Merge pull request #86 from hakril/add_ndr_tests

Add tests for NdrCString & NdrWString packing. Fix #84

.github/workflows/tests.yml

@@ -1,16 +1,32 @@
-# V0.1
 name: Pytest
 
-on: [push, workflow_dispatch]
+on:
+  push:
+    branches:
+      - 'master'
+  pull_request:
   # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
 
 jobs:
-  build:
+  generate_ctypes:
     runs-on: windows-latest
-    timeout-minutes: 15
+    timeout-minutes: 5
+    steps:
+        - uses: actions/checkout@v4
+        - uses: actions/setup-python@v5
+          with:
+            python-version: '3.11'
+        - run:
+            py .\ctypes_generation\generate.py
+        - name: Check generated code can execute
+          run: py -c "import windows.generated_def"
+  tests:
     strategy:
       fail-fast: false
       matrix:
+        runs-on: [windows-2022, windows-latest]
         python-version: [2.7, 3.6, 3.11]
         python-architecture: [x86, x64]
         include:
@@ -19,6 +35,10 @@ jobs:
               python-architecture: x86
             - python-bitness-to-test: 64
               python-architecture: x64
+    # Not a real dependency : but starting tests when ctypes generation is broken is not useful
+    needs: generate_ctypes
+    timeout-minutes: 15
+    runs-on: ${{ matrix.runs-on }}
 
     steps:
       - uses: actions/checkout@v4
@@ -31,6 +51,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version}}
           architecture: x86
+          update-environment: false
       ## Install the 64bits version of python3 asked
       - name: Set up Python3 ${{ matrix.python-version }} x64
         if: ${{ matrix.python-version != '2.7' }}
@@ -38,6 +59,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version}}
           architecture: x64
+          update-environment: false
 
       # Manually install python2.7 (both version at once)
       - name: Set up Python2.7 ${{ matrix.python-version }} x86 & x64
@@ -57,14 +79,50 @@ jobs:
             py -${{ matrix.python-version}}-64 setup.py install
 
       - name: Installing pytest & capstone-windows
-        run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pip install pytest capstone-windows
+        run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pip install pytest pytest-timeout capstone-windows
 
       # Testing
       - name: Testing
-        run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pytest --junitxml=junit/test-results.xml -s -k "not known_to_fail" -v tests/
+        run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pytest --junitxml=junit/test-results.xml -s -v tests/
 
       - name: Publish PyTest Results
-        uses: EnricoMi/publish-unit-test-result-action/composite@v1
+        uses: EnricoMi/publish-unit-test-result-action/windows@v2
         if: always()
         with:
-          files: junit/test-results.xml
+          files: junit/test-results.xml
+          check_name: PyTest Results for ${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}}
+          secondary_rate_limit_wait_seconds: 90
+          seconds_between_github_writes: 10
+          seconds_between_github_reads: 1
+
+#   tests_arm64:
+#     needs: generate_ctypes
+#     timeout-minutes: 15
+#     runs-on: windows-ARM64
+#     continue-on-error: true
+#
+#     strategy:
+#       fail-fast: false
+#       matrix:
+#         python-version: [3.11]
+#         python-architecture: [x86, x64, arm64]
+#         include:
+#             # Translate architecture to bitness for py.exe commandline
+#             - python-bitness-to-test: 32
+#               python-architecture: x86
+#             - python-bitness-to-test: 64
+#               python-architecture: x64
+#             - python-bitness-to-test: arm64
+#               python-architecture: arm64
+#
+#     steps:
+#       - uses: actions/checkout@v4
+#
+#       - name: Listing python versions availables
+#         run: py -0
+#
+#       - name: Testing PFW execute
+#         run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -c "import windows; print(windows)"
+#
+#       - name: Arm64 pytests
+#         run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pytest tests -k "not test_debugger" -v -s -r fEsx

.gitignore

@@ -3,7 +3,12 @@ doctrees
 *.inv
 *.pickle
 *.ignore
+*.code-workspace
 
 .vscode/
 .cache/
-dist/
+dist/
+build/
+docs/BuildDocEnv/
+playground/
+*egg-info/

CHANGELOG

@@ -1,3 +1,13 @@
+1.0.0:
+
+Unicode everywhere:
+	Whenever possible, PythonForWindows use W() (wide) APIs and returns unicode string.
+	This means `str` for python3 & `unicode` for python2.7
+
+windows.system.build_number now returns a int : the actual build number
+windows.system.build_number became windows.system.versionstr
+
+
 Between 0.4 & 0.5:
     == New features ==
         - windows.security

LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2016, Rouault Clement
+Copyright (c) 2016-2024, Rouault Clement
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without modification,

README.md

@@ -1,24 +1,25 @@
 # PythonForWindows
 
-[![Join the chat at https://gitter.im/PythonForWindows/general](https://badges.gitter.im/PythonForWindows/general.svg)](https://gitter.im/PythonForWindows/general)
+[![Pytest](https://github.com/hakril/PythonForWindows/actions/workflows/tests.yml/badge.svg?branch=master)](https://github.com/hakril/PythonForWindows/actions/workflows/tests.yml)
-[![Pytest](https://github.com/hakril/PythonForWindows/actions/workflows/mypytest.yml/badge.svg?branch=master)](https://github.com/hakril/PythonForWindows/actions/workflows/mypytest.yml)
 
 PythonForWindows (PFW) is a base of code aimed to make interaction with `Windows` (on X86/X64) easier (for both 32 and 64 bits Python).
 Its goal is to offer abstractions around some of the OS features in a (I hope) pythonic way.
 It also tries to make the barrier between python and native execution thinner in both ways.
 There is no external dependencies but it relies heavily on the `ctypes` module.
 
-
+Let's say that the codebase evolves with my needs, my researches and my curiosity.
-Some of this code is clean (IMHO) and some parts are just a wreck that works for now.
-Let's say that the codebase evolves with my needs and my curiosity.
 
 Complete online documentation is available [here][ONLINE_DOC]
 You can find some examples of code in the [samples directory][SAMPLE_DIR] or [online][ONLINE_SAMPLE].
 
-PythonForWindows is principally known for its ALPC-RPC Client (see [samples](http://hakril.github.io/PythonForWindows/build/html/sample.html#windows-rpc)).
+PythonForWindows is principally known for:
+
+- its ALPC-RPC Client (see [samples](https://hakril.github.io/PythonForWindows/build/html/sample.html#windows-rpc))
+- its generated [ctypes definitions](https://github.com/hakril/PythonForWindows/tree/master/windows/generated_def).
 
 
-If you have any issue, question or suggestion do not hesitate to join [the Gitter channel](https://gitter.im/PythonForWindows/general).
+
+If you have any issue, question or suggestion do not hesitate to create an issue or reach me out.
 I am always glad to have feedbacks from people using this project.
 
 ## Installation
@@ -36,12 +37,17 @@ You can also install PythonForWindows by cloning it and using the ``setup.py`` s
 python setup.py install
 ``
 
-#### Python3
+## Encoding & unicode
 
-PythonForWindows support python3 and is currently tested for Python2.7, 3.6 & 3.11 via [Github Workflow](https://github.com/hakril/PythonForWindows/actions/workflows/mypytest.yml)
+PythonForWindows support `python2.7` & `python3` and is currently tested for `Python2.7`, `3.6` & `3.11` via [Github Workflow](https://github.com/hakril/PythonForWindows/actions/workflows/tests.yml)
-Regarding the handling of encoding in the project it's currently a mix of Ascii & Unicode that may be awkward on Python3 as automatic encoding/decoding is not present.
+
+Since 1.0.0, the code uses "wide APIs" whenever possible and accept/returns python3 `str` (py2.7 `unicode` type) almost everywhere. Any functions/APIs not accepting unicode string can be  considered a bug if its not stated explicitly in the documentation.
+
+### Python2
+
+PythonForWindows continues to support python2.7 as its the only way to have it running on `Windows XP` & `Windows Server 2003` which are sadly still seen in production.
+Encoding errors at print time might be awkward for unicode string on python2, see the [PythonForWindows encoding guide](https://hakril.github.io/PythonForWindows/build/html/encoding.html) in the documentation.
 
-The aim of passing the whole project under unicode is actvily ongoing.
 
 ## Overview
 
@@ -531,6 +537,49 @@ The local debugger handles
 * Standard breakpoint ``int3``
 * Hardware Execution breakpoint ``DrX``
 
+### Symbols
+
+Classes around the Symbols APIs of `dbghelp.dll` are also implemented and can be used independently of the Debugger.
+The path of `dbghelp.dll` can also be given via the `PFW_DBGHELP_PATH` environment variable.
+
+
+```python
+# Python3
+
+>>> from windows.debug import symbols
+>>> # symbols.set_dbghelp_path(MY_DBGHELP_PATH)
+>>> symbols.engine.options = 0 # Disable defered load
+>>> sh = symbols.VirtualSymbolHandler()
+>>> ntmod = sh.load_file(r"c:\windows\system32\ntdll.dll", addr=0x420000)
+>>> ntmod
+<SymbolModule name="ntdll" type=SymPdb pdb="ntdll.pdb" addr=0x420000>
+>>> ntmod.name
+'ntdll'
+>>> ntmod.path
+'c:\\windows\\system32\\ntdll.dll'
+>>> ntmod.pdb
+'c:\\Symbols\\ntdll.pdb\\8D5D5ED5D5B8AA609A82600C14E3004D1\\ntdll.pdb'
+>>> sym = sh["ntdll!LdrLoadDll"]
+>>> sym
+<SymbolInfoW name="LdrLoadDll" start=0x44a160 tag=SymTagFunction>
+>>> sym.fullname
+'ntdll!LdrLoadDll'
+>>> hex(sym.addr)
+'0x44a160'
+>>> sh.search("ntdll!*CreateFile")
+[<SymbolInfoW name="EtwpCreateFile" start=0x47d9ec tag=SymTagFunction>, <SymbolInfoW name="EtwpCreateFile" start=0x47d9ec tag=SymTagPublicSymbol>, <SymbolInfoW name="NtCreateFile" start=0x4c03e0 tag=SymTagPublicSymbol>, <SymbolInfoW name="ZwCreateFile" start=0x4c03e0 tag=SymTagPublicSymbol>, <SymbolInfoW name="__imp_NtCreateFile" start=0x55cb70 tag=SymTagPublicSymbol>]
+# Some types exploration
+>>> peb = sh.get_type("ntdll!_PEB")
+>>> peb
+<SymbolType name="_PEB" tag=_SymTagEnum.SymTagUDT(0xb)>
+>>> peb.size
+2000
+>>> peb.children[:3]
+[<SymbolType name="InheritedAddressSpace" tag=_SymTagEnum.SymTagData(0x7)>, <SymbolType name="ReadImageFileExecOptions" tag=_SymTagEnum.SymTagData(0x7)>, <SymbolType name="BeingDebugged" tag=_SymTagEnum.SymTagData(0x7)>]
+>>> peb.children[2].offset
+2
+```
+
 ### Other stuff (see doc / samples)
 
 - Network
@@ -543,8 +592,8 @@ The local debugger handles
 
 [LKD_GITHUB]: https://github.com/sogeti-esec-lab/LKD/
 [SAMPLE_DIR]: https://github.com/hakril/PythonForWindows/tree/master/samples
-[ONLINE_DOC]: http://hakril.github.io/PythonForWindows/
+[ONLINE_DOC]: https://hakril.github.io/PythonForWindows/
-[ONLINE_SAMPLE]: http://hakril.github.io/PythonForWindows/build/html/sample.html
+[ONLINE_SAMPLE]: https://hakril.github.io/PythonForWindows/build/html/sample.html
-[ONLINE_SAMPLE_ALPC]: http://hakril.github.io/PythonForWindows/build/html/sample.html#windows-alpc
+[ONLINE_SAMPLE_ALPC]: https://hakril.github.io/PythonForWindows/build/html/sample.html#windows-alpc
-[ONLINE_SAMPLE_RPC]: http://hakril.github.io/PythonForWindows/build/html/sample.html#windows-rpc
+[ONLINE_SAMPLE_RPC]: https://hakril.github.io/PythonForWindows/build/html/sample.html#windows-rpc
-[ONLINE_IATHOOK]: http://hakril.github.io/PythonForWindows/build/html/iat_hook.html
+[ONLINE_IATHOOK]: https://hakril.github.io/PythonForWindows/build/html/iat_hook.html

ctypes_generation/com_parser.py

@@ -10,7 +10,7 @@ class WinComParser(Parser):
     PARAM_INFO =  ["__RPC__deref_out", "__RPC__in", "__RPC__deref_out_opt", "__RPC__out", "__RPC__in_opt",
         "__RPC__deref_opt_inout_opt", "__in", "__out", "__out_opt", "__in_opt", "__inout",
         "__reserved", "__RPC__in_opt_string", "__RPC__inout_opt", "__RPC__in_string", "__deref_out_opt", "__RPC__inout",
-        "__RPC__deref_out_opt_string", "_COM_Outptr_", "_In_", "_In_opt_", "_Out_"]
+        "__RPC__deref_out_opt_string", "_COM_Outptr_", "_In_", "_In_opt_", "_Out_", "__deref_out"]
     PARAM_INFO_WITH_VALUE = ["__RPC__in_ecount", "__RPC__out_ecount_part", "__RPC__in_ecount_full",
             "__RPC__in_range", "__RPC__out_ecount_full", "__out_ecount_opt", "__out_ecount", "__in_ecount_opt",
             "__in_ecount", "__out_bcount_opt", "__out_bcount", "__in_bcount", "__in_bcount_opt", "__RPC__out_ecount_full_string",

ctypes_generation/definitions/com/ICallFactory.txt

@@ -0,0 +1,29 @@
+typedef struct ICallFactoryVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            ICallFactory * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */
+            __RPC__deref_out  void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            ICallFactory * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            ICallFactory * This);
+
+        HRESULT ( STDMETHODCALLTYPE *CreateCall )(
+            ICallFactory * This,
+            /* [annotation][in] */
+            __in  REFIID riid,
+            /* [annotation][in] */
+            __in_opt  IUnknown *pCtrlUnk,
+            /* [annotation][in] */
+            __in  REFIID riid2,
+            /* [annotation][iid_is][out] */
+            __deref_out  IUnknown **ppv);
+
+        END_INTERFACE
+    } ICallFactoryVtbl;

ctypes_generation/definitions/com/IClassFactory.txt

@@ -0,0 +1,27 @@
+typedef struct IClassFactoryVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        IClassFactory * This,
+        /* [in] */ REFIID riid,
+        /* [iid_is][out] */ void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        IClassFactory * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        IClassFactory * This);
+
+    /* [local] */ HRESULT ( STDMETHODCALLTYPE *CreateInstance )(
+        IClassFactory * This,
+        /* [unique][in] */ IUnknown *pUnkOuter,
+        /* [in] */ REFIID riid,
+        /* [iid_is][out] */ void **ppvObject);
+
+    /* [local] */ HRESULT ( STDMETHODCALLTYPE *LockServer )(
+        IClassFactory * This,
+        /* [in] */ BOOL fLock);
+
+    END_INTERFACE
+} IClassFactoryVtbl;

ctypes_generation/definitions/com/IClientSecurity.txt

@@ -0,0 +1,63 @@
+typedef struct IClientSecurityVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IClientSecurity * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */
+            __RPC__deref_out  void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IClientSecurity * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IClientSecurity * This);
+
+        HRESULT ( STDMETHODCALLTYPE *QueryBlanket )(
+            IClientSecurity * This,
+            /* [annotation][in] */
+            __in  IUnknown *pProxy,
+            /* [annotation][out] */
+            __out  DWORD *pAuthnSvc,
+            /* [annotation][out] */
+            __out_opt  DWORD *pAuthzSvc,
+            /* [annotation][out] */
+            __RPC__deref_out_opt  OLECHAR **pServerPrincName,
+            /* [annotation][out] */
+            __out_opt  DWORD *pAuthnLevel,
+            /* [annotation][out] */
+            __out_opt  DWORD *pImpLevel,
+            /* [annotation][out] */
+            __deref_out_opt  void **pAuthInfo,
+            /* [annotation][out] */
+            __out_opt  DWORD *pCapabilites);
+
+        HRESULT ( STDMETHODCALLTYPE *SetBlanket )(
+            IClientSecurity * This,
+            /* [annotation][in] */
+            __in  IUnknown *pProxy,
+            /* [annotation][in] */
+            __in  DWORD dwAuthnSvc,
+            /* [annotation][in] */
+            __in  DWORD dwAuthzSvc,
+            /* [annotation][in] */
+            __RPC__in_opt  OLECHAR *pServerPrincName,
+            /* [annotation][in] */
+            __in  DWORD dwAuthnLevel,
+            /* [annotation][in] */
+            __in  DWORD dwImpLevel,
+            /* [annotation][in] */
+            __in_opt  void *pAuthInfo,
+            /* [annotation][in] */
+            __in  DWORD dwCapabilities);
+
+        HRESULT ( STDMETHODCALLTYPE *CopyProxy )(
+            IClientSecurity * This,
+            /* [annotation][in] */
+            __in  IUnknown *pProxy,
+            /* [annotation][out] */
+            __deref_out  IUnknown **ppCopy);
+
+        END_INTERFACE
+    } IClientSecurityVtbl;

ctypes_generation/definitions/com/IComCatalog.txt

@@ -0,0 +1,74 @@
+    typedef struct IComCatalogVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IComCatalog * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IComCatalog * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IComCatalog * This);
+
+        HRESULT ( STDMETHODCALLTYPE *GetClassInfo )(
+            IComCatalog * This,
+            /* [in] */ REFGUID guidConfiguredClsid,
+            /* [in] */ REFIID riid,
+            /* [out] */ void **ppv);
+
+        HRESULT ( STDMETHODCALLTYPE *GetApplicationInfo )(
+            IComCatalog * This,
+            /* [in] */ REFGUID guidApplId,
+            /* [in] */ REFIID riid,
+            /* [out] */ void **ppv);
+
+        HRESULT ( STDMETHODCALLTYPE *GetProcessInfo )(
+            IComCatalog * This,
+            /* [in] */ REFGUID guidProcess,
+            /* [in] */ REFIID riid,
+            /* [out] */ void **ppv);
+
+        HRESULT ( STDMETHODCALLTYPE *GetServerGroupInfo )(
+            IComCatalog * This,
+            /* [in] */ REFGUID guidServerGroup,
+            /* [in] */ REFIID riid,
+            /* [out] */ void **ppv);
+
+        HRESULT ( STDMETHODCALLTYPE *GetRetQueueInfo )(
+            IComCatalog * This,
+            /* [string][in] */ WCHAR *wszFormatName,
+            /* [in] */ REFIID riid,
+            /* [out] */ void **ppv);
+
+        HRESULT ( STDMETHODCALLTYPE *GetApplicationInfoForExe )(
+            IComCatalog * This,
+            /* [string][in] */ WCHAR *pwszExeName,
+            /* [in] */ REFIID riid,
+            /* [out] */ void **ppv);
+
+        HRESULT ( STDMETHODCALLTYPE *GetTypeLibrary )(
+            IComCatalog * This,
+            /* [in] */ REFGUID guidTypeLib,
+            /* [in] */ REFIID riid,
+            /* [out] */ void **ppv);
+
+        HRESULT ( STDMETHODCALLTYPE *GetInterfaceInfo )(
+            IComCatalog * This,
+            /* [in] */ REFIID iidInterface,
+            /* [in] */ REFIID riid,
+            /* [out] */ void **ppv);
+
+        HRESULT ( STDMETHODCALLTYPE *FlushCache )(
+            IComCatalog * This);
+
+        HRESULT ( STDMETHODCALLTYPE *GetClassInfoFromProgId )(
+            IComCatalog * This,
+            /* [in] */ WCHAR *pwszProgID,
+            /* [in] */ REFIID riid,
+            /* [out] */ void **ppv);
+
+        END_INTERFACE
+    } IComCatalogVtbl;

ctypes_generation/definitions/com/IInternalUnknown.txt

@@ -0,0 +1,22 @@
+    typedef struct IInternalUnknownVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IInternalUnknown * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IInternalUnknown * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IInternalUnknown * This);
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInternalInterface )(
+            IInternalUnknown * This,
+            /* [in] */ REFIID riid,
+            /* [out] */ void **ppv);
+
+        END_INTERFACE
+    } IInternalUnknownVtbl;

ctypes_generation/definitions/com/IMarshal.txt

@@ -0,0 +1,58 @@
+typedef struct IMarshalVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        IMarshal * This,
+        /* [in] */ REFIID riid,
+        /* [iid_is][out] */ void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        IMarshal * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        IMarshal * This);
+
+    HRESULT ( STDMETHODCALLTYPE *GetUnmarshalClass )(
+        IMarshal * This,
+        /* [in] */ REFIID riid,
+        /* [unique][in] */ void *pv,
+        /* [in] */ DWORD dwDestContext,
+        /* [unique][in] */ void *pvDestContext,
+        /* [in] */ DWORD mshlflags,
+        /* [out] */ CLSID *pCid);
+
+    HRESULT ( STDMETHODCALLTYPE *GetMarshalSizeMax )(
+        IMarshal * This,
+        /* [in] */ REFIID riid,
+        /* [unique][in] */ void *pv,
+        /* [in] */ DWORD dwDestContext,
+        /* [unique][in] */ void *pvDestContext,
+        /* [in] */ DWORD mshlflags,
+        /* [out] */ DWORD *pSize);
+
+    HRESULT ( STDMETHODCALLTYPE *MarshalInterface )(
+        IMarshal * This,
+        /* [unique][in] */ IStream *pStm,
+        /* [in] */ REFIID riid,
+        /* [unique][in] */ void *pv,
+        /* [in] */ DWORD dwDestContext,
+        /* [unique][in] */ void *pvDestContext,
+        /* [in] */ DWORD mshlflags);
+
+    HRESULT ( STDMETHODCALLTYPE *UnmarshalInterface )(
+        IMarshal * This,
+        /* [unique][in] */ IStream *pStm,
+        /* [in] */ REFIID riid,
+        /* [out] */ void **ppv);
+
+    HRESULT ( STDMETHODCALLTYPE *ReleaseMarshalData )(
+        IMarshal * This,
+        /* [unique][in] */ IStream *pStm);
+
+    HRESULT ( STDMETHODCALLTYPE *DisconnectObject )(
+        IMarshal * This,
+        /* [in] */ DWORD dwReserved);
+
+    END_INTERFACE
+} IMarshalVtbl;

ctypes_generation/definitions/com/IObjContext.txt

@@ -0,0 +1,67 @@
+typedef struct IObjContextVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IObjContext * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */
+             void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IObjContext * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IObjContext * This);
+
+        HRESULT ( STDMETHODCALLTYPE *SetProperty )(
+            IObjContext * This,
+            /* [annotation][in] */
+            __in  REFGUID rpolicyId,
+            /* [annotation][in] */
+            __in  CPFLAGS flags,
+            /* [annotation][in] */
+            __in  IUnknown *pUnk);
+
+        HRESULT ( STDMETHODCALLTYPE *RemoveProperty )(
+            IObjContext * This,
+            /* [annotation][in] */
+            __in  REFGUID rPolicyId);
+
+        HRESULT ( STDMETHODCALLTYPE *GetProperty )(
+            IObjContext * This,
+            /* [annotation][in] */
+            __in  REFGUID rGuid,
+            /* [annotation][out] */
+            __out  CPFLAGS *pFlags,
+            /* [annotation][out] */
+            __deref_out  IUnknown **ppUnk);
+
+        HRESULT ( STDMETHODCALLTYPE *EnumContextProps )(
+            IObjContext * This,
+            /* [annotation][out] */
+            __deref_out  IEnumContextProps **ppEnumContextProps);
+
+        PVOID ( STDMETHODCALLTYPE *Reserved1 )(
+            IObjContext * This);
+
+        PVOID ( STDMETHODCALLTYPE *Reserved2 )(
+            IObjContext * This);
+
+        PVOID ( STDMETHODCALLTYPE *Reserved3 )(
+            IObjContext * This);
+
+        PVOID ( STDMETHODCALLTYPE *Reserved4 )(
+            IObjContext * This);
+
+        PVOID ( STDMETHODCALLTYPE *Reserved5 )(
+            IObjContext * This);
+
+        PVOID ( STDMETHODCALLTYPE *Reserved6 )(
+            IObjContext * This);
+
+        PVOID ( STDMETHODCALLTYPE *Reserved7 )(
+            IObjContext * This);
+
+        END_INTERFACE
+    } IObjContextVtbl;

ctypes_generation/definitions/com/IRemUnknown.txt

@@ -0,0 +1,36 @@
+    typedef struct IRemUnknownVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IRemUnknown * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IRemUnknown * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IRemUnknown * This);
+
+        HRESULT ( STDMETHODCALLTYPE *RemQueryInterface )(
+            IRemUnknown * This,
+            /* [in] */ REFIPID ripid,
+            /* [in] */ ULONG cRefs,
+            /* [in] */ USHORT cIids,
+            /* [size_is][in] */ IID *iids,
+            /* [size_is][size_is][out] */ REMQIRESULT **ppQIResults);
+
+        HRESULT ( STDMETHODCALLTYPE *RemAddRef )(
+            IRemUnknown * This,
+            /* [in] */ USHORT cInterfaceRefs,
+            /* [size_is][in] */ REMINTERFACEREF *InterfaceRefs,
+            /* [size_is][out] */ HRESULT *pResults);
+
+        HRESULT ( STDMETHODCALLTYPE *RemRelease )(
+            IRemUnknown * This,
+            /* [in] */ USHORT cInterfaceRefs,
+            /* [size_is][in] */ REMINTERFACEREF *InterfaceRefs);
+
+        END_INTERFACE
+    } IRemUnknownVtbl;

ctypes_generation/definitions/com/IStdIdentity.txt

@@ -0,0 +1,20 @@
+// IStdIdentity is an empty interface to check that an object is the IStdIdentity
+// and thus query other interface
+typedef struct IStdIdentityVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        IUnknown * This,
+        /* [in] */ REFIID riid,
+        /* [annotation][iid_is][out] */
+        __RPC__deref_out  void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        IUnknown * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        IUnknown * This);
+
+    END_INTERFACE
+} IStdIdentityVtbl;

ctypes_generation/definitions/com/IStorage.txt

@@ -0,0 +1,108 @@
+    typedef struct IStorageVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IStorage * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IStorage * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IStorage * This);
+
+        HRESULT ( STDMETHODCALLTYPE *CreateStream )(
+            IStorage * This,
+            /* [string][in] */ const OLECHAR *pwcsName,
+            /* [in] */ DWORD grfMode,
+            /* [in] */ DWORD reserved1,
+            /* [in] */ DWORD reserved2,
+            /* [out] */ IStream **ppstm);
+
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *OpenStream )(
+            IStorage * This,
+            /* [string][in] */ const OLECHAR *pwcsName,
+            /* [unique][in] */ void *reserved1,
+            /* [in] */ DWORD grfMode,
+            /* [in] */ DWORD reserved2,
+            /* [out] */ IStream **ppstm);
+
+        HRESULT ( STDMETHODCALLTYPE *CreateStorage )(
+            IStorage * This,
+            /* [string][in] */ const OLECHAR *pwcsName,
+            /* [in] */ DWORD grfMode,
+            /* [in] */ DWORD reserved1,
+            /* [in] */ DWORD reserved2,
+            /* [out] */ IStorage **ppstg);
+
+        HRESULT ( STDMETHODCALLTYPE *OpenStorage )(
+            IStorage * This,
+            /* [string][unique][in] */ const OLECHAR *pwcsName,
+            /* [unique][in] */ IStorage *pstgPriority,
+            /* [in] */ DWORD grfMode,
+            /* [unique][in] */ SNB snbExclude,
+            /* [in] */ DWORD reserved,
+            /* [out] */ IStorage **ppstg);
+
+        HRESULT ( STDMETHODCALLTYPE *CopyTo )(
+            IStorage * This,
+            /* [in] */ DWORD ciidExclude,
+            /* [size_is][unique][in] */ const IID *rgiidExclude,
+            /* [unique][in] */ SNB snbExclude,
+            /* [unique][in] */ IStorage *pstgDest);
+
+        HRESULT ( STDMETHODCALLTYPE *MoveElementTo )(
+            IStorage * This,
+            /* [string][in] */ const OLECHAR *pwcsName,
+            /* [unique][in] */ IStorage *pstgDest,
+            /* [string][in] */ const OLECHAR *pwcsNewName,
+            /* [in] */ DWORD grfFlags);
+
+        HRESULT ( STDMETHODCALLTYPE *Commit )(
+            IStorage * This,
+            /* [in] */ DWORD grfCommitFlags);
+
+        HRESULT ( STDMETHODCALLTYPE *Revert )(
+            IStorage * This);
+
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *EnumElements )(
+            IStorage * This,
+            /* [in] */ DWORD reserved1,
+            /* [size_is][unique][in] */ void *reserved2,
+            /* [in] */ DWORD reserved3,
+            /* [out] */ IEnumSTATSTG **ppenum);
+
+        HRESULT ( STDMETHODCALLTYPE *DestroyElement )(
+            IStorage * This,
+            /* [string][in] */ const OLECHAR *pwcsName);
+
+        HRESULT ( STDMETHODCALLTYPE *RenameElement )(
+            IStorage * This,
+            /* [string][in] */ const OLECHAR *pwcsOldName,
+            /* [string][in] */ const OLECHAR *pwcsNewName);
+
+        HRESULT ( STDMETHODCALLTYPE *SetElementTimes )(
+            IStorage * This,
+            /* [string][unique][in] */ const OLECHAR *pwcsName,
+            /* [unique][in] */ const FILETIME *pctime,
+            /* [unique][in] */ const FILETIME *patime,
+            /* [unique][in] */ const FILETIME *pmtime);
+
+        HRESULT ( STDMETHODCALLTYPE *SetClass )(
+            IStorage * This,
+            /* [in] */ REFCLSID clsid);
+
+        HRESULT ( STDMETHODCALLTYPE *SetStateBits )(
+            IStorage * This,
+            /* [in] */ DWORD grfStateBits,
+            /* [in] */ DWORD grfMask);
+
+        HRESULT ( STDMETHODCALLTYPE *Stat )(
+            IStorage * This,
+            /* [out] */ STATSTG *pstatstg,
+            /* [in] */ DWORD grfStatFlag);
+
+        END_INTERFACE
+    } IStorageVtbl;

ctypes_generation/definitions/com/MYTEST.txt.ignore

@@ -1,28 +0,0 @@
-typedef struct MyClsVtbl
-{
-    BEGIN_INTERFACE
-
-    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
-        MyCls * This,
-        /* [in] */ REFIID riid,
-        /* [annotation][iid_is][out] */
-        __RPC__deref_out  void **ppvObject);
-
-    ULONG ( STDMETHODCALLTYPE *AddRef )(
-        MyCls * This);
-
-    ULONG ( STDMETHODCALLTYPE *Release )(
-        MyCls * This);
-
-    HRESULT ( STDMETHODCALLTYPE *add )(
-        MyCls * This,
-        /* [in] */ UINT x,
-        /* [in] */ UINT y,
-        /* [out] */ UINT *res);
-
-    HRESULT ( STDMETHODCALLTYPE *print_state )(
-        MyCls * This);
-
-    END_INTERFACE
-} MyClsVtbl;
-

ctypes_generation/definitions/com/combase/IActivationProperties.txt

@@ -0,0 +1,74 @@
+typedef struct IActivationPropertiesVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        IActivationProperties * This,
+        /* [in] */ REFIID riid,
+        /* [iid_is][out] */ void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        IActivationProperties * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        IActivationProperties * This);
+
+    HRESULT ( STDMETHODCALLTYPE *GetUnmarshalClass )(
+        IActivationProperties * This,
+        /* [in] */ REFIID riid,
+        /* [unique][in] */ void *pv,
+        /* [in] */ DWORD dwDestContext,
+        /* [unique][in] */ void *pvDestContext,
+        /* [in] */ DWORD mshlflags,
+        /* [out] */ CLSID *pCid);
+
+    HRESULT ( STDMETHODCALLTYPE *GetMarshalSizeMax )(
+        IActivationProperties * This,
+        /* [in] */ REFIID riid,
+        /* [unique][in] */ void *pv,
+        /* [in] */ DWORD dwDestContext,
+        /* [unique][in] */ void *pvDestContext,
+        /* [in] */ DWORD mshlflags,
+        /* [out] */ DWORD *pSize);
+
+    HRESULT ( STDMETHODCALLTYPE *MarshalInterface )(
+        IActivationProperties * This,
+        /* [unique][in] */ IStream *pStm,
+        /* [in] */ REFIID riid,
+        /* [unique][in] */ void *pv,
+        /* [in] */ DWORD dwDestContext,
+        /* [unique][in] */ void *pvDestContext,
+        /* [in] */ DWORD mshlflags);
+
+    HRESULT ( STDMETHODCALLTYPE *UnmarshalInterface )(
+        IActivationProperties * This,
+        /* [unique][in] */ IStream *pStm,
+        /* [in] */ REFIID riid,
+        /* [out] */ void **ppv);
+
+    HRESULT ( STDMETHODCALLTYPE *ReleaseMarshalData )(
+        IActivationProperties * This,
+        /* [unique][in] */ IStream *pStm);
+
+    HRESULT ( STDMETHODCALLTYPE *DisconnectObject )(
+        IActivationProperties * This,
+        /* [in] */ DWORD dwReserved);
+
+    HRESULT ( STDMETHODCALLTYPE *SetDestCtx )(
+        IActivationProperties * This,
+        /* [in] */ DWORD dwDestCtx);
+
+    HRESULT ( STDMETHODCALLTYPE *SetMarshalFlags )(
+        IActivationProperties * This,
+        /* [in] */ DWORD dwMarshalFlags);
+
+    HRESULT ( STDMETHODCALLTYPE *SetLocalBlob )(
+        IActivationProperties * This,
+        /* [in] */ void *blob);
+
+    HRESULT ( STDMETHODCALLTYPE *GetLocalBlob )(
+        IActivationProperties * This,
+        /* [out] */ void **blob);
+
+    END_INTERFACE
+} IActivationPropertiesVtbl;

ctypes_generation/definitions/com/combase/IActivationPropertiesOut.txt

@@ -0,0 +1,38 @@
+typedef struct IActivationPropertiesOutVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        IActivationPropertiesOut * This,
+        /* [in] */ REFIID riid,
+        /* [iid_is][out] */ void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        IActivationPropertiesOut * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        IActivationPropertiesOut * This);
+
+    HRESULT ( STDMETHODCALLTYPE *GetActivationID )(
+        IActivationPropertiesOut * This,
+        /* [out] */ GUID *pActivationID);
+
+    HRESULT ( STDMETHODCALLTYPE *GetObjectInterface )(
+        IActivationPropertiesOut * This,
+        /* [in] */ REFIID riid,
+        /* [in] */ DWORD actvflags,
+        /* [iid_is][out] */ void **ppv);
+
+    HRESULT ( STDMETHODCALLTYPE *GetObjectInterfaces )(
+        IActivationPropertiesOut * This,
+        /* [in] */ DWORD cIfs,
+        /* [in] */ DWORD actvflags,
+        /* [size_is][in] */ MULTI_QI *multiQi);
+
+    HRESULT ( STDMETHODCALLTYPE *RemoveRequestedIIDs )(
+        IActivationPropertiesOut * This,
+        /* [in] */ DWORD cIfs,
+        /* [size_is][in] */ IID *rgIID);
+
+    END_INTERFACE
+} IActivationPropertiesOutVtbl;

ctypes_generation/definitions/com/combase/IActivationPropertyIn.txt

@@ -0,0 +1,64 @@
+typedef struct IActivationPropertiesInVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        IActivationPropertiesIn * This,
+        /* [in] */ REFIID riid,
+        /* [iid_is][out] */ void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        IActivationPropertiesIn * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        IActivationPropertiesIn * This);
+
+    HRESULT ( STDMETHODCALLTYPE *GetActivationID )(
+        IActivationPropertiesIn * This,
+        /* [out] */ GUID *pActivationID);
+
+    HRESULT ( STDMETHODCALLTYPE *GetClassInfo )(
+        IActivationPropertiesIn * This,
+        /* [in] */ REFIID riid,
+        /* [iid_is][out] */ void **ppv);
+
+    HRESULT ( STDMETHODCALLTYPE *GetClsctx )(
+        IActivationPropertiesIn * This,
+        /* [out] */ DWORD *pclsctx);
+
+    HRESULT ( STDMETHODCALLTYPE *GetActivationFlags )(
+        IActivationPropertiesIn * This,
+        /* [out] */ DWORD *pactvflags);
+
+    HRESULT ( STDMETHODCALLTYPE *AddRequestedIIDs )(
+        IActivationPropertiesIn * This,
+        /* [in] */ DWORD cIfs,
+        /* [size_is][in] */ IID *rgIID);
+
+    HRESULT ( STDMETHODCALLTYPE *GetRequestedIIDs )(
+        IActivationPropertiesIn * This,
+        /* [out] */ ULONG *pulCount,
+        /* [out] */ IID **prgIID);
+
+    HRESULT ( STDMETHODCALLTYPE *DelegateGetClassObject )(
+        IActivationPropertiesIn * This,
+        /* [out] */ IActivationPropertiesOut **pActPropsOut);
+
+    HRESULT ( STDMETHODCALLTYPE *DelegateCreateInstance )(
+        IActivationPropertiesIn * This,
+        /* [in] */ IUnknown *pUnkOuter,
+        /* [out] */ IActivationPropertiesOut **pActPropsOut);
+
+    HRESULT ( STDMETHODCALLTYPE *DelegateCIAndGetCF )(
+        IActivationPropertiesIn * This,
+        /* [in] */ IUnknown *pUnkOuter,
+        /* [out] */ IActivationPropertiesOut **pActPropsOut,
+        /* [out] */ IClassFactory **ppCf);
+
+    HRESULT ( STDMETHODCALLTYPE *GetReturnActivationProperties )(
+        IActivationPropertiesIn * This,
+        /* [in] */ IUnknown *pUnk,
+        /* [out] */ IActivationPropertiesOut **ppActOut);
+
+    END_INTERFACE
+} IActivationPropertiesInVtbl;

ctypes_generation/definitions/com/combase/IActivationStageInfo.txt

@@ -0,0 +1,30 @@
+typedef struct IActivationStageInfoVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        IActivationStageInfo * This,
+        /* [in] */ REFIID riid,
+        /* [iid_is][out] */ void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        IActivationStageInfo * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        IActivationStageInfo * This);
+
+    HRESULT ( STDMETHODCALLTYPE *SetStageAndIndex )(
+        IActivationStageInfo * This,
+        /* [in] */ ACTIVATION_STAGE stage,
+        /* [in] */ int index);
+
+    HRESULT ( STDMETHODCALLTYPE *GetStage )(
+        IActivationStageInfo * This,
+        /* [out] */ ACTIVATION_STAGE *pstage);
+
+    HRESULT ( STDMETHODCALLTYPE *GetIndex )(
+        IActivationStageInfo * This,
+        /* [out] */ int *pindex);
+
+    END_INTERFACE
+} IActivationStageInfoVtbl;

ctypes_generation/definitions/com/combase/IClassClassicInfo.txt

@@ -0,0 +1,47 @@
+    typedef struct IClassClassicInfoVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IClassClassicInfo * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IClassClassicInfo * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IClassClassicInfo * This);
+
+        HRESULT ( STDMETHODCALLTYPE *GetThreadingModel )(
+            IClassClassicInfo * This,
+            /* [out] */ ThreadingModel *pthreadmodel);
+
+        HRESULT ( STDMETHODCALLTYPE *GetModulePath )(
+            IClassClassicInfo * This,
+            /* [in] */ CLSCTX clsctx,
+            /* [string][out] */ WCHAR **pwszDllName);
+
+        HRESULT ( STDMETHODCALLTYPE *GetImplementedClsid )(
+            IClassClassicInfo * This,
+            /* [out] */ GUID **ppguidClsid);
+
+        HRESULT ( STDMETHODCALLTYPE *GetProcess )(
+            IClassClassicInfo * This,
+            /* [in] */ REFIID riid,
+            /* [out] */ void **ppv);
+
+        HRESULT ( STDMETHODCALLTYPE *GetRemoteServerName )(
+            IClassClassicInfo * This,
+            /* [out] */ WCHAR **pwszServerName);
+
+        HRESULT ( STDMETHODCALLTYPE *GetLocalServerType )(
+            IClassClassicInfo * This,
+            /* [out] */ LocalServerType *pType);
+
+        HRESULT ( STDMETHODCALLTYPE *GetSurrogateCommandLine )(
+            IClassClassicInfo * This,
+            /* [out] */ WCHAR **pwszSurrogateCommandLine);
+
+        END_INTERFACE
+    } IClassClassicInfoVtbl;

ctypes_generation/definitions/com/combase/IComClassInfo.txt

@@ -0,0 +1,78 @@
+    typedef struct IComClassInfoVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IComClassInfo * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IComClassInfo * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IComClassInfo * This);
+
+        HRESULT ( STDMETHODCALLTYPE *GetConfiguredClsid )(
+            IComClassInfo * This,
+            /* [out] */ GUID **ppguidClsid);
+
+        HRESULT ( STDMETHODCALLTYPE *GetProgId )(
+            IComClassInfo * This,
+            /* [out] */ WCHAR **pwszProgid);
+
+        HRESULT ( STDMETHODCALLTYPE *GetClassName )(
+            IComClassInfo * This,
+            /* [out] */ WCHAR **pwszClassName);
+
+        HRESULT ( STDMETHODCALLTYPE *GetApplication )(
+            IComClassInfo * This,
+            /* [in] */ REFIID riid,
+            /* [out] */ void **ppv);
+
+        HRESULT ( STDMETHODCALLTYPE *GetClassContext )(
+            IComClassInfo * This,
+            /* [in] */ CLSCTX clsctxFilter,
+            /* [out] */ CLSCTX *pclsctx);
+
+        HRESULT ( STDMETHODCALLTYPE *GetCustomActivatorCount )(
+            IComClassInfo * This,
+            /* [in] */ ACTIVATION_STAGE activationStage,
+            /* [out] */ ULONG *pulCount);
+
+        HRESULT ( STDMETHODCALLTYPE *GetCustomActivatorClsids )(
+            IComClassInfo * This,
+            /* [in] */ ACTIVATION_STAGE activationStage,
+            /* [out] */ GUID **prgguidClsid);
+
+        HRESULT ( STDMETHODCALLTYPE *GetCustomActivators )(
+            IComClassInfo * This,
+            /* [in] */ ACTIVATION_STAGE activationStage,
+            /* [out] */ ISystemActivator ***prgpActivator);
+
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )(
+            IComClassInfo * This,
+            /* [in] */ REFIID riid,
+            /* [out] */ void **ppv);
+
+        HRESULT ( STDMETHODCALLTYPE *IsComPlusConfiguredClass )(
+            IComClassInfo * This,
+            /* [out] */ BOOL *pfComPlusConfiguredClass);
+
+        HRESULT ( STDMETHODCALLTYPE *MustRunInClientContext )(
+            IComClassInfo * This,
+            /* [out] */ BOOL *pbMustRunInClientContext);
+
+        HRESULT ( STDMETHODCALLTYPE *GetVersionNumber )(
+            IComClassInfo * This,
+            /* [out] */ DWORD *pdwVersionMS,
+            /* [out] */ DWORD *pdwVersionLS);
+
+        HRESULT ( STDMETHODCALLTYPE *Lock )(
+            IComClassInfo * This);
+
+        HRESULT ( STDMETHODCALLTYPE *Unlock )(
+            IComClassInfo * This);
+
+        END_INTERFACE
+    } IComClassInfoVtbl;

ctypes_generation/definitions/com/combase/IContext.txt

@@ -0,0 +1,37 @@
+typedef struct IContextVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        IContext * This,
+        /* [in] */ REFIID riid,
+        /* [iid_is][out] */ void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        IContext * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        IContext * This);
+
+    HRESULT ( STDMETHODCALLTYPE *SetProperty )(
+        IContext * This,
+        /* [in] */ REFGUID rpolicyId,
+        /* [in] */ CPFLAGS flags,
+        /* [in] */ IUnknown *pUnk);
+
+    HRESULT ( STDMETHODCALLTYPE *RemoveProperty )(
+        IContext * This,
+        /* [in] */ REFGUID rPolicyId);
+
+    HRESULT ( STDMETHODCALLTYPE *GetProperty )(
+        IContext * This,
+        /* [in] */ REFGUID rGuid,
+        /* [out] */ CPFLAGS *pFlags,
+        /* [out] */ IUnknown **ppUnk);
+
+    HRESULT ( STDMETHODCALLTYPE *EnumContextProps )(
+        IContext * This,
+        /* [out] */ IEnumContextProps **ppEnumContextProps);
+
+    END_INTERFACE
+} IContextVtbl;

ctypes_generation/definitions/com/combase/IEnumContextProps.txt

@@ -0,0 +1,38 @@
+typedef struct IEnumContextPropsVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        IEnumContextProps * This,
+        /* [in] */ REFIID riid,
+        /* [iid_is][out] */ void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        IEnumContextProps * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        IEnumContextProps * This);
+
+    HRESULT ( STDMETHODCALLTYPE *Next )(
+        IEnumContextProps * This,
+        /* [in] */ ULONG celt,
+        /* [length_is][size_is][out] */ ContextProperty *pContextProperties,
+        /* [out] */ ULONG *pceltFetched);
+
+    HRESULT ( STDMETHODCALLTYPE *Skip )(
+        IEnumContextProps * This,
+        /* [in] */ ULONG celt);
+
+    HRESULT ( STDMETHODCALLTYPE *Reset )(
+        IEnumContextProps * This);
+
+    HRESULT ( STDMETHODCALLTYPE *Clone )(
+        IEnumContextProps * This,
+        /* [out] */ IEnumContextProps **ppEnumContextProps);
+
+    HRESULT ( STDMETHODCALLTYPE *Count )(
+        IEnumContextProps * This,
+        /* [out] */ ULONG *pcelt);
+
+    END_INTERFACE
+} IEnumContextPropsVtbl;

ctypes_generation/definitions/com/combase/IEnumSTATSTG.txt

@@ -0,0 +1,34 @@
+    typedef struct IEnumSTATSTGVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IEnumSTATSTG * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IEnumSTATSTG * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IEnumSTATSTG * This);
+
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Next )(
+            IEnumSTATSTG * This,
+            /* [in] */ ULONG celt,
+            /* [length_is][size_is][out] */ STATSTG *rgelt,
+            /* [out] */ ULONG *pceltFetched);
+
+        HRESULT ( STDMETHODCALLTYPE *Skip )(
+            IEnumSTATSTG * This,
+            /* [in] */ ULONG celt);
+
+        HRESULT ( STDMETHODCALLTYPE *Reset )(
+            IEnumSTATSTG * This);
+
+        HRESULT ( STDMETHODCALLTYPE *Clone )(
+            IEnumSTATSTG * This,
+            /* [out] */ IEnumSTATSTG **ppenum);
+
+        END_INTERFACE
+    } IEnumSTATSTGVtbl;

ctypes_generation/definitions/com/combase/IInitActivationPropertiesIn.txt

@@ -0,0 +1,43 @@
+typedef struct IInitActivationPropertiesInVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        IInitActivationPropertiesIn * This,
+        /* [in] */ REFIID riid,
+        /* [iid_is][out] */ void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        IInitActivationPropertiesIn * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        IInitActivationPropertiesIn * This);
+
+    HRESULT ( STDMETHODCALLTYPE *SetClsctx )(
+        IInitActivationPropertiesIn * This,
+        /* [in] */ DWORD clsctx);
+
+    HRESULT ( STDMETHODCALLTYPE *SetActivationFlags )(
+        IInitActivationPropertiesIn * This,
+        /* [in] */ DWORD actvflags);
+
+    HRESULT ( STDMETHODCALLTYPE *SetClassInfo )(
+        IInitActivationPropertiesIn * This,
+        /* [unique][in] */ IUnknown *pUnkClassInfo);
+
+    HRESULT ( STDMETHODCALLTYPE *SetContextInfo )(
+        IInitActivationPropertiesIn * This,
+        /* [unique][in] */ IContext *pClientContext,
+        /* [in] */ IContext *pPrototypeContext);
+
+    HRESULT ( STDMETHODCALLTYPE *SetConstructFromStorage )(
+        IInitActivationPropertiesIn * This,
+        /* [unique][in] */ IStorage *pStorage);
+
+    HRESULT ( STDMETHODCALLTYPE *SetConstructFromFile )(
+        IInitActivationPropertiesIn * This,
+        /* [in] */ WCHAR *wszFileName,
+        /* [in] */ DWORD dwMode);
+
+    END_INTERFACE
+} IInitActivationPropertiesInVtbl;

ctypes_generation/definitions/com/combase/IOpaqueData.txt

@@ -0,0 +1,38 @@
+typedef struct IOpaqueDataInfoVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        IOpaqueDataInfo * This,
+        /* [in] */ REFIID riid,
+        /* [iid_is][out] */ void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        IOpaqueDataInfo * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        IOpaqueDataInfo * This);
+
+    HRESULT ( STDMETHODCALLTYPE *AddOpaqueData )(
+        IOpaqueDataInfo * This,
+        /* [in] */ OpaqueData *pData);
+
+    HRESULT ( STDMETHODCALLTYPE *GetOpaqueData )(
+        IOpaqueDataInfo * This,
+        /* [in] */ REFGUID guid,
+        /* [out] */ OpaqueData **pData);
+
+    HRESULT ( STDMETHODCALLTYPE *DeleteOpaqueData )(
+        IOpaqueDataInfo * This,
+        /* [in] */ REFGUID guid);
+
+    HRESULT ( STDMETHODCALLTYPE *GetOpaqueDataCount )(
+        IOpaqueDataInfo * This,
+        /* [out] */ ULONG *pulCount);
+
+    HRESULT ( STDMETHODCALLTYPE *GetAllOpaqueData )(
+        IOpaqueDataInfo * This,
+        /* [out] */ OpaqueData **prgData);
+
+    END_INTERFACE
+} IOpaqueDataInfoVtbl;

ctypes_generation/definitions/com/combase/IPrivActivationPropertiesIn.txt

@@ -0,0 +1,84 @@
+    typedef struct IPrivActivationPropertiesInVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IPrivActivationPropertiesIn * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IPrivActivationPropertiesIn * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IPrivActivationPropertiesIn * This);
+
+        HRESULT ( STDMETHODCALLTYPE *GetActivationID )(
+            IPrivActivationPropertiesIn * This,
+            /* [out] */ GUID *pActivationID);
+
+        HRESULT ( STDMETHODCALLTYPE *GetClassInfo )(
+            IPrivActivationPropertiesIn * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppv);
+
+        HRESULT ( STDMETHODCALLTYPE *GetClsctx )(
+            IPrivActivationPropertiesIn * This,
+            /* [out] */ DWORD *pclsctx);
+
+        HRESULT ( STDMETHODCALLTYPE *GetActivationFlags )(
+            IPrivActivationPropertiesIn * This,
+            /* [out] */ DWORD *pactvflags);
+
+        HRESULT ( STDMETHODCALLTYPE *AddRequestedIIDs )(
+            IPrivActivationPropertiesIn * This,
+            /* [in] */ DWORD cIfs,
+            /* [size_is][in] */ IID *rgIID);
+
+        HRESULT ( STDMETHODCALLTYPE *GetRequestedIIDs )(
+            IPrivActivationPropertiesIn * This,
+            /* [out] */ ULONG *pulCount,
+            /* [out] */ IID **prgIID);
+
+        HRESULT ( STDMETHODCALLTYPE *DelegateGetClassObject )(
+            IPrivActivationPropertiesIn * This,
+            /* [out] */ IActivationPropertiesOut **pActPropsOut);
+
+        HRESULT ( STDMETHODCALLTYPE *DelegateCreateInstance )(
+            IPrivActivationPropertiesIn * This,
+            /* [in] */ IUnknown *pUnkOuter,
+            /* [out] */ IActivationPropertiesOut **pActPropsOut);
+
+        HRESULT ( STDMETHODCALLTYPE *DelegateCIAndGetCF )(
+            IPrivActivationPropertiesIn * This,
+            /* [in] */ IUnknown *pUnkOuter,
+            /* [out] */ IActivationPropertiesOut **pActPropsOut,
+            /* [out] */ IClassFactory **ppCf);
+
+        HRESULT ( STDMETHODCALLTYPE *GetReturnActivationProperties )(
+            IPrivActivationPropertiesIn * This,
+            /* [in] */ IUnknown *pUnk,
+            /* [out] */ IActivationPropertiesOut **ppActOut);
+
+        HRESULT ( STDMETHODCALLTYPE *PrivGetReturnActivationProperties )(
+            IPrivActivationPropertiesIn * This,
+            /* [out] */ IPrivActivationPropertiesOut **ppActOut);
+
+        HRESULT ( STDMETHODCALLTYPE *GetCOMVersion )(
+            IPrivActivationPropertiesIn * This,
+            /* [out] */ COMVERSION *pVersion);
+
+        HRESULT ( STDMETHODCALLTYPE *GetClsid )(
+            IPrivActivationPropertiesIn * This,
+            /* [out] */ CLSID *pClsid);
+
+        HRESULT ( STDMETHODCALLTYPE *GetClientToken )(
+            IPrivActivationPropertiesIn * This,
+            /* [out] */ HANDLE *pHandle);
+
+        HRESULT ( STDMETHODCALLTYPE *GetDestCtx )(
+            IPrivActivationPropertiesIn * This,
+            /* [out] */ DWORD *pdwDestCtx);
+
+        END_INTERFACE
+    } IPrivActivationPropertiesInVtbl;

ctypes_generation/definitions/com/combase/IPrivActivationPropertiesOut.txt

@@ -0,0 +1,58 @@
+    typedef struct IPrivActivationPropertiesOutVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IPrivActivationPropertiesOut * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IPrivActivationPropertiesOut * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IPrivActivationPropertiesOut * This);
+
+        HRESULT ( STDMETHODCALLTYPE *GetActivationID )(
+            IPrivActivationPropertiesOut * This,
+            /* [out] */ GUID *pActivationID);
+
+        HRESULT ( STDMETHODCALLTYPE *GetObjectInterface )(
+            IPrivActivationPropertiesOut * This,
+            /* [in] */ REFIID riid,
+            /* [in] */ DWORD actvflags,
+            /* [iid_is][out] */ void **ppv);
+
+        HRESULT ( STDMETHODCALLTYPE *GetObjectInterfaces )(
+            IPrivActivationPropertiesOut * This,
+            /* [in] */ DWORD cIfs,
+            /* [in] */ DWORD actvflags,
+            /* [size_is][in] */ MULTI_QI *multiQi);
+
+        HRESULT ( STDMETHODCALLTYPE *RemoveRequestedIIDs )(
+            IPrivActivationPropertiesOut * This,
+            /* [in] */ DWORD cIfs,
+            /* [size_is][in] */ IID *rgIID);
+
+        HRESULT ( STDMETHODCALLTYPE *SetObjectInterfaces )(
+            IPrivActivationPropertiesOut * This,
+            /* [in] */ DWORD cIfs,
+            /* [in] */ IID *pIID,
+            /* [in] */ IUnknown *pUnk);
+
+        HRESULT ( STDMETHODCALLTYPE *SetMarshalledResults )(
+            IPrivActivationPropertiesOut * This,
+            /* [in] */ DWORD cIfs,
+            /* [in] */ IID *pIID,
+            /* [in] */ HRESULT *pHr,
+            /* [in] */ MInterfacePointer **pIntfData);
+
+        HRESULT ( STDMETHODCALLTYPE *GetMarshalledResults )(
+            IPrivActivationPropertiesOut * This,
+            /* [out] */ DWORD *pcIfs,
+            /* [out] */ IID **pIID,
+            /* [out] */ HRESULT **pHr,
+            /* [out] */ MInterfacePointer ***pIntfData);
+
+        END_INTERFACE
+    } IPrivActivationPropertiesOutVtbl;

ctypes_generation/definitions/com/combase/IScmReplyInfo.txt

@@ -0,0 +1,33 @@
+    typedef struct IScmReplyInfoVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IScmReplyInfo * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IScmReplyInfo * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IScmReplyInfo * This);
+
+        HRESULT ( STDMETHODCALLTYPE *SetResolverInfo )(
+            IScmReplyInfo * This,
+            /* [in] */ PRIV_RESOLVER_INFO *pResolverInfo); /* Need to be cast to PRIV_RESOLVER_INFO_LEGACY on old windows */
+
+        HRESULT ( STDMETHODCALLTYPE *GetResolverInfo )(
+            IScmReplyInfo * This,
+            /* [out] */ PRIV_RESOLVER_INFO **ppResolverInfo); /* Need to be cast to PRIV_RESOLVER_INFO_LEGACY on old windows */
+
+        HRESULT ( STDMETHODCALLTYPE *SetRemoteReplyInfo )(
+            IScmReplyInfo * This,
+            /* [in] */ REMOTE_REPLY_SCM_INFO *pRemoteReply);
+
+        HRESULT ( STDMETHODCALLTYPE *GetRemoteReplyInfo )(
+            IScmReplyInfo * This,
+            /* [out] */ REMOTE_REPLY_SCM_INFO **ppRemoteReply);
+
+        END_INTERFACE
+    } IScmReplyInfoVtbl;

ctypes_generation/definitions/com/combase/IScmRequestInfo.txt

@@ -0,0 +1,33 @@
+typedef struct IScmRequestInfoVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        IScmRequestInfo * This,
+        /* [in] */ REFIID riid,
+        /* [iid_is][out] */ void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        IScmRequestInfo * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        IScmRequestInfo * This);
+
+    HRESULT ( STDMETHODCALLTYPE *SetScmInfo )(
+        IScmRequestInfo * This,
+        /* [in] */ PRIV_SCM_INFO *pScmInfo);
+
+    HRESULT ( STDMETHODCALLTYPE *GetScmInfo )(
+        IScmRequestInfo * This,
+        /* [out] */ PRIV_SCM_INFO **ppScmInfo);
+
+    HRESULT ( STDMETHODCALLTYPE *SetRemoteRequestInfo )(
+        IScmRequestInfo * This,
+        /* [in] */ REMOTE_REQUEST_SCM_INFO *pRemoteReq);
+
+    HRESULT ( STDMETHODCALLTYPE *GetRemoteRequestInfo )(
+        IScmRequestInfo * This,
+        /* [out] */ REMOTE_REQUEST_SCM_INFO **ppRemoteReq);
+
+    END_INTERFACE
+} IScmRequestInfoVtbl;

ctypes_generation/definitions/com/combase/IStandardActivator.txt

@@ -0,0 +1,58 @@
+typedef struct IStandardActivatorVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        IStandardActivator * This,
+        /* [in] */ REFIID riid,
+        /* [iid_is][out] */ void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        IStandardActivator * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        IStandardActivator * This);
+
+    HRESULT ( STDMETHODCALLTYPE *StandardGetClassObject )(
+        IStandardActivator * This,
+        /* [in] */ REFCLSID rclsid,
+        /* [in] */ DWORD dwClsCtx,
+        /* [in] */ COSERVERINFO *pServerInfo,
+        /* [in] */ REFIID riid,
+        /* [iid_is][out] */ void **ppv);
+
+    HRESULT ( STDMETHODCALLTYPE *StandardCreateInstance )(
+        IStandardActivator * This,
+        /* [in] */ REFCLSID Clsid,
+        /* [in] */ IUnknown *punkOuter,
+        /* [in] */ DWORD dwClsCtx,
+        /* [in] */ COSERVERINFO *pServerInfo,
+        /* [in] */ DWORD dwCount,
+        /* [size_is][in] */ MULTI_QI *pResults);
+
+    HRESULT ( STDMETHODCALLTYPE *StandardGetInstanceFromFile )(
+        IStandardActivator * This,
+        /* [in] */ COSERVERINFO *pServerInfo,
+        /* [in] */ CLSID *pclsidOverride,
+        /* [in] */ IUnknown *punkOuter,
+        /* [in] */ DWORD dwClsCtx,
+        /* [in] */ DWORD grfMode,
+        /* [in] */ OLECHAR *pwszName,
+        /* [in] */ DWORD dwCount,
+        /* [size_is][in] */ MULTI_QI *pResults);
+
+    HRESULT ( STDMETHODCALLTYPE *StandardGetInstanceFromIStorage )(
+        IStandardActivator * This,
+        /* [in] */ COSERVERINFO *pServerInfo,
+        /* [in] */ CLSID *pclsidOverride,
+        /* [in] */ IUnknown *punkOuter,
+        /* [in] */ DWORD dwClsCtx,
+        /* [in] */ IStorage *pstg,
+        /* [in] */ DWORD dwCount,
+        /* [size_is][in] */ MULTI_QI *pResults);
+
+    HRESULT ( STDMETHODCALLTYPE *Reset )(
+        IStandardActivator * This);
+
+    END_INTERFACE
+} IStandardActivatorVtbl;

ctypes_generation/definitions/com/combase/ISystemActivator.txt

@@ -0,0 +1,28 @@
+    typedef struct ISystemActivatorVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            ISystemActivator * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            ISystemActivator * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            ISystemActivator * This);
+
+        HRESULT ( STDMETHODCALLTYPE *GetClassObject )(
+            ISystemActivator * This,
+            /* [unique][in] */ IActivationPropertiesIn *pActProperties,
+            /* [out] */ IActivationPropertiesOut **ppActProperties);
+
+        HRESULT ( STDMETHODCALLTYPE *CreateInstance )(
+            ISystemActivator * This,
+            /* [unique][in] */ IUnknown *pUnkOuter,
+            /* [unique][in] */ IActivationPropertiesIn *pActProperties,
+            /* [out] */ IActivationPropertiesOut **ppActProperties);
+
+        END_INTERFACE
+    } ISystemActivatorVtbl;

ctypes_generation/definitions/com/manually_created/IProxyManager.txt

@@ -0,0 +1,57 @@
+// Manually crafted from windows 10
+typedef struct IProxyManagerVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            __RPC__in IProxyManager * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [annotation][iid_is][out] */
+            _COM_Outptr_  void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            __RPC__in IProxyManager * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            __RPC__in IProxyManager * This);
+
+        HRESULT ( STDMETHODCALLTYPE *CreateServer )(
+            IProxyManager * This,
+            REFCLSID * rclsid,
+            DWORD * clsctx,
+            PVOID *pv);
+
+        BOOL ( STDMETHODCALLTYPE *IsConnected )(
+            IProxyManager * This);
+
+        HRESULT ( STDMETHODCALLTYPE *LockConnection )(
+            IProxyManager * This,
+            BOOL fLock,
+            BOOL fLastUnlockReleases);
+
+        HRESULT ( STDMETHODCALLTYPE *Disconnect )(
+            IProxyManager * This);
+
+        HRESULT ( STDMETHODCALLTYPE *GetConnectionStatus )(
+            IProxyManager * This);
+
+        HRESULT ( STDMETHODCALLTYPE *ScalarDeletingDestructor )( // CPP code ? is this the real end of the Interface ?
+            IProxyManager * This);
+
+        HRESULT ( STDMETHODCALLTYPE *SetMapping )(
+            IProxyManager * This);
+
+        HRESULT ( STDMETHODCALLTYPE *GetMapping )(
+            IProxyManager * This);
+
+        IObjContext ( STDMETHODCALLTYPE *GetServerObjectContext )(
+            IProxyManager * This);
+
+        HRESULT ( STDMETHODCALLTYPE *GetWrapperForContex )(
+            IProxyManager   * This,
+            IObjContext  *pCtx,
+            IID              *riid,
+            void            **ppv);
+
+        END_INTERFACE
+    } IProxyManagerVtbl;

ctypes_generation/definitions/com/manually_created/IProxyServerIdentity.txt

@@ -0,0 +1,28 @@
+typedef struct IProxyServerIdentityVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        IProxyServerIdentity * This,
+        /* [in] */ REFIID riid,
+        /* [annotation][iid_is][out] */
+        __RPC__deref_out  void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        IProxyServerIdentity * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        IProxyServerIdentity * This);
+
+    HRESULT ( STDMETHODCALLTYPE *GetServerProcessId )(
+        IProxyServerIdentity * This,
+        UINT *processId);
+
+    HRESULT ( STDMETHODCALLTYPE *GetServerProcessHandle )(
+        IProxyServerIdentity * This,
+        DWORD dwDesiredAccess,
+        INT bInheritHandle,
+        PVOID *phProcess)   ;
+
+    END_INTERFACE
+} IProxyServerIdentityVtbl;

ctypes_generation/definitions/com/rpc/IChannelHook.txt

@@ -0,0 +1,62 @@
+    typedef struct IChannelHookVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IChannelHook * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IChannelHook * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IChannelHook * This);
+
+        PVOID ( STDMETHODCALLTYPE *ClientGetSize )(
+            IChannelHook * This,
+            /* [in] */ REFGUID uExtent,
+            /* [in] */ REFIID riid,
+            /* [out] */ ULONG *pDataSize);
+
+        PVOID ( STDMETHODCALLTYPE *ClientFillBuffer )(
+            IChannelHook * This,
+            /* [in] */ REFGUID uExtent,
+            /* [in] */ REFIID riid,
+            /* [out][in] */ ULONG *pDataSize,
+            /* [in] */ void *pDataBuffer);
+
+        PVOID ( STDMETHODCALLTYPE *ClientNotify )(
+            IChannelHook * This,
+            /* [in] */ REFGUID uExtent,
+            /* [in] */ REFIID riid,
+            /* [in] */ ULONG cbDataSize,
+            /* [in] */ void *pDataBuffer,
+            /* [in] */ DWORD lDataRep,
+            /* [in] */ HRESULT hrFault);
+
+        PVOID ( STDMETHODCALLTYPE *ServerNotify )(
+            IChannelHook * This,
+            /* [in] */ REFGUID uExtent,
+            /* [in] */ REFIID riid,
+            /* [in] */ ULONG cbDataSize,
+            /* [in] */ void *pDataBuffer,
+            /* [in] */ DWORD lDataRep);
+
+        PVOID ( STDMETHODCALLTYPE *ServerGetSize )(
+            IChannelHook * This,
+            /* [in] */ REFGUID uExtent,
+            /* [in] */ REFIID riid,
+            /* [in] */ HRESULT hrFault,
+            /* [out] */ ULONG *pDataSize);
+
+        PVOID ( STDMETHODCALLTYPE *ServerFillBuffer )(
+            IChannelHook * This,
+            /* [in] */ REFGUID uExtent,
+            /* [in] */ REFIID riid,
+            /* [out][in] */ ULONG *pDataSize,
+            /* [in] */ void *pDataBuffer,
+            /* [in] */ HRESULT hrFault);
+
+        END_INTERFACE
+    } IChannelHookVtbl;

ctypes_generation/definitions/com/rpc/IRpcChannelBuffer.txt

@@ -0,0 +1,39 @@
+    typedef struct IRpcChannelBufferVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IRpcChannelBuffer * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IRpcChannelBuffer * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IRpcChannelBuffer * This);
+
+        HRESULT ( STDMETHODCALLTYPE *GetBuffer )(
+            IRpcChannelBuffer * This,
+            /* [in] */ RPCOLEMESSAGE *pMessage,
+            /* [in] */ REFIID riid);
+
+        HRESULT ( STDMETHODCALLTYPE *SendReceive )(
+            IRpcChannelBuffer * This,
+            /* [out][in] */ RPCOLEMESSAGE *pMessage,
+            /* [out] */ ULONG *pStatus);
+
+        HRESULT ( STDMETHODCALLTYPE *FreeBuffer )(
+            IRpcChannelBuffer * This,
+            /* [in] */ RPCOLEMESSAGE *pMessage);
+
+        HRESULT ( STDMETHODCALLTYPE *GetDestCtx )(
+            IRpcChannelBuffer * This,
+            /* [out] */ DWORD *pdwDestContext,
+            /* [out] */ void **ppvDestContext);
+
+        HRESULT ( STDMETHODCALLTYPE *IsConnected )(
+            IRpcChannelBuffer * This);
+
+        END_INTERFACE
+    } IRpcChannelBufferVtbl;

ctypes_generation/definitions/com/rpc/IRpcHelper.txt

@@ -0,0 +1,26 @@
+    typedef struct IRpcHelperVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IRpcHelper * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IRpcHelper * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IRpcHelper * This);
+
+        HRESULT ( STDMETHODCALLTYPE *GetDCOMProtocolVersion )(
+            IRpcHelper * This,
+            /* [out] */ DWORD *pComVersion);
+
+        HRESULT ( STDMETHODCALLTYPE *GetIIDFromOBJREF )(
+            IRpcHelper * This,
+            /* [in] */ void *pObjRef,
+            /* [out] */ IID **piid);
+
+        END_INTERFACE
+    } IRpcHelperVtbl;

ctypes_generation/definitions/com/rpc/IRpcOptions.txt

@@ -0,0 +1,29 @@
+    typedef struct IRpcOptionsVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IRpcOptions * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IRpcOptions * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IRpcOptions * This);
+
+        HRESULT ( STDMETHODCALLTYPE *Set )(
+            IRpcOptions * This,
+            /* [in] */ IUnknown *pPrx,
+            /* [in] */ DWORD dwProperty,
+            /* [in] */ ULONG_PTR dwValue);
+
+        HRESULT ( STDMETHODCALLTYPE *Query )(
+            IRpcOptions * This,
+            /* [in] */ IUnknown *pPrx,
+            /* [in] */ DWORD dwProperty,
+            /* [out] */ ULONG_PTR *pdwValue);
+
+        END_INTERFACE
+    } IRpcOptionsVtbl;

ctypes_generation/definitions/com/rpc/IRpcStubBuffer.txt

@@ -0,0 +1,45 @@
+    typedef struct IRpcStubBufferVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IRpcStubBuffer * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ PVOID *ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IRpcStubBuffer * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IRpcStubBuffer * This);
+
+        HRESULT ( STDMETHODCALLTYPE *Connect )(
+            IRpcStubBuffer * This,
+            /* [in] */ IUnknown *pUnkServer);
+
+        PVOID ( STDMETHODCALLTYPE *Disconnect )(
+            IRpcStubBuffer * This);
+
+        HRESULT ( STDMETHODCALLTYPE *Invoke )(
+            IRpcStubBuffer * This,
+            /* [in] */ RPCOLEMESSAGE *_prpcmsg,
+            /* [in] */ IRpcChannelBuffer *_pRpcChannelBuffer);
+
+        // IRpcStubBuffer *
+        PVOID ( STDMETHODCALLTYPE *IsIIDSupported )(
+            IRpcStubBuffer * This,
+            /* [in] */ REFIID riid);
+
+        ULONG ( STDMETHODCALLTYPE *CountRefs )(
+            IRpcStubBuffer * This);
+
+        HRESULT ( STDMETHODCALLTYPE *DebugServerQueryInterface )(
+            IRpcStubBuffer * This,
+            PVOID *ppv);
+
+        PVOID ( STDMETHODCALLTYPE *DebugServerRelease )(
+            IRpcStubBuffer * This,
+            PVOID pv);
+
+        END_INTERFACE
+    } IRpcStubBufferVtbl;

ctypes_generation/definitions/com/template.py

@@ -19,8 +19,8 @@ class COMInterface(ctypes.c_void_p):
 
     # So COMInterface completely bypass the HRESULT
     # return value check on restype by setting the restype to COMHRESULT
-    # But we add the 'errcheck' callbakc capacity for all COMInterface and subclasses
+    # But we add the 'errcheck' callback capacity for all COMInterface and subclasses
-    # So the default implem of the callbakc must have the same behavior as
+    # So the default implem of the callback must have the same behavior as
     # standard HRESULT restype.
     # This is why default errcheck callback call ctypes._check_HRESULT
     def _default_errcheck(self, result, func, args):
@@ -42,12 +42,33 @@ class COMInterface(ctypes.c_void_p):
         description = "<NULL>" if not self.value else ""
         return "<{0}{1} at {2:#x}>".format(type(self).__name__, description, id(self))
 
-    # Simplified API for QueryInterface for interface embeding there IID
+    # Simplified API for QueryInterface for interface embeding their IID
-    def query(self, interfacetype):
+    # Or for string/Obj
-        interface = interfacetype()
+    def query(self, interface, target=None):
-        self.QueryInterface(interface.IID, interface)
+        if isinstance(interface, str): # We have a GUID
-        return interface
+            interface_iid = IID.from_string(interface)
-
+            if target is None:
+                target = IUnknown()
+        elif issubclass(interface, COMInterface): # We have a PFW COM interface
+            interface_iid = interface.IID
+            if target is None:
+                target = interface() # Use an instance of the ComInterface as target of the QueryInterface
+        else:
+            # We have something else (A gdef.GUID probably)
+            interface_iid = interface
+            if target is None:
+                target = IUnknown()
+        self.QueryInterface(interface_iid, target)
+        return target
+
+    def marshal(self, target_iid=None, destination=MSHCTX_NOSHAREDMEM, flags=MSHLFLAGS_NORMAL):
+        if target_iid is None:
+            target_iid = self.IID
+        mystream = windows.com.MemoryIStream.create()
+        windows.winproxy.CoMarshalInterface(mystream, target_iid, self, destination, 0, flags)
+        mystream.seek(0)
+        buffer = mystream.read(0xffffffff) # Todo: release stuff
+        return buffer
 
 
 

ctypes_generation/definitions/defines/combase.txt

@@ -0,0 +1,33 @@
+#define	ORPCF_NULL	( 0 )
+#define	ORPCF_LOCAL	( 1 )
+#define	ORPCF_RESERVED1	( 2 )
+#define	ORPCF_RESERVED2	( 4 )
+#define	ORPCF_RESERVED3	( 8 )
+#define	ORPCF_RESERVED4	( 16 )
+
+#define ORPCF_INPUT_SYNC        ORPCF_RESERVED1
+#define ORPCF_ASYNC             ORPCF_RESERVED2
+#define ORPCF_DYNAMIC_CLOAKING  ORPCF_RESERVED3
+
+#define ORPCF_REJECTED          ORPCF_RESERVED1
+#define ORPCF_RETRY_LATER       ORPCF_RESERVED2
+
+#define	OBJREF_SIGNATURE	( 0x574f454d )
+#define	OBJREF_STANDARD	( 0x1 )
+#define	OBJREF_HANDLER	( 0x2 )
+#define	OBJREF_CUSTOM	( 0x4 )
+#define	OBJREF_EXTENDED	( 0x8 )
+#define	SORF_OXRES1	( 0x1 )
+#define	SORF_OXRES2	( 0x20 )
+#define	SORF_OXRES3	( 0x40 )
+#define	SORF_OXRES4	( 0x80 )
+#define	SORF_OXRES5	( 0x100 )
+#define	SORF_OXRES6	( 0x200 )
+#define	SORF_OXRES7	( 0x400 )
+#define	SORF_OXRES8	( 0x800 )
+#define	SORF_NULL	( 0 )
+#define	SORF_NOPING	( 0x1000 )
+
+#define UNIQUE_FLAG_PADDING 2
+#define MAINHDRSIG     0x414E554B
+#define ENTRYHDRSIG   0x494E414E

ctypes_generation/definitions/defines/error_helper.txt

@@ -2,4 +2,22 @@
 #define ERROR_SEVERITY_SUCCESS       0x00000000
 #define ERROR_SEVERITY_INFORMATIONAL 0x40000000
 #define ERROR_SEVERITY_WARNING       0x80000000
-#define ERROR_SEVERITY_ERROR         0xC0000000
+#define ERROR_SEVERITY_ERROR         0xC0000000
+
+// https://learn.microsoft.com/en-us/windows/win32/com/structure-of-com-error-codes
+// Define the facility codes
+//
+#define FACILITY_WINDOWS                 0x8
+#define FACILITY_WIN32                   0x7
+#define FACILITY_STORAGE                 0x3
+#define FACILITY_RPC                     0x1
+#define FACILITY_NULL                    0x0
+#define FACILITY_ITF                     0x4
+#define FACILITY_DISPATCH                0x2
+
+
+//
+// Define the severity codes
+//
+#define STATUS_SEVERITY_SUCCESS          0x0
+#define STATUS_SEVERITY_COERROR          0x2

ctypes_generation/definitions/defines/event_trace.txt

@@ -45,9 +45,6 @@
 #define EVENT_TRACE_FILE_MODE_NEWFILE       0x00000008  // Auto-switch log file
 #define EVENT_TRACE_FILE_MODE_PREALLOCATE   0x00000020  // Pre-allocate mode
 
-#define EVENT_TRACE_FILE_MODE_NEWFILE       0x00000008  // Auto-switch log file
-#define EVENT_TRACE_FILE_MODE_PREALLOCATE   0x00000020  // Pre-allocate mode
-
 //
 // Logger Mode flags on Vista and above
 //

ctypes_generation/definitions/defines/ioctl.txt

@@ -0,0 +1,359 @@
+
+/* CTL_CODE is directly defined in the .py template to simpify parsing of define */
+
+// #define CTL_CODE( DeviceType, Function, Method, Access ) (((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method))
+
+#define METHOD_BUFFERED                 0
+#define METHOD_IN_DIRECT                1
+#define METHOD_OUT_DIRECT               2
+#define METHOD_NEITHER                  3
+
+#define METHOD_DIRECT_TO_HARDWARE       METHOD_IN_DIRECT
+#define METHOD_DIRECT_FROM_HARDWARE     METHOD_OUT_DIRECT
+
+#define FILE_ANY_ACCESS                 0
+#define FILE_SPECIAL_ACCESS    (FILE_ANY_ACCESS)
+#define FILE_READ_ACCESS          ( 0x0001 )    // file & pipe
+#define FILE_WRITE_ACCESS         ( 0x0002 )    // file & pipe
+
+
+#define FILE_DISPOSITION_DO_NOT_DELETE              0x00000000
+#define FILE_DISPOSITION_DELETE                     0x00000001
+#define FILE_DISPOSITION_POSIX_SEMANTICS            0x00000002
+#define FILE_DISPOSITION_FORCE_IMAGE_SECTION_CHECK  0x00000004
+#define FILE_DISPOSITION_ON_CLOSE                   0x00000008
+#define FILE_DISPOSITION_IGNORE_READONLY_ATTRIBUTE  0x00000010
+
+/* From: ntifs.h */
+//
+// The following is a list of the native file system fsctls followed by
+// additional network file system fsctls.  Some values have been
+// decommissioned.
+//
+
+
+#define FSCTL_REQUEST_OPLOCK_LEVEL_1    CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  0, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_REQUEST_OPLOCK_LEVEL_2    CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  1, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_REQUEST_BATCH_OPLOCK      CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  2, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE  CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  3, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  4, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_OPLOCK_BREAK_NOTIFY       CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  5, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_LOCK_VOLUME               CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  6, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_UNLOCK_VOLUME             CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  7, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_DISMOUNT_VOLUME           CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  8, METHOD_BUFFERED, FILE_ANY_ACCESS)
+// decommissioned fsctl value                                              9
+#define FSCTL_IS_VOLUME_MOUNTED         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_IS_PATHNAME_VALID         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS) // PATHNAME_BUFFER,
+#define FSCTL_MARK_VOLUME_DIRTY         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
+// decommissioned fsctl value                                             13
+#define FSCTL_QUERY_RETRIEVAL_POINTERS  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14,  METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_GET_COMPRESSION           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SET_COMPRESSION           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
+// decommissioned fsctl value                                             17
+// decommissioned fsctl value                                             18
+#define FSCTL_SET_BOOTLOADER_ACCESSED   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19,  METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_MARK_AS_SYSTEM_HIVE       FSCTL_SET_BOOTLOADER_ACCESSED
+#define FSCTL_OPLOCK_BREAK_ACK_NO_2     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_INVALIDATE_VOLUMES        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_QUERY_FAT_BPB             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS) // FSCTL_QUERY_FAT_BPB_BUFFER
+#define FSCTL_REQUEST_FILTER_OPLOCK     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILESYSTEM_STATISTICS
+
+#define FSCTL_GET_NTFS_VOLUME_DATA      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS) // NTFS_VOLUME_DATA_BUFFER
+#define FSCTL_GET_NTFS_FILE_RECORD      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS) // NTFS_FILE_RECORD_INPUT_BUFFER, NTFS_FILE_RECORD_OUTPUT_BUFFER
+#define FSCTL_GET_VOLUME_BITMAP         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27,  METHOD_NEITHER, FILE_ANY_ACCESS) // STARTING_LCN_INPUT_BUFFER, VOLUME_BITMAP_BUFFER
+#define FSCTL_GET_RETRIEVAL_POINTERS    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28,  METHOD_NEITHER, FILE_ANY_ACCESS) // STARTING_VCN_INPUT_BUFFER, RETRIEVAL_POINTERS_BUFFER
+#define FSCTL_MOVE_FILE                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // MOVE_FILE_DATA,
+#define FSCTL_IS_VOLUME_DIRTY           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
+// decommissioned fsctl value                                             31
+#define FSCTL_ALLOW_EXTENDED_DASD_IO    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER,  FILE_ANY_ACCESS)
+
+// decommissioned fsctl value                                             33
+// decommissioned fsctl value                                             34
+#define FSCTL_FIND_FILES_BY_SID         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS)
+// decommissioned fsctl value                                             36
+// decommissioned fsctl value                                             37
+#define FSCTL_SET_OBJECT_ID             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // FILE_OBJECTID_BUFFER
+#define FSCTL_GET_OBJECT_ID             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_OBJECTID_BUFFER
+#define FSCTL_DELETE_OBJECT_ID          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+#define FSCTL_SET_REPARSE_POINT         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // REPARSE_DATA_BUFFER,
+#define FSCTL_GET_REPARSE_POINT         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS) // REPARSE_DATA_BUFFER
+#define FSCTL_DELETE_REPARSE_POINT      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // REPARSE_DATA_BUFFER,
+#define FSCTL_ENUM_USN_DATA             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44,  METHOD_NEITHER, FILE_ANY_ACCESS) // MFT_ENUM_DATA,
+#define FSCTL_SECURITY_ID_CHECK         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45,  METHOD_NEITHER, FILE_READ_DATA)  // BULK_SECURITY_TEST_DATA,
+#define FSCTL_READ_USN_JOURNAL          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46,  METHOD_NEITHER, FILE_ANY_ACCESS) // READ_USN_JOURNAL_DATA, USN
+#define FSCTL_SET_OBJECT_ID_EXTENDED    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+#define FSCTL_CREATE_OR_GET_OBJECT_ID   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_OBJECTID_BUFFER
+#define FSCTL_SET_SPARSE                CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+#define FSCTL_SET_ZERO_DATA             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA) // FILE_ZERO_DATA_INFORMATION,
+#define FSCTL_QUERY_ALLOCATED_RANGES    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51,  METHOD_NEITHER, FILE_READ_DATA)  // FILE_ALLOCATED_RANGE_BUFFER, FILE_ALLOCATED_RANGE_BUFFER
+#define FSCTL_ENABLE_UPGRADE            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_SET_ENCRYPTION            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53,  METHOD_NEITHER, FILE_ANY_ACCESS) // ENCRYPTION_BUFFER, DECRYPTION_STATUS_BUFFER
+#define FSCTL_ENCRYPTION_FSCTL_IO       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54,  METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_WRITE_RAW_ENCRYPTED       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55,  METHOD_NEITHER, FILE_SPECIAL_ACCESS) // ENCRYPTED_DATA_INFO, EXTENDED_ENCRYPTED_DATA_INFO
+#define FSCTL_READ_RAW_ENCRYPTED        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56,  METHOD_NEITHER, FILE_SPECIAL_ACCESS) // REQUEST_RAW_ENCRYPTED_DATA, ENCRYPTED_DATA_INFO, EXTENDED_ENCRYPTED_DATA_INFO
+#define FSCTL_CREATE_USN_JOURNAL        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57,  METHOD_NEITHER, FILE_ANY_ACCESS) // CREATE_USN_JOURNAL_DATA,
+#define FSCTL_READ_FILE_USN_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58,  METHOD_NEITHER, FILE_ANY_ACCESS) // Read the Usn Record for a file
+#define FSCTL_WRITE_USN_CLOSE_RECORD    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59,  METHOD_NEITHER, FILE_ANY_ACCESS) // Generate Close Usn Record
+#define FSCTL_EXTEND_VOLUME             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_QUERY_USN_JOURNAL         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_DELETE_USN_JOURNAL        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_MARK_HANDLE               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SIS_COPYFILE              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SIS_LINK_FILES            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
+// decommissioned fsctl value                                             66
+// decommissioned fsctl value                                             67
+// decommissioned fsctl value                                             68
+#define FSCTL_RECALL_FILE               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS)
+// decommissioned fsctl value                                             70
+#define FSCTL_READ_FROM_PLEX            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA)
+#define FSCTL_FILE_PREFETCH             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // FILE_PREFETCH
+
+#define FSCTL_MAKE_MEDIA_COMPATIBLE         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 76, METHOD_BUFFERED, FILE_WRITE_DATA) // UDFS R/W
+#define FSCTL_SET_DEFECT_MANAGEMENT         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 77, METHOD_BUFFERED, FILE_WRITE_DATA) // UDFS R/W
+#define FSCTL_QUERY_SPARING_INFO            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 78, METHOD_BUFFERED, FILE_ANY_ACCESS) // UDFS R/W
+#define FSCTL_QUERY_ON_DISK_VOLUME_INFO     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 79, METHOD_BUFFERED, FILE_ANY_ACCESS) // C/UDFS
+#define FSCTL_SET_VOLUME_COMPRESSION_STATE  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 80, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // VOLUME_COMPRESSION_STATE
+// decommissioned fsctl value                                                 80
+#define FSCTL_TXFS_MODIFY_RM                CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 81, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
+#define FSCTL_TXFS_QUERY_RM_INFORMATION     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 82, METHOD_BUFFERED, FILE_READ_DATA)  // TxF
+// decommissioned fsctl value                                                 83
+#define FSCTL_TXFS_ROLLFORWARD_REDO         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 84, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
+#define FSCTL_TXFS_ROLLFORWARD_UNDO         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 85, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
+#define FSCTL_TXFS_START_RM                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 86, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
+#define FSCTL_TXFS_SHUTDOWN_RM              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 87, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
+#define FSCTL_TXFS_READ_BACKUP_INFORMATION  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 88, METHOD_BUFFERED, FILE_READ_DATA)  // TxF
+#define FSCTL_TXFS_WRITE_BACKUP_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 89, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
+#define FSCTL_TXFS_CREATE_SECONDARY_RM      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 90, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
+#define FSCTL_TXFS_GET_METADATA_INFO        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 91, METHOD_BUFFERED, FILE_READ_DATA)  // TxF
+#define FSCTL_TXFS_GET_TRANSACTED_VERSION   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 92, METHOD_BUFFERED, FILE_READ_DATA)  // TxF
+// decommissioned fsctl value                                                 93
+#define FSCTL_TXFS_SAVEPOINT_INFORMATION    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 94, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
+#define FSCTL_TXFS_CREATE_MINIVERSION       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 95, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
+// decommissioned fsctl value                                                 96
+// decommissioned fsctl value                                                 97
+// decommissioned fsctl value                                                 98
+#define FSCTL_TXFS_TRANSACTION_ACTIVE       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 99, METHOD_BUFFERED, FILE_READ_DATA)  // TxF
+#define FSCTL_SET_ZERO_ON_DEALLOCATION      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 101, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+#define FSCTL_SET_REPAIR                    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 102, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_GET_REPAIR                    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 103, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_WAIT_FOR_REPAIR               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 104, METHOD_BUFFERED, FILE_ANY_ACCESS)
+// decommissioned fsctl value                                                 105
+#define FSCTL_INITIATE_REPAIR               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 106, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CSC_INTERNAL                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 107, METHOD_NEITHER, FILE_ANY_ACCESS) // CSC internal implementation
+#define FSCTL_SHRINK_VOLUME                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 108, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // SHRINK_VOLUME_INFORMATION
+#define FSCTL_SET_SHORT_NAME_BEHAVIOR       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 109, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_DFSR_SET_GHOST_HANDLE_STATE   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 110, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+//
+//  Values 111 - 119 are reserved for FSRM.
+//
+
+#define FSCTL_TXFS_LIST_TRANSACTION_LOCKED_FILES \
+                                            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_READ_DATA) // TxF
+#define FSCTL_TXFS_LIST_TRANSACTIONS        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 121, METHOD_BUFFERED, FILE_READ_DATA) // TxF
+#define FSCTL_QUERY_PAGEFILE_ENCRYPTION     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 122, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_RESET_VOLUME_ALLOCATION_HINTS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 123, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_QUERY_DEPENDENT_VOLUME        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 124, METHOD_BUFFERED, FILE_ANY_ACCESS)    // Dependency File System Filter
+#define FSCTL_SD_GLOBAL_CHANGE              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 125, METHOD_BUFFERED, FILE_ANY_ACCESS) // Query/Change NTFS Security Descriptors
+
+#define FSCTL_TXFS_READ_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 126, METHOD_BUFFERED, FILE_ANY_ACCESS) // TxF
+
+#define FSCTL_LOOKUP_STREAM_FROM_CLUSTER    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 127, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_TXFS_WRITE_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 128, METHOD_BUFFERED, FILE_ANY_ACCESS) // TxF
+#define FSCTL_FILE_TYPE_NOTIFICATION        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 129, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_FILE_LEVEL_TRIM               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 130, METHOD_BUFFERED, FILE_WRITE_DATA)
+
+//
+//  Values 131 - 139 are reserved for FSRM.
+//
+
+#define FSCTL_GET_BOOT_AREA_INFO            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 140, METHOD_BUFFERED, FILE_ANY_ACCESS) // BOOT_AREA_INFO
+#define FSCTL_GET_RETRIEVAL_POINTER_BASE    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 141, METHOD_BUFFERED, FILE_ANY_ACCESS) // RETRIEVAL_POINTER_BASE
+#define FSCTL_SET_PERSISTENT_VOLUME_STATE   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 142, METHOD_BUFFERED, FILE_ANY_ACCESS)  // FILE_FS_PERSISTENT_VOLUME_INFORMATION
+#define FSCTL_QUERY_PERSISTENT_VOLUME_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 143, METHOD_BUFFERED, FILE_ANY_ACCESS)  // FILE_FS_PERSISTENT_VOLUME_INFORMATION
+
+#define FSCTL_REQUEST_OPLOCK                CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 144, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_CSV_TUNNEL_REQUEST            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 145, METHOD_BUFFERED, FILE_ANY_ACCESS) // CSV_TUNNEL_REQUEST
+#define FSCTL_IS_CSV_FILE                   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 146, METHOD_BUFFERED, FILE_ANY_ACCESS) // IS_CSV_FILE
+
+#define FSCTL_QUERY_FILE_SYSTEM_RECOGNITION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 147, METHOD_BUFFERED, FILE_ANY_ACCESS) //
+#define FSCTL_CSV_GET_VOLUME_PATH_NAME      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 148, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CSV_GET_VOLUME_NAME_FOR_VOLUME_MOUNT_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 149, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CSV_GET_VOLUME_PATH_NAMES_FOR_VOLUME_NAME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 150,  METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_IS_FILE_ON_CSV_VOLUME         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 151,  METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_CORRUPTION_HANDLING           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 152, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_OFFLOAD_READ                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 153, METHOD_BUFFERED, FILE_READ_ACCESS)
+#define FSCTL_OFFLOAD_WRITE                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 154, METHOD_BUFFERED, FILE_WRITE_ACCESS)
+
+#define FSCTL_CSV_INTERNAL                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 155,  METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_SET_PURGE_FAILURE_MODE        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 156, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_QUERY_FILE_LAYOUT             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 157, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_IS_VOLUME_OWNED_BYCSVFS       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 158,  METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_GET_INTEGRITY_INFORMATION     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 159, METHOD_BUFFERED, FILE_ANY_ACCESS)                  // FSCTL_GET_INTEGRITY_INFORMATION_BUFFER
+#define FSCTL_SET_INTEGRITY_INFORMATION     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 160, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA) // FSCTL_SET_INTEGRITY_INFORMATION_BUFFER
+
+#define FSCTL_QUERY_FILE_REGIONS            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 161, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+
+
+#define FSCTL_RKF_INTERNAL                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 171, METHOD_NEITHER, FILE_ANY_ACCESS) // Resume Key Filter
+
+#define FSCTL_SCRUB_DATA                    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 172, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_REPAIR_COPIES                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 173, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
+#define FSCTL_DISABLE_LOCAL_BUFFERING       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 174, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CSV_MGMT_LOCK                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 175, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CSV_QUERY_DOWN_LEVEL_FILE_SYSTEM_CHARACTERISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 176, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_ADVANCE_FILE_ID               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 177, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CSV_SYNC_TUNNEL_REQUEST       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 178, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CSV_QUERY_VETO_FILE_DIRECT_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 179, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_WRITE_USN_REASON              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 180, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CSV_CONTROL                   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 181, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_GET_REFS_VOLUME_DATA          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 182, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CSV_H_BREAKING_SYNC_TUNNEL_REQUEST CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 185, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_QUERY_STORAGE_CLASSES         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 187, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_QUERY_REGION_INFO             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 188, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_USN_TRACK_MODIFIED_RANGES     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 189, METHOD_BUFFERED, FILE_ANY_ACCESS) // USN_TRACK_MODIFIED_RANGES
+#define FSCTL_QUERY_SHARED_VIRTUAL_DISK_SUPPORT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 192, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SVHDX_SYNC_TUNNEL_REQUEST         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 193, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SVHDX_SET_INITIATOR_INFORMATION   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 194, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SET_EXTERNAL_BACKING              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 195, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+#define FSCTL_GET_EXTERNAL_BACKING              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 196, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_DELETE_EXTERNAL_BACKING           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 197, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+#define FSCTL_ENUM_EXTERNAL_BACKING             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 198, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_ENUM_OVERLAY                      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 199, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_ADD_OVERLAY                       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 204, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_REMOVE_OVERLAY                    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 205, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_UPDATE_OVERLAY                    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 206, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_SHUFFLE_FILE                      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 208, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS) // SHUFFLE_FILE_DATA
+#define FSCTL_DUPLICATE_EXTENTS_TO_FILE         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 209, METHOD_BUFFERED, FILE_WRITE_DATA )
+#define FSCTL_SPARSE_OVERALLOCATE               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 211, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+#define FSCTL_STORAGE_QOS_CONTROL               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 212, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_INITIATE_FILE_METADATA_OPTIMIZATION       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 215, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+#define FSCTL_QUERY_FILE_METADATA_OPTIMIZATION          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 216, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+
+#define FSCTL_SVHDX_ASYNC_TUNNEL_REQUEST         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 217, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_GET_WOF_VERSION                    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 218, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_HCS_SYNC_TUNNEL_REQUEST            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 219, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_HCS_ASYNC_TUNNEL_REQUEST           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 220, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_QUERY_EXTENT_READ_CACHE_INFO       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 221, METHOD_NEITHER, FILE_ANY_ACCESS)  // VCN_RANGE_INPUT_BUFFER, EXTENT_READ_CACHE_INFO_BUFFER
+#define FSCTL_QUERY_REFS_VOLUME_COUNTER_INFO     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 222, METHOD_NEITHER, FILE_ANY_ACCESS)  // REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER, VOLUME_REFS_INFO_BUFFER
+#define FSCTL_CLEAN_VOLUME_METADATA              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 223, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SET_INTEGRITY_INFORMATION_EX       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 224, METHOD_BUFFERED, FILE_ANY_ACCESS) // FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX
+#define FSCTL_SUSPEND_OVERLAY                    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 225, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_VIRTUAL_STORAGE_QUERY_PROPERTY     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 226, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_FILESYSTEM_GET_STATISTICS_EX       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 227, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILESYSTEM_STATISTICS_EX
+#define FSCTL_QUERY_VOLUME_CONTAINER_STATE       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 228, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SET_LAYER_ROOT                     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 229, METHOD_BUFFERED, FILE_ANY_ACCESS) // CONTAINER_ROOT_INFO_INPUT CONTAINER_ROOT_INFO_OUTPUT
+
+#define FSCTL_QUERY_DIRECT_ACCESS_EXTENTS        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 230, METHOD_NEITHER, FILE_ANY_ACCESS) // QUERY_DIRECT_ACCESS_EXTENTS
+#define FSCTL_NOTIFY_STORAGE_SPACE_ALLOCATION    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 231, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SSDI_STORAGE_REQUEST               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 232, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_QUERY_DIRECT_IMAGE_ORIGINAL_BASE   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 233, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_READ_UNPRIVILEGED_USN_JOURNAL      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 234,  METHOD_NEITHER, FILE_ANY_ACCESS) // READ_USN_JOURNAL_DATA, USN
+
+#define FSCTL_GHOST_FILE_EXTENTS                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 235, METHOD_BUFFERED, FILE_WRITE_ACCESS) // FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER
+#define FSCTL_QUERY_GHOSTED_FILE_EXTENTS         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 236, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_UNMAP_SPACE                        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 237, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_HCS_SYNC_NO_WRITE_TUNNEL_REQUEST   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 238, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_START_VIRTUALIZATION_INSTANCE     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 240, METHOD_BUFFERED, FILE_ANY_ACCESS) // VIRTUALIZATION_INSTANCE_INFO_INPUT, VIRTUALIZATION_INSTANCE_INFO_OUTPUT
+#define FSCTL_GET_FILTER_FILE_IDENTIFIER        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 241, METHOD_BUFFERED, FILE_ANY_ACCESS) // GET_FILTER_FILE_IDENTIFIER_INPUT, GET_FILTER_FILE_IDENTIFIER_OUTPUT
+
+#define FSCTL_STREAMS_QUERY_PARAMETERS          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 241, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_STREAMS_ASSOCIATE_ID              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 242, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_STREAMS_QUERY_ID                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 243, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_GET_RETRIEVAL_POINTERS_AND_REFCOUNT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 244, METHOD_NEITHER,  FILE_ANY_ACCESS) // STARTING_VCN_INPUT_BUFFER, RETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER
+
+#define FSCTL_QUERY_VOLUME_NUMA_INFO            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 245, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+
+#define FSCTL_REFS_DEALLOCATE_RANGES            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 246, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_QUERY_REFS_SMR_VOLUME_INFO         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 247, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SET_REFS_SMR_VOLUME_GC_PARAMETERS  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 248, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SET_REFS_FILE_STRICTLY_SEQUENTIAL  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 249, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_DUPLICATE_EXTENTS_TO_FILE_EX      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_QUERY_BAD_RANGES                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 251, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SET_DAX_ALLOC_ALIGNMENT_HINT      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 252, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_DELETE_CORRUPTED_REFS_CONTAINER   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 253, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SCRUB_UNDISCOVERABLE_ID           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 254, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_NOTIFY_DATA_CHANGE                CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 255, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_START_VIRTUALIZATION_INSTANCE_EX  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 256, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_ENCRYPTION_KEY_CONTROL            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 257, METHOD_BUFFERED, FILE_ANY_ACCESS)  // protect/unprotect under DPL
+#define FSCTL_VIRTUAL_STORAGE_SET_BEHAVIOR      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 258, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_SET_REPARSE_POINT_EX              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 259, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // REPARSE_DATA_BUFFER_EX
+#define FSCTL_REARRANGE_FILE                    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 264, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS) // REARRANGE_FILE_DATA
+#define FSCTL_VIRTUAL_STORAGE_PASSTHROUGH       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 265, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_GET_RETRIEVAL_POINTER_COUNT       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 266, METHOD_NEITHER,  FILE_ANY_ACCESS) // STARTING_VCN_INPUT_BUFFER, RETRIEVAL_POINTER_COUNT
+#define FSCTL_ENABLE_PER_IO_FLAGS               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 267, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_QUERY_ASYNC_DUPLICATE_EXTENTS_STATUS  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 268, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SMB_SHARE_FLUSH_AND_PURGE         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 271, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_REFS_STREAM_SNAPSHOT_MANAGEMENT   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 272, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_MANAGE_BYPASS_IO                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 274, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_REFS_DEALLOCATE_RANGES_EX         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 275, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_SET_CACHED_RUNS_STATE             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 276, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_REFS_SET_VOLUME_COMPRESSION_INFO    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 277, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_REFS_QUERY_VOLUME_COMPRESSION_INFO  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 278, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_DUPLICATE_CLUSTER                     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 279, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CREATE_LCN_WEAK_REFERENCE             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 280, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CLEAR_LCN_WEAK_REFERENCE              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 281, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_QUERY_LCN_WEAK_REFERENCE              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 282, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CLEAR_ALL_LCN_WEAK_REFERENCES         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 283, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_REFS_SET_VOLUME_DEDUP_INFO            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 284, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_REFS_QUERY_VOLUME_DEDUP_INFO          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 285, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_LMR_QUERY_INFO                        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 286, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_REFS_CHECKPOINT_VOLUME                CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 287, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_REFS_QUERY_VOLUME_TOTAL_SHARED_LCNS   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 288, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_UPGRADE_VOLUME                    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 289, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_REFS_SET_VOLUME_IO_METRICS_INFO       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 290, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_REFS_QUERY_VOLUME_IO_METRICS_INFO     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 291, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_REFS_SET_ROLLBACK_PROTECTION_INFO     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 292, METHOD_BUFFERED, FILE_ANY_ACCESS) // REFS_SET_ROLLBACK_PROTECTION_INFO_INPUT_BUFFER
+#define FSCTL_REFS_QUERY_ROLLBACK_PROTECTION_INFO   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 293, METHOD_BUFFERED, FILE_ANY_ACCESS) // REFS_QUERY_ROLLBACK_PROTECTION_INFO_OUTPUT_BUFFER
+#define FSCTL_FILE_SOV_CHECK_RANGE                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 294, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CASCADES_REFS_SET_FILE_REMOTE         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 295, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+
+//
+// These are the IOCTLs supported by the mount point manager.
+//
+
+#define MOUNTMGR_DEVICE_NAME                        u"\\Device\\MountPointManager"
+#define MOUNTMGR_DOS_DEVICE_NAME                    u"\\\\.\\MountPointManager"
+
+#define MOUNTMGRCONTROLTYPE                         0x0000006D // 'm'
+#define MOUNTDEVCONTROLTYPE                         0x0000004D // 'M'
+
+#define IOCTL_MOUNTMGR_CREATE_POINT                 CTL_CODE(MOUNTMGRCONTROLTYPE, 0, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_DELETE_POINTS                CTL_CODE(MOUNTMGRCONTROLTYPE, 1, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_QUERY_POINTS                 CTL_CODE(MOUNTMGRCONTROLTYPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define IOCTL_MOUNTMGR_DELETE_POINTS_DBONLY         CTL_CODE(MOUNTMGRCONTROLTYPE, 3, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_NEXT_DRIVE_LETTER            CTL_CODE(MOUNTMGRCONTROLTYPE, 4, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_AUTO_DL_ASSIGNMENTS          CTL_CODE(MOUNTMGRCONTROLTYPE, 5, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_CREATED   CTL_CODE(MOUNTMGRCONTROLTYPE, 6, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_DELETED   CTL_CODE(MOUNTMGRCONTROLTYPE, 7, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_CHANGE_NOTIFY                CTL_CODE(MOUNTMGRCONTROLTYPE, 8, METHOD_BUFFERED, FILE_READ_ACCESS)
+#define IOCTL_MOUNTMGR_KEEP_LINKS_WHEN_OFFLINE      CTL_CODE(MOUNTMGRCONTROLTYPE, 9, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_CHECK_UNPROCESSED_VOLUMES    CTL_CODE(MOUNTMGRCONTROLTYPE, 10, METHOD_BUFFERED, FILE_READ_ACCESS)
+#define IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION  CTL_CODE(MOUNTMGRCONTROLTYPE, 11, METHOD_BUFFERED, FILE_READ_ACCESS)

ctypes_generation/definitions/defines/kuser_shared_data.txt

@@ -0,0 +1,14 @@
+#define MM_SHARED_USER_DATA_VA 0x7FFE0000
+
+#define XSTATE_LEGACY_FLOATING_POINT        (0)
+#define XSTATE_LEGACY_SSE                   (1)
+#define XSTATE_GSSE                         (2)
+#define XSTATE_AVX                          (XSTATE_GSSE)
+#define XSTATE_MPX_BNDREGS                  (3)
+#define XSTATE_MPX_BNDCSR                   (4)
+#define XSTATE_AVX512_KMASK                 (5)
+#define XSTATE_AVX512_ZMM_H                 (6)
+#define XSTATE_AVX512_ZMM                   (7)
+#define XSTATE_IPT                          (8)
+#define XSTATE_LWP                          (62)
+#define MAXIMUM_XSTATE_FEATURES             (64)

ctypes_generation/definitions/defines/proc_thread_attributes.txt

@@ -0,0 +1,79 @@
+// We have a rare case of defines that depends on an enum
+// Which is PROC_THREAD_ATTRIBUTE_NUM
+// So i Will just define a copy of those as define here
+// Define version copied from: https://github.com/winsiderss/systeminformer/blob/master/phnt/include/ntpsapi.h#L2666
+// Thx to them, as always :)
+
+#define ProcThreadAttributeParentProcess 0 // in HANDLE
+#define ProcThreadAttributeExtendedFlags 1 // in ULONG (EXTENDED_PROCESS_CREATION_FLAG_*)
+#define ProcThreadAttributeHandleList 2 // in HANDLE[]
+#define ProcThreadAttributeGroupAffinity 3 // in GROUP_AFFINITY // since WIN7
+#define ProcThreadAttributePreferredNode 4 // in USHORT
+#define ProcThreadAttributeIdealProcessor 5 // in PROCESSOR_NUMBER
+#define ProcThreadAttributeUmsThread 6 // in UMS_CREATE_THREAD_ATTRIBUTES
+#define ProcThreadAttributeMitigationPolicy 7 // in ULONG, ULONG64, or ULONG64[2]
+#define ProcThreadAttributePackageFullName 8 // in WCHAR[] // since WIN8
+#define ProcThreadAttributeSecurityCapabilities 9 // in SECURITY_CAPABILITIES
+#define ProcThreadAttributeConsoleReference 10 // BaseGetConsoleReference (kernelbase.dll)
+#define ProcThreadAttributeProtectionLevel 11 // in ULONG (PROTECTION_LEVEL_*) // since WINBLUE
+#define ProcThreadAttributeOsMaxVersionTested 12 // in MAXVERSIONTESTED_INFO // since THRESHOLD // (from exe.manifest)
+#define ProcThreadAttributeJobList 13 // in HANDLE[]
+#define ProcThreadAttributeChildProcessPolicy 14 // in ULONG (PROCESS_CREATION_CHILD_PROCESS_*) // since THRESHOLD2
+#define ProcThreadAttributeAllApplicationPackagesPolicy 15 // in ULONG (PROCESS_CREATION_ALL_APPLICATION_PACKAGES_*) // since REDSTONE
+#define ProcThreadAttributeWin32kFilter 16 // in WIN32K_SYSCALL_FILTER
+#define ProcThreadAttributeSafeOpenPromptOriginClaim 17 // in SE_SAFE_OPEN_PROMPT_RESULTS
+#define ProcThreadAttributeDesktopAppPolicy 18 // in ULONG (PROCESS_CREATION_DESKTOP_APP_*) // since RS2
+#define ProcThreadAttributeBnoIsolation 19 // in PROC_THREAD_BNOISOLATION_ATTRIBUTE
+#define ProcThreadAttributePseudoConsole 22 // in HANDLE (HPCON) // since RS5
+#define ProcThreadAttributeIsolationManifest 23 // in ISOLATION_MANIFEST_PROPERTIES // rev (diversenok) // since 19H2+
+#define ProcThreadAttributeMitigationAuditPolicy 24 // in ULONG, ULONG64, or ULONG64[2] // since 21H1
+#define ProcThreadAttributeMachineType 25 // in USHORT // since 21H2
+#define ProcThreadAttributeComponentFilter 26 // in ULONG
+#define ProcThreadAttributeEnableOptionalXStateFeatures 27 // in ULONG64 // since WIN11
+#define ProcThreadAttributeCreateStore 28 // ULONG // rev (diversenok)
+#define ProcThreadAttributeTrustedApp 29
+#define ProcThreadAttributeSveVectorLength 30
+
+// Real definition of value usef by API
+// From: https://github.com/microsoft/win32metadata/blob/6af96d8470751e13a4e3f579f84b7b8b3ca398e1/generation/WinSDK/RecompiledIdlHeaders/um/WinBase.h#L3568
+// macro ProcThreadAttributeValue is recoded in python in template.py
+// I replace TRUE by True && FALSE by False for native python compat :)
+
+#define PROC_THREAD_ATTRIBUTE_NUMBER    0x0000FFFF
+#define PROC_THREAD_ATTRIBUTE_THREAD    0x00010000  // Attribute may be used with thread creation
+#define PROC_THREAD_ATTRIBUTE_INPUT     0x00020000  // Attribute is input only
+#define PROC_THREAD_ATTRIBUTE_ADDITIVE  0x00040000  // Attribute may be "accumulated," e.g. bitmasks,
+
+#define PROC_THREAD_ATTRIBUTE_PARENT_PROCESS \
+    ProcThreadAttributeValue (ProcThreadAttributeParentProcess, False, True, False)
+#define PROC_THREAD_ATTRIBUTE_HANDLE_LIST \
+    ProcThreadAttributeValue (ProcThreadAttributeHandleList, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY \
+    ProcThreadAttributeValue (ProcThreadAttributeGroupAffinity, True, True, False)
+#define PROC_THREAD_ATTRIBUTE_PREFERRED_NODE \
+    ProcThreadAttributeValue (ProcThreadAttributePreferredNode, False, True, False)
+#define PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR \
+    ProcThreadAttributeValue (ProcThreadAttributeIdealProcessor, True, True, False)
+#define PROC_THREAD_ATTRIBUTE_UMS_THREAD \
+    ProcThreadAttributeValue (ProcThreadAttributeUmsThread, True, True, False)
+#define PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY \
+    ProcThreadAttributeValue (ProcThreadAttributeMitigationPolicy, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES \
+    ProcThreadAttributeValue (ProcThreadAttributeSecurityCapabilities, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL \
+    ProcThreadAttributeValue (ProcThreadAttributeProtectionLevel, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE \
+    ProcThreadAttributeValue (ProcThreadAttributePseudoConsole, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_MACHINE_TYPE \
+    ProcThreadAttributeValue (ProcThreadAttributeMachineType, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES \
+    ProcThreadAttributeValue (ProcThreadAttributeEnableOptionalXStateFeatures, True, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_SVE_VECTOR_LENGTH \
+    ProcThreadAttributeValue (ProcThreadAttributeSveVectorLength, False, True, False)

ctypes_generation/definitions/defines/processor.txt

@@ -0,0 +1,38 @@
+#define PROCESSOR_INTEL_386     386
+#define PROCESSOR_INTEL_486     486
+#define PROCESSOR_INTEL_PENTIUM 586
+#define PROCESSOR_INTEL_IA64    2200
+#define PROCESSOR_MIPS_R4000    4000    // incl R4101 & R3910 for Windows CE
+#define PROCESSOR_ALPHA_21064   21064
+#define PROCESSOR_PPC_601       601
+#define PROCESSOR_PPC_603       603
+#define PROCESSOR_PPC_604       604
+#define PROCESSOR_PPC_620       620
+#define PROCESSOR_HITACHI_SH3   10003   // Windows CE
+#define PROCESSOR_HITACHI_SH3E  10004   // Windows CE
+#define PROCESSOR_HITACHI_SH4   10005   // Windows CE
+#define PROCESSOR_MOTOROLA_821  821     // Windows CE
+#define PROCESSOR_SHx_SH3       103     // Windows CE
+#define PROCESSOR_SHx_SH4       104     // Windows CE
+#define PROCESSOR_STRONGARM     2577    // Windows CE - 0xA11
+#define PROCESSOR_ARM720        1824    // Windows CE - 0x720
+#define PROCESSOR_ARM820        2080    // Windows CE - 0x820
+#define PROCESSOR_ARM920        2336    // Windows CE - 0x920
+#define PROCESSOR_ARM_7TDMI     70001   // Windows CE
+#define PROCESSOR_OPTIL         0x494f  // MSIL
+
+#define PROCESSOR_ARCHITECTURE_INTEL            0
+#define PROCESSOR_ARCHITECTURE_MIPS             1
+#define PROCESSOR_ARCHITECTURE_ALPHA            2
+#define PROCESSOR_ARCHITECTURE_PPC              3
+#define PROCESSOR_ARCHITECTURE_SHX              4
+#define PROCESSOR_ARCHITECTURE_ARM              5
+#define PROCESSOR_ARCHITECTURE_IA64             6
+#define PROCESSOR_ARCHITECTURE_ALPHA64          7
+#define PROCESSOR_ARCHITECTURE_MSIL             8
+#define PROCESSOR_ARCHITECTURE_AMD64            9
+#define PROCESSOR_ARCHITECTURE_IA32_ON_WIN64    10
+#define PROCESSOR_ARCHITECTURE_NEUTRAL          11
+#define PROCESSOR_ARCHITECTURE_ARM64            12
+#define PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64   13
+#define PROCESSOR_ARCHITECTURE_UNKNOWN          0xFFFF

ctypes_generation/definitions/defines/section.txt

@@ -0,0 +1 @@
+#define MEM_EXTENDED_PARAMETER_TYPE_BITS    8

ctypes_generation/definitions/defines/security.txt

@@ -23,7 +23,6 @@
 #define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE   (0xF)
 #define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE   (0x10)
 #define SYSTEM_MANDATORY_LABEL_ACE_TYPE         (0x11)
-#define ACCESS_MAX_MS_V5_ACE_TYPE               (0x11)
 #define SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE      (0x12)
 #define SYSTEM_SCOPED_POLICY_ID_ACE_TYPE        (0x13)
 #define SYSTEM_PROCESS_TRUST_LABEL_ACE_TYPE     (0x14)

ctypes_generation/definitions/defines/services.txt

@@ -1,3 +1,5 @@
+/* Specific Access Rights are in <specific_access_right.txt> */
+
 //
 // Service trigger types
 //
@@ -19,8 +21,6 @@
 #define SERVICE_TRIGGER_DATA_TYPE_KEYWORD_ANY                       4
 #define SERVICE_TRIGGER_DATA_TYPE_KEYWORD_ALL                       5
 
-// Specific Access Rights are in <specific_access_right.txt>
-
 
 #define SERVICE_RUNS_IN_SYSTEM_PROCESS  0x00000001
 
@@ -35,16 +35,32 @@
 #define SERVICE_WIN32_OWN_PROCESS      0x00000010
 #define SERVICE_WIN32_SHARE_PROCESS    0x00000020
 
-#define SERVICE_USER_OWN_PROCESS       0x00000050
-#define SERVICE_USER_SHARE_PROCESS     0x00000060
 
 #define SERVICE_WIN32                  (SERVICE_WIN32_OWN_PROCESS | SERVICE_WIN32_SHARE_PROCESS)
 
 #define SERVICE_INTERACTIVE_PROCESS    0x00000100
 
+/*
+Legacy value changed with Win10 build 14942
+https://github.com/processhacker/processhacker/issues/120
+*/
 #define SERVICE_TYPE_ALL               (SERVICE_WIN32 | SERVICE_ADAPTER | SERVICE_DRIVER | SERVICE_INTERACTIVE_PROCESS)
 
 
+/* New service Type from Win10 build 14942 */
+
+#define SERVICE_USER_SERVICE 0x00000040
+#define SERVICE_USERSERVICE_INSTANCE 0x00000080
+#define SERVICE_USER_SHARE_PROCESS (SERVICE_USER_SERVICE |
+SERVICE_WIN32_SHARE_PROCESS)
+#define SERVICE_USER_OWN_PROCESS (SERVICE_USER_SERVICE |
+SERVICE_WIN32_OWN_PROCESS)
+#define SERVICE_PKG_SERVICE 0x00000200
+
+
+/* Make a value for the new SERVICE_TYPE_ALL ? */
+
+
 #define SERVICE_BOOT_START             0x00000000
 #define SERVICE_SYSTEM_START           0x00000001
 #define SERVICE_AUTO_START             0x00000002

ctypes_generation/definitions/defines/specific_access_right.txt

@@ -258,15 +258,15 @@
 #define FAX_JOB_MANAGE          (0x0040)
 
 
-// COM Specific Access Rights (Custom NAME)
+// COM Specific Access Rights
-// Based on internet search for "COM Access Mask"
+// Based on https://learn.microsoft.com/en-us/windows/win32/com/access-control-lists-for-com
 
 
-#define COM_EXECUTE              (0x0001)
+#define COM_RIGHTS_EXECUTE              (0x0001)
-#define COM_EXECUTE_LOCAL        (0x0002)
+#define COM_RIGHTS_EXECUTE_LOCAL        (0x0002)
-#define COM_EXECUTE_REMOTE       (0x0004)
+#define COM_RIGHTS_EXECUTE_REMOTE       (0x0004)
-#define COM_ACTIVATE_LOCAL       (0x0008)
+#define COM_RIGHTS_ACTIVATE_LOCAL       (0x0008)
-#define COM_ACTIVATE_REMOTE      (0x0010)
+#define COM_RIGHTS_ACTIVATE_REMOTE      (0x0010)
 
 //
 // Section Access Rights.

ctypes_generation/definitions/defines/template.py

@@ -5,3 +5,38 @@ bits = platform.architecture()[0]
 bitness =  int(bits[:2])
 
 NATIVE_WORD_MAX_VALUE = 0xffffffff if bitness == 32 else 0xffffffffffffffff
+
+# python implementation of CTL_CODE (macro to compute IOCTL code from param.
+# The python implem simplify the code parsing define (macro) by not handling macro functions
+
+# Original MACRO:
+#
+#    #define CTL_CODE( DeviceType, Function, Method, Access ) (                 \
+#        ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
+#    )
+
+def CTL_CODE(DeviceType, Function, Method, Access):
+    return (((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method))
+
+# https://learn.microsoft.com/en-us/windows/win32/api/winerror/nf-winerror-hresult_facility
+# Original MACRO:
+#   #define HRESULT_FACILITY(hr)  (((hr) >> 16) & 0x1fff)
+
+def HRESULT_FACILITY(hr):
+    return (((hr) >> 16) & 0x1fff)
+
+# https://github.com/microsoft/win32metadata/blob/6af96d8470751e13a4e3f579f84b7b8b3ca398e1/generation/WinSDK/RecompiledIdlHeaders/um/WinBase.h#L3562
+# Original MACRO:
+
+#define ProcThreadAttributeValue(Number, Thread, Input, Additive) \
+#      (((Number) & PROC_THREAD_ATTRIBUTE_NUMBER) | \
+#       ((Thread != FALSE) ? PROC_THREAD_ATTRIBUTE_THREAD : 0) | \
+#       ((Input != FALSE) ? PROC_THREAD_ATTRIBUTE_INPUT : 0) | \
+#       ((Additive != FALSE) ? PROC_THREAD_ATTRIBUTE_ADDITIVE : 0))
+
+def ProcThreadAttributeValue(Number, Thread, Input, Additive):
+    return ((Number & PROC_THREAD_ATTRIBUTE_NUMBER) |
+             (Thread and PROC_THREAD_ATTRIBUTE_THREAD) |
+             (Input and PROC_THREAD_ATTRIBUTE_INPUT) |
+             (Additive and PROC_THREAD_ATTRIBUTE_ADDITIVE))
+

ctypes_generation/definitions/defines/thread_context.txt

@@ -0,0 +1,61 @@
+// Atrget architecture description
+
+#define CONTEXT_I386    0x00010000 // An old PFW error in case ?
+#define CONTEXT_AMD64   0x00100000
+#define CONTEXT_ARM   0x00200000
+#define CONTEXT_ARM64   0x00400000
+#define CONTEXT_i386    0x00010000L    // this assumes that i386 and
+#define CONTEXT_i486    0x00010000L    // i486 have identical context records
+#define WOW64_CONTEXT_i386      0x00010000    // this assumes that i386 and
+#define WOW64_CONTEXT_i486      0x00010000    // i486 have identical context records
+
+// Not perfect, should be explicitly for an architecture
+
+#define CONTEXT_CONTROL             0x00000001L
+#define CONTEXT_INTEGER             0x00000002L
+#define CONTEXT_SEGMENTS            0x00000004L
+#define CONTEXT_FLOATING_POINT      0x00000008L
+#define CONTEXT_DEBUG_REGISTERS     0x00000010L
+#define CONTEXT_EXTENDED_REGISTERS  0x00000020L
+#define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS)
+#define CONTEXT_ALL (CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS)
+
+#define CONTEXT_XSTATE          (CONTEXT_I386 | 0x00000040L)
+
+// WOW64
+
+
+
+#define WOW64_CONTEXT_CONTROL               (WOW64_CONTEXT_i386 | 0x00000001L) // SS:SP, CS:IP, FLAGS, BP
+#define WOW64_CONTEXT_INTEGER               (WOW64_CONTEXT_i386 | 0x00000002L) // AX, BX, CX, DX, SI, DI
+#define WOW64_CONTEXT_SEGMENTS              (WOW64_CONTEXT_i386 | 0x00000004L) // DS, ES, FS, GS
+#define WOW64_CONTEXT_FLOATING_POINT        (WOW64_CONTEXT_i386 | 0x00000008L) // 387 state
+#define WOW64_CONTEXT_DEBUG_REGISTERS       (WOW64_CONTEXT_i386 | 0x00000010L) // DB 0-3,6,7
+#define WOW64_CONTEXT_EXTENDED_REGISTERS    (WOW64_CONTEXT_i386 | 0x00000020L) // cpu specific extensions
+
+#define WOW64_CONTEXT_FULL      (WOW64_CONTEXT_CONTROL | WOW64_CONTEXT_INTEGER | WOW64_CONTEXT_SEGMENTS)
+
+#define WOW64_CONTEXT_ALL       (WOW64_CONTEXT_CONTROL | WOW64_CONTEXT_INTEGER | WOW64_CONTEXT_SEGMENTS | \
+                                 WOW64_CONTEXT_FLOATING_POINT | WOW64_CONTEXT_DEBUG_REGISTERS | \
+                                 WOW64_CONTEXT_EXTENDED_REGISTERS)
+
+#define WOW64_CONTEXT_XSTATE                (WOW64_CONTEXT_i386 | 0x00000040L)
+
+#define WOW64_CONTEXT_EXCEPTION_ACTIVE      0x08000000
+#define WOW64_CONTEXT_SERVICE_ACTIVE        0x10000000
+#define WOW64_CONTEXT_EXCEPTION_REQUEST     0x40000000
+#define WOW64_CONTEXT_EXCEPTION_REPORTING   0x80000000
+
+// ARM64
+
+#define CONTEXT_ARM64_CONTROL (CONTEXT_ARM64 | 0x1L)
+#define CONTEXT_ARM64_INTEGER (CONTEXT_ARM64 | 0x2L)
+#define CONTEXT_ARM64_FLOATING_POINT  (CONTEXT_ARM64 | 0x4L)
+#define CONTEXT_ARM64_DEBUG_REGISTERS (CONTEXT_ARM64 | 0x8L)
+#define CONTEXT_ARM64_X18 (CONTEXT_ARM64 | 0x10L)
+
+#define CONTEXT_UNWOUND_TO_CALL 0x20000000
+#define CONTEXT_RET_TO_GUEST    0x04000000
+
+#define ARM64_MAX_BREAKPOINTS     8
+#define ARM64_MAX_WATCHPOINTS     2

ctypes_generation/definitions/defines/windef.txt

@@ -130,21 +130,6 @@
 #define TH32CS_SNAPALL      (TH32CS_SNAPHEAPLIST | TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD | TH32CS_SNAPMODULE)
 #define TH32CS_INHERIT      0x80000000
 
-#define CONTEXT_I386    0x00010000
-
-#define CONTEXT_CONTROL             0x00000001L
-#define CONTEXT_INTEGER             0x00000002L
-#define CONTEXT_SEGMENTS            0x00000004L
-#define CONTEXT_FLOATING_POINT      0x00000008L
-#define CONTEXT_DEBUG_REGISTERS     0x00000010L
-#define CONTEXT_EXTENDED_REGISTERS  0x00000020L
-#define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS)
-#define CONTEXT_ALL (CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS)
-
-#define CONTEXT_FULL CONTEXT_I386 | CONTEXT_FULL
-#define CONTEXT_ALL  CONTEXT_I386 | CONTEXT_ALL
-#define CONTEXT_XSTATE          (CONTEXT_I386 | 0x00000040L)
-
 
 #define PAGE_NOACCESS          0x01
 #define PAGE_READONLY          0x02
@@ -668,4 +653,7 @@
 
 #define TXFS_MINIVERSION_COMMITTED_VIEW                  (0x0000)
 #define TXFS_MINIVERSION_DIRTY_VIEW                      (0xFFFF)
-#define TXFS_MINIVERSION_DEFAULT_VIEW                    (0xFFFE)
+#define TXFS_MINIVERSION_DEFAULT_VIEW                    (0xFFFE)
+
+
+#define PROCESSOR_FEATURE_MAX 64

ctypes_generation/definitions/defines/windef_pe.txt

@@ -100,4 +100,6 @@
 #define IMAGE_FILE_MACHINE_AMD64             0x8664
 #define IMAGE_FILE_MACHINE_M32R              0x9041
 #define IMAGE_FILE_MACHINE_CEE               0xC0EE
-#define IMAGE_FILE_MACHINE_ARM64             0xAA64
+#define IMAGE_FILE_MACHINE_ARM64             0xAA64
+
+#define IMAGE_FILE_MACHINE_TARGET_HOST      0x0001  // Useful for indicating we want to interact with the host and not a WoW guest.

ctypes_generation/definitions/defines/wintrust_crypt_def.txt

@@ -387,6 +387,38 @@
 #define CRYPT_ARCHIVABLE        0x00004000
 #define CRYPT_FORCE_KEY_PROTECTION_HIGH 0x00008000
 
+#define CERT_RDN_ANY_TYPE 0
+#define CERT_RDN_ENCODED_BLOB 1
+#define CERT_RDN_OCTET_STRING 2
+#define CERT_RDN_NUMERIC_STRING 3
+#define CERT_RDN_PRINTABLE_STRING 4
+#define CERT_RDN_TELETEX_STRING 5
+#define CERT_RDN_T61_STRING 5
+#define CERT_RDN_VIDEOTEX_STRING 6
+#define CERT_RDN_IA5_STRING 7
+#define CERT_RDN_GRAPHIC_STRING 8
+#define CERT_RDN_VISIBLE_STRING 9
+#define CERT_RDN_ISO646_STRING 9
+#define CERT_RDN_GENERAL_STRING 10
+#define CERT_RDN_UNIVERSAL_STRING 11
+#define CERT_RDN_INT4_STRING 11
+#define CERT_RDN_BMP_STRING 12
+#define CERT_RDN_UNICODE_STRING 12
+#define CERT_RDN_UTF8_STRING 13
+#define CERT_RDN_TYPE_MASK 0xff
+#define CERT_RDN_FLAGS_MASK 0xff000000
+#define CERT_RDN_ENABLE_T61_UNICODE_FLAG 0x80000000
+#define CERT_RDN_ENABLE_UTF8_UNICODE_FLAG 0x20000000
+#define CERT_RDN_FORCE_UTF8_UNICODE_FLAG 0x10000000
+#define CERT_RDN_DISABLE_CHECK_TYPE_FLAG 0x40000000
+#define CERT_RDN_DISABLE_IE4_UTF8_FLAG 0x1000000
+
+#define CRYPT_DECODE_NOCOPY_FLAG 0x1
+#define CRYPT_DECODE_TO_BE_SIGNED_FLAG 0x2
+#define CRYPT_DECODE_SHARE_OID_STRING_FLAG 0x4
+#define CRYPT_DECODE_NO_SIGNATURE_BYTE_REVERSAL_FLAG 0x8
+#define CRYPT_DECODE_ALLOC_FLAG 0x8000
+#define CRYPT_UNICODE_NAME_DECODE_DISABLE_IE4_UTF8_FLAG CERT_RDN_DISABLE_IE4_UTF8_FLAG
 
 #define CRYPT_ENCODE_DECODE_NONE            0
 #define X509_CERT                           (1)
@@ -582,4 +614,47 @@
 #define CMSG_CTRL_MAIL_LIST_DECRYPT      18
 #define CMSG_CTRL_VERIFY_SIGNATURE_EX    19
 #define CMSG_CTRL_ADD_CMS_SIGNER_INFO    20
-#define CMSG_CTRL_ENABLE_STRONG_SIGNATURE 21
+#define CMSG_CTRL_ENABLE_STRONG_SIGNATURE 21
+
+
+//+-------------------------------------------------------------------------
+//  The following flag should be set in the above dwFlags to enable
+//  a CertSetCertificateContextProperty(CERT_KEY_CONTEXT_PROP_ID) after a
+//  CryptAcquireContext is done in the Sign or Decrypt Message functions.
+//
+//  The following define must not collide with any of the
+//  CryptAcquireContext dwFlag defines.
+//--------------------------------------------------------------------------
+#define CERT_SET_KEY_PROV_HANDLE_PROP_ID    0x00000001
+#define CERT_SET_KEY_CONTEXT_PROP_ID        0x00000001
+
+// Special dwKeySpec indicating a CNG NCRYPT_KEY_HANDLE instead of a CAPI1
+// HCRYPTPROV
+#define CERT_NCRYPT_KEY_SPEC                0xFFFFFFFF
+
+
+#define CERT_REQUEST_V1     0
+
+
+// Include\10.0.10240.0\um\wincrypt.h
+
+#define CRYPT_STRING_BASE64HEADER           0x00000000
+#define CRYPT_STRING_BASE64                 0x00000001
+#define CRYPT_STRING_BINARY                 0x00000002
+#define CRYPT_STRING_BASE64REQUESTHEADER    0x00000003
+#define CRYPT_STRING_HEX                    0x00000004
+#define CRYPT_STRING_HEXASCII               0x00000005
+#define CRYPT_STRING_BASE64_ANY             0x00000006
+#define CRYPT_STRING_ANY                    0x00000007
+#define CRYPT_STRING_HEX_ANY                0x00000008
+#define CRYPT_STRING_BASE64X509CRLHEADER    0x00000009
+#define CRYPT_STRING_HEXADDR                0x0000000a
+#define CRYPT_STRING_HEXASCIIADDR           0x0000000b
+#define CRYPT_STRING_HEXRAW                 0x0000000c
+#define CRYPT_STRING_BASE64URI              0x0000000d
+
+#define CRYPT_STRING_PERCENTESCAPE          0x08000000	// base64 formats only
+#define CRYPT_STRING_HASHDATA               0x10000000
+#define CRYPT_STRING_STRICT                 0x20000000
+#define CRYPT_STRING_NOCRLF                 0x40000000
+#define CRYPT_STRING_NOCR                   0x80000000

ctypes_generation/definitions/functions/com.txt

@@ -118,10 +118,6 @@ HRESULT SafeArrayGetVartype(
   [out] VARTYPE   *pvt
 );
 
-VOID SysFreeString(
-  [in, optional] BSTR bstrString
-);
-
 HRESULT SafeArrayCopy(
   [in]  SAFEARRAY   *psa,
   [out] LPSAFEARRAY *ppsaOut
@@ -139,4 +135,31 @@ PVOID SysAllocString(
 
 VOID SysFreeString(
   [in, optional] BSTR bstrString
-);
+);
+
+
+HRESULT CreateStreamOnHGlobal(
+  [in]  HGLOBAL  hGlobal,
+  [in]  BOOL     fDeleteOnRelease,
+  [out] LPSTREAM *ppstm
+);
+
+HRESULT GetHGlobalFromStream(
+  [in]  LPUNKNOWN    pstm,
+  [out] HGLOBAL  *phglobal
+);
+
+HRESULT CoMarshalInterface(
+  [in]           LPUNKNOWN pStm,
+  [in]           REFIID    riid,
+  [in]           LPUNKNOWN pUnk,
+  [in]           DWORD     dwDestContext,
+  [in, optional] LPVOID    pvDestContext,
+  [in]           DWORD     mshlflags
+);
+
+HRESULT CoUnmarshalInterface(
+  [in]  PVOID    pStm,
+  [in]  REFIID   riid,
+  [out] LPVOID   *ppv
+);

ctypes_generation/definitions/functions/crypto_wintrust.txt

@@ -52,11 +52,6 @@ BOOL WINAPI CryptCATAdminReleaseContext(
   _In_ DWORD     dwFlags
 );
 
-CRYPTCATATTRIBUTE* WINAPI CryptCATGetAttrInfo(
-  _In_ HANDLE         hCatalog,
-  _In_ CRYPTCATMEMBER *pCatMember,
-  _In_ LPWSTR         pwszReferenceTag
-);
 
 CRYPTCATMEMBER* WINAPI CryptCATGetMemberInfo(
   _In_ HANDLE hCatalog,
@@ -323,24 +318,7 @@ BOOL CryptDestroyHash(
   HCRYPTHASH hHash
 );
 
-BOOL CryptEncrypt(
-  HCRYPTKEY  hKey,
-  HCRYPTHASH hHash,
-  BOOL       Final,
-  DWORD      dwFlags,
-  BYTE       *pbData,
-  DWORD      *pdwDataLen,
-  DWORD      dwBufLen
-);
 
-BOOL CryptDecrypt(
-  HCRYPTKEY  hKey,
-  HCRYPTHASH hHash,
-  BOOL       Final,
-  DWORD      dwFlags,
-  BYTE       *pbData,
-  DWORD      *pdwDataLen
-);
 
 BOOL CryptDeriveKey(
   HCRYPTPROV hProv,
@@ -639,4 +617,64 @@ BOOL CryptGetOIDFunctionValue(
 BOOL CertCloseStore(
   HCERTSTORE hCertStore,
   DWORD      dwFlags
+);
+
+BOOL CryptSignAndEncodeCertificate(
+  [in]      BCRYPT_KEY_HANDLE           hBCryptKey,
+  [in]      DWORD                       dwKeySpec,
+  [in]      DWORD                       dwCertEncodingType,
+  [in]      LPCSTR                      lpszStructType,
+  [in]      PVOID                       pvStructInfo,
+  [in]      PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
+  [in]      PVOID                       pvHashAuxInfo,
+  [out]     BYTE                        *pbEncoded,
+  [in, out] DWORD                       *pcbEncoded
+);
+
+BOOL CryptSignCertificate(
+  [in]      BCRYPT_KEY_HANDLE           hBCryptKey,
+  [in]      DWORD                       dwKeySpec,
+  [in]      DWORD                       dwCertEncodingType,
+  [in]      BYTE                  *pbEncodedToBeSigned,
+  [in]      DWORD                       cbEncodedToBeSigned,
+  [in]      PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
+  [in]      PVOID                       pvHashAuxInfo,
+  [out]     BYTE                        *pbSignature,
+  [in, out] DWORD                       *pcbSignature
+);
+
+BOOL CryptBinaryToStringA(
+  [in]            BYTE *pbBinary,
+  [in]            DWORD      cbBinary,
+  [in]            DWORD      dwFlags,
+  [out, optional] LPSTR      pszString,
+  [in, out]       DWORD      *pcchString
+);
+
+BOOL CryptBinaryToStringW(
+  [in]            BYTE *pbBinary,
+  [in]            DWORD      cbBinary,
+  [in]            DWORD      dwFlags,
+  [out, optional] LPWSTR     pszString,
+  [in, out]       DWORD      *pcchString
+);
+
+BOOL CryptStringToBinaryA(
+  [in]      LPCSTR pszString,
+  [in]      DWORD  cchString,
+  [in]      DWORD  dwFlags,
+  [in]      BYTE   *pbBinary,
+  [in, out] DWORD  *pcbBinary,
+  [out]     DWORD  *pdwSkip,
+  [out]     DWORD  *pdwFlags
+);
+
+BOOL CryptStringToBinaryW(
+  [in]      LPCWSTR pszString,
+  [in]      DWORD   cchString,
+  [in]      DWORD   dwFlags,
+  [in]      BYTE    *pbBinary,
+  [in, out] DWORD   *pcbBinary,
+  [out]     DWORD   *pdwSkip,
+  [out]     DWORD   *pdwFlags
 );

ctypes_generation/definitions/functions/file.txt

@@ -45,9 +45,6 @@ BOOL FindCloseChangeNotification(
   HANDLE hChangeHandle
 );
 
-BOOL FindNextChangeNotification(
-  HANDLE hChangeHandle
-);
 
 BOOL ReadDirectoryChangesW(
   HANDLE                          hDirectory,
@@ -87,4 +84,23 @@ BOOL LockFileEx(
   [in]      DWORD        nNumberOfBytesToLockLow,
   [in]      DWORD        nNumberOfBytesToLockHigh,
   [in, out] LPOVERLAPPED lpOverlapped
+);
+
+BOOL SetFileInformationByHandle(
+  [in] HANDLE                    hFile,
+  [in] FILE_INFO_BY_HANDLE_CLASS FileInformationClass,
+  [in] LPVOID                    lpFileInformation,
+  [in] DWORD                     dwBufferSize
+);
+
+BOOL GetFileInformationByHandle(
+  [in]  HANDLE                       hFile,
+  [out] LPBY_HANDLE_FILE_INFORMATION lpFileInformation
+);
+
+BOOL GetFileInformationByHandleEx(
+  [in]  HANDLE                    hFile,
+  [in]  FILE_INFO_BY_HANDLE_CLASS FileInformationClass,
+  [out] LPVOID                    lpFileInformation,
+  [in]  DWORD                     dwBufferSize
 );

ctypes_generation/definitions/functions/internet.txt

@@ -104,21 +104,7 @@ BOOL InternetSetOptionW(
   DWORD     dwBufferLength
 );
 
-BOOL HttpSendRequestA(
-  HINTERNET hRequest,
-  LPCSTR    lpszHeaders,
-  DWORD     dwHeadersLength,
-  LPVOID    lpOptional,
-  DWORD     dwOptionalLength
-);
 
-BOOL HttpSendRequestW(
-  HINTERNET hRequest,
-  LPCWSTR   lpszHeaders,
-  DWORD     dwHeadersLength,
-  LPVOID    lpOptional,
-  DWORD     dwOptionalLength
-);
 
 BOOL InternetReadFile(
   HINTERNET hFile,

ctypes_generation/definitions/functions/io.txt

@@ -0,0 +1,51 @@
+BOOL GetOverlappedResult(
+  [in]  HANDLE       hFile,
+  [in]  LPOVERLAPPED lpOverlapped,
+  [out] LPDWORD      lpNumberOfBytesTransferred,
+  [in]  BOOL         bWait
+);
+
+HANDLE CreateIoCompletionPort(
+  [in]           HANDLE    FileHandle,
+  [in, optional] HANDLE    ExistingCompletionPort,
+  [in]           ULONG_PTR CompletionKey,
+  [in]           DWORD     NumberOfConcurrentThreads
+);
+
+BOOL GetQueuedCompletionStatus(
+  [in]  HANDLE       CompletionPort,
+        LPDWORD      lpNumberOfBytesTransferred,
+  [out] PULONG_PTR   lpCompletionKey,
+  [out] LPOVERLAPPED *lpOverlapped,
+  [in]  DWORD        dwMilliseconds
+);
+
+BOOL GetQueuedCompletionStatusEx(
+  [in]  HANDLE             CompletionPort,
+  [out] LPOVERLAPPED_ENTRY lpCompletionPortEntries,
+  [in]  ULONG              ulCount,
+  [out] PULONG             ulNumEntriesRemoved,
+  [in]  DWORD              dwMilliseconds,
+  [in]  BOOL               fAlertable
+);
+
+BOOL PostQueuedCompletionStatus(
+  [in]           HANDLE       CompletionPort,
+  [in]           DWORD        dwNumberOfBytesTransferred,
+  [in]           ULONG_PTR    dwCompletionKey,
+  [in, optional] LPOVERLAPPED lpOverlapped
+);
+
+BOOL CancelIo(
+  [in] HANDLE hFile
+);
+
+BOOL CancelIoEx(
+  [in]           HANDLE       hFile,
+  [in, optional] LPOVERLAPPED lpOverlapped
+);
+
+BOOL CancelSynchronousIo(
+  [in] HANDLE hThread
+);
+

ctypes_generation/definitions/functions/ncrypt.txt

@@ -0,0 +1,14 @@
+SECURITY_STATUS NCryptOpenKey(
+  [in]  NCRYPT_PROV_HANDLE hProvider,
+  [out] NCRYPT_KEY_HANDLE  *phKey,
+  [in]  LPCWSTR            pszKeyName,
+  [in]  DWORD              dwLegacyKeySpec,
+  [in]  DWORD              dwFlags
+);
+
+
+SECURITY_STATUS NCryptOpenStorageProvider(
+  [out]          NCRYPT_PROV_HANDLE *phProvider,
+  [in, optional] LPCWSTR            pszProviderName,
+  [in]           DWORD              dwFlags
+);

ctypes_generation/definitions/functions/netapi.txt

@@ -1,14 +1,3 @@
-NET_API_STATUS NetLocalGroupGetMembers(
-  [in]      LPCWSTR    servername,
-  [in]      LPCWSTR    localgroupname,
-  [in]      DWORD      level,
-  [out]     LPBYTE     *bufptr,
-  [in]      DWORD      prefmaxlen,
-  [out]     LPDWORD    entriesread,
-  [out]     LPDWORD    totalentries,
-  [in, out] PDWORD_PTR resumehandle
-);
-
 NET_API_STATUS NetQueryDisplayInformation(
   [in]  LPCWSTR ServerName,
   [in]  DWORD   Level,
@@ -68,12 +57,6 @@ NET_API_STATUS NetLocalGroupEnum(
   [in, out] PDWORD_PTR resumehandle
 );
 
-NET_API_STATUS NetLocalGroupGetInfo(
-  [in]  LPCWSTR servername,
-  [in]  LPCWSTR groupname,
-  [in]  DWORD   level,
-  [out] LPBYTE  *bufptr
-);
 
 NET_API_STATUS NetLocalGroupGetMembers(
   [in]      LPCWSTR    servername,
@@ -93,17 +76,6 @@ NET_API_STATUS NetLocalGroupGetInfo(
   [out] LPBYTE  *bufptr
 );
 
-NET_API_STATUS NetLocalGroupEnum(
-  [in]      LPCWSTR    servername,
-  [in]      DWORD      level,
-  [out]     LPBYTE     *bufptr,
-  [in]      DWORD      prefmaxlen,
-  [out]     LPDWORD    entriesread,
-  [out]     LPDWORD    totalentries,
-  [in, out] PDWORD_PTR resumehandle
-);
-
-
 NET_API_STATUS NetApiBufferFree(
   [in] LPVOID Buffer
 );

ctypes_generation/definitions/functions/process.txt

@@ -63,4 +63,23 @@ HMODULE LoadLibraryExW(
 
 BOOL FreeLibrary(
   HMODULE hLibModule
-);
+);
+
+BOOL GetProcessInformation(
+  [in] HANDLE                    hProcess,
+  [in] PROCESS_INFORMATION_CLASS ProcessInformationClass,
+       LPVOID                    ProcessInformation,
+  [in] DWORD                     ProcessInformationSize
+);
+
+BOOL SetProcessInformation(
+  [in] HANDLE                    hProcess,
+  [in] PROCESS_INFORMATION_CLASS ProcessInformationClass,
+       LPVOID                    ProcessInformation,
+  [in] DWORD                     ProcessInformationSize
+);
+
+/* Not documented by seems present since dawn of time (WRK)
+    I Prefere PVOID as a return value to allow simple cast to PEB subclass in process.py*/
+
+PVOID RtlGetCurrentPeb ();

ctypes_generation/definitions/functions/security.txt

@@ -333,9 +333,4 @@ BOOL WINAPI MakeSelfRelativeSD(
   [in]            PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
   [out, optional] PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
   [in, out]       LPDWORD              lpdwBufferLength
-);
+);
-
-BOOL WINAPI InitializeSecurityDescriptor(
-  [out] PSECURITY_DESCRIPTOR pSecurityDescriptor,
-  [in]  DWORD                dwRevision
-);

ctypes_generation/definitions/functions/service.txt

@@ -67,11 +67,6 @@ SC_HANDLE WINAPI OpenServiceW(
   _In_ DWORD     dwDesiredAccess
 );
 
-BOOL ControlService(
-  SC_HANDLE        hService,
-  DWORD            dwControl,
-  LPSERVICE_STATUS lpServiceStatus
-);
 
 BOOL QueryServiceStatus(
   SC_HANDLE        hService,
@@ -272,4 +267,38 @@ BOOL StartServiceCtrlDispatcherA(
 
 BOOL StartServiceCtrlDispatcherW(
   SERVICE_TABLE_ENTRYW *lpServiceStartTable
+);
+
+SERVICE_STATUS_HANDLE RegisterServiceCtrlHandlerExA(
+  [in]           LPCSTR                lpServiceName,
+  [in]           LPHANDLER_FUNCTION_EX lpHandlerProc,
+  [in, optional] LPVOID                lpContext
+);
+
+SERVICE_STATUS_HANDLE RegisterServiceCtrlHandlerExW(
+  [in]           LPCWSTR               lpServiceName,
+  [in]           LPHANDLER_FUNCTION_EX lpHandlerProc,
+  [in, optional] LPVOID                lpContext
+);
+
+SERVICE_STATUS_HANDLE RegisterServiceCtrlHandlerA(
+  [in] LPCSTR             lpServiceName,
+  [in] LPHANDLER_FUNCTION lpHandlerProc
+);
+
+SERVICE_STATUS_HANDLE RegisterServiceCtrlHandlerW(
+  [in] LPCWSTR            lpServiceName,
+  [in] LPHANDLER_FUNCTION lpHandlerProc
+);
+
+BOOL SetServiceStatus(
+  [in] SERVICE_STATUS_HANDLE hServiceStatus,
+  [in] LPSERVICE_STATUS      lpServiceStatus
+);
+
+BOOL SetServiceBits(
+  [in] SERVICE_STATUS_HANDLE hServiceStatus,
+  [in] DWORD                 dwServiceBits,
+  [in] BOOL                  bSetBitsOn,
+  [in] BOOL                  bUpdateImmediately
 );

ctypes_generation/definitions/functions/symbols.txt

@@ -29,6 +29,13 @@ BOOL WINAPI SymFromAddr(
   _Inout_   PSYMBOL_INFO Symbol
 );
 
+BOOL WINAPI SymFromAddrW(
+  [in]            HANDLE        hProcess,
+  [in]            DWORD64       Address,
+  [out, optional] PDWORD64      Displacement,
+  [in, out]       PSYMBOL_INFOW Symbol
+);
+
 
 BOOL WINAPI SymGetModuleInfo64(
   _In_  HANDLE             hProcess,
@@ -48,6 +55,12 @@ BOOL WINAPI SymInitialize(
   _In_     BOOL   fInvadeProcess
 );
 
+BOOL WINAPI SymInitializeW(
+  [in]           HANDLE hProcess,
+  [in, optional] PCWSTR UserSearchPath,
+  [in]           BOOL   fInvadeProcess
+);
+
 BOOL WINAPI SymFromName(
   _In_    HANDLE       hProcess,
   _In_    LPCSTR       Name,
@@ -96,20 +109,6 @@ BOOL WINAPI SymEnumSymbolsEx(
   _In_ DWORD                          Options
 );
 
-BOOL WINAPI SymEnumTypes(
-  _In_ HANDLE                         hProcess,
-  _In_ ULONG64                        BaseOfDll,
-  _In_ PVOID                          EnumSymbolsCallback,
-  _In_ PVOID                          UserContext
-);
-
-BOOL WINAPI SymEnumTypesByName(
-  _In_ HANDLE                         hProcess,
-  _In_ ULONG64                        BaseOfDll,
-  _In_ PCSTR                          mask,
-  _In_ PVOID                          EnumSymbolsCallback,
-  _In_ PVOID                          UserContext
-);
 
 BOOL WINAPI SymEnumerateModules64(
   _In_ HANDLE                      hProcess,
@@ -117,6 +116,12 @@ BOOL WINAPI SymEnumerateModules64(
   _In_ PVOID                       UserContext
 );
 
+BOOL WINAPI SymEnumerateModulesW64(
+  [in]           HANDLE                       hProcess,
+  [in]           PSYM_ENUMMODULES_CALLBACKW64 EnumModulesCallback,
+  [in, optional] PVOID                        UserContext
+);
+
 BOOL SymNext(
   HANDLE       hProcess,
   PSYMBOL_INFO si
@@ -266,6 +271,13 @@ BOOL WINAPI SymGetTypeFromName(
   _Inout_ PSYMBOL_INFO Symbol
 );
 
+BOOL WINAPI SymGetTypeFromNameW(
+  [in]      HANDLE        hProcess,
+  [in]      ULONG64       BaseOfDll,
+  [in]      PCWSTR        Name,
+  [in, out] PSYMBOL_INFOW Symbol
+);
+
 
 BOOL WINAPI SymGetTypeInfo(
   _In_  HANDLE                    hProcess,
@@ -404,4 +416,35 @@ BOOL SymSetSearchPath(
 BOOL SymSetSearchPathW(
   HANDLE hProcess,
   PCWSTR SearchPath
+);
+
+BOOL SymEnumTypes(
+  [in]           HANDLE                         hProcess,
+  [in]           ULONG64                        BaseOfDll,
+  [in]           PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback,
+  [in, optional] PVOID                          UserContext
+);
+
+BOOL SymEnumTypesW(
+  [in]           HANDLE                          hProcess,
+  [in]           ULONG64                         BaseOfDll,
+  [in]           PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback,
+  [in, optional] PVOID                           UserContext
+);
+
+BOOL SymEnumTypesByName(
+  [in]           HANDLE                         hProcess,
+  [in]           ULONG64                        BaseOfDll,
+  [in, optional] PCSTR                          mask,
+  [in]           PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback,
+  [in]           PVOID                          UserContext
+);
+
+
+BOOL SymEnumTypesByNameW(
+  [in]           HANDLE                          hProcess,
+  [in]           ULONG64                         BaseOfDll,
+  [in, optional] PCWSTR                          mask,
+  [in]           PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback,
+  [in]           PVOID                           UserContext
 );

ctypes_generation/definitions/functions/syscall.txt

@@ -182,6 +182,16 @@ NTSTATUS WINAPI NtQuerySystemInformation(
 );
 
 
+NTSTATUS WINAPI NtQuerySystemInformationEx(
+    _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
+    _In_reads_bytes_(InputBufferLength) PVOID InputBuffer,
+    _In_ ULONG InputBufferLength,
+    _Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,
+    _In_ ULONG SystemInformationLength,
+    _Out_opt_ PULONG ReturnLength
+);
+
+
 NTSTATUS WINAPI NtQueryInformationProcess(
   _In_      HANDLE           ProcessHandle,
   _In_      PROCESSINFOCLASS ProcessInformationClass,
@@ -304,19 +314,6 @@ NTSTATUS WINAPI NtFreeVirtualMemory(
 );
 
 
-
-NTSTATUS WINAPI NtGetContextThread(
-    __in    HANDLE hThread,
-    __inout LPCONTEXT lpContext
-);
-
-
-NTSTATUS WINAPI NtSetContextThread(
-    __in HANDLE hThread,
-    __in CONST LPCONTEXT lpContext
-);
-
-
 NTSTATUS NtCreateSection(
     PHANDLE            SectionHandle,
     ACCESS_MASK        DesiredAccess,
@@ -370,3 +367,28 @@ NTSTATUS NtTerminateProcess(
   HANDLE   ProcessHandle,
   NTSTATUS ExitStatus
 );
+
+
+NTSTATUS NtReadFile(
+  _In_     HANDLE           FileHandle,
+  _In_opt_ HANDLE           Event,
+  _In_opt_ PIO_APC_ROUTINE  ApcRoutine,
+  _In_opt_ PVOID            ApcContext,
+  _Out_    PIO_STATUS_BLOCK IoStatusBlock,
+  _Out_    PVOID            Buffer,
+  _In_     ULONG            Length,
+  _In_opt_ PLARGE_INTEGER   ByteOffset,
+  _In_opt_ PULONG           Key
+);
+
+NTSTATUS NtWriteFile(
+  [in]           HANDLE           FileHandle,
+  [in, optional] HANDLE           Event,
+  [in, optional] PIO_APC_ROUTINE  ApcRoutine,
+  [in, optional] PVOID            ApcContext,
+  [out]          PIO_STATUS_BLOCK IoStatusBlock,
+  [in]           PVOID            Buffer,
+  [in]           ULONG            Length,
+  [in, optional] PLARGE_INTEGER   ByteOffset,
+  [in, optional] PULONG           Key
+);

ctypes_generation/definitions/functions/sysinfo.txt

@@ -59,4 +59,12 @@ BOOL LookupAccountNameW(
   LPWSTR        ReferencedDomainName,
   LPDWORD       cchReferencedDomainName,
   PSID_NAME_USE peUse
+);
+
+PVOID GetNativeSystemInfo(
+  [out] LPSYSTEM_INFO lpSystemInfo
+);
+
+PVOID GetSystemInfo(
+  [out] LPSYSTEM_INFO lpSystemInfo
 );

ctypes_generation/definitions/functions/syswow64.txt

@@ -0,0 +1,83 @@
+BOOL IsWow64Process(
+  [in]  HANDLE hProcess,
+  [out] PBOOL  Wow64Process
+);
+
+BOOL IsWow64Process2(
+  [in]            HANDLE hProcess,
+  [out]           USHORT *pProcessMachine,
+  [out, optional] USHORT *pNativeMachine
+);
+
+HRESULT IsWow64GuestMachineSupported(
+  [in]  USHORT WowGuestMachine,
+  [out] BOOL   *MachineIsSupported
+);
+
+UINT GetSystemWow64DirectoryA(
+  [out] LPSTR lpBuffer,
+  [in]  UINT  uSize
+);
+
+UINT GetSystemWow64DirectoryW(
+  [out] LPWSTR lpBuffer,
+  [in]  UINT   uSize
+);
+
+UINT GetSystemWow64Directory2A(
+  [out] LPSTR lpBuffer,
+  [in]  UINT  uSize,
+  [in]  WORD  ImageFileMachineType
+);
+
+UINT GetSystemWow64Directory2W(
+  [out] LPWSTR lpBuffer,
+  [in]  UINT   uSize,
+  [in]  WORD   ImageFileMachineType
+);
+
+BOOL Wow64DisableWow64FsRedirection(
+  [out] PVOID *OldValue
+);
+
+BOOLEAN Wow64EnableWow64FsRedirection(
+  BOOLEAN Wow64FsEnableRedirection
+);
+
+BOOL Wow64RevertWow64FsRedirection(
+  [in] PVOID OlValue
+);
+
+BOOL Wow64GetThreadContext(
+  HANDLE         hThread,
+  PWOW64_CONTEXT lpContext
+);
+
+BOOL Wow64SetThreadContext(
+  HANDLE         hThread,
+  WOW64_CONTEXT *lpContext
+);
+
+USHORT Wow64SetThreadDefaultGuestMachine(
+  USHORT Machine
+);
+
+DWORD Wow64SuspendThread(
+  HANDLE hThread
+);
+
+NTSTATUS WINAPI NtWow64ReadVirtualMemory64(
+  _In_   HANDLE     hProcess,
+  _In_   ULONG64    lpBaseAddress,
+  _Out_  LPVOID     lpBuffer,
+  _In_   ULONG64    nSize,
+  _Out_  PULONG64   lpNumberOfBytesRead
+);
+
+NTSTATUS WINAPI NtWow64WriteVirtualMemory64(
+  _In_   HANDLE     hProcess,
+  _In_   ULONG64    lpBaseAddress,
+  _Out_  LPVOID     lpBuffer,
+  _In_   ULONG64    nSize,
+  _Out_  PULONG64   lpNumberOfBytesWritten
+);

ctypes_generation/definitions/functions/winfunc.txt

@@ -150,11 +150,15 @@ HANDLE WINAPI CreateRemoteThread(
   _Out_  LPDWORD lpThreadId
 );
 
-BOOL WINAPI VirtualProtect(
+HANDLE CreateRemoteThreadEx(
-  _In_   LPVOID lpAddress,
+  [in]            HANDLE                       hProcess,
-  _In_   SIZE_T dwSize,
+  [in, optional]  LPSECURITY_ATTRIBUTES        lpThreadAttributes,
-  _In_   DWORD flNewProtect,
+  [in]            SIZE_T                       dwStackSize,
-  _Out_  PDWORD lpflOldProtect
+  [in]            LPTHREAD_START_ROUTINE       lpStartAddress,
+  [in, optional]  LPVOID                       lpParameter,
+  [in]            DWORD                        dwCreationFlags,
+  [in, optional]  LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList,
+  [out, optional] LPDWORD                      lpThreadId
 );
 
 BOOL WINAPI CreateProcessA(
@@ -249,13 +253,6 @@ BOOL WINAPI ReadProcessMemory(
   _Out_  SIZE_T     *lpNumberOfBytesRead
 );
 
-NTSTATUS WINAPI NtWow64ReadVirtualMemory64(
-  _In_   HANDLE     hProcess,
-  _In_   ULONG64    lpBaseAddress,
-  _Out_  LPVOID     lpBuffer,
-  _In_   ULONG64    nSize,
-  _Out_  PULONG64   lpNumberOfBytesRead
-);
 
 
 BOOL WINAPI WriteProcessMemory(
@@ -267,13 +264,7 @@ BOOL WINAPI WriteProcessMemory(
 );
 
 
-NTSTATUS WINAPI NtWow64WriteVirtualMemory64(
+
-  _In_   HANDLE     hProcess,
-  _In_   ULONG64    lpBaseAddress,
-  _Out_  LPVOID     lpBuffer,
-  _In_   ULONG64    nSize,
-  _Out_  PULONG64   lpNumberOfBytesWritten
-);
 
 
 
@@ -300,15 +291,6 @@ HANDLE WINAPI CreateFileW(
     );
 
 
-
-
-
-BOOL WINAPI OpenProcessToken(
-  _In_   HANDLE ProcessHandle,
-  _In_   DWORD DesiredAccess,
-  _Out_  PHANDLE TokenHandle
-);
-
 BOOL WINAPI DuplicateToken(
   _In_  HANDLE                       ExistingTokenHandle,
   _In_  SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
@@ -326,13 +308,6 @@ BOOL WINAPI DuplicateTokenEx(
 );
 
 
-BOOL WINAPI OpenThreadToken(
-  _In_  HANDLE  ThreadHandle,
-  _In_  DWORD   DesiredAccess,
-  _In_  BOOL    OpenAsSelf,
-  _Out_ PHANDLE TokenHandle
-);
-
 BOOL WINAPI SetThreadToken(
   _In_opt_ PHANDLE Thread,
   _In_opt_ HANDLE  Token
@@ -450,6 +425,9 @@ BOOL AllocConsole();
 
 BOOL FreeConsole();
 
+UINT WINAPI GetConsoleOutputCP();
+UINT WINAPI GetConsoleCP();
+
 HANDLE WINAPI GetStdHandle(
   _In_  DWORD nStdHandle
 );
@@ -537,43 +515,12 @@ BOOL WINAPI DeviceIoControl(
   _Inout_opt_ LPOVERLAPPED lpOverlapped
 );
 
-BOOL WINAPI GetTokenInformation(
-  _In_      HANDLE                  TokenHandle,
-  _In_      TOKEN_INFORMATION_CLASS TokenInformationClass,
-  _Out_opt_ LPVOID                  TokenInformation,
-  _In_      DWORD                   TokenInformationLength,
-  _Out_     PDWORD                  ReturnLength
-);
-
-
-BOOL WINAPI Wow64DisableWow64FsRedirection(
-  _Out_ PVOID *OldValue
-);
-
-BOOL WINAPI Wow64RevertWow64FsRedirection(
-  _In_ PVOID OldValue
-);
-
-BOOLEAN WINAPI Wow64EnableWow64FsRedirection(
-  _In_ BOOLEAN Wow64FsEnableRedirection
-);
-
-BOOL WINAPI Wow64GetThreadContext(
-    _In_    HANDLE hThread,
-    _Inout_ PWOW64_CONTEXT lpContext
-);
 
 BOOL WINAPI SetConsoleCtrlHandler(
   _In_opt_ PHANDLER_ROUTINE HandlerRoutine,
   _In_     BOOL             Add
 );
 
-LONG WINAPI WinVerifyTrust(
-    _In_opt_ HWND hwnd,
-    _In_ GUID *pgActionID,
-    _Inout_ LPVOID pWVTData
-);
-
 HGLOBAL WINAPI GlobalAlloc(
   _In_ UINT   uFlags,
   _In_ SIZE_T dwBytes
@@ -703,10 +650,6 @@ DWORD WINAPI GetProcessId(
   _In_ HANDLE Process
 );
 
-BOOL WINAPI Wow64SetThreadContext(
-    __in HANDLE hThread,
-    __in CONST WOW64_CONTEXT *lpContext
-);
 
 DWORD WINAPI GetMappedFileNameW (
     __in HANDLE hProcess,

ctypes_generation/definitions/simple_types.txt

@@ -9,13 +9,12 @@ NTSTATUS = DWORD
 TDHSTATUS = ULONG
 DNS_STATUS = ULONG
 LSTATUS = LONG # Registry functions return value | typedef _Return_type_success_(return==ERROR_SUCCESS) LONG LSTATUS;
-SECURITY_INFORMATION = DWORD
-PSECURITY_INFORMATION = POINTER(SECURITY_INFORMATION)
 PULONG = POINTER(ULONG)
 PDWORD = POINTER(DWORD)
 LPDWORD = POINTER(DWORD)
 LPBYTE = POINTER(BYTE)
 ULONG_PTR = PVOID
+PULONG_PTR = POINTER(ULONG_PTR)
 LONG_PTR = PVOID
 DWORD_PTR = ULONG_PTR
 PDWORD_PTR = POINTER(DWORD_PTR)
@@ -23,6 +22,8 @@ KAFFINITY = ULONG_PTR
 KPRIORITY = LONG
 INTERNET_PORT = WORD
 
+
+
 CHAR = c_char
 PCHAR = POINTER(CHAR)
 UCHAR = c_char
@@ -39,6 +40,7 @@ LPCH = c_char_p
 LPWCH = c_wchar
 BSTR = c_wchar_p
 OLECHAR = c_wchar
+SNB = POINTER(POINTER(OLECHAR))
 POLECHAR = c_wchar_p
 PZZWSTR = c_wchar_p
 PUCHAR = POINTER(UCHAR)
@@ -65,8 +67,6 @@ PULONG64 = POINTER(ULONG64)
 PBYTE = POINTER(BYTE)
 PUINT = POINTER(UINT)
 PHKEY = POINTER(HKEY)
-ACCESS_MASK = DWORD
-REGSAM = ACCESS_MASK
 PBOOLEAN = POINTER(BOOLEAN)
 SECURITY_CONTEXT_TRACKING_MODE = BOOLEAN
 HCRYPTPROV_LEGACY = PULONG
@@ -77,7 +77,7 @@ ALG_ID = UINT
 DISPID = LONG
 MEMBERID = DISPID
 LRESULT = LONG_PTR
-LPUNKNOWN = POINTER(PVOID)
+LPUNKNOWN = PVOID
 LPPOINT = POINTER(POINT)
 LPRECT = POINTER(RECT)
 SPC_UUID = BYTE * 16
@@ -86,10 +86,16 @@ PWINDBG_EXTENSION_APIS32 = PVOID
 PWINDBG_EXTENSION_APIS64 = PVOID
 FILEOP_FLAGS = WORD
 NET_API_STATUS = DWORD
+SECURITY_STATUS = LONG // Return type of ncrypt functions
 
 
+// 2 custom PFW defintions for bitness-forces structures
+PVOID32 = DWORD
+PVOID64 = DWORD64
+
 NCRYPT_HANDLE = ULONG_PTR
 NCRYPT_PROV_HANDLE = ULONG_PTR
+BCRYPT_KEY_HANDLE = ULONG_PTR
 NCRYPT_KEY_HANDLE = ULONG_PTR
 NCRYPT_HASH_HANDLE = ULONG_PTR
 NCRYPT_SECRET_HANDLE  = ULONG_PTR
@@ -117,7 +123,6 @@ INT64 = LONGLONG
 UINT8 = BYTE
 UINT16 = USHORT
 UINT32 = UINT
-UINT64 = ULONGLONG
 
 /* LONG sized (lol..) */
 ULONG32 = UINT32
@@ -159,6 +164,8 @@ PSECURITY_DESCRIPTOR_CONTROL = POINTER(SECURITY_DESCRIPTOR_CONTROL)
 ACCESS_MASK = DWORD
 PACCESS_MASK = POINTER(ACCESS_MASK)
 
+REGSAM = ACCESS_MASK
+
 SECURITY_INFORMATION = DWORD
 PSECURITY_INFORMATION = POINTER(SECURITY_INFORMATION)
 PSECURITY_ATTRIBUTES_OPAQUE = PVOID
@@ -204,6 +211,16 @@ RPCOLEDATAREP = ULONG
 HREFTYPE = DWORD
 SFGAOF = ULONG
 
+ID = ULONG64
+MID = ID      // Machine Identifier
+OXID = ID     // Object Exporter Identifier
+OID = ID      // Object Identifer
+SETID = ID    // Ping Set Identifier
+
+// Interface pointer definition
+LPSTREAM = PVOID # Istream*
+
+
 /* SOCKET STUFF */
 
 GROUP = UINT
@@ -239,6 +256,7 @@ PTRANSLATE_ADDRESS_ROUTINE64  = PVOID # StackWalk
 PSYMBOL_REGISTERED_CALLBACK64 = PVOID # Symbols
 PSYMBOL_REGISTERED_CALLBACK = PVOID # Symbols
 PSYM_ENUMPROCESSES_CALLBACK = PVOID # Symbols
+PSYM_ENUMMODULES_CALLBACKW64 = PVOID # Symbols
 ENUMRESNAMEPROCA = PVOID # Resources
 ENUMRESNAMEPROCW = PVOID # Resources
 ENUMRESTYPEPROCA = PVOID # Resources
@@ -247,6 +265,8 @@ LPSERVICE_MAIN_FUNCTIONA = PVOID
 LPSERVICE_MAIN_FUNCTIONW = PVOID
 LPOVERLAPPED_COMPLETION_ROUTINE = PVOID
 PDNS_QUERY_COMPLETION_ROUTINE = PVOID
+LPHANDLER_FUNCTION = PVOID
+LPHANDLER_FUNCTION_EX = PVOID
 
 
 // Will be changed at import time

ctypes_generation/definitions/structures/alpc.txt

@@ -63,16 +63,16 @@ typedef union _PORT_MESSAGE32_TMP_UNION
 {
         ULONG ClientViewSize;
         ULONG CallbackId;
-} PORT_MESSAGE_TMP_UNION;
+} PORT_MESSAGE32_TMP_UNION;
 
 typedef union _PORT_MESSAGE64_TMP_UNION
 {
         ULONGLONG ClientViewSize;
         ULONG CallbackId;
-} PORT_MESSAGE_TMP_UNION;
+} PORT_MESSAGE64_TMP_UNION;
 
 
-typedef struct _PORT_MESSAGE_TMP_SUBSTRUCT_S1
+typedef struct
 {
     CSHORT DataLength;
     CSHORT TotalLength;
@@ -291,38 +291,6 @@ typedef struct _REMOTE_PORT_VIEW {
     PVOID  ViewBase;
 } REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW;
 
- typedef struct tagCOMVERSION
- {
-     USHORT MajorVersion;
-     USHORT MinorVersion;
- } COMVERSION;
-
-typedef struct tagORPCTHIS {
-   COMVERSION version;
-   ULONG flags;
-   ULONG reserved1;
-   GUID cid;
-   PVOID extensions; // [unique] ORPC_EXTENT_ARRAY *extensions;
- } ORPCTHIS;
-
-
-typedef struct __MIDL_XmitDefs_0001 {
-    GUID asyncOperationId;
-    ULONG64 oxidClientProcessNA;
-    GUID originalClientLogicalThreadId;
-    ULONG64 uClientCausalityTraceId;
-} MIDL_XmitDefs_0001;
-
-typedef struct _LOCALTHIS {
-    DWORD dwFlags;
-    DWORD dwClientThread;
-    GUID passthroughTraceActivity;
-    GUID callTraceActivity;
-    MIDL_XmitDefs_0001 asyncRequestBlock;
-    DWORD reserved;
-    PVOID pTouchedAstaArray; // Ptr32 __MIDL_XmitDefs_0002
-} LOCALTHIS;
-
 
 
 

ctypes_generation/definitions/structures/cfgmgr32.txt

@@ -193,25 +193,12 @@ typedef struct CS_Resource_s {
   CS_DES CS_Header;
 } CS_RESOURCE, *PCS_RESOURCE;
 
-typedef struct DMA_Des_s {
-  DWORD DD_Count;
-  DWORD DD_Type;
-  DWORD DD_Flags;
-  ULONG DD_Alloc_Chan;
-} DMA_DES, *PDMA_DES;
 
 typedef struct DMA_Resource_s {
   DMA_DES   DMA_Header;
   DMA_RANGE DMA_Data[ANYSIZE_ARRAY];
 } DMA_RESOURCE, *PDMA_RESOURCE;
 
-typedef struct IO_Des_s {
-  DWORD     IOD_Count;
-  DWORD     IOD_Type;
-  DWORDLONG IOD_Alloc_Base;
-  DWORDLONG IOD_Alloc_End;
-  DWORD     IOD_DesFlags;
-} IO_DES, *PIO_DES;
 
 typedef struct IO_Resource_s {
   IO_DES   IO_Header;

ctypes_generation/definitions/structures/com.txt

@@ -153,10 +153,3 @@ typedef struct __tagVARIANT {
     _ANON_TMP_variant_sub_union _VARIANT_NAME_3;
 } _tagVARIANT, VARIANT, VARIANTARG, *LPVARIANT, *LPVARIANTARG;
 
-
-typedef enum tagCOMSD {
-  SD_LAUNCHPERMISSIONS = 0,
-  SD_ACCESSPERMISSIONS = 1,
-  SD_LAUNCHRESTRICTIONS = 2,
-  SD_ACCESSRESTRICTIONS = 3
-} COMSD;

ctypes_generation/definitions/structures/combase.txt

@@ -0,0 +1,465 @@
+
+typedef enum tagCOMSD {
+  SD_LAUNCHPERMISSIONS = 0,
+  SD_ACCESSPERMISSIONS = 1,
+  SD_LAUNCHRESTRICTIONS = 2,
+  SD_ACCESSRESTRICTIONS = 3
+} COMSD;
+
+typedef struct tagOpaqueData
+{
+    GUID guid;
+    ULONG dataLength;
+    ULONG reserved1;
+    ULONG reserved2;
+    /*[size_is((dataLength+7)&~7)]*/ BYTE *data;
+} OpaqueData;
+
+
+typedef struct tagSTDOBJREF
+{
+    ULONG  flags;              // STDOBJREF flags (see above)
+    ULONG  cPublicRefs;        // count of references passed
+    OXID           oxid;               // oxid of server with this oid
+    OID            oid;                // oid of object with this ipid
+    IPID           ipid;               // ipid of Interface
+} STDOBJREF;
+
+
+typedef struct tagDATAELEMENT
+    {
+    GUID dataID;
+    ULONG cbSize;
+    ULONG cbRounded;
+    BYTE Data[ 1 ];
+    } 	DATAELEMENT, *PDATAELEMENT;
+
+typedef struct tagOBJREFDATA
+    {
+    ULONG nElms;
+    PDATAELEMENT *ppElmArray;
+    } 	OBJREFDATA;
+
+typedef struct tagDUALSTRINGARRAY
+{
+    USHORT wNumEntries;     // Number of entries in array.
+    USHORT wSecurityOffset; // Offset of security info.
+    // The array contains two parts, a set of STRINGBINDINGs
+    // and a set of SECURITYBINDINGs.  Each set is terminated by an
+    // extra zero.  The shortest array contains four zeros.
+    /*[size_is(wNumEntries)]*/ USHORT aStringArray[1];
+} DUALSTRINGARRAY;
+
+typedef struct tagOBJREF
+    {
+    ULONG signature;
+    ULONG flags;
+    GUID iid;
+    union
+        {
+        struct
+            {
+            STDOBJREF std;
+            DUALSTRINGARRAY saResAddr;
+            } 	u_standard;
+        struct
+            {
+            STDOBJREF std;
+            CLSID clsid;
+            DUALSTRINGARRAY saResAddr;
+            } 	u_handler;
+        struct
+            {
+            CLSID clsid;
+            ULONG cbExtension;
+            ULONG size;
+            BYTE *pData;
+            } 	u_custom;
+        struct
+            {
+            STDOBJREF std;
+            OBJREFDATA *pORData;
+            DUALSTRINGARRAY saResAddr;
+            } 	u_extended;
+        } 	u_objref;
+    } 	OBJREF;
+
+
+
+
+typedef struct tagCOMVERSION
+{
+    USHORT MajorVersion;
+    USHORT MinorVersion;
+} COMVERSION;
+
+typedef struct tagORPC_EXTENT {
+    _GUID               id;
+    ULONG               size;
+    BYTE                data[1];
+} ORPC_EXTENT, PORPC_EXTENT;
+
+typedef struct tagORPC_EXTENT_ARRAY {
+    ULONG               size;
+    ULONG               reserved;
+    PORPC_EXTENT        *extent;
+} ORPC_EXTENT_ARRAY;
+
+typedef struct tagORPCTHIS {
+   COMVERSION version;
+   ULONG flags;
+   ULONG reserved1;
+   GUID cid;
+   PVOID extensions; // [unique] ORPC_EXTENT_ARRAY *extensions;
+ } ORPCTHIS;
+
+typedef struct tagORPCTHIS32 {
+   COMVERSION version;
+   ULONG flags;
+   ULONG reserved1;
+   GUID cid;
+   PVOID32 extensions; // [unique] ORPC_EXTENT_ARRAY *extensions;
+ } ORPCTHIS32;
+
+typedef struct tagOXID_INFO
+{
+    DWORD       dwTid;              // thread id of object exporter
+    DWORD       dwPid;              // process id of object exporter
+    DWORD       dwAuthnHint;        // authentication hint
+    COMVERSION  version;            // COM Version of server
+    IPID        ipidRemUnknown;     // IRemUnknown IPID for object exporter
+    DWORD       dwFlags;            // miscellaneous flags
+    /*[unique]*/ DUALSTRINGARRAY *psa;  // protocol and security info
+} OXID_INFO;
+
+enum tagCPFLAGS
+{
+    CPFLAG_NONE	= 0,
+	CPFLAG_PROPAGATE	= 0x1,
+	CPFLAG_EXPOSE	= 0x2,
+	CPFLAG_ENVOY	= 0x4,
+	CPFLAG_MONITORSTUB	= 0x8,
+	CPFLAG_MONITORPROXY	= 0x10,
+	CPFLAG_DONTCOMPARE	= 0x20
+} CPFLAGS;
+
+typedef struct tagContextProperty
+{
+    GUID policyId;
+    CPFLAGS flags;
+    PVOID pUnk; // IUnknown
+} 	ContextProperty;
+
+typedef struct _PRIV_SCM_INFO
+{
+    LONG Apartment;
+    WCHAR *pwszWinstaDesktop;
+    ULONG64 ProcessSignature;
+    WCHAR *pEnvBlock;
+    DWORD EnvBlockLength;
+} 	PRIV_SCM_INFO;
+
+typedef struct _REMOTE_REQUEST_SCM_INFO
+{
+    DWORD ClientImpLevel;
+    USHORT cRequestedProtseqs;
+    USHORT *pRequestedProtseqs;
+} 	REMOTE_REQUEST_SCM_INFO;
+
+// From: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dcom/21781a97-cb45-4655-82b0-02c4a1584603
+ typedef struct tagMInterfacePointer {
+   ULONG ulCntData;
+   /*[size_is(ulCntData)]*/ BYTE abData[1];
+ } MInterfacePointer, *PMInterfacePointer;
+
+
+typedef enum tagACTIVATION_STAGE
+{
+    CLIENT_CONTEXT_STAGE	= 1,
+	CLIENT_MACHINE_STAGE	= 2,
+	SERVER_MACHINE_STAGE	= 3,
+	SERVER_PROCESS_STAGE	= 4,
+	SERVER_CONTEXT_STAGE	= 5
+} 	ACTIVATION_STAGE;
+
+typedef enum tagThreadingModel
+    {
+    ApartmentThreaded	= 0,
+	FreeThreaded	= 1 ,
+	SingleThreaded	= 2 ,
+	BothThreaded	= 3 ,
+	NeutralThreaded	= 4
+} 	ThreadingModel;
+
+typedef enum tagLocalServerType
+    {
+    LocalServerType16	= 0,
+	LocalServerType32	= 1
+    } 	LocalServerType;
+
+
+
+
+typedef struct tagRPCOLEMESSAGE
+{
+    PVOID             reserved1;
+    RPCOLEDATAREP     dataRepresentation;
+    PVOID             Buffer;
+    ULONG             cbBuffer;
+    ULONG             iMethod;
+    PVOID             reserved2[5];
+    ULONG             rpcFlags;
+} RPCOLEMESSAGE, *PRPCOLEMESSAGE;
+
+// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dcom/1d6a8a54-b115-4148-815a-af0258931948
+typedef struct tagREMQIRESULT
+{
+    HRESULT hResult;
+    STDOBJREF std;
+} 	REMQIRESULT, *PREMQIRESULT;
+
+typedef struct tagREMINTERFACEREF
+{
+    IPID ipid;
+    ULONG cPublicRefs;
+    ULONG cPrivateRefs;
+} REMINTERFACEREF;
+
+
+typedef enum tagSTREAM_SEEK {
+  STREAM_SEEK_SET = 0,
+  STREAM_SEEK_CUR = 1,
+  STREAM_SEEK_END = 2
+} STREAM_SEEK;
+
+typedef enum tagMSHCTX {
+  MSHCTX_LOCAL = 0,
+  MSHCTX_NOSHAREDMEM = 1,
+  MSHCTX_DIFFERENTMACHINE = 2,
+  MSHCTX_INPROC = 3,
+  MSHCTX_CROSSCTX = 4,
+  MSHCTX_CONTAINER
+} MSHCTX;
+
+
+typedef struct _PRIV_RESOLVER_INFO_LEGACY
+    {
+        OXID OxidServer;
+        DUALSTRINGARRAY *pServerORBindings;
+        OXID_INFO OxidInfo;
+        MID LocalMidOfRemote;
+        DWORD DllServerModel;
+        WCHAR *pwszDllServer;
+        BOOL FoundInROT;
+} PRIV_RESOLVER_INFO_LEGACY, *PPRIV_RESOLVER_INFO_LEGACY;
+
+
+typedef struct _REMOTE_REPLY_SCM_INFO
+    {
+    OXID Oxid;
+    DUALSTRINGARRAY *pdsaOxidBindings;
+    IPID ipidRemUnknown;
+    DWORD authnHint;
+    COMVERSION serverVersion;
+    } 	REMOTE_REPLY_SCM_INFO, *PREMOTE_REPLY_SCM_INFO;
+
+
+typedef struct CONTAINER_EXTENT {
+    UINT                id;
+    UINT                version;
+    UINT                size;
+    BYTE                data[1];
+};
+
+typedef struct CONTAINER_EXTENT_ARRAY {
+    UINT                size;
+    UINT                reserved;
+    CONTAINER_EXTENT    *extent;
+};
+
+typedef struct HSTRING__ {
+    INT                 unused;
+};
+
+
+typedef struct CONTAINERVERSION {
+    UINT                version;
+    UINT64              capabilityFlags;
+    CONTAINER_EXTENT_ARRAY *extensions;
+};
+
+typedef struct __MIDL_ILocalObjectExporter_0006 {
+    ULONG               dwTid;
+    ULONG               dwPid;
+    ULONG               dwAuthnHint;
+    tagCOMVERSION       version;
+    _GUID               ipidRemUnknown;
+    ULONG               dwFlags;
+    tagDUALSTRINGARRAY  *psa;
+    _GUID               guidProcessIdentifier;
+    UINT64              processHostId;
+    INT                 clientDependencyBehavior;
+    HSTRING__           *packageFullName;
+    HSTRING__           *userSid;
+    HSTRING__           *appcontainerSid;
+} MIDL_ILocalObjectExporter_0006;
+
+typedef struct _PRIV_RESOLVER_INFO_17763 {
+    UINT64              OxidServer;
+    tagDUALSTRINGARRAY  *pServerORBindings;
+    MIDL_ILocalObjectExporter_0006 OxidInfo;
+    UINT64              LocalMidOfRemote;
+    ULONG               DllServerModel;
+    WCHAR               *pwszDllServer;
+    INT                 FoundInROT;
+} PRIV_RESOLVER_INFO_17763, *PPRIV_RESOLVER_INFO_17763;
+
+typedef struct _MIDL_ILocalObjectExporter_0007 {
+    ULONG               dwTid;
+    ULONG               dwPid;
+    ULONG               dwAuthnHint;
+    tagCOMVERSION       dcomVersion;
+    CONTAINERVERSION    containerVersion;
+    _GUID               ipidRemUnknown;
+    ULONG               dwFlags;
+    tagDUALSTRINGARRAY  *psa;
+    _GUID               guidProcessIdentifier;
+    UINT64              processHostId;
+    INT                 clientDependencyBehavior;
+    HSTRING__           *packageFullName;
+    HSTRING__           *userSid;
+    HSTRING__           *appcontainerSid;
+    UINT64              primaryOxid;
+    _GUID               primaryIpidRemUnknown;
+} MIDL_ILocalObjectExporter_0007;
+
+
+typedef struct _PRIV_RESOLVER_INFO {
+    UINT64              OxidServer;
+    tagDUALSTRINGARRAY  *pServerORBindings;
+    MIDL_ILocalObjectExporter_0007 OxidInfo;
+    UINT64              LocalMidOfRemote;
+    INT                 FoundInROT;
+} PRIV_RESOLVER_INFO, *PPRIV_RESOLVER_INFO;
+
+
+typedef struct _MIDL_XmitDefs_0001 {
+    GUID asyncOperationId;
+    ULONG64 oxidClientProcessNA;
+    GUID originalClientLogicalThreadId;
+    ULONG64 uClientCausalityTraceId;
+} MIDL_XmitDefs_0001;
+
+typedef struct _LOCALTHIS {
+    DWORD dwFlags;
+    DWORD dwClientThread;
+    GUID passthroughTraceActivity;
+    GUID callTraceActivity;
+    MIDL_XmitDefs_0001 asyncRequestBlock;
+    DWORD reserved;
+    PVOID pTouchedAstaArray; // Ptr32 __MIDL_XmitDefs_0002
+} LOCALTHIS;
+
+/* LOCALTHAT & sub structures */
+
+typedef struct _MIDL_XmitDefs_0007 {
+    INT                 pointOfFailure;
+    HRESULT             hrFailure;
+    ULONG               sizeOfMarshaledErrorInfo;
+    ULONG               reserved;
+    BYTE                *pMarshaledErrorInfo;
+};
+
+typedef struct _MIDL_XmitDefs_0005 {
+    ULONG               sizeOfMarshaledResults;
+    ULONG               reserved;
+    BYTE                *pMarshaledResults;
+};
+
+typedef struct _MIDL_XmitDefs_0008 {
+    INT                 outcome;
+    _MIDL_XmitDefs_0005 successDetails;
+    _MIDL_XmitDefs_0007 failureDetails;
+};
+
+typedef struct _MIDL_XmitDefs_0010 {
+    ULONG               asyncStatus;
+    ULONG               reserved1;
+    UINT64              uServerCausalityTraceId;
+    _GUID               completionTraceActivity;
+    ULONG               reserved2;
+    _MIDL_XmitDefs_0008 *pOutcomeDetails;
+};
+
+typedef struct CONTAINERTHAT {
+    UINT64              responseFlags;
+    _GUID               unassignedPassthroughGuid_1;
+    _GUID               unassignedPassthroughGuid_2;
+    _GUID               unassignedPassthroughGuid_3;
+    _GUID               unassignedPassthroughGuid_4;
+    _GUID               reservedGuid_1;
+    _GUID               reservedGuid_2;
+    _GUID               reservedGuid_3;
+    _GUID               reservedGuid_4;
+    UINT64              unassignedPassthroughUint64_1;
+    UINT64              unassignedPassthroughUint64_2;
+    UINT64              unassignedPassthroughUint64_3;
+    UINT64              unassignedPassthroughUint64_4;
+    UINT64              marshalingSetId;
+    UINT64              reservedUint64_2;
+    UINT64              reservedUint64_3;
+    UINT64              reservedUint64_4;
+    UINT                reservedUint32;
+    CONTAINER_EXTENT_ARRAY *extensions;
+};
+
+typedef struct _LOCALTHAT {
+    UINT64              marshalingSetId;
+    ULONG               reserved;
+    _MIDL_XmitDefs_0010 *pAsyncResponseBlock;
+    CONTAINER_EXTENT    *containerErrorInformation;
+    CONTAINERTHAT       *containerPassthroughData;
+} LOCALTHAT;
+
+
+typedef struct tagORPCTHAT {
+    ULONG               flags;
+    tagORPC_EXTENT_ARRAY *extensions;
+} ORPCTHAT;
+
+
+typedef struct ORPCTHAT32 {
+    ULONG               flags;
+    PVOID32             extensions; // tagORPC_EXTENT_ARRAY tagORPC_EXTENT_ARRAY
+} ORPCTHAT32;
+
+// From: com\ole32\com\dcomrem\chock.hxx
+typedef struct
+{
+  ULONG  size;           // Number of extents.
+  ULONG  reserved;       // Must be zero.
+  ULONG  unique;         // Flag to indicate presence of unique_flag array.
+  ULONG  rounded_size;   // Actual number of extents.
+  ULONG  unique_flag[UNIQUE_FLAG_PADDING];  // Flags to indicate presense of ORPC_EXTENTs
+} WireExtentArray;
+
+typedef struct
+{
+    ULONG        rounded_size;   // Actual number of extents.
+    GUID         id;             // Extension identifier.
+    ULONG        size;           // Extension size.
+
+    // byte           data[];         // Extension data.
+} WireExtent;
+
+typedef struct tagMainHeader
+{
+    ULONG Signature;
+    ULONG Version;
+    ULONG cPolicies;
+    ULONG cbBuffer;
+    ULONG cbSize;
+    LONG          hr;
+    LONG          hrServer;
+    LONG         reserved;
+} MainHeader;

ctypes_generation/definitions/structures/combase_localthisthat_versions.txt

@@ -0,0 +1,212 @@
+/* Summary of seen version on combase symbols for LOCALTHIS:
+
+Nb fields:  2
+6.1.7601.17514 -> 6.2.9200.22376
+ * 6.1.7601.17514
+ * 6.1.7601.17514
+ * 6.2.9200.22376
+Nb fields:  4
+6.3.9600.17031 -> 6.3.9600.20772
+ * 6.3.9600.17031
+ * 6.3.9600.20772
+Nb fields:  5
+10.0.10240.16384 -> 10.0.15063.2679
+ * 10.0.10240.16384
+ * 10.0.10240.20747
+ * 10.0.10586.0
+ * 10.0.14393.576
+ * 10.0.14393.6451
+ * 10.0.14393.7426
+ * 10.0.15063.251
+ * 10.0.15063.1563
+ * 10.0.15063.2500
+ * 10.0.15063.2679
+Nb fields:  7
+10.0.16299.1 -> 10.0.26100.2454
+ * 10.0.16299.1
+ * 10.0.16299.15
+ * 10.0.17134.1
+ * 10.0.17134.48
+ * 10.0.17134.2145
+ * 10.0.17134.2145
+ * 10.0.17763.1
+ * 10.0.17763.2931
+ * 10.0.22621.2792
+ * 10.0.22621.3958
+ * 10.0.22621.4111
+ * 10.0.22621.4541
+ * 10.0.26100.2454
+*/
+
+/* Summary of seen version on combase symbols for LOCALTHAT:
+
+Nb fields:  2
+6.3.9600.17031 -> 6.3.9600.20772
+ * 6.3.9600.17031
+ * 6.3.9600.17031
+ * 6.3.9600.17031
+ * 6.3.9600.20772
+Nb fields:  3
+10.0.18362.900 -> 10.0.18362.1916
+ * 10.0.18362.900
+ * 10.0.18362.900
+ * 10.0.18362.1016
+ * 10.0.18362.1916
+Nb fields:  4
+10.0.10240.16384 -> 10.0.17763.6040
+ * 10.0.10240.16384
+ * 10.0.10240.16384
+ * 10.0.10240.20747
+ * 10.0.10586.0
+ * 10.0.14393.576
+ * 10.0.14393.6451
+ * 10.0.14393.7426
+ * 10.0.15063.251
+ * 10.0.15063.1563
+ * 10.0.15063.2500
+ * 10.0.15063.2679
+ * 10.0.16299.1
+ * 10.0.16299.15
+ * 10.0.17134.1
+ * 10.0.17134.48
+ * 10.0.17134.2145
+ * 10.0.17134.2145
+ * 10.0.17763.1
+ * 10.0.17763.2931
+ * 10.0.17763.6040
+Nb fields:  5
+10.0.19039.1 -> 10.0.26100.2454
+ * 10.0.19039.1
+ * 10.0.19041.84
+ * 10.0.19041.4894
+ * 10.0.22000.65
+ * 10.0.22621.2792
+ * 10.0.22621.3958
+ * 10.0.22621.4111
+ * 10.0.22621.4541
+ * 10.0.26100.2454
+ * 10.0.26100.2454
+*/
+
+
+/* Seen on 6.2.9200.22376 (win8_ldr_escrow.180222-0941) */
+/* also seen on previous version : XP / Win7 / Server 2012 */
+
+typedef struct LOCALTHIS32_NT_62 {
+    ULONG               dwFlags;
+    ULONG               dwClientThread;
+};
+
+// NO LOCALTHAT for these previous version as far as I now
+
+/* Seen on 6.3.9600.17031 (winblue_gdr.140221-1952) */
+
+typedef struct __MIDL_XmitDefs_0001_NT_63 {
+    ULONG               size;
+    ULONG               reserved;
+    UINT64              *pAstaOxids;
+};
+
+typedef struct LOCALTHIS32_NT_63 {
+    ULONG               dwFlags;
+    ULONG               dwClientThread;
+    ULONG               reserved;
+    PVOID32             pTouchedAstaArray;
+};
+
+
+typedef struct LOCALTHAT32_NT_63 {
+    UINT64              marshalingSetAcknowledgmentOxid;
+    UINT64              marshalingSetId;
+};
+
+/* NT_1607 : combase 10.0.14393.576  from a WS2016 ISO*/
+
+typedef struct __MIDL_XmitDefs_0002_NT_1607 {
+    ULONG               size;
+    ULONG               reserved;
+    PVOID32             pAstaOxids;
+};
+
+typedef struct __MIDL_XmitDefs_0001_NT_1607 {
+    _GUID               asyncOperationId;
+    UINT64              oxidClientProcessNA;
+    _GUID               originalClientLogicalThreadId;
+    UINT64              uClientCausalityTraceId;
+} MIDL_XmitDefs_0001_NT_1607;
+
+typedef struct _LOCALTHIS32_NT_1607 {
+    ULONG               dwFlags;
+    ULONG               dwClientThread;
+    MIDL_XmitDefs_0001_NT_1607 asyncRequestBlock;
+    ULONG               reserved;
+    PVOID32             pTouchedAstaArray;
+} LOCALTHIS32_NT_1607;
+
+typedef struct __MIDL_XmitDefs_0007 {
+    INT                 pointOfFailure;
+    HRESULT             hrFailure;
+    ULONG               sizeOfMarshaledErrorInfo;
+    ULONG               reserved;
+    BYTE                *pMarshaledErrorInfo;
+} MIDL_XmitDefs_0007;
+
+typedef struct __MIDL_XmitDefs_0005 {
+    ULONG               sizeOfMarshaledResults;
+    ULONG               reserved;
+    BYTE                *pMarshaledResults;
+} MIDL_XmitDefs_0005;
+
+typedef struct __MIDL_XmitDefs_0008 {
+    INT                 outcome;
+    MIDL_XmitDefs_0005 successDetails;
+    MIDL_XmitDefs_0007 failureDetails;
+} MIDL_XmitDefs_0008;
+
+typedef struct __MIDL_XmitDefs_0010 {
+    ULONG               asyncStatus;
+    ULONG               reserved1;
+    UINT64              uServerCausalityTraceId;
+    ULONG               reserved2;
+    PVOID32 *pOutcomeDetails; //__MIDL_XmitDefs_0008
+} MIDL_XmitDefs_0010;
+
+typedef struct LOCALTHAT32_NT_1607 {
+    UINT64              marshalingSetAcknowledgmentOxid;
+    UINT64              marshalingSetId;
+    ULONG               reserved;
+    PVOID32             pAsyncResponseBlock;
+};
+
+/* ! NT_1607: combase 10.0.14393.576 */
+
+
+/* */
+
+/* Seen only in 10.0.18362 versions of combase */
+
+typedef struct _LOCALTHAT32_10_1903 {
+    UINT64              marshalingSetId;
+    PVOID32             pAsyncResponseBlock;
+    PVOID32             containerPassthroughData;
+} LOCALTHAT32_10_1903;
+
+/* NT 10.22 ? seen on 10.0.22621.1 */
+
+typedef struct _LOCALTHIS32 {
+    DWORD dwFlags;
+    DWORD dwClientThread;
+    GUID passthroughTraceActivity;
+    GUID callTraceActivity;
+    MIDL_XmitDefs_0001 asyncRequestBlock;
+    DWORD reserved;
+    PVOID32 pTouchedAstaArray; // Ptr32 __MIDL_XmitDefs_0002
+} LOCALTHIS32;
+
+typedef struct _LOCALTHAT32 {
+    UINT64              marshalingSetId;
+    ULONG               reserved;
+    PVOID32             pAsyncResponseBlock;
+    PVOID32             containerErrorInformation;
+    PVOID32             containerPassthroughData;
+} LOCALTHAT32;

ctypes_generation/definitions/structures/crypto.txt

@@ -98,12 +98,6 @@ typedef struct _CTL_ENTRY {
 } CTL_ENTRY, *PCTL_ENTRY;
 
 
-typedef struct _CRYPT_ATTRIBUTE {
-    LPSTR               pszObjId;
-    DWORD               cValue;
-    PCRYPT_ATTR_BLOB    rgValue;
-} CRYPT_ATTRIBUTE, *PCRYPT_ATTRIBUTE;
-
 typedef struct _CRYPT_ATTRIBUTES {
     DWORD                cAttr;
     PCRYPT_ATTRIBUTE     rgAttr;
@@ -597,15 +591,6 @@ typedef struct _CMSG_MAIL_LIST_RECIPIENT_ENCODE_INFO {
 
 
 
-typedef struct _CMSG_KEY_TRANS_RECIPIENT_ENCODE_INFO {
-  DWORD                      cbSize;
-  CRYPT_ALGORITHM_IDENTIFIER KeyEncryptionAlgorithm;
-  PVOID                      pvKeyEncryptionAuxInfo;
-  HCRYPTPROV_LEGACY          hCryptProv;
-  CRYPT_BIT_BLOB             RecipientPublicKey;
-  CERT_ID                    RecipientId;
-} CMSG_KEY_TRANS_RECIPIENT_ENCODE_INFO, *PCMSG_KEY_TRANS_RECIPIENT_ENCODE_INFO;
-
 typedef struct _CMSG_KEY_TRANS_RECIPIENT_ENCODE_INFO {
   DWORD                      cbSize;
   CRYPT_ALGORITHM_IDENTIFIER KeyEncryptionAlgorithm;
@@ -730,4 +715,12 @@ typedef struct _STRUCT_PLAINTEXTKEYBLOB {
   BLOBHEADER hdr;
   DWORD      dwKeySize;
   BYTE       rgbKeyData[0];
-} STRUCT_PLAINTEXTKEYBLOB, *PSTRUCT_PLAINTEXTKEYBLOB;
+} STRUCT_PLAINTEXTKEYBLOB, *PSTRUCT_PLAINTEXTKEYBLOB;
+
+typedef struct _CERT_REQUEST_INFO {
+  DWORD                dwVersion;
+  CERT_NAME_BLOB       Subject;
+  CERT_PUBLIC_KEY_INFO SubjectPublicKeyInfo;
+  DWORD                cAttribute;
+  PCRYPT_ATTRIBUTE     rgAttribute;
+} CERT_REQUEST_INFO, *PCERT_REQUEST_INFO;

ctypes_generation/definitions/structures/disk.txt

@@ -90,4 +90,4 @@ typedef struct _ATTACH_VIRTUAL_DISK_PARAMETERS {
       ULONGLONG RestrictedLength;
     } Version2;
   };
-} ATTACH_VIRTUAL_DISK_PARAMETERS, *PATTACH_VIRTUAL_DISK_PARAMETERS;
+} ATTACH_VIRTUAL_DISK_PARAMETERS, *PATTACH_VIRTUAL_DISK_PARAMETERS;

ctypes_generation/definitions/structures/file_info.txt

@@ -69,6 +69,35 @@ typedef enum _FILE_INFORMATION_CLASS {
   FileMaximumInformation
 } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
 
+typedef enum _FILE_INFO_BY_HANDLE_CLASS {
+  FileBasicInfo,
+  FileStandardInfo,
+  FileNameInfo,
+  FileRenameInfo,
+  FileDispositionInfo,
+  FileAllocationInfo,
+  FileEndOfFileInfo,
+  FileStreamInfo,
+  FileCompressionInfo,
+  FileAttributeTagInfo,
+  FileIdBothDirectoryInfo,
+  FileIdBothDirectoryRestartInfo,
+  FileIoPriorityHintInfo,
+  FileRemoteProtocolInfo,
+  FileFullDirectoryInfo,
+  FileFullDirectoryRestartInfo,
+  FileStorageInfo,
+  FileAlignmentInfo,
+  FileIdInfo,
+  FileIdExtdDirectoryInfo,
+  FileIdExtdDirectoryRestartInfo,
+  FileDispositionInfoEx,
+  FileRenameInfoEx,
+  FileCaseSensitiveInfo,
+  FileNormalizedNameInfo,
+  MaximumFileInfoByHandleClass
+} FILE_INFO_BY_HANDLE_CLASS, *PFILE_INFO_BY_HANDLE_CLASS;
+
 typedef enum _IO_PRIORITY_HINT {
   IoPriorityVeryLow   = 0,
   IoPriorityLow       = 1,
@@ -193,6 +222,18 @@ typedef struct _FILE_GET_EA_INFORMATION
     CHAR EaName[1];
 } FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
 
+typedef struct _BY_HANDLE_FILE_INFORMATION {
+  DWORD    dwFileAttributes;
+  FILETIME ftCreationTime;
+  FILETIME ftLastAccessTime;
+  FILETIME ftLastWriteTime;
+  DWORD    dwVolumeSerialNumber;
+  DWORD    nFileSizeHigh;
+  DWORD    nFileSizeLow;
+  DWORD    nNumberOfLinks;
+  DWORD    nFileIndexHigh;
+  DWORD    nFileIndexLow;
+} BY_HANDLE_FILE_INFORMATION, *PBY_HANDLE_FILE_INFORMATION, *LPBY_HANDLE_FILE_INFORMATION;
 
 typedef struct tagVS_FIXEDFILEINFO {
   DWORD dwSignature;

ctypes_generation/definitions/structures/guid.txt

@@ -5,4 +5,4 @@ typedef struct _GUID {
     USHORT Data2;
     USHORT Data3;
     BYTE  Data4[ 8 ];
-} GUID, IID, CLSID, *REFIID, *REFCLSID, *LPGUID, *REFGUID, *LPCLSID, *LPCGUID;
+} GUID, IID, CLSID, *REFIID, *REFCLSID, *LPGUID, *REFGUID, *LPCLSID, *LPCGUID, IPID, CID, *REFIPID;

ctypes_generation/definitions/structures/io.txt

@@ -0,0 +1,19 @@
+typedef struct _OVERLAPPED {
+  ULONG_PTR Internal;
+  ULONG_PTR InternalHigh;
+  union {
+    struct {
+      DWORD Offset;
+      DWORD OffsetHigh;
+    } _ANON_OVERLAPPED_DUMMYSTRUCTNAME;
+    PVOID Pointer;
+  } _ANON_OVERLAPPED_DUMMYUNIONNAME;
+  HANDLE    hEvent;
+} OVERLAPPED, *LPOVERLAPPED;
+
+typedef struct _OVERLAPPED_ENTRY {
+  ULONG_PTR    lpCompletionKey;
+  LPOVERLAPPED lpOverlapped;
+  ULONG_PTR    Internal;
+  DWORD        dwNumberOfBytesTransferred;
+} OVERLAPPED_ENTRY, *LPOVERLAPPED_ENTRY;

ctypes_generation/definitions/structures/kuser_shared_data.txt

@@ -0,0 +1,270 @@
+/* From: https://www.codemachine.com/downloads/win10.1703/winnt.h*/
+
+
+typedef struct _XSTATE_FEATURE {
+    DWORD Offset;
+    DWORD Size;
+} XSTATE_FEATURE, *PXSTATE_FEATURE;
+
+typedef struct _XSTATE_CONFIGURATION {
+    // Mask of all enabled features
+    DWORD64 EnabledFeatures;
+
+    // Mask of volatile enabled features
+    DWORD64 EnabledVolatileFeatures;
+
+    // Total size of the save area for user states
+    DWORD Size;
+
+    // Control Flags
+    union {
+        DWORD ControlFlags;
+        struct
+        {
+            DWORD OptimizedSave : 1;
+            DWORD CompactionEnabled : 1;
+        };
+    };
+
+    // List of features
+    XSTATE_FEATURE Features[MAXIMUM_XSTATE_FEATURES];
+
+    // Mask of all supervisor features
+    DWORD64 EnabledSupervisorFeatures;
+
+    // Mask of features that require start address to be 64 byte aligned
+    DWORD64 AlignedFeatures;
+
+    // Total size of the save area for user and supervisor states
+    DWORD AllFeatureSize;
+
+    // List which holds size of each user and supervisor state supported by CPU
+    DWORD AllFeatures[MAXIMUM_XSTATE_FEATURES];
+
+} XSTATE_CONFIGURATION, *PXSTATE_CONFIGURATION;
+
+
+/* From ntexapi.h */
+
+typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE {
+    StandardDesign,                 // None == 0 == standard design
+    NEC98x86,                       // NEC PC98xx series on X86
+    EndAlternatives                 // past end of known alternatives
+} ALTERNATIVE_ARCHITECTURE_TYPE;
+
+/* ntkeapi.h */
+typedef struct _KSYSTEM_TIME {
+    ULONG LowPart;
+    LONG High1Time;
+    LONG High2Time;
+} KSYSTEM_TIME, *PKSYSTEM_TIME;
+
+
+/*
+    An extract from https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ns-ntddk-kuser_shared_data.
+    With only the fields up to <0x02f8 unsigned __int64 TestRetInstruction>
+    These are the fields that have not moved (but may have been renamed) since XP.
+*/
+
+
+typedef struct _PFW_MINIMAL_KUSER_SHARED_DATA {
+  ULONG                         TickCountLowDeprecated;
+  ULONG                         TickCountMultiplier;
+  KSYSTEM_TIME                  InterruptTime;
+  KSYSTEM_TIME                  SystemTime;
+  KSYSTEM_TIME                  TimeZoneBias;
+  USHORT                        ImageNumberLow;
+  USHORT                        ImageNumberHigh;
+  WCHAR                         NtSystemRoot[260];
+  ULONG                         MaxStackTraceDepth;
+  ULONG                         CryptoExponent;
+  ULONG                         TimeZoneId;
+  ULONG                         LargePageMinimum;
+  ULONG                         AitSamplingValue;
+  ULONG                         AppCompatFlag;
+  ULONGLONG                     RNGSeedVersion;
+  ULONG                         GlobalValidationRunlevel;
+  LONG                          TimeZoneBiasStamp;
+  ULONG                         NtBuildNumber;
+  NT_PRODUCT_TYPE               NtProductType;
+  BOOLEAN                       ProductTypeIsValid;
+  BOOLEAN                       Reserved0[1];
+  USHORT                        NativeProcessorArchitecture;
+  ULONG                         NtMajorVersion;
+  ULONG                         NtMinorVersion;
+  BOOLEAN                       ProcessorFeatures[PROCESSOR_FEATURE_MAX];
+  ULONG                         Reserved1;
+  ULONG                         Reserved3;
+  ULONG                         TimeSlip;
+  ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
+  ULONG                         BootId;
+  LARGE_INTEGER                 SystemExpirationDate;
+  ULONG                         SuiteMask;
+  BOOLEAN                       KdDebuggerEnabled;
+  union {
+    BYTE MitigationPolicies; /* Modified UCHAR to BYTE for ctype compat */
+    struct {
+      BYTE NXSupportPolicy : 2;
+      BYTE SEHValidationPolicy : 2;
+      BYTE CurDirDevicesSkippedForDlls : 2;
+      BYTE Reserved : 2;
+    };
+  };
+  USHORT                        CyclesPerYield;
+  ULONG                         ActiveConsoleId;
+  ULONG                         DismountCount;
+  ULONG                         ComPlusPackage;
+  ULONG                         LastSystemRITEventTickCount;
+  ULONG                         NumberOfPhysicalPages;
+  BOOLEAN                       SafeBootMode;
+  UCHAR                         VirtualizationFlags;
+  UCHAR                         Reserved12[2];
+  union {
+    ULONG SharedDataFlags;
+    struct {
+      ULONG DbgErrorPortPresent : 1;
+      ULONG DbgElevationEnabled : 1;
+      ULONG DbgVirtEnabled : 1;
+      ULONG DbgInstallerDetectEnabled : 1;
+      ULONG DbgLkgEnabled : 1;
+      ULONG DbgDynProcessorEnabled : 1;
+      ULONG DbgConsoleBrokerEnabled : 1;
+      ULONG DbgSecureBootEnabled : 1;
+      ULONG DbgMultiSessionSku : 1;
+      ULONG DbgMultiUsersInSessionSku : 1;
+      ULONG DbgStateSeparationEnabled : 1;
+      ULONG SpareBits : 21;
+    };
+  };
+  ULONG                         DataFlagsPad[1];
+  ULONGLONG                     TestRetInstruction;
+} PFW_MINIMAL_KUSER_SHARED_DATA;
+
+
+/* From: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ns-ntddk-kuser_shared_data */
+typedef struct _KUSER_SHARED_DATA {
+  ULONG                         TickCountLowDeprecated;
+  ULONG                         TickCountMultiplier;
+  KSYSTEM_TIME                  InterruptTime;
+  KSYSTEM_TIME                  SystemTime;
+  KSYSTEM_TIME                  TimeZoneBias;
+  USHORT                        ImageNumberLow;
+  USHORT                        ImageNumberHigh;
+  WCHAR                         NtSystemRoot[260];
+  ULONG                         MaxStackTraceDepth;
+  ULONG                         CryptoExponent;
+  ULONG                         TimeZoneId;
+  ULONG                         LargePageMinimum;
+  ULONG                         AitSamplingValue;
+  ULONG                         AppCompatFlag;
+  ULONGLONG                     RNGSeedVersion;
+  ULONG                         GlobalValidationRunlevel;
+  LONG                          TimeZoneBiasStamp;
+  ULONG                         NtBuildNumber;
+  NT_PRODUCT_TYPE               NtProductType;
+  BOOLEAN                       ProductTypeIsValid;
+  BOOLEAN                       Reserved0[1];
+  USHORT                        NativeProcessorArchitecture;
+  ULONG                         NtMajorVersion;
+  ULONG                         NtMinorVersion;
+  BOOLEAN                       ProcessorFeatures[PROCESSOR_FEATURE_MAX];
+  ULONG                         Reserved1;
+  ULONG                         Reserved3;
+  ULONG                         TimeSlip;
+  ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
+  ULONG                         BootId;
+  LARGE_INTEGER                 SystemExpirationDate;
+  ULONG                         SuiteMask;
+  BOOLEAN                       KdDebuggerEnabled;
+  union {
+    BYTE MitigationPolicies; /* Modified UCHAR to BYTE for ctype compat */
+    struct {
+      BYTE NXSupportPolicy : 2;
+      BYTE SEHValidationPolicy : 2;
+      BYTE CurDirDevicesSkippedForDlls : 2;
+      BYTE Reserved : 2;
+    };
+  };
+  USHORT                        CyclesPerYield;
+  ULONG                         ActiveConsoleId;
+  ULONG                         DismountCount;
+  ULONG                         ComPlusPackage;
+  ULONG                         LastSystemRITEventTickCount;
+  ULONG                         NumberOfPhysicalPages;
+  BOOLEAN                       SafeBootMode;
+  UCHAR                         VirtualizationFlags;
+  UCHAR                         Reserved12[2];
+  union {
+    ULONG SharedDataFlags;
+    struct {
+      ULONG DbgErrorPortPresent : 1;
+      ULONG DbgElevationEnabled : 1;
+      ULONG DbgVirtEnabled : 1;
+      ULONG DbgInstallerDetectEnabled : 1;
+      ULONG DbgLkgEnabled : 1;
+      ULONG DbgDynProcessorEnabled : 1;
+      ULONG DbgConsoleBrokerEnabled : 1;
+      ULONG DbgSecureBootEnabled : 1;
+      ULONG DbgMultiSessionSku : 1;
+      ULONG DbgMultiUsersInSessionSku : 1;
+      ULONG DbgStateSeparationEnabled : 1;
+      ULONG SpareBits : 21;
+    };
+  };
+  ULONG                         DataFlagsPad[1];
+  ULONGLONG                     TestRetInstruction;
+  LONGLONG                      QpcFrequency;
+  ULONG                         SystemCall;
+  union {
+    ULONG AllFlags;
+    struct {
+      ULONG Win32Process : 1;
+      ULONG Sgx2Enclave : 1;
+      ULONG VbsBasicEnclave : 1;
+      ULONG SpareBits : 29;
+    };
+  } UserCetAvailableEnvironments;
+  ULONGLONG                     SystemCallPad[2];
+  union {
+    KSYSTEM_TIME TickCount;
+    ULONG64      TickCountQuad;
+    struct {
+      ULONG ReservedTickCountOverlay[3];
+      ULONG TickCountPad[1];
+    };
+  };
+  ULONG                         Cookie;
+  ULONG                         CookiePad[1];
+  LONGLONG                      ConsoleSessionForegroundProcessId;
+  ULONGLONG                     TimeUpdateLock;
+  ULONGLONG                     BaselineSystemTimeQpc;
+  ULONGLONG                     BaselineInterruptTimeQpc;
+  ULONGLONG                     QpcSystemTimeIncrement;
+  ULONGLONG                     QpcInterruptTimeIncrement;
+  UCHAR                         QpcSystemTimeIncrementShift;
+  UCHAR                         QpcInterruptTimeIncrementShift;
+  USHORT                        UnparkedProcessorCount;
+  ULONG                         EnclaveFeatureMask[4];
+  ULONG                         TelemetryCoverageRound;
+  USHORT                        UserModeGlobalLogger[16];
+  ULONG                         ImageFileExecutionOptions;
+  ULONG                         LangGenerationCount;
+  ULONGLONG                     Reserved4;
+  ULONGLONG                     InterruptTimeBias;
+  ULONGLONG                     QpcBias;
+  ULONG                         ActiveProcessorCount;
+  UCHAR                         ActiveGroupCount;
+  UCHAR                         Reserved9;
+  union {
+    USHORT QpcData;
+    struct {
+      UCHAR QpcBypassEnabled;
+      UCHAR QpcShift;
+    };
+  };
+  LARGE_INTEGER                 TimeZoneBiasEffectiveStart;
+  LARGE_INTEGER                 TimeZoneBiasEffectiveEnd;
+  XSTATE_CONFIGURATION          XState;
+  KSYSTEM_TIME                  FeatureConfigurationChangeStamp;
+  ULONG                         Spare;
+} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;

ctypes_generation/definitions/structures/lsa.txt

@@ -49,12 +49,6 @@ typedef struct _POLICY_ACCOUNT_DOMAIN_INFO {
 } POLICY_ACCOUNT_DOMAIN_INFO, *PPOLICY_ACCOUNT_DOMAIN_INFO;
 
 
-typedef struct _POLICY_PRIMARY_DOMAIN_INFO {
-  LSA_UNICODE_STRING Name;
-  PSID               Sid;
-} POLICY_PRIMARY_DOMAIN_INFO, *PPOLICY_PRIMARY_DOMAIN_INFO;
-
-
 typedef struct _LSA_TRANSLATED_SID {
   SID_NAME_USE Use;
   ULONG        RelativeId;

ctypes_generation/definitions/structures/pe.txt

@@ -0,0 +1,266 @@
+typedef struct _IMAGE_FILE_HEADER {
+  WORD  Machine;
+  WORD  NumberOfSections;
+  DWORD TimeDateStamp;
+  DWORD PointerToSymbolTable;
+  DWORD NumberOfSymbols;
+  WORD  SizeOfOptionalHeader;
+  WORD  Characteristics;
+} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
+
+typedef struct _IMAGE_DATA_DIRECTORY {
+  DWORD VirtualAddress;
+  DWORD Size;
+} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
+
+
+typedef struct _IMAGE_SECTION_HEADER {
+  BYTE  Name[IMAGE_SIZEOF_SHORT_NAME];
+  DWORD VirtualSize;
+  DWORD VirtualAddress;
+  DWORD SizeOfRawData;
+  DWORD PointerToRawData;
+  DWORD PointerToRelocations;
+  DWORD PointerToLinenumbers;
+  WORD  NumberOfRelocations;
+  WORD  NumberOfLinenumbers;
+  DWORD Characteristics;
+} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
+
+typedef struct _IMAGE_OPTIONAL_HEADER64 {
+    WORD        Magic;
+    BYTE        MajorLinkerVersion;
+    BYTE        MinorLinkerVersion;
+    DWORD       SizeOfCode;
+    DWORD       SizeOfInitializedData;
+    DWORD       SizeOfUninitializedData;
+    DWORD       AddressOfEntryPoint;
+    DWORD       BaseOfCode;
+    ULONGLONG   ImageBase;
+    DWORD       SectionAlignment;
+    DWORD       FileAlignment;
+    WORD        MajorOperatingSystemVersion;
+    WORD        MinorOperatingSystemVersion;
+    WORD        MajorImageVersion;
+    WORD        MinorImageVersion;
+    WORD        MajorSubsystemVersion;
+    WORD        MinorSubsystemVersion;
+    DWORD       Win32VersionValue;
+    DWORD       SizeOfImage;
+    DWORD       SizeOfHeaders;
+    DWORD       CheckSum;
+    WORD        Subsystem;
+    WORD        DllCharacteristics;
+    ULONGLONG   SizeOfStackReserve;
+    ULONGLONG   SizeOfStackCommit;
+    ULONGLONG   SizeOfHeapReserve;
+    ULONGLONG   SizeOfHeapCommit;
+    DWORD       LoaderFlags;
+    DWORD       NumberOfRvaAndSizes;
+    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
+} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
+
+
+typedef struct _IMAGE_OPTIONAL_HEADER {
+    WORD    Magic;
+    BYTE    MajorLinkerVersion;
+    BYTE    MinorLinkerVersion;
+    DWORD   SizeOfCode;
+    DWORD   SizeOfInitializedData;
+    DWORD   SizeOfUninitializedData;
+    DWORD   AddressOfEntryPoint;
+    DWORD   BaseOfCode;
+    DWORD   BaseOfData;
+    DWORD   ImageBase;
+    DWORD   SectionAlignment;
+    DWORD   FileAlignment;
+    WORD    MajorOperatingSystemVersion;
+    WORD    MinorOperatingSystemVersion;
+    WORD    MajorImageVersion;
+    WORD    MinorImageVersion;
+    WORD    MajorSubsystemVersion;
+    WORD    MinorSubsystemVersion;
+    DWORD   Win32VersionValue;
+    DWORD   SizeOfImage;
+    DWORD   SizeOfHeaders;
+    DWORD   CheckSum;
+    WORD    Subsystem;
+    WORD    DllCharacteristics;
+    DWORD   SizeOfStackReserve;
+    DWORD   SizeOfStackCommit;
+    DWORD   SizeOfHeapReserve;
+    DWORD   SizeOfHeapCommit;
+    DWORD   LoaderFlags;
+    DWORD   NumberOfRvaAndSizes;
+    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
+} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
+
+typedef struct _IMAGE_NT_HEADERS64 {
+    DWORD Signature;
+    IMAGE_FILE_HEADER FileHeader;
+    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
+} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;
+
+typedef struct _IMAGE_NT_HEADERS {
+    DWORD Signature;
+    IMAGE_FILE_HEADER FileHeader;
+    IMAGE_OPTIONAL_HEADER32 OptionalHeader;
+} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;
+
+typedef struct _IMAGE_IMPORT_DESCRIPTOR {
+    DWORD   OriginalFirstThunk;
+    DWORD   TimeDateStamp;
+    DWORD   ForwarderChain;
+    DWORD   Name;
+    DWORD   FirstThunk;
+} IMAGE_IMPORT_DESCRIPTOR, *PIMAGE_IMPORT_DESCRIPTOR;
+
+typedef struct _IMAGE_IMPORT_BY_NAME {
+    WORD    Hint;
+    BYTE    Name[1];
+} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
+
+typedef struct _IMAGE_EXPORT_DIRECTORY {
+    DWORD   Characteristics;
+    DWORD   TimeDateStamp;
+    WORD    MajorVersion;
+    WORD    MinorVersion;
+    DWORD   Name;
+    DWORD   Base;
+    DWORD   NumberOfFunctions;
+    DWORD   NumberOfNames;
+    DWORD   AddressOfFunctions;
+    DWORD   AddressOfNames;
+    DWORD   AddressOfNameOrdinals;
+} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
+
+typedef struct _IMAGE_DEBUG_DIRECTORY {
+    DWORD   Characteristics;
+    DWORD   TimeDateStamp;
+    WORD    MajorVersion;
+    WORD    MinorVersion;
+    DWORD   Type;
+    DWORD   SizeOfData;
+    DWORD   AddressOfRawData;
+    DWORD   PointerToRawData;
+} IMAGE_DEBUG_DIRECTORY, *PIMAGE_DEBUG_DIRECTORY;
+
+typedef struct _IMAGE_BASE_RELOCATION {
+    DWORD   VirtualAddress;
+    DWORD   SizeOfBlock;
+} IMAGE_BASE_RELOCATION, *PIMAGE_BASE_RELOCATION;
+
+
+// not found on MSDN : from symbols
+typedef struct _IMAGE_LOAD_CONFIG_CODE_INTEGRITY {
+  WORD Flags;
+  WORD Catalog;
+  DWORD CatalogOffset;
+  DWORD Reserved;
+} IMAGE_LOAD_CONFIG_CODE_INTEGRITY, *PIMAGE_LOAD_CONFIG_CODE_INTEGRITY;
+
+
+typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32 {
+  DWORD                            Size;
+  DWORD                            TimeDateStamp;
+  WORD                             MajorVersion;
+  WORD                             MinorVersion;
+  DWORD                            GlobalFlagsClear;
+  DWORD                            GlobalFlagsSet;
+  DWORD                            CriticalSectionDefaultTimeout;
+  DWORD                            DeCommitFreeBlockThreshold;
+  DWORD                            DeCommitTotalFreeThreshold;
+  DWORD                            LockPrefixTable;
+  DWORD                            MaximumAllocationSize;
+  DWORD                            VirtualMemoryThreshold;
+  DWORD                            ProcessHeapFlags;
+  DWORD                            ProcessAffinityMask;
+  WORD                             CSDVersion;
+  WORD                             DependentLoadFlags;
+  DWORD                            EditList;
+  DWORD                            SecurityCookie;
+  DWORD                            SEHandlerTable;
+  DWORD                            SEHandlerCount;
+  DWORD                            GuardCFCheckFunctionPointer;
+  DWORD                            GuardCFDispatchFunctionPointer;
+  DWORD                            GuardCFFunctionTable;
+  DWORD                            GuardCFFunctionCount;
+  DWORD                            GuardFlags;
+  IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
+  DWORD                            GuardAddressTakenIatEntryTable;
+  DWORD                            GuardAddressTakenIatEntryCount;
+  DWORD                            GuardLongJumpTargetTable;
+  DWORD                            GuardLongJumpTargetCount;
+  DWORD                            DynamicValueRelocTable;
+  DWORD                            CHPEMetadataPointer;
+  DWORD                            GuardRFFailureRoutine;
+  DWORD                            GuardRFFailureRoutineFunctionPointer;
+  DWORD                            DynamicValueRelocTableOffset;
+  WORD                             DynamicValueRelocTableSection;
+  WORD                             Reserved2;
+  DWORD                            GuardRFVerifyStackPointerFunctionPointer;
+  DWORD                            HotPatchTableOffset;
+  DWORD                            Reserved3;
+  DWORD                            EnclaveConfigurationPointer;
+  DWORD                            VolatileMetadataPointer;
+  DWORD                            GuardEHContinuationTable;
+  DWORD                            GuardEHContinuationCount;
+  DWORD                            GuardXFGCheckFunctionPointer;
+  DWORD                            GuardXFGDispatchFunctionPointer;
+  DWORD                            GuardXFGTableDispatchFunctionPointer;
+  DWORD                            CastGuardOsDeterminedFailureMode;
+  DWORD                            GuardMemcpyFunctionPointer;
+} IMAGE_LOAD_CONFIG_DIRECTORY32, *PIMAGE_LOAD_CONFIG_DIRECTORY32;
+
+
+typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64 {
+  DWORD                            Size;
+  DWORD                            TimeDateStamp;
+  WORD                             MajorVersion;
+  WORD                             MinorVersion;
+  DWORD                            GlobalFlagsClear;
+  DWORD                            GlobalFlagsSet;
+  DWORD                            CriticalSectionDefaultTimeout;
+  ULONGLONG                        DeCommitFreeBlockThreshold;
+  ULONGLONG                        DeCommitTotalFreeThreshold;
+  ULONGLONG                        LockPrefixTable;
+  ULONGLONG                        MaximumAllocationSize;
+  ULONGLONG                        VirtualMemoryThreshold;
+  ULONGLONG                        ProcessAffinityMask;
+  DWORD                            ProcessHeapFlags;
+  WORD                             CSDVersion;
+  WORD                             DependentLoadFlags;
+  ULONGLONG                        EditList;
+  ULONGLONG                        SecurityCookie;
+  ULONGLONG                        SEHandlerTable;
+  ULONGLONG                        SEHandlerCount;
+  ULONGLONG                        GuardCFCheckFunctionPointer;
+  ULONGLONG                        GuardCFDispatchFunctionPointer;
+  ULONGLONG                        GuardCFFunctionTable;
+  ULONGLONG                        GuardCFFunctionCount;
+  DWORD                            GuardFlags;
+  IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
+  ULONGLONG                        GuardAddressTakenIatEntryTable;
+  ULONGLONG                        GuardAddressTakenIatEntryCount;
+  ULONGLONG                        GuardLongJumpTargetTable;
+  ULONGLONG                        GuardLongJumpTargetCount;
+  ULONGLONG                        DynamicValueRelocTable;
+  ULONGLONG                        CHPEMetadataPointer;
+  ULONGLONG                        GuardRFFailureRoutine;
+  ULONGLONG                        GuardRFFailureRoutineFunctionPointer;
+  DWORD                            DynamicValueRelocTableOffset;
+  WORD                             DynamicValueRelocTableSection;
+  WORD                             Reserved2;
+  ULONGLONG                        GuardRFVerifyStackPointerFunctionPointer;
+  DWORD                            HotPatchTableOffset;
+  DWORD                            Reserved3;
+  ULONGLONG                        EnclaveConfigurationPointer;
+  ULONGLONG                        VolatileMetadataPointer;
+  ULONGLONG                        GuardEHContinuationTable;
+  ULONGLONG                        GuardEHContinuationCount;
+  ULONGLONG                        GuardXFGCheckFunctionPointer;
+  ULONGLONG                        GuardXFGDispatchFunctionPointer;
+  ULONGLONG                        GuardXFGTableDispatchFunctionPointer;
+  ULONGLONG                        CastGuardOsDeterminedFailureMode;
+  ULONGLONG                        GuardMemcpyFunctionPointer;
+} IMAGE_LOAD_CONFIG_DIRECTORY64, *PIMAGE_LOAD_CONFIG_DIRECTORY64;

ctypes_generation/definitions/structures/proc_thread_attributes.txt

@@ -0,0 +1,24 @@
+typedef enum _PROC_THREAD_ATTRIBUTE_NUM {
+    ProcThreadAttributeParentProcess                = 0,
+    ProcThreadAttributeHandleList                   = 2,
+    ProcThreadAttributeGroupAffinity                = 3,
+    ProcThreadAttributePreferredNode                = 4,
+    ProcThreadAttributeIdealProcessor               = 5,
+    ProcThreadAttributeUmsThread                    = 6,
+    ProcThreadAttributeMitigationPolicy             = 7,
+    ProcThreadAttributeSecurityCapabilities         = 9,
+    ProcThreadAttributeProtectionLevel              = 11,
+    ProcThreadAttributeJobList                      = 13,
+    ProcThreadAttributeChildProcessPolicy           = 14,
+    ProcThreadAttributeAllApplicationPackagesPolicy = 15,
+    ProcThreadAttributeWin32kFilter                 = 16,
+    ProcThreadAttributeSafeOpenPromptOriginClaim    = 17,
+    ProcThreadAttributeDesktopAppPolicy             = 18,
+    ProcThreadAttributePseudoConsole                = 22,
+    ProcThreadAttributeMitigationAuditPolicy        = 24,
+    ProcThreadAttributeMachineType                  = 25,
+    ProcThreadAttributeComponentFilter              = 26,
+    ProcThreadAttributeEnableOptionalXStateFeatures = 27,
+    ProcThreadAttributeTrustedApp                   = 29,
+    ProcThreadAttributeSveVectorLength              = 30,
+} PROC_THREAD_ATTRIBUTE_NUM;

ctypes_generation/definitions/structures/process.txt

@@ -0,0 +1,124 @@
+typedef enum _MEMORY_INFORMATION_CLASS {
+    MemoryBasicInformation,
+    MemoryWorkingSetList,
+    MemorySectionName,
+    MemoryBasicVlmInformation,
+    MemoryWorkingSetListEx
+} MEMORY_INFORMATION_CLASS;
+
+typedef enum _THREAD_INFORMATION_CLASS {
+    ThreadBasicInformation,
+    ThreadTimes,
+    ThreadPriority,
+    ThreadBasePriority,
+    ThreadAffinityMask,
+    ThreadImpersonationToken,
+    ThreadDescriptorTableEntry,
+    ThreadEnableAlignmentFaultFixup,
+    ThreadEventPair,
+    ThreadQuerySetWin32StartAddress,
+    ThreadZeroTlsCell,
+    ThreadPerformanceCount,
+    ThreadAmILastThread,
+    ThreadIdealProcessor,
+    ThreadPriorityBoost,
+    ThreadSetTlsArrayAddress,
+    ThreadIsIoPending,
+    ThreadHideFromDebugger
+} THREAD_INFORMATION_CLASS, *PTHREAD_INFORMATION_CLASS;
+
+// For NtQueryInformationProcess
+typedef enum _PROCESSINFOCLASS {
+    ProcessBasicInformation                      = 0,
+    ProcessQuotaLimits                           = 1,
+    ProcessIoCounters                            = 2,
+    ProcessVmCounters                            = 3,
+    ProcessTimes                                 = 4,
+    ProcessBasePriority                          = 5,
+    ProcessRaisePriority                         = 6,
+    ProcessDebugPort                             = 7,
+    ProcessExceptionPort                         = 8,
+    ProcessAccessToken                           = 9,
+    ProcessLdtInformation                        = 10,
+    ProcessLdtSize                               = 11,
+    ProcessDefaultHardErrorMode                  = 12,
+    ProcessIoPortHandlers                        = 13,   // Note: this is kernel mode only
+    ProcessPooledUsageAndLimits                  = 14,
+    ProcessWorkingSetWatch                       = 15,
+    ProcessUserModeIOPL                          = 16,
+    ProcessEnableAlignmentFaultFixup             = 17,
+    ProcessPriorityClass                         = 18,
+    ProcessWx86Information                       = 19,
+    ProcessHandleCount                           = 20,
+    ProcessAffinityMask                          = 21,
+    ProcessPriorityBoost                         = 22,
+    ProcessDeviceMap                             = 23,
+    ProcessSessionInformation                    = 24,
+    ProcessForegroundInformation                 = 25,
+    ProcessWow64Information                      = 26,
+    ProcessImageFileName                         = 27,
+    ProcessLUIDDeviceMapsEnabled                 = 28,
+    ProcessBreakOnTermination                    = 29,
+    ProcessDebugObjectHandle                     = 30,
+    ProcessDebugFlags                            = 31,
+    ProcessHandleTracing                         = 32,
+    ProcessIoPriority                            = 33,
+    ProcessExecuteFlags                          = 34,
+    ProcessTlsInformation                        = 35,
+    ProcessCookie                                = 36,
+    ProcessImageInformation                      = 37,
+    ProcessCycleTime                             = 38,
+    ProcessPagePriority                          = 39,
+    ProcessInstrumentationCallback               = 40,
+    ProcessThreadStackAllocation                 = 41,
+    ProcessWorkingSetWatchEx                     = 42,
+    ProcessImageFileNameWin32                    = 43,
+    ProcessImageFileMapping                      = 44,
+    ProcessAffinityUpdateMode                    = 45,
+    ProcessMemoryAllocationMode                  = 46,
+    ProcessGroupInformation                      = 47,
+    ProcessTokenVirtualizationEnabled            = 48,
+    ProcessOwnerInformation                      = 49,
+    ProcessWindowInformation                     = 50,
+    ProcessHandleInformation                     = 51,
+    ProcessMitigationPolicy                      = 52,
+    ProcessDynamicFunctionTableInformation       = 53,
+    ProcessHandleCheckingMode                    = 54,
+    ProcessKeepAliveCount                        = 55,
+    ProcessRevokeFileHandles                     = 56,
+    ProcessWorkingSetControl                     = 57,
+    ProcessHandleTable                           = 58,
+    ProcessCheckStackExtentsMode                 = 59,
+    ProcessCommandLineInformation                = 60,
+    ProcessProtectionInformation                 = 61,
+    ProcessMemoryExhaustion                      = 62,
+    ProcessFaultInformation                      = 63,
+    ProcessTelemetryIdInformation                = 64,
+    ProcessCommitReleaseInformation              = 65,
+    ProcessReserved1Information                  = 66,
+    ProcessReserved2Information                  = 67,
+    ProcessSubsystemProcess                      = 68,
+    ProcessInPrivate                             = 70,
+    ProcessRaiseUMExceptionOnInvalidHandleClose  = 71,
+    ProcessSubsystemInformation                  = 75,
+    ProcessWin32kSyscallFilterInformation        = 79,
+    ProcessEnergyTrackingState                   = 82,
+    MaxProcessInfoClass                             // MaxProcessInfoClass should always be the last enum
+} PROCESSINFOCLASS;
+
+// GetProcessInfo
+typedef enum _PROCESS_INFORMATION_CLASS {
+  ProcessMemoryPriority,
+  ProcessMemoryExhaustionInfo,
+  ProcessAppMemoryInfo,
+  ProcessInPrivateInfo,
+  ProcessPowerThrottling,
+  ProcessReservedValue1,
+  ProcessTelemetryCoverageInfo,
+  ProcessProtectionLevelInfo,
+  ProcessLeapSecondInfo,
+  ProcessMachineTypeInfo, // Map to 0xe6(230) for the syscall NtQueryInformationProcess
+  ProcessOverrideSubsequentPrefetchParameter,
+  ProcessMaxOverridePrefetchParameter,
+  ProcessInformationClassMax
+} PROCESS_INFORMATION_CLASS;

ctypes_generation/definitions/structures/processor.txt

@@ -0,0 +1,11 @@
+typedef enum _MACHINE_ATTRIBUTES {
+  UserEnabled = 0x00000001,
+  KernelEnabled = 0x00000002,
+  Wow64Container = 0x00000004
+} MACHINE_ATTRIBUTES;
+
+typedef struct _PROCESS_MACHINE_INFORMATION {
+  USHORT             ProcessMachine;
+  USHORT             Res0;
+  MACHINE_ATTRIBUTES MachineAttributes;
+} PROCESS_MACHINE_INFORMATION;

ctypes_generation/definitions/structures/section.txt

@@ -0,0 +1,32 @@
+typedef enum MEM_EXTENDED_PARAMETER_TYPE {
+  MemExtendedParameterInvalidType = 0,
+  MemExtendedParameterAddressRequirements = 1,
+  MemExtendedParameterNumaNode = 2,
+  MemExtendedParameterPartitionHandle = 3,
+  MemExtendedParameterUserPhysicalHandle = 4,
+  MemExtendedParameterAttributeFlags = 5,
+  MemExtendedParameterImageMachine = 6,
+  MemExtendedParameterMax
+}  *PMEM_EXTENDED_PARAMETER_TYPE;
+
+
+typedef struct _MEM_ADDRESS_REQUIREMENTS {
+  PVOID  LowestStartingAddress;
+  PVOID  HighestEndingAddress;
+  SIZE_T Alignment;
+} MEM_ADDRESS_REQUIREMENTS, *PMEM_ADDRESS_REQUIREMENTS;
+
+
+typedef struct MEM_EXTENDED_PARAMETER {
+  struct {
+    ULONG64 Type : 8; // MEM_EXTENDED_PARAMETER_TYPE_BITS -> define not handled in parser here
+    ULONG64 Reserved : 56; // 64 - MEM_EXTENDED_PARAMETER_TYPE_BITS -> define not handled in parser here
+  } DUMMYSTRUCTNAME;
+  union {
+    ULONG64 ULong64;
+    PVOID   Pointer;
+    SIZE_T  Size;
+    HANDLE  Handle;
+    ULONG   ULong;
+  } DUMMYUNIONNAME;
+} MEM_EXTENDED_PARAMETER, *PMEM_EXTENDED_PARAMETER;

ctypes_generation/definitions/structures/simple_structs.txt

@@ -0,0 +1,29 @@
+/* Structures that do not depends on anything other that basic type
+    Simplify structure dependancy file graph
+*/
+
+typedef struct _LIST_ENTRY {
+   struct _LIST_ENTRY *Flink;
+   struct _LIST_ENTRY *Blink;
+} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY;
+
+typedef struct _LSA_UNICODE_STRING {
+  USHORT Length;
+  USHORT MaximumLength;
+  PVOID  Buffer; // PVOID to prevent ctypes to automatically read the content of the buffer till a \0
+} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING;
+
+typedef struct _CLIENT_ID{
+   HANDLE UniqueProcess;
+   HANDLE UniqueThread;
+} CLIENT_ID, *PCLIENT_ID;
+
+typedef struct _CLIENT_ID64{
+   ULONG64 UniqueProcess;
+   ULONG64 UniqueThread;
+} CLIENT_ID64, *PCLIENT_ID64;
+
+typedef struct _CLIENT_ID32{
+   ULONG UniqueProcess;
+   ULONG UniqueThread;
+} CLIENT_ID32, *PCLIENT_ID32;

ctypes_generation/definitions/structures/symbols.txt

@@ -130,7 +130,7 @@ typedef struct _IMAGEHLP_MODULEW64 {
   WCHAR    LoadedImageName[256];
   WCHAR    LoadedPdbName[256];
   DWORD    CVSig;
-  WCHAR    *CVData[MAX_PATH * 3];
+  WCHAR    CVData[MAX_PATH * 3]; // Typo in the documentation which says WCHAR    *CVData[MAX_PATH * 3];
   DWORD    PdbSig;
   GUID     PdbSig70;
   DWORD    PdbAge;

ctypes_generation/definitions/structures/system_info.txt

@@ -67,3 +67,22 @@ typedef enum _COMPUTER_NAME_FORMAT {
   ComputerNamePhysicalDnsFullyQualified,
   ComputerNameMax
 } COMPUTER_NAME_FORMAT;
+
+typedef struct _SYSTEM_INFO {
+  union {
+    DWORD dwOemId;
+    struct {
+      WORD wProcessorArchitecture;
+      WORD wReserved;
+    } DUMMYSTRUCTNAME;
+  } DUMMYUNIONNAME;
+  DWORD     dwPageSize;
+  LPVOID    lpMinimumApplicationAddress;
+  LPVOID    lpMaximumApplicationAddress;
+  DWORD_PTR dwActiveProcessorMask;
+  DWORD     dwNumberOfProcessors;
+  DWORD     dwProcessorType;
+  DWORD     dwAllocationGranularity;
+  WORD      wProcessorLevel;
+  WORD      wProcessorRevision;
+} SYSTEM_INFO, *LPSYSTEM_INFO;