go go gadget 0.5

Update replace deprecated use of getfuncargvalue to please new pytest versions
cosmetic changes to doc + generate html doc
2026-06-08 14:31:45 +00:00 · 2019-01-03 22:43:40 +01:00 · 2019-01-03 22:32:19 +01:00 · 2019-01-03 22:20:19 +01:00 · 2019-01-03 22:00:01 +01:00 · 2019-01-03 21:51:35 +01:00
426 changed files with 146245 additions and 56614 deletions
@@ -1,4 +1,8 @@
 *.pyc
 doctrees
 *.inv
-*.pickle
+*.pickle
+
+.vscode/
+.cache/
+dist/
@@ -1,3 +1,47 @@
+Between 0.4 & 0.5:
+    == New features ==
+        - windows.security
+            - SecurityDescriptor / ACL / ACE objects
+        - Improved Token object
+        - windows.debug
+            - New callback Debugger.on_setup
+
+    == Change / Break ==
+    - windows.winproxy
+        - Kernel32Error replaced by WinproxyError
+            - It seemed weird that ntdll/advapi32/etc raised Kernel32Error..
+    - windows.wmi
+        - Wmi API changed, most of them do not return dict anymore but WmiObject
+            - It can be used like mapping
+            - It offers improved feature
+            - real error display handling :)
+
+    - windows.com
+        - ImprovedVariant renamed Variant + new api variant
+            - This is not documented yet
+
+    - windows.rpc.ndr
+        - ndr strings add final \x00 when packing if not present
+    - crypto
+        - CertificateStore.find return None if certif is not found (was raising in the past)
+        - removed ECRYPT_DATA_BLOB
+            - new CRYPT_DATA_BLOB is an _extended_struct :)
+
+
+
+Since 0.35:
+    * WinProcess.get_mapped_filename can now raise on non-standard error (like: ERROR_TRANSACTION_NOT_ACTIVE)
+    * WinProcess.get_mapped_filename now use GetMappedFilenameW (returning an unicode string)
+    * CertificateContext is replace by Certificate
+        * CertificateContext was a PPCERT_CONTEXT. Certificate is a CERT_CONTEXT (not a pointer anymore)
+    * EHCERTSTORE renamed to CertificateStore
+    * added windows.pipe
+
+Since 0.3:
+
+    * Rewrote pe_parse to minimize closure (allowing the refcount to del all ref to WinProcess when the debugger detach it)
+    * Fix debugger.detach / handling on exit_process
+
 Since 0.2:

    * NtStatusException is now a WindowsError
@@ -26,7 +70,6 @@ Since 0.2:
    * Added Debugger.detach


-Since 0.3:

-    * Rewrote pe_parse to minimize closure (allowing the refcount to dell all ref to WinProcess when the debugger detach it)
-    * Fix debugger.detach / handling on exit_process
+
+
@@ -17,6 +17,16 @@ Parts of PythonForWindows are used in the [LKD project][LKD_GITHUB].
 If you have any issue, question, suggestion do not hesitate to contact me.
 I am always glad to have feedbacks from people using this project.

+## Installation
+
+You can install PythonForWindows using the ``setup.py`` script:
+
+``
+python setup.py install
+``
+
+Note that PythonForWindows only support Python2 at the moment.
+
 ## Overview

 ### Processes / Threads
@@ -39,32 +49,32 @@ You can also make some operation on threads (suspend/resume/wait/get(or set) con
 >>> windows.current_process.bitness
 32
 >>> windows.current_process.token.integrity
-SECURITY_MANDATORY_MEDIUM_RID(0x2000L)
->>> calc = [p for p in windows.system.processes if p.name == "calc.exe"][0]
->>> calc
-<WinProcess "calc.exe" pid 6960 at 0x37391f0>
->>> calc.bitness
+SECURITY_MANDATORY_MEDIUM_RID(0x2000)
+>>> proc = [p for p in windows.system.processes if p.name == "notepad.exe"][0]
+>>> proc
+<WinProcess "notepad.exe" pid 16520 at 0x544e410>
+>>> proc.bitness
 64
->>> calc.peb.modules[:3]
-[<RemoteLoadedModule64 "calc.exe" at 0x3671e90>, <RemoteLoadedModule64 "ntdll.dll" at 0x3671030>, <RemoteLoadedModule64 "kernel32.dll" at 0x3671080>]
->>> k32 = calc.peb.modules[2]
+>>> proc.peb.modules[:3]
+[<RemoteLoadedModule64 "notepad.exe" at 0x3671e90>, <RemoteLoadedModule64 "ntdll.dll" at 0x3671030>, <RemoteLoadedModule64 "kernel32.dll" at 0x3671080>]
+>>> k32 = proc.peb.modules[2]
 >>> hex(k32.pe.exports["CreateFileW"])
 '0x7ffee6761550L'
->>> calc.threads[0]
-<WinThread 3932 owner "calc.exe" at 0x3646350>
->>> hex(calc.threads[0].context.Rip)
+>>> proc.threads[0]
+<WinThread 17688 owner "notepad.exe" at 0x53b47f0>
+>>> hex(proc.threads[0].context.Rip)
 '0x7ffee68b54b0L'
->>> calc.execute_python("import os")
+>>> proc.execute_python("import os")
 True
->>> calc.execute_python("exit(os.getpid() + 1)")
+>>> proc.execute_python("exit(os.getpid() + 1)")
 # execute_python raise if process died
 Traceback (most recent call last):
 ...
-WindowsError: <WinProcess "calc.exe" pid 6960 (DEAD) at 0x37391f0> died during execution of python command
+WindowsError: <WinProcess "notepad.exe" pid 16520 (DEAD) at 0x579f610> died during execution of python command
 >>> calc
-<WinProcess "calc.exe" pid 6960 (DEAD) at 0x37391f0>
+<WinProcess "notepad.exe" pid 16520 (DEAD) at 0x579f610>
 >>> calc.exit_code
-6961L
+16521L
 ```

 ### System information
@@ -79,7 +89,7 @@ Information about the Windows computer running the script are available through
 >>> windows.system.computer_name
 'DESKTOP-VKUGISR'
 >>> windows.system.product_type
-VER_NT_WORKSTATION(0x1L)
+VER_NT_WORKSTATION(0x1)
 >>> windows.system.version
 (10, 0)
 >>> windows.system.version_name
@@ -94,6 +104,9 @@ VER_NT_WORKSTATION(0x1L)
 [<WinProcess "[System Process]" pid 0 at 0x433f7d0>, <WinProcess "System" pid 4 at 0x433fd30>]
 >>> windows.system.logicaldrives[0]
 <LogicalDrive "C:\" (DRIVE_FIXED)>
+>>> windows.system.services[23]
+<ServiceA "Appinfo" SERVICE_RUNNING(0x4)>
+
 ```

 ### IAT Hook
@@ -113,7 +126,7 @@ but some have default values and the functions raise exception on call error (I
 # Help on function VirtualAlloc in module windows.winproxy:
 # VirtualAlloc(lpAddress=0, dwSize=NeededParameter, flAllocationType=MEM_COMMIT(0x1000L), flProtect=PAGE_EXECUTE_READWRITE(0x40L))
 #     Errcheck:
-#     raise Kernel32Error if result is 0
+#     raise WinproxyError if result is 0

 # Positional arguments
 >>> windows.winproxy.VirtualAlloc(0, 0x1000)
@@ -145,8 +158,8 @@ File "windows\winproxy.py", line 264, in VirtualAlloc
 File "windows\winproxy.py", line 133, in perform_call
    return self._cprototyped(*args)
 File "windows\winproxy.py", line 59, in kernel32_error_check
-    raise Kernel32Error(func_name)
-windows.winproxy.Kernel32Error: VirtualAlloc: [Error 8] Not enough storage is available to process this command.
+    raise WinproxyError(func_name)
+windows.winproxy.error.WinproxyError: VirtualAlloc: [Error 87] The parameter is incorrect.
 """
 ```

@@ -169,6 +182,42 @@ a simple x86/x64 assembler.
 >>> f = windows.native_exec.create_function(code.get_code(), [ctypes.c_uint])
 >>> f()
 42L
+# Assemblers can also be used in a more standard way
+>>> x86.assemble("cmp edi, 0; jnz :end; mov eax, 1; label :end; ret")
+'\x81\xff\x00\x00\x00\x00u\x06\xc7\xc0\x01\x00\x00\x00\xc3'
+```
+
+### Token / Security Descriptor
+
+Objects easing access to some information about ``Token`` and ``SecurityDescriptor`` are also available.
+
+```python
+>>> import windows.security
+>>> import windows.generated_def as gdef
+>>> tok = windows.current_process.token
+>>> tok
+<Token TokenId=0x6a2b4550 Type=TokenPrimary(0x1)>
+>>> tok.username
+u'hakril'
+>>> tok.type
+tagTOKEN_TYPE.TokenPrimary(0x1)
+>>> tok.integrity
+SECURITY_MANDATORY_MEDIUM_RID(0x2000)
+>>> tok.duplicate(type=gdef.TokenImpersonation, impersonation_level=gdef.SecurityIdentification)
+<Token TokenId=0x6a3532ce Type=TokenImpersonation(0x2) ImpersonationLevel=SecurityIdentification(0x1)>
+
+# Security Descriptor
+>>> sd = windows.security.SecurityDescriptor.from_filename("c:\windows\system32\kernel32.dll")
+>>> sd
+<SecurityDescriptor object at 0x054E3DF0>
+>>> windows.utils.lookup_sid(sd.owner)
+(u'NT SERVICE', u'TrustedInstaller')
+>>> sd.dacl
+<Acl count=6>
+>>> list(sd.dacl)
+[<AccessAllowedACE mask=2032127>, <AccessAllowedACE mask=1179817>, <AccessAllowedACE mask=1179817>, <AccessAllowedACE mask=1179817>, <AccessAllowedACE mask=1179817>, <AccessAllowedACE mask=1179817>]
+>>> sd.dacl[1].sid
+<PSID "S-1-5-32-544">
 ```

 ### Wintrust
@@ -186,7 +235,7 @@ SignatureData(signed=True,
    catalog=u'C:\\Windows\\system32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Package_35_for_KB3128650~31bf3856ad364e35~amd64~~6.3.1.2.cat',
    catalogsigned=True, additionalinfo=0L)
 >>> windows.wintrust.full_signature_information(r"C:\Windows\system32\python27.dll")
-SignatureData(signed=False, catalog=None, catalogsigned=False, additionalinfo=TRUST_E_NOSIGNATURE(0x800b0100L))
+SignatureData(signed=False, catalog=None, catalogsigned=False, additionalinfo=TRUST_E_NOSIGNATURE(0x800b0100))
 ```

 ### WMI
@@ -196,10 +245,11 @@ To extract/play with even more information about the system, PythonForWindows is
 ```python
 >>> import windows
 >>> windows.system.wmi.select
-<bound method WmiRequester.select of <windows.winobject.wmi.WmiRequester object at 0x036BA590>>
->>> windows.system.wmi.select("Win32_Process", ["Name", "Handle"])[:4]
-[{'Handle': u'0', 'Name': u'System Idle Process'}, {'Handle': u'4', 'Name': u'System'}, {'Handle': u'412', 'Name': u'smss.exe'}, {'Handle': u'528', 'Name': u'csrss.exe'}]
-# Get WMI data for current process
+<bound method WmiNamespace.select of <WmiNamespace "root\cimv2">>
+>>> windows.system.wmi.select("Win32_Process")[:3]
+[<WmiObject instance of "Win32_Process">, <WmiObject instance of "Win32_Process">, <WmiObject instance of "Win32_Process">]# Get WMI data for current process
+>>> windows.system.wmi.select("Win32_Process")[42]["Name"]
+u'svchost.exe'
 >>> wmi_cp = [p for p in windows.system.wmi.select("Win32_Process") if int(p["Handle"]) == windows.current_process.pid][0]
 >>> wmi_cp["CommandLine"], wmi_cp["HandleCount"]
 (u'"C:\\Python27\\python.exe"', 227)
@@ -217,7 +267,7 @@ The project also contains some wrapping classes around `_winreg` for simpler use
 >>> cuuser_software
 <PyHKey "HKEY_CURRENT_USER\Software">
 >>> cuuser_software.sam
-KEY_READ(0x20019L)
+KEY_READ(0x20019)
 # Explore subkeys
 >>> cuuser_software.subkeys[:3]
 [<PyHKey "HKEY_CURRENT_USER\Software\7-Zip">, <PyHKey "HKEY_CURRENT_USER\Software\AppDataLow">, <PyHKey "HKEY_CURRENT_USER\Software\Audacity">]
@@ -234,6 +284,86 @@ KeyValue(name='MYQWORD', value=123456789987654321L, type=11)
 [KeyValue(name='MYQWORD', value=123456789987654321L, type=11), KeyValue(name='VALUE', value=u'a_value_for_my_key', type=1)]
 ```

+### Object manager
+
+PythonForWindows uses the native Windows NT API to display some information about the object in the Object Manager's name space.
+Just like the well-known tools ``winobj.exe``
+
+```python
+>>> windows.system.object_manager.root
+<KernelObject "\" (type="Directory")>
+# The objects of type "Directory" can be acceded just like a dict
+>>> list(windows.system.object_manager.root)[:3]
+[u'PendingRenameMutex', u'ObjectTypes', u'storqosfltport']
+# Find an object by its path
+>>> windows.system.object_manager["KnownDLLs\\kernel32.dll"]
+<KernelObject "\KnownDLLs\kernel32.dll" (type="Section")>
+>>> k32 = windows.system.object_manager["KnownDLLs\\kernel32.dll"]
+>>> k32.name, k32.fullname, k32.type
+('kernel32.dll', '\\KnownDLLs\\kernel32.dll', u'Section')
+# Follow SymbolicLink object
+>>> windows.system.object_manager["\\KnownDLLs\\KnownDLLPath"]
+<KernelObject "\KnownDLLs\KnownDLLPath" (type="SymbolicLink")>
+>>> windows.system.object_manager["\\KnownDLLs\\KnownDLLPath"].target
+u'C:\\WINDOWS\\System32'
+```
+
+### Scheduled Task
+
+The ``windows.system.task_scheduler`` object allows to query and create scheduled task.
+
+**This part is still in developpement and the API may evolve**
+
+```python
+>>> windows.system.task_scheduler
+<TaskService at 0x4774670>
+>>> windows.system.task_scheduler.root
+<TaskFolder "\" at 0x4774710>
+>>> task = windows.system.task_scheduler.root.tasks[2]
+>>> task
+<Task "DemoTask" at 0x47748f0>
+>>> task.name
+u'DemoTask'
+# Explore task actions
+>>> task.definition.actions[1]
+<ExecAction at 0x4774800>
+>>> task.definition.actions[1].path
+u'c:\\windows\\python\\python.exe'
+>>> task.definition.actions[1].arguments
+u'yolo.py --test'
+```
+
+### Event logs
+
+The ``windows.system.event_log`` object allows to query event logs.
+
+**This part is still in developpement and the API may evolve**
+
+```python
+>>> windows.system.event_log
+<windows.winobject.event_log.EvtlogManager object at 0x04A78270>
+# Find a channel by its name
+>>> chan = windows.system.event_log["Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"]
+>>> chan
+<EvtChannel "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall">
+# Open .evtx files
+>>> windows.system.event_log["test.evtx"]
+<EvtFile "test.evtx">
+# Query a channel for all events
+>>> chan.query().all()[:2]
+[<EvtEvent id="2004" time="2018-07-12 07:44:08.081504">, <EvtEvent id="2006" time="2018-07-12 07:57:59.806938">]
+# Query a channel for some ids
+>>> chan.query(ids=2004).all()[:2]
+[<EvtEvent id="2004" time="2018-07-12 07:44:08.081504">, <EvtEvent id="2004" time="2018-07-12 07:57:59.815156">]
+# Query a channel via XPATH
+>>> evt = chan.query("Event/EventData[Data='Netflix']").all()[0]
+# Explore event information
+>>> evt
+<EvtEvent id="2006" time="2018-07-17 10:32:39.160423">
+>>> evt.data
+{u'ModifyingUser': 69828304, u'RuleName': u'Netflix', u'ModifyingApplication': ...}
+```
+
 ### ALPC-RPC

 #### ALPC
@@ -292,28 +422,28 @@ import windows
 import windows.debug
 import windows.test
 import windows.native_exec.simple_x86 as x86
+import windows.generated_def as gdef

-from windows.test import pop_calc_32
-from windows.generated_def import EXCEPTION_ACCESS_VIOLATION
+from windows.test import pop_proc_32

 class MyDebugger(windows.debug.Debugger):
    def on_exception(self, exception):
        code = exception.ExceptionRecord.ExceptionCode
        addr = exception.ExceptionRecord.ExceptionAddress
        print("Got exception {0} at 0x{1:x}".format(code, addr))
-        if code == EXCEPTION_ACCESS_VIOLATION:
+        if code == gdef.EXCEPTION_ACCESS_VIOLATION:
            print("Access Violation: kill target process")
            self.current_process.exit()

-calc = windows.test.pop_calc_32(dwCreationFlags=DEBUG_PROCESS)
+calc = windows.test.pop_proc_32(dwCreationFlags=gdef.DEBUG_PROCESS)
 d = MyDebugger(calc)
 calc.execute(x86.assemble("int3; mov [0x42424242], EAX; ret"))
 d.loop()

 ## Ouput ##
-Got exception EXCEPTION_BREAKPOINT(0x80000003L) at 0x77e13c7d
-Got exception EXCEPTION_BREAKPOINT(0x80000003L) at 0x230000
-Got exception EXCEPTION_ACCESS_VIOLATION(0xc0000005L) at 0x230001
+Got exception EXCEPTION_BREAKPOINT(0x80000003) at 0x77e13c7d
+Got exception EXCEPTION_BREAKPOINT(0x80000003) at 0x230000
+Got exception EXCEPTION_ACCESS_VIOLATION(0xc0000005) at 0x230001
 Access Violation: kill target process
 ```

@@ -372,10 +502,10 @@ print("Done!")

 Code addr = 0x6a0002
 GOT AN HXBP at 0x6a0002
-EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x6a0003
-EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x6a0004
-EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x6a0005
-EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x770c7c04
+EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004) at 0x6a0003
+EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004) at 0x6a0004
+EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004) at 0x6a0005
+EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004) at 0x770c7c04
 Done!

 ```
@@ -388,9 +518,12 @@ The local debugger handles
 ### Other stuff (see doc / samples)

 - Network
- Services
 - COM

+## Acknowledgments
+
+* clmntb for his initial work on ``windows.security``
+

 [LKD_GITHUB]: https://github.com/sogeti-esec-lab/LKD/
 [SAMPLE_DIR]: https://github.com/hakril/PythonForWindows/tree/master/samples
@@ -1,11 +1,20 @@
 TODO:

-    - Better WMI interface
+-- CRITICAL BEFORE 0.6 ? --

-    - Process:
-        - set/get WinProcess.priority
+- Document / fix / release:
+    - windows.bits
+    - window
+- Ndr:
+    - Handle les struct conformant imbriquees
+    - Handle le packing de struct specifique
+
+======

    - DBG
+        - FIX BP API !!
+            - add_bp(target=XXX) vs del_bp(targets=XXX) ....
+
        - Verif multiple bp at same place..
        - Verif multiple pending at same place
        - Test !! (bp, BP_HX, bp on only on process, bp_hx on only one thread..)
@@ -24,21 +33,37 @@ TODO:
                - Ecrire un test et fix..


-    - windows.alpc | windows.rpc
-        - Clean + doc + samples
-
-
    - remotectypes
        - pretty sur I can get rid of PointerToStruct64/PointerToStruct32

-    - Some test/doc on windows.system.handles

+    - winutils
+        - some stuff in winutils.py are not documented.
+            - Fix/test/refactor API + doc
+
+    - winobject\exception.py
+        - large part could be rewritten with ctypes-generation extended-def
+
+    - add winobject/window.py
+        - Some test/doc

    - wintrust doc:
        add : https://blogs.msdn.microsoft.com/winsdk/2016/01/05/why-cryptcatadmincalchashfromfilehandle-fails-with-a-seemingly-unexpected-error-code/

+    - COM:
+        - test https://msdn.microsoft.com/en-us/library/vs/alm/hh846255(v=vs.85).aspx
+
+    - Hook
+        - Probleme with enabled hook + gc
+            - Prevent GC of enabled hook ?
+            - Raise on deletion of enabled hook ?
+                - if I implem __del__ -> we have a __del__ cycle -> no gc (gc.garbage instead..)
+
+
 Documentation
    * verif samples
+    * windows.bits
+    - Document change in CurrentProcess read/write memory behavior ?

 RESSOURCE
    * read http://www.codeproject.com/Articles/18975/Listing-Used-Files
@@ -1,4 +1,3 @@
-import StringIO
 from collections import namedtuple

 import dummy_wintypes
@@ -7,64 +6,16 @@ from winstruct import WinStruct, WinUnion, WinStructType, Ptr, WinEnum
 from simpleparser import *


-def initial_processing( data):
-    #  https://gcc.gnu.org/onlinedocs/cpp/Initial-processing.html#Initial-processing
-    # Step 1 -> use correct end of line + add last \n if not existing
-    data = data.replace("\r\n", "\n")
-    if not data.endswith("\n"):
-        data = data + "\n"
-    # Step 2: Trigraph : fuck it
-    pass
-    # Step 3: Line merge !
-    data = data.replace("\\\n", "")
-    # Step 4 Remove comments:
-
-    ins = StringIO.StringIO(data)
-    outs = StringIO.StringIO()
-
-    in_str = False
-    res = []
-    while ins.tell() != len(data):
-        c = ins.read(1)
-        if ins.tell() == len(data):
-            outs.write(c)
-            break
-        if not in_str and c == "/":
-            nc = ins.read(1)
-            if nc  == "/":
-                while c != "\n":
-                    c = ins.read(1)
-                outs.write(c)
-                continue
-            elif nc == "*":
-                while c != "*" or nc != "/":
-                    c = nc
-                    nc = ins.read(1)
-                    if not nc:
-                        raise ValueError("Unmatched */")
-                outs.write(" ")
-                continue
-            else:
-                outs.write(c)
-                ins.seek(ins.tell() - 1)
-                continue
-        # TODO: escape in str
-        elif c == '"':
-            in_str = not in_str
-        outs.write(c)
-    outs.seek(0)
-    return outs.read()
-
 class WinComParser(Parser):
    PARAM_INFO =  ["__RPC__deref_out", "__RPC__in", "__RPC__deref_out_opt", "__RPC__out", "__RPC__in_opt",
        "__RPC__deref_opt_inout_opt", "__in", "__out", "__out_opt", "__in_opt", "__inout",
-        "__reserved", "__RPC__in_opt_string", "__RPC__inout_opt"]
+        "__reserved", "__RPC__in_opt_string", "__RPC__inout_opt", "__RPC__in_string", "__deref_out_opt", "__RPC__inout"]
    PARAM_INFO_WITH_VALUE = ["__RPC__in_ecount", "__RPC__out_ecount_part", "__RPC__in_ecount_full",
            "__RPC__in_range", "__RPC__out_ecount_full", "__out_ecount_opt", "__out_ecount", "__in_ecount_opt",
-            "__in_ecount", "__out_bcount_opt", "__out_bcount", "__in_bcount", "__in_bcount_opt"]
+            "__in_ecount", "__out_bcount_opt", "__out_bcount", "__in_bcount", "__in_bcount_opt", "__RPC__out_ecount_full_string"]

    def __init__(self, data):
-        data = initial_processing(data)
+        # data = self.initial_processing(data)
        #print(data)
        super(WinComParser, self).__init__(data)

@@ -117,14 +68,16 @@ class WinComParser(Parser):
        args = []
        self.assert_token_type(OpenParenthesisToken)
        while type(self.peek()) != CloseParenthesisToken:
-            # TODO: handle call with VARGS ?
-            if self.peek().value == "...":
+            if self.peek().value == "...": #TODO: '...' token ?
                self.next_token()
+                # '...' should be last token before ')'
+                args.append("...") # Put a type ?
+                assert type(self.peek()) == CloseParenthesisToken
                continue
            args.append(self.parse_argument())
            #print("Pass <{0}>".format(p))
        self.next_token()
-        self.assert_token_type(ColonToken)
+        self.assert_token_type(SemiColonToken)
        return ret_type.value, method_name.value, args

    def parse(self):
@@ -160,13 +113,13 @@ class WinComParser(Parser):
            self.next_token()
            self.assert_token_type(StarToken)
            typedefptr = self.assert_token_type(NameToken).value
-        self.assert_token_type(ColonToken)
+        self.assert_token_type(SemiColonToken)
        res.typedefptr = typedefptr
        return res

        #print(self.data)

-Method = namedtuple("Method", ["ret_type", "name", "args"])
+Method = namedtuple("Method", ["ret_type", "name", "args", 'functype'])
 MethodArg = namedtuple("MethodArg", ["type", "byreflevel", "name"])
 class WinCOMVTABLE(object):
    def __init__(self, vtbl_name):
@@ -178,6 +131,11 @@ class WinCOMVTABLE(object):

    def add_method(self, ret_type, method_name, args):
        new_args = []
+        functype = 'stdcall'
+        if args[-1] == "...":
+            print("{0}.{1} is a cdecl COM method".format(self.name, method_name))
+            args = args[:-1]
+            functype = 'cdecl'
        for type, byreflevel, name in args:
            if type in ["long", "int"]:
                type = type.upper()
@@ -185,7 +143,7 @@ class WinCOMVTABLE(object):

        if ret_type in ["long", "int"]:
            ret_type = ret_type.upper()
-        self.methods.append(Method(ret_type, method_name, new_args))
+        self.methods.append(Method(ret_type, method_name, new_args, functype))


 if __name__ == "__main__":
@@ -7,12 +7,11 @@ class WinDef(object):
    def __init__(self, name, code):
        self.name = name
        self.code = code
-        
+
    def generate_ctypes(self):
        return """{0} = make_flag("{0}", {1})""".format(self.name, self.code)

 class WinDefParser(Parser):
-
    def parse_define(self):
        self.assert_token_type(SharpToken)
        define = self.assert_token_type(NameToken)
@@ -26,9 +25,26 @@ class WinDefParser(Parser):
                v = v[:-1]
            define_value.append(v)
        return WinDef(define_name.value, " ".join(define_value))
-        
+
    def parse(self):
        res = []
        while self.peek() is not None:
            res.append(self.parse_define())
-        return res 
+        return res
+
+# A simple Fake parser for NTSTATUS
+class NtStatusParser(object):
+    def __init__(self, data):
+        self.input = data
+
+    def parse(self):
+        nt_status_defs = []
+        for line in self.input.split("\n"):
+            if not line:
+                continue
+            code, name, descr = line.split("|", 2)
+            code = int(code, 0)
+            descr = re.sub(" +", " ", descr[:-1]) # remove \n
+            descr = descr.replace('"', "'")
+            nt_status_defs.append((code, name, descr))
+        return nt_status_defs
@@ -0,0 +1,127 @@
+typedef struct ICallFrameVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            ICallFrame * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */
+            __RPC__deref_out  void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            ICallFrame * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            ICallFrame * This);
+
+        HRESULT ( STDMETHODCALLTYPE *GetInfo )(
+            ICallFrame * This,
+            /* [out] */ CALLFRAMEINFO *pInfo);
+
+        HRESULT ( STDMETHODCALLTYPE *GetIIDAndMethod )(
+            ICallFrame * This,
+            /* [out] */ IID *pIID,
+            /* [out] */ ULONG *piMethod);
+
+        HRESULT ( STDMETHODCALLTYPE *GetNames )(
+            ICallFrame * This,
+            /* [annotation][out] */
+            __deref_out_opt  LPWSTR *pwszInterface,
+            /* [annotation][out] */
+            __deref_out_opt  LPWSTR *pwszMethod);
+
+        PVOID ( STDMETHODCALLTYPE *GetStackLocation )(
+            ICallFrame * This);
+
+        VOID ( STDMETHODCALLTYPE *SetStackLocation )(
+            ICallFrame * This,
+            /* [in] */ PVOID pvStack);
+
+        VOID ( STDMETHODCALLTYPE *SetReturnValue )(
+            ICallFrame * This,
+            /* [in] */ HRESULT hr);
+
+        HRESULT ( STDMETHODCALLTYPE *GetReturnValue )(
+            ICallFrame * This);
+
+        HRESULT ( STDMETHODCALLTYPE *GetParamInfo )(
+            ICallFrame * This,
+            /* [in] */ ULONG iparam,
+            /* [out] */ CALLFRAMEPARAMINFO *pInfo);
+
+        HRESULT ( STDMETHODCALLTYPE *SetParam )(
+            ICallFrame * This,
+            /* [in] */ ULONG iparam,
+            /* [in] */ VARIANT *pvar);
+
+        HRESULT ( STDMETHODCALLTYPE *GetParam )(
+            ICallFrame * This,
+            /* [in] */ ULONG iparam,
+            /* [out] */ VARIANT *pvar);
+
+        HRESULT ( STDMETHODCALLTYPE *Copy )(
+            ICallFrame * This,
+            /* [in] */ CALLFRAME_COPY copyControl,
+            /* [in] */ ICallFrameWalker *pWalker,
+            /* [out] */ ICallFrame **ppFrame);
+
+        HRESULT ( STDMETHODCALLTYPE *Free )(
+            ICallFrame * This,
+            /* [in] */ ICallFrame *pframeArgsDest,
+            /* [in] */ ICallFrameWalker *pWalkerDestFree,
+            /* [in] */ ICallFrameWalker *pWalkerCopy,
+            /* [in] */ DWORD freeFlags,
+            /* [in] */ ICallFrameWalker *pWalkerFree,
+            /* [in] */ DWORD nullFlags);
+
+        HRESULT ( STDMETHODCALLTYPE *FreeParam )(
+            ICallFrame * This,
+            /* [in] */ ULONG iparam,
+            /* [in] */ DWORD freeFlags,
+            /* [in] */ ICallFrameWalker *pWalkerFree,
+            /* [in] */ DWORD nullFlags);
+
+        HRESULT ( STDMETHODCALLTYPE *WalkFrame )(
+            ICallFrame * This,
+            /* [in] */ DWORD walkWhat,
+            /* [in] */ ICallFrameWalker *pWalker);
+
+        HRESULT ( STDMETHODCALLTYPE *GetMarshalSizeMax )(
+            ICallFrame * This,
+            /* [in] */ CALLFRAME_MARSHALCONTEXT *pmshlContext,
+            /* [in] */ MSHLFLAGS mshlflags,
+            /* [out] */ ULONG *pcbBufferNeeded);
+
+        HRESULT ( STDMETHODCALLTYPE *Marshal )(
+            ICallFrame * This,
+            /* [in] */ CALLFRAME_MARSHALCONTEXT *pmshlContext,
+            /* [in] */ MSHLFLAGS mshlflags,
+            /* [size_is][in] */ PVOID pBuffer,
+            /* [in] */ ULONG cbBuffer,
+            /* [out] */ ULONG *pcbBufferUsed,
+            /* [out] */ RPCOLEDATAREP *pdataRep,
+            /* [out] */ ULONG *prpcFlags);
+
+        HRESULT ( STDMETHODCALLTYPE *Unmarshal )(
+            ICallFrame * This,
+            /* [size_is][in] */ PVOID pBuffer,
+            /* [in] */ ULONG cbBuffer,
+            /* [in] */ RPCOLEDATAREP dataRep,
+            /* [in] */ CALLFRAME_MARSHALCONTEXT *pcontext,
+            /* [out] */ ULONG *pcbUnmarshalled);
+
+        HRESULT ( STDMETHODCALLTYPE *ReleaseMarshalData )(
+            ICallFrame * This,
+            /* [size_is][in] */ PVOID pBuffer,
+            /* [in] */ ULONG cbBuffer,
+            /* [in] */ ULONG ibFirstRelease,
+            /* [in] */ RPCOLEDATAREP dataRep,
+            /* [in] */ CALLFRAME_MARSHALCONTEXT *pcontext);
+
+        HRESULT ( STDMETHODCALLTYPE *Invoke )(
+            ICallFrame * This,
+            /* [in] */ void *pvReceiver,
+            ...);
+
+        END_INTERFACE
+    } ICallFrameVtbl;
@@ -0,0 +1,22 @@
+typedef struct ICallFrameEventsVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            ICallFrameEvents * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            ICallFrameEvents * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            ICallFrameEvents * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *OnCall )( 
+            ICallFrameEvents * This,
+            /* [in] */ ICallFrame *pFrame);
+        
+        END_INTERFACE
+    } ICallFrameEventsVtbl;
@@ -0,0 +1,25 @@
+typedef struct ICallFrameWalkerVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        ICallFrameWalker * This,
+        /* [in] */ REFIID riid,
+        /* [annotation][iid_is][out] */
+        __RPC__deref_out  void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        ICallFrameWalker * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        ICallFrameWalker * This);
+
+    HRESULT ( STDMETHODCALLTYPE *OnWalkInterface )(
+        ICallFrameWalker * This,
+        /* [in] */ REFIID iid,
+        /* [in] */ PVOID *ppvInterface,
+        /* [in] */ BOOL fIn,
+        /* [in] */ BOOL fOut);
+
+    END_INTERFACE
+} ICallFrameWalkerVtbl;
@@ -0,0 +1,56 @@
+typedef struct ICallInterceptorVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            ICallInterceptor * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            ICallInterceptor * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            ICallInterceptor * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *CallIndirect )( 
+            ICallInterceptor * This,
+            /* [out] */ HRESULT *phrReturn,
+            /* [in] */ ULONG iMethod,
+            /* [in] */ void *pvArgs,
+            /* [out] */ ULONG *cbArgs);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetMethodInfo )( 
+            ICallInterceptor * This,
+            /* [in] */ ULONG iMethod,
+            /* [out] */ CALLFRAMEINFO *pInfo,
+            /* [annotation][out] */ 
+            __deref_out_opt  LPWSTR *pwszMethod);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetStackSize )( 
+            ICallInterceptor * This,
+            /* [in] */ ULONG iMethod,
+            /* [out] */ ULONG *cbArgs);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIID )( 
+            ICallInterceptor * This,
+            /* [annotation][out] */ 
+            __out_opt  IID *piid,
+            /* [annotation][out] */ 
+            __out_opt  BOOL *pfDerivesFromIDispatch,
+            /* [annotation][out] */ 
+            __out_opt  ULONG *pcMethod,
+            /* [annotation][out] */ 
+            __deref_out_opt  LPWSTR *pwszInterface);
+        
+        HRESULT ( STDMETHODCALLTYPE *RegisterSink )( 
+            ICallInterceptor * This,
+            /* [in] */ ICallFrameEvents *psink);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetRegisteredSink )( 
+            ICallInterceptor * This,
+            /* [out] */ ICallFrameEvents **ppsink);
+        
+        END_INTERFACE
+    } ICallInterceptorVtbl;
@@ -0,0 +1,43 @@
+typedef struct IPersistFileVtbl
+ {
+     BEGIN_INTERFACE
+
+     HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+         __RPC__in IPersistFile * This,
+         /* [in] */ __RPC__in REFIID riid,
+         /* [annotation][iid_is][out] */
+         __RPC__deref_out  void **ppvObject);
+
+     ULONG ( STDMETHODCALLTYPE *AddRef )(
+         __RPC__in IPersistFile * This);
+
+     ULONG ( STDMETHODCALLTYPE *Release )(
+         __RPC__in IPersistFile * This);
+
+     HRESULT ( STDMETHODCALLTYPE *GetClassID )(
+         __RPC__in IPersistFile * This,
+         /* [out] */ __RPC__out CLSID *pClassID);
+
+     HRESULT ( STDMETHODCALLTYPE *IsDirty )(
+         __RPC__in IPersistFile * This);
+
+     HRESULT ( STDMETHODCALLTYPE *Load )(
+         __RPC__in IPersistFile * This,
+         /* [in] */ __RPC__in LPCOLESTR pszFileName,
+         /* [in] */ DWORD dwMode);
+
+     HRESULT ( STDMETHODCALLTYPE *Save )(
+         __RPC__in IPersistFile * This,
+         /* [unique][in] */ __RPC__in_opt LPCOLESTR pszFileName,
+         /* [in] */ BOOL fRemember);
+
+     HRESULT ( STDMETHODCALLTYPE *SaveCompleted )(
+         __RPC__in IPersistFile * This,
+         /* [unique][in] */ __RPC__in_opt LPCOLESTR pszFileName);
+
+     HRESULT ( STDMETHODCALLTYPE *GetCurFile )(
+         __RPC__in IPersistFile * This,
+         /* [out] */ __RPC__deref_out_opt LPOLESTR *ppszFileName);
+
+     END_INTERFACE
+} IPersistFileVtbl;
@@ -0,0 +1,101 @@
+typedef struct IShellLinkAVtbl
+{
+    BEGIN_INTERFACE
+
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+        __RPC__in IShellLinkA * This,
+        /* [in] */ __RPC__in REFIID riid,
+        /* [annotation][iid_is][out] */
+        __RPC__deref_out  void **ppvObject);
+
+    ULONG ( STDMETHODCALLTYPE *AddRef )(
+        __RPC__in IShellLinkA * This);
+
+    ULONG ( STDMETHODCALLTYPE *Release )(
+        __RPC__in IShellLinkA * This);
+
+    HRESULT ( STDMETHODCALLTYPE *GetPath )(
+        __RPC__in IShellLinkA * This,
+        /* [size_is][string][out] */ __RPC__out_ecount_full_string(cch) LPSTR pszFile,
+        /* [in] */ int cch,
+        /* [unique][out][in] */ __RPC__inout_opt WIN32_FIND_DATAA *pfd,
+        /* [in] */ DWORD fFlags);
+
+    HRESULT ( STDMETHODCALLTYPE *GetIDList )(
+        __RPC__in IShellLinkA * This,
+        /* [out] */ __RPC__deref_out_opt PIDLIST_ABSOLUTE *ppidl);
+
+    HRESULT ( STDMETHODCALLTYPE *SetIDList )(
+        __RPC__in IShellLinkA * This,
+        /* [in] */ __RPC__in PCIDLIST_ABSOLUTE pidl);
+
+    HRESULT ( STDMETHODCALLTYPE *GetDescription )(
+        __RPC__in IShellLinkA * This,
+        /* [size_is][string][out] */ __RPC__out_ecount_full_string(cch) LPSTR pszName,
+        /* [in] */ int cch);
+
+    HRESULT ( STDMETHODCALLTYPE *SetDescription )(
+        __RPC__in IShellLinkA * This,
+        /* [string][in] */ __RPC__in_string LPCSTR pszName);
+
+    HRESULT ( STDMETHODCALLTYPE *GetWorkingDirectory )(
+        __RPC__in IShellLinkA * This,
+        /* [size_is][string][out] */ __RPC__out_ecount_full_string(cch) LPSTR pszDir,
+        /* [in] */ int cch);
+
+    HRESULT ( STDMETHODCALLTYPE *SetWorkingDirectory )(
+        __RPC__in IShellLinkA * This,
+        /* [string][in] */ __RPC__in_string LPCSTR pszDir);
+
+    HRESULT ( STDMETHODCALLTYPE *GetArguments )(
+        __RPC__in IShellLinkA * This,
+        /* [size_is][string][out] */ __RPC__out_ecount_full_string(cch) LPSTR pszArgs,
+        /* [in] */ int cch);
+
+    HRESULT ( STDMETHODCALLTYPE *SetArguments )(
+        __RPC__in IShellLinkA * This,
+        /* [string][in] */ __RPC__in_string LPCSTR pszArgs);
+
+    HRESULT ( STDMETHODCALLTYPE *GetHotkey )(
+        __RPC__in IShellLinkA * This,
+        /* [out] */ __RPC__out WORD *pwHotkey);
+
+    HRESULT ( STDMETHODCALLTYPE *SetHotkey )(
+        __RPC__in IShellLinkA * This,
+        /* [in] */ WORD wHotkey);
+
+    HRESULT ( STDMETHODCALLTYPE *GetShowCmd )(
+        __RPC__in IShellLinkA * This,
+        /* [out] */ __RPC__out int *piShowCmd);
+
+    HRESULT ( STDMETHODCALLTYPE *SetShowCmd )(
+        __RPC__in IShellLinkA * This,
+        /* [in] */ int iShowCmd);
+
+    HRESULT ( STDMETHODCALLTYPE *GetIconLocation )(
+        __RPC__in IShellLinkA * This,
+        /* [size_is][string][out] */ __RPC__out_ecount_full_string(cch) LPSTR pszIconPath,
+        /* [in] */ int cch,
+        /* [out] */ __RPC__out int *piIcon);
+
+    HRESULT ( STDMETHODCALLTYPE *SetIconLocation )(
+        __RPC__in IShellLinkA * This,
+        /* [string][in] */ __RPC__in_string LPCSTR pszIconPath,
+        /* [in] */ int iIcon);
+
+    HRESULT ( STDMETHODCALLTYPE *SetRelativePath )(
+        __RPC__in IShellLinkA * This,
+        /* [string][in] */ __RPC__in_string LPCSTR pszPathRel,
+        /* [in] */ DWORD dwReserved);
+
+    HRESULT ( STDMETHODCALLTYPE *Resolve )(
+        __RPC__in IShellLinkA * This,
+        /* [unique][in] */ __RPC__in_opt HWND hwnd,
+        /* [in] */ DWORD fFlags);
+
+    HRESULT ( STDMETHODCALLTYPE *SetPath )(
+        __RPC__in IShellLinkA * This,
+        /* [string][in] */ __RPC__in_string LPCSTR pszFile);
+
+    END_INTERFACE
+} IShellLinkAVtbl;
@@ -0,0 +1,101 @@
+typedef struct IShellLinkWVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            __RPC__in IShellLinkW * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            __RPC__in IShellLinkW * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            __RPC__in IShellLinkW * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetPath )( 
+            __RPC__in IShellLinkW * This,
+            /* [size_is][string][out] */ __RPC__out_ecount_full_string(cch) LPWSTR pszFile,
+            /* [in] */ int cch,
+            /* [unique][out][in] */ __RPC__inout_opt WIN32_FIND_DATAW *pfd,
+            /* [in] */ DWORD fFlags);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDList )( 
+            __RPC__in IShellLinkW * This,
+            /* [out] */ __RPC__deref_out_opt PIDLIST_ABSOLUTE *ppidl);
+        
+        HRESULT ( STDMETHODCALLTYPE *SetIDList )( 
+            __RPC__in IShellLinkW * This,
+            /* [unique][in] */ __RPC__in_opt PCIDLIST_ABSOLUTE pidl);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetDescription )( 
+            __RPC__in IShellLinkW * This,
+            /* [size_is][string][out] */ __RPC__out_ecount_full_string(cch) LPWSTR pszName,
+            int cch);
+        
+        HRESULT ( STDMETHODCALLTYPE *SetDescription )( 
+            __RPC__in IShellLinkW * This,
+            /* [string][in] */ __RPC__in_string LPCWSTR pszName);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetWorkingDirectory )( 
+            __RPC__in IShellLinkW * This,
+            /* [size_is][string][out] */ __RPC__out_ecount_full_string(cch) LPWSTR pszDir,
+            int cch);
+        
+        HRESULT ( STDMETHODCALLTYPE *SetWorkingDirectory )( 
+            __RPC__in IShellLinkW * This,
+            /* [string][in] */ __RPC__in_string LPCWSTR pszDir);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetArguments )( 
+            __RPC__in IShellLinkW * This,
+            /* [size_is][string][out] */ __RPC__out_ecount_full_string(cch) LPWSTR pszArgs,
+            /* [in] */ int cch);
+        
+        HRESULT ( STDMETHODCALLTYPE *SetArguments )( 
+            __RPC__in IShellLinkW * This,
+            /* [string][in] */ __RPC__in_string LPCWSTR pszArgs);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetHotkey )( 
+            __RPC__in IShellLinkW * This,
+            /* [out] */ __RPC__out WORD *pwHotkey);
+        
+        HRESULT ( STDMETHODCALLTYPE *SetHotkey )( 
+            __RPC__in IShellLinkW * This,
+            /* [in] */ WORD wHotkey);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetShowCmd )( 
+            __RPC__in IShellLinkW * This,
+            /* [out] */ __RPC__out int *piShowCmd);
+        
+        HRESULT ( STDMETHODCALLTYPE *SetShowCmd )( 
+            __RPC__in IShellLinkW * This,
+            /* [in] */ int iShowCmd);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIconLocation )( 
+            __RPC__in IShellLinkW * This,
+            /* [size_is][string][out] */ __RPC__out_ecount_full_string(cch) LPWSTR pszIconPath,
+            /* [in] */ int cch,
+            /* [out] */ __RPC__out int *piIcon);
+        
+        HRESULT ( STDMETHODCALLTYPE *SetIconLocation )( 
+            __RPC__in IShellLinkW * This,
+            /* [string][in] */ __RPC__in_string LPCWSTR pszIconPath,
+            /* [in] */ int iIcon);
+        
+        HRESULT ( STDMETHODCALLTYPE *SetRelativePath )( 
+            __RPC__in IShellLinkW * This,
+            /* [string][in] */ __RPC__in_string LPCWSTR pszPathRel,
+            /* [in] */ DWORD dwReserved);
+        
+        HRESULT ( STDMETHODCALLTYPE *Resolve )( 
+            __RPC__in IShellLinkW * This,
+            /* [unique][in] */ __RPC__in_opt HWND hwnd,
+            /* [in] */ DWORD fFlags);
+        
+        HRESULT ( STDMETHODCALLTYPE *SetPath )( 
+            __RPC__in IShellLinkW * This,
+            /* [string][in] */ __RPC__in_string LPCWSTR pszFile);
+        
+        END_INTERFACE
+    } IShellLinkWVtbl;
@@ -0,0 +1,59 @@
+typedef struct IActionVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            IAction * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            IAction * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            IAction * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            IAction * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            IAction * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            IAction * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            IAction * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Id )( 
+            IAction * This,
+            /* [retval][out] */ BSTR *pId);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Id )( 
+            IAction * This,
+            /* [in] */ BSTR Id);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Type )( 
+            IAction * This,
+            /* [retval][out] */ TASK_ACTION_TYPE *pType);
+        
+        END_INTERFACE
+    } IActionVtbl;
@@ -0,0 +1,88 @@
+typedef struct IActionCollectionVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            IActionCollection * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            IActionCollection * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            IActionCollection * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            IActionCollection * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            IActionCollection * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            IActionCollection * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            IActionCollection * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Count )( 
+            IActionCollection * This,
+            /* [retval][out] */ long *pCount);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Item )( 
+            IActionCollection * This,
+            /* [in] */ long index,
+            /* [retval][out] */ IAction **ppAction);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get__NewEnum )( 
+            IActionCollection * This,
+            /* [retval][out] */ IUnknown **ppEnum);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_XmlText )( 
+            IActionCollection * This,
+            /* [retval][out] */ BSTR *pText);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_XmlText )( 
+            IActionCollection * This,
+            /* [in] */ BSTR text);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *Create )( 
+            IActionCollection * This,
+            /* [in] */ TASK_ACTION_TYPE type,
+            /* [retval][out] */ IAction **ppAction);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *Remove )( 
+            IActionCollection * This,
+            /* [in] */ VARIANT index);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *Clear )( 
+            IActionCollection * This);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Context )( 
+            IActionCollection * This,
+            /* [retval][out] */ BSTR *pContext);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Context )( 
+            IActionCollection * This,
+            /* [in] */ BSTR context);
+        
+        END_INTERFACE
+    } IActionCollectionVtbl;
@@ -0,0 +1,75 @@
+typedef struct IComHandlerActionVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            IComHandlerAction * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            IComHandlerAction * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            IComHandlerAction * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            IComHandlerAction * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            IComHandlerAction * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            IComHandlerAction * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            IComHandlerAction * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Id )( 
+            IComHandlerAction * This,
+            /* [retval][out] */ BSTR *pId);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Id )( 
+            IComHandlerAction * This,
+            /* [in] */ BSTR Id);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Type )( 
+            IComHandlerAction * This,
+            /* [retval][out] */ TASK_ACTION_TYPE *pType);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_ClassId )( 
+            IComHandlerAction * This,
+            /* [retval][out] */ BSTR *pClsid);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_ClassId )( 
+            IComHandlerAction * This,
+            /* [in] */ BSTR clsid);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Data )( 
+            IComHandlerAction * This,
+            /* [retval][out] */ BSTR *pData);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Data )( 
+            IComHandlerAction * This,
+            /* [in] */ BSTR data);
+        
+        END_INTERFACE
+    } IComHandlerActionVtbl;
@@ -0,0 +1,139 @@
+typedef struct IEmailActionVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            IEmailAction * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            IEmailAction * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            IEmailAction * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            IEmailAction * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            IEmailAction * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            IEmailAction * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            IEmailAction * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Id )( 
+            IEmailAction * This,
+            /* [retval][out] */ BSTR *pId);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Id )( 
+            IEmailAction * This,
+            /* [in] */ BSTR Id);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Type )( 
+            IEmailAction * This,
+            /* [retval][out] */ TASK_ACTION_TYPE *pType);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Server )( 
+            IEmailAction * This,
+            /* [retval][out] */ BSTR *pServer);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Server )( 
+            IEmailAction * This,
+            /* [in] */ BSTR server);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Subject )( 
+            IEmailAction * This,
+            /* [retval][out] */ BSTR *pSubject);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Subject )( 
+            IEmailAction * This,
+            /* [in] */ BSTR subject);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_To )( 
+            IEmailAction * This,
+            /* [retval][out] */ BSTR *pTo);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_To )( 
+            IEmailAction * This,
+            /* [in] */ BSTR to);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Cc )( 
+            IEmailAction * This,
+            /* [retval][out] */ BSTR *pCc);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Cc )( 
+            IEmailAction * This,
+            /* [in] */ BSTR cc);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Bcc )( 
+            IEmailAction * This,
+            /* [retval][out] */ BSTR *pBcc);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Bcc )( 
+            IEmailAction * This,
+            /* [in] */ BSTR bcc);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_ReplyTo )( 
+            IEmailAction * This,
+            /* [retval][out] */ BSTR *pReplyTo);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_ReplyTo )( 
+            IEmailAction * This,
+            /* [in] */ BSTR replyTo);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_From )( 
+            IEmailAction * This,
+            /* [retval][out] */ BSTR *pFrom);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_From )( 
+            IEmailAction * This,
+            /* [in] */ BSTR from);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_HeaderFields )( 
+            IEmailAction * This,
+            /* [retval][out] */ ITaskNamedValueCollection **ppHeaderFields);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_HeaderFields )( 
+            IEmailAction * This,
+            /* [in] */ ITaskNamedValueCollection *pHeaderFields);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Body )( 
+            IEmailAction * This,
+            /* [retval][out] */ BSTR *pBody);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Body )( 
+            IEmailAction * This,
+            /* [in] */ BSTR body);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Attachments )( 
+            IEmailAction * This,
+            /* [retval][out] */ SAFEARRAY * *pAttachements);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Attachments )( 
+            IEmailAction * This,
+            /* [max_is][in] */ SAFEARRAY * pAttachements);
+        
+        END_INTERFACE
+    } IEmailActionVtbl;
@@ -0,0 +1,83 @@
+typedef struct IExecActionVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            IExecAction * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            IExecAction * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            IExecAction * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            IExecAction * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            IExecAction * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            IExecAction * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            IExecAction * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Id )( 
+            IExecAction * This,
+            /* [retval][out] */ BSTR *pId);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Id )( 
+            IExecAction * This,
+            /* [in] */ BSTR Id);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Type )( 
+            IExecAction * This,
+            /* [retval][out] */ TASK_ACTION_TYPE *pType);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Path )( 
+            IExecAction * This,
+            /* [retval][out] */ BSTR *pPath);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Path )( 
+            IExecAction * This,
+            /* [in] */ BSTR path);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Arguments )( 
+            IExecAction * This,
+            /* [retval][out] */ BSTR *pArgument);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Arguments )( 
+            IExecAction * This,
+            /* [in] */ BSTR argument);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_WorkingDirectory )( 
+            IExecAction * This,
+            /* [retval][out] */ BSTR *pWorkingDirectory);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_WorkingDirectory )( 
+            IExecAction * This,
+            /* [in] */ BSTR workingDirectory);
+        
+        END_INTERFACE
+    } IExecActionVtbl;
@@ -0,0 +1,79 @@
+typedef struct IIdleSettingsVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            IIdleSettings * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            IIdleSettings * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            IIdleSettings * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            IIdleSettings * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            IIdleSettings * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            IIdleSettings * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            IIdleSettings * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_IdleDuration )( 
+            IIdleSettings * This,
+            /* [retval][out] */ BSTR *pDelay);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_IdleDuration )( 
+            IIdleSettings * This,
+            /* [in] */ BSTR delay);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_WaitTimeout )( 
+            IIdleSettings * This,
+            /* [retval][out] */ BSTR *pTimeout);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_WaitTimeout )( 
+            IIdleSettings * This,
+            /* [in] */ BSTR timeout);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_StopOnIdleEnd )( 
+            IIdleSettings * This,
+            /* [retval][out] */ VARIANT_BOOL *pStop);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_StopOnIdleEnd )( 
+            IIdleSettings * This,
+            /* [in] */ VARIANT_BOOL stop);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_RestartOnIdle )( 
+            IIdleSettings * This,
+            /* [retval][out] */ VARIANT_BOOL *pRestart);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_RestartOnIdle )( 
+            IIdleSettings * This,
+            /* [in] */ VARIANT_BOOL restart);
+        
+        END_INTERFACE
+    } IIdleSettingsVtbl;
@@ -0,0 +1,63 @@
+typedef struct INetworkSettingsVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            INetworkSettings * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            INetworkSettings * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            INetworkSettings * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            INetworkSettings * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            INetworkSettings * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            INetworkSettings * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            INetworkSettings * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Name )( 
+            INetworkSettings * This,
+            /* [retval][out] */ BSTR *pName);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Name )( 
+            INetworkSettings * This,
+            /* [in] */ BSTR name);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Id )( 
+            INetworkSettings * This,
+            /* [retval][out] */ BSTR *pId);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Id )( 
+            INetworkSettings * This,
+            /* [in] */ BSTR id);
+        
+        END_INTERFACE
+    } INetworkSettingsVtbl;
@@ -0,0 +1,95 @@
+typedef struct IPrincipalVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            IPrincipal * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            IPrincipal * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            IPrincipal * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            IPrincipal * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            IPrincipal * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            IPrincipal * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            IPrincipal * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Id )( 
+            IPrincipal * This,
+            /* [retval][out] */ BSTR *pId);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Id )( 
+            IPrincipal * This,
+            /* [in] */ BSTR Id);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_DisplayName )( 
+            IPrincipal * This,
+            /* [retval][out] */ BSTR *pName);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_DisplayName )( 
+            IPrincipal * This,
+            /* [in] */ BSTR name);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_UserId )( 
+            IPrincipal * This,
+            /* [retval][out] */ BSTR *pUser);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_UserId )( 
+            IPrincipal * This,
+            /* [in] */ BSTR user);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_LogonType )( 
+            IPrincipal * This,
+            /* [retval][out] */ TASK_LOGON_TYPE *pLogon);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_LogonType )( 
+            IPrincipal * This,
+            /* [in] */ TASK_LOGON_TYPE logon);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_GroupId )( 
+            IPrincipal * This,
+            /* [retval][out] */ BSTR *pGroup);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_GroupId )( 
+            IPrincipal * This,
+            /* [in] */ BSTR group);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_RunLevel )( 
+            IPrincipal * This,
+            /* [retval][out] */ TASK_RUNLEVEL_TYPE *pRunLevel);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_RunLevel )( 
+            IPrincipal * This,
+            /* [in] */ TASK_RUNLEVEL_TYPE runLevel);
+        
+        END_INTERFACE
+    } IPrincipalVtbl;
@@ -0,0 +1,130 @@
+typedef struct IRegisteredTaskVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            __RPC__in IRegisteredTask * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            __RPC__in IRegisteredTask * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            __RPC__in IRegisteredTask * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            __RPC__in IRegisteredTask * This,
+            /* [out] */ __RPC__out UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            __RPC__in IRegisteredTask * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ __RPC__deref_out_opt ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            __RPC__in IRegisteredTask * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [size_is][in] */ __RPC__in_ecount_full(cNames) LPOLESTR *rgszNames,
+            /* [range][in] */ __RPC__in_range(0,16384) UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ __RPC__out_ecount_full(cNames) DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            IRegisteredTask * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Name )( 
+            __RPC__in IRegisteredTask * This,
+            /* [retval][out] */ __RPC__deref_out_opt BSTR *pName);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Path )( 
+            __RPC__in IRegisteredTask * This,
+            /* [retval][out] */ __RPC__deref_out_opt BSTR *pPath);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_State )( 
+            __RPC__in IRegisteredTask * This,
+            /* [retval][out] */ __RPC__out TASK_STATE *pState);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Enabled )( 
+            __RPC__in IRegisteredTask * This,
+            /* [retval][out] */ __RPC__out VARIANT_BOOL *pEnabled);
+        
+        /* [helpstring][id][propput] */ HRESULT ( STDMETHODCALLTYPE *put_Enabled )( 
+            __RPC__in IRegisteredTask * This,
+            VARIANT_BOOL enabled);
+        
+        /* [id] */ HRESULT ( STDMETHODCALLTYPE *Run )( 
+            __RPC__in IRegisteredTask * This,
+            /* [in] */ VARIANT params,
+            /* [retval][out] */ __RPC__deref_out_opt IRunningTask **ppRunningTask);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *RunEx )( 
+            __RPC__in IRegisteredTask * This,
+            /* [in] */ VARIANT params,
+            /* [in] */ LONG flags,
+            /* [in] */ LONG sessionID,
+            /* [in] */ __RPC__in BSTR user,
+            /* [retval][out] */ __RPC__deref_out_opt IRunningTask **ppRunningTask);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *GetInstances )( 
+            __RPC__in IRegisteredTask * This,
+            /* [in] */ LONG flags,
+            /* [retval][out] */ __RPC__deref_out_opt IRunningTaskCollection **ppRunningTasks);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_LastRunTime )( 
+            __RPC__in IRegisteredTask * This,
+            /* [retval][out] */ __RPC__out DATE *pLastRunTime);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_LastTaskResult )( 
+            __RPC__in IRegisteredTask * This,
+            /* [retval][out] */ __RPC__out LONG *pLastTaskResult);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_NumberOfMissedRuns )( 
+            __RPC__in IRegisteredTask * This,
+            /* [retval][out] */ __RPC__out LONG *pNumberOfMissedRuns);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_NextRunTime )( 
+            __RPC__in IRegisteredTask * This,
+            /* [retval][out] */ __RPC__out DATE *pNextRunTime);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Definition )( 
+            __RPC__in IRegisteredTask * This,
+            /* [retval][out] */ __RPC__deref_out_opt ITaskDefinition **ppDefinition);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Xml )( 
+            __RPC__in IRegisteredTask * This,
+            /* [retval][out] */ __RPC__deref_out_opt BSTR *pXml);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *GetSecurityDescriptor )( 
+            __RPC__in IRegisteredTask * This,
+            /* [in] */ LONG securityInformation,
+            /* [retval][out] */ __RPC__deref_out_opt BSTR *pSddl);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *SetSecurityDescriptor )( 
+            __RPC__in IRegisteredTask * This,
+            /* [in] */ __RPC__in BSTR sddl,
+            /* [in] */ LONG flags);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *Stop )( 
+            __RPC__in IRegisteredTask * This,
+            /* [in] */ LONG flags);
+        
+        /* [helpstring][hidden][restricted] */ HRESULT ( STDMETHODCALLTYPE *GetRunTimes )( 
+            __RPC__in IRegisteredTask * This,
+            /* [in] */ __RPC__in const LPSYSTEMTIME pstStart,
+            /* [in] */ __RPC__in const LPSYSTEMTIME pstEnd,
+            /* [out][in] */ __RPC__inout DWORD *pCount,
+            /* [out] */ __RPC__deref_out_opt LPSYSTEMTIME *pRunTimes);
+        
+        END_INTERFACE
+    } IRegisteredTaskVtbl;
@@ -0,0 +1,60 @@
+typedef struct IRegisteredTaskCollectionVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            __RPC__in IRegisteredTaskCollection * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            __RPC__in IRegisteredTaskCollection * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            __RPC__in IRegisteredTaskCollection * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            __RPC__in IRegisteredTaskCollection * This,
+            /* [out] */ __RPC__out UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            __RPC__in IRegisteredTaskCollection * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ __RPC__deref_out_opt ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            __RPC__in IRegisteredTaskCollection * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [size_is][in] */ __RPC__in_ecount_full(cNames) LPOLESTR *rgszNames,
+            /* [range][in] */ __RPC__in_range(0,16384) UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ __RPC__out_ecount_full(cNames) DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            IRegisteredTaskCollection * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Count )( 
+            __RPC__in IRegisteredTaskCollection * This,
+            /* [retval][out] */ __RPC__out LONG *pCount);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Item )( 
+            __RPC__in IRegisteredTaskCollection * This,
+            /* [in] */ VARIANT index,
+            /* [retval][out] */ __RPC__deref_out_opt IRegisteredTask **ppRegisteredTask);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get__NewEnum )( 
+            __RPC__in IRegisteredTaskCollection * This,
+            /* [retval][out] */ __RPC__deref_out_opt IUnknown **ppEnum);
+        
+        END_INTERFACE
+    } IRegisteredTaskCollectionVtbl;
@@ -0,0 +1,119 @@
+typedef struct IRegistrationInfoVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            IRegistrationInfo * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            IRegistrationInfo * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            IRegistrationInfo * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            IRegistrationInfo * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            IRegistrationInfo * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            IRegistrationInfo * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            IRegistrationInfo * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Description )( 
+            IRegistrationInfo * This,
+            /* [retval][out] */ BSTR *pDescription);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Description )( 
+            IRegistrationInfo * This,
+            /* [in] */ BSTR description);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Author )( 
+            IRegistrationInfo * This,
+            /* [retval][out] */ BSTR *pAuthor);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Author )( 
+            IRegistrationInfo * This,
+            /* [in] */ BSTR author);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Version )( 
+            IRegistrationInfo * This,
+            /* [retval][out] */ BSTR *pVersion);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Version )( 
+            IRegistrationInfo * This,
+            /* [in] */ BSTR version);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Date )( 
+            IRegistrationInfo * This,
+            /* [retval][out] */ BSTR *pDate);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Date )( 
+            IRegistrationInfo * This,
+            /* [in] */ BSTR date);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Documentation )( 
+            IRegistrationInfo * This,
+            /* [retval][out] */ BSTR *pDocumentation);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Documentation )( 
+            IRegistrationInfo * This,
+            /* [in] */ BSTR documentation);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_XmlText )( 
+            IRegistrationInfo * This,
+            /* [retval][out] */ BSTR *pText);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_XmlText )( 
+            IRegistrationInfo * This,
+            /* [in] */ BSTR text);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_URI )( 
+            IRegistrationInfo * This,
+            /* [retval][out] */ BSTR *pUri);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_URI )( 
+            IRegistrationInfo * This,
+            /* [in] */ BSTR uri);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_SecurityDescriptor )( 
+            IRegistrationInfo * This,
+            /* [retval][out] */ VARIANT *pSddl);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_SecurityDescriptor )( 
+            IRegistrationInfo * This,
+            /* [in] */ VARIANT sddl);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Source )( 
+            IRegistrationInfo * This,
+            /* [retval][out] */ BSTR *pSource);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Source )( 
+            IRegistrationInfo * This,
+            /* [in] */ BSTR source);
+        
+        END_INTERFACE
+    } IRegistrationInfoVtbl;
@@ -0,0 +1,71 @@
+typedef struct IRepetitionPatternVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            IRepetitionPattern * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            IRepetitionPattern * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            IRepetitionPattern * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            IRepetitionPattern * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            IRepetitionPattern * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            IRepetitionPattern * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            IRepetitionPattern * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Interval )( 
+            IRepetitionPattern * This,
+            /* [retval][out] */ BSTR *pInterval);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Interval )( 
+            IRepetitionPattern * This,
+            /* [in] */ BSTR interval);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Duration )( 
+            IRepetitionPattern * This,
+            /* [retval][out] */ BSTR *pDuration);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Duration )( 
+            IRepetitionPattern * This,
+            /* [in] */ BSTR duration);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_StopAtDurationEnd )( 
+            IRepetitionPattern * This,
+            /* [retval][out] */ VARIANT_BOOL *pStop);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_StopAtDurationEnd )( 
+            IRepetitionPattern * This,
+            /* [in] */ VARIANT_BOOL stop);
+        
+        END_INTERFACE
+    } IRepetitionPatternVtbl;
@@ -0,0 +1,77 @@
+typedef struct IRunningTaskVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            __RPC__in IRunningTask * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            __RPC__in IRunningTask * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            __RPC__in IRunningTask * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            __RPC__in IRunningTask * This,
+            /* [out] */ __RPC__out UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            __RPC__in IRunningTask * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ __RPC__deref_out_opt ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            __RPC__in IRunningTask * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [size_is][in] */ __RPC__in_ecount_full(cNames) LPOLESTR *rgszNames,
+            /* [range][in] */ __RPC__in_range(0,16384) UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ __RPC__out_ecount_full(cNames) DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            IRunningTask * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Name )( 
+            __RPC__in IRunningTask * This,
+            /* [retval][out] */ __RPC__deref_out_opt BSTR *pName);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_InstanceGuid )( 
+            __RPC__in IRunningTask * This,
+            /* [retval][out] */ __RPC__deref_out_opt BSTR *pGuid);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Path )( 
+            __RPC__in IRunningTask * This,
+            /* [retval][out] */ __RPC__deref_out_opt BSTR *pPath);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_State )( 
+            __RPC__in IRunningTask * This,
+            /* [retval][out] */ __RPC__out TASK_STATE *pState);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_CurrentAction )( 
+            __RPC__in IRunningTask * This,
+            /* [retval][out] */ __RPC__deref_out_opt BSTR *pName);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *Stop )( 
+            __RPC__in IRunningTask * This);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *Refresh )( 
+            __RPC__in IRunningTask * This);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_EnginePID )( 
+            __RPC__in IRunningTask * This,
+            /* [retval][out] */ __RPC__out DWORD *pPID);
+        
+        END_INTERFACE
+    } IRunningTaskVtbl;
@@ -0,0 +1,60 @@
+typedef struct IRunningTaskCollectionVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            __RPC__in IRunningTaskCollection * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            __RPC__in IRunningTaskCollection * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            __RPC__in IRunningTaskCollection * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            __RPC__in IRunningTaskCollection * This,
+            /* [out] */ __RPC__out UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            __RPC__in IRunningTaskCollection * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ __RPC__deref_out_opt ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            __RPC__in IRunningTaskCollection * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [size_is][in] */ __RPC__in_ecount_full(cNames) LPOLESTR *rgszNames,
+            /* [range][in] */ __RPC__in_range(0,16384) UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ __RPC__out_ecount_full(cNames) DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            IRunningTaskCollection * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Count )( 
+            __RPC__in IRunningTaskCollection * This,
+            /* [retval][out] */ __RPC__out LONG *pCount);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Item )( 
+            __RPC__in IRunningTaskCollection * This,
+            /* [in] */ VARIANT index,
+            /* [retval][out] */ __RPC__deref_out_opt IRunningTask **ppRunningTask);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get__NewEnum )( 
+            __RPC__in IRunningTaskCollection * This,
+            /* [retval][out] */ __RPC__deref_out_opt IUnknown **ppEnum);
+        
+        END_INTERFACE
+    } IRunningTaskCollectionVtbl;
@@ -0,0 +1,75 @@
+typedef struct IShowMessageActionVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            IShowMessageAction * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            IShowMessageAction * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            IShowMessageAction * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            IShowMessageAction * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            IShowMessageAction * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            IShowMessageAction * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            IShowMessageAction * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Id )( 
+            IShowMessageAction * This,
+            /* [retval][out] */ BSTR *pId);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Id )( 
+            IShowMessageAction * This,
+            /* [in] */ BSTR Id);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Type )( 
+            IShowMessageAction * This,
+            /* [retval][out] */ TASK_ACTION_TYPE *pType);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Title )( 
+            IShowMessageAction * This,
+            /* [retval][out] */ BSTR *pTitle);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Title )( 
+            IShowMessageAction * This,
+            /* [in] */ BSTR title);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_MessageBody )( 
+            IShowMessageAction * This,
+            /* [retval][out] */ BSTR *pMessageBody);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_MessageBody )( 
+            IShowMessageAction * This,
+            /* [in] */ BSTR messageBody);
+        
+        END_INTERFACE
+    } IShowMessageActionVtbl;
@@ -0,0 +1,103 @@
+typedef struct ITaskDefinitionVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            ITaskDefinition * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            ITaskDefinition * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            ITaskDefinition * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            ITaskDefinition * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            ITaskDefinition * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            ITaskDefinition * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            ITaskDefinition * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_RegistrationInfo )( 
+            ITaskDefinition * This,
+            /* [retval][out] */ IRegistrationInfo **ppRegistrationInfo);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_RegistrationInfo )( 
+            ITaskDefinition * This,
+            /* [in] */ IRegistrationInfo *pRegistrationInfo);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Triggers )( 
+            ITaskDefinition * This,
+            /* [retval][out] */ ITriggerCollection **ppTriggers);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Triggers )( 
+            ITaskDefinition * This,
+            /* [in] */ ITriggerCollection *pTriggers);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Settings )( 
+            ITaskDefinition * This,
+            /* [retval][out] */ ITaskSettings **ppSettings);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Settings )( 
+            ITaskDefinition * This,
+            /* [in] */ ITaskSettings *pSettings);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Data )( 
+            ITaskDefinition * This,
+            /* [retval][out] */ BSTR *pData);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Data )( 
+            ITaskDefinition * This,
+            /* [in] */ BSTR data);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Principal )( 
+            ITaskDefinition * This,
+            /* [retval][out] */ IPrincipal **ppPrincipal);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Principal )( 
+            ITaskDefinition * This,
+            /* [in] */ IPrincipal *pPrincipal);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Actions )( 
+            ITaskDefinition * This,
+            /* [retval][out] */ IActionCollection **ppActions);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Actions )( 
+            ITaskDefinition * This,
+            /* [in] */ IActionCollection *pActions);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_XmlText )( 
+            ITaskDefinition * This,
+            /* [retval][out] */ BSTR *pXml);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_XmlText )( 
+            ITaskDefinition * This,
+            /* [in] */ BSTR xml);
+        
+        END_INTERFACE
+    } ITaskDefinitionVtbl;
@@ -0,0 +1,123 @@
+typedef struct ITaskFolderVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            __RPC__in ITaskFolder * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            __RPC__in ITaskFolder * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            __RPC__in ITaskFolder * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            __RPC__in ITaskFolder * This,
+            /* [out] */ __RPC__out UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            __RPC__in ITaskFolder * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ __RPC__deref_out_opt ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            __RPC__in ITaskFolder * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [size_is][in] */ __RPC__in_ecount_full(cNames) LPOLESTR *rgszNames,
+            /* [range][in] */ __RPC__in_range(0,16384) UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ __RPC__out_ecount_full(cNames) DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            ITaskFolder * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Name )( 
+            __RPC__in ITaskFolder * This,
+            /* [retval][out] */ __RPC__deref_out_opt BSTR *pName);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Path )( 
+            __RPC__in ITaskFolder * This,
+            /* [retval][out] */ __RPC__deref_out_opt BSTR *pPath);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *GetFolder )( 
+            __RPC__in ITaskFolder * This,
+            __RPC__in BSTR path,
+            /* [retval][out] */ __RPC__deref_out_opt ITaskFolder **ppFolder);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *GetFolders )( 
+            __RPC__in ITaskFolder * This,
+            /* [in] */ LONG flags,
+            /* [retval][out] */ __RPC__deref_out_opt ITaskFolderCollection **ppFolders);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *CreateFolder )( 
+            __RPC__in ITaskFolder * This,
+            /* [in] */ __RPC__in BSTR subFolderName,
+            /* [optional][in] */ VARIANT sddl,
+            /* [retval][out] */ __RPC__deref_out_opt ITaskFolder **ppFolder);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *DeleteFolder )( 
+            __RPC__in ITaskFolder * This,
+            __RPC__in BSTR subFolderName,
+            /* [in] */ LONG flags);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *GetTask )( 
+            __RPC__in ITaskFolder * This,
+            /* [in] */ __RPC__in BSTR path,
+            /* [retval][out] */ __RPC__deref_out_opt IRegisteredTask **ppTask);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *GetTasks )( 
+            __RPC__in ITaskFolder * This,
+            /* [in] */ LONG flags,
+            /* [retval][out] */ __RPC__deref_out_opt IRegisteredTaskCollection **ppTasks);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *DeleteTask )( 
+            __RPC__in ITaskFolder * This,
+            /* [in] */ __RPC__in BSTR name,
+            /* [in] */ LONG flags);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *RegisterTask )( 
+            __RPC__in ITaskFolder * This,
+            /* [in] */ __RPC__in BSTR path,
+            /* [in] */ __RPC__in BSTR xmlText,
+            /* [in] */ LONG flags,
+            /* [in] */ VARIANT userId,
+            /* [in] */ VARIANT password,
+            /* [in] */ TASK_LOGON_TYPE logonType,
+            /* [optional][in] */ VARIANT sddl,
+            /* [retval][out] */ __RPC__deref_out_opt IRegisteredTask **ppTask);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *RegisterTaskDefinition )( 
+            __RPC__in ITaskFolder * This,
+            /* [in] */ __RPC__in BSTR path,
+            /* [in] */ __RPC__in_opt ITaskDefinition *pDefinition,
+            /* [in] */ LONG flags,
+            /* [in] */ VARIANT userId,
+            /* [in] */ VARIANT password,
+            /* [in] */ TASK_LOGON_TYPE logonType,
+            /* [optional][in] */ VARIANT sddl,
+            /* [retval][out] */ __RPC__deref_out_opt IRegisteredTask **ppTask);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *GetSecurityDescriptor )( 
+            __RPC__in ITaskFolder * This,
+            LONG securityInformation,
+            /* [retval][out] */ __RPC__deref_out_opt BSTR *pSddl);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *SetSecurityDescriptor )( 
+            __RPC__in ITaskFolder * This,
+            /* [in] */ __RPC__in BSTR sddl,
+            /* [in] */ LONG flags);
+        
+        END_INTERFACE
+    } ITaskFolderVtbl;
@@ -0,0 +1,60 @@
+typedef struct ITaskFolderCollectionVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            __RPC__in ITaskFolderCollection * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            __RPC__in ITaskFolderCollection * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            __RPC__in ITaskFolderCollection * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            __RPC__in ITaskFolderCollection * This,
+            /* [out] */ __RPC__out UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            __RPC__in ITaskFolderCollection * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ __RPC__deref_out_opt ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            __RPC__in ITaskFolderCollection * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [size_is][in] */ __RPC__in_ecount_full(cNames) LPOLESTR *rgszNames,
+            /* [range][in] */ __RPC__in_range(0,16384) UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ __RPC__out_ecount_full(cNames) DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            ITaskFolderCollection * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Count )( 
+            __RPC__in ITaskFolderCollection * This,
+            /* [retval][out] */ __RPC__out LONG *pCount);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Item )( 
+            __RPC__in ITaskFolderCollection * This,
+            /* [in] */ VARIANT index,
+            /* [retval][out] */ __RPC__deref_out_opt ITaskFolder **ppFolder);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get__NewEnum )( 
+            __RPC__in ITaskFolderCollection * This,
+            /* [retval][out] */ __RPC__deref_out_opt IUnknown **ppEnum);
+        
+        END_INTERFACE
+    } ITaskFolderCollectionVtbl;
@@ -0,0 +1,73 @@
+typedef struct ITaskNamedValueCollectionVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            ITaskNamedValueCollection * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            ITaskNamedValueCollection * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            ITaskNamedValueCollection * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            ITaskNamedValueCollection * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            ITaskNamedValueCollection * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            ITaskNamedValueCollection * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            ITaskNamedValueCollection * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Count )( 
+            ITaskNamedValueCollection * This,
+            /* [retval][out] */ long *pCount);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Item )( 
+            ITaskNamedValueCollection * This,
+            /* [in] */ LONG index,
+            /* [retval][out] */ ITaskNamedValuePair **ppPair);
+        
+        /* [id][propget] */ HRESULT ( STDMETHODCALLTYPE *get__NewEnum )( 
+            ITaskNamedValueCollection * This,
+            /* [retval][out] */ IUnknown **ppEnum);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *Create )( 
+            ITaskNamedValueCollection * This,
+            /* [in] */ BSTR name,
+            /* [in] */ BSTR value,
+            /* [retval][out] */ ITaskNamedValuePair **ppPair);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *Remove )( 
+            ITaskNamedValueCollection * This,
+            /* [in] */ LONG index);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *Clear )( 
+            ITaskNamedValueCollection * This);
+        
+        END_INTERFACE
+    } ITaskNamedValueCollectionVtbl;
@@ -0,0 +1,63 @@
+typedef struct ITaskNamedValuePairVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            ITaskNamedValuePair * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            ITaskNamedValuePair * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            ITaskNamedValuePair * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            ITaskNamedValuePair * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            ITaskNamedValuePair * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            ITaskNamedValuePair * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            ITaskNamedValuePair * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Name )( 
+            ITaskNamedValuePair * This,
+            /* [retval][out] */ BSTR *pName);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Name )( 
+            ITaskNamedValuePair * This,
+            /* [in] */ BSTR name);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Value )( 
+            ITaskNamedValuePair * This,
+            /* [retval][out] */ BSTR *pValue);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Value )( 
+            ITaskNamedValuePair * This,
+            /* [in] */ BSTR value);
+        
+        END_INTERFACE
+    } ITaskNamedValuePairVtbl;
@@ -0,0 +1,89 @@
+typedef struct ITaskServiceVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            __RPC__in ITaskService * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            __RPC__in ITaskService * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            __RPC__in ITaskService * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            __RPC__in ITaskService * This,
+            /* [out] */ __RPC__out UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            __RPC__in ITaskService * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ __RPC__deref_out_opt ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            __RPC__in ITaskService * This,
+            /* [in] */ __RPC__in REFIID riid,
+            /* [size_is][in] */ __RPC__in_ecount_full(cNames) LPOLESTR *rgszNames,
+            /* [range][in] */ __RPC__in_range(0,16384) UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ __RPC__out_ecount_full(cNames) DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            ITaskService * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *GetFolder )( 
+            __RPC__in ITaskService * This,
+            /* [in] */ __RPC__in BSTR path,
+            /* [retval][out] */ __RPC__deref_out_opt ITaskFolder **ppFolder);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *GetRunningTasks )( 
+            __RPC__in ITaskService * This,
+            /* [in] */ LONG flags,
+            /* [retval][out] */ __RPC__deref_out_opt IRunningTaskCollection **ppRunningTasks);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *NewTask )( 
+            __RPC__in ITaskService * This,
+            /* [in] */ DWORD flags,
+            /* [retval][out] */ __RPC__deref_out_opt ITaskDefinition **ppDefinition);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *Connect )( 
+            __RPC__in ITaskService * This,
+            /* [optional][in] */ VARIANT serverName,
+            /* [optional][in] */ VARIANT user,
+            /* [optional][in] */ VARIANT domain,
+            /* [optional][in] */ VARIANT password);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Connected )( 
+            __RPC__in ITaskService * This,
+            /* [retval][out] */ __RPC__out VARIANT_BOOL *pConnected);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_TargetServer )( 
+            __RPC__in ITaskService * This,
+            /* [retval][out] */ __RPC__deref_out_opt BSTR *pServer);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_ConnectedUser )( 
+            __RPC__in ITaskService * This,
+            /* [retval][out] */ __RPC__deref_out_opt BSTR *pUser);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_ConnectedDomain )( 
+            __RPC__in ITaskService * This,
+            /* [retval][out] */ __RPC__deref_out_opt BSTR *pDomain);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_HighestVersion )( 
+            __RPC__in ITaskService * This,
+            /* [retval][out] */ __RPC__out DWORD *pVersion);
+        
+        END_INTERFACE
+    } ITaskServiceVtbl;
@@ -0,0 +1,207 @@
+typedef struct ITaskSettingsVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            ITaskSettings * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            ITaskSettings * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            ITaskSettings * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            ITaskSettings * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            ITaskSettings * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            ITaskSettings * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            ITaskSettings * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_AllowDemandStart )( 
+            ITaskSettings * This,
+            /* [retval][out] */ VARIANT_BOOL *pAllowDemandStart);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_AllowDemandStart )( 
+            ITaskSettings * This,
+            /* [in] */ VARIANT_BOOL allowDemandStart);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_RestartInterval )( 
+            ITaskSettings * This,
+            /* [retval][out] */ BSTR *pRestartInterval);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_RestartInterval )( 
+            ITaskSettings * This,
+            /* [in] */ BSTR restartInterval);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_RestartCount )( 
+            ITaskSettings * This,
+            /* [retval][out] */ int *pRestartCount);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_RestartCount )( 
+            ITaskSettings * This,
+            /* [in] */ int restartCount);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_MultipleInstances )( 
+            ITaskSettings * This,
+            /* [retval][out] */ TASK_INSTANCES_POLICY *pPolicy);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_MultipleInstances )( 
+            ITaskSettings * This,
+            /* [in] */ TASK_INSTANCES_POLICY policy);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_StopIfGoingOnBatteries )( 
+            ITaskSettings * This,
+            /* [retval][out] */ VARIANT_BOOL *pStopIfOnBatteries);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_StopIfGoingOnBatteries )( 
+            ITaskSettings * This,
+            /* [in] */ VARIANT_BOOL stopIfOnBatteries);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_DisallowStartIfOnBatteries )( 
+            ITaskSettings * This,
+            /* [retval][out] */ VARIANT_BOOL *pDisallowStart);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_DisallowStartIfOnBatteries )( 
+            ITaskSettings * This,
+            /* [in] */ VARIANT_BOOL disallowStart);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_AllowHardTerminate )( 
+            ITaskSettings * This,
+            /* [retval][out] */ VARIANT_BOOL *pAllowHardTerminate);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_AllowHardTerminate )( 
+            ITaskSettings * This,
+            /* [in] */ VARIANT_BOOL allowHardTerminate);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_StartWhenAvailable )( 
+            ITaskSettings * This,
+            /* [retval][out] */ VARIANT_BOOL *pStartWhenAvailable);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_StartWhenAvailable )( 
+            ITaskSettings * This,
+            /* [in] */ VARIANT_BOOL startWhenAvailable);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_XmlText )( 
+            ITaskSettings * This,
+            /* [retval][out] */ BSTR *pText);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_XmlText )( 
+            ITaskSettings * This,
+            /* [in] */ BSTR text);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_RunOnlyIfNetworkAvailable )( 
+            ITaskSettings * This,
+            /* [retval][out] */ VARIANT_BOOL *pRunOnlyIfNetworkAvailable);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_RunOnlyIfNetworkAvailable )( 
+            ITaskSettings * This,
+            /* [in] */ VARIANT_BOOL runOnlyIfNetworkAvailable);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_ExecutionTimeLimit )( 
+            ITaskSettings * This,
+            /* [retval][out] */ BSTR *pExecutionTimeLimit);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_ExecutionTimeLimit )( 
+            ITaskSettings * This,
+            /* [in] */ BSTR executionTimeLimit);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Enabled )( 
+            ITaskSettings * This,
+            /* [retval][out] */ VARIANT_BOOL *pEnabled);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Enabled )( 
+            ITaskSettings * This,
+            /* [in] */ VARIANT_BOOL enabled);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_DeleteExpiredTaskAfter )( 
+            ITaskSettings * This,
+            /* [retval][out] */ BSTR *pExpirationDelay);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_DeleteExpiredTaskAfter )( 
+            ITaskSettings * This,
+            /* [in] */ BSTR expirationDelay);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Priority )( 
+            ITaskSettings * This,
+            /* [retval][out] */ int *pPriority);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Priority )( 
+            ITaskSettings * This,
+            /* [in] */ int priority);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Compatibility )( 
+            ITaskSettings * This,
+            /* [retval][out] */ TASK_COMPATIBILITY *pCompatLevel);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Compatibility )( 
+            ITaskSettings * This,
+            /* [in] */ TASK_COMPATIBILITY compatLevel);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Hidden )( 
+            ITaskSettings * This,
+            /* [retval][out] */ VARIANT_BOOL *pHidden);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Hidden )( 
+            ITaskSettings * This,
+            /* [in] */ VARIANT_BOOL hidden);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_IdleSettings )( 
+            ITaskSettings * This,
+            /* [retval][out] */ IIdleSettings **ppIdleSettings);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_IdleSettings )( 
+            ITaskSettings * This,
+            /* [in] */ IIdleSettings *pIdleSettings);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_RunOnlyIfIdle )( 
+            ITaskSettings * This,
+            /* [retval][out] */ VARIANT_BOOL *pRunOnlyIfIdle);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_RunOnlyIfIdle )( 
+            ITaskSettings * This,
+            /* [in] */ VARIANT_BOOL runOnlyIfIdle);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_WakeToRun )( 
+            ITaskSettings * This,
+            /* [retval][out] */ VARIANT_BOOL *pWake);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_WakeToRun )( 
+            ITaskSettings * This,
+            /* [in] */ VARIANT_BOOL wake);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_NetworkSettings )( 
+            ITaskSettings * This,
+            /* [retval][out] */ INetworkSettings **ppNetworkSettings);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_NetworkSettings )( 
+            ITaskSettings * This,
+            /* [in] */ INetworkSettings *pNetworkSettings);
+        
+        END_INTERFACE
+    } ITaskSettingsVtbl;
@@ -0,0 +1,99 @@
+typedef struct ITriggerVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            ITrigger * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            ITrigger * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            ITrigger * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            ITrigger * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            ITrigger * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            ITrigger * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            ITrigger * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Type )( 
+            ITrigger * This,
+            /* [retval][out] */ TASK_TRIGGER_TYPE2 *pType);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Id )( 
+            ITrigger * This,
+            /* [retval][out] */ BSTR *pId);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Id )( 
+            ITrigger * This,
+            /* [in] */ BSTR id);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Repetition )( 
+            ITrigger * This,
+            /* [retval][out] */ IRepetitionPattern **ppRepeat);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Repetition )( 
+            ITrigger * This,
+            /* [in] */ IRepetitionPattern *pRepeat);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_ExecutionTimeLimit )( 
+            ITrigger * This,
+            /* [retval][out] */ BSTR *pTimeLimit);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_ExecutionTimeLimit )( 
+            ITrigger * This,
+            /* [in] */ BSTR timelimit);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_StartBoundary )( 
+            ITrigger * This,
+            /* [retval][out] */ BSTR *pStart);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_StartBoundary )( 
+            ITrigger * This,
+            /* [in] */ BSTR start);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_EndBoundary )( 
+            ITrigger * This,
+            /* [retval][out] */ BSTR *pEnd);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_EndBoundary )( 
+            ITrigger * This,
+            /* [in] */ BSTR end);
+        
+        /* [helpstring][propget][id] */ HRESULT ( STDMETHODCALLTYPE *get_Enabled )( 
+            ITrigger * This,
+            /* [retval][out] */ VARIANT_BOOL *pEnabled);
+        
+        /* [helpstring][propput][id] */ HRESULT ( STDMETHODCALLTYPE *put_Enabled )( 
+            ITrigger * This,
+            /* [in] */ VARIANT_BOOL enabled);
+        
+        END_INTERFACE
+    } ITriggerVtbl;
@@ -0,0 +1,72 @@
+typedef struct ITriggerCollectionVtbl
+    {
+        BEGIN_INTERFACE
+        
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
+            ITriggerCollection * This,
+            /* [in] */ REFIID riid,
+            /* [annotation][iid_is][out] */ 
+            __RPC__deref_out  void **ppvObject);
+        
+        ULONG ( STDMETHODCALLTYPE *AddRef )( 
+            ITriggerCollection * This);
+        
+        ULONG ( STDMETHODCALLTYPE *Release )( 
+            ITriggerCollection * This);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfoCount )( 
+            ITriggerCollection * This,
+            /* [out] */ UINT *pctinfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetTypeInfo )( 
+            ITriggerCollection * This,
+            /* [in] */ UINT iTInfo,
+            /* [in] */ LCID lcid,
+            /* [out] */ ITypeInfo **ppTInfo);
+        
+        HRESULT ( STDMETHODCALLTYPE *GetIDsOfNames )( 
+            ITriggerCollection * This,
+            /* [in] */ REFIID riid,
+            /* [size_is][in] */ LPOLESTR *rgszNames,
+            /* [range][in] */ UINT cNames,
+            /* [in] */ LCID lcid,
+            /* [size_is][out] */ DISPID *rgDispId);
+        
+        /* [local] */ HRESULT ( STDMETHODCALLTYPE *Invoke )( 
+            ITriggerCollection * This,
+            /* [in] */ DISPID dispIdMember,
+            /* [in] */ REFIID riid,
+            /* [in] */ LCID lcid,
+            /* [in] */ WORD wFlags,
+            /* [out][in] */ DISPPARAMS *pDispParams,
+            /* [out] */ VARIANT *pVarResult,
+            /* [out] */ EXCEPINFO *pExcepInfo,
+            /* [out] */ UINT *puArgErr);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Count )( 
+            ITriggerCollection * This,
+            /* [retval][out] */ long *pCount);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_Item )( 
+            ITriggerCollection * This,
+            /* [in] */ long index,
+            /* [retval][out] */ ITrigger **ppTrigger);
+        
+        /* [helpstring][id][propget] */ HRESULT ( STDMETHODCALLTYPE *get__NewEnum )( 
+            ITriggerCollection * This,
+            /* [retval][out] */ IUnknown **ppEnum);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *Create )( 
+            ITriggerCollection * This,
+            /* [in] */ TASK_TRIGGER_TYPE2 type,
+            /* [retval][out] */ ITrigger **ppTrigger);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *Remove )( 
+            ITriggerCollection * This,
+            /* [in] */ VARIANT index);
+        
+        /* [helpstring][id] */ HRESULT ( STDMETHODCALLTYPE *Clear )( 
+            ITriggerCollection * This);
+        
+        END_INTERFACE
+    } ITriggerCollectionVtbl;
@@ -0,0 +1,58 @@
+import functools
+import ctypes
+
+
+generate_IID = IID.from_raw
+
+
+class COMHRESULT(HRESULT):
+    _type_ = HRESULT._type_
+    def _check_retval_(self):
+        # We CAN NOT try to adapt the self.value and transform it with flags
+        # here, we need to do it with the errcheck
+        # So we have the peer-interface callback system on errcheck :)
+        return self.value # The value will be send to errcheck :)
+
+class COMInterface(ctypes.c_void_p):
+    _functions_ = {
+    }
+
+    # So COMInterface completely bypass the HRESULT
+    # return value check on restype by setting the restype to COMHRESULT
+    # But we add the 'errcheck' callbakc capacity for all COMInterface and subclasses
+    # So the default implem of the callbakc must have the same behavior as
+    # standard HRESULT restype.
+    # This is why default errcheck callback call ctypes._check_HRESULT
+    def _default_errcheck(self, result, func, args):
+        ctypes._check_HRESULT(result)
+        return args
+
+    def __getattr__(self, name):
+        if name in self._functions_:
+            winfunc = self._functions_[name]
+            # Hacking the HRESULT _check_retval_ and
+            # letting COMInterface.errcheck do the work of validating / raising
+            winfunc.restype = COMHRESULT
+            effective_errcheck = getattr(self, "errcheck", self._default_errcheck)
+            winfunc.errcheck = effective_errcheck
+            return functools.partial(winfunc, self)
+        return super(COMInterface, self).__getattribute__(name)
+
+    def __repr__(self):
+        description = "<NULL>" if not self.value else ""
+        return "<{0}{1} at {2:#x}>".format(type(self).__name__, description, id(self))
+
+    # Simplified API for QueryInterface for interface embeding there IID
+    def query(self, interfacetype):
+        interface = interfacetype()
+        self.QueryInterface(interface.IID, interface)
+        return interface
+
+
+
+
+
+
+
+
+
@@ -0,0 +1,46 @@
+#define CWCSTORAGENAME 32
+
+/* Storage instantiation modes */
+#define STGM_DIRECT             0x00000000L
+#define STGM_TRANSACTED         0x00010000L
+#define STGM_SIMPLE             0x08000000L
+
+#define STGM_READ               0x00000000L
+#define STGM_WRITE              0x00000001L
+#define STGM_READWRITE          0x00000002L
+
+#define STGM_SHARE_DENY_NONE    0x00000040L
+#define STGM_SHARE_DENY_READ    0x00000030L
+#define STGM_SHARE_DENY_WRITE   0x00000020L
+#define STGM_SHARE_EXCLUSIVE    0x00000010L
+
+#define STGM_PRIORITY           0x00040000L
+#define STGM_DELETEONRELEASE    0x04000000L
+#define STGM_NOSCRATCH          0x00100000L
+
+#define STGM_CREATE             0x00001000L
+#define STGM_CONVERT            0x00020000L
+#define STGM_FAILIFTHERE        0x00000000L
+
+#define STGM_NOSNAPSHOT         0x00200000L
+#define STGM_DIRECT_SWMR        0x00400000L
+
+/*  flags for internet asyncronous and layout docfile */
+#define ASYNC_MODE_COMPATIBILITY    0x00000001L
+#define ASYNC_MODE_DEFAULT          0x00000000L
+
+#define STGTY_REPEAT                0x00000100L
+#define STG_TOEND                   0xFFFFFFFFL
+
+#define STG_LAYOUT_SEQUENTIAL       0x00000000L
+#define STG_LAYOUT_INTERLEAVED      0x00000001L
+
+
+#define STGFMT_STORAGE          0
+#define STGFMT_NATIVE           1
+#define STGFMT_FILE             3
+#define STGFMT_ANY              4
+#define STGFMT_DOCFILE          5
+
+// This is a legacy define to allow old component to builds
+#define STGFMT_DOCUMENT         0
@@ -3,7 +3,7 @@

 #define RPC_RESPONSE_TYPE_BIND_OK 1
 #define RPC_RESPONSE_TYPE_FAIL 2
-#define RPC_RESPONSE_TYPE_SUCESS 3
+#define RPC_RESPONSE_TYPE_SUCCESS 3

 #define BIND_IF_SYNTAX_NDR32 1
 #define BIND_IF_SYNTAX_NDR64 2
@@ -0,0 +1,88 @@
+#define PRODUCT_UNDEFINED                           0x00000000
+
+#define PRODUCT_ULTIMATE                            0x00000001
+#define PRODUCT_HOME_BASIC                          0x00000002
+#define PRODUCT_HOME_PREMIUM                        0x00000003
+#define PRODUCT_ENTERPRISE                          0x00000004
+#define PRODUCT_HOME_BASIC_N                        0x00000005
+#define PRODUCT_BUSINESS                            0x00000006
+#define PRODUCT_STANDARD_SERVER                     0x00000007
+#define PRODUCT_DATACENTER_SERVER                   0x00000008
+#define PRODUCT_SMALLBUSINESS_SERVER                0x00000009
+#define PRODUCT_ENTERPRISE_SERVER                   0x0000000A
+#define PRODUCT_STARTER                             0x0000000B
+#define PRODUCT_DATACENTER_SERVER_CORE              0x0000000C
+#define PRODUCT_STANDARD_SERVER_CORE                0x0000000D
+#define PRODUCT_ENTERPRISE_SERVER_CORE              0x0000000E
+#define PRODUCT_ENTERPRISE_SERVER_IA64              0x0000000F
+#define PRODUCT_BUSINESS_N                          0x00000010
+#define PRODUCT_WEB_SERVER                          0x00000011
+#define PRODUCT_CLUSTER_SERVER                      0x00000012
+#define PRODUCT_HOME_SERVER                         0x00000013
+#define PRODUCT_STORAGE_EXPRESS_SERVER              0x00000014
+#define PRODUCT_STORAGE_STANDARD_SERVER             0x00000015
+#define PRODUCT_STORAGE_WORKGROUP_SERVER            0x00000016
+#define PRODUCT_STORAGE_ENTERPRISE_SERVER           0x00000017
+#define PRODUCT_SERVER_FOR_SMALLBUSINESS            0x00000018
+#define PRODUCT_SMALLBUSINESS_SERVER_PREMIUM        0x00000019
+#define PRODUCT_HOME_PREMIUM_N                      0x0000001A
+#define PRODUCT_ENTERPRISE_N                        0x0000001B
+#define PRODUCT_ULTIMATE_N                          0x0000001C
+#define PRODUCT_WEB_SERVER_CORE                     0x0000001D
+#define PRODUCT_MEDIUMBUSINESS_SERVER_MANAGEMENT    0x0000001E
+#define PRODUCT_MEDIUMBUSINESS_SERVER_SECURITY      0x0000001F
+#define PRODUCT_MEDIUMBUSINESS_SERVER_MESSAGING     0x00000020
+#define PRODUCT_SERVER_FOUNDATION                   0x00000021
+#define PRODUCT_HOME_PREMIUM_SERVER                 0x00000022
+#define PRODUCT_SERVER_FOR_SMALLBUSINESS_V          0x00000023
+#define PRODUCT_STANDARD_SERVER_V                   0x00000024
+#define PRODUCT_DATACENTER_SERVER_V                 0x00000025
+#define PRODUCT_ENTERPRISE_SERVER_V                 0x00000026
+#define PRODUCT_DATACENTER_SERVER_CORE_V            0x00000027
+#define PRODUCT_STANDARD_SERVER_CORE_V              0x00000028
+#define PRODUCT_ENTERPRISE_SERVER_CORE_V            0x00000029
+#define PRODUCT_HYPERV                              0x0000002A
+#define PRODUCT_STORAGE_EXPRESS_SERVER_CORE         0x0000002B
+#define PRODUCT_STORAGE_STANDARD_SERVER_CORE        0x0000002C
+#define PRODUCT_STORAGE_WORKGROUP_SERVER_CORE       0x0000002D
+#define PRODUCT_STORAGE_ENTERPRISE_SERVER_CORE      0x0000002E
+#define PRODUCT_STARTER_N                           0x0000002F
+#define PRODUCT_PROFESSIONAL                        0x00000030
+#define PRODUCT_PROFESSIONAL_N                      0x00000031
+#define PRODUCT_SB_SOLUTION_SERVER                  0x00000032
+#define PRODUCT_SERVER_FOR_SB_SOLUTIONS             0x00000033
+#define PRODUCT_STANDARD_SERVER_SOLUTIONS           0x00000034
+#define PRODUCT_STANDARD_SERVER_SOLUTIONS_CORE      0x00000035
+#define PRODUCT_SB_SOLUTION_SERVER_EM               0x00000036
+#define PRODUCT_SERVER_FOR_SB_SOLUTIONS_EM          0x00000037
+#define PRODUCT_SOLUTION_EMBEDDEDSERVER             0x00000038
+#define PRODUCT_SOLUTION_EMBEDDEDSERVER_CORE        0x00000039
+#define PRODUCT_SMALLBUSINESS_SERVER_PREMIUM_CORE   0x0000003F
+#define PRODUCT_ESSENTIALBUSINESS_SERVER_MGMT       0x0000003B
+#define PRODUCT_ESSENTIALBUSINESS_SERVER_ADDL       0x0000003C
+#define PRODUCT_ESSENTIALBUSINESS_SERVER_MGMTSVC    0x0000003D
+#define PRODUCT_ESSENTIALBUSINESS_SERVER_ADDLSVC    0x0000003E
+#define PRODUCT_CLUSTER_SERVER_V                    0x00000040
+#define PRODUCT_EMBEDDED                            0x00000041
+#define PRODUCT_STARTER_E                           0x00000042
+#define PRODUCT_HOME_BASIC_E                        0x00000043
+#define PRODUCT_HOME_PREMIUM_E                      0x00000044
+#define PRODUCT_PROFESSIONAL_E                      0x00000045
+#define PRODUCT_ENTERPRISE_E                        0x00000046
+#define PRODUCT_ULTIMATE_E                          0x00000047
+#define PRODUCT_ENTERPRISE_EVALUATION                   0x00000048
+#define PRODUCT_MULTIPOINT_STANDARD_SERVER              0x0000004C
+#define PRODUCT_MULTIPOINT_PREMIUM_SERVER               0x0000004D
+#define PRODUCT_STANDARD_EVALUATION_SERVER              0x0000004F
+#define PRODUCT_DATACENTER_EVALUATION_SERVER            0x00000050
+#define PRODUCT_ENTERPRISE_N_EVALUATION                 0x00000054
+#define PRODUCT_STORAGE_WORKGROUP_EVALUATION_SERVER     0x0000005F
+#define PRODUCT_STORAGE_STANDARD_EVALUATION_SERVER      0x00000060
+#define PRODUCT_CORE_ARM                                0x00000061
+#define PRODUCT_CORE_N                                  0x00000062
+#define PRODUCT_CORE_COUNTRYSPECIFIC                    0x00000063
+#define PRODUCT_CORE_LANGUAGESPECIFIC                   0x00000064
+#define PRODUCT_CORE                                    0x00000065
+#define PRODUCT_PROFESSIONAL_WMC                        0x00000067
+
+#define PRODUCT_UNLICENSED                          0xABCDABCD
@@ -0,0 +1,34 @@
+#define PIPE_ACCESS_INBOUND         0x00000001
+#define PIPE_ACCESS_OUTBOUND        0x00000002
+#define PIPE_ACCESS_DUPLEX          0x00000003
+
+//
+// Define the Named Pipe End flags for GetNamedPipeInfo
+//
+
+#define PIPE_CLIENT_END             0x00000000
+#define PIPE_SERVER_END             0x00000001
+
+//
+// Define the dwPipeMode values for CreateNamedPipe
+//
+
+#define PIPE_WAIT                   0x00000000
+#define PIPE_NOWAIT                 0x00000001
+#define PIPE_READMODE_BYTE          0x00000000
+#define PIPE_READMODE_MESSAGE       0x00000002
+#define PIPE_TYPE_BYTE              0x00000000
+#define PIPE_TYPE_MESSAGE           0x00000004
+#define PIPE_ACCEPT_REMOTE_CLIENTS  0x00000000
+#define PIPE_REJECT_REMOTE_CLIENTS  0x00000008
+
+//
+// Define the well known values for CreateNamedPipe nMaxInstances
+//
+
+#define PIPE_UNLIMITED_INSTANCES    255
+
+
+#define NMPWAIT_WAIT_FOREVER            0xffffffff
+#define NMPWAIT_NOWAIT                  0x00000001
+#define NMPWAIT_USE_DEFAULT_WAIT        0x00000000
@@ -0,0 +1,120 @@
+#define ACCESS_MIN_MS_ACE_TYPE                  (0x0)
+#define ACCESS_ALLOWED_ACE_TYPE                 (0x0)
+#define ACCESS_DENIED_ACE_TYPE                  (0x1)
+#define SYSTEM_AUDIT_ACE_TYPE                   (0x2)
+#define SYSTEM_ALARM_ACE_TYPE                   (0x3)
+#define ACCESS_MAX_MS_V2_ACE_TYPE               (0x3)
+#define ACCESS_ALLOWED_COMPOUND_ACE_TYPE        (0x4)
+#define ACCESS_MAX_MS_V3_ACE_TYPE               (0x4)
+#define ACCESS_MIN_MS_OBJECT_ACE_TYPE           (0x5)
+#define ACCESS_ALLOWED_OBJECT_ACE_TYPE          (0x5)
+#define ACCESS_DENIED_OBJECT_ACE_TYPE           (0x6)
+#define SYSTEM_AUDIT_OBJECT_ACE_TYPE            (0x7)
+#define SYSTEM_ALARM_OBJECT_ACE_TYPE            (0x8)
+#define ACCESS_MAX_MS_OBJECT_ACE_TYPE           (0x8)
+#define ACCESS_MAX_MS_V4_ACE_TYPE               (0x8)
+#define ACCESS_MAX_MS_ACE_TYPE                  (0x8)
+#define ACCESS_ALLOWED_CALLBACK_ACE_TYPE        (0x9)
+#define ACCESS_DENIED_CALLBACK_ACE_TYPE         (0xA)
+#define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE (0xB)
+#define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE  (0xC)
+#define SYSTEM_AUDIT_CALLBACK_ACE_TYPE          (0xD)
+#define SYSTEM_ALARM_CALLBACK_ACE_TYPE          (0xE)
+#define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE   (0xF)
+#define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE   (0x10)
+#define SYSTEM_MANDATORY_LABEL_ACE_TYPE         (0x11)
+#define ACCESS_MAX_MS_V5_ACE_TYPE               (0x11)
+#define SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE      (0x12)
+#define SYSTEM_SCOPED_POLICY_ID_ACE_TYPE        (0x13)
+#define SYSTEM_PROCESS_TRUST_LABEL_ACE_TYPE     (0x14)
+#define ACCESS_MAX_MS_V5_ACE_TYPE               (0x14)
+
+#define SEC_WINNT_AUTH_IDENTITY_ANSI        0x1
+#define SEC_WINNT_AUTH_IDENTITY_UNICODE     0x2
+
+#define SE_OWNER_DEFAULTED      0x00000001
+#define SE_GROUP_DEFAULTED      0x00000002
+#define SE_DACL_PRESENT         0x00000004
+#define SE_DACL_DEFAULTED       0x00000008
+#define SE_SACL_PRESENT         0x00000010
+#define SE_SACL_DEFAULTED       0x00000020
+#define SE_DACL_AUTO_INHERIT_REQ    0x00000100
+#define SE_SACL_AUTO_INHERIT_REQ    0x00000200
+#define SE_DACL_AUTO_INHERITED      0x00000400
+#define SE_SACL_AUTO_INHERITED      0x00000800
+#define SE_DACL_PROTECTED       0x00001000
+#define SE_SACL_PROTECTED       0x00002000
+#define SE_RM_CONTROL_VALID     0x00004000
+#define SE_SELF_RELATIVE        0x00008000
+
+#define SDDL_REVISION_1 0x1
+
+
+#define ACE_OBJECT_TYPE_PRESENT           0x1
+#define ACE_INHERITED_OBJECT_TYPE_PRESENT 0x2
+
+
+#define OBJECT_INHERIT_ACE                (0x1)
+#define CONTAINER_INHERIT_ACE             (0x2)
+#define NO_PROPAGATE_INHERIT_ACE          (0x4)
+#define INHERIT_ONLY_ACE                  (0x8)
+#define INHERITED_ACE                     (0x10)
+#define VALID_INHERIT_FLAGS               (0x1F)
+#define SUCCESSFUL_ACCESS_ACE_FLAG        (0x40)
+#define FAILED_ACCESS_ACE_FLAG            (0x80)
+
+
+#define SYSTEM_MANDATORY_LABEL_NO_WRITE_UP      0x1
+#define SYSTEM_MANDATORY_LABEL_NO_READ_UP       0x2
+#define SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP    0x4
+
+#define SYSTEM_PROCESS_TRUST_LABEL_VALID_MASK      0x00ffffff
+#define SYSTEM_PROCESS_TRUST_NOCONSTRAINT_MASK     0xffffffff
+
+
+#define CLAIM_SECURITY_ATTRIBUTE_TYPE_INVALID   0x00
+#define CLAIM_SECURITY_ATTRIBUTE_TYPE_INT64     0x01
+#define CLAIM_SECURITY_ATTRIBUTE_TYPE_UINT64    0x02
+#define CLAIM_SECURITY_ATTRIBUTE_TYPE_STRING    0x03
+#define CLAIM_SECURITY_ATTRIBUTE_TYPE_FQBN      0x04
+#define CLAIM_SECURITY_ATTRIBUTE_TYPE_SID       0x05
+#define CLAIM_SECURITY_ATTRIBUTE_TYPE_BOOLEAN   0x06
+#define CLAIM_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING  0x10
+
+
+
+#define SE_GROUP_MANDATORY                 (0x00000001L)
+#define SE_GROUP_ENABLED_BY_DEFAULT        (0x00000002L)
+#define SE_GROUP_ENABLED                   (0x00000004L)
+#define SE_GROUP_OWNER                     (0x00000008L)
+#define SE_GROUP_USE_FOR_DENY_ONLY         (0x00000010L)
+#define SE_GROUP_INTEGRITY                 (0x00000020L)
+#define SE_GROUP_INTEGRITY_ENABLED         (0x00000040L)
+#define SE_GROUP_LOGON_ID                  (0xC0000000L)
+#define SE_GROUP_RESOURCE                  (0x20000000L)
+
+#define SE_GROUP_VALID_ATTRIBUTES          (SE_GROUP_MANDATORY          | \
+                                            SE_GROUP_ENABLED_BY_DEFAULT | \
+                                            SE_GROUP_ENABLED            | \
+                                            SE_GROUP_OWNER              | \
+                                            SE_GROUP_USE_FOR_DENY_ONLY  | \
+                                            SE_GROUP_LOGON_ID           | \
+                                            SE_GROUP_RESOURCE           | \
+                                            SE_GROUP_INTEGRITY          | \
+                                            SE_GROUP_INTEGRITY_ENABLED)
+
+
+#define OWNER_SECURITY_INFORMATION       (0x00000001L)
+#define GROUP_SECURITY_INFORMATION       (0x00000002L)
+#define DACL_SECURITY_INFORMATION        (0x00000004L)
+#define SACL_SECURITY_INFORMATION        (0x00000008L)
+#define LABEL_SECURITY_INFORMATION       (0x00000010L)
+#define ATTRIBUTE_SECURITY_INFORMATION   (0x00000020L)
+#define SCOPE_SECURITY_INFORMATION       (0x00000040L)
+#define PROCESS_TRUST_LABEL_SECURITY_INFORMATION (0x00000080L)
+#define BACKUP_SECURITY_INFORMATION      (0x00010000L)
+
+#define PROTECTED_DACL_SECURITY_INFORMATION     (0x80000000L)
+#define PROTECTED_SACL_SECURITY_INFORMATION     (0x40000000L)
+#define UNPROTECTED_DACL_SECURITY_INFORMATION   (0x20000000L)
+#define UNPROTECTED_SACL_SECURITY_INFORMATION   (0x10000000L)
@@ -0,0 +1,20 @@
+//
+// Service trigger types
+//
+#define SERVICE_TRIGGER_TYPE_DEVICE_INTERFACE_ARRIVAL               1
+#define SERVICE_TRIGGER_TYPE_IP_ADDRESS_AVAILABILITY                2
+#define SERVICE_TRIGGER_TYPE_DOMAIN_JOIN                            3
+#define SERVICE_TRIGGER_TYPE_FIREWALL_PORT_EVENT                    4
+#define SERVICE_TRIGGER_TYPE_GROUP_POLICY                           5
+#define SERVICE_TRIGGER_TYPE_NETWORK_ENDPOINT                       6
+#define SERVICE_TRIGGER_TYPE_CUSTOM_SYSTEM_STATE_CHANGE             7
+#define SERVICE_TRIGGER_TYPE_CUSTOM                                 20
+
+//
+// Service trigger data types
+//
+#define SERVICE_TRIGGER_DATA_TYPE_BINARY                            1
+#define SERVICE_TRIGGER_DATA_TYPE_STRING                            2
+#define SERVICE_TRIGGER_DATA_TYPE_LEVEL                             3
+#define SERVICE_TRIGGER_DATA_TYPE_KEYWORD_ANY                       4
+#define SERVICE_TRIGGER_DATA_TYPE_KEYWORD_ALL                       5
@@ -0,0 +1,40 @@
+// Returns TRUE/FALSE depending on question
+#define OS_WINDOWS                  0           // Windows 9x vs. NT
+#define OS_NT                       1           // Windows 9x vs. NT
+#define OS_WIN95ORGREATER           2           // Win95 or greater
+#define OS_NT4ORGREATER             3           // NT4 or greater
+#define OS_WIN98ORGREATER           5           // Win98 or greater
+#define OS_WIN98_GOLD               6           // Win98 Gold (Version 4.10 build 1998)
+#define OS_WIN2000ORGREATER         7           // Some derivative of Win2000
+
+// NOTE: these flags check explicitly for (dwMajorVersion == 5)
+#define OS_WIN2000PRO               8           // Windows 2000 Professional (Workstation)
+#define OS_WIN2000SERVER            9           // Windows 2000 Server
+#define OS_WIN2000ADVSERVER         10          // Windows 2000 Advanced Server
+#define OS_WIN2000DATACENTER        11          // Windows 2000 Data Center Server
+#define OS_WIN2000TERMINAL          12          // Windows 2000 Terminal Server in "Application Server" mode (now simply called "Terminal Server")
+
+#define OS_EMBEDDED                 13          // Embedded Windows Edition
+#define OS_TERMINALCLIENT           14          // Windows Terminal Client (eg user is comming in via tsclient)
+#define OS_TERMINALREMOTEADMIN      15          // Terminal Server in "Remote Administration" mode
+#define OS_WIN95_GOLD               16          // Windows 95 Gold (Version 4.0 Build 1995)
+#define OS_MEORGREATER              17          // Windows Millennium (Version 5.0)
+#define OS_XPORGREATER              18          // Windows XP or greater
+#define OS_HOME                     19          // Home Edition (eg NOT Professional, Server, Advanced Server, or Datacenter)
+#define OS_PROFESSIONAL             20          // Professional     (aka Workstation; eg NOT Server, Advanced Server, or Datacenter)
+#define OS_DATACENTER               21          // Datacenter       (eg NOT Server, Advanced Server, Professional, or Personal)
+#define OS_ADVSERVER                22          // Advanced Server  (eg NOT Datacenter, Server, Professional, or Personal)
+#define OS_SERVER                   23          // Server           (eg NOT Datacenter, Advanced Server, Professional, or Personal)
+#define OS_TERMINALSERVER           24          // Terminal Server - server running in what used to be called "Application Server" mode (now simply called "Terminal Server")
+#define OS_PERSONALTERMINALSERVER   25          // Personal Terminal Server - per/pro machine running in single user TS mode
+#define OS_FASTUSERSWITCHING        26          // Fast User Switching
+#define OS_WELCOMELOGONUI           27          // New friendly logon UI
+#define OS_DOMAINMEMBER             28          // Is this machine a member of a domain (eg NOT a workgroup)
+#define OS_ANYSERVER                29          // is this machine any type of server? (eg datacenter or advanced server or server)?
+#define OS_WOW6432                  30          // Is this process a 32-bit process running on an 64-bit platform?
+#define OS_WEBSERVER                31          // Web Edition Server
+#define OS_SMALLBUSINESSSERVER      32          // SBS Server
+#define OS_TABLETPC                 33          // Are we running on a TabletPC?
+#define OS_SERVERADMINUI            34          // Should defaults lean towards those preferred by server administrators?
+#define OS_MEDIACENTER              35          // eHome Freestyle Project
+#define OS_APPLIANCE                36          // Windows .NET Appliance Server
@@ -0,0 +1,259 @@
+//
+// AccessSystemAcl access type
+//
+
+#define ACCESS_SYSTEM_SECURITY           (0x01000000L)
+
+//
+// MaximumAllowed access type
+//
+
+#define MAXIMUM_ALLOWED                  (0x02000000L)
+
+//
+// Define access rights to files and directories
+//
+
+#define FILE_READ_DATA            ( 0x0001 )    // file & pipe
+#define FILE_LIST_DIRECTORY       ( 0x0001 )    // directory
+#define FILE_WRITE_DATA           ( 0x0002 )    // file & pipe
+#define FILE_ADD_FILE             ( 0x0002 )    // directory
+#define FILE_APPEND_DATA          ( 0x0004 )    // file
+#define FILE_ADD_SUBDIRECTORY     ( 0x0004 )    // directory
+#define FILE_CREATE_PIPE_INSTANCE ( 0x0004 )    // named pipe
+#define FILE_READ_EA              ( 0x0008 )    // file & directory
+#define FILE_WRITE_EA             ( 0x0010 )    // file & directory
+#define FILE_EXECUTE              ( 0x0020 )    // file
+#define FILE_TRAVERSE             ( 0x0020 )    // directory
+#define FILE_DELETE_CHILD         ( 0x0040 )    // directory
+#define FILE_READ_ATTRIBUTES      ( 0x0080 )    // all
+#define FILE_WRITE_ATTRIBUTES     ( 0x0100 )    // all
+
+#define FILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1FF)
+
+#define FILE_GENERIC_READ         (STANDARD_RIGHTS_READ     |\
+                                   FILE_READ_DATA           |\
+                                   FILE_READ_ATTRIBUTES     |\
+                                   FILE_READ_EA             |\
+                                   SYNCHRONIZE)
+
+
+#define FILE_GENERIC_WRITE        (STANDARD_RIGHTS_WRITE    |\
+                                   FILE_WRITE_DATA          |\
+                                   FILE_WRITE_ATTRIBUTES    |\
+                                   FILE_WRITE_EA            |\
+                                   FILE_APPEND_DATA         |\
+                                   SYNCHRONIZE)
+
+
+#define FILE_GENERIC_EXECUTE      (STANDARD_RIGHTS_EXECUTE  |\
+                                   FILE_READ_ATTRIBUTES     |\
+                                   FILE_EXECUTE             |\
+                                   SYNCHRONIZE)
+
+
+
+//
+// Callback Specific Access Rights.
+//
+
+#define CALLBACK_MODIFY_STATE    0x0001
+
+#define CALLBACK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\
+                             CALLBACK_MODIFY_STATE )
+
+
+// Event Specific Access Rights.
+//
+
+#define EVENT_QUERY_STATE       0x0001
+#define EVENT_MODIFY_STATE      0x0002  // winnt
+#define EVENT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) // winnt
+
+
+//
+// Mutant Specific Access Rights.
+//
+// begin_winnt
+
+#define MUTANT_QUERY_STATE      0x0001
+
+#define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\
+                          MUTANT_QUERY_STATE)
+
+
+//
+// Semaphore Specific Access Rights.
+//
+
+#define SEMAPHORE_QUERY_STATE       0x0001
+#define SEMAPHORE_MODIFY_STATE      0x0002  // winnt
+
+#define SEMAPHORE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) // winnt
+
+
+// Timer Specific Access Rights.
+//
+
+#define TIMER_QUERY_STATE       0x0001
+#define TIMER_MODIFY_STATE      0x0002
+
+#define TIMER_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\
+                          TIMER_QUERY_STATE|TIMER_MODIFY_STATE)
+
+// I/O Completion Specific Access Rights.
+//
+
+#define IO_COMPLETION_QUERY_STATE   0x0001
+#define IO_COMPLETION_MODIFY_STATE  0x0002  // winnt
+#define IO_COMPLETION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) // winnt
+
+
+//
+// Connection Port Type Specific Access Rights.
+//
+
+#define PORT_CONNECT (0x0001)
+
+#define PORT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
+                         SYNCHRONIZE | 0x1)
+
+
+//
+// Object Manager Object Type Specific Access Rights.
+//
+
+#define OBJECT_TYPE_CREATE (0x0001)
+
+#define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
+
+//
+// Object Manager Directory Specific Access Rights.
+//
+
+#define DIRECTORY_QUERY                 (0x0001)
+#define DIRECTORY_TRAVERSE              (0x0002)
+#define DIRECTORY_CREATE_OBJECT         (0x0004)
+#define DIRECTORY_CREATE_SUBDIRECTORY   (0x0008)
+
+#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)
+
+
+//
+// Object Manager Symbolic Link Specific Access Rights.
+//
+
+#define SYMBOLIC_LINK_QUERY (0x0001)
+#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
+
+
+//
+// Process Specific Access Rights
+//
+
+#define PROCESS_TERMINATE                  (0x0001)
+#define PROCESS_CREATE_THREAD              (0x0002)
+#define PROCESS_SET_SESSIONID              (0x0004)
+#define PROCESS_VM_OPERATION               (0x0008)
+#define PROCESS_VM_READ                    (0x0010)
+#define PROCESS_VM_WRITE                   (0x0020)
+#define PROCESS_DUP_HANDLE                 (0x0040)
+#define PROCESS_CREATE_PROCESS             (0x0080)
+#define PROCESS_SET_QUOTA                  (0x0100)
+#define PROCESS_SET_INFORMATION            (0x0200)
+#define PROCESS_QUERY_INFORMATION          (0x0400)
+#define PROCESS_SUSPEND_RESUME             (0x0800)
+#define PROCESS_QUERY_LIMITED_INFORMATION  (0x1000)
+#define PROCESS_SET_LIMITED_INFORMATION    (0x2000)
+
+
+#define PROCESS_ALL_ACCESS        (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \
+                                   0xFFF)
+
+
+//
+// Thread Specific Access Rights
+//
+
+#define THREAD_TERMINATE                 (0x0001)
+#define THREAD_SUSPEND_RESUME            (0x0002)
+#define THREAD_GET_CONTEXT               (0x0008)
+#define THREAD_SET_CONTEXT               (0x0010)
+#define THREAD_QUERY_INFORMATION         (0x0040)
+#define THREAD_SET_INFORMATION           (0x0020)
+#define THREAD_SET_THREAD_TOKEN          (0x0080)
+#define THREAD_IMPERSONATE               (0x0100)
+#define THREAD_DIRECT_IMPERSONATION      (0x0200)
+
+#define THREAD_ALL_ACCESS  0x001F03FF
+
+//
+// Job Object Specific Access Rights
+//
+
+// begin_winnt
+#define JOB_OBJECT_ASSIGN_PROCESS           (0x0001)
+#define JOB_OBJECT_SET_ATTRIBUTES           (0x0002)
+#define JOB_OBJECT_QUERY                    (0x0004)
+#define JOB_OBJECT_TERMINATE                (0x0008)
+#define JOB_OBJECT_SET_SECURITY_ATTRIBUTES  (0x0010)
+#define JOB_OBJECT_ALL_ACCESS       (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \
+                                        0x1F )
+
+
+//
+// Registry Specific Access Rights.
+//
+
+#define KEY_QUERY_VALUE         (0x0001)
+#define KEY_SET_VALUE           (0x0002)
+#define KEY_CREATE_SUB_KEY      (0x0004)
+#define KEY_ENUMERATE_SUB_KEYS  (0x0008)
+#define KEY_NOTIFY              (0x0010)
+#define KEY_CREATE_LINK         (0x0020)
+#define KEY_WOW64_32KEY         (0x0200)
+#define KEY_WOW64_64KEY         (0x0100)
+#define KEY_WOW64_RES           (0x0300)
+
+
+#define KEY_READ                ((STANDARD_RIGHTS_READ|KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY)&(~SYNCHRONIZE))
+#define KEY_WRITE               ((STANDARD_RIGHTS_WRITE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY)&(~SYNCHRONIZE))
+#define KEY_EXECUTE             ((KEY_READ)&(~SYNCHRONIZE))
+#define KEY_ALL_ACCESS          ((STANDARD_RIGHTS_ALL|KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK)&(~SYNCHRONIZE))
+
+
+
+//
+// Token Specific Access Rights.
+////  Documentation purpose only real define are in token.txt
+// #define TOKEN_ASSIGN_PRIMARY    (0x0001)
+// #define TOKEN_DUPLICATE         (0x0002)
+// #define TOKEN_IMPERSONATE       (0x0004)
+// #define TOKEN_QUERY             (0x0008)
+// #define TOKEN_QUERY_SOURCE      (0x0010)
+// #define TOKEN_ADJUST_PRIVILEGES (0x0020)
+// #define TOKEN_ADJUST_GROUPS     (0x0040)
+// #define TOKEN_ADJUST_DEFAULT    (0x0080)
+// #define TOKEN_ADJUST_SESSIONID  (0x0100)
+
+
+//
+// Cluster API Specific Access Rights
+//
+#define CLUSAPI_READ_ACCESS     0x00000001L
+#define CLUSAPI_CHANGE_ACCESS   0x00000002L
+#define CLUSAPI_NO_ACCESS       0x00000004L
+#define CLUSAPI_ALL_ACCESS (CLUSAPI_READ_ACCESS | CLUSAPI_CHANGE_ACCESS)
+
+
+//
+// Fax Specific Access Rights
+//
+
+#define FAX_JOB_SUBMIT          (0x0001)
+#define FAX_JOB_QUERY           (0x0002)
+#define FAX_CONFIG_QUERY        (0x0004)
+#define FAX_CONFIG_SET          (0x0008)
+#define FAX_PORT_QUERY          (0x0010)
+#define FAX_PORT_SET            (0x0020)
+#define FAX_JOB_MANAGE          (0x0040)
@@ -0,0 +1,7 @@
+import platform
+from flag import make_flag
+
+bits = platform.architecture()[0]
+bitness =  int(bits[:2])
+
+NATIVE_WORD_MAX_VALUE = 0xffffffff if bitness == 32 else 0xffffffffffffffff
@@ -0,0 +1,100 @@
+#define TOKEN_SOURCE_LENGTH 8
+#define SID_HASH_SIZE 32
+
+#define TOKEN_MANDATORY_POLICY_OFF             0x0
+#define TOKEN_MANDATORY_POLICY_NO_WRITE_UP     0x1
+#define TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN 0x2
+
+#define TOKEN_MANDATORY_POLICY_VALID_MASK      (TOKEN_MANDATORY_POLICY_NO_WRITE_UP | \
+                                                TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN)
+
+/* from ntseapi.h
+ * https://github.com/PKRoma/ProcessHacker/blob/8cd2217e9ff2170096d85b0fdafd5f1e1a8c925f/phnt/include/ntseapi.h
+ */
+
+#define TOKEN_SECURITY_ATTRIBUTE_TYPE_INVALID 0x00
+#define TOKEN_SECURITY_ATTRIBUTE_TYPE_INT64 0x01
+#define TOKEN_SECURITY_ATTRIBUTE_TYPE_UINT64 0x02
+#define TOKEN_SECURITY_ATTRIBUTE_TYPE_STRING 0x03
+#define TOKEN_SECURITY_ATTRIBUTE_TYPE_FQBN 0x04
+#define TOKEN_SECURITY_ATTRIBUTE_TYPE_SID 0x05
+#define TOKEN_SECURITY_ATTRIBUTE_TYPE_BOOLEAN 0x06
+#define TOKEN_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING 0x10
+
+// Flags
+
+#define TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE 0x0001
+#define TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE 0x0002
+#define TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY 0x0004
+#define TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT 0x0008
+#define TOKEN_SECURITY_ATTRIBUTE_DISABLED 0x0010
+#define TOKEN_SECURITY_ATTRIBUTE_MANDATORY 0x0020
+
+#define TOKEN_SECURITY_ATTRIBUTE_VALID_FLAGS ( \
+    TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE | \
+    TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE | \
+    TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY | \
+    TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT | \
+    TOKEN_SECURITY_ATTRIBUTE_DISABLED | \
+    TOKEN_SECURITY_ATTRIBUTE_MANDATORY)
+
+#define TOKEN_SECURITY_ATTRIBUTE_CUSTOM_FLAGS 0xffff0000
+
+#define TOKEN_ASSIGN_PRIMARY    (0x0001)
+#define TOKEN_DUPLICATE         (0x0002)
+#define TOKEN_IMPERSONATE       (0x0004)
+#define TOKEN_QUERY             (0x0008)
+#define TOKEN_QUERY_SOURCE      (0x0010)
+#define TOKEN_ADJUST_PRIVILEGES (0x0020)
+#define TOKEN_ADJUST_GROUPS     (0x0040)
+#define TOKEN_ADJUST_DEFAULT    (0x0080)
+#define TOKEN_ADJUST_SESSIONID  (0x0100)
+
+#define TOKEN_ALL_ACCESS_P (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT)
+
+#define TOKEN_ALL_ACCESS  (TOKEN_ALL_ACCESS_P | TOKEN_ADJUST_SESSIONID )
+
+/* Privileges attributes */
+
+#define SE_PRIVILEGE_ENABLED_BY_DEFAULT (0x00000001L)
+#define SE_PRIVILEGE_ENABLED            (0x00000002L)
+#define SE_PRIVILEGE_REMOVED            (0X00000004L)
+#define SE_PRIVILEGE_USED_FOR_ACCESS    (0x80000000L)
+
+/* PRIVILEGES Names*/
+
+#define SE_CREATE_TOKEN_NAME              ("SeCreateTokenPrivilege")
+#define SE_ASSIGNPRIMARYTOKEN_NAME        ("SeAssignPrimaryTokenPrivilege")
+#define SE_LOCK_MEMORY_NAME               ("SeLockMemoryPrivilege")
+#define SE_INCREASE_QUOTA_NAME            ("SeIncreaseQuotaPrivilege")
+#define SE_UNSOLICITED_INPUT_NAME         ("SeUnsolicitedInputPrivilege")
+#define SE_MACHINE_ACCOUNT_NAME           ("SeMachineAccountPrivilege")
+#define SE_TCB_NAME                       ("SeTcbPrivilege")
+#define SE_SECURITY_NAME                  ("SeSecurityPrivilege")
+#define SE_TAKE_OWNERSHIP_NAME            ("SeTakeOwnershipPrivilege")
+#define SE_LOAD_DRIVER_NAME               ("SeLoadDriverPrivilege")
+#define SE_SYSTEM_PROFILE_NAME            ("SeSystemProfilePrivilege")
+#define SE_SYSTEMTIME_NAME                ("SeSystemtimePrivilege")
+#define SE_PROF_SINGLE_PROCESS_NAME       ("SeProfileSingleProcessPrivilege")
+#define SE_INC_BASE_PRIORITY_NAME         ("SeIncreaseBasePriorityPrivilege")
+#define SE_CREATE_PAGEFILE_NAME           ("SeCreatePagefilePrivilege")
+#define SE_CREATE_PERMANENT_NAME          ("SeCreatePermanentPrivilege")
+#define SE_BACKUP_NAME                    ("SeBackupPrivilege")
+#define SE_RESTORE_NAME                   ("SeRestorePrivilege")
+#define SE_SHUTDOWN_NAME                  ("SeShutdownPrivilege")
+#define SE_DEBUG_NAME                     ("SeDebugPrivilege")
+#define SE_AUDIT_NAME                     ("SeAuditPrivilege")
+#define SE_SYSTEM_ENVIRONMENT_NAME        ("SeSystemEnvironmentPrivilege")
+#define SE_CHANGE_NOTIFY_NAME             ("SeChangeNotifyPrivilege")
+#define SE_REMOTE_SHUTDOWN_NAME           ("SeRemoteShutdownPrivilege")
+#define SE_UNDOCK_NAME                    ("SeUndockPrivilege")
+#define SE_SYNC_AGENT_NAME                ("SeSyncAgentPrivilege")
+#define SE_ENABLE_DELEGATION_NAME         ("SeEnableDelegationPrivilege")
+#define SE_MANAGE_VOLUME_NAME             ("SeManageVolumePrivilege")
+#define SE_IMPERSONATE_NAME               ("SeImpersonatePrivilege")
+#define SE_CREATE_GLOBAL_NAME             ("SeCreateGlobalPrivilege")
+#define SE_TRUSTED_CREDMAN_ACCESS_NAME    ("SeTrustedCredManAccessPrivilege")
+#define SE_RELABEL_NAME                   ("SeRelabelPrivilege")
+#define SE_INC_WORKING_SET_NAME           ("SeIncreaseWorkingSetPrivilege")
+#define SE_TIME_ZONE_NAME                 ("SeTimeZonePrivilege")
+#define SE_CREATE_SYMBOLIC_LINK_NAME      ("SeCreateSymbolicLinkPrivilege")
@@ -13,33 +13,8 @@

 #define WARMING_NOT_SAME_FLAG_FOR_WINXP 0

-#define PROCESS_TERMINATE                  (0x0001)
-#define PROCESS_CREATE_THREAD              (0x0002)
-#define PROCESS_SET_SESSIONID              (0x0004)
-#define PROCESS_VM_OPERATION               (0x0008)
-#define PROCESS_VM_READ                    (0x0010)
-#define PROCESS_VM_WRITE                   (0x0020)
-#define PROCESS_DUP_HANDLE                 (0x0040)
-#define PROCESS_CREATE_PROCESS             (0x0080)
-#define PROCESS_SET_QUOTA                  (0x0100)
-#define PROCESS_SET_INFORMATION            (0x0200)
-#define PROCESS_QUERY_INFORMATION          (0x0400)
-#define PROCESS_SUSPEND_RESUME             (0x0800)
-#define PROCESS_QUERY_LIMITED_INFORMATION  (0x1000)
-
-#define THREAD_TERMINATE                 (0x0001)
-#define THREAD_SUSPEND_RESUME            (0x0002)
-#define THREAD_GET_CONTEXT               (0x0008)
-#define THREAD_SET_CONTEXT               (0x0010)
-#define THREAD_QUERY_INFORMATION         (0x0040)
-#define THREAD_SET_INFORMATION           (0x0020)
-#define THREAD_SET_THREAD_TOKEN          (0x0080)
-#define THREAD_IMPERSONATE               (0x0100)
-#define THREAD_DIRECT_IMPERSONATION      (0x0200)


-#define PROCESS_ALL_ACCESS  0x001F0FFF
-#define THREAD_ALL_ACCESS  0x001F03FF


 #define STARTF_USESHOWWINDOW    0x00000001
@@ -222,26 +197,6 @@

 #define SPECIFIC_RIGHTS_ALL              (0x0000FFFFL)

-#define TOKEN_ASSIGN_PRIMARY    (0x0001)
-#define TOKEN_DUPLICATE         (0x0002)
-#define TOKEN_IMPERSONATE       (0x0004)
-#define TOKEN_QUERY             (0x0008)
-#define TOKEN_QUERY_SOURCE      (0x0010)
-#define TOKEN_ADJUST_PRIVILEGES (0x0020)
-#define TOKEN_ADJUST_GROUPS     (0x0040)
-#define TOKEN_ADJUST_DEFAULT    (0x0080)
-#define TOKEN_ADJUST_SESSIONID  (0x0100)
-
-#define TOKEN_ALL_ACCESS_P (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT)
-
-
-#define TOKEN_ALL_ACCESS  (TOKEN_ALL_ACCESS_P | TOKEN_ADJUST_SESSIONID )
-
-#define SE_PRIVILEGE_ENABLED_BY_DEFAULT (0x00000001L)
-#define SE_PRIVILEGE_ENABLED            (0x00000002L)
-#define SE_PRIVILEGE_REMOVED            (0X00000004L)
-#define SE_PRIVILEGE_USED_FOR_ACCESS    (0x80000000L)
-

 #define AF_UNSPEC       0
 #define AF_UNIX         1
@@ -386,21 +341,6 @@
 #define RRF_ZEROONFAILURE      0x20000000


-#define KEY_QUERY_VALUE         (0x0001)
-#define KEY_SET_VALUE           (0x0002)
-#define KEY_CREATE_SUB_KEY      (0x0004)
-#define KEY_ENUMERATE_SUB_KEYS  (0x0008)
-#define KEY_NOTIFY              (0x0010)
-#define KEY_CREATE_LINK         (0x0020)
-#define KEY_WOW64_32KEY         (0x0200)
-#define KEY_WOW64_64KEY         (0x0100)
-#define KEY_WOW64_RES           (0x0300)
-
-
-#define KEY_READ                ((STANDARD_RIGHTS_READ|KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY)&(~SYNCHRONIZE))
-#define KEY_WRITE               ((STANDARD_RIGHTS_WRITE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY)&(~SYNCHRONIZE))
-#define KEY_EXECUTE             ((KEY_READ)&(~SYNCHRONIZE))
-#define KEY_ALL_ACCESS          ((STANDARD_RIGHTS_ALL|KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK)&(~SYNCHRONIZE))

 #define ERROR_NOT_ALL_ASSIGNED           1300

@@ -758,12 +698,6 @@
 #define MAXLEN_IFDESCR 256
 #define MAX_INTERFACE_NAME_LEN 256

-#define DIRECTORY_QUERY                 (0x0001)
-#define DIRECTORY_TRAVERSE              (0x0002)
-#define DIRECTORY_CREATE_OBJECT         (0x0004)
-#define DIRECTORY_CREATE_SUBDIRECTORY   (0x0008)
-
-#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)

 #define OBJ_INHERIT             0x00000002L
 #define OBJ_PERMANENT           0x00000010L
@@ -796,6 +730,7 @@
 #define PERSIST_E_SIZEINDEFINITE         (0x800B000AL)
 #define PERSIST_E_NOTSELFSIZING          (0x800B000BL)
 #define TRUST_E_NOSIGNATURE              (0x800B0100L)
+#define TRUST_E_BAD_DIGEST               (0x80096010L)
 #define CERT_E_EXPIRED                   (0x800B0101L)
 #define CERT_E_VALIDITYPERIODNESTING     (0x800B0102L)
 #define CERT_E_PURPOSE                   (0x800B0106L)
@@ -815,6 +750,17 @@
 #define CERT_E_INVALID_NAME              (0x800B0114L)
 #define CRYPT_E_FILE_ERROR               (0x80092003L)

+#define CRYPT_E_MSG_ERROR                (0x80091001L)
+#define CRYPT_E_UNKNOWN_ALGO             (0x80091002L)
+#define CRYPT_E_OID_FORMAT               (0x80091003L)
+#define CRYPT_E_INVALID_MSG_TYPE         (0x80091004L)
+#define CRYPT_E_UNEXPECTED_ENCODING      (0x80091005L)
+#define CRYPT_E_AUTH_ATTR_MISSING        (0x80091006L)
+#define CRYPT_E_HASH_VALUE               (0x80091007L)
+#define E_INVALIDARG                     (0x80070057L)
+#define CRYPT_E_NOT_DECRYPTED            (0x8009100AL)
+#define CRYPT_E_INVALID_INDEX            (0x80091008L)
+#define CRYPT_E_ATTRIBUTES_MISSING       (0x8009100FL)


 #define IMAGE_SCN_TYPE_REG                   0x00000000
@@ -866,35 +812,6 @@
 #define IMAGE_SCN_MEM_READ                   0x40000000
 #define IMAGE_SCN_MEM_WRITE                  0x80000000

-
-#define ACCESS_MIN_MS_ACE_TYPE                  (0x0)
-#define ACCESS_ALLOWED_ACE_TYPE                 (0x0)
-#define ACCESS_DENIED_ACE_TYPE                  (0x1)
-#define SYSTEM_AUDIT_ACE_TYPE                   (0x2)
-#define SYSTEM_ALARM_ACE_TYPE                   (0x3)
-#define ACCESS_MAX_MS_V2_ACE_TYPE               (0x3)
-#define ACCESS_ALLOWED_COMPOUND_ACE_TYPE        (0x4)
-#define ACCESS_MAX_MS_V3_ACE_TYPE               (0x4)
-#define ACCESS_MIN_MS_OBJECT_ACE_TYPE           (0x5)
-#define ACCESS_ALLOWED_OBJECT_ACE_TYPE          (0x5)
-#define ACCESS_DENIED_OBJECT_ACE_TYPE           (0x6)
-#define SYSTEM_AUDIT_OBJECT_ACE_TYPE            (0x7)
-#define SYSTEM_ALARM_OBJECT_ACE_TYPE            (0x8)
-#define ACCESS_MAX_MS_OBJECT_ACE_TYPE           (0x8)
-#define ACCESS_MAX_MS_V4_ACE_TYPE               (0x8)
-#define ACCESS_MAX_MS_ACE_TYPE                  (0x8)
-#define ACCESS_ALLOWED_CALLBACK_ACE_TYPE        (0x9)
-#define ACCESS_DENIED_CALLBACK_ACE_TYPE         (0xA)
-#define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE (0xB)
-#define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE  (0xC)
-#define SYSTEM_AUDIT_CALLBACK_ACE_TYPE          (0xD)
-#define SYSTEM_ALARM_CALLBACK_ACE_TYPE          (0xE)
-#define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE   (0xF)
-#define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE   (0x10)
-#define SYSTEM_MANDATORY_LABEL_ACE_TYPE         (0x11)
-#define ACCESS_MAX_MS_V5_ACE_TYPE               (0x11)
-
-
 #define LPC_REQUEST 1
 #define LPC_REPLY 2
 #define LPC_DATAGRAM 3
@@ -940,13 +857,97 @@
 #define ALPC_VIEWFLG_NOT_SECURE 0x40000


-#define OWNER_SECURITY_INFORMATION       (0x00000001L)
-#define GROUP_SECURITY_INFORMATION       (0x00000002L)
-#define DACL_SECURITY_INFORMATION        (0x00000004L)
-#define SACL_SECURITY_INFORMATION        (0x00000008L)
-#define LABEL_SECURITY_INFORMATION       (0x00000010L)
-#define MAXIMUM_ALLOWED                  (0x02000000L)
-
 #define CERT_STORE_CERTIFICATE_CONTEXT  1
 #define CERT_STORE_CRL_CONTEXT          2
 #define CERT_STORE_CTL_CONTEXT          3
+
+
+#define WTD_UI_ALL     1
+#define WTD_UI_NONE    2
+#define WTD_UI_NOBAD   3
+#define WTD_UI_NOGOOD  4
+
+#define WTD_REVOKE_NONE         0x00000000
+#define WTD_REVOKE_WHOLECHAIN   0x00000001
+
+#define WTD_CHOICE_FILE     1
+#define WTD_CHOICE_CATALOG  2
+#define WTD_CHOICE_BLOB     3
+#define WTD_CHOICE_SIGNER   4
+#define WTD_CHOICE_CERT     5
+
+#define WTD_STATEACTION_IGNORE            0x00000000
+#define WTD_STATEACTION_VERIFY            0x00000001
+#define WTD_STATEACTION_CLOSE             0x00000002
+#define WTD_STATEACTION_AUTO_CACHE        0x00000003
+#define WTD_STATEACTION_AUTO_CACHE_FLUSH  0x00000004
+
+
+#define COMPRESSION_FORMAT_NONE          (0x0000)
+#define COMPRESSION_FORMAT_DEFAULT       (0x0001)
+#define COMPRESSION_FORMAT_LZNT1         (0x0002)
+#define COMPRESSION_FORMAT_XPRESS        (0x0003)
+#define COMPRESSION_FORMAT_XPRESS_HUFF   (0x0004)
+#define COMPRESSION_ENGINE_STANDARD      (0x0000)
+#define COMPRESSION_ENGINE_MAXIMUM       (0x0100)
+#define COMPRESSION_ENGINE_HIBER         (0x0200)
+
+
+#define FILE_DIRECTORY_FILE                     0x00000001
+#define FILE_WRITE_THROUGH                      0x00000002
+#define FILE_SEQUENTIAL_ONLY                    0x00000004
+#define FILE_NO_INTERMEDIATE_BUFFERING          0x00000008
+#define FILE_SYNCHRONOUS_IO_ALERT               0x00000010
+#define FILE_SYNCHRONOUS_IO_NONALERT            0x00000020
+#define FILE_NON_DIRECTORY_FILE                 0x00000040
+#define FILE_CREATE_TREE_CONNECTION             0x00000080
+#define FILE_COMPLETE_IF_OPLOCKED               0x00000100
+#define FILE_NO_EA_KNOWLEDGE                    0x00000200
+#define FILE_OPEN_REMOTE_INSTANCE               0x00000400
+#define FILE_RANDOM_ACCESS                      0x00000800
+#define FILE_DELETE_ON_CLOSE                    0x00001000
+#define FILE_OPEN_BY_FILE_ID                    0x00002000
+#define FILE_OPEN_FOR_BACKUP_INTENT             0x00004000
+#define FILE_NO_COMPRESSION                     0x00008000
+#define FILE_OPEN_REQUIRING_OPLOCK              0x00010000
+#define FILE_RESERVE_OPFILTER                   0x00100000
+#define FILE_OPEN_REPARSE_POINT                 0x00200000
+#define FILE_OPEN_NO_RECALL                     0x00400000
+#define FILE_OPEN_FOR_FREE_SPACE_QUERY          0x00800000
+
+#define FILE_VALID_OPTION_FLAGS                 0x00ffffff
+#define FILE_VALID_PIPE_OPTION_FLAGS            0x00000032
+#define FILE_VALID_MAILSLOT_OPTION_FLAGS        0x00000032
+#define FILE_VALID_SET_FLAGS                    0x00000036
+
+#define FILE_SUPERSEDED                 0x00000000
+#define FILE_OPENED                     0x00000001
+#define FILE_CREATED                    0x00000002
+#define FILE_OVERWRITTEN                0x00000003
+#define FILE_EXISTS                     0x00000004
+#define FILE_DOES_NOT_EXIST             0x00000005
+
+
+#define API_SET_SCHEMA_VERSION_V2       0x00000002L
+#define API_SET_SCHEMA_VERSION_V3       0x00000003L // No offline support.
+#define API_SET_SCHEMA_VERSION_V4       0x00000004L
+
+#define API_SET_LOAD_SCHEMA_ORDINAL     1
+#define API_SET_LOOKUP_ORDINAL          2
+#define API_SET_RELEASE_SCHEMA_ORDINAL  3
+
+#define API_SET_SCHEMA_FLAGS_SEALED              0x00000001L
+#define API_SET_SCHEMA_FLAGS_HOST_EXTENSION      0x00000002L
+
+#define API_SET_SCHEMA_ENTRY_FLAGS_SEALED        0x00000001L
+#define API_SET_SCHEMA_ENTRY_FLAGS_EXTENSION     0x00000002L
+
+#define CMSG_VERIFY_SIGNER_PUBKEY                   1
+#define CMSG_VERIFY_SIGNER_CERT                     2
+#define CMSG_VERIFY_SIGNER_CHAIN                    3
+#define CMSG_VERIFY_SIGNER_NULL                     4
+
+
+#define TXFS_MINIVERSION_COMMITTED_VIEW                  (0x0000)
+#define TXFS_MINIVERSION_DIRTY_VIEW                      (0xFFFF)
+#define TXFS_MINIVERSION_DEFAULT_VIEW                    (0xFFFE)
@@ -501,4 +501,61 @@
 #define RPC_S_UNKNOWN_IF 1717
 #define RPC_S_PROTOCOL_ERROR 1728
 #define RPC_S_UNSUPPORTED_TRANS_SYN 1730
-#define RPC_S_PROCNUM_OUT_OF_RANGE 1745
+#define RPC_S_PROCNUM_OUT_OF_RANGE 1745
+
+#define ERROR_INVALID_TRANSACTION 6700
+#define ERROR_TRANSACTION_NOT_ACTIVE 6701
+#define ERROR_TRANSACTION_REQUEST_NOT_VALID 6702
+#define ERROR_TRANSACTION_NOT_REQUESTED 6703
+#define ERROR_TRANSACTION_ALREADY_ABORTED 6704
+#define ERROR_TRANSACTION_ALREADY_COMMITTED 6705
+
+// FACILITY_SSPI
+
+#define NTE_BAD_UID                      (0x80090001)
+#define NTE_BAD_HASH                     (0x80090002)
+#define NTE_BAD_KEY                      (0x80090003)
+#define NTE_BAD_LEN                      (0x80090004)
+#define NTE_BAD_DATA                     (0x80090005)
+#define NTE_BAD_SIGNATURE                (0x80090006)
+#define NTE_BAD_VER                      (0x80090007)
+#define NTE_BAD_ALGID                    (0x80090008)
+#define NTE_BAD_FLAGS                    (0x80090009)
+#define NTE_BAD_TYPE                     (0x8009000A)
+#define NTE_BAD_KEY_STATE                (0x8009000B)
+#define NTE_BAD_HASH_STATE               (0x8009000C)
+#define NTE_NO_KEY                       (0x8009000D)
+#define NTE_NO_MEMORY                    (0x8009000E)
+#define NTE_EXISTS                       (0x8009000F)
+#define NTE_PERM                         (0x80090010)
+#define NTE_NOT_FOUND                    (0x80090011)
+#define NTE_DOUBLE_ENCRYPT               (0x80090012)
+#define NTE_BAD_PROVIDER                 (0x80090013)
+#define NTE_BAD_PROV_TYPE                (0x80090014)
+#define NTE_BAD_PUBLIC_KEY               (0x80090015)
+#define NTE_BAD_KEYSET                   (0x80090016)
+#define NTE_PROV_TYPE_NOT_DEF            (0x80090017)
+#define NTE_PROV_TYPE_ENTRY_BAD          (0x80090018)
+#define NTE_KEYSET_NOT_DEF               (0x80090019)
+#define NTE_KEYSET_ENTRY_BAD             (0x8009001A)
+#define NTE_PROV_TYPE_NO_MATCH           (0x8009001B)
+#define NTE_SIGNATURE_FILE_BAD           (0x8009001C)
+#define NTE_PROVIDER_DLL_FAIL            (0x8009001D)
+#define NTE_PROV_DLL_NOT_FOUND           (0x8009001E)
+#define NTE_BAD_KEYSET_PARAM             (0x8009001F)
+#define NTE_FAIL                         (0x80090020)
+#define NTE_SYS_ERR                      (0x80090021)
+#define NTE_SILENT_CONTEXT               (0x80090022)
+#define NTE_TOKEN_KEYSET_STORAGE_FULL    (0x80090023)
+#define NTE_TEMPORARY_PROFILE            (0x80090024)
+#define NTE_FIXEDPARAMETER               (0x80090025)
+#define NTE_INVALID_HANDLE               (0x80090026)
+#define NTE_INVALID_PARAMETER            (0x80090027)
+#define NTE_BUFFER_TOO_SMALL             (0x80090028)
+#define NTE_NOT_SUPPORTED                (0x80090029)
+#define NTE_NO_MORE_ITEMS                (0x8009002A)
+#define NTE_BUFFERS_OVERLAP              (0x8009002B)
+#define NTE_DECRYPTION_FAILURE           (0x8009002C)
+#define NTE_INTERNAL_ERROR               (0x8009002D)
+#define NTE_UI_REQUIRED                  (0x8009002E)
+#define NTE_HMAC_NOT_SUPPORTED           (0x8009002F)
@@ -0,0 +1,365 @@
+#define EVENTLOG_SUCCESS                0x0000
+#define EVENTLOG_ERROR_TYPE             0x0001
+#define EVENTLOG_WARNING_TYPE           0x0002
+#define EVENTLOG_INFORMATION_TYPE       0x0004
+#define EVENTLOG_AUDIT_SUCCESS          0x0008
+#define EVENTLOG_AUDIT_FAILURE          0x0010
+
+
+#define EVENTLOG_SEQUENTIAL_READ        0x0001
+#define EVENTLOG_SEEK_READ              0x0002
+#define EVENTLOG_FORWARDS_READ          0x0004
+#define EVENTLOG_BACKWARDS_READ         0x0008
+
+#define EVT_VARIANT_TYPE_MASK           0x7f
+#define EVT_VARIANT_TYPE_ARRAY          128
+
+
+///////////////////////////////////////////////////
+//                                               //
+//           Start of WinEvt Error codes         //
+//                                               //
+//                 15000 to 15079                //
+///////////////////////////////////////////////////
+
+//
+// MessageId: ERROR_EVT_INVALID_CHANNEL_PATH
+//
+// MessageText:
+//
+// The specified channel path is invalid.
+//
+#define ERROR_EVT_INVALID_CHANNEL_PATH   15000L
+
+//
+// MessageId: ERROR_EVT_INVALID_QUERY
+//
+// MessageText:
+//
+// The specified query is invalid.
+//
+#define ERROR_EVT_INVALID_QUERY          15001L
+
+//
+// MessageId: ERROR_EVT_PUBLISHER_METADATA_NOT_FOUND
+//
+// MessageText:
+//
+// The publisher metadata cannot be found in the resource.
+//
+#define ERROR_EVT_PUBLISHER_METADATA_NOT_FOUND 15002L
+
+//
+// MessageId: ERROR_EVT_EVENT_TEMPLATE_NOT_FOUND
+//
+// MessageText:
+//
+// The template for an event definition cannot be found in the resource (error = %1).
+//
+#define ERROR_EVT_EVENT_TEMPLATE_NOT_FOUND 15003L
+
+//
+// MessageId: ERROR_EVT_INVALID_PUBLISHER_NAME
+//
+// MessageText:
+//
+// The specified publisher name is invalid.
+//
+#define ERROR_EVT_INVALID_PUBLISHER_NAME 15004L
+
+//
+// MessageId: ERROR_EVT_INVALID_EVENT_DATA
+//
+// MessageText:
+//
+// The event data raised by the publisher is not compatible with the event template definition in the publisher's manifest
+//
+#define ERROR_EVT_INVALID_EVENT_DATA     15005L
+
+//
+// MessageId: ERROR_EVT_CHANNEL_NOT_FOUND
+//
+// MessageText:
+//
+// The specified channel could not be found. Check channel configuration.
+//
+#define ERROR_EVT_CHANNEL_NOT_FOUND      15007L
+
+//
+// MessageId: ERROR_EVT_MALFORMED_XML_TEXT
+//
+// MessageText:
+//
+// The specified xml text was not well-formed. See Extended Error for more details.
+//
+#define ERROR_EVT_MALFORMED_XML_TEXT     15008L
+
+//
+// MessageId: ERROR_EVT_SUBSCRIPTION_TO_DIRECT_CHANNEL
+//
+// MessageText:
+//
+// The caller is trying to subscribe to a direct channel which is not allowed. The events for a direct channel go directly to a logfile and cannot be subscribed to.
+//
+#define ERROR_EVT_SUBSCRIPTION_TO_DIRECT_CHANNEL 15009L
+
+//
+// MessageId: ERROR_EVT_CONFIGURATION_ERROR
+//
+// MessageText:
+//
+// Configuration error.
+//
+#define ERROR_EVT_CONFIGURATION_ERROR    15010L
+
+//
+// MessageId: ERROR_EVT_QUERY_RESULT_STALE
+//
+// MessageText:
+//
+// The query result is stale / invalid. This may be due to the log being cleared or rolling over after the query result was created. Users should handle this code by releasing the query result object and reissuing the query.
+//
+#define ERROR_EVT_QUERY_RESULT_STALE     15011L
+
+//
+// MessageId: ERROR_EVT_QUERY_RESULT_INVALID_POSITION
+//
+// MessageText:
+//
+// Query result is currently at an invalid position.
+//
+#define ERROR_EVT_QUERY_RESULT_INVALID_POSITION 15012L
+
+//
+// MessageId: ERROR_EVT_NON_VALIDATING_MSXML
+//
+// MessageText:
+//
+// Registered MSXML doesn't support validation.
+//
+#define ERROR_EVT_NON_VALIDATING_MSXML   15013L
+
+//
+// MessageId: ERROR_EVT_FILTER_ALREADYSCOPED
+//
+// MessageText:
+//
+// An expression can only be followed by a change of scope operation if it itself evaluates to a node set and is not already part of some other change of scope operation.
+//
+#define ERROR_EVT_FILTER_ALREADYSCOPED   15014L
+
+//
+// MessageId: ERROR_EVT_FILTER_NOTELTSET
+//
+// MessageText:
+//
+// Can't perform a step operation from a term that does not represent an element set.
+//
+#define ERROR_EVT_FILTER_NOTELTSET       15015L
+
+//
+// MessageId: ERROR_EVT_FILTER_INVARG
+//
+// MessageText:
+//
+// Left hand side arguments to binary operators must be either attributes, nodes or variables and right hand side arguments must be constants.
+//
+#define ERROR_EVT_FILTER_INVARG          15016L
+
+//
+// MessageId: ERROR_EVT_FILTER_INVTEST
+//
+// MessageText:
+//
+// A step operation must involve either a node test or, in the case of a predicate, an algebraic expression against which to test each node in the node set identified by the preceeding node set can be evaluated.
+//
+#define ERROR_EVT_FILTER_INVTEST         15017L
+
+//
+// MessageId: ERROR_EVT_FILTER_INVTYPE
+//
+// MessageText:
+//
+// This data type is currently unsupported.
+//
+#define ERROR_EVT_FILTER_INVTYPE         15018L
+
+//
+// MessageId: ERROR_EVT_FILTER_PARSEERR
+//
+// MessageText:
+//
+// A syntax error occurred at position %1!d!
+//
+#define ERROR_EVT_FILTER_PARSEERR        15019L
+
+//
+// MessageId: ERROR_EVT_FILTER_UNSUPPORTEDOP
+//
+// MessageText:
+//
+// This operator is unsupported by this implementation of the filter.
+//
+#define ERROR_EVT_FILTER_UNSUPPORTEDOP   15020L
+
+//
+// MessageId: ERROR_EVT_FILTER_UNEXPECTEDTOKEN
+//
+// MessageText:
+//
+// The token encountered was unexpected.
+//
+#define ERROR_EVT_FILTER_UNEXPECTEDTOKEN 15021L
+
+//
+// MessageId: ERROR_EVT_INVALID_OPERATION_OVER_ENABLED_DIRECT_CHANNEL
+//
+// MessageText:
+//
+// The requested operation cannot be performed over an enabled direct channel. The channel must first be disabled before performing the requested operation.
+//
+#define ERROR_EVT_INVALID_OPERATION_OVER_ENABLED_DIRECT_CHANNEL 15022L
+
+//
+// MessageId: ERROR_EVT_INVALID_CHANNEL_PROPERTY_VALUE
+//
+// MessageText:
+//
+// Channel property %1!s! contains invalid value. The value has invalid type, is outside of valid range, can't be updated or is not supported by this type of channel.
+//
+#define ERROR_EVT_INVALID_CHANNEL_PROPERTY_VALUE 15023L
+
+//
+// MessageId: ERROR_EVT_INVALID_PUBLISHER_PROPERTY_VALUE
+//
+// MessageText:
+//
+// Publisher property %1!s! contains invalid value. The value has invalid type, is outside of valid range, can't be updated or is not supported by this type of publisher.
+//
+#define ERROR_EVT_INVALID_PUBLISHER_PROPERTY_VALUE 15024L
+
+//
+// MessageId: ERROR_EVT_CHANNEL_CANNOT_ACTIVATE
+//
+// MessageText:
+//
+// The channel fails to activate.
+//
+#define ERROR_EVT_CHANNEL_CANNOT_ACTIVATE 15025L
+
+//
+// MessageId: ERROR_EVT_FILTER_TOO_COMPLEX
+//
+// MessageText:
+//
+// The xpath expression exceeded supported complexity. Please symplify it or split it into two or more simple expressions.
+//
+#define ERROR_EVT_FILTER_TOO_COMPLEX     15026L
+
+//
+// MessageId: ERROR_EVT_MESSAGE_NOT_FOUND
+//
+// MessageText:
+//
+// the message resource is present but the message is not found in the string/message table
+//
+#define ERROR_EVT_MESSAGE_NOT_FOUND      15027L
+
+//
+// MessageId: ERROR_EVT_MESSAGE_ID_NOT_FOUND
+//
+// MessageText:
+//
+// The message id for the desired message could not be found.
+//
+#define ERROR_EVT_MESSAGE_ID_NOT_FOUND   15028L
+
+//
+// MessageId: ERROR_EVT_UNRESOLVED_VALUE_INSERT
+//
+// MessageText:
+//
+// The substitution string for insert index (%1) could not be found.
+//
+#define ERROR_EVT_UNRESOLVED_VALUE_INSERT 15029L
+
+//
+// MessageId: ERROR_EVT_UNRESOLVED_PARAMETER_INSERT
+//
+// MessageText:
+//
+// The description string for parameter reference (%1) could not be found.
+//
+#define ERROR_EVT_UNRESOLVED_PARAMETER_INSERT 15030L
+
+//
+// MessageId: ERROR_EVT_MAX_INSERTS_REACHED
+//
+// MessageText:
+//
+// The maximum number of replacements has been reached.
+//
+#define ERROR_EVT_MAX_INSERTS_REACHED    15031L
+
+//
+// MessageId: ERROR_EVT_EVENT_DEFINITION_NOT_FOUND
+//
+// MessageText:
+//
+// The event definition could not be found for event id (%1).
+//
+#define ERROR_EVT_EVENT_DEFINITION_NOT_FOUND 15032L
+
+//
+// MessageId: ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND
+//
+// MessageText:
+//
+// The locale specific resource for the desired message is not present.
+//
+#define ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND 15033L
+
+//
+// MessageId: ERROR_EVT_VERSION_TOO_OLD
+//
+// MessageText:
+//
+// The resource is too old to be compatible.
+//
+#define ERROR_EVT_VERSION_TOO_OLD        15034L
+
+//
+// MessageId: ERROR_EVT_VERSION_TOO_NEW
+//
+// MessageText:
+//
+// The resource is too new to be compatible.
+//
+#define ERROR_EVT_VERSION_TOO_NEW        15035L
+
+//
+// MessageId: ERROR_EVT_CANNOT_OPEN_CHANNEL_OF_QUERY
+//
+// MessageText:
+//
+// The channel at index %1!d! of the query can't be opened.
+//
+#define ERROR_EVT_CANNOT_OPEN_CHANNEL_OF_QUERY 15036L
+
+//
+// MessageId: ERROR_EVT_PUBLISHER_DISABLED
+//
+// MessageText:
+//
+// The publisher has been disabled and its resource is not avaiable. This usually occurs when the publisher is in the process of being uninstalled or upgraded.
+//
+#define ERROR_EVT_PUBLISHER_DISABLED     15037L
+
+//
+// MessageId: ERROR_EVT_FILTER_OUT_OF_RANGE
+//
+// MessageText:
+//
+// Attempted to create a numeric type that is outside of its valid range.
+//
+#define ERROR_EVT_FILTER_OUT_OF_RANGE    15038L
@@ -0,0 +1,49 @@
+// A LOT of PE related definition are in windef.txt
+// This refactoring (multiple .txt file) come very late in the dev
+
+#define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA    0x0020  // Image can handle a high entropy 64-bit virtual address space.
+#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040     // DLL can move.
+#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY    0x0080     // Code Integrity Image
+#define IMAGE_DLLCHARACTERISTICS_NX_COMPAT    0x0100     // Image is NX compatible
+#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200     // Image understands isolation and doesn't want it
+#define IMAGE_DLLCHARACTERISTICS_NO_SEH       0x0400     // Image does not use SEH.  No SE handler may reside in this image
+#define IMAGE_DLLCHARACTERISTICS_NO_BIND      0x0800     // Do not bind this image.
+#define IMAGE_DLLCHARACTERISTICS_APPCONTAINER 0x1000     // Image should execute in an AppContainer
+#define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER   0x2000     // Driver uses WDM model
+#define IMAGE_DLLCHARACTERISTICS_GUARD_CF     0x4000     // Image supports Control Flow Guard.
+#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE     0x8000
+
+// Directory Entries
+
+#define IMAGE_DIRECTORY_ENTRY_EXPORT          0   // Export Directory
+#define IMAGE_DIRECTORY_ENTRY_IMPORT          1   // Import Directory
+#define IMAGE_DIRECTORY_ENTRY_RESOURCE        2   // Resource Directory
+#define IMAGE_DIRECTORY_ENTRY_EXCEPTION       3   // Exception Directory
+#define IMAGE_DIRECTORY_ENTRY_SECURITY        4   // Security Directory
+#define IMAGE_DIRECTORY_ENTRY_BASERELOC       5   // Base Relocation Table
+#define IMAGE_DIRECTORY_ENTRY_DEBUG           6   // Debug Directory
+
+#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE    7   // Architecture Specific Data
+#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR       8   // RVA of GP
+#define IMAGE_DIRECTORY_ENTRY_TLS             9   // TLS Directory
+#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG    10   // Load Configuration Directory
+#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   11   // Bound Import Directory in headers
+#define IMAGE_DIRECTORY_ENTRY_IAT            12   // Import Address Table
+#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   13   // Delay Load Import Descriptors
+#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14   // COM Runtime descriptor
+
+//
+// Based relocation types.
+//
+
+#define IMAGE_REL_BASED_ABSOLUTE              0
+#define IMAGE_REL_BASED_HIGH                  1
+#define IMAGE_REL_BASED_LOW                   2
+#define IMAGE_REL_BASED_HIGHLOW               3
+#define IMAGE_REL_BASED_HIGHADJ               4
+#define IMAGE_REL_BASED_MACHINE_SPECIFIC_5    5
+#define IMAGE_REL_BASED_RESERVED              6
+#define IMAGE_REL_BASED_MACHINE_SPECIFIC_7    7
+#define IMAGE_REL_BASED_MACHINE_SPECIFIC_8    8
+#define IMAGE_REL_BASED_MACHINE_SPECIFIC_9    9
+#define IMAGE_REL_BASED_DIR64                 10
@@ -611,7 +611,12 @@

 #define MS_DEF_RSA_SIG_PROV_A   "Microsoft RSA Signature Cryptographic Provider"
 #define MS_DEF_RSA_SIG_PROV_W   u"Microsoft RSA Signature Cryptographic Provider"
-#define MS_DEF_RSA_SIG_PROV   MS_DEF_RSA_SIG_PROV_W
+#define MS_DEF_RSA_SIG_PROV   MS_DEF_RSA_SIG_PROV_A
+
+#define MS_ENH_RSA_AES_PROV_A    "Microsoft Enhanced RSA and AES Cryptographic Provider"
+#define MS_ENH_RSA_AES_PROV_W    u"Microsoft Enhanced RSA and AES Cryptographic Provider"
+#define MS_ENH_RSA_AES_PROV_XP_A "Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)"
+#define MS_ENH_RSA_AES_PROV_XP_W u"Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)"


 #define CERT_STORE_ADD_NEW                                  1
@@ -675,3 +680,62 @@
 #define CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY      (CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY_ID << CERT_SYSTEM_STORE_LOCATION_SHIFT)
 #define CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE      (CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE_ID << CERT_SYSTEM_STORE_LOCATION_SHIFT)

+//+-------------------------------------------------------------------------
+//  Message types
+//--------------------------------------------------------------------------
+#define CMSG_DATA                    1
+#define CMSG_SIGNED                  2
+#define CMSG_ENVELOPED               3
+#define CMSG_SIGNED_AND_ENVELOPED    4
+#define CMSG_HASHED                  5
+#define CMSG_ENCRYPTED               6
+
+//+-------------------------------------------------------------------------
+//  Open dwFlags
+//--------------------------------------------------------------------------
+#define CMSG_BARE_CONTENT_FLAG              0x00000001
+#define CMSG_LENGTH_ONLY_FLAG               0x00000002
+#define CMSG_DETACHED_FLAG                  0x00000004
+#define CMSG_AUTHENTICATED_ATTRIBUTES_FLAG  0x00000008
+#define CMSG_CONTENTS_OCTETS_FLAG           0x00000010
+#define CMSG_MAX_LENGTH_FLAG                0x00000020
+
+// When set, nonData type inner content is encapsulated within an
+// OCTET STRING. Applicable to both Signed and Enveloped messages.
+#define CMSG_CMS_ENCAPSULATED_CONTENT_FLAG  0x00000040
+
+// If set, then, the hCryptProv passed to CryptMsgOpenToEncode or
+// CryptMsgOpenToDecode is released on the final CryptMsgClose.
+// Not released if CryptMsgOpenToEncode or CryptMsgOpenToDecode fails.
+//
+// Also applies to hNCryptKey where applicable.
+//
+// Note, the envelope recipient hCryptProv's aren't released.
+#define CMSG_CRYPT_RELEASE_CONTEXT_FLAG     0x00008000
+
+
+#define CMSG_INDEFINITE_LENGTH       (0xFFFFFFFF)
+
+
+//+-------------------------------------------------------------------------
+//  Message control types
+//--------------------------------------------------------------------------
+#define CMSG_CTRL_VERIFY_SIGNATURE       1
+#define CMSG_CTRL_DECRYPT                2
+#define CMSG_CTRL_VERIFY_HASH            5
+#define CMSG_CTRL_ADD_SIGNER             6
+#define CMSG_CTRL_DEL_SIGNER             7
+#define CMSG_CTRL_ADD_SIGNER_UNAUTH_ATTR 8
+#define CMSG_CTRL_DEL_SIGNER_UNAUTH_ATTR 9
+#define CMSG_CTRL_ADD_CERT               10
+#define CMSG_CTRL_DEL_CERT               11
+#define CMSG_CTRL_ADD_CRL                12
+#define CMSG_CTRL_DEL_CRL                13
+#define CMSG_CTRL_ADD_ATTR_CERT          14
+#define CMSG_CTRL_DEL_ATTR_CERT          15
+#define CMSG_CTRL_KEY_TRANS_DECRYPT      16
+#define CMSG_CTRL_KEY_AGREE_DECRYPT      17
+#define CMSG_CTRL_MAIL_LIST_DECRYPT      18
+#define CMSG_CTRL_VERIFY_SIGNATURE_EX    19
+#define CMSG_CTRL_ADD_CMS_SIGNER_INFO    20
+#define CMSG_CTRL_ENABLE_STRONG_SIGNATURE 21
@@ -0,0 +1,69 @@
+import sys
+
+if sys.version_info.major == 3:
+    long = int
+
+
+class Flag(long):
+    def __new__(cls, name, value):
+        return super(Flag, cls).__new__(cls, value)
+
+    def __init__(self, name, value):
+        self.name = name
+
+    def __repr__(self):
+        return "{0}({1:#x})".format(self.name, self)
+
+    __str__ = __repr__
+
+   # Fix pickling with protocol 2
+    def __getnewargs__(self, *args):
+        return self.name, long(self)
+
+
+class StrFlag(str):
+    def __new__(cls, name, value):
+        if isinstance(value, cls):
+            return value
+        return super(StrFlag, cls).__new__(cls, value)
+
+    def __init__(self, name, value):
+        self.name = name
+
+    def __repr__(self):
+        return "{0}({1})".format(self.name, str.__repr__(self))
+
+    # __str__ = __repr__
+
+    # Fix pickling with protocol 2
+    def __getnewargs__(self, *args):
+        return self.name, str.__str__(self)
+
+
+def make_flag(name, value):
+    if isinstance(value, (int, long)):
+        return Flag(name, value)
+    return StrFlag(name, value)
+
+
+class FlagMapper(dict):
+    def __init__(self, *values):
+        self.update({x:x for x in values})
+
+    def __missing__(self, key):
+        return key
+
+
+class FlagExatractor(object):
+    def __init__(self, attr, values):
+        self.attr = attr
+        self.attrsize = attr.size * 8
+        self.mapper = FlagMapper(*values)
+
+    def __get__(self, obj, type):
+        if obj is None:
+            return self
+        # Retrieve the real value
+        value = self.attr.__get__(obj)
+        generator = (1 << i for i in range(self.attrsize))
+        return [self.mapper[f] for f in generator if value & f]
@@ -0,0 +1,6 @@
+HRESULT WINAPI ObjectFromLresult(
+  _In_  LRESULT lResult,
+  _In_  REFIID  riid,
+  _In_  WPARAM  wParam,
+  _Out_ PVOID   *ppvObject
+);
@@ -0,0 +1,47 @@
+HRESULT WINAPI CoInitializeEx(
+  _In_opt_ LPVOID pvReserved,
+  _In_     DWORD  dwCoInit
+);
+
+HRESULT WINAPI CoInitializeSecurity(
+  _In_opt_ PSECURITY_DESCRIPTOR        pSecDesc,
+  _In_     LONG                        cAuthSvc,
+  _In_opt_ SOLE_AUTHENTICATION_SERVICE *asAuthSvc,
+  _In_opt_ PVOID                        pReserved1,
+  _In_     DWORD                       dwAuthnLevel,
+  _In_     DWORD                       dwImpLevel,
+  _In_opt_ PVOID                       pAuthList,
+  _In_     DWORD                       dwCapabilities,
+  _In_opt_ PVOID                       pReserved3
+);
+
+HRESULT WINAPI CoCreateInstance(
+  _In_  REFCLSID  rclsid,
+  _In_  LPUNKNOWN pUnkOuter,
+  _In_  DWORD     dwClsContext,
+  _In_  REFIID    riid,
+  _Out_ LPVOID    *ppv
+);
+
+HRESULT WINAPI CoCreateInstanceEx(
+  _In_    REFCLSID     rclsid,
+  _In_    IUnknown     *punkOuter,
+  _In_    DWORD        dwClsCtx,
+  _In_    COSERVERINFO *pServerInfo,
+  _In_    DWORD        dwCount,
+  _Inout_ MULTI_QI     *pResults
+);
+
+
+HRESULT WINAPI CoGetInterceptor(
+  _In_  REFIID   iidIntercepted,
+  _In_  IUnknown *punkOuter,
+  _In_  REFIID   iid,
+  _Out_ PVOID     *ppv
+);
+
+
+HRESULT WINAPI CLSIDFromProgID(
+  _In_  LPCOLESTR lpszProgID,
+  _Out_ LPCLSID   lpclsid
+);
@@ -0,0 +1,37 @@
+DWORD64 WINAPI SymLoadModuleExA(
+  _In_ HANDLE        hProcess,
+  _In_ HANDLE        hFile,
+  _In_ PCSTR        ImageName,
+  _In_ PCSTR        ModuleName,
+  _In_ DWORD64       BaseOfDll,
+  _In_ DWORD         DllSize,
+  _In_ PMODLOAD_DATA Data,
+  _In_ DWORD         Flags
+);
+
+
+DWORD64 WINAPI SymLoadModuleExW(
+  _In_ HANDLE        hProcess,
+  _In_ HANDLE        hFile,
+  _In_ PCWSTR        ImageName,
+  _In_ PCWSTR        ModuleName,
+  _In_ DWORD64       BaseOfDll,
+  _In_ DWORD         DllSize,
+  _In_ PMODLOAD_DATA Data,
+  _In_ DWORD         Flags
+);
+
+
+BOOL WINAPI SymFromAddr(
+  _In_      HANDLE       hProcess,
+  _In_      DWORD64      Address,
+  _Out_opt_ PDWORD64     Displacement,
+  _Inout_   PSYMBOL_INFO Symbol
+);
+
+
+BOOL WINAPI SymGetModuleInfo64(
+  _In_  HANDLE             hProcess,
+  _In_  DWORD64            dwAddr,
+  _Out_ PIMAGEHLP_MODULE64 ModuleInfo
+);
@@ -0,0 +1,50 @@
+HANDLE WINAPI CreateFileTransactedA(
+  _In_       LPCSTR               lpFileName,
+  _In_       DWORD                 dwDesiredAccess,
+  _In_       DWORD                 dwShareMode,
+  _In_opt_   LPSECURITY_ATTRIBUTES lpSecurityAttributes,
+  _In_       DWORD                 dwCreationDisposition,
+  _In_       DWORD                 dwFlagsAndAttributes,
+  _In_opt_   HANDLE                hTemplateFile,
+  _In_       HANDLE                hTransaction,
+  _In_opt_   PUSHORT               pusMiniVersion,
+  _Reserved_ PVOID                 pExtendedParameter
+);
+
+
+HANDLE WINAPI CreateFileTransactedW(
+  _In_       LPWSTR               lpFileName,
+  _In_       DWORD                 dwDesiredAccess,
+  _In_       DWORD                 dwShareMode,
+  _In_opt_   LPSECURITY_ATTRIBUTES lpSecurityAttributes,
+  _In_       DWORD                 dwCreationDisposition,
+  _In_       DWORD                 dwFlagsAndAttributes,
+  _In_opt_   HANDLE                hTemplateFile,
+  _In_       HANDLE                hTransaction,
+  _In_opt_   PUSHORT               pusMiniVersion,
+  _Reserved_ PVOID                 pExtendedParameter
+);
+
+
+BOOL WINAPI CommitTransaction(
+  _In_ HANDLE TransactionHandle
+);
+
+HANDLE WINAPI CreateTransaction(
+  _In_opt_ LPSECURITY_ATTRIBUTES lpTransactionAttributes,
+  _In_opt_ LPGUID                UOW,
+  _In_opt_ DWORD                 CreateOptions,
+  _In_opt_ DWORD                 IsolationLevel,
+  _In_opt_ DWORD                 IsolationFlags,
+  _In_opt_ DWORD                 Timeout,
+  _In_opt_ LPWSTR                Description
+);
+
+BOOL WINAPI RollbackTransaction(
+  _In_ HANDLE TransactionHandle
+);
+
+HANDLE WINAPI OpenTransaction(
+  _In_ DWORD  dwDesiredAccess,
+  _In_ LPGUID TransactionId
+);
@@ -0,0 +1,45 @@
+NTSTATUS WINAPI  NtOpenKey(
+       _Out_ PHANDLE KeyHandle,
+       _In_ ACCESS_MASK DesiredAccess,
+       _In_ POBJECT_ATTRIBUTES ObjectAttributes
+);
+
+
+NTSTATUS WINAPI NtCreateKey(
+  _Out_ PHANDLE             pKeyHandle,
+  _In_ ACCESS_MASK          DesiredAccess,
+  _In_ POBJECT_ATTRIBUTES   ObjectAttributes,
+  _In_ ULONG                TitleIndex,
+  _In_ PUNICODE_STRING      Class,
+  _In_ ULONG                CreateOptions,
+  _Out_ PULONG              Disposition
+);
+
+NTSTATUS WINAPI NtSetValueKey(
+  _In_ HANDLE               KeyHandle,
+  _In_ PUNICODE_STRING      ValueName,
+  _In_ ULONG                TitleIndex,
+  _In_ ULONG                Type,
+  _In_ PVOID                Data,
+  _In_ ULONG                DataSize
+);
+
+
+NTSTATUS NtQueryValueKey(
+  HANDLE                      KeyHandle,
+  PUNICODE_STRING             ValueName,
+  KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
+  PVOID                       KeyValueInformation,
+  ULONG                       Length,
+  PULONG                      ResultLength
+);
+
+
+NTSTATUS NtEnumerateValueKey(
+  HANDLE                      KeyHandle,
+  ULONG                       Index,
+  KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
+  PVOID                       KeyValueInformation,
+  ULONG                       Length,
+  PULONG                      ResultLength
+);
@@ -0,0 +1,54 @@
+BOOL WINAPI CreatePipe(
+  _Out_    PHANDLE               hReadPipe,
+  _Out_    PHANDLE               hWritePipe,
+  _In_opt_ LPSECURITY_ATTRIBUTES lpPipeAttributes,
+  _In_     DWORD                 nSize
+);
+
+
+HANDLE WINAPI CreateNamedPipeA(
+  _In_     LPCSTR                lpName,
+  _In_     DWORD                 dwOpenMode,
+  _In_     DWORD                 dwPipeMode,
+  _In_     DWORD                 nMaxInstances,
+  _In_     DWORD                 nOutBufferSize,
+  _In_     DWORD                 nInBufferSize,
+  _In_     DWORD                 nDefaultTimeOut,
+  _In_opt_ LPSECURITY_ATTRIBUTES lpSecurityAttributes
+);
+
+HANDLE WINAPI CreateNamedPipeW(
+  _In_     LPWSTR                lpName,
+  _In_     DWORD                 dwOpenMode,
+  _In_     DWORD                 dwPipeMode,
+  _In_     DWORD                 nMaxInstances,
+  _In_     DWORD                 nOutBufferSize,
+  _In_     DWORD                 nInBufferSize,
+  _In_     DWORD                 nDefaultTimeOut,
+  _In_opt_ LPSECURITY_ATTRIBUTES lpSecurityAttributes
+);
+
+
+BOOL WINAPI ConnectNamedPipe(
+  _In_        HANDLE       hNamedPipe,
+  _Inout_opt_ LPOVERLAPPED lpOverlapped
+);
+
+
+BOOL WINAPI SetNamedPipeHandleState(
+  _In_     HANDLE  hNamedPipe,
+  _In_opt_ LPDWORD lpMode,
+  _In_opt_ LPDWORD lpMaxCollectionCount,
+  _In_opt_ LPDWORD lpCollectDataTimeout
+);
+
+
+BOOL WINAPI PeekNamedPipe(
+  _In_      HANDLE  hNamedPipe,
+  _Out_opt_ LPVOID  lpBuffer,
+  _In_      DWORD   nBufferSize,
+  _Out_opt_ LPDWORD lpBytesRead,
+  _Out_opt_ LPDWORD lpTotalBytesAvail,
+  _Out_opt_ LPDWORD lpBytesLeftThisMessage
+);
+
@@ -0,0 +1,143 @@
+BOOL WINAPI IsValidSecurityDescriptor(
+  _In_ PSECURITY_DESCRIPTOR pSecurityDescriptor
+);
+
+BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorA(
+  _In_  LPCSTR              StringSecurityDescriptor,
+  _In_  DWORD                StringSDRevision,
+  _Out_ PSECURITY_DESCRIPTOR *SecurityDescriptor,
+  _Out_ PULONG               SecurityDescriptorSize
+);
+
+BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorW(
+  _In_  LPWSTR              StringSecurityDescriptor,
+  _In_  DWORD                StringSDRevision,
+  _Out_ PSECURITY_DESCRIPTOR *SecurityDescriptor,
+  _Out_ PULONG               SecurityDescriptorSize
+);
+
+BOOL WINAPI ConvertSecurityDescriptorToStringSecurityDescriptorA(
+  _In_  PSECURITY_DESCRIPTOR SecurityDescriptor,
+  _In_  DWORD                RequestedStringSDRevision,
+  _In_  DWORD                SecurityInformation,
+  _Out_ LPCSTR               *StringSecurityDescriptor,
+  _Out_ PULONG               StringSecurityDescriptorLen
+);
+
+
+BOOL WINAPI ConvertSecurityDescriptorToStringSecurityDescriptorW(
+  _In_  PSECURITY_DESCRIPTOR SecurityDescriptor,
+  _In_  DWORD                RequestedStringSDRevision,
+  _In_  DWORD                SecurityInformation,
+  _Out_ LPWSTR               *StringSecurityDescriptor,
+  _Out_ PULONG               StringSecurityDescriptorLen
+);
+
+
+/* From Win10 securitybaseapi.h*/
+
+
+BOOL WINAPI GetSecurityDescriptorControl(
+    _In_ PSECURITY_DESCRIPTOR pSecurityDescriptor,
+    _Out_ PSECURITY_DESCRIPTOR_CONTROL pControl,
+    _Out_ LPDWORD lpdwRevision
+    );
+
+
+
+BOOL WINAPI GetSecurityDescriptorDacl(
+    _In_ PSECURITY_DESCRIPTOR pSecurityDescriptor,
+    _Out_ LPBOOL lpbDaclPresent,
+    _Outptr_ PACL * pDacl,
+    _Out_ LPBOOL lpbDaclDefaulted
+    );
+
+
+BOOL WINAPI GetSecurityDescriptorGroup(
+    _In_ PSECURITY_DESCRIPTOR pSecurityDescriptor,
+    _Outptr_ PSID * pGroup,
+    _Out_ LPBOOL lpbGroupDefaulted
+    );
+
+
+DWORD WINAPI GetSecurityDescriptorLength(
+    _In_ PSECURITY_DESCRIPTOR pSecurityDescriptor
+    );
+
+
+BOOL WINAPI GetSecurityDescriptorOwner(
+    _In_ PSECURITY_DESCRIPTOR pSecurityDescriptor,
+    _Outptr_ PSID * pOwner,
+    _Out_ LPBOOL lpbOwnerDefaulted
+    );
+
+
+DWORD WINAPI GetSecurityDescriptorRMControl(
+    _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
+    _Out_ PUCHAR RMControl
+    );
+
+
+BOOL WINAPI GetSecurityDescriptorSacl(
+    _In_ PSECURITY_DESCRIPTOR pSecurityDescriptor,
+    _Out_ LPBOOL lpbSaclPresent,
+    _Outptr_ PACL * pSacl,
+    _Out_ LPBOOL lpbSaclDefaulted
+    );
+
+DWORD WINAPI GetLengthSid(
+  _In_ PSID pSid
+);
+
+BOOL EqualSid(
+  PSID pSid1,
+  PSID pSid2
+);
+
+BOOL CopySid(
+  DWORD nDestinationSidLength,
+  PSID  pDestinationSid,
+  PSID  pSourceSid
+);
+
+
+PSID_IDENTIFIER_AUTHORITY WINAPI GetSidIdentifierAuthority(
+    _In_ PSID pSid
+);
+
+
+DWORD WINAPI GetSidLengthRequired(
+    _In_ UCHAR nSubAuthorityCount
+);
+
+
+PDWORD WINAPI GetSidSubAuthority(
+    _In_ PSID pSid,
+    _In_ DWORD nSubAuthority
+);
+
+/* Yep not the good definition (return PUCHAR)
+ * but who want this function to returns Python String..
+ */
+LPBYTE WINAPI GetSidSubAuthorityCount(
+    _In_ PSID pSid
+    );
+
+PVOID WINAPI FreeSid(
+    _In_ PSID pSid
+    );
+
+
+BOOL WINAPI GetAce(
+    _In_ PACL pAcl,
+    _In_ DWORD dwAceIndex,
+    _Outptr_ LPVOID * pAce
+    );
+
+
+BOOL WINAPI GetAclInformation(
+    _In_ PACL pAcl,
+    _Out_ LPVOID pAclInformation,
+    _In_ DWORD nAclInformationLength,
+    _In_ ACL_INFORMATION_CLASS dwAclInformationClass
+    );
@@ -0,0 +1,29 @@
+HINSTANCE WINAPI ShellExecuteA(
+  _In_opt_ HWND    hwnd,
+  _In_opt_ LPCSTR lpOperation,
+  _In_     LPCSTR lpFile,
+  _In_opt_ LPCSTR lpParameters,
+  _In_opt_ LPCSTR lpDirectory,
+  _In_     INT     nShowCmd
+);
+
+
+HINSTANCE WINAPI ShellExecuteW(
+  _In_opt_ HWND    hwnd,
+  _In_opt_ LPWSTR lpOperation,
+  _In_     LPWSTR lpFile,
+  _In_opt_ LPWSTR lpParameters,
+  _In_opt_ LPWSTR lpDirectory,
+  _In_     INT     nShowCmd
+);
+
+
+BOOL SHGetPathFromIDListA(
+  PCIDLIST_ABSOLUTE pidl,
+  LPCSTR             pszPath
+);
+
+BOOL SHGetPathFromIDListW(
+  PCIDLIST_ABSOLUTE pidl,
+  LPWSTR             pszPath
+);
@@ -0,0 +1,14 @@
+PWSTR WINAPI StrStrIW(
+  _In_ PWSTR  pszFirst,
+  _In_ PWSTR pszSrch
+);
+
+PCSTR WINAPI StrStrIA(
+  _In_ PCSTR  pszFirst,
+  _In_ PCSTR pszSrch
+);
+
+
+BOOL IsOS(
+  DWORD dwOS
+);
@@ -0,0 +1,145 @@
+BOOL WINAPI GetCursorPos(
+  _Out_ LPPOINT lpPoint
+);
+
+HWND WINAPI WindowFromPoint(
+  _In_ POINT Point
+);
+
+BOOL WINAPI GetWindowRect(
+  _In_  HWND   hWnd,
+  _Out_ LPRECT lpRect
+);
+
+BOOL WINAPI EnumWindows(
+    __in WNDENUMPROC lpEnumFunc,
+    __in LPARAM lParam
+);
+
+
+INT WINAPI GetWindowTextA(
+    __in HWND hWnd,
+    __out LPSTR lpString,
+    __in INT nMaxCount
+);
+
+HWND WINAPI GetParent(
+  _In_ HWND hWnd
+);
+
+INT WINAPI GetWindowTextW(
+    __in HWND hWnd,
+    __out LPWSTR lpString,
+    __in INT nMaxCount
+);
+
+UINT WINAPI GetWindowModuleFileNameA(
+    __in HWND hwnd,
+    __out LPSTR pszFileName,
+    __in UINT cchFileNameMax);
+
+UINT WINAPI GetWindowModuleFileNameW(
+    __in HWND hwnd,
+    __out LPWSTR pszFileName,
+    __in UINT cchFileNameMax);
+
+
+BOOL WINAPI EnumChildWindows(
+  _In_opt_ HWND        hWndParent,
+  _In_     WNDENUMPROC lpEnumFunc,
+  _In_     LPARAM      lParam
+);
+
+BOOL WINAPI CloseWindow(
+  _In_ HWND hWnd
+);
+
+HWND WINAPI GetDesktopWindow();
+
+HWND WINAPI GetForegroundWindow();
+
+
+BOOL WINAPI BringWindowToTop(
+  _In_ HWND hWnd
+);
+
+BOOL WINAPI MoveWindow(
+  _In_ HWND hWnd,
+  _In_ INT  X,
+  _In_ INT  Y,
+  _In_ INT  nWidth,
+  _In_ INT  nHeight,
+  _In_ BOOL bRepaint
+);
+
+
+BOOL WINAPI SetWindowPos(
+  _In_     HWND hWnd,
+  _In_opt_ HWND hWndInsertAfter,
+  _In_     INT  X,
+  _In_     INT  Y,
+  _In_     INT  cx,
+  _In_     INT  cy,
+  _In_     UINT uFlags
+);
+
+BOOL WINAPI SetWindowTextA(
+  _In_     HWND    hWnd,
+  _In_opt_ LPCSTR lpString
+);
+
+BOOL WINAPI SetWindowTextW(
+  _In_     HWND    hWnd,
+  _In_opt_ LPWSTR lpString
+);
+
+UINT WINAPI RealGetWindowClassA(
+  _In_  HWND   hwnd,
+  _Out_ LPCSTR pszType,
+  _In_  UINT   cchType
+);
+
+UINT WINAPI RealGetWindowClassW(
+  _In_  HWND   hwnd,
+  _Out_ LPWSTR pszType,
+  _In_  UINT   cchType
+);
+
+BOOL WINAPI GetClassInfoExA(
+  _In_opt_ HINSTANCE    hinst,
+  _In_     LPCSTR      lpszClass,
+  _Out_    LPWNDCLASSEXA lpwcx
+);
+
+BOOL WINAPI GetClassInfoExW(
+  _In_opt_ HINSTANCE    hinst,
+  _In_     LPCWSTR      lpszClass,
+  _Out_    LPWNDCLASSEXW lpwcx
+);
+
+INT WINAPI GetClassNameA(
+  _In_  HWND   hWnd,
+  _Out_ LPCSTR lpClassName,
+  _In_  INT    nMaxCount
+);
+
+INT WINAPI GetClassNameW(
+  _In_  HWND   hWnd,
+  _Out_ LPWSTR lpClassName,
+  _In_  INT    nMaxCount
+);
+
+DWORD WINAPI GetWindowThreadProcessId(
+  _In_      HWND    hWnd,
+  _Out_opt_ LPDWORD lpdwProcessId
+);
+
+HWND FindWindowA(
+  LPCSTR lpClassName,
+  LPCSTR lpWindowName
+);
+
+HWND FindWindowW(
+  LPCWSTR lpClassName,
+  LPCWSTR lpWindowName
+);
@@ -69,6 +69,13 @@ NTSTATUS WINAPI NtQueryInformationProcess(
  _Out_opt_ PULONG           ReturnLength
 );

+NTSTATUS WINAPI NtSetInformationProcess(
+  _In_ HANDLE               ProcessHandle,
+  _In_ PROCESS_INFORMATION_CLASS ProcessInformationClass,
+  _In_ PVOID                ProcessInformation,
+  _In_ ULONG                ProcessInformationLength
+);
+
 NTSTATUS WINAPI NtQueryVirtualMemory(
  _In_      HANDLE                   ProcessHandle,
  _In_opt_  PVOID                    BaseAddress,
@@ -78,6 +85,14 @@ NTSTATUS WINAPI NtQueryVirtualMemory(
  _Out_opt_ PSIZE_T                  ReturnLength
 );

+NTSTATUS WINAPI NtQueryVolumeInformationFile(
+  _In_  HANDLE               FileHandle,
+  _Out_ PIO_STATUS_BLOCK     IoStatusBlock,
+  _Out_ PVOID                FsInformation,
+  _In_  ULONG                Length,
+  _In_  FS_INFORMATION_CLASS FsInformationClass
+);
+
 NTSTATUS NtCreateThreadEx(
        PHANDLE                 ThreadHandle,
        ACCESS_MASK             DesiredAccess,
@@ -110,6 +125,16 @@ BOOL WINAPI GetExitCodeProcess(
    __out LPDWORD lpExitCode
 );

+
+BOOL WINAPI SetPriorityClass(
+  _In_ HANDLE hProcess,
+  _In_ DWORD  dwPriorityClass
+);
+
+DWORD WINAPI GetPriorityClass(
+  _In_ HANDLE hProcess
+);
+
 LPVOID WINAPI VirtualAlloc(
  _In_opt_  LPVOID lpAddress,
  _In_      SIZE_T dwSize,
@@ -125,6 +150,16 @@ LPVOID WINAPI VirtualAllocEx(
  _In_      DWORD flProtect
 );

+NTSTATUS WINAPI NtAllocateVirtualMemory(
+  _In_    HANDLE    ProcessHandle,
+  _Inout_ PVOID     *BaseAddress,
+  _In_    ULONG_PTR ZeroBits,
+  _Inout_ PSIZE_T   RegionSize,
+  _In_    ULONG     AllocationType,
+  _In_    ULONG     Protect
+);
+
+
 NTSTATUS WINAPI NtProtectVirtualMemory(
  _In_ HANDLE               ProcessHandle,
  _Inout_ PVOID            *BaseAddress,
@@ -147,6 +182,14 @@ BOOL WINAPI VirtualFreeEx(
  _In_ DWORD  dwFreeType
 );

+
+NTSTATUS WINAPI NtFreeVirtualMemory(
+  _In_    HANDLE  ProcessHandle,
+  _Inout_ PVOID   *BaseAddress,
+  _Inout_ PSIZE_T RegionSize,
+  _In_    ULONG   FreeType
+);
+
 BOOL WINAPI VirtualProtect(
  _In_   LPVOID lpAddress,
  _In_   SIZE_T dwSize,
@@ -287,7 +330,7 @@ BOOL WINAPI GetThreadContext(
    __inout LPCONTEXT lpContext
 );

-BOOL WINAPI NtGetContextThread(
+NTSTATUS WINAPI NtGetContextThread(
    __in    HANDLE hThread,
    __inout LPCONTEXT lpContext
 );
@@ -297,7 +340,7 @@ BOOL WINAPI SetThreadContext(
    __in CONST LPCONTEXT lpContext
 );

-BOOL WINAPI NtSetContextThread(
+NTSTATUS WINAPI NtSetContextThread(
    __in HANDLE hThread,
    __in CONST LPCONTEXT lpContext
 );
@@ -320,47 +363,57 @@ BOOL WINAPI CloseHandle(
 );

 BOOL WINAPI ReadProcessMemory(
-  _In_   HANDLE hProcess,
-  _In_   LPCVOID lpBaseAddress,
-  _Out_  LPVOID lpBuffer,
-  _In_   SIZE_T nSize,
-  _Out_  SIZE_T *lpNumberOfBytesRead
+  _In_   HANDLE     hProcess,
+  _In_   LPCVOID    lpBaseAddress,
+  _Out_  LPVOID     lpBuffer,
+  _In_   SIZE_T     nSize,
+  _Out_  SIZE_T     *lpNumberOfBytesRead
 );

-BOOL WINAPI NtWow64ReadVirtualMemory64(
-  _In_   HANDLE hProcess,
-  _In_   ULONG64 lpBaseAddress,
-  _Out_  LPVOID lpBuffer,
-  _In_   ULONG64 nSize,
-  _Out_  PULONG64 *lpNumberOfBytesRead
+NTSTATUS WINAPI NtWow64ReadVirtualMemory64(
+  _In_   HANDLE     hProcess,
+  _In_   ULONG64    lpBaseAddress,
+  _Out_  LPVOID     lpBuffer,
+  _In_   ULONG64    nSize,
+  _Out_  PULONG64   lpNumberOfBytesRead
 );

-
-BOOL WINAPI NtReadVirtualMemory(
-  _In_   HANDLE hProcess,
-  _In_   PVOID lpBaseAddress,
-  _Out_  LPVOID lpBuffer,
-  _In_   ULONG nSize,
-  _Out_  PULONG *lpNumberOfBytesRead
+NTSTATUS WINAPI NtReadVirtualMemory(
+  _In_   HANDLE     hProcess,
+  _In_   PVOID      lpBaseAddress,
+  _Out_  LPVOID     lpBuffer,
+  _In_   ULONG      nSize,
+  _Out_  PULONG     lpNumberOfBytesRead
 );


 BOOL WINAPI WriteProcessMemory(
-  _In_   HANDLE hProcess,
-  _In_   LPVOID lpBaseAddress,
-  _In_   LPCVOID lpBuffer,
-  _In_   SIZE_T nSize,
-  _Out_  SIZE_T *lpNumberOfBytesWritten
+  _In_   HANDLE     hProcess,
+  _In_   LPVOID     lpBaseAddress,
+  _In_   LPCVOID    lpBuffer,
+  _In_   SIZE_T     nSize,
+  _Out_  SIZE_T     *lpNumberOfBytesWritten
 );

-BOOL WINAPI NtWow64WriteVirtualMemory64(
-  _In_   HANDLE hProcess,
-  _In_   ULONG64 lpBaseAddress,
-  _Out_  LPVOID lpBuffer,
-  _In_   ULONG64 nSize,
-  _Out_  PULONG64 *lpNumberOfBytesWritten
+
+NTSTATUS WINAPI NtWow64WriteVirtualMemory64(
+  _In_   HANDLE     hProcess,
+  _In_   ULONG64    lpBaseAddress,
+  _Out_  LPVOID     lpBuffer,
+  _In_   ULONG64    nSize,
+  _Out_  PULONG64   lpNumberOfBytesWritten
 );

+
+NTSTATUS WINAPI NtWriteVirtualMemory(
+  _In_ HANDLE               ProcessHandle,
+  _In_ PVOID                BaseAddress,
+  _In_ PVOID                Buffer,
+  _In_ ULONG                NumberOfBytesToWrite,
+  _Out_ PULONG              NumberOfBytesWritten
+);
+
+
 HANDLE WINAPI CreateToolhelp32Snapshot(
  _In_  DWORD dwFlags,
  _In_  DWORD th32ProcessID
@@ -410,12 +463,45 @@ HMODULE WINAPI LoadLibraryW(
    __in LPCWSTR lpFileName
 );

+HMODULE LoadLibraryExA(
+  LPCSTR lpLibFileName,
+  HANDLE hFile,
+  DWORD  dwFlags
+);
+
+HMODULE LoadLibraryExW(
+  LPCWSTR lpLibFileName,
+  HANDLE  hFile,
+  DWORD   dwFlags
+);
+
+BOOL FreeLibrary(
+  HMODULE hLibModule
+);
+
 BOOL WINAPI OpenProcessToken(
  _In_   HANDLE ProcessHandle,
  _In_   DWORD DesiredAccess,
  _Out_  PHANDLE TokenHandle
 );

+BOOL WINAPI DuplicateToken(
+  _In_  HANDLE                       ExistingTokenHandle,
+  _In_  SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
+  _Out_ PHANDLE                      DuplicateTokenHandle
+);
+
+
+BOOL WINAPI DuplicateTokenEx(
+  _In_     HANDLE                       hExistingToken,
+  _In_     DWORD                        dwDesiredAccess,
+  _In_opt_ LPSECURITY_ATTRIBUTES        lpTokenAttributes,
+  _In_     SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
+  _In_     TOKEN_TYPE                   TokenType,
+  _Out_    PHANDLE                      phNewToken
+);
+
+
 BOOL WINAPI OpenThreadToken(
  _In_  HANDLE  ThreadHandle,
  _In_  DWORD   DesiredAccess,
@@ -423,6 +509,11 @@ BOOL WINAPI OpenThreadToken(
  _Out_ PHANDLE TokenHandle
 );

+BOOL WINAPI SetThreadToken(
+  _In_opt_ PHANDLE Thread,
+  _In_opt_ HANDLE  Token
+);
+
 BOOL WINAPI LookupPrivilegeValueA(
    __in_opt LPCSTR lpSystemName,
    __in     LPCSTR lpName,
@@ -818,22 +909,8 @@ BOOL WINAPI SetTokenInformation (
    __in DWORD TokenInformationLength
 );

-PSID_IDENTIFIER_AUTHORITY WINAPI GetSidIdentifierAuthority (
-    __in PSID pSid
-    );

-PDWORD WINAPI GetSidSubAuthority (
-    __in PSID pSid,
-    __in DWORD nSubAuthority
-    );

-LPBYTE WINAPI GetSidSubAuthorityCount (
-    __in PSID pSid
-    );
-
-DWORD WINAPI GetLengthSid(
-  _In_ PSID pSid
-);

 BOOL WINAPI CreateWellKnownSid(
  _In_      WELL_KNOWN_SID_TYPE WellKnownSidType,
@@ -921,6 +998,22 @@ NTSTATUS RtlDecompressBuffer(
    PULONG FinalUncompressedSize
 );

+NTSTATUS RtlDecompressBufferEx(
+   USHORT CompressionFormat,
+   PUCHAR UncompressedBuffer,
+   ULONG  UncompressedBufferSize,
+   PUCHAR CompressedBuffer,
+   ULONG  CompressedBufferSize,
+   PULONG FinalUncompressedSize,
+   PVOID  WorkSpace
+);
+
+NTSTATUS RtlGetCompressionWorkSpaceSize(
+   USHORT CompressionFormatAndEngine,
+   PULONG CompressBufferWorkSpaceSize,
+   PULONG CompressFragmentWorkSpaceSize
+);
+
 NTSTATUS NtCreateSection(
    PHANDLE            SectionHandle,
    ACCESS_MASK        DesiredAccess,
@@ -975,157 +1068,6 @@ NTSTATUS WINAPI NtOpenEvent(
 );


-
-NTSTATUS WINAPI NtAlpcCreatePort(
-    _Out_ PHANDLE PortHandle,
-    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
-    _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes
-);
-
-NTSTATUS WINAPI NtAlpcQueryInformation(
-    _In_opt_ HANDLE PortHandle,
-    _In_ ALPC_PORT_INFORMATION_CLASS PortInformationClass,
-    _Inout_opt_ PVOID PortInformation,
-    _In_ ULONG Length,
-    _Out_opt_ PULONG ReturnLength
-);
-
-NTSTATUS WINAPI NtAlpcConnectPort(
-    _Out_ PHANDLE PortHandle,
-    _In_ PUNICODE_STRING PortName,
-    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
-    _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
-    _In_ ULONG Flags,
-    _In_opt_ PSID RequiredServerSid,
-    _Inout_opt_ PPORT_MESSAGE ConnectionMessage,
-    _Inout_opt_ PULONG BufferLength,
-    _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,
-    _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,
-    _In_opt_ PLARGE_INTEGER Timeout
-);
-
-NTSTATUS WINAPI NtAlpcConnectPortEx(
-    _Out_ PHANDLE PortHandle,
-    _In_ POBJECT_ATTRIBUTES ConnectionPortObjectAttributes,
-    _In_opt_ POBJECT_ATTRIBUTES ClientPortObjectAttributes,
-    _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
-    _In_ ULONG Flags,
-    _In_opt_ PSECURITY_DESCRIPTOR ServerSecurityRequirements,
-    _Inout_opt_ PPORT_MESSAGE ConnectionMessage,
-    _Inout_opt_ PSIZE_T BufferLength,
-    _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,
-    _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,
-    _In_opt_ PLARGE_INTEGER Timeout
-);
-
-
-NTSTATUS WINAPI NtAlpcAcceptConnectPort(
-    _Out_ PHANDLE PortHandle,
-    _In_ HANDLE ConnectionPortHandle,
-    _In_ ULONG Flags,
-    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
-    _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
-    _In_opt_ PVOID PortContext,
-    _In_ PPORT_MESSAGE ConnectionRequest,
-    _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ConnectionMessageAttributes,
-    _In_ BOOLEAN AcceptConnection
-);
-
-NTSTATUS WINAPI AlpcInitializeMessageAttribute(
-    _In_ ULONG AttributeFlags,
-    _Out_opt_ PALPC_MESSAGE_ATTRIBUTES Buffer,
-    _In_ ULONG BufferSize,
-    _Out_ PULONG RequiredBufferSize
-);
-
-PVOID WINAPI AlpcGetMessageAttribute(
-    _In_ PALPC_MESSAGE_ATTRIBUTES Buffer,
-    _In_ ULONG AttributeFlag
-);
-
-NTSTATUS WINAPI NtAlpcSendWaitReceivePort(
-    _In_ HANDLE PortHandle,
-    _In_ ULONG Flags,
-    _In_opt_ PPORT_MESSAGE SendMessage,
-    _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES SendMessageAttributes,
-    _Out_opt_ PPORT_MESSAGE ReceiveMessage,
-    _Inout_opt_ PSIZE_T BufferLength,
-    _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ReceiveMessageAttributes,
-    _In_opt_ PLARGE_INTEGER Timeout
-);
-
-NTSTATUS WINAPI NtAlpcDisconnectPort(
-    _In_ HANDLE PortHandle,
-    _In_ ULONG Flags
-);
-
-NTSTATUS WINAPI NtAlpcCreatePortSection(
-    _In_ HANDLE PortHandle,
-    _In_ ULONG Flags,
-    _In_opt_ HANDLE SectionHandle,
-    _In_ SIZE_T SectionSize,
-    _Out_ PALPC_HANDLE AlpcSectionHandle,
-    _Out_ PSIZE_T ActualSectionSize
-    );
-
-NTSTATUS WINAPI NtAlpcDeletePortSection(
-    _In_ HANDLE PortHandle,
-    _Reserved_ ULONG Flags,
-    _In_ ALPC_HANDLE SectionHandle
-    );
-
-
-
-NTSTATUS WINAPI NtAlpcCreateResourceReserve(
-    _In_ HANDLE PortHandle,
-    _Reserved_ ULONG Flags,
-    _In_ SIZE_T MessageSize,
-    _Out_ PALPC_HANDLE ResourceId
-    );
-
-
-NTSTATUS WINAPI NtAlpcDeleteResourceReserve(
-    _In_ HANDLE PortHandle,
-    _Reserved_ ULONG Flags,
-    _In_ ALPC_HANDLE ResourceId
-    );
-
-
-NTSTATUS WINAPI NtAlpcCreateSectionView(
-    _In_ HANDLE PortHandle,
-    _Reserved_ ULONG Flags,
-    _Inout_ PALPC_DATA_VIEW_ATTR ViewAttributes
-    );
-
-
-NTSTATUS WINAPI NtAlpcDeleteSectionView(
-    _In_ HANDLE PortHandle,
-    _Reserved_ ULONG Flags,
-    _In_ PVOID ViewBase
-    );
-
-
-NTSTATUS WINAPI NtAlpcCreateSecurityContext(
-    _In_ HANDLE PortHandle,
-    _Reserved_ ULONG Flags,
-    _Inout_ PALPC_SECURITY_ATTR SecurityAttribute
-    );
-
-
-NTSTATUS WINAPI NtAlpcDeleteSecurityContext(
-    _In_ HANDLE PortHandle,
-    _Reserved_ ULONG Flags,
-    _In_ ALPC_HANDLE ContextHandle
-    );
-
-
-NTSTATUS WINAPI NtAlpcRevokeSecurityContext(
-    _In_ HANDLE PortHandle,
-    _Reserved_ ULONG Flags,
-    _In_ ALPC_HANDLE ContextHandle
-    );
-
-
 INT WINAPI lstrcmpA(
    __in LPCSTR lpString1,
    __in LPCSTR lpString2
@@ -1235,34 +1177,6 @@ SC_HANDLE WINAPI OpenServiceW(
 );


-BOOL WINAPI EnumWindows(
-    __in WNDENUMPROC lpEnumFunc,
-    __in LPARAM lParam
-);
-
-
-INT WINAPI GetWindowTextA(
-    __in HWND hWnd,
-    __out LPSTR lpString,
-    __in INT nMaxCount
-);
-
-INT WINAPI GetWindowTextW(
-    __in HWND hWnd,
-    __out LPWSTR lpString,
-    __in INT nMaxCount
-);
-
-UINT WINAPI GetWindowModuleFileNameA(
-    __in HWND hwnd,
-    __out LPSTR pszFileName,
-    __in UINT cchFileNameMax);
-
-UINT WINAPI GetWindowModuleFileNameW(
-    __in HWND hwnd,
-    __out LPWSTR pszFileName,
-    __in UINT cchFileNameMax);
-
 DWORD WINAPI GetLogicalDriveStringsA(
  _In_  DWORD  nBufferLength,
  _Out_ LPCSTR lpBuffer
@@ -1333,6 +1247,29 @@ DWORD WINAPI QueryDosDeviceW(
  _In_     DWORD   ucchMax
 );

+
+HANDLE WINAPI FindFirstVolumeA(
+  _Out_ LPCSTR lpszVolumeName,
+  _In_  DWORD  cchBufferLength
+);
+
+HANDLE WINAPI FindFirstVolumeW(
+  _Out_ LPWSTR lpszVolumeName,
+  _In_  DWORD  cchBufferLength
+);
+
+BOOL WINAPI FindNextVolumeA(
+  _In_  HANDLE hFindVolume,
+  _Out_ LPCSTR lpszVolumeName,
+  _In_  DWORD  cchBufferLength
+);
+
+BOOL WINAPI FindNextVolumeW(
+  _In_  HANDLE hFindVolume,
+  _Out_ LPWSTR lpszVolumeName,
+  _In_  DWORD  cchBufferLength
+);
+
 NTSTATUS WINAPI NtQueryObject(
  _In_opt_  HANDLE                   Handle,
  _In_      OBJECT_INFORMATION_CLASS ObjectInformationClass,
@@ -1460,30 +1397,6 @@ BOOL WINAPI LookupAccountSidW(
  _Out_     PSID_NAME_USE peUse
 );

-HRESULT WINAPI CoInitializeEx(
-  _In_opt_ LPVOID pvReserved,
-  _In_     DWORD  dwCoInit
-);
-
-HRESULT WINAPI CoInitializeSecurity(
-  _In_opt_ PSECURITY_DESCRIPTOR        pSecDesc,
-  _In_     LONG                        cAuthSvc,
-  _In_opt_ SOLE_AUTHENTICATION_SERVICE *asAuthSvc,
-  _In_opt_ PVOID                        pReserved1,
-  _In_     DWORD                       dwAuthnLevel,
-  _In_     DWORD                       dwImpLevel,
-  _In_opt_ PVOID                       pAuthList,
-  _In_     DWORD                       dwCapabilities,
-  _In_opt_ PVOID                       pReserved3
-);
-
-HRESULT WINAPI CoCreateInstance(
-  _In_  REFCLSID  rclsid,
-  _In_  LPUNKNOWN pUnkOuter,
-  _In_  DWORD     dwClsContext,
-  _In_  REFIID    riid,
-  _Out_ LPVOID    *ppv
-);

 DWORD WINAPI GetInterfaceInfo(
  _Out_   PIP_INTERFACE_INFO pIfTable,
@@ -1570,19 +1483,6 @@ BOOL WINAPI GetProcessDEPPolicy(
  _Out_ PBOOL   lpPermanent
 );

-BOOL WINAPI GetCursorPos(
-  _Out_ LPPOINT lpPoint
-);
-
-HWND WINAPI WindowFromPoint(
-  _In_ POINT Point
-);
-
-
-BOOL WINAPI GetWindowRect(
-  _In_  HWND   hWnd,
-  _Out_ LPRECT lpRect
-);

 DWORD WINAPI GetNamedSecurityInfoA(
  _In_      LPCSTR               pObjectName,
@@ -1666,26 +1566,6 @@ LONG WINAPI RegQueryValueExW(
 );


-
-HINSTANCE WINAPI ShellExecuteA(
-  _In_opt_ HWND    hwnd,
-  _In_opt_ LPCSTR lpOperation,
-  _In_     LPCSTR lpFile,
-  _In_opt_ LPCSTR lpParameters,
-  _In_opt_ LPCSTR lpDirectory,
-  _In_     INT     nShowCmd
-);
-
-
-HINSTANCE WINAPI ShellExecuteW(
-  _In_opt_ HWND    hwnd,
-  _In_opt_ LPWSTR lpOperation,
-  _In_     LPWSTR lpFile,
-  _In_opt_ LPWSTR lpParameters,
-  _In_opt_ LPWSTR lpDirectory,
-  _In_     INT     nShowCmd
-);
-
 BOOL WINAPI InitializeProcThreadAttributeList(
  _Out_opt_  LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList,
  _In_       DWORD                        dwAttributeCount,
@@ -1738,4 +1618,148 @@ VOID WINAPI RtlGetUnloadEventTraceEx(
  _Out_ PULONG *ElementSize,
  _Out_ PULONG *ElementCount,
  _Out_ PVOID  *EventTrace
-);
+);
+
+
+NTSTATUS WINAPI NtQueryInformationFile(
+  _In_  HANDLE                 FileHandle,
+  _Out_ PIO_STATUS_BLOCK       IoStatusBlock,
+  _Out_ PVOID                  FileInformation,
+  _In_  ULONG                  Length,
+  _In_  FILE_INFORMATION_CLASS FileInformationClass
+);
+
+NTSTATUS WINAPI NtQueryDirectoryFile(
+  _In_     HANDLE                 FileHandle,
+  _In_opt_ HANDLE                 Event,
+  _In_opt_ PIO_APC_ROUTINE        ApcRoutine,
+  _In_opt_ PVOID                  ApcContext,
+  _Out_    PIO_STATUS_BLOCK       IoStatusBlock,
+  _Out_    PVOID                  FileInformation,
+  _In_     ULONG                  Length,
+  _In_     FILE_INFORMATION_CLASS FileInformationClass,
+  _In_     BOOLEAN                ReturnSingleEntry,
+  _In_opt_ PUNICODE_STRING        FileName,
+  _In_     BOOLEAN                RestartScan
+);
+
+
+BOOLEAN WINAPI RtlDosPathNameToNtPathName_U(
+    _In_ PCWSTR DosName,
+    _Out_ PUNICODE_STRING NtName,
+    _Out_ PCWSTR *PartName,
+    _Out_ PRTL_RELATIVE_NAME_U RelativeName
+);
+
+// NOT EXPORTED !!
+NTSTATUS WINAPI ApiSetResolveToHost (
+    _In_ PVOID Schema,
+    _In_ PUNICODE_STRING FileNameIn,
+    _In_opt_ PUNICODE_STRING ParentName,
+    _Out_ PBOOLEAN Resolved,
+    _Out_ PUNICODE_STRING HostBinary
+    );
+
+
+VOID WINAPI Sleep(
+  _In_ DWORD dwMilliseconds
+);
+
+DWORD WINAPI SleepEx(
+  _In_ DWORD dwMilliseconds,
+  _In_ BOOL  bAlertable
+);
+
+BOOL WINAPI GetProcessMitigationPolicy(
+  _In_  HANDLE                    hProcess,
+  _In_  PROCESS_MITIGATION_POLICY MitigationPolicy,
+  _Out_ PVOID                     lpBuffer,
+  _In_  SIZE_T                    dwLength
+);
+
+
+BOOL WINAPI SetProcessMitigationPolicy(
+  _In_ PROCESS_MITIGATION_POLICY MitigationPolicy,
+  _In_ PVOID                     lpBuffer,
+  _In_ SIZE_T                    dwLength
+);
+
+
+BOOL WINAPI GetProductInfo(
+  _In_  DWORD  dwOSMajorVersion,
+  _In_  DWORD  dwOSMinorVersion,
+  _In_  DWORD  dwSpMajorVersion,
+  _In_  DWORD  dwSpMinorVersion,
+  _Out_ PDWORD pdwReturnedProductType
+);
+
+
+NTSTATUS NtSetInformationFile(
+  HANDLE                 FileHandle,
+  PIO_STATUS_BLOCK       IoStatusBlock,
+  PVOID                  FileInformation,
+  ULONG                  Length,
+  FILE_INFORMATION_CLASS FileInformationClass
+);
+
+
+BOOL GetProcessMemoryInfo(
+  HANDLE                   Process,
+  PPROCESS_MEMORY_COUNTERS ppsmemCounters,
+  DWORD                    cb
+);
+
+
+HMODULE WINAPI GetModuleHandleA(
+  _In_opt_ LPCSTR lpModuleName
+);
+
+HMODULE WINAPI GetModuleHandleW(
+  _In_opt_ LPWSTR lpModuleName
+);
+
+
+BOOLEAN RtlEqualUnicodeString(
+  PUNICODE_STRING String1,
+  PUNICODE_STRING String2,
+  BOOLEAN          CaseInSensitive
+);
+
+
+DWORD WINAPI GetFirmwareEnvironmentVariableA(
+  _In_ LPCSTR lpName,
+  _In_ LPCSTR lpGuid,
+  _Out_ PVOID pBuffer,
+  _In_ DWORD    nSize
+);
+
+DWORD WINAPI GetFirmwareEnvironmentVariableW(
+  _In_ LPCWSTR lpName,
+  _In_ LPCWSTR lpGuid,
+  _Out_ PVOID pBuffer,
+  _In_ DWORD    nSize
+);
+
+DWORD WINAPI GetFirmwareEnvironmentVariableExA(
+  _In_ LPCSTR lpName,
+  _In_ LPCSTR lpGuid,
+  _Out_ PVOID pBuffer,
+  _In_ DWORD    nSize,
+  _Out_ PDWORD pdwAttribubutes
+);
+
+DWORD WINAPI GetFirmwareEnvironmentVariableExW(
+  _In_ LPCWSTR lpName,
+  _In_ LPCWSTR lpGuid,
+  _Out_ PVOID pBuffer,
+  _In_ DWORD    nSize,
+  _Out_ PDWORD pdwAttribubutes
+);
+
+NTSTATUS WINAPI NtEnumerateSystemEnvironmentValuesEx(
+    _In_ ULONG InformationClass,
+    _In_ PVOID Buffer,
+    _In_ ULONG BufferLength
+);
+
+
@@ -0,0 +1,158 @@
+NTSTATUS WINAPI NtAlpcCreatePort(
+    _Out_ PHANDLE PortHandle,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes
+);
+
+NTSTATUS WINAPI NtAlpcQueryInformation(
+    _In_opt_ HANDLE PortHandle,
+    _In_ ALPC_PORT_INFORMATION_CLASS PortInformationClass,
+    _Inout_opt_ PVOID PortInformation,
+    _In_ ULONG Length,
+    _Out_opt_ PULONG ReturnLength
+);
+
+
+NTSTATUS WINAPI NtAlpcQueryInformationMessage(
+    _In_ HANDLE PortHandle,
+    _In_ PPORT_MESSAGE PortMessage,
+    _In_ ALPC_MESSAGE_INFORMATION_CLASS MessageInformationClass,
+    _Out_opt_ PVOID MessageInformation,
+    _In_ ULONG Length,
+    _Out_opt_ PULONG ReturnLength
+);
+
+NTSTATUS WINAPI NtAlpcConnectPort(
+    _Out_ PHANDLE PortHandle,
+    _In_ PUNICODE_STRING PortName,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
+    _In_ ULONG Flags,
+    _In_opt_ PSID RequiredServerSid,
+    _Inout_opt_ PPORT_MESSAGE ConnectionMessage,
+    _Inout_opt_ PULONG BufferLength,
+    _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,
+    _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,
+    _In_opt_ PLARGE_INTEGER Timeout
+);
+
+NTSTATUS WINAPI NtAlpcConnectPortEx(
+    _Out_ PHANDLE PortHandle,
+    _In_ POBJECT_ATTRIBUTES ConnectionPortObjectAttributes,
+    _In_opt_ POBJECT_ATTRIBUTES ClientPortObjectAttributes,
+    _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
+    _In_ ULONG Flags,
+    _In_opt_ PSECURITY_DESCRIPTOR ServerSecurityRequirements,
+    _Inout_opt_ PPORT_MESSAGE ConnectionMessage,
+    _Inout_opt_ PSIZE_T BufferLength,
+    _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,
+    _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,
+    _In_opt_ PLARGE_INTEGER Timeout
+);
+
+
+NTSTATUS WINAPI NtAlpcAcceptConnectPort(
+    _Out_ PHANDLE PortHandle,
+    _In_ HANDLE ConnectionPortHandle,
+    _In_ ULONG Flags,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
+    _In_opt_ PVOID PortContext,
+    _In_ PPORT_MESSAGE ConnectionRequest,
+    _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ConnectionMessageAttributes,
+    _In_ BOOLEAN AcceptConnection
+);
+
+NTSTATUS WINAPI AlpcInitializeMessageAttribute(
+    _In_ ULONG AttributeFlags,
+    _Out_opt_ PALPC_MESSAGE_ATTRIBUTES Buffer,
+    _In_ ULONG BufferSize,
+    _Out_ PULONG RequiredBufferSize
+);
+
+PVOID WINAPI AlpcGetMessageAttribute(
+    _In_ PALPC_MESSAGE_ATTRIBUTES Buffer,
+    _In_ ULONG AttributeFlag
+);
+
+NTSTATUS WINAPI NtAlpcSendWaitReceivePort(
+    _In_ HANDLE PortHandle,
+    _In_ ULONG Flags,
+    _In_opt_ PPORT_MESSAGE SendMessage,
+    _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES SendMessageAttributes,
+    _Out_opt_ PPORT_MESSAGE ReceiveMessage,
+    _Inout_opt_ PSIZE_T BufferLength,
+    _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ReceiveMessageAttributes,
+    _In_opt_ PLARGE_INTEGER Timeout
+);
+
+NTSTATUS WINAPI NtAlpcDisconnectPort(
+    _In_ HANDLE PortHandle,
+    _In_ ULONG Flags
+);
+
+NTSTATUS WINAPI NtAlpcCreatePortSection(
+    _In_ HANDLE PortHandle,
+    _In_ ULONG Flags,
+    _In_opt_ HANDLE SectionHandle,
+    _In_ SIZE_T SectionSize,
+    _Out_ PALPC_HANDLE AlpcSectionHandle,
+    _Out_ PSIZE_T ActualSectionSize
+    );
+
+NTSTATUS WINAPI NtAlpcDeletePortSection(
+    _In_ HANDLE PortHandle,
+    _Reserved_ ULONG Flags,
+    _In_ ALPC_HANDLE SectionHandle
+    );
+
+
+
+NTSTATUS WINAPI NtAlpcCreateResourceReserve(
+    _In_ HANDLE PortHandle,
+    _Reserved_ ULONG Flags,
+    _In_ SIZE_T MessageSize,
+    _Out_ PALPC_HANDLE ResourceId
+    );
+
+
+NTSTATUS WINAPI NtAlpcDeleteResourceReserve(
+    _In_ HANDLE PortHandle,
+    _Reserved_ ULONG Flags,
+    _In_ ALPC_HANDLE ResourceId
+    );
+
+
+NTSTATUS WINAPI NtAlpcCreateSectionView(
+    _In_ HANDLE PortHandle,
+    _Reserved_ ULONG Flags,
+    _Inout_ PALPC_DATA_VIEW_ATTR ViewAttributes
+    );
+
+
+NTSTATUS WINAPI NtAlpcDeleteSectionView(
+    _In_ HANDLE PortHandle,
+    _Reserved_ ULONG Flags,
+    _In_ PVOID ViewBase
+    );
+
+
+NTSTATUS WINAPI NtAlpcCreateSecurityContext(
+    _In_ HANDLE PortHandle,
+    _Reserved_ ULONG Flags,
+    _Inout_ PALPC_SECURITY_ATTR SecurityAttribute
+    );
+
+
+NTSTATUS WINAPI NtAlpcDeleteSecurityContext(
+    _In_ HANDLE PortHandle,
+    _Reserved_ ULONG Flags,
+    _In_ ALPC_HANDLE ContextHandle
+    );
+
+
+NTSTATUS WINAPI NtAlpcRevokeSecurityContext(
+    _In_ HANDLE PortHandle,
+    _Reserved_ ULONG Flags,
+    _In_ ALPC_HANDLE ContextHandle
+    );
@@ -4,6 +4,15 @@ BOOL WINAPI CryptCATAdminCalcHashFromFileHandle(
    _Out_opt_ BYTE *pbHash,
    __in DWORD dwFlags);

+
+BOOL CryptCATAdminCalcHashFromFileHandle2(
+  HCATADMIN hCatAdmin,
+  HANDLE    hFile,
+  DWORD     *pcbHash,
+  BYTE      *pbHash,
+  DWORD     dwFlags
+);
+
 HCATINFO WINAPI CryptCATAdminEnumCatalogFromHash(
    __in HCATADMIN hCatAdmin,
    __in BYTE *pbHash,
@@ -17,6 +26,14 @@ BOOL WINAPI CryptCATAdminAcquireContext(
  _In_        DWORD     dwFlags
 );

+BOOL CryptCATAdminAcquireContext2(
+  HCATADMIN               *phCatAdmin,
+  GUID              *pgSubsystem,
+  PCWSTR                  pwszHashAlgorithm,
+  PCCERT_STRONG_SIGN_PARA pStrongHashPolicy,
+  DWORD                   dwFlags
+);
+
 BOOL WINAPI CryptCATCatalogInfoFromContext(
  _In_    HCATINFO     hCatInfo,
  _Inout_ CATALOG_INFO *psCatInfo,
@@ -188,6 +205,10 @@ BOOL WINAPI CertAddCertificateContextToStore(
  _Out_opt_ PCCERT_CONTEXT *ppStoreContext
 );

+BOOL WINAPI CertFreeCertificateContext(
+  _In_ PCCERT_CONTEXT pCertContext
+);
+

 BOOL WINAPI PFXExportCertStoreEx(
  _In_    HCERTSTORE      hStore,
@@ -341,4 +362,156 @@ BOOL WINAPI CryptUIDlgViewContext(
  _In_       LPCWSTR pwszTitle,
  _In_       DWORD   dwFlags,
  _In_       PVOID   pvReserved
+);
+
+BOOL WINAPI CryptMsgVerifyCountersignatureEncoded(
+  _In_ HCRYPTPROV_LEGACY hCryptProv,
+  _In_ DWORD             dwEncodingType,
+  _In_ PBYTE             pbSignerInfo,
+  _In_ DWORD             cbSignerInfo,
+  _In_ PBYTE             pbSignerInfoCountersignature,
+  _In_ DWORD             cbSignerInfoCountersignature,
+  _In_ PCERT_INFO        pciCountersigner
+);
+
+BOOL WINAPI CryptMsgVerifyCountersignatureEncodedEx(
+  _In_opt_   HCRYPTPROV_LEGACY hCryptProv,
+  _In_       DWORD             dwEncodingType,
+  _In_       PBYTE             pbSignerInfo,
+  _In_       DWORD             cbSignerInfo,
+  _In_       PBYTE             pbSignerInfoCountersignature,
+  _In_       DWORD             cbSignerInfoCountersignature,
+  _In_       DWORD             dwSignerType,
+  _In_       PVOID             pvSigner,
+  _Reserved_ DWORD             dwFlags,
+  _Reserved_ PVOID             pvExtra
+);
+
+BOOL WINAPI CryptHashCertificate(
+  _In_          HCRYPTPROV_LEGACY hCryptProv,
+  _In_          ALG_ID            Algid,
+  _In_          DWORD             dwFlags,
+  _In_          BYTE              *pbEncoded,
+  _In_          DWORD             cbEncoded,
+  _Out_         BYTE              *pbComputedHash,
+  _Inout_       DWORD             *pcbComputedHash
+);
+
+
+BOOL CryptSignMessage(
+  PCRYPT_SIGN_MESSAGE_PARA pSignPara,
+  BOOL                     fDetachedSignature,
+  DWORD                    cToBeSigned,
+  PBYTE                 *rgpbToBeSigned,
+  DWORD                 *rgcbToBeSigned,
+  BYTE                     *pbSignedBlob,
+  DWORD                    *pcbSignedBlob
+);
+
+
+BOOL CryptSignAndEncryptMessage(
+  PCRYPT_SIGN_MESSAGE_PARA    pSignPara,
+  PCRYPT_ENCRYPT_MESSAGE_PARA pEncryptPara,
+  DWORD                       cRecipientCert,
+  PCCERT_CONTEXT           *rgpRecipientCert,
+  BYTE                  *pbToBeSignedAndEncrypted,
+  DWORD                       cbToBeSignedAndEncrypted,
+  BYTE                        *pbSignedAndEncryptedBlob,
+  DWORD                       *pcbSignedAndEncryptedBlob
+);
+
+BOOL CryptVerifyMessageSignature(
+  PCRYPT_VERIFY_MESSAGE_PARA pVerifyPara,
+  DWORD                      dwSignerIndex,
+  BYTE                 *pbSignedBlob,
+  DWORD                      cbSignedBlob,
+  BYTE                       *pbDecoded,
+  DWORD                      *pcbDecoded,
+  PCCERT_CONTEXT             *ppSignerCert
+);
+
+BOOL CryptVerifyMessageSignatureWithKey(
+  PCRYPT_KEY_VERIFY_MESSAGE_PARA pVerifyPara,
+  PCERT_PUBLIC_KEY_INFO          pPublicKeyInfo,
+  BYTE                     *pbSignedBlob,
+  DWORD                          cbSignedBlob,
+  BYTE                           *pbDecoded,
+  DWORD                          *pcbDecoded
+);
+
+
+BOOL CryptVerifyMessageHash(
+  PCRYPT_HASH_MESSAGE_PARA pHashPara,
+  BYTE                     *pbHashedBlob,
+  DWORD                    cbHashedBlob,
+  BYTE                     *pbToBeHashed,
+  DWORD                    *pcbToBeHashed,
+  BYTE                     *pbComputedHash,
+  DWORD                    *pcbComputedHash
+);
+
+
+
+PCCERT_CONTEXT PfnCryptGetSignerCertificate(
+  PVOID pvGetArg,
+  DWORD dwCertEncodingType,
+  PCERT_INFO pSignerId,
+  HCERTSTORE hMsgCertStore
+);
+
+
+BOOL CryptEncrypt(
+  HCRYPTKEY  hKey,
+  HCRYPTHASH hHash,
+  BOOL       Final,
+  DWORD      dwFlags,
+  BYTE       *pbData,
+  DWORD      *pdwDataLen,
+  DWORD      dwBufLen
+);
+
+
+BOOL CryptDecrypt(
+  HCRYPTKEY  hKey,
+  HCRYPTHASH hHash,
+  BOOL       Final,
+  DWORD      dwFlags,
+  BYTE       *pbData,
+  DWORD      *pdwDataLen
+);
+
+HCRYPTMSG CryptMsgOpenToEncode(
+  DWORD             dwMsgEncodingType,
+  DWORD             dwFlags,
+  DWORD             dwMsgType,
+  PVOID             pvMsgEncodeInfo,
+  LPSTR             pszInnerContentObjID,
+  PCMSG_STREAM_INFO pStreamInfo
+);
+
+HCRYPTMSG CryptMsgOpenToDecode(
+  DWORD             dwMsgEncodingType,
+  DWORD             dwFlags,
+  DWORD             dwMsgType,
+  HCRYPTPROV_LEGACY hCryptProv,
+  PCERT_INFO        pRecipientInfo,
+  PCMSG_STREAM_INFO pStreamInfo
+);
+
+BOOL CryptMsgUpdate(
+  HCRYPTMSG  hCryptMsg,
+  BYTE      *pbData,
+  DWORD      cbData,
+  BOOL       fFinal
+);
+
+BOOL CryptMsgControl(
+  HCRYPTMSG  hCryptMsg,
+  DWORD      dwFlags,
+  DWORD      dwCtrlType,
+  PVOID      pvCtrlPara
+);
+
+BOOL CryptMsgClose(
+  HCRYPTMSG hCryptMsg
 );
@@ -0,0 +1,225 @@
+HANDLE WINAPI OpenEventLogA(
+  _In_ LPCSTR lpUNCServerName,
+  _In_ LPCSTR lpSourceName
+);
+
+HANDLE WINAPI OpenEventLogW(
+  _In_ LPWSTR lpUNCServerName,
+  _In_ LPWSTR lpSourceName
+);
+
+
+HANDLE WINAPI OpenBackupEventLogA(
+  _In_ LPCSTR lpUNCServerName,
+  _In_ LPCSTR lpSourceName
+);
+
+HANDLE WINAPI OpenBackupEventLogW(
+  _In_ LPWSTR lpUNCServerName,
+  _In_ LPWSTR lpSourceName
+);
+
+
+BOOL WINAPI ReadEventLogA(
+  _In_  HANDLE hEventLog,
+  _In_  DWORD  dwReadFlags,
+  _In_  DWORD  dwRecordOffset,
+  _Out_ LPVOID lpBuffer,
+  _In_  DWORD  nNumberOfBytesToRead,
+  _Out_ DWORD  *pnBytesRead,
+  _Out_ DWORD  *pnMinNumberOfBytesNeeded
+);
+
+BOOL WINAPI ReadEventLogW(
+  _In_  HANDLE hEventLog,
+  _In_  DWORD  dwReadFlags,
+  _In_  DWORD  dwRecordOffset,
+  _Out_ LPVOID lpBuffer,
+  _In_  DWORD  nNumberOfBytesToRead,
+  _Out_ DWORD  *pnBytesRead,
+  _Out_ DWORD  *pnMinNumberOfBytesNeeded
+);
+
+BOOL WINAPI GetEventLogInformation(
+  _In_  HANDLE  hEventLog,
+  _In_  DWORD   dwInfoLevel,
+  _Out_ LPVOID  lpBuffer,
+  _In_  DWORD   cbBufSize,
+  _Out_ LPDWORD pcbBytesNeeded
+);
+
+BOOL WINAPI GetNumberOfEventLogRecords(
+  _In_  HANDLE hEventLog,
+  _Out_ PDWORD NumberOfRecords
+);
+
+BOOL WINAPI CloseEventLog(
+  _Inout_ HANDLE hEventLog
+);
+
+
+/* Event logging */
+
+EVT_HANDLE WINAPI EvtOpenLog(
+  _In_ EVT_HANDLE Session,
+  _In_ LPCWSTR    Path,
+  _In_ DWORD      Flags
+);
+
+
+EVT_HANDLE WINAPI EvtQuery(
+  _In_ EVT_HANDLE Session,
+  _In_ LPCWSTR    Path,
+  _In_ LPCWSTR    Query,
+  _In_ DWORD      Flags
+);
+
+
+BOOL WINAPI EvtNext(
+  _In_  EVT_HANDLE  ResultSet,
+  _In_  DWORD       EventArraySize,
+  _In_  EVT_HANDLE* EventArray,
+  _In_  DWORD       Timeout,
+  _In_  DWORD       Flags,
+  _Out_ PDWORD      Returned
+);
+
+EVT_HANDLE WINAPI EvtCreateRenderContext(
+  _In_ DWORD   ValuePathsCount,
+  _In_ LPCWSTR *ValuePaths,
+  _In_ DWORD   Flags
+);
+
+BOOL WINAPI EvtRender(
+  _In_  EVT_HANDLE Context,
+  _In_  EVT_HANDLE Fragment,
+  _In_  DWORD      Flags,
+  _In_  DWORD      BufferSize,
+  _In_  PVOID      Buffer,
+  _Out_ PDWORD     BufferUsed,
+  _Out_ PDWORD     PropertyCount
+);
+
+
+BOOL WINAPI EvtClose(
+  _In_ EVT_HANDLE Object
+);
+
+
+EVT_HANDLE WINAPI EvtOpenChannelEnum(
+  _In_ EVT_HANDLE Session,
+  _In_ DWORD      Flags
+);
+
+BOOL WINAPI EvtNextChannelPath(
+  _In_  EVT_HANDLE ChannelEnum,
+  _In_  DWORD      ChannelPathBufferSize,
+  _In_  LPWSTR     ChannelPathBuffer,
+  _Out_ PDWORD     ChannelPathBufferUsed
+);
+
+EVT_HANDLE WINAPI EvtOpenPublisherEnum(
+  _In_ EVT_HANDLE Session,
+  _In_ DWORD      Flags
+);
+
+
+BOOL WINAPI EvtNextPublisherId(
+  _In_  EVT_HANDLE PublisherEnum,
+  _In_  DWORD      PublisherIdBufferSize,
+  _In_  LPWSTR     PublisherIdBuffer,
+  _Out_ PDWORD     PublisherIdBufferUsed
+);
+
+
+BOOL WINAPI EvtGetLogInfo(
+  _In_  EVT_HANDLE          Log,
+  _In_  EVT_LOG_PROPERTY_ID PropertyId,
+  _In_  DWORD               PropertyValueBufferSize,
+  _In_  PEVT_VARIANT        PropertyValueBuffer,
+  _Out_ PDWORD              PropertyValueBufferUsed
+);
+
+
+EVT_HANDLE WINAPI EvtOpenChannelConfig(
+  _In_ EVT_HANDLE Session,
+  _In_ LPCWSTR    ChannelPath,
+  _In_ DWORD      Flags
+);
+
+BOOL WINAPI EvtGetChannelConfigProperty(
+  _In_  EVT_HANDLE                     ChannelConfig,
+  _In_  EVT_CHANNEL_CONFIG_PROPERTY_ID PropertyId,
+  _In_  DWORD                          Flags,
+  _In_  DWORD                          PropertyValueBufferSize,
+  _In_  PEVT_VARIANT                   PropertyValueBuffer,
+  _Out_ PDWORD                         PropertyValueBufferUsed
+);
+
+EVT_HANDLE WINAPI EvtOpenPublisherMetadata(
+  _In_opt_ EVT_HANDLE Session,
+  _In_     LPCWSTR    PublisherIdentity,
+  _In_opt_ LPCWSTR    LogFilePath,
+  _In_     LCID       Locale,
+  _In_     DWORD      Flags
+);
+
+EVT_HANDLE WINAPI EvtOpenEventMetadataEnum(
+  _In_ EVT_HANDLE PublisherMetadata,
+  _In_ DWORD      Flags
+);
+
+EVT_HANDLE WINAPI EvtNextEventMetadata(
+  _In_ EVT_HANDLE EventMetadataEnum,
+  _In_ DWORD      Flags
+);
+
+BOOL WINAPI EvtGetEventMetadataProperty(
+  _In_  EVT_HANDLE                     EventMetadata,
+  _In_  EVT_EVENT_METADATA_PROPERTY_ID PropertyId,
+  _In_  DWORD                          Flags,
+  _In_  DWORD                          EventMetadataPropertyBufferSize,
+  _In_  PEVT_VARIANT                   EventMetadataPropertyBuffer,
+  _Out_ PDWORD                         EventMetadataPropertyBufferUsed
+);
+
+
+BOOL WINAPI EvtGetPublisherMetadataProperty(
+  _In_  EVT_HANDLE                         PublisherMetadata,
+  _In_  EVT_PUBLISHER_METADATA_PROPERTY_ID PropertyId,
+  _In_  DWORD                              Flags,
+  _In_  DWORD                              PublisherMetadataPropertyBufferSize,
+  _In_  PEVT_VARIANT                       PublisherMetadataPropertyBuffer,
+  _Out_ PDWORD                             PublisherMetadataPropertyBufferUsed
+);
+
+
+BOOL WINAPI EvtGetObjectArraySize(
+  _In_  EVT_OBJECT_ARRAY_PROPERTY_HANDLE ObjectArray,
+  _Out_ PDWORD                           ObjectArraySize
+);
+
+
+BOOL WINAPI EvtGetObjectArrayProperty(
+  _In_  EVT_OBJECT_ARRAY_PROPERTY_HANDLE ObjectArray,
+  _In_  DWORD                            PropertyId,
+  _In_  DWORD                            ArrayIndex,
+  _In_  DWORD                            Flags,
+  _In_  DWORD                            PropertyValueBufferSize,
+  _In_  PEVT_VARIANT                     PropertyValueBuffer,
+  _Out_ PDWORD                           PropertyValueBufferUsed
+);
+
+
+BOOL WINAPI EvtFormatMessage(
+  _In_  EVT_HANDLE   PublisherMetadata,
+  _In_  EVT_HANDLE   Event,
+  _In_  DWORD        MessageId,
+  _In_  DWORD        ValueCount,
+  _In_  PEVT_VARIANT Values,
+  _In_  DWORD        Flags,
+  _In_  DWORD        BufferSize,
+  _In_  LPWSTR       Buffer,
+  _Out_ PDWORD       BufferUsed
+);
+
@@ -0,0 +1,47 @@
+NTSTATUS WINAPI TpCallbackSendAlpcMessageOnCompletion(
+    _In_ HANDLE TpHandle,
+    _In_ HANDLE PortHandle,
+    _In_ ULONG Flags,
+    _In_opt_ PPORT_MESSAGE SendMessage,
+);
+
+
+NTSTATUS NtQueryLicenseValue(
+    PUNICODE_STRING Name,
+    ULONG *Type,
+    PVOID Buffer,
+    ULONG Length,
+    ULONG *DataLength
+);
+
+NTSTATUS WINAPI NtQueryEaFile(
+    _In_ HANDLE FileHandle,
+    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
+    _Out_writes_bytes_(Length) PVOID Buffer,
+    _In_ ULONG Length,
+    _In_ BOOLEAN ReturnSingleEntry,
+    _In_reads_bytes_opt_(EaListLength) PVOID EaList,
+    _In_ ULONG EaListLength,
+    _In_opt_ PULONG EaIndex,
+    _In_ BOOLEAN RestartScan
+);
+
+NTSTATUS WINAPI NtSetEaFile(
+    _In_ HANDLE FileHandle,
+    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
+    _In_reads_bytes_(Length) PVOID Buffer,
+    _In_ ULONG Length
+);
+
+
+NTSTATUS WINAPI NtCreateProcessEx(
+   _Out_ PHANDLE ProcessHandle,
+   _In_ ACCESS_MASK DesiredAccess,
+   _In_ POBJECT_ATTRIBUTES ObjectAttributes,
+   _In_ HANDLE ParentProcess,
+   _In_ ULONG Flags,
+   _In_ HANDLE SectionHandle,
+   _In_ HANDLE DebugPort,
+   _In_ HANDLE ExceptionPort,
+   _In_ BOOLEAN InJob
+);
@@ -0,0 +1,29 @@
+import ctypes
+from flag import Flag
+
+class NtStatusException(WindowsError):
+    ALL_STATUS = {}
+    def __init__(self , code):
+        try:
+            x = self.ALL_STATUS[code]
+        except KeyError:
+            x = (code, 'UNKNOW_ERROR', 'Error non documented in ntstatus.py')
+        self.code = x[0]
+        self.name = x[1]
+        self.descr = x[2]
+        x =  ctypes.c_long(x[0]).value, x[1], x[2]
+        return super(NtStatusException, self).__init__(*x)
+
+    def __str__(self):
+        return "{e.name}(0x{e.code:x}): {e.descr}".format(e=self)
+
+    def __repr__(self):
+        return "{0}(0x{1:08x}, {2})".format(type(self).__name__, self.code, self.name)
+
+    @classmethod
+    def register_ntstatus(cls, code, name, descr):
+        if code in cls.ALL_STATUS:
+            return # Use the first def
+        cls.ALL_STATUS[code] = (code, name, descr)
+        return Flag(name, code)
+
@@ -0,0 +1,150 @@
+VOID = DWORD // This one is a 'cheat' to handle function returning void in ctypes
+BYTE = c_ubyte
+PWSTR = LPWSTR
+PCWSTR = LPWSTR
+SIZE_T = c_size_t
+PSIZE_T = POINTER(SIZE_T)
+PVOID = c_void_p
+NTSTATUS = DWORD
+SECURITY_INFORMATION = DWORD
+PSECURITY_INFORMATION = POINTER(SECURITY_INFORMATION)
+PULONG = POINTER(ULONG)
+PDWORD = POINTER(DWORD)
+LPDWORD = POINTER(DWORD)
+LPBYTE = POINTER(BYTE)
+ULONG_PTR = PVOID
+LONG_PTR = PVOID
+DWORD_PTR = ULONG_PTR
+KAFFINITY = ULONG_PTR
+KPRIORITY = LONG
+CHAR = c_char
+UCHAR = c_char
+CSHORT = c_short
+VARTYPE = c_ushort
+PUSHORT = POINTER(USHORT)
+PBOOL = POINTER(BOOL)
+LPBOOL = PBOOL
+PSTR = LPSTR
+PCSTR = LPSTR
+va_list = c_char_p
+BSTR = c_wchar_p
+OLECHAR = c_wchar
+POLECHAR = c_wchar_p
+PUCHAR = POINTER(UCHAR)
+double = c_double
+DATE = double
+ULONGLONG = c_ulonglong
+PULONGLONG = POINTER(ULONGLONG)
+LONGLONG = c_longlong
+ULONG64 = c_ulonglong
+UINT64 = ULONG64
+LONG64 = c_longlong
+PLARGE_INTEGER = POINTER(LARGE_INTEGER)
+DWORD64 = ULONG64
+PDWORD64 = POINTER(DWORD64)
+SCODE = LONG
+CIMTYPE = LONG
+NET_IFINDEX = ULONG
+IF_INDEX = NET_IFINDEX
+IFTYPE = ULONG
+PLONG64 = POINTER(LONG64)
+PULONG64 = POINTER(ULONG64)
+PBYTE = POINTER(BYTE)
+PUINT = POINTER(UINT)
+PHKEY = POINTER(HKEY)
+ACCESS_MASK = DWORD
+REGSAM = ACCESS_MASK
+PBOOLEAN = POINTER(BOOLEAN)
+SECURITY_CONTEXT_TRACKING_MODE = BOOLEAN
+HCRYPTPROV_LEGACY = PULONG
+HCRYPTKEY = PULONG
+HCRYPTPROV = PULONG
+HCRYPTHASH = PULONG
+ALG_ID = UINT
+DISPID = LONG
+MEMBERID = DISPID
+LRESULT = LONG_PTR
+LPUNKNOWN = POINTER(PVOID)
+LPFILETIME = POINTER(FILETIME)
+LPPOINT = POINTER(POINT)
+LPRECT = POINTER(RECT)
+SPC_UUID = BYTE * 16
+DEVICE_TYPE = DWORD
+PWINDBG_EXTENSION_APIS32 = PVOID
+PWINDBG_EXTENSION_APIS64 = PVOID
+
+NCRYPT_HANDLE = ULONG_PTR
+NCRYPT_PROV_HANDLE = ULONG_PTR
+NCRYPT_KEY_HANDLE = ULONG_PTR
+NCRYPT_HASH_HANDLE = ULONG_PTR
+NCRYPT_SECRET_HANDLE  = ULONG_PTR
+
+/* INT sized*/
+
+INT8 = c_byte // signed | our BYTE is unsigned
+INT16 = SHORT
+INT32 = INT
+INT64 = LONGLONG
+
+UINT8 = BYTE
+UINT16 = USHORT
+UINT32 = UINT
+UINT64 = ULONGLONG
+
+/* HANDLES */
+
+PHANDLE = POINTER(HANDLE)
+HCATADMIN = HANDLE
+HCATINFO = HANDLE
+HCERTCHAINENGINE = HANDLE
+LPHANDLE = POINTER(HANDLE)
+ALPC_HANDLE = HANDLE
+PALPC_HANDLE = POINTER(ALPC_HANDLE)
+HCURSOR = HANDLE
+HBRUSH = HANDLE
+HCRYPTPROV_OR_NCRYPT_KEY_HANDLE = PULONG
+EVT_HANDLE = HANDLE
+EVT_OBJECT_ARRAY_PROPERTY_HANDLE = HANDLE
+
+/* Security */
+
+PSECURITY_DESCRIPTOR = PVOID
+
+SECURITY_DESCRIPTOR_CONTROL = WORD
+PSECURITY_DESCRIPTOR_CONTROL = POINTER(SECURITY_DESCRIPTOR_CONTROL)
+
+ACCESS_MASK = DWORD
+PACCESS_MASK = POINTER(ACCESS_MASK)
+
+SECURITY_INFORMATION = DWORD
+PSECURITY_INFORMATION = POINTER(SECURITY_INFORMATION)
+PSECURITY_ATTRIBUTES_OPAQUE = PVOID
+SID_HASH_ENTRY = ULONG_PTR
+PSID_HASH_ENTRY = POINTER(SID_HASH_ENTRY)
+
+PSID = PVOID
+
+/* COM STUFF */
+
+RPCOLEDATAREP = ULONG
+
+/* Function PTR */
+
+WNDPROC = PVOID
+LPPROC_THREAD_ATTRIBUTE_LIST = PVOID
+PPS_POST_PROCESS_INIT_ROUTINE = PVOID
+LPTHREAD_START_ROUTINE = PVOID
+WNDENUMPROC = PVOID
+PHANDLER_ROUTINE = PVOID
+FARPROC = PVOID
+PIO_APC_ROUTINE = PVOID
+PVECTORED_EXCEPTION_HANDLER = PVOID
+PFN_CRYPT_GET_SIGNER_CERTIFICATE = PVOID
+
+// Will be changed at import time
+
+LPCONTEXT = PVOID
+HCERTSTORE = PVOID
+HCRYPTMSG = PVOID
+PALPC_PORT_ATTRIBUTES = PVOID
+PPORT_MESSAGE = PVOID
@@ -16,6 +16,13 @@ typedef enum _ALPC_PORT_INFORMATION_CLASS
    MaxAlpcPortInfoClass
 } ALPC_PORT_INFORMATION_CLASS;

+typedef enum _ALPC_MESSAGE_INFORMATION_CLASS
+{
+    AlpcMessageSidInformation,
+    AlpcMessageTokenModifiedIdInformation,
+    MaxAlpcMessageInfoClass,
+    AlpcMessageHandleInformation,
+} ALPC_MESSAGE_INFORMATION_CLASS, *PALPC_MESSAGE_INFORMATION_CLASS;

 typedef struct _ALPC_PORT_ATTRIBUTES32
 {
@@ -0,0 +1,154 @@
+typedef struct tagMULTI_QI {
+  IID *pIID;
+  PVOID  *pItf;
+  HRESULT   hr;
+} MULTI_QI;
+
+
+typedef struct _COAUTHIDENTITY {
+  USHORT *User;
+  ULONG  UserLength;
+  USHORT *Domain;
+  ULONG  DomainLength;
+  USHORT *Password;
+  ULONG  PasswordLength;
+  ULONG  Flags;
+} COAUTHIDENTITY;
+
+typedef struct _COAUTHINFO {
+  DWORD          dwAuthnSvc;
+  DWORD          dwAuthzSvc;
+  LPWSTR         pwszServerPrincName;
+  DWORD          dwAuthnLevel;
+  DWORD          dwImpersonationLevel;
+  COAUTHIDENTITY *pAuthIdentityData;
+  DWORD          dwCapabilities;
+} COAUTHINFO;
+
+typedef struct _COSERVERINFO {
+  DWORD      dwReserved1;
+  LPWSTR     pwszName;
+  COAUTHINFO *pAuthInfo;
+  DWORD      dwReserved2;
+} COSERVERINFO;
+
+
+typedef struct _CALLFRAMEPARAMINFO{
+  BOOLEAN fIn;
+  BOOLEAN fOut;
+  ULONG   stackOffset;
+  ULONG   cbParam;
+} CALLFRAMEPARAMINFO;
+
+typedef struct _CALLFRAMEINFO{
+  ULONG iMethod;
+  BOOL  fHasInValues;
+  BOOL  fHasInOutValues;
+  BOOL  fHasOutValues;
+  BOOL  fDerivesFromIDispatch;
+  LONG  cInInterfacesMax;
+  LONG  cInOutInterfacesMax;
+  LONG  cOutInterfacesMax;
+  LONG  cTopLevelInInterfaces;
+  IID   iid;
+  ULONG cMethod;
+  ULONG cParams;
+} CALLFRAMEINFO;
+
+
+typedef struct _CALLFRAME_MARSHALCONTEXT{
+  BOOLEAN  fIn;
+  DWORD    dwDestContext;
+  LPVOID   pvDestContext;
+  PVOID *mshlmgr; // Was <IUnknown> how can I do for this circle dep ?
+  GUID     guidTransferSyntax;
+} CALLFRAME_MARSHALCONTEXT;
+
+
+typedef enum  _CALLFRAME_COPY{
+  CALLFRAME_COPY_NESTED       = 1,
+  CALLFRAME_COPY_INDEPENDENT  = 2
+} CALLFRAME_COPY;
+
+
+typedef enum tagMSHLFLAGS {
+  MSHLFLAGS_NORMAL       = 0,
+  MSHLFLAGS_TABLESTRONG  = 1,
+  MSHLFLAGS_TABLEWEAK    = 2,
+  MSHLFLAGS_NOPING       = 4
+} MSHLFLAGS;
+
+typedef enum tagCALLFRAME_WALK {
+  CALLFRAME_WALK_IN     = 1,
+  CALLFRAME_WALK_INOUT  = 2,
+  CALLFRAME_WALK_OUT    = 4
+} CALLFRAME_WALK;
+
+typedef struct tagSAFEARRAYBOUND
+{
+    ULONG cElements;
+    LONG lLbound;
+}   SAFEARRAYBOUND, *LPSAFEARRAYBOUND;
+
+
+typedef struct tagSAFEARRAY
+{
+  USHORT cDims;
+  USHORT fFeatures;
+  ULONG cbElements;
+  ULONG cLocks;
+  PVOID pvData;
+  SAFEARRAYBOUND rgsabound[ 1 ];
+}   SAFEARRAY;
+
+typedef struct __tagBRECORD {
+    PVOID pvRecord;
+    PVOID pRecInfo;
+} _tagBRECORD;
+
+union _ANON_TMP_variant_sub_union{
+    LONGLONG llVal;
+    LONG lVal;
+    BYTE bVal;
+    SHORT iVal;
+    FLOAT fltVal;
+    DOUBLE dblVal;
+    VARIANT_BOOL boolVal;
+    SCODE scode;
+    BSTR bstrVal;
+    PVOID punkVal;
+    PVOID pdispVal;
+    SAFEARRAY *parray;
+    BYTE *pbVal;
+    SHORT *piVal;
+    LONG *plVal;
+    LONGLONG *pllVal;
+    FLOAT *pfltVal;
+    DOUBLE *pdblVal;
+    VARIANT_BOOL *pboolVal;
+    SCODE *pscode;
+    BSTR *pbstrVal;
+    PVOID byref;
+    CHAR cVal;
+    USHORT uiVal;
+    ULONG ulVal;
+    ULONGLONG ullVal;
+    INT intVal;
+    UINT uintVal;
+    CHAR *pcVal;
+    USHORT *puiVal;
+    ULONG *pulVal;
+    ULONGLONG *pullVal;
+    INT *pintVal;
+    UINT *puintVal;
+    _tagBRECORD _VARIANT_NAME_4;
+};
+
+
+typedef struct __tagVARIANT {
+    VARTYPE vt;
+    WORD wReserved1;
+    WORD wReserved2;
+    WORD wReserved3;
+    _ANON_TMP_variant_sub_union _VARIANT_NAME_3;
+} _tagVARIANT, VARIANT, VARIANTARG, *LPVARIANT, *LPVARIANTARG;
@@ -0,0 +1,697 @@
+typedef struct _CERT_STRONG_SIGN_SERIALIZED_INFO {
+  DWORD  dwFlags;
+  LPWSTR pwszCNGSignHashAlgids;
+  LPWSTR pwszCNGPubKeyMinBitLengths;
+} CERT_STRONG_SIGN_SERIALIZED_INFO, *PCERT_STRONG_SIGN_SERIALIZED_INFO;
+
+typedef union TMP_CERT_STRONG_SIGN_PARA_UNION_TYPE {
+    PVOID                              pvInfo;
+    PCERT_STRONG_SIGN_SERIALIZED_INFO pSerializedInfo;
+    LPSTR                             pszOID;
+};
+
+typedef struct _CERT_STRONG_SIGN_PARA {
+  DWORD cbSize;
+  DWORD dwInfoChoice;
+  TMP_CERT_STRONG_SIGN_PARA_UNION_TYPE tmp_union;
+} CERT_STRONG_SIGN_PARA, *PCERT_STRONG_SIGN_PARA, *PCCERT_STRONG_SIGN_PARA;
+
+
+typedef struct _CRYPTOAPI_BLOB {
+    DWORD   cbData;
+    BYTE    *pbData;
+} CRYPT_INTEGER_BLOB, *PCRYPT_INTEGER_BLOB,
+CRYPT_UINT_BLOB, *PCRYPT_UINT_BLOB,
+CRYPT_OBJID_BLOB, *PCRYPT_OBJID_BLOB,
+CERT_NAME_BLOB, *PCERT_NAME_BLOB,
+CERT_RDN_VALUE_BLOB, *PCERT_RDN_VALUE_BLOB,
+CERT_BLOB, *PCERT_BLOB,
+CRL_BLOB, *PCRL_BLOB,
+DATA_BLOB, *PDATA_BLOB,
+CRYPT_DATA_BLOB, *PCRYPT_DATA_BLOB,
+CRYPT_HASH_BLOB, *PCRYPT_HASH_BLOB,
+CRYPT_DIGEST_BLOB, *PCRYPT_DIGEST_BLOB,
+CRYPT_DER_BLOB, *PCRYPT_DER_BLOB,
+CRYPT_ATTR_BLOB, *PCRYPT_ATTR_BLOB;
+
+typedef struct CRYPTCATATTRIBUTE_ {
+  DWORD  cbStruct;
+  LPWSTR pwszReferenceTag;
+  DWORD  dwAttrTypeAndAction;
+  DWORD  cbValue;
+  BYTE   *pbValue;
+  DWORD  dwReserved;
+} CRYPTCATATTRIBUTE, *PCRYPTCATATTRIBUTE;
+
+typedef struct _CRYPT_ATTRIBUTE_TYPE_VALUE {
+    LPSTR               pszObjId;
+    CRYPT_OBJID_BLOB    Value;
+} CRYPT_ATTRIBUTE_TYPE_VALUE, *PCRYPT_ATTRIBUTE_TYPE_VALUE;
+
+typedef struct _CRYPT_ALGORITHM_IDENTIFIER {
+    LPSTR               pszObjId;
+    CRYPT_OBJID_BLOB    Parameters;
+} CRYPT_ALGORITHM_IDENTIFIER, *PCRYPT_ALGORITHM_IDENTIFIER;
+
+typedef struct SIP_INDIRECT_DATA_
+{
+    CRYPT_ATTRIBUTE_TYPE_VALUE    Data;
+    CRYPT_ALGORITHM_IDENTIFIER    DigestAlgorithm;
+    CRYPT_HASH_BLOB               Digest;
+} SIP_INDIRECT_DATA, *PSIP_INDIRECT_DATA;
+
+typedef struct CRYPTCATMEMBER_ {
+  DWORD                     cbStruct;
+  LPWSTR                    pwszReferenceTag;
+  LPWSTR                    pwszFileName;
+  GUID                      gSubjectType;
+  DWORD                     fdwMemberFlags;
+  struct SIP_INDIRECT_DATA  *pIndirectData;
+  DWORD                     dwCertVersion;
+  DWORD                     dwReserved;
+  HANDLE                    hReserved;
+  CRYPT_ATTR_BLOB           sEncodedIndirectData;
+  CRYPT_ATTR_BLOB           sEncodedMemberInfo;
+} CRYPTCATMEMBER, *PCRYPTCATMEMBER;
+
+typedef struct WINTRUST_FILE_INFO_
+{
+    DWORD           cbStruct;
+    LPCWSTR         pcwszFilePath;
+    HANDLE          hFile;
+    GUID            *pgKnownSubject;
+} WINTRUST_FILE_INFO, *PWINTRUST_FILE_INFO;
+
+
+typedef struct _CRYPT_ATTRIBUTE {
+    LPSTR               pszObjId;
+    DWORD               cValue;
+    PCRYPT_ATTR_BLOB    rgValue;
+} CRYPT_ATTRIBUTE, *PCRYPT_ATTRIBUTE;
+
+
+typedef struct _CTL_ENTRY {
+    CRYPT_DATA_BLOB     SubjectIdentifier;
+    DWORD               cAttribute;
+    PCRYPT_ATTRIBUTE    rgAttribute;
+} CTL_ENTRY, *PCTL_ENTRY;
+
+
+typedef struct _CRYPT_ATTRIBUTE {
+    LPSTR               pszObjId;
+    DWORD               cValue;
+    PCRYPT_ATTR_BLOB    rgValue;
+} CRYPT_ATTRIBUTE, *PCRYPT_ATTRIBUTE;
+
+typedef struct _CRYPT_ATTRIBUTES {
+    DWORD                cAttr;
+    PCRYPT_ATTRIBUTE     rgAttr;
+} CRYPT_ATTRIBUTES, *PCRYPT_ATTRIBUTES;
+
+
+typedef struct _CERT_EXTENSION {
+    LPSTR               pszObjId;
+    BOOL                fCritical;
+    CRYPT_OBJID_BLOB    Value;
+} CERT_EXTENSION, *PCERT_EXTENSION;
+
+
+typedef struct _CRL_ENTRY {
+    CRYPT_INTEGER_BLOB  SerialNumber;
+    FILETIME            RevocationDate;
+    DWORD               cExtension;
+    PCERT_EXTENSION     rgExtension;
+} CRL_ENTRY, *PCRL_ENTRY;
+
+typedef struct _CRL_INFO {
+    DWORD                       dwVersion;
+    CRYPT_ALGORITHM_IDENTIFIER  SignatureAlgorithm;
+    CERT_NAME_BLOB              Issuer;
+    FILETIME                    ThisUpdate;
+    FILETIME                    NextUpdate;
+    DWORD                       cCRLEntry;
+    PCRL_ENTRY                  rgCRLEntry;
+    DWORD                       cExtension;
+    PCERT_EXTENSION             rgExtension;
+} CRL_INFO, *PCRL_INFO;
+
+
+typedef struct _CRL_CONTEXT {
+    DWORD                   dwCertEncodingType;
+    BYTE                    *pbCrlEncoded;
+    DWORD                   cbCrlEncoded;
+    PCRL_INFO               pCrlInfo;
+    HCERTSTORE              hCertStore;
+} CRL_CONTEXT, *PCRL_CONTEXT, *PCCRL_CONTEXT;
+
+typedef struct _CMSG_SIGNER_INFO {
+    DWORD                       dwVersion;
+    CERT_NAME_BLOB              Issuer;
+    CRYPT_INTEGER_BLOB          SerialNumber;
+    CRYPT_ALGORITHM_IDENTIFIER  HashAlgorithm;
+    CRYPT_ALGORITHM_IDENTIFIER  HashEncryptionAlgorithm;
+    CRYPT_DATA_BLOB             EncryptedHash;
+    CRYPT_ATTRIBUTES            AuthAttrs;
+    CRYPT_ATTRIBUTES            UnauthAttrs;
+} CMSG_SIGNER_INFO, *PCMSG_SIGNER_INFO;
+
+
+
+
+typedef struct _CTL_USAGE {
+    DWORD               cUsageIdentifier;
+    LPSTR               *rgpszUsageIdentifier;
+} CTL_USAGE, *PCTL_USAGE, CERT_ENHKEY_USAGE, *PCERT_ENHKEY_USAGE;
+
+typedef struct _CTL_INFO {
+    DWORD                       dwVersion;
+    CTL_USAGE                   SubjectUsage;
+    CRYPT_DATA_BLOB             ListIdentifier;
+    CRYPT_INTEGER_BLOB          SequenceNumber;
+    FILETIME                    ThisUpdate;
+    FILETIME                    NextUpdate;
+    CRYPT_ALGORITHM_IDENTIFIER  SubjectAlgorithm;
+    DWORD                       cCTLEntry;
+    PCTL_ENTRY                  rgCTLEntry;
+    DWORD                       cExtension;
+    PCERT_EXTENSION             rgExtension;
+} CTL_INFO, *PCTL_INFO;
+
+typedef struct _CTL_CONTEXT {
+    DWORD                   dwMsgAndCertEncodingType;
+    BYTE                    *pbCtlEncoded;
+    DWORD                   cbCtlEncoded;
+    PCTL_INFO               pCtlInfo;
+    HCERTSTORE              hCertStore;
+    HCRYPTMSG               hCryptMsg;
+    BYTE                    *pbCtlContent;
+    DWORD                   cbCtlContent;
+} CTL_CONTEXT, *PCTL_CONTEXT, *PCCTL_CONTEXT;
+
+
+typedef struct WINTRUST_CATALOG_INFO_
+{
+    DWORD           cbStruct;
+    DWORD           dwCatalogVersion;
+    LPCWSTR         pcwszCatalogFilePath;
+    LPCWSTR         pcwszMemberTag;
+    LPCWSTR         pcwszMemberFilePath;
+    HANDLE          hMemberFile;
+    BYTE            *pbCalculatedFileHash;
+    DWORD           cbCalculatedFileHash;
+    PCCTL_CONTEXT   pcCatalogContext;
+} WINTRUST_CATALOG_INFO, *PWINTRUST_CATALOG_INFO;
+
+
+typedef struct WINTRUST_BLOB_INFO_
+{
+    DWORD           cbStruct;
+    GUID            gSubject;
+    LPCWSTR         pcwszDisplayName;
+    DWORD           cbMemObject;
+    BYTE            *pbMemObject;
+    DWORD           cbMemSignedMsg;
+    BYTE            *pbMemSignedMsg;
+} WINTRUST_BLOB_INFO, *PWINTRUST_BLOB_INFO;
+
+
+typedef struct _CRYPT_BIT_BLOB {
+    DWORD   cbData;
+    BYTE    *pbData;
+    DWORD   cUnusedBits;
+} CRYPT_BIT_BLOB, *PCRYPT_BIT_BLOB;
+
+typedef struct _CERT_PUBLIC_KEY_INFO {
+    CRYPT_ALGORITHM_IDENTIFIER    Algorithm;
+    CRYPT_BIT_BLOB                PublicKey;
+} CERT_PUBLIC_KEY_INFO, *PCERT_PUBLIC_KEY_INFO;
+
+typedef struct _CERT_INFO {
+    DWORD                       dwVersion;
+    CRYPT_INTEGER_BLOB          SerialNumber;
+    CRYPT_ALGORITHM_IDENTIFIER  SignatureAlgorithm;
+    CERT_NAME_BLOB              Issuer;
+    FILETIME                    NotBefore;
+    FILETIME                    NotAfter;
+    CERT_NAME_BLOB              Subject;
+    CERT_PUBLIC_KEY_INFO        SubjectPublicKeyInfo;
+    CRYPT_BIT_BLOB              IssuerUniqueId;
+    CRYPT_BIT_BLOB              SubjectUniqueId;
+    DWORD                       cExtension;
+    PCERT_EXTENSION             rgExtension;
+} CERT_INFO, *PCERT_INFO;
+
+
+typedef struct _CERT_ISSUER_SERIAL_NUMBER {
+  CERT_NAME_BLOB     Issuer;
+  CRYPT_INTEGER_BLOB SerialNumber;
+} CERT_ISSUER_SERIAL_NUMBER, *PCERT_ISSUER_SERIAL_NUMBER;
+
+typedef union _TMPUNION_CERT_ID {
+    CERT_ISSUER_SERIAL_NUMBER IssuerSerialNumber;
+    CRYPT_HASH_BLOB           KeyId;
+    CRYPT_HASH_BLOB           HashId;
+} TMPUNION_CERT_ID;
+
+typedef struct _CERT_ID {
+  DWORD dwIdChoice;
+  TMPUNION_CERT_ID DUMMYUNIONNAME;
+} CERT_ID, *PCERT_ID;
+
+typedef struct _CERT_CONTEXT {
+    DWORD                   dwCertEncodingType;
+    BYTE                    *pbCertEncoded;
+    DWORD                   cbCertEncoded;
+    PCERT_INFO              pCertInfo;
+    HCERTSTORE              hCertStore;
+} CERT_CONTEXT, *PCERT_CONTEXT, *PCCERT_CONTEXT;
+
+
+
+typedef struct WINTRUST_SGNR_INFO_
+{
+    DWORD           cbStruct;
+    LPCWSTR         pcwszDisplayName;
+    CMSG_SIGNER_INFO *psSignerInfo;
+    DWORD           chStores;
+    HCERTSTORE      *pahStores;
+} WINTRUST_SGNR_INFO, *PWINTRUST_SGNR_INFO;
+
+typedef struct WINTRUST_CERT_INFO_
+{
+    DWORD           cbStruct;
+    LPCWSTR         pcwszDisplayName;
+    CERT_CONTEXT    *psCertContext;
+    DWORD           chStores;
+    HCERTSTORE      *pahStores;
+    DWORD           dwFlags;
+    FILETIME        *psftVerifyAsOf;
+} WINTRUST_CERT_INFO, *PWINTRUST_CERT_INFO;
+
+
+typedef union _TMP_WINTRUST_UNION_TYPE
+{
+        struct WINTRUST_FILE_INFO_      *pFile;
+        struct WINTRUST_CATALOG_INFO_   *pCatalog;
+        struct WINTRUST_BLOB_INFO_      *pBlob;
+        struct WINTRUST_SGNR_INFO_      *pSgnr;
+        struct WINTRUST_CERT_INFO_      *pCert;
+} TMP_WINTRUST_UNION_TYPE;
+
+
+typedef struct _WINTRUST_DATA
+{
+    DWORD           cbStruct;
+    LPVOID          pPolicyCallbackData;
+    LPVOID          pSIPClientData;
+    DWORD           dwUIChoice;
+    DWORD           fdwRevocationChecks;
+    DWORD           dwUnionChoice;
+
+    TMP_WINTRUST_UNION_TYPE tmp_union;
+
+    DWORD           dwStateAction;
+    HANDLE          hWVTStateData;
+    WCHAR           *pwszURLReference;
+    DWORD           dwProvFlags;
+    DWORD           dwUIContext;
+} WINTRUST_DATA, *PWINTRUST_DATA;
+
+typedef struct _CRYPT_SIGN_MESSAGE_PARA {
+  DWORD                      cbSize;
+  DWORD                      dwMsgEncodingType;
+  PCCERT_CONTEXT             pSigningCert;
+  CRYPT_ALGORITHM_IDENTIFIER HashAlgorithm;
+  PVOID                      pvHashAuxInfo;
+  DWORD                      cMsgCert;
+  PCCERT_CONTEXT             *rgpMsgCert;
+  DWORD                      cMsgCrl;
+  PCCRL_CONTEXT              *rgpMsgCrl;
+  DWORD                      cAuthAttr;
+  PCRYPT_ATTRIBUTE           rgAuthAttr;
+  DWORD                      cUnauthAttr;
+  PCRYPT_ATTRIBUTE           rgUnauthAttr;
+  DWORD                      dwFlags;
+  DWORD                      dwInnerContentType;
+  CRYPT_ALGORITHM_IDENTIFIER HashEncryptionAlgorithm;
+  PVOID                      pvHashEncryptionAuxInfo;
+} CRYPT_SIGN_MESSAGE_PARA, *PCRYPT_SIGN_MESSAGE_PARA;
+
+
+typedef struct _CRYPT_HASH_MESSAGE_PARA {
+  DWORD                      cbSize;
+  DWORD                      dwMsgEncodingType;
+  HCRYPTPROV_LEGACY          hCryptProv;
+  CRYPT_ALGORITHM_IDENTIFIER HashAlgorithm;
+  PVOID                      pvHashAuxInfo;
+} CRYPT_HASH_MESSAGE_PARA, *PCRYPT_HASH_MESSAGE_PARA;
+
+
+typedef struct _CRYPT_KEY_VERIFY_MESSAGE_PARA {
+  DWORD             cbSize;
+  DWORD             dwMsgEncodingType;
+  HCRYPTPROV_LEGACY hCryptProv;
+} CRYPT_KEY_VERIFY_MESSAGE_PARA, *PCRYPT_KEY_VERIFY_MESSAGE_PARA;
+
+typedef struct _CRYPT_VERIFY_MESSAGE_PARA {
+  DWORD                            cbSize;
+  DWORD                            dwMsgAndCertEncodingType;
+  HCRYPTPROV_LEGACY                hCryptProv;
+  PFN_CRYPT_GET_SIGNER_CERTIFICATE pfnGetSignerCertificate;
+  PVOID                            pvGetArg;
+  PCCERT_STRONG_SIGN_PARA          pStrongSignPara;
+} CRYPT_VERIFY_MESSAGE_PARA, *PCRYPT_VERIFY_MESSAGE_PARA;
+
+
+
+typedef struct _SPC_SERIALIZED_OBJECT
+{
+    SPC_UUID            ClassId;
+    CRYPT_DATA_BLOB     SerializedData;
+
+} SPC_SERIALIZED_OBJECT, *PSPC_SERIALIZED_OBJECT;
+
+
+typedef union _TMP_SPC_LINK_UNION
+{
+    LPWSTR                  pwszUrl;
+    SPC_SERIALIZED_OBJECT   Moniker;
+    LPWSTR                  pwszFile;
+} TMP_SPC_LINK_UNION;
+
+
+
+typedef struct SPC_LINK_
+{
+    DWORD dwLinkChoice;
+    TMP_SPC_LINK_UNION u;
+} SPC_LINK, *PSPC_LINK;
+
+
+typedef struct _SPC_SP_OPUS_INFO
+{
+    LPCWSTR                     pwszProgramName;
+    struct SPC_LINK_            *pMoreInfo;
+    struct SPC_LINK_            *pPublisherInfo;
+
+} SPC_SP_OPUS_INFO, *PSPC_SP_OPUS_INFO;
+
+
+typedef struct _CERT_TRUST_STATUS {
+
+    DWORD dwErrorStatus;
+    DWORD dwInfoStatus;
+
+} CERT_TRUST_STATUS, *PCERT_TRUST_STATUS;
+
+typedef struct _CERT_TRUST_LIST_INFO {
+
+    DWORD         cbSize;
+    PCTL_ENTRY    pCtlEntry;
+    PCCTL_CONTEXT pCtlContext;
+
+} CERT_TRUST_LIST_INFO, *PCERT_TRUST_LIST_INFO;
+
+
+
+
+typedef struct _CERT_REVOCATION_CRL_INFO {
+    DWORD                   cbSize;
+    PCCRL_CONTEXT           pBaseCrlContext;
+    PCCRL_CONTEXT           pDeltaCrlContext;
+
+    PCRL_ENTRY              pCrlEntry;
+    BOOL                    fDeltaCrlEntry;
+} CERT_REVOCATION_CRL_INFO, *PCERT_REVOCATION_CRL_INFO;
+
+typedef struct _CERT_REVOCATION_INFO {
+
+    DWORD                       cbSize;
+    DWORD                       dwRevocationResult;
+    LPCSTR                      pszRevocationOid;
+    LPVOID                      pvOidSpecificInfo;
+    BOOL                        fHasFreshnessTime;
+    DWORD                       dwFreshnessTime;
+    PCERT_REVOCATION_CRL_INFO   pCrlInfo;
+
+} CERT_REVOCATION_INFO, *PCERT_REVOCATION_INFO;
+
+typedef struct _CERT_CHAIN_ELEMENT {
+
+    DWORD                 cbSize;
+    PCCERT_CONTEXT        pCertContext;
+    CERT_TRUST_STATUS     TrustStatus;
+    PCERT_REVOCATION_INFO pRevocationInfo;
+
+    PCERT_ENHKEY_USAGE    pIssuanceUsage;
+    PCERT_ENHKEY_USAGE    pApplicationUsage;
+
+    LPCWSTR               pwszExtendedErrorInfo;
+} CERT_CHAIN_ELEMENT, *PCERT_CHAIN_ELEMENT, *PCCERT_CHAIN_ELEMENT;
+
+typedef struct _CERT_SIMPLE_CHAIN {
+
+    DWORD                 cbSize;
+    CERT_TRUST_STATUS     TrustStatus;
+    DWORD                 cElement;
+    PCERT_CHAIN_ELEMENT*  rgpElement;
+    PCERT_TRUST_LIST_INFO pTrustListInfo;
+
+    BOOL                   fHasRevocationFreshnessTime;
+    DWORD                  dwRevocationFreshnessTime;
+
+} CERT_SIMPLE_CHAIN, *PCERT_SIMPLE_CHAIN, *PCCERT_SIMPLE_CHAIN;
+
+typedef struct _CERT_CHAIN_CONTEXT {
+    DWORD                   cbSize;
+    CERT_TRUST_STATUS       TrustStatus;
+    DWORD                   cChain;
+    PCERT_SIMPLE_CHAIN*     rgpChain;
+    DWORD                   cLowerQualityChainContext;
+    PCCERT_CHAIN_CONTEXT*   rgpLowerQualityChainContext;
+    BOOL                    fHasRevocationFreshnessTime;
+    DWORD                   dwRevocationFreshnessTime;
+    DWORD                   dwCreateFlags;
+    GUID                    ChainId;
+}CERT_CHAIN_CONTEXT, *PCERT_CHAIN_CONTEXT, *PCCERT_CHAIN_CONTEXT;
+
+
+typedef struct _CERT_USAGE_MATCH {
+
+    DWORD             dwType;
+    CERT_ENHKEY_USAGE Usage;
+
+} CERT_USAGE_MATCH, *PCERT_USAGE_MATCH;
+
+typedef struct _CERT_CHAIN_PARA {
+
+    DWORD            cbSize;
+    CERT_USAGE_MATCH RequestedUsage;
+    CERT_USAGE_MATCH RequestedIssuancePolicy;
+    DWORD            dwUrlRetrievalTimeout;
+    BOOL             fCheckRevocationFreshnessTime;
+    DWORD            dwRevocationFreshnessTime;
+    LPFILETIME                  pftCacheResync;
+
+} CERT_CHAIN_PARA, *PCERT_CHAIN_PARA;
+
+
+typedef struct _CERT_CHAIN_ENGINE_CONFIG {
+    DWORD       cbSize;
+    HCERTSTORE  hRestrictedRoot;
+    HCERTSTORE  hRestrictedTrust;
+    HCERTSTORE  hRestrictedOther;
+    DWORD       cAdditionalStore;
+    HCERTSTORE* rghAdditionalStore;
+    DWORD       dwFlags;
+    DWORD       dwUrlRetrievalTimeout;
+    DWORD       MaximumCachedCertificates;
+    DWORD       CycleDetectionModulus;
+} CERT_CHAIN_ENGINE_CONFIG, *PCERT_CHAIN_ENGINE_CONFIG;
+
+
+typedef struct _SYSTEMTIME {
+  WORD wYear;
+  WORD wMonth;
+  WORD wDayOfWeek;
+  WORD wDay;
+  WORD wHour;
+  WORD wMinute;
+  WORD wSecond;
+  WORD wMilliseconds;
+} SYSTEMTIME, *PSYSTEMTIME, *LPSYSTEMTIME;
+
+
+typedef struct _CERT_EXTENSIONS {
+  DWORD           cExtension;
+  PCERT_EXTENSION rgExtension;
+} CERT_EXTENSIONS, *PCERT_EXTENSIONS;
+
+typedef struct _CRYPT_KEY_PROV_PARAM {
+  DWORD dwParam;
+  BYTE  *pbData;
+  DWORD cbData;
+  DWORD dwFlags;
+} CRYPT_KEY_PROV_PARAM, *PCRYPT_KEY_PROV_PARAM;
+
+
+typedef struct _CRYPT_KEY_PROV_INFO {
+  LPWSTR                pwszContainerName;
+  LPWSTR                pwszProvName;
+  DWORD                 dwProvType;
+  DWORD                 dwFlags;
+  DWORD                 cProvParam;
+  PCRYPT_KEY_PROV_PARAM rgProvParam;
+  DWORD                 dwKeySpec;
+} CRYPT_KEY_PROV_INFO, *PCRYPT_KEY_PROV_INFO;
+
+typedef struct _CRYPT_ENCRYPT_MESSAGE_PARA {
+  DWORD                      cbSize;
+  DWORD                      dwMsgEncodingType;
+  HCRYPTPROV_LEGACY          hCryptProv;
+  CRYPT_ALGORITHM_IDENTIFIER ContentEncryptionAlgorithm;
+  VOID                       *pvEncryptionAuxInfo;
+  DWORD                      dwFlags;
+  DWORD                      dwInnerContentType;
+} CRYPT_ENCRYPT_MESSAGE_PARA, *PCRYPT_ENCRYPT_MESSAGE_PARA;
+
+
+typedef struct _CRYPT_DECRYPT_MESSAGE_PARA {
+  DWORD      cbSize;
+  DWORD      dwMsgAndCertEncodingType;
+  DWORD      cCertStore;
+  HCERTSTORE *rghCertStore;
+  DWORD      dwFlags;
+} CRYPT_DECRYPT_MESSAGE_PARA, *PCRYPT_DECRYPT_MESSAGE_PARA;
+
+
+typedef struct _CERT_KEY_CONTEXT {
+  DWORD cbSize;
+  HCRYPTPROV        hCryptProv;
+  DWORD dwKeySpec;
+} CERT_KEY_CONTEXT, *PCERT_KEY_CONTEXT;
+
+
+typedef struct _CRYPT_ENCODE_PARA {
+  DWORD           cbSize;
+  PVOID pfnAlloc;
+  PVOID  pfnFree;
+} CRYPT_ENCODE_PARA, *PCRYPT_ENCODE_PARA;
+
+typedef union _TMPUNION_CMSG_MAIL_LIST_RECIPIENT_ENCODE_INFO {
+    HCRYPTKEY hKeyEncryptionKey;
+    PVOID     pvKeyEncryptionKey;
+}TMPUNION_CMSG_MAIL_LIST_RECIPIENT_ENCODE_INFO;
+
+typedef struct _CMSG_MAIL_LIST_RECIPIENT_ENCODE_INFO {
+  DWORD                       cbSize;
+  CRYPT_ALGORITHM_IDENTIFIER  KeyEncryptionAlgorithm;
+  PVOID                       pvKeyEncryptionAuxInfo;
+  HCRYPTPROV                  hCryptProv;
+  DWORD                       dwKeyChoice;
+  TMPUNION_CMSG_MAIL_LIST_RECIPIENT_ENCODE_INFO DUMMYUNIONNAME;
+  CRYPT_DATA_BLOB             KeyId;
+  FILETIME                    Date;
+  PCRYPT_ATTRIBUTE_TYPE_VALUE pOtherAttr;
+} CMSG_MAIL_LIST_RECIPIENT_ENCODE_INFO, *PCMSG_MAIL_LIST_RECIPIENT_ENCODE_INFO;
+
+
+
+typedef struct _CMSG_KEY_TRANS_RECIPIENT_ENCODE_INFO {
+  DWORD                      cbSize;
+  CRYPT_ALGORITHM_IDENTIFIER KeyEncryptionAlgorithm;
+  PVOID                      pvKeyEncryptionAuxInfo;
+  HCRYPTPROV_LEGACY          hCryptProv;
+  CRYPT_BIT_BLOB             RecipientPublicKey;
+  CERT_ID                    RecipientId;
+} CMSG_KEY_TRANS_RECIPIENT_ENCODE_INFO, *PCMSG_KEY_TRANS_RECIPIENT_ENCODE_INFO;
+
+typedef struct _CMSG_KEY_TRANS_RECIPIENT_ENCODE_INFO {
+  DWORD                      cbSize;
+  CRYPT_ALGORITHM_IDENTIFIER KeyEncryptionAlgorithm;
+  PVOID                      pvKeyEncryptionAuxInfo;
+  HCRYPTPROV_LEGACY          hCryptProv;
+  CRYPT_BIT_BLOB             RecipientPublicKey;
+  CERT_ID                    RecipientId;
+} CMSG_KEY_TRANS_RECIPIENT_ENCODE_INFO, *PCMSG_KEY_TRANS_RECIPIENT_ENCODE_INFO;
+
+
+typedef union _TMPUNION_CMSG_KEY_AGREE_RECIPIENT_ENCODE_INFO {
+    PCRYPT_ALGORITHM_IDENTIFIER pEphemeralAlgorithm;
+    PCERT_ID                    pSenderId;
+}TMPUNION_CMSG_KEY_AGREE_RECIPIENT_ENCODE_INFO;
+
+typedef struct _CMSG_RECIPIENT_ENCRYPTED_KEY_ENCODE_INFO {
+  DWORD                       cbSize;
+  CRYPT_BIT_BLOB              RecipientPublicKey;
+  CERT_ID                     RecipientId;
+  FILETIME                    Date;
+  PCRYPT_ATTRIBUTE_TYPE_VALUE pOtherAttr;
+} CMSG_RECIPIENT_ENCRYPTED_KEY_ENCODE_INFO, *PCMSG_RECIPIENT_ENCRYPTED_KEY_ENCODE_INFO;
+
+typedef struct _CMSG_KEY_AGREE_RECIPIENT_ENCODE_INFO {
+  DWORD                                     cbSize;
+  CRYPT_ALGORITHM_IDENTIFIER                KeyEncryptionAlgorithm;
+  PVOID                                     pvKeyEncryptionAuxInfo;
+  CRYPT_ALGORITHM_IDENTIFIER                KeyWrapAlgorithm;
+  PVOID                                     pvKeyWrapAuxInfo;
+  HCRYPTPROV_LEGACY                         hCryptProv;
+  DWORD                                     dwKeySpec;
+  DWORD                                     dwKeyChoice;
+  TMPUNION_CMSG_KEY_AGREE_RECIPIENT_ENCODE_INFO DUMMYUNIONNAME;
+  CRYPT_DATA_BLOB                           UserKeyingMaterial;
+  DWORD                                     cRecipientEncryptedKeys;
+  PCMSG_RECIPIENT_ENCRYPTED_KEY_ENCODE_INFO *rgpRecipientEncryptedKeys;
+} CMSG_KEY_AGREE_RECIPIENT_ENCODE_INFO, *PCMSG_KEY_AGREE_RECIPIENT_ENCODE_INFO;
+
+
+typedef union _TMP_CMSG_RECIPIENT_ENCODE_INFO_UNION {
+    PCMSG_KEY_TRANS_RECIPIENT_ENCODE_INFO pKeyTrans;
+    PCMSG_KEY_AGREE_RECIPIENT_ENCODE_INFO pKeyAgree;
+    PCMSG_MAIL_LIST_RECIPIENT_ENCODE_INFO pMailList;
+} TMP_CMSG_RECIPIENT_ENCODE_INFO_UNION;
+
+typedef struct _CMSG_RECIPIENT_ENCODE_INFO {
+  DWORD dwRecipientChoice;
+  TMP_CMSG_RECIPIENT_ENCODE_INFO_UNION DUMMYUNIONNAME;
+} CMSG_RECIPIENT_ENCODE_INFO, *PCMSG_RECIPIENT_ENCODE_INFO;
+
+
+typedef struct _CMSG_ENVELOPED_ENCODE_INFO {
+  DWORD                       cbSize;
+  HCRYPTPROV_LEGACY           hCryptProv;
+  CRYPT_ALGORITHM_IDENTIFIER  ContentEncryptionAlgorithm;
+  PVOID                       pvEncryptionAuxInfo;
+  DWORD                       cRecipients;
+  PCERT_INFO                  *rgpRecipients;
+  PCMSG_RECIPIENT_ENCODE_INFO rgCmsRecipients;
+  DWORD                       cCertEncoded;
+  PCERT_BLOB                  rgCertEncoded;
+  DWORD                       cCrlEncoded;
+  PCRL_BLOB                   rgCrlEncoded;
+  DWORD                       cAttrCertEncoded;
+  PCERT_BLOB                  rgAttrCertEncoded;
+  DWORD                       cUnprotectedAttr;
+  PCRYPT_ATTRIBUTE            rgUnprotectedAttr;
+} CMSG_ENVELOPED_ENCODE_INFO, *PCMSG_ENVELOPED_ENCODE_INFO;
+
+
+typedef struct _CMSG_STREAM_INFO {
+  DWORD                  cbContent;
+  PVOID pfnStreamOutput;
+  PVOID                  pvArg;
+} CMSG_STREAM_INFO, *PCMSG_STREAM_INFO;
+
+
+typedef union _TMPUNION_CMSG_CTRL_DECRYPT_PARA {
+    HCRYPTPROV        hCryptProv;
+    NCRYPT_KEY_HANDLE hNCryptKey;
+} TMPUNION_CMSG_CTRL_DECRYPT_PARA;
+
+
+typedef struct _CMSG_CTRL_DECRYPT_PARA {
+  DWORD cbSize;
+  TMPUNION_CMSG_CTRL_DECRYPT_PARA DUMMYUNIONNAME;
+  DWORD dwKeySpec;
+  DWORD dwRecipientIndex;
+} CMSG_CTRL_DECRYPT_PARA, *PCMSG_CTRL_DECRYPT_PARA;
@@ -0,0 +1,194 @@
+typedef enum _FILE_INFORMATION_CLASS {
+  FakeFileInformationZero,
+  FileDirectoryInformation,
+  FileFullDirectoryInformation,
+  FileBothDirectoryInformation,
+  FileBasicInformation,
+  FileStandardInformation,
+  FileInternalInformation,
+  FileEaInformation,
+  FileAccessInformation,
+  FileNameInformation,
+  FileRenameInformation,
+  FileLinkInformation,
+  FileNamesInformation,
+  FileDispositionInformation,
+  FilePositionInformation,
+  FileFullEaInformation,
+  FileModeInformation,
+  FileAlignmentInformation,
+  FileAllInformation,
+  FileAllocationInformation,
+  FileEndOfFileInformation,
+  FileAlternateNameInformation,
+  FileStreamInformation,
+  FilePipeInformation,
+  FilePipeLocalInformation,
+  FilePipeRemoteInformation,
+  FileMailslotQueryInformation,
+  FileMailslotSetInformation,
+  FileCompressionInformation,
+  FileObjectIdInformation,
+  FileCompletionInformation,
+  FileMoveClusterInformation,
+  FileQuotaInformation,
+  FileReparsePointInformation,
+  FileNetworkOpenInformation,
+  FileAttributeTagInformation,
+  FileTrackingInformation,
+  FileIdBothDirectoryInformation,
+  FileIdFullDirectoryInformation,
+  FileValidDataLengthInformation,
+  FileShortNameInformation,
+  FileIoCompletionNotificationInformation,
+  FileIoStatusBlockRangeInformation,
+  FileIoPriorityHintInformation,
+  FileSfioReserveInformation,
+  FileSfioVolumeInformation,
+  FileHardLinkInformation,
+  FileProcessIdsUsingFileInformation,
+  FileNormalizedNameInformation,
+  FileNetworkPhysicalNameInformation,
+  FileIdGlobalTxDirectoryInformation,
+  FileIsRemoteDeviceInformation,
+  FileUnusedInformation,
+  FileNumaNodeInformation,
+  FileStandardLinkInformation,
+  FileRemoteProtocolInformation,
+  FileRenameInformationBypassAccessCheck,
+  FileLinkInformationBypassAccessCheck,
+  FileVolumeNameInformation,
+  FileIdInformation,
+  FileIdExtdDirectoryInformation,
+  FileReplaceCompletionInformation,
+  FileHardLinkFullIdInformation,
+  FileIdExtdBothDirectoryInformation,
+  FileDispositionInformationEx,
+  FileRenameInformationEx,
+  FileRenameInformationExBypassAccessCheck,
+  FileMaximumInformation
+} FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
+
+typedef enum _IO_PRIORITY_HINT {
+  IoPriorityVeryLow   = 0,
+  IoPriorityLow       = 1,
+  IoPriorityNormal    = 2,
+  IoPriorityHigh      = 3,
+  IoPriorityCritical  = 4,
+  MaxIoPriorityTypes  = 5
+} IO_PRIORITY_HINT;
+
+
+typedef struct _FILE_INTERNAL_INFORMATION {
+  LARGE_INTEGER IndexNumber;
+} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
+
+
+typedef struct _FILE_ALIGNMENT_INFORMATION {
+  ULONG AlignmentRequirement;
+} FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION;
+
+
+typedef struct _FILE_ATTRIBUTE_TAG_INFORMATION {
+  ULONG FileAttributes;
+  ULONG ReparseTag;
+} FILE_ATTRIBUTE_TAG_INFORMATION, *PFILE_ATTRIBUTE_TAG_INFORMATION;
+
+typedef struct _FILE_BASIC_INFORMATION {
+  LARGE_INTEGER CreationTime;
+  LARGE_INTEGER LastAccessTime;
+  LARGE_INTEGER LastWriteTime;
+  LARGE_INTEGER ChangeTime;
+  ULONG         FileAttributes;
+} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
+
+typedef struct _FILE_EA_INFORMATION {
+  ULONG EaSize;
+} FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
+
+typedef struct _FILE_IO_PRIORITY_HINT_INFORMATION {
+  IO_PRIORITY_HINT PriorityHint;
+} FILE_IO_PRIORITY_HINT_INFORMATION, *PFILE_IO_PRIORITY_HINT_INFORMATION;
+
+
+typedef struct _FILE_MODE_INFORMATION {
+  ULONG Mode;
+} FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
+
+typedef struct _FILE_NAME_INFORMATION {
+  ULONG FileNameLength;
+  WCHAR FileName[1];
+} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;
+
+
+typedef struct _FILE_NETWORK_OPEN_INFORMATION {
+  LARGE_INTEGER CreationTime;
+  LARGE_INTEGER LastAccessTime;
+  LARGE_INTEGER LastWriteTime;
+  LARGE_INTEGER ChangeTime;
+  LARGE_INTEGER AllocationSize;
+  LARGE_INTEGER EndOfFile;
+  ULONG         FileAttributes;
+} FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;
+
+typedef struct _FILE_STANDARD_INFORMATION {
+  LARGE_INTEGER AllocationSize;
+  LARGE_INTEGER EndOfFile;
+  ULONG         NumberOfLinks;
+  BOOLEAN       DeletePending;
+  BOOLEAN       Directory;
+} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;
+
+typedef struct _FILE_ACCESS_INFORMATION {
+  ACCESS_MASK AccessFlags;
+} FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
+
+typedef struct _FILE_POSITION_INFORMATION {
+  LARGE_INTEGER CurrentByteOffset;
+} FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;
+
+typedef struct _FILE_IS_REMOTE_DEVICE_INFORMATION {
+  BOOLEAN IsRemote;
+} FILE_IS_REMOTE_DEVICE_INFORMATION, *PFILE_IS_REMOTE_DEVICE_INFORMATION;
+
+
+typedef struct _FILE_ALL_INFORMATION {
+  FILE_BASIC_INFORMATION     BasicInformation;
+  FILE_STANDARD_INFORMATION  StandardInformation;
+  FILE_INTERNAL_INFORMATION  InternalInformation;
+  FILE_EA_INFORMATION        EaInformation;
+  FILE_ACCESS_INFORMATION    AccessInformation;
+  FILE_POSITION_INFORMATION  PositionInformation;
+  FILE_MODE_INFORMATION      ModeInformation;
+  FILE_ALIGNMENT_INFORMATION AlignmentInformation;
+  FILE_NAME_INFORMATION      NameInformation;
+} FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
+
+typedef struct _FILE_STREAM_INFORMATION {
+    ULONG NextEntryOffset;
+    ULONG StreamNameLength;
+    LARGE_INTEGER StreamSize;
+    LARGE_INTEGER StreamAllocationSize;
+    WCHAR StreamName[1];
+} FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;
+
+
+typedef struct _FILE_DISPOSITION_INFORMATION {
+  BOOLEAN DeleteFile;
+} FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;
+
+typedef struct _FILE_FULL_EA_INFORMATION
+{
+    ULONG NextEntryOffset;
+    UCHAR Flags;
+    UCHAR EaNameLength;
+    USHORT EaValueLength;
+    CHAR EaName[1];
+} FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;
+
+typedef struct _FILE_GET_EA_INFORMATION
+{
+    ULONG NextEntryOffset;
+    UCHAR EaNameLength;
+    CHAR EaName[1];
+} FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
@@ -0,0 +1,8 @@
+/* I 'often' add typedef for GUID: so I put it in a specific file */
+
+typedef struct _GUID {
+    ULONG  Data1;
+    USHORT Data2;
+    USHORT Data3;
+    BYTE  Data4[ 8 ];
+} GUID, IID, CLSID, *REFIID, *REFCLSID, *LPGUID, *REFGUID, *LPCLSID;
@@ -0,0 +1,182 @@
+typedef enum _PROCESS_MITIGATION_POLICY {
+    ProcessDEPPolicy,
+    ProcessASLRPolicy,
+    ProcessDynamicCodePolicy,
+    ProcessStrictHandleCheckPolicy,
+    ProcessSystemCallDisablePolicy,
+    ProcessMitigationOptionsMask,
+    ProcessExtensionPointDisablePolicy,
+    ProcessReserved1Policy,
+    ProcessSignaturePolicy,
+    MaxProcessMitigationPolicy
+} PROCESS_MITIGATION_POLICY, *PPROCESS_MITIGATION_POLICY;
+
+
+// DEP Policy
+
+struct _ANON_PROCESS_MITIGATION_DEP_POLICY_BITFIELD {
+    DWORD Enable : 1;
+    DWORD DisableAtlThunkEmulation : 1;
+    DWORD ReservedFlags : 30;
+};
+
+union _ANON_PROCESS_MITIGATION_DEP_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_DEP_POLICY_BITFIELD anon;
+};
+
+typedef struct _PROCESS_MITIGATION_DEP_POLICY {
+  _ANON_PROCESS_MITIGATION_DEP_POLICY_UNION anon;
+  BOOLEAN Permanent;
+} PROCESS_MITIGATION_DEP_POLICY, *PPROCESS_MITIGATION_DEP_POLICY;
+
+
+// ASLR policy
+
+struct _ANON_PROCESS_MITIGATION_ASLR_POLICY_BITFIELD {
+      DWORD EnableBottomUpRandomization : 1;
+      DWORD EnableForceRelocateImages : 1;
+      DWORD EnableHighEntropy : 1;
+      DWORD DisallowStrippedImages : 1;
+      DWORD ReservedFlags : 28;
+};
+
+union _ANON_PROCESS_MITIGATION_ASLR_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_ASLR_POLICY_BITFIELD anon;
+};
+
+
+typedef struct _PROCESS_MITIGATION_ASLR_POLICY {
+    _ANON_PROCESS_MITIGATION_ASLR_POLICY_UNION anon;
+} PROCESS_MITIGATION_ASLR_POLICY, *PPROCESS_MITIGATION_ASLR_POLICY;
+
+// Dynamic code policy
+
+struct _ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_BITFIELD {
+      DWORD ProhibitDynamicCode  :1;
+      DWORD AllowThreadOptOut  :1;
+      DWORD AllowRemoteDowngrade  :1;
+      DWORD ReservedFlags  :30;
+};
+
+union _ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_BITFIELD anon;
+};
+
+typedef struct _PROCESS_MITIGATION_DYNAMIC_CODE_POLICY {
+    _ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_UNION anon;
+} PROCESS_MITIGATION_DYNAMIC_CODE_POLICY, *PPROCESS_MITIGATION_DYNAMIC_CODE_POLICY;
+
+
+//Strict handle policy
+
+struct _ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_BITFIELD {
+  DWORD RaiseExceptionOnInvalidHandleReference : 1;
+  DWORD HandleExceptionsPermanentlyEnabled : 1;
+  DWORD ReservedFlags : 30;
+};
+
+union _ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_BITFIELD ANON_STRUCT;
+};
+
+
+typedef struct _PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY {
+    _ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_UNION  anon;
+} PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY, *PPROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY;
+
+
+
+// System Call policy
+
+struct _ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_BITFIELD {
+    DWORD DisallowWin32kSystemCalls : 1;
+    DWORD ReservedFlags : 31;
+};
+
+union _ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_BITFIELD ANON_STRUCT;
+};
+
+typedef struct _PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY {
+    _ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_UNION  anon;
+} PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY, *PPROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY;
+
+
+// EXTENSION POINT policy
+
+struct _ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_BITFIELD {
+    DWORD DisableExtensionPoints : 1;
+    DWORD ReservedFlags : 31;
+};
+
+union _ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_BITFIELD ANON_STRUCT;
+};
+
+typedef struct _PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY {
+    _ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_UNION  anon;
+} PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY, *PPROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY;
+
+
+// CFG policy
+
+struct _ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_BITFIELD {
+      DWORD EnableControlFlowGuard  :1;
+      DWORD EnableExportSuppression  :1;
+      DWORD StrictMode  :1;
+      DWORD ReservedFlags  :29;
+};
+
+union _ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_BITFIELD ANON_STRUCT;
+};
+
+typedef struct _PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY  {
+    _ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_UNION  anon;
+} PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY, *PPROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY;
+
+
+// BINARY SIGNATURE  policy
+
+
+struct _ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_BITFIELD {
+      DWORD MicrosoftSignedOnly  :1;
+      DWORD StoreSignedOnly  :1;
+      DWORD MitigationOptIn  :1;
+      DWORD ReservedFlags  :29;
+};
+
+union _ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_BITFIELD ANON_STRUCT;
+};
+
+typedef struct _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY  {
+    _ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_UNION  anon;
+} PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY, *PPROCESS_MITIGATION_BINARY_SIGNATURE_POLICY;
+
+
+// Font disable policy
+
+struct _ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_BITFIELD {
+      DWORD NoRemoteImages  :1;
+      DWORD NoLowMandatoryLabelImages  :1;
+      DWORD PreferSystem32Images  :1;
+      DWORD ReservedFlags  :29;
+};
+
+union _ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_BITFIELD ANON_STRUCT;
+};
+
+typedef struct _PROCESS_MITIGATION_IMAGE_LOAD_POLICY  {
+    _ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_UNION  anon;
+} PROCESS_MITIGATION_IMAGE_LOAD_POLICY, *PPROCESS_MITIGATION_IMAGE_LOAD_POLICY;
@@ -0,0 +1,34 @@
+typedef enum _KEY_VALUE_INFORMATION_CLASS {
+  KeyValueBasicInformation           ,
+  KeyValueFullInformation            ,
+  KeyValuePartialInformation         ,
+  KeyValueFullInformationAlign64     ,
+  KeyValuePartialInformationAlign64  ,
+  KeyValueLayerInformation           ,
+  MaxKeyValueInfoClass
+} KEY_VALUE_INFORMATION_CLASS;
+
+
+typedef struct _KEY_VALUE_BASIC_INFORMATION {
+  ULONG TitleIndex;
+  ULONG Type;
+  ULONG NameLength;
+  WCHAR Name[1];
+} KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION;
+
+typedef struct _KEY_VALUE_FULL_INFORMATION {
+  ULONG TitleIndex;
+  ULONG Type;
+  ULONG DataOffset;
+  ULONG DataLength;
+  ULONG NameLength;
+  WCHAR Name[1];
+} KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;
+
+
+typedef struct _KEY_VALUE_PARTIAL_INFORMATION {
+  ULONG TitleIndex;
+  ULONG Type;
+  ULONG DataLength;
+  UCHAR Data[1];
+} KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;
@@ -0,0 +1,265 @@
+/* Enum */
+
+typedef enum _ACL_INFORMATION_CLASS {
+    AclRevisionInformation = 1,
+    AclSizeInformation = 2,
+} ACL_INFORMATION_CLASS;
+
+/* ACL Stuff */
+
+typedef struct _ACL {
+  BYTE AclRevision;
+  BYTE Sbz1;
+  WORD AclSize;
+  WORD AceCount;
+  WORD Sbz2;
+} ACL, *PACL;
+
+
+typedef struct _ACL_REVISION_INFORMATION {
+    DWORD AclRevision;
+} ACL_REVISION_INFORMATION, *PACL_REVISION_INFORMATION;
+
+
+typedef struct _ACL_SIZE_INFORMATION {
+    DWORD AceCount;
+    DWORD AclBytesInUse;
+    DWORD AclBytesFree;
+} ACL_SIZE_INFORMATION, *PACL_SIZE_INFORMATION;
+
+typedef struct _ACE_HEADER {
+  BYTE AceType;
+  BYTE AceFlags;
+  WORD AceSize;
+} ACE_HEADER, *PACE_HEADER;
+
+
+typedef struct _ACCESS_ALLOWED_ACE {
+  ACE_HEADER  Header;
+  ACCESS_MASK Mask;
+  DWORD       SidStart;
+} ACCESS_ALLOWED_ACE, *PACCESS_ALLOWED_ACE;
+
+typedef struct _ACCESS_ALLOWED_CALLBACK_ACE {
+  ACE_HEADER  Header;
+  ACCESS_MASK Mask;
+  DWORD       SidStart;
+} ACCESS_ALLOWED_CALLBACK_ACE, *PACCESS_ALLOWED_CALLBACK_ACE;
+
+
+typedef struct _ACCESS_ALLOWED_CALLBACK_OBJECT_ACE {
+  ACE_HEADER  Header;
+  ACCESS_MASK Mask;
+  DWORD       Flags;
+  GUID        ObjectType;
+  GUID        InheritedObjectType;
+  DWORD       SidStart;
+} ACCESS_ALLOWED_CALLBACK_OBJECT_ACE, *PACCESS_ALLOWED_CALLBACK_OBJECT_ACE;
+
+typedef struct _ACCESS_DENIED_CALLBACK_OBJECT_ACE {
+    ACE_HEADER Header;
+    ACCESS_MASK Mask;
+    DWORD Flags;
+    GUID ObjectType;
+    GUID InheritedObjectType;
+    DWORD SidStart;
+    // Opaque resource manager specific data
+} ACCESS_DENIED_CALLBACK_OBJECT_ACE, *PACCESS_DENIED_CALLBACK_OBJECT_ACE;
+
+
+typedef struct _ACCESS_ALLOWED_OBJECT_ACE {
+  ACE_HEADER  Header;
+  ACCESS_MASK Mask;
+  DWORD       Flags;
+  GUID        ObjectType;
+  GUID        InheritedObjectType;
+  DWORD       SidStart;
+} ACCESS_ALLOWED_OBJECT_ACE, *PACCESS_ALLOWED_OBJECT_ACE;
+
+
+typedef struct _ACCESS_DENIED_ACE {
+  ACE_HEADER  Header;
+  ACCESS_MASK Mask;
+  DWORD       SidStart;
+} ACCESS_DENIED_ACE, *PACCESS_DENIED_ACE;
+
+
+typedef struct _ACCESS_DENIED_CALLBACK_ACE {
+  ACE_HEADER  Header;
+  ACCESS_MASK Mask;
+  DWORD       SidStart;
+} ACCESS_DENIED_CALLBACK_ACE, *PACCESS_DENIED_CALLBACK_ACE;
+
+
+typedef struct _ACCESS_DENIED_OBJECT_ACE {
+  ACE_HEADER  Header;
+  ACCESS_MASK Mask;
+  DWORD       Flags;
+  GUID        ObjectType;
+  GUID        InheritedObjectType;
+  DWORD       SidStart;
+} ACCESS_DENIED_OBJECT_ACE, *PACCESS_DENIED_OBJECT_ACE;
+
+
+typedef struct _SYSTEM_MANDATORY_LABEL_ACE {
+    ACE_HEADER Header;
+    ACCESS_MASK Mask;
+    DWORD SidStart;
+} SYSTEM_MANDATORY_LABEL_ACE, *PSYSTEM_MANDATORY_LABEL_ACE;
+
+typedef struct _SYSTEM_AUDIT_ACE {
+    ACE_HEADER Header;
+    ACCESS_MASK Mask;
+    DWORD SidStart;
+} SYSTEM_AUDIT_ACE;
+
+typedef struct _SYSTEM_ALARM_ACE {
+    ACE_HEADER Header;
+    ACCESS_MASK Mask;
+    DWORD SidStart;
+} SYSTEM_ALARM_ACE;
+
+typedef struct _SYSTEM_RESOURCE_ATTRIBUTE_ACE {
+    ACE_HEADER Header;
+    ACCESS_MASK Mask;
+    DWORD SidStart;
+} SYSTEM_RESOURCE_ATTRIBUTE_ACE, *PSYSTEM_RESOURCE_ATTRIBUTE_ACE;
+
+typedef struct _SYSTEM_SCOPED_POLICY_ID_ACE {
+    ACE_HEADER Header;
+    ACCESS_MASK Mask;
+    DWORD SidStart;
+} SYSTEM_SCOPED_POLICY_ID_ACE, *PSYSTEM_SCOPED_POLICY_ID_ACE;
+
+typedef struct _SYSTEM_PROCESS_TRUST_LABEL_ACE {
+    ACE_HEADER Header;
+    ACCESS_MASK Mask;
+    DWORD SidStart;
+} SYSTEM_PROCESS_TRUST_LABEL_ACE, *PSYSTEM_PROCESS_TRUST_LABEL_ACE;
+
+
+typedef struct _SYSTEM_AUDIT_OBJECT_ACE {
+    ACE_HEADER Header;
+    ACCESS_MASK Mask;
+    DWORD Flags;
+    GUID ObjectType;
+    GUID InheritedObjectType;
+    DWORD SidStart;
+} SYSTEM_AUDIT_OBJECT_ACE, *PSYSTEM_AUDIT_OBJECT_ACE;
+
+typedef struct _SYSTEM_ALARM_OBJECT_ACE {
+    ACE_HEADER Header;
+    ACCESS_MASK Mask;
+    DWORD Flags;
+    GUID ObjectType;
+    GUID InheritedObjectType;
+    DWORD SidStart;
+} SYSTEM_ALARM_OBJECT_ACE, *PSYSTEM_ALARM_OBJECT_ACE;
+
+
+typedef struct _SYSTEM_AUDIT_CALLBACK_ACE {
+  ACE_HEADER  Header;
+  ACCESS_MASK Mask;
+  DWORD       SidStart;
+} SYSTEM_AUDIT_CALLBACK_ACE, *PSYSTEM_AUDIT_CALLBACK_ACE;
+
+typedef struct _SYSTEM_ALARM_CALLBACK_ACE {
+  ACE_HEADER  Header;
+  ACCESS_MASK Mask;
+  DWORD       SidStart;
+} SYSTEM_ALARM_CALLBACK_ACE, *PSYSTEM_ALARM_CALLBACK_ACE;
+
+typedef struct _SYSTEM_AUDIT_CALLBACK_OBJECT_ACE {
+  ACE_HEADER  Header;
+  ACCESS_MASK Mask;
+  DWORD       Flags;
+  GUID        ObjectType;
+  GUID        InheritedObjectType;
+  DWORD       SidStart;
+} SYSTEM_AUDIT_CALLBACK_OBJECT_ACE, *PSYSTEM_AUDIT_CALLBACK_OBJECT_ACE;
+
+typedef struct _SYSTEM_ALARM_CALLBACK_OBJECT_ACE {
+  ACE_HEADER  Header;
+  ACCESS_MASK Mask;
+  DWORD       Flags;
+  GUID        ObjectType;
+  GUID        InheritedObjectType;
+  DWORD       SidStart;
+} SYSTEM_ALARM_CALLBACK_OBJECT_ACE, *PSYSTEM_ALARM_CALLBACK_OBJECT_ACE;
+
+
+typedef  union _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1_UNION {
+    DWORD pInt64[ANYSIZE_ARRAY];
+    DWORD pUint64[ANYSIZE_ARRAY];
+    DWORD ppString[ANYSIZE_ARRAY];
+    DWORD pFqbn[ANYSIZE_ARRAY];
+    DWORD pOctetString[ANYSIZE_ARRAY];
+} CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1_UNION;
+
+typedef struct _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 {
+  DWORD Name;
+  WORD  ValueType;
+  WORD  Reserved;
+  DWORD Flags;
+  DWORD ValueCount;
+  CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1_UNION Values;
+} CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1, *PCLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1;
+
+typedef struct _CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE {
+    DWORD64             Version;
+    PWSTR               Name;
+} CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE, *PCLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE;
+
+typedef struct _CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE {
+    PVOID   pValue;         //  Pointer is BYTE aligned.
+    DWORD   ValueLength;    //  In bytes
+} CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE,
+    *PCLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE;
+
+typedef struct _CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_RELATIVE {
+  DWORD Length;
+  BYTE OctetString[ANYSIZE_ARRAY];
+} CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_RELATIVE,
+ *PCLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_RELATIVE;
+
+
+typedef  union _CLAIM_SECURITY_ATTRIBUTE_V1_UNION {
+    PLONG64                                      pInt64;
+    PDWORD64                                     pUint64;
+    PWSTR                                        *ppString;
+    PCLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE         pFqbn;
+    PCLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE pOctetString;
+} CLAIM_SECURITY_ATTRIBUTE_V1_UNION;
+
+
+typedef struct _CLAIM_SECURITY_ATTRIBUTE_V1 {
+  PWSTR Name;
+  WORD  ValueType;
+  WORD  Reserved;
+  DWORD Flags;
+  DWORD ValueCount;
+  CLAIM_SECURITY_ATTRIBUTE_V1_UNION Values;
+} CLAIM_SECURITY_ATTRIBUTE_V1, *PCLAIM_SECURITY_ATTRIBUTE_V1;
+
+
+
+typedef union _CLAIM_SECURITY_ATTRIBUTES_INFORMATION_UNION {
+    PCLAIM_SECURITY_ATTRIBUTE_V1 pAttributeV1;
+} CLAIM_SECURITY_ATTRIBUTES_INFORMATION_UNION;
+
+typedef struct _CLAIM_SECURITY_ATTRIBUTES_INFORMATION {
+  WORD  Version;
+  WORD  Reserved;
+  DWORD AttributeCount;
+  CLAIM_SECURITY_ATTRIBUTES_INFORMATION_UNION Attribute;
+} CLAIM_SECURITY_ATTRIBUTES_INFORMATION, *PCLAIM_SECURITY_ATTRIBUTES_INFORMATION;
+
+typedef struct _SECURITY_DESCRIPTOR {
+  BYTE                        Revision;
+  BYTE                        Sbz1;
+  SECURITY_DESCRIPTOR_CONTROL Control;
+  PSID                        Owner;
+  PSID                        Group;
+  PACL                        Sacl;
+  PACL                        Dacl;
+} SECURITY_DESCRIPTOR, *PISECURITY_DESCRIPTOR;
@@ -0,0 +1,11 @@
+typedef struct _SHITEMID {
+  USHORT cb;
+  BYTE   abID[1];
+} SHITEMID;
+
+
+/* MANUAL TYPEDEF see: https://msdn.microsoft.com/en-us/library/windows/desktop/bb773321(v=vs.85).aspx*/
+
+typedef struct _ITEMIDLIST {
+  SHITEMID mkid;
+} ITEMIDLIST, *PCIDLIST_ABSOLUTE, *PIDLIST_ABSOLUTE;
@@ -0,0 +1,38 @@
+typedef enum {
+    SymNone,
+    SymCoff,
+    SymCv,
+    SymPdb,
+    SymExport,
+    SymDeferred,
+    SymSym,       // .sym file
+    SymDia,
+    SymVirtual,
+    NumSymTypes
+} SYM_TYPE;
+
+typedef struct _IMAGEHLP_MODULE64 {
+  DWORD    SizeOfStruct;
+  DWORD64  BaseOfImage;
+  DWORD    ImageSize;
+  DWORD    TimeDateStamp;
+  DWORD    CheckSum;
+  DWORD    NumSyms;
+  SYM_TYPE SymType;
+  CHAR    ModuleName[32];
+  CHAR    ImageName[256];
+  CHAR    LoadedImageName[256];
+  CHAR    LoadedPdbName[256];
+  DWORD    CVSig;
+  CHAR    CVData[780]; // MAX_PATH * 3
+  DWORD    PdbSig;
+  GUID     PdbSig70;
+  DWORD    PdbAge;
+  BOOL     PdbUnmatched;
+  BOOL     DbgUnmatched;
+  BOOL     LineNumbers;
+  BOOL     GlobalSymbols;
+  BOOL     TypeInfo;
+  BOOL     SourceIndexed;
+  BOOL     Publics;
+} IMAGEHLP_MODULE64, *PIMAGEHLP_MODULE64;
@@ -0,0 +1,85 @@
+typedef enum  _TASK_ACTION_TYPE{
+  TASK_ACTION_EXEC          = 0,
+  TASK_ACTION_COM_HANDLER   = 5,
+  TASK_ACTION_SEND_EMAIL    = 6,
+  TASK_ACTION_SHOW_MESSAGE  = 7
+} TASK_ACTION_TYPE;
+
+typedef enum  _TASK_RUNLEVEL_TYPE{
+  TASK_RUNLEVEL_LUA      = 0,
+  TASK_RUNLEVEL_HIGHEST  = 1
+} TASK_RUNLEVEL_TYPE;
+
+
+typedef enum  _TASK_LOGON_TYPE{
+  TASK_LOGON_NONE                           = 0,
+  TASK_LOGON_PASSWORD                       = 1,
+  TASK_LOGON_S4U                            = 2,
+  TASK_LOGON_INTERACTIVE_TOKEN              = 3,
+  TASK_LOGON_GROUP                          = 4,
+  TASK_LOGON_SERVICE_ACCOUNT                = 5,
+  TASK_LOGON_INTERACTIVE_TOKEN_OR_PASSWORD  = 6
+} TASK_LOGON_TYPE;
+
+typedef enum  _TASK_STATE {
+  TASK_STATE_UNKNOWN   = 0,
+  TASK_STATE_DISABLED  = 1,
+  TASK_STATE_QUEUED    = 2,
+  TASK_STATE_READY     = 3,
+  TASK_STATE_RUNNING   = 4
+} TASK_STATE;
+
+
+typedef enum  _TASK_INSTANCES_POLICY {
+  TASK_INSTANCES_PARALLEL       = 0,
+  TASK_INSTANCES_QUEUE          = 1,
+  TASK_INSTANCES_IGNORE_NEW     = 2,
+  TASK_INSTANCES_STOP_EXISTING  = 3
+} TASK_INSTANCES_POLICY;
+
+
+typedef enum  _TASK_COMPATIBILITY{
+  TASK_COMPATIBILITY_AT  = 0,
+  TASK_COMPATIBILITY_V1  = 1,
+  TASK_COMPATIBILITY_V2  = 2
+} TASK_COMPATIBILITY;
+
+
+
+typedef enum  _TASK_TRIGGER_TYPE2{
+  TASK_TRIGGER_EVENT                 = 0,
+  TASK_TRIGGER_TIME                  = 1,
+  TASK_TRIGGER_DAILY                 = 2,
+  TASK_TRIGGER_WEEKLY                = 3,
+  TASK_TRIGGER_MONTHLY               = 4,
+  TASK_TRIGGER_MONTHLYDOW            = 5,
+  TASK_TRIGGER_IDLE                  = 6,
+  TASK_TRIGGER_REGISTRATION          = 7,
+  TASK_TRIGGER_BOOT                  = 8,
+  TASK_TRIGGER_LOGON                 = 9,
+  TASK_TRIGGER_SESSION_STATE_CHANGE  = 11
+} TASK_TRIGGER_TYPE2;
+
+
+typedef enum _TASK_ENUM_FLAGS {
+    TASK_ENUM_HIDDEN    = 0x1
+} TASK_ENUM_FLAGS;
+
+typedef enum  _TASK_CREATION {
+  TASK_VALIDATE_ONLY                 = 0x1,
+  TASK_CREATE                        = 0x2,
+  TASK_UPDATE                        = 0x4,
+  TASK_CREATE_OR_UPDATE              = 0x6,
+  TASK_DISABLE                       = 0x8,
+  TASK_DONT_ADD_PRINCIPAL_ACE        = 0x10,
+  TASK_IGNORE_REGISTRATION_TRIGGERS  = 0x20
+} TASK_CREATION;
+
+
+typedef enum  {
+  TASK_RUN_NO_FLAGS             = 0x0,
+  TASK_RUN_AS_SELF              = 0x1,
+  TASK_RUN_IGNORE_CONSTRAINTS   = 0x2,
+  TASK_RUN_USE_SESSION_ID       = 0x4,
+  TASK_RUN_USER_SID             = 0x8
+} TASK_RUN_FLAGS;
@@ -0,0 +1,37 @@
+import windows # Allow extended-struct to use windows/winproxy/...
+from ctypes import *
+from ctypes.wintypes import *
+
+from flag import Flag, FlagMapper, FlagExatractor
+
+class EnumValue(Flag):
+    def __new__(cls, enum_name, name, value):
+        return super(EnumValue, cls).__new__(cls, name, value)
+
+    def __init__(self, enum_name, name, value):
+        self.enum_name = enum_name
+        self.name = name
+
+    def __repr__(self):
+        return "{0}.{1}({2})".format(self.enum_name, self.name, hex(self))
+
+    # Fix pickling with protocol 2
+    def __getnewargs__(self, *args):
+        return self.enum_name, self.name, int(self)
+
+
+class EnumType(DWORD):
+    values = ()
+    mapper = {}
+
+    @property
+    def value(self):
+        raw_value = super(EnumType, self).value
+        return self.mapper.get(raw_value, raw_value)
+
+    def __repr__(self):
+        raw_value = super(EnumType, self).value
+        if raw_value in self.values:
+            value = self.value
+            return "<{0} {1}({2})>".format(type(self).__name__, value.name, hex(raw_value))
+        return "<{0}({1})>".format(type(self).__name__, hex(self.value))
@@ -0,0 +1,216 @@
+typedef enum _TOKEN_INFORMATION_CLASS {
+  TokenInvalid,
+  TokenUser,
+  TokenGroups,
+  TokenPrivileges,
+  TokenOwner,
+  TokenPrimaryGroup,
+  TokenDefaultDacl,
+  TokenSource,
+  TokenType,
+  TokenImpersonationLevel,
+  TokenStatistics,
+  TokenRestrictedSids,
+  TokenSessionId,
+  TokenGroupsAndPrivileges,
+  TokenSessionReference,
+  TokenSandBoxInert,
+  TokenAuditPolicy,
+  TokenOrigin,
+  TokenElevationType,
+  TokenLinkedToken,
+  TokenElevation,
+  TokenHasRestrictions,
+  TokenAccessInformation,
+  TokenVirtualizationAllowed,
+  TokenVirtualizationEnabled,
+  TokenIntegrityLevel,
+  TokenUIAccess,
+  TokenMandatoryPolicy,
+  TokenLogonSid,
+  TokenIsAppContainer,
+  TokenCapabilities,
+  TokenAppContainerSid,
+  TokenAppContainerNumber,
+  TokenUserClaimAttributes,
+  TokenDeviceClaimAttributes,
+  TokenRestrictedUserClaimAttributes,
+  TokenRestrictedDeviceClaimAttributes,
+  TokenDeviceGroups,
+  TokenRestrictedDeviceGroups,
+  TokenSecurityAttributes,
+  TokenIsRestricted,
+  TokenProcessTrustLevel,
+  TokenPrivateNameSpace,
+  TokenSingletonAttributes,
+  TokenBnoIsolation,
+  TokenChildProcessFlags,
+  MaxTokenInfoClass
+} TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS;
+
+
+typedef enum _TOKEN_ELEVATION_TYPE {
+  TokenElevationTypeDefault = 1,
+  TokenElevationTypeFull = 2,
+  TokenElevationTypeLimited = 3
+} TOKEN_ELEVATION_TYPE, *PTOKEN_ELEVATION_TYPE;
+
+typedef struct _TOKEN_PRIVILEGES {
+  DWORD               PrivilegeCount;
+  LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY];
+} TOKEN_PRIVILEGES, *PTOKEN_PRIVILEGES;
+
+typedef struct _TOKEN_ELEVATION {
+  DWORD TokenIsElevated;
+} TOKEN_ELEVATION, *PTOKEN_ELEVATION;
+
+typedef struct _SID_AND_ATTRIBUTES {
+    PSID Sid;
+    DWORD Attributes;
+} SID_AND_ATTRIBUTES, * PSID_AND_ATTRIBUTES;
+
+typedef struct _TOKEN_MANDATORY_LABEL {
+    SID_AND_ATTRIBUTES Label;
+} TOKEN_MANDATORY_LABEL, *PTOKEN_MANDATORY_LABEL;
+
+
+typedef struct _TOKEN_USER {
+    SID_AND_ATTRIBUTES User;
+} TOKEN_USER, *PTOKEN_USER;
+
+typedef struct _TOKEN_DEFAULT_DACL {
+  PACL DefaultDacl;
+} TOKEN_DEFAULT_DACL, *PTOKEN_DEFAULT_DACL;
+
+
+typedef struct _TOKEN_GROUPS {
+  DWORD              GroupCount;
+  SID_AND_ATTRIBUTES Groups[ANYSIZE_ARRAY];
+} TOKEN_GROUPS, *PTOKEN_GROUPS;
+
+typedef struct _TOKEN_OWNER {
+  PSID Owner;
+} TOKEN_OWNER, *PTOKEN_OWNER;
+
+typedef struct _TOKEN_PRIMARY_GROUP {
+  PSID PrimaryGroup;
+} TOKEN_PRIMARY_GROUP, *PTOKEN_PRIMARY_GROUP;
+
+typedef struct _TOKEN_SOURCE {
+  CHAR SourceName[TOKEN_SOURCE_LENGTH];
+  LUID SourceIdentifier;
+} TOKEN_SOURCE, *PTOKEN_SOURCE;
+
+typedef struct _TOKEN_STATISTICS {
+  LUID                         TokenId;
+  LUID                         AuthenticationId;
+  LARGE_INTEGER                ExpirationTime;
+  TOKEN_TYPE                   TokenType;
+  SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
+  DWORD                        DynamicCharged;
+  DWORD                        DynamicAvailable;
+  DWORD                        GroupCount;
+  DWORD                        PrivilegeCount;
+  LUID                         ModifiedId;
+} TOKEN_STATISTICS, *PTOKEN_STATISTICS;
+
+typedef struct _TOKEN_ORIGIN {
+  LUID OriginatingLogonSession;
+} TOKEN_ORIGIN, *PTOKEN_ORIGIN;
+
+typedef struct _TOKEN_LINKED_TOKEN {
+  HANDLE LinkedToken;
+} TOKEN_LINKED_TOKEN, *PTOKEN_LINKED_TOKEN;
+
+typedef struct _TOKEN_MANDATORY_POLICY {
+  DWORD Policy;
+} TOKEN_MANDATORY_POLICY, *PTOKEN_MANDATORY_POLICY;
+
+typedef struct _SID_AND_ATTRIBUTES_HASH {
+  DWORD               SidCount;
+  PSID_AND_ATTRIBUTES SidAttr;
+  SID_HASH_ENTRY      Hash[SID_HASH_SIZE];
+} SID_AND_ATTRIBUTES_HASH, *PSID_AND_ATTRIBUTES_HASH;
+
+typedef struct _TOKEN_APPCONTAINER_INFORMATION {
+    PSID TokenAppContainer;
+} TOKEN_APPCONTAINER_INFORMATION, *PTOKEN_APPCONTAINER_INFORMATION;
+
+typedef struct _TOKEN_ACCESS_INFORMATION {
+  PSID_AND_ATTRIBUTES_HASH     SidHash;
+  PSID_AND_ATTRIBUTES_HASH     RestrictedSidHash;
+  PTOKEN_PRIVILEGES            Privileges;
+  LUID                         AuthenticationId;
+  TOKEN_TYPE                   TokenType;
+  SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
+  TOKEN_MANDATORY_POLICY       MandatoryPolicy;
+  DWORD                        Flags;
+  DWORD                        AppContainerNumber;
+  PSID                         PackageSid;
+  PSID_AND_ATTRIBUTES_HASH     CapabilitiesHash;
+  PSID                         TrustLevelSid;
+  PSECURITY_ATTRIBUTES_OPAQUE  SecurityAttributes;
+} TOKEN_ACCESS_INFORMATION, *PTOKEN_ACCESS_INFORMATION;
+
+typedef struct _TOKEN_GROUPS_AND_PRIVILEGES {
+  DWORD                SidCount;
+  DWORD                SidLength;
+  PSID_AND_ATTRIBUTES  Sids;
+  DWORD                RestrictedSidCount;
+  DWORD                RestrictedSidLength;
+  PSID_AND_ATTRIBUTES  RestrictedSids;
+  DWORD                PrivilegeCount;
+  DWORD                PrivilegeLength;
+  PLUID_AND_ATTRIBUTES Privileges;
+  LUID                 AuthenticationId;
+} TOKEN_GROUPS_AND_PRIVILEGES, *PTOKEN_GROUPS_AND_PRIVILEGES;
+
+
+
+/* from ntseapi.h */
+
+typedef struct _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE
+{
+    ULONG64 Version;
+    UNICODE_STRING Name;
+} TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE, *PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE;
+
+typedef struct _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE
+{
+    PVOID pValue;
+    ULONG ValueLength;
+} TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE, *PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE;
+
+typedef union _TOKEN_SECURITY_ATTRIBUTE_V1_UNION {
+    PLONG64 pInt64;
+    PULONG64 pUint64;
+    PUNICODE_STRING pString;
+    PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE pFqbn;
+    PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE pOctetString;
+} TOKEN_SECURITY_ATTRIBUTE_V1_UNION;
+
+
+// private
+typedef struct _TOKEN_SECURITY_ATTRIBUTE_V1
+{
+    UNICODE_STRING Name;
+    USHORT ValueType;
+    USHORT Reserved;
+    ULONG Flags;
+    ULONG ValueCount;
+    TOKEN_SECURITY_ATTRIBUTE_V1_UNION Values;
+} TOKEN_SECURITY_ATTRIBUTE_V1, *PTOKEN_SECURITY_ATTRIBUTE_V1;
+
+
+typedef union _TOKEN_SECURITY_ATTRIBUTES_INFORMATION_UNION {
+    PTOKEN_SECURITY_ATTRIBUTE_V1 pAttributeV1;
+} TOKEN_SECURITY_ATTRIBUTES_INFORMATION_UNION;
+
+//private
+typedef struct _TOKEN_SECURITY_ATTRIBUTES_INFORMATION
+{
+    USHORT Version;
+    USHORT Reserved;
+    ULONG AttributeCount;
+    TOKEN_SECURITY_ATTRIBUTES_INFORMATION_UNION Attribute;
+} TOKEN_SECURITY_ATTRIBUTES_INFORMATION, *PTOKEN_SECURITY_ATTRIBUTES_INFORMATION;
@@ -1,11 +1,3 @@
-typedef struct tagRECT
-{
-    LONG    left;
-    LONG    top;
-    LONG    right;
-    LONG    bottom;
-} RECT, *PRECT, *NPRECT, *LPRECT;
-
 typedef struct tagRGBTRIPLE {
        BYTE    rgbtBlue;
        BYTE    rgbtGreen;
@@ -71,4 +63,34 @@ typedef struct tagBITMAPINFO {
 typedef struct tagBITMAPCOREINFO {
    BITMAPCOREHEADER    bmciHeader;
    RGBTRIPLE           bmciColors[1];
-} BITMAPCOREINFO, *LPBITMAPCOREINFO, *PBITMAPCOREINFO;
+} BITMAPCOREINFO, *LPBITMAPCOREINFO, *PBITMAPCOREINFO;
+
+typedef struct tagWNDCLASSEXA {
+  UINT      cbSize;
+  UINT      style;
+  WNDPROC   lpfnWndProc;
+  INT       cbClsExtra;
+  INT       cbWndExtra;
+  HINSTANCE hInstance;
+  HICON     hIcon;
+  HCURSOR   hCursor;
+  HBRUSH    hbrBackground;
+  LPCSTR   lpszMenuName;
+  LPCSTR   lpszClassName;
+  HICON     hIconSm;
+} WNDCLASSEXA, *PWNDCLASSEXA, *LPWNDCLASSEXA;
+
+typedef struct tagWNDCLASSEXW {
+  UINT      cbSize;
+  UINT      style;
+  WNDPROC   lpfnWndProc;
+  INT       cbClsExtra;
+  INT       cbWndExtra;
+  HINSTANCE hInstance;
+  HICON     hIcon;
+  HCURSOR   hCursor;
+  HBRUSH    hbrBackground;
+  LPWSTR   lpszMenuName;
+  LPWSTR   lpszClassName;
+  HICON     hIconSm;
+} WNDCLASSEXW, *PWNDCLASSEXW, *LPWNDCLASSEXW;
@@ -0,0 +1,108 @@
+// API SET MAP Stuff
+// From apiset.h
+
+
+// Used in V6
+typedef struct _API_SET_VALUE_ENTRY {
+    ULONG Flags;
+    ULONG NameOffset;
+    ULONG NameLength;
+    ULONG ValueOffset;
+    ULONG ValueLength;
+} API_SET_VALUE_ENTRY, *PAPI_SET_VALUE_ENTRY;
+
+typedef struct _API_SET_NAMESPACE_ENTRY {
+    ULONG Flags;
+    ULONG NameOffset;
+    ULONG NameLength;
+    ULONG AliasOffset;
+    ULONG AliasLength;
+    ULONG DataOffset;   // API_SET_VALUE_ARRAY
+} API_SET_NAMESPACE_ENTRY, *PAPI_SET_NAMESPACE_ENTRY;
+
+
+typedef struct _API_SET_NAMESPACE_ARRAY {
+    ULONG Version;
+    ULONG Size;
+    ULONG Flags;
+    ULONG Count;
+    API_SET_NAMESPACE_ENTRY Array[ANYSIZE_ARRAY];
+} API_SET_NAMESPACE_ARRAY, *PAPI_SET_NAMESPACE_ARRAY;
+
+
+// Version 2
+
+typedef struct _API_SET_VALUE_ENTRY_V2 {
+    ULONG NameOffset;
+    ULONG NameLength;
+    ULONG ValueOffset;
+    ULONG ValueLength;
+} API_SET_VALUE_ENTRY_V2, *PAPI_SET_VALUE_ENTRY_V2;
+
+typedef struct _API_SET_VALUE_ARRAY_V2 {
+    ULONG Count;
+    API_SET_VALUE_ENTRY_V2 Array[ANYSIZE_ARRAY];
+} API_SET_VALUE_ARRAY_V2,*PAPI_SET_VALUE_ARRAY_V2;
+
+typedef struct _API_SET_NAMESPACE_ENTRY_V2 {
+    ULONG NameOffset;
+    ULONG NameLength;
+    ULONG DataOffset;   // _API_SET_VALUE_ARRAY_V2
+} API_SET_NAMESPACE_ENTRY_V2, *PAPI_SET_NAMESPACE_ENTRY_V2;
+
+typedef struct _API_SET_NAMESPACE_ARRAY_V2 {
+    ULONG Version;
+    ULONG Count;
+    API_SET_NAMESPACE_ENTRY_V2 Array[ANYSIZE_ARRAY];
+} API_SET_NAMESPACE_ARRAY_V2, *PAPI_SET_NAMESPACE_ARRAY_V2;
+
+// Version 4
+
+typedef struct _API_SET_VALUE_ARRAY_V4 {
+    ULONG GuessFlags;
+    ULONG Count;
+    API_SET_VALUE_ENTRY_V2 Array[ANYSIZE_ARRAY];
+} API_SET_VALUE_ARRAY_V4,*PAPI_SET_VALUE_ARRAY_V2;
+
+typedef struct _API_SET_NAMESPACE_ARRAY_V4 {
+    ULONG Version;
+    ULONG Size;
+    ULONG Flags;
+    ULONG Count;
+    API_SET_NAMESPACE_ENTRY Array[ANYSIZE_ARRAY];
+} API_SET_NAMESPACE_ARRAY_V4, *PAPI_SET_NAMESPACE_ARRAY_V4;
+
+typedef struct _API_SET_NAMESPACE_ENTRY_V4 {
+    ULONG Flags;
+    ULONG NameOffset;
+    ULONG NameLength;
+    ULONG AliasOffset;
+    ULONG AliasLength;
+    ULONG DataOffset;
+} API_SET_NAMESPACE_ENTRY_V4, *PAPI_SET_NAMESPACE_ENTRY_V4;
+
+
+
+// Version 6
+
+typedef struct _API_SET_NAMESPACE_ENTRY_V6 {
+	ULONG Flags;
+	ULONG NameOffset;
+	ULONG NameLength;
+	ULONG HashedLength;
+	ULONG ValueOffset;
+	ULONG ValueCount;
+} API_SET_NAMESPACE_ENTRY_V6;
+
+
+typedef struct _API_SET_NAMESPACE_V6 {
+	ULONG Version;
+	ULONG Size;
+	ULONG Flags;
+	ULONG Count;
+	ULONG EntryOffset;
+	ULONG HashOffset;
+	ULONG HashFactor;
+} API_SET_NAMESPACE_V6;
+
+// STOP API-SET-MAP
@@ -0,0 +1,267 @@
+typedef struct _EVENTLOGRECORD {
+  DWORD Length;
+  DWORD Reserved;
+  DWORD RecordNumber;
+  DWORD TimeGenerated;
+  DWORD TimeWritten;
+  DWORD EventID;
+  WORD  EventType;
+  WORD  NumStrings;
+  WORD  EventCategory;
+  WORD  ReservedFlags;
+  DWORD ClosingRecordNumber;
+  DWORD StringOffset;
+  DWORD UserSidLength;
+  DWORD UserSidOffset;
+  DWORD DataLength;
+  DWORD DataOffset;
+} EVENTLOGRECORD, *PEVENTLOGRECORD;
+
+typedef struct _EVENTLOG_FULL_INFORMATION {
+  DWORD dwFull;
+} EVENTLOG_FULL_INFORMATION, *LPEVENTLOG_FULL_INFORMATION;
+
+
+typedef enum _EVT_VARIANT_TYPE {
+  EvtVarTypeNull        = 0,
+  EvtVarTypeString      = 1,
+  EvtVarTypeAnsiString  = 2,
+  EvtVarTypeSByte       = 3,
+  EvtVarTypeByte        = 4,
+  EvtVarTypeInt16       = 5,
+  EvtVarTypeUInt16      = 6,
+  EvtVarTypeInt32       = 7,
+  EvtVarTypeUInt32      = 8,
+  EvtVarTypeInt64       = 9,
+  EvtVarTypeUInt64      = 10,
+  EvtVarTypeSingle      = 11,
+  EvtVarTypeDouble      = 12,
+  EvtVarTypeBoolean     = 13,
+  EvtVarTypeBinary      = 14,
+  EvtVarTypeGuid        = 15,
+  EvtVarTypeSizeT       = 16,
+  EvtVarTypeFileTime    = 17,
+  EvtVarTypeSysTime     = 18,
+  EvtVarTypeSid         = 19,
+  EvtVarTypeHexInt32    = 20,
+  EvtVarTypeHexInt64    = 21,
+  EvtVarTypeEvtHandle   = 32,
+  EvtVarTypeEvtXml      = 35
+} EVT_VARIANT_TYPE;
+
+
+
+
+union _ANON_evt_variant_sub_union {
+    BOOL       BooleanVal;
+    INT8       SByteVal;
+    INT16      Int16Val;
+    INT32      Int32Val;
+    INT64      Int64Val;
+    UINT8      ByteVal;
+    UINT16     UInt16Val;
+    UINT32     UInt32Val;
+    UINT64     UInt64Val;
+    FLOAT      SingleVal;
+    DOUBLE     DoubleVal;
+    ULONGLONG  FileTimeVal;
+    SYSTEMTIME *SysTimeVal;
+    GUID       *GuidVal;
+    LPCWSTR    StringVal;
+    LPCSTR     AnsiStringVal;
+    PBYTE      BinaryVal;
+    PSID       SidVal;
+    SIZE_T     SizeTVal;
+    EVT_HANDLE EvtHandleVal;
+    BOOL       *BooleanArr;
+    INT8       *SByteArr;
+    INT16      *Int16Arr;
+    INT32      *Int32Arr;
+    INT64      *Int64Arr;
+    UINT8      *ByteArr;
+    UINT16     *UInt16Arr;
+    UINT32     *UInt32Arr;
+    UINT64     *UInt64Arr;
+    FLOAT      *SingleArr;
+    DOUBLE     *DoubleArr;
+    FILETIME   *FileTimeArr;
+    SYSTEMTIME *SysTimeArr;
+    GUID       *GuidArr;
+    LPWSTR     *StringArr;
+    LPSTR      *AnsiStringArr;
+    PSID       *SidArr;
+    SIZE_T     *SizeTArr;
+    LPCWSTR    XmlVal;
+    LPCWSTR*   XmlValArr;
+};
+
+typedef struct _EVT_VARIANT {
+  _ANON_evt_variant_sub_union _VARIANT_VALUE;
+  DWORD Count;
+  DWORD Type;
+} EVT_VARIANT, *PEVT_VARIANT;
+
+
+typedef enum _EVT_RENDER_CONTEXT_FLAGS {
+  EvtRenderContextValues  = 0,
+  EvtRenderContextSystem  = 1,
+  EvtRenderContextUser    = 2
+} EVT_RENDER_CONTEXT_FLAGS;
+
+
+typedef enum  _EVT_SYSTEM_PROPERTY_ID {
+  EvtSystemProviderName,
+  EvtSystemProviderGuid,
+  EvtSystemEventID,
+  EvtSystemQualifiers,
+  EvtSystemLevel,
+  EvtSystemTask,
+  EvtSystemOpcode,
+  EvtSystemKeywords,
+  EvtSystemTimeCreated,
+  EvtSystemEventRecordId,
+  EvtSystemActivityID,
+  EvtSystemRelatedActivityID,
+  EvtSystemProcessID,
+  EvtSystemThreadID,
+  EvtSystemChannel,
+  EvtSystemComputer,
+  EvtSystemUserID,
+  EvtSystemVersion,
+  EvtSystemPropertyIdEND
+} EVT_SYSTEM_PROPERTY_ID;
+
+
+typedef enum _EVT_RENDER_FLAGS {
+  EvtRenderEventValues  = 0,
+  EvtRenderEventXml     = 1,
+  EvtRenderBookmark     = 2
+} EVT_RENDER_FLAGS;
+
+
+typedef enum _EVT_QUERY_FLAGS {
+  EvtQueryChannelPath          = 0x1,
+  EvtQueryFilePath             = 0x2,
+  EvtQueryForwardDirection     = 0x100,
+  EvtQueryReverseDirection     = 0x200,
+  EvtQueryTolerateQueryErrors  = 0x1000
+} EVT_QUERY_FLAGS;
+
+
+typedef enum _EVT_LOG_PROPERTY_ID {
+  EvtLogCreationTime        = 0,
+  EvtLogLastAccessTime      = 1,
+  EvtLogLastWriteTime       = 2,
+  EvtLogFileSize            = 3,
+  EvtLogAttributes          = 4,
+  EvtLogNumberOfLogRecords  = 5,
+  EvtLogOldestRecordNumber  = 6,
+  EvtLogFull                = 7
+} EVT_LOG_PROPERTY_ID;
+
+typedef enum _EVT_OPEN_LOG_FLAGS {
+  EvtOpenChannelPath  = 0x1,
+  EvtOpenFilePath     = 0x2
+} EVT_OPEN_LOG_FLAGS;
+
+
+typedef enum _EVT_CHANNEL_CONFIG_PROPERTY_ID {
+  EvtChannelConfigEnabled                = 0,
+  EvtChannelConfigIsolation              = 1,
+  EvtChannelConfigType                   = 2,
+  EvtChannelConfigOwningPublisher        = 3,
+  EvtChannelConfigClassicEventlog        = 4,
+  EvtChannelConfigAccess                 = 5,
+  EvtChannelLoggingConfigRetention       = 6,
+  EvtChannelLoggingConfigAutoBackup      = 7,
+  EvtChannelLoggingConfigMaxSize         = 8,
+  EvtChannelLoggingConfigLogFilePath     = 9,
+  EvtChannelPublishingConfigLevel        = 10,
+  EvtChannelPublishingConfigKeywords     = 11,
+  EvtChannelPublishingConfigControlGuid  = 12,
+  EvtChannelPublishingConfigBufferSize   = 13,
+  EvtChannelPublishingConfigMinBuffers   = 14,
+  EvtChannelPublishingConfigMaxBuffers   = 15,
+  EvtChannelPublishingConfigLatency      = 16,
+  EvtChannelPublishingConfigClockType    = 17,
+  EvtChannelPublishingConfigSidType      = 18,
+  EvtChannelPublisherList                = 19,
+  EvtChannelPublishingConfigFileMax      = 20,
+  EvtChannelConfigPropertyIdEND          = 21
+} EVT_CHANNEL_CONFIG_PROPERTY_ID;
+
+
+typedef enum  _EVT_CHANNEL_TYPE{
+  EvtChannelTypeAdmin        = 0,
+  EvtChannelTypeOperational  = 1,
+  EvtChannelTypeAnalytic     = 2,
+  EvtChannelTypeDebug        = 3
+} EVT_CHANNEL_TYPE;
+
+typedef enum  _EVT_CHANNEL_ISOLATION_TYPE{
+  EvtChannelIsolationTypeApplication  = 0,
+  EvtChannelIsolationTypeSystem       = 1,
+  EvtChannelIsolationTypeCustom       = 2
+} EVT_CHANNEL_ISOLATION_TYPE;
+
+
+typedef enum _EVT_EVENT_METADATA_PROPERTY_ID {
+  EventMetadataEventID           = 0,
+  EventMetadataEventVersion      = 1,
+  EventMetadataEventChannel      = 2,
+  EventMetadataEventLevel        = 3,
+  EventMetadataEventOpcode       = 4,
+  EventMetadataEventTask         = 5,
+  EventMetadataEventKeyword      = 6,
+  EventMetadataEventMessageID    = 7,
+  EventMetadataEventTemplate     = 8,
+  EvtEventMetadataPropertyIdEND  = 9
+} EVT_EVENT_METADATA_PROPERTY_ID;
+
+
+typedef enum _EVT_PUBLISHER_METADATA_PROPERTY_ID {
+  EvtPublisherMetadataPublisherGuid,
+  EvtPublisherMetadataResourceFilePath,
+  EvtPublisherMetadataParameterFilePath,
+  EvtPublisherMetadataMessageFilePath,
+  EvtPublisherMetadataHelpLink,
+  EvtPublisherMetadataPublisherMessageID,
+  EvtPublisherMetadataChannelReferences,
+  EvtPublisherMetadataChannelReferencePath,
+  EvtPublisherMetadataChannelReferenceIndex,
+  EvtPublisherMetadataChannelReferenceID,
+  EvtPublisherMetadataChannelReferenceFlags,
+  EvtPublisherMetadataChannelReferenceMessageID,
+  EvtPublisherMetadataLevels,
+  EvtPublisherMetadataLevelName,
+  EvtPublisherMetadataLevelValue,
+  EvtPublisherMetadataLevelMessageID,
+  EvtPublisherMetadataTasks,
+  EvtPublisherMetadataTaskName,
+  EvtPublisherMetadataTaskEventGuid,
+  EvtPublisherMetadataTaskValue,
+  EvtPublisherMetadataTaskMessageID,
+  EvtPublisherMetadataOpcodes,
+  EvtPublisherMetadataOpcodeName,
+  EvtPublisherMetadataOpcodeValue,
+  EvtPublisherMetadataOpcodeMessageID,
+  EvtPublisherMetadataKeywords,
+  EvtPublisherMetadataKeywordName,
+  EvtPublisherMetadataKeywordValue,
+  EvtPublisherMetadataKeywordMessageID,
+  EvtPublisherMetadataPropertyIdEND
+} EVT_PUBLISHER_METADATA_PROPERTY_ID;
+
+
+typedef enum _EVT_FORMAT_MESSAGE_FLAGS {
+  EvtFormatMessageEvent     = 1,
+  EvtFormatMessageLevel     = 2,
+  EvtFormatMessageTask      = 3,
+  EvtFormatMessageOpcode    = 4,
+  EvtFormatMessageKeyword   = 5,
+  EvtFormatMessageChannel   = 6,
+  EvtFormatMessageProvider  = 7,
+  EvtFormatMessageId        = 8,
+  EvtFormatMessageXml       = 9
+} EVT_FORMAT_MESSAGE_FLAGS;
+
@@ -0,0 +1,257 @@
+typedef /* [v1_enum] */
+enum tag_WBEM_GENUS_TYPE
+    {
+        WBEM_GENUS_CLASS    = 1,
+        WBEM_GENUS_INSTANCE = 2
+    }   WBEM_GENUS_TYPE;
+
+
+typedef /* [v1_enum] */
+enum tag_WBEM_CHANGE_FLAG_TYPE
+    {
+        WBEM_FLAG_CREATE_OR_UPDATE  = 0,
+        WBEM_FLAG_UPDATE_ONLY   = 0x1,
+        WBEM_FLAG_CREATE_ONLY   = 0x2,
+        WBEM_FLAG_UPDATE_COMPATIBLE = 0,
+        WBEM_FLAG_UPDATE_SAFE_MODE  = 0x20,
+        WBEM_FLAG_UPDATE_FORCE_MODE = 0x40,
+        WBEM_MASK_UPDATE_MODE   = 0x60,
+        WBEM_FLAG_ADVISORY  = 0x10000
+    }   WBEM_CHANGE_FLAG_TYPE;
+
+
+typedef enum tag_WBEMSTATUS {
+    WBEM_NO_ERROR   = 0,
+    WBEM_S_NO_ERROR = 0,
+    WBEM_S_SAME = 0,
+    WBEM_S_FALSE    = 1,
+    WBEM_S_ALREADY_EXISTS   = 0x40001,
+    WBEM_S_RESET_TO_DEFAULT = 0x40002,
+    WBEM_S_DIFFERENT    = 0x40003,
+    WBEM_S_TIMEDOUT = 0x40004,
+    WBEM_S_NO_MORE_DATA = 0x40005,
+    WBEM_S_OPERATION_CANCELLED  = 0x40006,
+    WBEM_S_PENDING  = 0x40007,
+    WBEM_S_DUPLICATE_OBJECTS    = 0x40008,
+    WBEM_S_ACCESS_DENIED    = 0x40009,
+    WBEM_S_PARTIAL_RESULTS  = 0x40010,
+    WBEM_S_SOURCE_NOT_AVAILABLE = 0x40017,
+    WBEM_E_FAILED   = 0x80041001,
+    WBEM_E_NOT_FOUND    = 0x80041002,
+    WBEM_E_ACCESS_DENIED    = 0x80041003,
+    WBEM_E_PROVIDER_FAILURE = 0x80041004,
+    WBEM_E_TYPE_MISMATCH    = 0x80041005,
+    WBEM_E_OUT_OF_MEMORY    = 0x80041006,
+    WBEM_E_INVALID_CONTEXT  = 0x80041007,
+    WBEM_E_INVALID_PARAMETER    = 0x80041008,
+    WBEM_E_NOT_AVAILABLE    = 0x80041009,
+    WBEM_E_CRITICAL_ERROR   = 0x8004100a,
+    WBEM_E_INVALID_STREAM   = 0x8004100b,
+    WBEM_E_NOT_SUPPORTED    = 0x8004100c,
+    WBEM_E_INVALID_SUPERCLASS   = 0x8004100d,
+    WBEM_E_INVALID_NAMESPACE    = 0x8004100e,
+    WBEM_E_INVALID_OBJECT   = 0x8004100f,
+    WBEM_E_INVALID_CLASS    = 0x80041010,
+    WBEM_E_PROVIDER_NOT_FOUND   = 0x80041011,
+    WBEM_E_INVALID_PROVIDER_REGISTRATION    = 0x80041012,
+    WBEM_E_PROVIDER_LOAD_FAILURE    = 0x80041013,
+    WBEM_E_INITIALIZATION_FAILURE   = 0x80041014,
+    WBEM_E_TRANSPORT_FAILURE    = 0x80041015,
+    WBEM_E_INVALID_OPERATION    = 0x80041016,
+    WBEM_E_INVALID_QUERY    = 0x80041017,
+    WBEM_E_INVALID_QUERY_TYPE   = 0x80041018,
+    WBEM_E_ALREADY_EXISTS   = 0x80041019,
+    WBEM_E_OVERRIDE_NOT_ALLOWED = 0x8004101a,
+    WBEM_E_PROPAGATED_QUALIFIER = 0x8004101b,
+    WBEM_E_PROPAGATED_PROPERTY  = 0x8004101c,
+    WBEM_E_UNEXPECTED   = 0x8004101d,
+    WBEM_E_ILLEGAL_OPERATION    = 0x8004101e,
+    WBEM_E_CANNOT_BE_KEY    = 0x8004101f,
+    WBEM_E_INCOMPLETE_CLASS = 0x80041020,
+    WBEM_E_INVALID_SYNTAX   = 0x80041021,
+    WBEM_E_NONDECORATED_OBJECT  = 0x80041022,
+    WBEM_E_READ_ONLY    = 0x80041023,
+    WBEM_E_PROVIDER_NOT_CAPABLE = 0x80041024,
+    WBEM_E_CLASS_HAS_CHILDREN   = 0x80041025,
+    WBEM_E_CLASS_HAS_INSTANCES  = 0x80041026,
+    WBEM_E_QUERY_NOT_IMPLEMENTED    = 0x80041027,
+    WBEM_E_ILLEGAL_NULL = 0x80041028,
+    WBEM_E_INVALID_QUALIFIER_TYPE   = 0x80041029,
+    WBEM_E_INVALID_PROPERTY_TYPE    = 0x8004102a,
+    WBEM_E_VALUE_OUT_OF_RANGE   = 0x8004102b,
+    WBEM_E_CANNOT_BE_SINGLETON  = 0x8004102c,
+    WBEM_E_INVALID_CIM_TYPE = 0x8004102d,
+    WBEM_E_INVALID_METHOD   = 0x8004102e,
+    WBEM_E_INVALID_METHOD_PARAMETERS    = 0x8004102f,
+    WBEM_E_SYSTEM_PROPERTY  = 0x80041030,
+    WBEM_E_INVALID_PROPERTY = 0x80041031,
+    WBEM_E_CALL_CANCELLED   = 0x80041032,
+    WBEM_E_SHUTTING_DOWN    = 0x80041033,
+    WBEM_E_PROPAGATED_METHOD    = 0x80041034,
+    WBEM_E_UNSUPPORTED_PARAMETER    = 0x80041035,
+    WBEM_E_MISSING_PARAMETER_ID = 0x80041036,
+    WBEM_E_INVALID_PARAMETER_ID = 0x80041037,
+    WBEM_E_NONCONSECUTIVE_PARAMETER_IDS = 0x80041038,
+    WBEM_E_PARAMETER_ID_ON_RETVAL   = 0x80041039,
+    WBEM_E_INVALID_OBJECT_PATH  = 0x8004103a,
+    WBEM_E_OUT_OF_DISK_SPACE    = 0x8004103b,
+    WBEM_E_BUFFER_TOO_SMALL = 0x8004103c,
+    WBEM_E_UNSUPPORTED_PUT_EXTENSION    = 0x8004103d,
+    WBEM_E_UNKNOWN_OBJECT_TYPE  = 0x8004103e,
+    WBEM_E_UNKNOWN_PACKET_TYPE  = 0x8004103f,
+    WBEM_E_MARSHAL_VERSION_MISMATCH = 0x80041040,
+    WBEM_E_MARSHAL_INVALID_SIGNATURE    = 0x80041041,
+    WBEM_E_INVALID_QUALIFIER    = 0x80041042,
+    WBEM_E_INVALID_DUPLICATE_PARAMETER  = 0x80041043,
+    WBEM_E_TOO_MUCH_DATA    = 0x80041044,
+    WBEM_E_SERVER_TOO_BUSY  = 0x80041045,
+    WBEM_E_INVALID_FLAVOR   = 0x80041046,
+    WBEM_E_CIRCULAR_REFERENCE   = 0x80041047,
+    WBEM_E_UNSUPPORTED_CLASS_UPDATE = 0x80041048,
+    WBEM_E_CANNOT_CHANGE_KEY_INHERITANCE    = 0x80041049,
+    WBEM_E_CANNOT_CHANGE_INDEX_INHERITANCE  = 0x80041050,
+    WBEM_E_TOO_MANY_PROPERTIES  = 0x80041051,
+    WBEM_E_UPDATE_TYPE_MISMATCH = 0x80041052,
+    WBEM_E_UPDATE_OVERRIDE_NOT_ALLOWED  = 0x80041053,
+    WBEM_E_UPDATE_PROPAGATED_METHOD = 0x80041054,
+    WBEM_E_METHOD_NOT_IMPLEMENTED   = 0x80041055,
+    WBEM_E_METHOD_DISABLED  = 0x80041056,
+    WBEM_E_REFRESHER_BUSY   = 0x80041057,
+    WBEM_E_UNPARSABLE_QUERY = 0x80041058,
+    WBEM_E_NOT_EVENT_CLASS  = 0x80041059,
+    WBEM_E_MISSING_GROUP_WITHIN = 0x8004105a,
+    WBEM_E_MISSING_AGGREGATION_LIST = 0x8004105b,
+    WBEM_E_PROPERTY_NOT_AN_OBJECT   = 0x8004105c,
+    WBEM_E_AGGREGATING_BY_OBJECT    = 0x8004105d,
+    WBEM_E_UNINTERPRETABLE_PROVIDER_QUERY   = 0x8004105f,
+    WBEM_E_BACKUP_RESTORE_WINMGMT_RUNNING   = 0x80041060,
+    WBEM_E_QUEUE_OVERFLOW   = 0x80041061,
+    WBEM_E_PRIVILEGE_NOT_HELD   = 0x80041062,
+    WBEM_E_INVALID_OPERATOR = 0x80041063,
+    WBEM_E_LOCAL_CREDENTIALS    = 0x80041064,
+    WBEM_E_CANNOT_BE_ABSTRACT   = 0x80041065,
+    WBEM_E_AMENDED_OBJECT   = 0x80041066,
+    WBEM_E_CLIENT_TOO_SLOW  = 0x80041067,
+    WBEM_E_NULL_SECURITY_DESCRIPTOR = 0x80041068,
+    WBEM_E_TIMED_OUT    = 0x80041069,
+    WBEM_E_INVALID_ASSOCIATION  = 0x8004106a,
+    WBEM_E_AMBIGUOUS_OPERATION  = 0x8004106b,
+    WBEM_E_QUOTA_VIOLATION  = 0x8004106c,
+    WBEM_E_RESERVED_001 = 0x8004106d,
+    WBEM_E_RESERVED_002 = 0x8004106e,
+    WBEM_E_UNSUPPORTED_LOCALE   = 0x8004106f,
+    WBEM_E_HANDLE_OUT_OF_DATE   = 0x80041070,
+    WBEM_E_CONNECTION_FAILED    = 0x80041071,
+    WBEM_E_INVALID_HANDLE_REQUEST   = 0x80041072,
+    WBEM_E_PROPERTY_NAME_TOO_WIDE   = 0x80041073,
+    WBEM_E_CLASS_NAME_TOO_WIDE  = 0x80041074,
+    WBEM_E_METHOD_NAME_TOO_WIDE = 0x80041075,
+    WBEM_E_QUALIFIER_NAME_TOO_WIDE  = 0x80041076,
+    WBEM_E_RERUN_COMMAND    = 0x80041077,
+    WBEM_E_DATABASE_VER_MISMATCH    = 0x80041078,
+    WBEM_E_VETO_DELETE  = 0x80041079,
+    WBEM_E_VETO_PUT = 0x8004107a,
+    WBEM_E_INVALID_LOCALE   = 0x80041080,
+    WBEM_E_PROVIDER_SUSPENDED   = 0x80041081,
+    WBEM_E_SYNCHRONIZATION_REQUIRED = 0x80041082,
+    WBEM_E_NO_SCHEMA    = 0x80041083,
+    WBEM_E_PROVIDER_ALREADY_REGISTERED  = 0x80041084,
+    WBEM_E_PROVIDER_NOT_REGISTERED  = 0x80041085,
+    WBEM_E_FATAL_TRANSPORT_ERROR    = 0x80041086,
+    WBEM_E_ENCRYPTED_CONNECTION_REQUIRED    = 0x80041087,
+    WBEM_E_PROVIDER_TIMED_OUT   = 0x80041088,
+    WBEM_E_NO_KEY   = 0x80041089,
+    WBEM_E_PROVIDER_DISABLED    = 0x8004108a,
+    WBEMESS_E_REGISTRATION_TOO_BROAD    = 0x80042001,
+    WBEMESS_E_REGISTRATION_TOO_PRECISE  = 0x80042002,
+    WBEMESS_E_AUTHZ_NOT_PRIVILEGED  = 0x80042003,
+    WBEMMOF_E_EXPECTED_QUALIFIER_NAME   = 0x80044001,
+    WBEMMOF_E_EXPECTED_SEMI = 0x80044002,
+    WBEMMOF_E_EXPECTED_OPEN_BRACE   = 0x80044003,
+    WBEMMOF_E_EXPECTED_CLOSE_BRACE  = 0x80044004,
+    WBEMMOF_E_EXPECTED_CLOSE_BRACKET    = 0x80044005,
+    WBEMMOF_E_EXPECTED_CLOSE_PAREN  = 0x80044006,
+    WBEMMOF_E_ILLEGAL_CONSTANT_VALUE    = 0x80044007,
+    WBEMMOF_E_EXPECTED_TYPE_IDENTIFIER  = 0x80044008,
+    WBEMMOF_E_EXPECTED_OPEN_PAREN   = 0x80044009,
+    WBEMMOF_E_UNRECOGNIZED_TOKEN    = 0x8004400a,
+    WBEMMOF_E_UNRECOGNIZED_TYPE = 0x8004400b,
+    WBEMMOF_E_EXPECTED_PROPERTY_NAME    = 0x8004400c,
+    WBEMMOF_E_TYPEDEF_NOT_SUPPORTED = 0x8004400d,
+    WBEMMOF_E_UNEXPECTED_ALIAS  = 0x8004400e,
+    WBEMMOF_E_UNEXPECTED_ARRAY_INIT = 0x8004400f,
+    WBEMMOF_E_INVALID_AMENDMENT_SYNTAX  = 0x80044010,
+    WBEMMOF_E_INVALID_DUPLICATE_AMENDMENT   = 0x80044011,
+    WBEMMOF_E_INVALID_PRAGMA    = 0x80044012,
+    WBEMMOF_E_INVALID_NAMESPACE_SYNTAX  = 0x80044013,
+    WBEMMOF_E_EXPECTED_CLASS_NAME   = 0x80044014,
+    WBEMMOF_E_TYPE_MISMATCH = 0x80044015,
+    WBEMMOF_E_EXPECTED_ALIAS_NAME   = 0x80044016,
+    WBEMMOF_E_INVALID_CLASS_DECLARATION = 0x80044017,
+    WBEMMOF_E_INVALID_INSTANCE_DECLARATION  = 0x80044018,
+    WBEMMOF_E_EXPECTED_DOLLAR   = 0x80044019,
+    WBEMMOF_E_CIMTYPE_QUALIFIER = 0x8004401a,
+    WBEMMOF_E_DUPLICATE_PROPERTY    = 0x8004401b,
+    WBEMMOF_E_INVALID_NAMESPACE_SPECIFICATION   = 0x8004401c,
+    WBEMMOF_E_OUT_OF_RANGE  = 0x8004401d,
+    WBEMMOF_E_INVALID_FILE  = 0x8004401e,
+    WBEMMOF_E_ALIASES_IN_EMBEDDED   = 0x8004401f,
+    WBEMMOF_E_NULL_ARRAY_ELEM   = 0x80044020,
+    WBEMMOF_E_DUPLICATE_QUALIFIER   = 0x80044021,
+    WBEMMOF_E_EXPECTED_FLAVOR_TYPE  = 0x80044022,
+    WBEMMOF_E_INCOMPATIBLE_FLAVOR_TYPES = 0x80044023,
+    WBEMMOF_E_MULTIPLE_ALIASES  = 0x80044024,
+    WBEMMOF_E_INCOMPATIBLE_FLAVOR_TYPES2    = 0x80044025,
+    WBEMMOF_E_NO_ARRAYS_RETURNED    = 0x80044026,
+    WBEMMOF_E_MUST_BE_IN_OR_OUT = 0x80044027,
+    WBEMMOF_E_INVALID_FLAGS_SYNTAX  = 0x80044028,
+    WBEMMOF_E_EXPECTED_BRACE_OR_BAD_TYPE    = 0x80044029,
+    WBEMMOF_E_UNSUPPORTED_CIMV22_QUAL_VALUE = 0x8004402a,
+    WBEMMOF_E_UNSUPPORTED_CIMV22_DATA_TYPE  = 0x8004402b,
+    WBEMMOF_E_INVALID_DELETEINSTANCE_SYNTAX = 0x8004402c,
+    WBEMMOF_E_INVALID_QUALIFIER_SYNTAX  = 0x8004402d,
+    WBEMMOF_E_QUALIFIER_USED_OUTSIDE_SCOPE  = 0x8004402e,
+    WBEMMOF_E_ERROR_CREATING_TEMP_FILE  = 0x8004402f,
+    WBEMMOF_E_ERROR_INVALID_INCLUDE_FILE    = 0x80044030,
+    WBEMMOF_E_INVALID_DELETECLASS_SYNTAX    = 0x80044031
+}   WBEMSTATUS;
+
+
+typedef enum tag_WBEM_TIMEOUT_TYPE
+{
+    WBEM_NO_WAIT    = 0,
+    WBEM_INFINITE   = 0xffffffff
+}   WBEM_TIMEOUT_TYPE;
+
+typedef enum tag_WBEM_GENERIC_FLAG_TYPE {
+    WBEM_FLAG_RETURN_IMMEDIATELY    = 0x10,
+    WBEM_FLAG_RETURN_WBEM_COMPLETE  = 0,
+    WBEM_FLAG_BIDIRECTIONAL = 0,
+    WBEM_FLAG_FORWARD_ONLY  = 0x20,
+    WBEM_FLAG_NO_ERROR_OBJECT   = 0x40,
+    WBEM_FLAG_RETURN_ERROR_OBJECT   = 0,
+    WBEM_FLAG_SEND_STATUS   = 0x80,
+    WBEM_FLAG_DONT_SEND_STATUS  = 0,
+    WBEM_FLAG_ENSURE_LOCATABLE  = 0x100,
+    WBEM_FLAG_DIRECT_READ   = 0x200,
+    WBEM_FLAG_SEND_ONLY_SELECTED    = 0,
+    WBEM_RETURN_WHEN_COMPLETE   = 0,
+    WBEM_RETURN_IMMEDIATELY = 0x10,
+    WBEM_MASK_RESERVED_FLAGS    = 0x1f000,
+    WBEM_FLAG_USE_AMENDED_QUALIFIERS    = 0x20000,
+    WBEM_FLAG_STRONG_VALIDATION = 0x100000
+}   WBEM_GENERIC_FLAG_TYPE;
+
+
+typedef enum tag_WBEM_CONNECT_OPTIONS {
+        WBEM_FLAG_CONNECT_REPOSITORY_ONLY   = 0x40,
+        WBEM_FLAG_CONNECT_USE_MAX_WAIT  = 0x80,
+        WBEM_FLAG_CONNECT_PROVIDERS = 0x100
+} WBEM_CONNECT_OPTIONS;
+
+
+typedef enum tag_WBEM_QUERY_FLAG_TYPE {
+        WBEM_FLAG_DEEP  = 0,
+        WBEM_FLAG_SHALLOW   = 1,
+        WBEM_FLAG_PROTOTYPE = 2
+} WBEM_QUERY_FLAG_TYPE;
@@ -1,6 +0,0 @@
-NTSTATUS WINAPI TpCallbackSendAlpcMessageOnCompletion(
-    _In_ HANDLE TpHandle,
-    _In_ HANDLE PortHandle,
-    _In_ ULONG Flags,
-    _In_opt_ PPORT_MESSAGE SendMessage,
-);
@@ -1 +1 @@
-names = ['HINSTANCE', 'HRESULT', 'ATOM', 'BOOL', 'BOOLEAN', 'BYTE', 'COLORREF', 'DOUBLE', 'DWORD', 'FILETIME', 'FLOAT', 'HACCEL', 'HANDLE', 'HBITMAP', ' HBRUSH', 'HCOLORSPACE', 'HDC', 'HDESK', 'HDWP', 'HENHMETAFILE', 'HFONT', 'HGDIOBJ', 'HGLOBAL', 'HHOOK', 'HICON', 'HINSTA NCE', 'HKEY', 'HKL', 'HLOCAL', 'HMENU', 'HMETAFILE', 'HMODULE', 'HMONITOR', 'HPALETTE', 'HPEN', 'HRGN', 'HRSRC', 'HSTR', 'HTASK', 'HWINSTA', 'HWND', 'INT', 'LANGID', 'LARGE_INTEGER', 'LCID', 'LCTYPE', 'LGRPID', 'LONG', 'LPARAM', 'LPCOLESTR' , 'LPCSTR', 'LPCVOID', 'LPCWSTR', 'LPOLESTR', 'LPSTR', 'LPVOID', 'LPWSTR', 'MAX_PATH', 'MSG', 'OLESTR', 'POINT', 'POINTL ', 'RECT', 'RECTL', 'RGB', 'SC_HANDLE', 'SERVICE_STATUS_HANDLE', 'SHORT', 'SIZE', 'SIZEL', 'SMALL_RECT', 'UINT', 'ULARGE _INTEGER', 'ULONG', 'USHORT', 'VARIANT_BOOL', 'WCHAR', 'WIN32_FIND_DATAA', 'WIN32_FIND_DATAW', 'WORD', 'WPARAM', '_COORD ', '_FILETIME', '_LARGE_INTEGER', '_POINTL', '_RECTL', '_SMALL_RECT', '_ULARGE_INTEGER', 'tagMSG', 'tagPOINT', 'tagRECT' , 'tagSIZE']
+names = ['HINSTANCE', 'HRESULT', 'ATOM', 'BOOL', 'BOOLEAN', 'BYTE', 'COLORREF', 'DOUBLE', 'DWORD', 'FILETIME', 'FLOAT', 'HACCEL', 'HANDLE', 'HBITMAP', ' HBRUSH', 'HCOLORSPACE', 'HDC', 'HDESK', 'HDWP', 'HENHMETAFILE', 'HFONT', 'HGDIOBJ', 'HGLOBAL', 'HHOOK', 'HICON', 'HINSTA NCE', 'HKEY', 'HKL', 'HLOCAL', 'HMENU', 'HMETAFILE', 'HMODULE', 'HMONITOR', 'HPALETTE', 'HPEN', 'HRGN', 'HRSRC', 'HSTR', 'HTASK', 'HWINSTA', 'HWND', 'INT', 'LANGID', 'LARGE_INTEGER', 'LCID', 'LCTYPE', 'LGRPID', 'LONG', 'LPARAM', 'LPCOLESTR' , 'LPCSTR', 'LPCVOID', 'LPCWSTR', 'LPOLESTR', 'LPSTR', 'LPVOID', 'LPWSTR', 'MAX_PATH', 'MSG', 'OLESTR', 'POINT', 'POINTL ', 'RECT', 'RECTL', 'RGB', 'SC_HANDLE', 'SERVICE_STATUS_HANDLE', 'SHORT', 'SIZE', 'SIZEL', 'SMALL_RECT', 'UINT', 'ULARGE _INTEGER', 'ULONG', 'USHORT', 'VARIANT_BOOL', 'WCHAR', 'WIN32_FIND_DATAA', 'WIN32_FIND_DATAW', 'WORD', 'WPARAM', '_COORD ', '_FILETIME', '_LARGE_INTEGER', '_POINTL', '_RECTL', '_SMALL_RECT', '_ULARGE_INTEGER', "ULARGE_INTEGER", 'tagMSG', 'tagPOINT', 'tagRECT' , 'tagSIZE']
@@ -0,0 +1,48 @@
+_INITIAL_PSID = PSID
+class PSID(_INITIAL_PSID): # _INITIAL_PSID -> PVOID
+    # def __init__(self, strsid=None):
+        # if strsid is not None:
+            # windows.winproxy.ConvertStringSidToSidA(strsid, self)
+
+    def __str__(self):
+       sid_str  = LPCSTR()
+       windows.winproxy.ConvertSidToStringSidA(self, sid_str)
+       result = sid_str.value
+       windows.winproxy.LocalFree(sid_str)
+       return result
+
+    def __eq__(self, other):
+        return windows.winproxy.EqualSid(self, other)
+
+    @property
+    def size(self):
+        return windows.winproxy.GetLengthSid(self)
+
+    def duplicate(self):
+        size = self.size
+        buffer = ctypes.c_buffer(size)
+        windows.winproxy.CopySid(size, buffer, self)
+        return ctypes.cast(buffer, type(self))
+
+    @classmethod
+    def from_string(cls, strsid):
+        self = cls()
+        windows.winproxy.ConvertStringSidToSidA(strsid, self)
+        return self
+
+    def to_string(self):
+       sid_str  = LPCSTR()
+       windows.winproxy.ConvertSidToStringSidA(self, sid_str)
+       result = sid_str.value
+       windows.winproxy.LocalFree(sid_str)
+       return result
+
+    def __repr__(self):
+        try:
+            return """<{0} "{1}">""".format(type(self).__name__, self.to_string())
+        except WindowsError: # Case of PSID is not valide
+            if not self:
+                return """<{0} (NULL) at {1:#x}>""".format(type(self).__name__, id(self))
+            return """<{0} "<conversion-failed>" at {1:#x}>""".format(type(self).__name__, id(self))
+
+    __sprint__ = __repr__
@@ -0,0 +1,4 @@
+class _CRYPT_BIT_BLOB(_CRYPT_BIT_BLOB):
+    @property
+    def data(self):
+        return bytearray(self.pbData[:self.cbData])
@@ -21,8 +21,10 @@ class _GUID(INITIAL_GUID):
        if getattr(self, "name", notpresent) is notpresent:
            self.name = None
        if self.name is None:
-            return '<IID "{0}">'.format(self.strid.upper())
-        return '<IID "{0}({1})">'.format(self.strid.upper(), self.name)
+            return '<GUID "{0}">'.format(self.strid.upper())
+        return '<GUID "{0}({1})">'.format(self.strid.upper(), self.name)
+
+    __sprint__ = __repr__

    def to_string(self):
        data4_format = "{0:02X}{1:02X}-" + "".join("{{{i}:02X}}".format(i=i + 2) for i in range(6))
@@ -51,8 +53,3 @@ class _GUID(INITIAL_GUID):
        if not isinstance(other, (_GUID, INITIAL_GUID)):
            return NotImplemented
        return (self.Data1, self.Data2, self.Data3, self.Data4[:]) == (other.Data1, other.Data2, other.Data3, other.Data4[:])
-
-LPGUID = POINTER(_GUID)
-REFGUID = POINTER(_GUID)
-REFCLSID = POINTER(_GUID)
-REFIID = POINTER(_GUID)
@@ -0,0 +1,31 @@
+INITIAL_LSA_UNICODE_STRING = _LSA_UNICODE_STRING
+
+class _LSA_UNICODE_STRING(INITIAL_LSA_UNICODE_STRING):
+    @property
+    def str(self):
+        """The python string of the LSA_UNICODE_STRING object
+
+        :type: :class:`unicode`
+        """
+        if not self.Length:
+            return ""
+        if getattr(self, "_target", None) is not None: #remote ctypes :D -> TRICKS OF THE YEAR
+            raw_data = self._target.read_memory(self.Buffer, self.Length)
+            return raw_data.decode("utf16")
+        size = self.Length / 2
+        return (ctypes.c_wchar * size).from_address(self.Buffer)[:]
+
+    @classmethod
+    def from_string(cls, s):
+        utf16_len = len(s) * 2
+        return cls(utf16_len, utf16_len, ctypes.cast(PWSTR(s), PVOID))
+
+    def __repr__(self):
+        return """<{0} "{1}" at {2}>""".format(type(self).__name__, self.str, hex(id(self)))
+
+    def __sprint__(self):
+        try:
+            return self.__repr__()
+        except TypeError as e:
+            # Bad buffer: print raw infos
+            return """<{0} len={1} maxlen={2} buffer={3}>""".format(type(self).__name__, self.Length, self.MaximumLength, self.Buffer)
@@ -0,0 +1,10 @@
+_INITIAL_LUID = _LUID
+class _LUID(_INITIAL_LUID):
+    def __int__(self):
+        return (self.HighPart << 32) | self.LowPart
+
+    def __eq__(self, other):
+        return (self.HighPart, self.LowPart) == (other.HighPart, other.LowPart)
+
+    def __repr__(self):
+        return "<{0} HighPart={1} LowPart={2}>".format(type(self).__name__, self.HighPart, self.LowPart)
@@ -0,0 +1,37 @@
+INITIAL_MEMORY_BASIC_INFORMATION32 = _MEMORY_BASIC_INFORMATION32
+
+class _MEMORY_BASIC_INFORMATION32(INITIAL_MEMORY_BASIC_INFORMATION32):
+    STATE_MAPPER = FlagMapper(MEM_COMMIT, MEM_FREE, MEM_RESERVE)
+    TYPE_MAPPER = FlagMapper(MEM_IMAGE, MEM_MAPPED, MEM_PRIVATE)
+    PROTECT_MAPPER = FlagMapper(PAGE_NOACCESS, PAGE_READONLY, PAGE_READWRITE,
+                                    PAGE_WRITECOPY, PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE,
+                                    PAGE_EXECUTE_WRITECOPY)
+
+
+    @property
+    def State(self):
+        raw_state = super(_MEMORY_BASIC_INFORMATION32, self).State
+        # Finally make a chooser somewhere ?
+        return self.STATE_MAPPER[raw_state]
+
+    @property
+    def Type(self):
+        raw_type = super(_MEMORY_BASIC_INFORMATION32, self).Type
+        # Finally make a chooser somewhere ?
+        return self.TYPE_MAPPER[raw_type]
+
+    @property
+    def Protect(self):
+        raw_protect = super(_MEMORY_BASIC_INFORMATION32, self).Protect
+        # Finally make a chooser somewhere ?
+        return self.PROTECT_MAPPER[raw_protect]
+
+    @property
+    def AllocationProtect(self):
+        raw_protect = super(_MEMORY_BASIC_INFORMATION32, self).AllocationProtect
+        # Finally make a chooser somewhere ?
+        return self.PROTECT_MAPPER[raw_protect]
+
+    def __repr__(self):
+        return "<MEMORY_BASIC_INFORMATION32 BaseAddress={0:#08x} RegionSize={1:#08x} State={2} Type={3} Protect={4}>".format(
+            self.BaseAddress, self.RegionSize, self.State, self.Type, self.Protect)
@@ -0,0 +1,37 @@
+INITIAL_MEMORY_BASIC_INFORMATION64 = _MEMORY_BASIC_INFORMATION64
+
+class _MEMORY_BASIC_INFORMATION64(INITIAL_MEMORY_BASIC_INFORMATION64):
+    STATE_MAPPER = FlagMapper(MEM_COMMIT, MEM_FREE, MEM_RESERVE)
+    TYPE_MAPPER = FlagMapper(MEM_IMAGE, MEM_MAPPED, MEM_PRIVATE)
+    PROTECT_MAPPER = FlagMapper(PAGE_NOACCESS, PAGE_READONLY, PAGE_READWRITE,
+                                    PAGE_WRITECOPY, PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE,
+                                    PAGE_EXECUTE_WRITECOPY)
+
+
+    @property
+    def State(self):
+        raw_state = super(_MEMORY_BASIC_INFORMATION64, self).State
+        # Finally make a chooser somewhere ?
+        return self.STATE_MAPPER[raw_state]
+
+    @property
+    def Type(self):
+        raw_type = super(_MEMORY_BASIC_INFORMATION64, self).Type
+        # Finally make a chooser somewhere ?
+        return self.TYPE_MAPPER[raw_type]
+
+    @property
+    def Protect(self):
+        raw_protect = super(_MEMORY_BASIC_INFORMATION64, self).Protect
+        # Finally make a chooser somewhere ?
+        return self.PROTECT_MAPPER[raw_protect]
+
+    @property
+    def AllocationProtect(self):
+        raw_protect = super(_MEMORY_BASIC_INFORMATION64, self).AllocationProtect
+        # Finally make a chooser somewhere ?
+        return self.PROTECT_MAPPER[raw_protect]
+
+    def __repr__(self):
+        return "<MEMORY_BASIC_INFORMATION64 BaseAddress={0:#08x} RegionSize={1:#08x} State={2} Type={3} Protect={4}>".format(
+            self.BaseAddress, self.RegionSize, self.State, self.Type, self.Protect)
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
hakril	f3de7b528b	go go gadget 0.5	2019-01-03 22:43:40 +01:00
hakril	252f6f8efa	Update replace deprecated use of getfuncargvalue to please new pytest versions	2019-01-03 22:32:19 +01:00
hakril	f53cd00bc4	cosmetic changes to doc + generate html doc	2019-01-03 22:20:19 +01:00
hakril	3fe7ee2cce	Fix bug in debugger caused by on_setup new code	2019-01-03 22:00:01 +01:00
hakril	370210a610	Fix a bug in MEMORY_BASIC_INFORMATION64 extended struct + add related test	2019-01-03 21:51:35 +01:00
hakril	288e87a0d3	Update windows.security doc + add ref to module in doc	2019-01-03 21:50:17 +01:00
hakril	abded9944d	Regenerated ctypes	2018-12-28 21:22:29 +01:00
hakril	d9a43a4a8b	Update readme with Token/SecurityDescriptor demo + fix flag repr in README + small docstring fix	2018-12-28 21:21:30 +01:00
hakril	c2f2f4c0a5	Flag repr does not print long 'L' at the end of hex value	2018-12-28 21:13:40 +01:00
hakril	771593f17d	Fix in safe_execute_python to raise WindowsError if process die during execution	2018-12-21 18:53:55 +01:00
hakril	a194f0be6b	Fixed bug in WinProxy where error add bad func name + update winproxy function list in doc	2018-12-21 18:52:08 +01:00
hakril	4f62434dfb	Moved lookup_sid to windows.utils + add Token to window.security + update doc about official Token path	2018-12-21 18:50:22 +01:00
hakril	fb567c6a76	Added some samples output + document change Kernel32Error -> WinproxyError + fix sample/readme/doc related	2018-12-21 18:13:28 +01:00
hakril	784e669597	update debugger.py with new on_setup callback"	2018-12-21 16:22:38 +01:00
hakril	21e259fa73	Update some doc/samples for new module/features	2018-12-21 16:18:19 +01:00
hakril	db44087bba	Refactor thread code for simple token retrieving on Process/Thread objects	2018-12-21 16:07:10 +01:00
hakril	f522f08e7f	Fix token.py doc + improve NDR with new class + doc NdrString new behavior + update uac.py sample to match new NdrString	2018-12-21 16:05:37 +01:00
hakril	a9a39bc53f	Added multiple ctypes_generation definition + some winproxy functions	2018-12-21 15:31:51 +01:00
hakril	45ace331cb	Added token sample + Debugger.on_setup sample	2018-12-21 15:27:04 +01:00
hakril	79ff18e06f	Update doc/samples/test of windows.security	2018-12-21 15:26:29 +01:00
hakril	986664d01f	update Doc + test + sample for token.py	2018-12-20 22:48:16 +01:00
hakril	8dc2d443d5	Update WMI docs / samples	2018-12-17 23:40:08 +01:00
hakril	e5f87e1453	Fix setup.py to match new winproxy packages	2018-12-17 09:44:43 +01:00
hakril	6c4a5f7d65	Added LoadLibraryEx[AW] + FreeLibrary to winproxy	2018-11-27 14:38:29 +01:00
hakril	5df8cc96dc	enum mapper is now a FlagMapper + improve winfunc parsing	2018-11-26 22:39:31 +01:00
hakril	460274d532	Process object now return new Token object (still WIP)	2018-11-24 22:59:01 +01:00
hakril	2a4bdd7e30	removing crypto ECRYPT_DATA_BLOB. now CRYPT_DATA_BLOB is extended_struct + testing new API in crypto object	2018-11-24 22:59:01 +01:00
hakril	d936942d28	[WIP] improving Token object possibilities	2018-11-24 22:59:01 +01:00
hakril	24c5083633	POC of new Improved buffer utilities + sprint use dunder method __sprint__ if available in objects	2018-11-24 22:59:01 +01:00
hakril	c3b85068e5	Added Retn to x86/64 assemblers + encryption_demo sample can now sign a file + [WIP] token improvement	2018-11-24 22:59:01 +01:00
hakril	fff2f37781	Add WMI create-process sample + improved some sample feature/doc	2018-11-24 22:59:01 +01:00
hakril	b6f57b8342	Code now use renamed/improved windows.com.Variant	2018-11-24 22:59:01 +01:00
hakril	cf6c813002	ComInterface now expose a callback for ctypes error handling. Allow COM interface to change/handle the raised Exception	2018-11-24 22:59:01 +01:00
hakril	b167c6e70f	Made some improvement of error handling by ApiProxy + some new generated def	2018-11-24 22:59:01 +01:00
hakril	267eddb5fe	Reworking windows.com.Variant + working on new wmi API + wmi test	2018-11-24 22:59:01 +01:00
hakril	a18c08ee53	Working on new WMI interface + improved ComInterface errcheck	2018-11-24 22:59:01 +01:00
hakril	e46dc48c37	Addapt codebase and tests to winproxy refactoring (replace Kernel32Error to WinproxyError)	2018-11-24 22:59:00 +01:00
hakril	77fca8bb0f	Refactor winproxy into a directory	2018-11-24 22:59:00 +01:00
hakril	bbde38ffe4	First version of windows.security based on clmntb work	2018-11-24 22:59:00 +01:00
hakril	0e52272ddc	Fixed a warning in simple_x[86\|64]	2018-11-24 22:59:00 +01:00
hakril	91cbcce38f	Added some definition + POC of FlagExtractor	2018-11-24 22:59:00 +01:00
hakril	33ca0c9c34	Added many security-related defines + moved improved-psid in extended_structs	2018-11-24 22:59:00 +01:00
hakril	272ad24f15	Added extended-struct capabilities to simple_type.txt	2018-11-24 22:59:00 +01:00
hakril	967c18d521	Added POC WinProcess.memory_info + some crypto defines	2018-11-24 22:59:00 +01:00
hakril	0125f78c67	Quick fix for query_volume_information	2018-11-24 22:59:00 +01:00
hakril	570436120b	Added some functions	2018-11-24 22:59:00 +01:00
hakril	1c21b77292	Add sign/verify methods to windows.crypto + POC/Play with improved ctypes buffer/array	2018-11-24 22:59:00 +01:00
hakril	7a313f57c1	Added some crypto-related ctypes_generation definitions + generate.py now try to check for out-of-order definition	2018-11-24 22:59:00 +01:00
hakril	b253bc5873	Merge pull request #4 from jagotu/master Ndr: Make sure Strings are null-terminated. Add NULL byte if not present.	2018-11-07 22:10:34 +01:00
JaGoTu	921f066fb8	Ndr: Make sure Strings are null-terminated Prevents RPC_X_BAD_STUB_DATA when a non-null-terminated string is provided as an argument.	2018-11-07 21:26:28 +01:00
hakril	2454bf815b	Regenerate sphinx doc	2018-08-03 10:10:31 +02:00
hakril	b3f1420d46	Updated README with new features description	2018-08-03 09:48:53 +02:00
hakril	19095f0e2f	Fix typo in certificate test + add very simple test of windows.system.modules	2018-08-02 18:52:35 +02:00
hakril	c228a0d5cb	Added Certificate.distinguished_name and BaseSystemModule.name + some winproxy functions	2018-08-02 18:51:41 +02:00
hakril	c97d149630	Added some ctypes_generation definitions	2018-08-02 18:42:36 +02:00
hakril	afccd0da30	Added doc about how to install pfw in readme and sphinx doc	2018-08-02 18:41:08 +02:00
hakril	e53f7ef34b	Added some test for windows.system.object_manager	2018-08-02 18:38:48 +02:00
hakril	e6a022f8be	Add windows.system.edition	2018-07-13 18:08:00 +02:00
hakril	a75de140d6	Added object manager samples to doc + fix Certificate.thum[b]print typo	2018-07-13 14:41:09 +02:00
hakril	d232928780	Added some generated def + some winproxy functions	2018-07-13 14:33:50 +02:00
hakril	c19241098a	Improve object manager doc + add samples	2018-07-13 14:24:55 +02:00
hakril	eb3b13016f	Fix right-margin in sphinx doc CSS (thanks bruno)	2018-07-11 11:57:39 +02:00
hakril	c59af86910	Renamed kernobj.py to object_manager.py and added to windows.system.object_manager + improve API + beginning of doc	2018-06-11 17:55:11 +02:00
hakril	041a354d17	Update some doc + document windows.system.modules	2018-06-11 11:09:48 +02:00
hakril	525432fecd	Add a POC for windows.system.modules to replace winutils.get_kernel_modules()	2018-06-05 21:55:54 +02:00
hakril	1ee9a8bc46	new POC for breakpoint with parameters extraction	2018-06-05 21:54:26 +02:00
hakril	3dcd27a1ca	Fix ntdll-registry winproxy error check + add LocalDebugger.current_thread to match Debugger API	2018-06-05 21:53:35 +02:00
hakril	b223ed233e	Fix stuff in service.py + update test	2018-06-05 11:59:06 +02:00
hakril	3d69ad3cb5	Add some definition in ctypes generation + winproxy wrappers; fix com.py imports	2018-06-05 11:38:57 +02:00
hakril	a559c5c295	Update some doc / test + some ctypes generation definition	2018-06-05 11:34:52 +02:00
hakril	93bb9b6540	Add doc/sample/test for event log code	2018-06-05 11:30:25 +02:00
hakril	057d4e5408	Add scheduled_task code/doc-source/tests	2018-06-01 12:20:13 +02:00
hakril	2bea15ffe8	add current word on event logs	2018-05-12 00:17:34 +02:00
hakril	11e4afeef5	ctypes generation : added bitfield parsing/generation + update/fix some definitions	2018-05-12 00:16:45 +02:00
hakril	05e7b755b0	Fix CurrentProcess read/write memory to use ctypes.memmove -> raise on bad address -> no more segv	2018-05-12 00:13:57 +02:00
hakril	849d64378f	Commit current work on scheduled tasks	2018-05-12 00:11:10 +02:00
hakril	8cc361b1f9	ctypes generation allow COM mission interface autocopy from a directory + support anon structs/enum in typedef	2018-04-16 19:54:09 +02:00
hakril	e918d735a1	Tests injecting python in remote process now check that target python is installed	2018-03-28 23:14:41 +02:00
hakril	9e1400e4ad	Forgot a file.. This is the real v0.4	2018-03-28 01:03:37 +02:00
hakril	3565474693	Let's call it a 0.4 !	2018-03-27 21:33:06 +02:00
hakril	83f4b0c48b	Fixing some doc / samples	2018-03-27 21:24:56 +02:00
hakril	b88ce36acb	Add somme Evt-related define/structs/functions	2018-03-27 20:46:54 +02:00
hakril	4564be8488	Adding IShellLinkW + commit generated defs	2018-03-27 20:44:54 +02:00
hakril	34c2d94bc2	Some fixes in code/samples/test	2018-03-27 20:37:30 +02:00
hakril	66852aae37	Add function NtAllocateVirtualMemory + NtFreeVirtualMemory	2018-03-23 12:43:31 +01:00
hakril	094979f7c0	Add NtWriteVirtualMemory + fix some winfunc param/ret-val type	2018-03-22 19:28:54 +01:00
hakril	b2c3493f46	Improve com generated interface	2018-03-09 16:10:59 +01:00
hakril	9ef71ad9e1	Clean ICallInterceptor POC	2018-03-08 23:12:06 +01:00
hakril	e40b9fb2ff	Add quick POC of ICallInterceptor to COM samples	2018-03-08 22:45:26 +01:00
hakril	af6943992a	cgen: Function generated after COM, handle COM variadic (cdecl) defintion + Comimplem.IID generated avec _functions_ + Add some COM/ComInterceptor definitions	2018-03-08 22:35:54 +01:00
hakril	babb743096	check we are on windows	2018-03-07 10:28:39 +01:00
hakril	8840b9fdb9	updated doc	2018-03-07 10:24:46 +01:00
hakril	03e252b53a	Upgrade to sphinx 1.7.1 + small css fix + review/update/refactor doc samples	2018-03-05 01:06:30 +01:00
hakril	1dc13b1a35	Adding some PE related windef + CertFreeCertificateContext	2018-03-04 18:45:23 +01:00
hakril	d91bc1a45a	Fix a bug in com.init() when CoInitializeEx failed + fix test: test_wmi fail du to pytest default COM-security settings	2018-03-04 18:34:40 +01:00
hakril	a057f8c130	class CertificateContext(PCERT_CONTEXT) replaced by Certificate(CERT_CONTEXT) + multi-received encrypt/decrypt test	2018-03-04 18:28:20 +01:00
hakril	c20d443c29	windows.com.init does not raise anymore if CoInitializeEx fails but return error code + cosmetic	2018-03-03 16:55:40 +01:00
hakril	262b80c8c3	utils.get_(long\|short)_path now handle unicode path using W func	2018-03-03 16:51:51 +01:00
hakril	805e735a88	Added some ctypes definitions	2018-03-03 16:49:53 +01:00
hakril	4499080a77	Remote load library now use LoadLibraryW and get_mapped_filename use GetMappedFileNameW: return unicode str in every case	2018-02-07 13:14:25 +01:00
hakril	b2a72f11cc	Add windows.pipe for simpler communication with injected process	2018-02-02 10:27:04 +01:00
hakril	f682fbd8c1	Add transaction + window APIs to winproxy + get_mapped_filename raise on non-standard error (like aborted transaction)	2018-01-26 11:05:53 +01:00
hakril	4251b18041	Fix ctypes generation + COM interface dependance check + add IPersistFile, IShellLink, strucs/defs	2018-01-25 16:51:04 +01:00
hakril	82e464d527	Replaced old generate.py with new ctypes generation code !	2018-01-19 18:11:16 +01:00
hakril	445de0b007	Commit generated def before switching generator code	2018-01-19 17:33:33 +01:00
hakril	61ddb4821a	Working in new ctypes generation code and features	2018-01-17 01:17:55 +01:00
hakril	65726e706f	Add Int X86/64 instruction	2018-01-13 16:40:21 +01:00
hakril	715a7fee95	Add CryptMsgVerifyCountersignatureEncoded[Ex] and some crypto definition	2018-01-13 16:39:53 +01:00
hakril	48b6758f7f	Add exists/create to PyHKey	2018-01-13 16:38:29 +01:00
hakril	f882bd1e35	Add wmi.gen_select for class select returning a generator + fom E_CRYPT define + CryptObj.nb_signer return 0 if CRYPT_E_INVALID_MSG_TYPE	2017-12-08 16:54:49 +01:00
hakril	4a75453a8b	Clean and Improve WMI query API that now accept a Timeout	2017-12-08 14:49:03 +01:00
hakril	3490dc987f	Default encrypt algo is now AES256_CBC + Fix import_pfx default flags to be able to use it for AES256_CBC simply	2017-12-07 15:40:47 +01:00
hakril	32de3cb824	Improve ApiSetMap resolve to match ntdll behavior + add sizekey option to encryption_demo genkey option	2017-12-06 10:21:40 +01:00
hakril	23837a0713	Improving volume objects + adding CurrentProcess.peb.apisetmap with ApiSetMap parsing capabilities	2017-12-04 10:12:41 +01:00
hakril	8f7adb8da1	Add fuller PEB structure + Improved UNICODE_STRING + other define	2017-12-04 10:01:40 +01:00
hakril	f03bb89ae6	Working on time translation (filetime - unix - datetime) and windows volume objects	2017-11-28 10:50:02 +01:00
hakril	22224b52e2	Added utils.query_file_informations wrapper arround new winproxy.NtQueryInformationFile	2017-11-27 10:13:13 +01:00
hakril	c135780ba9	Add Process.virtual_protect default value for 'old_protect' + add test for Improved LSA_UNICODE_STRING used in PEB.ProcessParameters + find_value now search in ntstatus values	2017-11-24 17:46:07 +01:00
hakril	f54599568d	Working on eventlog	2017-11-24 17:17:35 +01:00
Clement Rouault	5a5baa7bcd	Add ctypes_generation extended structs _LSA_UNICODE_STRING.py	2017-11-17 15:14:10 +01:00
Clement Rouault	d12bae6dbb	Remove 'WinUnicodeString' and add un extended struct _LSA_UNICODE_STRING: simplify lots of things	2017-11-17 15:13:34 +01:00
Clement Rouault	d3ca30b229	Winstruct parser now handle comments in winstructs source files	2017-11-17 15:10:19 +01:00
Clement Rouault	a0ffea68b7	Add a example of x86.assemble in the README	2017-11-15 17:29:11 +01:00
Clement Rouault	51bc3fdf7c	Improve _GUID & typedef definition + add a sample using gdef.meta to search for a name/value in generated defs	2017-11-15 15:20:38 +01:00
Clement Rouault	a6aa8b86ea	Fix typo in rpc windef and improve NDR-related exception message	2017-11-15 11:05:54 +01:00
hakril	d9db5ba428	utils.create_file_from_handle now handles binary opening mode	2017-11-15 09:00:38 +01:00
Clement Rouault	be68ba8b15	Testing a new generated file: meta.py	2017-11-10 17:29:50 +01:00
Clement Rouault	7929a31bf7	clean wintrust.py: add def to generated_ctypes + use gdef.IID for wintrust IID	2017-11-10 14:40:16 +01:00
Clement Rouault	4e5733c2c5	Process.prioroty now use the FlagMapper	2017-11-10 14:20:59 +01:00
Clement Rouault	8ba325afd2	Add a new FlagMapper to easily transform int to Flag and change to code use it	2017-11-10 13:47:27 +01:00
Clement Rouault	4efae2194d	Adding Process.priority + fix in WMI raised exceptions + add x86.Iret	2017-11-10 11:12:24 +01:00
hakril	14b1cbcf75	Adding improved MEMORY_BASIC_INFORMATION structs	2017-11-10 09:04:22 +01:00
Clement Rouault	5a79e15440	Improve WMI capabilities by adding access to various namespaces + listing methods + add CurrentProcess.load_library	2017-11-08 17:55:47 +01:00