#ifndef NTOBAPI_H #define NTOBAPI_H #include #define DIRECTORY_QUERY 0x0001 #define DIRECTORY_TRAVERSE 0x0002 #define DIRECTORY_CREATE_OBJECT 0x0004 #define DIRECTORY_CREATE_SUBDIRECTORY 0x0008 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xf) #define SYMBOLIC_LINK_QUERY 0x0001 #define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1) #define OBJ_PROTECT_CLOSE 0x00000001 #ifndef OBJ_INHERIT #define OBJ_INHERIT 0x00000002 #endif #define OBJ_AUDIT_OBJECT_CLOSE 0x00000004 typedef enum _OBJECT_INFORMATION_CLASS { ObjectBasicInformation, ObjectNameInformation, ObjectTypeInformation, ObjectTypesInformation, ObjectHandleFlagInformation, ObjectSessionInformation, MaxObjectInfoClass } OBJECT_INFORMATION_CLASS; typedef struct _OBJECT_BASIC_INFORMATION { ULONG Attributes; ACCESS_MASK GrantedAccess; ULONG HandleCount; ULONG PointerCount; ULONG PagedPoolCharge; ULONG NonPagedPoolCharge; ULONG Reserved[3]; ULONG NameInfoSize; ULONG TypeInfoSize; ULONG SecurityDescriptorSize; LARGE_INTEGER CreationTime; } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION; typedef struct _OBJECT_NAME_INFORMATION { UNICODE_STRING Name; } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION; typedef struct _OBJECT_TYPE_INFORMATION { UNICODE_STRING TypeName; ULONG TotalNumberOfObjects; ULONG TotalNumberOfHandles; ULONG TotalPagedPoolUsage; ULONG TotalNonPagedPoolUsage; ULONG TotalNamePoolUsage; ULONG TotalHandleTableUsage; ULONG HighWaterNumberOfObjects; ULONG HighWaterNumberOfHandles; ULONG HighWaterPagedPoolUsage; ULONG HighWaterNonPagedPoolUsage; ULONG HighWaterNamePoolUsage; ULONG HighWaterHandleTableUsage; ULONG InvalidAttributes; GENERIC_MAPPING GenericMapping; ULONG ValidAccessMask; BOOLEAN SecurityRequired; BOOLEAN MaintainHandleCount; ULONG PoolType; ULONG DefaultPagedPoolCharge; ULONG DefaultNonPagedPoolCharge; } OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION; typedef struct _OBJECT_TYPES_INFORMATION { ULONG NumberOfTypes; OBJECT_TYPE_INFORMATION TypeInformation[1]; } OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION; typedef struct _OBJECT_HANDLE_FLAG_INFORMATION { BOOLEAN Inherit; BOOLEAN ProtectFromClose; } OBJECT_HANDLE_FLAG_INFORMATION, *POBJECT_HANDLE_FLAG_INFORMATION; typedef NTSTATUS (NTAPI *_NtQueryObject)( __in HANDLE Handle, __in OBJECT_INFORMATION_CLASS ObjectInformationClass, __out_bcount_opt(ObjectInformationLength) PVOID ObjectInformation, __in ULONG ObjectInformationLength, __out_opt PULONG ReturnLength ); typedef NTSTATUS (NTAPI *_NtSetInformationObject)( __in HANDLE Handle, __in OBJECT_INFORMATION_CLASS ObjectInformationClass, __in_bcount(ObjectInformationLength) PVOID ObjectInformation, __in ULONG ObjectInformationLength ); typedef NTSTATUS (NTAPI *_NtDuplicateObject)( __in HANDLE SourceProcessHandle, __in HANDLE SourceHandle, __in_opt HANDLE TargetProcessHandle, __out_opt PHANDLE TargetHandle, __in ACCESS_MASK DesiredAccess, __in ULONG HandleAttributes, __in ULONG Options ); #define DUPLICATE_CLOSE_SOURCE 0x00000001 #define DUPLICATE_SAME_ACCESS 0x00000002 #define DUPLICATE_SAME_ATTRIBUTES 0x00000004 typedef NTSTATUS (NTAPI *_NtMakeTemporaryObject)( __in HANDLE Handle ); typedef NTSTATUS (NTAPI *_NtMakePermanentObject)( __in HANDLE Handle ); typedef NTSTATUS (NTAPI *_NtSignalAndWaitForSingleObject)( __in HANDLE SignalHandle, __in HANDLE WaitHandle, __in BOOLEAN Alertable, __in_opt PLARGE_INTEGER Timeout ); typedef NTSTATUS (NTAPI *_NtWaitForSingleObject)( __in HANDLE Handle, __in BOOLEAN Alertable, __in_opt PLARGE_INTEGER Timeout ); typedef NTSTATUS (NTAPI *_NtWaitForMultipleObjects)( __in ULONG Count, __in_ecount(Count) PHANDLE Handles, __in WAIT_TYPE WaitType, __in BOOLEAN Alertable, __in_opt PLARGE_INTEGER Timeout ); typedef NTSTATUS (NTAPI *_NtSetSecurityObject)( __in HANDLE Handle, __in SECURITY_INFORMATION SecurityInformation, __in PSECURITY_DESCRIPTOR SecurityDescriptor ); typedef NTSTATUS (NTAPI *_NtQuerySecurityObject)( __in HANDLE Handle, __in SECURITY_INFORMATION SecurityInformation, __out_bcount_opt(Length) PSECURITY_DESCRIPTOR SecurityDescriptor, __in ULONG Length, __out PULONG LengthNeeded ); typedef NTSTATUS (NTAPI *_NtClose)( __in HANDLE Handle ); #endif