mirror of
https://github.com/mirror/processhacker
synced 2026-06-08 16:03:24 +00:00
wj32
5a36134ced
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@4215 21ef857c-d57f-4fe0-8362-d861dc6d29cd
3814 lines
80 KiB
C
3814 lines
80 KiB
C
#ifndef _NTZWAPI_H
|
|
#define _NTZWAPI_H
|
|
|
|
// This file was automatically generated. Do not edit.
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAcceptConnectPort(
|
|
__out PHANDLE PortHandle,
|
|
__in_opt PVOID PortContext,
|
|
__in PPORT_MESSAGE ConnectionRequest,
|
|
__in BOOLEAN AcceptConnection,
|
|
__inout_opt PPORT_VIEW ServerView,
|
|
__out_opt PREMOTE_PORT_VIEW ClientView
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAccessCheck(
|
|
__in PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in HANDLE ClientToken,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in PGENERIC_MAPPING GenericMapping,
|
|
__out_bcount(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
|
|
__inout PULONG PrivilegeSetLength,
|
|
__out PACCESS_MASK GrantedAccess,
|
|
__out PNTSTATUS AccessStatus
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAccessCheckAndAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in PUNICODE_STRING ObjectTypeName,
|
|
__in PUNICODE_STRING ObjectName,
|
|
__in PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in PGENERIC_MAPPING GenericMapping,
|
|
__in BOOLEAN ObjectCreation,
|
|
__out PACCESS_MASK GrantedAccess,
|
|
__out PNTSTATUS AccessStatus,
|
|
__out PBOOLEAN GenerateOnClose
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAccessCheckByType(
|
|
__in PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in_opt PSID PrincipalSelfSid,
|
|
__in HANDLE ClientToken,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_ecount(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
__in ULONG ObjectTypeListLength,
|
|
__in PGENERIC_MAPPING GenericMapping,
|
|
__out_bcount(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
|
|
__inout PULONG PrivilegeSetLength,
|
|
__out PACCESS_MASK GrantedAccess,
|
|
__out PNTSTATUS AccessStatus
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAccessCheckByTypeAndAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in PUNICODE_STRING ObjectTypeName,
|
|
__in PUNICODE_STRING ObjectName,
|
|
__in PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in_opt PSID PrincipalSelfSid,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in AUDIT_EVENT_TYPE AuditType,
|
|
__in ULONG Flags,
|
|
__in_ecount_opt(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
__in ULONG ObjectTypeListLength,
|
|
__in PGENERIC_MAPPING GenericMapping,
|
|
__in BOOLEAN ObjectCreation,
|
|
__out PACCESS_MASK GrantedAccess,
|
|
__out PNTSTATUS AccessStatus,
|
|
__out PBOOLEAN GenerateOnClose
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAccessCheckByTypeResultList(
|
|
__in PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in_opt PSID PrincipalSelfSid,
|
|
__in HANDLE ClientToken,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_ecount(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
__in ULONG ObjectTypeListLength,
|
|
__in PGENERIC_MAPPING GenericMapping,
|
|
__out_bcount(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
|
|
__inout PULONG PrivilegeSetLength,
|
|
__out_ecount(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
|
|
__out_ecount(ObjectTypeListLength) PNTSTATUS AccessStatus
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAccessCheckByTypeResultListAndAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in PUNICODE_STRING ObjectTypeName,
|
|
__in PUNICODE_STRING ObjectName,
|
|
__in PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in_opt PSID PrincipalSelfSid,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in AUDIT_EVENT_TYPE AuditType,
|
|
__in ULONG Flags,
|
|
__in_ecount_opt(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
__in ULONG ObjectTypeListLength,
|
|
__in PGENERIC_MAPPING GenericMapping,
|
|
__in BOOLEAN ObjectCreation,
|
|
__out_ecount(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
|
|
__out_ecount(ObjectTypeListLength) PNTSTATUS AccessStatus,
|
|
__out PBOOLEAN GenerateOnClose
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in HANDLE ClientToken,
|
|
__in PUNICODE_STRING ObjectTypeName,
|
|
__in PUNICODE_STRING ObjectName,
|
|
__in PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in_opt PSID PrincipalSelfSid,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in AUDIT_EVENT_TYPE AuditType,
|
|
__in ULONG Flags,
|
|
__in_ecount_opt(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
__in ULONG ObjectTypeListLength,
|
|
__in PGENERIC_MAPPING GenericMapping,
|
|
__in BOOLEAN ObjectCreation,
|
|
__out_ecount(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
|
|
__out_ecount(ObjectTypeListLength) PNTSTATUS AccessStatus,
|
|
__out PBOOLEAN GenerateOnClose
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAcquireCMFViewOwnership(
|
|
__out PULONGLONG TimeStamp,
|
|
__out PBOOLEAN tokenTaken,
|
|
__in BOOLEAN replaceExisting
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAddAtom(
|
|
__in_bcount_opt(Length) PWSTR AtomName,
|
|
__in ULONG Length,
|
|
__out_opt PRTL_ATOM Atom
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAdjustGroupsToken(
|
|
__in HANDLE TokenHandle,
|
|
__in BOOLEAN ResetToDefault,
|
|
__in_opt PTOKEN_GROUPS NewState,
|
|
__in_opt ULONG BufferLength,
|
|
__out_bcount_part_opt(BufferLength, *ReturnLength) PTOKEN_GROUPS PreviousState,
|
|
__out PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAdjustPrivilegesToken(
|
|
__in HANDLE TokenHandle,
|
|
__in BOOLEAN DisableAllPrivileges,
|
|
__in_opt PTOKEN_PRIVILEGES NewState,
|
|
__in ULONG BufferLength,
|
|
__out_bcount_part_opt(BufferLength, *ReturnLength) PTOKEN_PRIVILEGES PreviousState,
|
|
__out __drv_when(PreviousState == NULL, __out_opt) PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlertResumeThread(
|
|
__in HANDLE ThreadHandle,
|
|
__out_opt PULONG PreviousSuspendCount
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlertThread(
|
|
__in HANDLE ThreadHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAllocateLocallyUniqueId(
|
|
__out PLUID Luid
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAllocateReserveObject(
|
|
__out PHANDLE MemoryReserveHandle,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in RESERVE_OBJECT_TYPE Type
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAllocateUserPhysicalPages(
|
|
__in HANDLE ProcessHandle,
|
|
__inout PULONG_PTR NumberOfPages,
|
|
__out_ecount(*NumberOfPages) PULONG_PTR UserPfnArray
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAllocateUuids(
|
|
__out PULARGE_INTEGER Time,
|
|
__out PULONG Range,
|
|
__out PULONG Sequence,
|
|
__out PCHAR Seed
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAllocateVirtualMemory(
|
|
__in HANDLE ProcessHandle,
|
|
__inout PVOID *BaseAddress,
|
|
__in ULONG_PTR ZeroBits,
|
|
__inout PSIZE_T RegionSize,
|
|
__in ULONG AllocationType,
|
|
__in ULONG Protect
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcAcceptConnectPort(
|
|
__out PHANDLE PortHandle,
|
|
__in HANDLE ConnectionPortHandle,
|
|
__in ULONG Flags,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in PALPC_PORT_ATTRIBUTES PortAttributes,
|
|
__in_opt PVOID PortContext,
|
|
__in PPORT_MESSAGE ConnectionRequest,
|
|
__inout_opt PALPC_MESSAGE_ATTRIBUTES ConnectionMessageAttributes,
|
|
__in BOOLEAN AcceptConnection
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcCancelMessage(
|
|
__in HANDLE PortHandle,
|
|
__in ULONG Flags,
|
|
__in PALPC_CONTEXT_ATTR MessageContext
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcConnectPort(
|
|
__out PHANDLE PortHandle,
|
|
__in PUNICODE_STRING PortName,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in_opt PALPC_PORT_ATTRIBUTES PortAttributes,
|
|
__in ULONG Flags,
|
|
__in_opt PSID RequiredServerSid,
|
|
__inout PPORT_MESSAGE ConnectionMessage,
|
|
__inout_opt PULONG BufferLength,
|
|
__inout_opt PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,
|
|
__inout_opt PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,
|
|
__in_opt PLARGE_INTEGER Timeout
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcCreatePort(
|
|
__out PHANDLE PortHandle,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in_opt PALPC_PORT_ATTRIBUTES PortAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcCreatePortSection(
|
|
__in HANDLE PortHandle,
|
|
__in ULONG Flags,
|
|
__in_opt HANDLE SectionHandle,
|
|
__in SIZE_T SectionSize,
|
|
__out PALPC_HANDLE AlpcSectionHandle,
|
|
__out PSIZE_T ActualSectionSize
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcCreateResourceReserve(
|
|
__in HANDLE PortHandle,
|
|
__reserved ULONG Flags,
|
|
__in SIZE_T MessageSize,
|
|
__out PALPC_HANDLE ResourceId
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcCreateSectionView(
|
|
__in HANDLE PortHandle,
|
|
__reserved ULONG Flags,
|
|
__inout PALPC_DATA_VIEW_ATTR ViewAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcCreateSecurityContext(
|
|
__in HANDLE PortHandle,
|
|
__reserved ULONG Flags,
|
|
__inout PALPC_SECURITY_ATTR SecurityAttribute
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcDeletePortSection(
|
|
__in HANDLE PortHandle,
|
|
__reserved ULONG Flags,
|
|
__in ALPC_HANDLE SectionHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcDeleteResourceReserve(
|
|
__in HANDLE PortHandle,
|
|
__reserved ULONG Flags,
|
|
__in ALPC_HANDLE ResourceId
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcDeleteSectionView(
|
|
__in HANDLE PortHandle,
|
|
__reserved ULONG Flags,
|
|
__in PVOID ViewBase
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcDeleteSecurityContext(
|
|
__in HANDLE PortHandle,
|
|
__reserved ULONG Flags,
|
|
__in ALPC_HANDLE ContextHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcDisconnectPort(
|
|
__in HANDLE PortHandle,
|
|
__in ULONG Flags
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcImpersonateClientOfPort(
|
|
__in HANDLE PortHandle,
|
|
__in PPORT_MESSAGE PortMessage,
|
|
__reserved PVOID Reserved
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcOpenSenderProcess(
|
|
__out PHANDLE ProcessHandle,
|
|
__in HANDLE PortHandle,
|
|
__in PPORT_MESSAGE PortMessage,
|
|
__reserved ULONG Flags,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcOpenSenderThread(
|
|
__out PHANDLE ThreadHandle,
|
|
__in HANDLE PortHandle,
|
|
__in PPORT_MESSAGE PortMessage,
|
|
__reserved ULONG Flags,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcQueryInformation(
|
|
__in HANDLE PortHandle,
|
|
__in ALPC_PORT_INFORMATION_CLASS PortInformationClass,
|
|
__out_bcount(Length) PVOID PortInformation,
|
|
__in ULONG Length,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcQueryInformationMessage(
|
|
__in HANDLE PortHandle,
|
|
__in PPORT_MESSAGE PortMessage,
|
|
__in ALPC_MESSAGE_INFORMATION_CLASS MessageInformationClass,
|
|
__out_bcount(Length) PVOID MessageInformation,
|
|
__in ULONG Length,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcRevokeSecurityContext(
|
|
__in HANDLE PortHandle,
|
|
__reserved ULONG Flags,
|
|
__in ALPC_HANDLE ContextHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcSendWaitReceivePort(
|
|
__in HANDLE PortHandle,
|
|
__in ULONG Flags,
|
|
__in_opt PPORT_MESSAGE SendMessage,
|
|
__in_opt PALPC_MESSAGE_ATTRIBUTES SendMessageAttributes,
|
|
__inout_opt PPORT_MESSAGE ReceiveMessage,
|
|
__inout_opt PULONG BufferLength,
|
|
__inout_opt PALPC_MESSAGE_ATTRIBUTES ReceiveMessageAttributes,
|
|
__in_opt PLARGE_INTEGER Timeout
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAlpcSetInformation(
|
|
__in HANDLE PortHandle,
|
|
__in ALPC_PORT_INFORMATION_CLASS PortInformationClass,
|
|
__in_bcount(Length) PVOID PortInformation,
|
|
__in ULONG Length
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAreMappedFilesTheSame(
|
|
__in PVOID File1MappedAsAnImage,
|
|
__in PVOID File2MappedAsFile
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwAssignProcessToJobObject(
|
|
__in HANDLE JobHandle,
|
|
__in HANDLE ProcessHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCallbackReturn(
|
|
__in_bcount_opt(OutputLength) PVOID OutputBuffer,
|
|
__in ULONG OutputLength,
|
|
__in NTSTATUS Status
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCancelIoFile(
|
|
__in HANDLE FileHandle,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCancelIoFileEx(
|
|
__in HANDLE FileHandle,
|
|
__in_opt PIO_STATUS_BLOCK IoRequestToCancel,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCancelSynchronousIoFile(
|
|
__in HANDLE ThreadHandle,
|
|
__in_opt PIO_STATUS_BLOCK IoRequestToCancel,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCancelTimer(
|
|
__in HANDLE TimerHandle,
|
|
__out_opt PBOOLEAN CurrentState
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwClearEvent(
|
|
__in HANDLE EventHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwClose(
|
|
__in HANDLE Handle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCloseObjectAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in BOOLEAN GenerateOnClose
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCommitComplete(
|
|
__in HANDLE EnlistmentHandle,
|
|
__in_opt PLARGE_INTEGER TmVirtualClock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCommitEnlistment(
|
|
__in HANDLE EnlistmentHandle,
|
|
__in_opt PLARGE_INTEGER TmVirtualClock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCommitTransaction(
|
|
__in HANDLE TransactionHandle,
|
|
__in BOOLEAN Wait
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCompactKeys(
|
|
__in ULONG Count,
|
|
__in_ecount(Count) HANDLE KeyArray[]
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCompareTokens(
|
|
__in HANDLE FirstTokenHandle,
|
|
__in HANDLE SecondTokenHandle,
|
|
__out PBOOLEAN Equal
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCompleteConnectPort(
|
|
__in HANDLE PortHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCompressKey(
|
|
__in HANDLE Key
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwConnectPort(
|
|
__out PHANDLE PortHandle,
|
|
__in PUNICODE_STRING PortName,
|
|
__in PSECURITY_QUALITY_OF_SERVICE SecurityQos,
|
|
__inout_opt PPORT_VIEW ClientView,
|
|
__inout_opt PREMOTE_PORT_VIEW ServerView,
|
|
__out_opt PULONG MaxMessageLength,
|
|
__inout_opt PVOID ConnectionInformation,
|
|
__inout_opt PULONG ConnectionInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwContinue(
|
|
__in PCONTEXT ContextRecord,
|
|
__in BOOLEAN TestAlert
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateDebugObject(
|
|
__out PHANDLE DebugObjectHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in ULONG Flags
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateDirectoryObject(
|
|
__out PHANDLE DirectoryHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateEnlistment(
|
|
__out PHANDLE EnlistmentHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in HANDLE ResourceManagerHandle,
|
|
__in HANDLE TransactionHandle,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in_opt ULONG CreateOptions,
|
|
__in NOTIFICATION_MASK NotificationMask,
|
|
__in_opt PVOID EnlistmentKey
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateEvent(
|
|
__out PHANDLE EventHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in EVENT_TYPE EventType,
|
|
__in BOOLEAN InitialState
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateEventPair(
|
|
__out PHANDLE EventPairHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateFile(
|
|
__out PHANDLE FileHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in_opt PLARGE_INTEGER AllocationSize,
|
|
__in ULONG FileAttributes,
|
|
__in ULONG ShareAccess,
|
|
__in ULONG CreateDisposition,
|
|
__in ULONG CreateOptions,
|
|
__in_bcount_opt(EaLength) PVOID EaBuffer,
|
|
__in ULONG EaLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateIoCompletion(
|
|
__out PHANDLE IoCompletionHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in_opt ULONG Count
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateJobObject(
|
|
__out PHANDLE JobHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateJobSet(
|
|
__in ULONG NumJob,
|
|
__in_ecount(NumJob) PJOB_SET_ARRAY UserJobSet,
|
|
__in ULONG Flags
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateKey(
|
|
__out PHANDLE KeyHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__reserved ULONG TitleIndex,
|
|
__in_opt PUNICODE_STRING Class,
|
|
__in ULONG CreateOptions,
|
|
__out_opt PULONG Disposition
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateKeyTransacted(
|
|
__out PHANDLE KeyHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__reserved ULONG TitleIndex,
|
|
__in_opt PUNICODE_STRING Class,
|
|
__in ULONG CreateOptions,
|
|
__in HANDLE TransactionHandle,
|
|
__out_opt PULONG Disposition
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateKeyedEvent(
|
|
__out PHANDLE KeyedEventHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in ULONG Flags
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateMailslotFile(
|
|
__out PHANDLE FileHandle,
|
|
__in ULONG DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in ULONG CreateOptions,
|
|
__in ULONG MailslotQuota,
|
|
__in ULONG MaximumMessageSize,
|
|
__in PLARGE_INTEGER ReadTimeout
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateMutant(
|
|
__out PHANDLE MutantHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in BOOLEAN InitialOwner
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateNamedPipeFile(
|
|
__out PHANDLE FileHandle,
|
|
__in ULONG DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in ULONG ShareAccess,
|
|
__in ULONG CreateDisposition,
|
|
__in ULONG CreateOptions,
|
|
__in ULONG NamedPipeType,
|
|
__in ULONG ReadMode,
|
|
__in ULONG CompletionMode,
|
|
__in ULONG MaximumInstances,
|
|
__in ULONG InboundQuota,
|
|
__in ULONG OutboundQuota,
|
|
__in_opt PLARGE_INTEGER DefaultTimeout
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreatePagingFile(
|
|
__in PUNICODE_STRING PageFileName,
|
|
__in PLARGE_INTEGER MinimumSize,
|
|
__in PLARGE_INTEGER MaximumSize,
|
|
__in ULONG Priority
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreatePort(
|
|
__out PHANDLE PortHandle,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in ULONG MaxConnectionInfoLength,
|
|
__in ULONG MaxMessageLength,
|
|
__in_opt ULONG MaxPoolUsage
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreatePrivateNamespace(
|
|
__out PHANDLE NamespaceHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in PVOID BoundaryDescriptor
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateProcess(
|
|
__out PHANDLE ProcessHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in HANDLE ParentProcess,
|
|
__in BOOLEAN InheritObjectTable,
|
|
__in_opt HANDLE SectionHandle,
|
|
__in_opt HANDLE DebugPort,
|
|
__in_opt HANDLE ExceptionPort
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateProcessEx(
|
|
__out PHANDLE ProcessHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in HANDLE ParentProcess,
|
|
__in ULONG Flags,
|
|
__in_opt HANDLE SectionHandle,
|
|
__in_opt HANDLE DebugPort,
|
|
__in_opt HANDLE ExceptionPort,
|
|
__in ULONG JobMemberLevel
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateProfile(
|
|
__out PHANDLE ProfileHandle,
|
|
__in_opt HANDLE Process,
|
|
__in PVOID ProfileBase,
|
|
__in SIZE_T ProfileSize,
|
|
__in ULONG BucketSize,
|
|
__in PULONG Buffer,
|
|
__in ULONG BufferSize,
|
|
__in KPROFILE_SOURCE ProfileSource,
|
|
__in KAFFINITY Affinity
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateProfileEx(
|
|
__out PHANDLE ProfileHandle,
|
|
__in_opt HANDLE Process,
|
|
__in PVOID ProfileBase,
|
|
__in SIZE_T ProfileSize,
|
|
__in ULONG BucketSize,
|
|
__in PULONG Buffer,
|
|
__in ULONG BufferSize,
|
|
__in KPROFILE_SOURCE ProfileSource,
|
|
__in ULONG GroupAffinityCount,
|
|
__in_opt PGROUP_AFFINITY GroupAffinity
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateResourceManager(
|
|
__out PHANDLE ResourceManagerHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in HANDLE TmHandle,
|
|
__in LPGUID RmGuid,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in_opt ULONG CreateOptions,
|
|
__in_opt PUNICODE_STRING Description
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateSection(
|
|
__out PHANDLE SectionHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in_opt PLARGE_INTEGER MaximumSize,
|
|
__in ULONG SectionPageProtection,
|
|
__in ULONG AllocationAttributes,
|
|
__in_opt HANDLE FileHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateSemaphore(
|
|
__out PHANDLE SemaphoreHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in LONG InitialCount,
|
|
__in LONG MaximumCount
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateSymbolicLinkObject(
|
|
__out PHANDLE LinkHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in PUNICODE_STRING LinkTarget
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateThread(
|
|
__out PHANDLE ThreadHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in HANDLE ProcessHandle,
|
|
__out PCLIENT_ID ClientId,
|
|
__in PCONTEXT ThreadContext,
|
|
__in PINITIAL_TEB InitialTeb,
|
|
__in BOOLEAN CreateSuspended
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateThreadEx(
|
|
__out PHANDLE ThreadHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in HANDLE ProcessHandle,
|
|
__in PVOID StartRoutine,
|
|
__in_opt PVOID Argument,
|
|
__in ULONG CreateFlags, // THREAD_CREATE_FLAGS_*
|
|
__in_opt ULONG_PTR ZeroBits,
|
|
__in_opt SIZE_T StackSize,
|
|
__in_opt SIZE_T MaximumStackSize,
|
|
__in_opt PPS_ATTRIBUTE_LIST AttributeList
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateTimer(
|
|
__out PHANDLE TimerHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in TIMER_TYPE TimerType
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateToken(
|
|
__out PHANDLE TokenHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in TOKEN_TYPE TokenType,
|
|
__in PLUID AuthenticationId,
|
|
__in PLARGE_INTEGER ExpirationTime,
|
|
__in PTOKEN_USER User,
|
|
__in PTOKEN_GROUPS Groups,
|
|
__in PTOKEN_PRIVILEGES Privileges,
|
|
__in_opt PTOKEN_OWNER Owner,
|
|
__in PTOKEN_PRIMARY_GROUP PrimaryGroup,
|
|
__in_opt PTOKEN_DEFAULT_DACL DefaultDacl,
|
|
__in PTOKEN_SOURCE TokenSource
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateTransaction(
|
|
__out PHANDLE TransactionHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in_opt LPGUID Uow,
|
|
__in_opt HANDLE TmHandle,
|
|
__in_opt ULONG CreateOptions,
|
|
__in_opt ULONG IsolationLevel,
|
|
__in_opt ULONG IsolationFlags,
|
|
__in_opt PLARGE_INTEGER Timeout,
|
|
__in_opt PUNICODE_STRING Description
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateTransactionManager(
|
|
__out PHANDLE TmHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in_opt PUNICODE_STRING LogFileName,
|
|
__in_opt ULONG CreateOptions,
|
|
__in_opt ULONG CommitStrength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateUserProcess(
|
|
__out PHANDLE ProcessHandle,
|
|
__out PHANDLE ThreadHandle,
|
|
__in ACCESS_MASK ProcessDesiredAccess,
|
|
__in ACCESS_MASK ThreadDesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ProcessObjectAttributes,
|
|
__in_opt POBJECT_ATTRIBUTES ThreadObjectAttributes,
|
|
__in ULONG ProcessFlags, // PROCESS_CREATE_FLAGS_*
|
|
__in ULONG ThreadFlags, // THREAD_CREATE_FLAGS_*
|
|
__in_opt PVOID ProcessParameters,
|
|
__inout PPS_CREATE_INFO CreateInfo,
|
|
__in_opt PPS_ATTRIBUTE_LIST AttributeList
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateWaitablePort(
|
|
__out PHANDLE PortHandle,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in ULONG MaxConnectionInfoLength,
|
|
__in ULONG MaxMessageLength,
|
|
__in_opt ULONG MaxPoolUsage
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwCreateWorkerFactory(
|
|
__out PHANDLE WorkerFactoryHandleReturn,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in HANDLE CompletionPortHandle,
|
|
__in HANDLE WorkerProcessHandle,
|
|
__in PVOID StartRoutine,
|
|
__in_opt PVOID StartParameter,
|
|
__in_opt ULONG MaxThreadCount,
|
|
__in_opt SIZE_T StackReserve,
|
|
__in_opt SIZE_T StackCommit
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDebugActiveProcess(
|
|
__in HANDLE ProcessHandle,
|
|
__in HANDLE DebugObjectHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDebugContinue(
|
|
__in HANDLE DebugObjectHandle,
|
|
__in PCLIENT_ID ClientId,
|
|
__in NTSTATUS ContinueStatus
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDelayExecution(
|
|
__in BOOLEAN Alertable,
|
|
__in PLARGE_INTEGER DelayInterval
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDeleteAtom(
|
|
__in RTL_ATOM Atom
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDeleteFile(
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDeleteKey(
|
|
__in HANDLE KeyHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDeleteObjectAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in BOOLEAN GenerateOnClose
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDeletePrivateNamespace(
|
|
__in HANDLE NamespaceHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDeleteValueKey(
|
|
__in HANDLE KeyHandle,
|
|
__in PUNICODE_STRING ValueName
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDeviceIoControlFile(
|
|
__in HANDLE FileHandle,
|
|
__in_opt HANDLE Event,
|
|
__in_opt PIO_APC_ROUTINE ApcRoutine,
|
|
__in_opt PVOID ApcContext,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in ULONG IoControlCode,
|
|
__in_bcount_opt(InputBufferLength) PVOID InputBuffer,
|
|
__in ULONG InputBufferLength,
|
|
__out_bcount_opt(OutputBufferLength) PVOID OutputBuffer,
|
|
__in ULONG OutputBufferLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDisableLastKnownGood(
|
|
VOID
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDisplayString(
|
|
__in PUNICODE_STRING String
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDrawText(
|
|
__in PUNICODE_STRING Text
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDuplicateObject(
|
|
__in HANDLE SourceProcessHandle,
|
|
__in HANDLE SourceHandle,
|
|
__in_opt HANDLE TargetProcessHandle,
|
|
__out_opt PHANDLE TargetHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in ULONG HandleAttributes,
|
|
__in ULONG Options
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwDuplicateToken(
|
|
__in HANDLE ExistingTokenHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in BOOLEAN EffectiveOnly,
|
|
__in TOKEN_TYPE TokenType,
|
|
__out PHANDLE NewTokenHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwEnableLastKnownGood(
|
|
VOID
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwEnumerateKey(
|
|
__in HANDLE KeyHandle,
|
|
__in ULONG Index,
|
|
__in KEY_INFORMATION_CLASS KeyInformationClass,
|
|
__out_bcount_opt(Length) PVOID KeyInformation,
|
|
__in ULONG Length,
|
|
__out PULONG ResultLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwEnumerateTransactionObject(
|
|
__in_opt HANDLE RootObjectHandle,
|
|
__in KTMOBJECT_TYPE QueryType,
|
|
__inout_bcount(ObjectCursorLength) PKTMOBJECT_CURSOR ObjectCursor,
|
|
__in ULONG ObjectCursorLength,
|
|
__out PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwEnumerateValueKey(
|
|
__in HANDLE KeyHandle,
|
|
__in ULONG Index,
|
|
__in KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
|
|
__out_bcount_opt(Length) PVOID KeyValueInformation,
|
|
__in ULONG Length,
|
|
__out PULONG ResultLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwExtendSection(
|
|
__in HANDLE SectionHandle,
|
|
__inout PLARGE_INTEGER NewSectionSize
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwFilterToken(
|
|
__in HANDLE ExistingTokenHandle,
|
|
__in ULONG Flags,
|
|
__in_opt PTOKEN_GROUPS SidsToDisable,
|
|
__in_opt PTOKEN_PRIVILEGES PrivilegesToDelete,
|
|
__in_opt PTOKEN_GROUPS RestrictedSids,
|
|
__out PHANDLE NewTokenHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwFindAtom(
|
|
__in_bcount_opt(Length) PWSTR AtomName,
|
|
__in ULONG Length,
|
|
__out_opt PRTL_ATOM Atom
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwFlushBuffersFile(
|
|
__in HANDLE FileHandle,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwFlushInstallUILanguage(
|
|
__in LANGID InstallUILanguage,
|
|
__in ULONG SetComittedFlag
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwFlushInstructionCache(
|
|
__in HANDLE ProcessHandle,
|
|
__in_opt PVOID BaseAddress,
|
|
__in SIZE_T Length
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwFlushKey(
|
|
__in HANDLE KeyHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
VOID
|
|
NTAPI
|
|
ZwFlushProcessWriteBuffers(
|
|
VOID
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwFlushWriteBuffer(
|
|
VOID
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwFreeUserPhysicalPages(
|
|
__in HANDLE ProcessHandle,
|
|
__inout PULONG_PTR NumberOfPages,
|
|
__in_ecount(*NumberOfPages) PULONG_PTR UserPfnArray
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwFreeVirtualMemory(
|
|
__in HANDLE ProcessHandle,
|
|
__inout PVOID *BaseAddress,
|
|
__inout PSIZE_T RegionSize,
|
|
__in ULONG FreeType
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwFreezeRegistry(
|
|
__in ULONG TimeOutInSeconds
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwFreezeTransactions(
|
|
__in PLARGE_INTEGER FreezeTimeout,
|
|
__in PLARGE_INTEGER ThawTimeout
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwFsControlFile(
|
|
__in HANDLE FileHandle,
|
|
__in_opt HANDLE Event,
|
|
__in_opt PIO_APC_ROUTINE ApcRoutine,
|
|
__in_opt PVOID ApcContext,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in ULONG FsControlCode,
|
|
__in_bcount_opt(InputBufferLength) PVOID InputBuffer,
|
|
__in ULONG InputBufferLength,
|
|
__out_bcount_opt(OutputBufferLength) PVOID OutputBuffer,
|
|
__in ULONG OutputBufferLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwGetContextThread(
|
|
__in HANDLE ThreadHandle,
|
|
__inout PCONTEXT ThreadContext
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
ULONG
|
|
NTAPI
|
|
ZwGetCurrentProcessorNumber(
|
|
VOID
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwGetDevicePowerState(
|
|
__in HANDLE Device,
|
|
__out PDEVICE_POWER_STATE State
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwGetMUIRegistryInfo(
|
|
__in ULONG Flags,
|
|
__inout PULONG DataSize,
|
|
__out PVOID Data
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwGetNextProcess(
|
|
__in HANDLE ProcessHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in ULONG HandleAttributes,
|
|
__in ULONG Flags,
|
|
__out PHANDLE NewProcessHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwGetNextThread(
|
|
__in HANDLE ProcessHandle,
|
|
__in HANDLE ThreadHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in ULONG HandleAttributes,
|
|
__in ULONG Flags,
|
|
__out PHANDLE NewThreadHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwGetNlsSectionPtr(
|
|
__in ULONG SectionType,
|
|
__in ULONG SectionData,
|
|
__in PVOID ContextData,
|
|
__out PVOID *SectionPointer,
|
|
__out PULONG SectionSize
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwGetNotificationResourceManager(
|
|
__in HANDLE ResourceManagerHandle,
|
|
__out PTRANSACTION_NOTIFICATION TransactionNotification,
|
|
__in ULONG NotificationLength,
|
|
__in_opt PLARGE_INTEGER Timeout,
|
|
__out_opt PULONG ReturnLength,
|
|
__in ULONG Asynchronous,
|
|
__in_opt ULONG_PTR AsynchronousContext
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwGetPlugPlayEvent(
|
|
__in HANDLE EventHandle,
|
|
__in_opt PVOID Context,
|
|
__out_bcount(EventBufferSize) PPLUGPLAY_EVENT_BLOCK EventBlock,
|
|
__in ULONG EventBufferSize
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwGetWriteWatch(
|
|
__in HANDLE ProcessHandle,
|
|
__in ULONG Flags,
|
|
__in PVOID BaseAddress,
|
|
__in SIZE_T RegionSize,
|
|
__out_ecount(*EntriesInUserAddressArray) PVOID *UserAddressArray,
|
|
__inout PULONG_PTR EntriesInUserAddressArray,
|
|
__out PULONG Granularity
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwImpersonateAnonymousToken(
|
|
__in HANDLE ThreadHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwImpersonateClientOfPort(
|
|
__in HANDLE PortHandle,
|
|
__in PPORT_MESSAGE Message
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwImpersonateThread(
|
|
__in HANDLE ServerThreadHandle,
|
|
__in HANDLE ClientThreadHandle,
|
|
__in PSECURITY_QUALITY_OF_SERVICE SecurityQos
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwInitializeNlsFiles(
|
|
__out PVOID *BaseAddress,
|
|
__out PLCID DefaultLocaleId,
|
|
__out PLARGE_INTEGER DefaultCasingTableSize,
|
|
__out_opt PULONG CurrentNLSVersion
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwInitializeRegistry(
|
|
__in USHORT BootCondition
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwInitiatePowerAction(
|
|
__in POWER_ACTION SystemAction,
|
|
__in SYSTEM_POWER_STATE LightestSystemState,
|
|
__in ULONG Flags, // POWER_ACTION_* flags
|
|
__in BOOLEAN Asynchronous
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwIsProcessInJob(
|
|
__in HANDLE ProcessHandle,
|
|
__in_opt HANDLE JobHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
BOOLEAN
|
|
NTAPI
|
|
ZwIsSystemResumeAutomatic(
|
|
VOID
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwIsUILanguageComitted(
|
|
VOID
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwListenPort(
|
|
__in HANDLE PortHandle,
|
|
__out PPORT_MESSAGE ConnectionRequest
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwLoadDriver(
|
|
__in PUNICODE_STRING DriverServiceName
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwLoadKey(
|
|
__in POBJECT_ATTRIBUTES TargetKey,
|
|
__in POBJECT_ATTRIBUTES SourceFile
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwLoadKey2(
|
|
__in POBJECT_ATTRIBUTES TargetKey,
|
|
__in POBJECT_ATTRIBUTES SourceFile,
|
|
__in ULONG Flags
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwLoadKeyEx(
|
|
__in POBJECT_ATTRIBUTES TargetKey,
|
|
__in POBJECT_ATTRIBUTES SourceFile,
|
|
__in ULONG Flags,
|
|
__in_opt HANDLE TrustClassKey
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwLockFile(
|
|
__in HANDLE FileHandle,
|
|
__in_opt HANDLE Event,
|
|
__in_opt PIO_APC_ROUTINE ApcRoutine,
|
|
__in_opt PVOID ApcContext,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in PLARGE_INTEGER ByteOffset,
|
|
__in PLARGE_INTEGER Length,
|
|
__in ULONG Key,
|
|
__in BOOLEAN FailImmediately,
|
|
__in BOOLEAN ExclusiveLock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwLockProductActivationKeys(
|
|
__inout_opt ULONG *pPrivateVer,
|
|
__out_opt ULONG *pSafeMode
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwLockRegistryKey(
|
|
__in HANDLE KeyHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwLockVirtualMemory(
|
|
__in HANDLE ProcessHandle,
|
|
__inout PVOID *BaseAddress,
|
|
__inout PSIZE_T RegionSize,
|
|
__in ULONG MapType
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwMakeTemporaryObject(
|
|
__in HANDLE Handle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwMapCMFModule(
|
|
__in ULONG What,
|
|
__in ULONG Index,
|
|
__out_opt PULONG CacheIndexOut,
|
|
__out_opt PULONG CacheFlagsOut,
|
|
__out_opt PULONG ViewSizeOut,
|
|
__out_opt PVOID *BaseAddress
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwMapUserPhysicalPages(
|
|
__in PVOID VirtualAddress,
|
|
__in ULONG_PTR NumberOfPages,
|
|
__in_ecount_opt(NumberOfPages) PULONG_PTR UserPfnArray
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwMapUserPhysicalPagesScatter(
|
|
__in_ecount(NumberOfPages) PVOID *VirtualAddresses,
|
|
__in ULONG_PTR NumberOfPages,
|
|
__in_ecount_opt(NumberOfPages) PULONG_PTR UserPfnArray
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwMapViewOfSection(
|
|
__in HANDLE SectionHandle,
|
|
__in HANDLE ProcessHandle,
|
|
__inout PVOID *BaseAddress,
|
|
__in ULONG_PTR ZeroBits,
|
|
__in SIZE_T CommitSize,
|
|
__inout_opt PLARGE_INTEGER SectionOffset,
|
|
__inout PSIZE_T ViewSize,
|
|
__in SECTION_INHERIT InheritDisposition,
|
|
__in ULONG AllocationType,
|
|
__in ULONG Win32Protect
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwNotifyChangeDirectoryFile(
|
|
__in HANDLE FileHandle,
|
|
__in_opt HANDLE Event,
|
|
__in_opt PIO_APC_ROUTINE ApcRoutine,
|
|
__in_opt PVOID ApcContext,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__out_bcount(Length) PVOID Buffer,
|
|
__in ULONG Length,
|
|
__in ULONG CompletionFilter,
|
|
__in BOOLEAN WatchTree
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwNotifyChangeKey(
|
|
__in HANDLE KeyHandle,
|
|
__in_opt HANDLE Event,
|
|
__in_opt PIO_APC_ROUTINE ApcRoutine,
|
|
__in_opt PVOID ApcContext,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in ULONG CompletionFilter,
|
|
__in BOOLEAN WatchTree,
|
|
__out_bcount_opt(BufferSize) PVOID Buffer,
|
|
__in ULONG BufferSize,
|
|
__in BOOLEAN Asynchronous
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwNotifyChangeMultipleKeys(
|
|
__in HANDLE MasterKeyHandle,
|
|
__in_opt ULONG Count,
|
|
__in_ecount_opt(Count) OBJECT_ATTRIBUTES SlaveObjects[],
|
|
__in_opt HANDLE Event,
|
|
__in_opt PIO_APC_ROUTINE ApcRoutine,
|
|
__in_opt PVOID ApcContext,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in ULONG CompletionFilter,
|
|
__in BOOLEAN WatchTree,
|
|
__out_bcount_opt(BufferSize) PVOID Buffer,
|
|
__in ULONG BufferSize,
|
|
__in BOOLEAN Asynchronous
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenDirectoryObject(
|
|
__out PHANDLE DirectoryHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenEnlistment(
|
|
__out PHANDLE EnlistmentHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in HANDLE ResourceManagerHandle,
|
|
__in LPGUID EnlistmentGuid,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenEvent(
|
|
__out PHANDLE EventHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenEventPair(
|
|
__out PHANDLE EventPairHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenFile(
|
|
__out PHANDLE FileHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in ULONG ShareAccess,
|
|
__in ULONG OpenOptions
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenIoCompletion(
|
|
__out PHANDLE IoCompletionHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenJobObject(
|
|
__out PHANDLE JobHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenKey(
|
|
__out PHANDLE KeyHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenKeyEx(
|
|
__out PHANDLE KeyHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in ULONG OpenOptions
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenKeyTransacted(
|
|
__out PHANDLE KeyHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in HANDLE TransactionHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenKeyTransactedEx(
|
|
__out PHANDLE KeyHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in ULONG OpenOptions,
|
|
__in HANDLE TransactionHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenKeyedEvent(
|
|
__out PHANDLE KeyedEventHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenMutant(
|
|
__out PHANDLE MutantHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenObjectAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in PUNICODE_STRING ObjectTypeName,
|
|
__in PUNICODE_STRING ObjectName,
|
|
__in_opt PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in HANDLE ClientToken,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in ACCESS_MASK GrantedAccess,
|
|
__in_opt PPRIVILEGE_SET Privileges,
|
|
__in BOOLEAN ObjectCreation,
|
|
__in BOOLEAN AccessGranted,
|
|
__out PBOOLEAN GenerateOnClose
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenPrivateNamespace(
|
|
__out PHANDLE NamespaceHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in PVOID BoundaryDescriptor
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenProcess(
|
|
__out PHANDLE ProcessHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in_opt PCLIENT_ID ClientId
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenProcessToken(
|
|
__in HANDLE ProcessHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__out PHANDLE TokenHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenProcessTokenEx(
|
|
__in HANDLE ProcessHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in ULONG HandleAttributes,
|
|
__out PHANDLE TokenHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenResourceManager(
|
|
__out PHANDLE ResourceManagerHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in HANDLE TmHandle,
|
|
__in_opt LPGUID ResourceManagerGuid,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenSection(
|
|
__out PHANDLE SectionHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenSemaphore(
|
|
__out PHANDLE SemaphoreHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenSession(
|
|
__out PHANDLE SessionHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenSymbolicLinkObject(
|
|
__out PHANDLE LinkHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenThread(
|
|
__out PHANDLE ThreadHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in_opt PCLIENT_ID ClientId
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenThreadToken(
|
|
__in HANDLE ThreadHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in BOOLEAN OpenAsSelf,
|
|
__out PHANDLE TokenHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenThreadTokenEx(
|
|
__in HANDLE ThreadHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in BOOLEAN OpenAsSelf,
|
|
__in ULONG HandleAttributes,
|
|
__out PHANDLE TokenHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenTimer(
|
|
__out PHANDLE TimerHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenTransaction(
|
|
__out PHANDLE TransactionHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in LPGUID Uow,
|
|
__in_opt HANDLE TmHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwOpenTransactionManager(
|
|
__out PHANDLE TmHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in_opt PUNICODE_STRING LogFileName,
|
|
__in_opt LPGUID TmIdentity,
|
|
__in_opt ULONG OpenOptions
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwPlugPlayControl(
|
|
__in PLUGPLAY_CONTROL_CLASS PnPControlClass,
|
|
__inout_bcount(PnPControlDataLength) PVOID PnPControlData,
|
|
__in ULONG PnPControlDataLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwPowerInformation(
|
|
__in POWER_INFORMATION_LEVEL InformationLevel,
|
|
__in_bcount_opt(InputBufferLength) PVOID InputBuffer,
|
|
__in ULONG InputBufferLength,
|
|
__out_bcount_opt(OutputBufferLength) PVOID OutputBuffer,
|
|
__in ULONG OutputBufferLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwPrePrepareComplete(
|
|
__in HANDLE EnlistmentHandle,
|
|
__in_opt PLARGE_INTEGER TmVirtualClock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwPrePrepareEnlistment(
|
|
__in HANDLE EnlistmentHandle,
|
|
__in_opt PLARGE_INTEGER TmVirtualClock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwPrepareComplete(
|
|
__in HANDLE EnlistmentHandle,
|
|
__in_opt PLARGE_INTEGER TmVirtualClock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwPrepareEnlistment(
|
|
__in HANDLE EnlistmentHandle,
|
|
__in_opt PLARGE_INTEGER TmVirtualClock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwPrivilegeCheck(
|
|
__in HANDLE ClientToken,
|
|
__inout PPRIVILEGE_SET RequiredPrivileges,
|
|
__out PBOOLEAN Result
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwPrivilegeObjectAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in HANDLE ClientToken,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in PPRIVILEGE_SET Privileges,
|
|
__in BOOLEAN AccessGranted
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwPrivilegedServiceAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in PUNICODE_STRING ServiceName,
|
|
__in HANDLE ClientToken,
|
|
__in PPRIVILEGE_SET Privileges,
|
|
__in BOOLEAN AccessGranted
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwPropagationComplete(
|
|
__in HANDLE ResourceManagerHandle,
|
|
__in ULONG RequestCookie,
|
|
__in ULONG BufferLength,
|
|
__in PVOID Buffer
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwPropagationFailed(
|
|
__in HANDLE ResourceManagerHandle,
|
|
__in ULONG RequestCookie,
|
|
__in NTSTATUS PropStatus
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwProtectVirtualMemory(
|
|
__in HANDLE ProcessHandle,
|
|
__inout PVOID *BaseAddress,
|
|
__inout PSIZE_T RegionSize,
|
|
__in ULONG NewProtect,
|
|
__out PULONG OldProtect
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwPulseEvent(
|
|
__in HANDLE EventHandle,
|
|
__out_opt PLONG PreviousState
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryAttributesFile(
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__out PFILE_BASIC_INFORMATION FileInformation
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryDebugFilterState(
|
|
__in ULONG ComponentId,
|
|
__in ULONG Level
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryDefaultLocale(
|
|
__in BOOLEAN UserProfile,
|
|
__out PLCID DefaultLocaleId
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryDefaultUILanguage(
|
|
__out LANGID *DefaultUILanguageId
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryDirectoryFile(
|
|
__in HANDLE FileHandle,
|
|
__in_opt HANDLE Event,
|
|
__in_opt PIO_APC_ROUTINE ApcRoutine,
|
|
__in_opt PVOID ApcContext,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__out_bcount(Length) PVOID FileInformation,
|
|
__in ULONG Length,
|
|
__in FILE_INFORMATION_CLASS FileInformationClass,
|
|
__in BOOLEAN ReturnSingleEntry,
|
|
__in_opt PUNICODE_STRING FileName,
|
|
__in BOOLEAN RestartScan
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryDirectoryObject(
|
|
__in HANDLE DirectoryHandle,
|
|
__out_bcount_opt(BufferLength) PVOID Buffer,
|
|
__in ULONG Length,
|
|
__in BOOLEAN ReturnSingleEntry,
|
|
__in BOOLEAN RestartScan,
|
|
__inout PULONG Context,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryEaFile(
|
|
__in HANDLE FileHandle,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__out_bcount(Length) PVOID Buffer,
|
|
__in ULONG Length,
|
|
__in BOOLEAN ReturnSingleEntry,
|
|
__in_bcount_opt(EaListLength) PVOID EaList,
|
|
__in ULONG EaListLength,
|
|
__in_opt PULONG EaIndex OPTIONAL,
|
|
__in BOOLEAN RestartScan
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryEvent(
|
|
__in HANDLE EventHandle,
|
|
__in EVENT_INFORMATION_CLASS EventInformationClass,
|
|
__out_bcount(EventInformationLength) PVOID EventInformation,
|
|
__in ULONG EventInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryFullAttributesFile(
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__out PFILE_NETWORK_OPEN_INFORMATION FileInformation
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryInformationAtom(
|
|
__in RTL_ATOM Atom,
|
|
__in ATOM_INFORMATION_CLASS AtomInformationClass,
|
|
__out_bcount(AtomInformationLength) PVOID AtomInformation,
|
|
__in ULONG AtomInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryInformationEnlistment(
|
|
__in HANDLE EnlistmentHandle,
|
|
__in ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,
|
|
__out_bcount(EnlistmentInformationLength) PVOID EnlistmentInformation,
|
|
__in ULONG EnlistmentInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryInformationFile(
|
|
__in HANDLE FileHandle,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__out_bcount(Length) PVOID FileInformation,
|
|
__in ULONG Length,
|
|
__in FILE_INFORMATION_CLASS FileInformationClass
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryInformationJobObject(
|
|
__in_opt HANDLE JobHandle,
|
|
__in JOBOBJECTINFOCLASS JobObjectInformationClass,
|
|
__out_bcount(JobObjectInformationLength) PVOID JobObjectInformation,
|
|
__in ULONG JobObjectInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryInformationPort(
|
|
__in HANDLE PortHandle,
|
|
__in PORT_INFORMATION_CLASS PortInformationClass,
|
|
__out_bcount(Length) PVOID PortInformation,
|
|
__in ULONG Length,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryInformationProcess(
|
|
__in HANDLE ProcessHandle,
|
|
__in PROCESS_INFORMATION_CLASS ProcessInformationClass,
|
|
__out_bcount(ProcessInformationLength) PVOID ProcessInformation,
|
|
__in ULONG ProcessInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryInformationResourceManager(
|
|
__in HANDLE ResourceManagerHandle,
|
|
__in RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass,
|
|
__out_bcount(ResourceManagerInformationLength) PVOID ResourceManagerInformation,
|
|
__in ULONG ResourceManagerInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryInformationThread(
|
|
__in HANDLE ThreadHandle,
|
|
__in THREAD_INFORMATION_CLASS ThreadInformationClass,
|
|
__out_bcount(ThreadInformationLength) PVOID ThreadInformation,
|
|
__in ULONG ThreadInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryInformationToken(
|
|
__in HANDLE TokenHandle,
|
|
__in TOKEN_INFORMATION_CLASS TokenInformationClass,
|
|
__out_bcount(TokenInformationLength) PVOID TokenInformation,
|
|
__in ULONG TokenInformationLength,
|
|
__out PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryInformationTransaction(
|
|
__in HANDLE TransactionHandle,
|
|
__in TRANSACTION_INFORMATION_CLASS TransactionInformationClass,
|
|
__out_bcount(TransactionInformationLength) PVOID TransactionInformation,
|
|
__in ULONG TransactionInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryInformationTransactionManager(
|
|
__in HANDLE TransactionManagerHandle,
|
|
__in TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass,
|
|
__out_bcount(TransactionManagerInformationLength) PVOID TransactionManagerInformation,
|
|
__in ULONG TransactionManagerInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryInformationWorkerFactory(
|
|
__in HANDLE WorkerFactoryHandle,
|
|
__in WORKERFACTORYINFOCLASS WorkerFactoryInformationClass,
|
|
__out_bcount(WorkerFactoryInformationLength) PVOID WorkerFactoryInformation,
|
|
__in ULONG WorkerFactoryInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryInstallUILanguage(
|
|
__out LANGID *InstallUILanguageId
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryIntervalProfile(
|
|
__in KPROFILE_SOURCE ProfileSource,
|
|
__out PULONG Interval
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryIoCompletion(
|
|
__in HANDLE IoCompletionHandle,
|
|
__in IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass,
|
|
__out_bcount(IoCompletionInformation) PVOID IoCompletionInformation,
|
|
__in ULONG IoCompletionInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryKey(
|
|
__in HANDLE KeyHandle,
|
|
__in KEY_INFORMATION_CLASS KeyInformationClass,
|
|
__out_bcount_opt(Length) PVOID KeyInformation,
|
|
__in ULONG Length,
|
|
__out PULONG ResultLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryMultipleValueKey(
|
|
__in HANDLE KeyHandle,
|
|
__inout_ecount(EntryCount) PKEY_VALUE_ENTRY ValueEntries,
|
|
__in ULONG EntryCount,
|
|
__out_bcount(*BufferLength) PVOID ValueBuffer,
|
|
__inout PULONG BufferLength,
|
|
__out_opt PULONG RequiredBufferLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryMutant(
|
|
__in HANDLE MutantHandle,
|
|
__in MUTANT_INFORMATION_CLASS MutantInformationClass,
|
|
__out_bcount(MutantInformationLength) PVOID MutantInformation,
|
|
__in ULONG MutantInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryObject(
|
|
__in HANDLE Handle,
|
|
__in OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
|
__out_bcount_opt(ObjectInformationLength) PVOID ObjectInformation,
|
|
__in ULONG ObjectInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryOpenSubKeys(
|
|
__in POBJECT_ATTRIBUTES TargetKey,
|
|
__out PULONG HandleCount
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryOpenSubKeysEx(
|
|
__in POBJECT_ATTRIBUTES TargetKey,
|
|
__in ULONG BufferLength,
|
|
__out_bcount(BufferLength) PVOID Buffer,
|
|
__out PULONG RequiredSize
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryPerformanceCounter(
|
|
__out PLARGE_INTEGER PerformanceCounter,
|
|
__out_opt PLARGE_INTEGER PerformanceFrequency
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryPortInformationProcess(
|
|
VOID
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryQuotaInformationFile(
|
|
__in HANDLE FileHandle,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__out_bcount(Length) PVOID Buffer,
|
|
__in ULONG Length,
|
|
__in BOOLEAN ReturnSingleEntry,
|
|
__in_bcount_opt(SidListLength) PVOID SidList,
|
|
__in ULONG SidListLength,
|
|
__in_opt PSID StartSid,
|
|
__in BOOLEAN RestartScan
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQuerySection(
|
|
__in HANDLE SectionHandle,
|
|
__in SECTION_INFORMATION_CLASS SectionInformationClass,
|
|
__out_bcount(SectionInformationLength) PVOID SectionInformation,
|
|
__in SIZE_T SectionInformationLength,
|
|
__out_opt PSIZE_T ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQuerySecurityAttributesToken(
|
|
__in HANDLE TokenHandle,
|
|
__in_ecount_opt(NumberOfAttributes) PUNICODE_STRING Attributes,
|
|
__in ULONG NumberOfAttributes,
|
|
__out_bcount(Length) PVOID Buffer, // PAUTHZ_SECURITY_ATTRIBUTES_INFORMATION
|
|
__in ULONG Length,
|
|
__out PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQuerySecurityObject(
|
|
__in HANDLE Handle,
|
|
__in SECURITY_INFORMATION SecurityInformation,
|
|
__out_bcount_opt(Length) PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in ULONG Length,
|
|
__out PULONG LengthNeeded
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQuerySemaphore(
|
|
__in HANDLE SemaphoreHandle,
|
|
__in SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,
|
|
__out_bcount(SemaphoreInformationLength) PVOID SemaphoreInformation,
|
|
__in ULONG SemaphoreInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQuerySymbolicLinkObject(
|
|
__in HANDLE LinkHandle,
|
|
__inout PUNICODE_STRING LinkTarget,
|
|
__out_opt PULONG ReturnedLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQuerySystemEnvironmentValue(
|
|
__in PUNICODE_STRING VariableName,
|
|
__out_bcount(ValueLength) PWSTR VariableValue,
|
|
__in USHORT ValueLength,
|
|
__out_opt PUSHORT ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQuerySystemInformation(
|
|
__in SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
|
__out_bcount_opt(SystemInformationLength) PVOID SystemInformation,
|
|
__in ULONG SystemInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQuerySystemInformationEx(
|
|
__in SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
|
__in_bcount(QueryInformationLength) PVOID QueryInformation,
|
|
__in ULONG QueryInformationLength,
|
|
__out_bcount_opt(SystemInformationLength) PVOID SystemInformation,
|
|
__in ULONG SystemInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQuerySystemTime(
|
|
__out PLARGE_INTEGER SystemTime
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryTimer(
|
|
__in HANDLE TimerHandle,
|
|
__in TIMER_INFORMATION_CLASS TimerInformationClass,
|
|
__out_bcount(TimerInformationLength) PVOID TimerInformation,
|
|
__in ULONG TimerInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryTimerResolution(
|
|
__out PULONG MaximumTime,
|
|
__out PULONG MinimumTime,
|
|
__out PULONG CurrentTime
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryValueKey(
|
|
__in HANDLE KeyHandle,
|
|
__in PUNICODE_STRING ValueName,
|
|
__in KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
|
|
__out_bcount_opt(Length) PVOID KeyValueInformation,
|
|
__in ULONG Length,
|
|
__out PULONG ResultLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryVirtualMemory(
|
|
__in HANDLE ProcessHandle,
|
|
__in PVOID BaseAddress,
|
|
__in MEMORY_INFORMATION_CLASS MemoryInformationClass,
|
|
__out_bcount(MemoryInformationLength) PVOID MemoryInformation,
|
|
__in SIZE_T MemoryInformationLength,
|
|
__out_opt PSIZE_T ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueryVolumeInformationFile(
|
|
__in HANDLE FileHandle,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__out_bcount(Length) PVOID FsInformation,
|
|
__in ULONG Length,
|
|
__in FS_INFORMATION_CLASS FsInformationClass
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueueApcThread(
|
|
__in HANDLE ThreadHandle,
|
|
__in PPS_APC_ROUTINE ApcRoutine,
|
|
__in_opt PVOID ApcArgument1,
|
|
__in_opt PVOID ApcArgument2,
|
|
__in_opt PVOID ApcArgument3
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwQueueApcThreadEx(
|
|
__in HANDLE ThreadHandle,
|
|
__in_opt HANDLE UserApcReserveHandle,
|
|
__in PPS_APC_ROUTINE ApcRoutine,
|
|
__in_opt PVOID ApcArgument1,
|
|
__in_opt PVOID ApcArgument2,
|
|
__in_opt PVOID ApcArgument3
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRaiseException(
|
|
__in PEXCEPTION_RECORD ExceptionRecord,
|
|
__in PCONTEXT ContextRecord,
|
|
__in BOOLEAN FirstChance
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRaiseHardError(
|
|
__in NTSTATUS ErrorStatus,
|
|
__in ULONG NumberOfParameters,
|
|
__in ULONG UnicodeStringParameterMask,
|
|
__in_ecount(NumberOfParameters) PULONG_PTR Parameters,
|
|
__in ULONG ValidResponseOptions,
|
|
__out PULONG Response
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReadFile(
|
|
__in HANDLE FileHandle,
|
|
__in_opt HANDLE Event,
|
|
__in_opt PIO_APC_ROUTINE ApcRoutine,
|
|
__in_opt PVOID ApcContext,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__out_bcount(Length) PVOID Buffer,
|
|
__in ULONG Length,
|
|
__in_opt PLARGE_INTEGER ByteOffset,
|
|
__in_opt PULONG Key
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReadFileScatter(
|
|
__in HANDLE FileHandle,
|
|
__in_opt HANDLE Event,
|
|
__in_opt PIO_APC_ROUTINE ApcRoutine,
|
|
__in_opt PVOID ApcContext,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in PFILE_SEGMENT_ELEMENT SegmentArray,
|
|
__in ULONG Length,
|
|
__in_opt PLARGE_INTEGER ByteOffset,
|
|
__in_opt PULONG Key
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReadOnlyEnlistment(
|
|
__in HANDLE EnlistmentHandle,
|
|
__in_opt PLARGE_INTEGER TmVirtualClock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReadRequestData(
|
|
__in HANDLE PortHandle,
|
|
__in PPORT_MESSAGE Message,
|
|
__in ULONG DataEntryIndex,
|
|
__out_bcount(BufferSize) PVOID Buffer,
|
|
__in SIZE_T BufferSize,
|
|
__out_opt PSIZE_T NumberOfBytesRead
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReadVirtualMemory(
|
|
__in HANDLE ProcessHandle,
|
|
__in_opt PVOID BaseAddress,
|
|
__out_bcount(BufferSize) PVOID Buffer,
|
|
__in SIZE_T BufferSize,
|
|
__out_opt PSIZE_T NumberOfBytesRead
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRecoverEnlistment(
|
|
__in HANDLE EnlistmentHandle,
|
|
__in_opt PVOID EnlistmentKey
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRecoverResourceManager(
|
|
__in HANDLE ResourceManagerHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRecoverTransactionManager(
|
|
__in HANDLE TransactionManagerHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRegisterProtocolAddressInformation(
|
|
__in HANDLE ResourceManager,
|
|
__in PCRM_PROTOCOL_ID ProtocolId,
|
|
__in ULONG ProtocolInformationSize,
|
|
__in PVOID ProtocolInformation,
|
|
__in_opt ULONG CreateOptions
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRegisterThreadTerminatePort(
|
|
__in HANDLE PortHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReleaseCMFViewOwnership(
|
|
VOID
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReleaseKeyedEvent(
|
|
__in HANDLE KeyedEventHandle,
|
|
__in PVOID KeyValue,
|
|
__in BOOLEAN Alertable,
|
|
__in_opt PLARGE_INTEGER Timeout
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReleaseMutant(
|
|
__in HANDLE MutantHandle,
|
|
__out_opt PLONG PreviousCount
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReleaseSemaphore(
|
|
__in HANDLE SemaphoreHandle,
|
|
__in LONG ReleaseCount,
|
|
__out_opt PLONG PreviousCount
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReleaseWorkerFactoryWorker(
|
|
__in HANDLE WorkerFactoryHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRemoveIoCompletion(
|
|
__in HANDLE IoCompletionHandle,
|
|
__out PVOID *KeyContext,
|
|
__out PVOID *ApcContext,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in_opt PLARGE_INTEGER Timeout
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRemoveIoCompletionEx(
|
|
__in HANDLE IoCompletionHandle,
|
|
__out_ecount(Count) PFILE_IO_COMPLETION_INFORMATION IoCompletionInformation,
|
|
__in ULONG Count,
|
|
__out PULONG NumEntriesRemoved,
|
|
__in_opt PLARGE_INTEGER Timeout,
|
|
__in BOOLEAN Alertable
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRemoveProcessDebug(
|
|
__in HANDLE ProcessHandle,
|
|
__in HANDLE DebugObjectHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRenameKey(
|
|
__in HANDLE KeyHandle,
|
|
__in PUNICODE_STRING NewName
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRenameTransactionManager(
|
|
__in PUNICODE_STRING LogFileName,
|
|
__in LPGUID ExistingTransactionManagerGuid
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReplaceKey(
|
|
__in POBJECT_ATTRIBUTES NewFile,
|
|
__in HANDLE TargetHandle,
|
|
__in POBJECT_ATTRIBUTES OldFile
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReplacePartitionUnit(
|
|
__in PUNICODE_STRING TargetInstancePath,
|
|
__in PUNICODE_STRING SpareInstancePath,
|
|
__in ULONG Flags
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReplyPort(
|
|
__in HANDLE PortHandle,
|
|
__in PPORT_MESSAGE ReplyMessage
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReplyWaitReceivePort(
|
|
__in HANDLE PortHandle,
|
|
__out_opt PVOID *PortContext,
|
|
__in_opt PPORT_MESSAGE ReplyMessage,
|
|
__out PPORT_MESSAGE ReceiveMessage
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReplyWaitReceivePortEx(
|
|
__in HANDLE PortHandle,
|
|
__out_opt PVOID *PortContext,
|
|
__in_opt PPORT_MESSAGE ReplyMessage,
|
|
__out PPORT_MESSAGE ReceiveMessage,
|
|
__in_opt PLARGE_INTEGER Timeout
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwReplyWaitReplyPort(
|
|
__in HANDLE PortHandle,
|
|
__inout PPORT_MESSAGE ReplyMessage
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRequestPort(
|
|
__in HANDLE PortHandle,
|
|
__in PPORT_MESSAGE RequestMessage
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRequestWaitReplyPort(
|
|
__in HANDLE PortHandle,
|
|
__in PPORT_MESSAGE RequestMessage,
|
|
__out PPORT_MESSAGE ReplyMessage
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRequestWakeupLatency(
|
|
__in LATENCY_TIME latency
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwResetEvent(
|
|
__in HANDLE EventHandle,
|
|
__out_opt PLONG PreviousState
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwResetWriteWatch(
|
|
__in HANDLE ProcessHandle,
|
|
__in PVOID BaseAddress,
|
|
__in SIZE_T RegionSize
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRestoreKey(
|
|
__in HANDLE KeyHandle,
|
|
__in HANDLE FileHandle,
|
|
__in ULONG Flags
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwResumeProcess(
|
|
__in HANDLE ProcessHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwResumeThread(
|
|
__in HANDLE ThreadHandle,
|
|
__out_opt PULONG PreviousSuspendCount
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRollbackComplete(
|
|
__in HANDLE EnlistmentHandle,
|
|
__in_opt PLARGE_INTEGER TmVirtualClock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRollbackEnlistment(
|
|
__in HANDLE EnlistmentHandle,
|
|
__in_opt PLARGE_INTEGER TmVirtualClock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRollbackTransaction(
|
|
__in HANDLE TransactionHandle,
|
|
__in BOOLEAN Wait
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwRollforwardTransactionManager(
|
|
__in HANDLE TransactionManagerHandle,
|
|
__in_opt PLARGE_INTEGER TmVirtualClock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSaveKey(
|
|
__in HANDLE KeyHandle,
|
|
__in HANDLE FileHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSaveKeyEx(
|
|
__in HANDLE KeyHandle,
|
|
__in HANDLE FileHandle,
|
|
__in ULONG Format
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSaveMergedKeys(
|
|
__in HANDLE HighPrecedenceKeyHandle,
|
|
__in HANDLE LowPrecedenceKeyHandle,
|
|
__in HANDLE FileHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSecureConnectPort(
|
|
__out PHANDLE PortHandle,
|
|
__in PUNICODE_STRING PortName,
|
|
__in PSECURITY_QUALITY_OF_SERVICE SecurityQos,
|
|
__inout_opt PPORT_VIEW ClientView,
|
|
__in_opt PSID RequiredServerSid,
|
|
__inout_opt PREMOTE_PORT_VIEW ServerView,
|
|
__out_opt PULONG MaxMessageLength,
|
|
__inout_opt PVOID ConnectionInformation,
|
|
__inout_opt PULONG ConnectionInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSerializeBoot(
|
|
VOID
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetContextThread(
|
|
__in HANDLE ThreadHandle,
|
|
__in PCONTEXT ThreadContext
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetDebugFilterState(
|
|
__in ULONG ComponentId,
|
|
__in ULONG Level,
|
|
__in BOOLEAN State
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetDefaultHardErrorPort(
|
|
__in HANDLE DefaultHardErrorPort
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetDefaultLocale(
|
|
__in BOOLEAN UserProfile,
|
|
__in LCID DefaultLocaleId
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetDefaultUILanguage(
|
|
__in LANGID DefaultUILanguageId
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetEaFile(
|
|
__in HANDLE FileHandle,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in_bcount(Length) PVOID Buffer,
|
|
__in ULONG Length
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetEvent(
|
|
__in HANDLE EventHandle,
|
|
__out_opt PLONG PreviousState
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetEventBoostPriority(
|
|
__in HANDLE EventHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetHighEventPair(
|
|
__in HANDLE EventPairHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetHighWaitLowEventPair(
|
|
__in HANDLE EventPairHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetInformationDebugObject(
|
|
__in HANDLE DebugObjectHandle,
|
|
__in DEBUGOBJECTINFOCLASS DebugObjectInformationClass,
|
|
__in PVOID DebugInformation,
|
|
__in ULONG DebugInformationLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetInformationEnlistment(
|
|
__in_opt HANDLE EnlistmentHandle,
|
|
__in ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,
|
|
__in_bcount(EnlistmentInformationLength) PVOID EnlistmentInformation,
|
|
__in ULONG EnlistmentInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetInformationFile(
|
|
__in HANDLE FileHandle,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in_bcount(Length) PVOID FileInformation,
|
|
__in ULONG Length,
|
|
__in FILE_INFORMATION_CLASS FileInformationClass
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetInformationJobObject(
|
|
__in HANDLE JobHandle,
|
|
__in JOBOBJECTINFOCLASS JobObjectInformationClass,
|
|
__in_bcount(JobObjectInformationLength) PVOID JobObjectInformation,
|
|
__in ULONG JobObjectInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetInformationKey(
|
|
__in HANDLE KeyHandle,
|
|
__in KEY_SET_INFORMATION_CLASS KeySetInformationClass,
|
|
__in_bcount(KeySetInformationLength) PVOID KeySetInformation,
|
|
__in ULONG KeySetInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetInformationObject(
|
|
__in HANDLE Handle,
|
|
__in OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
|
__in_bcount(ObjectInformationLength) PVOID ObjectInformation,
|
|
__in ULONG ObjectInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetInformationProcess(
|
|
__in HANDLE ProcessHandle,
|
|
__in PROCESS_INFORMATION_CLASS ProcessInformationClass,
|
|
__in_bcount(ProcessInformationLength) PVOID ProcessInformation,
|
|
__in ULONG ProcessInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetInformationResourceManager(
|
|
__in HANDLE ResourceManagerHandle,
|
|
__in RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass,
|
|
__in_bcount(ResourceManagerInformationLength) PVOID ResourceManagerInformation,
|
|
__in ULONG ResourceManagerInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetInformationThread(
|
|
__in HANDLE ThreadHandle,
|
|
__in THREAD_INFORMATION_CLASS ThreadInformationClass,
|
|
__in_bcount(ThreadInformationLength) PVOID ThreadInformation,
|
|
__in ULONG ThreadInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetInformationToken(
|
|
__in HANDLE TokenHandle,
|
|
__in TOKEN_INFORMATION_CLASS TokenInformationClass,
|
|
__in_bcount(TokenInformationLength) PVOID TokenInformation,
|
|
__in ULONG TokenInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetInformationTransaction(
|
|
__in HANDLE TransactionHandle,
|
|
__in TRANSACTION_INFORMATION_CLASS TransactionInformationClass,
|
|
__in_bcount(TransactionInformationLength) PVOID TransactionInformation,
|
|
__in ULONG TransactionInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetInformationTransactionManager(
|
|
__in_opt HANDLE TmHandle,
|
|
__in TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass,
|
|
__in_bcount(TransactionManagerInformationLength) PVOID TransactionManagerInformation,
|
|
__in ULONG TransactionManagerInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetInformationWorkerFactory(
|
|
__in HANDLE WorkerFactoryHandle,
|
|
__in WORKERFACTORYINFOCLASS WorkerFactoryInformationClass,
|
|
__in_bcount(WorkerFactoryInformationLength) PVOID WorkerFactoryInformation,
|
|
__in ULONG WorkerFactoryInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetIntervalProfile(
|
|
__in ULONG Interval,
|
|
__in KPROFILE_SOURCE Source
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetIoCompletion(
|
|
__in HANDLE IoCompletionHandle,
|
|
__in PVOID KeyContext,
|
|
__in_opt PVOID ApcContext,
|
|
__in NTSTATUS IoStatus,
|
|
__in ULONG_PTR IoStatusInformation
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetIoCompletionEx(
|
|
__in HANDLE IoCompletionHandle,
|
|
__in HANDLE IoCompletionReserveHandle,
|
|
__in PVOID KeyContext,
|
|
__in_opt PVOID ApcContext,
|
|
__in NTSTATUS IoStatus,
|
|
__in ULONG_PTR IoStatusInformation
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetLdtEntries(
|
|
__in ULONG Selector0,
|
|
__in ULONG Entry0Low,
|
|
__in ULONG Entry0Hi,
|
|
__in ULONG Selector1,
|
|
__in ULONG Entry1Low,
|
|
__in ULONG Entry1Hi
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetLowEventPair(
|
|
__in HANDLE EventPairHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetLowWaitHighEventPair(
|
|
__in HANDLE EventPairHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetQuotaInformationFile(
|
|
__in HANDLE FileHandle,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in_bcount(Length) PVOID Buffer,
|
|
__in ULONG Length
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetSecurityObject(
|
|
__in HANDLE Handle,
|
|
__in SECURITY_INFORMATION SecurityInformation,
|
|
__in PSECURITY_DESCRIPTOR SecurityDescriptor
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetSystemEnvironmentValue(
|
|
__in PUNICODE_STRING VariableName,
|
|
__in PUNICODE_STRING VariableValue
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetSystemInformation(
|
|
__in SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
|
__in_bcount_opt(SystemInformationLength) PVOID SystemInformation,
|
|
__in ULONG SystemInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetSystemPowerState(
|
|
__in POWER_ACTION SystemAction,
|
|
__in SYSTEM_POWER_STATE LightestSystemState,
|
|
__in ULONG Flags // POWER_ACTION_* flags
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetSystemTime(
|
|
__in_opt PLARGE_INTEGER SystemTime,
|
|
__out_opt PLARGE_INTEGER PreviousTime
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetThreadExecutionState(
|
|
__in EXECUTION_STATE NewFlags, // ES_* flags
|
|
__out EXECUTION_STATE *PreviousFlags
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetTimer(
|
|
__in HANDLE TimerHandle,
|
|
__in PLARGE_INTEGER DueTime,
|
|
__in_opt PTIMER_APC_ROUTINE TimerApcRoutine,
|
|
__in_opt PVOID TimerContext,
|
|
__in BOOLEAN ResumeTimer,
|
|
__in_opt LONG Period,
|
|
__out_opt PBOOLEAN PreviousState
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetTimerEx(
|
|
__in HANDLE TimerHandle,
|
|
__in TIMER_SET_INFORMATION_CLASS TimerSetInformationClass,
|
|
__inout_bcount_opt(TimerSetInformationLength) PVOID TimerSetInformation,
|
|
__in ULONG TimerSetInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetTimerResolution(
|
|
__in ULONG DesiredTime,
|
|
__in BOOLEAN SetResolution,
|
|
__out PULONG ActualTime
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetUuidSeed(
|
|
__in PCHAR Seed
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetValueKey(
|
|
__in HANDLE KeyHandle,
|
|
__in PUNICODE_STRING ValueName,
|
|
__in_opt ULONG TitleIndex,
|
|
__in ULONG Type,
|
|
__in_bcount_opt(DataSize) PVOID Data,
|
|
__in ULONG DataSize
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSetVolumeInformationFile(
|
|
__in HANDLE FileHandle,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in_bcount(Length) PVOID FsInformation,
|
|
__in ULONG Length,
|
|
__in FS_INFORMATION_CLASS FsInformationClass
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwShutdownSystem(
|
|
__in SHUTDOWN_ACTION Action
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwShutdownWorkerFactory(
|
|
__in HANDLE WorkerFactoryHandle,
|
|
__inout volatile LONG *PendingWorkerCount
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSignalAndWaitForSingleObject(
|
|
__in HANDLE SignalHandle,
|
|
__in HANDLE WaitHandle,
|
|
__in BOOLEAN Alertable,
|
|
__in_opt PLARGE_INTEGER Timeout
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSinglePhaseReject(
|
|
__in HANDLE EnlistmentHandle,
|
|
__in_opt PLARGE_INTEGER TmVirtualClock
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwStartProfile(
|
|
__in HANDLE ProfileHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwStopProfile(
|
|
__in HANDLE ProfileHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSuspendProcess(
|
|
__in HANDLE ProcessHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSuspendThread(
|
|
__in HANDLE ThreadHandle,
|
|
__out_opt PULONG PreviousSuspendCount
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwSystemDebugControl(
|
|
__in SYSDBG_COMMAND Command,
|
|
__inout_bcount_opt(InputBufferLength) PVOID InputBuffer,
|
|
__in ULONG InputBufferLength,
|
|
__out_bcount_opt(OutputBufferLength) PVOID OutputBuffer,
|
|
__in ULONG OutputBufferLength,
|
|
__out_opt PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwTerminateJobObject(
|
|
__in HANDLE JobHandle,
|
|
__in NTSTATUS ExitStatus
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwTerminateProcess(
|
|
__in_opt HANDLE ProcessHandle,
|
|
__in NTSTATUS ExitStatus
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwTerminateThread(
|
|
__in_opt HANDLE ThreadHandle,
|
|
__in NTSTATUS ExitStatus
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwTestAlert(
|
|
VOID
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwThawRegistry(
|
|
VOID
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwThawTransactions(
|
|
VOID
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwTraceControl(
|
|
__in ULONG FunctionCode,
|
|
__in_bcount_opt(InBufferLen) PVOID InBuffer,
|
|
__in ULONG InBufferLen,
|
|
__out_bcount_opt(OutBufferLen) PVOID OutBuffer,
|
|
__in ULONG OutBufferLen,
|
|
__out PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwTraceEvent(
|
|
__in HANDLE TraceHandle,
|
|
__in ULONG Flags,
|
|
__in ULONG FieldSize,
|
|
__in PVOID Fields
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwUnloadDriver(
|
|
__in PUNICODE_STRING DriverServiceName
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwUnloadKey(
|
|
__in POBJECT_ATTRIBUTES TargetKey
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwUnloadKey2(
|
|
__in POBJECT_ATTRIBUTES TargetKey,
|
|
__in ULONG Flags
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwUnloadKeyEx(
|
|
__in POBJECT_ATTRIBUTES TargetKey,
|
|
__in_opt HANDLE Event
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwUnlockFile(
|
|
__in HANDLE FileHandle,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in PLARGE_INTEGER ByteOffset,
|
|
__in PLARGE_INTEGER Length,
|
|
__in ULONG Key
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwUnlockVirtualMemory(
|
|
__in HANDLE ProcessHandle,
|
|
__inout PVOID *BaseAddress,
|
|
__inout PSIZE_T RegionSize,
|
|
__in ULONG MapType
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwUnmapViewOfSection(
|
|
__in HANDLE ProcessHandle,
|
|
__in PVOID BaseAddress
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwVdmControl(
|
|
__in VDMSERVICECLASS Service,
|
|
__inout PVOID ServiceData
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwWaitForDebugEvent(
|
|
__in HANDLE DebugObjectHandle,
|
|
__in BOOLEAN Alertable,
|
|
__in_opt PLARGE_INTEGER Timeout,
|
|
__out PVOID WaitStateChange
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwWaitForKeyedEvent(
|
|
__in HANDLE KeyedEventHandle,
|
|
__in PVOID KeyValue,
|
|
__in BOOLEAN Alertable,
|
|
__in_opt PLARGE_INTEGER Timeout
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwWaitForMultipleObjects(
|
|
__in ULONG Count,
|
|
__in_ecount(Count) PHANDLE Handles,
|
|
__in WAIT_TYPE WaitType,
|
|
__in BOOLEAN Alertable,
|
|
__in_opt PLARGE_INTEGER Timeout
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwWaitForSingleObject(
|
|
__in HANDLE Handle,
|
|
__in BOOLEAN Alertable,
|
|
__in_opt PLARGE_INTEGER Timeout
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwWaitForWorkViaWorkerFactory(
|
|
__in HANDLE WorkerFactoryHandle,
|
|
__out struct _FILE_IO_COMPLETION_INFORMATION *MiniPacket
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwWaitHighEventPair(
|
|
__in HANDLE EventPairHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwWaitLowEventPair(
|
|
__in HANDLE EventPairHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwWorkerFactoryWorkerReady(
|
|
__in HANDLE WorkerFactoryHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwWriteFile(
|
|
__in HANDLE FileHandle,
|
|
__in_opt HANDLE Event,
|
|
__in_opt PIO_APC_ROUTINE ApcRoutine,
|
|
__in_opt PVOID ApcContext,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in_bcount(Length) PVOID Buffer,
|
|
__in ULONG Length,
|
|
__in_opt PLARGE_INTEGER ByteOffset,
|
|
__in_opt PULONG Key
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwWriteFileGather(
|
|
__in HANDLE FileHandle,
|
|
__in_opt HANDLE Event,
|
|
__in_opt PIO_APC_ROUTINE ApcRoutine,
|
|
__in_opt PVOID ApcContext,
|
|
__out PIO_STATUS_BLOCK IoStatusBlock,
|
|
__in PFILE_SEGMENT_ELEMENT SegmentArray,
|
|
__in ULONG Length,
|
|
__in_opt PLARGE_INTEGER ByteOffset,
|
|
__in_opt PULONG Key
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwWriteRequestData(
|
|
__in HANDLE PortHandle,
|
|
__in PPORT_MESSAGE Message,
|
|
__in ULONG DataEntryIndex,
|
|
__in_bcount(BufferSize) PVOID Buffer,
|
|
__in SIZE_T BufferSize,
|
|
__out_opt PSIZE_T NumberOfBytesWritten
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwWriteVirtualMemory(
|
|
__in HANDLE ProcessHandle,
|
|
__in_opt PVOID BaseAddress,
|
|
__in_bcount(BufferSize) PVOID Buffer,
|
|
__in SIZE_T BufferSize,
|
|
__out_opt PSIZE_T NumberOfBytesWritten
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
ZwYieldExecution(
|
|
VOID
|
|
);
|
|
|
|
#endif
|