Update for 22H1 and sync latest improvements

2026-06-08 16:49:04 +00:00 · 2022-03-21 21:33:20 +11:00
parent 4953926024
commit 461f7b6462
26 changed files with 4521 additions and 2829 deletions
@@ -213,7 +213,7 @@ typedef struct _DBGUI_WAIT_STATE_CHANGE
 typedef enum _DEBUGOBJECTINFOCLASS
 {
    DebugObjectUnusedInformation,
-    DebugObjectKillProcessOnExitInformation,
+    DebugObjectKillProcessOnExitInformation, // s: ULONG
    MaxDebugObjectInfoClass
 } DEBUGOBJECTINFOCLASS, *PDEBUGOBJECTINFOCLASS;

@@ -225,7 +225,7 @@ NTAPI
 NtCreateDebugObject(
    _Out_ PHANDLE DebugObjectHandle,
    _In_ ACCESS_MASK DesiredAccess,
-    _In_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
    _In_ ULONG Flags
    );

@@ -350,6 +350,14 @@ DbgUiConvertStateChangeStructure(
    _Out_ LPDEBUG_EVENT DebugEvent
    );

+NTSYSAPI
+NTSTATUS
+NTAPI
+DbgUiConvertStateChangeStructureEx(
+    _In_ PDBGUI_WAIT_STATE_CHANGE StateChange,
+    _Out_ LPDEBUG_EVENT DebugEvent
+    );
+
 struct _EVENT_FILTER_DESCRIPTOR;

 typedef VOID (NTAPI *PENABLECALLBACK)(
@@ -46,6 +46,15 @@ NtSetSystemEnvironmentValue(
    _In_ PUNICODE_STRING VariableValue
    );

+#define EFI_VARIABLE_NON_VOLATILE 0x00000001
+#define EFI_VARIABLE_BOOTSERVICE_ACCESS 0x00000002
+#define EFI_VARIABLE_RUNTIME_ACCESS 0x00000004
+#define EFI_VARIABLE_HARDWARE_ERROR_RECORD 0x00000008
+#define EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS 0x00000010
+#define EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS 0x00000020
+#define EFI_VARIABLE_APPEND_WRITE 0x00000040
+#define EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS 0x00000080
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -54,7 +63,7 @@ NtQuerySystemEnvironmentValueEx(
    _In_ LPGUID VendorGuid,
    _Out_writes_bytes_opt_(*ValueLength) PVOID Value,
    _Inout_ PULONG ValueLength,
-    _Out_opt_ PULONG Attributes
+    _Out_opt_ PULONG Attributes // EFI_VARIABLE_*
    );

 NTSYSCALLAPI
@@ -64,8 +73,8 @@ NtSetSystemEnvironmentValueEx(
    _In_ PUNICODE_STRING VariableName,
    _In_ LPGUID VendorGuid,
    _In_reads_bytes_opt_(ValueLength) PVOID Value,
-    _In_ ULONG ValueLength,
-    _In_ ULONG Attributes
+    _In_ ULONG ValueLength, // 0 = delete variable
+    _In_ ULONG Attributes // EFI_VARIABLE_*
    );

 NTSYSCALLAPI
@@ -266,7 +275,7 @@ typedef enum _FILTER_BOOT_OPTION_OPERATION
    FilterBootOptionOperationMax
 } FILTER_BOOT_OPTION_OPERATION;

-#if (PHNT_VERSION >= PHNT_THRESHOLD)
+#if (PHNT_VERSION >= PHNT_WIN8)

 NTSYSCALLAPI
 NTSTATUS
@@ -441,6 +450,14 @@ NtSetHighWaitLowEventPair(

 // Mutant

+#ifndef MUTANT_QUERY_STATE
+#define MUTANT_QUERY_STATE 0x0001
+#endif
+
+#ifndef MUTANT_ALL_ACCESS
+#define MUTANT_ALL_ACCESS (MUTANT_QUERY_STATE|STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE)
+#endif
+
 typedef enum _MUTANT_INFORMATION_CLASS
 {
    MutantBasicInformation, // MUTANT_BASIC_INFORMATION
@@ -503,6 +520,14 @@ NtQueryMutant(
 #define SEMAPHORE_QUERY_STATE 0x0001
 #endif

+#ifndef SEMAPHORE_MODIFY_STATE
+#define SEMAPHORE_MODIFY_STATE 0x0002
+#endif
+
+#ifndef SEMAPHORE_ALL_ACCESS
+#define SEMAPHORE_ALL_ACCESS (SEMAPHORE_QUERY_STATE|SEMAPHORE_MODIFY_STATE|STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE)
+#endif
+
 typedef enum _SEMAPHORE_INFORMATION_CLASS
 {
    SemaphoreBasicInformation
@@ -556,6 +581,18 @@ NtQuerySemaphore(

 // Timer

+#ifndef TIMER_QUERY_STATE
+#define TIMER_QUERY_STATE 0x0001
+#endif
+
+#ifndef TIMER_MODIFY_STATE
+#define TIMER_MODIFY_STATE 0x0002
+#endif
+
+#ifndef TIMER_ALL_ACCESS
+#define TIMER_ALL_ACCESS (TIMER_QUERY_STATE|TIMER_MODIFY_STATE|STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE)
+#endif
+
 typedef enum _TIMER_INFORMATION_CLASS
 {
    TimerBasicInformation // TIMER_BASIC_INFORMATION
@@ -694,7 +731,7 @@ NTAPI
 NtCreateTimer2(
    _Out_ PHANDLE TimerHandle,
    _In_opt_ PVOID Reserved1,
-    _In_opt_ PVOID Reserved2,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
    _In_ ULONG Attributes,
    _In_ ACCESS_MASK DesiredAccess
    );
@@ -876,7 +913,8 @@ typedef enum _WNF_DATA_SCOPE
    WnfDataScopeSession,
    WnfDataScopeUser,
    WnfDataScopeProcess,
-    WnfDataScopeMachine // REDSTONE3
+    WnfDataScopeMachine, // REDSTONE3
+    WnfDataScopePhysicalMachine, // WIN11
 } WNF_DATA_SCOPE;

 typedef struct _WNF_TYPE_ID
@@ -1037,21 +1075,21 @@ NtSetWnfProcessNotificationEvent(

 typedef enum _WORKERFACTORYINFOCLASS
 {
-    WorkerFactoryTimeout, // q; s: LARGE_INTEGER
-    WorkerFactoryRetryTimeout, // q; s: LARGE_INTEGER
-    WorkerFactoryIdleTimeout, // q; s: LARGE_INTEGER
-    WorkerFactoryBindingCount,
-    WorkerFactoryThreadMinimum, // q; s: ULONG
-    WorkerFactoryThreadMaximum, // q; s: ULONG
+    WorkerFactoryTimeout, // LARGE_INTEGER
+    WorkerFactoryRetryTimeout, // LARGE_INTEGER
+    WorkerFactoryIdleTimeout, // s: LARGE_INTEGER
+    WorkerFactoryBindingCount, // s: ULONG
+    WorkerFactoryThreadMinimum, // s: ULONG
+    WorkerFactoryThreadMaximum, // s: ULONG
    WorkerFactoryPaused, // ULONG or BOOLEAN
-    WorkerFactoryBasicInformation, // WORKER_FACTORY_BASIC_INFORMATION
+    WorkerFactoryBasicInformation, // q: WORKER_FACTORY_BASIC_INFORMATION
    WorkerFactoryAdjustThreadGoal,
    WorkerFactoryCallbackType,
    WorkerFactoryStackInformation, // 10
-    WorkerFactoryThreadBasePriority,
-    WorkerFactoryTimeoutWaiters, // since THRESHOLD
-    WorkerFactoryFlags,
-    WorkerFactoryThreadSoftMaximum,
+    WorkerFactoryThreadBasePriority, // s: ULONG
+    WorkerFactoryTimeoutWaiters, // s: ULONG, since THRESHOLD
+    WorkerFactoryFlags, // s: ULONG
+    WorkerFactoryThreadSoftMaximum, // s: ULONG
    WorkerFactoryThreadCpuSets, // since REDSTONE5
    MaxWorkerFactoryInfoClass
 } WORKERFACTORYINFOCLASS, *PWORKERFACTORYINFOCLASS;
@@ -1248,7 +1286,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS
    SystemProcessInformation, // q: SYSTEM_PROCESS_INFORMATION
    SystemCallCountInformation, // q: SYSTEM_CALL_COUNT_INFORMATION
    SystemDeviceInformation, // q: SYSTEM_DEVICE_INFORMATION
-    SystemProcessorPerformanceInformation, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
+    SystemProcessorPerformanceInformation, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION (EX in: USHORT ProcessorGroup)
    SystemFlagsInformation, // q: SYSTEM_FLAGS_INFORMATION
    SystemCallTimeInformation, // not implemented // SYSTEM_CALL_TIME_INFORMATION // 10
    SystemModuleInformation, // q: RTL_PROCESS_MODULES
@@ -1294,16 +1332,16 @@ typedef enum _SYSTEM_INFORMATION_CLASS
    SystemVerifierInformation, // q: SYSTEM_VERIFIER_INFORMATION; s (requires SeDebugPrivilege)
    SystemVerifierThunkExtend, // s (kernel-mode only)
    SystemSessionProcessInformation, // q: SYSTEM_SESSION_PROCESS_INFORMATION
-    SystemLoadGdiDriverInSystemSpace, // s (kernel-mode only) (same as SystemLoadGdiDriverInformation)
-    SystemNumaProcessorMap, // q
-    SystemPrefetcherInformation, // q: PREFETCHER_INFORMATION; s: PREFETCHER_INFORMATION // PfSnQueryPrefetcherInformation
+    SystemLoadGdiDriverInSystemSpace, // s: SYSTEM_GDI_DRIVER_INFORMATION (kernel-mode only) (same as SystemLoadGdiDriverInformation)
+    SystemNumaProcessorMap, // q: SYSTEM_NUMA_INFORMATION
+    SystemPrefetcherInformation, // q; s: PREFETCHER_INFORMATION // PfSnQueryPrefetcherInformation
    SystemExtendedProcessInformation, // q: SYSTEM_PROCESS_INFORMATION
-    SystemRecommendedSharedDataAlignment, // q
-    SystemComPlusPackage, // q; s
-    SystemNumaAvailableMemory, // 60
+    SystemRecommendedSharedDataAlignment, // q: ULONG // KeGetRecommendedSharedDataAlignment
+    SystemComPlusPackage, // q; s: ULONG
+    SystemNumaAvailableMemory, // q: SYSTEM_NUMA_INFORMATION // 60
    SystemProcessorPowerInformation, // q: SYSTEM_PROCESSOR_POWER_INFORMATION
-    SystemEmulationBasicInformation,
-    SystemEmulationProcessorInformation,
+    SystemEmulationBasicInformation, // q: SYSTEM_BASIC_INFORMATION
+    SystemEmulationProcessorInformation, // q: SYSTEM_PROCESSOR_INFORMATION
    SystemExtendedHandleInformation, // q: SYSTEM_HANDLE_INFORMATION_EX
    SystemLostDelayedWriteInformation, // q: ULONG
    SystemBigPoolInformation, // q: SYSTEM_BIGPOOL_INFORMATION
@@ -1311,9 +1349,9 @@ typedef enum _SYSTEM_INFORMATION_CLASS
    SystemSessionMappedViewInformation, // q: SYSTEM_SESSION_MAPPED_VIEW_INFORMATION
    SystemHotpatchInformation, // q; s: SYSTEM_HOTPATCH_CODE_INFORMATION
    SystemObjectSecurityMode, // q: ULONG // 70
-    SystemWatchdogTimerHandler, // s (kernel-mode only)
-    SystemWatchdogTimerInformation, // q (kernel-mode only); s (kernel-mode only)
-    SystemLogicalProcessorInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION
+    SystemWatchdogTimerHandler, // s: SYSTEM_WATCHDOG_HANDLER_INFORMATION // (kernel-mode only)
+    SystemWatchdogTimerInformation, // q: SYSTEM_WATCHDOG_TIMER_INFORMATION // (kernel-mode only)
+    SystemLogicalProcessorInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION (EX in: USHORT ProcessorGroup)
    SystemWow64SharedInformationObsolete, // not implemented
    SystemRegisterFirmwareTableInformationHandler, // s: SYSTEM_FIRMWARE_TABLE_HANDLER // (kernel-mode only)
    SystemFirmwareTableInformation, // SYSTEM_FIRMWARE_TABLE_INFORMATION
@@ -1323,7 +1361,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS
    SystemMemoryListInformation, // q: SYSTEM_MEMORY_LIST_INFORMATION; s: SYSTEM_MEMORY_LIST_COMMAND (requires SeProfileSingleProcessPrivilege) // 80
    SystemFileCacheInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (same as SystemFileCacheInformation)
    SystemThreadPriorityClientIdInformation, // s: SYSTEM_THREAD_CID_PRIORITY_INFORMATION (requires SeIncreaseBasePriorityPrivilege)
-    SystemProcessorIdleCycleTimeInformation, // q: SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION[]
+    SystemProcessorIdleCycleTimeInformation, // q: SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION[] (EX in: USHORT ProcessorGroup)
    SystemVerifierCancellationInformation, // SYSTEM_VERIFIER_CANCELLATION_INFORMATION // name:wow64:whNT32QuerySystemVerifierCancellationInformation
    SystemProcessorPowerInformationEx, // not implemented
    SystemRefTraceInformation, // q; s: SYSTEM_REF_TRACE_INFORMATION // ObQueryRefTraceInformation
@@ -1331,25 +1369,25 @@ typedef enum _SYSTEM_INFORMATION_CLASS
    SystemProcessIdInformation, // q: SYSTEM_PROCESS_ID_INFORMATION
    SystemErrorPortInformation, // s (requires SeTcbPrivilege)
    SystemBootEnvironmentInformation, // q: SYSTEM_BOOT_ENVIRONMENT_INFORMATION // 90
-    SystemHypervisorInformation, // q; s (kernel-mode only)
+    SystemHypervisorInformation, // q: SYSTEM_HYPERVISOR_QUERY_INFORMATION
    SystemVerifierInformationEx, // q; s: SYSTEM_VERIFIER_INFORMATION_EX
-    SystemTimeZoneInformation, // s (requires SeTimeZonePrivilege)
+    SystemTimeZoneInformation, // q; s: RTL_TIME_ZONE_INFORMATION (requires SeTimeZonePrivilege)
    SystemImageFileExecutionOptionsInformation, // s: SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION (requires SeTcbPrivilege)
-    SystemCoverageInformation, // q; s // name:wow64:whNT32QuerySystemCoverageInformation; ExpCovQueryInformation
+    SystemCoverageInformation, // q: COVERAGE_MODULES s: COVERAGE_MODULE_REQUEST // ExpCovQueryInformation (requires SeDebugPrivilege)
    SystemPrefetchPatchInformation, // SYSTEM_PREFETCH_PATCH_INFORMATION
    SystemVerifierFaultsInformation, // s: SYSTEM_VERIFIER_FAULTS_INFORMATION (requires SeDebugPrivilege)
    SystemSystemPartitionInformation, // q: SYSTEM_SYSTEM_PARTITION_INFORMATION
    SystemSystemDiskInformation, // q: SYSTEM_SYSTEM_DISK_INFORMATION
    SystemProcessorPerformanceDistribution, // q: SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION // 100
-    SystemNumaProximityNodeInformation,
-    SystemDynamicTimeZoneInformation, // q; s (requires SeTimeZonePrivilege)
+    SystemNumaProximityNodeInformation, // q; s: SYSTEM_NUMA_PROXIMITY_MAP
+    SystemDynamicTimeZoneInformation, // q; s: RTL_DYNAMIC_TIME_ZONE_INFORMATION (requires SeTimeZonePrivilege)
    SystemCodeIntegrityInformation, // q: SYSTEM_CODEINTEGRITY_INFORMATION // SeCodeIntegrityQueryInformation
    SystemProcessorMicrocodeUpdateInformation, // s: SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION
-    SystemProcessorBrandString, // q // HaliQuerySystemInformation -> HalpGetProcessorBrandString, info class 23
+    SystemProcessorBrandString, // q: CHAR[] // HaliQuerySystemInformation -> HalpGetProcessorBrandString, info class 23
    SystemVirtualAddressInformation, // q: SYSTEM_VA_LIST_INFORMATION[]; s: SYSTEM_VA_LIST_INFORMATION[] (requires SeIncreaseQuotaPrivilege) // MmQuerySystemVaInformation
    SystemLogicalProcessorAndGroupInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // since WIN7 // KeQueryLogicalProcessorRelationship
-    SystemProcessorCycleTimeInformation, // q: SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION[]
-    SystemStoreInformation, // q; s: SYSTEM_STORE_INFORMATION // SmQueryStoreInformation
+    SystemProcessorCycleTimeInformation, // q: SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION[] (EX in: USHORT ProcessorGroup)
+    SystemStoreInformation, // q; s: SYSTEM_STORE_INFORMATION (requires SeProfileSingleProcessPrivilege) // SmQueryStoreInformation
    SystemRegistryAppendString, // s: SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS // 110
    SystemAitSamplingValue, // s: ULONG (requires SeProfileSingleProcessPrivilege)
    SystemVhdBootInformation, // q: SYSTEM_VHD_BOOT_INFORMATION
@@ -1371,9 +1409,9 @@ typedef enum _SYSTEM_INFORMATION_CLASS
    SystemBadPageInformation,
    SystemProcessorProfileControlArea, // q; s: SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA
    SystemCombinePhysicalMemoryInformation, // s: MEMORY_COMBINE_INFORMATION, MEMORY_COMBINE_INFORMATION_EX, MEMORY_COMBINE_INFORMATION_EX2 // 130
-    SystemEntropyInterruptTimingInformation,
+    SystemEntropyInterruptTimingInformation, // q; s: SYSTEM_ENTROPY_TIMING_INFORMATION
    SystemConsoleInformation, // q: SYSTEM_CONSOLE_INFORMATION
-    SystemPlatformBinaryInformation, // q: SYSTEM_PLATFORM_BINARY_INFORMATION
+    SystemPlatformBinaryInformation, // q: SYSTEM_PLATFORM_BINARY_INFORMATION (requires SeTcbPrivilege)
    SystemPolicyInformation, // q: SYSTEM_POLICY_INFORMATION
    SystemHypervisorProcessorCountInformation, // q: SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION
    SystemDeviceDataInformation, // q: SYSTEM_DEVICE_DATA_INFORMATION
@@ -1393,10 +1431,10 @@ typedef enum _SYSTEM_INFORMATION_CLASS
    SystemBootMetadataInformation, // 150
    SystemSoftRebootInformation, // q: ULONG
    SystemElamCertificateInformation, // s: SYSTEM_ELAM_CERTIFICATE_INFORMATION
-    SystemOfflineDumpConfigInformation,
+    SystemOfflineDumpConfigInformation, // q: OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2
    SystemProcessorFeaturesInformation, // q: SYSTEM_PROCESSOR_FEATURES_INFORMATION
    SystemRegistryReconciliationInformation, // s: NULL (requires admin) (flushes registry hives)
-    SystemEdidInformation,
+    SystemEdidInformation, // q: SYSTEM_EDID_INFORMATION
    SystemManufacturingInformation, // q: SYSTEM_MANUFACTURING_INFORMATION // since THRESHOLD
    SystemEnergyEstimationConfigInformation, // q: SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION
    SystemHypervisorDetailInformation, // q: SYSTEM_HYPERVISOR_DETAIL_INFORMATION
@@ -1413,7 +1451,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS
    SystemInterruptCpuSetsInformation, // q: SYSTEM_INTERRUPT_CPU_SET_INFORMATION // 170
    SystemSecureBootPolicyFullInformation, // q: SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION
    SystemCodeIntegrityPolicyFullInformation,
-    SystemAffinitizedInterruptProcessorInformation,
+    SystemAffinitizedInterruptProcessorInformation, // (requires SeIncreaseBasePriorityPrivilege)
    SystemRootSiloInformation, // q: SYSTEM_ROOT_SILO_INFORMATION
    SystemCpuSetInformation, // q: SYSTEM_CPU_SET_INFORMATION // since THRESHOLD2
    SystemCpuSetTagInformation, // q: SYSTEM_CPU_SET_TAG_INFORMATION
@@ -1421,7 +1459,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS
    SystemSecureKernelProfileInformation, // q: SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION
    SystemCodeIntegrityPlatformManifestInformation, // q: SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION // since REDSTONE
    SystemInterruptSteeringInformation, // SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT // 180
-    SystemSupportedProcessorArchitectures, // in: HANDLE, out: ULONG[3] // NtQuerySystemInformationEx
+    SystemSupportedProcessorArchitectures, // p: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx
    SystemMemoryUsageInformation, // q: SYSTEM_MEMORY_USAGE_INFORMATION
    SystemCodeIntegrityCertificateInformation, // q: SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION
    SystemPhysicalMemoryInformation, // q: SYSTEM_PHYSICAL_MEMORY_INFORMATION // since REDSTONE2
@@ -1452,7 +1490,7 @@ typedef enum _SYSTEM_INFORMATION_CLASS
    SystemCodeIntegritySyntheticCacheInformation,
    SystemFeatureConfigurationInformation, // SYSTEM_FEATURE_CONFIGURATION_INFORMATION // since 20H1 // 210
    SystemFeatureConfigurationSectionInformation, // SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION
-    SystemFeatureUsageSubscriptionInformation,
+    SystemFeatureUsageSubscriptionInformation, // SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS
    SystemSecureSpeculationControlInformation, // SECURE_SPECULATION_CONTROL_INFORMATION
    SystemSpacesBootInformation, // since 20H2
    SystemFwRamdiskInformation, // SYSTEM_FIRMWARE_RAMDISK_INFORMATION
@@ -1468,6 +1506,17 @@ typedef enum _SYSTEM_INFORMATION_CLASS
    SystemCodeIntegrityClearDynamicStores,
    SystemDifPoolTrackingInformation,
    SystemPoolZeroingInformation, // SYSTEM_POOL_ZEROING_INFORMATION
+    SystemDpcWatchdogInformation,
+    SystemDpcWatchdogInformation2,
+    SystemSupportedProcessorArchitectures2, // q: in opt: HANDLE, out: SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION[] // NtQuerySystemInformationEx  // 230
+    SystemSingleProcessorRelationshipInformation,
+    SystemXfgCheckFailureInformation,
+    SystemIommuStateInformation, // SYSTEM_IOMMU_STATE_INFORMATION // since 22H1
+    SystemHypervisorMinrootInformation, // SYSTEM_HYPERVISOR_MINROOT_INFORMATION
+    SystemHypervisorBootPagesInformation, // SYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION
+    SystemPointerAuthInformation, // SYSTEM_POINTER_AUTH_INFORMATION
+    SystemSecureKernelDebuggerInformation,
+    SystemOriginalImageFeatureInformation,
    MaxSystemInfoClass
 } SYSTEM_INFORMATION_CLASS;

@@ -2333,7 +2382,7 @@ typedef struct _SYSTEM_LOOKASIDE_INFORMATION
 // private
 typedef struct _SYSTEM_RANGE_START_INFORMATION
 {
-    PVOID SystemRangeStart;
+    ULONG_PTR SystemRangeStart;
 } SYSTEM_RANGE_START_INFORMATION, *PSYSTEM_RANGE_START_INFORMATION;

 typedef struct _SYSTEM_VERIFIER_INFORMATION_LEGACY // pre-19H1
@@ -2410,6 +2459,7 @@ typedef struct _SYSTEM_VERIFIER_INFORMATION
    SIZE_T PeakNonPagedPoolUsageInBytes;
 } SYSTEM_VERIFIER_INFORMATION, *PSYSTEM_VERIFIER_INFORMATION;

+// private
 typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
 {
    ULONG SessionId;
@@ -2417,6 +2467,37 @@ typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
    PVOID Buffer;
 } SYSTEM_SESSION_PROCESS_INFORMATION, *PSYSTEM_SESSION_PROCESS_INFORMATION;

+// private
+typedef struct _SYSTEM_GDI_DRIVER_INFORMATION
+{
+    UNICODE_STRING DriverName;
+    PVOID ImageAddress;
+    PVOID SectionPointer;
+    PVOID EntryPoint;
+    struct _IMAGE_EXPORT_DIRECTORY* ExportSectionPointer;
+    ULONG ImageLength;
+} SYSTEM_GDI_DRIVER_INFORMATION, *PSYSTEM_GDI_DRIVER_INFORMATION;
+
+// geoffchappell
+#ifdef _WIN64
+#define MAXIMUM_NODE_COUNT 0x40
+#else
+#define MAXIMUM_NODE_COUNT 0x10
+#endif
+
+// private
+typedef struct _SYSTEM_NUMA_INFORMATION
+{
+    ULONG HighestNodeNumber;
+    ULONG Reserved;
+    union
+    {
+        GROUP_AFFINITY ActiveProcessorsGroupAffinity[MAXIMUM_NODE_COUNT];
+        ULONGLONG AvailableMemory[MAXIMUM_NODE_COUNT];
+        ULONGLONG Pad[MAXIMUM_NODE_COUNT * 2];
+    };
+} SYSTEM_NUMA_INFORMATION, *PSYSTEM_NUMA_INFORMATION;
+
 typedef struct _SYSTEM_PROCESSOR_POWER_INFORMATION
 {
    UCHAR CurrentFrequency;
@@ -2523,6 +2604,48 @@ typedef struct _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION
    SIZE_T NumberOfBytesAvailableContiguous;
 } SYSTEM_SESSION_MAPPED_VIEW_INFORMATION, *PSYSTEM_SESSION_MAPPED_VIEW_INFORMATION;

+typedef enum _WATCHDOG_HANDLER_ACTION 
+{
+    WdActionSetTimeoutValue,
+    WdActionQueryTimeoutValue,
+    WdActionResetTimer,
+    WdActionStopTimer,
+    WdActionStartTimer,
+    WdActionSetTriggerAction,
+    WdActionQueryTriggerAction,
+    WdActionQueryState
+} WATCHDOG_HANDLER_ACTION;
+
+typedef NTSTATUS (*PSYSTEM_WATCHDOG_HANDLER)(_In_ WATCHDOG_HANDLER_ACTION Action, _In_ PVOID Context, _Inout_ PULONG DataValue, _In_ BOOLEAN NoLocks);
+
+// private
+typedef struct _SYSTEM_WATCHDOG_HANDLER_INFORMATION 
+{
+    PSYSTEM_WATCHDOG_HANDLER WdHandler;
+    PVOID Context;
+} SYSTEM_WATCHDOG_HANDLER_INFORMATION, *PSYSTEM_WATCHDOG_HANDLER_INFORMATION;
+
+typedef enum _WATCHDOG_INFORMATION_CLASS
+{
+    WdInfoTimeoutValue = 0,
+    WdInfoResetTimer = 1,
+    WdInfoStopTimer = 2,
+    WdInfoStartTimer = 3,
+    WdInfoTriggerAction = 4,
+    WdInfoState = 5,
+    WdInfoTriggerReset = 6,
+    WdInfoNop = 7,
+    WdInfoGeneratedLastReset = 8,
+    WdInfoInvalid = 9,
+} WATCHDOG_INFORMATION_CLASS;
+
+// private
+typedef struct _SYSTEM_WATCHDOG_TIMER_INFORMATION
+{
+    WATCHDOG_INFORMATION_CLASS WdInfoClass;
+    ULONG DataValue;
+} SYSTEM_WATCHDOG_TIMER_INFORMATION, PSYSTEM_WATCHDOG_TIMER_INFORMATION;
+
 #if (PHNT_MODE != PHNT_MODE_KERNEL)
 // private
 typedef enum _SYSTEM_FIRMWARE_TABLE_ACTION
@@ -2639,6 +2762,16 @@ typedef struct _SYSTEM_PROCESS_ID_INFORMATION
    UNICODE_STRING ImageName;
 } SYSTEM_PROCESS_ID_INFORMATION, *PSYSTEM_PROCESS_ID_INFORMATION;

+// private
+typedef struct _SYSTEM_HYPERVISOR_QUERY_INFORMATION
+{
+    BOOLEAN HypervisorConnected;
+    BOOLEAN HypervisorDebuggingEnabled;
+    BOOLEAN HypervisorPresent;
+    BOOLEAN Spare0[5];
+    ULONGLONG EnabledEnlightenments;
+} SYSTEM_HYPERVISOR_QUERY_INFORMATION, *PSYSTEM_HYPERVISOR_QUERY_INFORMATION;
+
 // private
 typedef struct _SYSTEM_BOOT_ENVIRONMENT_INFORMATION
 {
@@ -2668,6 +2801,44 @@ typedef struct _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION
    ULONG FlagsToDisable;
 } SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION, *PSYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION;

+// private
+typedef enum _COVERAGE_REQUEST_CODES
+{
+    CoverageAllModules = 0,
+    CoverageSearchByHash = 1,
+    CoverageSearchByName = 2
+} COVERAGE_REQUEST_CODES;
+
+// private
+typedef struct _COVERAGE_MODULE_REQUEST
+{
+    COVERAGE_REQUEST_CODES RequestType;
+    union
+    {
+        UCHAR MD5Hash[16];
+        UNICODE_STRING ModuleName;
+    } SearchInfo;
+} COVERAGE_MODULE_REQUEST, *PCOVERAGE_MODULE_REQUEST;
+
+// private
+typedef struct _COVERAGE_MODULE_INFO
+{
+    ULONG ModuleInfoSize;
+    ULONG IsBinaryLoaded;
+    UNICODE_STRING ModulePathName;
+    ULONG CoverageSectionSize;
+    UCHAR CoverageSection[1];
+} COVERAGE_MODULE_INFO, *PCOVERAGE_MODULE_INFO;
+
+// private
+typedef struct _COVERAGE_MODULES
+{
+    ULONG ListAndReset;
+    ULONG NumberOfModules;
+    COVERAGE_MODULE_REQUEST ModuleRequestInfo;
+    COVERAGE_MODULE_INFO Modules[1];
+} COVERAGE_MODULES, *PCOVERAGE_MODULES;
+
 // private
 typedef struct _SYSTEM_PREFETCH_PATCH_INFORMATION
 {
@@ -2710,6 +2881,13 @@ typedef struct _SYSTEM_SYSTEM_DISK_INFORMATION
    UNICODE_STRING SystemDisk;
 } SYSTEM_SYSTEM_DISK_INFORMATION, *PSYSTEM_SYSTEM_DISK_INFORMATION;

+// private
+typedef struct _SYSTEM_NUMA_PROXIMITY_MAP
+{
+    ULONG NodeProximityId;
+    USHORT NodeNumber;
+} SYSTEM_NUMA_PROXIMITY_MAP, *PSYSTEM_NUMA_PROXIMITY_MAP;
+
 // private (Windows 8.1 and above)
 typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT
 {
@@ -2753,6 +2931,8 @@ typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION
 #define CODEINTEGRITY_OPTION_HVCI_KMCI_AUDITMODE_ENABLED 0x800
 #define CODEINTEGRITY_OPTION_HVCI_KMCI_STRICTMODE_ENABLED 0x1000
 #define CODEINTEGRITY_OPTION_HVCI_IUM_ENABLED 0x2000
+#define CODEINTEGRITY_OPTION_WHQL_ENFORCEMENT_ENABLED 0x4000
+#define CODEINTEGRITY_OPTION_WHQL_AUDITMODE_ENABLED 0x8000

 // private
 typedef struct _SYSTEM_CODEINTEGRITY_INFORMATION
@@ -2789,36 +2969,77 @@ typedef struct _SYSTEM_VA_LIST_INFORMATION
 } SYSTEM_VA_LIST_INFORMATION, *PSYSTEM_VA_LIST_INFORMATION;

 // rev
-typedef enum _SYSTEM_STORE_INFORMATION_CLASS
+typedef enum _STORE_INFORMATION_CLASS
 {
-    SystemStoreCompressionInformation = 22 // q: SYSTEM_STORE_COMPRESSION_INFORMATION
-} SYSTEM_STORE_INFORMATION_CLASS;
+    StorePageRequest = 1,
+    StoreStatsRequest = 2, // (requires SeProfileSingleProcessPrivilege) // SmProcessStatsRequest
+    StoreCreateRequest = 3,
+    StoreDeleteRequest = 4,
+    StoreListRequest = 5, // SmProcessListRequest
+    Available1 = 6,
+    StoreEmptyRequest = 7,
+    CacheListRequest = 8, // SmcProcessListRequest
+    CacheCreateRequest = 9,
+    CacheDeleteRequest = 10,
+    CacheStoreCreateRequest = 11,
+    CacheStoreDeleteRequest = 12,
+    CacheStatsRequest = 13, // SmcProcessStatsRequest
+    Available2 = 14,
+    RegistrationRequest = 15, // SmProcessRegistrationRequest
+    GlobalCacheStatsRequest = 16,
+    StoreResizeRequest = 17,
+    CacheStoreResizeRequest = 18,
+    SmConfigRequest = 19,
+    StoreHighMemoryPriorityRequest = 20, // SM_STORE_HIGH_MEM_PRIORITY_REQUEST
+    SystemStoreTrimRequest = 21, // SM_SYSTEM_STORE_TRIM_REQUEST
+    MemCompressionInfoRequest = 22,  // q: SM_MEM_COMPRESSION_INFO_REQUEST // SmProcessCompressionInfoRequest
+    ProcessStoreInfoRequest = 23, // SmProcessProcessStoreInfoRequest
+    StoreInformationMax
+} STORE_INFORMATION_CLASS;

 // rev
 #define SYSTEM_STORE_INFORMATION_VERSION 1

 // rev
-typedef struct _SYSTEM_STORE_INFORMATION
+typedef struct _STORE_INFORMATION
 {
    _In_ ULONG Version;
-    _In_ SYSTEM_STORE_INFORMATION_CLASS StoreInformationClass;
+    _In_ STORE_INFORMATION_CLASS StoreInformationClass;
    _Inout_ PVOID Data;
    _Inout_ ULONG Length;
-} SYSTEM_STORE_INFORMATION, *PSYSTEM_STORE_INFORMATION;
+} STORE_INFORMATION, *PSTORE_INFORMATION;
+
+// rev
+typedef struct _SM_STORE_HIGH_MEM_PRIORITY_REQUEST
+{
+    ULONG Version : 8;
+    ULONG SetHighMemoryPriority : 1;
+    ULONG Spare : 23;
+    HANDLE ProcessHandle;
+} SM_STORE_HIGH_MEM_PRIORITY_REQUEST, *PSM_STORE_HIGH_MEM_PRIORITY_REQUEST;
+
+// rev
+typedef struct _SM_SYSTEM_STORE_TRIM_REQUEST
+{
+    ULONG Version : 8;
+    ULONG Spare : 24;
+    SIZE_T PagesToTrim; // ULONG?
+} SM_SYSTEM_STORE_TRIM_REQUEST, *PSM_SYSTEM_STORE_TRIM_REQUEST;

 // rev
 #define SYSTEM_STORE_COMPRESSION_INFORMATION_VERSION 3

 // rev
-typedef struct _SYSTEM_STORE_COMPRESSION_INFORMATION
+typedef struct _SM_MEM_COMPRESSION_INFO_REQUEST
 {
-    ULONG Version;
+    ULONG Version : 8;
+    ULONG Spare : 24;
    ULONG CompressionPid;
-    ULONGLONG CompressionWorkingSetSize;
-    ULONGLONG CompressSize;
-    ULONGLONG CompressedSize;
-    ULONGLONG NonCompressedSize;
-} SYSTEM_STORE_COMPRESSION_INFORMATION, *PSYSTEM_STORE_COMPRESSION_INFORMATION;
+    ULONG WorkingSetSize; // ULONGLONG?
+    ULONGLONG TotalDataCompressed;
+    ULONGLONG TotalCompressedSize;
+    ULONGLONG TotalUniqueDataCompressed;
+} SM_MEM_COMPRESSION_INFO_REQUEST, *PSM_MEM_COMPRESSION_INFO_REQUEST;

 // private
 typedef struct _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS
@@ -3080,6 +3301,14 @@ typedef struct _MEMORY_COMBINE_INFORMATION_EX2
    HANDLE ProcessHandle;
 } MEMORY_COMBINE_INFORMATION_EX2, *PMEMORY_COMBINE_INFORMATION_EX2;

+// private
+typedef struct _SYSTEM_ENTROPY_TIMING_INFORMATION
+{
+    VOID (NTAPI *EntropyRoutine)(PVOID, ULONG);
+    VOID (NTAPI *InitializationRoutine)(PVOID, ULONG, PVOID);
+    PVOID InitializationContext;
+} SYSTEM_ENTROPY_TIMING_INFORMATION, *PSYSTEM_ENTROPY_TIMING_INFORMATION;
+
 // private
 typedef struct _SYSTEM_CONSOLE_INFORMATION
 {
@@ -3224,14 +3453,13 @@ typedef struct _PROCESS_DISK_COUNTERS
 // private
 typedef union _ENERGY_STATE_DURATION
 {
-    union
+    ULONGLONG Value;
+    struct
    {
-        ULONGLONG Value;
        ULONG LastChangeTime;
+        ULONG Duration : 31;
+        ULONG IsInState : 1;
    };
-
-    ULONG Duration : 31;
-    ULONG IsInState : 1;
 } ENERGY_STATE_DURATION, *PENERGY_STATE_DURATION;

 typedef struct _PROCESS_ENERGY_VALUES
@@ -3260,11 +3488,14 @@ typedef struct _PROCESS_ENERGY_VALUES
    ULONGLONG WorkOnBehalfCycles[4][2];
 } PROCESS_ENERGY_VALUES, *PPROCESS_ENERGY_VALUES;

-typedef struct _TIMELINE_BITMAP
+typedef union _TIMELINE_BITMAP
 {
    ULONGLONG Value;
-    ULONG EndTime;
-    ULONG Bitmap;
+    struct
+    {
+        ULONG EndTime;
+        ULONG Bitmap;
+    };
 } TIMELINE_BITMAP, *PTIMELINE_BITMAP;

 typedef struct _PROCESS_ENERGY_VALUES_EXTENSION
@@ -3371,6 +3602,24 @@ typedef struct _SYSTEM_ELAM_CERTIFICATE_INFORMATION
    HANDLE ElamDriverFile;
 } SYSTEM_ELAM_CERTIFICATE_INFORMATION, *PSYSTEM_ELAM_CERTIFICATE_INFORMATION;

+// private
+typedef struct _OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2
+{
+    ULONG Version;
+    ULONG AbnormalResetOccurred;
+    ULONG OfflineMemoryDumpCapable;
+    LARGE_INTEGER ResetDataAddress;
+    ULONG ResetDataSize;
+} OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2, *POFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V2;
+
+// private
+typedef struct _OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V1
+{
+    ULONG Version;
+    ULONG AbnormalResetOccurred;
+    ULONG OfflineMemoryDumpCapable;
+} OFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V1, *POFFLINE_CRASHDUMP_CONFIGURATION_TABLE_V1;
+
 // private
 typedef struct _SYSTEM_PROCESSOR_FEATURES_INFORMATION
 {
@@ -3378,6 +3627,12 @@ typedef struct _SYSTEM_PROCESSOR_FEATURES_INFORMATION
    ULONGLONG Reserved[3];
 } SYSTEM_PROCESSOR_FEATURES_INFORMATION, *PSYSTEM_PROCESSOR_FEATURES_INFORMATION;

+// EDID v1.4 standard data format
+typedef struct _SYSTEM_EDID_INFORMATION
+{
+    UCHAR Edid[128];
+} SYSTEM_EDID_INFORMATION, *PSYSTEM_EDID_INFORMATION;
+
 // private
 typedef struct _SYSTEM_MANUFACTURING_INFORMATION
 {
@@ -3545,6 +3800,30 @@ typedef struct _SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT
    GROUP_AFFINITY TargetAffinity;
 } SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT, *PSYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT;

+typedef union _SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT
+{
+    ULONG AsULONG;
+    struct
+    {
+        ULONG Enabled : 1;
+        ULONG Reserved : 31;
+    };
+} SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT, *PSYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT;
+
+#if !defined(NTDDI_WIN10_CO) || (NTDDI_VERSION < NTDDI_WIN10_CO)
+// private
+typedef struct _SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION
+{
+    ULONG Machine : 16;
+    ULONG KernelMode : 1;
+    ULONG UserMode : 1;
+    ULONG Native : 1;
+    ULONG Process : 1;
+    ULONG WoW64Container : 1;
+    ULONG ReservedZero0 : 11;
+} SYSTEM_SUPPORTED_PROCESSOR_ARCHITECTURES_INFORMATION;
+#endif
+
 // private
 typedef struct _SYSTEM_MEMORY_USAGE_INFORMATION
 {
@@ -3780,6 +4059,21 @@ typedef struct _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION
    SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY Descriptors[3];
 } SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION, *PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION;

+// private
+typedef struct _RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET
+{
+    ULONG Data[2];
+} RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET, *PRTL_FEATURE_USAGE_SUBSCRIPTION_TARGET;
+
+// private
+typedef struct _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS
+{
+    ULONG FeatureId;
+    USHORT ReportingKind;
+    USHORT ReportingOptions;
+    RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET ReportingTarget;
+} SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS, *PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS;
+
 // private
 typedef union _SECURE_SPECULATION_CONTROL_INFORMATION
 {
@@ -3821,7 +4115,8 @@ typedef struct _SYSTEM_SHADOW_STACK_INFORMATION
            ULONG UserCetAllowed : 1;
            ULONG ReservedForUserCet : 6;
            ULONG KernelCetEnabled : 1;
-            ULONG ReservedForKernelCet : 7;
+            ULONG KernelCetAuditModeEnabled : 1;
+            ULONG ReservedForKernelCet : 6;       // since Windows 10 build 21387
            ULONG Reserved : 16;
        };
    };
@@ -3885,6 +4180,76 @@ typedef struct _SYSTEM_POOL_LIMIT_INFORMATION
 //    BOOLEAN PoolZeroingSupportPresent;
 //} SYSTEM_POOL_ZEROING_INFORMATION, *PSYSTEM_POOL_ZEROING_INFORMATION;

+// private
+typedef struct _HV_MINROOT_NUMA_LPS
+{
+    ULONG NodeIndex;
+    ULONG_PTR Mask[16];
+} HV_MINROOT_NUMA_LPS, *PHV_MINROOT_NUMA_LPS;
+
+// private
+typedef enum _SYSTEM_IOMMU_STATE
+{
+    IommuStateBlock,
+    IommuStateUnblock
+} SYSTEM_IOMMU_STATE;
+
+// private
+typedef struct _SYSTEM_IOMMU_STATE_INFORMATION
+{
+    SYSTEM_IOMMU_STATE State;
+    PVOID Pdo;
+} SYSTEM_IOMMU_STATE_INFORMATION, *PSYSTEM_IOMMU_STATE_INFORMATION;
+
+// private
+typedef struct _SYSTEM_HYPERVISOR_MINROOT_INFORMATION
+{
+    ULONG NumProc;
+    ULONG RootProc;
+    ULONG RootProcNumaNodesSpecified;
+    USHORT RootProcNumaNodes[64];
+    ULONG RootProcPerCore;
+    ULONG RootProcPerNode;
+    ULONG RootProcNumaNodesLpsSpecified;  
+    HV_MINROOT_NUMA_LPS RootProcNumaNodeLps[64];
+} SYSTEM_HYPERVISOR_MINROOT_INFORMATION, *PSYSTEM_HYPERVISOR_MINROOT_INFORMATION;
+
+// private
+typedef struct _SYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION
+{
+    ULONG RangeCount;
+    ULONG_PTR RangeArray[1];
+} SYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION, *PSYSTEM_HYPERVISOR_BOOT_PAGES_INFORMATION;
+
+// private
+typedef struct _SYSTEM_POINTER_AUTH_INFORMATION
+{
+    union
+    {
+        USHORT SupportedFlags;
+        struct
+        {
+            USHORT AddressAuthSupported : 1;
+            USHORT AddressAuthQarma : 1;
+            USHORT GenericAuthSupported : 1;
+            USHORT GenericAuthQarma : 1;
+            USHORT SupportedReserved : 12;
+        };
+    };
+    union
+    {
+        USHORT EnabledFlags;
+        struct
+        {
+            USHORT UserPerProcessIpAuthEnabled : 1;
+            USHORT UserGlobalIpAuthEnabled : 1;
+            USHORT UserEnabledReserved : 6;
+            USHORT KernelIpAuthEnabled : 1;
+            USHORT KernelEnabledReserved : 7;
+        };
+    };
+} SYSTEM_POINTER_AUTH_INFORMATION, *PSYSTEM_POINTER_AUTH_INFORMATION;
+
 #if (PHNT_MODE != PHNT_MODE_KERNEL)

 NTSYSCALLAPI
@@ -3928,24 +4293,24 @@ typedef enum _SYSDBG_COMMAND
    SysDbgQueryModuleInformation,
    SysDbgQueryTraceInformation,
    SysDbgSetTracepoint,
-    SysDbgSetSpecialCall,
-    SysDbgClearSpecialCalls,
+    SysDbgSetSpecialCall, // PVOID
+    SysDbgClearSpecialCalls, // void
    SysDbgQuerySpecialCalls,
    SysDbgBreakPoint,
-    SysDbgQueryVersion,
-    SysDbgReadVirtual,
-    SysDbgWriteVirtual,
-    SysDbgReadPhysical,
-    SysDbgWritePhysical,
-    SysDbgReadControlSpace,
-    SysDbgWriteControlSpace,
-    SysDbgReadIoSpace,
-    SysDbgWriteIoSpace,
-    SysDbgReadMsr,
-    SysDbgWriteMsr,
-    SysDbgReadBusData,
-    SysDbgWriteBusData,
-    SysDbgCheckLowMemory,
+    SysDbgQueryVersion, // DBGKD_GET_VERSION64
+    SysDbgReadVirtual, // SYSDBG_VIRTUAL
+    SysDbgWriteVirtual, // SYSDBG_VIRTUAL
+    SysDbgReadPhysical, // SYSDBG_PHYSICAL // 10
+    SysDbgWritePhysical, // SYSDBG_PHYSICAL
+    SysDbgReadControlSpace, // SYSDBG_CONTROL_SPACE
+    SysDbgWriteControlSpace, // SYSDBG_CONTROL_SPACE
+    SysDbgReadIoSpace, // SYSDBG_IO_SPACE
+    SysDbgWriteIoSpace, // SYSDBG_IO_SPACE
+    SysDbgReadMsr, // SYSDBG_MSR
+    SysDbgWriteMsr, // SYSDBG_MSR
+    SysDbgReadBusData, // SYSDBG_BUS_DATA
+    SysDbgWriteBusData, // SYSDBG_BUS_DATA
+    SysDbgCheckLowMemory, // 20
    SysDbgEnableKernelDebugger,
    SysDbgDisableKernelDebugger,
    SysDbgGetAutoKdEnable,
@@ -3954,15 +4319,17 @@ typedef enum _SYSDBG_COMMAND
    SysDbgSetPrintBufferSize,
    SysDbgGetKdUmExceptionEnable,
    SysDbgSetKdUmExceptionEnable,
-    SysDbgGetTriageDump,
-    SysDbgGetKdBlockEnable,
+    SysDbgGetTriageDump, // SYSDBG_TRIAGE_DUMP
+    SysDbgGetKdBlockEnable, // 30
    SysDbgSetKdBlockEnable,
    SysDbgRegisterForUmBreakInfo,
    SysDbgGetUmBreakPid,
    SysDbgClearUmBreakPid,
    SysDbgGetUmAttachPid,
    SysDbgClearUmAttachPid,
-    SysDbgGetLiveKernelDump
+    SysDbgGetLiveKernelDump, // SYSDBG_LIVEDUMP_CONTROL
+    SysDbgKdPullRemoteFile, // SYSDBG_KD_PULL_REMOTE_FILE
+    SysDbgMaxInfoClass
 } SYSDBG_COMMAND, *PSYSDBG_COMMAND;

 typedef struct _SYSDBG_VIRTUAL
@@ -4073,6 +4440,12 @@ typedef struct _SYSDBG_LIVEDUMP_CONTROL
    SYSDBG_LIVEDUMP_CONTROL_ADDPAGES AddPagesControl;
 } SYSDBG_LIVEDUMP_CONTROL, *PSYSDBG_LIVEDUMP_CONTROL;

+// private
+typedef struct _SYSDBG_KD_PULL_REMOTE_FILE
+{
+    UNICODE_STRING ImageFileName;
+} SYSDBG_KD_PULL_REMOTE_FILE, *PSYSDBG_KD_PULL_REMOTE_FILE;
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -4338,6 +4711,8 @@ C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NumberOfPhysicalPages) == 0x2e8);
 C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SafeBootMode) == 0x2ec);
 C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCount) == 0x320);
 C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountQuad) == 0x320);
+C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveProcessorCount) == 0x3c0);
+C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveGroupCount) == 0x3c4);
 C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, XState) == 0x3d8);
 //C_ASSERT(sizeof(KUSER_SHARED_DATA) == 0x70C); // VS2019 has some weird issue with this.

@@ -122,6 +122,8 @@
 #define FILE_CHARACTERISTIC_CSV 0x00010000
 #define FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL 0x00020000
 #define FILE_PORTABLE_DEVICE 0x00040000
+#define FILE_REMOTE_DEVICE_VSMB 0x00080000
+#define FILE_DEVICE_REQUIRE_SECURITY_CHECK 0x00100000

 // Named pipe values

@@ -249,7 +251,7 @@ typedef enum _FILE_INFORMATION_CLASS
    FileIdInformation, // FILE_ID_INFORMATION
    FileIdExtdDirectoryInformation, // FILE_ID_EXTD_DIR_INFORMATION // 60
    FileReplaceCompletionInformation, // FILE_COMPLETION_INFORMATION // since WINBLUE
-    FileHardLinkFullIdInformation, // FILE_LINK_ENTRY_FULL_ID_INFORMATION
+    FileHardLinkFullIdInformation, // FILE_LINK_ENTRY_FULL_ID_INFORMATION // FILE_LINKS_FULL_ID_INFORMATION
    FileIdExtdBothDirectoryInformation, // FILE_ID_EXTD_BOTH_DIR_INFORMATION // since THRESHOLD
    FileDispositionInformationEx, // FILE_DISPOSITION_INFO_EX // since REDSTONE
    FileRenameInformationEx, // FILE_RENAME_INFORMATION_EX
@@ -263,6 +265,7 @@ typedef enum _FILE_INFORMATION_CLASS
    FileLinkInformationExBypassAccessCheck, // (kernel-mode only); FILE_LINK_INFORMATION_EX
    FileStorageReserveIdInformation, // FILE_SET_STORAGE_RESERVE_ID_INFORMATION
    FileCaseSensitiveInformationForceAccessCheck, // FILE_CASE_SENSITIVE_INFORMATION
+    FileKnownFolderInformation, // FILE_KNOWN_FOLDER_INFORMATION // since WIN11
    FileMaximumInformation
 } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;

@@ -388,22 +391,31 @@ typedef struct _FILE_END_OF_FILE_INFORMATION
    LARGE_INTEGER EndOfFile;
 } FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;

+//#if (PHNT_VERSION >= PHNT_REDSTONE5)
+#define FLAGS_END_OF_FILE_INFO_EX_EXTEND_PAGING 0x00000001
+#define FLAGS_END_OF_FILE_INFO_EX_NO_EXTRA_PAGING_EXTEND 0x00000002
+#define FLAGS_END_OF_FILE_INFO_EX_TIME_CONSTRAINED 0x00000004
+#define FLAGS_DELAY_REASONS_LOG_FILE_FULL 0x00000001
+#define FLAGS_DELAY_REASONS_BITMAP_SCANNED 0x00000002
+
+typedef struct _FILE_END_OF_FILE_INFORMATION_EX 
+{
+    LARGE_INTEGER EndOfFile;
+    LARGE_INTEGER PagingFileSizeInMM;
+    LARGE_INTEGER PagingFileMaxSize;
+    ULONG Flags;
+} FILE_END_OF_FILE_INFORMATION_EX, *PFILE_END_OF_FILE_INFORMATION_EX;
+//#endif
+
 typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION
 {
    LARGE_INTEGER ValidDataLength;
 } FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION;

-typedef struct _FILE_LINK_INFORMATION
-{
-    BOOLEAN ReplaceIfExists;
-    HANDLE RootDirectory;
-    ULONG FileNameLength;
-    WCHAR FileName[1];
-} FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
-
 #if (PHNT_VERSION >= PHNT_REDSTONE5)
 #define FILE_LINK_REPLACE_IF_EXISTS 0x00000001
 #define FILE_LINK_POSIX_SEMANTICS 0x00000002
+
 #define FILE_LINK_SUPPRESS_STORAGE_RESERVE_INHERITANCE 0x00000008
 #define FILE_LINK_NO_INCREASE_AVAILABLE_SPACE 0x00000010
 #define FILE_LINK_NO_DECREASE_AVAILABLE_SPACE 0x00000020
@@ -417,6 +429,22 @@ typedef struct _FILE_LINK_INFORMATION
 #define FILE_LINK_FORCE_RESIZE_SR 0x00000180
 #endif

+typedef struct _FILE_LINK_INFORMATION
+{
+#if (PHNT_VERSION >= PHNT_REDSTONE5)
+    union
+    {
+        BOOLEAN ReplaceIfExists; // FileLinkInformation
+        ULONG Flags; // FileLinkInformationEx
+    };
+#else
+    BOOLEAN ReplaceIfExists;
+#endif
+    HANDLE RootDirectory;
+    ULONG FileNameLength;
+    WCHAR FileName[1];
+} FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
+
 typedef struct _FILE_LINK_INFORMATION_EX
 {
    ULONG Flags;
@@ -638,21 +666,23 @@ typedef struct _FILE_IOSTATUSBLOCK_RANGE_INFORMATION
    ULONG Length;
 } FILE_IOSTATUSBLOCK_RANGE_INFORMATION, *PFILE_IOSTATUSBLOCK_RANGE_INFORMATION;

+// Win32 FILE_REMOTE_PROTOCOL_INFO
 typedef struct _FILE_REMOTE_PROTOCOL_INFORMATION
 {
-    USHORT StructureVersion; // 1
-    USHORT StructureSize;
+    // Structure Version
+    USHORT StructureVersion;     // 1 for Win7, 2 for Win8 SMB3, 3 for Blue SMB3, 4 for RS5
+    USHORT StructureSize;        // sizeof(FILE_REMOTE_PROTOCOL_INFORMATION)

-    ULONG Protocol; // WNNC_NET_*
+    ULONG Protocol;             // Protocol (WNNC_NET_*) defined in winnetwk.h or ntifs.h.

+    // Protocol Version & Type
    USHORT ProtocolMajorVersion;
    USHORT ProtocolMinorVersion;
    USHORT ProtocolRevision;

    USHORT Reserved;

-    // Generic information
-
+    // Protocol-Generic Information
    ULONG Flags;

    struct
@@ -660,14 +690,16 @@ typedef struct _FILE_REMOTE_PROTOCOL_INFORMATION
        ULONG Reserved[8];
    } GenericReserved;

-    // Specific information
+    // Protocol specific information

-#if (PHNT_VERSION < PHNT_WIN8)
+#if (_WIN32_WINNT < PHNT_WIN8)
    struct
    {
        ULONG Reserved[16];
    } ProtocolSpecificReserved;
-#else
+#endif
+
+#if (PHNT_VERSION >= PHNT_WIN8)
    union
    {
        struct
@@ -679,7 +711,16 @@ typedef struct _FILE_REMOTE_PROTOCOL_INFORMATION
            struct
            {
                ULONG Capabilities;
+#if (PHNT_VERSION >= PHNT_21H1)
+                ULONG ShareFlags;
+#else
                ULONG CachingFlags;
+#endif
+#if (PHNT_VERSION >= PHNT_REDSTONE5)
+                UCHAR ShareType;
+                UCHAR Reserved0[3];
+                ULONG Reserved1;
+#endif
            } Share;
        } Smb2;
        ULONG Reserved[16];
@@ -735,6 +776,13 @@ typedef struct _FILE_LINK_ENTRY_FULL_ID_INFORMATION
    WCHAR FileName[1];
 } FILE_LINK_ENTRY_FULL_ID_INFORMATION, *PFILE_LINK_ENTRY_FULL_ID_INFORMATION;

+typedef struct _FILE_LINKS_FULL_ID_INFORMATION 
+{
+    ULONG BytesNeeded;
+    ULONG EntriesReturned;
+    FILE_LINK_ENTRY_FULL_ID_INFORMATION Entry;
+} FILE_LINKS_FULL_ID_INFORMATION, *PFILE_LINKS_FULL_ID_INFORMATION;
+
 typedef struct _FILE_ID_EXTD_BOTH_DIR_INFORMATION
 {
    ULONG NextEntryOffset;
@@ -768,7 +816,7 @@ typedef struct _FILE_STAT_INFORMATION
    ULONG FileAttributes;
    ULONG ReparseTag;
    ULONG NumberOfLinks;
-    ULONG EffectiveAccess;
+    ACCESS_MASK EffectiveAccess;
 } FILE_STAT_INFORMATION, *PFILE_STAT_INFORMATION;

 // private
@@ -786,6 +834,13 @@ typedef struct _FILE_MEMORY_PARTITION_INFORMATION
    } Flags;
 } FILE_MEMORY_PARTITION_INFORMATION, *PFILE_MEMORY_PARTITION_INFORMATION;

+// LxFlags
+#define LX_FILE_METADATA_HAS_UID 0x1
+#define LX_FILE_METADATA_HAS_GID 0x2
+#define LX_FILE_METADATA_HAS_MODE 0x4
+#define LX_FILE_METADATA_HAS_DEVICE_ID 0x8
+#define LX_FILE_CASE_SENSITIVE_DIR 0x10
+
 // private
 typedef struct _FILE_STAT_LX_INFORMATION
 {
@@ -799,7 +854,7 @@ typedef struct _FILE_STAT_LX_INFORMATION
    ULONG FileAttributes;
    ULONG ReparseTag;
    ULONG NumberOfLinks;
-    ULONG EffectiveAccess;
+    ACCESS_MASK EffectiveAccess;
    ULONG LxFlags;
    ULONG LxUid;
    ULONG LxGid;
@@ -808,12 +863,34 @@ typedef struct _FILE_STAT_LX_INFORMATION
    ULONG LxDeviceIdMinor;
 } FILE_STAT_LX_INFORMATION, *PFILE_STAT_LX_INFORMATION;

+#define FILE_CS_FLAG_CASE_SENSITIVE_DIR     0x00000001
+
 // private
 typedef struct _FILE_CASE_SENSITIVE_INFORMATION
 {
    ULONG Flags;
 } FILE_CASE_SENSITIVE_INFORMATION, *PFILE_CASE_SENSITIVE_INFORMATION;

+// private
+typedef enum _FILE_KNOWN_FOLDER_TYPE
+{
+    KnownFolderNone,
+    KnownFolderDesktop,
+    KnownFolderDocuments,
+    KnownFolderDownloads,
+    KnownFolderMusic,
+    KnownFolderPictures,
+    KnownFolderVideos,
+    KnownFolderOther,
+    KnownFolderMax = 7
+} FILE_KNOWN_FOLDER_TYPE;
+
+// private
+typedef struct _FILE_KNOWN_FOLDER_INFORMATION
+{
+    FILE_KNOWN_FOLDER_TYPE Type;
+} FILE_KNOWN_FOLDER_INFORMATION, *PFILE_KNOWN_FOLDER_INFORMATION;
+
 // NtQueryDirectoryFile types

 typedef struct _FILE_DIRECTORY_INFORMATION
@@ -1032,6 +1109,20 @@ typedef struct _FILE_FS_SIZE_INFORMATION
    ULONG BytesPerSector;
 } FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;

+// FileSystemControlFlags
+#define FILE_VC_QUOTA_NONE 0x00000000
+#define FILE_VC_QUOTA_TRACK 0x00000001
+#define FILE_VC_QUOTA_ENFORCE 0x00000002
+#define FILE_VC_QUOTA_MASK 0x00000003
+#define FILE_VC_CONTENT_INDEX_DISABLED 0x00000008
+#define FILE_VC_LOG_QUOTA_THRESHOLD 0x00000010
+#define FILE_VC_LOG_QUOTA_LIMIT 0x00000020
+#define FILE_VC_LOG_VOLUME_THRESHOLD 0x00000040
+#define FILE_VC_LOG_VOLUME_LIMIT 0x00000080
+#define FILE_VC_QUOTAS_INCOMPLETE 0x00000100
+#define FILE_VC_QUOTAS_REBUILDING 0x00000200
+#define FILE_VC_VALID_MASK 0x000003ff
+
 // private
 typedef struct _FILE_FS_CONTROL_INFORMATION
 {
@@ -1289,6 +1380,15 @@ NtQueryDirectoryFile(
    );

 #if (PHNT_VERSION >= PHNT_REDSTONE3)
+// QueryFlags values for NtQueryDirectoryFileEx
+#define FILE_QUERY_RESTART_SCAN 0x00000001
+#define FILE_QUERY_RETURN_SINGLE_ENTRY 0x00000002
+#define FILE_QUERY_INDEX_SPECIFIED 0x00000004
+#define FILE_QUERY_RETURN_ON_DISK_ENTRIES_ONLY 0x00000008
+#if (PHNT_VERSION >= PHNT_REDSTONE5)
+#define FILE_QUERY_NO_CURSOR_UPDATE 0x00000010
+#endif
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -1561,8 +1661,8 @@ NtNotifyChangeDirectoryFile(
 // private
 typedef enum _DIRECTORY_NOTIFY_INFORMATION_CLASS
 {
-    DirectoryNotifyInformation, // FILE_NOTIFY_INFORMATION
-    DirectoryNotifyExtendedInformation // FILE_NOTIFY_EXTENDED_INFORMATION
+    DirectoryNotifyInformation = 1, // FILE_NOTIFY_INFORMATION
+    DirectoryNotifyExtendedInformation = 2 // FILE_NOTIFY_EXTENDED_INFORMATION
 } DIRECTORY_NOTIFY_INFORMATION_CLASS, *PDIRECTORY_NOTIFY_INFORMATION_CLASS;

 #if (PHNT_VERSION >= PHNT_REDSTONE3)
@@ -1603,6 +1703,14 @@ NtUnloadDriver(
 #define IO_COMPLETION_QUERY_STATE 0x0001
 #endif

+#ifndef IO_COMPLETION_MODIFY_STATE
+#define IO_COMPLETION_MODIFY_STATE 0x0002
+#endif
+
+#ifndef IO_COMPLETION_ALL_ACCESS
+#define IO_COMPLETION_ALL_ACCESS (IO_COMPLETION_QUERY_STATE|IO_COMPLETION_MODIFY_STATE|STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE) 
+#endif
+
 typedef enum _IO_COMPLETION_INFORMATION_CLASS
 {
    IoCompletionBasicInformation
@@ -1746,14 +1854,14 @@ typedef enum _IO_SESSION_EVENT

 typedef enum _IO_SESSION_STATE
 {
-    IoSessionStateCreated,
-    IoSessionStateInitialized,
-    IoSessionStateConnected,
-    IoSessionStateDisconnected,
-    IoSessionStateDisconnectedLoggedOn,
-    IoSessionStateLoggedOn,
-    IoSessionStateLoggedOff,
-    IoSessionStateTerminated,
+    IoSessionStateCreated = 1,
+    IoSessionStateInitialized = 2,
+    IoSessionStateConnected = 3,
+    IoSessionStateDisconnected = 4,
+    IoSessionStateDisconnectedLoggedOn = 5,
+    IoSessionStateLoggedOn = 6,
+    IoSessionStateLoggedOff = 7,
+    IoSessionStateTerminated = 8,
    IoSessionStateMax
 } IO_SESSION_STATE;

@@ -1795,23 +1903,24 @@ NtNotifyChangeSession(
 typedef enum _INTERFACE_TYPE
 {
    InterfaceTypeUndefined = -1,
-    Internal,
-    Isa,
-    Eisa,
-    MicroChannel,
-    TurboChannel,
-    PCIBus,
-    VMEBus,
-    NuBus,
-    PCMCIABus,
-    CBus,
-    MPIBus,
-    MPSABus,
-    ProcessorInternal,
-    InternalPowerBus,
-    PNPISABus,
-    PNPBus,
-    Vmcs,
+    Internal = 0,
+    Isa = 1,
+    Eisa = 2,
+    MicroChannel = 3,
+    TurboChannel = 4,
+    PCIBus = 5,
+    VMEBus = 6,
+    NuBus = 7,
+    PCMCIABus = 8,
+    CBus = 9,
+    MPIBus = 10,
+    MPSABus = 11,
+    ProcessorInternal = 12,
+    InternalPowerBus = 13,
+    PNPISABus = 14,
+    PNPBus = 15,
+    Vmcs = 16,
+    ACPIBus = 17,
    MaximumInterfaceType
 } INTERFACE_TYPE, *PINTERFACE_TYPE;

@@ -1820,6 +1929,8 @@ typedef enum _DMA_WIDTH
    Width8Bits,
    Width16Bits,
    Width32Bits,
+    Width64Bits,
+    WidthNoWrap,
    MaximumDmaWidth
 } DMA_WIDTH, *PDMA_WIDTH;

@@ -1855,13 +1966,20 @@ typedef enum _BUS_DATA_TYPE

 // Reparse structure for FSCTL_SET_REPARSE_POINT, FSCTL_GET_REPARSE_POINT, FSCTL_DELETE_REPARSE_POINT

-#define SYMLINK_FLAG_RELATIVE 1
+#define SYMLINK_FLAG_RELATIVE 0x00000001
+
+#if (PHNT_VERSION >= PHNT_REDSTONE4)
+#define SYMLINK_DIRECTORY 0x80000000 // If set then this is a directory symlink
+#define SYMLINK_FILE 0x40000000 // If set then this is a file symlink
+#endif

 typedef struct _REPARSE_DATA_BUFFER
 {
    ULONG ReparseTag;
    USHORT ReparseDataLength;
    USHORT Reserved;
+
+    _Field_size_bytes_(ReparseDataLength)
    union
    {
        struct
@@ -1888,6 +2006,8 @@ typedef struct _REPARSE_DATA_BUFFER
    };
 } REPARSE_DATA_BUFFER, *PREPARSE_DATA_BUFFER;

+#define REPARSE_DATA_BUFFER_HEADER_SIZE UFIELD_OFFSET(REPARSE_DATA_BUFFER, GenericReparseBuffer)
+
 // Named pipe FS control definitions

 #define DEVICE_NAMED_PIPE L"\\Device\\NamedPipe\\"
@@ -1913,6 +2033,7 @@ typedef struct _REPARSE_DATA_BUFFER
 #define FSCTL_PIPE_SILO_ARRIVAL             CTL_CODE(FILE_DEVICE_NAMED_PIPE, 18, METHOD_BUFFERED, FILE_WRITE_DATA)
 #define FSCTL_PIPE_CREATE_SYMLINK           CTL_CODE(FILE_DEVICE_NAMED_PIPE, 19, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
 #define FSCTL_PIPE_DELETE_SYMLINK           CTL_CODE(FILE_DEVICE_NAMED_PIPE, 20, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+#define FSCTL_PIPE_QUERY_CLIENT_PROCESS_V2  CTL_CODE(FILE_DEVICE_NAMED_PIPE, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)

 #define FSCTL_PIPE_INTERNAL_READ            CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
 #define FSCTL_PIPE_INTERNAL_WRITE           CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
@@ -1972,6 +2093,18 @@ typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER
 #endif
 } FILE_PIPE_CLIENT_PROCESS_BUFFER, *PFILE_PIPE_CLIENT_PROCESS_BUFFER;

+// Control structure for FSCTL_PIPE_QUERY_CLIENT_PROCESS_V2
+
+typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER_V2 
+{
+     ULONGLONG ClientSession;
+#if !defined(BUILD_WOW6432)
+     PVOID ClientProcess;
+#else
+     ULONGLONG ClientProcess;
+#endif
+} FILE_PIPE_CLIENT_PROCESS_BUFFER_V2, *PFILE_PIPE_CLIENT_PROCESS_BUFFER_V2;
+
 #define FILE_PIPE_COMPUTER_NAME_LENGTH 15

 // Input for FSCTL_PIPE_SET_CLIENT_PROCESS, Output for FSCTL_PIPE_QUERY_CLIENT_PROCESS
@@ -37,17 +37,17 @@ typedef enum _KTHREAD_STATE
 // private
 typedef enum _KHETERO_CPU_POLICY
 {
-    KHeteroCpuPolicyAll,
-    KHeteroCpuPolicyLarge,
-    KHeteroCpuPolicyLargeOrIdle,
-    KHeteroCpuPolicySmall,
-    KHeteroCpuPolicySmallOrIdle,
-    KHeteroCpuPolicyDynamic,
-    KHeteroCpuPolicyStaticMax,
-    KHeteroCpuPolicyBiasedSmall,
-    KHeteroCpuPolicyBiasedLarge,
-    KHeteroCpuPolicyDefault,
-    KHeteroCpuPolicyMax
+    KHeteroCpuPolicyAll = 0,
+    KHeteroCpuPolicyLarge = 1,
+    KHeteroCpuPolicyLargeOrIdle = 2,
+    KHeteroCpuPolicySmall = 3,
+    KHeteroCpuPolicySmallOrIdle = 4,
+    KHeteroCpuPolicyDynamic = 5,
+    KHeteroCpuPolicyStaticMax = 5, // valid
+    KHeteroCpuPolicyBiasedSmall = 6,
+    KHeteroCpuPolicyBiasedLarge = 7,
+    KHeteroCpuPolicyDefault = 8,
+    KHeteroCpuPolicyMax = 9
 } KHETERO_CPU_POLICY, *PKHETERO_CPU_POLICY;

 #if (PHNT_MODE != PHNT_MODE_KERNEL)
@@ -94,6 +94,8 @@ typedef enum _KWAIT_REASON
    WrAlertByThreadId,
    WrDeferredPreempt,
    WrPhysicalFault,
+    WrIoRing,
+    WrMdlCache,
    MaximumWaitReason
 } KWAIT_REASON, *PKWAIT_REASON;

@@ -93,11 +93,22 @@ typedef enum _LDR_DLL_LOAD_REASON
    LoadReasonDynamicLoad,
    LoadReasonAsImageLoad,
    LoadReasonAsDataLoad,
-    LoadReasonEnclavePrimary, // REDSTONE3
+    LoadReasonEnclavePrimary, // since REDSTONE3
    LoadReasonEnclaveDependency,
+    LoadReasonPatchImage, // since WIN11
    LoadReasonUnknown = -1
 } LDR_DLL_LOAD_REASON, *PLDR_DLL_LOAD_REASON;

+typedef enum _LDR_HOT_PATCH_STATE
+{
+    LdrHotPatchBaseImage,
+    LdrHotPatchNotApplied,
+    LdrHotPatchAppliedReverse,
+    LdrHotPatchAppliedForward,
+    LdrHotPatchFailedToPatch,
+    LdrHotPatchStateMax,
+} LDR_HOT_PATCH_STATE, *PLDR_HOT_PATCH_STATE;
+
 #define LDRP_PACKAGED_BINARY 0x00000001
 #define LDRP_STATIC_LINK 0x00000002
 #define LDRP_IMAGE_DLL 0x00000004
@@ -125,7 +136,8 @@ typedef enum _LDR_DLL_LOAD_REASON
 #define LDR_DATA_TABLE_ENTRY_SIZE_WINXP FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, DdagNode)
 #define LDR_DATA_TABLE_ENTRY_SIZE_WIN7 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, BaseNameHashValue)
 #define LDR_DATA_TABLE_ENTRY_SIZE_WIN8 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, ImplicitPathOptions)
-#define LDR_DATA_TABLE_ENTRY_SIZE_WIN10 sizeof(LDR_DATA_TABLE_ENTRY)
+#define LDR_DATA_TABLE_ENTRY_SIZE_WIN10 FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, SigningLevel)
+#define LDR_DATA_TABLE_ENTRY_SIZE_WIN11 sizeof(LDR_DATA_TABLE_ENTRY)

 // symbols
 typedef struct _LDR_DATA_TABLE_ENTRY
@@ -172,7 +184,8 @@ typedef struct _LDR_DATA_TABLE_ENTRY
            ULONG DontRelocate : 1;
            ULONG CorILOnly : 1;
            ULONG ChpeImage : 1;
-            ULONG ReservedFlags5 : 2;
+            ULONG ChpeEmulatorImage : 1;
+            ULONG ReservedFlags5 : 1;
            ULONG Redirected : 1;
            ULONG ReservedFlags6 : 2;
            ULONG CompatDatabaseProcessed : 1;
@@ -199,10 +212,17 @@ typedef struct _LDR_DATA_TABLE_ENTRY
    ULONG ReferenceCount;
    ULONG DependentLoadFlags;
    UCHAR SigningLevel; // since REDSTONE2
+    ULONG CheckSum; // since 22H1
+    PVOID ActivePatchImageBase;
+    LDR_HOT_PATCH_STATE HotPatchState;
 } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

 #define LDR_IS_DATAFILE(DllHandle) (((ULONG_PTR)(DllHandle)) & (ULONG_PTR)1)
 #define LDR_IS_IMAGEMAPPING(DllHandle) (((ULONG_PTR)(DllHandle)) & (ULONG_PTR)2)
+#define LDR_MAPPEDVIEW_TO_DATAFILE(BaseAddress) ((PVOID)(((ULONG_PTR)(BaseAddress)) | (ULONG_PTR)1))
+#define LDR_MAPPEDVIEW_TO_IMAGEMAPPING(BaseAddress) ((PVOID)(((ULONG_PTR)(BaseAddress)) | (ULONG_PTR)2))
+#define LDR_DATAFILE_TO_MAPPEDVIEW(DllHandle) ((PVOID)(((ULONG_PTR)(DllHandle)) & ~(ULONG_PTR)1))
+#define LDR_IMAGEMAPPING_TO_MAPPEDVIEW(DllHandle) ((PVOID)(((ULONG_PTR)(DllHandle)) & ~(ULONG_PTR)2))
 #define LDR_IS_RESOURCE(DllHandle) (LDR_IS_IMAGEMAPPING(DllHandle) || LDR_IS_DATAFILE(DllHandle))

 NTSYSAPI
@@ -243,7 +263,7 @@ LdrGetDllHandleEx(
    _In_opt_ PWSTR DllPath,
    _In_opt_ PULONG DllCharacteristics,
    _In_ PUNICODE_STRING DllName,
-    _Out_opt_ PVOID *DllHandle
+    _Out_ PVOID *DllHandle
    );

 #if (PHNT_VERSION >= PHNT_WIN7)
@@ -533,7 +553,7 @@ NTAPI
 LdrRegisterDllNotification(
    _In_ ULONG Flags,
    _In_ PLDR_DLL_NOTIFICATION_FUNCTION NotificationFunction,
-    _In_ PVOID Context,
+    _In_opt_ PVOID Context,
    _Out_ PVOID *Cookie
    );

@@ -611,12 +631,7 @@ typedef struct _PS_SYSTEM_DLL_INIT_BLOCK

 #if (PHNT_VERSION >= PHNT_THRESHOLD)
 // rev
-NTSYSAPI
-PPS_SYSTEM_DLL_INIT_BLOCK
-NTAPI
-LdrSystemDllInitBlock(
-    VOID
-    );
+NTSYSAPI PS_SYSTEM_DLL_INIT_BLOCK LdrSystemDllInitBlock;
 #endif

 // Load as data table
@@ -631,7 +646,8 @@ LdrAddLoadAsDataTable(
    _In_ PVOID Module,
    _In_ PWSTR FilePath,
    _In_ SIZE_T Size,
-    _In_ HANDLE Handle
+    _In_ HANDLE Handle,
+    _In_ HANDLE ActCtx // param added on Win10
    );

 // private
@@ -758,6 +774,29 @@ LdrFindEntryForAddress(
    _Out_ PLDR_DATA_TABLE_ENTRY *Entry
    );

+// rev - Win10 type
+NTSYSAPI
+NTSTATUS
+NTAPI
+LdrLoadAlternateResourceModule(
+    _In_ PVOID DllHandle,
+    _Out_ PVOID *ResourceDllBase,
+    _Out_opt_ ULONG_PTR *ResourceOffset,
+    _In_ ULONG Flags
+    );
+
+// rev - Win10 type
+NTSYSAPI
+NTSTATUS
+NTAPI
+LdrLoadAlternateResourceModuleEx(
+    _In_ PVOID DllHandle,
+    _In_ LANGID LanguageId,
+    _Out_ PVOID *ResourceDllBase,
+    _Out_opt_ ULONG_PTR *ResourceOffset,
+    _In_ ULONG Flags
+    );
+
 #endif // (PHNT_MODE != PHNT_MODE_KERNEL)

 // Module information
@@ -900,6 +939,7 @@ typedef PVOID (NTAPI *PDELAYLOAD_FAILURE_SYSTEM_ROUTINE)(
    _In_ PCSTR ProcName
    );

+#if (PHNT_VERSION >= PHNT_WIN8)
 // rev
 NTSYSAPI
 PVOID
@@ -930,23 +970,27 @@ NTAPI
 LdrSetDefaultDllDirectories(
    _In_ ULONG DirectoryFlags
    );
+#endif

 // rev
+DECLSPEC_NORETURN
 NTSYSAPI
-NTSTATUS
+VOID
 NTAPI
 LdrShutdownProcess(
    VOID
    );

 // rev
+DECLSPEC_NORETURN
 NTSYSAPI
-NTSTATUS
+VOID
 NTAPI
 LdrShutdownThread(
    VOID
    );

+#if (PHNT_VERSION >= PHNT_WINBLUE)
 // rev
 NTSYSAPI
 NTSTATUS
@@ -962,6 +1006,7 @@ NTAPI
 LdrControlFlowGuardEnforced(
    VOID
    );
+#endif

 #if (PHNT_VERSION >= PHNT_19H1)
 // rev
@@ -530,8 +530,9 @@ typedef enum _ALPC_PORT_INFORMATION_CLASS
    AlpcUnregisterCompletionListInformation, // s: VOID
    AlpcAdjustCompletionListConcurrencyCountInformation, // s: in ULONG
    AlpcRegisterCallbackInformation, // kernel-mode only
-    AlpcCompletionListRundownInformation, // s: VOID
-    AlpcWaitForPortReferences
+    AlpcCompletionListRundownInformation, // s: VOID // 10
+    AlpcWaitForPortReferences,
+    AlpcServerSessionInformation // q: ALPC_SERVER_SESSION_INFORMATION // since 19H2
 } ALPC_PORT_INFORMATION_CLASS;

 // private
@@ -583,6 +584,13 @@ typedef struct _ALPC_PORT_COMPLETION_LIST_INFORMATION
    ULONG AttributeFlags;
 } ALPC_PORT_COMPLETION_LIST_INFORMATION, *PALPC_PORT_COMPLETION_LIST_INFORMATION;

+// private
+typedef struct _ALPC_SERVER_SESSION_INFORMATION
+{
+    ULONG SessionId;
+    ULONG ProcessId;
+} ALPC_SERVER_SESSION_INFORMATION, *PALPC_SERVER_SESSION_INFORMATION;
+
 // private
 typedef enum _ALPC_MESSAGE_INFORMATION_CLASS
 {
@@ -35,7 +35,8 @@ typedef enum _VDMSERVICECLASS
    VdmSetProcessLdtInfo,
    VdmAdlibEmulation,
    VdmPMCliControl,
-    VdmQueryVdmProcess
+    VdmQueryVdmProcess,
+    VdmPreInitialize
 } VDMSERVICECLASS, *PVDMSERVICECLASS;

 NTSYSCALLAPI
@@ -68,25 +69,27 @@ typedef enum _TRACE_CONTROL_INFORMATION_CLASS
    TraceControlIncrementLoggerFile = 6,

    TraceControlRealtimeConnect = 11,
+    TraceControlActivityIdCreate = 12,
    TraceControlWdiDispatchControl = 13,
    TraceControlRealtimeDisconnectConsumerByHandle = 14,
-
+    TraceControlRegisterGuidsCode = 15,
    TraceControlReceiveNotification = 16,
-    TraceControlEnableGuid = 17,
+    TraceControlSendDataBlock = 17, // EnableGuid
    TraceControlSendReplyDataBlock = 18,
    TraceControlReceiveReplyDataBlock = 19,
    TraceControlWdiUpdateSem = 20,
-    TraceControlGetTraceGuidList = 21,
+    TraceControlEnumTraceGuidList = 21,
    TraceControlGetTraceGuidInfo = 22,
    TraceControlEnumerateTraceGuids = 23,
-
+    TraceControlRegisterSecurityProv = 24,
    TraceControlQueryReferenceTime = 25,
    TraceControlTrackProviderBinary = 26,
    TraceControlAddNotificationEvent = 27,
    TraceControlUpdateDisallowList = 28,
-
-    TraceControlUseDescriptorTypeUm = 31,
-    TraceControlGetTraceGroupList = 32,
+    TraceControlSetEnableAllKeywordsCode = 29,
+    TraceControlSetProviderTraitsCode = 30,
+    TraceControlUseDescriptorTypeCode = 31,
+    TraceControlEnumTraceGroupList = 32,
    TraceControlGetTraceGroupInfo = 33,
    TraceControlTraceSetDisallowList= 34,
    TraceControlSetCompressionSettings = 35,
@@ -30,7 +30,12 @@
 #define PAGE_ENCLAVE_THREAD_CONTROL 0x80000000
 #define PAGE_TARGETS_NO_UPDATE      0x40000000
 #define PAGE_TARGETS_INVALID        0x40000000
-#define PAGE_ENCLAVE_UNVALIDATED    0x20000000
+#define PAGE_ENCLAVE_UNVALIDATED    0x20000000  
+#define PAGE_ENCLAVE_NO_CHANGE      0x20000000
+#define PAGE_ENCLAVE_MASK           0x10000000  
+#define PAGE_ENCLAVE_DECOMMIT       (PAGE_ENCLAVE_MASK | 0) 
+#define PAGE_ENCLAVE_SS_FIRST       (PAGE_ENCLAVE_MASK | 1) 
+#define PAGE_ENCLAVE_SS_REST        (PAGE_ENCLAVE_MASK | 2)

 // Region and section constants

@@ -51,7 +56,17 @@
 #define MEM_LARGE_PAGES 0x20000000
 #define MEM_DOS_LIM 0x40000000
 #define MEM_4MB_PAGES 0x80000000
+#define MEM_64K_PAGES (MEM_LARGE_PAGES | MEM_PHYSICAL)

+#define MEM_UNMAP_WITH_TRANSIENT_BOOST 0x00000001
+#define MEM_COALESCE_PLACEHOLDERS 0x00000001
+#define MEM_PRESERVE_PLACEHOLDER 0x00000002
+#define MEM_REPLACE_PLACEHOLDER 0x00004000
+#define MEM_RESERVE_PLACEHOLDER 0x00040000
+
+#define SEC_HUGE_PAGES 0x00020000  
+#define SEC_PARTITION_OWNER_HANDLE 0x00040000 
+#define SEC_64K_PAGES 0x00080000
 #define SEC_BASED 0x00200000
 #define SEC_NO_CHANGE 0x00400000
 #define SEC_FILE 0x00800000
@@ -84,6 +99,8 @@ typedef enum _MEMORY_INFORMATION_CLASS
    MemoryEnclaveImageInformation, // MEMORY_ENCLAVE_IMAGE_INFORMATION // since REDSTONE3
    MemoryBasicInformationCapped, // 10
    MemoryPhysicalContiguityInformation, // MEMORY_PHYSICAL_CONTIGUITY_INFORMATION // since 20H1
+    MemoryBadInformation, // since WIN11
+    MemoryBadInformationAllProcesses, // since 22H1
    MaxMemoryInfoClass
 } MEMORY_INFORMATION_CLASS;
 #else
@@ -99,6 +116,8 @@ typedef enum _MEMORY_INFORMATION_CLASS
 #define MemoryEnclaveImageInformation 0x9
 #define MemoryBasicInformationCapped 0xA
 #define MemoryPhysicalContiguityInformation 0xB
+#define MemoryBadInformation 0xC
+#define MemoryBadInformationAllProcesses 0xD
 #endif

 typedef struct _MEMORY_WORKING_SET_BLOCK
@@ -139,7 +158,11 @@ typedef struct _MEMORY_REGION_INFORMATION
            ULONG SoftwareEnclave : 1; // REDSTONE3
            ULONG PageSize64K : 1;
            ULONG PlaceholderReservation : 1; // REDSTONE4
-            ULONG Reserved : 23;
+            ULONG MappedAwe : 1; // 21H1
+            ULONG MappedWriteWatch : 1;
+            ULONG PageSizeLarge : 1;
+            ULONG PageSizeHuge : 1;
+            ULONG Reserved : 19;
        };
    };
    SIZE_T RegionSize;
@@ -258,12 +281,12 @@ typedef struct _MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION
 {
    union
    {
-        ULONG AllInformation;
        struct
        {
            ULONG State : 2;
            ULONG Reserved : 30;
        };
+        ULONG AllInformation;
    };
 } MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION, *PMEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION;

@@ -335,8 +358,9 @@ typedef struct _MEMORY_FRAME_INFORMATION
    ULONGLONG Cold : 1; // 19H1
    ULONGLONG Pinned : 1; // 1 - pinned, 0 - not pinned
    ULONGLONG DontUse : 48; // *_INFORMATION overlay
-    ULONGLONG Priority : 3; // rev
-    ULONGLONG Reserved : 4; // reserved for future expansion
+    ULONGLONG Priority : 3;
+    ULONGLONG NonTradeable : 1;
+    ULONGLONG Reserved : 3;
 } MEMORY_FRAME_INFORMATION;

 // private
@@ -344,7 +368,7 @@ typedef struct _FILEOFFSET_INFORMATION
 {
    ULONGLONG DontUse : 9; // MEMORY_FRAME_INFORMATION overlay
    ULONGLONG Offset : 48; // mapped files
-    ULONGLONG Reserved : 7; // reserved for future expansion
+    ULONGLONG Reserved : 7;
 } FILEOFFSET_INFORMATION;

 // private
@@ -352,7 +376,7 @@ typedef struct _PAGEDIR_INFORMATION
 {
    ULONGLONG DontUse : 9; // MEMORY_FRAME_INFORMATION overlay
    ULONGLONG PageDirectoryBase : 48; // private pages
-    ULONGLONG Reserved : 7; // reserved for future expansion
+    ULONGLONG Reserved : 7;
 } PAGEDIR_INFORMATION;

 // private
@@ -360,7 +384,7 @@ typedef struct _UNIQUE_PROCESS_INFORMATION
 {
    ULONGLONG DontUse : 9; // MEMORY_FRAME_INFORMATION overlay
    ULONGLONG UniqueProcessKey : 48; // ProcessId
-    ULONGLONG Reserved  : 7; // reserved for future expansion
+    ULONGLONG Reserved  : 7;
 } UNIQUE_PROCESS_INFORMATION, *PUNIQUE_PROCESS_INFORMATION;

 // private
@@ -402,7 +426,7 @@ typedef enum _SECTION_INFORMATION_CLASS
 {
    SectionBasicInformation, // q; SECTION_BASIC_INFORMATION
    SectionImageInformation, // q; SECTION_IMAGE_INFORMATION
-    SectionRelocationInformation, // name:wow64:whNtQuerySection_SectionRelocationInformation
+    SectionRelocationInformation, // q; PVOID RelocationAddress // name:wow64:whNtQuerySection_SectionRelocationInformation
    SectionOriginalBaseInformation, // PVOID BaseAddress
    SectionInternalImageInformation, // SECTION_INTERNAL_IMAGE_INFORMATION // since REDSTONE2
    MaxSectionInfoClass
@@ -494,8 +518,8 @@ typedef enum _SECTION_INHERIT
 } SECTION_INHERIT;
 #endif

-#define MEM_EXECUTE_OPTION_DISABLE 0x1
-#define MEM_EXECUTE_OPTION_ENABLE 0x2
+#define MEM_EXECUTE_OPTION_ENABLE 0x1
+#define MEM_EXECUTE_OPTION_DISABLE 0x2
 #define MEM_EXECUTE_OPTION_DISABLE_THUNK_EMULATION 0x4
 #define MEM_EXECUTE_OPTION_PERMANENT 0x8
 #define MEM_EXECUTE_OPTION_EXECUTE_DISPATCH_ENABLE 0x10
@@ -554,6 +578,21 @@ NtReadVirtualMemory(
    _Out_opt_ PSIZE_T NumberOfBytesRead
    );

+#if (PHNT_VERSION >= PHNT_WIN11)
+// rev
+NTSYSAPI
+NTSTATUS
+NTAPI
+NtReadVirtualMemoryEx(
+    _In_ HANDLE ProcessHandle,
+    _In_opt_ PVOID BaseAddress,
+    _Out_writes_bytes_(BufferSize) PVOID Buffer,
+    _In_ SIZE_T BufferSize,
+    _Out_opt_ PSIZE_T NumberOfBytesRead,
+    _In_ ULONG Flags
+    );
+#endif
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -605,12 +644,13 @@ NtFlushVirtualMemory(
 typedef enum _VIRTUAL_MEMORY_INFORMATION_CLASS
 {
    VmPrefetchInformation, // ULONG
-    VmPagePriorityInformation,
+    VmPagePriorityInformation, // OFFER_PRIORITY
    VmCfgCallTargetInformation, // CFG_CALL_TARGET_LIST_INFORMATION // REDSTONE2
    VmPageDirtyStateInformation, // REDSTONE3
    VmImageHotPatchInformation, // 19H1
    VmPhysicalContiguityInformation, // 20H1
    VmVirtualMachinePrepopulateInformation,
+    VmRemoveFromWorkingSetInformation,
    MaxVmInfoClass
 } VIRTUAL_MEMORY_INFORMATION_CLASS;

@@ -634,7 +674,7 @@ typedef struct _CFG_CALL_TARGET_LIST_INFORMATION

 #if (PHNT_MODE != PHNT_MODE_KERNEL)

-#if (PHNT_VERSION >= PHNT_THRESHOLD)
+#if (PHNT_VERSION >= PHNT_WIN8)

 NTSYSCALLAPI
 NTSTATUS
@@ -809,8 +849,9 @@ NtAreMappedFilesTheSame(
     MEMORY_PARTITION_QUERY_ACCESS | MEMORY_PARTITION_MODIFY_ACCESS)
 #endif

+#if (PHNT_MODE != PHNT_MODE_KERNEL)
 // private
-typedef enum _MEMORY_PARTITION_INFORMATION_CLASS
+typedef enum _PARTITION_INFORMATION_CLASS
 {
    SystemMemoryPartitionInformation, // q: MEMORY_PARTITION_CONFIGURATION_INFORMATION
    SystemMemoryPartitionMoveMemory, // s: MEMORY_PARTITION_TRANSFER_INFORMATION
@@ -818,8 +859,33 @@ typedef enum _MEMORY_PARTITION_INFORMATION_CLASS
    SystemMemoryPartitionCombineMemory, // q; s: MEMORY_PARTITION_PAGE_COMBINE_INFORMATION
    SystemMemoryPartitionInitialAddMemory, // q; s: MEMORY_PARTITION_INITIAL_ADD_INFORMATION
    SystemMemoryPartitionGetMemoryEvents, // MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION // since REDSTONE2
+    SystemMemoryPartitionSetAttributes,
+    SystemMemoryPartitionNodeInformation,
+    SystemMemoryPartitionCreateLargePages,
+    SystemMemoryPartitionDedicatedMemoryInformation,
+    SystemMemoryPartitionOpenDedicatedMemory, // 10
+    SystemMemoryPartitionMemoryChargeAttributes,
+    SystemMemoryPartitionClearAttributes,
+    SystemMemoryPartitionSetMemoryThresholds, // since WIN11
    SystemMemoryPartitionMax
-} MEMORY_PARTITION_INFORMATION_CLASS;
+} PARTITION_INFORMATION_CLASS, *PPARTITION_INFORMATION_CLASS;
+#else
+#define SystemMemoryPartitionInformation 0x0
+#define SystemMemoryPartitionMoveMemory 0x1
+#define SystemMemoryPartitionAddPagefile 0x2
+#define SystemMemoryPartitionCombineMemory 0x3
+#define SystemMemoryPartitionInitialAddMemory 0x4
+#define SystemMemoryPartitionGetMemoryEvents 0x5
+#define SystemMemoryPartitionSetAttributes 0x6
+#define SystemMemoryPartitionNodeInformation 0x7
+#define SystemMemoryPartitionCreateLargePages 0x8
+#define SystemMemoryPartitionDedicatedMemoryInformation 0x9
+#define SystemMemoryPartitionOpenDedicatedMemory 0xA
+#define SystemMemoryPartitionMemoryChargeAttributes 0xB
+#define SystemMemoryPartitionClearAttributes 0xC
+#define SystemMemoryPartitionSetMemoryThresholds 0xD
+#define SystemMemoryPartitionMax 0xE
+#endif

 // private
 typedef struct _MEMORY_PARTITION_CONFIGURATION_INFORMATION
@@ -840,7 +906,7 @@ typedef struct _MEMORY_PARTITION_CONFIGURATION_INFORMATION
    ULONG_PTR StandbyPageCountByPriority[8]; // since REDSTONE2
    ULONG_PTR RepurposedPagesByPriority[8];
    ULONG_PTR MaximumCommitLimit;
-    ULONG_PTR DonatedPagesToPartitions;
+    ULONG_PTR Reserved; // DonatedPagesToPartitions
    ULONG PartitionId; // since REDSTONE3
 } MEMORY_PARTITION_CONFIGURATION_INFORMATION, *PMEMORY_PARTITION_CONFIGURATION_INFORMATION;

@@ -913,6 +979,7 @@ NTSYSCALLAPI
 NTSTATUS
 NTAPI
 NtCreatePartition(
+    _In_ HANDLE ParentPartitionHandle,
    _Out_ PHANDLE PartitionHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
@@ -932,8 +999,10 @@ NTSYSCALLAPI
 NTSTATUS
 NTAPI
 NtManagePartition(
-    _In_ MEMORY_PARTITION_INFORMATION_CLASS PartitionInformationClass,
-    _In_ PVOID PartitionInformation,
+    _In_ HANDLE TargetHandle,
+    _In_opt_ HANDLE SourceHandle,
+    _In_ PARTITION_INFORMATION_CLASS PartitionInformationClass,
+    _Inout_updates_bytes_(PartitionInformationLength) PVOID PartitionInformation,
    _In_ ULONG PartitionInformationLength
    );

@@ -27,7 +27,9 @@

 #if (PHNT_MODE != PHNT_MODE_KERNEL)
 #define SYMBOLIC_LINK_QUERY 0x0001
+#define SYMBOLIC_LINK_SET 0x0002
 #define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
+#define SYMBOLIC_LINK_ALL_ACCESS_EX (STANDARD_RIGHTS_REQUIRED | 0xFFFF)
 #endif

 #ifndef OBJ_PROTECT_CLOSE
@@ -48,8 +50,8 @@ typedef enum _OBJECT_INFORMATION_CLASS
    ObjectTypeInformation, // q: OBJECT_TYPE_INFORMATION
    ObjectTypesInformation, // q: OBJECT_TYPES_INFORMATION
    ObjectHandleFlagInformation, // qs: OBJECT_HANDLE_FLAG_INFORMATION
-    ObjectSessionInformation,
-    ObjectSessionObjectInformation,
+    ObjectSessionInformation, // s: void // change object session // (requires SeTcbPrivilege)
+    ObjectSessionObjectInformation, // s: void // change object session // (requires SeTcbPrivilege)
    MaxObjectInfoClass
 } OBJECT_INFORMATION_CLASS;
 #else
@@ -321,14 +323,50 @@ NtQueryDirectoryObject(

 #if (PHNT_VERSION >= PHNT_VISTA)

+// private
+typedef enum _BOUNDARY_ENTRY_TYPE
+{
+    OBNS_Invalid,
+    OBNS_Name,
+    OBNS_SID,
+    OBNS_IL
+} BOUNDARY_ENTRY_TYPE;
+
+// private
+typedef struct _OBJECT_BOUNDARY_ENTRY
+{
+    BOUNDARY_ENTRY_TYPE EntryType;
+    ULONG EntrySize;
+} OBJECT_BOUNDARY_ENTRY, *POBJECT_BOUNDARY_ENTRY;
+
+// rev
+#define OBJECT_BOUNDARY_DESCRIPTOR_VERSION 1
+
+// private
+typedef struct _OBJECT_BOUNDARY_DESCRIPTOR
+{
+    ULONG Version;
+    ULONG Items;
+    ULONG TotalSize;
+    union
+    {
+        ULONG Flags;
+        struct
+        {
+            ULONG AddAppContainerSid : 1;
+            ULONG Reserved : 31;
+        };
+    };
+} OBJECT_BOUNDARY_DESCRIPTOR, *POBJECT_BOUNDARY_DESCRIPTOR;
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
 NtCreatePrivateNamespace(
    _Out_ PHANDLE NamespaceHandle,
    _In_ ACCESS_MASK DesiredAccess,
-    _In_ POBJECT_ATTRIBUTES ObjectAttributes,
-    _In_ PVOID BoundaryDescriptor
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_ POBJECT_BOUNDARY_DESCRIPTOR BoundaryDescriptor
    );

 NTSYSCALLAPI
@@ -338,7 +376,7 @@ NtOpenPrivateNamespace(
    _Out_ PHANDLE NamespaceHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
-    _In_ PVOID BoundaryDescriptor
+    _In_ POBJECT_BOUNDARY_DESCRIPTOR BoundaryDescriptor
    );

 NTSYSCALLAPI
@@ -391,6 +429,7 @@ typedef enum _SYMBOLIC_LINK_INFO_CLASS
    MaxnSymbolicLinkInfoClass
 } SYMBOLIC_LINK_INFO_CLASS;

+#if (PHNT_VERSION >= PHNT_THRESHOLD)
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -400,6 +439,7 @@ NtSetInformationSymbolicLink(
    _In_reads_bytes_(SymbolicLinkInformationLength) PVOID SymbolicLinkInformation,
    _In_ ULONG SymbolicLinkInformationLength
    );
+#endif

 #endif

@@ -194,7 +194,14 @@ typedef struct _PEB

    PVOID WerRegistrationData;
    PVOID WerShipAssertPtr;
-    PVOID pUnused; // pContextData
+
+    union
+    {
+        PVOID pContextData; // WIN7
+        PVOID pUnused; // WIN10
+        PVOID EcCodeBitMap; // WIN11
+    };
+
    PVOID pImageHeaderHash;
    union
    {
@@ -421,7 +428,7 @@ typedef struct _TEB
            USHORT LoadOwner : 1;
            USHORT LoaderWorker : 1;
            USHORT SkipLoaderInit : 1;
-            USHORT SpareSameTebBits : 1;
+            USHORT SkipFileAPIBrokering : 1;
        };
    };

@@ -434,6 +441,9 @@ typedef struct _TEB
    PVOID ReservedForWdf;
    ULONGLONG ReservedForCrt;
    GUID EffectiveContainerId;
+    ULONGLONG LastSleepCounter; // Win11
+    ULONG SpinCallCount;
+    ULONGLONG ExtendedFeatureDisableMask;
 } TEB, *PTEB;

 #endif
@@ -68,8 +68,12 @@ typedef enum _PREFETCHER_INFORMATION_CLASS
    PrefetcherRetrieveTrace = 1, // q: CHAR[]
    PrefetcherSystemParameters, // q: PF_SYSTEM_PREFETCH_PARAMETERS
    PrefetcherBootPhase, // s: PF_BOOT_PHASE_ID
-    PrefetcherRetrieveBootLoaderTrace, // q: CHAR[]
-    PrefetcherBootControl // s: PF_BOOT_CONTROL
+    PrefetcherSpare1, // PrefetcherRetrieveBootLoaderTrace // q: CHAR[]
+    PrefetcherBootControl, // s: PF_BOOT_CONTROL
+    PrefetcherScenarioPolicyControl,
+    PrefetcherSpare2,
+    PrefetcherAppLaunchScenarioControl,
+    PrefetcherInformationMax
 } PREFETCHER_INFORMATION_CLASS;

 #define PREFETCHER_INFORMATION_VERSION 23 // rev
@@ -77,11 +81,11 @@ typedef enum _PREFETCHER_INFORMATION_CLASS

 typedef struct _PREFETCHER_INFORMATION
 {
-    ULONG Version;
-    ULONG Magic;
-    PREFETCHER_INFORMATION_CLASS PrefetcherInformationClass;
-    PVOID PrefetcherInformation;
-    ULONG PrefetcherInformationLength;
+    _In_ ULONG Version;
+    _In_ ULONG Magic;
+    _In_ PREFETCHER_INFORMATION_CLASS PrefetcherInformationClass;
+    _Inout_ PVOID PrefetcherInformation;
+    _Inout_ ULONG PrefetcherInformationLength;
 } PREFETCHER_INFORMATION, *PPREFETCHER_INFORMATION;

 // Superfetch
@@ -94,6 +98,7 @@ typedef struct _PF_SYSTEM_SUPERFETCH_PARAMETERS
    ULONG SavedPageAccessTracesMax;
    ULONG ScenarioPrefetchTimeoutStandby;
    ULONG ScenarioPrefetchTimeoutHibernate;
+    ULONG ScenarioPrefetchTimeoutHiberBoot;
 } PF_SYSTEM_SUPERFETCH_PARAMETERS, *PPF_SYSTEM_SUPERFETCH_PARAMETERS;

 #define PF_PFN_PRIO_REQUEST_VERSION 1
@@ -262,6 +267,14 @@ typedef enum _SUPERFETCH_INFORMATION_CLASS
    SuperfetchTracingControl,
    SuperfetchTrimWhileAgingControl,
    SuperfetchRepurposedByPrefetch, // q: PF_REPURPOSED_BY_PREFETCH_INFO // rev
+    SuperfetchChannelPowerRequest,
+    SuperfetchMovePages,
+    SuperfetchVirtualQuery,
+    SuperfetchCombineStatsQuery,
+    SuperfetchSetMinWsAgeRate,
+    SuperfetchDeprioritizeOldPagesInWs,
+    SuperfetchFileExtentsQuery,
+    SuperfetchGpuUtilizationQuery, // PF_GPU_UTILIZATION_INFO
    SuperfetchInformationMax
 } SUPERFETCH_INFORMATION_CLASS;

@@ -272,9 +285,9 @@ typedef struct _SUPERFETCH_INFORMATION
 {
    _In_ ULONG Version;
    _In_ ULONG Magic;
-    _In_ SUPERFETCH_INFORMATION_CLASS InfoClass;
-    _Inout_ PVOID Data;
-    _Inout_ ULONG Length;
+    _In_ SUPERFETCH_INFORMATION_CLASS SuperfetchInformationClass;
+    _Inout_ PVOID SuperfetchInformation;
+    _Inout_ ULONG SuperfetchInformationLength;
 } SUPERFETCH_INFORMATION, *PSUPERFETCH_INFORMATION;

 // end_private
@@ -12,6 +12,175 @@
 #ifndef _NTPOAPI_H
 #define _NTPOAPI_H

+#if (PHNT_MODE != PHNT_MODE_KERNEL)
+// POWER_INFORMATION_LEVEL
+// Note: We don't use an enum for these values to minimize conflicts with the Windows SDK. (dmex)
+#define SystemPowerPolicyAc 0 // SYSTEM_POWER_POLICY // GET: InputBuffer NULL. SET: InputBuffer not NULL.
+#define SystemPowerPolicyDc 1 // SYSTEM_POWER_POLICY
+#define VerifySystemPolicyAc 2 // SYSTEM_POWER_POLICY
+#define VerifySystemPolicyDc 3 // SYSTEM_POWER_POLICY
+#define SystemPowerCapabilities 4 // SYSTEM_POWER_CAPABILITIES
+#define SystemBatteryState 5 // SYSTEM_BATTERY_STATE
+#define SystemPowerStateHandler 6 // POWER_STATE_HANDLER // (kernel-mode only)
+#define ProcessorStateHandler 7 // PROCESSOR_STATE_HANDLER // (kernel-mode only)
+#define SystemPowerPolicyCurrent 8 // SYSTEM_POWER_POLICY
+#define AdministratorPowerPolicy 9 // ADMINISTRATOR_POWER_POLICY
+#define SystemReserveHiberFile 10 // BOOLEAN // (requires SeCreatePagefilePrivilege) // TRUE: hibernation file created. FALSE: hibernation file deleted.
+#define ProcessorInformation 11 // PROCESSOR_POWER_INFORMATION
+#define SystemPowerInformation 12 // SYSTEM_POWER_INFORMATION
+#define ProcessorStateHandler2 13 // PROCESSOR_STATE_HANDLER2 // not implemented
+#define LastWakeTime 14 // ULONGLONG // InterruptTime
+#define LastSleepTime 15 // ULONGLONG // InterruptTime
+#define SystemExecutionState 16 // EXECUTION_STATE // NtSetThreadExecutionState
+#define SystemPowerStateNotifyHandler 17 // POWER_STATE_NOTIFY_HANDLER // (kernel-mode only)
+#define ProcessorPowerPolicyAc 18 // PROCESSOR_POWER_POLICY // not implemented
+#define ProcessorPowerPolicyDc 19 // PROCESSOR_POWER_POLICY // not implemented
+#define VerifyProcessorPowerPolicyAc 20 // PROCESSOR_POWER_POLICY // not implemented
+#define VerifyProcessorPowerPolicyDc 21 // PROCESSOR_POWER_POLICY // not implemented
+#define ProcessorPowerPolicyCurrent 22 // PROCESSOR_POWER_POLICY // not implemented
+#define SystemPowerStateLogging 23 // SYSTEM_POWER_STATE_DISABLE_REASON[]
+#define SystemPowerLoggingEntry 24 // SYSTEM_POWER_LOGGING_ENTRY[] // (kernel-mode only)
+#define SetPowerSettingValue 25 // (kernel-mode only)
+#define NotifyUserPowerSetting 26 // not implemented
+#define PowerInformationLevelUnused0 27 // not implemented
+#define SystemMonitorHiberBootPowerOff 28 // NULL (PowerMonitorOff)
+#define SystemVideoState 29 // MONITOR_DISPLAY_STATE
+#define TraceApplicationPowerMessage 30 // (kernel-mode only)
+#define TraceApplicationPowerMessageEnd 31 // (kernel-mode only)
+#define ProcessorPerfStates 32 // (kernel-mode only)
+#define ProcessorIdleStates 33 // (kernel-mode only)
+#define ProcessorCap 34 // (kernel-mode only)
+#define SystemWakeSource 35
+#define SystemHiberFileInformation 36 // q: SYSTEM_HIBERFILE_INFORMATION
+#define TraceServicePowerMessage 37
+#define ProcessorLoad 38
+#define PowerShutdownNotification 39 // (kernel-mode only)
+#define MonitorCapabilities 40 // (kernel-mode only)
+#define SessionPowerInit 41 // (kernel-mode only)
+#define SessionDisplayState 42 // (kernel-mode only)
+#define PowerRequestCreate 43 // in: COUNTED_REASON_CONTEXT, out: HANDLE
+#define PowerRequestAction 44 // in: POWER_REQUEST_ACTION
+#define GetPowerRequestList 45 // out: POWER_REQUEST_LIST
+#define ProcessorInformationEx 46 // in: USHORT ProcessorGroup, out: PROCESSOR_POWER_INFORMATION
+#define NotifyUserModeLegacyPowerEvent 47 // (kernel-mode only)
+#define GroupPark 48 // (debug-mode boot only) 
+#define ProcessorIdleDomains 49 // (kernel-mode only)
+#define WakeTimerList 50 // powercfg.exe /waketimers
+#define SystemHiberFileSize 51 // ULONG
+#define ProcessorIdleStatesHv 52 // (kernel-mode only)
+#define ProcessorPerfStatesHv 53 // (kernel-mode only)
+#define ProcessorPerfCapHv 54 // (kernel-mode only)
+#define ProcessorSetIdle 55 // (debug-mode boot only) 
+#define LogicalProcessorIdling 56 // (kernel-mode only)
+#define UserPresence 57 // POWER_USER_PRESENCE // not implemented
+#define PowerSettingNotificationName 58
+#define GetPowerSettingValue 59 // GUID
+#define IdleResiliency 60 // POWER_IDLE_RESILIENCY
+#define SessionRITState 61 // POWER_SESSION_RIT_STATE
+#define SessionConnectNotification 62 // POWER_SESSION_WINLOGON
+#define SessionPowerCleanup 63
+#define SessionLockState 64 // POWER_SESSION_WINLOGON
+#define SystemHiberbootState 65 // BOOLEAN // fast startup supported
+#define PlatformInformation 66 // BOOLEAN // connected standby supported
+#define PdcInvocation 67 // (kernel-mode only)
+#define MonitorInvocation 68 // (kernel-mode only)
+#define FirmwareTableInformationRegistered 69 // (kernel-mode only)
+#define SetShutdownSelectedTime 70 // NULL
+#define SuspendResumeInvocation 71 // (kernel-mode only)
+#define PlmPowerRequestCreate 72 // in: COUNTED_REASON_CONTEXT, out: HANDLE
+#define ScreenOff 73 // NULL (PowerMonitorOff)
+#define CsDeviceNotification 74 // (kernel-mode only)
+#define PlatformRole 75 // POWER_PLATFORM_ROLE
+#define LastResumePerformance 76 // RESUME_PERFORMANCE
+#define DisplayBurst 77 // NULL (PowerMonitorOn)
+#define ExitLatencySamplingPercentage 78
+#define RegisterSpmPowerSettings 79 // (kernel-mode only)
+#define PlatformIdleStates 80 // (kernel-mode only)
+#define ProcessorIdleVeto 81 // (kernel-mode only) // deprecated
+#define PlatformIdleVeto 82 // (kernel-mode only) // deprecated
+#define SystemBatteryStatePrecise 83 // SYSTEM_BATTERY_STATE
+#define ThermalEvent 84  // THERMAL_EVENT // PowerReportThermalEvent
+#define PowerRequestActionInternal 85 // POWER_REQUEST_ACTION_INTERNAL
+#define BatteryDeviceState 86
+#define PowerInformationInternal 87 // POWER_INFORMATION_LEVEL_INTERNAL // PopPowerInformationInternal
+#define ThermalStandby 88 // NULL // shutdown with thermal standby as reason.
+#define SystemHiberFileType 89 // ULONG // zero ? reduced : full // powercfg.exe /h /type 
+#define PhysicalPowerButtonPress 90 // BOOLEAN
+#define QueryPotentialDripsConstraint 91 // (kernel-mode only)
+#define EnergyTrackerCreate 92
+#define EnergyTrackerQuery 93
+#define UpdateBlackBoxRecorder 94
+#define SessionAllowExternalDmaDevices 95
+#define SendSuspendResumeNotification 96 // since WIN11
+#define PowerInformationLevelMaximum 97
+#endif
+
+typedef struct _PROCESSOR_POWER_INFORMATION
+{
+    ULONG Number;
+    ULONG MaxMhz;
+    ULONG CurrentMhz;
+    ULONG MhzLimit;
+    ULONG MaxIdleState;
+    ULONG CurrentIdleState;
+} PROCESSOR_POWER_INFORMATION, *PPROCESSOR_POWER_INFORMATION;
+
+typedef struct _SYSTEM_POWER_INFORMATION
+{
+    ULONG MaxIdlenessAllowed;
+    ULONG Idleness;
+    ULONG TimeRemaining;
+    UCHAR CoolingMode;
+} SYSTEM_POWER_INFORMATION, *PSYSTEM_POWER_INFORMATION;
+
+typedef struct _SYSTEM_HIBERFILE_INFORMATION
+{
+    ULONG NumberOfMcbPairs;
+    LARGE_INTEGER Mcb[1];
+} SYSTEM_HIBERFILE_INFORMATION, *PSYSTEM_HIBERFILE_INFORMATION;
+
+#define POWER_REQUEST_CONTEXT_NOT_SPECIFIED DIAGNOSTIC_REASON_NOT_SPECIFIED
+
+// wdm
+typedef struct _COUNTED_REASON_CONTEXT
+{
+    ULONG Version;
+    ULONG Flags;
+    union
+    {
+        struct
+        {
+            UNICODE_STRING ResourceFileName;
+            USHORT ResourceReasonId;
+            ULONG StringCount;
+            _Field_size_(StringCount) PUNICODE_STRING ReasonStrings;
+        };
+        UNICODE_STRING SimpleString;
+    };
+} COUNTED_REASON_CONTEXT, *PCOUNTED_REASON_CONTEXT;
+
+typedef enum _POWER_REQUEST_TYPE_INTERNAL // POWER_REQUEST_TYPE
+{
+    PowerRequestDisplayRequiredInternal,
+    PowerRequestSystemRequiredInternal,
+    PowerRequestAwayModeRequiredInternal,
+    PowerRequestExecutionRequiredInternal, // Windows 8+
+    PowerRequestPerfBoostRequiredInternal, // Windows 8+
+    PowerRequestActiveLockScreenInternal, // Windows 10 RS1+ (reserved on Windows 8)
+    // Values 6 and 7 are reserved for Windows 8 only
+    PowerRequestInternalInvalid,
+    PowerRequestInternalUnknown,
+    PowerRequestFullScreenVideoRequired  // Windows 8 only
+} POWER_REQUEST_TYPE_INTERNAL;
+
+typedef struct _POWER_REQUEST_ACTION
+{
+    HANDLE PowerRequestHandle;
+    POWER_REQUEST_TYPE_INTERNAL RequestType;
+    BOOLEAN SetAction;
+    HANDLE ProcessHandle; // Windows 8+ and only for requests created via PlmPowerRequestCreate
+} POWER_REQUEST_ACTION, *PPOWER_REQUEST_ACTION;
+
 typedef union _POWER_STATE
 {
    SYSTEM_POWER_STATE SystemState;
@@ -24,7 +193,6 @@ typedef enum _POWER_STATE_TYPE
    DevicePowerState
 } POWER_STATE_TYPE, *PPOWER_STATE_TYPE;

-#if (PHNT_VERSION >= PHNT_VISTA)
 // wdm
 typedef struct _SYSTEM_POWER_STATE_CONTEXT
 {
@@ -43,31 +211,99 @@ typedef struct _SYSTEM_POWER_STATE_CONTEXT
        ULONG ContextAsUlong;
    };
 } SYSTEM_POWER_STATE_CONTEXT, *PSYSTEM_POWER_STATE_CONTEXT;
-#endif

-#if (PHNT_VERSION >= PHNT_WIN7)
-#define  POWER_REQUEST_CONTEXT_NOT_SPECIFIED DIAGNOSTIC_REASON_NOT_SPECIFIED
-
-/** \cond NEVER */ // disable doxygen warning
-// wdm
-typedef struct _COUNTED_REASON_CONTEXT
+typedef enum _REQUESTER_TYPE
+{
+    KernelRequester = 0,
+    UserProcessRequester = 1,
+    UserSharedServiceRequester = 2
+} REQUESTER_TYPE;
+
+typedef struct _COUNTED_REASON_CONTEXT_RELATIVE
 {
-    ULONG Version;
    ULONG Flags;
    union
    {
        struct
        {
-            UNICODE_STRING ResourceFileName;
+            ULONG_PTR ResourceFileNameOffset;
            USHORT ResourceReasonId;
            ULONG StringCount;
-            PUNICODE_STRING _Field_size_(StringCount) ReasonStrings;
+            ULONG_PTR SubstitutionStringsOffset;
        };
-        UNICODE_STRING SimpleString;
+        ULONG_PTR SimpleStringOffset;
    };
-} COUNTED_REASON_CONTEXT, *PCOUNTED_REASON_CONTEXT;
-/** \endcond */
+} COUNTED_REASON_CONTEXT_RELATIVE, *PCOUNTED_REASON_CONTEXT_RELATIVE;
+
+typedef struct _DIAGNOSTIC_BUFFER
+{
+    SIZE_T Size;
+    REQUESTER_TYPE CallerType;
+    union
+    {
+        struct
+        {
+            ULONG_PTR ProcessImageNameOffset; // PWSTR
+            ULONG ProcessId;
+            ULONG ServiceTag;
+        };
+        struct
+        {
+            ULONG_PTR DeviceDescriptionOffset; // PWSTR
+            ULONG_PTR DevicePathOffset; // PWSTR
+        };
+    };    
+    ULONG_PTR ReasonOffset; // PCOUNTED_REASON_CONTEXT_RELATIVE
+} DIAGNOSTIC_BUFFER, *PDIAGNOSTIC_BUFFER;
+
+// The number of supported request types per version
+#define POWER_REQUEST_SUPPORTED_TYPES_V1 3 // Windows 7
+#define POWER_REQUEST_SUPPORTED_TYPES_V2 9 // Windows 8
+#define POWER_REQUEST_SUPPORTED_TYPES_V3 5 // Windows 8.1 and Windows 10 TH1-TH2
+#define POWER_REQUEST_SUPPORTED_TYPES_V4 6 // Windows 10 RS1+
+
+typedef struct _POWER_REQUEST
+{
+    union
+    {
+        struct
+        {
+            ULONG SupportedRequestMask;
+            ULONG PowerRequestCount[POWER_REQUEST_SUPPORTED_TYPES_V1];
+            DIAGNOSTIC_BUFFER DiagnosticBuffer;
+        } V1;
+#if (PHNT_VERSION >= PHNT_WIN8)
+        struct
+        {
+            ULONG SupportedRequestMask;
+            ULONG PowerRequestCount[POWER_REQUEST_SUPPORTED_TYPES_V2];
+            DIAGNOSTIC_BUFFER DiagnosticBuffer;
+        } V2;
 #endif
+#if (PHNT_VERSION >= PHNT_WINBLUE)
+        struct
+        {
+            ULONG SupportedRequestMask;
+            ULONG PowerRequestCount[POWER_REQUEST_SUPPORTED_TYPES_V3];
+            DIAGNOSTIC_BUFFER DiagnosticBuffer;
+        } V3;
+#endif
+#if (PHNT_VERSION >= PHNT_REDSTONE)
+        struct
+        {
+            ULONG SupportedRequestMask;
+            ULONG PowerRequestCount[POWER_REQUEST_SUPPORTED_TYPES_V4];
+            DIAGNOSTIC_BUFFER DiagnosticBuffer;
+        } V4;
+#endif
+    };
+} POWER_REQUEST, *PPOWER_REQUEST;
+
+typedef struct _POWER_REQUEST_LIST
+{
+    ULONG_PTR Count;
+    ULONG_PTR PowerRequestOffsets[ANYSIZE_ARRAY]; // PPOWER_REQUEST
+} POWER_REQUEST_LIST, *PPOWER_REQUEST_LIST;

 typedef enum _POWER_STATE_HANDLER_TYPE
 {
@@ -114,235 +350,185 @@ typedef struct _POWER_STATE_NOTIFY_HANDLER
    PVOID Context;
 } POWER_STATE_NOTIFY_HANDLER, *PPOWER_STATE_NOTIFY_HANDLER;

-#if (PHNT_MODE != PHNT_MODE_KERNEL)
-// POWER_INFORMATION_LEVEL
-// Note: We don't use an enum for these values to minimize conflicts with the Windows SDK. (dmex)
-#define SystemPowerPolicyAc 0 // SYSTEM_POWER_POLICY // GET: InputBuffer NULL. SET: InputBuffer not NULL.
-#define SystemPowerPolicyDc 1 // SYSTEM_POWER_POLICY
-#define VerifySystemPolicyAc 2 // SYSTEM_POWER_POLICY
-#define VerifySystemPolicyDc 3 // SYSTEM_POWER_POLICY
-#define SystemPowerCapabilities 4 // SYSTEM_POWER_CAPABILITIES
-#define SystemBatteryState 5 // SYSTEM_BATTERY_STATE
-#define SystemPowerStateHandler 6 // (kernel-mode only)
-#define ProcessorStateHandler 7 // (kernel-mode only)
-#define SystemPowerPolicyCurrent 8 // SYSTEM_POWER_POLICY
-#define AdministratorPowerPolicy 9 // ADMINISTRATOR_POWER_POLICY
-#define SystemReserveHiberFile 10 // BOOLEAN // (requires SeCreatePagefilePrivilege) // TRUE: hibernation file created. FALSE: hibernation file deleted.
-#define ProcessorInformation 11 // PROCESSOR_POWER_INFORMATION
-#define SystemPowerInformation 12 // SYSTEM_POWER_INFORMATION
-#define ProcessorStateHandler2 13 // not implemented
-#define LastWakeTime 14 // ULONGLONG
-#define LastSleepTime 15 // ULONGLONG
-#define SystemExecutionState 16 // EXECUTION_STATE // NtSetThreadExecutionState
-#define SystemPowerStateNotifyHandler 17 // (kernel-mode only)
-#define ProcessorPowerPolicyAc 18 // not implemented
-#define ProcessorPowerPolicyDc 19 // not implemented
-#define VerifyProcessorPowerPolicyAc 20 // not implemented
-#define VerifyProcessorPowerPolicyDc 21 // not implemented
-#define ProcessorPowerPolicyCurrent 22 // not implemented
-#define SystemPowerStateLogging 23
-#define SystemPowerLoggingEntry 24 // (kernel-mode only)
-#define SetPowerSettingValue 25 // (kernel-mode only)
-#define NotifyUserPowerSetting 26 // not implemented
-#define PowerInformationLevelUnused0 27 // not implemented
-#define SystemMonitorHiberBootPowerOff 28 // NULL (PowerMonitorOff)
-#define SystemVideoState 29 // MONITOR_DISPLAY_STATE
-#define TraceApplicationPowerMessage 30 // (kernel-mode only)
-#define TraceApplicationPowerMessageEnd 31 // (kernel-mode only)
-#define ProcessorPerfStates 32 // (kernel-mode only)
-#define ProcessorIdleStates 33 // (kernel-mode only)
-#define ProcessorCap 34 // (kernel-mode only)
-#define SystemWakeSource 35
-#define SystemHiberFileInformation 36
-#define TraceServicePowerMessage 37
-#define ProcessorLoad 38
-#define PowerShutdownNotification 39 // (kernel-mode only)
-#define MonitorCapabilities 40 // (kernel-mode only)
-#define SessionPowerInit 41 // (kernel-mode only)
-#define SessionDisplayState 42 // (kernel-mode only)
-#define PowerRequestCreate 43 // in: COUNTED_REASON_CONTEXT, out: HANDLE
-#define PowerRequestAction 44 // in: POWER_REQUEST_ACTION
-#define GetPowerRequestList 45 // out: POWER_REQUEST_LIST
-#define ProcessorInformationEx 46 // in: USHORT, out: PROCESSOR_POWER_INFORMATION
-#define NotifyUserModeLegacyPowerEvent 47 // (kernel-mode only)
-#define GroupPark 48 // (debug-mode boot only) 
-#define ProcessorIdleDomains 49 // (kernel-mode only)
-#define WakeTimerList 50 // powercfg.exe /waketimers
-#define SystemHiberFileSize 51 // ULONG
-#define ProcessorIdleStatesHv 52 // (kernel-mode only)
-#define ProcessorPerfStatesHv 53 // (kernel-mode only)
-#define ProcessorPerfCapHv 54 // (kernel-mode only)
-#define ProcessorSetIdle 55 // (debug-mode boot only) 
-#define LogicalProcessorIdling 56 // (kernel-mode only)
-#define UserPresence 57 // not implemented
-#define PowerSettingNotificationName 58
-#define GetPowerSettingValue 59 // GUID
-#define IdleResiliency 60 // POWER_IDLE_RESILIENCY
-#define SessionRITState 61 // (kernel-mode only)
-#define SessionConnectNotification 62 // (kernel-mode only)
-#define SessionPowerCleanup 63 // (kernel-mode only)
-#define SessionLockState 64
-#define SystemHiberbootState 65 // BOOLEAN // fast startup supported
-#define PlatformInformation 66 // BOOLEAN // connected standby supported
-#define PdcInvocation 67 // (kernel-mode only)
-#define MonitorInvocation 68 // (kernel-mode only)
-#define FirmwareTableInformationRegistered 69 // (kernel-mode only)
-#define SetShutdownSelectedTime 70 // NULL
-#define SuspendResumeInvocation 71 // (kernel-mode only)
-#define PlmPowerRequestCreate 72 // in: COUNTED_REASON_CONTEXT, out: HANDLE
-#define ScreenOff 73 // NULL (PowerMonitorOff)
-#define CsDeviceNotification 74 // (kernel-mode only)
-#define PlatformRole 75 // POWER_PLATFORM_ROLE
-#define LastResumePerformance 76 // RESUME_PERFORMANCE
-#define DisplayBurst 77 // NULL (PowerMonitorOn)
-#define ExitLatencySamplingPercentage 78
-#define RegisterSpmPowerSettings 79 // (kernel-mode only)
-#define PlatformIdleStates 80 // (kernel-mode only)
-#define ProcessorIdleVeto 81 // (kernel-mode only) // deprecated
-#define PlatformIdleVeto 82 // (kernel-mode only) // deprecated
-#define SystemBatteryStatePrecise 83 // SYSTEM_BATTERY_STATE
-#define ThermalEvent 84  // THERMAL_EVENT // PowerReportThermalEvent
-#define PowerRequestActionInternal 85 // (kernel-mode only)
-#define BatteryDeviceState 86
-#define PowerInformationInternal 87
-#define ThermalStandby 88 // NULL // shutdown with thermal standby as reason.
-#define SystemHiberFileType 89 // ULONG // zero ? reduced : full // powercfg.exe /h /type 
-#define PhysicalPowerButtonPress 90 // BOOLEAN
-#define QueryPotentialDripsConstraint 91 // (kernel-mode only)
-#define EnergyTrackerCreate 92
-#define EnergyTrackerQuery 93
-#define UpdateBlackBoxRecorder 94
-#define SessionAllowExternalDmaDevices 95
-#define PowerInformationLevelMaximum 96
-#endif
-
-#if (PHNT_VERSION >= PHNT_WIN7)
-// POWER_REQUEST_TYPE
-// Note: We don't use an enum since it conflicts with the Windows SDK.
-#define PowerRequestDisplayRequired 0
-#define PowerRequestSystemRequired 1
-#define PowerRequestAwayModeRequired 2
-#define PowerRequestExecutionRequired 3        // Windows 8+
-#define PowerRequestPerfBoostRequired 4        // Windows 8+
-#define PowerRequestActiveLockScreenRequired 5 // Windows 10 RS1+ (reserved on Windows 8)
-// Values 6 and 7 are reserved for Windows 8 only
-#define PowerRequestFullScreenVideoRequired 8  // Windows 8 only
-
-typedef struct _POWER_REQUEST_ACTION
+typedef struct _POWER_REQUEST_ACTION_INTERNAL
 {
-    HANDLE PowerRequest;
-    POWER_REQUEST_TYPE RequestType;
-    BOOLEAN Enable;
-    HANDLE TargetProcess; // Windows 8+ and only for requests created via PlmPowerRequestCreate
-} POWER_REQUEST_ACTION, * PPOWER_REQUEST_ACTION;
+    PVOID PowerRequestPointer;
+    POWER_REQUEST_TYPE_INTERNAL RequestType;
+    BOOLEAN SetAction;
+} POWER_REQUEST_ACTION_INTERNAL, *PPOWER_REQUEST_ACTION_INTERNAL;

-typedef struct _POWER_REQUEST_LIST
+typedef enum _POWER_INFORMATION_LEVEL_INTERNAL
 {
-    ULONG_PTR cElements;
-    ULONG_PTR OffsetsToRequests[ANYSIZE_ARRAY]; // PPOWER_REQUEST
-} POWER_REQUEST_LIST, *PPOWER_REQUEST_LIST;
+    PowerInternalAcpiInterfaceRegister,
+    PowerInternalS0LowPowerIdleInfo, // POWER_S0_LOW_POWER_IDLE_INFO
+    PowerInternalReapplyBrightnessSettings,
+    PowerInternalUserAbsencePrediction, // POWER_USER_ABSENCE_PREDICTION
+    PowerInternalUserAbsencePredictionCapability, // POWER_USER_ABSENCE_PREDICTION_CAPABILITY
+    PowerInternalPoProcessorLatencyHint, // POWER_PROCESSOR_LATENCY_HINT
+    PowerInternalStandbyNetworkRequest, // POWER_STANDBY_NETWORK_REQUEST
+    PowerInternalDirtyTransitionInformation,
+    PowerInternalSetBackgroundTaskState, // POWER_SET_BACKGROUND_TASK_STATE
+    PowerInternalTtmOpenTerminal,
+    PowerInternalTtmCreateTerminal, // 10
+    PowerInternalTtmEvacuateDevices,
+    PowerInternalTtmCreateTerminalEventQueue,
+    PowerInternalTtmGetTerminalEvent,
+    PowerInternalTtmSetDefaultDeviceAssignment,
+    PowerInternalTtmAssignDevice,
+    PowerInternalTtmSetDisplayState,
+    PowerInternalTtmSetDisplayTimeouts,
+    PowerInternalBootSessionStandbyActivationInformation,
+    PowerInternalSessionPowerState,
+    PowerInternalSessionTerminalInput, // 20
+    PowerInternalSetWatchdog,
+    PowerInternalPhysicalPowerButtonPressInfoAtBoot,
+    PowerInternalExternalMonitorConnected,
+    PowerInternalHighPrecisionBrightnessSettings,
+    PowerInternalWinrtScreenToggle,
+    PowerInternalPpmQosDisable,
+    PowerInternalTransitionCheckpoint,
+    PowerInternalInputControllerState,
+    PowerInternalFirmwareResetReason,
+    PowerInternalPpmSchedulerQosSupport, // 30
+    PowerInternalBootStatGet,
+    PowerInternalBootStatSet,
+    PowerInternalCallHasNotReturnedWatchdog,
+    PowerInternalBootStatCheckIntegrity,
+    PowerInternalBootStatRestoreDefaults, // in: void
+    PowerInternalHostEsStateUpdate,
+    PowerInternalGetPowerActionState,
+    PowerInternalBootStatUnlock,
+    PowerInternalWakeOnVoiceState,
+    PowerInternalDeepSleepBlock, // 40
+    PowerInternalIsPoFxDevice,
+    PowerInternalPowerTransitionExtensionAtBoot,
+    PowerInternalProcessorBrandedFrequency, // in: POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_INPUT, out: POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_OUTPUT
+    PowerInternalTimeBrokerExpirationReason,
+    PowerInternalNotifyUserShutdownStatus,
+    PowerInternalPowerRequestTerminalCoreWindow,
+    PowerInternalProcessorIdleVeto,
+    PowerInternalPlatformIdleVeto,
+    PowerInternalIsLongPowerButtonBugcheckEnabled,
+    PowerInternalAutoChkCausedReboot, // 50
+    PowerInternalSetWakeAlarmOverride,

-typedef enum _POWER_REQUEST_ORIGIN
-{
-    POWER_REQUEST_ORIGIN_DRIVER = 0,
-    POWER_REQUEST_ORIGIN_PROCESS = 1,
-    POWER_REQUEST_ORIGIN_SERVICE = 2
-} POWER_REQUEST_ORIGIN;
+    PowerInternalDirectedFxAddTestDevice = 53,
+    PowerInternalDirectedFxRemoveTestDevice,

-typedef struct _POWER_REQUEST_BODY
+    PowerInternalDirectedFxSetMode = 56,
+    PowerInternalRegisterPowerPlane,
+    PowerInternalSetDirectedDripsFlags,
+    PowerInternalClearDirectedDripsFlags,
+    PowerInternalRetrieveHiberFileResumeContext, // 60
+    PowerInternalReadHiberFilePage,
+    PowerInternalLastBootSucceeded, // out: BOOLEAN
+    PowerInternalQuerySleepStudyHelperRoutineBlock,
+    PowerInternalDirectedDripsQueryCapabilities,
+    PowerInternalClearConstraints,
+    PowerInternalSoftParkVelocityEnabled,
+    PowerInternalQueryIntelPepCapabilities,
+    PowerInternalGetSystemIdleLoopEnablement, // since WIN11
+    PowerInternalGetVmPerfControlSupport,
+    PowerInternalGetVmPerfControlConfig, // 70
+    PowerInternalSleepDetailedDiagUpdate,
+    PowerInternalProcessorClassFrequencyBandsStats,
+    PowerInternalHostGlobalUserPresenceStateUpdate,
+    PowerInternalCpuNodeIdleIntervalStats,
+    PowerInternalClassIdleIntervalStats,
+    PowerInternalCpuNodeConcurrencyStats,
+    PowerInternalClassConcurrencyStats,
+    PowerInternalQueryProcMeasurementCapabilities,
+    PowerInternalQueryProcMeasurementValues,
+    PowerInternalPrepareForSystemInitiatedReboot, // 80
+    PowerInternalGetAdaptiveSessionState,
+    PowerInternalSetConsoleLockedState,
+    PowerInternalOverrideSystemInitiatedRebootState,
+    PowerInternalFanImpactStats,
+    PowerInternalFanRpmBuckets,
+    PowerInternalPowerBootAppDiagInfo,
+    PowerInternalUnregisterShutdownNotification, // since 22H1
+    PowerInternalManageTransitionStateRecord,
+    PowerInformationInternalMaximum
+} POWER_INFORMATION_LEVEL_INTERNAL;
+
+typedef enum _POWER_S0_DISCONNECTED_REASON
 {
-    ULONG_PTR cbSize;
-    POWER_REQUEST_ORIGIN Origin;
-    ULONG_PTR OffsetToRequester; // PWSTR
+    PoS0DisconnectedReasonNone,
+    PoS0DisconnectedReasonNonCompliantNic,
+    PoS0DisconnectedReasonSettingPolicy,
+    PoS0DisconnectedReasonEnforceDsPolicy,
+    PoS0DisconnectedReasonCsChecksFailed,
+    PoS0DisconnectedReasonSmartStandby,
+    PoS0DisconnectedReasonMaximum
+} POWER_S0_DISCONNECTED_REASON;
+
+typedef struct _POWER_S0_LOW_POWER_IDLE_INFO
+{
+    POWER_S0_DISCONNECTED_REASON DisconnectedReason;
    union
    {
-        struct
-        {
-            ULONG ProcessId;
-            ULONG ServiceTag;
-        };
-        ULONG_PTR OffsetToDriverName; // PWSTR
-    };    
-    ULONG_PTR OffsetToContext; // PCOUNTED_REASON_CONTEXT_RELATIVE
-} POWER_REQUEST_BODY, *PPOWER_REQUEST_BODY;
-
-// The number of supported request types per version
-#define POWER_REQUEST_SUPPORTED_TYPES_V1 3 // Windows 7
-#define POWER_REQUEST_SUPPORTED_TYPES_V2 9 // Windows 8
-#define POWER_REQUEST_SUPPORTED_TYPES_V3 5 // Windows 8.1 and Windows 10 TH1-TH2
-#define POWER_REQUEST_SUPPORTED_TYPES_V4 6 // Windows 10 RS1+
-
-typedef struct _POWER_REQUEST
-{
+        BOOLEAN Storage : 1;
+        BOOLEAN WiFi : 1;
+        BOOLEAN Mbn : 1;
+        BOOLEAN Ethernet : 1;
+        BOOLEAN Reserved : 4;
+        UCHAR AsUCHAR;
+    } CsDeviceCompliance;
    union
    {
-        struct
-        {
-            ULONG Reserved;
-            ULONG ActiveCount[POWER_REQUEST_SUPPORTED_TYPES_V1];
-            POWER_REQUEST_BODY Body;
-        } V1;
-#if (PHNT_VERSION >= PHNT_WIN8)
-        struct
-        {
-            ULONG Reserved;
-            ULONG ActiveCount[POWER_REQUEST_SUPPORTED_TYPES_V2];
-            POWER_REQUEST_BODY Body;
-        } V2;
-#endif
-#if (PHNT_VERSION >= PHNT_WINBLUE)
-        struct
-        {
-            ULONG Reserved;
-            ULONG ActiveCount[POWER_REQUEST_SUPPORTED_TYPES_V3];
-            POWER_REQUEST_BODY Body;
-        } V3;
-#endif
-#if (PHNT_VERSION >= PHNT_REDSTONE)
-        struct
-        {
-            ULONG Reserved;
-            ULONG ActiveCount[POWER_REQUEST_SUPPORTED_TYPES_V4];
-            POWER_REQUEST_BODY Body;
-        } V4;
-#endif
-    };
-} POWER_REQUEST, *PPOWER_REQUEST;
+        BOOLEAN DisconnectInStandby : 1;
+        BOOLEAN EnforceDs : 1;
+        BOOLEAN Reserved : 6;
+        UCHAR AsUCHAR;
+    } Policy;
+} POWER_S0_LOW_POWER_IDLE_INFO, *PPOWER_S0_LOW_POWER_IDLE_INFO;

-typedef struct _COUNTED_REASON_CONTEXT_RELATIVE
+typedef struct _POWER_INFORMATION_INTERNAL_HEADER
 {
-    ULONG Flags;
-    union
-    {
-        struct
-        {
-            ULONG_PTR OffsetToResourceFileName;
-            USHORT ResourceReasonId;
-            ULONG StringCount;
-            ULONG_PTR OffsetToReasonStrings;
-        };
-        ULONG_PTR OffsetToSimpleString;
-    };
-} COUNTED_REASON_CONTEXT_RELATIVE, *PCOUNTED_REASON_CONTEXT_RELATIVE;
-#endif
+    POWER_INFORMATION_LEVEL_INTERNAL InternalType;
+    ULONG Version;
+} POWER_INFORMATION_INTERNAL_HEADER, *PPOWER_INFORMATION_INTERNAL_HEADER;

-typedef struct _PROCESSOR_POWER_INFORMATION
+typedef struct _POWER_USER_ABSENCE_PREDICTION
 {
-    ULONG Number;
-    ULONG MaxMhz;
-    ULONG CurrentMhz;
-    ULONG MhzLimit;
-    ULONG MaxIdleState;
-    ULONG CurrentIdleState;
-} PROCESSOR_POWER_INFORMATION, *PPROCESSOR_POWER_INFORMATION;
+    POWER_INFORMATION_INTERNAL_HEADER Header;
+    LARGE_INTEGER ReturnTime;
+} POWER_USER_ABSENCE_PREDICTION, *PPOWER_USER_ABSENCE_PREDICTION;

-typedef struct _SYSTEM_POWER_INFORMATION
+typedef struct _POWER_USER_ABSENCE_PREDICTION_CAPABILITY
 {
-    ULONG MaxIdlenessAllowed;
-    ULONG Idleness;
-    ULONG TimeRemaining;
-    UCHAR CoolingMode;
-} SYSTEM_POWER_INFORMATION, *PSYSTEM_POWER_INFORMATION;
+    BOOLEAN AbsencePredictionCapability;
+} POWER_USER_ABSENCE_PREDICTION_CAPABILITY, *PPOWER_USER_ABSENCE_PREDICTION_CAPABILITY;
+
+typedef struct _POWER_PROCESSOR_LATENCY_HINT
+{
+    POWER_INFORMATION_INTERNAL_HEADER PowerInformationInternalHeader;
+    ULONG Type;
+} POWER_PROCESSOR_LATENCY_HINT, *PPO_PROCESSOR_LATENCY_HINT;
+
+typedef struct _POWER_STANDBY_NETWORK_REQUEST
+{
+    POWER_INFORMATION_INTERNAL_HEADER PowerInformationInternalHeader;
+    BOOLEAN Active;
+} POWER_STANDBY_NETWORK_REQUEST, *PPOWER_STANDBY_NETWORK_REQUEST;
+
+typedef struct _POWER_SET_BACKGROUND_TASK_STATE
+{
+    POWER_INFORMATION_INTERNAL_HEADER PowerInformationInternalHeader;
+    BOOLEAN Engaged;
+} POWER_SET_BACKGROUND_TASK_STATE, *PPOWER_SET_BACKGROUND_TASK_STATE;
+
+typedef struct POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_INPUT
+{
+    POWER_INFORMATION_LEVEL_INTERNAL InternalType;
+    PROCESSOR_NUMBER ProcessorNumber; // ULONG_MAX
+} POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_INPUT, *PPOWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_INPUT;
+
+typedef struct POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_OUTPUT
+{
+    ULONG Version;
+    ULONG NominalFrequency; // if (Domain) Prcb->PowerState.CheckContext.Domain.NominalFrequency else Prcb->MHz
+} POWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_OUTPUT, *PPOWER_INTERNAL_PROCESSOR_BRANDED_FREQENCY_OUTPUT;

 NTSYSCALLAPI
 NTSTATUS
@@ -363,12 +549,14 @@ NtSetThreadExecutionState(
    _Out_ EXECUTION_STATE *PreviousFlags
    );

+#if (PHNT_VERSION < PHNT_WIN7)
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
 NtRequestWakeupLatency(
    _In_ LATENCY_TIME latency
    );
+#endif

 NTSYSCALLAPI
 NTSTATUS
@@ -49,7 +49,8 @@
 #define JOB_OBJECT_QUERY 0x0004
 #define JOB_OBJECT_TERMINATE 0x0008
 #define JOB_OBJECT_SET_SECURITY_ATTRIBUTES 0x0010
-#define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1f)
+#define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3F)
+//#define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1f) // pre-Vista full access
 #endif

 #define GDI_HANDLE_BUFFER_SIZE32 34
@@ -152,7 +153,7 @@ typedef enum _PROCESSINFOCLASS
    ProcessImageInformation, // q: SECTION_IMAGE_INFORMATION
    ProcessCycleTime, // q: PROCESS_CYCLE_TIME_INFORMATION // since VISTA
    ProcessPagePriority, // q: PAGE_PRIORITY_INFORMATION
-    ProcessInstrumentationCallback, // qs: PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION // 40
+    ProcessInstrumentationCallback, // s: PVOID or PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION // 40
    ProcessThreadStackAllocation, // s: PROCESS_STACK_ALLOCATION_INFORMATION, PROCESS_STACK_ALLOCATION_INFORMATION_EX
    ProcessWorkingSetWatchEx, // q: PROCESS_WS_WATCH_INFORMATION_EX[]
    ProcessImageFileNameWin32, // q: UNICODE_STRING
@@ -182,7 +183,7 @@ typedef enum _PROCESSINFOCLASS
    ProcessAllowedCpuSetsInformation,
    ProcessSubsystemProcess,
    ProcessJobMemoryInformation, // q: PROCESS_JOB_MEMORY_INFO
-    ProcessInPrivate, // since THRESHOLD2 // 70
+    ProcessInPrivate, // s: void // ETW // since THRESHOLD2 // 70
    ProcessRaiseUMExceptionOnInvalidHandleClose, // qs: ULONG; s: 0 disables, otherwise enables
    ProcessIumChallengeResponse,
    ProcessChildProcessInformation, // q: PROCESS_CHILD_PROCESS_INFORMATION
@@ -215,6 +216,15 @@ typedef enum _PROCESSINFOCLASS
    ProcessAltSystemCallInformation, // qs: BOOLEAN (kernel-mode only) // INT2E // since 20H1 // 100
    ProcessDynamicEHContinuationTargets, // PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION
    ProcessDynamicEnforcedCetCompatibleRanges, // PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE_INFORMATION // since 20H2
+    ProcessCreateStateChange, // since WIN11
+    ProcessApplyStateChange,
+    ProcessEnableOptionalXStateFeatures,
+    ProcessAltPrefetchParam, // since 22H1
+    ProcessAssignCpuPartitions,
+    ProcessPriorityClassEx,
+    ProcessMembershipInformation,
+    ProcessEffectiveIoPriority,
+    ProcessEffectivePagePriority,
    MaxProcessInfoClass
 } PROCESSINFOCLASS;
 #endif
@@ -224,55 +234,60 @@ typedef enum _THREADINFOCLASS
 {
    ThreadBasicInformation, // q: THREAD_BASIC_INFORMATION
    ThreadTimes, // q: KERNEL_USER_TIMES
-    ThreadPriority, // s: KPRIORITY
+    ThreadPriority, // s: KPRIORITY (requires SeIncreaseBasePriorityPrivilege)
    ThreadBasePriority, // s: LONG
    ThreadAffinityMask, // s: KAFFINITY
    ThreadImpersonationToken, // s: HANDLE
    ThreadDescriptorTableEntry, // q: DESCRIPTOR_TABLE_ENTRY (or WOW64_DESCRIPTOR_TABLE_ENTRY)
    ThreadEnableAlignmentFaultFixup, // s: BOOLEAN
    ThreadEventPair,
-    ThreadQuerySetWin32StartAddress, // q: PVOID
-    ThreadZeroTlsCell, // 10
+    ThreadQuerySetWin32StartAddress, // q: ULONG_PTR
+    ThreadZeroTlsCell, // s: ULONG // TlsIndex // 10
    ThreadPerformanceCount, // q: LARGE_INTEGER
    ThreadAmILastThread, // q: ULONG
    ThreadIdealProcessor, // s: ULONG
    ThreadPriorityBoost, // qs: ULONG
-    ThreadSetTlsArrayAddress,
+    ThreadSetTlsArrayAddress, // s: ULONG_PTR 
    ThreadIsIoPending, // q: ULONG
-    ThreadHideFromDebugger, // s: void
+    ThreadHideFromDebugger, // q: BOOLEAN; s: void
    ThreadBreakOnTermination, // qs: ULONG
-    ThreadSwitchLegacyState,
+    ThreadSwitchLegacyState, // s: void // NtCurrentThread // NPX/FPU
    ThreadIsTerminated, // q: ULONG // 20
    ThreadLastSystemCall, // q: THREAD_LAST_SYSCALL_INFORMATION
-    ThreadIoPriority, // qs: IO_PRIORITY_HINT
+    ThreadIoPriority, // qs: IO_PRIORITY_HINT (requires SeIncreaseBasePriorityPrivilege)
    ThreadCycleTime, // q: THREAD_CYCLE_TIME_INFORMATION
    ThreadPagePriority, // q: ULONG
-    ThreadActualBasePriority,
+    ThreadActualBasePriority, // s: LONG (requires SeIncreaseBasePriorityPrivilege)
    ThreadTebInformation, // q: THREAD_TEB_INFORMATION (requires THREAD_GET_CONTEXT + THREAD_SET_CONTEXT)
    ThreadCSwitchMon,
    ThreadCSwitchPmu,
    ThreadWow64Context, // qs: WOW64_CONTEXT
    ThreadGroupInformation, // q: GROUP_AFFINITY // 30
    ThreadUmsInformation, // q: THREAD_UMS_INFORMATION
-    ThreadCounterProfiling, // sizeof(1) 
+    ThreadCounterProfiling, // q: BOOLEAN; s: THREAD_PROFILING_INFORMATION?
    ThreadIdealProcessorEx, // q: PROCESSOR_NUMBER
-    ThreadCpuAccountingInformation, // sizeof(1) // since WIN8
+    ThreadCpuAccountingInformation, // q: BOOLEAN; s: HANDLE (NtOpenSession) // NtCurrentThread // since WIN8
    ThreadSuspendCount, // q: ULONG // since WINBLUE
    ThreadHeterogeneousCpuPolicy, // q: KHETERO_CPU_POLICY // since THRESHOLD
    ThreadContainerId, // q: GUID
    ThreadNameInformation, // qs: THREAD_NAME_INFORMATION
    ThreadSelectedCpuSets,
    ThreadSystemThreadInformation, // q: SYSTEM_THREAD_INFORMATION // 40
-    ThreadActualGroupAffinity, // sizeof(16) // since THRESHOLD2
-    ThreadDynamicCodePolicyInfo, // sizeof(4)
+    ThreadActualGroupAffinity, // q: GROUP_AFFINITY // since THRESHOLD2
+    ThreadDynamicCodePolicyInfo, // q: ULONG; s: ULONG (NtCurrentThread)
    ThreadExplicitCaseSensitivity, // qs: ULONG; s: 0 disables, otherwise enables
    ThreadWorkOnBehalfTicket, // RTL_WORK_ON_BEHALF_TICKET_EX
    ThreadSubsystemInformation, // q: SUBSYSTEM_INFORMATION_TYPE // since REDSTONE2
-    ThreadDbgkWerReportActive,
-    ThreadAttachContainer,
+    ThreadDbgkWerReportActive, // s: ULONG; s: 0 disables, otherwise enables
+    ThreadAttachContainer, // s: HANDLE (job object) // NtCurrentThread
    ThreadManageWritesToExecutableMemory, // MANAGE_WRITES_TO_EXECUTABLE_MEMORY // since REDSTONE3
    ThreadPowerThrottlingState, // POWER_THROTTLING_THREAD_STATE
    ThreadWorkloadClass, // THREAD_WORKLOAD_CLASS // since REDSTONE5 // 50
+    ThreadCreateStateChange, // since WIN11
+    ThreadApplyStateChange,
+    ThreadStrongerBadHandleChecks, // since 22H1
+    ThreadEffectiveIoPriority,
+    ThreadEffectivePagePriority,
    MaxThreadInfoClass
 } THREADINFOCLASS;
 #endif
@@ -648,26 +663,6 @@ typedef struct _PROCESS_HANDLE_SNAPSHOT_INFORMATION

 #if (PHNT_MODE != PHNT_MODE_KERNEL)

-// TODO: remove after switch to 21H1 SDK
-typedef struct _PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY_INT {
-    union {
-        DWORD Flags;
-        struct {
-            DWORD EnableUserShadowStack : 1;
-            DWORD AuditUserShadowStack : 1;
-            DWORD SetContextIpValidation : 1;
-            DWORD AuditSetContextIpValidation : 1;
-            DWORD EnableUserShadowStackStrictMode : 1;
-            DWORD BlockNonCetBinaries : 1;
-            DWORD BlockNonCetBinariesNonEhcont : 1;
-            DWORD AuditBlockNonCetBinaries : 1;
-            DWORD CetDynamicApisOutOfProcOnly : 1;
-            DWORD ReservedFlags : 23;
-
-        } DUMMYSTRUCTNAME;
-    } DUMMYUNIONNAME;
-} PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY_INT, * PPROCESS_MITIGATION_USER_SHADOW_STACK_POLICY_INT;
-
 // private
 typedef struct _PROCESS_MITIGATION_POLICY_INFORMATION
 {
@@ -687,7 +682,8 @@ typedef struct _PROCESS_MITIGATION_POLICY_INFORMATION
        PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY PayloadRestrictionPolicy;
        PROCESS_MITIGATION_CHILD_PROCESS_POLICY ChildProcessPolicy;
        PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY SideChannelIsolationPolicy;
-        PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY_INT UserShadowStackPolicy;
+        PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY UserShadowStackPolicy;
+        PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY RedirectionTrustPolicy;
    };
 } PROCESS_MITIGATION_POLICY_INFORMATION, *PPROCESS_MITIGATION_POLICY_INFORMATION;

@@ -940,7 +936,7 @@ typedef struct _PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION
 } PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION, *PPROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION;

 // private
-typedef struct _PROCESS_LOGGING_INFORMATION
+typedef union _PROCESS_LOGGING_INFORMATION
 {
    ULONG Flags;
    struct
@@ -1077,16 +1073,16 @@ typedef struct _RTL_UMS_CONTEXT
    CONTEXT Context;
    PVOID Teb;
    PVOID UserContext;
-    volatile ULONG ScheduledThread;
-    volatile ULONG Suspended;
-    volatile ULONG VolatileContext;
-    volatile ULONG Terminated;
-    volatile ULONG DebugActive;
-    volatile ULONG RunningOnSelfThread;
-    volatile ULONG DenyRunningOnSelfThread;
+    volatile ULONG ScheduledThread : 1;
+    volatile ULONG Suspended : 1;
+    volatile ULONG VolatileContext : 1;
+    volatile ULONG Terminated : 1;
+    volatile ULONG DebugActive : 1;
+    volatile ULONG RunningOnSelfThread : 1;
+    volatile ULONG DenyRunningOnSelfThread : 1;
    volatile LONG Flags;
-    volatile ULONG64 KernelUpdateLock;
-    volatile ULONG64 PrimaryClientID;
+    volatile ULONG64 KernelUpdateLock : 2;
+    volatile ULONG64 PrimaryClientID : 62;
    volatile ULONG64 ContextLock;
    struct _RTL_UMS_CONTEXT* PrimaryUmsContext;
    ULONG SwitchCount;
@@ -1193,14 +1189,25 @@ NtCreateProcess(
    _In_ BOOLEAN InheritObjectTable,
    _In_opt_ HANDLE SectionHandle,
    _In_opt_ HANDLE DebugPort,
-    _In_opt_ HANDLE ExceptionPort
+    _In_opt_ HANDLE TokenHandle
    );

-#define PROCESS_CREATE_FLAGS_BREAKAWAY 0x00000001
-#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT 0x00000002
-#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES 0x00000004
-#define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008
-#define PROCESS_CREATE_FLAGS_LARGE_PAGES 0x00000010
+// begin_rev
+#define PROCESS_CREATE_FLAGS_BREAKAWAY 0x00000001 // NtCreateProcessEx & NtCreateUserProcess
+#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT 0x00000002 // NtCreateProcessEx & NtCreateUserProcess
+#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES 0x00000004 // NtCreateProcessEx & NtCreateUserProcess
+#define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008 // NtCreateProcessEx only
+#define PROCESS_CREATE_FLAGS_LARGE_PAGES 0x00000010 // NtCreateProcessEx only, requires SeLockMemory
+#define PROCESS_CREATE_FLAGS_LARGE_PAGE_SYSTEM_DLL 0x00000020 // NtCreateProcessEx only, requires SeLockMemory
+#define PROCESS_CREATE_FLAGS_PROTECTED_PROCESS 0x00000040 // NtCreateUserProcess only
+#define PROCESS_CREATE_FLAGS_CREATE_SESSION 0x00000080 // NtCreateProcessEx & NtCreateUserProcess, requires SeLoadDriver
+#define PROCESS_CREATE_FLAGS_INHERIT_FROM_PARENT 0x00000100 // NtCreateProcessEx & NtCreateUserProcess
+#define PROCESS_CREATE_FLAGS_SUSPENDED 0x00000200 // NtCreateProcessEx & NtCreateUserProcess
+#define PROCESS_CREATE_FLAGS_FORCE_BREAKAWAY 0x00000400 // NtCreateProcessEx & NtCreateUserProcess, requires SeTcb
+#define PROCESS_CREATE_FLAGS_MINIMAL_PROCESS 0x00000800 // NtCreateProcessEx only
+#define PROCESS_CREATE_FLAGS_RELEASE_SECTION 0x00001000 // NtCreateProcessEx & NtCreateUserProcess
+#define PROCESS_CREATE_FLAGS_AUXILIARY_PROCESS 0x00008000 // NtCreateProcessEx & NtCreateUserProcess, requires SeTcb
+// end_rev

 NTSYSCALLAPI
 NTSTATUS
@@ -1210,11 +1217,11 @@ NtCreateProcessEx(
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
    _In_ HANDLE ParentProcess,
-    _In_ ULONG Flags,
+    _In_ ULONG Flags, // PROCESS_CREATE_FLAGS_*
    _In_opt_ HANDLE SectionHandle,
    _In_opt_ HANDLE DebugPort,
-    _In_opt_ HANDLE ExceptionPort,
-    _In_ ULONG JobMemberLevel
+    _In_opt_ HANDLE TokenHandle,
+    _Reserved_ ULONG Reserved // JobMemberLevel
    );

 NTSYSCALLAPI
@@ -1301,7 +1308,7 @@ NTSTATUS
 NTAPI
 NtGetNextThread(
    _In_ HANDLE ProcessHandle,
-    _In_ HANDLE ThreadHandle,
+    _In_opt_ HANDLE ThreadHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ ULONG HandleAttributes,
    _In_ ULONG Flags,
@@ -1319,11 +1326,74 @@ NtSetInformationProcess(
    _In_ ULONG ProcessInformationLength
    );

+#endif
+
+#define STATECHANGE_SET_ATTRIBUTES 0x0001
+
+typedef enum _PROCESS_STATE_CHANGE_TYPE
+{
+    ProcessStateChangeSuspend,
+    ProcessStateChangeResume,
+    ProcessStateChangeMax,
+} PROCESS_STATE_CHANGE_TYPE, *PPROCESS_STATE_CHANGE_TYPE;
+
+#if (PHNT_VERSION >= PHNT_WIN11)
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
-NtQueryPortInformationProcess(
-    VOID
+NtCreateProcessStateChange(
+    _Out_ PHANDLE ProcessStateChangeHandle,
+    _In_ ACCESS_MASK DesiredAccess,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_ HANDLE ProcessHandle,
+    _In_opt_ ULONG64 Reserved
+    );
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtChangeProcessState(
+    _In_ HANDLE ProcessStateChangeHandle,
+    _In_ HANDLE ProcessHandle,
+    _In_ PROCESS_STATE_CHANGE_TYPE StateChangeType,
+    _In_opt_ PVOID ExtendedInformation,
+    _In_opt_ SIZE_T ExtendedInformationLength,
+    _In_opt_ ULONG64 Reserved
+    );
+
+#endif
+
+typedef enum _THREAD_STATE_CHANGE_TYPE
+{
+    ThreadStateChangeSuspend,
+    ThreadStateChangeResume,
+    ThreadStateChangeMax,
+} THREAD_STATE_CHANGE_TYPE, *PTHREAD_STATE_CHANGE_TYPE;
+
+#if (PHNT_VERSION >= PHNT_WIN11)
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtCreateThreadStateChange(
+    _Out_ PHANDLE ThreadStateChangeHandle,
+    _In_ ACCESS_MASK DesiredAccess,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_ HANDLE ThreadHandle,
+    _In_opt_ ULONG64 Reserved
+    );
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtChangeThreadState(
+    _In_ HANDLE ThreadStateChangeHandle,
+    _In_ HANDLE ThreadHandle,
+    _In_ THREAD_STATE_CHANGE_TYPE StateChangeType,
+    _In_opt_ PVOID ExtendedInformation,
+    _In_opt_ SIZE_T ExtendedInformationLength,
+    _In_opt_ ULONG64 Reserved
    );

 #endif
@@ -1392,7 +1462,7 @@ NTSYSCALLAPI
 ULONG
 NTAPI
 NtGetCurrentProcessorNumberEx(
-    _Out_opt_ PPROCESSOR_NUMBER ProcNumber
+    _Out_opt_ PPROCESSOR_NUMBER ProcessorNumber
    );
 #endif

@@ -1517,6 +1587,21 @@ NtQueueApcThreadEx(
    );
 #endif

+#if (PHNT_VERSION >= PHNT_WIN11)
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtQueueApcThreadEx2(
+    _In_ HANDLE ThreadHandle,
+    _In_opt_ HANDLE ReserveHandle, // NtAllocateReserveObject
+    _In_ QUEUE_USER_APC_FLAGS ApcFlags,
+    _In_ PPS_APC_ROUTINE ApcRoutine,
+    _In_opt_ PVOID ApcArgument1,
+    _In_opt_ PVOID ApcArgument2,
+    _In_opt_ PVOID ApcArgument3
+    );
+#endif
+
 #if (PHNT_VERSION >= PHNT_WIN8)

 // rev
@@ -1552,6 +1637,68 @@ NtWaitForAlertByThreadId(
 #define PS_ATTRIBUTE_INPUT 0x00020000 // input only
 #define PS_ATTRIBUTE_ADDITIVE 0x00040000 // "accumulated" e.g. bitmasks, counters, etc.

+// PROC_THREAD_ATTRIBUTE_NUM (Win32 CreateProcess) (dmex)
+#define ProcThreadAttributeParentProcess 0 // in HANDLE
+#define ProcThreadAttributeExtendedFlags 1 // in ULONG (PROC_EXTENDED_FLAG)
+#define ProcThreadAttributeHandleList 2 // in HANDLE[]
+#define ProcThreadAttributeGroupAffinity 3 // in GROUP_AFFINITY // since WIN7
+#define ProcThreadAttributePreferredNode 4 // in USHORT
+#define ProcThreadAttributeIdealProcessor 5// in PROCESSOR_NUMBER
+#define ProcThreadAttributeUmsThread 6 // in UMS_CREATE_THREAD_ATTRIBUTES
+#define ProcThreadAttributeMitigationPolicy 7 // in ULONG[] or ULONG64[]
+#define ProcThreadAttributePackageName 8 // in WCHAR[] // since WIN8
+#define ProcThreadAttributeSecurityCapabilities 9 // in SECURITY_CAPABILITIES
+#define ProcThreadAttributeConsoleReference 10 // BaseGetConsoleReference (kernelbase.dll)
+#define ProcThreadAttributeProtectionLevel 11 // in ULONG
+#define ProcThreadAttributeJobList 13 // in HANDLE[] // since WIN10
+#define ProcThreadAttributeChildProcessPolicy 14 // in ULONG
+#define ProcThreadAttributeAllApplicationPackagesPolicy 15 // in ULONG
+#define ProcThreadAttributeWin32kFilter 16 // in PROC_THREAD_WIN32KFILTER_ATTRIBUTE
+#define ProcThreadAttributeSafeOpenPromptOriginClaim 17 // since RS1
+#define ProcThreadAttributeDesktopAppPolicy 18 // in ULONG // since RS2
+#define ProcThreadAttributeBnoIsolation 19 // in PROC_THREAD_BNOISOLATION_ATTRIBUTE
+#define ProcThreadAttributePseudoConsole 22 // in HANDLE (HPCON) // since RS5
+#define ProcThreadAttributeMitigationAuditPolicy 24 // in ULONG[] or ULONG64[] // since 20H1
+#define ProcThreadAttributeMachineType 25 // in ULONG
+#define ProcThreadAttributeComponentFilter 26 // in ULONG
+#define ProcThreadAttributeEnableOptionalXStateFeatures 27 // in ULONG // since 20H2
+
+#define PROC_EXTENDED_FLAG_LOG_ELEVATION_FAILURE 0x1
+#define PROC_EXTENDED_FLAG_IGNORE_ELEVATION 0x2
+#define PROC_EXTENDED_FLAG_FORCE_JOB_BREAKAWAY 0x4 // (requires SeTcbPrivilege)
+
+#define WIN32KFILTER_FLAG_ENABLE 0x1
+#define WIN32KFILTER_FLAG_AUDIT 0x2
+
+typedef struct _PROC_THREAD_WIN32KFILTER_ATTRIBUTE
+{
+    ULONG Flags;
+    ULONG FilterLevel;
+} PROC_THREAD_WIN32KFILTER_ATTRIBUTE, *PPROC_THREAD_WIN32KFILTER_ATTRIBUTE;
+
+typedef struct _PROC_THREAD_BNOISOLATION_ATTRIBUTE
+{
+    BOOL IsolationEnabled;
+    WCHAR IsolationPrefix[0x88];
+} PROC_THREAD_BNOISOLATION_ATTRIBUTE, *PPROC_THREAD_BNOISOLATION_ATTRIBUTE;
+
+#ifndef PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS
+#define PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS \
+    ProcThreadAttributeValue(ProcThreadAttributeExtendedFlags, FALSE, TRUE, TRUE)
+#endif
+#ifndef PROC_THREAD_ATTRIBUTE_CONSOLE_REFERENCE
+#define PROC_THREAD_ATTRIBUTE_CONSOLE_REFERENCE \
+    ProcThreadAttributeValue(ProcThreadAttributeConsoleReference, FALSE, TRUE, FALSE)
+#endif
+#ifndef PROC_THREAD_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM
+#define PROC_THREAD_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM \
+    ProcThreadAttributeValue(ProcThreadAttributeSafeOpenPromptOriginClaim, FALSE, TRUE, FALSE)
+#endif
+#ifndef PROC_THREAD_ATTRIBUTE_BNO_ISOLATION
+#define PROC_THREAD_ATTRIBUTE_BNO_ISOLATION \
+    ProcThreadAttributeValue(ProcThreadAttributeBnoIsolation, FALSE, TRUE, FALSE)
+#endif
+
 // private
 typedef enum _PS_ATTRIBUTE_NUM
 {
@@ -1582,6 +1729,10 @@ typedef enum _PS_ATTRIBUTE_NUM
    PsAttributeBnoIsolation, // PS_BNO_ISOLATION_PARAMETERS
    PsAttributeDesktopAppPolicy, // in ULONG
    PsAttributeChpe, // since REDSTONE3
+    PsAttributeMitigationAuditOptions, // since 21H1
+    PsAttributeMachineType, // since WIN11
+    PsAttributeComponentFilter,
+    PsAttributeEnableOptionalXStateFeatures,
    PsAttributeMax
 } PS_ATTRIBUTE_NUM;

@@ -1745,7 +1896,11 @@ typedef enum _PS_MITIGATION_OPTION
    PS_MITIGATION_OPTION_RESTRICT_INDIRECT_BRANCH_PREDICTION,
    PS_MITIGATION_OPTION_SPECULATIVE_STORE_BYPASS_DISABLE, // since REDSTONE5
    PS_MITIGATION_OPTION_ALLOW_DOWNGRADE_DYNAMIC_CODE_POLICY,
-    PS_MITIGATION_OPTION_CET_SHADOW_STACKS
+    PS_MITIGATION_OPTION_CET_USER_SHADOW_STACKS,
+    PS_MITIGATION_OPTION_USER_CET_SET_CONTEXT_IP_VALIDATION, // since 21H1
+    PS_MITIGATION_OPTION_BLOCK_NON_CET_BINARIES,
+    PS_MITIGATION_OPTION_CET_DYNAMIC_APIS_OUT_OF_PROC_ONLY,
+    PS_MITIGATION_OPTION_REDIRECTION_TRUST, // since 22H1
 } PS_MITIGATION_OPTION;

 // windows-internals-book:"Chapter 5"
@@ -1838,21 +1993,6 @@ typedef struct _PS_CREATE_INFO

 // end_private

-// begin_rev
-#define PROCESS_CREATE_FLAGS_BREAKAWAY 0x00000001
-#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT 0x00000002
-#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES 0x00000004
-#define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008
-#define PROCESS_CREATE_FLAGS_LARGE_PAGES 0x00000010
-#define PROCESS_CREATE_FLAGS_LARGE_PAGE_SYSTEM_DLL 0x00000020
-// Extended PROCESS_CREATE_FLAGS_*
-#define PROCESS_CREATE_FLAGS_PROTECTED_PROCESS 0x00000040
-#define PROCESS_CREATE_FLAGS_CREATE_SESSION 0x00000080 // ?
-#define PROCESS_CREATE_FLAGS_INHERIT_FROM_PARENT 0x00000100
-#define PROCESS_CREATE_FLAGS_SUSPENDED 0x00000200
-#define PROCESS_CREATE_FLAGS_EXTENDED_UNKNOWN 0x00000400
-// end_rev
-
 #if (PHNT_VERSION >= PHNT_VISTA)
 NTSYSCALLAPI
 NTSTATUS
@@ -1873,13 +2013,13 @@ NtCreateUserProcess(
 #endif

 // begin_rev
-#define THREAD_CREATE_FLAGS_CREATE_SUSPENDED 0x00000001
-#define THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH 0x00000002 // ?
-#define THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER 0x00000004
-#define THREAD_CREATE_FLAGS_HAS_SECURITY_DESCRIPTOR 0x00000010 // ?
-#define THREAD_CREATE_FLAGS_ACCESS_CHECK_IN_TARGET 0x00000020 // ?
-#define THREAD_CREATE_FLAGS_SKIP_THREAD_SUSPEND 0x00000040 // ?
-#define THREAD_CREATE_FLAGS_INITIAL_THREAD 0x00000080
+#define THREAD_CREATE_FLAGS_CREATE_SUSPENDED 0x00000001 // NtCreateUserProcess & NtCreateThreadEx
+#define THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH 0x00000002 // NtCreateThreadEx only
+#define THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER 0x00000004 // NtCreateThreadEx only
+#define THREAD_CREATE_FLAGS_LOADER_WORKER 0x00000010 // NtCreateThreadEx only
+#define THREAD_CREATE_FLAGS_SKIP_LOADER_INIT 0x00000020 // NtCreateThreadEx only
+#define THREAD_CREATE_FLAGS_BYPASS_PROCESS_FREEZE 0x00000040 // NtCreateThreadEx only
+#define THREAD_CREATE_FLAGS_INITIAL_THREAD 0x00000080 // ?
 // end_rev

 #if (PHNT_VERSION >= PHNT_VISTA)
@@ -1956,7 +2096,9 @@ NtCreateThreadEx(
 #define JobObjectSiloSystemRoot 45
 #define JobObjectEnergyTrackingState 46 // JOBOBJECT_ENERGY_TRACKING_STATE
 #define JobObjectThreadImpersonationInformation 47
-#define MaxJobObjectInfoClass 48
+#define JobObjectIoPriorityLimit 48
+#define JobObjectPagePriorityLimit 49
+#define MaxJobObjectInfoClass 50

 // private
 typedef struct _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION
@@ -91,9 +91,21 @@ typedef struct _KEY_CACHED_INFORMATION
    WCHAR Name[1];
 } KEY_CACHED_INFORMATION, *PKEY_CACHED_INFORMATION;

+// rev
+#define REG_FLAG_VOLATILE 0x0001
+#define REG_FLAG_LINK 0x0002
+
+// msdn
+#define REG_KEY_DONT_VIRTUALIZE 0x0002
+#define REG_KEY_DONT_SILENT_FAIL 0x0004
+#define REG_KEY_RECURSE_FLAG 0x0008
+
+// private
 typedef struct _KEY_FLAGS_INFORMATION
 {
-    ULONG UserFlags;
+    ULONG Wow64Flags;
+    ULONG KeyFlags; // REG_FLAG_*
+    ULONG ControlFlags; // REG_KEY_*
 } KEY_FLAGS_INFORMATION, *PKEY_FLAGS_INFORMATION;

 typedef struct _KEY_VIRTUALIZATION_INFORMATION
@@ -116,11 +128,11 @@ typedef struct _KEY_TRUST_INFORMATION
 // private
 typedef struct _KEY_LAYER_INFORMATION
 {
-    ULONG IsTombstone;
-    ULONG IsSupersedeLocal;
-    ULONG IsSupersedeTree;
-    ULONG ClassIsInherited;
-    ULONG Reserved;
+    ULONG IsTombstone : 1;
+    ULONG IsSupersedeLocal : 1;
+    ULONG IsSupersedeTree : 1;
+    ULONG ClassIsInherited : 1;
+    ULONG Reserved : 28;
 } KEY_LAYER_INFORMATION, *PKEY_LAYER_INFORMATION;

 typedef enum _KEY_SET_INFORMATION_CLASS
@@ -221,10 +233,29 @@ typedef struct _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64
 // private
 typedef struct _KEY_VALUE_LAYER_INFORMATION
 {
-    ULONG IsTombstone;
-    ULONG Reserved;
+    ULONG IsTombstone : 1;
+    ULONG Reserved : 31;
 } KEY_VALUE_LAYER_INFORMATION, *PKEY_VALUE_LAYER_INFORMATION;

+// rev
+typedef enum _KEY_LOAD_ENTRY_TYPE
+{
+    KeyLoadTrustClassKey = 1,
+    KeyLoadEvent,
+    KeyLoadToken
+} KEY_LOAD_ENTRY_TYPE;
+
+// rev
+typedef struct _KEY_LOAD_ENTRY
+{
+    KEY_LOAD_ENTRY_TYPE EntryType;
+    union
+    {
+        HANDLE Handle;
+        ULONG_PTR Value;
+    };
+} KEY_LOAD_ENTRY, *PKEY_LOAD_ENTRY;
+
 typedef struct _KEY_VALUE_ENTRY
 {
    PUNICODE_STRING ValueName;
@@ -493,6 +524,23 @@ NtLoadKeyEx(
    _Out_opt_ PHANDLE RootHandle,
    _Reserved_ PVOID Reserved // previously PIO_STATUS_BLOCK
    );
+       
+// rev by tyranid
+#if (PHNT_VERSION >= PHNT_20H1)
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtLoadKey3(
+    _In_ POBJECT_ATTRIBUTES TargetKey,
+    _In_ POBJECT_ATTRIBUTES SourceFile,
+    _In_ ULONG Flags,
+    _In_reads_(LoadEntryCount) PKEY_LOAD_ENTRY LoadEntries,
+    _In_ ULONG LoadEntryCount,
+    _In_opt_ ACCESS_MASK DesiredAccess,
+    _Out_opt_ PHANDLE RootHandle,
+    _Reserved_ PVOID Reserved
+    );
+#endif

 NTSYSCALLAPI
 NTSTATUS
@@ -661,4 +709,35 @@ NtThawRegistry(
    );
 #endif

+#if (PHNT_VERSION >= PHNT_REDSTONE)
+NTSTATUS NtCreateRegistryTransaction(
+    _Out_ HANDLE *RegistryTransactionHandle,
+    _In_ ACCESS_MASK DesiredAccess,
+    _In_opt_ POBJECT_ATTRIBUTES ObjAttributes,
+    _Reserved_ ULONG CreateOptions
+    );     
+#endif
+
+#if (PHNT_VERSION >= PHNT_REDSTONE)
+NTSTATUS NtOpenRegistryTransaction(
+    _Out_ HANDLE *RegistryTransactionHandle,
+    _In_ ACCESS_MASK DesiredAccess,
+    _In_ POBJECT_ATTRIBUTES ObjAttributes
+    );
+#endif
+
+#if (PHNT_VERSION >= PHNT_REDSTONE)
+NTSTATUS NtCommitRegistryTransaction(
+    _In_ HANDLE RegistryTransactionHandle,
+    _Reserved_ ULONG Flags
+    );
+#endif
+
+#if (PHNT_VERSION >= PHNT_REDSTONE)
+NTSTATUS NtRollbackRegistryTransaction(
+    _In_ HANDLE RegistryTransactionHandle,
+    _Reserved_ ULONG Flags
+    );
+#endif
+
 #endif
@@ -1236,6 +1236,20 @@ RtlWakeAddressSingle(

 // Strings

+FORCEINLINE
+VOID
+NTAPI
+RtlInitEmptyAnsiString(
+    _Out_ PANSI_STRING AnsiString,
+    _Pre_maybenull_ _Pre_readable_size_(MaximumLength) PCHAR Buffer,
+    _In_ USHORT MaximumLength
+    )
+{
+    memset(AnsiString, 0, sizeof(ANSI_STRING));
+    AnsiString->MaximumLength = MaximumLength;
+    AnsiString->Buffer = Buffer;
+}
+
 #ifndef PHNT_NO_INLINE_INIT_STRING
 FORCEINLINE VOID RtlInitString(
    _Out_ PSTRING DestinationString,
@@ -1243,7 +1257,7 @@ FORCEINLINE VOID RtlInitString(
    )
 {
    if (SourceString)
-        DestinationString->MaximumLength = (DestinationString->Length = (USHORT)strlen(SourceString)) + 1;
+        DestinationString->MaximumLength = (DestinationString->Length = (USHORT)strlen(SourceString)) + sizeof(ANSI_NULL);
    else
        DestinationString->MaximumLength = DestinationString->Length = 0;

@@ -1276,7 +1290,7 @@ FORCEINLINE VOID RtlInitAnsiString(
    )
 {
    if (SourceString)
-        DestinationString->MaximumLength = (DestinationString->Length = (USHORT)strlen(SourceString)) + 1;
+        DestinationString->MaximumLength = (DestinationString->Length = (USHORT)strlen(SourceString)) + sizeof(ANSI_NULL);
    else
        DestinationString->MaximumLength = DestinationString->Length = 0;

@@ -1306,9 +1320,34 @@ NTSYSAPI
 VOID
 NTAPI
 RtlFreeAnsiString(
-    _In_ PANSI_STRING AnsiString
+    _Inout_ _At_(AnsiString->Buffer, _Frees_ptr_opt_) PANSI_STRING AnsiString
    );

+#if (PHNT_VERSION >= PHNT_19H2)
+NTSYSAPI
+VOID
+NTAPI
+RtlInitUTF8String(
+    _Out_ PUTF8_STRING DestinationString,
+    _In_opt_z_ PCSZ SourceString
+    );
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlInitUTF8StringEx(
+    _Out_ PUTF8_STRING DestinationString,
+    _In_opt_z_ PCSZ SourceString
+    );
+
+NTSYSAPI
+VOID
+NTAPI
+RtlFreeUTF8String(
+    _Inout_ _At_(utf8String->Buffer, _Frees_ptr_opt_) PUTF8_STRING Utf8String
+    );
+#endif
+
 NTSYSAPI
 VOID
 NTAPI
@@ -1381,8 +1420,8 @@ NTSYSAPI
 VOID
 NTAPI
 RtlUpperString(
-    _In_ PSTRING DestinationString,
-    _In_ PSTRING SourceString
+    _Inout_ PSTRING DestinationString,
+    _In_ const STRING* SourceString
    );

 FORCEINLINE
@@ -1399,13 +1438,13 @@ VOID
 NTAPI
 RtlInitEmptyUnicodeString(
    _Out_ PUNICODE_STRING DestinationString,
-    _In_opt_ PWCHAR Buffer,
+    _Writable_bytes_(MaximumLength) _When_(MaximumLength != 0, _Notnull_) PWCHAR Buffer,
    _In_ USHORT MaximumLength
    )
 {
-    DestinationString->Buffer = Buffer;
+    memset(DestinationString, 0, sizeof(UNICODE_STRING));
    DestinationString->MaximumLength = MaximumLength;
-    DestinationString->Length = 0;
+    DestinationString->Buffer = Buffer;
 }

 #ifndef PHNT_NO_INLINE_INIT_STRING
@@ -1461,7 +1500,7 @@ NTSYSAPI
 VOID
 NTAPI
 RtlFreeUnicodeString(
-    _In_ PUNICODE_STRING UnicodeString
+    _Inout_ _At_(UnicodeString->Buffer, _Frees_ptr_opt_) PUNICODE_STRING UnicodeString
    );

 #define RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE (0x00000001)
@@ -1481,7 +1520,7 @@ VOID
 NTAPI
 RtlCopyUnicodeString(
    _In_ PUNICODE_STRING DestinationString,
-    _In_ PUNICODE_STRING SourceString
+    _In_opt_ PCUNICODE_STRING SourceString
    );

 NTSYSAPI
@@ -1607,7 +1646,7 @@ NTSTATUS
 NTAPI
 RtlAppendUnicodeStringToString(
    _In_ PUNICODE_STRING Destination,
-    _In_ PUNICODE_STRING Source
+    _In_ PCUNICODE_STRING Source
    );

 NTSYSAPI
@@ -1661,6 +1700,26 @@ RtlUnicodeStringToAnsiString(
    _In_ BOOLEAN AllocateDestinationString
    );

+#if (PHNT_VERSION >= PHNT_19H2)
+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlUnicodeStringToUTF8String(
+    _Inout_ PUTF8_STRING DestinationString,
+    _In_ PCUNICODE_STRING SourceString,
+    _In_ BOOLEAN AllocateDestinationString
+    );
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlUTF8StringToUnicodeString(
+    _Inout_ PUNICODE_STRING DestinationString,
+    _In_ PUTF8_STRING SourceString,
+    _In_ BOOLEAN AllocateDestinationString
+    );
+#endif
+
 NTSYSAPI
 WCHAR
 NTAPI
@@ -1990,6 +2049,13 @@ RtlIsNameInUnUpcasedExpression(
    );
 #endif

+NTSYSAPI
+BOOLEAN
+NTAPI
+RtlDoesNameContainWildCards(
+    _In_ PUNICODE_STRING Expression
+    );
+
 NTSYSAPI
 BOOLEAN
 NTAPI
@@ -2678,6 +2744,23 @@ RtlCreateUserProcess(
    _Out_ PRTL_USER_PROCESS_INFORMATION ProcessInformation
    );

+#if (PHNT_VERSION >= PHNT_REDSTONE2)
+
+#define RTL_USER_PROCESS_EXTENDED_PARAMETERS_VERSION 1
+
+// private
+typedef struct _RTL_USER_PROCESS_EXTENDED_PARAMETERS
+{
+    USHORT Version;
+    USHORT NodeNumber;
+    PSECURITY_DESCRIPTOR ProcessSecurityDescriptor;
+    PSECURITY_DESCRIPTOR ThreadSecurityDescriptor;
+    HANDLE ParentProcess;
+    HANDLE DebugPort;
+    HANDLE TokenHandle;
+    HANDLE JobHandle;
+} RTL_USER_PROCESS_EXTENDED_PARAMETERS, *PRTL_USER_PROCESS_EXTENDED_PARAMETERS;
+
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -2685,10 +2768,12 @@ RtlCreateUserProcessEx(
    _In_ PUNICODE_STRING NtImagePathName,
    _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters,
    _In_ BOOLEAN InheritHandles,
-    _Reserved_ ULONG Flags,
+    _In_opt_ PRTL_USER_PROCESS_EXTENDED_PARAMETERS ProcessExtendedParameters,
    _Out_ PRTL_USER_PROCESS_INFORMATION ProcessInformation
    );

+#endif
+
 #if (PHNT_VERSION >= PHNT_VISTA)
 DECLSPEC_NORETURN
 NTSYSAPI
@@ -2763,7 +2848,7 @@ NTSTATUS
 NTAPI
 RtlCreateProcessReflection(
    _In_ HANDLE ProcessHandle,
-    _In_ ULONG Flags,
+    _In_ ULONG Flags, // RTL_CLONE_PROCESS_FLAGS
    _In_opt_ PVOID StartRoutine,
    _In_opt_ PVOID StartContext,
    _In_opt_ HANDLE EventHandle,
@@ -2950,6 +3035,15 @@ RtlInitializeExtendedContext(
    _Out_ PCONTEXT_EX* ContextEx
    );

+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlCopyContext(
+    _Inout_ PCONTEXT Context,
+    _In_ ULONG ContextFlags,
+    _Out_ PCONTEXT Source
+    );
+
 NTSYSAPI
 ULONG
 NTAPI
@@ -3034,7 +3128,7 @@ RtlRemoteCall(
    _In_ BOOLEAN AlreadySuspended
    );

-// Vectored exception handlers
+// Vectored Exception Handlers

 NTSYSAPI
 PVOID
@@ -3129,7 +3223,8 @@ typedef struct _DYNAMIC_FUNCTION_TABLE
    PWSTR OutOfProcessCallbackDll;
    FUNCTION_TABLE_TYPE Type;
    ULONG EntryCount;
-    RTL_BALANCED_NODE TreeNode;
+    RTL_BALANCED_NODE TreeNodeMin;
+    RTL_BALANCED_NODE TreeNodeMax;
 } DYNAMIC_FUNCTION_TABLE, *PDYNAMIC_FUNCTION_TABLE;

 // rev
@@ -3752,7 +3847,7 @@ RtlComputePrivatizedDllName_U(

 // rev
 NTSYSAPI
-BOOLEAN
+NTSTATUS
 NTAPI
 RtlGetSearchPath(
    _Out_ PWSTR *SearchPath
@@ -3768,12 +3863,34 @@ RtlSetSearchPathMode(

 // rev
 NTSYSAPI
-PWSTR
+NTSTATUS
 NTAPI
 RtlGetExePath(
-    VOID
+    _In_ PCWSTR DosPathName,
+    _Out_ PWSTR* SearchPath
    );

+// rev
+NTSYSAPI
+VOID
+NTAPI
+RtlReleasePath(
+    _In_ PWSTR Path
+    );
+
+#endif
+
+#if (PHNT_VERSION >= PHNT_20H1)
+// rev
+NTSYSAPI
+ULONG
+NTAPI
+RtlReplaceSystemDirectoryInPath(
+    _Inout_ PUNICODE_STRING Destination,
+    _In_ ULONG Machine, // IMAGE_FILE_MACHINE_I386
+    _In_ ULONG TargetMachine, // IMAGE_FILE_MACHINE_TARGET_HOST
+    _In_ BOOLEAN IncludePathSeperator
+    );
 #endif

 #if (PHNT_VERSION >= PHNT_REDSTONE2)
@@ -3867,6 +3984,7 @@ typedef struct _RTL_HEAP_INFORMATION
    ULONG Reserved[5];
    PRTL_HEAP_TAG Tags;
    PRTL_HEAP_ENTRY Entries;
+    ULONG64 HeapTag; // Windows 11 > 22000
 } RTL_HEAP_INFORMATION, *PRTL_HEAP_INFORMATION;

 #define RTL_HEAP_SIGNATURE 0xFFEEFFEEUL
@@ -4105,7 +4223,7 @@ NTSYSAPI
 BOOLEAN
 NTAPI
 RtlValidateHeap(
-    _In_ PVOID HeapHandle,
+    _In_opt_ PVOID HeapHandle,
    _In_ ULONG Flags,
    _In_ PVOID BaseAddress
    );
@@ -4500,7 +4618,7 @@ NTSYSAPI
 LOGICAL
 NTAPI
 RtlSetCurrentTransaction(
-    _In_ HANDLE TransactionHandle
+    _In_opt_ HANDLE TransactionHandle
    );
 #endif

@@ -4684,7 +4802,7 @@ RtlDeCommitDebugInfo(
 #define RTL_QUERY_PROCESS_MODULES32 0x00000040
 #define RTL_QUERY_PROCESS_VERIFIER_OPTIONS 0x00000080 // rev
 #define RTL_QUERY_PROCESS_MODULESEX 0x00000100 // rev
-#define RTL_QUERY_PROCESS_HEAP_ENTRIES_EX 0x00000200 // ?
+#define RTL_QUERY_PROCESS_HEAP_SEGMENTS 0x00000200
 #define RTL_QUERY_PROCESS_CS_OWNER 0x00000400 // rev
 #define RTL_QUERY_PROCESS_NONINVASIVE 0x80000000

@@ -4900,38 +5018,6 @@ RtlReportSilentProcessExit(
    );
 #endif

-// Vectored Exception Handlers
-
-NTSYSAPI
-PVOID
-NTAPI
-RtlAddVectoredExceptionHandler(
-    _In_ ULONG First,
-    _In_ PVECTORED_EXCEPTION_HANDLER Handler
-    );
-
-NTSYSAPI
-ULONG
-NTAPI
-RtlRemoveVectoredExceptionHandler(
-    _In_ PVOID Handle
-    );
-
-NTSYSAPI
-PVOID
-NTAPI
-RtlAddVectoredContinueHandler(
-    _In_ ULONG First,
-    _In_ PVECTORED_EXCEPTION_HANDLER Handler
-    );
-
-NTSYSAPI
-ULONG
-NTAPI
-RtlRemoveVectoredContinueHandler(
-    _In_ PVOID Handle
-    );
-
 // Random

 NTSYSAPI
@@ -5227,6 +5313,31 @@ RtlGetSystemTimePrecise(
    );
 #endif

+#if (PHNT_VERSION >= PHNT_THRESHOLD)
+NTSYSAPI
+KSYSTEM_TIME
+NTAPI
+RtlGetSystemTimeAndBias(
+    _Out_ KSYSTEM_TIME TimeZoneBias,
+    _Out_opt_ PLARGE_INTEGER TimeZoneBiasEffectiveStart,
+    _Out_opt_ PLARGE_INTEGER TimeZoneBiasEffectiveEnd
+    );
+
+NTSYSAPI
+LARGE_INTEGER
+NTAPI
+RtlGetInterruptTimePrecise(
+    _Out_ PLARGE_INTEGER PerformanceCounter
+    );
+
+NTSYSAPI
+BOOLEAN
+NTAPI
+RtlQueryUnbiasedInterruptTime(
+    _Out_ PLARGE_INTEGER InterruptTime
+    );
+#endif
+
 // Time zones

 typedef struct _RTL_TIME_ZONE_INFORMATION
@@ -6185,7 +6296,7 @@ RtlSetDaclSecurityDescriptor(
    _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,
    _In_ BOOLEAN DaclPresent,
    _In_opt_ PACL Dacl,
-    _In_opt_ BOOLEAN DaclDefaulted
+    _In_ BOOLEAN DaclDefaulted
    );

 NTSYSAPI
@@ -6205,7 +6316,7 @@ RtlSetSaclSecurityDescriptor(
    _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,
    _In_ BOOLEAN SaclPresent,
    _In_opt_ PACL Sacl,
-    _In_opt_ BOOLEAN SaclDefaulted
+    _In_ BOOLEAN SaclDefaulted
    );

 NTSYSAPI
@@ -6294,12 +6405,35 @@ NTSYSAPI
 NTSTATUS
 NTAPI
 RtlSelfRelativeToAbsoluteSD2(
-    _Inout_ PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
-    _Inout_ PULONG pBufferSize
+    _Inout_ PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor,
+    _Inout_ PULONG BufferSize
    );

 // Access masks

+#ifndef PHNT_NO_INLINE_ACCESSES_GRANTED
+FORCEINLINE
+BOOLEAN
+NTAPI
+RtlAreAllAccessesGranted(
+    _In_ ACCESS_MASK GrantedAccess,
+    _In_ ACCESS_MASK DesiredAccess
+    )
+{
+    return (~GrantedAccess & DesiredAccess) == 0;
+}
+
+FORCEINLINE
+BOOLEAN
+NTAPI
+RtlAreAnyAccessesGranted(
+    _In_ ACCESS_MASK GrantedAccess,
+    _In_ ACCESS_MASK DesiredAccess
+    )
+{
+    return (GrantedAccess & DesiredAccess) != 0;
+}
+#else
 NTSYSAPI
 BOOLEAN
 NTAPI
@@ -6315,6 +6449,7 @@ RtlAreAnyAccessesGranted(
    _In_ ACCESS_MASK GrantedAccess,
    _In_ ACCESS_MASK DesiredAccess
    );
+#endif

 NTSYSAPI
 VOID
@@ -6404,9 +6539,9 @@ NTSYSAPI
 PVOID
 NTAPI
 RtlFindAceByType(
-    _In_ PACL pAcl,
+    _In_ PACL Acl,
    _In_ UCHAR AceType,
-    _Out_opt_ PULONG pIndex
+    _Out_opt_ PULONG Index
    );
 #endif

@@ -6710,6 +6845,40 @@ RtlCopySecurityDescriptor(
    _Out_ PSECURITY_DESCRIPTOR *OutputSecurityDescriptor
    );

+// private
+typedef struct _RTL_ACE_DATA
+{
+    UCHAR AceType;
+    UCHAR InheritFlags;
+    UCHAR AceFlags;
+    ACCESS_MASK AccessMask;
+    PSID* Sid;
+} RTL_ACE_DATA, *PRTL_ACE_DATA;
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlCreateUserSecurityObject(
+    _In_ PRTL_ACE_DATA AceData,
+    _In_ ULONG AceCount,
+    _In_ PSID OwnerSid,
+    _In_ PSID GroupSid,
+    _In_ BOOLEAN IsDirectoryObject,
+    _In_ PGENERIC_MAPPING GenericMapping,
+    _Out_ PSECURITY_DESCRIPTOR* NewSecurityDescriptor
+    );
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlCreateAndSetSD(
+    _In_ PRTL_ACE_DATA AceData,
+    _In_ ULONG AceCount,
+    _In_opt_ PSID OwnerSid,
+    _In_opt_ PSID GroupSid,
+    _Out_ PSECURITY_DESCRIPTOR* NewSecurityDescriptor
+    );
+
 // Misc. security

 NTSYSAPI
@@ -6717,7 +6886,7 @@ VOID
 NTAPI
 RtlRunEncodeUnicodeString(
    _Inout_ PUCHAR Seed,
-    _In_ PUNICODE_STRING String
+    _Inout_ PUNICODE_STRING String
    );

 NTSYSAPI
@@ -6725,7 +6894,7 @@ VOID
 NTAPI
 RtlRunDecodeUnicodeString(
    _In_ UCHAR Seed,
-    _In_ PUNICODE_STRING String
+    _Inout_ PUNICODE_STRING String
    );

 NTSYSAPI
@@ -6814,10 +6983,15 @@ RtlQueryValidationRunlevel(

 #if (PHNT_VERSION >= PHNT_VISTA)

+// rev
+#define BOUNDARY_DESCRIPTOR_ADD_APPCONTAINER_SID 0x0001
+
 // begin_private

+_Ret_maybenull_
+_Success_(return != NULL)
 NTSYSAPI
-HANDLE
+POBJECT_BOUNDARY_DESCRIPTOR
 NTAPI
 RtlCreateBoundaryDescriptor(
    _In_ PUNICODE_STRING Name,
@@ -6828,14 +7002,14 @@ NTSYSAPI
 VOID
 NTAPI
 RtlDeleteBoundaryDescriptor(
-    _In_ HANDLE BoundaryDescriptor
+    _In_ _Post_invalid_ POBJECT_BOUNDARY_DESCRIPTOR BoundaryDescriptor
    );

 NTSYSAPI
 NTSTATUS
 NTAPI
 RtlAddSIDToBoundaryDescriptor(
-    _Inout_ PHANDLE BoundaryDescriptor,
+    _Inout_ POBJECT_BOUNDARY_DESCRIPTOR *BoundaryDescriptor,
    _In_ PSID RequiredSid
    );

@@ -6845,7 +7019,7 @@ NTSYSAPI
 NTSTATUS
 NTAPI
 RtlAddIntegrityLabelToBoundaryDescriptor(
-    _Inout_ PHANDLE BoundaryDescriptor,
+    _Inout_ POBJECT_BOUNDARY_DESCRIPTOR *BoundaryDescriptor,
    _In_ PSID IntegrityLabel
    );
 #endif
@@ -6892,7 +7066,6 @@ RtlGetNtGlobalFlags(
    VOID
    );

-#if (PHNT_VERSION >= PHNT_REDSTONE)
 // rev
 NTSYSAPI
 BOOLEAN
@@ -6900,9 +7073,8 @@ NTAPI
 RtlGetNtProductType(
    _Out_ PNT_PRODUCT_TYPE NtProductType
    );
-#endif

-#if (PHNT_VERSION >= PHNT_REDSTONE2)
+#if (PHNT_VERSION >= PHNT_REDSTONE)
 // private
 NTSYSAPI
 ULONG
@@ -6933,12 +7105,14 @@ RtlDeregisterWait(
    _In_ HANDLE WaitHandle
    );

+#define RTL_WAITER_DEREGISTER_WAIT_FOR_COMPLETION ((HANDLE)(LONG_PTR)-1)
+
 NTSYSAPI
 NTSTATUS
 NTAPI
 RtlDeregisterWaitEx(
    _In_ HANDLE WaitHandle,
-    _In_ HANDLE Event
+    _In_opt_ HANDLE Event // optional: RTL_WAITER_DEREGISTER_WAIT_FOR_COMPLETION
    );

 NTSYSAPI
@@ -6993,6 +7167,16 @@ LdrInitializeThunk(
    _In_ PVOID Parameter
    );

+// Thread execution
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+RtlDelayExecution(
+    _In_ BOOLEAN Alertable,
+    _In_opt_ PLARGE_INTEGER DelayInterval
+    );
+
 // Timer support

 NTSYSAPI
@@ -7025,13 +7209,15 @@ RtlUpdateTimer(
    _In_ ULONG Period
    );

+#define RTL_TIMER_DELETE_WAIT_FOR_COMPLETION ((HANDLE)(LONG_PTR)-1)
+
 NTSYSAPI
 NTSTATUS
 NTAPI
 RtlDeleteTimer(
    _In_ HANDLE TimerQueueHandle,
    _In_ HANDLE TimerToCancel,
-    _In_opt_ HANDLE Event
+    _In_opt_ HANDLE Event // optional: RTL_TIMER_DELETE_WAIT_FOR_COMPLETION
    );

 NTSYSAPI
@@ -7046,7 +7232,7 @@ NTSTATUS
 NTAPI
 RtlDeleteTimerQueueEx(
    _In_ HANDLE TimerQueueHandle,
-    _In_ HANDLE Event
+    _In_opt_ HANDLE Event
    );

 // Registry access
@@ -7588,6 +7774,7 @@ typedef enum _IMAGE_MITIGATION_POLICY
    ImageChildProcessPolicy, // RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY
    ImageSehopPolicy, // RTL_IMAGE_MITIGATION_SEHOP_POLICY
    ImageHeapPolicy, // RTL_IMAGE_MITIGATION_HEAP_POLICY
+    ImageUserShadowStackPolicy, // RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY
    MaxImageMitigationPolicy
 } IMAGE_MITIGATION_POLICY;

@@ -7706,13 +7893,27 @@ typedef struct _RTL_IMAGE_MITIGATION_HEAP_POLICY
    RTL_IMAGE_MITIGATION_POLICY TerminateOnHeapErrors;
 } RTL_IMAGE_MITIGATION_HEAP_POLICY, *PRTL_IMAGE_MITIGATION_HEAP_POLICY;

+// rev
+typedef struct _RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY
+{
+    RTL_IMAGE_MITIGATION_POLICY UserShadowStack;
+    RTL_IMAGE_MITIGATION_POLICY SetContextIpValidation;
+    RTL_IMAGE_MITIGATION_POLICY BlockNonCetBinaries;
+} RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY, *PRTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY;
+
 typedef enum _RTL_IMAGE_MITIGATION_OPTION_STATE
 {
    RtlMitigationOptionStateNotConfigured,
    RtlMitigationOptionStateOn,
-    RtlMitigationOptionStateOff
+    RtlMitigationOptionStateOff,
+    RtlMitigationOptionStateForce,
+    RtlMitigationOptionStateOption
 } RTL_IMAGE_MITIGATION_OPTION_STATE;

+#define RTL_IMAGE_MITIGATION_OPTION_STATEMASK 3UL
+#define RTL_IMAGE_MITIGATION_OPTION_FORCEMASK 4UL
+#define RTL_IMAGE_MITIGATION_OPTION_OPTIONMASK 8UL
+
 // rev from PROCESS_MITIGATION_FLAGS
 #define RTL_IMAGE_MITIGATION_FLAG_RESET 0x1
 #define RTL_IMAGE_MITIGATION_FLAG_REMOVE 0x2
@@ -7875,6 +8076,14 @@ RtlIsParentOfChildAppContainer(
    _In_ PSID ChildAppContainerSid
    );

+// rev
+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlIsApiSetImplemented(
+    _In_ PCSTR Namespace
+    );
+
 // rev
 NTSYSAPI
 BOOLEAN
@@ -8131,25 +8340,78 @@ typedef enum _RTL_BSD_ITEM_TYPE
 {
    RtlBsdItemVersionNumber, // q; s: ULONG
    RtlBsdItemProductType, // q; s: NT_PRODUCT_TYPE (ULONG)
-    RtlBsdItemAabEnabled, // q: s: BOOLEAN
-    RtlBsdItemAabTimeout, // q: s: UCHAR
-    RtlBsdItemBootGood, // q: s: BOOLEAN
-    RtlBsdItemBootShutdown, // q: s: BOOLEAN
-    RtlBsdSleepInProgress, // q: s: BOOLEAN
-    RtlBsdPowerTransition,
-    RtlBsdItemBootAttemptCount, // q: s: UCHAR
-    RtlBsdItemBootCheckpoint, // q: s: UCHAR
+    RtlBsdItemAabEnabled, // q: s: BOOLEAN // AutoAdvancedBoot
+    RtlBsdItemAabTimeout, // q: s: UCHAR // AdvancedBootMenuTimeout
+    RtlBsdItemBootGood, // q: s: BOOLEAN // LastBootSucceeded
+    RtlBsdItemBootShutdown, // q: s: BOOLEAN // LastBootShutdown
+    RtlBsdSleepInProgress, // q: s: BOOLEAN // SleepInProgress
+    RtlBsdPowerTransition, // q: s: RTL_BSD_DATA_POWER_TRANSITION
+    RtlBsdItemBootAttemptCount, // q: s: UCHAR // BootAttemptCount
+    RtlBsdItemBootCheckpoint, // q: s: UCHAR // LastBootCheckpoint
    RtlBsdItemBootId, // q; s: ULONG (USER_SHARED_DATA->BootId)
    RtlBsdItemShutdownBootId, // q; s: ULONG
    RtlBsdItemReportedAbnormalShutdownBootId, // q; s: ULONG
-    RtlBsdItemErrorInfo,
-    RtlBsdItemPowerButtonPressInfo,
+    RtlBsdItemErrorInfo, // RTL_BSD_DATA_ERROR_INFO
+    RtlBsdItemPowerButtonPressInfo, // RTL_BSD_POWER_BUTTON_PRESS_INFO
    RtlBsdItemChecksum, // q: s: UCHAR
    RtlBsdPowerTransitionExtension,
    RtlBsdItemFeatureConfigurationState, // q; s: ULONG
    RtlBsdItemMax
 } RTL_BSD_ITEM_TYPE;

+// ros
+typedef struct _RTL_BSD_DATA_POWER_TRANSITION
+{
+    LARGE_INTEGER PowerButtonTimestamp;
+    struct
+    {
+        BOOLEAN SystemRunning : 1;
+        BOOLEAN ConnectedStandbyInProgress : 1;
+        BOOLEAN UserShutdownInProgress : 1;
+        BOOLEAN SystemShutdownInProgress : 1;
+        BOOLEAN SleepInProgress : 4;
+    } Flags;
+    UCHAR ConnectedStandbyScenarioInstanceId;
+    UCHAR ConnectedStandbyEntryReason;
+    UCHAR ConnectedStandbyExitReason;
+    USHORT SystemSleepTransitionCount;
+    LARGE_INTEGER LastReferenceTime;
+    ULONG LastReferenceTimeChecksum;
+    ULONG LastUpdateBootId;
+} RTL_BSD_DATA_POWER_TRANSITION, *PRTL_BSD_DATA_POWER_TRANSITION;
+
+// ros
+typedef struct _RTL_BSD_DATA_ERROR_INFO
+{
+    ULONG BootId;
+    ULONG RepeatCount;
+    ULONG OtherErrorCount;
+    ULONG Code;
+    ULONG OtherErrorCount2;
+} RTL_BSD_DATA_ERROR_INFO, *PRTL_BSD_DATA_ERROR_INFO;
+
+// ros
+typedef struct _RTL_BSD_POWER_BUTTON_PRESS_INFO
+{
+    LARGE_INTEGER LastPressTime;
+    ULONG CumulativePressCount;
+    USHORT LastPressBootId;
+    UCHAR LastPowerWatchdogStage;
+    struct
+    {
+        UCHAR WatchdogArmed : 1;
+        UCHAR ShutdownInProgress : 1;
+    } Flags;
+    LARGE_INTEGER LastReleaseTime;
+    ULONG CumulativeReleaseCount;
+    USHORT LastReleaseBootId;
+    USHORT ErrorCount;
+    UCHAR CurrentConnectedStandbyPhase;
+    ULONG TransitionLatestCheckpointId;
+    ULONG TransitionLatestCheckpointType;
+    ULONG TransitionLatestCheckpointSequenceNumber;
+} RTL_BSD_POWER_BUTTON_PRESS_INFO, *PRTL_BSD_POWER_BUTTON_PRESS_INFO;
+
 // private
 typedef struct _RTL_BSD_ITEM
 {
@@ -8204,6 +8466,22 @@ RtlCheckBootStatusIntegrity(
    _Out_ PBOOLEAN Verified
    );

+// rev
+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlRestoreBootStatusDefaults(
+    _In_ HANDLE FileHandle
+    );
+
+// rev
+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlRestoreSystemBootStatusDefaults(
+    VOID
+    );
+
 #if (PHNT_VERSION >= PHNT_REDSTONE3)
 // rev
 NTSYSAPI
@@ -8384,7 +8662,7 @@ RtlQueryFeatureUsageNotificationSubscriptions(
    _Inout_ PULONG FeatureConfigurationCount
    );

-typedef VOID (NTAPI *PRTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICAION)(
+typedef VOID (NTAPI *PRTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION)(
    _In_opt_ PVOID Context
    );

@@ -8393,7 +8671,7 @@ NTSYSAPI
 NTSTATUS
 NTAPI
 RtlRegisterFeatureConfigurationChangeNotification(
-    _In_ PRTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICAION Callback,
+    _In_ PRTL_FEATURE_CONFIGURATION_CHANGE_NOTIFICATION Callback,
    _In_opt_ PVOID Context,
    _Inout_opt_ PULONGLONG ChangeStamp,
    _Out_ PHANDLE NotificationHandle
@@ -128,6 +128,19 @@ SamConnect(
    _In_ POBJECT_ATTRIBUTES ObjectAttributes
    );

+_Check_return_
+NTSTATUS
+NTAPI
+SamConnectWithCreds(
+    _In_ PUNICODE_STRING ServerName,
+    _Out_ PSAM_HANDLE ServerHandle,
+    _In_ ACCESS_MASK DesiredAccess,
+    _In_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_ struct _RPC_AUTH_IDENTITY_HANDLE* Creds,
+    _In_ PWCHAR Spn,
+    _Out_ BOOL* pfDstIsW2K
+    );
+
 _Check_return_
 NTSTATUS
 NTAPI
@@ -186,19 +199,19 @@ SamShutdownSamServer(

 typedef enum _DOMAIN_INFORMATION_CLASS
 {
-    DomainPasswordInformation = 1,
-    DomainGeneralInformation,
-    DomainLogoffInformation,
-    DomainOemInformation,
-    DomainNameInformation,
-    DomainReplicationInformation,
-    DomainServerRoleInformation,
-    DomainModifiedInformation,
-    DomainStateInformation,
-    DomainUasInformation,
-    DomainGeneralInformation2,
-    DomainLockoutInformation,
-    DomainModifiedInformation2
+    DomainPasswordInformation = 1, // q; s: DOMAIN_PASSWORD_INFORMATION
+    DomainGeneralInformation, // q: DOMAIN_GENERAL_INFORMATION
+    DomainLogoffInformation, // q; s: DOMAIN_LOGOFF_INFORMATION
+    DomainOemInformation, // q; s: DOMAIN_OEM_INFORMATION
+    DomainNameInformation, // q: DOMAIN_NAME_INFORMATION
+    DomainReplicationInformation, // q; s: DOMAIN_REPLICATION_INFORMATION
+    DomainServerRoleInformation, // q; s: DOMAIN_SERVER_ROLE_INFORMATION
+    DomainModifiedInformation, // q: DOMAIN_MODIFIED_INFORMATION
+    DomainStateInformation, // q; s: DOMAIN_STATE_INFORMATION
+    DomainUasInformation, // q; s: DOMAIN_UAS_INFORMATION
+    DomainGeneralInformation2, // q: DOMAIN_GENERAL_INFORMATION2
+    DomainLockoutInformation, // q; s: DOMAIN_LOCKOUT_INFORMATION
+    DomainModifiedInformation2 // q: DOMAIN_MODIFIED_INFORMATION2
 } DOMAIN_INFORMATION_CLASS;

 typedef enum _DOMAIN_SERVER_ENABLE_STATE
@@ -329,11 +342,11 @@ typedef struct _DOMAIN_LOCKOUT_INFORMATION

 typedef enum _DOMAIN_DISPLAY_INFORMATION
 {
-    DomainDisplayUser = 1,
-    DomainDisplayMachine,
-    DomainDisplayGroup,
-    DomainDisplayOemUser,
-    DomainDisplayOemGroup,
+    DomainDisplayUser = 1, // DOMAIN_DISPLAY_USER
+    DomainDisplayMachine, // DOMAIN_DISPLAY_MACHINE
+    DomainDisplayGroup, // DOMAIN_DISPLAY_GROUP
+    DomainDisplayOemUser, // DOMAIN_DISPLAY_OEM_USER
+    DomainDisplayOemGroup, // DOMAIN_DISPLAY_OEM_GROUP
    DomainDisplayServer
 } DOMAIN_DISPLAY_INFORMATION, *PDOMAIN_DISPLAY_INFORMATION;

@@ -464,6 +477,17 @@ SamLookupNamesInDomain(
    _Out_ _Deref_post_count_(Count) PSID_NAME_USE *Use
    );

+_Check_return_
+NTSTATUS
+NTAPI
+SamLookupNamesInDomain2(
+    _In_ SAM_HANDLE DomainHandle,
+    _In_ ULONG Count,
+    _In_reads_(Count) PUNICODE_STRING Names,
+    _Out_ _Deref_post_count_(Count) PSID* Sids,
+    _Out_ _Deref_post_count_(Count) PSID_NAME_USE* Use
+    );
+
 _Check_return_
 NTSTATUS
 NTAPI
@@ -530,10 +554,10 @@ typedef struct _GROUP_MEMBERSHIP

 typedef enum _GROUP_INFORMATION_CLASS
 {
-    GroupGeneralInformation = 1,
-    GroupNameInformation,
-    GroupAttributeInformation,
-    GroupAdminCommentInformation,
+    GroupGeneralInformation = 1, // q: GROUP_GENERAL_INFORMATION
+    GroupNameInformation, // q; s: GROUP_NAME_INFORMATION
+    GroupAttributeInformation, // q; s: GROUP_ATTRIBUTE_INFORMATION
+    GroupAdminCommentInformation, // q; s: GROUP_ADM_COMMENT_INFORMATION
    GroupReplicationInformation
 } GROUP_INFORMATION_CLASS;

@@ -685,9 +709,9 @@ SamSetMemberAttributesOfGroup(

 typedef enum _ALIAS_INFORMATION_CLASS
 {
-    AliasGeneralInformation = 1,
-    AliasNameInformation,
-    AliasAdminCommentInformation,
+    AliasGeneralInformation = 1, // q: ALIAS_GENERAL_INFORMATION
+    AliasNameInformation, // q; s: ALIAS_NAME_INFORMATION
+    AliasAdminCommentInformation, // q; s: ALIAS_ADM_COMMENT_INFORMATION
    AliasReplicationInformation,
    AliasExtendedInformation,
 } ALIAS_INFORMATION_CLASS;
@@ -912,7 +936,7 @@ SamGetAliasMembership(
 #define USER_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (0x00040000)
 #define USER_NO_AUTH_DATA_REQUIRED (0x00080000)
 #define USER_PARTIAL_SECRETS_ACCOUNT (0x00100000)
-#define USER_USE_AES_KEYS (0x00200000) // not used
+#define USER_USE_AES_KEYS (0x00200000)

 #define NEXT_FREE_ACCOUNT_CONTROL_BIT (USER_USE_AES_KEYS << 1)

@@ -968,35 +992,38 @@ typedef struct _SR_SECURITY_DESCRIPTOR

 typedef enum _USER_INFORMATION_CLASS
 {
-    UserGeneralInformation = 1, // USER_GENERAL_INFORMATION
-    UserPreferencesInformation, // USER_PREFERENCES_INFORMATION
-    UserLogonInformation, // USER_LOGON_INFORMATION
-    UserLogonHoursInformation, // USER_LOGON_HOURS_INFORMATION
-    UserAccountInformation, // USER_ACCOUNT_INFORMATION
-    UserNameInformation, // USER_NAME_INFORMATION
-    UserAccountNameInformation, // USER_ACCOUNT_NAME_INFORMATION
-    UserFullNameInformation, // USER_FULL_NAME_INFORMATION
-    UserPrimaryGroupInformation, // USER_PRIMARY_GROUP_INFORMATION
-    UserHomeInformation, // USER_HOME_INFORMATION
-    UserScriptInformation, // USER_SCRIPT_INFORMATION
-    UserProfileInformation, // USER_PROFILE_INFORMATION
-    UserAdminCommentInformation, // USER_ADMIN_COMMENT_INFORMATION
-    UserWorkStationsInformation, // USER_WORKSTATIONS_INFORMATION
-    UserSetPasswordInformation, // USER_SET_PASSWORD_INFORMATION
-    UserControlInformation, // USER_CONTROL_INFORMATION
-    UserExpiresInformation, // USER_EXPIRES_INFORMATION
-    UserInternal1Information,
-    UserInternal2Information,
-    UserParametersInformation, // USER_PARAMETERS_INFORMATION
+    UserGeneralInformation = 1, // q: USER_GENERAL_INFORMATION
+    UserPreferencesInformation, // q; s: USER_PREFERENCES_INFORMATION
+    UserLogonInformation, // q: USER_LOGON_INFORMATION
+    UserLogonHoursInformation, // q; s: USER_LOGON_HOURS_INFORMATION
+    UserAccountInformation, // q: USER_ACCOUNT_INFORMATION
+    UserNameInformation, // q; s: USER_NAME_INFORMATION
+    UserAccountNameInformation, // q; s: USER_ACCOUNT_NAME_INFORMATION
+    UserFullNameInformation, // q; s: USER_FULL_NAME_INFORMATION
+    UserPrimaryGroupInformation, // q; s: USER_PRIMARY_GROUP_INFORMATION
+    UserHomeInformation, // q; s: USER_HOME_INFORMATION // 10
+    UserScriptInformation, // q; s: USER_SCRIPT_INFORMATION
+    UserProfileInformation, // q; s: USER_PROFILE_INFORMATION
+    UserAdminCommentInformation, // q; s: USER_ADMIN_COMMENT_INFORMATION
+    UserWorkStationsInformation, // q; s: USER_WORKSTATIONS_INFORMATION
+    UserSetPasswordInformation, // s: USER_SET_PASSWORD_INFORMATION
+    UserControlInformation, // q; s: USER_CONTROL_INFORMATION
+    UserExpiresInformation, // q; s: USER_EXPIRES_INFORMATION
+    UserInternal1Information, // USER_INTERNAL1_INFORMATION
+    UserInternal2Information, // USER_INTERNAL2_INFORMATION
+    UserParametersInformation, // q; s: USER_PARAMETERS_INFORMATION // 20
    UserAllInformation, // USER_ALL_INFORMATION
-    UserInternal3Information,
-    UserInternal4Information,
-    UserInternal5Information,
-    UserInternal4InformationNew,
-    UserInternal5InformationNew,
-    UserInternal6Information,
+    UserInternal3Information, // USER_INTERNAL3_INFORMATION
+    UserInternal4Information, // USER_INTERNAL4_INFORMATION
+    UserInternal5Information, // USER_INTERNAL5_INFORMATION
+    UserInternal4InformationNew, // USER_INTERNAL4_INFORMATION_NEW
+    UserInternal5InformationNew, // USER_INTERNAL5_INFORMATION_NEW
+    UserInternal6Information, // USER_INTERNAL6_INFORMATION
    UserExtendedInformation, // USER_EXTENDED_INFORMATION
-    UserLogonUIInformation // USER_LOGON_UI_INFORMATION
+    UserLogonUIInformation, // USER_LOGON_UI_INFORMATION
+    UserUnknownTodoInformation,
+    UserInternal7Information, // USER_INTERNAL7_INFORMATION
+    UserInternal8Information, // USER_INTERNAL8_INFORMATION
 } USER_INFORMATION_CLASS, *PUSER_INFORMATION_CLASS;

 typedef struct _USER_GENERAL_INFORMATION
@@ -1132,6 +1159,41 @@ typedef struct _USER_EXPIRES_INFORMATION
    LARGE_INTEGER AccountExpires;
 } USER_EXPIRES_INFORMATION, *PUSER_EXPIRES_INFORMATION;

+#define CYPHER_BLOCK_LENGTH 8
+
+typedef struct _CYPHER_BLOCK
+{
+    CHAR data[CYPHER_BLOCK_LENGTH];
+} CYPHER_BLOCK, *PCYPHER_BLOCK;
+
+typedef struct _ENCRYPTED_NT_OWF_PASSWORD
+{
+    CYPHER_BLOCK data[2];
+} ENCRYPTED_NT_OWF_PASSWORD, *PENCRYPTED_NT_OWF_PASSWORD;
+
+typedef struct _ENCRYPTED_LM_OWF_PASSWORD
+{
+    CYPHER_BLOCK data[2];
+} ENCRYPTED_LM_OWF_PASSWORD, *PENCRYPTED_LM_OWF_PASSWORD;
+
+typedef struct _USER_INTERNAL1_INFORMATION
+{
+    ENCRYPTED_NT_OWF_PASSWORD EncryptedNtOwfPassword;
+    ENCRYPTED_LM_OWF_PASSWORD EncryptedLmOwfPassword;
+    BOOLEAN NtPasswordPresent;
+    BOOLEAN LmPasswordPresent;
+    BOOLEAN PasswordExpired;
+} USER_INTERNAL1_INFORMATION, *PUSER_INTERNAL1_INFORMATION;
+
+typedef struct _USER_INTERNAL2_INFORMATION
+{
+    ULONG StatisticsToApply;
+    LARGE_INTEGER LastLogon;
+    LARGE_INTEGER LastLogoff;
+    USHORT BadPasswordCount;
+    USHORT LogonCount;
+} USER_INTERNAL2_INFORMATION, *PUSER_INTERNAL2_INFORMATION;
+
 typedef struct _USER_PARAMETERS_INFORMATION
 {
    UNICODE_STRING Parameters;
@@ -1316,6 +1378,68 @@ typedef struct _USER_ALL_INFORMATION
 } USER_ALL_INFORMATION, *PUSER_ALL_INFORMATION;
 #include <poppack.h>

+#include <pshpack4.h>
+typedef struct _USER_INTERNAL3_INFORMATION
+{
+    USER_ALL_INFORMATION I1;
+    LARGE_INTEGER LastBadPasswordTime;
+} USER_INTERNAL3_INFORMATION, *PUSER_INTERNAL3_INFORMATION;
+#include <poppack.h>
+
+typedef struct _ENCRYPTED_USER_PASSWORD
+{
+    UCHAR Buffer[(SAM_MAX_PASSWORD_LENGTH * 2) + 4];
+} ENCRYPTED_USER_PASSWORD, *PENCRYPTED_USER_PASSWORD;
+
+typedef struct _USER_INTERNAL4_INFORMATION
+{
+    USER_ALL_INFORMATION I1;
+    ENCRYPTED_USER_PASSWORD UserPassword;
+} USER_INTERNAL4_INFORMATION, *PUSER_INTERNAL4_INFORMATION;
+
+typedef struct _USER_INTERNAL5_INFORMATION
+{
+    ENCRYPTED_USER_PASSWORD UserPassword;
+    BOOLEAN PasswordExpired;
+} USER_INTERNAL5_INFORMATION, *PUSER_INTERNAL5_INFORMATION;
+
+typedef struct _ENCRYPTED_USER_PASSWORD_NEW
+{
+    UCHAR Buffer[(SAM_MAX_PASSWORD_LENGTH * 2) + 4 + SAM_PASSWORD_ENCRYPTION_SALT_LEN];
+} ENCRYPTED_USER_PASSWORD_NEW, *PENCRYPTED_USER_PASSWORD_NEW;
+
+typedef struct _USER_INTERNAL4_INFORMATION_NEW
+{
+    USER_ALL_INFORMATION I1;
+    ENCRYPTED_USER_PASSWORD_NEW UserPassword;
+} USER_INTERNAL4_INFORMATION_NEW, *PUSER_INTERNAL4_INFORMATION_NEW;
+
+typedef struct _USER_INTERNAL5_INFORMATION_NEW
+{
+    ENCRYPTED_USER_PASSWORD_NEW UserPassword;
+    BOOLEAN PasswordExpired;
+} USER_INTERNAL5_INFORMATION_NEW, *PUSER_INTERNAL5_INFORMATION_NEW;
+
+typedef struct _USER_ALLOWED_TO_DELEGATE_TO_LIST
+{
+    ULONG Size;
+    ULONG NumSPNs;
+    UNICODE_STRING SPNList[ANYSIZE_ARRAY];
+} USER_ALLOWED_TO_DELEGATE_TO_LIST, *PUSER_ALLOWED_TO_DELEGATE_TO_LIST; 
+
+#define USER_EXTENDED_FIELD_UPN 0x00000001L
+#define USER_EXTENDED_FIELD_A2D2 0x00000002L
+
+typedef struct _USER_INTERNAL6_INFORMATION
+{
+    USER_ALL_INFORMATION I1;
+    LARGE_INTEGER LastBadPasswordTime;
+    ULONG ExtendedFields;
+    BOOLEAN UPNDefaulted;
+    UNICODE_STRING UPN;
+    PUSER_ALLOWED_TO_DELEGATE_TO_LIST A2D2List;
+} USER_INTERNAL6_INFORMATION, *PUSER_INTERNAL6_INFORMATION;
+
 typedef SAM_BYTE_ARRAY_32K SAM_USER_TILE, *PSAM_USER_TILE;

 // 0xff000fff is reserved for internal callers and implementation.
@@ -1341,6 +1465,27 @@ typedef struct _USER_LOGON_UI_INFORMATION
    BOOLEAN AccountIsDisabled;
 } USER_LOGON_UI_INFORMATION, *PUSER_LOGON_UI_INFORMATION;

+typedef struct _ENCRYPTED_PASSWORD_AES
+{
+    UCHAR AuthData[64];
+    UCHAR Salt[SAM_PASSWORD_ENCRYPTION_SALT_LEN];
+    ULONG cbCipher;
+    PUCHAR Cipher;
+    ULONGLONG PBKDF2Iterations;
+} ENCRYPTED_PASSWORD_AES, *PENCRYPTED_PASSWORD_AES;
+
+typedef struct _USER_INTERNAL7_INFORMATION
+{
+    ENCRYPTED_PASSWORD_AES UserPassword;
+    BOOLEAN PasswordExpired;
+} USER_INTERNAL7_INFORMATION, *PUSER_INTERNAL7_INFORMATION;
+
+typedef struct _USER_INTERNAL8_INFORMATION
+{
+    USER_ALL_INFORMATION I1;
+    ENCRYPTED_PASSWORD_AES UserPassword;
+} USER_INTERNAL8_INFORMATION, *PUSER_INTERNAL8_INFORMATION;
+
 // SamChangePasswordUser3 types

 // Error values:
@@ -1493,7 +1638,7 @@ SamQueryDisplayInformation(
    _In_ ULONG Index,
    _In_ ULONG EntryCount,
    _In_ ULONG PreferredMaximumLength,
-    _In_ PULONG TotalAvailable,
+    _Out_ PULONG TotalAvailable,
    _Out_ PULONG TotalReturned,
    _Out_ PULONG ReturnedEntryCount,
    _Outptr_ PVOID *SortedBuffer
@@ -57,6 +57,61 @@

 // begin_rev

+#if (PHNT_MODE == PHNT_MODE_KERNEL)
+typedef enum _TOKEN_INFORMATION_CLASS
+{
+    TokenUser = 1, // q: TOKEN_USER
+    TokenGroups, // q: TOKEN_GROUPS
+    TokenPrivileges, // q: TOKEN_PRIVILEGES
+    TokenOwner, // q; s: TOKEN_OWNER
+    TokenPrimaryGroup, // q; s: TOKEN_PRIMARY_GROUP
+    TokenDefaultDacl, // q; s: TOKEN_DEFAULT_DACL
+    TokenSource, // q: TOKEN_SOURCE
+    TokenType, // q: TOKEN_TYPE
+    TokenImpersonationLevel, // q: SECURITY_IMPERSONATION_LEVEL
+    TokenStatistics, // q: TOKEN_STATISTICS // 10
+    TokenRestrictedSids, // q: TOKEN_GROUPS
+    TokenSessionId, // q; s: ULONG (requires SeTcbPrivilege)
+    TokenGroupsAndPrivileges, // q: TOKEN_GROUPS_AND_PRIVILEGES
+    TokenSessionReference, // s: ULONG (requires SeTcbPrivilege)
+    TokenSandBoxInert, // q: ULONG
+    TokenAuditPolicy, // q; s: TOKEN_AUDIT_POLICY (requires SeSecurityPrivilege/SeTcbPrivilege)
+    TokenOrigin, // q; s: TOKEN_ORIGIN (requires SeTcbPrivilege)
+    TokenElevationType, // q: TOKEN_ELEVATION_TYPE
+    TokenLinkedToken, // q; s: TOKEN_LINKED_TOKEN (requires SeCreateTokenPrivilege)
+    TokenElevation, // q: TOKEN_ELEVATION // 20
+    TokenHasRestrictions, // q: ULONG
+    TokenAccessInformation, // q: TOKEN_ACCESS_INFORMATION
+    TokenVirtualizationAllowed, // q; s: ULONG (requires SeCreateTokenPrivilege)
+    TokenVirtualizationEnabled, // q; s: ULONG
+    TokenIntegrityLevel, // q; s: TOKEN_MANDATORY_LABEL
+    TokenUIAccess, // q; s: ULONG
+    TokenMandatoryPolicy, // q; s: TOKEN_MANDATORY_POLICY (requires SeTcbPrivilege)
+    TokenLogonSid, // q: TOKEN_GROUPS
+    TokenIsAppContainer, // q: ULONG
+    TokenCapabilities, // q: TOKEN_GROUPS // 30
+    TokenAppContainerSid, // q: TOKEN_APPCONTAINER_INFORMATION
+    TokenAppContainerNumber, // q: ULONG
+    TokenUserClaimAttributes, // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION
+    TokenDeviceClaimAttributes, // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION
+    TokenRestrictedUserClaimAttributes, // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION
+    TokenRestrictedDeviceClaimAttributes, // q: CLAIM_SECURITY_ATTRIBUTES_INFORMATION
+    TokenDeviceGroups, // q: TOKEN_GROUPS
+    TokenRestrictedDeviceGroups, // q: TOKEN_GROUPS
+    TokenSecurityAttributes, // q; s: TOKEN_SECURITY_ATTRIBUTES_[AND_OPERATION_]INFORMATION
+    TokenIsRestricted, // q: ULONG // 40
+    TokenProcessTrustLevel, // q: TOKEN_PROCESS_TRUST_LEVEL
+    TokenPrivateNameSpace, // q; s: ULONG
+    TokenSingletonAttributes, // q: TOKEN_SECURITY_ATTRIBUTES_INFORMATION
+    TokenBnoIsolation, // q: TOKEN_BNO_ISOLATION_INFORMATION
+    TokenChildProcessFlags, // s: ULONG
+    TokenIsLessPrivilegedAppContainer, // q: ULONG
+    TokenIsSandboxed, // q: ULONG
+    TokenIsAppSilo, // TokenOriginatingProcessTrustLevel // q: TOKEN_PROCESS_TRUST_LEVEL
+    MaxTokenInfoClass
+} TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS;
+#endif
+
 // Types

 #define TOKEN_SECURITY_ATTRIBUTE_TYPE_INVALID 0x00
@@ -139,6 +194,23 @@ typedef struct _TOKEN_SECURITY_ATTRIBUTES_INFORMATION
    } Attribute;
 } TOKEN_SECURITY_ATTRIBUTES_INFORMATION, *PTOKEN_SECURITY_ATTRIBUTES_INFORMATION;

+// private
+typedef enum _TOKEN_SECURITY_ATTRIBUTE_OPERATION
+{
+    TOKEN_SECURITY_ATTRIBUTE_OPERATION_NONE,
+    TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE_ALL,
+    TOKEN_SECURITY_ATTRIBUTE_OPERATION_ADD,
+    TOKEN_SECURITY_ATTRIBUTE_OPERATION_DELETE,
+    TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE
+} TOKEN_SECURITY_ATTRIBUTE_OPERATION, *PTOKEN_SECURITY_ATTRIBUTE_OPERATION;
+
+// private
+typedef struct _TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION
+{
+    PTOKEN_SECURITY_ATTRIBUTES_INFORMATION Attributes;
+    PTOKEN_SECURITY_ATTRIBUTE_OPERATION Operations;
+} TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION, *PTOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION;
+
 // rev
 typedef struct _TOKEN_PROCESS_TRUST_LEVEL
 {
@@ -154,7 +226,7 @@ NtCreateToken(
    _Out_ PHANDLE TokenHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
-    _In_ TOKEN_TYPE TokenType,
+    _In_ TOKEN_TYPE Type,
    _In_ PLUID AuthenticationId,
    _In_ PLARGE_INTEGER ExpirationTime,
    _In_ PTOKEN_USER User,
@@ -163,7 +235,7 @@ NtCreateToken(
    _In_opt_ PTOKEN_OWNER Owner,
    _In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,
    _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,
-    _In_ PTOKEN_SOURCE TokenSource
+    _In_ PTOKEN_SOURCE Source
    );

 #if (PHNT_VERSION >= PHNT_WIN8)
@@ -191,7 +263,7 @@ NtCreateTokenEx(
    _Out_ PHANDLE TokenHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
-    _In_ TOKEN_TYPE TokenType,
+    _In_ TOKEN_TYPE Type,
    _In_ PLUID AuthenticationId,
    _In_ PLARGE_INTEGER ExpirationTime,
    _In_ PTOKEN_USER User,
@@ -200,11 +272,11 @@ NtCreateTokenEx(
    _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION UserAttributes,
    _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION DeviceAttributes,
    _In_opt_ PTOKEN_GROUPS DeviceGroups,
-    _In_opt_ PTOKEN_MANDATORY_POLICY TokenMandatoryPolicy,
+    _In_opt_ PTOKEN_MANDATORY_POLICY MandatoryPolicy,
    _In_opt_ PTOKEN_OWNER Owner,
    _In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,
    _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,
-    _In_ PTOKEN_SOURCE TokenSource
+    _In_ PTOKEN_SOURCE Source
    );
 #endif

@@ -256,7 +328,7 @@ NtDuplicateToken(
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
    _In_ BOOLEAN EffectiveOnly,
-    _In_ TOKEN_TYPE TokenType,
+    _In_ TOKEN_TYPE Type,
    _Out_ PHANDLE NewTokenHandle
    );

@@ -132,8 +132,8 @@ NTAPI
 NtOpenTransaction(
    _Out_ PHANDLE TransactionHandle,
    _In_ ACCESS_MASK DesiredAccess,
-    _In_ POBJECT_ATTRIBUTES ObjectAttributes,
-    _In_ LPGUID Uow,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_opt_ LPGUID Uow,
    _In_opt_ HANDLE TmHandle
    );
 #endif
@@ -259,7 +259,7 @@ TpSetTimer(
    _In_opt_ ULONG WindowLength
    );

-#if (PHNT_VERSION >= PHNT_WIN7)
+#if (PHNT_VERSION >= PHNT_WIN8)
 // winbase:SetThreadpoolTimerEx
 NTSYSAPI
 NTSTATUS
@@ -319,7 +319,7 @@ TpSetWait(
    _In_opt_ PLARGE_INTEGER Timeout
    );

-#if (PHNT_VERSION >= PHNT_WIN7)
+#if (PHNT_VERSION >= PHNT_WIN8)
 // winbase:SetThreadpoolWaitEx
 NTSYSAPI
 NTSTATUS
@@ -68,7 +68,7 @@ NTSTATUS
 NTAPI
 NtContinueEx(
    _In_ PCONTEXT ContextRecord,
-    _In_ PKCONTINUE_ARGUMENT ContinueArgument // BOOLEAN is also valid
+    _In_ PVOID ContinueArgument // PKCONTINUE_ARGUMENT and BOOLEAN are valid
    );

 //FORCEINLINE
@@ -676,6 +676,30 @@ ZwCancelWaitCompletionPacket(
    _In_ BOOLEAN RemoveSignaledPacket
    );

+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwChangeProcessState(
+    _In_ HANDLE ProcessStateChangeHandle,
+    _In_ HANDLE ProcessHandle,
+    _In_ PROCESS_STATE_CHANGE_TYPE StateChangeType,
+    _In_opt_ PVOID ExtendedInformation,
+    _In_opt_ SIZE_T ExtendedInformationLength,
+    _In_opt_ ULONG64 Reserved
+    );
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwChangeThreadState(
+    _In_ HANDLE ThreadStateChangeHandle,
+    _In_ HANDLE ThreadHandle,
+    _In_ THREAD_STATE_CHANGE_TYPE StateChangeType,
+    _In_opt_ PVOID ExtendedInformation,
+    _In_opt_ SIZE_T ExtendedInformationLength,
+    _In_opt_ ULONG64 Reserved
+    );
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -806,7 +830,7 @@ NTAPI
 ZwCreateDebugObject(
    _Out_ PHANDLE DebugObjectHandle,
    _In_ ACCESS_MASK DesiredAccess,
-    _In_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
    _In_ ULONG Flags
    );

@@ -1042,6 +1066,7 @@ NTSYSCALLAPI
 NTSTATUS
 NTAPI
 ZwCreatePartition(
+    _In_ HANDLE ParentPartitionHandle,
    _Out_ PHANDLE PartitionHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
@@ -1065,8 +1090,8 @@ NTAPI
 ZwCreatePrivateNamespace(
    _Out_ PHANDLE NamespaceHandle,
    _In_ ACCESS_MASK DesiredAccess,
-    _In_ POBJECT_ATTRIBUTES ObjectAttributes,
-    _In_ PVOID BoundaryDescriptor
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_ POBJECT_BOUNDARY_DESCRIPTOR BoundaryDescriptor
    );

 NTSYSCALLAPI
@@ -1080,7 +1105,7 @@ ZwCreateProcess(
    _In_ BOOLEAN InheritObjectTable,
    _In_opt_ HANDLE SectionHandle,
    _In_opt_ HANDLE DebugPort,
-    _In_opt_ HANDLE ExceptionPort
+    _In_opt_ HANDLE TokenHandle
    );

 NTSYSCALLAPI
@@ -1091,11 +1116,22 @@ ZwCreateProcessEx(
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
    _In_ HANDLE ParentProcess,
-    _In_ ULONG Flags,
+    _In_ ULONG Flags, // PROCESS_CREATE_FLAGS_*
    _In_opt_ HANDLE SectionHandle,
    _In_opt_ HANDLE DebugPort,
-    _In_opt_ HANDLE ExceptionPort,
-    _In_ ULONG JobMemberLevel
+    _In_opt_ HANDLE TokenHandle,
+    _Reserved_ ULONG Reserved // JobMemberLevel
+    );
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwCreateProcessStateChange(
+    _Out_ PHANDLE ProcessStateChangeHandle,
+    _In_ ACCESS_MASK DesiredAccess,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_ HANDLE ProcessHandle,
+    _In_opt_ ULONG64 Reserved
    );

 NTSYSCALLAPI
@@ -1222,6 +1258,17 @@ ZwCreateThreadEx(
    _In_opt_ PPS_ATTRIBUTE_LIST AttributeList
    );

+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwCreateThreadStateChange(
+    _Out_ PHANDLE ThreadStateChangeHandle,
+    _In_ ACCESS_MASK DesiredAccess,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_ HANDLE ThreadHandle,
+    _In_opt_ ULONG64 Reserved
+    );
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -1238,7 +1285,7 @@ NTAPI
 ZwCreateTimer2(
    _Out_ PHANDLE TimerHandle,
    _In_opt_ PVOID Reserved1,
-    _In_opt_ PVOID Reserved2,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
    _In_ ULONG Attributes,
    _In_ ACCESS_MASK DesiredAccess
    );
@@ -1250,7 +1297,7 @@ ZwCreateToken(
    _Out_ PHANDLE TokenHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
-    _In_ TOKEN_TYPE TokenType,
+    _In_ TOKEN_TYPE Type,
    _In_ PLUID AuthenticationId,
    _In_ PLARGE_INTEGER ExpirationTime,
    _In_ PTOKEN_USER User,
@@ -1259,7 +1306,7 @@ ZwCreateToken(
    _In_opt_ PTOKEN_OWNER Owner,
    _In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,
    _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,
-    _In_ PTOKEN_SOURCE TokenSource
+    _In_ PTOKEN_SOURCE Source
    );

 NTSYSCALLAPI
@@ -1269,7 +1316,7 @@ ZwCreateTokenEx(
    _Out_ PHANDLE TokenHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
-    _In_ TOKEN_TYPE TokenType,
+    _In_ TOKEN_TYPE Type,
    _In_ PLUID AuthenticationId,
    _In_ PLARGE_INTEGER ExpirationTime,
    _In_ PTOKEN_USER User,
@@ -1278,11 +1325,11 @@ ZwCreateTokenEx(
    _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION UserAttributes,
    _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION DeviceAttributes,
    _In_opt_ PTOKEN_GROUPS DeviceGroups,
-    _In_opt_ PTOKEN_MANDATORY_POLICY TokenMandatoryPolicy,
+    _In_opt_ PTOKEN_MANDATORY_POLICY MandatoryPolicy,
    _In_opt_ PTOKEN_OWNER Owner,
    _In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,
    _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,
-    _In_ PTOKEN_SOURCE TokenSource
+    _In_ PTOKEN_SOURCE Source
    );

 NTSYSCALLAPI
@@ -1536,7 +1583,7 @@ ZwDuplicateToken(
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
    _In_ BOOLEAN EffectiveOnly,
-    _In_ TOKEN_TYPE TokenType,
+    _In_ TOKEN_TYPE Type,
    _Out_ PHANDLE NewTokenHandle
    );

@@ -1827,7 +1874,7 @@ NTSYSCALLAPI
 ULONG
 NTAPI
 ZwGetCurrentProcessorNumberEx(
-    _Out_opt_ PPROCESSOR_NUMBER ProcNumber
+    _Out_opt_ PPROCESSOR_NUMBER ProcessorNumber
    );

 NTSYSCALLAPI
@@ -1863,7 +1910,7 @@ NTSTATUS
 NTAPI
 ZwGetNextThread(
    _In_ HANDLE ProcessHandle,
-    _In_ HANDLE ThreadHandle,
+    _In_opt_ HANDLE ThreadHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ ULONG HandleAttributes,
    _In_ ULONG Flags,
@@ -2047,6 +2094,20 @@ ZwLoadKey2(
    _In_ ULONG Flags
    );

+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwLoadKey3(
+    _In_ POBJECT_ATTRIBUTES TargetKey,
+    _In_ POBJECT_ATTRIBUTES SourceFile,
+    _In_ ULONG Flags,
+    _In_reads_(LoadEntryCount) PKEY_LOAD_ENTRY LoadEntries,
+    _In_ ULONG LoadEntryCount,
+    _In_opt_ ACCESS_MASK DesiredAccess,
+    _Out_opt_ PHANDLE RootHandle,
+    _Reserved_ PVOID Reserved
+    );
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -2120,8 +2181,10 @@ NTSYSCALLAPI
 NTSTATUS
 NTAPI
 ZwManagePartition(
-    _In_ MEMORY_PARTITION_INFORMATION_CLASS PartitionInformationClass,
-    _In_ PVOID PartitionInformation,
+    _In_ HANDLE TargetHandle,
+    _In_opt_ HANDLE SourceHandle,
+    _In_ PARTITION_INFORMATION_CLASS PartitionInformationClass,
+    _Inout_updates_bytes_(PartitionInformationLength) PVOID PartitionInformation,
    _In_ ULONG PartitionInformationLength
    );

@@ -2424,7 +2487,7 @@ ZwOpenPrivateNamespace(
    _Out_ PHANDLE NamespaceHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
-    _In_ PVOID BoundaryDescriptor
+    _In_ POBJECT_BOUNDARY_DESCRIPTOR BoundaryDescriptor
    );

 NTSYSCALLAPI
@@ -2549,8 +2612,8 @@ NTAPI
 ZwOpenTransaction(
    _Out_ PHANDLE TransactionHandle,
    _In_ ACCESS_MASK DesiredAccess,
-    _In_ POBJECT_ATTRIBUTES ObjectAttributes,
-    _In_ LPGUID Uow,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_opt_ LPGUID Uow,
    _In_opt_ HANDLE TmHandle
    );

@@ -3074,13 +3137,6 @@ ZwQueryPerformanceCounter(
    _Out_opt_ PLARGE_INTEGER PerformanceFrequency
    );

-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-ZwQueryPortInformationProcess(
-    VOID
-    );
-
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -3168,7 +3224,7 @@ ZwQuerySystemEnvironmentValueEx(
    _In_ LPGUID VendorGuid,
    _Out_writes_bytes_opt_(*ValueLength) PVOID Value,
    _Inout_ PULONG ValueLength,
-    _Out_opt_ PULONG Attributes
+    _Out_opt_ PULONG Attributes // EFI_VARIABLE_*
    );

 NTSYSCALLAPI
@@ -3301,6 +3357,19 @@ ZwQueueApcThreadEx(
    _In_opt_ PVOID ApcArgument3
    );

+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwQueueApcThreadEx2(
+    _In_ HANDLE ThreadHandle,
+    _In_opt_ HANDLE ReserveHandle, // NtAllocateReserveObject
+    _In_ QUEUE_USER_APC_FLAGS ApcFlags,
+    _In_ PPS_APC_ROUTINE ApcRoutine,
+    _In_opt_ PVOID ApcArgument1,
+    _In_opt_ PVOID ApcArgument2,
+    _In_opt_ PVOID ApcArgument3
+    );
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -4084,8 +4153,8 @@ ZwSetSystemEnvironmentValueEx(
    _In_ PUNICODE_STRING VariableName,
    _In_ LPGUID VendorGuid,
    _In_reads_bytes_opt_(ValueLength) PVOID Value,
-    _In_ ULONG ValueLength,
-    _In_ ULONG Attributes
+    _In_ ULONG ValueLength, // 0 = delete variable
+    _In_ ULONG Attributes // EFI_VARIABLE_*
    );

 NTSYSCALLAPI
@@ -54,6 +54,8 @@
 #define PHNT_20H1 109
 #define PHNT_20H2 110
 #define PHNT_21H1 111
+#define PHNT_21H2 112
+#define PHNT_WIN11 113

 #ifndef PHNT_MODE
 #define PHNT_MODE PHNT_MODE_USER
@@ -80,6 +82,7 @@ extern "C" {
 #include <ntldr.h>
 #include <ntexapi.h>

+#include <ntbcd.h>
 #include <ntmmapi.h>
 #include <ntobapi.h>
 #include <ntpsapi.h>
@@ -103,7 +106,6 @@ extern "C" {
 #include <nttp.h>
 #include <ntxcapi.h>

-#include <ntd3dkmt.h>
 #include <ntwow64.h>

 #include <ntlsa.h>
@@ -123,6 +123,9 @@ typedef struct _STRING
    _Field_size_bytes_part_opt_(MaximumLength, Length) PCHAR Buffer;
 } STRING, *PSTRING, ANSI_STRING, *PANSI_STRING, OEM_STRING, *POEM_STRING;

+typedef STRING UTF8_STRING;
+typedef PSTRING PUTF8_STRING;
+
 typedef const STRING *PCSTRING;
 typedef const ANSI_STRING *PCANSI_STRING;
 typedef const OEM_STRING *PCOEM_STRING;
@@ -621,13 +621,17 @@ typedef enum _SHADOWSTATECLASS
    State_Shadowed // The session is being shadowed by a different session. The current session is referred to as a shadow target.
 } SHADOWSTATECLASS;

+#define PROTOCOL_CONSOLE 0
+#define PROTOCOL_OTHERS 1
+#define PROTOCOL_RDP 2
+
 // Retrieves the current shadow state of a session.
 typedef struct _WINSTATIONSHADOW
 {
    SHADOWSTATECLASS ShadowState; // Specifies the current state of shadowing.
    SHADOWCLASS ShadowClass; // Specifies the type of shadowing.
    ULONG SessionId; // Specifies the session ID of the session.
-    ULONG ProtocolType; // Specifies the type of protocol on the session. Can be one of the following values.
+    ULONG ProtocolType; // Specifies the type of protocol on the session. Can be one of PROTOCOL_* values.
 } WINSTATIONSHADOW, *PWINSTATIONSHADOW;

 // Retrieves the client product ID and current product ID of the session.
@@ -827,7 +831,7 @@ WinStationFreeMemory(
 HANDLE
 WINAPI
 WinStationOpenServerW(
-    _In_ PWSTR ServerName
+    _In_opt_ PWSTR ServerName
    );

 // rev