diff --git a/ntdbg.h b/ntdbg.h
index 9ae786d..23fca78 100644
--- a/ntdbg.h
+++ b/ntdbg.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
@@ -272,7 +272,7 @@ NtWaitForDebugEvent(
     _In_ HANDLE DebugObjectHandle,
     _In_ BOOLEAN Alertable,
     _In_opt_ PLARGE_INTEGER Timeout,
-    _Out_ PVOID WaitStateChange
+    _Out_ PDBGUI_WAIT_STATE_CHANGE WaitStateChange
     );
 
 // Debugging UI
diff --git a/ntexapi.h b/ntexapi.h
index fac17d6..51c6228 100644
--- a/ntexapi.h
+++ b/ntexapi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
@@ -1027,14 +1027,14 @@ NtSetWnfProcessNotificationEvent(
 
 typedef enum _WORKERFACTORYINFOCLASS
 {
-    WorkerFactoryTimeout,
-    WorkerFactoryRetryTimeout,
-    WorkerFactoryIdleTimeout,
+    WorkerFactoryTimeout, // q; s: LARGE_INTEGER
+    WorkerFactoryRetryTimeout, // q; s: LARGE_INTEGER
+    WorkerFactoryIdleTimeout, // q; s: LARGE_INTEGER
     WorkerFactoryBindingCount,
-    WorkerFactoryThreadMinimum,
-    WorkerFactoryThreadMaximum,
-    WorkerFactoryPaused,
-    WorkerFactoryBasicInformation,
+    WorkerFactoryThreadMinimum, // q; s: ULONG
+    WorkerFactoryThreadMaximum, // q; s: ULONG
+    WorkerFactoryPaused, // ULONG or BOOLEAN
+    WorkerFactoryBasicInformation, // WORKER_FACTORY_BASIC_INFORMATION
     WorkerFactoryAdjustThreadGoal,
     WorkerFactoryCallbackType,
     WorkerFactoryStackInformation, // 10
@@ -1571,7 +1571,7 @@ typedef struct _SYSTEM_THREAD_INFORMATION
     KPRIORITY Priority;
     LONG BasePriority;
     ULONG ContextSwitches;
-    ULONG ThreadState;
+    KTHREAD_STATE ThreadState;
     KWAIT_REASON WaitReason;
 } SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
 
@@ -2458,6 +2458,21 @@ typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION
     ULONG Offsets[1];
 } SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION, *PSYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION;
 
+#define CODEINTEGRITY_OPTION_ENABLED 0x01
+#define CODEINTEGRITY_OPTION_TESTSIGN 0x02
+#define CODEINTEGRITY_OPTION_UMCI_ENABLED 0x04
+#define CODEINTEGRITY_OPTION_UMCI_AUDITMODE_ENABLED 0x08
+#define CODEINTEGRITY_OPTION_UMCI_EXCLUSIONPATHS_ENABLED 0x10
+#define CODEINTEGRITY_OPTION_TEST_BUILD 0x20
+#define CODEINTEGRITY_OPTION_PREPRODUCTION_BUILD 0x40
+#define CODEINTEGRITY_OPTION_DEBUGMODE_ENABLED 0x80
+#define CODEINTEGRITY_OPTION_FLIGHT_BUILD 0x100
+#define CODEINTEGRITY_OPTION_FLIGHTING_ENABLED 0x200
+#define CODEINTEGRITY_OPTION_HVCI_KMCI_ENABLED 0x400
+#define CODEINTEGRITY_OPTION_HVCI_KMCI_AUDITMODE_ENABLED 0x800
+#define CODEINTEGRITY_OPTION_HVCI_KMCI_STRICTMODE_ENABLED 0x1000
+#define CODEINTEGRITY_OPTION_HVCI_IUM_ENABLED 0x2000
+
 // private
 typedef struct _SYSTEM_CODEINTEGRITY_INFORMATION
 {
@@ -2854,7 +2869,19 @@ typedef struct _SYSTEM_SECUREBOOT_POLICY_INFORMATION
 // private
 typedef struct _SYSTEM_PAGEFILE_INFORMATION_EX
 {
-    SYSTEM_PAGEFILE_INFORMATION Info;
+    union // HACK union declaration for convenience (dmex)
+    {
+        SYSTEM_PAGEFILE_INFORMATION Info;
+        struct
+        {
+            ULONG NextEntryOffset;
+            ULONG TotalSize;
+            ULONG TotalInUse;
+            ULONG PeakUsage;
+            UNICODE_STRING PageFileName;
+        };
+    };
+
     ULONG MinimumSize;
     ULONG MaximumSize;
 } SYSTEM_PAGEFILE_INFORMATION_EX, *PSYSTEM_PAGEFILE_INFORMATION_EX;
@@ -3360,7 +3387,10 @@ typedef struct _SYSTEM_SPECULATION_CONTROL_INFORMATION
             ULONG HvL1tfMigitationNotEnabled_LoadOption : 1;
             ULONG HvL1tfMigitationNotEnabled_CoreScheduler : 1;
             ULONG EnhancedIbrsReported : 1;
-            ULONG Reserved : 8;
+            ULONG MdsHardwareProtected : 1; // since 19H2
+            ULONG MbClearEnabled : 1;
+            ULONG MbClearReported : 1;
+            ULONG Reserved : 5;
         };
     };
 } SYSTEM_SPECULATION_CONTROL_INFORMATION, *PSYSTEM_SPECULATION_CONTROL_INFORMATION;
diff --git a/ntgdi.h b/ntgdi.h
index 23461ed..e657d4d 100644
--- a/ntgdi.h
+++ b/ntgdi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/ntioapi.h b/ntioapi.h
index a1e4b39..c0bf1f1 100644
--- a/ntioapi.h
+++ b/ntioapi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
@@ -249,15 +249,15 @@ typedef enum _FILE_INFORMATION_CLASS
     FileHardLinkFullIdInformation, // FILE_LINK_ENTRY_FULL_ID_INFORMATION
     FileIdExtdBothDirectoryInformation, // FILE_ID_EXTD_BOTH_DIR_INFORMATION // since THRESHOLD
     FileDispositionInformationEx, // FILE_DISPOSITION_INFO_EX // since REDSTONE
-    FileRenameInformationEx, // FILE_RENAME_INFORMATION
-    FileRenameInformationExBypassAccessCheck, // FILE_RENAME_INFORMATION
+    FileRenameInformationEx, // FILE_RENAME_INFORMATION_EX
+    FileRenameInformationExBypassAccessCheck, // (kernel-mode only); FILE_RENAME_INFORMATION_EX
     FileDesiredStorageClassInformation, // FILE_DESIRED_STORAGE_CLASS_INFORMATION // since REDSTONE2
     FileStatInformation, // FILE_STAT_INFORMATION
     FileMemoryPartitionInformation, // FILE_MEMORY_PARTITION_INFORMATION // since REDSTONE3
     FileStatLxInformation, // FILE_STAT_LX_INFORMATION // since REDSTONE4 // 70
     FileCaseSensitiveInformation, // FILE_CASE_SENSITIVE_INFORMATION
-    FileLinkInformationEx, // FILE_LINK_INFORMATION // since REDSTONE5
-    FileLinkInformationExBypassAccessCheck, // FILE_LINK_INFORMATION
+    FileLinkInformationEx, // FILE_LINK_INFORMATION_EX // since REDSTONE5
+    FileLinkInformationExBypassAccessCheck, // (kernel-mode only); FILE_LINK_INFORMATION_EX
     FileStorageReserveIdInformation, // FILE_SET_STORAGE_RESERVE_ID_INFORMATION
     FileCaseSensitiveInformationForceAccessCheck, // FILE_CASE_SENSITIVE_INFORMATION
     FileMaximumInformation
@@ -398,6 +398,30 @@ typedef struct _FILE_LINK_INFORMATION
     WCHAR FileName[1];
 } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
 
+#if (PHNT_VERSION >= PHNT_REDSTONE5)
+#define FILE_LINK_REPLACE_IF_EXISTS 0x00000001
+#define FILE_LINK_POSIX_SEMANTICS 0x00000002
+#define FILE_LINK_SUPPRESS_STORAGE_RESERVE_INHERITANCE 0x00000008
+#define FILE_LINK_NO_INCREASE_AVAILABLE_SPACE 0x00000010
+#define FILE_LINK_NO_DECREASE_AVAILABLE_SPACE 0x00000020
+#define FILE_LINK_PRESERVE_AVAILABLE_SPACE 0x00000030
+#define FILE_LINK_IGNORE_READONLY_ATTRIBUTE 0x00000040
+#endif
+
+#if (PHNT_VERSION >= PHNT_19H1)
+#define FILE_LINK_FORCE_RESIZE_TARGET_SR 0x00000080
+#define FILE_LINK_FORCE_RESIZE_SOURCE_SR 0x00000100
+#define FILE_LINK_FORCE_RESIZE_SR 0x00000180
+#endif
+
+typedef struct _FILE_LINK_INFORMATION_EX
+{
+    ULONG Flags;
+    HANDLE RootDirectory;
+    ULONG FileNameLength;
+    WCHAR FileName[1];
+} FILE_LINK_INFORMATION_EX, *PFILE_LINK_INFORMATION_EX;
+
 typedef struct _FILE_MOVE_CLUSTER_INFORMATION
 {
     ULONG ClusterCount;
@@ -414,6 +438,37 @@ typedef struct _FILE_RENAME_INFORMATION
     WCHAR FileName[1];
 } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
 
+#if (PHNT_VERSION >= PHNT_REDSTONE)
+#define FILE_RENAME_REPLACE_IF_EXISTS 0x00000001
+#define FILE_RENAME_POSIX_SEMANTICS 0x00000002
+#endif
+
+#if (PHNT_VERSION >= PHNT_REDSTONE3)
+#define FILE_RENAME_SUPPRESS_PIN_STATE_INHERITANCE 0x00000004
+#endif
+
+#if (PHNT_VERSION >= PHNT_REDSTONE5)
+#define FILE_RENAME_SUPPRESS_STORAGE_RESERVE_INHERITANCE 0x00000008
+#define FILE_RENAME_NO_INCREASE_AVAILABLE_SPACE 0x00000010
+#define FILE_RENAME_NO_DECREASE_AVAILABLE_SPACE 0x00000020
+#define FILE_RENAME_PRESERVE_AVAILABLE_SPACE 0x00000030
+#define FILE_RENAME_IGNORE_READONLY_ATTRIBUTE 0x00000040
+#endif
+
+#if (_WIN32_WINNT >= PHNT_19H1)
+#define FILE_RENAME_FORCE_RESIZE_TARGET_SR 0x00000080
+#define FILE_RENAME_FORCE_RESIZE_SOURCE_SR 0x00000100
+#define FILE_RENAME_FORCE_RESIZE_SR 0x00000180
+#endif
+
+typedef struct _FILE_RENAME_INFORMATION_EX
+{
+    ULONG Flags;
+    HANDLE RootDirectory;
+    ULONG FileNameLength;
+    WCHAR FileName[1];
+} FILE_RENAME_INFORMATION_EX, *PFILE_RENAME_INFORMATION_EX;
+
 typedef struct _FILE_STREAM_INFORMATION
 {
     ULONG NextEntryOffset;
@@ -1235,17 +1290,17 @@ NTSYSCALLAPI
 NTSTATUS
 NTAPI
 NtQueryDirectoryFileEx(
-	_In_ HANDLE FileHandle,
-	_In_opt_ HANDLE Event,
-	_In_opt_ PIO_APC_ROUTINE ApcRoutine,
-	_In_opt_ PVOID ApcContext,
-	_Out_ PIO_STATUS_BLOCK IoStatusBlock,
-	_Out_ PVOID FileInformation,
-	_In_ ULONG Length,
-	_In_ FILE_INFORMATION_CLASS FileInformationClass,
-	_In_ ULONG QueryFlags,
-	_In_opt_ PUNICODE_STRING FileName
-);
+    _In_ HANDLE FileHandle,
+    _In_opt_ HANDLE Event,
+    _In_opt_ PIO_APC_ROUTINE ApcRoutine,
+    _In_opt_ PVOID ApcContext,
+    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
+    _Out_ PVOID FileInformation,
+    _In_ ULONG Length,
+    _In_ FILE_INFORMATION_CLASS FileInformationClass,
+    _In_ ULONG QueryFlags,
+    _In_opt_ PUNICODE_STRING FileName
+    );
 #endif
 
 NTSYSCALLAPI
@@ -1924,4 +1979,178 @@ typedef struct _FILE_MAILSLOT_PEEK_BUFFER
     ULONG MessageLength;
 } FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER;
 
+// Mount manager FS control definitions
+
+#define MOUNTMGR_DEVICE_NAME L"\\Device\\MountPointManager"
+#define MOUNTMGRCONTROLTYPE 0x0000006D // 'm'
+#define MOUNTDEVCONTROLTYPE 0x0000004D // 'M'
+
+#define IOCTL_MOUNTMGR_CREATE_POINT                 CTL_CODE(MOUNTMGRCONTROLTYPE, 0, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_DELETE_POINTS                CTL_CODE(MOUNTMGRCONTROLTYPE, 1, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_QUERY_POINTS                 CTL_CODE(MOUNTMGRCONTROLTYPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define IOCTL_MOUNTMGR_DELETE_POINTS_DBONLY         CTL_CODE(MOUNTMGRCONTROLTYPE, 3, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_NEXT_DRIVE_LETTER            CTL_CODE(MOUNTMGRCONTROLTYPE, 4, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_AUTO_DL_ASSIGNMENTS          CTL_CODE(MOUNTMGRCONTROLTYPE, 5, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_CREATED   CTL_CODE(MOUNTMGRCONTROLTYPE, 6, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_DELETED   CTL_CODE(MOUNTMGRCONTROLTYPE, 7, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_CHANGE_NOTIFY                CTL_CODE(MOUNTMGRCONTROLTYPE, 8, METHOD_BUFFERED, FILE_READ_ACCESS)
+#define IOCTL_MOUNTMGR_KEEP_LINKS_WHEN_OFFLINE      CTL_CODE(MOUNTMGRCONTROLTYPE, 9, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+#define IOCTL_MOUNTMGR_CHECK_UNPROCESSED_VOLUMES    CTL_CODE(MOUNTMGRCONTROLTYPE, 10, METHOD_BUFFERED, FILE_READ_ACCESS)
+#define IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION  CTL_CODE(MOUNTMGRCONTROLTYPE, 11, METHOD_BUFFERED, FILE_READ_ACCESS)
+#define IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH        CTL_CODE(MOUNTMGRCONTROLTYPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS       CTL_CODE(MOUNTMGRCONTROLTYPE, 13, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define IOCTL_MOUNTDEV_QUERY_DEVICE_NAME            CTL_CODE(MOUNTDEVCONTROLTYPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+// Input structure for IOCTL_MOUNTMGR_CREATE_POINT.
+typedef struct _MOUNTMGR_CREATE_POINT_INPUT
+{
+    USHORT SymbolicLinkNameOffset;
+    USHORT SymbolicLinkNameLength;
+    USHORT DeviceNameOffset;
+    USHORT DeviceNameLength;
+} MOUNTMGR_CREATE_POINT_INPUT, *PMOUNTMGR_CREATE_POINT_INPUT;
+
+// Input structure for IOCTL_MOUNTMGR_DELETE_POINTS, IOCTL_MOUNTMGR_QUERY_POINTS, and IOCTL_MOUNTMGR_DELETE_POINTS_DBONLY.
+typedef struct _MOUNTMGR_MOUNT_POINT
+{
+    ULONG SymbolicLinkNameOffset;
+    USHORT SymbolicLinkNameLength;
+    USHORT Reserved1;
+    ULONG UniqueIdOffset;
+    USHORT UniqueIdLength;
+    USHORT Reserved2;
+    ULONG DeviceNameOffset;
+    USHORT DeviceNameLength;
+    USHORT Reserved3;
+} MOUNTMGR_MOUNT_POINT, * PMOUNTMGR_MOUNT_POINT;
+
+// Output structure for IOCTL_MOUNTMGR_DELETE_POINTS, IOCTL_MOUNTMGR_QUERY_POINTS, and IOCTL_MOUNTMGR_DELETE_POINTS_DBONLY.
+typedef struct _MOUNTMGR_MOUNT_POINTS
+{
+    ULONG Size;
+    ULONG NumberOfMountPoints;
+    MOUNTMGR_MOUNT_POINT MountPoints[1];
+} MOUNTMGR_MOUNT_POINTS, *PMOUNTMGR_MOUNT_POINTS;
+
+// Input structure for IOCTL_MOUNTMGR_NEXT_DRIVE_LETTER.
+typedef struct _MOUNTMGR_DRIVE_LETTER_TARGET
+{
+    USHORT DeviceNameLength;
+    WCHAR DeviceName[1];
+} MOUNTMGR_DRIVE_LETTER_TARGET, *PMOUNTMGR_DRIVE_LETTER_TARGET;
+
+// Output structure for IOCTL_MOUNTMGR_NEXT_DRIVE_LETTER.
+typedef struct _MOUNTMGR_DRIVE_LETTER_INFORMATION
+{
+    BOOLEAN DriveLetterWasAssigned;
+    UCHAR CurrentDriveLetter;
+} MOUNTMGR_DRIVE_LETTER_INFORMATION, *PMOUNTMGR_DRIVE_LETTER_INFORMATION;
+
+// Input structure for IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_CREATED and
+// IOCTL_MOUNTMGR_VOLUME_MOUNT_POINT_DELETED.
+typedef struct _MOUNTMGR_VOLUME_MOUNT_POINT
+{
+    USHORT SourceVolumeNameOffset;
+    USHORT SourceVolumeNameLength;
+    USHORT TargetVolumeNameOffset;
+    USHORT TargetVolumeNameLength;
+} MOUNTMGR_VOLUME_MOUNT_POINT, *PMOUNTMGR_VOLUME_MOUNT_POINT;
+
+// Input structure for IOCTL_MOUNTMGR_CHANGE_NOTIFY.
+// Output structure for IOCTL_MOUNTMGR_CHANGE_NOTIFY.
+typedef struct _MOUNTMGR_CHANGE_NOTIFY_INFO
+{
+    ULONG EpicNumber;
+} MOUNTMGR_CHANGE_NOTIFY_INFO, *PMOUNTMGR_CHANGE_NOTIFY_INFO;
+
+// Input structure for IOCTL_MOUNTMGR_KEEP_LINKS_WHEN_OFFLINE,
+// IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION,
+// IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH, and
+// IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS.
+// IOCTL_MOUNTMGR_PREPARE_VOLUME_DELETE
+// IOCTL_MOUNTMGR_CANCEL_VOLUME_DELETE
+typedef struct _MOUNTMGR_TARGET_NAME
+{
+    USHORT DeviceNameLength;
+    WCHAR DeviceName[1];
+} MOUNTMGR_TARGET_NAME, * PMOUNTMGR_TARGET_NAME;
+
+// Macro that defines what a "drive letter" mount point is.  This macro can
+// be used to scan the result from QUERY_POINTS to discover which mount points
+// are find "drive letter" mount points.
+#define MOUNTMGR_IS_DRIVE_LETTER(s) ( \
+    (s)->Length == 28 && \
+    (s)->Buffer[0] == '\\' && \
+    (s)->Buffer[1] == 'D' && \
+    (s)->Buffer[2] == 'o' && \
+    (s)->Buffer[3] == 's' && \
+    (s)->Buffer[4] == 'D' && \
+    (s)->Buffer[5] == 'e' && \
+    (s)->Buffer[6] == 'v' && \
+    (s)->Buffer[7] == 'i' && \
+    (s)->Buffer[8] == 'c' && \
+    (s)->Buffer[9] == 'e' && \
+    (s)->Buffer[10] == 's' && \
+    (s)->Buffer[11] == '\\' && \
+    (s)->Buffer[12] >= 'A' && \
+    (s)->Buffer[12] <= 'Z' && \
+    (s)->Buffer[13] == ':')
+
+// Macro that defines what a "volume name" mount point is.  This macro can
+// be used to scan the result from QUERY_POINTS to discover which mount points
+// are "volume name" mount points.
+#define MOUNTMGR_IS_VOLUME_NAME(s) ( \
+     ((s)->Length == 96 || ((s)->Length == 98 && (s)->Buffer[48] == '\\')) && \
+     (s)->Buffer[0] == '\\' && \
+     ((s)->Buffer[1] == '?' || (s)->Buffer[1] == '\\') && \
+     (s)->Buffer[2] == '?' && \
+     (s)->Buffer[3] == '\\' && \
+     (s)->Buffer[4] == 'V' && \
+     (s)->Buffer[5] == 'o' && \
+     (s)->Buffer[6] == 'l' && \
+     (s)->Buffer[7] == 'u' && \
+     (s)->Buffer[8] == 'm' && \
+     (s)->Buffer[9] == 'e' && \
+     (s)->Buffer[10] == '{' && \
+     (s)->Buffer[19] == '-' && \
+     (s)->Buffer[24] == '-' && \
+     (s)->Buffer[29] == '-' && \
+     (s)->Buffer[34] == '-' && \
+     (s)->Buffer[47] == '}')
+
+// Output structure for IOCTL_MOUNTDEV_QUERY_DEVICE_NAME.
+typedef struct _MOUNTDEV_NAME
+{
+    USHORT NameLength;
+    WCHAR Name[1];
+} MOUNTDEV_NAME, * PMOUNTDEV_NAME;
+
+// Output structure for IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH and IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS.
+typedef struct _MOUNTMGR_VOLUME_PATHS
+{
+    ULONG MultiSzLength;
+    WCHAR MultiSz[1];
+} MOUNTMGR_VOLUME_PATHS, *PMOUNTMGR_VOLUME_PATHS;
+
+#define MOUNTMGR_IS_DOS_VOLUME_NAME(s) ( \
+     MOUNTMGR_IS_VOLUME_NAME(s) && \
+     (s)->Length == 96 && \
+     (s)->Buffer[1] == '\\')
+
+#define MOUNTMGR_IS_DOS_VOLUME_NAME_WB(s) ( \
+     MOUNTMGR_IS_VOLUME_NAME(s) && \
+     (s)->Length == 98 && \
+     (s)->Buffer[1] == '\\')
+
+#define MOUNTMGR_IS_NT_VOLUME_NAME(s) ( \
+     MOUNTMGR_IS_VOLUME_NAME(s) && \
+     (s)->Length == 96 && \
+     (s)->Buffer[1] == '?')
+
+#define MOUNTMGR_IS_NT_VOLUME_NAME_WB(s) ( \
+     MOUNTMGR_IS_VOLUME_NAME(s) && \
+     (s)->Length == 98 && \
+     (s)->Buffer[1] == '?')
+
 #endif
diff --git a/ntkeapi.h b/ntkeapi.h
index 247fdd2..29f90de 100644
--- a/ntkeapi.h
+++ b/ntkeapi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/ntldr.h b/ntldr.h
index 1f19678..5282cfe 100644
--- a/ntldr.h
+++ b/ntldr.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/ntlpcapi.h b/ntlpcapi.h
index a18d39c..8f0aa5c 100644
--- a/ntlpcapi.h
+++ b/ntlpcapi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/ntmisc.h b/ntmisc.h
index 557a0c9..d947177 100644
--- a/ntmisc.h
+++ b/ntmisc.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
@@ -58,17 +58,58 @@ NtTraceEvent(
     _In_ PVOID Fields
     );
 
+typedef enum _TRACE_CONTROL_INFORMATION_CLASS
+{
+    TraceControlStartLogger = 1,
+    TraceControlStopLogger = 2,
+    TraceControlQueryLogger = 3,
+    TraceControlUpdateLogger = 4,
+    TraceControlFlushLogger = 5,
+    TraceControlIncrementLoggerFile = 6,
+
+    TraceControlRealtimeConnect = 11,
+    TraceControlWdiDispatchControl = 13,
+    TraceControlRealtimeDisconnectConsumerByHandle = 14,
+
+    TraceControlReceiveNotification = 16,
+    TraceControlEnableGuid = 17,
+    TraceControlSendReplyDataBlock = 18,
+    TraceControlReceiveReplyDataBlock = 19,
+    TraceControlWdiUpdateSem = 20,
+    TraceControlGetTraceGuidList = 21,
+    TraceControlGetTraceGuidInfo = 22,
+    TraceControlEnumerateTraceGuids = 23,
+
+    TraceControlQueryReferenceTime = 25,
+    TraceControlTrackProviderBinary = 26,
+    TraceControlAddNotificationEvent = 27,
+    TraceControlUpdateDisallowList = 28,
+
+    TraceControlUseDescriptorTypeUm = 31,
+    TraceControlGetTraceGroupList = 32,
+    TraceControlGetTraceGroupInfo = 33,
+    TraceControlTraceSetDisallowList= 34,
+    TraceControlSetCompressionSettings = 35,
+    TraceControlGetCompressionSettings= 36,
+    TraceControlUpdatePeriodicCaptureState = 37,
+    TraceControlGetPrivateSessionTraceHandle = 38,
+    TraceControlRegisterPrivateSession = 39,
+    TraceControlQuerySessionDemuxObject = 40,
+    TraceControlSetProviderBinaryTracking = 41,
+    TraceControlMaxLoggers = 42,
+    TraceControlMaxPmcCounter = 43
+} TRACE_CONTROL_INFORMATION_CLASS;
+
 #if (PHNT_VERSION >= PHNT_VISTA)
-// private
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
 NtTraceControl(
-    _In_ ULONG FunctionCode,
-    _In_reads_bytes_opt_(InBufferLen) PVOID InBuffer,
-    _In_ ULONG InBufferLen,
-    _Out_writes_bytes_opt_(OutBufferLen) PVOID OutBuffer,
-    _In_ ULONG OutBufferLen,
+    _In_ TRACE_CONTROL_INFORMATION_CLASS TraceInformationClass,
+    _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
+    _In_ ULONG InputBufferLength,
+    _Out_writes_bytes_opt_(TraceInformationLength) PVOID TraceInformation,
+    _In_ ULONG TraceInformationLength,
     _Out_ PULONG ReturnLength
     );
 #endif
diff --git a/ntmmapi.h b/ntmmapi.h
index 5d27126..6b1f9c0 100644
--- a/ntmmapi.h
+++ b/ntmmapi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
@@ -253,6 +253,18 @@ typedef struct _MEMORY_ENCLAVE_IMAGE_INFORMATION
 #define MMPFNLIST_ACTIVE 6
 #define MMPFNLIST_TRANSITION 7
 
+//typedef enum _MMLISTS
+//{
+//    ZeroedPageList = 0,
+//    FreePageList = 1,
+//    StandbyPageList = 2,
+//    ModifiedPageList = 3,
+//    ModifiedNoWritePageList = 4,
+//    BadPageList = 5,
+//    ActiveAndValid = 6,
+//    TransitionPage = 7
+//} MMLISTS;
+
 #define MMPFNUSE_PROCESSPRIVATE 0
 #define MMPFNUSE_FILE 1
 #define MMPFNUSE_PAGEFILEMAPPED 2
@@ -266,6 +278,22 @@ typedef struct _MEMORY_ENCLAVE_IMAGE_INFORMATION
 #define MMPFNUSE_DRIVERLOCKPAGE 10
 #define MMPFNUSE_KERNELSTACK 11
 
+//typedef enum _MMPFNUSE
+//{
+//    ProcessPrivatePage,
+//    MemoryMappedFilePage,
+//    PageFileMappedPage,
+//    PageTablePage,
+//    PagedPoolPage,
+//    NonPagedPoolPage,
+//    SystemPTEPage,
+//    SessionPrivatePage,
+//    MetafilePage,
+//    AWEPage,
+//    DriverLockedPage,
+//    KernelStackPage
+//} MMPFNUSE;
+
 // private
 typedef struct _MEMORY_FRAME_INFORMATION
 {
@@ -558,6 +586,9 @@ NtSetInformationVirtualMemory(
 
 #endif
 
+#define MAP_PROCESS 1
+#define MAP_SYSTEM 2
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -942,4 +973,69 @@ NtFlushWriteBuffer(
 
 #endif
 
+// Enclave support
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+NtCreateEnclave(
+    _In_ HANDLE ProcessHandle,
+    _Inout_ PVOID* BaseAddress,
+    _In_ ULONG_PTR ZeroBits,
+    _In_ SIZE_T Size,
+    _In_ SIZE_T InitialCommitment,
+    _In_ ULONG EnclaveType,
+    _In_reads_bytes_(EnclaveInformationLength) PVOID EnclaveInformation,
+    _In_ ULONG EnclaveInformationLength,
+    _Out_opt_ PULONG EnclaveError
+    );
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+NtLoadEnclaveData(
+    _In_ HANDLE ProcessHandle,
+    _In_ PVOID BaseAddress,
+    _In_reads_bytes_(BufferSize) PVOID Buffer,
+    _In_ SIZE_T BufferSize,
+    _In_ ULONG Protect,
+    _In_reads_bytes_(PageInformationLength) PVOID PageInformation,
+    _In_ ULONG PageInformationLength,
+    _Out_opt_ PSIZE_T NumberOfBytesWritten,
+    _Out_opt_ PULONG EnclaveError
+    );
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+NtInitializeEnclave(
+    _In_ HANDLE ProcessHandle,
+    _In_ PVOID BaseAddress,
+    _In_reads_bytes_(EnclaveInformationLength) PVOID EnclaveInformation,
+    _In_ ULONG EnclaveInformationLength,
+    _Out_opt_ PULONG EnclaveError
+    );
+
+// rev
+NTSYSAPI
+NTSTATUS
+NTAPI
+NtTerminateEnclave(
+    _In_ PVOID BaseAddress,
+    _In_ BOOLEAN WaitForThread
+    );
+
+#if (PHNT_MODE != PHNT_MODE_KERNEL)
+// rev
+NTSYSAPI
+NTSTATUS
+NTAPI
+NtCallEnclave(
+    _In_ PENCLAVE_ROUTINE Routine,
+    _In_ PVOID Parameter,
+    _In_ BOOLEAN WaitForThread,
+    _Out_opt_ PVOID *ReturnValue
+    );
+#endif
+
 #endif
diff --git a/ntnls.h b/ntnls.h
index e52bd57..f07f0f1 100644
--- a/ntnls.h
+++ b/ntnls.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/ntobapi.h b/ntobapi.h
index 087920b..fe25888 100644
--- a/ntobapi.h
+++ b/ntobapi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/ntpebteb.h b/ntpebteb.h
index 732d60f..747d3c4 100644
--- a/ntpebteb.h
+++ b/ntpebteb.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/ntpfapi.h b/ntpfapi.h
index 67ba32d..c47c98c 100644
--- a/ntpfapi.h
+++ b/ntpfapi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
@@ -209,14 +209,24 @@ typedef struct _PF_PHYSICAL_MEMORY_RANGE
     ULONG_PTR PageCount;
 } PF_PHYSICAL_MEMORY_RANGE, *PPF_PHYSICAL_MEMORY_RANGE;
 
-#define PF_PHYSICAL_MEMORY_RANGE_INFO_VERSION 1
+#define PF_PHYSICAL_MEMORY_RANGE_INFO_V1_VERSION 1
 
-typedef struct _PF_PHYSICAL_MEMORY_RANGE_INFO
+typedef struct _PF_PHYSICAL_MEMORY_RANGE_INFO_V1
 {
     ULONG Version;
     ULONG RangeCount;
     PF_PHYSICAL_MEMORY_RANGE Ranges[1];
-} PF_PHYSICAL_MEMORY_RANGE_INFO, *PPF_PHYSICAL_MEMORY_RANGE_INFO;
+} PF_PHYSICAL_MEMORY_RANGE_INFO_V1, *PPF_PHYSICAL_MEMORY_RANGE_INFO_V1;
+
+#define PF_PHYSICAL_MEMORY_RANGE_INFO_V2_VERSION 2
+
+typedef struct _PF_PHYSICAL_MEMORY_RANGE_INFO_V2
+{
+    ULONG Version;
+    ULONG Flags;
+    ULONG RangeCount;
+    PF_PHYSICAL_MEMORY_RANGE Ranges[ANYSIZE_ARRAY];
+} PF_PHYSICAL_MEMORY_RANGE_INFO_V2, *PPF_PHYSICAL_MEMORY_RANGE_INFO_V2;
 
 // begin_rev
 
diff --git a/ntpnpapi.h b/ntpnpapi.h
index 166ff78..54ccd93 100644
--- a/ntpnpapi.h
+++ b/ntpnpapi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/ntpoapi.h b/ntpoapi.h
index 52d0c7b..5a6ce4c 100644
--- a/ntpoapi.h
+++ b/ntpoapi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/ntpsapi.h b/ntpsapi.h
index c4f516d..9c852fb 100644
--- a/ntpsapi.h
+++ b/ntpsapi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
@@ -103,8 +103,6 @@ typedef struct _WOW64_PROCESS
 
 #include <ntpebteb.h>
 
-// source:http://www.microsoft.com/whdc/system/Sysinternals/MoreThan64proc.mspx
-
 #if (PHNT_MODE != PHNT_MODE_KERNEL)
 typedef enum _PROCESSINFOCLASS
 {
@@ -166,7 +164,7 @@ typedef enum _PROCESSINFOCLASS
     ProcessKeepAliveCount, // q: PROCESS_KEEPALIVE_COUNT_INFORMATION
     ProcessRevokeFileHandles, // s: PROCESS_REVOKE_FILE_HANDLES_INFORMATION
     ProcessWorkingSetControl, // s: PROCESS_WORKING_SET_CONTROL
-    ProcessHandleTable, // since WINBLUE
+    ProcessHandleTable, // q: ULONG[] // since WINBLUE
     ProcessCheckStackExtentsMode,
     ProcessCommandLineInformation, // q: UNICODE_STRING // 60
     ProcessProtectionInformation, // q: PS_PROTECTION
@@ -179,7 +177,7 @@ typedef enum _PROCESSINFOCLASS
     ProcessSubsystemProcess,
     ProcessJobMemoryInformation, // PROCESS_JOB_MEMORY_INFO
     ProcessInPrivate, // since THRESHOLD2 // 70
-    ProcessRaiseUMExceptionOnInvalidHandleClose,
+    ProcessRaiseUMExceptionOnInvalidHandleClose, // qs: ULONG; s: 0 disables, otherwise enables
     ProcessIumChallengeResponse,
     ProcessChildProcessInformation, // PROCESS_CHILD_PROCESS_INFORMATION
     ProcessHighGraphicsPriorityInformation,
@@ -197,7 +195,7 @@ typedef enum _PROCESSINFOCLASS
     ProcessEnclaveInformation,
     ProcessEnableReadWriteVmLogging, // PROCESS_READWRITEVM_LOGGING_INFORMATION
     ProcessUptimeInformation, // PROCESS_UPTIME_INFORMATION
-    ProcessImageSection,
+    ProcessImageSection, // q: HANDLE
     ProcessDebugAuthInformation, // since REDSTONE4 // 90
     ProcessSystemResourceManagement, // PROCESS_SYSTEM_RESOURCE_MANAGEMENT
     ProcessSequenceNumber, // q: ULONGLONG
@@ -1187,7 +1185,7 @@ NTSYSCALLAPI
 NTSTATUS
 NTAPI
 NtGetNextProcess(
-    _In_ HANDLE ProcessHandle,
+    _In_opt_ HANDLE ProcessHandle,
     _In_ ACCESS_MASK DesiredAccess,
     _In_ ULONG HandleAttributes,
     _In_ ULONG Flags,
diff --git a/ntregapi.h b/ntregapi.h
index 37808d8..3af06af 100644
--- a/ntregapi.h
+++ b/ntregapi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
@@ -250,7 +250,7 @@ typedef struct _REG_NOTIFY_INFORMATION
 
 typedef struct _KEY_PID_ARRAY
 {
-    HANDLE PID;
+    HANDLE ProcessId;
     UNICODE_STRING KeyName;
 } KEY_PID_ARRAY, *PKEY_PID_ARRAY;
 
@@ -615,7 +615,7 @@ NTAPI
 NtQueryOpenSubKeysEx(
     _In_ POBJECT_ATTRIBUTES TargetKey,
     _In_ ULONG BufferLength,
-    _Out_writes_bytes_(BufferLength) PVOID Buffer,
+    _Out_writes_bytes_opt_(BufferLength) PVOID Buffer,
     _Out_ PULONG RequiredSize
     );
 
diff --git a/ntrtl.h b/ntrtl.h
index 716ab51..f558bed 100644
--- a/ntrtl.h
+++ b/ntrtl.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
@@ -1239,7 +1239,7 @@ RtlWakeAddressSingle(
 #ifndef PHNT_NO_INLINE_INIT_STRING
 FORCEINLINE VOID RtlInitString(
     _Out_ PSTRING DestinationString,
-    _In_opt_ PSTR SourceString
+    _In_opt_ PCSTR SourceString
     )
 {
     if (SourceString)
@@ -1247,7 +1247,7 @@ FORCEINLINE VOID RtlInitString(
     else
         DestinationString->MaximumLength = DestinationString->Length = 0;
 
-    DestinationString->Buffer = SourceString;
+    DestinationString->Buffer = (PCHAR)SourceString;
 }
 #else
 NTSYSAPI
@@ -1255,7 +1255,7 @@ VOID
 NTAPI
 RtlInitString(
     _Out_ PSTRING DestinationString,
-    _In_opt_ PSTR SourceString
+    _In_opt_ PCSTR SourceString
     );
 #endif
 
@@ -1272,7 +1272,7 @@ RtlInitStringEx(
 #ifndef PHNT_NO_INLINE_INIT_STRING
 FORCEINLINE VOID RtlInitAnsiString(
     _Out_ PANSI_STRING DestinationString,
-    _In_opt_ PSTR SourceString
+    _In_opt_ PCSTR SourceString
     )
 {
     if (SourceString)
@@ -1280,7 +1280,7 @@ FORCEINLINE VOID RtlInitAnsiString(
     else
         DestinationString->MaximumLength = DestinationString->Length = 0;
 
-    DestinationString->Buffer = SourceString;
+    DestinationString->Buffer = (PCHAR)SourceString;
 }
 #else
 NTSYSAPI
@@ -1288,7 +1288,7 @@ VOID
 NTAPI
 RtlInitAnsiString(
     _Out_ PANSI_STRING DestinationString,
-    _In_opt_ PSTR SourceString
+    _In_opt_ PCSTR SourceString
     );
 #endif
 
@@ -1374,7 +1374,7 @@ NTSTATUS
 NTAPI
 RtlAppendAsciizToString(
     _In_ PSTRING Destination,
-    _In_opt_ PSTR Source
+    _In_opt_ PCSTR Source
     );
 
 NTSYSAPI
@@ -1411,7 +1411,7 @@ RtlInitEmptyUnicodeString(
 #ifndef PHNT_NO_INLINE_INIT_STRING
 FORCEINLINE VOID RtlInitUnicodeString(
     _Out_ PUNICODE_STRING DestinationString,
-    _In_opt_ PWSTR SourceString
+    _In_opt_ PCWSTR SourceString
     )
 {
     if (SourceString)
@@ -1419,7 +1419,7 @@ FORCEINLINE VOID RtlInitUnicodeString(
     else
         DestinationString->MaximumLength = DestinationString->Length = 0;
 
-    DestinationString->Buffer = SourceString;
+    DestinationString->Buffer = (PWCH)SourceString;
 }
 #else
 NTSYSAPI
@@ -1427,7 +1427,7 @@ VOID
 NTAPI
 RtlInitUnicodeString(
     _Out_ PUNICODE_STRING DestinationString,
-    _In_opt_ PWSTR SourceString
+    _In_opt_ PCWSTR SourceString
     );
 #endif
 
@@ -1436,7 +1436,7 @@ NTSTATUS
 NTAPI
 RtlInitUnicodeStringEx(
     _Out_ PUNICODE_STRING DestinationString,
-    _In_opt_ PWSTR SourceString
+    _In_opt_ PCWSTR SourceString
     );
 
 NTSYSAPI
@@ -1444,7 +1444,7 @@ BOOLEAN
 NTAPI
 RtlCreateUnicodeString(
     _Out_ PUNICODE_STRING DestinationString,
-    _In_ PWSTR SourceString
+    _In_ PCWSTR SourceString
     );
 
 NTSYSAPI
@@ -1452,7 +1452,7 @@ BOOLEAN
 NTAPI
 RtlCreateUnicodeStringFromAsciiz(
     _Out_ PUNICODE_STRING DestinationString,
-    _In_ PSTR SourceString
+    _In_ PCSTR SourceString
     );
 
 NTSYSAPI
@@ -1512,9 +1512,9 @@ NTSYSAPI
 LONG
 NTAPI
 RtlCompareUnicodeStrings(
-    _In_reads_(String1Length) PWCH String1,
+    _In_reads_(String1Length) PCWCH String1,
     _In_ SIZE_T String1Length,
-    _In_reads_(String2Length) PWCH String2,
+    _In_reads_(String2Length) PCWCH String2,
     _In_ SIZE_T String2Length,
     _In_ BOOLEAN CaseInSensitive
     );
@@ -1613,7 +1613,7 @@ NTSTATUS
 NTAPI
 RtlAppendUnicodeToString(
     _In_ PUNICODE_STRING Destination,
-    _In_opt_ PWSTR Source
+    _In_opt_ PCWSTR Source
     );
 
 NTSYSAPI
@@ -1727,7 +1727,7 @@ RtlMultiByteToUnicodeN(
     _Out_writes_bytes_to_(MaxBytesInUnicodeString, *BytesInUnicodeString) PWCH UnicodeString,
     _In_ ULONG MaxBytesInUnicodeString,
     _Out_opt_ PULONG BytesInUnicodeString,
-    _In_reads_bytes_(BytesInMultiByteString) PSTR MultiByteString,
+    _In_reads_bytes_(BytesInMultiByteString) PCSTR MultiByteString,
     _In_ ULONG BytesInMultiByteString
     );
 
@@ -1736,7 +1736,7 @@ NTSTATUS
 NTAPI
 RtlMultiByteToUnicodeSize(
     _Out_ PULONG BytesInUnicodeString,
-    _In_reads_bytes_(BytesInMultiByteString) PSTR MultiByteString,
+    _In_reads_bytes_(BytesInMultiByteString) PCSTR MultiByteString,
     _In_ ULONG BytesInMultiByteString
     );
 
@@ -1747,7 +1747,7 @@ RtlUnicodeToMultiByteN(
     _Out_writes_bytes_to_(MaxBytesInMultiByteString, *BytesInMultiByteString) PCHAR MultiByteString,
     _In_ ULONG MaxBytesInMultiByteString,
     _Out_opt_ PULONG BytesInMultiByteString,
-    _In_reads_bytes_(BytesInUnicodeString) PWCH UnicodeString,
+    _In_reads_bytes_(BytesInUnicodeString) PCWCH UnicodeString,
     _In_ ULONG BytesInUnicodeString
     );
 
@@ -1756,7 +1756,7 @@ NTSTATUS
 NTAPI
 RtlUnicodeToMultiByteSize(
     _Out_ PULONG BytesInMultiByteString,
-    _In_reads_bytes_(BytesInUnicodeString) PWCH UnicodeString,
+    _In_reads_bytes_(BytesInUnicodeString) PCWCH UnicodeString,
     _In_ ULONG BytesInUnicodeString
     );
 
@@ -1767,7 +1767,7 @@ RtlUpcaseUnicodeToMultiByteN(
     _Out_writes_bytes_to_(MaxBytesInMultiByteString, *BytesInMultiByteString) PCHAR MultiByteString,
     _In_ ULONG MaxBytesInMultiByteString,
     _Out_opt_ PULONG BytesInMultiByteString,
-    _In_reads_bytes_(BytesInUnicodeString) PWCH UnicodeString,
+    _In_reads_bytes_(BytesInUnicodeString) PCWCH UnicodeString,
     _In_ ULONG BytesInUnicodeString
     );
 
@@ -1778,7 +1778,7 @@ RtlOemToUnicodeN(
     _Out_writes_bytes_to_(MaxBytesInUnicodeString, *BytesInUnicodeString) PWSTR UnicodeString,
     _In_ ULONG MaxBytesInUnicodeString,
     _Out_opt_ PULONG BytesInUnicodeString,
-    _In_reads_bytes_(BytesInOemString) PCH OemString,
+    _In_reads_bytes_(BytesInOemString) PCCH OemString,
     _In_ ULONG BytesInOemString
     );
 
@@ -1789,7 +1789,7 @@ RtlUnicodeToOemN(
     _Out_writes_bytes_to_(MaxBytesInOemString, *BytesInOemString) PCHAR OemString,
     _In_ ULONG MaxBytesInOemString,
     _Out_opt_ PULONG BytesInOemString,
-    _In_reads_bytes_(BytesInUnicodeString) PWCH UnicodeString,
+    _In_reads_bytes_(BytesInUnicodeString) PCWCH UnicodeString,
     _In_ ULONG BytesInUnicodeString
     );
 
@@ -1800,7 +1800,7 @@ RtlUpcaseUnicodeToOemN(
     _Out_writes_bytes_to_(MaxBytesInOemString, *BytesInOemString) PCHAR OemString,
     _In_ ULONG MaxBytesInOemString,
     _Out_opt_ PULONG BytesInOemString,
-    _In_reads_bytes_(BytesInUnicodeString) PWCH UnicodeString,
+    _In_reads_bytes_(BytesInUnicodeString) PCWCH UnicodeString,
     _In_ ULONG BytesInUnicodeString
     );
 
@@ -1811,7 +1811,7 @@ RtlConsoleMultiByteToUnicodeN(
     _Out_writes_bytes_to_(MaxBytesInUnicodeString, *BytesInUnicodeString) PWCH UnicodeString,
     _In_ ULONG MaxBytesInUnicodeString,
     _Out_opt_ PULONG BytesInUnicodeString,
-    _In_reads_bytes_(BytesInMultiByteString) PCH MultiByteString,
+    _In_reads_bytes_(BytesInMultiByteString) PCCH MultiByteString,
     _In_ ULONG BytesInMultiByteString,
     _Out_ PULONG pdwSpecialChar
     );
@@ -1824,7 +1824,7 @@ RtlUTF8ToUnicodeN(
     _Out_writes_bytes_to_(UnicodeStringMaxByteCount, *UnicodeStringActualByteCount) PWSTR UnicodeStringDestination,
     _In_ ULONG UnicodeStringMaxByteCount,
     _Out_ PULONG UnicodeStringActualByteCount,
-    _In_reads_bytes_(UTF8StringByteCount) PCH UTF8StringSource,
+    _In_reads_bytes_(UTF8StringByteCount) PCCH UTF8StringSource,
     _In_ ULONG UTF8StringByteCount
     );
 #endif
@@ -1837,7 +1837,7 @@ RtlUnicodeToUTF8N(
     _Out_writes_bytes_to_(UTF8StringMaxByteCount, *UTF8StringActualByteCount) PCHAR UTF8StringDestination,
     _In_ ULONG UTF8StringMaxByteCount,
     _Out_ PULONG UTF8StringActualByteCount,
-    _In_reads_bytes_(UnicodeStringByteCount) PWCH UnicodeStringSource,
+    _In_reads_bytes_(UnicodeStringByteCount) PCWCH UnicodeStringSource,
     _In_ ULONG UnicodeStringByteCount
     );
 #endif
@@ -2049,7 +2049,7 @@ NTSTATUS
 NTAPI
 RtlIdnToAscii(
     _In_ ULONG Flags,
-    _In_ PWSTR SourceString,
+    _In_ PCWSTR SourceString,
     _In_ LONG SourceStringLength,
     _Out_writes_to_(*DestinationStringLength, *DestinationStringLength) PWSTR DestinationString,
     _Inout_ PLONG DestinationStringLength
@@ -2060,7 +2060,7 @@ NTSTATUS
 NTAPI
 RtlIdnToUnicode(
     _In_ ULONG Flags,
-    _In_ PWSTR SourceString,
+    _In_ PCWSTR SourceString,
     _In_ LONG SourceStringLength,
     _Out_writes_to_(*DestinationStringLength, *DestinationStringLength) PWSTR DestinationString,
     _Inout_ PLONG DestinationStringLength
@@ -2071,7 +2071,7 @@ NTSTATUS
 NTAPI
 RtlIdnToNameprepUnicode(
     _In_ ULONG Flags,
-    _In_ PWSTR SourceString,
+    _In_ PCWSTR SourceString,
     _In_ LONG SourceStringLength,
     _Out_writes_to_(*DestinationStringLength, *DestinationStringLength) PWSTR DestinationString,
     _Inout_ PLONG DestinationStringLength
@@ -2337,7 +2337,7 @@ NTSYSAPI
 BOOLEAN
 NTAPI
 RtlIsValidLocaleName(
-    _In_ PWSTR LocaleName,
+    _In_ PCWSTR LocaleName,
     _In_ ULONG Flags
     );
 
@@ -2346,7 +2346,7 @@ NTSYSAPI
 NTSTATUS
 NTAPI
 RtlGetParentLocaleName(
-    _In_ PWSTR LocaleName,
+    _In_ PCWSTR LocaleName,
     _Inout_ PUNICODE_STRING ParentLocaleName,
     _In_ ULONG Flags,
     _In_ BOOLEAN AllocateDestinationString
@@ -2368,7 +2368,7 @@ NTSYSAPI
 NTSTATUS
 NTAPI
 RtlLocaleNameToLcid(
-    _In_ PWSTR LocaleName,
+    _In_ PCWSTR LocaleName,
     _Out_ PLCID lcid,
     _In_ ULONG Flags
     );
@@ -2610,8 +2610,8 @@ RtlDeNormalizeProcessParams(
 typedef struct _RTL_USER_PROCESS_INFORMATION
 {
     ULONG Length;
-    HANDLE Process;
-    HANDLE Thread;
+    HANDLE ProcessHandle;
+    HANDLE ThreadHandle;
     CLIENT_ID ClientId;
     SECTION_IMAGE_INFORMATION ImageInformation;
 } RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION;
@@ -3173,7 +3173,7 @@ PVOID
 NTAPI
 RtlFindExportedRoutineByName(
     _In_ PVOID BaseOfImage,
-    _In_ PSTR RoutineName
+    _In_ PCSTR RoutineName
     );
 
 #endif
@@ -3270,10 +3270,10 @@ NTSYSAPI
 NTSTATUS
 NTAPI
 RtlSetEnvironmentVar(
-    _In_opt_ PWSTR *Environment,
-    _In_reads_(NameLength) PWSTR Name,
+    _Inout_opt_ PVOID *Environment,
+    _In_reads_(NameLength) PCWSTR Name,
     _In_ SIZE_T NameLength,
-    _In_reads_(ValueLength) PWSTR Value,
+    _In_reads_(ValueLength) PCWSTR Value,
     _In_ SIZE_T ValueLength
     );
 #endif
@@ -3282,7 +3282,7 @@ NTSYSAPI
 NTSTATUS
 NTAPI
 RtlSetEnvironmentVariable(
-    _In_opt_ PVOID *Environment,
+    _Inout_opt_ PVOID *Environment,
     _In_ PUNICODE_STRING Name,
     _In_opt_ PUNICODE_STRING Value
     );
@@ -3294,7 +3294,7 @@ NTSTATUS
 NTAPI
 RtlQueryEnvironmentVariable(
     _In_opt_ PVOID Environment,
-    _In_reads_(NameLength) PWSTR Name,
+    _In_reads_(NameLength) PCWSTR Name,
     _In_ SIZE_T NameLength,
     _Out_writes_(ValueLength) PWSTR Value,
     _In_ SIZE_T ValueLength,
@@ -3308,7 +3308,7 @@ NTAPI
 RtlQueryEnvironmentVariable_U(
     _In_opt_ PVOID Environment,
     _In_ PUNICODE_STRING Name,
-    _Out_ PUNICODE_STRING Value
+    _Inout_ PUNICODE_STRING Value
     );
 
 #if (PHNT_VERSION >= PHNT_VISTA)
@@ -3318,7 +3318,7 @@ NTSTATUS
 NTAPI
 RtlExpandEnvironmentStrings(
     _In_opt_ PVOID Environment,
-    _In_reads_(SrcLength) PWSTR Src,
+    _In_reads_(SrcLength) PCWSTR Src,
     _In_ SIZE_T SrcLength,
     _Out_writes_(DstLength) PWSTR Dst,
     _In_ SIZE_T DstLength,
@@ -3332,7 +3332,7 @@ NTAPI
 RtlExpandEnvironmentStrings_U(
     _In_opt_ PVOID Environment,
     _In_ PUNICODE_STRING Source,
-    _Out_ PUNICODE_STRING Destination,
+    _Inout_ PUNICODE_STRING Destination,
     _Out_opt_ PULONG ReturnedLength
     );
 
@@ -3340,7 +3340,7 @@ NTSYSAPI
 NTSTATUS
 NTAPI
 RtlSetEnvironmentStrings(
-    _In_ PWCHAR NewEnvironment,
+    _In_ PCWCHAR NewEnvironment,
     _In_ SIZE_T NewEnvironmentSize
     );
 
@@ -3391,7 +3391,7 @@ NTSYSAPI
 RTL_PATH_TYPE
 NTAPI
 RtlDetermineDosPathNameType_U(
-    _In_ PWSTR DosFileName
+    _In_ PCWSTR DosFileName
     );
 
 NTSYSAPI
@@ -3405,7 +3405,7 @@ NTSYSAPI
 ULONG
 NTAPI
 RtlIsDosDeviceName_U(
-    _In_ PWSTR DosFileName
+    _In_ PCWSTR DosFileName
     );
 
 NTSYSAPI
@@ -3419,7 +3419,7 @@ NTSYSAPI
 ULONG
 NTAPI
 RtlGetFullPathName_U(
-    _In_ PWSTR FileName,
+    _In_ PCWSTR FileName,
     _In_ ULONG BufferLength,
     _Out_writes_bytes_(BufferLength) PWSTR Buffer,
     _Out_opt_ PWSTR *FilePart
@@ -3431,7 +3431,7 @@ NTSYSAPI
 NTSTATUS
 NTAPI
 RtlGetFullPathName_UEx(
-    _In_ PWSTR FileName,
+    _In_ PCWSTR FileName,
     _In_ ULONG BufferLength,
     _Out_writes_bytes_(BufferLength) PWSTR Buffer,
     _Out_opt_ PWSTR *FilePart,
@@ -3481,7 +3481,7 @@ NTSYSAPI
 BOOLEAN
 NTAPI
 RtlDosPathNameToNtPathName_U(
-    _In_ PWSTR DosFileName,
+    _In_ PCWSTR DosFileName,
     _Out_ PUNICODE_STRING NtFileName,
     _Out_opt_ PWSTR *FilePart,
     _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName
@@ -3492,7 +3492,7 @@ NTSYSAPI
 NTSTATUS
 NTAPI
 RtlDosPathNameToNtPathName_U_WithStatus(
-    _In_ PWSTR DosFileName,
+    _In_ PCWSTR DosFileName,
     _Out_ PUNICODE_STRING NtFileName,
     _Out_opt_ PWSTR *FilePart,
     _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName
@@ -3505,7 +3505,7 @@ NTSYSAPI
 NTSTATUS
 NTAPI
 RtlDosLongPathNameToNtPathName_U_WithStatus(
-    _In_ PWSTR DosFileName,
+    _In_ PCWSTR DosFileName,
     _Out_ PUNICODE_STRING NtFileName,
     _Out_opt_ PWSTR *FilePart,
     _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName
@@ -3517,7 +3517,7 @@ NTSYSAPI
 BOOLEAN
 NTAPI
 RtlDosPathNameToRelativeNtPathName_U(
-    _In_ PWSTR DosFileName,
+    _In_ PCWSTR DosFileName,
     _Out_ PUNICODE_STRING NtFileName,
     _Out_opt_ PWSTR *FilePart,
     _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName
@@ -3529,7 +3529,7 @@ NTSYSAPI
 NTSTATUS
 NTAPI
 RtlDosPathNameToRelativeNtPathName_U_WithStatus(
-    _In_ PWSTR DosFileName,
+    _In_ PCWSTR DosFileName,
     _Out_ PUNICODE_STRING NtFileName,
     _Out_opt_ PWSTR *FilePart,
     _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName
@@ -3542,7 +3542,7 @@ NTSYSAPI
 NTSTATUS
 NTAPI
 RtlDosLongPathNameToRelativeNtPathName_U_WithStatus(
-    _In_ PWSTR DosFileName,
+    _In_ PCWSTR DosFileName,
     _Out_ PUNICODE_STRING NtFileName,
     _Out_opt_ PWSTR *FilePart,
     _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName
@@ -3562,9 +3562,9 @@ NTSYSAPI
 ULONG
 NTAPI
 RtlDosSearchPath_U(
-    _In_ PWSTR Path,
-    _In_ PWSTR FileName,
-    _In_opt_ PWSTR Extension,
+    _In_ PCWSTR Path,
+    _In_ PCWSTR FileName,
+    _In_opt_ PCWSTR Extension,
     _In_ ULONG BufferLength,
     _Out_writes_bytes_(BufferLength) PWSTR Buffer,
     _Out_opt_ PWSTR *FilePart
@@ -3593,7 +3593,7 @@ NTSYSAPI
 BOOLEAN
 NTAPI
 RtlDoesFileExists_U(
-    _In_ PWSTR FileName
+    _In_ PCWSTR FileName
     );
 
 NTSYSAPI
@@ -4091,6 +4091,7 @@ RtlWalkHeap(
 #define HeapOptimizeResources 0x3 // q; s: HEAP_OPTIMIZE_RESOURCES_INFORMATION 
 #define HeapTaggingInformation 0x4
 #define HeapStackDatabase 0x5
+#define HeapMemoryLimit 0x6 // 19H2
 #define HeapDetailedFailureInformation 0x80000001
 #define HeapSetDebuggingInformation 0x80000002 // q; s: HEAP_DEBUGGING_INFORMATION
 
@@ -4834,7 +4835,7 @@ NTSYSAPI
 NTSTATUS
 NTAPI
 RtlCharToInteger(
-    _In_ PSTR String,
+    _In_ PCSTR String,
     _In_opt_ ULONG Base,
     _Out_ PULONG Value
     );
@@ -5866,6 +5867,14 @@ RtlReplaceSidInSd(
 
 #define MAX_UNICODE_STACK_BUFFER_LENGTH 256
 
+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlLengthSidAsUnicodeString(
+    _In_ PSID Sid,
+    _Out_ PULONG StringLength
+    );
+
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -6664,14 +6673,14 @@ NTSYSAPI
 NTSTATUS
 NTAPI
 RtlGetVersion(
-    _Out_ PRTL_OSVERSIONINFOW lpVersionInformation
+    _Out_ PRTL_OSVERSIONINFOEXW VersionInformation // PRTL_OSVERSIONINFOW
     );
 
 NTSYSAPI
 NTSTATUS
 NTAPI
 RtlVerifyVersionInfo(
-    _In_ PRTL_OSVERSIONINFOEXW VersionInfo,
+    _In_ PRTL_OSVERSIONINFOEXW VersionInformation, // PRTL_OSVERSIONINFOW
     _In_ ULONG TypeMask,
     _In_ ULONGLONG ConditionMask
     );
@@ -6835,7 +6844,7 @@ NTAPI
 RtlDeleteTimer(
     _In_ HANDLE TimerQueueHandle,
     _In_ HANDLE TimerToCancel,
-    _In_ HANDLE Event
+    _In_opt_ HANDLE Event
     );
 
 NTSYSAPI
@@ -6929,7 +6938,7 @@ NTSTATUS
 NTAPI
 RtlQueryRegistryValues(
     _In_ ULONG RelativeTo,
-    _In_ PWSTR Path,
+    _In_ PCWSTR Path,
     _In_ PRTL_QUERY_REGISTRY_TABLE QueryTable,
     _In_ PVOID Context,
     _In_opt_ PVOID Environment
@@ -6941,7 +6950,7 @@ NTSTATUS
 NTAPI
 RtlQueryRegistryValuesEx(
     _In_ ULONG RelativeTo,
-    _In_ PWSTR Path,
+    _In_ PCWSTR Path,
     _In_ PRTL_QUERY_REGISTRY_TABLE QueryTable,
     _In_ PVOID Context,
     _In_opt_ PVOID Environment
@@ -6952,8 +6961,8 @@ NTSTATUS
 NTAPI
 RtlWriteRegistryValue(
     _In_ ULONG RelativeTo,
-    _In_ PWSTR Path,
-    _In_ PWSTR ValueName,
+    _In_ PCWSTR Path,
+    _In_ PCWSTR ValueName,
     _In_ ULONG ValueType,
     _In_ PVOID ValueData,
     _In_ ULONG ValueLength
@@ -6964,8 +6973,8 @@ NTSTATUS
 NTAPI
 RtlDeleteRegistryValue(
     _In_ ULONG RelativeTo,
-    _In_ PWSTR Path,
-    _In_ PWSTR ValueName
+    _In_ PCWSTR Path,
+    _In_ PCWSTR ValueName
     );
 
 // Thread profiling
@@ -7672,7 +7681,7 @@ RtlQueryTokenHostIdAsUlong64(
 
 // rev
 NTSYSAPI
-NTSTATUS
+BOOLEAN
 NTAPI
 RtlIsParentOfChildAppContainer(
     _In_ PSID ParentAppContainerSid,
diff --git a/ntsam.h b/ntsam.h
index f22952f..a323aa4 100644
--- a/ntsam.h
+++ b/ntsam.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
@@ -968,210 +968,37 @@ typedef struct _SR_SECURITY_DESCRIPTOR
 
 typedef enum _USER_INFORMATION_CLASS
 {
-    UserGeneralInformation = 1,
-    UserPreferencesInformation,
-    UserLogonInformation,
-    UserLogonHoursInformation,
-    UserAccountInformation,
-    UserNameInformation,
-    UserAccountNameInformation,
-    UserFullNameInformation,
-    UserPrimaryGroupInformation,
-    UserHomeInformation,
-    UserScriptInformation,
-    UserProfileInformation,
-    UserAdminCommentInformation,
-    UserWorkStationsInformation,
-    UserSetPasswordInformation,
-    UserControlInformation,
-    UserExpiresInformation,
+    UserGeneralInformation = 1, // USER_GENERAL_INFORMATION
+    UserPreferencesInformation, // USER_PREFERENCES_INFORMATION
+    UserLogonInformation, // USER_LOGON_INFORMATION
+    UserLogonHoursInformation, // USER_LOGON_HOURS_INFORMATION
+    UserAccountInformation, // USER_ACCOUNT_INFORMATION
+    UserNameInformation, // USER_NAME_INFORMATION
+    UserAccountNameInformation, // USER_ACCOUNT_NAME_INFORMATION
+    UserFullNameInformation, // USER_FULL_NAME_INFORMATION
+    UserPrimaryGroupInformation, // USER_PRIMARY_GROUP_INFORMATION
+    UserHomeInformation, // USER_HOME_INFORMATION
+    UserScriptInformation, // USER_SCRIPT_INFORMATION
+    UserProfileInformation, // USER_PROFILE_INFORMATION
+    UserAdminCommentInformation, // USER_ADMIN_COMMENT_INFORMATION
+    UserWorkStationsInformation, // USER_WORKSTATIONS_INFORMATION
+    UserSetPasswordInformation, // USER_SET_PASSWORD_INFORMATION
+    UserControlInformation, // USER_CONTROL_INFORMATION
+    UserExpiresInformation, // USER_EXPIRES_INFORMATION
     UserInternal1Information,
     UserInternal2Information,
-    UserParametersInformation,
-    UserAllInformation,
+    UserParametersInformation, // USER_PARAMETERS_INFORMATION
+    UserAllInformation, // USER_ALL_INFORMATION
     UserInternal3Information,
     UserInternal4Information,
     UserInternal5Information,
     UserInternal4InformationNew,
     UserInternal5InformationNew,
     UserInternal6Information,
-    UserExtendedInformation,
-    UserLogonUIInformation
+    UserExtendedInformation, // USER_EXTENDED_INFORMATION
+    UserLogonUIInformation // USER_LOGON_UI_INFORMATION
 } USER_INFORMATION_CLASS, *PUSER_INFORMATION_CLASS;
 
-#include <pshpack4.h>
-typedef struct _USER_ALL_INFORMATION
-{
-    LARGE_INTEGER LastLogon;
-    LARGE_INTEGER LastLogoff;
-    LARGE_INTEGER PasswordLastSet;
-    LARGE_INTEGER AccountExpires;
-    LARGE_INTEGER PasswordCanChange;
-    LARGE_INTEGER PasswordMustChange;
-    UNICODE_STRING UserName;
-    UNICODE_STRING FullName;
-    UNICODE_STRING HomeDirectory;
-    UNICODE_STRING HomeDirectoryDrive;
-    UNICODE_STRING ScriptPath;
-    UNICODE_STRING ProfilePath;
-    UNICODE_STRING AdminComment;
-    UNICODE_STRING WorkStations;
-    UNICODE_STRING UserComment;
-    UNICODE_STRING Parameters;
-    UNICODE_STRING LmPassword;
-    UNICODE_STRING NtPassword;
-    UNICODE_STRING PrivateData;
-    SR_SECURITY_DESCRIPTOR SecurityDescriptor;
-    ULONG UserId;
-    ULONG PrimaryGroupId;
-    ULONG UserAccountControl;
-    ULONG WhichFields;
-    LOGON_HOURS LogonHours;
-    USHORT BadPasswordCount;
-    USHORT LogonCount;
-    USHORT CountryCode;
-    USHORT CodePage;
-    BOOLEAN LmPasswordPresent;
-    BOOLEAN NtPasswordPresent;
-    BOOLEAN PasswordExpired;
-    BOOLEAN PrivateDataSensitive;
-} USER_ALL_INFORMATION, *PUSER_ALL_INFORMATION;
-#include <poppack.h>
-
-// Flags for WhichFields in USER_ALL_INFORMATION
-
-#define USER_ALL_USERNAME 0x00000001
-#define USER_ALL_FULLNAME 0x00000002
-#define USER_ALL_USERID 0x00000004
-#define USER_ALL_PRIMARYGROUPID 0x00000008
-#define USER_ALL_ADMINCOMMENT 0x00000010
-#define USER_ALL_USERCOMMENT 0x00000020
-#define USER_ALL_HOMEDIRECTORY 0x00000040
-#define USER_ALL_HOMEDIRECTORYDRIVE 0x00000080
-#define USER_ALL_SCRIPTPATH 0x00000100
-#define USER_ALL_PROFILEPATH 0x00000200
-#define USER_ALL_WORKSTATIONS 0x00000400
-#define USER_ALL_LASTLOGON 0x00000800
-#define USER_ALL_LASTLOGOFF 0x00001000
-#define USER_ALL_LOGONHOURS 0x00002000
-#define USER_ALL_BADPASSWORDCOUNT 0x00004000
-#define USER_ALL_LOGONCOUNT 0x00008000
-#define USER_ALL_PASSWORDCANCHANGE 0x00010000
-#define USER_ALL_PASSWORDMUSTCHANGE 0x00020000
-#define USER_ALL_PASSWORDLASTSET 0x00040000
-#define USER_ALL_ACCOUNTEXPIRES 0x00080000
-#define USER_ALL_USERACCOUNTCONTROL 0x00100000
-#define USER_ALL_PARAMETERS 0x00200000
-#define USER_ALL_COUNTRYCODE 0x00400000
-#define USER_ALL_CODEPAGE 0x00800000
-#define USER_ALL_NTPASSWORDPRESENT 0x01000000 // field AND boolean
-#define USER_ALL_LMPASSWORDPRESENT 0x02000000 // field AND boolean
-#define USER_ALL_PRIVATEDATA 0x04000000 // field AND boolean
-#define USER_ALL_PASSWORDEXPIRED 0x08000000
-#define USER_ALL_SECURITYDESCRIPTOR 0x10000000
-#define USER_ALL_OWFPASSWORD 0x20000000 // boolean
-
-#define USER_ALL_UNDEFINED_MASK 0xc0000000
-
-// Fields that require USER_READ_GENERAL access to read.
-
-#define USER_ALL_READ_GENERAL_MASK (USER_ALL_USERNAME | \
-    USER_ALL_FULLNAME | \
-    USER_ALL_USERID | \
-    USER_ALL_PRIMARYGROUPID | \
-    USER_ALL_ADMINCOMMENT | \
-    USER_ALL_USERCOMMENT)
-
-// Fields that require USER_READ_LOGON access to read.
-
-#define USER_ALL_READ_LOGON_MASK (USER_ALL_HOMEDIRECTORY | \
-    USER_ALL_HOMEDIRECTORYDRIVE | \
-    USER_ALL_SCRIPTPATH | \
-    USER_ALL_PROFILEPATH | \
-    USER_ALL_WORKSTATIONS | \
-    USER_ALL_LASTLOGON | \
-    USER_ALL_LASTLOGOFF | \
-    USER_ALL_LOGONHOURS | \
-    USER_ALL_BADPASSWORDCOUNT | \
-    USER_ALL_LOGONCOUNT | \
-    USER_ALL_PASSWORDCANCHANGE | \
-    USER_ALL_PASSWORDMUSTCHANGE)
-
-// Fields that require USER_READ_ACCOUNT access to read.
-
-#define USER_ALL_READ_ACCOUNT_MASK (USER_ALL_PASSWORDLASTSET | \
-    USER_ALL_ACCOUNTEXPIRES | \
-    USER_ALL_USERACCOUNTCONTROL | \
-    USER_ALL_PARAMETERS)
-
-// Fields that require USER_READ_PREFERENCES access to read.
-
-#define USER_ALL_READ_PREFERENCES_MASK (USER_ALL_COUNTRYCODE | \
-    USER_ALL_CODEPAGE)
-
-// Fields that can only be read by trusted clients.
-
-#define USER_ALL_READ_TRUSTED_MASK (USER_ALL_NTPASSWORDPRESENT | \
-    USER_ALL_LMPASSWORDPRESENT | \
-    USER_ALL_PASSWORDEXPIRED | \
-    USER_ALL_SECURITYDESCRIPTOR | \
-    USER_ALL_PRIVATEDATA)
-
-// Fields that can't be read.
-
-#define USER_ALL_READ_CANT_MASK USER_ALL_UNDEFINED_MASK
-
-// Fields that require USER_WRITE_ACCOUNT access to write.
-
-#define USER_ALL_WRITE_ACCOUNT_MASK (USER_ALL_USERNAME | \
-    USER_ALL_FULLNAME | \
-    USER_ALL_PRIMARYGROUPID | \
-    USER_ALL_HOMEDIRECTORY | \
-    USER_ALL_HOMEDIRECTORYDRIVE | \
-    USER_ALL_SCRIPTPATH | \
-    USER_ALL_PROFILEPATH | \
-    USER_ALL_ADMINCOMMENT | \
-    USER_ALL_WORKSTATIONS | \
-    USER_ALL_LOGONHOURS | \
-    USER_ALL_ACCOUNTEXPIRES | \
-    USER_ALL_USERACCOUNTCONTROL | \
-    USER_ALL_PARAMETERS)
-
-// Fields that require USER_WRITE_PREFERENCES access to write.
-
-#define USER_ALL_WRITE_PREFERENCES_MASK (USER_ALL_USERCOMMENT | \
-    USER_ALL_COUNTRYCODE | \
-    USER_ALL_CODEPAGE)
-
-// Fields that require USER_FORCE_PASSWORD_CHANGE access to write.
-//
-// Note that non-trusted clients only set the NT password as a
-// UNICODE string. The wrapper will convert it to an LM password,
-// OWF and encrypt both versions. Trusted clients can pass in OWF
-// versions of either or both.
-
-#define USER_ALL_WRITE_FORCE_PASSWORD_CHANGE_MASK \
-    (USER_ALL_NTPASSWORDPRESENT | \
-    USER_ALL_LMPASSWORDPRESENT | \
-    USER_ALL_PASSWORDEXPIRED)
-
-// Fields that can only be written by trusted clients.
-
-#define USER_ALL_WRITE_TRUSTED_MASK (USER_ALL_LASTLOGON | \
-    USER_ALL_LASTLOGOFF | \
-    USER_ALL_BADPASSWORDCOUNT | \
-    USER_ALL_LOGONCOUNT | \
-    USER_ALL_PASSWORDLASTSET | \
-    USER_ALL_SECURITYDESCRIPTOR | \
-    USER_ALL_PRIVATEDATA)
-
-// Fields that can't be written.
-
-#define USER_ALL_WRITE_CANT_MASK (USER_ALL_USERID | \
-    USER_ALL_PASSWORDCANCHANGE | \
-    USER_ALL_PASSWORDMUSTCHANGE | \
-    USER_ALL_UNDEFINED_MASK)
-
 typedef struct _USER_GENERAL_INFORMATION
 {
     UNICODE_STRING UserName;
@@ -1189,11 +1016,6 @@ typedef struct _USER_PREFERENCES_INFORMATION
     USHORT CodePage;
 } USER_PREFERENCES_INFORMATION, *PUSER_PREFERENCES_INFORMATION;
 
-typedef struct _USER_PARAMETERS_INFORMATION
-{
-    UNICODE_STRING Parameters;
-} USER_PARAMETERS_INFORMATION, *PUSER_PARAMETERS_INFORMATION;
-
 #include <pshpack4.h>
 typedef struct _USER_LOGON_INFORMATION
 {
@@ -1215,9 +1037,14 @@ typedef struct _USER_LOGON_INFORMATION
     USHORT BadPasswordCount;
     USHORT LogonCount;
     ULONG UserAccountControl;
-} USER_LOGON_INFORMATION, *PUSER_LOGON_INFORMATION;
+} USER_LOGON_INFORMATION, * PUSER_LOGON_INFORMATION;
 #include <poppack.h>
 
+typedef struct _USER_LOGON_HOURS_INFORMATION
+{
+    LOGON_HOURS LogonHours;
+} USER_LOGON_HOURS_INFORMATION, * PUSER_LOGON_HOURS_INFORMATION;
+
 #include <pshpack4.h>
 typedef struct _USER_ACCOUNT_INFORMATION
 {
@@ -1239,9 +1066,15 @@ typedef struct _USER_ACCOUNT_INFORMATION
     LARGE_INTEGER PasswordLastSet;
     LARGE_INTEGER AccountExpires;
     ULONG UserAccountControl;
-} USER_ACCOUNT_INFORMATION, *PUSER_ACCOUNT_INFORMATION;
+} USER_ACCOUNT_INFORMATION, * PUSER_ACCOUNT_INFORMATION;
 #include <poppack.h>
 
+typedef struct _USER_NAME_INFORMATION
+{
+    UNICODE_STRING UserName;
+    UNICODE_STRING FullName;
+} USER_NAME_INFORMATION, *PUSER_NAME_INFORMATION;
+
 typedef struct _USER_ACCOUNT_NAME_INFORMATION
 {
     UNICODE_STRING UserName;
@@ -1252,12 +1085,6 @@ typedef struct _USER_FULL_NAME_INFORMATION
     UNICODE_STRING FullName;
 } USER_FULL_NAME_INFORMATION, *PUSER_FULL_NAME_INFORMATION;
 
-typedef struct _USER_NAME_INFORMATION
-{
-    UNICODE_STRING UserName;
-    UNICODE_STRING FullName;
-} USER_NAME_INFORMATION, *PUSER_NAME_INFORMATION;
-
 typedef struct _USER_PRIMARY_GROUP_INFORMATION
 {
     ULONG PrimaryGroupId;
@@ -1305,10 +1132,189 @@ typedef struct _USER_EXPIRES_INFORMATION
     LARGE_INTEGER AccountExpires;
 } USER_EXPIRES_INFORMATION, *PUSER_EXPIRES_INFORMATION;
 
-typedef struct _USER_LOGON_HOURS_INFORMATION
+typedef struct _USER_PARAMETERS_INFORMATION
 {
+    UNICODE_STRING Parameters;
+} USER_PARAMETERS_INFORMATION, *PUSER_PARAMETERS_INFORMATION;
+
+// Flags for WhichFields in USER_ALL_INFORMATION
+
+#define USER_ALL_USERNAME 0x00000001
+#define USER_ALL_FULLNAME 0x00000002
+#define USER_ALL_USERID 0x00000004
+#define USER_ALL_PRIMARYGROUPID 0x00000008
+#define USER_ALL_ADMINCOMMENT 0x00000010
+#define USER_ALL_USERCOMMENT 0x00000020
+#define USER_ALL_HOMEDIRECTORY 0x00000040
+#define USER_ALL_HOMEDIRECTORYDRIVE 0x00000080
+#define USER_ALL_SCRIPTPATH 0x00000100
+#define USER_ALL_PROFILEPATH 0x00000200
+#define USER_ALL_WORKSTATIONS 0x00000400
+#define USER_ALL_LASTLOGON 0x00000800
+#define USER_ALL_LASTLOGOFF 0x00001000
+#define USER_ALL_LOGONHOURS 0x00002000
+#define USER_ALL_BADPASSWORDCOUNT 0x00004000
+#define USER_ALL_LOGONCOUNT 0x00008000
+#define USER_ALL_PASSWORDCANCHANGE 0x00010000
+#define USER_ALL_PASSWORDMUSTCHANGE 0x00020000
+#define USER_ALL_PASSWORDLASTSET 0x00040000
+#define USER_ALL_ACCOUNTEXPIRES 0x00080000
+#define USER_ALL_USERACCOUNTCONTROL 0x00100000
+#define USER_ALL_PARAMETERS 0x00200000
+#define USER_ALL_COUNTRYCODE 0x00400000
+#define USER_ALL_CODEPAGE 0x00800000
+#define USER_ALL_NTPASSWORDPRESENT 0x01000000 // field AND boolean
+#define USER_ALL_LMPASSWORDPRESENT 0x02000000 // field AND boolean
+#define USER_ALL_PRIVATEDATA 0x04000000 // field AND boolean
+#define USER_ALL_PASSWORDEXPIRED 0x08000000
+#define USER_ALL_SECURITYDESCRIPTOR 0x10000000
+#define USER_ALL_OWFPASSWORD 0x20000000 // boolean
+
+#define USER_ALL_UNDEFINED_MASK 0xc0000000
+
+// Fields that require USER_READ_GENERAL access to read.
+
+#define USER_ALL_READ_GENERAL_MASK \
+    (USER_ALL_USERNAME | \
+    USER_ALL_FULLNAME | \
+    USER_ALL_USERID | \
+    USER_ALL_PRIMARYGROUPID | \
+    USER_ALL_ADMINCOMMENT | \
+    USER_ALL_USERCOMMENT)
+
+// Fields that require USER_READ_LOGON access to read.
+
+#define USER_ALL_READ_LOGON_MASK \
+   (USER_ALL_HOMEDIRECTORY | \
+    USER_ALL_HOMEDIRECTORYDRIVE | \
+    USER_ALL_SCRIPTPATH | \
+    USER_ALL_PROFILEPATH | \
+    USER_ALL_WORKSTATIONS | \
+    USER_ALL_LASTLOGON | \
+    USER_ALL_LASTLOGOFF | \
+    USER_ALL_LOGONHOURS | \
+    USER_ALL_BADPASSWORDCOUNT | \
+    USER_ALL_LOGONCOUNT | \
+    USER_ALL_PASSWORDCANCHANGE | \
+    USER_ALL_PASSWORDMUSTCHANGE)
+
+// Fields that require USER_READ_ACCOUNT access to read.
+
+#define USER_ALL_READ_ACCOUNT_MASK \
+    (USER_ALL_PASSWORDLASTSET | \
+    USER_ALL_ACCOUNTEXPIRES | \
+    USER_ALL_USERACCOUNTCONTROL | \
+    USER_ALL_PARAMETERS)
+
+// Fields that require USER_READ_PREFERENCES access to read.
+
+#define USER_ALL_READ_PREFERENCES_MASK \
+    (USER_ALL_COUNTRYCODE | USER_ALL_CODEPAGE)
+
+// Fields that can only be read by trusted clients.
+
+#define USER_ALL_READ_TRUSTED_MASK \
+    (USER_ALL_NTPASSWORDPRESENT | \
+    USER_ALL_LMPASSWORDPRESENT | \
+    USER_ALL_PASSWORDEXPIRED | \
+    USER_ALL_SECURITYDESCRIPTOR | \
+    USER_ALL_PRIVATEDATA)
+
+// Fields that can't be read.
+
+#define USER_ALL_READ_CANT_MASK USER_ALL_UNDEFINED_MASK
+
+// Fields that require USER_WRITE_ACCOUNT access to write.
+
+#define USER_ALL_WRITE_ACCOUNT_MASK \
+    (USER_ALL_USERNAME | \
+    USER_ALL_FULLNAME | \
+    USER_ALL_PRIMARYGROUPID | \
+    USER_ALL_HOMEDIRECTORY | \
+    USER_ALL_HOMEDIRECTORYDRIVE | \
+    USER_ALL_SCRIPTPATH | \
+    USER_ALL_PROFILEPATH | \
+    USER_ALL_ADMINCOMMENT | \
+    USER_ALL_WORKSTATIONS | \
+    USER_ALL_LOGONHOURS | \
+    USER_ALL_ACCOUNTEXPIRES | \
+    USER_ALL_USERACCOUNTCONTROL | \
+    USER_ALL_PARAMETERS)
+
+// Fields that require USER_WRITE_PREFERENCES access to write.
+
+#define USER_ALL_WRITE_PREFERENCES_MASK \
+    (USER_ALL_USERCOMMENT | USER_ALL_COUNTRYCODE | USER_ALL_CODEPAGE)
+
+// Fields that require USER_FORCE_PASSWORD_CHANGE access to write.
+//
+// Note that non-trusted clients only set the NT password as a
+// UNICODE string. The wrapper will convert it to an LM password,
+// OWF and encrypt both versions. Trusted clients can pass in OWF
+// versions of either or both.
+
+#define USER_ALL_WRITE_FORCE_PASSWORD_CHANGE_MASK \
+    (USER_ALL_NTPASSWORDPRESENT | \
+    USER_ALL_LMPASSWORDPRESENT | \
+    USER_ALL_PASSWORDEXPIRED)
+
+// Fields that can only be written by trusted clients.
+
+#define USER_ALL_WRITE_TRUSTED_MASK \
+    (USER_ALL_LASTLOGON | \
+    USER_ALL_LASTLOGOFF | \
+    USER_ALL_BADPASSWORDCOUNT | \
+    USER_ALL_LOGONCOUNT | \
+    USER_ALL_PASSWORDLASTSET | \
+    USER_ALL_SECURITYDESCRIPTOR | \
+    USER_ALL_PRIVATEDATA)
+
+// Fields that can't be written.
+
+#define USER_ALL_WRITE_CANT_MASK \
+    (USER_ALL_USERID | \
+    USER_ALL_PASSWORDCANCHANGE | \
+    USER_ALL_PASSWORDMUSTCHANGE | \
+    USER_ALL_UNDEFINED_MASK)
+
+#include <pshpack4.h>
+typedef struct _USER_ALL_INFORMATION
+{
+    LARGE_INTEGER LastLogon;
+    LARGE_INTEGER LastLogoff;
+    LARGE_INTEGER PasswordLastSet;
+    LARGE_INTEGER AccountExpires;
+    LARGE_INTEGER PasswordCanChange;
+    LARGE_INTEGER PasswordMustChange;
+    UNICODE_STRING UserName;
+    UNICODE_STRING FullName;
+    UNICODE_STRING HomeDirectory;
+    UNICODE_STRING HomeDirectoryDrive;
+    UNICODE_STRING ScriptPath;
+    UNICODE_STRING ProfilePath;
+    UNICODE_STRING AdminComment;
+    UNICODE_STRING WorkStations;
+    UNICODE_STRING UserComment;
+    UNICODE_STRING Parameters;
+    UNICODE_STRING LmPassword;
+    UNICODE_STRING NtPassword;
+    UNICODE_STRING PrivateData;
+    SR_SECURITY_DESCRIPTOR SecurityDescriptor;
+    ULONG UserId;
+    ULONG PrimaryGroupId;
+    ULONG UserAccountControl;
+    ULONG WhichFields;
     LOGON_HOURS LogonHours;
-} USER_LOGON_HOURS_INFORMATION, *PUSER_LOGON_HOURS_INFORMATION;
+    USHORT BadPasswordCount;
+    USHORT LogonCount;
+    USHORT CountryCode;
+    USHORT CodePage;
+    BOOLEAN LmPasswordPresent;
+    BOOLEAN NtPasswordPresent;
+    BOOLEAN PasswordExpired;
+    BOOLEAN PrivateDataSensitive;
+} USER_ALL_INFORMATION, *PUSER_ALL_INFORMATION;
+#include <poppack.h>
 
 typedef SAM_BYTE_ARRAY_32K SAM_USER_TILE, *PSAM_USER_TILE;
 
diff --git a/ntseapi.h b/ntseapi.h
index 3e3a0ed..d14a44d 100644
--- a/ntseapi.h
+++ b/ntseapi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
@@ -290,7 +290,7 @@ NtAdjustPrivilegesToken(
     _In_opt_ PTOKEN_PRIVILEGES NewState,
     _In_ ULONG BufferLength,
     _Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_PRIVILEGES PreviousState,
-    _Out_ _When_(PreviousState == NULL, _Out_opt_) PULONG ReturnLength
+    _Out_opt_ PULONG ReturnLength
     );
 
 NTSYSCALLAPI
diff --git a/ntsmss.h b/ntsmss.h
index 1ad6fdd..3731e88 100644
--- a/ntsmss.h
+++ b/ntsmss.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/nttmapi.h b/nttmapi.h
index bec6710..52fa853 100644
--- a/nttmapi.h
+++ b/nttmapi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/nttp.h b/nttp.h
index 8264e45..1c99a65 100644
--- a/nttp.h
+++ b/nttp.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
@@ -57,7 +57,7 @@ VOID
 NTAPI
 TpSetPoolMaxThreads(
     _Inout_ PTP_POOL Pool,
-    _In_ LONG MaxThreads
+    _In_ ULONG MaxThreads
     );
 
 // private
@@ -66,7 +66,7 @@ NTSTATUS
 NTAPI
 TpSetPoolMinThreads(
     _Inout_ PTP_POOL Pool,
-    _In_ LONG MinThreads
+    _In_ ULONG MinThreads
     );
 
 #if (PHNT_VERSION >= PHNT_WIN7)
@@ -134,7 +134,7 @@ NTAPI
 TpCallbackReleaseSemaphoreOnCompletion(
     _Inout_ PTP_CALLBACK_INSTANCE Instance,
     _In_ HANDLE Semaphore,
-    _In_ LONG ReleaseCount
+    _In_ ULONG ReleaseCount
     );
 
 // winbase:ReleaseMutexWhenCallbackReturns
@@ -255,10 +255,23 @@ NTAPI
 TpSetTimer(
     _Inout_ PTP_TIMER Timer,
     _In_opt_ PLARGE_INTEGER DueTime,
-    _In_ LONG Period,
-    _In_opt_ LONG WindowLength
+    _In_ ULONG Period,
+    _In_opt_ ULONG WindowLength
     );
 
+#if (PHNT_VERSION >= PHNT_WIN7)
+// winbase:SetThreadpoolTimerEx
+NTSYSAPI
+NTSTATUS
+NTAPI
+TpSetTimerEx(
+    _Inout_ PTP_TIMER Timer,
+    _In_opt_ PLARGE_INTEGER DueTime,
+    _In_ ULONG Period,
+    _In_opt_ ULONG WindowLength
+    );
+#endif
+
 // winbase:IsThreadpoolTimerSet
 NTSYSAPI
 LOGICAL
@@ -306,6 +319,19 @@ TpSetWait(
     _In_opt_ PLARGE_INTEGER Timeout
     );
 
+#if (PHNT_VERSION >= PHNT_WIN7)
+// winbase:SetThreadpoolWaitEx
+NTSYSAPI
+NTSTATUS
+NTAPI
+TpSetWaitEx(
+    _Inout_ PTP_WAIT Wait,
+    _In_opt_ HANDLE Handle,
+    _In_opt_ PLARGE_INTEGER Timeout,
+    _In_opt_ PVOID Reserved
+    );
+#endif
+
 // winbase:WaitForThreadpoolWaitCallbacks
 NTSYSAPI
 VOID
diff --git a/ntwow64.h b/ntwow64.h
index 14640e8..aa8ebda 100644
--- a/ntwow64.h
+++ b/ntwow64.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/ntxcapi.h b/ntxcapi.h
index 74bf7a8..b9d203c 100644
--- a/ntxcapi.h
+++ b/ntxcapi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/ntzwapi.h b/ntzwapi.h
index 196829d..5bd54d1 100644
--- a/ntzwapi.h
+++ b/ntzwapi.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
@@ -211,7 +211,7 @@ ZwAdjustGroupsToken(
     _In_opt_ PTOKEN_GROUPS NewState,
     _In_opt_ ULONG BufferLength,
     _Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_GROUPS PreviousState,
-    _Out_ PULONG ReturnLength
+    _Out_opt_ PULONG ReturnLength
     );
 
 NTSYSCALLAPI
@@ -223,7 +223,7 @@ ZwAdjustPrivilegesToken(
     _In_opt_ PTOKEN_PRIVILEGES NewState,
     _In_ ULONG BufferLength,
     _Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_PRIVILEGES PreviousState,
-    _Out_ _When_(PreviousState == NULL, _Out_opt_) PULONG ReturnLength
+    _Out_opt_ PULONG ReturnLength
     );
 
 NTSYSCALLAPI
@@ -844,14 +844,6 @@ ZwCreateFile(
     _In_ ULONG EaLength
     );
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-ZwCreateIRTimer(
-    _Out_ PHANDLE TimerHandle,
-    _In_ ACCESS_MASK DesiredAccess
-    );
-
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -862,6 +854,14 @@ ZwCreateIoCompletion(
     _In_opt_ ULONG Count
     );
 
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwCreateIRTimer(
+    _Out_ PHANDLE TimerHandle,
+    _In_ ACCESS_MASK DesiredAccess
+    );
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -893,6 +893,16 @@ ZwCreateKey(
     _Out_opt_ PULONG Disposition
     );
 
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwCreateKeyedEvent(
+    _Out_ PHANDLE KeyedEventHandle,
+    _In_ ACCESS_MASK DesiredAccess,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_ ULONG Flags
+    );
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -907,16 +917,6 @@ ZwCreateKeyTransacted(
     _Out_opt_ PULONG Disposition
     );
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-ZwCreateKeyedEvent(
-    _Out_ PHANDLE KeyedEventHandle,
-    _In_ ACCESS_MASK DesiredAccess,
-    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
-    _In_ ULONG Flags
-    );
-
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -1103,6 +1103,21 @@ ZwCreateSection(
     _In_opt_ HANDLE FileHandle
     );
 
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwCreateSectionEx(
+    _Out_ PHANDLE SectionHandle,
+    _In_ ACCESS_MASK DesiredAccess,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_opt_ PLARGE_INTEGER MaximumSize,
+    _In_ ULONG SectionPageProtection,
+    _In_ ULONG AllocationAttributes,
+    _In_opt_ HANDLE FileHandle,
+    _In_ PMEM_EXTENDED_PARAMETER ExtendedParameters,
+    _In_ ULONG ExtendedParameterCount
+    );
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -1263,15 +1278,6 @@ ZwCreateUserProcess(
     _In_opt_ PPS_ATTRIBUTE_LIST AttributeList
     );
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-ZwCreateWaitCompletionPacket(
-    _Out_ PHANDLE WaitCompletionPacketHandle,
-    _In_ ACCESS_MASK DesiredAccess,
-    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
-    );
-
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -1283,6 +1289,15 @@ ZwCreateWaitablePort(
     _In_opt_ ULONG MaxPoolUsage
     );
 
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwCreateWaitCompletionPacket(
+    _Out_ PHANDLE WaitCompletionPacketHandle,
+    _In_ ACCESS_MASK DesiredAccess,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
+    );
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -1334,7 +1349,7 @@ NTSTATUS
 NTAPI
 ZwDelayExecution(
     _In_ BOOLEAN Alertable,
-    _In_ PLARGE_INTEGER DelayInterval
+    _In_opt_ PLARGE_INTEGER DelayInterval
     );
 
 NTSYSCALLAPI
@@ -1445,7 +1460,7 @@ NTSYSCALLAPI
 NTSTATUS
 NTAPI
 ZwDrawText(
-    _In_ PUNICODE_STRING String
+    _In_ PUNICODE_STRING Text
     );
 
 NTSYSCALLAPI
@@ -1548,6 +1563,17 @@ ZwExtendSection(
     _Inout_ PLARGE_INTEGER NewSectionSize
     );
 
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwFilterBootOption(
+    _In_ FILTER_BOOT_OPTION_OPERATION FilterOperation,
+    _In_ ULONG ObjectType,
+    _In_ ULONG ElementType,
+    _In_reads_bytes_opt_(DataSize) PVOID Data,
+    _In_ ULONG DataSize
+    );
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -1756,7 +1782,7 @@ NTSYSCALLAPI
 NTSTATUS
 NTAPI
 ZwGetNextProcess(
-    _In_ HANDLE ProcessHandle,
+    _In_opt_ HANDLE ProcessHandle,
     _In_ ACCESS_MASK DesiredAccess,
     _In_ ULONG HandleAttributes,
     _In_ ULONG Flags,
@@ -2079,6 +2105,22 @@ ZwNotifyChangeDirectoryFile(
     _In_ BOOLEAN WatchTree
     );
 
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwNotifyChangeDirectoryFileEx(
+    _In_ HANDLE FileHandle,
+    _In_opt_ HANDLE Event,
+    _In_opt_ PIO_APC_ROUTINE ApcRoutine,
+    _In_opt_ PVOID ApcContext,
+    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
+    _Out_writes_bytes_(Length) PVOID Buffer,
+    _In_ ULONG Length,
+    _In_ ULONG CompletionFilter,
+    _In_ BOOLEAN WatchTree,
+    _In_opt_ DIRECTORY_NOTIFY_INFORMATION_CLASS DirectoryNotifyInformationClass
+    );
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -2204,6 +2246,15 @@ ZwOpenKey(
     _In_ POBJECT_ATTRIBUTES ObjectAttributes
     );
 
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwOpenKeyedEvent(
+    _Out_ PHANDLE KeyedEventHandle,
+    _In_ ACCESS_MASK DesiredAccess,
+    _In_ POBJECT_ATTRIBUTES ObjectAttributes
+    );
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -2235,15 +2286,6 @@ ZwOpenKeyTransactedEx(
     _In_ HANDLE TransactionHandle
     );
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-ZwOpenKeyedEvent(
-    _Out_ PHANDLE KeyedEventHandle,
-    _In_ ACCESS_MASK DesiredAccess,
-    _In_ POBJECT_ATTRIBUTES ObjectAttributes
-    );
-
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -2449,22 +2491,6 @@ ZwPowerInformation(
     _In_ ULONG OutputBufferLength
     );
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-ZwPrePrepareComplete(
-    _In_ HANDLE EnlistmentHandle,
-    _In_opt_ PLARGE_INTEGER TmVirtualClock
-    );
-
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-ZwPrePrepareEnlistment(
-    _In_ HANDLE EnlistmentHandle,
-    _In_opt_ PLARGE_INTEGER TmVirtualClock
-    );
-
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -2481,6 +2507,22 @@ ZwPrepareEnlistment(
     _In_opt_ PLARGE_INTEGER TmVirtualClock
     );
 
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwPrePrepareComplete(
+    _In_ HANDLE EnlistmentHandle,
+    _In_opt_ PLARGE_INTEGER TmVirtualClock
+    );
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwPrePrepareEnlistment(
+    _In_ HANDLE EnlistmentHandle,
+    _In_opt_ PLARGE_INTEGER TmVirtualClock
+    );
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -2490,6 +2532,17 @@ ZwPrivilegeCheck(
     _Out_ PBOOLEAN Result
     );
 
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwPrivilegedServiceAuditAlarm(
+    _In_ PUNICODE_STRING SubsystemName,
+    _In_ PUNICODE_STRING ServiceName,
+    _In_ HANDLE ClientToken,
+    _In_ PPRIVILEGE_SET Privileges,
+    _In_ BOOLEAN AccessGranted
+    );
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -2502,17 +2555,6 @@ ZwPrivilegeObjectAuditAlarm(
     _In_ BOOLEAN AccessGranted
     );
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-ZwPrivilegedServiceAuditAlarm(
-    _In_ PUNICODE_STRING SubsystemName,
-    _In_ PUNICODE_STRING ServiceName,
-    _In_ HANDLE ClientToken,
-    _In_ PPRIVILEGE_SET Privileges,
-    _In_ BOOLEAN AccessGranted
-    );
-
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -2681,6 +2723,17 @@ ZwQueryInformationAtom(
     _Out_opt_ PULONG ReturnLength
     );
 
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwQueryInformationByName(
+    _In_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
+    _Out_writes_bytes_(Length) PVOID FileInformation,
+    _In_ ULONG Length,
+    _In_ FILE_INFORMATION_CLASS FileInformationClass
+    );
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -2823,7 +2876,7 @@ NTAPI
 ZwQueryIoCompletion(
     _In_ HANDLE IoCompletionHandle,
     _In_ IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass,
-    _Out_writes_bytes_(IoCompletionInformation) PVOID IoCompletionInformation,
+    _Out_writes_bytes_(IoCompletionInformationLength) PVOID IoCompletionInformation,
     _In_ ULONG IoCompletionInformationLength,
     _Out_opt_ PULONG ReturnLength
     );
@@ -2877,7 +2930,7 @@ NTSYSCALLAPI
 NTSTATUS
 NTAPI
 ZwQueryObject(
-    _In_ HANDLE Handle,
+    _In_opt_ HANDLE Handle,
     _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
     _Out_writes_bytes_opt_(ObjectInformationLength) PVOID ObjectInformation,
     _In_ ULONG ObjectInformationLength,
@@ -2898,7 +2951,7 @@ NTAPI
 ZwQueryOpenSubKeysEx(
     _In_ POBJECT_ATTRIBUTES TargetKey,
     _In_ ULONG BufferLength,
-    _Out_writes_bytes_(BufferLength) PVOID Buffer,
+    _Out_writes_bytes_opt_(BufferLength) PVOID Buffer,
     _Out_ PULONG RequiredSize
     );
 
@@ -3073,7 +3126,7 @@ NTSTATUS
 NTAPI
 ZwQueryVirtualMemory(
     _In_ HANDLE ProcessHandle,
-    _In_ PVOID BaseAddress,
+    _In_opt_ PVOID BaseAddress,
     _In_ MEMORY_INFORMATION_CLASS MemoryInformationClass,
     _Out_writes_bytes_(MemoryInformationLength) PVOID MemoryInformation,
     _In_ SIZE_T MemoryInformationLength,
@@ -3667,14 +3720,6 @@ ZwSetHighWaitLowEventPair(
     _In_ HANDLE EventPairHandle
     );
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-ZwSetIRTimer(
-    _In_ HANDLE TimerHandle,
-    _In_opt_ PLARGE_INTEGER DueTime
-    );
-
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -3850,6 +3895,14 @@ ZwSetIoCompletionEx(
     _In_ ULONG_PTR IoStatusInformation
     );
 
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+ZwSetIRTimer(
+    _In_ HANDLE TimerHandle,
+    _In_opt_ PLARGE_INTEGER DueTime
+    );
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -4306,7 +4359,7 @@ ZwWaitForDebugEvent(
     _In_ HANDLE DebugObjectHandle,
     _In_ BOOLEAN Alertable,
     _In_opt_ PLARGE_INTEGER Timeout,
-    _Out_ PVOID WaitStateChange
+    _Out_ PDBGUI_WAIT_STATE_CHANGE WaitStateChange
     );
 
 NTSYSCALLAPI
diff --git a/phnt.h b/phnt.h
index e6d6fc9..c695224 100644
--- a/phnt.h
+++ b/phnt.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
@@ -50,6 +50,7 @@
 #define PHNT_REDSTONE4 105
 #define PHNT_REDSTONE5 106
 #define PHNT_19H1 107
+#define PHNT_19H2 108
 
 #ifndef PHNT_MODE
 #define PHNT_MODE PHNT_MODE_USER
diff --git a/phnt_ntdef.h b/phnt_ntdef.h
index a885feb..143ed30 100644
--- a/phnt_ntdef.h
+++ b/phnt_ntdef.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/phnt_windows.h b/phnt_windows.h
index f767293..1772b9f 100644
--- a/phnt_windows.h
+++ b/phnt_windows.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/subprocesstag.h b/subprocesstag.h
index 55a95f2..7d454e5 100644
--- a/subprocesstag.h
+++ b/subprocesstag.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license. 
diff --git a/winsta.h b/winsta.h
index 59cc925..3297b98 100644
--- a/winsta.h
+++ b/winsta.h
@@ -1,5 +1,5 @@
 /*
- * This file is part of the Process Hacker project - https://processhacker.sf.io/ 
+ * This file is part of the Process Hacker project - https://processhacker.sourceforge.io/
  *
  * You can redistribute this file and/or modify it under the terms of the 
  * Attribution 4.0 International (CC BY 4.0) license.