home *** CD-ROM | disk | FTP | other *** search
/ H4CK3R 14 / hacker14.iso / programacao / cwin / c.exe / $INSTDIR / include / ddk / ntifs.h < prev    next >
Encoding:
C/C++ Source or Header  |  2003-12-15  |  122.0 KB  |  4,685 lines
  1. /*
  2.  * ntifs.h
  3.  *
  4.  * Windows NT Filesystem Driver Developer Kit
  5.  *
  6.  * This file is part of the w32api package.
  7.  *
  8.  * Contributors:
  9.  *   Created by Bo BrantΘn <bosse@acc.umu.se>
  10.  *
  11.  * THIS SOFTWARE IS NOT COPYRIGHTED
  12.  *
  13.  * This source code is offered for use in the public domain. You may
  14.  * use, modify or distribute it freely.
  15.  *
  16.  * This code is distributed in the hope that it will be useful but
  17.  * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
  18.  * DISCLAIMED. This includes but is not limited to warranties of
  19.  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
  20.  *
  21.  */
  22.  
  23. #ifndef _NTIFS_
  24. #define _NTIFS_
  25. #define _GNU_NTIFS_
  26.  
  27. #if __GNUC__ >=3
  28. #pragma GCC system_header
  29. #endif
  30.  
  31. #ifdef __cplusplus
  32. extern "C" {
  33. #endif
  34.  
  35. #pragma pack(push,4)
  36.  
  37. #include "ntddk.h"
  38. #include "ntapi.h"
  39.  
  40. #define VER_PRODUCTBUILD 10000
  41.  
  42. #ifndef NTSYSAPI
  43. #define NTSYSAPI
  44. #endif
  45.  
  46. #ifndef NTKERNELAPI
  47. #define NTKERNELAPI STDCALL
  48. #endif
  49.  
  50. typedef struct _SE_EXPORTS                  *PSE_EXPORTS;
  51.  
  52. extern PUCHAR                       *FsRtlLegalAnsiCharacterArray;
  53. extern PSE_EXPORTS                  SeExports;
  54. extern PACL                         SePublicDefaultDacl;
  55. extern PACL                         SeSystemDefaultDacl;
  56.  
  57. #define ACCESS_ALLOWED_ACE_TYPE         (0x0)
  58. #define ACCESS_DENIED_ACE_TYPE          (0x1)
  59. #define SYSTEM_AUDIT_ACE_TYPE           (0x2)
  60. #define SYSTEM_ALARM_ACE_TYPE           (0x3)
  61.  
  62. #define ANSI_DOS_STAR                   ('<')
  63. #define ANSI_DOS_QM                     ('>')
  64. #define ANSI_DOS_DOT                    ('"')
  65.  
  66. #define DOS_STAR                        (L'<')
  67. #define DOS_QM                          (L'>')
  68. #define DOS_DOT                         (L'"')
  69.  
  70. #define COMPRESSION_FORMAT_NONE         (0x0000)
  71. #define COMPRESSION_FORMAT_DEFAULT      (0x0001)
  72. #define COMPRESSION_FORMAT_LZNT1        (0x0002)
  73. #define COMPRESSION_ENGINE_STANDARD     (0x0000)
  74. #define COMPRESSION_ENGINE_MAXIMUM      (0x0100)
  75. #define COMPRESSION_ENGINE_HIBER        (0x0200)
  76.  
  77. #define FILE_ACTION_ADDED                   0x00000001
  78. #define FILE_ACTION_REMOVED                 0x00000002
  79. #define FILE_ACTION_MODIFIED                0x00000003
  80. #define FILE_ACTION_RENAMED_OLD_NAME        0x00000004
  81. #define FILE_ACTION_RENAMED_NEW_NAME        0x00000005
  82. #define FILE_ACTION_ADDED_STREAM            0x00000006
  83. #define FILE_ACTION_REMOVED_STREAM          0x00000007
  84. #define FILE_ACTION_MODIFIED_STREAM         0x00000008
  85. #define FILE_ACTION_REMOVED_BY_DELETE       0x00000009
  86. #define FILE_ACTION_ID_NOT_TUNNELLED        0x0000000A
  87. #define FILE_ACTION_TUNNELLED_ID_COLLISION  0x0000000B
  88.  
  89. #define FILE_EA_TYPE_BINARY             0xfffe
  90. #define FILE_EA_TYPE_ASCII              0xfffd
  91. #define FILE_EA_TYPE_BITMAP             0xfffb
  92. #define FILE_EA_TYPE_METAFILE           0xfffa
  93. #define FILE_EA_TYPE_ICON               0xfff9
  94. #define FILE_EA_TYPE_EA                 0xffee
  95. #define FILE_EA_TYPE_MVMT               0xffdf
  96. #define FILE_EA_TYPE_MVST               0xffde
  97. #define FILE_EA_TYPE_ASN1               0xffdd
  98. #define FILE_EA_TYPE_FAMILY_IDS         0xff01
  99.  
  100. #define FILE_NEED_EA                    0x00000080
  101.  
  102. #define FILE_NOTIFY_CHANGE_FILE_NAME    0x00000001
  103. #define FILE_NOTIFY_CHANGE_DIR_NAME     0x00000002
  104. #define FILE_NOTIFY_CHANGE_NAME         0x00000003
  105. #define FILE_NOTIFY_CHANGE_ATTRIBUTES   0x00000004
  106. #define FILE_NOTIFY_CHANGE_SIZE         0x00000008
  107. #define FILE_NOTIFY_CHANGE_LAST_WRITE   0x00000010
  108. #define FILE_NOTIFY_CHANGE_LAST_ACCESS  0x00000020
  109. #define FILE_NOTIFY_CHANGE_CREATION     0x00000040
  110. #define FILE_NOTIFY_CHANGE_EA           0x00000080
  111. #define FILE_NOTIFY_CHANGE_SECURITY     0x00000100
  112. #define FILE_NOTIFY_CHANGE_STREAM_NAME  0x00000200
  113. #define FILE_NOTIFY_CHANGE_STREAM_SIZE  0x00000400
  114. #define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
  115. #define FILE_NOTIFY_VALID_MASK          0x00000fff
  116.  
  117. #define FILE_OPLOCK_BROKEN_TO_LEVEL_2   0x00000007
  118. #define FILE_OPLOCK_BROKEN_TO_NONE      0x00000008
  119.  
  120. #define FILE_OPBATCH_BREAK_UNDERWAY     0x00000009
  121.  
  122. #define FILE_CASE_SENSITIVE_SEARCH      0x00000001
  123. #define FILE_CASE_PRESERVED_NAMES       0x00000002
  124. #define FILE_UNICODE_ON_DISK            0x00000004
  125. #define FILE_PERSISTENT_ACLS            0x00000008
  126. #define FILE_FILE_COMPRESSION           0x00000010
  127. #define FILE_VOLUME_QUOTAS              0x00000020
  128. #define FILE_SUPPORTS_SPARSE_FILES      0x00000040
  129. #define FILE_SUPPORTS_REPARSE_POINTS    0x00000080
  130. #define FILE_SUPPORTS_REMOTE_STORAGE    0x00000100
  131. #define FS_LFN_APIS                     0x00004000
  132. #define FILE_VOLUME_IS_COMPRESSED       0x00008000
  133. #define FILE_SUPPORTS_OBJECT_IDS        0x00010000
  134. #define FILE_SUPPORTS_ENCRYPTION        0x00020000
  135. #define FILE_NAMED_STREAMS              0x00040000
  136.  
  137. #define FILE_PIPE_BYTE_STREAM_TYPE      0x00000000
  138. #define FILE_PIPE_MESSAGE_TYPE          0x00000001
  139.  
  140. #define FILE_PIPE_BYTE_STREAM_MODE      0x00000000
  141. #define FILE_PIPE_MESSAGE_MODE          0x00000001
  142.  
  143. #define FILE_PIPE_QUEUE_OPERATION       0x00000000
  144. #define FILE_PIPE_COMPLETE_OPERATION    0x00000001
  145.  
  146. #define FILE_PIPE_INBOUND               0x00000000
  147. #define FILE_PIPE_OUTBOUND              0x00000001
  148. #define FILE_PIPE_FULL_DUPLEX           0x00000002
  149.  
  150. #define FILE_PIPE_DISCONNECTED_STATE    0x00000001
  151. #define FILE_PIPE_LISTENING_STATE       0x00000002
  152. #define FILE_PIPE_CONNECTED_STATE       0x00000003
  153. #define FILE_PIPE_CLOSING_STATE         0x00000004
  154.  
  155. #define FILE_PIPE_CLIENT_END            0x00000000
  156. #define FILE_PIPE_SERVER_END            0x00000001
  157.  
  158. #define FILE_PIPE_READ_DATA             0x00000000
  159. #define FILE_PIPE_WRITE_SPACE           0x00000001
  160.  
  161. #define FILE_STORAGE_TYPE_SPECIFIED             0x00000041  // FILE_DIRECTORY_FILE | FILE_NON_DIRECTORY_FILE
  162. #define FILE_STORAGE_TYPE_DEFAULT               (StorageTypeDefault << FILE_STORAGE_TYPE_SHIFT)
  163. #define FILE_STORAGE_TYPE_DIRECTORY             (StorageTypeDirectory << FILE_STORAGE_TYPE_SHIFT)
  164. #define FILE_STORAGE_TYPE_FILE                  (StorageTypeFile << FILE_STORAGE_TYPE_SHIFT)
  165. #define FILE_STORAGE_TYPE_DOCFILE               (StorageTypeDocfile << FILE_STORAGE_TYPE_SHIFT)
  166. #define FILE_STORAGE_TYPE_JUNCTION_POINT        (StorageTypeJunctionPoint << FILE_STORAGE_TYPE_SHIFT)
  167. #define FILE_STORAGE_TYPE_CATALOG               (StorageTypeCatalog << FILE_STORAGE_TYPE_SHIFT)
  168. #define FILE_STORAGE_TYPE_STRUCTURED_STORAGE    (StorageTypeStructuredStorage << FILE_STORAGE_TYPE_SHIFT)
  169. #define FILE_STORAGE_TYPE_EMBEDDING             (StorageTypeEmbedding << FILE_STORAGE_TYPE_SHIFT)
  170. #define FILE_STORAGE_TYPE_STREAM                (StorageTypeStream << FILE_STORAGE_TYPE_SHIFT)
  171. #define FILE_MINIMUM_STORAGE_TYPE               FILE_STORAGE_TYPE_DEFAULT
  172. #define FILE_MAXIMUM_STORAGE_TYPE               FILE_STORAGE_TYPE_STREAM
  173. #define FILE_STORAGE_TYPE_MASK                  0x000f0000
  174. #define FILE_STORAGE_TYPE_SHIFT                 16
  175.  
  176. #define FILE_VC_QUOTA_NONE              0x00000000
  177. #define FILE_VC_QUOTA_TRACK             0x00000001
  178. #define FILE_VC_QUOTA_ENFORCE           0x00000002
  179. #define FILE_VC_QUOTA_MASK              0x00000003
  180.  
  181. #define FILE_VC_QUOTAS_LOG_VIOLATIONS   0x00000004
  182. #define FILE_VC_CONTENT_INDEX_DISABLED  0x00000008
  183.  
  184. #define FILE_VC_LOG_QUOTA_THRESHOLD     0x00000010
  185. #define FILE_VC_LOG_QUOTA_LIMIT         0x00000020
  186. #define FILE_VC_LOG_VOLUME_THRESHOLD    0x00000040
  187. #define FILE_VC_LOG_VOLUME_LIMIT        0x00000080
  188.  
  189. #define FILE_VC_QUOTAS_INCOMPLETE       0x00000100
  190. #define FILE_VC_QUOTAS_REBUILDING       0x00000200
  191.  
  192. #define FILE_VC_VALID_MASK              0x000003ff
  193.  
  194. #define FSRTL_FLAG_FILE_MODIFIED        (0x01)
  195. #define FSRTL_FLAG_FILE_LENGTH_CHANGED  (0x02)
  196. #define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04)
  197. #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08)
  198. #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10)
  199. #define FSRTL_FLAG_USER_MAPPED_FILE     (0x20)
  200. #define FSRTL_FLAG_EOF_ADVANCE_ACTIVE   (0x80)
  201.  
  202. #define FSRTL_FLAG2_DO_MODIFIED_WRITE   (0x01)
  203.  
  204. #define FSRTL_FSP_TOP_LEVEL_IRP         (0x01)
  205. #define FSRTL_CACHE_TOP_LEVEL_IRP       (0x02)
  206. #define FSRTL_MOD_WRITE_TOP_LEVEL_IRP   (0x03)
  207. #define FSRTL_FAST_IO_TOP_LEVEL_IRP     (0x04)
  208. #define FSRTL_MAX_TOP_LEVEL_IRP_FLAG    (0x04)
  209.  
  210. #define FSRTL_VOLUME_DISMOUNT           1
  211. #define FSRTL_VOLUME_DISMOUNT_FAILED    2
  212. #define FSRTL_VOLUME_LOCK               3
  213. #define FSRTL_VOLUME_LOCK_FAILED        4
  214. #define FSRTL_VOLUME_UNLOCK             5
  215. #define FSRTL_VOLUME_MOUNT              6
  216.  
  217. #define FSRTL_WILD_CHARACTER            0x08
  218.  
  219. #ifdef _X86_
  220. #define HARDWARE_PTE    HARDWARE_PTE_X86
  221. #define PHARDWARE_PTE   PHARDWARE_PTE_X86
  222. #else
  223. #define HARDWARE_PTE    ULONG
  224. #define PHARDWARE_PTE   PULONG
  225. #endif
  226.  
  227. #define IO_CHECK_CREATE_PARAMETERS      0x0200
  228. #define IO_ATTACH_DEVICE                0x0400
  229.  
  230. #define IO_ATTACH_DEVICE_API            0x80000000
  231.  
  232. #define IO_COMPLETION_QUERY_STATE       0x0001
  233. #define IO_COMPLETION_MODIFY_STATE      0x0002
  234. #define IO_COMPLETION_ALL_ACCESS        (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3)
  235.  
  236. #define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE    64
  237. #define IO_FILE_OBJECT_PAGED_POOL_CHARGE        1024
  238.  
  239. #define IO_TYPE_APC                     18
  240. #define IO_TYPE_DPC                     19
  241. #define IO_TYPE_DEVICE_QUEUE            20
  242. #define IO_TYPE_EVENT_PAIR              21
  243. #define IO_TYPE_INTERRUPT               22
  244. #define IO_TYPE_PROFILE                 23
  245.  
  246. #define IRP_BEING_VERIFIED              0x10
  247.  
  248. #define MAILSLOT_CLASS_FIRSTCLASS       1
  249. #define MAILSLOT_CLASS_SECONDCLASS      2
  250.  
  251. #define MAILSLOT_SIZE_AUTO              0
  252.  
  253. #define MAP_PROCESS                     1L
  254. #define MAP_SYSTEM                      2L
  255.  
  256. #define MEM_DOS_LIM                     0x40000000
  257. #define MEM_IMAGE                       SEC_IMAGE
  258.  
  259. #define OB_TYPE_TYPE                    1
  260. #define OB_TYPE_DIRECTORY               2
  261. #define OB_TYPE_SYMBOLIC_LINK           3
  262. #define OB_TYPE_TOKEN                   4
  263. #define OB_TYPE_PROCESS                 5
  264. #define OB_TYPE_THREAD                  6
  265. #define OB_TYPE_EVENT                   7
  266. #define OB_TYPE_EVENT_PAIR              8
  267. #define OB_TYPE_MUTANT                  9
  268. #define OB_TYPE_SEMAPHORE               10
  269. #define OB_TYPE_TIMER                   11
  270. #define OB_TYPE_PROFILE                 12
  271. #define OB_TYPE_WINDOW_STATION          13
  272. #define OB_TYPE_DESKTOP                 14
  273. #define OB_TYPE_SECTION                 15
  274. #define OB_TYPE_KEY                     16
  275. #define OB_TYPE_PORT                    17
  276. #define OB_TYPE_ADAPTER                 18
  277. #define OB_TYPE_CONTROLLER              19
  278. #define OB_TYPE_DEVICE                  20
  279. #define OB_TYPE_DRIVER                  21
  280. #define OB_TYPE_IO_COMPLETION           22
  281. #define OB_TYPE_FILE                    23
  282.  
  283. #define PIN_WAIT                        (1)
  284. #define PIN_EXCLUSIVE                   (2)
  285. #define PIN_NO_READ                     (4)
  286. #define PIN_IF_BCB                      (8)
  287.  
  288. #define PORT_CONNECT                    0x0001
  289. #define PORT_ALL_ACCESS                 (STANDARD_RIGHTS_ALL |\
  290.                                          PORT_CONNECT)
  291.  
  292. #define SEC_BASED                       0x00200000
  293. #define SEC_NO_CHANGE                   0x00400000
  294. #define SEC_FILE                        0x00800000
  295. #define SEC_IMAGE                       0x01000000
  296. #define SEC_COMMIT                      0x08000000
  297. #define SEC_NOCACHE                     0x10000000
  298.  
  299. #define SECURITY_WORLD_SID_AUTHORITY    {0,0,0,0,0,1}
  300. #define SECURITY_WORLD_RID              (0x00000000L)
  301.  
  302. #define SID_REVISION                    1
  303.  
  304. #define TOKEN_ASSIGN_PRIMARY            (0x0001)
  305. #define TOKEN_DUPLICATE                 (0x0002)
  306. #define TOKEN_IMPERSONATE               (0x0004)
  307. #define TOKEN_QUERY                     (0x0008)
  308. #define TOKEN_QUERY_SOURCE              (0x0010)
  309. #define TOKEN_ADJUST_PRIVILEGES         (0x0020)
  310. #define TOKEN_ADJUST_GROUPS             (0x0040)
  311. #define TOKEN_ADJUST_DEFAULT            (0x0080)
  312.  
  313. #define TOKEN_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED |\
  314.                           TOKEN_ASSIGN_PRIMARY     |\
  315.                           TOKEN_DUPLICATE          |\
  316.                           TOKEN_IMPERSONATE        |\
  317.                           TOKEN_QUERY              |\
  318.                           TOKEN_QUERY_SOURCE       |\
  319.                           TOKEN_ADJUST_PRIVILEGES  |\
  320.                           TOKEN_ADJUST_GROUPS      |\
  321.                           TOKEN_ADJUST_DEFAULT)
  322.  
  323. #define TOKEN_READ       (STANDARD_RIGHTS_READ     |\
  324.                           TOKEN_QUERY)
  325.  
  326. #define TOKEN_WRITE      (STANDARD_RIGHTS_WRITE    |\
  327.                           TOKEN_ADJUST_PRIVILEGES  |\
  328.                           TOKEN_ADJUST_GROUPS      |\
  329.                           TOKEN_ADJUST_DEFAULT)
  330.  
  331. #define TOKEN_EXECUTE    (STANDARD_RIGHTS_EXECUTE)
  332.  
  333. #define TOKEN_SOURCE_LENGTH 8
  334.  
  335. #define TOKEN_HAS_TRAVERSE_PRIVILEGE    0x01
  336. #define TOKEN_HAS_BACKUP_PRIVILEGE      0x02
  337. #define TOKEN_HAS_RESTORE_PRIVILEGE     0x04
  338. #define TOKEN_HAS_ADMIN_GROUP           0x08
  339. #define TOKEN_IS_RESTRICTED             0x10
  340.  
  341. #define VACB_MAPPING_GRANULARITY        (0x40000)
  342. #define VACB_OFFSET_SHIFT               (18)
  343.  
  344. #define FSCTL_REQUEST_OPLOCK_LEVEL_1    CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  0, METHOD_BUFFERED, FILE_ANY_ACCESS)
  345. #define FSCTL_REQUEST_OPLOCK_LEVEL_2    CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  1, METHOD_BUFFERED, FILE_ANY_ACCESS)
  346. #define FSCTL_REQUEST_BATCH_OPLOCK      CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  2, METHOD_BUFFERED, FILE_ANY_ACCESS)
  347. #define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE  CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  3, METHOD_BUFFERED, FILE_ANY_ACCESS)
  348. #define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  4, METHOD_BUFFERED, FILE_ANY_ACCESS)
  349. #define FSCTL_OPLOCK_BREAK_NOTIFY       CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  5, METHOD_BUFFERED, FILE_ANY_ACCESS)
  350. #define FSCTL_LOCK_VOLUME               CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  6, METHOD_BUFFERED, FILE_ANY_ACCESS)
  351. #define FSCTL_UNLOCK_VOLUME             CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  7, METHOD_BUFFERED, FILE_ANY_ACCESS)
  352. #define FSCTL_DISMOUNT_VOLUME           CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  8, METHOD_BUFFERED, FILE_ANY_ACCESS)
  353.  
  354. #define FSCTL_IS_VOLUME_MOUNTED         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
  355. #define FSCTL_IS_PATHNAME_VALID         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
  356. #define FSCTL_MARK_VOLUME_DIRTY         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
  357.  
  358. #define FSCTL_QUERY_RETRIEVAL_POINTERS  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14,  METHOD_NEITHER, FILE_ANY_ACCESS)
  359. #define FSCTL_GET_COMPRESSION           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
  360. #define FSCTL_SET_COMPRESSION           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
  361.  
  362.  
  363. #define FSCTL_MARK_AS_SYSTEM_HIVE       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19,  METHOD_NEITHER, FILE_ANY_ACCESS)
  364. #define FSCTL_OPLOCK_BREAK_ACK_NO_2     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
  365. #define FSCTL_INVALIDATE_VOLUMES        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
  366. #define FSCTL_QUERY_FAT_BPB             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS)
  367. #define FSCTL_REQUEST_FILTER_OPLOCK     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
  368. #define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS)
  369.  
  370. #if (VER_PRODUCTBUILD >= 1381)
  371.  
  372. #define FSCTL_GET_NTFS_VOLUME_DATA      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS)
  373. #define FSCTL_GET_NTFS_FILE_RECORD      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS)
  374. #define FSCTL_GET_VOLUME_BITMAP         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27,  METHOD_NEITHER, FILE_ANY_ACCESS)
  375. #define FSCTL_GET_RETRIEVAL_POINTERS    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28,  METHOD_NEITHER, FILE_ANY_ACCESS)
  376. #define FSCTL_MOVE_FILE                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_ANY_ACCESS)
  377. #define FSCTL_IS_VOLUME_DIRTY           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
  378. #define FSCTL_GET_HFS_INFORMATION       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS)
  379. #define FSCTL_ALLOW_EXTENDED_DASD_IO    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER,  FILE_ANY_ACCESS)
  380.  
  381. #endif // (VER_PRODUCTBUILD >= 1381)
  382.  
  383. #if (VER_PRODUCTBUILD >= 2195)
  384.  
  385. #define FSCTL_READ_PROPERTY_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 33, METHOD_NEITHER, FILE_ANY_ACCESS)
  386. #define FSCTL_WRITE_PROPERTY_DATA       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 34, METHOD_NEITHER, FILE_ANY_ACCESS)
  387. #define FSCTL_FIND_FILES_BY_SID         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS)
  388.  
  389. #define FSCTL_DUMP_PROPERTY_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 37,  METHOD_NEITHER, FILE_ANY_ACCESS)
  390. #define FSCTL_SET_OBJECT_ID             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_WRITE_DATA)
  391. #define FSCTL_GET_OBJECT_ID             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS)
  392. #define FSCTL_DELETE_OBJECT_ID          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_WRITE_DATA)
  393. #define FSCTL_SET_REPARSE_POINT         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_WRITE_DATA)
  394. #define FSCTL_GET_REPARSE_POINT         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS)
  395. #define FSCTL_DELETE_REPARSE_POINT      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_WRITE_DATA)
  396. #define FSCTL_ENUM_USN_DATA             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44,  METHOD_NEITHER, FILE_READ_DATA)
  397. #define FSCTL_SECURITY_ID_CHECK         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45,  METHOD_NEITHER, FILE_READ_DATA)
  398. #define FSCTL_READ_USN_JOURNAL          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46,  METHOD_NEITHER, FILE_READ_DATA)
  399. #define FSCTL_SET_OBJECT_ID_EXTENDED    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_WRITE_DATA)
  400. #define FSCTL_CREATE_OR_GET_OBJECT_ID   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS)
  401. #define FSCTL_SET_SPARSE                CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_WRITE_DATA)
  402. #define FSCTL_SET_ZERO_DATA             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA)
  403. #define FSCTL_QUERY_ALLOCATED_RANGES    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51,  METHOD_NEITHER, FILE_READ_DATA)
  404. #define FSCTL_ENABLE_UPGRADE            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA)
  405. #define FSCTL_SET_ENCRYPTION            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_BUFFERED, FILE_ANY_ACCESS)
  406. #define FSCTL_ENCRYPTION_FSCTL_IO       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54,  METHOD_NEITHER, FILE_ANY_ACCESS)
  407. #define FSCTL_WRITE_RAW_ENCRYPTED       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55,  METHOD_NEITHER, FILE_ANY_ACCESS)
  408. #define FSCTL_READ_RAW_ENCRYPTED        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56,  METHOD_NEITHER, FILE_ANY_ACCESS)
  409. #define FSCTL_CREATE_USN_JOURNAL        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57,  METHOD_NEITHER, FILE_READ_DATA)
  410. #define FSCTL_READ_FILE_USN_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58,  METHOD_NEITHER, FILE_READ_DATA)
  411. #define FSCTL_WRITE_USN_CLOSE_RECORD    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59,  METHOD_NEITHER, FILE_READ_DATA)
  412. #define FSCTL_EXTEND_VOLUME             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
  413. #define FSCTL_QUERY_USN_JOURNAL         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
  414. #define FSCTL_DELETE_USN_JOURNAL        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
  415. #define FSCTL_MARK_HANDLE               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS)
  416. #define FSCTL_SIS_COPYFILE              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS)
  417. #define FSCTL_SIS_LINK_FILES            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
  418. #define FSCTL_HSM_MSG                   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
  419. #define FSCTL_NSS_CONTROL               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 67, METHOD_BUFFERED, FILE_WRITE_DATA)
  420. #define FSCTL_HSM_DATA                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
  421. #define FSCTL_RECALL_FILE               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS)
  422. #define FSCTL_NSS_RCONTROL              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 70, METHOD_BUFFERED, FILE_READ_DATA)
  423. #define FSCTL_READ_FROM_PLEX            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA)
  424. #define FSCTL_FILE_PREFETCH             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
  425.  
  426. #endif // (VER_PRODUCTBUILD >= 2195)
  427.  
  428. #define FSCTL_MAILSLOT_PEEK             CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)
  429.  
  430. #define FSCTL_NETWORK_SET_CONFIGURATION_INFO    CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 102, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
  431. #define FSCTL_NETWORK_GET_CONFIGURATION_INFO    CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 103, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
  432. #define FSCTL_NETWORK_GET_CONNECTION_INFO       CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 104, METHOD_NEITHER, FILE_ANY_ACCESS)
  433. #define FSCTL_NETWORK_ENUMERATE_CONNECTIONS     CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 105, METHOD_NEITHER, FILE_ANY_ACCESS)
  434. #define FSCTL_NETWORK_DELETE_CONNECTION         CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 107, METHOD_BUFFERED, FILE_ANY_ACCESS)
  435. #define FSCTL_NETWORK_GET_STATISTICS            CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 116, METHOD_BUFFERED, FILE_ANY_ACCESS)
  436. #define FSCTL_NETWORK_SET_DOMAIN_NAME           CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_ANY_ACCESS)
  437. #define FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT     CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_ANY_ACCESS)
  438.  
  439. #define FSCTL_PIPE_ASSIGN_EVENT         CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
  440. #define FSCTL_PIPE_DISCONNECT           CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
  441. #define FSCTL_PIPE_LISTEN               CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
  442. #define FSCTL_PIPE_PEEK                 CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
  443. #define FSCTL_PIPE_QUERY_EVENT          CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
  444. #define FSCTL_PIPE_TRANSCEIVE           CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER,  FILE_READ_DATA | FILE_WRITE_DATA)
  445. #define FSCTL_PIPE_WAIT                 CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
  446. #define FSCTL_PIPE_IMPERSONATE          CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
  447. #define FSCTL_PIPE_SET_CLIENT_PROCESS   CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
  448. #define FSCTL_PIPE_QUERY_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
  449. #define FSCTL_PIPE_INTERNAL_READ        CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
  450. #define FSCTL_PIPE_INTERNAL_WRITE       CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
  451. #define FSCTL_PIPE_INTERNAL_TRANSCEIVE  CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
  452. #define FSCTL_PIPE_INTERNAL_READ_OVFLOW CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
  453.  
  454. #define IOCTL_REDIR_QUERY_PATH          CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
  455.  
  456. typedef PVOID PEJOB;
  457. typedef PVOID OPLOCK, *POPLOCK;
  458. typedef PVOID PWOW64_PROCESS;
  459.  
  460. typedef struct _CACHE_MANAGER_CALLBACKS         *PCACHE_MANAGER_CALLBACKS;
  461. typedef struct _EPROCESS_QUOTA_BLOCK            *PEPROCESS_QUOTA_BLOCK;
  462. typedef struct _FILE_GET_QUOTA_INFORMATION      *PFILE_GET_QUOTA_INFORMATION;
  463. typedef struct _HANDLE_TABLE                    *PHANDLE_TABLE;
  464. typedef struct _KEVENT_PAIR                     *PKEVENT_PAIR;
  465. typedef struct _KPROCESS                        *PKPROCESS;
  466. typedef struct _KQUEUE                          *PKQUEUE;
  467. typedef struct _KTRAP_FRAME                     *PKTRAP_FRAME;
  468. typedef struct _MAILSLOT_CREATE_PARAMETERS      *PMAILSLOT_CREATE_PARAMETERS;
  469. typedef struct _MMWSL                           *PMMWSL;
  470. typedef struct _NAMED_PIPE_CREATE_PARAMETERS    *PNAMED_PIPE_CREATE_PARAMETERS;
  471. typedef struct _OBJECT_DIRECTORY                *POBJECT_DIRECTORY;
  472. typedef struct _PAGEFAULT_HISTORY               *PPAGEFAULT_HISTORY;
  473. typedef struct _PS_IMPERSONATION_INFORMATION    *PPS_IMPERSONATION_INFORMATION;
  474. typedef struct _SECTION_OBJECT                  *PSECTION_OBJECT;
  475. typedef struct _SHARED_CACHE_MAP                *PSHARED_CACHE_MAP;
  476. typedef struct _TERMINATION_PORT                *PTERMINATION_PORT;
  477. typedef struct _VACB                            *PVACB;
  478. typedef struct _VAD_HEADER                      *PVAD_HEADER;
  479.  
  480. typedef struct _NOTIFY_SYNC
  481. {
  482.     ULONG Unknown0;
  483.     ULONG Unknown1;
  484.     ULONG Unknown2;
  485.     USHORT Unknown3;
  486.     USHORT Unknown4;
  487.     ULONG Unknown5;
  488.     ULONG Unknown6;
  489.     ULONG Unknown7;
  490.     ULONG Unknown8;
  491.     ULONG Unknown9;
  492.     ULONG Unknown10;
  493. } NOTIFY_SYNC, * PNOTIFY_SYNC;
  494.  
  495. typedef enum _FAST_IO_POSSIBLE {
  496.     FastIoIsNotPossible,
  497.     FastIoIsPossible,
  498.     FastIoIsQuestionable
  499. } FAST_IO_POSSIBLE;
  500.  
  501. typedef enum _FILE_STORAGE_TYPE {
  502.     StorageTypeDefault = 1,
  503.     StorageTypeDirectory,
  504.     StorageTypeFile,
  505.     StorageTypeJunctionPoint,
  506.     StorageTypeCatalog,
  507.     StorageTypeStructuredStorage,
  508.     StorageTypeEmbedding,
  509.     StorageTypeStream
  510. } FILE_STORAGE_TYPE;
  511.  
  512. typedef enum _IO_COMPLETION_INFORMATION_CLASS {
  513.     IoCompletionBasicInformation
  514. } IO_COMPLETION_INFORMATION_CLASS;
  515.  
  516. typedef enum _OBJECT_INFO_CLASS {
  517.     ObjectBasicInfo,
  518.     ObjectNameInfo,
  519.     ObjectTypeInfo,
  520.     ObjectAllTypesInfo,
  521.     ObjectProtectionInfo
  522. } OBJECT_INFO_CLASS;
  523.  
  524. typedef struct _HARDWARE_PTE_X86 {
  525.     ULONG Valid             : 1;
  526.     ULONG Write             : 1;
  527.     ULONG Owner             : 1;
  528.     ULONG WriteThrough      : 1;
  529.     ULONG CacheDisable      : 1;
  530.     ULONG Accessed          : 1;
  531.     ULONG Dirty             : 1;
  532.     ULONG LargePage         : 1;
  533.     ULONG Global            : 1;
  534.     ULONG CopyOnWrite       : 1;
  535.     ULONG Prototype         : 1;
  536.     ULONG reserved          : 1;
  537.     ULONG PageFrameNumber   : 20;
  538. } HARDWARE_PTE_X86, *PHARDWARE_PTE_X86;
  539.  
  540. typedef struct _KAPC_STATE {
  541.     LIST_ENTRY  ApcListHead[2];
  542.     PKPROCESS   Process;
  543.     BOOLEAN     KernelApcInProgress;
  544.     BOOLEAN     KernelApcPending;
  545.     BOOLEAN     UserApcPending;
  546. } KAPC_STATE, *PKAPC_STATE;
  547.  
  548. typedef struct _KGDTENTRY {
  549.     USHORT LimitLow;
  550.     USHORT BaseLow;
  551.     union {
  552.         struct {
  553.             UCHAR BaseMid;
  554.             UCHAR Flags1;
  555.             UCHAR Flags2;
  556.             UCHAR BaseHi;
  557.         } Bytes;
  558.         struct {
  559.             ULONG BaseMid       : 8;
  560.             ULONG Type          : 5;
  561.             ULONG Dpl           : 2;
  562.             ULONG Pres          : 1;
  563.             ULONG LimitHi       : 4;
  564.             ULONG Sys           : 1;
  565.             ULONG Reserved_0    : 1;
  566.             ULONG Default_Big   : 1;
  567.             ULONG Granularity   : 1;
  568.             ULONG BaseHi        : 8;
  569.         } Bits;
  570.     } HighWord;
  571. } KGDTENTRY, *PKGDTENTRY;
  572.  
  573. typedef struct _KIDTENTRY {
  574.     USHORT Offset;
  575.     USHORT Selector;
  576.     USHORT Access;
  577.     USHORT ExtendedOffset;
  578. } KIDTENTRY, *PKIDTENTRY;
  579.  
  580. #if (VER_PRODUCTBUILD >= 2600)
  581.  
  582. typedef struct _MMSUPPORT_FLAGS {
  583.     ULONG SessionSpace              : 1;
  584.     ULONG BeingTrimmed              : 1;
  585.     ULONG SessionLeader             : 1;
  586.     ULONG TrimHard                  : 1;
  587.     ULONG WorkingSetHard            : 1;
  588.     ULONG AddressSpaceBeingDeleted  : 1;
  589.     ULONG Available                 : 10;
  590.     ULONG AllowWorkingSetAdjustment : 8;
  591.     ULONG MemoryPriority            : 8;
  592. } MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS;
  593.  
  594. #else
  595.  
  596. typedef struct _MMSUPPORT_FLAGS {
  597.     ULONG SessionSpace      : 1;
  598.     ULONG BeingTrimmed      : 1;
  599.     ULONG ProcessInSession  : 1;
  600.     ULONG SessionLeader     : 1;
  601.     ULONG TrimHard          : 1;
  602.     ULONG WorkingSetHard    : 1;
  603.     ULONG WriteWatch        : 1;
  604.     ULONG Filler            : 25;
  605. } MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS;
  606.  
  607. #endif
  608.  
  609. #if (VER_PRODUCTBUILD >= 2600)
  610.  
  611. typedef struct _MMSUPPORT {
  612.     LARGE_INTEGER   LastTrimTime;
  613.     MMSUPPORT_FLAGS Flags;
  614.     ULONG           PageFaultCount;
  615.     ULONG           PeakWorkingSetSize;
  616.     ULONG           WorkingSetSize;
  617.     ULONG           MinimumWorkingSetSize;
  618.     ULONG           MaximumWorkingSetSize;
  619.     PMMWSL          VmWorkingSetList;
  620.     LIST_ENTRY      WorkingSetExpansionLinks;
  621.     ULONG           Claim;
  622.     ULONG           NextEstimationSlot;
  623.     ULONG           NextAgingSlot;
  624.     ULONG           EstimatedAvailable;
  625.     ULONG           GrowthSinceLastEstimate;
  626. } MMSUPPORT, *PMMSUPPORT;
  627.  
  628. #else
  629.  
  630. typedef struct _MMSUPPORT {
  631.     LARGE_INTEGER   LastTrimTime;
  632.     ULONG           LastTrimFaultCount;
  633.     ULONG           PageFaultCount;
  634.     ULONG           PeakWorkingSetSize;
  635.     ULONG           WorkingSetSize;
  636.     ULONG           MinimumWorkingSetSize;
  637.     ULONG           MaximumWorkingSetSize;
  638.     PMMWSL          VmWorkingSetList;
  639.     LIST_ENTRY      WorkingSetExpansionLinks;
  640.     BOOLEAN         AllowWorkingSetAdjustment;
  641.     BOOLEAN         AddressSpaceBeingDeleted;
  642.     UCHAR           ForegroundSwitchCount;
  643.     UCHAR           MemoryPriority;
  644. #if (VER_PRODUCTBUILD >= 2195)
  645.     union {
  646.         ULONG           LongFlags;
  647.         MMSUPPORT_FLAGS Flags;
  648.     } u;
  649.     ULONG           Claim;
  650.     ULONG           NextEstimationSlot;
  651.     ULONG           NextAgingSlot;
  652.     ULONG           EstimatedAvailable;
  653.     ULONG           GrowthSinceLastEstimate;
  654. #endif // (VER_PRODUCTBUILD >= 2195)
  655. } MMSUPPORT, *PMMSUPPORT;
  656.  
  657. #endif
  658.  
  659. typedef struct _SE_AUDIT_PROCESS_CREATION_INFO {
  660.     POBJECT_NAME_INFORMATION ImageFileName;
  661. } SE_AUDIT_PROCESS_CREATION_INFO, *PSE_AUDIT_PROCESS_CREATION_INFO;
  662.  
  663. typedef struct _BITMAP_RANGE {
  664.     LIST_ENTRY      Links;
  665.     LARGE_INTEGER   BasePage;
  666.     ULONG           FirstDirtyPage;
  667.     ULONG           LastDirtyPage;
  668.     ULONG           DirtyPages;
  669.     PULONG          Bitmap;
  670. } BITMAP_RANGE, *PBITMAP_RANGE;
  671.  
  672. typedef struct _CACHE_UNINITIALIZE_EVENT {
  673.     struct _CACHE_UNINITIALIZE_EVENT    *Next;
  674.     KEVENT                              Event;
  675. } CACHE_UNINITIALIZE_EVENT, *PCACHE_UNINITIALIZE_EVENT;
  676.  
  677. typedef struct _CC_FILE_SIZES {
  678.     LARGE_INTEGER AllocationSize;
  679.     LARGE_INTEGER FileSize;
  680.     LARGE_INTEGER ValidDataLength;
  681. } CC_FILE_SIZES, *PCC_FILE_SIZES;
  682.  
  683. typedef struct _COMPRESSED_DATA_INFO {
  684.     USHORT  CompressionFormatAndEngine;
  685.     UCHAR   CompressionUnitShift;
  686.     UCHAR   ChunkShift;
  687.     UCHAR   ClusterShift;
  688.     UCHAR   Reserved;
  689.     USHORT  NumberOfChunks;
  690.     ULONG   CompressedChunkSizes[ANYSIZE_ARRAY];
  691. } COMPRESSED_DATA_INFO, *PCOMPRESSED_DATA_INFO;
  692.  
  693. typedef struct _DEVICE_MAP {
  694.     POBJECT_DIRECTORY   DosDevicesDirectory;
  695.     POBJECT_DIRECTORY   GlobalDosDevicesDirectory;
  696.     ULONG               ReferenceCount;
  697.     ULONG               DriveMap;
  698.     UCHAR               DriveType[32];
  699. } DEVICE_MAP, *PDEVICE_MAP; 
  700.  
  701. #if (VER_PRODUCTBUILD >= 2600)
  702.  
  703. typedef struct _EX_FAST_REF {
  704.     union {
  705.         PVOID Object;
  706.         ULONG RefCnt : 3;
  707.         ULONG Value;
  708.     };
  709. } EX_FAST_REF, *PEX_FAST_REF;
  710.  
  711. typedef struct _EX_PUSH_LOCK {
  712.     union {
  713.         struct {
  714.             ULONG   Waiting     : 1;
  715.             ULONG   Exclusive   : 1;
  716.             ULONG   Shared      : 30;
  717.         };
  718.         ULONG   Value;
  719.         PVOID   Ptr;
  720.     };
  721. } EX_PUSH_LOCK, *PEX_PUSH_LOCK;
  722.  
  723. typedef struct _EX_RUNDOWN_REF {
  724.     union {
  725.         ULONG Count;
  726.         PVOID Ptr;
  727.     };
  728. } EX_RUNDOWN_REF, *PEX_RUNDOWN_REF;
  729.  
  730. #endif
  731.  
  732. typedef struct _EPROCESS_QUOTA_ENTRY {
  733.     ULONG Usage;
  734.     ULONG Limit;
  735.     ULONG Peak;
  736.     ULONG Return;
  737. } EPROCESS_QUOTA_ENTRY, *PEPROCESS_QUOTA_ENTRY;
  738.  
  739. typedef struct _EPROCESS_QUOTA_BLOCK {
  740.     EPROCESS_QUOTA_ENTRY    QuotaEntry[3];
  741.     LIST_ENTRY              QuotaList;
  742.     ULONG                   ReferenceCount;
  743.     ULONG                   ProcessCount;
  744. } EPROCESS_QUOTA_BLOCK, *PEPROCESS_QUOTA_BLOCK;
  745.  
  746. /*
  747.  * When needing these parameters cast your PIO_STACK_LOCATION to
  748.  * PEXTENDED_IO_STACK_LOCATION
  749.  */
  750. #if !defined(_ALPHA_)
  751. #include <pshpack4.h>
  752. #endif
  753. typedef struct _EXTENDED_IO_STACK_LOCATION {
  754.  
  755.     /* Included for padding */
  756.     UCHAR MajorFunction;
  757.     UCHAR MinorFunction;
  758.     UCHAR Flags;
  759.     UCHAR Control;
  760.  
  761.     union {
  762.  
  763.        struct {
  764.           PIO_SECURITY_CONTEXT              SecurityContext;
  765.           ULONG                             Options;
  766.           USHORT                            Reserved;
  767.           USHORT                            ShareAccess;
  768.           PMAILSLOT_CREATE_PARAMETERS       Parameters;
  769.        } CreateMailslot;
  770.  
  771.         struct {
  772.             PIO_SECURITY_CONTEXT            SecurityContext;
  773.             ULONG                           Options;
  774.             USHORT                          Reserved;
  775.             USHORT                          ShareAccess;
  776.             PNAMED_PIPE_CREATE_PARAMETERS   Parameters;
  777.         } CreatePipe;
  778.  
  779.         struct {
  780.             ULONG                           OutputBufferLength;
  781.             ULONG                           InputBufferLength;
  782.             ULONG                           FsControlCode;
  783.             PVOID                           Type3InputBuffer;
  784.         } FileSystemControl;
  785.  
  786.         struct {
  787.             PLARGE_INTEGER                  Length;
  788.             ULONG                           Key;
  789.             LARGE_INTEGER                   ByteOffset;
  790.         } LockControl;
  791.  
  792.         struct {
  793.             ULONG                           Length;
  794.             ULONG                           CompletionFilter;
  795.         } NotifyDirectory;
  796.  
  797.         struct {
  798.             ULONG                           Length;
  799.             PUNICODE_STRING                 FileName;
  800.             FILE_INFORMATION_CLASS          FileInformationClass;
  801.             ULONG                           FileIndex;
  802.         } QueryDirectory;
  803.  
  804.         struct {
  805.             ULONG                           Length;
  806.             PVOID                           EaList;
  807.             ULONG                           EaListLength;
  808.             ULONG                           EaIndex;
  809.         } QueryEa;
  810.  
  811.         struct {
  812.             ULONG                           Length;
  813.             PSID                            StartSid;
  814.             PFILE_GET_QUOTA_INFORMATION     SidList;
  815.             ULONG                           SidListLength;
  816.         } QueryQuota;
  817.  
  818.         struct {
  819.             ULONG                           Length;
  820.         } SetEa;
  821.  
  822.         struct {
  823.             ULONG                           Length;
  824.         } SetQuota;
  825.  
  826.         struct {
  827.             ULONG                           Length;
  828.             FS_INFORMATION_CLASS            FsInformationClass;
  829.         } SetVolume;
  830.  
  831.     } Parameters;
  832.     PDEVICE_OBJECT  DeviceObject;
  833.     PFILE_OBJECT  FileObject;
  834.     PIO_COMPLETION_ROUTINE  CompletionRoutine;
  835.     PVOID  Context;
  836.  
  837. } EXTENDED_IO_STACK_LOCATION, *PEXTENDED_IO_STACK_LOCATION;
  838. #if !defined(_ALPHA_)
  839. #include <poppack.h>
  840. #endif
  841.  
  842. typedef struct _FILE_ACCESS_INFORMATION {
  843.     ACCESS_MASK AccessFlags;
  844. } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
  845.  
  846. typedef struct _FILE_ALLOCATION_INFORMATION {
  847.     LARGE_INTEGER AllocationSize;
  848. } FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;
  849.  
  850. typedef struct _FILE_BOTH_DIR_INFORMATION {
  851.     ULONG           NextEntryOffset;
  852.     ULONG           FileIndex;
  853.     LARGE_INTEGER   CreationTime;
  854.     LARGE_INTEGER   LastAccessTime;
  855.     LARGE_INTEGER   LastWriteTime;
  856.     LARGE_INTEGER   ChangeTime;
  857.     LARGE_INTEGER   EndOfFile;
  858.     LARGE_INTEGER   AllocationSize;
  859.     ULONG           FileAttributes;
  860.     ULONG           FileNameLength;
  861.     ULONG           EaSize;
  862.     CCHAR           ShortNameLength;
  863.     WCHAR           ShortName[12];
  864.     WCHAR           FileName[1];
  865. } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
  866.  
  867. typedef struct _FILE_COMPLETION_INFORMATION {
  868.     HANDLE  Port;
  869.     ULONG   Key;
  870. } FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;
  871.  
  872. typedef struct _FILE_COMPRESSION_INFORMATION {
  873.     LARGE_INTEGER   CompressedFileSize;
  874.     USHORT          CompressionFormat;
  875.     UCHAR           CompressionUnitShift;
  876.     UCHAR           ChunkShift;
  877.     UCHAR           ClusterShift;
  878.     UCHAR           Reserved[3];
  879. } FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
  880.  
  881. typedef struct _FILE_COPY_ON_WRITE_INFORMATION {
  882.     BOOLEAN ReplaceIfExists;
  883.     HANDLE  RootDirectory;
  884.     ULONG   FileNameLength;
  885.     WCHAR   FileName[1];
  886. } FILE_COPY_ON_WRITE_INFORMATION, *PFILE_COPY_ON_WRITE_INFORMATION;
  887.  
  888. typedef struct _FILE_DIRECTORY_INFORMATION {
  889.     ULONG           NextEntryOffset;
  890.     ULONG           FileIndex;
  891.     LARGE_INTEGER   CreationTime;
  892.     LARGE_INTEGER   LastAccessTime;
  893.     LARGE_INTEGER   LastWriteTime;
  894.     LARGE_INTEGER   ChangeTime;
  895.     LARGE_INTEGER   EndOfFile;
  896.     LARGE_INTEGER   AllocationSize;
  897.     ULONG           FileAttributes;
  898.     ULONG           FileNameLength;
  899.     WCHAR           FileName[1];
  900. } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
  901.  
  902. typedef struct _FILE_FULL_DIRECTORY_INFORMATION {
  903.         ULONG              NextEntryOffset;
  904.         ULONG              FileIndex;
  905.         LARGE_INTEGER   CreationTime;
  906.         LARGE_INTEGER   LastAccessTime;
  907.         LARGE_INTEGER   LastWriteTime;
  908.         LARGE_INTEGER   ChangeTime;
  909.         LARGE_INTEGER   EndOfFile;
  910.         LARGE_INTEGER   AllocationSize;
  911.         ULONG           FileAttributes;
  912.         ULONG           FileNameLength;
  913.         ULONG           EaSize;
  914.         WCHAR           FileName[0];
  915. } FILE_FULL_DIRECTORY_INFORMATION, *PFILE_FULL_DIRECTORY_INFORMATION;
  916.  
  917. typedef struct _FILE_BOTH_DIRECTORY_INFORMATION {
  918.         ULONG         NextEntryOffset;
  919.         ULONG            FileIndex;
  920.         LARGE_INTEGER CreationTime;
  921.         LARGE_INTEGER LastAccessTime;
  922.         LARGE_INTEGER LastWriteTime;
  923.         LARGE_INTEGER ChangeTime;
  924.         LARGE_INTEGER EndOfFile;
  925.         LARGE_INTEGER AllocationSize;
  926.         ULONG         FileAttributes;
  927.         ULONG         FileNameLength;
  928.         ULONG         EaSize;
  929.         CHAR          ShortNameLength;
  930.         WCHAR         ShortName[12];
  931.         WCHAR         FileName[0];
  932. } FILE_BOTH_DIRECTORY_INFORMATION, *PFILE_BOTH_DIRECTORY_INFORMATION;
  933.  
  934. typedef struct _FILE_EA_INFORMATION {
  935.     ULONG EaSize;
  936. } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
  937.  
  938. typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {
  939.     ULONG   FileSystemAttributes;
  940.     ULONG   MaximumComponentNameLength;
  941.     ULONG   FileSystemNameLength;
  942.     WCHAR   FileSystemName[1];
  943. } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
  944.  
  945. typedef struct _FILE_FS_CONTROL_INFORMATION {
  946.     LARGE_INTEGER   FreeSpaceStartFiltering;
  947.     LARGE_INTEGER   FreeSpaceThreshold;
  948.     LARGE_INTEGER   FreeSpaceStopFiltering;
  949.     LARGE_INTEGER   DefaultQuotaThreshold;
  950.     LARGE_INTEGER   DefaultQuotaLimit;
  951.     ULONG           FileSystemControlFlags;
  952. } FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;
  953.  
  954. typedef struct _FILE_FS_FULL_SIZE_INFORMATION {
  955.     LARGE_INTEGER   TotalAllocationUnits;
  956.     LARGE_INTEGER   CallerAvailableAllocationUnits;
  957.     LARGE_INTEGER   ActualAvailableAllocationUnits;
  958.     ULONG           SectorsPerAllocationUnit;
  959.     ULONG           BytesPerSector;
  960. } FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
  961.  
  962. typedef struct _FILE_FS_LABEL_INFORMATION {
  963.     ULONG VolumeLabelLength;
  964.     WCHAR VolumeLabel[1];
  965. } FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
  966.  
  967. #if (VER_PRODUCTBUILD >= 2195)
  968.  
  969. typedef struct _FILE_FS_OBJECT_ID_INFORMATION {
  970.     UCHAR ObjectId[16];
  971.     UCHAR ExtendedInfo[48];
  972. } FILE_FS_OBJECT_ID_INFORMATION, *PFILE_FS_OBJECT_ID_INFORMATION;
  973.  
  974. #endif // (VER_PRODUCTBUILD >= 2195)
  975.  
  976. typedef struct _FILE_FS_SIZE_INFORMATION {
  977.     LARGE_INTEGER   TotalAllocationUnits;
  978.     LARGE_INTEGER   AvailableAllocationUnits;
  979.     ULONG           SectorsPerAllocationUnit;
  980.     ULONG           BytesPerSector;
  981. } FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
  982.  
  983. typedef struct _FILE_FS_VOLUME_INFORMATION {
  984.     LARGE_INTEGER   VolumeCreationTime;
  985.     ULONG           VolumeSerialNumber;
  986.     ULONG           VolumeLabelLength;
  987.     BOOLEAN         SupportsObjects;
  988.     WCHAR           VolumeLabel[1];
  989. } FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
  990.  
  991. typedef struct _FILE_FULL_DIR_INFORMATION {
  992.     ULONG           NextEntryOffset;
  993.     ULONG           FileIndex;
  994.     LARGE_INTEGER   CreationTime;
  995.     LARGE_INTEGER   LastAccessTime;
  996.     LARGE_INTEGER   LastWriteTime;
  997.     LARGE_INTEGER   ChangeTime;
  998.     LARGE_INTEGER   EndOfFile;
  999.     LARGE_INTEGER   AllocationSize;
  1000.     ULONG           FileAttributes;
  1001.     ULONG           FileNameLength;
  1002.     ULONG           EaSize;
  1003.     WCHAR           FileName[1];
  1004. } FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
  1005.  
  1006. typedef struct _FILE_GET_EA_INFORMATION {
  1007.     ULONG   NextEntryOffset;
  1008.     UCHAR   EaNameLength;
  1009.     CHAR    EaName[1];
  1010. } FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
  1011.  
  1012. typedef struct _FILE_GET_QUOTA_INFORMATION {
  1013.     ULONG   NextEntryOffset;
  1014.     ULONG   SidLength;
  1015.     SID     Sid;
  1016. } FILE_GET_QUOTA_INFORMATION, *PFILE_GET_QUOTA_INFORMATION;
  1017.  
  1018. typedef struct _FILE_INTERNAL_INFORMATION {
  1019.     LARGE_INTEGER IndexNumber;
  1020. } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
  1021.  
  1022. typedef struct _FILE_LINK_INFORMATION {
  1023.     BOOLEAN ReplaceIfExists;
  1024.     HANDLE  RootDirectory;
  1025.     ULONG   FileNameLength;
  1026.     WCHAR   FileName[1];
  1027. } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
  1028.  
  1029. typedef struct _FILE_LOCK_INFO {
  1030.     LARGE_INTEGER   StartingByte;
  1031.     LARGE_INTEGER   Length;
  1032.     BOOLEAN         ExclusiveLock;
  1033.     ULONG           Key;
  1034.     PFILE_OBJECT    FileObject;
  1035.     PEPROCESS       Process;
  1036.     LARGE_INTEGER   EndingByte;
  1037. } FILE_LOCK_INFO, *PFILE_LOCK_INFO;
  1038.  
  1039. // raw internal file lock struct returned from FsRtlGetNextFileLock
  1040. typedef struct _FILE_SHARED_LOCK_ENTRY {
  1041.     PVOID           Unknown1;
  1042.     PVOID           Unknown2;
  1043.     FILE_LOCK_INFO  FileLock;
  1044. } FILE_SHARED_LOCK_ENTRY, *PFILE_SHARED_LOCK_ENTRY;
  1045.  
  1046. // raw internal file lock struct returned from FsRtlGetNextFileLock
  1047. typedef struct _FILE_EXCLUSIVE_LOCK_ENTRY {
  1048.     LIST_ENTRY      ListEntry;
  1049.     PVOID           Unknown1;
  1050.     PVOID           Unknown2;
  1051.     FILE_LOCK_INFO  FileLock;
  1052. } FILE_EXCLUSIVE_LOCK_ENTRY, *PFILE_EXCLUSIVE_LOCK_ENTRY;
  1053.  
  1054. typedef NTSTATUS (*PCOMPLETE_LOCK_IRP_ROUTINE) (
  1055.     IN PVOID    Context,
  1056.     IN PIRP     Irp
  1057. );
  1058.  
  1059. typedef VOID (NTAPI *PUNLOCK_ROUTINE) (
  1060.     IN PVOID            Context,
  1061.     IN PFILE_LOCK_INFO  FileLockInfo
  1062. );
  1063.  
  1064. typedef struct _FILE_LOCK {
  1065.     PCOMPLETE_LOCK_IRP_ROUTINE  CompleteLockIrpRoutine;
  1066.     PUNLOCK_ROUTINE             UnlockRoutine;
  1067.     BOOLEAN                     FastIoIsQuestionable;
  1068.     BOOLEAN                     Pad[3];
  1069.     PVOID                       LockInformation;
  1070.     FILE_LOCK_INFO              LastReturnedLockInfo;
  1071.     PVOID                       LastReturnedLock;
  1072. } FILE_LOCK, *PFILE_LOCK;
  1073.  
  1074. typedef struct _FILE_MAILSLOT_PEEK_BUFFER {
  1075.     ULONG ReadDataAvailable;
  1076.     ULONG NumberOfMessages;
  1077.     ULONG MessageLength;
  1078. } FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER;
  1079.  
  1080. typedef struct _FILE_MAILSLOT_QUERY_INFORMATION {
  1081.     ULONG           MaximumMessageSize;
  1082.     ULONG           MailslotQuota;
  1083.     ULONG           NextMessageSize;
  1084.     ULONG           MessagesAvailable;
  1085.     LARGE_INTEGER   ReadTimeout;
  1086. } FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION;
  1087.  
  1088. typedef struct _FILE_MAILSLOT_SET_INFORMATION {
  1089.     LARGE_INTEGER ReadTimeout;
  1090. } FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
  1091.  
  1092. typedef struct _FILE_MODE_INFORMATION {
  1093.     ULONG Mode;
  1094. } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
  1095.  
  1096. typedef struct _FILE_ALL_INFORMATION {
  1097.     FILE_BASIC_INFORMATION      BasicInformation;
  1098.     FILE_STANDARD_INFORMATION   StandardInformation;
  1099.     FILE_INTERNAL_INFORMATION   InternalInformation;
  1100.     FILE_EA_INFORMATION         EaInformation;
  1101.     FILE_ACCESS_INFORMATION     AccessInformation;
  1102.     FILE_POSITION_INFORMATION   PositionInformation;
  1103.     FILE_MODE_INFORMATION       ModeInformation;
  1104.     FILE_ALIGNMENT_INFORMATION  AlignmentInformation;
  1105.     FILE_NAME_INFORMATION       NameInformation;
  1106. } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
  1107.  
  1108. typedef struct _FILE_NAMES_INFORMATION {
  1109.     ULONG NextEntryOffset;
  1110.     ULONG FileIndex;
  1111.     ULONG FileNameLength;
  1112.     WCHAR FileName[1];
  1113. } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
  1114.  
  1115. typedef struct _FILE_OBJECTID_INFORMATION {
  1116.     LONGLONG        FileReference;
  1117.     UCHAR           ObjectId[16];
  1118.     union {
  1119.         struct {
  1120.             UCHAR   BirthVolumeId[16];
  1121.             UCHAR   BirthObjectId[16];
  1122.             UCHAR   DomainId[16];
  1123.         } ;
  1124.         UCHAR       ExtendedInfo[48];
  1125.     };
  1126. } FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION;
  1127.  
  1128. typedef struct _FILE_OLE_CLASSID_INFORMATION {
  1129.     GUID ClassId;
  1130. } FILE_OLE_CLASSID_INFORMATION, *PFILE_OLE_CLASSID_INFORMATION;
  1131.  
  1132. typedef struct _FILE_OLE_ALL_INFORMATION {
  1133.     FILE_BASIC_INFORMATION          BasicInformation;
  1134.     FILE_STANDARD_INFORMATION       StandardInformation;
  1135.     FILE_INTERNAL_INFORMATION       InternalInformation;
  1136.     FILE_EA_INFORMATION             EaInformation;
  1137.     FILE_ACCESS_INFORMATION         AccessInformation;
  1138.     FILE_POSITION_INFORMATION       PositionInformation;
  1139.     FILE_MODE_INFORMATION           ModeInformation;
  1140.     FILE_ALIGNMENT_INFORMATION      AlignmentInformation;
  1141.     USN                             LastChangeUsn;
  1142.     USN                             ReplicationUsn;
  1143.     LARGE_INTEGER                   SecurityChangeTime;
  1144.     FILE_OLE_CLASSID_INFORMATION    OleClassIdInformation;
  1145.     FILE_OBJECTID_INFORMATION       ObjectIdInformation;
  1146.     FILE_STORAGE_TYPE               StorageType;
  1147.     ULONG                           OleStateBits;
  1148.     ULONG                           OleId;
  1149.     ULONG                           NumberOfStreamReferences;
  1150.     ULONG                           StreamIndex;
  1151.     ULONG                           SecurityId;
  1152.     BOOLEAN                         ContentIndexDisable;
  1153.     BOOLEAN                         InheritContentIndexDisable;
  1154.     FILE_NAME_INFORMATION           NameInformation;
  1155. } FILE_OLE_ALL_INFORMATION, *PFILE_OLE_ALL_INFORMATION;
  1156.  
  1157. typedef struct _FILE_OLE_DIR_INFORMATION {
  1158.     ULONG               NextEntryOffset;
  1159.     ULONG               FileIndex;
  1160.     LARGE_INTEGER       CreationTime;
  1161.     LARGE_INTEGER       LastAccessTime;
  1162.     LARGE_INTEGER       LastWriteTime;
  1163.     LARGE_INTEGER       ChangeTime;
  1164.     LARGE_INTEGER       EndOfFile;
  1165.     LARGE_INTEGER       AllocationSize;
  1166.     ULONG               FileAttributes;
  1167.     ULONG               FileNameLength;
  1168.     FILE_STORAGE_TYPE   StorageType;
  1169.     GUID                OleClassId;
  1170.     ULONG               OleStateBits;
  1171.     BOOLEAN             ContentIndexDisable;
  1172.     BOOLEAN             InheritContentIndexDisable;
  1173.     WCHAR               FileName[1];
  1174. } FILE_OLE_DIR_INFORMATION, *PFILE_OLE_DIR_INFORMATION;
  1175.  
  1176. typedef struct _FILE_OLE_INFORMATION {
  1177.     LARGE_INTEGER                   SecurityChangeTime;
  1178.     FILE_OLE_CLASSID_INFORMATION    OleClassIdInformation;
  1179.     FILE_OBJECTID_INFORMATION       ObjectIdInformation;
  1180.     FILE_STORAGE_TYPE               StorageType;
  1181.     ULONG                           OleStateBits;
  1182.     BOOLEAN                         ContentIndexDisable;
  1183.     BOOLEAN                         InheritContentIndexDisable;
  1184. } FILE_OLE_INFORMATION, *PFILE_OLE_INFORMATION;
  1185.  
  1186. typedef struct _FILE_OLE_STATE_BITS_INFORMATION {
  1187.     ULONG StateBits;
  1188.     ULONG StateBitsMask;
  1189. } FILE_OLE_STATE_BITS_INFORMATION, *PFILE_OLE_STATE_BITS_INFORMATION;
  1190.  
  1191. typedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER {
  1192.     HANDLE  EventHandle;
  1193.     ULONG   KeyValue;
  1194. } FILE_PIPE_ASSIGN_EVENT_BUFFER, *PFILE_PIPE_ASSIGN_EVENT_BUFFER;
  1195.  
  1196. typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER {
  1197.     PVOID ClientSession;
  1198.     PVOID ClientProcess;
  1199. } FILE_PIPE_CLIENT_PROCESS_BUFFER, *PFILE_PIPE_CLIENT_PROCESS_BUFFER;
  1200.  
  1201. typedef struct _FILE_PIPE_EVENT_BUFFER {
  1202.     ULONG NamedPipeState;
  1203.     ULONG EntryType;
  1204.     ULONG ByteCount;
  1205.     ULONG KeyValue;
  1206.     ULONG NumberRequests;
  1207. } FILE_PIPE_EVENT_BUFFER, *PFILE_PIPE_EVENT_BUFFER;
  1208.  
  1209. typedef struct _FILE_PIPE_INFORMATION {
  1210.     ULONG ReadMode;
  1211.     ULONG CompletionMode;
  1212. } FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;
  1213.  
  1214. typedef struct _FILE_PIPE_LOCAL_INFORMATION {
  1215.     ULONG NamedPipeType;
  1216.     ULONG NamedPipeConfiguration;
  1217.     ULONG MaximumInstances;
  1218.     ULONG CurrentInstances;
  1219.     ULONG InboundQuota;
  1220.     ULONG ReadDataAvailable;
  1221.     ULONG OutboundQuota;
  1222.     ULONG WriteQuotaAvailable;
  1223.     ULONG NamedPipeState;
  1224.     ULONG NamedPipeEnd;
  1225. } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
  1226.  
  1227. typedef struct _FILE_PIPE_REMOTE_INFORMATION {
  1228.     LARGE_INTEGER   CollectDataTime;
  1229.     ULONG           MaximumCollectionCount;
  1230. } FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION;
  1231.  
  1232. typedef struct _FILE_PIPE_WAIT_FOR_BUFFER {
  1233.     LARGE_INTEGER   Timeout;
  1234.     ULONG           NameLength;
  1235.     BOOLEAN         TimeoutSpecified;
  1236.     WCHAR           Name[1];
  1237. } FILE_PIPE_WAIT_FOR_BUFFER, *PFILE_PIPE_WAIT_FOR_BUFFER;
  1238.  
  1239. typedef struct _FILE_QUOTA_INFORMATION {
  1240.     ULONG           NextEntryOffset;
  1241.     ULONG           SidLength;
  1242.     LARGE_INTEGER   ChangeTime;
  1243.     LARGE_INTEGER   QuotaUsed;
  1244.     LARGE_INTEGER   QuotaThreshold;
  1245.     LARGE_INTEGER   QuotaLimit;
  1246.     SID             Sid;
  1247. } FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION;
  1248.  
  1249. typedef struct _FILE_RENAME_INFORMATION {
  1250.     BOOLEAN ReplaceIfExists;
  1251.     HANDLE  RootDirectory;
  1252.     ULONG   FileNameLength;
  1253.     WCHAR   FileName[1];
  1254. } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
  1255.  
  1256. typedef struct _FILE_STREAM_INFORMATION {
  1257.     ULONG           NextEntryOffset;
  1258.     ULONG           StreamNameLength;
  1259.     LARGE_INTEGER   StreamSize;
  1260.     LARGE_INTEGER   StreamAllocationSize;
  1261.     WCHAR           StreamName[1];
  1262. } FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;
  1263.  
  1264. typedef struct _FILE_TRACKING_INFORMATION {
  1265.     HANDLE  DestinationFile;
  1266.     ULONG   ObjectInformationLength;
  1267.     CHAR    ObjectInformation[1];
  1268. } FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION;
  1269.  
  1270. typedef struct _FSRTL_COMMON_FCB_HEADER {
  1271.     CSHORT          NodeTypeCode;
  1272.     CSHORT          NodeByteSize;
  1273.     UCHAR           Flags;
  1274.     UCHAR           IsFastIoPossible;
  1275. #if (VER_PRODUCTBUILD >= 1381)
  1276.     UCHAR           Flags2;
  1277.     UCHAR           Reserved;
  1278. #endif // (VER_PRODUCTBUILD >= 1381)
  1279.     PERESOURCE      Resource;
  1280.     PERESOURCE      PagingIoResource;
  1281.     LARGE_INTEGER   AllocationSize;
  1282.     LARGE_INTEGER   FileSize;
  1283.     LARGE_INTEGER   ValidDataLength;
  1284. } FSRTL_COMMON_FCB_HEADER, *PFSRTL_COMMON_FCB_HEADER;
  1285.  
  1286. typedef struct _GENERATE_NAME_CONTEXT {
  1287.     USHORT  Checksum;
  1288.     BOOLEAN CheckSumInserted;
  1289.     UCHAR   NameLength;
  1290.     WCHAR   NameBuffer[8];
  1291.     ULONG   ExtensionLength;
  1292.     WCHAR   ExtensionBuffer[4];
  1293.     ULONG   LastIndexValue;
  1294. } GENERATE_NAME_CONTEXT, *PGENERATE_NAME_CONTEXT;
  1295.  
  1296. typedef struct _HANDLE_TABLE_ENTRY {
  1297.     PVOID   Object;
  1298.     ULONG   ObjectAttributes;
  1299.     ULONG   GrantedAccess;
  1300.     USHORT  GrantedAccessIndex;
  1301.     USHORT  CreatorBackTraceIndex;
  1302.     ULONG   NextFreeTableEntry;
  1303. } HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;
  1304.  
  1305. typedef struct _MAPPING_PAIR {
  1306.     ULONGLONG Vcn;
  1307.     ULONGLONG Lcn;
  1308. } MAPPING_PAIR, *PMAPPING_PAIR;
  1309.  
  1310. typedef struct _GET_RETRIEVAL_DESCRIPTOR {
  1311.     ULONG           NumberOfPairs;
  1312.     ULONGLONG       StartVcn;
  1313.     MAPPING_PAIR    Pair[1];
  1314. } GET_RETRIEVAL_DESCRIPTOR, *PGET_RETRIEVAL_DESCRIPTOR;
  1315.  
  1316. typedef struct _IO_CLIENT_EXTENSION {
  1317.     struct _IO_CLIENT_EXTENSION *NextExtension;
  1318.     PVOID                       ClientIdentificationAddress;
  1319. } IO_CLIENT_EXTENSION, *PIO_CLIENT_EXTENSION;
  1320.  
  1321. typedef struct _IO_COMPLETION_BASIC_INFORMATION {
  1322.     LONG Depth;
  1323. } IO_COMPLETION_BASIC_INFORMATION, *PIO_COMPLETION_BASIC_INFORMATION;
  1324.  
  1325. typedef struct _KEVENT_PAIR {
  1326.     USHORT Type;
  1327.     USHORT Size;
  1328.     KEVENT Event1;
  1329.     KEVENT Event2;
  1330. } KEVENT_PAIR, *PKEVENT_PAIR;
  1331.  
  1332. typedef struct _KQUEUE {
  1333.     DISPATCHER_HEADER   Header;
  1334.     LIST_ENTRY          EntryListHead;
  1335.     ULONG               CurrentCount;
  1336.     ULONG               MaximumCount;
  1337.     LIST_ENTRY          ThreadListHead;
  1338. } KQUEUE, *PKQUEUE, *RESTRICTED_POINTER PRKQUEUE;
  1339.  
  1340. typedef struct _MAILSLOT_CREATE_PARAMETERS {
  1341.     ULONG           MailslotQuota;
  1342.     ULONG           MaximumMessageSize;
  1343.     LARGE_INTEGER   ReadTimeout;
  1344.     BOOLEAN         TimeoutSpecified;
  1345. } MAILSLOT_CREATE_PARAMETERS, *PMAILSLOT_CREATE_PARAMETERS;
  1346.  
  1347. typedef struct _MBCB {
  1348.     CSHORT          NodeTypeCode;
  1349.     CSHORT          NodeIsInZone;
  1350.     ULONG           PagesToWrite;
  1351.     ULONG           DirtyPages;
  1352.     ULONG           Reserved;
  1353.     LIST_ENTRY      BitmapRanges;
  1354.     LONGLONG        ResumeWritePage;
  1355.     BITMAP_RANGE    BitmapRange1;
  1356.     BITMAP_RANGE    BitmapRange2;
  1357.     BITMAP_RANGE    BitmapRange3;
  1358. } MBCB, *PMBCB;
  1359.  
  1360. typedef struct _MOVEFILE_DESCRIPTOR {
  1361.      HANDLE         FileHandle; 
  1362.      ULONG          Reserved;   
  1363.      LARGE_INTEGER  StartVcn; 
  1364.      LARGE_INTEGER  TargetLcn;
  1365.      ULONG          NumVcns; 
  1366.      ULONG          Reserved1;  
  1367. } MOVEFILE_DESCRIPTOR, *PMOVEFILE_DESCRIPTOR;
  1368.  
  1369. typedef struct _NAMED_PIPE_CREATE_PARAMETERS {
  1370.     ULONG           NamedPipeType;
  1371.     ULONG           ReadMode;
  1372.     ULONG           CompletionMode;
  1373.     ULONG           MaximumInstances;
  1374.     ULONG           InboundQuota;
  1375.     ULONG           OutboundQuota;
  1376.     LARGE_INTEGER   DefaultTimeout;
  1377.     BOOLEAN         TimeoutSpecified;
  1378. } NAMED_PIPE_CREATE_PARAMETERS, *PNAMED_PIPE_CREATE_PARAMETERS;
  1379.  
  1380. typedef struct _OBJECT_BASIC_INFO {
  1381.     ULONG           Attributes;
  1382.     ACCESS_MASK     GrantedAccess;
  1383.     ULONG           HandleCount;
  1384.     ULONG           ReferenceCount;
  1385.     ULONG           PagedPoolUsage;
  1386.     ULONG           NonPagedPoolUsage;
  1387.     ULONG           Reserved[3];
  1388.     ULONG           NameInformationLength;
  1389.     ULONG           TypeInformationLength;
  1390.     ULONG           SecurityDescriptorLength;
  1391.     LARGE_INTEGER   CreateTime;
  1392. } OBJECT_BASIC_INFO, *POBJECT_BASIC_INFO;
  1393.  
  1394. typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFO {
  1395.     BOOLEAN Inherit;
  1396.     BOOLEAN ProtectFromClose;
  1397. } OBJECT_HANDLE_ATTRIBUTE_INFO, *POBJECT_HANDLE_ATTRIBUTE_INFO;
  1398.  
  1399. typedef struct _OBJECT_NAME_INFO {
  1400.     UNICODE_STRING  ObjectName;
  1401.     WCHAR           ObjectNameBuffer[1];
  1402. } OBJECT_NAME_INFO, *POBJECT_NAME_INFO;
  1403.  
  1404. typedef struct _OBJECT_PROTECTION_INFO {
  1405.     BOOLEAN Inherit;
  1406.     BOOLEAN ProtectHandle;
  1407. } OBJECT_PROTECTION_INFO, *POBJECT_PROTECTION_INFO;
  1408.  
  1409. typedef struct _OBJECT_TYPE_INFO {
  1410.     UNICODE_STRING  ObjectTypeName;
  1411.     UCHAR           Unknown[0x58];
  1412.     WCHAR           ObjectTypeNameBuffer[1];
  1413. } OBJECT_TYPE_INFO, *POBJECT_TYPE_INFO;
  1414.  
  1415. typedef struct _OBJECT_ALL_TYPES_INFO {
  1416.     ULONG               NumberOfObjectTypes;
  1417.     OBJECT_TYPE_INFO    ObjectsTypeInfo[1];
  1418. } OBJECT_ALL_TYPES_INFO, *POBJECT_ALL_TYPES_INFO;
  1419.  
  1420. typedef struct _PAGEFAULT_HISTORY {
  1421.     ULONG                           CurrentIndex;
  1422.     ULONG                           MaxIndex;
  1423.     KSPIN_LOCK                      SpinLock;
  1424.     PVOID                           Reserved;
  1425.     PROCESS_WS_WATCH_INFORMATION    WatchInfo[1];
  1426. } PAGEFAULT_HISTORY, *PPAGEFAULT_HISTORY;
  1427.  
  1428. typedef struct _PATHNAME_BUFFER {
  1429.     ULONG PathNameLength;
  1430.     WCHAR Name[1];
  1431. } PATHNAME_BUFFER, *PPATHNAME_BUFFER;
  1432.  
  1433. #if (VER_PRODUCTBUILD >= 2600)
  1434.  
  1435. typedef struct _PRIVATE_CACHE_MAP_FLAGS {
  1436.     ULONG DontUse           : 16;
  1437.     ULONG ReadAheadActive   : 1;
  1438.     ULONG ReadAheadEnabled  : 1;
  1439.     ULONG Available         : 14;
  1440. } PRIVATE_CACHE_MAP_FLAGS, *PPRIVATE_CACHE_MAP_FLAGS;
  1441.  
  1442. typedef struct _PRIVATE_CACHE_MAP {
  1443.     union {
  1444.         CSHORT                  NodeTypeCode;
  1445.         PRIVATE_CACHE_MAP_FLAGS Flags;
  1446.         ULONG                   UlongFlags;
  1447.     };
  1448.     ULONG                       ReadAheadMask;
  1449.     PFILE_OBJECT                FileObject;
  1450.     LARGE_INTEGER               FileOffset1;
  1451.     LARGE_INTEGER               BeyondLastByte1;
  1452.     LARGE_INTEGER               FileOffset2;
  1453.     LARGE_INTEGER               BeyondLastByte2;
  1454.     LARGE_INTEGER               ReadAheadOffset[2];
  1455.     ULONG                       ReadAheadLength[2];
  1456.     KSPIN_LOCK                  ReadAheadSpinLock;
  1457.     LIST_ENTRY                  PrivateLinks;
  1458. } PRIVATE_CACHE_MAP, *PPRIVATE_CACHE_MAP;
  1459.  
  1460. #endif
  1461.  
  1462. typedef struct _PS_IMPERSONATION_INFORMATION {
  1463.     PACCESS_TOKEN                   Token;
  1464.     BOOLEAN                         CopyOnOpen;
  1465.     BOOLEAN                         EffectiveOnly;
  1466.     SECURITY_IMPERSONATION_LEVEL    ImpersonationLevel;
  1467. } PS_IMPERSONATION_INFORMATION, *PPS_IMPERSONATION_INFORMATION;
  1468.  
  1469. typedef struct _PUBLIC_BCB {
  1470.     CSHORT          NodeTypeCode;
  1471.     CSHORT          NodeByteSize;
  1472.     ULONG           MappedLength;
  1473.     LARGE_INTEGER   MappedFileOffset;
  1474. } PUBLIC_BCB, *PPUBLIC_BCB;
  1475.  
  1476. typedef struct _QUERY_PATH_REQUEST {
  1477.     ULONG                   PathNameLength;
  1478.     PIO_SECURITY_CONTEXT    SecurityContext;
  1479.     WCHAR                   FilePathName[1];
  1480. } QUERY_PATH_REQUEST, *PQUERY_PATH_REQUEST;
  1481.  
  1482. typedef struct _QUERY_PATH_RESPONSE {
  1483.     ULONG LengthAccepted;
  1484. } QUERY_PATH_RESPONSE, *PQUERY_PATH_RESPONSE;
  1485.  
  1486. typedef struct _RETRIEVAL_POINTERS_BUFFER {
  1487.     ULONG               ExtentCount;
  1488.     LARGE_INTEGER       StartingVcn;
  1489.     struct {
  1490.         LARGE_INTEGER   NextVcn;
  1491.         LARGE_INTEGER   Lcn;
  1492.     } Extents[1];
  1493. } RETRIEVAL_POINTERS_BUFFER, *PRETRIEVAL_POINTERS_BUFFER;
  1494.  
  1495. typedef struct _RTL_SPLAY_LINKS {
  1496.     struct _RTL_SPLAY_LINKS *Parent;
  1497.     struct _RTL_SPLAY_LINKS *LeftChild;
  1498.     struct _RTL_SPLAY_LINKS *RightChild;
  1499. } RTL_SPLAY_LINKS, *PRTL_SPLAY_LINKS;
  1500.  
  1501. typedef struct _SE_EXPORTS {
  1502.  
  1503.     LUID    SeCreateTokenPrivilege;
  1504.     LUID    SeAssignPrimaryTokenPrivilege;
  1505.     LUID    SeLockMemoryPrivilege;
  1506.     LUID    SeIncreaseQuotaPrivilege;
  1507.     LUID    SeUnsolicitedInputPrivilege;
  1508.     LUID    SeTcbPrivilege;
  1509.     LUID    SeSecurityPrivilege;
  1510.     LUID    SeTakeOwnershipPrivilege;
  1511.     LUID    SeLoadDriverPrivilege;
  1512.     LUID    SeCreatePagefilePrivilege;
  1513.     LUID    SeIncreaseBasePriorityPrivilege;
  1514.     LUID    SeSystemProfilePrivilege;
  1515.     LUID    SeSystemtimePrivilege;
  1516.     LUID    SeProfileSingleProcessPrivilege;
  1517.     LUID    SeCreatePermanentPrivilege;
  1518.     LUID    SeBackupPrivilege;
  1519.     LUID    SeRestorePrivilege;
  1520.     LUID    SeShutdownPrivilege;
  1521.     LUID    SeDebugPrivilege;
  1522.     LUID    SeAuditPrivilege;
  1523.     LUID    SeSystemEnvironmentPrivilege;
  1524.     LUID    SeChangeNotifyPrivilege;
  1525.     LUID    SeRemoteShutdownPrivilege;
  1526.  
  1527.     PSID    SeNullSid;
  1528.     PSID    SeWorldSid;
  1529.     PSID    SeLocalSid;
  1530.     PSID    SeCreatorOwnerSid;
  1531.     PSID    SeCreatorGroupSid;
  1532.  
  1533.     PSID    SeNtAuthoritySid;
  1534.     PSID    SeDialupSid;
  1535.     PSID    SeNetworkSid;
  1536.     PSID    SeBatchSid;
  1537.     PSID    SeInteractiveSid;
  1538.     PSID    SeLocalSystemSid;
  1539.     PSID    SeAliasAdminsSid;
  1540.     PSID    SeAliasUsersSid;
  1541.     PSID    SeAliasGuestsSid;
  1542.     PSID    SeAliasPowerUsersSid;
  1543.     PSID    SeAliasAccountOpsSid;
  1544.     PSID    SeAliasSystemOpsSid;
  1545.     PSID    SeAliasPrintOpsSid;
  1546.     PSID    SeAliasBackupOpsSid;
  1547.  
  1548.     PSID    SeAuthenticatedUsersSid;
  1549.  
  1550.     PSID    SeRestrictedSid;
  1551.     PSID    SeAnonymousLogonSid;
  1552.  
  1553.     LUID    SeUndockPrivilege;
  1554.     LUID    SeSyncAgentPrivilege;
  1555.     LUID    SeEnableDelegationPrivilege;
  1556.  
  1557. } SE_EXPORTS, *PSE_EXPORTS;
  1558.  
  1559. typedef struct _SECTION_BASIC_INFORMATION {
  1560.     PVOID           BaseAddress;
  1561.     ULONG           Attributes;
  1562.     LARGE_INTEGER   Size;
  1563. } SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;
  1564.  
  1565. typedef struct _SECTION_IMAGE_INFORMATION {
  1566.     PVOID   EntryPoint;
  1567.     ULONG   Unknown1;
  1568.     ULONG   StackReserve;
  1569.     ULONG   StackCommit;
  1570.     ULONG   Subsystem;
  1571.     USHORT  MinorSubsystemVersion;
  1572.     USHORT  MajorSubsystemVersion;
  1573.     ULONG   Unknown2;
  1574.     ULONG   Characteristics;
  1575.     USHORT  ImageNumber;
  1576.     BOOLEAN Executable;
  1577.     UCHAR   Unknown3;
  1578.     ULONG   Unknown4[3];
  1579. } SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;
  1580.  
  1581. #if (VER_PRODUCTBUILD >= 2600)
  1582.  
  1583. typedef struct _SHARED_CACHE_MAP {
  1584.     CSHORT                      NodeTypeCode;
  1585.     CSHORT                      NodeByteSize;
  1586.     ULONG                       OpenCount;
  1587.     LARGE_INTEGER               FileSize;
  1588.     LIST_ENTRY                  BcbList;
  1589.     LARGE_INTEGER               SectionSize;
  1590.     LARGE_INTEGER               ValidDataLength;
  1591.     LARGE_INTEGER               ValidDataGoal;
  1592.     PVACB                       InitialVacbs[4];
  1593.     PVACB                       *Vacbs;
  1594.     PFILE_OBJECT                FileObject;
  1595.     PVACB                       ActiveVacb;
  1596.     PVOID                       NeedToZero;
  1597.     ULONG                       ActivePage;
  1598.     ULONG                       NeedToZeroPage;
  1599.     KSPIN_LOCK                  ActiveVacbSpinLock;
  1600.     ULONG                       VacbActiveCount;
  1601.     ULONG                       DirtyPages;
  1602.     LIST_ENTRY                  SharedCacheMapLinks;
  1603.     ULONG                       Flags;
  1604.     NTSTATUS                    Status;
  1605.     PMBCB                       Mbcb;
  1606.     PVOID                       Section;
  1607.     PKEVENT                     CreateEvent;
  1608.     PKEVENT                     WaitOnActiveCount;
  1609.     ULONG                       PagesToWrite;
  1610.     LONGLONG                    BeyondLastFlush;
  1611.     PCACHE_MANAGER_CALLBACKS    Callbacks;
  1612.     PVOID                       LazyWriteContext;
  1613.     LIST_ENTRY                  PrivateList;
  1614.     PVOID                       LogHandle;
  1615.     PVOID                       FlushToLsnRoutine;
  1616.     ULONG                       DirtyPageThreshold;
  1617.     ULONG                       LazyWritePassCount;
  1618.     PCACHE_UNINITIALIZE_EVENT   UninitializeEvent;
  1619.     PVACB                       NeedToZeroVacb;
  1620.     KSPIN_LOCK                  BcbSpinLock;
  1621.     PVOID                       Reserved;
  1622.     KEVENT                      Event;
  1623.     EX_PUSH_LOCK                VacbPushLock;
  1624.     PRIVATE_CACHE_MAP           PrivateCacheMap;
  1625. } SHARED_CACHE_MAP, *PSHARED_CACHE_MAP;
  1626.  
  1627. #endif
  1628.  
  1629. typedef struct _STARTING_VCN_INPUT_BUFFER {
  1630.     LARGE_INTEGER StartingVcn;
  1631. } STARTING_VCN_INPUT_BUFFER, *PSTARTING_VCN_INPUT_BUFFER;
  1632.  
  1633. typedef struct _SYSTEM_CACHE_INFORMATION {
  1634.     ULONG CurrentSize;
  1635.     ULONG PeakSize;
  1636.     ULONG PageFaultCount;
  1637.     ULONG MinimumWorkingSet;
  1638.     ULONG MaximumWorkingSet;
  1639.     ULONG Unused[4];
  1640. } SYSTEM_CACHE_INFORMATION, *PSYSTEM_CACHE_INFORMATION;
  1641.  
  1642. typedef struct _TERMINATION_PORT {
  1643.     struct _TERMINATION_PORT*   Next;
  1644.     PVOID                       Port;
  1645. } TERMINATION_PORT, *PTERMINATION_PORT;
  1646.  
  1647. typedef struct _SECURITY_CLIENT_CONTEXT {
  1648.     SECURITY_QUALITY_OF_SERVICE SecurityQos;
  1649.     PACCESS_TOKEN               ClientToken;
  1650.     BOOLEAN                     DirectlyAccessClientToken;
  1651.     BOOLEAN                     DirectAccessEffectiveOnly;
  1652.     BOOLEAN                     ServerIsRemote;
  1653.     TOKEN_CONTROL               ClientTokenControl;
  1654. } SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;
  1655.  
  1656. typedef struct _TUNNEL {
  1657.     FAST_MUTEX          Mutex;
  1658.     PRTL_SPLAY_LINKS    Cache;
  1659.     LIST_ENTRY          TimerQueue;
  1660.     USHORT              NumEntries;
  1661. } TUNNEL, *PTUNNEL;
  1662.  
  1663. typedef struct _VACB {
  1664.     PVOID               BaseAddress;
  1665.     PSHARED_CACHE_MAP   SharedCacheMap;
  1666.     union {
  1667.         LARGE_INTEGER   FileOffset;
  1668.         USHORT          ActiveCount;
  1669.     } Overlay;
  1670.     LIST_ENTRY          LruList;
  1671. } VACB, *PVACB;
  1672.  
  1673. typedef struct _VAD_HEADER {
  1674.     PVOID       StartVPN;
  1675.     PVOID       EndVPN;
  1676.     PVAD_HEADER ParentLink;
  1677.     PVAD_HEADER LeftLink;
  1678.     PVAD_HEADER RightLink;
  1679.     ULONG       Flags;          // LSB = CommitCharge
  1680.     PVOID       ControlArea;
  1681.     PVOID       FirstProtoPte;
  1682.     PVOID       LastPTE;
  1683.     ULONG       Unknown;
  1684.     LIST_ENTRY  Secured;
  1685. } VAD_HEADER, *PVAD_HEADER;
  1686.  
  1687. NTKERNELAPI
  1688. BOOLEAN
  1689. NTAPI
  1690. CcCanIWrite (
  1691.     IN PFILE_OBJECT FileObject,
  1692.     IN ULONG        BytesToWrite,
  1693.     IN BOOLEAN      Wait,
  1694.     IN BOOLEAN      Retrying
  1695. );
  1696.  
  1697. NTKERNELAPI
  1698. BOOLEAN
  1699. NTAPI
  1700. CcCopyRead (
  1701.     IN PFILE_OBJECT         FileObject,
  1702.     IN PLARGE_INTEGER       FileOffset,
  1703.     IN ULONG                Length,
  1704.     IN BOOLEAN              Wait,
  1705.     OUT PVOID               Buffer,
  1706.     OUT PIO_STATUS_BLOCK    IoStatus
  1707. );
  1708.  
  1709. NTKERNELAPI
  1710. BOOLEAN
  1711. NTAPI
  1712. CcCopyWrite (
  1713.     IN PFILE_OBJECT     FileObject,
  1714.     IN PLARGE_INTEGER   FileOffset,
  1715.     IN ULONG            Length,
  1716.     IN BOOLEAN          Wait,
  1717.     IN PVOID            Buffer
  1718. );
  1719.  
  1720. #define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
  1721.  
  1722. typedef VOID (NTAPI *PCC_POST_DEFERRED_WRITE) (
  1723.     IN PVOID Context1,
  1724.     IN PVOID Context2
  1725. );
  1726.  
  1727. NTKERNELAPI
  1728. VOID
  1729. NTAPI
  1730. CcDeferWrite (
  1731.     IN PFILE_OBJECT             FileObject,
  1732.     IN PCC_POST_DEFERRED_WRITE  PostRoutine,
  1733.     IN PVOID                    Context1,
  1734.     IN PVOID                    Context2,
  1735.     IN ULONG                    BytesToWrite,
  1736.     IN BOOLEAN                  Retrying
  1737. );
  1738.  
  1739. NTKERNELAPI
  1740. VOID
  1741. NTAPI
  1742. CcFastCopyRead (
  1743.     IN PFILE_OBJECT         FileObject,
  1744.     IN ULONG                FileOffset,
  1745.     IN ULONG                Length,
  1746.     IN ULONG                PageCount,
  1747.     OUT PVOID               Buffer,
  1748.     OUT PIO_STATUS_BLOCK    IoStatus
  1749. );
  1750.  
  1751. NTKERNELAPI
  1752. VOID
  1753. NTAPI
  1754. CcFastCopyWrite (
  1755.     IN PFILE_OBJECT FileObject,
  1756.     IN ULONG        FileOffset,
  1757.     IN ULONG        Length,
  1758.     IN PVOID        Buffer
  1759. );
  1760.  
  1761. NTKERNELAPI
  1762. VOID
  1763. NTAPI
  1764. CcFlushCache (
  1765.     IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
  1766.     IN PLARGE_INTEGER           FileOffset OPTIONAL,
  1767.     IN ULONG                    Length,
  1768.     OUT PIO_STATUS_BLOCK        IoStatus OPTIONAL
  1769. );
  1770.  
  1771. typedef VOID (*PDIRTY_PAGE_ROUTINE) (
  1772.     IN PFILE_OBJECT     FileObject,
  1773.     IN PLARGE_INTEGER   FileOffset,
  1774.     IN ULONG            Length,
  1775.     IN PLARGE_INTEGER   OldestLsn,
  1776.     IN PLARGE_INTEGER   NewestLsn,
  1777.     IN PVOID            Context1,
  1778.     IN PVOID            Context2
  1779. );
  1780.  
  1781. NTKERNELAPI
  1782. LARGE_INTEGER
  1783. NTAPI
  1784. CcGetDirtyPages (
  1785.     IN PVOID                LogHandle,
  1786.     IN PDIRTY_PAGE_ROUTINE  DirtyPageRoutine,
  1787.     IN PVOID                Context1,
  1788.     IN PVOID                Context2
  1789. );
  1790.  
  1791. NTKERNELAPI
  1792. PFILE_OBJECT
  1793. NTAPI
  1794. CcGetFileObjectFromBcb (
  1795.     IN PVOID Bcb
  1796. );
  1797.  
  1798. NTKERNELAPI
  1799. PFILE_OBJECT
  1800. NTAPI
  1801. CcGetFileObjectFromSectionPtrs (
  1802.     IN PSECTION_OBJECT_POINTERS SectionObjectPointer
  1803. );
  1804.  
  1805. #define CcGetFileSizePointer(FO) (                                     \
  1806.     ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
  1807. )
  1808.  
  1809. #if (VER_PRODUCTBUILD >= 2195)
  1810.  
  1811. NTKERNELAPI
  1812. LARGE_INTEGER
  1813. NTAPI
  1814. CcGetFlushedValidData (
  1815.     IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
  1816.     IN BOOLEAN                  BcbListHeld
  1817. );
  1818.  
  1819. #endif // (VER_PRODUCTBUILD >= 2195)
  1820.  
  1821. NTKERNELAPI
  1822. LARGE_INTEGER
  1823. CcGetLsnForFileObject (
  1824.     IN PFILE_OBJECT     FileObject,
  1825.     OUT PLARGE_INTEGER  OldestLsn OPTIONAL
  1826. );
  1827.  
  1828. typedef BOOLEAN (NTAPI *PACQUIRE_FOR_LAZY_WRITE) (
  1829.     IN PVOID    Context,
  1830.     IN BOOLEAN  Wait
  1831. );
  1832.  
  1833. typedef VOID (NTAPI *PRELEASE_FROM_LAZY_WRITE) (
  1834.     IN PVOID Context
  1835. );
  1836.  
  1837. typedef BOOLEAN (NTAPI *PACQUIRE_FOR_READ_AHEAD) (
  1838.     IN PVOID    Context,
  1839.     IN BOOLEAN  Wait
  1840. );
  1841.  
  1842. typedef VOID (NTAPI *PRELEASE_FROM_READ_AHEAD) (
  1843.     IN PVOID Context
  1844. );
  1845.  
  1846. typedef struct _CACHE_MANAGER_CALLBACKS {
  1847.     PACQUIRE_FOR_LAZY_WRITE     AcquireForLazyWrite;
  1848.     PRELEASE_FROM_LAZY_WRITE    ReleaseFromLazyWrite;
  1849.     PACQUIRE_FOR_READ_AHEAD     AcquireForReadAhead;
  1850.     PRELEASE_FROM_READ_AHEAD    ReleaseFromReadAhead;
  1851. } CACHE_MANAGER_CALLBACKS, *PCACHE_MANAGER_CALLBACKS;
  1852.  
  1853. NTKERNELAPI
  1854. VOID
  1855. NTAPI
  1856. CcInitializeCacheMap (
  1857.     IN PFILE_OBJECT             FileObject,
  1858.     IN PCC_FILE_SIZES           FileSizes,
  1859.     IN BOOLEAN                  PinAccess,
  1860.     IN PCACHE_MANAGER_CALLBACKS Callbacks,
  1861.     IN PVOID                    LazyWriteContext
  1862. );
  1863.  
  1864. #define CcIsFileCached(FO) (                                                         \
  1865.     ((FO)->SectionObjectPointer != NULL) &&                                          \
  1866.     (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
  1867. )
  1868.  
  1869. NTKERNELAPI
  1870. BOOLEAN
  1871. NTAPI
  1872. CcIsThereDirtyData (
  1873.     IN PVPB Vpb
  1874. );
  1875.  
  1876. NTKERNELAPI
  1877. BOOLEAN
  1878. NTAPI
  1879. CcMapData (
  1880.     IN PFILE_OBJECT     FileObject,
  1881.     IN PLARGE_INTEGER   FileOffset,
  1882.     IN ULONG            Length,
  1883.     IN BOOLEAN          Wait,
  1884.     OUT PVOID           *Bcb,
  1885.     OUT PVOID           *Buffer
  1886. );
  1887.  
  1888. NTKERNELAPI
  1889. VOID
  1890. NTAPI
  1891. CcMdlRead (
  1892.     IN PFILE_OBJECT         FileObject,
  1893.     IN PLARGE_INTEGER       FileOffset,
  1894.     IN ULONG                Length,
  1895.     OUT PMDL                *MdlChain,
  1896.     OUT PIO_STATUS_BLOCK    IoStatus
  1897. );
  1898.  
  1899. NTKERNELAPI
  1900. VOID
  1901. NTAPI
  1902. CcMdlReadComplete (
  1903.     IN PFILE_OBJECT FileObject,
  1904.     IN PMDL         MdlChain
  1905. );
  1906.  
  1907. NTKERNELAPI
  1908. VOID
  1909. NTAPI
  1910. CcMdlWriteComplete (
  1911.     IN PFILE_OBJECT     FileObject,
  1912.     IN PLARGE_INTEGER   FileOffset,
  1913.     IN PMDL             MdlChain
  1914. );
  1915.  
  1916. NTKERNELAPI
  1917. BOOLEAN
  1918. NTAPI
  1919. CcPinMappedData (
  1920.     IN PFILE_OBJECT     FileObject,
  1921.     IN PLARGE_INTEGER   FileOffset,
  1922.     IN ULONG            Length,
  1923. #if (VER_PRODUCTBUILD >= 2195)
  1924.     IN ULONG            Flags,
  1925. #else
  1926.     IN BOOLEAN          Wait,
  1927. #endif
  1928.     IN OUT PVOID        *Bcb
  1929. );
  1930.  
  1931. NTKERNELAPI
  1932. BOOLEAN
  1933. NTAPI
  1934. CcPinRead (
  1935.     IN PFILE_OBJECT     FileObject,
  1936.     IN PLARGE_INTEGER   FileOffset,
  1937.     IN ULONG            Length,
  1938. #if (VER_PRODUCTBUILD >= 2195)
  1939.     IN ULONG            Flags,
  1940. #else
  1941.     IN BOOLEAN          Wait,
  1942. #endif
  1943.     OUT PVOID           *Bcb,
  1944.     OUT PVOID           *Buffer
  1945. );
  1946.  
  1947. NTKERNELAPI
  1948. VOID
  1949. NTAPI
  1950. CcPrepareMdlWrite (
  1951.     IN PFILE_OBJECT         FileObject,
  1952.     IN PLARGE_INTEGER       FileOffset,
  1953.     IN ULONG                Length,
  1954.     OUT PMDL                *MdlChain,
  1955.     OUT PIO_STATUS_BLOCK    IoStatus
  1956. );
  1957.  
  1958. NTKERNELAPI
  1959. BOOLEAN
  1960. NTAPI
  1961. CcPreparePinWrite (
  1962.     IN PFILE_OBJECT     FileObject,
  1963.     IN PLARGE_INTEGER   FileOffset,
  1964.     IN ULONG            Length,
  1965.     IN BOOLEAN          Zero,
  1966. #if (VER_PRODUCTBUILD >= 2195)
  1967.     IN ULONG            Flags,
  1968. #else
  1969.     IN BOOLEAN          Wait,
  1970. #endif
  1971.     OUT PVOID           *Bcb,
  1972.     OUT PVOID           *Buffer
  1973. );
  1974.  
  1975. NTKERNELAPI
  1976. BOOLEAN
  1977. NTAPI
  1978. CcPurgeCacheSection (
  1979.     IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
  1980.     IN PLARGE_INTEGER           FileOffset OPTIONAL,
  1981.     IN ULONG                    Length,
  1982.     IN BOOLEAN                  UninitializeCacheMaps
  1983. );
  1984.  
  1985. #define CcReadAhead(FO, FOFF, LEN) (                \
  1986.     if ((LEN) >= 256) {                             \
  1987.         CcScheduleReadAhead((FO), (FOFF), (LEN));   \
  1988.     }                                               \
  1989. )
  1990.  
  1991. #if (VER_PRODUCTBUILD >= 2195)
  1992.  
  1993. NTKERNELAPI
  1994. PVOID
  1995. NTAPI
  1996. CcRemapBcb (
  1997.     IN PVOID Bcb
  1998. );
  1999.  
  2000. #endif // (VER_PRODUCTBUILD >= 2195)
  2001.  
  2002. NTKERNELAPI
  2003. VOID
  2004. NTAPI
  2005. CcRepinBcb (
  2006.     IN PVOID Bcb
  2007. );
  2008.  
  2009. NTKERNELAPI
  2010. VOID
  2011. NTAPI
  2012. CcScheduleReadAhead (
  2013.     IN PFILE_OBJECT     FileObject,
  2014.     IN PLARGE_INTEGER   FileOffset,
  2015.     IN ULONG            Length
  2016. );
  2017.  
  2018. NTKERNELAPI
  2019. VOID
  2020. NTAPI
  2021. CcSetAdditionalCacheAttributes (
  2022.     IN PFILE_OBJECT FileObject,
  2023.     IN BOOLEAN      DisableReadAhead,
  2024.     IN BOOLEAN      DisableWriteBehind
  2025. );
  2026.  
  2027. NTKERNELAPI
  2028. VOID
  2029. NTAPI
  2030. CcSetBcbOwnerPointer (
  2031.     IN PVOID Bcb,
  2032.     IN PVOID OwnerPointer
  2033. );
  2034.  
  2035. NTKERNELAPI
  2036. VOID
  2037. NTAPI
  2038. CcSetDirtyPageThreshold (
  2039.     IN PFILE_OBJECT FileObject,
  2040.     IN ULONG        DirtyPageThreshold
  2041. );
  2042.  
  2043. NTKERNELAPI
  2044. VOID
  2045. NTAPI
  2046. CcSetDirtyPinnedData (
  2047.     IN PVOID            BcbVoid,
  2048.     IN PLARGE_INTEGER   Lsn OPTIONAL
  2049. );
  2050.  
  2051. NTKERNELAPI
  2052. VOID
  2053. NTAPI
  2054. CcSetFileSizes (
  2055.     IN PFILE_OBJECT     FileObject,
  2056.     IN PCC_FILE_SIZES   FileSizes
  2057. );
  2058.  
  2059. typedef VOID (NTAPI *PFLUSH_TO_LSN) (
  2060.     IN PVOID            LogHandle,
  2061.     IN PLARGE_INTEGER   Lsn
  2062. );
  2063.  
  2064. NTKERNELAPI
  2065. VOID
  2066. NTAPI
  2067. CcSetLogHandleForFile (
  2068.     IN PFILE_OBJECT     FileObject,
  2069.     IN PVOID            LogHandle,
  2070.     IN PFLUSH_TO_LSN    FlushToLsnRoutine
  2071. );
  2072.  
  2073. NTKERNELAPI
  2074. VOID
  2075. NTAPI
  2076. CcSetReadAheadGranularity (
  2077.     IN PFILE_OBJECT FileObject,
  2078.     IN ULONG        Granularity     // default: PAGE_SIZE
  2079.                                     // allowed: 2^n * PAGE_SIZE
  2080. );
  2081.  
  2082. NTKERNELAPI
  2083. BOOLEAN
  2084. NTAPI
  2085. CcUninitializeCacheMap (
  2086.     IN PFILE_OBJECT                 FileObject,
  2087.     IN PLARGE_INTEGER               TruncateSize OPTIONAL,
  2088.     IN PCACHE_UNINITIALIZE_EVENT    UninitializeCompleteEvent OPTIONAL
  2089. );
  2090.  
  2091. NTKERNELAPI
  2092. VOID
  2093. NTAPI
  2094. CcUnpinData (
  2095.     IN PVOID Bcb
  2096. );
  2097.  
  2098. NTKERNELAPI
  2099. VOID
  2100. NTAPI
  2101. CcUnpinDataForThread (
  2102.     IN PVOID            Bcb,
  2103.     IN ERESOURCE_THREAD ResourceThreadId
  2104. );
  2105.  
  2106. NTKERNELAPI
  2107. VOID
  2108. NTAPI
  2109. CcUnpinRepinnedBcb (
  2110.     IN PVOID                Bcb,
  2111.     IN BOOLEAN              WriteThrough,
  2112.     OUT PIO_STATUS_BLOCK    IoStatus
  2113. );
  2114.  
  2115. #if (VER_PRODUCTBUILD >= 2195)
  2116.  
  2117. NTKERNELAPI
  2118. NTSTATUS
  2119. NTAPI
  2120. CcWaitForCurrentLazyWriterActivity (
  2121.     VOID
  2122. );
  2123.  
  2124. #endif // (VER_PRODUCTBUILD >= 2195)
  2125.  
  2126. NTKERNELAPI
  2127. BOOLEAN
  2128. NTAPI
  2129. CcZeroData (
  2130.     IN PFILE_OBJECT     FileObject,
  2131.     IN PLARGE_INTEGER   StartOffset,
  2132.     IN PLARGE_INTEGER   EndOffset,
  2133.     IN BOOLEAN          Wait
  2134. );
  2135.  
  2136. NTKERNELAPI
  2137. VOID
  2138. NTAPI
  2139. ExDisableResourceBoostLite (
  2140.     IN PERESOURCE Resource
  2141. );
  2142.  
  2143. NTKERNELAPI
  2144. ULONG
  2145. NTAPI
  2146. ExQueryPoolBlockSize (
  2147.     IN PVOID        PoolBlock,
  2148.     OUT PBOOLEAN    QuotaCharged
  2149. );
  2150.  
  2151. #define FlagOn(x, f) ((x) & (f))
  2152.  
  2153. NTKERNELAPI
  2154. VOID
  2155. NTAPI
  2156. FsRtlAddToTunnelCache (
  2157.     IN PTUNNEL          Cache,
  2158.     IN ULONGLONG        DirectoryKey,
  2159.     IN PUNICODE_STRING  ShortName,
  2160.     IN PUNICODE_STRING  LongName,
  2161.     IN BOOLEAN          KeyByShortName,
  2162.     IN ULONG            DataLength,
  2163.     IN PVOID            Data
  2164. );
  2165.  
  2166. #if (VER_PRODUCTBUILD >= 2195)
  2167.  
  2168. PFILE_LOCK
  2169. NTAPI
  2170. FsRtlAllocateFileLock (
  2171.     IN PCOMPLETE_LOCK_IRP_ROUTINE   CompleteLockIrpRoutine OPTIONAL,
  2172.     IN PUNLOCK_ROUTINE              UnlockRoutine OPTIONAL
  2173. );
  2174.  
  2175. #endif // (VER_PRODUCTBUILD >= 2195)
  2176.  
  2177. NTKERNELAPI
  2178. PVOID
  2179. NTAPI
  2180. FsRtlAllocatePool (
  2181.     IN POOL_TYPE    PoolType,
  2182.     IN ULONG        NumberOfBytes
  2183. );
  2184.  
  2185. NTKERNELAPI
  2186. PVOID
  2187. NTAPI
  2188. FsRtlAllocatePoolWithQuota (
  2189.     IN POOL_TYPE    PoolType,
  2190.     IN ULONG        NumberOfBytes
  2191. );
  2192.  
  2193. NTKERNELAPI
  2194. PVOID
  2195. NTAPI
  2196. FsRtlAllocatePoolWithQuotaTag (
  2197.     IN POOL_TYPE    PoolType,
  2198.     IN ULONG        NumberOfBytes,
  2199.     IN ULONG        Tag
  2200. );
  2201.  
  2202. NTKERNELAPI
  2203. PVOID
  2204. NTAPI
  2205. FsRtlAllocatePoolWithTag (
  2206.     IN POOL_TYPE    PoolType,
  2207.     IN ULONG        NumberOfBytes,
  2208.     IN ULONG        Tag
  2209. );
  2210.  
  2211. NTKERNELAPI
  2212. BOOLEAN
  2213. NTAPI
  2214. FsRtlAreNamesEqual (
  2215.     IN PUNICODE_STRING  Name1,
  2216.     IN PUNICODE_STRING  Name2,
  2217.     IN BOOLEAN          IgnoreCase,
  2218.     IN PWCHAR           UpcaseTable OPTIONAL
  2219. );
  2220.  
  2221. #define FsRtlAreThereCurrentFileLocks(FL) ( \
  2222.     ((FL)->FastIoIsQuestionable)            \
  2223. )
  2224.  
  2225. /*
  2226.   FsRtlCheckLockForReadAccess:
  2227.  
  2228.   All this really does is pick out the lock parameters from the irp (io stack
  2229.   location?), get IoGetRequestorProcess, and pass values on to
  2230.   FsRtlFastCheckLockForRead.
  2231. */
  2232. NTKERNELAPI
  2233. BOOLEAN
  2234. NTAPI
  2235. FsRtlCheckLockForReadAccess (
  2236.     IN PFILE_LOCK   FileLock,
  2237.     IN PIRP         Irp
  2238. );
  2239.  
  2240. /*
  2241.   FsRtlCheckLockForWriteAccess:
  2242.  
  2243.   All this really does is pick out the lock parameters from the irp (io stack
  2244.   location?), get IoGetRequestorProcess, and pass values on to
  2245.   FsRtlFastCheckLockForWrite.
  2246. */
  2247. NTKERNELAPI
  2248. BOOLEAN
  2249. NTAPI
  2250. FsRtlCheckLockForWriteAccess (
  2251.     IN PFILE_LOCK   FileLock,
  2252.     IN PIRP         Irp
  2253. );
  2254.  
  2255. typedef
  2256. VOID NTAPI
  2257. (*POPLOCK_WAIT_COMPLETE_ROUTINE) (
  2258.     IN PVOID    Context,
  2259.     IN PIRP     Irp
  2260. );
  2261.  
  2262. typedef
  2263. VOID NTAPI
  2264. (*POPLOCK_FS_PREPOST_IRP) (
  2265.     IN PVOID    Context,
  2266.     IN PIRP     Irp
  2267. );
  2268.  
  2269. NTKERNELAPI
  2270. NTSTATUS
  2271. NTAPI
  2272. FsRtlCheckOplock (
  2273.     IN POPLOCK                          Oplock,
  2274.     IN PIRP                             Irp,
  2275.     IN PVOID                            Context,
  2276.     IN POPLOCK_WAIT_COMPLETE_ROUTINE    CompletionRoutine OPTIONAL,
  2277.     IN POPLOCK_FS_PREPOST_IRP           PostIrpRoutine OPTIONAL
  2278. );
  2279.  
  2280. NTKERNELAPI
  2281. BOOLEAN
  2282. NTAPI
  2283. FsRtlCopyRead (
  2284.     IN PFILE_OBJECT         FileObject,
  2285.     IN PLARGE_INTEGER       FileOffset,
  2286.     IN ULONG                Length,
  2287.     IN BOOLEAN              Wait,
  2288.     IN ULONG                LockKey,
  2289.     OUT PVOID               Buffer,
  2290.     OUT PIO_STATUS_BLOCK    IoStatus,
  2291.     IN PDEVICE_OBJECT       DeviceObject
  2292. );
  2293.  
  2294. NTKERNELAPI
  2295. BOOLEAN
  2296. NTAPI
  2297. FsRtlCopyWrite (
  2298.     IN PFILE_OBJECT         FileObject,
  2299.     IN PLARGE_INTEGER       FileOffset,
  2300.     IN ULONG                Length,
  2301.     IN BOOLEAN              Wait,
  2302.     IN ULONG                LockKey,
  2303.     IN PVOID                Buffer,
  2304.     OUT PIO_STATUS_BLOCK    IoStatus,
  2305.     IN PDEVICE_OBJECT       DeviceObject
  2306. );
  2307.  
  2308. NTKERNELAPI
  2309. BOOLEAN
  2310. NTAPI
  2311. FsRtlCurrentBatchOplock (
  2312.     IN POPLOCK Oplock
  2313. );
  2314.  
  2315. NTKERNELAPI
  2316. VOID
  2317. NTAPI
  2318. FsRtlDeleteKeyFromTunnelCache (
  2319.     IN PTUNNEL      Cache,
  2320.     IN ULONGLONG    DirectoryKey
  2321. );
  2322.  
  2323. NTKERNELAPI
  2324. VOID
  2325. NTAPI
  2326. FsRtlDeleteTunnelCache (
  2327.     IN PTUNNEL Cache
  2328. );
  2329.  
  2330. NTKERNELAPI
  2331. VOID
  2332. NTAPI
  2333. FsRtlDeregisterUncProvider (
  2334.     IN HANDLE Handle
  2335. );
  2336.  
  2337. NTKERNELAPI
  2338. BOOLEAN
  2339. NTAPI
  2340. FsRtlDoesNameContainWildCards (
  2341.     IN PUNICODE_STRING Name
  2342. );
  2343.  
  2344. #define FsRtlEnterFileSystem    KeEnterCriticalRegion
  2345.  
  2346. #define FsRtlExitFileSystem     KeLeaveCriticalRegion
  2347.  
  2348. NTKERNELAPI
  2349. BOOLEAN
  2350. NTAPI
  2351. FsRtlFastCheckLockForRead (
  2352.     IN PFILE_LOCK           FileLock,
  2353.     IN PLARGE_INTEGER       FileOffset,
  2354.     IN PLARGE_INTEGER       Length,
  2355.     IN ULONG                Key,
  2356.     IN PFILE_OBJECT         FileObject,
  2357.     IN PEPROCESS            Process
  2358. );
  2359.  
  2360. NTKERNELAPI
  2361. BOOLEAN
  2362. NTAPI
  2363. FsRtlFastCheckLockForWrite (
  2364.     IN PFILE_LOCK           FileLock,
  2365.     IN PLARGE_INTEGER       FileOffset,
  2366.     IN PLARGE_INTEGER       Length,
  2367.     IN ULONG                Key,
  2368.     IN PFILE_OBJECT         FileObject,
  2369.     IN PEPROCESS            Process
  2370. );
  2371.  
  2372. #define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) (       \
  2373.      FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11)   \
  2374. )
  2375.  
  2376. NTKERNELAPI
  2377. NTSTATUS
  2378. NTAPI
  2379. FsRtlFastUnlockAll (
  2380.     IN PFILE_LOCK           FileLock,
  2381.     IN PFILE_OBJECT         FileObject,
  2382.     IN PEPROCESS            Process,
  2383.     IN PVOID                Context OPTIONAL
  2384. );
  2385. //ret: STATUS_RANGE_NOT_LOCKED
  2386.  
  2387. NTKERNELAPI
  2388. NTSTATUS
  2389. NTAPI
  2390. FsRtlFastUnlockAllByKey (
  2391.     IN PFILE_LOCK           FileLock,
  2392.     IN PFILE_OBJECT         FileObject,
  2393.     IN PEPROCESS            Process,
  2394.     IN ULONG                Key,
  2395.     IN PVOID                Context OPTIONAL
  2396. );  
  2397. //ret: STATUS_RANGE_NOT_LOCKED
  2398.  
  2399. NTKERNELAPI
  2400. NTSTATUS
  2401. NTAPI
  2402. FsRtlFastUnlockSingle (
  2403.     IN PFILE_LOCK           FileLock,
  2404.     IN PFILE_OBJECT         FileObject,
  2405.     IN PLARGE_INTEGER       FileOffset,
  2406.     IN PLARGE_INTEGER       Length,
  2407.     IN PEPROCESS            Process,
  2408.     IN ULONG                Key,
  2409.     IN PVOID                Context OPTIONAL,
  2410.     IN BOOLEAN              AlreadySynchronized
  2411. );                      
  2412. //ret:  STATUS_RANGE_NOT_LOCKED
  2413.  
  2414. NTKERNELAPI
  2415. BOOLEAN
  2416. NTAPI
  2417. FsRtlFindInTunnelCache (
  2418.     IN PTUNNEL          Cache,
  2419.     IN ULONGLONG        DirectoryKey,
  2420.     IN PUNICODE_STRING  Name,
  2421.     OUT PUNICODE_STRING ShortName,
  2422.     OUT PUNICODE_STRING LongName,
  2423.     IN OUT PULONG       DataLength,
  2424.     OUT PVOID           Data
  2425. );
  2426.  
  2427. #if (VER_PRODUCTBUILD >= 2195)
  2428.  
  2429. NTKERNELAPI
  2430. VOID
  2431. NTAPI
  2432. FsRtlFreeFileLock (
  2433.     IN PFILE_LOCK FileLock
  2434. );
  2435.  
  2436. #endif // (VER_PRODUCTBUILD >= 2195)
  2437.  
  2438. NTKERNELAPI
  2439. NTSTATUS
  2440. NTAPI
  2441. FsRtlGetFileSize (
  2442.     IN PFILE_OBJECT         FileObject,
  2443.     IN OUT PLARGE_INTEGER   FileSize
  2444. );
  2445.  
  2446. /*
  2447.   FsRtlGetNextFileLock:
  2448.  
  2449.   ret: NULL if no more locks
  2450.  
  2451.   Internals:
  2452.     FsRtlGetNextFileLock uses FileLock->LastReturnedLockInfo and
  2453.     FileLock->LastReturnedLock as storage.
  2454.     LastReturnedLock is a pointer to the 'raw' lock inkl. double linked
  2455.     list, and FsRtlGetNextFileLock needs this to get next lock on subsequent
  2456.     calls with Restart = FALSE.
  2457. */
  2458. NTKERNELAPI
  2459. PFILE_LOCK_INFO
  2460. NTAPI
  2461. FsRtlGetNextFileLock (
  2462.     IN PFILE_LOCK   FileLock,
  2463.     IN BOOLEAN      Restart
  2464. );
  2465.  
  2466. NTKERNELAPI
  2467. VOID
  2468. NTAPI
  2469. FsRtlInitializeFileLock (
  2470.     IN PFILE_LOCK                   FileLock,
  2471.     IN PCOMPLETE_LOCK_IRP_ROUTINE   CompleteLockIrpRoutine OPTIONAL,
  2472.     IN PUNLOCK_ROUTINE              UnlockRoutine OPTIONAL
  2473. );
  2474.  
  2475. NTKERNELAPI
  2476. VOID
  2477. NTAPI
  2478. FsRtlInitializeOplock (
  2479.     IN OUT POPLOCK Oplock
  2480. );
  2481.  
  2482. NTKERNELAPI
  2483. VOID
  2484. NTAPI
  2485. FsRtlInitializeTunnelCache (
  2486.     IN PTUNNEL Cache
  2487. );
  2488.  
  2489. NTKERNELAPI
  2490. BOOLEAN
  2491. NTAPI
  2492. FsRtlIsNameInExpression (
  2493.     IN PUNICODE_STRING  Expression,
  2494.     IN PUNICODE_STRING  Name,
  2495.     IN BOOLEAN          IgnoreCase,
  2496.     IN PWCHAR           UpcaseTable OPTIONAL
  2497. );
  2498.  
  2499. NTKERNELAPI
  2500. BOOLEAN
  2501. NTAPI
  2502. FsRtlIsNtstatusExpected (
  2503.     IN NTSTATUS Ntstatus
  2504. );
  2505.  
  2506. #define FsRtlIsUnicodeCharacterWild(C) (                                    \
  2507.     (((C) >= 0x40) ?                                                        \
  2508.     FALSE :                                                                 \
  2509.     FlagOn((*FsRtlLegalAnsiCharacterArray)[(C)], FSRTL_WILD_CHARACTER ))    \
  2510. )
  2511.  
  2512. NTKERNELAPI
  2513. BOOLEAN
  2514. NTAPI
  2515. FsRtlMdlReadComplete (
  2516.     IN PFILE_OBJECT     FileObject,
  2517.     IN PMDL             MdlChain
  2518. );
  2519.  
  2520. NTKERNELAPI
  2521. BOOLEAN
  2522. NTAPI
  2523. FsRtlMdlReadCompleteDev (
  2524.     IN PFILE_OBJECT     FileObject,
  2525.     IN PMDL             MdlChain,
  2526.     IN PDEVICE_OBJECT   DeviceObject
  2527. );
  2528.  
  2529. NTKERNELAPI
  2530. BOOLEAN
  2531. NTAPI
  2532. FsRtlMdlWriteComplete (
  2533.     IN PFILE_OBJECT     FileObject,
  2534.     IN PLARGE_INTEGER   FileOffset,
  2535.     IN PMDL             MdlChain
  2536. );
  2537.  
  2538. NTKERNELAPI
  2539. BOOLEAN
  2540. NTAPI
  2541. FsRtlMdlWriteCompleteDev (
  2542.     IN PFILE_OBJECT     FileObject,
  2543.     IN PLARGE_INTEGER   FileOffset,
  2544.     IN PMDL             MdlChain,
  2545.     IN PDEVICE_OBJECT   DeviceObject
  2546. );
  2547.  
  2548. NTKERNELAPI
  2549. NTSTATUS
  2550. NTAPI
  2551. FsRtlNormalizeNtstatus (
  2552.     IN NTSTATUS Exception,
  2553.     IN NTSTATUS GenericException
  2554. );
  2555.  
  2556. NTKERNELAPI
  2557. VOID
  2558. NTAPI
  2559. FsRtlNotifyChangeDirectory (
  2560.     IN PNOTIFY_SYNC NotifySync,
  2561.     IN PVOID        FsContext,
  2562.     IN PSTRING      FullDirectoryName,
  2563.     IN PLIST_ENTRY  NotifyList,
  2564.     IN BOOLEAN      WatchTree,
  2565.     IN ULONG        CompletionFilter,
  2566.     IN PIRP         NotifyIrp
  2567. );
  2568.  
  2569. NTKERNELAPI
  2570. VOID
  2571. NTAPI
  2572. FsRtlNotifyCleanup (
  2573.     IN PNOTIFY_SYNC NotifySync,
  2574.     IN PLIST_ENTRY  NotifyList,
  2575.     IN PVOID        FsContext
  2576. );
  2577.  
  2578. typedef BOOLEAN (*PCHECK_FOR_TRAVERSE_ACCESS) (
  2579.     IN PVOID                        NotifyContext,
  2580.     IN PVOID                        TargetContext,
  2581.     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext
  2582. );
  2583.  
  2584. NTKERNELAPI
  2585. VOID
  2586. NTAPI
  2587. FsRtlNotifyFullChangeDirectory (
  2588.     IN PNOTIFY_SYNC                 NotifySync,
  2589.     IN PLIST_ENTRY                  NotifyList,
  2590.     IN PVOID                        FsContext,
  2591.     IN PSTRING                      FullDirectoryName,
  2592.     IN BOOLEAN                      WatchTree,
  2593.     IN BOOLEAN                      IgnoreBuffer,
  2594.     IN ULONG                        CompletionFilter,
  2595.     IN PIRP                         NotifyIrp,
  2596.     IN PCHECK_FOR_TRAVERSE_ACCESS   TraverseCallback OPTIONAL,
  2597.     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext OPTIONAL
  2598. );
  2599.  
  2600. NTKERNELAPI
  2601. VOID
  2602. NTAPI
  2603. FsRtlNotifyFullReportChange (
  2604.     IN PNOTIFY_SYNC NotifySync,
  2605.     IN PLIST_ENTRY  NotifyList,
  2606.     IN PSTRING      FullTargetName,
  2607.     IN USHORT       TargetNameOffset,
  2608.     IN PSTRING      StreamName OPTIONAL,
  2609.     IN PSTRING      NormalizedParentName OPTIONAL,
  2610.     IN ULONG        FilterMatch,
  2611.     IN ULONG        Action,
  2612.     IN PVOID        TargetContext
  2613. );
  2614.  
  2615. NTKERNELAPI
  2616. VOID
  2617. NTAPI
  2618. FsRtlNotifyInitializeSync (
  2619.     IN PNOTIFY_SYNC NotifySync
  2620. );
  2621.  
  2622. NTKERNELAPI
  2623. VOID
  2624. NTAPI
  2625. FsRtlNotifyReportChange (
  2626.     IN PNOTIFY_SYNC NotifySync,
  2627.     IN PLIST_ENTRY  NotifyList,
  2628.     IN PSTRING      FullTargetName,
  2629.     IN PUSHORT      FileNamePartLength,
  2630.     IN ULONG        FilterMatch
  2631. );
  2632.  
  2633. NTKERNELAPI
  2634. VOID
  2635. NTAPI
  2636. FsRtlNotifyUninitializeSync (
  2637.     IN PNOTIFY_SYNC NotifySync
  2638. );
  2639.  
  2640. #if (VER_PRODUCTBUILD >= 2195)
  2641.  
  2642. NTKERNELAPI
  2643. NTSTATUS
  2644. NTAPI
  2645. FsRtlNotifyVolumeEvent (
  2646.     IN PFILE_OBJECT FileObject,
  2647.     IN ULONG        EventCode
  2648. );
  2649.  
  2650. #endif // (VER_PRODUCTBUILD >= 2195)
  2651.  
  2652. NTKERNELAPI
  2653. NTSTATUS
  2654. NTAPI
  2655. FsRtlOplockFsctrl (
  2656.     IN POPLOCK  Oplock,
  2657.     IN PIRP     Irp,
  2658.     IN ULONG    OpenCount
  2659. );
  2660.  
  2661. NTKERNELAPI
  2662. BOOLEAN
  2663. NTAPI
  2664. FsRtlOplockIsFastIoPossible (
  2665.     IN POPLOCK Oplock
  2666. );
  2667.  
  2668. /*
  2669.   FsRtlPrivateLock:
  2670.  
  2671.   ret: IoStatus->Status: STATUS_PENDING, STATUS_LOCK_NOT_GRANTED
  2672.  
  2673.   Internals: 
  2674.     -Calls IoCompleteRequest if Irp
  2675.     -Uses exception handling / ExRaiseStatus with STATUS_INSUFFICIENT_RESOURCES
  2676. */
  2677. NTKERNELAPI
  2678. BOOLEAN
  2679. NTAPI
  2680. FsRtlPrivateLock (
  2681.     IN PFILE_LOCK           FileLock,
  2682.     IN PFILE_OBJECT         FileObject,
  2683.     IN PLARGE_INTEGER       FileOffset,
  2684.     IN PLARGE_INTEGER       Length,
  2685.     IN PEPROCESS            Process,
  2686.     IN ULONG                Key,
  2687.     IN BOOLEAN              FailImmediately, 
  2688.     IN BOOLEAN              ExclusiveLock,
  2689.     OUT PIO_STATUS_BLOCK    IoStatus, 
  2690.     IN PIRP                 Irp OPTIONAL,
  2691.     IN PVOID                Context,
  2692.     IN BOOLEAN              AlreadySynchronized
  2693. );
  2694.  
  2695. /*
  2696.   FsRtlProcessFileLock:
  2697.  
  2698.   ret:
  2699.     -STATUS_INVALID_DEVICE_REQUEST
  2700.     -STATUS_RANGE_NOT_LOCKED from unlock routines.
  2701.     -STATUS_PENDING, STATUS_LOCK_NOT_GRANTED from FsRtlPrivateLock
  2702.     (redirected IoStatus->Status).
  2703.  
  2704.   Internals: 
  2705.     -switch ( Irp->CurrentStackLocation->MinorFunction )
  2706.         lock: return FsRtlPrivateLock;
  2707.         unlocksingle: return FsRtlFastUnlockSingle;
  2708.         unlockall: return FsRtlFastUnlockAll;
  2709.         unlockallbykey: return FsRtlFastUnlockAllByKey;
  2710.         default: IofCompleteRequest with STATUS_INVALID_DEVICE_REQUEST;
  2711.                  return STATUS_INVALID_DEVICE_REQUEST;
  2712.  
  2713.     -'AllwaysZero' is passed thru as 'AllwaysZero' to lock / unlock routines.
  2714.     -'Irp' is passet thru as 'Irp' to FsRtlPrivateLock.
  2715. */
  2716. NTKERNELAPI
  2717. NTSTATUS
  2718. NTAPI
  2719. FsRtlProcessFileLock (
  2720.     IN PFILE_LOCK   FileLock,
  2721.     IN PIRP         Irp,
  2722.     IN PVOID        Context OPTIONAL
  2723. );
  2724.  
  2725. NTKERNELAPI
  2726. NTSTATUS
  2727. NTAPI
  2728. FsRtlRegisterUncProvider (
  2729.     IN OUT PHANDLE      MupHandle,
  2730.     IN PUNICODE_STRING  RedirectorDeviceName,
  2731.     IN BOOLEAN          MailslotsSupported
  2732. );
  2733.  
  2734. NTKERNELAPI
  2735. VOID
  2736. NTAPI
  2737. FsRtlUninitializeFileLock (
  2738.     IN PFILE_LOCK FileLock
  2739. );
  2740.  
  2741. NTKERNELAPI
  2742. VOID
  2743. NTAPI
  2744. FsRtlUninitializeOplock (
  2745.     IN OUT POPLOCK Oplock
  2746. );
  2747.  
  2748. NTSYSAPI
  2749. VOID
  2750. NTAPI
  2751. HalDisplayString (
  2752.     IN PCHAR String
  2753. );
  2754.  
  2755. NTSYSAPI
  2756. VOID
  2757. NTAPI
  2758. HalQueryRealTimeClock (
  2759.     IN OUT PTIME_FIELDS TimeFields
  2760. );
  2761.  
  2762. NTSYSAPI
  2763. VOID
  2764. NTAPI
  2765. HalSetRealTimeClock (
  2766.     IN PTIME_FIELDS TimeFields
  2767. );
  2768.  
  2769. #define InitializeMessageHeader(m, l, t) {                  \
  2770.     (m)->Length = (USHORT)(l);                              \
  2771.     (m)->DataLength = (USHORT)(l - sizeof( LPC_MESSAGE ));  \
  2772.     (m)->MessageType = (USHORT)(t);                         \
  2773.     (m)->DataInfoOffset = 0;                                \
  2774. }
  2775.  
  2776. NTKERNELAPI
  2777. VOID
  2778. NTAPI
  2779. IoAcquireVpbSpinLock (
  2780.     OUT PKIRQL Irql
  2781. );
  2782.  
  2783. NTKERNELAPI
  2784. NTSTATUS
  2785. NTAPI
  2786. IoCheckDesiredAccess (
  2787.     IN OUT PACCESS_MASK DesiredAccess,
  2788.     IN ACCESS_MASK      GrantedAccess
  2789. );
  2790.  
  2791. NTKERNELAPI
  2792. NTSTATUS
  2793. NTAPI
  2794. IoCheckEaBufferValidity (
  2795.     IN PFILE_FULL_EA_INFORMATION    EaBuffer,
  2796.     IN ULONG                        EaLength,
  2797.     OUT PULONG                      ErrorOffset
  2798. );
  2799.  
  2800. NTKERNELAPI
  2801. NTSTATUS
  2802. NTAPI
  2803. IoCheckFunctionAccess (
  2804.     IN ACCESS_MASK              GrantedAccess,
  2805.     IN UCHAR                    MajorFunction,
  2806.     IN UCHAR                    MinorFunction,
  2807.     IN ULONG                    IoControlCode,
  2808.     IN PFILE_INFORMATION_CLASS  FileInformationClass OPTIONAL,
  2809.     IN PFS_INFORMATION_CLASS    FsInformationClass OPTIONAL
  2810. );
  2811.  
  2812. #if (VER_PRODUCTBUILD >= 2195)
  2813.  
  2814. NTKERNELAPI
  2815. NTSTATUS
  2816. NTAPI
  2817. IoCheckQuotaBufferValidity (
  2818.     IN PFILE_QUOTA_INFORMATION  QuotaBuffer,
  2819.     IN ULONG                    QuotaLength,
  2820.     OUT PULONG                  ErrorOffset
  2821. );
  2822.  
  2823. #endif // (VER_PRODUCTBUILD >= 2195)
  2824.  
  2825. NTKERNELAPI
  2826. PFILE_OBJECT
  2827. NTAPI
  2828. IoCreateStreamFileObject (
  2829.     IN PFILE_OBJECT     FileObject OPTIONAL,
  2830.     IN PDEVICE_OBJECT   DeviceObject OPTIONAL
  2831. );
  2832.  
  2833. #if (VER_PRODUCTBUILD >= 2195)
  2834.  
  2835. NTKERNELAPI
  2836. PFILE_OBJECT
  2837. NTAPI
  2838. IoCreateStreamFileObjectLite (
  2839.     IN PFILE_OBJECT     FileObject OPTIONAL,
  2840.     IN PDEVICE_OBJECT   DeviceObject OPTIONAL
  2841. );
  2842.  
  2843. #endif // (VER_PRODUCTBUILD >= 2195)
  2844.  
  2845. NTKERNELAPI
  2846. BOOLEAN
  2847. NTAPI
  2848. IoFastQueryNetworkAttributes (
  2849.     IN POBJECT_ATTRIBUTES               ObjectAttributes,
  2850.     IN ACCESS_MASK                      DesiredAccess,
  2851.     IN ULONG                            OpenOptions,
  2852.     OUT PIO_STATUS_BLOCK                IoStatus,
  2853.     OUT PFILE_NETWORK_OPEN_INFORMATION  Buffer
  2854. );
  2855.  
  2856. NTKERNELAPI
  2857. PDEVICE_OBJECT
  2858. NTAPI
  2859. IoGetAttachedDevice (
  2860.     IN PDEVICE_OBJECT DeviceObject
  2861. );
  2862.  
  2863. NTKERNELAPI
  2864. PDEVICE_OBJECT
  2865. NTAPI
  2866. IoGetBaseFileSystemDeviceObject (
  2867.     IN PFILE_OBJECT FileObject
  2868. );
  2869.  
  2870. NTKERNELAPI
  2871. PEPROCESS
  2872. NTAPI
  2873. IoGetRequestorProcess (
  2874.     IN PIRP Irp
  2875. );
  2876.  
  2877. #if (VER_PRODUCTBUILD >= 2195)
  2878.  
  2879. NTKERNELAPI
  2880. ULONG
  2881. NTAPI
  2882. IoGetRequestorProcessId (
  2883.     IN PIRP Irp
  2884. );
  2885.  
  2886. #endif // (VER_PRODUCTBUILD >= 2195)
  2887.  
  2888. NTKERNELAPI
  2889. PIRP
  2890. NTAPI
  2891. IoGetTopLevelIrp (
  2892.     VOID
  2893. );
  2894.  
  2895. #define IoIsFileOpenedExclusively(FileObject) ( \
  2896.     (BOOLEAN) !(                                \
  2897.     (FileObject)->SharedRead ||                 \
  2898.     (FileObject)->SharedWrite ||                \
  2899.     (FileObject)->SharedDelete                  \
  2900.     )                                           \
  2901. )
  2902.  
  2903. NTKERNELAPI
  2904. BOOLEAN
  2905. NTAPI
  2906. IoIsOperationSynchronous (
  2907.     IN PIRP Irp
  2908. );
  2909.  
  2910. NTKERNELAPI
  2911. BOOLEAN
  2912. NTAPI
  2913. IoIsSystemThread (
  2914.     IN PETHREAD Thread
  2915. );
  2916.  
  2917. #if (VER_PRODUCTBUILD >= 2195)
  2918.  
  2919. NTKERNELAPI
  2920. BOOLEAN
  2921. NTAPI
  2922. IoIsValidNameGraftingBuffer (
  2923.     IN PIRP                 Irp,
  2924.     IN PREPARSE_DATA_BUFFER ReparseBuffer
  2925. );
  2926.  
  2927. #endif // (VER_PRODUCTBUILD >= 2195)
  2928.  
  2929. NTKERNELAPI
  2930. NTSTATUS
  2931. NTAPI
  2932. IoPageRead (
  2933.     IN PFILE_OBJECT         FileObject,
  2934.     IN PMDL                 Mdl,
  2935.     IN PLARGE_INTEGER       Offset,
  2936.     IN PKEVENT              Event,
  2937.     OUT PIO_STATUS_BLOCK    IoStatusBlock
  2938. );
  2939.  
  2940. NTKERNELAPI
  2941. NTSTATUS
  2942. NTAPI
  2943. IoQueryFileInformation (
  2944.     IN PFILE_OBJECT             FileObject,
  2945.     IN FILE_INFORMATION_CLASS   FileInformationClass,
  2946.     IN ULONG                    Length,
  2947.     OUT PVOID                   FileInformation,
  2948.     OUT PULONG                  ReturnedLength
  2949. );
  2950.  
  2951. NTKERNELAPI
  2952. NTSTATUS
  2953. NTAPI
  2954. IoQueryVolumeInformation (
  2955.     IN PFILE_OBJECT         FileObject,
  2956.     IN FS_INFORMATION_CLASS FsInformationClass,
  2957.     IN ULONG                Length,
  2958.     OUT PVOID               FsInformation,
  2959.     OUT PULONG              ReturnedLength
  2960. );
  2961.  
  2962. NTKERNELAPI
  2963. VOID
  2964. NTAPI
  2965. IoRegisterFileSystem (
  2966.     IN OUT PDEVICE_OBJECT DeviceObject
  2967. );
  2968.  
  2969. #if (VER_PRODUCTBUILD >= 1381)
  2970.  
  2971. typedef VOID (NTAPI *PDRIVER_FS_NOTIFICATION) (
  2972.     IN PDEVICE_OBJECT DeviceObject,
  2973.     IN BOOLEAN        DriverActive
  2974. );
  2975.  
  2976. NTKERNELAPI
  2977. NTSTATUS
  2978. NTAPI
  2979. IoRegisterFsRegistrationChange (
  2980.     IN PDRIVER_OBJECT           DriverObject,
  2981.     IN PDRIVER_FS_NOTIFICATION  DriverNotificationRoutine
  2982. );
  2983.  
  2984. #endif // (VER_PRODUCTBUILD >= 1381)
  2985.  
  2986. NTKERNELAPI
  2987. VOID
  2988. NTAPI
  2989. IoReleaseVpbSpinLock (
  2990.     IN KIRQL Irql
  2991. );
  2992.  
  2993. NTKERNELAPI
  2994. VOID
  2995. NTAPI
  2996. IoSetDeviceToVerify (
  2997.     IN PETHREAD         Thread,
  2998.     IN PDEVICE_OBJECT   DeviceObject
  2999. );
  3000.  
  3001. NTKERNELAPI
  3002. NTSTATUS
  3003. NTAPI
  3004. IoSetInformation (
  3005.     IN PFILE_OBJECT             FileObject,
  3006.     IN FILE_INFORMATION_CLASS   FileInformationClass,
  3007.     IN ULONG                    Length,
  3008.     IN PVOID                    FileInformation
  3009. );
  3010.  
  3011. NTKERNELAPI
  3012. VOID
  3013. NTAPI
  3014. IoSetTopLevelIrp (
  3015.     IN PIRP Irp
  3016. );
  3017.  
  3018. NTKERNELAPI
  3019. NTSTATUS
  3020. NTAPI
  3021. IoSynchronousPageWrite (
  3022.     IN PFILE_OBJECT         FileObject,
  3023.     IN PMDL                 Mdl,
  3024.     IN PLARGE_INTEGER       FileOffset,
  3025.     IN PKEVENT              Event,
  3026.     OUT PIO_STATUS_BLOCK    IoStatusBlock
  3027. );
  3028.  
  3029. NTKERNELAPI
  3030. PEPROCESS
  3031. NTAPI
  3032. IoThreadToProcess (
  3033.     IN PETHREAD Thread
  3034. );
  3035.  
  3036. NTKERNELAPI
  3037. VOID
  3038. NTAPI
  3039. IoUnregisterFileSystem (
  3040.     IN OUT PDEVICE_OBJECT DeviceObject
  3041. );
  3042.  
  3043. #if (VER_PRODUCTBUILD >= 1381)
  3044.  
  3045. NTKERNELAPI
  3046. NTSTATUS
  3047. NTAPI
  3048. IoUnregisterFsRegistrationChange (
  3049.     IN PDRIVER_OBJECT           DriverObject,
  3050.     IN PDRIVER_FS_NOTIFICATION  DriverNotificationRoutine
  3051. );
  3052.  
  3053. #endif // (VER_PRODUCTBUILD >= 1381)
  3054.  
  3055. NTKERNELAPI
  3056. NTSTATUS
  3057. NTAPI
  3058. IoVerifyVolume (
  3059.     IN PDEVICE_OBJECT   DeviceObject,
  3060.     IN BOOLEAN          AllowRawMount
  3061. );
  3062.  
  3063. NTKERNELAPI
  3064. VOID
  3065. NTAPI
  3066. KeAttachProcess (
  3067.     IN PEPROCESS Process
  3068. );
  3069.  
  3070. NTKERNELAPI
  3071. VOID
  3072. NTAPI
  3073. KeDetachProcess (
  3074.     VOID
  3075. );
  3076.  
  3077. NTKERNELAPI
  3078. VOID
  3079. NTAPI
  3080. KeInitializeQueue (
  3081.     IN PRKQUEUE Queue,
  3082.     IN ULONG    Count OPTIONAL
  3083. );
  3084.  
  3085. NTKERNELAPI
  3086. LONG
  3087. NTAPI
  3088. KeInsertHeadQueue (
  3089.     IN PRKQUEUE     Queue,
  3090.     IN PLIST_ENTRY  Entry
  3091. );
  3092.  
  3093. NTKERNELAPI
  3094. LONG
  3095. NTAPI
  3096. KeInsertQueue (
  3097.     IN PRKQUEUE     Queue,
  3098.     IN PLIST_ENTRY  Entry
  3099. );
  3100.  
  3101. NTKERNELAPI
  3102. VOID
  3103. NTAPI
  3104. KeInsertQueueApc (
  3105.     IN PKAPC    Apc,
  3106.     IN PVOID    SystemArgument1,
  3107.     IN PVOID    SystemArgument2,
  3108.     UCHAR       Unknown
  3109. );
  3110.  
  3111. NTKERNELAPI
  3112. LONG
  3113. NTAPI
  3114. KeReadStateQueue (
  3115.     IN PRKQUEUE Queue
  3116. );
  3117.  
  3118. NTKERNELAPI
  3119. PLIST_ENTRY
  3120. NTAPI
  3121. KeRemoveQueue (
  3122.     IN PRKQUEUE         Queue,
  3123.     IN KPROCESSOR_MODE  WaitMode,
  3124.     IN PLARGE_INTEGER   Timeout OPTIONAL
  3125. );
  3126.  
  3127. NTKERNELAPI
  3128. PLIST_ENTRY
  3129. NTAPI
  3130. KeRundownQueue (
  3131.     IN PRKQUEUE Queue
  3132. );
  3133.  
  3134. #if (VER_PRODUCTBUILD >= 2195)
  3135.  
  3136. NTKERNELAPI
  3137. VOID
  3138. NTAPI
  3139. KeStackAttachProcess (
  3140.     IN PKPROCESS    Process,
  3141.     OUT PKAPC_STATE ApcState
  3142. );
  3143.  
  3144. NTKERNELAPI
  3145. VOID
  3146. NTAPI
  3147. KeUnstackDetachProcess (
  3148.     IN PKAPC_STATE ApcState
  3149. );
  3150.  
  3151. #endif // (VER_PRODUCTBUILD >= 2195)
  3152.  
  3153. NTKERNELAPI
  3154. BOOLEAN
  3155. NTAPI
  3156. MmCanFileBeTruncated (
  3157.     IN PSECTION_OBJECT_POINTERS     SectionObjectPointer,
  3158.     IN PLARGE_INTEGER               NewFileSize
  3159. );
  3160.  
  3161. NTKERNELAPI
  3162. BOOLEAN
  3163. NTAPI
  3164. MmFlushImageSection (
  3165.     IN PSECTION_OBJECT_POINTERS     SectionObjectPointer,
  3166.     IN MMFLUSH_TYPE                 FlushType
  3167. );
  3168.  
  3169. NTKERNELAPI
  3170. BOOLEAN
  3171. NTAPI
  3172. MmForceSectionClosed (
  3173.     IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
  3174.     IN BOOLEAN                  DelayClose
  3175. );
  3176.  
  3177. #if (VER_PRODUCTBUILD >= 1381)
  3178.  
  3179. NTKERNELAPI
  3180. BOOLEAN
  3181. NTAPI
  3182. MmIsRecursiveIoFault (
  3183.     VOID
  3184. );
  3185.  
  3186. #else
  3187.  
  3188. #define MmIsRecursiveIoFault() (                            \
  3189.     (PsGetCurrentThread()->DisablePageFaultClustering) |    \
  3190.     (PsGetCurrentThread()->ForwardClusterOnly)              \
  3191. )
  3192.  
  3193. #endif
  3194.  
  3195. NTKERNELAPI
  3196. NTSTATUS
  3197. NTAPI
  3198. MmMapViewOfSection (
  3199.     IN PVOID                SectionObject,
  3200.     IN PEPROCESS            Process,
  3201.     IN OUT PVOID            *BaseAddress,
  3202.     IN ULONG                ZeroBits,
  3203.     IN ULONG                CommitSize,
  3204.     IN OUT PLARGE_INTEGER   SectionOffset OPTIONAL,
  3205.     IN OUT PULONG           ViewSize,
  3206.     IN SECTION_INHERIT      InheritDisposition,
  3207.     IN ULONG                AllocationType,
  3208.     IN ULONG                Protect
  3209. );
  3210.  
  3211. NTKERNELAPI
  3212. BOOLEAN
  3213. NTAPI
  3214. MmSetAddressRangeModified (
  3215.     IN PVOID    Address,
  3216.     IN ULONG    Length
  3217. );
  3218.  
  3219. NTKERNELAPI
  3220. NTSTATUS
  3221. NTAPI
  3222. ObCreateObject (
  3223.     IN KPROCESSOR_MODE      ObjectAttributesAccessMode OPTIONAL,
  3224.     IN POBJECT_TYPE         ObjectType,
  3225.     IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
  3226.     IN KPROCESSOR_MODE      AccessMode,
  3227.     IN OUT PVOID            ParseContext OPTIONAL,
  3228.     IN ULONG                ObjectSize,
  3229.     IN ULONG                PagedPoolCharge OPTIONAL,
  3230.     IN ULONG                NonPagedPoolCharge OPTIONAL,
  3231.     OUT PVOID               *Object
  3232. );
  3233.  
  3234. NTKERNELAPI
  3235. ULONG
  3236. NTAPI
  3237. ObGetObjectPointerCount (
  3238.     IN PVOID Object
  3239. );
  3240.  
  3241. NTKERNELAPI
  3242. NTSTATUS
  3243. NTAPI
  3244. ObInsertObject (
  3245.     IN PVOID            Object,
  3246.     IN PACCESS_STATE    PassedAccessState OPTIONAL,
  3247.     IN ACCESS_MASK      DesiredAccess,
  3248.     IN ULONG            AdditionalReferences,
  3249.     OUT PVOID           *ReferencedObject OPTIONAL,
  3250.     OUT PHANDLE         Handle
  3251. );
  3252.  
  3253. NTKERNELAPI
  3254. VOID
  3255. NTAPI
  3256. ObMakeTemporaryObject (
  3257.     IN PVOID Object
  3258. );
  3259.  
  3260. NTKERNELAPI
  3261. NTSTATUS
  3262. NTAPI
  3263. ObOpenObjectByPointer (
  3264.     IN PVOID            Object,
  3265.     IN ULONG            HandleAttributes,
  3266.     IN PACCESS_STATE    PassedAccessState OPTIONAL,
  3267.     IN ACCESS_MASK      DesiredAccess OPTIONAL,
  3268.     IN POBJECT_TYPE     ObjectType OPTIONAL,
  3269.     IN KPROCESSOR_MODE  AccessMode,
  3270.     OUT PHANDLE         Handle
  3271. );
  3272.  
  3273. NTKERNELAPI
  3274. NTSTATUS
  3275. NTAPI
  3276. ObQueryNameString (
  3277.     IN PVOID                        Object,
  3278.     OUT POBJECT_NAME_INFORMATION    ObjectNameInfo,
  3279.     IN ULONG                        Length,
  3280.     OUT PULONG                      ReturnLength
  3281. );
  3282.  
  3283. NTKERNELAPI
  3284. NTSTATUS
  3285. NTAPI
  3286. ObQueryObjectAuditingByHandle (
  3287.     IN HANDLE       Handle,
  3288.     OUT PBOOLEAN    GenerateOnClose
  3289. );
  3290.  
  3291. NTKERNELAPI
  3292. NTSTATUS
  3293. NTAPI
  3294. ObReferenceObjectByName (
  3295.     IN PUNICODE_STRING  ObjectName,
  3296.     IN ULONG            Attributes,
  3297.     IN PACCESS_STATE    PassedAccessState OPTIONAL,
  3298.     IN ACCESS_MASK      DesiredAccess OPTIONAL,
  3299.     IN POBJECT_TYPE     ObjectType,
  3300.     IN KPROCESSOR_MODE  AccessMode,
  3301.     IN OUT PVOID        ParseContext OPTIONAL,
  3302.     OUT PVOID           *Object
  3303. );
  3304.  
  3305. NTKERNELAPI
  3306. VOID
  3307. NTAPI
  3308. PsChargePoolQuota (
  3309.     IN PEPROCESS    Process,
  3310.     IN POOL_TYPE    PoolType,
  3311.     IN ULONG        Amount
  3312. );
  3313.  
  3314. #define PsDereferenceImpersonationToken(T)  \
  3315.             {if (ARGUMENT_PRESENT(T)) {     \
  3316.                 (ObDereferenceObject((T))); \
  3317.             } else {                        \
  3318.                 ;                           \
  3319.             }                               \
  3320. }
  3321.  
  3322. #define PsDereferencePrimaryToken(T) (ObDereferenceObject((T)))
  3323.  
  3324. NTKERNELAPI
  3325. ULONGLONG
  3326. NTAPI
  3327. PsGetProcessExitTime (
  3328.     VOID
  3329. );
  3330.  
  3331. NTKERNELAPI
  3332. BOOLEAN
  3333. NTAPI
  3334. PsIsThreadTerminating (
  3335.     IN PETHREAD Thread
  3336. );
  3337.  
  3338. NTKERNELAPI
  3339. NTSTATUS
  3340. NTAPI
  3341. PsLookupProcessByProcessId (
  3342.     IN PVOID        ProcessId,
  3343.     OUT PEPROCESS   *Process
  3344. );
  3345.  
  3346. NTKERNELAPI
  3347. NTSTATUS
  3348. NTAPI
  3349. PsLookupProcessThreadByCid (
  3350.     IN PCLIENT_ID   Cid,
  3351.     OUT PEPROCESS   *Process OPTIONAL,
  3352.     OUT PETHREAD    *Thread
  3353. );
  3354.  
  3355. NTKERNELAPI
  3356. NTSTATUS
  3357. NTAPI
  3358. PsLookupThreadByThreadId (
  3359.     IN PVOID        UniqueThreadId,
  3360.     OUT PETHREAD    *Thread
  3361. );
  3362.  
  3363. NTKERNELAPI
  3364. PACCESS_TOKEN
  3365. NTAPI
  3366. PsReferenceImpersonationToken (
  3367.     IN PETHREAD                         Thread,
  3368.     OUT PBOOLEAN                        CopyOnUse,
  3369.     OUT PBOOLEAN                        EffectiveOnly,
  3370.     OUT PSECURITY_IMPERSONATION_LEVEL   Level
  3371. );
  3372.  
  3373. NTKERNELAPI
  3374. HANDLE
  3375. NTAPI
  3376. PsReferencePrimaryToken (
  3377.     IN PEPROCESS Process
  3378. );
  3379.  
  3380. NTKERNELAPI
  3381. VOID
  3382. NTAPI
  3383. PsReturnPoolQuota (
  3384.     IN PEPROCESS    Process,
  3385.     IN POOL_TYPE    PoolType,
  3386.     IN ULONG        Amount
  3387. );
  3388.  
  3389. NTKERNELAPI
  3390. VOID
  3391. NTAPI
  3392. PsRevertToSelf (
  3393.     VOID
  3394. );
  3395.  
  3396. NTSYSAPI
  3397. NTSTATUS
  3398. NTAPI
  3399. RtlAbsoluteToSelfRelativeSD (
  3400.     IN PSECURITY_DESCRIPTOR     AbsoluteSecurityDescriptor,
  3401.     IN OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor,
  3402.     IN PULONG                   BufferLength
  3403. );
  3404.  
  3405. NTSYSAPI
  3406. PVOID
  3407. NTAPI
  3408. RtlAllocateHeap (
  3409.     IN HANDLE  HeapHandle,
  3410.     IN ULONG   Flags,
  3411.     IN ULONG   Size
  3412. );
  3413.  
  3414. NTSYSAPI
  3415. NTSTATUS
  3416. NTAPI
  3417. RtlCompressBuffer (
  3418.     IN USHORT   CompressionFormatAndEngine,
  3419.     IN PUCHAR   UncompressedBuffer,
  3420.     IN ULONG    UncompressedBufferSize,
  3421.     OUT PUCHAR  CompressedBuffer,
  3422.     IN ULONG    CompressedBufferSize,
  3423.     IN ULONG    UncompressedChunkSize,
  3424.     OUT PULONG  FinalCompressedSize,
  3425.     IN PVOID    WorkSpace
  3426. );
  3427.  
  3428. NTSYSAPI
  3429. NTSTATUS
  3430. NTAPI
  3431. RtlCompressChunks (
  3432.     IN PUCHAR                       UncompressedBuffer,
  3433.     IN ULONG                        UncompressedBufferSize,
  3434.     OUT PUCHAR                      CompressedBuffer,
  3435.     IN ULONG                        CompressedBufferSize,
  3436.     IN OUT PCOMPRESSED_DATA_INFO    CompressedDataInfo,
  3437.     IN ULONG                        CompressedDataInfoLength,
  3438.     IN PVOID                        WorkSpace
  3439. );
  3440.  
  3441. NTSYSAPI
  3442. NTSTATUS
  3443. NTAPI
  3444. RtlConvertSidToUnicodeString (
  3445.     OUT PUNICODE_STRING DestinationString,
  3446.     IN PSID             Sid,
  3447.     IN BOOLEAN          AllocateDestinationString
  3448. );
  3449.  
  3450. NTSYSAPI
  3451. NTSTATUS
  3452. NTAPI
  3453. RtlCopySid (
  3454.     IN ULONG   Length,
  3455.     IN PSID    Destination,
  3456.     IN PSID    Source
  3457. );
  3458.  
  3459. NTSYSAPI
  3460. NTSTATUS
  3461. NTAPI
  3462. RtlDecompressBuffer (
  3463.     IN USHORT   CompressionFormat,
  3464.     OUT PUCHAR  UncompressedBuffer,
  3465.     IN ULONG    UncompressedBufferSize,
  3466.     IN PUCHAR   CompressedBuffer,
  3467.     IN ULONG    CompressedBufferSize,
  3468.     OUT PULONG  FinalUncompressedSize
  3469. );
  3470.  
  3471. NTSYSAPI
  3472. NTSTATUS
  3473. NTAPI
  3474. RtlDecompressChunks (
  3475.     OUT PUCHAR                  UncompressedBuffer,
  3476.     IN ULONG                    UncompressedBufferSize,
  3477.     IN PUCHAR                   CompressedBuffer,
  3478.     IN ULONG                    CompressedBufferSize,
  3479.     IN PUCHAR                   CompressedTail,
  3480.     IN ULONG                    CompressedTailSize,
  3481.     IN PCOMPRESSED_DATA_INFO    CompressedDataInfo
  3482. );
  3483.  
  3484. NTSYSAPI
  3485. NTSTATUS
  3486. NTAPI
  3487. RtlDecompressFragment (
  3488.     IN USHORT   CompressionFormat,
  3489.     OUT PUCHAR  UncompressedFragment,
  3490.     IN ULONG    UncompressedFragmentSize,
  3491.     IN PUCHAR   CompressedBuffer,
  3492.     IN ULONG    CompressedBufferSize,
  3493.     IN ULONG    FragmentOffset,
  3494.     OUT PULONG  FinalUncompressedSize,
  3495.     IN PVOID    WorkSpace
  3496. );
  3497.  
  3498. NTSYSAPI
  3499. NTSTATUS
  3500. NTAPI
  3501. RtlDescribeChunk (
  3502.     IN USHORT       CompressionFormat,
  3503.     IN OUT PUCHAR   *CompressedBuffer,
  3504.     IN PUCHAR       EndOfCompressedBufferPlus1,
  3505.     OUT PUCHAR      *ChunkBuffer,
  3506.     OUT PULONG      ChunkSize
  3507. );
  3508.  
  3509. NTSYSAPI
  3510. BOOLEAN
  3511. NTAPI
  3512. RtlEqualSid (
  3513.     IN PSID Sid1,
  3514.     IN PSID Sid2
  3515. );
  3516.  
  3517. NTSYSAPI
  3518. VOID
  3519. NTAPI
  3520. RtlFillMemoryUlong (
  3521.     IN PVOID    Destination,
  3522.     IN ULONG    Length,
  3523.     IN ULONG    Fill
  3524. );
  3525.  
  3526. NTSYSAPI
  3527. BOOLEAN
  3528. NTAPI
  3529. RtlFreeHeap (
  3530.     IN HANDLE  HeapHandle,
  3531.     IN ULONG   Flags,
  3532.     IN PVOID   P
  3533. );
  3534.  
  3535. NTSYSAPI
  3536. VOID
  3537. NTAPI
  3538. RtlGenerate8dot3Name (
  3539.     IN PUNICODE_STRING              Name,
  3540.     IN BOOLEAN                      AllowExtendedCharacters,
  3541.     IN OUT PGENERATE_NAME_CONTEXT   Context,
  3542.     OUT PUNICODE_STRING             Name8dot3
  3543. );
  3544.  
  3545. NTSYSAPI
  3546. NTSTATUS
  3547. NTAPI
  3548. RtlGetCompressionWorkSpaceSize (
  3549.     IN USHORT   CompressionFormatAndEngine,
  3550.     OUT PULONG  CompressBufferWorkSpaceSize,
  3551.     OUT PULONG  CompressFragmentWorkSpaceSize
  3552. );
  3553.  
  3554. NTSYSAPI
  3555. NTSTATUS
  3556. NTAPI
  3557. RtlGetDaclSecurityDescriptor (
  3558.     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
  3559.     OUT PBOOLEAN            DaclPresent,
  3560.     OUT PACL                *Dacl,
  3561.     OUT PBOOLEAN            DaclDefaulted
  3562. );
  3563.  
  3564. NTSYSAPI
  3565. NTSTATUS
  3566. NTAPI
  3567. RtlGetGroupSecurityDescriptor (
  3568.     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
  3569.     OUT PSID                *Group,
  3570.     OUT PBOOLEAN            GroupDefaulted
  3571. );
  3572.  
  3573. NTSYSAPI
  3574. NTSTATUS
  3575. NTAPI
  3576. RtlGetOwnerSecurityDescriptor (
  3577.     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
  3578.     OUT PSID                *Owner,
  3579.     OUT PBOOLEAN            OwnerDefaulted
  3580. );
  3581.  
  3582. NTSYSAPI
  3583. NTSTATUS
  3584. NTAPI
  3585. RtlInitializeSid (
  3586.     IN OUT PSID                     Sid,
  3587.     IN PSID_IDENTIFIER_AUTHORITY    IdentifierAuthority,
  3588.     IN UCHAR                        SubAuthorityCount
  3589. );
  3590.  
  3591. NTSYSAPI
  3592. BOOLEAN
  3593. NTAPI
  3594. RtlIsNameLegalDOS8Dot3 (
  3595.     IN PUNICODE_STRING UnicodeName,
  3596.     IN PANSI_STRING    AnsiName,
  3597.     PBOOLEAN           Unknown
  3598. );
  3599.  
  3600. NTSYSAPI
  3601. ULONG
  3602. NTAPI
  3603. RtlLengthRequiredSid (
  3604.     IN UCHAR SubAuthorityCount
  3605. );
  3606.  
  3607. NTSYSAPI
  3608. ULONG
  3609. NTAPI
  3610. RtlLengthSid (
  3611.     IN PSID Sid
  3612. );
  3613.  
  3614. NTSYSAPI
  3615. ULONG
  3616. NTAPI
  3617. RtlNtStatusToDosError (
  3618.     IN NTSTATUS Status
  3619. );
  3620.  
  3621. NTSYSAPI
  3622. NTSTATUS
  3623. NTAPI
  3624. RtlReserveChunk (
  3625.     IN USHORT       CompressionFormat,
  3626.     IN OUT PUCHAR   *CompressedBuffer,
  3627.     IN PUCHAR       EndOfCompressedBufferPlus1,
  3628.     OUT PUCHAR      *ChunkBuffer,
  3629.     IN ULONG        ChunkSize
  3630. );
  3631.  
  3632. NTSYSAPI
  3633. VOID
  3634. NTAPI
  3635. RtlSecondsSince1970ToTime (
  3636.     IN ULONG            SecondsSince1970,
  3637.     OUT PLARGE_INTEGER  Time
  3638. );
  3639.  
  3640. #if (VER_PRODUCTBUILD >= 2195)
  3641.  
  3642. NTSYSAPI
  3643. NTSTATUS
  3644. NTAPI
  3645. RtlSelfRelativeToAbsoluteSD (
  3646.     IN PSECURITY_DESCRIPTOR     SelfRelativeSD,
  3647.     OUT PSECURITY_DESCRIPTOR    AbsoluteSD,
  3648.     IN PULONG                   AbsoluteSDSize,
  3649.     IN PACL                     Dacl,
  3650.     IN PULONG                   DaclSize,
  3651.     IN PACL                     Sacl,
  3652.     IN PULONG                   SaclSize,
  3653.     IN PSID                     Owner,
  3654.     IN PULONG                   OwnerSize,
  3655.     IN PSID                     PrimaryGroup,
  3656.     IN PULONG                   PrimaryGroupSize
  3657. );
  3658.  
  3659. #endif // (VER_PRODUCTBUILD >= 2195)
  3660.  
  3661. NTSYSAPI
  3662. NTSTATUS
  3663. NTAPI
  3664. RtlSetGroupSecurityDescriptor (
  3665.     IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
  3666.     IN PSID                     Group,
  3667.     IN BOOLEAN                  GroupDefaulted
  3668. );
  3669.  
  3670. NTSYSAPI
  3671. NTSTATUS
  3672. NTAPI
  3673. RtlSetOwnerSecurityDescriptor (
  3674.     IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
  3675.     IN PSID                     Owner,
  3676.     IN BOOLEAN                  OwnerDefaulted
  3677. );
  3678.  
  3679. NTSYSAPI
  3680. NTSTATUS
  3681. NTAPI
  3682. RtlSetSaclSecurityDescriptor (
  3683.     IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
  3684.     IN BOOLEAN                  SaclPresent,
  3685.     IN PACL                     Sacl,
  3686.     IN BOOLEAN                  SaclDefaulted
  3687. );
  3688.  
  3689. NTSYSAPI
  3690. PUCHAR
  3691. NTAPI
  3692. RtlSubAuthorityCountSid (
  3693.     IN PSID Sid
  3694. );
  3695.  
  3696. NTSYSAPI
  3697. PULONG
  3698. NTAPI
  3699. RtlSubAuthoritySid (
  3700.     IN PSID    Sid,
  3701.     IN ULONG   SubAuthority
  3702. );
  3703.  
  3704. NTSYSAPI
  3705. BOOLEAN
  3706. NTAPI
  3707. RtlValidSid (
  3708.     IN PSID Sid
  3709. );
  3710.  
  3711. NTKERNELAPI
  3712. NTSTATUS
  3713. NTAPI
  3714. SeAppendPrivileges (
  3715.     PACCESS_STATE   AccessState,
  3716.     PPRIVILEGE_SET  Privileges
  3717. );
  3718.  
  3719. NTKERNELAPI
  3720. BOOLEAN
  3721. NTAPI
  3722. SeAuditingFileEvents (
  3723.     IN BOOLEAN              AccessGranted,
  3724.     IN PSECURITY_DESCRIPTOR SecurityDescriptor
  3725. );
  3726.  
  3727. NTKERNELAPI
  3728. BOOLEAN
  3729. NTAPI
  3730. SeAuditingFileOrGlobalEvents (
  3731.     IN BOOLEAN                      AccessGranted,
  3732.     IN PSECURITY_DESCRIPTOR         SecurityDescriptor,
  3733.     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext
  3734. );
  3735.  
  3736. NTKERNELAPI
  3737. VOID
  3738. NTAPI
  3739. SeCaptureSubjectContext (
  3740.     OUT PSECURITY_SUBJECT_CONTEXT SubjectContext
  3741. );
  3742.  
  3743. NTKERNELAPI
  3744. NTSTATUS
  3745. NTAPI
  3746. SeCreateAccessState (
  3747.     OUT PACCESS_STATE   AccessState,
  3748.     IN PVOID            AuxData,
  3749.     IN ACCESS_MASK      AccessMask,
  3750.     IN PGENERIC_MAPPING Mapping
  3751. );
  3752.  
  3753. NTKERNELAPI
  3754. NTSTATUS
  3755. NTAPI
  3756. SeCreateClientSecurity (
  3757.     IN PETHREAD                     Thread,
  3758.     IN PSECURITY_QUALITY_OF_SERVICE QualityOfService,
  3759.     IN BOOLEAN                      RemoteClient,
  3760.     OUT PSECURITY_CLIENT_CONTEXT    ClientContext
  3761. );
  3762.  
  3763. #if (VER_PRODUCTBUILD >= 2195)
  3764.  
  3765. NTKERNELAPI
  3766. NTSTATUS
  3767. NTAPI
  3768. SeCreateClientSecurityFromSubjectContext (
  3769.     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext,
  3770.     IN PSECURITY_QUALITY_OF_SERVICE QualityOfService,
  3771.     IN BOOLEAN                      ServerIsRemote,
  3772.     OUT PSECURITY_CLIENT_CONTEXT    ClientContext
  3773. );
  3774.  
  3775. #endif // (VER_PRODUCTBUILD >= 2195)
  3776.  
  3777. #define SeDeleteClientSecurity(C)  {                                           \
  3778.             if (SeTokenType((C)->ClientToken) == TokenPrimary) {               \
  3779.                 PsDereferencePrimaryToken( (C)->ClientToken );                 \
  3780.             } else {                                                           \
  3781.                 PsDereferenceImpersonationToken( (C)->ClientToken );           \
  3782.             }                                                                  \
  3783. }
  3784.  
  3785. NTKERNELAPI
  3786. VOID
  3787. NTAPI
  3788. SeDeleteObjectAuditAlarm (
  3789.     IN PVOID    Object,
  3790.     IN HANDLE   Handle
  3791. );
  3792.  
  3793. #define SeEnableAccessToExports() SeExports = *(PSE_EXPORTS *)SeExports;
  3794.  
  3795. NTKERNELAPI
  3796. VOID
  3797. NTAPI
  3798. SeFreePrivileges (
  3799.     IN PPRIVILEGE_SET Privileges
  3800. );
  3801.  
  3802. NTKERNELAPI
  3803. VOID
  3804. NTAPI
  3805. SeImpersonateClient (
  3806.     IN PSECURITY_CLIENT_CONTEXT ClientContext,
  3807.     IN PETHREAD                 ServerThread OPTIONAL
  3808. );
  3809.  
  3810. #if (VER_PRODUCTBUILD >= 2195)
  3811.  
  3812. NTKERNELAPI
  3813. NTSTATUS
  3814. NTAPI
  3815. SeImpersonateClientEx (
  3816.     IN PSECURITY_CLIENT_CONTEXT ClientContext,
  3817.     IN PETHREAD                 ServerThread OPTIONAL
  3818. );
  3819.  
  3820. #endif // (VER_PRODUCTBUILD >= 2195)
  3821.  
  3822. NTKERNELAPI
  3823. VOID
  3824. NTAPI
  3825. SeLockSubjectContext (
  3826.     IN PSECURITY_SUBJECT_CONTEXT SubjectContext
  3827. );
  3828.  
  3829. NTKERNELAPI
  3830. NTSTATUS
  3831. NTAPI
  3832. SeMarkLogonSessionForTerminationNotification (
  3833.     IN PLUID LogonId
  3834. );
  3835.  
  3836. NTKERNELAPI
  3837. VOID
  3838. NTAPI
  3839. SeOpenObjectAuditAlarm (
  3840.     IN PUNICODE_STRING      ObjectTypeName,
  3841.     IN PVOID                Object OPTIONAL,
  3842.     IN PUNICODE_STRING      AbsoluteObjectName OPTIONAL,
  3843.     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
  3844.     IN PACCESS_STATE        AccessState,
  3845.     IN BOOLEAN              ObjectCreated,
  3846.     IN BOOLEAN              AccessGranted,
  3847.     IN KPROCESSOR_MODE      AccessMode,
  3848.     OUT PBOOLEAN            GenerateOnClose
  3849. );
  3850.  
  3851. NTKERNELAPI
  3852. VOID
  3853. NTAPI
  3854. SeOpenObjectForDeleteAuditAlarm (
  3855.     IN PUNICODE_STRING      ObjectTypeName,
  3856.     IN PVOID                Object OPTIONAL,
  3857.     IN PUNICODE_STRING      AbsoluteObjectName OPTIONAL,
  3858.     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
  3859.     IN PACCESS_STATE        AccessState,
  3860.     IN BOOLEAN              ObjectCreated,
  3861.     IN BOOLEAN              AccessGranted,
  3862.     IN KPROCESSOR_MODE      AccessMode,
  3863.     OUT PBOOLEAN            GenerateOnClose
  3864. );
  3865.  
  3866. NTKERNELAPI
  3867. BOOLEAN
  3868. NTAPI
  3869. SePrivilegeCheck (
  3870.     IN OUT PPRIVILEGE_SET           RequiredPrivileges,
  3871.     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext,
  3872.     IN KPROCESSOR_MODE              AccessMode
  3873. );
  3874.  
  3875. NTKERNELAPI
  3876. NTSTATUS
  3877. NTAPI
  3878. SeQueryAuthenticationIdToken (
  3879.     IN PACCESS_TOKEN    Token,
  3880.     OUT PLUID           LogonId
  3881. );
  3882.  
  3883. #if (VER_PRODUCTBUILD >= 2195)
  3884.  
  3885. NTKERNELAPI
  3886. NTSTATUS
  3887. NTAPI
  3888. SeQueryInformationToken (
  3889.     IN PACCESS_TOKEN           Token,
  3890.     IN TOKEN_INFORMATION_CLASS TokenInformationClass,
  3891.     OUT PVOID                  *TokenInformation
  3892. );
  3893.  
  3894. #endif // (VER_PRODUCTBUILD >= 2195)
  3895.  
  3896. NTKERNELAPI
  3897. NTSTATUS
  3898. NTAPI
  3899. SeQuerySecurityDescriptorInfo (
  3900.     IN PSECURITY_INFORMATION    SecurityInformation,
  3901.     OUT PSECURITY_DESCRIPTOR    SecurityDescriptor,
  3902.     IN OUT PULONG               Length,
  3903.     IN PSECURITY_DESCRIPTOR     *ObjectsSecurityDescriptor
  3904. );
  3905.  
  3906. #if (VER_PRODUCTBUILD >= 2195)
  3907.  
  3908. NTKERNELAPI
  3909. NTSTATUS
  3910. NTAPI
  3911. SeQuerySessionIdToken (
  3912.     IN PACCESS_TOKEN    Token,
  3913.     IN PULONG           SessionId
  3914. );
  3915.  
  3916. #endif // (VER_PRODUCTBUILD >= 2195)
  3917.  
  3918. #define SeQuerySubjectContextToken( SubjectContext )                \
  3919.     ( ARGUMENT_PRESENT(                                             \
  3920.         ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken   \
  3921.         ) ?                                                         \
  3922.     ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken :     \
  3923.     ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
  3924.  
  3925. typedef NTSTATUS (*PSE_LOGON_SESSION_TERMINATED_ROUTINE) (
  3926.     IN PLUID LogonId
  3927. );
  3928.  
  3929. NTKERNELAPI
  3930. NTSTATUS
  3931. NTAPI
  3932. SeRegisterLogonSessionTerminatedRoutine (
  3933.     IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
  3934. );
  3935.  
  3936. NTKERNELAPI
  3937. VOID
  3938. NTAPI
  3939. SeReleaseSubjectContext (
  3940.     IN PSECURITY_SUBJECT_CONTEXT SubjectContext
  3941. );
  3942.  
  3943. NTKERNELAPI
  3944. VOID
  3945. NTAPI
  3946. SeSetAccessStateGenericMapping (
  3947.     PACCESS_STATE       AccessState,
  3948.     PGENERIC_MAPPING    GenericMapping
  3949. );
  3950.  
  3951. NTKERNELAPI
  3952. NTSTATUS
  3953. NTAPI
  3954. SeSetSecurityDescriptorInfo (
  3955.     IN PVOID                    Object OPTIONAL,
  3956.     IN PSECURITY_INFORMATION    SecurityInformation,
  3957.     IN PSECURITY_DESCRIPTOR     SecurityDescriptor,
  3958.     IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
  3959.     IN POOL_TYPE                PoolType,
  3960.     IN PGENERIC_MAPPING         GenericMapping
  3961. );
  3962.  
  3963. #if (VER_PRODUCTBUILD >= 2195)
  3964.  
  3965. NTKERNELAPI
  3966. NTSTATUS
  3967. NTAPI
  3968. SeSetSecurityDescriptorInfoEx (
  3969.     IN PVOID                    Object OPTIONAL,
  3970.     IN PSECURITY_INFORMATION    SecurityInformation,
  3971.     IN PSECURITY_DESCRIPTOR     ModificationDescriptor,
  3972.     IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
  3973.     IN ULONG                    AutoInheritFlags,
  3974.     IN POOL_TYPE                PoolType,
  3975.     IN PGENERIC_MAPPING         GenericMapping
  3976. );
  3977.  
  3978. NTKERNELAPI
  3979. BOOLEAN
  3980. NTAPI
  3981. SeTokenIsAdmin (
  3982.     IN PACCESS_TOKEN Token
  3983. );
  3984.  
  3985. NTKERNELAPI
  3986. BOOLEAN
  3987. NTAPI
  3988. SeTokenIsRestricted (
  3989.     IN PACCESS_TOKEN Token
  3990. );
  3991.  
  3992. #endif // (VER_PRODUCTBUILD >= 2195)
  3993.  
  3994. NTKERNELAPI
  3995. TOKEN_TYPE
  3996. NTAPI
  3997. SeTokenType (
  3998.     IN PACCESS_TOKEN Token
  3999. );
  4000.  
  4001. NTKERNELAPI
  4002. VOID
  4003. NTAPI
  4004. SeUnlockSubjectContext (
  4005.     IN PSECURITY_SUBJECT_CONTEXT SubjectContext
  4006. );
  4007.  
  4008. NTKERNELAPI
  4009. NTSTATUS
  4010. SeUnregisterLogonSessionTerminatedRoutine (
  4011.     IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
  4012. );
  4013.  
  4014. #if (VER_PRODUCTBUILD >= 2195)
  4015.  
  4016. NTSYSAPI
  4017. NTSTATUS
  4018. NTAPI
  4019. ZwAdjustPrivilegesToken (
  4020.     IN HANDLE               TokenHandle,
  4021.     IN BOOLEAN              DisableAllPrivileges,
  4022.     IN PTOKEN_PRIVILEGES    NewState,
  4023.     IN ULONG                BufferLength,
  4024.     OUT PTOKEN_PRIVILEGES   PreviousState OPTIONAL,
  4025.     OUT PULONG              ReturnLength
  4026. );
  4027.  
  4028. #endif // (VER_PRODUCTBUILD >= 2195)
  4029.  
  4030. NTSYSAPI
  4031. NTSTATUS
  4032. NTAPI
  4033. ZwAlertThread (
  4034.     IN HANDLE ThreadHandle
  4035. );
  4036.  
  4037. NTSYSAPI
  4038. NTSTATUS
  4039. NTAPI
  4040. ZwAllocateVirtualMemory (
  4041.     IN HANDLE       ProcessHandle,
  4042.     IN OUT PVOID    *BaseAddress,
  4043.     IN ULONG        ZeroBits,
  4044.     IN OUT PULONG   RegionSize,
  4045.     IN ULONG        AllocationType,
  4046.     IN ULONG        Protect
  4047. );
  4048.  
  4049. NTSYSAPI
  4050. NTSTATUS
  4051. NTAPI
  4052. ZwAccessCheckAndAuditAlarm (
  4053.     IN PUNICODE_STRING      SubsystemName,
  4054.     IN PVOID                HandleId,
  4055.     IN PUNICODE_STRING      ObjectTypeName,
  4056.     IN PUNICODE_STRING      ObjectName,
  4057.     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
  4058.     IN ACCESS_MASK          DesiredAccess,
  4059.     IN PGENERIC_MAPPING     GenericMapping,
  4060.     IN BOOLEAN              ObjectCreation,
  4061.     OUT PACCESS_MASK        GrantedAccess,
  4062.     OUT PBOOLEAN            AccessStatus,
  4063.     OUT PBOOLEAN            GenerateOnClose
  4064. );
  4065.  
  4066. #if (VER_PRODUCTBUILD >= 2195)
  4067.  
  4068. NTSYSAPI
  4069. NTSTATUS
  4070. NTAPI
  4071. ZwCancelIoFile (
  4072.     IN HANDLE               FileHandle,
  4073.     OUT PIO_STATUS_BLOCK    IoStatusBlock
  4074. );
  4075.  
  4076. #endif // (VER_PRODUCTBUILD >= 2195)
  4077.  
  4078. NTSYSAPI
  4079. NTSTATUS
  4080. NTAPI
  4081. ZwClearEvent (
  4082.     IN HANDLE EventHandle
  4083. );
  4084.  
  4085. NTSYSAPI
  4086. NTSTATUS
  4087. NTAPI
  4088. ZwCloseObjectAuditAlarm (
  4089.     IN PUNICODE_STRING  SubsystemName,
  4090.     IN PVOID            HandleId,
  4091.     IN BOOLEAN          GenerateOnClose
  4092. );
  4093.  
  4094. NTSYSAPI
  4095. NTSTATUS
  4096. NTAPI
  4097. ZwCreateSection (
  4098.     OUT PHANDLE             SectionHandle,
  4099.     IN ACCESS_MASK          DesiredAccess,
  4100.     IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
  4101.     IN PLARGE_INTEGER       MaximumSize OPTIONAL,
  4102.     IN ULONG                SectionPageProtection,
  4103.     IN ULONG                AllocationAttributes,
  4104.     IN HANDLE               FileHandle OPTIONAL
  4105. );
  4106.  
  4107. NTSYSAPI
  4108. NTSTATUS
  4109. NTAPI
  4110. ZwCreateSymbolicLinkObject (
  4111.     OUT PHANDLE             SymbolicLinkHandle,
  4112.     IN ACCESS_MASK          DesiredAccess,
  4113.     IN POBJECT_ATTRIBUTES   ObjectAttributes,
  4114.     IN PUNICODE_STRING      TargetName
  4115. );
  4116.  
  4117. NTSYSAPI
  4118. NTSTATUS
  4119. NTAPI
  4120. ZwDeleteFile (
  4121.     IN POBJECT_ATTRIBUTES ObjectAttributes
  4122. );
  4123.  
  4124. NTSYSAPI
  4125. NTSTATUS
  4126. NTAPI
  4127. ZwDeleteValueKey (
  4128.     IN HANDLE           Handle,
  4129.     IN PUNICODE_STRING  Name
  4130. );
  4131.  
  4132. NTSYSAPI
  4133. NTSTATUS
  4134. NTAPI
  4135. ZwDeviceIoControlFile (
  4136.     IN HANDLE               FileHandle,
  4137.     IN HANDLE               Event OPTIONAL,
  4138.     IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  4139.     IN PVOID                ApcContext OPTIONAL,
  4140.     OUT PIO_STATUS_BLOCK    IoStatusBlock,
  4141.     IN ULONG                IoControlCode,
  4142.     IN PVOID                InputBuffer OPTIONAL,
  4143.     IN ULONG                InputBufferLength,
  4144.     OUT PVOID               OutputBuffer OPTIONAL,
  4145.     IN ULONG                OutputBufferLength
  4146. );
  4147.  
  4148. NTSYSAPI
  4149. NTSTATUS
  4150. NTAPI
  4151. ZwDisplayString (
  4152.     IN PUNICODE_STRING String
  4153. );
  4154.  
  4155. NTSYSAPI
  4156. NTSTATUS
  4157. NTAPI
  4158. ZwDuplicateObject (
  4159.     IN HANDLE       SourceProcessHandle,
  4160.     IN HANDLE       SourceHandle,
  4161.     IN HANDLE       TargetProcessHandle OPTIONAL,
  4162.     OUT PHANDLE     TargetHandle OPTIONAL,
  4163.     IN ACCESS_MASK  DesiredAccess,
  4164.     IN ULONG        HandleAttributes,
  4165.     IN ULONG        Options
  4166. );
  4167.  
  4168. NTSYSAPI
  4169. NTSTATUS
  4170. NTAPI
  4171. ZwDuplicateToken (
  4172.     IN HANDLE               ExistingTokenHandle,
  4173.     IN ACCESS_MASK          DesiredAccess,
  4174.     IN POBJECT_ATTRIBUTES   ObjectAttributes,
  4175.     IN BOOLEAN              EffectiveOnly,
  4176.     IN TOKEN_TYPE           TokenType,
  4177.     OUT PHANDLE             NewTokenHandle
  4178. );
  4179.  
  4180. NTSYSAPI
  4181. NTSTATUS
  4182. NTAPI
  4183. ZwFlushInstructionCache (
  4184.     IN HANDLE   ProcessHandle,
  4185.     IN PVOID    BaseAddress OPTIONAL,
  4186.     IN ULONG    FlushSize
  4187. );
  4188.  
  4189. #if (VER_PRODUCTBUILD >= 2195)
  4190.  
  4191. NTSYSAPI
  4192. NTSTATUS
  4193. NTAPI
  4194. ZwFlushVirtualMemory (
  4195.     IN HANDLE               ProcessHandle,
  4196.     IN OUT PVOID            *BaseAddress,
  4197.     IN OUT PULONG           FlushSize,
  4198.     OUT PIO_STATUS_BLOCK    IoStatusBlock
  4199. );
  4200.  
  4201. #endif // (VER_PRODUCTBUILD >= 2195)
  4202.  
  4203. NTSYSAPI
  4204. NTSTATUS
  4205. NTAPI
  4206. ZwFreeVirtualMemory (
  4207.     IN HANDLE       ProcessHandle,
  4208.     IN OUT PVOID    *BaseAddress,
  4209.     IN OUT PULONG   RegionSize,
  4210.     IN ULONG        FreeType
  4211. );
  4212.  
  4213. NTSYSAPI
  4214. NTSTATUS
  4215. NTAPI
  4216. ZwFsControlFile (
  4217.     IN HANDLE               FileHandle,
  4218.     IN HANDLE               Event OPTIONAL,
  4219.     IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  4220.     IN PVOID                ApcContext OPTIONAL,
  4221.     OUT PIO_STATUS_BLOCK    IoStatusBlock,
  4222.     IN ULONG                FsControlCode,
  4223.     IN PVOID                InputBuffer OPTIONAL,
  4224.     IN ULONG                InputBufferLength,
  4225.     OUT PVOID               OutputBuffer OPTIONAL,
  4226.     IN ULONG                OutputBufferLength
  4227. );
  4228.  
  4229. #if (VER_PRODUCTBUILD >= 2195)
  4230.  
  4231. NTSYSAPI
  4232. NTSTATUS
  4233. NTAPI
  4234. ZwInitiatePowerAction (
  4235.     IN POWER_ACTION         SystemAction,
  4236.     IN SYSTEM_POWER_STATE   MinSystemState,
  4237.     IN ULONG                Flags,
  4238.     IN BOOLEAN              Asynchronous
  4239. );
  4240.  
  4241. #endif // (VER_PRODUCTBUILD >= 2195)
  4242.  
  4243. NTSYSAPI
  4244. NTSTATUS
  4245. NTAPI
  4246. ZwLoadDriver (
  4247.     // "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>"
  4248.     IN PUNICODE_STRING RegistryPath
  4249. );
  4250.  
  4251. NTSYSAPI
  4252. NTSTATUS
  4253. NTAPI
  4254. ZwLoadKey (
  4255.     IN POBJECT_ATTRIBUTES KeyObjectAttributes,
  4256.     IN POBJECT_ATTRIBUTES FileObjectAttributes
  4257. );
  4258.  
  4259. NTSYSAPI
  4260. NTSTATUS
  4261. NTAPI
  4262. ZwNotifyChangeKey (
  4263.     IN HANDLE               KeyHandle,
  4264.     IN HANDLE               EventHandle OPTIONAL,
  4265.     IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  4266.     IN PVOID                ApcContext OPTIONAL,
  4267.     OUT PIO_STATUS_BLOCK    IoStatusBlock,
  4268.     IN ULONG                NotifyFilter,
  4269.     IN BOOLEAN              WatchSubtree,
  4270.     IN PVOID                Buffer,
  4271.     IN ULONG                BufferLength,
  4272.     IN BOOLEAN              Asynchronous
  4273. );
  4274.  
  4275. NTSYSAPI
  4276. NTSTATUS
  4277. NTAPI
  4278. ZwOpenDirectoryObject (
  4279.     OUT PHANDLE             DirectoryHandle,
  4280.     IN ACCESS_MASK          DesiredAccess,
  4281.     IN POBJECT_ATTRIBUTES   ObjectAttributes
  4282. );
  4283.  
  4284. NTSYSAPI
  4285. NTSTATUS
  4286. NTAPI
  4287. ZwOpenEvent (
  4288.     OUT PHANDLE             EventHandle,
  4289.     IN ACCESS_MASK          DesiredAccess,
  4290.     IN POBJECT_ATTRIBUTES   ObjectAttributes
  4291. );
  4292.  
  4293. NTSYSAPI
  4294. NTSTATUS
  4295. NTAPI
  4296. ZwOpenProcess (
  4297.     OUT PHANDLE             ProcessHandle,
  4298.     IN ACCESS_MASK          DesiredAccess,
  4299.     IN POBJECT_ATTRIBUTES   ObjectAttributes,
  4300.     IN PCLIENT_ID           ClientId OPTIONAL
  4301. );
  4302.  
  4303. NTSYSAPI
  4304. NTSTATUS
  4305. NTAPI
  4306. ZwOpenProcessToken (
  4307.     IN HANDLE       ProcessHandle,
  4308.     IN ACCESS_MASK  DesiredAccess,
  4309.     OUT PHANDLE     TokenHandle
  4310. );
  4311.  
  4312. NTSYSAPI
  4313. NTSTATUS
  4314. NTAPI
  4315. ZwOpenThread (
  4316.     OUT PHANDLE             ThreadHandle,
  4317.     IN ACCESS_MASK          DesiredAccess,
  4318.     IN POBJECT_ATTRIBUTES   ObjectAttributes,
  4319.     IN PCLIENT_ID           ClientId
  4320. );
  4321.  
  4322. NTSYSAPI
  4323. NTSTATUS
  4324. NTAPI
  4325. ZwOpenThreadToken (
  4326.     IN HANDLE       ThreadHandle,
  4327.     IN ACCESS_MASK  DesiredAccess,
  4328.     IN BOOLEAN      OpenAsSelf,
  4329.     OUT PHANDLE     TokenHandle
  4330. );
  4331.  
  4332. #if (VER_PRODUCTBUILD >= 2195)
  4333.  
  4334. NTSYSAPI
  4335. NTSTATUS
  4336. NTAPI
  4337. ZwPowerInformation (
  4338.     IN POWER_INFORMATION_LEVEL  PowerInformationLevel,
  4339.     IN PVOID                    InputBuffer OPTIONAL,
  4340.     IN ULONG                    InputBufferLength,
  4341.     OUT PVOID                   OutputBuffer OPTIONAL,
  4342.     IN ULONG                    OutputBufferLength
  4343. );
  4344.  
  4345. #endif // (VER_PRODUCTBUILD >= 2195)
  4346.  
  4347. NTSYSAPI
  4348. NTSTATUS
  4349. NTAPI
  4350. ZwPulseEvent (
  4351.     IN HANDLE   EventHandle,
  4352.     OUT PULONG  PreviousState OPTIONAL
  4353. );
  4354.  
  4355. NTSYSAPI
  4356. NTSTATUS
  4357. NTAPI
  4358. ZwQueryDefaultLocale (
  4359.     IN BOOLEAN  ThreadOrSystem,
  4360.     OUT PLCID   Locale
  4361. );
  4362.  
  4363. NTSYSAPI
  4364. NTSTATUS
  4365. NTAPI
  4366. ZwQueryDirectoryFile (
  4367.     IN HANDLE                   FileHandle,
  4368.     IN HANDLE                   Event OPTIONAL,
  4369.     IN PIO_APC_ROUTINE          ApcRoutine OPTIONAL,
  4370.     IN PVOID                    ApcContext OPTIONAL,
  4371.     OUT PIO_STATUS_BLOCK        IoStatusBlock,
  4372.     OUT PVOID                   FileInformation,
  4373.     IN ULONG                    Length,
  4374.     IN FILE_INFORMATION_CLASS   FileInformationClass,
  4375.     IN BOOLEAN                  ReturnSingleEntry,
  4376.     IN PUNICODE_STRING          FileName OPTIONAL,
  4377.     IN BOOLEAN                  RestartScan
  4378. );
  4379.  
  4380. #if (VER_PRODUCTBUILD >= 2195)
  4381.  
  4382. NTSYSAPI
  4383. NTSTATUS
  4384. NTAPI
  4385. ZwQueryDirectoryObject (
  4386.     IN HANDLE       DirectoryHandle,
  4387.     OUT PVOID       Buffer,
  4388.     IN ULONG        Length,
  4389.     IN BOOLEAN      ReturnSingleEntry,
  4390.     IN BOOLEAN      RestartScan,
  4391.     IN OUT PULONG   Context,
  4392.     OUT PULONG      ReturnLength OPTIONAL
  4393. );
  4394.  
  4395. NTSYSAPI
  4396. NTSTATUS
  4397. NTAPI
  4398. ZwQueryEaFile (
  4399.     IN HANDLE               FileHandle,
  4400.     OUT PIO_STATUS_BLOCK    IoStatusBlock,
  4401.     OUT PVOID               Buffer,
  4402.     IN ULONG                Length,
  4403.     IN BOOLEAN              ReturnSingleEntry,
  4404.     IN PVOID                EaList OPTIONAL,
  4405.     IN ULONG                EaListLength,
  4406.     IN PULONG               EaIndex OPTIONAL,
  4407.     IN BOOLEAN              RestartScan
  4408. );
  4409.  
  4410. #endif // (VER_PRODUCTBUILD >= 2195)
  4411.  
  4412. NTSYSAPI
  4413. NTSTATUS
  4414. NTAPI
  4415. ZwQueryInformationProcess (
  4416.     IN HANDLE           ProcessHandle,
  4417.     IN PROCESSINFOCLASS ProcessInformationClass,
  4418.     OUT PVOID           ProcessInformation,
  4419.     IN ULONG            ProcessInformationLength,
  4420.     OUT PULONG          ReturnLength OPTIONAL
  4421. );
  4422.  
  4423. NTSYSAPI
  4424. NTSTATUS
  4425. NTAPI
  4426. ZwQueryInformationToken (
  4427.     IN HANDLE                   TokenHandle,
  4428.     IN TOKEN_INFORMATION_CLASS  TokenInformationClass,
  4429.     OUT PVOID                   TokenInformation,
  4430.     IN ULONG                    Length,
  4431.     OUT PULONG                  ResultLength
  4432. );
  4433.  
  4434. NTSYSAPI
  4435. NTSTATUS
  4436. NTAPI
  4437. ZwQueryObject (
  4438.     IN HANDLE               ObjectHandle,
  4439.     IN OBJECT_INFO_CLASS    ObjectInformationClass,
  4440.     OUT PVOID               ObjectInformation,
  4441.     IN ULONG                Length,
  4442.     OUT PULONG              ResultLength
  4443. );
  4444.  
  4445. NTSYSAPI
  4446. NTSTATUS
  4447. NTAPI
  4448. ZwQuerySection (
  4449.     IN HANDLE                       SectionHandle,
  4450.     IN SECTION_INFORMATION_CLASS    SectionInformationClass,
  4451.     OUT PVOID                       SectionInformation,
  4452.     IN ULONG                        SectionInformationLength,
  4453.     OUT PULONG                      ResultLength OPTIONAL
  4454. );
  4455.  
  4456. NTSYSAPI
  4457. NTSTATUS
  4458. NTAPI
  4459. ZwQuerySecurityObject (
  4460.     IN HANDLE                   FileHandle,
  4461.     IN SECURITY_INFORMATION     SecurityInformation,
  4462.     OUT PSECURITY_DESCRIPTOR    SecurityDescriptor,
  4463.     IN ULONG                    Length,
  4464.     OUT PULONG                  ResultLength
  4465. );
  4466.  
  4467. NTSYSAPI
  4468. NTSTATUS
  4469. NTAPI
  4470. ZwQuerySystemInformation (
  4471.     IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
  4472.     OUT PVOID                   SystemInformation,
  4473.     IN ULONG                    Length,
  4474.     OUT PULONG                  ReturnLength
  4475. );
  4476.  
  4477. NTSYSAPI
  4478. NTSTATUS
  4479. NTAPI
  4480. ZwQueryVolumeInformationFile (
  4481.     IN HANDLE               FileHandle,
  4482.     OUT PIO_STATUS_BLOCK    IoStatusBlock,
  4483.     OUT PVOID               FsInformation,
  4484.     IN ULONG                Length,
  4485.     IN FS_INFORMATION_CLASS FsInformationClass
  4486. );
  4487.  
  4488. NTSYSAPI
  4489. NTSTATUS
  4490. NTAPI
  4491. ZwReplaceKey (
  4492.     IN POBJECT_ATTRIBUTES   NewFileObjectAttributes,
  4493.     IN HANDLE               KeyHandle,
  4494.     IN POBJECT_ATTRIBUTES   OldFileObjectAttributes
  4495. );
  4496.  
  4497. NTSYSAPI
  4498. NTSTATUS
  4499. NTAPI
  4500. ZwResetEvent (
  4501.     IN HANDLE   EventHandle,
  4502.     OUT PULONG  PreviousState OPTIONAL
  4503. );
  4504.  
  4505. #if (VER_PRODUCTBUILD >= 2195)
  4506.  
  4507. NTSYSAPI
  4508. NTSTATUS
  4509. NTAPI
  4510. ZwRestoreKey (
  4511.     IN HANDLE   KeyHandle,
  4512.     IN HANDLE   FileHandle,
  4513.     IN ULONG    Flags
  4514. );
  4515.  
  4516. #endif // (VER_PRODUCTBUILD >= 2195)
  4517.  
  4518. NTSYSAPI
  4519. NTSTATUS
  4520. NTAPI
  4521. ZwSaveKey (
  4522.     IN HANDLE KeyHandle,
  4523.     IN HANDLE FileHandle
  4524. );
  4525.  
  4526. NTSYSAPI
  4527. NTSTATUS
  4528. NTAPI
  4529. ZwSetDefaultLocale (
  4530.     IN BOOLEAN  ThreadOrSystem,
  4531.     IN LCID     Locale
  4532. );
  4533.  
  4534. #if (VER_PRODUCTBUILD >= 2195)
  4535.  
  4536. NTSYSAPI
  4537. NTSTATUS
  4538. NTAPI
  4539. ZwSetDefaultUILanguage (
  4540.     IN LANGID LanguageId
  4541. );
  4542.  
  4543. NTSYSAPI
  4544. NTSTATUS
  4545. NTAPI
  4546. ZwSetEaFile (
  4547.     IN HANDLE               FileHandle,
  4548.     OUT PIO_STATUS_BLOCK    IoStatusBlock,
  4549.     OUT PVOID               Buffer,
  4550.     IN ULONG                Length
  4551. );
  4552.  
  4553. #endif // (VER_PRODUCTBUILD >= 2195)
  4554.  
  4555. NTSYSAPI
  4556. NTSTATUS
  4557. NTAPI
  4558. ZwSetEvent (
  4559.     IN HANDLE   EventHandle,
  4560.     OUT PULONG  PreviousState OPTIONAL
  4561. );
  4562.  
  4563. NTSYSAPI
  4564. NTSTATUS
  4565. NTAPI
  4566. ZwSetInformationObject (
  4567.     IN HANDLE               ObjectHandle,
  4568.     IN OBJECT_INFO_CLASS    ObjectInformationClass,
  4569.     IN PVOID                ObjectInformation,
  4570.     IN ULONG                ObjectInformationLength
  4571. );
  4572.  
  4573. NTSYSAPI
  4574. NTSTATUS
  4575. NTAPI
  4576. ZwSetInformationProcess (
  4577.     IN HANDLE           ProcessHandle,
  4578.     IN PROCESSINFOCLASS ProcessInformationClass,
  4579.     IN PVOID            ProcessInformation,
  4580.     IN ULONG            ProcessInformationLength
  4581. );
  4582.  
  4583. #if (VER_PRODUCTBUILD >= 2195)
  4584.  
  4585. NTSYSAPI
  4586. NTSTATUS
  4587. NTAPI
  4588. ZwSetSecurityObject (
  4589.     IN HANDLE               Handle,
  4590.     IN SECURITY_INFORMATION SecurityInformation,
  4591.     IN PSECURITY_DESCRIPTOR SecurityDescriptor
  4592. );
  4593.  
  4594. #endif // (VER_PRODUCTBUILD >= 2195)
  4595.  
  4596. NTSYSAPI
  4597. NTSTATUS
  4598. NTAPI
  4599. ZwSetSystemInformation (
  4600.     IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
  4601.     IN PVOID                    SystemInformation,
  4602.     IN ULONG                    Length
  4603. );
  4604.  
  4605. NTSYSAPI
  4606. NTSTATUS
  4607. NTAPI
  4608. ZwSetSystemTime (
  4609.     IN PLARGE_INTEGER   NewTime,
  4610.     OUT PLARGE_INTEGER  OldTime OPTIONAL
  4611. );
  4612.  
  4613. #if (VER_PRODUCTBUILD >= 2195)
  4614.  
  4615. NTSYSAPI
  4616. NTSTATUS
  4617. NTAPI
  4618. ZwSetVolumeInformationFile (
  4619.     IN HANDLE               FileHandle,
  4620.     OUT PIO_STATUS_BLOCK    IoStatusBlock,
  4621.     IN PVOID                FsInformation,
  4622.     IN ULONG                Length,
  4623.     IN FS_INFORMATION_CLASS FsInformationClass
  4624. );
  4625.  
  4626. #endif // (VER_PRODUCTBUILD >= 2195)
  4627.  
  4628. NTSYSAPI
  4629. NTSTATUS
  4630. NTAPI
  4631. ZwTerminateProcess (
  4632.     IN HANDLE   ProcessHandle OPTIONAL,
  4633.     IN NTSTATUS ExitStatus
  4634. );
  4635.  
  4636. NTSYSAPI
  4637. NTSTATUS
  4638. NTAPI
  4639. ZwUnloadDriver (
  4640.     // "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>"
  4641.     IN PUNICODE_STRING RegistryPath
  4642. );
  4643.  
  4644. NTSYSAPI
  4645. NTSTATUS
  4646. NTAPI
  4647. ZwUnloadKey (
  4648.     IN POBJECT_ATTRIBUTES KeyObjectAttributes
  4649. );
  4650.  
  4651. NTSYSAPI
  4652. NTSTATUS
  4653. NTAPI
  4654. ZwWaitForSingleObject (
  4655.     IN HANDLE           Handle,
  4656.     IN BOOLEAN          Alertable,
  4657.     IN PLARGE_INTEGER   Timeout OPTIONAL
  4658. );
  4659.  
  4660. NTSYSAPI
  4661. NTSTATUS
  4662. NTAPI
  4663. ZwWaitForMultipleObjects (
  4664.     IN ULONG            HandleCount,
  4665.     IN PHANDLE          Handles,
  4666.     IN WAIT_TYPE        WaitType,
  4667.     IN BOOLEAN          Alertable,
  4668.     IN PLARGE_INTEGER   Timeout OPTIONAL
  4669. );
  4670.  
  4671. NTSYSAPI
  4672. NTSTATUS
  4673. NTAPI
  4674. ZwYieldExecution (
  4675.     VOID
  4676. );
  4677.  
  4678. #pragma pack(pop)
  4679.  
  4680. #ifdef __cplusplus
  4681. }
  4682. #endif
  4683.  
  4684. #endif // _NTIFS_
  4685.