2 * Copyright 2004-2005 Ivan Leo Puoti
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
26 #define POINTER_ALIGNMENT DECLSPEC_ALIGN(8)
28 #define POINTER_ALIGNMENT
31 typedef ULONG_PTR KSPIN_LOCK, *PKSPIN_LOCK;
36 struct _DEVICE_OBJECT;
37 struct _DRIVER_OBJECT;
39 typedef VOID (WINAPI *PKDEFERRED_ROUTINE)(struct _KDPC *, PVOID, PVOID, PVOID);
40 typedef VOID (WINAPI *PKSTART_ROUTINE)(PVOID);
42 typedef NTSTATUS (WINAPI *PDRIVER_INITIALIZE)(struct _DRIVER_OBJECT *, PUNICODE_STRING);
43 typedef NTSTATUS (WINAPI *PDRIVER_DISPATCH)(struct _DEVICE_OBJECT *, struct _IRP *);
44 typedef void (WINAPI *PDRIVER_STARTIO)(struct _DEVICE_OBJECT *, struct _IRP *);
45 typedef void (WINAPI *PDRIVER_UNLOAD)(struct _DRIVER_OBJECT *);
47 typedef struct _DISPATCHER_HEADER {
53 LIST_ENTRY WaitListHead;
54 } DISPATCHER_HEADER, *PDISPATCHER_HEADER;
56 typedef struct _KEVENT {
57 DISPATCHER_HEADER Header;
58 } KEVENT, *PKEVENT, *RESTRICTED_POINTER PRKEVENT;
60 typedef struct _KDPC {
64 LIST_ENTRY DpcListEntry;
65 PKDEFERRED_ROUTINE DeferredRoutine;
66 PVOID DeferredContext;
67 PVOID SystemArgument1;
68 PVOID SystemArgument2;
70 } KDPC, *PKDPC, *RESTRICTED_POINTER PRKDPC;
72 typedef struct _KDEVICE_QUEUE_ENTRY {
73 LIST_ENTRY DeviceListEntry;
76 } KDEVICE_QUEUE_ENTRY, *PKDEVICE_QUEUE_ENTRY,
77 *RESTRICTED_POINTER PRKDEVICE_QUEUE_ENTRY;
79 typedef struct _KDEVICE_QUEUE {
82 LIST_ENTRY DeviceListHead;
85 } KDEVICE_QUEUE, *PKDEVICE_QUEUE, *RESTRICTED_POINTER PRKDEVICE_QUEUE;
87 typedef struct _IO_TIMER *PIO_TIMER;
88 typedef struct _ETHREAD *PETHREAD;
89 typedef struct _KTHREAD *PKTHREAD;
90 typedef struct _EPROCESS *PEPROCESS;
92 #define MAXIMUM_VOLUME_LABEL_LENGTH (32 * sizeof(WCHAR))
98 USHORT VolumeLabelLength;
99 struct _DEVICE_OBJECT *DeviceObject;
100 struct _DEVICE_OBJECT *RealDevice;
102 ULONG ReferenceCount;
103 WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH / sizeof(WCHAR)];
106 typedef enum _POOL_TYPE {
109 NonPagedPoolMustSucceed,
111 NonPagedPoolCacheAligned,
112 PagedPoolCacheAligned,
113 NonPagedPoolCacheAlignedMustS,
117 typedef struct _WAIT_CONTEXT_BLOCK {
118 KDEVICE_QUEUE_ENTRY WaitQueueEntry;
119 struct _DRIVER_CONTROL *DeviceRoutine;
121 ULONG NumberOfMapRegisters;
124 PKDPC BufferChainingDpc;
125 } WAIT_CONTEXT_BLOCK, *PWAIT_CONTEXT_BLOCK;
128 #define DEVICE_TYPE ULONG
130 #define IRP_MJ_MAXIMUM_FUNCTION 0x1b
131 #define IRP_MJ_DEVICE_CONTROL 0x0e
133 typedef struct _DEVICE_OBJECT {
137 struct _DRIVER_OBJECT *DriverObject;
138 struct _DEVICE_OBJECT *NextDevice;
139 struct _DEVICE_OBJECT *AttachedDevice;
140 struct _IRP *CurrentIrp;
143 ULONG Characteristics;
145 PVOID DeviceExtension;
146 DEVICE_TYPE DeviceType;
149 LIST_ENTRY ListEntry;
150 WAIT_CONTEXT_BLOCK Wcb;
152 ULONG AlignmentRequirement;
153 KDEVICE_QUEUE DeviceQueue;
155 ULONG ActiveThreadCount;
156 PSECURITY_DESCRIPTOR SecurityDescriptor;
160 struct _DEVOBJ_EXTENSION *DeviceObjectExtension;
163 typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT;
165 typedef struct _DRIVER_EXTENSION {
166 struct _DRIVER_OBJECT *DriverObject;
169 UNICODE_STRING ServiceKeyName;
170 } DRIVER_EXTENSION, *PDRIVER_EXTENSION;
172 typedef struct _DRIVER_OBJECT {
175 PDEVICE_OBJECT DeviceObject;
180 PDRIVER_EXTENSION DriverExtension;
181 UNICODE_STRING DriverName;
182 PUNICODE_STRING HardwareDatabase;
183 PVOID FastIoDispatch;
184 PDRIVER_INITIALIZE DriverInit;
185 PDRIVER_STARTIO DriverStartIo;
186 PDRIVER_UNLOAD DriverUnload;
187 PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];
189 typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT;
191 /* Irp definitions */
192 typedef UCHAR KIRQL, *PKIRQL;
193 typedef CCHAR KPROCESSOR_MODE;
195 typedef VOID (WINAPI *PDRIVER_CANCEL)(
196 IN struct _DEVICE_OBJECT *DeviceObject,
197 IN struct _IRP *Irp);
199 typedef VOID (WINAPI *PKNORMAL_ROUTINE)(
200 IN PVOID NormalContext,
201 IN PVOID SystemArgument1,
202 IN PVOID SystemArgument2);
204 typedef VOID (WINAPI *PKKERNEL_ROUTINE)(
205 IN struct _KAPC *Apc,
206 IN OUT PKNORMAL_ROUTINE *NormalRoutine,
207 IN OUT PVOID *NormalContext,
208 IN OUT PVOID *SystemArgument1,
209 IN OUT PVOID *SystemArgument2);
211 typedef VOID (WINAPI *PKRUNDOWN_ROUTINE)(
212 IN struct _KAPC *Apc);
214 typedef struct _KAPC {
218 struct _KTHREAD *Thread;
219 LIST_ENTRY ApcListEntry;
220 PKKERNEL_ROUTINE KernelRoutine;
221 PKRUNDOWN_ROUTINE RundownRoutine;
222 PKNORMAL_ROUTINE NormalRoutine;
224 PVOID SystemArgument1;
225 PVOID SystemArgument2;
227 KPROCESSOR_MODE ApcMode;
229 } KAPC, *PKAPC, *RESTRICTED_POINTER PRKAPC;
231 #include <pshpack1.h>
232 typedef struct _IRP {
235 struct _MDL *MdlAddress;
238 struct _IRP *MasterIrp;
242 LIST_ENTRY ThreadListEntry;
243 IO_STATUS_BLOCK IoStatus;
244 KPROCESSOR_MODE RequestorMode;
245 BOOLEAN PendingReturned;
247 CHAR CurrentLocation;
250 CCHAR ApcEnvironment;
251 UCHAR AllocationFlags;
252 PIO_STATUS_BLOCK UserIosb;
256 PIO_APC_ROUTINE UserApcRoutine;
257 PVOID UserApcContext;
258 } AsynchronousParameters;
259 LARGE_INTEGER AllocationSize;
261 PDRIVER_CANCEL CancelRoutine;
266 KDEVICE_QUEUE_ENTRY DeviceQueueEntry;
268 PVOID DriverContext[4];
272 PCHAR AuxiliaryBuffer;
274 LIST_ENTRY ListEntry;
276 struct _IO_STACK_LOCATION *CurrentStackLocation;
280 struct _FILE_OBJECT *OriginalFileObject;
286 typedef struct _IRP *PIRP;
289 /* MDL definitions */
291 typedef VOID (WINAPI *PINTERFACE_REFERENCE)(
294 typedef VOID (WINAPI *PINTERFACE_DEREFERENCE)(
297 typedef struct _INTERFACE {
301 PINTERFACE_REFERENCE InterfaceReference;
302 PINTERFACE_DEREFERENCE InterfaceDereference;
303 } INTERFACE, *PINTERFACE;
305 typedef struct _SECTION_OBJECT_POINTERS {
306 PVOID DataSectionObject;
307 PVOID SharedCacheMap;
308 PVOID ImageSectionObject;
309 } SECTION_OBJECT_POINTERS, *PSECTION_OBJECT_POINTERS;
311 typedef struct _IO_COMPLETION_CONTEXT {
314 } IO_COMPLETION_CONTEXT, *PIO_COMPLETION_CONTEXT;
316 typedef enum _DEVICE_RELATION_TYPE {
321 TargetDeviceRelation,
323 } DEVICE_RELATION_TYPE, *PDEVICE_RELATION_TYPE;
325 typedef struct _FILE_OBJECT {
328 PDEVICE_OBJECT DeviceObject;
332 PSECTION_OBJECT_POINTERS SectionObjectPointer;
333 PVOID PrivateCacheMap;
334 NTSTATUS FinalStatus;
335 struct _FILE_OBJECT *RelatedFileObject;
336 BOOLEAN LockOperation;
337 BOOLEAN DeletePending;
340 BOOLEAN DeleteAccess;
343 BOOLEAN SharedDelete;
345 UNICODE_STRING FileName;
346 LARGE_INTEGER CurrentByteOffset;
352 PIO_COMPLETION_CONTEXT CompletionContext;
354 typedef struct _FILE_OBJECT *PFILE_OBJECT;
356 #define INITIAL_PRIVILEGE_COUNT 3
358 typedef struct _INITIAL_PRIVILEGE_SET {
359 ULONG PrivilegeCount;
361 LUID_AND_ATTRIBUTES Privilege[INITIAL_PRIVILEGE_COUNT];
362 } INITIAL_PRIVILEGE_SET, * PINITIAL_PRIVILEGE_SET;
364 typedef struct _SECURITY_SUBJECT_CONTEXT {
365 PACCESS_TOKEN ClientToken;
366 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
367 PACCESS_TOKEN PrimaryToken;
368 PVOID ProcessAuditId;
369 } SECURITY_SUBJECT_CONTEXT, *PSECURITY_SUBJECT_CONTEXT;
371 typedef struct _ACCESS_STATE {
373 BOOLEAN SecurityEvaluated;
374 BOOLEAN GenerateAudit;
375 BOOLEAN GenerateOnClose;
376 BOOLEAN PrivilegesAllocated;
378 ACCESS_MASK RemainingDesiredAccess;
379 ACCESS_MASK PreviouslyGrantedAccess;
380 ACCESS_MASK OriginalDesiredAccess;
381 SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
382 PSECURITY_DESCRIPTOR SecurityDescriptor;
385 INITIAL_PRIVILEGE_SET InitialPrivilegeSet;
386 PRIVILEGE_SET PrivilegeSet;
389 BOOLEAN AuditPrivileges;
390 UNICODE_STRING ObjectName;
391 UNICODE_STRING ObjectTypeName;
392 } ACCESS_STATE, *PACCESS_STATE;
394 typedef struct _IO_SECURITY_CONTEXT {
395 PSECURITY_QUALITY_OF_SERVICE SecurityQos;
396 PACCESS_STATE AccessState;
397 ACCESS_MASK DesiredAccess;
398 ULONG FullCreateOptions;
399 } IO_SECURITY_CONTEXT, *PIO_SECURITY_CONTEXT;
401 typedef struct _DEVICE_CAPABILITIES {
406 ULONG LockSupported : 1;
407 ULONG EjectSupported : 1;
409 ULONG DockDevice : 1;
411 ULONG SilentInstall : 1;
412 ULONG RawDeviceOK : 1;
413 ULONG SurpriseRemovalOK : 1;
414 ULONG WakeFromD0 : 1;
415 ULONG WakeFromD1 : 1;
416 ULONG WakeFromD2 : 1;
417 ULONG WakeFromD3 : 1;
418 ULONG HardwareDisabled : 1;
419 ULONG NonDynamic : 1;
420 ULONG WarmEjectSupported : 1;
421 ULONG NoDisplayInUI : 1;
425 DEVICE_POWER_STATE DeviceState[PowerSystemMaximum];
426 SYSTEM_POWER_STATE SystemWake;
427 DEVICE_POWER_STATE DeviceWake;
431 } DEVICE_CAPABILITIES, *PDEVICE_CAPABILITIES;
433 typedef enum _INTERFACE_TYPE {
434 InterfaceTypeUndefined = -1,
452 } INTERFACE_TYPE, *PINTERFACE_TYPE;
454 typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS;
456 #define IO_RESOURCE_PREFERRED 0x01
457 #define IO_RESOURCE_DEFAULT 0x02
458 #define IO_RESOURCE_ALTERNATIVE 0x08
460 typedef struct _IO_RESOURCE_DESCRIPTOR {
463 UCHAR ShareDisposition;
471 PHYSICAL_ADDRESS MinimumAddress;
472 PHYSICAL_ADDRESS MaximumAddress;
477 PHYSICAL_ADDRESS MinimumAddress;
478 PHYSICAL_ADDRESS MaximumAddress;
485 ULONG MinimumChannel;
486 ULONG MaximumChannel;
491 PHYSICAL_ADDRESS MinimumAddress;
492 PHYSICAL_ADDRESS MaximumAddress;
509 } IO_RESOURCE_DESCRIPTOR, *PIO_RESOURCE_DESCRIPTOR;
511 typedef struct _IO_RESOURCE_LIST {
515 IO_RESOURCE_DESCRIPTOR Descriptors[1];
516 } IO_RESOURCE_LIST, *PIO_RESOURCE_LIST;
518 typedef struct _IO_RESOURCE_REQUIREMENTS_LIST {
520 INTERFACE_TYPE InterfaceType;
524 ULONG AlternativeLists;
525 IO_RESOURCE_LIST List[1];
526 } IO_RESOURCE_REQUIREMENTS_LIST, *PIO_RESOURCE_REQUIREMENTS_LIST;
528 typedef enum _BUS_QUERY_ID_TYPE {
531 BusQueryCompatibleIDs,
533 BusQueryDeviceSerialNumber
534 } BUS_QUERY_ID_TYPE, *PBUS_QUERY_ID_TYPE;
536 typedef enum _DEVICE_TEXT_TYPE {
537 DeviceTextDescription,
538 DeviceTextLocationInformation
539 } DEVICE_TEXT_TYPE, *PDEVICE_TEXT_TYPE;
541 typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE {
542 DeviceUsageTypeUndefined,
543 DeviceUsageTypePaging,
544 DeviceUsageTypeHibernation,
545 DeviceUsageTypeDumpFile
546 } DEVICE_USAGE_NOTIFICATION_TYPE;
548 typedef struct _POWER_SEQUENCE {
552 } POWER_SEQUENCE, *PPOWER_SEQUENCE;
554 typedef enum _POWER_STATE_TYPE {
557 } POWER_STATE_TYPE, *PPOWER_STATE_TYPE;
559 typedef union _POWER_STATE {
560 SYSTEM_POWER_STATE SystemState;
561 DEVICE_POWER_STATE DeviceState;
562 } POWER_STATE, *PPOWER_STATE;
564 typedef struct _CM_PARTIAL_RESOURCE_DESCRIPTOR {
566 UCHAR ShareDisposition;
570 PHYSICAL_ADDRESS Start;
574 PHYSICAL_ADDRESS Start;
583 PHYSICAL_ADDRESS Start;
603 } DeviceSpecificData;
605 } CM_PARTIAL_RESOURCE_DESCRIPTOR, *PCM_PARTIAL_RESOURCE_DESCRIPTOR;
607 typedef struct _CM_PARTIAL_RESOURCE_LIST {
611 CM_PARTIAL_RESOURCE_DESCRIPTOR PartialDescriptors[1];
612 } CM_PARTIAL_RESOURCE_LIST, *PCM_PARTIAL_RESOURCE_LIST;
614 typedef struct _CM_FULL_RESOURCE_DESCRIPTOR {
615 INTERFACE_TYPE InterfaceType;
617 CM_PARTIAL_RESOURCE_LIST PartialResourceList;
618 } CM_FULL_RESOURCE_DESCRIPTOR, *PCM_FULL_RESOURCE_DESCRIPTOR;
620 typedef struct _CM_RESOURCE_LIST {
622 CM_FULL_RESOURCE_DESCRIPTOR List[1];
623 } CM_RESOURCE_LIST, *PCM_RESOURCE_LIST;
625 typedef NTSTATUS (WINAPI *PIO_COMPLETION_ROUTINE)(
626 IN struct _DEVICE_OBJECT *DeviceObject,
630 #include <pshpack1.h>
631 typedef struct _IO_STACK_LOCATION {
638 PIO_SECURITY_CONTEXT SecurityContext;
640 USHORT POINTER_ALIGNMENT FileAttributes;
642 ULONG POINTER_ALIGNMENT EaLength;
646 ULONG POINTER_ALIGNMENT Key;
647 LARGE_INTEGER ByteOffset;
651 ULONG POINTER_ALIGNMENT Key;
652 LARGE_INTEGER ByteOffset;
656 FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
660 FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
661 PFILE_OBJECT FileObject;
664 BOOLEAN ReplaceIfExists;
673 FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
676 ULONG OutputBufferLength;
677 ULONG POINTER_ALIGNMENT InputBufferLength;
678 ULONG POINTER_ALIGNMENT IoControlCode;
679 PVOID Type3InputBuffer;
682 SECURITY_INFORMATION SecurityInformation;
683 ULONG POINTER_ALIGNMENT Length;
686 SECURITY_INFORMATION SecurityInformation;
687 PSECURITY_DESCRIPTOR SecurityDescriptor;
691 PDEVICE_OBJECT DeviceObject;
695 PDEVICE_OBJECT DeviceObject;
698 struct _SCSI_REQUEST_BLOCK *Srb;
701 DEVICE_RELATION_TYPE Type;
702 } QueryDeviceRelations;
704 CONST GUID *InterfaceType;
707 PINTERFACE Interface;
708 PVOID InterfaceSpecificData;
711 PDEVICE_CAPABILITIES Capabilities;
712 } DeviceCapabilities;
714 PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;
715 } FilterResourceRequirements;
720 ULONG POINTER_ALIGNMENT Length;
726 BUS_QUERY_ID_TYPE IdType;
729 DEVICE_TEXT_TYPE DeviceTextType;
730 LCID POINTER_ALIGNMENT LocaleId;
735 DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;
738 SYSTEM_POWER_STATE PowerState;
741 PPOWER_SEQUENCE PowerSequence;
745 POWER_STATE_TYPE POINTER_ALIGNMENT Type;
746 POWER_STATE POINTER_ALIGNMENT State;
747 POWER_ACTION POINTER_ALIGNMENT ShutdownType;
750 PCM_RESOURCE_LIST AllocatedResources;
751 PCM_RESOURCE_LIST AllocatedResourcesTranslated;
754 ULONG_PTR ProviderId;
766 PDEVICE_OBJECT DeviceObject;
767 PFILE_OBJECT FileObject;
768 PIO_COMPLETION_ROUTINE CompletionRoutine;
770 } IO_STACK_LOCATION, *PIO_STACK_LOCATION;
773 typedef struct _MDL {
777 struct _EPROCESS *Process;
778 PVOID MappedSystemVa;
784 typedef struct _KTIMER {
785 DISPATCHER_HEADER Header;
786 ULARGE_INTEGER DueTime;
787 LIST_ENTRY TimerListEntry;
792 typedef struct _KSYSTEM_TIME {
796 } KSYSTEM_TIME, *PKSYSTEM_TIME;
798 typedef enum _NT_PRODUCT_TYPE {
802 } NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;
804 #define PROCESSOR_FEATURE_MAX 64
806 typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
811 } ALTERNATIVE_ARCHITECTURE_TYPE;
813 typedef struct _KUSER_SHARED_DATA {
814 ULONG TickCountLowDeprecated;
815 ULONG TickCountMultiplier;
816 volatile KSYSTEM_TIME InterruptTime;
817 volatile KSYSTEM_TIME SystemTime;
818 volatile KSYSTEM_TIME TimeZoneBias;
819 USHORT ImageNumberLow;
820 USHORT ImageNumberHigh;
821 WCHAR NtSystemRoot[260];
822 ULONG MaxStckTraceDepth;
823 ULONG CryptoExponent;
825 ULONG LargePageMinimum;
827 NT_PRODUCT_TYPE NtProductType;
828 BOOLEAN ProductTypeIsValid;
829 ULONG MajorNtVersion;
830 ULONG MinorNtVersion;
831 BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];
834 volatile ULONG TimeSlip;
835 ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
836 LARGE_INTEGER SystemExpirationDate;
838 BOOLEAN KdDebuggerEnabled;
839 volatile ULONG ActiveConsoleId;
840 volatile ULONG DismountCount;
841 ULONG ComPlusPackage;
842 ULONG LastSystemRITEventTickCount;
843 ULONG NumberOfPhysicalPages;
844 BOOLEAN SafeBootMode;
847 ULONGLONG SystemCall[4];
849 volatile KSYSTEM_TIME TickCount;
850 volatile ULONG64 TickCountQuad;
852 } KSHARED_USER_DATA, *PKSHARED_USER_DATA;
854 NTSTATUS WINAPI ObCloseHandle(IN HANDLE handle);
856 #define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.CurrentStackLocation)
861 /* directory object access rights */
862 #define DIRECTORY_QUERY 0x0001
863 #define DIRECTORY_TRAVERSE 0x0002
864 #define DIRECTORY_CREATE_OBJECT 0x0004
865 #define DIRECTORY_CREATE_SUBDIRECTORY 0x0008
866 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)
868 /* symbolic link access rights */
869 #define SYMBOLIC_LINK_QUERY 0x0001
870 #define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
872 PVOID WINAPI ExAllocatePool(POOL_TYPE,SIZE_T);
873 PVOID WINAPI ExAllocatePoolWithQuota(POOL_TYPE,SIZE_T);
874 PVOID WINAPI ExAllocatePoolWithTag(POOL_TYPE,SIZE_T,ULONG);
875 PVOID WINAPI ExAllocatePoolWithQuotaTag(POOL_TYPE,SIZE_T,ULONG);
876 void WINAPI ExFreePool(PVOID);
877 void WINAPI ExFreePoolWithTag(PVOID,ULONG);
879 NTSTATUS WINAPI IoCreateDevice(DRIVER_OBJECT*,ULONG,UNICODE_STRING*,DEVICE_TYPE,ULONG,BOOLEAN,DEVICE_OBJECT**);
880 NTSTATUS WINAPI IoCreateSymbolicLink(UNICODE_STRING*,UNICODE_STRING*);
881 void WINAPI IoDeleteDevice(DEVICE_OBJECT*);
882 NTSTATUS WINAPI IoDeleteSymbolicLink(UNICODE_STRING*);
883 PEPROCESS WINAPI IoGetCurrentProcess(void);
885 PKTHREAD WINAPI KeGetCurrentThread(void);
886 void WINAPI KeQuerySystemTime(LARGE_INTEGER*);
887 void WINAPI KeQueryTickCount(LARGE_INTEGER*);
888 ULONG WINAPI KeQueryTimeIncrement(void);
890 PVOID WINAPI MmAllocateNonCachedMemory(SIZE_T);
891 void WINAPI MmFreeNonCachedMemory(PVOID,SIZE_T);
893 NTSTATUS WINAPI PsCreateSystemThread(PHANDLE,ULONG,POBJECT_ATTRIBUTES,HANDLE,PCLIENT_ID,PKSTART_ROUTINE,PVOID);
894 #define PsGetCurrentProcess() IoGetCurrentProcess()
895 #define PsGetCurrentThread() ((PETHREAD)KeGetCurrentThread())
896 HANDLE WINAPI PsGetCurrentProcessId(void);
897 HANDLE WINAPI PsGetCurrentThreadId(void);
898 BOOLEAN WINAPI PsGetVersion(ULONG*,ULONG*,ULONG*,UNICODE_STRING*);
899 NTSTATUS WINAPI PsTerminateSystemThread(NTSTATUS);
901 NTSTATUS WINAPI ZwAddBootEntry(PUNICODE_STRING,PUNICODE_STRING);
902 NTSTATUS WINAPI ZwAccessCheckAndAuditAlarm(PUNICODE_STRING,HANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,ACCESS_MASK,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PBOOLEAN,PBOOLEAN);
903 NTSTATUS WINAPI ZwAdjustPrivilegesToken(HANDLE,BOOLEAN,PTOKEN_PRIVILEGES,DWORD,PTOKEN_PRIVILEGES,PDWORD);
904 NTSTATUS WINAPI ZwAlertThread(HANDLE ThreadHandle);
905 NTSTATUS WINAPI ZwAllocateVirtualMemory(HANDLE,PVOID*,ULONG,SIZE_T*,ULONG,ULONG);
906 NTSTATUS WINAPI ZwCancelIoFile(HANDLE,PIO_STATUS_BLOCK);
907 NTSTATUS WINAPI ZwCancelTimer(HANDLE, BOOLEAN*);
908 NTSTATUS WINAPI ZwClearEvent(HANDLE);
909 NTSTATUS WINAPI ZwClose(HANDLE);
910 NTSTATUS WINAPI ZwCloseObjectAuditAlarm(PUNICODE_STRING,HANDLE,BOOLEAN);
911 NTSTATUS WINAPI ZwConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
912 NTSTATUS WINAPI ZwCreateDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
913 NTSTATUS WINAPI ZwCreateEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *,BOOLEAN,BOOLEAN);
914 NTSTATUS WINAPI ZwCreateFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG);
915 NTSTATUS WINAPI ZwCreateKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,PULONG);
916 NTSTATUS WINAPI ZwCreateSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const LARGE_INTEGER*,ULONG,ULONG,HANDLE);
917 NTSTATUS WINAPI ZwCreateSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PUNICODE_STRING);
918 NTSTATUS WINAPI ZwCreateTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*, TIMER_TYPE);
919 NTSTATUS WINAPI ZwDeleteAtom(RTL_ATOM);
920 NTSTATUS WINAPI ZwDeleteFile(POBJECT_ATTRIBUTES);
921 NTSTATUS WINAPI ZwDeleteKey(HANDLE);
922 NTSTATUS WINAPI ZwDeleteValueKey(HANDLE,const UNICODE_STRING *);
923 NTSTATUS WINAPI ZwDeviceIoControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
924 NTSTATUS WINAPI ZwDisplayString(PUNICODE_STRING);
925 NTSTATUS WINAPI ZwDuplicateObject(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,ULONG,ULONG);
926 NTSTATUS WINAPI ZwDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
927 NTSTATUS WINAPI ZwEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
928 NTSTATUS WINAPI ZwEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
929 NTSTATUS WINAPI ZwFlushInstructionCache(HANDLE,LPCVOID,SIZE_T);
930 NTSTATUS WINAPI ZwFlushKey(HANDLE);
931 NTSTATUS WINAPI ZwFlushVirtualMemory(HANDLE,LPCVOID*,SIZE_T*,ULONG);
932 NTSTATUS WINAPI ZwFreeVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
933 NTSTATUS WINAPI ZwFsControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
934 NTSTATUS WINAPI ZwInitiatePowerAction(POWER_ACTION,SYSTEM_POWER_STATE,ULONG,BOOLEAN);
935 NTSTATUS WINAPI ZwLoadDriver(const UNICODE_STRING *);
936 NTSTATUS WINAPI ZwLoadKey(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *);
937 NTSTATUS WINAPI ZwLockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
938 NTSTATUS WINAPI ZwMakeTemporaryObject(HANDLE);
939 NTSTATUS WINAPI ZwMapViewOfSection(HANDLE,HANDLE,PVOID*,ULONG,SIZE_T,const LARGE_INTEGER*,SIZE_T*,SECTION_INHERIT,ULONG,ULONG);
940 NTSTATUS WINAPI ZwNotifyChangeKey(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
941 NTSTATUS WINAPI ZwOpenDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
942 NTSTATUS WINAPI ZwOpenEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
943 NTSTATUS WINAPI ZwOpenFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG);
944 NTSTATUS WINAPI ZwOpenKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
945 NTSTATUS WINAPI ZwOpenProcess(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
946 NTSTATUS WINAPI ZwOpenProcessToken(HANDLE,DWORD,HANDLE *);
947 NTSTATUS WINAPI ZwOpenSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
948 NTSTATUS WINAPI ZwOpenSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
949 NTSTATUS WINAPI ZwOpenThread(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
950 NTSTATUS WINAPI ZwOpenThreadToken(HANDLE,DWORD,BOOLEAN,HANDLE *);
951 NTSTATUS WINAPI ZwOpenTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*);
952 NTSTATUS WINAPI ZwPowerInformation(POWER_INFORMATION_LEVEL,PVOID,ULONG,PVOID,ULONG);
953 NTSTATUS WINAPI ZwPulseEvent(HANDLE,PULONG);
954 NTSTATUS WINAPI ZwQueryDefaultLocale(BOOLEAN,LCID*);
955 NTSTATUS WINAPI ZwQueryDefaultUILanguage(LANGID*);
956 NTSTATUS WINAPI ZwQueryDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS,BOOLEAN,PUNICODE_STRING,BOOLEAN);
957 NTSTATUS WINAPI ZwQueryDirectoryObject(HANDLE,PDIRECTORY_BASIC_INFORMATION,ULONG,BOOLEAN,BOOLEAN,PULONG,PULONG);
958 NTSTATUS WINAPI ZwQueryEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,BOOLEAN,PVOID,ULONG,PVOID,BOOLEAN);
959 NTSTATUS WINAPI ZwQueryFullAttributesFile(const OBJECT_ATTRIBUTES*,FILE_NETWORK_OPEN_INFORMATION*);
960 NTSTATUS WINAPI ZwQueryInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,LONG,FILE_INFORMATION_CLASS);
961 NTSTATUS WINAPI ZwQueryInformationThread(HANDLE,THREADINFOCLASS,PVOID,ULONG,PULONG);
962 NTSTATUS WINAPI ZwQueryInformationToken(HANDLE,DWORD,PVOID,DWORD,LPDWORD);
963 NTSTATUS WINAPI ZwQueryInstallUILanguage(LANGID*);
964 NTSTATUS WINAPI ZwQueryKey(HANDLE,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
965 NTSTATUS WINAPI ZwQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
966 NTSTATUS WINAPI ZwQuerySecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR,ULONG,PULONG);
967 NTSTATUS WINAPI ZwQuerySection(HANDLE,SECTION_INFORMATION_CLASS,PVOID,ULONG,PULONG);
968 NTSTATUS WINAPI ZwQuerySymbolicLinkObject(HANDLE,PUNICODE_STRING,PULONG);
969 NTSTATUS WINAPI ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG);
970 NTSTATUS WINAPI ZwQueryTimerResolution(PULONG,PULONG,PULONG);
971 NTSTATUS WINAPI ZwQueryValueKey(HANDLE,const UNICODE_STRING *,KEY_VALUE_INFORMATION_CLASS,void *,DWORD,DWORD *);
972 NTSTATUS WINAPI ZwQueryVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
973 NTSTATUS WINAPI ZwReadFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG);
974 NTSTATUS WINAPI ZwReplaceKey(POBJECT_ATTRIBUTES,HANDLE,POBJECT_ATTRIBUTES);
975 NTSTATUS WINAPI ZwRequestWaitReplyPort(HANDLE,PLPC_MESSAGE,PLPC_MESSAGE);
976 NTSTATUS WINAPI ZwResetEvent(HANDLE,PULONG);
977 NTSTATUS WINAPI ZwRestoreKey(HANDLE,HANDLE,ULONG);
978 NTSTATUS WINAPI ZwSaveKey(HANDLE,HANDLE);
979 NTSTATUS WINAPI ZwSecureConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PSID,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
980 NTSTATUS WINAPI ZwSetDefaultLocale(BOOLEAN,LCID);
981 NTSTATUS WINAPI ZwSetDefaultUILanguage(LANGID);
982 NTSTATUS WINAPI ZwSetEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG);
983 NTSTATUS WINAPI ZwSetEvent(HANDLE,PULONG);
984 NTSTATUS WINAPI ZwSetInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS);
985 NTSTATUS WINAPI ZwSetInformationKey(HANDLE,const int,PVOID,ULONG);
986 NTSTATUS WINAPI ZwSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG);
987 NTSTATUS WINAPI ZwSetInformationProcess(HANDLE,PROCESS_INFORMATION_CLASS,PVOID,ULONG);
988 NTSTATUS WINAPI ZwSetInformationThread(HANDLE,THREADINFOCLASS,LPCVOID,ULONG);
989 NTSTATUS WINAPI ZwSetIoCompletion(HANDLE,ULONG,ULONG,NTSTATUS,ULONG);
990 NTSTATUS WINAPI ZwSetSecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR);
991 NTSTATUS WINAPI ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG);
992 NTSTATUS WINAPI ZwSetSystemTime(const LARGE_INTEGER*,LARGE_INTEGER*);
993 NTSTATUS WINAPI ZwSetTimer(HANDLE, const LARGE_INTEGER*, PTIMER_APC_ROUTINE, PVOID, BOOLEAN, ULONG, BOOLEAN*);
994 NTSTATUS WINAPI ZwSetValueKey(HANDLE,const UNICODE_STRING *,ULONG,ULONG,const void *,ULONG);
995 NTSTATUS WINAPI ZwSetVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
996 NTSTATUS WINAPI ZwSuspendThread(HANDLE,PULONG);
997 NTSTATUS WINAPI ZwTerminateProcess(HANDLE,LONG);
998 NTSTATUS WINAPI ZwUnloadDriver(const UNICODE_STRING *);
999 NTSTATUS WINAPI ZwUnloadKey(HANDLE);
1000 NTSTATUS WINAPI ZwUnmapViewOfSection(HANDLE,PVOID);
1001 NTSTATUS WINAPI ZwWaitForSingleObject(HANDLE,BOOLEAN,const LARGE_INTEGER*);
1002 NTSTATUS WINAPI ZwWaitForMultipleObjects(ULONG,const HANDLE*,BOOLEAN,BOOLEAN,const LARGE_INTEGER*);
1003 NTSTATUS WINAPI ZwWriteFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,const void*,ULONG,PLARGE_INTEGER,PULONG);
1004 NTSTATUS WINAPI ZwYieldExecution(void);