2 * Copyright 2004-2005 Ivan Leo Puoti
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
26 #define POINTER_ALIGNMENT DECLSPEC_ALIGN(8)
28 #define POINTER_ALIGNMENT
31 typedef ULONG_PTR KSPIN_LOCK, *PKSPIN_LOCK;
36 struct _DEVICE_OBJECT;
37 struct _DRIVER_OBJECT;
39 typedef VOID (WINAPI *PKDEFERRED_ROUTINE)(struct _KDPC *, PVOID, PVOID, PVOID);
40 typedef VOID (WINAPI *PKSTART_ROUTINE)(PVOID);
42 typedef NTSTATUS (WINAPI *PDRIVER_INITIALIZE)(struct _DRIVER_OBJECT *, PUNICODE_STRING);
43 typedef NTSTATUS (WINAPI *PDRIVER_DISPATCH)(struct _DEVICE_OBJECT *, struct _IRP *);
44 typedef void (WINAPI *PDRIVER_STARTIO)(struct _DEVICE_OBJECT *, struct _IRP *);
45 typedef void (WINAPI *PDRIVER_UNLOAD)(struct _DRIVER_OBJECT *);
47 typedef struct _DISPATCHER_HEADER {
53 LIST_ENTRY WaitListHead;
54 } DISPATCHER_HEADER, *PDISPATCHER_HEADER;
56 typedef struct _KEVENT {
57 DISPATCHER_HEADER Header;
58 } KEVENT, *PKEVENT, *RESTRICTED_POINTER PRKEVENT;
60 typedef struct _KDPC {
64 LIST_ENTRY DpcListEntry;
65 PKDEFERRED_ROUTINE DeferredRoutine;
66 PVOID DeferredContext;
67 PVOID SystemArgument1;
68 PVOID SystemArgument2;
70 } KDPC, *PKDPC, *RESTRICTED_POINTER PRKDPC;
72 typedef struct _KDEVICE_QUEUE_ENTRY {
73 LIST_ENTRY DeviceListEntry;
76 } KDEVICE_QUEUE_ENTRY, *PKDEVICE_QUEUE_ENTRY,
77 *RESTRICTED_POINTER PRKDEVICE_QUEUE_ENTRY;
79 typedef struct _KDEVICE_QUEUE {
82 LIST_ENTRY DeviceListHead;
85 } KDEVICE_QUEUE, *PKDEVICE_QUEUE, *RESTRICTED_POINTER PRKDEVICE_QUEUE;
87 typedef struct _IO_TIMER *PIO_TIMER;
88 typedef struct _ETHREAD *PETHREAD;
89 typedef struct _KTHREAD *PKTHREAD;
90 typedef struct _EPROCESS *PEPROCESS;
91 typedef struct _IO_WORKITEM *PIO_WORKITEM;
93 #define MAXIMUM_VOLUME_LABEL_LENGTH (32 * sizeof(WCHAR))
99 USHORT VolumeLabelLength;
100 struct _DEVICE_OBJECT *DeviceObject;
101 struct _DEVICE_OBJECT *RealDevice;
103 ULONG ReferenceCount;
104 WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH / sizeof(WCHAR)];
107 typedef enum _POOL_TYPE {
110 NonPagedPoolMustSucceed,
112 NonPagedPoolCacheAligned,
113 PagedPoolCacheAligned,
114 NonPagedPoolCacheAlignedMustS,
118 typedef struct _WAIT_CONTEXT_BLOCK {
119 KDEVICE_QUEUE_ENTRY WaitQueueEntry;
120 struct _DRIVER_CONTROL *DeviceRoutine;
122 ULONG NumberOfMapRegisters;
125 PKDPC BufferChainingDpc;
126 } WAIT_CONTEXT_BLOCK, *PWAIT_CONTEXT_BLOCK;
129 #define DEVICE_TYPE ULONG
131 #define IRP_MJ_MAXIMUM_FUNCTION 0x1b
132 #define IRP_MJ_DEVICE_CONTROL 0x0e
134 typedef struct _DEVICE_OBJECT {
138 struct _DRIVER_OBJECT *DriverObject;
139 struct _DEVICE_OBJECT *NextDevice;
140 struct _DEVICE_OBJECT *AttachedDevice;
141 struct _IRP *CurrentIrp;
144 ULONG Characteristics;
146 PVOID DeviceExtension;
147 DEVICE_TYPE DeviceType;
150 LIST_ENTRY ListEntry;
151 WAIT_CONTEXT_BLOCK Wcb;
153 ULONG AlignmentRequirement;
154 KDEVICE_QUEUE DeviceQueue;
156 ULONG ActiveThreadCount;
157 PSECURITY_DESCRIPTOR SecurityDescriptor;
161 struct _DEVOBJ_EXTENSION *DeviceObjectExtension;
164 typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT;
166 typedef struct _DRIVER_EXTENSION {
167 struct _DRIVER_OBJECT *DriverObject;
170 UNICODE_STRING ServiceKeyName;
171 } DRIVER_EXTENSION, *PDRIVER_EXTENSION;
173 typedef struct _DRIVER_OBJECT {
176 PDEVICE_OBJECT DeviceObject;
181 PDRIVER_EXTENSION DriverExtension;
182 UNICODE_STRING DriverName;
183 PUNICODE_STRING HardwareDatabase;
184 PVOID FastIoDispatch;
185 PDRIVER_INITIALIZE DriverInit;
186 PDRIVER_STARTIO DriverStartIo;
187 PDRIVER_UNLOAD DriverUnload;
188 PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];
190 typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT;
192 /* Irp definitions */
193 typedef UCHAR KIRQL, *PKIRQL;
194 typedef CCHAR KPROCESSOR_MODE;
196 typedef VOID (WINAPI *PDRIVER_CANCEL)(
197 IN struct _DEVICE_OBJECT *DeviceObject,
198 IN struct _IRP *Irp);
200 typedef VOID (WINAPI *PKNORMAL_ROUTINE)(
201 IN PVOID NormalContext,
202 IN PVOID SystemArgument1,
203 IN PVOID SystemArgument2);
205 typedef VOID (WINAPI *PKKERNEL_ROUTINE)(
206 IN struct _KAPC *Apc,
207 IN OUT PKNORMAL_ROUTINE *NormalRoutine,
208 IN OUT PVOID *NormalContext,
209 IN OUT PVOID *SystemArgument1,
210 IN OUT PVOID *SystemArgument2);
212 typedef VOID (WINAPI *PKRUNDOWN_ROUTINE)(
213 IN struct _KAPC *Apc);
215 typedef struct _KAPC {
219 struct _KTHREAD *Thread;
220 LIST_ENTRY ApcListEntry;
221 PKKERNEL_ROUTINE KernelRoutine;
222 PKRUNDOWN_ROUTINE RundownRoutine;
223 PKNORMAL_ROUTINE NormalRoutine;
225 PVOID SystemArgument1;
226 PVOID SystemArgument2;
228 KPROCESSOR_MODE ApcMode;
230 } KAPC, *PKAPC, *RESTRICTED_POINTER PRKAPC;
232 #include <pshpack1.h>
233 typedef struct _IRP {
236 struct _MDL *MdlAddress;
239 struct _IRP *MasterIrp;
243 LIST_ENTRY ThreadListEntry;
244 IO_STATUS_BLOCK IoStatus;
245 KPROCESSOR_MODE RequestorMode;
246 BOOLEAN PendingReturned;
248 CHAR CurrentLocation;
251 CCHAR ApcEnvironment;
252 UCHAR AllocationFlags;
253 PIO_STATUS_BLOCK UserIosb;
257 PIO_APC_ROUTINE UserApcRoutine;
258 PVOID UserApcContext;
259 } AsynchronousParameters;
260 LARGE_INTEGER AllocationSize;
262 PDRIVER_CANCEL CancelRoutine;
267 KDEVICE_QUEUE_ENTRY DeviceQueueEntry;
269 PVOID DriverContext[4];
273 PCHAR AuxiliaryBuffer;
275 LIST_ENTRY ListEntry;
277 struct _IO_STACK_LOCATION *CurrentStackLocation;
281 struct _FILE_OBJECT *OriginalFileObject;
287 typedef struct _IRP *PIRP;
290 /* MDL definitions */
292 typedef VOID (WINAPI *PINTERFACE_REFERENCE)(
295 typedef VOID (WINAPI *PINTERFACE_DEREFERENCE)(
298 typedef struct _INTERFACE {
302 PINTERFACE_REFERENCE InterfaceReference;
303 PINTERFACE_DEREFERENCE InterfaceDereference;
304 } INTERFACE, *PINTERFACE;
306 typedef struct _SECTION_OBJECT_POINTERS {
307 PVOID DataSectionObject;
308 PVOID SharedCacheMap;
309 PVOID ImageSectionObject;
310 } SECTION_OBJECT_POINTERS, *PSECTION_OBJECT_POINTERS;
312 typedef struct _IO_COMPLETION_CONTEXT {
315 } IO_COMPLETION_CONTEXT, *PIO_COMPLETION_CONTEXT;
317 typedef enum _DEVICE_RELATION_TYPE {
322 TargetDeviceRelation,
324 } DEVICE_RELATION_TYPE, *PDEVICE_RELATION_TYPE;
326 typedef struct _FILE_OBJECT {
329 PDEVICE_OBJECT DeviceObject;
333 PSECTION_OBJECT_POINTERS SectionObjectPointer;
334 PVOID PrivateCacheMap;
335 NTSTATUS FinalStatus;
336 struct _FILE_OBJECT *RelatedFileObject;
337 BOOLEAN LockOperation;
338 BOOLEAN DeletePending;
341 BOOLEAN DeleteAccess;
344 BOOLEAN SharedDelete;
346 UNICODE_STRING FileName;
347 LARGE_INTEGER CurrentByteOffset;
353 PIO_COMPLETION_CONTEXT CompletionContext;
355 typedef struct _FILE_OBJECT *PFILE_OBJECT;
357 #define INITIAL_PRIVILEGE_COUNT 3
359 typedef struct _INITIAL_PRIVILEGE_SET {
360 ULONG PrivilegeCount;
362 LUID_AND_ATTRIBUTES Privilege[INITIAL_PRIVILEGE_COUNT];
363 } INITIAL_PRIVILEGE_SET, * PINITIAL_PRIVILEGE_SET;
365 typedef struct _SECURITY_SUBJECT_CONTEXT {
366 PACCESS_TOKEN ClientToken;
367 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
368 PACCESS_TOKEN PrimaryToken;
369 PVOID ProcessAuditId;
370 } SECURITY_SUBJECT_CONTEXT, *PSECURITY_SUBJECT_CONTEXT;
372 typedef struct _ACCESS_STATE {
374 BOOLEAN SecurityEvaluated;
375 BOOLEAN GenerateAudit;
376 BOOLEAN GenerateOnClose;
377 BOOLEAN PrivilegesAllocated;
379 ACCESS_MASK RemainingDesiredAccess;
380 ACCESS_MASK PreviouslyGrantedAccess;
381 ACCESS_MASK OriginalDesiredAccess;
382 SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
383 PSECURITY_DESCRIPTOR SecurityDescriptor;
386 INITIAL_PRIVILEGE_SET InitialPrivilegeSet;
387 PRIVILEGE_SET PrivilegeSet;
390 BOOLEAN AuditPrivileges;
391 UNICODE_STRING ObjectName;
392 UNICODE_STRING ObjectTypeName;
393 } ACCESS_STATE, *PACCESS_STATE;
395 typedef struct _IO_SECURITY_CONTEXT {
396 PSECURITY_QUALITY_OF_SERVICE SecurityQos;
397 PACCESS_STATE AccessState;
398 ACCESS_MASK DesiredAccess;
399 ULONG FullCreateOptions;
400 } IO_SECURITY_CONTEXT, *PIO_SECURITY_CONTEXT;
402 typedef struct _DEVICE_CAPABILITIES {
407 ULONG LockSupported : 1;
408 ULONG EjectSupported : 1;
410 ULONG DockDevice : 1;
412 ULONG SilentInstall : 1;
413 ULONG RawDeviceOK : 1;
414 ULONG SurpriseRemovalOK : 1;
415 ULONG WakeFromD0 : 1;
416 ULONG WakeFromD1 : 1;
417 ULONG WakeFromD2 : 1;
418 ULONG WakeFromD3 : 1;
419 ULONG HardwareDisabled : 1;
420 ULONG NonDynamic : 1;
421 ULONG WarmEjectSupported : 1;
422 ULONG NoDisplayInUI : 1;
426 DEVICE_POWER_STATE DeviceState[PowerSystemMaximum];
427 SYSTEM_POWER_STATE SystemWake;
428 DEVICE_POWER_STATE DeviceWake;
432 } DEVICE_CAPABILITIES, *PDEVICE_CAPABILITIES;
434 typedef enum _INTERFACE_TYPE {
435 InterfaceTypeUndefined = -1,
453 } INTERFACE_TYPE, *PINTERFACE_TYPE;
455 typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS;
457 #define IO_RESOURCE_PREFERRED 0x01
458 #define IO_RESOURCE_DEFAULT 0x02
459 #define IO_RESOURCE_ALTERNATIVE 0x08
461 typedef struct _IO_RESOURCE_DESCRIPTOR {
464 UCHAR ShareDisposition;
472 PHYSICAL_ADDRESS MinimumAddress;
473 PHYSICAL_ADDRESS MaximumAddress;
478 PHYSICAL_ADDRESS MinimumAddress;
479 PHYSICAL_ADDRESS MaximumAddress;
486 ULONG MinimumChannel;
487 ULONG MaximumChannel;
492 PHYSICAL_ADDRESS MinimumAddress;
493 PHYSICAL_ADDRESS MaximumAddress;
510 } IO_RESOURCE_DESCRIPTOR, *PIO_RESOURCE_DESCRIPTOR;
512 typedef struct _IO_RESOURCE_LIST {
516 IO_RESOURCE_DESCRIPTOR Descriptors[1];
517 } IO_RESOURCE_LIST, *PIO_RESOURCE_LIST;
519 typedef struct _IO_RESOURCE_REQUIREMENTS_LIST {
521 INTERFACE_TYPE InterfaceType;
525 ULONG AlternativeLists;
526 IO_RESOURCE_LIST List[1];
527 } IO_RESOURCE_REQUIREMENTS_LIST, *PIO_RESOURCE_REQUIREMENTS_LIST;
529 typedef enum _BUS_QUERY_ID_TYPE {
532 BusQueryCompatibleIDs,
534 BusQueryDeviceSerialNumber
535 } BUS_QUERY_ID_TYPE, *PBUS_QUERY_ID_TYPE;
537 typedef enum _DEVICE_TEXT_TYPE {
538 DeviceTextDescription,
539 DeviceTextLocationInformation
540 } DEVICE_TEXT_TYPE, *PDEVICE_TEXT_TYPE;
542 typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE {
543 DeviceUsageTypeUndefined,
544 DeviceUsageTypePaging,
545 DeviceUsageTypeHibernation,
546 DeviceUsageTypeDumpFile
547 } DEVICE_USAGE_NOTIFICATION_TYPE;
549 typedef struct _POWER_SEQUENCE {
553 } POWER_SEQUENCE, *PPOWER_SEQUENCE;
555 typedef enum _POWER_STATE_TYPE {
558 } POWER_STATE_TYPE, *PPOWER_STATE_TYPE;
560 typedef union _POWER_STATE {
561 SYSTEM_POWER_STATE SystemState;
562 DEVICE_POWER_STATE DeviceState;
563 } POWER_STATE, *PPOWER_STATE;
565 typedef struct _CM_PARTIAL_RESOURCE_DESCRIPTOR {
567 UCHAR ShareDisposition;
571 PHYSICAL_ADDRESS Start;
575 PHYSICAL_ADDRESS Start;
584 PHYSICAL_ADDRESS Start;
604 } DeviceSpecificData;
606 } CM_PARTIAL_RESOURCE_DESCRIPTOR, *PCM_PARTIAL_RESOURCE_DESCRIPTOR;
608 typedef struct _CM_PARTIAL_RESOURCE_LIST {
612 CM_PARTIAL_RESOURCE_DESCRIPTOR PartialDescriptors[1];
613 } CM_PARTIAL_RESOURCE_LIST, *PCM_PARTIAL_RESOURCE_LIST;
615 typedef struct _CM_FULL_RESOURCE_DESCRIPTOR {
616 INTERFACE_TYPE InterfaceType;
618 CM_PARTIAL_RESOURCE_LIST PartialResourceList;
619 } CM_FULL_RESOURCE_DESCRIPTOR, *PCM_FULL_RESOURCE_DESCRIPTOR;
621 typedef struct _CM_RESOURCE_LIST {
623 CM_FULL_RESOURCE_DESCRIPTOR List[1];
624 } CM_RESOURCE_LIST, *PCM_RESOURCE_LIST;
626 typedef NTSTATUS (WINAPI *PIO_COMPLETION_ROUTINE)(
627 IN struct _DEVICE_OBJECT *DeviceObject,
631 #include <pshpack1.h>
632 typedef struct _IO_STACK_LOCATION {
639 PIO_SECURITY_CONTEXT SecurityContext;
641 USHORT POINTER_ALIGNMENT FileAttributes;
643 ULONG POINTER_ALIGNMENT EaLength;
647 ULONG POINTER_ALIGNMENT Key;
648 LARGE_INTEGER ByteOffset;
652 ULONG POINTER_ALIGNMENT Key;
653 LARGE_INTEGER ByteOffset;
657 FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
661 FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
662 PFILE_OBJECT FileObject;
665 BOOLEAN ReplaceIfExists;
674 FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
677 ULONG OutputBufferLength;
678 ULONG POINTER_ALIGNMENT InputBufferLength;
679 ULONG POINTER_ALIGNMENT IoControlCode;
680 PVOID Type3InputBuffer;
683 SECURITY_INFORMATION SecurityInformation;
684 ULONG POINTER_ALIGNMENT Length;
687 SECURITY_INFORMATION SecurityInformation;
688 PSECURITY_DESCRIPTOR SecurityDescriptor;
692 PDEVICE_OBJECT DeviceObject;
696 PDEVICE_OBJECT DeviceObject;
699 struct _SCSI_REQUEST_BLOCK *Srb;
702 DEVICE_RELATION_TYPE Type;
703 } QueryDeviceRelations;
705 CONST GUID *InterfaceType;
708 PINTERFACE Interface;
709 PVOID InterfaceSpecificData;
712 PDEVICE_CAPABILITIES Capabilities;
713 } DeviceCapabilities;
715 PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;
716 } FilterResourceRequirements;
721 ULONG POINTER_ALIGNMENT Length;
727 BUS_QUERY_ID_TYPE IdType;
730 DEVICE_TEXT_TYPE DeviceTextType;
731 LCID POINTER_ALIGNMENT LocaleId;
736 DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;
739 SYSTEM_POWER_STATE PowerState;
742 PPOWER_SEQUENCE PowerSequence;
746 POWER_STATE_TYPE POINTER_ALIGNMENT Type;
747 POWER_STATE POINTER_ALIGNMENT State;
748 POWER_ACTION POINTER_ALIGNMENT ShutdownType;
751 PCM_RESOURCE_LIST AllocatedResources;
752 PCM_RESOURCE_LIST AllocatedResourcesTranslated;
755 ULONG_PTR ProviderId;
767 PDEVICE_OBJECT DeviceObject;
768 PFILE_OBJECT FileObject;
769 PIO_COMPLETION_ROUTINE CompletionRoutine;
771 } IO_STACK_LOCATION, *PIO_STACK_LOCATION;
774 typedef struct _MDL {
778 struct _EPROCESS *Process;
779 PVOID MappedSystemVa;
785 typedef struct _KTIMER {
786 DISPATCHER_HEADER Header;
787 ULARGE_INTEGER DueTime;
788 LIST_ENTRY TimerListEntry;
793 typedef struct _KSYSTEM_TIME {
797 } KSYSTEM_TIME, *PKSYSTEM_TIME;
799 typedef enum _NT_PRODUCT_TYPE {
803 } NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;
805 #define PROCESSOR_FEATURE_MAX 64
807 typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
812 } ALTERNATIVE_ARCHITECTURE_TYPE;
814 typedef struct _KUSER_SHARED_DATA {
815 ULONG TickCountLowDeprecated;
816 ULONG TickCountMultiplier;
817 volatile KSYSTEM_TIME InterruptTime;
818 volatile KSYSTEM_TIME SystemTime;
819 volatile KSYSTEM_TIME TimeZoneBias;
820 USHORT ImageNumberLow;
821 USHORT ImageNumberHigh;
822 WCHAR NtSystemRoot[260];
823 ULONG MaxStckTraceDepth;
824 ULONG CryptoExponent;
826 ULONG LargePageMinimum;
828 NT_PRODUCT_TYPE NtProductType;
829 BOOLEAN ProductTypeIsValid;
830 ULONG MajorNtVersion;
831 ULONG MinorNtVersion;
832 BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];
835 volatile ULONG TimeSlip;
836 ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
837 LARGE_INTEGER SystemExpirationDate;
839 BOOLEAN KdDebuggerEnabled;
840 volatile ULONG ActiveConsoleId;
841 volatile ULONG DismountCount;
842 ULONG ComPlusPackage;
843 ULONG LastSystemRITEventTickCount;
844 ULONG NumberOfPhysicalPages;
845 BOOLEAN SafeBootMode;
848 ULONGLONG SystemCall[4];
850 volatile KSYSTEM_TIME TickCount;
851 volatile ULONG64 TickCountQuad;
853 } KSHARED_USER_DATA, *PKSHARED_USER_DATA;
855 NTSTATUS WINAPI ObCloseHandle(IN HANDLE handle);
857 #define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.CurrentStackLocation)
862 /* directory object access rights */
863 #define DIRECTORY_QUERY 0x0001
864 #define DIRECTORY_TRAVERSE 0x0002
865 #define DIRECTORY_CREATE_OBJECT 0x0004
866 #define DIRECTORY_CREATE_SUBDIRECTORY 0x0008
867 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)
869 /* symbolic link access rights */
870 #define SYMBOLIC_LINK_QUERY 0x0001
871 #define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
873 PVOID WINAPI ExAllocatePool(POOL_TYPE,SIZE_T);
874 PVOID WINAPI ExAllocatePoolWithQuota(POOL_TYPE,SIZE_T);
875 PVOID WINAPI ExAllocatePoolWithTag(POOL_TYPE,SIZE_T,ULONG);
876 PVOID WINAPI ExAllocatePoolWithQuotaTag(POOL_TYPE,SIZE_T,ULONG);
877 void WINAPI ExFreePool(PVOID);
878 void WINAPI ExFreePoolWithTag(PVOID,ULONG);
880 NTSTATUS WINAPI IoCreateDevice(DRIVER_OBJECT*,ULONG,UNICODE_STRING*,DEVICE_TYPE,ULONG,BOOLEAN,DEVICE_OBJECT**);
881 NTSTATUS WINAPI IoCreateDriver(UNICODE_STRING*,PDRIVER_INITIALIZE);
882 NTSTATUS WINAPI IoCreateSymbolicLink(UNICODE_STRING*,UNICODE_STRING*);
883 void WINAPI IoDeleteDevice(DEVICE_OBJECT*);
884 void WINAPI IoDeleteDriver(DRIVER_OBJECT*);
885 NTSTATUS WINAPI IoDeleteSymbolicLink(UNICODE_STRING*);
886 PEPROCESS WINAPI IoGetCurrentProcess(void);
888 PKTHREAD WINAPI KeGetCurrentThread(void);
889 void WINAPI KeQuerySystemTime(LARGE_INTEGER*);
890 void WINAPI KeQueryTickCount(LARGE_INTEGER*);
891 ULONG WINAPI KeQueryTimeIncrement(void);
893 PVOID WINAPI MmAllocateNonCachedMemory(SIZE_T);
894 void WINAPI MmFreeNonCachedMemory(PVOID,SIZE_T);
896 NTSTATUS WINAPI PsCreateSystemThread(PHANDLE,ULONG,POBJECT_ATTRIBUTES,HANDLE,PCLIENT_ID,PKSTART_ROUTINE,PVOID);
897 #define PsGetCurrentProcess() IoGetCurrentProcess()
898 #define PsGetCurrentThread() ((PETHREAD)KeGetCurrentThread())
899 HANDLE WINAPI PsGetCurrentProcessId(void);
900 HANDLE WINAPI PsGetCurrentThreadId(void);
901 BOOLEAN WINAPI PsGetVersion(ULONG*,ULONG*,ULONG*,UNICODE_STRING*);
902 NTSTATUS WINAPI PsTerminateSystemThread(NTSTATUS);
904 NTSTATUS WINAPI ZwAddBootEntry(PUNICODE_STRING,PUNICODE_STRING);
905 NTSTATUS WINAPI ZwAccessCheckAndAuditAlarm(PUNICODE_STRING,HANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,ACCESS_MASK,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PBOOLEAN,PBOOLEAN);
906 NTSTATUS WINAPI ZwAdjustPrivilegesToken(HANDLE,BOOLEAN,PTOKEN_PRIVILEGES,DWORD,PTOKEN_PRIVILEGES,PDWORD);
907 NTSTATUS WINAPI ZwAlertThread(HANDLE ThreadHandle);
908 NTSTATUS WINAPI ZwAllocateVirtualMemory(HANDLE,PVOID*,ULONG,SIZE_T*,ULONG,ULONG);
909 NTSTATUS WINAPI ZwCancelIoFile(HANDLE,PIO_STATUS_BLOCK);
910 NTSTATUS WINAPI ZwCancelTimer(HANDLE, BOOLEAN*);
911 NTSTATUS WINAPI ZwClearEvent(HANDLE);
912 NTSTATUS WINAPI ZwClose(HANDLE);
913 NTSTATUS WINAPI ZwCloseObjectAuditAlarm(PUNICODE_STRING,HANDLE,BOOLEAN);
914 NTSTATUS WINAPI ZwConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
915 NTSTATUS WINAPI ZwCreateDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
916 NTSTATUS WINAPI ZwCreateEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *,BOOLEAN,BOOLEAN);
917 NTSTATUS WINAPI ZwCreateFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG);
918 NTSTATUS WINAPI ZwCreateKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,PULONG);
919 NTSTATUS WINAPI ZwCreateSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const LARGE_INTEGER*,ULONG,ULONG,HANDLE);
920 NTSTATUS WINAPI ZwCreateSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PUNICODE_STRING);
921 NTSTATUS WINAPI ZwCreateTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*, TIMER_TYPE);
922 NTSTATUS WINAPI ZwDeleteAtom(RTL_ATOM);
923 NTSTATUS WINAPI ZwDeleteFile(POBJECT_ATTRIBUTES);
924 NTSTATUS WINAPI ZwDeleteKey(HANDLE);
925 NTSTATUS WINAPI ZwDeleteValueKey(HANDLE,const UNICODE_STRING *);
926 NTSTATUS WINAPI ZwDeviceIoControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
927 NTSTATUS WINAPI ZwDisplayString(PUNICODE_STRING);
928 NTSTATUS WINAPI ZwDuplicateObject(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,ULONG,ULONG);
929 NTSTATUS WINAPI ZwDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
930 NTSTATUS WINAPI ZwEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
931 NTSTATUS WINAPI ZwEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
932 NTSTATUS WINAPI ZwFlushInstructionCache(HANDLE,LPCVOID,SIZE_T);
933 NTSTATUS WINAPI ZwFlushKey(HANDLE);
934 NTSTATUS WINAPI ZwFlushVirtualMemory(HANDLE,LPCVOID*,SIZE_T*,ULONG);
935 NTSTATUS WINAPI ZwFreeVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
936 NTSTATUS WINAPI ZwFsControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
937 NTSTATUS WINAPI ZwInitiatePowerAction(POWER_ACTION,SYSTEM_POWER_STATE,ULONG,BOOLEAN);
938 NTSTATUS WINAPI ZwLoadDriver(const UNICODE_STRING *);
939 NTSTATUS WINAPI ZwLoadKey(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *);
940 NTSTATUS WINAPI ZwLockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
941 NTSTATUS WINAPI ZwMakeTemporaryObject(HANDLE);
942 NTSTATUS WINAPI ZwMapViewOfSection(HANDLE,HANDLE,PVOID*,ULONG,SIZE_T,const LARGE_INTEGER*,SIZE_T*,SECTION_INHERIT,ULONG,ULONG);
943 NTSTATUS WINAPI ZwNotifyChangeKey(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
944 NTSTATUS WINAPI ZwOpenDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
945 NTSTATUS WINAPI ZwOpenEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
946 NTSTATUS WINAPI ZwOpenFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG);
947 NTSTATUS WINAPI ZwOpenKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
948 NTSTATUS WINAPI ZwOpenProcess(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
949 NTSTATUS WINAPI ZwOpenProcessToken(HANDLE,DWORD,HANDLE *);
950 NTSTATUS WINAPI ZwOpenSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
951 NTSTATUS WINAPI ZwOpenSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
952 NTSTATUS WINAPI ZwOpenThread(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
953 NTSTATUS WINAPI ZwOpenThreadToken(HANDLE,DWORD,BOOLEAN,HANDLE *);
954 NTSTATUS WINAPI ZwOpenTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*);
955 NTSTATUS WINAPI ZwPowerInformation(POWER_INFORMATION_LEVEL,PVOID,ULONG,PVOID,ULONG);
956 NTSTATUS WINAPI ZwPulseEvent(HANDLE,PULONG);
957 NTSTATUS WINAPI ZwQueryDefaultLocale(BOOLEAN,LCID*);
958 NTSTATUS WINAPI ZwQueryDefaultUILanguage(LANGID*);
959 NTSTATUS WINAPI ZwQueryDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS,BOOLEAN,PUNICODE_STRING,BOOLEAN);
960 NTSTATUS WINAPI ZwQueryDirectoryObject(HANDLE,PDIRECTORY_BASIC_INFORMATION,ULONG,BOOLEAN,BOOLEAN,PULONG,PULONG);
961 NTSTATUS WINAPI ZwQueryEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,BOOLEAN,PVOID,ULONG,PVOID,BOOLEAN);
962 NTSTATUS WINAPI ZwQueryFullAttributesFile(const OBJECT_ATTRIBUTES*,FILE_NETWORK_OPEN_INFORMATION*);
963 NTSTATUS WINAPI ZwQueryInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,LONG,FILE_INFORMATION_CLASS);
964 NTSTATUS WINAPI ZwQueryInformationThread(HANDLE,THREADINFOCLASS,PVOID,ULONG,PULONG);
965 NTSTATUS WINAPI ZwQueryInformationToken(HANDLE,DWORD,PVOID,DWORD,LPDWORD);
966 NTSTATUS WINAPI ZwQueryInstallUILanguage(LANGID*);
967 NTSTATUS WINAPI ZwQueryKey(HANDLE,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
968 NTSTATUS WINAPI ZwQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
969 NTSTATUS WINAPI ZwQuerySecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR,ULONG,PULONG);
970 NTSTATUS WINAPI ZwQuerySection(HANDLE,SECTION_INFORMATION_CLASS,PVOID,ULONG,PULONG);
971 NTSTATUS WINAPI ZwQuerySymbolicLinkObject(HANDLE,PUNICODE_STRING,PULONG);
972 NTSTATUS WINAPI ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG);
973 NTSTATUS WINAPI ZwQueryTimerResolution(PULONG,PULONG,PULONG);
974 NTSTATUS WINAPI ZwQueryValueKey(HANDLE,const UNICODE_STRING *,KEY_VALUE_INFORMATION_CLASS,void *,DWORD,DWORD *);
975 NTSTATUS WINAPI ZwQueryVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
976 NTSTATUS WINAPI ZwReadFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG);
977 NTSTATUS WINAPI ZwReplaceKey(POBJECT_ATTRIBUTES,HANDLE,POBJECT_ATTRIBUTES);
978 NTSTATUS WINAPI ZwRequestWaitReplyPort(HANDLE,PLPC_MESSAGE,PLPC_MESSAGE);
979 NTSTATUS WINAPI ZwResetEvent(HANDLE,PULONG);
980 NTSTATUS WINAPI ZwRestoreKey(HANDLE,HANDLE,ULONG);
981 NTSTATUS WINAPI ZwSaveKey(HANDLE,HANDLE);
982 NTSTATUS WINAPI ZwSecureConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PSID,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
983 NTSTATUS WINAPI ZwSetDefaultLocale(BOOLEAN,LCID);
984 NTSTATUS WINAPI ZwSetDefaultUILanguage(LANGID);
985 NTSTATUS WINAPI ZwSetEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG);
986 NTSTATUS WINAPI ZwSetEvent(HANDLE,PULONG);
987 NTSTATUS WINAPI ZwSetInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS);
988 NTSTATUS WINAPI ZwSetInformationKey(HANDLE,const int,PVOID,ULONG);
989 NTSTATUS WINAPI ZwSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG);
990 NTSTATUS WINAPI ZwSetInformationProcess(HANDLE,PROCESS_INFORMATION_CLASS,PVOID,ULONG);
991 NTSTATUS WINAPI ZwSetInformationThread(HANDLE,THREADINFOCLASS,LPCVOID,ULONG);
992 NTSTATUS WINAPI ZwSetIoCompletion(HANDLE,ULONG,ULONG,NTSTATUS,ULONG);
993 NTSTATUS WINAPI ZwSetSecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR);
994 NTSTATUS WINAPI ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG);
995 NTSTATUS WINAPI ZwSetSystemTime(const LARGE_INTEGER*,LARGE_INTEGER*);
996 NTSTATUS WINAPI ZwSetTimer(HANDLE, const LARGE_INTEGER*, PTIMER_APC_ROUTINE, PVOID, BOOLEAN, ULONG, BOOLEAN*);
997 NTSTATUS WINAPI ZwSetValueKey(HANDLE,const UNICODE_STRING *,ULONG,ULONG,const void *,ULONG);
998 NTSTATUS WINAPI ZwSetVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
999 NTSTATUS WINAPI ZwSuspendThread(HANDLE,PULONG);
1000 NTSTATUS WINAPI ZwTerminateProcess(HANDLE,LONG);
1001 NTSTATUS WINAPI ZwUnloadDriver(const UNICODE_STRING *);
1002 NTSTATUS WINAPI ZwUnloadKey(HANDLE);
1003 NTSTATUS WINAPI ZwUnmapViewOfSection(HANDLE,PVOID);
1004 NTSTATUS WINAPI ZwWaitForSingleObject(HANDLE,BOOLEAN,const LARGE_INTEGER*);
1005 NTSTATUS WINAPI ZwWaitForMultipleObjects(ULONG,const HANDLE*,BOOLEAN,BOOLEAN,const LARGE_INTEGER*);
1006 NTSTATUS WINAPI ZwWriteFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,const void*,ULONG,PLARGE_INTEGER,PULONG);
1007 NTSTATUS WINAPI ZwYieldExecution(void);