2 * Copyright 2004-2005 Ivan Leo Puoti
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
26 #define POINTER_ALIGNMENT DECLSPEC_ALIGN(8)
28 #define POINTER_ALIGNMENT
31 typedef LONG KPRIORITY;
33 typedef ULONG_PTR KSPIN_LOCK, *PKSPIN_LOCK;
38 struct _DEVICE_OBJECT;
39 struct _DRIVER_OBJECT;
41 typedef VOID (WINAPI *PKDEFERRED_ROUTINE)(struct _KDPC *, PVOID, PVOID, PVOID);
42 typedef VOID (WINAPI *PKSTART_ROUTINE)(PVOID);
44 typedef NTSTATUS (WINAPI *PDRIVER_INITIALIZE)(struct _DRIVER_OBJECT *, PUNICODE_STRING);
45 typedef NTSTATUS (WINAPI *PDRIVER_DISPATCH)(struct _DEVICE_OBJECT *, struct _IRP *);
46 typedef void (WINAPI *PDRIVER_STARTIO)(struct _DEVICE_OBJECT *, struct _IRP *);
47 typedef void (WINAPI *PDRIVER_UNLOAD)(struct _DRIVER_OBJECT *);
49 typedef struct _DISPATCHER_HEADER {
55 LIST_ENTRY WaitListHead;
56 } DISPATCHER_HEADER, *PDISPATCHER_HEADER;
58 typedef struct _KEVENT {
59 DISPATCHER_HEADER Header;
60 } KEVENT, *PKEVENT, *RESTRICTED_POINTER PRKEVENT;
62 typedef struct _KSEMAPHORE {
63 DISPATCHER_HEADER Header;
65 } KSEMAPHORE, *PKSEMAPHORE, *PRKSEMAPHORE;
67 typedef struct _KDPC {
71 LIST_ENTRY DpcListEntry;
72 PKDEFERRED_ROUTINE DeferredRoutine;
73 PVOID DeferredContext;
74 PVOID SystemArgument1;
75 PVOID SystemArgument2;
77 } KDPC, *PKDPC, *RESTRICTED_POINTER PRKDPC;
79 typedef struct _KDEVICE_QUEUE_ENTRY {
80 LIST_ENTRY DeviceListEntry;
83 } KDEVICE_QUEUE_ENTRY, *PKDEVICE_QUEUE_ENTRY,
84 *RESTRICTED_POINTER PRKDEVICE_QUEUE_ENTRY;
86 typedef struct _KDEVICE_QUEUE {
89 LIST_ENTRY DeviceListHead;
92 } KDEVICE_QUEUE, *PKDEVICE_QUEUE, *RESTRICTED_POINTER PRKDEVICE_QUEUE;
94 typedef struct _KMUTANT {
95 DISPATCHER_HEADER Header;
96 LIST_ENTRY MutantListEntry;
97 struct _KTHREAD *RESTRICTED_POINTER OwnerThread;
100 } KMUTANT, *PKMUTANT, *RESTRICTED_POINTER PRKMUTANT, KMUTEX, *PKMUTEX, *RESTRICTED_POINTER PRKMUTEX;
102 typedef enum _KWAIT_REASON
132 typedef struct _ALLOCATE_FUNCTION *PALLOCATE_FUNCTION;
133 typedef struct _IO_TIMER *PIO_TIMER;
134 typedef struct _IO_TIMER_ROUTINE *PIO_TIMER_ROUTINE;
135 typedef struct _ETHREAD *PETHREAD;
136 typedef struct _FREE_FUNCTION *PFREE_FUNCTION;
137 typedef struct _KTHREAD *PKTHREAD, *PRKTHREAD;
138 typedef struct _EPROCESS *PEPROCESS;
139 typedef struct _ERESOURCE *PERESOURCE;
140 typedef struct _IO_WORKITEM *PIO_WORKITEM;
141 typedef struct _NPAGED_LOOKASIDE_LIST *PNPAGED_LOOKASIDE_LIST;
142 typedef struct _PAGED_LOOKASIDE_LIST *PPAGED_LOOKASIDE_LIST;
143 typedef struct _OBJECT_TYPE *POBJECT_TYPE;
144 typedef struct _OBJECT_HANDLE_INFORMATION *POBJECT_HANDLE_INFORMATION;
145 typedef struct _ZONE_HEADER *PZONE_HEADER;
147 typedef struct _FAST_MUTEX
154 } FAST_MUTEX, *PFAST_MUTEX;
156 #define MAXIMUM_VOLUME_LABEL_LENGTH (32 * sizeof(WCHAR))
158 typedef struct _VPB {
162 USHORT VolumeLabelLength;
163 struct _DEVICE_OBJECT *DeviceObject;
164 struct _DEVICE_OBJECT *RealDevice;
166 ULONG ReferenceCount;
167 WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH / sizeof(WCHAR)];
170 typedef enum _POOL_TYPE {
173 NonPagedPoolMustSucceed,
175 NonPagedPoolCacheAligned,
176 PagedPoolCacheAligned,
177 NonPagedPoolCacheAlignedMustS,
181 typedef struct _WAIT_CONTEXT_BLOCK {
182 KDEVICE_QUEUE_ENTRY WaitQueueEntry;
183 struct _DRIVER_CONTROL *DeviceRoutine;
185 ULONG NumberOfMapRegisters;
188 PKDPC BufferChainingDpc;
189 } WAIT_CONTEXT_BLOCK, *PWAIT_CONTEXT_BLOCK;
191 #define DO_BUFFERED_IO 0x00000004
192 #define DO_EXCLUSIVE 0x00000008
193 #define DO_DIRECT_IO 0x00000010
194 #define DO_MAP_IO_BUFFER 0x00000020
195 #define DO_DEVICE_INITIALIZING 0x00000080
196 #define DO_SHUTDOWN_REGISTERED 0x00000800
197 #define DO_BUS_ENUMERATED_DEVICE 0x00001000
198 #define DO_POWER_PAGABLE 0x00002000
199 #define DO_POWER_INRUSH 0x00004000
201 #define IO_NO_INCREMENT 0
202 #define IO_CD_ROM_INCREMENT 1
203 #define IO_DISK_INCREMENT 1
204 #define IO_KEYBOARD_INCREMENT 6
205 #define IO_MAILSLOT_INCREMENT 2
206 #define IO_MOUSE_INCREMENT 6
207 #define IO_NAMED_PIPE_INCREMENT 2
208 #define IO_NETWORK_INCREMENT 2
209 #define IO_PARALLEL_INCREMENT 1
210 #define IO_SERIAL_INCREMENT 2
211 #define IO_SOUND_INCREMENT 8
212 #define IO_VIDEO_INCREMENT 1
215 #define DEVICE_TYPE ULONG
217 #define IRP_MJ_MAXIMUM_FUNCTION 0x1b
218 #define IRP_MJ_CREATE 0x00
219 #define IRP_MJ_CREATE_NAMED_PIPE 0x01
220 #define IRP_MJ_CLOSE 0x02
221 #define IRP_MJ_READ 0x03
222 #define IRP_MJ_WRITE 0x04
223 #define IRP_MJ_QUERY_INFORMATION 0x05
224 #define IRP_MJ_SET_INFORMATION 0x06
225 #define IRP_MJ_QUERY_EA 0x07
226 #define IRP_MJ_SET_EA 0x08
227 #define IRP_MJ_FLUSH_BUFFERS 0x09
228 #define IRP_MJ_QUERY_VOLUME_INFORMATION 0x0a
229 #define IRP_MJ_SET_VOLUME_INFORMATION 0x0b
230 #define IRP_MJ_DIRECTORY_CONTROL 0x0c
231 #define IRP_MJ_FILE_SYSTEM_CONTROL 0x0d
232 #define IRP_MJ_DEVICE_CONTROL 0x0e
233 #define IRP_MJ_INTERNAL_DEVICE_CONTROL 0x0f
234 #define IRP_MJ_SHUTDOWN 0x10
235 #define IRP_MJ_LOCK_CONTROL 0x11
236 #define IRP_MJ_CLEANUP 0x12
237 #define IRP_MJ_CREATE_MAILSLOT 0x13
238 #define IRP_MJ_QUERY_SECURITY 0x14
239 #define IRP_MJ_SET_SECURITY 0x15
240 #define IRP_MJ_POWER 0x16
241 #define IRP_MJ_SYSTEM_CONTROL 0x17
242 #define IRP_MJ_DEVICE_CHANGE 0x18
243 #define IRP_MJ_QUERY_QUOTA 0x19
244 #define IRP_MJ_SET_QUOTA 0x1a
245 #define IRP_MJ_PNP 0x1b
247 #define IRP_MN_START_DEVICE 0x00
248 #define IRP_MN_QUERY_REMOVE_DEVICE 0x01
249 #define IRP_MN_REMOVE_DEVICE 0x02
250 #define IRP_MN_CANCEL_REMOVE_DEVICE 0x03
251 #define IRP_MN_STOP_DEVICE 0x04
252 #define IRP_MN_QUERY_STOP_DEVICE 0x05
253 #define IRP_MN_CANCEL_STOP_DEVICE 0x06
254 #define IRP_MN_QUERY_DEVICE_RELATIONS 0x07
255 #define IRP_MN_QUERY_INTERFACE 0x08
256 #define IRP_MN_QUERY_CAPABILITIES 0x09
257 #define IRP_MN_QUERY_RESOURCES 0x0A
258 #define IRP_MN_QUERY_RESOURCE_REQUIREMENTS 0x0B
259 #define IRP_MN_QUERY_DEVICE_TEXT 0x0C
260 #define IRP_MN_FILTER_RESOURCE_REQUIREMENTS 0x0D
261 #define IRP_MN_READ_CONFIG 0x0F
262 #define IRP_MN_WRITE_CONFIG 0x10
263 #define IRP_MN_EJECT 0x11
264 #define IRP_MN_SET_LOCK 0x12
265 #define IRP_MN_QUERY_ID 0x13
266 #define IRP_MN_QUERY_PNP_DEVICE_STATE 0x14
267 #define IRP_MN_QUERY_BUS_INFORMATION 0x15
268 #define IRP_MN_DEVICE_USAGE_NOTIFICATION 0x16
269 #define IRP_MN_SURPRISE_REMOVAL 0x17
271 #define IRP_QUOTA_CHARGED 0x01
272 #define IRP_ALLOCATED_MUST_SUCCEED 0x02
273 #define IRP_ALLOCATED_FIXED_SIZE 0x04
274 #define IRP_LOOKASIDE_ALLOCATION 0x08
276 #define IO_TYPE_ADAPTER 0x01
277 #define IO_TYPE_CONTROLLER 0x02
278 #define IO_TYPE_DEVICE 0x03
279 #define IO_TYPE_DRIVER 0x04
280 #define IO_TYPE_FILE 0x05
281 #define IO_TYPE_IRP 0x06
282 #define IO_TYPE_MASTER_ADAPTER 0x07
283 #define IO_TYPE_OPEN_PACKET 0x08
284 #define IO_TYPE_TIMER 0x09
285 #define IO_TYPE_VPB 0x0a
286 #define IO_TYPE_ERROR_LOG 0x0b
287 #define IO_TYPE_ERROR_MESSAGE 0x0c
288 #define IO_TYPE_DEVICE_OBJECT_EXTENSION 0x0d
290 typedef struct _DEVICE_OBJECT {
294 struct _DRIVER_OBJECT *DriverObject;
295 struct _DEVICE_OBJECT *NextDevice;
296 struct _DEVICE_OBJECT *AttachedDevice;
297 struct _IRP *CurrentIrp;
300 ULONG Characteristics;
302 PVOID DeviceExtension;
303 DEVICE_TYPE DeviceType;
306 LIST_ENTRY ListEntry;
307 WAIT_CONTEXT_BLOCK Wcb;
309 ULONG AlignmentRequirement;
310 KDEVICE_QUEUE DeviceQueue;
312 ULONG ActiveThreadCount;
313 PSECURITY_DESCRIPTOR SecurityDescriptor;
317 struct _DEVOBJ_EXTENSION *DeviceObjectExtension;
320 typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT;
322 typedef struct _DRIVER_EXTENSION {
323 struct _DRIVER_OBJECT *DriverObject;
326 UNICODE_STRING ServiceKeyName;
327 } DRIVER_EXTENSION, *PDRIVER_EXTENSION;
329 typedef struct _DRIVER_OBJECT {
332 PDEVICE_OBJECT DeviceObject;
337 PDRIVER_EXTENSION DriverExtension;
338 UNICODE_STRING DriverName;
339 PUNICODE_STRING HardwareDatabase;
340 PVOID FastIoDispatch;
341 PDRIVER_INITIALIZE DriverInit;
342 PDRIVER_STARTIO DriverStartIo;
343 PDRIVER_UNLOAD DriverUnload;
344 PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];
346 typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT;
348 /* Irp definitions */
349 typedef UCHAR KIRQL, *PKIRQL;
350 typedef CCHAR KPROCESSOR_MODE;
352 typedef VOID (WINAPI *PDRIVER_CANCEL)(
353 IN struct _DEVICE_OBJECT *DeviceObject,
354 IN struct _IRP *Irp);
356 typedef VOID (WINAPI *PKNORMAL_ROUTINE)(
357 IN PVOID NormalContext,
358 IN PVOID SystemArgument1,
359 IN PVOID SystemArgument2);
361 typedef VOID (WINAPI *PKKERNEL_ROUTINE)(
362 IN struct _KAPC *Apc,
363 IN OUT PKNORMAL_ROUTINE *NormalRoutine,
364 IN OUT PVOID *NormalContext,
365 IN OUT PVOID *SystemArgument1,
366 IN OUT PVOID *SystemArgument2);
368 typedef VOID (WINAPI *PKRUNDOWN_ROUTINE)(
369 IN struct _KAPC *Apc);
371 typedef struct _KAPC {
375 struct _KTHREAD *Thread;
376 LIST_ENTRY ApcListEntry;
377 PKKERNEL_ROUTINE KernelRoutine;
378 PKRUNDOWN_ROUTINE RundownRoutine;
379 PKNORMAL_ROUTINE NormalRoutine;
381 PVOID SystemArgument1;
382 PVOID SystemArgument2;
384 KPROCESSOR_MODE ApcMode;
386 } KAPC, *PKAPC, *RESTRICTED_POINTER PRKAPC;
388 #include <pshpack1.h>
389 typedef struct _IRP {
392 struct _MDL *MdlAddress;
395 struct _IRP *MasterIrp;
399 LIST_ENTRY ThreadListEntry;
400 IO_STATUS_BLOCK IoStatus;
401 KPROCESSOR_MODE RequestorMode;
402 BOOLEAN PendingReturned;
404 CHAR CurrentLocation;
407 CCHAR ApcEnvironment;
408 UCHAR AllocationFlags;
409 PIO_STATUS_BLOCK UserIosb;
413 PIO_APC_ROUTINE UserApcRoutine;
414 PVOID UserApcContext;
415 } AsynchronousParameters;
416 LARGE_INTEGER AllocationSize;
418 PDRIVER_CANCEL CancelRoutine;
423 KDEVICE_QUEUE_ENTRY DeviceQueueEntry;
425 PVOID DriverContext[4];
429 PCHAR AuxiliaryBuffer;
431 LIST_ENTRY ListEntry;
433 struct _IO_STACK_LOCATION *CurrentStackLocation;
437 struct _FILE_OBJECT *OriginalFileObject;
443 typedef struct _IRP *PIRP;
446 /* MDL definitions */
448 typedef VOID (WINAPI *PINTERFACE_REFERENCE)(
451 typedef VOID (WINAPI *PINTERFACE_DEREFERENCE)(
454 typedef struct _INTERFACE {
458 PINTERFACE_REFERENCE InterfaceReference;
459 PINTERFACE_DEREFERENCE InterfaceDereference;
460 } INTERFACE, *PINTERFACE;
462 typedef struct _SECTION_OBJECT_POINTERS {
463 PVOID DataSectionObject;
464 PVOID SharedCacheMap;
465 PVOID ImageSectionObject;
466 } SECTION_OBJECT_POINTERS, *PSECTION_OBJECT_POINTERS;
468 typedef struct _IO_COMPLETION_CONTEXT {
471 } IO_COMPLETION_CONTEXT, *PIO_COMPLETION_CONTEXT;
473 typedef enum _DEVICE_RELATION_TYPE {
478 TargetDeviceRelation,
480 } DEVICE_RELATION_TYPE, *PDEVICE_RELATION_TYPE;
482 typedef struct _FILE_OBJECT {
485 PDEVICE_OBJECT DeviceObject;
489 PSECTION_OBJECT_POINTERS SectionObjectPointer;
490 PVOID PrivateCacheMap;
491 NTSTATUS FinalStatus;
492 struct _FILE_OBJECT *RelatedFileObject;
493 BOOLEAN LockOperation;
494 BOOLEAN DeletePending;
497 BOOLEAN DeleteAccess;
500 BOOLEAN SharedDelete;
502 UNICODE_STRING FileName;
503 LARGE_INTEGER CurrentByteOffset;
509 PIO_COMPLETION_CONTEXT CompletionContext;
511 typedef struct _FILE_OBJECT *PFILE_OBJECT;
513 #define INITIAL_PRIVILEGE_COUNT 3
515 typedef struct _INITIAL_PRIVILEGE_SET {
516 ULONG PrivilegeCount;
518 LUID_AND_ATTRIBUTES Privilege[INITIAL_PRIVILEGE_COUNT];
519 } INITIAL_PRIVILEGE_SET, * PINITIAL_PRIVILEGE_SET;
521 typedef struct _SECURITY_SUBJECT_CONTEXT {
522 PACCESS_TOKEN ClientToken;
523 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
524 PACCESS_TOKEN PrimaryToken;
525 PVOID ProcessAuditId;
526 } SECURITY_SUBJECT_CONTEXT, *PSECURITY_SUBJECT_CONTEXT;
528 typedef struct _ACCESS_STATE {
530 BOOLEAN SecurityEvaluated;
531 BOOLEAN GenerateAudit;
532 BOOLEAN GenerateOnClose;
533 BOOLEAN PrivilegesAllocated;
535 ACCESS_MASK RemainingDesiredAccess;
536 ACCESS_MASK PreviouslyGrantedAccess;
537 ACCESS_MASK OriginalDesiredAccess;
538 SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
539 PSECURITY_DESCRIPTOR SecurityDescriptor;
542 INITIAL_PRIVILEGE_SET InitialPrivilegeSet;
543 PRIVILEGE_SET PrivilegeSet;
546 BOOLEAN AuditPrivileges;
547 UNICODE_STRING ObjectName;
548 UNICODE_STRING ObjectTypeName;
549 } ACCESS_STATE, *PACCESS_STATE;
551 typedef struct _IO_SECURITY_CONTEXT {
552 PSECURITY_QUALITY_OF_SERVICE SecurityQos;
553 PACCESS_STATE AccessState;
554 ACCESS_MASK DesiredAccess;
555 ULONG FullCreateOptions;
556 } IO_SECURITY_CONTEXT, *PIO_SECURITY_CONTEXT;
558 typedef struct _DEVICE_CAPABILITIES {
563 ULONG LockSupported : 1;
564 ULONG EjectSupported : 1;
566 ULONG DockDevice : 1;
568 ULONG SilentInstall : 1;
569 ULONG RawDeviceOK : 1;
570 ULONG SurpriseRemovalOK : 1;
571 ULONG WakeFromD0 : 1;
572 ULONG WakeFromD1 : 1;
573 ULONG WakeFromD2 : 1;
574 ULONG WakeFromD3 : 1;
575 ULONG HardwareDisabled : 1;
576 ULONG NonDynamic : 1;
577 ULONG WarmEjectSupported : 1;
578 ULONG NoDisplayInUI : 1;
582 DEVICE_POWER_STATE DeviceState[PowerSystemMaximum];
583 SYSTEM_POWER_STATE SystemWake;
584 DEVICE_POWER_STATE DeviceWake;
588 } DEVICE_CAPABILITIES, *PDEVICE_CAPABILITIES;
590 typedef enum _INTERFACE_TYPE {
591 InterfaceTypeUndefined = -1,
609 } INTERFACE_TYPE, *PINTERFACE_TYPE;
611 typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS;
613 #define IO_RESOURCE_PREFERRED 0x01
614 #define IO_RESOURCE_DEFAULT 0x02
615 #define IO_RESOURCE_ALTERNATIVE 0x08
617 typedef struct _IO_RESOURCE_DESCRIPTOR {
620 UCHAR ShareDisposition;
628 PHYSICAL_ADDRESS MinimumAddress;
629 PHYSICAL_ADDRESS MaximumAddress;
634 PHYSICAL_ADDRESS MinimumAddress;
635 PHYSICAL_ADDRESS MaximumAddress;
642 ULONG MinimumChannel;
643 ULONG MaximumChannel;
648 PHYSICAL_ADDRESS MinimumAddress;
649 PHYSICAL_ADDRESS MaximumAddress;
666 } IO_RESOURCE_DESCRIPTOR, *PIO_RESOURCE_DESCRIPTOR;
668 typedef struct _IO_RESOURCE_LIST {
672 IO_RESOURCE_DESCRIPTOR Descriptors[1];
673 } IO_RESOURCE_LIST, *PIO_RESOURCE_LIST;
675 typedef struct _IO_RESOURCE_REQUIREMENTS_LIST {
677 INTERFACE_TYPE InterfaceType;
681 ULONG AlternativeLists;
682 IO_RESOURCE_LIST List[1];
683 } IO_RESOURCE_REQUIREMENTS_LIST, *PIO_RESOURCE_REQUIREMENTS_LIST;
685 typedef enum _BUS_QUERY_ID_TYPE {
688 BusQueryCompatibleIDs,
690 BusQueryDeviceSerialNumber
691 } BUS_QUERY_ID_TYPE, *PBUS_QUERY_ID_TYPE;
694 DevicePropertyDeviceDescription,
695 DevicePropertyHardwareID,
696 DevicePropertyCompatibleIDs,
697 DevicePropertyBootConfiguration,
698 DevicePropertyBootConfigurationTranslated,
699 DevicePropertyClassName,
700 DevicePropertyClassGuid,
701 DevicePropertyDriverKeyName,
702 DevicePropertyManufacturer,
703 DevicePropertyFriendlyName,
704 DevicePropertyLocationInformation,
705 DevicePropertyPhysicalDeviceObjectName,
706 DevicePropertyBusTypeGuid,
707 DevicePropertyLegacyBusType,
708 DevicePropertyBusNumber,
709 DevicePropertyEnumeratorName,
710 DevicePropertyAddress,
711 DevicePropertyUINumber,
712 DevicePropertyInstallState,
713 DevicePropertyRemovalPolicy
714 } DEVICE_REGISTRY_PROPERTY;
716 typedef enum _DEVICE_TEXT_TYPE {
717 DeviceTextDescription,
718 DeviceTextLocationInformation
719 } DEVICE_TEXT_TYPE, *PDEVICE_TEXT_TYPE;
721 typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE {
722 DeviceUsageTypeUndefined,
723 DeviceUsageTypePaging,
724 DeviceUsageTypeHibernation,
725 DeviceUsageTypeDumpFile
726 } DEVICE_USAGE_NOTIFICATION_TYPE;
728 typedef struct _POWER_SEQUENCE {
732 } POWER_SEQUENCE, *PPOWER_SEQUENCE;
734 typedef enum _POWER_STATE_TYPE {
737 } POWER_STATE_TYPE, *PPOWER_STATE_TYPE;
739 typedef union _POWER_STATE {
740 SYSTEM_POWER_STATE SystemState;
741 DEVICE_POWER_STATE DeviceState;
742 } POWER_STATE, *PPOWER_STATE;
744 typedef struct _CM_PARTIAL_RESOURCE_DESCRIPTOR {
746 UCHAR ShareDisposition;
750 PHYSICAL_ADDRESS Start;
754 PHYSICAL_ADDRESS Start;
763 PHYSICAL_ADDRESS Start;
783 } DeviceSpecificData;
785 } CM_PARTIAL_RESOURCE_DESCRIPTOR, *PCM_PARTIAL_RESOURCE_DESCRIPTOR;
787 typedef struct _CM_PARTIAL_RESOURCE_LIST {
791 CM_PARTIAL_RESOURCE_DESCRIPTOR PartialDescriptors[1];
792 } CM_PARTIAL_RESOURCE_LIST, *PCM_PARTIAL_RESOURCE_LIST;
794 typedef struct _CM_FULL_RESOURCE_DESCRIPTOR {
795 INTERFACE_TYPE InterfaceType;
797 CM_PARTIAL_RESOURCE_LIST PartialResourceList;
798 } CM_FULL_RESOURCE_DESCRIPTOR, *PCM_FULL_RESOURCE_DESCRIPTOR;
800 typedef struct _CM_RESOURCE_LIST {
802 CM_FULL_RESOURCE_DESCRIPTOR List[1];
803 } CM_RESOURCE_LIST, *PCM_RESOURCE_LIST;
805 typedef NTSTATUS (WINAPI *PIO_COMPLETION_ROUTINE)(
806 IN struct _DEVICE_OBJECT *DeviceObject,
810 #define SL_PENDING_RETURNED 0x01
811 #define SL_INVOKE_ON_CANCEL 0x20
812 #define SL_INVOKE_ON_SUCCESS 0x40
813 #define SL_INVOKE_ON_ERROR 0x80
815 #include <pshpack1.h>
816 typedef struct _IO_STACK_LOCATION {
823 PIO_SECURITY_CONTEXT SecurityContext;
825 USHORT POINTER_ALIGNMENT FileAttributes;
827 ULONG POINTER_ALIGNMENT EaLength;
831 ULONG POINTER_ALIGNMENT Key;
832 LARGE_INTEGER ByteOffset;
836 ULONG POINTER_ALIGNMENT Key;
837 LARGE_INTEGER ByteOffset;
841 FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
845 FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
846 PFILE_OBJECT FileObject;
849 BOOLEAN ReplaceIfExists;
858 FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
861 ULONG OutputBufferLength;
862 ULONG POINTER_ALIGNMENT InputBufferLength;
863 ULONG POINTER_ALIGNMENT IoControlCode;
864 PVOID Type3InputBuffer;
867 SECURITY_INFORMATION SecurityInformation;
868 ULONG POINTER_ALIGNMENT Length;
871 SECURITY_INFORMATION SecurityInformation;
872 PSECURITY_DESCRIPTOR SecurityDescriptor;
876 PDEVICE_OBJECT DeviceObject;
880 PDEVICE_OBJECT DeviceObject;
883 struct _SCSI_REQUEST_BLOCK *Srb;
886 DEVICE_RELATION_TYPE Type;
887 } QueryDeviceRelations;
889 CONST GUID *InterfaceType;
892 PINTERFACE Interface;
893 PVOID InterfaceSpecificData;
896 PDEVICE_CAPABILITIES Capabilities;
897 } DeviceCapabilities;
899 PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;
900 } FilterResourceRequirements;
905 ULONG POINTER_ALIGNMENT Length;
911 BUS_QUERY_ID_TYPE IdType;
914 DEVICE_TEXT_TYPE DeviceTextType;
915 LCID POINTER_ALIGNMENT LocaleId;
920 DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;
923 SYSTEM_POWER_STATE PowerState;
926 PPOWER_SEQUENCE PowerSequence;
930 POWER_STATE_TYPE POINTER_ALIGNMENT Type;
931 POWER_STATE POINTER_ALIGNMENT State;
932 POWER_ACTION POINTER_ALIGNMENT ShutdownType;
935 PCM_RESOURCE_LIST AllocatedResources;
936 PCM_RESOURCE_LIST AllocatedResourcesTranslated;
939 ULONG_PTR ProviderId;
951 PDEVICE_OBJECT DeviceObject;
952 PFILE_OBJECT FileObject;
953 PIO_COMPLETION_ROUTINE CompletionRoutine;
955 } IO_STACK_LOCATION, *PIO_STACK_LOCATION;
958 typedef struct _MDL {
962 struct _EPROCESS *Process;
963 PVOID MappedSystemVa;
969 typedef struct _KTIMER {
970 DISPATCHER_HEADER Header;
971 ULARGE_INTEGER DueTime;
972 LIST_ENTRY TimerListEntry;
977 typedef struct _KSYSTEM_TIME {
981 } KSYSTEM_TIME, *PKSYSTEM_TIME;
983 typedef enum _NT_PRODUCT_TYPE {
987 } NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;
989 #define PROCESSOR_FEATURE_MAX 64
991 typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
996 } ALTERNATIVE_ARCHITECTURE_TYPE;
998 #define NX_SUPPORT_POLICY_ALWAYSOFF 0
999 #define NX_SUPPORT_POLICY_ALWAYSON 1
1000 #define NX_SUPPORT_POLICY_OPTIN 2
1001 #define NX_SUPPORT_POLICY_OPTOUT 3
1003 #define MAX_WOW64_SHARED_ENTRIES 16
1005 typedef struct _KUSER_SHARED_DATA {
1006 ULONG TickCountLowDeprecated;
1007 ULONG TickCountMultiplier;
1008 volatile KSYSTEM_TIME InterruptTime;
1009 volatile KSYSTEM_TIME SystemTime;
1010 volatile KSYSTEM_TIME TimeZoneBias;
1011 USHORT ImageNumberLow;
1012 USHORT ImageNumberHigh;
1013 WCHAR NtSystemRoot[260];
1014 ULONG MaxStackTraceDepth;
1015 ULONG CryptoExponent;
1017 ULONG LargePageMinimum;
1019 NT_PRODUCT_TYPE NtProductType;
1020 BOOLEAN ProductTypeIsValid;
1021 ULONG NtMajorVersion;
1022 ULONG NtMinorVersion;
1023 BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];
1026 volatile ULONG TimeSlip;
1027 ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
1028 LARGE_INTEGER SystemExpirationDate;
1030 BOOLEAN KdDebuggerEnabled;
1031 UCHAR NXSupportPolicy;
1032 volatile ULONG ActiveConsoleId;
1033 volatile ULONG DismountCount;
1034 ULONG ComPlusPackage;
1035 ULONG LastSystemRITEventTickCount;
1036 ULONG NumberOfPhysicalPages;
1037 BOOLEAN SafeBootMode;
1039 ULONGLONG TestRetInstruction;
1041 ULONG SystemCallReturn;
1042 ULONGLONG SystemCallPad[3];
1044 volatile KSYSTEM_TIME TickCount;
1045 volatile ULONG64 TickCountQuad;
1048 ULONG Wow64SharedInformation[MAX_WOW64_SHARED_ENTRIES];
1049 } KSHARED_USER_DATA, *PKSHARED_USER_DATA;
1051 typedef enum _MEMORY_CACHING_TYPE {
1054 MmWriteCombined = 2,
1055 MmHardwareCoherentCached = 3,
1056 MmNonCachedUnordered = 4,
1058 MmMaximumCacheType = 6
1059 } MEMORY_CACHING_TYPE;
1061 typedef enum _MM_SYSTEM_SIZE
1068 typedef struct _IO_REMOVE_LOCK_COMMON_BLOCK {
1070 BOOLEAN Reserved[3];
1073 } IO_REMOVE_LOCK_COMMON_BLOCK;
1075 typedef struct _IO_REMOVE_LOCK_TRACKING_BLOCK *PIO_REMOVE_LOCK_TRACKING_BLOCK;
1077 typedef struct _IO_REMOVE_LOCK_DBG_BLOCK {
1080 LONGLONG MaxLockedTicks;
1082 LIST_ENTRY LockList;
1084 LONG LowMemoryCount;
1087 PIO_REMOVE_LOCK_TRACKING_BLOCK Blocks;
1088 } IO_REMOVE_LOCK_DBG_BLOCK;
1090 typedef struct _IO_REMOVE_LOCK {
1091 IO_REMOVE_LOCK_COMMON_BLOCK Common;
1092 IO_REMOVE_LOCK_DBG_BLOCK Dbg;
1093 } IO_REMOVE_LOCK, *PIO_REMOVE_LOCK;
1095 NTSTATUS WINAPI ObCloseHandle(IN HANDLE handle);
1097 #ifdef NONAMELESSUNION
1098 # ifdef NONAMELESSSTRUCT
1099 # define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.u2.CurrentStackLocation)
1100 # define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.u2.CurrentStackLocation - 1)
1102 # define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.u2.CurrentStackLocation)
1103 # define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.u2.CurrentStackLocation - 1)
1106 # ifdef NONAMELESSSTRUCT
1107 # define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.CurrentStackLocation)
1108 # define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.CurrentStackLocation - 1)
1110 # define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.CurrentStackLocation)
1111 # define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.CurrentStackLocation - 1)
1115 #define KernelMode 0
1118 /* directory object access rights */
1119 #define DIRECTORY_QUERY 0x0001
1120 #define DIRECTORY_TRAVERSE 0x0002
1121 #define DIRECTORY_CREATE_OBJECT 0x0004
1122 #define DIRECTORY_CREATE_SUBDIRECTORY 0x0008
1123 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)
1125 /* symbolic link access rights */
1126 #define SYMBOLIC_LINK_QUERY 0x0001
1127 #define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
1129 PVOID WINAPI ExAllocatePool(POOL_TYPE,SIZE_T);
1130 PVOID WINAPI ExAllocatePoolWithQuota(POOL_TYPE,SIZE_T);
1131 PVOID WINAPI ExAllocatePoolWithTag(POOL_TYPE,SIZE_T,ULONG);
1132 PVOID WINAPI ExAllocatePoolWithQuotaTag(POOL_TYPE,SIZE_T,ULONG);
1133 void WINAPI ExFreePool(PVOID);
1134 void WINAPI ExFreePoolWithTag(PVOID,ULONG);
1136 NTSTATUS WINAPI IoAllocateDriverObjectExtension(PDRIVER_OBJECT,PVOID,ULONG,PVOID*);
1137 PVOID WINAPI IoAllocateErrorLogEntry(PVOID,UCHAR);
1138 PIRP WINAPI IoAllocateIrp(CCHAR,BOOLEAN);
1139 NTSTATUS WINAPI IoCallDriver(DEVICE_OBJECT*,IRP*);
1140 VOID WINAPI IoCompleteRequest(IRP*,UCHAR);
1141 NTSTATUS WINAPI IoCreateDevice(DRIVER_OBJECT*,ULONG,UNICODE_STRING*,DEVICE_TYPE,ULONG,BOOLEAN,DEVICE_OBJECT**);
1142 NTSTATUS WINAPI IoCreateDriver(UNICODE_STRING*,PDRIVER_INITIALIZE);
1143 NTSTATUS WINAPI IoCreateSymbolicLink(UNICODE_STRING*,UNICODE_STRING*);
1144 void WINAPI IoDeleteDevice(DEVICE_OBJECT*);
1145 void WINAPI IoDeleteDriver(DRIVER_OBJECT*);
1146 NTSTATUS WINAPI IoDeleteSymbolicLink(UNICODE_STRING*);
1147 void WINAPI IoFreeIrp(IRP*);
1148 PEPROCESS WINAPI IoGetCurrentProcess(void);
1149 NTSTATUS WINAPI IoGetDeviceInterfaces(CONST GUID*,PDEVICE_OBJECT,ULONG,PWSTR*);
1150 NTSTATUS WINAPI IoGetDeviceObjectPointer(UNICODE_STRING*,ACCESS_MASK,PFILE_OBJECT*,PDEVICE_OBJECT*);
1151 NTSTATUS WINAPI IoGetDeviceProperty(PDEVICE_OBJECT,DEVICE_REGISTRY_PROPERTY,ULONG,PVOID,PULONG);
1152 PVOID WINAPI IoGetDriverObjectExtension(PDRIVER_OBJECT,PVOID);
1153 PDEVICE_OBJECT WINAPI IoGetRelatedDeviceObject(PFILE_OBJECT);
1154 void WINAPI IoInitializeIrp(IRP*,USHORT,CCHAR);
1155 VOID WINAPI IoInitializeRemoveLockEx(PIO_REMOVE_LOCK,ULONG,ULONG,ULONG,ULONG);
1156 NTSTATUS WINAPI IoWMIRegistrationControl(PDEVICE_OBJECT,ULONG);
1158 PKTHREAD WINAPI KeGetCurrentThread(void);
1159 void WINAPI KeQuerySystemTime(LARGE_INTEGER*);
1160 void WINAPI KeQueryTickCount(LARGE_INTEGER*);
1161 ULONG WINAPI KeQueryTimeIncrement(void);
1162 LONG WINAPI KeReleaseSemaphore(PRKSEMAPHORE,KPRIORITY,LONG,BOOLEAN);
1163 LONG WINAPI KeResetEvent(PRKEVENT);
1164 LONG WINAPI KeSetEvent(PRKEVENT,KPRIORITY,BOOLEAN);
1165 KPRIORITY WINAPI KeSetPriorityThread(PKTHREAD,KPRIORITY);
1167 PVOID WINAPI MmAllocateContiguousMemory(SIZE_T,PHYSICAL_ADDRESS);
1168 PVOID WINAPI MmAllocateNonCachedMemory(SIZE_T);
1169 PMDL WINAPI MmAllocatePagesForMdl(PHYSICAL_ADDRESS,PHYSICAL_ADDRESS,PHYSICAL_ADDRESS,SIZE_T);
1170 void WINAPI MmFreeNonCachedMemory(PVOID,SIZE_T);
1171 MM_SYSTEMSIZE WINAPI MmQuerySystemSize(void);
1173 NTSTATUS WINAPI ObReferenceObjectByHandle(HANDLE,ACCESS_MASK,POBJECT_TYPE,KPROCESSOR_MODE,PVOID*,POBJECT_HANDLE_INFORMATION);
1175 POWER_STATE WINAPI PoSetPowerState(PDEVICE_OBJECT,POWER_STATE_TYPE,POWER_STATE);
1176 NTSTATUS WINAPI PsCreateSystemThread(PHANDLE,ULONG,POBJECT_ATTRIBUTES,HANDLE,PCLIENT_ID,PKSTART_ROUTINE,PVOID);
1177 #define PsGetCurrentProcess() IoGetCurrentProcess()
1178 #define PsGetCurrentThread() ((PETHREAD)KeGetCurrentThread())
1179 HANDLE WINAPI PsGetCurrentProcessId(void);
1180 HANDLE WINAPI PsGetCurrentThreadId(void);
1181 BOOLEAN WINAPI PsGetVersion(ULONG*,ULONG*,ULONG*,UNICODE_STRING*);
1182 NTSTATUS WINAPI PsTerminateSystemThread(NTSTATUS);
1184 NTSTATUS WINAPI ZwAddBootEntry(PUNICODE_STRING,PUNICODE_STRING);
1185 NTSTATUS WINAPI ZwAccessCheckAndAuditAlarm(PUNICODE_STRING,HANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,ACCESS_MASK,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PBOOLEAN,PBOOLEAN);
1186 NTSTATUS WINAPI ZwAdjustPrivilegesToken(HANDLE,BOOLEAN,PTOKEN_PRIVILEGES,DWORD,PTOKEN_PRIVILEGES,PDWORD);
1187 NTSTATUS WINAPI ZwAlertThread(HANDLE ThreadHandle);
1188 NTSTATUS WINAPI ZwAllocateVirtualMemory(HANDLE,PVOID*,ULONG,SIZE_T*,ULONG,ULONG);
1189 NTSTATUS WINAPI ZwCancelIoFile(HANDLE,PIO_STATUS_BLOCK);
1190 NTSTATUS WINAPI ZwCancelTimer(HANDLE, BOOLEAN*);
1191 NTSTATUS WINAPI ZwClearEvent(HANDLE);
1192 NTSTATUS WINAPI ZwClose(HANDLE);
1193 NTSTATUS WINAPI ZwCloseObjectAuditAlarm(PUNICODE_STRING,HANDLE,BOOLEAN);
1194 NTSTATUS WINAPI ZwConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
1195 NTSTATUS WINAPI ZwCreateDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
1196 NTSTATUS WINAPI ZwCreateEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *,BOOLEAN,BOOLEAN);
1197 NTSTATUS WINAPI ZwCreateFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG);
1198 NTSTATUS WINAPI ZwCreateKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,PULONG);
1199 NTSTATUS WINAPI ZwCreateSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const LARGE_INTEGER*,ULONG,ULONG,HANDLE);
1200 NTSTATUS WINAPI ZwCreateSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PUNICODE_STRING);
1201 NTSTATUS WINAPI ZwCreateTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*, TIMER_TYPE);
1202 NTSTATUS WINAPI ZwDeleteAtom(RTL_ATOM);
1203 NTSTATUS WINAPI ZwDeleteFile(POBJECT_ATTRIBUTES);
1204 NTSTATUS WINAPI ZwDeleteKey(HANDLE);
1205 NTSTATUS WINAPI ZwDeleteValueKey(HANDLE,const UNICODE_STRING *);
1206 NTSTATUS WINAPI ZwDeviceIoControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
1207 NTSTATUS WINAPI ZwDisplayString(PUNICODE_STRING);
1208 NTSTATUS WINAPI ZwDuplicateObject(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,ULONG,ULONG);
1209 NTSTATUS WINAPI ZwDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
1210 NTSTATUS WINAPI ZwEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
1211 NTSTATUS WINAPI ZwEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
1212 NTSTATUS WINAPI ZwFlushInstructionCache(HANDLE,LPCVOID,SIZE_T);
1213 NTSTATUS WINAPI ZwFlushKey(HANDLE);
1214 NTSTATUS WINAPI ZwFlushVirtualMemory(HANDLE,LPCVOID*,SIZE_T*,ULONG);
1215 NTSTATUS WINAPI ZwFreeVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
1216 NTSTATUS WINAPI ZwFsControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
1217 NTSTATUS WINAPI ZwInitiatePowerAction(POWER_ACTION,SYSTEM_POWER_STATE,ULONG,BOOLEAN);
1218 NTSTATUS WINAPI ZwLoadDriver(const UNICODE_STRING *);
1219 NTSTATUS WINAPI ZwLoadKey(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *);
1220 NTSTATUS WINAPI ZwLockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
1221 NTSTATUS WINAPI ZwMakeTemporaryObject(HANDLE);
1222 NTSTATUS WINAPI ZwMapViewOfSection(HANDLE,HANDLE,PVOID*,ULONG,SIZE_T,const LARGE_INTEGER*,SIZE_T*,SECTION_INHERIT,ULONG,ULONG);
1223 NTSTATUS WINAPI ZwNotifyChangeKey(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
1224 NTSTATUS WINAPI ZwOpenDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
1225 NTSTATUS WINAPI ZwOpenEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
1226 NTSTATUS WINAPI ZwOpenFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG);
1227 NTSTATUS WINAPI ZwOpenKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
1228 NTSTATUS WINAPI ZwOpenProcess(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
1229 NTSTATUS WINAPI ZwOpenProcessToken(HANDLE,DWORD,HANDLE *);
1230 NTSTATUS WINAPI ZwOpenSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
1231 NTSTATUS WINAPI ZwOpenSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
1232 NTSTATUS WINAPI ZwOpenThread(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
1233 NTSTATUS WINAPI ZwOpenThreadToken(HANDLE,DWORD,BOOLEAN,HANDLE *);
1234 NTSTATUS WINAPI ZwOpenTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*);
1235 NTSTATUS WINAPI ZwPowerInformation(POWER_INFORMATION_LEVEL,PVOID,ULONG,PVOID,ULONG);
1236 NTSTATUS WINAPI ZwPulseEvent(HANDLE,PULONG);
1237 NTSTATUS WINAPI ZwQueryDefaultLocale(BOOLEAN,LCID*);
1238 NTSTATUS WINAPI ZwQueryDefaultUILanguage(LANGID*);
1239 NTSTATUS WINAPI ZwQueryDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS,BOOLEAN,PUNICODE_STRING,BOOLEAN);
1240 NTSTATUS WINAPI ZwQueryDirectoryObject(HANDLE,PDIRECTORY_BASIC_INFORMATION,ULONG,BOOLEAN,BOOLEAN,PULONG,PULONG);
1241 NTSTATUS WINAPI ZwQueryEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,BOOLEAN,PVOID,ULONG,PVOID,BOOLEAN);
1242 NTSTATUS WINAPI ZwQueryFullAttributesFile(const OBJECT_ATTRIBUTES*,FILE_NETWORK_OPEN_INFORMATION*);
1243 NTSTATUS WINAPI ZwQueryInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,LONG,FILE_INFORMATION_CLASS);
1244 NTSTATUS WINAPI ZwQueryInformationThread(HANDLE,THREADINFOCLASS,PVOID,ULONG,PULONG);
1245 NTSTATUS WINAPI ZwQueryInformationToken(HANDLE,DWORD,PVOID,DWORD,LPDWORD);
1246 NTSTATUS WINAPI ZwQueryInstallUILanguage(LANGID*);
1247 NTSTATUS WINAPI ZwQueryKey(HANDLE,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
1248 NTSTATUS WINAPI ZwQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
1249 NTSTATUS WINAPI ZwQuerySecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR,ULONG,PULONG);
1250 NTSTATUS WINAPI ZwQuerySection(HANDLE,SECTION_INFORMATION_CLASS,PVOID,ULONG,PULONG);
1251 NTSTATUS WINAPI ZwQuerySymbolicLinkObject(HANDLE,PUNICODE_STRING,PULONG);
1252 NTSTATUS WINAPI ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG);
1253 NTSTATUS WINAPI ZwQueryTimerResolution(PULONG,PULONG,PULONG);
1254 NTSTATUS WINAPI ZwQueryValueKey(HANDLE,const UNICODE_STRING *,KEY_VALUE_INFORMATION_CLASS,void *,DWORD,DWORD *);
1255 NTSTATUS WINAPI ZwQueryVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
1256 NTSTATUS WINAPI ZwReadFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG);
1257 NTSTATUS WINAPI ZwReplaceKey(POBJECT_ATTRIBUTES,HANDLE,POBJECT_ATTRIBUTES);
1258 NTSTATUS WINAPI ZwRequestWaitReplyPort(HANDLE,PLPC_MESSAGE,PLPC_MESSAGE);
1259 NTSTATUS WINAPI ZwResetEvent(HANDLE,PULONG);
1260 NTSTATUS WINAPI ZwRestoreKey(HANDLE,HANDLE,ULONG);
1261 NTSTATUS WINAPI ZwSaveKey(HANDLE,HANDLE);
1262 NTSTATUS WINAPI ZwSecureConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PSID,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
1263 NTSTATUS WINAPI ZwSetDefaultLocale(BOOLEAN,LCID);
1264 NTSTATUS WINAPI ZwSetDefaultUILanguage(LANGID);
1265 NTSTATUS WINAPI ZwSetEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG);
1266 NTSTATUS WINAPI ZwSetEvent(HANDLE,PULONG);
1267 NTSTATUS WINAPI ZwSetInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS);
1268 NTSTATUS WINAPI ZwSetInformationKey(HANDLE,const int,PVOID,ULONG);
1269 NTSTATUS WINAPI ZwSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG);
1270 NTSTATUS WINAPI ZwSetInformationProcess(HANDLE,PROCESS_INFORMATION_CLASS,PVOID,ULONG);
1271 NTSTATUS WINAPI ZwSetInformationThread(HANDLE,THREADINFOCLASS,LPCVOID,ULONG);
1272 NTSTATUS WINAPI ZwSetIoCompletion(HANDLE,ULONG,ULONG,NTSTATUS,ULONG);
1273 NTSTATUS WINAPI ZwSetSecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR);
1274 NTSTATUS WINAPI ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG);
1275 NTSTATUS WINAPI ZwSetSystemTime(const LARGE_INTEGER*,LARGE_INTEGER*);
1276 NTSTATUS WINAPI ZwSetTimer(HANDLE, const LARGE_INTEGER*, PTIMER_APC_ROUTINE, PVOID, BOOLEAN, ULONG, BOOLEAN*);
1277 NTSTATUS WINAPI ZwSetValueKey(HANDLE,const UNICODE_STRING *,ULONG,ULONG,const void *,ULONG);
1278 NTSTATUS WINAPI ZwSetVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
1279 NTSTATUS WINAPI ZwSuspendThread(HANDLE,PULONG);
1280 NTSTATUS WINAPI ZwTerminateProcess(HANDLE,LONG);
1281 NTSTATUS WINAPI ZwUnloadDriver(const UNICODE_STRING *);
1282 NTSTATUS WINAPI ZwUnloadKey(HANDLE);
1283 NTSTATUS WINAPI ZwUnmapViewOfSection(HANDLE,PVOID);
1284 NTSTATUS WINAPI ZwWaitForSingleObject(HANDLE,BOOLEAN,const LARGE_INTEGER*);
1285 NTSTATUS WINAPI ZwWaitForMultipleObjects(ULONG,const HANDLE*,BOOLEAN,BOOLEAN,const LARGE_INTEGER*);
1286 NTSTATUS WINAPI ZwWriteFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,const void*,ULONG,PLARGE_INTEGER,PULONG);
1287 NTSTATUS WINAPI ZwYieldExecution(void);