2 * Copyright 2004-2005 Ivan Leo Puoti
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
26 #define POINTER_ALIGNMENT DECLSPEC_ALIGN(8)
28 #define POINTER_ALIGNMENT
31 typedef ULONG_PTR KSPIN_LOCK, *PKSPIN_LOCK;
36 struct _DEVICE_OBJECT;
37 struct _DRIVER_OBJECT;
39 typedef VOID (WINAPI *PKDEFERRED_ROUTINE)(struct _KDPC *, PVOID, PVOID, PVOID);
41 typedef NTSTATUS (WINAPI *PDRIVER_INITIALIZE)(struct _DRIVER_OBJECT *, PUNICODE_STRING);
42 typedef NTSTATUS (WINAPI *PDRIVER_DISPATCH)(struct _DEVICE_OBJECT *, struct _IRP *);
43 typedef void (WINAPI *PDRIVER_STARTIO)(struct _DEVICE_OBJECT *, struct _IRP *);
44 typedef void (WINAPI *PDRIVER_UNLOAD)(struct _DRIVER_OBJECT *);
46 typedef struct _DISPATCHER_HEADER {
52 LIST_ENTRY WaitListHead;
53 } DISPATCHER_HEADER, *PDISPATCHER_HEADER;
55 typedef struct _KEVENT {
56 DISPATCHER_HEADER Header;
57 } KEVENT, *PKEVENT, *RESTRICTED_POINTER PRKEVENT;
59 typedef struct _KDPC {
63 LIST_ENTRY DpcListEntry;
64 PKDEFERRED_ROUTINE DeferredRoutine;
65 PVOID DeferredContext;
66 PVOID SystemArgument1;
67 PVOID SystemArgument2;
69 } KDPC, *PKDPC, *RESTRICTED_POINTER PRKDPC;
71 typedef struct _KDEVICE_QUEUE_ENTRY {
72 LIST_ENTRY DeviceListEntry;
75 } KDEVICE_QUEUE_ENTRY, *PKDEVICE_QUEUE_ENTRY,
76 *RESTRICTED_POINTER PRKDEVICE_QUEUE_ENTRY;
78 typedef struct _KDEVICE_QUEUE {
81 LIST_ENTRY DeviceListHead;
84 } KDEVICE_QUEUE, *PKDEVICE_QUEUE, *RESTRICTED_POINTER PRKDEVICE_QUEUE;
86 typedef struct _IO_TIMER *PIO_TIMER;
87 typedef struct _ETHREAD *PETHREAD;
88 typedef struct _KTHREAD *PKTHREAD;
89 typedef struct _EPROCESS *PEPROCESS;
91 #define MAXIMUM_VOLUME_LABEL_LENGTH (32 * sizeof(WCHAR))
97 USHORT VolumeLabelLength;
98 struct _DEVICE_OBJECT *DeviceObject;
99 struct _DEVICE_OBJECT *RealDevice;
101 ULONG ReferenceCount;
102 WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH / sizeof(WCHAR)];
105 typedef enum _POOL_TYPE {
108 NonPagedPoolMustSucceed,
110 NonPagedPoolCacheAligned,
111 PagedPoolCacheAligned,
112 NonPagedPoolCacheAlignedMustS,
116 typedef struct _WAIT_CONTEXT_BLOCK {
117 KDEVICE_QUEUE_ENTRY WaitQueueEntry;
118 struct _DRIVER_CONTROL *DeviceRoutine;
120 ULONG NumberOfMapRegisters;
123 PKDPC BufferChainingDpc;
124 } WAIT_CONTEXT_BLOCK, *PWAIT_CONTEXT_BLOCK;
127 #define DEVICE_TYPE ULONG
129 #define IRP_MJ_MAXIMUM_FUNCTION 0x1b
130 #define IRP_MJ_DEVICE_CONTROL 0x0e
132 typedef struct _DEVICE_OBJECT {
136 struct _DRIVER_OBJECT *DriverObject;
137 struct _DEVICE_OBJECT *NextDevice;
138 struct _DEVICE_OBJECT *AttachedDevice;
139 struct _IRP *CurrentIrp;
142 ULONG Characteristics;
144 PVOID DeviceExtension;
145 DEVICE_TYPE DeviceType;
148 LIST_ENTRY ListEntry;
149 WAIT_CONTEXT_BLOCK Wcb;
151 ULONG AlignmentRequirement;
152 KDEVICE_QUEUE DeviceQueue;
154 ULONG ActiveThreadCount;
155 PSECURITY_DESCRIPTOR SecurityDescriptor;
159 struct _DEVOBJ_EXTENSION *DeviceObjectExtension;
162 typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT;
164 typedef struct _DRIVER_EXTENSION {
165 struct _DRIVER_OBJECT *DriverObject;
168 UNICODE_STRING ServiceKeyName;
169 } DRIVER_EXTENSION, *PDRIVER_EXTENSION;
171 typedef struct _DRIVER_OBJECT {
174 PDEVICE_OBJECT DeviceObject;
179 PDRIVER_EXTENSION DriverExtension;
180 UNICODE_STRING DriverName;
181 PUNICODE_STRING HardwareDatabase;
182 PVOID FastIoDispatch;
183 PDRIVER_INITIALIZE DriverInit;
184 PDRIVER_STARTIO DriverStartIo;
185 PDRIVER_UNLOAD DriverUnload;
186 PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];
188 typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT;
190 /* Irp definitions */
191 typedef UCHAR KIRQL, *PKIRQL;
192 typedef CCHAR KPROCESSOR_MODE;
194 typedef VOID (WINAPI *PDRIVER_CANCEL)(
195 IN struct _DEVICE_OBJECT *DeviceObject,
196 IN struct _IRP *Irp);
198 typedef VOID (WINAPI *PKNORMAL_ROUTINE)(
199 IN PVOID NormalContext,
200 IN PVOID SystemArgument1,
201 IN PVOID SystemArgument2);
203 typedef VOID (WINAPI *PKKERNEL_ROUTINE)(
204 IN struct _KAPC *Apc,
205 IN OUT PKNORMAL_ROUTINE *NormalRoutine,
206 IN OUT PVOID *NormalContext,
207 IN OUT PVOID *SystemArgument1,
208 IN OUT PVOID *SystemArgument2);
210 typedef VOID (WINAPI *PKRUNDOWN_ROUTINE)(
211 IN struct _KAPC *Apc);
213 typedef struct _KAPC {
217 struct _KTHREAD *Thread;
218 LIST_ENTRY ApcListEntry;
219 PKKERNEL_ROUTINE KernelRoutine;
220 PKRUNDOWN_ROUTINE RundownRoutine;
221 PKNORMAL_ROUTINE NormalRoutine;
223 PVOID SystemArgument1;
224 PVOID SystemArgument2;
226 KPROCESSOR_MODE ApcMode;
228 } KAPC, *PKAPC, *RESTRICTED_POINTER PRKAPC;
230 #include <pshpack1.h>
231 typedef struct _IRP {
234 struct _MDL *MdlAddress;
237 struct _IRP *MasterIrp;
241 LIST_ENTRY ThreadListEntry;
242 IO_STATUS_BLOCK IoStatus;
243 KPROCESSOR_MODE RequestorMode;
244 BOOLEAN PendingReturned;
246 CHAR CurrentLocation;
249 CCHAR ApcEnvironment;
250 UCHAR AllocationFlags;
251 PIO_STATUS_BLOCK UserIosb;
255 PIO_APC_ROUTINE UserApcRoutine;
256 PVOID UserApcContext;
257 } AsynchronousParameters;
258 LARGE_INTEGER AllocationSize;
260 PDRIVER_CANCEL CancelRoutine;
265 KDEVICE_QUEUE_ENTRY DeviceQueueEntry;
267 PVOID DriverContext[4];
271 PCHAR AuxiliaryBuffer;
273 LIST_ENTRY ListEntry;
275 struct _IO_STACK_LOCATION *CurrentStackLocation;
279 struct _FILE_OBJECT *OriginalFileObject;
285 typedef struct _IRP *PIRP;
288 /* MDL definitions */
290 typedef VOID (WINAPI *PINTERFACE_REFERENCE)(
293 typedef VOID (WINAPI *PINTERFACE_DEREFERENCE)(
296 typedef struct _INTERFACE {
300 PINTERFACE_REFERENCE InterfaceReference;
301 PINTERFACE_DEREFERENCE InterfaceDereference;
302 } INTERFACE, *PINTERFACE;
304 typedef struct _SECTION_OBJECT_POINTERS {
305 PVOID DataSectionObject;
306 PVOID SharedCacheMap;
307 PVOID ImageSectionObject;
308 } SECTION_OBJECT_POINTERS, *PSECTION_OBJECT_POINTERS;
310 typedef struct _IO_COMPLETION_CONTEXT {
313 } IO_COMPLETION_CONTEXT, *PIO_COMPLETION_CONTEXT;
315 typedef enum _DEVICE_RELATION_TYPE {
320 TargetDeviceRelation,
322 } DEVICE_RELATION_TYPE, *PDEVICE_RELATION_TYPE;
324 typedef struct _FILE_OBJECT {
327 PDEVICE_OBJECT DeviceObject;
331 PSECTION_OBJECT_POINTERS SectionObjectPointer;
332 PVOID PrivateCacheMap;
333 NTSTATUS FinalStatus;
334 struct _FILE_OBJECT *RelatedFileObject;
335 BOOLEAN LockOperation;
336 BOOLEAN DeletePending;
339 BOOLEAN DeleteAccess;
342 BOOLEAN SharedDelete;
344 UNICODE_STRING FileName;
345 LARGE_INTEGER CurrentByteOffset;
351 PIO_COMPLETION_CONTEXT CompletionContext;
353 typedef struct _FILE_OBJECT *PFILE_OBJECT;
355 #define INITIAL_PRIVILEGE_COUNT 3
357 typedef struct _INITIAL_PRIVILEGE_SET {
358 ULONG PrivilegeCount;
360 LUID_AND_ATTRIBUTES Privilege[INITIAL_PRIVILEGE_COUNT];
361 } INITIAL_PRIVILEGE_SET, * PINITIAL_PRIVILEGE_SET;
363 typedef struct _SECURITY_SUBJECT_CONTEXT {
364 PACCESS_TOKEN ClientToken;
365 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
366 PACCESS_TOKEN PrimaryToken;
367 PVOID ProcessAuditId;
368 } SECURITY_SUBJECT_CONTEXT, *PSECURITY_SUBJECT_CONTEXT;
370 typedef struct _ACCESS_STATE {
372 BOOLEAN SecurityEvaluated;
373 BOOLEAN GenerateAudit;
374 BOOLEAN GenerateOnClose;
375 BOOLEAN PrivilegesAllocated;
377 ACCESS_MASK RemainingDesiredAccess;
378 ACCESS_MASK PreviouslyGrantedAccess;
379 ACCESS_MASK OriginalDesiredAccess;
380 SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
381 PSECURITY_DESCRIPTOR SecurityDescriptor;
384 INITIAL_PRIVILEGE_SET InitialPrivilegeSet;
385 PRIVILEGE_SET PrivilegeSet;
388 BOOLEAN AuditPrivileges;
389 UNICODE_STRING ObjectName;
390 UNICODE_STRING ObjectTypeName;
391 } ACCESS_STATE, *PACCESS_STATE;
393 typedef struct _IO_SECURITY_CONTEXT {
394 PSECURITY_QUALITY_OF_SERVICE SecurityQos;
395 PACCESS_STATE AccessState;
396 ACCESS_MASK DesiredAccess;
397 ULONG FullCreateOptions;
398 } IO_SECURITY_CONTEXT, *PIO_SECURITY_CONTEXT;
400 typedef struct _DEVICE_CAPABILITIES {
405 ULONG LockSupported : 1;
406 ULONG EjectSupported : 1;
408 ULONG DockDevice : 1;
410 ULONG SilentInstall : 1;
411 ULONG RawDeviceOK : 1;
412 ULONG SurpriseRemovalOK : 1;
413 ULONG WakeFromD0 : 1;
414 ULONG WakeFromD1 : 1;
415 ULONG WakeFromD2 : 1;
416 ULONG WakeFromD3 : 1;
417 ULONG HardwareDisabled : 1;
418 ULONG NonDynamic : 1;
419 ULONG WarmEjectSupported : 1;
420 ULONG NoDisplayInUI : 1;
424 DEVICE_POWER_STATE DeviceState[PowerSystemMaximum];
425 SYSTEM_POWER_STATE SystemWake;
426 DEVICE_POWER_STATE DeviceWake;
430 } DEVICE_CAPABILITIES, *PDEVICE_CAPABILITIES;
432 typedef enum _INTERFACE_TYPE {
433 InterfaceTypeUndefined = -1,
451 } INTERFACE_TYPE, *PINTERFACE_TYPE;
453 typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS;
455 #define IO_RESOURCE_PREFERRED 0x01
456 #define IO_RESOURCE_DEFAULT 0x02
457 #define IO_RESOURCE_ALTERNATIVE 0x08
459 typedef struct _IO_RESOURCE_DESCRIPTOR {
462 UCHAR ShareDisposition;
470 PHYSICAL_ADDRESS MinimumAddress;
471 PHYSICAL_ADDRESS MaximumAddress;
476 PHYSICAL_ADDRESS MinimumAddress;
477 PHYSICAL_ADDRESS MaximumAddress;
484 ULONG MinimumChannel;
485 ULONG MaximumChannel;
490 PHYSICAL_ADDRESS MinimumAddress;
491 PHYSICAL_ADDRESS MaximumAddress;
508 } IO_RESOURCE_DESCRIPTOR, *PIO_RESOURCE_DESCRIPTOR;
510 typedef struct _IO_RESOURCE_LIST {
514 IO_RESOURCE_DESCRIPTOR Descriptors[1];
515 } IO_RESOURCE_LIST, *PIO_RESOURCE_LIST;
517 typedef struct _IO_RESOURCE_REQUIREMENTS_LIST {
519 INTERFACE_TYPE InterfaceType;
523 ULONG AlternativeLists;
524 IO_RESOURCE_LIST List[1];
525 } IO_RESOURCE_REQUIREMENTS_LIST, *PIO_RESOURCE_REQUIREMENTS_LIST;
527 typedef enum _BUS_QUERY_ID_TYPE {
530 BusQueryCompatibleIDs,
532 BusQueryDeviceSerialNumber
533 } BUS_QUERY_ID_TYPE, *PBUS_QUERY_ID_TYPE;
535 typedef enum _DEVICE_TEXT_TYPE {
536 DeviceTextDescription,
537 DeviceTextLocationInformation
538 } DEVICE_TEXT_TYPE, *PDEVICE_TEXT_TYPE;
540 typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE {
541 DeviceUsageTypeUndefined,
542 DeviceUsageTypePaging,
543 DeviceUsageTypeHibernation,
544 DeviceUsageTypeDumpFile
545 } DEVICE_USAGE_NOTIFICATION_TYPE;
547 typedef struct _POWER_SEQUENCE {
551 } POWER_SEQUENCE, *PPOWER_SEQUENCE;
553 typedef enum _POWER_STATE_TYPE {
556 } POWER_STATE_TYPE, *PPOWER_STATE_TYPE;
558 typedef union _POWER_STATE {
559 SYSTEM_POWER_STATE SystemState;
560 DEVICE_POWER_STATE DeviceState;
561 } POWER_STATE, *PPOWER_STATE;
563 typedef struct _CM_PARTIAL_RESOURCE_DESCRIPTOR {
565 UCHAR ShareDisposition;
569 PHYSICAL_ADDRESS Start;
573 PHYSICAL_ADDRESS Start;
582 PHYSICAL_ADDRESS Start;
602 } DeviceSpecificData;
604 } CM_PARTIAL_RESOURCE_DESCRIPTOR, *PCM_PARTIAL_RESOURCE_DESCRIPTOR;
606 typedef struct _CM_PARTIAL_RESOURCE_LIST {
610 CM_PARTIAL_RESOURCE_DESCRIPTOR PartialDescriptors[1];
611 } CM_PARTIAL_RESOURCE_LIST, *PCM_PARTIAL_RESOURCE_LIST;
613 typedef struct _CM_FULL_RESOURCE_DESCRIPTOR {
614 INTERFACE_TYPE InterfaceType;
616 CM_PARTIAL_RESOURCE_LIST PartialResourceList;
617 } CM_FULL_RESOURCE_DESCRIPTOR, *PCM_FULL_RESOURCE_DESCRIPTOR;
619 typedef struct _CM_RESOURCE_LIST {
621 CM_FULL_RESOURCE_DESCRIPTOR List[1];
622 } CM_RESOURCE_LIST, *PCM_RESOURCE_LIST;
624 typedef NTSTATUS (WINAPI *PIO_COMPLETION_ROUTINE)(
625 IN struct _DEVICE_OBJECT *DeviceObject,
629 #include <pshpack1.h>
630 typedef struct _IO_STACK_LOCATION {
637 PIO_SECURITY_CONTEXT SecurityContext;
639 USHORT POINTER_ALIGNMENT FileAttributes;
641 ULONG POINTER_ALIGNMENT EaLength;
645 ULONG POINTER_ALIGNMENT Key;
646 LARGE_INTEGER ByteOffset;
650 ULONG POINTER_ALIGNMENT Key;
651 LARGE_INTEGER ByteOffset;
655 FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
659 FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
660 PFILE_OBJECT FileObject;
663 BOOLEAN ReplaceIfExists;
672 FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
675 ULONG OutputBufferLength;
676 ULONG POINTER_ALIGNMENT InputBufferLength;
677 ULONG POINTER_ALIGNMENT IoControlCode;
678 PVOID Type3InputBuffer;
681 SECURITY_INFORMATION SecurityInformation;
682 ULONG POINTER_ALIGNMENT Length;
685 SECURITY_INFORMATION SecurityInformation;
686 PSECURITY_DESCRIPTOR SecurityDescriptor;
690 PDEVICE_OBJECT DeviceObject;
694 PDEVICE_OBJECT DeviceObject;
697 struct _SCSI_REQUEST_BLOCK *Srb;
700 DEVICE_RELATION_TYPE Type;
701 } QueryDeviceRelations;
703 CONST GUID *InterfaceType;
706 PINTERFACE Interface;
707 PVOID InterfaceSpecificData;
710 PDEVICE_CAPABILITIES Capabilities;
711 } DeviceCapabilities;
713 PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;
714 } FilterResourceRequirements;
719 ULONG POINTER_ALIGNMENT Length;
725 BUS_QUERY_ID_TYPE IdType;
728 DEVICE_TEXT_TYPE DeviceTextType;
729 LCID POINTER_ALIGNMENT LocaleId;
734 DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;
737 SYSTEM_POWER_STATE PowerState;
740 PPOWER_SEQUENCE PowerSequence;
744 POWER_STATE_TYPE POINTER_ALIGNMENT Type;
745 POWER_STATE POINTER_ALIGNMENT State;
746 POWER_ACTION POINTER_ALIGNMENT ShutdownType;
749 PCM_RESOURCE_LIST AllocatedResources;
750 PCM_RESOURCE_LIST AllocatedResourcesTranslated;
753 ULONG_PTR ProviderId;
765 PDEVICE_OBJECT DeviceObject;
766 PFILE_OBJECT FileObject;
767 PIO_COMPLETION_ROUTINE CompletionRoutine;
769 } IO_STACK_LOCATION, *PIO_STACK_LOCATION;
772 typedef struct _MDL {
776 struct _EPROCESS *Process;
777 PVOID MappedSystemVa;
783 typedef struct _KSYSTEM_TIME {
787 } KSYSTEM_TIME, *PKSYSTEM_TIME;
789 typedef enum _NT_PRODUCT_TYPE {
793 } NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;
795 #define PROCESSOR_FEATURE_MAX 64
797 typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
802 } ALTERNATIVE_ARCHITECTURE_TYPE;
804 typedef struct _KUSER_SHARED_DATA {
805 ULONG TickCountLowDeprecated;
806 ULONG TickCountMultiplier;
807 volatile KSYSTEM_TIME InterruptTime;
808 volatile KSYSTEM_TIME SystemTime;
809 volatile KSYSTEM_TIME TimeZoneBias;
810 USHORT ImageNumberLow;
811 USHORT ImageNumberHigh;
812 WCHAR NtSystemRoot[260];
813 ULONG MaxStckTraceDepth;
814 ULONG CryptoExponent;
816 ULONG LargePageMinimum;
818 NT_PRODUCT_TYPE NtProductType;
819 BOOLEAN ProductTypeIsValid;
820 ULONG MajorNtVersion;
821 ULONG MinorNtVersion;
822 BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];
825 volatile ULONG TimeSlip;
826 ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
827 LARGE_INTEGER SystemExpirationDate;
829 BOOLEAN KdDebuggerEnabled;
830 volatile ULONG ActiveConsoleId;
831 volatile ULONG DismountCount;
832 ULONG ComPlusPackage;
833 ULONG LastSystemRITEventTickCount;
834 ULONG NumberOfPhysicalPages;
835 BOOLEAN SafeBootMode;
838 ULONGLONG SystemCall[4];
840 volatile KSYSTEM_TIME TickCount;
841 volatile ULONG64 TickCountQuad;
843 } KSHARED_USER_DATA, *PKSHARED_USER_DATA;
845 NTSTATUS WINAPI ObCloseHandle(IN HANDLE handle);
847 #define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.CurrentStackLocation)
852 /* directory object access rights */
853 #define DIRECTORY_QUERY 0x0001
854 #define DIRECTORY_TRAVERSE 0x0002
855 #define DIRECTORY_CREATE_OBJECT 0x0004
856 #define DIRECTORY_CREATE_SUBDIRECTORY 0x0008
857 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)
859 /* symbolic link access rights */
860 #define SYMBOLIC_LINK_QUERY 0x0001
861 #define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
863 PVOID WINAPI ExAllocatePool(POOL_TYPE,SIZE_T);
864 PVOID WINAPI ExAllocatePoolWithQuota(POOL_TYPE,SIZE_T);
865 PVOID WINAPI ExAllocatePoolWithTag(POOL_TYPE,SIZE_T,ULONG);
866 PVOID WINAPI ExAllocatePoolWithQuotaTag(POOL_TYPE,SIZE_T,ULONG);
867 void WINAPI ExFreePool(PVOID);
869 NTSTATUS WINAPI IoCreateDevice(DRIVER_OBJECT*,ULONG,UNICODE_STRING*,DEVICE_TYPE,ULONG,BOOLEAN,DEVICE_OBJECT**);
870 NTSTATUS WINAPI IoCreateSymbolicLink(UNICODE_STRING*,UNICODE_STRING*);
871 void WINAPI IoDeleteDevice(DEVICE_OBJECT*);
872 NTSTATUS WINAPI IoDeleteSymbolicLink(UNICODE_STRING*);
873 PEPROCESS WINAPI IoGetCurrentProcess(void);
875 PKTHREAD WINAPI KeGetCurrentThread(void);
877 #define PsGetCurrentProcess() IoGetCurrentProcess()
878 #define PsGetCurrentThread() ((PETHREAD)KeGetCurrentThread())
879 HANDLE WINAPI PsGetCurrentProcessId(void);
880 HANDLE WINAPI PsGetCurrentThreadId(void);
881 BOOLEAN WINAPI PsGetVersion(ULONG*,ULONG*,ULONG*,UNICODE_STRING*);
883 NTSTATUS WINAPI ZwAddBootEntry(PUNICODE_STRING,PUNICODE_STRING);
884 NTSTATUS WINAPI ZwAccessCheckAndAuditAlarm(PUNICODE_STRING,HANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,ACCESS_MASK,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PBOOLEAN,PBOOLEAN);
885 NTSTATUS WINAPI ZwAdjustPrivilegesToken(HANDLE,BOOLEAN,PTOKEN_PRIVILEGES,DWORD,PTOKEN_PRIVILEGES,PDWORD);
886 NTSTATUS WINAPI ZwAlertThread(HANDLE ThreadHandle);
887 NTSTATUS WINAPI ZwAllocateVirtualMemory(HANDLE,PVOID*,ULONG,SIZE_T*,ULONG,ULONG);
888 NTSTATUS WINAPI ZwCancelIoFile(HANDLE,PIO_STATUS_BLOCK);
889 NTSTATUS WINAPI ZwCancelTimer(HANDLE, BOOLEAN*);
890 NTSTATUS WINAPI ZwClearEvent(HANDLE);
891 NTSTATUS WINAPI ZwClose(HANDLE);
892 NTSTATUS WINAPI ZwCloseObjectAuditAlarm(PUNICODE_STRING,HANDLE,BOOLEAN);
893 NTSTATUS WINAPI ZwConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
894 NTSTATUS WINAPI ZwCreateDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
895 NTSTATUS WINAPI ZwCreateEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *,BOOLEAN,BOOLEAN);
896 NTSTATUS WINAPI ZwCreateFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG);
897 NTSTATUS WINAPI ZwCreateKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,PULONG);
898 NTSTATUS WINAPI ZwCreateSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const LARGE_INTEGER*,ULONG,ULONG,HANDLE);
899 NTSTATUS WINAPI ZwCreateSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PUNICODE_STRING);
900 NTSTATUS WINAPI ZwCreateTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*, TIMER_TYPE);
901 NTSTATUS WINAPI ZwDeleteAtom(RTL_ATOM);
902 NTSTATUS WINAPI ZwDeleteFile(POBJECT_ATTRIBUTES);
903 NTSTATUS WINAPI ZwDeleteKey(HANDLE);
904 NTSTATUS WINAPI ZwDeleteValueKey(HANDLE,const UNICODE_STRING *);
905 NTSTATUS WINAPI ZwDeviceIoControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
906 NTSTATUS WINAPI ZwDisplayString(PUNICODE_STRING);
907 NTSTATUS WINAPI ZwDuplicateObject(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,ULONG,ULONG);
908 NTSTATUS WINAPI ZwDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
909 NTSTATUS WINAPI ZwEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
910 NTSTATUS WINAPI ZwEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
911 NTSTATUS WINAPI ZwFlushInstructionCache(HANDLE,LPCVOID,SIZE_T);
912 NTSTATUS WINAPI ZwFlushKey(HANDLE);
913 NTSTATUS WINAPI ZwFlushVirtualMemory(HANDLE,LPCVOID*,SIZE_T*,ULONG);
914 NTSTATUS WINAPI ZwFreeVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
915 NTSTATUS WINAPI ZwFsControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
916 NTSTATUS WINAPI ZwInitiatePowerAction(POWER_ACTION,SYSTEM_POWER_STATE,ULONG,BOOLEAN);
917 NTSTATUS WINAPI ZwLoadDriver(const UNICODE_STRING *);
918 NTSTATUS WINAPI ZwLoadKey(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *);
919 NTSTATUS WINAPI ZwLockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
920 NTSTATUS WINAPI ZwMakeTemporaryObject(HANDLE);
921 NTSTATUS WINAPI ZwMapViewOfSection(HANDLE,HANDLE,PVOID*,ULONG,SIZE_T,const LARGE_INTEGER*,SIZE_T*,SECTION_INHERIT,ULONG,ULONG);
922 NTSTATUS WINAPI ZwNotifyChangeKey(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
923 NTSTATUS WINAPI ZwOpenDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
924 NTSTATUS WINAPI ZwOpenEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
925 NTSTATUS WINAPI ZwOpenFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG);
926 NTSTATUS WINAPI ZwOpenKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
927 NTSTATUS WINAPI ZwOpenProcess(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
928 NTSTATUS WINAPI ZwOpenProcessToken(HANDLE,DWORD,HANDLE *);
929 NTSTATUS WINAPI ZwOpenSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
930 NTSTATUS WINAPI ZwOpenSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
931 NTSTATUS WINAPI ZwOpenThread(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
932 NTSTATUS WINAPI ZwOpenThreadToken(HANDLE,DWORD,BOOLEAN,HANDLE *);
933 NTSTATUS WINAPI ZwOpenTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*);
934 NTSTATUS WINAPI ZwPowerInformation(POWER_INFORMATION_LEVEL,PVOID,ULONG,PVOID,ULONG);
935 NTSTATUS WINAPI ZwPulseEvent(HANDLE,PULONG);
936 NTSTATUS WINAPI ZwQueryDefaultLocale(BOOLEAN,LCID*);
937 NTSTATUS WINAPI ZwQueryDefaultUILanguage(LANGID*);
938 NTSTATUS WINAPI ZwQueryDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS,BOOLEAN,PUNICODE_STRING,BOOLEAN);
939 NTSTATUS WINAPI ZwQueryDirectoryObject(HANDLE,PDIRECTORY_BASIC_INFORMATION,ULONG,BOOLEAN,BOOLEAN,PULONG,PULONG);
940 NTSTATUS WINAPI ZwQueryEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,BOOLEAN,PVOID,ULONG,PVOID,BOOLEAN);
941 NTSTATUS WINAPI ZwQueryFullAttributesFile(const OBJECT_ATTRIBUTES*,FILE_NETWORK_OPEN_INFORMATION*);
942 NTSTATUS WINAPI ZwQueryInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,LONG,FILE_INFORMATION_CLASS);
943 NTSTATUS WINAPI ZwQueryInformationThread(HANDLE,THREADINFOCLASS,PVOID,ULONG,PULONG);
944 NTSTATUS WINAPI ZwQueryInformationToken(HANDLE,DWORD,LPVOID,DWORD,LPDWORD);
945 NTSTATUS WINAPI ZwQueryInstallUILanguage(LANGID*);
946 NTSTATUS WINAPI ZwQueryKey(HANDLE,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
947 NTSTATUS WINAPI ZwQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
948 NTSTATUS WINAPI ZwQuerySecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR,ULONG,PULONG);
949 NTSTATUS WINAPI ZwQuerySection(HANDLE,SECTION_INFORMATION_CLASS,PVOID,ULONG,PULONG);
950 NTSTATUS WINAPI ZwQuerySymbolicLinkObject(HANDLE,PUNICODE_STRING,PULONG);
951 NTSTATUS WINAPI ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG);
952 NTSTATUS WINAPI ZwQueryTimerResolution(PULONG,PULONG,PULONG);
953 NTSTATUS WINAPI ZwQueryValueKey(HANDLE,const UNICODE_STRING *,KEY_VALUE_INFORMATION_CLASS,void *,DWORD,DWORD *);
954 NTSTATUS WINAPI ZwQueryVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
955 NTSTATUS WINAPI ZwReadFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG);
956 NTSTATUS WINAPI ZwReplaceKey(POBJECT_ATTRIBUTES,HANDLE,POBJECT_ATTRIBUTES);
957 NTSTATUS WINAPI ZwRequestWaitReplyPort(HANDLE,PLPC_MESSAGE,PLPC_MESSAGE);
958 NTSTATUS WINAPI ZwResetEvent(HANDLE,PULONG);
959 NTSTATUS WINAPI ZwRestoreKey(HANDLE,HANDLE,ULONG);
960 NTSTATUS WINAPI ZwSaveKey(HANDLE,HANDLE);
961 NTSTATUS WINAPI ZwSecureConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PSID,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
962 NTSTATUS WINAPI ZwSetDefaultLocale(BOOLEAN,LCID);
963 NTSTATUS WINAPI ZwSetDefaultUILanguage(LANGID);
964 NTSTATUS WINAPI ZwSetEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG);
965 NTSTATUS WINAPI ZwSetEvent(HANDLE,PULONG);
966 NTSTATUS WINAPI ZwSetInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS);
967 NTSTATUS WINAPI ZwSetInformationKey(HANDLE,const int,PVOID,ULONG);
968 NTSTATUS WINAPI ZwSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG);
969 NTSTATUS WINAPI ZwSetInformationProcess(HANDLE,PROCESS_INFORMATION_CLASS,PVOID,ULONG);
970 NTSTATUS WINAPI ZwSetInformationThread(HANDLE,THREADINFOCLASS,LPCVOID,ULONG);
971 NTSTATUS WINAPI ZwSetIoCompletion(HANDLE,ULONG,ULONG,NTSTATUS,ULONG);
972 NTSTATUS WINAPI ZwSetSecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR);
973 NTSTATUS WINAPI ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG);
974 NTSTATUS WINAPI ZwSetSystemTime(const LARGE_INTEGER*,LARGE_INTEGER*);
975 NTSTATUS WINAPI ZwSetTimer(HANDLE, const LARGE_INTEGER*, PTIMER_APC_ROUTINE, PVOID, BOOLEAN, ULONG, BOOLEAN*);
976 NTSTATUS WINAPI ZwSetValueKey(HANDLE,const UNICODE_STRING *,ULONG,ULONG,const void *,ULONG);
977 NTSTATUS WINAPI ZwSetVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
978 NTSTATUS WINAPI ZwSuspendThread(HANDLE,PULONG);
979 NTSTATUS WINAPI ZwTerminateProcess(HANDLE,LONG);
980 NTSTATUS WINAPI ZwUnloadDriver(const UNICODE_STRING *);
981 NTSTATUS WINAPI ZwUnloadKey(HANDLE);
982 NTSTATUS WINAPI ZwUnmapViewOfSection(HANDLE,PVOID);
983 NTSTATUS WINAPI ZwWaitForSingleObject(HANDLE,BOOLEAN,const LARGE_INTEGER*);
984 NTSTATUS WINAPI ZwWaitForMultipleObjects(ULONG,const HANDLE*,BOOLEAN,BOOLEAN,const LARGE_INTEGER*);
985 NTSTATUS WINAPI ZwWriteFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,const void*,ULONG,PLARGE_INTEGER,PULONG);
986 NTSTATUS WINAPI ZwYieldExecution(void);