2 * Copyright 2004-2005 Ivan Leo Puoti
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
26 #define POINTER_ALIGNMENT DECLSPEC_ALIGN(8)
28 #define POINTER_ALIGNMENT
31 typedef LONG KPRIORITY;
33 typedef ULONG_PTR KSPIN_LOCK, *PKSPIN_LOCK;
38 struct _DEVICE_OBJECT;
39 struct _DRIVER_OBJECT;
41 typedef VOID (WINAPI *PKDEFERRED_ROUTINE)(struct _KDPC *, PVOID, PVOID, PVOID);
42 typedef VOID (WINAPI *PKSTART_ROUTINE)(PVOID);
44 typedef NTSTATUS (WINAPI *PDRIVER_INITIALIZE)(struct _DRIVER_OBJECT *, PUNICODE_STRING);
45 typedef NTSTATUS (WINAPI *PDRIVER_DISPATCH)(struct _DEVICE_OBJECT *, struct _IRP *);
46 typedef void (WINAPI *PDRIVER_STARTIO)(struct _DEVICE_OBJECT *, struct _IRP *);
47 typedef void (WINAPI *PDRIVER_UNLOAD)(struct _DRIVER_OBJECT *);
49 typedef struct _DISPATCHER_HEADER {
55 LIST_ENTRY WaitListHead;
56 } DISPATCHER_HEADER, *PDISPATCHER_HEADER;
58 typedef struct _KEVENT {
59 DISPATCHER_HEADER Header;
60 } KEVENT, *PKEVENT, *RESTRICTED_POINTER PRKEVENT;
62 typedef struct _KSEMAPHORE {
63 DISPATCHER_HEADER Header;
65 } KSEMAPHORE, *PKSEMAPHORE, *PRKSEMAPHORE;
67 typedef struct _KDPC {
71 LIST_ENTRY DpcListEntry;
72 PKDEFERRED_ROUTINE DeferredRoutine;
73 PVOID DeferredContext;
74 PVOID SystemArgument1;
75 PVOID SystemArgument2;
77 } KDPC, *PKDPC, *RESTRICTED_POINTER PRKDPC;
79 typedef struct _KDEVICE_QUEUE_ENTRY {
80 LIST_ENTRY DeviceListEntry;
83 } KDEVICE_QUEUE_ENTRY, *PKDEVICE_QUEUE_ENTRY,
84 *RESTRICTED_POINTER PRKDEVICE_QUEUE_ENTRY;
86 typedef struct _KDEVICE_QUEUE {
89 LIST_ENTRY DeviceListHead;
92 } KDEVICE_QUEUE, *PKDEVICE_QUEUE, *RESTRICTED_POINTER PRKDEVICE_QUEUE;
94 typedef struct _KMUTANT {
95 DISPATCHER_HEADER Header;
96 LIST_ENTRY MutantListEntry;
97 struct _KTHREAD *RESTRICTED_POINTER OwnerThread;
100 } KMUTANT, *PKMUTANT, *RESTRICTED_POINTER PRKMUTANT, KMUTEX, *PKMUTEX, *RESTRICTED_POINTER PRKMUTEX;
102 typedef enum _KWAIT_REASON
132 typedef struct _ALLOCATE_FUNCTION *PALLOCATE_FUNCTION;
133 typedef struct _IO_TIMER *PIO_TIMER;
134 typedef struct _IO_TIMER_ROUTINE *PIO_TIMER_ROUTINE;
135 typedef struct _ETHREAD *PETHREAD;
136 typedef struct _FREE_FUNCTION *PFREE_FUNCTION;
137 typedef struct _KTHREAD *PKTHREAD, *PRKTHREAD;
138 typedef struct _EPROCESS *PEPROCESS;
139 typedef struct _ERESOURCE *PERESOURCE;
140 typedef struct _IO_WORKITEM *PIO_WORKITEM;
141 typedef struct _NPAGED_LOOKASIDE_LIST *PNPAGED_LOOKASIDE_LIST;
142 typedef struct _OBJECT_TYPE *POBJECT_TYPE;
143 typedef struct _OBJECT_HANDLE_INFORMATION *POBJECT_HANDLE_INFORMATION;
144 typedef struct _ZONE_HEADER *PZONE_HEADER;
146 typedef struct _FAST_MUTEX
153 } FAST_MUTEX, *PFAST_MUTEX;
155 #define MAXIMUM_VOLUME_LABEL_LENGTH (32 * sizeof(WCHAR))
157 typedef struct _VPB {
161 USHORT VolumeLabelLength;
162 struct _DEVICE_OBJECT *DeviceObject;
163 struct _DEVICE_OBJECT *RealDevice;
165 ULONG ReferenceCount;
166 WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH / sizeof(WCHAR)];
169 typedef enum _POOL_TYPE {
172 NonPagedPoolMustSucceed,
174 NonPagedPoolCacheAligned,
175 PagedPoolCacheAligned,
176 NonPagedPoolCacheAlignedMustS,
180 typedef struct _WAIT_CONTEXT_BLOCK {
181 KDEVICE_QUEUE_ENTRY WaitQueueEntry;
182 struct _DRIVER_CONTROL *DeviceRoutine;
184 ULONG NumberOfMapRegisters;
187 PKDPC BufferChainingDpc;
188 } WAIT_CONTEXT_BLOCK, *PWAIT_CONTEXT_BLOCK;
190 #define DO_BUFFERED_IO 0x00000004
191 #define DO_EXCLUSIVE 0x00000008
192 #define DO_DIRECT_IO 0x00000010
193 #define DO_MAP_IO_BUFFER 0x00000020
194 #define DO_DEVICE_INITIALIZING 0x00000080
195 #define DO_SHUTDOWN_REGISTERED 0x00000800
196 #define DO_BUS_ENUMERATED_DEVICE 0x00001000
197 #define DO_POWER_PAGABLE 0x00002000
198 #define DO_POWER_INRUSH 0x00004000
200 #define IO_NO_INCREMENT 0
201 #define IO_CD_ROM_INCREMENT 1
202 #define IO_DISK_INCREMENT 1
203 #define IO_KEYBOARD_INCREMENT 6
204 #define IO_MAILSLOT_INCREMENT 2
205 #define IO_MOUSE_INCREMENT 6
206 #define IO_NAMED_PIPE_INCREMENT 2
207 #define IO_NETWORK_INCREMENT 2
208 #define IO_PARALLEL_INCREMENT 1
209 #define IO_SERIAL_INCREMENT 2
210 #define IO_SOUND_INCREMENT 8
211 #define IO_VIDEO_INCREMENT 1
214 #define DEVICE_TYPE ULONG
216 #define IRP_MJ_MAXIMUM_FUNCTION 0x1b
217 #define IRP_MJ_CREATE 0x00
218 #define IRP_MJ_CREATE_NAMED_PIPE 0x01
219 #define IRP_MJ_CLOSE 0x02
220 #define IRP_MJ_READ 0x03
221 #define IRP_MJ_WRITE 0x04
222 #define IRP_MJ_QUERY_INFORMATION 0x05
223 #define IRP_MJ_SET_INFORMATION 0x06
224 #define IRP_MJ_QUERY_EA 0x07
225 #define IRP_MJ_SET_EA 0x08
226 #define IRP_MJ_FLUSH_BUFFERS 0x09
227 #define IRP_MJ_QUERY_VOLUME_INFORMATION 0x0a
228 #define IRP_MJ_SET_VOLUME_INFORMATION 0x0b
229 #define IRP_MJ_DIRECTORY_CONTROL 0x0c
230 #define IRP_MJ_FILE_SYSTEM_CONTROL 0x0d
231 #define IRP_MJ_DEVICE_CONTROL 0x0e
232 #define IRP_MJ_INTERNAL_DEVICE_CONTROL 0x0f
233 #define IRP_MJ_SHUTDOWN 0x10
234 #define IRP_MJ_LOCK_CONTROL 0x11
235 #define IRP_MJ_CLEANUP 0x12
236 #define IRP_MJ_CREATE_MAILSLOT 0x13
237 #define IRP_MJ_QUERY_SECURITY 0x14
238 #define IRP_MJ_SET_SECURITY 0x15
239 #define IRP_MJ_POWER 0x16
240 #define IRP_MJ_SYSTEM_CONTROL 0x17
241 #define IRP_MJ_DEVICE_CHANGE 0x18
242 #define IRP_MJ_QUERY_QUOTA 0x19
243 #define IRP_MJ_SET_QUOTA 0x1a
244 #define IRP_MJ_PNP 0x1b
246 #define IRP_MN_START_DEVICE 0x00
247 #define IRP_MN_QUERY_REMOVE_DEVICE 0x01
248 #define IRP_MN_REMOVE_DEVICE 0x02
249 #define IRP_MN_CANCEL_REMOVE_DEVICE 0x03
250 #define IRP_MN_STOP_DEVICE 0x04
251 #define IRP_MN_QUERY_STOP_DEVICE 0x05
252 #define IRP_MN_CANCEL_STOP_DEVICE 0x06
253 #define IRP_MN_QUERY_DEVICE_RELATIONS 0x07
254 #define IRP_MN_QUERY_INTERFACE 0x08
255 #define IRP_MN_QUERY_CAPABILITIES 0x09
256 #define IRP_MN_QUERY_RESOURCES 0x0A
257 #define IRP_MN_QUERY_RESOURCE_REQUIREMENTS 0x0B
258 #define IRP_MN_QUERY_DEVICE_TEXT 0x0C
259 #define IRP_MN_FILTER_RESOURCE_REQUIREMENTS 0x0D
260 #define IRP_MN_READ_CONFIG 0x0F
261 #define IRP_MN_WRITE_CONFIG 0x10
262 #define IRP_MN_EJECT 0x11
263 #define IRP_MN_SET_LOCK 0x12
264 #define IRP_MN_QUERY_ID 0x13
265 #define IRP_MN_QUERY_PNP_DEVICE_STATE 0x14
266 #define IRP_MN_QUERY_BUS_INFORMATION 0x15
267 #define IRP_MN_DEVICE_USAGE_NOTIFICATION 0x16
268 #define IRP_MN_SURPRISE_REMOVAL 0x17
270 #define IRP_QUOTA_CHARGED 0x01
271 #define IRP_ALLOCATED_MUST_SUCCEED 0x02
272 #define IRP_ALLOCATED_FIXED_SIZE 0x04
273 #define IRP_LOOKASIDE_ALLOCATION 0x08
275 #define IO_TYPE_ADAPTER 0x01
276 #define IO_TYPE_CONTROLLER 0x02
277 #define IO_TYPE_DEVICE 0x03
278 #define IO_TYPE_DRIVER 0x04
279 #define IO_TYPE_FILE 0x05
280 #define IO_TYPE_IRP 0x06
281 #define IO_TYPE_MASTER_ADAPTER 0x07
282 #define IO_TYPE_OPEN_PACKET 0x08
283 #define IO_TYPE_TIMER 0x09
284 #define IO_TYPE_VPB 0x0a
285 #define IO_TYPE_ERROR_LOG 0x0b
286 #define IO_TYPE_ERROR_MESSAGE 0x0c
287 #define IO_TYPE_DEVICE_OBJECT_EXTENSION 0x0d
289 typedef struct _DEVICE_OBJECT {
293 struct _DRIVER_OBJECT *DriverObject;
294 struct _DEVICE_OBJECT *NextDevice;
295 struct _DEVICE_OBJECT *AttachedDevice;
296 struct _IRP *CurrentIrp;
299 ULONG Characteristics;
301 PVOID DeviceExtension;
302 DEVICE_TYPE DeviceType;
305 LIST_ENTRY ListEntry;
306 WAIT_CONTEXT_BLOCK Wcb;
308 ULONG AlignmentRequirement;
309 KDEVICE_QUEUE DeviceQueue;
311 ULONG ActiveThreadCount;
312 PSECURITY_DESCRIPTOR SecurityDescriptor;
316 struct _DEVOBJ_EXTENSION *DeviceObjectExtension;
319 typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT;
321 typedef struct _DRIVER_EXTENSION {
322 struct _DRIVER_OBJECT *DriverObject;
325 UNICODE_STRING ServiceKeyName;
326 } DRIVER_EXTENSION, *PDRIVER_EXTENSION;
328 typedef struct _DRIVER_OBJECT {
331 PDEVICE_OBJECT DeviceObject;
336 PDRIVER_EXTENSION DriverExtension;
337 UNICODE_STRING DriverName;
338 PUNICODE_STRING HardwareDatabase;
339 PVOID FastIoDispatch;
340 PDRIVER_INITIALIZE DriverInit;
341 PDRIVER_STARTIO DriverStartIo;
342 PDRIVER_UNLOAD DriverUnload;
343 PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];
345 typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT;
347 /* Irp definitions */
348 typedef UCHAR KIRQL, *PKIRQL;
349 typedef CCHAR KPROCESSOR_MODE;
351 typedef VOID (WINAPI *PDRIVER_CANCEL)(
352 IN struct _DEVICE_OBJECT *DeviceObject,
353 IN struct _IRP *Irp);
355 typedef VOID (WINAPI *PKNORMAL_ROUTINE)(
356 IN PVOID NormalContext,
357 IN PVOID SystemArgument1,
358 IN PVOID SystemArgument2);
360 typedef VOID (WINAPI *PKKERNEL_ROUTINE)(
361 IN struct _KAPC *Apc,
362 IN OUT PKNORMAL_ROUTINE *NormalRoutine,
363 IN OUT PVOID *NormalContext,
364 IN OUT PVOID *SystemArgument1,
365 IN OUT PVOID *SystemArgument2);
367 typedef VOID (WINAPI *PKRUNDOWN_ROUTINE)(
368 IN struct _KAPC *Apc);
370 typedef struct _KAPC {
374 struct _KTHREAD *Thread;
375 LIST_ENTRY ApcListEntry;
376 PKKERNEL_ROUTINE KernelRoutine;
377 PKRUNDOWN_ROUTINE RundownRoutine;
378 PKNORMAL_ROUTINE NormalRoutine;
380 PVOID SystemArgument1;
381 PVOID SystemArgument2;
383 KPROCESSOR_MODE ApcMode;
385 } KAPC, *PKAPC, *RESTRICTED_POINTER PRKAPC;
387 #include <pshpack1.h>
388 typedef struct _IRP {
391 struct _MDL *MdlAddress;
394 struct _IRP *MasterIrp;
398 LIST_ENTRY ThreadListEntry;
399 IO_STATUS_BLOCK IoStatus;
400 KPROCESSOR_MODE RequestorMode;
401 BOOLEAN PendingReturned;
403 CHAR CurrentLocation;
406 CCHAR ApcEnvironment;
407 UCHAR AllocationFlags;
408 PIO_STATUS_BLOCK UserIosb;
412 PIO_APC_ROUTINE UserApcRoutine;
413 PVOID UserApcContext;
414 } AsynchronousParameters;
415 LARGE_INTEGER AllocationSize;
417 PDRIVER_CANCEL CancelRoutine;
422 KDEVICE_QUEUE_ENTRY DeviceQueueEntry;
424 PVOID DriverContext[4];
428 PCHAR AuxiliaryBuffer;
430 LIST_ENTRY ListEntry;
432 struct _IO_STACK_LOCATION *CurrentStackLocation;
436 struct _FILE_OBJECT *OriginalFileObject;
442 typedef struct _IRP *PIRP;
445 /* MDL definitions */
447 typedef VOID (WINAPI *PINTERFACE_REFERENCE)(
450 typedef VOID (WINAPI *PINTERFACE_DEREFERENCE)(
453 typedef struct _INTERFACE {
457 PINTERFACE_REFERENCE InterfaceReference;
458 PINTERFACE_DEREFERENCE InterfaceDereference;
459 } INTERFACE, *PINTERFACE;
461 typedef struct _SECTION_OBJECT_POINTERS {
462 PVOID DataSectionObject;
463 PVOID SharedCacheMap;
464 PVOID ImageSectionObject;
465 } SECTION_OBJECT_POINTERS, *PSECTION_OBJECT_POINTERS;
467 typedef struct _IO_COMPLETION_CONTEXT {
470 } IO_COMPLETION_CONTEXT, *PIO_COMPLETION_CONTEXT;
472 typedef enum _DEVICE_RELATION_TYPE {
477 TargetDeviceRelation,
479 } DEVICE_RELATION_TYPE, *PDEVICE_RELATION_TYPE;
481 typedef struct _FILE_OBJECT {
484 PDEVICE_OBJECT DeviceObject;
488 PSECTION_OBJECT_POINTERS SectionObjectPointer;
489 PVOID PrivateCacheMap;
490 NTSTATUS FinalStatus;
491 struct _FILE_OBJECT *RelatedFileObject;
492 BOOLEAN LockOperation;
493 BOOLEAN DeletePending;
496 BOOLEAN DeleteAccess;
499 BOOLEAN SharedDelete;
501 UNICODE_STRING FileName;
502 LARGE_INTEGER CurrentByteOffset;
508 PIO_COMPLETION_CONTEXT CompletionContext;
510 typedef struct _FILE_OBJECT *PFILE_OBJECT;
512 #define INITIAL_PRIVILEGE_COUNT 3
514 typedef struct _INITIAL_PRIVILEGE_SET {
515 ULONG PrivilegeCount;
517 LUID_AND_ATTRIBUTES Privilege[INITIAL_PRIVILEGE_COUNT];
518 } INITIAL_PRIVILEGE_SET, * PINITIAL_PRIVILEGE_SET;
520 typedef struct _SECURITY_SUBJECT_CONTEXT {
521 PACCESS_TOKEN ClientToken;
522 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
523 PACCESS_TOKEN PrimaryToken;
524 PVOID ProcessAuditId;
525 } SECURITY_SUBJECT_CONTEXT, *PSECURITY_SUBJECT_CONTEXT;
527 typedef struct _ACCESS_STATE {
529 BOOLEAN SecurityEvaluated;
530 BOOLEAN GenerateAudit;
531 BOOLEAN GenerateOnClose;
532 BOOLEAN PrivilegesAllocated;
534 ACCESS_MASK RemainingDesiredAccess;
535 ACCESS_MASK PreviouslyGrantedAccess;
536 ACCESS_MASK OriginalDesiredAccess;
537 SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
538 PSECURITY_DESCRIPTOR SecurityDescriptor;
541 INITIAL_PRIVILEGE_SET InitialPrivilegeSet;
542 PRIVILEGE_SET PrivilegeSet;
545 BOOLEAN AuditPrivileges;
546 UNICODE_STRING ObjectName;
547 UNICODE_STRING ObjectTypeName;
548 } ACCESS_STATE, *PACCESS_STATE;
550 typedef struct _IO_SECURITY_CONTEXT {
551 PSECURITY_QUALITY_OF_SERVICE SecurityQos;
552 PACCESS_STATE AccessState;
553 ACCESS_MASK DesiredAccess;
554 ULONG FullCreateOptions;
555 } IO_SECURITY_CONTEXT, *PIO_SECURITY_CONTEXT;
557 typedef struct _DEVICE_CAPABILITIES {
562 ULONG LockSupported : 1;
563 ULONG EjectSupported : 1;
565 ULONG DockDevice : 1;
567 ULONG SilentInstall : 1;
568 ULONG RawDeviceOK : 1;
569 ULONG SurpriseRemovalOK : 1;
570 ULONG WakeFromD0 : 1;
571 ULONG WakeFromD1 : 1;
572 ULONG WakeFromD2 : 1;
573 ULONG WakeFromD3 : 1;
574 ULONG HardwareDisabled : 1;
575 ULONG NonDynamic : 1;
576 ULONG WarmEjectSupported : 1;
577 ULONG NoDisplayInUI : 1;
581 DEVICE_POWER_STATE DeviceState[PowerSystemMaximum];
582 SYSTEM_POWER_STATE SystemWake;
583 DEVICE_POWER_STATE DeviceWake;
587 } DEVICE_CAPABILITIES, *PDEVICE_CAPABILITIES;
589 typedef enum _INTERFACE_TYPE {
590 InterfaceTypeUndefined = -1,
608 } INTERFACE_TYPE, *PINTERFACE_TYPE;
610 typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS;
612 #define IO_RESOURCE_PREFERRED 0x01
613 #define IO_RESOURCE_DEFAULT 0x02
614 #define IO_RESOURCE_ALTERNATIVE 0x08
616 typedef struct _IO_RESOURCE_DESCRIPTOR {
619 UCHAR ShareDisposition;
627 PHYSICAL_ADDRESS MinimumAddress;
628 PHYSICAL_ADDRESS MaximumAddress;
633 PHYSICAL_ADDRESS MinimumAddress;
634 PHYSICAL_ADDRESS MaximumAddress;
641 ULONG MinimumChannel;
642 ULONG MaximumChannel;
647 PHYSICAL_ADDRESS MinimumAddress;
648 PHYSICAL_ADDRESS MaximumAddress;
665 } IO_RESOURCE_DESCRIPTOR, *PIO_RESOURCE_DESCRIPTOR;
667 typedef struct _IO_RESOURCE_LIST {
671 IO_RESOURCE_DESCRIPTOR Descriptors[1];
672 } IO_RESOURCE_LIST, *PIO_RESOURCE_LIST;
674 typedef struct _IO_RESOURCE_REQUIREMENTS_LIST {
676 INTERFACE_TYPE InterfaceType;
680 ULONG AlternativeLists;
681 IO_RESOURCE_LIST List[1];
682 } IO_RESOURCE_REQUIREMENTS_LIST, *PIO_RESOURCE_REQUIREMENTS_LIST;
684 typedef enum _BUS_QUERY_ID_TYPE {
687 BusQueryCompatibleIDs,
689 BusQueryDeviceSerialNumber
690 } BUS_QUERY_ID_TYPE, *PBUS_QUERY_ID_TYPE;
693 DevicePropertyDeviceDescription,
694 DevicePropertyHardwareID,
695 DevicePropertyCompatibleIDs,
696 DevicePropertyBootConfiguration,
697 DevicePropertyBootConfigurationTranslated,
698 DevicePropertyClassName,
699 DevicePropertyClassGuid,
700 DevicePropertyDriverKeyName,
701 DevicePropertyManufacturer,
702 DevicePropertyFriendlyName,
703 DevicePropertyLocationInformation,
704 DevicePropertyPhysicalDeviceObjectName,
705 DevicePropertyBusTypeGuid,
706 DevicePropertyLegacyBusType,
707 DevicePropertyBusNumber,
708 DevicePropertyEnumeratorName,
709 DevicePropertyAddress,
710 DevicePropertyUINumber,
711 DevicePropertyInstallState,
712 DevicePropertyRemovalPolicy
713 } DEVICE_REGISTRY_PROPERTY;
715 typedef enum _DEVICE_TEXT_TYPE {
716 DeviceTextDescription,
717 DeviceTextLocationInformation
718 } DEVICE_TEXT_TYPE, *PDEVICE_TEXT_TYPE;
720 typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE {
721 DeviceUsageTypeUndefined,
722 DeviceUsageTypePaging,
723 DeviceUsageTypeHibernation,
724 DeviceUsageTypeDumpFile
725 } DEVICE_USAGE_NOTIFICATION_TYPE;
727 typedef struct _POWER_SEQUENCE {
731 } POWER_SEQUENCE, *PPOWER_SEQUENCE;
733 typedef enum _POWER_STATE_TYPE {
736 } POWER_STATE_TYPE, *PPOWER_STATE_TYPE;
738 typedef union _POWER_STATE {
739 SYSTEM_POWER_STATE SystemState;
740 DEVICE_POWER_STATE DeviceState;
741 } POWER_STATE, *PPOWER_STATE;
743 typedef struct _CM_PARTIAL_RESOURCE_DESCRIPTOR {
745 UCHAR ShareDisposition;
749 PHYSICAL_ADDRESS Start;
753 PHYSICAL_ADDRESS Start;
762 PHYSICAL_ADDRESS Start;
782 } DeviceSpecificData;
784 } CM_PARTIAL_RESOURCE_DESCRIPTOR, *PCM_PARTIAL_RESOURCE_DESCRIPTOR;
786 typedef struct _CM_PARTIAL_RESOURCE_LIST {
790 CM_PARTIAL_RESOURCE_DESCRIPTOR PartialDescriptors[1];
791 } CM_PARTIAL_RESOURCE_LIST, *PCM_PARTIAL_RESOURCE_LIST;
793 typedef struct _CM_FULL_RESOURCE_DESCRIPTOR {
794 INTERFACE_TYPE InterfaceType;
796 CM_PARTIAL_RESOURCE_LIST PartialResourceList;
797 } CM_FULL_RESOURCE_DESCRIPTOR, *PCM_FULL_RESOURCE_DESCRIPTOR;
799 typedef struct _CM_RESOURCE_LIST {
801 CM_FULL_RESOURCE_DESCRIPTOR List[1];
802 } CM_RESOURCE_LIST, *PCM_RESOURCE_LIST;
804 typedef NTSTATUS (WINAPI *PIO_COMPLETION_ROUTINE)(
805 IN struct _DEVICE_OBJECT *DeviceObject,
809 #define SL_PENDING_RETURNED 0x01
810 #define SL_INVOKE_ON_CANCEL 0x20
811 #define SL_INVOKE_ON_SUCCESS 0x40
812 #define SL_INVOKE_ON_ERROR 0x80
814 #include <pshpack1.h>
815 typedef struct _IO_STACK_LOCATION {
822 PIO_SECURITY_CONTEXT SecurityContext;
824 USHORT POINTER_ALIGNMENT FileAttributes;
826 ULONG POINTER_ALIGNMENT EaLength;
830 ULONG POINTER_ALIGNMENT Key;
831 LARGE_INTEGER ByteOffset;
835 ULONG POINTER_ALIGNMENT Key;
836 LARGE_INTEGER ByteOffset;
840 FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
844 FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
845 PFILE_OBJECT FileObject;
848 BOOLEAN ReplaceIfExists;
857 FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
860 ULONG OutputBufferLength;
861 ULONG POINTER_ALIGNMENT InputBufferLength;
862 ULONG POINTER_ALIGNMENT IoControlCode;
863 PVOID Type3InputBuffer;
866 SECURITY_INFORMATION SecurityInformation;
867 ULONG POINTER_ALIGNMENT Length;
870 SECURITY_INFORMATION SecurityInformation;
871 PSECURITY_DESCRIPTOR SecurityDescriptor;
875 PDEVICE_OBJECT DeviceObject;
879 PDEVICE_OBJECT DeviceObject;
882 struct _SCSI_REQUEST_BLOCK *Srb;
885 DEVICE_RELATION_TYPE Type;
886 } QueryDeviceRelations;
888 CONST GUID *InterfaceType;
891 PINTERFACE Interface;
892 PVOID InterfaceSpecificData;
895 PDEVICE_CAPABILITIES Capabilities;
896 } DeviceCapabilities;
898 PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;
899 } FilterResourceRequirements;
904 ULONG POINTER_ALIGNMENT Length;
910 BUS_QUERY_ID_TYPE IdType;
913 DEVICE_TEXT_TYPE DeviceTextType;
914 LCID POINTER_ALIGNMENT LocaleId;
919 DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;
922 SYSTEM_POWER_STATE PowerState;
925 PPOWER_SEQUENCE PowerSequence;
929 POWER_STATE_TYPE POINTER_ALIGNMENT Type;
930 POWER_STATE POINTER_ALIGNMENT State;
931 POWER_ACTION POINTER_ALIGNMENT ShutdownType;
934 PCM_RESOURCE_LIST AllocatedResources;
935 PCM_RESOURCE_LIST AllocatedResourcesTranslated;
938 ULONG_PTR ProviderId;
950 PDEVICE_OBJECT DeviceObject;
951 PFILE_OBJECT FileObject;
952 PIO_COMPLETION_ROUTINE CompletionRoutine;
954 } IO_STACK_LOCATION, *PIO_STACK_LOCATION;
957 typedef struct _MDL {
961 struct _EPROCESS *Process;
962 PVOID MappedSystemVa;
968 typedef struct _KTIMER {
969 DISPATCHER_HEADER Header;
970 ULARGE_INTEGER DueTime;
971 LIST_ENTRY TimerListEntry;
976 typedef struct _KSYSTEM_TIME {
980 } KSYSTEM_TIME, *PKSYSTEM_TIME;
982 typedef enum _NT_PRODUCT_TYPE {
986 } NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;
988 #define PROCESSOR_FEATURE_MAX 64
990 typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
995 } ALTERNATIVE_ARCHITECTURE_TYPE;
997 #define NX_SUPPORT_POLICY_ALWAYSOFF 0
998 #define NX_SUPPORT_POLICY_ALWAYSON 1
999 #define NX_SUPPORT_POLICY_OPTIN 2
1000 #define NX_SUPPORT_POLICY_OPTOUT 3
1002 #define MAX_WOW64_SHARED_ENTRIES 16
1004 typedef struct _KUSER_SHARED_DATA {
1005 ULONG TickCountLowDeprecated;
1006 ULONG TickCountMultiplier;
1007 volatile KSYSTEM_TIME InterruptTime;
1008 volatile KSYSTEM_TIME SystemTime;
1009 volatile KSYSTEM_TIME TimeZoneBias;
1010 USHORT ImageNumberLow;
1011 USHORT ImageNumberHigh;
1012 WCHAR NtSystemRoot[260];
1013 ULONG MaxStackTraceDepth;
1014 ULONG CryptoExponent;
1016 ULONG LargePageMinimum;
1018 NT_PRODUCT_TYPE NtProductType;
1019 BOOLEAN ProductTypeIsValid;
1020 ULONG NtMajorVersion;
1021 ULONG NtMinorVersion;
1022 BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];
1025 volatile ULONG TimeSlip;
1026 ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
1027 LARGE_INTEGER SystemExpirationDate;
1029 BOOLEAN KdDebuggerEnabled;
1030 UCHAR NXSupportPolicy;
1031 volatile ULONG ActiveConsoleId;
1032 volatile ULONG DismountCount;
1033 ULONG ComPlusPackage;
1034 ULONG LastSystemRITEventTickCount;
1035 ULONG NumberOfPhysicalPages;
1036 BOOLEAN SafeBootMode;
1038 ULONGLONG TestRetInstruction;
1040 ULONG SystemCallReturn;
1041 ULONGLONG SystemCallPad[3];
1043 volatile KSYSTEM_TIME TickCount;
1044 volatile ULONG64 TickCountQuad;
1047 ULONG Wow64SharedInformation[MAX_WOW64_SHARED_ENTRIES];
1048 } KSHARED_USER_DATA, *PKSHARED_USER_DATA;
1050 typedef enum _MEMORY_CACHING_TYPE {
1053 MmWriteCombined = 2,
1054 MmHardwareCoherentCached = 3,
1055 MmNonCachedUnordered = 4,
1057 MmMaximumCacheType = 6
1058 } MEMORY_CACHING_TYPE;
1060 typedef enum _MM_SYSTEM_SIZE
1067 NTSTATUS WINAPI ObCloseHandle(IN HANDLE handle);
1069 #ifdef NONAMELESSUNION
1070 # ifdef NONAMELESSSTRUCT
1071 # define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.u2.CurrentStackLocation)
1072 # define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.u2.CurrentStackLocation - 1)
1074 # define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.u2.CurrentStackLocation)
1075 # define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.u2.CurrentStackLocation - 1)
1078 # ifdef NONAMELESSSTRUCT
1079 # define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.CurrentStackLocation)
1080 # define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.CurrentStackLocation - 1)
1082 # define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.CurrentStackLocation)
1083 # define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.CurrentStackLocation - 1)
1087 #define KernelMode 0
1090 /* directory object access rights */
1091 #define DIRECTORY_QUERY 0x0001
1092 #define DIRECTORY_TRAVERSE 0x0002
1093 #define DIRECTORY_CREATE_OBJECT 0x0004
1094 #define DIRECTORY_CREATE_SUBDIRECTORY 0x0008
1095 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)
1097 /* symbolic link access rights */
1098 #define SYMBOLIC_LINK_QUERY 0x0001
1099 #define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
1101 PVOID WINAPI ExAllocatePool(POOL_TYPE,SIZE_T);
1102 PVOID WINAPI ExAllocatePoolWithQuota(POOL_TYPE,SIZE_T);
1103 PVOID WINAPI ExAllocatePoolWithTag(POOL_TYPE,SIZE_T,ULONG);
1104 PVOID WINAPI ExAllocatePoolWithQuotaTag(POOL_TYPE,SIZE_T,ULONG);
1105 void WINAPI ExFreePool(PVOID);
1106 void WINAPI ExFreePoolWithTag(PVOID,ULONG);
1108 NTSTATUS WINAPI IoAllocateDriverObjectExtension(PDRIVER_OBJECT,PVOID,ULONG,PVOID*);
1109 PVOID WINAPI IoAllocateErrorLogEntry(PVOID,UCHAR);
1110 PIRP WINAPI IoAllocateIrp(CCHAR,BOOLEAN);
1111 NTSTATUS WINAPI IoCallDriver(DEVICE_OBJECT*,IRP*);
1112 VOID WINAPI IoCompleteRequest(IRP*,UCHAR);
1113 NTSTATUS WINAPI IoCreateDevice(DRIVER_OBJECT*,ULONG,UNICODE_STRING*,DEVICE_TYPE,ULONG,BOOLEAN,DEVICE_OBJECT**);
1114 NTSTATUS WINAPI IoCreateDriver(UNICODE_STRING*,PDRIVER_INITIALIZE);
1115 NTSTATUS WINAPI IoCreateSymbolicLink(UNICODE_STRING*,UNICODE_STRING*);
1116 void WINAPI IoDeleteDevice(DEVICE_OBJECT*);
1117 void WINAPI IoDeleteDriver(DRIVER_OBJECT*);
1118 NTSTATUS WINAPI IoDeleteSymbolicLink(UNICODE_STRING*);
1119 void WINAPI IoFreeIrp(IRP*);
1120 PEPROCESS WINAPI IoGetCurrentProcess(void);
1121 NTSTATUS WINAPI IoGetDeviceInterfaces(CONST GUID*,PDEVICE_OBJECT,ULONG,PWSTR*);
1122 NTSTATUS WINAPI IoGetDeviceObjectPointer(UNICODE_STRING*,ACCESS_MASK,PFILE_OBJECT*,PDEVICE_OBJECT*);
1123 NTSTATUS WINAPI IoGetDeviceProperty(PDEVICE_OBJECT,DEVICE_REGISTRY_PROPERTY,ULONG,PVOID,PULONG);
1124 PVOID WINAPI IoGetDriverObjectExtension(PDRIVER_OBJECT,PVOID);
1125 PDEVICE_OBJECT WINAPI IoGetRelatedDeviceObject(PFILE_OBJECT);
1126 void WINAPI IoInitializeIrp(IRP*,USHORT,CCHAR);
1127 NTSTATUS WINAPI IoWMIRegistrationControl(PDEVICE_OBJECT,ULONG);
1129 PKTHREAD WINAPI KeGetCurrentThread(void);
1130 void WINAPI KeQuerySystemTime(LARGE_INTEGER*);
1131 void WINAPI KeQueryTickCount(LARGE_INTEGER*);
1132 ULONG WINAPI KeQueryTimeIncrement(void);
1133 LONG WINAPI KeReleaseSemaphore(PRKSEMAPHORE,KPRIORITY,LONG,BOOLEAN);
1134 LONG WINAPI KeResetEvent(PRKEVENT);
1135 LONG WINAPI KeSetEvent(PRKEVENT,KPRIORITY,BOOLEAN);
1136 KPRIORITY WINAPI KeSetPriorityThread(PKTHREAD,KPRIORITY);
1138 PVOID WINAPI MmAllocateContiguousMemory(SIZE_T,PHYSICAL_ADDRESS);
1139 PVOID WINAPI MmAllocateNonCachedMemory(SIZE_T);
1140 PMDL WINAPI MmAllocatePagesForMdl(PHYSICAL_ADDRESS,PHYSICAL_ADDRESS,PHYSICAL_ADDRESS,SIZE_T);
1141 void WINAPI MmFreeNonCachedMemory(PVOID,SIZE_T);
1142 MM_SYSTEMSIZE WINAPI MmQuerySystemSize(void);
1144 NTSTATUS WINAPI ObReferenceObjectByHandle(HANDLE,ACCESS_MASK,POBJECT_TYPE,KPROCESSOR_MODE,PVOID*,POBJECT_HANDLE_INFORMATION);
1146 POWER_STATE WINAPI PoSetPowerState(PDEVICE_OBJECT,POWER_STATE_TYPE,POWER_STATE);
1147 NTSTATUS WINAPI PsCreateSystemThread(PHANDLE,ULONG,POBJECT_ATTRIBUTES,HANDLE,PCLIENT_ID,PKSTART_ROUTINE,PVOID);
1148 #define PsGetCurrentProcess() IoGetCurrentProcess()
1149 #define PsGetCurrentThread() ((PETHREAD)KeGetCurrentThread())
1150 HANDLE WINAPI PsGetCurrentProcessId(void);
1151 HANDLE WINAPI PsGetCurrentThreadId(void);
1152 BOOLEAN WINAPI PsGetVersion(ULONG*,ULONG*,ULONG*,UNICODE_STRING*);
1153 NTSTATUS WINAPI PsTerminateSystemThread(NTSTATUS);
1155 NTSTATUS WINAPI ZwAddBootEntry(PUNICODE_STRING,PUNICODE_STRING);
1156 NTSTATUS WINAPI ZwAccessCheckAndAuditAlarm(PUNICODE_STRING,HANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,ACCESS_MASK,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PBOOLEAN,PBOOLEAN);
1157 NTSTATUS WINAPI ZwAdjustPrivilegesToken(HANDLE,BOOLEAN,PTOKEN_PRIVILEGES,DWORD,PTOKEN_PRIVILEGES,PDWORD);
1158 NTSTATUS WINAPI ZwAlertThread(HANDLE ThreadHandle);
1159 NTSTATUS WINAPI ZwAllocateVirtualMemory(HANDLE,PVOID*,ULONG,SIZE_T*,ULONG,ULONG);
1160 NTSTATUS WINAPI ZwCancelIoFile(HANDLE,PIO_STATUS_BLOCK);
1161 NTSTATUS WINAPI ZwCancelTimer(HANDLE, BOOLEAN*);
1162 NTSTATUS WINAPI ZwClearEvent(HANDLE);
1163 NTSTATUS WINAPI ZwClose(HANDLE);
1164 NTSTATUS WINAPI ZwCloseObjectAuditAlarm(PUNICODE_STRING,HANDLE,BOOLEAN);
1165 NTSTATUS WINAPI ZwConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
1166 NTSTATUS WINAPI ZwCreateDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
1167 NTSTATUS WINAPI ZwCreateEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *,BOOLEAN,BOOLEAN);
1168 NTSTATUS WINAPI ZwCreateFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG);
1169 NTSTATUS WINAPI ZwCreateKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,PULONG);
1170 NTSTATUS WINAPI ZwCreateSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const LARGE_INTEGER*,ULONG,ULONG,HANDLE);
1171 NTSTATUS WINAPI ZwCreateSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PUNICODE_STRING);
1172 NTSTATUS WINAPI ZwCreateTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*, TIMER_TYPE);
1173 NTSTATUS WINAPI ZwDeleteAtom(RTL_ATOM);
1174 NTSTATUS WINAPI ZwDeleteFile(POBJECT_ATTRIBUTES);
1175 NTSTATUS WINAPI ZwDeleteKey(HANDLE);
1176 NTSTATUS WINAPI ZwDeleteValueKey(HANDLE,const UNICODE_STRING *);
1177 NTSTATUS WINAPI ZwDeviceIoControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
1178 NTSTATUS WINAPI ZwDisplayString(PUNICODE_STRING);
1179 NTSTATUS WINAPI ZwDuplicateObject(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,ULONG,ULONG);
1180 NTSTATUS WINAPI ZwDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
1181 NTSTATUS WINAPI ZwEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
1182 NTSTATUS WINAPI ZwEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
1183 NTSTATUS WINAPI ZwFlushInstructionCache(HANDLE,LPCVOID,SIZE_T);
1184 NTSTATUS WINAPI ZwFlushKey(HANDLE);
1185 NTSTATUS WINAPI ZwFlushVirtualMemory(HANDLE,LPCVOID*,SIZE_T*,ULONG);
1186 NTSTATUS WINAPI ZwFreeVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
1187 NTSTATUS WINAPI ZwFsControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
1188 NTSTATUS WINAPI ZwInitiatePowerAction(POWER_ACTION,SYSTEM_POWER_STATE,ULONG,BOOLEAN);
1189 NTSTATUS WINAPI ZwLoadDriver(const UNICODE_STRING *);
1190 NTSTATUS WINAPI ZwLoadKey(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *);
1191 NTSTATUS WINAPI ZwLockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
1192 NTSTATUS WINAPI ZwMakeTemporaryObject(HANDLE);
1193 NTSTATUS WINAPI ZwMapViewOfSection(HANDLE,HANDLE,PVOID*,ULONG,SIZE_T,const LARGE_INTEGER*,SIZE_T*,SECTION_INHERIT,ULONG,ULONG);
1194 NTSTATUS WINAPI ZwNotifyChangeKey(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
1195 NTSTATUS WINAPI ZwOpenDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
1196 NTSTATUS WINAPI ZwOpenEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
1197 NTSTATUS WINAPI ZwOpenFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG);
1198 NTSTATUS WINAPI ZwOpenKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
1199 NTSTATUS WINAPI ZwOpenProcess(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
1200 NTSTATUS WINAPI ZwOpenProcessToken(HANDLE,DWORD,HANDLE *);
1201 NTSTATUS WINAPI ZwOpenSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
1202 NTSTATUS WINAPI ZwOpenSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
1203 NTSTATUS WINAPI ZwOpenThread(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
1204 NTSTATUS WINAPI ZwOpenThreadToken(HANDLE,DWORD,BOOLEAN,HANDLE *);
1205 NTSTATUS WINAPI ZwOpenTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*);
1206 NTSTATUS WINAPI ZwPowerInformation(POWER_INFORMATION_LEVEL,PVOID,ULONG,PVOID,ULONG);
1207 NTSTATUS WINAPI ZwPulseEvent(HANDLE,PULONG);
1208 NTSTATUS WINAPI ZwQueryDefaultLocale(BOOLEAN,LCID*);
1209 NTSTATUS WINAPI ZwQueryDefaultUILanguage(LANGID*);
1210 NTSTATUS WINAPI ZwQueryDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS,BOOLEAN,PUNICODE_STRING,BOOLEAN);
1211 NTSTATUS WINAPI ZwQueryDirectoryObject(HANDLE,PDIRECTORY_BASIC_INFORMATION,ULONG,BOOLEAN,BOOLEAN,PULONG,PULONG);
1212 NTSTATUS WINAPI ZwQueryEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,BOOLEAN,PVOID,ULONG,PVOID,BOOLEAN);
1213 NTSTATUS WINAPI ZwQueryFullAttributesFile(const OBJECT_ATTRIBUTES*,FILE_NETWORK_OPEN_INFORMATION*);
1214 NTSTATUS WINAPI ZwQueryInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,LONG,FILE_INFORMATION_CLASS);
1215 NTSTATUS WINAPI ZwQueryInformationThread(HANDLE,THREADINFOCLASS,PVOID,ULONG,PULONG);
1216 NTSTATUS WINAPI ZwQueryInformationToken(HANDLE,DWORD,PVOID,DWORD,LPDWORD);
1217 NTSTATUS WINAPI ZwQueryInstallUILanguage(LANGID*);
1218 NTSTATUS WINAPI ZwQueryKey(HANDLE,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
1219 NTSTATUS WINAPI ZwQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
1220 NTSTATUS WINAPI ZwQuerySecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR,ULONG,PULONG);
1221 NTSTATUS WINAPI ZwQuerySection(HANDLE,SECTION_INFORMATION_CLASS,PVOID,ULONG,PULONG);
1222 NTSTATUS WINAPI ZwQuerySymbolicLinkObject(HANDLE,PUNICODE_STRING,PULONG);
1223 NTSTATUS WINAPI ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG);
1224 NTSTATUS WINAPI ZwQueryTimerResolution(PULONG,PULONG,PULONG);
1225 NTSTATUS WINAPI ZwQueryValueKey(HANDLE,const UNICODE_STRING *,KEY_VALUE_INFORMATION_CLASS,void *,DWORD,DWORD *);
1226 NTSTATUS WINAPI ZwQueryVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
1227 NTSTATUS WINAPI ZwReadFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG);
1228 NTSTATUS WINAPI ZwReplaceKey(POBJECT_ATTRIBUTES,HANDLE,POBJECT_ATTRIBUTES);
1229 NTSTATUS WINAPI ZwRequestWaitReplyPort(HANDLE,PLPC_MESSAGE,PLPC_MESSAGE);
1230 NTSTATUS WINAPI ZwResetEvent(HANDLE,PULONG);
1231 NTSTATUS WINAPI ZwRestoreKey(HANDLE,HANDLE,ULONG);
1232 NTSTATUS WINAPI ZwSaveKey(HANDLE,HANDLE);
1233 NTSTATUS WINAPI ZwSecureConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PSID,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
1234 NTSTATUS WINAPI ZwSetDefaultLocale(BOOLEAN,LCID);
1235 NTSTATUS WINAPI ZwSetDefaultUILanguage(LANGID);
1236 NTSTATUS WINAPI ZwSetEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG);
1237 NTSTATUS WINAPI ZwSetEvent(HANDLE,PULONG);
1238 NTSTATUS WINAPI ZwSetInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS);
1239 NTSTATUS WINAPI ZwSetInformationKey(HANDLE,const int,PVOID,ULONG);
1240 NTSTATUS WINAPI ZwSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG);
1241 NTSTATUS WINAPI ZwSetInformationProcess(HANDLE,PROCESS_INFORMATION_CLASS,PVOID,ULONG);
1242 NTSTATUS WINAPI ZwSetInformationThread(HANDLE,THREADINFOCLASS,LPCVOID,ULONG);
1243 NTSTATUS WINAPI ZwSetIoCompletion(HANDLE,ULONG,ULONG,NTSTATUS,ULONG);
1244 NTSTATUS WINAPI ZwSetSecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR);
1245 NTSTATUS WINAPI ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG);
1246 NTSTATUS WINAPI ZwSetSystemTime(const LARGE_INTEGER*,LARGE_INTEGER*);
1247 NTSTATUS WINAPI ZwSetTimer(HANDLE, const LARGE_INTEGER*, PTIMER_APC_ROUTINE, PVOID, BOOLEAN, ULONG, BOOLEAN*);
1248 NTSTATUS WINAPI ZwSetValueKey(HANDLE,const UNICODE_STRING *,ULONG,ULONG,const void *,ULONG);
1249 NTSTATUS WINAPI ZwSetVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
1250 NTSTATUS WINAPI ZwSuspendThread(HANDLE,PULONG);
1251 NTSTATUS WINAPI ZwTerminateProcess(HANDLE,LONG);
1252 NTSTATUS WINAPI ZwUnloadDriver(const UNICODE_STRING *);
1253 NTSTATUS WINAPI ZwUnloadKey(HANDLE);
1254 NTSTATUS WINAPI ZwUnmapViewOfSection(HANDLE,PVOID);
1255 NTSTATUS WINAPI ZwWaitForSingleObject(HANDLE,BOOLEAN,const LARGE_INTEGER*);
1256 NTSTATUS WINAPI ZwWaitForMultipleObjects(ULONG,const HANDLE*,BOOLEAN,BOOLEAN,const LARGE_INTEGER*);
1257 NTSTATUS WINAPI ZwWriteFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,const void*,ULONG,PLARGE_INTEGER,PULONG);
1258 NTSTATUS WINAPI ZwYieldExecution(void);