2 * Copyright 2004-2005 Ivan Leo Puoti
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
26 #define POINTER_ALIGNMENT DECLSPEC_ALIGN(8)
28 #define POINTER_ALIGNMENT
31 typedef LONG KPRIORITY;
33 typedef ULONG_PTR KSPIN_LOCK, *PKSPIN_LOCK;
38 struct _DEVICE_OBJECT;
39 struct _DRIVER_OBJECT;
41 typedef VOID (WINAPI *PKDEFERRED_ROUTINE)(struct _KDPC *, PVOID, PVOID, PVOID);
42 typedef VOID (WINAPI *PKSTART_ROUTINE)(PVOID);
44 typedef NTSTATUS (WINAPI *PDRIVER_INITIALIZE)(struct _DRIVER_OBJECT *, PUNICODE_STRING);
45 typedef NTSTATUS (WINAPI *PDRIVER_DISPATCH)(struct _DEVICE_OBJECT *, struct _IRP *);
46 typedef void (WINAPI *PDRIVER_STARTIO)(struct _DEVICE_OBJECT *, struct _IRP *);
47 typedef void (WINAPI *PDRIVER_UNLOAD)(struct _DRIVER_OBJECT *);
49 typedef struct _DISPATCHER_HEADER {
55 LIST_ENTRY WaitListHead;
56 } DISPATCHER_HEADER, *PDISPATCHER_HEADER;
58 typedef struct _KEVENT {
59 DISPATCHER_HEADER Header;
60 } KEVENT, *PKEVENT, *RESTRICTED_POINTER PRKEVENT;
62 typedef struct _KSEMAPHORE {
63 DISPATCHER_HEADER Header;
65 } KSEMAPHORE, *PKSEMAPHORE, *PRKSEMAPHORE;
67 typedef struct _KDPC {
71 LIST_ENTRY DpcListEntry;
72 PKDEFERRED_ROUTINE DeferredRoutine;
73 PVOID DeferredContext;
74 PVOID SystemArgument1;
75 PVOID SystemArgument2;
77 } KDPC, *PKDPC, *RESTRICTED_POINTER PRKDPC;
79 typedef struct _KDEVICE_QUEUE_ENTRY {
80 LIST_ENTRY DeviceListEntry;
83 } KDEVICE_QUEUE_ENTRY, *PKDEVICE_QUEUE_ENTRY,
84 *RESTRICTED_POINTER PRKDEVICE_QUEUE_ENTRY;
86 typedef struct _KDEVICE_QUEUE {
89 LIST_ENTRY DeviceListHead;
92 } KDEVICE_QUEUE, *PKDEVICE_QUEUE, *RESTRICTED_POINTER PRKDEVICE_QUEUE;
94 typedef struct _KMUTANT {
95 DISPATCHER_HEADER Header;
96 LIST_ENTRY MutantListEntry;
97 struct _KTHREAD *RESTRICTED_POINTER OwnerThread;
100 } KMUTANT, *PKMUTANT, *RESTRICTED_POINTER PRKMUTANT, KMUTEX, *PKMUTEX, *RESTRICTED_POINTER PRKMUTEX;
102 typedef enum _KWAIT_REASON
132 typedef struct _ALLOCATE_FUNCTION *PALLOCATE_FUNCTION;
133 typedef struct _IO_TIMER *PIO_TIMER;
134 typedef struct _IO_TIMER_ROUTINE *PIO_TIMER_ROUTINE;
135 typedef struct _ETHREAD *PETHREAD;
136 typedef struct _FREE_FUNCTION *PFREE_FUNCTION;
137 typedef struct _KTHREAD *PKTHREAD, *PRKTHREAD;
138 typedef struct _EPROCESS *PEPROCESS;
139 typedef struct _ERESOURCE *PERESOURCE;
140 typedef struct _IO_WORKITEM *PIO_WORKITEM;
141 typedef struct _NPAGED_LOOKASIDE_LIST *PNPAGED_LOOKASIDE_LIST;
142 typedef struct _PAGED_LOOKASIDE_LIST *PPAGED_LOOKASIDE_LIST;
143 typedef struct _OBJECT_TYPE *POBJECT_TYPE;
144 typedef struct _OBJECT_HANDLE_INFORMATION *POBJECT_HANDLE_INFORMATION;
145 typedef struct _ZONE_HEADER *PZONE_HEADER;
147 typedef struct _FAST_MUTEX
154 } FAST_MUTEX, *PFAST_MUTEX;
156 #define MAXIMUM_VOLUME_LABEL_LENGTH (32 * sizeof(WCHAR))
158 typedef struct _VPB {
162 USHORT VolumeLabelLength;
163 struct _DEVICE_OBJECT *DeviceObject;
164 struct _DEVICE_OBJECT *RealDevice;
166 ULONG ReferenceCount;
167 WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH / sizeof(WCHAR)];
170 typedef enum _POOL_TYPE {
173 NonPagedPoolMustSucceed,
175 NonPagedPoolCacheAligned,
176 PagedPoolCacheAligned,
177 NonPagedPoolCacheAlignedMustS,
181 typedef struct _WAIT_CONTEXT_BLOCK {
182 KDEVICE_QUEUE_ENTRY WaitQueueEntry;
183 struct _DRIVER_CONTROL *DeviceRoutine;
185 ULONG NumberOfMapRegisters;
188 PKDPC BufferChainingDpc;
189 } WAIT_CONTEXT_BLOCK, *PWAIT_CONTEXT_BLOCK;
191 #define DO_BUFFERED_IO 0x00000004
192 #define DO_EXCLUSIVE 0x00000008
193 #define DO_DIRECT_IO 0x00000010
194 #define DO_MAP_IO_BUFFER 0x00000020
195 #define DO_DEVICE_INITIALIZING 0x00000080
196 #define DO_SHUTDOWN_REGISTERED 0x00000800
197 #define DO_BUS_ENUMERATED_DEVICE 0x00001000
198 #define DO_POWER_PAGABLE 0x00002000
199 #define DO_POWER_INRUSH 0x00004000
201 #define IO_NO_INCREMENT 0
202 #define IO_CD_ROM_INCREMENT 1
203 #define IO_DISK_INCREMENT 1
204 #define IO_KEYBOARD_INCREMENT 6
205 #define IO_MAILSLOT_INCREMENT 2
206 #define IO_MOUSE_INCREMENT 6
207 #define IO_NAMED_PIPE_INCREMENT 2
208 #define IO_NETWORK_INCREMENT 2
209 #define IO_PARALLEL_INCREMENT 1
210 #define IO_SERIAL_INCREMENT 2
211 #define IO_SOUND_INCREMENT 8
212 #define IO_VIDEO_INCREMENT 1
215 #define DEVICE_TYPE ULONG
217 #define IRP_MJ_MAXIMUM_FUNCTION 0x1b
218 #define IRP_MJ_CREATE 0x00
219 #define IRP_MJ_CREATE_NAMED_PIPE 0x01
220 #define IRP_MJ_CLOSE 0x02
221 #define IRP_MJ_READ 0x03
222 #define IRP_MJ_WRITE 0x04
223 #define IRP_MJ_QUERY_INFORMATION 0x05
224 #define IRP_MJ_SET_INFORMATION 0x06
225 #define IRP_MJ_QUERY_EA 0x07
226 #define IRP_MJ_SET_EA 0x08
227 #define IRP_MJ_FLUSH_BUFFERS 0x09
228 #define IRP_MJ_QUERY_VOLUME_INFORMATION 0x0a
229 #define IRP_MJ_SET_VOLUME_INFORMATION 0x0b
230 #define IRP_MJ_DIRECTORY_CONTROL 0x0c
231 #define IRP_MJ_FILE_SYSTEM_CONTROL 0x0d
232 #define IRP_MJ_DEVICE_CONTROL 0x0e
233 #define IRP_MJ_INTERNAL_DEVICE_CONTROL 0x0f
234 #define IRP_MJ_SHUTDOWN 0x10
235 #define IRP_MJ_LOCK_CONTROL 0x11
236 #define IRP_MJ_CLEANUP 0x12
237 #define IRP_MJ_CREATE_MAILSLOT 0x13
238 #define IRP_MJ_QUERY_SECURITY 0x14
239 #define IRP_MJ_SET_SECURITY 0x15
240 #define IRP_MJ_POWER 0x16
241 #define IRP_MJ_SYSTEM_CONTROL 0x17
242 #define IRP_MJ_DEVICE_CHANGE 0x18
243 #define IRP_MJ_QUERY_QUOTA 0x19
244 #define IRP_MJ_SET_QUOTA 0x1a
245 #define IRP_MJ_PNP 0x1b
247 #define IRP_MN_START_DEVICE 0x00
248 #define IRP_MN_QUERY_REMOVE_DEVICE 0x01
249 #define IRP_MN_REMOVE_DEVICE 0x02
250 #define IRP_MN_CANCEL_REMOVE_DEVICE 0x03
251 #define IRP_MN_STOP_DEVICE 0x04
252 #define IRP_MN_QUERY_STOP_DEVICE 0x05
253 #define IRP_MN_CANCEL_STOP_DEVICE 0x06
254 #define IRP_MN_QUERY_DEVICE_RELATIONS 0x07
255 #define IRP_MN_QUERY_INTERFACE 0x08
256 #define IRP_MN_QUERY_CAPABILITIES 0x09
257 #define IRP_MN_QUERY_RESOURCES 0x0A
258 #define IRP_MN_QUERY_RESOURCE_REQUIREMENTS 0x0B
259 #define IRP_MN_QUERY_DEVICE_TEXT 0x0C
260 #define IRP_MN_FILTER_RESOURCE_REQUIREMENTS 0x0D
261 #define IRP_MN_READ_CONFIG 0x0F
262 #define IRP_MN_WRITE_CONFIG 0x10
263 #define IRP_MN_EJECT 0x11
264 #define IRP_MN_SET_LOCK 0x12
265 #define IRP_MN_QUERY_ID 0x13
266 #define IRP_MN_QUERY_PNP_DEVICE_STATE 0x14
267 #define IRP_MN_QUERY_BUS_INFORMATION 0x15
268 #define IRP_MN_DEVICE_USAGE_NOTIFICATION 0x16
269 #define IRP_MN_SURPRISE_REMOVAL 0x17
271 #define IRP_QUOTA_CHARGED 0x01
272 #define IRP_ALLOCATED_MUST_SUCCEED 0x02
273 #define IRP_ALLOCATED_FIXED_SIZE 0x04
274 #define IRP_LOOKASIDE_ALLOCATION 0x08
276 #define IO_TYPE_ADAPTER 0x01
277 #define IO_TYPE_CONTROLLER 0x02
278 #define IO_TYPE_DEVICE 0x03
279 #define IO_TYPE_DRIVER 0x04
280 #define IO_TYPE_FILE 0x05
281 #define IO_TYPE_IRP 0x06
282 #define IO_TYPE_MASTER_ADAPTER 0x07
283 #define IO_TYPE_OPEN_PACKET 0x08
284 #define IO_TYPE_TIMER 0x09
285 #define IO_TYPE_VPB 0x0a
286 #define IO_TYPE_ERROR_LOG 0x0b
287 #define IO_TYPE_ERROR_MESSAGE 0x0c
288 #define IO_TYPE_DEVICE_OBJECT_EXTENSION 0x0d
290 typedef struct _DEVICE_OBJECT {
294 struct _DRIVER_OBJECT *DriverObject;
295 struct _DEVICE_OBJECT *NextDevice;
296 struct _DEVICE_OBJECT *AttachedDevice;
297 struct _IRP *CurrentIrp;
300 ULONG Characteristics;
302 PVOID DeviceExtension;
303 DEVICE_TYPE DeviceType;
306 LIST_ENTRY ListEntry;
307 WAIT_CONTEXT_BLOCK Wcb;
309 ULONG AlignmentRequirement;
310 KDEVICE_QUEUE DeviceQueue;
312 ULONG ActiveThreadCount;
313 PSECURITY_DESCRIPTOR SecurityDescriptor;
317 struct _DEVOBJ_EXTENSION *DeviceObjectExtension;
320 typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT;
322 typedef struct _DRIVER_EXTENSION {
323 struct _DRIVER_OBJECT *DriverObject;
326 UNICODE_STRING ServiceKeyName;
327 } DRIVER_EXTENSION, *PDRIVER_EXTENSION;
329 typedef struct _DRIVER_OBJECT {
332 PDEVICE_OBJECT DeviceObject;
337 PDRIVER_EXTENSION DriverExtension;
338 UNICODE_STRING DriverName;
339 PUNICODE_STRING HardwareDatabase;
340 PVOID FastIoDispatch;
341 PDRIVER_INITIALIZE DriverInit;
342 PDRIVER_STARTIO DriverStartIo;
343 PDRIVER_UNLOAD DriverUnload;
344 PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];
346 typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT;
348 /* Irp definitions */
349 typedef UCHAR KIRQL, *PKIRQL;
350 typedef CCHAR KPROCESSOR_MODE;
352 typedef VOID (WINAPI *PDRIVER_CANCEL)(
353 IN struct _DEVICE_OBJECT *DeviceObject,
354 IN struct _IRP *Irp);
356 typedef VOID (WINAPI *PKNORMAL_ROUTINE)(
357 IN PVOID NormalContext,
358 IN PVOID SystemArgument1,
359 IN PVOID SystemArgument2);
361 typedef VOID (WINAPI *PKKERNEL_ROUTINE)(
362 IN struct _KAPC *Apc,
363 IN OUT PKNORMAL_ROUTINE *NormalRoutine,
364 IN OUT PVOID *NormalContext,
365 IN OUT PVOID *SystemArgument1,
366 IN OUT PVOID *SystemArgument2);
368 typedef VOID (WINAPI *PKRUNDOWN_ROUTINE)(
369 IN struct _KAPC *Apc);
371 typedef struct _KAPC {
375 struct _KTHREAD *Thread;
376 LIST_ENTRY ApcListEntry;
377 PKKERNEL_ROUTINE KernelRoutine;
378 PKRUNDOWN_ROUTINE RundownRoutine;
379 PKNORMAL_ROUTINE NormalRoutine;
381 PVOID SystemArgument1;
382 PVOID SystemArgument2;
384 KPROCESSOR_MODE ApcMode;
386 } KAPC, *PKAPC, *RESTRICTED_POINTER PRKAPC;
388 #include <pshpack1.h>
389 typedef struct _IRP {
392 struct _MDL *MdlAddress;
395 struct _IRP *MasterIrp;
399 LIST_ENTRY ThreadListEntry;
400 IO_STATUS_BLOCK IoStatus;
401 KPROCESSOR_MODE RequestorMode;
402 BOOLEAN PendingReturned;
404 CHAR CurrentLocation;
407 CCHAR ApcEnvironment;
408 UCHAR AllocationFlags;
409 PIO_STATUS_BLOCK UserIosb;
413 PIO_APC_ROUTINE UserApcRoutine;
414 PVOID UserApcContext;
415 } AsynchronousParameters;
416 LARGE_INTEGER AllocationSize;
418 PDRIVER_CANCEL CancelRoutine;
423 KDEVICE_QUEUE_ENTRY DeviceQueueEntry;
425 PVOID DriverContext[4];
429 PCHAR AuxiliaryBuffer;
431 LIST_ENTRY ListEntry;
433 struct _IO_STACK_LOCATION *CurrentStackLocation;
437 struct _FILE_OBJECT *OriginalFileObject;
443 typedef struct _IRP *PIRP;
446 typedef VOID (WINAPI *PINTERFACE_REFERENCE)(
449 typedef VOID (WINAPI *PINTERFACE_DEREFERENCE)(
452 typedef struct _INTERFACE {
456 PINTERFACE_REFERENCE InterfaceReference;
457 PINTERFACE_DEREFERENCE InterfaceDereference;
458 } INTERFACE, *PINTERFACE;
460 typedef struct _SECTION_OBJECT_POINTERS {
461 PVOID DataSectionObject;
462 PVOID SharedCacheMap;
463 PVOID ImageSectionObject;
464 } SECTION_OBJECT_POINTERS, *PSECTION_OBJECT_POINTERS;
466 typedef struct _IO_COMPLETION_CONTEXT {
469 } IO_COMPLETION_CONTEXT, *PIO_COMPLETION_CONTEXT;
471 typedef enum _DEVICE_RELATION_TYPE {
476 TargetDeviceRelation,
478 } DEVICE_RELATION_TYPE, *PDEVICE_RELATION_TYPE;
480 typedef struct _FILE_OBJECT {
483 PDEVICE_OBJECT DeviceObject;
487 PSECTION_OBJECT_POINTERS SectionObjectPointer;
488 PVOID PrivateCacheMap;
489 NTSTATUS FinalStatus;
490 struct _FILE_OBJECT *RelatedFileObject;
491 BOOLEAN LockOperation;
492 BOOLEAN DeletePending;
495 BOOLEAN DeleteAccess;
498 BOOLEAN SharedDelete;
500 UNICODE_STRING FileName;
501 LARGE_INTEGER CurrentByteOffset;
507 PIO_COMPLETION_CONTEXT CompletionContext;
509 typedef struct _FILE_OBJECT *PFILE_OBJECT;
511 #define INITIAL_PRIVILEGE_COUNT 3
513 typedef struct _INITIAL_PRIVILEGE_SET {
514 ULONG PrivilegeCount;
516 LUID_AND_ATTRIBUTES Privilege[INITIAL_PRIVILEGE_COUNT];
517 } INITIAL_PRIVILEGE_SET, * PINITIAL_PRIVILEGE_SET;
519 typedef struct _SECURITY_SUBJECT_CONTEXT {
520 PACCESS_TOKEN ClientToken;
521 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
522 PACCESS_TOKEN PrimaryToken;
523 PVOID ProcessAuditId;
524 } SECURITY_SUBJECT_CONTEXT, *PSECURITY_SUBJECT_CONTEXT;
526 typedef struct _ACCESS_STATE {
528 BOOLEAN SecurityEvaluated;
529 BOOLEAN GenerateAudit;
530 BOOLEAN GenerateOnClose;
531 BOOLEAN PrivilegesAllocated;
533 ACCESS_MASK RemainingDesiredAccess;
534 ACCESS_MASK PreviouslyGrantedAccess;
535 ACCESS_MASK OriginalDesiredAccess;
536 SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
537 PSECURITY_DESCRIPTOR SecurityDescriptor;
540 INITIAL_PRIVILEGE_SET InitialPrivilegeSet;
541 PRIVILEGE_SET PrivilegeSet;
544 BOOLEAN AuditPrivileges;
545 UNICODE_STRING ObjectName;
546 UNICODE_STRING ObjectTypeName;
547 } ACCESS_STATE, *PACCESS_STATE;
549 typedef struct _IO_SECURITY_CONTEXT {
550 PSECURITY_QUALITY_OF_SERVICE SecurityQos;
551 PACCESS_STATE AccessState;
552 ACCESS_MASK DesiredAccess;
553 ULONG FullCreateOptions;
554 } IO_SECURITY_CONTEXT, *PIO_SECURITY_CONTEXT;
556 typedef struct _DEVICE_CAPABILITIES {
561 ULONG LockSupported : 1;
562 ULONG EjectSupported : 1;
564 ULONG DockDevice : 1;
566 ULONG SilentInstall : 1;
567 ULONG RawDeviceOK : 1;
568 ULONG SurpriseRemovalOK : 1;
569 ULONG WakeFromD0 : 1;
570 ULONG WakeFromD1 : 1;
571 ULONG WakeFromD2 : 1;
572 ULONG WakeFromD3 : 1;
573 ULONG HardwareDisabled : 1;
574 ULONG NonDynamic : 1;
575 ULONG WarmEjectSupported : 1;
576 ULONG NoDisplayInUI : 1;
580 DEVICE_POWER_STATE DeviceState[PowerSystemMaximum];
581 SYSTEM_POWER_STATE SystemWake;
582 DEVICE_POWER_STATE DeviceWake;
586 } DEVICE_CAPABILITIES, *PDEVICE_CAPABILITIES;
588 typedef enum _INTERFACE_TYPE {
589 InterfaceTypeUndefined = -1,
607 } INTERFACE_TYPE, *PINTERFACE_TYPE;
609 typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS;
611 #define IO_RESOURCE_PREFERRED 0x01
612 #define IO_RESOURCE_DEFAULT 0x02
613 #define IO_RESOURCE_ALTERNATIVE 0x08
615 typedef struct _IO_RESOURCE_DESCRIPTOR {
618 UCHAR ShareDisposition;
626 PHYSICAL_ADDRESS MinimumAddress;
627 PHYSICAL_ADDRESS MaximumAddress;
632 PHYSICAL_ADDRESS MinimumAddress;
633 PHYSICAL_ADDRESS MaximumAddress;
640 ULONG MinimumChannel;
641 ULONG MaximumChannel;
646 PHYSICAL_ADDRESS MinimumAddress;
647 PHYSICAL_ADDRESS MaximumAddress;
664 } IO_RESOURCE_DESCRIPTOR, *PIO_RESOURCE_DESCRIPTOR;
666 typedef struct _IO_RESOURCE_LIST {
670 IO_RESOURCE_DESCRIPTOR Descriptors[1];
671 } IO_RESOURCE_LIST, *PIO_RESOURCE_LIST;
673 typedef struct _IO_RESOURCE_REQUIREMENTS_LIST {
675 INTERFACE_TYPE InterfaceType;
679 ULONG AlternativeLists;
680 IO_RESOURCE_LIST List[1];
681 } IO_RESOURCE_REQUIREMENTS_LIST, *PIO_RESOURCE_REQUIREMENTS_LIST;
683 typedef enum _BUS_QUERY_ID_TYPE {
686 BusQueryCompatibleIDs,
688 BusQueryDeviceSerialNumber
689 } BUS_QUERY_ID_TYPE, *PBUS_QUERY_ID_TYPE;
692 DevicePropertyDeviceDescription,
693 DevicePropertyHardwareID,
694 DevicePropertyCompatibleIDs,
695 DevicePropertyBootConfiguration,
696 DevicePropertyBootConfigurationTranslated,
697 DevicePropertyClassName,
698 DevicePropertyClassGuid,
699 DevicePropertyDriverKeyName,
700 DevicePropertyManufacturer,
701 DevicePropertyFriendlyName,
702 DevicePropertyLocationInformation,
703 DevicePropertyPhysicalDeviceObjectName,
704 DevicePropertyBusTypeGuid,
705 DevicePropertyLegacyBusType,
706 DevicePropertyBusNumber,
707 DevicePropertyEnumeratorName,
708 DevicePropertyAddress,
709 DevicePropertyUINumber,
710 DevicePropertyInstallState,
711 DevicePropertyRemovalPolicy
712 } DEVICE_REGISTRY_PROPERTY;
714 typedef enum _DEVICE_TEXT_TYPE {
715 DeviceTextDescription,
716 DeviceTextLocationInformation
717 } DEVICE_TEXT_TYPE, *PDEVICE_TEXT_TYPE;
719 typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE {
720 DeviceUsageTypeUndefined,
721 DeviceUsageTypePaging,
722 DeviceUsageTypeHibernation,
723 DeviceUsageTypeDumpFile
724 } DEVICE_USAGE_NOTIFICATION_TYPE;
726 typedef struct _POWER_SEQUENCE {
730 } POWER_SEQUENCE, *PPOWER_SEQUENCE;
732 typedef enum _POWER_STATE_TYPE {
735 } POWER_STATE_TYPE, *PPOWER_STATE_TYPE;
737 typedef union _POWER_STATE {
738 SYSTEM_POWER_STATE SystemState;
739 DEVICE_POWER_STATE DeviceState;
740 } POWER_STATE, *PPOWER_STATE;
742 typedef struct _CM_PARTIAL_RESOURCE_DESCRIPTOR {
744 UCHAR ShareDisposition;
748 PHYSICAL_ADDRESS Start;
752 PHYSICAL_ADDRESS Start;
761 PHYSICAL_ADDRESS Start;
781 } DeviceSpecificData;
783 } CM_PARTIAL_RESOURCE_DESCRIPTOR, *PCM_PARTIAL_RESOURCE_DESCRIPTOR;
785 typedef struct _CM_PARTIAL_RESOURCE_LIST {
789 CM_PARTIAL_RESOURCE_DESCRIPTOR PartialDescriptors[1];
790 } CM_PARTIAL_RESOURCE_LIST, *PCM_PARTIAL_RESOURCE_LIST;
792 typedef struct _CM_FULL_RESOURCE_DESCRIPTOR {
793 INTERFACE_TYPE InterfaceType;
795 CM_PARTIAL_RESOURCE_LIST PartialResourceList;
796 } CM_FULL_RESOURCE_DESCRIPTOR, *PCM_FULL_RESOURCE_DESCRIPTOR;
798 typedef struct _CM_RESOURCE_LIST {
800 CM_FULL_RESOURCE_DESCRIPTOR List[1];
801 } CM_RESOURCE_LIST, *PCM_RESOURCE_LIST;
803 typedef NTSTATUS (WINAPI *PIO_COMPLETION_ROUTINE)(
804 IN struct _DEVICE_OBJECT *DeviceObject,
808 #define SL_PENDING_RETURNED 0x01
809 #define SL_INVOKE_ON_CANCEL 0x20
810 #define SL_INVOKE_ON_SUCCESS 0x40
811 #define SL_INVOKE_ON_ERROR 0x80
813 #include <pshpack1.h>
814 typedef struct _IO_STACK_LOCATION {
821 PIO_SECURITY_CONTEXT SecurityContext;
823 USHORT POINTER_ALIGNMENT FileAttributes;
825 ULONG POINTER_ALIGNMENT EaLength;
829 ULONG POINTER_ALIGNMENT Key;
830 LARGE_INTEGER ByteOffset;
834 ULONG POINTER_ALIGNMENT Key;
835 LARGE_INTEGER ByteOffset;
839 FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
843 FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
844 PFILE_OBJECT FileObject;
847 BOOLEAN ReplaceIfExists;
856 FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
859 ULONG OutputBufferLength;
860 ULONG POINTER_ALIGNMENT InputBufferLength;
861 ULONG POINTER_ALIGNMENT IoControlCode;
862 PVOID Type3InputBuffer;
865 SECURITY_INFORMATION SecurityInformation;
866 ULONG POINTER_ALIGNMENT Length;
869 SECURITY_INFORMATION SecurityInformation;
870 PSECURITY_DESCRIPTOR SecurityDescriptor;
874 PDEVICE_OBJECT DeviceObject;
878 PDEVICE_OBJECT DeviceObject;
881 struct _SCSI_REQUEST_BLOCK *Srb;
884 DEVICE_RELATION_TYPE Type;
885 } QueryDeviceRelations;
887 CONST GUID *InterfaceType;
890 PINTERFACE Interface;
891 PVOID InterfaceSpecificData;
894 PDEVICE_CAPABILITIES Capabilities;
895 } DeviceCapabilities;
897 PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;
898 } FilterResourceRequirements;
903 ULONG POINTER_ALIGNMENT Length;
909 BUS_QUERY_ID_TYPE IdType;
912 DEVICE_TEXT_TYPE DeviceTextType;
913 LCID POINTER_ALIGNMENT LocaleId;
918 DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;
921 SYSTEM_POWER_STATE PowerState;
924 PPOWER_SEQUENCE PowerSequence;
928 POWER_STATE_TYPE POINTER_ALIGNMENT Type;
929 POWER_STATE POINTER_ALIGNMENT State;
930 POWER_ACTION POINTER_ALIGNMENT ShutdownType;
933 PCM_RESOURCE_LIST AllocatedResources;
934 PCM_RESOURCE_LIST AllocatedResourcesTranslated;
937 ULONG_PTR ProviderId;
949 PDEVICE_OBJECT DeviceObject;
950 PFILE_OBJECT FileObject;
951 PIO_COMPLETION_ROUTINE CompletionRoutine;
953 } IO_STACK_LOCATION, *PIO_STACK_LOCATION;
956 /* MDL definitions */
958 #define MDL_MAPPED_TO_SYSTEM_VA 0x0001
959 #define MDL_PAGES_LOCKED 0x0002
960 #define MDL_SOURCE_IS_NONPAGED_POOL 0x0004
961 #define MDL_ALLOCATED_FIXED_SIZE 0x0008
962 #define MDL_PARTIAL 0x0010
963 #define MDL_PARTIAL_HAS_BEEN_MAPPED 0x0020
964 #define MDL_IO_PAGE_READ 0x0040
965 #define MDL_WRITE_OPERATION 0x0080
966 #define MDL_PARENT_MAPPED_SYSTEM_VA 0x0100
967 #define MDL_FREE_EXTRA_PTES 0x0200
968 #define MDL_DESCRIBES_AWE 0x0400
969 #define MDL_IO_SPACE 0x0800
970 #define MDL_NETWORK_HEADER 0x1000
971 #define MDL_MAPPING_CAN_FAIL 0x2000
972 #define MDL_ALLOCATED_MUST_SUCCEED 0x4000
973 #define MDL_INTERNAL 0x8000
975 #define MDL_MAPPING_FLAGS (MDL_MAPPED_TO_SYSTEM_VA | \
977 MDL_SOURCE_IS_NONPAGED_POOL | \
978 MDL_PARTIAL_HAS_BEEN_MAPPED | \
979 MDL_PARENT_MAPPED_SYSTEM_VA | \
983 typedef struct _MDL {
987 struct _EPROCESS *Process;
988 PVOID MappedSystemVa;
996 typedef struct _KTIMER {
997 DISPATCHER_HEADER Header;
998 ULARGE_INTEGER DueTime;
999 LIST_ENTRY TimerListEntry;
1004 typedef struct _KSYSTEM_TIME {
1008 } KSYSTEM_TIME, *PKSYSTEM_TIME;
1010 typedef enum _NT_PRODUCT_TYPE {
1014 } NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;
1016 #define PROCESSOR_FEATURE_MAX 64
1018 typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
1023 } ALTERNATIVE_ARCHITECTURE_TYPE;
1025 #define NX_SUPPORT_POLICY_ALWAYSOFF 0
1026 #define NX_SUPPORT_POLICY_ALWAYSON 1
1027 #define NX_SUPPORT_POLICY_OPTIN 2
1028 #define NX_SUPPORT_POLICY_OPTOUT 3
1030 #define MAX_WOW64_SHARED_ENTRIES 16
1032 typedef struct _KUSER_SHARED_DATA {
1033 ULONG TickCountLowDeprecated;
1034 ULONG TickCountMultiplier;
1035 volatile KSYSTEM_TIME InterruptTime;
1036 volatile KSYSTEM_TIME SystemTime;
1037 volatile KSYSTEM_TIME TimeZoneBias;
1038 USHORT ImageNumberLow;
1039 USHORT ImageNumberHigh;
1040 WCHAR NtSystemRoot[260];
1041 ULONG MaxStackTraceDepth;
1042 ULONG CryptoExponent;
1044 ULONG LargePageMinimum;
1046 NT_PRODUCT_TYPE NtProductType;
1047 BOOLEAN ProductTypeIsValid;
1048 ULONG NtMajorVersion;
1049 ULONG NtMinorVersion;
1050 BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];
1053 volatile ULONG TimeSlip;
1054 ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
1055 LARGE_INTEGER SystemExpirationDate;
1057 BOOLEAN KdDebuggerEnabled;
1058 UCHAR NXSupportPolicy;
1059 volatile ULONG ActiveConsoleId;
1060 volatile ULONG DismountCount;
1061 ULONG ComPlusPackage;
1062 ULONG LastSystemRITEventTickCount;
1063 ULONG NumberOfPhysicalPages;
1064 BOOLEAN SafeBootMode;
1066 ULONGLONG TestRetInstruction;
1068 ULONG SystemCallReturn;
1069 ULONGLONG SystemCallPad[3];
1071 volatile KSYSTEM_TIME TickCount;
1072 volatile ULONG64 TickCountQuad;
1075 ULONG Wow64SharedInformation[MAX_WOW64_SHARED_ENTRIES];
1076 } KSHARED_USER_DATA, *PKSHARED_USER_DATA;
1078 typedef enum _MEMORY_CACHING_TYPE {
1081 MmWriteCombined = 2,
1082 MmHardwareCoherentCached = 3,
1083 MmNonCachedUnordered = 4,
1085 MmMaximumCacheType = 6
1086 } MEMORY_CACHING_TYPE;
1088 typedef enum _MM_PAGE_PRIORITY {
1090 NormalPagePriority = 16,
1091 HighPagePriority = 32
1094 typedef enum _MM_SYSTEM_SIZE
1101 typedef struct _IO_REMOVE_LOCK_COMMON_BLOCK {
1103 BOOLEAN Reserved[3];
1106 } IO_REMOVE_LOCK_COMMON_BLOCK;
1108 typedef struct _IO_REMOVE_LOCK_TRACKING_BLOCK *PIO_REMOVE_LOCK_TRACKING_BLOCK;
1110 typedef struct _IO_REMOVE_LOCK_DBG_BLOCK {
1113 LONGLONG MaxLockedTicks;
1115 LIST_ENTRY LockList;
1117 LONG LowMemoryCount;
1120 PIO_REMOVE_LOCK_TRACKING_BLOCK Blocks;
1121 } IO_REMOVE_LOCK_DBG_BLOCK;
1123 typedef struct _IO_REMOVE_LOCK {
1124 IO_REMOVE_LOCK_COMMON_BLOCK Common;
1125 IO_REMOVE_LOCK_DBG_BLOCK Dbg;
1126 } IO_REMOVE_LOCK, *PIO_REMOVE_LOCK;
1134 typedef struct _CALLBACK_OBJECT
1138 LIST_ENTRY RegisteredCallbacks;
1139 BOOLEAN AllowMultipleCallbacks;
1141 } CALLBACK_OBJECT, *PCALLBACK_OBJECT;
1143 NTSTATUS WINAPI ObCloseHandle(IN HANDLE handle);
1145 #ifdef NONAMELESSUNION
1146 # ifdef NONAMELESSSTRUCT
1147 # define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.u2.CurrentStackLocation)
1148 # define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.u2.CurrentStackLocation - 1)
1150 # define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.u2.CurrentStackLocation)
1151 # define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.u2.CurrentStackLocation - 1)
1154 # ifdef NONAMELESSSTRUCT
1155 # define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.CurrentStackLocation)
1156 # define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.CurrentStackLocation - 1)
1158 # define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.CurrentStackLocation)
1159 # define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.CurrentStackLocation - 1)
1163 #define KernelMode 0
1166 /* directory object access rights */
1167 #define DIRECTORY_QUERY 0x0001
1168 #define DIRECTORY_TRAVERSE 0x0002
1169 #define DIRECTORY_CREATE_OBJECT 0x0004
1170 #define DIRECTORY_CREATE_SUBDIRECTORY 0x0008
1171 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)
1173 /* symbolic link access rights */
1174 #define SYMBOLIC_LINK_QUERY 0x0001
1175 #define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
1177 PVOID WINAPI ExAllocatePool(POOL_TYPE,SIZE_T);
1178 PVOID WINAPI ExAllocatePoolWithQuota(POOL_TYPE,SIZE_T);
1179 PVOID WINAPI ExAllocatePoolWithTag(POOL_TYPE,SIZE_T,ULONG);
1180 PVOID WINAPI ExAllocatePoolWithQuotaTag(POOL_TYPE,SIZE_T,ULONG);
1181 void WINAPI ExFreePool(PVOID);
1182 void WINAPI ExFreePoolWithTag(PVOID,ULONG);
1184 NTSTATUS WINAPI IoAllocateDriverObjectExtension(PDRIVER_OBJECT,PVOID,ULONG,PVOID*);
1185 PVOID WINAPI IoAllocateErrorLogEntry(PVOID,UCHAR);
1186 PIRP WINAPI IoAllocateIrp(CCHAR,BOOLEAN);
1187 NTSTATUS WINAPI IoCallDriver(DEVICE_OBJECT*,IRP*);
1188 VOID WINAPI IoCompleteRequest(IRP*,UCHAR);
1189 NTSTATUS WINAPI IoCreateDevice(DRIVER_OBJECT*,ULONG,UNICODE_STRING*,DEVICE_TYPE,ULONG,BOOLEAN,DEVICE_OBJECT**);
1190 NTSTATUS WINAPI IoCreateDriver(UNICODE_STRING*,PDRIVER_INITIALIZE);
1191 NTSTATUS WINAPI IoCreateSymbolicLink(UNICODE_STRING*,UNICODE_STRING*);
1192 void WINAPI IoDeleteDevice(DEVICE_OBJECT*);
1193 void WINAPI IoDeleteDriver(DRIVER_OBJECT*);
1194 NTSTATUS WINAPI IoDeleteSymbolicLink(UNICODE_STRING*);
1195 void WINAPI IoFreeIrp(IRP*);
1196 PEPROCESS WINAPI IoGetCurrentProcess(void);
1197 NTSTATUS WINAPI IoGetDeviceInterfaces(CONST GUID*,PDEVICE_OBJECT,ULONG,PWSTR*);
1198 NTSTATUS WINAPI IoGetDeviceObjectPointer(UNICODE_STRING*,ACCESS_MASK,PFILE_OBJECT*,PDEVICE_OBJECT*);
1199 NTSTATUS WINAPI IoGetDeviceProperty(PDEVICE_OBJECT,DEVICE_REGISTRY_PROPERTY,ULONG,PVOID,PULONG);
1200 PVOID WINAPI IoGetDriverObjectExtension(PDRIVER_OBJECT,PVOID);
1201 PDEVICE_OBJECT WINAPI IoGetRelatedDeviceObject(PFILE_OBJECT);
1202 void WINAPI IoInitializeIrp(IRP*,USHORT,CCHAR);
1203 VOID WINAPI IoInitializeRemoveLockEx(PIO_REMOVE_LOCK,ULONG,ULONG,ULONG,ULONG);
1204 NTSTATUS WINAPI IoWMIRegistrationControl(PDEVICE_OBJECT,ULONG);
1206 PKTHREAD WINAPI KeGetCurrentThread(void);
1207 void WINAPI KeQuerySystemTime(LARGE_INTEGER*);
1208 void WINAPI KeQueryTickCount(LARGE_INTEGER*);
1209 ULONG WINAPI KeQueryTimeIncrement(void);
1210 LONG WINAPI KeReleaseSemaphore(PRKSEMAPHORE,KPRIORITY,LONG,BOOLEAN);
1211 LONG WINAPI KeResetEvent(PRKEVENT);
1212 LONG WINAPI KeSetEvent(PRKEVENT,KPRIORITY,BOOLEAN);
1213 KPRIORITY WINAPI KeSetPriorityThread(PKTHREAD,KPRIORITY);
1215 PVOID WINAPI MmAllocateContiguousMemory(SIZE_T,PHYSICAL_ADDRESS);
1216 PVOID WINAPI MmAllocateNonCachedMemory(SIZE_T);
1217 PMDL WINAPI MmAllocatePagesForMdl(PHYSICAL_ADDRESS,PHYSICAL_ADDRESS,PHYSICAL_ADDRESS,SIZE_T);
1218 void WINAPI MmFreeNonCachedMemory(PVOID,SIZE_T);
1219 MM_SYSTEMSIZE WINAPI MmQuerySystemSize(void);
1221 NTSTATUS WINAPI ObReferenceObjectByHandle(HANDLE,ACCESS_MASK,POBJECT_TYPE,KPROCESSOR_MODE,PVOID*,POBJECT_HANDLE_INFORMATION);
1223 POWER_STATE WINAPI PoSetPowerState(PDEVICE_OBJECT,POWER_STATE_TYPE,POWER_STATE);
1224 NTSTATUS WINAPI PsCreateSystemThread(PHANDLE,ULONG,POBJECT_ATTRIBUTES,HANDLE,PCLIENT_ID,PKSTART_ROUTINE,PVOID);
1225 #define PsGetCurrentProcess() IoGetCurrentProcess()
1226 #define PsGetCurrentThread() ((PETHREAD)KeGetCurrentThread())
1227 HANDLE WINAPI PsGetCurrentProcessId(void);
1228 HANDLE WINAPI PsGetCurrentThreadId(void);
1229 BOOLEAN WINAPI PsGetVersion(ULONG*,ULONG*,ULONG*,UNICODE_STRING*);
1230 NTSTATUS WINAPI PsTerminateSystemThread(NTSTATUS);
1232 NTSTATUS WINAPI ZwAddBootEntry(PUNICODE_STRING,PUNICODE_STRING);
1233 NTSTATUS WINAPI ZwAccessCheckAndAuditAlarm(PUNICODE_STRING,HANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,ACCESS_MASK,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PBOOLEAN,PBOOLEAN);
1234 NTSTATUS WINAPI ZwAdjustPrivilegesToken(HANDLE,BOOLEAN,PTOKEN_PRIVILEGES,DWORD,PTOKEN_PRIVILEGES,PDWORD);
1235 NTSTATUS WINAPI ZwAlertThread(HANDLE ThreadHandle);
1236 NTSTATUS WINAPI ZwAllocateVirtualMemory(HANDLE,PVOID*,ULONG,SIZE_T*,ULONG,ULONG);
1237 NTSTATUS WINAPI ZwCancelIoFile(HANDLE,PIO_STATUS_BLOCK);
1238 NTSTATUS WINAPI ZwCancelTimer(HANDLE, BOOLEAN*);
1239 NTSTATUS WINAPI ZwClearEvent(HANDLE);
1240 NTSTATUS WINAPI ZwClose(HANDLE);
1241 NTSTATUS WINAPI ZwCloseObjectAuditAlarm(PUNICODE_STRING,HANDLE,BOOLEAN);
1242 NTSTATUS WINAPI ZwConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
1243 NTSTATUS WINAPI ZwCreateDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
1244 NTSTATUS WINAPI ZwCreateEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *,BOOLEAN,BOOLEAN);
1245 NTSTATUS WINAPI ZwCreateFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG);
1246 NTSTATUS WINAPI ZwCreateKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,PULONG);
1247 NTSTATUS WINAPI ZwCreateSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const LARGE_INTEGER*,ULONG,ULONG,HANDLE);
1248 NTSTATUS WINAPI ZwCreateSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PUNICODE_STRING);
1249 NTSTATUS WINAPI ZwCreateTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*, TIMER_TYPE);
1250 NTSTATUS WINAPI ZwDeleteAtom(RTL_ATOM);
1251 NTSTATUS WINAPI ZwDeleteFile(POBJECT_ATTRIBUTES);
1252 NTSTATUS WINAPI ZwDeleteKey(HANDLE);
1253 NTSTATUS WINAPI ZwDeleteValueKey(HANDLE,const UNICODE_STRING *);
1254 NTSTATUS WINAPI ZwDeviceIoControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
1255 NTSTATUS WINAPI ZwDisplayString(PUNICODE_STRING);
1256 NTSTATUS WINAPI ZwDuplicateObject(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,ULONG,ULONG);
1257 NTSTATUS WINAPI ZwDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
1258 NTSTATUS WINAPI ZwEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
1259 NTSTATUS WINAPI ZwEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
1260 NTSTATUS WINAPI ZwFlushInstructionCache(HANDLE,LPCVOID,SIZE_T);
1261 NTSTATUS WINAPI ZwFlushKey(HANDLE);
1262 NTSTATUS WINAPI ZwFlushVirtualMemory(HANDLE,LPCVOID*,SIZE_T*,ULONG);
1263 NTSTATUS WINAPI ZwFreeVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
1264 NTSTATUS WINAPI ZwFsControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
1265 NTSTATUS WINAPI ZwInitiatePowerAction(POWER_ACTION,SYSTEM_POWER_STATE,ULONG,BOOLEAN);
1266 NTSTATUS WINAPI ZwLoadDriver(const UNICODE_STRING *);
1267 NTSTATUS WINAPI ZwLoadKey(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *);
1268 NTSTATUS WINAPI ZwLockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
1269 NTSTATUS WINAPI ZwMakeTemporaryObject(HANDLE);
1270 NTSTATUS WINAPI ZwMapViewOfSection(HANDLE,HANDLE,PVOID*,ULONG,SIZE_T,const LARGE_INTEGER*,SIZE_T*,SECTION_INHERIT,ULONG,ULONG);
1271 NTSTATUS WINAPI ZwNotifyChangeKey(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
1272 NTSTATUS WINAPI ZwOpenDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
1273 NTSTATUS WINAPI ZwOpenEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
1274 NTSTATUS WINAPI ZwOpenFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG);
1275 NTSTATUS WINAPI ZwOpenKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
1276 NTSTATUS WINAPI ZwOpenProcess(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
1277 NTSTATUS WINAPI ZwOpenProcessToken(HANDLE,DWORD,HANDLE *);
1278 NTSTATUS WINAPI ZwOpenSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
1279 NTSTATUS WINAPI ZwOpenSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
1280 NTSTATUS WINAPI ZwOpenThread(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
1281 NTSTATUS WINAPI ZwOpenThreadToken(HANDLE,DWORD,BOOLEAN,HANDLE *);
1282 NTSTATUS WINAPI ZwOpenTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*);
1283 NTSTATUS WINAPI ZwPowerInformation(POWER_INFORMATION_LEVEL,PVOID,ULONG,PVOID,ULONG);
1284 NTSTATUS WINAPI ZwPulseEvent(HANDLE,PULONG);
1285 NTSTATUS WINAPI ZwQueryDefaultLocale(BOOLEAN,LCID*);
1286 NTSTATUS WINAPI ZwQueryDefaultUILanguage(LANGID*);
1287 NTSTATUS WINAPI ZwQueryDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS,BOOLEAN,PUNICODE_STRING,BOOLEAN);
1288 NTSTATUS WINAPI ZwQueryDirectoryObject(HANDLE,PDIRECTORY_BASIC_INFORMATION,ULONG,BOOLEAN,BOOLEAN,PULONG,PULONG);
1289 NTSTATUS WINAPI ZwQueryEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,BOOLEAN,PVOID,ULONG,PVOID,BOOLEAN);
1290 NTSTATUS WINAPI ZwQueryFullAttributesFile(const OBJECT_ATTRIBUTES*,FILE_NETWORK_OPEN_INFORMATION*);
1291 NTSTATUS WINAPI ZwQueryInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,LONG,FILE_INFORMATION_CLASS);
1292 NTSTATUS WINAPI ZwQueryInformationThread(HANDLE,THREADINFOCLASS,PVOID,ULONG,PULONG);
1293 NTSTATUS WINAPI ZwQueryInformationToken(HANDLE,DWORD,PVOID,DWORD,LPDWORD);
1294 NTSTATUS WINAPI ZwQueryInstallUILanguage(LANGID*);
1295 NTSTATUS WINAPI ZwQueryKey(HANDLE,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
1296 NTSTATUS WINAPI ZwQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
1297 NTSTATUS WINAPI ZwQuerySecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR,ULONG,PULONG);
1298 NTSTATUS WINAPI ZwQuerySection(HANDLE,SECTION_INFORMATION_CLASS,PVOID,ULONG,PULONG);
1299 NTSTATUS WINAPI ZwQuerySymbolicLinkObject(HANDLE,PUNICODE_STRING,PULONG);
1300 NTSTATUS WINAPI ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG);
1301 NTSTATUS WINAPI ZwQueryTimerResolution(PULONG,PULONG,PULONG);
1302 NTSTATUS WINAPI ZwQueryValueKey(HANDLE,const UNICODE_STRING *,KEY_VALUE_INFORMATION_CLASS,void *,DWORD,DWORD *);
1303 NTSTATUS WINAPI ZwQueryVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
1304 NTSTATUS WINAPI ZwReadFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG);
1305 NTSTATUS WINAPI ZwReplaceKey(POBJECT_ATTRIBUTES,HANDLE,POBJECT_ATTRIBUTES);
1306 NTSTATUS WINAPI ZwRequestWaitReplyPort(HANDLE,PLPC_MESSAGE,PLPC_MESSAGE);
1307 NTSTATUS WINAPI ZwResetEvent(HANDLE,PULONG);
1308 NTSTATUS WINAPI ZwRestoreKey(HANDLE,HANDLE,ULONG);
1309 NTSTATUS WINAPI ZwSaveKey(HANDLE,HANDLE);
1310 NTSTATUS WINAPI ZwSecureConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PSID,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
1311 NTSTATUS WINAPI ZwSetDefaultLocale(BOOLEAN,LCID);
1312 NTSTATUS WINAPI ZwSetDefaultUILanguage(LANGID);
1313 NTSTATUS WINAPI ZwSetEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG);
1314 NTSTATUS WINAPI ZwSetEvent(HANDLE,PULONG);
1315 NTSTATUS WINAPI ZwSetInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS);
1316 NTSTATUS WINAPI ZwSetInformationKey(HANDLE,const int,PVOID,ULONG);
1317 NTSTATUS WINAPI ZwSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG);
1318 NTSTATUS WINAPI ZwSetInformationProcess(HANDLE,PROCESS_INFORMATION_CLASS,PVOID,ULONG);
1319 NTSTATUS WINAPI ZwSetInformationThread(HANDLE,THREADINFOCLASS,LPCVOID,ULONG);
1320 NTSTATUS WINAPI ZwSetIoCompletion(HANDLE,ULONG,ULONG,NTSTATUS,ULONG);
1321 NTSTATUS WINAPI ZwSetSecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR);
1322 NTSTATUS WINAPI ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG);
1323 NTSTATUS WINAPI ZwSetSystemTime(const LARGE_INTEGER*,LARGE_INTEGER*);
1324 NTSTATUS WINAPI ZwSetTimer(HANDLE, const LARGE_INTEGER*, PTIMER_APC_ROUTINE, PVOID, BOOLEAN, ULONG, BOOLEAN*);
1325 NTSTATUS WINAPI ZwSetValueKey(HANDLE,const UNICODE_STRING *,ULONG,ULONG,const void *,ULONG);
1326 NTSTATUS WINAPI ZwSetVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
1327 NTSTATUS WINAPI ZwSuspendThread(HANDLE,PULONG);
1328 NTSTATUS WINAPI ZwTerminateProcess(HANDLE,LONG);
1329 NTSTATUS WINAPI ZwUnloadDriver(const UNICODE_STRING *);
1330 NTSTATUS WINAPI ZwUnloadKey(HANDLE);
1331 NTSTATUS WINAPI ZwUnmapViewOfSection(HANDLE,PVOID);
1332 NTSTATUS WINAPI ZwWaitForSingleObject(HANDLE,BOOLEAN,const LARGE_INTEGER*);
1333 NTSTATUS WINAPI ZwWaitForMultipleObjects(ULONG,const HANDLE*,BOOLEAN,BOOLEAN,const LARGE_INTEGER*);
1334 NTSTATUS WINAPI ZwWriteFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,const void*,ULONG,PLARGE_INTEGER,PULONG);
1335 NTSTATUS WINAPI ZwYieldExecution(void);