source: vendor/w32api/3.6/include/ddk/ntifs.h

Last change on this file was 2720, checked in by bird, 19 years ago

w32api v3.6
File size: 123.6 KB
Line 
1/*
2 * ntifs.h
3 *
4 * Windows NT Filesystem Driver Developer Kit
5 *
6 * This file is part of the w32api package.
7 *
8 * Contributors:
9 * Created by Bo Brantén <bosse@acc.umu.se>
10 *
11 * THIS SOFTWARE IS NOT COPYRIGHTED
12 *
13 * This source code is offered for use in the public domain. You may
14 * use, modify or distribute it freely.
15 *
16 * This code is distributed in the hope that it will be useful but
17 * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
18 * DISCLAIMED. This includes but is not limited to warranties of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 */
22
23#ifndef _NTIFS_
24#define _NTIFS_
25#define _GNU_NTIFS_
26
27#if __GNUC__ >= 3
28#pragma GCC system_header
29#endif
30
31#ifdef __cplusplus
32extern "C" {
33#endif
34
35#include "ntddk.h"
36#include "ntapi.h"
37
38#pragma pack(push,4)
39
40#define VER_PRODUCTBUILD 10000
41
42#ifndef NTSYSAPI
43#define NTSYSAPI
44#endif
45
46#ifndef NTKERNELAPI
47#define NTKERNELAPI STDCALL
48#endif
49
50typedef struct _SE_EXPORTS *PSE_EXPORTS;
51
52extern PUCHAR *FsRtlLegalAnsiCharacterArray;
53extern PSE_EXPORTS SeExports;
54extern PACL SePublicDefaultDacl;
55extern PACL SeSystemDefaultDacl;
56
57#define ANSI_DOS_STAR ('<')
58#define ANSI_DOS_QM ('>')
59#define ANSI_DOS_DOT ('"')
60
61#define DOS_STAR (L'<')
62#define DOS_QM (L'>')
63#define DOS_DOT (L'"')
64
65/* also in winnt.h */
66#define ACCESS_ALLOWED_ACE_TYPE (0x0)
67#define ACCESS_DENIED_ACE_TYPE (0x1)
68#define SYSTEM_AUDIT_ACE_TYPE (0x2)
69#define SYSTEM_ALARM_ACE_TYPE (0x3)
70
71#define COMPRESSION_FORMAT_NONE (0x0000)
72#define COMPRESSION_FORMAT_DEFAULT (0x0001)
73#define COMPRESSION_FORMAT_LZNT1 (0x0002)
74#define COMPRESSION_ENGINE_STANDARD (0x0000)
75#define COMPRESSION_ENGINE_MAXIMUM (0x0100)
76#define COMPRESSION_ENGINE_HIBER (0x0200)
77
78#define FILE_ACTION_ADDED 0x00000001
79#define FILE_ACTION_REMOVED 0x00000002
80#define FILE_ACTION_MODIFIED 0x00000003
81#define FILE_ACTION_RENAMED_OLD_NAME 0x00000004
82#define FILE_ACTION_RENAMED_NEW_NAME 0x00000005
83#define FILE_ACTION_ADDED_STREAM 0x00000006
84#define FILE_ACTION_REMOVED_STREAM 0x00000007
85#define FILE_ACTION_MODIFIED_STREAM 0x00000008
86#define FILE_ACTION_REMOVED_BY_DELETE 0x00000009
87#define FILE_ACTION_ID_NOT_TUNNELLED 0x0000000A
88#define FILE_ACTION_TUNNELLED_ID_COLLISION 0x0000000B
89/* end winnt.h */
90
91#define FILE_EA_TYPE_BINARY 0xfffe
92#define FILE_EA_TYPE_ASCII 0xfffd
93#define FILE_EA_TYPE_BITMAP 0xfffb
94#define FILE_EA_TYPE_METAFILE 0xfffa
95#define FILE_EA_TYPE_ICON 0xfff9
96#define FILE_EA_TYPE_EA 0xffee
97#define FILE_EA_TYPE_MVMT 0xffdf
98#define FILE_EA_TYPE_MVST 0xffde
99#define FILE_EA_TYPE_ASN1 0xffdd
100#define FILE_EA_TYPE_FAMILY_IDS 0xff01
101
102#define FILE_NEED_EA 0x00000080
103
104/* also in winnt.h */
105#define FILE_NOTIFY_CHANGE_FILE_NAME 0x00000001
106#define FILE_NOTIFY_CHANGE_DIR_NAME 0x00000002
107#define FILE_NOTIFY_CHANGE_NAME 0x00000003
108#define FILE_NOTIFY_CHANGE_ATTRIBUTES 0x00000004
109#define FILE_NOTIFY_CHANGE_SIZE 0x00000008
110#define FILE_NOTIFY_CHANGE_LAST_WRITE 0x00000010
111#define FILE_NOTIFY_CHANGE_LAST_ACCESS 0x00000020
112#define FILE_NOTIFY_CHANGE_CREATION 0x00000040
113#define FILE_NOTIFY_CHANGE_EA 0x00000080
114#define FILE_NOTIFY_CHANGE_SECURITY 0x00000100
115#define FILE_NOTIFY_CHANGE_STREAM_NAME 0x00000200
116#define FILE_NOTIFY_CHANGE_STREAM_SIZE 0x00000400
117#define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
118#define FILE_NOTIFY_VALID_MASK 0x00000fff
119/* end winnt.h */
120
121#define FILE_OPLOCK_BROKEN_TO_LEVEL_2 0x00000007
122#define FILE_OPLOCK_BROKEN_TO_NONE 0x00000008
123
124#define FILE_OPBATCH_BREAK_UNDERWAY 0x00000009
125
126#define FILE_CASE_SENSITIVE_SEARCH 0x00000001
127#define FILE_CASE_PRESERVED_NAMES 0x00000002
128#define FILE_UNICODE_ON_DISK 0x00000004
129#define FILE_PERSISTENT_ACLS 0x00000008
130#define FILE_FILE_COMPRESSION 0x00000010
131#define FILE_VOLUME_QUOTAS 0x00000020
132#define FILE_SUPPORTS_SPARSE_FILES 0x00000040
133#define FILE_SUPPORTS_REPARSE_POINTS 0x00000080
134#define FILE_SUPPORTS_REMOTE_STORAGE 0x00000100
135#define FS_LFN_APIS 0x00004000
136#define FILE_VOLUME_IS_COMPRESSED 0x00008000
137#define FILE_SUPPORTS_OBJECT_IDS 0x00010000
138#define FILE_SUPPORTS_ENCRYPTION 0x00020000
139#define FILE_NAMED_STREAMS 0x00040000
140
141#define FILE_PIPE_BYTE_STREAM_TYPE 0x00000000
142#define FILE_PIPE_MESSAGE_TYPE 0x00000001
143
144#define FILE_PIPE_BYTE_STREAM_MODE 0x00000000
145#define FILE_PIPE_MESSAGE_MODE 0x00000001
146
147#define FILE_PIPE_QUEUE_OPERATION 0x00000000
148#define FILE_PIPE_COMPLETE_OPERATION 0x00000001
149
150#define FILE_PIPE_INBOUND 0x00000000
151#define FILE_PIPE_OUTBOUND 0x00000001
152#define FILE_PIPE_FULL_DUPLEX 0x00000002
153
154#define FILE_PIPE_DISCONNECTED_STATE 0x00000001
155#define FILE_PIPE_LISTENING_STATE 0x00000002
156#define FILE_PIPE_CONNECTED_STATE 0x00000003
157#define FILE_PIPE_CLOSING_STATE 0x00000004
158
159#define FILE_PIPE_CLIENT_END 0x00000000
160#define FILE_PIPE_SERVER_END 0x00000001
161
162#define FILE_PIPE_READ_DATA 0x00000000
163#define FILE_PIPE_WRITE_SPACE 0x00000001
164
165#define FILE_STORAGE_TYPE_SPECIFIED 0x00000041 /* FILE_DIRECTORY_FILE | FILE_NON_DIRECTORY_FILE */
166#define FILE_STORAGE_TYPE_DEFAULT (StorageTypeDefault << FILE_STORAGE_TYPE_SHIFT)
167#define FILE_STORAGE_TYPE_DIRECTORY (StorageTypeDirectory << FILE_STORAGE_TYPE_SHIFT)
168#define FILE_STORAGE_TYPE_FILE (StorageTypeFile << FILE_STORAGE_TYPE_SHIFT)
169#define FILE_STORAGE_TYPE_DOCFILE (StorageTypeDocfile << FILE_STORAGE_TYPE_SHIFT)
170#define FILE_STORAGE_TYPE_JUNCTION_POINT (StorageTypeJunctionPoint << FILE_STORAGE_TYPE_SHIFT)
171#define FILE_STORAGE_TYPE_CATALOG (StorageTypeCatalog << FILE_STORAGE_TYPE_SHIFT)
172#define FILE_STORAGE_TYPE_STRUCTURED_STORAGE (StorageTypeStructuredStorage << FILE_STORAGE_TYPE_SHIFT)
173#define FILE_STORAGE_TYPE_EMBEDDING (StorageTypeEmbedding << FILE_STORAGE_TYPE_SHIFT)
174#define FILE_STORAGE_TYPE_STREAM (StorageTypeStream << FILE_STORAGE_TYPE_SHIFT)
175#define FILE_MINIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_DEFAULT
176#define FILE_MAXIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_STREAM
177#define FILE_STORAGE_TYPE_MASK 0x000f0000
178#define FILE_STORAGE_TYPE_SHIFT 16
179
180#define FILE_VC_QUOTA_NONE 0x00000000
181#define FILE_VC_QUOTA_TRACK 0x00000001
182#define FILE_VC_QUOTA_ENFORCE 0x00000002
183#define FILE_VC_QUOTA_MASK 0x00000003
184
185#define FILE_VC_QUOTAS_LOG_VIOLATIONS 0x00000004
186#define FILE_VC_CONTENT_INDEX_DISABLED 0x00000008
187
188#define FILE_VC_LOG_QUOTA_THRESHOLD 0x00000010
189#define FILE_VC_LOG_QUOTA_LIMIT 0x00000020
190#define FILE_VC_LOG_VOLUME_THRESHOLD 0x00000040
191#define FILE_VC_LOG_VOLUME_LIMIT 0x00000080
192
193#define FILE_VC_QUOTAS_INCOMPLETE 0x00000100
194#define FILE_VC_QUOTAS_REBUILDING 0x00000200
195
196#define FILE_VC_VALID_MASK 0x000003ff
197
198#define FSRTL_FLAG_FILE_MODIFIED (0x01)
199#define FSRTL_FLAG_FILE_LENGTH_CHANGED (0x02)
200#define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04)
201#define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08)
202#define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10)
203#define FSRTL_FLAG_USER_MAPPED_FILE (0x20)
204#define FSRTL_FLAG_EOF_ADVANCE_ACTIVE (0x80)
205
206#define FSRTL_FLAG2_DO_MODIFIED_WRITE (0x01)
207
208#define FSRTL_FSP_TOP_LEVEL_IRP (0x01)
209#define FSRTL_CACHE_TOP_LEVEL_IRP (0x02)
210#define FSRTL_MOD_WRITE_TOP_LEVEL_IRP (0x03)
211#define FSRTL_FAST_IO_TOP_LEVEL_IRP (0x04)
212#define FSRTL_MAX_TOP_LEVEL_IRP_FLAG (0x04)
213
214#define FSRTL_VOLUME_DISMOUNT 1
215#define FSRTL_VOLUME_DISMOUNT_FAILED 2
216#define FSRTL_VOLUME_LOCK 3
217#define FSRTL_VOLUME_LOCK_FAILED 4
218#define FSRTL_VOLUME_UNLOCK 5
219#define FSRTL_VOLUME_MOUNT 6
220
221#define FSRTL_WILD_CHARACTER 0x08
222
223#ifdef _X86_
224#define HARDWARE_PTE HARDWARE_PTE_X86
225#define PHARDWARE_PTE PHARDWARE_PTE_X86
226#else
227#define HARDWARE_PTE ULONG
228#define PHARDWARE_PTE PULONG
229#endif
230
231#define IO_CHECK_CREATE_PARAMETERS 0x0200
232#define IO_ATTACH_DEVICE 0x0400
233
234#define IO_ATTACH_DEVICE_API 0x80000000
235/* also in winnt.h */
236#define IO_COMPLETION_QUERY_STATE 0x0001
237#define IO_COMPLETION_MODIFY_STATE 0x0002
238#define IO_COMPLETION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3)
239/* end winnt.h */
240#define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE 64
241#define IO_FILE_OBJECT_PAGED_POOL_CHARGE 1024
242
243#define IO_TYPE_APC 18
244#define IO_TYPE_DPC 19
245#define IO_TYPE_DEVICE_QUEUE 20
246#define IO_TYPE_EVENT_PAIR 21
247#define IO_TYPE_INTERRUPT 22
248#define IO_TYPE_PROFILE 23
249
250#define IRP_BEING_VERIFIED 0x10
251
252#define MAILSLOT_CLASS_FIRSTCLASS 1
253#define MAILSLOT_CLASS_SECONDCLASS 2
254
255#define MAILSLOT_SIZE_AUTO 0
256
257#define MAP_PROCESS 1L
258#define MAP_SYSTEM 2L
259#define MEM_DOS_LIM 0x40000000
260/* also in winnt.h */
261#define MEM_IMAGE SEC_IMAGE
262/* end winnt.h */
263#define OB_TYPE_TYPE 1
264#define OB_TYPE_DIRECTORY 2
265#define OB_TYPE_SYMBOLIC_LINK 3
266#define OB_TYPE_TOKEN 4
267#define OB_TYPE_PROCESS 5
268#define OB_TYPE_THREAD 6
269#define OB_TYPE_EVENT 7
270#define OB_TYPE_EVENT_PAIR 8
271#define OB_TYPE_MUTANT 9
272#define OB_TYPE_SEMAPHORE 10
273#define OB_TYPE_TIMER 11
274#define OB_TYPE_PROFILE 12
275#define OB_TYPE_WINDOW_STATION 13
276#define OB_TYPE_DESKTOP 14
277#define OB_TYPE_SECTION 15
278#define OB_TYPE_KEY 16
279#define OB_TYPE_PORT 17
280#define OB_TYPE_ADAPTER 18
281#define OB_TYPE_CONTROLLER 19
282#define OB_TYPE_DEVICE 20
283#define OB_TYPE_DRIVER 21
284#define OB_TYPE_IO_COMPLETION 22
285#define OB_TYPE_FILE 23
286
287#define PIN_WAIT (1)
288#define PIN_EXCLUSIVE (2)
289#define PIN_NO_READ (4)
290#define PIN_IF_BCB (8)
291
292#define PORT_CONNECT 0x0001
293#define PORT_ALL_ACCESS (STANDARD_RIGHTS_ALL |\
294 PORT_CONNECT)
295/* also in winnt.h */
296#define SEC_BASED 0x00200000
297#define SEC_NO_CHANGE 0x00400000
298#define SEC_FILE 0x00800000
299#define SEC_IMAGE 0x01000000
300#define SEC_VLM 0x02000000
301#define SEC_RESERVE 0x04000000
302#define SEC_COMMIT 0x08000000
303#define SEC_NOCACHE 0x10000000
304
305#define SECURITY_WORLD_SID_AUTHORITY {0,0,0,0,0,1}
306#define SECURITY_WORLD_RID (0x00000000L)
307
308#define SID_REVISION 1
309
310#define TOKEN_ASSIGN_PRIMARY (0x0001)
311#define TOKEN_DUPLICATE (0x0002)
312#define TOKEN_IMPERSONATE (0x0004)
313#define TOKEN_QUERY (0x0008)
314#define TOKEN_QUERY_SOURCE (0x0010)
315#define TOKEN_ADJUST_PRIVILEGES (0x0020)
316#define TOKEN_ADJUST_GROUPS (0x0040)
317#define TOKEN_ADJUST_DEFAULT (0x0080)
318
319#define TOKEN_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED |\
320 TOKEN_ASSIGN_PRIMARY |\
321 TOKEN_DUPLICATE |\
322 TOKEN_IMPERSONATE |\
323 TOKEN_QUERY |\
324 TOKEN_QUERY_SOURCE |\
325 TOKEN_ADJUST_PRIVILEGES |\
326 TOKEN_ADJUST_GROUPS |\
327 TOKEN_ADJUST_DEFAULT)
328
329#define TOKEN_READ (STANDARD_RIGHTS_READ |\
330 TOKEN_QUERY)
331
332#define TOKEN_WRITE (STANDARD_RIGHTS_WRITE |\
333 TOKEN_ADJUST_PRIVILEGES |\
334 TOKEN_ADJUST_GROUPS |\
335 TOKEN_ADJUST_DEFAULT)
336
337#define TOKEN_EXECUTE (STANDARD_RIGHTS_EXECUTE)
338
339#define TOKEN_SOURCE_LENGTH 8
340/* end winnt.h */
341
342#define TOKEN_HAS_TRAVERSE_PRIVILEGE 0x01
343#define TOKEN_HAS_BACKUP_PRIVILEGE 0x02
344#define TOKEN_HAS_RESTORE_PRIVILEGE 0x04
345#define TOKEN_HAS_ADMIN_GROUP 0x08
346#define TOKEN_IS_RESTRICTED 0x10
347
348#define VACB_MAPPING_GRANULARITY (0x40000)
349#define VACB_OFFSET_SHIFT (18)
350
351#define FSCTL_REQUEST_OPLOCK_LEVEL_1 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
352#define FSCTL_REQUEST_OPLOCK_LEVEL_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
353#define FSCTL_REQUEST_BATCH_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
354#define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 3, METHOD_BUFFERED, FILE_ANY_ACCESS)
355#define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
356#define FSCTL_OPLOCK_BREAK_NOTIFY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 5, METHOD_BUFFERED, FILE_ANY_ACCESS)
357#define FSCTL_LOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
358#define FSCTL_UNLOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
359#define FSCTL_DISMOUNT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
360
361#define FSCTL_IS_VOLUME_MOUNTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
362#define FSCTL_IS_PATHNAME_VALID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
363#define FSCTL_MARK_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
364
365#define FSCTL_QUERY_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER, FILE_ANY_ACCESS)
366#define FSCTL_GET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
367#define FSCTL_SET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
368
369
370#define FSCTL_MARK_AS_SYSTEM_HIVE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS)
371#define FSCTL_OPLOCK_BREAK_ACK_NO_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
372#define FSCTL_INVALIDATE_VOLUMES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
373#define FSCTL_QUERY_FAT_BPB CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS)
374#define FSCTL_REQUEST_FILTER_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
375#define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS)
376
377#if (VER_PRODUCTBUILD >= 1381)
378
379#define FSCTL_GET_NTFS_VOLUME_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS)
380#define FSCTL_GET_NTFS_FILE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS)
381#define FSCTL_GET_VOLUME_BITMAP CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER, FILE_ANY_ACCESS)
382#define FSCTL_GET_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER, FILE_ANY_ACCESS)
383#define FSCTL_MOVE_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_ANY_ACCESS)
384#define FSCTL_IS_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
385#define FSCTL_GET_HFS_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS)
386#define FSCTL_ALLOW_EXTENDED_DASD_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER, FILE_ANY_ACCESS)
387
388#endif /* (VER_PRODUCTBUILD >= 1381) */
389
390#if (VER_PRODUCTBUILD >= 2195)
391
392#define FSCTL_READ_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 33, METHOD_NEITHER, FILE_ANY_ACCESS)
393#define FSCTL_WRITE_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 34, METHOD_NEITHER, FILE_ANY_ACCESS)
394#define FSCTL_FIND_FILES_BY_SID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS)
395
396#define FSCTL_DUMP_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 37, METHOD_NEITHER, FILE_ANY_ACCESS)
397#define FSCTL_SET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_WRITE_DATA)
398#define FSCTL_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS)
399#define FSCTL_DELETE_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_WRITE_DATA)
400#define FSCTL_SET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_WRITE_DATA)
401#define FSCTL_GET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS)
402#define FSCTL_DELETE_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_WRITE_DATA)
403#define FSCTL_ENUM_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER, FILE_READ_DATA)
404#define FSCTL_SECURITY_ID_CHECK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45, METHOD_NEITHER, FILE_READ_DATA)
405#define FSCTL_READ_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46, METHOD_NEITHER, FILE_READ_DATA)
406#define FSCTL_SET_OBJECT_ID_EXTENDED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_WRITE_DATA)
407#define FSCTL_CREATE_OR_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS)
408#define FSCTL_SET_SPARSE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_WRITE_DATA)
409#define FSCTL_SET_ZERO_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA)
410#define FSCTL_QUERY_ALLOCATED_RANGES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51, METHOD_NEITHER, FILE_READ_DATA)
411#define FSCTL_ENABLE_UPGRADE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA)
412#define FSCTL_SET_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_BUFFERED, FILE_ANY_ACCESS)
413#define FSCTL_ENCRYPTION_FSCTL_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54, METHOD_NEITHER, FILE_ANY_ACCESS)
414#define FSCTL_WRITE_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55, METHOD_NEITHER, FILE_ANY_ACCESS)
415#define FSCTL_READ_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56, METHOD_NEITHER, FILE_ANY_ACCESS)
416#define FSCTL_CREATE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57, METHOD_NEITHER, FILE_READ_DATA)
417#define FSCTL_READ_FILE_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58, METHOD_NEITHER, FILE_READ_DATA)
418#define FSCTL_WRITE_USN_CLOSE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59, METHOD_NEITHER, FILE_READ_DATA)
419#define FSCTL_EXTEND_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
420#define FSCTL_QUERY_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
421#define FSCTL_DELETE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
422#define FSCTL_MARK_HANDLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS)
423#define FSCTL_SIS_COPYFILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS)
424#define FSCTL_SIS_LINK_FILES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
425#define FSCTL_HSM_MSG CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
426#define FSCTL_NSS_CONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 67, METHOD_BUFFERED, FILE_WRITE_DATA)
427#define FSCTL_HSM_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
428#define FSCTL_RECALL_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS)
429#define FSCTL_NSS_RCONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 70, METHOD_BUFFERED, FILE_READ_DATA)
430#define FSCTL_READ_FROM_PLEX CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA)
431#define FSCTL_FILE_PREFETCH CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
432
433#endif /* (VER_PRODUCTBUILD >= 2195) */
434
435#define FSCTL_MAILSLOT_PEEK CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)
436
437#define FSCTL_NETWORK_SET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 102, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
438#define FSCTL_NETWORK_GET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 103, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
439#define FSCTL_NETWORK_GET_CONNECTION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 104, METHOD_NEITHER, FILE_ANY_ACCESS)
440#define FSCTL_NETWORK_ENUMERATE_CONNECTIONS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 105, METHOD_NEITHER, FILE_ANY_ACCESS)
441#define FSCTL_NETWORK_DELETE_CONNECTION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 107, METHOD_BUFFERED, FILE_ANY_ACCESS)
442#define FSCTL_NETWORK_GET_STATISTICS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 116, METHOD_BUFFERED, FILE_ANY_ACCESS)
443#define FSCTL_NETWORK_SET_DOMAIN_NAME CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_ANY_ACCESS)
444#define FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_ANY_ACCESS)
445
446#define FSCTL_PIPE_ASSIGN_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
447#define FSCTL_PIPE_DISCONNECT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
448#define FSCTL_PIPE_LISTEN CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
449#define FSCTL_PIPE_PEEK CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
450#define FSCTL_PIPE_QUERY_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
451#define FSCTL_PIPE_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
452#define FSCTL_PIPE_WAIT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
453#define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
454#define FSCTL_PIPE_SET_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
455#define FSCTL_PIPE_QUERY_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
456#define FSCTL_PIPE_INTERNAL_READ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
457#define FSCTL_PIPE_INTERNAL_WRITE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
458#define FSCTL_PIPE_INTERNAL_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
459#define FSCTL_PIPE_INTERNAL_READ_OVFLOW CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
460
461#define IOCTL_REDIR_QUERY_PATH CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
462
463typedef PVOID PEJOB;
464typedef PVOID OPLOCK, *POPLOCK;
465typedef PVOID PWOW64_PROCESS;
466
467typedef struct _CACHE_MANAGER_CALLBACKS *PCACHE_MANAGER_CALLBACKS;
468typedef struct _EPROCESS_QUOTA_BLOCK *PEPROCESS_QUOTA_BLOCK;
469typedef struct _FILE_GET_QUOTA_INFORMATION *PFILE_GET_QUOTA_INFORMATION;
470typedef struct _HANDLE_TABLE *PHANDLE_TABLE;
471typedef struct _KEVENT_PAIR *PKEVENT_PAIR;
472typedef struct _KPROCESS *PKPROCESS;
473typedef struct _KQUEUE *PKQUEUE;
474typedef struct _KTRAP_FRAME *PKTRAP_FRAME;
475typedef struct _MAILSLOT_CREATE_PARAMETERS *PMAILSLOT_CREATE_PARAMETERS;
476typedef struct _MMWSL *PMMWSL;
477typedef struct _NAMED_PIPE_CREATE_PARAMETERS *PNAMED_PIPE_CREATE_PARAMETERS;
478typedef struct _OBJECT_DIRECTORY *POBJECT_DIRECTORY;
479typedef struct _PAGEFAULT_HISTORY *PPAGEFAULT_HISTORY;
480typedef struct _PS_IMPERSONATION_INFORMATION *PPS_IMPERSONATION_INFORMATION;
481typedef struct _SECTION_OBJECT *PSECTION_OBJECT;
482typedef struct _SHARED_CACHE_MAP *PSHARED_CACHE_MAP;
483typedef struct _TERMINATION_PORT *PTERMINATION_PORT;
484typedef struct _VACB *PVACB;
485typedef struct _VAD_HEADER *PVAD_HEADER;
486
487typedef struct _NOTIFY_SYNC
488{
489 ULONG Unknown0;
490 ULONG Unknown1;
491 ULONG Unknown2;
492 USHORT Unknown3;
493 USHORT Unknown4;
494 ULONG Unknown5;
495 ULONG Unknown6;
496 ULONG Unknown7;
497 ULONG Unknown8;
498 ULONG Unknown9;
499 ULONG Unknown10;
500} NOTIFY_SYNC, * PNOTIFY_SYNC;
501
502typedef enum _FAST_IO_POSSIBLE {
503 FastIoIsNotPossible,
504 FastIoIsPossible,
505 FastIoIsQuestionable
506} FAST_IO_POSSIBLE;
507
508typedef enum _FILE_STORAGE_TYPE {
509 StorageTypeDefault = 1,
510 StorageTypeDirectory,
511 StorageTypeFile,
512 StorageTypeJunctionPoint,
513 StorageTypeCatalog,
514 StorageTypeStructuredStorage,
515 StorageTypeEmbedding,
516 StorageTypeStream
517} FILE_STORAGE_TYPE;
518
519typedef enum _IO_COMPLETION_INFORMATION_CLASS {
520 IoCompletionBasicInformation
521} IO_COMPLETION_INFORMATION_CLASS;
522
523typedef enum _OBJECT_INFO_CLASS {
524 ObjectBasicInfo,
525 ObjectNameInfo,
526 ObjectTypeInfo,
527 ObjectAllTypesInfo,
528 ObjectProtectionInfo
529} OBJECT_INFO_CLASS;
530
531typedef struct _HARDWARE_PTE_X86 {
532 ULONG Valid : 1;
533 ULONG Write : 1;
534 ULONG Owner : 1;
535 ULONG WriteThrough : 1;
536 ULONG CacheDisable : 1;
537 ULONG Accessed : 1;
538 ULONG Dirty : 1;
539 ULONG LargePage : 1;
540 ULONG Global : 1;
541 ULONG CopyOnWrite : 1;
542 ULONG Prototype : 1;
543 ULONG reserved : 1;
544 ULONG PageFrameNumber : 20;
545} HARDWARE_PTE_X86, *PHARDWARE_PTE_X86;
546
547typedef struct _KAPC_STATE {
548 LIST_ENTRY ApcListHead[2];
549 PKPROCESS Process;
550 BOOLEAN KernelApcInProgress;
551 BOOLEAN KernelApcPending;
552 BOOLEAN UserApcPending;
553} KAPC_STATE, *PKAPC_STATE;
554
555typedef struct _KGDTENTRY {
556 USHORT LimitLow;
557 USHORT BaseLow;
558 union {
559 struct {
560 UCHAR BaseMid;
561 UCHAR Flags1;
562 UCHAR Flags2;
563 UCHAR BaseHi;
564 } Bytes;
565 struct {
566 ULONG BaseMid : 8;
567 ULONG Type : 5;
568 ULONG Dpl : 2;
569 ULONG Pres : 1;
570 ULONG LimitHi : 4;
571 ULONG Sys : 1;
572 ULONG Reserved_0 : 1;
573 ULONG Default_Big : 1;
574 ULONG Granularity : 1;
575 ULONG BaseHi : 8;
576 } Bits;
577 } HighWord;
578} KGDTENTRY, *PKGDTENTRY;
579
580typedef struct _KIDTENTRY {
581 USHORT Offset;
582 USHORT Selector;
583 USHORT Access;
584 USHORT ExtendedOffset;
585} KIDTENTRY, *PKIDTENTRY;
586
587#if (VER_PRODUCTBUILD >= 2600)
588
589typedef struct _MMSUPPORT_FLAGS {
590 ULONG SessionSpace : 1;
591 ULONG BeingTrimmed : 1;
592 ULONG SessionLeader : 1;
593 ULONG TrimHard : 1;
594 ULONG WorkingSetHard : 1;
595 ULONG AddressSpaceBeingDeleted : 1;
596 ULONG Available : 10;
597 ULONG AllowWorkingSetAdjustment : 8;
598 ULONG MemoryPriority : 8;
599} MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS;
600
601#else
602
603typedef struct _MMSUPPORT_FLAGS {
604 ULONG SessionSpace : 1;
605 ULONG BeingTrimmed : 1;
606 ULONG ProcessInSession : 1;
607 ULONG SessionLeader : 1;
608 ULONG TrimHard : 1;
609 ULONG WorkingSetHard : 1;
610 ULONG WriteWatch : 1;
611 ULONG Filler : 25;
612} MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS;
613
614#endif
615
616#if (VER_PRODUCTBUILD >= 2600)
617
618typedef struct _MMSUPPORT {
619 LARGE_INTEGER LastTrimTime;
620 MMSUPPORT_FLAGS Flags;
621 ULONG PageFaultCount;
622 ULONG PeakWorkingSetSize;
623 ULONG WorkingSetSize;
624 ULONG MinimumWorkingSetSize;
625 ULONG MaximumWorkingSetSize;
626 PMMWSL VmWorkingSetList;
627 LIST_ENTRY WorkingSetExpansionLinks;
628 ULONG Claim;
629 ULONG NextEstimationSlot;
630 ULONG NextAgingSlot;
631 ULONG EstimatedAvailable;
632 ULONG GrowthSinceLastEstimate;
633} MMSUPPORT, *PMMSUPPORT;
634
635#else
636
637typedef struct _MMSUPPORT {
638 LARGE_INTEGER LastTrimTime;
639 ULONG LastTrimFaultCount;
640 ULONG PageFaultCount;
641 ULONG PeakWorkingSetSize;
642 ULONG WorkingSetSize;
643 ULONG MinimumWorkingSetSize;
644 ULONG MaximumWorkingSetSize;
645 PMMWSL VmWorkingSetList;
646 LIST_ENTRY WorkingSetExpansionLinks;
647 BOOLEAN AllowWorkingSetAdjustment;
648 BOOLEAN AddressSpaceBeingDeleted;
649 UCHAR ForegroundSwitchCount;
650 UCHAR MemoryPriority;
651#if (VER_PRODUCTBUILD >= 2195)
652 union {
653 ULONG LongFlags;
654 MMSUPPORT_FLAGS Flags;
655 } u;
656 ULONG Claim;
657 ULONG NextEstimationSlot;
658 ULONG NextAgingSlot;
659 ULONG EstimatedAvailable;
660 ULONG GrowthSinceLastEstimate;
661#endif /* (VER_PRODUCTBUILD >= 2195) */
662} MMSUPPORT, *PMMSUPPORT;
663
664#endif
665
666typedef struct _SE_AUDIT_PROCESS_CREATION_INFO {
667 POBJECT_NAME_INFORMATION ImageFileName;
668} SE_AUDIT_PROCESS_CREATION_INFO, *PSE_AUDIT_PROCESS_CREATION_INFO;
669
670typedef struct _BITMAP_RANGE {
671 LIST_ENTRY Links;
672 LARGE_INTEGER BasePage;
673 ULONG FirstDirtyPage;
674 ULONG LastDirtyPage;
675 ULONG DirtyPages;
676 PULONG Bitmap;
677} BITMAP_RANGE, *PBITMAP_RANGE;
678
679typedef struct _CACHE_UNINITIALIZE_EVENT {
680 struct _CACHE_UNINITIALIZE_EVENT *Next;
681 KEVENT Event;
682} CACHE_UNINITIALIZE_EVENT, *PCACHE_UNINITIALIZE_EVENT;
683
684typedef struct _CC_FILE_SIZES {
685 LARGE_INTEGER AllocationSize;
686 LARGE_INTEGER FileSize;
687 LARGE_INTEGER ValidDataLength;
688} CC_FILE_SIZES, *PCC_FILE_SIZES;
689
690typedef struct _COMPRESSED_DATA_INFO {
691 USHORT CompressionFormatAndEngine;
692 UCHAR CompressionUnitShift;
693 UCHAR ChunkShift;
694 UCHAR ClusterShift;
695 UCHAR Reserved;
696 USHORT NumberOfChunks;
697 ULONG CompressedChunkSizes[ANYSIZE_ARRAY];
698} COMPRESSED_DATA_INFO, *PCOMPRESSED_DATA_INFO;
699
700typedef struct _DEVICE_MAP {
701 POBJECT_DIRECTORY DosDevicesDirectory;
702 POBJECT_DIRECTORY GlobalDosDevicesDirectory;
703 ULONG ReferenceCount;
704 ULONG DriveMap;
705 UCHAR DriveType[32];
706} DEVICE_MAP, *PDEVICE_MAP;
707
708#if (VER_PRODUCTBUILD >= 2600)
709
710typedef struct _EX_FAST_REF {
711 _ANONYMOUS_UNION union {
712 PVOID Object;
713 ULONG RefCnt : 3;
714 ULONG Value;
715 } DUMMYUNIONNAME;
716} EX_FAST_REF, *PEX_FAST_REF;
717
718typedef struct _EX_PUSH_LOCK {
719 _ANONYMOUS_UNION union {
720 _ANONYMOUS_STRUCT struct {
721 ULONG Waiting : 1;
722 ULONG Exclusive : 1;
723 ULONG Shared : 30;
724 } DUMMYSTRUCTNAME;
725 ULONG Value;
726 PVOID Ptr;
727 } DUMMYUNIONNAME;
728} EX_PUSH_LOCK, *PEX_PUSH_LOCK;
729
730typedef struct _EX_RUNDOWN_REF {
731 _ANONYMOUS_UNION union {
732 ULONG Count;
733 PVOID Ptr;
734 } DUMMYUNIONNAME;
735} EX_RUNDOWN_REF, *PEX_RUNDOWN_REF;
736
737#endif
738
739typedef struct _EPROCESS_QUOTA_ENTRY {
740 ULONG Usage;
741 ULONG Limit;
742 ULONG Peak;
743 ULONG Return;
744} EPROCESS_QUOTA_ENTRY, *PEPROCESS_QUOTA_ENTRY;
745
746typedef struct _EPROCESS_QUOTA_BLOCK {
747 EPROCESS_QUOTA_ENTRY QuotaEntry[3];
748 LIST_ENTRY QuotaList;
749 ULONG ReferenceCount;
750 ULONG ProcessCount;
751} EPROCESS_QUOTA_BLOCK, *PEPROCESS_QUOTA_BLOCK;
752
753/*
754 * When needing these parameters cast your PIO_STACK_LOCATION to
755 * PEXTENDED_IO_STACK_LOCATION
756 */
757#if !defined(_ALPHA_)
758#include <pshpack4.h>
759#endif
760typedef struct _EXTENDED_IO_STACK_LOCATION {
761
762 /* Included for padding */
763 UCHAR MajorFunction;
764 UCHAR MinorFunction;
765 UCHAR Flags;
766 UCHAR Control;
767
768 union {
769
770 struct {
771 PIO_SECURITY_CONTEXT SecurityContext;
772 ULONG Options;
773 USHORT Reserved;
774 USHORT ShareAccess;
775 PMAILSLOT_CREATE_PARAMETERS Parameters;
776 } CreateMailslot;
777
778 struct {
779 PIO_SECURITY_CONTEXT SecurityContext;
780 ULONG Options;
781 USHORT Reserved;
782 USHORT ShareAccess;
783 PNAMED_PIPE_CREATE_PARAMETERS Parameters;
784 } CreatePipe;
785
786 struct {
787 ULONG OutputBufferLength;
788 ULONG InputBufferLength;
789 ULONG FsControlCode;
790 PVOID Type3InputBuffer;
791 } FileSystemControl;
792
793 struct {
794 PLARGE_INTEGER Length;
795 ULONG Key;
796 LARGE_INTEGER ByteOffset;
797 } LockControl;
798
799 struct {
800 ULONG Length;
801 ULONG CompletionFilter;
802 } NotifyDirectory;
803
804 struct {
805 ULONG Length;
806 PUNICODE_STRING FileName;
807 FILE_INFORMATION_CLASS FileInformationClass;
808 ULONG FileIndex;
809 } QueryDirectory;
810
811 struct {
812 ULONG Length;
813 PVOID EaList;
814 ULONG EaListLength;
815 ULONG EaIndex;
816 } QueryEa;
817
818 struct {
819 ULONG Length;
820 PSID StartSid;
821 PFILE_GET_QUOTA_INFORMATION SidList;
822 ULONG SidListLength;
823 } QueryQuota;
824
825 struct {
826 ULONG Length;
827 } SetEa;
828
829 struct {
830 ULONG Length;
831 } SetQuota;
832
833 struct {
834 ULONG Length;
835 FS_INFORMATION_CLASS FsInformationClass;
836 } SetVolume;
837
838 } Parameters;
839 PDEVICE_OBJECT DeviceObject;
840 PFILE_OBJECT FileObject;
841 PIO_COMPLETION_ROUTINE CompletionRoutine;
842 PVOID Context;
843
844} EXTENDED_IO_STACK_LOCATION, *PEXTENDED_IO_STACK_LOCATION;
845#if !defined(_ALPHA_)
846#include <poppack.h>
847#endif
848
849typedef struct _FILE_ACCESS_INFORMATION {
850 ACCESS_MASK AccessFlags;
851} FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
852
853typedef struct _FILE_ALLOCATION_INFORMATION {
854 LARGE_INTEGER AllocationSize;
855} FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;
856
857typedef struct _FILE_BOTH_DIR_INFORMATION {
858 ULONG NextEntryOffset;
859 ULONG FileIndex;
860 LARGE_INTEGER CreationTime;
861 LARGE_INTEGER LastAccessTime;
862 LARGE_INTEGER LastWriteTime;
863 LARGE_INTEGER ChangeTime;
864 LARGE_INTEGER EndOfFile;
865 LARGE_INTEGER AllocationSize;
866 ULONG FileAttributes;
867 ULONG FileNameLength;
868 ULONG EaSize;
869 CCHAR ShortNameLength;
870 WCHAR ShortName[12];
871 WCHAR FileName[1];
872} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
873
874typedef struct _FILE_COMPLETION_INFORMATION {
875 HANDLE Port;
876 ULONG Key;
877} FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;
878
879typedef struct _FILE_COMPRESSION_INFORMATION {
880 LARGE_INTEGER CompressedFileSize;
881 USHORT CompressionFormat;
882 UCHAR CompressionUnitShift;
883 UCHAR ChunkShift;
884 UCHAR ClusterShift;
885 UCHAR Reserved[3];
886} FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
887
888typedef struct _FILE_COPY_ON_WRITE_INFORMATION {
889 BOOLEAN ReplaceIfExists;
890 HANDLE RootDirectory;
891 ULONG FileNameLength;
892 WCHAR FileName[1];
893} FILE_COPY_ON_WRITE_INFORMATION, *PFILE_COPY_ON_WRITE_INFORMATION;
894
895typedef struct _FILE_DIRECTORY_INFORMATION {
896 ULONG NextEntryOffset;
897 ULONG FileIndex;
898 LARGE_INTEGER CreationTime;
899 LARGE_INTEGER LastAccessTime;
900 LARGE_INTEGER LastWriteTime;
901 LARGE_INTEGER ChangeTime;
902 LARGE_INTEGER EndOfFile;
903 LARGE_INTEGER AllocationSize;
904 ULONG FileAttributes;
905 ULONG FileNameLength;
906 WCHAR FileName[1];
907} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
908
909typedef struct _FILE_FULL_DIRECTORY_INFORMATION {
910 ULONG NextEntryOffset;
911 ULONG FileIndex;
912 LARGE_INTEGER CreationTime;
913 LARGE_INTEGER LastAccessTime;
914 LARGE_INTEGER LastWriteTime;
915 LARGE_INTEGER ChangeTime;
916 LARGE_INTEGER EndOfFile;
917 LARGE_INTEGER AllocationSize;
918 ULONG FileAttributes;
919 ULONG FileNameLength;
920 ULONG EaSize;
921 WCHAR FileName[0];
922} FILE_FULL_DIRECTORY_INFORMATION, *PFILE_FULL_DIRECTORY_INFORMATION;
923
924typedef struct _FILE_BOTH_DIRECTORY_INFORMATION {
925 ULONG NextEntryOffset;
926 ULONG FileIndex;
927 LARGE_INTEGER CreationTime;
928 LARGE_INTEGER LastAccessTime;
929 LARGE_INTEGER LastWriteTime;
930 LARGE_INTEGER ChangeTime;
931 LARGE_INTEGER EndOfFile;
932 LARGE_INTEGER AllocationSize;
933 ULONG FileAttributes;
934 ULONG FileNameLength;
935 ULONG EaSize;
936 CHAR ShortNameLength;
937 WCHAR ShortName[12];
938 WCHAR FileName[0];
939} FILE_BOTH_DIRECTORY_INFORMATION, *PFILE_BOTH_DIRECTORY_INFORMATION;
940
941#if (VER_PRODUCTBUILD >= 2600)
942
943typedef struct _FILE_ID_FULL_DIRECTORY_INFORMATION {
944 ULONG NextEntryOffset;
945 ULONG FileIndex;
946 LARGE_INTEGER CreationTime;
947 LARGE_INTEGER LastAccessTime;
948 LARGE_INTEGER LastWriteTime;
949 LARGE_INTEGER ChangeTime;
950 LARGE_INTEGER EndOfFile;
951 LARGE_INTEGER AllocationSize;
952 ULONG FileAttributes;
953 ULONG FileNameLength;
954 ULONG EaSize;
955 LARGE_INTEGER FileId;
956 WCHAR FileName[0];
957} FILE_ID_FULL_DIRECTORY_INFORMATION, *PFILE_ID_FULL_DIRECTORY_INFORMATION;
958
959typedef struct _FILE_ID_BOTH_DIRECTORY_INFORMATION {
960 ULONG NextEntryOffset;
961 ULONG FileIndex;
962 LARGE_INTEGER CreationTime;
963 LARGE_INTEGER LastAccessTime;
964 LARGE_INTEGER LastWriteTime;
965 LARGE_INTEGER ChangeTime;
966 LARGE_INTEGER EndOfFile;
967 LARGE_INTEGER AllocationSize;
968 ULONG FileAttributes;
969 ULONG FileNameLength;
970 ULONG EaSize;
971 CHAR ShortNameLength;
972 WCHAR ShortName[12];
973 LARGE_INTEGER FileId;
974 WCHAR FileName[0];
975} FILE_ID_BOTH_DIRECTORY_INFORMATION, *PFILE_ID_BOTH_DIRECTORY_INFORMATION;
976
977#endif
978
979typedef struct _FILE_EA_INFORMATION {
980 ULONG EaSize;
981} FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
982
983typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {
984 ULONG FileSystemAttributes;
985 ULONG MaximumComponentNameLength;
986 ULONG FileSystemNameLength;
987 WCHAR FileSystemName[1];
988} FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
989
990typedef struct _FILE_FS_CONTROL_INFORMATION {
991 LARGE_INTEGER FreeSpaceStartFiltering;
992 LARGE_INTEGER FreeSpaceThreshold;
993 LARGE_INTEGER FreeSpaceStopFiltering;
994 LARGE_INTEGER DefaultQuotaThreshold;
995 LARGE_INTEGER DefaultQuotaLimit;
996 ULONG FileSystemControlFlags;
997} FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;
998
999typedef struct _FILE_FS_FULL_SIZE_INFORMATION {
1000 LARGE_INTEGER TotalAllocationUnits;
1001 LARGE_INTEGER CallerAvailableAllocationUnits;
1002 LARGE_INTEGER ActualAvailableAllocationUnits;
1003 ULONG SectorsPerAllocationUnit;
1004 ULONG BytesPerSector;
1005} FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
1006
1007typedef struct _FILE_FS_LABEL_INFORMATION {
1008 ULONG VolumeLabelLength;
1009 WCHAR VolumeLabel[1];
1010} FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
1011
1012#if (VER_PRODUCTBUILD >= 2195)
1013
1014typedef struct _FILE_FS_OBJECT_ID_INFORMATION {
1015 UCHAR ObjectId[16];
1016 UCHAR ExtendedInfo[48];
1017} FILE_FS_OBJECT_ID_INFORMATION, *PFILE_FS_OBJECT_ID_INFORMATION;
1018
1019#endif /* (VER_PRODUCTBUILD >= 2195) */
1020
1021typedef struct _FILE_FS_SIZE_INFORMATION {
1022 LARGE_INTEGER TotalAllocationUnits;
1023 LARGE_INTEGER AvailableAllocationUnits;
1024 ULONG SectorsPerAllocationUnit;
1025 ULONG BytesPerSector;
1026} FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
1027
1028typedef struct _FILE_FS_VOLUME_INFORMATION {
1029 LARGE_INTEGER VolumeCreationTime;
1030 ULONG VolumeSerialNumber;
1031 ULONG VolumeLabelLength;
1032 BOOLEAN SupportsObjects;
1033 WCHAR VolumeLabel[1];
1034} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
1035
1036typedef struct _FILE_FULL_DIR_INFORMATION {
1037 ULONG NextEntryOffset;
1038 ULONG FileIndex;
1039 LARGE_INTEGER CreationTime;
1040 LARGE_INTEGER LastAccessTime;
1041 LARGE_INTEGER LastWriteTime;
1042 LARGE_INTEGER ChangeTime;
1043 LARGE_INTEGER EndOfFile;
1044 LARGE_INTEGER AllocationSize;
1045 ULONG FileAttributes;
1046 ULONG FileNameLength;
1047 ULONG EaSize;
1048 WCHAR FileName[1];
1049} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
1050
1051typedef struct _FILE_GET_EA_INFORMATION {
1052 ULONG NextEntryOffset;
1053 UCHAR EaNameLength;
1054 CHAR EaName[1];
1055} FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
1056
1057typedef struct _FILE_GET_QUOTA_INFORMATION {
1058 ULONG NextEntryOffset;
1059 ULONG SidLength;
1060 SID Sid;
1061} FILE_GET_QUOTA_INFORMATION, *PFILE_GET_QUOTA_INFORMATION;
1062
1063typedef struct _FILE_INTERNAL_INFORMATION {
1064 LARGE_INTEGER IndexNumber;
1065} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
1066
1067typedef struct _FILE_LINK_INFORMATION {
1068 BOOLEAN ReplaceIfExists;
1069 HANDLE RootDirectory;
1070 ULONG FileNameLength;
1071 WCHAR FileName[1];
1072} FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
1073
1074typedef struct _FILE_LOCK_INFO {
1075 LARGE_INTEGER StartingByte;
1076 LARGE_INTEGER Length;
1077 BOOLEAN ExclusiveLock;
1078 ULONG Key;
1079 PFILE_OBJECT FileObject;
1080 PEPROCESS Process;
1081 LARGE_INTEGER EndingByte;
1082} FILE_LOCK_INFO, *PFILE_LOCK_INFO;
1083
1084/* raw internal file lock struct returned from FsRtlGetNextFileLock */
1085typedef struct _FILE_SHARED_LOCK_ENTRY {
1086 PVOID Unknown1;
1087 PVOID Unknown2;
1088 FILE_LOCK_INFO FileLock;
1089} FILE_SHARED_LOCK_ENTRY, *PFILE_SHARED_LOCK_ENTRY;
1090
1091/* raw internal file lock struct returned from FsRtlGetNextFileLock */
1092typedef struct _FILE_EXCLUSIVE_LOCK_ENTRY {
1093 LIST_ENTRY ListEntry;
1094 PVOID Unknown1;
1095 PVOID Unknown2;
1096 FILE_LOCK_INFO FileLock;
1097} FILE_EXCLUSIVE_LOCK_ENTRY, *PFILE_EXCLUSIVE_LOCK_ENTRY;
1098
1099typedef NTSTATUS (*PCOMPLETE_LOCK_IRP_ROUTINE) (
1100 IN PVOID Context,
1101 IN PIRP Irp
1102);
1103
1104typedef VOID (NTAPI *PUNLOCK_ROUTINE) (
1105 IN PVOID Context,
1106 IN PFILE_LOCK_INFO FileLockInfo
1107);
1108
1109typedef struct _FILE_LOCK {
1110 PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine;
1111 PUNLOCK_ROUTINE UnlockRoutine;
1112 BOOLEAN FastIoIsQuestionable;
1113 BOOLEAN Pad[3];
1114 PVOID LockInformation;
1115 FILE_LOCK_INFO LastReturnedLockInfo;
1116 PVOID LastReturnedLock;
1117} FILE_LOCK, *PFILE_LOCK;
1118
1119typedef struct _FILE_MAILSLOT_PEEK_BUFFER {
1120 ULONG ReadDataAvailable;
1121 ULONG NumberOfMessages;
1122 ULONG MessageLength;
1123} FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER;
1124
1125typedef struct _FILE_MAILSLOT_QUERY_INFORMATION {
1126 ULONG MaximumMessageSize;
1127 ULONG MailslotQuota;
1128 ULONG NextMessageSize;
1129 ULONG MessagesAvailable;
1130 LARGE_INTEGER ReadTimeout;
1131} FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION;
1132
1133typedef struct _FILE_MAILSLOT_SET_INFORMATION {
1134 LARGE_INTEGER ReadTimeout;
1135} FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
1136
1137typedef struct _FILE_MODE_INFORMATION {
1138 ULONG Mode;
1139} FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
1140
1141typedef struct _FILE_ALL_INFORMATION {
1142 FILE_BASIC_INFORMATION BasicInformation;
1143 FILE_STANDARD_INFORMATION StandardInformation;
1144 FILE_INTERNAL_INFORMATION InternalInformation;
1145 FILE_EA_INFORMATION EaInformation;
1146 FILE_ACCESS_INFORMATION AccessInformation;
1147 FILE_POSITION_INFORMATION PositionInformation;
1148 FILE_MODE_INFORMATION ModeInformation;
1149 FILE_ALIGNMENT_INFORMATION AlignmentInformation;
1150 FILE_NAME_INFORMATION NameInformation;
1151} FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
1152
1153typedef struct _FILE_NAMES_INFORMATION {
1154 ULONG NextEntryOffset;
1155 ULONG FileIndex;
1156 ULONG FileNameLength;
1157 WCHAR FileName[1];
1158} FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
1159
1160typedef struct _FILE_OBJECTID_INFORMATION {
1161 LONGLONG FileReference;
1162 UCHAR ObjectId[16];
1163 _ANONYMOUS_UNION union {
1164 struct {
1165 UCHAR BirthVolumeId[16];
1166 UCHAR BirthObjectId[16];
1167 UCHAR DomainId[16];
1168 } ;
1169 UCHAR ExtendedInfo[48];
1170 } DUMMYUNIONNAME;
1171} FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION;
1172
1173typedef struct _FILE_OLE_CLASSID_INFORMATION {
1174 GUID ClassId;
1175} FILE_OLE_CLASSID_INFORMATION, *PFILE_OLE_CLASSID_INFORMATION;
1176
1177typedef struct _FILE_OLE_ALL_INFORMATION {
1178 FILE_BASIC_INFORMATION BasicInformation;
1179 FILE_STANDARD_INFORMATION StandardInformation;
1180 FILE_INTERNAL_INFORMATION InternalInformation;
1181 FILE_EA_INFORMATION EaInformation;
1182 FILE_ACCESS_INFORMATION AccessInformation;
1183 FILE_POSITION_INFORMATION PositionInformation;
1184 FILE_MODE_INFORMATION ModeInformation;
1185 FILE_ALIGNMENT_INFORMATION AlignmentInformation;
1186 USN LastChangeUsn;
1187 USN ReplicationUsn;
1188 LARGE_INTEGER SecurityChangeTime;
1189 FILE_OLE_CLASSID_INFORMATION OleClassIdInformation;
1190 FILE_OBJECTID_INFORMATION ObjectIdInformation;
1191 FILE_STORAGE_TYPE StorageType;
1192 ULONG OleStateBits;
1193 ULONG OleId;
1194 ULONG NumberOfStreamReferences;
1195 ULONG StreamIndex;
1196 ULONG SecurityId;
1197 BOOLEAN ContentIndexDisable;
1198 BOOLEAN InheritContentIndexDisable;
1199 FILE_NAME_INFORMATION NameInformation;
1200} FILE_OLE_ALL_INFORMATION, *PFILE_OLE_ALL_INFORMATION;
1201
1202typedef struct _FILE_OLE_DIR_INFORMATION {
1203 ULONG NextEntryOffset;
1204 ULONG FileIndex;
1205 LARGE_INTEGER CreationTime;
1206 LARGE_INTEGER LastAccessTime;
1207 LARGE_INTEGER LastWriteTime;
1208 LARGE_INTEGER ChangeTime;
1209 LARGE_INTEGER EndOfFile;
1210 LARGE_INTEGER AllocationSize;
1211 ULONG FileAttributes;
1212 ULONG FileNameLength;
1213 FILE_STORAGE_TYPE StorageType;
1214 GUID OleClassId;
1215 ULONG OleStateBits;
1216 BOOLEAN ContentIndexDisable;
1217 BOOLEAN InheritContentIndexDisable;
1218 WCHAR FileName[1];
1219} FILE_OLE_DIR_INFORMATION, *PFILE_OLE_DIR_INFORMATION;
1220
1221typedef struct _FILE_OLE_INFORMATION {
1222 LARGE_INTEGER SecurityChangeTime;
1223 FILE_OLE_CLASSID_INFORMATION OleClassIdInformation;
1224 FILE_OBJECTID_INFORMATION ObjectIdInformation;
1225 FILE_STORAGE_TYPE StorageType;
1226 ULONG OleStateBits;
1227 BOOLEAN ContentIndexDisable;
1228 BOOLEAN InheritContentIndexDisable;
1229} FILE_OLE_INFORMATION, *PFILE_OLE_INFORMATION;
1230
1231typedef struct _FILE_OLE_STATE_BITS_INFORMATION {
1232 ULONG StateBits;
1233 ULONG StateBitsMask;
1234} FILE_OLE_STATE_BITS_INFORMATION, *PFILE_OLE_STATE_BITS_INFORMATION;
1235
1236typedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER {
1237 HANDLE EventHandle;
1238 ULONG KeyValue;
1239} FILE_PIPE_ASSIGN_EVENT_BUFFER, *PFILE_PIPE_ASSIGN_EVENT_BUFFER;
1240
1241typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER {
1242 PVOID ClientSession;
1243 PVOID ClientProcess;
1244} FILE_PIPE_CLIENT_PROCESS_BUFFER, *PFILE_PIPE_CLIENT_PROCESS_BUFFER;
1245
1246typedef struct _FILE_PIPE_EVENT_BUFFER {
1247 ULONG NamedPipeState;
1248 ULONG EntryType;
1249 ULONG ByteCount;
1250 ULONG KeyValue;
1251 ULONG NumberRequests;
1252} FILE_PIPE_EVENT_BUFFER, *PFILE_PIPE_EVENT_BUFFER;
1253
1254typedef struct _FILE_PIPE_INFORMATION {
1255 ULONG ReadMode;
1256 ULONG CompletionMode;
1257} FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;
1258
1259typedef struct _FILE_PIPE_LOCAL_INFORMATION {
1260 ULONG NamedPipeType;
1261 ULONG NamedPipeConfiguration;
1262 ULONG MaximumInstances;
1263 ULONG CurrentInstances;
1264 ULONG InboundQuota;
1265 ULONG ReadDataAvailable;
1266 ULONG OutboundQuota;
1267 ULONG WriteQuotaAvailable;
1268 ULONG NamedPipeState;
1269 ULONG NamedPipeEnd;
1270} FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
1271
1272typedef struct _FILE_PIPE_REMOTE_INFORMATION {
1273 LARGE_INTEGER CollectDataTime;
1274 ULONG MaximumCollectionCount;
1275} FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION;
1276
1277typedef struct _FILE_PIPE_WAIT_FOR_BUFFER {
1278 LARGE_INTEGER Timeout;
1279 ULONG NameLength;
1280 BOOLEAN TimeoutSpecified;
1281 WCHAR Name[1];
1282} FILE_PIPE_WAIT_FOR_BUFFER, *PFILE_PIPE_WAIT_FOR_BUFFER;
1283
1284typedef struct _FILE_QUOTA_INFORMATION {
1285 ULONG NextEntryOffset;
1286 ULONG SidLength;
1287 LARGE_INTEGER ChangeTime;
1288 LARGE_INTEGER QuotaUsed;
1289 LARGE_INTEGER QuotaThreshold;
1290 LARGE_INTEGER QuotaLimit;
1291 SID Sid;
1292} FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION;
1293
1294typedef struct _FILE_RENAME_INFORMATION {
1295 BOOLEAN ReplaceIfExists;
1296 HANDLE RootDirectory;
1297 ULONG FileNameLength;
1298 WCHAR FileName[1];
1299} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
1300
1301typedef struct _FILE_STREAM_INFORMATION {
1302 ULONG NextEntryOffset;
1303 ULONG StreamNameLength;
1304 LARGE_INTEGER StreamSize;
1305 LARGE_INTEGER StreamAllocationSize;
1306 WCHAR StreamName[1];
1307} FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;
1308
1309typedef struct _FILE_TRACKING_INFORMATION {
1310 HANDLE DestinationFile;
1311 ULONG ObjectInformationLength;
1312 CHAR ObjectInformation[1];
1313} FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION;
1314
1315typedef struct _FSRTL_COMMON_FCB_HEADER {
1316 CSHORT NodeTypeCode;
1317 CSHORT NodeByteSize;
1318 UCHAR Flags;
1319 UCHAR IsFastIoPossible;
1320#if (VER_PRODUCTBUILD >= 1381)
1321 UCHAR Flags2;
1322 UCHAR Reserved;
1323#endif /* (VER_PRODUCTBUILD >= 1381) */
1324 PERESOURCE Resource;
1325 PERESOURCE PagingIoResource;
1326 LARGE_INTEGER AllocationSize;
1327 LARGE_INTEGER FileSize;
1328 LARGE_INTEGER ValidDataLength;
1329} FSRTL_COMMON_FCB_HEADER, *PFSRTL_COMMON_FCB_HEADER;
1330
1331typedef struct _GENERATE_NAME_CONTEXT {
1332 USHORT Checksum;
1333 BOOLEAN CheckSumInserted;
1334 UCHAR NameLength;
1335 WCHAR NameBuffer[8];
1336 ULONG ExtensionLength;
1337 WCHAR ExtensionBuffer[4];
1338 ULONG LastIndexValue;
1339} GENERATE_NAME_CONTEXT, *PGENERATE_NAME_CONTEXT;
1340
1341typedef struct _HANDLE_TABLE_ENTRY {
1342 PVOID Object;
1343 ULONG ObjectAttributes;
1344 ULONG GrantedAccess;
1345 USHORT GrantedAccessIndex;
1346 USHORT CreatorBackTraceIndex;
1347 ULONG NextFreeTableEntry;
1348} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;
1349
1350typedef struct _MAPPING_PAIR {
1351 ULONGLONG Vcn;
1352 ULONGLONG Lcn;
1353} MAPPING_PAIR, *PMAPPING_PAIR;
1354
1355typedef struct _GET_RETRIEVAL_DESCRIPTOR {
1356 ULONG NumberOfPairs;
1357 ULONGLONG StartVcn;
1358 MAPPING_PAIR Pair[1];
1359} GET_RETRIEVAL_DESCRIPTOR, *PGET_RETRIEVAL_DESCRIPTOR;
1360
1361typedef struct _IO_CLIENT_EXTENSION {
1362 struct _IO_CLIENT_EXTENSION *NextExtension;
1363 PVOID ClientIdentificationAddress;
1364} IO_CLIENT_EXTENSION, *PIO_CLIENT_EXTENSION;
1365
1366typedef struct _IO_COMPLETION_BASIC_INFORMATION {
1367 LONG Depth;
1368} IO_COMPLETION_BASIC_INFORMATION, *PIO_COMPLETION_BASIC_INFORMATION;
1369
1370typedef struct _KEVENT_PAIR {
1371 USHORT Type;
1372 USHORT Size;
1373 KEVENT Event1;
1374 KEVENT Event2;
1375} KEVENT_PAIR, *PKEVENT_PAIR;
1376
1377typedef struct _KQUEUE {
1378 DISPATCHER_HEADER Header;
1379 LIST_ENTRY EntryListHead;
1380 ULONG CurrentCount;
1381 ULONG MaximumCount;
1382 LIST_ENTRY ThreadListHead;
1383} KQUEUE, *PKQUEUE, *RESTRICTED_POINTER PRKQUEUE;
1384
1385typedef struct _MAILSLOT_CREATE_PARAMETERS {
1386 ULONG MailslotQuota;
1387 ULONG MaximumMessageSize;
1388 LARGE_INTEGER ReadTimeout;
1389 BOOLEAN TimeoutSpecified;
1390} MAILSLOT_CREATE_PARAMETERS, *PMAILSLOT_CREATE_PARAMETERS;
1391
1392typedef struct _MBCB {
1393 CSHORT NodeTypeCode;
1394 CSHORT NodeIsInZone;
1395 ULONG PagesToWrite;
1396 ULONG DirtyPages;
1397 ULONG Reserved;
1398 LIST_ENTRY BitmapRanges;
1399 LONGLONG ResumeWritePage;
1400 BITMAP_RANGE BitmapRange1;
1401 BITMAP_RANGE BitmapRange2;
1402 BITMAP_RANGE BitmapRange3;
1403} MBCB, *PMBCB;
1404
1405typedef struct _MOVEFILE_DESCRIPTOR {
1406 HANDLE FileHandle;
1407 ULONG Reserved;
1408 LARGE_INTEGER StartVcn;
1409 LARGE_INTEGER TargetLcn;
1410 ULONG NumVcns;
1411 ULONG Reserved1;
1412} MOVEFILE_DESCRIPTOR, *PMOVEFILE_DESCRIPTOR;
1413
1414typedef struct _NAMED_PIPE_CREATE_PARAMETERS {
1415 ULONG NamedPipeType;
1416 ULONG ReadMode;
1417 ULONG CompletionMode;
1418 ULONG MaximumInstances;
1419 ULONG InboundQuota;
1420 ULONG OutboundQuota;
1421 LARGE_INTEGER DefaultTimeout;
1422 BOOLEAN TimeoutSpecified;
1423} NAMED_PIPE_CREATE_PARAMETERS, *PNAMED_PIPE_CREATE_PARAMETERS;
1424
1425typedef struct _OBJECT_BASIC_INFO {
1426 ULONG Attributes;
1427 ACCESS_MASK GrantedAccess;
1428 ULONG HandleCount;
1429 ULONG ReferenceCount;
1430 ULONG PagedPoolUsage;
1431 ULONG NonPagedPoolUsage;
1432 ULONG Reserved[3];
1433 ULONG NameInformationLength;
1434 ULONG TypeInformationLength;
1435 ULONG SecurityDescriptorLength;
1436 LARGE_INTEGER CreateTime;
1437} OBJECT_BASIC_INFO, *POBJECT_BASIC_INFO;
1438
1439typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFO {
1440 BOOLEAN Inherit;
1441 BOOLEAN ProtectFromClose;
1442} OBJECT_HANDLE_ATTRIBUTE_INFO, *POBJECT_HANDLE_ATTRIBUTE_INFO;
1443
1444typedef struct _OBJECT_NAME_INFO {
1445 UNICODE_STRING ObjectName;
1446 WCHAR ObjectNameBuffer[1];
1447} OBJECT_NAME_INFO, *POBJECT_NAME_INFO;
1448
1449typedef struct _OBJECT_PROTECTION_INFO {
1450 BOOLEAN Inherit;
1451 BOOLEAN ProtectHandle;
1452} OBJECT_PROTECTION_INFO, *POBJECT_PROTECTION_INFO;
1453
1454typedef struct _OBJECT_TYPE_INFO {
1455 UNICODE_STRING ObjectTypeName;
1456 UCHAR Unknown[0x58];
1457 WCHAR ObjectTypeNameBuffer[1];
1458} OBJECT_TYPE_INFO, *POBJECT_TYPE_INFO;
1459
1460typedef struct _OBJECT_ALL_TYPES_INFO {
1461 ULONG NumberOfObjectTypes;
1462 OBJECT_TYPE_INFO ObjectsTypeInfo[1];
1463} OBJECT_ALL_TYPES_INFO, *POBJECT_ALL_TYPES_INFO;
1464
1465typedef struct _PAGEFAULT_HISTORY {
1466 ULONG CurrentIndex;
1467 ULONG MaxIndex;
1468 KSPIN_LOCK SpinLock;
1469 PVOID Reserved;
1470 PROCESS_WS_WATCH_INFORMATION WatchInfo[1];
1471} PAGEFAULT_HISTORY, *PPAGEFAULT_HISTORY;
1472
1473typedef struct _PATHNAME_BUFFER {
1474 ULONG PathNameLength;
1475 WCHAR Name[1];
1476} PATHNAME_BUFFER, *PPATHNAME_BUFFER;
1477
1478#if (VER_PRODUCTBUILD >= 2600)
1479
1480typedef struct _PRIVATE_CACHE_MAP_FLAGS {
1481 ULONG DontUse : 16;
1482 ULONG ReadAheadActive : 1;
1483 ULONG ReadAheadEnabled : 1;
1484 ULONG Available : 14;
1485} PRIVATE_CACHE_MAP_FLAGS, *PPRIVATE_CACHE_MAP_FLAGS;
1486
1487typedef struct _PRIVATE_CACHE_MAP {
1488 _ANONYMOUS_UNION union {
1489 CSHORT NodeTypeCode;
1490 PRIVATE_CACHE_MAP_FLAGS Flags;
1491 ULONG UlongFlags;
1492 } DUMMYUNIONNAME;
1493 ULONG ReadAheadMask;
1494 PFILE_OBJECT FileObject;
1495 LARGE_INTEGER FileOffset1;
1496 LARGE_INTEGER BeyondLastByte1;
1497 LARGE_INTEGER FileOffset2;
1498 LARGE_INTEGER BeyondLastByte2;
1499 LARGE_INTEGER ReadAheadOffset[2];
1500 ULONG ReadAheadLength[2];
1501 KSPIN_LOCK ReadAheadSpinLock;
1502 LIST_ENTRY PrivateLinks;
1503} PRIVATE_CACHE_MAP, *PPRIVATE_CACHE_MAP;
1504
1505#endif
1506
1507typedef struct _PS_IMPERSONATION_INFORMATION {
1508 PACCESS_TOKEN Token;
1509 BOOLEAN CopyOnOpen;
1510 BOOLEAN EffectiveOnly;
1511 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
1512} PS_IMPERSONATION_INFORMATION, *PPS_IMPERSONATION_INFORMATION;
1513
1514typedef struct _PUBLIC_BCB {
1515 CSHORT NodeTypeCode;
1516 CSHORT NodeByteSize;
1517 ULONG MappedLength;
1518 LARGE_INTEGER MappedFileOffset;
1519} PUBLIC_BCB, *PPUBLIC_BCB;
1520
1521typedef struct _QUERY_PATH_REQUEST {
1522 ULONG PathNameLength;
1523 PIO_SECURITY_CONTEXT SecurityContext;
1524 WCHAR FilePathName[1];
1525} QUERY_PATH_REQUEST, *PQUERY_PATH_REQUEST;
1526
1527typedef struct _QUERY_PATH_RESPONSE {
1528 ULONG LengthAccepted;
1529} QUERY_PATH_RESPONSE, *PQUERY_PATH_RESPONSE;
1530
1531typedef struct _RETRIEVAL_POINTERS_BUFFER {
1532 ULONG ExtentCount;
1533 LARGE_INTEGER StartingVcn;
1534 struct {
1535 LARGE_INTEGER NextVcn;
1536 LARGE_INTEGER Lcn;
1537 } Extents[1];
1538} RETRIEVAL_POINTERS_BUFFER, *PRETRIEVAL_POINTERS_BUFFER;
1539
1540typedef struct _RTL_SPLAY_LINKS {
1541 struct _RTL_SPLAY_LINKS *Parent;
1542 struct _RTL_SPLAY_LINKS *LeftChild;
1543 struct _RTL_SPLAY_LINKS *RightChild;
1544} RTL_SPLAY_LINKS, *PRTL_SPLAY_LINKS;
1545
1546typedef struct _SE_EXPORTS {
1547
1548 LUID SeCreateTokenPrivilege;
1549 LUID SeAssignPrimaryTokenPrivilege;
1550 LUID SeLockMemoryPrivilege;
1551 LUID SeIncreaseQuotaPrivilege;
1552 LUID SeUnsolicitedInputPrivilege;
1553 LUID SeTcbPrivilege;
1554 LUID SeSecurityPrivilege;
1555 LUID SeTakeOwnershipPrivilege;
1556 LUID SeLoadDriverPrivilege;
1557 LUID SeCreatePagefilePrivilege;
1558 LUID SeIncreaseBasePriorityPrivilege;
1559 LUID SeSystemProfilePrivilege;
1560 LUID SeSystemtimePrivilege;
1561 LUID SeProfileSingleProcessPrivilege;
1562 LUID SeCreatePermanentPrivilege;
1563 LUID SeBackupPrivilege;
1564 LUID SeRestorePrivilege;
1565 LUID SeShutdownPrivilege;
1566 LUID SeDebugPrivilege;
1567 LUID SeAuditPrivilege;
1568 LUID SeSystemEnvironmentPrivilege;
1569 LUID SeChangeNotifyPrivilege;
1570 LUID SeRemoteShutdownPrivilege;
1571
1572 PSID SeNullSid;
1573 PSID SeWorldSid;
1574 PSID SeLocalSid;
1575 PSID SeCreatorOwnerSid;
1576 PSID SeCreatorGroupSid;
1577
1578 PSID SeNtAuthoritySid;
1579 PSID SeDialupSid;
1580 PSID SeNetworkSid;
1581 PSID SeBatchSid;
1582 PSID SeInteractiveSid;
1583 PSID SeLocalSystemSid;
1584 PSID SeAliasAdminsSid;
1585 PSID SeAliasUsersSid;
1586 PSID SeAliasGuestsSid;
1587 PSID SeAliasPowerUsersSid;
1588 PSID SeAliasAccountOpsSid;
1589 PSID SeAliasSystemOpsSid;
1590 PSID SeAliasPrintOpsSid;
1591 PSID SeAliasBackupOpsSid;
1592
1593 PSID SeAuthenticatedUsersSid;
1594
1595 PSID SeRestrictedSid;
1596 PSID SeAnonymousLogonSid;
1597
1598 LUID SeUndockPrivilege;
1599 LUID SeSyncAgentPrivilege;
1600 LUID SeEnableDelegationPrivilege;
1601
1602} SE_EXPORTS, *PSE_EXPORTS;
1603
1604typedef struct _SECTION_BASIC_INFORMATION {
1605 PVOID BaseAddress;
1606 ULONG Attributes;
1607 LARGE_INTEGER Size;
1608} SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;
1609
1610typedef struct _SECTION_IMAGE_INFORMATION {
1611 PVOID EntryPoint;
1612 ULONG Unknown1;
1613 ULONG StackReserve;
1614 ULONG StackCommit;
1615 ULONG Subsystem;
1616 USHORT MinorSubsystemVersion;
1617 USHORT MajorSubsystemVersion;
1618 ULONG Unknown2;
1619 ULONG Characteristics;
1620 USHORT ImageNumber;
1621 BOOLEAN Executable;
1622 UCHAR Unknown3;
1623 ULONG Unknown4[3];
1624} SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;
1625
1626#if (VER_PRODUCTBUILD >= 2600)
1627
1628typedef struct _SHARED_CACHE_MAP {
1629 CSHORT NodeTypeCode;
1630 CSHORT NodeByteSize;
1631 ULONG OpenCount;
1632 LARGE_INTEGER FileSize;
1633 LIST_ENTRY BcbList;
1634 LARGE_INTEGER SectionSize;
1635 LARGE_INTEGER ValidDataLength;
1636 LARGE_INTEGER ValidDataGoal;
1637 PVACB InitialVacbs[4];
1638 PVACB *Vacbs;
1639 PFILE_OBJECT FileObject;
1640 PVACB ActiveVacb;
1641 PVOID NeedToZero;
1642 ULONG ActivePage;
1643 ULONG NeedToZeroPage;
1644 KSPIN_LOCK ActiveVacbSpinLock;
1645 ULONG VacbActiveCount;
1646 ULONG DirtyPages;
1647 LIST_ENTRY SharedCacheMapLinks;
1648 ULONG Flags;
1649 NTSTATUS Status;
1650 PMBCB Mbcb;
1651 PVOID Section;
1652 PKEVENT CreateEvent;
1653 PKEVENT WaitOnActiveCount;
1654 ULONG PagesToWrite;
1655 LONGLONG BeyondLastFlush;
1656 PCACHE_MANAGER_CALLBACKS Callbacks;
1657 PVOID LazyWriteContext;
1658 LIST_ENTRY PrivateList;
1659 PVOID LogHandle;
1660 PVOID FlushToLsnRoutine;
1661 ULONG DirtyPageThreshold;
1662 ULONG LazyWritePassCount;
1663 PCACHE_UNINITIALIZE_EVENT UninitializeEvent;
1664 PVACB NeedToZeroVacb;
1665 KSPIN_LOCK BcbSpinLock;
1666 PVOID Reserved;
1667 KEVENT Event;
1668 EX_PUSH_LOCK VacbPushLock;
1669 PRIVATE_CACHE_MAP PrivateCacheMap;
1670} SHARED_CACHE_MAP, *PSHARED_CACHE_MAP;
1671
1672#endif
1673
1674typedef struct _STARTING_VCN_INPUT_BUFFER {
1675 LARGE_INTEGER StartingVcn;
1676} STARTING_VCN_INPUT_BUFFER, *PSTARTING_VCN_INPUT_BUFFER;
1677
1678typedef struct _SYSTEM_CACHE_INFORMATION {
1679 ULONG CurrentSize;
1680 ULONG PeakSize;
1681 ULONG PageFaultCount;
1682 ULONG MinimumWorkingSet;
1683 ULONG MaximumWorkingSet;
1684 ULONG Unused[4];
1685} SYSTEM_CACHE_INFORMATION, *PSYSTEM_CACHE_INFORMATION;
1686
1687typedef struct _TERMINATION_PORT {
1688 struct _TERMINATION_PORT* Next;
1689 PVOID Port;
1690} TERMINATION_PORT, *PTERMINATION_PORT;
1691
1692typedef struct _SECURITY_CLIENT_CONTEXT {
1693 SECURITY_QUALITY_OF_SERVICE SecurityQos;
1694 PACCESS_TOKEN ClientToken;
1695 BOOLEAN DirectlyAccessClientToken;
1696 BOOLEAN DirectAccessEffectiveOnly;
1697 BOOLEAN ServerIsRemote;
1698 TOKEN_CONTROL ClientTokenControl;
1699} SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;
1700
1701typedef struct _TUNNEL {
1702 FAST_MUTEX Mutex;
1703 PRTL_SPLAY_LINKS Cache;
1704 LIST_ENTRY TimerQueue;
1705 USHORT NumEntries;
1706} TUNNEL, *PTUNNEL;
1707
1708typedef struct _VACB {
1709 PVOID BaseAddress;
1710 PSHARED_CACHE_MAP SharedCacheMap;
1711 union {
1712 LARGE_INTEGER FileOffset;
1713 USHORT ActiveCount;
1714 } Overlay;
1715 LIST_ENTRY LruList;
1716} VACB, *PVACB;
1717
1718typedef struct _VAD_HEADER {
1719 PVOID StartVPN;
1720 PVOID EndVPN;
1721 PVAD_HEADER ParentLink;
1722 PVAD_HEADER LeftLink;
1723 PVAD_HEADER RightLink;
1724 ULONG Flags; /* LSB = CommitCharge */
1725 PVOID ControlArea;
1726 PVOID FirstProtoPte;
1727 PVOID LastPTE;
1728 ULONG Unknown;
1729 LIST_ENTRY Secured;
1730} VAD_HEADER, *PVAD_HEADER;
1731
1732NTKERNELAPI
1733BOOLEAN
1734NTAPI
1735CcCanIWrite (
1736 IN PFILE_OBJECT FileObject,
1737 IN ULONG BytesToWrite,
1738 IN BOOLEAN Wait,
1739 IN BOOLEAN Retrying
1740);
1741
1742NTKERNELAPI
1743BOOLEAN
1744NTAPI
1745CcCopyRead (
1746 IN PFILE_OBJECT FileObject,
1747 IN PLARGE_INTEGER FileOffset,
1748 IN ULONG Length,
1749 IN BOOLEAN Wait,
1750 OUT PVOID Buffer,
1751 OUT PIO_STATUS_BLOCK IoStatus
1752);
1753
1754NTKERNELAPI
1755BOOLEAN
1756NTAPI
1757CcCopyWrite (
1758 IN PFILE_OBJECT FileObject,
1759 IN PLARGE_INTEGER FileOffset,
1760 IN ULONG Length,
1761 IN BOOLEAN Wait,
1762 IN PVOID Buffer
1763);
1764
1765#define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
1766
1767typedef VOID (NTAPI *PCC_POST_DEFERRED_WRITE) (
1768 IN PVOID Context1,
1769 IN PVOID Context2
1770);
1771
1772NTKERNELAPI
1773VOID
1774NTAPI
1775CcDeferWrite (
1776 IN PFILE_OBJECT FileObject,
1777 IN PCC_POST_DEFERRED_WRITE PostRoutine,
1778 IN PVOID Context1,
1779 IN PVOID Context2,
1780 IN ULONG BytesToWrite,
1781 IN BOOLEAN Retrying
1782);
1783
1784NTKERNELAPI
1785VOID
1786NTAPI
1787CcFastCopyRead (
1788 IN PFILE_OBJECT FileObject,
1789 IN ULONG FileOffset,
1790 IN ULONG Length,
1791 IN ULONG PageCount,
1792 OUT PVOID Buffer,
1793 OUT PIO_STATUS_BLOCK IoStatus
1794);
1795
1796NTKERNELAPI
1797VOID
1798NTAPI
1799CcFastCopyWrite (
1800 IN PFILE_OBJECT FileObject,
1801 IN ULONG FileOffset,
1802 IN ULONG Length,
1803 IN PVOID Buffer
1804);
1805
1806NTKERNELAPI
1807VOID
1808NTAPI
1809CcFlushCache (
1810 IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
1811 IN PLARGE_INTEGER FileOffset OPTIONAL,
1812 IN ULONG Length,
1813 OUT PIO_STATUS_BLOCK IoStatus OPTIONAL
1814);
1815
1816typedef VOID (*PDIRTY_PAGE_ROUTINE) (
1817 IN PFILE_OBJECT FileObject,
1818 IN PLARGE_INTEGER FileOffset,
1819 IN ULONG Length,
1820 IN PLARGE_INTEGER OldestLsn,
1821 IN PLARGE_INTEGER NewestLsn,
1822 IN PVOID Context1,
1823 IN PVOID Context2
1824);
1825
1826NTKERNELAPI
1827LARGE_INTEGER
1828NTAPI
1829CcGetDirtyPages (
1830 IN PVOID LogHandle,
1831 IN PDIRTY_PAGE_ROUTINE DirtyPageRoutine,
1832 IN PVOID Context1,
1833 IN PVOID Context2
1834);
1835
1836NTKERNELAPI
1837PFILE_OBJECT
1838NTAPI
1839CcGetFileObjectFromBcb (
1840 IN PVOID Bcb
1841);
1842
1843NTKERNELAPI
1844PFILE_OBJECT
1845NTAPI
1846CcGetFileObjectFromSectionPtrs (
1847 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
1848);
1849
1850#define CcGetFileSizePointer(FO) ( \
1851 ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
1852)
1853
1854#if (VER_PRODUCTBUILD >= 2195)
1855
1856NTKERNELAPI
1857LARGE_INTEGER
1858NTAPI
1859CcGetFlushedValidData (
1860 IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
1861 IN BOOLEAN BcbListHeld
1862);
1863
1864#endif /* (VER_PRODUCTBUILD >= 2195) */
1865
1866NTKERNELAPI
1867LARGE_INTEGER
1868CcGetLsnForFileObject (
1869 IN PFILE_OBJECT FileObject,
1870 OUT PLARGE_INTEGER OldestLsn OPTIONAL
1871);
1872
1873typedef BOOLEAN (NTAPI *PACQUIRE_FOR_LAZY_WRITE) (
1874 IN PVOID Context,
1875 IN BOOLEAN Wait
1876);
1877
1878typedef VOID (NTAPI *PRELEASE_FROM_LAZY_WRITE) (
1879 IN PVOID Context
1880);
1881
1882typedef BOOLEAN (NTAPI *PACQUIRE_FOR_READ_AHEAD) (
1883 IN PVOID Context,
1884 IN BOOLEAN Wait
1885);
1886
1887typedef VOID (NTAPI *PRELEASE_FROM_READ_AHEAD) (
1888 IN PVOID Context
1889);
1890
1891typedef struct _CACHE_MANAGER_CALLBACKS {
1892 PACQUIRE_FOR_LAZY_WRITE AcquireForLazyWrite;
1893 PRELEASE_FROM_LAZY_WRITE ReleaseFromLazyWrite;
1894 PACQUIRE_FOR_READ_AHEAD AcquireForReadAhead;
1895 PRELEASE_FROM_READ_AHEAD ReleaseFromReadAhead;
1896} CACHE_MANAGER_CALLBACKS, *PCACHE_MANAGER_CALLBACKS;
1897
1898NTKERNELAPI
1899VOID
1900NTAPI
1901CcInitializeCacheMap (
1902 IN PFILE_OBJECT FileObject,
1903 IN PCC_FILE_SIZES FileSizes,
1904 IN BOOLEAN PinAccess,
1905 IN PCACHE_MANAGER_CALLBACKS Callbacks,
1906 IN PVOID LazyWriteContext
1907);
1908
1909#define CcIsFileCached(FO) ( \
1910 ((FO)->SectionObjectPointer != NULL) && \
1911 (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
1912)
1913
1914NTKERNELAPI
1915BOOLEAN
1916NTAPI
1917CcIsThereDirtyData (
1918 IN PVPB Vpb
1919);
1920
1921NTKERNELAPI
1922BOOLEAN
1923NTAPI
1924CcMapData (
1925 IN PFILE_OBJECT FileObject,
1926 IN PLARGE_INTEGER FileOffset,
1927 IN ULONG Length,
1928 IN BOOLEAN Wait,
1929 OUT PVOID *Bcb,
1930 OUT PVOID *Buffer
1931);
1932
1933NTKERNELAPI
1934VOID
1935NTAPI
1936CcMdlRead (
1937 IN PFILE_OBJECT FileObject,
1938 IN PLARGE_INTEGER FileOffset,
1939 IN ULONG Length,
1940 OUT PMDL *MdlChain,
1941 OUT PIO_STATUS_BLOCK IoStatus
1942);
1943
1944NTKERNELAPI
1945VOID
1946NTAPI
1947CcMdlReadComplete (
1948 IN PFILE_OBJECT FileObject,
1949 IN PMDL MdlChain
1950);
1951
1952NTKERNELAPI
1953VOID
1954NTAPI
1955CcMdlWriteComplete (
1956 IN PFILE_OBJECT FileObject,
1957 IN PLARGE_INTEGER FileOffset,
1958 IN PMDL MdlChain
1959);
1960
1961NTKERNELAPI
1962BOOLEAN
1963NTAPI
1964CcPinMappedData (
1965 IN PFILE_OBJECT FileObject,
1966 IN PLARGE_INTEGER FileOffset,
1967 IN ULONG Length,
1968#if (VER_PRODUCTBUILD >= 2195)
1969 IN ULONG Flags,
1970#else
1971 IN BOOLEAN Wait,
1972#endif
1973 IN OUT PVOID *Bcb
1974);
1975
1976NTKERNELAPI
1977BOOLEAN
1978NTAPI
1979CcPinRead (
1980 IN PFILE_OBJECT FileObject,
1981 IN PLARGE_INTEGER FileOffset,
1982 IN ULONG Length,
1983#if (VER_PRODUCTBUILD >= 2195)
1984 IN ULONG Flags,
1985#else
1986 IN BOOLEAN Wait,
1987#endif
1988 OUT PVOID *Bcb,
1989 OUT PVOID *Buffer
1990);
1991
1992NTKERNELAPI
1993VOID
1994NTAPI
1995CcPrepareMdlWrite (
1996 IN PFILE_OBJECT FileObject,
1997 IN PLARGE_INTEGER FileOffset,
1998 IN ULONG Length,
1999 OUT PMDL *MdlChain,
2000 OUT PIO_STATUS_BLOCK IoStatus
2001);
2002
2003NTKERNELAPI
2004BOOLEAN
2005NTAPI
2006CcPreparePinWrite (
2007 IN PFILE_OBJECT FileObject,
2008 IN PLARGE_INTEGER FileOffset,
2009 IN ULONG Length,
2010 IN BOOLEAN Zero,
2011#if (VER_PRODUCTBUILD >= 2195)
2012 IN ULONG Flags,
2013#else
2014 IN BOOLEAN Wait,
2015#endif
2016 OUT PVOID *Bcb,
2017 OUT PVOID *Buffer
2018);
2019
2020NTKERNELAPI
2021BOOLEAN
2022NTAPI
2023CcPurgeCacheSection (
2024 IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
2025 IN PLARGE_INTEGER FileOffset OPTIONAL,
2026 IN ULONG Length,
2027 IN BOOLEAN UninitializeCacheMaps
2028);
2029
2030#define CcReadAhead(FO, FOFF, LEN) ( \
2031 if ((LEN) >= 256) { \
2032 CcScheduleReadAhead((FO), (FOFF), (LEN)); \
2033 } \
2034)
2035
2036#if (VER_PRODUCTBUILD >= 2195)
2037
2038NTKERNELAPI
2039PVOID
2040NTAPI
2041CcRemapBcb (
2042 IN PVOID Bcb
2043);
2044
2045#endif /* (VER_PRODUCTBUILD >= 2195) */
2046
2047NTKERNELAPI
2048VOID
2049NTAPI
2050CcRepinBcb (
2051 IN PVOID Bcb
2052);
2053
2054NTKERNELAPI
2055VOID
2056NTAPI
2057CcScheduleReadAhead (
2058 IN PFILE_OBJECT FileObject,
2059 IN PLARGE_INTEGER FileOffset,
2060 IN ULONG Length
2061);
2062
2063NTKERNELAPI
2064VOID
2065NTAPI
2066CcSetAdditionalCacheAttributes (
2067 IN PFILE_OBJECT FileObject,
2068 IN BOOLEAN DisableReadAhead,
2069 IN BOOLEAN DisableWriteBehind
2070);
2071
2072NTKERNELAPI
2073VOID
2074NTAPI
2075CcSetBcbOwnerPointer (
2076 IN PVOID Bcb,
2077 IN PVOID OwnerPointer
2078);
2079
2080NTKERNELAPI
2081VOID
2082NTAPI
2083CcSetDirtyPageThreshold (
2084 IN PFILE_OBJECT FileObject,
2085 IN ULONG DirtyPageThreshold
2086);
2087
2088NTKERNELAPI
2089VOID
2090NTAPI
2091CcSetDirtyPinnedData (
2092 IN PVOID BcbVoid,
2093 IN PLARGE_INTEGER Lsn OPTIONAL
2094);
2095
2096NTKERNELAPI
2097VOID
2098NTAPI
2099CcSetFileSizes (
2100 IN PFILE_OBJECT FileObject,
2101 IN PCC_FILE_SIZES FileSizes
2102);
2103
2104typedef VOID (NTAPI *PFLUSH_TO_LSN) (
2105 IN PVOID LogHandle,
2106 IN PLARGE_INTEGER Lsn
2107);
2108
2109NTKERNELAPI
2110VOID
2111NTAPI
2112CcSetLogHandleForFile (
2113 IN PFILE_OBJECT FileObject,
2114 IN PVOID LogHandle,
2115 IN PFLUSH_TO_LSN FlushToLsnRoutine
2116);
2117
2118NTKERNELAPI
2119VOID
2120NTAPI
2121CcSetReadAheadGranularity (
2122 IN PFILE_OBJECT FileObject,
2123 IN ULONG Granularity /* default: PAGE_SIZE */
2124 /* allowed: 2^n * PAGE_SIZE */
2125);
2126
2127NTKERNELAPI
2128BOOLEAN
2129NTAPI
2130CcUninitializeCacheMap (
2131 IN PFILE_OBJECT FileObject,
2132 IN PLARGE_INTEGER TruncateSize OPTIONAL,
2133 IN PCACHE_UNINITIALIZE_EVENT UninitializeCompleteEvent OPTIONAL
2134);
2135
2136NTKERNELAPI
2137VOID
2138NTAPI
2139CcUnpinData (
2140 IN PVOID Bcb
2141);
2142
2143NTKERNELAPI
2144VOID
2145NTAPI
2146CcUnpinDataForThread (
2147 IN PVOID Bcb,
2148 IN ERESOURCE_THREAD ResourceThreadId
2149);
2150
2151NTKERNELAPI
2152VOID
2153NTAPI
2154CcUnpinRepinnedBcb (
2155 IN PVOID Bcb,
2156 IN BOOLEAN WriteThrough,
2157 OUT PIO_STATUS_BLOCK IoStatus
2158);
2159
2160#if (VER_PRODUCTBUILD >= 2195)
2161
2162NTKERNELAPI
2163NTSTATUS
2164NTAPI
2165CcWaitForCurrentLazyWriterActivity (
2166 VOID
2167);
2168
2169#endif /* (VER_PRODUCTBUILD >= 2195) */
2170
2171NTKERNELAPI
2172BOOLEAN
2173NTAPI
2174CcZeroData (
2175 IN PFILE_OBJECT FileObject,
2176 IN PLARGE_INTEGER StartOffset,
2177 IN PLARGE_INTEGER EndOffset,
2178 IN BOOLEAN Wait
2179);
2180
2181NTKERNELAPI
2182VOID
2183NTAPI
2184ExDisableResourceBoostLite (
2185 IN PERESOURCE Resource
2186);
2187
2188NTKERNELAPI
2189ULONG
2190NTAPI
2191ExQueryPoolBlockSize (
2192 IN PVOID PoolBlock,
2193 OUT PBOOLEAN QuotaCharged
2194);
2195
2196#define FlagOn(x, f) ((x) & (f))
2197
2198NTKERNELAPI
2199VOID
2200NTAPI
2201FsRtlAddToTunnelCache (
2202 IN PTUNNEL Cache,
2203 IN ULONGLONG DirectoryKey,
2204 IN PUNICODE_STRING ShortName,
2205 IN PUNICODE_STRING LongName,
2206 IN BOOLEAN KeyByShortName,
2207 IN ULONG DataLength,
2208 IN PVOID Data
2209);
2210
2211#if (VER_PRODUCTBUILD >= 2195)
2212
2213PFILE_LOCK
2214NTAPI
2215FsRtlAllocateFileLock (
2216 IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL,
2217 IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
2218);
2219
2220#endif /* (VER_PRODUCTBUILD >= 2195) */
2221
2222NTKERNELAPI
2223PVOID
2224NTAPI
2225FsRtlAllocatePool (
2226 IN POOL_TYPE PoolType,
2227 IN ULONG NumberOfBytes
2228);
2229
2230NTKERNELAPI
2231PVOID
2232NTAPI
2233FsRtlAllocatePoolWithQuota (
2234 IN POOL_TYPE PoolType,
2235 IN ULONG NumberOfBytes
2236);
2237
2238NTKERNELAPI
2239PVOID
2240NTAPI
2241FsRtlAllocatePoolWithQuotaTag (
2242 IN POOL_TYPE PoolType,
2243 IN ULONG NumberOfBytes,
2244 IN ULONG Tag
2245);
2246
2247NTKERNELAPI
2248PVOID
2249NTAPI
2250FsRtlAllocatePoolWithTag (
2251 IN POOL_TYPE PoolType,
2252 IN ULONG NumberOfBytes,
2253 IN ULONG Tag
2254);
2255
2256NTKERNELAPI
2257BOOLEAN
2258NTAPI
2259FsRtlAreNamesEqual (
2260 IN PUNICODE_STRING Name1,
2261 IN PUNICODE_STRING Name2,
2262 IN BOOLEAN IgnoreCase,
2263 IN PWCHAR UpcaseTable OPTIONAL
2264);
2265
2266#define FsRtlAreThereCurrentFileLocks(FL) ( \
2267 ((FL)->FastIoIsQuestionable) \
2268)
2269
2270/*
2271 FsRtlCheckLockForReadAccess:
2272
2273 All this really does is pick out the lock parameters from the irp (io stack
2274 location?), get IoGetRequestorProcess, and pass values on to
2275 FsRtlFastCheckLockForRead.
2276*/
2277NTKERNELAPI
2278BOOLEAN
2279NTAPI
2280FsRtlCheckLockForReadAccess (
2281 IN PFILE_LOCK FileLock,
2282 IN PIRP Irp
2283);
2284
2285/*
2286 FsRtlCheckLockForWriteAccess:
2287
2288 All this really does is pick out the lock parameters from the irp (io stack
2289 location?), get IoGetRequestorProcess, and pass values on to
2290 FsRtlFastCheckLockForWrite.
2291*/
2292NTKERNELAPI
2293BOOLEAN
2294NTAPI
2295FsRtlCheckLockForWriteAccess (
2296 IN PFILE_LOCK FileLock,
2297 IN PIRP Irp
2298);
2299
2300typedef
2301VOID NTAPI
2302(*POPLOCK_WAIT_COMPLETE_ROUTINE) (
2303 IN PVOID Context,
2304 IN PIRP Irp
2305);
2306
2307typedef
2308VOID NTAPI
2309(*POPLOCK_FS_PREPOST_IRP) (
2310 IN PVOID Context,
2311 IN PIRP Irp
2312);
2313
2314NTKERNELAPI
2315NTSTATUS
2316NTAPI
2317FsRtlCheckOplock (
2318 IN POPLOCK Oplock,
2319 IN PIRP Irp,
2320 IN PVOID Context,
2321 IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
2322 IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL
2323);
2324
2325NTKERNELAPI
2326BOOLEAN
2327NTAPI
2328FsRtlCopyRead (
2329 IN PFILE_OBJECT FileObject,
2330 IN PLARGE_INTEGER FileOffset,
2331 IN ULONG Length,
2332 IN BOOLEAN Wait,
2333 IN ULONG LockKey,
2334 OUT PVOID Buffer,
2335 OUT PIO_STATUS_BLOCK IoStatus,
2336 IN PDEVICE_OBJECT DeviceObject
2337);
2338
2339NTKERNELAPI
2340BOOLEAN
2341NTAPI
2342FsRtlCopyWrite (
2343 IN PFILE_OBJECT FileObject,
2344 IN PLARGE_INTEGER FileOffset,
2345 IN ULONG Length,
2346 IN BOOLEAN Wait,
2347 IN ULONG LockKey,
2348 IN PVOID Buffer,
2349 OUT PIO_STATUS_BLOCK IoStatus,
2350 IN PDEVICE_OBJECT DeviceObject
2351);
2352
2353NTKERNELAPI
2354BOOLEAN
2355NTAPI
2356FsRtlCurrentBatchOplock (
2357 IN POPLOCK Oplock
2358);
2359
2360NTKERNELAPI
2361VOID
2362NTAPI
2363FsRtlDeleteKeyFromTunnelCache (
2364 IN PTUNNEL Cache,
2365 IN ULONGLONG DirectoryKey
2366);
2367
2368NTKERNELAPI
2369VOID
2370NTAPI
2371FsRtlDeleteTunnelCache (
2372 IN PTUNNEL Cache
2373);
2374
2375NTKERNELAPI
2376VOID
2377NTAPI
2378FsRtlDeregisterUncProvider (
2379 IN HANDLE Handle
2380);
2381
2382NTKERNELAPI
2383BOOLEAN
2384NTAPI
2385FsRtlDoesNameContainWildCards (
2386 IN PUNICODE_STRING Name
2387);
2388
2389#define FsRtlEnterFileSystem KeEnterCriticalRegion
2390
2391#define FsRtlExitFileSystem KeLeaveCriticalRegion
2392
2393NTKERNELAPI
2394BOOLEAN
2395NTAPI
2396FsRtlFastCheckLockForRead (
2397 IN PFILE_LOCK FileLock,
2398 IN PLARGE_INTEGER FileOffset,
2399 IN PLARGE_INTEGER Length,
2400 IN ULONG Key,
2401 IN PFILE_OBJECT FileObject,
2402 IN PEPROCESS Process
2403);
2404
2405NTKERNELAPI
2406BOOLEAN
2407NTAPI
2408FsRtlFastCheckLockForWrite (
2409 IN PFILE_LOCK FileLock,
2410 IN PLARGE_INTEGER FileOffset,
2411 IN PLARGE_INTEGER Length,
2412 IN ULONG Key,
2413 IN PFILE_OBJECT FileObject,
2414 IN PEPROCESS Process
2415);
2416
2417#define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) ( \
2418 FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11) \
2419)
2420
2421NTKERNELAPI
2422NTSTATUS
2423NTAPI
2424FsRtlFastUnlockAll (
2425 IN PFILE_LOCK FileLock,
2426 IN PFILE_OBJECT FileObject,
2427 IN PEPROCESS Process,
2428 IN PVOID Context OPTIONAL
2429);
2430/* ret: STATUS_RANGE_NOT_LOCKED */
2431
2432NTKERNELAPI
2433NTSTATUS
2434NTAPI
2435FsRtlFastUnlockAllByKey (
2436 IN PFILE_LOCK FileLock,
2437 IN PFILE_OBJECT FileObject,
2438 IN PEPROCESS Process,
2439 IN ULONG Key,
2440 IN PVOID Context OPTIONAL
2441);
2442/* ret: STATUS_RANGE_NOT_LOCKED */
2443
2444NTKERNELAPI
2445NTSTATUS
2446NTAPI
2447FsRtlFastUnlockSingle (
2448 IN PFILE_LOCK FileLock,
2449 IN PFILE_OBJECT FileObject,
2450 IN PLARGE_INTEGER FileOffset,
2451 IN PLARGE_INTEGER Length,
2452 IN PEPROCESS Process,
2453 IN ULONG Key,
2454 IN PVOID Context OPTIONAL,
2455 IN BOOLEAN AlreadySynchronized
2456);
2457/* ret: STATUS_RANGE_NOT_LOCKED */
2458
2459NTKERNELAPI
2460BOOLEAN
2461NTAPI
2462FsRtlFindInTunnelCache (
2463 IN PTUNNEL Cache,
2464 IN ULONGLONG DirectoryKey,
2465 IN PUNICODE_STRING Name,
2466 OUT PUNICODE_STRING ShortName,
2467 OUT PUNICODE_STRING LongName,
2468 IN OUT PULONG DataLength,
2469 OUT PVOID Data
2470);
2471
2472#if (VER_PRODUCTBUILD >= 2195)
2473
2474NTKERNELAPI
2475VOID
2476NTAPI
2477FsRtlFreeFileLock (
2478 IN PFILE_LOCK FileLock
2479);
2480
2481#endif /* (VER_PRODUCTBUILD >= 2195) */
2482
2483NTKERNELAPI
2484NTSTATUS
2485NTAPI
2486FsRtlGetFileSize (
2487 IN PFILE_OBJECT FileObject,
2488 IN OUT PLARGE_INTEGER FileSize
2489);
2490
2491/*
2492 FsRtlGetNextFileLock:
2493
2494 ret: NULL if no more locks
2495
2496 Internals:
2497 FsRtlGetNextFileLock uses FileLock->LastReturnedLockInfo and
2498 FileLock->LastReturnedLock as storage.
2499 LastReturnedLock is a pointer to the 'raw' lock inkl. double linked
2500 list, and FsRtlGetNextFileLock needs this to get next lock on subsequent
2501 calls with Restart = FALSE.
2502*/
2503NTKERNELAPI
2504PFILE_LOCK_INFO
2505NTAPI
2506FsRtlGetNextFileLock (
2507 IN PFILE_LOCK FileLock,
2508 IN BOOLEAN Restart
2509);
2510
2511NTKERNELAPI
2512VOID
2513NTAPI
2514FsRtlInitializeFileLock (
2515 IN PFILE_LOCK FileLock,
2516 IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL,
2517 IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
2518);
2519
2520NTKERNELAPI
2521VOID
2522NTAPI
2523FsRtlInitializeOplock (
2524 IN OUT POPLOCK Oplock
2525);
2526
2527NTKERNELAPI
2528VOID
2529NTAPI
2530FsRtlInitializeTunnelCache (
2531 IN PTUNNEL Cache
2532);
2533
2534NTKERNELAPI
2535BOOLEAN
2536NTAPI
2537FsRtlIsNameInExpression (
2538 IN PUNICODE_STRING Expression,
2539 IN PUNICODE_STRING Name,
2540 IN BOOLEAN IgnoreCase,
2541 IN PWCHAR UpcaseTable OPTIONAL
2542);
2543
2544NTKERNELAPI
2545BOOLEAN
2546NTAPI
2547FsRtlIsNtstatusExpected (
2548 IN NTSTATUS Ntstatus
2549);
2550
2551#define FsRtlIsUnicodeCharacterWild(C) ( \
2552 (((C) >= 0x40) ? \
2553 FALSE : \
2554 FlagOn((*FsRtlLegalAnsiCharacterArray)[(C)], FSRTL_WILD_CHARACTER )) \
2555)
2556
2557NTKERNELAPI
2558BOOLEAN
2559NTAPI
2560FsRtlMdlReadComplete (
2561 IN PFILE_OBJECT FileObject,
2562 IN PMDL MdlChain
2563);
2564
2565NTKERNELAPI
2566BOOLEAN
2567NTAPI
2568FsRtlMdlReadCompleteDev (
2569 IN PFILE_OBJECT FileObject,
2570 IN PMDL MdlChain,
2571 IN PDEVICE_OBJECT DeviceObject
2572);
2573
2574NTKERNELAPI
2575BOOLEAN
2576NTAPI
2577FsRtlMdlWriteComplete (
2578 IN PFILE_OBJECT FileObject,
2579 IN PLARGE_INTEGER FileOffset,
2580 IN PMDL MdlChain
2581);
2582
2583NTKERNELAPI
2584BOOLEAN
2585NTAPI
2586FsRtlMdlWriteCompleteDev (
2587 IN PFILE_OBJECT FileObject,
2588 IN PLARGE_INTEGER FileOffset,
2589 IN PMDL MdlChain,
2590 IN PDEVICE_OBJECT DeviceObject
2591);
2592
2593NTKERNELAPI
2594NTSTATUS
2595NTAPI
2596FsRtlNormalizeNtstatus (
2597 IN NTSTATUS Exception,
2598 IN NTSTATUS GenericException
2599);
2600
2601NTKERNELAPI
2602VOID
2603NTAPI
2604FsRtlNotifyChangeDirectory (
2605 IN PNOTIFY_SYNC NotifySync,
2606 IN PVOID FsContext,
2607 IN PSTRING FullDirectoryName,
2608 IN PLIST_ENTRY NotifyList,
2609 IN BOOLEAN WatchTree,
2610 IN ULONG CompletionFilter,
2611 IN PIRP NotifyIrp
2612);
2613
2614NTKERNELAPI
2615VOID
2616NTAPI
2617FsRtlNotifyCleanup (
2618 IN PNOTIFY_SYNC NotifySync,
2619 IN PLIST_ENTRY NotifyList,
2620 IN PVOID FsContext
2621);
2622
2623typedef BOOLEAN (*PCHECK_FOR_TRAVERSE_ACCESS) (
2624 IN PVOID NotifyContext,
2625 IN PVOID TargetContext,
2626 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
2627);
2628
2629NTKERNELAPI
2630VOID
2631NTAPI
2632FsRtlNotifyFullChangeDirectory (
2633 IN PNOTIFY_SYNC NotifySync,
2634 IN PLIST_ENTRY NotifyList,
2635 IN PVOID FsContext,
2636 IN PSTRING FullDirectoryName,
2637 IN BOOLEAN WatchTree,
2638 IN BOOLEAN IgnoreBuffer,
2639 IN ULONG CompletionFilter,
2640 IN PIRP NotifyIrp,
2641 IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL,
2642 IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL
2643);
2644
2645NTKERNELAPI
2646VOID
2647NTAPI
2648FsRtlNotifyFullReportChange (
2649 IN PNOTIFY_SYNC NotifySync,
2650 IN PLIST_ENTRY NotifyList,
2651 IN PSTRING FullTargetName,
2652 IN USHORT TargetNameOffset,
2653 IN PSTRING StreamName OPTIONAL,
2654 IN PSTRING NormalizedParentName OPTIONAL,
2655 IN ULONG FilterMatch,
2656 IN ULONG Action,
2657 IN PVOID TargetContext
2658);
2659
2660NTKERNELAPI
2661VOID
2662NTAPI
2663FsRtlNotifyInitializeSync (
2664 IN PNOTIFY_SYNC NotifySync
2665);
2666
2667NTKERNELAPI
2668VOID
2669NTAPI
2670FsRtlNotifyReportChange (
2671 IN PNOTIFY_SYNC NotifySync,
2672 IN PLIST_ENTRY NotifyList,
2673 IN PSTRING FullTargetName,
2674 IN PUSHORT FileNamePartLength,
2675 IN ULONG FilterMatch
2676);
2677
2678NTKERNELAPI
2679VOID
2680NTAPI
2681FsRtlNotifyUninitializeSync (
2682 IN PNOTIFY_SYNC NotifySync
2683);
2684
2685#if (VER_PRODUCTBUILD >= 2195)
2686
2687NTKERNELAPI
2688NTSTATUS
2689NTAPI
2690FsRtlNotifyVolumeEvent (
2691 IN PFILE_OBJECT FileObject,
2692 IN ULONG EventCode
2693);
2694
2695#endif /* (VER_PRODUCTBUILD >= 2195) */
2696
2697NTKERNELAPI
2698NTSTATUS
2699NTAPI
2700FsRtlOplockFsctrl (
2701 IN POPLOCK Oplock,
2702 IN PIRP Irp,
2703 IN ULONG OpenCount
2704);
2705
2706NTKERNELAPI
2707BOOLEAN
2708NTAPI
2709FsRtlOplockIsFastIoPossible (
2710 IN POPLOCK Oplock
2711);
2712
2713/*
2714 FsRtlPrivateLock:
2715
2716 ret: IoStatus->Status: STATUS_PENDING, STATUS_LOCK_NOT_GRANTED
2717
2718 Internals:
2719 -Calls IoCompleteRequest if Irp
2720 -Uses exception handling / ExRaiseStatus with STATUS_INSUFFICIENT_RESOURCES
2721*/
2722NTKERNELAPI
2723BOOLEAN
2724NTAPI
2725FsRtlPrivateLock (
2726 IN PFILE_LOCK FileLock,
2727 IN PFILE_OBJECT FileObject,
2728 IN PLARGE_INTEGER FileOffset,
2729 IN PLARGE_INTEGER Length,
2730 IN PEPROCESS Process,
2731 IN ULONG Key,
2732 IN BOOLEAN FailImmediately,
2733 IN BOOLEAN ExclusiveLock,
2734 OUT PIO_STATUS_BLOCK IoStatus,
2735 IN PIRP Irp OPTIONAL,
2736 IN PVOID Context,
2737 IN BOOLEAN AlreadySynchronized
2738);
2739
2740/*
2741 FsRtlProcessFileLock:
2742
2743 ret:
2744 -STATUS_INVALID_DEVICE_REQUEST
2745 -STATUS_RANGE_NOT_LOCKED from unlock routines.
2746 -STATUS_PENDING, STATUS_LOCK_NOT_GRANTED from FsRtlPrivateLock
2747 (redirected IoStatus->Status).
2748
2749 Internals:
2750 -switch ( Irp->CurrentStackLocation->MinorFunction )
2751 lock: return FsRtlPrivateLock;
2752 unlocksingle: return FsRtlFastUnlockSingle;
2753 unlockall: return FsRtlFastUnlockAll;
2754 unlockallbykey: return FsRtlFastUnlockAllByKey;
2755 default: IofCompleteRequest with STATUS_INVALID_DEVICE_REQUEST;
2756 return STATUS_INVALID_DEVICE_REQUEST;
2757
2758 -'AllwaysZero' is passed thru as 'AllwaysZero' to lock / unlock routines.
2759 -'Irp' is passet thru as 'Irp' to FsRtlPrivateLock.
2760*/
2761NTKERNELAPI
2762NTSTATUS
2763NTAPI
2764FsRtlProcessFileLock (
2765 IN PFILE_LOCK FileLock,
2766 IN PIRP Irp,
2767 IN PVOID Context OPTIONAL
2768);
2769
2770NTKERNELAPI
2771NTSTATUS
2772NTAPI
2773FsRtlRegisterUncProvider (
2774 IN OUT PHANDLE MupHandle,
2775 IN PUNICODE_STRING RedirectorDeviceName,
2776 IN BOOLEAN MailslotsSupported
2777);
2778
2779NTKERNELAPI
2780VOID
2781NTAPI
2782FsRtlUninitializeFileLock (
2783 IN PFILE_LOCK FileLock
2784);
2785
2786NTKERNELAPI
2787VOID
2788NTAPI
2789FsRtlUninitializeOplock (
2790 IN OUT POPLOCK Oplock
2791);
2792
2793NTSYSAPI
2794VOID
2795NTAPI
2796HalDisplayString (
2797 IN PCHAR String
2798);
2799
2800NTSYSAPI
2801VOID
2802NTAPI
2803HalQueryRealTimeClock (
2804 IN OUT PTIME_FIELDS TimeFields
2805);
2806
2807NTSYSAPI
2808VOID
2809NTAPI
2810HalSetRealTimeClock (
2811 IN PTIME_FIELDS TimeFields
2812);
2813
2814#define InitializeMessageHeader(m, l, t) { \
2815 (m)->Length = (USHORT)(l); \
2816 (m)->DataLength = (USHORT)(l - sizeof( LPC_MESSAGE )); \
2817 (m)->MessageType = (USHORT)(t); \
2818 (m)->DataInfoOffset = 0; \
2819}
2820
2821NTKERNELAPI
2822VOID
2823NTAPI
2824IoAcquireVpbSpinLock (
2825 OUT PKIRQL Irql
2826);
2827
2828NTKERNELAPI
2829NTSTATUS
2830NTAPI
2831IoCheckDesiredAccess (
2832 IN OUT PACCESS_MASK DesiredAccess,
2833 IN ACCESS_MASK GrantedAccess
2834);
2835
2836NTKERNELAPI
2837NTSTATUS
2838NTAPI
2839IoCheckEaBufferValidity (
2840 IN PFILE_FULL_EA_INFORMATION EaBuffer,
2841 IN ULONG EaLength,
2842 OUT PULONG ErrorOffset
2843);
2844
2845NTKERNELAPI
2846NTSTATUS
2847NTAPI
2848IoCheckFunctionAccess (
2849 IN ACCESS_MASK GrantedAccess,
2850 IN UCHAR MajorFunction,
2851 IN UCHAR MinorFunction,
2852 IN ULONG IoControlCode,
2853 IN PFILE_INFORMATION_CLASS FileInformationClass OPTIONAL,
2854 IN PFS_INFORMATION_CLASS FsInformationClass OPTIONAL
2855);
2856
2857#if (VER_PRODUCTBUILD >= 2195)
2858
2859NTKERNELAPI
2860NTSTATUS
2861NTAPI
2862IoCheckQuotaBufferValidity (
2863 IN PFILE_QUOTA_INFORMATION QuotaBuffer,
2864 IN ULONG QuotaLength,
2865 OUT PULONG ErrorOffset
2866);
2867
2868#endif /* (VER_PRODUCTBUILD >= 2195) */
2869
2870NTKERNELAPI
2871PFILE_OBJECT
2872NTAPI
2873IoCreateStreamFileObject (
2874 IN PFILE_OBJECT FileObject OPTIONAL,
2875 IN PDEVICE_OBJECT DeviceObject OPTIONAL
2876);
2877
2878#if (VER_PRODUCTBUILD >= 2195)
2879
2880NTKERNELAPI
2881PFILE_OBJECT
2882NTAPI
2883IoCreateStreamFileObjectLite (
2884 IN PFILE_OBJECT FileObject OPTIONAL,
2885 IN PDEVICE_OBJECT DeviceObject OPTIONAL
2886);
2887
2888#endif /* (VER_PRODUCTBUILD >= 2195) */
2889
2890NTKERNELAPI
2891BOOLEAN
2892NTAPI
2893IoFastQueryNetworkAttributes (
2894 IN POBJECT_ATTRIBUTES ObjectAttributes,
2895 IN ACCESS_MASK DesiredAccess,
2896 IN ULONG OpenOptions,
2897 OUT PIO_STATUS_BLOCK IoStatus,
2898 OUT PFILE_NETWORK_OPEN_INFORMATION Buffer
2899);
2900
2901NTKERNELAPI
2902PDEVICE_OBJECT
2903NTAPI
2904IoGetAttachedDevice (
2905 IN PDEVICE_OBJECT DeviceObject
2906);
2907
2908NTKERNELAPI
2909PDEVICE_OBJECT
2910NTAPI
2911IoGetBaseFileSystemDeviceObject (
2912 IN PFILE_OBJECT FileObject
2913);
2914
2915NTKERNELAPI
2916PEPROCESS
2917NTAPI
2918IoGetRequestorProcess (
2919 IN PIRP Irp
2920);
2921
2922#if (VER_PRODUCTBUILD >= 2195)
2923
2924NTKERNELAPI
2925ULONG
2926NTAPI
2927IoGetRequestorProcessId (
2928 IN PIRP Irp
2929);
2930
2931#endif /* (VER_PRODUCTBUILD >= 2195) */
2932
2933NTKERNELAPI
2934PIRP
2935NTAPI
2936IoGetTopLevelIrp (
2937 VOID
2938);
2939
2940#define IoIsFileOpenedExclusively(FileObject) ( \
2941 (BOOLEAN) !( \
2942 (FileObject)->SharedRead || \
2943 (FileObject)->SharedWrite || \
2944 (FileObject)->SharedDelete \
2945 ) \
2946)
2947
2948NTKERNELAPI
2949BOOLEAN
2950NTAPI
2951IoIsOperationSynchronous (
2952 IN PIRP Irp
2953);
2954
2955NTKERNELAPI
2956BOOLEAN
2957NTAPI
2958IoIsSystemThread (
2959 IN PETHREAD Thread
2960);
2961
2962#if (VER_PRODUCTBUILD >= 2195)
2963
2964NTKERNELAPI
2965BOOLEAN
2966NTAPI
2967IoIsValidNameGraftingBuffer (
2968 IN PIRP Irp,
2969 IN PREPARSE_DATA_BUFFER ReparseBuffer
2970);
2971
2972#endif /* (VER_PRODUCTBUILD >= 2195) */
2973
2974NTKERNELAPI
2975NTSTATUS
2976NTAPI
2977IoPageRead (
2978 IN PFILE_OBJECT FileObject,
2979 IN PMDL Mdl,
2980 IN PLARGE_INTEGER Offset,
2981 IN PKEVENT Event,
2982 OUT PIO_STATUS_BLOCK IoStatusBlock
2983);
2984
2985NTKERNELAPI
2986NTSTATUS
2987NTAPI
2988IoQueryFileInformation (
2989 IN PFILE_OBJECT FileObject,
2990 IN FILE_INFORMATION_CLASS FileInformationClass,
2991 IN ULONG Length,
2992 OUT PVOID FileInformation,
2993 OUT PULONG ReturnedLength
2994);
2995
2996NTKERNELAPI
2997NTSTATUS
2998NTAPI
2999IoQueryVolumeInformation (
3000 IN PFILE_OBJECT FileObject,
3001 IN FS_INFORMATION_CLASS FsInformationClass,
3002 IN ULONG Length,
3003 OUT PVOID FsInformation,
3004 OUT PULONG ReturnedLength
3005);
3006
3007NTKERNELAPI
3008VOID
3009NTAPI
3010IoRegisterFileSystem (
3011 IN OUT PDEVICE_OBJECT DeviceObject
3012);
3013
3014#if (VER_PRODUCTBUILD >= 1381)
3015
3016typedef VOID (NTAPI *PDRIVER_FS_NOTIFICATION) (
3017 IN PDEVICE_OBJECT DeviceObject,
3018 IN BOOLEAN DriverActive
3019);
3020
3021NTKERNELAPI
3022NTSTATUS
3023NTAPI
3024IoRegisterFsRegistrationChange (
3025 IN PDRIVER_OBJECT DriverObject,
3026 IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
3027);
3028
3029#endif /* (VER_PRODUCTBUILD >= 1381) */
3030
3031NTKERNELAPI
3032VOID
3033NTAPI
3034IoReleaseVpbSpinLock (
3035 IN KIRQL Irql
3036);
3037
3038NTKERNELAPI
3039VOID
3040NTAPI
3041IoSetDeviceToVerify (
3042 IN PETHREAD Thread,
3043 IN PDEVICE_OBJECT DeviceObject
3044);
3045
3046NTKERNELAPI
3047NTSTATUS
3048NTAPI
3049IoSetInformation (
3050 IN PFILE_OBJECT FileObject,
3051 IN FILE_INFORMATION_CLASS FileInformationClass,
3052 IN ULONG Length,
3053 IN PVOID FileInformation
3054);
3055
3056NTKERNELAPI
3057VOID
3058NTAPI
3059IoSetTopLevelIrp (
3060 IN PIRP Irp
3061);
3062
3063NTKERNELAPI
3064NTSTATUS
3065NTAPI
3066IoSynchronousPageWrite (
3067 IN PFILE_OBJECT FileObject,
3068 IN PMDL Mdl,
3069 IN PLARGE_INTEGER FileOffset,
3070 IN PKEVENT Event,
3071 OUT PIO_STATUS_BLOCK IoStatusBlock
3072);
3073
3074NTKERNELAPI
3075PEPROCESS
3076NTAPI
3077IoThreadToProcess (
3078 IN PETHREAD Thread
3079);
3080
3081NTKERNELAPI
3082VOID
3083NTAPI
3084IoUnregisterFileSystem (
3085 IN OUT PDEVICE_OBJECT DeviceObject
3086);
3087
3088#if (VER_PRODUCTBUILD >= 1381)
3089
3090NTKERNELAPI
3091NTSTATUS
3092NTAPI
3093IoUnregisterFsRegistrationChange (
3094 IN PDRIVER_OBJECT DriverObject,
3095 IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
3096);
3097
3098#endif /* (VER_PRODUCTBUILD >= 1381) */
3099
3100NTKERNELAPI
3101NTSTATUS
3102NTAPI
3103IoVerifyVolume (
3104 IN PDEVICE_OBJECT DeviceObject,
3105 IN BOOLEAN AllowRawMount
3106);
3107
3108NTKERNELAPI
3109VOID
3110NTAPI
3111KeAttachProcess (
3112 IN PEPROCESS Process
3113);
3114
3115NTKERNELAPI
3116VOID
3117NTAPI
3118KeDetachProcess (
3119 VOID
3120);
3121
3122NTKERNELAPI
3123VOID
3124NTAPI
3125KeInitializeQueue (
3126 IN PRKQUEUE Queue,
3127 IN ULONG Count OPTIONAL
3128);
3129
3130NTKERNELAPI
3131LONG
3132NTAPI
3133KeInsertHeadQueue (
3134 IN PRKQUEUE Queue,
3135 IN PLIST_ENTRY Entry
3136);
3137
3138NTKERNELAPI
3139LONG
3140NTAPI
3141KeInsertQueue (
3142 IN PRKQUEUE Queue,
3143 IN PLIST_ENTRY Entry
3144);
3145
3146NTKERNELAPI
3147BOOLEAN
3148NTAPI
3149KeInsertQueueApc (
3150 IN PKAPC Apc,
3151 IN PVOID SystemArgument1,
3152 IN PVOID SystemArgument2,
3153 IN KPRIORITY PriorityBoost
3154);
3155
3156NTKERNELAPI
3157LONG
3158NTAPI
3159KeReadStateQueue (
3160 IN PRKQUEUE Queue
3161);
3162
3163NTKERNELAPI
3164PLIST_ENTRY
3165NTAPI
3166KeRemoveQueue (
3167 IN PRKQUEUE Queue,
3168 IN KPROCESSOR_MODE WaitMode,
3169 IN PLARGE_INTEGER Timeout OPTIONAL
3170);
3171
3172NTKERNELAPI
3173PLIST_ENTRY
3174NTAPI
3175KeRundownQueue (
3176 IN PRKQUEUE Queue
3177);
3178
3179#if (VER_PRODUCTBUILD >= 2195)
3180
3181NTKERNELAPI
3182VOID
3183NTAPI
3184KeStackAttachProcess (
3185 IN PKPROCESS Process,
3186 OUT PKAPC_STATE ApcState
3187);
3188
3189NTKERNELAPI
3190VOID
3191NTAPI
3192KeUnstackDetachProcess (
3193 IN PKAPC_STATE ApcState
3194);
3195
3196#endif /* (VER_PRODUCTBUILD >= 2195) */
3197
3198NTKERNELAPI
3199BOOLEAN
3200NTAPI
3201MmCanFileBeTruncated (
3202 IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
3203 IN PLARGE_INTEGER NewFileSize
3204);
3205
3206NTKERNELAPI
3207BOOLEAN
3208NTAPI
3209MmFlushImageSection (
3210 IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
3211 IN MMFLUSH_TYPE FlushType
3212);
3213
3214NTKERNELAPI
3215BOOLEAN
3216NTAPI
3217MmForceSectionClosed (
3218 IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
3219 IN BOOLEAN DelayClose
3220);
3221
3222#if (VER_PRODUCTBUILD >= 1381)
3223
3224NTKERNELAPI
3225BOOLEAN
3226NTAPI
3227MmIsRecursiveIoFault (
3228 VOID
3229);
3230
3231#else
3232
3233#define MmIsRecursiveIoFault() ( \
3234 (PsGetCurrentThread()->DisablePageFaultClustering) | \
3235 (PsGetCurrentThread()->ForwardClusterOnly) \
3236)
3237
3238#endif
3239
3240NTKERNELAPI
3241NTSTATUS
3242NTAPI
3243MmMapViewOfSection (
3244 IN PVOID SectionObject,
3245 IN PEPROCESS Process,
3246 IN OUT PVOID *BaseAddress,
3247 IN ULONG ZeroBits,
3248 IN ULONG CommitSize,
3249 IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,
3250 IN OUT PULONG ViewSize,
3251 IN SECTION_INHERIT InheritDisposition,
3252 IN ULONG AllocationType,
3253 IN ULONG Protect
3254);
3255
3256NTKERNELAPI
3257BOOLEAN
3258NTAPI
3259MmSetAddressRangeModified (
3260 IN PVOID Address,
3261 IN ULONG Length
3262);
3263
3264NTKERNELAPI
3265NTSTATUS
3266NTAPI
3267ObCreateObject (
3268 IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL,
3269 IN POBJECT_TYPE ObjectType,
3270 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
3271 IN KPROCESSOR_MODE AccessMode,
3272 IN OUT PVOID ParseContext OPTIONAL,
3273 IN ULONG ObjectSize,
3274 IN ULONG PagedPoolCharge OPTIONAL,
3275 IN ULONG NonPagedPoolCharge OPTIONAL,
3276 OUT PVOID *Object
3277);
3278
3279NTKERNELAPI
3280ULONG
3281NTAPI
3282ObGetObjectPointerCount (
3283 IN PVOID Object
3284);
3285
3286NTKERNELAPI
3287NTSTATUS
3288NTAPI
3289ObInsertObject (
3290 IN PVOID Object,
3291 IN PACCESS_STATE PassedAccessState OPTIONAL,
3292 IN ACCESS_MASK DesiredAccess,
3293 IN ULONG AdditionalReferences,
3294 OUT PVOID *ReferencedObject OPTIONAL,
3295 OUT PHANDLE Handle
3296);
3297
3298NTKERNELAPI
3299VOID
3300NTAPI
3301ObMakeTemporaryObject (
3302 IN PVOID Object
3303);
3304
3305NTKERNELAPI
3306NTSTATUS
3307NTAPI
3308ObOpenObjectByPointer (
3309 IN PVOID Object,
3310 IN ULONG HandleAttributes,
3311 IN PACCESS_STATE PassedAccessState OPTIONAL,
3312 IN ACCESS_MASK DesiredAccess OPTIONAL,
3313 IN POBJECT_TYPE ObjectType OPTIONAL,
3314 IN KPROCESSOR_MODE AccessMode,
3315 OUT PHANDLE Handle
3316);
3317
3318NTKERNELAPI
3319NTSTATUS
3320NTAPI
3321ObQueryNameString (
3322 IN PVOID Object,
3323 OUT POBJECT_NAME_INFORMATION ObjectNameInfo,
3324 IN ULONG Length,
3325 OUT PULONG ReturnLength
3326);
3327
3328NTKERNELAPI
3329NTSTATUS
3330NTAPI
3331ObQueryObjectAuditingByHandle (
3332 IN HANDLE Handle,
3333 OUT PBOOLEAN GenerateOnClose
3334);
3335
3336NTKERNELAPI
3337NTSTATUS
3338NTAPI
3339ObReferenceObjectByName (
3340 IN PUNICODE_STRING ObjectName,
3341 IN ULONG Attributes,
3342 IN PACCESS_STATE PassedAccessState OPTIONAL,
3343 IN ACCESS_MASK DesiredAccess OPTIONAL,
3344 IN POBJECT_TYPE ObjectType,
3345 IN KPROCESSOR_MODE AccessMode,
3346 IN OUT PVOID ParseContext OPTIONAL,
3347 OUT PVOID *Object
3348);
3349
3350NTKERNELAPI
3351VOID
3352NTAPI
3353PsChargePoolQuota (
3354 IN PEPROCESS Process,
3355 IN POOL_TYPE PoolType,
3356 IN ULONG Amount
3357);
3358
3359#define PsDereferenceImpersonationToken(T) \
3360 {if (ARGUMENT_PRESENT(T)) { \
3361 (ObDereferenceObject((T))); \
3362 } else { \
3363 ; \
3364 } \
3365}
3366
3367#define PsDereferencePrimaryToken(T) (ObDereferenceObject((T)))
3368
3369NTKERNELAPI
3370ULONGLONG
3371NTAPI
3372PsGetProcessExitTime (
3373 VOID
3374);
3375
3376NTKERNELAPI
3377BOOLEAN
3378NTAPI
3379PsIsThreadTerminating (
3380 IN PETHREAD Thread
3381);
3382
3383NTKERNELAPI
3384NTSTATUS
3385NTAPI
3386PsLookupProcessByProcessId (
3387 IN PVOID ProcessId,
3388 OUT PEPROCESS *Process
3389);
3390
3391NTKERNELAPI
3392NTSTATUS
3393NTAPI
3394PsLookupProcessThreadByCid (
3395 IN PCLIENT_ID Cid,
3396 OUT PEPROCESS *Process OPTIONAL,
3397 OUT PETHREAD *Thread
3398);
3399
3400NTKERNELAPI
3401NTSTATUS
3402NTAPI
3403PsLookupThreadByThreadId (
3404 IN PVOID UniqueThreadId,
3405 OUT PETHREAD *Thread
3406);
3407
3408NTKERNELAPI
3409PACCESS_TOKEN
3410NTAPI
3411PsReferenceImpersonationToken (
3412 IN PETHREAD Thread,
3413 OUT PBOOLEAN CopyOnUse,
3414 OUT PBOOLEAN EffectiveOnly,
3415 OUT PSECURITY_IMPERSONATION_LEVEL Level
3416);
3417
3418NTKERNELAPI
3419HANDLE
3420NTAPI
3421PsReferencePrimaryToken (
3422 IN PEPROCESS Process
3423);
3424
3425NTKERNELAPI
3426VOID
3427NTAPI
3428PsReturnPoolQuota (
3429 IN PEPROCESS Process,
3430 IN POOL_TYPE PoolType,
3431 IN ULONG Amount
3432);
3433
3434NTKERNELAPI
3435VOID
3436NTAPI
3437PsRevertToSelf (
3438 VOID
3439);
3440
3441NTSYSAPI
3442NTSTATUS
3443NTAPI
3444RtlAbsoluteToSelfRelativeSD (
3445 IN PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor,
3446 IN OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor,
3447 IN PULONG BufferLength
3448);
3449
3450NTSYSAPI
3451PVOID
3452NTAPI
3453RtlAllocateHeap (
3454 IN HANDLE HeapHandle,
3455 IN ULONG Flags,
3456 IN ULONG Size
3457);
3458
3459NTSYSAPI
3460NTSTATUS
3461NTAPI
3462RtlCompressBuffer (
3463 IN USHORT CompressionFormatAndEngine,
3464 IN PUCHAR UncompressedBuffer,
3465 IN ULONG UncompressedBufferSize,
3466 OUT PUCHAR CompressedBuffer,
3467 IN ULONG CompressedBufferSize,
3468 IN ULONG UncompressedChunkSize,
3469 OUT PULONG FinalCompressedSize,
3470 IN PVOID WorkSpace
3471);
3472
3473NTSYSAPI
3474NTSTATUS
3475NTAPI
3476RtlCompressChunks (
3477 IN PUCHAR UncompressedBuffer,
3478 IN ULONG UncompressedBufferSize,
3479 OUT PUCHAR CompressedBuffer,
3480 IN ULONG CompressedBufferSize,
3481 IN OUT PCOMPRESSED_DATA_INFO CompressedDataInfo,
3482 IN ULONG CompressedDataInfoLength,
3483 IN PVOID WorkSpace
3484);
3485
3486NTSYSAPI
3487NTSTATUS
3488NTAPI
3489RtlConvertSidToUnicodeString (
3490 OUT PUNICODE_STRING DestinationString,
3491 IN PSID Sid,
3492 IN BOOLEAN AllocateDestinationString
3493);
3494
3495NTSYSAPI
3496NTSTATUS
3497NTAPI
3498RtlCopySid (
3499 IN ULONG Length,
3500 IN PSID Destination,
3501 IN PSID Source
3502);
3503
3504NTSYSAPI
3505NTSTATUS
3506NTAPI
3507RtlDecompressBuffer (
3508 IN USHORT CompressionFormat,
3509 OUT PUCHAR UncompressedBuffer,
3510 IN ULONG UncompressedBufferSize,
3511 IN PUCHAR CompressedBuffer,
3512 IN ULONG CompressedBufferSize,
3513 OUT PULONG FinalUncompressedSize
3514);
3515
3516NTSYSAPI
3517NTSTATUS
3518NTAPI
3519RtlDecompressChunks (
3520 OUT PUCHAR UncompressedBuffer,
3521 IN ULONG UncompressedBufferSize,
3522 IN PUCHAR CompressedBuffer,
3523 IN ULONG CompressedBufferSize,
3524 IN PUCHAR CompressedTail,
3525 IN ULONG CompressedTailSize,
3526 IN PCOMPRESSED_DATA_INFO CompressedDataInfo
3527);
3528
3529NTSYSAPI
3530NTSTATUS
3531NTAPI
3532RtlDecompressFragment (
3533 IN USHORT CompressionFormat,
3534 OUT PUCHAR UncompressedFragment,
3535 IN ULONG UncompressedFragmentSize,
3536 IN PUCHAR CompressedBuffer,
3537 IN ULONG CompressedBufferSize,
3538 IN ULONG FragmentOffset,
3539 OUT PULONG FinalUncompressedSize,
3540 IN PVOID WorkSpace
3541);
3542
3543NTSYSAPI
3544NTSTATUS
3545NTAPI
3546RtlDescribeChunk (
3547 IN USHORT CompressionFormat,
3548 IN OUT PUCHAR *CompressedBuffer,
3549 IN PUCHAR EndOfCompressedBufferPlus1,
3550 OUT PUCHAR *ChunkBuffer,
3551 OUT PULONG ChunkSize
3552);
3553
3554NTSYSAPI
3555BOOLEAN
3556NTAPI
3557RtlEqualSid (
3558 IN PSID Sid1,
3559 IN PSID Sid2
3560);
3561
3562NTSYSAPI
3563VOID
3564NTAPI
3565RtlFillMemoryUlong (
3566 IN PVOID Destination,
3567 IN ULONG Length,
3568 IN ULONG Fill
3569);
3570
3571NTSYSAPI
3572BOOLEAN
3573NTAPI
3574RtlFreeHeap (
3575 IN HANDLE HeapHandle,
3576 IN ULONG Flags,
3577 IN PVOID P
3578);
3579
3580NTSYSAPI
3581VOID
3582NTAPI
3583RtlGenerate8dot3Name (
3584 IN PUNICODE_STRING Name,
3585 IN BOOLEAN AllowExtendedCharacters,
3586 IN OUT PGENERATE_NAME_CONTEXT Context,
3587 OUT PUNICODE_STRING Name8dot3
3588);
3589
3590NTSYSAPI
3591NTSTATUS
3592NTAPI
3593RtlGetCompressionWorkSpaceSize (
3594 IN USHORT CompressionFormatAndEngine,
3595 OUT PULONG CompressBufferWorkSpaceSize,
3596 OUT PULONG CompressFragmentWorkSpaceSize
3597);
3598
3599NTSYSAPI
3600NTSTATUS
3601NTAPI
3602RtlGetDaclSecurityDescriptor (
3603 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3604 OUT PBOOLEAN DaclPresent,
3605 OUT PACL *Dacl,
3606 OUT PBOOLEAN DaclDefaulted
3607);
3608
3609NTSYSAPI
3610NTSTATUS
3611NTAPI
3612RtlGetGroupSecurityDescriptor (
3613 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3614 OUT PSID *Group,
3615 OUT PBOOLEAN GroupDefaulted
3616);
3617
3618NTSYSAPI
3619NTSTATUS
3620NTAPI
3621RtlGetOwnerSecurityDescriptor (
3622 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3623 OUT PSID *Owner,
3624 OUT PBOOLEAN OwnerDefaulted
3625);
3626
3627NTSYSAPI
3628NTSTATUS
3629NTAPI
3630RtlInitializeSid (
3631 IN OUT PSID Sid,
3632 IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,
3633 IN UCHAR SubAuthorityCount
3634);
3635
3636NTSYSAPI
3637BOOLEAN
3638NTAPI
3639RtlIsNameLegalDOS8Dot3 (
3640 IN PUNICODE_STRING UnicodeName,
3641 IN PANSI_STRING AnsiName,
3642 PBOOLEAN Unknown
3643);
3644
3645NTSYSAPI
3646ULONG
3647NTAPI
3648RtlLengthRequiredSid (
3649 IN UCHAR SubAuthorityCount
3650);
3651
3652NTSYSAPI
3653ULONG
3654NTAPI
3655RtlLengthSid (
3656 IN PSID Sid
3657);
3658
3659NTSYSAPI
3660ULONG
3661NTAPI
3662RtlNtStatusToDosError (
3663 IN NTSTATUS Status
3664);
3665
3666NTSYSAPI
3667NTSTATUS
3668NTAPI
3669RtlReserveChunk (
3670 IN USHORT CompressionFormat,
3671 IN OUT PUCHAR *CompressedBuffer,
3672 IN PUCHAR EndOfCompressedBufferPlus1,
3673 OUT PUCHAR *ChunkBuffer,
3674 IN ULONG ChunkSize
3675);
3676
3677NTSYSAPI
3678VOID
3679NTAPI
3680RtlSecondsSince1970ToTime (
3681 IN ULONG SecondsSince1970,
3682 OUT PLARGE_INTEGER Time
3683);
3684
3685#if (VER_PRODUCTBUILD >= 2195)
3686
3687NTSYSAPI
3688NTSTATUS
3689NTAPI
3690RtlSelfRelativeToAbsoluteSD (
3691 IN PSECURITY_DESCRIPTOR SelfRelativeSD,
3692 OUT PSECURITY_DESCRIPTOR AbsoluteSD,
3693 IN PULONG AbsoluteSDSize,
3694 IN PACL Dacl,
3695 IN PULONG DaclSize,
3696 IN PACL Sacl,
3697 IN PULONG SaclSize,
3698 IN PSID Owner,
3699 IN PULONG OwnerSize,
3700 IN PSID PrimaryGroup,
3701 IN PULONG PrimaryGroupSize
3702);
3703
3704#endif /* (VER_PRODUCTBUILD >= 2195) */
3705
3706NTSYSAPI
3707NTSTATUS
3708NTAPI
3709RtlSetGroupSecurityDescriptor (
3710 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
3711 IN PSID Group,
3712 IN BOOLEAN GroupDefaulted
3713);
3714
3715NTSYSAPI
3716NTSTATUS
3717NTAPI
3718RtlSetOwnerSecurityDescriptor (
3719 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
3720 IN PSID Owner,
3721 IN BOOLEAN OwnerDefaulted
3722);
3723
3724NTSYSAPI
3725NTSTATUS
3726NTAPI
3727RtlSetSaclSecurityDescriptor (
3728 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
3729 IN BOOLEAN SaclPresent,
3730 IN PACL Sacl,
3731 IN BOOLEAN SaclDefaulted
3732);
3733
3734NTSYSAPI
3735PUCHAR
3736NTAPI
3737RtlSubAuthorityCountSid (
3738 IN PSID Sid
3739);
3740
3741NTSYSAPI
3742PULONG
3743NTAPI
3744RtlSubAuthoritySid (
3745 IN PSID Sid,
3746 IN ULONG SubAuthority
3747);
3748
3749NTSYSAPI
3750BOOLEAN
3751NTAPI
3752RtlValidSid (
3753 IN PSID Sid
3754);
3755
3756NTKERNELAPI
3757NTSTATUS
3758NTAPI
3759SeAppendPrivileges (
3760 PACCESS_STATE AccessState,
3761 PPRIVILEGE_SET Privileges
3762);
3763
3764NTKERNELAPI
3765BOOLEAN
3766NTAPI
3767SeAuditingFileEvents (
3768 IN BOOLEAN AccessGranted,
3769 IN PSECURITY_DESCRIPTOR SecurityDescriptor
3770);
3771
3772NTKERNELAPI
3773BOOLEAN
3774NTAPI
3775SeAuditingFileOrGlobalEvents (
3776 IN BOOLEAN AccessGranted,
3777 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3778 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
3779);
3780
3781NTKERNELAPI
3782VOID
3783NTAPI
3784SeCaptureSubjectContext (
3785 OUT PSECURITY_SUBJECT_CONTEXT SubjectContext
3786);
3787
3788NTKERNELAPI
3789NTSTATUS
3790NTAPI
3791SeCreateAccessState (
3792 OUT PACCESS_STATE AccessState,
3793 IN PVOID AuxData,
3794 IN ACCESS_MASK AccessMask,
3795 IN PGENERIC_MAPPING Mapping
3796);
3797
3798NTKERNELAPI
3799NTSTATUS
3800NTAPI
3801SeCreateClientSecurity (
3802 IN PETHREAD Thread,
3803 IN PSECURITY_QUALITY_OF_SERVICE QualityOfService,
3804 IN BOOLEAN RemoteClient,
3805 OUT PSECURITY_CLIENT_CONTEXT ClientContext
3806);
3807
3808#if (VER_PRODUCTBUILD >= 2195)
3809
3810NTKERNELAPI
3811NTSTATUS
3812NTAPI
3813SeCreateClientSecurityFromSubjectContext (
3814 IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
3815 IN PSECURITY_QUALITY_OF_SERVICE QualityOfService,
3816 IN BOOLEAN ServerIsRemote,
3817 OUT PSECURITY_CLIENT_CONTEXT ClientContext
3818);
3819
3820#endif /* (VER_PRODUCTBUILD >= 2195) */
3821
3822#define SeDeleteClientSecurity(C) { \
3823 if (SeTokenType((C)->ClientToken) == TokenPrimary) { \
3824 PsDereferencePrimaryToken( (C)->ClientToken ); \
3825 } else { \
3826 PsDereferenceImpersonationToken( (C)->ClientToken ); \
3827 } \
3828}
3829
3830NTKERNELAPI
3831VOID
3832NTAPI
3833SeDeleteObjectAuditAlarm (
3834 IN PVOID Object,
3835 IN HANDLE Handle
3836);
3837
3838#define SeEnableAccessToExports() SeExports = *(PSE_EXPORTS *)SeExports;
3839
3840NTKERNELAPI
3841VOID
3842NTAPI
3843SeFreePrivileges (
3844 IN PPRIVILEGE_SET Privileges
3845);
3846
3847NTKERNELAPI
3848VOID
3849NTAPI
3850SeImpersonateClient (
3851 IN PSECURITY_CLIENT_CONTEXT ClientContext,
3852 IN PETHREAD ServerThread OPTIONAL
3853);
3854
3855#if (VER_PRODUCTBUILD >= 2195)
3856
3857NTKERNELAPI
3858NTSTATUS
3859NTAPI
3860SeImpersonateClientEx (
3861 IN PSECURITY_CLIENT_CONTEXT ClientContext,
3862 IN PETHREAD ServerThread OPTIONAL
3863);
3864
3865#endif /* (VER_PRODUCTBUILD >= 2195) */
3866
3867NTKERNELAPI
3868VOID
3869NTAPI
3870SeLockSubjectContext (
3871 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
3872);
3873
3874NTKERNELAPI
3875NTSTATUS
3876NTAPI
3877SeMarkLogonSessionForTerminationNotification (
3878 IN PLUID LogonId
3879);
3880
3881NTKERNELAPI
3882VOID
3883NTAPI
3884SeOpenObjectAuditAlarm (
3885 IN PUNICODE_STRING ObjectTypeName,
3886 IN PVOID Object OPTIONAL,
3887 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
3888 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3889 IN PACCESS_STATE AccessState,
3890 IN BOOLEAN ObjectCreated,
3891 IN BOOLEAN AccessGranted,
3892 IN KPROCESSOR_MODE AccessMode,
3893 OUT PBOOLEAN GenerateOnClose
3894);
3895
3896NTKERNELAPI
3897VOID
3898NTAPI
3899SeOpenObjectForDeleteAuditAlarm (
3900 IN PUNICODE_STRING ObjectTypeName,
3901 IN PVOID Object OPTIONAL,
3902 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
3903 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3904 IN PACCESS_STATE AccessState,
3905 IN BOOLEAN ObjectCreated,
3906 IN BOOLEAN AccessGranted,
3907 IN KPROCESSOR_MODE AccessMode,
3908 OUT PBOOLEAN GenerateOnClose
3909);
3910
3911NTKERNELAPI
3912BOOLEAN
3913NTAPI
3914SePrivilegeCheck (
3915 IN OUT PPRIVILEGE_SET RequiredPrivileges,
3916 IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
3917 IN KPROCESSOR_MODE AccessMode
3918);
3919
3920NTKERNELAPI
3921NTSTATUS
3922NTAPI
3923SeQueryAuthenticationIdToken (
3924 IN PACCESS_TOKEN Token,
3925 OUT PLUID LogonId
3926);
3927
3928#if (VER_PRODUCTBUILD >= 2195)
3929
3930NTKERNELAPI
3931NTSTATUS
3932NTAPI
3933SeQueryInformationToken (
3934 IN PACCESS_TOKEN Token,
3935 IN TOKEN_INFORMATION_CLASS TokenInformationClass,
3936 OUT PVOID *TokenInformation
3937);
3938
3939#endif /* (VER_PRODUCTBUILD >= 2195) */
3940
3941NTKERNELAPI
3942NTSTATUS
3943NTAPI
3944SeQuerySecurityDescriptorInfo (
3945 IN PSECURITY_INFORMATION SecurityInformation,
3946 OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
3947 IN OUT PULONG Length,
3948 IN PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor
3949);
3950
3951#if (VER_PRODUCTBUILD >= 2195)
3952
3953NTKERNELAPI
3954NTSTATUS
3955NTAPI
3956SeQuerySessionIdToken (
3957 IN PACCESS_TOKEN Token,
3958 IN PULONG SessionId
3959);
3960
3961#endif /* (VER_PRODUCTBUILD >= 2195) */
3962
3963#define SeQuerySubjectContextToken( SubjectContext ) \
3964 ( ARGUMENT_PRESENT( \
3965 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken \
3966 ) ? \
3967 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken : \
3968 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
3969
3970typedef NTSTATUS (*PSE_LOGON_SESSION_TERMINATED_ROUTINE) (
3971 IN PLUID LogonId
3972);
3973
3974NTKERNELAPI
3975NTSTATUS
3976NTAPI
3977SeRegisterLogonSessionTerminatedRoutine (
3978 IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
3979);
3980
3981NTKERNELAPI
3982VOID
3983NTAPI
3984SeReleaseSubjectContext (
3985 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
3986);
3987
3988NTKERNELAPI
3989VOID
3990NTAPI
3991SeSetAccessStateGenericMapping (
3992 PACCESS_STATE AccessState,
3993 PGENERIC_MAPPING GenericMapping
3994);
3995
3996NTKERNELAPI
3997NTSTATUS
3998NTAPI
3999SeSetSecurityDescriptorInfo (
4000 IN PVOID Object OPTIONAL,
4001 IN PSECURITY_INFORMATION SecurityInformation,
4002 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
4003 IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
4004 IN POOL_TYPE PoolType,
4005 IN PGENERIC_MAPPING GenericMapping
4006);
4007
4008#if (VER_PRODUCTBUILD >= 2195)
4009
4010NTKERNELAPI
4011NTSTATUS
4012NTAPI
4013SeSetSecurityDescriptorInfoEx (
4014 IN PVOID Object OPTIONAL,
4015 IN PSECURITY_INFORMATION SecurityInformation,
4016 IN PSECURITY_DESCRIPTOR ModificationDescriptor,
4017 IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
4018 IN ULONG AutoInheritFlags,
4019 IN POOL_TYPE PoolType,
4020 IN PGENERIC_MAPPING GenericMapping
4021);
4022
4023NTKERNELAPI
4024BOOLEAN
4025NTAPI
4026SeTokenIsAdmin (
4027 IN PACCESS_TOKEN Token
4028);
4029
4030NTKERNELAPI
4031BOOLEAN
4032NTAPI
4033SeTokenIsRestricted (
4034 IN PACCESS_TOKEN Token
4035);
4036
4037#endif /* (VER_PRODUCTBUILD >= 2195) */
4038
4039NTKERNELAPI
4040TOKEN_TYPE
4041NTAPI
4042SeTokenType (
4043 IN PACCESS_TOKEN Token
4044);
4045
4046NTKERNELAPI
4047VOID
4048NTAPI
4049SeUnlockSubjectContext (
4050 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4051);
4052
4053NTKERNELAPI
4054NTSTATUS
4055SeUnregisterLogonSessionTerminatedRoutine (
4056 IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
4057);
4058
4059#if (VER_PRODUCTBUILD >= 2195)
4060
4061NTSYSAPI
4062NTSTATUS
4063NTAPI
4064ZwAdjustPrivilegesToken (
4065 IN HANDLE TokenHandle,
4066 IN BOOLEAN DisableAllPrivileges,
4067 IN PTOKEN_PRIVILEGES NewState,
4068 IN ULONG BufferLength,
4069 OUT PTOKEN_PRIVILEGES PreviousState OPTIONAL,
4070 OUT PULONG ReturnLength
4071);
4072
4073#endif /* (VER_PRODUCTBUILD >= 2195) */
4074
4075NTSYSAPI
4076NTSTATUS
4077NTAPI
4078ZwAlertThread (
4079 IN HANDLE ThreadHandle
4080);
4081
4082NTSYSAPI
4083NTSTATUS
4084NTAPI
4085ZwAllocateVirtualMemory (
4086 IN HANDLE ProcessHandle,
4087 IN OUT PVOID *BaseAddress,
4088 IN ULONG ZeroBits,
4089 IN OUT PULONG RegionSize,
4090 IN ULONG AllocationType,
4091 IN ULONG Protect
4092);
4093
4094NTSYSAPI
4095NTSTATUS
4096NTAPI
4097ZwAccessCheckAndAuditAlarm (
4098 IN PUNICODE_STRING SubsystemName,
4099 IN PVOID HandleId,
4100 IN PUNICODE_STRING ObjectTypeName,
4101 IN PUNICODE_STRING ObjectName,
4102 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
4103 IN ACCESS_MASK DesiredAccess,
4104 IN PGENERIC_MAPPING GenericMapping,
4105 IN BOOLEAN ObjectCreation,
4106 OUT PACCESS_MASK GrantedAccess,
4107 OUT PBOOLEAN AccessStatus,
4108 OUT PBOOLEAN GenerateOnClose
4109);
4110
4111#if (VER_PRODUCTBUILD >= 2195)
4112
4113NTSYSAPI
4114NTSTATUS
4115NTAPI
4116ZwCancelIoFile (
4117 IN HANDLE FileHandle,
4118 OUT PIO_STATUS_BLOCK IoStatusBlock
4119);
4120
4121#endif /* (VER_PRODUCTBUILD >= 2195) */
4122
4123NTSYSAPI
4124NTSTATUS
4125NTAPI
4126ZwClearEvent (
4127 IN HANDLE EventHandle
4128);
4129
4130NTSYSAPI
4131NTSTATUS
4132NTAPI
4133ZwCloseObjectAuditAlarm (
4134 IN PUNICODE_STRING SubsystemName,
4135 IN PVOID HandleId,
4136 IN BOOLEAN GenerateOnClose
4137);
4138
4139NTSYSAPI
4140NTSTATUS
4141NTAPI
4142ZwCreateSection (
4143 OUT PHANDLE SectionHandle,
4144 IN ACCESS_MASK DesiredAccess,
4145 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
4146 IN PLARGE_INTEGER MaximumSize OPTIONAL,
4147 IN ULONG SectionPageProtection,
4148 IN ULONG AllocationAttributes,
4149 IN HANDLE FileHandle OPTIONAL
4150);
4151
4152NTSYSAPI
4153NTSTATUS
4154NTAPI
4155ZwCreateSymbolicLinkObject (
4156 OUT PHANDLE SymbolicLinkHandle,
4157 IN ACCESS_MASK DesiredAccess,
4158 IN POBJECT_ATTRIBUTES ObjectAttributes,
4159 IN PUNICODE_STRING TargetName
4160);
4161
4162NTSYSAPI
4163NTSTATUS
4164NTAPI
4165ZwDeleteFile (
4166 IN POBJECT_ATTRIBUTES ObjectAttributes
4167);
4168
4169NTSYSAPI
4170NTSTATUS
4171NTAPI
4172ZwDeleteValueKey (
4173 IN HANDLE Handle,
4174 IN PUNICODE_STRING Name
4175);
4176
4177NTSYSAPI
4178NTSTATUS
4179NTAPI
4180ZwDeviceIoControlFile (
4181 IN HANDLE FileHandle,
4182 IN HANDLE Event OPTIONAL,
4183 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4184 IN PVOID ApcContext OPTIONAL,
4185 OUT PIO_STATUS_BLOCK IoStatusBlock,
4186 IN ULONG IoControlCode,
4187 IN PVOID InputBuffer OPTIONAL,
4188 IN ULONG InputBufferLength,
4189 OUT PVOID OutputBuffer OPTIONAL,
4190 IN ULONG OutputBufferLength
4191);
4192
4193NTSYSAPI
4194NTSTATUS
4195NTAPI
4196ZwDisplayString (
4197 IN PUNICODE_STRING String
4198);
4199
4200NTSYSAPI
4201NTSTATUS
4202NTAPI
4203ZwDuplicateObject (
4204 IN HANDLE SourceProcessHandle,
4205 IN HANDLE SourceHandle,
4206 IN HANDLE TargetProcessHandle OPTIONAL,
4207 OUT PHANDLE TargetHandle OPTIONAL,
4208 IN ACCESS_MASK DesiredAccess,
4209 IN ULONG HandleAttributes,
4210 IN ULONG Options
4211);
4212
4213NTSYSAPI
4214NTSTATUS
4215NTAPI
4216ZwDuplicateToken (
4217 IN HANDLE ExistingTokenHandle,
4218 IN ACCESS_MASK DesiredAccess,
4219 IN POBJECT_ATTRIBUTES ObjectAttributes,
4220 IN BOOLEAN EffectiveOnly,
4221 IN TOKEN_TYPE TokenType,
4222 OUT PHANDLE NewTokenHandle
4223);
4224
4225NTSYSAPI
4226NTSTATUS
4227NTAPI
4228ZwFlushInstructionCache (
4229 IN HANDLE ProcessHandle,
4230 IN PVOID BaseAddress OPTIONAL,
4231 IN ULONG FlushSize
4232);
4233
4234#if (VER_PRODUCTBUILD >= 2195)
4235
4236NTSYSAPI
4237NTSTATUS
4238NTAPI
4239ZwFlushVirtualMemory (
4240 IN HANDLE ProcessHandle,
4241 IN OUT PVOID *BaseAddress,
4242 IN OUT PULONG FlushSize,
4243 OUT PIO_STATUS_BLOCK IoStatusBlock
4244);
4245
4246#endif /* (VER_PRODUCTBUILD >= 2195) */
4247
4248NTSYSAPI
4249NTSTATUS
4250NTAPI
4251ZwFreeVirtualMemory (
4252 IN HANDLE ProcessHandle,
4253 IN OUT PVOID *BaseAddress,
4254 IN OUT PULONG RegionSize,
4255 IN ULONG FreeType
4256);
4257
4258NTSYSAPI
4259NTSTATUS
4260NTAPI
4261ZwFsControlFile (
4262 IN HANDLE FileHandle,
4263 IN HANDLE Event OPTIONAL,
4264 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4265 IN PVOID ApcContext OPTIONAL,
4266 OUT PIO_STATUS_BLOCK IoStatusBlock,
4267 IN ULONG FsControlCode,
4268 IN PVOID InputBuffer OPTIONAL,
4269 IN ULONG InputBufferLength,
4270 OUT PVOID OutputBuffer OPTIONAL,
4271 IN ULONG OutputBufferLength
4272);
4273
4274#if (VER_PRODUCTBUILD >= 2195)
4275
4276NTSYSAPI
4277NTSTATUS
4278NTAPI
4279ZwInitiatePowerAction (
4280 IN POWER_ACTION SystemAction,
4281 IN SYSTEM_POWER_STATE MinSystemState,
4282 IN ULONG Flags,
4283 IN BOOLEAN Asynchronous
4284);
4285
4286#endif /* (VER_PRODUCTBUILD >= 2195) */
4287
4288NTSYSAPI
4289NTSTATUS
4290NTAPI
4291ZwLoadDriver (
4292 /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
4293 IN PUNICODE_STRING RegistryPath
4294);
4295
4296NTSYSAPI
4297NTSTATUS
4298NTAPI
4299ZwLoadKey (
4300 IN POBJECT_ATTRIBUTES KeyObjectAttributes,
4301 IN POBJECT_ATTRIBUTES FileObjectAttributes
4302);
4303
4304NTSYSAPI
4305NTSTATUS
4306NTAPI
4307ZwNotifyChangeKey (
4308 IN HANDLE KeyHandle,
4309 IN HANDLE EventHandle OPTIONAL,
4310 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4311 IN PVOID ApcContext OPTIONAL,
4312 OUT PIO_STATUS_BLOCK IoStatusBlock,
4313 IN ULONG NotifyFilter,
4314 IN BOOLEAN WatchSubtree,
4315 IN PVOID Buffer,
4316 IN ULONG BufferLength,
4317 IN BOOLEAN Asynchronous
4318);
4319
4320NTSYSAPI
4321NTSTATUS
4322NTAPI
4323ZwOpenDirectoryObject (
4324 OUT PHANDLE DirectoryHandle,
4325 IN ACCESS_MASK DesiredAccess,
4326 IN POBJECT_ATTRIBUTES ObjectAttributes
4327);
4328
4329NTSYSAPI
4330NTSTATUS
4331NTAPI
4332ZwOpenEvent (
4333 OUT PHANDLE EventHandle,
4334 IN ACCESS_MASK DesiredAccess,
4335 IN POBJECT_ATTRIBUTES ObjectAttributes
4336);
4337
4338NTSYSAPI
4339NTSTATUS
4340NTAPI
4341ZwOpenProcess (
4342 OUT PHANDLE ProcessHandle,
4343 IN ACCESS_MASK DesiredAccess,
4344 IN POBJECT_ATTRIBUTES ObjectAttributes,
4345 IN PCLIENT_ID ClientId OPTIONAL
4346);
4347
4348NTSYSAPI
4349NTSTATUS
4350NTAPI
4351ZwOpenProcessToken (
4352 IN HANDLE ProcessHandle,
4353 IN ACCESS_MASK DesiredAccess,
4354 OUT PHANDLE TokenHandle
4355);
4356
4357NTSYSAPI
4358NTSTATUS
4359NTAPI
4360ZwOpenThread (
4361 OUT PHANDLE ThreadHandle,
4362 IN ACCESS_MASK DesiredAccess,
4363 IN POBJECT_ATTRIBUTES ObjectAttributes,
4364 IN PCLIENT_ID ClientId
4365);
4366
4367NTSYSAPI
4368NTSTATUS
4369NTAPI
4370ZwOpenThreadToken (
4371 IN HANDLE ThreadHandle,
4372 IN ACCESS_MASK DesiredAccess,
4373 IN BOOLEAN OpenAsSelf,
4374 OUT PHANDLE TokenHandle
4375);
4376
4377#if (VER_PRODUCTBUILD >= 2195)
4378
4379NTSYSAPI
4380NTSTATUS
4381NTAPI
4382ZwPowerInformation (
4383 IN POWER_INFORMATION_LEVEL PowerInformationLevel,
4384 IN PVOID InputBuffer OPTIONAL,
4385 IN ULONG InputBufferLength,
4386 OUT PVOID OutputBuffer OPTIONAL,
4387 IN ULONG OutputBufferLength
4388);
4389
4390#endif /* (VER_PRODUCTBUILD >= 2195) */
4391
4392NTSYSAPI
4393NTSTATUS
4394NTAPI
4395ZwPulseEvent (
4396 IN HANDLE EventHandle,
4397 OUT PULONG PreviousState OPTIONAL
4398);
4399
4400NTSYSAPI
4401NTSTATUS
4402NTAPI
4403ZwQueryDefaultLocale (
4404 IN BOOLEAN ThreadOrSystem,
4405 OUT PLCID Locale
4406);
4407
4408NTSYSAPI
4409NTSTATUS
4410NTAPI
4411ZwQueryDirectoryFile (
4412 IN HANDLE FileHandle,
4413 IN HANDLE Event OPTIONAL,
4414 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4415 IN PVOID ApcContext OPTIONAL,
4416 OUT PIO_STATUS_BLOCK IoStatusBlock,
4417 OUT PVOID FileInformation,
4418 IN ULONG Length,
4419 IN FILE_INFORMATION_CLASS FileInformationClass,
4420 IN BOOLEAN ReturnSingleEntry,
4421 IN PUNICODE_STRING FileName OPTIONAL,
4422 IN BOOLEAN RestartScan
4423);
4424
4425#if (VER_PRODUCTBUILD >= 2195)
4426
4427NTSYSAPI
4428NTSTATUS
4429NTAPI
4430ZwQueryDirectoryObject (
4431 IN HANDLE DirectoryHandle,
4432 OUT PVOID Buffer,
4433 IN ULONG Length,
4434 IN BOOLEAN ReturnSingleEntry,
4435 IN BOOLEAN RestartScan,
4436 IN OUT PULONG Context,
4437 OUT PULONG ReturnLength OPTIONAL
4438);
4439
4440NTSYSAPI
4441NTSTATUS
4442NTAPI
4443ZwQueryEaFile (
4444 IN HANDLE FileHandle,
4445 OUT PIO_STATUS_BLOCK IoStatusBlock,
4446 OUT PVOID Buffer,
4447 IN ULONG Length,
4448 IN BOOLEAN ReturnSingleEntry,
4449 IN PVOID EaList OPTIONAL,
4450 IN ULONG EaListLength,
4451 IN PULONG EaIndex OPTIONAL,
4452 IN BOOLEAN RestartScan
4453);
4454
4455#endif /* (VER_PRODUCTBUILD >= 2195) */
4456
4457NTSYSAPI
4458NTSTATUS
4459NTAPI
4460ZwQueryInformationProcess (
4461 IN HANDLE ProcessHandle,
4462 IN PROCESSINFOCLASS ProcessInformationClass,
4463 OUT PVOID ProcessInformation,
4464 IN ULONG ProcessInformationLength,
4465 OUT PULONG ReturnLength OPTIONAL
4466);
4467
4468NTSYSAPI
4469NTSTATUS
4470NTAPI
4471ZwQueryInformationToken (
4472 IN HANDLE TokenHandle,
4473 IN TOKEN_INFORMATION_CLASS TokenInformationClass,
4474 OUT PVOID TokenInformation,
4475 IN ULONG Length,
4476 OUT PULONG ResultLength
4477);
4478
4479NTSYSAPI
4480NTSTATUS
4481NTAPI
4482ZwQueryObject (
4483 IN HANDLE ObjectHandle,
4484 IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
4485 OUT PVOID ObjectInformation,
4486 IN ULONG Length,
4487 OUT PULONG ResultLength
4488);
4489
4490NTSYSAPI
4491NTSTATUS
4492NTAPI
4493ZwQuerySection (
4494 IN HANDLE SectionHandle,
4495 IN SECTION_INFORMATION_CLASS SectionInformationClass,
4496 OUT PVOID SectionInformation,
4497 IN ULONG SectionInformationLength,
4498 OUT PULONG ResultLength OPTIONAL
4499);
4500
4501NTSYSAPI
4502NTSTATUS
4503NTAPI
4504ZwQuerySecurityObject (
4505 IN HANDLE FileHandle,
4506 IN SECURITY_INFORMATION SecurityInformation,
4507 OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
4508 IN ULONG Length,
4509 OUT PULONG ResultLength
4510);
4511
4512NTSYSAPI
4513NTSTATUS
4514NTAPI
4515ZwQuerySystemInformation (
4516 IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
4517 OUT PVOID SystemInformation,
4518 IN ULONG Length,
4519 OUT PULONG ReturnLength
4520);
4521
4522NTSYSAPI
4523NTSTATUS
4524NTAPI
4525ZwQueryVolumeInformationFile (
4526 IN HANDLE FileHandle,
4527 OUT PIO_STATUS_BLOCK IoStatusBlock,
4528 OUT PVOID FsInformation,
4529 IN ULONG Length,
4530 IN FS_INFORMATION_CLASS FsInformationClass
4531);
4532
4533NTSYSAPI
4534NTSTATUS
4535NTAPI
4536ZwReplaceKey (
4537 IN POBJECT_ATTRIBUTES NewFileObjectAttributes,
4538 IN HANDLE KeyHandle,
4539 IN POBJECT_ATTRIBUTES OldFileObjectAttributes
4540);
4541
4542NTSYSAPI
4543NTSTATUS
4544NTAPI
4545ZwResetEvent (
4546 IN HANDLE EventHandle,
4547 OUT PULONG PreviousState OPTIONAL
4548);
4549
4550#if (VER_PRODUCTBUILD >= 2195)
4551
4552NTSYSAPI
4553NTSTATUS
4554NTAPI
4555ZwRestoreKey (
4556 IN HANDLE KeyHandle,
4557 IN HANDLE FileHandle,
4558 IN ULONG Flags
4559);
4560
4561#endif /* (VER_PRODUCTBUILD >= 2195) */
4562
4563NTSYSAPI
4564NTSTATUS
4565NTAPI
4566ZwSaveKey (
4567 IN HANDLE KeyHandle,
4568 IN HANDLE FileHandle
4569);
4570
4571NTSYSAPI
4572NTSTATUS
4573NTAPI
4574ZwSetDefaultLocale (
4575 IN BOOLEAN ThreadOrSystem,
4576 IN LCID Locale
4577);
4578
4579#if (VER_PRODUCTBUILD >= 2195)
4580
4581NTSYSAPI
4582NTSTATUS
4583NTAPI
4584ZwSetDefaultUILanguage (
4585 IN LANGID LanguageId
4586);
4587
4588NTSYSAPI
4589NTSTATUS
4590NTAPI
4591ZwSetEaFile (
4592 IN HANDLE FileHandle,
4593 OUT PIO_STATUS_BLOCK IoStatusBlock,
4594 OUT PVOID Buffer,
4595 IN ULONG Length
4596);
4597
4598#endif /* (VER_PRODUCTBUILD >= 2195) */
4599
4600NTSYSAPI
4601NTSTATUS
4602NTAPI
4603ZwSetEvent (
4604 IN HANDLE EventHandle,
4605 OUT PULONG PreviousState OPTIONAL
4606);
4607
4608NTSYSAPI
4609NTSTATUS
4610NTAPI
4611ZwSetInformationObject (
4612 IN HANDLE ObjectHandle,
4613 IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
4614 IN PVOID ObjectInformation,
4615 IN ULONG ObjectInformationLength
4616);
4617
4618NTSYSAPI
4619NTSTATUS
4620NTAPI
4621ZwSetInformationProcess (
4622 IN HANDLE ProcessHandle,
4623 IN PROCESSINFOCLASS ProcessInformationClass,
4624 IN PVOID ProcessInformation,
4625 IN ULONG ProcessInformationLength
4626);
4627
4628#if (VER_PRODUCTBUILD >= 2195)
4629
4630NTSYSAPI
4631NTSTATUS
4632NTAPI
4633ZwSetSecurityObject (
4634 IN HANDLE Handle,
4635 IN SECURITY_INFORMATION SecurityInformation,
4636 IN PSECURITY_DESCRIPTOR SecurityDescriptor
4637);
4638
4639#endif /* (VER_PRODUCTBUILD >= 2195) */
4640
4641NTSYSAPI
4642NTSTATUS
4643NTAPI
4644ZwSetSystemInformation (
4645 IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
4646 IN PVOID SystemInformation,
4647 IN ULONG Length
4648);
4649
4650NTSYSAPI
4651NTSTATUS
4652NTAPI
4653ZwSetSystemTime (
4654 IN PLARGE_INTEGER NewTime,
4655 OUT PLARGE_INTEGER OldTime OPTIONAL
4656);
4657
4658#if (VER_PRODUCTBUILD >= 2195)
4659
4660NTSYSAPI
4661NTSTATUS
4662NTAPI
4663ZwSetVolumeInformationFile (
4664 IN HANDLE FileHandle,
4665 OUT PIO_STATUS_BLOCK IoStatusBlock,
4666 IN PVOID FsInformation,
4667 IN ULONG Length,
4668 IN FS_INFORMATION_CLASS FsInformationClass
4669);
4670
4671#endif /* (VER_PRODUCTBUILD >= 2195) */
4672
4673NTSYSAPI
4674NTSTATUS
4675NTAPI
4676ZwTerminateProcess (
4677 IN HANDLE ProcessHandle OPTIONAL,
4678 IN NTSTATUS ExitStatus
4679);
4680
4681NTSYSAPI
4682NTSTATUS
4683NTAPI
4684ZwUnloadDriver (
4685 /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
4686 IN PUNICODE_STRING RegistryPath
4687);
4688
4689NTSYSAPI
4690NTSTATUS
4691NTAPI
4692ZwUnloadKey (
4693 IN POBJECT_ATTRIBUTES KeyObjectAttributes
4694);
4695
4696NTSYSAPI
4697NTSTATUS
4698NTAPI
4699ZwWaitForSingleObject (
4700 IN HANDLE Handle,
4701 IN BOOLEAN Alertable,
4702 IN PLARGE_INTEGER Timeout OPTIONAL
4703);
4704
4705NTSYSAPI
4706NTSTATUS
4707NTAPI
4708ZwWaitForMultipleObjects (
4709 IN ULONG HandleCount,
4710 IN PHANDLE Handles,
4711 IN WAIT_TYPE WaitType,
4712 IN BOOLEAN Alertable,
4713 IN PLARGE_INTEGER Timeout OPTIONAL
4714);
4715
4716NTSYSAPI
4717NTSTATUS
4718NTAPI
4719ZwYieldExecution (
4720 VOID
4721);
4722
4723#pragma pack(pop)
4724
4725#ifdef __cplusplus
4726}
4727#endif
4728
4729#endif /* _NTIFS_ */
Note: See TracBrowser for help on using the repository browser.