API tools faq
paste
captmicro

ntinternals scraper output & script

captmicro
Jun 9th, 2013
616
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 184.09 KB | None | 0 0
raw download clone embed print report
  1. // SCRAPED FROM: $api_index
  2. // BY: Capt. Micro
  3. // SCRIPT: End of file
  4.  
  5. /*
  6.     ATOM_BASIC_INFORMATION (STRUCT)
  7.     UsageCount
  8.      Internal Atom counter state. This value increments at every NtAddAtom call for current Atom, and it's decremented on every NtDeleteAtom function call.
  9.     Flags
  10.      (?), Only lowest bit is used.
  11.     NameLength
  12.      Size of Name array, in bytes.
  13.     Name[1]
  14.      Atom name.
  15. */
  16. typedef struct _ATOM_BASIC_INFORMATION {
  17.     USHORT UsageCount;
  18.     USHORT Flags;
  19.     USHORT NameLength;
  20.     WCHAR Name[1];
  21. } ATOM_BASIC_INFORMATION, *PATOM_BASIC_INFORMATION;
  22.  
  23. /*
  24.     ATOM_INFORMATION_CLASS (ENUM)
  25. */
  26. typedef enum _ATOM_INFORMATION_CLASS {
  27.     AtomBasicInformation,
  28.     AtomTableInformation
  29. } ATOM_INFORMATION_CLASS, *PATOM_INFORMATION_CLASS;
  30.  
  31. /*
  32.     ATOM_TABLE_INFORMATION (STRUCT)
  33.     NumberOfAtoms
  34.      Number of members in Atoms array.
  35.     Atoms[1]
  36.      Array of Global Atoms.
  37. */
  38. typedef struct _ATOM_TABLE_INFORMATION {
  39.     ULONG NumberOfAtoms;
  40.     RTL_ATOM Atoms[1];
  41. } ATOM_TABLE_INFORMATION, *PATOM_TABLE_INFORMATION;
  42.  
  43. /*
  44.     DbgPrint (FUNCTION)
  45.     INFO-0
  46.      Function works like a normal C printf routine, but result is streamed to debug output.
  47. */
  48. typedef NTSTATUS (NTAPI *_DbgPrint)( IN LPCSTR Format, ... );
  49.  
  50. /*
  51.     DBG_STATE (ENUM)
  52. */
  53. typedef enum _DBG_STATE {
  54.     DbgIdle,
  55.     DbgReplyPending,
  56.     DbgCreateThreadStateChange,
  57.     DbgCreateProcessStateChange,
  58.     DbgExitThreadStateChange,
  59.     DbgExitProcessStateChange,
  60.     DbgExceptionStateChange,
  61.     DbgBreakpointStateChange,
  62.     DbgSingleStepStateChange,
  63.     DbgLoadDllStateChange,
  64.     DbgUnloadDllStateChange
  65. } DBG_STATE, *PDBG_STATE;
  66.  
  67. /*
  68.     EVENT_BASIC_INFORMATION (STRUCT)
  69.     INFO-0
  70.      This structure is used with EventBasicInformation information class as a result of call NtQueryEvent.
  71.     EventType
  72.      Type of Event Object. Can be SynchronizationEvent or NotificationEvent. See EVENT_TYPE for details.
  73.     EventState
  74.      Current state of Event Object.
  75. */
  76. typedef struct _EVENT_BASIC_INFORMATION {
  77.     EVENT_TYPE EventType;
  78.     LONG EventState;
  79. } EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;
  80.  
  81. /*
  82.     EVENT_INFORMATION_CLASS (ENUM)
  83. */
  84. typedef enum _EVENT_INFORMATION_CLASS {
  85.     EventBasicInformation
  86. } EVENT_INFORMATION_CLASS, *PEVENT_INFORMATION_CLASS;
  87.  
  88. /*
  89.     EVENT_TYPE (ENUM)
  90. */
  91. typedef enum _EVENT_TYPE {
  92.     NotificationEvent,
  93.     SynchronizationEvent
  94. } EVENT_TYPE, *PEVENT_TYPE;
  95.  
  96. /*
  97.     FILE_BASIC_INFORMATION (STRUCT)
  98.     CreationTime
  99.      Time of file creation, in 100-ns units.
  100.     LastAccessTime
  101.      Time of last open operation, in 100-ns units.
  102.     LastWriteTime
  103.      Time of last write operation, in 100-ns units.
  104.     ChangeTime
  105.      Time of any last change, in 100-ns units.
  106.     FileAttributes
  107.      File attributes. See NtCreateFile for possibilities.
  108. */
  109. typedef struct _FILE_BASIC_INFORMATION {
  110.     LARGE_INTEGER CreationTime;
  111.     LARGE_INTEGER LastAccessTime;
  112.     LARGE_INTEGER LastWriteTime;
  113.     LARGE_INTEGER ChangeTime;
  114.     ULONG FileAttributes;
  115. } FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
  116.  
  117. /*
  118.     FILE_BOTH_DIR_INFORMATION (STRUCT)
  119.     NextEntryOffset
  120.      Offset (in bytes) of next FILE_BOTH_DIR_INFORMATION structure placed in result buffer. If there's no more entries, NextEntryOffset is set to zero.
  121.     FileIndex
  122.      File index value, or zero, if directory indexing is not avaiable.
  123.     CreationTime
  124.      Time of object creation;
  125.     LastAccessTime
  126.      Last access time. Means time when last open operation was performed.
  127.     LastWriteTime
  128.      Time of last write data.
  129.     ChangeTime
  130.      Time of last change.
  131.     EndOfFile
  132.      Specify length of file, in bytes.
  133.     AllocationSize
  134.      Specify real size of file on device. It must be equal or greater to EndOfFile member.
  135.     FileAttributes
  136.      Attributes of file.
  137.     FileNameLength
  138.      Length of FileName array, in bytes.
  139.     EaSize
  140.      Size of Extended Attributes associated with file. See also FILE_EA_INFORMATION structure.
  141.     ShortNameLength
  142.      Length ShortName array, in bytes.
  143.     ShortName[12]
  144.      Alternate file name, in UNICODE format. Empty string means:
  145.          Primary name is compatible with 8DOT3 (MS DOS) standart, and there's no reason to set the same name twice;
  146.          File system don't improve short names;
  147.     FileName[1]
  148.      UNICODE string specifing file name.
  149. */
  150. typedef struct _FILE_BOTH_DIR_INFORMATION {
  151.     ULONG NextEntryOffset;
  152.     ULONG FileIndex;
  153.     LARGE_INTEGER CreationTime;
  154.     LARGE_INTEGER LastAccessTime;
  155.     LARGE_INTEGER LastWriteTime;
  156.     LARGE_INTEGER ChangeTime;
  157.     LARGE_INTEGER EndOfFile;
  158.     LARGE_INTEGER AllocationSize;
  159.     ULONG FileAttributes;
  160.     ULONG FileNameLength;
  161.     ULONG EaSize;
  162.     BYTE ShortNameLength;
  163.     WCHAR ShortName[12];
  164.     WCHAR FileName[1];
  165. } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
  166.  
  167. /*
  168.     FILE_DIRECTORY_INFORMATION (STRUCT)
  169.     NextEntryOffset
  170.      Offset (in bytes) of next FILE_DIRECTORY_INFORMATION structure placed in result buffer. If there's no more entries, NextEntryOffset is set to zero.
  171.     FileIndex
  172.      File index value, or zero, if directory indexing is not avaiable.
  173.     CreationTime
  174.      Time of object creation;
  175.     LastAccessTime
  176.      Last access time. Means time when last open operation was performed.
  177.     LastWriteTime
  178.      Time of last write data.
  179.     ChangeTime
  180.      Time of last change.
  181.     EndOfFile
  182.      Specify length of file, in bytes.
  183.     AllocationSize
  184.      Specify real size of file on device. It must be equal or greater to EndOfFile member.
  185.     FileAttributes
  186.      Attributes of file.
  187.     FileNameLength
  188.      Length of FileName array, in bytes.
  189.     FileName[1]
  190.      UNICODE string specifing file name.
  191. */
  192. typedef struct _FILE_DIRECTORY_INFORMATION {
  193.     ULONG NextEntryOffset;
  194.     ULONG FileIndex;
  195.     LARGE_INTEGER CreationTime;
  196.     LARGE_INTEGER LastAccessTime;
  197.     LARGE_INTEGER LastWriteTime;
  198.     LARGE_INTEGER ChangeTime;
  199.     LARGE_INTEGER EndOfFile;
  200.     LARGE_INTEGER AllocationSize;
  201.     ULONG FileAttributes;
  202.     ULONG FileNameLength;
  203.     WCHAR FileName[1];
  204. } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
  205.  
  206. /*
  207.     FILE_FS_ATTRIBUTE_INFORMATION (STRUCT)
  208.     INFO-0
  209.      FILE_FS_ATTRIBUTE_INFORMATION is output buffer in a call to NtQueryVolumeInformationFile function with FileFsAttributeInformation information class.
  210.     MaximumComponentNameLength
  211.      Maximum length of file name on specified device.
  212.     FileSystemNameLength
  213.      Length of FileSystemName array, in bytes.
  214.     FileSystemName[1]
  215.      Name of File System on specified device (ex. "NTFS").
  216. */
  217. typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {
  218.     ULONG FileSystemAttributes;
  219.     LONG MaximumComponentNameLength;
  220.     ULONG FileSystemNameLength;
  221.     WCHAR FileSystemName[1];
  222. } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
  223.  
  224. /*
  225.     FILE_FS_CONTROL_INFORMATION (STRUCT)
  226.     INFO-0
  227.      Structure FILE_FS_CONTROL_INFORMATION is user as input and output buffers in calls to NtQueryVolumeInformationFile and NtSetVolumeInformationFile with information class set to FileFsControlInformation.
  228.     INFO-1
  229.      FreeSpaceStartFiltering
  230.     INFO-2
  231.      FreeSpaceThreshold
  232.     INFO-3
  233.      FreeSpaceStopFiltering
  234.     INFO-4
  235.      DefaultQuotaThreshold
  236.     INFO-5
  237.      DefaultQuotaLimit
  238.     INFO-6
  239.      FileSystemControlFlags
  240. */
  241. typedef struct _FILE_FS_CONTROL_INFORMATION {
  242.     LARGE_INTEGER FreeSpaceStartFiltering;
  243.     LARGE_INTEGER FreeSpaceThreshold;
  244.     LARGE_INTEGER FreeSpaceStopFiltering;
  245.     LARGE_INTEGER DefaultQuotaThreshold;
  246.     LARGE_INTEGER DefaultQuotaLimit;
  247.     ULONG FileSystemControlFlags;
  248. } FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;
  249.  
  250. /*
  251.     FILE_FS_DEVICE_INFORMATION (STRUCT)
  252.     DeviceType
  253.      Numeric device types are defined in <ntddk.h> as FILE_DEVICE_* precompiler definitions.
  254.     Characteristics
  255.      Or-ed bit mask of device characteristic. Can be one of:
  256.         FILE_REMOVABLE_MEDIA          
  257.         FILE_READ_ONLY_DEVICE
  258. */
  259. typedef struct _FILE_FS_DEVICE_INFORMATION {
  260.     DEVICE_TYPE DeviceType;
  261.     ULONG Characteristics;
  262. } FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;
  263.  
  264. /*
  265.     FILE_FS_LABEL_INFORMATION (STRUCT)
  266.     VolumeLabelLength
  267.      Length of VolumeLabel array, in bytes.
  268.     VolumeLabel[1]
  269.      Label for specified volume.
  270. */
  271. typedef struct _FILE_FS_LABEL_INFORMATION {
  272.     ULONG VolumeLabelLength;
  273.     WCHAR VolumeLabel[1];
  274. } FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
  275.  
  276. /*
  277.     FILE_FS_SIZE_INFORMATION (STRUCT)
  278.     INFO-0
  279.      Structure provides detailed information about volume physical size. Is returned in call to NtQueryVolumeInformationFile with FileFsSizeInformation information class.
  280.     INFO-1
  281.      TotalAllocationUnits
  282.     INFO-2
  283.      AvailableAllocationUnits
  284.     INFO-3
  285.      SectorsPerAllocationUnit
  286.     INFO-4
  287.      BytesPerSector
  288. */
  289. typedef struct _FILE_FS_SIZE_INFORMATION {
  290.     LARGE_INTEGER TotalAllocationUnits;
  291.     LARGE_INTEGER AvailableAllocationUnits;
  292.     ULONG SectorsPerAllocationUnit;
  293.     ULONG BytesPerSector;
  294. } FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
  295.  
  296. /*
  297.     FILE_FS_VOLUME_INFORMATION (STRUCT)
  298.     VolumeCreationTime
  299.      It means time of last Volume Formating Process.
  300.     VolumeSerialNumber
  301.      Serial number of volume, associated in Volume Formating Process.
  302.     VolumeLabelLength
  303.      Length of VolumeLabel array, in bytes.
  304.     SupportsObjects
  305.      If TRUE, Object Files can be stored on specified volume.
  306.     VolumeLabel[1]
  307.      Name of volume. Can be set with FileFsLabelInformation.
  308. */
  309. typedef struct _FILE_FS_VOLUME_INFORMATION {
  310.     LARGE_INTEGER VolumeCreationTime;
  311.     ULONG VolumeSerialNumber;
  312.     ULONG VolumeLabelLength;
  313.     BOOLEAN SupportsObjects;
  314.     WCHAR VolumeLabel[1];
  315. } FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
  316.  
  317. /*
  318.     FILE_FULL_DIR_INFORMATION (STRUCT)
  319.     NextEntryOffset
  320.      Offset (in bytes) of next FILE_FULL_DIR_INFORMATION structure placed in result buffer. If there's no more entries, NextEntryOffset is set to zero.
  321.     FileIndex
  322.      File index value, or zero, if directory indexing is not avaiable.
  323.     CreationTime
  324.      Time of object creation;
  325.     LastAccessTime
  326.      Last access time. Means time when last open operation was performed.
  327.     LastWriteTime
  328.      Time of last write data.
  329.     ChangeTime
  330.      Time of last change.
  331.     EndOfFile
  332.      Specify length of file, in bytes.
  333.     AllocationSize
  334.      Specify real size of file on device. It must be equal or greater to EndOfFile member.
  335.     FileAttributes
  336.      Attributes of file.
  337.     FileNameLength
  338.      Length of FileName array, in bytes.
  339.     EaSize
  340.      Size of Extended Attributes associated with file. See also FILE_EA_INFORMATION structure.
  341.     FileName[1]
  342.      UNICODE string specifing file name.
  343. */
  344. typedef struct _FILE_FULL_DIR_INFORMATION {
  345.     ULONG NextEntryOffset;
  346.     ULONG FileIndex;
  347.     LARGE_INTEGER CreationTime;
  348.     LARGE_INTEGER LastAccessTime;
  349.     LARGE_INTEGER LastWriteTime;
  350.     LARGE_INTEGER ChangeTime;
  351.     LARGE_INTEGER EndOfFile;
  352.     LARGE_INTEGER AllocationSize;
  353.     ULONG FileAttributes;
  354.     ULONG FileNameLength;
  355.     ULONG EaSize;
  356.     WCHAR FileName[1];
  357. } FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
  358.  
  359. /*
  360.     FILE_FULL_EA_INFORMATION (STRUCT)
  361.     INFO-0
  362.      Structure FILE_FULL_EA_INFORMATION is also defined in Win2000 DDK.
  363. */
  364. typedef struct _FILE_FULL_EA_INFORMATION {
  365.     ULONG NextEntryOffset;
  366.     BYTE Flags;
  367.     BYTE EaNameLength;
  368.     USHORT EaValueLength;
  369.     CHAR EaName[1];
  370. } FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;
  371.  
  372. /*
  373.     FILE_GET_EA_INFORMATION (STRUCT)
  374.     INFO-0
  375.      Structure FILE_GET_EA_INFORMATION is used in a call to NtQueryEaFile function. See FILE_FULL_EA_INFORMATION for detailed information about EA.
  376.     NextEntryOffset
  377.      Relative offset for next FILE_GET_EA_INFORMATION structure in buffer.
  378.     EaNameLength
  379.      Length of EA name, in bytes (without leading zero).
  380.     EaName[1]
  381.      ASCIIZ name of EA, case insensitive.
  382. */
  383. typedef struct _FILE_GET_EA_INFORMATION {
  384.     ULONG NextEntryOffset;
  385.     BYTE EaNameLength;
  386.     CHAR EaName[1];
  387. } FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
  388.  
  389. /*
  390.     FILE_INFORMATION_CLASS (ENUM)
  391. */
  392. typedef enum _FILE_INFORMATION_CLASS {
  393.     FileDirectoryInformation=1,
  394.     FileFullDirectoryInformation,
  395.     FileBothDirectoryInformation,
  396.     FileBasicInformation,
  397.     FileStandardInformation,
  398.     FileInternalInformation,
  399.     FileEaInformation,
  400.     FileAccessInformation,
  401.     FileNameInformation,
  402.     FileRenameInformation,
  403.     FileLinkInformation,
  404.     FileNamesInformation,
  405.     FileDispositionInformation,
  406.     FilePositionInformation,
  407.     FileFullEaInformation,
  408.     FileModeInformation,
  409.     FileAlignmentInformation,
  410.     FileAllInformation,
  411.     FileAllocationInformation,
  412.     FileEndOfFileInformation,
  413.     FileAlternateNameInformation,
  414.     FileStreamInformation,
  415.     FilePipeInformation,
  416.     FilePipeLocalInformation,
  417.     FilePipeRemoteInformation,
  418.     FileMailslotQueryInformation,
  419.     FileMailslotSetInformation,
  420.     FileCompressionInformation,
  421.     FileCopyOnWriteInformation,
  422.     FileCompletionInformation,
  423.     FileMoveClusterInformation,
  424.     FileQuotaInformation,
  425.     FileReparsePointInformation,
  426.     FileNetworkOpenInformation,
  427.     FileObjectIdInformation,
  428.     FileTrackingInformation,
  429.     FileOleDirectoryInformation,
  430.     FileContentIndexInformation,
  431.     FileInheritContentIndexInformation,
  432.     FileOleInformation,
  433.     FileMaximumInformation
  434. } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
  435.  
  436. /*
  437.     FILE_INTERNAL_INFORMATION (STRUCT)
  438.     IndexNumber
  439.      File indentifier, unique for file's device.
  440. */
  441. typedef struct _FILE_INTERNAL_INFORMATION {
  442.     LARGE_INTEGER IndexNumber;
  443. } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
  444.  
  445. /*
  446.     FILE_LINK_INFORMATION (STRUCT)
  447.     ReplaceIfExists
  448.      If set, and destination object already exists, it will be replaced with newly created link.
  449.     RootDirectory
  450.      HANDLE to File Object specyfing directory where link should be placed. Can be NULL if FileName parameter contains full path.
  451.     FileNameLength
  452.      Length of FileName array, in bytes.
  453.     FileName[1]
  454.      UNICODE string specyfing name of link and optionally with path (see description of RootDirectory).
  455. */
  456. typedef struct _FILE_LINK_INFORMATION {
  457.     BOOLEAN ReplaceIfExists;
  458.     HANDLE RootDirectory;
  459.     ULONG FileNameLength;
  460.     WCHAR FileName[1];
  461. } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
  462.  
  463. /*
  464.     FILE_NAMES_INFORMATION (STRUCT)
  465.     NextEntryOffset
  466.      Offset (in bytes) of next FILE_NAMES_INFORMATION entry, or zero if last.
  467.     FileIndex
  468.      Index of file, or zero if Directory Indexing is disabled.
  469.     FileNameLength
  470.      Length of FileName array, in bytes.
  471.     FileName[1]
  472.      Name of file, in UNICODE format.
  473. */
  474. typedef struct _FILE_NAMES_INFORMATION {
  475.     ULONG NextEntryOffset;
  476.     ULONG FileIndex;
  477.     ULONG FileNameLength;
  478.     WCHAR FileName[1];
  479. } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
  480.  
  481. /*
  482.     FILE_NAME_INFORMATION (STRUCT)
  483.     FileNameLength
  484.      Length of FileName, in bytes.
  485.     FileName[1]
  486.      UNICODE name of file. If caller query about FileNameInformation, FileName additionally contains path to file, and begins with '/' (full path to file relative to device).
  487. */
  488. typedef struct _FILE_NAME_INFORMATION {
  489.     ULONG FileNameLength;
  490.     WCHAR FileName[1];
  491. } FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;
  492.  
  493. /*
  494.     FILE_NETWORK_OPEN_INFORMATION (STRUCT)
  495.     CreationTime
  496.      Indicates time of file creation.
  497.     LastAccessTime
  498.      Time of last open file.
  499.     LastWriteTime
  500.      Time of last write operation.
  501.     ChangeTime
  502.      Time of any last change.
  503.     AllocationSize
  504.      Number of bytes that file use on storage, equal or greater to EndOfFile.
  505.     EndOfFile
  506.      Length of file, in bytes.
  507.     FileAttributes
  508.      File attributes.
  509. */
  510. typedef struct _FILE_NETWORK_OPEN_INFORMATION {
  511.     LARGE_INTEGER CreationTime;
  512.     LARGE_INTEGER LastAccessTime;
  513.     LARGE_INTEGER LastWriteTime;
  514.     LARGE_INTEGER ChangeTime;
  515.     LARGE_INTEGER AllocationSize;
  516.     LARGE_INTEGER EndOfFile;
  517.     ULONG FileAttributes;
  518.     ULONG Unknown;
  519. } FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;
  520.  
  521. /*
  522.     FILE_NOTIFY_INFORMATION (STRUCT)
  523.     INFO-0
  524.      Only some of notification reasons can be readed from Action member. In most cases is contains FILE_ACTION_MODIFIED value, and user must check sort of notitication manually.
  525. */
  526. typedef struct _FILE_NOTIFY_INFORMATION {
  527.     ULONG NextEntryOffset;
  528.     ULONG Action;
  529.     ULONG FileNameLength;
  530.     WCHAR FileName[1];
  531. } FILE_NOTIFY_INFORMATION, *PFILE_NOTIFY_INFORMATION;
  532.  
  533. /*
  534.     FILE_RENAME_INFORMATION (STRUCT)
  535.     ReplaceIfExists
  536.      If set, and file with the same name as destination exist, it will be replaced. If no, STATUS_OBJECT_NAME_COLLISION is returned.
  537.     RootDirectory
  538.      Optional HANDLE to parent directory for destination file.
  539.     FileNameLength
  540.      Length of FileName array, in bytes.
  541.     FileName[1]
  542.      UNICODE string specifing destination file name. If RootDirectory is NULL, it must contains full system path, or only destination file name for in-place rename operation.
  543. */
  544. typedef struct _FILE_RENAME_INFORMATION {
  545.     BOOLEAN ReplaceIfExists;
  546.     HANDLE RootDirectory;
  547.     ULONG FileNameLength;
  548.     WCHAR FileName[1];
  549. } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
  550.  
  551. /*
  552.     FS_INFORMATION_CLASS (ENUM)
  553. */
  554. typedef enum _FS_INFORMATION_CLASS {
  555.     FileFsVolumeInformation=1,
  556.     FileFsLabelInformation,
  557.     FileFsSizeInformation,
  558.     FileFsDeviceInformation,
  559.     FileFsAttributeInformation,
  560.     FileFsControlInformation,
  561.     FileFsFullSizeInformation,
  562.     FileFsObjectIdInformation,
  563.     FileFsMaximumInformation
  564. } FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;
  565.  
  566. /*
  567.     HARDERROR_MSG (STRUCT)
  568.     INFO-0
  569.      Structure HARDERROR_MSG is send to LPC server in a result of call NtRaiseHardError. Most of stucture's members are  the same as parameters specified in this call.
  570.     LpcMessageHeader
  571.      Message header - see LPC_MESSAGE description.
  572.     ErrorStatus
  573.      Error code.
  574.     ErrorTime
  575.      Time when error was signaled.
  576.     ResponseOption
  577.      See HARDERROR_RESPONSE_OPTION for possible values.
  578.     Response
  579.      See HARDERROR_RESPONSE for possible values.
  580.     NumberOfParameters
  581.      Number of parameters in Parameters array. Maximum parameters number is defined as:
  582.     UnicodeStringParameterMask
  583.      Pointer to UNICODE_STRING in port's client address space
  584.     Parameters[MAXIMUM_HARDERROR_PARAMETERS]
  585.      Array of DWORD parameters.
  586. */
  587. typedef struct _HARDERROR_MSG {
  588.     LPC_MESSAGE LpcMessageHeader;
  589.     NTSTATUS ErrorStatus;
  590.     LARGE_INTEGER ErrorTime;
  591.     HARDERROR_RESPONSE_OPTION ResponseOption;
  592.     HARDERROR_RESPONSE Response;
  593.     ULONG NumberOfParameters;
  594.     PVOID UnicodeStringParameterMask;
  595.     ULONG Parameters[MAXIMUM_HARDERROR_PARAMETERS];
  596. } HARDERROR_MSG, *PHARDERROR_MSG;
  597.  
  598. /*
  599.     HARDERROR_RESPONSE (ENUM)
  600. */
  601. typedef enum _HARDERROR_RESPONSE {
  602.     ResponseReturnToCaller,
  603.     ResponseNotHandled,
  604.     ResponseAbort,
  605.     ResponseCancel,
  606.     ResponseIgnore,
  607.     ResponseNo,
  608.     ResponseOk,
  609.     ResponseRetry,
  610.     ResponseYes
  611. } HARDERROR_RESPONSE, *PHARDERROR_RESPONSE;
  612.  
  613. /*
  614.     HARDERROR_RESPONSE_OPTION (ENUM)
  615. */
  616. typedef enum _HARDERROR_RESPONSE_OPTION {
  617.     OptionAbortRetryIgnore,
  618.     OptionOk,
  619.     OptionOkCancel,
  620.     OptionRetryCancel,
  621.     OptionYesNo,
  622.     OptionYesNoCancel,
  623.     OptionShutdownSystem
  624. } HARDERROR_RESPONSE_OPTION, *PHARDERROR_RESPONSE_OPTION;
  625.  
  626. /*
  627.     INITIAL_TEB (STRUCT)
  628.     StackBase
  629.      DIV CLASS="reg">
  630.     StackLimit
  631.      DIV CLASS="reg">
  632.     StackCommit
  633.      DIV CLASS="reg">
  634.     StackCommitMax
  635.      DIV CLASS="reg">
  636.     StackReserved
  637.      DIV CLASS="reg">
  638. */
  639. typedef struct _INITIAL_TEB {
  640.     PVOID StackBase;
  641.     PVOID StackLimit;
  642.     PVOID StackCommit;
  643.     PVOID StackCommitMax;
  644.     PVOID StackReserved;
  645. } INITIAL_TEB, *PINITIAL_TEB;
  646.  
  647. /*
  648.     IO_COMPLETION_BASIC_INFORMATION (STRUCT)
  649.     Depth
  650.      Number of currently pending file operations for specified IO Completion Object.
  651. */
  652. typedef struct _IO_COMPLETION_BASIC_INFORMATION {
  653.     ULONG Depth;
  654. } IO_COMPLETION_BASIC_INFORMATION, *PIO_COMPLETION_BASIC_INFORMATION;
  655.  
  656. /*
  657.     IO_COMPLETION_INFORMATION_CLASS (ENUM)
  658. */
  659. typedef enum _IO_COMPLETION_INFORMATION_CLASS {
  660.     IoCompletionBasicInformation
  661. } IO_COMPLETION_INFORMATION_CLASS, *PIO_COMPLETION_INFORMATION_CLASS;
  662.  
  663. /*
  664.     KEY_MULTIPLE_VALUE_INFORMATION (STRUCT)
  665.     ValueName
  666.      Pointer to UNICODE_STRING structure containing value name. If specified value not exist, function fails.
  667.     DataLength
  668.      Length of value's data, in bytes.
  669.     DataOffset
  670.      Offset in output buffer (declared in NtQueryMultipleValueKey) to value's data.
  671.     Type
  672.      Type of queried value.
  673. */
  674. typedef struct _KEY_MULTIPLE_VALUE_INFORMATION {
  675.     PUNICODE_STRING ValueName;
  676.     ULONG DataLength;
  677.     ULONG DataOffset;
  678.     ULONG Type;
  679. } KEY_MULTIPLE_VALUE_INFORMATION, *PKEY_MULTIPLE_VALUE_INFORMATION;
  680.  
  681. /*
  682.     KiUserApcDispatcher (FUNCTION)
  683.     KiUserApcDispatcher isn't standard ntdll function. It's used by kernel to process APC queue for calling thread.
  684.      Five paraters I defined only for compatibility with ntdll.lib export (_KiUserApcDispatcher@20). Function first execute  code placed after call, and next calls NtContinue with CONTEXT specified at 4 parameter position (Warning: Not pointer to CONTEXT, but CONTEXT body must be stored on stack).
  685. */
  686. typedef VOID (NTAPI *_KiUserApcDispatcher)( IN PVOID Unused1, IN PVOID Unused2, IN PVOID Unused3, IN PVOID ContextStart, IN PVOID ContextBody );
  687.  
  688. /*
  689.     KPROFILE_SOURCE (ENUM)
  690. */
  691. typedef enum _KPROFILE_SOURCE {
  692.     ProfileTime,
  693.     ProfileAlignmentFixup,
  694.     ProfileTotalIssues,
  695.     ProfilePipelineDry,
  696.     ProfileLoadInstructions,
  697.     ProfilePipelineFrozen,
  698.     ProfileBranchInstructions,
  699.     ProfileTotalNonissues,
  700.     ProfileDcacheMisses,
  701.     ProfileIcacheMisses,
  702.     ProfileCacheMisses,
  703.     ProfileBranchMispredictions,
  704.     ProfileStoreInstructions,
  705.     ProfileFpInstructions,
  706.     ProfileIntegerInstructions,
  707.     Profile2Issue,
  708.     Profile3Issue,
  709.     Profile4Issue,
  710.     ProfileSpecialInstructions,
  711.     ProfileTotalCycles,
  712.     ProfileIcacheIssues,
  713.     ProfileDcacheAccesses,
  714.     ProfileMemoryBarrierCycles,
  715.     ProfileLoadLinkedIssues,
  716.     ProfileMaximum
  717. } KPROFILE_SOURCE, *PKPROFILE_SOURCE;
  718.  
  719. /*
  720.     LdrGetDllHandle (FUNCTION)
  721.     ModuleFileName
  722.      Path to file + Dll name, in NT directory format.
  723.     pHModule
  724.      Pointer to received HMODULE. See LdrLoadDll for more info.
  725. */
  726. typedef NTSTATUS (NTAPI *_LdrGetDllHandle)( IN PWORD pwPath OPTIONAL, IN PVOID Unused OPTIONAL, IN PUNICODE_STRING ModuleFileName, OUT PHANDLE pHModule );
  727.  
  728. /*
  729.     LdrGetProcedureAddress (FUNCTION)
  730.     FunctionName
  731.      Is optional, but you must declare one of FunctionName or Oridinal. In Microsoft concept, you should use both parameters,
  732. */
  733. typedef NTSTATUS (NTAPI *_LdrGetProcedureAddress)( IN HMODULE ModuleHandle, IN PANSI_STRING FunctionName OPTIONAL, IN WORD Oridinal OPTIONAL, OUT PVOID *FunctionAddress );
  734.  
  735. /*
  736.     LdrLoadDll (FUNCTION)
  737.     Flags
  738.      See WINAPI LoadLibraryEx for possibbilitied flags.
  739.     ModuleHandle
  740.      Address of MZ header in virtual memory of caller's process.
  741. */
  742. typedef NTSTATUS (NTAPI *_LdrLoadDll)( IN PWCHAR PathToFile OPTIONAL, IN ULONG Flags OPTIONAL, IN PUNICODE_STRING ModuleFileName, OUT PHANDLE ModuleHandle );
  743.  
  744. /*
  745.     LdrQueryProcessModuleInformation (FUNCTION)
  746.     INFO-0
  747.      Use for enumerate modules loaded with current process.
  748.     BufferSize
  749.      Required minimum size is sizeof(SYSTEM_MODULE_INFORMATION) (4 bytes).
  750. */
  751. typedef NTSTATUS (NTAPI *_LdrQueryProcessModuleInformation)( OUT PSYSTEM_MODULE_INFORMATION SystemModuleInformationBuffer, IN ULONG BufferSize, OUT PULONG RequiredSize OPTIONAL );
  752.  
  753. /*
  754.     LdrShutdownProcess (FUNCTION)
  755.     INFO-0
  756.      Kernel32.dll use this after call to NtTerminateProcess.
  757. */
  758. typedef VOID (NTAPI *_LdrShutdownProcess)();
  759.  
  760. /*
  761.     LdrShutdownThread (FUNCTION)
  762.     INFO-0
  763. */
  764. typedef VOID (NTAPI *_LdrShutdownThread)();
  765.  
  766. /*
  767.     LdrUnloadDll (FUNCTION)
  768.     ModuleHandle
  769.      In fact, ModuleHandle is virtual address of loaded module, not a typical HANDLE to object.
  770. */
  771. typedef NTSTATUS (NTAPI *_LdrUnloadDll)( IN HANDLE ModuleHandle );
  772.  
  773. /*
  774.     LDR_MODULE (STRUCT)
  775.     InLoadOrderModuleList
  776.      ointers to previous and next LDR_MODULE in load order.
  777.     InMemoryOrderModuleList
  778.      ointers to previous and next LDR_MODULE in memory placement order.
  779.     InInitializationOrderModuleList
  780.      ointers to previous and next LDR_MODULE in initialization order.
  781.     BaseAddress
  782.      odule base address known also as HMODULE.
  783.     EntryPoint
  784.      odule entry point (address of initialization procedure).
  785.     SizeOfImage
  786.      um of all image's sections placed in memory. Rounded up to 4Kb (page size).
  787.     FullDllName
  788.      ath and name of module.
  789.     BaseDllName
  790.      odule name only.
  791.     INFO-8
  792.      Flags
  793.     INFO-9
  794.      LoadCount
  795.     INFO-10
  796.      TlsIndex
  797.     HashTableEntry
  798.      B>LIST_ENTRY contains pointer to LdrpHashTable. Both prev and next values are the same.
  799.     INFO-12
  800.      TimeDateStamp
  801. */
  802. typedef struct _LDR_MODULE {
  803.     LIST_ENTRY InLoadOrderModuleList;
  804.     LIST_ENTRY InMemoryOrderModuleList;
  805.     LIST_ENTRY InInitializationOrderModuleList;
  806.     PVOID BaseAddress;
  807.     PVOID EntryPoint;
  808.     ULONG SizeOfImage;
  809.     UNICODE_STRING FullDllName;
  810.     UNICODE_STRING BaseDllName;
  811.     ULONG Flags;
  812.     SHORT LoadCount;
  813.     SHORT TlsIndex;
  814.     LIST_ENTRY HashTableEntry;
  815.     ULONG TimeDateStamp;
  816. } LDR_MODULE, *PLDR_MODULE;
  817.  
  818. /*
  819.     LPC_MESSAGE (STRUCT)
  820.     DataLength
  821.      Length of additional data in message. Maximum length of data is 0x130 bytes.
  822.     Length
  823.      Length of message, including header. Maximum value is 0x148 bytes length.
  824.     MessageType
  825.      Type of message. This field is filled by system in message transfer process. Can be one of following:
  826.         LPC_REQUEST            
  827.         LPC_REPLY              
  828.     INFO-4
  829.      DataInfoOffset
  830.     ClientId
  831.      Port's client unique identifier.
  832.     MessageId
  833.      System set this field to actual value of incremental message counter.
  834.     INFO-7
  835.      CallbackId
  836. */
  837. typedef struct _LPC_MESSAGE {
  838.     USHORT DataLength;
  839.     USHORT Length;
  840.     USHORT MessageType;
  841.     USHORT DataInfoOffset;
  842.     CLIENT_ID ClientId;
  843.     ULONG MessageId;
  844.     ULONG CallbackId;
  845. } LPC_MESSAGE, *PLPC_MESSAGE;
  846.  
  847. /*
  848.     LPC_SECTION_MEMORY (STRUCT)
  849.     INFO-0
  850. */
  851. typedef struct _LPC_SECTION_MEMORY {
  852.     ULONG Length;
  853.     ULONG ViewSize;
  854.     PVOID ViewBase;
  855. } LPC_SECTION_MEMORY, *PLPC_SECTION_MEMORY;
  856.  
  857. /*
  858.     LPC_SECTION_OWNER_MEMORY (STRUCT)
  859.     INFO-0
  860.      This structure is used by LPC connection functions by Section Object creator side (whatever it is client of port or server). See LPC_SECTION_MEMORY for more information.
  861.     Length
  862.      Length of structure.
  863.     SectionHandle
  864.      HANDLE to SectionObject mapped on both sides of LPC connection.
  865.     INFO-3
  866.      OffsetInSection
  867.     ViewSize
  868.      Receives size of mapped window.
  869.     ViewBase
  870.      Receives base address of mapped window.
  871.     OtherSideViewBase
  872.      Receives base address of mapped window for other LPC connection side.
  873. */
  874. typedef struct _LPC_SECTION_OWNER_MEMORY {
  875.     ULONG Length;
  876.     HANDLE SectionHandle;
  877.     ULONG OffsetInSection;
  878.     ULONG ViewSize;
  879.     PVOID ViewBase;
  880.     PVOID OtherSideViewBase;
  881. } LPC_SECTION_OWNER_MEMORY, *PLPC_SECTION_OWNER_MEMORY;
  882.  
  883. /*
  884.     LPC_TERMINATION_MESSAGE (STRUCT)
  885.     INFO-0
  886.      LPC_TERMINATION_MESSAGE is send to LPC server process when thread is terminating. Thread must be registered for inform server process by call NtRegisterThreadTerminatePort.
  887.     INFO-1
  888.      This message type is also send when LPC client close connection to server's port.
  889.     Header
  890.      Header.MessageType is LPC_CLIENT_DIED when thread terminate.
  891.     INFO-3
  892.      See LPC_MESSAGE for details.
  893.     CreationTime
  894.      Time of thread creation or time of connection begin.
  895. */
  896. typedef struct _LPC_TERMINATION_MESSAGE {
  897.     LPC_MESSAGE_HEADER Header;
  898.     LARGE_INTEGER CreationTime;
  899. } LPC_TERMINATION_MESSAGE, *PLPC_TERMINATION_MESSAGE;
  900.  
  901. /*
  902.     MEMORY_BASIC_INFORMATION (STRUCT)
  903.     BaseAddress
  904.      Address of queried memory page.
  905.     AllocationBase
  906.      Base address of allocation. It's different (typically less) to BaseAddress when user allocate more then one page length memory block, and change attributes of a part of allocated block.
  907.     AllocationProtect
  908.      Access type on memory allocation. Can be one or combination of following attributes:
  909.     INFO-3
  910.         PAGE_NOACCESS   PAGE_READONLY   PAGE_READWRITE  PAGE_WRITECOPY  PAGE_EXECUTE    PAGE_EXECUTE_READ   PAGE_EXECUTE_READWRITE  PAGE_EXECUTE_WRITECOPY  PAGE_GUARD  PAGE_NOCACHE    PAGE_WRITECOMBINE
  911.     RegionSize
  912.      Size of queried region, in bytes.
  913.     State
  914.      State of memory block. Can be one of:
  915.     INFO-6
  916.         MEM_RESERVE MEM_COMMIT  MEM_FREE
  917.     Protect
  918.      Current protection of queried memory block. Can be one or combination of values listed for AllocationProtect member.
  919.     Type
  920.      Type of queried memory block. Can be one of:
  921.     INFO-9
  922.         MEM_PRIVATE - Queried block was allocated by call NtAllocateVirtualMemory,  MEM_MAPPED - Queried block is memory mapped Section Object, SEC_IMAGE - Queried block is Section Object representing executable image file in memory.
  923. */
  924. typedef struct _MEMORY_BASIC_INFORMATION {
  925.     PVOID BaseAddress;
  926.     PVOID AllocationBase;
  927.     ULONG AllocationProtect;
  928.     ULONG RegionSize;
  929.     ULONG State;
  930.     ULONG Protect;
  931.     ULONG Type;
  932. } MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;
  933.  
  934. /*
  935.     MEMORY_INFORMATION_CLASS (ENUM)
  936. */
  937. typedef enum _MEMORY_INFORMATION_CLASS {
  938.     MemoryBasicInformation
  939. } MEMORY_INFORMATION_CLASS, *PMEMORY_INFORMATION_CLASS;
  940.  
  941. /*
  942.     MUTANT_BASIC_INFORMATION (STRUCT)
  943.     INFO-0
  944.      Use MUTANT_BASIC_INFORMATION as a buffer in NtQueryMutant call.
  945.     INFO-1
  946.      <HR WIDTH="40%">
  947.     CurrentCount
  948.      f CurrentCount is less than zero, mutant is signaled.
  949.     OwnedByCaller
  950.      t's TRUE if mutant is signaled by caller's thread.
  951.     AbandonedState
  952.      s set when thread terminates without call NtReleaseMutant.
  953. */
  954. typedef struct _MUTANT_BASIC_INFORMATION {
  955.     LONG CurrentCount;
  956.     BOOLEAN OwnedByCaller;
  957.     BOOLEAN AbandonedState;
  958. } MUTANT_BASIC_INFORMATION, *PMUTANT_BASIC_INFORMATION;
  959.  
  960. /*
  961.     NtAcceptConnectPort (FUNCTION)
  962.     INFO-0
  963.      This function returns HANDLE to newly created Port Object. All other LPC functions for currently accepted connection should use this HANDLE, not a base named port HANDLE created with NtCreatePort.
  964. */
  965. typedef NTSTATUS (NTAPI *_NtAcceptConnectPort)( OUT PHANDLE ServerPortHandle, IN HANDLE AlternativeReceivePortHandle OPTIONAL, IN PLPC_MESSAGE ConnectionReply, IN BOOLEAN AcceptConnection, IN OUT PLPC_SECTION_OWNER_MEMORY ServerSharedMemory OPTIONAL, OUT PLPC_SECTION_MEMORY ClientSharedMemory OPTIONAL );
  966.  
  967. /*
  968.     NtAccessCheck (FUNCTION)
  969.     SecurityDescriptor
  970.      Pointer to SECURITY_DESCRIPTOR structure.
  971.     ClientToken
  972.      HANDLE to client's Token Object opened with TOKEN_QUERY access.
  973.     DesiredAccess
  974.      ACCESS_MASK required by client.
  975.     GenericMapping
  976.      Pointer to GENERIC_MAPPING structure. Caller can take it in a call to NtQueryObject.
  977.     RequiredPrivilegesBuffer
  978.      Function fills this buffer with structure PRIVILEGE_SET contains required privileges.
  979.     BufferLength
  980.      Pointer to ULONG value. On input this value means size of RequiredPrivilegesBuffer buffer. If buffer was to small, required buffer size is avaiable on output.
  981.     GrantedAccess
  982.      Pointer to ACCESS_MASK value receiving granted access for object.
  983.     AccessStatus
  984.      Result of access check, in typical NTSTATUS format.
  985. */
  986. typedef NTSTATUS (NTAPI *_NtAccessCheck)( IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN HANDLE ClientToken, IN ACCESS_MASK DesiredAccess, IN PGENERIC_MAPPING GenericMapping OPTIONAL, OUT PPRIVILEGE_SET RequiredPrivilegesBuffer, IN OUT PULONG BufferLength, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus );
  987.  
  988. /*
  989.     NtAccessCheckAndAuditAlarm (FUNCTION)
  990.     ObjectHandle
  991.      Can be any valid HANDLE to object, or NULL.
  992.     SecurityDescriptor
  993.      Pointer to "Absolute" SECURITY_DESCRIPTOR structure.
  994.     GenericMapping
  995.      Pointer to GENERIC_MAPPING structure valid for object specified above as ObjectHandle parameter.
  996.     GrantedAccess
  997.      Pointer to ACCESS_MASK value (?).
  998.     AccessStatus
  999.      Pointer to NTSTATUS value (?).
  1000.     GenerateOnClose
  1001.      Pointer to BOOLEAN value (?).
  1002. */
  1003. typedef NTSTATUS (NTAPI *_NtAccessCheckAndAuditAlarm)( IN PUNICODE_STRING SubsystemName OPTIONAL, IN HANDLE ObjectHandle OPTIONAL, IN PUNICODE_STRING ObjectTypeName OPTIONAL, IN PUNICODE_STRING ObjectName OPTIONAL, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN ACCESS_MASK DesiredAccess, IN PGENERIC_MAPPING GenericMapping, IN BOOLEAN ObjectCreation, OUT PULONG GrantedAccess, OUT PULONG AccessStatus, OUT PBOOLEAN GenerateOnClose );
  1004.  
  1005. /*
  1006.     NtAddAtom (FUNCTION)
  1007.     AtomName
  1008.      UNICODE Atom name.
  1009.     Atom
  1010.      Result of call - pointer to RTL_ATOM.
  1011. */
  1012. typedef NTSTATUS (NTAPI *_NtAddAtom)( IN PWCHAR AtomName, OUT PRTL_ATOM Atom );
  1013.  
  1014. /*
  1015.     NtAdjustGroupsToken (FUNCTION)
  1016.     TokenHandle
  1017.      HANDLE to Token Object opened with TOKEN_ADJUST_GROUPS access.
  1018.     ResetToDefault
  1019.      If set, groups are reset to token's defaults. In this case all other parameters are ignored.
  1020.     TokenGroups
  1021.      Pointer to TOKEN_GROUPS structure containing groups to modify.
  1022.     PreviousGroupsLength
  1023.      Specifies length of PreviousGroups buffer, in bytes.
  1024.     PreviousGroups
  1025.      Optionally pointer to TOKEN_GROUPS buffer receiving information about modified groups before modification begins.
  1026.     RequiredLength
  1027.      If PreviousGroups parameter is specified, and PreviousGroupsLength is to small, this value receives required length of buffer, in bytes.
  1028. */
  1029. typedef NTSTATUS (NTAPI *_NtAdjustGroupsToken)( IN HANDLE TokenHandle, IN BOOLEAN ResetToDefault, IN PTOKEN_GROUPS TokenGroups, IN ULONG PreviousGroupsLength, OUT PTOKEN_GROUPS PreviousGroups OPTIONAL, OUT PULONG RequiredLength OPTIONAL );
  1030.  
  1031. /*
  1032.     NtAdjustPrivilegesToken (FUNCTION)
  1033.     TokenHandle
  1034.      HANDLE to Token Object opened with TOKEN_ADJUST_PRIVILEGES access. If PreviousPrivileges parameter is non-NULL, also TOKEN_QUERY access is required.
  1035.     DisableAllPrivileges
  1036.      If set, all accessable privileges are disabled, and rest of parameters below are ignored.
  1037.     TokenPrivileges
  1038.      Pointer to TOKEN_PRIVILEGES structure containing array of privileges to adjust.
  1039.     PreviousPrivilegesLength
  1040.      Length of PreviousPrivileges buffer, in bytes.
  1041.     PreviousPrivileges
  1042.      Optionally pointer to TOKEN_PRIVILEGES structure filled by function with previous state of privileges specified by TokenPrivileges array.
  1043.     RequiredLength
  1044.      If PreviousPrivileges buffer was to small, this parameter point to required size.
  1045. */
  1046. typedef NTSTATUS (NTAPI *_NtAdjustPrivilegesToken)( IN HANDLE TokenHandle, IN BOOLEAN DisableAllPrivileges, IN PTOKEN_PRIVILEGES TokenPrivileges, IN ULONG PreviousPrivilegesLength, OUT PTOKEN_PRIVILEGES PreviousPrivileges OPTIONAL, OUT PULONG RequiredLength OPTIONAL );
  1047.  
  1048. /*
  1049.     NtAlertResumeThread (FUNCTION)
  1050.     ThreadHandle
  1051.      andle to thread object.
  1052.     SuspendCount
  1053.      eturns number of suspend request for thread ThreadHandle before call NtAlertResumeThread. If this number is 0,
  1054.     INFO-2
  1055.      Difference between AlertResumeThread and ResumeThread it's the first one sets Thread Object to alerted state (so before thread will continue execution, all APC will be executed).
  1056. */
  1057. typedef NTSTATUS (NTAPI *_NtAlertResumeThread)( IN HANDLE ThreadHandle, OUT PULONG SuspendCount );
  1058.  
  1059. /*
  1060.     NtAlertThread (FUNCTION)
  1061.     ThreadHandle
  1062.      andle to opened Thread Object.
  1063.     INFO-1
  1064.      <HR WIDTH="40%">
  1065.     INFO-2
  1066.      NtAlertThread puts specified thread in alerted state.
  1067. */
  1068. typedef NTSTATUS (NTAPI *_NtAlertThread)( IN HANDLE ThreadHandle );
  1069.  
  1070. /*
  1071.     NtAllocateLocallyUniqueId (FUNCTION)
  1072.     LocallyUniqueId
  1073.      Pointer to LUID structure receiving new locally unique identifier.
  1074. */
  1075. typedef NTSTATUS (NTAPI *_NtAllocateLocallyUniqueId)( OUT PLUID LocallyUniqueId );
  1076.  
  1077. /*
  1078.     NtAllocateUuids (FUNCTION)
  1079.     Time
  1080.      Returns current time.
  1081. */
  1082. typedef NTSTATUS (NTAPI *_NtAllocateUuids)( OUT PLARGE_INTEGER Time, OUT PULONG Range, OUT PULONG Sequence );
  1083.  
  1084. /*
  1085.     NtAllocateVirtualMemory (FUNCTION)
  1086.     ProcessHandle
  1087.      andle to Process Object opened with PROCESS_VM_OPERATION access.
  1088.     *BaseAddress
  1089.      f not zero, system tries to allocate virtual memory block on this virtual address. If BaseAddress is zero, system use first free virtual location.
  1090.     AllocationType
  1091.      an be MEM_RESERVE or MEM_COMMIT.
  1092.     Protect
  1093.      ne or combination of PAGE_*** attributes.
  1094. */
  1095. typedef NTSTATUS (NTAPI *_NtAllocateVirtualMemory)( IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress, IN ULONG ZeroBits, IN OUT PULONG RegionSize, IN ULONG AllocationType, IN ULONG Protect );
  1096.  
  1097. /*
  1098.     NtCallbackReturn (FUNCTION)
  1099.     Result
  1100.      Pointer to user's allocated buffer with custom data.
  1101.     ResultLength
  1102.      Length of Result buffer, in bytes.
  1103.     Status
  1104.      Callback execution status code.
  1105. */
  1106. typedef NTSTATUS (NTAPI *_NtCallbackReturn)( IN PVOID Result OPTIONAL, IN ULONG ResultLength, IN NTSTATUS Status );
  1107.  
  1108. /*
  1109.     NtCancelIoFile (FUNCTION)
  1110.     FileHandle
  1111.      HANDLE to File Object.
  1112.     IoStatusBlock
  1113.      IO result of call.
  1114. */
  1115. typedef NTSTATUS (NTAPI *_NtCancelIoFile)( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock );
  1116.  
  1117. /*
  1118.     NtCancelTimer (FUNCTION)
  1119.     TimerHandle
  1120.      HANDLE to Timer Object opened with TIMER_MODIFY_STATE access.
  1121.     CurrentState
  1122.      Pointer to BOOLEAN value, that received state of timer before function call.
  1123. */
  1124. typedef NTSTATUS (NTAPI *_NtCancelTimer)( IN HANDLE TimerHandle, OUT PBOOLEAN CurrentState OPTIONAL );
  1125.  
  1126. /*
  1127.     NtClearEvent (FUNCTION)
  1128.     INFO-0
  1129.      There're no functional difference between NtClearEvent and NtResetEvent, but the first works faster (see NtResetEvent).
  1130. */
  1131. typedef NTSTATUS (NTAPI *_NtClearEvent)( IN HANDLE EventHandle );
  1132.  
  1133. /*
  1134.     NtClose (FUNCTION)
  1135.     ObjectHandle
  1136.      Handle to open object.
  1137. */
  1138. typedef NTSTATUS (NTAPI *_NtClose)( IN HANDLE ObjectHandle );
  1139.  
  1140. /*
  1141.     NtCloseObjectAuditAlarm (FUNCTION)
  1142.     SubsystemName
  1143.      This string is sent to Event Log as the first parameter.
  1144.     ObjectHandle
  1145.      HANDLE to object, or NULL value.
  1146.     GenerateOnClose
  1147.      If set, event is generated.
  1148. */
  1149. typedef NTSTATUS (NTAPI *_NtCloseObjectAuditAlarm)( IN PUNICODE_STRING SubsystemName, IN HANDLE ObjectHandle OPTIONAL, IN BOOLEAN GenerateOnClose );
  1150.  
  1151. /*
  1152.     NtCompactKeys (FUNCTION)
  1153.     INFO-0
  1154.      Function NtCompactKeys compacts (reduces size) of specified key(s). On Windows NT the same functionality was given by use NtSaveKey and NtRestoreKey
  1155.     NrOfKeys
  1156.      Number of enries in KeysArray array.
  1157.     KeysArray[]
  1158.      Array containing handles for previously opened keys.
  1159.     Supported on system versions:
  1160.      Win 2000,Win XP/2003
  1161. */
  1162. typedef NTSTATUS (NTAPI *_NtCompactKeys)( IN ULONG NrOfKeys, IN HANDLE KeysArray[] );
  1163.  
  1164. /*
  1165.     NtCompleteConnectPort (FUNCTION)
  1166.     INFO-0
  1167.      Return from NtConnectPort on client's side is synchronised with return from this call. Both sides of LPC connection are ready for sending and receiving LPC messages.
  1168. */
  1169. typedef NTSTATUS (NTAPI *_NtCompleteConnectPort)( IN HANDLE PortHandle );
  1170.  
  1171. /*
  1172.     NtCompressKey (FUNCTION)
  1173.     INFO-0
  1174.      This function compress data associated with specified Key and all his sub-keys. Compressed key require smaller space in registry file, but whole functionality used with compressed key works slower.
  1175.     Key
  1176.      HANDLE of previously opened key object (with write access).
  1177.     Supported on system versions:
  1178.      Win 2000,Win XP/2003
  1179. */
  1180. typedef NTSTATUS (NTAPI *_NtCompressKey)( IN HANDLE Key );
  1181.  
  1182. /*
  1183.     NtConnectPort (FUNCTION)
  1184.     INFO-0
  1185.      NtConnectPort is used by client process for establish LPC connection with Named Port's owner.
  1186.     ClientPortHandle
  1187.      Result of call - HANDLE to Port Object.
  1188.     ServerPortName
  1189.      Name of port to connect to.
  1190.     INFO-3
  1191.      SecurityQos
  1192.     ClientSharedMemory
  1193.      Used when calling process created Section Object for shared memory. See NtAcceptConnectPort for details.
  1194.     ServerSharedMemory
  1195.      Used when calling process didn't create Section Object. See NtAcceptConnectPort for details.
  1196.     MaximumMessageLength
  1197.      Maximum communication message length. This value is calculated by server on port creation process (see NtCreatePort).
  1198.     ConnectionInfo
  1199.      Pointer to RAW buffer containing information from client. That information is received by server through LPC_MESSAGE with MessageType field set to LPC_CONNECTION_REQUEST.
  1200.     ConnectionInfoLength
  1201.      Size of ConnectionInfo buffer, in bytes.
  1202. */
  1203. typedef NTSTATUS (NTAPI *_NtConnectPort)( OUT PHANDLE ClientPortHandle, IN PUNICODE_STRING ServerPortName, IN PSECURITY_QUALITY_OF_SERVICE SecurityQos, IN OUT PLPC_SECTION_OWNER_MEMORY ClientSharedMemory OPTIONAL, OUT PLPC_SECTION_MEMORY ServerSharedMemory OPTIONAL, OUT PULONG MaximumMessageLength OPTIONAL, IN ConnectionInfo OPTIONAL, IN PULONG ConnectionInfoLength OPTIONAL );
  1204.  
  1205. /*
  1206.     NtContinue (FUNCTION)
  1207.     You can use NtContinue after processing exception for continue executing thread.
  1208.      System uses NtContinue also in APC processing.
  1209. */
  1210. typedef NTSTATUS (NTAPI *_NtContinue)( IN PCONTEXT ThreadContext, IN BOOLEAN RaiseAlert );
  1211.  
  1212. /*
  1213.     NtCreateDirectoryObject (FUNCTION)
  1214.     DirectoryHandle
  1215.      ointer to newly created Directory Object after function call.
  1216.     DesiredAccess
  1217.      s defined in &lt;ntddk.h&gt; can be one of following:
  1218.        #define DIRECTORY_QUERY                 (0x0001)
  1219.         #define DIRECTORY_TRAVERSE              (0x0002)
  1220.     ObjectAttributes
  1221.      ointer to object attributes. Structure must contain valid object name.
  1222. */
  1223. typedef NTSTATUS (NTAPI *_NtCreateDirectoryObject)( OUT PHANDLE DirectoryHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes );
  1224.  
  1225. /*
  1226.     NtCreateEvent (FUNCTION)
  1227.     EventHandle
  1228.      Result of call - HANDLE to newly created Event Object.
  1229.     DesiredAccess
  1230.      Assess rights associated with created event. Can be one of following values from &lt;winnt.h&gt;:
  1231.         EVENT_QUERY_STATE  
  1232.         EVENT_MODIFY_STATE
  1233.     ObjectAttributes
  1234.      Optional name of Event Object for multiprocess use.
  1235.     EventType
  1236.      See EVENT_TYPE for details.
  1237.     InitialState
  1238.      State of event immediatelly after creation.
  1239. */
  1240. typedef NTSTATUS (NTAPI *_NtCreateEvent)( OUT PHANDLE EventHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN EVENT_TYPE EventType, IN BOOLEAN InitialState );
  1241.  
  1242. /*
  1243.     NtCreateEventPair (FUNCTION)
  1244.     EventPairHandle
  1245.      esult handle to EventPair object.
  1246.     DesiredAccess
  1247.      s defined as:
  1248.     INFO-2
  1249.      #define EVENT_PAIR_ALL_ACCESS ( STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE )
  1250. */
  1251. typedef NTSTATUS (NTAPI *_NtCreateEventPair)( OUT PHANDLE EventPairHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL );
  1252.  
  1253. /*
  1254.     NtCreateFile (FUNCTION)
  1255.     INFO-0
  1256.      (Avaiable also in 2000 DDK.)
  1257.     FileHandle
  1258.      Result of call - HANDLE to File Object.
  1259.     DesiredAccess
  1260.      Access mask based on definitions in schema FILE_* from &lt;WinNT.h&gt;.
  1261.     ObjectAttributes
  1262.      Name of file to create (or open), optionally path in name string. You can also define root directory, security descriptor and attributes OBJ_CASE_INSENSITIVE and OBJ_INHERIT.
  1263.     IoStatusBlock
  1264.      Pointer to IO_STATUS_BLOCK structure, that receive final status of function call. Can be one of:
  1265.     AllocationSize
  1266.      File size after creation.
  1267.     FileAttributes
  1268.      Attributes for newly created file, as follows:
  1269.     INFO-7
  1270.         FILE_ATTRIBUTE_READONLY FILE_ATTRIBUTE_HIDDEN   FILE_ATTRIBUTE_SYSTEM   FILE_ATTRIBUTE_ARCHIVE  FILE_ATTRIBUTE_NORMAL   FILE_ATTRIBUTE_TEMPORARY    FILE_ATTRIBUTE_OFFLINE  FILE_ATTRIBUTE_NOT_CONTENT_INDEXED
  1271.     ShareAccess
  1272.      Specifies share method for opened object. Can be set to zero or any combination of flags:
  1273.     INFO-9
  1274.         FILE_SHARE_READ     FILE_SHARE_WRITE    FILE_SHARE_DELETE
  1275.     CreateDisposition
  1276.      Specifies disposition how to create or open object and can be one of:
  1277.     INFO-11
  1278.         FILE_SUPERSEDE - If file exists, deletes it before creation of new one.     FILE_OPEN - Fails, if file not exists.  FILE_CREATE - Fails, if file exists.    FILE_OPEN_IF - If file exists, opens it. If not, creates new one and then open it.  FILE_OVERWRITE - If file not exists, create and open it. If exists, open them and reset content.    FILE_OVERWRITE_IF - As FILE_OVERWRITE, but fails if file not exists.
  1279.     CreateOptions
  1280.      Creation options.
  1281.     EaBuffer
  1282.      Buffer for Extended Attributes contains one or more of FILE_FULL_EA_INFORMATION structures.
  1283.     EaLength
  1284.      Length of EaBuffer.
  1285. */
  1286. typedef NTSTATUS (NTAPI *_NtCreateFile)( OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER AllocationSize OPTIONAL, IN ULONG FileAttributes, IN ULONG ShareAccess, IN ULONG CreateDisposition, IN ULONG CreateOptions, IN PVOID EaBuffer OPTIONAL, IN ULONG EaLength );
  1287.  
  1288. /*
  1289.     NtCreateIoCompletion (FUNCTION)
  1290.     IoCompletionHandle
  1291.      Result of call - HANDLE to newly created IO Completion Object.
  1292.     DesiredAccess
  1293.      Access mask for created HANDLE. Can be combination of:
  1294.         IO_COMPLETION_QUERY_STATE
  1295.         IO_COMPLETION_MODIFY_STATE
  1296.     ObjectAttributes
  1297.      Optionally contains object name, in Objects Namespace.
  1298.     NumberOfConcurrentThreads
  1299.      Number of threads accessing File Object associated with IO Completion. If Zero, system reserves memory for number of threads equal to current nymber of processes.
  1300. */
  1301. typedef NTSTATUS (NTAPI *_NtCreateIoCompletion)( OUT PHANDLE IoCompletionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN ULONG NumberOfConcurrentThreads );
  1302.  
  1303. /*
  1304.     NtCreateKey (FUNCTION)
  1305.     INFO-0
  1306.      See ZwCreateKey in NT DDK or 2000 DDK for detailed description.
  1307. */
  1308. typedef NTSTATUS (NTAPI *_NtCreateKey)( OUT PHANDLE pKeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG TitleIndex, IN PUNICODE_STRING Class OPTIONAL, IN ULONG CreateOptions, OUT PULONG Disposition OPTIONAL );
  1309.  
  1310. /*
  1311.     NtCreateKeyedEvent (FUNCTION)
  1312.     INFO-0
  1313.      Synchronization object called KeyedEvent is avaiable in Windows XP+ systems. It's usefull when both (or more) threads have to wait for each other.
  1314.     KeyedEventHandle
  1315.      HANDLE to newly created KeyedEvent object.
  1316.     DesiredAccess
  1317.      The same values as for Event objects (typically EVENT_ALL_ACCESS).
  1318.     ObjectAttributes
  1319.      Optionally name of object.
  1320.     Reserved
  1321.      Have to be zero. Reserved for future use.
  1322.     Supported on system versions:
  1323.      Win XP/2003
  1324. */
  1325. typedef NTSTATUS (NTAPI *_NtCreateKeyedEvent)( OUT PHANDLE KeyedEventHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN ULONG Reserved );
  1326.  
  1327. /*
  1328.     NtCreateMailslotFile (FUNCTION)
  1329.     MailslotFileHandle
  1330.      Result of call - HANDLE to Mailslot File Object.
  1331.     DesiredAccess
  1332.      Access rights associated with opened handle.
  1333.     ObjectAttributes
  1334.      Pointer to OBJECT_ATTRIBUTES structure contains valid object name. Name must be in format "//??/MAILSLOT/..." where "..." means unique name of Mailslot.
  1335.     IoStatusBlock
  1336.      IO result of call.
  1337.     CreateOptions
  1338.      Can be combination of:
  1339.         FILE_WRITE_THROUGH
  1340.         FILE_SYNCHRONOUS_IO_ALERT
  1341.     MaxMessageSize
  1342.      Maximum message size, or MAILSLOT_SIZE_AUTO for automatic message size.
  1343.     ReadTimeOut
  1344.      Timeout value, or -1 for infinite waiting.
  1345. */
  1346. typedef NTSTATUS (NTAPI *_NtCreateMailslotFile)( OUT PHANDLE MailslotFileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CreateOptions, IN ULONG MailslotQuota, IN ULONG MaxMessageSize, IN PLARGE_INTEGER ReadTimeOut );
  1347.  
  1348. /*
  1349.     NtCreateMutant (FUNCTION)
  1350.     MutantHandle
  1351.      esult of function call - handle to newly created Mutant object.
  1352.     DesiredAccess
  1353.      n most cases there's MUTANT_ALL_ACCESS. See &lt;WinNT.h&gt; or &lt;WinBase.h&gt; for other information about Mutant objects access rights.
  1354.     ObjectAttributes
  1355.      ay be used to creation named Mutant objects. Named Mutant can be used by more then one process.
  1356.     InitialOwner
  1357.      f TRUE, Mutant is created with non-signaled state. Caller should call NtReleaseMutant after program initialization.
  1358.     <HR WIDTH="40%">
  1359.      Mutant object live in object namespace as long as at least one handle is still open. To destroy Mutant, just call NtClose with MutantHandle.
  1360. */
  1361. typedef NTSTATUS (NTAPI *_NtCreateMutant)( OUT PHANDLE MutantHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN BOOLEAN InitialOwner );
  1362.  
  1363. /*
  1364.     NtCreateNamedPipeFile (FUNCTION)
  1365.     NamedPipeFileHandle
  1366.      Result of call - pointer to HANDLE to Named Pipe.
  1367.     DesiredAccess
  1368.      Access rights for object's handle. Can be one or combination of:FILE_READ_DATAFILE_WRITE_DATAFILE_CREATE_PIPE_INSTANCEFILE_READ_ATTRIBUTESFILE_WRITE_ATTRIBUTESSYNCHRONIZEREAD_CONTROLWRITE_OWNERWRITE_DACACCESS_SYSTEM_SECURITY
  1369.     ObjectAttributes
  1370.      Pointer to OBJECT_ATTRIBUTES structure contains name of named pipe. Name must begin with "/??/PIPE/" string, that is Symbolic Link to NamedPipe device object.
  1371.     IoStatusBlock
  1372.      IO result of call.
  1373.     ShareAccess
  1374.      Can be combination of following:FILE_SHARE_READFILE_SHARE_WRITEFILE_SHARE_DELETE
  1375.     CreateDisposition
  1376.      Use FILE_CREATE, FILE_OPEN or FILE_OPEN_IF.
  1377.     CreateOptions
  1378.      See description of NtCreateFile for possible creation flags.
  1379.     WriteModeMessage
  1380.      If set, writing to created pipe are processed in Message Mode. If not, all writes are in Byte Mode.
  1381.     ReadModeMessage
  1382.      The same functionality as WriteModeMessage parameter, but for reading data.
  1383.     NonBlocking
  1384.      If set, all operations on created pipe are asynchronous.
  1385.     MaxInstances
  1386.      Maximum number of open handles for Named Pipe, or FILE_PIPE_UNLIMITED_INSTANCES constant.
  1387.     InBufferSize
  1388.      Input buffer size, in bytes.
  1389.     OutBufferSize
  1390.      Output buffer size, in bytes.
  1391.     DefaultTimeOut
  1392.      Pointer to LARGE_INTEGER value specifing pipe's time out, in 100-ns units. Negative value means relative time.
  1393. */
  1394. typedef NTSTATUS (NTAPI *_NtCreateNamedPipeFile)( OUT PHANDLE NamedPipeFileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG ShareAccess, IN ULONG CreateDisposition, IN ULONG CreateOptions, IN BOOLEAN WriteModeMessage, IN BOOLEAN ReadModeMessage, IN BOOLEAN NonBlocking, IN ULONG MaxInstances, IN ULONG InBufferSize, IN ULONG OutBufferSize, IN PLARGE_INTEGER DefaultTimeOut );
  1395.  
  1396. /*
  1397.     NtCreatePagingFile (FUNCTION)
  1398.     PageFileName
  1399.      System path to newly created paged file.
  1400.     MiniumSize
  1401.      Minimum size of paged file, in bytes. This value must be multiply of page size (0x1000 bytes on x86), and must be greater then 2MB (0x02000000 bytes).
  1402.     MaxiumSize
  1403.      Maximum size of paged file, in bytes. Also this value must be multiply of page size. Minimal value accepted is 5MB (0x05000000 bytes).
  1404.     ActualSize
  1405.      Optional (and currently unused) parameter.
  1406. */
  1407. typedef NTSTATUS (NTAPI *_NtCreatePagingFile)( IN PUNICODE_STRING PageFileName, IN PLARGE_INTEGER MiniumSize, IN PLARGE_INTEGER MaxiumSize, OUT PLARGE_INTEGER ActualSize OPTIONAL );
  1408.  
  1409. /*
  1410.     NtCreatePort (FUNCTION)
  1411.     PortHandle
  1412.      Result of call - HANDLE to Port Object.
  1413.     ObjectAttributes
  1414.      Typically contains name and SECURITY_DESCRIPTOR for newly created named port.
  1415.     INFO-2
  1416.      MaxConnectInfoLength
  1417.     MaxDataLength
  1418.      Maximum size of message.
  1419.     INFO-4
  1420.      Reserved
  1421. */
  1422. typedef NTSTATUS (NTAPI *_NtCreatePort)( OUT PHANDLE PortHandle, IN POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG MaxConnectInfoLength, IN ULONG MaxDataLength, IN OUT PULONG Reserved OPTIONAL );
  1423.  
  1424. /*
  1425.         NtCreateProcess (FUNCTION)
  1426.     INFO-0
  1427. */
  1428. typedef NTSTATUS (NTAPI *_NtCreateProcess)( OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess, IN BOOLEAN InheritObjectTable, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL );
  1429.  
  1430. /*
  1431.     NtCreateProfile (FUNCTION)
  1432.     ProfileHandle
  1433.      Result of call - HANDLE to Profile Object.
  1434.     Process
  1435.      HANDLE to Process Object to profile. Not required if profiled code is placed in Kernel address space (above 0x80000000).
  1436.     ImageBase
  1437.      Start address of profiling.
  1438.     ImageSize
  1439.      Size of profiled memory block.
  1440.     Buffer
  1441.      Caller's allocated buffer for data.
  1442.     BufferSize
  1443.      Size of buffer, in bytes.
  1444.     ProfileSource
  1445.      Identifier of performance counter. See KPROFILE_SOURCE enumeration type for possible values.
  1446.     Affinity
  1447.      Processor affinity mask. It defines processors to ask about performance counter.
  1448. */
  1449. typedef NTSTATUS (NTAPI *_NtCreateProfile)( OUT PHANDLE ProfileHandle, IN HANDLE Process OPTIONAL, IN PVOID ImageBase, IN ULONG ImageSize, IN ULONG BucketSize, IN PVOID Buffer, IN ULONG BufferSize, IN KPROFILE_SOURCE ProfileSource, IN KAFFINITY Affinity );
  1450.  
  1451. /*
  1452.     NtCreateSection (FUNCTION)
  1453.     SectionHandle
  1454.      Result of call - HANDLE to Section Object.
  1455.     DesiredAccess
  1456.      Access mask. Can be combination of:
  1457.         SECTION_QUERY      
  1458.         SECTION_MAP_WRITE  
  1459.     ObjectAttributes
  1460.      Pointer to OBJECT_ATTRIBUTES structure contains section name, in Object Namespace format.
  1461.     MaximumSize
  1462.      Optionally define maximum size of section. Must be defined when caller create section based on system PageFile.
  1463.     PageAttributess
  1464.      Can be one or combination of:
  1465.         PAGE_NOACCESS        
  1466.         PAGE_READONLY        
  1467.     SectionAttributes
  1468.      Can be one or combination of:
  1469.         SEC_FILE  
  1470.         SEC_IMAGE  
  1471.     FileHandle
  1472.      Optionally HANDLE to File Object opened with proper access.
  1473. */
  1474. typedef NTSTATUS (NTAPI *_NtCreateSection)( OUT PHANDLE SectionHandle, IN ULONG DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG PageAttributess, IN ULONG SectionAttributes, IN HANDLE FileHandle OPTIONAL );
  1475.  
  1476. /*
  1477.     NtCreateSemaphore (FUNCTION)
  1478.     SemaphoreHandle
  1479.      Result of call - pointer to HANDLE to Semaphore Object.
  1480.     DesiredAccess
  1481.      Access rights to Semaphore Object. Can be one of:
  1482.         SEMAPHORE_QUERY_STATE
  1483.         SEMAPHORE_MODIFY_STATE
  1484.     ObjectAttributes
  1485.      Optional pointer to OBJECT_ATTRIBUTES structure containing semaphore's name.
  1486.     InitialCount
  1487.      Initial state of semaphore. Typically the same as MaximumCount.
  1488.     MaximumCount
  1489.      Maximum releases number.
  1490. */
  1491. typedef NTSTATUS (NTAPI *_NtCreateSemaphore)( OUT PHANDLE SemaphoreHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN ULONG InitialCount, IN ULONG MaximumCount );
  1492.  
  1493. /*
  1494.     NtCreateSymbolicLinkObject  (FUNCTION)
  1495.     pHandle
  1496.      Handle to SymbolicLinkObject.
  1497.     INFO-1
  1498.      
  1499.     ObjectAttributes
  1500.      Name of SymbolicLinkObject.
  1501.     DestinationName
  1502.      Name or path to destination object in Object Namespace.
  1503. */
  1504. typedef NTSTATUS NTAPI NtCreateSymbolicLinkObject )( OUT PHANDLE pHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN PUNICODE_STRING DestinationName );
  1505.  
  1506. /*
  1507.     NtCreateThread (FUNCTION)
  1508.     ThreadHandle
  1509.      DIV CLASS="reg">Caller supplied storage for the resulting handle.
  1510.     DesiredAccess
  1511.      DIV CLASS="reg">Specifies the allowed or desired access to the thread.
  1512.     ObjectAttributes
  1513.      DIV CLASS="reg">Initialized attributes for the object.
  1514.     ProcessHandle
  1515.      DIV CLASS="reg">Handle to the threads parent process.
  1516.     ClientId
  1517.      DIV CLASS="reg">Caller supplies storage for returned process id and thread id.
  1518.     ThreadContext
  1519.      DIV CLASS="reg">Initial processor context for the thread.
  1520.     InitialTeb
  1521.      DIV CLASS="reg">Initial user mode stack context for the thread.
  1522.     CreateSuspended
  1523.      DIV CLASS="reg">Specifies if the thread is ready for scheduling. See NtContinue for more information.
  1524. */
  1525. typedef NTSTATUS (NTAPI *_NtCreateThread)( OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ProcessHandle, OUT PCLIENT_ID ClientId, IN PCONTEXT ThreadContext, IN PINITIAL_TEB InitialTeb, IN BOOLEAN CreateSuspended );
  1526.  
  1527. /*
  1528.     NtCreateTimer (FUNCTION)
  1529.     TimerHandle
  1530.      Result of call - HANDLE to Timer Object.
  1531.     DesiredAccess
  1532.      Access mask for TimerHandle. Can be set of (from &lt;WinNT.h&gt;):
  1533.     ObjectAttributes
  1534.      Optional name of Timer Object.
  1535.     TimerType
  1536.      Can be NotificationTimer or SynchronizationTimer (enumerated type definition from &lt;ntdef.h&gt;).
  1537. */
  1538. typedef NTSTATUS (NTAPI *_NtCreateTimer)( OUT PHANDLE TimerHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN TIMER_TYPE TimerType );
  1539.  
  1540. /*
  1541.     NtCreateToken (FUNCTION)
  1542.     TokenHandle
  1543.      Result of call - pointer to HANDLE to Token Object.
  1544.     DesiredAccess
  1545.      Can be one or more of following:
  1546.         TOKEN_ASSIGN_PRIMARY
  1547.         TOKEN_DUPLICATE
  1548.     ObjectAttributes
  1549.      Pointer to OBJECT_ATTRIBUTES structure.
  1550.     TokenType
  1551.      (?), see TOKEN_TYPE enumeration type.
  1552.     AuthenticationId
  1553.      (?), see NtAllocateLocallyUniqueId security function.
  1554.     ExpirationTime
  1555.      (?), pointer to LARGE_INTEGER value contains time in 100-ns format.
  1556.     TokenUser
  1557.      (?), see TOKEN_USER structure.
  1558.     TokenGroups
  1559.      (?), see TOKEN_GROUPS structure.
  1560.     TokenPrivileges
  1561.      (?), see TOKEN_PRIVILEGES structure.
  1562.     TokenOwner
  1563.      (?), see TOKEN_OWNER structure.
  1564.     TokenPrimaryGroup
  1565.      (?), see TOKEN_PRIMARY_GROUP structure.
  1566.     TokenDefaultDacl
  1567.      (?), see TOKEN_DEFAULT_DACL structure.
  1568.     TokenSource
  1569.      (?), see TOKEN_SOURCE structure.
  1570. */
  1571. typedef NTSTATUS (NTAPI *_NtCreateToken)( OUT PHANDLE TokenHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN TOKEN_TYPE TokenType, IN PLUID AuthenticationId, IN PLARGE_INTEGER ExpirationTime, IN PTOKEN_USER TokenUser, IN PTOKEN_GROUPS TokenGroups, IN PTOKEN_PRIVILEGES TokenPrivileges, IN PTOKEN_OWNER TokenOwner, IN PTOKEN_PRIMARY_GROUP TokenPrimaryGroup, IN PTOKEN_DEFAULT_DACL TokenDefaultDacl, IN PTOKEN_SOURCE TokenSource );
  1572.  
  1573. /*
  1574.     NtCurrentTeb (FUNCTION)
  1575.     INFO-0
  1576.      NtCurrentTeb isn't typical NT CALL realised via INT 2E, becouse TEB is accessable at address fs:[0018h].
  1577.     INFO-1
  1578.      Microsoft declare NtCurrentTeb as __cdecl, but ntdll.dll export it as __stdcall (it don't have metter, becouse function don't have any parameters), so you cannot use ntdll.dll export. In this case the better way is write NtCurrentTeb manually, declaring it as __cdecl.
  1579. */
  1580. typedef PTEB (NTAPI *_NtCurrentTeb)( );
  1581.  
  1582. /*
  1583.     NtDelayExecution (FUNCTION)
  1584.     Alertable
  1585.      If set, execution can break in a result of NtAlertThread call.
  1586.     DelayInterval
  1587.      Delay in 100-ns units. Negative value means delay relative to current.
  1588. */
  1589. typedef NTSTATUS (NTAPI *_NtDelayExecution)( IN BOOLEAN Alertable, IN PLARGE_INTEGER DelayInterval );
  1590.  
  1591. /*
  1592.     NtDeleteAtom (FUNCTION)
  1593.     Atom
  1594.      Atom identifier.
  1595. */
  1596. typedef NTSTATUS (NTAPI *_NtDeleteAtom)( IN RTL_ATOM Atom );
  1597.  
  1598. /*
  1599.     NtDeleteFile (FUNCTION)
  1600.     It's very interesting NT System Call... Normally, file deletion is realised as FileDispositionInformation class in a call to NtSetInformationFile. When you use NtDeleteFile, file will be deleted immediatly after call (system isn't waiting for close last HANDLE to file).
  1601.      <HR WIDTH="40%">
  1602.     ObjectAttributes
  1603.      ou can manipulate ObjectName and RootDirectory members.
  1604. */
  1605. typedef NTSTATUS (NTAPI *_NtDeleteFile)( IN POBJECT_ATTRIBUTES ObjectAttributes );
  1606.  
  1607. /*
  1608.     NtDeleteKey (FUNCTION)
  1609.     INFO-0
  1610.      See ZwDeleteKey in NT DDK or 2000 DDK for detailed description.
  1611. */
  1612. typedef NTSTATUS (NTAPI *_NtDeleteKey)( IN HANDLE KeyHandle );
  1613.  
  1614. /*
  1615.     NtDeleteObjectAuditAlarm (FUNCTION)
  1616.     SubsystemName
  1617.      This string is passed as a parameter to event message.
  1618.     ObjectHandle
  1619.      HANDLE to any object.
  1620.     GenerateOnClose
  1621.      If set, event is generated.
  1622. */
  1623. typedef NTSTATUS (NTAPI *_NtDeleteObjectAuditAlarm)( IN PUNICODE_STRING SubsystemName, IN HANDLE ObjectHandle OPTIONAL, IN BOOLEAN GenerateOnClose );
  1624.  
  1625. /*
  1626.     NtDeleteValueKey (FUNCTION)
  1627.     INFO-0
  1628. */
  1629. typedef NTSTATUS (NTAPI *_NtDeleteValueKey)( IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName );
  1630.  
  1631. /*
  1632.     NtDeviceIoControlFile (FUNCTION)
  1633.     FileHandle
  1634.      HANDLE to Device Object opened as a file.
  1635.     Event
  1636.      Optional HANDLE to Event Object signalled on the end of processing request.
  1637.     ApcRoutine
  1638.      Optional pointer to user's APC Routine called on the end of processing request.
  1639.     ApcContext
  1640.      User's parameter to ApcRoutine.
  1641.     IoStatusBlock
  1642.      IO result of call.
  1643.     IoControlCode
  1644.      IO Control code [IOCTL_*].
  1645.     InputBuffer
  1646.      User's allocated buffer with input data.
  1647.     InputBufferLength
  1648.      Length of InputBuffer, in bytes.
  1649.     OutputBuffer
  1650.      User's allocated buffer for result data.
  1651.     OutputBufferLength
  1652.      Length of OutputBuffer, in bytes.
  1653. */
  1654. typedef NTSTATUS (NTAPI *_NtDeviceIoControlFile)( IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG IoControlCode, IN PVOID InputBuffer OPTIONAL, IN ULONG InputBufferLength, OUT PVOID OutputBuffer OPTIONAL, IN ULONG OutputBufferLength );
  1655.  
  1656. /*
  1657.     NtDisplayString (FUNCTION)
  1658.     String
  1659.      Pointer to UNICODE_STRING contains string to display. Some basic control characters are implemented (like CR, LF).
  1660. */
  1661. typedef NTSTATUS (NTAPI *_NtDisplayString)( IN PUNICODE_STRING String );
  1662.  
  1663. /*
  1664.     NtDuplicateObject (FUNCTION)
  1665.     INFO-0
  1666.      See Microsoft SDK for description of DuplicateHandle Win32 API.
  1667. */
  1668. typedef NTSTATUS (NTAPI *_NtDuplicateObject)( IN HANDLE SourceProcessHandle, IN PHANDLE SourceHandle, IN HANDLE TargetProcessHandle, OUT PHANDLE TargetHandle, IN ACCESS_MASK DesiredAccess OPTIONAL, IN BOOLEAN InheritHandle, IN ULONG Options );
  1669.  
  1670. /*
  1671.     NtDuplicateToken (FUNCTION)
  1672.     ExistingToken
  1673.      HANDLE to Token Object opened with TOKEN_DUPLICATE access.
  1674.     DesiredAccess
  1675.      Access mask for newly created token. Can be combination of:
  1676.         TOKEN_ASSIGN_PRIMARY
  1677.         TOKEN_DUPLICATE
  1678.     ObjectAttributes
  1679.      Optionally pointer to OBJECT_ATTRIBUTES structure, containing token's name.
  1680.     ImpersonationLevel
  1681.      Level of impersonation for new token.
  1682.     TokenType
  1683.      Type of new token.
  1684.     NewToken
  1685.      Result of call - pointer to HANDLE to new Token Object.
  1686. */
  1687. typedef NTSTATUS (NTAPI *_NtDuplicateToken)( IN HANDLE ExistingToken, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, IN TOKEN_TYPE TokenType, OUT PHANDLE NewToken );
  1688.  
  1689. /*
  1690.     NtEnumerateKey (FUNCTION)
  1691.     INFO-0
  1692.      See ZwEnumerateKey in NT DDK or 2000 DDK for detailed description.
  1693. */
  1694. typedef NTSTATUS (NTAPI *_NtEnumerateKey)( IN HANDLE KeyHandle, IN ULONG Index, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT PVOID KeyInformation, IN ULONG Length, OUT PULONG ResultLength );
  1695.  
  1696. /*
  1697.     NtEnumerateValueKey (FUNCTION)
  1698.     INFO-0
  1699.      See ZwEnumerateValueKey in NT DDK or 2000 DDK for detailed description.
  1700. */
  1701. typedef NTSTATUS (NTAPI *_NtEnumerateValueKey)( IN HANDLE KeyHandle, IN ULONG Index, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformation, OUT PVOID KeyValueInformation, IN ULONG Length, OUT PULONG ResultLength );
  1702.  
  1703. /*
  1704.     NtExtendSection (FUNCTION)
  1705.     SectionHandle
  1706.      Must be open with SECTION_EXTEND_SIZE attribute.
  1707. */
  1708. typedef NTSTATUS (NTAPI *_NtExtendSection)( IN HANDLE SectionHandle, IN PLARGE_INTEGER NewSectionSize );
  1709.  
  1710. /*
  1711.     NtFindAtom (FUNCTION)
  1712.     AtomName
  1713.      Atom's name, in UNICODE format.
  1714.     Atom
  1715.      Result of call - Pointer to Atom's identifier.
  1716. */
  1717. typedef NTSTATUS (NTAPI *_NtFindAtom)( IN PWCHAR AtomName, OUT PRTL_ATOM Atom OPTIONAL );
  1718.  
  1719. /*
  1720.     NtFlushBuffersFile (FUNCTION)
  1721.     FileHandle
  1722.      HANDLE to File Object.
  1723.     IoStatusBlock
  1724.      IO result of call.
  1725. */
  1726. typedef NTSTATUS (NTAPI *_NtFlushBuffersFile)( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock );
  1727.  
  1728. /*
  1729.     NtFlushInstructionCache (FUNCTION)
  1730.     ProcessHandle
  1731.      HANDLE to Process Object.
  1732.     BaseAddress
  1733.      Starting memory address to flush.
  1734.     NumberOfBytesToFlush
  1735.      Length of flushed memory block.
  1736. */
  1737. typedef NTSTATUS (NTAPI *_NtFlushInstructionCache)( IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN ULONG NumberOfBytesToFlush );
  1738.  
  1739. /*
  1740.     NtFlushKey (FUNCTION)
  1741.     INFO-0
  1742.      See ZwFlushKey in NT DDK or 2000 DDK for detailed description.
  1743. */
  1744. typedef NTSTATUS (NTAPI *_NtFlushKey)( IN HANDLE KeyHandle );
  1745.  
  1746. /*
  1747.     NtFlushVirtualMemory (FUNCTION)
  1748.     INFO-0
  1749.      WARNING: Two (or more) memory pages mapped in different calls of NtMapViewOfSection cannot be flushed in one function call, even if both has the same SECTION as a source.
  1750. */
  1751. typedef NTSTATUS (NTAPI *_NtFlushVirtualMemory)( IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress, IN OUT PULONG NumberOfBytesToFlush, OUT PIO_STATUS_BLOCK IoStatusBlock );
  1752.  
  1753. /*
  1754.     NtFlushWriteBuffer (FUNCTION)
  1755.     INFO-0
  1756.      It test IRQ Level, and call HAL export named KeFlushWriteBuffer.
  1757.     INFO-1
  1758.      KeFlushWriteBuffer as first asm code has ret, so it returns immediatelly.
  1759.     INFO-2
  1760.      Next NtFlushWriteBuffer clear eax (set result of call to STATUS_SUCCESS) and returns to User-Mode.
  1761. */
  1762. typedef NTSTATUS (NTAPI *_NtFlushWriteBuffer)( );
  1763.  
  1764. /*
  1765.     NtFreeVirtualMemory (FUNCTION)
  1766.     RegionSize
  1767.      f you put pointer to NULL value as RegionSize, system will free all region, and put size of it in result.
  1768.     FreeType
  1769.      an be one of the values:  MEM_DECOMMIT, or MEM_RELEASE.
  1770. */
  1771. typedef NTSTATUS (NTAPI *_NtFreeVirtualMemory)( IN HANDLE ProcessHandle, IN PVOID *BaseAddress, IN OUT PULONG RegionSize, IN ULONG FreeType );
  1772.  
  1773. /*
  1774.     NtFsControlFile (FUNCTION)
  1775.     FileHandle
  1776.      HANDLE to File System Device Object opened as a file.
  1777.     Event
  1778.      Optional HANDLE to Event Object.
  1779.     ApcRoutine
  1780.      Optional pointer to user's APC Routine.
  1781.     ApcContext
  1782.      Parameter for ApcRoutine.
  1783.     IoStatusBlock
  1784.      IO result of call.
  1785.     FsControlCode
  1786.      Control Code typically defined as FSCTL_*.
  1787.     InputBuffer
  1788.      User's allocated buffer contains input data.
  1789.     InputBufferLength
  1790.      Length of InputBuffer, in bytes.
  1791.     OutputBuffer
  1792.      User's allocated buffer for results of call.
  1793.     OutputBufferLength
  1794.      Length of OutputBuffer, in bytes.
  1795. */
  1796. typedef NTSTATUS (NTAPI *_NtFsControlFile)( IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG FsControlCode, IN PVOID InputBuffer OPTIONAL, IN ULONG InputBufferLength, OUT PVOID OutputBuffer OPTIONAL, IN ULONG OutputBufferLength );
  1797.  
  1798. /*
  1799.     NtGetContextThread (FUNCTION)
  1800.     pContext
  1801.      ee &lt;ntddk.h&gt; for information about CONTEXT structure usage.
  1802. */
  1803. typedef NTSTATUS (NTAPI *_NtGetContextThread)( IN HANDLE ThreadHandle, OUT PCONTEXT pContext );
  1804.  
  1805. /*
  1806.     NtGetTickCount (FUNCTION)
  1807.     INFO-0
  1808.      Function NtGetTickCount returns system Timer's ticks counter. This counter is also avaiable in KUSER_SHARED_DATA structure as TickCountLow member.
  1809.     INFO-1
  1810.      Calling NtSetTimerResolution doesn't effect in counter's update resolution.
  1811. */
  1812. typedef ULONG (NTAPI *_NtGetTickCount)( );
  1813.  
  1814. /*
  1815.     NtImpersonateClientOfPort (FUNCTION)
  1816.     INFO-0
  1817.      NtImpersonateClientOfPort is called by LPC server process to get security context of client. That means: client's Token Object is assiciated with calling server thread (like NtSetInformationThread with ThreadImpersonationToken information class).
  1818.     PortHandle
  1819.      HANDLE to Port Object opened with NtAcceptConnectPort call.
  1820.     Request
  1821.      Pointer to LPC_MESSAGE structure contains reason of impersonation.
  1822. */
  1823. typedef NTSTATUS (NTAPI *_NtImpersonateClientOfPort)( IN HANDLE PortHandle, IN PLPC_MESSAGE Request );
  1824.  
  1825. /*
  1826.     NtImpersonateThread (FUNCTION)
  1827.     ThreadHandle
  1828.      HANDLE to source Thread Object.
  1829.     ThreadToImpersonate
  1830.      HANDLE to destination Thread Object opened with THREAD_IMPERSONATE access.
  1831.     SecurityQualityOfService
  1832.      Pointer to SECURITY_QUALITY_OF_SERVICE structure filled by user.
  1833. */
  1834. typedef NTSTATUS (NTAPI *_NtImpersonateThread)( IN HANDLE ThreadHandle, IN HANDLE ThreadToImpersonate, IN PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService );
  1835.  
  1836. /*
  1837.     NtListenPort (FUNCTION)
  1838.     INFO-0
  1839.      Server process should create new thread starting from execution of NtAcceptConnectPort. Main thread should call NtListenPort again to make possible for other processes to connect to port.
  1840. */
  1841. typedef NTSTATUS (NTAPI *_NtListenPort)( IN HANDLE PortHandle, OUT PLPC_MESSAGE ConnectionRequest );
  1842.  
  1843. /*
  1844.     NtLoadDriver (FUNCTION)
  1845.     DriverServiceName
  1846.      Registry path in system format. Path must begin with "//registry//machine//SYSTEM//CurrentControlSet//Services//..." where "..." is driver symbolic name.
  1847. */
  1848. typedef NTSTATUS (NTAPI *_NtLoadDriver)( IN PUNICODE_STRING DriverServiceName );
  1849.  
  1850. /*
  1851.     NtLoadKey (FUNCTION)
  1852.     DestinationKeyName
  1853.      Pointer to OBJECT_ATTRIBUTES structure contains destination key name and HANDLE to root key. Root can be /REGISTRY/machine or /REGISTRY/user. All other keys are invalid.
  1854.     HiveFileName
  1855.      Pointer to OBJECT_ATTRIBUTES structure contains Hive file path and name.
  1856. */
  1857. typedef NTSTATUS (NTAPI *_NtLoadKey)( IN POBJECT_ATTRIBUTES DestinationKeyName, IN POBJECT_ATTRIBUTES HiveFileName );
  1858.  
  1859. /*
  1860.     NtLoadKey2 (FUNCTION)
  1861.     DestinationKeyName
  1862.      Pointer to OBJECT_ATTRIBUTES structure contains name of loaded key and virtual parent key ("machine" or "user").
  1863.     HiveFileName
  1864.      Pointer to OBJECT_ATTRIBUTES structure specifing Hive file.
  1865.     Flags
  1866.      (?) Only values 0x0000 and 0x0004 are valid. If caller set Flags to 0x0000, function works as NtLoadKey.
  1867. */
  1868. typedef NTSTATUS (NTAPI *_NtLoadKey2)( IN POBJECT_ATTRIBUTES DestinationKeyName, IN POBJECT_ATTRIBUTES HiveFileName, IN ULONG Flags );
  1869.  
  1870. /*
  1871.     NtLockFile (FUNCTION)
  1872.     FileHandle
  1873.      HANDLE to File Object opened with FILE_READ_DATA access.
  1874.     LockGrantedEvent
  1875.      Optional HANDLE to Event Object, whitch is signaled when lock is created (typically used with ReturnImmediately parameter set to TRUE).
  1876.     ApcRoutine
  1877.      APC routine executed when lock is granted.
  1878.     ApcContext
  1879.      Optional parameter for ApcRoutine.
  1880.     IoStatusBlock
  1881.      IO result of call.
  1882.     ByteOffset
  1883.      Offset (in bytes) to begin of file region to lock.
  1884.     Length
  1885.      Length of region to lock, in bytes.
  1886.     Key
  1887.      Pointer to user's defined 4-bytes key associated with this lock. It can be used in multi-thread process to allow reading or writing data only for one specified thread, whitch known Key value.
  1888.     ReturnImmediately
  1889.      If TRUE, function returns immediately. Caller is informed about lock creation by LockGrantedEvent or by executing ApcRoutine.
  1890.     ExclusiveLock
  1891.      If set, all read and write operation are denied for other processes. If not, only write operation is denied.
  1892. */
  1893. typedef NTSTATUS (NTAPI *_NtLockFile)( IN HANDLE FileHandle, IN HANDLE LockGrantedEvent OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER ByteOffset, IN PLARGE_INTEGER Length, IN PULONG Key, IN BOOLEAN ReturnImmediately, IN BOOLEAN ExclusiveLock );
  1894.  
  1895. /*
  1896.     NtLockVirtualMemory (FUNCTION)
  1897.     LockOption
  1898.      an be one or both of following values:
  1899.         #define VM_LOCK_1       0x0001  // This is used, when calling KERNEL32.DLL VirtualLock routine
  1900.         #define VM_LOCK_2       0x0002  // This require SE_LOCK_MEMORY_NAME privilege
  1901. */
  1902. typedef NTSTATUS (NTAPI *_NtLockVirtualMemory)( IN HANDLE ProcessHandle, IN PVOID *BaseAddress, IN OUT PULONG NumberOfBytesToLock, IN ULONG LockOption );
  1903.  
  1904. /*
  1905.     NtMakeTemporaryObject (FUNCTION)
  1906.     (Also avaiable in Win2000 DDK)
  1907.      Function clears object's PERMANENT flag, so it's live as long as the latest HANDLE is closed.
  1908.     ObjectHandle
  1909.      HANDLE to object to make temporary.
  1910. */
  1911. typedef NTSTATUS (NTAPI *_NtMakeTemporaryObject)( IN HANDLE ObjectHandle );
  1912.  
  1913. /*
  1914.     NtMapViewOfSection (FUNCTION)
  1915.     SectionHandle
  1916.      HANDLE to Section Object opened with one or more from SECTION_MAP_EXECUTE, SECTION_MAP_READ, SECTION_MAP_WRITE attributes.
  1917.     ProcessHandle
  1918.      HANDLE to Process Object opened with PROCESS_VM_OPERATION access.
  1919.     *BaseAddress
  1920.      Pointer to variable receiving virtual address of mapped memory. If this value is not NULL, system tries to allocate memory from specified value.
  1921.     ZeroBits
  1922.      Indicates how many high bits must not be set in BaseAddress.
  1923.     CommitSize
  1924.      Size of initially commited memory, in bytes.
  1925.     SectionOffset
  1926.      Pointer to begin of mapped block in section. This value must be rounded up to X64K block size (0x10000 on X86).
  1927.     ViewSize
  1928.      Pointer to size of mapped block, in bytes. This value is rounded up to page size (0x1000 on x86).
  1929.     InheritDisposition
  1930.      How to child processes inherid maped section. See description of enumeration type SECTION_INHERIT.
  1931.     AllocationType
  1932.      Can be one of:MEM_COMMIT MEM_RESERVE
  1933.     Protect
  1934.      Page protection. Can be one of:PAGE_NOACCESS         PAGE_READONLY         PAGE_READWRITE        PAGE_WRITECOPY        PAGE_EXECUTE          PAGE_EXECUTE_READ     PAGE_EXECUTE_READWRITEPAGE_EXECUTE_WRITECOPYPAGE_GUARD            PAGE_NOCACHE          PAGE_WRITECOMBINE    
  1935.     Supported on system versions:
  1936.      NT 4.0,Win 2000,Win XP/2003
  1937. */
  1938. typedef NTSTATUS (NTAPI *_NtMapViewOfSection)( IN HANDLE SectionHandle, IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress OPTIONAL, IN ULONG ZeroBits OPTIONAL, IN ULONG CommitSize, IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, IN OUT PULONG ViewSize, IN InheritDisposition, IN ULONG AllocationType OPTIONAL, IN ULONG Protect );
  1939.  
  1940. /*
  1941.     NtNotifyChangeDirectoryFile (FUNCTION)
  1942.     FileHandle
  1943.      HANDLE to File Object opened with SYNCHRONIZE access and FILE_DIRECTORY_FILE option set.
  1944.     Event
  1945.      HANDLE to Event Object. Event can be created as NotificationEvent or SynchronizationEvent, but second one is better in this situation.
  1946.     ApcRoutine
  1947.      Address of user's APC routine, queued when change complete.
  1948.     ApcContext
  1949.      Optional parameter for ApcRoutine.
  1950.     IoStatusBlock
  1951.      IO result of call. Status member in IoStatusBlock can result STATUS_NOTIFY_ENUM_DIR when Buffer was to small.
  1952.     Buffer
  1953.      User's allocated buffer for change informations. It contains one or more of FILE_NOTIFY_INFORMATION structures.
  1954.     BufferSize
  1955.      Size of Buffer, in bytes.
  1956.     CompletionFilter
  1957.      Mask specifing what sort of changes should be monitored. Can be combination of:
  1958.     FILE_NOTIFY_CHANGE_FILE_NAME
  1959.      FILE_NOTIFY_CHANGE_DIR_NAME
  1960.     WatchTree
  1961.      If set, all subdirectiories of specified directory will be also monitored.
  1962. */
  1963. typedef NTSTATUS (NTAPI *_NtNotifyChangeDirectoryFile)( IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG BufferSize, IN ULONG CompletionFilter, IN BOOLEAN WatchTree );
  1964.  
  1965. /*
  1966.     NtNotifyChangeKey (FUNCTION)
  1967.     INFO-0
  1968. */
  1969. typedef NTSTATUS (NTAPI *_NtNotifyChangeKey)( IN HANDLE KeyHandle, IN HANDLE EventHandle, IN PIO_APC_ROUTINE ApcRoutine, IN PVOID ApcRoutineContext, IN PIO_STATUS_BLOCK IoStatusBlock, IN ULONG NotifyFilter, IN BOOLEAN WatchSubtree, OUT PVOID RegChangesDataBuffer, IN ULONG RegChangesDataBufferLength, IN BOOLEAN Asynchronous );
  1970.  
  1971. /*
  1972.     NtOpenDirectoryObject (FUNCTION)
  1973.     DirectoryObjectHandle
  1974.      ointer to HANDLE value representing opened Directory Object.
  1975.     DesiredAccess
  1976.      ccess mask. See NtCreateDirectoryObject for possible values.
  1977.     ObjectAttributes
  1978.      ust contains valid Directory Object name.
  1979. */
  1980. typedef NTSTATUS (NTAPI *_NtOpenDirectoryObject)( OUT PHANDLE DirectoryObjectHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes );
  1981.  
  1982. /*
  1983.     NtOpenEvent (FUNCTION)
  1984.     INFO-0
  1985.      Only named events can be opened by this function call.
  1986. */
  1987. typedef NTSTATUS (NTAPI *_NtOpenEvent)( OUT PHANDLE EventHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes );
  1988.  
  1989. /*
  1990.     NtOpenEventPair (FUNCTION)
  1991.     DesiredAccess
  1992.      ee NtCreateEventPair for definitions of EventPair possibble access rights.
  1993. */
  1994. typedef NTSTATUS (NTAPI *_NtOpenEventPair)( OUT PHANDLE EventPairHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes );
  1995.  
  1996. /*
  1997.     NtOpenFile (FUNCTION)
  1998.     INFO-0
  1999.      (Also avaiable in 2000 DDK.)
  2000.     FileHandle
  2001.      Result of call.
  2002.     DesiredAccess
  2003.      Access mask to opened file object.
  2004.     ObjectAttributes
  2005.      File name, path etc. See NtCreateFile for more information.
  2006.     IoStatusBlock
  2007.      Completion status of call.
  2008.     ShareAccess
  2009.      Sharing option defined as FILE_SHARE_*.
  2010.     OpenOptions
  2011.      Open options.
  2012. */
  2013. typedef NTSTATUS (NTAPI *_NtOpenFile)( OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG ShareAccess, IN ULONG OpenOptions );
  2014.  
  2015. /*
  2016.     NtOpenIoCompletion (FUNCTION)
  2017.     IoCompletionHandle
  2018.      Result of call - pointer to HANDLE value.
  2019.     DesiredAccess
  2020.      Can be one or combination of:
  2021.         IO_COMPLETION_QUERY_STATE
  2022.         IO_COMPLETION_MODIFY_STATE
  2023.     ObjectAttributes
  2024.      Pointer to OBJECT_ATTRIBUTES structure containing valid IO Completion name.
  2025. */
  2026. typedef NTSTATUS (NTAPI *_NtOpenIoCompletion)( OUT PHANDLE IoCompletionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes );
  2027.  
  2028. /*
  2029.     NtOpenKey (FUNCTION)
  2030.     INFO-0
  2031.      See ZwOpenKey in NT DDK or 2000 DDK for detailed description.
  2032. */
  2033. typedef NTSTATUS (NTAPI *_NtOpenKey)( OUT PHANDLE pKeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes );
  2034.  
  2035. /*
  2036.     NtOpenKeyedEvent (FUNCTION)
  2037.     INFO-0
  2038.      Function NtOpenKeyedEvent is used for open previously created KeyedEvent with associated name.
  2039.     KeyedEventHandle
  2040.      Result of call - HANDLE to opened KeyedEvent object.
  2041.     DesiredAccess
  2042.      Access to object, the same values as for Event object.
  2043.     ObjectAttributes
  2044.      Name of KeyedEvent to open.
  2045.     Supported on system versions:
  2046.      Win XP/2003
  2047. */
  2048. typedef NTSTATUS (NTAPI *_NtOpenKeyedEvent)( OUT PHANDLE KeyedEventHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL );
  2049.  
  2050. /*
  2051.     NtOpenMutant (FUNCTION)
  2052.     DesiredAccess
  2053.      ee &lt;WinNT.h&gt; or &lt;WinBase.h&gt; for possible Mutant access rights.
  2054.     ObjectAttributes
  2055.      ame of Mutant object to open.
  2056. */
  2057. typedef NTSTATUS (NTAPI *_NtOpenMutant)( OUT PHANDLE MutantHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes );
  2058.  
  2059. /*
  2060.     NtOpenObjectAuditAlarm (FUNCTION)
  2061.     ObjectHandle
  2062.      Can be any valid HANDLE to object, or NULL.
  2063.     SecurityDescriptor
  2064.      Pointer to SECURITY_DESCRIPTOR structure, or NULL.
  2065.     ClientToken
  2066.      HANDLE to Token Object previously opened with TOKEN_QUERY access.
  2067.     Privileges
  2068.      Optionally pointer to PRIVILEGE_SET structure filled by user with valid privileges.
  2069.     GenerateOnClose
  2070.      Optionally pointer to BOOLEAN value.
  2071. */
  2072. typedef NTSTATUS (NTAPI *_NtOpenObjectAuditAlarm)( IN PUNICODE_STRING SubsystemName OPTIONAL, IN PHANDLE ObjectHandle OPTIONAL, IN PUNICODE_STRING ObjectTypeName OPTIONAL, IN PUNICODE_STRING ObjectName OPTIONAL, IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL, IN HANDLE ClientToken, IN ACCESS_MASK DesiredAccess, IN ACCESS_MASK GrantedAccess, IN PPRIVILEGE_SET Privileges OPTIONAL, IN BOOLEAN ObjectCreation, IN BOOLEAN AccessGranted, OUT PBOOLEAN GenerateOnClose OPTIONAL );
  2073.  
  2074. /*
  2075.     NtOpenProcess (FUNCTION)
  2076.     AccessMask
  2077.      PROCESS_TERMINATE
  2078.     ObjectAttributes
  2079.      or standard processes, all fields of ObjectAttributes should be NULL.
  2080.     ClientId
  2081.      rocess id and thread id must be fill with valid values.
  2082. */
  2083. typedef NTSTATUS (NTAPI *_NtOpenProcess)( OUT PHANDLE ProcessHandle, IN ACCESS_MASK AccessMask, IN POBJECT_ATTRIBUTES ObjectAttributes, IN PCLIENT_ID ClientId );
  2084.  
  2085. /*
  2086.     NtOpenProcessToken (FUNCTION)
  2087.     INFO-0
  2088.      See also PROCESS_INFORMATION_CLASS with ProcessAccessToken information class.
  2089. */
  2090. typedef NTSTATUS (NTAPI *_NtOpenProcessToken)( IN HANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, OUT PHANDLE TokenHandle );
  2091.  
  2092. /*
  2093.     NtOpenSection (FUNCTION)
  2094.     INFO-0
  2095. */
  2096. typedef NTSTATUS (NTAPI *_NtOpenSection)( OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes );
  2097.  
  2098. /*
  2099.     NtOpenSemaphore (FUNCTION)
  2100.     SemaphoreHandle
  2101.      Result of call - pointer to HANDLE to Semaphore Object.
  2102.     DesiredAccess
  2103.      Access rights, descripted in NtCreateSemaphore.
  2104.     ObjectAttributes
  2105.      Pointer to OBJECT_ATTRIBUTES structure containing semaphore's name.
  2106. */
  2107. typedef NTSTATUS (NTAPI *_NtOpenSemaphore)( OUT PHANDLE SemaphoreHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes );
  2108.  
  2109. /*
  2110.     NtOpenSymbolicLinkObject (FUNCTION)
  2111.     INFO-0
  2112. */
  2113. typedef NTSTATUS (NTAPI *_NtOpenSymbolicLinkObject)( OUT PHANDLE pHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes );
  2114.  
  2115. /*
  2116.     NtOpenThread (FUNCTION)
  2117.     ThreadHandle
  2118.      ointer to received handle to thread object.
  2119.     AccessMask
  2120.      ccess mask. See WinNT.h for details.
  2121.     ObjectAttributes
  2122.      ttributes of thread to open. For standard threads there are empty.
  2123.     ClientId
  2124.      ointer to CLIENT_ID structure. Only UniqueThread member is required (difference to NtOpenProcess).
  2125. */
  2126. typedef NTSTATUS (NTAPI *_NtOpenThread)( OUT PHANDLE ThreadHandle, IN ACCESS_MASK AccessMask, IN POBJECT_ATTRIBUTES ObjectAttributes, IN PCLIENT_ID ClientId );
  2127.  
  2128. /*
  2129.     NtOpenThreadToken (FUNCTION)
  2130.     Usually Win32 threads don't have associated Tokens. If you want to associate Token for Thread Object, use
  2131.      NtSetInformationThread with ThreadImpersonationToken information class.
  2132. */
  2133. typedef NTSTATUS (NTAPI *_NtOpenThreadToken)( IN HANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN BOOLEAN OpenAsSelf, OUT PHANDLE TokenHandle );
  2134.  
  2135. /*
  2136.     NtOpenTimer (FUNCTION)
  2137.     TimerHandle
  2138.      Result of call - HANDLE to Timer Object.
  2139.     DesiredAccess
  2140.      Access mask for TimerHandle. See NtCreateTimer for possible values.
  2141.     ObjectAttributes
  2142.      Name of Timer Object.
  2143. */
  2144. typedef NTSTATUS (NTAPI *_NtOpenTimer)( OUT PHANDLE TimerHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes );
  2145.  
  2146. /*
  2147.     NtPrivilegeCheck (FUNCTION)
  2148.     TokenHandle
  2149.      HANDLE to Token Object opened with TOKEN_QUERY access.
  2150.     RequiredPrivileges
  2151.      Pointer to PRIVILEGE_SET structure contains definitions of privileges to check.
  2152.     Result
  2153.      Result of call - pointer to BOOLEAN value containing TRUE is all asked privileges are enabled.
  2154. */
  2155. typedef NTSTATUS (NTAPI *_NtPrivilegeCheck)( IN HANDLE TokenHandle, IN PPRIVILEGE_SET RequiredPrivileges, IN PBOOLEAN Result );
  2156.  
  2157. /*
  2158.     NtPrivilegedServiceAuditAlarm (FUNCTION)
  2159.     ClientToken
  2160.      HANDLE to Token Object opened with TOKEN_QUERY access.
  2161.     ClientPrivileges
  2162.      Pointer to PRIVILEGE_SET structure contains valid data.
  2163. */
  2164. typedef NTSTATUS (NTAPI *_NtPrivilegedServiceAuditAlarm)( IN PUNICODE_STRING SubsystemName OPTIONAL, IN PUNICODE_STRING ServiceName OPTIONAL, IN HANDLE ClientToken, IN PPRIVILEGE_SET ClientPrivileges, IN BOOLEAN AccessGranted );
  2165.  
  2166. /*
  2167.     NtPrivilegeObjectAuditAlarm (FUNCTION)
  2168.     ObjectHandle
  2169.      This can be any value.
  2170.     ClientToken
  2171.      HANDLE to Token Object opened with TOKEN_QUERY access.
  2172.     ClientPrivileges
  2173.      Pointer to PRIVILEGE_SET structure filled with valid data.
  2174. */
  2175. typedef NTSTATUS (NTAPI *_NtPrivilegeObjectAuditAlarm)( IN PUNICODE_STRING SubsystemName OPTIONAL, IN HANDLE ObjectHandle OPTIONAL, IN HANDLE ClientToken, IN ULONG DesiredAccess, IN PPRIVILEGE_SET ClientPrivileges, IN BOOLEAN AccessGranted );
  2176.  
  2177. /*
  2178.     NtProtectVirtualMemory (FUNCTION)
  2179.     ProcessHandle
  2180.      andle to Process Object opened with PROCESS_VM_OPERATION access.
  2181.     *BaseAddress
  2182.      ointer to base address to protect. Protection will change on all page containing specified address. On output, BaseAddress will point to page start address.
  2183.     NumberOfBytesToProtect
  2184.      ointer to size of region to protect. On output will be round to page size (4KB).
  2185.     NewAccessProtection
  2186.      ne or some of PAGE_... attributess.
  2187.     OldAccessProtection
  2188.      eceive previous protection.
  2189. */
  2190. typedef NTSTATUS (NTAPI *_NtProtectVirtualMemory)( IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress, IN OUT PULONG NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection );
  2191.  
  2192. /*
  2193.     NtPulseEvent (FUNCTION)
  2194.     INFO-0
  2195.      Function sets event to signaled state, releases all (or one - dependly of EVENT_TYPE) waiting threads, and resets event to non-signaled state. If they're no waiting threads, NtPulseEvent just clear event state.
  2196. */
  2197. typedef NTSTATUS (NTAPI *_NtPulseEvent)( IN HANDLE EventHandle, OUT PLONG PreviousState OPTIONAL );
  2198.  
  2199. /*
  2200.     NtQueryAttributesFile (FUNCTION)
  2201.     INFO-0
  2202.      Use of NtQueryAttributesFile is the easiest and the best way to check if file exist. NtOpenFile isn't good for this, becouse it modifies last access time for opened file. See NtQueryDirectoryFile for details.
  2203. */
  2204. typedef NTSTATUS (NTAPI *_NtQueryAttributesFile)( IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PFILE_BASIC_INFORMATION FileAttributes );
  2205.  
  2206. /*
  2207.     NtQueryDefaultLocale (FUNCTION)
  2208.     UserProfile
  2209.      If set, function returns UserMode default locale. If not, result is system locale.
  2210.     DefaultLocaleId
  2211.      Pointer to LCID value receiving current locale.
  2212. */
  2213. typedef NTSTATUS (NTAPI *_NtQueryDefaultLocale)( IN BOOLEAN UserProfile, OUT PLCID DefaultLocaleId );
  2214.  
  2215. /*
  2216.     NtQueryDirectoryFile (FUNCTION)
  2217.     FileHandle
  2218.      HANDLE to File Object opened with FILE_DIRECTORY_FILE option and FILE_LIST_DIRECTORY access.
  2219.     Event
  2220.      Optional HANDLE to Event Object signaled after query complete.
  2221.     ApcRoutine
  2222.      Optinal pointer to user's APC routine queued after query complete.
  2223.     ApcContext
  2224.      Parameter for ApcRoutine.
  2225.     IoStatusBlock
  2226.      Pointer to IO_STATUS_BLOCK structure. After enumeration complete, Information member of this structure contains number of bytes writed into FileInformation buffer. Status member contains IO result of call, and can be one of:
  2227.         STATUS_SUCCESS - Enumeration has results in FileInformation buffer.
  2228.         STATUS_NO_MORE_FILES - FileInformation buffer is empty, and next call isn't needed.
  2229.     FileInformation
  2230.      User's allocated buffer for output data.
  2231.     Length
  2232.      Length of FileInformation buffer, in bytes.
  2233.     FileInformationClass
  2234.      Information class. Can be one of:
  2235.         FileDirectoryInformation   
  2236.         FileFullDirectoryInformation
  2237.     ReturnSingleEntry
  2238.      If set, only one entry is returned.
  2239.     FileMask
  2240.      If specified, only information about files matches this wildchar mask will be returned.
  2241.     RestartScan
  2242.      Used with ReturnSingleEntry parameter. If set, NtQueryDirectoryFile continue enumeration after last enumerated element in previous call. If no, returns the first entry in directory.
  2243. */
  2244. typedef NTSTATUS (NTAPI *_NtQueryDirectoryFile)( IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass, IN BOOLEAN ReturnSingleEntry, IN PUNICODE_STRING FileMask OPTIONAL, IN BOOLEAN RestartScan );
  2245.  
  2246. /*
  2247.     NtQueryDirectoryObject (FUNCTION)
  2248.     DirectoryObjectHandle
  2249.      andle to Directory Object opened with DIRECTORY_QUERY access.
  2250.     DirObjInformation
  2251.      ointer to OBJDIR_INFORMATION structure. Warning: structure has variable length dependly to length of object name.
  2252.     BufferLength
  2253.      ength of DirObjInformation buffer.
  2254.     GetNextIndex
  2255.      ecide of ObjectIndex parameter usage on output.
  2256.     IgnoreInputIndex
  2257.      ecide how to use ObjectIndex on function input.
  2258.     ObjectIndex
  2259.      ointer to ULONG value described above.
  2260.     DataWritten
  2261.      ointer to ULONG value receiving required / written buffer size. This parameter is optional.
  2262. */
  2263. typedef NTSTATUS (NTAPI *_NtQueryDirectoryObject)( IN HANDLE DirectoryObjectHandle, OUT POBJDIR_INFORMATION DirObjInformation, IN ULONG BufferLength, IN BOOLEAN GetNextIndex, IN BOOLEAN IgnoreInputIndex, IN OUT PULONG ObjectIndex, OUT PULONG DataWritten OPTIONAL );
  2264.  
  2265. /*
  2266.     NtQueryEaFile (FUNCTION)
  2267.     INFO-0
  2268.      NtQueryEaFile is used to read EA from NTFS file. For more information about EA see FILE_FULL_EA_INFORMATION.
  2269.     FileHandle
  2270.      HANDLE to File Object opened with FILE_READ_EA access.
  2271.     IoStatusBlock
  2272.      IO result of call.
  2273.     Buffer
  2274.      Caller's allocated buffer for output data. See FILE_FULL_EA_INFORMATION for detailed description of fields avaiable in buffer.
  2275.     Length
  2276.      Length of buffer, in bytes.
  2277.     ReturnSingleEntry
  2278.      If set, only one entry is returned.
  2279.     EaList
  2280.      Optional list of FILE_GET_EA_INFORMATION structures containing names of EA.
  2281.     EaListLength
  2282.      Length of EaList, in bytes.
  2283.     EaIndex
  2284.      Pointer to ULONG value contains 1-based index of queried attribute.
  2285.     RestartScan
  2286.      If set, result is the first quered EA.
  2287. */
  2288. typedef NTSTATUS (NTAPI *_NtQueryEaFile)( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN ReturnSingleEntry, IN PVOID EaList OPTIONAL, IN ULONG EaListLength, IN PULONG EaIndex OPTIONAL, IN BOOLEAN RestartScan );
  2289.  
  2290. /*
  2291.     NtQueryEvent (FUNCTION)
  2292.     INFO-0
  2293.      Currently there're only one information class for use with Event Object. See EVENT_INFORMATION_CLASS for details.
  2294. */
  2295. typedef NTSTATUS (NTAPI *_NtQueryEvent)( IN HANDLE EventHandle, IN EVENT_INFORMATION_CLASS EventInformationClass, OUT PVOID EventInformation, IN ULONG EventInformationLength, OUT PULONG ReturnLength OPTIONAL );
  2296.  
  2297. /*
  2298.     NtQueryFullAttributesFile (FUNCTION)
  2299.     ObjectAttributes
  2300.      Path and name of File Object to query.
  2301.     Attributes
  2302.      Pointer to FILE_NETWORK_OPEN_INFORMATION structure.
  2303. */
  2304. typedef NTSTATUS (NTAPI *_NtQueryFullAttributesFile)( IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PVOID Attributes );
  2305.  
  2306. /*
  2307.     NtQueryInformationAtom (FUNCTION)
  2308.     Atom
  2309.      Atom to query. If AtomInformationClass parameter is AtomTableInformation, Atom parameter is not used.
  2310.     AtomInformationClass
  2311.      See ATOM_INFORMATION_CLASS enumeration type for details.
  2312.     AtomInformation
  2313.      Result of call - pointer to user's allocated buffer for data.
  2314.     AtomInformationLength
  2315.      Size of AtomInformation buffer, in bytes.
  2316.     ReturnLength
  2317.      Pointer to ULONG value contains required AtomInformation buffer size.
  2318. */
  2319. typedef NTSTATUS (NTAPI *_NtQueryInformationAtom)( IN RTL_ATOM Atom, IN ATOM_INFORMATION_CLASS AtomInformationClass, OUT PVOID AtomInformation, IN ULONG AtomInformationLength, OUT PULONG ReturnLength OPTIONAL );
  2320.  
  2321. /*
  2322.     NtQueryInformationFile (FUNCTION)
  2323.     INFO-0
  2324. */
  2325. typedef NTSTATUS (NTAPI *_NtQueryInformationFile)( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass );
  2326.  
  2327. /*
  2328.     NtQueryInformationPort (FUNCTION)
  2329.     INFO-0
  2330.      Currently (on WinNT 4.0 SP6) there are no information classes for Port Object.
  2331.     INFO-1
  2332.      PortHandle
  2333.     INFO-2
  2334.      PortInformationClass
  2335.     INFO-3
  2336.      PortInformation
  2337.     INFO-4
  2338.      Length
  2339.     INFO-5
  2340.      ResultLength
  2341. */
  2342. typedef NTSTATUS (NTAPI *_NtQueryInformationPort)( IN HANDLE PortHandle, IN PORT_INFORMATION_CLASS PortInformationClass, OUT PVOID PortInformation, IN ULONG Length, OUT PULONG ResultLength OPTIONAL );
  2343.  
  2344. /*
  2345.     NtQueryInformationProcess (FUNCTION)
  2346.     ProcessHandle
  2347.      andle to process opened with PROCESS_QUERY_INFORMATION access.
  2348.     ProcessInformationClass
  2349.      ee PROCESS_INFORMATION_CLASS.
  2350.     ProcessInformation
  2351.      uffer for results.
  2352.     ProcessInformationLength
  2353.      ength of buffer. See PROCESS_INFORMATION_CLASS for additional information.
  2354.     ReturnLength
  2355.      umber of bytes needed, if ProcessInformationLength was too small.
  2356. */
  2357. typedef NTSTATUS (NTAPI *_NtQueryInformationProcess)( IN HANDLE ProcessHandle, IN PROCESS_INFORMATION_CLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength );
  2358.  
  2359. /*
  2360.     NtQueryInformationThread (FUNCTION)
  2361.     ThreadHandle
  2362.      andle to Thread Object opened with THREAD_QUERY_INFORMATION access.
  2363.     ThreadInformationClass
  2364.      nformation class defined in THREAD_INFORMATION_CLASS enumerated type.
  2365.     ThreadInformation
  2366.      aller's allocated buffer for results.
  2367.     ThreadInformationLength
  2368.      ength of buffer, in bytes.
  2369.     ReturnLength
  2370.      ptional pointer to required buffer length.
  2371.     INFO-5
  2372.      <HR WIDTH="40%">
  2373.     INFO-6
  2374.      See THREAD_INFORMATION_CLASS for more information.
  2375. */
  2376. typedef NTSTATUS (NTAPI *_NtQueryInformationThread)( IN HANDLE ThreadHandle, IN THREAD_INFORMATION_CLASS ThreadInformationClass, OUT PVOID ThreadInformation, IN ULONG ThreadInformationLength, OUT PULONG ReturnLength OPTIONAL );
  2377.  
  2378. /*
  2379.     NtQueryInformationToken (FUNCTION)
  2380.     TokenHandle
  2381.      HANDLE to Token Object opened with TOKEN_QUERY access.
  2382.     TokenInformationClass
  2383.      Information class descripted in TOKEN_INFORMATION_CLASS topic.
  2384.     TokenInformation
  2385.      User's allocated buffer for output data. Format of output buffer depends on TokenInformationClass parameter.
  2386.     TokenInformationLength
  2387.      Length of TokenInformation buffer, in bytes.
  2388.     ReturnLength
  2389.      If output buffer is to small, value under this parameter receives required length.
  2390. */
  2391. typedef NTSTATUS (NTAPI *_NtQueryInformationToken)( IN HANDLE TokenHandle, IN TOKEN_INFORMATION_CLASS TokenInformationClass, OUT PVOID TokenInformation, IN ULONG TokenInformationLength, OUT PULONG ReturnLength );
  2392.  
  2393. /*
  2394.     NtQueryIntervalProfile (FUNCTION)
  2395.     ProfileSource
  2396.      Performance counter identifier defined in KPROFILE_SOURCE enumeration type.
  2397.     Interval
  2398.      Pointer to ULONG value receiving current interval, in ms. If received value is zero, counter specified in ProfileSource parameter is hardware counter (performacne counter build in CPU).
  2399. */
  2400. typedef NTSTATUS (NTAPI *_NtQueryIntervalProfile)( IN KPROFILE_SOURCE ProfileSource, OUT PULONG Interval );
  2401.  
  2402. /*
  2403.     NtQueryIoCompletion (FUNCTION)
  2404.     IoCompletionHandle
  2405.      HANDLE to IO Completion Object opened with IO_COMPLETION_QUERY_STATE access.
  2406.     InformationClass
  2407.      See IO_COMPLETION_INFORMATION_CLASS for possible values.
  2408.     IoCompletionInformation
  2409.      User's allocated buffer for result data.
  2410.     InformationBufferLength
  2411.      Length of IoCompletionInformation buffer, in bytes.
  2412.     RequiredLength
  2413.      Optionally receives required length of buffer.
  2414. */
  2415. typedef NTSTATUS (NTAPI *_NtQueryIoCompletion)( IN HANDLE IoCompletionHandle, IN IO_COMPLETION_INFORMATION_CLASS InformationClass, OUT PVOID IoCompletionInformation, IN ULONG InformationBufferLength, OUT PULONG RequiredLength OPTIONAL );
  2416.  
  2417. /*
  2418.     NtQueryKey (FUNCTION)
  2419.     INFO-0
  2420.      See ZwQueryKey in NT DDK or 2000 DDK for detailed description.
  2421. */
  2422. typedef NTSTATUS (NTAPI *_NtQueryKey)( IN HANDLE KeyHandle, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT PVOID KeyInformation, IN ULONG Length, OUT PULONG ResultLength );
  2423.  
  2424. /*
  2425.     NtQueryMultipleValueKey (FUNCTION)
  2426.     KeyHandle
  2427.      HANDLE to Key Object opened with KEY_READ access.
  2428.     ValuesList
  2429.      Array of KEY_MULTIPLE_VALUE_INFORMATION structures contains names of values to query.
  2430.     NumberOfValues
  2431.      Number of members in ValueList array.
  2432.     DataBuffer
  2433.      User's allocated buffer receiving queried value's data.
  2434.     BufferLength
  2435.      Pointer to value specifing length of DataBuffer, in bytes.
  2436.     RequiredLength
  2437.      Optionally pointer to value receiving required DataBuffer length, in bytes.
  2438. */
  2439. typedef NTSTATUS (NTAPI *_NtQueryMultipleValueKey)( IN HANDLE KeyHandle, IN OUT PKEY_MULTIPLE_VALUE_INFORMATION ValuesList, IN ULONG NumberOfValues, OUT PVOID DataBuffer, IN OUT ULONG BufferLength, OUT PULONG RequiredLength OPTIONAL );
  2440.  
  2441. /*
  2442.     NtQueryMutant (FUNCTION)
  2443.     MutantHandle
  2444.      andle to Mutant object.
  2445.     MutantInformationClass
  2446.      s defined as enum:
  2447.     INFO-2
  2448.         } MUTANT_INFORMATION_CLASS, *PMUTANT_INFORMATION_CLASS;
  2449.     MutantInformation
  2450.      uffer for result. As long as only one information type is defined, set MutantInformation as a pointer to MUTANT_BASIC_INFORMATION structure.
  2451.     MutantInformationLength
  2452.      ize of buffer.
  2453.     ResultLength
  2454.      umber of bytes written to buffer.
  2455. */
  2456. typedef NTSTATUS (NTAPI *_NtQueryMutant)( IN HANDLE MutantHandle, IN MUTANT_INFORMATION_CLASS MutantInformationClass, OUT PVOID MutantInformation, IN ULONG MutantInformationLength, OUT PULONG ResultLength OPTIONAL );
  2457.  
  2458. /*
  2459.     NtQueryObject (FUNCTION)
  2460.     INFO-0
  2461.      Function NtQueryObject retrives some informations about any or all objects opened by calling process. It can be used with any type of object.
  2462.     ObjectHandle
  2463.      HANDLE to object.
  2464.     ObjectInformationClass
  2465.      Kind of information to retrive. See OBJECT_INFORMATION_CLASS for possible values list.
  2466.     ObjectInformation
  2467.      Output buffer allocated by caller.
  2468.     Length
  2469.      Length of ObjectInformation buffer, in bytes.
  2470.     ResultLength
  2471.      Pointer to ULONG value that contains required size of ObjectInformation buffer after function call.
  2472. */
  2473. typedef NTSTATUS (NTAPI *_NtQueryObject)( IN HANDLE ObjectHandle, IN OBJECT_INFORMATION_CLASS ObjectInformationClass, OUT PVOID ObjectInformation, IN ULONG Length, OUT PULONG ResultLength );
  2474.  
  2475. /*
  2476.     NtQueryOleDirectoryFile (FUNCTION)
  2477.     INFO-0
  2478.      All function's parameters are descripted in NtQueryDirectoryFile section.
  2479. */
  2480. typedef NTSTATUS (NTAPI *_NtQueryOleDirectoryFile)( IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass, IN BOOLEAN ReturnSingleEntry, IN PUNICODE_STRING FileMask OPTIONAL, IN BOOLEAN RestartScan );
  2481.  
  2482. /*
  2483.     NtQueryPerformanceCounter (FUNCTION)
  2484.     INFO-0
  2485.      Another method of uptime calculation :
  2486.     INFO-1
  2487.      UpTime = PerformanceCounter / PerformanceFrequency;
  2488. */
  2489. typedef NTSTATUS (NTAPI *_NtQueryPerformanceCounter)( OUT PLARGE_INTEGER PerformanceCounter, OUT PLARGE_INTEGER PerformanceFrequency OPTIONAL );
  2490.  
  2491. /*
  2492.     NtQuerySection (FUNCTION)
  2493.     InformationClass
  2494.      Use one of following:
  2495.     INFO-1
  2496.      SectionImageInformation Are avaiable only for file-based sections.
  2497. */
  2498. typedef NTSTATUS (NTAPI *_NtQuerySection)( IN HANDLE SectionHandle, IN SECTION_INFORMATION_CLASS InformationClass, OUT PVOID InformationBuffer, IN ULONG InformationBufferSize, OUT PULONG ResultLength OPTIONAL );
  2499.  
  2500. /*
  2501.     NtQuerySecurityObject (FUNCTION)
  2502.     ObjectHandle
  2503.      HANDLE to any object opened with READ_CONTROL access.
  2504.     SecurityInformationClass
  2505.      Can be combination of:
  2506.         OWNER_SECURITY_INFORMATION
  2507.         GROUP_SECURITY_INFORMATION
  2508.     DescriptorBuffer
  2509.      Result of call - pointer to SECURITY_DESCRIPTOR structure.
  2510.     DescriptorBufferLength
  2511.      Size of buffer, in bytes.
  2512.     RequiredLength
  2513.      Pointer to value receiving required length of buffer.
  2514. */
  2515. typedef NTSTATUS (NTAPI *_NtQuerySecurityObject)( IN HANDLE ObjectHandle, IN SECURITY_INFORMATION SecurityInformationClass, OUT PSECURITY_DESCRIPTOR DescriptorBuffer, IN ULONG DescriptorBufferLength, OUT PULONG RequiredLength );
  2516.  
  2517. /*
  2518.     NtQuerySemaphore (FUNCTION)
  2519.     SemaphoreHandle
  2520.      HANDLE to Semaphore Object opened with SEMAPHORE_QUERY_STATE access.
  2521.     SemaphoreInformationClass
  2522.      Information class descripted in SEMAPHORE_INFORMATION_CLASS section.
  2523.     SemaphoreInformation
  2524.      Pointer to user's allocated buffer for result data.
  2525.     SemaphoreInformationLength
  2526.      Size of SemaphoreInformation buffer, in bytes.
  2527.     ReturnLength
  2528.      Optionally returns required buffer size.
  2529. */
  2530. typedef NTSTATUS (NTAPI *_NtQuerySemaphore)( IN HANDLE SemaphoreHandle, IN SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass, OUT PVOID SemaphoreInformation, IN ULONG SemaphoreInformationLength, OUT PULONG ReturnLength OPTIONAL );
  2531.  
  2532. /*
  2533.     NtQuerySymbolicLinkObject (FUNCTION)
  2534.     pLinkName
  2535.      Received path to destination object.
  2536. */
  2537. typedef NTSTATUS (NTAPI *_NtQuerySymbolicLinkObject)( IN HANDLE SymbolicLinkHandle, OUT PUNICODE_STRING pLinkName, OUT PULONG pDataWritten OPTIONAL );
  2538.  
  2539. /*
  2540.     NtQuerySystemEnvironmentValue (FUNCTION)
  2541.     INFO-0
  2542.      Seems not works on NT 4.0 SP6. Control Panel applet query and set System Environment values by Rtl...Environment functions or directly by registry.
  2543. */
  2544. typedef NTSTATUS (NTAPI *_NtQuerySystemEnvironmentValue)( IN PUNICODE_STRING VariableName, OUT PWCHAR Value, IN ULONG ValueBufferLength, OUT PULONG RequiredLength OPTIONAL );
  2545.  
  2546. /*
  2547.     NtQuerySystemInformation (FUNCTION)
  2548.     SystemInformationClass
  2549.      Information class (see SYSTEM_INFORMATION_CLASS).
  2550.     SystemInformation
  2551.      User-allocated buffer for results. Sometimes this parameter can be NULL (OPTIONAL), if you check required buffer size (see below).
  2552.     SystemInformationLength
  2553.      Length of SystemInformation buffer (in bytes).
  2554.     ReturnLength
  2555.      Required length of SystemInformation buffer.
  2556. */
  2557. typedef NTSTATUS (NTAPI *_NtQuerySystemInformation)( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL );
  2558.  
  2559. /*
  2560.     NtQuerySystemTime (FUNCTION)
  2561.     SystemTime
  2562.      Pointer to LARGE_INTEGER value receiving current time.
  2563. */
  2564. typedef NTSTATUS (NTAPI *_NtQuerySystemTime)( OUT PLARGE_INTEGER SystemTime );
  2565.  
  2566. /*
  2567.     NtQueryTimer (FUNCTION)
  2568.     TimerHandle
  2569.      HANDLE to Timer Object opened with TIMER_QUERY_STATE access.
  2570.     TimerInformationClass
  2571.      Information class. See TIMER_INFORMATION_CLASS for details.
  2572.     TimerInformation
  2573.      User's allocated buffer for result data.
  2574.     TimerInformationLength
  2575.      Length of TimerInformation buffer, in bytes.
  2576.     ReturnLength
  2577.      Optional pointer to value received used/required length of TimerInformation buffer.
  2578. */
  2579. typedef NTSTATUS (NTAPI *_NtQueryTimer)( IN HANDLE TimerHandle, IN TIMER_INFORMATION_CLASS TimerInformationClass, OUT PVOID TimerInformation, IN ULONG TimerInformationLength, OUT PULONG ReturnLength OPTIONAL );
  2580.  
  2581. /*
  2582.     NtQueryTimerResolution (FUNCTION)
  2583.     MinimumResolution
  2584.      Means highest possible delay (in 100-ns units) between timer events.
  2585.     MaximumResolution
  2586.      Means lowest possible delay (in 100-ns units) between timer events.
  2587.     CurrentResolution
  2588.      Current timer resolution, in 100-ns units.
  2589. */
  2590. typedef NTSTATUS (NTAPI *_NtQueryTimerResolution)( OUT PULONG MinimumResolution, OUT PULONG MaximumResolution, OUT PULONG CurrentResolution );
  2591.  
  2592. /*
  2593.     NtQueryValueKey (FUNCTION)
  2594.     INFO-0
  2595.      See ZwQueryValueKey in NT DDK or 2000 DDK for detailed description.
  2596. */
  2597. typedef NTSTATUS (NTAPI *_NtQueryValueKey)( IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, OUT PVOID KeyValueInformation, IN ULONG Length, OUT PULONG ResultLength );
  2598.  
  2599. /*
  2600.     NtQueryVirtualMemory (FUNCTION)
  2601.     ProcessHandle
  2602.      HANDLE to process containing queried address in process'es address space.
  2603.     BaseAddress
  2604.      Virtual address to query.
  2605.     MemoryInformationClass
  2606.      Information class defined in MEMORY_INFORMATION_CLASS enumeration type. Currently only one class is supported.
  2607.     Buffer
  2608.      As long as only MemoryBasicInformation is supported, this value points to structure MEMORY_BASIC_INFORMATION, defined in &lt;WINNT.h&gt; and described in MS SDK.
  2609.     Length
  2610.      Length of Buffer, in bytes.
  2611.     ResultLength
  2612.      Optionally pointer to ULONG value receiving required size of Buffer, in bytes.
  2613. */
  2614. typedef NTSTATUS (NTAPI *_NtQueryVirtualMemory)( IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN MEMORY_INFORMATION_CLASS MemoryInformationClass, OUT PVOID Buffer, IN ULONG Length, OUT PULONG ResultLength OPTIONAL );
  2615.  
  2616. /*
  2617.     NtQueryVolumeInformationFile (FUNCTION)
  2618.     INFO-0
  2619.      NtQueryVolumeInformationFile gives information about volume (device) containing file specified as FileHandle parameter.
  2620. */
  2621. typedef NTSTATUS (NTAPI *_NtQueryVolumeInformationFile)( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FileSystemInformation, IN ULONG Length, IN FS_INFORMATION_CLASS FileSystemInformationClass );
  2622.  
  2623. /*
  2624.     NtQueueApcThread (FUNCTION)
  2625.     ThreadHandle
  2626.      pen handle to any Thread Object, including caller's thread.
  2627.     ApcRoutine
  2628.      ntry point to user APC routine.
  2629.     ApcRoutineContext
  2630.      ser defined parameter for ApcRoutine.
  2631.     INFO-5
  2632.      <HR WIDTH="40%">
  2633.     INFO-6
  2634.      Function adds user defined routine to thread's APC queue. This routine will be executed when thread will be signaled. You can manually empty APC queue by calling NtTestAlert.
  2635. */
  2636. typedef NTSTATUS (NTAPI *_NtQueueApcThread)( IN HANDLE ThreadHandle, IN PIO_APC_ROUTINE ApcRoutine, IN PVOID ApcRoutineContext OPTIONAL, IN PIO_STATUS_BLOCK ApcStatusBlock OPTIONAL, IN ULONG ApcReserved OPTIONAL );
  2637.  
  2638. /*
  2639.     NtRaiseException (FUNCTION)
  2640.     ExceptionRecord
  2641.      Pointer to EXCEPTION_RECORD structure containing typical information about error.
  2642.     ThreadContext
  2643.      Pointer to CONTEXT structure.
  2644.     HandleException
  2645.      If not set, calling process is killed. If set, system tries to execute actually enabled Exception Handler procedure with parameters specified aa ExceptionRecord and ThreadContext.
  2646. */
  2647. typedef NTSTATUS (NTAPI *_NtRaiseException)( IN PEXCEPTION_RECORD ExceptionRecord, IN PCONTEXT ThreadContext, IN BOOLEAN HandleException );
  2648.  
  2649. /*
  2650.     NtRaiseHardError (FUNCTION)
  2651.     INFO-0
  2652.      NtRaiseHardError is easy way to display message in GUI without loading Win32 API libraries.
  2653. */
  2654. typedef NTSTATUS (NTAPI *_NtRaiseHardError)( IN NTSTATUS ErrorStatus, IN ULONG NumberOfParameters, IN PUNICODE_STRING UnicodeStringParameterMask OPTIONAL, IN PVOID *Parameters, IN HARDERROR_RESPONSE_OPTION ResponseOption, OUT PHARDERROR_RESPONSE Response );
  2655.  
  2656. /*
  2657.     NtReadFile (FUNCTION)
  2658.     INFO-0
  2659.      (Also descripted in Win2000 DDK)
  2660.     FileHandle
  2661.      HANDLE to File Object opened with FILE_READ_DATA access.
  2662.     Event
  2663.      Optional HANDLE to Event Object signaled when reading is done.
  2664.     ApcRoutine
  2665.      User defined APC routine queued for execute after reading is done.
  2666.     ApcContext
  2667.      User parameter to ApcRoutine.
  2668.     IoStatusBlock
  2669.      Pointer to IO_STATUS structure received IO status of file reading.
  2670.     Buffer
  2671.      User-allocated buffer for readed data.
  2672.     Length
  2673.      Length of Buffer, in bytes.
  2674.     ByteOffset
  2675.      Offset from begining of file, in bytes.
  2676. */
  2677. typedef NTSTATUS (NTAPI *_NtReadFile)( IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG Length, IN PLARGE_INTEGER ByteOffset OPTIONAL, IN PULONG Key OPTIONAL );
  2678.  
  2679. /*
  2680.     NtReadFileScatter (FUNCTION)
  2681.     FileHandle
  2682.      HANDLE to File Object opened with FILE_READ_DATA access and with FILE_NO_INTERMEDIATE_BUFFERING open option.
  2683.     Event
  2684.      HANDLE to Event Object signaled when reading is complete. This parameter is optional, but caller should use one of notification way, becouse function always use asynchronous reading method.
  2685.     ApcRoutine
  2686.      Optional pointer to user's APC Routine.
  2687.     ApcContext
  2688.      User's parameter for ApcRoutine.
  2689.     IoStatusBlock
  2690.      IO result of call.
  2691.     SegmentArray
  2692.      Array of FILE_SEGMENT_ELEMENT unions. Any element point to allocated memory page address. Last element of array must be NULL.
  2693.     Length
  2694.      Number of bytes to read.
  2695.     ByteOffset
  2696.      Pointer to LARGE_INTEGER value indicates reading start position.
  2697.     Key
  2698.      Optional pointer to user's key, used when file is locked (see NtLockFile).
  2699. */
  2700. typedef NTSTATUS (NTAPI *_NtReadFileScatter)( IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN FILE_SEGMENT_ELEMENT SegmentArray, IN ULONG Length, IN PLARGE_INTEGER ByteOffset, IN PULONG Key OPTIONAL );
  2701.  
  2702. /*
  2703.     NtReadRequestData (FUNCTION)
  2704.     PortHandle
  2705.      HANDLE to Port Object opened in a result of call NtAcceptConnectPort.
  2706.     INFO-1
  2707.      Request
  2708.     INFO-2
  2709.      DataIndex
  2710.     INFO-3
  2711.      Buffer
  2712.     INFO-4
  2713.      Length
  2714.     INFO-5
  2715.      ResultLength
  2716. */
  2717. typedef NTSTATUS (NTAPI *_NtReadRequestData)( IN HANDLE PortHandle, IN PLPC_MESSAGE Request, IN ULONG DataIndex, OUT PVOID Buffer, IN ULONG Length, OUT PULONG ResultLength OPTIONAL );
  2718.  
  2719. /*
  2720.     NtReadVirtualMemory (FUNCTION)
  2721.     INFO-0
  2722.      NtReadVirtualMemory is similar to API ReadProcessMemory, described in MS SDK.
  2723. */
  2724. typedef NTSTATUS (NTAPI *_NtReadVirtualMemory)( IN HANDLE ProcessHandle, IN PVOID BaseAddress, OUT PVOID Buffer, IN ULONG NumberOfBytesToRead, OUT PULONG NumberOfBytesReaded OPTIONAL );
  2725.  
  2726. /*
  2727.     NtRegisterThreadTerminatePort (FUNCTION)
  2728.     Typically, NtRegisterThreadTerminatePort is used in CsrNewThread function, called before thread execution begins, but in thread context.
  2729.      Function associate PortHandle with thread, and sends LPC_TERMINATION_MESSAGE to specified port immediatelly after call NtTerminateThread.
  2730. */
  2731. typedef NTSTATUS (NTAPI *_NtRegisterThreadTerminatePort)( IN HANDLE PortHandle );
  2732.  
  2733. /*
  2734.     NtReleaseKeyedEvent (FUNCTION)
  2735.     INFO-0
  2736.      This function is used for signal KeyedEvent object with value specified as Key parameter. If there are no other thread (or threads) waiting for the same KeyedEvent with the same Key value, waiting is performed up to NtWaitForKeyedEvent called by any other thread.
  2737.     KeyedEventHandle
  2738.      HANDLE to KeyedEvent object.
  2739.     Key
  2740.      Value used as KEY. Note that this value has to have lowest bit cleared (must divide by two).
  2741.     Alertable
  2742.      If set, waiting can be broken by alerting thread.
  2743.     Timeout
  2744.      Optional pointer for timeout value.
  2745.     Supported on system versions:
  2746.      Win XP/2003
  2747. */
  2748. typedef NTSTATUS (NTAPI *_NtReleaseKeyedEvent)( IN HANDLE KeyedEventHandle, IN PVOID Key, IN BOOLEAN Alertable, IN PLARGE_INTEGER Timeout OPTIONAL );
  2749.  
  2750. /*
  2751.     NtReleaseMutant (FUNCTION)
  2752.     PreviousCount
  2753.      nternal mutant counter state before call NtReleaseMutant.
  2754. */
  2755. typedef NTSTATUS (NTAPI *_NtReleaseMutant)( IN HANDLE MutantHandle, OUT PLONG PreviousCount OPTIONAL );
  2756.  
  2757. /*
  2758.     NtReleaseSemaphore (FUNCTION)
  2759.     SemaphoreHandle
  2760.      HANDLE to Semaphore Object opened with SEMAPHORE_MODIFY_STATE access.
  2761.     ReleaseCount
  2762.      Number of increments, typically set to 1.
  2763.     PreviousCount
  2764.      Optional pointer to ULONG value receiving semaphore's counter state before call.
  2765. */
  2766. typedef NTSTATUS (NTAPI *_NtReleaseSemaphore)( IN HANDLE SemaphoreHandle, IN ULONG ReleaseCount, OUT PULONG PreviousCount OPTIONAL );
  2767.  
  2768. /*
  2769.     NtRemoveIoCompletion (FUNCTION)
  2770.     IoCompletionHandle
  2771.      HANDLE to previously created or opened Io Completion object.
  2772.     CompletionKey
  2773.      Receives completion Key informing about File object who finishes I/O.
  2774.     CompletionValue
  2775.      Value of ApcContext file operation parameter. CompletionValue informs about operation finished.
  2776.     IoStatusBlock
  2777.      Io status of finished operation.
  2778.     Timeout
  2779.      Optionally pointer to time out value.
  2780.     Supported on system versions:
  2781.      NT 4.0,Win 2000,Win XP/2003
  2782. */
  2783. typedef NTSTATUS (NTAPI *_NtRemoveIoCompletion)( IN HANDLE IoCompletionHandle, OUT PULONG CompletionKey, OUT PULONG CompletionValue, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER Timeout OPTIONAL );
  2784.  
  2785. /*
  2786.     NtReplaceKey (FUNCTION)
  2787.     NewHiveFileName
  2788.      Pointer to OBJECT_ATTRIBUTES structure containing name of third file (file with new contents).
  2789.     KeyHandle
  2790.      HANDLE to Key Object. Backuped and replaced are all keys from hive whith contains key specified by KeyHandle parameter.
  2791.     BackupHiveFileName
  2792.      Pointer to OBJECT_ATTRIBUTES structure containing name of first file (new hive file).
  2793. */
  2794. typedef NTSTATUS (NTAPI *_NtReplaceKey)( IN POBJECT_ATTRIBUTES NewHiveFileName, IN HANDLE KeyHandle, IN POBJECT_ATTRIBUTES BackupHiveFileName );
  2795.  
  2796. /*
  2797.     NtReplyPort (FUNCTION)
  2798.     INFO-0
  2799.      NtReplyPort can be used by both sides of LPC connection.
  2800.     PortHandle
  2801.      HANDLE to Port Object.
  2802.     Reply
  2803.      Pointer to LPC_MESSAGE structure.
  2804. */
  2805. typedef NTSTATUS (NTAPI *_NtReplyPort)( IN HANDLE PortHandle, IN PLPC_MESSAGE Reply );
  2806.  
  2807. /*
  2808.     NtReplyWaitReceivePort (FUNCTION)
  2809.     INFO-0
  2810. */
  2811. typedef NTSTATUS (NTAPI *_NtReplyWaitReceivePort)( IN HANDLE PortHandle, OUT PHANDLE ReceivePortHandle OPTIONAL, IN PLPC_MESSAGE Reply OPTIONAL, OUT PLPC_MESSAGE IncomingRequest );
  2812.  
  2813. /*
  2814.     NtReplyWaitReplyPort (FUNCTION)
  2815.     INFO-0
  2816.      NtReplyWaitReplyPort sends REPLY and waits for other side REPLY.
  2817.     PortHandle
  2818.      HANDLE to Port Object.
  2819.     Reply
  2820.      There's a pointer to LPC_MESSAGE structure. On input, should be filled with REPLY data by user. On output it contains REPLY from other side.
  2821. */
  2822. typedef NTSTATUS (NTAPI *_NtReplyWaitReplyPort)( IN HANDLE PortHandle, IN OUT PLPC_MESSAGE Reply );
  2823.  
  2824. /*
  2825.     NtRequestPort (FUNCTION)
  2826.     INFO-0
  2827.      NtRequestPort sends request message to other side of LPC connection.
  2828.     PortHandle
  2829.      HANDLE to Port Object.
  2830.     Request
  2831.      Pointer to LPC_MESSAGE struct contains request data.
  2832. */
  2833. typedef NTSTATUS (NTAPI *_NtRequestPort)( IN HANDLE PortHandle, IN PLPC_MESSAGE Request );
  2834.  
  2835. /*
  2836.     NtRequestWaitReplyPort (FUNCTION)
  2837.     INFO-0
  2838.      NtRequestWaitReplyPort is used typically by client side in LPC connection.
  2839.     PortHandle
  2840.      HANDLE to Port Object.
  2841.     Request
  2842.      Pointer to LPC_MESSAGE buffer contains request data.
  2843.     IncomingReply
  2844.      Pointer to LPC_MESSAGE buffer filled on return with reply from other side.
  2845. */
  2846. typedef NTSTATUS (NTAPI *_NtRequestWaitReplyPort)( IN HANDLE PortHandle, IN PLPC_MESSAGE Request, OUT PLPC_MESSAGE IncomingReply );
  2847.  
  2848. /*
  2849.     NtResetEvent (FUNCTION)
  2850.     EventHandle
  2851.      HANDLE to Event Object opened with EVENT_MODIFY_STATE access.
  2852.     PreviousState
  2853.      Optional pointer to state of event before function call.
  2854.     INFO-2
  2855.      Difference between NtResetEvent and NtClearEvent is the first one can return state of event before call.
  2856. */
  2857. typedef NTSTATUS (NTAPI *_NtResetEvent)( IN HANDLE EventHandle, OUT PLONG PreviousState OPTIONAL );
  2858.  
  2859. /*
  2860.     NtRestoreKey (FUNCTION)
  2861.     KeyHandle
  2862.      All keys and values stored in file represented by FileHandle will be childern of KeyHandle.
  2863.     FileHandle
  2864.      See NtSaveKey for more information about FileHandle.
  2865.     RestoreOption
  2866.      See RegRestoreKey in SDK
  2867. */
  2868. typedef NTSTATUS (NTAPI *_NtRestoreKey)( IN HANDLE KeyHandle, IN HANDLE FileHandle, IN ULONG RestoreOption );
  2869.  
  2870. /*
  2871.     NtResumeThread (FUNCTION)
  2872.     INFO-0
  2873.      See AlertResumeThread.
  2874. */
  2875. typedef NTSTATUS (NTAPI *_NtResumeThread)( IN HANDLE ThreadHandle, OUT PULONG SuspendCount OPTIONAL );
  2876.  
  2877. /*
  2878.     NtSaveKey (FUNCTION)
  2879.     INFO-0
  2880.      KeyHandle
  2881.     FileHandle
  2882.      HANDLE to any file created with write access.
  2883.     Before use FileHandle in other registry function without closing it, call NtFlushKey with KeyHandle
  2884.      as param.
  2885. */
  2886. typedef NTSTATUS (NTAPI *_NtSaveKey)( IN HANDLE KeyHandle, IN HANDLE FileHandle );
  2887.  
  2888. /*
  2889.     NtSetContextThread (FUNCTION)
  2890.     ThreadHandle
  2891.      andle to Thread Object opened with THREAD_SET_CONTEXT access flag.
  2892.     Context
  2893.      ontext to set to thread.
  2894. */
  2895. typedef NTSTATUS (NTAPI *_NtSetContextThread)( IN HANDLE ThreadHandle, IN PCONTEXT Context );
  2896.  
  2897. /*
  2898.     NtSetDefaultHardErrorPort (FUNCTION)
  2899.     PortHandle
  2900.      HANDLE to named Port Object.
  2901. */
  2902. typedef NTSTATUS (NTAPI *_NtSetDefaultHardErrorPort)( IN HANDLE PortHandle );
  2903.  
  2904. /*
  2905.     NtSetDefaultLocale (FUNCTION)
  2906.     UserProfile
  2907.      If set, function sets UserMode locale. If not, KernelMode locale is modified.
  2908.     DefaultLocaleId
  2909.      Locale to set.
  2910. */
  2911. typedef NTSTATUS (NTAPI *_NtSetDefaultLocale)( IN BOOLEAN UserProfile, IN LCID DefaultLocaleId );
  2912.  
  2913. /*
  2914.     NtSetEaFile (FUNCTION)
  2915.     INFO-0
  2916.      See NtQueryEaFile for information about EA.
  2917.     FileHandle
  2918.      HANDLE to File Object opened with FILE_SET_EA access.
  2919.     IoStatusBlock
  2920.      IO result of call.
  2921.     EaBuffer
  2922.      User's allocated input buffer containing one or more FILE_FULL_EA_INFORMATION structures.
  2923.     EaBufferSize
  2924.      Size of EaBuffer, in bytes.
  2925. */
  2926. typedef NTSTATUS (NTAPI *_NtSetEaFile)( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID EaBuffer, IN ULONG EaBufferSize );
  2927.  
  2928. /*
  2929.     NtSetEvent (FUNCTION)
  2930.     EventHandle
  2931.      HANDLE to Event Object opened with EVENT_MODIFY_STATE access.
  2932.     PreviousState
  2933.      State of Event Object before function call.
  2934. */
  2935. typedef NTSTATUS (NTAPI *_NtSetEvent)( IN HANDLE EventHandle, OUT PLONG PreviousState OPTIONAL );
  2936.  
  2937. /*
  2938.     NtSetEventBoostPriority (FUNCTION)
  2939.     INFO-0
  2940.      Function NtSetEventPriorityBoost was added in Windows XP system. Has the same functionality as NtSetEvent, but thread that is waiting on specified Event will be executed immediatelly after context switch, regardless of waiting thread's priority.
  2941.     EventHandle
  2942.      HANDLE to previously created or opened Event object. Note that Event has to be created with EVENT_TYPE set to SynchronizationEvent (automatic reset), in other cases function will return with error.
  2943.     Supported on system versions:
  2944.      Win XP/2003
  2945. */
  2946. typedef NTSTATUS (NTAPI *_NtSetEventBoostPriority)( IN HANDLE EventHandle );
  2947.  
  2948. /*
  2949.     NtSetHighEventPair (FUNCTION)
  2950.     INFO-0
  2951.      Function sets HIGH event state to signalled.
  2952. */
  2953. typedef NTSTATUS (NTAPI *_NtSetHighEventPair)( IN HANDLE EventPairHandle );
  2954.  
  2955. /*
  2956.     NtSetHighWaitLowEventPair (FUNCTION)
  2957.     INFO-0
  2958.      Function signals HIGH event and waits unlit LOW event will be signaled.
  2959. */
  2960. typedef NTSTATUS (NTAPI *_NtSetHighWaitLowEventPair)( IN HANDLE EventPairHandle );
  2961.  
  2962. /*
  2963.     NtSetHighWaitLowThread (FUNCTION)
  2964.     INFO-1
  2965.      <HR WIDTH="40%">
  2966.     INFO-2
  2967.      See also SetInformationThread with ThreadEventPair information class.
  2968. */
  2969. typedef NTSTATUS (NTAPI *_NtSetHighWaitLowThread)( );
  2970.  
  2971. /*
  2972.     NtSetInformationFile (FUNCTION)
  2973.     INFO-0
  2974.      (Description of this function is also avaiable in Win2000 DDK)
  2975.     FileHandle
  2976.      HANDLE to File Object.
  2977.     IoStatusBlock
  2978.      IO result of call.
  2979.     FileInformation
  2980.      User's allocated buffer contains data to set to.
  2981.     Length
  2982.      Length of FileInformation buffer, in bytes.
  2983.     FileInformationClass
  2984.      See FILE_INFORMATION_CLASS for possible information classes and required contents of FileInformation buffer.
  2985. */
  2986. typedef NTSTATUS (NTAPI *_NtSetInformationFile)( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass );
  2987.  
  2988. /*
  2989.     NtSetInformationKey (FUNCTION)
  2990.     InformationClass
  2991.      See &lt;ntddk.h&gt; for possible values. Currently only KEY_WRITE_TIME_INFORMATION is supported.
  2992.     KeyInformationData
  2993.      See &lt;ntddk.h&gt; for detailed structure KEY_WRITE_TIME_INFORMATION.
  2994. */
  2995. typedef NTSTATUS (NTAPI *_NtSetInformationKey)( IN HANDLE KeyHandle, IN KEY_SET_INFORMATION_CLASS InformationClass, IN PVOID KeyInformationData, IN ULONG DataLength );
  2996.  
  2997. /*
  2998.     NtSetInformationObject (FUNCTION)
  2999.     ObjectHandle
  3000.      pen handle to any NT object.
  3001.     ObjectInformationClass
  3002.      ee NtQueryObject for detailed description of possible information classes.
  3003.     ObjectInformation
  3004.      uffor with data to set.
  3005.     Length
  3006.      ength of ObjectInformation buffer, in bytes.
  3007.     INFO-4
  3008.      <HR WIDTH="40%">
  3009.     INFO-5
  3010.      Currently only one class in allowed in set mode: ObjectDataInformation. See description of OBJECT_DATA_INFORMATION structure.
  3011. */
  3012. typedef NTSTATUS (NTAPI *_NtSetInformationObject)( IN HANDLE ObjectHandle, IN OBJECT_INFORMATION_CLASS ObjectInformationClass, IN PVOID ObjectInformation, IN ULONG Length );
  3013.  
  3014. /*
  3015.     NtSetInformationProcess (FUNCTION)
  3016.     ProcessHandle
  3017.      andle to process opened with PROCESS_SET_INFORMATION access.
  3018.     ProcessInformationClass
  3019.      ee PROCESS_INFORMATION_CLASS for more information.
  3020. */
  3021. typedef NTSTATUS (NTAPI *_NtSetInformationProcess)( IN HANDLE ProcessHandle, IN PROCESS_INFORMATION_CLASS ProcessInformationClass, IN PVOID ProcessInformation, IN ULONG ProcessInformationLength );
  3022.  
  3023. /*
  3024.     NtSetInformationThread (FUNCTION)
  3025.     ThreadHandle
  3026.      andle to Thread Object opened with THREAD_SET_INFORMATION access.
  3027.     ThreadInformationClass
  3028.      nformation class to set to. See THREAD_INFORMATION_CLASS for detailed description of use.
  3029.     ThreadInformation
  3030.      ointer to value to set.
  3031.     ThreadInformationLength
  3032.      ength of value to set.
  3033.     INFO-4
  3034.      <HR WIDTH="40%">
  3035.     INFO-5
  3036.      See THREAD_INFORMATION_CLASS for more information.
  3037. */
  3038. typedef NTSTATUS (NTAPI *_NtSetInformationThread)( IN HANDLE ThreadHandle, IN THREAD_INFORMATION_CLASS ThreadInformationClass, IN PVOID ThreadInformation, IN ULONG ThreadInformationLength );
  3039.  
  3040. /*
  3041.     NtSetInformationToken (FUNCTION)
  3042.     TokenHandle
  3043.      HANDLE to Token Object opened with TOKEN_ADJUST_DEFAULT access.
  3044.     TokenInformationClass
  3045.      Information class descripted in TOKEN_INFORMATION_CLASS topic.
  3046.     TokenInformation
  3047.      User's allocated buffer containing data to set to.
  3048.     TokenInformationLength
  3049.      Length of TokenInformation buffer, in bytes.
  3050. */
  3051. typedef NTSTATUS (NTAPI *_NtSetInformationToken)( IN HANDLE TokenHandle, IN TOKEN_INFORMATION_CLASS TokenInformationClass, OUT PVOID TokenInformation, IN ULONG TokenInformationLength );
  3052.  
  3053. /*
  3054.     NtSetIntervalProfile (FUNCTION)
  3055.     Interval
  3056.      New interval, in ms.
  3057.     Source
  3058.      Performance counter's identifier, defined in KPROFILE_SOURCE enumeration type.
  3059. */
  3060. typedef NTSTATUS (NTAPI *_NtSetIntervalProfile)( IN ULONG Interval, IN KPROFILE_SOURCE Source );
  3061.  
  3062. /*
  3063.     NtSetIoCompletion (FUNCTION)
  3064.     IoCompletionHandle
  3065.      HANDLE to IO Completion Object opened with IO_COMPLETION_MODIFY_STATE access.
  3066.     CompletionKey
  3067.      User's defined key received by NtRemoveIoCompletion function.
  3068.     IoStatusBlock
  3069.      IO result of call.
  3070.     CompletionStatus
  3071.      IO operation status.
  3072.     NumberOfBytesTransfered
  3073.      Number of bytes transfered in manually finished IO operation.
  3074. */
  3075. typedef NTSTATUS (NTAPI *_NtSetIoCompletion)( IN HANDLE IoCompletionHandle, IN ULONG CompletionKey, OUT PIO_STATUS_BLOCK IoStatusBlock, IN NTSTATUS CompletionStatus, IN ULONG NumberOfBytesTransfered );
  3076.  
  3077. /*
  3078.     NtSetLowEventPair (FUNCTION)
  3079.     INFO-0
  3080.      Function sets LOW event for EventPairHandle object.
  3081. */
  3082. typedef NTSTATUS (NTAPI *_NtSetLowEventPair)( IN HANDLE EventPairHandle );
  3083.  
  3084. /*
  3085.     NtSetLowWaitHighEventPair (FUNCTION)
  3086.     INFO-0
  3087.      Function set signalled state to LOW event and wait until HIGH event will be signaled.
  3088. */
  3089. typedef NTSTATUS (NTAPI *_NtSetLowWaitHighEventPair)( IN HANDLE EventPairHandle );
  3090.  
  3091. /*
  3092.     NtSetLowWaitHighThread (FUNCTION)
  3093.     INFO-0
  3094.      See also NtSetInformationThread with ThreadEventPair information class.
  3095. */
  3096. typedef NTSTATUS (NTAPI *_NtSetLowWaitHighThread)( );
  3097.  
  3098. /*
  3099.     NtSetSecurityObject (FUNCTION)
  3100.     ObjectHandle
  3101.      HANDLE to object of any type. Must be opened with WRITE_DAC or WRITE_OWNER access dependly to SecurityInformationClass parameter.
  3102.     SecurityInformationClass
  3103.      See NtQuerySecurityObject for possible values.
  3104.     DescriptorBuffer
  3105.      Pointer to user's allocated SECURITY_DESCRIPTOR to set.
  3106. */
  3107. typedef NTSTATUS (NTAPI *_NtSetSecurityObject)( IN HANDLE ObjectHandle, IN SECURITY_INFORMATION SecurityInformationClass, IN PSECURITY_DESCRIPTOR DescriptorBuffer );
  3108.  
  3109. /*
  3110.     NtSetSystemEnvironmentValue (FUNCTION)
  3111.     INFO-0
  3112.      Seems not works on NT 4.0 SP6...
  3113. */
  3114. typedef NTSTATUS (NTAPI *_NtSetSystemEnvironmentValue)( IN PUNICODE_STRING VariableName, IN PUNICODE_STRING Value );
  3115.  
  3116. /*
  3117.     NtSetSystemInformation (FUNCTION)
  3118.     SystemInformationClass
  3119.      Information class described in SYSTEM_INFORMATION_CLASS.
  3120.     SystemInformation
  3121.      Pointer to data buffer to set.
  3122.     SystemInformationLength
  3123.      Length of information in SystemInformation buffer, in bytes.
  3124. */
  3125. typedef NTSTATUS (NTAPI *_NtSetSystemInformation)( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN PVOID SystemInformation, IN ULONG SystemInformationLength );
  3126.  
  3127. /*
  3128.     NtSetSystemTime (FUNCTION)
  3129.     SystemTime
  3130.      Pointer to LARGE_INTEGER contains UTC time to set.
  3131.     PreviousTime
  3132.      Optionally receives time before change.
  3133. */
  3134. typedef NTSTATUS (NTAPI *_NtSetSystemTime)( IN PLARGE_INTEGER SystemTime, OUT PLARGE_INTEGER PreviousTime OPTIONAL );
  3135.  
  3136. /*
  3137.     NtSetTimer (FUNCTION)
  3138.     typedef void (*PTIMER_APC_ROUTINE)(
  3139.                 IN PVOID TimerContext,
  3140. */
  3141. typedef NTSTATUS (NTAPI *_NtSetTimer)( IN HANDLE TimerHandle, IN PLARGE_INTEGER DueTime, IN PTIMER_APC_ROUTINE TimerApcRoutine OPTIONAL, IN PVOID TimerContext OPTIONAL, IN BOOLEAN ResumeTimer, IN LONG Period OPTIONAL, OUT PBOOLEAN PreviousState OPTIONAL );
  3142.  
  3143. /*
  3144.     NtSetTimerResolution (FUNCTION)
  3145.     DesiredResolution
  3146.      Resolution to set. To receive minimum and maximum resolution values, call NtQueryTimerResolution.
  3147.     SetResolution
  3148.      If set, system Timer's resolution is set to DesiredResolution value. If no, parameter DesiredResolution is ignored.
  3149.     CurrentResolution
  3150.      Pointer to ULONG value receiving current timer's resolution, in 100-ns units.
  3151. */
  3152. typedef NTSTATUS (NTAPI *_NtSetTimerResolution)( IN ULONG DesiredResolution, IN BOOLEAN SetResolution, OUT PULONG CurrentResolution );
  3153.  
  3154. /*
  3155.     NtSetValueKey (FUNCTION)
  3156.     INFO-0
  3157.      See ZwSetValueKey in NT DDK or 2000 DDK for detailed description.
  3158. */
  3159. typedef NTSTATUS (NTAPI *_NtSetValueKey)( IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN ULONG TitleIndex OPTIONAL, IN ULONG Type, IN PVOID Data, IN ULONG DataSize );
  3160.  
  3161. /*
  3162.     NtSetVolumeInformationFile (FUNCTION)
  3163.     INFO-0
  3164.      NtSetVolumeInformationFile sets information to volume (device) containing file specified in FileHandle parameter.
  3165. */
  3166. typedef NTSTATUS (NTAPI *_NtSetVolumeInformationFile)( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID FileSystemInformation, IN ULONG Length, IN FS_INFORMATION_CLASS FileSystemInformationClass );
  3167.  
  3168. /*
  3169.     NtShutdownSystem (FUNCTION)
  3170.     Action
  3171.      Type of shudown defined in SHUTDOWN_ACTION enumeration type.
  3172. */
  3173. typedef NTSTATUS (NTAPI *_NtShutdownSystem)( IN SHUTDOWN_ACTION Action );
  3174.  
  3175. /*
  3176.     NtSignalAndWaitForSingleObject (FUNCTION)
  3177.     ObjectToSignal
  3178.      HANDLE to object to signal. Possible object's types are:
  3179.         Event Object
  3180.         Semaphore Object
  3181.     WaitableObject
  3182.      HANDLE to object to wait for. Can be any waitable object.
  3183.     Alertable
  3184.      If set, APC Routine can break waiting.
  3185.     Time
  3186.      Optionally pointer to LARGE_INTEGER value specifing time (absolute or relative) when function time outs (in 100-ns units). Negative value means relative time.
  3187. */
  3188. typedef NTSTATUS (NTAPI *_NtSignalAndWaitForSingleObject)( IN HANDLE ObjectToSignal, IN HANDLE WaitableObject, IN BOOLEAN Alertable, IN PLARGE_INTEGER Time OPTIONAL );
  3189.  
  3190. /*
  3191.     NtStartProfile (FUNCTION)
  3192.     ProfileHandle
  3193.      HANDLE to Profile Object.
  3194. */
  3195. typedef NTSTATUS (NTAPI *_NtStartProfile)( IN HANDLE ProfileHandle );
  3196.  
  3197. /*
  3198.     NtStopProfile (FUNCTION)
  3199.     ProfileHandle
  3200.      HANDLE to Profile Object, previously started with NtStartProfile function call.
  3201. */
  3202. typedef NTSTATUS (NTAPI *_NtStopProfile)( IN HANDLE ProfileHandle );
  3203.  
  3204. /*
  3205.     NtSuspendThread (FUNCTION)
  3206.     PreviousSuspendCount
  3207.      uspend count for ThreadHandle thread before function call.
  3208. */
  3209. typedef NTSTATUS (NTAPI *_NtSuspendThread)( IN HANDLE ThreadHandle, OUT PULONG PreviousSuspendCount OPTIONAL );
  3210.  
  3211. /*
  3212.     NtSystemDebugControl (FUNCTION)
  3213.     Command
  3214.      Command request for system. Command's codes are avaiable in enumeration type SYSDBG_COMMAND.
  3215.     InputBuffer
  3216.      User's allocated buffer with input data.
  3217.     InputBufferLength
  3218.      Length of InputBuffer, in bytes.
  3219.     OutputBuffer
  3220.      User's allocated buffer for output data.
  3221.     OutputBufferLength
  3222.      Length of OutputBuffer, in bytes.
  3223.     ReturnLength
  3224.      Pointer to ULONG value receiving required size of OutputBuffer.
  3225. */
  3226. typedef NTSTATUS (NTAPI *_NtSystemDebugControl)( IN SYSDBG_COMMAND Command, IN PVOID InputBuffer OPTIONAL, IN ULONG InputBufferLength, OUT PVOID OutputBuffer OPTIONAL, IN ULONG OutputBufferLength, OUT PULONG ReturnLength OPTIONAL );
  3227.  
  3228. /*
  3229.     NtTerminateProcess (FUNCTION)
  3230.     ProcessHandle
  3231.      If not specified, caller process is killed.
  3232. */
  3233. typedef NTSTATUS (NTAPI *_NtTerminateProcess)( IN HANDLE ProcessHandle OPTIONAL, IN NTSTATUS ExitStatus );
  3234.  
  3235. /*
  3236.     NtTerminateThread (FUNCTION)
  3237.     ThreadHandle
  3238.      pen handle to thread object.
  3239.     ExitStatus
  3240.      esult of thread, as NTSTATUS.
  3241. */
  3242. typedef NTSTATUS (NTAPI *_NtTerminateThread)( IN HANDLE ThreadHandle, IN NTSTATUS ExitStatus );
  3243.  
  3244. /*
  3245.     NtTestAlert (FUNCTION)
  3246.     INFO-0
  3247.      You can use NtTestAlert to empty APC queue for current thread. If APC queue was empty before call, NtTestAlert has no efect.
  3248.     INFO-1
  3249.      NtTestAlert is typical ntcall kernel routine, accessable via int 2Eh. It check thread APC queue, and call KiUserApcDispatcher.
  3250. */
  3251. typedef NTSTATUS (NTAPI *_NtTestAlert)( );
  3252.  
  3253. /*
  3254.     NtUnloadDriver (FUNCTION)
  3255.     INFO-0
  3256. */
  3257. typedef NTSTATUS (NTAPI *_NtUnloadDriver)( IN PUNICODE_STRING DriverServiceName );
  3258.  
  3259. /*
  3260.     NtUnloadKey (FUNCTION)
  3261.     DestinationKeyName
  3262.      Pointer to OBJECT_ATTRIBUTES structure contains path and name of Hive root key.
  3263. */
  3264. typedef NTSTATUS (NTAPI *_NtUnloadKey)( IN POBJECT_ATTRIBUTES DestinationKeyName );
  3265.  
  3266. /*
  3267.     NtUnlockFile (FUNCTION)
  3268.     FileHandle
  3269.      HANDLE to File Object with locked region.
  3270.     IoStatusBlock
  3271.      IO result of function call.
  3272.     ByteOffset
  3273.      Offset in file where unlock region begins.
  3274.     Length
  3275.      Length of region to unlock.
  3276.     Key
  3277.      Pointer to 4-bytes key associated with lock. See NtLockFile for additional information about locking by key usage.
  3278. */
  3279. typedef NTSTATUS (NTAPI *_NtUnlockFile)( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER ByteOffset, IN PLARGE_INTEGER Length, IN PULONG Key );
  3280.  
  3281. /*
  3282.     NtUnlockVirtualMemory (FUNCTION)
  3283.     INFO-0
  3284.      See NtLockVirtualMemory for more information about parameters and usage.
  3285. */
  3286. typedef NTSTATUS (NTAPI *_NtUnlockVirtualMemory)( IN HANDLE ProcessHandle, IN PVOID *BaseAddress, IN OUT PULONG NumberOfBytesToUnlock, IN ULONG LockType );
  3287.  
  3288. /*
  3289.     NtUnmapViewOfSection (FUNCTION)
  3290.     INFO-0
  3291. */
  3292. typedef NTSTATUS (NTAPI *_NtUnmapViewOfSection)( IN HANDLE ProcessHandle, IN PVOID BaseAddress );
  3293.  
  3294. /*
  3295.     NtWaitForKeyedEvent (FUNCTION)
  3296.     INFO-0
  3297.      Function with similar functionality as NtReleaseKeyedEvent. In my opinion it is not needed and exists only for future vision of KeyedEvent objects or just as a mistake.
  3298.     KeyedEventHandle
  3299.      HANDLE for previously opened KeyedEvent object.
  3300.     Key
  3301.      Value to wait for, must have lowest bit clear.
  3302.     Alertable
  3303.      If set, waiting can be broken by alerting thread.
  3304.     Timeout
  3305.      Optinally pointer for timing out value.
  3306.     Supported on system versions:
  3307.      Win XP/2003
  3308. */
  3309. typedef NTSTATUS (NTAPI *_NtWaitForKeyedEvent)( IN HANDLE KeyedEventHandle, IN PVOID Key, IN BOOLEAN Alertable, IN PLARGE_INTEGER Timeout OPTIONAL );
  3310.  
  3311. /*
  3312.     NtWaitForMultipleObjects (FUNCTION)
  3313.     INFO-0
  3314.      NtWaitForMultipleObjects is used typically to response for notyfications. For synchronization purposes you should use NtWaitForSingleObject.
  3315. */
  3316. typedef NTSTATUS (NTAPI *_NtWaitForMultipleObjects)( IN ULONG ObjectCount, IN PHANDLE ObjectsArray, IN OBJECT_WAIT_TYPE WaitType, IN BOOLEAN Alertable, IN PLARGE_INTEGER TimeOut OPTIONAL );
  3317.  
  3318. /*
  3319.     NtWaitForSingleObject (FUNCTION)
  3320.     ObjectHandle
  3321.      HANDLE to alertable object.
  3322.     Alertable
  3323.      If set, calling thread is signaled, so all queued APC routines are executed.
  3324.     TimeOut
  3325.      Time-out interval, in microseconds. NULL means infinite.
  3326. */
  3327. typedef NTSTATUS (NTAPI *_NtWaitForSingleObject)( IN HANDLE ObjectHandle, IN BOOLEAN Alertable, IN PLARGE_INTEGER TimeOut OPTIONAL );
  3328.  
  3329. /*
  3330.     NtWaitHighEventPair (FUNCTION)
  3331.     INFO-0
  3332.      ait until HIGH event of EventPairHandle will be signaled.
  3333. */
  3334. typedef NTSTATUS (NTAPI *_NtWaitHighEventPair)( IN HANDLE EventPairHandle );
  3335.  
  3336. /*
  3337.     NtWaitLowEventPair (FUNCTION)
  3338.     INFO-0
  3339.      unction waits, until LOW event will be signaled.
  3340. */
  3341. typedef NTSTATUS (NTAPI *_NtWaitLowEventPair)( IN HANDLE EventPairHandle );
  3342.  
  3343. /*
  3344.     NtWriteFile (FUNCTION)
  3345.     INFO-0
  3346.      (Also descripted in Win 2000 DDK)
  3347.     FileHandle
  3348.      HANDLE to File Object opened with FILE_WRITE_DATA access.
  3349.     Event
  3350.      HANDLE to Event Object signaled when write finished.
  3351.     ApcRoutine
  3352.      User APC routine executed after writing is complete.
  3353.     ApcContext
  3354.      Parameter to ApcRoutine.
  3355.     IoStatusBlock
  3356.      IO result of call.
  3357.     Buffer
  3358.      Buffer with data to write.
  3359.     Length
  3360.      Length of Buffer, in bytes.
  3361.     ByteOffset
  3362.      Offset from begining of file, where write starts.
  3363. */
  3364. typedef NTSTATUS (NTAPI *_NtWriteFile)( IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID Buffer, IN ULONG Length, IN PLARGE_INTEGER ByteOffset OPTIONAL, IN PULONG Key OPTIONAL );
  3365.  
  3366. /*
  3367.     NtWriteFileGather (FUNCTION)
  3368.     FileHandle
  3369.      HANDLE to File Object opened with FILE_WRITE_DATA access and FILE_NO_INTERMEDIATE_BUFFERING open option.
  3370.     Event
  3371.      HANDLE to Event Object signaled when writing will finish. Function always use asynchronous writing operation, so caller should define Event or ApcRoutine parameter.
  3372.     ApcRoutine
  3373.      Pointer to user's APC Routine.
  3374.     ApcContext
  3375.      Parameter for ApcRoutine.
  3376.     IoStatusBlock
  3377.      IO result of call.
  3378.     SegmentArray
  3379.      Array of FILE_SEGMENT_ELEMENT elements pointing to memory pages to write. Last array element must be NULL.
  3380.     Length
  3381.      Number of bytes to write.
  3382.     ByteOffset
  3383.      Pointer to LARGE_INTEGER value indicates starting position for write.
  3384.     Key
  3385.      Pointer to user's defined key, used when file is locked (see NtLockFile).
  3386. */
  3387. typedef NTSTATUS (NTAPI *_NtWriteFileGather)( IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN FILE_SEGMENT_ELEMENT SegmentArray, IN ULONG Length, IN PLARGE_INTEGER ByteOffset, IN PULONG Key OPTIONAL );
  3388.  
  3389. /*
  3390.     NtWriteRequestData (FUNCTION)
  3391.     PortHandle
  3392.      HANDLE to Port Object opened in a result of call NtAcceptConnectPort.
  3393.     INFO-1
  3394.      Request
  3395.     INFO-2
  3396.      DataIndex
  3397.     INFO-3
  3398.      Buffer
  3399.     INFO-4
  3400.      Length
  3401.     INFO-5
  3402.      ResultLength
  3403. */
  3404. typedef NTSTATUS (NTAPI *_NtWriteRequestData)( IN HANDLE PortHandle, IN PLPC_MESSAGE Request, IN ULONG DataIndex, IN PVOID Buffer, IN ULONG Length, OUT PULONG ResultLength OPTIONAL );
  3405.  
  3406. /*
  3407.     NtWriteVirtualMemory (FUNCTION)
  3408.     INFO-0
  3409.      NtWriteVirtualMemory is similar to WINAPI WriteProcessMemory. See Ms SDK for detailed description of parameters.
  3410. */
  3411. typedef NTSTATUS (NTAPI *_NtWriteVirtualMemory)( IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN PVOID Buffer, IN ULONG NumberOfBytesToWrite, OUT PULONG NumberOfBytesWritten OPTIONAL );
  3412.  
  3413. /*
  3414.     NtYieldExecution (FUNCTION)
  3415.     INFO-0
  3416.      This function stop executing of calling thread, and switch to any other currently running thread.
  3417. */
  3418. typedef NTSTATUS (NTAPI *_NtYieldExecution)( );
  3419.  
  3420. /*
  3421.     OBJDIR_INFORMATION (STRUCT)
  3422.     Structure is used with NtQueryDirectoryObject function. Contains information of named object placed in object directory space.
  3423.      <HR WIDTH="40%">
  3424.     ObjectName
  3425.      ame of object.
  3426.     ObjectTypeName
  3427.      ame of object type.
  3428.     Data[1]
  3429.      ariable length data buffer.
  3430. */
  3431. typedef struct _OBJDIR_INFORMATION {
  3432.     UNICODE_STRING ObjectName;
  3433.     UNICODE_STRING ObjectTypeName;
  3434.     BYTE Data[1];
  3435. } OBJDIR_INFORMATION, *POBJDIR_INFORMATION;
  3436.  
  3437. /*
  3438.     OBJECT_BASIC_INFORMATION (STRUCT)
  3439.     INFO-0
  3440.      Structure OBJECT_BASIC_INFORMATION is returned in a result of call NtQueryObject with ObjectBasicInformation information class.
  3441.     INFO-1
  3442.      Attributes
  3443.     INFO-2
  3444.      DesiredAccess
  3445.     INFO-3
  3446.      HandleCount
  3447.     INFO-4
  3448.      ReferenceCount
  3449.     INFO-5
  3450.      PagedPoolUsage
  3451.     INFO-6
  3452.      NonPagedPoolUsage
  3453.     INFO-7
  3454.      Reserved[3]
  3455.     INFO-8
  3456.      NameInformationLength
  3457.     INFO-9
  3458.      TypeInformationLength
  3459.     INFO-10
  3460.      SecurityDescriptorLength
  3461.     INFO-11
  3462.      CreationTime
  3463.     Supported on system versions:
  3464.      NT 4.0,Win 2000,Win XP/2003
  3465. */
  3466. typedef struct _OBJECT_BASIC_INFORMATION {
  3467.     ULONG Attributes;
  3468.     ACCESS_MASK DesiredAccess;
  3469.     ULONG HandleCount;
  3470.     ULONG ReferenceCount;
  3471.     ULONG PagedPoolUsage;
  3472.     ULONG NonPagedPoolUsage;
  3473.     ULONG Reserved[3];
  3474.     ULONG NameInformationLength;
  3475.     ULONG TypeInformationLength;
  3476.     ULONG SecurityDescriptorLength;
  3477.     LARGE_INTEGER CreationTime;
  3478. } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
  3479.  
  3480. /*
  3481.     OBJECT_INFORMATION_CLASS (ENUM)
  3482. */
  3483. typedef enum _OBJECT_INFORMATION_CLASS {
  3484.     ObjectBasicInformation,
  3485.     ObjectNameInformation,
  3486.     ObjectTypeInformation,
  3487.     ObjectAllInformation,
  3488.     ObjectDataInformation
  3489. } OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS;
  3490.  
  3491. /*
  3492.     OBJECT_NAME_INFORMATION (STRUCT)
  3493.     INFO-0
  3494.      Structure OBJECT_NAME_INFORMATION is used as a result of call NtQueryObject with ObjectNameInformation information class.
  3495.     Name
  3496.      Name of object or NULL if object don't have associated name.
  3497.     NameBuffer[0]
  3498.      Buffer with UNICODE name of object.
  3499.     Supported on system versions:
  3500.      NT 4.0,Win 2000,Win XP/2003
  3501. */
  3502. typedef struct _OBJECT_NAME_INFORMATION {
  3503.     UNICODE_STRING Name;
  3504.     WCHAR NameBuffer[0];
  3505. } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
  3506.  
  3507. /*
  3508.     OBJECT_WAIT_TYPE (ENUM)
  3509. */
  3510. typedef enum _OBJECT_WAIT_TYPE {
  3511.     WaitAllObject,
  3512.     WaitAnyObject
  3513. } OBJECT_WAIT_TYPE, *POBJECT_WAIT_TYPE;
  3514.  
  3515. /*
  3516.     Other NT Object Functions (FUNCTION)
  3517.     TITLE>Other NT Object Functions</TITLE>
  3518.        
  3519.    
  3520.      Undocumented functions of NTDLL
  3521.     INFO-2
  3522.      
  3523.     INFO-3
  3524.      Other functions, described in other section of this help file. You can use it with all NT Object types.
  3525.     INFO-4
  3526.      Security
  3527.         NtQuerySecurityObject
  3528.         NtSetSecurityObject
  3529.     INFO-6
  3530.      
  3531.     INFO-7
  3532.      <HR WIDTH="0" SIZE="0" NOSHADE CLASS="page
  3533. */
  3534. typedef t Functions</TITLE>      Undocumented functions of NTDLL Other functions, described in other section of this help file. You can use it with all NT Object types. Security   NtQuerySecurityObject   NtSetSecurityObject <HR WIDTH="0" SIZE="0"
  3535.  
  3536. /*
  3537.     PEB (STRUCT)
  3538.     INFO-0
  3539.      InheritedAddressSpace
  3540.     INFO-1
  3541.      ReadImageFileExecOptions
  3542.     INFO-2
  3543.      BeingDebugged
  3544.     INFO-3
  3545.      Spare
  3546.     INFO-4
  3547.      Mutant
  3548.     ImageBaseAddress
  3549.      Address of executable image in process' memory.
  3550.     LoaderData
  3551.      Pointer to PEB_LDR_DATA structure contains information filled by Loader.
  3552.     ProcessParameters
  3553.      Pointer to RTL_USER_PROCESS_PARAMETERS structure.
  3554.     INFO-8
  3555.      SubSystemData
  3556.     ProcessHeap
  3557.      Address of process' first heap allocated by Loader.
  3558.     FastPebLock
  3559.      Parameter for PEBLOCKROUTINE (see below).
  3560.     FastPebLockRoutine
  3561.      Address of fast-locking routine for PEB. Definition of routine is:
  3562.     FastPebUnlockRoutine
  3563.      PEB fast-unlock routine.
  3564.     EnvironmentUpdateCount
  3565.      Counter of process environment updates.
  3566.     INFO-14
  3567.      KernelCallbackTable
  3568.     INFO-15
  3569.      EventLogSection
  3570.     INFO-16
  3571.      EventLog
  3572.     INFO-17
  3573.      FreeList
  3574.     INFO-18
  3575.      TlsExpansionCounter
  3576.     INFO-19
  3577.      TlsBitmap
  3578.     INFO-20
  3579.      TlsBitmapBits[0x2]
  3580.     INFO-21
  3581.      ReadOnlySharedMemoryBase
  3582.     INFO-22
  3583.      ReadOnlySharedMemoryHeap
  3584.     INFO-23
  3585.      ReadOnlyStaticServerData
  3586.     INFO-24
  3587.      AnsiCodePageData
  3588.     INFO-25
  3589.      OemCodePageData
  3590.     INFO-26
  3591.      UnicodeCaseTableData
  3592.     INFO-27
  3593.      NumberOfProcessors
  3594.     INFO-28
  3595.      NtGlobalFlag
  3596.     INFO-29
  3597.      Spare2[0x4]
  3598.     INFO-30
  3599.      CriticalSectionTimeout
  3600.     INFO-31
  3601.      HeapSegmentReserve
  3602.     INFO-32
  3603.      HeapSegmentCommit
  3604.     INFO-33
  3605.      HeapDeCommitTotalFreeThreshold
  3606.     INFO-34
  3607.      HeapDeCommitFreeBlockThreshold
  3608.     INFO-35
  3609.      NumberOfHeaps
  3610.     INFO-36
  3611.      MaximumNumberOfHeaps
  3612.     INFO-37
  3613.      *ProcessHeaps
  3614.     INFO-38
  3615.      GdiSharedHandleTable
  3616.     INFO-39
  3617.      ProcessStarterHelper
  3618.     INFO-40
  3619.      GdiDCAttributeList
  3620.     INFO-41
  3621.      LoaderLock
  3622.     INFO-42
  3623.      OSMajorVersion
  3624.     INFO-43
  3625.      OSMinorVersion
  3626.     INFO-44
  3627.      OSBuildNumber
  3628.     INFO-45
  3629.      OSPlatformId
  3630.     INFO-46
  3631.      ImageSubSystem
  3632.     INFO-47
  3633.      ImageSubSystemMajorVersion
  3634.     INFO-48
  3635.      ImageSubSystemMinorVersion
  3636.     INFO-49
  3637.      GdiHandleBuffer[0x22]
  3638.     INFO-50
  3639.      PostProcessInitRoutine
  3640.     INFO-51
  3641.      TlsExpansionBitmap
  3642.     INFO-52
  3643.      TlsExpansionBitmapBits[0x80]
  3644.     INFO-53
  3645.      SessionId
  3646. */
  3647. typedef struct _PEB {
  3648.     BOOLEAN InheritedAddressSpace;
  3649.     BOOLEAN ReadImageFileExecOptions;
  3650.     BOOLEAN BeingDebugged;
  3651.     BOOLEAN Spare;
  3652.     HANDLE Mutant;
  3653.     PVOID ImageBaseAddress;
  3654.     PPEB_LDR_DATA LoaderData;
  3655.     PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
  3656.     PVOID SubSystemData;
  3657.     PVOID ProcessHeap;
  3658.     PVOID FastPebLock;
  3659.     PPEBLOCKROUTINE FastPebLockRoutine;
  3660.     PPEBLOCKROUTINE FastPebUnlockRoutine;
  3661.     ULONG EnvironmentUpdateCount;
  3662.     PPVOID KernelCallbackTable;
  3663.     PVOID EventLogSection;
  3664.     PVOID EventLog;
  3665.     PPEB_FREE_BLOCK FreeList;
  3666.     ULONG TlsExpansionCounter;
  3667.     PVOID TlsBitmap;
  3668.     ULONG TlsBitmapBits[0x2];
  3669.     PVOID ReadOnlySharedMemoryBase;
  3670.     PVOID ReadOnlySharedMemoryHeap;
  3671.     PPVOID ReadOnlyStaticServerData;
  3672.     PVOID AnsiCodePageData;
  3673.     PVOID OemCodePageData;
  3674.     PVOID UnicodeCaseTableData;
  3675.     ULONG NumberOfProcessors;
  3676.     ULONG NtGlobalFlag;
  3677.     BYTE Spare2[0x4];
  3678.     LARGE_INTEGER CriticalSectionTimeout;
  3679.     ULONG HeapSegmentReserve;
  3680.     ULONG HeapSegmentCommit;
  3681.     ULONG HeapDeCommitTotalFreeThreshold;
  3682.     ULONG HeapDeCommitFreeBlockThreshold;
  3683.     ULONG NumberOfHeaps;
  3684.     ULONG MaximumNumberOfHeaps;
  3685.     PPVOID *ProcessHeaps;
  3686.     PVOID GdiSharedHandleTable;
  3687.     PVOID ProcessStarterHelper;
  3688.     PVOID GdiDCAttributeList;
  3689.     PVOID LoaderLock;
  3690.     ULONG OSMajorVersion;
  3691.     ULONG OSMinorVersion;
  3692.     ULONG OSBuildNumber;
  3693.     ULONG OSPlatformId;
  3694.     ULONG ImageSubSystem;
  3695.     ULONG ImageSubSystemMajorVersion;
  3696.     ULONG ImageSubSystemMinorVersion;
  3697.     ULONG GdiHandleBuffer[0x22];
  3698.     ULONG PostProcessInitRoutine;
  3699.     ULONG TlsExpansionBitmap;
  3700.     BYTE TlsExpansionBitmapBits[0x80];
  3701.     ULONG SessionId;
  3702. } PEB, *PPEB;
  3703.  
  3704. /*
  3705.     PEB_FREE_BLOCK (STRUCT)
  3706.     *Next
  3707.      Pointer to next free block.
  3708.     Size
  3709.      Size of block, in bytes.
  3710. */
  3711. typedef struct _PEB_FREE_BLOCK {
  3712.     PEB_FREE_BLOCK *Next;
  3713.     ULONG Size;
  3714. } PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
  3715.  
  3716. /*
  3717.     PEB_LDR_DATA (STRUCT)
  3718.     Length
  3719.      ize of structure, used by ntdll.dll as structure version ID.
  3720.     Initialized
  3721.      f set, loader data section for current process is initialized.
  3722.     InLoadOrderModuleList
  3723.      oubly linked list containing pointers to LDR_MODULE structure for previous and next module in load order.
  3724.     InMemoryOrderModuleList
  3725.      s above, but in memory placement order.
  3726.     InInitializationOrderModuleList
  3727.      s InLoadOrderModuleList, but in initialization order.
  3728. */
  3729. typedef struct _PEB_LDR_DATA {
  3730.     ULONG Length;
  3731.     BOOLEAN Initialized;
  3732.     PVOID SsHandle;
  3733.     LIST_ENTRY InLoadOrderModuleList;
  3734.     LIST_ENTRY InMemoryOrderModuleList;
  3735.     LIST_ENTRY InInitializationOrderModuleList;
  3736. } PEB_LDR_DATA, *PPEB_LDR_DATA;
  3737.  
  3738. /*
  3739.     POOLED_USAGE_AND_LIMITS (STRUCT)
  3740.     INFO-0
  3741.      PeakPagedPoolUsage
  3742.     INFO-1
  3743.      PagedPoolUsage
  3744.     INFO-2
  3745.      PagedPoolLimit
  3746.     INFO-3
  3747.      PeakNonPagedPoolUsage
  3748.     INFO-4
  3749.      NonPagedPoolUsage
  3750.     INFO-5
  3751.      NonPagedPoolLimit
  3752.     INFO-6
  3753.      PeakPagefileUsage
  3754.     INFO-7
  3755.      PagefileUsage
  3756.     INFO-8
  3757.      PagefileLimit
  3758.     Supported on system versions:
  3759.      NT 4.0,Win 2000,Win XP/2003
  3760. */
  3761. typedef struct _POOLED_USAGE_AND_LIMITS {
  3762.     ULONG PeakPagedPoolUsage;
  3763.     ULONG PagedPoolUsage;
  3764.     ULONG PagedPoolLimit;
  3765.     ULONG PeakNonPagedPoolUsage;
  3766.     ULONG NonPagedPoolUsage;
  3767.     ULONG NonPagedPoolLimit;
  3768.     ULONG PeakPagefileUsage;
  3769.     ULONG PagefileUsage;
  3770.     ULONG PagefileLimit;
  3771. } POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS;
  3772.  
  3773. /*
  3774.     PORT_INFORMATION_CLASS (ENUM)
  3775. */
  3776. typedef enum _PORT_INFORMATION_CLASS {
  3777.     PortNoInformation
  3778. } PORT_INFORMATION_CLASS, *PPORT_INFORMATION_CLASS;
  3779.  
  3780. /*
  3781.     PROCESS_ACCESS_TOKEN (STRUCT)
  3782.     INFO-0
  3783.      Token
  3784.     INFO-1
  3785.      Thread
  3786.     Supported on system versions:
  3787.      NT 4.0,Win 2000,Win XP/2003
  3788. */
  3789. typedef struct _PROCESS_ACCESS_TOKEN {
  3790.     HANDLE Token;
  3791.     HANDLE Thread;
  3792. } PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;
  3793.  
  3794. /*
  3795.     PROCESS_INFORMATION_CLASS (ENUM)
  3796. */
  3797. typedef enum _PROCESS_INFORMATION_CLASS {
  3798.     ProcessBasicInformation,
  3799.     ProcessQuotaLimits,
  3800.     ProcessIoCounters,
  3801.     ProcessVmCounters,
  3802.     ProcessTimes,
  3803.     ProcessBasePriority,
  3804.     ProcessRaisePriority,
  3805.     ProcessDebugPort,
  3806.     ProcessExceptionPort,
  3807.     ProcessAccessToken,
  3808.     ProcessLdtInformation,
  3809.     ProcessLdtSize,
  3810.     ProcessDefaultHardErrorMode,
  3811.     ProcessIoPortHandlers,
  3812.     ProcessPooledUsageAndLimits,
  3813.     ProcessWorkingSetWatch,
  3814.     ProcessUserModeIOPL,
  3815.     ProcessEnableAlignmentFaultFixup,
  3816.     ProcessPriorityClass,
  3817.     ProcessWx86Information,
  3818.     ProcessHandleCount,
  3819.     ProcessAffinityMask,
  3820.     ProcessPriorityBoost,
  3821.     MaxProcessInfoClass
  3822. } PROCESS_INFORMATION_CLASS, *PPROCESS_INFORMATION_CLASS;
  3823.  
  3824. /*
  3825.     PROCESS_WS_WATCH_INFORMATION (STRUCT)
  3826.     INFO-0
  3827.      FaultingPc
  3828.     INFO-1
  3829.      FaultingVa
  3830.     Supported on system versions:
  3831.      NT 4.0,Win 2000,Win XP/2003
  3832. */
  3833. typedef struct _PROCESS_WS_WATCH_INFORMATION {
  3834.     PVOID FaultingPc;
  3835.     PVOID FaultingVa;
  3836. } PROCESS_WS_WATCH_INFORMATION, *PPROCESS_WS_WATCH_INFORMATION;
  3837.  
  3838. /*
  3839.     RtlAllocateHeap (FUNCTION)
  3840.     INFO-0
  3841.      B><HR WIDTH="40%">
  3842.     INFO-1
  3843.      unction maps Win32 API HeapCreate, see Ms SDK.
  3844. */
  3845. typedef PVOID (NTAPI *_RtlAllocateHeap)( IN PVOID HeapHandle, IN ULONG Flags, IN ULONG Size );
  3846.  
  3847. /*
  3848.     RtlCaptureStackBackTrace (FUNCTION)
  3849.     INFO-0
  3850.      Function RtlCaptureStackBackTrace is usefull for debugging and analysing problems by making complete trace of calling functions by processing stack.
  3851.     FramesToSkip
  3852.      How many stack entries should be skiped.
  3853.     FramesToCapture
  3854.      Length of BackTrace buffer array.
  3855.     BackTrace
  3856.      Array of caller's addresses.
  3857.     BackTraceHash
  3858.      Unknown...
  3859.     Supported on system versions:
  3860.      NT 4.0,Win 2000,Win XP/2003
  3861. */
  3862. typedef USHORT (NTAPI *_RtlCaptureStackBackTrace)( IN ULONG FramesToSkip, IN ULONG FramesToCapture, OUT PVOID *BackTrace, OUT PULONG BackTraceHash );
  3863.  
  3864. /*
  3865.     RtlCompactHeap (FUNCTION)
  3866.     HeapHandle
  3867.      eap address.
  3868.     Flags
  3869.      ee RtlCreateHeap for more information.
  3870. */
  3871. typedef ULONG (NTAPI *_RtlCompactHeap)( IN HANDLE HeapHandle, IN ULONG Flags );
  3872.  
  3873. /*
  3874.     RtlCompressBuffer (FUNCTION)
  3875.     CompressionFormat
  3876.      Only lower 2 bytes are supported. Higher byte means Compression Engine. Lower byte means Compressing Format.
  3877.     Compression format (0-15). Bits 4-7 are unused.
  3878.      In NT 4.0 sp6 only LZNT1 is supported.
  3879.     #define COMPRESSION_FORMAT_NONE     (0x0000)        // [result:STATUS_INVALID_PARAMETER]
  3880.      #define COMPRESSION_FORMAT_DEFAULT (0x0001)        // [result:STATUS_INVALID_PARAMETER]
  3881.     Compression engine.
  3882.      It's level of compression. Higher level means better results, but longer time used for compression process.
  3883.     #define COMPRESSION_ENGINE_STANDARD (0x0000)        // Standart compression
  3884.      #define COMPRESSION_ENGINE_MAXIMUM (0x0100)        // Maximum (slowest but better)
  3885.    
  3886.      Unknown
  3887.     pDestinationSize
  3888.      Size of data after compression.
  3889.     WorkspaceBuffer
  3890.      See RtlGetCompressionWorkSpaceSize for more information.
  3891. */
  3892. typedef NTSTATUS (NTAPI *_RtlCompressBuffer)( IN ULONG CompressionFormat, IN PVOID SourceBuffer, IN ULONG SourceBufferLength, OUT PVOID DestinationBuffer, IN ULONG DestinationBufferLength, IN ULONG Unknown, OUT PULONG pDestinationSize, IN PVOID WorkspaceBuffer );
  3893.  
  3894. /*
  3895.     RtlCreateEnvironment (FUNCTION)
  3896.     Inherit
  3897.      f set, newly created environment are similar to caller's environment.
  3898.     *Environment
  3899.      B>RtlCreateEnvironment allocate memory in caller's address space, and fills it with new environment block. Environment is pointer to this block.
  3900. */
  3901. typedef NTSTATUS (NTAPI *_RtlCreateEnvironment)( IN BOOLEAN Inherit, OUT PVOID *Environment );
  3902.  
  3903. /*
  3904.     RtlCreateHeap (FUNCTION)
  3905.     Flags
  3906.      lags are defined in &lt;WinNT.h&gt;. Can be one of following:
  3907.     Base
  3908.      ase address, where heap should be created. If memory was previously allocated at this address, heap is created at the nearest possibble virtual address.
  3909.     Reserve
  3910.      ow much bytes should be reserved. See NtAllocateVirtualMemory.
  3911.     Commit
  3912.      ow meny bytes should be commited. If Reserve is greater than zero, Commit must be less or equal to Reserve.
  3913.     Lock
  3914.      f set, heap will be locked. See RtlLockHeap / RtlUnlockHeap.
  3915.     RtlHeapParams
  3916.      ointer to RTL_HEAP_DEFINITION structure. On NT 4.0 all bytes of this (except length field) are set to zero.
  3917. */
  3918. typedef PVOID (NTAPI *_RtlCreateHeap)( IN ULONG Flags, IN PVOID Base OPTIONAL, IN ULONG Reserve OPTIONAL, IN ULONG Commit, IN BOOLEAN Lock OPTIONAL, IN PRTL_HEAP_DEFINITION RtlHeapParams OPTIONAL );
  3919.  
  3920. /*
  3921.     RtlCreateUserProcess (FUNCTION)
  3922.     ImagePath
  3923.      ull path to executable image, in NT format (ex: "/??/C:/WinNT/SYSTEM32/cmd.exe").
  3924.     ObjectAttributes
  3925.      sed in File object creation. Valid are OBJ_INHERIT and OBJ_CASE_INSENSITIVE.
  3926.     ProcessParameters
  3927.      ormalized RTL_USER_PROCESS_PARAMETERS structure pointer. See RtlCreateProcessParameters for more information.
  3928.     ParentProcess
  3929.      andle to object Process, opened with PROCESS_CREATE_PROCESS access.
  3930.     ProcessInformation
  3931.      ointer to user-allocated structure RTL_USER_PROCESS_INFORMATION.
  3932. */
  3933. typedef NTSTATUS (NTAPI *_RtlCreateUserProcess)( IN PUNICODE_STRING ImagePath, IN ULONG ObjectAttributes, IN OUT PRTL_USER_PROCESS_PARAMETERS ProcessParameters, IN PSECURITY_DESCRIPTOR ProcessSecurityDescriptor OPTIONAL, IN PSECURITY_DESCRIPTOR ThreadSecurityDescriptor OPTIONAL, IN HANDLE ParentProcess, IN BOOLEAN InheritHandles, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL, OUT PRTL_USER_PROCESS_INFORMATION ProcessInformation );
  3934.  
  3935. /*
  3936.     RtlCreateUserThread (FUNCTION)
  3937.     StackZeroBits
  3938.      ow many older bits must be clear while allocating thread stack. See INITIAL_TEB.
  3939.     StartAddress
  3940.      hread start routine address.
  3941. */
  3942. typedef NTSTATUS (NTAPI *_RtlCreateUserThread)( IN HANDLE ProcessHandle, IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL, IN BOOLEAN CreateSuspended, IN ULONG StackZeroBits, IN OUT PULONG StackReserved, IN OUT PULONG StackCommit, IN PVOID StartAddress, IN PVOID StartParameter OPTIONAL, OUT PHANDLE ThreadHandle, OUT PCLIENT_ID ClientID );
  3943.  
  3944. /*
  3945.     RtlDecompressBuffer (FUNCTION)
  3946.     CompressionFormat
  3947.      See RtlCompressBuffer for possible compression formats. Compression engine is not used
  3948. */
  3949. typedef NTSTATUS (NTAPI *_RtlDecompressBuffer)( IN ULONG CompressionFormat, OUT PVOID DestinationBuffer, IN ULONG DestinationBufferLength, IN PVOID SourceBuffer, IN ULONG SourceBufferLength, OUT PULONG pDestinationSize );
  3950.  
  3951. /*
  3952.     RtlDestroyEnvironment (FUNCTION)
  3953.     Environment
  3954.      ointer to allocated environment block.
  3955. */
  3956. typedef VOID (NTAPI *_RtlDestroyEnvironment)( IN PVOID Environment );
  3957.  
  3958. /*
  3959.     RtlDestroyHeap (FUNCTION)
  3960.     HeapHandle
  3961.      DIV CLASS="reg">Pointer to heap memory block.
  3962. */
  3963. typedef NTSTATUS (NTAPI *_RtlDestroyHeap)( IN PVOID HeapHandle );
  3964.  
  3965. /*
  3966.     RtlEnumProcessHeaps (FUNCTION)
  3967.     INFO-0
  3968.      PHEAP_ENUMERATION_ROUTINE is defined as follows:
  3969.     typedef NTSTATUS
  3970.      (*PHEAP_ENUMERATION_ROUTINE)(
  3971.     INFO-2
  3972.      <HR WIDTH="40%">
  3973.     HeapEnumerationRoutine
  3974.      ser function address.
  3975.     Param
  3976.      ser defined parameter, will be placed as UserParam in every HeapEnumerationRoutine calls.
  3977. */
  3978. typedef NTSTATUS (NTAPI *_RtlEnumProcessHeaps)( IN PHEAP_ENUMERATION_ROUTINE HeapEnumerationRoutine, IN PVOID Param OPTIONAL );
  3979.  
  3980. /*
  3981.     RtlExpandEnvironmentStrings_U (FUNCTION)
  3982.     Environment
  3983.      ointer to environment block.
  3984.     SourceString
  3985.      ointer to UNICODE_STRING structure with text. If text contains any environment variable name separated with '%' character, variable name is replaced by value of this variable.
  3986.     DestinationString
  3987.      esult of above operation. At input only MaximumLength of UNICODE_STRING structure must be valid.
  3988.     DestinationBufferLength
  3989.      f you don't know, how long should be result buffer, use value at DestinationBufferLength pointer.
  3990. */
  3991. typedef NTSTATUS (NTAPI *_RtlExpandEnvironmentStrings_U)( IN PVOID Environment OPTIONAL, IN PUNICODE_STRING SourceString, OUT PUNICODE_STRING DestinationString, OUT PULONG DestinationBufferLength OPTIONAL );
  3992.  
  3993. /*
  3994.     RtlFormatCurrentUserKeyPath (FUNCTION)
  3995.     INFO-0
  3996. */
  3997. typedef NTSTATUS (NTAPI *_RtlFormatCurrentUserKeyPath)( OUT PUNICODE_STRING RegistryPath );
  3998.  
  3999. /*
  4000.     RtlFreeHeap (FUNCTION)
  4001.     INFO-0
  4002.      Maps directly to Win32 API HeapFree from Kernel32.dll.
  4003. */
  4004. typedef BOOLEAN (NTAPI *_RtlFreeHeap)( IN PVOID HeapHandle, IN ULONG Flags OPTIONAL, IN PVOID MemoryPointer );
  4005.  
  4006. /*
  4007.     RtlGetCallersAddress (FUNCTION)
  4008.     INFO-0
  4009.      Routine RtlGetCallersAddress is usefull in program debugging or exceptions control. It returns address of calling instruction.
  4010.     CallersAddress
  4011.      Returns address in body of function that call RtlGetCallersAddress.
  4012.     CallersCaller
  4013.      Returns address in function's calling function that call RtlGetCallersAddress body.
  4014.     Supported on system versions:
  4015.      NT 4.0,Win 2000,Win XP/2003
  4016. */
  4017. typedef PVOID (NTAPI *_RtlGetCallersAddress)( OUT PVOID *CallersAddress, OUT PVOID *CallersCaller );
  4018.  
  4019. /*
  4020.     RtlGetCompressionWorkSpaceSize (FUNCTION)
  4021.     CompressionFormat
  4022.      See RtlCompressBuffer for valid CompressionFormat flags.
  4023.     pNeededBufferSize
  4024.      You must allocate temporary compression buffer for system internal use in compression process.
  4025.     pUnknown
  4026.      -?, propably PageSize (0x4000).
  4027. */
  4028. typedef NTSTATUS (NTAPI *_RtlGetCompressionWorkSpaceSize)( IN ULONG CompressionFormat, OUT PULONG pNeededBufferSize, OUT PULONG pUnknown );
  4029.  
  4030. /*
  4031.     RtlGetProcessHeaps (FUNCTION)
  4032.     MaxNumberOfHeaps
  4033.      DIV CLASS="reg">Size of HeapArray.
  4034.     Return value:
  4035.      DIV CLASS="reg">Number of process heaps.
  4036. */
  4037. typedef ULONG (NTAPI *_RtlGetProcessHeaps)( IN ULONG MaxNumberOfHeaps, OUT PVOID *HeapArray );
  4038.  
  4039. /*
  4040.     RtlImageNtHeader (FUNCTION)
  4041.     ModuleAddress
  4042.      Is module base address in process virtual memory, known as HMODULE.
  4043.     Return value
  4044.      Is pointer to IMAGE_NT_HEADERS structure.
  4045. */
  4046. typedef PIMAGE_NT_HEADERS (NTAPI *_RtlImageNtHeader)( IN PVOID ModuleAddress );
  4047.  
  4048. /*
  4049.     RtlImageRvaToVa (FUNCTION)
  4050.     Return value
  4051.      It's pointer to vitrual memory in caller's address space.
  4052.     INFO-1
  4053.      See ImageRvaToVa in &lt;Dbghelp.h&gt; for detailed description of use.
  4054. */
  4055. typedef PVOID (NTAPI *_RtlImageRvaToVa)( IN PIMAGE_NT_HEADERS NtHeaders, IN PVOID ModuleBase, IN ULONG Rva, IN OUT PIMAGE_SECTION_HEADER pLastSection OPTIONAL );
  4056.  
  4057. /*
  4058.     RtlInitializeContext (FUNCTION)
  4059.     INFO-0
  4060.      Initialise CONTEXT structure for use with NtCreateThread.
  4061. */
  4062. typedef PVOID (NTAPI *_RtlInitializeContext)( IN HANDLE ProcessHandle, OUT PCONTEXT ThreadContext, IN PVOID ThreadStartParam OPTIONAL, IN PTHREAD_START_ROUTINE ThreadStartAddress, IN PINITIAL_TEB InitialTeb );
  4063.  
  4064. /*
  4065.     RtlLockHeap (FUNCTION)
  4066.     HeapHandle
  4067.      eap address.
  4068.     INFO-1
  4069.      <HR WIDTH="40%">
  4070.     INFO-2
  4071.      Function protect locks virtual memory. See NtLockVirtualMemory for additional information.
  4072. */
  4073. typedef BOOLEAN (NTAPI *_RtlLockHeap)( IN PVOID HeapHandle );
  4074.  
  4075. /*
  4076.     RtlProtectHeap (FUNCTION)
  4077.     HeapHandle
  4078.      ddress of heap.
  4079.     Protect
  4080.      f set, memory is protected to PAGE_READONLY. If zero, protect with PAGE_READWRITE.
  4081.     Return value
  4082.      esult is address of protected or unprotected heap.
  4083. */
  4084. typedef PVOID (NTAPI *_RtlProtectHeap)( IN PVOID HeapHandle, IN BOOLEAN Protect );
  4085.  
  4086. /*
  4087.     RtlQueryEnvironmentVariable_U (FUNCTION)
  4088.     Environment
  4089.      ointer to environment block. If NULL, current environment is used.
  4090. */
  4091. typedef NTSTATUS (NTAPI *_RtlQueryEnvironmentVariable_U)( IN PVOID Environment OPTIONAL, IN PUNICODE_STRING VariableName, OUT PUNICODE_STRING VariableValue );
  4092.  
  4093. /*
  4094.     RtlReAllocateHeap (FUNCTION)
  4095.     INFO-0
  4096.      Kernel32.dll HeapReAlloc maps directly to RtlReAllocateHeap. All parameters are descripted in Ms SDK.
  4097. */
  4098. typedef PVOID (NTAPI *_RtlReAllocateHeap)( IN PVOID HeapHandle, IN ULONG Flags, IN PVOID MemoryPointer, IN ULONG Size );
  4099.  
  4100. /*
  4101.     RtlSetCurrentEnvironment (FUNCTION)
  4102.     NewEnvironment
  4103.      ointer to newly created environment block.
  4104.     OldEnvironment
  4105.      eturn pointer to previous environment block. You should release it by call RtlDestroyEnvironment.
  4106. */
  4107. typedef VOID (NTAPI *_RtlSetCurrentEnvironment)( IN PVOID NewEnvironment, OUT PVOID *OldEnvironment OPTIONAL );
  4108.  
  4109. /*
  4110.     RtlSetEnvironmentVariable (FUNCTION)
  4111.     *Environment
  4112.      f Environment is NULL, current environment block is used.
  4113. */
  4114. typedef NTSTATUS (NTAPI *_RtlSetEnvironmentVariable)( IN OUT PVOID *Environment OPTIONAL, IN PUNICODE_STRING VariableName, IN PUNICODE_STRING VariableValue );
  4115.  
  4116. /*
  4117.     RtlSizeHeap (FUNCTION)
  4118.     INFO-0
  4119.      Kernel32.dll HeapSize maps directly to RtlSizeHeap. See Ms SDK for definition.
  4120. */
  4121. typedef ULONG (NTAPI *_RtlSizeHeap)( IN PVOID HeapHandle, IN ULONG Flags, IN PVOID MemoryPointer );
  4122.  
  4123. /*
  4124.     RtlTimeFieldsToTime (FUNCTION)
  4125.     TimeFields
  4126.      Pointer to TIME_FIELDS structure containing time to convert.
  4127.     Time
  4128.      Pointer to LARGE_INTEGER receiving converted time.
  4129. */
  4130. typedef BOOLEAN (NTAPI *_RtlTimeFieldsToTime)( IN PTIME_FIELDS TimeFields, OUT PLARGE_INTEGER Time );
  4131.  
  4132. /*
  4133.     RtlTimeToTimeFields (FUNCTION)
  4134.     Time
  4135.      Pointer to LARGE_INTEGER contains time to convert.
  4136.     TimeFields
  4137.      Result of call - pointer to TIME_FIELDS structure.
  4138. */
  4139. typedef VOID (NTAPI *_RtlTimeToTimeFields)( IN PLARGE_INTEGER Time, OUT PTIME_FIELDS TimeFields );
  4140.  
  4141. /*
  4142.     RtlUnlockHeap (FUNCTION)
  4143.     HeapHandle
  4144.      ddress of heap.
  4145.     INFO-1
  4146.      See RtlLockHeap for details.
  4147. */
  4148. typedef BOOLEAN (NTAPI *_RtlUnlockHeap)( IN PVOID HeapHandle );
  4149.  
  4150. /*
  4151.     RtlValidateHeap (FUNCTION)
  4152.     HeapHandle
  4153.      ddress of heap to validate.
  4154.     Flags
  4155.      ee RtlCreateHeap.
  4156.     AddressToValidate
  4157.      f specified, only one block is validated. If not, all blocks from heap are validated.
  4158. */
  4159. typedef BOOLEAN (NTAPI *_RtlValidateHeap)( IN PVOID HeapHandle, IN ULONG Flags, IN PVOID AddressToValidate OPTIONAL );
  4160.  
  4161. /*
  4162.     RtlValidateProcessHeaps (FUNCTION)
  4163.     INFO-0
  4164.      Function validate all heaps associated with calling process. See RtlValidateHeap for more information.
  4165. */
  4166. typedef BOOLEAN (NTAPI *_RtlValidateProcessHeaps)( );
  4167.  
  4168. /*
  4169.     RtlWalkHeap (FUNCTION)
  4170.     HeapHandle
  4171.      ddress of heap.
  4172.     ProcessHeapEntry
  4173.      ointer to PROCESS_HEAP_ENTRY structure defined in &lt;WinNT.h&gt;.
  4174.     Return value
  4175.      epeat calls to RtlWalkHeap until result is STATUS_NO_MORE_ENTRIES.
  4176. */
  4177. typedef NTSTATUS (NTAPI *_RtlWalkHeap)( IN PVOID HeapHandle, IN OUT LPPROCESS_HEAP_ENTRY ProcessHeapEntry );
  4178.  
  4179. /*
  4180.     RTL_DRIVE_LETTER_CURDIR (STRUCT)
  4181.     INFO-1
  4182.      Flags
  4183.     INFO-2
  4184.      Length
  4185.     INFO-3
  4186.      TimeStamp
  4187.     INFO-4
  4188.      DosPath
  4189. */
  4190. typedef struct _RTL_DRIVE_LETTER_CURDIR {
  4191.     USHORT Flags;
  4192.     USHORT Length;
  4193.     ULONG TimeStamp;
  4194.     UNICODE_STRING DosPath;
  4195. } RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
  4196.  
  4197. /*
  4198.     RTL_HEAP_DEFINITION (STRUCT)
  4199.     INFO-0
  4200. */
  4201. typedef struct _RTL_HEAP_DEFINITION {
  4202.     ULONG Length;
  4203.     ULONG Unknown1;
  4204.     ULONG Unknown2;
  4205.     ULONG Unknown3;
  4206.     ULONG Unknown4;
  4207.     ULONG Unknown5;
  4208.     ULONG Unknown6;
  4209.     ULONG Unknown7;
  4210.     ULONG Unknown8;
  4211.     ULONG Unknown9;
  4212.     ULONG Unknown10;
  4213.     ULONG Unknown11;
  4214.     ULONG Unknown12;
  4215. } RTL_HEAP_DEFINITION, *PRTL_HEAP_DEFINITION;
  4216.  
  4217. /*
  4218.     RTL_USER_PROCESS_INFORMATION (STRUCT)
  4219.     Size
  4220.      ize of structure, in bytes.
  4221.     ProcessHandle
  4222.      I>HANDLE to newly created Process object.
  4223.     ThreadHandle
  4224.      I>HANDLE to Thread object representing main thread in process.
  4225.     ClientId
  4226.      nique Id of process and thread.
  4227.     ImageInformation
  4228.      ome information from PE header. Created in result of call NtQuerySection with SectionImageInformation class.
  4229. */
  4230. typedef struct _RTL_USER_PROCESS_INFORMATION {
  4231.     ULONG Size;
  4232.     HANDLE ProcessHandle;
  4233.     HANDLE ThreadHandle;
  4234.     CLIENT_ID ClientId;
  4235.     SECTION_IMAGE_INFORMATION ImageInformation;
  4236. } RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION;
  4237.  
  4238. /*
  4239.     RTL_USER_PROCESS_PARAMETERS (STRUCT)
  4240.     MaximumLength
  4241.      hould be set before call RtlCreateProcessParameters.
  4242.     Length
  4243.      ength of valid structure.
  4244.     Flags
  4245.      urrently only one flag is known:
  4246.     INFO-3
  4247.      DebugFlags
  4248.     ConsoleHandle
  4249.      B>HWND to console window associated with process (if any).
  4250.     INFO-5
  4251.      ConsoleFlags
  4252.     INFO-6
  4253.      StdInputHandle
  4254.     INFO-7
  4255.      StdOutputHandle
  4256.     INFO-8
  4257.      StdErrorHandle
  4258.     CurrentDirectoryPath
  4259.      pecified in DOS-like symbolic link path, ex: "C:/WinNT/SYSTEM32"
  4260.     CurrentDirectoryHandle
  4261.      andle to FILE object.
  4262.     DllPath
  4263.      OS-like paths separated by ';' where system shoult search for DLL files.
  4264.     ImagePathName
  4265.      ull path in DOS-like format to process'es file image.
  4266.     CommandLine
  4267.      ommand line.
  4268.     Environment
  4269.      ointer to environment block (see RtlCreateEnvironment).
  4270.     INFO-15
  4271.      StartingPositionLeft
  4272.     INFO-16
  4273.      StartingPositionTop
  4274.     INFO-17
  4275.      Width
  4276.     INFO-18
  4277.      Height
  4278.     INFO-19
  4279.      CharWidth
  4280.     INFO-20
  4281.      CharHeight
  4282.     INFO-21
  4283.      ConsoleTextAttributes
  4284.     INFO-22
  4285.      WindowFlags
  4286.     INFO-23
  4287.      ShowWindowFlags
  4288.     INFO-24
  4289.      WindowTitle
  4290.     DesktopName
  4291.      ame of WindowStation and Desktop objects, where process is assigned.
  4292.     INFO-26
  4293.      ShellInfo
  4294.     INFO-27
  4295.      RuntimeData
  4296.     INFO-29
  4297.      <HR WIDTH="40%">
  4298.     INFO-30
  4299.      RTL_USER_PROCESS_PARAMETERS is located at address 0x20000 (for all processes created by call WIN32 API CreateProcess).
  4300. */
  4301. typedef struct _RTL_USER_PROCESS_PARAMETERS {
  4302.     ULONG MaximumLength;
  4303.     ULONG Length;
  4304.     ULONG Flags;
  4305.     ULONG DebugFlags;
  4306.     PVOID ConsoleHandle;
  4307.     ULONG ConsoleFlags;
  4308.     HANDLE StdInputHandle;
  4309.     HANDLE StdOutputHandle;
  4310.     HANDLE StdErrorHandle;
  4311.     UNICODE_STRING CurrentDirectoryPath;
  4312.     HANDLE CurrentDirectoryHandle;
  4313.     UNICODE_STRING DllPath;
  4314.     UNICODE_STRING ImagePathName;
  4315.     UNICODE_STRING CommandLine;
  4316.     PVOID Environment;
  4317.     ULONG StartingPositionLeft;
  4318.     ULONG StartingPositionTop;
  4319.     ULONG Width;
  4320.     ULONG Height;
  4321.     ULONG CharWidth;
  4322.     ULONG CharHeight;
  4323.     ULONG ConsoleTextAttributes;
  4324.     ULONG WindowFlags;
  4325.     ULONG ShowWindowFlags;
  4326.     UNICODE_STRING WindowTitle;
  4327.     UNICODE_STRING DesktopName;
  4328.     UNICODE_STRING ShellInfo;
  4329.     UNICODE_STRING RuntimeData;
  4330.     RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];
  4331. } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
  4332.  
  4333. /*
  4334.     SECTION_BASIC_INFORMATION (STRUCT)
  4335.     Unknown
  4336.      (?), always set to zero.
  4337.     SectionAttributes
  4338.      Can be one or combination of:
  4339.     INFO-2
  4340.         SEC_RESERVE SEC_IMAGE   SEC_FILE
  4341.     SectionSize
  4342.      Size of section, in bytes. This value equals to section's size declared in a call to NtCreateSection or NtExtendSection.
  4343. */
  4344. typedef struct _SECTION_BASIC_INFORMATION {
  4345.     ULONG Unknown;
  4346.     ULONG SectionAttributes;
  4347.     LARGE_INTEGER SectionSize;
  4348. } SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;
  4349.  
  4350. /*
  4351.     SECTION_IMAGE_INFORMATION (STRUCT)
  4352.     EntryPoint
  4353.      Image's entry point.
  4354.     StackZeroBits
  4355.      Number of bits from left side of stack address must be set to zero. It means maximum stack's address in process memory.
  4356.     StackReserved
  4357.      Total size of stack, in bytes.
  4358.     StackCommit
  4359.      Initially commited stack's block size.
  4360.     ImageSubsystem
  4361.      One of IMAGE_SUBSYSTEM_* descripted in Microsoft SDK and avaiable in &lt;winnt.h&gt; header file.
  4362.     SubSystemVersionLow
  4363.      Minor version number of subsystem.
  4364.     SubSystemVersionHigh
  4365.      Major version number of subsystem.
  4366.     Unknown1
  4367.      (?)
  4368.     ImageCharacteristics
  4369.      DLL Characteristics.
  4370.     ImageMachineType
  4371.      One of IMAGE_FILE_MACHINE_*.
  4372.     Unknown2[3]
  4373.      (?)
  4374. */
  4375. typedef struct _SECTION_IMAGE_INFORMATION {
  4376.     PVOID EntryPoint;
  4377.     ULONG StackZeroBits;
  4378.     ULONG StackReserved;
  4379.     ULONG StackCommit;
  4380.     ULONG ImageSubsystem;
  4381.     WORD SubSystemVersionLow;
  4382.     WORD SubSystemVersionHigh;
  4383.     ULONG Unknown1;
  4384.     ULONG ImageCharacteristics;
  4385.     ULONG ImageMachineType;
  4386.     ULONG Unknown2[3];
  4387. } SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;
  4388.  
  4389. /*
  4390.     SECTION_INFORMATION_CLASS (ENUM)
  4391. */
  4392. typedef enum _SECTION_INFORMATION_CLASS {
  4393.     SectionBasicInformation,
  4394.     SectionImageInformation
  4395. } SECTION_INFORMATION_CLASS, *PSECTION_INFORMATION_CLASS;
  4396.  
  4397. /*
  4398.     SECTION_INHERIT (ENUM)
  4399. */
  4400. typedef enum _SECTION_INHERIT {
  4401.     ViewShare=1,
  4402.     ViewUnmap=2
  4403. } SECTION_INHERIT, *PSECTION_INHERIT;
  4404.  
  4405. /*
  4406.     SEMAPHORE_BASIC_INFORMATION (STRUCT)
  4407.     CurrentCount
  4408.      Current state of semaphore's counter.
  4409.     MaximumCount
  4410.      Maximum counter position, defined with call to NtCreateSemaphore.
  4411. */
  4412. typedef struct _SEMAPHORE_BASIC_INFORMATION {
  4413.     ULONG CurrentCount;
  4414.     ULONG MaximumCount;
  4415. } SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;
  4416.  
  4417. /*
  4418.     SEMAPHORE_INFORMATION_CLASS (ENUM)
  4419. */
  4420. typedef enum _SEMAPHORE_INFORMATION_CLASS {
  4421.     SemaphoreBasicInformation
  4422. } SEMAPHORE_INFORMATION_CLASS, *PSEMAPHORE_INFORMATION_CLASS;
  4423.  
  4424. /*
  4425.     SHUTDOWN_ACTION (ENUM)
  4426. */
  4427. typedef enum _SHUTDOWN_ACTION {
  4428.     ShutdownNoReboot,
  4429.     ShutdownReboot,
  4430.     ShutdownPowerOff
  4431. } SHUTDOWN_ACTION, *PSHUTDOWN_ACTION;
  4432.  
  4433. /*
  4434.     SYSDBG_COMMAND (ENUM)
  4435. */
  4436. typedef enum _SYSDBG_COMMAND {
  4437.     SysDbgQueryModuleInformation=1,
  4438.     SysDbgQueryTraceInformation,
  4439.     SysDbgSetTracepoint,
  4440.     SysDbgSetSpecialCall,
  4441.     SysDbgClearSpecialCalls,
  4442.     SysDbgQuerySpecialCalls
  4443. } SYSDBG_COMMAND, *PSYSDBG_COMMAND;
  4444.  
  4445. /*
  4446.     SYSTEM_INFORMATION_CLASS (ENUM)
  4447. */
  4448. typedef enum _SYSTEM_INFORMATION_CLASS {
  4449.     SystemBasicInformation,
  4450.     SystemProcessorInformation,
  4451.     SystemPerformanceInformation,
  4452.     SystemTimeOfDayInformation,
  4453.     SystemPathInformation,
  4454.     SystemProcessInformation,
  4455.     SystemCallCountInformation,
  4456.     SystemDeviceInformation,
  4457.     SystemProcessorPerformanceInformation,
  4458.     SystemFlagsInformation,
  4459.     SystemCallTimeInformation,
  4460.     SystemModuleInformation,
  4461.     SystemLocksInformation,
  4462.     SystemStackTraceInformation,
  4463.     SystemPagedPoolInformation,
  4464.     SystemNonPagedPoolInformation,
  4465.     SystemHandleInformation,
  4466.     SystemObjectInformation,
  4467.     SystemPageFileInformation,
  4468.     SystemVdmInstemulInformation,
  4469.     SystemVdmBopInformation,
  4470.     SystemFileCacheInformation,
  4471.     SystemPoolTagInformation,
  4472.     SystemInterruptInformation,
  4473.     SystemDpcBehaviorInformation,
  4474.     SystemFullMemoryInformation,
  4475.     SystemLoadGdiDriverInformation,
  4476.     SystemUnloadGdiDriverInformation,
  4477.     SystemTimeAdjustmentInformation,
  4478.     SystemSummaryMemoryInformation,
  4479.     SystemNextEventIdInformation,
  4480.     SystemEventIdsInformation,
  4481.     SystemCrashDumpInformation,
  4482.     SystemExceptionInformation,
  4483.     SystemCrashDumpStateInformation,
  4484.     SystemKernelDebuggerInformation,
  4485.     SystemContextSwitchInformation,
  4486.     SystemRegistryQuotaInformation,
  4487.     SystemExtendServiceTableInformation,
  4488.     SystemPrioritySeperation,
  4489.     SystemPlugPlayBusInformation,
  4490.     SystemDockInformation,
  4491.     SystemPowerInformation,
  4492.     SystemProcessorSpeedInformation,
  4493.     SystemCurrentTimeZoneInformation,
  4494.     SystemLookasideInformation
  4495. } SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;
  4496.  
  4497. /*
  4498.     SYSTEM_MODULE (STRUCT)
  4499.     Reserved1
  4500.      DIV CLASS="reg">Reserved (always 0xBAADF00D).
  4501.     Reserved2
  4502.      DIV CLASS="reg">Reserved (always 0).
  4503.     Address
  4504.      DIV CLASS="reg">Module address in virtual address space.
  4505.     ImageSize
  4506.      DIV CLASS="reg">Size of module in virtual address space.
  4507.     Id
  4508.      DIV CLASS="reg">0-based counter of results.
  4509.     Rank
  4510.      DIV CLASS="reg">The same as Id (in global enumeration with NtQuerySystemInformation), or unknown.
  4511.     w018
  4512.      DIV CLASS="reg">In process module enumeration with LdrQueryProcessModuleInformation always 0xFFFF, in other - unknown.
  4513.     NameOffset
  4514.      DIV CLASS="reg">Offset in Name table to first char of module name.
  4515.     Name
  4516.      DIV CLASS="reg">Path to module.
  4517. */
  4518. typedef struct _SYSTEM_MODULE {
  4519.     ULONG Reserved1;
  4520.     ULONG Reserved2;
  4521.     PVOID ImageBaseAddress;
  4522.     ULONG ImageSize;
  4523.     ULONG Flags;
  4524.     WORD Id;
  4525.     WORD Rank;
  4526.     WORD w018;
  4527.     WORD NameOffset;
  4528.     BYTE Name[MAXIMUM_FILENAME_LENGTH];
  4529. } SYSTEM_MODULE, *PSYSTEM_MODULE;
  4530.  
  4531. /*
  4532.     SYSTEM_MODULE_INFORMATION (STRUCT)
  4533.     See SYSTEM_MODULE for details.
  4534.      See NtQuerySystemInformation with SystemModuleInformation class for global module enumeration.
  4535. */
  4536. typedef struct _SYSTEM_MODULE_INFORMATION {
  4537.     ULONG ModulesCount;
  4538.     SYSTEM_MODULE Modules[0];
  4539. } SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
  4540.  
  4541. /*
  4542.     SYSTEM_PAGEFILE_INFORMATION (STRUCT)
  4543.     NextEntryOffset
  4544.      Offset to next SYSTEM_PAGEFILE_INFORMATION structure or zero, if it's last one.
  4545.     TotalSize
  4546.      Size of paged file, in pages (Size of page depend on machine type, for x86 one page is 0x1000 (4096) bytes).
  4547.     TotalInUse
  4548.      Number of currently used pages in paged file.
  4549.     PeakUsage
  4550.      Maximum number of pages used in this boot session.
  4551.     PageFileName
  4552.      System path to paged file.
  4553. */
  4554. typedef struct _SYSTEM_PAGEFILE_INFORMATION {
  4555.     ULONG NextEntryOffset;
  4556.     ULONG TotalSize;
  4557.     ULONG TotalInUse;
  4558.     ULONG PeakUsage;
  4559.     UNICODE_STRING PageFileName;
  4560. } SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION;
  4561.  
  4562. /*
  4563.     SYSTEM_PROCESS_INFORMATION (STRUCT)
  4564.     NextEntryOffset
  4565.      Offset from begining of output buffer to next process entry. On last entry contains zero.
  4566.     NumberOfThreads
  4567.      Number of process'es threads. Also number of members in Threads array descripted below.
  4568.     Reserved[3]
  4569.      Reserved.
  4570.     CreateTime
  4571.      Process creation time, in 100-ns units.
  4572.     UserTime
  4573.      Effective time in User Mode.
  4574.     KernelTime
  4575.      Effective time in Kernel Mode.
  4576.     ImageName
  4577.      Process name, based on executable file name.
  4578.     BasePriority
  4579.      Process base priority.
  4580.     ProcessId
  4581.      Unique identifier of process.
  4582.     InheritedFromProcessId
  4583.      Creator's identifier.
  4584.     HandleCount
  4585.      Nr of open HANDLEs.
  4586.     Reserved2[2]
  4587.      Reserved.
  4588.     PrivatePageCount
  4589.      Number of memory pages assigned to process.
  4590.     VirtualMemoryCounters
  4591.      Memory performance counters.
  4592.     IoCounters
  4593.      IO performance counters.
  4594.     Threads[0]
  4595.      Array of SYSTEM_THREAD structures descripting process's threads.
  4596. */
  4597. typedef struct _SYSTEM_PROCESS_INFORMATION {
  4598.     ULONG NextEntryOffset;
  4599.     ULONG NumberOfThreads;
  4600.     LARGE_INTEGER Reserved[3];
  4601.     LARGE_INTEGER CreateTime;
  4602.     LARGE_INTEGER UserTime;
  4603.     LARGE_INTEGER KernelTime;
  4604.     UNICODE_STRING ImageName;
  4605.     KPRIORITY BasePriority;
  4606.     HANDLE ProcessId;
  4607.     HANDLE InheritedFromProcessId;
  4608.     ULONG HandleCount;
  4609.     ULONG Reserved2[2];
  4610.     ULONG PrivatePageCount;
  4611.     VM_COUNTERS VirtualMemoryCounters;
  4612.     IO_COUNTERS IoCounters;
  4613.     SYSTEM_THREAD Threads[0];
  4614. } SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
  4615.  
  4616. /*
  4617.     SYSTEM_REGISTRY_QUOTA_INFORMATION (STRUCT)
  4618.     RegistryQuotaAllowed
  4619.      llowed size of all currently loaded hives.
  4620.     RegistryQuotaUsed
  4621.      ize of all currently loaded hives.
  4622.     PagedPoolSize
  4623.      aged Pool size. RegistryQuotaAllowed shouldn't be grater then 80 percent of PagedPoolSize.
  4624.     INFO-3
  4625.      <HR WIDTH="40%">
  4626.     Remember that registry size is always sum of all loaded hives. So if you call NtSaveKey, size of registry will have the highest point at the end of saving.
  4627.      SYSTEM_REGISTRY_QUOTA_INFORMATION don't need restart of system to change registry quota.
  4628. */
  4629. typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION {
  4630.     ULONG RegistryQuotaAllowed;
  4631.     ULONG RegistryQuotaUsed;
  4632.     ULONG PagedPoolSize;
  4633. } SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION;
  4634.  
  4635. /*
  4636.     SYSTEM_THREAD (STRUCT)
  4637.     KernelTime
  4638.        Sum of thread's execution time in KernelMode, in native format.
  4639.     UserTime
  4640.       Sum of thread's execution time in UserMode, in native format.
  4641.     CreateTime
  4642.       Time of thread creation, in native format.
  4643.     WaitTime
  4644.        Sum of thread's waiting time, in native format.
  4645.     StartAddress
  4646.        Thread start address.
  4647.     ClientId
  4648.        Process and thread identyficators.
  4649.     Priority
  4650.        Thread prioryty.
  4651.     BasePriority
  4652.        Thread base prioryty.
  4653.     ContextSwitchCount
  4654.        Number of context switches executed by thread.
  4655.     State
  4656.        Current thread's state.
  4657.     WaitReason
  4658.        Reason for waiting (if any).
  4659. */
  4660. typedef struct _SYSTEM_THREAD {
  4661.     LARGE_INTEGER KernelTime;
  4662.     LARGE_INTEGER UserTime;
  4663.     LARGE_INTEGER CreateTime;
  4664.     ULONG WaitTime;
  4665.     PVOID StartAddress;
  4666.     CLIENT_ID ClientId;
  4667.     KPRIORITY Priority;
  4668.     LONG BasePriority;
  4669.     ULONG ContextSwitchCount;
  4670.     ULONG State;
  4671.     KWAIT_REASON WaitReason;
  4672. } SYSTEM_THREAD, *PSYSTEM_THREAD;
  4673.  
  4674. /*
  4675.     TEB (STRUCT)
  4676.     Tib
  4677.      Structure NT_TIB is avaiable in &lt;WinNT.h&gt; header file.
  4678.     INFO-1
  4679.      EnvironmentPointer
  4680.     INFO-2
  4681.      Cid
  4682.     INFO-3
  4683.      ActiveRpcInfo
  4684.     INFO-4
  4685.      ThreadLocalStoragePointer
  4686.     Peb
  4687.      Pointer to PEB structure contains Process Environment Block.
  4688.     INFO-6
  4689.      LastErrorValue
  4690.     INFO-7
  4691.      CountOfOwnedCriticalSections
  4692.     INFO-8
  4693.      CsrClientThread
  4694.     INFO-9
  4695.      Win32ThreadInfo
  4696.     INFO-10
  4697.      Win32ClientInfo[0x1F]
  4698.     INFO-11
  4699.      WOW32Reserved
  4700.     INFO-12
  4701.      CurrentLocale
  4702.     INFO-13
  4703.      FpSoftwareStatusRegister
  4704.     INFO-14
  4705.      SystemReserved1[0x36]
  4706.     INFO-15
  4707.      Spare1
  4708.     INFO-16
  4709.      ExceptionCode
  4710.     INFO-17
  4711.      SpareBytes1[0x28]
  4712.     INFO-18
  4713.      SystemReserved2[0xA]
  4714.     INFO-19
  4715.      GdiRgn
  4716.     INFO-20
  4717.      GdiPen
  4718.     INFO-21
  4719.      GdiBrush
  4720.     INFO-22
  4721.      RealClientId
  4722.     INFO-23
  4723.      GdiCachedProcessHandle
  4724.     INFO-24
  4725.      GdiClientPID
  4726.     INFO-25
  4727.      GdiClientTID
  4728.     INFO-26
  4729.      GdiThreadLocaleInfo
  4730.     INFO-27
  4731.      UserReserved[5]
  4732.     INFO-28
  4733.      GlDispatchTable[0x118]
  4734.     INFO-29
  4735.      GlReserved1[0x1A]
  4736.     INFO-30
  4737.      GlReserved2
  4738.     INFO-31
  4739.      GlSectionInfo
  4740.     INFO-32
  4741.      GlSection
  4742.     INFO-33
  4743.      GlTable
  4744.     INFO-34
  4745.      GlCurrentRC
  4746.     INFO-35
  4747.      GlContext
  4748.     INFO-36
  4749.      LastStatusValue
  4750.     INFO-37
  4751.      StaticUnicodeString
  4752.     INFO-38
  4753.      StaticUnicodeBuffer[0x105]
  4754.     INFO-39
  4755.      DeallocationStack
  4756.     INFO-40
  4757.      TlsSlots[0x40]
  4758.     INFO-41
  4759.      TlsLinks
  4760.     INFO-42
  4761.      Vdm
  4762.     INFO-43
  4763.      ReservedForNtRpc
  4764.     INFO-44
  4765.      DbgSsReserved[0x2]
  4766.     INFO-45
  4767.      HardErrorDisabled
  4768.     INFO-46
  4769.      Instrumentation[0x10]
  4770.     INFO-47
  4771.      WinSockData
  4772.     INFO-48
  4773.      GdiBatchCount
  4774.     INFO-49
  4775.      Spare2
  4776.     INFO-50
  4777.      Spare3
  4778.     INFO-51
  4779.      Spare4
  4780.     INFO-52
  4781.      ReservedForOle
  4782.     INFO-53
  4783.      WaitingOnLoaderLock
  4784.     INFO-54
  4785.      StackCommit
  4786.     INFO-55
  4787.      StackCommitMax
  4788.     INFO-56
  4789.      StackReserved
  4790. */
  4791. typedef struct _TEB {
  4792.     NT_TIB Tib;
  4793.     PVOID EnvironmentPointer;
  4794.     CLIENT_ID Cid;
  4795.     PVOID ActiveRpcInfo;
  4796.     PVOID ThreadLocalStoragePointer;
  4797.     PPEB Peb;
  4798.     ULONG LastErrorValue;
  4799.     ULONG CountOfOwnedCriticalSections;
  4800.     PVOID CsrClientThread;
  4801.     PVOID Win32ThreadInfo;
  4802.     ULONG Win32ClientInfo[0x1F];
  4803.     PVOID WOW32Reserved;
  4804.     ULONG CurrentLocale;
  4805.     ULONG FpSoftwareStatusRegister;
  4806.     PVOID SystemReserved1[0x36];
  4807.     PVOID Spare1;
  4808.     ULONG ExceptionCode;
  4809.     ULONG SpareBytes1[0x28];
  4810.     PVOID SystemReserved2[0xA];
  4811.     ULONG GdiRgn;
  4812.     ULONG GdiPen;
  4813.     ULONG GdiBrush;
  4814.     CLIENT_ID RealClientId;
  4815.     PVOID GdiCachedProcessHandle;
  4816.     ULONG GdiClientPID;
  4817.     ULONG GdiClientTID;
  4818.     PVOID GdiThreadLocaleInfo;
  4819.     PVOID UserReserved[5];
  4820.     PVOID GlDispatchTable[0x118];
  4821.     ULONG GlReserved1[0x1A];
  4822.     PVOID GlReserved2;
  4823.     PVOID GlSectionInfo;
  4824.     PVOID GlSection;
  4825.     PVOID GlTable;
  4826.     PVOID GlCurrentRC;
  4827.     PVOID GlContext;
  4828.     NTSTATUS LastStatusValue;
  4829.     UNICODE_STRING StaticUnicodeString;
  4830.     WCHAR StaticUnicodeBuffer[0x105];
  4831.     PVOID DeallocationStack;
  4832.     PVOID TlsSlots[0x40];
  4833.     LIST_ENTRY TlsLinks;
  4834.     PVOID Vdm;
  4835.     PVOID ReservedForNtRpc;
  4836.     PVOID DbgSsReserved[0x2];
  4837.     ULONG HardErrorDisabled;
  4838.     PVOID Instrumentation[0x10];
  4839.     PVOID WinSockData;
  4840.     ULONG GdiBatchCount;
  4841.     ULONG Spare2;
  4842.     ULONG Spare3;
  4843.     ULONG Spare4;
  4844.     PVOID ReservedForOle;
  4845.     ULONG WaitingOnLoaderLock;
  4846.     PVOID StackCommit;
  4847.     PVOID StackCommitMax;
  4848.     PVOID StackReserved;
  4849. } TEB, *PTEB;
  4850.  
  4851. /*
  4852.     THREAD_BASIC_INFORMATION (STRUCT)
  4853.     INFO-0
  4854.      Structure is used with ThreadBasicInformation information class in NtQueryInformationThread call.
  4855. */
  4856. typedef struct _THREAD_BASIC_INFORMATION {
  4857.     NTSTATUS ExitStatus;
  4858.     PVOID TebBaseAddress;
  4859.     CLIENT_ID ClientId;
  4860.     KAFFINITY AffinityMask;
  4861.     KPRIORITY Priority;
  4862.     KPRIORITY BasePriority;
  4863. } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
  4864.  
  4865. /*
  4866.     THREAD_INFORMATION_CLASS (ENUM)
  4867. */
  4868. typedef enum _THREAD_INFORMATION_CLASS {
  4869.     ThreadBasicInformation,
  4870.     ThreadTimes,
  4871.     ThreadPriority,
  4872.     ThreadBasePriority,
  4873.     ThreadAffinityMask,
  4874.     ThreadImpersonationToken,
  4875.     ThreadDescriptorTableEntry,
  4876.     ThreadEnableAlignmentFaultFixup,
  4877.     ThreadEventPair,
  4878.     ThreadQuerySetWin32StartAddress,
  4879.     ThreadZeroTlsCell,
  4880.     ThreadPerformanceCount,
  4881.     ThreadAmILastThread,
  4882.     ThreadIdealProcessor,
  4883.     ThreadPriorityBoost,
  4884.     ThreadSetTlsArrayAddress,
  4885.     ThreadIsIoPending,
  4886.     ThreadHideFromDebugger
  4887. } THREAD_INFORMATION_CLASS, *PTHREAD_INFORMATION_CLASS;
  4888.  
  4889. /*
  4890.     THREAD_TIMES_INFORMATION (STRUCT)
  4891.     CreationTime
  4892.      ime of thread creation.
  4893.     ExitTime
  4894.      ime of thread termination.
  4895.     KernelTime
  4896.      ime that thread spent in KernelMode.
  4897.     UserTime
  4898.      ime that thread spent in UserMode.
  4899.     INFO-4
  4900.      <HR WIDTH="40%">
  4901.     INFO-5
  4902.      Structure is used with ThreadTimes information class in NtQueryInformationThread call.
  4903. */
  4904. typedef struct _THREAD_TIMES_INFORMATION {
  4905.     LARGE_INTEGER CreationTime;
  4906.     LARGE_INTEGER ExitTime;
  4907.     LARGE_INTEGER KernelTime;
  4908.     LARGE_INTEGER UserTime;
  4909. } THREAD_TIMES_INFORMATION, *PTHREAD_TIMES_INFORMATION;
  4910.  
  4911. /*
  4912.     TIMER_BASIC_INFORMATION (STRUCT)
  4913.     RemainingTime
  4914.      Contains time (in 100ns units) to next timer signal (negative value), or time after last signalization.
  4915.     TimerState
  4916.      If TRUE, timer is signaled.
  4917. */
  4918. typedef struct _TIMER_BASIC_INFORMATION {
  4919.     LARGE_INTEGER RemainingTime;
  4920.     BOOLEAN TimerState;
  4921. } TIMER_BASIC_INFORMATION, *PTIMER_BASIC_INFORMATION;
  4922.  
  4923. /*
  4924.     TIMER_INFORMATION_CLASS (ENUM)
  4925. */
  4926. typedef enum _TIMER_INFORMATION_CLASS {
  4927.     TimerBasicInformation
  4928. } TIMER_INFORMATION_CLASS, *PTIMER_INFORMATION_CLASS;
  4929.  
  4930. /*
  4931.     TIME_FIELDS (STRUCT)
  4932.     Year
  4933.      Year, in range 1601 - 65535.
  4934.     Month
  4935.      Month, in range 1 - 12.
  4936.     Day
  4937.      Day, in range 1 - 31, dependly on Month member.
  4938.     Hour
  4939.      Hour, in range 0 - 23.
  4940.     Minute
  4941.      Minute, in range 0 - 59.
  4942.     Second
  4943.      Second, in range 0 - 59.
  4944.     Milliseconds
  4945.      Milliseconds, in range 0 - 1000.
  4946.     Weekday
  4947.      Day of week, in range 0 - 6, where 0 means "Sunday", 1 means "Monday" etc.
  4948. */
  4949. typedef struct _TIME_FIELDS {
  4950.     USHORT Year;
  4951.     USHORT Month;
  4952.     USHORT Day;
  4953.     USHORT Hour;
  4954.     USHORT Minute;
  4955.     USHORT Second;
  4956.     USHORT Milliseconds;
  4957.     USHORT Weekday;
  4958. } TIME_FIELDS, *PTIME_FIELDS;
  4959.  
  4960. /*
  4961. <?php
  4962. //PHP NTINTERNALS SCRAPER
  4963. $dump_file = "O:/NTAPI.h";
  4964. $use_dll_import = FALSE; //Remove NTSYSAPI from function typedefs?
  4965. //Iterate through api index
  4966. $api_base   = "http://undocumented.ntinternals.net";
  4967. $api_index  = "$api_base/aindex.html";
  4968. $page = strip_tags(file_get_contents($api_index), '<a>');
  4969. $indexstart = strpos($page, '<A HREF="/title.html">About</a>');
  4970. $indexstart = $indexstart + strlen('<A HREF="/title.html">About</a>');
  4971. $indexend = strpos($page, 'Autogenerated by mkindex.awk', $indexstart);
  4972. $index = ltrim(rtrim(substr($page, $indexstart, $indexend - $indexstart)));
  4973. $index = str_replace('<A HREF="', '', $index);
  4974. $index = str_replace('">', ':', $index);
  4975. $index = str_replace('</a>', '', $index);
  4976. //Format now => URL:NAME\n
  4977. $limit_apis = 999;
  4978. echo "Dumping APIs to $dump_file\n";
  4979. file_put_contents($dump_file, "// SCRAPED FROM: $api_index\n// BY: Capt. Micro\n// SCRIPT: End of file\n\n");
  4980. $indexexp = explode("\n", $index);
  4981. foreach ($indexexp as $key => $line) {
  4982.     if ((int)$key > $limit_apis) break;
  4983.     $lineexp = explode(":", $line);
  4984.     if ($lineexp[1] == "Index") continue;
  4985.     echo "[$key] Scraping API " . $lineexp[1] . "... ";
  4986.     $apidata = get_api($api_base . str_replace(" ", "%20", $lineexp[0]), 0);
  4987.     if ($apidata != FALSE)
  4988.         file_put_contents($dump_file,
  4989.         $apidata[0]."\n".$apidata[1]."\n\n",
  4990.         FILE_APPEND);
  4991.     echo " DONE\n";
  4992. }
  4993. file_put_conents($dump_file, "\n\n\n".file_get_conents(__FILE__), FILE_APPEND);
  4994. $namesearch = array('<TITLE>','</TITLE>');
  4995. $codesearch = array('<PRE CLASS="FnDefinition">','</PRE>');
  4996. $docssearch = array('<PRE>','</PRE>');
  4997. function get_api($url, $dbgout) {
  4998.     global $namesearch, $codesearch, $docssearch, $use_dll_import;
  4999.     //Setup page
  5000.     $file = file_get_contents($url);
  5001.     if ($file == FALSE) return FALSE;
  5002.     $page = str_replace("\r", "", $file);
  5003.     $page = str_replace("&nbsp;", "", $file);
  5004.     $page = str_replace("<H6>", "\n\n", $page);
  5005.     $page = preg_replace("/<.H6>./", "\n", $page);
  5006.     while (strpos($page, "\n\n\n") != FALSE) $page = str_replace("\n\n\n", "\n\n", $page);
  5007.     $page = strip_tags($page, '<title><pre><hr>');
  5008.    
  5009.     $startname = strpos($page, $namesearch[0]) + strlen($namesearch[0]);
  5010.     $endname = strpos($page, $namesearch[1], $startname);
  5011.     $name = substr($page, $startname, $endname-$startname);
  5012.    
  5013.     $is_struct = FALSE;
  5014.     $startcode = strpos($page, $codesearch[0]) + strlen($codesearch[0]);
  5015.     $endcode = strpos($page, $codesearch[1], $startcode);
  5016.     $code = substr($page, $startcode, $endcode-$startcode);
  5017.     if (strpos($code, "typedef") != FALSE) $is_struct = TRUE;
  5018.     if ($is_struct == FALSE) { //FUNCTION
  5019.         $code = str_replace("\n", " ", $code);
  5020.         if (!$use_dll_import) $code = str_replace("NTSYSAPI", "", $code);
  5021.     } else { //STRUCTURE / ENUM
  5022.        
  5023.     }
  5024.     $code = str_replace("\n\n", "\n", rtrim(ltrim($code)));
  5025.     while (strpos($code, "\n\n") != FALSE) $code = str_replace("\n\n","\n",$code);
  5026.     while (strpos($code, "  ") != FALSE) $code = str_replace("  "," ",$code);
  5027.    
  5028.     $startdocs = strpos($page, $docssearch[0]) + strlen($docssearch[0]);
  5029.     $enddocs = strpos($page, $docssearch[1], $startdocs);
  5030.     if ($startdocs == strlen($docssearch[0])) { //Other docs format
  5031.         $startdocs = strpos($page, '<HR WIDTH="40%">') + strlen('<HR WIDTH="40%">');
  5032.         if ($startdocs == 16) $startdocs = strpos($page, '</PRE>', $endcode) + strlen('</PRE>');
  5033.         $enddocs = strpos($page, '<HR WIDTH="40%">', $startdocs);
  5034.         if ($enddocs == FALSE) $enddocs = strpos($page, 'Documented by:', $startdocs);
  5035.     }
  5036.     $docs = array();
  5037.     if (strpos($code,"enum")==FALSE) { //NO ENUMS!
  5038.         echo "[DOCS] ";
  5039.         $predocs = rtrim(ltrim(substr($page, $startdocs, $enddocs-$startdocs)));
  5040.         $predocs = str_replace("\n\n\n\n","\n\n\n",$predocs);
  5041.         $predocs = str_replace("\n\n\n","\n\n",$predocs);
  5042.         $predocs = explode("\n\n", $predocs);
  5043.         foreach ($predocs as $key => $val) {
  5044.             if (strpos($val, "???") == FALSE) {
  5045.                 $tmp = explode("\n", "$val\n");
  5046.                 if (strlen($tmp[1])==0) $docs["INFO-$key"] = $tmp[0];
  5047.                 else $docs[$tmp[0]] = $tmp[1];
  5048.             }
  5049.         }
  5050.     }
  5051.    
  5052.     $type = "FUNCTION";
  5053.     if ($is_struct) {
  5054.         $type = "STRUCT";
  5055.         if (strpos($code, "enum") != FALSE) $type = "ENUM";
  5056.     }
  5057.     echo "[$type]";
  5058.     $comments = "/"."*\n    $name ($type)\n";
  5059.     foreach ($docs as $key => $val) {
  5060.         $comments .= "    $key\n     $val\n";
  5061.     }
  5062.     $comments = rtrim($comments) . "\n*"."/";
  5063.     if ($dbgout) echo "$comments\n";
  5064.    
  5065.     $typedef = "";
  5066.     if ($is_struct == FALSE) { //FUNCTION
  5067.         $func = str_replace("(", ")(", $code);
  5068.         $typeexp = explode(" ", $func, 4);
  5069.         $lastkey = -666;
  5070.         foreach ($typeexp as $key => $val) {
  5071.             if ($lastkey == -666) $typeexp[$key] = "typedef " . $val;
  5072.             if (strpos($val, ")(") != FALSE) {
  5073.                 $typeexp[$key] = "*_" . $val;
  5074.                 $typeexp[$lastkey] = "(" . $typeexp[$lastkey];
  5075.             }
  5076.             $lastkey = $key;
  5077.         }
  5078.         $typedef = implode(" ", $typeexp);
  5079.     } else { //STRUCTURE / ENUM
  5080.         $typedef = str_replace("\n ", "\n    ", $code);
  5081.     }
  5082.     if ($dbgout) echo "$typedef\n";
  5083.     return array($comments,$typedef);
  5084. }
  5085. ?>
  5086. */
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!