include/ddk/ntifs.h

   1 /*
   2  * ntifs.h
   3  *
   4  * Windows NT Filesystem Driver Developer Kit
   5  *
   6  * This file is part of the w32api package.
   7  *
   8  * Contributors:
   9  *   Created by Bo Brantén <bosse@acc.umu.se>
  10  *
  11  * THIS SOFTWARE IS NOT COPYRIGHTED
  12  *
  13  * This source code is offered for use in the public domain. You may
  14  * use, modify or distribute it freely.
  15  *
  16  * This code is distributed in the hope that it will be useful but
  17  * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
  18  * DISCLAIMED. This includes but is not limited to warranties of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  */
  22
  23 #ifndef _NTIFS_
  24 #define _NTIFS_
  25 #define _GNU_NTIFS_
  26
  27 /* Helper macro to enable gcc's extension.  */
  28 #ifndef __GNU_EXTENSION
  29 #ifdef __GNUC__
  30 #define __GNU_EXTENSION __extension__
  31 #else
  32 #define __GNU_EXTENSION
  33 #endif
  34 #endif
  35
  36 #define NTKERNELAPI DECLSPEC_IMPORT
  37
  38 #include <ntddk.h>
  39
  40 #define _NTIFS_INCLUDED_
  41 #ifdef __cplusplus
  42 extern "C" {
  43 #endif
  44
  45 #pragma pack(push,4)
  46
  47 #ifndef VER_PRODUCTBUILD
  48 #define VER_PRODUCTBUILD 10000
  49 #endif
  50
  51 #define EX_PUSH_LOCK ULONG_PTR
  52 #define PEX_PUSH_LOCK PULONG_PTR
  53
  54
  55 #ifndef FlagOn
  56 #define FlagOn(_F,_SF)        ((_F) & (_SF))
  57 #endif
  58
  59 #ifndef BooleanFlagOn
  60 #define BooleanFlagOn(F,SF)   ((BOOLEAN)(((F) & (SF)) != 0))
  61 #endif
  62
  63 #ifndef SetFlag
  64 #define SetFlag(_F,_SF)       ((_F) |= (_SF))
  65 #endif
  66
  67 #ifndef ClearFlag
  68 #define ClearFlag(_F,_SF)     ((_F) &= ~(_SF))
  69 #endif
  70
  71 #include "csq.h"
  72
  73 #ifdef _NTOSKRNL_
  74 extern PUCHAR                       FsRtlLegalAnsiCharacterArray;
  75 #else
  76 extern DECLSPEC_IMPORT PUCHAR       FsRtlLegalAnsiCharacterArray;
  77 #endif
  78 extern PACL                         SePublicDefaultDacl;
  79 extern PACL                         SeSystemDefaultDacl;
  80
  81 extern KSPIN_LOCK                   IoStatisticsLock;
  82 extern ULONG                        IoReadOperationCount;
  83 extern ULONG                        IoWriteOperationCount;
  84 extern ULONG                        IoOtherOperationCount;
  85 extern LARGE_INTEGER                IoReadTransferCount;
  86 extern LARGE_INTEGER                IoWriteTransferCount;
  87 extern LARGE_INTEGER                IoOtherTransferCount;
  88
  89 typedef STRING LSA_STRING, *PLSA_STRING;
  90 typedef ULONG  LSA_OPERATIONAL_MODE, *PLSA_OPERATIONAL_MODE;
  91
  92 typedef enum _SECURITY_LOGON_TYPE
  93 {
  94     UndefinedLogonType = 0,
  95     Interactive = 2,
  96     Network,
  97     Batch,
  98     Service,
  99     Proxy,
 100     Unlock,
 101     NetworkCleartext,
 102     NewCredentials,
 103 #if (_WIN32_WINNT >= 0x0501)
 104     RemoteInteractive,
 105     CachedInteractive,
 106 #endif
 107 #if (_WIN32_WINNT >= 0x0502)
 108     CachedRemoteInteractive,
 109     CachedUnlock
 110 #endif
 111 } SECURITY_LOGON_TYPE, *PSECURITY_LOGON_TYPE;
 112
 113 #define ANSI_DOS_STAR                   ('<')
 114 #define ANSI_DOS_QM                     ('>')
 115 #define ANSI_DOS_DOT                    ('"')
 116
 117 #define DOS_STAR                        (L'<')
 118 #define DOS_QM                          (L'>')
 119 #define DOS_DOT                         (L'"')
 120
 121 /* also in winnt.h */
 122 #define ACCESS_MIN_MS_ACE_TYPE                  (0x0)
 123 #define ACCESS_ALLOWED_ACE_TYPE                 (0x0)
 124 #define ACCESS_DENIED_ACE_TYPE                  (0x1)
 125 #define SYSTEM_AUDIT_ACE_TYPE                   (0x2)
 126 #define SYSTEM_ALARM_ACE_TYPE                   (0x3)
 127 #define ACCESS_MAX_MS_V2_ACE_TYPE               (0x3)
 128 #define ACCESS_ALLOWED_COMPOUND_ACE_TYPE        (0x4)
 129 #define ACCESS_MAX_MS_V3_ACE_TYPE               (0x4)
 130 #define ACCESS_MIN_MS_OBJECT_ACE_TYPE           (0x5)
 131 #define ACCESS_ALLOWED_OBJECT_ACE_TYPE          (0x5)
 132 #define ACCESS_DENIED_OBJECT_ACE_TYPE           (0x6)
 133 #define SYSTEM_AUDIT_OBJECT_ACE_TYPE            (0x7)
 134 #define SYSTEM_ALARM_OBJECT_ACE_TYPE            (0x8)
 135 #define ACCESS_MAX_MS_OBJECT_ACE_TYPE           (0x8)
 136 #define ACCESS_MAX_MS_V4_ACE_TYPE               (0x8)
 137 #define ACCESS_MAX_MS_ACE_TYPE                  (0x8)
 138 #define ACCESS_ALLOWED_CALLBACK_ACE_TYPE        (0x9)
 139 #define ACCESS_DENIED_CALLBACK_ACE_TYPE         (0xA)
 140 #define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE (0xB)
 141 #define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE  (0xC)
 142 #define SYSTEM_AUDIT_CALLBACK_ACE_TYPE          (0xD)
 143 #define SYSTEM_ALARM_CALLBACK_ACE_TYPE          (0xE)
 144 #define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE   (0xF)
 145 #define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE   (0x10)
 146 #define ACCESS_MAX_MS_V5_ACE_TYPE               (0x10)
 147
 148 #define COMPRESSION_FORMAT_NONE         (0x0000)
 149 #define COMPRESSION_FORMAT_DEFAULT      (0x0001)
 150 #define COMPRESSION_FORMAT_LZNT1        (0x0002)
 151 #define COMPRESSION_ENGINE_STANDARD     (0x0000)
 152 #define COMPRESSION_ENGINE_MAXIMUM      (0x0100)
 153 #define COMPRESSION_ENGINE_HIBER        (0x0200)
 154
 155 #define FILE_ACTION_ADDED                   0x00000001
 156 #define FILE_ACTION_REMOVED                 0x00000002
 157 #define FILE_ACTION_MODIFIED                0x00000003
 158 #define FILE_ACTION_RENAMED_OLD_NAME        0x00000004
 159 #define FILE_ACTION_RENAMED_NEW_NAME        0x00000005
 160 #define FILE_ACTION_ADDED_STREAM            0x00000006
 161 #define FILE_ACTION_REMOVED_STREAM          0x00000007
 162 #define FILE_ACTION_MODIFIED_STREAM         0x00000008
 163 #define FILE_ACTION_REMOVED_BY_DELETE       0x00000009
 164 #define FILE_ACTION_ID_NOT_TUNNELLED        0x0000000A
 165 #define FILE_ACTION_TUNNELLED_ID_COLLISION  0x0000000B
 166 /* end  winnt.h */
 167
 168 #define FILE_EA_TYPE_BINARY             0xfffe
 169 #define FILE_EA_TYPE_ASCII              0xfffd
 170 #define FILE_EA_TYPE_BITMAP             0xfffb
 171 #define FILE_EA_TYPE_METAFILE           0xfffa
 172 #define FILE_EA_TYPE_ICON               0xfff9
 173 #define FILE_EA_TYPE_EA                 0xffee
 174 #define FILE_EA_TYPE_MVMT               0xffdf
 175 #define FILE_EA_TYPE_MVST               0xffde
 176 #define FILE_EA_TYPE_ASN1               0xffdd
 177 #define FILE_EA_TYPE_FAMILY_IDS         0xff01
 178
 179 #define FILE_NEED_EA                    0x00000080
 180
 181 /* also in winnt.h */
 182 #define FILE_NOTIFY_CHANGE_FILE_NAME    0x00000001
 183 #define FILE_NOTIFY_CHANGE_DIR_NAME     0x00000002
 184 #define FILE_NOTIFY_CHANGE_NAME         0x00000003
 185 #define FILE_NOTIFY_CHANGE_ATTRIBUTES   0x00000004
 186 #define FILE_NOTIFY_CHANGE_SIZE         0x00000008
 187 #define FILE_NOTIFY_CHANGE_LAST_WRITE   0x00000010
 188 #define FILE_NOTIFY_CHANGE_LAST_ACCESS  0x00000020
 189 #define FILE_NOTIFY_CHANGE_CREATION     0x00000040
 190 #define FILE_NOTIFY_CHANGE_EA           0x00000080
 191 #define FILE_NOTIFY_CHANGE_SECURITY     0x00000100
 192 #define FILE_NOTIFY_CHANGE_STREAM_NAME  0x00000200
 193 #define FILE_NOTIFY_CHANGE_STREAM_SIZE  0x00000400
 194 #define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
 195 #define FILE_NOTIFY_VALID_MASK          0x00000fff
 196 /* end winnt.h */
 197
 198 #define FILE_OPLOCK_BROKEN_TO_LEVEL_2   0x00000007
 199 #define FILE_OPLOCK_BROKEN_TO_NONE      0x00000008
 200
 201 #define FILE_OPBATCH_BREAK_UNDERWAY     0x00000009
 202
 203 #define FILE_CASE_SENSITIVE_SEARCH      0x00000001
 204 #define FILE_CASE_PRESERVED_NAMES       0x00000002
 205 #define FILE_UNICODE_ON_DISK            0x00000004
 206 #define FILE_PERSISTENT_ACLS            0x00000008
 207 #define FILE_FILE_COMPRESSION           0x00000010
 208 #define FILE_VOLUME_QUOTAS              0x00000020
 209 #define FILE_SUPPORTS_SPARSE_FILES      0x00000040
 210 #define FILE_SUPPORTS_REPARSE_POINTS    0x00000080
 211 #define FILE_SUPPORTS_REMOTE_STORAGE    0x00000100
 212 #define FS_LFN_APIS                     0x00004000
 213 #define FILE_VOLUME_IS_COMPRESSED       0x00008000
 214 #define FILE_SUPPORTS_OBJECT_IDS        0x00010000
 215 #define FILE_SUPPORTS_ENCRYPTION        0x00020000
 216 #define FILE_NAMED_STREAMS              0x00040000
 217 #define FILE_READ_ONLY_VOLUME           0x00080000
 218 #define FILE_SEQUENTIAL_WRITE_ONCE      0x00100000
 219 #define FILE_SUPPORTS_TRANSACTIONS      0x00200000
 220
 221 #define FILE_PIPE_BYTE_STREAM_TYPE      0x00000000
 222 #define FILE_PIPE_MESSAGE_TYPE          0x00000001
 223
 224 #define FILE_PIPE_BYTE_STREAM_MODE      0x00000000
 225 #define FILE_PIPE_MESSAGE_MODE          0x00000001
 226
 227 #define FILE_PIPE_QUEUE_OPERATION       0x00000000
 228 #define FILE_PIPE_COMPLETE_OPERATION    0x00000001
 229
 230 #define FILE_PIPE_INBOUND               0x00000000
 231 #define FILE_PIPE_OUTBOUND              0x00000001
 232 #define FILE_PIPE_FULL_DUPLEX           0x00000002
 233
 234 #define FILE_PIPE_DISCONNECTED_STATE    0x00000001
 235 #define FILE_PIPE_LISTENING_STATE       0x00000002
 236 #define FILE_PIPE_CONNECTED_STATE       0x00000003
 237 #define FILE_PIPE_CLOSING_STATE         0x00000004
 238
 239 #define FILE_PIPE_CLIENT_END            0x00000000
 240 #define FILE_PIPE_SERVER_END            0x00000001
 241
 242 #define FILE_PIPE_READ_DATA             0x00000000
 243 #define FILE_PIPE_WRITE_SPACE           0x00000001
 244
 245 #define FILE_STORAGE_TYPE_SPECIFIED             0x00000041  /* FILE_DIRECTORY_FILE | FILE_NON_DIRECTORY_FILE */
 246 #define FILE_STORAGE_TYPE_DEFAULT               (StorageTypeDefault << FILE_STORAGE_TYPE_SHIFT)
 247 #define FILE_STORAGE_TYPE_DIRECTORY             (StorageTypeDirectory << FILE_STORAGE_TYPE_SHIFT)
 248 #define FILE_STORAGE_TYPE_FILE                  (StorageTypeFile << FILE_STORAGE_TYPE_SHIFT)
 249 #define FILE_STORAGE_TYPE_DOCFILE               (StorageTypeDocfile << FILE_STORAGE_TYPE_SHIFT)
 250 #define FILE_STORAGE_TYPE_JUNCTION_POINT        (StorageTypeJunctionPoint << FILE_STORAGE_TYPE_SHIFT)
 251 #define FILE_STORAGE_TYPE_CATALOG               (StorageTypeCatalog << FILE_STORAGE_TYPE_SHIFT)
 252 #define FILE_STORAGE_TYPE_STRUCTURED_STORAGE    (StorageTypeStructuredStorage << FILE_STORAGE_TYPE_SHIFT)
 253 #define FILE_STORAGE_TYPE_EMBEDDING             (StorageTypeEmbedding << FILE_STORAGE_TYPE_SHIFT)
 254 #define FILE_STORAGE_TYPE_STREAM                (StorageTypeStream << FILE_STORAGE_TYPE_SHIFT)
 255 #define FILE_MINIMUM_STORAGE_TYPE               FILE_STORAGE_TYPE_DEFAULT
 256 #define FILE_MAXIMUM_STORAGE_TYPE               FILE_STORAGE_TYPE_STREAM
 257 #define FILE_STORAGE_TYPE_MASK                  0x000f0000
 258 #define FILE_STORAGE_TYPE_SHIFT                 16
 259
 260 #define FILE_VC_QUOTA_NONE              0x00000000
 261 #define FILE_VC_QUOTA_TRACK             0x00000001
 262 #define FILE_VC_QUOTA_ENFORCE           0x00000002
 263 #define FILE_VC_QUOTA_MASK              0x00000003
 264
 265 #define FILE_VC_QUOTAS_LOG_VIOLATIONS   0x00000004
 266 #define FILE_VC_CONTENT_INDEX_DISABLED  0x00000008
 267
 268 #define FILE_VC_LOG_QUOTA_THRESHOLD     0x00000010
 269 #define FILE_VC_LOG_QUOTA_LIMIT         0x00000020
 270 #define FILE_VC_LOG_VOLUME_THRESHOLD    0x00000040
 271 #define FILE_VC_LOG_VOLUME_LIMIT        0x00000080
 272
 273 #define FILE_VC_QUOTAS_INCOMPLETE       0x00000100
 274 #define FILE_VC_QUOTAS_REBUILDING       0x00000200
 275
 276 #define FILE_VC_VALID_MASK              0x000003ff
 277
 278 #define FSRTL_FLAG_FILE_MODIFIED        (0x01)
 279 #define FSRTL_FLAG_FILE_LENGTH_CHANGED  (0x02)
 280 #define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04)
 281 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08)
 282 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10)
 283 #define FSRTL_FLAG_USER_MAPPED_FILE     (0x20)
 284 #define FSRTL_FLAG_ADVANCED_HEADER      (0x40)
 285 #define FSRTL_FLAG_EOF_ADVANCE_ACTIVE   (0x80)
 286
 287 #define FSRTL_FLAG2_DO_MODIFIED_WRITE        (0x01)
 288 #define FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS (0x02)
 289 #define FSRTL_FLAG2_PURGE_WHEN_MAPPED        (0x04)
 290 #define FSRTL_FLAG2_IS_PAGING_FILE           (0x08)
 291
 292 #define FSRTL_FSP_TOP_LEVEL_IRP         (0x01)
 293 #define FSRTL_CACHE_TOP_LEVEL_IRP       (0x02)
 294 #define FSRTL_MOD_WRITE_TOP_LEVEL_IRP   (0x03)
 295 #define FSRTL_FAST_IO_TOP_LEVEL_IRP     (0x04)
 296 #define FSRTL_MAX_TOP_LEVEL_IRP_FLAG    (0x04)
 297
 298 #define FSRTL_VOLUME_DISMOUNT           1
 299 #define FSRTL_VOLUME_DISMOUNT_FAILED    2
 300 #define FSRTL_VOLUME_LOCK               3
 301 #define FSRTL_VOLUME_LOCK_FAILED        4
 302 #define FSRTL_VOLUME_UNLOCK             5
 303 #define FSRTL_VOLUME_MOUNT              6
 304
 305 #define FSRTL_WILD_CHARACTER            0x08
 306
 307 #define FSRTL_FAT_LEGAL                 0x01
 308 #define FSRTL_HPFS_LEGAL                0x02
 309 #define FSRTL_NTFS_LEGAL                0x04
 310 #define FSRTL_WILD_CHARACTER            0x08
 311 #define FSRTL_OLE_LEGAL                 0x10
 312 #define FSRTL_NTFS_STREAM_LEGAL         0x14
 313
 314 #ifdef _X86_
 315 #define HARDWARE_PTE    HARDWARE_PTE_X86
 316 #define PHARDWARE_PTE   PHARDWARE_PTE_X86
 317 #endif
 318
 319 #define IO_CHECK_CREATE_PARAMETERS      0x0200
 320 #define IO_ATTACH_DEVICE                0x0400
 321
 322 #define IO_ATTACH_DEVICE_API            0x80000000
 323
 324 #define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE    64
 325 #define IO_FILE_OBJECT_PAGED_POOL_CHARGE        1024
 326
 327 #define IO_TYPE_APC                     18
 328 #define IO_TYPE_DPC                     19
 329 #define IO_TYPE_DEVICE_QUEUE            20
 330 #define IO_TYPE_EVENT_PAIR              21
 331 #define IO_TYPE_INTERRUPT               22
 332 #define IO_TYPE_PROFILE                 23
 333
 334 #define IRP_BEING_VERIFIED              0x10
 335
 336 #define MAILSLOT_CLASS_FIRSTCLASS       1
 337 #define MAILSLOT_CLASS_SECONDCLASS      2
 338
 339 #define MAILSLOT_SIZE_AUTO              0
 340
 341 #define MEM_DOS_LIM                     0x40000000
 342
 343 #define MCB_FLAG_RAISE_ON_ALLOCATION_FAILURE 1
 344
 345 #define OB_TYPE_TYPE                    1
 346 #define OB_TYPE_DIRECTORY               2
 347 #define OB_TYPE_SYMBOLIC_LINK           3
 348 #define OB_TYPE_TOKEN                   4
 349 #define OB_TYPE_PROCESS                 5
 350 #define OB_TYPE_THREAD                  6
 351 #define OB_TYPE_EVENT                   7
 352 #define OB_TYPE_EVENT_PAIR              8
 353 #define OB_TYPE_MUTANT                  9
 354 #define OB_TYPE_SEMAPHORE               10
 355 #define OB_TYPE_TIMER                   11
 356 #define OB_TYPE_PROFILE                 12
 357 #define OB_TYPE_WINDOW_STATION          13
 358 #define OB_TYPE_DESKTOP                 14
 359 #define OB_TYPE_SECTION                 15
 360 #define OB_TYPE_KEY                     16
 361 #define OB_TYPE_PORT                    17
 362 #define OB_TYPE_ADAPTER                 18
 363 #define OB_TYPE_CONTROLLER              19
 364 #define OB_TYPE_DEVICE                  20
 365 #define OB_TYPE_DRIVER                  21
 366 #define OB_TYPE_IO_COMPLETION           22
 367 #define OB_TYPE_FILE                    23
 368
 369 #define PIN_WAIT                        (1)
 370 #define PIN_EXCLUSIVE                   (2)
 371 #define PIN_NO_READ                     (4)
 372 #define PIN_IF_BCB                      (8)
 373
 374 #define RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE 1
 375 #define RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING 2
 376
 377 #define SEC_BASED       0x00200000
 378
 379 #define SECURITY_WORLD_SID_AUTHORITY    {0,0,0,0,0,1}
 380 #define SECURITY_WORLD_RID              (0x00000000L)
 381
 382 #define SID_REVISION                    1
 383 #define SID_MAX_SUB_AUTHORITIES         15
 384 #define SID_RECOMMENDED_SUB_AUTHORITIES 1
 385
 386 #define TOKEN_ASSIGN_PRIMARY            (0x0001)
 387 #define TOKEN_DUPLICATE                 (0x0002)
 388 #define TOKEN_IMPERSONATE               (0x0004)
 389 #define TOKEN_QUERY                     (0x0008)
 390 #define TOKEN_QUERY_SOURCE              (0x0010)
 391 #define TOKEN_ADJUST_PRIVILEGES         (0x0020)
 392 #define TOKEN_ADJUST_GROUPS             (0x0040)
 393 #define TOKEN_ADJUST_DEFAULT            (0x0080)
 394 #define TOKEN_ADJUST_SESSIONID          (0x0100)
 395
 396 #define TOKEN_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED |\
 397                           TOKEN_ASSIGN_PRIMARY     |\
 398                           TOKEN_DUPLICATE          |\
 399                           TOKEN_IMPERSONATE        |\
 400                           TOKEN_QUERY              |\
 401                           TOKEN_QUERY_SOURCE       |\
 402                           TOKEN_ADJUST_PRIVILEGES  |\
 403                           TOKEN_ADJUST_GROUPS      |\
 404                           TOKEN_ADJUST_DEFAULT     |\
 405                           TOKEN_ADJUST_SESSIONID)
 406
 407 #define TOKEN_READ       (STANDARD_RIGHTS_READ     |\
 408                           TOKEN_QUERY)
 409
 410 #define TOKEN_WRITE      (STANDARD_RIGHTS_WRITE    |\
 411                           TOKEN_ADJUST_PRIVILEGES  |\
 412                           TOKEN_ADJUST_GROUPS      |\
 413                           TOKEN_ADJUST_DEFAULT)
 414
 415 #define TOKEN_EXECUTE    (STANDARD_RIGHTS_EXECUTE)
 416
 417 #define TOKEN_SOURCE_LENGTH 8
 418 /* end winnt.h */
 419
 420 #define TOKEN_HAS_TRAVERSE_PRIVILEGE    0x01
 421 #define TOKEN_HAS_BACKUP_PRIVILEGE      0x02
 422 #define TOKEN_HAS_RESTORE_PRIVILEGE     0x04
 423 #define TOKEN_HAS_ADMIN_GROUP           0x08
 424 #define TOKEN_WRITE_RESTRICTED          0x08
 425 #define TOKEN_IS_RESTRICTED             0x10
 426 #define SE_BACKUP_PRIVILEGES_CHECKED    0x0100
 427
 428 #define VACB_MAPPING_GRANULARITY        (0x40000)
 429 #define VACB_OFFSET_SHIFT               (18)
 430
 431 #define SE_OWNER_DEFAULTED              0x0001
 432 #define SE_GROUP_DEFAULTED              0x0002
 433 #define SE_DACL_PRESENT                 0x0004
 434 #define SE_DACL_DEFAULTED               0x0008
 435 #define SE_SACL_PRESENT                 0x0010
 436 #define SE_SACL_DEFAULTED               0x0020
 437 #define SE_DACL_UNTRUSTED               0x0040
 438 #define SE_SERVER_SECURITY              0x0080
 439 #define SE_DACL_AUTO_INHERIT_REQ        0x0100
 440 #define SE_SACL_AUTO_INHERIT_REQ        0x0200
 441 #define SE_DACL_AUTO_INHERITED          0x0400
 442 #define SE_SACL_AUTO_INHERITED          0x0800
 443 #define SE_DACL_PROTECTED               0x1000
 444 #define SE_SACL_PROTECTED               0x2000
 445 #define SE_RM_CONTROL_VALID             0x4000
 446 #define SE_SELF_RELATIVE                0x8000
 447
 448 #ifndef _WINNT_H
 449 #define _AUDIT_EVENT_TYPE_HACK 0
 450 #endif
 451 #if (_AUDIT_EVENT_TYPE_HACK == 1)
 452
 453 #else
 454 typedef enum _AUDIT_EVENT_TYPE
 455 {
 456     AuditEventObjectAccess,
 457     AuditEventDirectoryServiceAccess
 458 } AUDIT_EVENT_TYPE, *PAUDIT_EVENT_TYPE;
 459 #endif
 460
 461 #define AUDIT_ALLOW_NO_PRIVILEGE 0x1
 462
 463 #define FSCTL_REQUEST_OPLOCK_LEVEL_1    CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  0, METHOD_BUFFERED, FILE_ANY_ACCESS)
 464 #define FSCTL_REQUEST_OPLOCK_LEVEL_2    CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  1, METHOD_BUFFERED, FILE_ANY_ACCESS)
 465 #define FSCTL_REQUEST_BATCH_OPLOCK      CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  2, METHOD_BUFFERED, FILE_ANY_ACCESS)
 466 #define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE  CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  3, METHOD_BUFFERED, FILE_ANY_ACCESS)
 467 #define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  4, METHOD_BUFFERED, FILE_ANY_ACCESS)
 468 #define FSCTL_OPLOCK_BREAK_NOTIFY       CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  5, METHOD_BUFFERED, FILE_ANY_ACCESS)
 469 #define FSCTL_LOCK_VOLUME               CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  6, METHOD_BUFFERED, FILE_ANY_ACCESS)
 470 #define FSCTL_UNLOCK_VOLUME             CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  7, METHOD_BUFFERED, FILE_ANY_ACCESS)
 471 #define FSCTL_DISMOUNT_VOLUME           CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  8, METHOD_BUFFERED, FILE_ANY_ACCESS)
 472
 473 #define FSCTL_IS_VOLUME_MOUNTED         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
 474 #define FSCTL_IS_PATHNAME_VALID         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
 475 #define FSCTL_MARK_VOLUME_DIRTY         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
 476
 477 #define FSCTL_QUERY_RETRIEVAL_POINTERS  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14,  METHOD_NEITHER, FILE_ANY_ACCESS)
 478 #define FSCTL_GET_COMPRESSION           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
 479 #define FSCTL_SET_COMPRESSION           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
 480
 481
 482 #define FSCTL_MARK_AS_SYSTEM_HIVE       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19,  METHOD_NEITHER, FILE_ANY_ACCESS)
 483 #define FSCTL_OPLOCK_BREAK_ACK_NO_2     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
 484 #define FSCTL_INVALIDATE_VOLUMES        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
 485 #define FSCTL_QUERY_FAT_BPB             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS)
 486 #define FSCTL_REQUEST_FILTER_OPLOCK     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
 487 #define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS)
 488
 489 #if (VER_PRODUCTBUILD >= 1381)
 490
 491 #define FSCTL_GET_NTFS_VOLUME_DATA      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS)
 492 #define FSCTL_GET_NTFS_FILE_RECORD      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS)
 493 #define FSCTL_GET_VOLUME_BITMAP         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27,  METHOD_NEITHER, FILE_ANY_ACCESS)
 494 #define FSCTL_GET_RETRIEVAL_POINTERS    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28,  METHOD_NEITHER, FILE_ANY_ACCESS)
 495 #define FSCTL_MOVE_FILE                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_ANY_ACCESS)
 496 #define FSCTL_IS_VOLUME_DIRTY           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
 497 #define FSCTL_GET_HFS_INFORMATION       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS)
 498 #define FSCTL_ALLOW_EXTENDED_DASD_IO    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER,  FILE_ANY_ACCESS)
 499
 500 #endif /* (VER_PRODUCTBUILD >= 1381) */
 501
 502 #if (VER_PRODUCTBUILD >= 2195)
 503
 504 #define FSCTL_READ_PROPERTY_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 33, METHOD_NEITHER, FILE_ANY_ACCESS)
 505 #define FSCTL_WRITE_PROPERTY_DATA       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 34, METHOD_NEITHER, FILE_ANY_ACCESS)
 506 #define FSCTL_FIND_FILES_BY_SID         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS)
 507
 508 #define FSCTL_DUMP_PROPERTY_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 37,  METHOD_NEITHER, FILE_ANY_ACCESS)
 509 #define FSCTL_SET_OBJECT_ID             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_WRITE_DATA)
 510 #define FSCTL_GET_OBJECT_ID             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS)
 511 #define FSCTL_DELETE_OBJECT_ID          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_WRITE_DATA)
 512 #define FSCTL_SET_REPARSE_POINT         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_WRITE_DATA)
 513 #define FSCTL_GET_REPARSE_POINT         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS)
 514 #define FSCTL_DELETE_REPARSE_POINT      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_WRITE_DATA)
 515 #define FSCTL_ENUM_USN_DATA             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44,  METHOD_NEITHER, FILE_READ_DATA)
 516 #define FSCTL_SECURITY_ID_CHECK         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45,  METHOD_NEITHER, FILE_READ_DATA)
 517 #define FSCTL_READ_USN_JOURNAL          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46,  METHOD_NEITHER, FILE_READ_DATA)
 518 #define FSCTL_SET_OBJECT_ID_EXTENDED    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_WRITE_DATA)
 519 #define FSCTL_CREATE_OR_GET_OBJECT_ID   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS)
 520 #define FSCTL_SET_SPARSE                CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_WRITE_DATA)
 521 #define FSCTL_SET_ZERO_DATA             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA)
 522 #define FSCTL_QUERY_ALLOCATED_RANGES    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51,  METHOD_NEITHER, FILE_READ_DATA)
 523 #define FSCTL_ENABLE_UPGRADE            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA)
 524 #define FSCTL_SET_ENCRYPTION            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_BUFFERED, FILE_ANY_ACCESS)
 525 #define FSCTL_ENCRYPTION_FSCTL_IO       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54,  METHOD_NEITHER, FILE_ANY_ACCESS)
 526 #define FSCTL_WRITE_RAW_ENCRYPTED       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55,  METHOD_NEITHER, FILE_ANY_ACCESS)
 527 #define FSCTL_READ_RAW_ENCRYPTED        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56,  METHOD_NEITHER, FILE_ANY_ACCESS)
 528 #define FSCTL_CREATE_USN_JOURNAL        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57,  METHOD_NEITHER, FILE_READ_DATA)
 529 #define FSCTL_READ_FILE_USN_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58,  METHOD_NEITHER, FILE_READ_DATA)
 530 #define FSCTL_WRITE_USN_CLOSE_RECORD    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59,  METHOD_NEITHER, FILE_READ_DATA)
 531 #define FSCTL_EXTEND_VOLUME             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
 532 #define FSCTL_QUERY_USN_JOURNAL         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
 533 #define FSCTL_DELETE_USN_JOURNAL        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
 534 #define FSCTL_MARK_HANDLE               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS)
 535 #define FSCTL_SIS_COPYFILE              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS)
 536 #define FSCTL_SIS_LINK_FILES            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
 537 #define FSCTL_HSM_MSG                   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
 538 #define FSCTL_NSS_CONTROL               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 67, METHOD_BUFFERED, FILE_WRITE_DATA)
 539 #define FSCTL_HSM_DATA                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
 540 #define FSCTL_RECALL_FILE               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS)
 541 #define FSCTL_NSS_RCONTROL              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 70, METHOD_BUFFERED, FILE_READ_DATA)
 542 #define FSCTL_READ_FROM_PLEX            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA)
 543 #define FSCTL_FILE_PREFETCH             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
 544
 545 #endif /* (VER_PRODUCTBUILD >= 2195) */
 546
 547 #define FSCTL_MAILSLOT_PEEK             CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)
 548
 549 #define FSCTL_NETWORK_SET_CONFIGURATION_INFO    CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 102, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
 550 #define FSCTL_NETWORK_GET_CONFIGURATION_INFO    CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 103, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
 551 #define FSCTL_NETWORK_GET_CONNECTION_INFO       CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 104, METHOD_NEITHER, FILE_ANY_ACCESS)
 552 #define FSCTL_NETWORK_ENUMERATE_CONNECTIONS     CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 105, METHOD_NEITHER, FILE_ANY_ACCESS)
 553 #define FSCTL_NETWORK_DELETE_CONNECTION         CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 107, METHOD_BUFFERED, FILE_ANY_ACCESS)
 554 #define FSCTL_NETWORK_GET_STATISTICS            CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 116, METHOD_BUFFERED, FILE_ANY_ACCESS)
 555 #define FSCTL_NETWORK_SET_DOMAIN_NAME           CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_ANY_ACCESS)
 556 #define FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT     CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_ANY_ACCESS)
 557
 558 #define FSCTL_PIPE_ASSIGN_EVENT         CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
 559 #define FSCTL_PIPE_DISCONNECT           CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
 560 #define FSCTL_PIPE_LISTEN               CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
 561 #define FSCTL_PIPE_PEEK                 CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
 562 #define FSCTL_PIPE_QUERY_EVENT          CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
 563 #define FSCTL_PIPE_TRANSCEIVE           CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER,  FILE_READ_DATA | FILE_WRITE_DATA)
 564 #define FSCTL_PIPE_WAIT                 CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
 565 #define FSCTL_PIPE_IMPERSONATE          CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
 566 #define FSCTL_PIPE_SET_CLIENT_PROCESS   CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
 567 #define FSCTL_PIPE_QUERY_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
 568 #define FSCTL_PIPE_INTERNAL_READ        CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
 569 #define FSCTL_PIPE_INTERNAL_WRITE       CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
 570 #define FSCTL_PIPE_INTERNAL_TRANSCEIVE  CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
 571 #define FSCTL_PIPE_INTERNAL_READ_OVFLOW CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
 572
 573 #define IOCTL_REDIR_QUERY_PATH          CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
 574
 575 typedef PVOID OPLOCK, *POPLOCK;
 576
 577 //
 578 // Forwarders
 579 //
 580 struct _RTL_AVL_TABLE;
 581 struct _RTL_GENERIC_TABLE;
 582
 583 typedef ULONG LBN;
 584 typedef LBN *PLBN;
 585
 586 typedef ULONG VBN;
 587 typedef VBN *PVBN;
 588
 589 typedef PVOID PNOTIFY_SYNC;
 590
 591 typedef enum _FAST_IO_POSSIBLE {
 592     FastIoIsNotPossible,
 593     FastIoIsPossible,
 594     FastIoIsQuestionable
 595 } FAST_IO_POSSIBLE;
 596
 597 typedef enum _FILE_STORAGE_TYPE {
 598     StorageTypeDefault = 1,
 599     StorageTypeDirectory,
 600     StorageTypeFile,
 601     StorageTypeJunctionPoint,
 602     StorageTypeCatalog,
 603     StorageTypeStructuredStorage,
 604     StorageTypeEmbedding,
 605     StorageTypeStream
 606 } FILE_STORAGE_TYPE;
 607
 608 typedef enum _OBJECT_INFORMATION_CLASS
 609 {
 610     ObjectBasicInformation,
 611     ObjectNameInformation,
 612     ObjectTypeInformation,
 613     ObjectTypesInformation,
 614     ObjectHandleFlagInformation,
 615     ObjectSessionInformation,
 616     MaxObjectInfoClass
 617 } OBJECT_INFORMATION_CLASS;
 618
 619 typedef struct _OBJECT_BASIC_INFORMATION
 620 {
 621     ULONG Attributes;
 622     ACCESS_MASK GrantedAccess;
 623     ULONG HandleCount;
 624     ULONG PointerCount;
 625     ULONG PagedPoolCharge;
 626     ULONG NonPagedPoolCharge;
 627     ULONG Reserved[ 3 ];
 628     ULONG NameInfoSize;
 629     ULONG TypeInfoSize;
 630     ULONG SecurityDescriptorSize;
 631     LARGE_INTEGER CreationTime;
 632 } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
 633
 634 typedef struct _KAPC_STATE {
 635     LIST_ENTRY  ApcListHead[2];
 636     PKPROCESS   Process;
 637     BOOLEAN     KernelApcInProgress;
 638     BOOLEAN     KernelApcPending;
 639     BOOLEAN     UserApcPending;
 640 } KAPC_STATE, *PKAPC_STATE, *RESTRICTED_POINTER PRKAPC_STATE;
 641 #define KAPC_STATE_ACTUAL_LENGTH (FIELD_OFFSET(KAPC_STATE, UserApcPending) + sizeof(BOOLEAN))
 642
 643 typedef struct _BITMAP_RANGE {
 644     LIST_ENTRY      Links;
 645     LONGLONG        BasePage;
 646     ULONG           FirstDirtyPage;
 647     ULONG           LastDirtyPage;
 648     ULONG           DirtyPages;
 649     PULONG          Bitmap;
 650 } BITMAP_RANGE, *PBITMAP_RANGE;
 651
 652 typedef struct _CACHE_UNINITIALIZE_EVENT {
 653     struct _CACHE_UNINITIALIZE_EVENT    *Next;
 654     KEVENT                              Event;
 655 } CACHE_UNINITIALIZE_EVENT, *PCACHE_UNINITIALIZE_EVENT;
 656
 657 typedef struct _CC_FILE_SIZES {
 658     LARGE_INTEGER AllocationSize;
 659     LARGE_INTEGER FileSize;
 660     LARGE_INTEGER ValidDataLength;
 661 } CC_FILE_SIZES, *PCC_FILE_SIZES;
 662
 663 typedef struct _COMPRESSED_DATA_INFO {
 664     USHORT  CompressionFormatAndEngine;
 665     UCHAR   CompressionUnitShift;
 666     UCHAR   ChunkShift;
 667     UCHAR   ClusterShift;
 668     UCHAR   Reserved;
 669     USHORT  NumberOfChunks;
 670     ULONG   CompressedChunkSizes[ANYSIZE_ARRAY];
 671 } COMPRESSED_DATA_INFO, *PCOMPRESSED_DATA_INFO;
 672
 673 typedef struct _SID_IDENTIFIER_AUTHORITY {
 674         UCHAR Value[6];
 675 } SID_IDENTIFIER_AUTHORITY,*PSID_IDENTIFIER_AUTHORITY,*LPSID_IDENTIFIER_AUTHORITY;
 676
 677 typedef struct _SID {
 678    UCHAR  Revision;
 679    UCHAR  SubAuthorityCount;
 680    SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
 681    ULONG SubAuthority[ANYSIZE_ARRAY];
 682 } SID, *PISID;
 683 typedef struct _SID_AND_ATTRIBUTES {
 684         PSID Sid;
 685         ULONG Attributes;
 686 } SID_AND_ATTRIBUTES, *PSID_AND_ATTRIBUTES;
 687 typedef SID_AND_ATTRIBUTES SID_AND_ATTRIBUTES_ARRAY[ANYSIZE_ARRAY];
 688 typedef SID_AND_ATTRIBUTES_ARRAY *PSID_AND_ATTRIBUTES_ARRAY;
 689
 690
 691
 692 //
 693 // Universal well-known SIDs
 694 //
 695 #define SECURITY_NULL_SID_AUTHORITY         {0,0,0,0,0,0}
 696 #define SECURITY_WORLD_SID_AUTHORITY        {0,0,0,0,0,1}
 697 #define SECURITY_LOCAL_SID_AUTHORITY        {0,0,0,0,0,2}
 698 #define SECURITY_CREATOR_SID_AUTHORITY      {0,0,0,0,0,3}
 699 #define SECURITY_NON_UNIQUE_AUTHORITY       {0,0,0,0,0,4}
 700 #define SECURITY_RESOURCE_MANAGER_AUTHORITY {0,0,0,0,0,9}
 701
 702 #define SECURITY_NULL_RID                 (0x00000000L)
 703 #define SECURITY_WORLD_RID                (0x00000000L)
 704 #define SECURITY_LOCAL_RID                (0x00000000L)
 705
 706 #define SECURITY_CREATOR_OWNER_RID        (0x00000000L)
 707 #define SECURITY_CREATOR_GROUP_RID        (0x00000001L)
 708
 709 #define SECURITY_CREATOR_OWNER_SERVER_RID (0x00000002L)
 710 #define SECURITY_CREATOR_GROUP_SERVER_RID (0x00000003L)
 711
 712 #define SECURITY_CREATOR_OWNER_RIGHTS_RID (0x00000004L)
 713
 714
 715
 716 //
 717 // NT well-known SIDs
 718 //
 719 #define SECURITY_NT_AUTHORITY           {0,0,0,0,0,5}
 720
 721 #define SECURITY_DIALUP_RID             (0x00000001L)
 722 #define SECURITY_NETWORK_RID            (0x00000002L)
 723 #define SECURITY_BATCH_RID              (0x00000003L)
 724 #define SECURITY_INTERACTIVE_RID        (0x00000004L)
 725 #define SECURITY_LOGON_IDS_RID          (0x00000005L)
 726 #define SECURITY_LOGON_IDS_RID_COUNT    (3L)
 727 #define SECURITY_SERVICE_RID            (0x00000006L)
 728 #define SECURITY_ANONYMOUS_LOGON_RID    (0x00000007L)
 729 #define SECURITY_PROXY_RID              (0x00000008L)
 730 #define SECURITY_ENTERPRISE_CONTROLLERS_RID (0x00000009L)
 731 #define SECURITY_SERVER_LOGON_RID       SECURITY_ENTERPRISE_CONTROLLERS_RID
 732 #define SECURITY_PRINCIPAL_SELF_RID     (0x0000000AL)
 733 #define SECURITY_AUTHENTICATED_USER_RID (0x0000000BL)
 734 #define SECURITY_RESTRICTED_CODE_RID    (0x0000000CL)
 735 #define SECURITY_TERMINAL_SERVER_RID    (0x0000000DL)
 736 #define SECURITY_REMOTE_LOGON_RID       (0x0000000EL)
 737 #define SECURITY_THIS_ORGANIZATION_RID  (0x0000000FL)
 738 #define SECURITY_IUSER_RID              (0x00000011L)
 739 #define SECURITY_LOCAL_SYSTEM_RID       (0x00000012L)
 740 #define SECURITY_LOCAL_SERVICE_RID      (0x00000013L)
 741 #define SECURITY_NETWORK_SERVICE_RID    (0x00000014L)
 742
 743 #define SECURITY_NT_NON_UNIQUE          (0x00000015L)
 744 #define SECURITY_NT_NON_UNIQUE_SUB_AUTH_COUNT  (3L)
 745
 746 #define SECURITY_ENTERPRISE_READONLY_CONTROLLERS_RID (0x00000016L)
 747
 748 #define SECURITY_BUILTIN_DOMAIN_RID     (0x00000020L)
 749 #define SECURITY_WRITE_RESTRICTED_CODE_RID (0x00000021L)
 750
 751
 752 #define SECURITY_PACKAGE_BASE_RID       (0x00000040L)
 753 #define SECURITY_PACKAGE_RID_COUNT      (2L)
 754 #define SECURITY_PACKAGE_NTLM_RID       (0x0000000AL)
 755 #define SECURITY_PACKAGE_SCHANNEL_RID   (0x0000000EL)
 756 #define SECURITY_PACKAGE_DIGEST_RID     (0x00000015L)
 757
 758 #define SECURITY_MIN_BASE_RID           (0x00000050L)
 759
 760 #define SECURITY_SERVICE_ID_BASE_RID    (0x00000050L)
 761 #define SECURITY_SERVICE_ID_RID_COUNT   (6L)
 762
 763 #define SECURITY_RESERVED_ID_BASE_RID   (0x00000051L)
 764
 765 #define SECURITY_APPPOOL_ID_BASE_RID    (0x00000052L)
 766 #define SECURITY_APPPOOL_ID_RID_COUNT   (6L)
 767
 768 #define SECURITY_VIRTUALSERVER_ID_BASE_RID    (0x00000053L)
 769 #define SECURITY_VIRTUALSERVER_ID_RID_COUNT   (6L)
 770
 771 #define SECURITY_MAX_BASE_RID           (0x0000006FL)
 772
 773 #define SECURITY_MAX_ALWAYS_FILTERED    (0x000003E7L)
 774 #define SECURITY_MIN_NEVER_FILTERED     (0x000003E8L)
 775
 776 #define SECURITY_OTHER_ORGANIZATION_RID (0x000003E8L)
 777
 778
 779
 780 //
 781 // Well-known domain relative sub-authority values (RIDs)
 782 //
 783 #define DOMAIN_GROUP_RID_ENTERPRISE_READONLY_DOMAIN_CONTROLLERS (0x000001F2L)
 784
 785 #define FOREST_USER_RID_MAX            (0x000001F3L)
 786
 787 //
 788 // Well-known users
 789 //
 790 #define DOMAIN_USER_RID_ADMIN          (0x000001F4L)
 791 #define DOMAIN_USER_RID_GUEST          (0x000001F5L)
 792 #define DOMAIN_USER_RID_KRBTGT         (0x000001F6L)
 793
 794 #define DOMAIN_USER_RID_MAX            (0x000003E7L)
 795
 796 //
 797 // Well-known groups
 798 //
 799 #define DOMAIN_GROUP_RID_ADMINS        (0x00000200L)
 800 #define DOMAIN_GROUP_RID_USERS         (0x00000201L)
 801 #define DOMAIN_GROUP_RID_GUESTS        (0x00000202L)
 802 #define DOMAIN_GROUP_RID_COMPUTERS     (0x00000203L)
 803 #define DOMAIN_GROUP_RID_CONTROLLERS   (0x00000204L)
 804 #define DOMAIN_GROUP_RID_CERT_ADMINS   (0x00000205L)
 805 #define DOMAIN_GROUP_RID_SCHEMA_ADMINS (0x00000206L)
 806 #define DOMAIN_GROUP_RID_ENTERPRISE_ADMINS (0x00000207L)
 807 #define DOMAIN_GROUP_RID_POLICY_ADMINS (0x00000208L)
 808 #define DOMAIN_GROUP_RID_READONLY_CONTROLLERS (0x00000209L)
 809
 810 //
 811 // Well-known aliases
 812 //
 813 #define DOMAIN_ALIAS_RID_ADMINS                         (0x00000220L)
 814 #define DOMAIN_ALIAS_RID_USERS                          (0x00000221L)
 815 #define DOMAIN_ALIAS_RID_GUESTS                         (0x00000222L)
 816 #define DOMAIN_ALIAS_RID_POWER_USERS                    (0x00000223L)
 817
 818 #define DOMAIN_ALIAS_RID_ACCOUNT_OPS                    (0x00000224L)
 819 #define DOMAIN_ALIAS_RID_SYSTEM_OPS                     (0x00000225L)
 820 #define DOMAIN_ALIAS_RID_PRINT_OPS                      (0x00000226L)
 821 #define DOMAIN_ALIAS_RID_BACKUP_OPS                     (0x00000227L)
 822
 823 #define DOMAIN_ALIAS_RID_REPLICATOR                     (0x00000228L)
 824 #define DOMAIN_ALIAS_RID_RAS_SERVERS                    (0x00000229L)
 825 #define DOMAIN_ALIAS_RID_PREW2KCOMPACCESS               (0x0000022AL)
 826 #define DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS           (0x0000022BL)
 827 #define DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS      (0x0000022CL)
 828 #define DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS (0x0000022DL)
 829
 830 #define DOMAIN_ALIAS_RID_MONITORING_USERS               (0x0000022EL)
 831 #define DOMAIN_ALIAS_RID_LOGGING_USERS                  (0x0000022FL)
 832 #define DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS            (0x00000230L)
 833 #define DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS             (0x00000231L)
 834 #define DOMAIN_ALIAS_RID_DCOM_USERS                     (0x00000232L)
 835 #define DOMAIN_ALIAS_RID_IUSERS                         (0x00000238L)
 836 #define DOMAIN_ALIAS_RID_CRYPTO_OPERATORS               (0x00000239L)
 837 #define DOMAIN_ALIAS_RID_CACHEABLE_PRINCIPALS_GROUP     (0x0000023BL)
 838 #define DOMAIN_ALIAS_RID_NON_CACHEABLE_PRINCIPALS_GROUP (0x0000023CL)
 839 #define DOMAIN_ALIAS_RID_EVENT_LOG_READERS_GROUP        (0x0000023DL)
 840 #define DOMAIN_ALIAS_RID_CERTSVC_DCOM_ACCESS_GROUP      (0x0000023EL)
 841
 842
 843 #define SECURITY_MANDATORY_LABEL_AUTHORITY          {0,0,0,0,0,16}
 844 #define SECURITY_MANDATORY_UNTRUSTED_RID            (0x00000000L)
 845 #define SECURITY_MANDATORY_LOW_RID                  (0x00001000L)
 846 #define SECURITY_MANDATORY_MEDIUM_RID               (0x00002000L)
 847 #define SECURITY_MANDATORY_HIGH_RID                 (0x00003000L)
 848 #define SECURITY_MANDATORY_SYSTEM_RID               (0x00004000L)
 849 #define SECURITY_MANDATORY_PROTECTED_PROCESS_RID    (0x00005000L)
 850
 851 //
 852 // SECURITY_MANDATORY_MAXIMUM_USER_RID is the highest RID that
 853 // can be set by a usermode caller.
 854 //
 855 #define SECURITY_MANDATORY_MAXIMUM_USER_RID   SECURITY_MANDATORY_SYSTEM_RID
 856
 857 #define MANDATORY_LEVEL_TO_MANDATORY_RID(IL) (IL * 0x1000)
 858
 859 //
 860 // Allocate the System Luid.  The first 1000 LUIDs are reserved.
 861 // Use #999 here (0x3e7 = 999)
 862 //
 863 #define SYSTEM_LUID                     { 0x3e7, 0x0 }
 864 #define ANONYMOUS_LOGON_LUID            { 0x3e6, 0x0 }
 865 #define LOCALSERVICE_LUID               { 0x3e5, 0x0 }
 866 #define NETWORKSERVICE_LUID             { 0x3e4, 0x0 }
 867 #define IUSER_LUID                      { 0x3e3, 0x0 }
 868
 869
 870
 871 typedef struct _TOKEN_SOURCE {
 872         CHAR SourceName[TOKEN_SOURCE_LENGTH];
 873         LUID SourceIdentifier;
 874 } TOKEN_SOURCE,*PTOKEN_SOURCE;
 875 typedef struct _TOKEN_CONTROL {
 876         LUID TokenId;
 877         LUID AuthenticationId;
 878         LUID ModifiedId;
 879         TOKEN_SOURCE TokenSource;
 880 } TOKEN_CONTROL,*PTOKEN_CONTROL;
 881 typedef struct _TOKEN_DEFAULT_DACL {
 882         PACL DefaultDacl;
 883 } TOKEN_DEFAULT_DACL,*PTOKEN_DEFAULT_DACL;
 884 typedef struct _TOKEN_GROUPS {
 885         ULONG GroupCount;
 886         SID_AND_ATTRIBUTES Groups[ANYSIZE_ARRAY];
 887 } TOKEN_GROUPS,*PTOKEN_GROUPS,*LPTOKEN_GROUPS;
 888 typedef struct _TOKEN_GROUPS_AND_PRIVILEGES {
 889         ULONG SidCount;
 890         ULONG SidLength;
 891         PSID_AND_ATTRIBUTES Sids;
 892         ULONG RestrictedSidCount;
 893         ULONG RestrictedSidLength;
 894         PSID_AND_ATTRIBUTES RestrictedSids;
 895         ULONG PrivilegeCount;
 896         ULONG PrivilegeLength;
 897         PLUID_AND_ATTRIBUTES Privileges;
 898         LUID AuthenticationId;
 899 } TOKEN_GROUPS_AND_PRIVILEGES, *PTOKEN_GROUPS_AND_PRIVILEGES;
 900 typedef struct _TOKEN_ORIGIN {
 901         LUID OriginatingLogonSession;
 902 } TOKEN_ORIGIN, *PTOKEN_ORIGIN;
 903 typedef struct _TOKEN_OWNER {
 904         PSID Owner;
 905 } TOKEN_OWNER,*PTOKEN_OWNER;
 906 typedef struct _TOKEN_PRIMARY_GROUP {
 907         PSID PrimaryGroup;
 908 } TOKEN_PRIMARY_GROUP,*PTOKEN_PRIMARY_GROUP;
 909 typedef struct _TOKEN_PRIVILEGES {
 910         ULONG PrivilegeCount;
 911         LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY];
 912 } TOKEN_PRIVILEGES,*PTOKEN_PRIVILEGES,*LPTOKEN_PRIVILEGES;
 913 typedef enum tagTOKEN_TYPE {
 914         TokenPrimary = 1,
 915         TokenImpersonation
 916 } TOKEN_TYPE,*PTOKEN_TYPE;
 917 typedef struct _TOKEN_STATISTICS {
 918         LUID TokenId;
 919         LUID AuthenticationId;
 920         LARGE_INTEGER ExpirationTime;
 921         TOKEN_TYPE TokenType;
 922         SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
 923         ULONG DynamicCharged;
 924         ULONG DynamicAvailable;
 925         ULONG GroupCount;
 926         ULONG PrivilegeCount;
 927         LUID ModifiedId;
 928 } TOKEN_STATISTICS, *PTOKEN_STATISTICS;
 929 typedef struct _TOKEN_USER {
 930         SID_AND_ATTRIBUTES User;
 931 } TOKEN_USER, *PTOKEN_USER;
 932 typedef USHORT SECURITY_DESCRIPTOR_CONTROL,*PSECURITY_DESCRIPTOR_CONTROL;
 933 typedef struct _SECURITY_DESCRIPTOR {
 934         UCHAR Revision;
 935         UCHAR Sbz1;
 936         SECURITY_DESCRIPTOR_CONTROL Control;
 937         PSID Owner;
 938         PSID Group;
 939         PACL Sacl;
 940         PACL Dacl;
 941 } SECURITY_DESCRIPTOR, *PISECURITY_DESCRIPTOR;
 942
 943 #define SECURITY_DESCRIPTOR_MIN_LENGTH   (sizeof(SECURITY_DESCRIPTOR))
 944
 945 typedef struct _OBJECT_TYPE_LIST {
 946     USHORT Level;
 947     USHORT Sbz;
 948     GUID *ObjectType;
 949     } OBJECT_TYPE_LIST, *POBJECT_TYPE_LIST;
 950
 951 typedef struct _SECURITY_DESCRIPTOR_RELATIVE {
 952     UCHAR Revision;
 953     UCHAR Sbz1;
 954     SECURITY_DESCRIPTOR_CONTROL Control;
 955     ULONG Owner;
 956     ULONG Group;
 957     ULONG Sacl;
 958     ULONG Dacl;
 959 } SECURITY_DESCRIPTOR_RELATIVE, *PISECURITY_DESCRIPTOR_RELATIVE;
 960 typedef enum _TOKEN_INFORMATION_CLASS {
 961         TokenUser=1,TokenGroups,TokenPrivileges,TokenOwner,
 962         TokenPrimaryGroup,TokenDefaultDacl,TokenSource,TokenType,
 963         TokenImpersonationLevel,TokenStatistics,TokenRestrictedSids,
 964         TokenSessionId,TokenGroupsAndPrivileges,TokenSessionReference,
 965         TokenSandBoxInert,TokenAuditPolicy,TokenOrigin,
 966 } TOKEN_INFORMATION_CLASS;
 967
 968 #define SYMLINK_FLAG_RELATIVE   1
 969
 970 typedef struct _REPARSE_DATA_BUFFER {
 971     ULONG  ReparseTag;
 972     USHORT ReparseDataLength;
 973     USHORT Reserved;
 974     __GNU_EXTENSION union {
 975         struct {
 976             USHORT SubstituteNameOffset;
 977             USHORT SubstituteNameLength;
 978             USHORT PrintNameOffset;
 979             USHORT PrintNameLength;
 980             ULONG Flags;
 981             WCHAR PathBuffer[1];
 982         } SymbolicLinkReparseBuffer;
 983         struct {
 984             USHORT SubstituteNameOffset;
 985             USHORT SubstituteNameLength;
 986             USHORT PrintNameOffset;
 987             USHORT PrintNameLength;
 988             WCHAR PathBuffer[1];
 989         } MountPointReparseBuffer;
 990         struct {
 991             UCHAR  DataBuffer[1];
 992         } GenericReparseBuffer;
 993     };
 994 } REPARSE_DATA_BUFFER, *PREPARSE_DATA_BUFFER;
 995
 996
 997
 998 //
 999 // MicroSoft reparse point tags
1000 //
1001 #define IO_REPARSE_TAG_MOUNT_POINT              (0xA0000003L)
1002 #define IO_REPARSE_TAG_HSM                      (0xC0000004L)
1003 #define IO_REPARSE_TAG_DRIVE_EXTENDER           (0x80000005L)
1004 #define IO_REPARSE_TAG_HSM2                     (0x80000006L)
1005 #define IO_REPARSE_TAG_SIS                      (0x80000007L)
1006 #define IO_REPARSE_TAG_DFS                      (0x8000000AL)
1007 #define IO_REPARSE_TAG_FILTER_MANAGER           (0x8000000BL)
1008 #define IO_REPARSE_TAG_SYMLINK                  (0xA000000CL)
1009 #define IO_REPARSE_TAG_IIS_CACHE                (0xA0000010L)
1010 #define IO_REPARSE_TAG_DFSR                     (0x80000012L)
1011
1012 //
1013 // Reserved reparse tags
1014 //
1015 #define IO_REPARSE_TAG_RESERVED_ZERO            (0)
1016 #define IO_REPARSE_TAG_RESERVED_ONE             (1)
1017 #define IO_REPARSE_TAG_RESERVED_RANGE           IO_REPARSE_TAG_RESERVED_ONE
1018
1019
1020 #define REPARSE_DATA_BUFFER_HEADER_SIZE   FIELD_OFFSET(REPARSE_DATA_BUFFER, GenericReparseBuffer)
1021
1022 typedef struct _FILE_ACCESS_INFORMATION {
1023     ACCESS_MASK AccessFlags;
1024 } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
1025
1026 typedef struct _FILE_ALLOCATION_INFORMATION {
1027     LARGE_INTEGER AllocationSize;
1028 } FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;
1029
1030 typedef struct _FILE_BOTH_DIR_INFORMATION {
1031     ULONG           NextEntryOffset;
1032     ULONG           FileIndex;
1033     LARGE_INTEGER   CreationTime;
1034     LARGE_INTEGER   LastAccessTime;
1035     LARGE_INTEGER   LastWriteTime;
1036     LARGE_INTEGER   ChangeTime;
1037     LARGE_INTEGER   EndOfFile;
1038     LARGE_INTEGER   AllocationSize;
1039     ULONG           FileAttributes;
1040     ULONG           FileNameLength;
1041     ULONG           EaSize;
1042     CCHAR           ShortNameLength;
1043     WCHAR           ShortName[12];
1044     WCHAR           FileName[1];
1045 } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
1046
1047 typedef struct _FILE_COMPLETION_INFORMATION {
1048     HANDLE  Port;
1049     PVOID   Key;
1050 } FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;
1051
1052 typedef struct _FILE_COMPRESSION_INFORMATION {
1053     LARGE_INTEGER   CompressedFileSize;
1054     USHORT          CompressionFormat;
1055     UCHAR           CompressionUnitShift;
1056     UCHAR           ChunkShift;
1057     UCHAR           ClusterShift;
1058     UCHAR           Reserved[3];
1059 } FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
1060
1061 typedef struct _FILE_COPY_ON_WRITE_INFORMATION {
1062     BOOLEAN ReplaceIfExists;
1063     HANDLE  RootDirectory;
1064     ULONG   FileNameLength;
1065     WCHAR   FileName[1];
1066 } FILE_COPY_ON_WRITE_INFORMATION, *PFILE_COPY_ON_WRITE_INFORMATION;
1067
1068 typedef struct _FILE_DIRECTORY_INFORMATION {
1069     ULONG           NextEntryOffset;
1070     ULONG           FileIndex;
1071     LARGE_INTEGER   CreationTime;
1072     LARGE_INTEGER   LastAccessTime;
1073     LARGE_INTEGER   LastWriteTime;
1074     LARGE_INTEGER   ChangeTime;
1075     LARGE_INTEGER   EndOfFile;
1076     LARGE_INTEGER   AllocationSize;
1077     ULONG           FileAttributes;
1078     ULONG           FileNameLength;
1079     WCHAR           FileName[1];
1080 } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
1081
1082 typedef struct _FILE_FULL_DIRECTORY_INFORMATION {
1083     ULONG           NextEntryOffset;
1084     ULONG           FileIndex;
1085     LARGE_INTEGER   CreationTime;
1086     LARGE_INTEGER   LastAccessTime;
1087     LARGE_INTEGER   LastWriteTime;
1088     LARGE_INTEGER   ChangeTime;
1089     LARGE_INTEGER   EndOfFile;
1090     LARGE_INTEGER   AllocationSize;
1091     ULONG           FileAttributes;
1092     ULONG           FileNameLength;
1093     ULONG           EaSize;
1094     WCHAR           FileName[ANYSIZE_ARRAY];
1095 } FILE_FULL_DIRECTORY_INFORMATION, *PFILE_FULL_DIRECTORY_INFORMATION;
1096
1097 typedef struct _FILE_ID_FULL_DIR_INFORMATION {
1098     ULONG NextEntryOffset;
1099     ULONG FileIndex;
1100     LARGE_INTEGER CreationTime;
1101     LARGE_INTEGER LastAccessTime;
1102     LARGE_INTEGER LastWriteTime;
1103     LARGE_INTEGER ChangeTime;
1104     LARGE_INTEGER EndOfFile;
1105     LARGE_INTEGER AllocationSize;
1106     ULONG FileAttributes;
1107     ULONG FileNameLength;
1108     ULONG EaSize;
1109     LARGE_INTEGER FileId;
1110     WCHAR FileName[1];
1111 } FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION;
1112
1113 typedef struct _FILE_ID_BOTH_DIR_INFORMATION {
1114     ULONG NextEntryOffset;
1115     ULONG FileIndex;
1116     LARGE_INTEGER CreationTime;
1117     LARGE_INTEGER LastAccessTime;
1118     LARGE_INTEGER LastWriteTime;
1119     LARGE_INTEGER ChangeTime;
1120     LARGE_INTEGER EndOfFile;
1121     LARGE_INTEGER AllocationSize;
1122     ULONG FileAttributes;
1123     ULONG FileNameLength;
1124     ULONG EaSize;
1125     CCHAR ShortNameLength;
1126     WCHAR ShortName[12];
1127     LARGE_INTEGER FileId;
1128     WCHAR FileName[1];
1129 } FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;
1130
1131 typedef struct _FILE_EA_INFORMATION {
1132     ULONG EaSize;
1133 } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
1134
1135 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {
1136     ULONG   FileSystemAttributes;
1137     ULONG   MaximumComponentNameLength;
1138     ULONG   FileSystemNameLength;
1139     WCHAR   FileSystemName[1];
1140 } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
1141
1142 typedef struct _FILE_FS_CONTROL_INFORMATION {
1143     LARGE_INTEGER   FreeSpaceStartFiltering;
1144     LARGE_INTEGER   FreeSpaceThreshold;
1145     LARGE_INTEGER   FreeSpaceStopFiltering;
1146     LARGE_INTEGER   DefaultQuotaThreshold;
1147     LARGE_INTEGER   DefaultQuotaLimit;
1148     ULONG           FileSystemControlFlags;
1149 } FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;
1150
1151 typedef struct _FILE_FS_FULL_SIZE_INFORMATION {
1152     LARGE_INTEGER   TotalAllocationUnits;
1153     LARGE_INTEGER   CallerAvailableAllocationUnits;
1154     LARGE_INTEGER   ActualAvailableAllocationUnits;
1155     ULONG           SectorsPerAllocationUnit;
1156     ULONG           BytesPerSector;
1157 } FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
1158
1159 typedef struct _FILE_FS_LABEL_INFORMATION {
1160     ULONG VolumeLabelLength;
1161     WCHAR VolumeLabel[1];
1162 } FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
1163
1164 #if (VER_PRODUCTBUILD >= 2195)
1165
1166 typedef struct _FILE_FS_OBJECT_ID_INFORMATION {
1167     UCHAR ObjectId[16];
1168     UCHAR ExtendedInfo[48];
1169 } FILE_FS_OBJECT_ID_INFORMATION, *PFILE_FS_OBJECT_ID_INFORMATION;
1170
1171 #endif /* (VER_PRODUCTBUILD >= 2195) */
1172
1173 typedef struct _FILE_FS_SIZE_INFORMATION {
1174     LARGE_INTEGER   TotalAllocationUnits;
1175     LARGE_INTEGER   AvailableAllocationUnits;
1176     ULONG           SectorsPerAllocationUnit;
1177     ULONG           BytesPerSector;
1178 } FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
1179
1180 typedef struct _FILE_FS_VOLUME_INFORMATION {
1181     LARGE_INTEGER   VolumeCreationTime;
1182     ULONG           VolumeSerialNumber;
1183     ULONG           VolumeLabelLength;
1184     BOOLEAN         SupportsObjects;
1185     WCHAR           VolumeLabel[1];
1186 } FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
1187
1188 typedef struct _FILE_FS_OBJECTID_INFORMATION
1189 {
1190     UCHAR ObjectId[16];
1191     UCHAR ExtendedInfo[48];
1192 } FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION;
1193
1194 typedef struct _FILE_FS_DRIVER_PATH_INFORMATION
1195 {
1196     BOOLEAN DriverInPath;
1197     ULONG DriverNameLength;
1198     WCHAR DriverName[1];
1199 } FILE_FS_DRIVER_PATH_INFORMATION, *PFILE_FS_DRIVER_PATH_INFORMATION;
1200
1201 typedef struct _FILE_FULL_DIR_INFORMATION {
1202     ULONG           NextEntryOffset;
1203     ULONG           FileIndex;
1204     LARGE_INTEGER   CreationTime;
1205     LARGE_INTEGER   LastAccessTime;
1206     LARGE_INTEGER   LastWriteTime;
1207     LARGE_INTEGER   ChangeTime;
1208     LARGE_INTEGER   EndOfFile;
1209     LARGE_INTEGER   AllocationSize;
1210     ULONG           FileAttributes;
1211     ULONG           FileNameLength;
1212     ULONG           EaSize;
1213     WCHAR           FileName[1];
1214 } FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
1215
1216 typedef struct _FILE_GET_EA_INFORMATION {
1217     ULONG   NextEntryOffset;
1218     UCHAR   EaNameLength;
1219     CHAR    EaName[1];
1220 } FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
1221
1222 typedef struct _FILE_GET_QUOTA_INFORMATION {
1223     ULONG   NextEntryOffset;
1224     ULONG   SidLength;
1225     SID     Sid;
1226 } FILE_GET_QUOTA_INFORMATION, *PFILE_GET_QUOTA_INFORMATION;
1227
1228 typedef struct _FILE_QUOTA_INFORMATION
1229 {
1230     ULONG NextEntryOffset;
1231     ULONG SidLength;
1232     LARGE_INTEGER ChangeTime;
1233     LARGE_INTEGER QuotaUsed;
1234     LARGE_INTEGER QuotaThreshold;
1235     LARGE_INTEGER QuotaLimit;
1236     SID Sid;
1237 } FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION;
1238
1239 typedef struct _FILE_INTERNAL_INFORMATION {
1240     LARGE_INTEGER IndexNumber;
1241 } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
1242
1243 typedef struct _FILE_LINK_INFORMATION {
1244     BOOLEAN ReplaceIfExists;
1245     HANDLE  RootDirectory;
1246     ULONG   FileNameLength;
1247     WCHAR   FileName[1];
1248 } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
1249
1250 typedef struct _FILE_LOCK_INFO
1251 {
1252     LARGE_INTEGER StartingByte;
1253     LARGE_INTEGER Length;
1254     BOOLEAN ExclusiveLock;
1255     ULONG Key;
1256     PFILE_OBJECT FileObject;
1257     PVOID ProcessId;
1258     LARGE_INTEGER EndingByte;
1259 } FILE_LOCK_INFO, *PFILE_LOCK_INFO;
1260
1261 typedef struct _FILE_REPARSE_POINT_INFORMATION
1262 {
1263     LONGLONG FileReference;
1264     ULONG Tag;
1265 } FILE_REPARSE_POINT_INFORMATION, *PFILE_REPARSE_POINT_INFORMATION;
1266
1267 typedef struct _FILE_MOVE_CLUSTER_INFORMATION
1268 {
1269     ULONG ClusterCount;
1270     HANDLE RootDirectory;
1271     ULONG FileNameLength;
1272     WCHAR FileName[1];
1273 } FILE_MOVE_CLUSTER_INFORMATION, *PFILE_MOVE_CLUSTER_INFORMATION;
1274
1275 typedef struct _FILE_NOTIFY_INFORMATION
1276 {
1277     ULONG NextEntryOffset;
1278     ULONG Action;
1279     ULONG FileNameLength;
1280     WCHAR FileName[1];
1281 } FILE_NOTIFY_INFORMATION, *PFILE_NOTIFY_INFORMATION;
1282
1283 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
1284 typedef struct _FILE_SHARED_LOCK_ENTRY {
1285     PVOID           Unknown1;
1286     PVOID           Unknown2;
1287     FILE_LOCK_INFO  FileLock;
1288 } FILE_SHARED_LOCK_ENTRY, *PFILE_SHARED_LOCK_ENTRY;
1289
1290 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
1291 typedef struct _FILE_EXCLUSIVE_LOCK_ENTRY {
1292     LIST_ENTRY      ListEntry;
1293     PVOID           Unknown1;
1294     PVOID           Unknown2;
1295     FILE_LOCK_INFO  FileLock;
1296 } FILE_EXCLUSIVE_LOCK_ENTRY, *PFILE_EXCLUSIVE_LOCK_ENTRY;
1297
1298 typedef NTSTATUS (NTAPI *PCOMPLETE_LOCK_IRP_ROUTINE) (
1299     IN PVOID    Context,
1300     IN PIRP     Irp
1301 );
1302
1303 typedef VOID (NTAPI *PUNLOCK_ROUTINE) (
1304     IN PVOID            Context,
1305     IN PFILE_LOCK_INFO  FileLockInfo
1306 );
1307
1308 typedef struct _FILE_LOCK {
1309     PCOMPLETE_LOCK_IRP_ROUTINE  CompleteLockIrpRoutine;
1310     PUNLOCK_ROUTINE             UnlockRoutine;
1311     BOOLEAN                     FastIoIsQuestionable;
1312     BOOLEAN                     Pad[3];
1313     PVOID                       LockInformation;
1314     FILE_LOCK_INFO              LastReturnedLockInfo;
1315     PVOID                       LastReturnedLock;
1316 } FILE_LOCK, *PFILE_LOCK;
1317
1318 typedef struct _FILE_MAILSLOT_PEEK_BUFFER {
1319     ULONG ReadDataAvailable;
1320     ULONG NumberOfMessages;
1321     ULONG MessageLength;
1322 } FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER;
1323
1324 typedef struct _FILE_MAILSLOT_QUERY_INFORMATION {
1325     ULONG           MaximumMessageSize;
1326     ULONG           MailslotQuota;
1327     ULONG           NextMessageSize;
1328     ULONG           MessagesAvailable;
1329     LARGE_INTEGER   ReadTimeout;
1330 } FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION;
1331
1332 typedef struct _FILE_MAILSLOT_SET_INFORMATION {
1333     PLARGE_INTEGER ReadTimeout;
1334 } FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
1335
1336 typedef struct _FILE_MODE_INFORMATION {
1337     ULONG Mode;
1338 } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
1339
1340 typedef struct _FILE_ALL_INFORMATION {
1341     FILE_BASIC_INFORMATION      BasicInformation;
1342     FILE_STANDARD_INFORMATION   StandardInformation;
1343     FILE_INTERNAL_INFORMATION   InternalInformation;
1344     FILE_EA_INFORMATION         EaInformation;
1345     FILE_ACCESS_INFORMATION     AccessInformation;
1346     FILE_POSITION_INFORMATION   PositionInformation;
1347     FILE_MODE_INFORMATION       ModeInformation;
1348     FILE_ALIGNMENT_INFORMATION  AlignmentInformation;
1349     FILE_NAME_INFORMATION       NameInformation;
1350 } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
1351
1352 typedef struct _FILE_NAMES_INFORMATION {
1353     ULONG NextEntryOffset;
1354     ULONG FileIndex;
1355     ULONG FileNameLength;
1356     WCHAR FileName[1];
1357 } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
1358
1359 typedef struct _FILE_OBJECTID_INFORMATION {
1360     LONGLONG        FileReference;
1361     UCHAR           ObjectId[16];
1362     _ANONYMOUS_UNION union {
1363         __GNU_EXTENSION struct {
1364             UCHAR   BirthVolumeId[16];
1365             UCHAR   BirthObjectId[16];
1366             UCHAR   DomainId[16];
1367         };
1368         UCHAR       ExtendedInfo[48];
1369     } DUMMYUNIONNAME;
1370 } FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION;
1371
1372 typedef struct _FILE_OLE_CLASSID_INFORMATION {
1373     GUID ClassId;
1374 } FILE_OLE_CLASSID_INFORMATION, *PFILE_OLE_CLASSID_INFORMATION;
1375
1376 typedef struct _FILE_OLE_ALL_INFORMATION {
1377     FILE_BASIC_INFORMATION          BasicInformation;
1378     FILE_STANDARD_INFORMATION       StandardInformation;
1379     FILE_INTERNAL_INFORMATION       InternalInformation;
1380     FILE_EA_INFORMATION             EaInformation;
1381     FILE_ACCESS_INFORMATION         AccessInformation;
1382     FILE_POSITION_INFORMATION       PositionInformation;
1383     FILE_MODE_INFORMATION           ModeInformation;
1384     FILE_ALIGNMENT_INFORMATION      AlignmentInformation;
1385     USN                             LastChangeUsn;
1386     USN                             ReplicationUsn;
1387     LARGE_INTEGER                   SecurityChangeTime;
1388     FILE_OLE_CLASSID_INFORMATION    OleClassIdInformation;
1389     FILE_OBJECTID_INFORMATION       ObjectIdInformation;
1390     FILE_STORAGE_TYPE               StorageType;
1391     ULONG                           OleStateBits;
1392     ULONG                           OleId;
1393     ULONG                           NumberOfStreamReferences;
1394     ULONG                           StreamIndex;
1395     ULONG                           SecurityId;
1396     BOOLEAN                         ContentIndexDisable;
1397     BOOLEAN                         InheritContentIndexDisable;
1398     FILE_NAME_INFORMATION           NameInformation;
1399 } FILE_OLE_ALL_INFORMATION, *PFILE_OLE_ALL_INFORMATION;
1400
1401 typedef struct _FILE_OLE_DIR_INFORMATION {
1402     ULONG               NextEntryOffset;
1403     ULONG               FileIndex;
1404     LARGE_INTEGER       CreationTime;
1405     LARGE_INTEGER       LastAccessTime;
1406     LARGE_INTEGER       LastWriteTime;
1407     LARGE_INTEGER       ChangeTime;
1408     LARGE_INTEGER       EndOfFile;
1409     LARGE_INTEGER       AllocationSize;
1410     ULONG               FileAttributes;
1411     ULONG               FileNameLength;
1412     FILE_STORAGE_TYPE   StorageType;
1413     GUID                OleClassId;
1414     ULONG               OleStateBits;
1415     BOOLEAN             ContentIndexDisable;
1416     BOOLEAN             InheritContentIndexDisable;
1417     WCHAR               FileName[1];
1418 } FILE_OLE_DIR_INFORMATION, *PFILE_OLE_DIR_INFORMATION;
1419
1420 typedef struct _FILE_OLE_INFORMATION {
1421     LARGE_INTEGER                   SecurityChangeTime;
1422     FILE_OLE_CLASSID_INFORMATION    OleClassIdInformation;
1423     FILE_OBJECTID_INFORMATION       ObjectIdInformation;
1424     FILE_STORAGE_TYPE               StorageType;
1425     ULONG                           OleStateBits;
1426     BOOLEAN                         ContentIndexDisable;
1427     BOOLEAN                         InheritContentIndexDisable;
1428 } FILE_OLE_INFORMATION, *PFILE_OLE_INFORMATION;
1429
1430 typedef struct _FILE_OLE_STATE_BITS_INFORMATION {
1431     ULONG StateBits;
1432     ULONG StateBitsMask;
1433 } FILE_OLE_STATE_BITS_INFORMATION, *PFILE_OLE_STATE_BITS_INFORMATION;
1434
1435 typedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER {
1436     HANDLE  EventHandle;
1437     ULONG   KeyValue;
1438 } FILE_PIPE_ASSIGN_EVENT_BUFFER, *PFILE_PIPE_ASSIGN_EVENT_BUFFER;
1439
1440 typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER {
1441     PVOID ClientSession;
1442     PVOID ClientProcess;
1443 } FILE_PIPE_CLIENT_PROCESS_BUFFER, *PFILE_PIPE_CLIENT_PROCESS_BUFFER;
1444
1445 typedef struct _FILE_PIPE_EVENT_BUFFER {
1446     ULONG NamedPipeState;
1447     ULONG EntryType;
1448     ULONG ByteCount;
1449     ULONG KeyValue;
1450     ULONG NumberRequests;
1451 } FILE_PIPE_EVENT_BUFFER, *PFILE_PIPE_EVENT_BUFFER;
1452
1453 typedef struct _FILE_PIPE_PEEK_BUFFER
1454 {
1455     ULONG NamedPipeState;
1456     ULONG ReadDataAvailable;
1457     ULONG NumberOfMessages;
1458     ULONG MessageLength;
1459     CHAR Data[1];
1460 } FILE_PIPE_PEEK_BUFFER, *PFILE_PIPE_PEEK_BUFFER;
1461
1462 typedef struct _FILE_PIPE_INFORMATION {
1463     ULONG ReadMode;
1464     ULONG CompletionMode;
1465 } FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;
1466
1467 typedef struct _FILE_PIPE_LOCAL_INFORMATION {
1468     ULONG NamedPipeType;
1469     ULONG NamedPipeConfiguration;
1470     ULONG MaximumInstances;
1471     ULONG CurrentInstances;
1472     ULONG InboundQuota;
1473     ULONG ReadDataAvailable;
1474     ULONG OutboundQuota;
1475     ULONG WriteQuotaAvailable;
1476     ULONG NamedPipeState;
1477     ULONG NamedPipeEnd;
1478 } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
1479
1480 typedef struct _FILE_PIPE_REMOTE_INFORMATION {
1481     LARGE_INTEGER   CollectDataTime;
1482     ULONG           MaximumCollectionCount;
1483 } FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION;
1484
1485 typedef struct _FILE_PIPE_WAIT_FOR_BUFFER {
1486     LARGE_INTEGER   Timeout;
1487     ULONG           NameLength;
1488     BOOLEAN         TimeoutSpecified;
1489     WCHAR           Name[1];
1490 } FILE_PIPE_WAIT_FOR_BUFFER, *PFILE_PIPE_WAIT_FOR_BUFFER;
1491
1492 typedef struct _FILE_RENAME_INFORMATION {
1493     BOOLEAN ReplaceIfExists;
1494     HANDLE  RootDirectory;
1495     ULONG   FileNameLength;
1496     WCHAR   FileName[1];
1497 } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
1498
1499 typedef struct _FILE_STREAM_INFORMATION {
1500     ULONG           NextEntryOffset;
1501     ULONG           StreamNameLength;
1502     LARGE_INTEGER   StreamSize;
1503     LARGE_INTEGER   StreamAllocationSize;
1504     WCHAR           StreamName[1];
1505 } FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;
1506
1507 typedef struct _FILE_TRACKING_INFORMATION {
1508     HANDLE  DestinationFile;
1509     ULONG   ObjectInformationLength;
1510     CHAR    ObjectInformation[1];
1511 } FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION;
1512
1513 #if (VER_PRODUCTBUILD >= 2195)
1514 typedef struct _FILE_ZERO_DATA_INFORMATION {
1515     LARGE_INTEGER FileOffset;
1516     LARGE_INTEGER BeyondFinalZero;
1517 } FILE_ZERO_DATA_INFORMATION, *PFILE_ZERO_DATA_INFORMATION;
1518
1519 typedef struct FILE_ALLOCATED_RANGE_BUFFER {
1520     LARGE_INTEGER FileOffset;
1521     LARGE_INTEGER Length;
1522 } FILE_ALLOCATED_RANGE_BUFFER, *PFILE_ALLOCATED_RANGE_BUFFER;
1523 #endif /* (VER_PRODUCTBUILD >= 2195) */
1524
1525 #define FSRTL_FCB_HEADER_V0             (0x00)
1526 #define FSRTL_FCB_HEADER_V1             (0x01)
1527
1528
1529 typedef struct _FSRTL_COMMON_FCB_HEADER {
1530     CSHORT          NodeTypeCode;
1531     CSHORT          NodeByteSize;
1532     UCHAR           Flags;
1533     UCHAR           IsFastIoPossible;
1534 #if (VER_PRODUCTBUILD >= 1381)
1535     UCHAR           Flags2;
1536     UCHAR           Reserved;
1537 #endif /* (VER_PRODUCTBUILD >= 1381) */
1538     PERESOURCE      Resource;
1539     PERESOURCE      PagingIoResource;
1540     LARGE_INTEGER   AllocationSize;
1541     LARGE_INTEGER   FileSize;
1542     LARGE_INTEGER   ValidDataLength;
1543 } FSRTL_COMMON_FCB_HEADER, *PFSRTL_COMMON_FCB_HEADER;
1544
1545 typedef enum _FSRTL_COMPARISON_RESULT
1546 {
1547     LessThan = -1,
1548     EqualTo = 0,
1549     GreaterThan = 1
1550 } FSRTL_COMPARISON_RESULT;
1551
1552 #if (VER_PRODUCTBUILD >= 2600)
1553
1554 typedef struct _FSRTL_ADVANCED_FCB_HEADER {
1555     CSHORT          NodeTypeCode;
1556     CSHORT          NodeByteSize;
1557     UCHAR           Flags;
1558     UCHAR           IsFastIoPossible;
1559     UCHAR           Flags2;
1560     UCHAR           Reserved: 4;
1561     UCHAR           Version: 4;
1562     PERESOURCE      Resource;
1563     PERESOURCE      PagingIoResource;
1564     LARGE_INTEGER   AllocationSize;
1565     LARGE_INTEGER   FileSize;
1566     LARGE_INTEGER   ValidDataLength;
1567     PFAST_MUTEX     FastMutex;
1568     LIST_ENTRY      FilterContexts;
1569     EX_PUSH_LOCK    PushLock;
1570     PVOID           *FileContextSupportPointer;
1571 } FSRTL_ADVANCED_FCB_HEADER, *PFSRTL_ADVANCED_FCB_HEADER;
1572
1573 typedef struct _FSRTL_PER_STREAM_CONTEXT {
1574     LIST_ENTRY     Links;
1575     PVOID          OwnerId;
1576     PVOID          InstanceId;
1577     PFREE_FUNCTION FreeCallback;
1578 } FSRTL_PER_STREAM_CONTEXT, *PFSRTL_PER_STREAM_CONTEXT;
1579
1580 typedef struct _FSRTL_PER_FILEOBJECT_CONTEXT
1581 {
1582     LIST_ENTRY Links;
1583     PVOID OwnerId;
1584     PVOID InstanceId;
1585 } FSRTL_PER_FILEOBJECT_CONTEXT, *PFSRTL_PER_FILEOBJECT_CONTEXT;
1586
1587 #endif /* (VER_PRODUCTBUILD >= 2600) */
1588
1589 typedef struct _BASE_MCB
1590 {
1591     ULONG MaximumPairCount;
1592     ULONG PairCount;
1593     USHORT PoolType;
1594     USHORT Flags;
1595     PVOID Mapping;
1596 } BASE_MCB, *PBASE_MCB;
1597
1598 typedef struct _LARGE_MCB
1599 {
1600     PKGUARDED_MUTEX GuardedMutex;
1601     BASE_MCB BaseMcb;
1602 } LARGE_MCB, *PLARGE_MCB;
1603
1604 typedef struct _MCB
1605 {
1606     LARGE_MCB DummyFieldThatSizesThisStructureCorrectly;
1607 } MCB, *PMCB;
1608
1609 typedef struct _GENERATE_NAME_CONTEXT {
1610     USHORT  Checksum;
1611     BOOLEAN CheckSumInserted;
1612     UCHAR   NameLength;
1613     WCHAR   NameBuffer[8];
1614     ULONG   ExtensionLength;
1615     WCHAR   ExtensionBuffer[4];
1616     ULONG   LastIndexValue;
1617 } GENERATE_NAME_CONTEXT, *PGENERATE_NAME_CONTEXT;
1618
1619 typedef struct _MAPPING_PAIR {
1620     ULONGLONG Vcn;
1621     ULONGLONG Lcn;
1622 } MAPPING_PAIR, *PMAPPING_PAIR;
1623
1624 typedef struct _GET_RETRIEVAL_DESCRIPTOR {
1625     ULONG           NumberOfPairs;
1626     ULONGLONG       StartVcn;
1627     MAPPING_PAIR    Pair[1];
1628 } GET_RETRIEVAL_DESCRIPTOR, *PGET_RETRIEVAL_DESCRIPTOR;
1629
1630 typedef struct _KQUEUE {
1631     DISPATCHER_HEADER   Header;
1632     LIST_ENTRY          EntryListHead;
1633     ULONG               CurrentCount;
1634     ULONG               MaximumCount;
1635     LIST_ENTRY          ThreadListHead;
1636 } KQUEUE, *PKQUEUE, *RESTRICTED_POINTER PRKQUEUE;
1637
1638 #define ASSERT_QUEUE(Q) ASSERT(((Q)->Header.Type & KOBJECT_TYPE_MASK) == QueueObject);
1639
1640 typedef struct _MBCB {
1641     CSHORT          NodeTypeCode;
1642     CSHORT          NodeIsInZone;
1643     ULONG           PagesToWrite;
1644     ULONG           DirtyPages;
1645     ULONG           Reserved;
1646     LIST_ENTRY      BitmapRanges;
1647     LONGLONG        ResumeWritePage;
1648     BITMAP_RANGE    BitmapRange1;
1649     BITMAP_RANGE    BitmapRange2;
1650     BITMAP_RANGE    BitmapRange3;
1651 } MBCB, *PMBCB;
1652
1653 typedef enum _MMFLUSH_TYPE {
1654   MmFlushForDelete,
1655   MmFlushForWrite
1656 } MMFLUSH_TYPE;
1657
1658 typedef struct _MOVEFILE_DESCRIPTOR {
1659      HANDLE         FileHandle;
1660      ULONG          Reserved;
1661      LARGE_INTEGER  StartVcn;
1662      LARGE_INTEGER  TargetLcn;
1663      ULONG          NumVcns;
1664      ULONG          Reserved1;
1665 } MOVEFILE_DESCRIPTOR, *PMOVEFILE_DESCRIPTOR;
1666
1667 typedef struct _OBJECT_BASIC_INFO {
1668     ULONG           Attributes;
1669     ACCESS_MASK     GrantedAccess;
1670     ULONG           HandleCount;
1671     ULONG           ReferenceCount;
1672     ULONG           PagedPoolUsage;
1673     ULONG           NonPagedPoolUsage;
1674     ULONG           Reserved[3];
1675     ULONG           NameInformationLength;
1676     ULONG           TypeInformationLength;
1677     ULONG           SecurityDescriptorLength;
1678     LARGE_INTEGER   CreateTime;
1679 } OBJECT_BASIC_INFO, *POBJECT_BASIC_INFO;
1680
1681 typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFO {
1682     BOOLEAN Inherit;
1683     BOOLEAN ProtectFromClose;
1684 } OBJECT_HANDLE_ATTRIBUTE_INFO, *POBJECT_HANDLE_ATTRIBUTE_INFO;
1685
1686 typedef struct _OBJECT_NAME_INFO {
1687     UNICODE_STRING  ObjectName;
1688     WCHAR           ObjectNameBuffer[1];
1689 } OBJECT_NAME_INFO, *POBJECT_NAME_INFO;
1690
1691 typedef struct _OBJECT_PROTECTION_INFO {
1692     BOOLEAN Inherit;
1693     BOOLEAN ProtectHandle;
1694 } OBJECT_PROTECTION_INFO, *POBJECT_PROTECTION_INFO;
1695
1696 typedef struct _OBJECT_TYPE_INFO {
1697     UNICODE_STRING  ObjectTypeName;
1698     UCHAR           Unknown[0x58];
1699     WCHAR           ObjectTypeNameBuffer[1];
1700 } OBJECT_TYPE_INFO, *POBJECT_TYPE_INFO;
1701
1702 typedef struct _OBJECT_ALL_TYPES_INFO {
1703     ULONG               NumberOfObjectTypes;
1704     OBJECT_TYPE_INFO    ObjectsTypeInfo[1];
1705 } OBJECT_ALL_TYPES_INFO, *POBJECT_ALL_TYPES_INFO;
1706
1707 typedef struct _PATHNAME_BUFFER {
1708     ULONG PathNameLength;
1709     WCHAR Name[1];
1710 } PATHNAME_BUFFER, *PPATHNAME_BUFFER;
1711
1712 typedef enum _RTL_GENERIC_COMPARE_RESULTS
1713 {
1714     GenericLessThan,
1715     GenericGreaterThan,
1716     GenericEqual
1717 } RTL_GENERIC_COMPARE_RESULTS;
1718
1719 typedef enum _TABLE_SEARCH_RESULT
1720 {
1721     TableEmptyTree,
1722     TableFoundNode,
1723     TableInsertAsLeft,
1724     TableInsertAsRight
1725 } TABLE_SEARCH_RESULT;
1726
1727 typedef NTSTATUS
1728 (NTAPI *PRTL_AVL_MATCH_FUNCTION)(
1729     struct _RTL_AVL_TABLE *Table,
1730     PVOID UserData,
1731     PVOID MatchData
1732 );
1733
1734 typedef RTL_GENERIC_COMPARE_RESULTS
1735 (NTAPI *PRTL_AVL_COMPARE_ROUTINE) (
1736     struct _RTL_AVL_TABLE *Table,
1737     PVOID FirstStruct,
1738     PVOID SecondStruct
1739 );
1740
1741 typedef RTL_GENERIC_COMPARE_RESULTS
1742 (NTAPI *PRTL_GENERIC_COMPARE_ROUTINE) (
1743     struct _RTL_GENERIC_TABLE *Table,
1744     PVOID FirstStruct,
1745     PVOID SecondStruct
1746 );
1747
1748 typedef PVOID
1749 (NTAPI *PRTL_GENERIC_ALLOCATE_ROUTINE) (
1750     struct _RTL_GENERIC_TABLE *Table,
1751     CLONG ByteSize
1752 );
1753
1754 typedef VOID
1755 (NTAPI *PRTL_GENERIC_FREE_ROUTINE) (
1756     struct _RTL_GENERIC_TABLE *Table,
1757     PVOID Buffer
1758 );
1759
1760 typedef PVOID
1761 (NTAPI *PRTL_AVL_ALLOCATE_ROUTINE) (
1762     struct _RTL_AVL_TABLE *Table,
1763     CLONG ByteSize
1764 );
1765
1766 typedef VOID
1767 (NTAPI *PRTL_AVL_FREE_ROUTINE) (
1768     struct _RTL_AVL_TABLE *Table,
1769     PVOID Buffer
1770 );
1771
1772 typedef struct _PUBLIC_BCB {
1773     CSHORT          NodeTypeCode;
1774     CSHORT          NodeByteSize;
1775     ULONG           MappedLength;
1776     LARGE_INTEGER   MappedFileOffset;
1777 } PUBLIC_BCB, *PPUBLIC_BCB;
1778
1779 typedef struct _QUERY_PATH_REQUEST {
1780     ULONG                   PathNameLength;
1781     PIO_SECURITY_CONTEXT    SecurityContext;
1782     WCHAR                   FilePathName[1];
1783 } QUERY_PATH_REQUEST, *PQUERY_PATH_REQUEST;
1784
1785 typedef struct _QUERY_PATH_RESPONSE {
1786     ULONG LengthAccepted;
1787 } QUERY_PATH_RESPONSE, *PQUERY_PATH_RESPONSE;
1788
1789 typedef struct _RETRIEVAL_POINTERS_BUFFER {
1790     ULONG               ExtentCount;
1791     LARGE_INTEGER       StartingVcn;
1792     struct {
1793         LARGE_INTEGER   NextVcn;
1794         LARGE_INTEGER   Lcn;
1795     } Extents[1];
1796 } RETRIEVAL_POINTERS_BUFFER, *PRETRIEVAL_POINTERS_BUFFER;
1797
1798 typedef struct _RTL_SPLAY_LINKS {
1799     struct _RTL_SPLAY_LINKS *Parent;
1800     struct _RTL_SPLAY_LINKS *LeftChild;
1801     struct _RTL_SPLAY_LINKS *RightChild;
1802 } RTL_SPLAY_LINKS, *PRTL_SPLAY_LINKS;
1803
1804 typedef struct _RTL_BALANCED_LINKS
1805 {
1806     struct _RTL_BALANCED_LINKS *Parent;
1807     struct _RTL_BALANCED_LINKS *LeftChild;
1808     struct _RTL_BALANCED_LINKS *RightChild;
1809     CHAR Balance;
1810     UCHAR Reserved[3];
1811 } RTL_BALANCED_LINKS, *PRTL_BALANCED_LINKS;
1812
1813 typedef struct _RTL_GENERIC_TABLE
1814 {
1815     PRTL_SPLAY_LINKS TableRoot;
1816     LIST_ENTRY InsertOrderList;
1817     PLIST_ENTRY OrderedPointer;
1818     ULONG WhichOrderedElement;
1819     ULONG NumberGenericTableElements;
1820     PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine;
1821     PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine;
1822     PRTL_GENERIC_FREE_ROUTINE FreeRoutine;
1823     PVOID TableContext;
1824 } RTL_GENERIC_TABLE, *PRTL_GENERIC_TABLE;
1825
1826 typedef struct _UNICODE_PREFIX_TABLE_ENTRY
1827 {
1828     CSHORT NodeTypeCode;
1829     CSHORT NameLength;
1830     struct _UNICODE_PREFIX_TABLE_ENTRY *NextPrefixTree;
1831     struct _UNICODE_PREFIX_TABLE_ENTRY *CaseMatch;
1832     RTL_SPLAY_LINKS Links;
1833     PUNICODE_STRING Prefix;
1834 } UNICODE_PREFIX_TABLE_ENTRY, *PUNICODE_PREFIX_TABLE_ENTRY;
1835
1836 typedef struct _UNICODE_PREFIX_TABLE
1837 {
1838     CSHORT NodeTypeCode;
1839     CSHORT NameLength;
1840     PUNICODE_PREFIX_TABLE_ENTRY NextPrefixTree;
1841     PUNICODE_PREFIX_TABLE_ENTRY LastNextEntry;
1842 } UNICODE_PREFIX_TABLE, *PUNICODE_PREFIX_TABLE;
1843
1844 NTSYSAPI
1845 VOID
1846 NTAPI
1847 RtlInitializeUnicodePrefix (
1848     IN PUNICODE_PREFIX_TABLE PrefixTable
1849 );
1850
1851 NTSYSAPI
1852 BOOLEAN
1853 NTAPI
1854 RtlInsertUnicodePrefix (
1855     IN PUNICODE_PREFIX_TABLE PrefixTable,
1856     IN PUNICODE_STRING Prefix,
1857     IN PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry
1858 );
1859
1860 NTSYSAPI
1861 VOID
1862 NTAPI
1863 RtlRemoveUnicodePrefix (
1864     IN PUNICODE_PREFIX_TABLE PrefixTable,
1865     IN PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry
1866 );
1867
1868 NTSYSAPI
1869 PUNICODE_PREFIX_TABLE_ENTRY
1870 NTAPI
1871 RtlFindUnicodePrefix (
1872     IN PUNICODE_PREFIX_TABLE PrefixTable,
1873     IN PUNICODE_STRING FullName,
1874     IN ULONG CaseInsensitiveIndex
1875 );
1876
1877 NTSYSAPI
1878 PUNICODE_PREFIX_TABLE_ENTRY
1879 NTAPI
1880 RtlNextUnicodePrefix (
1881     IN PUNICODE_PREFIX_TABLE PrefixTable,
1882     IN BOOLEAN Restart
1883 );
1884
1885 #undef PRTL_GENERIC_COMPARE_ROUTINE
1886 #undef PRTL_GENERIC_ALLOCATE_ROUTINE
1887 #undef PRTL_GENERIC_FREE_ROUTINE
1888 #undef RTL_GENERIC_TABLE
1889 #undef PRTL_GENERIC_TABLE
1890
1891 #define PRTL_GENERIC_COMPARE_ROUTINE PRTL_AVL_COMPARE_ROUTINE
1892 #define PRTL_GENERIC_ALLOCATE_ROUTINE PRTL_AVL_ALLOCATE_ROUTINE
1893 #define PRTL_GENERIC_FREE_ROUTINE PRTL_AVL_FREE_ROUTINE
1894 #define RTL_GENERIC_TABLE RTL_AVL_TABLE
1895 #define PRTL_GENERIC_TABLE PRTL_AVL_TABLE
1896
1897 #define RtlInitializeGenericTable               RtlInitializeGenericTableAvl
1898 #define RtlInsertElementGenericTable            RtlInsertElementGenericTableAvl
1899 #define RtlInsertElementGenericTableFull        RtlInsertElementGenericTableFullAvl
1900 #define RtlDeleteElementGenericTable            RtlDeleteElementGenericTableAvl
1901 #define RtlLookupElementGenericTable            RtlLookupElementGenericTableAvl
1902 #define RtlLookupElementGenericTableFull        RtlLookupElementGenericTableFullAvl
1903 #define RtlEnumerateGenericTable                RtlEnumerateGenericTableAvl
1904 #define RtlEnumerateGenericTableWithoutSplaying RtlEnumerateGenericTableWithoutSplayingAvl
1905 #define RtlGetElementGenericTable               RtlGetElementGenericTableAvl
1906 #define RtlNumberGenericTableElements           RtlNumberGenericTableElementsAvl
1907 #define RtlIsGenericTableEmpty                  RtlIsGenericTableEmptyAvl
1908
1909 typedef struct _RTL_AVL_TABLE
1910 {
1911     RTL_BALANCED_LINKS BalancedRoot;
1912     PVOID OrderedPointer;
1913     ULONG WhichOrderedElement;
1914     ULONG NumberGenericTableElements;
1915     ULONG DepthOfTree;
1916     PRTL_BALANCED_LINKS RestartKey;
1917     ULONG DeleteCount;
1918     PRTL_AVL_COMPARE_ROUTINE CompareRoutine;
1919     PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine;
1920     PRTL_AVL_FREE_ROUTINE FreeRoutine;
1921     PVOID TableContext;
1922 } RTL_AVL_TABLE, *PRTL_AVL_TABLE;
1923
1924 NTSYSAPI
1925 VOID
1926 NTAPI
1927 RtlInitializeGenericTableAvl(
1928     PRTL_AVL_TABLE Table,
1929     PRTL_AVL_COMPARE_ROUTINE CompareRoutine,
1930     PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine,
1931     PRTL_AVL_FREE_ROUTINE FreeRoutine,
1932     PVOID TableContext
1933 );
1934
1935 NTSYSAPI
1936 PVOID
1937 NTAPI
1938 RtlInsertElementGenericTableAvl (
1939     PRTL_AVL_TABLE Table,
1940     PVOID Buffer,
1941     CLONG BufferSize,
1942     PBOOLEAN NewElement OPTIONAL
1943     );
1944
1945 NTSYSAPI
1946 BOOLEAN
1947 NTAPI
1948 RtlDeleteElementGenericTableAvl (
1949     PRTL_AVL_TABLE Table,
1950     PVOID Buffer
1951     );
1952
1953 NTSYSAPI
1954 PVOID
1955 NTAPI
1956 RtlLookupElementGenericTableAvl (
1957     PRTL_AVL_TABLE Table,
1958     PVOID Buffer
1959     );
1960
1961 NTSYSAPI
1962 PVOID
1963 NTAPI
1964 RtlEnumerateGenericTableWithoutSplayingAvl (
1965     PRTL_AVL_TABLE Table,
1966     PVOID *RestartKey
1967     );
1968
1969 #if defined(USE_LPC6432)
1970 #define LPC_CLIENT_ID CLIENT_ID64
1971 #define LPC_SIZE_T ULONGLONG
1972 #define LPC_PVOID ULONGLONG
1973 #define LPC_HANDLE ULONGLONG
1974 #else
1975 #define LPC_CLIENT_ID CLIENT_ID
1976 #define LPC_SIZE_T SIZE_T
1977 #define LPC_PVOID PVOID
1978 #define LPC_HANDLE HANDLE
1979 #endif
1980
1981 typedef struct _PORT_MESSAGE
1982 {
1983     union
1984     {
1985         struct
1986         {
1987             CSHORT DataLength;
1988             CSHORT TotalLength;
1989         } s1;
1990         ULONG Length;
1991     } u1;
1992     union
1993     {
1994         struct
1995         {
1996             CSHORT Type;
1997             CSHORT DataInfoOffset;
1998         } s2;
1999         ULONG ZeroInit;
2000     } u2;
2001     __GNU_EXTENSION union
2002     {
2003         LPC_CLIENT_ID ClientId;
2004         double DoNotUseThisField;
2005     };
2006     ULONG MessageId;
2007     __GNU_EXTENSION union
2008     {
2009         LPC_SIZE_T ClientViewSize;
2010         ULONG CallbackId;
2011     };
2012 } PORT_MESSAGE, *PPORT_MESSAGE;
2013
2014 #define LPC_KERNELMODE_MESSAGE      (CSHORT)((USHORT)0x8000)
2015
2016 typedef struct _PORT_VIEW
2017 {
2018     ULONG Length;
2019     LPC_HANDLE SectionHandle;
2020     ULONG SectionOffset;
2021     LPC_SIZE_T ViewSize;
2022     LPC_PVOID ViewBase;
2023     LPC_PVOID ViewRemoteBase;
2024 } PORT_VIEW, *PPORT_VIEW;
2025
2026 typedef struct _REMOTE_PORT_VIEW
2027 {
2028     ULONG Length;
2029     LPC_SIZE_T ViewSize;
2030     LPC_PVOID ViewBase;
2031 } REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW;
2032
2033 typedef struct _SE_EXPORTS {
2034
2035     LUID    SeCreateTokenPrivilege;
2036     LUID    SeAssignPrimaryTokenPrivilege;
2037     LUID    SeLockMemoryPrivilege;
2038     LUID    SeIncreaseQuotaPrivilege;
2039     LUID    SeUnsolicitedInputPrivilege;
2040     LUID    SeTcbPrivilege;
2041     LUID    SeSecurityPrivilege;
2042     LUID    SeTakeOwnershipPrivilege;
2043     LUID    SeLoadDriverPrivilege;
2044     LUID    SeCreatePagefilePrivilege;
2045     LUID    SeIncreaseBasePriorityPrivilege;
2046     LUID    SeSystemProfilePrivilege;
2047     LUID    SeSystemtimePrivilege;
2048     LUID    SeProfileSingleProcessPrivilege;
2049     LUID    SeCreatePermanentPrivilege;
2050     LUID    SeBackupPrivilege;
2051     LUID    SeRestorePrivilege;
2052     LUID    SeShutdownPrivilege;
2053     LUID    SeDebugPrivilege;
2054     LUID    SeAuditPrivilege;
2055     LUID    SeSystemEnvironmentPrivilege;
2056     LUID    SeChangeNotifyPrivilege;
2057     LUID    SeRemoteShutdownPrivilege;
2058
2059     PSID    SeNullSid;
2060     PSID    SeWorldSid;
2061     PSID    SeLocalSid;
2062     PSID    SeCreatorOwnerSid;
2063     PSID    SeCreatorGroupSid;
2064
2065     PSID    SeNtAuthoritySid;
2066     PSID    SeDialupSid;
2067     PSID    SeNetworkSid;
2068     PSID    SeBatchSid;
2069     PSID    SeInteractiveSid;
2070     PSID    SeLocalSystemSid;
2071     PSID    SeAliasAdminsSid;
2072     PSID    SeAliasUsersSid;
2073     PSID    SeAliasGuestsSid;
2074     PSID    SeAliasPowerUsersSid;
2075     PSID    SeAliasAccountOpsSid;
2076     PSID    SeAliasSystemOpsSid;
2077     PSID    SeAliasPrintOpsSid;
2078     PSID    SeAliasBackupOpsSid;
2079
2080     PSID    SeAuthenticatedUsersSid;
2081
2082     PSID    SeRestrictedSid;
2083     PSID    SeAnonymousLogonSid;
2084
2085     LUID    SeUndockPrivilege;
2086     LUID    SeSyncAgentPrivilege;
2087     LUID    SeEnableDelegationPrivilege;
2088
2089 } SE_EXPORTS, *PSE_EXPORTS;
2090
2091 extern PSE_EXPORTS SeExports;
2092
2093 typedef struct
2094 {
2095   LARGE_INTEGER StartingLcn;
2096 } STARTING_LCN_INPUT_BUFFER, *PSTARTING_LCN_INPUT_BUFFER;
2097
2098 typedef struct _STARTING_VCN_INPUT_BUFFER {
2099     LARGE_INTEGER StartingVcn;
2100 } STARTING_VCN_INPUT_BUFFER, *PSTARTING_VCN_INPUT_BUFFER;
2101
2102 typedef struct _SECURITY_CLIENT_CONTEXT {
2103     SECURITY_QUALITY_OF_SERVICE SecurityQos;
2104     PACCESS_TOKEN               ClientToken;
2105     BOOLEAN                     DirectlyAccessClientToken;
2106     BOOLEAN                     DirectAccessEffectiveOnly;
2107     BOOLEAN                     ServerIsRemote;
2108     TOKEN_CONTROL               ClientTokenControl;
2109 } SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;
2110
2111 //
2112 //  The following are the inherit flags that go into the AceFlags field
2113 //  of an Ace header.
2114 //
2115 #define OBJECT_INHERIT_ACE                (0x1)
2116 #define CONTAINER_INHERIT_ACE             (0x2)
2117 #define NO_PROPAGATE_INHERIT_ACE          (0x4)
2118 #define INHERIT_ONLY_ACE                  (0x8)
2119 #define INHERITED_ACE                     (0x10)
2120 #define VALID_INHERIT_FLAGS               (0x1F)
2121
2122 typedef struct _ACE_HEADER
2123 {
2124     UCHAR AceType;
2125     UCHAR AceFlags;
2126     USHORT AceSize;
2127 } ACE_HEADER, *PACE_HEADER;
2128
2129 typedef struct _ACCESS_ALLOWED_ACE
2130 {
2131     ACE_HEADER Header;
2132     ACCESS_MASK Mask;
2133     ULONG SidStart;
2134 } ACCESS_ALLOWED_ACE, *PACCESS_ALLOWED_ACE;
2135
2136 typedef struct _ACCESS_DENIED_ACE
2137 {
2138     ACE_HEADER Header;
2139     ACCESS_MASK Mask;
2140     ULONG SidStart;
2141 } ACCESS_DENIED_ACE, *PACCESS_DENIED_ACE;
2142
2143 typedef struct _SYSTEM_AUDIT_ACE
2144 {
2145     ACE_HEADER Header;
2146     ACCESS_MASK Mask;
2147     ULONG SidStart;
2148 } SYSTEM_AUDIT_ACE, *PSYSTEM_AUDIT_ACE;
2149
2150 typedef struct _SYSTEM_ALARM_ACE
2151 {
2152     ACE_HEADER Header;
2153     ACCESS_MASK Mask;
2154     ULONG SidStart;
2155 } SYSTEM_ALARM_ACE, *PSYSTEM_ALARM_ACE;
2156
2157 typedef struct _SYSTEM_MANDATORY_LABEL_ACE
2158 {
2159     ACE_HEADER Header;
2160     ACCESS_MASK Mask;
2161     ULONG SidStart;
2162 } SYSTEM_MANDATORY_LABEL_ACE, *PSYSTEM_MANDATORY_LABEL_ACE;
2163
2164 typedef struct _TUNNEL {
2165     FAST_MUTEX          Mutex;
2166     PRTL_SPLAY_LINKS    Cache;
2167     LIST_ENTRY          TimerQueue;
2168     USHORT              NumEntries;
2169 } TUNNEL, *PTUNNEL;
2170
2171 typedef struct _VAD_HEADER {
2172     PVOID       StartVPN;
2173     PVOID       EndVPN;
2174     struct _VAD_HEADER* ParentLink;
2175     struct _VAD_HEADER* LeftLink;
2176     struct _VAD_HEADER* RightLink;
2177     ULONG       Flags;          /* LSB = CommitCharge */
2178     PVOID       ControlArea;
2179     PVOID       FirstProtoPte;
2180     PVOID       LastPTE;
2181     ULONG       Unknown;
2182     LIST_ENTRY  Secured;
2183 } VAD_HEADER, *PVAD_HEADER;
2184
2185 typedef struct
2186 {
2187   LARGE_INTEGER StartingLcn;
2188   LARGE_INTEGER BitmapSize;
2189   UCHAR Buffer[1];
2190 } VOLUME_BITMAP_BUFFER, *PVOLUME_BITMAP_BUFFER;
2191
2192 #if (VER_PRODUCTBUILD >= 2600)
2193
2194 typedef BOOLEAN
2195 (NTAPI *PFILTER_REPORT_CHANGE) (
2196     IN PVOID  NotifyContext,
2197     IN PVOID  FilterContext
2198 );
2199
2200 typedef enum _FS_FILTER_SECTION_SYNC_TYPE {
2201     SyncTypeOther = 0,
2202     SyncTypeCreateSection
2203 } FS_FILTER_SECTION_SYNC_TYPE, *PFS_FILTER_SECTION_SYNC_TYPE;
2204
2205 typedef enum _FS_FILTER_STREAM_FO_NOTIFICATION_TYPE {
2206     NotifyTypeCreate = 0,
2207     NotifyTypeRetired
2208 } FS_FILTER_STREAM_FO_NOTIFICATION_TYPE, *PFS_FILTER_STREAM_FO_NOTIFICATION_TYPE;
2209
2210 typedef union _FS_FILTER_PARAMETERS {
2211     struct {
2212         PLARGE_INTEGER  EndingOffset;
2213         PERESOURCE *ResourceToRelease;
2214     } AcquireForModifiedPageWriter;
2215
2216     struct {
2217         PERESOURCE  ResourceToRelease;
2218     } ReleaseForModifiedPageWriter;
2219
2220     struct {
2221         FS_FILTER_SECTION_SYNC_TYPE  SyncType;
2222         ULONG  PageProtection;
2223     } AcquireForSectionSynchronization;
2224
2225     struct {
2226         FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType;
2227         BOOLEAN POINTER_ALIGNMENT SafeToRecurse;
2228     } NotifyStreamFileObject;
2229
2230     struct {
2231         PVOID  Argument1;
2232         PVOID  Argument2;
2233         PVOID  Argument3;
2234         PVOID  Argument4;
2235         PVOID  Argument5;
2236     } Others;
2237 } FS_FILTER_PARAMETERS, *PFS_FILTER_PARAMETERS;
2238
2239 typedef struct _FS_FILTER_CALLBACK_DATA {
2240     ULONG                  SizeOfFsFilterCallbackData;
2241     UCHAR                  Operation;
2242     UCHAR                  Reserved;
2243     struct _DEVICE_OBJECT  *DeviceObject;
2244     struct _FILE_OBJECT    *FileObject;
2245     FS_FILTER_PARAMETERS   Parameters;
2246 } FS_FILTER_CALLBACK_DATA, *PFS_FILTER_CALLBACK_DATA;
2247
2248 typedef NTSTATUS
2249 (NTAPI *PFS_FILTER_CALLBACK) (
2250     IN PFS_FILTER_CALLBACK_DATA  Data,
2251     OUT PVOID                    *CompletionContext
2252 );
2253
2254 typedef VOID
2255 (NTAPI *PFS_FILTER_COMPLETION_CALLBACK) (
2256     IN PFS_FILTER_CALLBACK_DATA  Data,
2257     IN NTSTATUS                  OperationStatus,
2258     IN PVOID                     CompletionContext
2259 );
2260
2261 typedef struct _FS_FILTER_CALLBACKS {
2262     ULONG                           SizeOfFsFilterCallbacks;
2263     ULONG                           Reserved;
2264     PFS_FILTER_CALLBACK             PreAcquireForSectionSynchronization;
2265     PFS_FILTER_COMPLETION_CALLBACK  PostAcquireForSectionSynchronization;
2266     PFS_FILTER_CALLBACK             PreReleaseForSectionSynchronization;
2267     PFS_FILTER_COMPLETION_CALLBACK  PostReleaseForSectionSynchronization;
2268     PFS_FILTER_CALLBACK             PreAcquireForCcFlush;
2269     PFS_FILTER_COMPLETION_CALLBACK  PostAcquireForCcFlush;
2270     PFS_FILTER_CALLBACK             PreReleaseForCcFlush;
2271     PFS_FILTER_COMPLETION_CALLBACK  PostReleaseForCcFlush;
2272     PFS_FILTER_CALLBACK             PreAcquireForModifiedPageWriter;
2273     PFS_FILTER_COMPLETION_CALLBACK  PostAcquireForModifiedPageWriter;
2274     PFS_FILTER_CALLBACK             PreReleaseForModifiedPageWriter;
2275     PFS_FILTER_COMPLETION_CALLBACK  PostReleaseForModifiedPageWriter;
2276 } FS_FILTER_CALLBACKS, *PFS_FILTER_CALLBACKS;
2277
2278 typedef struct _READ_LIST {
2279     PFILE_OBJECT          FileObject;
2280     ULONG                 NumberOfEntries;
2281     LOGICAL               IsImage;
2282     FILE_SEGMENT_ELEMENT  List[ANYSIZE_ARRAY];
2283 } READ_LIST, *PREAD_LIST;
2284
2285 #endif
2286
2287 typedef NTSTATUS
2288 (NTAPI * PRTL_HEAP_COMMIT_ROUTINE) (
2289     IN PVOID  Base,
2290     IN OUT PVOID  *CommitAddress,
2291     IN OUT PSIZE_T  CommitSize
2292 );
2293
2294 typedef struct _RTL_HEAP_PARAMETERS {
2295     ULONG                     Length;
2296     SIZE_T                    SegmentReserve;
2297     SIZE_T                    SegmentCommit;
2298     SIZE_T                    DeCommitFreeBlockThreshold;
2299     SIZE_T                    DeCommitTotalFreeThreshold;
2300     SIZE_T                    MaximumAllocationSize;
2301     SIZE_T                    VirtualMemoryThreshold;
2302     SIZE_T                    InitialCommit;
2303     SIZE_T                    InitialReserve;
2304     PRTL_HEAP_COMMIT_ROUTINE  CommitRoutine;
2305     SIZE_T                    Reserved[2];
2306 } RTL_HEAP_PARAMETERS, *PRTL_HEAP_PARAMETERS;
2307
2308 NTKERNELAPI
2309 BOOLEAN
2310 NTAPI
2311 CcCanIWrite (
2312     IN PFILE_OBJECT FileObject,
2313     IN ULONG        BytesToWrite,
2314     IN BOOLEAN      Wait,
2315     IN BOOLEAN      Retrying
2316 );
2317
2318 NTKERNELAPI
2319 BOOLEAN
2320 NTAPI
2321 CcCopyRead (
2322     IN PFILE_OBJECT         FileObject,
2323     IN PLARGE_INTEGER       FileOffset,
2324     IN ULONG                Length,
2325     IN BOOLEAN              Wait,
2326     OUT PVOID               Buffer,
2327     OUT PIO_STATUS_BLOCK    IoStatus
2328 );
2329
2330 NTKERNELAPI
2331 BOOLEAN
2332 NTAPI
2333 CcCopyWrite (
2334     IN PFILE_OBJECT     FileObject,
2335     IN PLARGE_INTEGER   FileOffset,
2336     IN ULONG            Length,
2337     IN BOOLEAN          Wait,
2338     IN PVOID            Buffer
2339 );
2340
2341 #define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
2342
2343 typedef VOID (NTAPI *PCC_POST_DEFERRED_WRITE) (
2344     IN PVOID Context1,
2345     IN PVOID Context2
2346 );
2347
2348 NTKERNELAPI
2349 VOID
2350 NTAPI
2351 CcDeferWrite (
2352     IN PFILE_OBJECT             FileObject,
2353     IN PCC_POST_DEFERRED_WRITE  PostRoutine,
2354     IN PVOID                    Context1,
2355     IN PVOID                    Context2,
2356     IN ULONG                    BytesToWrite,
2357     IN BOOLEAN                  Retrying
2358 );
2359
2360 NTKERNELAPI
2361 VOID
2362 NTAPI
2363 CcFastCopyRead (
2364     IN PFILE_OBJECT         FileObject,
2365     IN ULONG                FileOffset,
2366     IN ULONG                Length,
2367     IN ULONG                PageCount,
2368     OUT PVOID               Buffer,
2369     OUT PIO_STATUS_BLOCK    IoStatus
2370 );
2371
2372 NTKERNELAPI
2373 VOID
2374 NTAPI
2375 CcFastCopyWrite (
2376     IN PFILE_OBJECT FileObject,
2377     IN ULONG        FileOffset,
2378     IN ULONG        Length,
2379     IN PVOID        Buffer
2380 );
2381
2382 NTKERNELAPI
2383 VOID
2384 NTAPI
2385 CcFlushCache (
2386     IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
2387     IN PLARGE_INTEGER           FileOffset OPTIONAL,
2388     IN ULONG                    Length,
2389     OUT PIO_STATUS_BLOCK        IoStatus OPTIONAL
2390 );
2391
2392 typedef VOID (NTAPI *PDIRTY_PAGE_ROUTINE) (
2393     IN PFILE_OBJECT     FileObject,
2394     IN PLARGE_INTEGER   FileOffset,
2395     IN ULONG            Length,
2396     IN PLARGE_INTEGER   OldestLsn,
2397     IN PLARGE_INTEGER   NewestLsn,
2398     IN PVOID            Context1,
2399     IN PVOID            Context2
2400 );
2401
2402 NTKERNELAPI
2403 LARGE_INTEGER
2404 NTAPI
2405 CcGetDirtyPages (
2406     IN PVOID                LogHandle,
2407     IN PDIRTY_PAGE_ROUTINE  DirtyPageRoutine,
2408     IN PVOID                Context1,
2409     IN PVOID                Context2
2410 );
2411
2412 NTKERNELAPI
2413 PFILE_OBJECT
2414 NTAPI
2415 CcGetFileObjectFromBcb (
2416     IN PVOID Bcb
2417 );
2418
2419 NTKERNELAPI
2420 PFILE_OBJECT
2421 NTAPI
2422 CcGetFileObjectFromSectionPtrs (
2423     IN PSECTION_OBJECT_POINTERS SectionObjectPointer
2424 );
2425
2426 #define CcGetFileSizePointer(FO) (                                     \
2427     ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
2428 )
2429
2430 #if (VER_PRODUCTBUILD >= 2195)
2431
2432 NTKERNELAPI
2433 LARGE_INTEGER
2434 NTAPI
2435 CcGetFlushedValidData (
2436     IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
2437     IN BOOLEAN                  BcbListHeld
2438 );
2439
2440 #endif /* (VER_PRODUCTBUILD >= 2195) */
2441
2442 NTKERNELAPI
2443 LARGE_INTEGER
2444 NTAPI
2445 CcGetLsnForFileObject (
2446     IN PFILE_OBJECT     FileObject,
2447     OUT PLARGE_INTEGER  OldestLsn OPTIONAL
2448 );
2449
2450 typedef BOOLEAN (NTAPI *PACQUIRE_FOR_LAZY_WRITE) (
2451     IN PVOID    Context,
2452     IN BOOLEAN  Wait
2453 );
2454
2455 typedef VOID (NTAPI *PRELEASE_FROM_LAZY_WRITE) (
2456     IN PVOID Context
2457 );
2458
2459 typedef BOOLEAN (NTAPI *PACQUIRE_FOR_READ_AHEAD) (
2460     IN PVOID    Context,
2461     IN BOOLEAN  Wait
2462 );
2463
2464 typedef VOID (NTAPI *PRELEASE_FROM_READ_AHEAD) (
2465     IN PVOID Context
2466 );
2467
2468 typedef struct _CACHE_MANAGER_CALLBACKS {
2469     PACQUIRE_FOR_LAZY_WRITE     AcquireForLazyWrite;
2470     PRELEASE_FROM_LAZY_WRITE    ReleaseFromLazyWrite;
2471     PACQUIRE_FOR_READ_AHEAD     AcquireForReadAhead;
2472     PRELEASE_FROM_READ_AHEAD    ReleaseFromReadAhead;
2473 } CACHE_MANAGER_CALLBACKS, *PCACHE_MANAGER_CALLBACKS;
2474
2475 NTKERNELAPI
2476 VOID
2477 NTAPI
2478 CcInitializeCacheMap (
2479     IN PFILE_OBJECT             FileObject,
2480     IN PCC_FILE_SIZES           FileSizes,
2481     IN BOOLEAN                  PinAccess,
2482     IN PCACHE_MANAGER_CALLBACKS Callbacks,
2483     IN PVOID                    LazyWriteContext
2484 );
2485
2486 #define CcIsFileCached(FO) (                                                         \
2487     ((FO)->SectionObjectPointer != NULL) &&                                          \
2488     (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
2489 )
2490
2491 extern ULONG CcFastMdlReadWait;
2492
2493 NTKERNELAPI
2494 BOOLEAN
2495 NTAPI
2496 CcIsThereDirtyData (
2497     IN PVPB Vpb
2498 );
2499
2500 NTKERNELAPI
2501 BOOLEAN
2502 NTAPI
2503 CcMapData (
2504     IN PFILE_OBJECT     FileObject,
2505     IN PLARGE_INTEGER   FileOffset,
2506     IN ULONG            Length,
2507     IN ULONG            Flags,
2508     OUT PVOID           *Bcb,
2509     OUT PVOID           *Buffer
2510 );
2511
2512 NTKERNELAPI
2513 VOID
2514 NTAPI
2515 CcMdlRead (
2516     IN PFILE_OBJECT         FileObject,
2517     IN PLARGE_INTEGER       FileOffset,
2518     IN ULONG                Length,
2519     OUT PMDL                *MdlChain,
2520     OUT PIO_STATUS_BLOCK    IoStatus
2521 );
2522
2523 NTKERNELAPI
2524 VOID
2525 NTAPI
2526 CcMdlReadComplete (
2527     IN PFILE_OBJECT FileObject,
2528     IN PMDL         MdlChain
2529 );
2530
2531 NTKERNELAPI
2532 VOID
2533 NTAPI
2534 CcMdlWriteComplete (
2535     IN PFILE_OBJECT     FileObject,
2536     IN PLARGE_INTEGER   FileOffset,
2537     IN PMDL             MdlChain
2538 );
2539
2540 #define MAP_WAIT        1
2541
2542 NTKERNELAPI
2543 BOOLEAN
2544 NTAPI
2545 CcPinMappedData (
2546     IN PFILE_OBJECT     FileObject,
2547     IN PLARGE_INTEGER   FileOffset,
2548     IN ULONG            Length,
2549     IN ULONG            Flags,
2550     IN OUT PVOID        *Bcb
2551 );
2552
2553 NTKERNELAPI
2554 BOOLEAN
2555 NTAPI
2556 CcPinRead (
2557     IN PFILE_OBJECT     FileObject,
2558     IN PLARGE_INTEGER   FileOffset,
2559     IN ULONG            Length,
2560     IN ULONG            Flags,
2561     OUT PVOID           *Bcb,
2562     OUT PVOID           *Buffer
2563 );
2564
2565 NTKERNELAPI
2566 VOID
2567 NTAPI
2568 CcPrepareMdlWrite (
2569     IN PFILE_OBJECT         FileObject,
2570     IN PLARGE_INTEGER       FileOffset,
2571     IN ULONG                Length,
2572     OUT PMDL                *MdlChain,
2573     OUT PIO_STATUS_BLOCK    IoStatus
2574 );
2575
2576 NTKERNELAPI
2577 BOOLEAN
2578 NTAPI
2579 CcPreparePinWrite (
2580     IN PFILE_OBJECT     FileObject,
2581     IN PLARGE_INTEGER   FileOffset,
2582     IN ULONG            Length,
2583     IN BOOLEAN          Zero,
2584     IN ULONG            Flags,
2585     OUT PVOID           *Bcb,
2586     OUT PVOID           *Buffer
2587 );
2588
2589 NTKERNELAPI
2590 BOOLEAN
2591 NTAPI
2592 CcPurgeCacheSection (
2593     IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
2594     IN PLARGE_INTEGER           FileOffset OPTIONAL,
2595     IN ULONG                    Length,
2596     IN BOOLEAN                  UninitializeCacheMaps
2597 );
2598
2599 #define CcReadAhead(FO, FOFF, LEN) (                \
2600     if ((LEN) >= 256) {                             \
2601         CcScheduleReadAhead((FO), (FOFF), (LEN));   \
2602     }                                               \
2603 )
2604
2605 #if (VER_PRODUCTBUILD >= 2195)
2606
2607 NTKERNELAPI
2608 PVOID
2609 NTAPI
2610 CcRemapBcb (
2611     IN PVOID Bcb
2612 );
2613
2614 #endif /* (VER_PRODUCTBUILD >= 2195) */
2615
2616 NTKERNELAPI
2617 VOID
2618 NTAPI
2619 CcRepinBcb (
2620     IN PVOID Bcb
2621 );
2622
2623 NTKERNELAPI
2624 VOID
2625 NTAPI
2626 CcScheduleReadAhead (
2627     IN PFILE_OBJECT     FileObject,
2628     IN PLARGE_INTEGER   FileOffset,
2629     IN ULONG            Length
2630 );
2631
2632 NTKERNELAPI
2633 VOID
2634 NTAPI
2635 CcSetAdditionalCacheAttributes (
2636     IN PFILE_OBJECT FileObject,
2637     IN BOOLEAN      DisableReadAhead,
2638     IN BOOLEAN      DisableWriteBehind
2639 );
2640
2641 NTKERNELAPI
2642 VOID
2643 NTAPI
2644 CcSetBcbOwnerPointer (
2645     IN PVOID Bcb,
2646     IN PVOID OwnerPointer
2647 );
2648
2649 NTKERNELAPI
2650 VOID
2651 NTAPI
2652 CcSetDirtyPageThreshold (
2653     IN PFILE_OBJECT FileObject,
2654     IN ULONG        DirtyPageThreshold
2655 );
2656
2657 NTKERNELAPI
2658 VOID
2659 NTAPI
2660 CcSetDirtyPinnedData (
2661     IN PVOID            BcbVoid,
2662     IN PLARGE_INTEGER   Lsn OPTIONAL
2663 );
2664
2665 NTKERNELAPI
2666 VOID
2667 NTAPI
2668 CcSetFileSizes (
2669     IN PFILE_OBJECT     FileObject,
2670     IN PCC_FILE_SIZES   FileSizes
2671 );
2672
2673 typedef VOID (NTAPI *PFLUSH_TO_LSN) (
2674     IN PVOID            LogHandle,
2675     IN LARGE_INTEGER    Lsn
2676 );
2677
2678 NTKERNELAPI
2679 VOID
2680 NTAPI
2681 CcSetLogHandleForFile (
2682     IN PFILE_OBJECT     FileObject,
2683     IN PVOID            LogHandle,
2684     IN PFLUSH_TO_LSN    FlushToLsnRoutine
2685 );
2686
2687 NTKERNELAPI
2688 VOID
2689 NTAPI
2690 CcSetReadAheadGranularity (
2691     IN PFILE_OBJECT FileObject,
2692     IN ULONG        Granularity     /* default: PAGE_SIZE */
2693                                     /* allowed: 2^n * PAGE_SIZE */
2694 );
2695
2696 NTKERNELAPI
2697 BOOLEAN
2698 NTAPI
2699 CcUninitializeCacheMap (
2700     IN PFILE_OBJECT                 FileObject,
2701     IN PLARGE_INTEGER               TruncateSize OPTIONAL,
2702     IN PCACHE_UNINITIALIZE_EVENT    UninitializeCompleteEvent OPTIONAL
2703 );
2704
2705 NTKERNELAPI
2706 VOID
2707 NTAPI
2708 CcUnpinData (
2709     IN PVOID Bcb
2710 );
2711
2712 NTKERNELAPI
2713 VOID
2714 NTAPI
2715 CcUnpinDataForThread (
2716     IN PVOID            Bcb,
2717     IN ERESOURCE_THREAD ResourceThreadId
2718 );
2719
2720 NTKERNELAPI
2721 VOID
2722 NTAPI
2723 CcUnpinRepinnedBcb (
2724     IN PVOID                Bcb,
2725     IN BOOLEAN              WriteThrough,
2726     OUT PIO_STATUS_BLOCK    IoStatus
2727 );
2728
2729 #if (VER_PRODUCTBUILD >= 2195)
2730
2731 NTKERNELAPI
2732 NTSTATUS
2733 NTAPI
2734 CcWaitForCurrentLazyWriterActivity (
2735     VOID
2736 );
2737
2738 #endif /* (VER_PRODUCTBUILD >= 2195) */
2739
2740 NTKERNELAPI
2741 BOOLEAN
2742 NTAPI
2743 CcZeroData (
2744     IN PFILE_OBJECT     FileObject,
2745     IN PLARGE_INTEGER   StartOffset,
2746     IN PLARGE_INTEGER   EndOffset,
2747     IN BOOLEAN          Wait
2748 );
2749
2750 NTKERNELAPI
2751 VOID
2752 NTAPI
2753 ExDisableResourceBoostLite (
2754     IN PERESOURCE  Resource
2755 );
2756
2757 NTKERNELAPI
2758 SIZE_T
2759 NTAPI
2760 ExQueryPoolBlockSize (
2761     IN PVOID      PoolBlock,
2762     OUT PBOOLEAN  QuotaCharged
2763 );
2764
2765 #if (VER_PRODUCTBUILD >= 2600)
2766
2767 #ifndef __NTOSKRNL__
2768 NTKERNELAPI
2769 VOID
2770 FASTCALL
2771 ExInitializeRundownProtection (
2772     IN PEX_RUNDOWN_REF  RunRef
2773 );
2774
2775 NTKERNELAPI
2776 VOID
2777 FASTCALL
2778 ExReInitializeRundownProtection (
2779     IN PEX_RUNDOWN_REF  RunRef
2780 );
2781
2782 NTKERNELAPI
2783 BOOLEAN
2784 FASTCALL
2785 ExAcquireRundownProtection (
2786     IN PEX_RUNDOWN_REF  RunRef
2787 );
2788
2789 NTKERNELAPI
2790 BOOLEAN
2791 FASTCALL
2792 ExAcquireRundownProtectionEx (
2793     IN PEX_RUNDOWN_REF  RunRef,
2794     IN ULONG            Count
2795 );
2796
2797 NTKERNELAPI
2798 VOID
2799 FASTCALL
2800 ExReleaseRundownProtection (
2801     IN PEX_RUNDOWN_REF  RunRef
2802 );
2803
2804 NTKERNELAPI
2805 VOID
2806 FASTCALL
2807 ExReleaseRundownProtectionEx (
2808     IN PEX_RUNDOWN_REF  RunRef,
2809     IN ULONG            Count
2810 );
2811
2812 NTKERNELAPI
2813 VOID
2814 FASTCALL
2815 ExRundownCompleted (
2816     IN PEX_RUNDOWN_REF  RunRef
2817 );
2818
2819 NTKERNELAPI
2820 VOID
2821 FASTCALL
2822 ExWaitForRundownProtectionRelease (
2823     IN PEX_RUNDOWN_REF  RunRef
2824 );
2825
2826 #endif
2827 #endif /* (VER_PRODUCTBUILD >= 2600) */
2828
2829
2830 #define FsRtlSetupAdvancedHeader( _advhdr, _fmutx )                         \
2831 {                                                                           \
2832     SetFlag( (_advhdr)->Flags, FSRTL_FLAG_ADVANCED_HEADER );                \
2833     SetFlag( (_advhdr)->Flags2, FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS );     \
2834     (_advhdr)->Version = FSRTL_FCB_HEADER_V1;                               \
2835     InitializeListHead( &(_advhdr)->FilterContexts );                       \
2836     if ((_fmutx) != NULL) {                                                 \
2837         (_advhdr)->FastMutex = (_fmutx);                                    \
2838     }                                                                       \
2839     *((PULONG_PTR)(&(_advhdr)->PushLock)) = 0;                              \
2840     /*ExInitializePushLock( &(_advhdr)->PushLock ); API Not avaliable downlevel*/\
2841     (_advhdr)->FileContextSupportPointer = NULL;                            \
2842 }
2843
2844 NTKERNELAPI
2845 BOOLEAN
2846 NTAPI
2847 FsRtlAddBaseMcbEntry (
2848     IN PBASE_MCB  Mcb,
2849     IN LONGLONG   Vbn,
2850     IN LONGLONG   Lbn,
2851     IN LONGLONG   SectorCount
2852 );
2853
2854 NTKERNELAPI
2855 BOOLEAN
2856 NTAPI
2857 FsRtlAddLargeMcbEntry (
2858     IN PLARGE_MCB  Mcb,
2859     IN LONGLONG    Vbn,
2860     IN LONGLONG    Lbn,
2861     IN LONGLONG    SectorCount
2862 );
2863
2864 NTKERNELAPI
2865 BOOLEAN
2866 NTAPI
2867 FsRtlAddMcbEntry (
2868     IN PMCB   Mcb,
2869     IN VBN    Vbn,
2870     IN LBN    Lbn,
2871     IN ULONG  SectorCount
2872 );
2873
2874 NTKERNELAPI
2875 VOID
2876 NTAPI
2877 FsRtlAddToTunnelCache (
2878     IN PTUNNEL          Cache,
2879     IN ULONGLONG        DirectoryKey,
2880     IN PUNICODE_STRING  ShortName,
2881     IN PUNICODE_STRING  LongName,
2882     IN BOOLEAN          KeyByShortName,
2883     IN ULONG            DataLength,
2884     IN PVOID            Data
2885 );
2886
2887 #if (VER_PRODUCTBUILD >= 2195)
2888
2889 PFILE_LOCK
2890 NTAPI
2891 FsRtlAllocateFileLock (
2892     IN PCOMPLETE_LOCK_IRP_ROUTINE   CompleteLockIrpRoutine OPTIONAL,
2893     IN PUNLOCK_ROUTINE              UnlockRoutine OPTIONAL
2894 );
2895
2896 #endif /* (VER_PRODUCTBUILD >= 2195) */
2897
2898 NTKERNELAPI
2899 PVOID
2900 NTAPI
2901 FsRtlAllocatePool (
2902     IN POOL_TYPE    PoolType,
2903     IN ULONG        NumberOfBytes
2904 );
2905
2906 NTKERNELAPI
2907 PVOID
2908 NTAPI
2909 FsRtlAllocatePoolWithQuota (
2910     IN POOL_TYPE    PoolType,
2911     IN ULONG        NumberOfBytes
2912 );
2913
2914 NTKERNELAPI
2915 PVOID
2916 NTAPI
2917 FsRtlAllocatePoolWithQuotaTag (
2918     IN POOL_TYPE    PoolType,
2919     IN ULONG        NumberOfBytes,
2920     IN ULONG        Tag
2921 );
2922
2923 NTKERNELAPI
2924 PVOID
2925 NTAPI
2926 FsRtlAllocatePoolWithTag (
2927     IN POOL_TYPE    PoolType,
2928     IN ULONG        NumberOfBytes,
2929     IN ULONG        Tag
2930 );
2931
2932 NTKERNELAPI
2933 BOOLEAN
2934 NTAPI
2935 FsRtlAreNamesEqual (
2936     IN PCUNICODE_STRING  Name1,
2937     IN PCUNICODE_STRING  Name2,
2938     IN BOOLEAN           IgnoreCase,
2939     IN PCWCH             UpcaseTable OPTIONAL
2940 );
2941
2942 #define FsRtlAreThereCurrentFileLocks(FL) ( \
2943     ((FL)->FastIoIsQuestionable)            \
2944 )
2945
2946 /*
2947   FsRtlCheckLockForReadAccess:
2948
2949   All this really does is pick out the lock parameters from the irp (io stack
2950   location?), get IoGetRequestorProcess, and pass values on to
2951   FsRtlFastCheckLockForRead.
2952 */
2953 NTKERNELAPI
2954 BOOLEAN
2955 NTAPI
2956 FsRtlCheckLockForReadAccess (
2957     IN PFILE_LOCK   FileLock,
2958     IN PIRP         Irp
2959 );
2960
2961 /*
2962   FsRtlCheckLockForWriteAccess:
2963
2964   All this really does is pick out the lock parameters from the irp (io stack
2965   location?), get IoGetRequestorProcess, and pass values on to
2966   FsRtlFastCheckLockForWrite.
2967 */
2968 NTKERNELAPI
2969 BOOLEAN
2970 NTAPI
2971 FsRtlCheckLockForWriteAccess (
2972     IN PFILE_LOCK   FileLock,
2973     IN PIRP         Irp
2974 );
2975
2976 typedef
2977 VOID
2978 (NTAPI*POPLOCK_WAIT_COMPLETE_ROUTINE) (
2979     IN PVOID    Context,
2980     IN PIRP     Irp
2981 );
2982
2983 typedef
2984 VOID
2985 (NTAPI*POPLOCK_FS_PREPOST_IRP) (
2986     IN PVOID    Context,
2987     IN PIRP     Irp
2988 );
2989
2990 NTKERNELAPI
2991 NTSTATUS
2992 NTAPI
2993 FsRtlCheckOplock (
2994     IN POPLOCK                          Oplock,
2995     IN PIRP                             Irp,
2996     IN PVOID                            Context,
2997     IN POPLOCK_WAIT_COMPLETE_ROUTINE    CompletionRoutine OPTIONAL,
2998     IN POPLOCK_FS_PREPOST_IRP           PostIrpRoutine OPTIONAL
2999 );
3000
3001 NTKERNELAPI
3002 BOOLEAN
3003 NTAPI
3004 FsRtlCopyRead (
3005     IN PFILE_OBJECT         FileObject,
3006     IN PLARGE_INTEGER       FileOffset,
3007     IN ULONG                Length,
3008     IN BOOLEAN              Wait,
3009     IN ULONG                LockKey,
3010     OUT PVOID               Buffer,
3011     OUT PIO_STATUS_BLOCK    IoStatus,
3012     IN PDEVICE_OBJECT       DeviceObject
3013 );
3014
3015 NTKERNELAPI
3016 BOOLEAN
3017 NTAPI
3018 FsRtlCopyWrite (
3019     IN PFILE_OBJECT         FileObject,
3020     IN PLARGE_INTEGER       FileOffset,
3021     IN ULONG                Length,
3022     IN BOOLEAN              Wait,
3023     IN ULONG                LockKey,
3024     IN PVOID                Buffer,
3025     OUT PIO_STATUS_BLOCK    IoStatus,
3026     IN PDEVICE_OBJECT       DeviceObject
3027 );
3028
3029 #define HEAP_NO_SERIALIZE               0x00000001
3030 #define HEAP_GROWABLE                   0x00000002
3031 #define HEAP_GENERATE_EXCEPTIONS        0x00000004
3032 #define HEAP_ZERO_MEMORY                0x00000008
3033 #define HEAP_REALLOC_IN_PLACE_ONLY      0x00000010
3034 #define HEAP_TAIL_CHECKING_ENABLED      0x00000020
3035 #define HEAP_FREE_CHECKING_ENABLED      0x00000040
3036 #define HEAP_DISABLE_COALESCE_ON_FREE   0x00000080
3037
3038 #define HEAP_CREATE_ALIGN_16            0x00010000
3039 #define HEAP_CREATE_ENABLE_TRACING      0x00020000
3040 #define HEAP_CREATE_ENABLE_EXECUTE      0x00040000
3041
3042 NTSYSAPI
3043 PVOID
3044 NTAPI
3045 RtlCreateHeap (
3046     IN ULONG                Flags,
3047     IN PVOID                HeapBase OPTIONAL,
3048     IN SIZE_T               ReserveSize OPTIONAL,
3049     IN SIZE_T               CommitSize OPTIONAL,
3050     IN PVOID                Lock OPTIONAL,
3051     IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL
3052 );
3053
3054 NTKERNELAPI
3055 BOOLEAN
3056 NTAPI
3057 FsRtlCurrentBatchOplock (
3058     IN POPLOCK Oplock
3059 );
3060
3061 NTKERNELAPI
3062 VOID
3063 NTAPI
3064 FsRtlDeleteKeyFromTunnelCache (
3065     IN PTUNNEL      Cache,
3066     IN ULONGLONG    DirectoryKey
3067 );
3068
3069 NTKERNELAPI
3070 VOID
3071 NTAPI
3072 FsRtlDeleteTunnelCache (
3073     IN PTUNNEL Cache
3074 );
3075
3076 NTKERNELAPI
3077 VOID
3078 NTAPI
3079 FsRtlDeregisterUncProvider (
3080     IN HANDLE Handle
3081 );
3082
3083 NTSYSAPI
3084 PVOID
3085 NTAPI
3086 RtlDestroyHeap(
3087     IN PVOID HeapHandle
3088 );
3089
3090 NTKERNELAPI
3091 VOID
3092 NTAPI
3093 FsRtlDissectDbcs (
3094     IN ANSI_STRING    Name,
3095     OUT PANSI_STRING  FirstPart,
3096     OUT PANSI_STRING  RemainingPart
3097 );
3098
3099 NTKERNELAPI
3100 VOID
3101 NTAPI
3102 FsRtlDissectName (
3103     IN UNICODE_STRING    Name,
3104     OUT PUNICODE_STRING  FirstPart,
3105     OUT PUNICODE_STRING  RemainingPart
3106 );
3107
3108 NTKERNELAPI
3109 BOOLEAN
3110 NTAPI
3111 FsRtlDoesDbcsContainWildCards (
3112     IN PANSI_STRING Name
3113 );
3114
3115 NTKERNELAPI
3116 BOOLEAN
3117 NTAPI
3118 FsRtlDoesNameContainWildCards (
3119     IN PUNICODE_STRING Name
3120 );
3121
3122 NTKERNELAPI
3123 BOOLEAN
3124 NTAPI
3125 FsRtlIsFatDbcsLegal (
3126     IN ANSI_STRING DbcsName,
3127     IN BOOLEAN WildCardsPermissible,
3128     IN BOOLEAN PathNamePermissible,
3129     IN BOOLEAN LeadingBackslashPermissible
3130     );
3131
3132
3133 #define FsRtlCompleteRequest(IRP,STATUS) {         \
3134     (IRP)->IoStatus.Status = (STATUS);             \
3135     IoCompleteRequest( (IRP), IO_DISK_INCREMENT ); \
3136 }
3137
3138 #define FsRtlEnterFileSystem    KeEnterCriticalRegion
3139
3140 #define FsRtlExitFileSystem     KeLeaveCriticalRegion
3141
3142 NTKERNELAPI
3143 BOOLEAN
3144 NTAPI
3145 FsRtlFastCheckLockForRead (
3146     IN PFILE_LOCK           FileLock,
3147     IN PLARGE_INTEGER       FileOffset,
3148     IN PLARGE_INTEGER       Length,
3149     IN ULONG                Key,
3150     IN PFILE_OBJECT         FileObject,
3151     IN PVOID                Process
3152 );
3153
3154 NTKERNELAPI
3155 BOOLEAN
3156 NTAPI
3157 FsRtlFastCheckLockForWrite (
3158     IN PFILE_LOCK           FileLock,
3159     IN PLARGE_INTEGER       FileOffset,
3160     IN PLARGE_INTEGER       Length,
3161     IN ULONG                Key,
3162     IN PFILE_OBJECT         FileObject,
3163     IN PVOID                Process
3164 );
3165
3166 #define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) (       \
3167      FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11)   \
3168 )
3169
3170 NTKERNELAPI
3171 NTSTATUS
3172 NTAPI
3173 FsRtlFastUnlockAll (
3174     IN PFILE_LOCK           FileLock,
3175     IN PFILE_OBJECT         FileObject,
3176     IN PEPROCESS            Process,
3177     IN PVOID                Context OPTIONAL
3178 );
3179 /* ret: STATUS_RANGE_NOT_LOCKED */
3180
3181 NTKERNELAPI
3182 NTSTATUS
3183 NTAPI
3184 FsRtlFastUnlockAllByKey (
3185     IN PFILE_LOCK           FileLock,
3186     IN PFILE_OBJECT         FileObject,
3187     IN PEPROCESS            Process,
3188     IN ULONG                Key,
3189     IN PVOID                Context OPTIONAL
3190 );
3191 /* ret: STATUS_RANGE_NOT_LOCKED */
3192
3193 NTKERNELAPI
3194 NTSTATUS
3195 NTAPI
3196 FsRtlFastUnlockSingle (
3197     IN PFILE_LOCK           FileLock,
3198     IN PFILE_OBJECT         FileObject,
3199     IN PLARGE_INTEGER       FileOffset,
3200     IN PLARGE_INTEGER       Length,
3201     IN PEPROCESS            Process,
3202     IN ULONG                Key,
3203     IN PVOID                Context OPTIONAL,
3204     IN BOOLEAN              AlreadySynchronized
3205 );
3206 /* ret:  STATUS_RANGE_NOT_LOCKED */
3207
3208 NTKERNELAPI
3209 BOOLEAN
3210 NTAPI
3211 FsRtlFindInTunnelCache (
3212     IN PTUNNEL          Cache,
3213     IN ULONGLONG        DirectoryKey,
3214     IN PUNICODE_STRING  Name,
3215     OUT PUNICODE_STRING ShortName,
3216     OUT PUNICODE_STRING LongName,
3217     IN OUT PULONG       DataLength,
3218     OUT PVOID           Data
3219 );
3220
3221 #if (VER_PRODUCTBUILD >= 2195)
3222
3223 NTKERNELAPI
3224 VOID
3225 NTAPI
3226 FsRtlFreeFileLock (
3227     IN PFILE_LOCK FileLock
3228 );
3229
3230 #endif /* (VER_PRODUCTBUILD >= 2195) */
3231
3232 NTKERNELAPI
3233 NTSTATUS
3234 NTAPI
3235 FsRtlGetFileSize (
3236     IN PFILE_OBJECT         FileObject,
3237     IN OUT PLARGE_INTEGER   FileSize
3238 );
3239
3240 NTKERNELAPI
3241 BOOLEAN
3242 NTAPI
3243 FsRtlGetNextBaseMcbEntry (
3244     IN PBASE_MCB   Mcb,
3245     IN ULONG       RunIndex,
3246     OUT PLONGLONG  Vbn,
3247     OUT PLONGLONG  Lbn,
3248     OUT PLONGLONG  SectorCount
3249 );
3250
3251 /*
3252   FsRtlGetNextFileLock:
3253
3254   ret: NULL if no more locks
3255
3256   Internals:
3257     FsRtlGetNextFileLock uses FileLock->LastReturnedLockInfo and
3258     FileLock->LastReturnedLock as storage.
3259     LastReturnedLock is a pointer to the 'raw' lock inkl. double linked
3260     list, and FsRtlGetNextFileLock needs this to get next lock on subsequent
3261     calls with Restart = FALSE.
3262 */
3263 NTKERNELAPI
3264 PFILE_LOCK_INFO
3265 NTAPI
3266 FsRtlGetNextFileLock (
3267     IN PFILE_LOCK   FileLock,
3268     IN BOOLEAN      Restart
3269 );
3270
3271 NTKERNELAPI
3272 BOOLEAN
3273 NTAPI
3274 FsRtlGetNextLargeMcbEntry (
3275     IN PLARGE_MCB  Mcb,
3276     IN ULONG       RunIndex,
3277     OUT PLONGLONG  Vbn,
3278     OUT PLONGLONG  Lbn,
3279     OUT PLONGLONG  SectorCount
3280 );
3281
3282 NTKERNELAPI
3283 BOOLEAN
3284 NTAPI
3285 FsRtlGetNextMcbEntry (
3286     IN PMCB     Mcb,
3287     IN ULONG    RunIndex,
3288     OUT PVBN    Vbn,
3289     OUT PLBN    Lbn,
3290     OUT PULONG  SectorCount
3291 );
3292
3293 #define FsRtlGetPerStreamContextPointer(FO) (   \
3294     (PFSRTL_ADVANCED_FCB_HEADER)(FO)->FsContext \
3295 )
3296
3297 NTKERNELAPI
3298 VOID
3299 NTAPI
3300 FsRtlInitializeBaseMcb (
3301     IN PBASE_MCB  Mcb,
3302     IN POOL_TYPE  PoolType
3303 );
3304
3305 NTKERNELAPI
3306 VOID
3307 NTAPI
3308 FsRtlInitializeFileLock (
3309     IN PFILE_LOCK                   FileLock,
3310     IN PCOMPLETE_LOCK_IRP_ROUTINE   CompleteLockIrpRoutine OPTIONAL,
3311     IN PUNLOCK_ROUTINE              UnlockRoutine OPTIONAL
3312 );
3313
3314 NTKERNELAPI
3315 VOID
3316 NTAPI
3317 FsRtlInitializeLargeMcb (
3318     IN PLARGE_MCB  Mcb,
3319     IN POOL_TYPE   PoolType
3320 );
3321
3322 NTKERNELAPI
3323 VOID
3324 NTAPI
3325 FsRtlInitializeMcb (
3326     IN PMCB       Mcb,
3327     IN POOL_TYPE  PoolType
3328 );
3329
3330 NTKERNELAPI
3331 VOID
3332 NTAPI
3333 FsRtlInitializeOplock (
3334     IN OUT POPLOCK Oplock
3335 );
3336
3337 NTKERNELAPI
3338 VOID
3339 NTAPI
3340 FsRtlInitializeTunnelCache (
3341     IN PTUNNEL Cache
3342 );
3343
3344 #define FsRtlInitPerStreamContext(PSC, O, I, FC) ( \
3345     (PSC)->OwnerId = (O),                          \
3346     (PSC)->InstanceId = (I),                       \
3347     (PSC)->FreeCallback = (FC)                     \
3348 )
3349
3350 NTKERNELAPI
3351 NTSTATUS
3352 NTAPI
3353 FsRtlInsertPerStreamContext (
3354     IN PFSRTL_ADVANCED_FCB_HEADER  PerStreamContext,
3355     IN PFSRTL_PER_STREAM_CONTEXT   Ptr
3356 );
3357
3358 #define FsRtlIsAnsiCharacterLegalFat(C, WILD) (                                \
3359     FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_FAT_LEGAL) |       \
3360                                         ((WILD) ? FSRTL_WILD_CHARACTER : 0 ))  \
3361 )
3362
3363 #define FsRtlIsAnsiCharacterLegalHpfs(C, WILD) (                               \
3364     FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_HPFS_LEGAL) |      \
3365                                         ((WILD) ? FSRTL_WILD_CHARACTER : 0 ))  \
3366 )
3367
3368 #define FsRtlIsAnsiCharacterLegalNtfs(C, WILD) (                               \
3369     FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_NTFS_LEGAL) |      \
3370                                         ((WILD) ? FSRTL_WILD_CHARACTER : 0 ))  \
3371 )
3372
3373 #define FsRtlIsAnsiCharacterWild(C) (                                       \
3374     FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], FSRTL_WILD_CHARACTER ) \
3375 )
3376
3377 NTKERNELAPI
3378 BOOLEAN
3379 NTAPI
3380 FsRtlIsFatDbcsLegal (
3381     IN ANSI_STRING  DbcsName,
3382     IN BOOLEAN      WildCardsPermissible,
3383     IN BOOLEAN      PathNamePermissible,
3384     IN BOOLEAN      LeadingBackslashPermissible
3385 );
3386
3387 NTKERNELAPI
3388 BOOLEAN
3389 NTAPI
3390 FsRtlIsHpfsDbcsLegal (
3391     IN ANSI_STRING  DbcsName,
3392     IN BOOLEAN      WildCardsPermissible,
3393     IN BOOLEAN      PathNamePermissible,
3394     IN BOOLEAN      LeadingBackslashPermissible
3395 );
3396
3397 NTKERNELAPI
3398 BOOLEAN
3399 NTAPI
3400 FsRtlIsNameInExpression (
3401     IN PUNICODE_STRING  Expression,
3402     IN PUNICODE_STRING  Name,
3403     IN BOOLEAN          IgnoreCase,
3404     IN PWCHAR           UpcaseTable OPTIONAL
3405 );
3406
3407 NTKERNELAPI
3408 BOOLEAN
3409 NTAPI
3410 FsRtlIsNtstatusExpected (
3411     IN NTSTATUS Ntstatus
3412 );
3413
3414 #define NLS_OEM_LEAD_BYTE_INFO NlsOemLeadByteInfo
3415
3416 extern PUSHORT NlsOemLeadByteInfo;
3417
3418 #define FsRtlIsLeadDbcsCharacter(DBCS_CHAR) (                               \
3419     (BOOLEAN)((UCHAR)(DBCS_CHAR) < 0x80 ? FALSE :                           \
3420               (NLS_MB_CODE_PAGE_TAG &&                                      \
3421                (NLS_OEM_LEAD_BYTE_INFO[(UCHAR)(DBCS_CHAR)] != 0)))          \
3422 )
3423
3424 #define FsRtlIsUnicodeCharacterWild(C) (                                    \
3425     (((C) >= 0x40) ?                                                        \
3426     FALSE :                                                                 \
3427     FlagOn(FsRtlLegalAnsiCharacterArray[(C)], FSRTL_WILD_CHARACTER ))       \
3428 )
3429
3430 NTKERNELAPI
3431 BOOLEAN
3432 NTAPI
3433 FsRtlLookupBaseMcbEntry (
3434     IN PBASE_MCB   Mcb,
3435     IN LONGLONG    Vbn,
3436     OUT PLONGLONG  Lbn OPTIONAL,
3437     OUT PLONGLONG  SectorCountFromLbn OPTIONAL,
3438     OUT PLONGLONG  StartingLbn OPTIONAL,
3439     OUT PLONGLONG  SectorCountFromStartingLbn OPTIONAL,
3440     OUT PULONG     Index OPTIONAL
3441 );
3442
3443 NTKERNELAPI
3444 BOOLEAN
3445 NTAPI
3446 FsRtlLookupLargeMcbEntry (
3447     IN PLARGE_MCB  Mcb,
3448     IN LONGLONG    Vbn,
3449     OUT PLONGLONG  Lbn OPTIONAL,
3450     OUT PLONGLONG  SectorCountFromLbn OPTIONAL,
3451     OUT PLONGLONG  StartingLbn OPTIONAL,
3452     OUT PLONGLONG  SectorCountFromStartingLbn OPTIONAL,
3453     OUT PULONG     Index OPTIONAL
3454 );
3455
3456 NTKERNELAPI
3457 BOOLEAN
3458 NTAPI
3459 FsRtlLookupLastBaseMcbEntry (
3460     IN PBASE_MCB   Mcb,
3461     OUT PLONGLONG  Vbn,
3462     OUT PLONGLONG  Lbn
3463 );
3464
3465 NTKERNELAPI
3466 BOOLEAN
3467 NTAPI
3468 FsRtlLookupLastLargeMcbEntry (
3469     IN PLARGE_MCB  Mcb,
3470     OUT PLONGLONG  Vbn,
3471     OUT PLONGLONG  Lbn
3472 );
3473
3474 NTKERNELAPI
3475 BOOLEAN
3476 NTAPI
3477 FsRtlLookupLastMcbEntry (
3478     IN PMCB   Mcb,
3479     OUT PVBN  Vbn,
3480     OUT PLBN  Lbn
3481 );
3482
3483 NTKERNELAPI
3484 BOOLEAN
3485 NTAPI
3486 FsRtlLookupLastBaseMcbEntryAndIndex (
3487     IN PBASE_MCB      OpaqueMcb,
3488     IN OUT PLONGLONG  LargeVbn,
3489     IN OUT PLONGLONG  LargeLbn,
3490     IN OUT PULONG     Index
3491 );
3492
3493 NTKERNELAPI
3494 BOOLEAN
3495 NTAPI
3496 FsRtlLookupLastLargeMcbEntryAndIndex (
3497     IN PLARGE_MCB  OpaqueMcb,
3498     OUT PLONGLONG  LargeVbn,
3499     OUT PLONGLONG  LargeLbn,
3500     OUT PULONG     Index
3501 );
3502
3503 NTKERNELAPI
3504 BOOLEAN
3505 NTAPI
3506 FsRtlLookupMcbEntry (
3507     IN PMCB     Mcb,
3508     IN VBN      Vbn,
3509     OUT PLBN    Lbn,
3510     OUT PULONG  SectorCount OPTIONAL,
3511     OUT PULONG  Index
3512 );
3513
3514 NTKERNELAPI
3515 PFSRTL_PER_STREAM_CONTEXT
3516 NTAPI
3517 FsRtlLookupPerStreamContextInternal (
3518     IN PFSRTL_ADVANCED_FCB_HEADER  StreamContext,
3519     IN PVOID                       OwnerId OPTIONAL,
3520     IN PVOID                       InstanceId OPTIONAL
3521 );
3522
3523 NTKERNELAPI
3524 BOOLEAN
3525 NTAPI
3526 FsRtlMdlReadDev (
3527     IN PFILE_OBJECT       FileObject,
3528     IN PLARGE_INTEGER     FileOffset,
3529     IN ULONG              Length,
3530     IN ULONG              LockKey,
3531     OUT PMDL              *MdlChain,
3532     OUT PIO_STATUS_BLOCK  IoStatus,
3533     IN PDEVICE_OBJECT     DeviceObject
3534 );
3535
3536 NTKERNELAPI
3537 BOOLEAN
3538 NTAPI
3539 FsRtlMdlReadComplete (
3540     IN PFILE_OBJECT     FileObject,
3541     IN PMDL             MdlChain
3542 );
3543
3544 NTKERNELAPI
3545 BOOLEAN
3546 NTAPI
3547 FsRtlMdlReadCompleteDev (
3548     IN PFILE_OBJECT     FileObject,
3549     IN PMDL             MdlChain,
3550     IN PDEVICE_OBJECT   DeviceObject
3551 );
3552
3553 NTKERNELAPI
3554 BOOLEAN
3555 NTAPI
3556 FsRtlPrepareMdlWriteDev (
3557     IN PFILE_OBJECT       FileObject,
3558     IN PLARGE_INTEGER     FileOffset,
3559     IN ULONG              Length,
3560     IN ULONG              LockKey,
3561     OUT PMDL              *MdlChain,
3562     OUT PIO_STATUS_BLOCK  IoStatus,
3563     IN PDEVICE_OBJECT     DeviceObject
3564 );
3565
3566 NTKERNELAPI
3567 BOOLEAN
3568 NTAPI
3569 FsRtlMdlWriteComplete (
3570     IN PFILE_OBJECT     FileObject,
3571     IN PLARGE_INTEGER   FileOffset,
3572     IN PMDL             MdlChain
3573 );
3574
3575 NTKERNELAPI
3576 BOOLEAN
3577 NTAPI
3578 FsRtlMdlWriteCompleteDev (
3579     IN PFILE_OBJECT     FileObject,
3580     IN PLARGE_INTEGER   FileOffset,
3581     IN PMDL             MdlChain,
3582     IN PDEVICE_OBJECT   DeviceObject
3583 );
3584
3585 NTKERNELAPI
3586 NTSTATUS
3587 NTAPI
3588 FsRtlNormalizeNtstatus (
3589     IN NTSTATUS Exception,
3590     IN NTSTATUS GenericException
3591 );
3592
3593 NTKERNELAPI
3594 VOID
3595 NTAPI
3596 FsRtlNotifyChangeDirectory (
3597     IN PNOTIFY_SYNC NotifySync,
3598     IN PVOID        FsContext,
3599     IN PSTRING      FullDirectoryName,
3600     IN PLIST_ENTRY  NotifyList,
3601     IN BOOLEAN      WatchTree,
3602     IN ULONG        CompletionFilter,
3603     IN PIRP         NotifyIrp
3604 );
3605
3606 NTKERNELAPI
3607 VOID
3608 NTAPI
3609 FsRtlNotifyCleanup (
3610     IN PNOTIFY_SYNC NotifySync,
3611     IN PLIST_ENTRY  NotifyList,
3612     IN PVOID        FsContext
3613 );
3614
3615 typedef BOOLEAN (NTAPI *PCHECK_FOR_TRAVERSE_ACCESS) (
3616     IN PVOID                        NotifyContext,
3617     IN PVOID                        TargetContext,
3618     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext
3619 );
3620
3621 NTKERNELAPI
3622 VOID
3623 NTAPI
3624 FsRtlNotifyFilterChangeDirectory (
3625     IN PNOTIFY_SYNC                 NotifySync,
3626     IN PLIST_ENTRY                  NotifyList,
3627     IN PVOID                        FsContext,
3628     IN PSTRING                      FullDirectoryName,
3629     IN BOOLEAN                      WatchTree,
3630     IN BOOLEAN                      IgnoreBuffer,
3631     IN ULONG                        CompletionFilter,
3632     IN PIRP                         NotifyIrp,
3633     IN PCHECK_FOR_TRAVERSE_ACCESS   TraverseCallback OPTIONAL,
3634     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext OPTIONAL,
3635     IN PFILTER_REPORT_CHANGE        FilterCallback OPTIONAL);
3636
3637 NTKERNELAPI
3638 VOID
3639 NTAPI
3640 FsRtlNotifyFilterReportChange (
3641     IN PNOTIFY_SYNC   NotifySync,
3642     IN PLIST_ENTRY    NotifyList,
3643     IN PSTRING        FullTargetName,
3644     IN USHORT         TargetNameOffset,
3645     IN PSTRING        StreamName OPTIONAL,
3646     IN PSTRING        NormalizedParentName OPTIONAL,
3647     IN ULONG          FilterMatch,
3648     IN ULONG          Action,
3649     IN PVOID          TargetContext,
3650     IN PVOID          FilterContext);
3651
3652 NTKERNELAPI
3653 VOID
3654 NTAPI
3655 FsRtlNotifyFullChangeDirectory (
3656     IN PNOTIFY_SYNC                 NotifySync,
3657     IN PLIST_ENTRY                  NotifyList,
3658     IN PVOID                        FsContext,
3659     IN PSTRING                      FullDirectoryName,
3660     IN BOOLEAN                      WatchTree,
3661     IN BOOLEAN                      IgnoreBuffer,
3662     IN ULONG                        CompletionFilter,
3663     IN PIRP                         NotifyIrp,
3664     IN PCHECK_FOR_TRAVERSE_ACCESS   TraverseCallback OPTIONAL,
3665     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext OPTIONAL
3666 );
3667
3668 NTKERNELAPI
3669 VOID
3670 NTAPI
3671 FsRtlNotifyFullReportChange (
3672     IN PNOTIFY_SYNC NotifySync,
3673     IN PLIST_ENTRY  NotifyList,
3674     IN PSTRING      FullTargetName,
3675     IN USHORT       TargetNameOffset,
3676     IN PSTRING      StreamName OPTIONAL,
3677     IN PSTRING      NormalizedParentName OPTIONAL,
3678     IN ULONG        FilterMatch,
3679     IN ULONG        Action,
3680     IN PVOID        TargetContext
3681 );
3682
3683 NTKERNELAPI
3684 VOID
3685 NTAPI
3686 FsRtlNotifyInitializeSync (
3687     IN PNOTIFY_SYNC *NotifySync
3688 );
3689
3690 NTKERNELAPI
3691 VOID
3692 NTAPI
3693 FsRtlNotifyUninitializeSync (
3694     IN PNOTIFY_SYNC *NotifySync
3695 );
3696
3697 #if (VER_PRODUCTBUILD >= 2195)
3698
3699 NTKERNELAPI
3700 NTSTATUS
3701 NTAPI
3702 FsRtlNotifyVolumeEvent (
3703     IN PFILE_OBJECT FileObject,
3704     IN ULONG        EventCode
3705 );
3706
3707 #endif /* (VER_PRODUCTBUILD >= 2195) */
3708
3709 NTKERNELAPI
3710 ULONG
3711 NTAPI
3712 FsRtlNumberOfRunsInBaseMcb (
3713     IN PBASE_MCB Mcb
3714 );
3715
3716 NTKERNELAPI
3717 ULONG
3718 NTAPI
3719 FsRtlNumberOfRunsInLargeMcb (
3720     IN PLARGE_MCB Mcb
3721 );
3722
3723 NTKERNELAPI
3724 ULONG
3725 NTAPI
3726 FsRtlNumberOfRunsInMcb (
3727     IN PMCB Mcb
3728 );
3729
3730 NTKERNELAPI
3731 NTSTATUS
3732 NTAPI
3733 FsRtlOplockFsctrl (
3734     IN POPLOCK  Oplock,
3735     IN PIRP     Irp,
3736     IN ULONG    OpenCount
3737 );
3738
3739 NTKERNELAPI
3740 BOOLEAN
3741 NTAPI
3742 FsRtlOplockIsFastIoPossible (
3743     IN POPLOCK Oplock
3744 );
3745
3746 typedef VOID
3747 (NTAPI *PFSRTL_STACK_OVERFLOW_ROUTINE) (
3748     IN PVOID    Context,
3749     IN PKEVENT  Event
3750 );
3751
3752 NTKERNELAPI
3753 VOID
3754 NTAPI
3755 FsRtlPostPagingFileStackOverflow (
3756     IN PVOID                          Context,
3757     IN PKEVENT                        Event,
3758     IN PFSRTL_STACK_OVERFLOW_ROUTINE  StackOverflowRoutine
3759 );
3760
3761 NTKERNELAPI
3762 VOID
3763 NTAPI
3764 FsRtlPostStackOverflow (
3765     IN PVOID                          Context,
3766     IN PKEVENT                        Event,
3767     IN PFSRTL_STACK_OVERFLOW_ROUTINE  StackOverflowRoutine
3768 );
3769
3770 /*
3771   FsRtlPrivateLock:
3772
3773   ret: IoStatus->Status: STATUS_PENDING, STATUS_LOCK_NOT_GRANTED
3774
3775   Internals:
3776     -Calls IoCompleteRequest if Irp
3777     -Uses exception handling / ExRaiseStatus with STATUS_INSUFFICIENT_RESOURCES
3778 */
3779 NTKERNELAPI
3780 BOOLEAN
3781 NTAPI
3782 FsRtlPrivateLock (
3783     IN PFILE_LOCK           FileLock,
3784     IN PFILE_OBJECT         FileObject,
3785     IN PLARGE_INTEGER       FileOffset,
3786     IN PLARGE_INTEGER       Length,
3787     IN PEPROCESS            Process,
3788     IN ULONG                Key,
3789     IN BOOLEAN              FailImmediately,
3790     IN BOOLEAN              ExclusiveLock,
3791     OUT PIO_STATUS_BLOCK    IoStatus,
3792     IN PIRP                 Irp OPTIONAL,
3793     IN PVOID                Context,
3794     IN BOOLEAN              AlreadySynchronized
3795 );
3796
3797 /*
3798   FsRtlProcessFileLock:
3799
3800   ret:
3801     -STATUS_INVALID_DEVICE_REQUEST
3802     -STATUS_RANGE_NOT_LOCKED from unlock routines.
3803     -STATUS_PENDING, STATUS_LOCK_NOT_GRANTED from FsRtlPrivateLock
3804     (redirected IoStatus->Status).
3805
3806   Internals:
3807     -switch ( Irp->CurrentStackLocation->MinorFunction )
3808         lock: return FsRtlPrivateLock;
3809         unlocksingle: return FsRtlFastUnlockSingle;
3810         unlockall: return FsRtlFastUnlockAll;
3811         unlockallbykey: return FsRtlFastUnlockAllByKey;
3812         default: IofCompleteRequest with STATUS_INVALID_DEVICE_REQUEST;
3813                  return STATUS_INVALID_DEVICE_REQUEST;
3814
3815     -'AllwaysZero' is passed thru as 'AllwaysZero' to lock / unlock routines.
3816     -'Irp' is passet thru as 'Irp' to FsRtlPrivateLock.
3817 */
3818 NTKERNELAPI
3819 NTSTATUS
3820 NTAPI
3821 FsRtlProcessFileLock (
3822     IN PFILE_LOCK   FileLock,
3823     IN PIRP         Irp,
3824     IN PVOID        Context OPTIONAL
3825 );
3826
3827 NTKERNELAPI
3828 NTSTATUS
3829 NTAPI
3830 FsRtlRegisterUncProvider (
3831     IN OUT PHANDLE      MupHandle,
3832     IN PUNICODE_STRING  RedirectorDeviceName,
3833     IN BOOLEAN          MailslotsSupported
3834 );
3835
3836 NTKERNELAPI
3837 VOID
3838 NTAPI
3839 FsRtlRemoveBaseMcbEntry (
3840     IN PBASE_MCB  Mcb,
3841     IN LONGLONG   Vbn,
3842     IN LONGLONG   SectorCount
3843 );
3844
3845 NTKERNELAPI
3846 VOID
3847 NTAPI
3848 FsRtlRemoveLargeMcbEntry (
3849     IN PLARGE_MCB  Mcb,
3850     IN LONGLONG    Vbn,
3851     IN LONGLONG    SectorCount
3852 );
3853
3854 NTKERNELAPI
3855 VOID
3856 NTAPI
3857 FsRtlRemoveMcbEntry (
3858     IN PMCB   Mcb,
3859     IN VBN    Vbn,
3860     IN ULONG  SectorCount
3861 );
3862
3863 NTKERNELAPI
3864 PFSRTL_PER_STREAM_CONTEXT
3865 NTAPI
3866 FsRtlRemovePerStreamContext (
3867     IN PFSRTL_ADVANCED_FCB_HEADER  StreamContext,
3868     IN PVOID                       OwnerId OPTIONAL,
3869     IN PVOID                       InstanceId OPTIONAL
3870 );
3871
3872 NTKERNELAPI
3873 VOID
3874 NTAPI
3875 FsRtlResetBaseMcb (
3876     IN PBASE_MCB Mcb
3877 );
3878
3879 NTKERNELAPI
3880 VOID
3881 NTAPI
3882 FsRtlResetLargeMcb (
3883     IN PLARGE_MCB  Mcb,
3884     IN BOOLEAN     SelfSynchronized
3885 );
3886
3887 NTKERNELAPI
3888 BOOLEAN
3889 NTAPI
3890 FsRtlSplitBaseMcb (
3891     IN PBASE_MCB  Mcb,
3892     IN LONGLONG   Vbn,
3893     IN LONGLONG   Amount
3894 );
3895
3896 NTKERNELAPI
3897 BOOLEAN
3898 NTAPI
3899 FsRtlSplitLargeMcb (
3900     IN PLARGE_MCB  Mcb,
3901     IN LONGLONG    Vbn,
3902     IN LONGLONG    Amount
3903 );
3904
3905 #define FsRtlSupportsPerStreamContexts(FO) (                       \
3906     (BOOLEAN)((NULL != FsRtlGetPerStreamContextPointer(FO) &&     \
3907               FlagOn(FsRtlGetPerStreamContextPointer(FO)->Flags2, \
3908               FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS))               \
3909 )
3910
3911 NTKERNELAPI
3912 VOID
3913 NTAPI
3914 FsRtlTruncateBaseMcb (
3915     IN PBASE_MCB  Mcb,
3916     IN LONGLONG   Vbn
3917 );
3918
3919 NTKERNELAPI
3920 VOID
3921 NTAPI
3922 FsRtlTruncateLargeMcb (
3923     IN PLARGE_MCB  Mcb,
3924     IN LONGLONG    Vbn
3925 );
3926
3927 NTKERNELAPI
3928 VOID
3929 NTAPI
3930 FsRtlTruncateMcb (
3931     IN PMCB  Mcb,
3932     IN VBN   Vbn
3933 );
3934
3935 NTKERNELAPI
3936 VOID
3937 NTAPI
3938 FsRtlUninitializeBaseMcb (
3939     IN PBASE_MCB Mcb
3940 );
3941
3942 NTKERNELAPI
3943 VOID
3944 NTAPI
3945 FsRtlUninitializeFileLock (
3946     IN PFILE_LOCK FileLock
3947 );
3948
3949 NTKERNELAPI
3950 VOID
3951 NTAPI
3952 FsRtlUninitializeLargeMcb (
3953     IN PLARGE_MCB Mcb
3954 );
3955
3956 NTKERNELAPI
3957 VOID
3958 NTAPI
3959 FsRtlUninitializeMcb (
3960     IN PMCB Mcb
3961 );
3962
3963 NTKERNELAPI
3964 VOID
3965 NTAPI
3966 FsRtlUninitializeOplock (
3967     IN OUT POPLOCK Oplock
3968 );
3969
3970 NTKERNELAPI
3971 UCHAR
3972 NTAPI
3973 KeSetIdealProcessorThread(
3974     IN OUT PKTHREAD Thread,
3975     IN UCHAR Processor
3976 );
3977
3978 NTKERNELAPI
3979 NTSTATUS
3980 NTAPI
3981 IoAttachDeviceToDeviceStackSafe(
3982     IN PDEVICE_OBJECT   SourceDevice,
3983     IN PDEVICE_OBJECT   TargetDevice,
3984     OUT PDEVICE_OBJECT  *AttachedToDeviceObject
3985 );
3986
3987 NTKERNELAPI
3988 VOID
3989 NTAPI
3990 IoAcquireVpbSpinLock (
3991     OUT PKIRQL Irql
3992 );
3993
3994 NTKERNELAPI
3995 NTSTATUS
3996 NTAPI
3997 IoCheckDesiredAccess (
3998     IN OUT PACCESS_MASK DesiredAccess,
3999     IN ACCESS_MASK      GrantedAccess
4000 );
4001
4002 NTKERNELAPI
4003 NTSTATUS
4004 NTAPI
4005 IoCheckEaBufferValidity (
4006     IN PFILE_FULL_EA_INFORMATION    EaBuffer,
4007     IN ULONG                        EaLength,
4008     OUT PULONG                      ErrorOffset
4009 );
4010
4011 NTKERNELAPI
4012 NTSTATUS
4013 NTAPI
4014 IoCheckFunctionAccess (
4015     IN ACCESS_MASK              GrantedAccess,
4016     IN UCHAR                    MajorFunction,
4017     IN UCHAR                    MinorFunction,
4018     IN ULONG                    IoControlCode,
4019     IN PVOID                    Argument1 OPTIONAL,
4020     IN PVOID                    Argument2 OPTIONAL
4021 );
4022
4023 #if (VER_PRODUCTBUILD >= 2195)
4024
4025 NTKERNELAPI
4026 NTSTATUS
4027 NTAPI
4028 IoCheckQuotaBufferValidity (
4029     IN PFILE_QUOTA_INFORMATION  QuotaBuffer,
4030     IN ULONG                    QuotaLength,
4031     OUT PULONG                  ErrorOffset
4032 );
4033
4034 #endif /* (VER_PRODUCTBUILD >= 2195) */
4035
4036 NTKERNELAPI
4037 PFILE_OBJECT
4038 NTAPI
4039 IoCreateStreamFileObject (
4040     IN PFILE_OBJECT     FileObject OPTIONAL,
4041     IN PDEVICE_OBJECT   DeviceObject OPTIONAL
4042 );
4043
4044 #if (VER_PRODUCTBUILD >= 2195)
4045
4046 NTKERNELAPI
4047 PFILE_OBJECT
4048 NTAPI
4049 IoCreateStreamFileObjectLite (
4050     IN PFILE_OBJECT     FileObject OPTIONAL,
4051     IN PDEVICE_OBJECT   DeviceObject OPTIONAL
4052 );
4053
4054 #endif /* (VER_PRODUCTBUILD >= 2195) */
4055
4056 NTKERNELAPI
4057 BOOLEAN
4058 NTAPI
4059 IoFastQueryNetworkAttributes (
4060     IN POBJECT_ATTRIBUTES               ObjectAttributes,
4061     IN ACCESS_MASK                      DesiredAccess,
4062     IN ULONG                            OpenOptions,
4063     OUT PIO_STATUS_BLOCK                IoStatus,
4064     OUT PFILE_NETWORK_OPEN_INFORMATION  Buffer
4065 );
4066
4067 NTKERNELAPI
4068 PDEVICE_OBJECT
4069 NTAPI
4070 IoGetAttachedDevice (
4071     IN PDEVICE_OBJECT DeviceObject
4072 );
4073
4074 NTKERNELAPI
4075 PDEVICE_OBJECT
4076 NTAPI
4077 IoGetBaseFileSystemDeviceObject (
4078     IN PFILE_OBJECT FileObject
4079 );
4080
4081 #if (VER_PRODUCTBUILD >= 2600)
4082
4083 NTKERNELAPI
4084 PDEVICE_OBJECT
4085 NTAPI
4086 IoGetDeviceAttachmentBaseRef (
4087     IN PDEVICE_OBJECT DeviceObject
4088 );
4089
4090 NTKERNELAPI
4091 NTSTATUS
4092 NTAPI
4093 IoGetDiskDeviceObject (
4094     IN PDEVICE_OBJECT   FileSystemDeviceObject,
4095     OUT PDEVICE_OBJECT  *DiskDeviceObject
4096 );
4097
4098 NTKERNELAPI
4099 PDEVICE_OBJECT
4100 NTAPI
4101 IoGetLowerDeviceObject (
4102     IN PDEVICE_OBJECT DeviceObject
4103 );
4104
4105 #endif /* (VER_PRODUCTBUILD >= 2600) */
4106
4107 NTKERNELAPI
4108 PEPROCESS
4109 NTAPI
4110 IoGetRequestorProcess (
4111     IN PIRP Irp
4112 );
4113
4114 #if (VER_PRODUCTBUILD >= 2195)
4115
4116 NTKERNELAPI
4117 ULONG
4118 NTAPI
4119 IoGetRequestorProcessId (
4120     IN PIRP Irp
4121 );
4122
4123 #endif /* (VER_PRODUCTBUILD >= 2195) */
4124
4125 NTKERNELAPI
4126 PIRP
4127 NTAPI
4128 IoGetTopLevelIrp (
4129     VOID
4130 );
4131
4132 #define IoIsFileOpenedExclusively(FileObject) ( \
4133     (BOOLEAN) !(                                \
4134     (FileObject)->SharedRead ||                 \
4135     (FileObject)->SharedWrite ||                \
4136     (FileObject)->SharedDelete                  \
4137     )                                           \
4138 )
4139
4140 NTKERNELAPI
4141 BOOLEAN
4142 NTAPI
4143 IoIsOperationSynchronous (
4144     IN PIRP Irp
4145 );
4146
4147 NTKERNELAPI
4148 BOOLEAN
4149 NTAPI
4150 IoIsSystemThread (
4151     IN PETHREAD Thread
4152 );
4153
4154 #if (VER_PRODUCTBUILD >= 2195)
4155
4156 NTKERNELAPI
4157 BOOLEAN
4158 NTAPI
4159 IoIsValidNameGraftingBuffer (
4160     IN PIRP                 Irp,
4161     IN PREPARSE_DATA_BUFFER ReparseBuffer
4162 );
4163
4164 #endif /* (VER_PRODUCTBUILD >= 2195) */
4165
4166 NTKERNELAPI
4167 NTSTATUS
4168 NTAPI
4169 IoPageRead (
4170     IN PFILE_OBJECT         FileObject,
4171     IN PMDL                 Mdl,
4172     IN PLARGE_INTEGER       Offset,
4173     IN PKEVENT              Event,
4174     OUT PIO_STATUS_BLOCK    IoStatusBlock
4175 );
4176
4177 NTKERNELAPI
4178 NTSTATUS
4179 NTAPI
4180 IoQueryFileInformation (
4181     IN PFILE_OBJECT             FileObject,
4182     IN FILE_INFORMATION_CLASS   FileInformationClass,
4183     IN ULONG                    Length,
4184     OUT PVOID                   FileInformation,
4185     OUT PULONG                  ReturnedLength
4186 );
4187
4188 NTKERNELAPI
4189 NTSTATUS
4190 NTAPI
4191 IoQueryVolumeInformation (
4192     IN PFILE_OBJECT         FileObject,
4193     IN FS_INFORMATION_CLASS FsInformationClass,
4194     IN ULONG                Length,
4195     OUT PVOID               FsInformation,
4196     OUT PULONG              ReturnedLength
4197 );
4198
4199 NTKERNELAPI
4200 VOID
4201 NTAPI
4202 IoQueueThreadIrp(
4203     IN PIRP Irp
4204 );
4205
4206 NTKERNELAPI
4207 VOID
4208 NTAPI
4209 IoRegisterFileSystem (
4210     IN OUT PDEVICE_OBJECT DeviceObject
4211 );
4212
4213 #if (VER_PRODUCTBUILD >= 1381)
4214
4215 typedef VOID (NTAPI *PDRIVER_FS_NOTIFICATION) (
4216     IN PDEVICE_OBJECT DeviceObject,
4217     IN BOOLEAN        DriverActive
4218 );
4219
4220 NTKERNELAPI
4221 NTSTATUS
4222 NTAPI
4223 IoRegisterFsRegistrationChange (
4224     IN PDRIVER_OBJECT           DriverObject,
4225     IN PDRIVER_FS_NOTIFICATION  DriverNotificationRoutine
4226 );
4227
4228 #endif /* (VER_PRODUCTBUILD >= 1381) */
4229
4230 NTKERNELAPI
4231 VOID
4232 NTAPI
4233 IoReleaseVpbSpinLock (
4234     IN KIRQL Irql
4235 );
4236
4237 NTKERNELAPI
4238 VOID
4239 NTAPI
4240 IoSetDeviceToVerify (
4241     IN PETHREAD         Thread,
4242     IN PDEVICE_OBJECT   DeviceObject
4243 );
4244
4245 NTKERNELAPI
4246 NTSTATUS
4247 NTAPI
4248 IoSetInformation (
4249     IN PFILE_OBJECT             FileObject,
4250     IN FILE_INFORMATION_CLASS   FileInformationClass,
4251     IN ULONG                    Length,
4252     IN PVOID                    FileInformation
4253 );
4254
4255 NTKERNELAPI
4256 VOID
4257 NTAPI
4258 IoSetTopLevelIrp (
4259     IN PIRP Irp
4260 );
4261
4262 NTKERNELAPI
4263 NTSTATUS
4264 NTAPI
4265 IoSynchronousPageWrite (
4266     IN PFILE_OBJECT         FileObject,
4267     IN PMDL                 Mdl,
4268     IN PLARGE_INTEGER       FileOffset,
4269     IN PKEVENT              Event,
4270     OUT PIO_STATUS_BLOCK    IoStatusBlock
4271 );
4272
4273 NTKERNELAPI
4274 PEPROCESS
4275 NTAPI
4276 IoThreadToProcess (
4277     IN PETHREAD Thread
4278 );
4279
4280 NTKERNELAPI
4281 VOID
4282 NTAPI
4283 IoUnregisterFileSystem (
4284     IN OUT PDEVICE_OBJECT DeviceObject
4285 );
4286
4287 #if (VER_PRODUCTBUILD >= 1381)
4288
4289 NTKERNELAPI
4290 VOID
4291 NTAPI
4292 IoUnregisterFsRegistrationChange (
4293     IN PDRIVER_OBJECT           DriverObject,
4294     IN PDRIVER_FS_NOTIFICATION  DriverNotificationRoutine
4295 );
4296
4297 #endif /* (VER_PRODUCTBUILD >= 1381) */
4298
4299 NTKERNELAPI
4300 NTSTATUS
4301 NTAPI
4302 IoVerifyVolume (
4303     IN PDEVICE_OBJECT   DeviceObject,
4304     IN BOOLEAN          AllowRawMount
4305 );
4306
4307 #if !defined (_M_AMD64)
4308
4309 NTHALAPI
4310 KIRQL
4311 FASTCALL
4312 KeAcquireQueuedSpinLock (
4313     IN KSPIN_LOCK_QUEUE_NUMBER Number
4314 );
4315
4316 NTHALAPI
4317 VOID
4318 FASTCALL
4319 KeReleaseQueuedSpinLock (
4320     IN KSPIN_LOCK_QUEUE_NUMBER Number,
4321     IN KIRQL OldIrql
4322 );
4323
4324 NTHALAPI
4325 KIRQL
4326 FASTCALL
4327 KeAcquireSpinLockRaiseToSynch(
4328     IN OUT PKSPIN_LOCK SpinLock
4329 );
4330
4331 NTHALAPI
4332 LOGICAL
4333 FASTCALL
4334 KeTryToAcquireQueuedSpinLock(
4335   KSPIN_LOCK_QUEUE_NUMBER Number,
4336   PKIRQL OldIrql);
4337
4338 #else
4339
4340 NTKERNELAPI
4341 KIRQL
4342 FASTCALL
4343 KeAcquireQueuedSpinLock (
4344     IN KSPIN_LOCK_QUEUE_NUMBER Number
4345 );
4346
4347 NTKERNELAPI
4348 VOID
4349 FASTCALL
4350 KeReleaseQueuedSpinLock (
4351     IN KSPIN_LOCK_QUEUE_NUMBER Number,
4352     IN KIRQL OldIrql
4353 );
4354
4355 NTKERNELAPI
4356 KIRQL
4357 KeAcquireSpinLockRaiseToSynch(
4358     IN OUT PKSPIN_LOCK SpinLock
4359 );
4360
4361 NTKERNELAPI
4362 LOGICAL
4363 KeTryToAcquireQueuedSpinLock(
4364   KSPIN_LOCK_QUEUE_NUMBER Number,
4365   PKIRQL OldIrql);
4366
4367 #endif
4368
4369 NTKERNELAPI
4370 VOID
4371 NTAPI
4372 KeAttachProcess (
4373     IN PKPROCESS Process
4374 );
4375
4376 NTKERNELAPI
4377 VOID
4378 NTAPI
4379 KeDetachProcess (
4380     VOID
4381 );
4382
4383 NTKERNELAPI
4384 VOID
4385 NTAPI
4386 KeInitializeQueue (
4387     IN PRKQUEUE Queue,
4388     IN ULONG    Count OPTIONAL
4389 );
4390
4391 NTKERNELAPI
4392 LONG
4393 NTAPI
4394 KeInsertHeadQueue (
4395     IN PRKQUEUE     Queue,
4396     IN PLIST_ENTRY  Entry
4397 );
4398
4399 NTKERNELAPI
4400 LONG
4401 NTAPI
4402 KeInsertQueue (
4403     IN PRKQUEUE     Queue,
4404     IN PLIST_ENTRY  Entry
4405 );
4406
4407 NTKERNELAPI
4408 LONG
4409 NTAPI
4410 KeReadStateQueue (
4411     IN PRKQUEUE Queue
4412 );
4413
4414 NTKERNELAPI
4415 PLIST_ENTRY
4416 NTAPI
4417 KeRemoveQueue (
4418     IN PRKQUEUE         Queue,
4419     IN KPROCESSOR_MODE  WaitMode,
4420     IN PLARGE_INTEGER   Timeout OPTIONAL
4421 );
4422
4423 NTKERNELAPI
4424 PLIST_ENTRY
4425 NTAPI
4426 KeRundownQueue (
4427     IN PRKQUEUE Queue
4428 );
4429
4430 NTKERNELAPI
4431 VOID
4432 NTAPI
4433 KeInitializeMutant (
4434     IN PRKMUTANT  Mutant,
4435     IN BOOLEAN    InitialOwner
4436 );
4437
4438 NTKERNELAPI
4439 LONG
4440 NTAPI
4441 KeReadStateMutant (
4442     IN PRKMUTANT  Mutant
4443 );
4444
4445 NTKERNELAPI
4446 LONG
4447 NTAPI
4448 KeReleaseMutant (
4449     IN PRKMUTANT  Mutant,
4450     IN KPRIORITY  Increment,
4451     IN BOOLEAN    Abandoned,
4452     IN BOOLEAN    Wait
4453 );
4454
4455 #if (VER_PRODUCTBUILD >= 2195)
4456
4457 NTKERNELAPI
4458 VOID
4459 NTAPI
4460 KeStackAttachProcess (
4461     IN PKPROCESS    Process,
4462     OUT PKAPC_STATE ApcState
4463 );
4464
4465 NTKERNELAPI
4466 VOID
4467 NTAPI
4468 KeUnstackDetachProcess (
4469     IN PKAPC_STATE ApcState
4470 );
4471
4472 #endif /* (VER_PRODUCTBUILD >= 2195) */
4473
4474 NTKERNELAPI
4475 BOOLEAN
4476 NTAPI
4477 KeSetKernelStackSwapEnable(
4478     IN BOOLEAN Enable
4479 );
4480
4481 NTKERNELAPI
4482 BOOLEAN
4483 NTAPI
4484 MmCanFileBeTruncated (
4485     IN PSECTION_OBJECT_POINTERS     SectionObjectPointer,
4486     IN PLARGE_INTEGER               NewFileSize
4487 );
4488
4489 NTKERNELAPI
4490 BOOLEAN
4491 NTAPI
4492 MmFlushImageSection (
4493     IN PSECTION_OBJECT_POINTERS     SectionObjectPointer,
4494     IN MMFLUSH_TYPE                 FlushType
4495 );
4496
4497 NTKERNELAPI
4498 BOOLEAN
4499 NTAPI
4500 MmForceSectionClosed (
4501     IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
4502     IN BOOLEAN                  DelayClose
4503 );
4504
4505 #if (VER_PRODUCTBUILD >= 1381)
4506
4507 NTKERNELAPI
4508 BOOLEAN
4509 NTAPI
4510 MmIsRecursiveIoFault (
4511     VOID
4512 );
4513
4514 #else
4515
4516 #define MmIsRecursiveIoFault() (                            \
4517     (PsGetCurrentThread()->DisablePageFaultClustering) |    \
4518     (PsGetCurrentThread()->ForwardClusterOnly)              \
4519 )
4520
4521 #endif
4522
4523
4524 NTKERNELAPI
4525 BOOLEAN
4526 NTAPI
4527 MmSetAddressRangeModified (
4528     IN PVOID    Address,
4529     IN SIZE_T    Length
4530 );
4531
4532 NTKERNELAPI
4533 NTSTATUS
4534 NTAPI
4535 ObCreateObject (
4536     IN KPROCESSOR_MODE      ObjectAttributesAccessMode OPTIONAL,
4537     IN POBJECT_TYPE         ObjectType,
4538     IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
4539     IN KPROCESSOR_MODE      AccessMode,
4540     IN OUT PVOID            ParseContext OPTIONAL,
4541     IN ULONG                ObjectSize,
4542     IN ULONG                PagedPoolCharge OPTIONAL,
4543     IN ULONG                NonPagedPoolCharge OPTIONAL,
4544     OUT PVOID               *Object
4545 );
4546
4547 NTKERNELAPI
4548 ULONG
4549 NTAPI
4550 ObGetObjectPointerCount (
4551     IN PVOID Object
4552 );
4553
4554 #if (NTDDI_VERSION >= NTDDI_WIN2K)
4555
4556 NTKERNELAPI
4557 NTSTATUS
4558 NTAPI
4559 ObInsertObject (
4560   IN PVOID Object,
4561   IN PACCESS_STATE PassedAccessState OPTIONAL,
4562   IN ACCESS_MASK DesiredAccess OPTIONAL,
4563   IN ULONG ObjectPointerBias,
4564   OUT PVOID *NewObject OPTIONAL,
4565   OUT PHANDLE Handle OPTIONAL);
4566
4567 NTKERNELAPI
4568 NTSTATUS
4569 NTAPI
4570 ObOpenObjectByPointer (
4571   IN PVOID Object,
4572   IN ULONG HandleAttributes,
4573   IN PACCESS_STATE PassedAccessState OPTIONAL,
4574   IN ACCESS_MASK DesiredAccess OPTIONAL,
4575   IN POBJECT_TYPE ObjectType OPTIONAL,
4576   IN KPROCESSOR_MODE AccessMode,
4577   OUT PHANDLE Handle);
4578
4579 NTKERNELAPI
4580 VOID
4581 NTAPI
4582 ObMakeTemporaryObject (
4583   IN PVOID Object);
4584
4585 NTKERNELAPI
4586 NTSTATUS
4587 NTAPI
4588 ObQueryObjectAuditingByHandle (
4589   IN HANDLE Handle,
4590   OUT PBOOLEAN GenerateOnClose);
4591
4592 #endif
4593
4594 NTKERNELAPI
4595 NTSTATUS
4596 NTAPI
4597 ObQueryNameString (
4598     IN PVOID                        Object,
4599     OUT POBJECT_NAME_INFORMATION    ObjectNameInfo,
4600     IN ULONG                        Length,
4601     OUT PULONG                      ReturnLength
4602 );
4603
4604 NTKERNELAPI
4605 NTSTATUS
4606 NTAPI
4607 ObReferenceObjectByName (
4608     IN PUNICODE_STRING  ObjectName,
4609     IN ULONG            Attributes,
4610     IN PACCESS_STATE    PassedAccessState OPTIONAL,
4611     IN ACCESS_MASK      DesiredAccess OPTIONAL,
4612     IN POBJECT_TYPE     ObjectType,
4613     IN KPROCESSOR_MODE  AccessMode,
4614     IN OUT PVOID        ParseContext OPTIONAL,
4615     OUT PVOID           *Object
4616 );
4617
4618 NTKERNELAPI
4619 NTSTATUS
4620 NTAPI
4621 PsAssignImpersonationToken (
4622     IN PETHREAD     Thread,
4623     IN HANDLE       Token
4624 );
4625
4626 NTKERNELAPI
4627 VOID
4628 NTAPI
4629 PsChargePoolQuota (
4630     IN PEPROCESS    Process,
4631     IN POOL_TYPE    PoolType,
4632     IN SIZE_T       Amount
4633 );
4634
4635 NTKERNELAPI
4636 NTSTATUS
4637 NTAPI
4638 PsChargeProcessPoolQuota (
4639     IN PEPROCESS    Process,
4640     IN POOL_TYPE    PoolType,
4641     IN SIZE_T       Amount
4642 );
4643
4644 #define PsDereferenceImpersonationToken(T)  \
4645             {if (ARGUMENT_PRESENT(T)) {     \
4646                 (ObDereferenceObject((T))); \
4647             } else {                        \
4648                 ;                           \
4649             }                               \
4650 }
4651
4652 #define PsDereferencePrimaryToken(T) (ObDereferenceObject((T)))
4653
4654 NTKERNELAPI
4655 BOOLEAN
4656 NTAPI
4657 PsDisableImpersonation(
4658     IN PETHREAD                 Thread,
4659     IN PSE_IMPERSONATION_STATE  ImpersonationState
4660 );
4661
4662 NTKERNELAPI
4663 LARGE_INTEGER
4664 NTAPI
4665 PsGetProcessExitTime (
4666     VOID
4667 );
4668
4669 NTKERNELAPI
4670 NTSTATUS
4671 NTAPI
4672 PsImpersonateClient(
4673     IN PETHREAD                      Thread,
4674     IN PACCESS_TOKEN                 Token,
4675     IN BOOLEAN                       CopyOnOpen,
4676     IN BOOLEAN                       EffectiveOnly,
4677     IN SECURITY_IMPERSONATION_LEVEL  ImpersonationLevel
4678 );
4679
4680 NTKERNELAPI
4681 BOOLEAN
4682 NTAPI
4683 PsIsSystemThread(
4684     IN PETHREAD Thread
4685 );
4686
4687 NTKERNELAPI
4688 BOOLEAN
4689 NTAPI
4690 PsIsThreadTerminating (
4691     IN PETHREAD Thread
4692 );
4693
4694 NTKERNELAPI
4695 NTSTATUS
4696 NTAPI
4697 PsLookupProcessByProcessId (
4698     IN HANDLE       ProcessId,
4699     OUT PEPROCESS   *Process
4700 );
4701
4702 NTKERNELAPI
4703 NTSTATUS
4704 NTAPI
4705 PsLookupProcessThreadByCid (
4706     IN PCLIENT_ID   Cid,
4707     OUT PEPROCESS   *Process OPTIONAL,
4708     OUT PETHREAD    *Thread
4709 );
4710
4711 NTKERNELAPI
4712 NTSTATUS
4713 NTAPI
4714 PsLookupThreadByThreadId (
4715     IN HANDLE       UniqueThreadId,
4716     OUT PETHREAD    *Thread
4717 );
4718
4719 NTKERNELAPI
4720 PACCESS_TOKEN
4721 NTAPI
4722 PsReferenceImpersonationToken (
4723     IN PETHREAD                         Thread,
4724     OUT PBOOLEAN                        CopyOnUse,
4725     OUT PBOOLEAN                        EffectiveOnly,
4726     OUT PSECURITY_IMPERSONATION_LEVEL   Level
4727 );
4728
4729 NTKERNELAPI
4730 HANDLE
4731 NTAPI
4732 PsReferencePrimaryToken (
4733     IN PEPROCESS Process
4734 );
4735
4736 NTKERNELAPI
4737 VOID
4738 NTAPI
4739 PsRestoreImpersonation(
4740     IN PETHREAD                 Thread,
4741     IN PSE_IMPERSONATION_STATE  ImpersonationState
4742 );
4743
4744 NTKERNELAPI
4745 VOID
4746 NTAPI
4747 PsReturnPoolQuota (
4748     IN PEPROCESS    Process,
4749     IN POOL_TYPE    PoolType,
4750     IN SIZE_T       Amount
4751 );
4752
4753 NTKERNELAPI
4754 VOID
4755 NTAPI
4756 PsRevertToSelf (
4757     VOID
4758 );
4759
4760 NTSYSAPI
4761 NTSTATUS
4762 NTAPI
4763 RtlAbsoluteToSelfRelativeSD (
4764     IN PSECURITY_DESCRIPTOR              AbsoluteSecurityDescriptor,
4765     IN OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor,
4766     IN PULONG                            BufferLength
4767 );
4768
4769 NTSYSAPI
4770 PVOID
4771 NTAPI
4772 RtlAllocateHeap (
4773     IN HANDLE  HeapHandle,
4774     IN ULONG   Flags,
4775     IN SIZE_T   Size
4776 );
4777
4778 NTSYSAPI
4779 NTSTATUS
4780 NTAPI
4781 RtlAppendStringToString(
4782     PSTRING Destination,
4783     const STRING *Source
4784 );
4785
4786 NTSYSAPI
4787 USHORT
4788 NTAPI
4789 RtlCaptureStackBackTrace (
4790     IN ULONG FramesToSkip,
4791     IN ULONG FramesToCapture,
4792     OUT PVOID *BackTrace,
4793     OUT PULONG BackTraceHash OPTIONAL
4794 );
4795
4796 NTSYSAPI
4797 SIZE_T
4798 NTAPI
4799 RtlCompareMemoryUlong (
4800     PVOID Source,
4801     SIZE_T Length,
4802     ULONG Pattern
4803 );
4804
4805 NTSYSAPI
4806 NTSTATUS
4807 NTAPI
4808 RtlCompressBuffer (
4809     IN USHORT   CompressionFormatAndEngine,
4810     IN PUCHAR   UncompressedBuffer,
4811     IN ULONG    UncompressedBufferSize,
4812     OUT PUCHAR  CompressedBuffer,
4813     IN ULONG    CompressedBufferSize,
4814     IN ULONG    UncompressedChunkSize,
4815     OUT PULONG  FinalCompressedSize,
4816     IN PVOID    WorkSpace
4817 );
4818
4819 NTSYSAPI
4820 NTSTATUS
4821 NTAPI
4822 RtlCompressChunks (
4823     IN PUCHAR                       UncompressedBuffer,
4824     IN ULONG                        UncompressedBufferSize,
4825     OUT PUCHAR                      CompressedBuffer,
4826     IN ULONG                        CompressedBufferSize,
4827     IN OUT PCOMPRESSED_DATA_INFO    CompressedDataInfo,
4828     IN ULONG                        CompressedDataInfoLength,
4829     IN PVOID                        WorkSpace
4830 );
4831
4832 NTSYSAPI
4833 NTSTATUS
4834 NTAPI
4835 RtlConvertSidToUnicodeString (
4836     OUT PUNICODE_STRING DestinationString,
4837     IN PSID             Sid,
4838     IN BOOLEAN          AllocateDestinationString
4839 );
4840
4841 NTSYSAPI
4842 NTSTATUS
4843 NTAPI
4844 RtlCopySid (
4845     IN ULONG   Length,
4846     IN PSID    Destination,
4847     IN PSID    Source
4848 );
4849
4850 NTSYSAPI
4851 BOOLEAN
4852 NTAPI
4853 RtlCreateUnicodeString(
4854     PUNICODE_STRING DestinationString,
4855     PCWSTR SourceString
4856 );
4857
4858 NTSYSAPI
4859 NTSTATUS
4860 NTAPI
4861 RtlDecompressBuffer (
4862     IN USHORT   CompressionFormat,
4863     OUT PUCHAR  UncompressedBuffer,
4864     IN ULONG    UncompressedBufferSize,
4865     IN PUCHAR   CompressedBuffer,
4866     IN ULONG    CompressedBufferSize,
4867     OUT PULONG  FinalUncompressedSize
4868 );
4869
4870 NTSYSAPI
4871 NTSTATUS
4872 NTAPI
4873 RtlDecompressChunks (
4874     OUT PUCHAR                  UncompressedBuffer,
4875     IN ULONG                    UncompressedBufferSize,
4876     IN PUCHAR                   CompressedBuffer,
4877     IN ULONG                    CompressedBufferSize,
4878     IN PUCHAR                   CompressedTail,
4879     IN ULONG                    CompressedTailSize,
4880     IN PCOMPRESSED_DATA_INFO    CompressedDataInfo
4881 );
4882
4883 NTSYSAPI
4884 NTSTATUS
4885 NTAPI
4886 RtlDecompressFragment (
4887     IN USHORT   CompressionFormat,
4888     OUT PUCHAR  UncompressedFragment,
4889     IN ULONG    UncompressedFragmentSize,
4890     IN PUCHAR   CompressedBuffer,
4891     IN ULONG    CompressedBufferSize,
4892     IN ULONG    FragmentOffset,
4893     OUT PULONG  FinalUncompressedSize,
4894     IN PVOID    WorkSpace
4895 );
4896
4897 NTSYSAPI
4898 NTSTATUS
4899 NTAPI
4900 RtlDescribeChunk (
4901     IN USHORT       CompressionFormat,
4902     IN OUT PUCHAR   *CompressedBuffer,
4903     IN PUCHAR       EndOfCompressedBufferPlus1,
4904     OUT PUCHAR      *ChunkBuffer,
4905     OUT PULONG      ChunkSize
4906 );
4907
4908 NTSYSAPI
4909 NTSTATUS
4910 NTAPI
4911 RtlDowncaseUnicodeString(
4912     IN OUT PUNICODE_STRING UniDest,
4913     IN PCUNICODE_STRING UniSource,
4914     IN BOOLEAN AllocateDestinationString
4915 );
4916
4917 NTSYSAPI
4918 NTSTATUS
4919 NTAPI
4920 RtlDuplicateUnicodeString(
4921     IN ULONG Flags,
4922     IN PCUNICODE_STRING SourceString,
4923     OUT PUNICODE_STRING DestinationString
4924 );
4925
4926 NTSYSAPI
4927 BOOLEAN
4928 NTAPI
4929 RtlEqualSid (
4930     IN PSID Sid1,
4931     IN PSID Sid2
4932 );
4933
4934 NTSYSAPI
4935 VOID
4936 NTAPI
4937 RtlFillMemoryUlong (
4938     IN PVOID    Destination,
4939     IN ULONG    Length,
4940     IN ULONG    Fill
4941 );
4942
4943 NTSYSAPI
4944 BOOLEAN
4945 NTAPI
4946 RtlFreeHeap (
4947     IN HANDLE  HeapHandle,
4948     IN ULONG   Flags,
4949     IN PVOID   P
4950 );
4951
4952 NTSYSAPI
4953 VOID
4954 NTAPI
4955 RtlFreeOemString (
4956     IN POEM_STRING  OemString
4957 );
4958
4959 NTSYSAPI
4960 VOID
4961 NTAPI
4962 RtlGenerate8dot3Name (
4963     IN PUNICODE_STRING              Name,
4964     IN BOOLEAN                      AllowExtendedCharacters,
4965     IN OUT PGENERATE_NAME_CONTEXT   Context,
4966     OUT PUNICODE_STRING             Name8dot3
4967 );
4968
4969 NTSYSAPI
4970 NTSTATUS
4971 NTAPI
4972 RtlGetCompressionWorkSpaceSize (
4973     IN USHORT   CompressionFormatAndEngine,
4974     OUT PULONG  CompressBufferWorkSpaceSize,
4975     OUT PULONG  CompressFragmentWorkSpaceSize
4976 );
4977
4978 NTSYSAPI
4979 NTSTATUS
4980 NTAPI
4981 RtlGetDaclSecurityDescriptor (
4982     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
4983     OUT PBOOLEAN            DaclPresent,
4984     OUT PACL                *Dacl,
4985     OUT PBOOLEAN            DaclDefaulted
4986 );
4987
4988 NTSYSAPI
4989 NTSTATUS
4990 NTAPI
4991 RtlGetGroupSecurityDescriptor (
4992     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
4993     OUT PSID                *Group,
4994     OUT PBOOLEAN            GroupDefaulted
4995 );
4996
4997 NTSYSAPI
4998 NTSTATUS
4999 NTAPI
5000 RtlGetOwnerSecurityDescriptor (
5001     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5002     OUT PSID                *Owner,
5003     OUT PBOOLEAN            OwnerDefaulted
5004 );
5005
5006 NTSYSAPI
5007 NTSTATUS
5008 NTAPI
5009 RtlInitializeSid (
5010     IN OUT PSID                     Sid,
5011     IN PSID_IDENTIFIER_AUTHORITY    IdentifierAuthority,
5012     IN UCHAR                        SubAuthorityCount
5013 );
5014
5015 NTSYSAPI
5016 BOOLEAN
5017 NTAPI
5018 RtlIsNameLegalDOS8Dot3(
5019     IN PCUNICODE_STRING Name,
5020     IN OUT POEM_STRING OemName OPTIONAL,
5021     IN OUT PBOOLEAN NameContainsSpaces OPTIONAL
5022 );
5023
5024 NTSYSAPI
5025 ULONG
5026 NTAPI
5027 RtlLengthRequiredSid (
5028     IN ULONG SubAuthorityCount
5029 );
5030
5031 NTSYSAPI
5032 ULONG
5033 NTAPI
5034 RtlLengthSid (
5035     IN PSID Sid
5036 );
5037
5038 NTSYSAPI
5039 ULONG
5040 NTAPI
5041 RtlNtStatusToDosError (
5042     IN NTSTATUS Status
5043 );
5044
5045 NTSYSAPI
5046 ULONG
5047 NTAPI
5048 RtlxUnicodeStringToOemSize(
5049     PCUNICODE_STRING UnicodeString
5050     );
5051
5052 NTSYSAPI
5053 ULONG
5054 NTAPI
5055 RtlxOemStringToUnicodeSize(
5056     PCOEM_STRING OemString
5057 );
5058
5059 #define RtlOemStringToUnicodeSize(STRING) (                 \
5060     NLS_MB_OEM_CODE_PAGE_TAG ?                              \
5061     RtlxOemStringToUnicodeSize(STRING) :                    \
5062     ((STRING)->Length + sizeof(ANSI_NULL)) * sizeof(WCHAR)  \
5063 )
5064
5065 #define RtlOemStringToCountedUnicodeSize(STRING) (                    \
5066     (ULONG)(RtlOemStringToUnicodeSize(STRING) - sizeof(UNICODE_NULL)) \
5067 )
5068
5069
5070 NTSYSAPI
5071 NTSTATUS
5072 NTAPI
5073 RtlOemStringToUnicodeString(
5074     IN OUT PUNICODE_STRING DestinationString,
5075     IN PCOEM_STRING SourceString,
5076     IN BOOLEAN AllocateDestinationString
5077 );
5078
5079 NTSYSAPI
5080 NTSTATUS
5081 NTAPI
5082 RtlUnicodeStringToOemString(
5083     IN OUT POEM_STRING DestinationString,
5084     IN PCUNICODE_STRING SourceString,
5085     IN BOOLEAN AllocateDestinationString
5086 );
5087
5088 NTSYSAPI
5089 NTSTATUS
5090 NTAPI
5091 RtlOemStringToCountedUnicodeString(
5092     IN OUT PUNICODE_STRING DestinationString,
5093     IN PCOEM_STRING SourceString,
5094     IN BOOLEAN AllocateDestinationString
5095 );
5096
5097 NTSYSAPI
5098 NTSTATUS
5099 NTAPI
5100 RtlUnicodeStringToCountedOemString(
5101     IN OUT POEM_STRING DestinationString,
5102     IN PCUNICODE_STRING SourceString,
5103     IN BOOLEAN AllocateDestinationString
5104 );
5105
5106 NTSYSAPI
5107 NTSTATUS
5108 NTAPI
5109 RtlReserveChunk (
5110     IN USHORT       CompressionFormat,
5111     IN OUT PUCHAR   *CompressedBuffer,
5112     IN PUCHAR       EndOfCompressedBufferPlus1,
5113     OUT PUCHAR      *ChunkBuffer,
5114     IN ULONG        ChunkSize
5115 );
5116
5117 NTSYSAPI
5118 VOID
5119 NTAPI
5120 RtlSecondsSince1970ToTime (
5121     IN ULONG            SecondsSince1970,
5122     OUT PLARGE_INTEGER  Time
5123 );
5124
5125 NTSYSAPI
5126 NTSTATUS
5127 NTAPI
5128 RtlSetGroupSecurityDescriptor (
5129     IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
5130     IN PSID                     Group,
5131     IN BOOLEAN                  GroupDefaulted
5132 );
5133
5134 NTSYSAPI
5135 NTSTATUS
5136 NTAPI
5137 RtlSetOwnerSecurityDescriptor (
5138     IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
5139     IN PSID                     Owner,
5140     IN BOOLEAN                  OwnerDefaulted
5141 );
5142
5143 NTSYSAPI
5144 NTSTATUS
5145 NTAPI
5146 RtlSetSaclSecurityDescriptor (
5147     IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
5148     IN BOOLEAN                  SaclPresent,
5149     IN PACL                     Sacl,
5150     IN BOOLEAN                  SaclDefaulted
5151 );
5152
5153 NTSYSAPI
5154 PUCHAR
5155 NTAPI
5156 RtlSubAuthorityCountSid (
5157     IN PSID Sid
5158 );
5159
5160 NTSYSAPI
5161 PULONG
5162 NTAPI
5163 RtlSubAuthoritySid (
5164     IN PSID    Sid,
5165     IN ULONG   SubAuthority
5166 );
5167
5168 NTSYSAPI
5169 NTSTATUS
5170 NTAPI
5171 RtlUnicodeStringToCountedOemString (
5172     IN OUT POEM_STRING  DestinationString,
5173     IN PCUNICODE_STRING SourceString,
5174     IN BOOLEAN          AllocateDestinationString
5175 );
5176
5177 NTSYSAPI
5178 NTSTATUS
5179 NTAPI
5180 RtlUnicodeToMultiByteN(
5181     OUT PCHAR MultiByteString,
5182     IN ULONG MaxBytesInMultiByteString,
5183     OUT PULONG BytesInMultiByteString OPTIONAL,
5184     IN PWCH UnicodeString,
5185     IN ULONG BytesInUnicodeString
5186 );
5187
5188 NTSYSAPI
5189 NTSTATUS
5190 NTAPI
5191 RtlOemToUnicodeN(
5192     OUT PWSTR UnicodeString,
5193     IN ULONG MaxBytesInUnicodeString,
5194     OUT PULONG BytesInUnicodeString OPTIONAL,
5195     IN PCH OemString,
5196     IN ULONG BytesInOemString
5197 );
5198
5199 /* RTL Splay Tree Functions */
5200 NTSYSAPI
5201 PRTL_SPLAY_LINKS
5202 NTAPI
5203 RtlSplay(PRTL_SPLAY_LINKS Links);
5204
5205 NTSYSAPI
5206 PRTL_SPLAY_LINKS
5207 NTAPI
5208 RtlDelete(PRTL_SPLAY_LINKS Links);
5209
5210 NTSYSAPI
5211 VOID
5212 NTAPI
5213 RtlDeleteNoSplay(
5214     PRTL_SPLAY_LINKS Links,
5215     PRTL_SPLAY_LINKS *Root
5216 );
5217
5218 NTSYSAPI
5219 PRTL_SPLAY_LINKS
5220 NTAPI
5221 RtlSubtreeSuccessor(PRTL_SPLAY_LINKS Links);
5222
5223 NTSYSAPI
5224 PRTL_SPLAY_LINKS
5225 NTAPI
5226 RtlSubtreePredecessor(PRTL_SPLAY_LINKS Links);
5227
5228 NTSYSAPI
5229 PRTL_SPLAY_LINKS
5230 NTAPI
5231 RtlRealSuccessor(PRTL_SPLAY_LINKS Links);
5232
5233 NTSYSAPI
5234 PRTL_SPLAY_LINKS
5235 NTAPI
5236 RtlRealPredecessor(PRTL_SPLAY_LINKS Links);
5237
5238 #define RtlIsLeftChild(Links) \
5239     (RtlLeftChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
5240
5241 #define RtlIsRightChild(Links) \
5242     (RtlRightChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
5243
5244 #define RtlRightChild(Links) \
5245     ((PRTL_SPLAY_LINKS)(Links))->RightChild
5246
5247 #define RtlIsRoot(Links) \
5248     (RtlParent(Links) == (PRTL_SPLAY_LINKS)(Links))
5249
5250 #define RtlLeftChild(Links) \
5251     ((PRTL_SPLAY_LINKS)(Links))->LeftChild
5252
5253 #define RtlParent(Links) \
5254     ((PRTL_SPLAY_LINKS)(Links))->Parent
5255
5256 #define RtlInitializeSplayLinks(Links)                  \
5257     {                                                   \
5258         PRTL_SPLAY_LINKS _SplayLinks;                   \
5259         _SplayLinks = (PRTL_SPLAY_LINKS)(Links);        \
5260         _SplayLinks->Parent = _SplayLinks;              \
5261         _SplayLinks->LeftChild = NULL;                  \
5262         _SplayLinks->RightChild = NULL;                 \
5263     }
5264
5265 #define RtlInsertAsLeftChild(ParentLinks,ChildLinks)    \
5266     {                                                   \
5267         PRTL_SPLAY_LINKS _SplayParent;                  \
5268         PRTL_SPLAY_LINKS _SplayChild;                   \
5269         _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
5270         _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks);   \
5271         _SplayParent->LeftChild = _SplayChild;          \
5272         _SplayChild->Parent = _SplayParent;             \
5273     }
5274
5275 #define RtlInsertAsRightChild(ParentLinks,ChildLinks)   \
5276     {                                                   \
5277         PRTL_SPLAY_LINKS _SplayParent;                  \
5278         PRTL_SPLAY_LINKS _SplayChild;                   \
5279         _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
5280         _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks);   \
5281         _SplayParent->RightChild = _SplayChild;         \
5282         _SplayChild->Parent = _SplayParent;             \
5283     }
5284
5285 NTSYSAPI
5286 BOOLEAN
5287 NTAPI
5288 RtlValidSid (
5289     IN PSID Sid
5290 );
5291
5292 //
5293 // RTL time functions
5294 //
5295
5296 NTSYSAPI
5297 BOOLEAN
5298 NTAPI
5299 RtlTimeToSecondsSince1980 (
5300     PLARGE_INTEGER Time,
5301     PULONG ElapsedSeconds
5302 );
5303
5304 NTSYSAPI
5305 VOID
5306 NTAPI
5307 RtlSecondsSince1980ToTime (
5308     ULONG ElapsedSeconds,
5309     PLARGE_INTEGER Time
5310 );
5311
5312 NTSYSAPI
5313 BOOLEAN
5314 NTAPI
5315 RtlTimeToSecondsSince1970 (
5316     PLARGE_INTEGER Time,
5317     PULONG ElapsedSeconds
5318 );
5319
5320 NTSYSAPI
5321 VOID
5322 NTAPI
5323 RtlSecondsSince1970ToTime (
5324     ULONG ElapsedSeconds,
5325     PLARGE_INTEGER Time
5326 );
5327
5328 NTKERNELAPI
5329 NTSTATUS
5330 NTAPI
5331 SeAppendPrivileges (
5332     PACCESS_STATE   AccessState,
5333     PPRIVILEGE_SET  Privileges
5334 );
5335
5336 NTKERNELAPI
5337 BOOLEAN
5338 NTAPI
5339 SeAuditingFileEvents (
5340     IN BOOLEAN              AccessGranted,
5341     IN PSECURITY_DESCRIPTOR SecurityDescriptor
5342 );
5343
5344 NTKERNELAPI
5345 BOOLEAN
5346 NTAPI
5347 SeAuditingFileOrGlobalEvents (
5348     IN BOOLEAN                      AccessGranted,
5349     IN PSECURITY_DESCRIPTOR         SecurityDescriptor,
5350     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext
5351 );
5352
5353 NTKERNELAPI
5354 VOID
5355 NTAPI
5356 SeCaptureSubjectContext (
5357     OUT PSECURITY_SUBJECT_CONTEXT SubjectContext
5358 );
5359
5360 NTKERNELAPI
5361 NTSTATUS
5362 NTAPI
5363 SeCreateClientSecurity (
5364     IN PETHREAD                     Thread,
5365     IN PSECURITY_QUALITY_OF_SERVICE QualityOfService,
5366     IN BOOLEAN                      RemoteClient,
5367     OUT PSECURITY_CLIENT_CONTEXT    ClientContext
5368 );
5369
5370 #if (VER_PRODUCTBUILD >= 2195)
5371
5372 NTKERNELAPI
5373 NTSTATUS
5374 NTAPI
5375 SeCreateClientSecurityFromSubjectContext (
5376     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext,
5377     IN PSECURITY_QUALITY_OF_SERVICE QualityOfService,
5378     IN BOOLEAN                      ServerIsRemote,
5379     OUT PSECURITY_CLIENT_CONTEXT    ClientContext
5380 );
5381
5382 #endif /* (VER_PRODUCTBUILD >= 2195) */
5383
5384
5385 #define SeLengthSid( Sid ) \
5386     (8 + (4 * ((SID *)Sid)->SubAuthorityCount))
5387
5388 #define SeDeleteClientSecurity(C)  {                                           \
5389             if (SeTokenType((C)->ClientToken) == TokenPrimary) {               \
5390                 PsDereferencePrimaryToken( (C)->ClientToken );                 \
5391             } else {                                                           \
5392                 PsDereferenceImpersonationToken( (C)->ClientToken );           \
5393             }                                                                  \
5394 }
5395
5396 NTKERNELAPI
5397 VOID
5398 NTAPI
5399 SeDeleteObjectAuditAlarm (
5400     IN PVOID    Object,
5401     IN HANDLE   Handle
5402 );
5403
5404 #define SeEnableAccessToExports() SeExports = *(PSE_EXPORTS *)SeExports;
5405
5406 NTKERNELAPI
5407 VOID
5408 NTAPI
5409 SeFreePrivileges (
5410     IN PPRIVILEGE_SET Privileges
5411 );
5412
5413 NTKERNELAPI
5414 VOID
5415 NTAPI
5416 SeImpersonateClient (
5417     IN PSECURITY_CLIENT_CONTEXT ClientContext,
5418     IN PETHREAD                 ServerThread OPTIONAL
5419 );
5420
5421 #if (VER_PRODUCTBUILD >= 2195)
5422
5423 NTKERNELAPI
5424 NTSTATUS
5425 NTAPI
5426 SeImpersonateClientEx (
5427     IN PSECURITY_CLIENT_CONTEXT ClientContext,
5428     IN PETHREAD                 ServerThread OPTIONAL
5429 );
5430
5431 #endif /* (VER_PRODUCTBUILD >= 2195) */
5432
5433 NTKERNELAPI
5434 VOID
5435 NTAPI
5436 SeLockSubjectContext (
5437     IN PSECURITY_SUBJECT_CONTEXT SubjectContext
5438 );
5439
5440 NTKERNELAPI
5441 NTSTATUS
5442 NTAPI
5443 SeMarkLogonSessionForTerminationNotification (
5444     IN PLUID LogonId
5445 );
5446
5447 NTKERNELAPI
5448 VOID
5449 NTAPI
5450 SeOpenObjectAuditAlarm (
5451     IN PUNICODE_STRING      ObjectTypeName,
5452     IN PVOID                Object OPTIONAL,
5453     IN PUNICODE_STRING      AbsoluteObjectName OPTIONAL,
5454     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5455     IN PACCESS_STATE        AccessState,
5456     IN BOOLEAN              ObjectCreated,
5457     IN BOOLEAN              AccessGranted,
5458     IN KPROCESSOR_MODE      AccessMode,
5459     OUT PBOOLEAN            GenerateOnClose
5460 );
5461
5462 NTKERNELAPI
5463 VOID
5464 NTAPI
5465 SeOpenObjectForDeleteAuditAlarm (
5466     IN PUNICODE_STRING      ObjectTypeName,
5467     IN PVOID                Object OPTIONAL,
5468     IN PUNICODE_STRING      AbsoluteObjectName OPTIONAL,
5469     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5470     IN PACCESS_STATE        AccessState,
5471     IN BOOLEAN              ObjectCreated,
5472     IN BOOLEAN              AccessGranted,
5473     IN KPROCESSOR_MODE      AccessMode,
5474     OUT PBOOLEAN            GenerateOnClose
5475 );
5476
5477 NTKERNELAPI
5478 BOOLEAN
5479 NTAPI
5480 SePrivilegeCheck (
5481     IN OUT PPRIVILEGE_SET           RequiredPrivileges,
5482     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext,
5483     IN KPROCESSOR_MODE              AccessMode
5484 );
5485
5486 NTKERNELAPI
5487 NTSTATUS
5488 NTAPI
5489 SeQueryAuthenticationIdToken (
5490     IN PACCESS_TOKEN    Token,
5491     OUT PLUID           LogonId
5492 );
5493
5494 #if (VER_PRODUCTBUILD >= 2195)
5495
5496 NTKERNELAPI
5497 NTSTATUS
5498 NTAPI
5499 SeQueryInformationToken (
5500     IN PACCESS_TOKEN           Token,
5501     IN TOKEN_INFORMATION_CLASS TokenInformationClass,
5502     OUT PVOID                  *TokenInformation
5503 );
5504
5505 #endif /* (VER_PRODUCTBUILD >= 2195) */
5506
5507 NTKERNELAPI
5508 NTSTATUS
5509 NTAPI
5510 SeQuerySecurityDescriptorInfo (
5511     IN PSECURITY_INFORMATION    SecurityInformation,
5512     OUT PSECURITY_DESCRIPTOR    SecurityDescriptor,
5513     IN OUT PULONG               Length,
5514     IN PSECURITY_DESCRIPTOR     *ObjectsSecurityDescriptor
5515 );
5516
5517 #if (VER_PRODUCTBUILD >= 2195)
5518
5519 NTKERNELAPI
5520 NTSTATUS
5521 NTAPI
5522 SeQuerySessionIdToken (
5523     IN PACCESS_TOKEN    Token,
5524     IN PULONG           SessionId
5525 );
5526
5527 #endif /* (VER_PRODUCTBUILD >= 2195) */
5528
5529 #define SeQuerySubjectContextToken( SubjectContext )                \
5530     ( ARGUMENT_PRESENT(                                             \
5531         ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken   \
5532         ) ?                                                         \
5533     ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken :     \
5534     ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
5535
5536 typedef NTSTATUS (NTAPI *PSE_LOGON_SESSION_TERMINATED_ROUTINE) (
5537     IN PLUID LogonId
5538 );
5539
5540 NTKERNELAPI
5541 NTSTATUS
5542 NTAPI
5543 SeRegisterLogonSessionTerminatedRoutine (
5544     IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
5545 );
5546
5547 NTKERNELAPI
5548 VOID
5549 NTAPI
5550 SeReleaseSubjectContext (
5551     IN PSECURITY_SUBJECT_CONTEXT SubjectContext
5552 );
5553
5554 NTKERNELAPI
5555 VOID
5556 NTAPI
5557 SeSetAccessStateGenericMapping (
5558     PACCESS_STATE       AccessState,
5559     PGENERIC_MAPPING    GenericMapping
5560 );
5561
5562 NTKERNELAPI
5563 NTSTATUS
5564 NTAPI
5565 SeSetSecurityDescriptorInfo (
5566     IN PVOID                    Object OPTIONAL,
5567     IN PSECURITY_INFORMATION    SecurityInformation,
5568     IN PSECURITY_DESCRIPTOR     SecurityDescriptor,
5569     IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
5570     IN POOL_TYPE                PoolType,
5571     IN PGENERIC_MAPPING         GenericMapping
5572 );
5573
5574 #if (VER_PRODUCTBUILD >= 2195)
5575
5576 NTKERNELAPI
5577 NTSTATUS
5578 NTAPI
5579 SeSetSecurityDescriptorInfoEx (
5580     IN PVOID                    Object OPTIONAL,
5581     IN PSECURITY_INFORMATION    SecurityInformation,
5582     IN PSECURITY_DESCRIPTOR     ModificationDescriptor,
5583     IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
5584     IN ULONG                    AutoInheritFlags,
5585     IN POOL_TYPE                PoolType,
5586     IN PGENERIC_MAPPING         GenericMapping
5587 );
5588
5589 NTKERNELAPI
5590 BOOLEAN
5591 NTAPI
5592 SeTokenIsAdmin (
5593     IN PACCESS_TOKEN Token
5594 );
5595
5596 NTKERNELAPI
5597 BOOLEAN
5598 NTAPI
5599 SeTokenIsRestricted (
5600     IN PACCESS_TOKEN Token
5601 );
5602
5603
5604 NTSTATUS
5605 NTAPI
5606 SeLocateProcessImageName(
5607     IN PEPROCESS Process,
5608     OUT PUNICODE_STRING *pImageFileName
5609 );
5610
5611 #endif /* (VER_PRODUCTBUILD >= 2195) */
5612
5613 NTKERNELAPI
5614 TOKEN_TYPE
5615 NTAPI
5616 SeTokenType (
5617     IN PACCESS_TOKEN Token
5618 );
5619
5620 NTKERNELAPI
5621 VOID
5622 NTAPI
5623 SeUnlockSubjectContext (
5624     IN PSECURITY_SUBJECT_CONTEXT SubjectContext
5625 );
5626
5627 NTKERNELAPI
5628 NTSTATUS
5629 NTAPI
5630 SeUnregisterLogonSessionTerminatedRoutine (
5631     IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
5632 );
5633
5634 #if (VER_PRODUCTBUILD >= 2195)
5635
5636 NTSYSAPI
5637 NTSTATUS
5638 NTAPI
5639 ZwAdjustPrivilegesToken (
5640     IN HANDLE               TokenHandle,
5641     IN BOOLEAN              DisableAllPrivileges,
5642     IN PTOKEN_PRIVILEGES    NewState,
5643     IN ULONG                BufferLength,
5644     OUT PTOKEN_PRIVILEGES   PreviousState OPTIONAL,
5645     OUT PULONG              ReturnLength
5646 );
5647
5648 #endif /* (VER_PRODUCTBUILD >= 2195) */
5649
5650 NTSYSAPI
5651 NTSTATUS
5652 NTAPI
5653 ZwAlertThread (
5654     IN HANDLE ThreadHandle
5655 );
5656
5657 NTSYSAPI
5658 NTSTATUS
5659 NTAPI
5660 ZwAllocateVirtualMemory (
5661     IN HANDLE       ProcessHandle,
5662     IN OUT PVOID    *BaseAddress,
5663     IN ULONG_PTR    ZeroBits,
5664     IN OUT PSIZE_T  RegionSize,
5665     IN ULONG        AllocationType,
5666     IN ULONG        Protect
5667 );
5668
5669 NTSTATUS
5670 NTAPI
5671 NtAccessCheckByTypeAndAuditAlarm(
5672     IN PUNICODE_STRING SubsystemName,
5673     IN HANDLE HandleId,
5674     IN PUNICODE_STRING ObjectTypeName,
5675     IN PUNICODE_STRING ObjectName,
5676     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5677     IN PSID PrincipalSelfSid,
5678     IN ACCESS_MASK DesiredAccess,
5679     IN AUDIT_EVENT_TYPE AuditType,
5680     IN ULONG Flags,
5681     IN POBJECT_TYPE_LIST ObjectTypeList,
5682     IN ULONG ObjectTypeLength,
5683     IN PGENERIC_MAPPING GenericMapping,
5684     IN BOOLEAN ObjectCreation,
5685     OUT PACCESS_MASK GrantedAccess,
5686     OUT PNTSTATUS AccessStatus,
5687     OUT PBOOLEAN GenerateOnClose
5688 );
5689
5690 NTSTATUS
5691 NTAPI
5692 NtAccessCheckByTypeResultListAndAuditAlarm(
5693     IN PUNICODE_STRING SubsystemName,
5694     IN HANDLE HandleId,
5695     IN PUNICODE_STRING ObjectTypeName,
5696     IN PUNICODE_STRING ObjectName,
5697     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5698     IN PSID PrincipalSelfSid,
5699     IN ACCESS_MASK DesiredAccess,
5700     IN AUDIT_EVENT_TYPE AuditType,
5701     IN ULONG Flags,
5702     IN POBJECT_TYPE_LIST ObjectTypeList,
5703     IN ULONG ObjectTypeLength,
5704     IN PGENERIC_MAPPING GenericMapping,
5705     IN BOOLEAN ObjectCreation,
5706     OUT PACCESS_MASK GrantedAccess,
5707     OUT PNTSTATUS AccessStatus,
5708     OUT PBOOLEAN GenerateOnClose
5709 );
5710
5711 NTSTATUS
5712 NTAPI
5713 NtAccessCheckByTypeResultListAndAuditAlarmByHandle(
5714     IN PUNICODE_STRING SubsystemName,
5715     IN HANDLE HandleId,
5716     IN HANDLE ClientToken,
5717     IN PUNICODE_STRING ObjectTypeName,
5718     IN PUNICODE_STRING ObjectName,
5719     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5720     IN PSID PrincipalSelfSid,
5721     IN ACCESS_MASK DesiredAccess,
5722     IN AUDIT_EVENT_TYPE AuditType,
5723     IN ULONG Flags,
5724     IN POBJECT_TYPE_LIST ObjectTypeList,
5725     IN ULONG ObjectTypeLength,
5726     IN PGENERIC_MAPPING GenericMapping,
5727     IN BOOLEAN ObjectCreation,
5728     OUT PACCESS_MASK GrantedAccess,
5729     OUT PNTSTATUS AccessStatus,
5730     OUT PBOOLEAN GenerateOnClose
5731 );
5732
5733 NTSYSAPI
5734 NTSTATUS
5735 NTAPI
5736 ZwAccessCheckAndAuditAlarm (
5737     IN PUNICODE_STRING      SubsystemName,
5738     IN PVOID                HandleId,
5739     IN PUNICODE_STRING      ObjectTypeName,
5740     IN PUNICODE_STRING      ObjectName,
5741     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5742     IN ACCESS_MASK          DesiredAccess,
5743     IN PGENERIC_MAPPING     GenericMapping,
5744     IN BOOLEAN              ObjectCreation,
5745     OUT PACCESS_MASK        GrantedAccess,
5746     OUT PBOOLEAN            AccessStatus,
5747     OUT PBOOLEAN            GenerateOnClose
5748 );
5749
5750 #if (VER_PRODUCTBUILD >= 2195)
5751
5752 NTSYSAPI
5753 NTSTATUS
5754 NTAPI
5755 ZwCancelIoFile (
5756     IN HANDLE               FileHandle,
5757     OUT PIO_STATUS_BLOCK    IoStatusBlock
5758 );
5759
5760 #endif /* (VER_PRODUCTBUILD >= 2195) */
5761
5762 NTSYSAPI
5763 NTSTATUS
5764 NTAPI
5765 ZwClearEvent (
5766     IN HANDLE EventHandle
5767 );
5768
5769 NTSYSAPI
5770 NTSTATUS
5771 NTAPI
5772 ZwCloseObjectAuditAlarm (
5773     IN PUNICODE_STRING  SubsystemName,
5774     IN PVOID            HandleId,
5775     IN BOOLEAN          GenerateOnClose
5776 );
5777
5778 NTSYSAPI
5779 NTSTATUS
5780 NTAPI
5781 ZwCreateSection (
5782     OUT PHANDLE             SectionHandle,
5783     IN ACCESS_MASK          DesiredAccess,
5784     IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
5785     IN PLARGE_INTEGER       MaximumSize OPTIONAL,
5786     IN ULONG                SectionPageProtection,
5787     IN ULONG                AllocationAttributes,
5788     IN HANDLE               FileHandle OPTIONAL
5789 );
5790
5791 NTSYSAPI
5792 NTSTATUS
5793 NTAPI
5794 ZwCreateSymbolicLinkObject (
5795     OUT PHANDLE             SymbolicLinkHandle,
5796     IN ACCESS_MASK          DesiredAccess,
5797     IN POBJECT_ATTRIBUTES   ObjectAttributes,
5798     IN PUNICODE_STRING      TargetName
5799 );
5800
5801 NTSYSAPI
5802 NTSTATUS
5803 NTAPI
5804 ZwDeleteFile (
5805     IN POBJECT_ATTRIBUTES ObjectAttributes
5806 );
5807
5808 NTSYSAPI
5809 NTSTATUS
5810 NTAPI
5811 ZwDeleteValueKey (
5812     IN HANDLE           Handle,
5813     IN PUNICODE_STRING  Name
5814 );
5815
5816
5817 #if (NTDDI_VERSION >= NTDDI_WIN2K)
5818 NTSYSAPI
5819 NTSTATUS
5820 NTAPI
5821 ZwDeviceIoControlFile (
5822   IN HANDLE FileHandle,
5823   IN HANDLE Event OPTIONAL,
5824   IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
5825   IN PVOID ApcContext OPTIONAL,
5826   OUT PIO_STATUS_BLOCK IoStatusBlock,
5827   IN ULONG IoControlCode,
5828   IN PVOID InputBuffer OPTIONAL,
5829   IN ULONG InputBufferLength,
5830   OUT PVOID OutputBuffer OPTIONAL,
5831   IN ULONG OutputBufferLength);
5832 #endif
5833
5834 NTSYSAPI
5835 NTSTATUS
5836 NTAPI
5837 ZwDisplayString (
5838     IN PUNICODE_STRING String
5839 );
5840
5841 NTSYSAPI
5842 NTSTATUS
5843 NTAPI
5844 ZwDuplicateObject (
5845     IN HANDLE       SourceProcessHandle,
5846     IN HANDLE       SourceHandle,
5847     IN HANDLE       TargetProcessHandle OPTIONAL,
5848     OUT PHANDLE     TargetHandle OPTIONAL,
5849     IN ACCESS_MASK  DesiredAccess,
5850     IN ULONG        HandleAttributes,
5851     IN ULONG        Options
5852 );
5853
5854 NTSYSAPI
5855 NTSTATUS
5856 NTAPI
5857 ZwDuplicateToken (
5858     IN HANDLE               ExistingTokenHandle,
5859     IN ACCESS_MASK          DesiredAccess,
5860     IN POBJECT_ATTRIBUTES   ObjectAttributes,
5861     IN BOOLEAN              EffectiveOnly,
5862     IN TOKEN_TYPE           TokenType,
5863     OUT PHANDLE             NewTokenHandle
5864 );
5865
5866 NTSTATUS
5867 NTAPI
5868 NtFilterToken(
5869     IN HANDLE ExistingTokenHandle,
5870     IN ULONG Flags,
5871     IN PTOKEN_GROUPS SidsToDisable OPTIONAL,
5872     IN PTOKEN_PRIVILEGES PrivilegesToDelete OPTIONAL,
5873     IN PTOKEN_GROUPS RestrictedSids OPTIONAL,
5874     OUT PHANDLE NewTokenHandle
5875 );
5876
5877 NTSYSAPI
5878 NTSTATUS
5879 NTAPI
5880 ZwFlushInstructionCache (
5881     IN HANDLE   ProcessHandle,
5882     IN PVOID    BaseAddress OPTIONAL,
5883     IN ULONG    FlushSize
5884 );
5885
5886 NTSYSAPI
5887 NTSTATUS
5888 NTAPI
5889 ZwFlushBuffersFile(
5890     IN HANDLE FileHandle,
5891     OUT PIO_STATUS_BLOCK IoStatusBlock
5892 );
5893
5894 #if (VER_PRODUCTBUILD >= 2195)
5895
5896 NTSYSAPI
5897 NTSTATUS
5898 NTAPI
5899 ZwFlushVirtualMemory (
5900     IN HANDLE               ProcessHandle,
5901     IN OUT PVOID            *BaseAddress,
5902     IN OUT PULONG           FlushSize,
5903     OUT PIO_STATUS_BLOCK    IoStatusBlock
5904 );
5905
5906 #endif /* (VER_PRODUCTBUILD >= 2195) */
5907
5908 NTSYSAPI
5909 NTSTATUS
5910 NTAPI
5911 ZwFreeVirtualMemory (
5912     IN HANDLE       ProcessHandle,
5913     IN OUT PVOID    *BaseAddress,
5914     IN OUT PSIZE_T  RegionSize,
5915     IN ULONG        FreeType
5916 );
5917
5918 NTSYSAPI
5919 NTSTATUS
5920 NTAPI
5921 ZwFsControlFile (
5922     IN HANDLE               FileHandle,
5923     IN HANDLE               Event OPTIONAL,
5924     IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
5925     IN PVOID                ApcContext OPTIONAL,
5926     OUT PIO_STATUS_BLOCK    IoStatusBlock,
5927     IN ULONG                FsControlCode,
5928     IN PVOID                InputBuffer OPTIONAL,
5929     IN ULONG                InputBufferLength,
5930     OUT PVOID               OutputBuffer OPTIONAL,
5931     IN ULONG                OutputBufferLength
5932 );
5933
5934 #if (VER_PRODUCTBUILD >= 2195)
5935
5936 NTSYSAPI
5937 NTSTATUS
5938 NTAPI
5939 ZwInitiatePowerAction (
5940     IN POWER_ACTION         SystemAction,
5941     IN SYSTEM_POWER_STATE   MinSystemState,
5942     IN ULONG                Flags,
5943     IN BOOLEAN              Asynchronous
5944 );
5945
5946 #endif /* (VER_PRODUCTBUILD >= 2195) */
5947
5948 NTSYSAPI
5949 NTSTATUS
5950 NTAPI
5951 ZwLoadDriver (
5952     /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
5953     IN PUNICODE_STRING RegistryPath
5954 );
5955
5956 NTSYSAPI
5957 NTSTATUS
5958 NTAPI
5959 ZwLoadKey (
5960     IN POBJECT_ATTRIBUTES KeyObjectAttributes,
5961     IN POBJECT_ATTRIBUTES FileObjectAttributes
5962 );
5963
5964 NTSYSAPI
5965 NTSTATUS
5966 NTAPI
5967 ZwNotifyChangeKey (
5968     IN HANDLE               KeyHandle,
5969     IN HANDLE               EventHandle OPTIONAL,
5970     IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
5971     IN PVOID                ApcContext OPTIONAL,
5972     OUT PIO_STATUS_BLOCK    IoStatusBlock,
5973     IN ULONG                NotifyFilter,
5974     IN BOOLEAN              WatchSubtree,
5975     IN PVOID                Buffer,
5976     IN ULONG                BufferLength,
5977     IN BOOLEAN              Asynchronous
5978 );
5979
5980 NTSYSAPI
5981 NTSTATUS
5982 NTAPI
5983 ZwOpenDirectoryObject (
5984     OUT PHANDLE             DirectoryHandle,
5985     IN ACCESS_MASK          DesiredAccess,
5986     IN POBJECT_ATTRIBUTES   ObjectAttributes
5987 );
5988
5989 NTSYSAPI
5990 NTSTATUS
5991 NTAPI
5992 ZwOpenEvent (
5993     OUT PHANDLE             EventHandle,
5994     IN ACCESS_MASK          DesiredAccess,
5995     IN POBJECT_ATTRIBUTES   ObjectAttributes
5996 );
5997
5998 NTSYSAPI
5999 NTSTATUS
6000 NTAPI
6001 ZwOpenProcess (
6002     OUT PHANDLE             ProcessHandle,
6003     IN ACCESS_MASK          DesiredAccess,
6004     IN POBJECT_ATTRIBUTES   ObjectAttributes,
6005     IN PCLIENT_ID           ClientId OPTIONAL
6006 );
6007
6008 NTSYSAPI
6009 NTSTATUS
6010 NTAPI
6011 ZwOpenProcessToken (
6012     IN HANDLE       ProcessHandle,
6013     IN ACCESS_MASK  DesiredAccess,
6014     OUT PHANDLE     TokenHandle
6015 );
6016
6017 NTSYSAPI
6018 NTSTATUS
6019 NTAPI
6020 ZwOpenThread (
6021     OUT PHANDLE             ThreadHandle,
6022     IN ACCESS_MASK          DesiredAccess,
6023     IN POBJECT_ATTRIBUTES   ObjectAttributes,
6024     IN PCLIENT_ID           ClientId
6025 );
6026
6027 NTSYSAPI
6028 NTSTATUS
6029 NTAPI
6030 ZwOpenThreadToken (
6031     IN HANDLE       ThreadHandle,
6032     IN ACCESS_MASK  DesiredAccess,
6033     IN BOOLEAN      OpenAsSelf,
6034     OUT PHANDLE     TokenHandle
6035 );
6036
6037 #if (VER_PRODUCTBUILD >= 2195)
6038
6039 NTSYSAPI
6040 NTSTATUS
6041 NTAPI
6042 ZwPowerInformation (
6043     IN POWER_INFORMATION_LEVEL  PowerInformationLevel,
6044     IN PVOID                    InputBuffer OPTIONAL,
6045     IN ULONG                    InputBufferLength,
6046     OUT PVOID                   OutputBuffer OPTIONAL,
6047     IN ULONG                    OutputBufferLength
6048 );
6049
6050 #endif /* (VER_PRODUCTBUILD >= 2195) */
6051
6052 NTSYSAPI
6053 NTSTATUS
6054 NTAPI
6055 ZwPulseEvent (
6056     IN HANDLE   EventHandle,
6057     OUT PLONG   PreviousState OPTIONAL
6058 );
6059
6060 NTSYSAPI
6061 NTSTATUS
6062 NTAPI
6063 ZwQueryDefaultLocale (
6064     IN BOOLEAN  ThreadOrSystem,
6065     OUT PLCID   Locale
6066 );
6067
6068 NTSYSAPI
6069 NTSTATUS
6070 NTAPI
6071 ZwQueryDirectoryFile (
6072     IN HANDLE                   FileHandle,
6073     IN HANDLE                   Event OPTIONAL,
6074     IN PIO_APC_ROUTINE          ApcRoutine OPTIONAL,
6075     IN PVOID                    ApcContext OPTIONAL,
6076     OUT PIO_STATUS_BLOCK        IoStatusBlock,
6077     OUT PVOID                   FileInformation,
6078     IN ULONG                    Length,
6079     IN FILE_INFORMATION_CLASS   FileInformationClass,
6080     IN BOOLEAN                  ReturnSingleEntry,
6081     IN PUNICODE_STRING          FileName OPTIONAL,
6082     IN BOOLEAN                  RestartScan
6083 );
6084
6085 #if (VER_PRODUCTBUILD >= 2195)
6086
6087 NTSYSAPI
6088 NTSTATUS
6089 NTAPI
6090 ZwQueryDirectoryObject (
6091     IN HANDLE       DirectoryHandle,
6092     OUT PVOID       Buffer,
6093     IN ULONG        Length,
6094     IN BOOLEAN      ReturnSingleEntry,
6095     IN BOOLEAN      RestartScan,
6096     IN OUT PULONG   Context,
6097     OUT PULONG      ReturnLength OPTIONAL
6098 );
6099
6100 NTSYSAPI
6101 NTSTATUS
6102 NTAPI
6103 ZwQueryEaFile (
6104     IN HANDLE               FileHandle,
6105     OUT PIO_STATUS_BLOCK    IoStatusBlock,
6106     OUT PVOID               Buffer,
6107     IN ULONG                Length,
6108     IN BOOLEAN              ReturnSingleEntry,
6109     IN PVOID                EaList OPTIONAL,
6110     IN ULONG                EaListLength,
6111     IN PULONG               EaIndex OPTIONAL,
6112     IN BOOLEAN              RestartScan
6113 );
6114
6115 #endif /* (VER_PRODUCTBUILD >= 2195) */
6116
6117 NTSYSAPI
6118 NTSTATUS
6119 NTAPI
6120 ZwQueryInformationProcess (
6121     IN HANDLE           ProcessHandle,
6122     IN PROCESSINFOCLASS ProcessInformationClass,
6123     OUT PVOID           ProcessInformation,
6124     IN ULONG            ProcessInformationLength,
6125     OUT PULONG          ReturnLength OPTIONAL
6126 );
6127
6128 NTSYSAPI
6129 NTSTATUS
6130 NTAPI
6131 ZwQueryInformationToken (
6132     IN HANDLE                   TokenHandle,
6133     IN TOKEN_INFORMATION_CLASS  TokenInformationClass,
6134     OUT PVOID                   TokenInformation,
6135     IN ULONG                    Length,
6136     OUT PULONG                  ResultLength
6137 );
6138
6139 NTSYSAPI
6140 NTSTATUS
6141 NTAPI
6142 ZwQuerySecurityObject (
6143     IN HANDLE                   FileHandle,
6144     IN SECURITY_INFORMATION     SecurityInformation,
6145     OUT PSECURITY_DESCRIPTOR    SecurityDescriptor,
6146     IN ULONG                    Length,
6147     OUT PULONG                  ResultLength
6148 );
6149
6150 NTSYSAPI
6151 NTSTATUS
6152 NTAPI
6153 ZwQueryVolumeInformationFile (
6154     IN HANDLE               FileHandle,
6155     OUT PIO_STATUS_BLOCK    IoStatusBlock,
6156     OUT PVOID               FsInformation,
6157     IN ULONG                Length,
6158     IN FS_INFORMATION_CLASS FsInformationClass
6159 );
6160
6161 NTSYSAPI
6162 NTSTATUS
6163 NTAPI
6164 ZwReplaceKey (
6165     IN POBJECT_ATTRIBUTES   NewFileObjectAttributes,
6166     IN HANDLE               KeyHandle,
6167     IN POBJECT_ATTRIBUTES   OldFileObjectAttributes
6168 );
6169
6170 NTSYSAPI
6171 NTSTATUS
6172 NTAPI
6173 ZwResetEvent (
6174     IN HANDLE   EventHandle,
6175     OUT PLONG   PreviousState OPTIONAL
6176 );
6177
6178 #if (VER_PRODUCTBUILD >= 2195)
6179
6180 NTSYSAPI
6181 NTSTATUS
6182 NTAPI
6183 ZwRestoreKey (
6184     IN HANDLE   KeyHandle,
6185     IN HANDLE   FileHandle,
6186     IN ULONG    Flags
6187 );
6188
6189 #endif /* (VER_PRODUCTBUILD >= 2195) */
6190
6191 NTSYSAPI
6192 NTSTATUS
6193 NTAPI
6194 ZwSaveKey (
6195     IN HANDLE KeyHandle,
6196     IN HANDLE FileHandle
6197 );
6198
6199 NTSYSAPI
6200 NTSTATUS
6201 NTAPI
6202 ZwSetDefaultLocale (
6203     IN BOOLEAN  ThreadOrSystem,
6204     IN LCID     Locale
6205 );
6206
6207 #if (VER_PRODUCTBUILD >= 2195)
6208
6209 NTSYSAPI
6210 NTSTATUS
6211 NTAPI
6212 ZwSetDefaultUILanguage (
6213     IN LANGID LanguageId
6214 );
6215
6216 NTSYSAPI
6217 NTSTATUS
6218 NTAPI
6219 ZwSetEaFile (
6220     IN HANDLE               FileHandle,
6221     OUT PIO_STATUS_BLOCK    IoStatusBlock,
6222     OUT PVOID               Buffer,
6223     IN ULONG                Length
6224 );
6225
6226 #endif /* (VER_PRODUCTBUILD >= 2195) */
6227
6228 NTSYSAPI
6229 NTSTATUS
6230 NTAPI
6231 ZwSetEvent (
6232     IN HANDLE   EventHandle,
6233     OUT PLONG   PreviousState OPTIONAL
6234 );
6235
6236 NTSYSAPI
6237 NTSTATUS
6238 NTAPI
6239 ZwSetInformationProcess (
6240     IN HANDLE           ProcessHandle,
6241     IN PROCESSINFOCLASS ProcessInformationClass,
6242     IN PVOID            ProcessInformation,
6243     IN ULONG            ProcessInformationLength
6244 );
6245
6246 #if (VER_PRODUCTBUILD >= 2195)
6247
6248 NTSYSAPI
6249 NTSTATUS
6250 NTAPI
6251 ZwSetSecurityObject (
6252     IN HANDLE               Handle,
6253     IN SECURITY_INFORMATION SecurityInformation,
6254     IN PSECURITY_DESCRIPTOR SecurityDescriptor
6255 );
6256
6257 #endif /* (VER_PRODUCTBUILD >= 2195) */
6258
6259 NTSYSAPI
6260 NTSTATUS
6261 NTAPI
6262 ZwSetSystemTime (
6263     IN PLARGE_INTEGER   NewTime,
6264     OUT PLARGE_INTEGER  OldTime OPTIONAL
6265 );
6266
6267 #if (VER_PRODUCTBUILD >= 2195)
6268
6269 NTSYSAPI
6270 NTSTATUS
6271 NTAPI
6272 ZwSetVolumeInformationFile (
6273     IN HANDLE               FileHandle,
6274     OUT PIO_STATUS_BLOCK    IoStatusBlock,
6275     IN PVOID                FsInformation,
6276     IN ULONG                Length,
6277     IN FS_INFORMATION_CLASS FsInformationClass
6278 );
6279
6280 #endif /* (VER_PRODUCTBUILD >= 2195) */
6281
6282 NTSYSAPI
6283 NTSTATUS
6284 NTAPI
6285 ZwTerminateProcess (
6286     IN HANDLE   ProcessHandle OPTIONAL,
6287     IN NTSTATUS ExitStatus
6288 );
6289
6290 NTSYSAPI
6291 NTSTATUS
6292 NTAPI
6293 ZwUnloadDriver (
6294     /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
6295     IN PUNICODE_STRING RegistryPath
6296 );
6297
6298 NTSYSAPI
6299 NTSTATUS
6300 NTAPI
6301 ZwUnloadKey (
6302     IN POBJECT_ATTRIBUTES KeyObjectAttributes
6303 );
6304
6305 #if (NTDDI_VERSION >= NTDDI_WIN2K)
6306 NTSYSAPI
6307 NTSTATUS
6308 NTAPI
6309 ZwWaitForSingleObject (
6310   IN HANDLE Handle,
6311   IN BOOLEAN Alertable,
6312   IN PLARGE_INTEGER Timeout OPTIONAL);
6313 #endif
6314
6315 NTSYSAPI
6316 NTSTATUS
6317 NTAPI
6318 ZwWaitForMultipleObjects (
6319     IN ULONG            HandleCount,
6320     IN PHANDLE          Handles,
6321     IN WAIT_TYPE        WaitType,
6322     IN BOOLEAN          Alertable,
6323     IN PLARGE_INTEGER   Timeout OPTIONAL
6324 );
6325
6326 NTSYSAPI
6327 NTSTATUS
6328 NTAPI
6329 ZwYieldExecution (
6330     VOID
6331 );
6332
6333 #pragma pack(pop)
6334
6335 #ifdef __cplusplus
6336 }
6337 #endif
6338
6339 #endif /* _NTIFS_ */