4 * Windows NT Filesystem Driver Developer Kit
6 * This file is part of the w32api package.
9 * Created by Bo Brantén <bosse@acc.umu.se>
11 * THIS SOFTWARE IS NOT COPYRIGHTED
13 * This source code is offered for use in the public domain. You may
14 * use, modify or distribute it freely.
16 * This code is distributed in the hope that it will be useful but
17 * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
18 * DISCLAIMED. This includes but is not limited to warranties of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
25 #define _NTIFS_INCLUDED_
28 /* Helper macro to enable gcc's extension. */
29 #ifndef __GNU_EXTENSION
31 #define __GNU_EXTENSION __extension__
33 #define __GNU_EXTENSION
41 #if !defined(_NTHALDLL_) && !defined(_BLDR_)
42 #define NTHALAPI DECLSPEC_IMPORT
47 #if !defined(_NTOSKRNL_) /* For ReactOS */
48 #define NTKERNELAPI DECLSPEC_IMPORT
60 /* FIXME : #include <ntiologc.h> */
63 #define FlagOn(_F,_SF) ((_F) & (_SF))
67 #define BooleanFlagOn(F,SF) ((BOOLEAN)(((F) & (SF)) != 0))
71 #define SetFlag(_F,_SF) ((_F) |= (_SF))
75 #define ClearFlag(_F,_SF) ((_F) &= ~(_SF))
78 #define PsGetCurrentProcess IoGetCurrentProcess
80 #if (NTDDI_VERSION >= NTDDI_VISTA)
81 extern NTSYSAPI
volatile CCHAR KeNumberProcessors
;
82 #elif (NTDDI_VERSION >= NTDDI_WINXP)
83 extern NTSYSAPI CCHAR KeNumberProcessors
;
85 extern PCCHAR KeNumberProcessors
;
88 typedef UNICODE_STRING LSA_UNICODE_STRING
, *PLSA_UNICODE_STRING
;
89 typedef STRING LSA_STRING
, *PLSA_STRING
;
90 typedef OBJECT_ATTRIBUTES LSA_OBJECT_ATTRIBUTES
, *PLSA_OBJECT_ATTRIBUTES
;
92 #ifndef SID_IDENTIFIER_AUTHORITY_DEFINED
93 #define SID_IDENTIFIER_AUTHORITY_DEFINED
94 typedef struct _SID_IDENTIFIER_AUTHORITY
{
96 } SID_IDENTIFIER_AUTHORITY
,*PSID_IDENTIFIER_AUTHORITY
,*LPSID_IDENTIFIER_AUTHORITY
;
101 typedef struct _SID
{
103 UCHAR SubAuthorityCount
;
104 SID_IDENTIFIER_AUTHORITY IdentifierAuthority
;
105 ULONG SubAuthority
[ANYSIZE_ARRAY
];
109 #define SID_REVISION 1
110 #define SID_MAX_SUB_AUTHORITIES 15
111 #define SID_RECOMMENDED_SUB_AUTHORITIES 1
113 typedef enum _SID_NAME_USE
{
118 SidTypeWellKnownGroup
,
119 SidTypeDeletedAccount
,
124 } SID_NAME_USE
, *PSID_NAME_USE
;
126 typedef struct _SID_AND_ATTRIBUTES
{
129 } SID_AND_ATTRIBUTES
, *PSID_AND_ATTRIBUTES
;
130 typedef SID_AND_ATTRIBUTES SID_AND_ATTRIBUTES_ARRAY
[ANYSIZE_ARRAY
];
131 typedef SID_AND_ATTRIBUTES_ARRAY
*PSID_AND_ATTRIBUTES_ARRAY
;
133 #define SID_HASH_SIZE 32
134 typedef ULONG_PTR SID_HASH_ENTRY
, *PSID_HASH_ENTRY
;
136 typedef struct _SID_AND_ATTRIBUTES_HASH
{
138 PSID_AND_ATTRIBUTES SidAttr
;
139 SID_HASH_ENTRY Hash
[SID_HASH_SIZE
];
140 } SID_AND_ATTRIBUTES_HASH
, *PSID_AND_ATTRIBUTES_HASH
;
142 /* Universal well-known SIDs */
144 #define SECURITY_NULL_SID_AUTHORITY {0,0,0,0,0,0}
145 #define SECURITY_WORLD_SID_AUTHORITY {0,0,0,0,0,1}
146 #define SECURITY_LOCAL_SID_AUTHORITY {0,0,0,0,0,2}
147 #define SECURITY_CREATOR_SID_AUTHORITY {0,0,0,0,0,3}
148 #define SECURITY_NON_UNIQUE_AUTHORITY {0,0,0,0,0,4}
149 #define SECURITY_RESOURCE_MANAGER_AUTHORITY {0,0,0,0,0,9}
151 #define SECURITY_NULL_RID (0x00000000L)
152 #define SECURITY_WORLD_RID (0x00000000L)
153 #define SECURITY_LOCAL_RID (0x00000000L)
154 #define SECURITY_LOCAL_LOGON_RID (0x00000001L)
156 #define SECURITY_CREATOR_OWNER_RID (0x00000000L)
157 #define SECURITY_CREATOR_GROUP_RID (0x00000001L)
158 #define SECURITY_CREATOR_OWNER_SERVER_RID (0x00000002L)
159 #define SECURITY_CREATOR_GROUP_SERVER_RID (0x00000003L)
160 #define SECURITY_CREATOR_OWNER_RIGHTS_RID (0x00000004L)
162 /* NT well-known SIDs */
164 #define SECURITY_NT_AUTHORITY {0,0,0,0,0,5}
166 #define SECURITY_DIALUP_RID (0x00000001L)
167 #define SECURITY_NETWORK_RID (0x00000002L)
168 #define SECURITY_BATCH_RID (0x00000003L)
169 #define SECURITY_INTERACTIVE_RID (0x00000004L)
170 #define SECURITY_LOGON_IDS_RID (0x00000005L)
171 #define SECURITY_LOGON_IDS_RID_COUNT (3L)
172 #define SECURITY_SERVICE_RID (0x00000006L)
173 #define SECURITY_ANONYMOUS_LOGON_RID (0x00000007L)
174 #define SECURITY_PROXY_RID (0x00000008L)
175 #define SECURITY_ENTERPRISE_CONTROLLERS_RID (0x00000009L)
176 #define SECURITY_SERVER_LOGON_RID SECURITY_ENTERPRISE_CONTROLLERS_RID
177 #define SECURITY_PRINCIPAL_SELF_RID (0x0000000AL)
178 #define SECURITY_AUTHENTICATED_USER_RID (0x0000000BL)
179 #define SECURITY_RESTRICTED_CODE_RID (0x0000000CL)
180 #define SECURITY_TERMINAL_SERVER_RID (0x0000000DL)
181 #define SECURITY_REMOTE_LOGON_RID (0x0000000EL)
182 #define SECURITY_THIS_ORGANIZATION_RID (0x0000000FL)
183 #define SECURITY_IUSER_RID (0x00000011L)
184 #define SECURITY_LOCAL_SYSTEM_RID (0x00000012L)
185 #define SECURITY_LOCAL_SERVICE_RID (0x00000013L)
186 #define SECURITY_NETWORK_SERVICE_RID (0x00000014L)
187 #define SECURITY_NT_NON_UNIQUE (0x00000015L)
188 #define SECURITY_NT_NON_UNIQUE_SUB_AUTH_COUNT (3L)
189 #define SECURITY_ENTERPRISE_READONLY_CONTROLLERS_RID (0x00000016L)
191 #define SECURITY_BUILTIN_DOMAIN_RID (0x00000020L)
192 #define SECURITY_WRITE_RESTRICTED_CODE_RID (0x00000021L)
195 #define SECURITY_PACKAGE_BASE_RID (0x00000040L)
196 #define SECURITY_PACKAGE_RID_COUNT (2L)
197 #define SECURITY_PACKAGE_NTLM_RID (0x0000000AL)
198 #define SECURITY_PACKAGE_SCHANNEL_RID (0x0000000EL)
199 #define SECURITY_PACKAGE_DIGEST_RID (0x00000015L)
201 #define SECURITY_CRED_TYPE_BASE_RID (0x00000041L)
202 #define SECURITY_CRED_TYPE_RID_COUNT (2L)
203 #define SECURITY_CRED_TYPE_THIS_ORG_CERT_RID (0x00000001L)
205 #define SECURITY_MIN_BASE_RID (0x00000050L)
206 #define SECURITY_SERVICE_ID_BASE_RID (0x00000050L)
207 #define SECURITY_SERVICE_ID_RID_COUNT (6L)
208 #define SECURITY_RESERVED_ID_BASE_RID (0x00000051L)
209 #define SECURITY_APPPOOL_ID_BASE_RID (0x00000052L)
210 #define SECURITY_APPPOOL_ID_RID_COUNT (6L)
211 #define SECURITY_VIRTUALSERVER_ID_BASE_RID (0x00000053L)
212 #define SECURITY_VIRTUALSERVER_ID_RID_COUNT (6L)
213 #define SECURITY_USERMODEDRIVERHOST_ID_BASE_RID (0x00000054L)
214 #define SECURITY_USERMODEDRIVERHOST_ID_RID_COUNT (6L)
215 #define SECURITY_CLOUD_INFRASTRUCTURE_SERVICES_ID_BASE_RID (0x00000055L)
216 #define SECURITY_CLOUD_INFRASTRUCTURE_SERVICES_ID_RID_COUNT (6L)
217 #define SECURITY_WMIHOST_ID_BASE_RID (0x00000056L)
218 #define SECURITY_WMIHOST_ID_RID_COUNT (6L)
219 #define SECURITY_TASK_ID_BASE_RID (0x00000057L)
220 #define SECURITY_NFS_ID_BASE_RID (0x00000058L)
221 #define SECURITY_COM_ID_BASE_RID (0x00000059L)
222 #define SECURITY_VIRTUALACCOUNT_ID_RID_COUNT (6L)
224 #define SECURITY_MAX_BASE_RID (0x0000006FL)
226 #define SECURITY_MAX_ALWAYS_FILTERED (0x000003E7L)
227 #define SECURITY_MIN_NEVER_FILTERED (0x000003E8L)
229 #define SECURITY_OTHER_ORGANIZATION_RID (0x000003E8L)
231 #define SECURITY_WINDOWSMOBILE_ID_BASE_RID (0x00000070L)
233 /* Well-known domain relative sub-authority values (RIDs) */
235 #define DOMAIN_GROUP_RID_ENTERPRISE_READONLY_DOMAIN_CONTROLLERS (0x000001F2L)
237 #define FOREST_USER_RID_MAX (0x000001F3L)
239 /* Well-known users */
241 #define DOMAIN_USER_RID_ADMIN (0x000001F4L)
242 #define DOMAIN_USER_RID_GUEST (0x000001F5L)
243 #define DOMAIN_USER_RID_KRBTGT (0x000001F6L)
245 #define DOMAIN_USER_RID_MAX (0x000003E7L)
247 /* Well-known groups */
249 #define DOMAIN_GROUP_RID_ADMINS (0x00000200L)
250 #define DOMAIN_GROUP_RID_USERS (0x00000201L)
251 #define DOMAIN_GROUP_RID_GUESTS (0x00000202L)
252 #define DOMAIN_GROUP_RID_COMPUTERS (0x00000203L)
253 #define DOMAIN_GROUP_RID_CONTROLLERS (0x00000204L)
254 #define DOMAIN_GROUP_RID_CERT_ADMINS (0x00000205L)
255 #define DOMAIN_GROUP_RID_SCHEMA_ADMINS (0x00000206L)
256 #define DOMAIN_GROUP_RID_ENTERPRISE_ADMINS (0x00000207L)
257 #define DOMAIN_GROUP_RID_POLICY_ADMINS (0x00000208L)
258 #define DOMAIN_GROUP_RID_READONLY_CONTROLLERS (0x00000209L)
260 /* Well-known aliases */
262 #define DOMAIN_ALIAS_RID_ADMINS (0x00000220L)
263 #define DOMAIN_ALIAS_RID_USERS (0x00000221L)
264 #define DOMAIN_ALIAS_RID_GUESTS (0x00000222L)
265 #define DOMAIN_ALIAS_RID_POWER_USERS (0x00000223L)
267 #define DOMAIN_ALIAS_RID_ACCOUNT_OPS (0x00000224L)
268 #define DOMAIN_ALIAS_RID_SYSTEM_OPS (0x00000225L)
269 #define DOMAIN_ALIAS_RID_PRINT_OPS (0x00000226L)
270 #define DOMAIN_ALIAS_RID_BACKUP_OPS (0x00000227L)
272 #define DOMAIN_ALIAS_RID_REPLICATOR (0x00000228L)
273 #define DOMAIN_ALIAS_RID_RAS_SERVERS (0x00000229L)
274 #define DOMAIN_ALIAS_RID_PREW2KCOMPACCESS (0x0000022AL)
275 #define DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS (0x0000022BL)
276 #define DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS (0x0000022CL)
277 #define DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS (0x0000022DL)
279 #define DOMAIN_ALIAS_RID_MONITORING_USERS (0x0000022EL)
280 #define DOMAIN_ALIAS_RID_LOGGING_USERS (0x0000022FL)
281 #define DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS (0x00000230L)
282 #define DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS (0x00000231L)
283 #define DOMAIN_ALIAS_RID_DCOM_USERS (0x00000232L)
284 #define DOMAIN_ALIAS_RID_IUSERS (0x00000238L)
285 #define DOMAIN_ALIAS_RID_CRYPTO_OPERATORS (0x00000239L)
286 #define DOMAIN_ALIAS_RID_CACHEABLE_PRINCIPALS_GROUP (0x0000023BL)
287 #define DOMAIN_ALIAS_RID_NON_CACHEABLE_PRINCIPALS_GROUP (0x0000023CL)
288 #define DOMAIN_ALIAS_RID_EVENT_LOG_READERS_GROUP (0x0000023DL)
289 #define DOMAIN_ALIAS_RID_CERTSVC_DCOM_ACCESS_GROUP (0x0000023EL)
291 #define SECURITY_MANDATORY_LABEL_AUTHORITY {0,0,0,0,0,16}
292 #define SECURITY_MANDATORY_UNTRUSTED_RID (0x00000000L)
293 #define SECURITY_MANDATORY_LOW_RID (0x00001000L)
294 #define SECURITY_MANDATORY_MEDIUM_RID (0x00002000L)
295 #define SECURITY_MANDATORY_HIGH_RID (0x00003000L)
296 #define SECURITY_MANDATORY_SYSTEM_RID (0x00004000L)
297 #define SECURITY_MANDATORY_PROTECTED_PROCESS_RID (0x00005000L)
299 /* SECURITY_MANDATORY_MAXIMUM_USER_RID is the highest RID that
300 can be set by a usermode caller.*/
302 #define SECURITY_MANDATORY_MAXIMUM_USER_RID SECURITY_MANDATORY_SYSTEM_RID
304 #define MANDATORY_LEVEL_TO_MANDATORY_RID(IL) (IL * 0x1000)
306 /* Allocate the System Luid. The first 1000 LUIDs are reserved.
307 Use #999 here (0x3e7 = 999) */
309 #define SYSTEM_LUID { 0x3e7, 0x0 }
310 #define ANONYMOUS_LOGON_LUID { 0x3e6, 0x0 }
311 #define LOCALSERVICE_LUID { 0x3e5, 0x0 }
312 #define NETWORKSERVICE_LUID { 0x3e4, 0x0 }
313 #define IUSER_LUID { 0x3e3, 0x0 }
315 typedef struct _ACE_HEADER
{
319 } ACE_HEADER
, *PACE_HEADER
;
321 /* also in winnt.h */
322 #define ACCESS_MIN_MS_ACE_TYPE (0x0)
323 #define ACCESS_ALLOWED_ACE_TYPE (0x0)
324 #define ACCESS_DENIED_ACE_TYPE (0x1)
325 #define SYSTEM_AUDIT_ACE_TYPE (0x2)
326 #define SYSTEM_ALARM_ACE_TYPE (0x3)
327 #define ACCESS_MAX_MS_V2_ACE_TYPE (0x3)
328 #define ACCESS_ALLOWED_COMPOUND_ACE_TYPE (0x4)
329 #define ACCESS_MAX_MS_V3_ACE_TYPE (0x4)
330 #define ACCESS_MIN_MS_OBJECT_ACE_TYPE (0x5)
331 #define ACCESS_ALLOWED_OBJECT_ACE_TYPE (0x5)
332 #define ACCESS_DENIED_OBJECT_ACE_TYPE (0x6)
333 #define SYSTEM_AUDIT_OBJECT_ACE_TYPE (0x7)
334 #define SYSTEM_ALARM_OBJECT_ACE_TYPE (0x8)
335 #define ACCESS_MAX_MS_OBJECT_ACE_TYPE (0x8)
336 #define ACCESS_MAX_MS_V4_ACE_TYPE (0x8)
337 #define ACCESS_MAX_MS_ACE_TYPE (0x8)
338 #define ACCESS_ALLOWED_CALLBACK_ACE_TYPE (0x9)
339 #define ACCESS_DENIED_CALLBACK_ACE_TYPE (0xA)
340 #define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE (0xB)
341 #define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE (0xC)
342 #define SYSTEM_AUDIT_CALLBACK_ACE_TYPE (0xD)
343 #define SYSTEM_ALARM_CALLBACK_ACE_TYPE (0xE)
344 #define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE (0xF)
345 #define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE (0x10)
346 #define ACCESS_MAX_MS_V5_ACE_TYPE (0x11)
347 #define SYSTEM_MANDATORY_LABEL_ACE_TYPE (0x11)
349 /* The following are the inherit flags that go into the AceFlags field
352 #define OBJECT_INHERIT_ACE (0x1)
353 #define CONTAINER_INHERIT_ACE (0x2)
354 #define NO_PROPAGATE_INHERIT_ACE (0x4)
355 #define INHERIT_ONLY_ACE (0x8)
356 #define INHERITED_ACE (0x10)
357 #define VALID_INHERIT_FLAGS (0x1F)
359 #define SUCCESSFUL_ACCESS_ACE_FLAG (0x40)
360 #define FAILED_ACCESS_ACE_FLAG (0x80)
362 typedef struct _ACCESS_ALLOWED_ACE
{
366 } ACCESS_ALLOWED_ACE
, *PACCESS_ALLOWED_ACE
;
368 typedef struct _ACCESS_DENIED_ACE
{
372 } ACCESS_DENIED_ACE
, *PACCESS_DENIED_ACE
;
374 typedef struct _SYSTEM_AUDIT_ACE
{
378 } SYSTEM_AUDIT_ACE
, *PSYSTEM_AUDIT_ACE
;
380 typedef struct _SYSTEM_ALARM_ACE
{
384 } SYSTEM_ALARM_ACE
, *PSYSTEM_ALARM_ACE
;
386 typedef struct _SYSTEM_MANDATORY_LABEL_ACE
{
390 } SYSTEM_MANDATORY_LABEL_ACE
, *PSYSTEM_MANDATORY_LABEL_ACE
;
392 #define SYSTEM_MANDATORY_LABEL_NO_WRITE_UP 0x1
393 #define SYSTEM_MANDATORY_LABEL_NO_READ_UP 0x2
394 #define SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP 0x4
395 #define SYSTEM_MANDATORY_LABEL_VALID_MASK (SYSTEM_MANDATORY_LABEL_NO_WRITE_UP | \
396 SYSTEM_MANDATORY_LABEL_NO_READ_UP | \
397 SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP)
399 #define SECURITY_DESCRIPTOR_MIN_LENGTH (sizeof(SECURITY_DESCRIPTOR))
401 typedef USHORT SECURITY_DESCRIPTOR_CONTROL
,*PSECURITY_DESCRIPTOR_CONTROL
;
403 #define SE_OWNER_DEFAULTED 0x0001
404 #define SE_GROUP_DEFAULTED 0x0002
405 #define SE_DACL_PRESENT 0x0004
406 #define SE_DACL_DEFAULTED 0x0008
407 #define SE_SACL_PRESENT 0x0010
408 #define SE_SACL_DEFAULTED 0x0020
409 #define SE_DACL_UNTRUSTED 0x0040
410 #define SE_SERVER_SECURITY 0x0080
411 #define SE_DACL_AUTO_INHERIT_REQ 0x0100
412 #define SE_SACL_AUTO_INHERIT_REQ 0x0200
413 #define SE_DACL_AUTO_INHERITED 0x0400
414 #define SE_SACL_AUTO_INHERITED 0x0800
415 #define SE_DACL_PROTECTED 0x1000
416 #define SE_SACL_PROTECTED 0x2000
417 #define SE_RM_CONTROL_VALID 0x4000
418 #define SE_SELF_RELATIVE 0x8000
420 typedef struct _SECURITY_DESCRIPTOR_RELATIVE
{
423 SECURITY_DESCRIPTOR_CONTROL Control
;
428 } SECURITY_DESCRIPTOR_RELATIVE
, *PISECURITY_DESCRIPTOR_RELATIVE
;
430 typedef struct _SECURITY_DESCRIPTOR
{
433 SECURITY_DESCRIPTOR_CONTROL Control
;
438 } SECURITY_DESCRIPTOR
, *PISECURITY_DESCRIPTOR
;
440 typedef struct _OBJECT_TYPE_LIST
{
444 } OBJECT_TYPE_LIST
, *POBJECT_TYPE_LIST
;
446 #define ACCESS_OBJECT_GUID 0
447 #define ACCESS_PROPERTY_SET_GUID 1
448 #define ACCESS_PROPERTY_GUID 2
449 #define ACCESS_MAX_LEVEL 4
451 typedef enum _AUDIT_EVENT_TYPE
{
452 AuditEventObjectAccess
,
453 AuditEventDirectoryServiceAccess
454 } AUDIT_EVENT_TYPE
, *PAUDIT_EVENT_TYPE
;
456 #define AUDIT_ALLOW_NO_PRIVILEGE 0x1
458 #define ACCESS_DS_SOURCE_A "DS"
459 #define ACCESS_DS_SOURCE_W L"DS"
460 #define ACCESS_DS_OBJECT_TYPE_NAME_A "Directory Service Object"
461 #define ACCESS_DS_OBJECT_TYPE_NAME_W L"Directory Service Object"
463 #define ACCESS_REASON_TYPE_MASK 0xffff0000
464 #define ACCESS_REASON_DATA_MASK 0x0000ffff
466 typedef enum _ACCESS_REASON_TYPE
{
467 AccessReasonNone
= 0x00000000,
468 AccessReasonAllowedAce
= 0x00010000,
469 AccessReasonDeniedAce
= 0x00020000,
470 AccessReasonAllowedParentAce
= 0x00030000,
471 AccessReasonDeniedParentAce
= 0x00040000,
472 AccessReasonMissingPrivilege
= 0x00100000,
473 AccessReasonFromPrivilege
= 0x00200000,
474 AccessReasonIntegrityLevel
= 0x00300000,
475 AccessReasonOwnership
= 0x00400000,
476 AccessReasonNullDacl
= 0x00500000,
477 AccessReasonEmptyDacl
= 0x00600000,
478 AccessReasonNoSD
= 0x00700000,
479 AccessReasonNoGrant
= 0x00800000
480 } ACCESS_REASON_TYPE
;
482 typedef ULONG ACCESS_REASON
;
484 typedef struct _ACCESS_REASONS
{
485 ACCESS_REASON Data
[32];
486 } ACCESS_REASONS
, *PACCESS_REASONS
;
488 #define SE_SECURITY_DESCRIPTOR_FLAG_NO_OWNER_ACE 0x00000001
489 #define SE_SECURITY_DESCRIPTOR_FLAG_NO_LABEL_ACE 0x00000002
490 #define SE_SECURITY_DESCRIPTOR_VALID_FLAGS 0x00000003
492 typedef struct _SE_SECURITY_DESCRIPTOR
{
495 PSECURITY_DESCRIPTOR SecurityDescriptor
;
496 } SE_SECURITY_DESCRIPTOR
, *PSE_SECURITY_DESCRIPTOR
;
498 typedef struct _SE_ACCESS_REQUEST
{
500 PSE_SECURITY_DESCRIPTOR SeSecurityDescriptor
;
501 ACCESS_MASK DesiredAccess
;
502 ACCESS_MASK PreviouslyGrantedAccess
;
503 PSID PrincipalSelfSid
;
504 PGENERIC_MAPPING GenericMapping
;
505 ULONG ObjectTypeListCount
;
506 POBJECT_TYPE_LIST ObjectTypeList
;
507 } SE_ACCESS_REQUEST
, *PSE_ACCESS_REQUEST
;
509 typedef struct _SE_ACCESS_REPLY
{
511 ULONG ResultListCount
;
512 PACCESS_MASK GrantedAccess
;
513 PNTSTATUS AccessStatus
;
514 PACCESS_REASONS AccessReason
;
515 PPRIVILEGE_SET
* Privileges
;
516 } SE_ACCESS_REPLY
, *PSE_ACCESS_REPLY
;
518 typedef enum _SE_AUDIT_OPERATION
{
519 AuditPrivilegeObject
,
520 AuditPrivilegeService
,
523 AuditOpenObjectWithTransaction
,
526 AuditOpenObjectForDelete
,
527 AuditOpenObjectForDeleteWithTransaction
,
530 AuditObjectReference
,
532 } SE_AUDIT_OPERATION
, *PSE_AUDIT_OPERATION
;
534 typedef struct _SE_AUDIT_INFO
{
536 AUDIT_EVENT_TYPE AuditType
;
537 SE_AUDIT_OPERATION AuditOperation
;
539 UNICODE_STRING SubsystemName
;
540 UNICODE_STRING ObjectTypeName
;
541 UNICODE_STRING ObjectName
;
545 BOOLEAN ObjectCreation
;
546 BOOLEAN GenerateOnClose
;
547 } SE_AUDIT_INFO
, *PSE_AUDIT_INFO
;
549 #define TOKEN_ASSIGN_PRIMARY (0x0001)
550 #define TOKEN_DUPLICATE (0x0002)
551 #define TOKEN_IMPERSONATE (0x0004)
552 #define TOKEN_QUERY (0x0008)
553 #define TOKEN_QUERY_SOURCE (0x0010)
554 #define TOKEN_ADJUST_PRIVILEGES (0x0020)
555 #define TOKEN_ADJUST_GROUPS (0x0040)
556 #define TOKEN_ADJUST_DEFAULT (0x0080)
557 #define TOKEN_ADJUST_SESSIONID (0x0100)
559 #define TOKEN_ALL_ACCESS_P (STANDARD_RIGHTS_REQUIRED |\
560 TOKEN_ASSIGN_PRIMARY |\
564 TOKEN_QUERY_SOURCE |\
565 TOKEN_ADJUST_PRIVILEGES |\
566 TOKEN_ADJUST_GROUPS |\
567 TOKEN_ADJUST_DEFAULT )
569 #if ((defined(_WIN32_WINNT) && (_WIN32_WINNT > 0x0400)) || (!defined(_WIN32_WINNT)))
570 #define TOKEN_ALL_ACCESS (TOKEN_ALL_ACCESS_P |\
571 TOKEN_ADJUST_SESSIONID )
573 #define TOKEN_ALL_ACCESS (TOKEN_ALL_ACCESS_P)
576 #define TOKEN_READ (STANDARD_RIGHTS_READ |\
579 #define TOKEN_WRITE (STANDARD_RIGHTS_WRITE |\
580 TOKEN_ADJUST_PRIVILEGES |\
581 TOKEN_ADJUST_GROUPS |\
582 TOKEN_ADJUST_DEFAULT)
584 #define TOKEN_EXECUTE (STANDARD_RIGHTS_EXECUTE)
586 typedef enum _TOKEN_TYPE
{
589 } TOKEN_TYPE
,*PTOKEN_TYPE
;
591 typedef enum _TOKEN_INFORMATION_CLASS
{
600 TokenImpersonationLevel
,
604 TokenGroupsAndPrivileges
,
605 TokenSessionReference
,
612 TokenHasRestrictions
,
613 TokenAccessInformation
,
614 TokenVirtualizationAllowed
,
615 TokenVirtualizationEnabled
,
618 TokenMandatoryPolicy
,
621 } TOKEN_INFORMATION_CLASS
, *PTOKEN_INFORMATION_CLASS
;
623 typedef struct _TOKEN_USER
{
624 SID_AND_ATTRIBUTES User
;
625 } TOKEN_USER
, *PTOKEN_USER
;
627 typedef struct _TOKEN_GROUPS
{
629 SID_AND_ATTRIBUTES Groups
[ANYSIZE_ARRAY
];
630 } TOKEN_GROUPS
,*PTOKEN_GROUPS
,*LPTOKEN_GROUPS
;
632 typedef struct _TOKEN_PRIVILEGES
{
633 ULONG PrivilegeCount
;
634 LUID_AND_ATTRIBUTES Privileges
[ANYSIZE_ARRAY
];
635 } TOKEN_PRIVILEGES
,*PTOKEN_PRIVILEGES
,*LPTOKEN_PRIVILEGES
;
637 typedef struct _TOKEN_OWNER
{
639 } TOKEN_OWNER
,*PTOKEN_OWNER
;
641 typedef struct _TOKEN_PRIMARY_GROUP
{
643 } TOKEN_PRIMARY_GROUP
,*PTOKEN_PRIMARY_GROUP
;
645 typedef struct _TOKEN_DEFAULT_DACL
{
647 } TOKEN_DEFAULT_DACL
,*PTOKEN_DEFAULT_DACL
;
649 typedef struct _TOKEN_GROUPS_AND_PRIVILEGES
{
652 PSID_AND_ATTRIBUTES Sids
;
653 ULONG RestrictedSidCount
;
654 ULONG RestrictedSidLength
;
655 PSID_AND_ATTRIBUTES RestrictedSids
;
656 ULONG PrivilegeCount
;
657 ULONG PrivilegeLength
;
658 PLUID_AND_ATTRIBUTES Privileges
;
659 LUID AuthenticationId
;
660 } TOKEN_GROUPS_AND_PRIVILEGES
, *PTOKEN_GROUPS_AND_PRIVILEGES
;
662 typedef struct _TOKEN_LINKED_TOKEN
{
664 } TOKEN_LINKED_TOKEN
, *PTOKEN_LINKED_TOKEN
;
666 typedef struct _TOKEN_ELEVATION
{
667 ULONG TokenIsElevated
;
668 } TOKEN_ELEVATION
, *PTOKEN_ELEVATION
;
670 typedef struct _TOKEN_MANDATORY_LABEL
{
671 SID_AND_ATTRIBUTES Label
;
672 } TOKEN_MANDATORY_LABEL
, *PTOKEN_MANDATORY_LABEL
;
674 #define TOKEN_MANDATORY_POLICY_OFF 0x0
675 #define TOKEN_MANDATORY_POLICY_NO_WRITE_UP 0x1
676 #define TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN 0x2
678 #define TOKEN_MANDATORY_POLICY_VALID_MASK (TOKEN_MANDATORY_POLICY_NO_WRITE_UP | \
679 TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN)
681 typedef struct _TOKEN_MANDATORY_POLICY
{
683 } TOKEN_MANDATORY_POLICY
, *PTOKEN_MANDATORY_POLICY
;
685 typedef struct _TOKEN_ACCESS_INFORMATION
{
686 PSID_AND_ATTRIBUTES_HASH SidHash
;
687 PSID_AND_ATTRIBUTES_HASH RestrictedSidHash
;
688 PTOKEN_PRIVILEGES Privileges
;
689 LUID AuthenticationId
;
690 TOKEN_TYPE TokenType
;
691 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
;
692 TOKEN_MANDATORY_POLICY MandatoryPolicy
;
694 } TOKEN_ACCESS_INFORMATION
, *PTOKEN_ACCESS_INFORMATION
;
696 #define POLICY_AUDIT_SUBCATEGORY_COUNT (53)
698 typedef struct _TOKEN_AUDIT_POLICY
{
699 UCHAR PerUserPolicy
[((POLICY_AUDIT_SUBCATEGORY_COUNT
) >> 1) + 1];
700 } TOKEN_AUDIT_POLICY
, *PTOKEN_AUDIT_POLICY
;
702 #define TOKEN_SOURCE_LENGTH 8
704 typedef struct _TOKEN_SOURCE
{
705 CHAR SourceName
[TOKEN_SOURCE_LENGTH
];
706 LUID SourceIdentifier
;
707 } TOKEN_SOURCE
,*PTOKEN_SOURCE
;
709 typedef struct _TOKEN_STATISTICS
{
711 LUID AuthenticationId
;
712 LARGE_INTEGER ExpirationTime
;
713 TOKEN_TYPE TokenType
;
714 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
;
715 ULONG DynamicCharged
;
716 ULONG DynamicAvailable
;
718 ULONG PrivilegeCount
;
720 } TOKEN_STATISTICS
, *PTOKEN_STATISTICS
;
722 typedef struct _TOKEN_CONTROL
{
724 LUID AuthenticationId
;
726 TOKEN_SOURCE TokenSource
;
727 } TOKEN_CONTROL
,*PTOKEN_CONTROL
;
729 typedef struct _TOKEN_ORIGIN
{
730 LUID OriginatingLogonSession
;
731 } TOKEN_ORIGIN
, *PTOKEN_ORIGIN
;
733 typedef enum _MANDATORY_LEVEL
{
734 MandatoryLevelUntrusted
= 0,
736 MandatoryLevelMedium
,
738 MandatoryLevelSystem
,
739 MandatoryLevelSecureProcess
,
741 } MANDATORY_LEVEL
, *PMANDATORY_LEVEL
;
743 #if (NTDDI_VERSION >= NTDDI_NT4)
749 IN HANDLE Handle OPTIONAL
,
750 IN OBJECT_INFORMATION_CLASS ObjectInformationClass
,
751 OUT PVOID ObjectInformation OPTIONAL
,
752 IN ULONG ObjectInformationLength
,
753 OUT PULONG ReturnLength OPTIONAL
);
757 #if (NTDDI_VERSION >= NTDDI_WIN2K)
763 IN HANDLE ThreadHandle
,
764 IN ACCESS_MASK DesiredAccess
,
765 IN BOOLEAN OpenAsSelf
,
766 OUT PHANDLE TokenHandle
);
772 IN HANDLE ProcessHandle
,
773 IN ACCESS_MASK DesiredAccess
,
774 OUT PHANDLE TokenHandle
);
779 NtQueryInformationToken(
780 IN HANDLE TokenHandle
,
781 IN TOKEN_INFORMATION_CLASS TokenInformationClass
,
782 OUT PVOID TokenInformation OPTIONAL
,
783 IN ULONG TokenInformationLength
,
784 OUT PULONG ReturnLength
);
789 NtAdjustPrivilegesToken(
790 IN HANDLE TokenHandle
,
791 IN BOOLEAN DisableAllPrivileges
,
792 IN PTOKEN_PRIVILEGES NewState OPTIONAL
,
793 IN ULONG BufferLength
,
794 OUT PTOKEN_PRIVILEGES PreviousState
,
795 OUT PULONG ReturnLength OPTIONAL
);
801 OUT PHANDLE FileHandle
,
802 IN ACCESS_MASK DesiredAccess
,
803 IN POBJECT_ATTRIBUTES ObjectAttributes
,
804 OUT PIO_STATUS_BLOCK IoStatusBlock
,
805 IN PLARGE_INTEGER AllocationSize OPTIONAL
,
806 IN ULONG FileAttributes
,
807 IN ULONG ShareAccess
,
808 IN ULONG CreateDisposition
,
809 IN ULONG CreateOptions
,
816 NtDeviceIoControlFile(
817 IN HANDLE FileHandle
,
818 IN HANDLE Event OPTIONAL
,
819 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
820 IN PVOID ApcContext OPTIONAL
,
821 OUT PIO_STATUS_BLOCK IoStatusBlock
,
822 IN ULONG IoControlCode
,
823 IN PVOID InputBuffer OPTIONAL
,
824 IN ULONG InputBufferLength
,
825 OUT PVOID OutputBuffer OPTIONAL
,
826 IN ULONG OutputBufferLength
);
832 IN HANDLE FileHandle
,
833 IN HANDLE Event OPTIONAL
,
834 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
835 IN PVOID ApcContext OPTIONAL
,
836 OUT PIO_STATUS_BLOCK IoStatusBlock
,
837 IN ULONG FsControlCode
,
838 IN PVOID InputBuffer OPTIONAL
,
839 IN ULONG InputBufferLength
,
840 OUT PVOID OutputBuffer OPTIONAL
,
841 IN ULONG OutputBufferLength
);
847 IN HANDLE FileHandle
,
848 IN HANDLE Event OPTIONAL
,
849 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
850 IN PVOID ApcContext OPTIONAL
,
851 OUT PIO_STATUS_BLOCK IoStatusBlock
,
852 IN PLARGE_INTEGER ByteOffset
,
853 IN PLARGE_INTEGER Length
,
855 IN BOOLEAN FailImmediately
,
856 IN BOOLEAN ExclusiveLock
);
862 OUT PHANDLE FileHandle
,
863 IN ACCESS_MASK DesiredAccess
,
864 IN POBJECT_ATTRIBUTES ObjectAttributes
,
865 OUT PIO_STATUS_BLOCK IoStatusBlock
,
866 IN ULONG ShareAccess
,
867 IN ULONG OpenOptions
);
872 NtQueryDirectoryFile(
873 IN HANDLE FileHandle
,
874 IN HANDLE Event OPTIONAL
,
875 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
876 IN PVOID ApcContext OPTIONAL
,
877 OUT PIO_STATUS_BLOCK IoStatusBlock
,
878 OUT PVOID FileInformation
,
880 IN FILE_INFORMATION_CLASS FileInformationClass
,
881 IN BOOLEAN ReturnSingleEntry
,
882 IN PUNICODE_STRING FileName OPTIONAL
,
883 IN BOOLEAN RestartScan
);
888 NtQueryInformationFile(
889 IN HANDLE FileHandle
,
890 OUT PIO_STATUS_BLOCK IoStatusBlock
,
891 OUT PVOID FileInformation
,
893 IN FILE_INFORMATION_CLASS FileInformationClass
);
898 NtQueryQuotaInformationFile(
899 IN HANDLE FileHandle
,
900 OUT PIO_STATUS_BLOCK IoStatusBlock
,
903 IN BOOLEAN ReturnSingleEntry
,
905 IN ULONG SidListLength
,
906 IN PSID StartSid OPTIONAL
,
907 IN BOOLEAN RestartScan
);
912 NtQueryVolumeInformationFile(
913 IN HANDLE FileHandle
,
914 OUT PIO_STATUS_BLOCK IoStatusBlock
,
915 OUT PVOID FsInformation
,
917 IN FS_INFORMATION_CLASS FsInformationClass
);
923 IN HANDLE FileHandle
,
924 IN HANDLE Event OPTIONAL
,
925 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
926 IN PVOID ApcContext OPTIONAL
,
927 OUT PIO_STATUS_BLOCK IoStatusBlock
,
930 IN PLARGE_INTEGER ByteOffset OPTIONAL
,
931 IN PULONG Key OPTIONAL
);
936 NtSetInformationFile(
937 IN HANDLE FileHandle
,
938 OUT PIO_STATUS_BLOCK IoStatusBlock
,
939 IN PVOID FileInformation
,
941 IN FILE_INFORMATION_CLASS FileInformationClass
);
946 NtSetQuotaInformationFile(
947 IN HANDLE FileHandle
,
948 OUT PIO_STATUS_BLOCK IoStatusBlock
,
955 NtSetVolumeInformationFile(
956 IN HANDLE FileHandle
,
957 OUT PIO_STATUS_BLOCK IoStatusBlock
,
958 IN PVOID FsInformation
,
960 IN FS_INFORMATION_CLASS FsInformationClass
);
966 IN HANDLE FileHandle
,
967 IN HANDLE Event OPTIONAL
,
968 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
969 IN PVOID ApcContext OPTIONAL
,
970 OUT PIO_STATUS_BLOCK IoStatusBlock
,
973 IN PLARGE_INTEGER ByteOffset OPTIONAL
,
974 IN PULONG Key OPTIONAL
);
980 IN HANDLE FileHandle
,
981 OUT PIO_STATUS_BLOCK IoStatusBlock
,
982 IN PLARGE_INTEGER ByteOffset
,
983 IN PLARGE_INTEGER Length
,
991 IN SECURITY_INFORMATION SecurityInformation
,
992 IN PSECURITY_DESCRIPTOR SecurityDescriptor
);
997 NtQuerySecurityObject(
999 IN SECURITY_INFORMATION SecurityInformation
,
1000 OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
1002 OUT PULONG LengthNeeded
);
1013 NtAllocateVirtualMemory(
1014 IN HANDLE ProcessHandle
,
1015 IN OUT PVOID
*BaseAddress
,
1016 IN ULONG_PTR ZeroBits
,
1017 IN OUT PSIZE_T RegionSize
,
1018 IN ULONG AllocationType
,
1024 NtFreeVirtualMemory(
1025 IN HANDLE ProcessHandle
,
1026 IN OUT PVOID
*BaseAddress
,
1027 IN OUT PSIZE_T RegionSize
,
1032 #if (NTDDI_VERSION >= NTDDI_WINXP)
1037 NtOpenThreadTokenEx(
1038 IN HANDLE ThreadHandle
,
1039 IN ACCESS_MASK DesiredAccess
,
1040 IN BOOLEAN OpenAsSelf
,
1041 IN ULONG HandleAttributes
,
1042 OUT PHANDLE TokenHandle
);
1047 NtOpenProcessTokenEx(
1048 IN HANDLE ProcessHandle
,
1049 IN ACCESS_MASK DesiredAccess
,
1050 IN ULONG HandleAttributes
,
1051 OUT PHANDLE TokenHandle
);
1056 NtOpenJobObjectToken(
1057 IN HANDLE JobHandle
,
1058 IN ACCESS_MASK DesiredAccess
,
1059 OUT PHANDLE TokenHandle
);
1065 IN HANDLE ExistingTokenHandle
,
1066 IN ACCESS_MASK DesiredAccess
,
1067 IN POBJECT_ATTRIBUTES ObjectAttributes
,
1068 IN BOOLEAN EffectiveOnly
,
1069 IN TOKEN_TYPE TokenType
,
1070 OUT PHANDLE NewTokenHandle
);
1076 IN HANDLE ExistingTokenHandle
,
1078 IN PTOKEN_GROUPS SidsToDisable OPTIONAL
,
1079 IN PTOKEN_PRIVILEGES PrivilegesToDelete OPTIONAL
,
1080 IN PTOKEN_GROUPS RestrictedSids OPTIONAL
,
1081 OUT PHANDLE NewTokenHandle
);
1086 NtImpersonateAnonymousToken(
1087 IN HANDLE ThreadHandle
);
1092 NtSetInformationToken(
1093 IN HANDLE TokenHandle
,
1094 IN TOKEN_INFORMATION_CLASS TokenInformationClass
,
1095 IN PVOID TokenInformation
,
1096 IN ULONG TokenInformationLength
);
1101 NtAdjustGroupsToken(
1102 IN HANDLE TokenHandle
,
1103 IN BOOLEAN ResetToDefault
,
1104 IN PTOKEN_GROUPS NewState OPTIONAL
,
1105 IN ULONG BufferLength OPTIONAL
,
1106 OUT PTOKEN_GROUPS PreviousState
,
1107 OUT PULONG ReturnLength
);
1113 IN HANDLE ClientToken
,
1114 IN OUT PPRIVILEGE_SET RequiredPrivileges
,
1115 OUT PBOOLEAN Result
);
1120 NtAccessCheckAndAuditAlarm(
1121 IN PUNICODE_STRING SubsystemName
,
1122 IN PVOID HandleId OPTIONAL
,
1123 IN PUNICODE_STRING ObjectTypeName
,
1124 IN PUNICODE_STRING ObjectName
,
1125 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
1126 IN ACCESS_MASK DesiredAccess
,
1127 IN PGENERIC_MAPPING GenericMapping
,
1128 IN BOOLEAN ObjectCreation
,
1129 OUT PACCESS_MASK GrantedAccess
,
1130 OUT PNTSTATUS AccessStatus
,
1131 OUT PBOOLEAN GenerateOnClose
);
1136 NtAccessCheckByTypeAndAuditAlarm(
1137 IN PUNICODE_STRING SubsystemName
,
1139 IN PUNICODE_STRING ObjectTypeName
,
1140 IN PUNICODE_STRING ObjectName
,
1141 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
1142 IN PSID PrincipalSelfSid OPTIONAL
,
1143 IN ACCESS_MASK DesiredAccess
,
1144 IN AUDIT_EVENT_TYPE AuditType
,
1146 IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL
,
1147 IN ULONG ObjectTypeLength
,
1148 IN PGENERIC_MAPPING GenericMapping
,
1149 IN BOOLEAN ObjectCreation
,
1150 OUT PACCESS_MASK GrantedAccess
,
1151 OUT PNTSTATUS AccessStatus
,
1152 OUT PBOOLEAN GenerateOnClose
);
1157 NtAccessCheckByTypeResultListAndAuditAlarm(
1158 IN PUNICODE_STRING SubsystemName
,
1159 IN PVOID HandleId OPTIONAL
,
1160 IN PUNICODE_STRING ObjectTypeName
,
1161 IN PUNICODE_STRING ObjectName
,
1162 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
1163 IN PSID PrincipalSelfSid OPTIONAL
,
1164 IN ACCESS_MASK DesiredAccess
,
1165 IN AUDIT_EVENT_TYPE AuditType
,
1167 IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL
,
1168 IN ULONG ObjectTypeLength
,
1169 IN PGENERIC_MAPPING GenericMapping
,
1170 IN BOOLEAN ObjectCreation
,
1171 OUT PACCESS_MASK GrantedAccess
,
1172 OUT PNTSTATUS AccessStatus
,
1173 OUT PBOOLEAN GenerateOnClose
);
1177 NtAccessCheckByTypeResultListAndAuditAlarmByHandle(
1178 IN PUNICODE_STRING SubsystemName
,
1179 IN PVOID HandleId OPTIONAL
,
1180 IN HANDLE ClientToken
,
1181 IN PUNICODE_STRING ObjectTypeName
,
1182 IN PUNICODE_STRING ObjectName
,
1183 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
1184 IN PSID PrincipalSelfSid OPTIONAL
,
1185 IN ACCESS_MASK DesiredAccess
,
1186 IN AUDIT_EVENT_TYPE AuditType
,
1188 IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL
,
1189 IN ULONG ObjectTypeLength
,
1190 IN PGENERIC_MAPPING GenericMapping
,
1191 IN BOOLEAN ObjectCreation
,
1192 OUT PACCESS_MASK GrantedAccess
,
1193 OUT PNTSTATUS AccessStatus
,
1194 OUT PBOOLEAN GenerateOnClose
);
1199 NtOpenObjectAuditAlarm(
1200 IN PUNICODE_STRING SubsystemName
,
1201 IN PVOID HandleId OPTIONAL
,
1202 IN PUNICODE_STRING ObjectTypeName
,
1203 IN PUNICODE_STRING ObjectName
,
1204 IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL
,
1205 IN HANDLE ClientToken
,
1206 IN ACCESS_MASK DesiredAccess
,
1207 IN ACCESS_MASK GrantedAccess
,
1208 IN PPRIVILEGE_SET Privileges OPTIONAL
,
1209 IN BOOLEAN ObjectCreation
,
1210 IN BOOLEAN AccessGranted
,
1211 OUT PBOOLEAN GenerateOnClose
);
1216 NtPrivilegeObjectAuditAlarm(
1217 IN PUNICODE_STRING SubsystemName
,
1218 IN PVOID HandleId OPTIONAL
,
1219 IN HANDLE ClientToken
,
1220 IN ACCESS_MASK DesiredAccess
,
1221 IN PPRIVILEGE_SET Privileges
,
1222 IN BOOLEAN AccessGranted
);
1227 NtCloseObjectAuditAlarm(
1228 IN PUNICODE_STRING SubsystemName
,
1229 IN PVOID HandleId OPTIONAL
,
1230 IN BOOLEAN GenerateOnClose
);
1235 NtDeleteObjectAuditAlarm(
1236 IN PUNICODE_STRING SubsystemName
,
1237 IN PVOID HandleId OPTIONAL
,
1238 IN BOOLEAN GenerateOnClose
);
1243 NtPrivilegedServiceAuditAlarm(
1244 IN PUNICODE_STRING SubsystemName
,
1245 IN PUNICODE_STRING ServiceName
,
1246 IN HANDLE ClientToken
,
1247 IN PPRIVILEGE_SET Privileges
,
1248 IN BOOLEAN AccessGranted
);
1253 NtSetInformationThread(
1254 IN HANDLE ThreadHandle
,
1255 IN THREADINFOCLASS ThreadInformationClass
,
1256 IN PVOID ThreadInformation
,
1257 IN ULONG ThreadInformationLength
);
1263 OUT PHANDLE SectionHandle
,
1264 IN ACCESS_MASK DesiredAccess
,
1265 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL
,
1266 IN PLARGE_INTEGER MaximumSize OPTIONAL
,
1267 IN ULONG SectionPageProtection
,
1268 IN ULONG AllocationAttributes
,
1269 IN HANDLE FileHandle OPTIONAL
);
1274 (NTAPI
* PRTL_HEAP_COMMIT_ROUTINE
) (
1276 IN OUT PVOID
*CommitAddress
,
1277 IN OUT PSIZE_T CommitSize
);
1279 typedef struct _RTL_HEAP_PARAMETERS
{
1281 SIZE_T SegmentReserve
;
1282 SIZE_T SegmentCommit
;
1283 SIZE_T DeCommitFreeBlockThreshold
;
1284 SIZE_T DeCommitTotalFreeThreshold
;
1285 SIZE_T MaximumAllocationSize
;
1286 SIZE_T VirtualMemoryThreshold
;
1287 SIZE_T InitialCommit
;
1288 SIZE_T InitialReserve
;
1289 PRTL_HEAP_COMMIT_ROUTINE CommitRoutine
;
1291 } RTL_HEAP_PARAMETERS
, *PRTL_HEAP_PARAMETERS
;
1293 #if (NTDDI_VERSION >= NTDDI_WIN2K)
1299 IN HANDLE HeapHandle
,
1300 IN ULONG Flags OPTIONAL
,
1307 IN PVOID HeapHandle
,
1308 IN ULONG Flags OPTIONAL
,
1309 IN PVOID BaseAddress
);
1315 OUT PCONTEXT ContextRecord
);
1321 IN OUT PULONG Seed
);
1326 RtlCreateUnicodeString(
1327 OUT PUNICODE_STRING DestinationString
,
1328 IN PCWSTR SourceString
);
1333 RtlAppendStringToString(
1334 IN OUT PSTRING Destination
,
1335 IN
const STRING
*Source
);
1340 RtlOemStringToUnicodeString(
1341 IN OUT PUNICODE_STRING DestinationString
,
1342 IN PCOEM_STRING SourceString
,
1343 IN BOOLEAN AllocateDestinationString
);
1348 RtlUnicodeStringToOemString(
1349 IN OUT POEM_STRING DestinationString
,
1350 IN PCUNICODE_STRING SourceString
,
1351 IN BOOLEAN AllocateDestinationString
);
1356 RtlUpcaseUnicodeStringToOemString(
1357 IN OUT POEM_STRING DestinationString
,
1358 IN PCUNICODE_STRING SourceString
,
1359 IN BOOLEAN AllocateDestinationString
);
1364 RtlOemStringToCountedUnicodeString(
1365 IN OUT PUNICODE_STRING DestinationString
,
1366 IN PCOEM_STRING SourceString
,
1367 IN BOOLEAN AllocateDestinationString
);
1372 RtlUnicodeStringToCountedOemString(
1373 IN OUT POEM_STRING DestinationString
,
1374 IN PCUNICODE_STRING SourceString
,
1375 IN BOOLEAN AllocateDestinationString
);
1380 RtlUpcaseUnicodeStringToCountedOemString(
1381 IN OUT POEM_STRING DestinationString
,
1382 IN PCUNICODE_STRING SourceString
,
1383 IN BOOLEAN AllocateDestinationString
);
1388 RtlDowncaseUnicodeString(
1389 IN OUT PUNICODE_STRING UniDest
,
1390 IN PCUNICODE_STRING UniSource
,
1391 IN BOOLEAN AllocateDestinationString
);
1397 IN OUT POEM_STRING OemString
);
1402 RtlxUnicodeStringToOemSize(
1403 IN PCUNICODE_STRING UnicodeString
);
1408 RtlxOemStringToUnicodeSize(
1409 IN PCOEM_STRING OemString
);
1414 RtlMultiByteToUnicodeN(
1415 OUT PWCH UnicodeString
,
1416 IN ULONG MaxBytesInUnicodeString
,
1417 OUT PULONG BytesInUnicodeString OPTIONAL
,
1418 IN
const CHAR
*MultiByteString
,
1419 IN ULONG BytesInMultiByteString
);
1424 RtlMultiByteToUnicodeSize(
1425 OUT PULONG BytesInUnicodeString
,
1426 IN
const CHAR
*MultiByteString
,
1427 IN ULONG BytesInMultiByteString
);
1432 RtlUnicodeToMultiByteSize(
1433 OUT PULONG BytesInMultiByteString
,
1434 IN PCWCH UnicodeString
,
1435 IN ULONG BytesInUnicodeString
);
1440 RtlUnicodeToMultiByteN(
1441 OUT PCHAR MultiByteString
,
1442 IN ULONG MaxBytesInMultiByteString
,
1443 OUT PULONG BytesInMultiByteString OPTIONAL
,
1444 IN PWCH UnicodeString
,
1445 IN ULONG BytesInUnicodeString
);
1450 RtlUpcaseUnicodeToMultiByteN(
1451 OUT PCHAR MultiByteString
,
1452 IN ULONG MaxBytesInMultiByteString
,
1453 OUT PULONG BytesInMultiByteString OPTIONAL
,
1454 IN PCWCH UnicodeString
,
1455 IN ULONG BytesInUnicodeString
);
1461 OUT PWSTR UnicodeString
,
1462 IN ULONG MaxBytesInUnicodeString
,
1463 OUT PULONG BytesInUnicodeString OPTIONAL
,
1465 IN ULONG BytesInOemString
);
1471 OUT PCHAR OemString
,
1472 IN ULONG MaxBytesInOemString
,
1473 OUT PULONG BytesInOemString OPTIONAL
,
1474 IN PCWCH UnicodeString
,
1475 IN ULONG BytesInUnicodeString
);
1480 RtlUpcaseUnicodeToOemN(
1481 OUT PCHAR OemString
,
1482 IN ULONG MaxBytesInOemString
,
1483 OUT PULONG BytesInOemString OPTIONAL
,
1484 IN PCWCH UnicodeString
,
1485 IN ULONG BytesInUnicodeString
);
1487 #if (NTDDI_VERSION >= NTDDI_VISTASP1)
1491 RtlGenerate8dot3Name(
1492 IN PCUNICODE_STRING Name
,
1493 IN BOOLEAN AllowExtendedCharacters
,
1494 IN OUT PGENERATE_NAME_CONTEXT Context
,
1495 IN OUT PUNICODE_STRING Name8dot3
);
1500 RtlGenerate8dot3Name(
1501 IN PCUNICODE_STRING Name
,
1502 IN BOOLEAN AllowExtendedCharacters
,
1503 IN OUT PGENERATE_NAME_CONTEXT Context
,
1504 IN OUT PUNICODE_STRING Name8dot3
);
1510 RtlIsNameLegalDOS8Dot3(
1511 IN PCUNICODE_STRING Name
,
1512 IN OUT POEM_STRING OemName OPTIONAL
,
1513 IN OUT PBOOLEAN NameContainsSpaces OPTIONAL
);
1518 RtlIsValidOemCharacter(
1519 IN OUT PWCHAR Char
);
1525 OUT PPREFIX_TABLE PrefixTable
);
1531 IN PPREFIX_TABLE PrefixTable
,
1533 OUT PPREFIX_TABLE_ENTRY PrefixTableEntry
);
1539 IN PPREFIX_TABLE PrefixTable
,
1540 IN PPREFIX_TABLE_ENTRY PrefixTableEntry
);
1546 IN PPREFIX_TABLE PrefixTable
,
1547 IN PSTRING FullName
);
1552 RtlInitializeUnicodePrefix(
1553 OUT PUNICODE_PREFIX_TABLE PrefixTable
);
1558 RtlInsertUnicodePrefix(
1559 IN PUNICODE_PREFIX_TABLE PrefixTable
,
1560 IN PUNICODE_STRING Prefix
,
1561 OUT PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry
);
1566 RtlRemoveUnicodePrefix(
1567 IN PUNICODE_PREFIX_TABLE PrefixTable
,
1568 IN PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry
);
1571 PUNICODE_PREFIX_TABLE_ENTRY
1573 RtlFindUnicodePrefix(
1574 IN PUNICODE_PREFIX_TABLE PrefixTable
,
1575 IN PUNICODE_STRING FullName
,
1576 IN ULONG CaseInsensitiveIndex
);
1579 PUNICODE_PREFIX_TABLE_ENTRY
1581 RtlNextUnicodePrefix(
1582 IN PUNICODE_PREFIX_TABLE PrefixTable
,
1583 IN BOOLEAN Restart
);
1588 RtlCompareMemoryUlong(
1596 RtlTimeToSecondsSince1980(
1597 IN PLARGE_INTEGER Time
,
1598 OUT PULONG ElapsedSeconds
);
1603 RtlSecondsSince1980ToTime(
1604 IN ULONG ElapsedSeconds
,
1605 OUT PLARGE_INTEGER Time
);
1610 RtlTimeToSecondsSince1970(
1611 IN PLARGE_INTEGER Time
,
1612 OUT PULONG ElapsedSeconds
);
1617 RtlSecondsSince1970ToTime(
1618 IN ULONG ElapsedSeconds
,
1619 OUT PLARGE_INTEGER Time
);
1644 RtlLengthRequiredSid(
1645 IN ULONG SubAuthorityCount
);
1656 RtlAllocateAndInitializeSid(
1657 IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority
,
1658 IN UCHAR SubAuthorityCount
,
1659 IN ULONG SubAuthority0
,
1660 IN ULONG SubAuthority1
,
1661 IN ULONG SubAuthority2
,
1662 IN ULONG SubAuthority3
,
1663 IN ULONG SubAuthority4
,
1664 IN ULONG SubAuthority5
,
1665 IN ULONG SubAuthority6
,
1666 IN ULONG SubAuthority7
,
1674 IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority
,
1675 IN UCHAR SubAuthorityCount
);
1682 IN ULONG SubAuthority
);
1695 IN PSID Destination
,
1701 RtlConvertSidToUnicodeString(
1702 IN OUT PUNICODE_STRING UnicodeString
,
1704 IN BOOLEAN AllocateDestinationString
);
1710 OUT PLUID DestinationLuid
,
1711 IN PLUID SourceLuid
);
1719 IN ULONG AclRevision
);
1726 IN ULONG AceRevision
,
1727 IN ULONG StartingAceIndex
,
1729 IN ULONG AceListLength
);
1749 RtlAddAccessAllowedAce(
1751 IN ULONG AceRevision
,
1752 IN ACCESS_MASK AccessMask
,
1758 RtlAddAccessAllowedAceEx(
1760 IN ULONG AceRevision
,
1762 IN ACCESS_MASK AccessMask
,
1768 RtlCreateSecurityDescriptorRelative(
1769 OUT PISECURITY_DESCRIPTOR_RELATIVE SecurityDescriptor
,
1775 RtlGetDaclSecurityDescriptor(
1776 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
1777 OUT PBOOLEAN DaclPresent
,
1779 OUT PBOOLEAN DaclDefaulted
);
1784 RtlSetOwnerSecurityDescriptor(
1785 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
1786 IN PSID Owner OPTIONAL
,
1787 IN BOOLEAN OwnerDefaulted
);
1792 RtlGetOwnerSecurityDescriptor(
1793 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
1795 OUT PBOOLEAN OwnerDefaulted
);
1800 RtlNtStatusToDosError(
1801 IN NTSTATUS Status
);
1806 RtlCustomCPToUnicodeN(
1807 IN PCPTABLEINFO CustomCP
,
1808 OUT PWCH UnicodeString
,
1809 IN ULONG MaxBytesInUnicodeString
,
1810 OUT PULONG BytesInUnicodeString OPTIONAL
,
1811 IN PCH CustomCPString
,
1812 IN ULONG BytesInCustomCPString
);
1817 RtlUnicodeToCustomCPN(
1818 IN PCPTABLEINFO CustomCP
,
1819 OUT PCH CustomCPString
,
1820 IN ULONG MaxBytesInCustomCPString
,
1821 OUT PULONG BytesInCustomCPString OPTIONAL
,
1822 IN PWCH UnicodeString
,
1823 IN ULONG BytesInUnicodeString
);
1828 RtlUpcaseUnicodeToCustomCPN(
1829 IN PCPTABLEINFO CustomCP
,
1830 OUT PCH CustomCPString
,
1831 IN ULONG MaxBytesInCustomCPString
,
1832 OUT PULONG BytesInCustomCPString OPTIONAL
,
1833 IN PWCH UnicodeString
,
1834 IN ULONG BytesInUnicodeString
);
1839 RtlInitCodePageTable(
1840 IN PUSHORT TableBase
,
1841 IN OUT PCPTABLEINFO CodePageTable
);
1845 #if (NTDDI_VERSION >= NTDDI_WINXP)
1852 IN PVOID HeapBase OPTIONAL
,
1853 IN SIZE_T ReserveSize OPTIONAL
,
1854 IN SIZE_T CommitSize OPTIONAL
,
1855 IN PVOID Lock OPTIONAL
,
1856 IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL
);
1862 IN PVOID HeapHandle
);
1867 RtlCaptureStackBackTrace(
1868 IN ULONG FramesToSkip
,
1869 IN ULONG FramesToCapture
,
1870 OUT PVOID
*BackTrace
,
1871 OUT PULONG BackTraceHash OPTIONAL
);
1877 IN OUT PULONG Seed
);
1882 RtlInitUnicodeStringEx(
1883 OUT PUNICODE_STRING DestinationString
,
1884 IN PCWSTR SourceString OPTIONAL
);
1889 RtlValidateUnicodeString(
1891 IN PCUNICODE_STRING String
);
1896 RtlDuplicateUnicodeString(
1898 IN PCUNICODE_STRING SourceString
,
1899 OUT PUNICODE_STRING DestinationString
);
1904 RtlGetCompressionWorkSpaceSize(
1905 IN USHORT CompressionFormatAndEngine
,
1906 OUT PULONG CompressBufferWorkSpaceSize
,
1907 OUT PULONG CompressFragmentWorkSpaceSize
);
1913 IN USHORT CompressionFormatAndEngine
,
1914 IN PUCHAR UncompressedBuffer
,
1915 IN ULONG UncompressedBufferSize
,
1916 OUT PUCHAR CompressedBuffer
,
1917 IN ULONG CompressedBufferSize
,
1918 IN ULONG UncompressedChunkSize
,
1919 OUT PULONG FinalCompressedSize
,
1920 IN PVOID WorkSpace
);
1925 RtlDecompressBuffer(
1926 IN USHORT CompressionFormat
,
1927 OUT PUCHAR UncompressedBuffer
,
1928 IN ULONG UncompressedBufferSize
,
1929 IN PUCHAR CompressedBuffer
,
1930 IN ULONG CompressedBufferSize
,
1931 OUT PULONG FinalUncompressedSize
);
1936 RtlDecompressFragment(
1937 IN USHORT CompressionFormat
,
1938 OUT PUCHAR UncompressedFragment
,
1939 IN ULONG UncompressedFragmentSize
,
1940 IN PUCHAR CompressedBuffer
,
1941 IN ULONG CompressedBufferSize
,
1942 IN ULONG FragmentOffset
,
1943 OUT PULONG FinalUncompressedSize
,
1944 IN PVOID WorkSpace
);
1950 IN USHORT CompressionFormat
,
1951 IN OUT PUCHAR
*CompressedBuffer
,
1952 IN PUCHAR EndOfCompressedBufferPlus1
,
1953 OUT PUCHAR
*ChunkBuffer
,
1954 OUT PULONG ChunkSize
);
1960 IN USHORT CompressionFormat
,
1961 IN OUT PUCHAR
*CompressedBuffer
,
1962 IN PUCHAR EndOfCompressedBufferPlus1
,
1963 OUT PUCHAR
*ChunkBuffer
,
1964 IN ULONG ChunkSize
);
1969 RtlDecompressChunks(
1970 OUT PUCHAR UncompressedBuffer
,
1971 IN ULONG UncompressedBufferSize
,
1972 IN PUCHAR CompressedBuffer
,
1973 IN ULONG CompressedBufferSize
,
1974 IN PUCHAR CompressedTail
,
1975 IN ULONG CompressedTailSize
,
1976 IN PCOMPRESSED_DATA_INFO CompressedDataInfo
);
1982 IN PUCHAR UncompressedBuffer
,
1983 IN ULONG UncompressedBufferSize
,
1984 OUT PUCHAR CompressedBuffer
,
1985 IN ULONG CompressedBufferSize
,
1986 IN OUT PCOMPRESSED_DATA_INFO CompressedDataInfo
,
1987 IN ULONG CompressedDataInfoLength
,
1988 IN PVOID WorkSpace
);
1991 PSID_IDENTIFIER_AUTHORITY
1993 RtlIdentifierAuthoritySid(
1999 RtlSubAuthorityCountSid(
2005 RtlNtStatusToDosErrorNoTeb(
2006 IN NTSTATUS Status
);
2011 RtlCreateSystemVolumeInformationFolder(
2012 IN PCUNICODE_STRING VolumeRootPath
);
2016 #if defined(_M_AMD64)
2020 RtlFillMemoryUlong (
2021 OUT PVOID Destination
,
2025 PULONG Address
= (PULONG
)Destination
;
2026 if ((Length
/= 4) != 0) {
2027 if (((ULONG64
)Address
& 4) != 0) {
2029 if ((Length
-= 1) == 0) {
2034 __stosq((PULONG64
)(Address
), Pattern
| ((ULONG64
)Pattern
<< 32), Length
/ 2);
2035 if ((Length
& 1) != 0) Address
[Length
- 1] = Pattern
;
2040 #define RtlFillMemoryUlonglong(Destination, Length, Pattern) \
2041 __stosq((PULONG64)(Destination), Pattern, (Length) / 8)
2045 #if (NTDDI_VERSION >= NTDDI_WINXP)
2051 OUT PVOID Destination
,
2058 RtlFillMemoryUlonglong(
2059 OUT PVOID Destination
,
2061 IN ULONGLONG Pattern
);
2065 #endif // defined(_M_AMD64)
2067 #if (NTDDI_VERSION >= NTDDI_WS03)
2072 RtlInitAnsiStringEx(
2073 OUT PANSI_STRING DestinationString
,
2074 IN PCSZ SourceString OPTIONAL
);
2078 #if (NTDDI_VERSION >= NTDDI_WS03SP1)
2083 RtlGetSaclSecurityDescriptor(
2084 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
2085 OUT PBOOLEAN SaclPresent
,
2087 OUT PBOOLEAN SaclDefaulted
);
2092 RtlSetGroupSecurityDescriptor(
2093 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
2094 IN PSID Group OPTIONAL
,
2095 IN BOOLEAN GroupDefaulted OPTIONAL
);
2100 RtlGetGroupSecurityDescriptor(
2101 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
2103 OUT PBOOLEAN GroupDefaulted
);
2108 RtlAbsoluteToSelfRelativeSD(
2109 IN PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor
,
2110 OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor OPTIONAL
,
2111 IN OUT PULONG BufferLength
);
2116 RtlSelfRelativeToAbsoluteSD(
2117 IN PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor
,
2118 OUT PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor OPTIONAL
,
2119 IN OUT PULONG AbsoluteSecurityDescriptorSize
,
2120 OUT PACL Dacl OPTIONAL
,
2121 IN OUT PULONG DaclSize
,
2122 OUT PACL Sacl OPTIONAL
,
2123 IN OUT PULONG SaclSize
,
2124 OUT PSID Owner OPTIONAL
,
2125 IN OUT PULONG OwnerSize
,
2126 OUT PSID PrimaryGroup OPTIONAL
,
2127 IN OUT PULONG PrimaryGroupSize
);
2131 #if (NTDDI_VERSION >= NTDDI_VISTA)
2138 IN PCWSTR SourceString
,
2139 IN LONG SourceStringLength
,
2140 OUT PWSTR DestinationString
,
2141 IN OUT PLONG DestinationStringLength
);
2146 RtlIsNormalizedString(
2148 IN PCWSTR SourceString
,
2149 IN LONG SourceStringLength
,
2150 OUT PBOOLEAN Normalized
);
2157 IN PCWSTR SourceString
,
2158 IN LONG SourceStringLength
,
2159 OUT PWSTR DestinationString
,
2160 IN OUT PLONG DestinationStringLength
);
2167 IN PCWSTR SourceString
,
2168 IN LONG SourceStringLength
,
2169 OUT PWSTR DestinationString
,
2170 IN OUT PLONG DestinationStringLength
);
2175 RtlIdnToNameprepUnicode(
2177 IN PCWSTR SourceString
,
2178 IN LONG SourceStringLength
,
2179 OUT PWSTR DestinationString
,
2180 IN OUT PLONG DestinationStringLength
);
2185 RtlCreateServiceSid(
2186 IN PUNICODE_STRING ServiceName
,
2187 OUT PSID ServiceSid
,
2188 IN OUT PULONG ServiceSidLength
);
2193 RtlCompareAltitudes(
2194 IN PCUNICODE_STRING Altitude1
,
2195 IN PCUNICODE_STRING Altitude2
);
2199 #if (NTDDI_VERSION >= NTDDI_WIN7)
2205 OUT PCHAR UTF8StringDestination
,
2206 IN ULONG UTF8StringMaxByteCount
,
2207 OUT PULONG UTF8StringActualByteCount
,
2208 IN PCWCH UnicodeStringSource
,
2209 IN ULONG UnicodeStringByteCount
);
2215 OUT PWSTR UnicodeStringDestination
,
2216 IN ULONG UnicodeStringMaxByteCount
,
2217 OUT PULONG UnicodeStringActualByteCount
,
2218 IN PCCH UTF8StringSource
,
2219 IN ULONG UTF8StringByteCount
);
2225 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
2228 OUT ULONG
*NumChanges
);
2233 RtlCreateVirtualAccountSid(
2234 IN PCUNICODE_STRING Name
,
2235 IN ULONG BaseSubAuthority
,
2237 IN OUT PULONG SidLength
);
2241 #define HEAP_NO_SERIALIZE 0x00000001
2242 #define HEAP_GROWABLE 0x00000002
2243 #define HEAP_GENERATE_EXCEPTIONS 0x00000004
2244 #define HEAP_ZERO_MEMORY 0x00000008
2245 #define HEAP_REALLOC_IN_PLACE_ONLY 0x00000010
2246 #define HEAP_TAIL_CHECKING_ENABLED 0x00000020
2247 #define HEAP_FREE_CHECKING_ENABLED 0x00000040
2248 #define HEAP_DISABLE_COALESCE_ON_FREE 0x00000080
2250 #define HEAP_CREATE_ALIGN_16 0x00010000
2251 #define HEAP_CREATE_ENABLE_TRACING 0x00020000
2252 #define HEAP_CREATE_ENABLE_EXECUTE 0x00040000
2254 #define HEAP_SETTABLE_USER_VALUE 0x00000100
2255 #define HEAP_SETTABLE_USER_FLAG1 0x00000200
2256 #define HEAP_SETTABLE_USER_FLAG2 0x00000400
2257 #define HEAP_SETTABLE_USER_FLAG3 0x00000800
2258 #define HEAP_SETTABLE_USER_FLAGS 0x00000E00
2260 #define HEAP_CLASS_0 0x00000000
2261 #define HEAP_CLASS_1 0x00001000
2262 #define HEAP_CLASS_2 0x00002000
2263 #define HEAP_CLASS_3 0x00003000
2264 #define HEAP_CLASS_4 0x00004000
2265 #define HEAP_CLASS_5 0x00005000
2266 #define HEAP_CLASS_6 0x00006000
2267 #define HEAP_CLASS_7 0x00007000
2268 #define HEAP_CLASS_8 0x00008000
2269 #define HEAP_CLASS_MASK 0x0000F000
2271 #define HEAP_MAXIMUM_TAG 0x0FFF
2272 #define HEAP_GLOBAL_TAG 0x0800
2273 #define HEAP_PSEUDO_TAG_FLAG 0x8000
2274 #define HEAP_TAG_SHIFT 18
2275 #define HEAP_TAG_MASK (HEAP_MAXIMUM_TAG << HEAP_TAG_SHIFT)
2277 #define HEAP_CREATE_VALID_MASK (HEAP_NO_SERIALIZE | \
2279 HEAP_GENERATE_EXCEPTIONS | \
2280 HEAP_ZERO_MEMORY | \
2281 HEAP_REALLOC_IN_PLACE_ONLY | \
2282 HEAP_TAIL_CHECKING_ENABLED | \
2283 HEAP_FREE_CHECKING_ENABLED | \
2284 HEAP_DISABLE_COALESCE_ON_FREE | \
2286 HEAP_CREATE_ALIGN_16 | \
2287 HEAP_CREATE_ENABLE_TRACING | \
2288 HEAP_CREATE_ENABLE_EXECUTE)
2292 HEAP_MAKE_TAG_FLAGS(
2296 __assume_bound(TagBase
);
2297 return ((ULONG
)((TagBase
) + ((Tag
) << HEAP_TAG_SHIFT
)));
2300 #define RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE 1
2301 #define RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING 2
2303 #define RtlUnicodeStringToOemSize(STRING) (NLS_MB_OEM_CODE_PAGE_TAG ? \
2304 RtlxUnicodeStringToOemSize(STRING) : \
2305 ((STRING)->Length + sizeof(UNICODE_NULL)) / sizeof(WCHAR) \
2308 #define RtlOemStringToUnicodeSize(STRING) ( \
2309 NLS_MB_OEM_CODE_PAGE_TAG ? \
2310 RtlxOemStringToUnicodeSize(STRING) : \
2311 ((STRING)->Length + sizeof(ANSI_NULL)) * sizeof(WCHAR) \
2314 #define RtlOemStringToCountedUnicodeSize(STRING) ( \
2315 (ULONG)(RtlOemStringToUnicodeSize(STRING) - sizeof(UNICODE_NULL)) \
2319 (NTAPI
*PRTL_ALLOCATE_STRING_ROUTINE (
2320 IN SIZE_T NumberOfBytes
);
2322 #if _WIN32_WINNT >= 0x0600
2325 (NTAPI
*PRTL_REALLOCATE_STRING_ROUTINE (
2326 IN SIZE_T NumberOfBytes
,
2332 (NTAPI
*PRTL_FREE_STRING_ROUTINE (
2335 extern const PRTL_ALLOCATE_STRING_ROUTINE RtlAllocateStringRoutine
;
2336 extern const PRTL_FREE_STRING_ROUTINE RtlFreeStringRoutine
;
2338 #if _WIN32_WINNT >= 0x0600
2339 extern const PRTL_REALLOCATE_STRING_ROUTINE RtlReallocateStringRoutine
;
2342 typedef struct _GENERATE_NAME_CONTEXT
{
2344 BOOLEAN CheckSumInserted
;
2346 WCHAR NameBuffer
[8];
2347 ULONG ExtensionLength
;
2348 WCHAR ExtensionBuffer
[4];
2349 ULONG LastIndexValue
;
2350 } GENERATE_NAME_CONTEXT
, *PGENERATE_NAME_CONTEXT
;
2352 typedef struct _PREFIX_TABLE_ENTRY
{
2353 CSHORT NodeTypeCode
;
2355 struct _PREFIX_TABLE_ENTRY
*NextPrefixTree
;
2356 RTL_SPLAY_LINKS Links
;
2358 } PREFIX_TABLE_ENTRY
, *PPREFIX_TABLE_ENTRY
;
2360 typedef struct _PREFIX_TABLE
{
2361 CSHORT NodeTypeCode
;
2363 PPREFIX_TABLE_ENTRY NextPrefixTree
;
2364 } PREFIX_TABLE
, *PPREFIX_TABLE
;
2366 typedef struct _UNICODE_PREFIX_TABLE_ENTRY
{
2367 CSHORT NodeTypeCode
;
2369 struct _UNICODE_PREFIX_TABLE_ENTRY
*NextPrefixTree
;
2370 struct _UNICODE_PREFIX_TABLE_ENTRY
*CaseMatch
;
2371 RTL_SPLAY_LINKS Links
;
2372 PUNICODE_STRING Prefix
;
2373 } UNICODE_PREFIX_TABLE_ENTRY
, *PUNICODE_PREFIX_TABLE_ENTRY
;
2375 typedef struct _UNICODE_PREFIX_TABLE
{
2376 CSHORT NodeTypeCode
;
2378 PUNICODE_PREFIX_TABLE_ENTRY NextPrefixTree
;
2379 PUNICODE_PREFIX_TABLE_ENTRY LastNextEntry
;
2380 } UNICODE_PREFIX_TABLE
, *PUNICODE_PREFIX_TABLE
;
2382 #define COMPRESSION_FORMAT_NONE (0x0000)
2383 #define COMPRESSION_FORMAT_DEFAULT (0x0001)
2384 #define COMPRESSION_FORMAT_LZNT1 (0x0002)
2385 #define COMPRESSION_ENGINE_STANDARD (0x0000)
2386 #define COMPRESSION_ENGINE_MAXIMUM (0x0100)
2387 #define COMPRESSION_ENGINE_HIBER (0x0200)
2389 typedef struct _COMPRESSED_DATA_INFO
{
2390 USHORT CompressionFormatAndEngine
;
2391 UCHAR CompressionUnitShift
;
2395 USHORT NumberOfChunks
;
2396 ULONG CompressedChunkSizes
[ANYSIZE_ARRAY
];
2397 } COMPRESSED_DATA_INFO
, *PCOMPRESSED_DATA_INFO
;
2399 #define RtlOffsetToPointer(B,O) ((PCHAR)( ((PCHAR)(B)) + ((ULONG_PTR)(O)) ))
2400 #define RtlPointerToOffset(B,P) ((ULONG)( ((PCHAR)(P)) - ((PCHAR)(B)) ))
2402 #define MAX_UNICODE_STACK_BUFFER_LENGTH 256
2404 #define RTL_SYSTEM_VOLUME_INFORMATION_FOLDER L"System Volume Information"
2406 #define DEVICE_TYPE ULONG
2408 #define FILE_DEVICE_BEEP 0x00000001
2409 #define FILE_DEVICE_CD_ROM 0x00000002
2410 #define FILE_DEVICE_CD_ROM_FILE_SYSTEM 0x00000003
2411 #define FILE_DEVICE_CONTROLLER 0x00000004
2412 #define FILE_DEVICE_DATALINK 0x00000005
2413 #define FILE_DEVICE_DFS 0x00000006
2414 #define FILE_DEVICE_DISK 0x00000007
2415 #define FILE_DEVICE_DISK_FILE_SYSTEM 0x00000008
2416 #define FILE_DEVICE_FILE_SYSTEM 0x00000009
2417 #define FILE_DEVICE_INPORT_PORT 0x0000000a
2418 #define FILE_DEVICE_KEYBOARD 0x0000000b
2419 #define FILE_DEVICE_MAILSLOT 0x0000000c
2420 #define FILE_DEVICE_MIDI_IN 0x0000000d
2421 #define FILE_DEVICE_MIDI_OUT 0x0000000e
2422 #define FILE_DEVICE_MOUSE 0x0000000f
2423 #define FILE_DEVICE_MULTI_UNC_PROVIDER 0x00000010
2424 #define FILE_DEVICE_NAMED_PIPE 0x00000011
2425 #define FILE_DEVICE_NETWORK 0x00000012
2426 #define FILE_DEVICE_NETWORK_BROWSER 0x00000013
2427 #define FILE_DEVICE_NETWORK_FILE_SYSTEM 0x00000014
2428 #define FILE_DEVICE_NULL 0x00000015
2429 #define FILE_DEVICE_PARALLEL_PORT 0x00000016
2430 #define FILE_DEVICE_PHYSICAL_NETCARD 0x00000017
2431 #define FILE_DEVICE_PRINTER 0x00000018
2432 #define FILE_DEVICE_SCANNER 0x00000019
2433 #define FILE_DEVICE_SERIAL_MOUSE_PORT 0x0000001a
2434 #define FILE_DEVICE_SERIAL_PORT 0x0000001b
2435 #define FILE_DEVICE_SCREEN 0x0000001c
2436 #define FILE_DEVICE_SOUND 0x0000001d
2437 #define FILE_DEVICE_STREAMS 0x0000001e
2438 #define FILE_DEVICE_TAPE 0x0000001f
2439 #define FILE_DEVICE_TAPE_FILE_SYSTEM 0x00000020
2440 #define FILE_DEVICE_TRANSPORT 0x00000021
2441 #define FILE_DEVICE_UNKNOWN 0x00000022
2442 #define FILE_DEVICE_VIDEO 0x00000023
2443 #define FILE_DEVICE_VIRTUAL_DISK 0x00000024
2444 #define FILE_DEVICE_WAVE_IN 0x00000025
2445 #define FILE_DEVICE_WAVE_OUT 0x00000026
2446 #define FILE_DEVICE_8042_PORT 0x00000027
2447 #define FILE_DEVICE_NETWORK_REDIRECTOR 0x00000028
2448 #define FILE_DEVICE_BATTERY 0x00000029
2449 #define FILE_DEVICE_BUS_EXTENDER 0x0000002a
2450 #define FILE_DEVICE_MODEM 0x0000002b
2451 #define FILE_DEVICE_VDM 0x0000002c
2452 #define FILE_DEVICE_MASS_STORAGE 0x0000002d
2453 #define FILE_DEVICE_SMB 0x0000002e
2454 #define FILE_DEVICE_KS 0x0000002f
2455 #define FILE_DEVICE_CHANGER 0x00000030
2456 #define FILE_DEVICE_SMARTCARD 0x00000031
2457 #define FILE_DEVICE_ACPI 0x00000032
2458 #define FILE_DEVICE_DVD 0x00000033
2459 #define FILE_DEVICE_FULLSCREEN_VIDEO 0x00000034
2460 #define FILE_DEVICE_DFS_FILE_SYSTEM 0x00000035
2461 #define FILE_DEVICE_DFS_VOLUME 0x00000036
2462 #define FILE_DEVICE_SERENUM 0x00000037
2463 #define FILE_DEVICE_TERMSRV 0x00000038
2464 #define FILE_DEVICE_KSEC 0x00000039
2465 #define FILE_DEVICE_FIPS 0x0000003A
2466 #define FILE_DEVICE_INFINIBAND 0x0000003B
2467 #define FILE_DEVICE_VMBUS 0x0000003E
2468 #define FILE_DEVICE_CRYPT_PROVIDER 0x0000003F
2469 #define FILE_DEVICE_WPD 0x00000040
2470 #define FILE_DEVICE_BLUETOOTH 0x00000041
2471 #define FILE_DEVICE_MT_COMPOSITE 0x00000042
2472 #define FILE_DEVICE_MT_TRANSPORT 0x00000043
2473 #define FILE_DEVICE_BIOMETRIC 0x00000044
2474 #define FILE_DEVICE_PMI 0x00000045
2476 #define CTL_CODE( DeviceType, Function, Method, Access ) ( \
2477 ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
2479 #define DEVICE_TYPE_FROM_CTL_CODE(ctrlCode) (((ULONG)(ctrlCode & 0xffff0000)) >> 16)
2480 #define METHOD_FROM_CTL_CODE(ctrlCode) ((ULONG)(ctrlCode & 3))
2482 #define METHOD_BUFFERED 0
2483 #define METHOD_IN_DIRECT 1
2484 #define METHOD_OUT_DIRECT 2
2485 #define METHOD_NEITHER 3
2486 #define METHOD_DIRECT_TO_HARDWARE METHOD_IN_DIRECT
2487 #define METHOD_DIRECT_FROM_HARDWARE METHOD_OUT_DIRECT
2489 #define FILE_ANY_ACCESS 0
2490 #define FILE_SPECIAL_ACCESS (FILE_ANY_ACCESS)
2491 #define FILE_READ_ACCESS ( 0x0001 )
2492 #define FILE_WRITE_ACCESS ( 0x0002 )
2494 typedef ULONG LSA_OPERATIONAL_MODE
, *PLSA_OPERATIONAL_MODE
;
2496 typedef enum _SECURITY_LOGON_TYPE
{
2497 UndefinedLogonType
= 0,
2506 #if (_WIN32_WINNT >= 0x0501)
2510 #if (_WIN32_WINNT >= 0x0502)
2511 CachedRemoteInteractive
,
2514 } SECURITY_LOGON_TYPE
, *PSECURITY_LOGON_TYPE
;
2516 #ifndef _NTLSA_AUDIT_
2517 #define _NTLSA_AUDIT_
2519 typedef enum _SE_ADT_PARAMETER_TYPE
{
2520 SeAdtParmTypeNone
= 0,
2521 SeAdtParmTypeString
,
2522 SeAdtParmTypeFileSpec
,
2525 SeAdtParmTypeLogonId
,
2526 SeAdtParmTypeNoLogonId
,
2527 SeAdtParmTypeAccessMask
,
2529 SeAdtParmTypeObjectTypes
,
2530 SeAdtParmTypeHexUlong
,
2535 SeAdtParmTypeHexInt64
,
2536 SeAdtParmTypeStringList
,
2537 SeAdtParmTypeSidList
,
2538 SeAdtParmTypeDuration
,
2539 SeAdtParmTypeUserAccountControl
,
2541 SeAdtParmTypeMessage
,
2542 SeAdtParmTypeDateTime
,
2543 SeAdtParmTypeSockAddr
,
2545 SeAdtParmTypeLogonHours
,
2546 SeAdtParmTypeLogonIdNoSid
,
2547 SeAdtParmTypeUlongNoConv
,
2548 SeAdtParmTypeSockAddrNoPort
,
2549 SeAdtParmTypeAccessReason
2550 } SE_ADT_PARAMETER_TYPE
, *PSE_ADT_PARAMETER_TYPE
;
2552 #ifndef GUID_DEFINED
2553 #include <guiddef.h>
2556 typedef struct _SE_ADT_OBJECT_TYPE
{
2559 #define SE_ADT_OBJECT_ONLY 0x1
2561 ACCESS_MASK AccessMask
;
2562 } SE_ADT_OBJECT_TYPE
, *PSE_ADT_OBJECT_TYPE
;
2564 typedef struct _SE_ADT_PARAMETER_ARRAY_ENTRY
{
2565 SE_ADT_PARAMETER_TYPE Type
;
2569 } SE_ADT_PARAMETER_ARRAY_ENTRY
, *PSE_ADT_PARAMETER_ARRAY_ENTRY
;
2571 typedef struct _SE_ADT_ACCESS_REASON
{
2572 ACCESS_MASK AccessMask
;
2573 ULONG AccessReasons
[32];
2574 ULONG ObjectTypeIndex
;
2575 ULONG AccessGranted
;
2576 PSECURITY_DESCRIPTOR SecurityDescriptor
;
2577 } SE_ADT_ACCESS_REASON
, *PSE_ADT_ACCESS_REASON
;
2579 #define SE_MAX_AUDIT_PARAMETERS 32
2580 #define SE_MAX_GENERIC_AUDIT_PARAMETERS 28
2582 typedef struct _SE_ADT_PARAMETER_ARRAY
{
2585 ULONG ParameterCount
;
2587 USHORT FlatSubCategoryId
;
2590 SE_ADT_PARAMETER_ARRAY_ENTRY Parameters
[ SE_MAX_AUDIT_PARAMETERS
];
2591 } SE_ADT_PARAMETER_ARRAY
, *PSE_ADT_PARAMETER_ARRAY
;
2593 #define SE_ADT_PARAMETERS_SELF_RELATIVE 0x00000001
2594 #define SE_ADT_PARAMETERS_SEND_TO_LSA 0x00000002
2595 #define SE_ADT_PARAMETER_EXTENSIBLE_AUDIT 0x00000004
2596 #define SE_ADT_PARAMETER_GENERIC_AUDIT 0x00000008
2597 #define SE_ADT_PARAMETER_WRITE_SYNCHRONOUS 0x00000010
2599 #define LSAP_SE_ADT_PARAMETER_ARRAY_TRUE_SIZE(AuditParameters) \
2600 ( sizeof(SE_ADT_PARAMETER_ARRAY) - \
2601 sizeof(SE_ADT_PARAMETER_ARRAY_ENTRY) * \
2602 (SE_MAX_AUDIT_PARAMETERS - AuditParameters->ParameterCount) )
2604 #endif /* _NTLSA_AUDIT_ */
2608 LsaRegisterLogonProcess(
2609 IN PLSA_STRING LogonProcessName
,
2610 OUT PHANDLE LsaHandle
,
2611 OUT PLSA_OPERATIONAL_MODE SecurityMode
);
2616 IN HANDLE LsaHandle
,
2617 IN PLSA_STRING OriginName
,
2618 IN SECURITY_LOGON_TYPE LogonType
,
2619 IN ULONG AuthenticationPackage
,
2620 IN PVOID AuthenticationInformation
,
2621 IN ULONG AuthenticationInformationLength
,
2622 IN PTOKEN_GROUPS LocalGroups OPTIONAL
,
2623 IN PTOKEN_SOURCE SourceContext
,
2624 OUT PVOID
*ProfileBuffer
,
2625 OUT PULONG ProfileBufferLength
,
2628 OUT PQUOTA_LIMITS Quotas
,
2629 OUT PNTSTATUS SubStatus
);
2633 LsaFreeReturnBuffer(
2640 #define MSV1_0_PACKAGE_NAME "MICROSOFT_AUTHENTICATION_PACKAGE_V1_0"
2641 #define MSV1_0_PACKAGE_NAMEW L"MICROSOFT_AUTHENTICATION_PACKAGE_V1_0"
2642 #define MSV1_0_PACKAGE_NAMEW_LENGTH sizeof(MSV1_0_PACKAGE_NAMEW) - sizeof(WCHAR)
2644 #define MSV1_0_SUBAUTHENTICATION_KEY "SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0"
2645 #define MSV1_0_SUBAUTHENTICATION_VALUE "Auth"
2647 #define MSV1_0_CHALLENGE_LENGTH 8
2648 #define MSV1_0_USER_SESSION_KEY_LENGTH 16
2649 #define MSV1_0_LANMAN_SESSION_KEY_LENGTH 8
2651 #define MSV1_0_CLEARTEXT_PASSWORD_ALLOWED 0x02
2652 #define MSV1_0_UPDATE_LOGON_STATISTICS 0x04
2653 #define MSV1_0_RETURN_USER_PARAMETERS 0x08
2654 #define MSV1_0_DONT_TRY_GUEST_ACCOUNT 0x10
2655 #define MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT 0x20
2656 #define MSV1_0_RETURN_PASSWORD_EXPIRY 0x40
2657 #define MSV1_0_USE_CLIENT_CHALLENGE 0x80
2658 #define MSV1_0_TRY_GUEST_ACCOUNT_ONLY 0x100
2659 #define MSV1_0_RETURN_PROFILE_PATH 0x200
2660 #define MSV1_0_TRY_SPECIFIED_DOMAIN_ONLY 0x400
2661 #define MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT 0x800
2663 #define MSV1_0_DISABLE_PERSONAL_FALLBACK 0x00001000
2664 #define MSV1_0_ALLOW_FORCE_GUEST 0x00002000
2666 #if (_WIN32_WINNT >= 0x0502)
2667 #define MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED 0x00004000
2668 #define MSV1_0_USE_DOMAIN_FOR_ROUTING_ONLY 0x00008000
2671 #define MSV1_0_SUBAUTHENTICATION_DLL_EX 0x00100000
2672 #define MSV1_0_ALLOW_MSVCHAPV2 0x00010000
2674 #if (_WIN32_WINNT >= 0x0600)
2675 #define MSV1_0_S4U2SELF 0x00020000
2676 #define MSV1_0_CHECK_LOGONHOURS_FOR_S4U 0x00040000
2679 #define MSV1_0_SUBAUTHENTICATION_DLL 0xFF000000
2680 #define MSV1_0_SUBAUTHENTICATION_DLL_SHIFT 24
2681 #define MSV1_0_MNS_LOGON 0x01000000
2683 #define MSV1_0_SUBAUTHENTICATION_DLL_RAS 2
2684 #define MSV1_0_SUBAUTHENTICATION_DLL_IIS 132
2686 #define LOGON_GUEST 0x01
2687 #define LOGON_NOENCRYPTION 0x02
2688 #define LOGON_CACHED_ACCOUNT 0x04
2689 #define LOGON_USED_LM_PASSWORD 0x08
2690 #define LOGON_EXTRA_SIDS 0x20
2691 #define LOGON_SUBAUTH_SESSION_KEY 0x40
2692 #define LOGON_SERVER_TRUST_ACCOUNT 0x80
2693 #define LOGON_NTLMV2_ENABLED 0x100
2694 #define LOGON_RESOURCE_GROUPS 0x200
2695 #define LOGON_PROFILE_PATH_RETURNED 0x400
2696 #define LOGON_NT_V2 0x800
2697 #define LOGON_LM_V2 0x1000
2698 #define LOGON_NTLM_V2 0x2000
2700 #if (_WIN32_WINNT >= 0x0600)
2702 #define LOGON_OPTIMIZED 0x4000
2703 #define LOGON_WINLOGON 0x8000
2704 #define LOGON_PKINIT 0x10000
2705 #define LOGON_NO_OPTIMIZED 0x20000
2709 #define MSV1_0_SUBAUTHENTICATION_FLAGS 0xFF000000
2711 #define LOGON_GRACE_LOGON 0x01000000
2713 #define MSV1_0_OWF_PASSWORD_LENGTH 16
2714 #define MSV1_0_CRED_LM_PRESENT 0x1
2715 #define MSV1_0_CRED_NT_PRESENT 0x2
2716 #define MSV1_0_CRED_VERSION 0
2718 #define MSV1_0_NTLM3_RESPONSE_LENGTH 16
2719 #define MSV1_0_NTLM3_OWF_LENGTH 16
2721 #if (_WIN32_WINNT == 0x0500)
2722 #define MSV1_0_MAX_NTLM3_LIFE 1800
2724 #define MSV1_0_MAX_NTLM3_LIFE 129600
2726 #define MSV1_0_MAX_AVL_SIZE 64000
2728 #if (_WIN32_WINNT >= 0x0501)
2730 #define MSV1_0_AV_FLAG_FORCE_GUEST 0x00000001
2732 #if (_WIN32_WINNT >= 0x0600)
2733 #define MSV1_0_AV_FLAG_MIC_HANDSHAKE_MESSAGES 0x00000002
2738 #define MSV1_0_NTLM3_INPUT_LENGTH (sizeof(MSV1_0_NTLM3_RESPONSE) - MSV1_0_NTLM3_RESPONSE_LENGTH)
2740 #if(_WIN32_WINNT >= 0x0502)
2741 #define MSV1_0_NTLM3_MIN_NT_RESPONSE_LENGTH RTL_SIZEOF_THROUGH_FIELD(MSV1_0_NTLM3_RESPONSE, AvPairsOff)
2744 #define USE_PRIMARY_PASSWORD 0x01
2745 #define RETURN_PRIMARY_USERNAME 0x02
2746 #define RETURN_PRIMARY_LOGON_DOMAINNAME 0x04
2747 #define RETURN_NON_NT_USER_SESSION_KEY 0x08
2748 #define GENERATE_CLIENT_CHALLENGE 0x10
2749 #define GCR_NTLM3_PARMS 0x20
2750 #define GCR_TARGET_INFO 0x40
2751 #define RETURN_RESERVED_PARAMETER 0x80
2752 #define GCR_ALLOW_NTLM 0x100
2753 #define GCR_USE_OEM_SET 0x200
2754 #define GCR_MACHINE_CREDENTIAL 0x400
2755 #define GCR_USE_OWF_PASSWORD 0x800
2756 #define GCR_ALLOW_LM 0x1000
2757 #define GCR_ALLOW_NO_TARGET 0x2000
2759 typedef enum _MSV1_0_LOGON_SUBMIT_TYPE
{
2760 MsV1_0InteractiveLogon
= 2,
2764 MsV1_0WorkstationUnlockLogon
= 7,
2765 MsV1_0S4ULogon
= 12,
2766 MsV1_0VirtualLogon
= 82
2767 } MSV1_0_LOGON_SUBMIT_TYPE
, *PMSV1_0_LOGON_SUBMIT_TYPE
;
2769 typedef enum _MSV1_0_PROFILE_BUFFER_TYPE
{
2770 MsV1_0InteractiveProfile
= 2,
2771 MsV1_0Lm20LogonProfile
,
2772 MsV1_0SmartCardProfile
2773 } MSV1_0_PROFILE_BUFFER_TYPE
, *PMSV1_0_PROFILE_BUFFER_TYPE
;
2775 typedef struct _MSV1_0_INTERACTIVE_LOGON
{
2776 MSV1_0_LOGON_SUBMIT_TYPE MessageType
;
2777 UNICODE_STRING LogonDomainName
;
2778 UNICODE_STRING UserName
;
2779 UNICODE_STRING Password
;
2780 } MSV1_0_INTERACTIVE_LOGON
, *PMSV1_0_INTERACTIVE_LOGON
;
2782 typedef struct _MSV1_0_INTERACTIVE_PROFILE
{
2783 MSV1_0_PROFILE_BUFFER_TYPE MessageType
;
2785 USHORT BadPasswordCount
;
2786 LARGE_INTEGER LogonTime
;
2787 LARGE_INTEGER LogoffTime
;
2788 LARGE_INTEGER KickOffTime
;
2789 LARGE_INTEGER PasswordLastSet
;
2790 LARGE_INTEGER PasswordCanChange
;
2791 LARGE_INTEGER PasswordMustChange
;
2792 UNICODE_STRING LogonScript
;
2793 UNICODE_STRING HomeDirectory
;
2794 UNICODE_STRING FullName
;
2795 UNICODE_STRING ProfilePath
;
2796 UNICODE_STRING HomeDirectoryDrive
;
2797 UNICODE_STRING LogonServer
;
2799 } MSV1_0_INTERACTIVE_PROFILE
, *PMSV1_0_INTERACTIVE_PROFILE
;
2801 typedef struct _MSV1_0_LM20_LOGON
{
2802 MSV1_0_LOGON_SUBMIT_TYPE MessageType
;
2803 UNICODE_STRING LogonDomainName
;
2804 UNICODE_STRING UserName
;
2805 UNICODE_STRING Workstation
;
2806 UCHAR ChallengeToClient
[MSV1_0_CHALLENGE_LENGTH
];
2807 STRING CaseSensitiveChallengeResponse
;
2808 STRING CaseInsensitiveChallengeResponse
;
2809 ULONG ParameterControl
;
2810 } MSV1_0_LM20_LOGON
, * PMSV1_0_LM20_LOGON
;
2812 typedef struct _MSV1_0_SUBAUTH_LOGON
{
2813 MSV1_0_LOGON_SUBMIT_TYPE MessageType
;
2814 UNICODE_STRING LogonDomainName
;
2815 UNICODE_STRING UserName
;
2816 UNICODE_STRING Workstation
;
2817 UCHAR ChallengeToClient
[MSV1_0_CHALLENGE_LENGTH
];
2818 STRING AuthenticationInfo1
;
2819 STRING AuthenticationInfo2
;
2820 ULONG ParameterControl
;
2821 ULONG SubAuthPackageId
;
2822 } MSV1_0_SUBAUTH_LOGON
, * PMSV1_0_SUBAUTH_LOGON
;
2824 #if (_WIN32_WINNT >= 0x0600)
2826 #define MSV1_0_S4U_LOGON_FLAG_CHECK_LOGONHOURS 0x2
2828 typedef struct _MSV1_0_S4U_LOGON
{
2829 MSV1_0_LOGON_SUBMIT_TYPE MessageType
;
2831 UNICODE_STRING UserPrincipalName
;
2832 UNICODE_STRING DomainName
;
2833 } MSV1_0_S4U_LOGON
, *PMSV1_0_S4U_LOGON
;
2837 typedef struct _MSV1_0_LM20_LOGON_PROFILE
{
2838 MSV1_0_PROFILE_BUFFER_TYPE MessageType
;
2839 LARGE_INTEGER KickOffTime
;
2840 LARGE_INTEGER LogoffTime
;
2842 UCHAR UserSessionKey
[MSV1_0_USER_SESSION_KEY_LENGTH
];
2843 UNICODE_STRING LogonDomainName
;
2844 UCHAR LanmanSessionKey
[MSV1_0_LANMAN_SESSION_KEY_LENGTH
];
2845 UNICODE_STRING LogonServer
;
2846 UNICODE_STRING UserParameters
;
2847 } MSV1_0_LM20_LOGON_PROFILE
, * PMSV1_0_LM20_LOGON_PROFILE
;
2849 typedef struct _MSV1_0_SUPPLEMENTAL_CREDENTIAL
{
2852 UCHAR LmPassword
[MSV1_0_OWF_PASSWORD_LENGTH
];
2853 UCHAR NtPassword
[MSV1_0_OWF_PASSWORD_LENGTH
];
2854 } MSV1_0_SUPPLEMENTAL_CREDENTIAL
, *PMSV1_0_SUPPLEMENTAL_CREDENTIAL
;
2856 typedef struct _MSV1_0_NTLM3_RESPONSE
{
2857 UCHAR Response
[MSV1_0_NTLM3_RESPONSE_LENGTH
];
2862 ULONGLONG TimeStamp
;
2863 UCHAR ChallengeFromClient
[MSV1_0_CHALLENGE_LENGTH
];
2866 } MSV1_0_NTLM3_RESPONSE
, *PMSV1_0_NTLM3_RESPONSE
;
2868 typedef enum _MSV1_0_AVID
{
2870 MsvAvNbComputerName
,
2872 MsvAvDnsComputerName
,
2874 #if (_WIN32_WINNT >= 0x0501)
2877 #if (_WIN32_WINNT >= 0x0600)
2881 MsvAvChannelBindings
,
2886 typedef struct _MSV1_0_AV_PAIR
{
2889 } MSV1_0_AV_PAIR
, *PMSV1_0_AV_PAIR
;
2891 typedef enum _MSV1_0_PROTOCOL_MESSAGE_TYPE
{
2892 MsV1_0Lm20ChallengeRequest
= 0,
2893 MsV1_0Lm20GetChallengeResponse
,
2894 MsV1_0EnumerateUsers
,
2897 MsV1_0ChangePassword
,
2898 MsV1_0ChangeCachedPassword
,
2899 MsV1_0GenericPassthrough
,
2902 MsV1_0DeriveCredential
,
2904 #if (_WIN32_WINNT >= 0x0501)
2905 MsV1_0SetProcessOption
,
2907 #if (_WIN32_WINNT >= 0x0600)
2908 MsV1_0ConfigLocalAliases
,
2909 MsV1_0ClearCachedCredentials
,
2911 } MSV1_0_PROTOCOL_MESSAGE_TYPE
, *PMSV1_0_PROTOCOL_MESSAGE_TYPE
;
2913 typedef struct _MSV1_0_LM20_CHALLENGE_REQUEST
{
2914 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2915 } MSV1_0_LM20_CHALLENGE_REQUEST
, *PMSV1_0_LM20_CHALLENGE_REQUEST
;
2917 typedef struct _MSV1_0_LM20_CHALLENGE_RESPONSE
{
2918 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2919 UCHAR ChallengeToClient
[MSV1_0_CHALLENGE_LENGTH
];
2920 } MSV1_0_LM20_CHALLENGE_RESPONSE
, *PMSV1_0_LM20_CHALLENGE_RESPONSE
;
2922 typedef struct _MSV1_0_GETCHALLENRESP_REQUEST_V1
{
2923 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2924 ULONG ParameterControl
;
2926 UNICODE_STRING Password
;
2927 UCHAR ChallengeToClient
[MSV1_0_CHALLENGE_LENGTH
];
2928 } MSV1_0_GETCHALLENRESP_REQUEST_V1
, *PMSV1_0_GETCHALLENRESP_REQUEST_V1
;
2930 typedef struct _MSV1_0_GETCHALLENRESP_REQUEST
{
2931 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2932 ULONG ParameterControl
;
2934 UNICODE_STRING Password
;
2935 UCHAR ChallengeToClient
[MSV1_0_CHALLENGE_LENGTH
];
2936 UNICODE_STRING UserName
;
2937 UNICODE_STRING LogonDomainName
;
2938 UNICODE_STRING ServerName
;
2939 } MSV1_0_GETCHALLENRESP_REQUEST
, *PMSV1_0_GETCHALLENRESP_REQUEST
;
2941 typedef struct _MSV1_0_GETCHALLENRESP_RESPONSE
{
2942 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2943 STRING CaseSensitiveChallengeResponse
;
2944 STRING CaseInsensitiveChallengeResponse
;
2945 UNICODE_STRING UserName
;
2946 UNICODE_STRING LogonDomainName
;
2947 UCHAR UserSessionKey
[MSV1_0_USER_SESSION_KEY_LENGTH
];
2948 UCHAR LanmanSessionKey
[MSV1_0_LANMAN_SESSION_KEY_LENGTH
];
2949 } MSV1_0_GETCHALLENRESP_RESPONSE
, *PMSV1_0_GETCHALLENRESP_RESPONSE
;
2951 typedef struct _MSV1_0_ENUMUSERS_REQUEST
{
2952 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2953 } MSV1_0_ENUMUSERS_REQUEST
, *PMSV1_0_ENUMUSERS_REQUEST
;
2955 typedef struct _MSV1_0_ENUMUSERS_RESPONSE
{
2956 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2957 ULONG NumberOfLoggedOnUsers
;
2960 } MSV1_0_ENUMUSERS_RESPONSE
, *PMSV1_0_ENUMUSERS_RESPONSE
;
2962 typedef struct _MSV1_0_GETUSERINFO_REQUEST
{
2963 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2965 } MSV1_0_GETUSERINFO_REQUEST
, *PMSV1_0_GETUSERINFO_REQUEST
;
2967 typedef struct _MSV1_0_GETUSERINFO_RESPONSE
{
2968 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2970 UNICODE_STRING UserName
;
2971 UNICODE_STRING LogonDomainName
;
2972 UNICODE_STRING LogonServer
;
2973 SECURITY_LOGON_TYPE LogonType
;
2974 } MSV1_0_GETUSERINFO_RESPONSE
, *PMSV1_0_GETUSERINFO_RESPONSE
;
2976 #define FILE_OPLOCK_BROKEN_TO_LEVEL_2 0x00000007
2977 #define FILE_OPLOCK_BROKEN_TO_NONE 0x00000008
2978 #define FILE_OPBATCH_BREAK_UNDERWAY 0x00000009
2980 /* also in winnt.h */
2981 #define FILE_NOTIFY_CHANGE_FILE_NAME 0x00000001
2982 #define FILE_NOTIFY_CHANGE_DIR_NAME 0x00000002
2983 #define FILE_NOTIFY_CHANGE_NAME 0x00000003
2984 #define FILE_NOTIFY_CHANGE_ATTRIBUTES 0x00000004
2985 #define FILE_NOTIFY_CHANGE_SIZE 0x00000008
2986 #define FILE_NOTIFY_CHANGE_LAST_WRITE 0x00000010
2987 #define FILE_NOTIFY_CHANGE_LAST_ACCESS 0x00000020
2988 #define FILE_NOTIFY_CHANGE_CREATION 0x00000040
2989 #define FILE_NOTIFY_CHANGE_EA 0x00000080
2990 #define FILE_NOTIFY_CHANGE_SECURITY 0x00000100
2991 #define FILE_NOTIFY_CHANGE_STREAM_NAME 0x00000200
2992 #define FILE_NOTIFY_CHANGE_STREAM_SIZE 0x00000400
2993 #define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
2994 #define FILE_NOTIFY_VALID_MASK 0x00000fff
2996 #define FILE_ACTION_ADDED 0x00000001
2997 #define FILE_ACTION_REMOVED 0x00000002
2998 #define FILE_ACTION_MODIFIED 0x00000003
2999 #define FILE_ACTION_RENAMED_OLD_NAME 0x00000004
3000 #define FILE_ACTION_RENAMED_NEW_NAME 0x00000005
3001 #define FILE_ACTION_ADDED_STREAM 0x00000006
3002 #define FILE_ACTION_REMOVED_STREAM 0x00000007
3003 #define FILE_ACTION_MODIFIED_STREAM 0x00000008
3004 #define FILE_ACTION_REMOVED_BY_DELETE 0x00000009
3005 #define FILE_ACTION_ID_NOT_TUNNELLED 0x0000000A
3006 #define FILE_ACTION_TUNNELLED_ID_COLLISION 0x0000000B
3009 #define FILE_PIPE_BYTE_STREAM_TYPE 0x00000000
3010 #define FILE_PIPE_MESSAGE_TYPE 0x00000001
3012 #define FILE_PIPE_ACCEPT_REMOTE_CLIENTS 0x00000000
3013 #define FILE_PIPE_REJECT_REMOTE_CLIENTS 0x00000002
3015 #define FILE_PIPE_ACCEPT_REMOTE_CLIENTS 0x00000000
3016 #define FILE_PIPE_REJECT_REMOTE_CLIENTS 0x00000002
3017 #define FILE_PIPE_TYPE_VALID_MASK 0x00000003
3019 #define FILE_PIPE_BYTE_STREAM_MODE 0x00000000
3020 #define FILE_PIPE_MESSAGE_MODE 0x00000001
3022 #define FILE_PIPE_QUEUE_OPERATION 0x00000000
3023 #define FILE_PIPE_COMPLETE_OPERATION 0x00000001
3025 #define FILE_PIPE_INBOUND 0x00000000
3026 #define FILE_PIPE_OUTBOUND 0x00000001
3027 #define FILE_PIPE_FULL_DUPLEX 0x00000002
3029 #define FILE_PIPE_DISCONNECTED_STATE 0x00000001
3030 #define FILE_PIPE_LISTENING_STATE 0x00000002
3031 #define FILE_PIPE_CONNECTED_STATE 0x00000003
3032 #define FILE_PIPE_CLOSING_STATE 0x00000004
3034 #define FILE_PIPE_CLIENT_END 0x00000000
3035 #define FILE_PIPE_SERVER_END 0x00000001
3037 #define FILE_CASE_SENSITIVE_SEARCH 0x00000001
3038 #define FILE_CASE_PRESERVED_NAMES 0x00000002
3039 #define FILE_UNICODE_ON_DISK 0x00000004
3040 #define FILE_PERSISTENT_ACLS 0x00000008
3041 #define FILE_FILE_COMPRESSION 0x00000010
3042 #define FILE_VOLUME_QUOTAS 0x00000020
3043 #define FILE_SUPPORTS_SPARSE_FILES 0x00000040
3044 #define FILE_SUPPORTS_REPARSE_POINTS 0x00000080
3045 #define FILE_SUPPORTS_REMOTE_STORAGE 0x00000100
3046 #define FILE_VOLUME_IS_COMPRESSED 0x00008000
3047 #define FILE_SUPPORTS_OBJECT_IDS 0x00010000
3048 #define FILE_SUPPORTS_ENCRYPTION 0x00020000
3049 #define FILE_NAMED_STREAMS 0x00040000
3050 #define FILE_READ_ONLY_VOLUME 0x00080000
3051 #define FILE_SEQUENTIAL_WRITE_ONCE 0x00100000
3052 #define FILE_SUPPORTS_TRANSACTIONS 0x00200000
3053 #define FILE_SUPPORTS_HARD_LINKS 0x00400000
3054 #define FILE_SUPPORTS_EXTENDED_ATTRIBUTES 0x00800000
3055 #define FILE_SUPPORTS_OPEN_BY_FILE_ID 0x01000000
3056 #define FILE_SUPPORTS_USN_JOURNAL 0x02000000
3058 #define FILE_NEED_EA 0x00000080
3060 #define FILE_EA_TYPE_BINARY 0xfffe
3061 #define FILE_EA_TYPE_ASCII 0xfffd
3062 #define FILE_EA_TYPE_BITMAP 0xfffb
3063 #define FILE_EA_TYPE_METAFILE 0xfffa
3064 #define FILE_EA_TYPE_ICON 0xfff9
3065 #define FILE_EA_TYPE_EA 0xffee
3066 #define FILE_EA_TYPE_MVMT 0xffdf
3067 #define FILE_EA_TYPE_MVST 0xffde
3068 #define FILE_EA_TYPE_ASN1 0xffdd
3069 #define FILE_EA_TYPE_FAMILY_IDS 0xff01
3071 typedef struct _FILE_NOTIFY_INFORMATION
{
3072 ULONG NextEntryOffset
;
3074 ULONG FileNameLength
;
3076 } FILE_NOTIFY_INFORMATION
, *PFILE_NOTIFY_INFORMATION
;
3078 typedef struct _FILE_DIRECTORY_INFORMATION
{
3079 ULONG NextEntryOffset
;
3081 LARGE_INTEGER CreationTime
;
3082 LARGE_INTEGER LastAccessTime
;
3083 LARGE_INTEGER LastWriteTime
;
3084 LARGE_INTEGER ChangeTime
;
3085 LARGE_INTEGER EndOfFile
;
3086 LARGE_INTEGER AllocationSize
;
3087 ULONG FileAttributes
;
3088 ULONG FileNameLength
;
3090 } FILE_DIRECTORY_INFORMATION
, *PFILE_DIRECTORY_INFORMATION
;
3092 typedef struct _FILE_FULL_DIR_INFORMATION
{
3093 ULONG NextEntryOffset
;
3095 LARGE_INTEGER CreationTime
;
3096 LARGE_INTEGER LastAccessTime
;
3097 LARGE_INTEGER LastWriteTime
;
3098 LARGE_INTEGER ChangeTime
;
3099 LARGE_INTEGER EndOfFile
;
3100 LARGE_INTEGER AllocationSize
;
3101 ULONG FileAttributes
;
3102 ULONG FileNameLength
;
3105 } FILE_FULL_DIR_INFORMATION
, *PFILE_FULL_DIR_INFORMATION
;
3107 typedef struct _FILE_ID_FULL_DIR_INFORMATION
{
3108 ULONG NextEntryOffset
;
3110 LARGE_INTEGER CreationTime
;
3111 LARGE_INTEGER LastAccessTime
;
3112 LARGE_INTEGER LastWriteTime
;
3113 LARGE_INTEGER ChangeTime
;
3114 LARGE_INTEGER EndOfFile
;
3115 LARGE_INTEGER AllocationSize
;
3116 ULONG FileAttributes
;
3117 ULONG FileNameLength
;
3119 LARGE_INTEGER FileId
;
3121 } FILE_ID_FULL_DIR_INFORMATION
, *PFILE_ID_FULL_DIR_INFORMATION
;
3123 typedef struct _FILE_BOTH_DIR_INFORMATION
{
3124 ULONG NextEntryOffset
;
3126 LARGE_INTEGER CreationTime
;
3127 LARGE_INTEGER LastAccessTime
;
3128 LARGE_INTEGER LastWriteTime
;
3129 LARGE_INTEGER ChangeTime
;
3130 LARGE_INTEGER EndOfFile
;
3131 LARGE_INTEGER AllocationSize
;
3132 ULONG FileAttributes
;
3133 ULONG FileNameLength
;
3135 CCHAR ShortNameLength
;
3136 WCHAR ShortName
[12];
3138 } FILE_BOTH_DIR_INFORMATION
, *PFILE_BOTH_DIR_INFORMATION
;
3140 typedef struct _FILE_ID_BOTH_DIR_INFORMATION
{
3141 ULONG NextEntryOffset
;
3143 LARGE_INTEGER CreationTime
;
3144 LARGE_INTEGER LastAccessTime
;
3145 LARGE_INTEGER LastWriteTime
;
3146 LARGE_INTEGER ChangeTime
;
3147 LARGE_INTEGER EndOfFile
;
3148 LARGE_INTEGER AllocationSize
;
3149 ULONG FileAttributes
;
3150 ULONG FileNameLength
;
3152 CCHAR ShortNameLength
;
3153 WCHAR ShortName
[12];
3154 LARGE_INTEGER FileId
;
3156 } FILE_ID_BOTH_DIR_INFORMATION
, *PFILE_ID_BOTH_DIR_INFORMATION
;
3158 typedef struct _FILE_NAMES_INFORMATION
{
3159 ULONG NextEntryOffset
;
3161 ULONG FileNameLength
;
3163 } FILE_NAMES_INFORMATION
, *PFILE_NAMES_INFORMATION
;
3165 typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION
{
3166 ULONG NextEntryOffset
;
3168 LARGE_INTEGER CreationTime
;
3169 LARGE_INTEGER LastAccessTime
;
3170 LARGE_INTEGER LastWriteTime
;
3171 LARGE_INTEGER ChangeTime
;
3172 LARGE_INTEGER EndOfFile
;
3173 LARGE_INTEGER AllocationSize
;
3174 ULONG FileAttributes
;
3175 ULONG FileNameLength
;
3176 LARGE_INTEGER FileId
;
3177 GUID LockingTransactionId
;
3180 } FILE_ID_GLOBAL_TX_DIR_INFORMATION
, *PFILE_ID_GLOBAL_TX_DIR_INFORMATION
;
3182 #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_WRITELOCKED 0x00000001
3183 #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_TO_TX 0x00000002
3184 #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_OUTSIDE_TX 0x00000004
3186 typedef struct _FILE_OBJECTID_INFORMATION
{
3187 LONGLONG FileReference
;
3189 _ANONYMOUS_UNION
union {
3190 __GNU_EXTENSION
struct {
3191 UCHAR BirthVolumeId
[16];
3192 UCHAR BirthObjectId
[16];
3195 UCHAR ExtendedInfo
[48];
3197 } FILE_OBJECTID_INFORMATION
, *PFILE_OBJECTID_INFORMATION
;
3199 #define ANSI_DOS_STAR ('<')
3200 #define ANSI_DOS_QM ('>')
3201 #define ANSI_DOS_DOT ('"')
3203 #define DOS_STAR (L'<')
3204 #define DOS_QM (L'>')
3205 #define DOS_DOT (L'"')
3207 typedef struct _FILE_INTERNAL_INFORMATION
{
3208 LARGE_INTEGER IndexNumber
;
3209 } FILE_INTERNAL_INFORMATION
, *PFILE_INTERNAL_INFORMATION
;
3211 typedef struct _FILE_EA_INFORMATION
{
3213 } FILE_EA_INFORMATION
, *PFILE_EA_INFORMATION
;
3215 typedef struct _FILE_ACCESS_INFORMATION
{
3216 ACCESS_MASK AccessFlags
;
3217 } FILE_ACCESS_INFORMATION
, *PFILE_ACCESS_INFORMATION
;
3219 typedef struct _FILE_MODE_INFORMATION
{
3221 } FILE_MODE_INFORMATION
, *PFILE_MODE_INFORMATION
;
3223 typedef struct _FILE_ALL_INFORMATION
{
3224 FILE_BASIC_INFORMATION BasicInformation
;
3225 FILE_STANDARD_INFORMATION StandardInformation
;
3226 FILE_INTERNAL_INFORMATION InternalInformation
;
3227 FILE_EA_INFORMATION EaInformation
;
3228 FILE_ACCESS_INFORMATION AccessInformation
;
3229 FILE_POSITION_INFORMATION PositionInformation
;
3230 FILE_MODE_INFORMATION ModeInformation
;
3231 FILE_ALIGNMENT_INFORMATION AlignmentInformation
;
3232 FILE_NAME_INFORMATION NameInformation
;
3233 } FILE_ALL_INFORMATION
, *PFILE_ALL_INFORMATION
;
3235 typedef struct _FILE_ALLOCATION_INFORMATION
{
3236 LARGE_INTEGER AllocationSize
;
3237 } FILE_ALLOCATION_INFORMATION
, *PFILE_ALLOCATION_INFORMATION
;
3239 typedef struct _FILE_COMPRESSION_INFORMATION
{
3240 LARGE_INTEGER CompressedFileSize
;
3241 USHORT CompressionFormat
;
3242 UCHAR CompressionUnitShift
;
3246 } FILE_COMPRESSION_INFORMATION
, *PFILE_COMPRESSION_INFORMATION
;
3248 typedef struct _FILE_LINK_INFORMATION
{
3249 BOOLEAN ReplaceIfExists
;
3250 HANDLE RootDirectory
;
3251 ULONG FileNameLength
;
3253 } FILE_LINK_INFORMATION
, *PFILE_LINK_INFORMATION
;
3255 typedef struct _FILE_MOVE_CLUSTER_INFORMATION
{
3257 HANDLE RootDirectory
;
3258 ULONG FileNameLength
;
3260 } FILE_MOVE_CLUSTER_INFORMATION
, *PFILE_MOVE_CLUSTER_INFORMATION
;
3262 typedef struct _FILE_RENAME_INFORMATION
{
3263 BOOLEAN ReplaceIfExists
;
3264 HANDLE RootDirectory
;
3265 ULONG FileNameLength
;
3267 } FILE_RENAME_INFORMATION
, *PFILE_RENAME_INFORMATION
;
3269 typedef struct _FILE_STREAM_INFORMATION
{
3270 ULONG NextEntryOffset
;
3271 ULONG StreamNameLength
;
3272 LARGE_INTEGER StreamSize
;
3273 LARGE_INTEGER StreamAllocationSize
;
3274 WCHAR StreamName
[1];
3275 } FILE_STREAM_INFORMATION
, *PFILE_STREAM_INFORMATION
;
3277 typedef struct _FILE_TRACKING_INFORMATION
{
3278 HANDLE DestinationFile
;
3279 ULONG ObjectInformationLength
;
3280 CHAR ObjectInformation
[1];
3281 } FILE_TRACKING_INFORMATION
, *PFILE_TRACKING_INFORMATION
;
3283 typedef struct _FILE_COMPLETION_INFORMATION
{
3286 } FILE_COMPLETION_INFORMATION
, *PFILE_COMPLETION_INFORMATION
;
3288 typedef struct _FILE_PIPE_INFORMATION
{
3290 ULONG CompletionMode
;
3291 } FILE_PIPE_INFORMATION
, *PFILE_PIPE_INFORMATION
;
3293 typedef struct _FILE_PIPE_LOCAL_INFORMATION
{
3294 ULONG NamedPipeType
;
3295 ULONG NamedPipeConfiguration
;
3296 ULONG MaximumInstances
;
3297 ULONG CurrentInstances
;
3299 ULONG ReadDataAvailable
;
3300 ULONG OutboundQuota
;
3301 ULONG WriteQuotaAvailable
;
3302 ULONG NamedPipeState
;
3304 } FILE_PIPE_LOCAL_INFORMATION
, *PFILE_PIPE_LOCAL_INFORMATION
;
3306 typedef struct _FILE_PIPE_REMOTE_INFORMATION
{
3307 LARGE_INTEGER CollectDataTime
;
3308 ULONG MaximumCollectionCount
;
3309 } FILE_PIPE_REMOTE_INFORMATION
, *PFILE_PIPE_REMOTE_INFORMATION
;
3311 typedef struct _FILE_MAILSLOT_QUERY_INFORMATION
{
3312 ULONG MaximumMessageSize
;
3313 ULONG MailslotQuota
;
3314 ULONG NextMessageSize
;
3315 ULONG MessagesAvailable
;
3316 LARGE_INTEGER ReadTimeout
;
3317 } FILE_MAILSLOT_QUERY_INFORMATION
, *PFILE_MAILSLOT_QUERY_INFORMATION
;
3319 typedef struct _FILE_MAILSLOT_SET_INFORMATION
{
3320 PLARGE_INTEGER ReadTimeout
;
3321 } FILE_MAILSLOT_SET_INFORMATION
, *PFILE_MAILSLOT_SET_INFORMATION
;
3323 typedef struct _FILE_REPARSE_POINT_INFORMATION
{
3324 LONGLONG FileReference
;
3326 } FILE_REPARSE_POINT_INFORMATION
, *PFILE_REPARSE_POINT_INFORMATION
;
3328 typedef struct _FILE_LINK_ENTRY_INFORMATION
{
3329 ULONG NextEntryOffset
;
3330 LONGLONG ParentFileId
;
3331 ULONG FileNameLength
;
3333 } FILE_LINK_ENTRY_INFORMATION
, *PFILE_LINK_ENTRY_INFORMATION
;
3335 typedef struct _FILE_LINKS_INFORMATION
{
3337 ULONG EntriesReturned
;
3338 FILE_LINK_ENTRY_INFORMATION Entry
;
3339 } FILE_LINKS_INFORMATION
, *PFILE_LINKS_INFORMATION
;
3341 typedef struct _FILE_NETWORK_PHYSICAL_NAME_INFORMATION
{
3342 ULONG FileNameLength
;
3344 } FILE_NETWORK_PHYSICAL_NAME_INFORMATION
, *PFILE_NETWORK_PHYSICAL_NAME_INFORMATION
;
3346 typedef struct _FILE_STANDARD_LINK_INFORMATION
{
3347 ULONG NumberOfAccessibleLinks
;
3348 ULONG TotalNumberOfLinks
;
3349 BOOLEAN DeletePending
;
3351 } FILE_STANDARD_LINK_INFORMATION
, *PFILE_STANDARD_LINK_INFORMATION
;
3353 typedef struct _FILE_GET_EA_INFORMATION
{
3354 ULONG NextEntryOffset
;
3357 } FILE_GET_EA_INFORMATION
, *PFILE_GET_EA_INFORMATION
;
3359 #define REMOTE_PROTOCOL_FLAG_LOOPBACK 0x00000001
3360 #define REMOTE_PROTOCOL_FLAG_OFFLINE 0x00000002
3362 typedef struct _FILE_REMOTE_PROTOCOL_INFORMATION
{
3363 USHORT StructureVersion
;
3364 USHORT StructureSize
;
3366 USHORT ProtocolMajorVersion
;
3367 USHORT ProtocolMinorVersion
;
3368 USHORT ProtocolRevision
;
3376 } ProtocolSpecificReserved
;
3377 } FILE_REMOTE_PROTOCOL_INFORMATION
, *PFILE_REMOTE_PROTOCOL_INFORMATION
;
3379 typedef struct _FILE_GET_QUOTA_INFORMATION
{
3380 ULONG NextEntryOffset
;
3383 } FILE_GET_QUOTA_INFORMATION
, *PFILE_GET_QUOTA_INFORMATION
;
3385 typedef struct _FILE_QUOTA_INFORMATION
{
3386 ULONG NextEntryOffset
;
3388 LARGE_INTEGER ChangeTime
;
3389 LARGE_INTEGER QuotaUsed
;
3390 LARGE_INTEGER QuotaThreshold
;
3391 LARGE_INTEGER QuotaLimit
;
3393 } FILE_QUOTA_INFORMATION
, *PFILE_QUOTA_INFORMATION
;
3395 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
{
3396 ULONG FileSystemAttributes
;
3397 ULONG MaximumComponentNameLength
;
3398 ULONG FileSystemNameLength
;
3399 WCHAR FileSystemName
[1];
3400 } FILE_FS_ATTRIBUTE_INFORMATION
, *PFILE_FS_ATTRIBUTE_INFORMATION
;
3402 typedef struct _FILE_FS_DRIVER_PATH_INFORMATION
{
3403 BOOLEAN DriverInPath
;
3404 ULONG DriverNameLength
;
3405 WCHAR DriverName
[1];
3406 } FILE_FS_DRIVER_PATH_INFORMATION
, *PFILE_FS_DRIVER_PATH_INFORMATION
;
3408 typedef struct _FILE_FS_VOLUME_FLAGS_INFORMATION
{
3410 } FILE_FS_VOLUME_FLAGS_INFORMATION
, *PFILE_FS_VOLUME_FLAGS_INFORMATION
;
3412 #define FILE_VC_QUOTA_NONE 0x00000000
3413 #define FILE_VC_QUOTA_TRACK 0x00000001
3414 #define FILE_VC_QUOTA_ENFORCE 0x00000002
3415 #define FILE_VC_QUOTA_MASK 0x00000003
3416 #define FILE_VC_CONTENT_INDEX_DISABLED 0x00000008
3417 #define FILE_VC_LOG_QUOTA_THRESHOLD 0x00000010
3418 #define FILE_VC_LOG_QUOTA_LIMIT 0x00000020
3419 #define FILE_VC_LOG_VOLUME_THRESHOLD 0x00000040
3420 #define FILE_VC_LOG_VOLUME_LIMIT 0x00000080
3421 #define FILE_VC_QUOTAS_INCOMPLETE 0x00000100
3422 #define FILE_VC_QUOTAS_REBUILDING 0x00000200
3423 #define FILE_VC_VALID_MASK 0x000003ff
3425 typedef struct _FILE_FS_CONTROL_INFORMATION
{
3426 LARGE_INTEGER FreeSpaceStartFiltering
;
3427 LARGE_INTEGER FreeSpaceThreshold
;
3428 LARGE_INTEGER FreeSpaceStopFiltering
;
3429 LARGE_INTEGER DefaultQuotaThreshold
;
3430 LARGE_INTEGER DefaultQuotaLimit
;
3431 ULONG FileSystemControlFlags
;
3432 } FILE_FS_CONTROL_INFORMATION
, *PFILE_FS_CONTROL_INFORMATION
;
3434 #ifndef _FILESYSTEMFSCTL_
3435 #define _FILESYSTEMFSCTL_
3437 #define FSCTL_REQUEST_OPLOCK_LEVEL_1 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
3438 #define FSCTL_REQUEST_OPLOCK_LEVEL_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
3439 #define FSCTL_REQUEST_BATCH_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
3440 #define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 3, METHOD_BUFFERED, FILE_ANY_ACCESS)
3441 #define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
3442 #define FSCTL_OPLOCK_BREAK_NOTIFY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 5, METHOD_BUFFERED, FILE_ANY_ACCESS)
3443 #define FSCTL_LOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
3444 #define FSCTL_UNLOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
3445 #define FSCTL_DISMOUNT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
3446 #define FSCTL_IS_VOLUME_MOUNTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
3447 #define FSCTL_IS_PATHNAME_VALID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
3448 #define FSCTL_MARK_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
3449 #define FSCTL_QUERY_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER, FILE_ANY_ACCESS)
3450 #define FSCTL_GET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
3451 #define FSCTL_SET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
3452 #define FSCTL_SET_BOOTLOADER_ACCESSED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS)
3454 #define FSCTL_OPLOCK_BREAK_ACK_NO_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
3455 #define FSCTL_INVALIDATE_VOLUMES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
3456 #define FSCTL_QUERY_FAT_BPB CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS)
3457 #define FSCTL_REQUEST_FILTER_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
3458 #define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS)
3460 #if (_WIN32_WINNT >= 0x0400)
3462 #define FSCTL_GET_NTFS_VOLUME_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS)
3463 #define FSCTL_GET_NTFS_FILE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS)
3464 #define FSCTL_GET_VOLUME_BITMAP CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER, FILE_ANY_ACCESS)
3465 #define FSCTL_GET_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER, FILE_ANY_ACCESS)
3466 #define FSCTL_MOVE_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_ANY_ACCESS)
3467 #define FSCTL_IS_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
3468 #define FSCTL_ALLOW_EXTENDED_DASD_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER, FILE_ANY_ACCESS)
3472 #if (_WIN32_WINNT >= 0x0500)
3474 #define FSCTL_FIND_FILES_BY_SID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS)
3475 #define FSCTL_SET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_WRITE_DATA)
3476 #define FSCTL_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS)
3477 #define FSCTL_DELETE_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_WRITE_DATA)
3478 #define FSCTL_SET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_WRITE_DATA)
3479 #define FSCTL_GET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS)
3480 #define FSCTL_DELETE_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_WRITE_DATA)
3481 #define FSCTL_ENUM_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER, FILE_READ_DATA)
3482 #define FSCTL_SECURITY_ID_CHECK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45, METHOD_NEITHER, FILE_READ_DATA)
3483 #define FSCTL_READ_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46, METHOD_NEITHER, FILE_READ_DATA)
3484 #define FSCTL_SET_OBJECT_ID_EXTENDED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_WRITE_DATA)
3485 #define FSCTL_CREATE_OR_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS)
3486 #define FSCTL_SET_SPARSE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_WRITE_DATA)
3487 #define FSCTL_SET_ZERO_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA)
3488 #define FSCTL_QUERY_ALLOCATED_RANGES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51, METHOD_NEITHER, FILE_READ_DATA)
3489 #define FSCTL_ENABLE_UPGRADE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA)
3490 #define FSCTL_SET_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_BUFFERED, FILE_ANY_ACCESS)
3491 #define FSCTL_ENCRYPTION_FSCTL_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54, METHOD_NEITHER, FILE_ANY_ACCESS)
3492 #define FSCTL_WRITE_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55, METHOD_NEITHER, FILE_ANY_ACCESS)
3493 #define FSCTL_READ_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56, METHOD_NEITHER, FILE_ANY_ACCESS)
3494 #define FSCTL_CREATE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57, METHOD_NEITHER, FILE_READ_DATA)
3495 #define FSCTL_READ_FILE_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58, METHOD_NEITHER, FILE_READ_DATA)
3496 #define FSCTL_WRITE_USN_CLOSE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59, METHOD_NEITHER, FILE_READ_DATA)
3497 #define FSCTL_EXTEND_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
3498 #define FSCTL_QUERY_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
3499 #define FSCTL_DELETE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
3500 #define FSCTL_MARK_HANDLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS)
3501 #define FSCTL_SIS_COPYFILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS)
3502 #define FSCTL_SIS_LINK_FILES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
3503 #define FSCTL_RECALL_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS)
3504 #define FSCTL_READ_FROM_PLEX CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA)
3505 #define FSCTL_FILE_PREFETCH CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3509 #if (_WIN32_WINNT >= 0x0600)
3511 #define FSCTL_MAKE_MEDIA_COMPATIBLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 76, METHOD_BUFFERED, FILE_WRITE_DATA)
3512 #define FSCTL_SET_DEFECT_MANAGEMENT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 77, METHOD_BUFFERED, FILE_WRITE_DATA)
3513 #define FSCTL_QUERY_SPARING_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 78, METHOD_BUFFERED, FILE_ANY_ACCESS)
3514 #define FSCTL_QUERY_ON_DISK_VOLUME_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 79, METHOD_BUFFERED, FILE_ANY_ACCESS)
3515 #define FSCTL_SET_VOLUME_COMPRESSION_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 80, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3516 #define FSCTL_TXFS_MODIFY_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 81, METHOD_BUFFERED, FILE_WRITE_DATA)
3517 #define FSCTL_TXFS_QUERY_RM_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 82, METHOD_BUFFERED, FILE_READ_DATA)
3518 #define FSCTL_TXFS_ROLLFORWARD_REDO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 84, METHOD_BUFFERED, FILE_WRITE_DATA)
3519 #define FSCTL_TXFS_ROLLFORWARD_UNDO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 85, METHOD_BUFFERED, FILE_WRITE_DATA)
3520 #define FSCTL_TXFS_START_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 86, METHOD_BUFFERED, FILE_WRITE_DATA)
3521 #define FSCTL_TXFS_SHUTDOWN_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 87, METHOD_BUFFERED, FILE_WRITE_DATA)
3522 #define FSCTL_TXFS_READ_BACKUP_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 88, METHOD_BUFFERED, FILE_READ_DATA)
3523 #define FSCTL_TXFS_WRITE_BACKUP_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 89, METHOD_BUFFERED, FILE_WRITE_DATA)
3524 #define FSCTL_TXFS_CREATE_SECONDARY_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 90, METHOD_BUFFERED, FILE_WRITE_DATA)
3525 #define FSCTL_TXFS_GET_METADATA_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 91, METHOD_BUFFERED, FILE_READ_DATA)
3526 #define FSCTL_TXFS_GET_TRANSACTED_VERSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 92, METHOD_BUFFERED, FILE_READ_DATA)
3527 #define FSCTL_TXFS_SAVEPOINT_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 94, METHOD_BUFFERED, FILE_WRITE_DATA)
3528 #define FSCTL_TXFS_CREATE_MINIVERSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 95, METHOD_BUFFERED, FILE_WRITE_DATA)
3529 #define FSCTL_TXFS_TRANSACTION_ACTIVE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 99, METHOD_BUFFERED, FILE_READ_DATA)
3530 #define FSCTL_SET_ZERO_ON_DEALLOCATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 101, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3531 #define FSCTL_SET_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 102, METHOD_BUFFERED, FILE_ANY_ACCESS)
3532 #define FSCTL_GET_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 103, METHOD_BUFFERED, FILE_ANY_ACCESS)
3533 #define FSCTL_WAIT_FOR_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 104, METHOD_BUFFERED, FILE_ANY_ACCESS)
3534 #define FSCTL_INITIATE_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 106, METHOD_BUFFERED, FILE_ANY_ACCESS)
3535 #define FSCTL_CSC_INTERNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 107, METHOD_NEITHER, FILE_ANY_ACCESS)
3536 #define FSCTL_SHRINK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 108, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3537 #define FSCTL_SET_SHORT_NAME_BEHAVIOR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 109, METHOD_BUFFERED, FILE_ANY_ACCESS)
3538 #define FSCTL_DFSR_SET_GHOST_HANDLE_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 110, METHOD_BUFFERED, FILE_ANY_ACCESS)
3540 #define FSCTL_TXFS_LIST_TRANSACTION_LOCKED_FILES \
3541 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_READ_DATA)
3542 #define FSCTL_TXFS_LIST_TRANSACTIONS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 121, METHOD_BUFFERED, FILE_READ_DATA)
3543 #define FSCTL_QUERY_PAGEFILE_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 122, METHOD_BUFFERED, FILE_ANY_ACCESS)
3544 #define FSCTL_RESET_VOLUME_ALLOCATION_HINTS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 123, METHOD_BUFFERED, FILE_ANY_ACCESS)
3545 #define FSCTL_TXFS_READ_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 126, METHOD_BUFFERED, FILE_ANY_ACCESS)
3549 #if (_WIN32_WINNT >= 0x0601)
3551 #define FSCTL_QUERY_DEPENDENT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 124, METHOD_BUFFERED, FILE_ANY_ACCESS)
3552 #define FSCTL_SD_GLOBAL_CHANGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 125, METHOD_BUFFERED, FILE_ANY_ACCESS)
3553 #define FSCTL_LOOKUP_STREAM_FROM_CLUSTER CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 127, METHOD_BUFFERED, FILE_ANY_ACCESS)
3554 #define FSCTL_TXFS_WRITE_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 128, METHOD_BUFFERED, FILE_ANY_ACCESS)
3555 #define FSCTL_FILE_TYPE_NOTIFICATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 129, METHOD_BUFFERED, FILE_ANY_ACCESS)
3556 #define FSCTL_GET_BOOT_AREA_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 140, METHOD_BUFFERED, FILE_ANY_ACCESS)
3557 #define FSCTL_GET_RETRIEVAL_POINTER_BASE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 141, METHOD_BUFFERED, FILE_ANY_ACCESS)
3558 #define FSCTL_SET_PERSISTENT_VOLUME_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 142, METHOD_BUFFERED, FILE_ANY_ACCESS)
3559 #define FSCTL_QUERY_PERSISTENT_VOLUME_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 143, METHOD_BUFFERED, FILE_ANY_ACCESS)
3561 #define FSCTL_REQUEST_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 144, METHOD_BUFFERED, FILE_ANY_ACCESS)
3563 #define FSCTL_CSV_TUNNEL_REQUEST CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 145, METHOD_BUFFERED, FILE_ANY_ACCESS)
3564 #define FSCTL_IS_CSV_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 146, METHOD_BUFFERED, FILE_ANY_ACCESS)
3566 #define FSCTL_QUERY_FILE_SYSTEM_RECOGNITION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 147, METHOD_BUFFERED, FILE_ANY_ACCESS)
3567 #define FSCTL_CSV_GET_VOLUME_PATH_NAME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 148, METHOD_BUFFERED, FILE_ANY_ACCESS)
3568 #define FSCTL_CSV_GET_VOLUME_NAME_FOR_VOLUME_MOUNT_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 149, METHOD_BUFFERED, FILE_ANY_ACCESS)
3569 #define FSCTL_CSV_GET_VOLUME_PATH_NAMES_FOR_VOLUME_NAME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 150, METHOD_BUFFERED, FILE_ANY_ACCESS)
3570 #define FSCTL_IS_FILE_ON_CSV_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 151, METHOD_BUFFERED, FILE_ANY_ACCESS)
3572 typedef struct _CSV_NAMESPACE_INFO
{
3575 LARGE_INTEGER StartingOffset
;
3577 } CSV_NAMESPACE_INFO
, *PCSV_NAMESPACE_INFO
;
3579 #define CSV_NAMESPACE_INFO_V1 (sizeof(CSV_NAMESPACE_INFO))
3580 #define CSV_INVALID_DEVICE_NUMBER 0xFFFFFFFF
3584 #define FSCTL_MARK_AS_SYSTEM_HIVE FSCTL_SET_BOOTLOADER_ACCESSED
3586 typedef struct _PATHNAME_BUFFER
{
3587 ULONG PathNameLength
;
3589 } PATHNAME_BUFFER
, *PPATHNAME_BUFFER
;
3591 typedef struct _FSCTL_QUERY_FAT_BPB_BUFFER
{
3592 UCHAR First0x24BytesOfBootSector
[0x24];
3593 } FSCTL_QUERY_FAT_BPB_BUFFER
, *PFSCTL_QUERY_FAT_BPB_BUFFER
;
3595 #if (_WIN32_WINNT >= 0x0400)
3597 typedef struct _NTFS_VOLUME_DATA_BUFFER
{
3598 LARGE_INTEGER VolumeSerialNumber
;
3599 LARGE_INTEGER NumberSectors
;
3600 LARGE_INTEGER TotalClusters
;
3601 LARGE_INTEGER FreeClusters
;
3602 LARGE_INTEGER TotalReserved
;
3603 ULONG BytesPerSector
;
3604 ULONG BytesPerCluster
;
3605 ULONG BytesPerFileRecordSegment
;
3606 ULONG ClustersPerFileRecordSegment
;
3607 LARGE_INTEGER MftValidDataLength
;
3608 LARGE_INTEGER MftStartLcn
;
3609 LARGE_INTEGER Mft2StartLcn
;
3610 LARGE_INTEGER MftZoneStart
;
3611 LARGE_INTEGER MftZoneEnd
;
3612 } NTFS_VOLUME_DATA_BUFFER
, *PNTFS_VOLUME_DATA_BUFFER
;
3614 typedef struct _NTFS_EXTENDED_VOLUME_DATA
{
3616 USHORT MajorVersion
;
3617 USHORT MinorVersion
;
3618 } NTFS_EXTENDED_VOLUME_DATA
, *PNTFS_EXTENDED_VOLUME_DATA
;
3620 typedef struct _STARTING_LCN_INPUT_BUFFER
{
3621 LARGE_INTEGER StartingLcn
;
3622 } STARTING_LCN_INPUT_BUFFER
, *PSTARTING_LCN_INPUT_BUFFER
;
3624 typedef struct _VOLUME_BITMAP_BUFFER
{
3625 LARGE_INTEGER StartingLcn
;
3626 LARGE_INTEGER BitmapSize
;
3628 } VOLUME_BITMAP_BUFFER
, *PVOLUME_BITMAP_BUFFER
;
3630 typedef struct _STARTING_VCN_INPUT_BUFFER
{
3631 LARGE_INTEGER StartingVcn
;
3632 } STARTING_VCN_INPUT_BUFFER
, *PSTARTING_VCN_INPUT_BUFFER
;
3634 typedef struct _RETRIEVAL_POINTERS_BUFFER
{
3636 LARGE_INTEGER StartingVcn
;
3638 LARGE_INTEGER NextVcn
;
3641 } RETRIEVAL_POINTERS_BUFFER
, *PRETRIEVAL_POINTERS_BUFFER
;
3643 typedef struct _NTFS_FILE_RECORD_INPUT_BUFFER
{
3644 LARGE_INTEGER FileReferenceNumber
;
3645 } NTFS_FILE_RECORD_INPUT_BUFFER
, *PNTFS_FILE_RECORD_INPUT_BUFFER
;
3647 typedef struct _NTFS_FILE_RECORD_OUTPUT_BUFFER
{
3648 LARGE_INTEGER FileReferenceNumber
;
3649 ULONG FileRecordLength
;
3650 UCHAR FileRecordBuffer
[1];
3651 } NTFS_FILE_RECORD_OUTPUT_BUFFER
, *PNTFS_FILE_RECORD_OUTPUT_BUFFER
;
3653 typedef struct _MOVE_FILE_DATA
{
3655 LARGE_INTEGER StartingVcn
;
3656 LARGE_INTEGER StartingLcn
;
3658 } MOVE_FILE_DATA
, *PMOVE_FILE_DATA
;
3660 typedef struct _MOVE_FILE_RECORD_DATA
{
3662 LARGE_INTEGER SourceFileRecord
;
3663 LARGE_INTEGER TargetFileRecord
;
3664 } MOVE_FILE_RECORD_DATA
, *PMOVE_FILE_RECORD_DATA
;
3667 typedef struct _MOVE_FILE_DATA32
{
3669 LARGE_INTEGER StartingVcn
;
3670 LARGE_INTEGER StartingLcn
;
3672 } MOVE_FILE_DATA32
, *PMOVE_FILE_DATA32
;
3675 #endif /* (_WIN32_WINNT >= 0x0400) */
3677 #if (_WIN32_WINNT >= 0x0500)
3679 typedef struct _FIND_BY_SID_DATA
{
3682 } FIND_BY_SID_DATA
, *PFIND_BY_SID_DATA
;
3684 typedef struct _FIND_BY_SID_OUTPUT
{
3685 ULONG NextEntryOffset
;
3687 ULONG FileNameLength
;
3689 } FIND_BY_SID_OUTPUT
, *PFIND_BY_SID_OUTPUT
;
3691 typedef struct _MFT_ENUM_DATA
{
3692 ULONGLONG StartFileReferenceNumber
;
3695 } MFT_ENUM_DATA
, *PMFT_ENUM_DATA
;
3697 typedef struct _CREATE_USN_JOURNAL_DATA
{
3698 ULONGLONG MaximumSize
;
3699 ULONGLONG AllocationDelta
;
3700 } CREATE_USN_JOURNAL_DATA
, *PCREATE_USN_JOURNAL_DATA
;
3702 typedef struct _READ_USN_JOURNAL_DATA
{
3705 ULONG ReturnOnlyOnClose
;
3707 ULONGLONG BytesToWaitFor
;
3708 ULONGLONG UsnJournalID
;
3709 } READ_USN_JOURNAL_DATA
, *PREAD_USN_JOURNAL_DATA
;
3711 typedef struct _USN_RECORD
{
3713 USHORT MajorVersion
;
3714 USHORT MinorVersion
;
3715 ULONGLONG FileReferenceNumber
;
3716 ULONGLONG ParentFileReferenceNumber
;
3718 LARGE_INTEGER TimeStamp
;
3722 ULONG FileAttributes
;
3723 USHORT FileNameLength
;
3724 USHORT FileNameOffset
;
3726 } USN_RECORD
, *PUSN_RECORD
;
3728 #define USN_PAGE_SIZE (0x1000)
3730 #define USN_REASON_DATA_OVERWRITE (0x00000001)
3731 #define USN_REASON_DATA_EXTEND (0x00000002)
3732 #define USN_REASON_DATA_TRUNCATION (0x00000004)
3733 #define USN_REASON_NAMED_DATA_OVERWRITE (0x00000010)
3734 #define USN_REASON_NAMED_DATA_EXTEND (0x00000020)
3735 #define USN_REASON_NAMED_DATA_TRUNCATION (0x00000040)
3736 #define USN_REASON_FILE_CREATE (0x00000100)
3737 #define USN_REASON_FILE_DELETE (0x00000200)
3738 #define USN_REASON_EA_CHANGE (0x00000400)
3739 #define USN_REASON_SECURITY_CHANGE (0x00000800)
3740 #define USN_REASON_RENAME_OLD_NAME (0x00001000)
3741 #define USN_REASON_RENAME_NEW_NAME (0x00002000)
3742 #define USN_REASON_INDEXABLE_CHANGE (0x00004000)
3743 #define USN_REASON_BASIC_INFO_CHANGE (0x00008000)
3744 #define USN_REASON_HARD_LINK_CHANGE (0x00010000)
3745 #define USN_REASON_COMPRESSION_CHANGE (0x00020000)
3746 #define USN_REASON_ENCRYPTION_CHANGE (0x00040000)
3747 #define USN_REASON_OBJECT_ID_CHANGE (0x00080000)
3748 #define USN_REASON_REPARSE_POINT_CHANGE (0x00100000)
3749 #define USN_REASON_STREAM_CHANGE (0x00200000)
3750 #define USN_REASON_TRANSACTED_CHANGE (0x00400000)
3751 #define USN_REASON_CLOSE (0x80000000)
3753 typedef struct _USN_JOURNAL_DATA
{
3754 ULONGLONG UsnJournalID
;
3759 ULONGLONG MaximumSize
;
3760 ULONGLONG AllocationDelta
;
3761 } USN_JOURNAL_DATA
, *PUSN_JOURNAL_DATA
;
3763 typedef struct _DELETE_USN_JOURNAL_DATA
{
3764 ULONGLONG UsnJournalID
;
3766 } DELETE_USN_JOURNAL_DATA
, *PDELETE_USN_JOURNAL_DATA
;
3768 #define USN_DELETE_FLAG_DELETE (0x00000001)
3769 #define USN_DELETE_FLAG_NOTIFY (0x00000002)
3770 #define USN_DELETE_VALID_FLAGS (0x00000003)
3772 typedef struct _MARK_HANDLE_INFO
{
3773 ULONG UsnSourceInfo
;
3774 HANDLE VolumeHandle
;
3776 } MARK_HANDLE_INFO
, *PMARK_HANDLE_INFO
;
3779 typedef struct _MARK_HANDLE_INFO32
{
3780 ULONG UsnSourceInfo
;
3781 UINT32 VolumeHandle
;
3783 } MARK_HANDLE_INFO32
, *PMARK_HANDLE_INFO32
;
3786 #define USN_SOURCE_DATA_MANAGEMENT (0x00000001)
3787 #define USN_SOURCE_AUXILIARY_DATA (0x00000002)
3788 #define USN_SOURCE_REPLICATION_MANAGEMENT (0x00000004)
3790 #define MARK_HANDLE_PROTECT_CLUSTERS (0x00000001)
3791 #define MARK_HANDLE_TXF_SYSTEM_LOG (0x00000004)
3792 #define MARK_HANDLE_NOT_TXF_SYSTEM_LOG (0x00000008)
3794 typedef struct _BULK_SECURITY_TEST_DATA
{
3795 ACCESS_MASK DesiredAccess
;
3796 ULONG SecurityIds
[1];
3797 } BULK_SECURITY_TEST_DATA
, *PBULK_SECURITY_TEST_DATA
;
3799 #define VOLUME_IS_DIRTY (0x00000001)
3800 #define VOLUME_UPGRADE_SCHEDULED (0x00000002)
3801 #define VOLUME_SESSION_OPEN (0x00000004)
3803 typedef struct _FILE_PREFETCH
{
3806 ULONGLONG Prefetch
[1];
3807 } FILE_PREFETCH
, *PFILE_PREFETCH
;
3809 typedef struct _FILE_PREFETCH_EX
{
3813 ULONGLONG Prefetch
[1];
3814 } FILE_PREFETCH_EX
, *PFILE_PREFETCH_EX
;
3816 #define FILE_PREFETCH_TYPE_FOR_CREATE 0x1
3817 #define FILE_PREFETCH_TYPE_FOR_DIRENUM 0x2
3818 #define FILE_PREFETCH_TYPE_FOR_CREATE_EX 0x3
3819 #define FILE_PREFETCH_TYPE_FOR_DIRENUM_EX 0x4
3821 #define FILE_PREFETCH_TYPE_MAX 0x4
3823 typedef struct _FILE_OBJECTID_BUFFER
{
3827 UCHAR BirthVolumeId
[16];
3828 UCHAR BirthObjectId
[16];
3831 UCHAR ExtendedInfo
[48];
3833 } FILE_OBJECTID_BUFFER
, *PFILE_OBJECTID_BUFFER
;
3835 typedef struct _FILE_SET_SPARSE_BUFFER
{
3837 } FILE_SET_SPARSE_BUFFER
, *PFILE_SET_SPARSE_BUFFER
;
3839 typedef struct _FILE_ZERO_DATA_INFORMATION
{
3840 LARGE_INTEGER FileOffset
;
3841 LARGE_INTEGER BeyondFinalZero
;
3842 } FILE_ZERO_DATA_INFORMATION
, *PFILE_ZERO_DATA_INFORMATION
;
3844 typedef struct _FILE_ALLOCATED_RANGE_BUFFER
{
3845 LARGE_INTEGER FileOffset
;
3846 LARGE_INTEGER Length
;
3847 } FILE_ALLOCATED_RANGE_BUFFER
, *PFILE_ALLOCATED_RANGE_BUFFER
;
3849 typedef struct _ENCRYPTION_BUFFER
{
3850 ULONG EncryptionOperation
;
3852 } ENCRYPTION_BUFFER
, *PENCRYPTION_BUFFER
;
3854 #define FILE_SET_ENCRYPTION 0x00000001
3855 #define FILE_CLEAR_ENCRYPTION 0x00000002
3856 #define STREAM_SET_ENCRYPTION 0x00000003
3857 #define STREAM_CLEAR_ENCRYPTION 0x00000004
3859 #define MAXIMUM_ENCRYPTION_VALUE 0x00000004
3861 typedef struct _DECRYPTION_STATUS_BUFFER
{
3862 BOOLEAN NoEncryptedStreams
;
3863 } DECRYPTION_STATUS_BUFFER
, *PDECRYPTION_STATUS_BUFFER
;
3865 #define ENCRYPTION_FORMAT_DEFAULT (0x01)
3867 #define COMPRESSION_FORMAT_SPARSE (0x4000)
3869 typedef struct _REQUEST_RAW_ENCRYPTED_DATA
{
3870 LONGLONG FileOffset
;
3872 } REQUEST_RAW_ENCRYPTED_DATA
, *PREQUEST_RAW_ENCRYPTED_DATA
;
3874 typedef struct _ENCRYPTED_DATA_INFO
{
3875 ULONGLONG StartingFileOffset
;
3876 ULONG OutputBufferOffset
;
3877 ULONG BytesWithinFileSize
;
3878 ULONG BytesWithinValidDataLength
;
3879 USHORT CompressionFormat
;
3880 UCHAR DataUnitShift
;
3883 UCHAR EncryptionFormat
;
3884 USHORT NumberOfDataBlocks
;
3885 ULONG DataBlockSize
[ANYSIZE_ARRAY
];
3886 } ENCRYPTED_DATA_INFO
, *PENCRYPTED_DATA_INFO
;
3888 typedef struct _PLEX_READ_DATA_REQUEST
{
3889 LARGE_INTEGER ByteOffset
;
3892 } PLEX_READ_DATA_REQUEST
, *PPLEX_READ_DATA_REQUEST
;
3894 typedef struct _SI_COPYFILE
{
3895 ULONG SourceFileNameLength
;
3896 ULONG DestinationFileNameLength
;
3898 WCHAR FileNameBuffer
[1];
3899 } SI_COPYFILE
, *PSI_COPYFILE
;
3901 #define COPYFILE_SIS_LINK 0x0001
3902 #define COPYFILE_SIS_REPLACE 0x0002
3903 #define COPYFILE_SIS_FLAGS 0x0003
3905 #endif /* (_WIN32_WINNT >= 0x0500) */
3907 #if (_WIN32_WINNT >= 0x0600)
3909 typedef struct _FILE_MAKE_COMPATIBLE_BUFFER
{
3911 } FILE_MAKE_COMPATIBLE_BUFFER
, *PFILE_MAKE_COMPATIBLE_BUFFER
;
3913 typedef struct _FILE_SET_DEFECT_MGMT_BUFFER
{
3915 } FILE_SET_DEFECT_MGMT_BUFFER
, *PFILE_SET_DEFECT_MGMT_BUFFER
;
3917 typedef struct _FILE_QUERY_SPARING_BUFFER
{
3918 ULONG SparingUnitBytes
;
3919 BOOLEAN SoftwareSparing
;
3920 ULONG TotalSpareBlocks
;
3921 ULONG FreeSpareBlocks
;
3922 } FILE_QUERY_SPARING_BUFFER
, *PFILE_QUERY_SPARING_BUFFER
;
3924 typedef struct _FILE_QUERY_ON_DISK_VOL_INFO_BUFFER
{
3925 LARGE_INTEGER DirectoryCount
;
3926 LARGE_INTEGER FileCount
;
3927 USHORT FsFormatMajVersion
;
3928 USHORT FsFormatMinVersion
;
3929 WCHAR FsFormatName
[12];
3930 LARGE_INTEGER FormatTime
;
3931 LARGE_INTEGER LastUpdateTime
;
3932 WCHAR CopyrightInfo
[34];
3933 WCHAR AbstractInfo
[34];
3934 WCHAR FormattingImplementationInfo
[34];
3935 WCHAR LastModifyingImplementationInfo
[34];
3936 } FILE_QUERY_ON_DISK_VOL_INFO_BUFFER
, *PFILE_QUERY_ON_DISK_VOL_INFO_BUFFER
;
3938 #define SET_REPAIR_ENABLED (0x00000001)
3939 #define SET_REPAIR_VOLUME_BITMAP_SCAN (0x00000002)
3940 #define SET_REPAIR_DELETE_CROSSLINK (0x00000004)
3941 #define SET_REPAIR_WARN_ABOUT_DATA_LOSS (0x00000008)
3942 #define SET_REPAIR_DISABLED_AND_BUGCHECK_ON_CORRUPT (0x00000010)
3943 #define SET_REPAIR_VALID_MASK (0x0000001F)
3945 typedef enum _SHRINK_VOLUME_REQUEST_TYPES
{
3949 } SHRINK_VOLUME_REQUEST_TYPES
, *PSHRINK_VOLUME_REQUEST_TYPES
;
3951 typedef struct _SHRINK_VOLUME_INFORMATION
{
3952 SHRINK_VOLUME_REQUEST_TYPES ShrinkRequestType
;
3954 LONGLONG NewNumberOfSectors
;
3955 } SHRINK_VOLUME_INFORMATION
, *PSHRINK_VOLUME_INFORMATION
;
3957 #define TXFS_RM_FLAG_LOGGING_MODE 0x00000001
3958 #define TXFS_RM_FLAG_RENAME_RM 0x00000002
3959 #define TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX 0x00000004
3960 #define TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN 0x00000008
3961 #define TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS 0x00000010
3962 #define TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT 0x00000020
3963 #define TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE 0x00000040
3964 #define TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX 0x00000080
3965 #define TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN 0x00000100
3966 #define TXFS_RM_FLAG_GROW_LOG 0x00000400
3967 #define TXFS_RM_FLAG_SHRINK_LOG 0x00000800
3968 #define TXFS_RM_FLAG_ENFORCE_MINIMUM_SIZE 0x00001000
3969 #define TXFS_RM_FLAG_PRESERVE_CHANGES 0x00002000
3970 #define TXFS_RM_FLAG_RESET_RM_AT_NEXT_START 0x00004000
3971 #define TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START 0x00008000
3972 #define TXFS_RM_FLAG_PREFER_CONSISTENCY 0x00010000
3973 #define TXFS_RM_FLAG_PREFER_AVAILABILITY 0x00020000
3975 #define TXFS_LOGGING_MODE_SIMPLE (0x0001)
3976 #define TXFS_LOGGING_MODE_FULL (0x0002)
3978 #define TXFS_TRANSACTION_STATE_NONE 0x00
3979 #define TXFS_TRANSACTION_STATE_ACTIVE 0x01
3980 #define TXFS_TRANSACTION_STATE_PREPARED 0x02
3981 #define TXFS_TRANSACTION_STATE_NOTACTIVE 0x03
3983 #define TXFS_MODIFY_RM_VALID_FLAGS \
3984 (TXFS_RM_FLAG_LOGGING_MODE | \
3985 TXFS_RM_FLAG_RENAME_RM | \
3986 TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX | \
3987 TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN | \
3988 TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \
3989 TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT | \
3990 TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE | \
3991 TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX | \
3992 TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN | \
3993 TXFS_RM_FLAG_SHRINK_LOG | \
3994 TXFS_RM_FLAG_GROW_LOG | \
3995 TXFS_RM_FLAG_ENFORCE_MINIMUM_SIZE | \
3996 TXFS_RM_FLAG_PRESERVE_CHANGES | \
3997 TXFS_RM_FLAG_RESET_RM_AT_NEXT_START | \
3998 TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START | \
3999 TXFS_RM_FLAG_PREFER_CONSISTENCY | \
4000 TXFS_RM_FLAG_PREFER_AVAILABILITY)
4002 typedef struct _TXFS_MODIFY_RM
{
4004 ULONG LogContainerCountMax
;
4005 ULONG LogContainerCountMin
;
4006 ULONG LogContainerCount
;
4007 ULONG LogGrowthIncrement
;
4008 ULONG LogAutoShrinkPercentage
;
4011 } TXFS_MODIFY_RM
, *PTXFS_MODIFY_RM
;
4013 #define TXFS_RM_STATE_NOT_STARTED 0
4014 #define TXFS_RM_STATE_STARTING 1
4015 #define TXFS_RM_STATE_ACTIVE 2
4016 #define TXFS_RM_STATE_SHUTTING_DOWN 3
4018 #define TXFS_QUERY_RM_INFORMATION_VALID_FLAGS \
4019 (TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \
4020 TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT | \
4021 TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX | \
4022 TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN | \
4023 TXFS_RM_FLAG_RESET_RM_AT_NEXT_START | \
4024 TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START | \
4025 TXFS_RM_FLAG_PREFER_CONSISTENCY | \
4026 TXFS_RM_FLAG_PREFER_AVAILABILITY)
4028 typedef struct _TXFS_QUERY_RM_INFORMATION
{
4029 ULONG BytesRequired
;
4031 ULONGLONG CurrentLsn
;
4032 ULONGLONG ArchiveTailLsn
;
4033 ULONGLONG LogContainerSize
;
4034 LARGE_INTEGER HighestVirtualClock
;
4035 ULONG LogContainerCount
;
4036 ULONG LogContainerCountMax
;
4037 ULONG LogContainerCountMin
;
4038 ULONG LogGrowthIncrement
;
4039 ULONG LogAutoShrinkPercentage
;
4044 ULONGLONG LogCapacity
;
4048 ULONGLONG TransactionCount
;
4049 ULONGLONG OnePCCount
;
4050 ULONGLONG TwoPCCount
;
4051 ULONGLONG NumberLogFileFull
;
4052 ULONGLONG OldestTransactionAge
;
4054 ULONG TmLogPathOffset
;
4055 } TXFS_QUERY_RM_INFORMATION
, *PTXFS_QUERY_RM_INFORMATION
;
4057 #define TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_REDO_LSN 0x01
4058 #define TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_VIRTUAL_CLOCK 0x02
4060 #define TXFS_ROLLFORWARD_REDO_VALID_FLAGS \
4061 (TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_REDO_LSN | \
4062 TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_VIRTUAL_CLOCK)
4064 typedef struct _TXFS_ROLLFORWARD_REDO_INFORMATION
{
4065 LARGE_INTEGER LastVirtualClock
;
4066 ULONGLONG LastRedoLsn
;
4067 ULONGLONG HighestRecoveryLsn
;
4069 } TXFS_ROLLFORWARD_REDO_INFORMATION
, *PTXFS_ROLLFORWARD_REDO_INFORMATION
;
4071 #define TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MAX 0x00000001
4072 #define TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MIN 0x00000002
4073 #define TXFS_START_RM_FLAG_LOG_CONTAINER_SIZE 0x00000004
4074 #define TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS 0x00000008
4075 #define TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT 0x00000010
4076 #define TXFS_START_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE 0x00000020
4077 #define TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX 0x00000040
4078 #define TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN 0x00000080
4080 #define TXFS_START_RM_FLAG_RECOVER_BEST_EFFORT 0x00000200
4081 #define TXFS_START_RM_FLAG_LOGGING_MODE 0x00000400
4082 #define TXFS_START_RM_FLAG_PRESERVE_CHANGES 0x00000800
4084 #define TXFS_START_RM_FLAG_PREFER_CONSISTENCY 0x00001000
4085 #define TXFS_START_RM_FLAG_PREFER_AVAILABILITY 0x00002000
4087 #define TXFS_START_RM_VALID_FLAGS \
4088 (TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MAX | \
4089 TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MIN | \
4090 TXFS_START_RM_FLAG_LOG_CONTAINER_SIZE | \
4091 TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \
4092 TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT | \
4093 TXFS_START_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE | \
4094 TXFS_START_RM_FLAG_RECOVER_BEST_EFFORT | \
4095 TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX | \
4096 TXFS_START_RM_FLAG_LOGGING_MODE | \
4097 TXFS_START_RM_FLAG_PRESERVE_CHANGES | \
4098 TXFS_START_RM_FLAG_PREFER_CONSISTENCY | \
4099 TXFS_START_RM_FLAG_PREFER_AVAILABILITY)
4101 typedef struct _TXFS_START_RM_INFORMATION
{
4103 ULONGLONG LogContainerSize
;
4104 ULONG LogContainerCountMin
;
4105 ULONG LogContainerCountMax
;
4106 ULONG LogGrowthIncrement
;
4107 ULONG LogAutoShrinkPercentage
;
4108 ULONG TmLogPathOffset
;
4109 USHORT TmLogPathLength
;
4111 USHORT LogPathLength
;
4114 } TXFS_START_RM_INFORMATION
, *PTXFS_START_RM_INFORMATION
;
4116 typedef struct _TXFS_GET_METADATA_INFO_OUT
{
4121 GUID LockingTransaction
;
4123 ULONG TransactionState
;
4124 } TXFS_GET_METADATA_INFO_OUT
, *PTXFS_GET_METADATA_INFO_OUT
;
4126 #define TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_CREATED 0x00000001
4127 #define TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_DELETED 0x00000002
4129 typedef struct _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY
{
4137 } TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY
, *PTXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY
;
4139 typedef struct _TXFS_LIST_TRANSACTION_LOCKED_FILES
{
4140 GUID KtmTransaction
;
4141 ULONGLONG NumberOfFiles
;
4142 ULONGLONG BufferSizeRequired
;
4144 } TXFS_LIST_TRANSACTION_LOCKED_FILES
, *PTXFS_LIST_TRANSACTION_LOCKED_FILES
;
4146 typedef struct _TXFS_LIST_TRANSACTIONS_ENTRY
{
4148 ULONG TransactionState
;
4152 } TXFS_LIST_TRANSACTIONS_ENTRY
, *PTXFS_LIST_TRANSACTIONS_ENTRY
;
4154 typedef struct _TXFS_LIST_TRANSACTIONS
{
4155 ULONGLONG NumberOfTransactions
;
4156 ULONGLONG BufferSizeRequired
;
4157 } TXFS_LIST_TRANSACTIONS
, *PTXFS_LIST_TRANSACTIONS
;
4159 typedef struct _TXFS_READ_BACKUP_INFORMATION_OUT
{
4164 } TXFS_READ_BACKUP_INFORMATION_OUT
, *PTXFS_READ_BACKUP_INFORMATION_OUT
;
4166 typedef struct _TXFS_WRITE_BACKUP_INFORMATION
{
4168 } TXFS_WRITE_BACKUP_INFORMATION
, *PTXFS_WRITE_BACKUP_INFORMATION
;
4170 #define TXFS_TRANSACTED_VERSION_NONTRANSACTED 0xFFFFFFFE
4171 #define TXFS_TRANSACTED_VERSION_UNCOMMITTED 0xFFFFFFFF
4173 typedef struct _TXFS_GET_TRANSACTED_VERSION
{
4174 ULONG ThisBaseVersion
;
4175 ULONG LatestVersion
;
4176 USHORT ThisMiniVersion
;
4177 USHORT FirstMiniVersion
;
4178 USHORT LatestMiniVersion
;
4179 } TXFS_GET_TRANSACTED_VERSION
, *PTXFS_GET_TRANSACTED_VERSION
;
4181 #define TXFS_SAVEPOINT_SET 0x00000001
4182 #define TXFS_SAVEPOINT_ROLLBACK 0x00000002
4183 #define TXFS_SAVEPOINT_CLEAR 0x00000004
4184 #define TXFS_SAVEPOINT_CLEAR_ALL 0x00000010
4186 typedef struct _TXFS_SAVEPOINT_INFORMATION
{
4187 HANDLE KtmTransaction
;
4190 } TXFS_SAVEPOINT_INFORMATION
, *PTXFS_SAVEPOINT_INFORMATION
;
4192 typedef struct _TXFS_CREATE_MINIVERSION_INFO
{
4193 USHORT StructureVersion
;
4194 USHORT StructureLength
;
4197 } TXFS_CREATE_MINIVERSION_INFO
, *PTXFS_CREATE_MINIVERSION_INFO
;
4199 typedef struct _TXFS_TRANSACTION_ACTIVE_INFO
{
4200 BOOLEAN TransactionsActiveAtSnapshot
;
4201 } TXFS_TRANSACTION_ACTIVE_INFO
, *PTXFS_TRANSACTION_ACTIVE_INFO
;
4203 #endif /* (_WIN32_WINNT >= 0x0600) */
4205 #if (_WIN32_WINNT >= 0x0601)
4207 #define MARK_HANDLE_REALTIME (0x00000020)
4208 #define MARK_HANDLE_NOT_REALTIME (0x00000040)
4210 #define NO_8DOT3_NAME_PRESENT (0x00000001)
4211 #define REMOVED_8DOT3_NAME (0x00000002)
4213 #define PERSISTENT_VOLUME_STATE_SHORT_NAME_CREATION_DISABLED (0x00000001)
4215 typedef struct _BOOT_AREA_INFO
{
4216 ULONG BootSectorCount
;
4218 LARGE_INTEGER Offset
;
4220 } BOOT_AREA_INFO
, *PBOOT_AREA_INFO
;
4222 typedef struct _RETRIEVAL_POINTER_BASE
{
4223 LARGE_INTEGER FileAreaOffset
;
4224 } RETRIEVAL_POINTER_BASE
, *PRETRIEVAL_POINTER_BASE
;
4226 typedef struct _FILE_FS_PERSISTENT_VOLUME_INFORMATION
{
4231 } FILE_FS_PERSISTENT_VOLUME_INFORMATION
, *PFILE_FS_PERSISTENT_VOLUME_INFORMATION
;
4233 typedef struct _FILE_SYSTEM_RECOGNITION_INFORMATION
{
4235 } FILE_SYSTEM_RECOGNITION_INFORMATION
, *PFILE_SYSTEM_RECOGNITION_INFORMATION
;
4237 #define OPLOCK_LEVEL_CACHE_READ (0x00000001)
4238 #define OPLOCK_LEVEL_CACHE_HANDLE (0x00000002)
4239 #define OPLOCK_LEVEL_CACHE_WRITE (0x00000004)
4241 #define REQUEST_OPLOCK_INPUT_FLAG_REQUEST (0x00000001)
4242 #define REQUEST_OPLOCK_INPUT_FLAG_ACK (0x00000002)
4243 #define REQUEST_OPLOCK_INPUT_FLAG_COMPLETE_ACK_ON_CLOSE (0x00000004)
4245 #define REQUEST_OPLOCK_CURRENT_VERSION 1
4247 typedef struct _REQUEST_OPLOCK_INPUT_BUFFER
{
4248 USHORT StructureVersion
;
4249 USHORT StructureLength
;
4250 ULONG RequestedOplockLevel
;
4252 } REQUEST_OPLOCK_INPUT_BUFFER
, *PREQUEST_OPLOCK_INPUT_BUFFER
;
4254 #define REQUEST_OPLOCK_OUTPUT_FLAG_ACK_REQUIRED (0x00000001)
4255 #define REQUEST_OPLOCK_OUTPUT_FLAG_MODES_PROVIDED (0x00000002)
4257 typedef struct _REQUEST_OPLOCK_OUTPUT_BUFFER
{
4258 USHORT StructureVersion
;
4259 USHORT StructureLength
;
4260 ULONG OriginalOplockLevel
;
4261 ULONG NewOplockLevel
;
4263 ACCESS_MASK AccessMode
;
4265 } REQUEST_OPLOCK_OUTPUT_BUFFER
, *PREQUEST_OPLOCK_OUTPUT_BUFFER
;
4267 #define SD_GLOBAL_CHANGE_TYPE_MACHINE_SID 1
4269 typedef struct _SD_CHANGE_MACHINE_SID_INPUT
{
4270 USHORT CurrentMachineSIDOffset
;
4271 USHORT CurrentMachineSIDLength
;
4272 USHORT NewMachineSIDOffset
;
4273 USHORT NewMachineSIDLength
;
4274 } SD_CHANGE_MACHINE_SID_INPUT
, *PSD_CHANGE_MACHINE_SID_INPUT
;
4276 typedef struct _SD_CHANGE_MACHINE_SID_OUTPUT
{
4277 ULONGLONG NumSDChangedSuccess
;
4278 ULONGLONG NumSDChangedFail
;
4279 ULONGLONG NumSDUnused
;
4280 ULONGLONG NumSDTotal
;
4281 ULONGLONG NumMftSDChangedSuccess
;
4282 ULONGLONG NumMftSDChangedFail
;
4283 ULONGLONG NumMftSDTotal
;
4284 } SD_CHANGE_MACHINE_SID_OUTPUT
, *PSD_CHANGE_MACHINE_SID_OUTPUT
;
4286 typedef struct _SD_GLOBAL_CHANGE_INPUT
{
4290 SD_CHANGE_MACHINE_SID_INPUT SdChange
;
4292 } SD_GLOBAL_CHANGE_INPUT
, *PSD_GLOBAL_CHANGE_INPUT
;
4294 typedef struct _SD_GLOBAL_CHANGE_OUTPUT
{
4298 SD_CHANGE_MACHINE_SID_OUTPUT SdChange
;
4300 } SD_GLOBAL_CHANGE_OUTPUT
, *PSD_GLOBAL_CHANGE_OUTPUT
;
4302 #define ENCRYPTED_DATA_INFO_SPARSE_FILE 1
4304 typedef struct _EXTENDED_ENCRYPTED_DATA_INFO
{
4309 } EXTENDED_ENCRYPTED_DATA_INFO
, *PEXTENDED_ENCRYPTED_DATA_INFO
;
4311 typedef struct _LOOKUP_STREAM_FROM_CLUSTER_INPUT
{
4313 ULONG NumberOfClusters
;
4314 LARGE_INTEGER Cluster
[1];
4315 } LOOKUP_STREAM_FROM_CLUSTER_INPUT
, *PLOOKUP_STREAM_FROM_CLUSTER_INPUT
;
4317 typedef struct _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT
{
4319 ULONG NumberOfMatches
;
4320 ULONG BufferSizeRequired
;
4321 } LOOKUP_STREAM_FROM_CLUSTER_OUTPUT
, *PLOOKUP_STREAM_FROM_CLUSTER_OUTPUT
;
4323 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_PAGE_FILE 0x00000001
4324 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_DENY_DEFRAG_SET 0x00000002
4325 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_FS_SYSTEM_FILE 0x00000004
4326 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_TXF_SYSTEM_FILE 0x00000008
4328 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_MASK 0xff000000
4329 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_DATA 0x01000000
4330 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_INDEX 0x02000000
4331 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_SYSTEM 0x03000000
4333 typedef struct _LOOKUP_STREAM_FROM_CLUSTER_ENTRY
{
4336 LARGE_INTEGER Reserved
;
4337 LARGE_INTEGER Cluster
;
4339 } LOOKUP_STREAM_FROM_CLUSTER_ENTRY
, *PLOOKUP_STREAM_FROM_CLUSTER_ENTRY
;
4341 typedef struct _FILE_TYPE_NOTIFICATION_INPUT
{
4343 ULONG NumFileTypeIDs
;
4345 } FILE_TYPE_NOTIFICATION_INPUT
, *PFILE_TYPE_NOTIFICATION_INPUT
;
4347 #define FILE_TYPE_NOTIFICATION_FLAG_USAGE_BEGIN 0x00000001
4348 #define FILE_TYPE_NOTIFICATION_FLAG_USAGE_END 0x00000002
4350 DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_PAGE_FILE
, 0x0d0a64a1, 0x38fc, 0x4db8, 0x9f, 0xe7, 0x3f, 0x43, 0x52, 0xcd, 0x7c, 0x5c );
4351 DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_HIBERNATION_FILE
, 0xb7624d64, 0xb9a3, 0x4cf8, 0x80, 0x11, 0x5b, 0x86, 0xc9, 0x40, 0xe7, 0xb7 );
4352 DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_CRASHDUMP_FILE
, 0x9d453eb7, 0xd2a6, 0x4dbd, 0xa2, 0xe3, 0xfb, 0xd0, 0xed, 0x91, 0x09, 0xa9 );
4354 #ifndef _VIRTUAL_STORAGE_TYPE_DEFINED
4355 #define _VIRTUAL_STORAGE_TYPE_DEFINED
4356 typedef struct _VIRTUAL_STORAGE_TYPE
{
4359 } VIRTUAL_STORAGE_TYPE
, *PVIRTUAL_STORAGE_TYPE
;
4362 typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST
{
4365 } STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST
, *PSTORAGE_QUERY_DEPENDENT_VOLUME_REQUEST
;
4367 #define QUERY_DEPENDENT_VOLUME_REQUEST_FLAG_HOST_VOLUMES 0x1
4368 #define QUERY_DEPENDENT_VOLUME_REQUEST_FLAG_GUEST_VOLUMES 0x2
4370 typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY
{
4372 ULONG DependencyTypeFlags
;
4373 ULONG ProviderSpecificFlags
;
4374 VIRTUAL_STORAGE_TYPE VirtualStorageType
;
4375 } STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY
, *PSTORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY
;
4377 typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY
{
4379 ULONG DependencyTypeFlags
;
4380 ULONG ProviderSpecificFlags
;
4381 VIRTUAL_STORAGE_TYPE VirtualStorageType
;
4382 ULONG AncestorLevel
;
4383 ULONG HostVolumeNameOffset
;
4384 ULONG HostVolumeNameSize
;
4385 ULONG DependentVolumeNameOffset
;
4386 ULONG DependentVolumeNameSize
;
4387 ULONG RelativePathOffset
;
4388 ULONG RelativePathSize
;
4389 ULONG DependentDeviceNameOffset
;
4390 ULONG DependentDeviceNameSize
;
4391 } STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY
, *PSTORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY
;
4393 typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE
{
4394 ULONG ResponseLevel
;
4395 ULONG NumberEntries
;
4397 STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY Lev1Depends
[];
4398 STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY Lev2Depends
[];
4400 } STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE
, *PSTORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE
;
4402 #endif /* (_WIN32_WINNT >= 0x0601) */
4404 typedef struct _FILESYSTEM_STATISTICS
{
4405 USHORT FileSystemType
;
4407 ULONG SizeOfCompleteStructure
;
4408 ULONG UserFileReads
;
4409 ULONG UserFileReadBytes
;
4410 ULONG UserDiskReads
;
4411 ULONG UserFileWrites
;
4412 ULONG UserFileWriteBytes
;
4413 ULONG UserDiskWrites
;
4414 ULONG MetaDataReads
;
4415 ULONG MetaDataReadBytes
;
4416 ULONG MetaDataDiskReads
;
4417 ULONG MetaDataWrites
;
4418 ULONG MetaDataWriteBytes
;
4419 ULONG MetaDataDiskWrites
;
4420 } FILESYSTEM_STATISTICS
, *PFILESYSTEM_STATISTICS
;
4422 #define FILESYSTEM_STATISTICS_TYPE_NTFS 1
4423 #define FILESYSTEM_STATISTICS_TYPE_FAT 2
4424 #define FILESYSTEM_STATISTICS_TYPE_EXFAT 3
4426 typedef struct _FAT_STATISTICS
{
4428 ULONG SuccessfulCreates
;
4429 ULONG FailedCreates
;
4430 ULONG NonCachedReads
;
4431 ULONG NonCachedReadBytes
;
4432 ULONG NonCachedWrites
;
4433 ULONG NonCachedWriteBytes
;
4434 ULONG NonCachedDiskReads
;
4435 ULONG NonCachedDiskWrites
;
4436 } FAT_STATISTICS
, *PFAT_STATISTICS
;
4438 typedef struct _EXFAT_STATISTICS
{
4440 ULONG SuccessfulCreates
;
4441 ULONG FailedCreates
;
4442 ULONG NonCachedReads
;
4443 ULONG NonCachedReadBytes
;
4444 ULONG NonCachedWrites
;
4445 ULONG NonCachedWriteBytes
;
4446 ULONG NonCachedDiskReads
;
4447 ULONG NonCachedDiskWrites
;
4448 } EXFAT_STATISTICS
, *PEXFAT_STATISTICS
;
4450 typedef struct _NTFS_STATISTICS
{
4451 ULONG LogFileFullExceptions
;
4452 ULONG OtherExceptions
;
4456 ULONG MftWriteBytes
;
4462 } MftWritesUserLevel
;
4463 USHORT MftWritesFlushForLogFileFull
;
4464 USHORT MftWritesLazyWriter
;
4465 USHORT MftWritesUserRequest
;
4467 ULONG Mft2WriteBytes
;
4473 } Mft2WritesUserLevel
;
4474 USHORT Mft2WritesFlushForLogFileFull
;
4475 USHORT Mft2WritesLazyWriter
;
4476 USHORT Mft2WritesUserRequest
;
4477 ULONG RootIndexReads
;
4478 ULONG RootIndexReadBytes
;
4479 ULONG RootIndexWrites
;
4480 ULONG RootIndexWriteBytes
;
4482 ULONG BitmapReadBytes
;
4484 ULONG BitmapWriteBytes
;
4485 USHORT BitmapWritesFlushForLogFileFull
;
4486 USHORT BitmapWritesLazyWriter
;
4487 USHORT BitmapWritesUserRequest
;
4492 } BitmapWritesUserLevel
;
4493 ULONG MftBitmapReads
;
4494 ULONG MftBitmapReadBytes
;
4495 ULONG MftBitmapWrites
;
4496 ULONG MftBitmapWriteBytes
;
4497 USHORT MftBitmapWritesFlushForLogFileFull
;
4498 USHORT MftBitmapWritesLazyWriter
;
4499 USHORT MftBitmapWritesUserRequest
;
4505 } MftBitmapWritesUserLevel
;
4506 ULONG UserIndexReads
;
4507 ULONG UserIndexReadBytes
;
4508 ULONG UserIndexWrites
;
4509 ULONG UserIndexWriteBytes
;
4511 ULONG LogFileReadBytes
;
4512 ULONG LogFileWrites
;
4513 ULONG LogFileWriteBytes
;
4520 ULONG HintsClusters
;
4522 ULONG CacheClusters
;
4524 ULONG CacheMissClusters
;
4526 } NTFS_STATISTICS
, *PNTFS_STATISTICS
;
4528 #endif // _FILESYSTEMFSCTL_
4530 #define SYMLINK_FLAG_RELATIVE 1
4532 typedef struct _REPARSE_DATA_BUFFER
{
4534 USHORT ReparseDataLength
;
4536 __GNU_EXTENSION
union {
4538 USHORT SubstituteNameOffset
;
4539 USHORT SubstituteNameLength
;
4540 USHORT PrintNameOffset
;
4541 USHORT PrintNameLength
;
4543 WCHAR PathBuffer
[1];
4544 } SymbolicLinkReparseBuffer
;
4546 USHORT SubstituteNameOffset
;
4547 USHORT SubstituteNameLength
;
4548 USHORT PrintNameOffset
;
4549 USHORT PrintNameLength
;
4550 WCHAR PathBuffer
[1];
4551 } MountPointReparseBuffer
;
4553 UCHAR DataBuffer
[1];
4554 } GenericReparseBuffer
;
4556 } REPARSE_DATA_BUFFER
, *PREPARSE_DATA_BUFFER
;
4558 #define REPARSE_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(REPARSE_DATA_BUFFER, GenericReparseBuffer)
4560 typedef struct _REPARSE_GUID_DATA_BUFFER
{
4562 USHORT ReparseDataLength
;
4566 UCHAR DataBuffer
[1];
4567 } GenericReparseBuffer
;
4568 } REPARSE_GUID_DATA_BUFFER
, *PREPARSE_GUID_DATA_BUFFER
;
4570 #define REPARSE_GUID_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(REPARSE_GUID_DATA_BUFFER, GenericReparseBuffer)
4572 #define MAXIMUM_REPARSE_DATA_BUFFER_SIZE ( 16 * 1024 )
4574 /* Reserved reparse tags */
4575 #define IO_REPARSE_TAG_RESERVED_ZERO (0)
4576 #define IO_REPARSE_TAG_RESERVED_ONE (1)
4577 #define IO_REPARSE_TAG_RESERVED_RANGE IO_REPARSE_TAG_RESERVED_ONE
4579 #define IsReparseTagMicrosoft(_tag) (((_tag) & 0x80000000))
4580 #define IsReparseTagNameSurrogate(_tag) (((_tag) & 0x20000000))
4582 #define IO_REPARSE_TAG_VALID_VALUES (0xF000FFFF)
4584 #define IsReparseTagValid(tag) ( \
4585 !((tag) & ~IO_REPARSE_TAG_VALID_VALUES) && \
4586 ((tag) > IO_REPARSE_TAG_RESERVED_RANGE) \
4589 /* MicroSoft reparse point tags */
4590 #define IO_REPARSE_TAG_MOUNT_POINT (0xA0000003L)
4591 #define IO_REPARSE_TAG_HSM (0xC0000004L)
4592 #define IO_REPARSE_TAG_DRIVE_EXTENDER (0x80000005L)
4593 #define IO_REPARSE_TAG_HSM2 (0x80000006L)
4594 #define IO_REPARSE_TAG_SIS (0x80000007L)
4595 #define IO_REPARSE_TAG_WIM (0x80000008L)
4596 #define IO_REPARSE_TAG_CSV (0x80000009L)
4597 #define IO_REPARSE_TAG_DFS (0x8000000AL)
4598 #define IO_REPARSE_TAG_FILTER_MANAGER (0x8000000BL)
4599 #define IO_REPARSE_TAG_SYMLINK (0xA000000CL)
4600 #define IO_REPARSE_TAG_IIS_CACHE (0xA0000010L)
4601 #define IO_REPARSE_TAG_DFSR (0x80000012L)
4604 typedef struct _REPARSE_INDEX_KEY
{
4605 ULONG FileReparseTag
;
4606 LARGE_INTEGER FileId
;
4607 } REPARSE_INDEX_KEY
, *PREPARSE_INDEX_KEY
;
4610 #define FSCTL_LMR_GET_LINK_TRACKING_INFORMATION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,58,METHOD_BUFFERED,FILE_ANY_ACCESS)
4611 #define FSCTL_LMR_SET_LINK_TRACKING_INFORMATION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,59,METHOD_BUFFERED,FILE_ANY_ACCESS)
4612 #define IOCTL_LMR_ARE_FILE_OBJECTS_ON_SAME_SERVER CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,60,METHOD_BUFFERED,FILE_ANY_ACCESS)
4614 #define FSCTL_PIPE_ASSIGN_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
4615 #define FSCTL_PIPE_DISCONNECT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
4616 #define FSCTL_PIPE_LISTEN CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
4617 #define FSCTL_PIPE_PEEK CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
4618 #define FSCTL_PIPE_QUERY_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
4619 #define FSCTL_PIPE_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
4620 #define FSCTL_PIPE_WAIT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
4621 #define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
4622 #define FSCTL_PIPE_SET_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
4623 #define FSCTL_PIPE_QUERY_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
4624 #define FSCTL_PIPE_GET_PIPE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
4625 #define FSCTL_PIPE_SET_PIPE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
4626 #define FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
4627 #define FSCTL_PIPE_SET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 13, METHOD_BUFFERED, FILE_ANY_ACCESS)
4628 #define FSCTL_PIPE_GET_HANDLE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 14, METHOD_BUFFERED, FILE_ANY_ACCESS)
4629 #define FSCTL_PIPE_SET_HANDLE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
4630 #define FSCTL_PIPE_FLUSH CTL_CODE(FILE_DEVICE_NAMED_PIPE, 16, METHOD_BUFFERED, FILE_WRITE_DATA)
4632 #define FSCTL_PIPE_INTERNAL_READ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
4633 #define FSCTL_PIPE_INTERNAL_WRITE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
4634 #define FSCTL_PIPE_INTERNAL_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
4635 #define FSCTL_PIPE_INTERNAL_READ_OVFLOW CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
4637 #define FILE_PIPE_READ_DATA 0x00000000
4638 #define FILE_PIPE_WRITE_SPACE 0x00000001
4640 typedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER
{
4643 } FILE_PIPE_ASSIGN_EVENT_BUFFER
, *PFILE_PIPE_ASSIGN_EVENT_BUFFER
;
4645 typedef struct _FILE_PIPE_EVENT_BUFFER
{
4646 ULONG NamedPipeState
;
4650 ULONG NumberRequests
;
4651 } FILE_PIPE_EVENT_BUFFER
, *PFILE_PIPE_EVENT_BUFFER
;
4653 typedef struct _FILE_PIPE_PEEK_BUFFER
{
4654 ULONG NamedPipeState
;
4655 ULONG ReadDataAvailable
;
4656 ULONG NumberOfMessages
;
4657 ULONG MessageLength
;
4659 } FILE_PIPE_PEEK_BUFFER
, *PFILE_PIPE_PEEK_BUFFER
;
4661 typedef struct _FILE_PIPE_WAIT_FOR_BUFFER
{
4662 LARGE_INTEGER Timeout
;
4664 BOOLEAN TimeoutSpecified
;
4666 } FILE_PIPE_WAIT_FOR_BUFFER
, *PFILE_PIPE_WAIT_FOR_BUFFER
;
4668 typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER
{
4669 #if !defined(BUILD_WOW6432)
4670 PVOID ClientSession
;
4671 PVOID ClientProcess
;
4673 ULONGLONG ClientSession
;
4674 ULONGLONG ClientProcess
;
4676 } FILE_PIPE_CLIENT_PROCESS_BUFFER
, *PFILE_PIPE_CLIENT_PROCESS_BUFFER
;
4678 #define FILE_PIPE_COMPUTER_NAME_LENGTH 15
4680 typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX
{
4681 #if !defined(BUILD_WOW6432)
4682 PVOID ClientSession
;
4683 PVOID ClientProcess
;
4685 ULONGLONG ClientSession
;
4686 ULONGLONG ClientProcess
;
4688 USHORT ClientComputerNameLength
;
4689 WCHAR ClientComputerBuffer
[FILE_PIPE_COMPUTER_NAME_LENGTH
+1];
4690 } FILE_PIPE_CLIENT_PROCESS_BUFFER_EX
, *PFILE_PIPE_CLIENT_PROCESS_BUFFER_EX
;
4692 #define FSCTL_MAILSLOT_PEEK CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)
4694 typedef enum _LINK_TRACKING_INFORMATION_TYPE
{
4695 NtfsLinkTrackingInformation
,
4696 DfsLinkTrackingInformation
4697 } LINK_TRACKING_INFORMATION_TYPE
, *PLINK_TRACKING_INFORMATION_TYPE
;
4699 typedef struct _LINK_TRACKING_INFORMATION
{
4700 LINK_TRACKING_INFORMATION_TYPE Type
;
4702 } LINK_TRACKING_INFORMATION
, *PLINK_TRACKING_INFORMATION
;
4704 typedef struct _REMOTE_LINK_TRACKING_INFORMATION
{
4705 PVOID TargetFileObject
;
4706 ULONG TargetLinkTrackingInformationLength
;
4707 UCHAR TargetLinkTrackingInformationBuffer
[1];
4708 } REMOTE_LINK_TRACKING_INFORMATION
, *PREMOTE_LINK_TRACKING_INFORMATION
;
4710 typedef enum _OBJECT_INFORMATION_CLASS
{
4711 ObjectBasicInformation
= 0,
4712 ObjectTypeInformation
= 2
4713 } OBJECT_INFORMATION_CLASS
;
4715 typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION
{
4717 ACCESS_MASK GrantedAccess
;
4721 } PUBLIC_OBJECT_BASIC_INFORMATION
, *PPUBLIC_OBJECT_BASIC_INFORMATION
;
4723 typedef struct _PUBLIC_OBJECT_TYPE_INFORMATION
{
4724 UNICODE_STRING TypeName
;
4725 ULONG Reserved
[22];
4726 } PUBLIC_OBJECT_TYPE_INFORMATION
, *PPUBLIC_OBJECT_TYPE_INFORMATION
;
4728 typedef struct _SECURITY_CLIENT_CONTEXT
{
4729 SECURITY_QUALITY_OF_SERVICE SecurityQos
;
4730 PACCESS_TOKEN ClientToken
;
4731 BOOLEAN DirectlyAccessClientToken
;
4732 BOOLEAN DirectAccessEffectiveOnly
;
4733 BOOLEAN ServerIsRemote
;
4734 TOKEN_CONTROL ClientTokenControl
;
4735 } SECURITY_CLIENT_CONTEXT
, *PSECURITY_CLIENT_CONTEXT
;
4737 #define EVENT_INCREMENT 1
4738 #define IO_NO_INCREMENT 0
4739 #define IO_CD_ROM_INCREMENT 1
4740 #define IO_DISK_INCREMENT 1
4741 #define IO_MAILSLOT_INCREMENT 2
4742 #define IO_NAMED_PIPE_INCREMENT 2
4743 #define IO_NETWORK_INCREMENT 2
4744 #define SEMAPHORE_INCREMENT 1
4746 #define SYSTEM_PAGE_PRIORITY_BITS 3
4747 #define SYSTEM_PAGE_PRIORITY_LEVELS (1 << SYSTEM_PAGE_PRIORITY_BITS)
4749 typedef struct _KAPC_STATE
{
4750 LIST_ENTRY ApcListHead
[MaximumMode
];
4752 BOOLEAN KernelApcInProgress
;
4753 BOOLEAN KernelApcPending
;
4754 BOOLEAN UserApcPending
;
4755 } KAPC_STATE
, *PKAPC_STATE
, *RESTRICTED_POINTER PRKAPC_STATE
;
4757 #define KAPC_STATE_ACTUAL_LENGTH (FIELD_OFFSET(KAPC_STATE, UserApcPending) + sizeof(BOOLEAN))
4759 typedef struct _KQUEUE
{
4760 DISPATCHER_HEADER Header
;
4761 LIST_ENTRY EntryListHead
;
4762 volatile ULONG CurrentCount
;
4764 LIST_ENTRY ThreadListHead
;
4765 } KQUEUE
, *PKQUEUE
, *RESTRICTED_POINTER PRKQUEUE
;
4767 #if (NTDDI_VERSION >= NTDDI_WIN2K)
4773 OUT PRKMUTANT Mutant
,
4774 IN BOOLEAN InitialOwner
);
4780 IN PRKMUTANT Mutant
);
4786 IN OUT PRKMUTANT Mutant
,
4787 IN KPRIORITY Increment
,
4788 IN BOOLEAN Abandoned
,
4808 IN OUT PRKQUEUE Queue
,
4809 IN OUT PLIST_ENTRY Entry
);
4815 IN OUT PRKQUEUE Queue
,
4816 IN OUT PLIST_ENTRY Entry
);
4822 IN OUT PRKQUEUE Queue
,
4823 IN KPROCESSOR_MODE WaitMode
,
4824 IN PLARGE_INTEGER Timeout OPTIONAL
);
4830 IN OUT PKPROCESS Process
);
4842 IN OUT PRKQUEUE Queue
);
4847 KeStackAttachProcess(
4848 IN OUT PKPROCESS Process
,
4849 OUT PKAPC_STATE ApcState
);
4854 KeUnstackDetachProcess(
4855 IN PKAPC_STATE ApcState
);
4860 KeSetIdealProcessorThread(
4861 IN OUT PKTHREAD Thread
,
4862 IN UCHAR Processor
);
4867 KeSetKernelStackSwapEnable(
4874 KeAcquireSpinLockRaiseToSynch(
4875 IN OUT PKSPIN_LOCK SpinLock
);
4879 KeAcquireSpinLockRaiseToSynch(
4880 IN OUT PKSPIN_LOCK SpinLock
);
4883 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
4885 #if (NTDDI_VERSION >= NTDDI_WINXP)
4890 KeAcquireQueuedSpinLock(
4891 IN OUT KSPIN_LOCK_QUEUE_NUMBER Number
);
4896 KeReleaseQueuedSpinLock(
4897 IN OUT KSPIN_LOCK_QUEUE_NUMBER Number
,
4903 KeTryToAcquireQueuedSpinLock(
4904 IN KSPIN_LOCK_QUEUE_NUMBER Number
,
4905 OUT PKIRQL OldIrql
);
4907 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
4909 #if (NTDDI_VERSION >= NTDDI_VISTA)
4915 OUT PCLIENT_ID ClientId
);
4920 IN OUT PKQUEUE Queue
,
4921 IN KPROCESSOR_MODE WaitMode
,
4922 IN BOOLEAN Alertable
,
4923 IN PLARGE_INTEGER Timeout OPTIONAL
,
4924 OUT PLIST_ENTRY
*EntryArray
,
4927 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
4929 #define INVALID_PROCESSOR_INDEX 0xffffffff
4933 KeGetProcessorNumberFromIndex(
4935 OUT PPROCESSOR_NUMBER ProcNumber
);
4939 KeGetProcessorIndexFromNumber(
4940 IN PPROCESSOR_NUMBER ProcNumber
);
4942 #pragma pack(push,4)
4944 #ifndef VER_PRODUCTBUILD
4945 #define VER_PRODUCTBUILD 10000
4948 #define EX_PUSH_LOCK ULONG_PTR
4949 #define PEX_PUSH_LOCK PULONG_PTR
4954 extern PUCHAR FsRtlLegalAnsiCharacterArray
;
4956 extern DECLSPEC_IMPORT PUCHAR FsRtlLegalAnsiCharacterArray
;
4958 extern PACL SePublicDefaultDacl
;
4959 extern PACL SeSystemDefaultDacl
;
4961 extern KSPIN_LOCK IoStatisticsLock
;
4962 extern ULONG IoReadOperationCount
;
4963 extern ULONG IoWriteOperationCount
;
4964 extern ULONG IoOtherOperationCount
;
4965 extern LARGE_INTEGER IoReadTransferCount
;
4966 extern LARGE_INTEGER IoWriteTransferCount
;
4967 extern LARGE_INTEGER IoOtherTransferCount
;
4969 #define FS_LFN_APIS 0x00004000
4971 #define FILE_STORAGE_TYPE_SPECIFIED 0x00000041 /* FILE_DIRECTORY_FILE | FILE_NON_DIRECTORY_FILE */
4972 #define FILE_STORAGE_TYPE_DEFAULT (StorageTypeDefault << FILE_STORAGE_TYPE_SHIFT)
4973 #define FILE_STORAGE_TYPE_DIRECTORY (StorageTypeDirectory << FILE_STORAGE_TYPE_SHIFT)
4974 #define FILE_STORAGE_TYPE_FILE (StorageTypeFile << FILE_STORAGE_TYPE_SHIFT)
4975 #define FILE_STORAGE_TYPE_DOCFILE (StorageTypeDocfile << FILE_STORAGE_TYPE_SHIFT)
4976 #define FILE_STORAGE_TYPE_JUNCTION_POINT (StorageTypeJunctionPoint << FILE_STORAGE_TYPE_SHIFT)
4977 #define FILE_STORAGE_TYPE_CATALOG (StorageTypeCatalog << FILE_STORAGE_TYPE_SHIFT)
4978 #define FILE_STORAGE_TYPE_STRUCTURED_STORAGE (StorageTypeStructuredStorage << FILE_STORAGE_TYPE_SHIFT)
4979 #define FILE_STORAGE_TYPE_EMBEDDING (StorageTypeEmbedding << FILE_STORAGE_TYPE_SHIFT)
4980 #define FILE_STORAGE_TYPE_STREAM (StorageTypeStream << FILE_STORAGE_TYPE_SHIFT)
4981 #define FILE_MINIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_DEFAULT
4982 #define FILE_MAXIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_STREAM
4983 #define FILE_STORAGE_TYPE_MASK 0x000f0000
4984 #define FILE_STORAGE_TYPE_SHIFT 16
4986 #define FILE_VC_QUOTAS_LOG_VIOLATIONS 0x00000004
4988 #define FSRTL_FLAG_FILE_MODIFIED (0x01)
4989 #define FSRTL_FLAG_FILE_LENGTH_CHANGED (0x02)
4990 #define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04)
4991 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08)
4992 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10)
4993 #define FSRTL_FLAG_USER_MAPPED_FILE (0x20)
4994 #define FSRTL_FLAG_ADVANCED_HEADER (0x40)
4995 #define FSRTL_FLAG_EOF_ADVANCE_ACTIVE (0x80)
4997 #define FSRTL_FLAG2_DO_MODIFIED_WRITE (0x01)
4998 #define FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS (0x02)
4999 #define FSRTL_FLAG2_PURGE_WHEN_MAPPED (0x04)
5000 #define FSRTL_FLAG2_IS_PAGING_FILE (0x08)
5002 #define FSRTL_FSP_TOP_LEVEL_IRP (0x01)
5003 #define FSRTL_CACHE_TOP_LEVEL_IRP (0x02)
5004 #define FSRTL_MOD_WRITE_TOP_LEVEL_IRP (0x03)
5005 #define FSRTL_FAST_IO_TOP_LEVEL_IRP (0x04)
5006 #define FSRTL_MAX_TOP_LEVEL_IRP_FLAG (0x04)
5008 #define FSRTL_VOLUME_DISMOUNT 1
5009 #define FSRTL_VOLUME_DISMOUNT_FAILED 2
5010 #define FSRTL_VOLUME_LOCK 3
5011 #define FSRTL_VOLUME_LOCK_FAILED 4
5012 #define FSRTL_VOLUME_UNLOCK 5
5013 #define FSRTL_VOLUME_MOUNT 6
5015 #define FSRTL_WILD_CHARACTER 0x08
5017 #define FSRTL_FAT_LEGAL 0x01
5018 #define FSRTL_HPFS_LEGAL 0x02
5019 #define FSRTL_NTFS_LEGAL 0x04
5020 #define FSRTL_WILD_CHARACTER 0x08
5021 #define FSRTL_OLE_LEGAL 0x10
5022 #define FSRTL_NTFS_STREAM_LEGAL 0x14
5025 #define HARDWARE_PTE HARDWARE_PTE_X86
5026 #define PHARDWARE_PTE PHARDWARE_PTE_X86
5029 #define IO_CHECK_CREATE_PARAMETERS 0x0200
5030 #define IO_ATTACH_DEVICE 0x0400
5032 #define IO_ATTACH_DEVICE_API 0x80000000
5034 #define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE 64
5035 #define IO_FILE_OBJECT_PAGED_POOL_CHARGE 1024
5037 #define IO_TYPE_APC 18
5038 #define IO_TYPE_DPC 19
5039 #define IO_TYPE_DEVICE_QUEUE 20
5040 #define IO_TYPE_EVENT_PAIR 21
5041 #define IO_TYPE_INTERRUPT 22
5042 #define IO_TYPE_PROFILE 23
5044 #define IRP_BEING_VERIFIED 0x10
5046 #define MAILSLOT_CLASS_FIRSTCLASS 1
5047 #define MAILSLOT_CLASS_SECONDCLASS 2
5049 #define MAILSLOT_SIZE_AUTO 0
5051 #define MEM_DOS_LIM 0x40000000
5053 #define MCB_FLAG_RAISE_ON_ALLOCATION_FAILURE 1
5055 #define OB_TYPE_TYPE 1
5056 #define OB_TYPE_DIRECTORY 2
5057 #define OB_TYPE_SYMBOLIC_LINK 3
5058 #define OB_TYPE_TOKEN 4
5059 #define OB_TYPE_PROCESS 5
5060 #define OB_TYPE_THREAD 6
5061 #define OB_TYPE_EVENT 7
5062 #define OB_TYPE_EVENT_PAIR 8
5063 #define OB_TYPE_MUTANT 9
5064 #define OB_TYPE_SEMAPHORE 10
5065 #define OB_TYPE_TIMER 11
5066 #define OB_TYPE_PROFILE 12
5067 #define OB_TYPE_WINDOW_STATION 13
5068 #define OB_TYPE_DESKTOP 14
5069 #define OB_TYPE_SECTION 15
5070 #define OB_TYPE_KEY 16
5071 #define OB_TYPE_PORT 17
5072 #define OB_TYPE_ADAPTER 18
5073 #define OB_TYPE_CONTROLLER 19
5074 #define OB_TYPE_DEVICE 20
5075 #define OB_TYPE_DRIVER 21
5076 #define OB_TYPE_IO_COMPLETION 22
5077 #define OB_TYPE_FILE 23
5079 #define PIN_WAIT (1)
5080 #define PIN_EXCLUSIVE (2)
5081 #define PIN_NO_READ (4)
5082 #define PIN_IF_BCB (8)
5084 #define SEC_BASED 0x00200000
5086 #define SECURITY_WORLD_SID_AUTHORITY {0,0,0,0,0,1}
5087 #define SECURITY_WORLD_RID (0x00000000L)
5091 #define TOKEN_HAS_TRAVERSE_PRIVILEGE 0x01
5092 #define TOKEN_HAS_BACKUP_PRIVILEGE 0x02
5093 #define TOKEN_HAS_RESTORE_PRIVILEGE 0x04
5094 #define TOKEN_HAS_ADMIN_GROUP 0x08
5095 #define TOKEN_WRITE_RESTRICTED 0x08
5096 #define TOKEN_IS_RESTRICTED 0x10
5097 #define SE_BACKUP_PRIVILEGES_CHECKED 0x0100
5099 #define VACB_MAPPING_GRANULARITY (0x40000)
5100 #define VACB_OFFSET_SHIFT (18)
5102 #if (VER_PRODUCTBUILD >= 1381)
5103 #define FSCTL_MARK_AS_SYSTEM_HIVE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS)
5104 #define FSCTL_GET_HFS_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS)
5105 #endif /* (VER_PRODUCTBUILD >= 1381) */
5107 #if (VER_PRODUCTBUILD >= 2195)
5109 #define FSCTL_READ_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 33, METHOD_NEITHER, FILE_ANY_ACCESS)
5110 #define FSCTL_WRITE_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 34, METHOD_NEITHER, FILE_ANY_ACCESS)
5112 #define FSCTL_DUMP_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 37, METHOD_NEITHER, FILE_ANY_ACCESS)
5114 #define FSCTL_HSM_MSG CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
5115 #define FSCTL_NSS_CONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 67, METHOD_BUFFERED, FILE_WRITE_DATA)
5116 #define FSCTL_HSM_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
5117 #define FSCTL_NSS_RCONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 70, METHOD_BUFFERED, FILE_READ_DATA)
5118 #endif /* (VER_PRODUCTBUILD >= 2195) */
5120 #define FSCTL_NETWORK_SET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 102, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
5121 #define FSCTL_NETWORK_GET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 103, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
5122 #define FSCTL_NETWORK_GET_CONNECTION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 104, METHOD_NEITHER, FILE_ANY_ACCESS)
5123 #define FSCTL_NETWORK_ENUMERATE_CONNECTIONS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 105, METHOD_NEITHER, FILE_ANY_ACCESS)
5124 #define FSCTL_NETWORK_DELETE_CONNECTION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 107, METHOD_BUFFERED, FILE_ANY_ACCESS)
5125 #define FSCTL_NETWORK_GET_STATISTICS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 116, METHOD_BUFFERED, FILE_ANY_ACCESS)
5126 #define FSCTL_NETWORK_SET_DOMAIN_NAME CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_ANY_ACCESS)
5127 #define FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_ANY_ACCESS)
5129 #define IOCTL_REDIR_QUERY_PATH CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
5131 typedef PVOID OPLOCK
, *POPLOCK
;
5136 struct _RTL_AVL_TABLE
;
5137 struct _RTL_GENERIC_TABLE
;
5145 typedef PVOID PNOTIFY_SYNC
;
5147 typedef enum _FAST_IO_POSSIBLE
{
5148 FastIoIsNotPossible
,
5150 FastIoIsQuestionable
5153 typedef enum _FILE_STORAGE_TYPE
{
5154 StorageTypeDefault
= 1,
5155 StorageTypeDirectory
,
5157 StorageTypeJunctionPoint
,
5159 StorageTypeStructuredStorage
,
5160 StorageTypeEmbedding
,
5162 } FILE_STORAGE_TYPE
;
5164 typedef struct _OBJECT_BASIC_INFORMATION
5167 ACCESS_MASK GrantedAccess
;
5170 ULONG PagedPoolCharge
;
5171 ULONG NonPagedPoolCharge
;
5172 ULONG Reserved
[ 3 ];
5175 ULONG SecurityDescriptorSize
;
5176 LARGE_INTEGER CreationTime
;
5177 } OBJECT_BASIC_INFORMATION
, *POBJECT_BASIC_INFORMATION
;
5179 typedef struct _BITMAP_RANGE
{
5182 ULONG FirstDirtyPage
;
5183 ULONG LastDirtyPage
;
5186 } BITMAP_RANGE
, *PBITMAP_RANGE
;
5188 typedef struct _CACHE_UNINITIALIZE_EVENT
{
5189 struct _CACHE_UNINITIALIZE_EVENT
*Next
;
5191 } CACHE_UNINITIALIZE_EVENT
, *PCACHE_UNINITIALIZE_EVENT
;
5193 typedef struct _CC_FILE_SIZES
{
5194 LARGE_INTEGER AllocationSize
;
5195 LARGE_INTEGER FileSize
;
5196 LARGE_INTEGER ValidDataLength
;
5197 } CC_FILE_SIZES
, *PCC_FILE_SIZES
;
5199 typedef struct _FILE_COPY_ON_WRITE_INFORMATION
{
5200 BOOLEAN ReplaceIfExists
;
5201 HANDLE RootDirectory
;
5202 ULONG FileNameLength
;
5204 } FILE_COPY_ON_WRITE_INFORMATION
, *PFILE_COPY_ON_WRITE_INFORMATION
;
5206 typedef struct _FILE_FULL_DIRECTORY_INFORMATION
{
5207 ULONG NextEntryOffset
;
5209 LARGE_INTEGER CreationTime
;
5210 LARGE_INTEGER LastAccessTime
;
5211 LARGE_INTEGER LastWriteTime
;
5212 LARGE_INTEGER ChangeTime
;
5213 LARGE_INTEGER EndOfFile
;
5214 LARGE_INTEGER AllocationSize
;
5215 ULONG FileAttributes
;
5216 ULONG FileNameLength
;
5218 WCHAR FileName
[ANYSIZE_ARRAY
];
5219 } FILE_FULL_DIRECTORY_INFORMATION
, *PFILE_FULL_DIRECTORY_INFORMATION
;
5221 typedef struct _FILE_FS_FULL_SIZE_INFORMATION
{
5222 LARGE_INTEGER TotalAllocationUnits
;
5223 LARGE_INTEGER CallerAvailableAllocationUnits
;
5224 LARGE_INTEGER ActualAvailableAllocationUnits
;
5225 ULONG SectorsPerAllocationUnit
;
5226 ULONG BytesPerSector
;
5227 } FILE_FS_FULL_SIZE_INFORMATION
, *PFILE_FS_FULL_SIZE_INFORMATION
;
5229 typedef struct _FILE_FS_LABEL_INFORMATION
{
5230 ULONG VolumeLabelLength
;
5231 WCHAR VolumeLabel
[1];
5232 } FILE_FS_LABEL_INFORMATION
, *PFILE_FS_LABEL_INFORMATION
;
5234 #if (VER_PRODUCTBUILD >= 2195)
5236 typedef struct _FILE_FS_OBJECT_ID_INFORMATION
{
5238 UCHAR ExtendedInfo
[48];
5239 } FILE_FS_OBJECT_ID_INFORMATION
, *PFILE_FS_OBJECT_ID_INFORMATION
;
5241 #endif /* (VER_PRODUCTBUILD >= 2195) */
5243 typedef struct _FILE_FS_SIZE_INFORMATION
{
5244 LARGE_INTEGER TotalAllocationUnits
;
5245 LARGE_INTEGER AvailableAllocationUnits
;
5246 ULONG SectorsPerAllocationUnit
;
5247 ULONG BytesPerSector
;
5248 } FILE_FS_SIZE_INFORMATION
, *PFILE_FS_SIZE_INFORMATION
;
5250 typedef struct _FILE_FS_VOLUME_INFORMATION
{
5251 LARGE_INTEGER VolumeCreationTime
;
5252 ULONG VolumeSerialNumber
;
5253 ULONG VolumeLabelLength
;
5254 BOOLEAN SupportsObjects
;
5255 WCHAR VolumeLabel
[1];
5256 } FILE_FS_VOLUME_INFORMATION
, *PFILE_FS_VOLUME_INFORMATION
;
5258 typedef struct _FILE_FS_OBJECTID_INFORMATION
5261 UCHAR ExtendedInfo
[48];
5262 } FILE_FS_OBJECTID_INFORMATION
, *PFILE_FS_OBJECTID_INFORMATION
;
5264 typedef struct _FILE_LOCK_INFO
5266 LARGE_INTEGER StartingByte
;
5267 LARGE_INTEGER Length
;
5268 BOOLEAN ExclusiveLock
;
5270 PFILE_OBJECT FileObject
;
5272 LARGE_INTEGER EndingByte
;
5273 } FILE_LOCK_INFO
, *PFILE_LOCK_INFO
;
5275 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
5276 typedef struct _FILE_SHARED_LOCK_ENTRY
{
5279 FILE_LOCK_INFO FileLock
;
5280 } FILE_SHARED_LOCK_ENTRY
, *PFILE_SHARED_LOCK_ENTRY
;
5282 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
5283 typedef struct _FILE_EXCLUSIVE_LOCK_ENTRY
{
5284 LIST_ENTRY ListEntry
;
5287 FILE_LOCK_INFO FileLock
;
5288 } FILE_EXCLUSIVE_LOCK_ENTRY
, *PFILE_EXCLUSIVE_LOCK_ENTRY
;
5290 typedef NTSTATUS (NTAPI
*PCOMPLETE_LOCK_IRP_ROUTINE
) (
5295 typedef VOID (NTAPI
*PUNLOCK_ROUTINE
) (
5297 IN PFILE_LOCK_INFO FileLockInfo
5300 typedef struct _FILE_LOCK
{
5301 PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine
;
5302 PUNLOCK_ROUTINE UnlockRoutine
;
5303 BOOLEAN FastIoIsQuestionable
;
5305 PVOID LockInformation
;
5306 FILE_LOCK_INFO LastReturnedLockInfo
;
5307 PVOID LastReturnedLock
;
5308 } FILE_LOCK
, *PFILE_LOCK
;
5310 typedef struct _FILE_MAILSLOT_PEEK_BUFFER
{
5311 ULONG ReadDataAvailable
;
5312 ULONG NumberOfMessages
;
5313 ULONG MessageLength
;
5314 } FILE_MAILSLOT_PEEK_BUFFER
, *PFILE_MAILSLOT_PEEK_BUFFER
;
5316 typedef struct _FILE_OLE_CLASSID_INFORMATION
{
5318 } FILE_OLE_CLASSID_INFORMATION
, *PFILE_OLE_CLASSID_INFORMATION
;
5320 typedef struct _FILE_OLE_ALL_INFORMATION
{
5321 FILE_BASIC_INFORMATION BasicInformation
;
5322 FILE_STANDARD_INFORMATION StandardInformation
;
5323 FILE_INTERNAL_INFORMATION InternalInformation
;
5324 FILE_EA_INFORMATION EaInformation
;
5325 FILE_ACCESS_INFORMATION AccessInformation
;
5326 FILE_POSITION_INFORMATION PositionInformation
;
5327 FILE_MODE_INFORMATION ModeInformation
;
5328 FILE_ALIGNMENT_INFORMATION AlignmentInformation
;
5331 LARGE_INTEGER SecurityChangeTime
;
5332 FILE_OLE_CLASSID_INFORMATION OleClassIdInformation
;
5333 FILE_OBJECTID_INFORMATION ObjectIdInformation
;
5334 FILE_STORAGE_TYPE StorageType
;
5337 ULONG NumberOfStreamReferences
;
5340 BOOLEAN ContentIndexDisable
;
5341 BOOLEAN InheritContentIndexDisable
;
5342 FILE_NAME_INFORMATION NameInformation
;
5343 } FILE_OLE_ALL_INFORMATION
, *PFILE_OLE_ALL_INFORMATION
;
5345 typedef struct _FILE_OLE_DIR_INFORMATION
{
5346 ULONG NextEntryOffset
;
5348 LARGE_INTEGER CreationTime
;
5349 LARGE_INTEGER LastAccessTime
;
5350 LARGE_INTEGER LastWriteTime
;
5351 LARGE_INTEGER ChangeTime
;
5352 LARGE_INTEGER EndOfFile
;
5353 LARGE_INTEGER AllocationSize
;
5354 ULONG FileAttributes
;
5355 ULONG FileNameLength
;
5356 FILE_STORAGE_TYPE StorageType
;
5359 BOOLEAN ContentIndexDisable
;
5360 BOOLEAN InheritContentIndexDisable
;
5362 } FILE_OLE_DIR_INFORMATION
, *PFILE_OLE_DIR_INFORMATION
;
5364 typedef struct _FILE_OLE_INFORMATION
{
5365 LARGE_INTEGER SecurityChangeTime
;
5366 FILE_OLE_CLASSID_INFORMATION OleClassIdInformation
;
5367 FILE_OBJECTID_INFORMATION ObjectIdInformation
;
5368 FILE_STORAGE_TYPE StorageType
;
5370 BOOLEAN ContentIndexDisable
;
5371 BOOLEAN InheritContentIndexDisable
;
5372 } FILE_OLE_INFORMATION
, *PFILE_OLE_INFORMATION
;
5374 typedef struct _FILE_OLE_STATE_BITS_INFORMATION
{
5376 ULONG StateBitsMask
;
5377 } FILE_OLE_STATE_BITS_INFORMATION
, *PFILE_OLE_STATE_BITS_INFORMATION
;
5379 #if (VER_PRODUCTBUILD >= 2195)
5380 typedef struct FILE_ALLOCATED_RANGE_BUFFER
{
5381 LARGE_INTEGER FileOffset
;
5382 LARGE_INTEGER Length
;
5383 } FILE_ALLOCATED_RANGE_BUFFER
, *PFILE_ALLOCATED_RANGE_BUFFER
;
5384 #endif /* (VER_PRODUCTBUILD >= 2195) */
5386 #define FSRTL_FCB_HEADER_V0 (0x00)
5387 #define FSRTL_FCB_HEADER_V1 (0x01)
5390 typedef struct _FSRTL_COMMON_FCB_HEADER
{
5391 CSHORT NodeTypeCode
;
5392 CSHORT NodeByteSize
;
5394 UCHAR IsFastIoPossible
;
5395 #if (VER_PRODUCTBUILD >= 1381)
5398 #endif /* (VER_PRODUCTBUILD >= 1381) */
5399 PERESOURCE Resource
;
5400 PERESOURCE PagingIoResource
;
5401 LARGE_INTEGER AllocationSize
;
5402 LARGE_INTEGER FileSize
;
5403 LARGE_INTEGER ValidDataLength
;
5404 } FSRTL_COMMON_FCB_HEADER
, *PFSRTL_COMMON_FCB_HEADER
;
5406 typedef enum _FSRTL_COMPARISON_RESULT
5411 } FSRTL_COMPARISON_RESULT
;
5413 #if (VER_PRODUCTBUILD >= 2600)
5415 typedef struct _FSRTL_ADVANCED_FCB_HEADER
{
5416 CSHORT NodeTypeCode
;
5417 CSHORT NodeByteSize
;
5419 UCHAR IsFastIoPossible
;
5423 PERESOURCE Resource
;
5424 PERESOURCE PagingIoResource
;
5425 LARGE_INTEGER AllocationSize
;
5426 LARGE_INTEGER FileSize
;
5427 LARGE_INTEGER ValidDataLength
;
5428 PFAST_MUTEX FastMutex
;
5429 LIST_ENTRY FilterContexts
;
5430 EX_PUSH_LOCK PushLock
;
5431 PVOID
*FileContextSupportPointer
;
5432 } FSRTL_ADVANCED_FCB_HEADER
, *PFSRTL_ADVANCED_FCB_HEADER
;
5434 typedef struct _FSRTL_PER_STREAM_CONTEXT
{
5438 PFREE_FUNCTION FreeCallback
;
5439 } FSRTL_PER_STREAM_CONTEXT
, *PFSRTL_PER_STREAM_CONTEXT
;
5441 typedef struct _FSRTL_PER_FILEOBJECT_CONTEXT
5446 } FSRTL_PER_FILEOBJECT_CONTEXT
, *PFSRTL_PER_FILEOBJECT_CONTEXT
;
5448 #endif /* (VER_PRODUCTBUILD >= 2600) */
5450 typedef struct _BASE_MCB
5452 ULONG MaximumPairCount
;
5457 } BASE_MCB
, *PBASE_MCB
;
5459 typedef struct _LARGE_MCB
5461 PKGUARDED_MUTEX GuardedMutex
;
5463 } LARGE_MCB
, *PLARGE_MCB
;
5467 LARGE_MCB DummyFieldThatSizesThisStructureCorrectly
;
5470 typedef struct _MAPPING_PAIR
{
5473 } MAPPING_PAIR
, *PMAPPING_PAIR
;
5475 typedef struct _GET_RETRIEVAL_DESCRIPTOR
{
5476 ULONG NumberOfPairs
;
5478 MAPPING_PAIR Pair
[1];
5479 } GET_RETRIEVAL_DESCRIPTOR
, *PGET_RETRIEVAL_DESCRIPTOR
;
5481 #define ASSERT_QUEUE(Q) ASSERT(((Q)->Header.Type & KOBJECT_TYPE_MASK) == QueueObject);
5483 typedef struct _MBCB
{
5484 CSHORT NodeTypeCode
;
5485 CSHORT NodeIsInZone
;
5489 LIST_ENTRY BitmapRanges
;
5490 LONGLONG ResumeWritePage
;
5491 BITMAP_RANGE BitmapRange1
;
5492 BITMAP_RANGE BitmapRange2
;
5493 BITMAP_RANGE BitmapRange3
;
5496 typedef enum _MMFLUSH_TYPE
{
5501 typedef struct _MOVEFILE_DESCRIPTOR
{
5504 LARGE_INTEGER StartVcn
;
5505 LARGE_INTEGER TargetLcn
;
5508 } MOVEFILE_DESCRIPTOR
, *PMOVEFILE_DESCRIPTOR
;
5510 typedef struct _OBJECT_BASIC_INFO
{
5512 ACCESS_MASK GrantedAccess
;
5514 ULONG ReferenceCount
;
5515 ULONG PagedPoolUsage
;
5516 ULONG NonPagedPoolUsage
;
5518 ULONG NameInformationLength
;
5519 ULONG TypeInformationLength
;
5520 ULONG SecurityDescriptorLength
;
5521 LARGE_INTEGER CreateTime
;
5522 } OBJECT_BASIC_INFO
, *POBJECT_BASIC_INFO
;
5524 typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFO
{
5526 BOOLEAN ProtectFromClose
;
5527 } OBJECT_HANDLE_ATTRIBUTE_INFO
, *POBJECT_HANDLE_ATTRIBUTE_INFO
;
5529 typedef struct _OBJECT_NAME_INFO
{
5530 UNICODE_STRING ObjectName
;
5531 WCHAR ObjectNameBuffer
[1];
5532 } OBJECT_NAME_INFO
, *POBJECT_NAME_INFO
;
5534 typedef struct _OBJECT_PROTECTION_INFO
{
5536 BOOLEAN ProtectHandle
;
5537 } OBJECT_PROTECTION_INFO
, *POBJECT_PROTECTION_INFO
;
5539 typedef struct _OBJECT_TYPE_INFO
{
5540 UNICODE_STRING ObjectTypeName
;
5541 UCHAR Unknown
[0x58];
5542 WCHAR ObjectTypeNameBuffer
[1];
5543 } OBJECT_TYPE_INFO
, *POBJECT_TYPE_INFO
;
5545 typedef struct _OBJECT_ALL_TYPES_INFO
{
5546 ULONG NumberOfObjectTypes
;
5547 OBJECT_TYPE_INFO ObjectsTypeInfo
[1];
5548 } OBJECT_ALL_TYPES_INFO
, *POBJECT_ALL_TYPES_INFO
;
5550 typedef enum _RTL_GENERIC_COMPARE_RESULTS
5555 } RTL_GENERIC_COMPARE_RESULTS
;
5557 typedef enum _TABLE_SEARCH_RESULT
5563 } TABLE_SEARCH_RESULT
;
5566 (NTAPI
*PRTL_AVL_MATCH_FUNCTION
)(
5567 struct _RTL_AVL_TABLE
*Table
,
5572 typedef RTL_GENERIC_COMPARE_RESULTS
5573 (NTAPI
*PRTL_AVL_COMPARE_ROUTINE
) (
5574 struct _RTL_AVL_TABLE
*Table
,
5579 typedef RTL_GENERIC_COMPARE_RESULTS
5580 (NTAPI
*PRTL_GENERIC_COMPARE_ROUTINE
) (
5581 struct _RTL_GENERIC_TABLE
*Table
,
5587 (NTAPI
*PRTL_GENERIC_ALLOCATE_ROUTINE
) (
5588 struct _RTL_GENERIC_TABLE
*Table
,
5593 (NTAPI
*PRTL_GENERIC_FREE_ROUTINE
) (
5594 struct _RTL_GENERIC_TABLE
*Table
,
5599 (NTAPI
*PRTL_AVL_ALLOCATE_ROUTINE
) (
5600 struct _RTL_AVL_TABLE
*Table
,
5605 (NTAPI
*PRTL_AVL_FREE_ROUTINE
) (
5606 struct _RTL_AVL_TABLE
*Table
,
5610 typedef struct _PUBLIC_BCB
{
5611 CSHORT NodeTypeCode
;
5612 CSHORT NodeByteSize
;
5614 LARGE_INTEGER MappedFileOffset
;
5615 } PUBLIC_BCB
, *PPUBLIC_BCB
;
5617 typedef struct _QUERY_PATH_REQUEST
{
5618 ULONG PathNameLength
;
5619 PIO_SECURITY_CONTEXT SecurityContext
;
5620 WCHAR FilePathName
[1];
5621 } QUERY_PATH_REQUEST
, *PQUERY_PATH_REQUEST
;
5623 typedef struct _QUERY_PATH_RESPONSE
{
5624 ULONG LengthAccepted
;
5625 } QUERY_PATH_RESPONSE
, *PQUERY_PATH_RESPONSE
;
5627 typedef struct _RTL_SPLAY_LINKS
{
5628 struct _RTL_SPLAY_LINKS
*Parent
;
5629 struct _RTL_SPLAY_LINKS
*LeftChild
;
5630 struct _RTL_SPLAY_LINKS
*RightChild
;
5631 } RTL_SPLAY_LINKS
, *PRTL_SPLAY_LINKS
;
5633 typedef struct _RTL_BALANCED_LINKS
5635 struct _RTL_BALANCED_LINKS
*Parent
;
5636 struct _RTL_BALANCED_LINKS
*LeftChild
;
5637 struct _RTL_BALANCED_LINKS
*RightChild
;
5640 } RTL_BALANCED_LINKS
, *PRTL_BALANCED_LINKS
;
5642 typedef struct _RTL_GENERIC_TABLE
5644 PRTL_SPLAY_LINKS TableRoot
;
5645 LIST_ENTRY InsertOrderList
;
5646 PLIST_ENTRY OrderedPointer
;
5647 ULONG WhichOrderedElement
;
5648 ULONG NumberGenericTableElements
;
5649 PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine
;
5650 PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine
;
5651 PRTL_GENERIC_FREE_ROUTINE FreeRoutine
;
5653 } RTL_GENERIC_TABLE
, *PRTL_GENERIC_TABLE
;
5655 #undef PRTL_GENERIC_COMPARE_ROUTINE
5656 #undef PRTL_GENERIC_ALLOCATE_ROUTINE
5657 #undef PRTL_GENERIC_FREE_ROUTINE
5658 #undef RTL_GENERIC_TABLE
5659 #undef PRTL_GENERIC_TABLE
5661 #define PRTL_GENERIC_COMPARE_ROUTINE PRTL_AVL_COMPARE_ROUTINE
5662 #define PRTL_GENERIC_ALLOCATE_ROUTINE PRTL_AVL_ALLOCATE_ROUTINE
5663 #define PRTL_GENERIC_FREE_ROUTINE PRTL_AVL_FREE_ROUTINE
5664 #define RTL_GENERIC_TABLE RTL_AVL_TABLE
5665 #define PRTL_GENERIC_TABLE PRTL_AVL_TABLE
5667 #define RtlInitializeGenericTable RtlInitializeGenericTableAvl
5668 #define RtlInsertElementGenericTable RtlInsertElementGenericTableAvl
5669 #define RtlInsertElementGenericTableFull RtlInsertElementGenericTableFullAvl
5670 #define RtlDeleteElementGenericTable RtlDeleteElementGenericTableAvl
5671 #define RtlLookupElementGenericTable RtlLookupElementGenericTableAvl
5672 #define RtlLookupElementGenericTableFull RtlLookupElementGenericTableFullAvl
5673 #define RtlEnumerateGenericTable RtlEnumerateGenericTableAvl
5674 #define RtlEnumerateGenericTableWithoutSplaying RtlEnumerateGenericTableWithoutSplayingAvl
5675 #define RtlGetElementGenericTable RtlGetElementGenericTableAvl
5676 #define RtlNumberGenericTableElements RtlNumberGenericTableElementsAvl
5677 #define RtlIsGenericTableEmpty RtlIsGenericTableEmptyAvl
5679 typedef struct _RTL_AVL_TABLE
5681 RTL_BALANCED_LINKS BalancedRoot
;
5682 PVOID OrderedPointer
;
5683 ULONG WhichOrderedElement
;
5684 ULONG NumberGenericTableElements
;
5686 PRTL_BALANCED_LINKS RestartKey
;
5688 PRTL_AVL_COMPARE_ROUTINE CompareRoutine
;
5689 PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine
;
5690 PRTL_AVL_FREE_ROUTINE FreeRoutine
;
5692 } RTL_AVL_TABLE
, *PRTL_AVL_TABLE
;
5697 RtlInitializeGenericTableAvl(
5698 PRTL_AVL_TABLE Table
,
5699 PRTL_AVL_COMPARE_ROUTINE CompareRoutine
,
5700 PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine
,
5701 PRTL_AVL_FREE_ROUTINE FreeRoutine
,
5708 RtlInsertElementGenericTableAvl (
5709 PRTL_AVL_TABLE Table
,
5712 PBOOLEAN NewElement OPTIONAL
5718 RtlDeleteElementGenericTableAvl (
5719 PRTL_AVL_TABLE Table
,
5726 RtlLookupElementGenericTableAvl (
5727 PRTL_AVL_TABLE Table
,
5734 RtlEnumerateGenericTableWithoutSplayingAvl (
5735 PRTL_AVL_TABLE Table
,
5739 #if defined(USE_LPC6432)
5740 #define LPC_CLIENT_ID CLIENT_ID64
5741 #define LPC_SIZE_T ULONGLONG
5742 #define LPC_PVOID ULONGLONG
5743 #define LPC_HANDLE ULONGLONG
5745 #define LPC_CLIENT_ID CLIENT_ID
5746 #define LPC_SIZE_T SIZE_T
5747 #define LPC_PVOID PVOID
5748 #define LPC_HANDLE HANDLE
5751 typedef struct _PORT_MESSAGE
5767 CSHORT DataInfoOffset
;
5771 __GNU_EXTENSION
union
5773 LPC_CLIENT_ID ClientId
;
5774 double DoNotUseThisField
;
5777 __GNU_EXTENSION
union
5779 LPC_SIZE_T ClientViewSize
;
5782 } PORT_MESSAGE
, *PPORT_MESSAGE
;
5784 #define LPC_KERNELMODE_MESSAGE (CSHORT)((USHORT)0x8000)
5786 typedef struct _PORT_VIEW
5789 LPC_HANDLE SectionHandle
;
5790 ULONG SectionOffset
;
5791 LPC_SIZE_T ViewSize
;
5793 LPC_PVOID ViewRemoteBase
;
5794 } PORT_VIEW
, *PPORT_VIEW
;
5796 typedef struct _REMOTE_PORT_VIEW
5799 LPC_SIZE_T ViewSize
;
5801 } REMOTE_PORT_VIEW
, *PREMOTE_PORT_VIEW
;
5803 typedef struct _SE_EXPORTS
{
5805 LUID SeCreateTokenPrivilege
;
5806 LUID SeAssignPrimaryTokenPrivilege
;
5807 LUID SeLockMemoryPrivilege
;
5808 LUID SeIncreaseQuotaPrivilege
;
5809 LUID SeUnsolicitedInputPrivilege
;
5810 LUID SeTcbPrivilege
;
5811 LUID SeSecurityPrivilege
;
5812 LUID SeTakeOwnershipPrivilege
;
5813 LUID SeLoadDriverPrivilege
;
5814 LUID SeCreatePagefilePrivilege
;
5815 LUID SeIncreaseBasePriorityPrivilege
;
5816 LUID SeSystemProfilePrivilege
;
5817 LUID SeSystemtimePrivilege
;
5818 LUID SeProfileSingleProcessPrivilege
;
5819 LUID SeCreatePermanentPrivilege
;
5820 LUID SeBackupPrivilege
;
5821 LUID SeRestorePrivilege
;
5822 LUID SeShutdownPrivilege
;
5823 LUID SeDebugPrivilege
;
5824 LUID SeAuditPrivilege
;
5825 LUID SeSystemEnvironmentPrivilege
;
5826 LUID SeChangeNotifyPrivilege
;
5827 LUID SeRemoteShutdownPrivilege
;
5832 PSID SeCreatorOwnerSid
;
5833 PSID SeCreatorGroupSid
;
5835 PSID SeNtAuthoritySid
;
5839 PSID SeInteractiveSid
;
5840 PSID SeLocalSystemSid
;
5841 PSID SeAliasAdminsSid
;
5842 PSID SeAliasUsersSid
;
5843 PSID SeAliasGuestsSid
;
5844 PSID SeAliasPowerUsersSid
;
5845 PSID SeAliasAccountOpsSid
;
5846 PSID SeAliasSystemOpsSid
;
5847 PSID SeAliasPrintOpsSid
;
5848 PSID SeAliasBackupOpsSid
;
5850 PSID SeAuthenticatedUsersSid
;
5852 PSID SeRestrictedSid
;
5853 PSID SeAnonymousLogonSid
;
5855 LUID SeUndockPrivilege
;
5856 LUID SeSyncAgentPrivilege
;
5857 LUID SeEnableDelegationPrivilege
;
5859 } SE_EXPORTS
, *PSE_EXPORTS
;
5861 extern PSE_EXPORTS SeExports
;
5863 typedef struct _TUNNEL
{
5865 PRTL_SPLAY_LINKS Cache
;
5866 LIST_ENTRY TimerQueue
;
5870 typedef struct _VAD_HEADER
{
5873 struct _VAD_HEADER
* ParentLink
;
5874 struct _VAD_HEADER
* LeftLink
;
5875 struct _VAD_HEADER
* RightLink
;
5876 ULONG Flags
; /* LSB = CommitCharge */
5878 PVOID FirstProtoPte
;
5882 } VAD_HEADER
, *PVAD_HEADER
;
5884 #if (VER_PRODUCTBUILD >= 2600)
5887 (NTAPI
*PFILTER_REPORT_CHANGE
) (
5888 IN PVOID NotifyContext
,
5889 IN PVOID FilterContext
5892 typedef enum _FS_FILTER_SECTION_SYNC_TYPE
{
5894 SyncTypeCreateSection
5895 } FS_FILTER_SECTION_SYNC_TYPE
, *PFS_FILTER_SECTION_SYNC_TYPE
;
5897 typedef enum _FS_FILTER_STREAM_FO_NOTIFICATION_TYPE
{
5898 NotifyTypeCreate
= 0,
5900 } FS_FILTER_STREAM_FO_NOTIFICATION_TYPE
, *PFS_FILTER_STREAM_FO_NOTIFICATION_TYPE
;
5902 typedef union _FS_FILTER_PARAMETERS
{
5904 PLARGE_INTEGER EndingOffset
;
5905 PERESOURCE
*ResourceToRelease
;
5906 } AcquireForModifiedPageWriter
;
5909 PERESOURCE ResourceToRelease
;
5910 } ReleaseForModifiedPageWriter
;
5913 FS_FILTER_SECTION_SYNC_TYPE SyncType
;
5914 ULONG PageProtection
;
5915 } AcquireForSectionSynchronization
;
5918 FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType
;
5919 BOOLEAN POINTER_ALIGNMENT SafeToRecurse
;
5920 } NotifyStreamFileObject
;
5929 } FS_FILTER_PARAMETERS
, *PFS_FILTER_PARAMETERS
;
5931 typedef struct _FS_FILTER_CALLBACK_DATA
{
5932 ULONG SizeOfFsFilterCallbackData
;
5935 struct _DEVICE_OBJECT
*DeviceObject
;
5936 struct _FILE_OBJECT
*FileObject
;
5937 FS_FILTER_PARAMETERS Parameters
;
5938 } FS_FILTER_CALLBACK_DATA
, *PFS_FILTER_CALLBACK_DATA
;
5941 (NTAPI
*PFS_FILTER_CALLBACK
) (
5942 IN PFS_FILTER_CALLBACK_DATA Data
,
5943 OUT PVOID
*CompletionContext
5947 (NTAPI
*PFS_FILTER_COMPLETION_CALLBACK
) (
5948 IN PFS_FILTER_CALLBACK_DATA Data
,
5949 IN NTSTATUS OperationStatus
,
5950 IN PVOID CompletionContext
5953 typedef struct _FS_FILTER_CALLBACKS
{
5954 ULONG SizeOfFsFilterCallbacks
;
5956 PFS_FILTER_CALLBACK PreAcquireForSectionSynchronization
;
5957 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization
;
5958 PFS_FILTER_CALLBACK PreReleaseForSectionSynchronization
;
5959 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization
;
5960 PFS_FILTER_CALLBACK PreAcquireForCcFlush
;
5961 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush
;
5962 PFS_FILTER_CALLBACK PreReleaseForCcFlush
;
5963 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush
;
5964 PFS_FILTER_CALLBACK PreAcquireForModifiedPageWriter
;
5965 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter
;
5966 PFS_FILTER_CALLBACK PreReleaseForModifiedPageWriter
;
5967 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter
;
5968 } FS_FILTER_CALLBACKS
, *PFS_FILTER_CALLBACKS
;
5970 typedef struct _READ_LIST
{
5971 PFILE_OBJECT FileObject
;
5972 ULONG NumberOfEntries
;
5974 FILE_SEGMENT_ELEMENT List
[ANYSIZE_ARRAY
];
5975 } READ_LIST
, *PREAD_LIST
;
5983 IN PFILE_OBJECT FileObject
,
5984 IN ULONG BytesToWrite
,
5993 IN PFILE_OBJECT FileObject
,
5994 IN PLARGE_INTEGER FileOffset
,
5998 OUT PIO_STATUS_BLOCK IoStatus
6005 IN PFILE_OBJECT FileObject
,
6006 IN PLARGE_INTEGER FileOffset
,
6012 #define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
6014 typedef VOID (NTAPI
*PCC_POST_DEFERRED_WRITE
) (
6023 IN PFILE_OBJECT FileObject
,
6024 IN PCC_POST_DEFERRED_WRITE PostRoutine
,
6027 IN ULONG BytesToWrite
,
6035 IN PFILE_OBJECT FileObject
,
6036 IN ULONG FileOffset
,
6040 OUT PIO_STATUS_BLOCK IoStatus
6047 IN PFILE_OBJECT FileObject
,
6048 IN ULONG FileOffset
,
6057 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
6058 IN PLARGE_INTEGER FileOffset OPTIONAL
,
6060 OUT PIO_STATUS_BLOCK IoStatus OPTIONAL
6063 typedef VOID (NTAPI
*PDIRTY_PAGE_ROUTINE
) (
6064 IN PFILE_OBJECT FileObject
,
6065 IN PLARGE_INTEGER FileOffset
,
6067 IN PLARGE_INTEGER OldestLsn
,
6068 IN PLARGE_INTEGER NewestLsn
,
6078 IN PDIRTY_PAGE_ROUTINE DirtyPageRoutine
,
6086 CcGetFileObjectFromBcb (
6093 CcGetFileObjectFromSectionPtrs (
6094 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
6097 #define CcGetFileSizePointer(FO) ( \
6098 ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
6101 #if (VER_PRODUCTBUILD >= 2195)
6106 CcGetFlushedValidData (
6107 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
6108 IN BOOLEAN BcbListHeld
6111 #endif /* (VER_PRODUCTBUILD >= 2195) */
6116 CcGetLsnForFileObject (
6117 IN PFILE_OBJECT FileObject
,
6118 OUT PLARGE_INTEGER OldestLsn OPTIONAL
6121 typedef BOOLEAN (NTAPI
*PACQUIRE_FOR_LAZY_WRITE
) (
6126 typedef VOID (NTAPI
*PRELEASE_FROM_LAZY_WRITE
) (
6130 typedef BOOLEAN (NTAPI
*PACQUIRE_FOR_READ_AHEAD
) (
6135 typedef VOID (NTAPI
*PRELEASE_FROM_READ_AHEAD
) (
6139 typedef struct _CACHE_MANAGER_CALLBACKS
{
6140 PACQUIRE_FOR_LAZY_WRITE AcquireForLazyWrite
;
6141 PRELEASE_FROM_LAZY_WRITE ReleaseFromLazyWrite
;
6142 PACQUIRE_FOR_READ_AHEAD AcquireForReadAhead
;
6143 PRELEASE_FROM_READ_AHEAD ReleaseFromReadAhead
;
6144 } CACHE_MANAGER_CALLBACKS
, *PCACHE_MANAGER_CALLBACKS
;
6149 CcInitializeCacheMap (
6150 IN PFILE_OBJECT FileObject
,
6151 IN PCC_FILE_SIZES FileSizes
,
6152 IN BOOLEAN PinAccess
,
6153 IN PCACHE_MANAGER_CALLBACKS Callbacks
,
6154 IN PVOID LazyWriteContext
6157 #define CcIsFileCached(FO) ( \
6158 ((FO)->SectionObjectPointer != NULL) && \
6159 (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
6162 extern ULONG CcFastMdlReadWait
;
6167 CcIsThereDirtyData (
6175 IN PFILE_OBJECT FileObject
,
6176 IN PLARGE_INTEGER FileOffset
,
6187 IN PFILE_OBJECT FileObject
,
6188 IN PLARGE_INTEGER FileOffset
,
6191 OUT PIO_STATUS_BLOCK IoStatus
6198 IN PFILE_OBJECT FileObject
,
6205 CcMdlWriteComplete (
6206 IN PFILE_OBJECT FileObject
,
6207 IN PLARGE_INTEGER FileOffset
,
6217 IN PFILE_OBJECT FileObject
,
6218 IN PLARGE_INTEGER FileOffset
,
6228 IN PFILE_OBJECT FileObject
,
6229 IN PLARGE_INTEGER FileOffset
,
6240 IN PFILE_OBJECT FileObject
,
6241 IN PLARGE_INTEGER FileOffset
,
6244 OUT PIO_STATUS_BLOCK IoStatus
6251 IN PFILE_OBJECT FileObject
,
6252 IN PLARGE_INTEGER FileOffset
,
6263 CcPurgeCacheSection (
6264 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
6265 IN PLARGE_INTEGER FileOffset OPTIONAL
,
6267 IN BOOLEAN UninitializeCacheMaps
6270 #define CcReadAhead(FO, FOFF, LEN) ( \
6271 if ((LEN) >= 256) { \
6272 CcScheduleReadAhead((FO), (FOFF), (LEN)); \
6276 #if (VER_PRODUCTBUILD >= 2195)
6285 #endif /* (VER_PRODUCTBUILD >= 2195) */
6297 CcScheduleReadAhead (
6298 IN PFILE_OBJECT FileObject
,
6299 IN PLARGE_INTEGER FileOffset
,
6306 CcSetAdditionalCacheAttributes (
6307 IN PFILE_OBJECT FileObject
,
6308 IN BOOLEAN DisableReadAhead
,
6309 IN BOOLEAN DisableWriteBehind
6315 CcSetBcbOwnerPointer (
6317 IN PVOID OwnerPointer
6323 CcSetDirtyPageThreshold (
6324 IN PFILE_OBJECT FileObject
,
6325 IN ULONG DirtyPageThreshold
6331 CcSetDirtyPinnedData (
6333 IN PLARGE_INTEGER Lsn OPTIONAL
6340 IN PFILE_OBJECT FileObject
,
6341 IN PCC_FILE_SIZES FileSizes
6344 typedef VOID (NTAPI
*PFLUSH_TO_LSN
) (
6346 IN LARGE_INTEGER Lsn
6352 CcSetLogHandleForFile (
6353 IN PFILE_OBJECT FileObject
,
6355 IN PFLUSH_TO_LSN FlushToLsnRoutine
6361 CcSetReadAheadGranularity (
6362 IN PFILE_OBJECT FileObject
,
6363 IN ULONG Granularity
/* default: PAGE_SIZE */
6364 /* allowed: 2^n * PAGE_SIZE */
6370 CcUninitializeCacheMap (
6371 IN PFILE_OBJECT FileObject
,
6372 IN PLARGE_INTEGER TruncateSize OPTIONAL
,
6373 IN PCACHE_UNINITIALIZE_EVENT UninitializeCompleteEvent OPTIONAL
6386 CcUnpinDataForThread (
6388 IN ERESOURCE_THREAD ResourceThreadId
6394 CcUnpinRepinnedBcb (
6396 IN BOOLEAN WriteThrough
,
6397 OUT PIO_STATUS_BLOCK IoStatus
6400 #if (VER_PRODUCTBUILD >= 2195)
6405 CcWaitForCurrentLazyWriterActivity (
6409 #endif /* (VER_PRODUCTBUILD >= 2195) */
6415 IN PFILE_OBJECT FileObject
,
6416 IN PLARGE_INTEGER StartOffset
,
6417 IN PLARGE_INTEGER EndOffset
,
6424 ExDisableResourceBoostLite (
6425 IN PERESOURCE Resource
6431 ExQueryPoolBlockSize (
6433 OUT PBOOLEAN QuotaCharged
6436 #if (VER_PRODUCTBUILD >= 2600)
6438 #ifndef __NTOSKRNL__
6442 ExInitializeRundownProtection (
6443 IN PEX_RUNDOWN_REF RunRef
6449 ExReInitializeRundownProtection (
6450 IN PEX_RUNDOWN_REF RunRef
6456 ExAcquireRundownProtection (
6457 IN PEX_RUNDOWN_REF RunRef
6463 ExAcquireRundownProtectionEx (
6464 IN PEX_RUNDOWN_REF RunRef
,
6471 ExReleaseRundownProtection (
6472 IN PEX_RUNDOWN_REF RunRef
6478 ExReleaseRundownProtectionEx (
6479 IN PEX_RUNDOWN_REF RunRef
,
6486 ExRundownCompleted (
6487 IN PEX_RUNDOWN_REF RunRef
6493 ExWaitForRundownProtectionRelease (
6494 IN PEX_RUNDOWN_REF RunRef
6498 #endif /* (VER_PRODUCTBUILD >= 2600) */
6501 #define FsRtlSetupAdvancedHeader( _advhdr, _fmutx ) \
6503 SetFlag( (_advhdr)->Flags, FSRTL_FLAG_ADVANCED_HEADER ); \
6504 SetFlag( (_advhdr)->Flags2, FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS ); \
6505 (_advhdr)->Version = FSRTL_FCB_HEADER_V1; \
6506 InitializeListHead( &(_advhdr)->FilterContexts ); \
6507 if ((_fmutx) != NULL) { \
6508 (_advhdr)->FastMutex = (_fmutx); \
6510 *((PULONG_PTR)(&(_advhdr)->PushLock)) = 0; \
6511 /*ExInitializePushLock( &(_advhdr)->PushLock ); API Not avaliable downlevel*/\
6512 (_advhdr)->FileContextSupportPointer = NULL; \
6518 FsRtlAddBaseMcbEntry (
6522 IN LONGLONG SectorCount
6528 FsRtlAddLargeMcbEntry (
6532 IN LONGLONG SectorCount
6542 IN ULONG SectorCount
6548 FsRtlAddToTunnelCache (
6550 IN ULONGLONG DirectoryKey
,
6551 IN PUNICODE_STRING ShortName
,
6552 IN PUNICODE_STRING LongName
,
6553 IN BOOLEAN KeyByShortName
,
6554 IN ULONG DataLength
,
6558 #if (VER_PRODUCTBUILD >= 2195)
6562 FsRtlAllocateFileLock (
6563 IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL
,
6564 IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
6567 #endif /* (VER_PRODUCTBUILD >= 2195) */
6573 IN POOL_TYPE PoolType
,
6574 IN ULONG NumberOfBytes
6580 FsRtlAllocatePoolWithQuota (
6581 IN POOL_TYPE PoolType
,
6582 IN ULONG NumberOfBytes
6588 FsRtlAllocatePoolWithQuotaTag (
6589 IN POOL_TYPE PoolType
,
6590 IN ULONG NumberOfBytes
,
6597 FsRtlAllocatePoolWithTag (
6598 IN POOL_TYPE PoolType
,
6599 IN ULONG NumberOfBytes
,
6606 FsRtlAreNamesEqual (
6607 IN PCUNICODE_STRING Name1
,
6608 IN PCUNICODE_STRING Name2
,
6609 IN BOOLEAN IgnoreCase
,
6610 IN PCWCH UpcaseTable OPTIONAL
6613 #define FsRtlAreThereCurrentFileLocks(FL) ( \
6614 ((FL)->FastIoIsQuestionable) \
6618 FsRtlCheckLockForReadAccess:
6620 All this really does is pick out the lock parameters from the irp (io stack
6621 location?), get IoGetRequestorProcess, and pass values on to
6622 FsRtlFastCheckLockForRead.
6627 FsRtlCheckLockForReadAccess (
6628 IN PFILE_LOCK FileLock
,
6633 FsRtlCheckLockForWriteAccess:
6635 All this really does is pick out the lock parameters from the irp (io stack
6636 location?), get IoGetRequestorProcess, and pass values on to
6637 FsRtlFastCheckLockForWrite.
6642 FsRtlCheckLockForWriteAccess (
6643 IN PFILE_LOCK FileLock
,
6649 (NTAPI
*POPLOCK_WAIT_COMPLETE_ROUTINE
) (
6656 (NTAPI
*POPLOCK_FS_PREPOST_IRP
) (
6668 IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL
,
6669 IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL
6676 IN PFILE_OBJECT FileObject
,
6677 IN PLARGE_INTEGER FileOffset
,
6682 OUT PIO_STATUS_BLOCK IoStatus
,
6683 IN PDEVICE_OBJECT DeviceObject
6690 IN PFILE_OBJECT FileObject
,
6691 IN PLARGE_INTEGER FileOffset
,
6696 OUT PIO_STATUS_BLOCK IoStatus
,
6697 IN PDEVICE_OBJECT DeviceObject
6703 FsRtlCurrentBatchOplock (
6710 FsRtlDeleteKeyFromTunnelCache (
6712 IN ULONGLONG DirectoryKey
6718 FsRtlDeleteTunnelCache (
6725 FsRtlDeregisterUncProvider (
6733 IN ANSI_STRING Name
,
6734 OUT PANSI_STRING FirstPart
,
6735 OUT PANSI_STRING RemainingPart
6742 IN UNICODE_STRING Name
,
6743 OUT PUNICODE_STRING FirstPart
,
6744 OUT PUNICODE_STRING RemainingPart
6750 FsRtlDoesDbcsContainWildCards (
6751 IN PANSI_STRING Name
6757 FsRtlDoesNameContainWildCards (
6758 IN PUNICODE_STRING Name
6764 FsRtlIsFatDbcsLegal (
6765 IN ANSI_STRING DbcsName
,
6766 IN BOOLEAN WildCardsPermissible
,
6767 IN BOOLEAN PathNamePermissible
,
6768 IN BOOLEAN LeadingBackslashPermissible
6772 #define FsRtlCompleteRequest(IRP,STATUS) { \
6773 (IRP)->IoStatus.Status = (STATUS); \
6774 IoCompleteRequest( (IRP), IO_DISK_INCREMENT ); \
6777 #define FsRtlEnterFileSystem KeEnterCriticalRegion
6779 #define FsRtlExitFileSystem KeLeaveCriticalRegion
6784 FsRtlFastCheckLockForRead (
6785 IN PFILE_LOCK FileLock
,
6786 IN PLARGE_INTEGER FileOffset
,
6787 IN PLARGE_INTEGER Length
,
6789 IN PFILE_OBJECT FileObject
,
6796 FsRtlFastCheckLockForWrite (
6797 IN PFILE_LOCK FileLock
,
6798 IN PLARGE_INTEGER FileOffset
,
6799 IN PLARGE_INTEGER Length
,
6801 IN PFILE_OBJECT FileObject
,
6805 #define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) ( \
6806 FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11) \
6812 FsRtlFastUnlockAll (
6813 IN PFILE_LOCK FileLock
,
6814 IN PFILE_OBJECT FileObject
,
6815 IN PEPROCESS Process
,
6816 IN PVOID Context OPTIONAL
6818 /* ret: STATUS_RANGE_NOT_LOCKED */
6823 FsRtlFastUnlockAllByKey (
6824 IN PFILE_LOCK FileLock
,
6825 IN PFILE_OBJECT FileObject
,
6826 IN PEPROCESS Process
,
6828 IN PVOID Context OPTIONAL
6830 /* ret: STATUS_RANGE_NOT_LOCKED */
6835 FsRtlFastUnlockSingle (
6836 IN PFILE_LOCK FileLock
,
6837 IN PFILE_OBJECT FileObject
,
6838 IN PLARGE_INTEGER FileOffset
,
6839 IN PLARGE_INTEGER Length
,
6840 IN PEPROCESS Process
,
6842 IN PVOID Context OPTIONAL
,
6843 IN BOOLEAN AlreadySynchronized
6845 /* ret: STATUS_RANGE_NOT_LOCKED */
6850 FsRtlFindInTunnelCache (
6852 IN ULONGLONG DirectoryKey
,
6853 IN PUNICODE_STRING Name
,
6854 OUT PUNICODE_STRING ShortName
,
6855 OUT PUNICODE_STRING LongName
,
6856 IN OUT PULONG DataLength
,
6860 #if (VER_PRODUCTBUILD >= 2195)
6866 IN PFILE_LOCK FileLock
6869 #endif /* (VER_PRODUCTBUILD >= 2195) */
6875 IN PFILE_OBJECT FileObject
,
6876 IN OUT PLARGE_INTEGER FileSize
6882 FsRtlGetNextBaseMcbEntry (
6887 OUT PLONGLONG SectorCount
6891 FsRtlGetNextFileLock:
6893 ret: NULL if no more locks
6896 FsRtlGetNextFileLock uses FileLock->LastReturnedLockInfo and
6897 FileLock->LastReturnedLock as storage.
6898 LastReturnedLock is a pointer to the 'raw' lock inkl. double linked
6899 list, and FsRtlGetNextFileLock needs this to get next lock on subsequent
6900 calls with Restart = FALSE.
6905 FsRtlGetNextFileLock (
6906 IN PFILE_LOCK FileLock
,
6913 FsRtlGetNextLargeMcbEntry (
6918 OUT PLONGLONG SectorCount
6924 FsRtlGetNextMcbEntry (
6929 OUT PULONG SectorCount
6932 #define FsRtlGetPerStreamContextPointer(FO) ( \
6933 (PFSRTL_ADVANCED_FCB_HEADER)(FO)->FsContext \
6939 FsRtlInitializeBaseMcb (
6941 IN POOL_TYPE PoolType
6947 FsRtlInitializeFileLock (
6948 IN PFILE_LOCK FileLock
,
6949 IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL
,
6950 IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
6956 FsRtlInitializeLargeMcb (
6958 IN POOL_TYPE PoolType
6964 FsRtlInitializeMcb (
6966 IN POOL_TYPE PoolType
6972 FsRtlInitializeOplock (
6973 IN OUT POPLOCK Oplock
6979 FsRtlInitializeTunnelCache (
6983 #define FsRtlInitPerStreamContext(PSC, O, I, FC) ( \
6984 (PSC)->OwnerId = (O), \
6985 (PSC)->InstanceId = (I), \
6986 (PSC)->FreeCallback = (FC) \
6992 FsRtlInsertPerStreamContext (
6993 IN PFSRTL_ADVANCED_FCB_HEADER PerStreamContext
,
6994 IN PFSRTL_PER_STREAM_CONTEXT Ptr
6997 #define FsRtlIsAnsiCharacterLegalFat(C, WILD) ( \
6998 FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_FAT_LEGAL) | \
6999 ((WILD) ? FSRTL_WILD_CHARACTER : 0 )) \
7002 #define FsRtlIsAnsiCharacterLegalHpfs(C, WILD) ( \
7003 FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_HPFS_LEGAL) | \
7004 ((WILD) ? FSRTL_WILD_CHARACTER : 0 )) \
7007 #define FsRtlIsAnsiCharacterLegalNtfs(C, WILD) ( \
7008 FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_NTFS_LEGAL) | \
7009 ((WILD) ? FSRTL_WILD_CHARACTER : 0 )) \
7012 #define FsRtlIsAnsiCharacterWild(C) ( \
7013 FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], FSRTL_WILD_CHARACTER ) \
7019 FsRtlIsFatDbcsLegal (
7020 IN ANSI_STRING DbcsName
,
7021 IN BOOLEAN WildCardsPermissible
,
7022 IN BOOLEAN PathNamePermissible
,
7023 IN BOOLEAN LeadingBackslashPermissible
7029 FsRtlIsHpfsDbcsLegal (
7030 IN ANSI_STRING DbcsName
,
7031 IN BOOLEAN WildCardsPermissible
,
7032 IN BOOLEAN PathNamePermissible
,
7033 IN BOOLEAN LeadingBackslashPermissible
7039 FsRtlIsNameInExpression (
7040 IN PUNICODE_STRING Expression
,
7041 IN PUNICODE_STRING Name
,
7042 IN BOOLEAN IgnoreCase
,
7043 IN PWCHAR UpcaseTable OPTIONAL
7049 FsRtlIsNtstatusExpected (
7050 IN NTSTATUS Ntstatus
7053 #define NLS_OEM_LEAD_BYTE_INFO NlsOemLeadByteInfo
7055 extern PUSHORT NlsOemLeadByteInfo
;
7057 #define FsRtlIsLeadDbcsCharacter(DBCS_CHAR) ( \
7058 (BOOLEAN)((UCHAR)(DBCS_CHAR) < 0x80 ? FALSE : \
7059 (NLS_MB_CODE_PAGE_TAG && \
7060 (NLS_OEM_LEAD_BYTE_INFO[(UCHAR)(DBCS_CHAR)] != 0))) \
7063 #define FsRtlIsUnicodeCharacterWild(C) ( \
7066 FlagOn(FsRtlLegalAnsiCharacterArray[(C)], FSRTL_WILD_CHARACTER )) \
7072 FsRtlLookupBaseMcbEntry (
7075 OUT PLONGLONG Lbn OPTIONAL
,
7076 OUT PLONGLONG SectorCountFromLbn OPTIONAL
,
7077 OUT PLONGLONG StartingLbn OPTIONAL
,
7078 OUT PLONGLONG SectorCountFromStartingLbn OPTIONAL
,
7079 OUT PULONG Index OPTIONAL
7085 FsRtlLookupLargeMcbEntry (
7088 OUT PLONGLONG Lbn OPTIONAL
,
7089 OUT PLONGLONG SectorCountFromLbn OPTIONAL
,
7090 OUT PLONGLONG StartingLbn OPTIONAL
,
7091 OUT PLONGLONG SectorCountFromStartingLbn OPTIONAL
,
7092 OUT PULONG Index OPTIONAL
7098 FsRtlLookupLastBaseMcbEntry (
7107 FsRtlLookupLastLargeMcbEntry (
7116 FsRtlLookupLastMcbEntry (
7125 FsRtlLookupLastBaseMcbEntryAndIndex (
7126 IN PBASE_MCB OpaqueMcb
,
7127 IN OUT PLONGLONG LargeVbn
,
7128 IN OUT PLONGLONG LargeLbn
,
7135 FsRtlLookupLastLargeMcbEntryAndIndex (
7136 IN PLARGE_MCB OpaqueMcb
,
7137 OUT PLONGLONG LargeVbn
,
7138 OUT PLONGLONG LargeLbn
,
7145 FsRtlLookupMcbEntry (
7149 OUT PULONG SectorCount OPTIONAL
,
7154 PFSRTL_PER_STREAM_CONTEXT
7156 FsRtlLookupPerStreamContextInternal (
7157 IN PFSRTL_ADVANCED_FCB_HEADER StreamContext
,
7158 IN PVOID OwnerId OPTIONAL
,
7159 IN PVOID InstanceId OPTIONAL
7166 IN PFILE_OBJECT FileObject
,
7167 IN PLARGE_INTEGER FileOffset
,
7171 OUT PIO_STATUS_BLOCK IoStatus
,
7172 IN PDEVICE_OBJECT DeviceObject
7178 FsRtlMdlReadComplete (
7179 IN PFILE_OBJECT FileObject
,
7186 FsRtlMdlReadCompleteDev (
7187 IN PFILE_OBJECT FileObject
,
7189 IN PDEVICE_OBJECT DeviceObject
7195 FsRtlPrepareMdlWriteDev (
7196 IN PFILE_OBJECT FileObject
,
7197 IN PLARGE_INTEGER FileOffset
,
7201 OUT PIO_STATUS_BLOCK IoStatus
,
7202 IN PDEVICE_OBJECT DeviceObject
7208 FsRtlMdlWriteComplete (
7209 IN PFILE_OBJECT FileObject
,
7210 IN PLARGE_INTEGER FileOffset
,
7217 FsRtlMdlWriteCompleteDev (
7218 IN PFILE_OBJECT FileObject
,
7219 IN PLARGE_INTEGER FileOffset
,
7221 IN PDEVICE_OBJECT DeviceObject
7227 FsRtlNormalizeNtstatus (
7228 IN NTSTATUS Exception
,
7229 IN NTSTATUS GenericException
7235 FsRtlNotifyChangeDirectory (
7236 IN PNOTIFY_SYNC NotifySync
,
7238 IN PSTRING FullDirectoryName
,
7239 IN PLIST_ENTRY NotifyList
,
7240 IN BOOLEAN WatchTree
,
7241 IN ULONG CompletionFilter
,
7248 FsRtlNotifyCleanup (
7249 IN PNOTIFY_SYNC NotifySync
,
7250 IN PLIST_ENTRY NotifyList
,
7254 typedef BOOLEAN (NTAPI
*PCHECK_FOR_TRAVERSE_ACCESS
) (
7255 IN PVOID NotifyContext
,
7256 IN PVOID TargetContext
,
7257 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
7263 FsRtlNotifyFilterChangeDirectory (
7264 IN PNOTIFY_SYNC NotifySync
,
7265 IN PLIST_ENTRY NotifyList
,
7267 IN PSTRING FullDirectoryName
,
7268 IN BOOLEAN WatchTree
,
7269 IN BOOLEAN IgnoreBuffer
,
7270 IN ULONG CompletionFilter
,
7272 IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL
,
7273 IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL
,
7274 IN PFILTER_REPORT_CHANGE FilterCallback OPTIONAL
);
7279 FsRtlNotifyFilterReportChange (
7280 IN PNOTIFY_SYNC NotifySync
,
7281 IN PLIST_ENTRY NotifyList
,
7282 IN PSTRING FullTargetName
,
7283 IN USHORT TargetNameOffset
,
7284 IN PSTRING StreamName OPTIONAL
,
7285 IN PSTRING NormalizedParentName OPTIONAL
,
7286 IN ULONG FilterMatch
,
7288 IN PVOID TargetContext
,
7289 IN PVOID FilterContext
);
7294 FsRtlNotifyFullChangeDirectory (
7295 IN PNOTIFY_SYNC NotifySync
,
7296 IN PLIST_ENTRY NotifyList
,
7298 IN PSTRING FullDirectoryName
,
7299 IN BOOLEAN WatchTree
,
7300 IN BOOLEAN IgnoreBuffer
,
7301 IN ULONG CompletionFilter
,
7303 IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL
,
7304 IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL
7310 FsRtlNotifyFullReportChange (
7311 IN PNOTIFY_SYNC NotifySync
,
7312 IN PLIST_ENTRY NotifyList
,
7313 IN PSTRING FullTargetName
,
7314 IN USHORT TargetNameOffset
,
7315 IN PSTRING StreamName OPTIONAL
,
7316 IN PSTRING NormalizedParentName OPTIONAL
,
7317 IN ULONG FilterMatch
,
7319 IN PVOID TargetContext
7325 FsRtlNotifyInitializeSync (
7326 IN PNOTIFY_SYNC
*NotifySync
7332 FsRtlNotifyUninitializeSync (
7333 IN PNOTIFY_SYNC
*NotifySync
7336 #if (VER_PRODUCTBUILD >= 2195)
7341 FsRtlNotifyVolumeEvent (
7342 IN PFILE_OBJECT FileObject
,
7346 #endif /* (VER_PRODUCTBUILD >= 2195) */
7351 FsRtlNumberOfRunsInBaseMcb (
7358 FsRtlNumberOfRunsInLargeMcb (
7365 FsRtlNumberOfRunsInMcb (
7381 FsRtlOplockIsFastIoPossible (
7386 (NTAPI
*PFSRTL_STACK_OVERFLOW_ROUTINE
) (
7394 FsRtlPostPagingFileStackOverflow (
7397 IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine
7403 FsRtlPostStackOverflow (
7406 IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine
7412 ret: IoStatus->Status: STATUS_PENDING, STATUS_LOCK_NOT_GRANTED
7415 -Calls IoCompleteRequest if Irp
7416 -Uses exception handling / ExRaiseStatus with STATUS_INSUFFICIENT_RESOURCES
7422 IN PFILE_LOCK FileLock
,
7423 IN PFILE_OBJECT FileObject
,
7424 IN PLARGE_INTEGER FileOffset
,
7425 IN PLARGE_INTEGER Length
,
7426 IN PEPROCESS Process
,
7428 IN BOOLEAN FailImmediately
,
7429 IN BOOLEAN ExclusiveLock
,
7430 OUT PIO_STATUS_BLOCK IoStatus
,
7431 IN PIRP Irp OPTIONAL
,
7433 IN BOOLEAN AlreadySynchronized
7437 FsRtlProcessFileLock:
7440 -STATUS_INVALID_DEVICE_REQUEST
7441 -STATUS_RANGE_NOT_LOCKED from unlock routines.
7442 -STATUS_PENDING, STATUS_LOCK_NOT_GRANTED from FsRtlPrivateLock
7443 (redirected IoStatus->Status).
7446 -switch ( Irp->CurrentStackLocation->MinorFunction )
7447 lock: return FsRtlPrivateLock;
7448 unlocksingle: return FsRtlFastUnlockSingle;
7449 unlockall: return FsRtlFastUnlockAll;
7450 unlockallbykey: return FsRtlFastUnlockAllByKey;
7451 default: IofCompleteRequest with STATUS_INVALID_DEVICE_REQUEST;
7452 return STATUS_INVALID_DEVICE_REQUEST;
7454 -'AllwaysZero' is passed thru as 'AllwaysZero' to lock / unlock routines.
7455 -'Irp' is passet thru as 'Irp' to FsRtlPrivateLock.
7460 FsRtlProcessFileLock (
7461 IN PFILE_LOCK FileLock
,
7463 IN PVOID Context OPTIONAL
7469 FsRtlRegisterUncProvider (
7470 IN OUT PHANDLE MupHandle
,
7471 IN PUNICODE_STRING RedirectorDeviceName
,
7472 IN BOOLEAN MailslotsSupported
7478 FsRtlRemoveBaseMcbEntry (
7481 IN LONGLONG SectorCount
7487 FsRtlRemoveLargeMcbEntry (
7490 IN LONGLONG SectorCount
7496 FsRtlRemoveMcbEntry (
7499 IN ULONG SectorCount
7503 PFSRTL_PER_STREAM_CONTEXT
7505 FsRtlRemovePerStreamContext (
7506 IN PFSRTL_ADVANCED_FCB_HEADER StreamContext
,
7507 IN PVOID OwnerId OPTIONAL
,
7508 IN PVOID InstanceId OPTIONAL
7521 FsRtlResetLargeMcb (
7523 IN BOOLEAN SelfSynchronized
7538 FsRtlSplitLargeMcb (
7544 #define FsRtlSupportsPerStreamContexts(FO) ( \
7545 (BOOLEAN)((NULL != FsRtlGetPerStreamContextPointer(FO) && \
7546 FlagOn(FsRtlGetPerStreamContextPointer(FO)->Flags2, \
7547 FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS)) \
7553 FsRtlTruncateBaseMcb (
7561 FsRtlTruncateLargeMcb (
7577 FsRtlUninitializeBaseMcb (
7584 FsRtlUninitializeFileLock (
7585 IN PFILE_LOCK FileLock
7591 FsRtlUninitializeLargeMcb (
7598 FsRtlUninitializeMcb (
7605 FsRtlUninitializeOplock (
7606 IN OUT POPLOCK Oplock
7612 IoAttachDeviceToDeviceStackSafe(
7613 IN PDEVICE_OBJECT SourceDevice
,
7614 IN PDEVICE_OBJECT TargetDevice
,
7615 OUT PDEVICE_OBJECT
*AttachedToDeviceObject
7621 IoAcquireVpbSpinLock (
7628 IoCheckDesiredAccess (
7629 IN OUT PACCESS_MASK DesiredAccess
,
7630 IN ACCESS_MASK GrantedAccess
7636 IoCheckEaBufferValidity (
7637 IN PFILE_FULL_EA_INFORMATION EaBuffer
,
7639 OUT PULONG ErrorOffset
7645 IoCheckFunctionAccess (
7646 IN ACCESS_MASK GrantedAccess
,
7647 IN UCHAR MajorFunction
,
7648 IN UCHAR MinorFunction
,
7649 IN ULONG IoControlCode
,
7650 IN PVOID Argument1 OPTIONAL
,
7651 IN PVOID Argument2 OPTIONAL
7654 #if (VER_PRODUCTBUILD >= 2195)
7659 IoCheckQuotaBufferValidity (
7660 IN PFILE_QUOTA_INFORMATION QuotaBuffer
,
7661 IN ULONG QuotaLength
,
7662 OUT PULONG ErrorOffset
7665 #endif /* (VER_PRODUCTBUILD >= 2195) */
7670 IoCreateStreamFileObject (
7671 IN PFILE_OBJECT FileObject OPTIONAL
,
7672 IN PDEVICE_OBJECT DeviceObject OPTIONAL
7675 #if (VER_PRODUCTBUILD >= 2195)
7680 IoCreateStreamFileObjectLite (
7681 IN PFILE_OBJECT FileObject OPTIONAL
,
7682 IN PDEVICE_OBJECT DeviceObject OPTIONAL
7685 #endif /* (VER_PRODUCTBUILD >= 2195) */
7690 IoFastQueryNetworkAttributes (
7691 IN POBJECT_ATTRIBUTES ObjectAttributes
,
7692 IN ACCESS_MASK DesiredAccess
,
7693 IN ULONG OpenOptions
,
7694 OUT PIO_STATUS_BLOCK IoStatus
,
7695 OUT PFILE_NETWORK_OPEN_INFORMATION Buffer
7701 IoGetAttachedDevice (
7702 IN PDEVICE_OBJECT DeviceObject
7708 IoGetBaseFileSystemDeviceObject (
7709 IN PFILE_OBJECT FileObject
7712 #if (VER_PRODUCTBUILD >= 2600)
7717 IoGetDeviceAttachmentBaseRef (
7718 IN PDEVICE_OBJECT DeviceObject
7724 IoGetDiskDeviceObject (
7725 IN PDEVICE_OBJECT FileSystemDeviceObject
,
7726 OUT PDEVICE_OBJECT
*DiskDeviceObject
7732 IoGetLowerDeviceObject (
7733 IN PDEVICE_OBJECT DeviceObject
7736 #endif /* (VER_PRODUCTBUILD >= 2600) */
7741 IoGetRequestorProcess (
7745 #if (VER_PRODUCTBUILD >= 2195)
7750 IoGetRequestorProcessId (
7754 #endif /* (VER_PRODUCTBUILD >= 2195) */
7763 #define IoIsFileOpenedExclusively(FileObject) ( \
7765 (FileObject)->SharedRead || \
7766 (FileObject)->SharedWrite || \
7767 (FileObject)->SharedDelete \
7774 IoIsOperationSynchronous (
7785 #if (VER_PRODUCTBUILD >= 2195)
7790 IoIsValidNameGraftingBuffer (
7792 IN PREPARSE_DATA_BUFFER ReparseBuffer
7795 #endif /* (VER_PRODUCTBUILD >= 2195) */
7801 IN PFILE_OBJECT FileObject
,
7803 IN PLARGE_INTEGER Offset
,
7805 OUT PIO_STATUS_BLOCK IoStatusBlock
7811 IoQueryFileInformation (
7812 IN PFILE_OBJECT FileObject
,
7813 IN FILE_INFORMATION_CLASS FileInformationClass
,
7815 OUT PVOID FileInformation
,
7816 OUT PULONG ReturnedLength
7822 IoQueryVolumeInformation (
7823 IN PFILE_OBJECT FileObject
,
7824 IN FS_INFORMATION_CLASS FsInformationClass
,
7826 OUT PVOID FsInformation
,
7827 OUT PULONG ReturnedLength
7840 IoRegisterFileSystem (
7841 IN OUT PDEVICE_OBJECT DeviceObject
7844 #if (VER_PRODUCTBUILD >= 1381)
7846 typedef VOID (NTAPI
*PDRIVER_FS_NOTIFICATION
) (
7847 IN PDEVICE_OBJECT DeviceObject
,
7848 IN BOOLEAN DriverActive
7854 IoRegisterFsRegistrationChange (
7855 IN PDRIVER_OBJECT DriverObject
,
7856 IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
7859 #endif /* (VER_PRODUCTBUILD >= 1381) */
7864 IoReleaseVpbSpinLock (
7871 IoSetDeviceToVerify (
7873 IN PDEVICE_OBJECT DeviceObject
7880 IN PFILE_OBJECT FileObject
,
7881 IN FILE_INFORMATION_CLASS FileInformationClass
,
7883 IN PVOID FileInformation
7896 IoSynchronousPageWrite (
7897 IN PFILE_OBJECT FileObject
,
7899 IN PLARGE_INTEGER FileOffset
,
7901 OUT PIO_STATUS_BLOCK IoStatusBlock
7914 IoUnregisterFileSystem (
7915 IN OUT PDEVICE_OBJECT DeviceObject
7918 #if (VER_PRODUCTBUILD >= 1381)
7923 IoUnregisterFsRegistrationChange (
7924 IN PDRIVER_OBJECT DriverObject
,
7925 IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
7928 #endif /* (VER_PRODUCTBUILD >= 1381) */
7934 IN PDEVICE_OBJECT DeviceObject
,
7935 IN BOOLEAN AllowRawMount
7941 KeAcquireQueuedSpinLock (
7942 IN KSPIN_LOCK_QUEUE_NUMBER Number
7948 KeReleaseQueuedSpinLock (
7949 IN KSPIN_LOCK_QUEUE_NUMBER Number
,
7955 KeTryToAcquireQueuedSpinLock(
7956 KSPIN_LOCK_QUEUE_NUMBER Number
,
7962 MmCanFileBeTruncated (
7963 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
7964 IN PLARGE_INTEGER NewFileSize
7970 MmFlushImageSection (
7971 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
7972 IN MMFLUSH_TYPE FlushType
7978 MmForceSectionClosed (
7979 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
7980 IN BOOLEAN DelayClose
7983 #if (VER_PRODUCTBUILD >= 1381)
7988 MmIsRecursiveIoFault (
7994 #define MmIsRecursiveIoFault() ( \
7995 (PsGetCurrentThread()->DisablePageFaultClustering) | \
7996 (PsGetCurrentThread()->ForwardClusterOnly) \
8005 MmSetAddressRangeModified (
8014 IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL
,
8015 IN POBJECT_TYPE ObjectType
,
8016 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL
,
8017 IN KPROCESSOR_MODE AccessMode
,
8018 IN OUT PVOID ParseContext OPTIONAL
,
8019 IN ULONG ObjectSize
,
8020 IN ULONG PagedPoolCharge OPTIONAL
,
8021 IN ULONG NonPagedPoolCharge OPTIONAL
,
8028 ObGetObjectPointerCount (
8032 #if (NTDDI_VERSION >= NTDDI_WIN2K)
8039 IN PACCESS_STATE PassedAccessState OPTIONAL
,
8040 IN ACCESS_MASK DesiredAccess OPTIONAL
,
8041 IN ULONG ObjectPointerBias
,
8042 OUT PVOID
*NewObject OPTIONAL
,
8043 OUT PHANDLE Handle OPTIONAL
);
8048 ObOpenObjectByPointer (
8050 IN ULONG HandleAttributes
,
8051 IN PACCESS_STATE PassedAccessState OPTIONAL
,
8052 IN ACCESS_MASK DesiredAccess OPTIONAL
,
8053 IN POBJECT_TYPE ObjectType OPTIONAL
,
8054 IN KPROCESSOR_MODE AccessMode
,
8055 OUT PHANDLE Handle
);
8060 ObMakeTemporaryObject (
8066 ObQueryObjectAuditingByHandle (
8068 OUT PBOOLEAN GenerateOnClose
);
8077 OUT POBJECT_NAME_INFORMATION ObjectNameInfo
,
8079 OUT PULONG ReturnLength
8085 ObReferenceObjectByName (
8086 IN PUNICODE_STRING ObjectName
,
8087 IN ULONG Attributes
,
8088 IN PACCESS_STATE PassedAccessState OPTIONAL
,
8089 IN ACCESS_MASK DesiredAccess OPTIONAL
,
8090 IN POBJECT_TYPE ObjectType
,
8091 IN KPROCESSOR_MODE AccessMode
,
8092 IN OUT PVOID ParseContext OPTIONAL
,
8099 PsAssignImpersonationToken (
8108 IN PEPROCESS Process
,
8109 IN POOL_TYPE PoolType
,
8116 PsChargeProcessPoolQuota (
8117 IN PEPROCESS Process
,
8118 IN POOL_TYPE PoolType
,
8122 #define PsDereferenceImpersonationToken(T) \
8123 {if (ARGUMENT_PRESENT(T)) { \
8124 (ObDereferenceObject((T))); \
8130 #define PsDereferencePrimaryToken(T) (ObDereferenceObject((T)))
8135 PsDisableImpersonation(
8137 IN PSE_IMPERSONATION_STATE ImpersonationState
8143 PsGetProcessExitTime (
8150 PsImpersonateClient(
8152 IN PACCESS_TOKEN Token
,
8153 IN BOOLEAN CopyOnOpen
,
8154 IN BOOLEAN EffectiveOnly
,
8155 IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
8168 PsIsThreadTerminating (
8175 PsLookupProcessByProcessId (
8176 IN HANDLE ProcessId
,
8177 OUT PEPROCESS
*Process
8183 PsLookupProcessThreadByCid (
8185 OUT PEPROCESS
*Process OPTIONAL
,
8186 OUT PETHREAD
*Thread
8192 PsLookupThreadByThreadId (
8193 IN HANDLE UniqueThreadId
,
8194 OUT PETHREAD
*Thread
8200 PsReferenceImpersonationToken (
8202 OUT PBOOLEAN CopyOnUse
,
8203 OUT PBOOLEAN EffectiveOnly
,
8204 OUT PSECURITY_IMPERSONATION_LEVEL Level
8210 PsReferencePrimaryToken (
8211 IN PEPROCESS Process
8217 PsRestoreImpersonation(
8219 IN PSE_IMPERSONATION_STATE ImpersonationState
8226 IN PEPROCESS Process
,
8227 IN POOL_TYPE PoolType
,
8241 RtlGenerate8dot3Name (
8242 IN PUNICODE_STRING Name
,
8243 IN BOOLEAN AllowExtendedCharacters
,
8244 IN OUT PGENERATE_NAME_CONTEXT Context
,
8245 OUT PUNICODE_STRING Name8dot3
8251 RtlSecondsSince1970ToTime (
8252 IN ULONG SecondsSince1970
,
8253 OUT PLARGE_INTEGER Time
8259 RtlSetSaclSecurityDescriptor (
8260 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
8261 IN BOOLEAN SaclPresent
,
8263 IN BOOLEAN SaclDefaulted
8269 RtlUnicodeStringToCountedOemString (
8270 IN OUT POEM_STRING DestinationString
,
8271 IN PCUNICODE_STRING SourceString
,
8272 IN BOOLEAN AllocateDestinationString
8275 /* RTL Splay Tree Functions */
8279 RtlSplay(PRTL_SPLAY_LINKS Links
);
8284 RtlDelete(PRTL_SPLAY_LINKS Links
);
8290 PRTL_SPLAY_LINKS Links
,
8291 PRTL_SPLAY_LINKS
*Root
8297 RtlSubtreeSuccessor(PRTL_SPLAY_LINKS Links
);
8302 RtlSubtreePredecessor(PRTL_SPLAY_LINKS Links
);
8307 RtlRealSuccessor(PRTL_SPLAY_LINKS Links
);
8312 RtlRealPredecessor(PRTL_SPLAY_LINKS Links
);
8314 #define RtlIsLeftChild(Links) \
8315 (RtlLeftChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
8317 #define RtlIsRightChild(Links) \
8318 (RtlRightChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
8320 #define RtlRightChild(Links) \
8321 ((PRTL_SPLAY_LINKS)(Links))->RightChild
8323 #define RtlIsRoot(Links) \
8324 (RtlParent(Links) == (PRTL_SPLAY_LINKS)(Links))
8326 #define RtlLeftChild(Links) \
8327 ((PRTL_SPLAY_LINKS)(Links))->LeftChild
8329 #define RtlParent(Links) \
8330 ((PRTL_SPLAY_LINKS)(Links))->Parent
8332 #define RtlInitializeSplayLinks(Links) \
8334 PRTL_SPLAY_LINKS _SplayLinks; \
8335 _SplayLinks = (PRTL_SPLAY_LINKS)(Links); \
8336 _SplayLinks->Parent = _SplayLinks; \
8337 _SplayLinks->LeftChild = NULL; \
8338 _SplayLinks->RightChild = NULL; \
8341 #define RtlInsertAsLeftChild(ParentLinks,ChildLinks) \
8343 PRTL_SPLAY_LINKS _SplayParent; \
8344 PRTL_SPLAY_LINKS _SplayChild; \
8345 _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
8346 _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \
8347 _SplayParent->LeftChild = _SplayChild; \
8348 _SplayChild->Parent = _SplayParent; \
8351 #define RtlInsertAsRightChild(ParentLinks,ChildLinks) \
8353 PRTL_SPLAY_LINKS _SplayParent; \
8354 PRTL_SPLAY_LINKS _SplayChild; \
8355 _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
8356 _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \
8357 _SplayParent->RightChild = _SplayChild; \
8358 _SplayChild->Parent = _SplayParent; \
8362 // RTL time functions
8368 SeAppendPrivileges (
8369 PACCESS_STATE AccessState
,
8370 PPRIVILEGE_SET Privileges
8376 SeAuditingFileEvents (
8377 IN BOOLEAN AccessGranted
,
8378 IN PSECURITY_DESCRIPTOR SecurityDescriptor
8384 SeAuditingFileOrGlobalEvents (
8385 IN BOOLEAN AccessGranted
,
8386 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
8387 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
8393 SeCaptureSubjectContext (
8394 OUT PSECURITY_SUBJECT_CONTEXT SubjectContext
8400 SeCreateClientSecurity (
8402 IN PSECURITY_QUALITY_OF_SERVICE QualityOfService
,
8403 IN BOOLEAN RemoteClient
,
8404 OUT PSECURITY_CLIENT_CONTEXT ClientContext
8407 #if (VER_PRODUCTBUILD >= 2195)
8412 SeCreateClientSecurityFromSubjectContext (
8413 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
,
8414 IN PSECURITY_QUALITY_OF_SERVICE QualityOfService
,
8415 IN BOOLEAN ServerIsRemote
,
8416 OUT PSECURITY_CLIENT_CONTEXT ClientContext
8419 #endif /* (VER_PRODUCTBUILD >= 2195) */
8422 #define SeLengthSid( Sid ) \
8423 (8 + (4 * ((SID *)Sid)->SubAuthorityCount))
8425 #define SeDeleteClientSecurity(C) { \
8426 if (SeTokenType((C)->ClientToken) == TokenPrimary) { \
8427 PsDereferencePrimaryToken( (C)->ClientToken ); \
8429 PsDereferenceImpersonationToken( (C)->ClientToken ); \
8436 SeDeleteObjectAuditAlarm (
8441 #define SeEnableAccessToExports() SeExports = *(PSE_EXPORTS *)SeExports;
8447 IN PPRIVILEGE_SET Privileges
8453 SeImpersonateClient (
8454 IN PSECURITY_CLIENT_CONTEXT ClientContext
,
8455 IN PETHREAD ServerThread OPTIONAL
8458 #if (VER_PRODUCTBUILD >= 2195)
8463 SeImpersonateClientEx (
8464 IN PSECURITY_CLIENT_CONTEXT ClientContext
,
8465 IN PETHREAD ServerThread OPTIONAL
8468 #endif /* (VER_PRODUCTBUILD >= 2195) */
8473 SeLockSubjectContext (
8474 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
8480 SeMarkLogonSessionForTerminationNotification (
8487 SeOpenObjectAuditAlarm (
8488 IN PUNICODE_STRING ObjectTypeName
,
8489 IN PVOID Object OPTIONAL
,
8490 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL
,
8491 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
8492 IN PACCESS_STATE AccessState
,
8493 IN BOOLEAN ObjectCreated
,
8494 IN BOOLEAN AccessGranted
,
8495 IN KPROCESSOR_MODE AccessMode
,
8496 OUT PBOOLEAN GenerateOnClose
8502 SeOpenObjectForDeleteAuditAlarm (
8503 IN PUNICODE_STRING ObjectTypeName
,
8504 IN PVOID Object OPTIONAL
,
8505 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL
,
8506 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
8507 IN PACCESS_STATE AccessState
,
8508 IN BOOLEAN ObjectCreated
,
8509 IN BOOLEAN AccessGranted
,
8510 IN KPROCESSOR_MODE AccessMode
,
8511 OUT PBOOLEAN GenerateOnClose
8518 IN OUT PPRIVILEGE_SET RequiredPrivileges
,
8519 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
,
8520 IN KPROCESSOR_MODE AccessMode
8526 SeQueryAuthenticationIdToken (
8527 IN PACCESS_TOKEN Token
,
8531 #if (VER_PRODUCTBUILD >= 2195)
8536 SeQueryInformationToken (
8537 IN PACCESS_TOKEN Token
,
8538 IN TOKEN_INFORMATION_CLASS TokenInformationClass
,
8539 OUT PVOID
*TokenInformation
8542 #endif /* (VER_PRODUCTBUILD >= 2195) */
8547 SeQuerySecurityDescriptorInfo (
8548 IN PSECURITY_INFORMATION SecurityInformation
,
8549 OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
8550 IN OUT PULONG Length
,
8551 IN PSECURITY_DESCRIPTOR
*ObjectsSecurityDescriptor
8554 #if (VER_PRODUCTBUILD >= 2195)
8559 SeQuerySessionIdToken (
8560 IN PACCESS_TOKEN Token
,
8564 #endif /* (VER_PRODUCTBUILD >= 2195) */
8566 #define SeQuerySubjectContextToken( SubjectContext ) \
8567 ( ARGUMENT_PRESENT( \
8568 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken \
8570 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken : \
8571 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
8573 typedef NTSTATUS (NTAPI
*PSE_LOGON_SESSION_TERMINATED_ROUTINE
) (
8580 SeRegisterLogonSessionTerminatedRoutine (
8581 IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
8587 SeReleaseSubjectContext (
8588 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
8594 SeSetAccessStateGenericMapping (
8595 PACCESS_STATE AccessState
,
8596 PGENERIC_MAPPING GenericMapping
8602 SeSetSecurityDescriptorInfo (
8603 IN PVOID Object OPTIONAL
,
8604 IN PSECURITY_INFORMATION SecurityInformation
,
8605 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
8606 IN OUT PSECURITY_DESCRIPTOR
*ObjectsSecurityDescriptor
,
8607 IN POOL_TYPE PoolType
,
8608 IN PGENERIC_MAPPING GenericMapping
8611 #if (VER_PRODUCTBUILD >= 2195)
8616 SeSetSecurityDescriptorInfoEx (
8617 IN PVOID Object OPTIONAL
,
8618 IN PSECURITY_INFORMATION SecurityInformation
,
8619 IN PSECURITY_DESCRIPTOR ModificationDescriptor
,
8620 IN OUT PSECURITY_DESCRIPTOR
*ObjectsSecurityDescriptor
,
8621 IN ULONG AutoInheritFlags
,
8622 IN POOL_TYPE PoolType
,
8623 IN PGENERIC_MAPPING GenericMapping
8630 IN PACCESS_TOKEN Token
8636 SeTokenIsRestricted (
8637 IN PACCESS_TOKEN Token
8643 SeLocateProcessImageName(
8644 IN PEPROCESS Process
,
8645 OUT PUNICODE_STRING
*pImageFileName
8648 #endif /* (VER_PRODUCTBUILD >= 2195) */
8654 IN PACCESS_TOKEN Token
8660 SeUnlockSubjectContext (
8661 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
8667 SeUnregisterLogonSessionTerminatedRoutine (
8668 IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
8671 #if (VER_PRODUCTBUILD >= 2195)
8676 ZwAdjustPrivilegesToken (
8677 IN HANDLE TokenHandle
,
8678 IN BOOLEAN DisableAllPrivileges
,
8679 IN PTOKEN_PRIVILEGES NewState
,
8680 IN ULONG BufferLength
,
8681 OUT PTOKEN_PRIVILEGES PreviousState OPTIONAL
,
8682 OUT PULONG ReturnLength
8685 #endif /* (VER_PRODUCTBUILD >= 2195) */
8691 IN HANDLE ThreadHandle
8697 ZwAllocateVirtualMemory (
8698 IN HANDLE ProcessHandle
,
8699 IN OUT PVOID
*BaseAddress
,
8700 IN ULONG_PTR ZeroBits
,
8701 IN OUT PSIZE_T RegionSize
,
8702 IN ULONG AllocationType
,
8709 ZwAccessCheckAndAuditAlarm (
8710 IN PUNICODE_STRING SubsystemName
,
8712 IN PUNICODE_STRING ObjectTypeName
,
8713 IN PUNICODE_STRING ObjectName
,
8714 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
8715 IN ACCESS_MASK DesiredAccess
,
8716 IN PGENERIC_MAPPING GenericMapping
,
8717 IN BOOLEAN ObjectCreation
,
8718 OUT PACCESS_MASK GrantedAccess
,
8719 OUT PBOOLEAN AccessStatus
,
8720 OUT PBOOLEAN GenerateOnClose
8723 #if (VER_PRODUCTBUILD >= 2195)
8729 IN HANDLE FileHandle
,
8730 OUT PIO_STATUS_BLOCK IoStatusBlock
8733 #endif /* (VER_PRODUCTBUILD >= 2195) */
8739 IN HANDLE EventHandle
8745 ZwCloseObjectAuditAlarm (
8746 IN PUNICODE_STRING SubsystemName
,
8748 IN BOOLEAN GenerateOnClose
8755 OUT PHANDLE SectionHandle
,
8756 IN ACCESS_MASK DesiredAccess
,
8757 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL
,
8758 IN PLARGE_INTEGER MaximumSize OPTIONAL
,
8759 IN ULONG SectionPageProtection
,
8760 IN ULONG AllocationAttributes
,
8761 IN HANDLE FileHandle OPTIONAL
8767 ZwCreateSymbolicLinkObject (
8768 OUT PHANDLE SymbolicLinkHandle
,
8769 IN ACCESS_MASK DesiredAccess
,
8770 IN POBJECT_ATTRIBUTES ObjectAttributes
,
8771 IN PUNICODE_STRING TargetName
8778 IN POBJECT_ATTRIBUTES ObjectAttributes
8786 IN PUNICODE_STRING Name
8790 #if (NTDDI_VERSION >= NTDDI_WIN2K)
8794 ZwDeviceIoControlFile (
8795 IN HANDLE FileHandle
,
8796 IN HANDLE Event OPTIONAL
,
8797 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
8798 IN PVOID ApcContext OPTIONAL
,
8799 OUT PIO_STATUS_BLOCK IoStatusBlock
,
8800 IN ULONG IoControlCode
,
8801 IN PVOID InputBuffer OPTIONAL
,
8802 IN ULONG InputBufferLength
,
8803 OUT PVOID OutputBuffer OPTIONAL
,
8804 IN ULONG OutputBufferLength
);
8811 IN PUNICODE_STRING String
8818 IN HANDLE SourceProcessHandle
,
8819 IN HANDLE SourceHandle
,
8820 IN HANDLE TargetProcessHandle OPTIONAL
,
8821 OUT PHANDLE TargetHandle OPTIONAL
,
8822 IN ACCESS_MASK DesiredAccess
,
8823 IN ULONG HandleAttributes
,
8831 IN HANDLE ExistingTokenHandle
,
8832 IN ACCESS_MASK DesiredAccess
,
8833 IN POBJECT_ATTRIBUTES ObjectAttributes
,
8834 IN BOOLEAN EffectiveOnly
,
8835 IN TOKEN_TYPE TokenType
,
8836 OUT PHANDLE NewTokenHandle
8842 ZwFlushInstructionCache (
8843 IN HANDLE ProcessHandle
,
8844 IN PVOID BaseAddress OPTIONAL
,
8852 IN HANDLE FileHandle
,
8853 OUT PIO_STATUS_BLOCK IoStatusBlock
8856 #if (VER_PRODUCTBUILD >= 2195)
8861 ZwFlushVirtualMemory (
8862 IN HANDLE ProcessHandle
,
8863 IN OUT PVOID
*BaseAddress
,
8864 IN OUT PULONG FlushSize
,
8865 OUT PIO_STATUS_BLOCK IoStatusBlock
8868 #endif /* (VER_PRODUCTBUILD >= 2195) */
8873 ZwFreeVirtualMemory (
8874 IN HANDLE ProcessHandle
,
8875 IN OUT PVOID
*BaseAddress
,
8876 IN OUT PSIZE_T RegionSize
,
8884 IN HANDLE FileHandle
,
8885 IN HANDLE Event OPTIONAL
,
8886 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
8887 IN PVOID ApcContext OPTIONAL
,
8888 OUT PIO_STATUS_BLOCK IoStatusBlock
,
8889 IN ULONG FsControlCode
,
8890 IN PVOID InputBuffer OPTIONAL
,
8891 IN ULONG InputBufferLength
,
8892 OUT PVOID OutputBuffer OPTIONAL
,
8893 IN ULONG OutputBufferLength
8896 #if (VER_PRODUCTBUILD >= 2195)
8901 ZwInitiatePowerAction (
8902 IN POWER_ACTION SystemAction
,
8903 IN SYSTEM_POWER_STATE MinSystemState
,
8905 IN BOOLEAN Asynchronous
8908 #endif /* (VER_PRODUCTBUILD >= 2195) */
8914 /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
8915 IN PUNICODE_STRING RegistryPath
8922 IN POBJECT_ATTRIBUTES KeyObjectAttributes
,
8923 IN POBJECT_ATTRIBUTES FileObjectAttributes
8930 IN HANDLE KeyHandle
,
8931 IN HANDLE EventHandle OPTIONAL
,
8932 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
8933 IN PVOID ApcContext OPTIONAL
,
8934 OUT PIO_STATUS_BLOCK IoStatusBlock
,
8935 IN ULONG NotifyFilter
,
8936 IN BOOLEAN WatchSubtree
,
8938 IN ULONG BufferLength
,
8939 IN BOOLEAN Asynchronous
8945 ZwOpenDirectoryObject (
8946 OUT PHANDLE DirectoryHandle
,
8947 IN ACCESS_MASK DesiredAccess
,
8948 IN POBJECT_ATTRIBUTES ObjectAttributes
8955 OUT PHANDLE EventHandle
,
8956 IN ACCESS_MASK DesiredAccess
,
8957 IN POBJECT_ATTRIBUTES ObjectAttributes
8964 OUT PHANDLE ProcessHandle
,
8965 IN ACCESS_MASK DesiredAccess
,
8966 IN POBJECT_ATTRIBUTES ObjectAttributes
,
8967 IN PCLIENT_ID ClientId OPTIONAL
8973 ZwOpenProcessToken (
8974 IN HANDLE ProcessHandle
,
8975 IN ACCESS_MASK DesiredAccess
,
8976 OUT PHANDLE TokenHandle
8983 OUT PHANDLE ThreadHandle
,
8984 IN ACCESS_MASK DesiredAccess
,
8985 IN POBJECT_ATTRIBUTES ObjectAttributes
,
8986 IN PCLIENT_ID ClientId
8993 IN HANDLE ThreadHandle
,
8994 IN ACCESS_MASK DesiredAccess
,
8995 IN BOOLEAN OpenAsSelf
,
8996 OUT PHANDLE TokenHandle
8999 #if (VER_PRODUCTBUILD >= 2195)
9004 ZwPowerInformation (
9005 IN POWER_INFORMATION_LEVEL PowerInformationLevel
,
9006 IN PVOID InputBuffer OPTIONAL
,
9007 IN ULONG InputBufferLength
,
9008 OUT PVOID OutputBuffer OPTIONAL
,
9009 IN ULONG OutputBufferLength
9012 #endif /* (VER_PRODUCTBUILD >= 2195) */
9018 IN HANDLE EventHandle
,
9019 OUT PLONG PreviousState OPTIONAL
9025 ZwQueryDefaultLocale (
9026 IN BOOLEAN ThreadOrSystem
,
9033 ZwQueryDirectoryFile (
9034 IN HANDLE FileHandle
,
9035 IN HANDLE Event OPTIONAL
,
9036 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
9037 IN PVOID ApcContext OPTIONAL
,
9038 OUT PIO_STATUS_BLOCK IoStatusBlock
,
9039 OUT PVOID FileInformation
,
9041 IN FILE_INFORMATION_CLASS FileInformationClass
,
9042 IN BOOLEAN ReturnSingleEntry
,
9043 IN PUNICODE_STRING FileName OPTIONAL
,
9044 IN BOOLEAN RestartScan
9047 #if (VER_PRODUCTBUILD >= 2195)
9052 ZwQueryDirectoryObject (
9053 IN HANDLE DirectoryHandle
,
9056 IN BOOLEAN ReturnSingleEntry
,
9057 IN BOOLEAN RestartScan
,
9058 IN OUT PULONG Context
,
9059 OUT PULONG ReturnLength OPTIONAL
9066 IN HANDLE FileHandle
,
9067 OUT PIO_STATUS_BLOCK IoStatusBlock
,
9070 IN BOOLEAN ReturnSingleEntry
,
9071 IN PVOID EaList OPTIONAL
,
9072 IN ULONG EaListLength
,
9073 IN PULONG EaIndex OPTIONAL
,
9074 IN BOOLEAN RestartScan
9077 #endif /* (VER_PRODUCTBUILD >= 2195) */
9082 ZwQueryInformationProcess (
9083 IN HANDLE ProcessHandle
,
9084 IN PROCESSINFOCLASS ProcessInformationClass
,
9085 OUT PVOID ProcessInformation
,
9086 IN ULONG ProcessInformationLength
,
9087 OUT PULONG ReturnLength OPTIONAL
9093 ZwQueryInformationToken (
9094 IN HANDLE TokenHandle
,
9095 IN TOKEN_INFORMATION_CLASS TokenInformationClass
,
9096 OUT PVOID TokenInformation
,
9098 OUT PULONG ResultLength
9104 ZwQuerySecurityObject (
9105 IN HANDLE FileHandle
,
9106 IN SECURITY_INFORMATION SecurityInformation
,
9107 OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
9109 OUT PULONG ResultLength
9115 ZwQueryVolumeInformationFile (
9116 IN HANDLE FileHandle
,
9117 OUT PIO_STATUS_BLOCK IoStatusBlock
,
9118 OUT PVOID FsInformation
,
9120 IN FS_INFORMATION_CLASS FsInformationClass
9127 IN POBJECT_ATTRIBUTES NewFileObjectAttributes
,
9128 IN HANDLE KeyHandle
,
9129 IN POBJECT_ATTRIBUTES OldFileObjectAttributes
9136 IN HANDLE EventHandle
,
9137 OUT PLONG PreviousState OPTIONAL
9140 #if (VER_PRODUCTBUILD >= 2195)
9146 IN HANDLE KeyHandle
,
9147 IN HANDLE FileHandle
,
9151 #endif /* (VER_PRODUCTBUILD >= 2195) */
9157 IN HANDLE KeyHandle
,
9158 IN HANDLE FileHandle
9164 ZwSetDefaultLocale (
9165 IN BOOLEAN ThreadOrSystem
,
9169 #if (VER_PRODUCTBUILD >= 2195)
9174 ZwSetDefaultUILanguage (
9175 IN LANGID LanguageId
9182 IN HANDLE FileHandle
,
9183 OUT PIO_STATUS_BLOCK IoStatusBlock
,
9188 #endif /* (VER_PRODUCTBUILD >= 2195) */
9194 IN HANDLE EventHandle
,
9195 OUT PLONG PreviousState OPTIONAL
9201 ZwSetInformationProcess (
9202 IN HANDLE ProcessHandle
,
9203 IN PROCESSINFOCLASS ProcessInformationClass
,
9204 IN PVOID ProcessInformation
,
9205 IN ULONG ProcessInformationLength
9208 #if (VER_PRODUCTBUILD >= 2195)
9213 ZwSetSecurityObject (
9215 IN SECURITY_INFORMATION SecurityInformation
,
9216 IN PSECURITY_DESCRIPTOR SecurityDescriptor
9219 #endif /* (VER_PRODUCTBUILD >= 2195) */
9225 IN PLARGE_INTEGER NewTime
,
9226 OUT PLARGE_INTEGER OldTime OPTIONAL
9229 #if (VER_PRODUCTBUILD >= 2195)
9234 ZwSetVolumeInformationFile (
9235 IN HANDLE FileHandle
,
9236 OUT PIO_STATUS_BLOCK IoStatusBlock
,
9237 IN PVOID FsInformation
,
9239 IN FS_INFORMATION_CLASS FsInformationClass
9242 #endif /* (VER_PRODUCTBUILD >= 2195) */
9247 ZwTerminateProcess (
9248 IN HANDLE ProcessHandle OPTIONAL
,
9249 IN NTSTATUS ExitStatus
9256 /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
9257 IN PUNICODE_STRING RegistryPath
9264 IN POBJECT_ATTRIBUTES KeyObjectAttributes
9267 #if (NTDDI_VERSION >= NTDDI_WIN2K)
9271 ZwWaitForSingleObject (
9273 IN BOOLEAN Alertable
,
9274 IN PLARGE_INTEGER Timeout OPTIONAL
);
9280 ZwWaitForMultipleObjects (
9281 IN ULONG HandleCount
,
9283 IN WAIT_TYPE WaitType
,
9284 IN BOOLEAN Alertable
,
9285 IN PLARGE_INTEGER Timeout OPTIONAL