4 * Windows NT Filesystem Driver Developer Kit
6 * This file is part of the w32api package.
9 * Created by Bo Brantén <bosse@acc.umu.se>
11 * THIS SOFTWARE IS NOT COPYRIGHTED
13 * This source code is offered for use in the public domain. You may
14 * use, modify or distribute it freely.
16 * This code is distributed in the hope that it will be useful but
17 * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
18 * DISCLAIMED. This includes but is not limited to warranties of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
25 #define _NTIFS_INCLUDED_
28 /* Helper macro to enable gcc's extension. */
29 #ifndef __GNU_EXTENSION
31 #define __GNU_EXTENSION __extension__
33 #define __GNU_EXTENSION
41 #if !defined(_NTHALDLL_) && !defined(_BLDR_)
42 #define NTHALAPI DECLSPEC_IMPORT
47 #if !defined(_NTOSKRNL_) /* For ReactOS */
48 #define NTKERNELAPI DECLSPEC_IMPORT
60 /* FIXME : #include <ntiologc.h> */
63 #define FlagOn(_F,_SF) ((_F) & (_SF))
67 #define BooleanFlagOn(F,SF) ((BOOLEAN)(((F) & (SF)) != 0))
71 #define SetFlag(_F,_SF) ((_F) |= (_SF))
75 #define ClearFlag(_F,_SF) ((_F) &= ~(_SF))
78 #define PsGetCurrentProcess IoGetCurrentProcess
80 #if (NTDDI_VERSION >= NTDDI_VISTA)
81 extern NTSYSAPI
volatile CCHAR KeNumberProcessors
;
82 #elif (NTDDI_VERSION >= NTDDI_WINXP)
83 extern NTSYSAPI CCHAR KeNumberProcessors
;
85 extern PCCHAR KeNumberProcessors
;
88 typedef UNICODE_STRING LSA_UNICODE_STRING
, *PLSA_UNICODE_STRING
;
89 typedef STRING LSA_STRING
, *PLSA_STRING
;
90 typedef OBJECT_ATTRIBUTES LSA_OBJECT_ATTRIBUTES
, *PLSA_OBJECT_ATTRIBUTES
;
92 #ifndef SID_IDENTIFIER_AUTHORITY_DEFINED
93 #define SID_IDENTIFIER_AUTHORITY_DEFINED
94 typedef struct _SID_IDENTIFIER_AUTHORITY
{
96 } SID_IDENTIFIER_AUTHORITY
,*PSID_IDENTIFIER_AUTHORITY
,*LPSID_IDENTIFIER_AUTHORITY
;
101 typedef struct _SID
{
103 UCHAR SubAuthorityCount
;
104 SID_IDENTIFIER_AUTHORITY IdentifierAuthority
;
105 ULONG SubAuthority
[ANYSIZE_ARRAY
];
109 #define SID_REVISION 1
110 #define SID_MAX_SUB_AUTHORITIES 15
111 #define SID_RECOMMENDED_SUB_AUTHORITIES 1
113 typedef enum _SID_NAME_USE
{
118 SidTypeWellKnownGroup
,
119 SidTypeDeletedAccount
,
124 } SID_NAME_USE
, *PSID_NAME_USE
;
126 typedef struct _SID_AND_ATTRIBUTES
{
129 } SID_AND_ATTRIBUTES
, *PSID_AND_ATTRIBUTES
;
130 typedef SID_AND_ATTRIBUTES SID_AND_ATTRIBUTES_ARRAY
[ANYSIZE_ARRAY
];
131 typedef SID_AND_ATTRIBUTES_ARRAY
*PSID_AND_ATTRIBUTES_ARRAY
;
133 #define SID_HASH_SIZE 32
134 typedef ULONG_PTR SID_HASH_ENTRY
, *PSID_HASH_ENTRY
;
136 typedef struct _SID_AND_ATTRIBUTES_HASH
{
138 PSID_AND_ATTRIBUTES SidAttr
;
139 SID_HASH_ENTRY Hash
[SID_HASH_SIZE
];
140 } SID_AND_ATTRIBUTES_HASH
, *PSID_AND_ATTRIBUTES_HASH
;
142 /* Universal well-known SIDs */
144 #define SECURITY_NULL_SID_AUTHORITY {0,0,0,0,0,0}
145 #define SECURITY_WORLD_SID_AUTHORITY {0,0,0,0,0,1}
146 #define SECURITY_LOCAL_SID_AUTHORITY {0,0,0,0,0,2}
147 #define SECURITY_CREATOR_SID_AUTHORITY {0,0,0,0,0,3}
148 #define SECURITY_NON_UNIQUE_AUTHORITY {0,0,0,0,0,4}
149 #define SECURITY_RESOURCE_MANAGER_AUTHORITY {0,0,0,0,0,9}
151 #define SECURITY_NULL_RID (0x00000000L)
152 #define SECURITY_WORLD_RID (0x00000000L)
153 #define SECURITY_LOCAL_RID (0x00000000L)
154 #define SECURITY_LOCAL_LOGON_RID (0x00000001L)
156 #define SECURITY_CREATOR_OWNER_RID (0x00000000L)
157 #define SECURITY_CREATOR_GROUP_RID (0x00000001L)
158 #define SECURITY_CREATOR_OWNER_SERVER_RID (0x00000002L)
159 #define SECURITY_CREATOR_GROUP_SERVER_RID (0x00000003L)
160 #define SECURITY_CREATOR_OWNER_RIGHTS_RID (0x00000004L)
162 /* NT well-known SIDs */
164 #define SECURITY_NT_AUTHORITY {0,0,0,0,0,5}
166 #define SECURITY_DIALUP_RID (0x00000001L)
167 #define SECURITY_NETWORK_RID (0x00000002L)
168 #define SECURITY_BATCH_RID (0x00000003L)
169 #define SECURITY_INTERACTIVE_RID (0x00000004L)
170 #define SECURITY_LOGON_IDS_RID (0x00000005L)
171 #define SECURITY_LOGON_IDS_RID_COUNT (3L)
172 #define SECURITY_SERVICE_RID (0x00000006L)
173 #define SECURITY_ANONYMOUS_LOGON_RID (0x00000007L)
174 #define SECURITY_PROXY_RID (0x00000008L)
175 #define SECURITY_ENTERPRISE_CONTROLLERS_RID (0x00000009L)
176 #define SECURITY_SERVER_LOGON_RID SECURITY_ENTERPRISE_CONTROLLERS_RID
177 #define SECURITY_PRINCIPAL_SELF_RID (0x0000000AL)
178 #define SECURITY_AUTHENTICATED_USER_RID (0x0000000BL)
179 #define SECURITY_RESTRICTED_CODE_RID (0x0000000CL)
180 #define SECURITY_TERMINAL_SERVER_RID (0x0000000DL)
181 #define SECURITY_REMOTE_LOGON_RID (0x0000000EL)
182 #define SECURITY_THIS_ORGANIZATION_RID (0x0000000FL)
183 #define SECURITY_IUSER_RID (0x00000011L)
184 #define SECURITY_LOCAL_SYSTEM_RID (0x00000012L)
185 #define SECURITY_LOCAL_SERVICE_RID (0x00000013L)
186 #define SECURITY_NETWORK_SERVICE_RID (0x00000014L)
187 #define SECURITY_NT_NON_UNIQUE (0x00000015L)
188 #define SECURITY_NT_NON_UNIQUE_SUB_AUTH_COUNT (3L)
189 #define SECURITY_ENTERPRISE_READONLY_CONTROLLERS_RID (0x00000016L)
191 #define SECURITY_BUILTIN_DOMAIN_RID (0x00000020L)
192 #define SECURITY_WRITE_RESTRICTED_CODE_RID (0x00000021L)
195 #define SECURITY_PACKAGE_BASE_RID (0x00000040L)
196 #define SECURITY_PACKAGE_RID_COUNT (2L)
197 #define SECURITY_PACKAGE_NTLM_RID (0x0000000AL)
198 #define SECURITY_PACKAGE_SCHANNEL_RID (0x0000000EL)
199 #define SECURITY_PACKAGE_DIGEST_RID (0x00000015L)
201 #define SECURITY_CRED_TYPE_BASE_RID (0x00000041L)
202 #define SECURITY_CRED_TYPE_RID_COUNT (2L)
203 #define SECURITY_CRED_TYPE_THIS_ORG_CERT_RID (0x00000001L)
205 #define SECURITY_MIN_BASE_RID (0x00000050L)
206 #define SECURITY_SERVICE_ID_BASE_RID (0x00000050L)
207 #define SECURITY_SERVICE_ID_RID_COUNT (6L)
208 #define SECURITY_RESERVED_ID_BASE_RID (0x00000051L)
209 #define SECURITY_APPPOOL_ID_BASE_RID (0x00000052L)
210 #define SECURITY_APPPOOL_ID_RID_COUNT (6L)
211 #define SECURITY_VIRTUALSERVER_ID_BASE_RID (0x00000053L)
212 #define SECURITY_VIRTUALSERVER_ID_RID_COUNT (6L)
213 #define SECURITY_USERMODEDRIVERHOST_ID_BASE_RID (0x00000054L)
214 #define SECURITY_USERMODEDRIVERHOST_ID_RID_COUNT (6L)
215 #define SECURITY_CLOUD_INFRASTRUCTURE_SERVICES_ID_BASE_RID (0x00000055L)
216 #define SECURITY_CLOUD_INFRASTRUCTURE_SERVICES_ID_RID_COUNT (6L)
217 #define SECURITY_WMIHOST_ID_BASE_RID (0x00000056L)
218 #define SECURITY_WMIHOST_ID_RID_COUNT (6L)
219 #define SECURITY_TASK_ID_BASE_RID (0x00000057L)
220 #define SECURITY_NFS_ID_BASE_RID (0x00000058L)
221 #define SECURITY_COM_ID_BASE_RID (0x00000059L)
222 #define SECURITY_VIRTUALACCOUNT_ID_RID_COUNT (6L)
224 #define SECURITY_MAX_BASE_RID (0x0000006FL)
226 #define SECURITY_MAX_ALWAYS_FILTERED (0x000003E7L)
227 #define SECURITY_MIN_NEVER_FILTERED (0x000003E8L)
229 #define SECURITY_OTHER_ORGANIZATION_RID (0x000003E8L)
231 #define SECURITY_WINDOWSMOBILE_ID_BASE_RID (0x00000070L)
233 /* Well-known domain relative sub-authority values (RIDs) */
235 #define DOMAIN_GROUP_RID_ENTERPRISE_READONLY_DOMAIN_CONTROLLERS (0x000001F2L)
237 #define FOREST_USER_RID_MAX (0x000001F3L)
239 /* Well-known users */
241 #define DOMAIN_USER_RID_ADMIN (0x000001F4L)
242 #define DOMAIN_USER_RID_GUEST (0x000001F5L)
243 #define DOMAIN_USER_RID_KRBTGT (0x000001F6L)
245 #define DOMAIN_USER_RID_MAX (0x000003E7L)
247 /* Well-known groups */
249 #define DOMAIN_GROUP_RID_ADMINS (0x00000200L)
250 #define DOMAIN_GROUP_RID_USERS (0x00000201L)
251 #define DOMAIN_GROUP_RID_GUESTS (0x00000202L)
252 #define DOMAIN_GROUP_RID_COMPUTERS (0x00000203L)
253 #define DOMAIN_GROUP_RID_CONTROLLERS (0x00000204L)
254 #define DOMAIN_GROUP_RID_CERT_ADMINS (0x00000205L)
255 #define DOMAIN_GROUP_RID_SCHEMA_ADMINS (0x00000206L)
256 #define DOMAIN_GROUP_RID_ENTERPRISE_ADMINS (0x00000207L)
257 #define DOMAIN_GROUP_RID_POLICY_ADMINS (0x00000208L)
258 #define DOMAIN_GROUP_RID_READONLY_CONTROLLERS (0x00000209L)
260 /* Well-known aliases */
262 #define DOMAIN_ALIAS_RID_ADMINS (0x00000220L)
263 #define DOMAIN_ALIAS_RID_USERS (0x00000221L)
264 #define DOMAIN_ALIAS_RID_GUESTS (0x00000222L)
265 #define DOMAIN_ALIAS_RID_POWER_USERS (0x00000223L)
267 #define DOMAIN_ALIAS_RID_ACCOUNT_OPS (0x00000224L)
268 #define DOMAIN_ALIAS_RID_SYSTEM_OPS (0x00000225L)
269 #define DOMAIN_ALIAS_RID_PRINT_OPS (0x00000226L)
270 #define DOMAIN_ALIAS_RID_BACKUP_OPS (0x00000227L)
272 #define DOMAIN_ALIAS_RID_REPLICATOR (0x00000228L)
273 #define DOMAIN_ALIAS_RID_RAS_SERVERS (0x00000229L)
274 #define DOMAIN_ALIAS_RID_PREW2KCOMPACCESS (0x0000022AL)
275 #define DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS (0x0000022BL)
276 #define DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS (0x0000022CL)
277 #define DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS (0x0000022DL)
279 #define DOMAIN_ALIAS_RID_MONITORING_USERS (0x0000022EL)
280 #define DOMAIN_ALIAS_RID_LOGGING_USERS (0x0000022FL)
281 #define DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS (0x00000230L)
282 #define DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS (0x00000231L)
283 #define DOMAIN_ALIAS_RID_DCOM_USERS (0x00000232L)
284 #define DOMAIN_ALIAS_RID_IUSERS (0x00000238L)
285 #define DOMAIN_ALIAS_RID_CRYPTO_OPERATORS (0x00000239L)
286 #define DOMAIN_ALIAS_RID_CACHEABLE_PRINCIPALS_GROUP (0x0000023BL)
287 #define DOMAIN_ALIAS_RID_NON_CACHEABLE_PRINCIPALS_GROUP (0x0000023CL)
288 #define DOMAIN_ALIAS_RID_EVENT_LOG_READERS_GROUP (0x0000023DL)
289 #define DOMAIN_ALIAS_RID_CERTSVC_DCOM_ACCESS_GROUP (0x0000023EL)
291 #define SECURITY_MANDATORY_LABEL_AUTHORITY {0,0,0,0,0,16}
292 #define SECURITY_MANDATORY_UNTRUSTED_RID (0x00000000L)
293 #define SECURITY_MANDATORY_LOW_RID (0x00001000L)
294 #define SECURITY_MANDATORY_MEDIUM_RID (0x00002000L)
295 #define SECURITY_MANDATORY_HIGH_RID (0x00003000L)
296 #define SECURITY_MANDATORY_SYSTEM_RID (0x00004000L)
297 #define SECURITY_MANDATORY_PROTECTED_PROCESS_RID (0x00005000L)
299 /* SECURITY_MANDATORY_MAXIMUM_USER_RID is the highest RID that
300 can be set by a usermode caller.*/
302 #define SECURITY_MANDATORY_MAXIMUM_USER_RID SECURITY_MANDATORY_SYSTEM_RID
304 #define MANDATORY_LEVEL_TO_MANDATORY_RID(IL) (IL * 0x1000)
306 /* Allocate the System Luid. The first 1000 LUIDs are reserved.
307 Use #999 here (0x3e7 = 999) */
309 #define SYSTEM_LUID { 0x3e7, 0x0 }
310 #define ANONYMOUS_LOGON_LUID { 0x3e6, 0x0 }
311 #define LOCALSERVICE_LUID { 0x3e5, 0x0 }
312 #define NETWORKSERVICE_LUID { 0x3e4, 0x0 }
313 #define IUSER_LUID { 0x3e3, 0x0 }
315 typedef struct _ACE_HEADER
{
319 } ACE_HEADER
, *PACE_HEADER
;
321 /* also in winnt.h */
322 #define ACCESS_MIN_MS_ACE_TYPE (0x0)
323 #define ACCESS_ALLOWED_ACE_TYPE (0x0)
324 #define ACCESS_DENIED_ACE_TYPE (0x1)
325 #define SYSTEM_AUDIT_ACE_TYPE (0x2)
326 #define SYSTEM_ALARM_ACE_TYPE (0x3)
327 #define ACCESS_MAX_MS_V2_ACE_TYPE (0x3)
328 #define ACCESS_ALLOWED_COMPOUND_ACE_TYPE (0x4)
329 #define ACCESS_MAX_MS_V3_ACE_TYPE (0x4)
330 #define ACCESS_MIN_MS_OBJECT_ACE_TYPE (0x5)
331 #define ACCESS_ALLOWED_OBJECT_ACE_TYPE (0x5)
332 #define ACCESS_DENIED_OBJECT_ACE_TYPE (0x6)
333 #define SYSTEM_AUDIT_OBJECT_ACE_TYPE (0x7)
334 #define SYSTEM_ALARM_OBJECT_ACE_TYPE (0x8)
335 #define ACCESS_MAX_MS_OBJECT_ACE_TYPE (0x8)
336 #define ACCESS_MAX_MS_V4_ACE_TYPE (0x8)
337 #define ACCESS_MAX_MS_ACE_TYPE (0x8)
338 #define ACCESS_ALLOWED_CALLBACK_ACE_TYPE (0x9)
339 #define ACCESS_DENIED_CALLBACK_ACE_TYPE (0xA)
340 #define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE (0xB)
341 #define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE (0xC)
342 #define SYSTEM_AUDIT_CALLBACK_ACE_TYPE (0xD)
343 #define SYSTEM_ALARM_CALLBACK_ACE_TYPE (0xE)
344 #define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE (0xF)
345 #define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE (0x10)
346 #define ACCESS_MAX_MS_V5_ACE_TYPE (0x11)
347 #define SYSTEM_MANDATORY_LABEL_ACE_TYPE (0x11)
349 /* The following are the inherit flags that go into the AceFlags field
352 #define OBJECT_INHERIT_ACE (0x1)
353 #define CONTAINER_INHERIT_ACE (0x2)
354 #define NO_PROPAGATE_INHERIT_ACE (0x4)
355 #define INHERIT_ONLY_ACE (0x8)
356 #define INHERITED_ACE (0x10)
357 #define VALID_INHERIT_FLAGS (0x1F)
359 #define SUCCESSFUL_ACCESS_ACE_FLAG (0x40)
360 #define FAILED_ACCESS_ACE_FLAG (0x80)
362 typedef struct _ACCESS_ALLOWED_ACE
{
366 } ACCESS_ALLOWED_ACE
, *PACCESS_ALLOWED_ACE
;
368 typedef struct _ACCESS_DENIED_ACE
{
372 } ACCESS_DENIED_ACE
, *PACCESS_DENIED_ACE
;
374 typedef struct _SYSTEM_AUDIT_ACE
{
378 } SYSTEM_AUDIT_ACE
, *PSYSTEM_AUDIT_ACE
;
380 typedef struct _SYSTEM_ALARM_ACE
{
384 } SYSTEM_ALARM_ACE
, *PSYSTEM_ALARM_ACE
;
386 typedef struct _SYSTEM_MANDATORY_LABEL_ACE
{
390 } SYSTEM_MANDATORY_LABEL_ACE
, *PSYSTEM_MANDATORY_LABEL_ACE
;
392 #define SYSTEM_MANDATORY_LABEL_NO_WRITE_UP 0x1
393 #define SYSTEM_MANDATORY_LABEL_NO_READ_UP 0x2
394 #define SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP 0x4
395 #define SYSTEM_MANDATORY_LABEL_VALID_MASK (SYSTEM_MANDATORY_LABEL_NO_WRITE_UP | \
396 SYSTEM_MANDATORY_LABEL_NO_READ_UP | \
397 SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP)
399 #define SECURITY_DESCRIPTOR_MIN_LENGTH (sizeof(SECURITY_DESCRIPTOR))
401 typedef USHORT SECURITY_DESCRIPTOR_CONTROL
,*PSECURITY_DESCRIPTOR_CONTROL
;
403 #define SE_OWNER_DEFAULTED 0x0001
404 #define SE_GROUP_DEFAULTED 0x0002
405 #define SE_DACL_PRESENT 0x0004
406 #define SE_DACL_DEFAULTED 0x0008
407 #define SE_SACL_PRESENT 0x0010
408 #define SE_SACL_DEFAULTED 0x0020
409 #define SE_DACL_UNTRUSTED 0x0040
410 #define SE_SERVER_SECURITY 0x0080
411 #define SE_DACL_AUTO_INHERIT_REQ 0x0100
412 #define SE_SACL_AUTO_INHERIT_REQ 0x0200
413 #define SE_DACL_AUTO_INHERITED 0x0400
414 #define SE_SACL_AUTO_INHERITED 0x0800
415 #define SE_DACL_PROTECTED 0x1000
416 #define SE_SACL_PROTECTED 0x2000
417 #define SE_RM_CONTROL_VALID 0x4000
418 #define SE_SELF_RELATIVE 0x8000
420 typedef struct _SECURITY_DESCRIPTOR_RELATIVE
{
423 SECURITY_DESCRIPTOR_CONTROL Control
;
428 } SECURITY_DESCRIPTOR_RELATIVE
, *PISECURITY_DESCRIPTOR_RELATIVE
;
430 typedef struct _SECURITY_DESCRIPTOR
{
433 SECURITY_DESCRIPTOR_CONTROL Control
;
438 } SECURITY_DESCRIPTOR
, *PISECURITY_DESCRIPTOR
;
440 typedef struct _OBJECT_TYPE_LIST
{
444 } OBJECT_TYPE_LIST
, *POBJECT_TYPE_LIST
;
446 #define ACCESS_OBJECT_GUID 0
447 #define ACCESS_PROPERTY_SET_GUID 1
448 #define ACCESS_PROPERTY_GUID 2
449 #define ACCESS_MAX_LEVEL 4
451 typedef enum _AUDIT_EVENT_TYPE
{
452 AuditEventObjectAccess
,
453 AuditEventDirectoryServiceAccess
454 } AUDIT_EVENT_TYPE
, *PAUDIT_EVENT_TYPE
;
456 #define AUDIT_ALLOW_NO_PRIVILEGE 0x1
458 #define ACCESS_DS_SOURCE_A "DS"
459 #define ACCESS_DS_SOURCE_W L"DS"
460 #define ACCESS_DS_OBJECT_TYPE_NAME_A "Directory Service Object"
461 #define ACCESS_DS_OBJECT_TYPE_NAME_W L"Directory Service Object"
463 #define ACCESS_REASON_TYPE_MASK 0xffff0000
464 #define ACCESS_REASON_DATA_MASK 0x0000ffff
466 typedef enum _ACCESS_REASON_TYPE
{
467 AccessReasonNone
= 0x00000000,
468 AccessReasonAllowedAce
= 0x00010000,
469 AccessReasonDeniedAce
= 0x00020000,
470 AccessReasonAllowedParentAce
= 0x00030000,
471 AccessReasonDeniedParentAce
= 0x00040000,
472 AccessReasonMissingPrivilege
= 0x00100000,
473 AccessReasonFromPrivilege
= 0x00200000,
474 AccessReasonIntegrityLevel
= 0x00300000,
475 AccessReasonOwnership
= 0x00400000,
476 AccessReasonNullDacl
= 0x00500000,
477 AccessReasonEmptyDacl
= 0x00600000,
478 AccessReasonNoSD
= 0x00700000,
479 AccessReasonNoGrant
= 0x00800000
480 } ACCESS_REASON_TYPE
;
482 typedef ULONG ACCESS_REASON
;
484 typedef struct _ACCESS_REASONS
{
485 ACCESS_REASON Data
[32];
486 } ACCESS_REASONS
, *PACCESS_REASONS
;
488 #define SE_SECURITY_DESCRIPTOR_FLAG_NO_OWNER_ACE 0x00000001
489 #define SE_SECURITY_DESCRIPTOR_FLAG_NO_LABEL_ACE 0x00000002
490 #define SE_SECURITY_DESCRIPTOR_VALID_FLAGS 0x00000003
492 typedef struct _SE_SECURITY_DESCRIPTOR
{
495 PSECURITY_DESCRIPTOR SecurityDescriptor
;
496 } SE_SECURITY_DESCRIPTOR
, *PSE_SECURITY_DESCRIPTOR
;
498 typedef struct _SE_ACCESS_REQUEST
{
500 PSE_SECURITY_DESCRIPTOR SeSecurityDescriptor
;
501 ACCESS_MASK DesiredAccess
;
502 ACCESS_MASK PreviouslyGrantedAccess
;
503 PSID PrincipalSelfSid
;
504 PGENERIC_MAPPING GenericMapping
;
505 ULONG ObjectTypeListCount
;
506 POBJECT_TYPE_LIST ObjectTypeList
;
507 } SE_ACCESS_REQUEST
, *PSE_ACCESS_REQUEST
;
509 typedef struct _SE_ACCESS_REPLY
{
511 ULONG ResultListCount
;
512 PACCESS_MASK GrantedAccess
;
513 PNTSTATUS AccessStatus
;
514 PACCESS_REASONS AccessReason
;
515 PPRIVILEGE_SET
* Privileges
;
516 } SE_ACCESS_REPLY
, *PSE_ACCESS_REPLY
;
518 typedef enum _SE_AUDIT_OPERATION
{
519 AuditPrivilegeObject
,
520 AuditPrivilegeService
,
523 AuditOpenObjectWithTransaction
,
526 AuditOpenObjectForDelete
,
527 AuditOpenObjectForDeleteWithTransaction
,
530 AuditObjectReference
,
532 } SE_AUDIT_OPERATION
, *PSE_AUDIT_OPERATION
;
534 typedef struct _SE_AUDIT_INFO
{
536 AUDIT_EVENT_TYPE AuditType
;
537 SE_AUDIT_OPERATION AuditOperation
;
539 UNICODE_STRING SubsystemName
;
540 UNICODE_STRING ObjectTypeName
;
541 UNICODE_STRING ObjectName
;
545 BOOLEAN ObjectCreation
;
546 BOOLEAN GenerateOnClose
;
547 } SE_AUDIT_INFO
, *PSE_AUDIT_INFO
;
549 #define TOKEN_ASSIGN_PRIMARY (0x0001)
550 #define TOKEN_DUPLICATE (0x0002)
551 #define TOKEN_IMPERSONATE (0x0004)
552 #define TOKEN_QUERY (0x0008)
553 #define TOKEN_QUERY_SOURCE (0x0010)
554 #define TOKEN_ADJUST_PRIVILEGES (0x0020)
555 #define TOKEN_ADJUST_GROUPS (0x0040)
556 #define TOKEN_ADJUST_DEFAULT (0x0080)
557 #define TOKEN_ADJUST_SESSIONID (0x0100)
559 #define TOKEN_ALL_ACCESS_P (STANDARD_RIGHTS_REQUIRED |\
560 TOKEN_ASSIGN_PRIMARY |\
564 TOKEN_QUERY_SOURCE |\
565 TOKEN_ADJUST_PRIVILEGES |\
566 TOKEN_ADJUST_GROUPS |\
567 TOKEN_ADJUST_DEFAULT )
569 #if ((defined(_WIN32_WINNT) && (_WIN32_WINNT > 0x0400)) || (!defined(_WIN32_WINNT)))
570 #define TOKEN_ALL_ACCESS (TOKEN_ALL_ACCESS_P |\
571 TOKEN_ADJUST_SESSIONID )
573 #define TOKEN_ALL_ACCESS (TOKEN_ALL_ACCESS_P)
576 #define TOKEN_READ (STANDARD_RIGHTS_READ |\
579 #define TOKEN_WRITE (STANDARD_RIGHTS_WRITE |\
580 TOKEN_ADJUST_PRIVILEGES |\
581 TOKEN_ADJUST_GROUPS |\
582 TOKEN_ADJUST_DEFAULT)
584 #define TOKEN_EXECUTE (STANDARD_RIGHTS_EXECUTE)
586 typedef enum _TOKEN_TYPE
{
589 } TOKEN_TYPE
,*PTOKEN_TYPE
;
591 typedef enum _TOKEN_INFORMATION_CLASS
{
600 TokenImpersonationLevel
,
604 TokenGroupsAndPrivileges
,
605 TokenSessionReference
,
612 TokenHasRestrictions
,
613 TokenAccessInformation
,
614 TokenVirtualizationAllowed
,
615 TokenVirtualizationEnabled
,
618 TokenMandatoryPolicy
,
621 } TOKEN_INFORMATION_CLASS
, *PTOKEN_INFORMATION_CLASS
;
623 typedef struct _TOKEN_USER
{
624 SID_AND_ATTRIBUTES User
;
625 } TOKEN_USER
, *PTOKEN_USER
;
627 typedef struct _TOKEN_GROUPS
{
629 SID_AND_ATTRIBUTES Groups
[ANYSIZE_ARRAY
];
630 } TOKEN_GROUPS
,*PTOKEN_GROUPS
,*LPTOKEN_GROUPS
;
632 typedef struct _TOKEN_PRIVILEGES
{
633 ULONG PrivilegeCount
;
634 LUID_AND_ATTRIBUTES Privileges
[ANYSIZE_ARRAY
];
635 } TOKEN_PRIVILEGES
,*PTOKEN_PRIVILEGES
,*LPTOKEN_PRIVILEGES
;
637 typedef struct _TOKEN_OWNER
{
639 } TOKEN_OWNER
,*PTOKEN_OWNER
;
641 typedef struct _TOKEN_PRIMARY_GROUP
{
643 } TOKEN_PRIMARY_GROUP
,*PTOKEN_PRIMARY_GROUP
;
645 typedef struct _TOKEN_DEFAULT_DACL
{
647 } TOKEN_DEFAULT_DACL
,*PTOKEN_DEFAULT_DACL
;
649 typedef struct _TOKEN_GROUPS_AND_PRIVILEGES
{
652 PSID_AND_ATTRIBUTES Sids
;
653 ULONG RestrictedSidCount
;
654 ULONG RestrictedSidLength
;
655 PSID_AND_ATTRIBUTES RestrictedSids
;
656 ULONG PrivilegeCount
;
657 ULONG PrivilegeLength
;
658 PLUID_AND_ATTRIBUTES Privileges
;
659 LUID AuthenticationId
;
660 } TOKEN_GROUPS_AND_PRIVILEGES
, *PTOKEN_GROUPS_AND_PRIVILEGES
;
662 typedef struct _TOKEN_LINKED_TOKEN
{
664 } TOKEN_LINKED_TOKEN
, *PTOKEN_LINKED_TOKEN
;
666 typedef struct _TOKEN_ELEVATION
{
667 ULONG TokenIsElevated
;
668 } TOKEN_ELEVATION
, *PTOKEN_ELEVATION
;
670 typedef struct _TOKEN_MANDATORY_LABEL
{
671 SID_AND_ATTRIBUTES Label
;
672 } TOKEN_MANDATORY_LABEL
, *PTOKEN_MANDATORY_LABEL
;
674 #define TOKEN_MANDATORY_POLICY_OFF 0x0
675 #define TOKEN_MANDATORY_POLICY_NO_WRITE_UP 0x1
676 #define TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN 0x2
678 #define TOKEN_MANDATORY_POLICY_VALID_MASK (TOKEN_MANDATORY_POLICY_NO_WRITE_UP | \
679 TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN)
681 typedef struct _TOKEN_MANDATORY_POLICY
{
683 } TOKEN_MANDATORY_POLICY
, *PTOKEN_MANDATORY_POLICY
;
685 typedef struct _TOKEN_ACCESS_INFORMATION
{
686 PSID_AND_ATTRIBUTES_HASH SidHash
;
687 PSID_AND_ATTRIBUTES_HASH RestrictedSidHash
;
688 PTOKEN_PRIVILEGES Privileges
;
689 LUID AuthenticationId
;
690 TOKEN_TYPE TokenType
;
691 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
;
692 TOKEN_MANDATORY_POLICY MandatoryPolicy
;
694 } TOKEN_ACCESS_INFORMATION
, *PTOKEN_ACCESS_INFORMATION
;
696 #define POLICY_AUDIT_SUBCATEGORY_COUNT (53)
698 typedef struct _TOKEN_AUDIT_POLICY
{
699 UCHAR PerUserPolicy
[((POLICY_AUDIT_SUBCATEGORY_COUNT
) >> 1) + 1];
700 } TOKEN_AUDIT_POLICY
, *PTOKEN_AUDIT_POLICY
;
702 #define TOKEN_SOURCE_LENGTH 8
704 typedef struct _TOKEN_SOURCE
{
705 CHAR SourceName
[TOKEN_SOURCE_LENGTH
];
706 LUID SourceIdentifier
;
707 } TOKEN_SOURCE
,*PTOKEN_SOURCE
;
709 typedef struct _TOKEN_STATISTICS
{
711 LUID AuthenticationId
;
712 LARGE_INTEGER ExpirationTime
;
713 TOKEN_TYPE TokenType
;
714 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
;
715 ULONG DynamicCharged
;
716 ULONG DynamicAvailable
;
718 ULONG PrivilegeCount
;
720 } TOKEN_STATISTICS
, *PTOKEN_STATISTICS
;
722 typedef struct _TOKEN_CONTROL
{
724 LUID AuthenticationId
;
726 TOKEN_SOURCE TokenSource
;
727 } TOKEN_CONTROL
,*PTOKEN_CONTROL
;
729 typedef struct _TOKEN_ORIGIN
{
730 LUID OriginatingLogonSession
;
731 } TOKEN_ORIGIN
, *PTOKEN_ORIGIN
;
733 typedef enum _MANDATORY_LEVEL
{
734 MandatoryLevelUntrusted
= 0,
736 MandatoryLevelMedium
,
738 MandatoryLevelSystem
,
739 MandatoryLevelSecureProcess
,
741 } MANDATORY_LEVEL
, *PMANDATORY_LEVEL
;
743 #if (NTDDI_VERSION >= NTDDI_WIN2K)
749 IN HANDLE ThreadHandle
,
750 IN ACCESS_MASK DesiredAccess
,
751 IN BOOLEAN OpenAsSelf
,
752 OUT PHANDLE TokenHandle
);
758 IN HANDLE ProcessHandle
,
759 IN ACCESS_MASK DesiredAccess
,
760 OUT PHANDLE TokenHandle
);
765 NtQueryInformationToken(
766 IN HANDLE TokenHandle
,
767 IN TOKEN_INFORMATION_CLASS TokenInformationClass
,
768 OUT PVOID TokenInformation OPTIONAL
,
769 IN ULONG TokenInformationLength
,
770 OUT PULONG ReturnLength
);
775 NtAdjustPrivilegesToken(
776 IN HANDLE TokenHandle
,
777 IN BOOLEAN DisableAllPrivileges
,
778 IN PTOKEN_PRIVILEGES NewState OPTIONAL
,
779 IN ULONG BufferLength
,
780 OUT PTOKEN_PRIVILEGES PreviousState
,
781 OUT PULONG ReturnLength OPTIONAL
);
787 OUT PHANDLE FileHandle
,
788 IN ACCESS_MASK DesiredAccess
,
789 IN POBJECT_ATTRIBUTES ObjectAttributes
,
790 OUT PIO_STATUS_BLOCK IoStatusBlock
,
791 IN PLARGE_INTEGER AllocationSize OPTIONAL
,
792 IN ULONG FileAttributes
,
793 IN ULONG ShareAccess
,
794 IN ULONG CreateDisposition
,
795 IN ULONG CreateOptions
,
802 NtDeviceIoControlFile(
803 IN HANDLE FileHandle
,
804 IN HANDLE Event OPTIONAL
,
805 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
806 IN PVOID ApcContext OPTIONAL
,
807 OUT PIO_STATUS_BLOCK IoStatusBlock
,
808 IN ULONG IoControlCode
,
809 IN PVOID InputBuffer OPTIONAL
,
810 IN ULONG InputBufferLength
,
811 OUT PVOID OutputBuffer OPTIONAL
,
812 IN ULONG OutputBufferLength
);
818 IN HANDLE FileHandle
,
819 IN HANDLE Event OPTIONAL
,
820 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
821 IN PVOID ApcContext OPTIONAL
,
822 OUT PIO_STATUS_BLOCK IoStatusBlock
,
823 IN ULONG FsControlCode
,
824 IN PVOID InputBuffer OPTIONAL
,
825 IN ULONG InputBufferLength
,
826 OUT PVOID OutputBuffer OPTIONAL
,
827 IN ULONG OutputBufferLength
);
833 IN HANDLE FileHandle
,
834 IN HANDLE Event OPTIONAL
,
835 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
836 IN PVOID ApcContext OPTIONAL
,
837 OUT PIO_STATUS_BLOCK IoStatusBlock
,
838 IN PLARGE_INTEGER ByteOffset
,
839 IN PLARGE_INTEGER Length
,
841 IN BOOLEAN FailImmediately
,
842 IN BOOLEAN ExclusiveLock
);
848 OUT PHANDLE FileHandle
,
849 IN ACCESS_MASK DesiredAccess
,
850 IN POBJECT_ATTRIBUTES ObjectAttributes
,
851 OUT PIO_STATUS_BLOCK IoStatusBlock
,
852 IN ULONG ShareAccess
,
853 IN ULONG OpenOptions
);
858 NtQueryDirectoryFile(
859 IN HANDLE FileHandle
,
860 IN HANDLE Event OPTIONAL
,
861 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
862 IN PVOID ApcContext OPTIONAL
,
863 OUT PIO_STATUS_BLOCK IoStatusBlock
,
864 OUT PVOID FileInformation
,
866 IN FILE_INFORMATION_CLASS FileInformationClass
,
867 IN BOOLEAN ReturnSingleEntry
,
868 IN PUNICODE_STRING FileName OPTIONAL
,
869 IN BOOLEAN RestartScan
);
874 NtQueryInformationFile(
875 IN HANDLE FileHandle
,
876 OUT PIO_STATUS_BLOCK IoStatusBlock
,
877 OUT PVOID FileInformation
,
879 IN FILE_INFORMATION_CLASS FileInformationClass
);
884 NtQueryQuotaInformationFile(
885 IN HANDLE FileHandle
,
886 OUT PIO_STATUS_BLOCK IoStatusBlock
,
889 IN BOOLEAN ReturnSingleEntry
,
891 IN ULONG SidListLength
,
892 IN PSID StartSid OPTIONAL
,
893 IN BOOLEAN RestartScan
);
898 NtQueryVolumeInformationFile(
899 IN HANDLE FileHandle
,
900 OUT PIO_STATUS_BLOCK IoStatusBlock
,
901 OUT PVOID FsInformation
,
903 IN FS_INFORMATION_CLASS FsInformationClass
);
909 IN HANDLE FileHandle
,
910 IN HANDLE Event OPTIONAL
,
911 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
912 IN PVOID ApcContext OPTIONAL
,
913 OUT PIO_STATUS_BLOCK IoStatusBlock
,
916 IN PLARGE_INTEGER ByteOffset OPTIONAL
,
917 IN PULONG Key OPTIONAL
);
922 NtSetInformationFile(
923 IN HANDLE FileHandle
,
924 OUT PIO_STATUS_BLOCK IoStatusBlock
,
925 IN PVOID FileInformation
,
927 IN FILE_INFORMATION_CLASS FileInformationClass
);
932 NtSetQuotaInformationFile(
933 IN HANDLE FileHandle
,
934 OUT PIO_STATUS_BLOCK IoStatusBlock
,
941 NtSetVolumeInformationFile(
942 IN HANDLE FileHandle
,
943 OUT PIO_STATUS_BLOCK IoStatusBlock
,
944 IN PVOID FsInformation
,
946 IN FS_INFORMATION_CLASS FsInformationClass
);
952 IN HANDLE FileHandle
,
953 IN HANDLE Event OPTIONAL
,
954 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
955 IN PVOID ApcContext OPTIONAL
,
956 OUT PIO_STATUS_BLOCK IoStatusBlock
,
959 IN PLARGE_INTEGER ByteOffset OPTIONAL
,
960 IN PULONG Key OPTIONAL
);
966 IN HANDLE FileHandle
,
967 OUT PIO_STATUS_BLOCK IoStatusBlock
,
968 IN PLARGE_INTEGER ByteOffset
,
969 IN PLARGE_INTEGER Length
,
974 #if (NTDDI_VERSION >= NTDDI_WINXP)
980 IN HANDLE ThreadHandle
,
981 IN ACCESS_MASK DesiredAccess
,
982 IN BOOLEAN OpenAsSelf
,
983 IN ULONG HandleAttributes
,
984 OUT PHANDLE TokenHandle
);
989 NtOpenProcessTokenEx(
990 IN HANDLE ProcessHandle
,
991 IN ACCESS_MASK DesiredAccess
,
992 IN ULONG HandleAttributes
,
993 OUT PHANDLE TokenHandle
);
998 NtOpenJobObjectToken(
1000 IN ACCESS_MASK DesiredAccess
,
1001 OUT PHANDLE TokenHandle
);
1007 IN HANDLE ExistingTokenHandle
,
1008 IN ACCESS_MASK DesiredAccess
,
1009 IN POBJECT_ATTRIBUTES ObjectAttributes
,
1010 IN BOOLEAN EffectiveOnly
,
1011 IN TOKEN_TYPE TokenType
,
1012 OUT PHANDLE NewTokenHandle
);
1018 IN HANDLE ExistingTokenHandle
,
1020 IN PTOKEN_GROUPS SidsToDisable OPTIONAL
,
1021 IN PTOKEN_PRIVILEGES PrivilegesToDelete OPTIONAL
,
1022 IN PTOKEN_GROUPS RestrictedSids OPTIONAL
,
1023 OUT PHANDLE NewTokenHandle
);
1028 NtImpersonateAnonymousToken(
1029 IN HANDLE ThreadHandle
);
1034 NtSetInformationToken(
1035 IN HANDLE TokenHandle
,
1036 IN TOKEN_INFORMATION_CLASS TokenInformationClass
,
1037 IN PVOID TokenInformation
,
1038 IN ULONG TokenInformationLength
);
1043 NtAdjustGroupsToken(
1044 IN HANDLE TokenHandle
,
1045 IN BOOLEAN ResetToDefault
,
1046 IN PTOKEN_GROUPS NewState OPTIONAL
,
1047 IN ULONG BufferLength OPTIONAL
,
1048 OUT PTOKEN_GROUPS PreviousState
,
1049 OUT PULONG ReturnLength
);
1055 IN HANDLE ClientToken
,
1056 IN OUT PPRIVILEGE_SET RequiredPrivileges
,
1057 OUT PBOOLEAN Result
);
1062 NtAccessCheckAndAuditAlarm(
1063 IN PUNICODE_STRING SubsystemName
,
1064 IN PVOID HandleId OPTIONAL
,
1065 IN PUNICODE_STRING ObjectTypeName
,
1066 IN PUNICODE_STRING ObjectName
,
1067 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
1068 IN ACCESS_MASK DesiredAccess
,
1069 IN PGENERIC_MAPPING GenericMapping
,
1070 IN BOOLEAN ObjectCreation
,
1071 OUT PACCESS_MASK GrantedAccess
,
1072 OUT PNTSTATUS AccessStatus
,
1073 OUT PBOOLEAN GenerateOnClose
);
1078 NtAccessCheckByTypeAndAuditAlarm(
1079 IN PUNICODE_STRING SubsystemName
,
1081 IN PUNICODE_STRING ObjectTypeName
,
1082 IN PUNICODE_STRING ObjectName
,
1083 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
1084 IN PSID PrincipalSelfSid OPTIONAL
,
1085 IN ACCESS_MASK DesiredAccess
,
1086 IN AUDIT_EVENT_TYPE AuditType
,
1088 IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL
,
1089 IN ULONG ObjectTypeLength
,
1090 IN PGENERIC_MAPPING GenericMapping
,
1091 IN BOOLEAN ObjectCreation
,
1092 OUT PACCESS_MASK GrantedAccess
,
1093 OUT PNTSTATUS AccessStatus
,
1094 OUT PBOOLEAN GenerateOnClose
);
1099 NtAccessCheckByTypeResultListAndAuditAlarm(
1100 IN PUNICODE_STRING SubsystemName
,
1101 IN PVOID HandleId OPTIONAL
,
1102 IN PUNICODE_STRING ObjectTypeName
,
1103 IN PUNICODE_STRING ObjectName
,
1104 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
1105 IN PSID PrincipalSelfSid OPTIONAL
,
1106 IN ACCESS_MASK DesiredAccess
,
1107 IN AUDIT_EVENT_TYPE AuditType
,
1109 IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL
,
1110 IN ULONG ObjectTypeLength
,
1111 IN PGENERIC_MAPPING GenericMapping
,
1112 IN BOOLEAN ObjectCreation
,
1113 OUT PACCESS_MASK GrantedAccess
,
1114 OUT PNTSTATUS AccessStatus
,
1115 OUT PBOOLEAN GenerateOnClose
);
1119 NtAccessCheckByTypeResultListAndAuditAlarmByHandle(
1120 IN PUNICODE_STRING SubsystemName
,
1121 IN PVOID HandleId OPTIONAL
,
1122 IN HANDLE ClientToken
,
1123 IN PUNICODE_STRING ObjectTypeName
,
1124 IN PUNICODE_STRING ObjectName
,
1125 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
1126 IN PSID PrincipalSelfSid OPTIONAL
,
1127 IN ACCESS_MASK DesiredAccess
,
1128 IN AUDIT_EVENT_TYPE AuditType
,
1130 IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL
,
1131 IN ULONG ObjectTypeLength
,
1132 IN PGENERIC_MAPPING GenericMapping
,
1133 IN BOOLEAN ObjectCreation
,
1134 OUT PACCESS_MASK GrantedAccess
,
1135 OUT PNTSTATUS AccessStatus
,
1136 OUT PBOOLEAN GenerateOnClose
);
1141 NtOpenObjectAuditAlarm(
1142 IN PUNICODE_STRING SubsystemName
,
1143 IN PVOID HandleId OPTIONAL
,
1144 IN PUNICODE_STRING ObjectTypeName
,
1145 IN PUNICODE_STRING ObjectName
,
1146 IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL
,
1147 IN HANDLE ClientToken
,
1148 IN ACCESS_MASK DesiredAccess
,
1149 IN ACCESS_MASK GrantedAccess
,
1150 IN PPRIVILEGE_SET Privileges OPTIONAL
,
1151 IN BOOLEAN ObjectCreation
,
1152 IN BOOLEAN AccessGranted
,
1153 OUT PBOOLEAN GenerateOnClose
);
1158 NtPrivilegeObjectAuditAlarm(
1159 IN PUNICODE_STRING SubsystemName
,
1160 IN PVOID HandleId OPTIONAL
,
1161 IN HANDLE ClientToken
,
1162 IN ACCESS_MASK DesiredAccess
,
1163 IN PPRIVILEGE_SET Privileges
,
1164 IN BOOLEAN AccessGranted
);
1169 NtCloseObjectAuditAlarm(
1170 IN PUNICODE_STRING SubsystemName
,
1171 IN PVOID HandleId OPTIONAL
,
1172 IN BOOLEAN GenerateOnClose
);
1177 NtDeleteObjectAuditAlarm(
1178 IN PUNICODE_STRING SubsystemName
,
1179 IN PVOID HandleId OPTIONAL
,
1180 IN BOOLEAN GenerateOnClose
);
1185 NtPrivilegedServiceAuditAlarm(
1186 IN PUNICODE_STRING SubsystemName
,
1187 IN PUNICODE_STRING ServiceName
,
1188 IN HANDLE ClientToken
,
1189 IN PPRIVILEGE_SET Privileges
,
1190 IN BOOLEAN AccessGranted
);
1195 NtSetInformationThread(
1196 IN HANDLE ThreadHandle
,
1197 IN THREADINFOCLASS ThreadInformationClass
,
1198 IN PVOID ThreadInformation
,
1199 IN ULONG ThreadInformationLength
);
1204 (NTAPI
* PRTL_HEAP_COMMIT_ROUTINE
) (
1206 IN OUT PVOID
*CommitAddress
,
1207 IN OUT PSIZE_T CommitSize
);
1209 typedef struct _RTL_HEAP_PARAMETERS
{
1211 SIZE_T SegmentReserve
;
1212 SIZE_T SegmentCommit
;
1213 SIZE_T DeCommitFreeBlockThreshold
;
1214 SIZE_T DeCommitTotalFreeThreshold
;
1215 SIZE_T MaximumAllocationSize
;
1216 SIZE_T VirtualMemoryThreshold
;
1217 SIZE_T InitialCommit
;
1218 SIZE_T InitialReserve
;
1219 PRTL_HEAP_COMMIT_ROUTINE CommitRoutine
;
1221 } RTL_HEAP_PARAMETERS
, *PRTL_HEAP_PARAMETERS
;
1223 #if (NTDDI_VERSION >= NTDDI_WIN2K)
1229 IN HANDLE HeapHandle
,
1230 IN ULONG Flags OPTIONAL
,
1237 IN PVOID HeapHandle
,
1238 IN ULONG Flags OPTIONAL
,
1239 IN PVOID BaseAddress
);
1245 OUT PCONTEXT ContextRecord
);
1251 IN OUT PULONG Seed
);
1256 RtlCreateUnicodeString(
1257 OUT PUNICODE_STRING DestinationString
,
1258 IN PCWSTR SourceString
);
1263 RtlAppendStringToString(
1264 IN OUT PSTRING Destination
,
1265 IN
const STRING
*Source
);
1270 RtlOemStringToUnicodeString(
1271 IN OUT PUNICODE_STRING DestinationString
,
1272 IN PCOEM_STRING SourceString
,
1273 IN BOOLEAN AllocateDestinationString
);
1278 RtlUnicodeStringToOemString(
1279 IN OUT POEM_STRING DestinationString
,
1280 IN PCUNICODE_STRING SourceString
,
1281 IN BOOLEAN AllocateDestinationString
);
1286 RtlUpcaseUnicodeStringToOemString(
1287 IN OUT POEM_STRING DestinationString
,
1288 IN PCUNICODE_STRING SourceString
,
1289 IN BOOLEAN AllocateDestinationString
);
1294 RtlOemStringToCountedUnicodeString(
1295 IN OUT PUNICODE_STRING DestinationString
,
1296 IN PCOEM_STRING SourceString
,
1297 IN BOOLEAN AllocateDestinationString
);
1302 RtlUnicodeStringToCountedOemString(
1303 IN OUT POEM_STRING DestinationString
,
1304 IN PCUNICODE_STRING SourceString
,
1305 IN BOOLEAN AllocateDestinationString
);
1310 RtlUpcaseUnicodeStringToCountedOemString(
1311 IN OUT POEM_STRING DestinationString
,
1312 IN PCUNICODE_STRING SourceString
,
1313 IN BOOLEAN AllocateDestinationString
);
1318 RtlDowncaseUnicodeString(
1319 IN OUT PUNICODE_STRING UniDest
,
1320 IN PCUNICODE_STRING UniSource
,
1321 IN BOOLEAN AllocateDestinationString
);
1327 IN OUT POEM_STRING OemString
);
1332 RtlxUnicodeStringToOemSize(
1333 IN PCUNICODE_STRING UnicodeString
);
1338 RtlxOemStringToUnicodeSize(
1339 IN PCOEM_STRING OemString
);
1344 RtlMultiByteToUnicodeN(
1345 OUT PWCH UnicodeString
,
1346 IN ULONG MaxBytesInUnicodeString
,
1347 OUT PULONG BytesInUnicodeString OPTIONAL
,
1348 IN
const CHAR
*MultiByteString
,
1349 IN ULONG BytesInMultiByteString
);
1354 RtlMultiByteToUnicodeSize(
1355 OUT PULONG BytesInUnicodeString
,
1356 IN
const CHAR
*MultiByteString
,
1357 IN ULONG BytesInMultiByteString
);
1362 RtlUnicodeToMultiByteSize(
1363 OUT PULONG BytesInMultiByteString
,
1364 IN PCWCH UnicodeString
,
1365 IN ULONG BytesInUnicodeString
);
1370 RtlUnicodeToMultiByteN(
1371 OUT PCHAR MultiByteString
,
1372 IN ULONG MaxBytesInMultiByteString
,
1373 OUT PULONG BytesInMultiByteString OPTIONAL
,
1374 IN PWCH UnicodeString
,
1375 IN ULONG BytesInUnicodeString
);
1380 RtlUpcaseUnicodeToMultiByteN(
1381 OUT PCHAR MultiByteString
,
1382 IN ULONG MaxBytesInMultiByteString
,
1383 OUT PULONG BytesInMultiByteString OPTIONAL
,
1384 IN PCWCH UnicodeString
,
1385 IN ULONG BytesInUnicodeString
);
1391 OUT PWSTR UnicodeString
,
1392 IN ULONG MaxBytesInUnicodeString
,
1393 OUT PULONG BytesInUnicodeString OPTIONAL
,
1395 IN ULONG BytesInOemString
);
1401 OUT PCHAR OemString
,
1402 IN ULONG MaxBytesInOemString
,
1403 OUT PULONG BytesInOemString OPTIONAL
,
1404 IN PCWCH UnicodeString
,
1405 IN ULONG BytesInUnicodeString
);
1410 RtlUpcaseUnicodeToOemN(
1411 OUT PCHAR OemString
,
1412 IN ULONG MaxBytesInOemString
,
1413 OUT PULONG BytesInOemString OPTIONAL
,
1414 IN PCWCH UnicodeString
,
1415 IN ULONG BytesInUnicodeString
);
1417 #if (NTDDI_VERSION >= NTDDI_VISTASP1)
1421 RtlGenerate8dot3Name(
1422 IN PCUNICODE_STRING Name
,
1423 IN BOOLEAN AllowExtendedCharacters
,
1424 IN OUT PGENERATE_NAME_CONTEXT Context
,
1425 IN OUT PUNICODE_STRING Name8dot3
);
1430 RtlGenerate8dot3Name(
1431 IN PCUNICODE_STRING Name
,
1432 IN BOOLEAN AllowExtendedCharacters
,
1433 IN OUT PGENERATE_NAME_CONTEXT Context
,
1434 IN OUT PUNICODE_STRING Name8dot3
);
1440 RtlIsNameLegalDOS8Dot3(
1441 IN PCUNICODE_STRING Name
,
1442 IN OUT POEM_STRING OemName OPTIONAL
,
1443 IN OUT PBOOLEAN NameContainsSpaces OPTIONAL
);
1448 RtlIsValidOemCharacter(
1449 IN OUT PWCHAR Char
);
1455 OUT PPREFIX_TABLE PrefixTable
);
1461 IN PPREFIX_TABLE PrefixTable
,
1463 OUT PPREFIX_TABLE_ENTRY PrefixTableEntry
);
1469 IN PPREFIX_TABLE PrefixTable
,
1470 IN PPREFIX_TABLE_ENTRY PrefixTableEntry
);
1476 IN PPREFIX_TABLE PrefixTable
,
1477 IN PSTRING FullName
);
1482 RtlInitializeUnicodePrefix(
1483 OUT PUNICODE_PREFIX_TABLE PrefixTable
);
1488 RtlInsertUnicodePrefix(
1489 IN PUNICODE_PREFIX_TABLE PrefixTable
,
1490 IN PUNICODE_STRING Prefix
,
1491 OUT PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry
);
1496 RtlRemoveUnicodePrefix(
1497 IN PUNICODE_PREFIX_TABLE PrefixTable
,
1498 IN PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry
);
1501 PUNICODE_PREFIX_TABLE_ENTRY
1503 RtlFindUnicodePrefix(
1504 IN PUNICODE_PREFIX_TABLE PrefixTable
,
1505 IN PUNICODE_STRING FullName
,
1506 IN ULONG CaseInsensitiveIndex
);
1509 PUNICODE_PREFIX_TABLE_ENTRY
1511 RtlNextUnicodePrefix(
1512 IN PUNICODE_PREFIX_TABLE PrefixTable
,
1513 IN BOOLEAN Restart
);
1518 RtlCompareMemoryUlong(
1526 RtlTimeToSecondsSince1980(
1527 IN PLARGE_INTEGER Time
,
1528 OUT PULONG ElapsedSeconds
);
1533 RtlSecondsSince1980ToTime(
1534 IN ULONG ElapsedSeconds
,
1535 OUT PLARGE_INTEGER Time
);
1540 RtlTimeToSecondsSince1970(
1541 IN PLARGE_INTEGER Time
,
1542 OUT PULONG ElapsedSeconds
);
1547 RtlSecondsSince1970ToTime(
1548 IN ULONG ElapsedSeconds
,
1549 OUT PLARGE_INTEGER Time
);
1574 RtlLengthRequiredSid(
1575 IN ULONG SubAuthorityCount
);
1586 RtlAllocateAndInitializeSid(
1587 IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority
,
1588 IN UCHAR SubAuthorityCount
,
1589 IN ULONG SubAuthority0
,
1590 IN ULONG SubAuthority1
,
1591 IN ULONG SubAuthority2
,
1592 IN ULONG SubAuthority3
,
1593 IN ULONG SubAuthority4
,
1594 IN ULONG SubAuthority5
,
1595 IN ULONG SubAuthority6
,
1596 IN ULONG SubAuthority7
,
1604 IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority
,
1605 IN UCHAR SubAuthorityCount
);
1612 IN ULONG SubAuthority
);
1625 IN PSID Destination
,
1631 RtlConvertSidToUnicodeString(
1632 IN OUT PUNICODE_STRING UnicodeString
,
1634 IN BOOLEAN AllocateDestinationString
);
1640 OUT PLUID DestinationLuid
,
1641 IN PLUID SourceLuid
);
1649 IN ULONG AclRevision
);
1656 IN ULONG AceRevision
,
1657 IN ULONG StartingAceIndex
,
1659 IN ULONG AceListLength
);
1679 RtlAddAccessAllowedAce(
1681 IN ULONG AceRevision
,
1682 IN ACCESS_MASK AccessMask
,
1688 RtlAddAccessAllowedAceEx(
1690 IN ULONG AceRevision
,
1692 IN ACCESS_MASK AccessMask
,
1698 RtlCreateSecurityDescriptorRelative(
1699 OUT PISECURITY_DESCRIPTOR_RELATIVE SecurityDescriptor
,
1705 RtlGetDaclSecurityDescriptor(
1706 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
1707 OUT PBOOLEAN DaclPresent
,
1709 OUT PBOOLEAN DaclDefaulted
);
1714 RtlSetOwnerSecurityDescriptor(
1715 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
1716 IN PSID Owner OPTIONAL
,
1717 IN BOOLEAN OwnerDefaulted
);
1722 RtlGetOwnerSecurityDescriptor(
1723 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
1725 OUT PBOOLEAN OwnerDefaulted
);
1730 RtlNtStatusToDosError(
1731 IN NTSTATUS Status
);
1736 RtlCustomCPToUnicodeN(
1737 IN PCPTABLEINFO CustomCP
,
1738 OUT PWCH UnicodeString
,
1739 IN ULONG MaxBytesInUnicodeString
,
1740 OUT PULONG BytesInUnicodeString OPTIONAL
,
1741 IN PCH CustomCPString
,
1742 IN ULONG BytesInCustomCPString
);
1747 RtlUnicodeToCustomCPN(
1748 IN PCPTABLEINFO CustomCP
,
1749 OUT PCH CustomCPString
,
1750 IN ULONG MaxBytesInCustomCPString
,
1751 OUT PULONG BytesInCustomCPString OPTIONAL
,
1752 IN PWCH UnicodeString
,
1753 IN ULONG BytesInUnicodeString
);
1758 RtlUpcaseUnicodeToCustomCPN(
1759 IN PCPTABLEINFO CustomCP
,
1760 OUT PCH CustomCPString
,
1761 IN ULONG MaxBytesInCustomCPString
,
1762 OUT PULONG BytesInCustomCPString OPTIONAL
,
1763 IN PWCH UnicodeString
,
1764 IN ULONG BytesInUnicodeString
);
1769 RtlInitCodePageTable(
1770 IN PUSHORT TableBase
,
1771 IN OUT PCPTABLEINFO CodePageTable
);
1775 #if (NTDDI_VERSION >= NTDDI_WINXP)
1782 IN PVOID HeapBase OPTIONAL
,
1783 IN SIZE_T ReserveSize OPTIONAL
,
1784 IN SIZE_T CommitSize OPTIONAL
,
1785 IN PVOID Lock OPTIONAL
,
1786 IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL
);
1792 IN PVOID HeapHandle
);
1797 RtlCaptureStackBackTrace(
1798 IN ULONG FramesToSkip
,
1799 IN ULONG FramesToCapture
,
1800 OUT PVOID
*BackTrace
,
1801 OUT PULONG BackTraceHash OPTIONAL
);
1807 IN OUT PULONG Seed
);
1812 RtlInitUnicodeStringEx(
1813 OUT PUNICODE_STRING DestinationString
,
1814 IN PCWSTR SourceString OPTIONAL
);
1819 RtlValidateUnicodeString(
1821 IN PCUNICODE_STRING String
);
1826 RtlDuplicateUnicodeString(
1828 IN PCUNICODE_STRING SourceString
,
1829 OUT PUNICODE_STRING DestinationString
);
1834 RtlGetCompressionWorkSpaceSize(
1835 IN USHORT CompressionFormatAndEngine
,
1836 OUT PULONG CompressBufferWorkSpaceSize
,
1837 OUT PULONG CompressFragmentWorkSpaceSize
);
1843 IN USHORT CompressionFormatAndEngine
,
1844 IN PUCHAR UncompressedBuffer
,
1845 IN ULONG UncompressedBufferSize
,
1846 OUT PUCHAR CompressedBuffer
,
1847 IN ULONG CompressedBufferSize
,
1848 IN ULONG UncompressedChunkSize
,
1849 OUT PULONG FinalCompressedSize
,
1850 IN PVOID WorkSpace
);
1855 RtlDecompressBuffer(
1856 IN USHORT CompressionFormat
,
1857 OUT PUCHAR UncompressedBuffer
,
1858 IN ULONG UncompressedBufferSize
,
1859 IN PUCHAR CompressedBuffer
,
1860 IN ULONG CompressedBufferSize
,
1861 OUT PULONG FinalUncompressedSize
);
1866 RtlDecompressFragment(
1867 IN USHORT CompressionFormat
,
1868 OUT PUCHAR UncompressedFragment
,
1869 IN ULONG UncompressedFragmentSize
,
1870 IN PUCHAR CompressedBuffer
,
1871 IN ULONG CompressedBufferSize
,
1872 IN ULONG FragmentOffset
,
1873 OUT PULONG FinalUncompressedSize
,
1874 IN PVOID WorkSpace
);
1880 IN USHORT CompressionFormat
,
1881 IN OUT PUCHAR
*CompressedBuffer
,
1882 IN PUCHAR EndOfCompressedBufferPlus1
,
1883 OUT PUCHAR
*ChunkBuffer
,
1884 OUT PULONG ChunkSize
);
1890 IN USHORT CompressionFormat
,
1891 IN OUT PUCHAR
*CompressedBuffer
,
1892 IN PUCHAR EndOfCompressedBufferPlus1
,
1893 OUT PUCHAR
*ChunkBuffer
,
1894 IN ULONG ChunkSize
);
1899 RtlDecompressChunks(
1900 OUT PUCHAR UncompressedBuffer
,
1901 IN ULONG UncompressedBufferSize
,
1902 IN PUCHAR CompressedBuffer
,
1903 IN ULONG CompressedBufferSize
,
1904 IN PUCHAR CompressedTail
,
1905 IN ULONG CompressedTailSize
,
1906 IN PCOMPRESSED_DATA_INFO CompressedDataInfo
);
1912 IN PUCHAR UncompressedBuffer
,
1913 IN ULONG UncompressedBufferSize
,
1914 OUT PUCHAR CompressedBuffer
,
1915 IN ULONG CompressedBufferSize
,
1916 IN OUT PCOMPRESSED_DATA_INFO CompressedDataInfo
,
1917 IN ULONG CompressedDataInfoLength
,
1918 IN PVOID WorkSpace
);
1921 PSID_IDENTIFIER_AUTHORITY
1923 RtlIdentifierAuthoritySid(
1929 RtlSubAuthorityCountSid(
1935 RtlNtStatusToDosErrorNoTeb(
1936 IN NTSTATUS Status
);
1941 RtlCreateSystemVolumeInformationFolder(
1942 IN PCUNICODE_STRING VolumeRootPath
);
1946 #if defined(_M_AMD64)
1950 RtlFillMemoryUlong (
1951 OUT PVOID Destination
,
1955 PULONG Address
= (PULONG
)Destination
;
1956 if ((Length
/= 4) != 0) {
1957 if (((ULONG64
)Address
& 4) != 0) {
1959 if ((Length
-= 1) == 0) {
1964 __stosq((PULONG64
)(Address
), Pattern
| ((ULONG64
)Pattern
<< 32), Length
/ 2);
1965 if ((Length
& 1) != 0) Address
[Length
- 1] = Pattern
;
1970 #define RtlFillMemoryUlonglong(Destination, Length, Pattern) \
1971 __stosq((PULONG64)(Destination), Pattern, (Length) / 8)
1975 #if (NTDDI_VERSION >= NTDDI_WINXP)
1981 OUT PVOID Destination
,
1988 RtlFillMemoryUlonglong(
1989 OUT PVOID Destination
,
1991 IN ULONGLONG Pattern
);
1995 #endif // defined(_M_AMD64)
1997 #if (NTDDI_VERSION >= NTDDI_WS03)
2002 RtlInitAnsiStringEx(
2003 OUT PANSI_STRING DestinationString
,
2004 IN PCSZ SourceString OPTIONAL
);
2008 #if (NTDDI_VERSION >= NTDDI_WS03SP1)
2013 RtlGetSaclSecurityDescriptor(
2014 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
2015 OUT PBOOLEAN SaclPresent
,
2017 OUT PBOOLEAN SaclDefaulted
);
2022 RtlSetGroupSecurityDescriptor(
2023 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
2024 IN PSID Group OPTIONAL
,
2025 IN BOOLEAN GroupDefaulted OPTIONAL
);
2030 RtlGetGroupSecurityDescriptor(
2031 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
2033 OUT PBOOLEAN GroupDefaulted
);
2038 RtlAbsoluteToSelfRelativeSD(
2039 IN PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor
,
2040 OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor OPTIONAL
,
2041 IN OUT PULONG BufferLength
);
2046 RtlSelfRelativeToAbsoluteSD(
2047 IN PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor
,
2048 OUT PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor OPTIONAL
,
2049 IN OUT PULONG AbsoluteSecurityDescriptorSize
,
2050 OUT PACL Dacl OPTIONAL
,
2051 IN OUT PULONG DaclSize
,
2052 OUT PACL Sacl OPTIONAL
,
2053 IN OUT PULONG SaclSize
,
2054 OUT PSID Owner OPTIONAL
,
2055 IN OUT PULONG OwnerSize
,
2056 OUT PSID PrimaryGroup OPTIONAL
,
2057 IN OUT PULONG PrimaryGroupSize
);
2061 #if (NTDDI_VERSION >= NTDDI_VISTA)
2068 IN PCWSTR SourceString
,
2069 IN LONG SourceStringLength
,
2070 OUT PWSTR DestinationString
,
2071 IN OUT PLONG DestinationStringLength
);
2076 RtlIsNormalizedString(
2078 IN PCWSTR SourceString
,
2079 IN LONG SourceStringLength
,
2080 OUT PBOOLEAN Normalized
);
2087 IN PCWSTR SourceString
,
2088 IN LONG SourceStringLength
,
2089 OUT PWSTR DestinationString
,
2090 IN OUT PLONG DestinationStringLength
);
2097 IN PCWSTR SourceString
,
2098 IN LONG SourceStringLength
,
2099 OUT PWSTR DestinationString
,
2100 IN OUT PLONG DestinationStringLength
);
2105 RtlIdnToNameprepUnicode(
2107 IN PCWSTR SourceString
,
2108 IN LONG SourceStringLength
,
2109 OUT PWSTR DestinationString
,
2110 IN OUT PLONG DestinationStringLength
);
2115 RtlCreateServiceSid(
2116 IN PUNICODE_STRING ServiceName
,
2117 OUT PSID ServiceSid
,
2118 IN OUT PULONG ServiceSidLength
);
2123 RtlCompareAltitudes(
2124 IN PCUNICODE_STRING Altitude1
,
2125 IN PCUNICODE_STRING Altitude2
);
2129 #if (NTDDI_VERSION >= NTDDI_WIN7)
2135 OUT PCHAR UTF8StringDestination
,
2136 IN ULONG UTF8StringMaxByteCount
,
2137 OUT PULONG UTF8StringActualByteCount
,
2138 IN PCWCH UnicodeStringSource
,
2139 IN ULONG UnicodeStringByteCount
);
2145 OUT PWSTR UnicodeStringDestination
,
2146 IN ULONG UnicodeStringMaxByteCount
,
2147 OUT PULONG UnicodeStringActualByteCount
,
2148 IN PCCH UTF8StringSource
,
2149 IN ULONG UTF8StringByteCount
);
2155 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
2158 OUT ULONG
*NumChanges
);
2163 RtlCreateVirtualAccountSid(
2164 IN PCUNICODE_STRING Name
,
2165 IN ULONG BaseSubAuthority
,
2167 IN OUT PULONG SidLength
);
2171 #define HEAP_NO_SERIALIZE 0x00000001
2172 #define HEAP_GROWABLE 0x00000002
2173 #define HEAP_GENERATE_EXCEPTIONS 0x00000004
2174 #define HEAP_ZERO_MEMORY 0x00000008
2175 #define HEAP_REALLOC_IN_PLACE_ONLY 0x00000010
2176 #define HEAP_TAIL_CHECKING_ENABLED 0x00000020
2177 #define HEAP_FREE_CHECKING_ENABLED 0x00000040
2178 #define HEAP_DISABLE_COALESCE_ON_FREE 0x00000080
2180 #define HEAP_CREATE_ALIGN_16 0x00010000
2181 #define HEAP_CREATE_ENABLE_TRACING 0x00020000
2182 #define HEAP_CREATE_ENABLE_EXECUTE 0x00040000
2184 #define HEAP_SETTABLE_USER_VALUE 0x00000100
2185 #define HEAP_SETTABLE_USER_FLAG1 0x00000200
2186 #define HEAP_SETTABLE_USER_FLAG2 0x00000400
2187 #define HEAP_SETTABLE_USER_FLAG3 0x00000800
2188 #define HEAP_SETTABLE_USER_FLAGS 0x00000E00
2190 #define HEAP_CLASS_0 0x00000000
2191 #define HEAP_CLASS_1 0x00001000
2192 #define HEAP_CLASS_2 0x00002000
2193 #define HEAP_CLASS_3 0x00003000
2194 #define HEAP_CLASS_4 0x00004000
2195 #define HEAP_CLASS_5 0x00005000
2196 #define HEAP_CLASS_6 0x00006000
2197 #define HEAP_CLASS_7 0x00007000
2198 #define HEAP_CLASS_8 0x00008000
2199 #define HEAP_CLASS_MASK 0x0000F000
2201 #define HEAP_MAXIMUM_TAG 0x0FFF
2202 #define HEAP_GLOBAL_TAG 0x0800
2203 #define HEAP_PSEUDO_TAG_FLAG 0x8000
2204 #define HEAP_TAG_SHIFT 18
2205 #define HEAP_TAG_MASK (HEAP_MAXIMUM_TAG << HEAP_TAG_SHIFT)
2207 #define HEAP_CREATE_VALID_MASK (HEAP_NO_SERIALIZE | \
2209 HEAP_GENERATE_EXCEPTIONS | \
2210 HEAP_ZERO_MEMORY | \
2211 HEAP_REALLOC_IN_PLACE_ONLY | \
2212 HEAP_TAIL_CHECKING_ENABLED | \
2213 HEAP_FREE_CHECKING_ENABLED | \
2214 HEAP_DISABLE_COALESCE_ON_FREE | \
2216 HEAP_CREATE_ALIGN_16 | \
2217 HEAP_CREATE_ENABLE_TRACING | \
2218 HEAP_CREATE_ENABLE_EXECUTE)
2222 HEAP_MAKE_TAG_FLAGS(
2226 __assume_bound(TagBase
);
2227 return ((ULONG
)((TagBase
) + ((Tag
) << HEAP_TAG_SHIFT
)));
2230 #define RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE 1
2231 #define RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING 2
2233 #define RtlUnicodeStringToOemSize(STRING) (NLS_MB_OEM_CODE_PAGE_TAG ? \
2234 RtlxUnicodeStringToOemSize(STRING) : \
2235 ((STRING)->Length + sizeof(UNICODE_NULL)) / sizeof(WCHAR) \
2238 #define RtlOemStringToUnicodeSize(STRING) ( \
2239 NLS_MB_OEM_CODE_PAGE_TAG ? \
2240 RtlxOemStringToUnicodeSize(STRING) : \
2241 ((STRING)->Length + sizeof(ANSI_NULL)) * sizeof(WCHAR) \
2244 #define RtlOemStringToCountedUnicodeSize(STRING) ( \
2245 (ULONG)(RtlOemStringToUnicodeSize(STRING) - sizeof(UNICODE_NULL)) \
2249 (NTAPI
*PRTL_ALLOCATE_STRING_ROUTINE (
2250 IN SIZE_T NumberOfBytes
);
2252 #if _WIN32_WINNT >= 0x0600
2255 (NTAPI
*PRTL_REALLOCATE_STRING_ROUTINE (
2256 IN SIZE_T NumberOfBytes
,
2262 (NTAPI
*PRTL_FREE_STRING_ROUTINE (
2265 extern const PRTL_ALLOCATE_STRING_ROUTINE RtlAllocateStringRoutine
;
2266 extern const PRTL_FREE_STRING_ROUTINE RtlFreeStringRoutine
;
2268 #if _WIN32_WINNT >= 0x0600
2269 extern const PRTL_REALLOCATE_STRING_ROUTINE RtlReallocateStringRoutine
;
2272 typedef struct _GENERATE_NAME_CONTEXT
{
2274 BOOLEAN CheckSumInserted
;
2276 WCHAR NameBuffer
[8];
2277 ULONG ExtensionLength
;
2278 WCHAR ExtensionBuffer
[4];
2279 ULONG LastIndexValue
;
2280 } GENERATE_NAME_CONTEXT
, *PGENERATE_NAME_CONTEXT
;
2282 typedef struct _PREFIX_TABLE_ENTRY
{
2283 CSHORT NodeTypeCode
;
2285 struct _PREFIX_TABLE_ENTRY
*NextPrefixTree
;
2286 RTL_SPLAY_LINKS Links
;
2288 } PREFIX_TABLE_ENTRY
, *PPREFIX_TABLE_ENTRY
;
2290 typedef struct _PREFIX_TABLE
{
2291 CSHORT NodeTypeCode
;
2293 PPREFIX_TABLE_ENTRY NextPrefixTree
;
2294 } PREFIX_TABLE
, *PPREFIX_TABLE
;
2296 typedef struct _UNICODE_PREFIX_TABLE_ENTRY
{
2297 CSHORT NodeTypeCode
;
2299 struct _UNICODE_PREFIX_TABLE_ENTRY
*NextPrefixTree
;
2300 struct _UNICODE_PREFIX_TABLE_ENTRY
*CaseMatch
;
2301 RTL_SPLAY_LINKS Links
;
2302 PUNICODE_STRING Prefix
;
2303 } UNICODE_PREFIX_TABLE_ENTRY
, *PUNICODE_PREFIX_TABLE_ENTRY
;
2305 typedef struct _UNICODE_PREFIX_TABLE
{
2306 CSHORT NodeTypeCode
;
2308 PUNICODE_PREFIX_TABLE_ENTRY NextPrefixTree
;
2309 PUNICODE_PREFIX_TABLE_ENTRY LastNextEntry
;
2310 } UNICODE_PREFIX_TABLE
, *PUNICODE_PREFIX_TABLE
;
2312 #define COMPRESSION_FORMAT_NONE (0x0000)
2313 #define COMPRESSION_FORMAT_DEFAULT (0x0001)
2314 #define COMPRESSION_FORMAT_LZNT1 (0x0002)
2315 #define COMPRESSION_ENGINE_STANDARD (0x0000)
2316 #define COMPRESSION_ENGINE_MAXIMUM (0x0100)
2317 #define COMPRESSION_ENGINE_HIBER (0x0200)
2319 typedef struct _COMPRESSED_DATA_INFO
{
2320 USHORT CompressionFormatAndEngine
;
2321 UCHAR CompressionUnitShift
;
2325 USHORT NumberOfChunks
;
2326 ULONG CompressedChunkSizes
[ANYSIZE_ARRAY
];
2327 } COMPRESSED_DATA_INFO
, *PCOMPRESSED_DATA_INFO
;
2329 #define RtlOffsetToPointer(B,O) ((PCHAR)( ((PCHAR)(B)) + ((ULONG_PTR)(O)) ))
2330 #define RtlPointerToOffset(B,P) ((ULONG)( ((PCHAR)(P)) - ((PCHAR)(B)) ))
2332 #define MAX_UNICODE_STACK_BUFFER_LENGTH 256
2334 #define RTL_SYSTEM_VOLUME_INFORMATION_FOLDER L"System Volume Information"
2336 #define DEVICE_TYPE ULONG
2338 #define FILE_DEVICE_BEEP 0x00000001
2339 #define FILE_DEVICE_CD_ROM 0x00000002
2340 #define FILE_DEVICE_CD_ROM_FILE_SYSTEM 0x00000003
2341 #define FILE_DEVICE_CONTROLLER 0x00000004
2342 #define FILE_DEVICE_DATALINK 0x00000005
2343 #define FILE_DEVICE_DFS 0x00000006
2344 #define FILE_DEVICE_DISK 0x00000007
2345 #define FILE_DEVICE_DISK_FILE_SYSTEM 0x00000008
2346 #define FILE_DEVICE_FILE_SYSTEM 0x00000009
2347 #define FILE_DEVICE_INPORT_PORT 0x0000000a
2348 #define FILE_DEVICE_KEYBOARD 0x0000000b
2349 #define FILE_DEVICE_MAILSLOT 0x0000000c
2350 #define FILE_DEVICE_MIDI_IN 0x0000000d
2351 #define FILE_DEVICE_MIDI_OUT 0x0000000e
2352 #define FILE_DEVICE_MOUSE 0x0000000f
2353 #define FILE_DEVICE_MULTI_UNC_PROVIDER 0x00000010
2354 #define FILE_DEVICE_NAMED_PIPE 0x00000011
2355 #define FILE_DEVICE_NETWORK 0x00000012
2356 #define FILE_DEVICE_NETWORK_BROWSER 0x00000013
2357 #define FILE_DEVICE_NETWORK_FILE_SYSTEM 0x00000014
2358 #define FILE_DEVICE_NULL 0x00000015
2359 #define FILE_DEVICE_PARALLEL_PORT 0x00000016
2360 #define FILE_DEVICE_PHYSICAL_NETCARD 0x00000017
2361 #define FILE_DEVICE_PRINTER 0x00000018
2362 #define FILE_DEVICE_SCANNER 0x00000019
2363 #define FILE_DEVICE_SERIAL_MOUSE_PORT 0x0000001a
2364 #define FILE_DEVICE_SERIAL_PORT 0x0000001b
2365 #define FILE_DEVICE_SCREEN 0x0000001c
2366 #define FILE_DEVICE_SOUND 0x0000001d
2367 #define FILE_DEVICE_STREAMS 0x0000001e
2368 #define FILE_DEVICE_TAPE 0x0000001f
2369 #define FILE_DEVICE_TAPE_FILE_SYSTEM 0x00000020
2370 #define FILE_DEVICE_TRANSPORT 0x00000021
2371 #define FILE_DEVICE_UNKNOWN 0x00000022
2372 #define FILE_DEVICE_VIDEO 0x00000023
2373 #define FILE_DEVICE_VIRTUAL_DISK 0x00000024
2374 #define FILE_DEVICE_WAVE_IN 0x00000025
2375 #define FILE_DEVICE_WAVE_OUT 0x00000026
2376 #define FILE_DEVICE_8042_PORT 0x00000027
2377 #define FILE_DEVICE_NETWORK_REDIRECTOR 0x00000028
2378 #define FILE_DEVICE_BATTERY 0x00000029
2379 #define FILE_DEVICE_BUS_EXTENDER 0x0000002a
2380 #define FILE_DEVICE_MODEM 0x0000002b
2381 #define FILE_DEVICE_VDM 0x0000002c
2382 #define FILE_DEVICE_MASS_STORAGE 0x0000002d
2383 #define FILE_DEVICE_SMB 0x0000002e
2384 #define FILE_DEVICE_KS 0x0000002f
2385 #define FILE_DEVICE_CHANGER 0x00000030
2386 #define FILE_DEVICE_SMARTCARD 0x00000031
2387 #define FILE_DEVICE_ACPI 0x00000032
2388 #define FILE_DEVICE_DVD 0x00000033
2389 #define FILE_DEVICE_FULLSCREEN_VIDEO 0x00000034
2390 #define FILE_DEVICE_DFS_FILE_SYSTEM 0x00000035
2391 #define FILE_DEVICE_DFS_VOLUME 0x00000036
2392 #define FILE_DEVICE_SERENUM 0x00000037
2393 #define FILE_DEVICE_TERMSRV 0x00000038
2394 #define FILE_DEVICE_KSEC 0x00000039
2395 #define FILE_DEVICE_FIPS 0x0000003A
2396 #define FILE_DEVICE_INFINIBAND 0x0000003B
2397 #define FILE_DEVICE_VMBUS 0x0000003E
2398 #define FILE_DEVICE_CRYPT_PROVIDER 0x0000003F
2399 #define FILE_DEVICE_WPD 0x00000040
2400 #define FILE_DEVICE_BLUETOOTH 0x00000041
2401 #define FILE_DEVICE_MT_COMPOSITE 0x00000042
2402 #define FILE_DEVICE_MT_TRANSPORT 0x00000043
2403 #define FILE_DEVICE_BIOMETRIC 0x00000044
2404 #define FILE_DEVICE_PMI 0x00000045
2406 #define CTL_CODE( DeviceType, Function, Method, Access ) ( \
2407 ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
2409 #define DEVICE_TYPE_FROM_CTL_CODE(ctrlCode) (((ULONG)(ctrlCode & 0xffff0000)) >> 16)
2410 #define METHOD_FROM_CTL_CODE(ctrlCode) ((ULONG)(ctrlCode & 3))
2412 #define METHOD_BUFFERED 0
2413 #define METHOD_IN_DIRECT 1
2414 #define METHOD_OUT_DIRECT 2
2415 #define METHOD_NEITHER 3
2416 #define METHOD_DIRECT_TO_HARDWARE METHOD_IN_DIRECT
2417 #define METHOD_DIRECT_FROM_HARDWARE METHOD_OUT_DIRECT
2419 #define FILE_ANY_ACCESS 0
2420 #define FILE_SPECIAL_ACCESS (FILE_ANY_ACCESS)
2421 #define FILE_READ_ACCESS ( 0x0001 )
2422 #define FILE_WRITE_ACCESS ( 0x0002 )
2424 typedef ULONG LSA_OPERATIONAL_MODE
, *PLSA_OPERATIONAL_MODE
;
2426 typedef enum _SECURITY_LOGON_TYPE
{
2427 UndefinedLogonType
= 0,
2436 #if (_WIN32_WINNT >= 0x0501)
2440 #if (_WIN32_WINNT >= 0x0502)
2441 CachedRemoteInteractive
,
2444 } SECURITY_LOGON_TYPE
, *PSECURITY_LOGON_TYPE
;
2446 #ifndef _NTLSA_AUDIT_
2447 #define _NTLSA_AUDIT_
2449 typedef enum _SE_ADT_PARAMETER_TYPE
{
2450 SeAdtParmTypeNone
= 0,
2451 SeAdtParmTypeString
,
2452 SeAdtParmTypeFileSpec
,
2455 SeAdtParmTypeLogonId
,
2456 SeAdtParmTypeNoLogonId
,
2457 SeAdtParmTypeAccessMask
,
2459 SeAdtParmTypeObjectTypes
,
2460 SeAdtParmTypeHexUlong
,
2465 SeAdtParmTypeHexInt64
,
2466 SeAdtParmTypeStringList
,
2467 SeAdtParmTypeSidList
,
2468 SeAdtParmTypeDuration
,
2469 SeAdtParmTypeUserAccountControl
,
2471 SeAdtParmTypeMessage
,
2472 SeAdtParmTypeDateTime
,
2473 SeAdtParmTypeSockAddr
,
2475 SeAdtParmTypeLogonHours
,
2476 SeAdtParmTypeLogonIdNoSid
,
2477 SeAdtParmTypeUlongNoConv
,
2478 SeAdtParmTypeSockAddrNoPort
,
2479 SeAdtParmTypeAccessReason
2480 } SE_ADT_PARAMETER_TYPE
, *PSE_ADT_PARAMETER_TYPE
;
2482 #ifndef GUID_DEFINED
2483 #include <guiddef.h>
2486 typedef struct _SE_ADT_OBJECT_TYPE
{
2489 #define SE_ADT_OBJECT_ONLY 0x1
2491 ACCESS_MASK AccessMask
;
2492 } SE_ADT_OBJECT_TYPE
, *PSE_ADT_OBJECT_TYPE
;
2494 typedef struct _SE_ADT_PARAMETER_ARRAY_ENTRY
{
2495 SE_ADT_PARAMETER_TYPE Type
;
2499 } SE_ADT_PARAMETER_ARRAY_ENTRY
, *PSE_ADT_PARAMETER_ARRAY_ENTRY
;
2501 typedef struct _SE_ADT_ACCESS_REASON
{
2502 ACCESS_MASK AccessMask
;
2503 ULONG AccessReasons
[32];
2504 ULONG ObjectTypeIndex
;
2505 ULONG AccessGranted
;
2506 PSECURITY_DESCRIPTOR SecurityDescriptor
;
2507 } SE_ADT_ACCESS_REASON
, *PSE_ADT_ACCESS_REASON
;
2509 #define SE_MAX_AUDIT_PARAMETERS 32
2510 #define SE_MAX_GENERIC_AUDIT_PARAMETERS 28
2512 typedef struct _SE_ADT_PARAMETER_ARRAY
{
2515 ULONG ParameterCount
;
2517 USHORT FlatSubCategoryId
;
2520 SE_ADT_PARAMETER_ARRAY_ENTRY Parameters
[ SE_MAX_AUDIT_PARAMETERS
];
2521 } SE_ADT_PARAMETER_ARRAY
, *PSE_ADT_PARAMETER_ARRAY
;
2523 #define SE_ADT_PARAMETERS_SELF_RELATIVE 0x00000001
2524 #define SE_ADT_PARAMETERS_SEND_TO_LSA 0x00000002
2525 #define SE_ADT_PARAMETER_EXTENSIBLE_AUDIT 0x00000004
2526 #define SE_ADT_PARAMETER_GENERIC_AUDIT 0x00000008
2527 #define SE_ADT_PARAMETER_WRITE_SYNCHRONOUS 0x00000010
2529 #define LSAP_SE_ADT_PARAMETER_ARRAY_TRUE_SIZE(AuditParameters) \
2530 ( sizeof(SE_ADT_PARAMETER_ARRAY) - \
2531 sizeof(SE_ADT_PARAMETER_ARRAY_ENTRY) * \
2532 (SE_MAX_AUDIT_PARAMETERS - AuditParameters->ParameterCount) )
2534 #endif /* _NTLSA_AUDIT_ */
2538 LsaRegisterLogonProcess(
2539 IN PLSA_STRING LogonProcessName
,
2540 OUT PHANDLE LsaHandle
,
2541 OUT PLSA_OPERATIONAL_MODE SecurityMode
);
2546 IN HANDLE LsaHandle
,
2547 IN PLSA_STRING OriginName
,
2548 IN SECURITY_LOGON_TYPE LogonType
,
2549 IN ULONG AuthenticationPackage
,
2550 IN PVOID AuthenticationInformation
,
2551 IN ULONG AuthenticationInformationLength
,
2552 IN PTOKEN_GROUPS LocalGroups OPTIONAL
,
2553 IN PTOKEN_SOURCE SourceContext
,
2554 OUT PVOID
*ProfileBuffer
,
2555 OUT PULONG ProfileBufferLength
,
2558 OUT PQUOTA_LIMITS Quotas
,
2559 OUT PNTSTATUS SubStatus
);
2563 LsaFreeReturnBuffer(
2570 #define MSV1_0_PACKAGE_NAME "MICROSOFT_AUTHENTICATION_PACKAGE_V1_0"
2571 #define MSV1_0_PACKAGE_NAMEW L"MICROSOFT_AUTHENTICATION_PACKAGE_V1_0"
2572 #define MSV1_0_PACKAGE_NAMEW_LENGTH sizeof(MSV1_0_PACKAGE_NAMEW) - sizeof(WCHAR)
2574 #define MSV1_0_SUBAUTHENTICATION_KEY "SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0"
2575 #define MSV1_0_SUBAUTHENTICATION_VALUE "Auth"
2577 #define MSV1_0_CHALLENGE_LENGTH 8
2578 #define MSV1_0_USER_SESSION_KEY_LENGTH 16
2579 #define MSV1_0_LANMAN_SESSION_KEY_LENGTH 8
2581 #define MSV1_0_CLEARTEXT_PASSWORD_ALLOWED 0x02
2582 #define MSV1_0_UPDATE_LOGON_STATISTICS 0x04
2583 #define MSV1_0_RETURN_USER_PARAMETERS 0x08
2584 #define MSV1_0_DONT_TRY_GUEST_ACCOUNT 0x10
2585 #define MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT 0x20
2586 #define MSV1_0_RETURN_PASSWORD_EXPIRY 0x40
2587 #define MSV1_0_USE_CLIENT_CHALLENGE 0x80
2588 #define MSV1_0_TRY_GUEST_ACCOUNT_ONLY 0x100
2589 #define MSV1_0_RETURN_PROFILE_PATH 0x200
2590 #define MSV1_0_TRY_SPECIFIED_DOMAIN_ONLY 0x400
2591 #define MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT 0x800
2593 #define MSV1_0_DISABLE_PERSONAL_FALLBACK 0x00001000
2594 #define MSV1_0_ALLOW_FORCE_GUEST 0x00002000
2596 #if (_WIN32_WINNT >= 0x0502)
2597 #define MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED 0x00004000
2598 #define MSV1_0_USE_DOMAIN_FOR_ROUTING_ONLY 0x00008000
2601 #define MSV1_0_SUBAUTHENTICATION_DLL_EX 0x00100000
2602 #define MSV1_0_ALLOW_MSVCHAPV2 0x00010000
2604 #if (_WIN32_WINNT >= 0x0600)
2605 #define MSV1_0_S4U2SELF 0x00020000
2606 #define MSV1_0_CHECK_LOGONHOURS_FOR_S4U 0x00040000
2609 #define MSV1_0_SUBAUTHENTICATION_DLL 0xFF000000
2610 #define MSV1_0_SUBAUTHENTICATION_DLL_SHIFT 24
2611 #define MSV1_0_MNS_LOGON 0x01000000
2613 #define MSV1_0_SUBAUTHENTICATION_DLL_RAS 2
2614 #define MSV1_0_SUBAUTHENTICATION_DLL_IIS 132
2616 #define LOGON_GUEST 0x01
2617 #define LOGON_NOENCRYPTION 0x02
2618 #define LOGON_CACHED_ACCOUNT 0x04
2619 #define LOGON_USED_LM_PASSWORD 0x08
2620 #define LOGON_EXTRA_SIDS 0x20
2621 #define LOGON_SUBAUTH_SESSION_KEY 0x40
2622 #define LOGON_SERVER_TRUST_ACCOUNT 0x80
2623 #define LOGON_NTLMV2_ENABLED 0x100
2624 #define LOGON_RESOURCE_GROUPS 0x200
2625 #define LOGON_PROFILE_PATH_RETURNED 0x400
2626 #define LOGON_NT_V2 0x800
2627 #define LOGON_LM_V2 0x1000
2628 #define LOGON_NTLM_V2 0x2000
2630 #if (_WIN32_WINNT >= 0x0600)
2632 #define LOGON_OPTIMIZED 0x4000
2633 #define LOGON_WINLOGON 0x8000
2634 #define LOGON_PKINIT 0x10000
2635 #define LOGON_NO_OPTIMIZED 0x20000
2639 #define MSV1_0_SUBAUTHENTICATION_FLAGS 0xFF000000
2641 #define LOGON_GRACE_LOGON 0x01000000
2643 #define MSV1_0_OWF_PASSWORD_LENGTH 16
2644 #define MSV1_0_CRED_LM_PRESENT 0x1
2645 #define MSV1_0_CRED_NT_PRESENT 0x2
2646 #define MSV1_0_CRED_VERSION 0
2648 #define MSV1_0_NTLM3_RESPONSE_LENGTH 16
2649 #define MSV1_0_NTLM3_OWF_LENGTH 16
2651 #if (_WIN32_WINNT == 0x0500)
2652 #define MSV1_0_MAX_NTLM3_LIFE 1800
2654 #define MSV1_0_MAX_NTLM3_LIFE 129600
2656 #define MSV1_0_MAX_AVL_SIZE 64000
2658 #if (_WIN32_WINNT >= 0x0501)
2660 #define MSV1_0_AV_FLAG_FORCE_GUEST 0x00000001
2662 #if (_WIN32_WINNT >= 0x0600)
2663 #define MSV1_0_AV_FLAG_MIC_HANDSHAKE_MESSAGES 0x00000002
2668 #define MSV1_0_NTLM3_INPUT_LENGTH (sizeof(MSV1_0_NTLM3_RESPONSE) - MSV1_0_NTLM3_RESPONSE_LENGTH)
2670 #if(_WIN32_WINNT >= 0x0502)
2671 #define MSV1_0_NTLM3_MIN_NT_RESPONSE_LENGTH RTL_SIZEOF_THROUGH_FIELD(MSV1_0_NTLM3_RESPONSE, AvPairsOff)
2674 #define USE_PRIMARY_PASSWORD 0x01
2675 #define RETURN_PRIMARY_USERNAME 0x02
2676 #define RETURN_PRIMARY_LOGON_DOMAINNAME 0x04
2677 #define RETURN_NON_NT_USER_SESSION_KEY 0x08
2678 #define GENERATE_CLIENT_CHALLENGE 0x10
2679 #define GCR_NTLM3_PARMS 0x20
2680 #define GCR_TARGET_INFO 0x40
2681 #define RETURN_RESERVED_PARAMETER 0x80
2682 #define GCR_ALLOW_NTLM 0x100
2683 #define GCR_USE_OEM_SET 0x200
2684 #define GCR_MACHINE_CREDENTIAL 0x400
2685 #define GCR_USE_OWF_PASSWORD 0x800
2686 #define GCR_ALLOW_LM 0x1000
2687 #define GCR_ALLOW_NO_TARGET 0x2000
2689 typedef enum _MSV1_0_LOGON_SUBMIT_TYPE
{
2690 MsV1_0InteractiveLogon
= 2,
2694 MsV1_0WorkstationUnlockLogon
= 7,
2695 MsV1_0S4ULogon
= 12,
2696 MsV1_0VirtualLogon
= 82
2697 } MSV1_0_LOGON_SUBMIT_TYPE
, *PMSV1_0_LOGON_SUBMIT_TYPE
;
2699 typedef enum _MSV1_0_PROFILE_BUFFER_TYPE
{
2700 MsV1_0InteractiveProfile
= 2,
2701 MsV1_0Lm20LogonProfile
,
2702 MsV1_0SmartCardProfile
2703 } MSV1_0_PROFILE_BUFFER_TYPE
, *PMSV1_0_PROFILE_BUFFER_TYPE
;
2705 typedef struct _MSV1_0_INTERACTIVE_LOGON
{
2706 MSV1_0_LOGON_SUBMIT_TYPE MessageType
;
2707 UNICODE_STRING LogonDomainName
;
2708 UNICODE_STRING UserName
;
2709 UNICODE_STRING Password
;
2710 } MSV1_0_INTERACTIVE_LOGON
, *PMSV1_0_INTERACTIVE_LOGON
;
2712 typedef struct _MSV1_0_INTERACTIVE_PROFILE
{
2713 MSV1_0_PROFILE_BUFFER_TYPE MessageType
;
2715 USHORT BadPasswordCount
;
2716 LARGE_INTEGER LogonTime
;
2717 LARGE_INTEGER LogoffTime
;
2718 LARGE_INTEGER KickOffTime
;
2719 LARGE_INTEGER PasswordLastSet
;
2720 LARGE_INTEGER PasswordCanChange
;
2721 LARGE_INTEGER PasswordMustChange
;
2722 UNICODE_STRING LogonScript
;
2723 UNICODE_STRING HomeDirectory
;
2724 UNICODE_STRING FullName
;
2725 UNICODE_STRING ProfilePath
;
2726 UNICODE_STRING HomeDirectoryDrive
;
2727 UNICODE_STRING LogonServer
;
2729 } MSV1_0_INTERACTIVE_PROFILE
, *PMSV1_0_INTERACTIVE_PROFILE
;
2731 typedef struct _MSV1_0_LM20_LOGON
{
2732 MSV1_0_LOGON_SUBMIT_TYPE MessageType
;
2733 UNICODE_STRING LogonDomainName
;
2734 UNICODE_STRING UserName
;
2735 UNICODE_STRING Workstation
;
2736 UCHAR ChallengeToClient
[MSV1_0_CHALLENGE_LENGTH
];
2737 STRING CaseSensitiveChallengeResponse
;
2738 STRING CaseInsensitiveChallengeResponse
;
2739 ULONG ParameterControl
;
2740 } MSV1_0_LM20_LOGON
, * PMSV1_0_LM20_LOGON
;
2742 typedef struct _MSV1_0_SUBAUTH_LOGON
{
2743 MSV1_0_LOGON_SUBMIT_TYPE MessageType
;
2744 UNICODE_STRING LogonDomainName
;
2745 UNICODE_STRING UserName
;
2746 UNICODE_STRING Workstation
;
2747 UCHAR ChallengeToClient
[MSV1_0_CHALLENGE_LENGTH
];
2748 STRING AuthenticationInfo1
;
2749 STRING AuthenticationInfo2
;
2750 ULONG ParameterControl
;
2751 ULONG SubAuthPackageId
;
2752 } MSV1_0_SUBAUTH_LOGON
, * PMSV1_0_SUBAUTH_LOGON
;
2754 #if (_WIN32_WINNT >= 0x0600)
2756 #define MSV1_0_S4U_LOGON_FLAG_CHECK_LOGONHOURS 0x2
2758 typedef struct _MSV1_0_S4U_LOGON
{
2759 MSV1_0_LOGON_SUBMIT_TYPE MessageType
;
2761 UNICODE_STRING UserPrincipalName
;
2762 UNICODE_STRING DomainName
;
2763 } MSV1_0_S4U_LOGON
, *PMSV1_0_S4U_LOGON
;
2767 typedef struct _MSV1_0_LM20_LOGON_PROFILE
{
2768 MSV1_0_PROFILE_BUFFER_TYPE MessageType
;
2769 LARGE_INTEGER KickOffTime
;
2770 LARGE_INTEGER LogoffTime
;
2772 UCHAR UserSessionKey
[MSV1_0_USER_SESSION_KEY_LENGTH
];
2773 UNICODE_STRING LogonDomainName
;
2774 UCHAR LanmanSessionKey
[MSV1_0_LANMAN_SESSION_KEY_LENGTH
];
2775 UNICODE_STRING LogonServer
;
2776 UNICODE_STRING UserParameters
;
2777 } MSV1_0_LM20_LOGON_PROFILE
, * PMSV1_0_LM20_LOGON_PROFILE
;
2779 typedef struct _MSV1_0_SUPPLEMENTAL_CREDENTIAL
{
2782 UCHAR LmPassword
[MSV1_0_OWF_PASSWORD_LENGTH
];
2783 UCHAR NtPassword
[MSV1_0_OWF_PASSWORD_LENGTH
];
2784 } MSV1_0_SUPPLEMENTAL_CREDENTIAL
, *PMSV1_0_SUPPLEMENTAL_CREDENTIAL
;
2786 typedef struct _MSV1_0_NTLM3_RESPONSE
{
2787 UCHAR Response
[MSV1_0_NTLM3_RESPONSE_LENGTH
];
2792 ULONGLONG TimeStamp
;
2793 UCHAR ChallengeFromClient
[MSV1_0_CHALLENGE_LENGTH
];
2796 } MSV1_0_NTLM3_RESPONSE
, *PMSV1_0_NTLM3_RESPONSE
;
2798 typedef enum _MSV1_0_AVID
{
2800 MsvAvNbComputerName
,
2802 MsvAvDnsComputerName
,
2804 #if (_WIN32_WINNT >= 0x0501)
2807 #if (_WIN32_WINNT >= 0x0600)
2811 MsvAvChannelBindings
,
2816 typedef struct _MSV1_0_AV_PAIR
{
2819 } MSV1_0_AV_PAIR
, *PMSV1_0_AV_PAIR
;
2821 typedef enum _MSV1_0_PROTOCOL_MESSAGE_TYPE
{
2822 MsV1_0Lm20ChallengeRequest
= 0,
2823 MsV1_0Lm20GetChallengeResponse
,
2824 MsV1_0EnumerateUsers
,
2827 MsV1_0ChangePassword
,
2828 MsV1_0ChangeCachedPassword
,
2829 MsV1_0GenericPassthrough
,
2832 MsV1_0DeriveCredential
,
2834 #if (_WIN32_WINNT >= 0x0501)
2835 MsV1_0SetProcessOption
,
2837 #if (_WIN32_WINNT >= 0x0600)
2838 MsV1_0ConfigLocalAliases
,
2839 MsV1_0ClearCachedCredentials
,
2841 } MSV1_0_PROTOCOL_MESSAGE_TYPE
, *PMSV1_0_PROTOCOL_MESSAGE_TYPE
;
2843 typedef struct _MSV1_0_LM20_CHALLENGE_REQUEST
{
2844 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2845 } MSV1_0_LM20_CHALLENGE_REQUEST
, *PMSV1_0_LM20_CHALLENGE_REQUEST
;
2847 typedef struct _MSV1_0_LM20_CHALLENGE_RESPONSE
{
2848 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2849 UCHAR ChallengeToClient
[MSV1_0_CHALLENGE_LENGTH
];
2850 } MSV1_0_LM20_CHALLENGE_RESPONSE
, *PMSV1_0_LM20_CHALLENGE_RESPONSE
;
2852 typedef struct _MSV1_0_GETCHALLENRESP_REQUEST_V1
{
2853 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2854 ULONG ParameterControl
;
2856 UNICODE_STRING Password
;
2857 UCHAR ChallengeToClient
[MSV1_0_CHALLENGE_LENGTH
];
2858 } MSV1_0_GETCHALLENRESP_REQUEST_V1
, *PMSV1_0_GETCHALLENRESP_REQUEST_V1
;
2860 typedef struct _MSV1_0_GETCHALLENRESP_REQUEST
{
2861 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2862 ULONG ParameterControl
;
2864 UNICODE_STRING Password
;
2865 UCHAR ChallengeToClient
[MSV1_0_CHALLENGE_LENGTH
];
2866 UNICODE_STRING UserName
;
2867 UNICODE_STRING LogonDomainName
;
2868 UNICODE_STRING ServerName
;
2869 } MSV1_0_GETCHALLENRESP_REQUEST
, *PMSV1_0_GETCHALLENRESP_REQUEST
;
2871 typedef struct _MSV1_0_GETCHALLENRESP_RESPONSE
{
2872 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2873 STRING CaseSensitiveChallengeResponse
;
2874 STRING CaseInsensitiveChallengeResponse
;
2875 UNICODE_STRING UserName
;
2876 UNICODE_STRING LogonDomainName
;
2877 UCHAR UserSessionKey
[MSV1_0_USER_SESSION_KEY_LENGTH
];
2878 UCHAR LanmanSessionKey
[MSV1_0_LANMAN_SESSION_KEY_LENGTH
];
2879 } MSV1_0_GETCHALLENRESP_RESPONSE
, *PMSV1_0_GETCHALLENRESP_RESPONSE
;
2881 typedef struct _MSV1_0_ENUMUSERS_REQUEST
{
2882 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2883 } MSV1_0_ENUMUSERS_REQUEST
, *PMSV1_0_ENUMUSERS_REQUEST
;
2885 typedef struct _MSV1_0_ENUMUSERS_RESPONSE
{
2886 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2887 ULONG NumberOfLoggedOnUsers
;
2890 } MSV1_0_ENUMUSERS_RESPONSE
, *PMSV1_0_ENUMUSERS_RESPONSE
;
2892 typedef struct _MSV1_0_GETUSERINFO_REQUEST
{
2893 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2895 } MSV1_0_GETUSERINFO_REQUEST
, *PMSV1_0_GETUSERINFO_REQUEST
;
2897 typedef struct _MSV1_0_GETUSERINFO_RESPONSE
{
2898 MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType
;
2900 UNICODE_STRING UserName
;
2901 UNICODE_STRING LogonDomainName
;
2902 UNICODE_STRING LogonServer
;
2903 SECURITY_LOGON_TYPE LogonType
;
2904 } MSV1_0_GETUSERINFO_RESPONSE
, *PMSV1_0_GETUSERINFO_RESPONSE
;
2906 #define FILE_OPLOCK_BROKEN_TO_LEVEL_2 0x00000007
2907 #define FILE_OPLOCK_BROKEN_TO_NONE 0x00000008
2908 #define FILE_OPBATCH_BREAK_UNDERWAY 0x00000009
2910 /* also in winnt.h */
2911 #define FILE_NOTIFY_CHANGE_FILE_NAME 0x00000001
2912 #define FILE_NOTIFY_CHANGE_DIR_NAME 0x00000002
2913 #define FILE_NOTIFY_CHANGE_NAME 0x00000003
2914 #define FILE_NOTIFY_CHANGE_ATTRIBUTES 0x00000004
2915 #define FILE_NOTIFY_CHANGE_SIZE 0x00000008
2916 #define FILE_NOTIFY_CHANGE_LAST_WRITE 0x00000010
2917 #define FILE_NOTIFY_CHANGE_LAST_ACCESS 0x00000020
2918 #define FILE_NOTIFY_CHANGE_CREATION 0x00000040
2919 #define FILE_NOTIFY_CHANGE_EA 0x00000080
2920 #define FILE_NOTIFY_CHANGE_SECURITY 0x00000100
2921 #define FILE_NOTIFY_CHANGE_STREAM_NAME 0x00000200
2922 #define FILE_NOTIFY_CHANGE_STREAM_SIZE 0x00000400
2923 #define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
2924 #define FILE_NOTIFY_VALID_MASK 0x00000fff
2926 #define FILE_ACTION_ADDED 0x00000001
2927 #define FILE_ACTION_REMOVED 0x00000002
2928 #define FILE_ACTION_MODIFIED 0x00000003
2929 #define FILE_ACTION_RENAMED_OLD_NAME 0x00000004
2930 #define FILE_ACTION_RENAMED_NEW_NAME 0x00000005
2931 #define FILE_ACTION_ADDED_STREAM 0x00000006
2932 #define FILE_ACTION_REMOVED_STREAM 0x00000007
2933 #define FILE_ACTION_MODIFIED_STREAM 0x00000008
2934 #define FILE_ACTION_REMOVED_BY_DELETE 0x00000009
2935 #define FILE_ACTION_ID_NOT_TUNNELLED 0x0000000A
2936 #define FILE_ACTION_TUNNELLED_ID_COLLISION 0x0000000B
2939 #define FILE_PIPE_BYTE_STREAM_TYPE 0x00000000
2940 #define FILE_PIPE_MESSAGE_TYPE 0x00000001
2942 #define FILE_PIPE_ACCEPT_REMOTE_CLIENTS 0x00000000
2943 #define FILE_PIPE_REJECT_REMOTE_CLIENTS 0x00000002
2945 #define FILE_PIPE_ACCEPT_REMOTE_CLIENTS 0x00000000
2946 #define FILE_PIPE_REJECT_REMOTE_CLIENTS 0x00000002
2947 #define FILE_PIPE_TYPE_VALID_MASK 0x00000003
2949 #define FILE_PIPE_BYTE_STREAM_MODE 0x00000000
2950 #define FILE_PIPE_MESSAGE_MODE 0x00000001
2952 #define FILE_PIPE_QUEUE_OPERATION 0x00000000
2953 #define FILE_PIPE_COMPLETE_OPERATION 0x00000001
2955 #define FILE_PIPE_INBOUND 0x00000000
2956 #define FILE_PIPE_OUTBOUND 0x00000001
2957 #define FILE_PIPE_FULL_DUPLEX 0x00000002
2959 #define FILE_PIPE_DISCONNECTED_STATE 0x00000001
2960 #define FILE_PIPE_LISTENING_STATE 0x00000002
2961 #define FILE_PIPE_CONNECTED_STATE 0x00000003
2962 #define FILE_PIPE_CLOSING_STATE 0x00000004
2964 #define FILE_PIPE_CLIENT_END 0x00000000
2965 #define FILE_PIPE_SERVER_END 0x00000001
2967 #define FILE_CASE_SENSITIVE_SEARCH 0x00000001
2968 #define FILE_CASE_PRESERVED_NAMES 0x00000002
2969 #define FILE_UNICODE_ON_DISK 0x00000004
2970 #define FILE_PERSISTENT_ACLS 0x00000008
2971 #define FILE_FILE_COMPRESSION 0x00000010
2972 #define FILE_VOLUME_QUOTAS 0x00000020
2973 #define FILE_SUPPORTS_SPARSE_FILES 0x00000040
2974 #define FILE_SUPPORTS_REPARSE_POINTS 0x00000080
2975 #define FILE_SUPPORTS_REMOTE_STORAGE 0x00000100
2976 #define FILE_VOLUME_IS_COMPRESSED 0x00008000
2977 #define FILE_SUPPORTS_OBJECT_IDS 0x00010000
2978 #define FILE_SUPPORTS_ENCRYPTION 0x00020000
2979 #define FILE_NAMED_STREAMS 0x00040000
2980 #define FILE_READ_ONLY_VOLUME 0x00080000
2981 #define FILE_SEQUENTIAL_WRITE_ONCE 0x00100000
2982 #define FILE_SUPPORTS_TRANSACTIONS 0x00200000
2983 #define FILE_SUPPORTS_HARD_LINKS 0x00400000
2984 #define FILE_SUPPORTS_EXTENDED_ATTRIBUTES 0x00800000
2985 #define FILE_SUPPORTS_OPEN_BY_FILE_ID 0x01000000
2986 #define FILE_SUPPORTS_USN_JOURNAL 0x02000000
2988 #define FILE_NEED_EA 0x00000080
2990 #define FILE_EA_TYPE_BINARY 0xfffe
2991 #define FILE_EA_TYPE_ASCII 0xfffd
2992 #define FILE_EA_TYPE_BITMAP 0xfffb
2993 #define FILE_EA_TYPE_METAFILE 0xfffa
2994 #define FILE_EA_TYPE_ICON 0xfff9
2995 #define FILE_EA_TYPE_EA 0xffee
2996 #define FILE_EA_TYPE_MVMT 0xffdf
2997 #define FILE_EA_TYPE_MVST 0xffde
2998 #define FILE_EA_TYPE_ASN1 0xffdd
2999 #define FILE_EA_TYPE_FAMILY_IDS 0xff01
3001 typedef struct _FILE_NOTIFY_INFORMATION
{
3002 ULONG NextEntryOffset
;
3004 ULONG FileNameLength
;
3006 } FILE_NOTIFY_INFORMATION
, *PFILE_NOTIFY_INFORMATION
;
3008 typedef struct _FILE_DIRECTORY_INFORMATION
{
3009 ULONG NextEntryOffset
;
3011 LARGE_INTEGER CreationTime
;
3012 LARGE_INTEGER LastAccessTime
;
3013 LARGE_INTEGER LastWriteTime
;
3014 LARGE_INTEGER ChangeTime
;
3015 LARGE_INTEGER EndOfFile
;
3016 LARGE_INTEGER AllocationSize
;
3017 ULONG FileAttributes
;
3018 ULONG FileNameLength
;
3020 } FILE_DIRECTORY_INFORMATION
, *PFILE_DIRECTORY_INFORMATION
;
3022 typedef struct _FILE_FULL_DIR_INFORMATION
{
3023 ULONG NextEntryOffset
;
3025 LARGE_INTEGER CreationTime
;
3026 LARGE_INTEGER LastAccessTime
;
3027 LARGE_INTEGER LastWriteTime
;
3028 LARGE_INTEGER ChangeTime
;
3029 LARGE_INTEGER EndOfFile
;
3030 LARGE_INTEGER AllocationSize
;
3031 ULONG FileAttributes
;
3032 ULONG FileNameLength
;
3035 } FILE_FULL_DIR_INFORMATION
, *PFILE_FULL_DIR_INFORMATION
;
3037 typedef struct _FILE_ID_FULL_DIR_INFORMATION
{
3038 ULONG NextEntryOffset
;
3040 LARGE_INTEGER CreationTime
;
3041 LARGE_INTEGER LastAccessTime
;
3042 LARGE_INTEGER LastWriteTime
;
3043 LARGE_INTEGER ChangeTime
;
3044 LARGE_INTEGER EndOfFile
;
3045 LARGE_INTEGER AllocationSize
;
3046 ULONG FileAttributes
;
3047 ULONG FileNameLength
;
3049 LARGE_INTEGER FileId
;
3051 } FILE_ID_FULL_DIR_INFORMATION
, *PFILE_ID_FULL_DIR_INFORMATION
;
3053 typedef struct _FILE_BOTH_DIR_INFORMATION
{
3054 ULONG NextEntryOffset
;
3056 LARGE_INTEGER CreationTime
;
3057 LARGE_INTEGER LastAccessTime
;
3058 LARGE_INTEGER LastWriteTime
;
3059 LARGE_INTEGER ChangeTime
;
3060 LARGE_INTEGER EndOfFile
;
3061 LARGE_INTEGER AllocationSize
;
3062 ULONG FileAttributes
;
3063 ULONG FileNameLength
;
3065 CCHAR ShortNameLength
;
3066 WCHAR ShortName
[12];
3068 } FILE_BOTH_DIR_INFORMATION
, *PFILE_BOTH_DIR_INFORMATION
;
3070 typedef struct _FILE_ID_BOTH_DIR_INFORMATION
{
3071 ULONG NextEntryOffset
;
3073 LARGE_INTEGER CreationTime
;
3074 LARGE_INTEGER LastAccessTime
;
3075 LARGE_INTEGER LastWriteTime
;
3076 LARGE_INTEGER ChangeTime
;
3077 LARGE_INTEGER EndOfFile
;
3078 LARGE_INTEGER AllocationSize
;
3079 ULONG FileAttributes
;
3080 ULONG FileNameLength
;
3082 CCHAR ShortNameLength
;
3083 WCHAR ShortName
[12];
3084 LARGE_INTEGER FileId
;
3086 } FILE_ID_BOTH_DIR_INFORMATION
, *PFILE_ID_BOTH_DIR_INFORMATION
;
3088 typedef struct _FILE_NAMES_INFORMATION
{
3089 ULONG NextEntryOffset
;
3091 ULONG FileNameLength
;
3093 } FILE_NAMES_INFORMATION
, *PFILE_NAMES_INFORMATION
;
3095 typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION
{
3096 ULONG NextEntryOffset
;
3098 LARGE_INTEGER CreationTime
;
3099 LARGE_INTEGER LastAccessTime
;
3100 LARGE_INTEGER LastWriteTime
;
3101 LARGE_INTEGER ChangeTime
;
3102 LARGE_INTEGER EndOfFile
;
3103 LARGE_INTEGER AllocationSize
;
3104 ULONG FileAttributes
;
3105 ULONG FileNameLength
;
3106 LARGE_INTEGER FileId
;
3107 GUID LockingTransactionId
;
3110 } FILE_ID_GLOBAL_TX_DIR_INFORMATION
, *PFILE_ID_GLOBAL_TX_DIR_INFORMATION
;
3112 #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_WRITELOCKED 0x00000001
3113 #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_TO_TX 0x00000002
3114 #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_OUTSIDE_TX 0x00000004
3116 typedef struct _FILE_OBJECTID_INFORMATION
{
3117 LONGLONG FileReference
;
3119 _ANONYMOUS_UNION
union {
3120 __GNU_EXTENSION
struct {
3121 UCHAR BirthVolumeId
[16];
3122 UCHAR BirthObjectId
[16];
3125 UCHAR ExtendedInfo
[48];
3127 } FILE_OBJECTID_INFORMATION
, *PFILE_OBJECTID_INFORMATION
;
3129 #define ANSI_DOS_STAR ('<')
3130 #define ANSI_DOS_QM ('>')
3131 #define ANSI_DOS_DOT ('"')
3133 #define DOS_STAR (L'<')
3134 #define DOS_QM (L'>')
3135 #define DOS_DOT (L'"')
3137 typedef struct _FILE_INTERNAL_INFORMATION
{
3138 LARGE_INTEGER IndexNumber
;
3139 } FILE_INTERNAL_INFORMATION
, *PFILE_INTERNAL_INFORMATION
;
3141 typedef struct _FILE_EA_INFORMATION
{
3143 } FILE_EA_INFORMATION
, *PFILE_EA_INFORMATION
;
3145 typedef struct _FILE_ACCESS_INFORMATION
{
3146 ACCESS_MASK AccessFlags
;
3147 } FILE_ACCESS_INFORMATION
, *PFILE_ACCESS_INFORMATION
;
3149 typedef struct _FILE_MODE_INFORMATION
{
3151 } FILE_MODE_INFORMATION
, *PFILE_MODE_INFORMATION
;
3153 typedef struct _FILE_ALL_INFORMATION
{
3154 FILE_BASIC_INFORMATION BasicInformation
;
3155 FILE_STANDARD_INFORMATION StandardInformation
;
3156 FILE_INTERNAL_INFORMATION InternalInformation
;
3157 FILE_EA_INFORMATION EaInformation
;
3158 FILE_ACCESS_INFORMATION AccessInformation
;
3159 FILE_POSITION_INFORMATION PositionInformation
;
3160 FILE_MODE_INFORMATION ModeInformation
;
3161 FILE_ALIGNMENT_INFORMATION AlignmentInformation
;
3162 FILE_NAME_INFORMATION NameInformation
;
3163 } FILE_ALL_INFORMATION
, *PFILE_ALL_INFORMATION
;
3165 typedef struct _FILE_ALLOCATION_INFORMATION
{
3166 LARGE_INTEGER AllocationSize
;
3167 } FILE_ALLOCATION_INFORMATION
, *PFILE_ALLOCATION_INFORMATION
;
3169 typedef struct _FILE_COMPRESSION_INFORMATION
{
3170 LARGE_INTEGER CompressedFileSize
;
3171 USHORT CompressionFormat
;
3172 UCHAR CompressionUnitShift
;
3176 } FILE_COMPRESSION_INFORMATION
, *PFILE_COMPRESSION_INFORMATION
;
3178 typedef struct _FILE_LINK_INFORMATION
{
3179 BOOLEAN ReplaceIfExists
;
3180 HANDLE RootDirectory
;
3181 ULONG FileNameLength
;
3183 } FILE_LINK_INFORMATION
, *PFILE_LINK_INFORMATION
;
3185 typedef struct _FILE_MOVE_CLUSTER_INFORMATION
{
3187 HANDLE RootDirectory
;
3188 ULONG FileNameLength
;
3190 } FILE_MOVE_CLUSTER_INFORMATION
, *PFILE_MOVE_CLUSTER_INFORMATION
;
3192 typedef struct _FILE_RENAME_INFORMATION
{
3193 BOOLEAN ReplaceIfExists
;
3194 HANDLE RootDirectory
;
3195 ULONG FileNameLength
;
3197 } FILE_RENAME_INFORMATION
, *PFILE_RENAME_INFORMATION
;
3199 typedef struct _FILE_STREAM_INFORMATION
{
3200 ULONG NextEntryOffset
;
3201 ULONG StreamNameLength
;
3202 LARGE_INTEGER StreamSize
;
3203 LARGE_INTEGER StreamAllocationSize
;
3204 WCHAR StreamName
[1];
3205 } FILE_STREAM_INFORMATION
, *PFILE_STREAM_INFORMATION
;
3207 typedef struct _FILE_TRACKING_INFORMATION
{
3208 HANDLE DestinationFile
;
3209 ULONG ObjectInformationLength
;
3210 CHAR ObjectInformation
[1];
3211 } FILE_TRACKING_INFORMATION
, *PFILE_TRACKING_INFORMATION
;
3213 typedef struct _FILE_COMPLETION_INFORMATION
{
3216 } FILE_COMPLETION_INFORMATION
, *PFILE_COMPLETION_INFORMATION
;
3218 typedef struct _FILE_PIPE_INFORMATION
{
3220 ULONG CompletionMode
;
3221 } FILE_PIPE_INFORMATION
, *PFILE_PIPE_INFORMATION
;
3223 typedef struct _FILE_PIPE_LOCAL_INFORMATION
{
3224 ULONG NamedPipeType
;
3225 ULONG NamedPipeConfiguration
;
3226 ULONG MaximumInstances
;
3227 ULONG CurrentInstances
;
3229 ULONG ReadDataAvailable
;
3230 ULONG OutboundQuota
;
3231 ULONG WriteQuotaAvailable
;
3232 ULONG NamedPipeState
;
3234 } FILE_PIPE_LOCAL_INFORMATION
, *PFILE_PIPE_LOCAL_INFORMATION
;
3236 typedef struct _FILE_PIPE_REMOTE_INFORMATION
{
3237 LARGE_INTEGER CollectDataTime
;
3238 ULONG MaximumCollectionCount
;
3239 } FILE_PIPE_REMOTE_INFORMATION
, *PFILE_PIPE_REMOTE_INFORMATION
;
3241 typedef struct _FILE_MAILSLOT_QUERY_INFORMATION
{
3242 ULONG MaximumMessageSize
;
3243 ULONG MailslotQuota
;
3244 ULONG NextMessageSize
;
3245 ULONG MessagesAvailable
;
3246 LARGE_INTEGER ReadTimeout
;
3247 } FILE_MAILSLOT_QUERY_INFORMATION
, *PFILE_MAILSLOT_QUERY_INFORMATION
;
3249 typedef struct _FILE_MAILSLOT_SET_INFORMATION
{
3250 PLARGE_INTEGER ReadTimeout
;
3251 } FILE_MAILSLOT_SET_INFORMATION
, *PFILE_MAILSLOT_SET_INFORMATION
;
3253 typedef struct _FILE_REPARSE_POINT_INFORMATION
{
3254 LONGLONG FileReference
;
3256 } FILE_REPARSE_POINT_INFORMATION
, *PFILE_REPARSE_POINT_INFORMATION
;
3258 typedef struct _FILE_LINK_ENTRY_INFORMATION
{
3259 ULONG NextEntryOffset
;
3260 LONGLONG ParentFileId
;
3261 ULONG FileNameLength
;
3263 } FILE_LINK_ENTRY_INFORMATION
, *PFILE_LINK_ENTRY_INFORMATION
;
3265 typedef struct _FILE_LINKS_INFORMATION
{
3267 ULONG EntriesReturned
;
3268 FILE_LINK_ENTRY_INFORMATION Entry
;
3269 } FILE_LINKS_INFORMATION
, *PFILE_LINKS_INFORMATION
;
3271 typedef struct _FILE_NETWORK_PHYSICAL_NAME_INFORMATION
{
3272 ULONG FileNameLength
;
3274 } FILE_NETWORK_PHYSICAL_NAME_INFORMATION
, *PFILE_NETWORK_PHYSICAL_NAME_INFORMATION
;
3276 typedef struct _FILE_STANDARD_LINK_INFORMATION
{
3277 ULONG NumberOfAccessibleLinks
;
3278 ULONG TotalNumberOfLinks
;
3279 BOOLEAN DeletePending
;
3281 } FILE_STANDARD_LINK_INFORMATION
, *PFILE_STANDARD_LINK_INFORMATION
;
3283 typedef struct _FILE_GET_EA_INFORMATION
{
3284 ULONG NextEntryOffset
;
3287 } FILE_GET_EA_INFORMATION
, *PFILE_GET_EA_INFORMATION
;
3289 #define REMOTE_PROTOCOL_FLAG_LOOPBACK 0x00000001
3290 #define REMOTE_PROTOCOL_FLAG_OFFLINE 0x00000002
3292 typedef struct _FILE_REMOTE_PROTOCOL_INFORMATION
{
3293 USHORT StructureVersion
;
3294 USHORT StructureSize
;
3296 USHORT ProtocolMajorVersion
;
3297 USHORT ProtocolMinorVersion
;
3298 USHORT ProtocolRevision
;
3306 } ProtocolSpecificReserved
;
3307 } FILE_REMOTE_PROTOCOL_INFORMATION
, *PFILE_REMOTE_PROTOCOL_INFORMATION
;
3309 typedef struct _FILE_GET_QUOTA_INFORMATION
{
3310 ULONG NextEntryOffset
;
3313 } FILE_GET_QUOTA_INFORMATION
, *PFILE_GET_QUOTA_INFORMATION
;
3315 typedef struct _FILE_QUOTA_INFORMATION
{
3316 ULONG NextEntryOffset
;
3318 LARGE_INTEGER ChangeTime
;
3319 LARGE_INTEGER QuotaUsed
;
3320 LARGE_INTEGER QuotaThreshold
;
3321 LARGE_INTEGER QuotaLimit
;
3323 } FILE_QUOTA_INFORMATION
, *PFILE_QUOTA_INFORMATION
;
3325 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
{
3326 ULONG FileSystemAttributes
;
3327 ULONG MaximumComponentNameLength
;
3328 ULONG FileSystemNameLength
;
3329 WCHAR FileSystemName
[1];
3330 } FILE_FS_ATTRIBUTE_INFORMATION
, *PFILE_FS_ATTRIBUTE_INFORMATION
;
3332 typedef struct _FILE_FS_DRIVER_PATH_INFORMATION
{
3333 BOOLEAN DriverInPath
;
3334 ULONG DriverNameLength
;
3335 WCHAR DriverName
[1];
3336 } FILE_FS_DRIVER_PATH_INFORMATION
, *PFILE_FS_DRIVER_PATH_INFORMATION
;
3338 typedef struct _FILE_FS_VOLUME_FLAGS_INFORMATION
{
3340 } FILE_FS_VOLUME_FLAGS_INFORMATION
, *PFILE_FS_VOLUME_FLAGS_INFORMATION
;
3342 #define FILE_VC_QUOTA_NONE 0x00000000
3343 #define FILE_VC_QUOTA_TRACK 0x00000001
3344 #define FILE_VC_QUOTA_ENFORCE 0x00000002
3345 #define FILE_VC_QUOTA_MASK 0x00000003
3346 #define FILE_VC_CONTENT_INDEX_DISABLED 0x00000008
3347 #define FILE_VC_LOG_QUOTA_THRESHOLD 0x00000010
3348 #define FILE_VC_LOG_QUOTA_LIMIT 0x00000020
3349 #define FILE_VC_LOG_VOLUME_THRESHOLD 0x00000040
3350 #define FILE_VC_LOG_VOLUME_LIMIT 0x00000080
3351 #define FILE_VC_QUOTAS_INCOMPLETE 0x00000100
3352 #define FILE_VC_QUOTAS_REBUILDING 0x00000200
3353 #define FILE_VC_VALID_MASK 0x000003ff
3355 typedef struct _FILE_FS_CONTROL_INFORMATION
{
3356 LARGE_INTEGER FreeSpaceStartFiltering
;
3357 LARGE_INTEGER FreeSpaceThreshold
;
3358 LARGE_INTEGER FreeSpaceStopFiltering
;
3359 LARGE_INTEGER DefaultQuotaThreshold
;
3360 LARGE_INTEGER DefaultQuotaLimit
;
3361 ULONG FileSystemControlFlags
;
3362 } FILE_FS_CONTROL_INFORMATION
, *PFILE_FS_CONTROL_INFORMATION
;
3364 #ifndef _FILESYSTEMFSCTL_
3365 #define _FILESYSTEMFSCTL_
3367 #define FSCTL_REQUEST_OPLOCK_LEVEL_1 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
3368 #define FSCTL_REQUEST_OPLOCK_LEVEL_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
3369 #define FSCTL_REQUEST_BATCH_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
3370 #define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 3, METHOD_BUFFERED, FILE_ANY_ACCESS)
3371 #define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
3372 #define FSCTL_OPLOCK_BREAK_NOTIFY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 5, METHOD_BUFFERED, FILE_ANY_ACCESS)
3373 #define FSCTL_LOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
3374 #define FSCTL_UNLOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
3375 #define FSCTL_DISMOUNT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
3376 #define FSCTL_IS_VOLUME_MOUNTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
3377 #define FSCTL_IS_PATHNAME_VALID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
3378 #define FSCTL_MARK_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
3379 #define FSCTL_QUERY_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER, FILE_ANY_ACCESS)
3380 #define FSCTL_GET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
3381 #define FSCTL_SET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
3382 #define FSCTL_SET_BOOTLOADER_ACCESSED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS)
3384 #define FSCTL_OPLOCK_BREAK_ACK_NO_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
3385 #define FSCTL_INVALIDATE_VOLUMES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
3386 #define FSCTL_QUERY_FAT_BPB CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS)
3387 #define FSCTL_REQUEST_FILTER_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
3388 #define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS)
3390 #if (_WIN32_WINNT >= 0x0400)
3392 #define FSCTL_GET_NTFS_VOLUME_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS)
3393 #define FSCTL_GET_NTFS_FILE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS)
3394 #define FSCTL_GET_VOLUME_BITMAP CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER, FILE_ANY_ACCESS)
3395 #define FSCTL_GET_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER, FILE_ANY_ACCESS)
3396 #define FSCTL_MOVE_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_ANY_ACCESS)
3397 #define FSCTL_IS_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
3398 #define FSCTL_ALLOW_EXTENDED_DASD_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER, FILE_ANY_ACCESS)
3402 #if (_WIN32_WINNT >= 0x0500)
3404 #define FSCTL_FIND_FILES_BY_SID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS)
3405 #define FSCTL_SET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_WRITE_DATA)
3406 #define FSCTL_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS)
3407 #define FSCTL_DELETE_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_WRITE_DATA)
3408 #define FSCTL_SET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_WRITE_DATA)
3409 #define FSCTL_GET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS)
3410 #define FSCTL_DELETE_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_WRITE_DATA)
3411 #define FSCTL_ENUM_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER, FILE_READ_DATA)
3412 #define FSCTL_SECURITY_ID_CHECK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45, METHOD_NEITHER, FILE_READ_DATA)
3413 #define FSCTL_READ_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46, METHOD_NEITHER, FILE_READ_DATA)
3414 #define FSCTL_SET_OBJECT_ID_EXTENDED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_WRITE_DATA)
3415 #define FSCTL_CREATE_OR_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS)
3416 #define FSCTL_SET_SPARSE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_WRITE_DATA)
3417 #define FSCTL_SET_ZERO_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA)
3418 #define FSCTL_QUERY_ALLOCATED_RANGES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51, METHOD_NEITHER, FILE_READ_DATA)
3419 #define FSCTL_ENABLE_UPGRADE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA)
3420 #define FSCTL_SET_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_BUFFERED, FILE_ANY_ACCESS)
3421 #define FSCTL_ENCRYPTION_FSCTL_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54, METHOD_NEITHER, FILE_ANY_ACCESS)
3422 #define FSCTL_WRITE_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55, METHOD_NEITHER, FILE_ANY_ACCESS)
3423 #define FSCTL_READ_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56, METHOD_NEITHER, FILE_ANY_ACCESS)
3424 #define FSCTL_CREATE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57, METHOD_NEITHER, FILE_READ_DATA)
3425 #define FSCTL_READ_FILE_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58, METHOD_NEITHER, FILE_READ_DATA)
3426 #define FSCTL_WRITE_USN_CLOSE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59, METHOD_NEITHER, FILE_READ_DATA)
3427 #define FSCTL_EXTEND_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
3428 #define FSCTL_QUERY_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
3429 #define FSCTL_DELETE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
3430 #define FSCTL_MARK_HANDLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS)
3431 #define FSCTL_SIS_COPYFILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS)
3432 #define FSCTL_SIS_LINK_FILES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
3433 #define FSCTL_RECALL_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS)
3434 #define FSCTL_READ_FROM_PLEX CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA)
3435 #define FSCTL_FILE_PREFETCH CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3439 #if (_WIN32_WINNT >= 0x0600)
3441 #define FSCTL_MAKE_MEDIA_COMPATIBLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 76, METHOD_BUFFERED, FILE_WRITE_DATA)
3442 #define FSCTL_SET_DEFECT_MANAGEMENT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 77, METHOD_BUFFERED, FILE_WRITE_DATA)
3443 #define FSCTL_QUERY_SPARING_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 78, METHOD_BUFFERED, FILE_ANY_ACCESS)
3444 #define FSCTL_QUERY_ON_DISK_VOLUME_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 79, METHOD_BUFFERED, FILE_ANY_ACCESS)
3445 #define FSCTL_SET_VOLUME_COMPRESSION_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 80, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3446 #define FSCTL_TXFS_MODIFY_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 81, METHOD_BUFFERED, FILE_WRITE_DATA)
3447 #define FSCTL_TXFS_QUERY_RM_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 82, METHOD_BUFFERED, FILE_READ_DATA)
3448 #define FSCTL_TXFS_ROLLFORWARD_REDO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 84, METHOD_BUFFERED, FILE_WRITE_DATA)
3449 #define FSCTL_TXFS_ROLLFORWARD_UNDO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 85, METHOD_BUFFERED, FILE_WRITE_DATA)
3450 #define FSCTL_TXFS_START_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 86, METHOD_BUFFERED, FILE_WRITE_DATA)
3451 #define FSCTL_TXFS_SHUTDOWN_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 87, METHOD_BUFFERED, FILE_WRITE_DATA)
3452 #define FSCTL_TXFS_READ_BACKUP_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 88, METHOD_BUFFERED, FILE_READ_DATA)
3453 #define FSCTL_TXFS_WRITE_BACKUP_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 89, METHOD_BUFFERED, FILE_WRITE_DATA)
3454 #define FSCTL_TXFS_CREATE_SECONDARY_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 90, METHOD_BUFFERED, FILE_WRITE_DATA)
3455 #define FSCTL_TXFS_GET_METADATA_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 91, METHOD_BUFFERED, FILE_READ_DATA)
3456 #define FSCTL_TXFS_GET_TRANSACTED_VERSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 92, METHOD_BUFFERED, FILE_READ_DATA)
3457 #define FSCTL_TXFS_SAVEPOINT_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 94, METHOD_BUFFERED, FILE_WRITE_DATA)
3458 #define FSCTL_TXFS_CREATE_MINIVERSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 95, METHOD_BUFFERED, FILE_WRITE_DATA)
3459 #define FSCTL_TXFS_TRANSACTION_ACTIVE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 99, METHOD_BUFFERED, FILE_READ_DATA)
3460 #define FSCTL_SET_ZERO_ON_DEALLOCATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 101, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3461 #define FSCTL_SET_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 102, METHOD_BUFFERED, FILE_ANY_ACCESS)
3462 #define FSCTL_GET_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 103, METHOD_BUFFERED, FILE_ANY_ACCESS)
3463 #define FSCTL_WAIT_FOR_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 104, METHOD_BUFFERED, FILE_ANY_ACCESS)
3464 #define FSCTL_INITIATE_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 106, METHOD_BUFFERED, FILE_ANY_ACCESS)
3465 #define FSCTL_CSC_INTERNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 107, METHOD_NEITHER, FILE_ANY_ACCESS)
3466 #define FSCTL_SHRINK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 108, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3467 #define FSCTL_SET_SHORT_NAME_BEHAVIOR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 109, METHOD_BUFFERED, FILE_ANY_ACCESS)
3468 #define FSCTL_DFSR_SET_GHOST_HANDLE_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 110, METHOD_BUFFERED, FILE_ANY_ACCESS)
3470 #define FSCTL_TXFS_LIST_TRANSACTION_LOCKED_FILES \
3471 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_READ_DATA)
3472 #define FSCTL_TXFS_LIST_TRANSACTIONS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 121, METHOD_BUFFERED, FILE_READ_DATA)
3473 #define FSCTL_QUERY_PAGEFILE_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 122, METHOD_BUFFERED, FILE_ANY_ACCESS)
3474 #define FSCTL_RESET_VOLUME_ALLOCATION_HINTS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 123, METHOD_BUFFERED, FILE_ANY_ACCESS)
3475 #define FSCTL_TXFS_READ_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 126, METHOD_BUFFERED, FILE_ANY_ACCESS)
3479 #if (_WIN32_WINNT >= 0x0601)
3481 #define FSCTL_QUERY_DEPENDENT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 124, METHOD_BUFFERED, FILE_ANY_ACCESS)
3482 #define FSCTL_SD_GLOBAL_CHANGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 125, METHOD_BUFFERED, FILE_ANY_ACCESS)
3483 #define FSCTL_LOOKUP_STREAM_FROM_CLUSTER CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 127, METHOD_BUFFERED, FILE_ANY_ACCESS)
3484 #define FSCTL_TXFS_WRITE_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 128, METHOD_BUFFERED, FILE_ANY_ACCESS)
3485 #define FSCTL_FILE_TYPE_NOTIFICATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 129, METHOD_BUFFERED, FILE_ANY_ACCESS)
3486 #define FSCTL_GET_BOOT_AREA_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 140, METHOD_BUFFERED, FILE_ANY_ACCESS)
3487 #define FSCTL_GET_RETRIEVAL_POINTER_BASE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 141, METHOD_BUFFERED, FILE_ANY_ACCESS)
3488 #define FSCTL_SET_PERSISTENT_VOLUME_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 142, METHOD_BUFFERED, FILE_ANY_ACCESS)
3489 #define FSCTL_QUERY_PERSISTENT_VOLUME_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 143, METHOD_BUFFERED, FILE_ANY_ACCESS)
3491 #define FSCTL_REQUEST_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 144, METHOD_BUFFERED, FILE_ANY_ACCESS)
3493 #define FSCTL_CSV_TUNNEL_REQUEST CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 145, METHOD_BUFFERED, FILE_ANY_ACCESS)
3494 #define FSCTL_IS_CSV_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 146, METHOD_BUFFERED, FILE_ANY_ACCESS)
3496 #define FSCTL_QUERY_FILE_SYSTEM_RECOGNITION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 147, METHOD_BUFFERED, FILE_ANY_ACCESS)
3497 #define FSCTL_CSV_GET_VOLUME_PATH_NAME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 148, METHOD_BUFFERED, FILE_ANY_ACCESS)
3498 #define FSCTL_CSV_GET_VOLUME_NAME_FOR_VOLUME_MOUNT_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 149, METHOD_BUFFERED, FILE_ANY_ACCESS)
3499 #define FSCTL_CSV_GET_VOLUME_PATH_NAMES_FOR_VOLUME_NAME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 150, METHOD_BUFFERED, FILE_ANY_ACCESS)
3500 #define FSCTL_IS_FILE_ON_CSV_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 151, METHOD_BUFFERED, FILE_ANY_ACCESS)
3502 typedef struct _CSV_NAMESPACE_INFO
{
3505 LARGE_INTEGER StartingOffset
;
3507 } CSV_NAMESPACE_INFO
, *PCSV_NAMESPACE_INFO
;
3509 #define CSV_NAMESPACE_INFO_V1 (sizeof(CSV_NAMESPACE_INFO))
3510 #define CSV_INVALID_DEVICE_NUMBER 0xFFFFFFFF
3514 #define FSCTL_MARK_AS_SYSTEM_HIVE FSCTL_SET_BOOTLOADER_ACCESSED
3516 typedef struct _PATHNAME_BUFFER
{
3517 ULONG PathNameLength
;
3519 } PATHNAME_BUFFER
, *PPATHNAME_BUFFER
;
3521 typedef struct _FSCTL_QUERY_FAT_BPB_BUFFER
{
3522 UCHAR First0x24BytesOfBootSector
[0x24];
3523 } FSCTL_QUERY_FAT_BPB_BUFFER
, *PFSCTL_QUERY_FAT_BPB_BUFFER
;
3525 #if (_WIN32_WINNT >= 0x0400)
3527 typedef struct _NTFS_VOLUME_DATA_BUFFER
{
3528 LARGE_INTEGER VolumeSerialNumber
;
3529 LARGE_INTEGER NumberSectors
;
3530 LARGE_INTEGER TotalClusters
;
3531 LARGE_INTEGER FreeClusters
;
3532 LARGE_INTEGER TotalReserved
;
3533 ULONG BytesPerSector
;
3534 ULONG BytesPerCluster
;
3535 ULONG BytesPerFileRecordSegment
;
3536 ULONG ClustersPerFileRecordSegment
;
3537 LARGE_INTEGER MftValidDataLength
;
3538 LARGE_INTEGER MftStartLcn
;
3539 LARGE_INTEGER Mft2StartLcn
;
3540 LARGE_INTEGER MftZoneStart
;
3541 LARGE_INTEGER MftZoneEnd
;
3542 } NTFS_VOLUME_DATA_BUFFER
, *PNTFS_VOLUME_DATA_BUFFER
;
3544 typedef struct _NTFS_EXTENDED_VOLUME_DATA
{
3546 USHORT MajorVersion
;
3547 USHORT MinorVersion
;
3548 } NTFS_EXTENDED_VOLUME_DATA
, *PNTFS_EXTENDED_VOLUME_DATA
;
3550 typedef struct _STARTING_LCN_INPUT_BUFFER
{
3551 LARGE_INTEGER StartingLcn
;
3552 } STARTING_LCN_INPUT_BUFFER
, *PSTARTING_LCN_INPUT_BUFFER
;
3554 typedef struct _VOLUME_BITMAP_BUFFER
{
3555 LARGE_INTEGER StartingLcn
;
3556 LARGE_INTEGER BitmapSize
;
3558 } VOLUME_BITMAP_BUFFER
, *PVOLUME_BITMAP_BUFFER
;
3560 typedef struct _STARTING_VCN_INPUT_BUFFER
{
3561 LARGE_INTEGER StartingVcn
;
3562 } STARTING_VCN_INPUT_BUFFER
, *PSTARTING_VCN_INPUT_BUFFER
;
3564 typedef struct _RETRIEVAL_POINTERS_BUFFER
{
3566 LARGE_INTEGER StartingVcn
;
3568 LARGE_INTEGER NextVcn
;
3571 } RETRIEVAL_POINTERS_BUFFER
, *PRETRIEVAL_POINTERS_BUFFER
;
3573 typedef struct _NTFS_FILE_RECORD_INPUT_BUFFER
{
3574 LARGE_INTEGER FileReferenceNumber
;
3575 } NTFS_FILE_RECORD_INPUT_BUFFER
, *PNTFS_FILE_RECORD_INPUT_BUFFER
;
3577 typedef struct _NTFS_FILE_RECORD_OUTPUT_BUFFER
{
3578 LARGE_INTEGER FileReferenceNumber
;
3579 ULONG FileRecordLength
;
3580 UCHAR FileRecordBuffer
[1];
3581 } NTFS_FILE_RECORD_OUTPUT_BUFFER
, *PNTFS_FILE_RECORD_OUTPUT_BUFFER
;
3583 typedef struct _MOVE_FILE_DATA
{
3585 LARGE_INTEGER StartingVcn
;
3586 LARGE_INTEGER StartingLcn
;
3588 } MOVE_FILE_DATA
, *PMOVE_FILE_DATA
;
3590 typedef struct _MOVE_FILE_RECORD_DATA
{
3592 LARGE_INTEGER SourceFileRecord
;
3593 LARGE_INTEGER TargetFileRecord
;
3594 } MOVE_FILE_RECORD_DATA
, *PMOVE_FILE_RECORD_DATA
;
3597 typedef struct _MOVE_FILE_DATA32
{
3599 LARGE_INTEGER StartingVcn
;
3600 LARGE_INTEGER StartingLcn
;
3602 } MOVE_FILE_DATA32
, *PMOVE_FILE_DATA32
;
3605 #endif /* (_WIN32_WINNT >= 0x0400) */
3607 #if (_WIN32_WINNT >= 0x0500)
3609 typedef struct _FIND_BY_SID_DATA
{
3612 } FIND_BY_SID_DATA
, *PFIND_BY_SID_DATA
;
3614 typedef struct _FIND_BY_SID_OUTPUT
{
3615 ULONG NextEntryOffset
;
3617 ULONG FileNameLength
;
3619 } FIND_BY_SID_OUTPUT
, *PFIND_BY_SID_OUTPUT
;
3621 typedef struct _MFT_ENUM_DATA
{
3622 ULONGLONG StartFileReferenceNumber
;
3625 } MFT_ENUM_DATA
, *PMFT_ENUM_DATA
;
3627 typedef struct _CREATE_USN_JOURNAL_DATA
{
3628 ULONGLONG MaximumSize
;
3629 ULONGLONG AllocationDelta
;
3630 } CREATE_USN_JOURNAL_DATA
, *PCREATE_USN_JOURNAL_DATA
;
3632 typedef struct _READ_USN_JOURNAL_DATA
{
3635 ULONG ReturnOnlyOnClose
;
3637 ULONGLONG BytesToWaitFor
;
3638 ULONGLONG UsnJournalID
;
3639 } READ_USN_JOURNAL_DATA
, *PREAD_USN_JOURNAL_DATA
;
3641 typedef struct _USN_RECORD
{
3643 USHORT MajorVersion
;
3644 USHORT MinorVersion
;
3645 ULONGLONG FileReferenceNumber
;
3646 ULONGLONG ParentFileReferenceNumber
;
3648 LARGE_INTEGER TimeStamp
;
3652 ULONG FileAttributes
;
3653 USHORT FileNameLength
;
3654 USHORT FileNameOffset
;
3656 } USN_RECORD
, *PUSN_RECORD
;
3658 #define USN_PAGE_SIZE (0x1000)
3660 #define USN_REASON_DATA_OVERWRITE (0x00000001)
3661 #define USN_REASON_DATA_EXTEND (0x00000002)
3662 #define USN_REASON_DATA_TRUNCATION (0x00000004)
3663 #define USN_REASON_NAMED_DATA_OVERWRITE (0x00000010)
3664 #define USN_REASON_NAMED_DATA_EXTEND (0x00000020)
3665 #define USN_REASON_NAMED_DATA_TRUNCATION (0x00000040)
3666 #define USN_REASON_FILE_CREATE (0x00000100)
3667 #define USN_REASON_FILE_DELETE (0x00000200)
3668 #define USN_REASON_EA_CHANGE (0x00000400)
3669 #define USN_REASON_SECURITY_CHANGE (0x00000800)
3670 #define USN_REASON_RENAME_OLD_NAME (0x00001000)
3671 #define USN_REASON_RENAME_NEW_NAME (0x00002000)
3672 #define USN_REASON_INDEXABLE_CHANGE (0x00004000)
3673 #define USN_REASON_BASIC_INFO_CHANGE (0x00008000)
3674 #define USN_REASON_HARD_LINK_CHANGE (0x00010000)
3675 #define USN_REASON_COMPRESSION_CHANGE (0x00020000)
3676 #define USN_REASON_ENCRYPTION_CHANGE (0x00040000)
3677 #define USN_REASON_OBJECT_ID_CHANGE (0x00080000)
3678 #define USN_REASON_REPARSE_POINT_CHANGE (0x00100000)
3679 #define USN_REASON_STREAM_CHANGE (0x00200000)
3680 #define USN_REASON_TRANSACTED_CHANGE (0x00400000)
3681 #define USN_REASON_CLOSE (0x80000000)
3683 typedef struct _USN_JOURNAL_DATA
{
3684 ULONGLONG UsnJournalID
;
3689 ULONGLONG MaximumSize
;
3690 ULONGLONG AllocationDelta
;
3691 } USN_JOURNAL_DATA
, *PUSN_JOURNAL_DATA
;
3693 typedef struct _DELETE_USN_JOURNAL_DATA
{
3694 ULONGLONG UsnJournalID
;
3696 } DELETE_USN_JOURNAL_DATA
, *PDELETE_USN_JOURNAL_DATA
;
3698 #define USN_DELETE_FLAG_DELETE (0x00000001)
3699 #define USN_DELETE_FLAG_NOTIFY (0x00000002)
3700 #define USN_DELETE_VALID_FLAGS (0x00000003)
3702 typedef struct _MARK_HANDLE_INFO
{
3703 ULONG UsnSourceInfo
;
3704 HANDLE VolumeHandle
;
3706 } MARK_HANDLE_INFO
, *PMARK_HANDLE_INFO
;
3709 typedef struct _MARK_HANDLE_INFO32
{
3710 ULONG UsnSourceInfo
;
3711 UINT32 VolumeHandle
;
3713 } MARK_HANDLE_INFO32
, *PMARK_HANDLE_INFO32
;
3716 #define USN_SOURCE_DATA_MANAGEMENT (0x00000001)
3717 #define USN_SOURCE_AUXILIARY_DATA (0x00000002)
3718 #define USN_SOURCE_REPLICATION_MANAGEMENT (0x00000004)
3720 #define MARK_HANDLE_PROTECT_CLUSTERS (0x00000001)
3721 #define MARK_HANDLE_TXF_SYSTEM_LOG (0x00000004)
3722 #define MARK_HANDLE_NOT_TXF_SYSTEM_LOG (0x00000008)
3724 typedef struct _BULK_SECURITY_TEST_DATA
{
3725 ACCESS_MASK DesiredAccess
;
3726 ULONG SecurityIds
[1];
3727 } BULK_SECURITY_TEST_DATA
, *PBULK_SECURITY_TEST_DATA
;
3729 #define VOLUME_IS_DIRTY (0x00000001)
3730 #define VOLUME_UPGRADE_SCHEDULED (0x00000002)
3731 #define VOLUME_SESSION_OPEN (0x00000004)
3733 typedef struct _FILE_PREFETCH
{
3736 ULONGLONG Prefetch
[1];
3737 } FILE_PREFETCH
, *PFILE_PREFETCH
;
3739 typedef struct _FILE_PREFETCH_EX
{
3743 ULONGLONG Prefetch
[1];
3744 } FILE_PREFETCH_EX
, *PFILE_PREFETCH_EX
;
3746 #define FILE_PREFETCH_TYPE_FOR_CREATE 0x1
3747 #define FILE_PREFETCH_TYPE_FOR_DIRENUM 0x2
3748 #define FILE_PREFETCH_TYPE_FOR_CREATE_EX 0x3
3749 #define FILE_PREFETCH_TYPE_FOR_DIRENUM_EX 0x4
3751 #define FILE_PREFETCH_TYPE_MAX 0x4
3753 typedef struct _FILE_OBJECTID_BUFFER
{
3757 UCHAR BirthVolumeId
[16];
3758 UCHAR BirthObjectId
[16];
3761 UCHAR ExtendedInfo
[48];
3763 } FILE_OBJECTID_BUFFER
, *PFILE_OBJECTID_BUFFER
;
3765 typedef struct _FILE_SET_SPARSE_BUFFER
{
3767 } FILE_SET_SPARSE_BUFFER
, *PFILE_SET_SPARSE_BUFFER
;
3769 typedef struct _FILE_ZERO_DATA_INFORMATION
{
3770 LARGE_INTEGER FileOffset
;
3771 LARGE_INTEGER BeyondFinalZero
;
3772 } FILE_ZERO_DATA_INFORMATION
, *PFILE_ZERO_DATA_INFORMATION
;
3774 typedef struct _FILE_ALLOCATED_RANGE_BUFFER
{
3775 LARGE_INTEGER FileOffset
;
3776 LARGE_INTEGER Length
;
3777 } FILE_ALLOCATED_RANGE_BUFFER
, *PFILE_ALLOCATED_RANGE_BUFFER
;
3779 typedef struct _ENCRYPTION_BUFFER
{
3780 ULONG EncryptionOperation
;
3782 } ENCRYPTION_BUFFER
, *PENCRYPTION_BUFFER
;
3784 #define FILE_SET_ENCRYPTION 0x00000001
3785 #define FILE_CLEAR_ENCRYPTION 0x00000002
3786 #define STREAM_SET_ENCRYPTION 0x00000003
3787 #define STREAM_CLEAR_ENCRYPTION 0x00000004
3789 #define MAXIMUM_ENCRYPTION_VALUE 0x00000004
3791 typedef struct _DECRYPTION_STATUS_BUFFER
{
3792 BOOLEAN NoEncryptedStreams
;
3793 } DECRYPTION_STATUS_BUFFER
, *PDECRYPTION_STATUS_BUFFER
;
3795 #define ENCRYPTION_FORMAT_DEFAULT (0x01)
3797 #define COMPRESSION_FORMAT_SPARSE (0x4000)
3799 typedef struct _REQUEST_RAW_ENCRYPTED_DATA
{
3800 LONGLONG FileOffset
;
3802 } REQUEST_RAW_ENCRYPTED_DATA
, *PREQUEST_RAW_ENCRYPTED_DATA
;
3804 typedef struct _ENCRYPTED_DATA_INFO
{
3805 ULONGLONG StartingFileOffset
;
3806 ULONG OutputBufferOffset
;
3807 ULONG BytesWithinFileSize
;
3808 ULONG BytesWithinValidDataLength
;
3809 USHORT CompressionFormat
;
3810 UCHAR DataUnitShift
;
3813 UCHAR EncryptionFormat
;
3814 USHORT NumberOfDataBlocks
;
3815 ULONG DataBlockSize
[ANYSIZE_ARRAY
];
3816 } ENCRYPTED_DATA_INFO
, *PENCRYPTED_DATA_INFO
;
3818 typedef struct _PLEX_READ_DATA_REQUEST
{
3819 LARGE_INTEGER ByteOffset
;
3822 } PLEX_READ_DATA_REQUEST
, *PPLEX_READ_DATA_REQUEST
;
3824 typedef struct _SI_COPYFILE
{
3825 ULONG SourceFileNameLength
;
3826 ULONG DestinationFileNameLength
;
3828 WCHAR FileNameBuffer
[1];
3829 } SI_COPYFILE
, *PSI_COPYFILE
;
3831 #define COPYFILE_SIS_LINK 0x0001
3832 #define COPYFILE_SIS_REPLACE 0x0002
3833 #define COPYFILE_SIS_FLAGS 0x0003
3835 #endif /* (_WIN32_WINNT >= 0x0500) */
3837 #if (_WIN32_WINNT >= 0x0600)
3839 typedef struct _FILE_MAKE_COMPATIBLE_BUFFER
{
3841 } FILE_MAKE_COMPATIBLE_BUFFER
, *PFILE_MAKE_COMPATIBLE_BUFFER
;
3843 typedef struct _FILE_SET_DEFECT_MGMT_BUFFER
{
3845 } FILE_SET_DEFECT_MGMT_BUFFER
, *PFILE_SET_DEFECT_MGMT_BUFFER
;
3847 typedef struct _FILE_QUERY_SPARING_BUFFER
{
3848 ULONG SparingUnitBytes
;
3849 BOOLEAN SoftwareSparing
;
3850 ULONG TotalSpareBlocks
;
3851 ULONG FreeSpareBlocks
;
3852 } FILE_QUERY_SPARING_BUFFER
, *PFILE_QUERY_SPARING_BUFFER
;
3854 typedef struct _FILE_QUERY_ON_DISK_VOL_INFO_BUFFER
{
3855 LARGE_INTEGER DirectoryCount
;
3856 LARGE_INTEGER FileCount
;
3857 USHORT FsFormatMajVersion
;
3858 USHORT FsFormatMinVersion
;
3859 WCHAR FsFormatName
[12];
3860 LARGE_INTEGER FormatTime
;
3861 LARGE_INTEGER LastUpdateTime
;
3862 WCHAR CopyrightInfo
[34];
3863 WCHAR AbstractInfo
[34];
3864 WCHAR FormattingImplementationInfo
[34];
3865 WCHAR LastModifyingImplementationInfo
[34];
3866 } FILE_QUERY_ON_DISK_VOL_INFO_BUFFER
, *PFILE_QUERY_ON_DISK_VOL_INFO_BUFFER
;
3868 #define SET_REPAIR_ENABLED (0x00000001)
3869 #define SET_REPAIR_VOLUME_BITMAP_SCAN (0x00000002)
3870 #define SET_REPAIR_DELETE_CROSSLINK (0x00000004)
3871 #define SET_REPAIR_WARN_ABOUT_DATA_LOSS (0x00000008)
3872 #define SET_REPAIR_DISABLED_AND_BUGCHECK_ON_CORRUPT (0x00000010)
3873 #define SET_REPAIR_VALID_MASK (0x0000001F)
3875 typedef enum _SHRINK_VOLUME_REQUEST_TYPES
{
3879 } SHRINK_VOLUME_REQUEST_TYPES
, *PSHRINK_VOLUME_REQUEST_TYPES
;
3881 typedef struct _SHRINK_VOLUME_INFORMATION
{
3882 SHRINK_VOLUME_REQUEST_TYPES ShrinkRequestType
;
3884 LONGLONG NewNumberOfSectors
;
3885 } SHRINK_VOLUME_INFORMATION
, *PSHRINK_VOLUME_INFORMATION
;
3887 #define TXFS_RM_FLAG_LOGGING_MODE 0x00000001
3888 #define TXFS_RM_FLAG_RENAME_RM 0x00000002
3889 #define TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX 0x00000004
3890 #define TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN 0x00000008
3891 #define TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS 0x00000010
3892 #define TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT 0x00000020
3893 #define TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE 0x00000040
3894 #define TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX 0x00000080
3895 #define TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN 0x00000100
3896 #define TXFS_RM_FLAG_GROW_LOG 0x00000400
3897 #define TXFS_RM_FLAG_SHRINK_LOG 0x00000800
3898 #define TXFS_RM_FLAG_ENFORCE_MINIMUM_SIZE 0x00001000
3899 #define TXFS_RM_FLAG_PRESERVE_CHANGES 0x00002000
3900 #define TXFS_RM_FLAG_RESET_RM_AT_NEXT_START 0x00004000
3901 #define TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START 0x00008000
3902 #define TXFS_RM_FLAG_PREFER_CONSISTENCY 0x00010000
3903 #define TXFS_RM_FLAG_PREFER_AVAILABILITY 0x00020000
3905 #define TXFS_LOGGING_MODE_SIMPLE (0x0001)
3906 #define TXFS_LOGGING_MODE_FULL (0x0002)
3908 #define TXFS_TRANSACTION_STATE_NONE 0x00
3909 #define TXFS_TRANSACTION_STATE_ACTIVE 0x01
3910 #define TXFS_TRANSACTION_STATE_PREPARED 0x02
3911 #define TXFS_TRANSACTION_STATE_NOTACTIVE 0x03
3913 #define TXFS_MODIFY_RM_VALID_FLAGS \
3914 (TXFS_RM_FLAG_LOGGING_MODE | \
3915 TXFS_RM_FLAG_RENAME_RM | \
3916 TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX | \
3917 TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN | \
3918 TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \
3919 TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT | \
3920 TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE | \
3921 TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX | \
3922 TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN | \
3923 TXFS_RM_FLAG_SHRINK_LOG | \
3924 TXFS_RM_FLAG_GROW_LOG | \
3925 TXFS_RM_FLAG_ENFORCE_MINIMUM_SIZE | \
3926 TXFS_RM_FLAG_PRESERVE_CHANGES | \
3927 TXFS_RM_FLAG_RESET_RM_AT_NEXT_START | \
3928 TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START | \
3929 TXFS_RM_FLAG_PREFER_CONSISTENCY | \
3930 TXFS_RM_FLAG_PREFER_AVAILABILITY)
3932 typedef struct _TXFS_MODIFY_RM
{
3934 ULONG LogContainerCountMax
;
3935 ULONG LogContainerCountMin
;
3936 ULONG LogContainerCount
;
3937 ULONG LogGrowthIncrement
;
3938 ULONG LogAutoShrinkPercentage
;
3941 } TXFS_MODIFY_RM
, *PTXFS_MODIFY_RM
;
3943 #define TXFS_RM_STATE_NOT_STARTED 0
3944 #define TXFS_RM_STATE_STARTING 1
3945 #define TXFS_RM_STATE_ACTIVE 2
3946 #define TXFS_RM_STATE_SHUTTING_DOWN 3
3948 #define TXFS_QUERY_RM_INFORMATION_VALID_FLAGS \
3949 (TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \
3950 TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT | \
3951 TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX | \
3952 TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN | \
3953 TXFS_RM_FLAG_RESET_RM_AT_NEXT_START | \
3954 TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START | \
3955 TXFS_RM_FLAG_PREFER_CONSISTENCY | \
3956 TXFS_RM_FLAG_PREFER_AVAILABILITY)
3958 typedef struct _TXFS_QUERY_RM_INFORMATION
{
3959 ULONG BytesRequired
;
3961 ULONGLONG CurrentLsn
;
3962 ULONGLONG ArchiveTailLsn
;
3963 ULONGLONG LogContainerSize
;
3964 LARGE_INTEGER HighestVirtualClock
;
3965 ULONG LogContainerCount
;
3966 ULONG LogContainerCountMax
;
3967 ULONG LogContainerCountMin
;
3968 ULONG LogGrowthIncrement
;
3969 ULONG LogAutoShrinkPercentage
;
3974 ULONGLONG LogCapacity
;
3978 ULONGLONG TransactionCount
;
3979 ULONGLONG OnePCCount
;
3980 ULONGLONG TwoPCCount
;
3981 ULONGLONG NumberLogFileFull
;
3982 ULONGLONG OldestTransactionAge
;
3984 ULONG TmLogPathOffset
;
3985 } TXFS_QUERY_RM_INFORMATION
, *PTXFS_QUERY_RM_INFORMATION
;
3987 #define TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_REDO_LSN 0x01
3988 #define TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_VIRTUAL_CLOCK 0x02
3990 #define TXFS_ROLLFORWARD_REDO_VALID_FLAGS \
3991 (TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_REDO_LSN | \
3992 TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_VIRTUAL_CLOCK)
3994 typedef struct _TXFS_ROLLFORWARD_REDO_INFORMATION
{
3995 LARGE_INTEGER LastVirtualClock
;
3996 ULONGLONG LastRedoLsn
;
3997 ULONGLONG HighestRecoveryLsn
;
3999 } TXFS_ROLLFORWARD_REDO_INFORMATION
, *PTXFS_ROLLFORWARD_REDO_INFORMATION
;
4001 #define TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MAX 0x00000001
4002 #define TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MIN 0x00000002
4003 #define TXFS_START_RM_FLAG_LOG_CONTAINER_SIZE 0x00000004
4004 #define TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS 0x00000008
4005 #define TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT 0x00000010
4006 #define TXFS_START_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE 0x00000020
4007 #define TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX 0x00000040
4008 #define TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN 0x00000080
4010 #define TXFS_START_RM_FLAG_RECOVER_BEST_EFFORT 0x00000200
4011 #define TXFS_START_RM_FLAG_LOGGING_MODE 0x00000400
4012 #define TXFS_START_RM_FLAG_PRESERVE_CHANGES 0x00000800
4014 #define TXFS_START_RM_FLAG_PREFER_CONSISTENCY 0x00001000
4015 #define TXFS_START_RM_FLAG_PREFER_AVAILABILITY 0x00002000
4017 #define TXFS_START_RM_VALID_FLAGS \
4018 (TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MAX | \
4019 TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MIN | \
4020 TXFS_START_RM_FLAG_LOG_CONTAINER_SIZE | \
4021 TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \
4022 TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT | \
4023 TXFS_START_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE | \
4024 TXFS_START_RM_FLAG_RECOVER_BEST_EFFORT | \
4025 TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX | \
4026 TXFS_START_RM_FLAG_LOGGING_MODE | \
4027 TXFS_START_RM_FLAG_PRESERVE_CHANGES | \
4028 TXFS_START_RM_FLAG_PREFER_CONSISTENCY | \
4029 TXFS_START_RM_FLAG_PREFER_AVAILABILITY)
4031 typedef struct _TXFS_START_RM_INFORMATION
{
4033 ULONGLONG LogContainerSize
;
4034 ULONG LogContainerCountMin
;
4035 ULONG LogContainerCountMax
;
4036 ULONG LogGrowthIncrement
;
4037 ULONG LogAutoShrinkPercentage
;
4038 ULONG TmLogPathOffset
;
4039 USHORT TmLogPathLength
;
4041 USHORT LogPathLength
;
4044 } TXFS_START_RM_INFORMATION
, *PTXFS_START_RM_INFORMATION
;
4046 typedef struct _TXFS_GET_METADATA_INFO_OUT
{
4051 GUID LockingTransaction
;
4053 ULONG TransactionState
;
4054 } TXFS_GET_METADATA_INFO_OUT
, *PTXFS_GET_METADATA_INFO_OUT
;
4056 #define TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_CREATED 0x00000001
4057 #define TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_DELETED 0x00000002
4059 typedef struct _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY
{
4067 } TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY
, *PTXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY
;
4069 typedef struct _TXFS_LIST_TRANSACTION_LOCKED_FILES
{
4070 GUID KtmTransaction
;
4071 ULONGLONG NumberOfFiles
;
4072 ULONGLONG BufferSizeRequired
;
4074 } TXFS_LIST_TRANSACTION_LOCKED_FILES
, *PTXFS_LIST_TRANSACTION_LOCKED_FILES
;
4076 typedef struct _TXFS_LIST_TRANSACTIONS_ENTRY
{
4078 ULONG TransactionState
;
4082 } TXFS_LIST_TRANSACTIONS_ENTRY
, *PTXFS_LIST_TRANSACTIONS_ENTRY
;
4084 typedef struct _TXFS_LIST_TRANSACTIONS
{
4085 ULONGLONG NumberOfTransactions
;
4086 ULONGLONG BufferSizeRequired
;
4087 } TXFS_LIST_TRANSACTIONS
, *PTXFS_LIST_TRANSACTIONS
;
4089 typedef struct _TXFS_READ_BACKUP_INFORMATION_OUT
{
4094 } TXFS_READ_BACKUP_INFORMATION_OUT
, *PTXFS_READ_BACKUP_INFORMATION_OUT
;
4096 typedef struct _TXFS_WRITE_BACKUP_INFORMATION
{
4098 } TXFS_WRITE_BACKUP_INFORMATION
, *PTXFS_WRITE_BACKUP_INFORMATION
;
4100 #define TXFS_TRANSACTED_VERSION_NONTRANSACTED 0xFFFFFFFE
4101 #define TXFS_TRANSACTED_VERSION_UNCOMMITTED 0xFFFFFFFF
4103 typedef struct _TXFS_GET_TRANSACTED_VERSION
{
4104 ULONG ThisBaseVersion
;
4105 ULONG LatestVersion
;
4106 USHORT ThisMiniVersion
;
4107 USHORT FirstMiniVersion
;
4108 USHORT LatestMiniVersion
;
4109 } TXFS_GET_TRANSACTED_VERSION
, *PTXFS_GET_TRANSACTED_VERSION
;
4111 #define TXFS_SAVEPOINT_SET 0x00000001
4112 #define TXFS_SAVEPOINT_ROLLBACK 0x00000002
4113 #define TXFS_SAVEPOINT_CLEAR 0x00000004
4114 #define TXFS_SAVEPOINT_CLEAR_ALL 0x00000010
4116 typedef struct _TXFS_SAVEPOINT_INFORMATION
{
4117 HANDLE KtmTransaction
;
4120 } TXFS_SAVEPOINT_INFORMATION
, *PTXFS_SAVEPOINT_INFORMATION
;
4122 typedef struct _TXFS_CREATE_MINIVERSION_INFO
{
4123 USHORT StructureVersion
;
4124 USHORT StructureLength
;
4127 } TXFS_CREATE_MINIVERSION_INFO
, *PTXFS_CREATE_MINIVERSION_INFO
;
4129 typedef struct _TXFS_TRANSACTION_ACTIVE_INFO
{
4130 BOOLEAN TransactionsActiveAtSnapshot
;
4131 } TXFS_TRANSACTION_ACTIVE_INFO
, *PTXFS_TRANSACTION_ACTIVE_INFO
;
4133 #endif /* (_WIN32_WINNT >= 0x0600) */
4135 #if (_WIN32_WINNT >= 0x0601)
4137 #define MARK_HANDLE_REALTIME (0x00000020)
4138 #define MARK_HANDLE_NOT_REALTIME (0x00000040)
4140 #define NO_8DOT3_NAME_PRESENT (0x00000001)
4141 #define REMOVED_8DOT3_NAME (0x00000002)
4143 #define PERSISTENT_VOLUME_STATE_SHORT_NAME_CREATION_DISABLED (0x00000001)
4145 typedef struct _BOOT_AREA_INFO
{
4146 ULONG BootSectorCount
;
4148 LARGE_INTEGER Offset
;
4150 } BOOT_AREA_INFO
, *PBOOT_AREA_INFO
;
4152 typedef struct _RETRIEVAL_POINTER_BASE
{
4153 LARGE_INTEGER FileAreaOffset
;
4154 } RETRIEVAL_POINTER_BASE
, *PRETRIEVAL_POINTER_BASE
;
4156 typedef struct _FILE_FS_PERSISTENT_VOLUME_INFORMATION
{
4161 } FILE_FS_PERSISTENT_VOLUME_INFORMATION
, *PFILE_FS_PERSISTENT_VOLUME_INFORMATION
;
4163 typedef struct _FILE_SYSTEM_RECOGNITION_INFORMATION
{
4165 } FILE_SYSTEM_RECOGNITION_INFORMATION
, *PFILE_SYSTEM_RECOGNITION_INFORMATION
;
4167 #define OPLOCK_LEVEL_CACHE_READ (0x00000001)
4168 #define OPLOCK_LEVEL_CACHE_HANDLE (0x00000002)
4169 #define OPLOCK_LEVEL_CACHE_WRITE (0x00000004)
4171 #define REQUEST_OPLOCK_INPUT_FLAG_REQUEST (0x00000001)
4172 #define REQUEST_OPLOCK_INPUT_FLAG_ACK (0x00000002)
4173 #define REQUEST_OPLOCK_INPUT_FLAG_COMPLETE_ACK_ON_CLOSE (0x00000004)
4175 #define REQUEST_OPLOCK_CURRENT_VERSION 1
4177 typedef struct _REQUEST_OPLOCK_INPUT_BUFFER
{
4178 USHORT StructureVersion
;
4179 USHORT StructureLength
;
4180 ULONG RequestedOplockLevel
;
4182 } REQUEST_OPLOCK_INPUT_BUFFER
, *PREQUEST_OPLOCK_INPUT_BUFFER
;
4184 #define REQUEST_OPLOCK_OUTPUT_FLAG_ACK_REQUIRED (0x00000001)
4185 #define REQUEST_OPLOCK_OUTPUT_FLAG_MODES_PROVIDED (0x00000002)
4187 typedef struct _REQUEST_OPLOCK_OUTPUT_BUFFER
{
4188 USHORT StructureVersion
;
4189 USHORT StructureLength
;
4190 ULONG OriginalOplockLevel
;
4191 ULONG NewOplockLevel
;
4193 ACCESS_MASK AccessMode
;
4195 } REQUEST_OPLOCK_OUTPUT_BUFFER
, *PREQUEST_OPLOCK_OUTPUT_BUFFER
;
4197 #define SD_GLOBAL_CHANGE_TYPE_MACHINE_SID 1
4199 typedef struct _SD_CHANGE_MACHINE_SID_INPUT
{
4200 USHORT CurrentMachineSIDOffset
;
4201 USHORT CurrentMachineSIDLength
;
4202 USHORT NewMachineSIDOffset
;
4203 USHORT NewMachineSIDLength
;
4204 } SD_CHANGE_MACHINE_SID_INPUT
, *PSD_CHANGE_MACHINE_SID_INPUT
;
4206 typedef struct _SD_CHANGE_MACHINE_SID_OUTPUT
{
4207 ULONGLONG NumSDChangedSuccess
;
4208 ULONGLONG NumSDChangedFail
;
4209 ULONGLONG NumSDUnused
;
4210 ULONGLONG NumSDTotal
;
4211 ULONGLONG NumMftSDChangedSuccess
;
4212 ULONGLONG NumMftSDChangedFail
;
4213 ULONGLONG NumMftSDTotal
;
4214 } SD_CHANGE_MACHINE_SID_OUTPUT
, *PSD_CHANGE_MACHINE_SID_OUTPUT
;
4216 typedef struct _SD_GLOBAL_CHANGE_INPUT
{
4220 SD_CHANGE_MACHINE_SID_INPUT SdChange
;
4222 } SD_GLOBAL_CHANGE_INPUT
, *PSD_GLOBAL_CHANGE_INPUT
;
4224 typedef struct _SD_GLOBAL_CHANGE_OUTPUT
{
4228 SD_CHANGE_MACHINE_SID_OUTPUT SdChange
;
4230 } SD_GLOBAL_CHANGE_OUTPUT
, *PSD_GLOBAL_CHANGE_OUTPUT
;
4232 #define ENCRYPTED_DATA_INFO_SPARSE_FILE 1
4234 typedef struct _EXTENDED_ENCRYPTED_DATA_INFO
{
4239 } EXTENDED_ENCRYPTED_DATA_INFO
, *PEXTENDED_ENCRYPTED_DATA_INFO
;
4241 typedef struct _LOOKUP_STREAM_FROM_CLUSTER_INPUT
{
4243 ULONG NumberOfClusters
;
4244 LARGE_INTEGER Cluster
[1];
4245 } LOOKUP_STREAM_FROM_CLUSTER_INPUT
, *PLOOKUP_STREAM_FROM_CLUSTER_INPUT
;
4247 typedef struct _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT
{
4249 ULONG NumberOfMatches
;
4250 ULONG BufferSizeRequired
;
4251 } LOOKUP_STREAM_FROM_CLUSTER_OUTPUT
, *PLOOKUP_STREAM_FROM_CLUSTER_OUTPUT
;
4253 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_PAGE_FILE 0x00000001
4254 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_DENY_DEFRAG_SET 0x00000002
4255 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_FS_SYSTEM_FILE 0x00000004
4256 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_TXF_SYSTEM_FILE 0x00000008
4258 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_MASK 0xff000000
4259 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_DATA 0x01000000
4260 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_INDEX 0x02000000
4261 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_SYSTEM 0x03000000
4263 typedef struct _LOOKUP_STREAM_FROM_CLUSTER_ENTRY
{
4266 LARGE_INTEGER Reserved
;
4267 LARGE_INTEGER Cluster
;
4269 } LOOKUP_STREAM_FROM_CLUSTER_ENTRY
, *PLOOKUP_STREAM_FROM_CLUSTER_ENTRY
;
4271 typedef struct _FILE_TYPE_NOTIFICATION_INPUT
{
4273 ULONG NumFileTypeIDs
;
4275 } FILE_TYPE_NOTIFICATION_INPUT
, *PFILE_TYPE_NOTIFICATION_INPUT
;
4277 #define FILE_TYPE_NOTIFICATION_FLAG_USAGE_BEGIN 0x00000001
4278 #define FILE_TYPE_NOTIFICATION_FLAG_USAGE_END 0x00000002
4280 DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_PAGE_FILE
, 0x0d0a64a1, 0x38fc, 0x4db8, 0x9f, 0xe7, 0x3f, 0x43, 0x52, 0xcd, 0x7c, 0x5c );
4281 DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_HIBERNATION_FILE
, 0xb7624d64, 0xb9a3, 0x4cf8, 0x80, 0x11, 0x5b, 0x86, 0xc9, 0x40, 0xe7, 0xb7 );
4282 DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_CRASHDUMP_FILE
, 0x9d453eb7, 0xd2a6, 0x4dbd, 0xa2, 0xe3, 0xfb, 0xd0, 0xed, 0x91, 0x09, 0xa9 );
4284 #ifndef _VIRTUAL_STORAGE_TYPE_DEFINED
4285 #define _VIRTUAL_STORAGE_TYPE_DEFINED
4286 typedef struct _VIRTUAL_STORAGE_TYPE
{
4289 } VIRTUAL_STORAGE_TYPE
, *PVIRTUAL_STORAGE_TYPE
;
4292 typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST
{
4295 } STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST
, *PSTORAGE_QUERY_DEPENDENT_VOLUME_REQUEST
;
4297 #define QUERY_DEPENDENT_VOLUME_REQUEST_FLAG_HOST_VOLUMES 0x1
4298 #define QUERY_DEPENDENT_VOLUME_REQUEST_FLAG_GUEST_VOLUMES 0x2
4300 typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY
{
4302 ULONG DependencyTypeFlags
;
4303 ULONG ProviderSpecificFlags
;
4304 VIRTUAL_STORAGE_TYPE VirtualStorageType
;
4305 } STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY
, *PSTORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY
;
4307 typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY
{
4309 ULONG DependencyTypeFlags
;
4310 ULONG ProviderSpecificFlags
;
4311 VIRTUAL_STORAGE_TYPE VirtualStorageType
;
4312 ULONG AncestorLevel
;
4313 ULONG HostVolumeNameOffset
;
4314 ULONG HostVolumeNameSize
;
4315 ULONG DependentVolumeNameOffset
;
4316 ULONG DependentVolumeNameSize
;
4317 ULONG RelativePathOffset
;
4318 ULONG RelativePathSize
;
4319 ULONG DependentDeviceNameOffset
;
4320 ULONG DependentDeviceNameSize
;
4321 } STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY
, *PSTORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY
;
4323 typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE
{
4324 ULONG ResponseLevel
;
4325 ULONG NumberEntries
;
4327 STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY Lev1Depends
[];
4328 STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY Lev2Depends
[];
4330 } STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE
, *PSTORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE
;
4332 #endif /* (_WIN32_WINNT >= 0x0601) */
4334 typedef struct _FILESYSTEM_STATISTICS
{
4335 USHORT FileSystemType
;
4337 ULONG SizeOfCompleteStructure
;
4338 ULONG UserFileReads
;
4339 ULONG UserFileReadBytes
;
4340 ULONG UserDiskReads
;
4341 ULONG UserFileWrites
;
4342 ULONG UserFileWriteBytes
;
4343 ULONG UserDiskWrites
;
4344 ULONG MetaDataReads
;
4345 ULONG MetaDataReadBytes
;
4346 ULONG MetaDataDiskReads
;
4347 ULONG MetaDataWrites
;
4348 ULONG MetaDataWriteBytes
;
4349 ULONG MetaDataDiskWrites
;
4350 } FILESYSTEM_STATISTICS
, *PFILESYSTEM_STATISTICS
;
4352 #define FILESYSTEM_STATISTICS_TYPE_NTFS 1
4353 #define FILESYSTEM_STATISTICS_TYPE_FAT 2
4354 #define FILESYSTEM_STATISTICS_TYPE_EXFAT 3
4356 typedef struct _FAT_STATISTICS
{
4358 ULONG SuccessfulCreates
;
4359 ULONG FailedCreates
;
4360 ULONG NonCachedReads
;
4361 ULONG NonCachedReadBytes
;
4362 ULONG NonCachedWrites
;
4363 ULONG NonCachedWriteBytes
;
4364 ULONG NonCachedDiskReads
;
4365 ULONG NonCachedDiskWrites
;
4366 } FAT_STATISTICS
, *PFAT_STATISTICS
;
4368 typedef struct _EXFAT_STATISTICS
{
4370 ULONG SuccessfulCreates
;
4371 ULONG FailedCreates
;
4372 ULONG NonCachedReads
;
4373 ULONG NonCachedReadBytes
;
4374 ULONG NonCachedWrites
;
4375 ULONG NonCachedWriteBytes
;
4376 ULONG NonCachedDiskReads
;
4377 ULONG NonCachedDiskWrites
;
4378 } EXFAT_STATISTICS
, *PEXFAT_STATISTICS
;
4380 typedef struct _NTFS_STATISTICS
{
4381 ULONG LogFileFullExceptions
;
4382 ULONG OtherExceptions
;
4386 ULONG MftWriteBytes
;
4392 } MftWritesUserLevel
;
4393 USHORT MftWritesFlushForLogFileFull
;
4394 USHORT MftWritesLazyWriter
;
4395 USHORT MftWritesUserRequest
;
4397 ULONG Mft2WriteBytes
;
4403 } Mft2WritesUserLevel
;
4404 USHORT Mft2WritesFlushForLogFileFull
;
4405 USHORT Mft2WritesLazyWriter
;
4406 USHORT Mft2WritesUserRequest
;
4407 ULONG RootIndexReads
;
4408 ULONG RootIndexReadBytes
;
4409 ULONG RootIndexWrites
;
4410 ULONG RootIndexWriteBytes
;
4412 ULONG BitmapReadBytes
;
4414 ULONG BitmapWriteBytes
;
4415 USHORT BitmapWritesFlushForLogFileFull
;
4416 USHORT BitmapWritesLazyWriter
;
4417 USHORT BitmapWritesUserRequest
;
4422 } BitmapWritesUserLevel
;
4423 ULONG MftBitmapReads
;
4424 ULONG MftBitmapReadBytes
;
4425 ULONG MftBitmapWrites
;
4426 ULONG MftBitmapWriteBytes
;
4427 USHORT MftBitmapWritesFlushForLogFileFull
;
4428 USHORT MftBitmapWritesLazyWriter
;
4429 USHORT MftBitmapWritesUserRequest
;
4435 } MftBitmapWritesUserLevel
;
4436 ULONG UserIndexReads
;
4437 ULONG UserIndexReadBytes
;
4438 ULONG UserIndexWrites
;
4439 ULONG UserIndexWriteBytes
;
4441 ULONG LogFileReadBytes
;
4442 ULONG LogFileWrites
;
4443 ULONG LogFileWriteBytes
;
4450 ULONG HintsClusters
;
4452 ULONG CacheClusters
;
4454 ULONG CacheMissClusters
;
4456 } NTFS_STATISTICS
, *PNTFS_STATISTICS
;
4458 #endif // _FILESYSTEMFSCTL_
4460 #define SYMLINK_FLAG_RELATIVE 1
4462 typedef struct _REPARSE_DATA_BUFFER
{
4464 USHORT ReparseDataLength
;
4466 __GNU_EXTENSION
union {
4468 USHORT SubstituteNameOffset
;
4469 USHORT SubstituteNameLength
;
4470 USHORT PrintNameOffset
;
4471 USHORT PrintNameLength
;
4473 WCHAR PathBuffer
[1];
4474 } SymbolicLinkReparseBuffer
;
4476 USHORT SubstituteNameOffset
;
4477 USHORT SubstituteNameLength
;
4478 USHORT PrintNameOffset
;
4479 USHORT PrintNameLength
;
4480 WCHAR PathBuffer
[1];
4481 } MountPointReparseBuffer
;
4483 UCHAR DataBuffer
[1];
4484 } GenericReparseBuffer
;
4486 } REPARSE_DATA_BUFFER
, *PREPARSE_DATA_BUFFER
;
4488 #define REPARSE_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(REPARSE_DATA_BUFFER, GenericReparseBuffer)
4490 typedef struct _REPARSE_GUID_DATA_BUFFER
{
4492 USHORT ReparseDataLength
;
4496 UCHAR DataBuffer
[1];
4497 } GenericReparseBuffer
;
4498 } REPARSE_GUID_DATA_BUFFER
, *PREPARSE_GUID_DATA_BUFFER
;
4500 #define REPARSE_GUID_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(REPARSE_GUID_DATA_BUFFER, GenericReparseBuffer)
4502 #define MAXIMUM_REPARSE_DATA_BUFFER_SIZE ( 16 * 1024 )
4504 /* Reserved reparse tags */
4505 #define IO_REPARSE_TAG_RESERVED_ZERO (0)
4506 #define IO_REPARSE_TAG_RESERVED_ONE (1)
4507 #define IO_REPARSE_TAG_RESERVED_RANGE IO_REPARSE_TAG_RESERVED_ONE
4509 #define IsReparseTagMicrosoft(_tag) (((_tag) & 0x80000000))
4510 #define IsReparseTagNameSurrogate(_tag) (((_tag) & 0x20000000))
4512 #define IO_REPARSE_TAG_VALID_VALUES (0xF000FFFF)
4514 #define IsReparseTagValid(tag) ( \
4515 !((tag) & ~IO_REPARSE_TAG_VALID_VALUES) && \
4516 ((tag) > IO_REPARSE_TAG_RESERVED_RANGE) \
4519 /* MicroSoft reparse point tags */
4520 #define IO_REPARSE_TAG_MOUNT_POINT (0xA0000003L)
4521 #define IO_REPARSE_TAG_HSM (0xC0000004L)
4522 #define IO_REPARSE_TAG_DRIVE_EXTENDER (0x80000005L)
4523 #define IO_REPARSE_TAG_HSM2 (0x80000006L)
4524 #define IO_REPARSE_TAG_SIS (0x80000007L)
4525 #define IO_REPARSE_TAG_WIM (0x80000008L)
4526 #define IO_REPARSE_TAG_CSV (0x80000009L)
4527 #define IO_REPARSE_TAG_DFS (0x8000000AL)
4528 #define IO_REPARSE_TAG_FILTER_MANAGER (0x8000000BL)
4529 #define IO_REPARSE_TAG_SYMLINK (0xA000000CL)
4530 #define IO_REPARSE_TAG_IIS_CACHE (0xA0000010L)
4531 #define IO_REPARSE_TAG_DFSR (0x80000012L)
4534 typedef struct _REPARSE_INDEX_KEY
{
4535 ULONG FileReparseTag
;
4536 LARGE_INTEGER FileId
;
4537 } REPARSE_INDEX_KEY
, *PREPARSE_INDEX_KEY
;
4540 #define FSCTL_LMR_GET_LINK_TRACKING_INFORMATION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,58,METHOD_BUFFERED,FILE_ANY_ACCESS)
4541 #define FSCTL_LMR_SET_LINK_TRACKING_INFORMATION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,59,METHOD_BUFFERED,FILE_ANY_ACCESS)
4542 #define IOCTL_LMR_ARE_FILE_OBJECTS_ON_SAME_SERVER CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,60,METHOD_BUFFERED,FILE_ANY_ACCESS)
4544 #define FSCTL_PIPE_ASSIGN_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
4545 #define FSCTL_PIPE_DISCONNECT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
4546 #define FSCTL_PIPE_LISTEN CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
4547 #define FSCTL_PIPE_PEEK CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
4548 #define FSCTL_PIPE_QUERY_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
4549 #define FSCTL_PIPE_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
4550 #define FSCTL_PIPE_WAIT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
4551 #define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
4552 #define FSCTL_PIPE_SET_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
4553 #define FSCTL_PIPE_QUERY_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
4554 #define FSCTL_PIPE_GET_PIPE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
4555 #define FSCTL_PIPE_SET_PIPE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
4556 #define FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
4557 #define FSCTL_PIPE_SET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 13, METHOD_BUFFERED, FILE_ANY_ACCESS)
4558 #define FSCTL_PIPE_GET_HANDLE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 14, METHOD_BUFFERED, FILE_ANY_ACCESS)
4559 #define FSCTL_PIPE_SET_HANDLE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
4560 #define FSCTL_PIPE_FLUSH CTL_CODE(FILE_DEVICE_NAMED_PIPE, 16, METHOD_BUFFERED, FILE_WRITE_DATA)
4562 #define FSCTL_PIPE_INTERNAL_READ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
4563 #define FSCTL_PIPE_INTERNAL_WRITE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
4564 #define FSCTL_PIPE_INTERNAL_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
4565 #define FSCTL_PIPE_INTERNAL_READ_OVFLOW CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
4567 #define FILE_PIPE_READ_DATA 0x00000000
4568 #define FILE_PIPE_WRITE_SPACE 0x00000001
4570 typedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER
{
4573 } FILE_PIPE_ASSIGN_EVENT_BUFFER
, *PFILE_PIPE_ASSIGN_EVENT_BUFFER
;
4575 typedef struct _FILE_PIPE_EVENT_BUFFER
{
4576 ULONG NamedPipeState
;
4580 ULONG NumberRequests
;
4581 } FILE_PIPE_EVENT_BUFFER
, *PFILE_PIPE_EVENT_BUFFER
;
4583 typedef struct _FILE_PIPE_PEEK_BUFFER
{
4584 ULONG NamedPipeState
;
4585 ULONG ReadDataAvailable
;
4586 ULONG NumberOfMessages
;
4587 ULONG MessageLength
;
4589 } FILE_PIPE_PEEK_BUFFER
, *PFILE_PIPE_PEEK_BUFFER
;
4591 typedef struct _FILE_PIPE_WAIT_FOR_BUFFER
{
4592 LARGE_INTEGER Timeout
;
4594 BOOLEAN TimeoutSpecified
;
4596 } FILE_PIPE_WAIT_FOR_BUFFER
, *PFILE_PIPE_WAIT_FOR_BUFFER
;
4598 typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER
{
4599 #if !defined(BUILD_WOW6432)
4600 PVOID ClientSession
;
4601 PVOID ClientProcess
;
4603 ULONGLONG ClientSession
;
4604 ULONGLONG ClientProcess
;
4606 } FILE_PIPE_CLIENT_PROCESS_BUFFER
, *PFILE_PIPE_CLIENT_PROCESS_BUFFER
;
4608 #define FILE_PIPE_COMPUTER_NAME_LENGTH 15
4610 typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX
{
4611 #if !defined(BUILD_WOW6432)
4612 PVOID ClientSession
;
4613 PVOID ClientProcess
;
4615 ULONGLONG ClientSession
;
4616 ULONGLONG ClientProcess
;
4618 USHORT ClientComputerNameLength
;
4619 WCHAR ClientComputerBuffer
[FILE_PIPE_COMPUTER_NAME_LENGTH
+1];
4620 } FILE_PIPE_CLIENT_PROCESS_BUFFER_EX
, *PFILE_PIPE_CLIENT_PROCESS_BUFFER_EX
;
4622 #define FSCTL_MAILSLOT_PEEK CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)
4624 typedef enum _LINK_TRACKING_INFORMATION_TYPE
{
4625 NtfsLinkTrackingInformation
,
4626 DfsLinkTrackingInformation
4627 } LINK_TRACKING_INFORMATION_TYPE
, *PLINK_TRACKING_INFORMATION_TYPE
;
4629 typedef struct _LINK_TRACKING_INFORMATION
{
4630 LINK_TRACKING_INFORMATION_TYPE Type
;
4632 } LINK_TRACKING_INFORMATION
, *PLINK_TRACKING_INFORMATION
;
4634 typedef struct _REMOTE_LINK_TRACKING_INFORMATION
{
4635 PVOID TargetFileObject
;
4636 ULONG TargetLinkTrackingInformationLength
;
4637 UCHAR TargetLinkTrackingInformationBuffer
[1];
4638 } REMOTE_LINK_TRACKING_INFORMATION
, *PREMOTE_LINK_TRACKING_INFORMATION
;
4640 typedef enum _OBJECT_INFORMATION_CLASS
{
4641 ObjectBasicInformation
= 0,
4642 ObjectTypeInformation
= 2
4643 } OBJECT_INFORMATION_CLASS
;
4645 typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION
{
4647 ACCESS_MASK GrantedAccess
;
4651 } PUBLIC_OBJECT_BASIC_INFORMATION
, *PPUBLIC_OBJECT_BASIC_INFORMATION
;
4653 typedef struct _PUBLIC_OBJECT_TYPE_INFORMATION
{
4654 UNICODE_STRING TypeName
;
4655 ULONG Reserved
[22];
4656 } PUBLIC_OBJECT_TYPE_INFORMATION
, *PPUBLIC_OBJECT_TYPE_INFORMATION
;
4658 #pragma pack(push,4)
4660 #ifndef VER_PRODUCTBUILD
4661 #define VER_PRODUCTBUILD 10000
4664 #define EX_PUSH_LOCK ULONG_PTR
4665 #define PEX_PUSH_LOCK PULONG_PTR
4670 extern PUCHAR FsRtlLegalAnsiCharacterArray
;
4672 extern DECLSPEC_IMPORT PUCHAR FsRtlLegalAnsiCharacterArray
;
4674 extern PACL SePublicDefaultDacl
;
4675 extern PACL SeSystemDefaultDacl
;
4677 extern KSPIN_LOCK IoStatisticsLock
;
4678 extern ULONG IoReadOperationCount
;
4679 extern ULONG IoWriteOperationCount
;
4680 extern ULONG IoOtherOperationCount
;
4681 extern LARGE_INTEGER IoReadTransferCount
;
4682 extern LARGE_INTEGER IoWriteTransferCount
;
4683 extern LARGE_INTEGER IoOtherTransferCount
;
4685 #define FS_LFN_APIS 0x00004000
4687 #define FILE_STORAGE_TYPE_SPECIFIED 0x00000041 /* FILE_DIRECTORY_FILE | FILE_NON_DIRECTORY_FILE */
4688 #define FILE_STORAGE_TYPE_DEFAULT (StorageTypeDefault << FILE_STORAGE_TYPE_SHIFT)
4689 #define FILE_STORAGE_TYPE_DIRECTORY (StorageTypeDirectory << FILE_STORAGE_TYPE_SHIFT)
4690 #define FILE_STORAGE_TYPE_FILE (StorageTypeFile << FILE_STORAGE_TYPE_SHIFT)
4691 #define FILE_STORAGE_TYPE_DOCFILE (StorageTypeDocfile << FILE_STORAGE_TYPE_SHIFT)
4692 #define FILE_STORAGE_TYPE_JUNCTION_POINT (StorageTypeJunctionPoint << FILE_STORAGE_TYPE_SHIFT)
4693 #define FILE_STORAGE_TYPE_CATALOG (StorageTypeCatalog << FILE_STORAGE_TYPE_SHIFT)
4694 #define FILE_STORAGE_TYPE_STRUCTURED_STORAGE (StorageTypeStructuredStorage << FILE_STORAGE_TYPE_SHIFT)
4695 #define FILE_STORAGE_TYPE_EMBEDDING (StorageTypeEmbedding << FILE_STORAGE_TYPE_SHIFT)
4696 #define FILE_STORAGE_TYPE_STREAM (StorageTypeStream << FILE_STORAGE_TYPE_SHIFT)
4697 #define FILE_MINIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_DEFAULT
4698 #define FILE_MAXIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_STREAM
4699 #define FILE_STORAGE_TYPE_MASK 0x000f0000
4700 #define FILE_STORAGE_TYPE_SHIFT 16
4702 #define FILE_VC_QUOTAS_LOG_VIOLATIONS 0x00000004
4704 #define FSRTL_FLAG_FILE_MODIFIED (0x01)
4705 #define FSRTL_FLAG_FILE_LENGTH_CHANGED (0x02)
4706 #define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04)
4707 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08)
4708 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10)
4709 #define FSRTL_FLAG_USER_MAPPED_FILE (0x20)
4710 #define FSRTL_FLAG_ADVANCED_HEADER (0x40)
4711 #define FSRTL_FLAG_EOF_ADVANCE_ACTIVE (0x80)
4713 #define FSRTL_FLAG2_DO_MODIFIED_WRITE (0x01)
4714 #define FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS (0x02)
4715 #define FSRTL_FLAG2_PURGE_WHEN_MAPPED (0x04)
4716 #define FSRTL_FLAG2_IS_PAGING_FILE (0x08)
4718 #define FSRTL_FSP_TOP_LEVEL_IRP (0x01)
4719 #define FSRTL_CACHE_TOP_LEVEL_IRP (0x02)
4720 #define FSRTL_MOD_WRITE_TOP_LEVEL_IRP (0x03)
4721 #define FSRTL_FAST_IO_TOP_LEVEL_IRP (0x04)
4722 #define FSRTL_MAX_TOP_LEVEL_IRP_FLAG (0x04)
4724 #define FSRTL_VOLUME_DISMOUNT 1
4725 #define FSRTL_VOLUME_DISMOUNT_FAILED 2
4726 #define FSRTL_VOLUME_LOCK 3
4727 #define FSRTL_VOLUME_LOCK_FAILED 4
4728 #define FSRTL_VOLUME_UNLOCK 5
4729 #define FSRTL_VOLUME_MOUNT 6
4731 #define FSRTL_WILD_CHARACTER 0x08
4733 #define FSRTL_FAT_LEGAL 0x01
4734 #define FSRTL_HPFS_LEGAL 0x02
4735 #define FSRTL_NTFS_LEGAL 0x04
4736 #define FSRTL_WILD_CHARACTER 0x08
4737 #define FSRTL_OLE_LEGAL 0x10
4738 #define FSRTL_NTFS_STREAM_LEGAL 0x14
4741 #define HARDWARE_PTE HARDWARE_PTE_X86
4742 #define PHARDWARE_PTE PHARDWARE_PTE_X86
4745 #define IO_CHECK_CREATE_PARAMETERS 0x0200
4746 #define IO_ATTACH_DEVICE 0x0400
4748 #define IO_ATTACH_DEVICE_API 0x80000000
4750 #define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE 64
4751 #define IO_FILE_OBJECT_PAGED_POOL_CHARGE 1024
4753 #define IO_TYPE_APC 18
4754 #define IO_TYPE_DPC 19
4755 #define IO_TYPE_DEVICE_QUEUE 20
4756 #define IO_TYPE_EVENT_PAIR 21
4757 #define IO_TYPE_INTERRUPT 22
4758 #define IO_TYPE_PROFILE 23
4760 #define IRP_BEING_VERIFIED 0x10
4762 #define MAILSLOT_CLASS_FIRSTCLASS 1
4763 #define MAILSLOT_CLASS_SECONDCLASS 2
4765 #define MAILSLOT_SIZE_AUTO 0
4767 #define MEM_DOS_LIM 0x40000000
4769 #define MCB_FLAG_RAISE_ON_ALLOCATION_FAILURE 1
4771 #define OB_TYPE_TYPE 1
4772 #define OB_TYPE_DIRECTORY 2
4773 #define OB_TYPE_SYMBOLIC_LINK 3
4774 #define OB_TYPE_TOKEN 4
4775 #define OB_TYPE_PROCESS 5
4776 #define OB_TYPE_THREAD 6
4777 #define OB_TYPE_EVENT 7
4778 #define OB_TYPE_EVENT_PAIR 8
4779 #define OB_TYPE_MUTANT 9
4780 #define OB_TYPE_SEMAPHORE 10
4781 #define OB_TYPE_TIMER 11
4782 #define OB_TYPE_PROFILE 12
4783 #define OB_TYPE_WINDOW_STATION 13
4784 #define OB_TYPE_DESKTOP 14
4785 #define OB_TYPE_SECTION 15
4786 #define OB_TYPE_KEY 16
4787 #define OB_TYPE_PORT 17
4788 #define OB_TYPE_ADAPTER 18
4789 #define OB_TYPE_CONTROLLER 19
4790 #define OB_TYPE_DEVICE 20
4791 #define OB_TYPE_DRIVER 21
4792 #define OB_TYPE_IO_COMPLETION 22
4793 #define OB_TYPE_FILE 23
4795 #define PIN_WAIT (1)
4796 #define PIN_EXCLUSIVE (2)
4797 #define PIN_NO_READ (4)
4798 #define PIN_IF_BCB (8)
4800 #define SEC_BASED 0x00200000
4802 #define SECURITY_WORLD_SID_AUTHORITY {0,0,0,0,0,1}
4803 #define SECURITY_WORLD_RID (0x00000000L)
4807 #define TOKEN_HAS_TRAVERSE_PRIVILEGE 0x01
4808 #define TOKEN_HAS_BACKUP_PRIVILEGE 0x02
4809 #define TOKEN_HAS_RESTORE_PRIVILEGE 0x04
4810 #define TOKEN_HAS_ADMIN_GROUP 0x08
4811 #define TOKEN_WRITE_RESTRICTED 0x08
4812 #define TOKEN_IS_RESTRICTED 0x10
4813 #define SE_BACKUP_PRIVILEGES_CHECKED 0x0100
4815 #define VACB_MAPPING_GRANULARITY (0x40000)
4816 #define VACB_OFFSET_SHIFT (18)
4818 #if (VER_PRODUCTBUILD >= 1381)
4819 #define FSCTL_MARK_AS_SYSTEM_HIVE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS)
4820 #define FSCTL_GET_HFS_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS)
4821 #endif /* (VER_PRODUCTBUILD >= 1381) */
4823 #if (VER_PRODUCTBUILD >= 2195)
4825 #define FSCTL_READ_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 33, METHOD_NEITHER, FILE_ANY_ACCESS)
4826 #define FSCTL_WRITE_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 34, METHOD_NEITHER, FILE_ANY_ACCESS)
4828 #define FSCTL_DUMP_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 37, METHOD_NEITHER, FILE_ANY_ACCESS)
4830 #define FSCTL_HSM_MSG CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
4831 #define FSCTL_NSS_CONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 67, METHOD_BUFFERED, FILE_WRITE_DATA)
4832 #define FSCTL_HSM_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
4833 #define FSCTL_NSS_RCONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 70, METHOD_BUFFERED, FILE_READ_DATA)
4834 #endif /* (VER_PRODUCTBUILD >= 2195) */
4836 #define FSCTL_NETWORK_SET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 102, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
4837 #define FSCTL_NETWORK_GET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 103, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
4838 #define FSCTL_NETWORK_GET_CONNECTION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 104, METHOD_NEITHER, FILE_ANY_ACCESS)
4839 #define FSCTL_NETWORK_ENUMERATE_CONNECTIONS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 105, METHOD_NEITHER, FILE_ANY_ACCESS)
4840 #define FSCTL_NETWORK_DELETE_CONNECTION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 107, METHOD_BUFFERED, FILE_ANY_ACCESS)
4841 #define FSCTL_NETWORK_GET_STATISTICS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 116, METHOD_BUFFERED, FILE_ANY_ACCESS)
4842 #define FSCTL_NETWORK_SET_DOMAIN_NAME CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_ANY_ACCESS)
4843 #define FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_ANY_ACCESS)
4845 #define IOCTL_REDIR_QUERY_PATH CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
4847 typedef PVOID OPLOCK
, *POPLOCK
;
4852 struct _RTL_AVL_TABLE
;
4853 struct _RTL_GENERIC_TABLE
;
4861 typedef PVOID PNOTIFY_SYNC
;
4863 typedef enum _FAST_IO_POSSIBLE
{
4864 FastIoIsNotPossible
,
4866 FastIoIsQuestionable
4869 typedef enum _FILE_STORAGE_TYPE
{
4870 StorageTypeDefault
= 1,
4871 StorageTypeDirectory
,
4873 StorageTypeJunctionPoint
,
4875 StorageTypeStructuredStorage
,
4876 StorageTypeEmbedding
,
4878 } FILE_STORAGE_TYPE
;
4880 typedef struct _OBJECT_BASIC_INFORMATION
4883 ACCESS_MASK GrantedAccess
;
4886 ULONG PagedPoolCharge
;
4887 ULONG NonPagedPoolCharge
;
4888 ULONG Reserved
[ 3 ];
4891 ULONG SecurityDescriptorSize
;
4892 LARGE_INTEGER CreationTime
;
4893 } OBJECT_BASIC_INFORMATION
, *POBJECT_BASIC_INFORMATION
;
4895 typedef struct _KAPC_STATE
{
4896 LIST_ENTRY ApcListHead
[2];
4898 BOOLEAN KernelApcInProgress
;
4899 BOOLEAN KernelApcPending
;
4900 BOOLEAN UserApcPending
;
4901 } KAPC_STATE
, *PKAPC_STATE
, *RESTRICTED_POINTER PRKAPC_STATE
;
4902 #define KAPC_STATE_ACTUAL_LENGTH (FIELD_OFFSET(KAPC_STATE, UserApcPending) + sizeof(BOOLEAN))
4904 typedef struct _BITMAP_RANGE
{
4907 ULONG FirstDirtyPage
;
4908 ULONG LastDirtyPage
;
4911 } BITMAP_RANGE
, *PBITMAP_RANGE
;
4913 typedef struct _CACHE_UNINITIALIZE_EVENT
{
4914 struct _CACHE_UNINITIALIZE_EVENT
*Next
;
4916 } CACHE_UNINITIALIZE_EVENT
, *PCACHE_UNINITIALIZE_EVENT
;
4918 typedef struct _CC_FILE_SIZES
{
4919 LARGE_INTEGER AllocationSize
;
4920 LARGE_INTEGER FileSize
;
4921 LARGE_INTEGER ValidDataLength
;
4922 } CC_FILE_SIZES
, *PCC_FILE_SIZES
;
4924 typedef struct _FILE_COPY_ON_WRITE_INFORMATION
{
4925 BOOLEAN ReplaceIfExists
;
4926 HANDLE RootDirectory
;
4927 ULONG FileNameLength
;
4929 } FILE_COPY_ON_WRITE_INFORMATION
, *PFILE_COPY_ON_WRITE_INFORMATION
;
4931 typedef struct _FILE_FULL_DIRECTORY_INFORMATION
{
4932 ULONG NextEntryOffset
;
4934 LARGE_INTEGER CreationTime
;
4935 LARGE_INTEGER LastAccessTime
;
4936 LARGE_INTEGER LastWriteTime
;
4937 LARGE_INTEGER ChangeTime
;
4938 LARGE_INTEGER EndOfFile
;
4939 LARGE_INTEGER AllocationSize
;
4940 ULONG FileAttributes
;
4941 ULONG FileNameLength
;
4943 WCHAR FileName
[ANYSIZE_ARRAY
];
4944 } FILE_FULL_DIRECTORY_INFORMATION
, *PFILE_FULL_DIRECTORY_INFORMATION
;
4946 typedef struct _FILE_FS_FULL_SIZE_INFORMATION
{
4947 LARGE_INTEGER TotalAllocationUnits
;
4948 LARGE_INTEGER CallerAvailableAllocationUnits
;
4949 LARGE_INTEGER ActualAvailableAllocationUnits
;
4950 ULONG SectorsPerAllocationUnit
;
4951 ULONG BytesPerSector
;
4952 } FILE_FS_FULL_SIZE_INFORMATION
, *PFILE_FS_FULL_SIZE_INFORMATION
;
4954 typedef struct _FILE_FS_LABEL_INFORMATION
{
4955 ULONG VolumeLabelLength
;
4956 WCHAR VolumeLabel
[1];
4957 } FILE_FS_LABEL_INFORMATION
, *PFILE_FS_LABEL_INFORMATION
;
4959 #if (VER_PRODUCTBUILD >= 2195)
4961 typedef struct _FILE_FS_OBJECT_ID_INFORMATION
{
4963 UCHAR ExtendedInfo
[48];
4964 } FILE_FS_OBJECT_ID_INFORMATION
, *PFILE_FS_OBJECT_ID_INFORMATION
;
4966 #endif /* (VER_PRODUCTBUILD >= 2195) */
4968 typedef struct _FILE_FS_SIZE_INFORMATION
{
4969 LARGE_INTEGER TotalAllocationUnits
;
4970 LARGE_INTEGER AvailableAllocationUnits
;
4971 ULONG SectorsPerAllocationUnit
;
4972 ULONG BytesPerSector
;
4973 } FILE_FS_SIZE_INFORMATION
, *PFILE_FS_SIZE_INFORMATION
;
4975 typedef struct _FILE_FS_VOLUME_INFORMATION
{
4976 LARGE_INTEGER VolumeCreationTime
;
4977 ULONG VolumeSerialNumber
;
4978 ULONG VolumeLabelLength
;
4979 BOOLEAN SupportsObjects
;
4980 WCHAR VolumeLabel
[1];
4981 } FILE_FS_VOLUME_INFORMATION
, *PFILE_FS_VOLUME_INFORMATION
;
4983 typedef struct _FILE_FS_OBJECTID_INFORMATION
4986 UCHAR ExtendedInfo
[48];
4987 } FILE_FS_OBJECTID_INFORMATION
, *PFILE_FS_OBJECTID_INFORMATION
;
4989 typedef struct _FILE_LOCK_INFO
4991 LARGE_INTEGER StartingByte
;
4992 LARGE_INTEGER Length
;
4993 BOOLEAN ExclusiveLock
;
4995 PFILE_OBJECT FileObject
;
4997 LARGE_INTEGER EndingByte
;
4998 } FILE_LOCK_INFO
, *PFILE_LOCK_INFO
;
5000 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
5001 typedef struct _FILE_SHARED_LOCK_ENTRY
{
5004 FILE_LOCK_INFO FileLock
;
5005 } FILE_SHARED_LOCK_ENTRY
, *PFILE_SHARED_LOCK_ENTRY
;
5007 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
5008 typedef struct _FILE_EXCLUSIVE_LOCK_ENTRY
{
5009 LIST_ENTRY ListEntry
;
5012 FILE_LOCK_INFO FileLock
;
5013 } FILE_EXCLUSIVE_LOCK_ENTRY
, *PFILE_EXCLUSIVE_LOCK_ENTRY
;
5015 typedef NTSTATUS (NTAPI
*PCOMPLETE_LOCK_IRP_ROUTINE
) (
5020 typedef VOID (NTAPI
*PUNLOCK_ROUTINE
) (
5022 IN PFILE_LOCK_INFO FileLockInfo
5025 typedef struct _FILE_LOCK
{
5026 PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine
;
5027 PUNLOCK_ROUTINE UnlockRoutine
;
5028 BOOLEAN FastIoIsQuestionable
;
5030 PVOID LockInformation
;
5031 FILE_LOCK_INFO LastReturnedLockInfo
;
5032 PVOID LastReturnedLock
;
5033 } FILE_LOCK
, *PFILE_LOCK
;
5035 typedef struct _FILE_MAILSLOT_PEEK_BUFFER
{
5036 ULONG ReadDataAvailable
;
5037 ULONG NumberOfMessages
;
5038 ULONG MessageLength
;
5039 } FILE_MAILSLOT_PEEK_BUFFER
, *PFILE_MAILSLOT_PEEK_BUFFER
;
5041 typedef struct _FILE_OLE_CLASSID_INFORMATION
{
5043 } FILE_OLE_CLASSID_INFORMATION
, *PFILE_OLE_CLASSID_INFORMATION
;
5045 typedef struct _FILE_OLE_ALL_INFORMATION
{
5046 FILE_BASIC_INFORMATION BasicInformation
;
5047 FILE_STANDARD_INFORMATION StandardInformation
;
5048 FILE_INTERNAL_INFORMATION InternalInformation
;
5049 FILE_EA_INFORMATION EaInformation
;
5050 FILE_ACCESS_INFORMATION AccessInformation
;
5051 FILE_POSITION_INFORMATION PositionInformation
;
5052 FILE_MODE_INFORMATION ModeInformation
;
5053 FILE_ALIGNMENT_INFORMATION AlignmentInformation
;
5056 LARGE_INTEGER SecurityChangeTime
;
5057 FILE_OLE_CLASSID_INFORMATION OleClassIdInformation
;
5058 FILE_OBJECTID_INFORMATION ObjectIdInformation
;
5059 FILE_STORAGE_TYPE StorageType
;
5062 ULONG NumberOfStreamReferences
;
5065 BOOLEAN ContentIndexDisable
;
5066 BOOLEAN InheritContentIndexDisable
;
5067 FILE_NAME_INFORMATION NameInformation
;
5068 } FILE_OLE_ALL_INFORMATION
, *PFILE_OLE_ALL_INFORMATION
;
5070 typedef struct _FILE_OLE_DIR_INFORMATION
{
5071 ULONG NextEntryOffset
;
5073 LARGE_INTEGER CreationTime
;
5074 LARGE_INTEGER LastAccessTime
;
5075 LARGE_INTEGER LastWriteTime
;
5076 LARGE_INTEGER ChangeTime
;
5077 LARGE_INTEGER EndOfFile
;
5078 LARGE_INTEGER AllocationSize
;
5079 ULONG FileAttributes
;
5080 ULONG FileNameLength
;
5081 FILE_STORAGE_TYPE StorageType
;
5084 BOOLEAN ContentIndexDisable
;
5085 BOOLEAN InheritContentIndexDisable
;
5087 } FILE_OLE_DIR_INFORMATION
, *PFILE_OLE_DIR_INFORMATION
;
5089 typedef struct _FILE_OLE_INFORMATION
{
5090 LARGE_INTEGER SecurityChangeTime
;
5091 FILE_OLE_CLASSID_INFORMATION OleClassIdInformation
;
5092 FILE_OBJECTID_INFORMATION ObjectIdInformation
;
5093 FILE_STORAGE_TYPE StorageType
;
5095 BOOLEAN ContentIndexDisable
;
5096 BOOLEAN InheritContentIndexDisable
;
5097 } FILE_OLE_INFORMATION
, *PFILE_OLE_INFORMATION
;
5099 typedef struct _FILE_OLE_STATE_BITS_INFORMATION
{
5101 ULONG StateBitsMask
;
5102 } FILE_OLE_STATE_BITS_INFORMATION
, *PFILE_OLE_STATE_BITS_INFORMATION
;
5104 #if (VER_PRODUCTBUILD >= 2195)
5105 typedef struct FILE_ALLOCATED_RANGE_BUFFER
{
5106 LARGE_INTEGER FileOffset
;
5107 LARGE_INTEGER Length
;
5108 } FILE_ALLOCATED_RANGE_BUFFER
, *PFILE_ALLOCATED_RANGE_BUFFER
;
5109 #endif /* (VER_PRODUCTBUILD >= 2195) */
5111 #define FSRTL_FCB_HEADER_V0 (0x00)
5112 #define FSRTL_FCB_HEADER_V1 (0x01)
5115 typedef struct _FSRTL_COMMON_FCB_HEADER
{
5116 CSHORT NodeTypeCode
;
5117 CSHORT NodeByteSize
;
5119 UCHAR IsFastIoPossible
;
5120 #if (VER_PRODUCTBUILD >= 1381)
5123 #endif /* (VER_PRODUCTBUILD >= 1381) */
5124 PERESOURCE Resource
;
5125 PERESOURCE PagingIoResource
;
5126 LARGE_INTEGER AllocationSize
;
5127 LARGE_INTEGER FileSize
;
5128 LARGE_INTEGER ValidDataLength
;
5129 } FSRTL_COMMON_FCB_HEADER
, *PFSRTL_COMMON_FCB_HEADER
;
5131 typedef enum _FSRTL_COMPARISON_RESULT
5136 } FSRTL_COMPARISON_RESULT
;
5138 #if (VER_PRODUCTBUILD >= 2600)
5140 typedef struct _FSRTL_ADVANCED_FCB_HEADER
{
5141 CSHORT NodeTypeCode
;
5142 CSHORT NodeByteSize
;
5144 UCHAR IsFastIoPossible
;
5148 PERESOURCE Resource
;
5149 PERESOURCE PagingIoResource
;
5150 LARGE_INTEGER AllocationSize
;
5151 LARGE_INTEGER FileSize
;
5152 LARGE_INTEGER ValidDataLength
;
5153 PFAST_MUTEX FastMutex
;
5154 LIST_ENTRY FilterContexts
;
5155 EX_PUSH_LOCK PushLock
;
5156 PVOID
*FileContextSupportPointer
;
5157 } FSRTL_ADVANCED_FCB_HEADER
, *PFSRTL_ADVANCED_FCB_HEADER
;
5159 typedef struct _FSRTL_PER_STREAM_CONTEXT
{
5163 PFREE_FUNCTION FreeCallback
;
5164 } FSRTL_PER_STREAM_CONTEXT
, *PFSRTL_PER_STREAM_CONTEXT
;
5166 typedef struct _FSRTL_PER_FILEOBJECT_CONTEXT
5171 } FSRTL_PER_FILEOBJECT_CONTEXT
, *PFSRTL_PER_FILEOBJECT_CONTEXT
;
5173 #endif /* (VER_PRODUCTBUILD >= 2600) */
5175 typedef struct _BASE_MCB
5177 ULONG MaximumPairCount
;
5182 } BASE_MCB
, *PBASE_MCB
;
5184 typedef struct _LARGE_MCB
5186 PKGUARDED_MUTEX GuardedMutex
;
5188 } LARGE_MCB
, *PLARGE_MCB
;
5192 LARGE_MCB DummyFieldThatSizesThisStructureCorrectly
;
5195 typedef struct _MAPPING_PAIR
{
5198 } MAPPING_PAIR
, *PMAPPING_PAIR
;
5200 typedef struct _GET_RETRIEVAL_DESCRIPTOR
{
5201 ULONG NumberOfPairs
;
5203 MAPPING_PAIR Pair
[1];
5204 } GET_RETRIEVAL_DESCRIPTOR
, *PGET_RETRIEVAL_DESCRIPTOR
;
5206 typedef struct _KQUEUE
{
5207 DISPATCHER_HEADER Header
;
5208 LIST_ENTRY EntryListHead
;
5211 LIST_ENTRY ThreadListHead
;
5212 } KQUEUE
, *PKQUEUE
, *RESTRICTED_POINTER PRKQUEUE
;
5214 #define ASSERT_QUEUE(Q) ASSERT(((Q)->Header.Type & KOBJECT_TYPE_MASK) == QueueObject);
5216 typedef struct _MBCB
{
5217 CSHORT NodeTypeCode
;
5218 CSHORT NodeIsInZone
;
5222 LIST_ENTRY BitmapRanges
;
5223 LONGLONG ResumeWritePage
;
5224 BITMAP_RANGE BitmapRange1
;
5225 BITMAP_RANGE BitmapRange2
;
5226 BITMAP_RANGE BitmapRange3
;
5229 typedef enum _MMFLUSH_TYPE
{
5234 typedef struct _MOVEFILE_DESCRIPTOR
{
5237 LARGE_INTEGER StartVcn
;
5238 LARGE_INTEGER TargetLcn
;
5241 } MOVEFILE_DESCRIPTOR
, *PMOVEFILE_DESCRIPTOR
;
5243 typedef struct _OBJECT_BASIC_INFO
{
5245 ACCESS_MASK GrantedAccess
;
5247 ULONG ReferenceCount
;
5248 ULONG PagedPoolUsage
;
5249 ULONG NonPagedPoolUsage
;
5251 ULONG NameInformationLength
;
5252 ULONG TypeInformationLength
;
5253 ULONG SecurityDescriptorLength
;
5254 LARGE_INTEGER CreateTime
;
5255 } OBJECT_BASIC_INFO
, *POBJECT_BASIC_INFO
;
5257 typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFO
{
5259 BOOLEAN ProtectFromClose
;
5260 } OBJECT_HANDLE_ATTRIBUTE_INFO
, *POBJECT_HANDLE_ATTRIBUTE_INFO
;
5262 typedef struct _OBJECT_NAME_INFO
{
5263 UNICODE_STRING ObjectName
;
5264 WCHAR ObjectNameBuffer
[1];
5265 } OBJECT_NAME_INFO
, *POBJECT_NAME_INFO
;
5267 typedef struct _OBJECT_PROTECTION_INFO
{
5269 BOOLEAN ProtectHandle
;
5270 } OBJECT_PROTECTION_INFO
, *POBJECT_PROTECTION_INFO
;
5272 typedef struct _OBJECT_TYPE_INFO
{
5273 UNICODE_STRING ObjectTypeName
;
5274 UCHAR Unknown
[0x58];
5275 WCHAR ObjectTypeNameBuffer
[1];
5276 } OBJECT_TYPE_INFO
, *POBJECT_TYPE_INFO
;
5278 typedef struct _OBJECT_ALL_TYPES_INFO
{
5279 ULONG NumberOfObjectTypes
;
5280 OBJECT_TYPE_INFO ObjectsTypeInfo
[1];
5281 } OBJECT_ALL_TYPES_INFO
, *POBJECT_ALL_TYPES_INFO
;
5283 typedef enum _RTL_GENERIC_COMPARE_RESULTS
5288 } RTL_GENERIC_COMPARE_RESULTS
;
5290 typedef enum _TABLE_SEARCH_RESULT
5296 } TABLE_SEARCH_RESULT
;
5299 (NTAPI
*PRTL_AVL_MATCH_FUNCTION
)(
5300 struct _RTL_AVL_TABLE
*Table
,
5305 typedef RTL_GENERIC_COMPARE_RESULTS
5306 (NTAPI
*PRTL_AVL_COMPARE_ROUTINE
) (
5307 struct _RTL_AVL_TABLE
*Table
,
5312 typedef RTL_GENERIC_COMPARE_RESULTS
5313 (NTAPI
*PRTL_GENERIC_COMPARE_ROUTINE
) (
5314 struct _RTL_GENERIC_TABLE
*Table
,
5320 (NTAPI
*PRTL_GENERIC_ALLOCATE_ROUTINE
) (
5321 struct _RTL_GENERIC_TABLE
*Table
,
5326 (NTAPI
*PRTL_GENERIC_FREE_ROUTINE
) (
5327 struct _RTL_GENERIC_TABLE
*Table
,
5332 (NTAPI
*PRTL_AVL_ALLOCATE_ROUTINE
) (
5333 struct _RTL_AVL_TABLE
*Table
,
5338 (NTAPI
*PRTL_AVL_FREE_ROUTINE
) (
5339 struct _RTL_AVL_TABLE
*Table
,
5343 typedef struct _PUBLIC_BCB
{
5344 CSHORT NodeTypeCode
;
5345 CSHORT NodeByteSize
;
5347 LARGE_INTEGER MappedFileOffset
;
5348 } PUBLIC_BCB
, *PPUBLIC_BCB
;
5350 typedef struct _QUERY_PATH_REQUEST
{
5351 ULONG PathNameLength
;
5352 PIO_SECURITY_CONTEXT SecurityContext
;
5353 WCHAR FilePathName
[1];
5354 } QUERY_PATH_REQUEST
, *PQUERY_PATH_REQUEST
;
5356 typedef struct _QUERY_PATH_RESPONSE
{
5357 ULONG LengthAccepted
;
5358 } QUERY_PATH_RESPONSE
, *PQUERY_PATH_RESPONSE
;
5360 typedef struct _RTL_SPLAY_LINKS
{
5361 struct _RTL_SPLAY_LINKS
*Parent
;
5362 struct _RTL_SPLAY_LINKS
*LeftChild
;
5363 struct _RTL_SPLAY_LINKS
*RightChild
;
5364 } RTL_SPLAY_LINKS
, *PRTL_SPLAY_LINKS
;
5366 typedef struct _RTL_BALANCED_LINKS
5368 struct _RTL_BALANCED_LINKS
*Parent
;
5369 struct _RTL_BALANCED_LINKS
*LeftChild
;
5370 struct _RTL_BALANCED_LINKS
*RightChild
;
5373 } RTL_BALANCED_LINKS
, *PRTL_BALANCED_LINKS
;
5375 typedef struct _RTL_GENERIC_TABLE
5377 PRTL_SPLAY_LINKS TableRoot
;
5378 LIST_ENTRY InsertOrderList
;
5379 PLIST_ENTRY OrderedPointer
;
5380 ULONG WhichOrderedElement
;
5381 ULONG NumberGenericTableElements
;
5382 PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine
;
5383 PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine
;
5384 PRTL_GENERIC_FREE_ROUTINE FreeRoutine
;
5386 } RTL_GENERIC_TABLE
, *PRTL_GENERIC_TABLE
;
5388 #undef PRTL_GENERIC_COMPARE_ROUTINE
5389 #undef PRTL_GENERIC_ALLOCATE_ROUTINE
5390 #undef PRTL_GENERIC_FREE_ROUTINE
5391 #undef RTL_GENERIC_TABLE
5392 #undef PRTL_GENERIC_TABLE
5394 #define PRTL_GENERIC_COMPARE_ROUTINE PRTL_AVL_COMPARE_ROUTINE
5395 #define PRTL_GENERIC_ALLOCATE_ROUTINE PRTL_AVL_ALLOCATE_ROUTINE
5396 #define PRTL_GENERIC_FREE_ROUTINE PRTL_AVL_FREE_ROUTINE
5397 #define RTL_GENERIC_TABLE RTL_AVL_TABLE
5398 #define PRTL_GENERIC_TABLE PRTL_AVL_TABLE
5400 #define RtlInitializeGenericTable RtlInitializeGenericTableAvl
5401 #define RtlInsertElementGenericTable RtlInsertElementGenericTableAvl
5402 #define RtlInsertElementGenericTableFull RtlInsertElementGenericTableFullAvl
5403 #define RtlDeleteElementGenericTable RtlDeleteElementGenericTableAvl
5404 #define RtlLookupElementGenericTable RtlLookupElementGenericTableAvl
5405 #define RtlLookupElementGenericTableFull RtlLookupElementGenericTableFullAvl
5406 #define RtlEnumerateGenericTable RtlEnumerateGenericTableAvl
5407 #define RtlEnumerateGenericTableWithoutSplaying RtlEnumerateGenericTableWithoutSplayingAvl
5408 #define RtlGetElementGenericTable RtlGetElementGenericTableAvl
5409 #define RtlNumberGenericTableElements RtlNumberGenericTableElementsAvl
5410 #define RtlIsGenericTableEmpty RtlIsGenericTableEmptyAvl
5412 typedef struct _RTL_AVL_TABLE
5414 RTL_BALANCED_LINKS BalancedRoot
;
5415 PVOID OrderedPointer
;
5416 ULONG WhichOrderedElement
;
5417 ULONG NumberGenericTableElements
;
5419 PRTL_BALANCED_LINKS RestartKey
;
5421 PRTL_AVL_COMPARE_ROUTINE CompareRoutine
;
5422 PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine
;
5423 PRTL_AVL_FREE_ROUTINE FreeRoutine
;
5425 } RTL_AVL_TABLE
, *PRTL_AVL_TABLE
;
5430 RtlInitializeGenericTableAvl(
5431 PRTL_AVL_TABLE Table
,
5432 PRTL_AVL_COMPARE_ROUTINE CompareRoutine
,
5433 PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine
,
5434 PRTL_AVL_FREE_ROUTINE FreeRoutine
,
5441 RtlInsertElementGenericTableAvl (
5442 PRTL_AVL_TABLE Table
,
5445 PBOOLEAN NewElement OPTIONAL
5451 RtlDeleteElementGenericTableAvl (
5452 PRTL_AVL_TABLE Table
,
5459 RtlLookupElementGenericTableAvl (
5460 PRTL_AVL_TABLE Table
,
5467 RtlEnumerateGenericTableWithoutSplayingAvl (
5468 PRTL_AVL_TABLE Table
,
5472 #if defined(USE_LPC6432)
5473 #define LPC_CLIENT_ID CLIENT_ID64
5474 #define LPC_SIZE_T ULONGLONG
5475 #define LPC_PVOID ULONGLONG
5476 #define LPC_HANDLE ULONGLONG
5478 #define LPC_CLIENT_ID CLIENT_ID
5479 #define LPC_SIZE_T SIZE_T
5480 #define LPC_PVOID PVOID
5481 #define LPC_HANDLE HANDLE
5484 typedef struct _PORT_MESSAGE
5500 CSHORT DataInfoOffset
;
5504 __GNU_EXTENSION
union
5506 LPC_CLIENT_ID ClientId
;
5507 double DoNotUseThisField
;
5510 __GNU_EXTENSION
union
5512 LPC_SIZE_T ClientViewSize
;
5515 } PORT_MESSAGE
, *PPORT_MESSAGE
;
5517 #define LPC_KERNELMODE_MESSAGE (CSHORT)((USHORT)0x8000)
5519 typedef struct _PORT_VIEW
5522 LPC_HANDLE SectionHandle
;
5523 ULONG SectionOffset
;
5524 LPC_SIZE_T ViewSize
;
5526 LPC_PVOID ViewRemoteBase
;
5527 } PORT_VIEW
, *PPORT_VIEW
;
5529 typedef struct _REMOTE_PORT_VIEW
5532 LPC_SIZE_T ViewSize
;
5534 } REMOTE_PORT_VIEW
, *PREMOTE_PORT_VIEW
;
5536 typedef struct _SE_EXPORTS
{
5538 LUID SeCreateTokenPrivilege
;
5539 LUID SeAssignPrimaryTokenPrivilege
;
5540 LUID SeLockMemoryPrivilege
;
5541 LUID SeIncreaseQuotaPrivilege
;
5542 LUID SeUnsolicitedInputPrivilege
;
5543 LUID SeTcbPrivilege
;
5544 LUID SeSecurityPrivilege
;
5545 LUID SeTakeOwnershipPrivilege
;
5546 LUID SeLoadDriverPrivilege
;
5547 LUID SeCreatePagefilePrivilege
;
5548 LUID SeIncreaseBasePriorityPrivilege
;
5549 LUID SeSystemProfilePrivilege
;
5550 LUID SeSystemtimePrivilege
;
5551 LUID SeProfileSingleProcessPrivilege
;
5552 LUID SeCreatePermanentPrivilege
;
5553 LUID SeBackupPrivilege
;
5554 LUID SeRestorePrivilege
;
5555 LUID SeShutdownPrivilege
;
5556 LUID SeDebugPrivilege
;
5557 LUID SeAuditPrivilege
;
5558 LUID SeSystemEnvironmentPrivilege
;
5559 LUID SeChangeNotifyPrivilege
;
5560 LUID SeRemoteShutdownPrivilege
;
5565 PSID SeCreatorOwnerSid
;
5566 PSID SeCreatorGroupSid
;
5568 PSID SeNtAuthoritySid
;
5572 PSID SeInteractiveSid
;
5573 PSID SeLocalSystemSid
;
5574 PSID SeAliasAdminsSid
;
5575 PSID SeAliasUsersSid
;
5576 PSID SeAliasGuestsSid
;
5577 PSID SeAliasPowerUsersSid
;
5578 PSID SeAliasAccountOpsSid
;
5579 PSID SeAliasSystemOpsSid
;
5580 PSID SeAliasPrintOpsSid
;
5581 PSID SeAliasBackupOpsSid
;
5583 PSID SeAuthenticatedUsersSid
;
5585 PSID SeRestrictedSid
;
5586 PSID SeAnonymousLogonSid
;
5588 LUID SeUndockPrivilege
;
5589 LUID SeSyncAgentPrivilege
;
5590 LUID SeEnableDelegationPrivilege
;
5592 } SE_EXPORTS
, *PSE_EXPORTS
;
5594 extern PSE_EXPORTS SeExports
;
5596 typedef struct _SECURITY_CLIENT_CONTEXT
{
5597 SECURITY_QUALITY_OF_SERVICE SecurityQos
;
5598 PACCESS_TOKEN ClientToken
;
5599 BOOLEAN DirectlyAccessClientToken
;
5600 BOOLEAN DirectAccessEffectiveOnly
;
5601 BOOLEAN ServerIsRemote
;
5602 TOKEN_CONTROL ClientTokenControl
;
5603 } SECURITY_CLIENT_CONTEXT
, *PSECURITY_CLIENT_CONTEXT
;
5605 typedef struct _TUNNEL
{
5607 PRTL_SPLAY_LINKS Cache
;
5608 LIST_ENTRY TimerQueue
;
5612 typedef struct _VAD_HEADER
{
5615 struct _VAD_HEADER
* ParentLink
;
5616 struct _VAD_HEADER
* LeftLink
;
5617 struct _VAD_HEADER
* RightLink
;
5618 ULONG Flags
; /* LSB = CommitCharge */
5620 PVOID FirstProtoPte
;
5624 } VAD_HEADER
, *PVAD_HEADER
;
5626 #if (VER_PRODUCTBUILD >= 2600)
5629 (NTAPI
*PFILTER_REPORT_CHANGE
) (
5630 IN PVOID NotifyContext
,
5631 IN PVOID FilterContext
5634 typedef enum _FS_FILTER_SECTION_SYNC_TYPE
{
5636 SyncTypeCreateSection
5637 } FS_FILTER_SECTION_SYNC_TYPE
, *PFS_FILTER_SECTION_SYNC_TYPE
;
5639 typedef enum _FS_FILTER_STREAM_FO_NOTIFICATION_TYPE
{
5640 NotifyTypeCreate
= 0,
5642 } FS_FILTER_STREAM_FO_NOTIFICATION_TYPE
, *PFS_FILTER_STREAM_FO_NOTIFICATION_TYPE
;
5644 typedef union _FS_FILTER_PARAMETERS
{
5646 PLARGE_INTEGER EndingOffset
;
5647 PERESOURCE
*ResourceToRelease
;
5648 } AcquireForModifiedPageWriter
;
5651 PERESOURCE ResourceToRelease
;
5652 } ReleaseForModifiedPageWriter
;
5655 FS_FILTER_SECTION_SYNC_TYPE SyncType
;
5656 ULONG PageProtection
;
5657 } AcquireForSectionSynchronization
;
5660 FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType
;
5661 BOOLEAN POINTER_ALIGNMENT SafeToRecurse
;
5662 } NotifyStreamFileObject
;
5671 } FS_FILTER_PARAMETERS
, *PFS_FILTER_PARAMETERS
;
5673 typedef struct _FS_FILTER_CALLBACK_DATA
{
5674 ULONG SizeOfFsFilterCallbackData
;
5677 struct _DEVICE_OBJECT
*DeviceObject
;
5678 struct _FILE_OBJECT
*FileObject
;
5679 FS_FILTER_PARAMETERS Parameters
;
5680 } FS_FILTER_CALLBACK_DATA
, *PFS_FILTER_CALLBACK_DATA
;
5683 (NTAPI
*PFS_FILTER_CALLBACK
) (
5684 IN PFS_FILTER_CALLBACK_DATA Data
,
5685 OUT PVOID
*CompletionContext
5689 (NTAPI
*PFS_FILTER_COMPLETION_CALLBACK
) (
5690 IN PFS_FILTER_CALLBACK_DATA Data
,
5691 IN NTSTATUS OperationStatus
,
5692 IN PVOID CompletionContext
5695 typedef struct _FS_FILTER_CALLBACKS
{
5696 ULONG SizeOfFsFilterCallbacks
;
5698 PFS_FILTER_CALLBACK PreAcquireForSectionSynchronization
;
5699 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization
;
5700 PFS_FILTER_CALLBACK PreReleaseForSectionSynchronization
;
5701 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization
;
5702 PFS_FILTER_CALLBACK PreAcquireForCcFlush
;
5703 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush
;
5704 PFS_FILTER_CALLBACK PreReleaseForCcFlush
;
5705 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush
;
5706 PFS_FILTER_CALLBACK PreAcquireForModifiedPageWriter
;
5707 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter
;
5708 PFS_FILTER_CALLBACK PreReleaseForModifiedPageWriter
;
5709 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter
;
5710 } FS_FILTER_CALLBACKS
, *PFS_FILTER_CALLBACKS
;
5712 typedef struct _READ_LIST
{
5713 PFILE_OBJECT FileObject
;
5714 ULONG NumberOfEntries
;
5716 FILE_SEGMENT_ELEMENT List
[ANYSIZE_ARRAY
];
5717 } READ_LIST
, *PREAD_LIST
;
5725 IN PFILE_OBJECT FileObject
,
5726 IN ULONG BytesToWrite
,
5735 IN PFILE_OBJECT FileObject
,
5736 IN PLARGE_INTEGER FileOffset
,
5740 OUT PIO_STATUS_BLOCK IoStatus
5747 IN PFILE_OBJECT FileObject
,
5748 IN PLARGE_INTEGER FileOffset
,
5754 #define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
5756 typedef VOID (NTAPI
*PCC_POST_DEFERRED_WRITE
) (
5765 IN PFILE_OBJECT FileObject
,
5766 IN PCC_POST_DEFERRED_WRITE PostRoutine
,
5769 IN ULONG BytesToWrite
,
5777 IN PFILE_OBJECT FileObject
,
5778 IN ULONG FileOffset
,
5782 OUT PIO_STATUS_BLOCK IoStatus
5789 IN PFILE_OBJECT FileObject
,
5790 IN ULONG FileOffset
,
5799 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
5800 IN PLARGE_INTEGER FileOffset OPTIONAL
,
5802 OUT PIO_STATUS_BLOCK IoStatus OPTIONAL
5805 typedef VOID (NTAPI
*PDIRTY_PAGE_ROUTINE
) (
5806 IN PFILE_OBJECT FileObject
,
5807 IN PLARGE_INTEGER FileOffset
,
5809 IN PLARGE_INTEGER OldestLsn
,
5810 IN PLARGE_INTEGER NewestLsn
,
5820 IN PDIRTY_PAGE_ROUTINE DirtyPageRoutine
,
5828 CcGetFileObjectFromBcb (
5835 CcGetFileObjectFromSectionPtrs (
5836 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
5839 #define CcGetFileSizePointer(FO) ( \
5840 ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
5843 #if (VER_PRODUCTBUILD >= 2195)
5848 CcGetFlushedValidData (
5849 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
5850 IN BOOLEAN BcbListHeld
5853 #endif /* (VER_PRODUCTBUILD >= 2195) */
5858 CcGetLsnForFileObject (
5859 IN PFILE_OBJECT FileObject
,
5860 OUT PLARGE_INTEGER OldestLsn OPTIONAL
5863 typedef BOOLEAN (NTAPI
*PACQUIRE_FOR_LAZY_WRITE
) (
5868 typedef VOID (NTAPI
*PRELEASE_FROM_LAZY_WRITE
) (
5872 typedef BOOLEAN (NTAPI
*PACQUIRE_FOR_READ_AHEAD
) (
5877 typedef VOID (NTAPI
*PRELEASE_FROM_READ_AHEAD
) (
5881 typedef struct _CACHE_MANAGER_CALLBACKS
{
5882 PACQUIRE_FOR_LAZY_WRITE AcquireForLazyWrite
;
5883 PRELEASE_FROM_LAZY_WRITE ReleaseFromLazyWrite
;
5884 PACQUIRE_FOR_READ_AHEAD AcquireForReadAhead
;
5885 PRELEASE_FROM_READ_AHEAD ReleaseFromReadAhead
;
5886 } CACHE_MANAGER_CALLBACKS
, *PCACHE_MANAGER_CALLBACKS
;
5891 CcInitializeCacheMap (
5892 IN PFILE_OBJECT FileObject
,
5893 IN PCC_FILE_SIZES FileSizes
,
5894 IN BOOLEAN PinAccess
,
5895 IN PCACHE_MANAGER_CALLBACKS Callbacks
,
5896 IN PVOID LazyWriteContext
5899 #define CcIsFileCached(FO) ( \
5900 ((FO)->SectionObjectPointer != NULL) && \
5901 (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
5904 extern ULONG CcFastMdlReadWait
;
5909 CcIsThereDirtyData (
5917 IN PFILE_OBJECT FileObject
,
5918 IN PLARGE_INTEGER FileOffset
,
5929 IN PFILE_OBJECT FileObject
,
5930 IN PLARGE_INTEGER FileOffset
,
5933 OUT PIO_STATUS_BLOCK IoStatus
5940 IN PFILE_OBJECT FileObject
,
5947 CcMdlWriteComplete (
5948 IN PFILE_OBJECT FileObject
,
5949 IN PLARGE_INTEGER FileOffset
,
5959 IN PFILE_OBJECT FileObject
,
5960 IN PLARGE_INTEGER FileOffset
,
5970 IN PFILE_OBJECT FileObject
,
5971 IN PLARGE_INTEGER FileOffset
,
5982 IN PFILE_OBJECT FileObject
,
5983 IN PLARGE_INTEGER FileOffset
,
5986 OUT PIO_STATUS_BLOCK IoStatus
5993 IN PFILE_OBJECT FileObject
,
5994 IN PLARGE_INTEGER FileOffset
,
6005 CcPurgeCacheSection (
6006 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
6007 IN PLARGE_INTEGER FileOffset OPTIONAL
,
6009 IN BOOLEAN UninitializeCacheMaps
6012 #define CcReadAhead(FO, FOFF, LEN) ( \
6013 if ((LEN) >= 256) { \
6014 CcScheduleReadAhead((FO), (FOFF), (LEN)); \
6018 #if (VER_PRODUCTBUILD >= 2195)
6027 #endif /* (VER_PRODUCTBUILD >= 2195) */
6039 CcScheduleReadAhead (
6040 IN PFILE_OBJECT FileObject
,
6041 IN PLARGE_INTEGER FileOffset
,
6048 CcSetAdditionalCacheAttributes (
6049 IN PFILE_OBJECT FileObject
,
6050 IN BOOLEAN DisableReadAhead
,
6051 IN BOOLEAN DisableWriteBehind
6057 CcSetBcbOwnerPointer (
6059 IN PVOID OwnerPointer
6065 CcSetDirtyPageThreshold (
6066 IN PFILE_OBJECT FileObject
,
6067 IN ULONG DirtyPageThreshold
6073 CcSetDirtyPinnedData (
6075 IN PLARGE_INTEGER Lsn OPTIONAL
6082 IN PFILE_OBJECT FileObject
,
6083 IN PCC_FILE_SIZES FileSizes
6086 typedef VOID (NTAPI
*PFLUSH_TO_LSN
) (
6088 IN LARGE_INTEGER Lsn
6094 CcSetLogHandleForFile (
6095 IN PFILE_OBJECT FileObject
,
6097 IN PFLUSH_TO_LSN FlushToLsnRoutine
6103 CcSetReadAheadGranularity (
6104 IN PFILE_OBJECT FileObject
,
6105 IN ULONG Granularity
/* default: PAGE_SIZE */
6106 /* allowed: 2^n * PAGE_SIZE */
6112 CcUninitializeCacheMap (
6113 IN PFILE_OBJECT FileObject
,
6114 IN PLARGE_INTEGER TruncateSize OPTIONAL
,
6115 IN PCACHE_UNINITIALIZE_EVENT UninitializeCompleteEvent OPTIONAL
6128 CcUnpinDataForThread (
6130 IN ERESOURCE_THREAD ResourceThreadId
6136 CcUnpinRepinnedBcb (
6138 IN BOOLEAN WriteThrough
,
6139 OUT PIO_STATUS_BLOCK IoStatus
6142 #if (VER_PRODUCTBUILD >= 2195)
6147 CcWaitForCurrentLazyWriterActivity (
6151 #endif /* (VER_PRODUCTBUILD >= 2195) */
6157 IN PFILE_OBJECT FileObject
,
6158 IN PLARGE_INTEGER StartOffset
,
6159 IN PLARGE_INTEGER EndOffset
,
6166 ExDisableResourceBoostLite (
6167 IN PERESOURCE Resource
6173 ExQueryPoolBlockSize (
6175 OUT PBOOLEAN QuotaCharged
6178 #if (VER_PRODUCTBUILD >= 2600)
6180 #ifndef __NTOSKRNL__
6184 ExInitializeRundownProtection (
6185 IN PEX_RUNDOWN_REF RunRef
6191 ExReInitializeRundownProtection (
6192 IN PEX_RUNDOWN_REF RunRef
6198 ExAcquireRundownProtection (
6199 IN PEX_RUNDOWN_REF RunRef
6205 ExAcquireRundownProtectionEx (
6206 IN PEX_RUNDOWN_REF RunRef
,
6213 ExReleaseRundownProtection (
6214 IN PEX_RUNDOWN_REF RunRef
6220 ExReleaseRundownProtectionEx (
6221 IN PEX_RUNDOWN_REF RunRef
,
6228 ExRundownCompleted (
6229 IN PEX_RUNDOWN_REF RunRef
6235 ExWaitForRundownProtectionRelease (
6236 IN PEX_RUNDOWN_REF RunRef
6240 #endif /* (VER_PRODUCTBUILD >= 2600) */
6243 #define FsRtlSetupAdvancedHeader( _advhdr, _fmutx ) \
6245 SetFlag( (_advhdr)->Flags, FSRTL_FLAG_ADVANCED_HEADER ); \
6246 SetFlag( (_advhdr)->Flags2, FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS ); \
6247 (_advhdr)->Version = FSRTL_FCB_HEADER_V1; \
6248 InitializeListHead( &(_advhdr)->FilterContexts ); \
6249 if ((_fmutx) != NULL) { \
6250 (_advhdr)->FastMutex = (_fmutx); \
6252 *((PULONG_PTR)(&(_advhdr)->PushLock)) = 0; \
6253 /*ExInitializePushLock( &(_advhdr)->PushLock ); API Not avaliable downlevel*/\
6254 (_advhdr)->FileContextSupportPointer = NULL; \
6260 FsRtlAddBaseMcbEntry (
6264 IN LONGLONG SectorCount
6270 FsRtlAddLargeMcbEntry (
6274 IN LONGLONG SectorCount
6284 IN ULONG SectorCount
6290 FsRtlAddToTunnelCache (
6292 IN ULONGLONG DirectoryKey
,
6293 IN PUNICODE_STRING ShortName
,
6294 IN PUNICODE_STRING LongName
,
6295 IN BOOLEAN KeyByShortName
,
6296 IN ULONG DataLength
,
6300 #if (VER_PRODUCTBUILD >= 2195)
6304 FsRtlAllocateFileLock (
6305 IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL
,
6306 IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
6309 #endif /* (VER_PRODUCTBUILD >= 2195) */
6315 IN POOL_TYPE PoolType
,
6316 IN ULONG NumberOfBytes
6322 FsRtlAllocatePoolWithQuota (
6323 IN POOL_TYPE PoolType
,
6324 IN ULONG NumberOfBytes
6330 FsRtlAllocatePoolWithQuotaTag (
6331 IN POOL_TYPE PoolType
,
6332 IN ULONG NumberOfBytes
,
6339 FsRtlAllocatePoolWithTag (
6340 IN POOL_TYPE PoolType
,
6341 IN ULONG NumberOfBytes
,
6348 FsRtlAreNamesEqual (
6349 IN PCUNICODE_STRING Name1
,
6350 IN PCUNICODE_STRING Name2
,
6351 IN BOOLEAN IgnoreCase
,
6352 IN PCWCH UpcaseTable OPTIONAL
6355 #define FsRtlAreThereCurrentFileLocks(FL) ( \
6356 ((FL)->FastIoIsQuestionable) \
6360 FsRtlCheckLockForReadAccess:
6362 All this really does is pick out the lock parameters from the irp (io stack
6363 location?), get IoGetRequestorProcess, and pass values on to
6364 FsRtlFastCheckLockForRead.
6369 FsRtlCheckLockForReadAccess (
6370 IN PFILE_LOCK FileLock
,
6375 FsRtlCheckLockForWriteAccess:
6377 All this really does is pick out the lock parameters from the irp (io stack
6378 location?), get IoGetRequestorProcess, and pass values on to
6379 FsRtlFastCheckLockForWrite.
6384 FsRtlCheckLockForWriteAccess (
6385 IN PFILE_LOCK FileLock
,
6391 (NTAPI
*POPLOCK_WAIT_COMPLETE_ROUTINE
) (
6398 (NTAPI
*POPLOCK_FS_PREPOST_IRP
) (
6410 IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL
,
6411 IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL
6418 IN PFILE_OBJECT FileObject
,
6419 IN PLARGE_INTEGER FileOffset
,
6424 OUT PIO_STATUS_BLOCK IoStatus
,
6425 IN PDEVICE_OBJECT DeviceObject
6432 IN PFILE_OBJECT FileObject
,
6433 IN PLARGE_INTEGER FileOffset
,
6438 OUT PIO_STATUS_BLOCK IoStatus
,
6439 IN PDEVICE_OBJECT DeviceObject
6445 FsRtlCurrentBatchOplock (
6452 FsRtlDeleteKeyFromTunnelCache (
6454 IN ULONGLONG DirectoryKey
6460 FsRtlDeleteTunnelCache (
6467 FsRtlDeregisterUncProvider (
6475 IN ANSI_STRING Name
,
6476 OUT PANSI_STRING FirstPart
,
6477 OUT PANSI_STRING RemainingPart
6484 IN UNICODE_STRING Name
,
6485 OUT PUNICODE_STRING FirstPart
,
6486 OUT PUNICODE_STRING RemainingPart
6492 FsRtlDoesDbcsContainWildCards (
6493 IN PANSI_STRING Name
6499 FsRtlDoesNameContainWildCards (
6500 IN PUNICODE_STRING Name
6506 FsRtlIsFatDbcsLegal (
6507 IN ANSI_STRING DbcsName
,
6508 IN BOOLEAN WildCardsPermissible
,
6509 IN BOOLEAN PathNamePermissible
,
6510 IN BOOLEAN LeadingBackslashPermissible
6514 #define FsRtlCompleteRequest(IRP,STATUS) { \
6515 (IRP)->IoStatus.Status = (STATUS); \
6516 IoCompleteRequest( (IRP), IO_DISK_INCREMENT ); \
6519 #define FsRtlEnterFileSystem KeEnterCriticalRegion
6521 #define FsRtlExitFileSystem KeLeaveCriticalRegion
6526 FsRtlFastCheckLockForRead (
6527 IN PFILE_LOCK FileLock
,
6528 IN PLARGE_INTEGER FileOffset
,
6529 IN PLARGE_INTEGER Length
,
6531 IN PFILE_OBJECT FileObject
,
6538 FsRtlFastCheckLockForWrite (
6539 IN PFILE_LOCK FileLock
,
6540 IN PLARGE_INTEGER FileOffset
,
6541 IN PLARGE_INTEGER Length
,
6543 IN PFILE_OBJECT FileObject
,
6547 #define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) ( \
6548 FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11) \
6554 FsRtlFastUnlockAll (
6555 IN PFILE_LOCK FileLock
,
6556 IN PFILE_OBJECT FileObject
,
6557 IN PEPROCESS Process
,
6558 IN PVOID Context OPTIONAL
6560 /* ret: STATUS_RANGE_NOT_LOCKED */
6565 FsRtlFastUnlockAllByKey (
6566 IN PFILE_LOCK FileLock
,
6567 IN PFILE_OBJECT FileObject
,
6568 IN PEPROCESS Process
,
6570 IN PVOID Context OPTIONAL
6572 /* ret: STATUS_RANGE_NOT_LOCKED */
6577 FsRtlFastUnlockSingle (
6578 IN PFILE_LOCK FileLock
,
6579 IN PFILE_OBJECT FileObject
,
6580 IN PLARGE_INTEGER FileOffset
,
6581 IN PLARGE_INTEGER Length
,
6582 IN PEPROCESS Process
,
6584 IN PVOID Context OPTIONAL
,
6585 IN BOOLEAN AlreadySynchronized
6587 /* ret: STATUS_RANGE_NOT_LOCKED */
6592 FsRtlFindInTunnelCache (
6594 IN ULONGLONG DirectoryKey
,
6595 IN PUNICODE_STRING Name
,
6596 OUT PUNICODE_STRING ShortName
,
6597 OUT PUNICODE_STRING LongName
,
6598 IN OUT PULONG DataLength
,
6602 #if (VER_PRODUCTBUILD >= 2195)
6608 IN PFILE_LOCK FileLock
6611 #endif /* (VER_PRODUCTBUILD >= 2195) */
6617 IN PFILE_OBJECT FileObject
,
6618 IN OUT PLARGE_INTEGER FileSize
6624 FsRtlGetNextBaseMcbEntry (
6629 OUT PLONGLONG SectorCount
6633 FsRtlGetNextFileLock:
6635 ret: NULL if no more locks
6638 FsRtlGetNextFileLock uses FileLock->LastReturnedLockInfo and
6639 FileLock->LastReturnedLock as storage.
6640 LastReturnedLock is a pointer to the 'raw' lock inkl. double linked
6641 list, and FsRtlGetNextFileLock needs this to get next lock on subsequent
6642 calls with Restart = FALSE.
6647 FsRtlGetNextFileLock (
6648 IN PFILE_LOCK FileLock
,
6655 FsRtlGetNextLargeMcbEntry (
6660 OUT PLONGLONG SectorCount
6666 FsRtlGetNextMcbEntry (
6671 OUT PULONG SectorCount
6674 #define FsRtlGetPerStreamContextPointer(FO) ( \
6675 (PFSRTL_ADVANCED_FCB_HEADER)(FO)->FsContext \
6681 FsRtlInitializeBaseMcb (
6683 IN POOL_TYPE PoolType
6689 FsRtlInitializeFileLock (
6690 IN PFILE_LOCK FileLock
,
6691 IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL
,
6692 IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
6698 FsRtlInitializeLargeMcb (
6700 IN POOL_TYPE PoolType
6706 FsRtlInitializeMcb (
6708 IN POOL_TYPE PoolType
6714 FsRtlInitializeOplock (
6715 IN OUT POPLOCK Oplock
6721 FsRtlInitializeTunnelCache (
6725 #define FsRtlInitPerStreamContext(PSC, O, I, FC) ( \
6726 (PSC)->OwnerId = (O), \
6727 (PSC)->InstanceId = (I), \
6728 (PSC)->FreeCallback = (FC) \
6734 FsRtlInsertPerStreamContext (
6735 IN PFSRTL_ADVANCED_FCB_HEADER PerStreamContext
,
6736 IN PFSRTL_PER_STREAM_CONTEXT Ptr
6739 #define FsRtlIsAnsiCharacterLegalFat(C, WILD) ( \
6740 FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_FAT_LEGAL) | \
6741 ((WILD) ? FSRTL_WILD_CHARACTER : 0 )) \
6744 #define FsRtlIsAnsiCharacterLegalHpfs(C, WILD) ( \
6745 FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_HPFS_LEGAL) | \
6746 ((WILD) ? FSRTL_WILD_CHARACTER : 0 )) \
6749 #define FsRtlIsAnsiCharacterLegalNtfs(C, WILD) ( \
6750 FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_NTFS_LEGAL) | \
6751 ((WILD) ? FSRTL_WILD_CHARACTER : 0 )) \
6754 #define FsRtlIsAnsiCharacterWild(C) ( \
6755 FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], FSRTL_WILD_CHARACTER ) \
6761 FsRtlIsFatDbcsLegal (
6762 IN ANSI_STRING DbcsName
,
6763 IN BOOLEAN WildCardsPermissible
,
6764 IN BOOLEAN PathNamePermissible
,
6765 IN BOOLEAN LeadingBackslashPermissible
6771 FsRtlIsHpfsDbcsLegal (
6772 IN ANSI_STRING DbcsName
,
6773 IN BOOLEAN WildCardsPermissible
,
6774 IN BOOLEAN PathNamePermissible
,
6775 IN BOOLEAN LeadingBackslashPermissible
6781 FsRtlIsNameInExpression (
6782 IN PUNICODE_STRING Expression
,
6783 IN PUNICODE_STRING Name
,
6784 IN BOOLEAN IgnoreCase
,
6785 IN PWCHAR UpcaseTable OPTIONAL
6791 FsRtlIsNtstatusExpected (
6792 IN NTSTATUS Ntstatus
6795 #define NLS_OEM_LEAD_BYTE_INFO NlsOemLeadByteInfo
6797 extern PUSHORT NlsOemLeadByteInfo
;
6799 #define FsRtlIsLeadDbcsCharacter(DBCS_CHAR) ( \
6800 (BOOLEAN)((UCHAR)(DBCS_CHAR) < 0x80 ? FALSE : \
6801 (NLS_MB_CODE_PAGE_TAG && \
6802 (NLS_OEM_LEAD_BYTE_INFO[(UCHAR)(DBCS_CHAR)] != 0))) \
6805 #define FsRtlIsUnicodeCharacterWild(C) ( \
6808 FlagOn(FsRtlLegalAnsiCharacterArray[(C)], FSRTL_WILD_CHARACTER )) \
6814 FsRtlLookupBaseMcbEntry (
6817 OUT PLONGLONG Lbn OPTIONAL
,
6818 OUT PLONGLONG SectorCountFromLbn OPTIONAL
,
6819 OUT PLONGLONG StartingLbn OPTIONAL
,
6820 OUT PLONGLONG SectorCountFromStartingLbn OPTIONAL
,
6821 OUT PULONG Index OPTIONAL
6827 FsRtlLookupLargeMcbEntry (
6830 OUT PLONGLONG Lbn OPTIONAL
,
6831 OUT PLONGLONG SectorCountFromLbn OPTIONAL
,
6832 OUT PLONGLONG StartingLbn OPTIONAL
,
6833 OUT PLONGLONG SectorCountFromStartingLbn OPTIONAL
,
6834 OUT PULONG Index OPTIONAL
6840 FsRtlLookupLastBaseMcbEntry (
6849 FsRtlLookupLastLargeMcbEntry (
6858 FsRtlLookupLastMcbEntry (
6867 FsRtlLookupLastBaseMcbEntryAndIndex (
6868 IN PBASE_MCB OpaqueMcb
,
6869 IN OUT PLONGLONG LargeVbn
,
6870 IN OUT PLONGLONG LargeLbn
,
6877 FsRtlLookupLastLargeMcbEntryAndIndex (
6878 IN PLARGE_MCB OpaqueMcb
,
6879 OUT PLONGLONG LargeVbn
,
6880 OUT PLONGLONG LargeLbn
,
6887 FsRtlLookupMcbEntry (
6891 OUT PULONG SectorCount OPTIONAL
,
6896 PFSRTL_PER_STREAM_CONTEXT
6898 FsRtlLookupPerStreamContextInternal (
6899 IN PFSRTL_ADVANCED_FCB_HEADER StreamContext
,
6900 IN PVOID OwnerId OPTIONAL
,
6901 IN PVOID InstanceId OPTIONAL
6908 IN PFILE_OBJECT FileObject
,
6909 IN PLARGE_INTEGER FileOffset
,
6913 OUT PIO_STATUS_BLOCK IoStatus
,
6914 IN PDEVICE_OBJECT DeviceObject
6920 FsRtlMdlReadComplete (
6921 IN PFILE_OBJECT FileObject
,
6928 FsRtlMdlReadCompleteDev (
6929 IN PFILE_OBJECT FileObject
,
6931 IN PDEVICE_OBJECT DeviceObject
6937 FsRtlPrepareMdlWriteDev (
6938 IN PFILE_OBJECT FileObject
,
6939 IN PLARGE_INTEGER FileOffset
,
6943 OUT PIO_STATUS_BLOCK IoStatus
,
6944 IN PDEVICE_OBJECT DeviceObject
6950 FsRtlMdlWriteComplete (
6951 IN PFILE_OBJECT FileObject
,
6952 IN PLARGE_INTEGER FileOffset
,
6959 FsRtlMdlWriteCompleteDev (
6960 IN PFILE_OBJECT FileObject
,
6961 IN PLARGE_INTEGER FileOffset
,
6963 IN PDEVICE_OBJECT DeviceObject
6969 FsRtlNormalizeNtstatus (
6970 IN NTSTATUS Exception
,
6971 IN NTSTATUS GenericException
6977 FsRtlNotifyChangeDirectory (
6978 IN PNOTIFY_SYNC NotifySync
,
6980 IN PSTRING FullDirectoryName
,
6981 IN PLIST_ENTRY NotifyList
,
6982 IN BOOLEAN WatchTree
,
6983 IN ULONG CompletionFilter
,
6990 FsRtlNotifyCleanup (
6991 IN PNOTIFY_SYNC NotifySync
,
6992 IN PLIST_ENTRY NotifyList
,
6996 typedef BOOLEAN (NTAPI
*PCHECK_FOR_TRAVERSE_ACCESS
) (
6997 IN PVOID NotifyContext
,
6998 IN PVOID TargetContext
,
6999 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
7005 FsRtlNotifyFilterChangeDirectory (
7006 IN PNOTIFY_SYNC NotifySync
,
7007 IN PLIST_ENTRY NotifyList
,
7009 IN PSTRING FullDirectoryName
,
7010 IN BOOLEAN WatchTree
,
7011 IN BOOLEAN IgnoreBuffer
,
7012 IN ULONG CompletionFilter
,
7014 IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL
,
7015 IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL
,
7016 IN PFILTER_REPORT_CHANGE FilterCallback OPTIONAL
);
7021 FsRtlNotifyFilterReportChange (
7022 IN PNOTIFY_SYNC NotifySync
,
7023 IN PLIST_ENTRY NotifyList
,
7024 IN PSTRING FullTargetName
,
7025 IN USHORT TargetNameOffset
,
7026 IN PSTRING StreamName OPTIONAL
,
7027 IN PSTRING NormalizedParentName OPTIONAL
,
7028 IN ULONG FilterMatch
,
7030 IN PVOID TargetContext
,
7031 IN PVOID FilterContext
);
7036 FsRtlNotifyFullChangeDirectory (
7037 IN PNOTIFY_SYNC NotifySync
,
7038 IN PLIST_ENTRY NotifyList
,
7040 IN PSTRING FullDirectoryName
,
7041 IN BOOLEAN WatchTree
,
7042 IN BOOLEAN IgnoreBuffer
,
7043 IN ULONG CompletionFilter
,
7045 IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL
,
7046 IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL
7052 FsRtlNotifyFullReportChange (
7053 IN PNOTIFY_SYNC NotifySync
,
7054 IN PLIST_ENTRY NotifyList
,
7055 IN PSTRING FullTargetName
,
7056 IN USHORT TargetNameOffset
,
7057 IN PSTRING StreamName OPTIONAL
,
7058 IN PSTRING NormalizedParentName OPTIONAL
,
7059 IN ULONG FilterMatch
,
7061 IN PVOID TargetContext
7067 FsRtlNotifyInitializeSync (
7068 IN PNOTIFY_SYNC
*NotifySync
7074 FsRtlNotifyUninitializeSync (
7075 IN PNOTIFY_SYNC
*NotifySync
7078 #if (VER_PRODUCTBUILD >= 2195)
7083 FsRtlNotifyVolumeEvent (
7084 IN PFILE_OBJECT FileObject
,
7088 #endif /* (VER_PRODUCTBUILD >= 2195) */
7093 FsRtlNumberOfRunsInBaseMcb (
7100 FsRtlNumberOfRunsInLargeMcb (
7107 FsRtlNumberOfRunsInMcb (
7123 FsRtlOplockIsFastIoPossible (
7128 (NTAPI
*PFSRTL_STACK_OVERFLOW_ROUTINE
) (
7136 FsRtlPostPagingFileStackOverflow (
7139 IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine
7145 FsRtlPostStackOverflow (
7148 IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine
7154 ret: IoStatus->Status: STATUS_PENDING, STATUS_LOCK_NOT_GRANTED
7157 -Calls IoCompleteRequest if Irp
7158 -Uses exception handling / ExRaiseStatus with STATUS_INSUFFICIENT_RESOURCES
7164 IN PFILE_LOCK FileLock
,
7165 IN PFILE_OBJECT FileObject
,
7166 IN PLARGE_INTEGER FileOffset
,
7167 IN PLARGE_INTEGER Length
,
7168 IN PEPROCESS Process
,
7170 IN BOOLEAN FailImmediately
,
7171 IN BOOLEAN ExclusiveLock
,
7172 OUT PIO_STATUS_BLOCK IoStatus
,
7173 IN PIRP Irp OPTIONAL
,
7175 IN BOOLEAN AlreadySynchronized
7179 FsRtlProcessFileLock:
7182 -STATUS_INVALID_DEVICE_REQUEST
7183 -STATUS_RANGE_NOT_LOCKED from unlock routines.
7184 -STATUS_PENDING, STATUS_LOCK_NOT_GRANTED from FsRtlPrivateLock
7185 (redirected IoStatus->Status).
7188 -switch ( Irp->CurrentStackLocation->MinorFunction )
7189 lock: return FsRtlPrivateLock;
7190 unlocksingle: return FsRtlFastUnlockSingle;
7191 unlockall: return FsRtlFastUnlockAll;
7192 unlockallbykey: return FsRtlFastUnlockAllByKey;
7193 default: IofCompleteRequest with STATUS_INVALID_DEVICE_REQUEST;
7194 return STATUS_INVALID_DEVICE_REQUEST;
7196 -'AllwaysZero' is passed thru as 'AllwaysZero' to lock / unlock routines.
7197 -'Irp' is passet thru as 'Irp' to FsRtlPrivateLock.
7202 FsRtlProcessFileLock (
7203 IN PFILE_LOCK FileLock
,
7205 IN PVOID Context OPTIONAL
7211 FsRtlRegisterUncProvider (
7212 IN OUT PHANDLE MupHandle
,
7213 IN PUNICODE_STRING RedirectorDeviceName
,
7214 IN BOOLEAN MailslotsSupported
7220 FsRtlRemoveBaseMcbEntry (
7223 IN LONGLONG SectorCount
7229 FsRtlRemoveLargeMcbEntry (
7232 IN LONGLONG SectorCount
7238 FsRtlRemoveMcbEntry (
7241 IN ULONG SectorCount
7245 PFSRTL_PER_STREAM_CONTEXT
7247 FsRtlRemovePerStreamContext (
7248 IN PFSRTL_ADVANCED_FCB_HEADER StreamContext
,
7249 IN PVOID OwnerId OPTIONAL
,
7250 IN PVOID InstanceId OPTIONAL
7263 FsRtlResetLargeMcb (
7265 IN BOOLEAN SelfSynchronized
7280 FsRtlSplitLargeMcb (
7286 #define FsRtlSupportsPerStreamContexts(FO) ( \
7287 (BOOLEAN)((NULL != FsRtlGetPerStreamContextPointer(FO) && \
7288 FlagOn(FsRtlGetPerStreamContextPointer(FO)->Flags2, \
7289 FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS)) \
7295 FsRtlTruncateBaseMcb (
7303 FsRtlTruncateLargeMcb (
7319 FsRtlUninitializeBaseMcb (
7326 FsRtlUninitializeFileLock (
7327 IN PFILE_LOCK FileLock
7333 FsRtlUninitializeLargeMcb (
7340 FsRtlUninitializeMcb (
7347 FsRtlUninitializeOplock (
7348 IN OUT POPLOCK Oplock
7354 KeSetIdealProcessorThread(
7355 IN OUT PKTHREAD Thread
,
7362 IoAttachDeviceToDeviceStackSafe(
7363 IN PDEVICE_OBJECT SourceDevice
,
7364 IN PDEVICE_OBJECT TargetDevice
,
7365 OUT PDEVICE_OBJECT
*AttachedToDeviceObject
7371 IoAcquireVpbSpinLock (
7378 IoCheckDesiredAccess (
7379 IN OUT PACCESS_MASK DesiredAccess
,
7380 IN ACCESS_MASK GrantedAccess
7386 IoCheckEaBufferValidity (
7387 IN PFILE_FULL_EA_INFORMATION EaBuffer
,
7389 OUT PULONG ErrorOffset
7395 IoCheckFunctionAccess (
7396 IN ACCESS_MASK GrantedAccess
,
7397 IN UCHAR MajorFunction
,
7398 IN UCHAR MinorFunction
,
7399 IN ULONG IoControlCode
,
7400 IN PVOID Argument1 OPTIONAL
,
7401 IN PVOID Argument2 OPTIONAL
7404 #if (VER_PRODUCTBUILD >= 2195)
7409 IoCheckQuotaBufferValidity (
7410 IN PFILE_QUOTA_INFORMATION QuotaBuffer
,
7411 IN ULONG QuotaLength
,
7412 OUT PULONG ErrorOffset
7415 #endif /* (VER_PRODUCTBUILD >= 2195) */
7420 IoCreateStreamFileObject (
7421 IN PFILE_OBJECT FileObject OPTIONAL
,
7422 IN PDEVICE_OBJECT DeviceObject OPTIONAL
7425 #if (VER_PRODUCTBUILD >= 2195)
7430 IoCreateStreamFileObjectLite (
7431 IN PFILE_OBJECT FileObject OPTIONAL
,
7432 IN PDEVICE_OBJECT DeviceObject OPTIONAL
7435 #endif /* (VER_PRODUCTBUILD >= 2195) */
7440 IoFastQueryNetworkAttributes (
7441 IN POBJECT_ATTRIBUTES ObjectAttributes
,
7442 IN ACCESS_MASK DesiredAccess
,
7443 IN ULONG OpenOptions
,
7444 OUT PIO_STATUS_BLOCK IoStatus
,
7445 OUT PFILE_NETWORK_OPEN_INFORMATION Buffer
7451 IoGetAttachedDevice (
7452 IN PDEVICE_OBJECT DeviceObject
7458 IoGetBaseFileSystemDeviceObject (
7459 IN PFILE_OBJECT FileObject
7462 #if (VER_PRODUCTBUILD >= 2600)
7467 IoGetDeviceAttachmentBaseRef (
7468 IN PDEVICE_OBJECT DeviceObject
7474 IoGetDiskDeviceObject (
7475 IN PDEVICE_OBJECT FileSystemDeviceObject
,
7476 OUT PDEVICE_OBJECT
*DiskDeviceObject
7482 IoGetLowerDeviceObject (
7483 IN PDEVICE_OBJECT DeviceObject
7486 #endif /* (VER_PRODUCTBUILD >= 2600) */
7491 IoGetRequestorProcess (
7495 #if (VER_PRODUCTBUILD >= 2195)
7500 IoGetRequestorProcessId (
7504 #endif /* (VER_PRODUCTBUILD >= 2195) */
7513 #define IoIsFileOpenedExclusively(FileObject) ( \
7515 (FileObject)->SharedRead || \
7516 (FileObject)->SharedWrite || \
7517 (FileObject)->SharedDelete \
7524 IoIsOperationSynchronous (
7535 #if (VER_PRODUCTBUILD >= 2195)
7540 IoIsValidNameGraftingBuffer (
7542 IN PREPARSE_DATA_BUFFER ReparseBuffer
7545 #endif /* (VER_PRODUCTBUILD >= 2195) */
7551 IN PFILE_OBJECT FileObject
,
7553 IN PLARGE_INTEGER Offset
,
7555 OUT PIO_STATUS_BLOCK IoStatusBlock
7561 IoQueryFileInformation (
7562 IN PFILE_OBJECT FileObject
,
7563 IN FILE_INFORMATION_CLASS FileInformationClass
,
7565 OUT PVOID FileInformation
,
7566 OUT PULONG ReturnedLength
7572 IoQueryVolumeInformation (
7573 IN PFILE_OBJECT FileObject
,
7574 IN FS_INFORMATION_CLASS FsInformationClass
,
7576 OUT PVOID FsInformation
,
7577 OUT PULONG ReturnedLength
7590 IoRegisterFileSystem (
7591 IN OUT PDEVICE_OBJECT DeviceObject
7594 #if (VER_PRODUCTBUILD >= 1381)
7596 typedef VOID (NTAPI
*PDRIVER_FS_NOTIFICATION
) (
7597 IN PDEVICE_OBJECT DeviceObject
,
7598 IN BOOLEAN DriverActive
7604 IoRegisterFsRegistrationChange (
7605 IN PDRIVER_OBJECT DriverObject
,
7606 IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
7609 #endif /* (VER_PRODUCTBUILD >= 1381) */
7614 IoReleaseVpbSpinLock (
7621 IoSetDeviceToVerify (
7623 IN PDEVICE_OBJECT DeviceObject
7630 IN PFILE_OBJECT FileObject
,
7631 IN FILE_INFORMATION_CLASS FileInformationClass
,
7633 IN PVOID FileInformation
7646 IoSynchronousPageWrite (
7647 IN PFILE_OBJECT FileObject
,
7649 IN PLARGE_INTEGER FileOffset
,
7651 OUT PIO_STATUS_BLOCK IoStatusBlock
7664 IoUnregisterFileSystem (
7665 IN OUT PDEVICE_OBJECT DeviceObject
7668 #if (VER_PRODUCTBUILD >= 1381)
7673 IoUnregisterFsRegistrationChange (
7674 IN PDRIVER_OBJECT DriverObject
,
7675 IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
7678 #endif /* (VER_PRODUCTBUILD >= 1381) */
7684 IN PDEVICE_OBJECT DeviceObject
,
7685 IN BOOLEAN AllowRawMount
7688 #if !defined (_M_AMD64)
7693 KeAcquireQueuedSpinLock (
7694 IN KSPIN_LOCK_QUEUE_NUMBER Number
7700 KeReleaseQueuedSpinLock (
7701 IN KSPIN_LOCK_QUEUE_NUMBER Number
,
7708 KeAcquireSpinLockRaiseToSynch(
7709 IN OUT PKSPIN_LOCK SpinLock
7715 KeTryToAcquireQueuedSpinLock(
7716 KSPIN_LOCK_QUEUE_NUMBER Number
,
7724 KeAcquireQueuedSpinLock (
7725 IN KSPIN_LOCK_QUEUE_NUMBER Number
7731 KeReleaseQueuedSpinLock (
7732 IN KSPIN_LOCK_QUEUE_NUMBER Number
,
7738 KeAcquireSpinLockRaiseToSynch(
7739 IN OUT PKSPIN_LOCK SpinLock
7744 KeTryToAcquireQueuedSpinLock(
7745 KSPIN_LOCK_QUEUE_NUMBER Number
,
7754 IN PKPROCESS Process
7769 IN ULONG Count OPTIONAL
7777 IN PLIST_ENTRY Entry
7785 IN PLIST_ENTRY Entry
7800 IN KPROCESSOR_MODE WaitMode
,
7801 IN PLARGE_INTEGER Timeout OPTIONAL
7814 KeInitializeMutant (
7815 IN PRKMUTANT Mutant
,
7816 IN BOOLEAN InitialOwner
7830 IN PRKMUTANT Mutant
,
7831 IN KPRIORITY Increment
,
7832 IN BOOLEAN Abandoned
,
7836 #if (VER_PRODUCTBUILD >= 2195)
7841 KeStackAttachProcess (
7842 IN PKPROCESS Process
,
7843 OUT PKAPC_STATE ApcState
7849 KeUnstackDetachProcess (
7850 IN PKAPC_STATE ApcState
7853 #endif /* (VER_PRODUCTBUILD >= 2195) */
7858 KeSetKernelStackSwapEnable(
7865 MmCanFileBeTruncated (
7866 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
7867 IN PLARGE_INTEGER NewFileSize
7873 MmFlushImageSection (
7874 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
7875 IN MMFLUSH_TYPE FlushType
7881 MmForceSectionClosed (
7882 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
7883 IN BOOLEAN DelayClose
7886 #if (VER_PRODUCTBUILD >= 1381)
7891 MmIsRecursiveIoFault (
7897 #define MmIsRecursiveIoFault() ( \
7898 (PsGetCurrentThread()->DisablePageFaultClustering) | \
7899 (PsGetCurrentThread()->ForwardClusterOnly) \
7908 MmSetAddressRangeModified (
7917 IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL
,
7918 IN POBJECT_TYPE ObjectType
,
7919 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL
,
7920 IN KPROCESSOR_MODE AccessMode
,
7921 IN OUT PVOID ParseContext OPTIONAL
,
7922 IN ULONG ObjectSize
,
7923 IN ULONG PagedPoolCharge OPTIONAL
,
7924 IN ULONG NonPagedPoolCharge OPTIONAL
,
7931 ObGetObjectPointerCount (
7935 #if (NTDDI_VERSION >= NTDDI_WIN2K)
7942 IN PACCESS_STATE PassedAccessState OPTIONAL
,
7943 IN ACCESS_MASK DesiredAccess OPTIONAL
,
7944 IN ULONG ObjectPointerBias
,
7945 OUT PVOID
*NewObject OPTIONAL
,
7946 OUT PHANDLE Handle OPTIONAL
);
7951 ObOpenObjectByPointer (
7953 IN ULONG HandleAttributes
,
7954 IN PACCESS_STATE PassedAccessState OPTIONAL
,
7955 IN ACCESS_MASK DesiredAccess OPTIONAL
,
7956 IN POBJECT_TYPE ObjectType OPTIONAL
,
7957 IN KPROCESSOR_MODE AccessMode
,
7958 OUT PHANDLE Handle
);
7963 ObMakeTemporaryObject (
7969 ObQueryObjectAuditingByHandle (
7971 OUT PBOOLEAN GenerateOnClose
);
7980 OUT POBJECT_NAME_INFORMATION ObjectNameInfo
,
7982 OUT PULONG ReturnLength
7988 ObReferenceObjectByName (
7989 IN PUNICODE_STRING ObjectName
,
7990 IN ULONG Attributes
,
7991 IN PACCESS_STATE PassedAccessState OPTIONAL
,
7992 IN ACCESS_MASK DesiredAccess OPTIONAL
,
7993 IN POBJECT_TYPE ObjectType
,
7994 IN KPROCESSOR_MODE AccessMode
,
7995 IN OUT PVOID ParseContext OPTIONAL
,
8002 PsAssignImpersonationToken (
8011 IN PEPROCESS Process
,
8012 IN POOL_TYPE PoolType
,
8019 PsChargeProcessPoolQuota (
8020 IN PEPROCESS Process
,
8021 IN POOL_TYPE PoolType
,
8025 #define PsDereferenceImpersonationToken(T) \
8026 {if (ARGUMENT_PRESENT(T)) { \
8027 (ObDereferenceObject((T))); \
8033 #define PsDereferencePrimaryToken(T) (ObDereferenceObject((T)))
8038 PsDisableImpersonation(
8040 IN PSE_IMPERSONATION_STATE ImpersonationState
8046 PsGetProcessExitTime (
8053 PsImpersonateClient(
8055 IN PACCESS_TOKEN Token
,
8056 IN BOOLEAN CopyOnOpen
,
8057 IN BOOLEAN EffectiveOnly
,
8058 IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
8071 PsIsThreadTerminating (
8078 PsLookupProcessByProcessId (
8079 IN HANDLE ProcessId
,
8080 OUT PEPROCESS
*Process
8086 PsLookupProcessThreadByCid (
8088 OUT PEPROCESS
*Process OPTIONAL
,
8089 OUT PETHREAD
*Thread
8095 PsLookupThreadByThreadId (
8096 IN HANDLE UniqueThreadId
,
8097 OUT PETHREAD
*Thread
8103 PsReferenceImpersonationToken (
8105 OUT PBOOLEAN CopyOnUse
,
8106 OUT PBOOLEAN EffectiveOnly
,
8107 OUT PSECURITY_IMPERSONATION_LEVEL Level
8113 PsReferencePrimaryToken (
8114 IN PEPROCESS Process
8120 PsRestoreImpersonation(
8122 IN PSE_IMPERSONATION_STATE ImpersonationState
8129 IN PEPROCESS Process
,
8130 IN POOL_TYPE PoolType
,
8144 RtlGenerate8dot3Name (
8145 IN PUNICODE_STRING Name
,
8146 IN BOOLEAN AllowExtendedCharacters
,
8147 IN OUT PGENERATE_NAME_CONTEXT Context
,
8148 OUT PUNICODE_STRING Name8dot3
8154 RtlSecondsSince1970ToTime (
8155 IN ULONG SecondsSince1970
,
8156 OUT PLARGE_INTEGER Time
8162 RtlSetSaclSecurityDescriptor (
8163 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
8164 IN BOOLEAN SaclPresent
,
8166 IN BOOLEAN SaclDefaulted
8172 RtlUnicodeStringToCountedOemString (
8173 IN OUT POEM_STRING DestinationString
,
8174 IN PCUNICODE_STRING SourceString
,
8175 IN BOOLEAN AllocateDestinationString
8178 /* RTL Splay Tree Functions */
8182 RtlSplay(PRTL_SPLAY_LINKS Links
);
8187 RtlDelete(PRTL_SPLAY_LINKS Links
);
8193 PRTL_SPLAY_LINKS Links
,
8194 PRTL_SPLAY_LINKS
*Root
8200 RtlSubtreeSuccessor(PRTL_SPLAY_LINKS Links
);
8205 RtlSubtreePredecessor(PRTL_SPLAY_LINKS Links
);
8210 RtlRealSuccessor(PRTL_SPLAY_LINKS Links
);
8215 RtlRealPredecessor(PRTL_SPLAY_LINKS Links
);
8217 #define RtlIsLeftChild(Links) \
8218 (RtlLeftChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
8220 #define RtlIsRightChild(Links) \
8221 (RtlRightChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
8223 #define RtlRightChild(Links) \
8224 ((PRTL_SPLAY_LINKS)(Links))->RightChild
8226 #define RtlIsRoot(Links) \
8227 (RtlParent(Links) == (PRTL_SPLAY_LINKS)(Links))
8229 #define RtlLeftChild(Links) \
8230 ((PRTL_SPLAY_LINKS)(Links))->LeftChild
8232 #define RtlParent(Links) \
8233 ((PRTL_SPLAY_LINKS)(Links))->Parent
8235 #define RtlInitializeSplayLinks(Links) \
8237 PRTL_SPLAY_LINKS _SplayLinks; \
8238 _SplayLinks = (PRTL_SPLAY_LINKS)(Links); \
8239 _SplayLinks->Parent = _SplayLinks; \
8240 _SplayLinks->LeftChild = NULL; \
8241 _SplayLinks->RightChild = NULL; \
8244 #define RtlInsertAsLeftChild(ParentLinks,ChildLinks) \
8246 PRTL_SPLAY_LINKS _SplayParent; \
8247 PRTL_SPLAY_LINKS _SplayChild; \
8248 _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
8249 _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \
8250 _SplayParent->LeftChild = _SplayChild; \
8251 _SplayChild->Parent = _SplayParent; \
8254 #define RtlInsertAsRightChild(ParentLinks,ChildLinks) \
8256 PRTL_SPLAY_LINKS _SplayParent; \
8257 PRTL_SPLAY_LINKS _SplayChild; \
8258 _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
8259 _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \
8260 _SplayParent->RightChild = _SplayChild; \
8261 _SplayChild->Parent = _SplayParent; \
8265 // RTL time functions
8271 SeAppendPrivileges (
8272 PACCESS_STATE AccessState
,
8273 PPRIVILEGE_SET Privileges
8279 SeAuditingFileEvents (
8280 IN BOOLEAN AccessGranted
,
8281 IN PSECURITY_DESCRIPTOR SecurityDescriptor
8287 SeAuditingFileOrGlobalEvents (
8288 IN BOOLEAN AccessGranted
,
8289 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
8290 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
8296 SeCaptureSubjectContext (
8297 OUT PSECURITY_SUBJECT_CONTEXT SubjectContext
8303 SeCreateClientSecurity (
8305 IN PSECURITY_QUALITY_OF_SERVICE QualityOfService
,
8306 IN BOOLEAN RemoteClient
,
8307 OUT PSECURITY_CLIENT_CONTEXT ClientContext
8310 #if (VER_PRODUCTBUILD >= 2195)
8315 SeCreateClientSecurityFromSubjectContext (
8316 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
,
8317 IN PSECURITY_QUALITY_OF_SERVICE QualityOfService
,
8318 IN BOOLEAN ServerIsRemote
,
8319 OUT PSECURITY_CLIENT_CONTEXT ClientContext
8322 #endif /* (VER_PRODUCTBUILD >= 2195) */
8325 #define SeLengthSid( Sid ) \
8326 (8 + (4 * ((SID *)Sid)->SubAuthorityCount))
8328 #define SeDeleteClientSecurity(C) { \
8329 if (SeTokenType((C)->ClientToken) == TokenPrimary) { \
8330 PsDereferencePrimaryToken( (C)->ClientToken ); \
8332 PsDereferenceImpersonationToken( (C)->ClientToken ); \
8339 SeDeleteObjectAuditAlarm (
8344 #define SeEnableAccessToExports() SeExports = *(PSE_EXPORTS *)SeExports;
8350 IN PPRIVILEGE_SET Privileges
8356 SeImpersonateClient (
8357 IN PSECURITY_CLIENT_CONTEXT ClientContext
,
8358 IN PETHREAD ServerThread OPTIONAL
8361 #if (VER_PRODUCTBUILD >= 2195)
8366 SeImpersonateClientEx (
8367 IN PSECURITY_CLIENT_CONTEXT ClientContext
,
8368 IN PETHREAD ServerThread OPTIONAL
8371 #endif /* (VER_PRODUCTBUILD >= 2195) */
8376 SeLockSubjectContext (
8377 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
8383 SeMarkLogonSessionForTerminationNotification (
8390 SeOpenObjectAuditAlarm (
8391 IN PUNICODE_STRING ObjectTypeName
,
8392 IN PVOID Object OPTIONAL
,
8393 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL
,
8394 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
8395 IN PACCESS_STATE AccessState
,
8396 IN BOOLEAN ObjectCreated
,
8397 IN BOOLEAN AccessGranted
,
8398 IN KPROCESSOR_MODE AccessMode
,
8399 OUT PBOOLEAN GenerateOnClose
8405 SeOpenObjectForDeleteAuditAlarm (
8406 IN PUNICODE_STRING ObjectTypeName
,
8407 IN PVOID Object OPTIONAL
,
8408 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL
,
8409 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
8410 IN PACCESS_STATE AccessState
,
8411 IN BOOLEAN ObjectCreated
,
8412 IN BOOLEAN AccessGranted
,
8413 IN KPROCESSOR_MODE AccessMode
,
8414 OUT PBOOLEAN GenerateOnClose
8421 IN OUT PPRIVILEGE_SET RequiredPrivileges
,
8422 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
,
8423 IN KPROCESSOR_MODE AccessMode
8429 SeQueryAuthenticationIdToken (
8430 IN PACCESS_TOKEN Token
,
8434 #if (VER_PRODUCTBUILD >= 2195)
8439 SeQueryInformationToken (
8440 IN PACCESS_TOKEN Token
,
8441 IN TOKEN_INFORMATION_CLASS TokenInformationClass
,
8442 OUT PVOID
*TokenInformation
8445 #endif /* (VER_PRODUCTBUILD >= 2195) */
8450 SeQuerySecurityDescriptorInfo (
8451 IN PSECURITY_INFORMATION SecurityInformation
,
8452 OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
8453 IN OUT PULONG Length
,
8454 IN PSECURITY_DESCRIPTOR
*ObjectsSecurityDescriptor
8457 #if (VER_PRODUCTBUILD >= 2195)
8462 SeQuerySessionIdToken (
8463 IN PACCESS_TOKEN Token
,
8467 #endif /* (VER_PRODUCTBUILD >= 2195) */
8469 #define SeQuerySubjectContextToken( SubjectContext ) \
8470 ( ARGUMENT_PRESENT( \
8471 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken \
8473 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken : \
8474 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
8476 typedef NTSTATUS (NTAPI
*PSE_LOGON_SESSION_TERMINATED_ROUTINE
) (
8483 SeRegisterLogonSessionTerminatedRoutine (
8484 IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
8490 SeReleaseSubjectContext (
8491 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
8497 SeSetAccessStateGenericMapping (
8498 PACCESS_STATE AccessState
,
8499 PGENERIC_MAPPING GenericMapping
8505 SeSetSecurityDescriptorInfo (
8506 IN PVOID Object OPTIONAL
,
8507 IN PSECURITY_INFORMATION SecurityInformation
,
8508 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
8509 IN OUT PSECURITY_DESCRIPTOR
*ObjectsSecurityDescriptor
,
8510 IN POOL_TYPE PoolType
,
8511 IN PGENERIC_MAPPING GenericMapping
8514 #if (VER_PRODUCTBUILD >= 2195)
8519 SeSetSecurityDescriptorInfoEx (
8520 IN PVOID Object OPTIONAL
,
8521 IN PSECURITY_INFORMATION SecurityInformation
,
8522 IN PSECURITY_DESCRIPTOR ModificationDescriptor
,
8523 IN OUT PSECURITY_DESCRIPTOR
*ObjectsSecurityDescriptor
,
8524 IN ULONG AutoInheritFlags
,
8525 IN POOL_TYPE PoolType
,
8526 IN PGENERIC_MAPPING GenericMapping
8533 IN PACCESS_TOKEN Token
8539 SeTokenIsRestricted (
8540 IN PACCESS_TOKEN Token
8546 SeLocateProcessImageName(
8547 IN PEPROCESS Process
,
8548 OUT PUNICODE_STRING
*pImageFileName
8551 #endif /* (VER_PRODUCTBUILD >= 2195) */
8557 IN PACCESS_TOKEN Token
8563 SeUnlockSubjectContext (
8564 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
8570 SeUnregisterLogonSessionTerminatedRoutine (
8571 IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
8574 #if (VER_PRODUCTBUILD >= 2195)
8579 ZwAdjustPrivilegesToken (
8580 IN HANDLE TokenHandle
,
8581 IN BOOLEAN DisableAllPrivileges
,
8582 IN PTOKEN_PRIVILEGES NewState
,
8583 IN ULONG BufferLength
,
8584 OUT PTOKEN_PRIVILEGES PreviousState OPTIONAL
,
8585 OUT PULONG ReturnLength
8588 #endif /* (VER_PRODUCTBUILD >= 2195) */
8594 IN HANDLE ThreadHandle
8600 ZwAllocateVirtualMemory (
8601 IN HANDLE ProcessHandle
,
8602 IN OUT PVOID
*BaseAddress
,
8603 IN ULONG_PTR ZeroBits
,
8604 IN OUT PSIZE_T RegionSize
,
8605 IN ULONG AllocationType
,
8612 ZwAccessCheckAndAuditAlarm (
8613 IN PUNICODE_STRING SubsystemName
,
8615 IN PUNICODE_STRING ObjectTypeName
,
8616 IN PUNICODE_STRING ObjectName
,
8617 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
8618 IN ACCESS_MASK DesiredAccess
,
8619 IN PGENERIC_MAPPING GenericMapping
,
8620 IN BOOLEAN ObjectCreation
,
8621 OUT PACCESS_MASK GrantedAccess
,
8622 OUT PBOOLEAN AccessStatus
,
8623 OUT PBOOLEAN GenerateOnClose
8626 #if (VER_PRODUCTBUILD >= 2195)
8632 IN HANDLE FileHandle
,
8633 OUT PIO_STATUS_BLOCK IoStatusBlock
8636 #endif /* (VER_PRODUCTBUILD >= 2195) */
8642 IN HANDLE EventHandle
8648 ZwCloseObjectAuditAlarm (
8649 IN PUNICODE_STRING SubsystemName
,
8651 IN BOOLEAN GenerateOnClose
8658 OUT PHANDLE SectionHandle
,
8659 IN ACCESS_MASK DesiredAccess
,
8660 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL
,
8661 IN PLARGE_INTEGER MaximumSize OPTIONAL
,
8662 IN ULONG SectionPageProtection
,
8663 IN ULONG AllocationAttributes
,
8664 IN HANDLE FileHandle OPTIONAL
8670 ZwCreateSymbolicLinkObject (
8671 OUT PHANDLE SymbolicLinkHandle
,
8672 IN ACCESS_MASK DesiredAccess
,
8673 IN POBJECT_ATTRIBUTES ObjectAttributes
,
8674 IN PUNICODE_STRING TargetName
8681 IN POBJECT_ATTRIBUTES ObjectAttributes
8689 IN PUNICODE_STRING Name
8693 #if (NTDDI_VERSION >= NTDDI_WIN2K)
8697 ZwDeviceIoControlFile (
8698 IN HANDLE FileHandle
,
8699 IN HANDLE Event OPTIONAL
,
8700 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
8701 IN PVOID ApcContext OPTIONAL
,
8702 OUT PIO_STATUS_BLOCK IoStatusBlock
,
8703 IN ULONG IoControlCode
,
8704 IN PVOID InputBuffer OPTIONAL
,
8705 IN ULONG InputBufferLength
,
8706 OUT PVOID OutputBuffer OPTIONAL
,
8707 IN ULONG OutputBufferLength
);
8714 IN PUNICODE_STRING String
8721 IN HANDLE SourceProcessHandle
,
8722 IN HANDLE SourceHandle
,
8723 IN HANDLE TargetProcessHandle OPTIONAL
,
8724 OUT PHANDLE TargetHandle OPTIONAL
,
8725 IN ACCESS_MASK DesiredAccess
,
8726 IN ULONG HandleAttributes
,
8734 IN HANDLE ExistingTokenHandle
,
8735 IN ACCESS_MASK DesiredAccess
,
8736 IN POBJECT_ATTRIBUTES ObjectAttributes
,
8737 IN BOOLEAN EffectiveOnly
,
8738 IN TOKEN_TYPE TokenType
,
8739 OUT PHANDLE NewTokenHandle
8745 ZwFlushInstructionCache (
8746 IN HANDLE ProcessHandle
,
8747 IN PVOID BaseAddress OPTIONAL
,
8755 IN HANDLE FileHandle
,
8756 OUT PIO_STATUS_BLOCK IoStatusBlock
8759 #if (VER_PRODUCTBUILD >= 2195)
8764 ZwFlushVirtualMemory (
8765 IN HANDLE ProcessHandle
,
8766 IN OUT PVOID
*BaseAddress
,
8767 IN OUT PULONG FlushSize
,
8768 OUT PIO_STATUS_BLOCK IoStatusBlock
8771 #endif /* (VER_PRODUCTBUILD >= 2195) */
8776 ZwFreeVirtualMemory (
8777 IN HANDLE ProcessHandle
,
8778 IN OUT PVOID
*BaseAddress
,
8779 IN OUT PSIZE_T RegionSize
,
8787 IN HANDLE FileHandle
,
8788 IN HANDLE Event OPTIONAL
,
8789 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
8790 IN PVOID ApcContext OPTIONAL
,
8791 OUT PIO_STATUS_BLOCK IoStatusBlock
,
8792 IN ULONG FsControlCode
,
8793 IN PVOID InputBuffer OPTIONAL
,
8794 IN ULONG InputBufferLength
,
8795 OUT PVOID OutputBuffer OPTIONAL
,
8796 IN ULONG OutputBufferLength
8799 #if (VER_PRODUCTBUILD >= 2195)
8804 ZwInitiatePowerAction (
8805 IN POWER_ACTION SystemAction
,
8806 IN SYSTEM_POWER_STATE MinSystemState
,
8808 IN BOOLEAN Asynchronous
8811 #endif /* (VER_PRODUCTBUILD >= 2195) */
8817 /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
8818 IN PUNICODE_STRING RegistryPath
8825 IN POBJECT_ATTRIBUTES KeyObjectAttributes
,
8826 IN POBJECT_ATTRIBUTES FileObjectAttributes
8833 IN HANDLE KeyHandle
,
8834 IN HANDLE EventHandle OPTIONAL
,
8835 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
8836 IN PVOID ApcContext OPTIONAL
,
8837 OUT PIO_STATUS_BLOCK IoStatusBlock
,
8838 IN ULONG NotifyFilter
,
8839 IN BOOLEAN WatchSubtree
,
8841 IN ULONG BufferLength
,
8842 IN BOOLEAN Asynchronous
8848 ZwOpenDirectoryObject (
8849 OUT PHANDLE DirectoryHandle
,
8850 IN ACCESS_MASK DesiredAccess
,
8851 IN POBJECT_ATTRIBUTES ObjectAttributes
8858 OUT PHANDLE EventHandle
,
8859 IN ACCESS_MASK DesiredAccess
,
8860 IN POBJECT_ATTRIBUTES ObjectAttributes
8867 OUT PHANDLE ProcessHandle
,
8868 IN ACCESS_MASK DesiredAccess
,
8869 IN POBJECT_ATTRIBUTES ObjectAttributes
,
8870 IN PCLIENT_ID ClientId OPTIONAL
8876 ZwOpenProcessToken (
8877 IN HANDLE ProcessHandle
,
8878 IN ACCESS_MASK DesiredAccess
,
8879 OUT PHANDLE TokenHandle
8886 OUT PHANDLE ThreadHandle
,
8887 IN ACCESS_MASK DesiredAccess
,
8888 IN POBJECT_ATTRIBUTES ObjectAttributes
,
8889 IN PCLIENT_ID ClientId
8896 IN HANDLE ThreadHandle
,
8897 IN ACCESS_MASK DesiredAccess
,
8898 IN BOOLEAN OpenAsSelf
,
8899 OUT PHANDLE TokenHandle
8902 #if (VER_PRODUCTBUILD >= 2195)
8907 ZwPowerInformation (
8908 IN POWER_INFORMATION_LEVEL PowerInformationLevel
,
8909 IN PVOID InputBuffer OPTIONAL
,
8910 IN ULONG InputBufferLength
,
8911 OUT PVOID OutputBuffer OPTIONAL
,
8912 IN ULONG OutputBufferLength
8915 #endif /* (VER_PRODUCTBUILD >= 2195) */
8921 IN HANDLE EventHandle
,
8922 OUT PLONG PreviousState OPTIONAL
8928 ZwQueryDefaultLocale (
8929 IN BOOLEAN ThreadOrSystem
,
8936 ZwQueryDirectoryFile (
8937 IN HANDLE FileHandle
,
8938 IN HANDLE Event OPTIONAL
,
8939 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
8940 IN PVOID ApcContext OPTIONAL
,
8941 OUT PIO_STATUS_BLOCK IoStatusBlock
,
8942 OUT PVOID FileInformation
,
8944 IN FILE_INFORMATION_CLASS FileInformationClass
,
8945 IN BOOLEAN ReturnSingleEntry
,
8946 IN PUNICODE_STRING FileName OPTIONAL
,
8947 IN BOOLEAN RestartScan
8950 #if (VER_PRODUCTBUILD >= 2195)
8955 ZwQueryDirectoryObject (
8956 IN HANDLE DirectoryHandle
,
8959 IN BOOLEAN ReturnSingleEntry
,
8960 IN BOOLEAN RestartScan
,
8961 IN OUT PULONG Context
,
8962 OUT PULONG ReturnLength OPTIONAL
8969 IN HANDLE FileHandle
,
8970 OUT PIO_STATUS_BLOCK IoStatusBlock
,
8973 IN BOOLEAN ReturnSingleEntry
,
8974 IN PVOID EaList OPTIONAL
,
8975 IN ULONG EaListLength
,
8976 IN PULONG EaIndex OPTIONAL
,
8977 IN BOOLEAN RestartScan
8980 #endif /* (VER_PRODUCTBUILD >= 2195) */
8985 ZwQueryInformationProcess (
8986 IN HANDLE ProcessHandle
,
8987 IN PROCESSINFOCLASS ProcessInformationClass
,
8988 OUT PVOID ProcessInformation
,
8989 IN ULONG ProcessInformationLength
,
8990 OUT PULONG ReturnLength OPTIONAL
8996 ZwQueryInformationToken (
8997 IN HANDLE TokenHandle
,
8998 IN TOKEN_INFORMATION_CLASS TokenInformationClass
,
8999 OUT PVOID TokenInformation
,
9001 OUT PULONG ResultLength
9007 ZwQuerySecurityObject (
9008 IN HANDLE FileHandle
,
9009 IN SECURITY_INFORMATION SecurityInformation
,
9010 OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
9012 OUT PULONG ResultLength
9018 ZwQueryVolumeInformationFile (
9019 IN HANDLE FileHandle
,
9020 OUT PIO_STATUS_BLOCK IoStatusBlock
,
9021 OUT PVOID FsInformation
,
9023 IN FS_INFORMATION_CLASS FsInformationClass
9030 IN POBJECT_ATTRIBUTES NewFileObjectAttributes
,
9031 IN HANDLE KeyHandle
,
9032 IN POBJECT_ATTRIBUTES OldFileObjectAttributes
9039 IN HANDLE EventHandle
,
9040 OUT PLONG PreviousState OPTIONAL
9043 #if (VER_PRODUCTBUILD >= 2195)
9049 IN HANDLE KeyHandle
,
9050 IN HANDLE FileHandle
,
9054 #endif /* (VER_PRODUCTBUILD >= 2195) */
9060 IN HANDLE KeyHandle
,
9061 IN HANDLE FileHandle
9067 ZwSetDefaultLocale (
9068 IN BOOLEAN ThreadOrSystem
,
9072 #if (VER_PRODUCTBUILD >= 2195)
9077 ZwSetDefaultUILanguage (
9078 IN LANGID LanguageId
9085 IN HANDLE FileHandle
,
9086 OUT PIO_STATUS_BLOCK IoStatusBlock
,
9091 #endif /* (VER_PRODUCTBUILD >= 2195) */
9097 IN HANDLE EventHandle
,
9098 OUT PLONG PreviousState OPTIONAL
9104 ZwSetInformationProcess (
9105 IN HANDLE ProcessHandle
,
9106 IN PROCESSINFOCLASS ProcessInformationClass
,
9107 IN PVOID ProcessInformation
,
9108 IN ULONG ProcessInformationLength
9111 #if (VER_PRODUCTBUILD >= 2195)
9116 ZwSetSecurityObject (
9118 IN SECURITY_INFORMATION SecurityInformation
,
9119 IN PSECURITY_DESCRIPTOR SecurityDescriptor
9122 #endif /* (VER_PRODUCTBUILD >= 2195) */
9128 IN PLARGE_INTEGER NewTime
,
9129 OUT PLARGE_INTEGER OldTime OPTIONAL
9132 #if (VER_PRODUCTBUILD >= 2195)
9137 ZwSetVolumeInformationFile (
9138 IN HANDLE FileHandle
,
9139 OUT PIO_STATUS_BLOCK IoStatusBlock
,
9140 IN PVOID FsInformation
,
9142 IN FS_INFORMATION_CLASS FsInformationClass
9145 #endif /* (VER_PRODUCTBUILD >= 2195) */
9150 ZwTerminateProcess (
9151 IN HANDLE ProcessHandle OPTIONAL
,
9152 IN NTSTATUS ExitStatus
9159 /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
9160 IN PUNICODE_STRING RegistryPath
9167 IN POBJECT_ATTRIBUTES KeyObjectAttributes
9170 #if (NTDDI_VERSION >= NTDDI_WIN2K)
9174 ZwWaitForSingleObject (
9176 IN BOOLEAN Alertable
,
9177 IN PLARGE_INTEGER Timeout OPTIONAL
);
9183 ZwWaitForMultipleObjects (
9184 IN ULONG HandleCount
,
9186 IN WAIT_TYPE WaitType
,
9187 IN BOOLEAN Alertable
,
9188 IN PLARGE_INTEGER Timeout OPTIONAL