1 ////////////////////////////////////////////////////////////////////
2 // Copyright (C) Alexander Telyatnikov, Ivan Keliukh, Yegor Anchishkin, SKIF Software, 1999-2013. Kiev, Ukraine
4 ////////////////////////////////////////////////////////////////////
6 //======================================================================
10 //======================================================================
12 #ifndef __NT_NATIVE_DEFS__H__
13 #define __NT_NATIVE_DEFS__H__
27 typedef struct _KTHREAD
*PKTHREAD
;
28 typedef struct _ETHREAD
*PETHREAD
;
29 typedef struct _EPROCESS
*PEPROCESS
;
30 typedef struct _PEB
*PPEB
;
31 typedef struct _KINTERRUPT
*PKINTERRUPT
;
32 typedef struct _IO_TIMER
*PIO_TIMER
;
33 typedef struct _OBJECT_TYPE
*POBJECT_TYPE
;
34 typedef struct _CALLBACK_OBJECT
*PCALLBACK_OBJECT
;
35 typedef struct _DEVICE_HANDLER_OBJECT
*PDEVICE_HANDLER_OBJECT
;
36 typedef struct _BUS_HANDLER
*PBUS_HANDLER
;
39 typedef ULONG ACCESS_MASK
;
40 typedef ACCESS_MASK
*PACCESS_MASK
;
45 #define LPDWORD PULONG
47 #define APIENTRY __stdcall
49 #define FASTCALL _fastcall
53 // The following are masks for the predefined standard access types
56 #define DELETE (0x00010000L)
57 #define READ_CONTROL (0x00020000L)
58 #define WRITE_DAC (0x00040000L)
59 #define WRITE_OWNER (0x00080000L)
60 #define SYNCHRONIZE (0x00100000L)
62 #define STANDARD_RIGHTS_REQUIRED (0x000F0000L)
64 #define STANDARD_RIGHTS_READ (READ_CONTROL)
65 #define STANDARD_RIGHTS_WRITE (READ_CONTROL)
66 #define STANDARD_RIGHTS_EXECUTE (READ_CONTROL)
68 #define STANDARD_RIGHTS_ALL (0x001F0000L)
70 #define SPECIFIC_RIGHTS_ALL (0x0000FFFFL)
73 // AccessSystemAcl access type
76 #define ACCESS_SYSTEM_SECURITY (0x01000000L)
79 // MaximumAllowed access type
82 #define MAXIMUM_ALLOWED (0x02000000L)
85 // These are the generic rights.
88 #define GENERIC_READ (0x80000000L)
89 #define GENERIC_WRITE (0x40000000L)
90 #define GENERIC_EXECUTE (0x20000000L)
91 #define GENERIC_ALL (0x10000000L)
95 // Subroutines for dealing with the Registry
98 typedef NTSTATUS (*PRTL_QUERY_REGISTRY_ROUTINE
)(
102 IN ULONG ValueLength
,
104 IN PVOID EntryContext
107 typedef struct _RTL_QUERY_REGISTRY_TABLE
{
108 PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine
;
116 } RTL_QUERY_REGISTRY_TABLE
, *PRTL_QUERY_REGISTRY_TABLE
;
120 // The following flags specify how the Name field of a RTL_QUERY_REGISTRY_TABLE
121 // entry is interpreted. A NULL name indicates the end of the table.
124 #define RTL_QUERY_REGISTRY_SUBKEY 0x00000001 // Name is a subkey and remainder of
125 // table or until next subkey are value
126 // names for that subkey to look at.
128 #define RTL_QUERY_REGISTRY_TOPKEY 0x00000002 // Reset current key to original key for
129 // this and all following table entries.
131 #define RTL_QUERY_REGISTRY_REQUIRED 0x00000004 // Fail if no match found for this table
134 #define RTL_QUERY_REGISTRY_NOVALUE 0x00000008 // Used to mark a table entry that has no
135 // value name, just wants a call out, not
136 // an enumeration of all values.
138 #define RTL_QUERY_REGISTRY_NOEXPAND 0x00000010 // Used to suppress the expansion of
139 // REG_MULTI_SZ into multiple callouts or
140 // to prevent the expansion of environment
141 // variable values in REG_EXPAND_SZ
143 #define RTL_QUERY_REGISTRY_DIRECT 0x00000020 // QueryRoutine field ignored. EntryContext
144 // field points to location to store value.
145 // For null terminated strings, EntryContext
146 // points to UNICODE_STRING structure that
147 // that describes maximum size of buffer.
148 // If .Buffer field is NULL then a buffer is
152 #define RTL_QUERY_REGISTRY_DELETE 0x00000040 // Used to delete value keys after they
156 // The following values for the RelativeTo parameter determine what the
157 // Path parameter to RtlQueryRegistryValues is relative to.
160 #define RTL_REGISTRY_ABSOLUTE 0 // Path is a full path
161 #define RTL_REGISTRY_SERVICES 1 // \Registry\Machine\System\CurrentControlSet\Services
162 #define RTL_REGISTRY_CONTROL 2 // \Registry\Machine\System\CurrentControlSet\Control
163 #define RTL_REGISTRY_WINDOWS_NT 3 // \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion
164 #define RTL_REGISTRY_DEVICEMAP 4 // \Registry\Machine\Hardware\DeviceMap
165 #define RTL_REGISTRY_USER 5 // \Registry\User\CurrentUser
166 #define RTL_REGISTRY_MAXIMUM 6
167 #define RTL_REGISTRY_HANDLE 0x40000000 // Low order bits are registry handle
168 #define RTL_REGISTRY_OPTIONAL 0x80000000 // Indicates the key node is optional
184 RtlIntegerToUnicodeString (
187 PUNICODE_STRING String
193 RtlUnicodeStringToInteger (
194 PUNICODE_STRING String
,
201 // String manipulation routines
206 #define NLS_MB_CODE_PAGE_TAG NlsMbCodePageTag
207 #define NLS_MB_OEM_CODE_PAGE_TAG NlsMbOemCodePageTag
211 #define NLS_MB_CODE_PAGE_TAG (*NlsMbCodePageTag)
212 #define NLS_MB_OEM_CODE_PAGE_TAG (*NlsMbOemCodePageTag)
216 extern BOOLEAN NLS_MB_CODE_PAGE_TAG
; // TRUE -> Multibyte CP, FALSE -> Singlebyte
217 extern BOOLEAN NLS_MB_OEM_CODE_PAGE_TAG
; // TRUE -> Multibyte CP, FALSE -> Singlebyte
223 PSTRING DestinationString
,
231 PANSI_STRING DestinationString
,
238 RtlInitUnicodeString(
239 PUNICODE_STRING DestinationString
,
248 PSTRING DestinationString
,
265 BOOLEAN CaseInSensitive
274 BOOLEAN CaseInSensitive
282 PSTRING DestinationString
,
287 // NLS String functions
293 RtlAnsiStringToUnicodeString(
294 PUNICODE_STRING DestinationString
,
295 PANSI_STRING SourceString
,
296 BOOLEAN AllocateDestinationString
303 RtlUnicodeStringToAnsiString(
304 PANSI_STRING DestinationString
,
305 PUNICODE_STRING SourceString
,
306 BOOLEAN AllocateDestinationString
313 RtlCompareUnicodeString(
314 PUNICODE_STRING String1
,
315 PUNICODE_STRING String2
,
316 BOOLEAN CaseInSensitive
322 RtlEqualUnicodeString(
323 PUNICODE_STRING String1
,
324 PUNICODE_STRING String2
,
325 BOOLEAN CaseInSensitive
331 RtlPrefixUnicodeString(
332 IN PUNICODE_STRING String1
,
333 IN PUNICODE_STRING String2
,
334 IN BOOLEAN CaseInSensitive
340 RtlUpcaseUnicodeString(
341 PUNICODE_STRING DestinationString
,
342 PUNICODE_STRING SourceString
,
343 BOOLEAN AllocateDestinationString
350 RtlCopyUnicodeString(
351 PUNICODE_STRING DestinationString
,
352 PUNICODE_STRING SourceString
358 RtlAppendUnicodeStringToString (
359 PUNICODE_STRING Destination
,
360 PUNICODE_STRING Source
366 RtlAppendUnicodeToString (
367 PUNICODE_STRING Destination
,
375 RtlFreeUnicodeString(
376 PUNICODE_STRING UnicodeString
383 PANSI_STRING AnsiString
390 RtlxAnsiStringToUnicodeSize(
391 PANSI_STRING AnsiString
398 // RtlAnsiStringToUnicodeSize(
399 // PANSI_STRING AnsiString
403 #define RtlAnsiStringToUnicodeSize(STRING) ( \
404 NLS_MB_CODE_PAGE_TAG ? \
405 RtlxAnsiStringToUnicodeSize(STRING) : \
406 ((STRING)->Length + sizeof((UCHAR)NULL)) * sizeof(WCHAR) \
414 PVOID FailedAssertion
,
420 #define ASSERT( exp ) \
422 RtlAssert( #exp, __FILE__, __LINE__, NULL )
424 #define ASSERTMSG( msg, exp ) \
426 RtlAssert( #exp, __FILE__, __LINE__, msg )
429 #define ASSERT( exp )
430 #define ASSERTMSG( msg, exp )
434 // Fast primitives to compare, move, and zero memory
437 // begin_winnt begin_ntndis
438 #if defined(_M_IX86) || defined(_M_MRX000) || defined(_M_ALPHA)
440 #if defined(_M_MRX000)
451 #define RtlEqualMemory(Destination,Source,Length) (!memcmp((Destination),(Source),(Length)))
454 #define RtlMoveMemory(Destination,Source,Length) memmove((Destination),(Source),(Length))
455 #define RtlCopyMemory(Destination,Source,Length) memcpy((Destination),(Source),(Length))
456 #define RtlFillMemory(Destination,Length,Fill) memset((Destination),(Fill),(Length))
457 #define RtlZeroMemory(Destination,Length) memset((Destination),0,(Length))
474 VOID UNALIGNED
*Destination
,
475 CONST VOID UNALIGNED
*Source
,
483 VOID UNALIGNED
*Destination
,
484 CONST VOID UNALIGNED
*Source
,
492 VOID UNALIGNED
*Destination
,
493 CONST VOID UNALIGNED
*Source
,
501 VOID UNALIGNED
*Destination
,
510 VOID UNALIGNED
*Destination
,
514 // end_winnt end_ntndis
525 typedef struct _TIME_FIELDS
{
526 CSHORT Year
; // range [1601...]
527 CSHORT Month
; // range [1..12]
528 CSHORT Day
; // range [1..31]
529 CSHORT Hour
; // range [0..23]
530 CSHORT Minute
; // range [0..59]
531 CSHORT Second
; // range [0..59]
532 CSHORT Milliseconds
;// range [0..999]
533 CSHORT Weekday
; // range [0..6] == [Sunday..Saturday]
535 typedef TIME_FIELDS
*PTIME_FIELDS
;
541 RtlTimeToTimeFields (
543 PTIME_FIELDS TimeFields
547 // A time field record (Weekday ignored) -> 64 bit Time value
553 RtlTimeFieldsToTime (
554 PTIME_FIELDS TimeFields
,
559 // Define the generic mapping array. This is used to denote the
560 // mapping of each generic access right to a specific access mask.
563 typedef struct _GENERIC_MAPPING
{
564 ACCESS_MASK GenericRead
;
565 ACCESS_MASK GenericWrite
;
566 ACCESS_MASK GenericExecute
;
567 ACCESS_MASK GenericAll
;
569 typedef GENERIC_MAPPING
*PGENERIC_MAPPING
;
572 // Define the various device type values. Note that values used by Microsoft
573 // Corporation are in the range 0-32767, and 32768-65535 are reserved for use
577 #define DEVICE_TYPE ULONG
579 #define FILE_DEVICE_BEEP 0x00000001
580 #define FILE_DEVICE_CD_ROM 0x00000002
581 #define FILE_DEVICE_CD_ROM_FILE_SYSTEM 0x00000003
582 #define FILE_DEVICE_CONTROLLER 0x00000004
583 #define FILE_DEVICE_DATALINK 0x00000005
584 #define FILE_DEVICE_DFS 0x00000006
585 #define FILE_DEVICE_DISK 0x00000007
586 #define FILE_DEVICE_DISK_FILE_SYSTEM 0x00000008
587 #define FILE_DEVICE_FILE_SYSTEM 0x00000009
588 #define FILE_DEVICE_INPORT_PORT 0x0000000a
589 #define FILE_DEVICE_KEYBOARD 0x0000000b
590 #define FILE_DEVICE_MAILSLOT 0x0000000c
591 #define FILE_DEVICE_MIDI_IN 0x0000000d
592 #define FILE_DEVICE_MIDI_OUT 0x0000000e
593 #define FILE_DEVICE_MOUSE 0x0000000f
594 #define FILE_DEVICE_MULTI_UNC_PROVIDER 0x00000010
595 #define FILE_DEVICE_NAMED_PIPE 0x00000011
596 #define FILE_DEVICE_NETWORK 0x00000012
597 #define FILE_DEVICE_NETWORK_BROWSER 0x00000013
598 #define FILE_DEVICE_NETWORK_FILE_SYSTEM 0x00000014
599 #define FILE_DEVICE_NULL 0x00000015
600 #define FILE_DEVICE_PARALLEL_PORT 0x00000016
601 #define FILE_DEVICE_PHYSICAL_NETCARD 0x00000017
602 #define FILE_DEVICE_PRINTER 0x00000018
603 #define FILE_DEVICE_SCANNER 0x00000019
604 #define FILE_DEVICE_SERIAL_MOUSE_PORT 0x0000001a
605 #define FILE_DEVICE_SERIAL_PORT 0x0000001b
606 #define FILE_DEVICE_SCREEN 0x0000001c
607 #define FILE_DEVICE_SOUND 0x0000001d
608 #define FILE_DEVICE_STREAMS 0x0000001e
609 #define FILE_DEVICE_TAPE 0x0000001f
610 #define FILE_DEVICE_TAPE_FILE_SYSTEM 0x00000020
611 #define FILE_DEVICE_TRANSPORT 0x00000021
612 #define FILE_DEVICE_UNKNOWN 0x00000022
613 #define FILE_DEVICE_VIDEO 0x00000023
614 #define FILE_DEVICE_VIRTUAL_DISK 0x00000024
615 #define FILE_DEVICE_WAVE_IN 0x00000025
616 #define FILE_DEVICE_WAVE_OUT 0x00000026
617 #define FILE_DEVICE_8042_PORT 0x00000027
618 #define FILE_DEVICE_NETWORK_REDIRECTOR 0x00000028
619 #define FILE_DEVICE_BATTERY 0x00000029
620 #define FILE_DEVICE_BUS_EXTENDER 0x0000002a
621 #define FILE_DEVICE_MODEM 0x0000002b
622 #define FILE_DEVICE_VDM 0x0000002c
624 // Macro definition for defining IOCTL and FSCTL function control codes. Note
625 // that function codes 0-2047 are reserved for Microsoft Corporation, and
626 // 2048-4095 are reserved for customers.
629 #define CTL_CODE( DeviceType, Function, Method, Access ) ( \
630 ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
634 // Define the method codes for how buffers are passed for I/O and FS controls
637 #define METHOD_BUFFERED 0
638 #define METHOD_IN_DIRECT 1
639 #define METHOD_OUT_DIRECT 2
640 #define METHOD_NEITHER 3
643 // Define the access check value for any access
646 // The FILE_READ_ACCESS and FILE_WRITE_ACCESS constants are also defined in
647 // ntioapi.h as FILE_READ_DATA and FILE_WRITE_DATA. The values for these
648 // constants *MUST* always be in sync.
652 #define FILE_ANY_ACCESS 0
653 #define FILE_READ_ACCESS ( 0x0001 ) // file & pipe
654 #define FILE_WRITE_ACCESS ( 0x0002 ) // file & pipe
660 // Define access rights to files and directories
664 // The FILE_READ_DATA and FILE_WRITE_DATA constants are also defined in
665 // devioctl.h as FILE_READ_ACCESS and FILE_WRITE_ACCESS. The values for these
666 // constants *MUST* always be in sync.
667 // The values are redefined in devioctl.h because they must be available to
671 #define FILE_READ_DATA ( 0x0001 ) // file & pipe
672 #define FILE_LIST_DIRECTORY ( 0x0001 ) // directory
674 #define FILE_WRITE_DATA ( 0x0002 ) // file & pipe
675 #define FILE_ADD_FILE ( 0x0002 ) // directory
677 #define FILE_APPEND_DATA ( 0x0004 ) // file
678 #define FILE_ADD_SUBDIRECTORY ( 0x0004 ) // directory
679 #define FILE_CREATE_PIPE_INSTANCE ( 0x0004 ) // named pipe
681 #define FILE_READ_EA ( 0x0008 ) // file & directory
683 #define FILE_WRITE_EA ( 0x0010 ) // file & directory
685 #define FILE_EXECUTE ( 0x0020 ) // file
686 #define FILE_TRAVERSE ( 0x0020 ) // directory
688 #define FILE_DELETE_CHILD ( 0x0040 ) // directory
690 #define FILE_READ_ATTRIBUTES ( 0x0080 ) // all
692 #define FILE_WRITE_ATTRIBUTES ( 0x0100 ) // all
694 #define FILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1FF)
696 #define FILE_GENERIC_READ (STANDARD_RIGHTS_READ |\
698 FILE_READ_ATTRIBUTES |\
703 #define FILE_GENERIC_WRITE (STANDARD_RIGHTS_WRITE |\
705 FILE_WRITE_ATTRIBUTES |\
711 #define FILE_GENERIC_EXECUTE (STANDARD_RIGHTS_EXECUTE |\
712 FILE_READ_ATTRIBUTES |\
720 // Define share access rights to files and directories
723 #define FILE_SHARE_READ 0x00000001 // winnt
724 #define FILE_SHARE_WRITE 0x00000002 // winnt
725 #define FILE_SHARE_DELETE 0x00000004 // winnt
726 #define FILE_SHARE_VALID_FLAGS 0x00000007
729 // Define the file attributes values
731 // Note: 0x00000008 is reserved for use for the old DOS VOLID (volume ID)
732 // and is therefore not considered valid in NT.
734 // Note: 0x00000010 is reserved for use for the old DOS SUBDIRECTORY flag
735 // and is therefore not considered valid in NT. This flag has
736 // been disassociated with file attributes since the other flags are
737 // protected with READ_ and WRITE_ATTRIBUTES access to the file.
739 // Note: Note also that the order of these flags is set to allow both the
740 // FAT and the Pinball File Systems to directly set the attributes
741 // flags in attributes words without having to pick each flag out
742 // individually. The order of these flags should not be changed!
745 #define FILE_ATTRIBUTE_READONLY 0x00000001 // winnt
746 #define FILE_ATTRIBUTE_HIDDEN 0x00000002 // winnt
747 #define FILE_ATTRIBUTE_SYSTEM 0x00000004 // winnt
748 #define FILE_ATTRIBUTE_DIRECTORY 0x00000010 // winnt
749 #define FILE_ATTRIBUTE_ARCHIVE 0x00000020 // winnt
750 #define FILE_ATTRIBUTE_NORMAL 0x00000080 // winnt
751 #define FILE_ATTRIBUTE_TEMPORARY 0x00000100 // winnt
752 #define FILE_ATTRIBUTE_RESERVED0 0x00000200
753 #define FILE_ATTRIBUTE_RESERVED1 0x00000400
754 #define FILE_ATTRIBUTE_COMPRESSED 0x00000800 // winnt
755 #define FILE_ATTRIBUTE_OFFLINE 0x00001000 // winnt
756 #define FILE_ATTRIBUTE_PROPERTY_SET 0x00002000
757 #define FILE_ATTRIBUTE_VALID_FLAGS 0x00003fb7
758 #define FILE_ATTRIBUTE_VALID_SET_FLAGS 0x00003fa7
761 // Define the create disposition values
764 #define FILE_SUPERSEDE 0x00000000
765 #define FILE_OPEN 0x00000001
766 #define FILE_CREATE 0x00000002
767 #define FILE_OPEN_IF 0x00000003
768 #define FILE_OVERWRITE 0x00000004
769 #define FILE_OVERWRITE_IF 0x00000005
770 #define FILE_MAXIMUM_DISPOSITION 0x00000005
774 // Define the create/open option flags
777 #define FILE_DIRECTORY_FILE 0x00000001
778 #define FILE_WRITE_THROUGH 0x00000002
779 #define FILE_SEQUENTIAL_ONLY 0x00000004
780 #define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008
782 #define FILE_SYNCHRONOUS_IO_ALERT 0x00000010
783 #define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
784 #define FILE_NON_DIRECTORY_FILE 0x00000040
785 #define FILE_CREATE_TREE_CONNECTION 0x00000080
787 #define FILE_COMPLETE_IF_OPLOCKED 0x00000100
788 #define FILE_NO_EA_KNOWLEDGE 0x00000200
790 #define FILE_RANDOM_ACCESS 0x00000800
792 #define FILE_DELETE_ON_CLOSE 0x00001000
793 #define FILE_OPEN_BY_FILE_ID 0x00002000
794 #define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000
795 #define FILE_NO_COMPRESSION 0x00008000
798 #define FILE_RESERVE_OPFILTER 0x00100000
799 #define FILE_TRANSACTED_MODE 0x00200000
800 #define FILE_OPEN_OFFLINE_FILE 0x00400000
802 #define FILE_VALID_OPTION_FLAGS 0x007fffff
803 #define FILE_VALID_PIPE_OPTION_FLAGS 0x00000032
804 #define FILE_VALID_MAILSLOT_OPTION_FLAGS 0x00000032
805 #define FILE_VALID_SET_FLAGS 0x00000036
808 // Define the I/O status information return values for NtCreateFile/NtOpenFile
811 #define FILE_SUPERSEDED 0x00000000
812 #define FILE_OPENED 0x00000001
813 #define FILE_CREATED 0x00000002
814 #define FILE_OVERWRITTEN 0x00000003
815 #define FILE_EXISTS 0x00000004
816 #define FILE_DOES_NOT_EXIST 0x00000005
819 // Define special ByteOffset parameters for read and write operations
822 #define FILE_WRITE_TO_END_OF_FILE 0xffffffff
823 #define FILE_USE_FILE_POINTER_POSITION 0xfffffffe
826 // Define alignment requirement values
829 #define FILE_BYTE_ALIGNMENT 0x00000000
830 #define FILE_WORD_ALIGNMENT 0x00000001
831 #define FILE_LONG_ALIGNMENT 0x00000003
832 #define FILE_QUAD_ALIGNMENT 0x00000007
833 #define FILE_OCTA_ALIGNMENT 0x0000000f
834 #define FILE_32_BYTE_ALIGNMENT 0x0000001f
835 #define FILE_64_BYTE_ALIGNMENT 0x0000003f
836 #define FILE_128_BYTE_ALIGNMENT 0x0000007f
837 #define FILE_256_BYTE_ALIGNMENT 0x000000ff
838 #define FILE_512_BYTE_ALIGNMENT 0x000001ff
841 // Define the maximum length of a filename string
844 #define MAXIMUM_FILENAME_LENGTH 256
847 // Define the various device characteristics flags
850 #define FILE_REMOVABLE_MEDIA 0x00000001
851 #define FILE_READ_ONLY_DEVICE 0x00000002
852 #define FILE_FLOPPY_DISKETTE 0x00000004
853 #define FILE_WRITE_ONCE_MEDIA 0x00000008
854 #define FILE_REMOTE_DEVICE 0x00000010
855 #define FILE_DEVICE_IS_MOUNTED 0x00000020
856 #define FILE_VIRTUAL_VOLUME 0x00000040
858 #ifndef _FILESYSTEMFSCTL_
859 #define _FILESYSTEMFSCTL_
861 #endif // _FILESYSTEMFSCTL_
864 // The following is a list of the native file system fsctls followed by
865 // additional network file system fsctls. Some values have been
869 #define FSCTL_REQUEST_OPLOCK_LEVEL_1 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
870 #define FSCTL_REQUEST_OPLOCK_LEVEL_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
871 #define FSCTL_REQUEST_BATCH_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
872 #define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 3, METHOD_BUFFERED, FILE_ANY_ACCESS)
873 #define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
874 #define FSCTL_OPLOCK_BREAK_NOTIFY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 5, METHOD_BUFFERED, FILE_ANY_ACCESS)
875 #define FSCTL_LOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
876 #define FSCTL_UNLOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
877 #define FSCTL_DISMOUNT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
878 // decommissioned fsctl value 9
879 #define FSCTL_IS_VOLUME_MOUNTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
880 #define FSCTL_IS_PATHNAME_VALID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS) // PATHNAME_BUFFER,
881 #define FSCTL_MARK_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
882 // decommissioned fsctl value 13
883 #define FSCTL_QUERY_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER, FILE_ANY_ACCESS)
884 #define FSCTL_GET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
885 #define FSCTL_SET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
886 // decommissioned fsctl value 17
887 // decommissioned fsctl value 18
888 #define FSCTL_MARK_AS_SYSTEM_HIVE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS)
889 #define FSCTL_OPLOCK_BREAK_ACK_NO_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
890 #define FSCTL_INVALIDATE_VOLUMES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
891 #define FSCTL_QUERY_FAT_BPB CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS) // FSCTL_QUERY_FAT_BPB_BUFFER
892 #define FSCTL_REQUEST_FILTER_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
893 #define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILESYSTEM_STATISTICS
894 #if(_WIN32_WINNT >= 0x0400)
895 #define FSCTL_GET_NTFS_VOLUME_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS) // NTFS_VOLUME_DATA_BUFFER
896 #define FSCTL_GET_NTFS_FILE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS) // NTFS_FILE_RECORD_INPUT_BUFFER, NTFS_FILE_RECORD_OUTPUT_BUFFER
897 #define FSCTL_GET_VOLUME_BITMAP CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER, FILE_ANY_ACCESS) // STARTING_LCN_INPUT_BUFFER, VOLUME_BITMAP_BUFFER
898 #define FSCTL_GET_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER, FILE_ANY_ACCESS) // STARTING_VCN_INPUT_BUFFER, RETRIEVAL_POINTERS_BUFFER
899 #define FSCTL_MOVE_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // MOVE_FILE_DATA,
900 #define FSCTL_IS_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
901 // decomissioned fsctl value 31
902 #define FSCTL_ALLOW_EXTENDED_DASD_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER, FILE_ANY_ACCESS)
903 #endif /* _WIN32_WINNT >= 0x0400 */
906 // Define the base asynchronous I/O argument types
909 typedef struct _IO_STATUS_BLOCK
{
912 } IO_STATUS_BLOCK
, *PIO_STATUS_BLOCK
;
915 // Define an Asynchronous Procedure Call from I/O viewpoint
922 IN PIO_STATUS_BLOCK IoStatusBlock
,
927 // Define the file information class values
929 // WARNING: The order of the following values are assumed by the I/O system.
930 // Any changes made here should be reflected there as well.
933 typedef enum _FILE_INFORMATION_CLASS
{
934 FileDirectoryInformation
= 1,
935 FileFullDirectoryInformation
,
936 FileBothDirectoryInformation
,
937 FileBasicInformation
,
938 FileStandardInformation
,
939 FileInternalInformation
,
941 FileAccessInformation
,
943 FileRenameInformation
,
945 FileNamesInformation
,
946 FileDispositionInformation
,
947 FilePositionInformation
,
948 FileFullEaInformation
,
950 FileAlignmentInformation
,
952 FileAllocationInformation
,
953 FileEndOfFileInformation
,
954 FileAlternateNameInformation
,
955 FileStreamInformation
,
957 FilePipeLocalInformation
,
958 FilePipeRemoteInformation
,
959 FileMailslotQueryInformation
,
960 FileMailslotSetInformation
,
961 FileCompressionInformation
,
962 FileCopyOnWriteInformation
,
963 FileCompletionInformation
,
964 FileMoveClusterInformation
,
965 FileOleClassIdInformation
,
966 FileOleStateBitsInformation
,
967 FileNetworkOpenInformation
,
968 FileObjectIdInformation
,
969 FileOleAllInformation
,
970 FileOleDirectoryInformation
,
971 FileContentIndexInformation
,
972 FileInheritContentIndexInformation
,
974 FileMaximumInformation
975 } FILE_INFORMATION_CLASS
, *PFILE_INFORMATION_CLASS
;
978 // Define the various structures which are returned on query operations
981 typedef struct _FILE_BASIC_INFORMATION
{
982 LARGE_INTEGER CreationTime
;
983 LARGE_INTEGER LastAccessTime
;
984 LARGE_INTEGER LastWriteTime
;
985 LARGE_INTEGER ChangeTime
;
986 ULONG FileAttributes
;
987 } FILE_BASIC_INFORMATION
, *PFILE_BASIC_INFORMATION
;
989 typedef struct _FILE_STANDARD_INFORMATION
{
990 LARGE_INTEGER AllocationSize
;
991 LARGE_INTEGER EndOfFile
;
993 BOOLEAN DeletePending
;
995 } FILE_STANDARD_INFORMATION
, *PFILE_STANDARD_INFORMATION
;
997 typedef struct _FILE_POSITION_INFORMATION
{
998 LARGE_INTEGER CurrentByteOffset
;
999 } FILE_POSITION_INFORMATION
, *PFILE_POSITION_INFORMATION
;
1001 typedef struct _FILE_ALIGNMENT_INFORMATION
{
1002 ULONG AlignmentRequirement
;
1003 } FILE_ALIGNMENT_INFORMATION
, *PFILE_ALIGNMENT_INFORMATION
;
1005 typedef struct _FILE_NETWORK_OPEN_INFORMATION
{
1006 LARGE_INTEGER CreationTime
;
1007 LARGE_INTEGER LastAccessTime
;
1008 LARGE_INTEGER LastWriteTime
;
1009 LARGE_INTEGER ChangeTime
;
1010 LARGE_INTEGER AllocationSize
;
1011 LARGE_INTEGER EndOfFile
;
1012 ULONG FileAttributes
;
1013 } FILE_NETWORK_OPEN_INFORMATION
, *PFILE_NETWORK_OPEN_INFORMATION
;
1015 typedef struct _FILE_DISPOSITION_INFORMATION
{
1017 } FILE_DISPOSITION_INFORMATION
, *PFILE_DISPOSITION_INFORMATION
;
1019 typedef struct _FILE_END_OF_FILE_INFORMATION
{
1020 LARGE_INTEGER EndOfFile
;
1021 } FILE_END_OF_FILE_INFORMATION
, *PFILE_END_OF_FILE_INFORMATION
;
1024 typedef struct _FILE_FULL_EA_INFORMATION
{
1025 ULONG NextEntryOffset
;
1028 USHORT EaValueLength
;
1030 } FILE_FULL_EA_INFORMATION
, *PFILE_FULL_EA_INFORMATION
;
1033 // Define the file system information class values
1035 // WARNING: The order of the following values are assumed by the I/O system.
1036 // Any changes made here should be reflected there as well.
1038 typedef enum _FSINFOCLASS
{
1039 FileFsVolumeInformation
= 1,
1040 FileFsLabelInformation
,
1041 FileFsSizeInformation
,
1042 FileFsDeviceInformation
,
1043 FileFsAttributeInformation
,
1044 FileFsControlInformation
,
1045 FileFsQuotaQueryInformation
, // temporary
1046 FileFsQuotaSetInformation
, // temporary
1047 FileFsMaximumInformation
1048 } FS_INFORMATION_CLASS
, *PFS_INFORMATION_CLASS
;
1050 typedef struct _FILE_FS_DEVICE_INFORMATION
{
1051 DEVICE_TYPE DeviceType
;
1052 ULONG Characteristics
;
1053 } FILE_FS_DEVICE_INFORMATION
, *PFILE_FS_DEVICE_INFORMATION
;
1056 // Registry Specific Access Rights.
1059 #define KEY_QUERY_VALUE (0x0001)
1060 #define KEY_SET_VALUE (0x0002)
1061 #define KEY_CREATE_SUB_KEY (0x0004)
1062 #define KEY_ENUMERATE_SUB_KEYS (0x0008)
1063 #define KEY_NOTIFY (0x0010)
1064 #define KEY_CREATE_LINK (0x0020)
1066 #define KEY_READ ((STANDARD_RIGHTS_READ |\
1068 KEY_ENUMERATE_SUB_KEYS |\
1074 #define KEY_WRITE ((STANDARD_RIGHTS_WRITE |\
1076 KEY_CREATE_SUB_KEY) \
1080 #define KEY_EXECUTE ((KEY_READ) \
1084 #define KEY_ALL_ACCESS ((STANDARD_RIGHTS_ALL |\
1087 KEY_CREATE_SUB_KEY |\
1088 KEY_ENUMERATE_SUB_KEYS |\
1095 // Open/Create Options
1098 #define REG_OPTION_RESERVED (0x00000000L) // Parameter is reserved
1100 #define REG_OPTION_NON_VOLATILE (0x00000000L) // Key is preserved
1101 // when system is rebooted
1103 #define REG_OPTION_VOLATILE (0x00000001L) // Key is not preserved
1104 // when system is rebooted
1106 #define REG_OPTION_CREATE_LINK (0x00000002L) // Created key is a
1109 #define REG_OPTION_BACKUP_RESTORE (0x00000004L) // open for backup or restore
1110 // special access rules
1111 // privilege required
1113 #define REG_OPTION_OPEN_LINK (0x00000008L) // Open symbolic link
1115 #define REG_LEGAL_OPTION \
1116 (REG_OPTION_RESERVED |\
1117 REG_OPTION_NON_VOLATILE |\
1118 REG_OPTION_VOLATILE |\
1119 REG_OPTION_CREATE_LINK |\
1120 REG_OPTION_BACKUP_RESTORE |\
1121 REG_OPTION_OPEN_LINK)
1124 // Key creation/open disposition
1127 #define REG_CREATED_NEW_KEY (0x00000001L) // New Registry Key created
1128 #define REG_OPENED_EXISTING_KEY (0x00000002L) // Existing Key opened
1131 // Key restore flags
1134 #define REG_WHOLE_HIVE_VOLATILE (0x00000001L) // Restore whole hive volatile
1135 #define REG_REFRESH_HIVE (0x00000002L) // Unwind changes to last flush
1136 #define REG_NO_LAZY_FLUSH (0x00000004L) // Never lazy flush this hive
1139 // Key query structures
1142 typedef struct _KEY_BASIC_INFORMATION
{
1143 LARGE_INTEGER LastWriteTime
;
1146 WCHAR Name
[1]; // Variable length string
1147 } KEY_BASIC_INFORMATION
, *PKEY_BASIC_INFORMATION
;
1149 typedef struct _KEY_NODE_INFORMATION
{
1150 LARGE_INTEGER LastWriteTime
;
1155 WCHAR Name
[1]; // Variable length string
1156 // Class[1]; // Variable length string not declared
1157 } KEY_NODE_INFORMATION
, *PKEY_NODE_INFORMATION
;
1159 typedef struct _KEY_FULL_INFORMATION
{
1160 LARGE_INTEGER LastWriteTime
;
1168 ULONG MaxValueNameLen
;
1169 ULONG MaxValueDataLen
;
1170 WCHAR Class
[1]; // Variable length
1171 } KEY_FULL_INFORMATION
, *PKEY_FULL_INFORMATION
;
1173 typedef enum _KEY_INFORMATION_CLASS
{
1174 KeyBasicInformation
,
1177 } KEY_INFORMATION_CLASS
;
1179 typedef struct _KEY_WRITE_TIME_INFORMATION
{
1180 LARGE_INTEGER LastWriteTime
;
1181 } KEY_WRITE_TIME_INFORMATION
, *PKEY_WRITE_TIME_INFORMATION
;
1183 typedef enum _KEY_SET_INFORMATION_CLASS
{
1184 KeyWriteTimeInformation
1185 } KEY_SET_INFORMATION_CLASS
;
1188 // Value entry query structures
1191 typedef struct _KEY_VALUE_BASIC_INFORMATION
{
1195 WCHAR Name
[1]; // Variable size
1196 } KEY_VALUE_BASIC_INFORMATION
, *PKEY_VALUE_BASIC_INFORMATION
;
1198 typedef struct _KEY_VALUE_FULL_INFORMATION
{
1204 WCHAR Name
[1]; // Variable size
1205 // Data[1]; // Variable size data not declared
1206 } KEY_VALUE_FULL_INFORMATION
, *PKEY_VALUE_FULL_INFORMATION
;
1208 typedef struct _KEY_VALUE_PARTIAL_INFORMATION
{
1212 UCHAR Data
[1]; // Variable size
1213 } KEY_VALUE_PARTIAL_INFORMATION
, *PKEY_VALUE_PARTIAL_INFORMATION
;
1215 typedef struct _KEY_VALUE_ENTRY
{
1216 PUNICODE_STRING ValueName
;
1220 } KEY_VALUE_ENTRY
, *PKEY_VALUE_ENTRY
;
1222 typedef enum _KEY_VALUE_INFORMATION_CLASS
{
1223 KeyValueBasicInformation
,
1224 KeyValueFullInformation
,
1225 KeyValuePartialInformation
1226 } KEY_VALUE_INFORMATION_CLASS
;
1233 IN HANDLE KeyHandle
,
1235 IN KEY_INFORMATION_CLASS KeyInformationClass
,
1236 IN PVOID KeyInformation
,
1238 IN PULONG ResultLength
1245 OUT PHANDLE KeyHandle
,
1246 IN ACCESS_MASK DesiredAccess
,
1247 IN POBJECT_ATTRIBUTES ObjectAttributes
1254 IN HANDLE KeyHandle
,
1255 IN PUNICODE_STRING ValueName
,
1256 IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass
,
1257 IN PVOID KeyValueInformation
,
1259 IN PULONG ResultLength
1266 IN HANDLE KeyHandle
,
1267 IN PUNICODE_STRING ValueName
,
1268 IN ULONG TitleIndex OPTIONAL
,
1278 IN HANDLE KeyHandle
,
1279 IN PUNICODE_STRING ValueName
1283 #define OBJ_NAME_PATH_SEPARATOR ((WCHAR)L'\\')
1286 // Object Manager Object Type Specific Access Rights.
1289 #define OBJECT_TYPE_CREATE (0x0001)
1291 #define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
1294 // Object Manager Directory Specific Access Rights.
1297 #define DIRECTORY_QUERY (0x0001)
1298 #define DIRECTORY_TRAVERSE (0x0002)
1299 #define DIRECTORY_CREATE_OBJECT (0x0004)
1300 #define DIRECTORY_CREATE_SUBDIRECTORY (0x0008)
1302 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)
1305 // Object Manager Symbolic Link Specific Access Rights.
1308 #define SYMBOLIC_LINK_QUERY (0x0001)
1310 #define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
1312 typedef struct _OBJECT_NAME_INFORMATION
{
1313 UNICODE_STRING Name
;
1314 } OBJECT_NAME_INFORMATION
, *POBJECT_NAME_INFORMATION
;
1317 // Section Information Structures.
1320 typedef enum _SECTION_INHERIT
{
1326 // Section Access Rights.
1330 #define SECTION_QUERY 0x0001
1331 #define SECTION_MAP_WRITE 0x0002
1332 #define SECTION_MAP_READ 0x0004
1333 #define SECTION_MAP_EXECUTE 0x0008
1334 #define SECTION_EXTEND_SIZE 0x0010
1336 #define SECTION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|\
1337 SECTION_MAP_WRITE | \
1338 SECTION_MAP_READ | \
1339 SECTION_MAP_EXECUTE | \
1340 SECTION_EXTEND_SIZE)
1343 #define SEGMENT_ALL_ACCESS SECTION_ALL_ACCESS
1345 #define PAGE_NOACCESS 0x01 // winnt
1346 #define PAGE_READONLY 0x02 // winnt
1347 #define PAGE_READWRITE 0x04 // winnt
1348 #define PAGE_WRITECOPY 0x08 // winnt
1349 #define PAGE_EXECUTE 0x10 // winnt
1350 #define PAGE_EXECUTE_READ 0x20 // winnt
1351 #define PAGE_EXECUTE_READWRITE 0x40 // winnt
1352 #define PAGE_EXECUTE_WRITECOPY 0x80 // winnt
1353 #define PAGE_GUARD 0x100 // winnt
1354 #define PAGE_NOCACHE 0x200 // winnt
1356 #define MEM_COMMIT 0x1000
1357 #define MEM_RESERVE 0x2000
1358 #define MEM_DECOMMIT 0x4000
1359 #define MEM_RELEASE 0x8000
1360 #define MEM_FREE 0x10000
1361 #define MEM_PRIVATE 0x20000
1362 #define MEM_MAPPED 0x40000
1363 #define MEM_RESET 0x80000
1364 #define MEM_TOP_DOWN 0x100000
1365 #define MEM_LARGE_PAGES 0x20000000
1366 #define SEC_RESERVE 0x4000000
1367 #define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \
1371 #define MAXIMUM_PROCESSORS 32
1376 // Thread Specific Access Rights
1379 #define THREAD_TERMINATE (0x0001) // winnt
1380 #define THREAD_SET_INFORMATION (0x0020) // winnt
1382 #define THREAD_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \
1389 typedef struct _CLIENT_ID
{
1390 HANDLE UniqueProcess
;
1391 HANDLE UniqueThread
;
1393 typedef CLIENT_ID
*PCLIENT_ID
;
1396 // Define the size of the 80387 save area, which is in the context frame.
1399 #define SIZE_OF_80387_REGISTERS 80
1402 // The following flags control the contents of the CONTEXT structure.
1405 #if !defined(RC_INVOKED)
1407 #define CONTEXT_i386 0x00010000 // this assumes that i386 and
1408 #define CONTEXT_i486 0x00010000 // i486 have identical context records
1412 #define CONTEXT_CONTROL (CONTEXT_i386 | 0x00000001L) // SS:SP, CS:IP, FLAGS, BP
1413 #define CONTEXT_INTEGER (CONTEXT_i386 | 0x00000002L) // AX, BX, CX, DX, SI, DI
1414 #define CONTEXT_SEGMENTS (CONTEXT_i386 | 0x00000004L) // DS, ES, FS, GS
1415 #define CONTEXT_FLOATING_POINT (CONTEXT_i386 | 0x00000008L) // 387 state
1416 #define CONTEXT_DEBUG_REGISTERS (CONTEXT_i386 | 0x00000010L) // DB 0-3,6,7
1418 #define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER |\
1425 typedef struct _FLOATING_SAVE_AREA
{
1430 ULONG ErrorSelector
;
1433 UCHAR RegisterArea
[SIZE_OF_80387_REGISTERS
];
1435 } FLOATING_SAVE_AREA
;
1437 typedef FLOATING_SAVE_AREA
*PFLOATING_SAVE_AREA
;
1442 // This frame has a several purposes: 1) it is used as an argument to
1443 // NtContinue, 2) is is used to constuct a call frame for APC delivery,
1444 // and 3) it is used in the user level thread creation routines.
1446 // The layout of the record conforms to a standard call frame.
1449 typedef struct _CONTEXT
{
1452 // The flags values within this flag control the contents of
1453 // a CONTEXT record.
1455 // If the context record is used as an input parameter, then
1456 // for each portion of the context record controlled by a flag
1457 // whose value is set, it is assumed that that portion of the
1458 // context record contains valid context. If the context record
1459 // is being used to modify a threads context, then only that
1460 // portion of the threads context will be modified.
1462 // If the context record is used as an IN OUT parameter to capture
1463 // the context of a thread, then only those portions of the thread's
1464 // context corresponding to set flags will be returned.
1466 // The context record is never used as an OUT only parameter.
1472 // This section is specified/returned if CONTEXT_DEBUG_REGISTERS is
1473 // set in ContextFlags. Note that CONTEXT_DEBUG_REGISTERS is NOT
1474 // included in CONTEXT_FULL.
1485 // This section is specified/returned if the
1486 // ContextFlags word contians the flag CONTEXT_FLOATING_POINT.
1489 FLOATING_SAVE_AREA FloatSave
;
1492 // This section is specified/returned if the
1493 // ContextFlags word contians the flag CONTEXT_SEGMENTS.
1502 // This section is specified/returned if the
1503 // ContextFlags word contians the flag CONTEXT_INTEGER.
1514 // This section is specified/returned if the
1515 // ContextFlags word contians the flag CONTEXT_CONTROL.
1520 ULONG SegCs
; // MUST BE SANITIZED
1521 ULONG EFlags
; // MUST BE SANITIZED
1529 typedef CONTEXT
*PCONTEXT
;
1532 // Predefined Value Types.
1535 #define REG_NONE ( 0 ) // No value type
1536 #define REG_SZ ( 1 ) // Unicode nul terminated string
1537 #define REG_EXPAND_SZ ( 2 ) // Unicode nul terminated string
1538 // (with environment variable references)
1539 #define REG_BINARY ( 3 ) // Free form binary
1540 #define REG_DWORD ( 4 ) // 32-bit number
1541 #define REG_DWORD_LITTLE_ENDIAN ( 4 ) // 32-bit number (same as REG_DWORD)
1542 #define REG_DWORD_BIG_ENDIAN ( 5 ) // 32-bit number
1543 #define REG_LINK ( 6 ) // Symbolic Link (unicode)
1544 #define REG_MULTI_SZ ( 7 ) // Multiple Unicode strings
1545 #define REG_RESOURCE_LIST ( 8 ) // Resource list in the resource map
1546 #define REG_FULL_RESOURCE_DESCRIPTOR ( 9 ) // Resource list in the hardware description
1547 #define REG_RESOURCE_REQUIREMENTS_LIST ( 10 )
1552 InterlockedIncrement(
1558 InterlockedDecrement(
1564 InterlockedExchange(
1565 IN OUT PLONG Target,
1571 InterlockedExchangeAdd(
1572 IN OUT PLONG Addend,
1578 InterlockedCompareExchange(
1579 IN OUT PVOID *Destination,
1585 // Environment information, which includes command line and
1590 UNICODE_STRING CommandLine
;
1591 UNICODE_STRING ImageFile
;
1592 } ENVIRONMENT_INFORMATION
, *PENVIRONMENT_INFORMATION
;
1595 // This structure is passed as NtProcessStartup's parameter
1599 PENVIRONMENT_INFORMATION Environment
;
1600 } STARTUP_ARGUMENT
, *PSTARTUP_ARGUMENT
;
1603 // Data structure for heap definition. This includes various
1604 // sizing parameters and callback routines, which, if left NULL,
1605 // result in default behavior
1610 } RTL_HEAP_DEFINITION
, *PRTL_HEAP_DEFINITION
;
1613 // Native NT api function to write something to the boot-time
1619 PUNICODE_STRING String
1623 // Native applications must kill themselves when done - the job
1624 // of this native API
1629 HANDLE ProcessHandle
,
1634 // Thread start function
1639 (*PKSTART_ROUTINE
) (
1640 IN PVOID StartContext
1643 typedef struct StackInfo_t
{
1647 ULONG OnePageBelowTopOfStack
;
1648 ULONG BottomOfStack
;
1649 } STACKINFO
, *PSTACKINFO
;
1655 OUT PHANDLE phThread
,
1656 IN ACCESS_MASK AccessMask
,
1657 IN POBJECT_ATTRIBUTES ObjectAttributes
,
1659 OUT PCLIENT_ID pClientId
,
1660 IN PCONTEXT pContext
,
1661 OUT PSTACKINFO pStackInfo
,
1662 IN BOOLEAN bSuspended
1666 PsCreateSystemThread(
1667 OUT PHANDLE ThreadHandle,
1668 IN ACCESS_MASK DesiredAccess,
1669 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
1670 IN HANDLE ProcessHandle OPTIONAL,
1671 OUT PCLIENT_ID ClientId OPTIONAL,
1672 IN PKSTART_ROUTINE StartRoutine,
1673 IN PVOID StartContext
1678 IN HANDLE ThreadHandle OPTIONAL
,
1679 IN NTSTATUS ExitStatus
1685 PULONG MajorVersion OPTIONAL,
1686 PULONG MinorVersion OPTIONAL,
1687 PULONG BuildNumber OPTIONAL,
1688 PUNICODE_STRING CSDVersion OPTIONAL
1692 PsGetCurrentProcessId( VOID );
1695 PsGetCurrentThreadId( VOID );
1698 // Definition to represent current process
1700 #define NtCurrentProcess() ( (HANDLE) -1 )
1703 (*PRTL_HEAP_COMMIT_ROUTINE
)(
1705 IN OUT PVOID
*CommitAddress
,
1706 IN OUT PULONG CommitSize
1709 typedef struct _RTL_HEAP_PARAMETERS
{
1711 ULONG SegmentReserve
;
1712 ULONG SegmentCommit
;
1713 ULONG DeCommitFreeBlockThreshold
;
1714 ULONG DeCommitTotalFreeThreshold
;
1715 ULONG MaximumAllocationSize
;
1716 ULONG VirtualMemoryThreshold
;
1717 ULONG InitialCommit
;
1718 ULONG InitialReserve
;
1719 PRTL_HEAP_COMMIT_ROUTINE CommitRoutine
;
1720 ULONG Reserved
[ 2 ];
1721 } RTL_HEAP_PARAMETERS
, *PRTL_HEAP_PARAMETERS
;
1728 IN PVOID HeapBase OPTIONAL
,
1729 IN ULONG ReserveSize OPTIONAL
,
1730 IN ULONG CommitSize OPTIONAL
,
1731 IN PVOID Lock OPTIONAL
,
1732 IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL
1735 #define HEAP_NO_SERIALIZE 0x00000001 // winnt
1736 #define HEAP_GROWABLE 0x00000002 // winnt
1737 #define HEAP_GENERATE_EXCEPTIONS 0x00000004 // winnt
1738 #define HEAP_ZERO_MEMORY 0x00000008 // winnt
1739 #define HEAP_REALLOC_IN_PLACE_ONLY 0x00000010 // winnt
1740 #define HEAP_TAIL_CHECKING_ENABLED 0x00000020 // winnt
1741 #define HEAP_FREE_CHECKING_ENABLED 0x00000040 // winnt
1742 #define HEAP_DISABLE_COALESCE_ON_FREE 0x00000080 // winnt
1744 #define HEAP_CREATE_ALIGN_16 0x00010000 // winnt Create heap with 16 byte alignment
1745 #define HEAP_CREATE_ENABLE_TRACING 0x00020000 // winnt Create heap call tracing enabled
1747 #define HEAP_SETTABLE_USER_VALUE 0x00000100
1748 #define HEAP_SETTABLE_USER_FLAG1 0x00000200
1749 #define HEAP_SETTABLE_USER_FLAG2 0x00000400
1750 #define HEAP_SETTABLE_USER_FLAG3 0x00000800
1751 #define HEAP_SETTABLE_USER_FLAGS 0x00000E00
1753 #define HEAP_CLASS_0 0x00000000 // process heap
1754 #define HEAP_CLASS_1 0x00001000 // private heap
1755 #define HEAP_CLASS_2 0x00002000 // Kernel Heap
1756 #define HEAP_CLASS_3 0x00003000 // GDI heap
1757 #define HEAP_CLASS_4 0x00004000 // User heap
1758 #define HEAP_CLASS_5 0x00005000 // Console heap
1759 #define HEAP_CLASS_6 0x00006000 // User Desktop heap
1760 #define HEAP_CLASS_7 0x00007000 // Csrss Shared heap
1761 #define HEAP_CLASS_8 0x00008000 // Csr Port heap
1762 #define HEAP_CLASS_MASK 0x0000F000
1764 #define HEAP_MAXIMUM_TAG 0x0FFF // winnt
1765 #define HEAP_GLOBAL_TAG 0x0800
1766 #define HEAP_PSEUDO_TAG_FLAG 0x8000 // winnt
1767 #define HEAP_TAG_SHIFT 16 // winnt
1768 #define HEAP_MAKE_TAG_FLAGS( b, o ) ((ULONG)((b) + ((o) << 16))) // winnt
1769 #define HEAP_TAG_MASK (HEAP_MAXIMUM_TAG << HEAP_TAG_SHIFT)
1771 #define HEAP_CREATE_VALID_MASK (HEAP_NO_SERIALIZE | \
1773 HEAP_GENERATE_EXCEPTIONS | \
1774 HEAP_ZERO_MEMORY | \
1775 HEAP_REALLOC_IN_PLACE_ONLY | \
1776 HEAP_TAIL_CHECKING_ENABLED | \
1777 HEAP_FREE_CHECKING_ENABLED | \
1778 HEAP_DISABLE_COALESCE_ON_FREE | \
1780 HEAP_CREATE_ALIGN_16 | \
1781 HEAP_CREATE_ENABLE_TRACING)
1791 // Heap allocation function (ala "malloc")
1802 // Heap free function (ala "free")
1816 OUT PHANDLE FileHandle
,
1817 IN ACCESS_MASK DesiredAccess
,
1818 IN POBJECT_ATTRIBUTES ObjectAttributes
,
1819 OUT PIO_STATUS_BLOCK IoStatusBlock
,
1820 IN PLARGE_INTEGER AllocationSize OPTIONAL
,
1821 IN ULONG FileAttributes
,
1822 IN ULONG ShareAccess
,
1823 IN ULONG CreateDisposition
,
1824 IN ULONG CreateOptions
,
1825 IN PVOID EaBuffer OPTIONAL
,
1834 IN ACCESS_MASK DesiredAccess
,
1835 IN POBJECT_ATTRIBUTES ObjectAttributes
,
1836 OUT PIO_STATUS_BLOCK pIoStatusBlock
,
1844 NtDeviceIoControlFile(
1846 IN HANDLE hEvent OPTIONAL
,
1847 IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL
,
1848 IN PVOID IoApcContext OPTIONAL
,
1849 OUT PIO_STATUS_BLOCK pIoStatusBlock
,
1850 IN ULONG DeviceIoControlCode
,
1851 IN PVOID InBuffer OPTIONAL
,
1852 IN ULONG InBufferLength
,
1853 OUT PVOID OutBuffer OPTIONAL
,
1854 IN ULONG OutBufferLength
1862 IN HANDLE hEvent OPTIONAL
,
1863 IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL
,
1864 IN PVOID IoApcContext OPTIONAL
,
1865 OUT PIO_STATUS_BLOCK pIoStatusBlock
,
1866 IN ULONG DeviceIoControlCode
,
1867 IN PVOID InBuffer OPTIONAL
,
1868 IN ULONG InBufferLength
,
1869 OUT PVOID OutBuffer OPTIONAL
,
1870 IN ULONG OutBufferLength
1878 IN HANDLE hEvent OPTIONAL
,
1879 IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL
,
1880 IN PVOID IoApcContext OPTIONAL
,
1881 OUT PIO_STATUS_BLOCK pIoStatusBlock
,
1882 OUT PVOID ReadBuffer
,
1883 IN ULONG ReadBufferLength
,
1884 IN PLARGE_INTEGER FileOffset OPTIONAL
,
1885 IN PULONG LockOperationKey
1893 IN HANDLE hEvent OPTIONAL
,
1894 IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL
,
1895 IN PVOID IoApcContext OPTIONAL
,
1896 OUT PIO_STATUS_BLOCK pIoStatusBlock
,
1897 IN PVOID WriteBuffer
,
1898 IN ULONG WriteBufferLength
,
1899 IN PLARGE_INTEGER FileOffset OPTIONAL
,
1900 IN PULONG LockOperationKey OPTIONAL
1906 NtQueryInformationFile(
1908 OUT PIO_STATUS_BLOCK pIoStatusBlock
,
1909 OUT PVOID FileInformationBuffer
,
1910 IN ULONG FileInformationBufferLength
,
1911 IN FILE_INFORMATION_CLASS FileInfoClass
1917 NtSetInformationFile(
1919 OUT PIO_STATUS_BLOCK pIoStatusBlock
,
1920 IN PVOID FileInformationBuffer
,
1921 IN ULONG FileInformationBufferLength
,
1922 IN FILE_INFORMATION_CLASS FileInfoClass
1934 NtWaitForSingleObject(
1936 IN BOOLEAN bAlertable
,
1937 IN PLARGE_INTEGER Timeout
1943 IN BOOLEAN Alertable
,
1944 IN PLARGE_INTEGER DelayInterval
1949 #endif //__cplusplus
1951 #endif //__NT_NATIVE_DEFS__H__