4 * Windows NT Filesystem Driver Developer Kit
6 * This file is part of the w32api package.
9 * Created by Bo Brantén <bosse@acc.umu.se>
11 * THIS SOFTWARE IS NOT COPYRIGHTED
13 * This source code is offered for use in the public domain. You may
14 * use, modify or distribute it freely.
16 * This code is distributed in the hope that it will be useful but
17 * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
18 * DISCLAIMED. This includes but is not limited to warranties of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
28 #pragma GCC system_header
32 /* HACKHACKHACK!!! We shouldn't include this header from ntoskrnl! */
35 #define NTKERNELAPI DECLSPEC_IMPORT
40 #define _NTIFS_INCLUDED_
47 #ifndef VER_PRODUCTBUILD
48 #define VER_PRODUCTBUILD 10000
55 #define EX_PUSH_LOCK ULONG_PTR
56 #define PEX_PUSH_LOCK PULONG_PTR
60 typedef struct _SE_EXPORTS
*PSE_EXPORTS
;
63 extern PUCHAR FsRtlLegalAnsiCharacterArray
;
65 extern DECLSPEC_IMPORT PUCHAR FsRtlLegalAnsiCharacterArray
;
67 extern PSE_EXPORTS SeExports
;
68 extern PACL SePublicDefaultDacl
;
69 extern PACL SeSystemDefaultDacl
;
71 extern KSPIN_LOCK IoStatisticsLock
;
72 extern ULONG IoReadOperationCount
;
73 extern ULONG IoWriteOperationCount
;
74 extern ULONG IoOtherOperationCount
;
75 extern LARGE_INTEGER IoReadTransferCount
;
76 extern LARGE_INTEGER IoWriteTransferCount
;
77 extern LARGE_INTEGER IoOtherTransferCount
;
79 typedef STRING LSA_STRING
, *PLSA_STRING
;
80 typedef ULONG LSA_OPERATIONAL_MODE
, *PLSA_OPERATIONAL_MODE
;
82 typedef enum _SECURITY_LOGON_TYPE
84 UndefinedLogonType
= 0,
93 #if (_WIN32_WINNT >= 0x0501)
97 #if (_WIN32_WINNT >= 0x0502)
98 CachedRemoteInteractive
,
101 } SECURITY_LOGON_TYPE
, *PSECURITY_LOGON_TYPE
;
103 #define ANSI_DOS_STAR ('<')
104 #define ANSI_DOS_QM ('>')
105 #define ANSI_DOS_DOT ('"')
107 #define DOS_STAR (L'<')
108 #define DOS_QM (L'>')
109 #define DOS_DOT (L'"')
111 /* also in winnt.h */
112 #define ACCESS_MIN_MS_ACE_TYPE (0x0)
113 #define ACCESS_ALLOWED_ACE_TYPE (0x0)
114 #define ACCESS_DENIED_ACE_TYPE (0x1)
115 #define SYSTEM_AUDIT_ACE_TYPE (0x2)
116 #define SYSTEM_ALARM_ACE_TYPE (0x3)
117 #define ACCESS_MAX_MS_V2_ACE_TYPE (0x3)
118 #define ACCESS_ALLOWED_COMPOUND_ACE_TYPE (0x4)
119 #define ACCESS_MAX_MS_V3_ACE_TYPE (0x4)
120 #define ACCESS_MIN_MS_OBJECT_ACE_TYPE (0x5)
121 #define ACCESS_ALLOWED_OBJECT_ACE_TYPE (0x5)
122 #define ACCESS_DENIED_OBJECT_ACE_TYPE (0x6)
123 #define SYSTEM_AUDIT_OBJECT_ACE_TYPE (0x7)
124 #define SYSTEM_ALARM_OBJECT_ACE_TYPE (0x8)
125 #define ACCESS_MAX_MS_OBJECT_ACE_TYPE (0x8)
126 #define ACCESS_MAX_MS_V4_ACE_TYPE (0x8)
127 #define ACCESS_MAX_MS_ACE_TYPE (0x8)
128 #define ACCESS_ALLOWED_CALLBACK_ACE_TYPE (0x9)
129 #define ACCESS_DENIED_CALLBACK_ACE_TYPE (0xA)
130 #define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE (0xB)
131 #define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE (0xC)
132 #define SYSTEM_AUDIT_CALLBACK_ACE_TYPE (0xD)
133 #define SYSTEM_ALARM_CALLBACK_ACE_TYPE (0xE)
134 #define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE (0xF)
135 #define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE (0x10)
136 #define ACCESS_MAX_MS_V5_ACE_TYPE (0x10)
138 #define COMPRESSION_FORMAT_NONE (0x0000)
139 #define COMPRESSION_FORMAT_DEFAULT (0x0001)
140 #define COMPRESSION_FORMAT_LZNT1 (0x0002)
141 #define COMPRESSION_ENGINE_STANDARD (0x0000)
142 #define COMPRESSION_ENGINE_MAXIMUM (0x0100)
143 #define COMPRESSION_ENGINE_HIBER (0x0200)
145 #define FILE_ACTION_ADDED 0x00000001
146 #define FILE_ACTION_REMOVED 0x00000002
147 #define FILE_ACTION_MODIFIED 0x00000003
148 #define FILE_ACTION_RENAMED_OLD_NAME 0x00000004
149 #define FILE_ACTION_RENAMED_NEW_NAME 0x00000005
150 #define FILE_ACTION_ADDED_STREAM 0x00000006
151 #define FILE_ACTION_REMOVED_STREAM 0x00000007
152 #define FILE_ACTION_MODIFIED_STREAM 0x00000008
153 #define FILE_ACTION_REMOVED_BY_DELETE 0x00000009
154 #define FILE_ACTION_ID_NOT_TUNNELLED 0x0000000A
155 #define FILE_ACTION_TUNNELLED_ID_COLLISION 0x0000000B
158 #define FILE_EA_TYPE_BINARY 0xfffe
159 #define FILE_EA_TYPE_ASCII 0xfffd
160 #define FILE_EA_TYPE_BITMAP 0xfffb
161 #define FILE_EA_TYPE_METAFILE 0xfffa
162 #define FILE_EA_TYPE_ICON 0xfff9
163 #define FILE_EA_TYPE_EA 0xffee
164 #define FILE_EA_TYPE_MVMT 0xffdf
165 #define FILE_EA_TYPE_MVST 0xffde
166 #define FILE_EA_TYPE_ASN1 0xffdd
167 #define FILE_EA_TYPE_FAMILY_IDS 0xff01
169 #define FILE_NEED_EA 0x00000080
171 /* also in winnt.h */
172 #define FILE_NOTIFY_CHANGE_FILE_NAME 0x00000001
173 #define FILE_NOTIFY_CHANGE_DIR_NAME 0x00000002
174 #define FILE_NOTIFY_CHANGE_NAME 0x00000003
175 #define FILE_NOTIFY_CHANGE_ATTRIBUTES 0x00000004
176 #define FILE_NOTIFY_CHANGE_SIZE 0x00000008
177 #define FILE_NOTIFY_CHANGE_LAST_WRITE 0x00000010
178 #define FILE_NOTIFY_CHANGE_LAST_ACCESS 0x00000020
179 #define FILE_NOTIFY_CHANGE_CREATION 0x00000040
180 #define FILE_NOTIFY_CHANGE_EA 0x00000080
181 #define FILE_NOTIFY_CHANGE_SECURITY 0x00000100
182 #define FILE_NOTIFY_CHANGE_STREAM_NAME 0x00000200
183 #define FILE_NOTIFY_CHANGE_STREAM_SIZE 0x00000400
184 #define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
185 #define FILE_NOTIFY_VALID_MASK 0x00000fff
188 #define FILE_OPLOCK_BROKEN_TO_LEVEL_2 0x00000007
189 #define FILE_OPLOCK_BROKEN_TO_NONE 0x00000008
191 #define FILE_OPBATCH_BREAK_UNDERWAY 0x00000009
193 #define FILE_CASE_SENSITIVE_SEARCH 0x00000001
194 #define FILE_CASE_PRESERVED_NAMES 0x00000002
195 #define FILE_UNICODE_ON_DISK 0x00000004
196 #define FILE_PERSISTENT_ACLS 0x00000008
197 #define FILE_FILE_COMPRESSION 0x00000010
198 #define FILE_VOLUME_QUOTAS 0x00000020
199 #define FILE_SUPPORTS_SPARSE_FILES 0x00000040
200 #define FILE_SUPPORTS_REPARSE_POINTS 0x00000080
201 #define FILE_SUPPORTS_REMOTE_STORAGE 0x00000100
202 #define FS_LFN_APIS 0x00004000
203 #define FILE_VOLUME_IS_COMPRESSED 0x00008000
204 #define FILE_SUPPORTS_OBJECT_IDS 0x00010000
205 #define FILE_SUPPORTS_ENCRYPTION 0x00020000
206 #define FILE_NAMED_STREAMS 0x00040000
208 #define FILE_PIPE_BYTE_STREAM_TYPE 0x00000000
209 #define FILE_PIPE_MESSAGE_TYPE 0x00000001
211 #define FILE_PIPE_BYTE_STREAM_MODE 0x00000000
212 #define FILE_PIPE_MESSAGE_MODE 0x00000001
214 #define FILE_PIPE_QUEUE_OPERATION 0x00000000
215 #define FILE_PIPE_COMPLETE_OPERATION 0x00000001
217 #define FILE_PIPE_INBOUND 0x00000000
218 #define FILE_PIPE_OUTBOUND 0x00000001
219 #define FILE_PIPE_FULL_DUPLEX 0x00000002
221 #define FILE_PIPE_DISCONNECTED_STATE 0x00000001
222 #define FILE_PIPE_LISTENING_STATE 0x00000002
223 #define FILE_PIPE_CONNECTED_STATE 0x00000003
224 #define FILE_PIPE_CLOSING_STATE 0x00000004
226 #define FILE_PIPE_CLIENT_END 0x00000000
227 #define FILE_PIPE_SERVER_END 0x00000001
229 #define FILE_PIPE_READ_DATA 0x00000000
230 #define FILE_PIPE_WRITE_SPACE 0x00000001
232 #define FILE_STORAGE_TYPE_SPECIFIED 0x00000041 /* FILE_DIRECTORY_FILE | FILE_NON_DIRECTORY_FILE */
233 #define FILE_STORAGE_TYPE_DEFAULT (StorageTypeDefault << FILE_STORAGE_TYPE_SHIFT)
234 #define FILE_STORAGE_TYPE_DIRECTORY (StorageTypeDirectory << FILE_STORAGE_TYPE_SHIFT)
235 #define FILE_STORAGE_TYPE_FILE (StorageTypeFile << FILE_STORAGE_TYPE_SHIFT)
236 #define FILE_STORAGE_TYPE_DOCFILE (StorageTypeDocfile << FILE_STORAGE_TYPE_SHIFT)
237 #define FILE_STORAGE_TYPE_JUNCTION_POINT (StorageTypeJunctionPoint << FILE_STORAGE_TYPE_SHIFT)
238 #define FILE_STORAGE_TYPE_CATALOG (StorageTypeCatalog << FILE_STORAGE_TYPE_SHIFT)
239 #define FILE_STORAGE_TYPE_STRUCTURED_STORAGE (StorageTypeStructuredStorage << FILE_STORAGE_TYPE_SHIFT)
240 #define FILE_STORAGE_TYPE_EMBEDDING (StorageTypeEmbedding << FILE_STORAGE_TYPE_SHIFT)
241 #define FILE_STORAGE_TYPE_STREAM (StorageTypeStream << FILE_STORAGE_TYPE_SHIFT)
242 #define FILE_MINIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_DEFAULT
243 #define FILE_MAXIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_STREAM
244 #define FILE_STORAGE_TYPE_MASK 0x000f0000
245 #define FILE_STORAGE_TYPE_SHIFT 16
247 #define FILE_VC_QUOTA_NONE 0x00000000
248 #define FILE_VC_QUOTA_TRACK 0x00000001
249 #define FILE_VC_QUOTA_ENFORCE 0x00000002
250 #define FILE_VC_QUOTA_MASK 0x00000003
252 #define FILE_VC_QUOTAS_LOG_VIOLATIONS 0x00000004
253 #define FILE_VC_CONTENT_INDEX_DISABLED 0x00000008
255 #define FILE_VC_LOG_QUOTA_THRESHOLD 0x00000010
256 #define FILE_VC_LOG_QUOTA_LIMIT 0x00000020
257 #define FILE_VC_LOG_VOLUME_THRESHOLD 0x00000040
258 #define FILE_VC_LOG_VOLUME_LIMIT 0x00000080
260 #define FILE_VC_QUOTAS_INCOMPLETE 0x00000100
261 #define FILE_VC_QUOTAS_REBUILDING 0x00000200
263 #define FILE_VC_VALID_MASK 0x000003ff
265 #define FSRTL_FLAG_FILE_MODIFIED (0x01)
266 #define FSRTL_FLAG_FILE_LENGTH_CHANGED (0x02)
267 #define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04)
268 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08)
269 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10)
270 #define FSRTL_FLAG_USER_MAPPED_FILE (0x20)
271 #define FSRTL_FLAG_EOF_ADVANCE_ACTIVE (0x80)
273 #define FSRTL_FLAG2_DO_MODIFIED_WRITE (0x01)
275 #define FSRTL_FSP_TOP_LEVEL_IRP (0x01)
276 #define FSRTL_CACHE_TOP_LEVEL_IRP (0x02)
277 #define FSRTL_MOD_WRITE_TOP_LEVEL_IRP (0x03)
278 #define FSRTL_FAST_IO_TOP_LEVEL_IRP (0x04)
279 #define FSRTL_MAX_TOP_LEVEL_IRP_FLAG (0x04)
281 #define FSRTL_VOLUME_DISMOUNT 1
282 #define FSRTL_VOLUME_DISMOUNT_FAILED 2
283 #define FSRTL_VOLUME_LOCK 3
284 #define FSRTL_VOLUME_LOCK_FAILED 4
285 #define FSRTL_VOLUME_UNLOCK 5
286 #define FSRTL_VOLUME_MOUNT 6
288 #define FSRTL_WILD_CHARACTER 0x08
290 #define FSRTL_FAT_LEGAL 0x01
291 #define FSRTL_HPFS_LEGAL 0x02
292 #define FSRTL_NTFS_LEGAL 0x04
293 #define FSRTL_WILD_CHARACTER 0x08
294 #define FSRTL_OLE_LEGAL 0x10
295 #define FSRTL_NTFS_STREAM_LEGAL 0x14
298 #define HARDWARE_PTE HARDWARE_PTE_X86
299 #define PHARDWARE_PTE PHARDWARE_PTE_X86
301 #define HARDWARE_PTE ULONG
302 #define PHARDWARE_PTE PULONG
305 #define IO_CHECK_CREATE_PARAMETERS 0x0200
306 #define IO_ATTACH_DEVICE 0x0400
308 #define IO_ATTACH_DEVICE_API 0x80000000
310 #define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE 64
311 #define IO_FILE_OBJECT_PAGED_POOL_CHARGE 1024
313 #define IO_TYPE_APC 18
314 #define IO_TYPE_DPC 19
315 #define IO_TYPE_DEVICE_QUEUE 20
316 #define IO_TYPE_EVENT_PAIR 21
317 #define IO_TYPE_INTERRUPT 22
318 #define IO_TYPE_PROFILE 23
320 #define IRP_BEING_VERIFIED 0x10
322 #define MAILSLOT_CLASS_FIRSTCLASS 1
323 #define MAILSLOT_CLASS_SECONDCLASS 2
325 #define MAILSLOT_SIZE_AUTO 0
327 #define MAP_PROCESS 1L
328 #define MAP_SYSTEM 2L
329 #define MEM_DOS_LIM 0x40000000
331 #define OB_TYPE_TYPE 1
332 #define OB_TYPE_DIRECTORY 2
333 #define OB_TYPE_SYMBOLIC_LINK 3
334 #define OB_TYPE_TOKEN 4
335 #define OB_TYPE_PROCESS 5
336 #define OB_TYPE_THREAD 6
337 #define OB_TYPE_EVENT 7
338 #define OB_TYPE_EVENT_PAIR 8
339 #define OB_TYPE_MUTANT 9
340 #define OB_TYPE_SEMAPHORE 10
341 #define OB_TYPE_TIMER 11
342 #define OB_TYPE_PROFILE 12
343 #define OB_TYPE_WINDOW_STATION 13
344 #define OB_TYPE_DESKTOP 14
345 #define OB_TYPE_SECTION 15
346 #define OB_TYPE_KEY 16
347 #define OB_TYPE_PORT 17
348 #define OB_TYPE_ADAPTER 18
349 #define OB_TYPE_CONTROLLER 19
350 #define OB_TYPE_DEVICE 20
351 #define OB_TYPE_DRIVER 21
352 #define OB_TYPE_IO_COMPLETION 22
353 #define OB_TYPE_FILE 23
356 #define PIN_EXCLUSIVE (2)
357 #define PIN_NO_READ (4)
358 #define PIN_IF_BCB (8)
360 #define RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE 1
361 #define RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING 2
363 #define SEC_BASED 0x00200000
365 #define SECURITY_WORLD_SID_AUTHORITY {0,0,0,0,0,1}
366 #define SECURITY_WORLD_RID (0x00000000L)
368 #define SID_REVISION 1
369 #define SID_MAX_SUB_AUTHORITIES 15
370 #define SID_RECOMMENDED_SUB_AUTHORITIES 1
372 #define TOKEN_ASSIGN_PRIMARY (0x0001)
373 #define TOKEN_DUPLICATE (0x0002)
374 #define TOKEN_IMPERSONATE (0x0004)
375 #define TOKEN_QUERY (0x0008)
376 #define TOKEN_QUERY_SOURCE (0x0010)
377 #define TOKEN_ADJUST_PRIVILEGES (0x0020)
378 #define TOKEN_ADJUST_GROUPS (0x0040)
379 #define TOKEN_ADJUST_DEFAULT (0x0080)
380 #define TOKEN_ADJUST_SESSIONID (0x0100)
382 #define TOKEN_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED |\
383 TOKEN_ASSIGN_PRIMARY |\
387 TOKEN_QUERY_SOURCE |\
388 TOKEN_ADJUST_PRIVILEGES |\
389 TOKEN_ADJUST_GROUPS |\
390 TOKEN_ADJUST_DEFAULT |\
391 TOKEN_ADJUST_SESSIONID)
393 #define TOKEN_READ (STANDARD_RIGHTS_READ |\
396 #define TOKEN_WRITE (STANDARD_RIGHTS_WRITE |\
397 TOKEN_ADJUST_PRIVILEGES |\
398 TOKEN_ADJUST_GROUPS |\
399 TOKEN_ADJUST_DEFAULT)
401 #define TOKEN_EXECUTE (STANDARD_RIGHTS_EXECUTE)
403 #define TOKEN_SOURCE_LENGTH 8
406 #define TOKEN_HAS_TRAVERSE_PRIVILEGE 0x01
407 #define TOKEN_HAS_BACKUP_PRIVILEGE 0x02
408 #define TOKEN_HAS_RESTORE_PRIVILEGE 0x04
409 #define TOKEN_HAS_ADMIN_GROUP 0x08
410 #define TOKEN_WRITE_RESTRICTED 0x08
411 #define TOKEN_IS_RESTRICTED 0x10
412 #define SE_BACKUP_PRIVILEGES_CHECKED 0x0100
414 #define VACB_MAPPING_GRANULARITY (0x40000)
415 #define VACB_OFFSET_SHIFT (18)
417 #define SE_OWNER_DEFAULTED 0x0001
418 #define SE_GROUP_DEFAULTED 0x0002
419 #define SE_DACL_PRESENT 0x0004
420 #define SE_DACL_DEFAULTED 0x0008
421 #define SE_SACL_PRESENT 0x0010
422 #define SE_SACL_DEFAULTED 0x0020
423 #define SE_DACL_UNTRUSTED 0x0040
424 #define SE_SERVER_SECURITY 0x0080
425 #define SE_DACL_AUTO_INHERIT_REQ 0x0100
426 #define SE_SACL_AUTO_INHERIT_REQ 0x0200
427 #define SE_DACL_AUTO_INHERITED 0x0400
428 #define SE_SACL_AUTO_INHERITED 0x0800
429 #define SE_DACL_PROTECTED 0x1000
430 #define SE_SACL_PROTECTED 0x2000
431 #define SE_RM_CONTROL_VALID 0x4000
432 #define SE_SELF_RELATIVE 0x8000
435 #define _AUDIT_EVENT_TYPE_HACK 0
437 #if (_AUDIT_EVENT_TYPE_HACK == 1)
440 typedef enum _AUDIT_EVENT_TYPE
442 AuditEventObjectAccess
,
443 AuditEventDirectoryServiceAccess
444 } AUDIT_EVENT_TYPE
, *PAUDIT_EVENT_TYPE
;
447 #define AUDIT_ALLOW_NO_PRIVILEGE 0x1
449 #define FSCTL_REQUEST_OPLOCK_LEVEL_1 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
450 #define FSCTL_REQUEST_OPLOCK_LEVEL_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
451 #define FSCTL_REQUEST_BATCH_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
452 #define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 3, METHOD_BUFFERED, FILE_ANY_ACCESS)
453 #define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
454 #define FSCTL_OPLOCK_BREAK_NOTIFY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 5, METHOD_BUFFERED, FILE_ANY_ACCESS)
455 #define FSCTL_LOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
456 #define FSCTL_UNLOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
457 #define FSCTL_DISMOUNT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
459 #define FSCTL_IS_VOLUME_MOUNTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
460 #define FSCTL_IS_PATHNAME_VALID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
461 #define FSCTL_MARK_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
463 #define FSCTL_QUERY_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER, FILE_ANY_ACCESS)
464 #define FSCTL_GET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
465 #define FSCTL_SET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
468 #define FSCTL_MARK_AS_SYSTEM_HIVE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS)
469 #define FSCTL_OPLOCK_BREAK_ACK_NO_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
470 #define FSCTL_INVALIDATE_VOLUMES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
471 #define FSCTL_QUERY_FAT_BPB CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS)
472 #define FSCTL_REQUEST_FILTER_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
473 #define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS)
475 #if (VER_PRODUCTBUILD >= 1381)
477 #define FSCTL_GET_NTFS_VOLUME_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS)
478 #define FSCTL_GET_NTFS_FILE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS)
479 #define FSCTL_GET_VOLUME_BITMAP CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER, FILE_ANY_ACCESS)
480 #define FSCTL_GET_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER, FILE_ANY_ACCESS)
481 #define FSCTL_MOVE_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_ANY_ACCESS)
482 #define FSCTL_IS_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
483 #define FSCTL_GET_HFS_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS)
484 #define FSCTL_ALLOW_EXTENDED_DASD_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER, FILE_ANY_ACCESS)
486 #endif /* (VER_PRODUCTBUILD >= 1381) */
488 #if (VER_PRODUCTBUILD >= 2195)
490 #define FSCTL_READ_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 33, METHOD_NEITHER, FILE_ANY_ACCESS)
491 #define FSCTL_WRITE_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 34, METHOD_NEITHER, FILE_ANY_ACCESS)
492 #define FSCTL_FIND_FILES_BY_SID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS)
494 #define FSCTL_DUMP_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 37, METHOD_NEITHER, FILE_ANY_ACCESS)
495 #define FSCTL_SET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_WRITE_DATA)
496 #define FSCTL_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS)
497 #define FSCTL_DELETE_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_WRITE_DATA)
498 #define FSCTL_SET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_WRITE_DATA)
499 #define FSCTL_GET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS)
500 #define FSCTL_DELETE_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_WRITE_DATA)
501 #define FSCTL_ENUM_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER, FILE_READ_DATA)
502 #define FSCTL_SECURITY_ID_CHECK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45, METHOD_NEITHER, FILE_READ_DATA)
503 #define FSCTL_READ_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46, METHOD_NEITHER, FILE_READ_DATA)
504 #define FSCTL_SET_OBJECT_ID_EXTENDED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_WRITE_DATA)
505 #define FSCTL_CREATE_OR_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS)
506 #define FSCTL_SET_SPARSE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_WRITE_DATA)
507 #define FSCTL_SET_ZERO_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA)
508 #define FSCTL_QUERY_ALLOCATED_RANGES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51, METHOD_NEITHER, FILE_READ_DATA)
509 #define FSCTL_ENABLE_UPGRADE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA)
510 #define FSCTL_SET_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_BUFFERED, FILE_ANY_ACCESS)
511 #define FSCTL_ENCRYPTION_FSCTL_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54, METHOD_NEITHER, FILE_ANY_ACCESS)
512 #define FSCTL_WRITE_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55, METHOD_NEITHER, FILE_ANY_ACCESS)
513 #define FSCTL_READ_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56, METHOD_NEITHER, FILE_ANY_ACCESS)
514 #define FSCTL_CREATE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57, METHOD_NEITHER, FILE_READ_DATA)
515 #define FSCTL_READ_FILE_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58, METHOD_NEITHER, FILE_READ_DATA)
516 #define FSCTL_WRITE_USN_CLOSE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59, METHOD_NEITHER, FILE_READ_DATA)
517 #define FSCTL_EXTEND_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
518 #define FSCTL_QUERY_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
519 #define FSCTL_DELETE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
520 #define FSCTL_MARK_HANDLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS)
521 #define FSCTL_SIS_COPYFILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS)
522 #define FSCTL_SIS_LINK_FILES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
523 #define FSCTL_HSM_MSG CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
524 #define FSCTL_NSS_CONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 67, METHOD_BUFFERED, FILE_WRITE_DATA)
525 #define FSCTL_HSM_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
526 #define FSCTL_RECALL_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS)
527 #define FSCTL_NSS_RCONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 70, METHOD_BUFFERED, FILE_READ_DATA)
528 #define FSCTL_READ_FROM_PLEX CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA)
529 #define FSCTL_FILE_PREFETCH CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
531 #endif /* (VER_PRODUCTBUILD >= 2195) */
533 #define FSCTL_MAILSLOT_PEEK CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)
535 #define FSCTL_NETWORK_SET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 102, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
536 #define FSCTL_NETWORK_GET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 103, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
537 #define FSCTL_NETWORK_GET_CONNECTION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 104, METHOD_NEITHER, FILE_ANY_ACCESS)
538 #define FSCTL_NETWORK_ENUMERATE_CONNECTIONS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 105, METHOD_NEITHER, FILE_ANY_ACCESS)
539 #define FSCTL_NETWORK_DELETE_CONNECTION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 107, METHOD_BUFFERED, FILE_ANY_ACCESS)
540 #define FSCTL_NETWORK_GET_STATISTICS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 116, METHOD_BUFFERED, FILE_ANY_ACCESS)
541 #define FSCTL_NETWORK_SET_DOMAIN_NAME CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_ANY_ACCESS)
542 #define FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_ANY_ACCESS)
544 #define FSCTL_PIPE_ASSIGN_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
545 #define FSCTL_PIPE_DISCONNECT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
546 #define FSCTL_PIPE_LISTEN CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
547 #define FSCTL_PIPE_PEEK CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
548 #define FSCTL_PIPE_QUERY_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
549 #define FSCTL_PIPE_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
550 #define FSCTL_PIPE_WAIT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
551 #define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
552 #define FSCTL_PIPE_SET_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
553 #define FSCTL_PIPE_QUERY_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
554 #define FSCTL_PIPE_INTERNAL_READ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
555 #define FSCTL_PIPE_INTERNAL_WRITE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
556 #define FSCTL_PIPE_INTERNAL_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
557 #define FSCTL_PIPE_INTERNAL_READ_OVFLOW CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
559 #define IOCTL_REDIR_QUERY_PATH CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
561 typedef PVOID OPLOCK
, *POPLOCK
;
563 typedef struct _CACHE_MANAGER_CALLBACKS
*PCACHE_MANAGER_CALLBACKS
;
564 typedef struct _FILE_GET_QUOTA_INFORMATION
*PFILE_GET_QUOTA_INFORMATION
;
565 typedef struct _HANDLE_TABLE
*PHANDLE_TABLE
;
566 typedef struct _KPROCESS
*PKPROCESS
;
567 typedef struct _KQUEUE
*PKQUEUE
;
568 typedef struct _KTRAP_FRAME
*PKTRAP_FRAME
;
569 typedef struct _OBJECT_DIRECTORY
*POBJECT_DIRECTORY
;
570 typedef struct _SHARED_CACHE_MAP
*PSHARED_CACHE_MAP
;
571 typedef struct _VACB
*PVACB
;
572 typedef struct _VAD_HEADER
*PVAD_HEADER
;
580 typedef struct _NOTIFY_SYNC
593 } NOTIFY_SYNC
, * PNOTIFY_SYNC
;
595 typedef enum _FAST_IO_POSSIBLE
{
601 typedef enum _FILE_STORAGE_TYPE
{
602 StorageTypeDefault
= 1,
603 StorageTypeDirectory
,
605 StorageTypeJunctionPoint
,
607 StorageTypeStructuredStorage
,
608 StorageTypeEmbedding
,
612 typedef enum _OBJECT_INFO_CLASS
{
620 typedef struct _KAPC_STATE
{
621 LIST_ENTRY ApcListHead
[2];
623 BOOLEAN KernelApcInProgress
;
624 BOOLEAN KernelApcPending
;
625 BOOLEAN UserApcPending
;
626 } KAPC_STATE
, *PKAPC_STATE
, *RESTRICTED_POINTER PRKAPC_STATE
;
628 typedef struct _BITMAP_RANGE
{
630 LARGE_INTEGER BasePage
;
631 ULONG FirstDirtyPage
;
635 } BITMAP_RANGE
, *PBITMAP_RANGE
;
637 typedef struct _CACHE_UNINITIALIZE_EVENT
{
638 struct _CACHE_UNINITIALIZE_EVENT
*Next
;
640 } CACHE_UNINITIALIZE_EVENT
, *PCACHE_UNINITIALIZE_EVENT
;
642 typedef struct _CC_FILE_SIZES
{
643 LARGE_INTEGER AllocationSize
;
644 LARGE_INTEGER FileSize
;
645 LARGE_INTEGER ValidDataLength
;
646 } CC_FILE_SIZES
, *PCC_FILE_SIZES
;
648 typedef struct _COMPRESSED_DATA_INFO
{
649 USHORT CompressionFormatAndEngine
;
650 UCHAR CompressionUnitShift
;
654 USHORT NumberOfChunks
;
655 ULONG CompressedChunkSizes
[ANYSIZE_ARRAY
];
656 } COMPRESSED_DATA_INFO
, *PCOMPRESSED_DATA_INFO
;
658 typedef struct _SID_IDENTIFIER_AUTHORITY
{
660 } SID_IDENTIFIER_AUTHORITY
,*PSID_IDENTIFIER_AUTHORITY
,*LPSID_IDENTIFIER_AUTHORITY
;
662 typedef struct _SID
{
664 BYTE SubAuthorityCount
;
665 SID_IDENTIFIER_AUTHORITY IdentifierAuthority
;
666 DWORD SubAuthority
[ANYSIZE_ARRAY
];
668 typedef struct _SID_AND_ATTRIBUTES
{
671 } SID_AND_ATTRIBUTES
, *PSID_AND_ATTRIBUTES
;
672 typedef SID_AND_ATTRIBUTES SID_AND_ATTRIBUTES_ARRAY
[ANYSIZE_ARRAY
];
673 typedef SID_AND_ATTRIBUTES_ARRAY
*PSID_AND_ATTRIBUTES_ARRAY
;
674 typedef struct _TOKEN_SOURCE
{
675 CHAR SourceName
[TOKEN_SOURCE_LENGTH
];
676 LUID SourceIdentifier
;
677 } TOKEN_SOURCE
,*PTOKEN_SOURCE
;
678 typedef struct _TOKEN_CONTROL
{
680 LUID AuthenticationId
;
682 TOKEN_SOURCE TokenSource
;
683 } TOKEN_CONTROL
,*PTOKEN_CONTROL
;
684 typedef struct _TOKEN_DEFAULT_DACL
{
686 } TOKEN_DEFAULT_DACL
,*PTOKEN_DEFAULT_DACL
;
687 typedef struct _TOKEN_GROUPS
{
689 SID_AND_ATTRIBUTES Groups
[ANYSIZE_ARRAY
];
690 } TOKEN_GROUPS
,*PTOKEN_GROUPS
,*LPTOKEN_GROUPS
;
691 typedef struct _TOKEN_GROUPS_AND_PRIVILEGES
{
694 PSID_AND_ATTRIBUTES Sids
;
695 ULONG RestrictedSidCount
;
696 ULONG RestrictedSidLength
;
697 PSID_AND_ATTRIBUTES RestrictedSids
;
698 ULONG PrivilegeCount
;
699 ULONG PrivilegeLength
;
700 PLUID_AND_ATTRIBUTES Privileges
;
701 LUID AuthenticationId
;
702 } TOKEN_GROUPS_AND_PRIVILEGES
, *PTOKEN_GROUPS_AND_PRIVILEGES
;
703 typedef struct _TOKEN_ORIGIN
{
704 LUID OriginatingLogonSession
;
705 } TOKEN_ORIGIN
, *PTOKEN_ORIGIN
;
706 typedef struct _TOKEN_OWNER
{
708 } TOKEN_OWNER
,*PTOKEN_OWNER
;
709 typedef struct _TOKEN_PRIMARY_GROUP
{
711 } TOKEN_PRIMARY_GROUP
,*PTOKEN_PRIMARY_GROUP
;
712 typedef struct _TOKEN_PRIVILEGES
{
713 DWORD PrivilegeCount
;
714 LUID_AND_ATTRIBUTES Privileges
[ANYSIZE_ARRAY
];
715 } TOKEN_PRIVILEGES
,*PTOKEN_PRIVILEGES
,*LPTOKEN_PRIVILEGES
;
716 typedef enum tagTOKEN_TYPE
{
719 } TOKEN_TYPE
,*PTOKEN_TYPE
;
720 typedef struct _TOKEN_STATISTICS
{
722 LUID AuthenticationId
;
723 LARGE_INTEGER ExpirationTime
;
724 TOKEN_TYPE TokenType
;
725 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
;
726 DWORD DynamicCharged
;
727 DWORD DynamicAvailable
;
729 DWORD PrivilegeCount
;
731 } TOKEN_STATISTICS
, *PTOKEN_STATISTICS
;
732 typedef struct _TOKEN_USER
{
733 SID_AND_ATTRIBUTES User
;
734 } TOKEN_USER
, *PTOKEN_USER
;
735 typedef DWORD SECURITY_INFORMATION
,*PSECURITY_INFORMATION
;
736 typedef WORD SECURITY_DESCRIPTOR_CONTROL
,*PSECURITY_DESCRIPTOR_CONTROL
;
737 typedef struct _SECURITY_DESCRIPTOR
{
740 SECURITY_DESCRIPTOR_CONTROL Control
;
745 } SECURITY_DESCRIPTOR
, *PISECURITY_DESCRIPTOR
;
746 typedef struct _SECURITY_DESCRIPTOR_RELATIVE
{
749 SECURITY_DESCRIPTOR_CONTROL Control
;
754 } SECURITY_DESCRIPTOR_RELATIVE
, *PISECURITY_DESCRIPTOR_RELATIVE
;
755 typedef enum _TOKEN_INFORMATION_CLASS
{
756 TokenUser
=1,TokenGroups
,TokenPrivileges
,TokenOwner
,
757 TokenPrimaryGroup
,TokenDefaultDacl
,TokenSource
,TokenType
,
758 TokenImpersonationLevel
,TokenStatistics
,TokenRestrictedSids
,
759 TokenSessionId
,TokenGroupsAndPrivileges
,TokenSessionReference
,
760 TokenSandBoxInert
,TokenAuditPolicy
,TokenOrigin
,
761 } TOKEN_INFORMATION_CLASS
;
763 #define SYMLINK_FLAG_RELATIVE 1
765 typedef struct _REPARSE_DATA_BUFFER
{
767 USHORT ReparseDataLength
;
771 USHORT SubstituteNameOffset
;
772 USHORT SubstituteNameLength
;
773 USHORT PrintNameOffset
;
774 USHORT PrintNameLength
;
777 } SymbolicLinkReparseBuffer
;
779 USHORT SubstituteNameOffset
;
780 USHORT SubstituteNameLength
;
781 USHORT PrintNameOffset
;
782 USHORT PrintNameLength
;
784 } MountPointReparseBuffer
;
787 } GenericReparseBuffer
;
789 } REPARSE_DATA_BUFFER
, *PREPARSE_DATA_BUFFER
;
791 #define REPARSE_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(REPARSE_DATA_BUFFER, GenericReparseBuffer)
793 typedef struct _FILE_ACCESS_INFORMATION
{
794 ACCESS_MASK AccessFlags
;
795 } FILE_ACCESS_INFORMATION
, *PFILE_ACCESS_INFORMATION
;
797 typedef struct _FILE_ALLOCATION_INFORMATION
{
798 LARGE_INTEGER AllocationSize
;
799 } FILE_ALLOCATION_INFORMATION
, *PFILE_ALLOCATION_INFORMATION
;
801 typedef struct _FILE_BOTH_DIR_INFORMATION
{
802 ULONG NextEntryOffset
;
804 LARGE_INTEGER CreationTime
;
805 LARGE_INTEGER LastAccessTime
;
806 LARGE_INTEGER LastWriteTime
;
807 LARGE_INTEGER ChangeTime
;
808 LARGE_INTEGER EndOfFile
;
809 LARGE_INTEGER AllocationSize
;
810 ULONG FileAttributes
;
811 ULONG FileNameLength
;
813 CCHAR ShortNameLength
;
816 } FILE_BOTH_DIR_INFORMATION
, *PFILE_BOTH_DIR_INFORMATION
;
818 typedef struct _FILE_COMPLETION_INFORMATION
{
821 } FILE_COMPLETION_INFORMATION
, *PFILE_COMPLETION_INFORMATION
;
823 typedef struct _FILE_COMPRESSION_INFORMATION
{
824 LARGE_INTEGER CompressedFileSize
;
825 USHORT CompressionFormat
;
826 UCHAR CompressionUnitShift
;
830 } FILE_COMPRESSION_INFORMATION
, *PFILE_COMPRESSION_INFORMATION
;
832 typedef struct _FILE_COPY_ON_WRITE_INFORMATION
{
833 BOOLEAN ReplaceIfExists
;
834 HANDLE RootDirectory
;
835 ULONG FileNameLength
;
837 } FILE_COPY_ON_WRITE_INFORMATION
, *PFILE_COPY_ON_WRITE_INFORMATION
;
839 typedef struct _FILE_DIRECTORY_INFORMATION
{
840 ULONG NextEntryOffset
;
842 LARGE_INTEGER CreationTime
;
843 LARGE_INTEGER LastAccessTime
;
844 LARGE_INTEGER LastWriteTime
;
845 LARGE_INTEGER ChangeTime
;
846 LARGE_INTEGER EndOfFile
;
847 LARGE_INTEGER AllocationSize
;
848 ULONG FileAttributes
;
849 ULONG FileNameLength
;
851 } FILE_DIRECTORY_INFORMATION
, *PFILE_DIRECTORY_INFORMATION
;
853 typedef struct _FILE_FULL_DIRECTORY_INFORMATION
{
854 ULONG NextEntryOffset
;
856 LARGE_INTEGER CreationTime
;
857 LARGE_INTEGER LastAccessTime
;
858 LARGE_INTEGER LastWriteTime
;
859 LARGE_INTEGER ChangeTime
;
860 LARGE_INTEGER EndOfFile
;
861 LARGE_INTEGER AllocationSize
;
862 ULONG FileAttributes
;
863 ULONG FileNameLength
;
866 } FILE_FULL_DIRECTORY_INFORMATION
, *PFILE_FULL_DIRECTORY_INFORMATION
;
868 typedef struct _FILE_BOTH_DIRECTORY_INFORMATION
{
869 ULONG NextEntryOffset
;
871 LARGE_INTEGER CreationTime
;
872 LARGE_INTEGER LastAccessTime
;
873 LARGE_INTEGER LastWriteTime
;
874 LARGE_INTEGER ChangeTime
;
875 LARGE_INTEGER EndOfFile
;
876 LARGE_INTEGER AllocationSize
;
877 ULONG FileAttributes
;
878 ULONG FileNameLength
;
880 CHAR ShortNameLength
;
883 } FILE_BOTH_DIRECTORY_INFORMATION
, *PFILE_BOTH_DIRECTORY_INFORMATION
;
885 typedef struct _FILE_EA_INFORMATION
{
887 } FILE_EA_INFORMATION
, *PFILE_EA_INFORMATION
;
889 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
{
890 ULONG FileSystemAttributes
;
891 ULONG MaximumComponentNameLength
;
892 ULONG FileSystemNameLength
;
893 WCHAR FileSystemName
[1];
894 } FILE_FS_ATTRIBUTE_INFORMATION
, *PFILE_FS_ATTRIBUTE_INFORMATION
;
896 typedef struct _FILE_FS_CONTROL_INFORMATION
{
897 LARGE_INTEGER FreeSpaceStartFiltering
;
898 LARGE_INTEGER FreeSpaceThreshold
;
899 LARGE_INTEGER FreeSpaceStopFiltering
;
900 LARGE_INTEGER DefaultQuotaThreshold
;
901 LARGE_INTEGER DefaultQuotaLimit
;
902 ULONG FileSystemControlFlags
;
903 } FILE_FS_CONTROL_INFORMATION
, *PFILE_FS_CONTROL_INFORMATION
;
905 typedef struct _FILE_FS_FULL_SIZE_INFORMATION
{
906 LARGE_INTEGER TotalAllocationUnits
;
907 LARGE_INTEGER CallerAvailableAllocationUnits
;
908 LARGE_INTEGER ActualAvailableAllocationUnits
;
909 ULONG SectorsPerAllocationUnit
;
910 ULONG BytesPerSector
;
911 } FILE_FS_FULL_SIZE_INFORMATION
, *PFILE_FS_FULL_SIZE_INFORMATION
;
913 typedef struct _FILE_FS_LABEL_INFORMATION
{
914 ULONG VolumeLabelLength
;
915 WCHAR VolumeLabel
[1];
916 } FILE_FS_LABEL_INFORMATION
, *PFILE_FS_LABEL_INFORMATION
;
918 #if (VER_PRODUCTBUILD >= 2195)
920 typedef struct _FILE_FS_OBJECT_ID_INFORMATION
{
922 UCHAR ExtendedInfo
[48];
923 } FILE_FS_OBJECT_ID_INFORMATION
, *PFILE_FS_OBJECT_ID_INFORMATION
;
925 #endif /* (VER_PRODUCTBUILD >= 2195) */
927 typedef struct _FILE_FS_SIZE_INFORMATION
{
928 LARGE_INTEGER TotalAllocationUnits
;
929 LARGE_INTEGER AvailableAllocationUnits
;
930 ULONG SectorsPerAllocationUnit
;
931 ULONG BytesPerSector
;
932 } FILE_FS_SIZE_INFORMATION
, *PFILE_FS_SIZE_INFORMATION
;
934 typedef struct _FILE_FS_VOLUME_INFORMATION
{
935 LARGE_INTEGER VolumeCreationTime
;
936 ULONG VolumeSerialNumber
;
937 ULONG VolumeLabelLength
;
938 BOOLEAN SupportsObjects
;
939 WCHAR VolumeLabel
[1];
940 } FILE_FS_VOLUME_INFORMATION
, *PFILE_FS_VOLUME_INFORMATION
;
942 typedef struct _FILE_FS_OBJECTID_INFORMATION
945 UCHAR ExtendedInfo
[48];
946 } FILE_FS_OBJECTID_INFORMATION
, *PFILE_FS_OBJECTID_INFORMATION
;
948 typedef struct _FILE_FS_DRIVER_PATH_INFORMATION
950 BOOLEAN DriverInPath
;
951 ULONG DriverNameLength
;
953 } FILE_FS_DRIVER_PATH_INFORMATION
, *PFILE_FS_DRIVER_PATH_INFORMATION
;
955 typedef struct _FILE_FULL_DIR_INFORMATION
{
956 ULONG NextEntryOffset
;
958 LARGE_INTEGER CreationTime
;
959 LARGE_INTEGER LastAccessTime
;
960 LARGE_INTEGER LastWriteTime
;
961 LARGE_INTEGER ChangeTime
;
962 LARGE_INTEGER EndOfFile
;
963 LARGE_INTEGER AllocationSize
;
964 ULONG FileAttributes
;
965 ULONG FileNameLength
;
968 } FILE_FULL_DIR_INFORMATION
, *PFILE_FULL_DIR_INFORMATION
;
970 typedef struct _FILE_GET_EA_INFORMATION
{
971 ULONG NextEntryOffset
;
974 } FILE_GET_EA_INFORMATION
, *PFILE_GET_EA_INFORMATION
;
976 typedef struct _FILE_GET_QUOTA_INFORMATION
{
977 ULONG NextEntryOffset
;
980 } FILE_GET_QUOTA_INFORMATION
, *PFILE_GET_QUOTA_INFORMATION
;
982 typedef struct _FILE_QUOTA_INFORMATION
984 ULONG NextEntryOffset
;
986 LARGE_INTEGER ChangeTime
;
987 LARGE_INTEGER QuotaUsed
;
988 LARGE_INTEGER QuotaThreshold
;
989 LARGE_INTEGER QuotaLimit
;
991 } FILE_QUOTA_INFORMATION
, *PFILE_QUOTA_INFORMATION
;
993 typedef struct _FILE_INTERNAL_INFORMATION
{
994 LARGE_INTEGER IndexNumber
;
995 } FILE_INTERNAL_INFORMATION
, *PFILE_INTERNAL_INFORMATION
;
997 typedef struct _FILE_LINK_INFORMATION
{
998 BOOLEAN ReplaceIfExists
;
999 HANDLE RootDirectory
;
1000 ULONG FileNameLength
;
1002 } FILE_LINK_INFORMATION
, *PFILE_LINK_INFORMATION
;
1004 typedef struct _FILE_LOCK_INFO
1006 LARGE_INTEGER StartingByte
;
1007 LARGE_INTEGER Length
;
1008 BOOLEAN ExclusiveLock
;
1010 PFILE_OBJECT FileObject
;
1012 LARGE_INTEGER EndingByte
;
1013 } FILE_LOCK_INFO
, *PFILE_LOCK_INFO
;
1015 typedef struct _FILE_REPARSE_POINT_INFORMATION
1017 LONGLONG FileReference
;
1019 } FILE_REPARSE_POINT_INFORMATION
, *PFILE_REPARSE_POINT_INFORMATION
;
1021 typedef struct _FILE_MOVE_CLUSTER_INFORMATION
1024 HANDLE RootDirectory
;
1025 ULONG FileNameLength
;
1027 } FILE_MOVE_CLUSTER_INFORMATION
, *PFILE_MOVE_CLUSTER_INFORMATION
;
1029 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
1030 typedef struct _FILE_SHARED_LOCK_ENTRY
{
1033 FILE_LOCK_INFO FileLock
;
1034 } FILE_SHARED_LOCK_ENTRY
, *PFILE_SHARED_LOCK_ENTRY
;
1036 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
1037 typedef struct _FILE_EXCLUSIVE_LOCK_ENTRY
{
1038 LIST_ENTRY ListEntry
;
1041 FILE_LOCK_INFO FileLock
;
1042 } FILE_EXCLUSIVE_LOCK_ENTRY
, *PFILE_EXCLUSIVE_LOCK_ENTRY
;
1044 typedef NTSTATUS (*PCOMPLETE_LOCK_IRP_ROUTINE
) (
1049 typedef VOID (NTAPI
*PUNLOCK_ROUTINE
) (
1051 IN PFILE_LOCK_INFO FileLockInfo
1054 typedef struct _FILE_LOCK
{
1055 PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine
;
1056 PUNLOCK_ROUTINE UnlockRoutine
;
1057 BOOLEAN FastIoIsQuestionable
;
1059 PVOID LockInformation
;
1060 FILE_LOCK_INFO LastReturnedLockInfo
;
1061 PVOID LastReturnedLock
;
1062 } FILE_LOCK
, *PFILE_LOCK
;
1064 typedef struct _FILE_MAILSLOT_PEEK_BUFFER
{
1065 ULONG ReadDataAvailable
;
1066 ULONG NumberOfMessages
;
1067 ULONG MessageLength
;
1068 } FILE_MAILSLOT_PEEK_BUFFER
, *PFILE_MAILSLOT_PEEK_BUFFER
;
1070 typedef struct _FILE_MAILSLOT_QUERY_INFORMATION
{
1071 ULONG MaximumMessageSize
;
1072 ULONG MailslotQuota
;
1073 ULONG NextMessageSize
;
1074 ULONG MessagesAvailable
;
1075 LARGE_INTEGER ReadTimeout
;
1076 } FILE_MAILSLOT_QUERY_INFORMATION
, *PFILE_MAILSLOT_QUERY_INFORMATION
;
1078 typedef struct _FILE_MAILSLOT_SET_INFORMATION
{
1079 PLARGE_INTEGER ReadTimeout
;
1080 } FILE_MAILSLOT_SET_INFORMATION
, *PFILE_MAILSLOT_SET_INFORMATION
;
1082 typedef struct _FILE_MODE_INFORMATION
{
1084 } FILE_MODE_INFORMATION
, *PFILE_MODE_INFORMATION
;
1086 typedef struct _FILE_ALL_INFORMATION
{
1087 FILE_BASIC_INFORMATION BasicInformation
;
1088 FILE_STANDARD_INFORMATION StandardInformation
;
1089 FILE_INTERNAL_INFORMATION InternalInformation
;
1090 FILE_EA_INFORMATION EaInformation
;
1091 FILE_ACCESS_INFORMATION AccessInformation
;
1092 FILE_POSITION_INFORMATION PositionInformation
;
1093 FILE_MODE_INFORMATION ModeInformation
;
1094 FILE_ALIGNMENT_INFORMATION AlignmentInformation
;
1095 FILE_NAME_INFORMATION NameInformation
;
1096 } FILE_ALL_INFORMATION
, *PFILE_ALL_INFORMATION
;
1098 typedef struct _FILE_NAMES_INFORMATION
{
1099 ULONG NextEntryOffset
;
1101 ULONG FileNameLength
;
1103 } FILE_NAMES_INFORMATION
, *PFILE_NAMES_INFORMATION
;
1105 typedef struct _FILE_OBJECTID_INFORMATION
{
1106 LONGLONG FileReference
;
1108 _ANONYMOUS_UNION
union {
1110 UCHAR BirthVolumeId
[16];
1111 UCHAR BirthObjectId
[16];
1114 UCHAR ExtendedInfo
[48];
1116 } FILE_OBJECTID_INFORMATION
, *PFILE_OBJECTID_INFORMATION
;
1118 typedef struct _FILE_OLE_CLASSID_INFORMATION
{
1120 } FILE_OLE_CLASSID_INFORMATION
, *PFILE_OLE_CLASSID_INFORMATION
;
1122 typedef struct _FILE_OLE_ALL_INFORMATION
{
1123 FILE_BASIC_INFORMATION BasicInformation
;
1124 FILE_STANDARD_INFORMATION StandardInformation
;
1125 FILE_INTERNAL_INFORMATION InternalInformation
;
1126 FILE_EA_INFORMATION EaInformation
;
1127 FILE_ACCESS_INFORMATION AccessInformation
;
1128 FILE_POSITION_INFORMATION PositionInformation
;
1129 FILE_MODE_INFORMATION ModeInformation
;
1130 FILE_ALIGNMENT_INFORMATION AlignmentInformation
;
1133 LARGE_INTEGER SecurityChangeTime
;
1134 FILE_OLE_CLASSID_INFORMATION OleClassIdInformation
;
1135 FILE_OBJECTID_INFORMATION ObjectIdInformation
;
1136 FILE_STORAGE_TYPE StorageType
;
1139 ULONG NumberOfStreamReferences
;
1142 BOOLEAN ContentIndexDisable
;
1143 BOOLEAN InheritContentIndexDisable
;
1144 FILE_NAME_INFORMATION NameInformation
;
1145 } FILE_OLE_ALL_INFORMATION
, *PFILE_OLE_ALL_INFORMATION
;
1147 typedef struct _FILE_OLE_DIR_INFORMATION
{
1148 ULONG NextEntryOffset
;
1150 LARGE_INTEGER CreationTime
;
1151 LARGE_INTEGER LastAccessTime
;
1152 LARGE_INTEGER LastWriteTime
;
1153 LARGE_INTEGER ChangeTime
;
1154 LARGE_INTEGER EndOfFile
;
1155 LARGE_INTEGER AllocationSize
;
1156 ULONG FileAttributes
;
1157 ULONG FileNameLength
;
1158 FILE_STORAGE_TYPE StorageType
;
1161 BOOLEAN ContentIndexDisable
;
1162 BOOLEAN InheritContentIndexDisable
;
1164 } FILE_OLE_DIR_INFORMATION
, *PFILE_OLE_DIR_INFORMATION
;
1166 typedef struct _FILE_OLE_INFORMATION
{
1167 LARGE_INTEGER SecurityChangeTime
;
1168 FILE_OLE_CLASSID_INFORMATION OleClassIdInformation
;
1169 FILE_OBJECTID_INFORMATION ObjectIdInformation
;
1170 FILE_STORAGE_TYPE StorageType
;
1172 BOOLEAN ContentIndexDisable
;
1173 BOOLEAN InheritContentIndexDisable
;
1174 } FILE_OLE_INFORMATION
, *PFILE_OLE_INFORMATION
;
1176 typedef struct _FILE_OLE_STATE_BITS_INFORMATION
{
1178 ULONG StateBitsMask
;
1179 } FILE_OLE_STATE_BITS_INFORMATION
, *PFILE_OLE_STATE_BITS_INFORMATION
;
1181 typedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER
{
1184 } FILE_PIPE_ASSIGN_EVENT_BUFFER
, *PFILE_PIPE_ASSIGN_EVENT_BUFFER
;
1186 typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER
{
1187 PVOID ClientSession
;
1188 PVOID ClientProcess
;
1189 } FILE_PIPE_CLIENT_PROCESS_BUFFER
, *PFILE_PIPE_CLIENT_PROCESS_BUFFER
;
1191 typedef struct _FILE_PIPE_EVENT_BUFFER
{
1192 ULONG NamedPipeState
;
1196 ULONG NumberRequests
;
1197 } FILE_PIPE_EVENT_BUFFER
, *PFILE_PIPE_EVENT_BUFFER
;
1199 typedef struct _FILE_PIPE_PEEK_BUFFER
1201 ULONG NamedPipeState
;
1202 ULONG ReadDataAvailable
;
1203 ULONG NumberOfMessages
;
1204 ULONG MessageLength
;
1206 } FILE_PIPE_PEEK_BUFFER
, *PFILE_PIPE_PEEK_BUFFER
;
1208 typedef struct _FILE_PIPE_INFORMATION
{
1210 ULONG CompletionMode
;
1211 } FILE_PIPE_INFORMATION
, *PFILE_PIPE_INFORMATION
;
1213 typedef struct _FILE_PIPE_LOCAL_INFORMATION
{
1214 ULONG NamedPipeType
;
1215 ULONG NamedPipeConfiguration
;
1216 ULONG MaximumInstances
;
1217 ULONG CurrentInstances
;
1219 ULONG ReadDataAvailable
;
1220 ULONG OutboundQuota
;
1221 ULONG WriteQuotaAvailable
;
1222 ULONG NamedPipeState
;
1224 } FILE_PIPE_LOCAL_INFORMATION
, *PFILE_PIPE_LOCAL_INFORMATION
;
1226 typedef struct _FILE_PIPE_REMOTE_INFORMATION
{
1227 LARGE_INTEGER CollectDataTime
;
1228 ULONG MaximumCollectionCount
;
1229 } FILE_PIPE_REMOTE_INFORMATION
, *PFILE_PIPE_REMOTE_INFORMATION
;
1231 typedef struct _FILE_PIPE_WAIT_FOR_BUFFER
{
1232 LARGE_INTEGER Timeout
;
1234 BOOLEAN TimeoutSpecified
;
1236 } FILE_PIPE_WAIT_FOR_BUFFER
, *PFILE_PIPE_WAIT_FOR_BUFFER
;
1238 typedef struct _FILE_RENAME_INFORMATION
{
1239 BOOLEAN ReplaceIfExists
;
1240 HANDLE RootDirectory
;
1241 ULONG FileNameLength
;
1243 } FILE_RENAME_INFORMATION
, *PFILE_RENAME_INFORMATION
;
1245 typedef struct _FILE_STREAM_INFORMATION
{
1246 ULONG NextEntryOffset
;
1247 ULONG StreamNameLength
;
1248 LARGE_INTEGER StreamSize
;
1249 LARGE_INTEGER StreamAllocationSize
;
1250 WCHAR StreamName
[1];
1251 } FILE_STREAM_INFORMATION
, *PFILE_STREAM_INFORMATION
;
1253 typedef struct _FILE_TRACKING_INFORMATION
{
1254 HANDLE DestinationFile
;
1255 ULONG ObjectInformationLength
;
1256 CHAR ObjectInformation
[1];
1257 } FILE_TRACKING_INFORMATION
, *PFILE_TRACKING_INFORMATION
;
1259 #if (VER_PRODUCTBUILD >= 2195)
1260 typedef struct _FILE_ZERO_DATA_INFORMATION
{
1261 LARGE_INTEGER FileOffset
;
1262 LARGE_INTEGER BeyondFinalZero
;
1263 } FILE_ZERO_DATA_INFORMATION
, *PFILE_ZERO_DATA_INFORMATION
;
1265 typedef struct FILE_ALLOCATED_RANGE_BUFFER
{
1266 LARGE_INTEGER FileOffset
;
1267 LARGE_INTEGER Length
;
1268 } FILE_ALLOCATED_RANGE_BUFFER
, *PFILE_ALLOCATED_RANGE_BUFFER
;
1269 #endif /* (VER_PRODUCTBUILD >= 2195) */
1271 typedef struct _FSRTL_COMMON_FCB_HEADER
{
1272 CSHORT NodeTypeCode
;
1273 CSHORT NodeByteSize
;
1275 UCHAR IsFastIoPossible
;
1276 #if (VER_PRODUCTBUILD >= 1381)
1279 #endif /* (VER_PRODUCTBUILD >= 1381) */
1280 PERESOURCE Resource
;
1281 PERESOURCE PagingIoResource
;
1282 LARGE_INTEGER AllocationSize
;
1283 LARGE_INTEGER FileSize
;
1284 LARGE_INTEGER ValidDataLength
;
1285 } FSRTL_COMMON_FCB_HEADER
, *PFSRTL_COMMON_FCB_HEADER
;
1287 #if (VER_PRODUCTBUILD >= 2600)
1289 typedef struct _FSRTL_ADVANCED_FCB_HEADER
{
1290 CSHORT NodeTypeCode
;
1291 CSHORT NodeByteSize
;
1293 UCHAR IsFastIoPossible
;
1296 PERESOURCE Resource
;
1297 PERESOURCE PagingIoResource
;
1298 LARGE_INTEGER AllocationSize
;
1299 LARGE_INTEGER FileSize
;
1300 LARGE_INTEGER ValidDataLength
;
1301 PFAST_MUTEX FastMutex
;
1302 LIST_ENTRY FilterContexts
;
1303 } FSRTL_ADVANCED_FCB_HEADER
, *PFSRTL_ADVANCED_FCB_HEADER
;
1305 typedef struct _FSRTL_PER_STREAM_CONTEXT
{
1309 PFREE_FUNCTION FreeCallback
;
1310 } FSRTL_PER_STREAM_CONTEXT
, *PFSRTL_PER_STREAM_CONTEXT
;
1312 typedef struct _FSRTL_PER_FILEOBJECT_CONTEXT
1317 } FSRTL_PER_FILEOBJECT_CONTEXT
, *PFSRTL_PER_FILEOBJECT_CONTEXT
;
1319 #endif /* (VER_PRODUCTBUILD >= 2600) */
1321 typedef struct _BASE_MCB
1323 ULONG MaximumPairCount
;
1328 } BASE_MCB
, *PBASE_MCB
;
1330 typedef struct _LARGE_MCB
1332 PKGUARDED_MUTEX GuardedMutex
;
1334 } LARGE_MCB
, *PLARGE_MCB
;
1338 LARGE_MCB DummyFieldThatSizesThisStructureCorrectly
;
1341 typedef struct _GENERATE_NAME_CONTEXT
{
1343 BOOLEAN CheckSumInserted
;
1345 WCHAR NameBuffer
[8];
1346 ULONG ExtensionLength
;
1347 WCHAR ExtensionBuffer
[4];
1348 ULONG LastIndexValue
;
1349 } GENERATE_NAME_CONTEXT
, *PGENERATE_NAME_CONTEXT
;
1351 typedef struct _MAPPING_PAIR
{
1354 } MAPPING_PAIR
, *PMAPPING_PAIR
;
1356 typedef struct _GET_RETRIEVAL_DESCRIPTOR
{
1357 ULONG NumberOfPairs
;
1359 MAPPING_PAIR Pair
[1];
1360 } GET_RETRIEVAL_DESCRIPTOR
, *PGET_RETRIEVAL_DESCRIPTOR
;
1362 typedef struct _KQUEUE
{
1363 DISPATCHER_HEADER Header
;
1364 LIST_ENTRY EntryListHead
;
1367 LIST_ENTRY ThreadListHead
;
1368 } KQUEUE
, *PKQUEUE
, *RESTRICTED_POINTER PRKQUEUE
;
1370 #define ASSERT_QUEUE(Q) ASSERT(((Q)->Header.Type & KOBJECT_TYPE_MASK) == QueueObject);
1372 typedef struct _MBCB
{
1373 CSHORT NodeTypeCode
;
1374 CSHORT NodeIsInZone
;
1378 LIST_ENTRY BitmapRanges
;
1379 LONGLONG ResumeWritePage
;
1380 BITMAP_RANGE BitmapRange1
;
1381 BITMAP_RANGE BitmapRange2
;
1382 BITMAP_RANGE BitmapRange3
;
1385 typedef struct _MOVEFILE_DESCRIPTOR
{
1388 LARGE_INTEGER StartVcn
;
1389 LARGE_INTEGER TargetLcn
;
1392 } MOVEFILE_DESCRIPTOR
, *PMOVEFILE_DESCRIPTOR
;
1394 typedef struct _OBJECT_BASIC_INFO
{
1396 ACCESS_MASK GrantedAccess
;
1398 ULONG ReferenceCount
;
1399 ULONG PagedPoolUsage
;
1400 ULONG NonPagedPoolUsage
;
1402 ULONG NameInformationLength
;
1403 ULONG TypeInformationLength
;
1404 ULONG SecurityDescriptorLength
;
1405 LARGE_INTEGER CreateTime
;
1406 } OBJECT_BASIC_INFO
, *POBJECT_BASIC_INFO
;
1408 typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFO
{
1410 BOOLEAN ProtectFromClose
;
1411 } OBJECT_HANDLE_ATTRIBUTE_INFO
, *POBJECT_HANDLE_ATTRIBUTE_INFO
;
1413 typedef struct _OBJECT_NAME_INFO
{
1414 UNICODE_STRING ObjectName
;
1415 WCHAR ObjectNameBuffer
[1];
1416 } OBJECT_NAME_INFO
, *POBJECT_NAME_INFO
;
1418 typedef struct _OBJECT_PROTECTION_INFO
{
1420 BOOLEAN ProtectHandle
;
1421 } OBJECT_PROTECTION_INFO
, *POBJECT_PROTECTION_INFO
;
1423 typedef struct _OBJECT_TYPE_INFO
{
1424 UNICODE_STRING ObjectTypeName
;
1425 UCHAR Unknown
[0x58];
1426 WCHAR ObjectTypeNameBuffer
[1];
1427 } OBJECT_TYPE_INFO
, *POBJECT_TYPE_INFO
;
1429 typedef struct _OBJECT_ALL_TYPES_INFO
{
1430 ULONG NumberOfObjectTypes
;
1431 OBJECT_TYPE_INFO ObjectsTypeInfo
[1];
1432 } OBJECT_ALL_TYPES_INFO
, *POBJECT_ALL_TYPES_INFO
;
1435 typedef struct _PATHNAME_BUFFER
{
1436 ULONG PathNameLength
;
1438 } PATHNAME_BUFFER
, *PPATHNAME_BUFFER
;
1440 typedef enum _RTL_GENERIC_COMPARE_RESULTS
1445 } RTL_GENERIC_COMPARE_RESULTS
;
1447 typedef enum _TABLE_SEARCH_RESULT
1453 } TABLE_SEARCH_RESULT
;
1456 (NTAPI
*PRTL_AVL_MATCH_FUNCTION
)(
1457 struct _RTL_AVL_TABLE
*Table
,
1462 typedef RTL_GENERIC_COMPARE_RESULTS
1463 (NTAPI
*PRTL_AVL_COMPARE_ROUTINE
) (
1464 struct _RTL_AVL_TABLE
*Table
,
1469 typedef RTL_GENERIC_COMPARE_RESULTS
1470 (NTAPI
*PRTL_GENERIC_COMPARE_ROUTINE
) (
1471 struct _RTL_GENERIC_TABLE
*Table
,
1477 (NTAPI
*PRTL_GENERIC_ALLOCATE_ROUTINE
) (
1478 struct _RTL_GENERIC_TABLE
*Table
,
1483 (NTAPI
*PRTL_GENERIC_FREE_ROUTINE
) (
1484 struct _RTL_GENERIC_TABLE
*Table
,
1489 (NTAPI
*PRTL_AVL_ALLOCATE_ROUTINE
) (
1490 struct _RTL_AVL_TABLE
*Table
,
1495 (NTAPI
*PRTL_AVL_FREE_ROUTINE
) (
1496 struct _RTL_AVL_TABLE
*Table
,
1500 typedef struct _PUBLIC_BCB
{
1501 CSHORT NodeTypeCode
;
1502 CSHORT NodeByteSize
;
1504 LARGE_INTEGER MappedFileOffset
;
1505 } PUBLIC_BCB
, *PPUBLIC_BCB
;
1507 typedef struct _QUERY_PATH_REQUEST
{
1508 ULONG PathNameLength
;
1509 PIO_SECURITY_CONTEXT SecurityContext
;
1510 WCHAR FilePathName
[1];
1511 } QUERY_PATH_REQUEST
, *PQUERY_PATH_REQUEST
;
1513 typedef struct _QUERY_PATH_RESPONSE
{
1514 ULONG LengthAccepted
;
1515 } QUERY_PATH_RESPONSE
, *PQUERY_PATH_RESPONSE
;
1517 typedef struct _RETRIEVAL_POINTERS_BUFFER
{
1519 LARGE_INTEGER StartingVcn
;
1521 LARGE_INTEGER NextVcn
;
1524 } RETRIEVAL_POINTERS_BUFFER
, *PRETRIEVAL_POINTERS_BUFFER
;
1526 typedef struct _RTL_SPLAY_LINKS
{
1527 struct _RTL_SPLAY_LINKS
*Parent
;
1528 struct _RTL_SPLAY_LINKS
*LeftChild
;
1529 struct _RTL_SPLAY_LINKS
*RightChild
;
1530 } RTL_SPLAY_LINKS
, *PRTL_SPLAY_LINKS
;
1532 typedef struct _RTL_BALANCED_LINKS
1534 struct _RTL_BALANCED_LINKS
*Parent
;
1535 struct _RTL_BALANCED_LINKS
*LeftChild
;
1536 struct _RTL_BALANCED_LINKS
*RightChild
;
1539 } RTL_BALANCED_LINKS
, *PRTL_BALANCED_LINKS
;
1541 typedef struct _RTL_GENERIC_TABLE
1543 PRTL_SPLAY_LINKS TableRoot
;
1544 LIST_ENTRY InsertOrderList
;
1545 PLIST_ENTRY OrderedPointer
;
1546 ULONG WhichOrderedElement
;
1547 ULONG NumberGenericTableElements
;
1548 PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine
;
1549 PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine
;
1550 PRTL_GENERIC_FREE_ROUTINE FreeRoutine
;
1552 } RTL_GENERIC_TABLE
, *PRTL_GENERIC_TABLE
;
1554 typedef struct _RTL_AVL_TABLE
1556 RTL_BALANCED_LINKS BalancedRoot
;
1557 PVOID OrderedPointer
;
1558 ULONG WhichOrderedElement
;
1559 ULONG NumberGenericTableElements
;
1561 PRTL_BALANCED_LINKS RestartKey
;
1563 PRTL_AVL_COMPARE_ROUTINE CompareRoutine
;
1564 PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine
;
1565 PRTL_AVL_FREE_ROUTINE FreeRoutine
;
1567 } RTL_AVL_TABLE
, *PRTL_AVL_TABLE
;
1572 RtlInitializeGenericTableAvl(
1573 PRTL_AVL_TABLE Table
,
1574 PRTL_AVL_COMPARE_ROUTINE CompareRoutine
,
1575 PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine
,
1576 PRTL_AVL_FREE_ROUTINE FreeRoutine
,
1580 #if defined(USE_LPC6432)
1581 #define LPC_CLIENT_ID CLIENT_ID64
1582 #define LPC_SIZE_T ULONGLONG
1583 #define LPC_PVOID ULONGLONG
1584 #define LPC_HANDLE ULONGLONG
1586 #define LPC_CLIENT_ID CLIENT_ID
1587 #define LPC_SIZE_T SIZE_T
1588 #define LPC_PVOID PVOID
1589 #define LPC_HANDLE HANDLE
1592 typedef struct _PORT_MESSAGE
1608 CSHORT DataInfoOffset
;
1614 LPC_CLIENT_ID ClientId
;
1615 double DoNotUseThisField
;
1620 LPC_SIZE_T ClientViewSize
;
1623 } PORT_MESSAGE
, *PPORT_MESSAGE
;
1625 #define LPC_KERNELMODE_MESSAGE (CSHORT)((USHORT)0x8000)
1627 typedef struct _PORT_VIEW
1630 LPC_HANDLE SectionHandle
;
1631 ULONG SectionOffset
;
1632 LPC_SIZE_T ViewSize
;
1634 LPC_PVOID ViewRemoteBase
;
1635 } PORT_VIEW
, *PPORT_VIEW
;
1637 typedef struct _REMOTE_PORT_VIEW
1640 LPC_SIZE_T ViewSize
;
1642 } REMOTE_PORT_VIEW
, *PREMOTE_PORT_VIEW
;
1644 typedef struct _SE_EXPORTS
{
1646 LUID SeCreateTokenPrivilege
;
1647 LUID SeAssignPrimaryTokenPrivilege
;
1648 LUID SeLockMemoryPrivilege
;
1649 LUID SeIncreaseQuotaPrivilege
;
1650 LUID SeUnsolicitedInputPrivilege
;
1651 LUID SeTcbPrivilege
;
1652 LUID SeSecurityPrivilege
;
1653 LUID SeTakeOwnershipPrivilege
;
1654 LUID SeLoadDriverPrivilege
;
1655 LUID SeCreatePagefilePrivilege
;
1656 LUID SeIncreaseBasePriorityPrivilege
;
1657 LUID SeSystemProfilePrivilege
;
1658 LUID SeSystemtimePrivilege
;
1659 LUID SeProfileSingleProcessPrivilege
;
1660 LUID SeCreatePermanentPrivilege
;
1661 LUID SeBackupPrivilege
;
1662 LUID SeRestorePrivilege
;
1663 LUID SeShutdownPrivilege
;
1664 LUID SeDebugPrivilege
;
1665 LUID SeAuditPrivilege
;
1666 LUID SeSystemEnvironmentPrivilege
;
1667 LUID SeChangeNotifyPrivilege
;
1668 LUID SeRemoteShutdownPrivilege
;
1673 PSID SeCreatorOwnerSid
;
1674 PSID SeCreatorGroupSid
;
1676 PSID SeNtAuthoritySid
;
1680 PSID SeInteractiveSid
;
1681 PSID SeLocalSystemSid
;
1682 PSID SeAliasAdminsSid
;
1683 PSID SeAliasUsersSid
;
1684 PSID SeAliasGuestsSid
;
1685 PSID SeAliasPowerUsersSid
;
1686 PSID SeAliasAccountOpsSid
;
1687 PSID SeAliasSystemOpsSid
;
1688 PSID SeAliasPrintOpsSid
;
1689 PSID SeAliasBackupOpsSid
;
1691 PSID SeAuthenticatedUsersSid
;
1693 PSID SeRestrictedSid
;
1694 PSID SeAnonymousLogonSid
;
1696 LUID SeUndockPrivilege
;
1697 LUID SeSyncAgentPrivilege
;
1698 LUID SeEnableDelegationPrivilege
;
1700 } SE_EXPORTS
, *PSE_EXPORTS
;
1704 LARGE_INTEGER StartingLcn
;
1705 } STARTING_LCN_INPUT_BUFFER
, *PSTARTING_LCN_INPUT_BUFFER
;
1707 typedef struct _STARTING_VCN_INPUT_BUFFER
{
1708 LARGE_INTEGER StartingVcn
;
1709 } STARTING_VCN_INPUT_BUFFER
, *PSTARTING_VCN_INPUT_BUFFER
;
1711 typedef struct _SECURITY_CLIENT_CONTEXT
{
1712 SECURITY_QUALITY_OF_SERVICE SecurityQos
;
1713 PACCESS_TOKEN ClientToken
;
1714 BOOLEAN DirectlyAccessClientToken
;
1715 BOOLEAN DirectAccessEffectiveOnly
;
1716 BOOLEAN ServerIsRemote
;
1717 TOKEN_CONTROL ClientTokenControl
;
1718 } SECURITY_CLIENT_CONTEXT
, *PSECURITY_CLIENT_CONTEXT
;
1720 typedef struct _ACE_HEADER
1725 } ACE_HEADER
, *PACE_HEADER
;
1727 typedef struct _TUNNEL
{
1729 PRTL_SPLAY_LINKS Cache
;
1730 LIST_ENTRY TimerQueue
;
1734 typedef struct _VAD_HEADER
{
1737 PVAD_HEADER ParentLink
;
1738 PVAD_HEADER LeftLink
;
1739 PVAD_HEADER RightLink
;
1740 ULONG Flags
; /* LSB = CommitCharge */
1742 PVOID FirstProtoPte
;
1746 } VAD_HEADER
, *PVAD_HEADER
;
1750 LARGE_INTEGER StartingLcn
;
1751 LARGE_INTEGER BitmapSize
;
1753 } VOLUME_BITMAP_BUFFER
, *PVOLUME_BITMAP_BUFFER
;
1755 #if (VER_PRODUCTBUILD >= 2600)
1758 (NTAPI
*PFILTER_REPORT_CHANGE
) (
1759 IN PVOID NotifyContext
,
1760 IN PVOID FilterContext
1763 typedef enum _FS_FILTER_SECTION_SYNC_TYPE
{
1765 SyncTypeCreateSection
1766 } FS_FILTER_SECTION_SYNC_TYPE
, *PFS_FILTER_SECTION_SYNC_TYPE
;
1768 typedef union _FS_FILTER_PARAMETERS
{
1770 PLARGE_INTEGER EndingOffset
;
1771 } AcquireForModifiedPageWriter
;
1774 PERESOURCE ResourceToRelease
;
1775 } ReleaseForModifiedPageWriter
;
1778 FS_FILTER_SECTION_SYNC_TYPE SyncType
;
1779 ULONG PageProtection
;
1780 } AcquireForSectionSynchronization
;
1789 } FS_FILTER_PARAMETERS
, *PFS_FILTER_PARAMETERS
;
1791 typedef struct _FS_FILTER_CALLBACK_DATA
{
1792 ULONG SizeOfFsFilterCallbackData
;
1795 struct _DEVICE_OBJECT
*DeviceObject
;
1796 struct _FILE_OBJECT
*FileObject
;
1797 FS_FILTER_PARAMETERS Parameters
;
1798 } FS_FILTER_CALLBACK_DATA
, *PFS_FILTER_CALLBACK_DATA
;
1801 (NTAPI
*PFS_FILTER_CALLBACK
) (
1802 IN PFS_FILTER_CALLBACK_DATA Data
,
1803 OUT PVOID
*CompletionContext
1807 (NTAPI
*PFS_FILTER_COMPLETION_CALLBACK
) (
1808 IN PFS_FILTER_CALLBACK_DATA Data
,
1809 IN NTSTATUS OperationStatus
,
1810 IN PVOID CompletionContext
1813 typedef struct _FS_FILTER_CALLBACKS
{
1814 ULONG SizeOfFsFilterCallbacks
;
1816 PFS_FILTER_CALLBACK PreAcquireForSectionSynchronization
;
1817 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization
;
1818 PFS_FILTER_CALLBACK PreReleaseForSectionSynchronization
;
1819 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization
;
1820 PFS_FILTER_CALLBACK PreAcquireForCcFlush
;
1821 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush
;
1822 PFS_FILTER_CALLBACK PreReleaseForCcFlush
;
1823 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush
;
1824 PFS_FILTER_CALLBACK PreAcquireForModifiedPageWriter
;
1825 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter
;
1826 PFS_FILTER_CALLBACK PreReleaseForModifiedPageWriter
;
1827 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter
;
1828 } FS_FILTER_CALLBACKS
, *PFS_FILTER_CALLBACKS
;
1830 typedef struct _READ_LIST
{
1831 PFILE_OBJECT FileObject
;
1832 ULONG NumberOfEntries
;
1834 FILE_SEGMENT_ELEMENT List
[ANYSIZE_ARRAY
];
1835 } READ_LIST
, *PREAD_LIST
;
1840 (NTAPI
* PRTL_HEAP_COMMIT_ROUTINE
) (
1842 IN OUT PVOID
*CommitAddress
,
1843 IN OUT PSIZE_T CommitSize
1846 typedef struct _RTL_HEAP_PARAMETERS
{
1848 SIZE_T SegmentReserve
;
1849 SIZE_T SegmentCommit
;
1850 SIZE_T DeCommitFreeBlockThreshold
;
1851 SIZE_T DeCommitTotalFreeThreshold
;
1852 SIZE_T MaximumAllocationSize
;
1853 SIZE_T VirtualMemoryThreshold
;
1854 SIZE_T InitialCommit
;
1855 SIZE_T InitialReserve
;
1856 PRTL_HEAP_COMMIT_ROUTINE CommitRoutine
;
1858 } RTL_HEAP_PARAMETERS
, *PRTL_HEAP_PARAMETERS
;
1864 IN PFILE_OBJECT FileObject
,
1865 IN ULONG BytesToWrite
,
1874 IN PFILE_OBJECT FileObject
,
1875 IN PLARGE_INTEGER FileOffset
,
1879 OUT PIO_STATUS_BLOCK IoStatus
1886 IN PFILE_OBJECT FileObject
,
1887 IN PLARGE_INTEGER FileOffset
,
1893 #define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
1895 typedef VOID (NTAPI
*PCC_POST_DEFERRED_WRITE
) (
1904 IN PFILE_OBJECT FileObject
,
1905 IN PCC_POST_DEFERRED_WRITE PostRoutine
,
1908 IN ULONG BytesToWrite
,
1916 IN PFILE_OBJECT FileObject
,
1917 IN ULONG FileOffset
,
1921 OUT PIO_STATUS_BLOCK IoStatus
1928 IN PFILE_OBJECT FileObject
,
1929 IN ULONG FileOffset
,
1938 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
1939 IN PLARGE_INTEGER FileOffset OPTIONAL
,
1941 OUT PIO_STATUS_BLOCK IoStatus OPTIONAL
1944 typedef VOID (*PDIRTY_PAGE_ROUTINE
) (
1945 IN PFILE_OBJECT FileObject
,
1946 IN PLARGE_INTEGER FileOffset
,
1948 IN PLARGE_INTEGER OldestLsn
,
1949 IN PLARGE_INTEGER NewestLsn
,
1959 IN PDIRTY_PAGE_ROUTINE DirtyPageRoutine
,
1967 CcGetFileObjectFromBcb (
1974 CcGetFileObjectFromSectionPtrs (
1975 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
1978 #define CcGetFileSizePointer(FO) ( \
1979 ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
1982 #if (VER_PRODUCTBUILD >= 2195)
1987 CcGetFlushedValidData (
1988 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
1989 IN BOOLEAN BcbListHeld
1992 #endif /* (VER_PRODUCTBUILD >= 2195) */
1997 CcGetLsnForFileObject (
1998 IN PFILE_OBJECT FileObject
,
1999 OUT PLARGE_INTEGER OldestLsn OPTIONAL
2002 typedef BOOLEAN (NTAPI
*PACQUIRE_FOR_LAZY_WRITE
) (
2007 typedef VOID (NTAPI
*PRELEASE_FROM_LAZY_WRITE
) (
2011 typedef BOOLEAN (NTAPI
*PACQUIRE_FOR_READ_AHEAD
) (
2016 typedef VOID (NTAPI
*PRELEASE_FROM_READ_AHEAD
) (
2020 typedef struct _CACHE_MANAGER_CALLBACKS
{
2021 PACQUIRE_FOR_LAZY_WRITE AcquireForLazyWrite
;
2022 PRELEASE_FROM_LAZY_WRITE ReleaseFromLazyWrite
;
2023 PACQUIRE_FOR_READ_AHEAD AcquireForReadAhead
;
2024 PRELEASE_FROM_READ_AHEAD ReleaseFromReadAhead
;
2025 } CACHE_MANAGER_CALLBACKS
, *PCACHE_MANAGER_CALLBACKS
;
2030 CcInitializeCacheMap (
2031 IN PFILE_OBJECT FileObject
,
2032 IN PCC_FILE_SIZES FileSizes
,
2033 IN BOOLEAN PinAccess
,
2034 IN PCACHE_MANAGER_CALLBACKS Callbacks
,
2035 IN PVOID LazyWriteContext
2038 #define CcIsFileCached(FO) ( \
2039 ((FO)->SectionObjectPointer != NULL) && \
2040 (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
2043 extern ULONG CcFastMdlReadWait
;
2048 CcIsThereDirtyData (
2056 IN PFILE_OBJECT FileObject
,
2057 IN PLARGE_INTEGER FileOffset
,
2068 IN PFILE_OBJECT FileObject
,
2069 IN PLARGE_INTEGER FileOffset
,
2072 OUT PIO_STATUS_BLOCK IoStatus
2079 IN PFILE_OBJECT FileObject
,
2086 CcMdlWriteComplete (
2087 IN PFILE_OBJECT FileObject
,
2088 IN PLARGE_INTEGER FileOffset
,
2098 IN PFILE_OBJECT FileObject
,
2099 IN PLARGE_INTEGER FileOffset
,
2109 IN PFILE_OBJECT FileObject
,
2110 IN PLARGE_INTEGER FileOffset
,
2121 IN PFILE_OBJECT FileObject
,
2122 IN PLARGE_INTEGER FileOffset
,
2125 OUT PIO_STATUS_BLOCK IoStatus
2132 IN PFILE_OBJECT FileObject
,
2133 IN PLARGE_INTEGER FileOffset
,
2144 CcPurgeCacheSection (
2145 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
2146 IN PLARGE_INTEGER FileOffset OPTIONAL
,
2148 IN BOOLEAN UninitializeCacheMaps
2151 #define CcReadAhead(FO, FOFF, LEN) ( \
2152 if ((LEN) >= 256) { \
2153 CcScheduleReadAhead((FO), (FOFF), (LEN)); \
2157 #if (VER_PRODUCTBUILD >= 2195)
2166 #endif /* (VER_PRODUCTBUILD >= 2195) */
2178 CcScheduleReadAhead (
2179 IN PFILE_OBJECT FileObject
,
2180 IN PLARGE_INTEGER FileOffset
,
2187 CcSetAdditionalCacheAttributes (
2188 IN PFILE_OBJECT FileObject
,
2189 IN BOOLEAN DisableReadAhead
,
2190 IN BOOLEAN DisableWriteBehind
2196 CcSetBcbOwnerPointer (
2198 IN PVOID OwnerPointer
2204 CcSetDirtyPageThreshold (
2205 IN PFILE_OBJECT FileObject
,
2206 IN ULONG DirtyPageThreshold
2212 CcSetDirtyPinnedData (
2214 IN PLARGE_INTEGER Lsn OPTIONAL
2221 IN PFILE_OBJECT FileObject
,
2222 IN PCC_FILE_SIZES FileSizes
2225 typedef VOID (NTAPI
*PFLUSH_TO_LSN
) (
2227 IN PLARGE_INTEGER Lsn
2233 CcSetLogHandleForFile (
2234 IN PFILE_OBJECT FileObject
,
2236 IN PFLUSH_TO_LSN FlushToLsnRoutine
2242 CcSetReadAheadGranularity (
2243 IN PFILE_OBJECT FileObject
,
2244 IN ULONG Granularity
/* default: PAGE_SIZE */
2245 /* allowed: 2^n * PAGE_SIZE */
2251 CcUninitializeCacheMap (
2252 IN PFILE_OBJECT FileObject
,
2253 IN PLARGE_INTEGER TruncateSize OPTIONAL
,
2254 IN PCACHE_UNINITIALIZE_EVENT UninitializeCompleteEvent OPTIONAL
2267 CcUnpinDataForThread (
2269 IN ERESOURCE_THREAD ResourceThreadId
2275 CcUnpinRepinnedBcb (
2277 IN BOOLEAN WriteThrough
,
2278 OUT PIO_STATUS_BLOCK IoStatus
2281 #if (VER_PRODUCTBUILD >= 2195)
2286 CcWaitForCurrentLazyWriterActivity (
2290 #endif /* (VER_PRODUCTBUILD >= 2195) */
2296 IN PFILE_OBJECT FileObject
,
2297 IN PLARGE_INTEGER StartOffset
,
2298 IN PLARGE_INTEGER EndOffset
,
2305 ExDisableResourceBoostLite (
2306 IN PERESOURCE Resource
2312 ExQueryPoolBlockSize (
2314 OUT PBOOLEAN QuotaCharged
2317 #if (VER_PRODUCTBUILD >= 2600)
2319 #ifndef __NTOSKRNL__
2323 ExInitializeRundownProtection (
2324 IN PEX_RUNDOWN_REF RunRef
2330 ExReInitializeRundownProtection (
2331 IN PEX_RUNDOWN_REF RunRef
2337 ExAcquireRundownProtection (
2338 IN PEX_RUNDOWN_REF RunRef
2344 ExAcquireRundownProtectionEx (
2345 IN PEX_RUNDOWN_REF RunRef
,
2352 ExReleaseRundownProtection (
2353 IN PEX_RUNDOWN_REF RunRef
2359 ExReleaseRundownProtectionEx (
2360 IN PEX_RUNDOWN_REF RunRef
,
2367 ExRundownCompleted (
2368 IN PEX_RUNDOWN_REF RunRef
2374 ExWaitForRundownProtectionRelease (
2375 IN PEX_RUNDOWN_REF RunRef
2379 #endif /* (VER_PRODUCTBUILD >= 2600) */
2381 #define FlagOn(x, f) ((x) & (f))
2386 FsRtlAddToTunnelCache (
2388 IN ULONGLONG DirectoryKey
,
2389 IN PUNICODE_STRING ShortName
,
2390 IN PUNICODE_STRING LongName
,
2391 IN BOOLEAN KeyByShortName
,
2392 IN ULONG DataLength
,
2396 #if (VER_PRODUCTBUILD >= 2195)
2400 FsRtlAllocateFileLock (
2401 IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL
,
2402 IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
2405 #endif /* (VER_PRODUCTBUILD >= 2195) */
2411 IN POOL_TYPE PoolType
,
2412 IN ULONG NumberOfBytes
2418 FsRtlAllocatePoolWithQuota (
2419 IN POOL_TYPE PoolType
,
2420 IN ULONG NumberOfBytes
2426 FsRtlAllocatePoolWithQuotaTag (
2427 IN POOL_TYPE PoolType
,
2428 IN ULONG NumberOfBytes
,
2435 FsRtlAllocatePoolWithTag (
2436 IN POOL_TYPE PoolType
,
2437 IN ULONG NumberOfBytes
,
2444 FsRtlAreNamesEqual (
2445 IN PCUNICODE_STRING Name1
,
2446 IN PCUNICODE_STRING Name2
,
2447 IN BOOLEAN IgnoreCase
,
2448 IN PCWCH UpcaseTable OPTIONAL
2451 #define FsRtlAreThereCurrentFileLocks(FL) ( \
2452 ((FL)->FastIoIsQuestionable) \
2456 FsRtlCheckLockForReadAccess:
2458 All this really does is pick out the lock parameters from the irp (io stack
2459 location?), get IoGetRequestorProcess, and pass values on to
2460 FsRtlFastCheckLockForRead.
2465 FsRtlCheckLockForReadAccess (
2466 IN PFILE_LOCK FileLock
,
2471 FsRtlCheckLockForWriteAccess:
2473 All this really does is pick out the lock parameters from the irp (io stack
2474 location?), get IoGetRequestorProcess, and pass values on to
2475 FsRtlFastCheckLockForWrite.
2480 FsRtlCheckLockForWriteAccess (
2481 IN PFILE_LOCK FileLock
,
2487 (NTAPI
*POPLOCK_WAIT_COMPLETE_ROUTINE
) (
2494 (NTAPI
*POPLOCK_FS_PREPOST_IRP
) (
2506 IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL
,
2507 IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL
2514 IN PFILE_OBJECT FileObject
,
2515 IN PLARGE_INTEGER FileOffset
,
2520 OUT PIO_STATUS_BLOCK IoStatus
,
2521 IN PDEVICE_OBJECT DeviceObject
2528 IN PFILE_OBJECT FileObject
,
2529 IN PLARGE_INTEGER FileOffset
,
2534 OUT PIO_STATUS_BLOCK IoStatus
,
2535 IN PDEVICE_OBJECT DeviceObject
2543 IN PVOID HeapBase OPTIONAL
,
2544 IN SIZE_T ReserveSize OPTIONAL
,
2545 IN SIZE_T CommitSize OPTIONAL
,
2546 IN PVOID Lock OPTIONAL
,
2547 IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL
2553 FsRtlCurrentBatchOplock (
2560 FsRtlDeleteKeyFromTunnelCache (
2562 IN ULONGLONG DirectoryKey
2568 FsRtlDeleteTunnelCache (
2575 FsRtlDeregisterUncProvider (
2590 IN ANSI_STRING Name
,
2591 OUT PANSI_STRING FirstPart
,
2592 OUT PANSI_STRING RemainingPart
2599 IN UNICODE_STRING Name
,
2600 OUT PUNICODE_STRING FirstPart
,
2601 OUT PUNICODE_STRING RemainingPart
2607 FsRtlDoesDbcsContainWildCards (
2608 IN PANSI_STRING Name
2614 FsRtlDoesNameContainWildCards (
2615 IN PUNICODE_STRING Name
2618 #define FsRtlCompleteRequest(IRP,STATUS) { \
2619 (IRP)->IoStatus.Status = (STATUS); \
2620 IoCompleteRequest( (IRP), IO_DISK_INCREMENT ); \
2623 #define FsRtlEnterFileSystem KeEnterCriticalRegion
2625 #define FsRtlExitFileSystem KeLeaveCriticalRegion
2630 FsRtlFastCheckLockForRead (
2631 IN PFILE_LOCK FileLock
,
2632 IN PLARGE_INTEGER FileOffset
,
2633 IN PLARGE_INTEGER Length
,
2635 IN PFILE_OBJECT FileObject
,
2636 IN PEPROCESS Process
2642 FsRtlFastCheckLockForWrite (
2643 IN PFILE_LOCK FileLock
,
2644 IN PLARGE_INTEGER FileOffset
,
2645 IN PLARGE_INTEGER Length
,
2647 IN PFILE_OBJECT FileObject
,
2648 IN PEPROCESS Process
2651 #define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) ( \
2652 FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11) \
2658 FsRtlFastUnlockAll (
2659 IN PFILE_LOCK FileLock
,
2660 IN PFILE_OBJECT FileObject
,
2661 IN PEPROCESS Process
,
2662 IN PVOID Context OPTIONAL
2664 /* ret: STATUS_RANGE_NOT_LOCKED */
2669 FsRtlFastUnlockAllByKey (
2670 IN PFILE_LOCK FileLock
,
2671 IN PFILE_OBJECT FileObject
,
2672 IN PEPROCESS Process
,
2674 IN PVOID Context OPTIONAL
2676 /* ret: STATUS_RANGE_NOT_LOCKED */
2681 FsRtlFastUnlockSingle (
2682 IN PFILE_LOCK FileLock
,
2683 IN PFILE_OBJECT FileObject
,
2684 IN PLARGE_INTEGER FileOffset
,
2685 IN PLARGE_INTEGER Length
,
2686 IN PEPROCESS Process
,
2688 IN PVOID Context OPTIONAL
,
2689 IN BOOLEAN AlreadySynchronized
2691 /* ret: STATUS_RANGE_NOT_LOCKED */
2696 FsRtlFindInTunnelCache (
2698 IN ULONGLONG DirectoryKey
,
2699 IN PUNICODE_STRING Name
,
2700 OUT PUNICODE_STRING ShortName
,
2701 OUT PUNICODE_STRING LongName
,
2702 IN OUT PULONG DataLength
,
2706 #if (VER_PRODUCTBUILD >= 2195)
2712 IN PFILE_LOCK FileLock
2715 #endif /* (VER_PRODUCTBUILD >= 2195) */
2721 IN PFILE_OBJECT FileObject
,
2722 IN OUT PLARGE_INTEGER FileSize
2726 FsRtlGetNextFileLock:
2728 ret: NULL if no more locks
2731 FsRtlGetNextFileLock uses FileLock->LastReturnedLockInfo and
2732 FileLock->LastReturnedLock as storage.
2733 LastReturnedLock is a pointer to the 'raw' lock inkl. double linked
2734 list, and FsRtlGetNextFileLock needs this to get next lock on subsequent
2735 calls with Restart = FALSE.
2740 FsRtlGetNextFileLock (
2741 IN PFILE_LOCK FileLock
,
2748 FsRtlInitializeFileLock (
2749 IN PFILE_LOCK FileLock
,
2750 IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL
,
2751 IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
2757 FsRtlInitializeOplock (
2758 IN OUT POPLOCK Oplock
2764 FsRtlInitializeTunnelCache (
2771 FsRtlIsNameInExpression (
2772 IN PUNICODE_STRING Expression
,
2773 IN PUNICODE_STRING Name
,
2774 IN BOOLEAN IgnoreCase
,
2775 IN PWCHAR UpcaseTable OPTIONAL
2781 FsRtlIsNtstatusExpected (
2782 IN NTSTATUS Ntstatus
2785 #define NLS_OEM_LEAD_BYTE_INFO NlsOemLeadByteInfo
2787 extern PUSHORT NlsOemLeadByteInfo
;
2789 #define FsRtlIsLeadDbcsCharacter(DBCS_CHAR) ( \
2790 (BOOLEAN)((UCHAR)(DBCS_CHAR) < 0x80 ? FALSE : \
2791 (NLS_MB_CODE_PAGE_TAG && \
2792 (NLS_OEM_LEAD_BYTE_INFO[(UCHAR)(DBCS_CHAR)] != 0))) \
2795 #define FsRtlIsAnsiCharacterWild(C) ( \
2796 FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], FSRTL_WILD_CHARACTER ) \
2799 #define FsRtlIsUnicodeCharacterWild(C) ( \
2802 FlagOn(FsRtlLegalAnsiCharacterArray[(C)], FSRTL_WILD_CHARACTER )) \
2809 IN PFILE_OBJECT FileObject
,
2810 IN PLARGE_INTEGER FileOffset
,
2814 OUT PIO_STATUS_BLOCK IoStatus
,
2815 IN PDEVICE_OBJECT DeviceObject
2821 FsRtlMdlReadComplete (
2822 IN PFILE_OBJECT FileObject
,
2829 FsRtlMdlReadCompleteDev (
2830 IN PFILE_OBJECT FileObject
,
2832 IN PDEVICE_OBJECT DeviceObject
2838 FsRtlPrepareMdlWriteDev (
2839 IN PFILE_OBJECT FileObject
,
2840 IN PLARGE_INTEGER FileOffset
,
2844 OUT PIO_STATUS_BLOCK IoStatus
,
2845 IN PDEVICE_OBJECT DeviceObject
2851 FsRtlMdlWriteComplete (
2852 IN PFILE_OBJECT FileObject
,
2853 IN PLARGE_INTEGER FileOffset
,
2860 FsRtlMdlWriteCompleteDev (
2861 IN PFILE_OBJECT FileObject
,
2862 IN PLARGE_INTEGER FileOffset
,
2864 IN PDEVICE_OBJECT DeviceObject
2870 FsRtlNormalizeNtstatus (
2871 IN NTSTATUS Exception
,
2872 IN NTSTATUS GenericException
2878 FsRtlNotifyChangeDirectory (
2879 IN PNOTIFY_SYNC NotifySync
,
2881 IN PSTRING FullDirectoryName
,
2882 IN PLIST_ENTRY NotifyList
,
2883 IN BOOLEAN WatchTree
,
2884 IN ULONG CompletionFilter
,
2891 FsRtlNotifyCleanup (
2892 IN PNOTIFY_SYNC NotifySync
,
2893 IN PLIST_ENTRY NotifyList
,
2897 typedef BOOLEAN (*PCHECK_FOR_TRAVERSE_ACCESS
) (
2898 IN PVOID NotifyContext
,
2899 IN PVOID TargetContext
,
2900 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
2906 FsRtlNotifyFullChangeDirectory (
2907 IN PNOTIFY_SYNC NotifySync
,
2908 IN PLIST_ENTRY NotifyList
,
2910 IN PSTRING FullDirectoryName
,
2911 IN BOOLEAN WatchTree
,
2912 IN BOOLEAN IgnoreBuffer
,
2913 IN ULONG CompletionFilter
,
2915 IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL
,
2916 IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL
2922 FsRtlNotifyFullReportChange (
2923 IN PNOTIFY_SYNC NotifySync
,
2924 IN PLIST_ENTRY NotifyList
,
2925 IN PSTRING FullTargetName
,
2926 IN USHORT TargetNameOffset
,
2927 IN PSTRING StreamName OPTIONAL
,
2928 IN PSTRING NormalizedParentName OPTIONAL
,
2929 IN ULONG FilterMatch
,
2931 IN PVOID TargetContext
2937 FsRtlNotifyInitializeSync (
2938 IN PNOTIFY_SYNC
*NotifySync
2944 FsRtlNotifyReportChange (
2945 IN PNOTIFY_SYNC NotifySync
,
2946 IN PLIST_ENTRY NotifyList
,
2947 IN PSTRING FullTargetName
,
2948 IN PUSHORT FileNamePartLength
,
2949 IN ULONG FilterMatch
2955 FsRtlNotifyUninitializeSync (
2956 IN PNOTIFY_SYNC
*NotifySync
2959 #if (VER_PRODUCTBUILD >= 2195)
2964 FsRtlNotifyVolumeEvent (
2965 IN PFILE_OBJECT FileObject
,
2969 #endif /* (VER_PRODUCTBUILD >= 2195) */
2983 FsRtlOplockIsFastIoPossible (
2990 ret: IoStatus->Status: STATUS_PENDING, STATUS_LOCK_NOT_GRANTED
2993 -Calls IoCompleteRequest if Irp
2994 -Uses exception handling / ExRaiseStatus with STATUS_INSUFFICIENT_RESOURCES
3000 IN PFILE_LOCK FileLock
,
3001 IN PFILE_OBJECT FileObject
,
3002 IN PLARGE_INTEGER FileOffset
,
3003 IN PLARGE_INTEGER Length
,
3004 IN PEPROCESS Process
,
3006 IN BOOLEAN FailImmediately
,
3007 IN BOOLEAN ExclusiveLock
,
3008 OUT PIO_STATUS_BLOCK IoStatus
,
3009 IN PIRP Irp OPTIONAL
,
3011 IN BOOLEAN AlreadySynchronized
3015 FsRtlProcessFileLock:
3018 -STATUS_INVALID_DEVICE_REQUEST
3019 -STATUS_RANGE_NOT_LOCKED from unlock routines.
3020 -STATUS_PENDING, STATUS_LOCK_NOT_GRANTED from FsRtlPrivateLock
3021 (redirected IoStatus->Status).
3024 -switch ( Irp->CurrentStackLocation->MinorFunction )
3025 lock: return FsRtlPrivateLock;
3026 unlocksingle: return FsRtlFastUnlockSingle;
3027 unlockall: return FsRtlFastUnlockAll;
3028 unlockallbykey: return FsRtlFastUnlockAllByKey;
3029 default: IofCompleteRequest with STATUS_INVALID_DEVICE_REQUEST;
3030 return STATUS_INVALID_DEVICE_REQUEST;
3032 -'AllwaysZero' is passed thru as 'AllwaysZero' to lock / unlock routines.
3033 -'Irp' is passet thru as 'Irp' to FsRtlPrivateLock.
3038 FsRtlProcessFileLock (
3039 IN PFILE_LOCK FileLock
,
3041 IN PVOID Context OPTIONAL
3047 FsRtlRegisterUncProvider (
3048 IN OUT PHANDLE MupHandle
,
3049 IN PUNICODE_STRING RedirectorDeviceName
,
3050 IN BOOLEAN MailslotsSupported
3054 (NTAPI
*PFSRTL_STACK_OVERFLOW_ROUTINE
) (
3062 FsRtlPostStackOverflow (
3065 IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine
3071 FsRtlPostPagingFileStackOverflow (
3074 IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine
3080 FsRtlUninitializeFileLock (
3081 IN PFILE_LOCK FileLock
3087 FsRtlUninitializeOplock (
3088 IN OUT POPLOCK Oplock
3101 KeSetIdealProcessorThread(
3102 IN OUT PKTHREAD Thread
,
3109 IoAttachDeviceToDeviceStackSafe(
3110 IN PDEVICE_OBJECT SourceDevice
,
3111 IN PDEVICE_OBJECT TargetDevice
,
3112 OUT PDEVICE_OBJECT
*AttachedToDeviceObject
3118 IoAcquireVpbSpinLock (
3125 IoCheckDesiredAccess (
3126 IN OUT PACCESS_MASK DesiredAccess
,
3127 IN ACCESS_MASK GrantedAccess
3133 IoCheckEaBufferValidity (
3134 IN PFILE_FULL_EA_INFORMATION EaBuffer
,
3136 OUT PULONG ErrorOffset
3142 IoCheckFunctionAccess (
3143 IN ACCESS_MASK GrantedAccess
,
3144 IN UCHAR MajorFunction
,
3145 IN UCHAR MinorFunction
,
3146 IN ULONG IoControlCode
,
3147 IN PVOID Argument1 OPTIONAL
,
3148 IN PVOID Argument2 OPTIONAL
3151 #if (VER_PRODUCTBUILD >= 2195)
3156 IoCheckQuotaBufferValidity (
3157 IN PFILE_QUOTA_INFORMATION QuotaBuffer
,
3158 IN ULONG QuotaLength
,
3159 OUT PULONG ErrorOffset
3162 #endif /* (VER_PRODUCTBUILD >= 2195) */
3167 IoCreateStreamFileObject (
3168 IN PFILE_OBJECT FileObject OPTIONAL
,
3169 IN PDEVICE_OBJECT DeviceObject OPTIONAL
3172 #if (VER_PRODUCTBUILD >= 2195)
3177 IoCreateStreamFileObjectLite (
3178 IN PFILE_OBJECT FileObject OPTIONAL
,
3179 IN PDEVICE_OBJECT DeviceObject OPTIONAL
3182 #endif /* (VER_PRODUCTBUILD >= 2195) */
3187 IoFastQueryNetworkAttributes (
3188 IN POBJECT_ATTRIBUTES ObjectAttributes
,
3189 IN ACCESS_MASK DesiredAccess
,
3190 IN ULONG OpenOptions
,
3191 OUT PIO_STATUS_BLOCK IoStatus
,
3192 OUT PFILE_NETWORK_OPEN_INFORMATION Buffer
3198 IoGetAttachedDevice (
3199 IN PDEVICE_OBJECT DeviceObject
3205 IoGetBaseFileSystemDeviceObject (
3206 IN PFILE_OBJECT FileObject
3212 IoGetRequestorProcess (
3216 #if (VER_PRODUCTBUILD >= 2195)
3221 IoGetRequestorProcessId (
3225 #endif /* (VER_PRODUCTBUILD >= 2195) */
3234 #define IoIsFileOpenedExclusively(FileObject) ( \
3236 (FileObject)->SharedRead || \
3237 (FileObject)->SharedWrite || \
3238 (FileObject)->SharedDelete \
3245 IoIsOperationSynchronous (
3256 #if (VER_PRODUCTBUILD >= 2195)
3261 IoIsValidNameGraftingBuffer (
3263 IN PREPARSE_DATA_BUFFER ReparseBuffer
3266 #endif /* (VER_PRODUCTBUILD >= 2195) */
3272 IN PFILE_OBJECT FileObject
,
3274 IN PLARGE_INTEGER Offset
,
3276 OUT PIO_STATUS_BLOCK IoStatusBlock
3282 IoQueryFileInformation (
3283 IN PFILE_OBJECT FileObject
,
3284 IN FILE_INFORMATION_CLASS FileInformationClass
,
3286 OUT PVOID FileInformation
,
3287 OUT PULONG ReturnedLength
3293 IoQueryVolumeInformation (
3294 IN PFILE_OBJECT FileObject
,
3295 IN FS_INFORMATION_CLASS FsInformationClass
,
3297 OUT PVOID FsInformation
,
3298 OUT PULONG ReturnedLength
3311 IoRegisterFileSystem (
3312 IN OUT PDEVICE_OBJECT DeviceObject
3315 #if (VER_PRODUCTBUILD >= 1381)
3317 typedef VOID (NTAPI
*PDRIVER_FS_NOTIFICATION
) (
3318 IN PDEVICE_OBJECT DeviceObject
,
3319 IN BOOLEAN DriverActive
3325 IoRegisterFsRegistrationChange (
3326 IN PDRIVER_OBJECT DriverObject
,
3327 IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
3330 #endif /* (VER_PRODUCTBUILD >= 1381) */
3335 IoReleaseVpbSpinLock (
3342 IoSetDeviceToVerify (
3344 IN PDEVICE_OBJECT DeviceObject
3351 IN PFILE_OBJECT FileObject
,
3352 IN FILE_INFORMATION_CLASS FileInformationClass
,
3354 IN PVOID FileInformation
3367 IoSynchronousPageWrite (
3368 IN PFILE_OBJECT FileObject
,
3370 IN PLARGE_INTEGER FileOffset
,
3372 OUT PIO_STATUS_BLOCK IoStatusBlock
3385 IoUnregisterFileSystem (
3386 IN OUT PDEVICE_OBJECT DeviceObject
3389 #if (VER_PRODUCTBUILD >= 1381)
3394 IoUnregisterFsRegistrationChange (
3395 IN PDRIVER_OBJECT DriverObject
,
3396 IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
3399 #endif /* (VER_PRODUCTBUILD >= 1381) */
3405 IN PDEVICE_OBJECT DeviceObject
,
3406 IN BOOLEAN AllowRawMount
3413 IN PKPROCESS Process
3428 IN ULONG Count OPTIONAL
3436 IN PLIST_ENTRY Entry
3444 IN PLIST_ENTRY Entry
3459 IN KPROCESSOR_MODE WaitMode
,
3460 IN PLARGE_INTEGER Timeout OPTIONAL
3473 KeInitializeMutant (
3474 IN PRKMUTANT Mutant
,
3475 IN BOOLEAN InitialOwner
3489 IN PRKMUTANT Mutant
,
3490 IN KPRIORITY Increment
,
3491 IN BOOLEAN Abandoned
,
3495 #if (VER_PRODUCTBUILD >= 2195)
3500 KeStackAttachProcess (
3501 IN PKPROCESS Process
,
3502 OUT PKAPC_STATE ApcState
3508 KeUnstackDetachProcess (
3509 IN PKAPC_STATE ApcState
3512 #endif /* (VER_PRODUCTBUILD >= 2195) */
3517 KeSetKernelStackSwapEnable(
3524 MmCanFileBeTruncated (
3525 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
3526 IN PLARGE_INTEGER NewFileSize
3532 MmFlushImageSection (
3533 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
3534 IN MMFLUSH_TYPE FlushType
3540 MmForceSectionClosed (
3541 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
3542 IN BOOLEAN DelayClose
3545 #if (VER_PRODUCTBUILD >= 1381)
3550 MmIsRecursiveIoFault (
3556 #define MmIsRecursiveIoFault() ( \
3557 (PsGetCurrentThread()->DisablePageFaultClustering) | \
3558 (PsGetCurrentThread()->ForwardClusterOnly) \
3567 MmSetAddressRangeModified (
3576 IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL
,
3577 IN POBJECT_TYPE ObjectType
,
3578 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL
,
3579 IN KPROCESSOR_MODE AccessMode
,
3580 IN OUT PVOID ParseContext OPTIONAL
,
3581 IN ULONG ObjectSize
,
3582 IN ULONG PagedPoolCharge OPTIONAL
,
3583 IN ULONG NonPagedPoolCharge OPTIONAL
,
3590 ObGetObjectPointerCount (
3599 IN PACCESS_STATE PassedAccessState OPTIONAL
,
3600 IN ACCESS_MASK DesiredAccess
,
3601 IN ULONG AdditionalReferences
,
3602 OUT PVOID
*ReferencedObject OPTIONAL
,
3609 ObMakeTemporaryObject (
3616 ObOpenObjectByPointer (
3618 IN ULONG HandleAttributes
,
3619 IN PACCESS_STATE PassedAccessState OPTIONAL
,
3620 IN ACCESS_MASK DesiredAccess OPTIONAL
,
3621 IN POBJECT_TYPE ObjectType OPTIONAL
,
3622 IN KPROCESSOR_MODE AccessMode
,
3631 OUT POBJECT_NAME_INFORMATION ObjectNameInfo
,
3633 OUT PULONG ReturnLength
3639 ObQueryObjectAuditingByHandle (
3641 OUT PBOOLEAN GenerateOnClose
3647 ObReferenceObjectByName (
3648 IN PUNICODE_STRING ObjectName
,
3649 IN ULONG Attributes
,
3650 IN PACCESS_STATE PassedAccessState OPTIONAL
,
3651 IN ACCESS_MASK DesiredAccess OPTIONAL
,
3652 IN POBJECT_TYPE ObjectType
,
3653 IN KPROCESSOR_MODE AccessMode
,
3654 IN OUT PVOID ParseContext OPTIONAL
,
3661 PsAssignImpersonationToken (
3670 IN PEPROCESS Process
,
3671 IN POOL_TYPE PoolType
,
3678 PsChargeProcessPoolQuota (
3679 IN PEPROCESS Process
,
3680 IN POOL_TYPE PoolType
,
3684 #define PsDereferenceImpersonationToken(T) \
3685 {if (ARGUMENT_PRESENT(T)) { \
3686 (ObDereferenceObject((T))); \
3692 #define PsDereferencePrimaryToken(T) (ObDereferenceObject((T)))
3697 PsDisableImpersonation(
3699 IN PSE_IMPERSONATION_STATE ImpersonationState
3705 PsGetProcessExitTime (
3712 PsImpersonateClient(
3714 IN PACCESS_TOKEN Token
,
3715 IN BOOLEAN CopyOnOpen
,
3716 IN BOOLEAN EffectiveOnly
,
3717 IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
3730 PsIsThreadTerminating (
3737 PsLookupProcessByProcessId (
3738 IN HANDLE ProcessId
,
3739 OUT PEPROCESS
*Process
3745 PsLookupProcessThreadByCid (
3747 OUT PEPROCESS
*Process OPTIONAL
,
3748 OUT PETHREAD
*Thread
3754 PsLookupThreadByThreadId (
3755 IN HANDLE UniqueThreadId
,
3756 OUT PETHREAD
*Thread
3762 PsReferenceImpersonationToken (
3764 OUT PBOOLEAN CopyOnUse
,
3765 OUT PBOOLEAN EffectiveOnly
,
3766 OUT PSECURITY_IMPERSONATION_LEVEL Level
3772 PsReferencePrimaryToken (
3773 IN PEPROCESS Process
3779 PsRestoreImpersonation(
3781 IN PSE_IMPERSONATION_STATE ImpersonationState
3788 IN PEPROCESS Process
,
3789 IN POOL_TYPE PoolType
,
3803 RtlAbsoluteToSelfRelativeSD (
3804 IN PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor
,
3805 IN OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor
,
3806 IN PULONG BufferLength
3813 IN HANDLE HeapHandle
,
3821 RtlAppendStringToString(
3822 PSTRING Destination
,
3823 const STRING
*Source
3829 RtlCaptureStackBackTrace (
3830 IN ULONG FramesToSkip
,
3831 IN ULONG FramesToCapture
,
3832 OUT PVOID
*BackTrace
,
3833 OUT PULONG BackTraceHash OPTIONAL
3840 IN USHORT CompressionFormatAndEngine
,
3841 IN PUCHAR UncompressedBuffer
,
3842 IN ULONG UncompressedBufferSize
,
3843 OUT PUCHAR CompressedBuffer
,
3844 IN ULONG CompressedBufferSize
,
3845 IN ULONG UncompressedChunkSize
,
3846 OUT PULONG FinalCompressedSize
,
3854 IN PUCHAR UncompressedBuffer
,
3855 IN ULONG UncompressedBufferSize
,
3856 OUT PUCHAR CompressedBuffer
,
3857 IN ULONG CompressedBufferSize
,
3858 IN OUT PCOMPRESSED_DATA_INFO CompressedDataInfo
,
3859 IN ULONG CompressedDataInfoLength
,
3866 RtlConvertSidToUnicodeString (
3867 OUT PUNICODE_STRING DestinationString
,
3869 IN BOOLEAN AllocateDestinationString
3877 IN PSID Destination
,
3884 RtlCreateUnicodeString(
3885 PUNICODE_STRING DestinationString
,
3892 RtlDecompressBuffer (
3893 IN USHORT CompressionFormat
,
3894 OUT PUCHAR UncompressedBuffer
,
3895 IN ULONG UncompressedBufferSize
,
3896 IN PUCHAR CompressedBuffer
,
3897 IN ULONG CompressedBufferSize
,
3898 OUT PULONG FinalUncompressedSize
3904 RtlDecompressChunks (
3905 OUT PUCHAR UncompressedBuffer
,
3906 IN ULONG UncompressedBufferSize
,
3907 IN PUCHAR CompressedBuffer
,
3908 IN ULONG CompressedBufferSize
,
3909 IN PUCHAR CompressedTail
,
3910 IN ULONG CompressedTailSize
,
3911 IN PCOMPRESSED_DATA_INFO CompressedDataInfo
3917 RtlDecompressFragment (
3918 IN USHORT CompressionFormat
,
3919 OUT PUCHAR UncompressedFragment
,
3920 IN ULONG UncompressedFragmentSize
,
3921 IN PUCHAR CompressedBuffer
,
3922 IN ULONG CompressedBufferSize
,
3923 IN ULONG FragmentOffset
,
3924 OUT PULONG FinalUncompressedSize
,
3932 IN USHORT CompressionFormat
,
3933 IN OUT PUCHAR
*CompressedBuffer
,
3934 IN PUCHAR EndOfCompressedBufferPlus1
,
3935 OUT PUCHAR
*ChunkBuffer
,
3936 OUT PULONG ChunkSize
3942 RtlDowncaseUnicodeString(
3943 IN OUT PUNICODE_STRING UniDest
,
3944 IN PCUNICODE_STRING UniSource
,
3945 IN BOOLEAN AllocateDestinationString
3951 RtlDuplicateUnicodeString(
3953 IN PCUNICODE_STRING SourceString
,
3954 OUT PUNICODE_STRING DestinationString
3968 RtlFillMemoryUlong (
3969 IN PVOID Destination
,
3978 IN HANDLE HeapHandle
,
3986 RtlGenerate8dot3Name (
3987 IN PUNICODE_STRING Name
,
3988 IN BOOLEAN AllowExtendedCharacters
,
3989 IN OUT PGENERATE_NAME_CONTEXT Context
,
3990 OUT PUNICODE_STRING Name8dot3
3996 RtlGetCompressionWorkSpaceSize (
3997 IN USHORT CompressionFormatAndEngine
,
3998 OUT PULONG CompressBufferWorkSpaceSize
,
3999 OUT PULONG CompressFragmentWorkSpaceSize
4005 RtlGetDaclSecurityDescriptor (
4006 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4007 OUT PBOOLEAN DaclPresent
,
4009 OUT PBOOLEAN DaclDefaulted
4015 RtlGetGroupSecurityDescriptor (
4016 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4018 OUT PBOOLEAN GroupDefaulted
4024 RtlGetOwnerSecurityDescriptor (
4025 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4027 OUT PBOOLEAN OwnerDefaulted
4035 IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority
,
4036 IN UCHAR SubAuthorityCount
4042 RtlIsNameLegalDOS8Dot3(
4043 IN PCUNICODE_STRING Name
,
4044 IN OUT POEM_STRING OemName OPTIONAL
,
4045 IN OUT PBOOLEAN NameContainsSpaces OPTIONAL
4051 RtlLengthRequiredSid (
4052 IN ULONG SubAuthorityCount
4065 RtlNtStatusToDosError (
4072 RtlOemStringToUnicodeString(
4073 IN OUT PUNICODE_STRING DestinationString
,
4074 IN PCOEM_STRING SourceString
,
4075 IN BOOLEAN AllocateDestinationString
4081 RtlUnicodeStringToOemString(
4082 IN OUT POEM_STRING DestinationString
,
4083 IN PCUNICODE_STRING SourceString
,
4084 IN BOOLEAN AllocateDestinationString
4091 IN USHORT CompressionFormat
,
4092 IN OUT PUCHAR
*CompressedBuffer
,
4093 IN PUCHAR EndOfCompressedBufferPlus1
,
4094 OUT PUCHAR
*ChunkBuffer
,
4101 RtlSecondsSince1970ToTime (
4102 IN ULONG SecondsSince1970
,
4103 OUT PLARGE_INTEGER Time
4109 RtlSetGroupSecurityDescriptor (
4110 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
4112 IN BOOLEAN GroupDefaulted
4118 RtlSetOwnerSecurityDescriptor (
4119 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
4121 IN BOOLEAN OwnerDefaulted
4127 RtlSetSaclSecurityDescriptor (
4128 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
4129 IN BOOLEAN SaclPresent
,
4131 IN BOOLEAN SaclDefaulted
4137 RtlSubAuthorityCountSid (
4144 RtlSubAuthoritySid (
4146 IN ULONG SubAuthority
4152 RtlUnicodeToMultiByteN(
4153 OUT PCHAR MultiByteString
,
4154 IN ULONG MaxBytesInMultiByteString
,
4155 OUT PULONG BytesInMultiByteString OPTIONAL
,
4156 IN PWCH UnicodeString
,
4157 IN ULONG BytesInUnicodeString
4160 /* RTL Splay Tree Functions */
4164 RtlSplay(PRTL_SPLAY_LINKS Links
);
4169 RtlDelete(PRTL_SPLAY_LINKS Links
);
4175 PRTL_SPLAY_LINKS Links
,
4176 PRTL_SPLAY_LINKS
*Root
4182 RtlSubtreeSuccessor(PRTL_SPLAY_LINKS Links
);
4187 RtlSubtreePredecessor(PRTL_SPLAY_LINKS Links
);
4192 RtlRealSuccessor(PRTL_SPLAY_LINKS Links
);
4197 RtlRealPredecessor(PRTL_SPLAY_LINKS Links
);
4199 #define RtlIsLeftChild(Links) \
4200 (RtlLeftChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
4202 #define RtlIsRightChild(Links) \
4203 (RtlRightChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
4205 #define RtlRightChild(Links) \
4206 ((PRTL_SPLAY_LINKS)(Links))->RightChild
4208 #define RtlIsRoot(Links) \
4209 (RtlParent(Links) == (PRTL_SPLAY_LINKS)(Links))
4211 #define RtlLeftChild(Links) \
4212 ((PRTL_SPLAY_LINKS)(Links))->LeftChild
4214 #define RtlParent(Links) \
4215 ((PRTL_SPLAY_LINKS)(Links))->Parent
4217 #define RtlInitializeSplayLinks(Links) \
4219 PRTL_SPLAY_LINKS _SplayLinks; \
4220 _SplayLinks = (PRTL_SPLAY_LINKS)(Links); \
4221 _SplayLinks->Parent = _SplayLinks; \
4222 _SplayLinks->LeftChild = NULL; \
4223 _SplayLinks->RightChild = NULL; \
4226 #define RtlInsertAsLeftChild(ParentLinks,ChildLinks) \
4228 PRTL_SPLAY_LINKS _SplayParent; \
4229 PRTL_SPLAY_LINKS _SplayChild; \
4230 _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
4231 _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \
4232 _SplayParent->LeftChild = _SplayChild; \
4233 _SplayChild->Parent = _SplayParent; \
4236 #define RtlInsertAsRightChild(ParentLinks,ChildLinks) \
4238 PRTL_SPLAY_LINKS _SplayParent; \
4239 PRTL_SPLAY_LINKS _SplayChild; \
4240 _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
4241 _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \
4242 _SplayParent->RightChild = _SplayChild; \
4243 _SplayChild->Parent = _SplayParent; \
4256 SeAppendPrivileges (
4257 PACCESS_STATE AccessState
,
4258 PPRIVILEGE_SET Privileges
4264 SeAuditingFileEvents (
4265 IN BOOLEAN AccessGranted
,
4266 IN PSECURITY_DESCRIPTOR SecurityDescriptor
4272 SeAuditingFileOrGlobalEvents (
4273 IN BOOLEAN AccessGranted
,
4274 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4275 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4281 SeCaptureSubjectContext (
4282 OUT PSECURITY_SUBJECT_CONTEXT SubjectContext
4288 SeCreateClientSecurity (
4290 IN PSECURITY_QUALITY_OF_SERVICE QualityOfService
,
4291 IN BOOLEAN RemoteClient
,
4292 OUT PSECURITY_CLIENT_CONTEXT ClientContext
4295 #if (VER_PRODUCTBUILD >= 2195)
4300 SeCreateClientSecurityFromSubjectContext (
4301 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
,
4302 IN PSECURITY_QUALITY_OF_SERVICE QualityOfService
,
4303 IN BOOLEAN ServerIsRemote
,
4304 OUT PSECURITY_CLIENT_CONTEXT ClientContext
4307 #endif /* (VER_PRODUCTBUILD >= 2195) */
4309 #define SeDeleteClientSecurity(C) { \
4310 if (SeTokenType((C)->ClientToken) == TokenPrimary) { \
4311 PsDereferencePrimaryToken( (C)->ClientToken ); \
4313 PsDereferenceImpersonationToken( (C)->ClientToken ); \
4320 SeDeleteObjectAuditAlarm (
4325 #define SeEnableAccessToExports() SeExports = *(PSE_EXPORTS *)SeExports;
4331 IN PPRIVILEGE_SET Privileges
4337 SeImpersonateClient (
4338 IN PSECURITY_CLIENT_CONTEXT ClientContext
,
4339 IN PETHREAD ServerThread OPTIONAL
4342 #if (VER_PRODUCTBUILD >= 2195)
4347 SeImpersonateClientEx (
4348 IN PSECURITY_CLIENT_CONTEXT ClientContext
,
4349 IN PETHREAD ServerThread OPTIONAL
4352 #endif /* (VER_PRODUCTBUILD >= 2195) */
4357 SeLockSubjectContext (
4358 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4364 SeMarkLogonSessionForTerminationNotification (
4371 SeOpenObjectAuditAlarm (
4372 IN PUNICODE_STRING ObjectTypeName
,
4373 IN PVOID Object OPTIONAL
,
4374 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL
,
4375 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4376 IN PACCESS_STATE AccessState
,
4377 IN BOOLEAN ObjectCreated
,
4378 IN BOOLEAN AccessGranted
,
4379 IN KPROCESSOR_MODE AccessMode
,
4380 OUT PBOOLEAN GenerateOnClose
4386 SeOpenObjectForDeleteAuditAlarm (
4387 IN PUNICODE_STRING ObjectTypeName
,
4388 IN PVOID Object OPTIONAL
,
4389 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL
,
4390 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4391 IN PACCESS_STATE AccessState
,
4392 IN BOOLEAN ObjectCreated
,
4393 IN BOOLEAN AccessGranted
,
4394 IN KPROCESSOR_MODE AccessMode
,
4395 OUT PBOOLEAN GenerateOnClose
4402 IN OUT PPRIVILEGE_SET RequiredPrivileges
,
4403 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
,
4404 IN KPROCESSOR_MODE AccessMode
4410 SeQueryAuthenticationIdToken (
4411 IN PACCESS_TOKEN Token
,
4415 #if (VER_PRODUCTBUILD >= 2195)
4420 SeQueryInformationToken (
4421 IN PACCESS_TOKEN Token
,
4422 IN TOKEN_INFORMATION_CLASS TokenInformationClass
,
4423 OUT PVOID
*TokenInformation
4426 #endif /* (VER_PRODUCTBUILD >= 2195) */
4431 SeQuerySecurityDescriptorInfo (
4432 IN PSECURITY_INFORMATION SecurityInformation
,
4433 OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
4434 IN OUT PULONG Length
,
4435 IN PSECURITY_DESCRIPTOR
*ObjectsSecurityDescriptor
4438 #if (VER_PRODUCTBUILD >= 2195)
4443 SeQuerySessionIdToken (
4444 IN PACCESS_TOKEN Token
,
4448 #endif /* (VER_PRODUCTBUILD >= 2195) */
4450 #define SeQuerySubjectContextToken( SubjectContext ) \
4451 ( ARGUMENT_PRESENT( \
4452 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken \
4454 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken : \
4455 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
4457 typedef NTSTATUS (*PSE_LOGON_SESSION_TERMINATED_ROUTINE
) (
4464 SeRegisterLogonSessionTerminatedRoutine (
4465 IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
4471 SeReleaseSubjectContext (
4472 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4478 SeSetAccessStateGenericMapping (
4479 PACCESS_STATE AccessState
,
4480 PGENERIC_MAPPING GenericMapping
4486 SeSetSecurityDescriptorInfo (
4487 IN PVOID Object OPTIONAL
,
4488 IN PSECURITY_INFORMATION SecurityInformation
,
4489 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4490 IN OUT PSECURITY_DESCRIPTOR
*ObjectsSecurityDescriptor
,
4491 IN POOL_TYPE PoolType
,
4492 IN PGENERIC_MAPPING GenericMapping
4495 #if (VER_PRODUCTBUILD >= 2195)
4500 SeSetSecurityDescriptorInfoEx (
4501 IN PVOID Object OPTIONAL
,
4502 IN PSECURITY_INFORMATION SecurityInformation
,
4503 IN PSECURITY_DESCRIPTOR ModificationDescriptor
,
4504 IN OUT PSECURITY_DESCRIPTOR
*ObjectsSecurityDescriptor
,
4505 IN ULONG AutoInheritFlags
,
4506 IN POOL_TYPE PoolType
,
4507 IN PGENERIC_MAPPING GenericMapping
4514 IN PACCESS_TOKEN Token
4520 SeTokenIsRestricted (
4521 IN PACCESS_TOKEN Token
4527 SeLocateProcessImageName(
4528 IN PEPROCESS Process
,
4529 OUT PUNICODE_STRING
*pImageFileName
4532 #endif /* (VER_PRODUCTBUILD >= 2195) */
4538 IN PACCESS_TOKEN Token
4544 SeUnlockSubjectContext (
4545 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4551 SeUnregisterLogonSessionTerminatedRoutine (
4552 IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
4555 #if (VER_PRODUCTBUILD >= 2195)
4560 ZwAdjustPrivilegesToken (
4561 IN HANDLE TokenHandle
,
4562 IN BOOLEAN DisableAllPrivileges
,
4563 IN PTOKEN_PRIVILEGES NewState
,
4564 IN ULONG BufferLength
,
4565 OUT PTOKEN_PRIVILEGES PreviousState OPTIONAL
,
4566 OUT PULONG ReturnLength
4569 #endif /* (VER_PRODUCTBUILD >= 2195) */
4575 IN HANDLE ThreadHandle
4581 ZwAllocateVirtualMemory (
4582 IN HANDLE ProcessHandle
,
4583 IN OUT PVOID
*BaseAddress
,
4585 IN OUT PULONG RegionSize
,
4586 IN ULONG AllocationType
,
4592 NtAccessCheckByTypeAndAuditAlarm(
4593 IN PUNICODE_STRING SubsystemName
,
4595 IN PUNICODE_STRING ObjectTypeName
,
4596 IN PUNICODE_STRING ObjectName
,
4597 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4598 IN PSID PrincipalSelfSid
,
4599 IN ACCESS_MASK DesiredAccess
,
4600 IN AUDIT_EVENT_TYPE AuditType
,
4602 IN POBJECT_TYPE_LIST ObjectTypeList
,
4603 IN ULONG ObjectTypeLength
,
4604 IN PGENERIC_MAPPING GenericMapping
,
4605 IN BOOLEAN ObjectCreation
,
4606 OUT PACCESS_MASK GrantedAccess
,
4607 OUT PNTSTATUS AccessStatus
,
4608 OUT PBOOLEAN GenerateOnClose
4613 NtAccessCheckByTypeResultListAndAuditAlarm(
4614 IN PUNICODE_STRING SubsystemName
,
4616 IN PUNICODE_STRING ObjectTypeName
,
4617 IN PUNICODE_STRING ObjectName
,
4618 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4619 IN PSID PrincipalSelfSid
,
4620 IN ACCESS_MASK DesiredAccess
,
4621 IN AUDIT_EVENT_TYPE AuditType
,
4623 IN POBJECT_TYPE_LIST ObjectTypeList
,
4624 IN ULONG ObjectTypeLength
,
4625 IN PGENERIC_MAPPING GenericMapping
,
4626 IN BOOLEAN ObjectCreation
,
4627 OUT PACCESS_MASK GrantedAccess
,
4628 OUT PNTSTATUS AccessStatus
,
4629 OUT PBOOLEAN GenerateOnClose
4634 NtAccessCheckByTypeResultListAndAuditAlarmByHandle(
4635 IN PUNICODE_STRING SubsystemName
,
4637 IN HANDLE ClientToken
,
4638 IN PUNICODE_STRING ObjectTypeName
,
4639 IN PUNICODE_STRING ObjectName
,
4640 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4641 IN PSID PrincipalSelfSid
,
4642 IN ACCESS_MASK DesiredAccess
,
4643 IN AUDIT_EVENT_TYPE AuditType
,
4645 IN POBJECT_TYPE_LIST ObjectTypeList
,
4646 IN ULONG ObjectTypeLength
,
4647 IN PGENERIC_MAPPING GenericMapping
,
4648 IN BOOLEAN ObjectCreation
,
4649 OUT PACCESS_MASK GrantedAccess
,
4650 OUT PNTSTATUS AccessStatus
,
4651 OUT PBOOLEAN GenerateOnClose
4657 ZwAccessCheckAndAuditAlarm (
4658 IN PUNICODE_STRING SubsystemName
,
4660 IN PUNICODE_STRING ObjectTypeName
,
4661 IN PUNICODE_STRING ObjectName
,
4662 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4663 IN ACCESS_MASK DesiredAccess
,
4664 IN PGENERIC_MAPPING GenericMapping
,
4665 IN BOOLEAN ObjectCreation
,
4666 OUT PACCESS_MASK GrantedAccess
,
4667 OUT PBOOLEAN AccessStatus
,
4668 OUT PBOOLEAN GenerateOnClose
4671 #if (VER_PRODUCTBUILD >= 2195)
4677 IN HANDLE FileHandle
,
4678 OUT PIO_STATUS_BLOCK IoStatusBlock
4681 #endif /* (VER_PRODUCTBUILD >= 2195) */
4687 IN HANDLE EventHandle
4693 ZwCloseObjectAuditAlarm (
4694 IN PUNICODE_STRING SubsystemName
,
4696 IN BOOLEAN GenerateOnClose
4703 OUT PHANDLE SectionHandle
,
4704 IN ACCESS_MASK DesiredAccess
,
4705 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL
,
4706 IN PLARGE_INTEGER MaximumSize OPTIONAL
,
4707 IN ULONG SectionPageProtection
,
4708 IN ULONG AllocationAttributes
,
4709 IN HANDLE FileHandle OPTIONAL
4715 ZwCreateSymbolicLinkObject (
4716 OUT PHANDLE SymbolicLinkHandle
,
4717 IN ACCESS_MASK DesiredAccess
,
4718 IN POBJECT_ATTRIBUTES ObjectAttributes
,
4719 IN PUNICODE_STRING TargetName
4726 IN POBJECT_ATTRIBUTES ObjectAttributes
4734 IN PUNICODE_STRING Name
4740 ZwDeviceIoControlFile (
4741 IN HANDLE FileHandle
,
4742 IN HANDLE Event OPTIONAL
,
4743 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
4744 IN PVOID ApcContext OPTIONAL
,
4745 OUT PIO_STATUS_BLOCK IoStatusBlock
,
4746 IN ULONG IoControlCode
,
4747 IN PVOID InputBuffer OPTIONAL
,
4748 IN ULONG InputBufferLength
,
4749 OUT PVOID OutputBuffer OPTIONAL
,
4750 IN ULONG OutputBufferLength
4757 IN PUNICODE_STRING String
4764 IN HANDLE SourceProcessHandle
,
4765 IN HANDLE SourceHandle
,
4766 IN HANDLE TargetProcessHandle OPTIONAL
,
4767 OUT PHANDLE TargetHandle OPTIONAL
,
4768 IN ACCESS_MASK DesiredAccess
,
4769 IN ULONG HandleAttributes
,
4777 IN HANDLE ExistingTokenHandle
,
4778 IN ACCESS_MASK DesiredAccess
,
4779 IN POBJECT_ATTRIBUTES ObjectAttributes
,
4780 IN BOOLEAN EffectiveOnly
,
4781 IN TOKEN_TYPE TokenType
,
4782 OUT PHANDLE NewTokenHandle
4788 IN HANDLE ExistingTokenHandle
,
4790 IN PTOKEN_GROUPS SidsToDisable OPTIONAL
,
4791 IN PTOKEN_PRIVILEGES PrivilegesToDelete OPTIONAL
,
4792 IN PTOKEN_GROUPS RestrictedSids OPTIONAL
,
4793 OUT PHANDLE NewTokenHandle
4799 ZwFlushInstructionCache (
4800 IN HANDLE ProcessHandle
,
4801 IN PVOID BaseAddress OPTIONAL
,
4809 IN HANDLE FileHandle
,
4810 OUT PIO_STATUS_BLOCK IoStatusBlock
4813 #if (VER_PRODUCTBUILD >= 2195)
4818 ZwFlushVirtualMemory (
4819 IN HANDLE ProcessHandle
,
4820 IN OUT PVOID
*BaseAddress
,
4821 IN OUT PULONG FlushSize
,
4822 OUT PIO_STATUS_BLOCK IoStatusBlock
4825 #endif /* (VER_PRODUCTBUILD >= 2195) */
4830 ZwFreeVirtualMemory (
4831 IN HANDLE ProcessHandle
,
4832 IN OUT PVOID
*BaseAddress
,
4833 IN OUT PULONG RegionSize
,
4841 IN HANDLE FileHandle
,
4842 IN HANDLE Event OPTIONAL
,
4843 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
4844 IN PVOID ApcContext OPTIONAL
,
4845 OUT PIO_STATUS_BLOCK IoStatusBlock
,
4846 IN ULONG FsControlCode
,
4847 IN PVOID InputBuffer OPTIONAL
,
4848 IN ULONG InputBufferLength
,
4849 OUT PVOID OutputBuffer OPTIONAL
,
4850 IN ULONG OutputBufferLength
4853 #if (VER_PRODUCTBUILD >= 2195)
4858 ZwInitiatePowerAction (
4859 IN POWER_ACTION SystemAction
,
4860 IN SYSTEM_POWER_STATE MinSystemState
,
4862 IN BOOLEAN Asynchronous
4865 #endif /* (VER_PRODUCTBUILD >= 2195) */
4871 /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
4872 IN PUNICODE_STRING RegistryPath
4879 IN POBJECT_ATTRIBUTES KeyObjectAttributes
,
4880 IN POBJECT_ATTRIBUTES FileObjectAttributes
4887 IN HANDLE KeyHandle
,
4888 IN HANDLE EventHandle OPTIONAL
,
4889 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
4890 IN PVOID ApcContext OPTIONAL
,
4891 OUT PIO_STATUS_BLOCK IoStatusBlock
,
4892 IN ULONG NotifyFilter
,
4893 IN BOOLEAN WatchSubtree
,
4895 IN ULONG BufferLength
,
4896 IN BOOLEAN Asynchronous
4902 ZwOpenDirectoryObject (
4903 OUT PHANDLE DirectoryHandle
,
4904 IN ACCESS_MASK DesiredAccess
,
4905 IN POBJECT_ATTRIBUTES ObjectAttributes
4912 OUT PHANDLE EventHandle
,
4913 IN ACCESS_MASK DesiredAccess
,
4914 IN POBJECT_ATTRIBUTES ObjectAttributes
4921 OUT PHANDLE ProcessHandle
,
4922 IN ACCESS_MASK DesiredAccess
,
4923 IN POBJECT_ATTRIBUTES ObjectAttributes
,
4924 IN PCLIENT_ID ClientId OPTIONAL
4930 ZwOpenProcessToken (
4931 IN HANDLE ProcessHandle
,
4932 IN ACCESS_MASK DesiredAccess
,
4933 OUT PHANDLE TokenHandle
4940 OUT PHANDLE ThreadHandle
,
4941 IN ACCESS_MASK DesiredAccess
,
4942 IN POBJECT_ATTRIBUTES ObjectAttributes
,
4943 IN PCLIENT_ID ClientId
4950 IN HANDLE ThreadHandle
,
4951 IN ACCESS_MASK DesiredAccess
,
4952 IN BOOLEAN OpenAsSelf
,
4953 OUT PHANDLE TokenHandle
4956 #if (VER_PRODUCTBUILD >= 2195)
4961 ZwPowerInformation (
4962 IN POWER_INFORMATION_LEVEL PowerInformationLevel
,
4963 IN PVOID InputBuffer OPTIONAL
,
4964 IN ULONG InputBufferLength
,
4965 OUT PVOID OutputBuffer OPTIONAL
,
4966 IN ULONG OutputBufferLength
4969 #endif /* (VER_PRODUCTBUILD >= 2195) */
4975 IN HANDLE EventHandle
,
4976 OUT PLONG PreviousState OPTIONAL
4982 ZwQueryDefaultLocale (
4983 IN BOOLEAN ThreadOrSystem
,
4990 ZwQueryDirectoryFile (
4991 IN HANDLE FileHandle
,
4992 IN HANDLE Event OPTIONAL
,
4993 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
4994 IN PVOID ApcContext OPTIONAL
,
4995 OUT PIO_STATUS_BLOCK IoStatusBlock
,
4996 OUT PVOID FileInformation
,
4998 IN FILE_INFORMATION_CLASS FileInformationClass
,
4999 IN BOOLEAN ReturnSingleEntry
,
5000 IN PUNICODE_STRING FileName OPTIONAL
,
5001 IN BOOLEAN RestartScan
5004 #if (VER_PRODUCTBUILD >= 2195)
5009 ZwQueryDirectoryObject (
5010 IN HANDLE DirectoryHandle
,
5013 IN BOOLEAN ReturnSingleEntry
,
5014 IN BOOLEAN RestartScan
,
5015 IN OUT PULONG Context
,
5016 OUT PULONG ReturnLength OPTIONAL
5023 IN HANDLE FileHandle
,
5024 OUT PIO_STATUS_BLOCK IoStatusBlock
,
5027 IN BOOLEAN ReturnSingleEntry
,
5028 IN PVOID EaList OPTIONAL
,
5029 IN ULONG EaListLength
,
5030 IN PULONG EaIndex OPTIONAL
,
5031 IN BOOLEAN RestartScan
5034 #endif /* (VER_PRODUCTBUILD >= 2195) */
5039 ZwQueryInformationProcess (
5040 IN HANDLE ProcessHandle
,
5041 IN PROCESSINFOCLASS ProcessInformationClass
,
5042 OUT PVOID ProcessInformation
,
5043 IN ULONG ProcessInformationLength
,
5044 OUT PULONG ReturnLength OPTIONAL
5050 ZwQueryInformationToken (
5051 IN HANDLE TokenHandle
,
5052 IN TOKEN_INFORMATION_CLASS TokenInformationClass
,
5053 OUT PVOID TokenInformation
,
5055 OUT PULONG ResultLength
5061 ZwQuerySecurityObject (
5062 IN HANDLE FileHandle
,
5063 IN SECURITY_INFORMATION SecurityInformation
,
5064 OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
5066 OUT PULONG ResultLength
5072 ZwQueryVolumeInformationFile (
5073 IN HANDLE FileHandle
,
5074 OUT PIO_STATUS_BLOCK IoStatusBlock
,
5075 OUT PVOID FsInformation
,
5077 IN FS_INFORMATION_CLASS FsInformationClass
5084 IN POBJECT_ATTRIBUTES NewFileObjectAttributes
,
5085 IN HANDLE KeyHandle
,
5086 IN POBJECT_ATTRIBUTES OldFileObjectAttributes
5093 IN HANDLE EventHandle
,
5094 OUT PLONG PreviousState OPTIONAL
5097 #if (VER_PRODUCTBUILD >= 2195)
5103 IN HANDLE KeyHandle
,
5104 IN HANDLE FileHandle
,
5108 #endif /* (VER_PRODUCTBUILD >= 2195) */
5114 IN HANDLE KeyHandle
,
5115 IN HANDLE FileHandle
5121 ZwSetDefaultLocale (
5122 IN BOOLEAN ThreadOrSystem
,
5126 #if (VER_PRODUCTBUILD >= 2195)
5131 ZwSetDefaultUILanguage (
5132 IN LANGID LanguageId
5139 IN HANDLE FileHandle
,
5140 OUT PIO_STATUS_BLOCK IoStatusBlock
,
5145 #endif /* (VER_PRODUCTBUILD >= 2195) */
5151 IN HANDLE EventHandle
,
5152 OUT PLONG PreviousState OPTIONAL
5158 ZwSetInformationProcess (
5159 IN HANDLE ProcessHandle
,
5160 IN PROCESSINFOCLASS ProcessInformationClass
,
5161 IN PVOID ProcessInformation
,
5162 IN ULONG ProcessInformationLength
5165 #if (VER_PRODUCTBUILD >= 2195)
5170 ZwSetSecurityObject (
5172 IN SECURITY_INFORMATION SecurityInformation
,
5173 IN PSECURITY_DESCRIPTOR SecurityDescriptor
5176 #endif /* (VER_PRODUCTBUILD >= 2195) */
5182 IN PLARGE_INTEGER NewTime
,
5183 OUT PLARGE_INTEGER OldTime OPTIONAL
5186 #if (VER_PRODUCTBUILD >= 2195)
5191 ZwSetVolumeInformationFile (
5192 IN HANDLE FileHandle
,
5193 OUT PIO_STATUS_BLOCK IoStatusBlock
,
5194 IN PVOID FsInformation
,
5196 IN FS_INFORMATION_CLASS FsInformationClass
5199 #endif /* (VER_PRODUCTBUILD >= 2195) */
5204 ZwTerminateProcess (
5205 IN HANDLE ProcessHandle OPTIONAL
,
5206 IN NTSTATUS ExitStatus
5213 /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
5214 IN PUNICODE_STRING RegistryPath
5221 IN POBJECT_ATTRIBUTES KeyObjectAttributes
5227 ZwWaitForSingleObject (
5229 IN BOOLEAN Alertable
,
5230 IN PLARGE_INTEGER Timeout OPTIONAL
5236 ZwWaitForMultipleObjects (
5237 IN ULONG HandleCount
,
5239 IN WAIT_TYPE WaitType
,
5240 IN BOOLEAN Alertable
,
5241 IN PLARGE_INTEGER Timeout OPTIONAL
5257 #endif /* _NTIFS_ */