4 * Windows NT Filesystem Driver Developer Kit
6 * This file is part of the w32api package.
9 * Created by Bo Brantén <bosse@acc.umu.se>
11 * THIS SOFTWARE IS NOT COPYRIGHTED
13 * This source code is offered for use in the public domain. You may
14 * use, modify or distribute it freely.
16 * This code is distributed in the hope that it will be useful but
17 * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
18 * DISCLAIMED. This includes but is not limited to warranties of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
28 #pragma GCC system_header
32 /* HACKHACKHACK!!! We shouldn't include this header from ntoskrnl! */
35 #define NTKERNELAPI DECLSPEC_IMPORT
40 #define _NTIFS_INCLUDED_
47 #define VER_PRODUCTBUILD 10000
53 #define EX_PUSH_LOCK ULONG_PTR
54 #define PEX_PUSH_LOCK PULONG_PTR
58 typedef struct _SE_EXPORTS
*PSE_EXPORTS
;
61 extern PUCHAR FsRtlLegalAnsiCharacterArray
;
63 extern DECLSPEC_IMPORT PUCHAR FsRtlLegalAnsiCharacterArray
;
65 extern PSE_EXPORTS SeExports
;
66 extern PACL SePublicDefaultDacl
;
67 extern PACL SeSystemDefaultDacl
;
69 extern KSPIN_LOCK IoStatisticsLock
;
70 extern ULONG IoReadOperationCount
;
71 extern ULONG IoWriteOperationCount
;
72 extern ULONG IoOtherOperationCount
;
73 extern LARGE_INTEGER IoReadTransferCount
;
74 extern LARGE_INTEGER IoWriteTransferCount
;
75 extern LARGE_INTEGER IoOtherTransferCount
;
77 typedef STRING LSA_STRING
, *PLSA_STRING
;
78 typedef ULONG LSA_OPERATIONAL_MODE
, *PLSA_OPERATIONAL_MODE
;
80 typedef enum _SECURITY_LOGON_TYPE
82 UndefinedLogonType
= 0,
91 #if (_WIN32_WINNT >= 0x0501)
95 #if (_WIN32_WINNT >= 0x0502)
96 CachedRemoteInteractive
,
99 } SECURITY_LOGON_TYPE
, *PSECURITY_LOGON_TYPE
;
101 #define ANSI_DOS_STAR ('<')
102 #define ANSI_DOS_QM ('>')
103 #define ANSI_DOS_DOT ('"')
105 #define DOS_STAR (L'<')
106 #define DOS_QM (L'>')
107 #define DOS_DOT (L'"')
109 /* also in winnt.h */
110 #define ACCESS_MIN_MS_ACE_TYPE (0x0)
111 #define ACCESS_ALLOWED_ACE_TYPE (0x0)
112 #define ACCESS_DENIED_ACE_TYPE (0x1)
113 #define SYSTEM_AUDIT_ACE_TYPE (0x2)
114 #define SYSTEM_ALARM_ACE_TYPE (0x3)
115 #define ACCESS_MAX_MS_V2_ACE_TYPE (0x3)
116 #define ACCESS_ALLOWED_COMPOUND_ACE_TYPE (0x4)
117 #define ACCESS_MAX_MS_V3_ACE_TYPE (0x4)
118 #define ACCESS_MIN_MS_OBJECT_ACE_TYPE (0x5)
119 #define ACCESS_ALLOWED_OBJECT_ACE_TYPE (0x5)
120 #define ACCESS_DENIED_OBJECT_ACE_TYPE (0x6)
121 #define SYSTEM_AUDIT_OBJECT_ACE_TYPE (0x7)
122 #define SYSTEM_ALARM_OBJECT_ACE_TYPE (0x8)
123 #define ACCESS_MAX_MS_OBJECT_ACE_TYPE (0x8)
124 #define ACCESS_MAX_MS_V4_ACE_TYPE (0x8)
125 #define ACCESS_MAX_MS_ACE_TYPE (0x8)
126 #define ACCESS_ALLOWED_CALLBACK_ACE_TYPE (0x9)
127 #define ACCESS_DENIED_CALLBACK_ACE_TYPE (0xA)
128 #define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE (0xB)
129 #define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE (0xC)
130 #define SYSTEM_AUDIT_CALLBACK_ACE_TYPE (0xD)
131 #define SYSTEM_ALARM_CALLBACK_ACE_TYPE (0xE)
132 #define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE (0xF)
133 #define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE (0x10)
134 #define ACCESS_MAX_MS_V5_ACE_TYPE (0x10)
136 #define COMPRESSION_FORMAT_NONE (0x0000)
137 #define COMPRESSION_FORMAT_DEFAULT (0x0001)
138 #define COMPRESSION_FORMAT_LZNT1 (0x0002)
139 #define COMPRESSION_ENGINE_STANDARD (0x0000)
140 #define COMPRESSION_ENGINE_MAXIMUM (0x0100)
141 #define COMPRESSION_ENGINE_HIBER (0x0200)
143 #define FILE_ACTION_ADDED 0x00000001
144 #define FILE_ACTION_REMOVED 0x00000002
145 #define FILE_ACTION_MODIFIED 0x00000003
146 #define FILE_ACTION_RENAMED_OLD_NAME 0x00000004
147 #define FILE_ACTION_RENAMED_NEW_NAME 0x00000005
148 #define FILE_ACTION_ADDED_STREAM 0x00000006
149 #define FILE_ACTION_REMOVED_STREAM 0x00000007
150 #define FILE_ACTION_MODIFIED_STREAM 0x00000008
151 #define FILE_ACTION_REMOVED_BY_DELETE 0x00000009
152 #define FILE_ACTION_ID_NOT_TUNNELLED 0x0000000A
153 #define FILE_ACTION_TUNNELLED_ID_COLLISION 0x0000000B
156 #define FILE_EA_TYPE_BINARY 0xfffe
157 #define FILE_EA_TYPE_ASCII 0xfffd
158 #define FILE_EA_TYPE_BITMAP 0xfffb
159 #define FILE_EA_TYPE_METAFILE 0xfffa
160 #define FILE_EA_TYPE_ICON 0xfff9
161 #define FILE_EA_TYPE_EA 0xffee
162 #define FILE_EA_TYPE_MVMT 0xffdf
163 #define FILE_EA_TYPE_MVST 0xffde
164 #define FILE_EA_TYPE_ASN1 0xffdd
165 #define FILE_EA_TYPE_FAMILY_IDS 0xff01
167 #define FILE_NEED_EA 0x00000080
169 /* also in winnt.h */
170 #define FILE_NOTIFY_CHANGE_FILE_NAME 0x00000001
171 #define FILE_NOTIFY_CHANGE_DIR_NAME 0x00000002
172 #define FILE_NOTIFY_CHANGE_NAME 0x00000003
173 #define FILE_NOTIFY_CHANGE_ATTRIBUTES 0x00000004
174 #define FILE_NOTIFY_CHANGE_SIZE 0x00000008
175 #define FILE_NOTIFY_CHANGE_LAST_WRITE 0x00000010
176 #define FILE_NOTIFY_CHANGE_LAST_ACCESS 0x00000020
177 #define FILE_NOTIFY_CHANGE_CREATION 0x00000040
178 #define FILE_NOTIFY_CHANGE_EA 0x00000080
179 #define FILE_NOTIFY_CHANGE_SECURITY 0x00000100
180 #define FILE_NOTIFY_CHANGE_STREAM_NAME 0x00000200
181 #define FILE_NOTIFY_CHANGE_STREAM_SIZE 0x00000400
182 #define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
183 #define FILE_NOTIFY_VALID_MASK 0x00000fff
186 #define FILE_OPLOCK_BROKEN_TO_LEVEL_2 0x00000007
187 #define FILE_OPLOCK_BROKEN_TO_NONE 0x00000008
189 #define FILE_OPBATCH_BREAK_UNDERWAY 0x00000009
191 #define FILE_CASE_SENSITIVE_SEARCH 0x00000001
192 #define FILE_CASE_PRESERVED_NAMES 0x00000002
193 #define FILE_UNICODE_ON_DISK 0x00000004
194 #define FILE_PERSISTENT_ACLS 0x00000008
195 #define FILE_FILE_COMPRESSION 0x00000010
196 #define FILE_VOLUME_QUOTAS 0x00000020
197 #define FILE_SUPPORTS_SPARSE_FILES 0x00000040
198 #define FILE_SUPPORTS_REPARSE_POINTS 0x00000080
199 #define FILE_SUPPORTS_REMOTE_STORAGE 0x00000100
200 #define FS_LFN_APIS 0x00004000
201 #define FILE_VOLUME_IS_COMPRESSED 0x00008000
202 #define FILE_SUPPORTS_OBJECT_IDS 0x00010000
203 #define FILE_SUPPORTS_ENCRYPTION 0x00020000
204 #define FILE_NAMED_STREAMS 0x00040000
206 #define FILE_PIPE_BYTE_STREAM_TYPE 0x00000000
207 #define FILE_PIPE_MESSAGE_TYPE 0x00000001
209 #define FILE_PIPE_BYTE_STREAM_MODE 0x00000000
210 #define FILE_PIPE_MESSAGE_MODE 0x00000001
212 #define FILE_PIPE_QUEUE_OPERATION 0x00000000
213 #define FILE_PIPE_COMPLETE_OPERATION 0x00000001
215 #define FILE_PIPE_INBOUND 0x00000000
216 #define FILE_PIPE_OUTBOUND 0x00000001
217 #define FILE_PIPE_FULL_DUPLEX 0x00000002
219 #define FILE_PIPE_DISCONNECTED_STATE 0x00000001
220 #define FILE_PIPE_LISTENING_STATE 0x00000002
221 #define FILE_PIPE_CONNECTED_STATE 0x00000003
222 #define FILE_PIPE_CLOSING_STATE 0x00000004
224 #define FILE_PIPE_CLIENT_END 0x00000000
225 #define FILE_PIPE_SERVER_END 0x00000001
227 #define FILE_PIPE_READ_DATA 0x00000000
228 #define FILE_PIPE_WRITE_SPACE 0x00000001
230 #define FILE_STORAGE_TYPE_SPECIFIED 0x00000041 /* FILE_DIRECTORY_FILE | FILE_NON_DIRECTORY_FILE */
231 #define FILE_STORAGE_TYPE_DEFAULT (StorageTypeDefault << FILE_STORAGE_TYPE_SHIFT)
232 #define FILE_STORAGE_TYPE_DIRECTORY (StorageTypeDirectory << FILE_STORAGE_TYPE_SHIFT)
233 #define FILE_STORAGE_TYPE_FILE (StorageTypeFile << FILE_STORAGE_TYPE_SHIFT)
234 #define FILE_STORAGE_TYPE_DOCFILE (StorageTypeDocfile << FILE_STORAGE_TYPE_SHIFT)
235 #define FILE_STORAGE_TYPE_JUNCTION_POINT (StorageTypeJunctionPoint << FILE_STORAGE_TYPE_SHIFT)
236 #define FILE_STORAGE_TYPE_CATALOG (StorageTypeCatalog << FILE_STORAGE_TYPE_SHIFT)
237 #define FILE_STORAGE_TYPE_STRUCTURED_STORAGE (StorageTypeStructuredStorage << FILE_STORAGE_TYPE_SHIFT)
238 #define FILE_STORAGE_TYPE_EMBEDDING (StorageTypeEmbedding << FILE_STORAGE_TYPE_SHIFT)
239 #define FILE_STORAGE_TYPE_STREAM (StorageTypeStream << FILE_STORAGE_TYPE_SHIFT)
240 #define FILE_MINIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_DEFAULT
241 #define FILE_MAXIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_STREAM
242 #define FILE_STORAGE_TYPE_MASK 0x000f0000
243 #define FILE_STORAGE_TYPE_SHIFT 16
245 #define FILE_VC_QUOTA_NONE 0x00000000
246 #define FILE_VC_QUOTA_TRACK 0x00000001
247 #define FILE_VC_QUOTA_ENFORCE 0x00000002
248 #define FILE_VC_QUOTA_MASK 0x00000003
250 #define FILE_VC_QUOTAS_LOG_VIOLATIONS 0x00000004
251 #define FILE_VC_CONTENT_INDEX_DISABLED 0x00000008
253 #define FILE_VC_LOG_QUOTA_THRESHOLD 0x00000010
254 #define FILE_VC_LOG_QUOTA_LIMIT 0x00000020
255 #define FILE_VC_LOG_VOLUME_THRESHOLD 0x00000040
256 #define FILE_VC_LOG_VOLUME_LIMIT 0x00000080
258 #define FILE_VC_QUOTAS_INCOMPLETE 0x00000100
259 #define FILE_VC_QUOTAS_REBUILDING 0x00000200
261 #define FILE_VC_VALID_MASK 0x000003ff
263 #define FSRTL_FLAG_FILE_MODIFIED (0x01)
264 #define FSRTL_FLAG_FILE_LENGTH_CHANGED (0x02)
265 #define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04)
266 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08)
267 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10)
268 #define FSRTL_FLAG_USER_MAPPED_FILE (0x20)
269 #define FSRTL_FLAG_EOF_ADVANCE_ACTIVE (0x80)
271 #define FSRTL_FLAG2_DO_MODIFIED_WRITE (0x01)
273 #define FSRTL_FSP_TOP_LEVEL_IRP (0x01)
274 #define FSRTL_CACHE_TOP_LEVEL_IRP (0x02)
275 #define FSRTL_MOD_WRITE_TOP_LEVEL_IRP (0x03)
276 #define FSRTL_FAST_IO_TOP_LEVEL_IRP (0x04)
277 #define FSRTL_MAX_TOP_LEVEL_IRP_FLAG (0x04)
279 #define FSRTL_VOLUME_DISMOUNT 1
280 #define FSRTL_VOLUME_DISMOUNT_FAILED 2
281 #define FSRTL_VOLUME_LOCK 3
282 #define FSRTL_VOLUME_LOCK_FAILED 4
283 #define FSRTL_VOLUME_UNLOCK 5
284 #define FSRTL_VOLUME_MOUNT 6
286 #define FSRTL_WILD_CHARACTER 0x08
288 #define FSRTL_FAT_LEGAL 0x01
289 #define FSRTL_HPFS_LEGAL 0x02
290 #define FSRTL_NTFS_LEGAL 0x04
291 #define FSRTL_WILD_CHARACTER 0x08
292 #define FSRTL_OLE_LEGAL 0x10
293 #define FSRTL_NTFS_STREAM_LEGAL 0x14
296 #define HARDWARE_PTE HARDWARE_PTE_X86
297 #define PHARDWARE_PTE PHARDWARE_PTE_X86
299 #define HARDWARE_PTE ULONG
300 #define PHARDWARE_PTE PULONG
303 #define IO_CHECK_CREATE_PARAMETERS 0x0200
304 #define IO_ATTACH_DEVICE 0x0400
306 #define IO_ATTACH_DEVICE_API 0x80000000
308 #define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE 64
309 #define IO_FILE_OBJECT_PAGED_POOL_CHARGE 1024
311 #define IO_TYPE_APC 18
312 #define IO_TYPE_DPC 19
313 #define IO_TYPE_DEVICE_QUEUE 20
314 #define IO_TYPE_EVENT_PAIR 21
315 #define IO_TYPE_INTERRUPT 22
316 #define IO_TYPE_PROFILE 23
318 #define IRP_BEING_VERIFIED 0x10
320 #define MAILSLOT_CLASS_FIRSTCLASS 1
321 #define MAILSLOT_CLASS_SECONDCLASS 2
323 #define MAILSLOT_SIZE_AUTO 0
325 #define MAP_PROCESS 1L
326 #define MAP_SYSTEM 2L
327 #define MEM_DOS_LIM 0x40000000
329 #define OB_TYPE_TYPE 1
330 #define OB_TYPE_DIRECTORY 2
331 #define OB_TYPE_SYMBOLIC_LINK 3
332 #define OB_TYPE_TOKEN 4
333 #define OB_TYPE_PROCESS 5
334 #define OB_TYPE_THREAD 6
335 #define OB_TYPE_EVENT 7
336 #define OB_TYPE_EVENT_PAIR 8
337 #define OB_TYPE_MUTANT 9
338 #define OB_TYPE_SEMAPHORE 10
339 #define OB_TYPE_TIMER 11
340 #define OB_TYPE_PROFILE 12
341 #define OB_TYPE_WINDOW_STATION 13
342 #define OB_TYPE_DESKTOP 14
343 #define OB_TYPE_SECTION 15
344 #define OB_TYPE_KEY 16
345 #define OB_TYPE_PORT 17
346 #define OB_TYPE_ADAPTER 18
347 #define OB_TYPE_CONTROLLER 19
348 #define OB_TYPE_DEVICE 20
349 #define OB_TYPE_DRIVER 21
350 #define OB_TYPE_IO_COMPLETION 22
351 #define OB_TYPE_FILE 23
354 #define PIN_EXCLUSIVE (2)
355 #define PIN_NO_READ (4)
356 #define PIN_IF_BCB (8)
358 #define RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE 1
359 #define RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING 2
361 #define SEC_BASED 0x00200000
363 #define SECURITY_WORLD_SID_AUTHORITY {0,0,0,0,0,1}
364 #define SECURITY_WORLD_RID (0x00000000L)
366 #define SID_REVISION 1
367 #define SID_MAX_SUB_AUTHORITIES 15
368 #define SID_RECOMMENDED_SUB_AUTHORITIES 1
370 #define TOKEN_ASSIGN_PRIMARY (0x0001)
371 #define TOKEN_DUPLICATE (0x0002)
372 #define TOKEN_IMPERSONATE (0x0004)
373 #define TOKEN_QUERY (0x0008)
374 #define TOKEN_QUERY_SOURCE (0x0010)
375 #define TOKEN_ADJUST_PRIVILEGES (0x0020)
376 #define TOKEN_ADJUST_GROUPS (0x0040)
377 #define TOKEN_ADJUST_DEFAULT (0x0080)
378 #define TOKEN_ADJUST_SESSIONID (0x0100)
380 #define TOKEN_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED |\
381 TOKEN_ASSIGN_PRIMARY |\
385 TOKEN_QUERY_SOURCE |\
386 TOKEN_ADJUST_PRIVILEGES |\
387 TOKEN_ADJUST_GROUPS |\
388 TOKEN_ADJUST_DEFAULT |\
389 TOKEN_ADJUST_SESSIONID)
391 #define TOKEN_READ (STANDARD_RIGHTS_READ |\
394 #define TOKEN_WRITE (STANDARD_RIGHTS_WRITE |\
395 TOKEN_ADJUST_PRIVILEGES |\
396 TOKEN_ADJUST_GROUPS |\
397 TOKEN_ADJUST_DEFAULT)
399 #define TOKEN_EXECUTE (STANDARD_RIGHTS_EXECUTE)
401 #define TOKEN_SOURCE_LENGTH 8
404 #define TOKEN_HAS_TRAVERSE_PRIVILEGE 0x01
405 #define TOKEN_HAS_BACKUP_PRIVILEGE 0x02
406 #define TOKEN_HAS_RESTORE_PRIVILEGE 0x04
407 #define TOKEN_HAS_ADMIN_GROUP 0x08
408 #define TOKEN_WRITE_RESTRICTED 0x08
409 #define TOKEN_IS_RESTRICTED 0x10
410 #define SE_BACKUP_PRIVILEGES_CHECKED 0x0100
412 #define VACB_MAPPING_GRANULARITY (0x40000)
413 #define VACB_OFFSET_SHIFT (18)
415 #define SE_OWNER_DEFAULTED 0x0001
416 #define SE_GROUP_DEFAULTED 0x0002
417 #define SE_DACL_PRESENT 0x0004
418 #define SE_DACL_DEFAULTED 0x0008
419 #define SE_SACL_PRESENT 0x0010
420 #define SE_SACL_DEFAULTED 0x0020
421 #define SE_DACL_UNTRUSTED 0x0040
422 #define SE_SERVER_SECURITY 0x0080
423 #define SE_DACL_AUTO_INHERIT_REQ 0x0100
424 #define SE_SACL_AUTO_INHERIT_REQ 0x0200
425 #define SE_DACL_AUTO_INHERITED 0x0400
426 #define SE_SACL_AUTO_INHERITED 0x0800
427 #define SE_DACL_PROTECTED 0x1000
428 #define SE_SACL_PROTECTED 0x2000
429 #define SE_RM_CONTROL_VALID 0x4000
430 #define SE_SELF_RELATIVE 0x8000
433 #define _AUDIT_EVENT_TYPE_HACK 0
435 #if (_AUDIT_EVENT_TYPE_HACK == 1)
438 typedef enum _AUDIT_EVENT_TYPE
440 AuditEventObjectAccess
,
441 AuditEventDirectoryServiceAccess
442 } AUDIT_EVENT_TYPE
, *PAUDIT_EVENT_TYPE
;
445 #define AUDIT_ALLOW_NO_PRIVILEGE 0x1
447 #define FSCTL_REQUEST_OPLOCK_LEVEL_1 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
448 #define FSCTL_REQUEST_OPLOCK_LEVEL_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
449 #define FSCTL_REQUEST_BATCH_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
450 #define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 3, METHOD_BUFFERED, FILE_ANY_ACCESS)
451 #define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
452 #define FSCTL_OPLOCK_BREAK_NOTIFY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 5, METHOD_BUFFERED, FILE_ANY_ACCESS)
453 #define FSCTL_LOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
454 #define FSCTL_UNLOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
455 #define FSCTL_DISMOUNT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
457 #define FSCTL_IS_VOLUME_MOUNTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
458 #define FSCTL_IS_PATHNAME_VALID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
459 #define FSCTL_MARK_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
461 #define FSCTL_QUERY_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER, FILE_ANY_ACCESS)
462 #define FSCTL_GET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
463 #define FSCTL_SET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
466 #define FSCTL_MARK_AS_SYSTEM_HIVE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS)
467 #define FSCTL_OPLOCK_BREAK_ACK_NO_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
468 #define FSCTL_INVALIDATE_VOLUMES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
469 #define FSCTL_QUERY_FAT_BPB CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS)
470 #define FSCTL_REQUEST_FILTER_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
471 #define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS)
473 #if (VER_PRODUCTBUILD >= 1381)
475 #define FSCTL_GET_NTFS_VOLUME_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS)
476 #define FSCTL_GET_NTFS_FILE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS)
477 #define FSCTL_GET_VOLUME_BITMAP CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER, FILE_ANY_ACCESS)
478 #define FSCTL_GET_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER, FILE_ANY_ACCESS)
479 #define FSCTL_MOVE_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_ANY_ACCESS)
480 #define FSCTL_IS_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
481 #define FSCTL_GET_HFS_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS)
482 #define FSCTL_ALLOW_EXTENDED_DASD_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER, FILE_ANY_ACCESS)
484 #endif /* (VER_PRODUCTBUILD >= 1381) */
486 #if (VER_PRODUCTBUILD >= 2195)
488 #define FSCTL_READ_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 33, METHOD_NEITHER, FILE_ANY_ACCESS)
489 #define FSCTL_WRITE_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 34, METHOD_NEITHER, FILE_ANY_ACCESS)
490 #define FSCTL_FIND_FILES_BY_SID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS)
492 #define FSCTL_DUMP_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 37, METHOD_NEITHER, FILE_ANY_ACCESS)
493 #define FSCTL_SET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_WRITE_DATA)
494 #define FSCTL_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS)
495 #define FSCTL_DELETE_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_WRITE_DATA)
496 #define FSCTL_SET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_WRITE_DATA)
497 #define FSCTL_GET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS)
498 #define FSCTL_DELETE_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_WRITE_DATA)
499 #define FSCTL_ENUM_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER, FILE_READ_DATA)
500 #define FSCTL_SECURITY_ID_CHECK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45, METHOD_NEITHER, FILE_READ_DATA)
501 #define FSCTL_READ_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46, METHOD_NEITHER, FILE_READ_DATA)
502 #define FSCTL_SET_OBJECT_ID_EXTENDED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_WRITE_DATA)
503 #define FSCTL_CREATE_OR_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS)
504 #define FSCTL_SET_SPARSE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_WRITE_DATA)
505 #define FSCTL_SET_ZERO_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA)
506 #define FSCTL_QUERY_ALLOCATED_RANGES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51, METHOD_NEITHER, FILE_READ_DATA)
507 #define FSCTL_ENABLE_UPGRADE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA)
508 #define FSCTL_SET_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_BUFFERED, FILE_ANY_ACCESS)
509 #define FSCTL_ENCRYPTION_FSCTL_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54, METHOD_NEITHER, FILE_ANY_ACCESS)
510 #define FSCTL_WRITE_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55, METHOD_NEITHER, FILE_ANY_ACCESS)
511 #define FSCTL_READ_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56, METHOD_NEITHER, FILE_ANY_ACCESS)
512 #define FSCTL_CREATE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57, METHOD_NEITHER, FILE_READ_DATA)
513 #define FSCTL_READ_FILE_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58, METHOD_NEITHER, FILE_READ_DATA)
514 #define FSCTL_WRITE_USN_CLOSE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59, METHOD_NEITHER, FILE_READ_DATA)
515 #define FSCTL_EXTEND_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
516 #define FSCTL_QUERY_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
517 #define FSCTL_DELETE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
518 #define FSCTL_MARK_HANDLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS)
519 #define FSCTL_SIS_COPYFILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS)
520 #define FSCTL_SIS_LINK_FILES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
521 #define FSCTL_HSM_MSG CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
522 #define FSCTL_NSS_CONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 67, METHOD_BUFFERED, FILE_WRITE_DATA)
523 #define FSCTL_HSM_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
524 #define FSCTL_RECALL_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS)
525 #define FSCTL_NSS_RCONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 70, METHOD_BUFFERED, FILE_READ_DATA)
526 #define FSCTL_READ_FROM_PLEX CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA)
527 #define FSCTL_FILE_PREFETCH CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
529 #endif /* (VER_PRODUCTBUILD >= 2195) */
531 #define FSCTL_MAILSLOT_PEEK CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)
533 #define FSCTL_NETWORK_SET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 102, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
534 #define FSCTL_NETWORK_GET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 103, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
535 #define FSCTL_NETWORK_GET_CONNECTION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 104, METHOD_NEITHER, FILE_ANY_ACCESS)
536 #define FSCTL_NETWORK_ENUMERATE_CONNECTIONS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 105, METHOD_NEITHER, FILE_ANY_ACCESS)
537 #define FSCTL_NETWORK_DELETE_CONNECTION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 107, METHOD_BUFFERED, FILE_ANY_ACCESS)
538 #define FSCTL_NETWORK_GET_STATISTICS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 116, METHOD_BUFFERED, FILE_ANY_ACCESS)
539 #define FSCTL_NETWORK_SET_DOMAIN_NAME CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_ANY_ACCESS)
540 #define FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_ANY_ACCESS)
542 #define FSCTL_PIPE_ASSIGN_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
543 #define FSCTL_PIPE_DISCONNECT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
544 #define FSCTL_PIPE_LISTEN CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
545 #define FSCTL_PIPE_PEEK CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
546 #define FSCTL_PIPE_QUERY_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
547 #define FSCTL_PIPE_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
548 #define FSCTL_PIPE_WAIT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
549 #define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
550 #define FSCTL_PIPE_SET_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
551 #define FSCTL_PIPE_QUERY_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
552 #define FSCTL_PIPE_INTERNAL_READ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
553 #define FSCTL_PIPE_INTERNAL_WRITE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
554 #define FSCTL_PIPE_INTERNAL_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
555 #define FSCTL_PIPE_INTERNAL_READ_OVFLOW CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
557 #define IOCTL_REDIR_QUERY_PATH CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
559 typedef PVOID OPLOCK
, *POPLOCK
;
561 typedef struct _CACHE_MANAGER_CALLBACKS
*PCACHE_MANAGER_CALLBACKS
;
562 typedef struct _FILE_GET_QUOTA_INFORMATION
*PFILE_GET_QUOTA_INFORMATION
;
563 typedef struct _HANDLE_TABLE
*PHANDLE_TABLE
;
564 typedef struct _KPROCESS
*PKPROCESS
;
565 typedef struct _KQUEUE
*PKQUEUE
;
566 typedef struct _KTRAP_FRAME
*PKTRAP_FRAME
;
567 typedef struct _OBJECT_DIRECTORY
*POBJECT_DIRECTORY
;
568 typedef struct _SHARED_CACHE_MAP
*PSHARED_CACHE_MAP
;
569 typedef struct _VACB
*PVACB
;
570 typedef struct _VAD_HEADER
*PVAD_HEADER
;
578 typedef struct _NOTIFY_SYNC
591 } NOTIFY_SYNC
, * PNOTIFY_SYNC
;
593 typedef enum _FAST_IO_POSSIBLE
{
599 typedef enum _FILE_STORAGE_TYPE
{
600 StorageTypeDefault
= 1,
601 StorageTypeDirectory
,
603 StorageTypeJunctionPoint
,
605 StorageTypeStructuredStorage
,
606 StorageTypeEmbedding
,
610 typedef enum _OBJECT_INFO_CLASS
{
618 typedef struct _KAPC_STATE
{
619 LIST_ENTRY ApcListHead
[2];
621 BOOLEAN KernelApcInProgress
;
622 BOOLEAN KernelApcPending
;
623 BOOLEAN UserApcPending
;
624 } KAPC_STATE
, *PKAPC_STATE
, *RESTRICTED_POINTER PRKAPC_STATE
;
626 typedef struct _BITMAP_RANGE
{
628 LARGE_INTEGER BasePage
;
629 ULONG FirstDirtyPage
;
633 } BITMAP_RANGE
, *PBITMAP_RANGE
;
635 typedef struct _CACHE_UNINITIALIZE_EVENT
{
636 struct _CACHE_UNINITIALIZE_EVENT
*Next
;
638 } CACHE_UNINITIALIZE_EVENT
, *PCACHE_UNINITIALIZE_EVENT
;
640 typedef struct _CC_FILE_SIZES
{
641 LARGE_INTEGER AllocationSize
;
642 LARGE_INTEGER FileSize
;
643 LARGE_INTEGER ValidDataLength
;
644 } CC_FILE_SIZES
, *PCC_FILE_SIZES
;
646 typedef struct _COMPRESSED_DATA_INFO
{
647 USHORT CompressionFormatAndEngine
;
648 UCHAR CompressionUnitShift
;
652 USHORT NumberOfChunks
;
653 ULONG CompressedChunkSizes
[ANYSIZE_ARRAY
];
654 } COMPRESSED_DATA_INFO
, *PCOMPRESSED_DATA_INFO
;
656 typedef struct _SID_IDENTIFIER_AUTHORITY
{
658 } SID_IDENTIFIER_AUTHORITY
,*PSID_IDENTIFIER_AUTHORITY
,*LPSID_IDENTIFIER_AUTHORITY
;
660 typedef struct _SID
{
662 BYTE SubAuthorityCount
;
663 SID_IDENTIFIER_AUTHORITY IdentifierAuthority
;
664 DWORD SubAuthority
[ANYSIZE_ARRAY
];
666 typedef struct _SID_AND_ATTRIBUTES
{
669 } SID_AND_ATTRIBUTES
, *PSID_AND_ATTRIBUTES
;
670 typedef SID_AND_ATTRIBUTES SID_AND_ATTRIBUTES_ARRAY
[ANYSIZE_ARRAY
];
671 typedef SID_AND_ATTRIBUTES_ARRAY
*PSID_AND_ATTRIBUTES_ARRAY
;
672 typedef struct _TOKEN_SOURCE
{
673 CHAR SourceName
[TOKEN_SOURCE_LENGTH
];
674 LUID SourceIdentifier
;
675 } TOKEN_SOURCE
,*PTOKEN_SOURCE
;
676 typedef struct _TOKEN_CONTROL
{
678 LUID AuthenticationId
;
680 TOKEN_SOURCE TokenSource
;
681 } TOKEN_CONTROL
,*PTOKEN_CONTROL
;
682 typedef struct _TOKEN_DEFAULT_DACL
{
684 } TOKEN_DEFAULT_DACL
,*PTOKEN_DEFAULT_DACL
;
685 typedef struct _TOKEN_GROUPS
{
687 SID_AND_ATTRIBUTES Groups
[ANYSIZE_ARRAY
];
688 } TOKEN_GROUPS
,*PTOKEN_GROUPS
,*LPTOKEN_GROUPS
;
689 typedef struct _TOKEN_GROUPS_AND_PRIVILEGES
{
692 PSID_AND_ATTRIBUTES Sids
;
693 ULONG RestrictedSidCount
;
694 ULONG RestrictedSidLength
;
695 PSID_AND_ATTRIBUTES RestrictedSids
;
696 ULONG PrivilegeCount
;
697 ULONG PrivilegeLength
;
698 PLUID_AND_ATTRIBUTES Privileges
;
699 LUID AuthenticationId
;
700 } TOKEN_GROUPS_AND_PRIVILEGES
, *PTOKEN_GROUPS_AND_PRIVILEGES
;
701 typedef struct _TOKEN_ORIGIN
{
702 LUID OriginatingLogonSession
;
703 } TOKEN_ORIGIN
, *PTOKEN_ORIGIN
;
704 typedef struct _TOKEN_OWNER
{
706 } TOKEN_OWNER
,*PTOKEN_OWNER
;
707 typedef struct _TOKEN_PRIMARY_GROUP
{
709 } TOKEN_PRIMARY_GROUP
,*PTOKEN_PRIMARY_GROUP
;
710 typedef struct _TOKEN_PRIVILEGES
{
711 DWORD PrivilegeCount
;
712 LUID_AND_ATTRIBUTES Privileges
[ANYSIZE_ARRAY
];
713 } TOKEN_PRIVILEGES
,*PTOKEN_PRIVILEGES
,*LPTOKEN_PRIVILEGES
;
714 typedef enum tagTOKEN_TYPE
{
717 } TOKEN_TYPE
,*PTOKEN_TYPE
;
718 typedef struct _TOKEN_STATISTICS
{
720 LUID AuthenticationId
;
721 LARGE_INTEGER ExpirationTime
;
722 TOKEN_TYPE TokenType
;
723 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
;
724 DWORD DynamicCharged
;
725 DWORD DynamicAvailable
;
727 DWORD PrivilegeCount
;
729 } TOKEN_STATISTICS
, *PTOKEN_STATISTICS
;
730 typedef struct _TOKEN_USER
{
731 SID_AND_ATTRIBUTES User
;
732 } TOKEN_USER
, *PTOKEN_USER
;
733 typedef DWORD SECURITY_INFORMATION
,*PSECURITY_INFORMATION
;
734 typedef WORD SECURITY_DESCRIPTOR_CONTROL
,*PSECURITY_DESCRIPTOR_CONTROL
;
735 typedef struct _SECURITY_DESCRIPTOR
{
738 SECURITY_DESCRIPTOR_CONTROL Control
;
743 } SECURITY_DESCRIPTOR
, *PISECURITY_DESCRIPTOR
;
744 typedef struct _SECURITY_DESCRIPTOR_RELATIVE
{
747 SECURITY_DESCRIPTOR_CONTROL Control
;
752 } SECURITY_DESCRIPTOR_RELATIVE
, *PISECURITY_DESCRIPTOR_RELATIVE
;
753 typedef enum _TOKEN_INFORMATION_CLASS
{
754 TokenUser
=1,TokenGroups
,TokenPrivileges
,TokenOwner
,
755 TokenPrimaryGroup
,TokenDefaultDacl
,TokenSource
,TokenType
,
756 TokenImpersonationLevel
,TokenStatistics
,TokenRestrictedSids
,
757 TokenSessionId
,TokenGroupsAndPrivileges
,TokenSessionReference
,
758 TokenSandBoxInert
,TokenAuditPolicy
,TokenOrigin
,
759 } TOKEN_INFORMATION_CLASS
;
761 #define SYMLINK_FLAG_RELATIVE 1
763 typedef struct _REPARSE_DATA_BUFFER
{
765 USHORT ReparseDataLength
;
769 USHORT SubstituteNameOffset
;
770 USHORT SubstituteNameLength
;
771 USHORT PrintNameOffset
;
772 USHORT PrintNameLength
;
775 } SymbolicLinkReparseBuffer
;
777 USHORT SubstituteNameOffset
;
778 USHORT SubstituteNameLength
;
779 USHORT PrintNameOffset
;
780 USHORT PrintNameLength
;
782 } MountPointReparseBuffer
;
785 } GenericReparseBuffer
;
787 } REPARSE_DATA_BUFFER
, *PREPARSE_DATA_BUFFER
;
789 #define REPARSE_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(REPARSE_DATA_BUFFER, GenericReparseBuffer)
791 typedef struct _FILE_ACCESS_INFORMATION
{
792 ACCESS_MASK AccessFlags
;
793 } FILE_ACCESS_INFORMATION
, *PFILE_ACCESS_INFORMATION
;
795 typedef struct _FILE_ALLOCATION_INFORMATION
{
796 LARGE_INTEGER AllocationSize
;
797 } FILE_ALLOCATION_INFORMATION
, *PFILE_ALLOCATION_INFORMATION
;
799 typedef struct _FILE_BOTH_DIR_INFORMATION
{
800 ULONG NextEntryOffset
;
802 LARGE_INTEGER CreationTime
;
803 LARGE_INTEGER LastAccessTime
;
804 LARGE_INTEGER LastWriteTime
;
805 LARGE_INTEGER ChangeTime
;
806 LARGE_INTEGER EndOfFile
;
807 LARGE_INTEGER AllocationSize
;
808 ULONG FileAttributes
;
809 ULONG FileNameLength
;
811 CCHAR ShortNameLength
;
814 } FILE_BOTH_DIR_INFORMATION
, *PFILE_BOTH_DIR_INFORMATION
;
816 typedef struct _FILE_COMPLETION_INFORMATION
{
819 } FILE_COMPLETION_INFORMATION
, *PFILE_COMPLETION_INFORMATION
;
821 typedef struct _FILE_COMPRESSION_INFORMATION
{
822 LARGE_INTEGER CompressedFileSize
;
823 USHORT CompressionFormat
;
824 UCHAR CompressionUnitShift
;
828 } FILE_COMPRESSION_INFORMATION
, *PFILE_COMPRESSION_INFORMATION
;
830 typedef struct _FILE_COPY_ON_WRITE_INFORMATION
{
831 BOOLEAN ReplaceIfExists
;
832 HANDLE RootDirectory
;
833 ULONG FileNameLength
;
835 } FILE_COPY_ON_WRITE_INFORMATION
, *PFILE_COPY_ON_WRITE_INFORMATION
;
837 typedef struct _FILE_DIRECTORY_INFORMATION
{
838 ULONG NextEntryOffset
;
840 LARGE_INTEGER CreationTime
;
841 LARGE_INTEGER LastAccessTime
;
842 LARGE_INTEGER LastWriteTime
;
843 LARGE_INTEGER ChangeTime
;
844 LARGE_INTEGER EndOfFile
;
845 LARGE_INTEGER AllocationSize
;
846 ULONG FileAttributes
;
847 ULONG FileNameLength
;
849 } FILE_DIRECTORY_INFORMATION
, *PFILE_DIRECTORY_INFORMATION
;
851 typedef struct _FILE_FULL_DIRECTORY_INFORMATION
{
852 ULONG NextEntryOffset
;
854 LARGE_INTEGER CreationTime
;
855 LARGE_INTEGER LastAccessTime
;
856 LARGE_INTEGER LastWriteTime
;
857 LARGE_INTEGER ChangeTime
;
858 LARGE_INTEGER EndOfFile
;
859 LARGE_INTEGER AllocationSize
;
860 ULONG FileAttributes
;
861 ULONG FileNameLength
;
864 } FILE_FULL_DIRECTORY_INFORMATION
, *PFILE_FULL_DIRECTORY_INFORMATION
;
866 typedef struct _FILE_BOTH_DIRECTORY_INFORMATION
{
867 ULONG NextEntryOffset
;
869 LARGE_INTEGER CreationTime
;
870 LARGE_INTEGER LastAccessTime
;
871 LARGE_INTEGER LastWriteTime
;
872 LARGE_INTEGER ChangeTime
;
873 LARGE_INTEGER EndOfFile
;
874 LARGE_INTEGER AllocationSize
;
875 ULONG FileAttributes
;
876 ULONG FileNameLength
;
878 CHAR ShortNameLength
;
881 } FILE_BOTH_DIRECTORY_INFORMATION
, *PFILE_BOTH_DIRECTORY_INFORMATION
;
883 typedef struct _FILE_EA_INFORMATION
{
885 } FILE_EA_INFORMATION
, *PFILE_EA_INFORMATION
;
887 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
{
888 ULONG FileSystemAttributes
;
889 ULONG MaximumComponentNameLength
;
890 ULONG FileSystemNameLength
;
891 WCHAR FileSystemName
[1];
892 } FILE_FS_ATTRIBUTE_INFORMATION
, *PFILE_FS_ATTRIBUTE_INFORMATION
;
894 typedef struct _FILE_FS_CONTROL_INFORMATION
{
895 LARGE_INTEGER FreeSpaceStartFiltering
;
896 LARGE_INTEGER FreeSpaceThreshold
;
897 LARGE_INTEGER FreeSpaceStopFiltering
;
898 LARGE_INTEGER DefaultQuotaThreshold
;
899 LARGE_INTEGER DefaultQuotaLimit
;
900 ULONG FileSystemControlFlags
;
901 } FILE_FS_CONTROL_INFORMATION
, *PFILE_FS_CONTROL_INFORMATION
;
903 typedef struct _FILE_FS_FULL_SIZE_INFORMATION
{
904 LARGE_INTEGER TotalAllocationUnits
;
905 LARGE_INTEGER CallerAvailableAllocationUnits
;
906 LARGE_INTEGER ActualAvailableAllocationUnits
;
907 ULONG SectorsPerAllocationUnit
;
908 ULONG BytesPerSector
;
909 } FILE_FS_FULL_SIZE_INFORMATION
, *PFILE_FS_FULL_SIZE_INFORMATION
;
911 typedef struct _FILE_FS_LABEL_INFORMATION
{
912 ULONG VolumeLabelLength
;
913 WCHAR VolumeLabel
[1];
914 } FILE_FS_LABEL_INFORMATION
, *PFILE_FS_LABEL_INFORMATION
;
916 #if (VER_PRODUCTBUILD >= 2195)
918 typedef struct _FILE_FS_OBJECT_ID_INFORMATION
{
920 UCHAR ExtendedInfo
[48];
921 } FILE_FS_OBJECT_ID_INFORMATION
, *PFILE_FS_OBJECT_ID_INFORMATION
;
923 #endif /* (VER_PRODUCTBUILD >= 2195) */
925 typedef struct _FILE_FS_SIZE_INFORMATION
{
926 LARGE_INTEGER TotalAllocationUnits
;
927 LARGE_INTEGER AvailableAllocationUnits
;
928 ULONG SectorsPerAllocationUnit
;
929 ULONG BytesPerSector
;
930 } FILE_FS_SIZE_INFORMATION
, *PFILE_FS_SIZE_INFORMATION
;
932 typedef struct _FILE_FS_VOLUME_INFORMATION
{
933 LARGE_INTEGER VolumeCreationTime
;
934 ULONG VolumeSerialNumber
;
935 ULONG VolumeLabelLength
;
936 BOOLEAN SupportsObjects
;
937 WCHAR VolumeLabel
[1];
938 } FILE_FS_VOLUME_INFORMATION
, *PFILE_FS_VOLUME_INFORMATION
;
940 typedef struct _FILE_FS_OBJECTID_INFORMATION
943 UCHAR ExtendedInfo
[48];
944 } FILE_FS_OBJECTID_INFORMATION
, *PFILE_FS_OBJECTID_INFORMATION
;
946 typedef struct _FILE_FS_DRIVER_PATH_INFORMATION
948 BOOLEAN DriverInPath
;
949 ULONG DriverNameLength
;
951 } FILE_FS_DRIVER_PATH_INFORMATION
, *PFILE_FS_DRIVER_PATH_INFORMATION
;
953 typedef struct _FILE_FULL_DIR_INFORMATION
{
954 ULONG NextEntryOffset
;
956 LARGE_INTEGER CreationTime
;
957 LARGE_INTEGER LastAccessTime
;
958 LARGE_INTEGER LastWriteTime
;
959 LARGE_INTEGER ChangeTime
;
960 LARGE_INTEGER EndOfFile
;
961 LARGE_INTEGER AllocationSize
;
962 ULONG FileAttributes
;
963 ULONG FileNameLength
;
966 } FILE_FULL_DIR_INFORMATION
, *PFILE_FULL_DIR_INFORMATION
;
968 typedef struct _FILE_GET_EA_INFORMATION
{
969 ULONG NextEntryOffset
;
972 } FILE_GET_EA_INFORMATION
, *PFILE_GET_EA_INFORMATION
;
974 typedef struct _FILE_GET_QUOTA_INFORMATION
{
975 ULONG NextEntryOffset
;
978 } FILE_GET_QUOTA_INFORMATION
, *PFILE_GET_QUOTA_INFORMATION
;
980 typedef struct _FILE_QUOTA_INFORMATION
982 ULONG NextEntryOffset
;
984 LARGE_INTEGER ChangeTime
;
985 LARGE_INTEGER QuotaUsed
;
986 LARGE_INTEGER QuotaThreshold
;
987 LARGE_INTEGER QuotaLimit
;
989 } FILE_QUOTA_INFORMATION
, *PFILE_QUOTA_INFORMATION
;
991 typedef struct _FILE_INTERNAL_INFORMATION
{
992 LARGE_INTEGER IndexNumber
;
993 } FILE_INTERNAL_INFORMATION
, *PFILE_INTERNAL_INFORMATION
;
995 typedef struct _FILE_LINK_INFORMATION
{
996 BOOLEAN ReplaceIfExists
;
997 HANDLE RootDirectory
;
998 ULONG FileNameLength
;
1000 } FILE_LINK_INFORMATION
, *PFILE_LINK_INFORMATION
;
1002 typedef struct _FILE_LOCK_INFO
1004 LARGE_INTEGER StartingByte
;
1005 LARGE_INTEGER Length
;
1006 BOOLEAN ExclusiveLock
;
1008 PFILE_OBJECT FileObject
;
1010 LARGE_INTEGER EndingByte
;
1011 } FILE_LOCK_INFO
, *PFILE_LOCK_INFO
;
1013 typedef struct _FILE_REPARSE_POINT_INFORMATION
1015 LONGLONG FileReference
;
1017 } FILE_REPARSE_POINT_INFORMATION
, *PFILE_REPARSE_POINT_INFORMATION
;
1019 typedef struct _FILE_MOVE_CLUSTER_INFORMATION
1022 HANDLE RootDirectory
;
1023 ULONG FileNameLength
;
1025 } FILE_MOVE_CLUSTER_INFORMATION
, *PFILE_MOVE_CLUSTER_INFORMATION
;
1027 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
1028 typedef struct _FILE_SHARED_LOCK_ENTRY
{
1031 FILE_LOCK_INFO FileLock
;
1032 } FILE_SHARED_LOCK_ENTRY
, *PFILE_SHARED_LOCK_ENTRY
;
1034 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
1035 typedef struct _FILE_EXCLUSIVE_LOCK_ENTRY
{
1036 LIST_ENTRY ListEntry
;
1039 FILE_LOCK_INFO FileLock
;
1040 } FILE_EXCLUSIVE_LOCK_ENTRY
, *PFILE_EXCLUSIVE_LOCK_ENTRY
;
1042 typedef NTSTATUS (*PCOMPLETE_LOCK_IRP_ROUTINE
) (
1047 typedef VOID (NTAPI
*PUNLOCK_ROUTINE
) (
1049 IN PFILE_LOCK_INFO FileLockInfo
1052 typedef struct _FILE_LOCK
{
1053 PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine
;
1054 PUNLOCK_ROUTINE UnlockRoutine
;
1055 BOOLEAN FastIoIsQuestionable
;
1057 PVOID LockInformation
;
1058 FILE_LOCK_INFO LastReturnedLockInfo
;
1059 PVOID LastReturnedLock
;
1060 } FILE_LOCK
, *PFILE_LOCK
;
1062 typedef struct _FILE_MAILSLOT_PEEK_BUFFER
{
1063 ULONG ReadDataAvailable
;
1064 ULONG NumberOfMessages
;
1065 ULONG MessageLength
;
1066 } FILE_MAILSLOT_PEEK_BUFFER
, *PFILE_MAILSLOT_PEEK_BUFFER
;
1068 typedef struct _FILE_MAILSLOT_QUERY_INFORMATION
{
1069 ULONG MaximumMessageSize
;
1070 ULONG MailslotQuota
;
1071 ULONG NextMessageSize
;
1072 ULONG MessagesAvailable
;
1073 LARGE_INTEGER ReadTimeout
;
1074 } FILE_MAILSLOT_QUERY_INFORMATION
, *PFILE_MAILSLOT_QUERY_INFORMATION
;
1076 typedef struct _FILE_MAILSLOT_SET_INFORMATION
{
1077 PLARGE_INTEGER ReadTimeout
;
1078 } FILE_MAILSLOT_SET_INFORMATION
, *PFILE_MAILSLOT_SET_INFORMATION
;
1080 typedef struct _FILE_MODE_INFORMATION
{
1082 } FILE_MODE_INFORMATION
, *PFILE_MODE_INFORMATION
;
1084 typedef struct _FILE_ALL_INFORMATION
{
1085 FILE_BASIC_INFORMATION BasicInformation
;
1086 FILE_STANDARD_INFORMATION StandardInformation
;
1087 FILE_INTERNAL_INFORMATION InternalInformation
;
1088 FILE_EA_INFORMATION EaInformation
;
1089 FILE_ACCESS_INFORMATION AccessInformation
;
1090 FILE_POSITION_INFORMATION PositionInformation
;
1091 FILE_MODE_INFORMATION ModeInformation
;
1092 FILE_ALIGNMENT_INFORMATION AlignmentInformation
;
1093 FILE_NAME_INFORMATION NameInformation
;
1094 } FILE_ALL_INFORMATION
, *PFILE_ALL_INFORMATION
;
1096 typedef struct _FILE_NAMES_INFORMATION
{
1097 ULONG NextEntryOffset
;
1099 ULONG FileNameLength
;
1101 } FILE_NAMES_INFORMATION
, *PFILE_NAMES_INFORMATION
;
1103 typedef struct _FILE_OBJECTID_INFORMATION
{
1104 LONGLONG FileReference
;
1106 _ANONYMOUS_UNION
union {
1108 UCHAR BirthVolumeId
[16];
1109 UCHAR BirthObjectId
[16];
1112 UCHAR ExtendedInfo
[48];
1114 } FILE_OBJECTID_INFORMATION
, *PFILE_OBJECTID_INFORMATION
;
1116 typedef struct _FILE_OLE_CLASSID_INFORMATION
{
1118 } FILE_OLE_CLASSID_INFORMATION
, *PFILE_OLE_CLASSID_INFORMATION
;
1120 typedef struct _FILE_OLE_ALL_INFORMATION
{
1121 FILE_BASIC_INFORMATION BasicInformation
;
1122 FILE_STANDARD_INFORMATION StandardInformation
;
1123 FILE_INTERNAL_INFORMATION InternalInformation
;
1124 FILE_EA_INFORMATION EaInformation
;
1125 FILE_ACCESS_INFORMATION AccessInformation
;
1126 FILE_POSITION_INFORMATION PositionInformation
;
1127 FILE_MODE_INFORMATION ModeInformation
;
1128 FILE_ALIGNMENT_INFORMATION AlignmentInformation
;
1131 LARGE_INTEGER SecurityChangeTime
;
1132 FILE_OLE_CLASSID_INFORMATION OleClassIdInformation
;
1133 FILE_OBJECTID_INFORMATION ObjectIdInformation
;
1134 FILE_STORAGE_TYPE StorageType
;
1137 ULONG NumberOfStreamReferences
;
1140 BOOLEAN ContentIndexDisable
;
1141 BOOLEAN InheritContentIndexDisable
;
1142 FILE_NAME_INFORMATION NameInformation
;
1143 } FILE_OLE_ALL_INFORMATION
, *PFILE_OLE_ALL_INFORMATION
;
1145 typedef struct _FILE_OLE_DIR_INFORMATION
{
1146 ULONG NextEntryOffset
;
1148 LARGE_INTEGER CreationTime
;
1149 LARGE_INTEGER LastAccessTime
;
1150 LARGE_INTEGER LastWriteTime
;
1151 LARGE_INTEGER ChangeTime
;
1152 LARGE_INTEGER EndOfFile
;
1153 LARGE_INTEGER AllocationSize
;
1154 ULONG FileAttributes
;
1155 ULONG FileNameLength
;
1156 FILE_STORAGE_TYPE StorageType
;
1159 BOOLEAN ContentIndexDisable
;
1160 BOOLEAN InheritContentIndexDisable
;
1162 } FILE_OLE_DIR_INFORMATION
, *PFILE_OLE_DIR_INFORMATION
;
1164 typedef struct _FILE_OLE_INFORMATION
{
1165 LARGE_INTEGER SecurityChangeTime
;
1166 FILE_OLE_CLASSID_INFORMATION OleClassIdInformation
;
1167 FILE_OBJECTID_INFORMATION ObjectIdInformation
;
1168 FILE_STORAGE_TYPE StorageType
;
1170 BOOLEAN ContentIndexDisable
;
1171 BOOLEAN InheritContentIndexDisable
;
1172 } FILE_OLE_INFORMATION
, *PFILE_OLE_INFORMATION
;
1174 typedef struct _FILE_OLE_STATE_BITS_INFORMATION
{
1176 ULONG StateBitsMask
;
1177 } FILE_OLE_STATE_BITS_INFORMATION
, *PFILE_OLE_STATE_BITS_INFORMATION
;
1179 typedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER
{
1182 } FILE_PIPE_ASSIGN_EVENT_BUFFER
, *PFILE_PIPE_ASSIGN_EVENT_BUFFER
;
1184 typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER
{
1185 PVOID ClientSession
;
1186 PVOID ClientProcess
;
1187 } FILE_PIPE_CLIENT_PROCESS_BUFFER
, *PFILE_PIPE_CLIENT_PROCESS_BUFFER
;
1189 typedef struct _FILE_PIPE_EVENT_BUFFER
{
1190 ULONG NamedPipeState
;
1194 ULONG NumberRequests
;
1195 } FILE_PIPE_EVENT_BUFFER
, *PFILE_PIPE_EVENT_BUFFER
;
1197 typedef struct _FILE_PIPE_PEEK_BUFFER
1199 ULONG NamedPipeState
;
1200 ULONG ReadDataAvailable
;
1201 ULONG NumberOfMessages
;
1202 ULONG MessageLength
;
1204 } FILE_PIPE_PEEK_BUFFER
, *PFILE_PIPE_PEEK_BUFFER
;
1206 typedef struct _FILE_PIPE_INFORMATION
{
1208 ULONG CompletionMode
;
1209 } FILE_PIPE_INFORMATION
, *PFILE_PIPE_INFORMATION
;
1211 typedef struct _FILE_PIPE_LOCAL_INFORMATION
{
1212 ULONG NamedPipeType
;
1213 ULONG NamedPipeConfiguration
;
1214 ULONG MaximumInstances
;
1215 ULONG CurrentInstances
;
1217 ULONG ReadDataAvailable
;
1218 ULONG OutboundQuota
;
1219 ULONG WriteQuotaAvailable
;
1220 ULONG NamedPipeState
;
1222 } FILE_PIPE_LOCAL_INFORMATION
, *PFILE_PIPE_LOCAL_INFORMATION
;
1224 typedef struct _FILE_PIPE_REMOTE_INFORMATION
{
1225 LARGE_INTEGER CollectDataTime
;
1226 ULONG MaximumCollectionCount
;
1227 } FILE_PIPE_REMOTE_INFORMATION
, *PFILE_PIPE_REMOTE_INFORMATION
;
1229 typedef struct _FILE_PIPE_WAIT_FOR_BUFFER
{
1230 LARGE_INTEGER Timeout
;
1232 BOOLEAN TimeoutSpecified
;
1234 } FILE_PIPE_WAIT_FOR_BUFFER
, *PFILE_PIPE_WAIT_FOR_BUFFER
;
1236 typedef struct _FILE_RENAME_INFORMATION
{
1237 BOOLEAN ReplaceIfExists
;
1238 HANDLE RootDirectory
;
1239 ULONG FileNameLength
;
1241 } FILE_RENAME_INFORMATION
, *PFILE_RENAME_INFORMATION
;
1243 typedef struct _FILE_STREAM_INFORMATION
{
1244 ULONG NextEntryOffset
;
1245 ULONG StreamNameLength
;
1246 LARGE_INTEGER StreamSize
;
1247 LARGE_INTEGER StreamAllocationSize
;
1248 WCHAR StreamName
[1];
1249 } FILE_STREAM_INFORMATION
, *PFILE_STREAM_INFORMATION
;
1251 typedef struct _FILE_TRACKING_INFORMATION
{
1252 HANDLE DestinationFile
;
1253 ULONG ObjectInformationLength
;
1254 CHAR ObjectInformation
[1];
1255 } FILE_TRACKING_INFORMATION
, *PFILE_TRACKING_INFORMATION
;
1257 #if (VER_PRODUCTBUILD >= 2195)
1258 typedef struct _FILE_ZERO_DATA_INFORMATION
{
1259 LARGE_INTEGER FileOffset
;
1260 LARGE_INTEGER BeyondFinalZero
;
1261 } FILE_ZERO_DATA_INFORMATION
, *PFILE_ZERO_DATA_INFORMATION
;
1263 typedef struct FILE_ALLOCATED_RANGE_BUFFER
{
1264 LARGE_INTEGER FileOffset
;
1265 LARGE_INTEGER Length
;
1266 } FILE_ALLOCATED_RANGE_BUFFER
, *PFILE_ALLOCATED_RANGE_BUFFER
;
1267 #endif /* (VER_PRODUCTBUILD >= 2195) */
1269 typedef struct _FSRTL_COMMON_FCB_HEADER
{
1270 CSHORT NodeTypeCode
;
1271 CSHORT NodeByteSize
;
1273 UCHAR IsFastIoPossible
;
1274 #if (VER_PRODUCTBUILD >= 1381)
1277 #endif /* (VER_PRODUCTBUILD >= 1381) */
1278 PERESOURCE Resource
;
1279 PERESOURCE PagingIoResource
;
1280 LARGE_INTEGER AllocationSize
;
1281 LARGE_INTEGER FileSize
;
1282 LARGE_INTEGER ValidDataLength
;
1283 } FSRTL_COMMON_FCB_HEADER
, *PFSRTL_COMMON_FCB_HEADER
;
1285 #if (VER_PRODUCTBUILD >= 2600)
1287 typedef struct _FSRTL_ADVANCED_FCB_HEADER
{
1288 CSHORT NodeTypeCode
;
1289 CSHORT NodeByteSize
;
1291 UCHAR IsFastIoPossible
;
1294 PERESOURCE Resource
;
1295 PERESOURCE PagingIoResource
;
1296 LARGE_INTEGER AllocationSize
;
1297 LARGE_INTEGER FileSize
;
1298 LARGE_INTEGER ValidDataLength
;
1299 PFAST_MUTEX FastMutex
;
1300 LIST_ENTRY FilterContexts
;
1301 } FSRTL_ADVANCED_FCB_HEADER
, *PFSRTL_ADVANCED_FCB_HEADER
;
1303 typedef struct _FSRTL_PER_STREAM_CONTEXT
{
1307 PFREE_FUNCTION FreeCallback
;
1308 } FSRTL_PER_STREAM_CONTEXT
, *PFSRTL_PER_STREAM_CONTEXT
;
1310 typedef struct _FSRTL_PER_FILEOBJECT_CONTEXT
1315 } FSRTL_PER_FILEOBJECT_CONTEXT
, *PFSRTL_PER_FILEOBJECT_CONTEXT
;
1317 #endif /* (VER_PRODUCTBUILD >= 2600) */
1319 typedef struct _BASE_MCB
1321 ULONG MaximumPairCount
;
1326 } BASE_MCB
, *PBASE_MCB
;
1328 typedef struct _LARGE_MCB
1330 PKGUARDED_MUTEX GuardedMutex
;
1332 } LARGE_MCB
, *PLARGE_MCB
;
1336 LARGE_MCB DummyFieldThatSizesThisStructureCorrectly
;
1339 typedef struct _GENERATE_NAME_CONTEXT
{
1341 BOOLEAN CheckSumInserted
;
1343 WCHAR NameBuffer
[8];
1344 ULONG ExtensionLength
;
1345 WCHAR ExtensionBuffer
[4];
1346 ULONG LastIndexValue
;
1347 } GENERATE_NAME_CONTEXT
, *PGENERATE_NAME_CONTEXT
;
1349 typedef struct _MAPPING_PAIR
{
1352 } MAPPING_PAIR
, *PMAPPING_PAIR
;
1354 typedef struct _GET_RETRIEVAL_DESCRIPTOR
{
1355 ULONG NumberOfPairs
;
1357 MAPPING_PAIR Pair
[1];
1358 } GET_RETRIEVAL_DESCRIPTOR
, *PGET_RETRIEVAL_DESCRIPTOR
;
1360 typedef struct _KQUEUE
{
1361 DISPATCHER_HEADER Header
;
1362 LIST_ENTRY EntryListHead
;
1365 LIST_ENTRY ThreadListHead
;
1366 } KQUEUE
, *PKQUEUE
, *RESTRICTED_POINTER PRKQUEUE
;
1368 #define ASSERT_QUEUE(Q) ASSERT(((Q)->Header.Type & KOBJECT_TYPE_MASK) == QueueObject);
1370 typedef struct _MBCB
{
1371 CSHORT NodeTypeCode
;
1372 CSHORT NodeIsInZone
;
1376 LIST_ENTRY BitmapRanges
;
1377 LONGLONG ResumeWritePage
;
1378 BITMAP_RANGE BitmapRange1
;
1379 BITMAP_RANGE BitmapRange2
;
1380 BITMAP_RANGE BitmapRange3
;
1383 typedef struct _MOVEFILE_DESCRIPTOR
{
1386 LARGE_INTEGER StartVcn
;
1387 LARGE_INTEGER TargetLcn
;
1390 } MOVEFILE_DESCRIPTOR
, *PMOVEFILE_DESCRIPTOR
;
1392 typedef struct _OBJECT_BASIC_INFO
{
1394 ACCESS_MASK GrantedAccess
;
1396 ULONG ReferenceCount
;
1397 ULONG PagedPoolUsage
;
1398 ULONG NonPagedPoolUsage
;
1400 ULONG NameInformationLength
;
1401 ULONG TypeInformationLength
;
1402 ULONG SecurityDescriptorLength
;
1403 LARGE_INTEGER CreateTime
;
1404 } OBJECT_BASIC_INFO
, *POBJECT_BASIC_INFO
;
1406 typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFO
{
1408 BOOLEAN ProtectFromClose
;
1409 } OBJECT_HANDLE_ATTRIBUTE_INFO
, *POBJECT_HANDLE_ATTRIBUTE_INFO
;
1411 typedef struct _OBJECT_NAME_INFO
{
1412 UNICODE_STRING ObjectName
;
1413 WCHAR ObjectNameBuffer
[1];
1414 } OBJECT_NAME_INFO
, *POBJECT_NAME_INFO
;
1416 typedef struct _OBJECT_PROTECTION_INFO
{
1418 BOOLEAN ProtectHandle
;
1419 } OBJECT_PROTECTION_INFO
, *POBJECT_PROTECTION_INFO
;
1421 typedef struct _OBJECT_TYPE_INFO
{
1422 UNICODE_STRING ObjectTypeName
;
1423 UCHAR Unknown
[0x58];
1424 WCHAR ObjectTypeNameBuffer
[1];
1425 } OBJECT_TYPE_INFO
, *POBJECT_TYPE_INFO
;
1427 typedef struct _OBJECT_ALL_TYPES_INFO
{
1428 ULONG NumberOfObjectTypes
;
1429 OBJECT_TYPE_INFO ObjectsTypeInfo
[1];
1430 } OBJECT_ALL_TYPES_INFO
, *POBJECT_ALL_TYPES_INFO
;
1433 typedef struct _PATHNAME_BUFFER
{
1434 ULONG PathNameLength
;
1436 } PATHNAME_BUFFER
, *PPATHNAME_BUFFER
;
1438 typedef enum _RTL_GENERIC_COMPARE_RESULTS
1443 } RTL_GENERIC_COMPARE_RESULTS
;
1445 typedef enum _TABLE_SEARCH_RESULT
1451 } TABLE_SEARCH_RESULT
;
1454 (NTAPI
*PRTL_AVL_MATCH_FUNCTION
)(
1455 struct _RTL_AVL_TABLE
*Table
,
1460 typedef RTL_GENERIC_COMPARE_RESULTS
1461 (NTAPI
*PRTL_AVL_COMPARE_ROUTINE
) (
1462 struct _RTL_AVL_TABLE
*Table
,
1467 typedef RTL_GENERIC_COMPARE_RESULTS
1468 (NTAPI
*PRTL_GENERIC_COMPARE_ROUTINE
) (
1469 struct _RTL_GENERIC_TABLE
*Table
,
1475 (NTAPI
*PRTL_GENERIC_ALLOCATE_ROUTINE
) (
1476 struct _RTL_GENERIC_TABLE
*Table
,
1481 (NTAPI
*PRTL_GENERIC_FREE_ROUTINE
) (
1482 struct _RTL_GENERIC_TABLE
*Table
,
1487 (NTAPI
*PRTL_AVL_ALLOCATE_ROUTINE
) (
1488 struct _RTL_AVL_TABLE
*Table
,
1493 (NTAPI
*PRTL_AVL_FREE_ROUTINE
) (
1494 struct _RTL_AVL_TABLE
*Table
,
1498 typedef struct _PUBLIC_BCB
{
1499 CSHORT NodeTypeCode
;
1500 CSHORT NodeByteSize
;
1502 LARGE_INTEGER MappedFileOffset
;
1503 } PUBLIC_BCB
, *PPUBLIC_BCB
;
1505 typedef struct _QUERY_PATH_REQUEST
{
1506 ULONG PathNameLength
;
1507 PIO_SECURITY_CONTEXT SecurityContext
;
1508 WCHAR FilePathName
[1];
1509 } QUERY_PATH_REQUEST
, *PQUERY_PATH_REQUEST
;
1511 typedef struct _QUERY_PATH_RESPONSE
{
1512 ULONG LengthAccepted
;
1513 } QUERY_PATH_RESPONSE
, *PQUERY_PATH_RESPONSE
;
1515 typedef struct _RETRIEVAL_POINTERS_BUFFER
{
1517 LARGE_INTEGER StartingVcn
;
1519 LARGE_INTEGER NextVcn
;
1522 } RETRIEVAL_POINTERS_BUFFER
, *PRETRIEVAL_POINTERS_BUFFER
;
1524 typedef struct _RTL_SPLAY_LINKS
{
1525 struct _RTL_SPLAY_LINKS
*Parent
;
1526 struct _RTL_SPLAY_LINKS
*LeftChild
;
1527 struct _RTL_SPLAY_LINKS
*RightChild
;
1528 } RTL_SPLAY_LINKS
, *PRTL_SPLAY_LINKS
;
1530 typedef struct _RTL_BALANCED_LINKS
1532 struct _RTL_BALANCED_LINKS
*Parent
;
1533 struct _RTL_BALANCED_LINKS
*LeftChild
;
1534 struct _RTL_BALANCED_LINKS
*RightChild
;
1537 } RTL_BALANCED_LINKS
, *PRTL_BALANCED_LINKS
;
1539 typedef struct _RTL_GENERIC_TABLE
1541 PRTL_SPLAY_LINKS TableRoot
;
1542 LIST_ENTRY InsertOrderList
;
1543 PLIST_ENTRY OrderedPointer
;
1544 ULONG WhichOrderedElement
;
1545 ULONG NumberGenericTableElements
;
1546 PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine
;
1547 PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine
;
1548 PRTL_GENERIC_FREE_ROUTINE FreeRoutine
;
1550 } RTL_GENERIC_TABLE
, *PRTL_GENERIC_TABLE
;
1552 typedef struct _RTL_AVL_TABLE
1554 RTL_BALANCED_LINKS BalancedRoot
;
1555 PVOID OrderedPointer
;
1556 ULONG WhichOrderedElement
;
1557 ULONG NumberGenericTableElements
;
1559 PRTL_BALANCED_LINKS RestartKey
;
1561 PRTL_AVL_COMPARE_ROUTINE CompareRoutine
;
1562 PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine
;
1563 PRTL_AVL_FREE_ROUTINE FreeRoutine
;
1565 } RTL_AVL_TABLE
, *PRTL_AVL_TABLE
;
1570 RtlInitializeGenericTableAvl(
1571 PRTL_AVL_TABLE Table
,
1572 PRTL_AVL_COMPARE_ROUTINE CompareRoutine
,
1573 PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine
,
1574 PRTL_AVL_FREE_ROUTINE FreeRoutine
,
1578 #if defined(USE_LPC6432)
1579 #define LPC_CLIENT_ID CLIENT_ID64
1580 #define LPC_SIZE_T ULONGLONG
1581 #define LPC_PVOID ULONGLONG
1582 #define LPC_HANDLE ULONGLONG
1584 #define LPC_CLIENT_ID CLIENT_ID
1585 #define LPC_SIZE_T SIZE_T
1586 #define LPC_PVOID PVOID
1587 #define LPC_HANDLE HANDLE
1590 typedef struct _PORT_MESSAGE
1606 CSHORT DataInfoOffset
;
1612 LPC_CLIENT_ID ClientId
;
1613 double DoNotUseThisField
;
1618 LPC_SIZE_T ClientViewSize
;
1621 } PORT_MESSAGE
, *PPORT_MESSAGE
;
1623 #define LPC_KERNELMODE_MESSAGE (CSHORT)((USHORT)0x8000)
1625 typedef struct _PORT_VIEW
1628 LPC_HANDLE SectionHandle
;
1629 ULONG SectionOffset
;
1630 LPC_SIZE_T ViewSize
;
1632 LPC_PVOID ViewRemoteBase
;
1633 } PORT_VIEW
, *PPORT_VIEW
;
1635 typedef struct _REMOTE_PORT_VIEW
1638 LPC_SIZE_T ViewSize
;
1640 } REMOTE_PORT_VIEW
, *PREMOTE_PORT_VIEW
;
1642 typedef struct _SE_EXPORTS
{
1644 LUID SeCreateTokenPrivilege
;
1645 LUID SeAssignPrimaryTokenPrivilege
;
1646 LUID SeLockMemoryPrivilege
;
1647 LUID SeIncreaseQuotaPrivilege
;
1648 LUID SeUnsolicitedInputPrivilege
;
1649 LUID SeTcbPrivilege
;
1650 LUID SeSecurityPrivilege
;
1651 LUID SeTakeOwnershipPrivilege
;
1652 LUID SeLoadDriverPrivilege
;
1653 LUID SeCreatePagefilePrivilege
;
1654 LUID SeIncreaseBasePriorityPrivilege
;
1655 LUID SeSystemProfilePrivilege
;
1656 LUID SeSystemtimePrivilege
;
1657 LUID SeProfileSingleProcessPrivilege
;
1658 LUID SeCreatePermanentPrivilege
;
1659 LUID SeBackupPrivilege
;
1660 LUID SeRestorePrivilege
;
1661 LUID SeShutdownPrivilege
;
1662 LUID SeDebugPrivilege
;
1663 LUID SeAuditPrivilege
;
1664 LUID SeSystemEnvironmentPrivilege
;
1665 LUID SeChangeNotifyPrivilege
;
1666 LUID SeRemoteShutdownPrivilege
;
1671 PSID SeCreatorOwnerSid
;
1672 PSID SeCreatorGroupSid
;
1674 PSID SeNtAuthoritySid
;
1678 PSID SeInteractiveSid
;
1679 PSID SeLocalSystemSid
;
1680 PSID SeAliasAdminsSid
;
1681 PSID SeAliasUsersSid
;
1682 PSID SeAliasGuestsSid
;
1683 PSID SeAliasPowerUsersSid
;
1684 PSID SeAliasAccountOpsSid
;
1685 PSID SeAliasSystemOpsSid
;
1686 PSID SeAliasPrintOpsSid
;
1687 PSID SeAliasBackupOpsSid
;
1689 PSID SeAuthenticatedUsersSid
;
1691 PSID SeRestrictedSid
;
1692 PSID SeAnonymousLogonSid
;
1694 LUID SeUndockPrivilege
;
1695 LUID SeSyncAgentPrivilege
;
1696 LUID SeEnableDelegationPrivilege
;
1698 } SE_EXPORTS
, *PSE_EXPORTS
;
1702 LARGE_INTEGER StartingLcn
;
1703 } STARTING_LCN_INPUT_BUFFER
, *PSTARTING_LCN_INPUT_BUFFER
;
1705 typedef struct _STARTING_VCN_INPUT_BUFFER
{
1706 LARGE_INTEGER StartingVcn
;
1707 } STARTING_VCN_INPUT_BUFFER
, *PSTARTING_VCN_INPUT_BUFFER
;
1709 typedef struct _SECURITY_CLIENT_CONTEXT
{
1710 SECURITY_QUALITY_OF_SERVICE SecurityQos
;
1711 PACCESS_TOKEN ClientToken
;
1712 BOOLEAN DirectlyAccessClientToken
;
1713 BOOLEAN DirectAccessEffectiveOnly
;
1714 BOOLEAN ServerIsRemote
;
1715 TOKEN_CONTROL ClientTokenControl
;
1716 } SECURITY_CLIENT_CONTEXT
, *PSECURITY_CLIENT_CONTEXT
;
1718 typedef struct _ACE_HEADER
1723 } ACE_HEADER
, *PACE_HEADER
;
1725 typedef struct _TUNNEL
{
1727 PRTL_SPLAY_LINKS Cache
;
1728 LIST_ENTRY TimerQueue
;
1732 typedef struct _VAD_HEADER
{
1735 PVAD_HEADER ParentLink
;
1736 PVAD_HEADER LeftLink
;
1737 PVAD_HEADER RightLink
;
1738 ULONG Flags
; /* LSB = CommitCharge */
1740 PVOID FirstProtoPte
;
1744 } VAD_HEADER
, *PVAD_HEADER
;
1748 LARGE_INTEGER StartingLcn
;
1749 LARGE_INTEGER BitmapSize
;
1751 } VOLUME_BITMAP_BUFFER
, *PVOLUME_BITMAP_BUFFER
;
1753 #if (VER_PRODUCTBUILD >= 2600)
1756 (NTAPI
*PFILTER_REPORT_CHANGE
) (
1757 IN PVOID NotifyContext
,
1758 IN PVOID FilterContext
1761 typedef enum _FS_FILTER_SECTION_SYNC_TYPE
{
1763 SyncTypeCreateSection
1764 } FS_FILTER_SECTION_SYNC_TYPE
, *PFS_FILTER_SECTION_SYNC_TYPE
;
1766 typedef union _FS_FILTER_PARAMETERS
{
1768 PLARGE_INTEGER EndingOffset
;
1769 } AcquireForModifiedPageWriter
;
1772 PERESOURCE ResourceToRelease
;
1773 } ReleaseForModifiedPageWriter
;
1776 FS_FILTER_SECTION_SYNC_TYPE SyncType
;
1777 ULONG PageProtection
;
1778 } AcquireForSectionSynchronization
;
1787 } FS_FILTER_PARAMETERS
, *PFS_FILTER_PARAMETERS
;
1789 typedef struct _FS_FILTER_CALLBACK_DATA
{
1790 ULONG SizeOfFsFilterCallbackData
;
1793 struct _DEVICE_OBJECT
*DeviceObject
;
1794 struct _FILE_OBJECT
*FileObject
;
1795 FS_FILTER_PARAMETERS Parameters
;
1796 } FS_FILTER_CALLBACK_DATA
, *PFS_FILTER_CALLBACK_DATA
;
1799 (NTAPI
*PFS_FILTER_CALLBACK
) (
1800 IN PFS_FILTER_CALLBACK_DATA Data
,
1801 OUT PVOID
*CompletionContext
1805 (NTAPI
*PFS_FILTER_COMPLETION_CALLBACK
) (
1806 IN PFS_FILTER_CALLBACK_DATA Data
,
1807 IN NTSTATUS OperationStatus
,
1808 IN PVOID CompletionContext
1811 typedef struct _FS_FILTER_CALLBACKS
{
1812 ULONG SizeOfFsFilterCallbacks
;
1814 PFS_FILTER_CALLBACK PreAcquireForSectionSynchronization
;
1815 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization
;
1816 PFS_FILTER_CALLBACK PreReleaseForSectionSynchronization
;
1817 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization
;
1818 PFS_FILTER_CALLBACK PreAcquireForCcFlush
;
1819 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush
;
1820 PFS_FILTER_CALLBACK PreReleaseForCcFlush
;
1821 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush
;
1822 PFS_FILTER_CALLBACK PreAcquireForModifiedPageWriter
;
1823 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter
;
1824 PFS_FILTER_CALLBACK PreReleaseForModifiedPageWriter
;
1825 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter
;
1826 } FS_FILTER_CALLBACKS
, *PFS_FILTER_CALLBACKS
;
1828 typedef struct _READ_LIST
{
1829 PFILE_OBJECT FileObject
;
1830 ULONG NumberOfEntries
;
1832 FILE_SEGMENT_ELEMENT List
[ANYSIZE_ARRAY
];
1833 } READ_LIST
, *PREAD_LIST
;
1838 (NTAPI
* PRTL_HEAP_COMMIT_ROUTINE
) (
1840 IN OUT PVOID
*CommitAddress
,
1841 IN OUT PSIZE_T CommitSize
1844 typedef struct _RTL_HEAP_PARAMETERS
{
1846 SIZE_T SegmentReserve
;
1847 SIZE_T SegmentCommit
;
1848 SIZE_T DeCommitFreeBlockThreshold
;
1849 SIZE_T DeCommitTotalFreeThreshold
;
1850 SIZE_T MaximumAllocationSize
;
1851 SIZE_T VirtualMemoryThreshold
;
1852 SIZE_T InitialCommit
;
1853 SIZE_T InitialReserve
;
1854 PRTL_HEAP_COMMIT_ROUTINE CommitRoutine
;
1856 } RTL_HEAP_PARAMETERS
, *PRTL_HEAP_PARAMETERS
;
1862 IN PFILE_OBJECT FileObject
,
1863 IN ULONG BytesToWrite
,
1872 IN PFILE_OBJECT FileObject
,
1873 IN PLARGE_INTEGER FileOffset
,
1877 OUT PIO_STATUS_BLOCK IoStatus
1884 IN PFILE_OBJECT FileObject
,
1885 IN PLARGE_INTEGER FileOffset
,
1891 #define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
1893 typedef VOID (NTAPI
*PCC_POST_DEFERRED_WRITE
) (
1902 IN PFILE_OBJECT FileObject
,
1903 IN PCC_POST_DEFERRED_WRITE PostRoutine
,
1906 IN ULONG BytesToWrite
,
1914 IN PFILE_OBJECT FileObject
,
1915 IN ULONG FileOffset
,
1919 OUT PIO_STATUS_BLOCK IoStatus
1926 IN PFILE_OBJECT FileObject
,
1927 IN ULONG FileOffset
,
1936 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
1937 IN PLARGE_INTEGER FileOffset OPTIONAL
,
1939 OUT PIO_STATUS_BLOCK IoStatus OPTIONAL
1942 typedef VOID (*PDIRTY_PAGE_ROUTINE
) (
1943 IN PFILE_OBJECT FileObject
,
1944 IN PLARGE_INTEGER FileOffset
,
1946 IN PLARGE_INTEGER OldestLsn
,
1947 IN PLARGE_INTEGER NewestLsn
,
1957 IN PDIRTY_PAGE_ROUTINE DirtyPageRoutine
,
1965 CcGetFileObjectFromBcb (
1972 CcGetFileObjectFromSectionPtrs (
1973 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
1976 #define CcGetFileSizePointer(FO) ( \
1977 ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
1980 #if (VER_PRODUCTBUILD >= 2195)
1985 CcGetFlushedValidData (
1986 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
1987 IN BOOLEAN BcbListHeld
1990 #endif /* (VER_PRODUCTBUILD >= 2195) */
1995 CcGetLsnForFileObject (
1996 IN PFILE_OBJECT FileObject
,
1997 OUT PLARGE_INTEGER OldestLsn OPTIONAL
2000 typedef BOOLEAN (NTAPI
*PACQUIRE_FOR_LAZY_WRITE
) (
2005 typedef VOID (NTAPI
*PRELEASE_FROM_LAZY_WRITE
) (
2009 typedef BOOLEAN (NTAPI
*PACQUIRE_FOR_READ_AHEAD
) (
2014 typedef VOID (NTAPI
*PRELEASE_FROM_READ_AHEAD
) (
2018 typedef struct _CACHE_MANAGER_CALLBACKS
{
2019 PACQUIRE_FOR_LAZY_WRITE AcquireForLazyWrite
;
2020 PRELEASE_FROM_LAZY_WRITE ReleaseFromLazyWrite
;
2021 PACQUIRE_FOR_READ_AHEAD AcquireForReadAhead
;
2022 PRELEASE_FROM_READ_AHEAD ReleaseFromReadAhead
;
2023 } CACHE_MANAGER_CALLBACKS
, *PCACHE_MANAGER_CALLBACKS
;
2028 CcInitializeCacheMap (
2029 IN PFILE_OBJECT FileObject
,
2030 IN PCC_FILE_SIZES FileSizes
,
2031 IN BOOLEAN PinAccess
,
2032 IN PCACHE_MANAGER_CALLBACKS Callbacks
,
2033 IN PVOID LazyWriteContext
2036 #define CcIsFileCached(FO) ( \
2037 ((FO)->SectionObjectPointer != NULL) && \
2038 (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
2041 extern ULONG CcFastMdlReadWait
;
2046 CcIsThereDirtyData (
2054 IN PFILE_OBJECT FileObject
,
2055 IN PLARGE_INTEGER FileOffset
,
2066 IN PFILE_OBJECT FileObject
,
2067 IN PLARGE_INTEGER FileOffset
,
2070 OUT PIO_STATUS_BLOCK IoStatus
2077 IN PFILE_OBJECT FileObject
,
2084 CcMdlWriteComplete (
2085 IN PFILE_OBJECT FileObject
,
2086 IN PLARGE_INTEGER FileOffset
,
2096 IN PFILE_OBJECT FileObject
,
2097 IN PLARGE_INTEGER FileOffset
,
2107 IN PFILE_OBJECT FileObject
,
2108 IN PLARGE_INTEGER FileOffset
,
2119 IN PFILE_OBJECT FileObject
,
2120 IN PLARGE_INTEGER FileOffset
,
2123 OUT PIO_STATUS_BLOCK IoStatus
2130 IN PFILE_OBJECT FileObject
,
2131 IN PLARGE_INTEGER FileOffset
,
2142 CcPurgeCacheSection (
2143 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
2144 IN PLARGE_INTEGER FileOffset OPTIONAL
,
2146 IN BOOLEAN UninitializeCacheMaps
2149 #define CcReadAhead(FO, FOFF, LEN) ( \
2150 if ((LEN) >= 256) { \
2151 CcScheduleReadAhead((FO), (FOFF), (LEN)); \
2155 #if (VER_PRODUCTBUILD >= 2195)
2164 #endif /* (VER_PRODUCTBUILD >= 2195) */
2176 CcScheduleReadAhead (
2177 IN PFILE_OBJECT FileObject
,
2178 IN PLARGE_INTEGER FileOffset
,
2185 CcSetAdditionalCacheAttributes (
2186 IN PFILE_OBJECT FileObject
,
2187 IN BOOLEAN DisableReadAhead
,
2188 IN BOOLEAN DisableWriteBehind
2194 CcSetBcbOwnerPointer (
2196 IN PVOID OwnerPointer
2202 CcSetDirtyPageThreshold (
2203 IN PFILE_OBJECT FileObject
,
2204 IN ULONG DirtyPageThreshold
2210 CcSetDirtyPinnedData (
2212 IN PLARGE_INTEGER Lsn OPTIONAL
2219 IN PFILE_OBJECT FileObject
,
2220 IN PCC_FILE_SIZES FileSizes
2223 typedef VOID (NTAPI
*PFLUSH_TO_LSN
) (
2225 IN PLARGE_INTEGER Lsn
2231 CcSetLogHandleForFile (
2232 IN PFILE_OBJECT FileObject
,
2234 IN PFLUSH_TO_LSN FlushToLsnRoutine
2240 CcSetReadAheadGranularity (
2241 IN PFILE_OBJECT FileObject
,
2242 IN ULONG Granularity
/* default: PAGE_SIZE */
2243 /* allowed: 2^n * PAGE_SIZE */
2249 CcUninitializeCacheMap (
2250 IN PFILE_OBJECT FileObject
,
2251 IN PLARGE_INTEGER TruncateSize OPTIONAL
,
2252 IN PCACHE_UNINITIALIZE_EVENT UninitializeCompleteEvent OPTIONAL
2265 CcUnpinDataForThread (
2267 IN ERESOURCE_THREAD ResourceThreadId
2273 CcUnpinRepinnedBcb (
2275 IN BOOLEAN WriteThrough
,
2276 OUT PIO_STATUS_BLOCK IoStatus
2279 #if (VER_PRODUCTBUILD >= 2195)
2284 CcWaitForCurrentLazyWriterActivity (
2288 #endif /* (VER_PRODUCTBUILD >= 2195) */
2294 IN PFILE_OBJECT FileObject
,
2295 IN PLARGE_INTEGER StartOffset
,
2296 IN PLARGE_INTEGER EndOffset
,
2303 ExDisableResourceBoostLite (
2304 IN PERESOURCE Resource
2310 ExQueryPoolBlockSize (
2312 OUT PBOOLEAN QuotaCharged
2315 #if (VER_PRODUCTBUILD >= 2600)
2317 #ifndef __NTOSKRNL__
2321 ExInitializeRundownProtection (
2322 IN PEX_RUNDOWN_REF RunRef
2328 ExReInitializeRundownProtection (
2329 IN PEX_RUNDOWN_REF RunRef
2335 ExAcquireRundownProtection (
2336 IN PEX_RUNDOWN_REF RunRef
2342 ExAcquireRundownProtectionEx (
2343 IN PEX_RUNDOWN_REF RunRef
,
2350 ExReleaseRundownProtection (
2351 IN PEX_RUNDOWN_REF RunRef
2357 ExReleaseRundownProtectionEx (
2358 IN PEX_RUNDOWN_REF RunRef
,
2365 ExRundownCompleted (
2366 IN PEX_RUNDOWN_REF RunRef
2372 ExWaitForRundownProtectionRelease (
2373 IN PEX_RUNDOWN_REF RunRef
2377 #endif /* (VER_PRODUCTBUILD >= 2600) */
2379 #define FlagOn(x, f) ((x) & (f))
2384 FsRtlAddToTunnelCache (
2386 IN ULONGLONG DirectoryKey
,
2387 IN PUNICODE_STRING ShortName
,
2388 IN PUNICODE_STRING LongName
,
2389 IN BOOLEAN KeyByShortName
,
2390 IN ULONG DataLength
,
2394 #if (VER_PRODUCTBUILD >= 2195)
2398 FsRtlAllocateFileLock (
2399 IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL
,
2400 IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
2403 #endif /* (VER_PRODUCTBUILD >= 2195) */
2409 IN POOL_TYPE PoolType
,
2410 IN ULONG NumberOfBytes
2416 FsRtlAllocatePoolWithQuota (
2417 IN POOL_TYPE PoolType
,
2418 IN ULONG NumberOfBytes
2424 FsRtlAllocatePoolWithQuotaTag (
2425 IN POOL_TYPE PoolType
,
2426 IN ULONG NumberOfBytes
,
2433 FsRtlAllocatePoolWithTag (
2434 IN POOL_TYPE PoolType
,
2435 IN ULONG NumberOfBytes
,
2442 FsRtlAreNamesEqual (
2443 IN PCUNICODE_STRING Name1
,
2444 IN PCUNICODE_STRING Name2
,
2445 IN BOOLEAN IgnoreCase
,
2446 IN PCWCH UpcaseTable OPTIONAL
2449 #define FsRtlAreThereCurrentFileLocks(FL) ( \
2450 ((FL)->FastIoIsQuestionable) \
2454 FsRtlCheckLockForReadAccess:
2456 All this really does is pick out the lock parameters from the irp (io stack
2457 location?), get IoGetRequestorProcess, and pass values on to
2458 FsRtlFastCheckLockForRead.
2463 FsRtlCheckLockForReadAccess (
2464 IN PFILE_LOCK FileLock
,
2469 FsRtlCheckLockForWriteAccess:
2471 All this really does is pick out the lock parameters from the irp (io stack
2472 location?), get IoGetRequestorProcess, and pass values on to
2473 FsRtlFastCheckLockForWrite.
2478 FsRtlCheckLockForWriteAccess (
2479 IN PFILE_LOCK FileLock
,
2485 (NTAPI
*POPLOCK_WAIT_COMPLETE_ROUTINE
) (
2492 (NTAPI
*POPLOCK_FS_PREPOST_IRP
) (
2504 IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL
,
2505 IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL
2512 IN PFILE_OBJECT FileObject
,
2513 IN PLARGE_INTEGER FileOffset
,
2518 OUT PIO_STATUS_BLOCK IoStatus
,
2519 IN PDEVICE_OBJECT DeviceObject
2526 IN PFILE_OBJECT FileObject
,
2527 IN PLARGE_INTEGER FileOffset
,
2532 OUT PIO_STATUS_BLOCK IoStatus
,
2533 IN PDEVICE_OBJECT DeviceObject
2541 IN PVOID HeapBase OPTIONAL
,
2542 IN SIZE_T ReserveSize OPTIONAL
,
2543 IN SIZE_T CommitSize OPTIONAL
,
2544 IN PVOID Lock OPTIONAL
,
2545 IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL
2551 FsRtlCurrentBatchOplock (
2558 FsRtlDeleteKeyFromTunnelCache (
2560 IN ULONGLONG DirectoryKey
2566 FsRtlDeleteTunnelCache (
2573 FsRtlDeregisterUncProvider (
2588 IN ANSI_STRING Name
,
2589 OUT PANSI_STRING FirstPart
,
2590 OUT PANSI_STRING RemainingPart
2597 IN UNICODE_STRING Name
,
2598 OUT PUNICODE_STRING FirstPart
,
2599 OUT PUNICODE_STRING RemainingPart
2605 FsRtlDoesDbcsContainWildCards (
2606 IN PANSI_STRING Name
2612 FsRtlDoesNameContainWildCards (
2613 IN PUNICODE_STRING Name
2616 #define FsRtlCompleteRequest(IRP,STATUS) { \
2617 (IRP)->IoStatus.Status = (STATUS); \
2618 IoCompleteRequest( (IRP), IO_DISK_INCREMENT ); \
2621 #define FsRtlEnterFileSystem KeEnterCriticalRegion
2623 #define FsRtlExitFileSystem KeLeaveCriticalRegion
2628 FsRtlFastCheckLockForRead (
2629 IN PFILE_LOCK FileLock
,
2630 IN PLARGE_INTEGER FileOffset
,
2631 IN PLARGE_INTEGER Length
,
2633 IN PFILE_OBJECT FileObject
,
2634 IN PEPROCESS Process
2640 FsRtlFastCheckLockForWrite (
2641 IN PFILE_LOCK FileLock
,
2642 IN PLARGE_INTEGER FileOffset
,
2643 IN PLARGE_INTEGER Length
,
2645 IN PFILE_OBJECT FileObject
,
2646 IN PEPROCESS Process
2649 #define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) ( \
2650 FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11) \
2656 FsRtlFastUnlockAll (
2657 IN PFILE_LOCK FileLock
,
2658 IN PFILE_OBJECT FileObject
,
2659 IN PEPROCESS Process
,
2660 IN PVOID Context OPTIONAL
2662 /* ret: STATUS_RANGE_NOT_LOCKED */
2667 FsRtlFastUnlockAllByKey (
2668 IN PFILE_LOCK FileLock
,
2669 IN PFILE_OBJECT FileObject
,
2670 IN PEPROCESS Process
,
2672 IN PVOID Context OPTIONAL
2674 /* ret: STATUS_RANGE_NOT_LOCKED */
2679 FsRtlFastUnlockSingle (
2680 IN PFILE_LOCK FileLock
,
2681 IN PFILE_OBJECT FileObject
,
2682 IN PLARGE_INTEGER FileOffset
,
2683 IN PLARGE_INTEGER Length
,
2684 IN PEPROCESS Process
,
2686 IN PVOID Context OPTIONAL
,
2687 IN BOOLEAN AlreadySynchronized
2689 /* ret: STATUS_RANGE_NOT_LOCKED */
2694 FsRtlFindInTunnelCache (
2696 IN ULONGLONG DirectoryKey
,
2697 IN PUNICODE_STRING Name
,
2698 OUT PUNICODE_STRING ShortName
,
2699 OUT PUNICODE_STRING LongName
,
2700 IN OUT PULONG DataLength
,
2704 #if (VER_PRODUCTBUILD >= 2195)
2710 IN PFILE_LOCK FileLock
2713 #endif /* (VER_PRODUCTBUILD >= 2195) */
2719 IN PFILE_OBJECT FileObject
,
2720 IN OUT PLARGE_INTEGER FileSize
2724 FsRtlGetNextFileLock:
2726 ret: NULL if no more locks
2729 FsRtlGetNextFileLock uses FileLock->LastReturnedLockInfo and
2730 FileLock->LastReturnedLock as storage.
2731 LastReturnedLock is a pointer to the 'raw' lock inkl. double linked
2732 list, and FsRtlGetNextFileLock needs this to get next lock on subsequent
2733 calls with Restart = FALSE.
2738 FsRtlGetNextFileLock (
2739 IN PFILE_LOCK FileLock
,
2746 FsRtlInitializeFileLock (
2747 IN PFILE_LOCK FileLock
,
2748 IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL
,
2749 IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
2755 FsRtlInitializeOplock (
2756 IN OUT POPLOCK Oplock
2762 FsRtlInitializeTunnelCache (
2769 FsRtlIsNameInExpression (
2770 IN PUNICODE_STRING Expression
,
2771 IN PUNICODE_STRING Name
,
2772 IN BOOLEAN IgnoreCase
,
2773 IN PWCHAR UpcaseTable OPTIONAL
2779 FsRtlIsNtstatusExpected (
2780 IN NTSTATUS Ntstatus
2783 #define NLS_OEM_LEAD_BYTE_INFO NlsOemLeadByteInfo
2785 extern PUSHORT NlsOemLeadByteInfo
;
2787 #define FsRtlIsLeadDbcsCharacter(DBCS_CHAR) ( \
2788 (BOOLEAN)((UCHAR)(DBCS_CHAR) < 0x80 ? FALSE : \
2789 (NLS_MB_CODE_PAGE_TAG && \
2790 (NLS_OEM_LEAD_BYTE_INFO[(UCHAR)(DBCS_CHAR)] != 0))) \
2793 #define FsRtlIsAnsiCharacterWild(C) ( \
2794 FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], FSRTL_WILD_CHARACTER ) \
2797 #define FsRtlIsUnicodeCharacterWild(C) ( \
2800 FlagOn(FsRtlLegalAnsiCharacterArray[(C)], FSRTL_WILD_CHARACTER )) \
2807 IN PFILE_OBJECT FileObject
,
2808 IN PLARGE_INTEGER FileOffset
,
2812 OUT PIO_STATUS_BLOCK IoStatus
,
2813 IN PDEVICE_OBJECT DeviceObject
2819 FsRtlMdlReadComplete (
2820 IN PFILE_OBJECT FileObject
,
2827 FsRtlMdlReadCompleteDev (
2828 IN PFILE_OBJECT FileObject
,
2830 IN PDEVICE_OBJECT DeviceObject
2836 FsRtlPrepareMdlWriteDev (
2837 IN PFILE_OBJECT FileObject
,
2838 IN PLARGE_INTEGER FileOffset
,
2842 OUT PIO_STATUS_BLOCK IoStatus
,
2843 IN PDEVICE_OBJECT DeviceObject
2849 FsRtlMdlWriteComplete (
2850 IN PFILE_OBJECT FileObject
,
2851 IN PLARGE_INTEGER FileOffset
,
2858 FsRtlMdlWriteCompleteDev (
2859 IN PFILE_OBJECT FileObject
,
2860 IN PLARGE_INTEGER FileOffset
,
2862 IN PDEVICE_OBJECT DeviceObject
2868 FsRtlNormalizeNtstatus (
2869 IN NTSTATUS Exception
,
2870 IN NTSTATUS GenericException
2876 FsRtlNotifyChangeDirectory (
2877 IN PNOTIFY_SYNC NotifySync
,
2879 IN PSTRING FullDirectoryName
,
2880 IN PLIST_ENTRY NotifyList
,
2881 IN BOOLEAN WatchTree
,
2882 IN ULONG CompletionFilter
,
2889 FsRtlNotifyCleanup (
2890 IN PNOTIFY_SYNC NotifySync
,
2891 IN PLIST_ENTRY NotifyList
,
2895 typedef BOOLEAN (*PCHECK_FOR_TRAVERSE_ACCESS
) (
2896 IN PVOID NotifyContext
,
2897 IN PVOID TargetContext
,
2898 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
2904 FsRtlNotifyFullChangeDirectory (
2905 IN PNOTIFY_SYNC NotifySync
,
2906 IN PLIST_ENTRY NotifyList
,
2908 IN PSTRING FullDirectoryName
,
2909 IN BOOLEAN WatchTree
,
2910 IN BOOLEAN IgnoreBuffer
,
2911 IN ULONG CompletionFilter
,
2913 IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL
,
2914 IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL
2920 FsRtlNotifyFullReportChange (
2921 IN PNOTIFY_SYNC NotifySync
,
2922 IN PLIST_ENTRY NotifyList
,
2923 IN PSTRING FullTargetName
,
2924 IN USHORT TargetNameOffset
,
2925 IN PSTRING StreamName OPTIONAL
,
2926 IN PSTRING NormalizedParentName OPTIONAL
,
2927 IN ULONG FilterMatch
,
2929 IN PVOID TargetContext
2935 FsRtlNotifyInitializeSync (
2936 IN PNOTIFY_SYNC
*NotifySync
2942 FsRtlNotifyReportChange (
2943 IN PNOTIFY_SYNC NotifySync
,
2944 IN PLIST_ENTRY NotifyList
,
2945 IN PSTRING FullTargetName
,
2946 IN PUSHORT FileNamePartLength
,
2947 IN ULONG FilterMatch
2953 FsRtlNotifyUninitializeSync (
2954 IN PNOTIFY_SYNC
*NotifySync
2957 #if (VER_PRODUCTBUILD >= 2195)
2962 FsRtlNotifyVolumeEvent (
2963 IN PFILE_OBJECT FileObject
,
2967 #endif /* (VER_PRODUCTBUILD >= 2195) */
2981 FsRtlOplockIsFastIoPossible (
2988 ret: IoStatus->Status: STATUS_PENDING, STATUS_LOCK_NOT_GRANTED
2991 -Calls IoCompleteRequest if Irp
2992 -Uses exception handling / ExRaiseStatus with STATUS_INSUFFICIENT_RESOURCES
2998 IN PFILE_LOCK FileLock
,
2999 IN PFILE_OBJECT FileObject
,
3000 IN PLARGE_INTEGER FileOffset
,
3001 IN PLARGE_INTEGER Length
,
3002 IN PEPROCESS Process
,
3004 IN BOOLEAN FailImmediately
,
3005 IN BOOLEAN ExclusiveLock
,
3006 OUT PIO_STATUS_BLOCK IoStatus
,
3007 IN PIRP Irp OPTIONAL
,
3009 IN BOOLEAN AlreadySynchronized
3013 FsRtlProcessFileLock:
3016 -STATUS_INVALID_DEVICE_REQUEST
3017 -STATUS_RANGE_NOT_LOCKED from unlock routines.
3018 -STATUS_PENDING, STATUS_LOCK_NOT_GRANTED from FsRtlPrivateLock
3019 (redirected IoStatus->Status).
3022 -switch ( Irp->CurrentStackLocation->MinorFunction )
3023 lock: return FsRtlPrivateLock;
3024 unlocksingle: return FsRtlFastUnlockSingle;
3025 unlockall: return FsRtlFastUnlockAll;
3026 unlockallbykey: return FsRtlFastUnlockAllByKey;
3027 default: IofCompleteRequest with STATUS_INVALID_DEVICE_REQUEST;
3028 return STATUS_INVALID_DEVICE_REQUEST;
3030 -'AllwaysZero' is passed thru as 'AllwaysZero' to lock / unlock routines.
3031 -'Irp' is passet thru as 'Irp' to FsRtlPrivateLock.
3036 FsRtlProcessFileLock (
3037 IN PFILE_LOCK FileLock
,
3039 IN PVOID Context OPTIONAL
3045 FsRtlRegisterUncProvider (
3046 IN OUT PHANDLE MupHandle
,
3047 IN PUNICODE_STRING RedirectorDeviceName
,
3048 IN BOOLEAN MailslotsSupported
3052 (NTAPI
*PFSRTL_STACK_OVERFLOW_ROUTINE
) (
3060 FsRtlPostStackOverflow (
3063 IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine
3069 FsRtlPostPagingFileStackOverflow (
3072 IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine
3078 FsRtlUninitializeFileLock (
3079 IN PFILE_LOCK FileLock
3085 FsRtlUninitializeOplock (
3086 IN OUT POPLOCK Oplock
3099 KeSetIdealProcessorThread(
3100 IN OUT PKTHREAD Thread
,
3107 IoAttachDeviceToDeviceStackSafe(
3108 IN PDEVICE_OBJECT SourceDevice
,
3109 IN PDEVICE_OBJECT TargetDevice
,
3110 OUT PDEVICE_OBJECT
*AttachedToDeviceObject
3116 IoAcquireVpbSpinLock (
3123 IoCheckDesiredAccess (
3124 IN OUT PACCESS_MASK DesiredAccess
,
3125 IN ACCESS_MASK GrantedAccess
3131 IoCheckEaBufferValidity (
3132 IN PFILE_FULL_EA_INFORMATION EaBuffer
,
3134 OUT PULONG ErrorOffset
3140 IoCheckFunctionAccess (
3141 IN ACCESS_MASK GrantedAccess
,
3142 IN UCHAR MajorFunction
,
3143 IN UCHAR MinorFunction
,
3144 IN ULONG IoControlCode
,
3145 IN PVOID Argument1 OPTIONAL
,
3146 IN PVOID Argument2 OPTIONAL
3149 #if (VER_PRODUCTBUILD >= 2195)
3154 IoCheckQuotaBufferValidity (
3155 IN PFILE_QUOTA_INFORMATION QuotaBuffer
,
3156 IN ULONG QuotaLength
,
3157 OUT PULONG ErrorOffset
3160 #endif /* (VER_PRODUCTBUILD >= 2195) */
3165 IoCreateStreamFileObject (
3166 IN PFILE_OBJECT FileObject OPTIONAL
,
3167 IN PDEVICE_OBJECT DeviceObject OPTIONAL
3170 #if (VER_PRODUCTBUILD >= 2195)
3175 IoCreateStreamFileObjectLite (
3176 IN PFILE_OBJECT FileObject OPTIONAL
,
3177 IN PDEVICE_OBJECT DeviceObject OPTIONAL
3180 #endif /* (VER_PRODUCTBUILD >= 2195) */
3185 IoFastQueryNetworkAttributes (
3186 IN POBJECT_ATTRIBUTES ObjectAttributes
,
3187 IN ACCESS_MASK DesiredAccess
,
3188 IN ULONG OpenOptions
,
3189 OUT PIO_STATUS_BLOCK IoStatus
,
3190 OUT PFILE_NETWORK_OPEN_INFORMATION Buffer
3196 IoGetAttachedDevice (
3197 IN PDEVICE_OBJECT DeviceObject
3203 IoGetBaseFileSystemDeviceObject (
3204 IN PFILE_OBJECT FileObject
3210 IoGetRequestorProcess (
3214 #if (VER_PRODUCTBUILD >= 2195)
3219 IoGetRequestorProcessId (
3223 #endif /* (VER_PRODUCTBUILD >= 2195) */
3232 #define IoIsFileOpenedExclusively(FileObject) ( \
3234 (FileObject)->SharedRead || \
3235 (FileObject)->SharedWrite || \
3236 (FileObject)->SharedDelete \
3243 IoIsOperationSynchronous (
3254 #if (VER_PRODUCTBUILD >= 2195)
3259 IoIsValidNameGraftingBuffer (
3261 IN PREPARSE_DATA_BUFFER ReparseBuffer
3264 #endif /* (VER_PRODUCTBUILD >= 2195) */
3270 IN PFILE_OBJECT FileObject
,
3272 IN PLARGE_INTEGER Offset
,
3274 OUT PIO_STATUS_BLOCK IoStatusBlock
3280 IoQueryFileInformation (
3281 IN PFILE_OBJECT FileObject
,
3282 IN FILE_INFORMATION_CLASS FileInformationClass
,
3284 OUT PVOID FileInformation
,
3285 OUT PULONG ReturnedLength
3291 IoQueryVolumeInformation (
3292 IN PFILE_OBJECT FileObject
,
3293 IN FS_INFORMATION_CLASS FsInformationClass
,
3295 OUT PVOID FsInformation
,
3296 OUT PULONG ReturnedLength
3309 IoRegisterFileSystem (
3310 IN OUT PDEVICE_OBJECT DeviceObject
3313 #if (VER_PRODUCTBUILD >= 1381)
3315 typedef VOID (NTAPI
*PDRIVER_FS_NOTIFICATION
) (
3316 IN PDEVICE_OBJECT DeviceObject
,
3317 IN BOOLEAN DriverActive
3323 IoRegisterFsRegistrationChange (
3324 IN PDRIVER_OBJECT DriverObject
,
3325 IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
3328 #endif /* (VER_PRODUCTBUILD >= 1381) */
3333 IoReleaseVpbSpinLock (
3340 IoSetDeviceToVerify (
3342 IN PDEVICE_OBJECT DeviceObject
3349 IN PFILE_OBJECT FileObject
,
3350 IN FILE_INFORMATION_CLASS FileInformationClass
,
3352 IN PVOID FileInformation
3365 IoSynchronousPageWrite (
3366 IN PFILE_OBJECT FileObject
,
3368 IN PLARGE_INTEGER FileOffset
,
3370 OUT PIO_STATUS_BLOCK IoStatusBlock
3383 IoUnregisterFileSystem (
3384 IN OUT PDEVICE_OBJECT DeviceObject
3387 #if (VER_PRODUCTBUILD >= 1381)
3392 IoUnregisterFsRegistrationChange (
3393 IN PDRIVER_OBJECT DriverObject
,
3394 IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
3397 #endif /* (VER_PRODUCTBUILD >= 1381) */
3403 IN PDEVICE_OBJECT DeviceObject
,
3404 IN BOOLEAN AllowRawMount
3411 IN PKPROCESS Process
3426 IN ULONG Count OPTIONAL
3434 IN PLIST_ENTRY Entry
3442 IN PLIST_ENTRY Entry
3457 IN KPROCESSOR_MODE WaitMode
,
3458 IN PLARGE_INTEGER Timeout OPTIONAL
3471 KeInitializeMutant (
3472 IN PRKMUTANT Mutant
,
3473 IN BOOLEAN InitialOwner
3487 IN PRKMUTANT Mutant
,
3488 IN KPRIORITY Increment
,
3489 IN BOOLEAN Abandoned
,
3493 #if (VER_PRODUCTBUILD >= 2195)
3498 KeStackAttachProcess (
3499 IN PKPROCESS Process
,
3500 OUT PKAPC_STATE ApcState
3506 KeUnstackDetachProcess (
3507 IN PKAPC_STATE ApcState
3510 #endif /* (VER_PRODUCTBUILD >= 2195) */
3515 KeSetKernelStackSwapEnable(
3522 MmCanFileBeTruncated (
3523 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
3524 IN PLARGE_INTEGER NewFileSize
3530 MmFlushImageSection (
3531 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
3532 IN MMFLUSH_TYPE FlushType
3538 MmForceSectionClosed (
3539 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
3540 IN BOOLEAN DelayClose
3543 #if (VER_PRODUCTBUILD >= 1381)
3548 MmIsRecursiveIoFault (
3554 #define MmIsRecursiveIoFault() ( \
3555 (PsGetCurrentThread()->DisablePageFaultClustering) | \
3556 (PsGetCurrentThread()->ForwardClusterOnly) \
3565 MmSetAddressRangeModified (
3574 IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL
,
3575 IN POBJECT_TYPE ObjectType
,
3576 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL
,
3577 IN KPROCESSOR_MODE AccessMode
,
3578 IN OUT PVOID ParseContext OPTIONAL
,
3579 IN ULONG ObjectSize
,
3580 IN ULONG PagedPoolCharge OPTIONAL
,
3581 IN ULONG NonPagedPoolCharge OPTIONAL
,
3588 ObGetObjectPointerCount (
3597 IN PACCESS_STATE PassedAccessState OPTIONAL
,
3598 IN ACCESS_MASK DesiredAccess
,
3599 IN ULONG AdditionalReferences
,
3600 OUT PVOID
*ReferencedObject OPTIONAL
,
3607 ObMakeTemporaryObject (
3614 ObOpenObjectByPointer (
3616 IN ULONG HandleAttributes
,
3617 IN PACCESS_STATE PassedAccessState OPTIONAL
,
3618 IN ACCESS_MASK DesiredAccess OPTIONAL
,
3619 IN POBJECT_TYPE ObjectType OPTIONAL
,
3620 IN KPROCESSOR_MODE AccessMode
,
3629 OUT POBJECT_NAME_INFORMATION ObjectNameInfo
,
3631 OUT PULONG ReturnLength
3637 ObQueryObjectAuditingByHandle (
3639 OUT PBOOLEAN GenerateOnClose
3645 ObReferenceObjectByName (
3646 IN PUNICODE_STRING ObjectName
,
3647 IN ULONG Attributes
,
3648 IN PACCESS_STATE PassedAccessState OPTIONAL
,
3649 IN ACCESS_MASK DesiredAccess OPTIONAL
,
3650 IN POBJECT_TYPE ObjectType
,
3651 IN KPROCESSOR_MODE AccessMode
,
3652 IN OUT PVOID ParseContext OPTIONAL
,
3659 PsAssignImpersonationToken (
3668 IN PEPROCESS Process
,
3669 IN POOL_TYPE PoolType
,
3676 PsChargeProcessPoolQuota (
3677 IN PEPROCESS Process
,
3678 IN POOL_TYPE PoolType
,
3682 #define PsDereferenceImpersonationToken(T) \
3683 {if (ARGUMENT_PRESENT(T)) { \
3684 (ObDereferenceObject((T))); \
3690 #define PsDereferencePrimaryToken(T) (ObDereferenceObject((T)))
3695 PsDisableImpersonation(
3697 IN PSE_IMPERSONATION_STATE ImpersonationState
3703 PsGetProcessExitTime (
3710 PsImpersonateClient(
3712 IN PACCESS_TOKEN Token
,
3713 IN BOOLEAN CopyOnOpen
,
3714 IN BOOLEAN EffectiveOnly
,
3715 IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
3728 PsIsThreadTerminating (
3735 PsLookupProcessByProcessId (
3736 IN HANDLE ProcessId
,
3737 OUT PEPROCESS
*Process
3743 PsLookupProcessThreadByCid (
3745 OUT PEPROCESS
*Process OPTIONAL
,
3746 OUT PETHREAD
*Thread
3752 PsLookupThreadByThreadId (
3753 IN HANDLE UniqueThreadId
,
3754 OUT PETHREAD
*Thread
3760 PsReferenceImpersonationToken (
3762 OUT PBOOLEAN CopyOnUse
,
3763 OUT PBOOLEAN EffectiveOnly
,
3764 OUT PSECURITY_IMPERSONATION_LEVEL Level
3770 PsReferencePrimaryToken (
3771 IN PEPROCESS Process
3777 PsRestoreImpersonation(
3779 IN PSE_IMPERSONATION_STATE ImpersonationState
3786 IN PEPROCESS Process
,
3787 IN POOL_TYPE PoolType
,
3801 RtlAbsoluteToSelfRelativeSD (
3802 IN PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor
,
3803 IN OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor
,
3804 IN PULONG BufferLength
3811 IN HANDLE HeapHandle
,
3819 RtlCaptureStackBackTrace (
3820 IN ULONG FramesToSkip
,
3821 IN ULONG FramesToCapture
,
3822 OUT PVOID
*BackTrace
,
3823 OUT PULONG BackTraceHash OPTIONAL
3830 IN USHORT CompressionFormatAndEngine
,
3831 IN PUCHAR UncompressedBuffer
,
3832 IN ULONG UncompressedBufferSize
,
3833 OUT PUCHAR CompressedBuffer
,
3834 IN ULONG CompressedBufferSize
,
3835 IN ULONG UncompressedChunkSize
,
3836 OUT PULONG FinalCompressedSize
,
3844 IN PUCHAR UncompressedBuffer
,
3845 IN ULONG UncompressedBufferSize
,
3846 OUT PUCHAR CompressedBuffer
,
3847 IN ULONG CompressedBufferSize
,
3848 IN OUT PCOMPRESSED_DATA_INFO CompressedDataInfo
,
3849 IN ULONG CompressedDataInfoLength
,
3856 RtlConvertSidToUnicodeString (
3857 OUT PUNICODE_STRING DestinationString
,
3859 IN BOOLEAN AllocateDestinationString
3867 IN PSID Destination
,
3874 RtlCreateUnicodeString(
3875 PUNICODE_STRING DestinationString
,
3882 RtlDecompressBuffer (
3883 IN USHORT CompressionFormat
,
3884 OUT PUCHAR UncompressedBuffer
,
3885 IN ULONG UncompressedBufferSize
,
3886 IN PUCHAR CompressedBuffer
,
3887 IN ULONG CompressedBufferSize
,
3888 OUT PULONG FinalUncompressedSize
3894 RtlDecompressChunks (
3895 OUT PUCHAR UncompressedBuffer
,
3896 IN ULONG UncompressedBufferSize
,
3897 IN PUCHAR CompressedBuffer
,
3898 IN ULONG CompressedBufferSize
,
3899 IN PUCHAR CompressedTail
,
3900 IN ULONG CompressedTailSize
,
3901 IN PCOMPRESSED_DATA_INFO CompressedDataInfo
3907 RtlDecompressFragment (
3908 IN USHORT CompressionFormat
,
3909 OUT PUCHAR UncompressedFragment
,
3910 IN ULONG UncompressedFragmentSize
,
3911 IN PUCHAR CompressedBuffer
,
3912 IN ULONG CompressedBufferSize
,
3913 IN ULONG FragmentOffset
,
3914 OUT PULONG FinalUncompressedSize
,
3922 IN USHORT CompressionFormat
,
3923 IN OUT PUCHAR
*CompressedBuffer
,
3924 IN PUCHAR EndOfCompressedBufferPlus1
,
3925 OUT PUCHAR
*ChunkBuffer
,
3926 OUT PULONG ChunkSize
3932 RtlDowncaseUnicodeString(
3933 IN OUT PUNICODE_STRING UniDest
,
3934 IN PCUNICODE_STRING UniSource
,
3935 IN BOOLEAN AllocateDestinationString
3941 RtlDuplicateUnicodeString(
3943 IN PCUNICODE_STRING SourceString
,
3944 OUT PUNICODE_STRING DestinationString
3958 RtlFillMemoryUlong (
3959 IN PVOID Destination
,
3968 IN HANDLE HeapHandle
,
3976 RtlGenerate8dot3Name (
3977 IN PUNICODE_STRING Name
,
3978 IN BOOLEAN AllowExtendedCharacters
,
3979 IN OUT PGENERATE_NAME_CONTEXT Context
,
3980 OUT PUNICODE_STRING Name8dot3
3986 RtlGetCompressionWorkSpaceSize (
3987 IN USHORT CompressionFormatAndEngine
,
3988 OUT PULONG CompressBufferWorkSpaceSize
,
3989 OUT PULONG CompressFragmentWorkSpaceSize
3995 RtlGetDaclSecurityDescriptor (
3996 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
3997 OUT PBOOLEAN DaclPresent
,
3999 OUT PBOOLEAN DaclDefaulted
4005 RtlGetGroupSecurityDescriptor (
4006 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4008 OUT PBOOLEAN GroupDefaulted
4014 RtlGetOwnerSecurityDescriptor (
4015 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4017 OUT PBOOLEAN OwnerDefaulted
4025 IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority
,
4026 IN UCHAR SubAuthorityCount
4032 RtlIsNameLegalDOS8Dot3(
4033 IN PCUNICODE_STRING Name
,
4034 IN OUT POEM_STRING OemName OPTIONAL
,
4035 IN OUT PBOOLEAN NameContainsSpaces OPTIONAL
4041 RtlLengthRequiredSid (
4042 IN ULONG SubAuthorityCount
4055 RtlNtStatusToDosError (
4062 RtlOemStringToUnicodeString(
4063 IN OUT PUNICODE_STRING DestinationString
,
4064 IN PCOEM_STRING SourceString
,
4065 IN BOOLEAN AllocateDestinationString
4071 RtlUnicodeStringToOemString(
4072 IN OUT POEM_STRING DestinationString
,
4073 IN PCUNICODE_STRING SourceString
,
4074 IN BOOLEAN AllocateDestinationString
4081 IN USHORT CompressionFormat
,
4082 IN OUT PUCHAR
*CompressedBuffer
,
4083 IN PUCHAR EndOfCompressedBufferPlus1
,
4084 OUT PUCHAR
*ChunkBuffer
,
4091 RtlSecondsSince1970ToTime (
4092 IN ULONG SecondsSince1970
,
4093 OUT PLARGE_INTEGER Time
4099 RtlSetGroupSecurityDescriptor (
4100 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
4102 IN BOOLEAN GroupDefaulted
4108 RtlSetOwnerSecurityDescriptor (
4109 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
4111 IN BOOLEAN OwnerDefaulted
4117 RtlSetSaclSecurityDescriptor (
4118 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
4119 IN BOOLEAN SaclPresent
,
4121 IN BOOLEAN SaclDefaulted
4127 RtlSubAuthorityCountSid (
4134 RtlSubAuthoritySid (
4136 IN ULONG SubAuthority
4142 RtlUnicodeToMultiByteN(
4143 OUT PCHAR MultiByteString
,
4144 IN ULONG MaxBytesInMultiByteString
,
4145 OUT PULONG BytesInMultiByteString OPTIONAL
,
4146 IN PWCH UnicodeString
,
4147 IN ULONG BytesInUnicodeString
4150 /* RTL Splay Tree Functions */
4154 RtlSplay(PRTL_SPLAY_LINKS Links
);
4159 RtlDelete(PRTL_SPLAY_LINKS Links
);
4165 PRTL_SPLAY_LINKS Links
,
4166 PRTL_SPLAY_LINKS
*Root
4172 RtlSubtreeSuccessor(PRTL_SPLAY_LINKS Links
);
4177 RtlSubtreePredecessor(PRTL_SPLAY_LINKS Links
);
4182 RtlRealSuccessor(PRTL_SPLAY_LINKS Links
);
4187 RtlRealPredecessor(PRTL_SPLAY_LINKS Links
);
4189 #define RtlIsLeftChild(Links) \
4190 (RtlLeftChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
4192 #define RtlIsRightChild(Links) \
4193 (RtlRightChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
4195 #define RtlRightChild(Links) \
4196 ((PRTL_SPLAY_LINKS)(Links))->RightChild
4198 #define RtlIsRoot(Links) \
4199 (RtlParent(Links) == (PRTL_SPLAY_LINKS)(Links))
4201 #define RtlLeftChild(Links) \
4202 ((PRTL_SPLAY_LINKS)(Links))->LeftChild
4204 #define RtlParent(Links) \
4205 ((PRTL_SPLAY_LINKS)(Links))->Parent
4207 #define RtlInitializeSplayLinks(Links) \
4209 PRTL_SPLAY_LINKS _SplayLinks; \
4210 _SplayLinks = (PRTL_SPLAY_LINKS)(Links); \
4211 _SplayLinks->Parent = _SplayLinks; \
4212 _SplayLinks->LeftChild = NULL; \
4213 _SplayLinks->RightChild = NULL; \
4216 #define RtlInsertAsLeftChild(ParentLinks,ChildLinks) \
4218 PRTL_SPLAY_LINKS _SplayParent; \
4219 PRTL_SPLAY_LINKS _SplayChild; \
4220 _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
4221 _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \
4222 _SplayParent->LeftChild = _SplayChild; \
4223 _SplayChild->Parent = _SplayParent; \
4226 #define RtlInsertAsRightChild(ParentLinks,ChildLinks) \
4228 PRTL_SPLAY_LINKS _SplayParent; \
4229 PRTL_SPLAY_LINKS _SplayChild; \
4230 _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
4231 _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \
4232 _SplayParent->RightChild = _SplayChild; \
4233 _SplayChild->Parent = _SplayParent; \
4246 SeAppendPrivileges (
4247 PACCESS_STATE AccessState
,
4248 PPRIVILEGE_SET Privileges
4254 SeAuditingFileEvents (
4255 IN BOOLEAN AccessGranted
,
4256 IN PSECURITY_DESCRIPTOR SecurityDescriptor
4262 SeAuditingFileOrGlobalEvents (
4263 IN BOOLEAN AccessGranted
,
4264 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4265 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4271 SeCaptureSubjectContext (
4272 OUT PSECURITY_SUBJECT_CONTEXT SubjectContext
4278 SeCreateClientSecurity (
4280 IN PSECURITY_QUALITY_OF_SERVICE QualityOfService
,
4281 IN BOOLEAN RemoteClient
,
4282 OUT PSECURITY_CLIENT_CONTEXT ClientContext
4285 #if (VER_PRODUCTBUILD >= 2195)
4290 SeCreateClientSecurityFromSubjectContext (
4291 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
,
4292 IN PSECURITY_QUALITY_OF_SERVICE QualityOfService
,
4293 IN BOOLEAN ServerIsRemote
,
4294 OUT PSECURITY_CLIENT_CONTEXT ClientContext
4297 #endif /* (VER_PRODUCTBUILD >= 2195) */
4299 #define SeDeleteClientSecurity(C) { \
4300 if (SeTokenType((C)->ClientToken) == TokenPrimary) { \
4301 PsDereferencePrimaryToken( (C)->ClientToken ); \
4303 PsDereferenceImpersonationToken( (C)->ClientToken ); \
4310 SeDeleteObjectAuditAlarm (
4315 #define SeEnableAccessToExports() SeExports = *(PSE_EXPORTS *)SeExports;
4321 IN PPRIVILEGE_SET Privileges
4327 SeImpersonateClient (
4328 IN PSECURITY_CLIENT_CONTEXT ClientContext
,
4329 IN PETHREAD ServerThread OPTIONAL
4332 #if (VER_PRODUCTBUILD >= 2195)
4337 SeImpersonateClientEx (
4338 IN PSECURITY_CLIENT_CONTEXT ClientContext
,
4339 IN PETHREAD ServerThread OPTIONAL
4342 #endif /* (VER_PRODUCTBUILD >= 2195) */
4347 SeLockSubjectContext (
4348 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4354 SeMarkLogonSessionForTerminationNotification (
4361 SeOpenObjectAuditAlarm (
4362 IN PUNICODE_STRING ObjectTypeName
,
4363 IN PVOID Object OPTIONAL
,
4364 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL
,
4365 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4366 IN PACCESS_STATE AccessState
,
4367 IN BOOLEAN ObjectCreated
,
4368 IN BOOLEAN AccessGranted
,
4369 IN KPROCESSOR_MODE AccessMode
,
4370 OUT PBOOLEAN GenerateOnClose
4376 SeOpenObjectForDeleteAuditAlarm (
4377 IN PUNICODE_STRING ObjectTypeName
,
4378 IN PVOID Object OPTIONAL
,
4379 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL
,
4380 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4381 IN PACCESS_STATE AccessState
,
4382 IN BOOLEAN ObjectCreated
,
4383 IN BOOLEAN AccessGranted
,
4384 IN KPROCESSOR_MODE AccessMode
,
4385 OUT PBOOLEAN GenerateOnClose
4392 IN OUT PPRIVILEGE_SET RequiredPrivileges
,
4393 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
,
4394 IN KPROCESSOR_MODE AccessMode
4400 SeQueryAuthenticationIdToken (
4401 IN PACCESS_TOKEN Token
,
4405 #if (VER_PRODUCTBUILD >= 2195)
4410 SeQueryInformationToken (
4411 IN PACCESS_TOKEN Token
,
4412 IN TOKEN_INFORMATION_CLASS TokenInformationClass
,
4413 OUT PVOID
*TokenInformation
4416 #endif /* (VER_PRODUCTBUILD >= 2195) */
4421 SeQuerySecurityDescriptorInfo (
4422 IN PSECURITY_INFORMATION SecurityInformation
,
4423 OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
4424 IN OUT PULONG Length
,
4425 IN PSECURITY_DESCRIPTOR
*ObjectsSecurityDescriptor
4428 #if (VER_PRODUCTBUILD >= 2195)
4433 SeQuerySessionIdToken (
4434 IN PACCESS_TOKEN Token
,
4438 #endif /* (VER_PRODUCTBUILD >= 2195) */
4440 #define SeQuerySubjectContextToken( SubjectContext ) \
4441 ( ARGUMENT_PRESENT( \
4442 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken \
4444 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken : \
4445 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
4447 typedef NTSTATUS (*PSE_LOGON_SESSION_TERMINATED_ROUTINE
) (
4454 SeRegisterLogonSessionTerminatedRoutine (
4455 IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
4461 SeReleaseSubjectContext (
4462 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4468 SeSetAccessStateGenericMapping (
4469 PACCESS_STATE AccessState
,
4470 PGENERIC_MAPPING GenericMapping
4476 SeSetSecurityDescriptorInfo (
4477 IN PVOID Object OPTIONAL
,
4478 IN PSECURITY_INFORMATION SecurityInformation
,
4479 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4480 IN OUT PSECURITY_DESCRIPTOR
*ObjectsSecurityDescriptor
,
4481 IN POOL_TYPE PoolType
,
4482 IN PGENERIC_MAPPING GenericMapping
4485 #if (VER_PRODUCTBUILD >= 2195)
4490 SeSetSecurityDescriptorInfoEx (
4491 IN PVOID Object OPTIONAL
,
4492 IN PSECURITY_INFORMATION SecurityInformation
,
4493 IN PSECURITY_DESCRIPTOR ModificationDescriptor
,
4494 IN OUT PSECURITY_DESCRIPTOR
*ObjectsSecurityDescriptor
,
4495 IN ULONG AutoInheritFlags
,
4496 IN POOL_TYPE PoolType
,
4497 IN PGENERIC_MAPPING GenericMapping
4504 IN PACCESS_TOKEN Token
4510 SeTokenIsRestricted (
4511 IN PACCESS_TOKEN Token
4517 SeLocateProcessImageName(
4518 IN PEPROCESS Process
,
4519 OUT PUNICODE_STRING
*pImageFileName
4522 #endif /* (VER_PRODUCTBUILD >= 2195) */
4528 IN PACCESS_TOKEN Token
4534 SeUnlockSubjectContext (
4535 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4541 SeUnregisterLogonSessionTerminatedRoutine (
4542 IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
4545 #if (VER_PRODUCTBUILD >= 2195)
4550 ZwAdjustPrivilegesToken (
4551 IN HANDLE TokenHandle
,
4552 IN BOOLEAN DisableAllPrivileges
,
4553 IN PTOKEN_PRIVILEGES NewState
,
4554 IN ULONG BufferLength
,
4555 OUT PTOKEN_PRIVILEGES PreviousState OPTIONAL
,
4556 OUT PULONG ReturnLength
4559 #endif /* (VER_PRODUCTBUILD >= 2195) */
4565 IN HANDLE ThreadHandle
4571 ZwAllocateVirtualMemory (
4572 IN HANDLE ProcessHandle
,
4573 IN OUT PVOID
*BaseAddress
,
4575 IN OUT PULONG RegionSize
,
4576 IN ULONG AllocationType
,
4582 NtAccessCheckByTypeAndAuditAlarm(
4583 IN PUNICODE_STRING SubsystemName
,
4585 IN PUNICODE_STRING ObjectTypeName
,
4586 IN PUNICODE_STRING ObjectName
,
4587 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4588 IN PSID PrincipalSelfSid
,
4589 IN ACCESS_MASK DesiredAccess
,
4590 IN AUDIT_EVENT_TYPE AuditType
,
4592 IN POBJECT_TYPE_LIST ObjectTypeList
,
4593 IN ULONG ObjectTypeLength
,
4594 IN PGENERIC_MAPPING GenericMapping
,
4595 IN BOOLEAN ObjectCreation
,
4596 OUT PACCESS_MASK GrantedAccess
,
4597 OUT PNTSTATUS AccessStatus
,
4598 OUT PBOOLEAN GenerateOnClose
4603 NtAccessCheckByTypeResultListAndAuditAlarm(
4604 IN PUNICODE_STRING SubsystemName
,
4606 IN PUNICODE_STRING ObjectTypeName
,
4607 IN PUNICODE_STRING ObjectName
,
4608 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4609 IN PSID PrincipalSelfSid
,
4610 IN ACCESS_MASK DesiredAccess
,
4611 IN AUDIT_EVENT_TYPE AuditType
,
4613 IN POBJECT_TYPE_LIST ObjectTypeList
,
4614 IN ULONG ObjectTypeLength
,
4615 IN PGENERIC_MAPPING GenericMapping
,
4616 IN BOOLEAN ObjectCreation
,
4617 OUT PACCESS_MASK GrantedAccess
,
4618 OUT PNTSTATUS AccessStatus
,
4619 OUT PBOOLEAN GenerateOnClose
4624 NtAccessCheckByTypeResultListAndAuditAlarmByHandle(
4625 IN PUNICODE_STRING SubsystemName
,
4627 IN HANDLE ClientToken
,
4628 IN PUNICODE_STRING ObjectTypeName
,
4629 IN PUNICODE_STRING ObjectName
,
4630 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4631 IN PSID PrincipalSelfSid
,
4632 IN ACCESS_MASK DesiredAccess
,
4633 IN AUDIT_EVENT_TYPE AuditType
,
4635 IN POBJECT_TYPE_LIST ObjectTypeList
,
4636 IN ULONG ObjectTypeLength
,
4637 IN PGENERIC_MAPPING GenericMapping
,
4638 IN BOOLEAN ObjectCreation
,
4639 OUT PACCESS_MASK GrantedAccess
,
4640 OUT PNTSTATUS AccessStatus
,
4641 OUT PBOOLEAN GenerateOnClose
4647 ZwAccessCheckAndAuditAlarm (
4648 IN PUNICODE_STRING SubsystemName
,
4650 IN PUNICODE_STRING ObjectTypeName
,
4651 IN PUNICODE_STRING ObjectName
,
4652 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4653 IN ACCESS_MASK DesiredAccess
,
4654 IN PGENERIC_MAPPING GenericMapping
,
4655 IN BOOLEAN ObjectCreation
,
4656 OUT PACCESS_MASK GrantedAccess
,
4657 OUT PBOOLEAN AccessStatus
,
4658 OUT PBOOLEAN GenerateOnClose
4661 #if (VER_PRODUCTBUILD >= 2195)
4667 IN HANDLE FileHandle
,
4668 OUT PIO_STATUS_BLOCK IoStatusBlock
4671 #endif /* (VER_PRODUCTBUILD >= 2195) */
4677 IN HANDLE EventHandle
4683 ZwCloseObjectAuditAlarm (
4684 IN PUNICODE_STRING SubsystemName
,
4686 IN BOOLEAN GenerateOnClose
4693 OUT PHANDLE SectionHandle
,
4694 IN ACCESS_MASK DesiredAccess
,
4695 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL
,
4696 IN PLARGE_INTEGER MaximumSize OPTIONAL
,
4697 IN ULONG SectionPageProtection
,
4698 IN ULONG AllocationAttributes
,
4699 IN HANDLE FileHandle OPTIONAL
4705 ZwCreateSymbolicLinkObject (
4706 OUT PHANDLE SymbolicLinkHandle
,
4707 IN ACCESS_MASK DesiredAccess
,
4708 IN POBJECT_ATTRIBUTES ObjectAttributes
,
4709 IN PUNICODE_STRING TargetName
4716 IN POBJECT_ATTRIBUTES ObjectAttributes
4724 IN PUNICODE_STRING Name
4730 ZwDeviceIoControlFile (
4731 IN HANDLE FileHandle
,
4732 IN HANDLE Event OPTIONAL
,
4733 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
4734 IN PVOID ApcContext OPTIONAL
,
4735 OUT PIO_STATUS_BLOCK IoStatusBlock
,
4736 IN ULONG IoControlCode
,
4737 IN PVOID InputBuffer OPTIONAL
,
4738 IN ULONG InputBufferLength
,
4739 OUT PVOID OutputBuffer OPTIONAL
,
4740 IN ULONG OutputBufferLength
4747 IN PUNICODE_STRING String
4754 IN HANDLE SourceProcessHandle
,
4755 IN HANDLE SourceHandle
,
4756 IN HANDLE TargetProcessHandle OPTIONAL
,
4757 OUT PHANDLE TargetHandle OPTIONAL
,
4758 IN ACCESS_MASK DesiredAccess
,
4759 IN ULONG HandleAttributes
,
4767 IN HANDLE ExistingTokenHandle
,
4768 IN ACCESS_MASK DesiredAccess
,
4769 IN POBJECT_ATTRIBUTES ObjectAttributes
,
4770 IN BOOLEAN EffectiveOnly
,
4771 IN TOKEN_TYPE TokenType
,
4772 OUT PHANDLE NewTokenHandle
4778 IN HANDLE ExistingTokenHandle
,
4780 IN PTOKEN_GROUPS SidsToDisable OPTIONAL
,
4781 IN PTOKEN_PRIVILEGES PrivilegesToDelete OPTIONAL
,
4782 IN PTOKEN_GROUPS RestrictedSids OPTIONAL
,
4783 OUT PHANDLE NewTokenHandle
4789 ZwFlushInstructionCache (
4790 IN HANDLE ProcessHandle
,
4791 IN PVOID BaseAddress OPTIONAL
,
4799 IN HANDLE FileHandle
,
4800 OUT PIO_STATUS_BLOCK IoStatusBlock
4803 #if (VER_PRODUCTBUILD >= 2195)
4808 ZwFlushVirtualMemory (
4809 IN HANDLE ProcessHandle
,
4810 IN OUT PVOID
*BaseAddress
,
4811 IN OUT PULONG FlushSize
,
4812 OUT PIO_STATUS_BLOCK IoStatusBlock
4815 #endif /* (VER_PRODUCTBUILD >= 2195) */
4820 ZwFreeVirtualMemory (
4821 IN HANDLE ProcessHandle
,
4822 IN OUT PVOID
*BaseAddress
,
4823 IN OUT PULONG RegionSize
,
4831 IN HANDLE FileHandle
,
4832 IN HANDLE Event OPTIONAL
,
4833 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
4834 IN PVOID ApcContext OPTIONAL
,
4835 OUT PIO_STATUS_BLOCK IoStatusBlock
,
4836 IN ULONG FsControlCode
,
4837 IN PVOID InputBuffer OPTIONAL
,
4838 IN ULONG InputBufferLength
,
4839 OUT PVOID OutputBuffer OPTIONAL
,
4840 IN ULONG OutputBufferLength
4843 #if (VER_PRODUCTBUILD >= 2195)
4848 ZwInitiatePowerAction (
4849 IN POWER_ACTION SystemAction
,
4850 IN SYSTEM_POWER_STATE MinSystemState
,
4852 IN BOOLEAN Asynchronous
4855 #endif /* (VER_PRODUCTBUILD >= 2195) */
4861 /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
4862 IN PUNICODE_STRING RegistryPath
4869 IN POBJECT_ATTRIBUTES KeyObjectAttributes
,
4870 IN POBJECT_ATTRIBUTES FileObjectAttributes
4877 IN HANDLE KeyHandle
,
4878 IN HANDLE EventHandle OPTIONAL
,
4879 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
4880 IN PVOID ApcContext OPTIONAL
,
4881 OUT PIO_STATUS_BLOCK IoStatusBlock
,
4882 IN ULONG NotifyFilter
,
4883 IN BOOLEAN WatchSubtree
,
4885 IN ULONG BufferLength
,
4886 IN BOOLEAN Asynchronous
4892 ZwOpenDirectoryObject (
4893 OUT PHANDLE DirectoryHandle
,
4894 IN ACCESS_MASK DesiredAccess
,
4895 IN POBJECT_ATTRIBUTES ObjectAttributes
4902 OUT PHANDLE EventHandle
,
4903 IN ACCESS_MASK DesiredAccess
,
4904 IN POBJECT_ATTRIBUTES ObjectAttributes
4911 OUT PHANDLE ProcessHandle
,
4912 IN ACCESS_MASK DesiredAccess
,
4913 IN POBJECT_ATTRIBUTES ObjectAttributes
,
4914 IN PCLIENT_ID ClientId OPTIONAL
4920 ZwOpenProcessToken (
4921 IN HANDLE ProcessHandle
,
4922 IN ACCESS_MASK DesiredAccess
,
4923 OUT PHANDLE TokenHandle
4930 OUT PHANDLE ThreadHandle
,
4931 IN ACCESS_MASK DesiredAccess
,
4932 IN POBJECT_ATTRIBUTES ObjectAttributes
,
4933 IN PCLIENT_ID ClientId
4940 IN HANDLE ThreadHandle
,
4941 IN ACCESS_MASK DesiredAccess
,
4942 IN BOOLEAN OpenAsSelf
,
4943 OUT PHANDLE TokenHandle
4946 #if (VER_PRODUCTBUILD >= 2195)
4951 ZwPowerInformation (
4952 IN POWER_INFORMATION_LEVEL PowerInformationLevel
,
4953 IN PVOID InputBuffer OPTIONAL
,
4954 IN ULONG InputBufferLength
,
4955 OUT PVOID OutputBuffer OPTIONAL
,
4956 IN ULONG OutputBufferLength
4959 #endif /* (VER_PRODUCTBUILD >= 2195) */
4965 IN HANDLE EventHandle
,
4966 OUT PLONG PreviousState OPTIONAL
4972 ZwQueryDefaultLocale (
4973 IN BOOLEAN ThreadOrSystem
,
4980 ZwQueryDirectoryFile (
4981 IN HANDLE FileHandle
,
4982 IN HANDLE Event OPTIONAL
,
4983 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
4984 IN PVOID ApcContext OPTIONAL
,
4985 OUT PIO_STATUS_BLOCK IoStatusBlock
,
4986 OUT PVOID FileInformation
,
4988 IN FILE_INFORMATION_CLASS FileInformationClass
,
4989 IN BOOLEAN ReturnSingleEntry
,
4990 IN PUNICODE_STRING FileName OPTIONAL
,
4991 IN BOOLEAN RestartScan
4994 #if (VER_PRODUCTBUILD >= 2195)
4999 ZwQueryDirectoryObject (
5000 IN HANDLE DirectoryHandle
,
5003 IN BOOLEAN ReturnSingleEntry
,
5004 IN BOOLEAN RestartScan
,
5005 IN OUT PULONG Context
,
5006 OUT PULONG ReturnLength OPTIONAL
5013 IN HANDLE FileHandle
,
5014 OUT PIO_STATUS_BLOCK IoStatusBlock
,
5017 IN BOOLEAN ReturnSingleEntry
,
5018 IN PVOID EaList OPTIONAL
,
5019 IN ULONG EaListLength
,
5020 IN PULONG EaIndex OPTIONAL
,
5021 IN BOOLEAN RestartScan
5024 #endif /* (VER_PRODUCTBUILD >= 2195) */
5029 ZwQueryInformationProcess (
5030 IN HANDLE ProcessHandle
,
5031 IN PROCESSINFOCLASS ProcessInformationClass
,
5032 OUT PVOID ProcessInformation
,
5033 IN ULONG ProcessInformationLength
,
5034 OUT PULONG ReturnLength OPTIONAL
5040 ZwQueryInformationToken (
5041 IN HANDLE TokenHandle
,
5042 IN TOKEN_INFORMATION_CLASS TokenInformationClass
,
5043 OUT PVOID TokenInformation
,
5045 OUT PULONG ResultLength
5051 ZwQuerySecurityObject (
5052 IN HANDLE FileHandle
,
5053 IN SECURITY_INFORMATION SecurityInformation
,
5054 OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
5056 OUT PULONG ResultLength
5062 ZwQueryVolumeInformationFile (
5063 IN HANDLE FileHandle
,
5064 OUT PIO_STATUS_BLOCK IoStatusBlock
,
5065 OUT PVOID FsInformation
,
5067 IN FS_INFORMATION_CLASS FsInformationClass
5074 IN POBJECT_ATTRIBUTES NewFileObjectAttributes
,
5075 IN HANDLE KeyHandle
,
5076 IN POBJECT_ATTRIBUTES OldFileObjectAttributes
5083 IN HANDLE EventHandle
,
5084 OUT PLONG PreviousState OPTIONAL
5087 #if (VER_PRODUCTBUILD >= 2195)
5093 IN HANDLE KeyHandle
,
5094 IN HANDLE FileHandle
,
5098 #endif /* (VER_PRODUCTBUILD >= 2195) */
5104 IN HANDLE KeyHandle
,
5105 IN HANDLE FileHandle
5111 ZwSetDefaultLocale (
5112 IN BOOLEAN ThreadOrSystem
,
5116 #if (VER_PRODUCTBUILD >= 2195)
5121 ZwSetDefaultUILanguage (
5122 IN LANGID LanguageId
5129 IN HANDLE FileHandle
,
5130 OUT PIO_STATUS_BLOCK IoStatusBlock
,
5135 #endif /* (VER_PRODUCTBUILD >= 2195) */
5141 IN HANDLE EventHandle
,
5142 OUT PLONG PreviousState OPTIONAL
5148 ZwSetInformationProcess (
5149 IN HANDLE ProcessHandle
,
5150 IN PROCESSINFOCLASS ProcessInformationClass
,
5151 IN PVOID ProcessInformation
,
5152 IN ULONG ProcessInformationLength
5155 #if (VER_PRODUCTBUILD >= 2195)
5160 ZwSetSecurityObject (
5162 IN SECURITY_INFORMATION SecurityInformation
,
5163 IN PSECURITY_DESCRIPTOR SecurityDescriptor
5166 #endif /* (VER_PRODUCTBUILD >= 2195) */
5172 IN PLARGE_INTEGER NewTime
,
5173 OUT PLARGE_INTEGER OldTime OPTIONAL
5176 #if (VER_PRODUCTBUILD >= 2195)
5181 ZwSetVolumeInformationFile (
5182 IN HANDLE FileHandle
,
5183 OUT PIO_STATUS_BLOCK IoStatusBlock
,
5184 IN PVOID FsInformation
,
5186 IN FS_INFORMATION_CLASS FsInformationClass
5189 #endif /* (VER_PRODUCTBUILD >= 2195) */
5194 ZwTerminateProcess (
5195 IN HANDLE ProcessHandle OPTIONAL
,
5196 IN NTSTATUS ExitStatus
5203 /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
5204 IN PUNICODE_STRING RegistryPath
5211 IN POBJECT_ATTRIBUTES KeyObjectAttributes
5217 ZwWaitForSingleObject (
5219 IN BOOLEAN Alertable
,
5220 IN PLARGE_INTEGER Timeout OPTIONAL
5226 ZwWaitForMultipleObjects (
5227 IN ULONG HandleCount
,
5229 IN WAIT_TYPE WaitType
,
5230 IN BOOLEAN Alertable
,
5231 IN PLARGE_INTEGER Timeout OPTIONAL
5247 #endif /* _NTIFS_ */