4 * Windows NT Filesystem Driver Developer Kit
6 * This file is part of the w32api package.
9 * Created by Bo Brantén <bosse@acc.umu.se>
11 * THIS SOFTWARE IS NOT COPYRIGHTED
13 * This source code is offered for use in the public domain. You may
14 * use, modify or distribute it freely.
16 * This code is distributed in the hope that it will be useful but
17 * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
18 * DISCLAIMED. This includes but is not limited to warranties of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
28 #pragma GCC system_header
32 /* HACKHACKHACK!!! We shouldn't include this header from ntoskrnl! */
35 #define NTKERNELAPI DECLSPEC_IMPORT
40 #define _NTIFS_INCLUDED_
47 #ifndef VER_PRODUCTBUILD
48 #define VER_PRODUCTBUILD 10000
55 #define EX_PUSH_LOCK ULONG_PTR
56 #define PEX_PUSH_LOCK PULONG_PTR
60 typedef struct _SE_EXPORTS
*PSE_EXPORTS
;
63 extern PUCHAR FsRtlLegalAnsiCharacterArray
;
65 extern DECLSPEC_IMPORT PUCHAR FsRtlLegalAnsiCharacterArray
;
67 extern PSE_EXPORTS SeExports
;
68 extern PACL SePublicDefaultDacl
;
69 extern PACL SeSystemDefaultDacl
;
71 extern KSPIN_LOCK IoStatisticsLock
;
72 extern ULONG IoReadOperationCount
;
73 extern ULONG IoWriteOperationCount
;
74 extern ULONG IoOtherOperationCount
;
75 extern LARGE_INTEGER IoReadTransferCount
;
76 extern LARGE_INTEGER IoWriteTransferCount
;
77 extern LARGE_INTEGER IoOtherTransferCount
;
79 typedef STRING LSA_STRING
, *PLSA_STRING
;
80 typedef ULONG LSA_OPERATIONAL_MODE
, *PLSA_OPERATIONAL_MODE
;
82 typedef enum _SECURITY_LOGON_TYPE
84 UndefinedLogonType
= 0,
93 #if (_WIN32_WINNT >= 0x0501)
97 #if (_WIN32_WINNT >= 0x0502)
98 CachedRemoteInteractive
,
101 } SECURITY_LOGON_TYPE
, *PSECURITY_LOGON_TYPE
;
103 #define ANSI_DOS_STAR ('<')
104 #define ANSI_DOS_QM ('>')
105 #define ANSI_DOS_DOT ('"')
107 #define DOS_STAR (L'<')
108 #define DOS_QM (L'>')
109 #define DOS_DOT (L'"')
111 /* also in winnt.h */
112 #define ACCESS_MIN_MS_ACE_TYPE (0x0)
113 #define ACCESS_ALLOWED_ACE_TYPE (0x0)
114 #define ACCESS_DENIED_ACE_TYPE (0x1)
115 #define SYSTEM_AUDIT_ACE_TYPE (0x2)
116 #define SYSTEM_ALARM_ACE_TYPE (0x3)
117 #define ACCESS_MAX_MS_V2_ACE_TYPE (0x3)
118 #define ACCESS_ALLOWED_COMPOUND_ACE_TYPE (0x4)
119 #define ACCESS_MAX_MS_V3_ACE_TYPE (0x4)
120 #define ACCESS_MIN_MS_OBJECT_ACE_TYPE (0x5)
121 #define ACCESS_ALLOWED_OBJECT_ACE_TYPE (0x5)
122 #define ACCESS_DENIED_OBJECT_ACE_TYPE (0x6)
123 #define SYSTEM_AUDIT_OBJECT_ACE_TYPE (0x7)
124 #define SYSTEM_ALARM_OBJECT_ACE_TYPE (0x8)
125 #define ACCESS_MAX_MS_OBJECT_ACE_TYPE (0x8)
126 #define ACCESS_MAX_MS_V4_ACE_TYPE (0x8)
127 #define ACCESS_MAX_MS_ACE_TYPE (0x8)
128 #define ACCESS_ALLOWED_CALLBACK_ACE_TYPE (0x9)
129 #define ACCESS_DENIED_CALLBACK_ACE_TYPE (0xA)
130 #define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE (0xB)
131 #define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE (0xC)
132 #define SYSTEM_AUDIT_CALLBACK_ACE_TYPE (0xD)
133 #define SYSTEM_ALARM_CALLBACK_ACE_TYPE (0xE)
134 #define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE (0xF)
135 #define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE (0x10)
136 #define ACCESS_MAX_MS_V5_ACE_TYPE (0x10)
138 #define COMPRESSION_FORMAT_NONE (0x0000)
139 #define COMPRESSION_FORMAT_DEFAULT (0x0001)
140 #define COMPRESSION_FORMAT_LZNT1 (0x0002)
141 #define COMPRESSION_ENGINE_STANDARD (0x0000)
142 #define COMPRESSION_ENGINE_MAXIMUM (0x0100)
143 #define COMPRESSION_ENGINE_HIBER (0x0200)
145 #define FILE_ACTION_ADDED 0x00000001
146 #define FILE_ACTION_REMOVED 0x00000002
147 #define FILE_ACTION_MODIFIED 0x00000003
148 #define FILE_ACTION_RENAMED_OLD_NAME 0x00000004
149 #define FILE_ACTION_RENAMED_NEW_NAME 0x00000005
150 #define FILE_ACTION_ADDED_STREAM 0x00000006
151 #define FILE_ACTION_REMOVED_STREAM 0x00000007
152 #define FILE_ACTION_MODIFIED_STREAM 0x00000008
153 #define FILE_ACTION_REMOVED_BY_DELETE 0x00000009
154 #define FILE_ACTION_ID_NOT_TUNNELLED 0x0000000A
155 #define FILE_ACTION_TUNNELLED_ID_COLLISION 0x0000000B
158 #define FILE_EA_TYPE_BINARY 0xfffe
159 #define FILE_EA_TYPE_ASCII 0xfffd
160 #define FILE_EA_TYPE_BITMAP 0xfffb
161 #define FILE_EA_TYPE_METAFILE 0xfffa
162 #define FILE_EA_TYPE_ICON 0xfff9
163 #define FILE_EA_TYPE_EA 0xffee
164 #define FILE_EA_TYPE_MVMT 0xffdf
165 #define FILE_EA_TYPE_MVST 0xffde
166 #define FILE_EA_TYPE_ASN1 0xffdd
167 #define FILE_EA_TYPE_FAMILY_IDS 0xff01
169 #define FILE_NEED_EA 0x00000080
171 /* also in winnt.h */
172 #define FILE_NOTIFY_CHANGE_FILE_NAME 0x00000001
173 #define FILE_NOTIFY_CHANGE_DIR_NAME 0x00000002
174 #define FILE_NOTIFY_CHANGE_NAME 0x00000003
175 #define FILE_NOTIFY_CHANGE_ATTRIBUTES 0x00000004
176 #define FILE_NOTIFY_CHANGE_SIZE 0x00000008
177 #define FILE_NOTIFY_CHANGE_LAST_WRITE 0x00000010
178 #define FILE_NOTIFY_CHANGE_LAST_ACCESS 0x00000020
179 #define FILE_NOTIFY_CHANGE_CREATION 0x00000040
180 #define FILE_NOTIFY_CHANGE_EA 0x00000080
181 #define FILE_NOTIFY_CHANGE_SECURITY 0x00000100
182 #define FILE_NOTIFY_CHANGE_STREAM_NAME 0x00000200
183 #define FILE_NOTIFY_CHANGE_STREAM_SIZE 0x00000400
184 #define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
185 #define FILE_NOTIFY_VALID_MASK 0x00000fff
188 #define FILE_OPLOCK_BROKEN_TO_LEVEL_2 0x00000007
189 #define FILE_OPLOCK_BROKEN_TO_NONE 0x00000008
191 #define FILE_OPBATCH_BREAK_UNDERWAY 0x00000009
193 #define FILE_CASE_SENSITIVE_SEARCH 0x00000001
194 #define FILE_CASE_PRESERVED_NAMES 0x00000002
195 #define FILE_UNICODE_ON_DISK 0x00000004
196 #define FILE_PERSISTENT_ACLS 0x00000008
197 #define FILE_FILE_COMPRESSION 0x00000010
198 #define FILE_VOLUME_QUOTAS 0x00000020
199 #define FILE_SUPPORTS_SPARSE_FILES 0x00000040
200 #define FILE_SUPPORTS_REPARSE_POINTS 0x00000080
201 #define FILE_SUPPORTS_REMOTE_STORAGE 0x00000100
202 #define FS_LFN_APIS 0x00004000
203 #define FILE_VOLUME_IS_COMPRESSED 0x00008000
204 #define FILE_SUPPORTS_OBJECT_IDS 0x00010000
205 #define FILE_SUPPORTS_ENCRYPTION 0x00020000
206 #define FILE_NAMED_STREAMS 0x00040000
208 #define FILE_PIPE_BYTE_STREAM_TYPE 0x00000000
209 #define FILE_PIPE_MESSAGE_TYPE 0x00000001
211 #define FILE_PIPE_BYTE_STREAM_MODE 0x00000000
212 #define FILE_PIPE_MESSAGE_MODE 0x00000001
214 #define FILE_PIPE_QUEUE_OPERATION 0x00000000
215 #define FILE_PIPE_COMPLETE_OPERATION 0x00000001
217 #define FILE_PIPE_INBOUND 0x00000000
218 #define FILE_PIPE_OUTBOUND 0x00000001
219 #define FILE_PIPE_FULL_DUPLEX 0x00000002
221 #define FILE_PIPE_DISCONNECTED_STATE 0x00000001
222 #define FILE_PIPE_LISTENING_STATE 0x00000002
223 #define FILE_PIPE_CONNECTED_STATE 0x00000003
224 #define FILE_PIPE_CLOSING_STATE 0x00000004
226 #define FILE_PIPE_CLIENT_END 0x00000000
227 #define FILE_PIPE_SERVER_END 0x00000001
229 #define FILE_PIPE_READ_DATA 0x00000000
230 #define FILE_PIPE_WRITE_SPACE 0x00000001
232 #define FILE_STORAGE_TYPE_SPECIFIED 0x00000041 /* FILE_DIRECTORY_FILE | FILE_NON_DIRECTORY_FILE */
233 #define FILE_STORAGE_TYPE_DEFAULT (StorageTypeDefault << FILE_STORAGE_TYPE_SHIFT)
234 #define FILE_STORAGE_TYPE_DIRECTORY (StorageTypeDirectory << FILE_STORAGE_TYPE_SHIFT)
235 #define FILE_STORAGE_TYPE_FILE (StorageTypeFile << FILE_STORAGE_TYPE_SHIFT)
236 #define FILE_STORAGE_TYPE_DOCFILE (StorageTypeDocfile << FILE_STORAGE_TYPE_SHIFT)
237 #define FILE_STORAGE_TYPE_JUNCTION_POINT (StorageTypeJunctionPoint << FILE_STORAGE_TYPE_SHIFT)
238 #define FILE_STORAGE_TYPE_CATALOG (StorageTypeCatalog << FILE_STORAGE_TYPE_SHIFT)
239 #define FILE_STORAGE_TYPE_STRUCTURED_STORAGE (StorageTypeStructuredStorage << FILE_STORAGE_TYPE_SHIFT)
240 #define FILE_STORAGE_TYPE_EMBEDDING (StorageTypeEmbedding << FILE_STORAGE_TYPE_SHIFT)
241 #define FILE_STORAGE_TYPE_STREAM (StorageTypeStream << FILE_STORAGE_TYPE_SHIFT)
242 #define FILE_MINIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_DEFAULT
243 #define FILE_MAXIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_STREAM
244 #define FILE_STORAGE_TYPE_MASK 0x000f0000
245 #define FILE_STORAGE_TYPE_SHIFT 16
247 #define FILE_VC_QUOTA_NONE 0x00000000
248 #define FILE_VC_QUOTA_TRACK 0x00000001
249 #define FILE_VC_QUOTA_ENFORCE 0x00000002
250 #define FILE_VC_QUOTA_MASK 0x00000003
252 #define FILE_VC_QUOTAS_LOG_VIOLATIONS 0x00000004
253 #define FILE_VC_CONTENT_INDEX_DISABLED 0x00000008
255 #define FILE_VC_LOG_QUOTA_THRESHOLD 0x00000010
256 #define FILE_VC_LOG_QUOTA_LIMIT 0x00000020
257 #define FILE_VC_LOG_VOLUME_THRESHOLD 0x00000040
258 #define FILE_VC_LOG_VOLUME_LIMIT 0x00000080
260 #define FILE_VC_QUOTAS_INCOMPLETE 0x00000100
261 #define FILE_VC_QUOTAS_REBUILDING 0x00000200
263 #define FILE_VC_VALID_MASK 0x000003ff
265 #define FSRTL_FLAG_FILE_MODIFIED (0x01)
266 #define FSRTL_FLAG_FILE_LENGTH_CHANGED (0x02)
267 #define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04)
268 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08)
269 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10)
270 #define FSRTL_FLAG_USER_MAPPED_FILE (0x20)
271 #define FSRTL_FLAG_EOF_ADVANCE_ACTIVE (0x80)
273 #define FSRTL_FLAG2_DO_MODIFIED_WRITE (0x01)
275 #define FSRTL_FSP_TOP_LEVEL_IRP (0x01)
276 #define FSRTL_CACHE_TOP_LEVEL_IRP (0x02)
277 #define FSRTL_MOD_WRITE_TOP_LEVEL_IRP (0x03)
278 #define FSRTL_FAST_IO_TOP_LEVEL_IRP (0x04)
279 #define FSRTL_MAX_TOP_LEVEL_IRP_FLAG (0x04)
281 #define FSRTL_VOLUME_DISMOUNT 1
282 #define FSRTL_VOLUME_DISMOUNT_FAILED 2
283 #define FSRTL_VOLUME_LOCK 3
284 #define FSRTL_VOLUME_LOCK_FAILED 4
285 #define FSRTL_VOLUME_UNLOCK 5
286 #define FSRTL_VOLUME_MOUNT 6
288 #define FSRTL_WILD_CHARACTER 0x08
290 #define FSRTL_FAT_LEGAL 0x01
291 #define FSRTL_HPFS_LEGAL 0x02
292 #define FSRTL_NTFS_LEGAL 0x04
293 #define FSRTL_WILD_CHARACTER 0x08
294 #define FSRTL_OLE_LEGAL 0x10
295 #define FSRTL_NTFS_STREAM_LEGAL 0x14
298 #define HARDWARE_PTE HARDWARE_PTE_X86
299 #define PHARDWARE_PTE PHARDWARE_PTE_X86
302 #define IO_CHECK_CREATE_PARAMETERS 0x0200
303 #define IO_ATTACH_DEVICE 0x0400
305 #define IO_ATTACH_DEVICE_API 0x80000000
307 #define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE 64
308 #define IO_FILE_OBJECT_PAGED_POOL_CHARGE 1024
310 #define IO_TYPE_APC 18
311 #define IO_TYPE_DPC 19
312 #define IO_TYPE_DEVICE_QUEUE 20
313 #define IO_TYPE_EVENT_PAIR 21
314 #define IO_TYPE_INTERRUPT 22
315 #define IO_TYPE_PROFILE 23
317 #define IRP_BEING_VERIFIED 0x10
319 #define MAILSLOT_CLASS_FIRSTCLASS 1
320 #define MAILSLOT_CLASS_SECONDCLASS 2
322 #define MAILSLOT_SIZE_AUTO 0
324 #define MAP_PROCESS 1L
325 #define MAP_SYSTEM 2L
326 #define MEM_DOS_LIM 0x40000000
328 #define OB_TYPE_TYPE 1
329 #define OB_TYPE_DIRECTORY 2
330 #define OB_TYPE_SYMBOLIC_LINK 3
331 #define OB_TYPE_TOKEN 4
332 #define OB_TYPE_PROCESS 5
333 #define OB_TYPE_THREAD 6
334 #define OB_TYPE_EVENT 7
335 #define OB_TYPE_EVENT_PAIR 8
336 #define OB_TYPE_MUTANT 9
337 #define OB_TYPE_SEMAPHORE 10
338 #define OB_TYPE_TIMER 11
339 #define OB_TYPE_PROFILE 12
340 #define OB_TYPE_WINDOW_STATION 13
341 #define OB_TYPE_DESKTOP 14
342 #define OB_TYPE_SECTION 15
343 #define OB_TYPE_KEY 16
344 #define OB_TYPE_PORT 17
345 #define OB_TYPE_ADAPTER 18
346 #define OB_TYPE_CONTROLLER 19
347 #define OB_TYPE_DEVICE 20
348 #define OB_TYPE_DRIVER 21
349 #define OB_TYPE_IO_COMPLETION 22
350 #define OB_TYPE_FILE 23
353 #define PIN_EXCLUSIVE (2)
354 #define PIN_NO_READ (4)
355 #define PIN_IF_BCB (8)
357 #define RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE 1
358 #define RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING 2
360 #define SEC_BASED 0x00200000
362 #define SECURITY_WORLD_SID_AUTHORITY {0,0,0,0,0,1}
363 #define SECURITY_WORLD_RID (0x00000000L)
365 #define SID_REVISION 1
366 #define SID_MAX_SUB_AUTHORITIES 15
367 #define SID_RECOMMENDED_SUB_AUTHORITIES 1
369 #define TOKEN_ASSIGN_PRIMARY (0x0001)
370 #define TOKEN_DUPLICATE (0x0002)
371 #define TOKEN_IMPERSONATE (0x0004)
372 #define TOKEN_QUERY (0x0008)
373 #define TOKEN_QUERY_SOURCE (0x0010)
374 #define TOKEN_ADJUST_PRIVILEGES (0x0020)
375 #define TOKEN_ADJUST_GROUPS (0x0040)
376 #define TOKEN_ADJUST_DEFAULT (0x0080)
377 #define TOKEN_ADJUST_SESSIONID (0x0100)
379 #define TOKEN_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED |\
380 TOKEN_ASSIGN_PRIMARY |\
384 TOKEN_QUERY_SOURCE |\
385 TOKEN_ADJUST_PRIVILEGES |\
386 TOKEN_ADJUST_GROUPS |\
387 TOKEN_ADJUST_DEFAULT |\
388 TOKEN_ADJUST_SESSIONID)
390 #define TOKEN_READ (STANDARD_RIGHTS_READ |\
393 #define TOKEN_WRITE (STANDARD_RIGHTS_WRITE |\
394 TOKEN_ADJUST_PRIVILEGES |\
395 TOKEN_ADJUST_GROUPS |\
396 TOKEN_ADJUST_DEFAULT)
398 #define TOKEN_EXECUTE (STANDARD_RIGHTS_EXECUTE)
400 #define TOKEN_SOURCE_LENGTH 8
403 #define TOKEN_HAS_TRAVERSE_PRIVILEGE 0x01
404 #define TOKEN_HAS_BACKUP_PRIVILEGE 0x02
405 #define TOKEN_HAS_RESTORE_PRIVILEGE 0x04
406 #define TOKEN_HAS_ADMIN_GROUP 0x08
407 #define TOKEN_WRITE_RESTRICTED 0x08
408 #define TOKEN_IS_RESTRICTED 0x10
409 #define SE_BACKUP_PRIVILEGES_CHECKED 0x0100
411 #define VACB_MAPPING_GRANULARITY (0x40000)
412 #define VACB_OFFSET_SHIFT (18)
414 #define SE_OWNER_DEFAULTED 0x0001
415 #define SE_GROUP_DEFAULTED 0x0002
416 #define SE_DACL_PRESENT 0x0004
417 #define SE_DACL_DEFAULTED 0x0008
418 #define SE_SACL_PRESENT 0x0010
419 #define SE_SACL_DEFAULTED 0x0020
420 #define SE_DACL_UNTRUSTED 0x0040
421 #define SE_SERVER_SECURITY 0x0080
422 #define SE_DACL_AUTO_INHERIT_REQ 0x0100
423 #define SE_SACL_AUTO_INHERIT_REQ 0x0200
424 #define SE_DACL_AUTO_INHERITED 0x0400
425 #define SE_SACL_AUTO_INHERITED 0x0800
426 #define SE_DACL_PROTECTED 0x1000
427 #define SE_SACL_PROTECTED 0x2000
428 #define SE_RM_CONTROL_VALID 0x4000
429 #define SE_SELF_RELATIVE 0x8000
432 #define _AUDIT_EVENT_TYPE_HACK 0
434 #if (_AUDIT_EVENT_TYPE_HACK == 1)
437 typedef enum _AUDIT_EVENT_TYPE
439 AuditEventObjectAccess
,
440 AuditEventDirectoryServiceAccess
441 } AUDIT_EVENT_TYPE
, *PAUDIT_EVENT_TYPE
;
444 #define AUDIT_ALLOW_NO_PRIVILEGE 0x1
446 #define FSCTL_REQUEST_OPLOCK_LEVEL_1 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
447 #define FSCTL_REQUEST_OPLOCK_LEVEL_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
448 #define FSCTL_REQUEST_BATCH_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
449 #define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 3, METHOD_BUFFERED, FILE_ANY_ACCESS)
450 #define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
451 #define FSCTL_OPLOCK_BREAK_NOTIFY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 5, METHOD_BUFFERED, FILE_ANY_ACCESS)
452 #define FSCTL_LOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
453 #define FSCTL_UNLOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
454 #define FSCTL_DISMOUNT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
456 #define FSCTL_IS_VOLUME_MOUNTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
457 #define FSCTL_IS_PATHNAME_VALID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
458 #define FSCTL_MARK_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
460 #define FSCTL_QUERY_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER, FILE_ANY_ACCESS)
461 #define FSCTL_GET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
462 #define FSCTL_SET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
465 #define FSCTL_MARK_AS_SYSTEM_HIVE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS)
466 #define FSCTL_OPLOCK_BREAK_ACK_NO_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
467 #define FSCTL_INVALIDATE_VOLUMES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
468 #define FSCTL_QUERY_FAT_BPB CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS)
469 #define FSCTL_REQUEST_FILTER_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
470 #define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS)
472 #if (VER_PRODUCTBUILD >= 1381)
474 #define FSCTL_GET_NTFS_VOLUME_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS)
475 #define FSCTL_GET_NTFS_FILE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS)
476 #define FSCTL_GET_VOLUME_BITMAP CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER, FILE_ANY_ACCESS)
477 #define FSCTL_GET_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER, FILE_ANY_ACCESS)
478 #define FSCTL_MOVE_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_ANY_ACCESS)
479 #define FSCTL_IS_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
480 #define FSCTL_GET_HFS_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS)
481 #define FSCTL_ALLOW_EXTENDED_DASD_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER, FILE_ANY_ACCESS)
483 #endif /* (VER_PRODUCTBUILD >= 1381) */
485 #if (VER_PRODUCTBUILD >= 2195)
487 #define FSCTL_READ_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 33, METHOD_NEITHER, FILE_ANY_ACCESS)
488 #define FSCTL_WRITE_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 34, METHOD_NEITHER, FILE_ANY_ACCESS)
489 #define FSCTL_FIND_FILES_BY_SID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS)
491 #define FSCTL_DUMP_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 37, METHOD_NEITHER, FILE_ANY_ACCESS)
492 #define FSCTL_SET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_WRITE_DATA)
493 #define FSCTL_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS)
494 #define FSCTL_DELETE_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_WRITE_DATA)
495 #define FSCTL_SET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_WRITE_DATA)
496 #define FSCTL_GET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS)
497 #define FSCTL_DELETE_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_WRITE_DATA)
498 #define FSCTL_ENUM_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER, FILE_READ_DATA)
499 #define FSCTL_SECURITY_ID_CHECK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45, METHOD_NEITHER, FILE_READ_DATA)
500 #define FSCTL_READ_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46, METHOD_NEITHER, FILE_READ_DATA)
501 #define FSCTL_SET_OBJECT_ID_EXTENDED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_WRITE_DATA)
502 #define FSCTL_CREATE_OR_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS)
503 #define FSCTL_SET_SPARSE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_WRITE_DATA)
504 #define FSCTL_SET_ZERO_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA)
505 #define FSCTL_QUERY_ALLOCATED_RANGES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51, METHOD_NEITHER, FILE_READ_DATA)
506 #define FSCTL_ENABLE_UPGRADE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA)
507 #define FSCTL_SET_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_BUFFERED, FILE_ANY_ACCESS)
508 #define FSCTL_ENCRYPTION_FSCTL_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54, METHOD_NEITHER, FILE_ANY_ACCESS)
509 #define FSCTL_WRITE_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55, METHOD_NEITHER, FILE_ANY_ACCESS)
510 #define FSCTL_READ_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56, METHOD_NEITHER, FILE_ANY_ACCESS)
511 #define FSCTL_CREATE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57, METHOD_NEITHER, FILE_READ_DATA)
512 #define FSCTL_READ_FILE_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58, METHOD_NEITHER, FILE_READ_DATA)
513 #define FSCTL_WRITE_USN_CLOSE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59, METHOD_NEITHER, FILE_READ_DATA)
514 #define FSCTL_EXTEND_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
515 #define FSCTL_QUERY_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
516 #define FSCTL_DELETE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
517 #define FSCTL_MARK_HANDLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS)
518 #define FSCTL_SIS_COPYFILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS)
519 #define FSCTL_SIS_LINK_FILES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
520 #define FSCTL_HSM_MSG CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
521 #define FSCTL_NSS_CONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 67, METHOD_BUFFERED, FILE_WRITE_DATA)
522 #define FSCTL_HSM_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
523 #define FSCTL_RECALL_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS)
524 #define FSCTL_NSS_RCONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 70, METHOD_BUFFERED, FILE_READ_DATA)
525 #define FSCTL_READ_FROM_PLEX CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA)
526 #define FSCTL_FILE_PREFETCH CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
528 #endif /* (VER_PRODUCTBUILD >= 2195) */
530 #define FSCTL_MAILSLOT_PEEK CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)
532 #define FSCTL_NETWORK_SET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 102, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
533 #define FSCTL_NETWORK_GET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 103, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
534 #define FSCTL_NETWORK_GET_CONNECTION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 104, METHOD_NEITHER, FILE_ANY_ACCESS)
535 #define FSCTL_NETWORK_ENUMERATE_CONNECTIONS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 105, METHOD_NEITHER, FILE_ANY_ACCESS)
536 #define FSCTL_NETWORK_DELETE_CONNECTION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 107, METHOD_BUFFERED, FILE_ANY_ACCESS)
537 #define FSCTL_NETWORK_GET_STATISTICS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 116, METHOD_BUFFERED, FILE_ANY_ACCESS)
538 #define FSCTL_NETWORK_SET_DOMAIN_NAME CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_ANY_ACCESS)
539 #define FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_ANY_ACCESS)
541 #define FSCTL_PIPE_ASSIGN_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
542 #define FSCTL_PIPE_DISCONNECT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
543 #define FSCTL_PIPE_LISTEN CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
544 #define FSCTL_PIPE_PEEK CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
545 #define FSCTL_PIPE_QUERY_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
546 #define FSCTL_PIPE_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
547 #define FSCTL_PIPE_WAIT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
548 #define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
549 #define FSCTL_PIPE_SET_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
550 #define FSCTL_PIPE_QUERY_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
551 #define FSCTL_PIPE_INTERNAL_READ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
552 #define FSCTL_PIPE_INTERNAL_WRITE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
553 #define FSCTL_PIPE_INTERNAL_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
554 #define FSCTL_PIPE_INTERNAL_READ_OVFLOW CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
556 #define IOCTL_REDIR_QUERY_PATH CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
558 typedef PVOID OPLOCK
, *POPLOCK
;
560 typedef struct _CACHE_MANAGER_CALLBACKS
*PCACHE_MANAGER_CALLBACKS
;
561 typedef struct _FILE_GET_QUOTA_INFORMATION
*PFILE_GET_QUOTA_INFORMATION
;
562 typedef struct _HANDLE_TABLE
*PHANDLE_TABLE
;
563 typedef struct _KPROCESS
*PKPROCESS
;
564 typedef struct _KQUEUE
*PKQUEUE
;
565 typedef struct _KTRAP_FRAME
*PKTRAP_FRAME
;
566 typedef struct _OBJECT_DIRECTORY
*POBJECT_DIRECTORY
;
567 typedef struct _SHARED_CACHE_MAP
*PSHARED_CACHE_MAP
;
568 typedef struct _VACB
*PVACB
;
569 typedef struct _VAD_HEADER
*PVAD_HEADER
;
577 typedef struct _NOTIFY_SYNC
590 } NOTIFY_SYNC
, * PNOTIFY_SYNC
;
592 typedef enum _FAST_IO_POSSIBLE
{
598 typedef enum _FILE_STORAGE_TYPE
{
599 StorageTypeDefault
= 1,
600 StorageTypeDirectory
,
602 StorageTypeJunctionPoint
,
604 StorageTypeStructuredStorage
,
605 StorageTypeEmbedding
,
609 typedef enum _OBJECT_INFORMATION_CLASS
611 ObjectBasicInformation
,
612 ObjectNameInformation
,
613 ObjectTypeInformation
,
614 ObjectTypesInformation
,
615 ObjectHandleFlagInformation
,
616 ObjectSessionInformation
,
618 } OBJECT_INFORMATION_CLASS
;
620 typedef struct _OBJECT_BASIC_INFORMATION
623 ACCESS_MASK GrantedAccess
;
626 ULONG PagedPoolCharge
;
627 ULONG NonPagedPoolCharge
;
631 ULONG SecurityDescriptorSize
;
632 LARGE_INTEGER CreationTime
;
633 } OBJECT_BASIC_INFORMATION
, *POBJECT_BASIC_INFORMATION
;
635 typedef struct _KAPC_STATE
{
636 LIST_ENTRY ApcListHead
[2];
638 BOOLEAN KernelApcInProgress
;
639 BOOLEAN KernelApcPending
;
640 BOOLEAN UserApcPending
;
641 } KAPC_STATE
, *PKAPC_STATE
, *RESTRICTED_POINTER PRKAPC_STATE
;
642 #define KAPC_STATE_ACTUAL_LENGTH (FIELD_OFFSET(KAPC_STATE, UserApcPending) + sizeof(BOOLEAN))
644 typedef struct _BITMAP_RANGE
{
647 ULONG FirstDirtyPage
;
651 } BITMAP_RANGE
, *PBITMAP_RANGE
;
653 typedef struct _CACHE_UNINITIALIZE_EVENT
{
654 struct _CACHE_UNINITIALIZE_EVENT
*Next
;
656 } CACHE_UNINITIALIZE_EVENT
, *PCACHE_UNINITIALIZE_EVENT
;
658 typedef struct _CC_FILE_SIZES
{
659 LARGE_INTEGER AllocationSize
;
660 LARGE_INTEGER FileSize
;
661 LARGE_INTEGER ValidDataLength
;
662 } CC_FILE_SIZES
, *PCC_FILE_SIZES
;
664 typedef struct _COMPRESSED_DATA_INFO
{
665 USHORT CompressionFormatAndEngine
;
666 UCHAR CompressionUnitShift
;
670 USHORT NumberOfChunks
;
671 ULONG CompressedChunkSizes
[ANYSIZE_ARRAY
];
672 } COMPRESSED_DATA_INFO
, *PCOMPRESSED_DATA_INFO
;
674 typedef struct _SID_IDENTIFIER_AUTHORITY
{
676 } SID_IDENTIFIER_AUTHORITY
,*PSID_IDENTIFIER_AUTHORITY
,*LPSID_IDENTIFIER_AUTHORITY
;
678 typedef struct _SID
{
680 BYTE SubAuthorityCount
;
681 SID_IDENTIFIER_AUTHORITY IdentifierAuthority
;
682 DWORD SubAuthority
[ANYSIZE_ARRAY
];
684 typedef struct _SID_AND_ATTRIBUTES
{
687 } SID_AND_ATTRIBUTES
, *PSID_AND_ATTRIBUTES
;
688 typedef SID_AND_ATTRIBUTES SID_AND_ATTRIBUTES_ARRAY
[ANYSIZE_ARRAY
];
689 typedef SID_AND_ATTRIBUTES_ARRAY
*PSID_AND_ATTRIBUTES_ARRAY
;
690 typedef struct _TOKEN_SOURCE
{
691 CHAR SourceName
[TOKEN_SOURCE_LENGTH
];
692 LUID SourceIdentifier
;
693 } TOKEN_SOURCE
,*PTOKEN_SOURCE
;
694 typedef struct _TOKEN_CONTROL
{
696 LUID AuthenticationId
;
698 TOKEN_SOURCE TokenSource
;
699 } TOKEN_CONTROL
,*PTOKEN_CONTROL
;
700 typedef struct _TOKEN_DEFAULT_DACL
{
702 } TOKEN_DEFAULT_DACL
,*PTOKEN_DEFAULT_DACL
;
703 typedef struct _TOKEN_GROUPS
{
705 SID_AND_ATTRIBUTES Groups
[ANYSIZE_ARRAY
];
706 } TOKEN_GROUPS
,*PTOKEN_GROUPS
,*LPTOKEN_GROUPS
;
707 typedef struct _TOKEN_GROUPS_AND_PRIVILEGES
{
710 PSID_AND_ATTRIBUTES Sids
;
711 ULONG RestrictedSidCount
;
712 ULONG RestrictedSidLength
;
713 PSID_AND_ATTRIBUTES RestrictedSids
;
714 ULONG PrivilegeCount
;
715 ULONG PrivilegeLength
;
716 PLUID_AND_ATTRIBUTES Privileges
;
717 LUID AuthenticationId
;
718 } TOKEN_GROUPS_AND_PRIVILEGES
, *PTOKEN_GROUPS_AND_PRIVILEGES
;
719 typedef struct _TOKEN_ORIGIN
{
720 LUID OriginatingLogonSession
;
721 } TOKEN_ORIGIN
, *PTOKEN_ORIGIN
;
722 typedef struct _TOKEN_OWNER
{
724 } TOKEN_OWNER
,*PTOKEN_OWNER
;
725 typedef struct _TOKEN_PRIMARY_GROUP
{
727 } TOKEN_PRIMARY_GROUP
,*PTOKEN_PRIMARY_GROUP
;
728 typedef struct _TOKEN_PRIVILEGES
{
729 DWORD PrivilegeCount
;
730 LUID_AND_ATTRIBUTES Privileges
[ANYSIZE_ARRAY
];
731 } TOKEN_PRIVILEGES
,*PTOKEN_PRIVILEGES
,*LPTOKEN_PRIVILEGES
;
732 typedef enum tagTOKEN_TYPE
{
735 } TOKEN_TYPE
,*PTOKEN_TYPE
;
736 typedef struct _TOKEN_STATISTICS
{
738 LUID AuthenticationId
;
739 LARGE_INTEGER ExpirationTime
;
740 TOKEN_TYPE TokenType
;
741 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
;
742 DWORD DynamicCharged
;
743 DWORD DynamicAvailable
;
745 DWORD PrivilegeCount
;
747 } TOKEN_STATISTICS
, *PTOKEN_STATISTICS
;
748 typedef struct _TOKEN_USER
{
749 SID_AND_ATTRIBUTES User
;
750 } TOKEN_USER
, *PTOKEN_USER
;
751 typedef DWORD SECURITY_INFORMATION
,*PSECURITY_INFORMATION
;
752 typedef WORD SECURITY_DESCRIPTOR_CONTROL
,*PSECURITY_DESCRIPTOR_CONTROL
;
753 typedef struct _SECURITY_DESCRIPTOR
{
756 SECURITY_DESCRIPTOR_CONTROL Control
;
761 } SECURITY_DESCRIPTOR
, *PISECURITY_DESCRIPTOR
;
762 typedef struct _SECURITY_DESCRIPTOR_RELATIVE
{
765 SECURITY_DESCRIPTOR_CONTROL Control
;
770 } SECURITY_DESCRIPTOR_RELATIVE
, *PISECURITY_DESCRIPTOR_RELATIVE
;
771 typedef enum _TOKEN_INFORMATION_CLASS
{
772 TokenUser
=1,TokenGroups
,TokenPrivileges
,TokenOwner
,
773 TokenPrimaryGroup
,TokenDefaultDacl
,TokenSource
,TokenType
,
774 TokenImpersonationLevel
,TokenStatistics
,TokenRestrictedSids
,
775 TokenSessionId
,TokenGroupsAndPrivileges
,TokenSessionReference
,
776 TokenSandBoxInert
,TokenAuditPolicy
,TokenOrigin
,
777 } TOKEN_INFORMATION_CLASS
;
779 #define SYMLINK_FLAG_RELATIVE 1
781 typedef struct _REPARSE_DATA_BUFFER
{
783 USHORT ReparseDataLength
;
787 USHORT SubstituteNameOffset
;
788 USHORT SubstituteNameLength
;
789 USHORT PrintNameOffset
;
790 USHORT PrintNameLength
;
793 } SymbolicLinkReparseBuffer
;
795 USHORT SubstituteNameOffset
;
796 USHORT SubstituteNameLength
;
797 USHORT PrintNameOffset
;
798 USHORT PrintNameLength
;
800 } MountPointReparseBuffer
;
803 } GenericReparseBuffer
;
805 } REPARSE_DATA_BUFFER
, *PREPARSE_DATA_BUFFER
;
807 #define REPARSE_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(REPARSE_DATA_BUFFER, GenericReparseBuffer)
809 typedef struct _FILE_ACCESS_INFORMATION
{
810 ACCESS_MASK AccessFlags
;
811 } FILE_ACCESS_INFORMATION
, *PFILE_ACCESS_INFORMATION
;
813 typedef struct _FILE_ALLOCATION_INFORMATION
{
814 LARGE_INTEGER AllocationSize
;
815 } FILE_ALLOCATION_INFORMATION
, *PFILE_ALLOCATION_INFORMATION
;
817 typedef struct _FILE_BOTH_DIR_INFORMATION
{
818 ULONG NextEntryOffset
;
820 LARGE_INTEGER CreationTime
;
821 LARGE_INTEGER LastAccessTime
;
822 LARGE_INTEGER LastWriteTime
;
823 LARGE_INTEGER ChangeTime
;
824 LARGE_INTEGER EndOfFile
;
825 LARGE_INTEGER AllocationSize
;
826 ULONG FileAttributes
;
827 ULONG FileNameLength
;
829 CCHAR ShortNameLength
;
832 } FILE_BOTH_DIR_INFORMATION
, *PFILE_BOTH_DIR_INFORMATION
;
834 typedef struct _FILE_COMPLETION_INFORMATION
{
837 } FILE_COMPLETION_INFORMATION
, *PFILE_COMPLETION_INFORMATION
;
839 typedef struct _FILE_COMPRESSION_INFORMATION
{
840 LARGE_INTEGER CompressedFileSize
;
841 USHORT CompressionFormat
;
842 UCHAR CompressionUnitShift
;
846 } FILE_COMPRESSION_INFORMATION
, *PFILE_COMPRESSION_INFORMATION
;
848 typedef struct _FILE_COPY_ON_WRITE_INFORMATION
{
849 BOOLEAN ReplaceIfExists
;
850 HANDLE RootDirectory
;
851 ULONG FileNameLength
;
853 } FILE_COPY_ON_WRITE_INFORMATION
, *PFILE_COPY_ON_WRITE_INFORMATION
;
855 typedef struct _FILE_DIRECTORY_INFORMATION
{
856 ULONG NextEntryOffset
;
858 LARGE_INTEGER CreationTime
;
859 LARGE_INTEGER LastAccessTime
;
860 LARGE_INTEGER LastWriteTime
;
861 LARGE_INTEGER ChangeTime
;
862 LARGE_INTEGER EndOfFile
;
863 LARGE_INTEGER AllocationSize
;
864 ULONG FileAttributes
;
865 ULONG FileNameLength
;
867 } FILE_DIRECTORY_INFORMATION
, *PFILE_DIRECTORY_INFORMATION
;
869 typedef struct _FILE_FULL_DIRECTORY_INFORMATION
{
870 ULONG NextEntryOffset
;
872 LARGE_INTEGER CreationTime
;
873 LARGE_INTEGER LastAccessTime
;
874 LARGE_INTEGER LastWriteTime
;
875 LARGE_INTEGER ChangeTime
;
876 LARGE_INTEGER EndOfFile
;
877 LARGE_INTEGER AllocationSize
;
878 ULONG FileAttributes
;
879 ULONG FileNameLength
;
882 } FILE_FULL_DIRECTORY_INFORMATION
, *PFILE_FULL_DIRECTORY_INFORMATION
;
884 typedef struct _FILE_BOTH_DIRECTORY_INFORMATION
{
885 ULONG NextEntryOffset
;
887 LARGE_INTEGER CreationTime
;
888 LARGE_INTEGER LastAccessTime
;
889 LARGE_INTEGER LastWriteTime
;
890 LARGE_INTEGER ChangeTime
;
891 LARGE_INTEGER EndOfFile
;
892 LARGE_INTEGER AllocationSize
;
893 ULONG FileAttributes
;
894 ULONG FileNameLength
;
896 CHAR ShortNameLength
;
899 } FILE_BOTH_DIRECTORY_INFORMATION
, *PFILE_BOTH_DIRECTORY_INFORMATION
;
901 typedef struct _FILE_EA_INFORMATION
{
903 } FILE_EA_INFORMATION
, *PFILE_EA_INFORMATION
;
905 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
{
906 ULONG FileSystemAttributes
;
907 ULONG MaximumComponentNameLength
;
908 ULONG FileSystemNameLength
;
909 WCHAR FileSystemName
[1];
910 } FILE_FS_ATTRIBUTE_INFORMATION
, *PFILE_FS_ATTRIBUTE_INFORMATION
;
912 typedef struct _FILE_FS_CONTROL_INFORMATION
{
913 LARGE_INTEGER FreeSpaceStartFiltering
;
914 LARGE_INTEGER FreeSpaceThreshold
;
915 LARGE_INTEGER FreeSpaceStopFiltering
;
916 LARGE_INTEGER DefaultQuotaThreshold
;
917 LARGE_INTEGER DefaultQuotaLimit
;
918 ULONG FileSystemControlFlags
;
919 } FILE_FS_CONTROL_INFORMATION
, *PFILE_FS_CONTROL_INFORMATION
;
921 typedef struct _FILE_FS_FULL_SIZE_INFORMATION
{
922 LARGE_INTEGER TotalAllocationUnits
;
923 LARGE_INTEGER CallerAvailableAllocationUnits
;
924 LARGE_INTEGER ActualAvailableAllocationUnits
;
925 ULONG SectorsPerAllocationUnit
;
926 ULONG BytesPerSector
;
927 } FILE_FS_FULL_SIZE_INFORMATION
, *PFILE_FS_FULL_SIZE_INFORMATION
;
929 typedef struct _FILE_FS_LABEL_INFORMATION
{
930 ULONG VolumeLabelLength
;
931 WCHAR VolumeLabel
[1];
932 } FILE_FS_LABEL_INFORMATION
, *PFILE_FS_LABEL_INFORMATION
;
934 #if (VER_PRODUCTBUILD >= 2195)
936 typedef struct _FILE_FS_OBJECT_ID_INFORMATION
{
938 UCHAR ExtendedInfo
[48];
939 } FILE_FS_OBJECT_ID_INFORMATION
, *PFILE_FS_OBJECT_ID_INFORMATION
;
941 #endif /* (VER_PRODUCTBUILD >= 2195) */
943 typedef struct _FILE_FS_SIZE_INFORMATION
{
944 LARGE_INTEGER TotalAllocationUnits
;
945 LARGE_INTEGER AvailableAllocationUnits
;
946 ULONG SectorsPerAllocationUnit
;
947 ULONG BytesPerSector
;
948 } FILE_FS_SIZE_INFORMATION
, *PFILE_FS_SIZE_INFORMATION
;
950 typedef struct _FILE_FS_VOLUME_INFORMATION
{
951 LARGE_INTEGER VolumeCreationTime
;
952 ULONG VolumeSerialNumber
;
953 ULONG VolumeLabelLength
;
954 BOOLEAN SupportsObjects
;
955 WCHAR VolumeLabel
[1];
956 } FILE_FS_VOLUME_INFORMATION
, *PFILE_FS_VOLUME_INFORMATION
;
958 typedef struct _FILE_FS_OBJECTID_INFORMATION
961 UCHAR ExtendedInfo
[48];
962 } FILE_FS_OBJECTID_INFORMATION
, *PFILE_FS_OBJECTID_INFORMATION
;
964 typedef struct _FILE_FS_DRIVER_PATH_INFORMATION
966 BOOLEAN DriverInPath
;
967 ULONG DriverNameLength
;
969 } FILE_FS_DRIVER_PATH_INFORMATION
, *PFILE_FS_DRIVER_PATH_INFORMATION
;
971 typedef struct _FILE_FULL_DIR_INFORMATION
{
972 ULONG NextEntryOffset
;
974 LARGE_INTEGER CreationTime
;
975 LARGE_INTEGER LastAccessTime
;
976 LARGE_INTEGER LastWriteTime
;
977 LARGE_INTEGER ChangeTime
;
978 LARGE_INTEGER EndOfFile
;
979 LARGE_INTEGER AllocationSize
;
980 ULONG FileAttributes
;
981 ULONG FileNameLength
;
984 } FILE_FULL_DIR_INFORMATION
, *PFILE_FULL_DIR_INFORMATION
;
986 typedef struct _FILE_GET_EA_INFORMATION
{
987 ULONG NextEntryOffset
;
990 } FILE_GET_EA_INFORMATION
, *PFILE_GET_EA_INFORMATION
;
992 typedef struct _FILE_GET_QUOTA_INFORMATION
{
993 ULONG NextEntryOffset
;
996 } FILE_GET_QUOTA_INFORMATION
, *PFILE_GET_QUOTA_INFORMATION
;
998 typedef struct _FILE_QUOTA_INFORMATION
1000 ULONG NextEntryOffset
;
1002 LARGE_INTEGER ChangeTime
;
1003 LARGE_INTEGER QuotaUsed
;
1004 LARGE_INTEGER QuotaThreshold
;
1005 LARGE_INTEGER QuotaLimit
;
1007 } FILE_QUOTA_INFORMATION
, *PFILE_QUOTA_INFORMATION
;
1009 typedef struct _FILE_INTERNAL_INFORMATION
{
1010 LARGE_INTEGER IndexNumber
;
1011 } FILE_INTERNAL_INFORMATION
, *PFILE_INTERNAL_INFORMATION
;
1013 typedef struct _FILE_LINK_INFORMATION
{
1014 BOOLEAN ReplaceIfExists
;
1015 HANDLE RootDirectory
;
1016 ULONG FileNameLength
;
1018 } FILE_LINK_INFORMATION
, *PFILE_LINK_INFORMATION
;
1020 typedef struct _FILE_LOCK_INFO
1022 LARGE_INTEGER StartingByte
;
1023 LARGE_INTEGER Length
;
1024 BOOLEAN ExclusiveLock
;
1026 PFILE_OBJECT FileObject
;
1028 LARGE_INTEGER EndingByte
;
1029 } FILE_LOCK_INFO
, *PFILE_LOCK_INFO
;
1031 typedef struct _FILE_REPARSE_POINT_INFORMATION
1033 LONGLONG FileReference
;
1035 } FILE_REPARSE_POINT_INFORMATION
, *PFILE_REPARSE_POINT_INFORMATION
;
1037 typedef struct _FILE_MOVE_CLUSTER_INFORMATION
1040 HANDLE RootDirectory
;
1041 ULONG FileNameLength
;
1043 } FILE_MOVE_CLUSTER_INFORMATION
, *PFILE_MOVE_CLUSTER_INFORMATION
;
1045 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
1046 typedef struct _FILE_SHARED_LOCK_ENTRY
{
1049 FILE_LOCK_INFO FileLock
;
1050 } FILE_SHARED_LOCK_ENTRY
, *PFILE_SHARED_LOCK_ENTRY
;
1052 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
1053 typedef struct _FILE_EXCLUSIVE_LOCK_ENTRY
{
1054 LIST_ENTRY ListEntry
;
1057 FILE_LOCK_INFO FileLock
;
1058 } FILE_EXCLUSIVE_LOCK_ENTRY
, *PFILE_EXCLUSIVE_LOCK_ENTRY
;
1060 typedef NTSTATUS (NTAPI
*PCOMPLETE_LOCK_IRP_ROUTINE
) (
1065 typedef VOID (NTAPI
*PUNLOCK_ROUTINE
) (
1067 IN PFILE_LOCK_INFO FileLockInfo
1070 typedef struct _FILE_LOCK
{
1071 PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine
;
1072 PUNLOCK_ROUTINE UnlockRoutine
;
1073 BOOLEAN FastIoIsQuestionable
;
1075 PVOID LockInformation
;
1076 FILE_LOCK_INFO LastReturnedLockInfo
;
1077 PVOID LastReturnedLock
;
1078 } FILE_LOCK
, *PFILE_LOCK
;
1080 typedef struct _FILE_MAILSLOT_PEEK_BUFFER
{
1081 ULONG ReadDataAvailable
;
1082 ULONG NumberOfMessages
;
1083 ULONG MessageLength
;
1084 } FILE_MAILSLOT_PEEK_BUFFER
, *PFILE_MAILSLOT_PEEK_BUFFER
;
1086 typedef struct _FILE_MAILSLOT_QUERY_INFORMATION
{
1087 ULONG MaximumMessageSize
;
1088 ULONG MailslotQuota
;
1089 ULONG NextMessageSize
;
1090 ULONG MessagesAvailable
;
1091 LARGE_INTEGER ReadTimeout
;
1092 } FILE_MAILSLOT_QUERY_INFORMATION
, *PFILE_MAILSLOT_QUERY_INFORMATION
;
1094 typedef struct _FILE_MAILSLOT_SET_INFORMATION
{
1095 PLARGE_INTEGER ReadTimeout
;
1096 } FILE_MAILSLOT_SET_INFORMATION
, *PFILE_MAILSLOT_SET_INFORMATION
;
1098 typedef struct _FILE_MODE_INFORMATION
{
1100 } FILE_MODE_INFORMATION
, *PFILE_MODE_INFORMATION
;
1102 typedef struct _FILE_ALL_INFORMATION
{
1103 FILE_BASIC_INFORMATION BasicInformation
;
1104 FILE_STANDARD_INFORMATION StandardInformation
;
1105 FILE_INTERNAL_INFORMATION InternalInformation
;
1106 FILE_EA_INFORMATION EaInformation
;
1107 FILE_ACCESS_INFORMATION AccessInformation
;
1108 FILE_POSITION_INFORMATION PositionInformation
;
1109 FILE_MODE_INFORMATION ModeInformation
;
1110 FILE_ALIGNMENT_INFORMATION AlignmentInformation
;
1111 FILE_NAME_INFORMATION NameInformation
;
1112 } FILE_ALL_INFORMATION
, *PFILE_ALL_INFORMATION
;
1114 typedef struct _FILE_NAMES_INFORMATION
{
1115 ULONG NextEntryOffset
;
1117 ULONG FileNameLength
;
1119 } FILE_NAMES_INFORMATION
, *PFILE_NAMES_INFORMATION
;
1121 typedef struct _FILE_OBJECTID_INFORMATION
{
1122 LONGLONG FileReference
;
1124 _ANONYMOUS_UNION
union {
1126 UCHAR BirthVolumeId
[16];
1127 UCHAR BirthObjectId
[16];
1130 UCHAR ExtendedInfo
[48];
1132 } FILE_OBJECTID_INFORMATION
, *PFILE_OBJECTID_INFORMATION
;
1134 typedef struct _FILE_OLE_CLASSID_INFORMATION
{
1136 } FILE_OLE_CLASSID_INFORMATION
, *PFILE_OLE_CLASSID_INFORMATION
;
1138 typedef struct _FILE_OLE_ALL_INFORMATION
{
1139 FILE_BASIC_INFORMATION BasicInformation
;
1140 FILE_STANDARD_INFORMATION StandardInformation
;
1141 FILE_INTERNAL_INFORMATION InternalInformation
;
1142 FILE_EA_INFORMATION EaInformation
;
1143 FILE_ACCESS_INFORMATION AccessInformation
;
1144 FILE_POSITION_INFORMATION PositionInformation
;
1145 FILE_MODE_INFORMATION ModeInformation
;
1146 FILE_ALIGNMENT_INFORMATION AlignmentInformation
;
1149 LARGE_INTEGER SecurityChangeTime
;
1150 FILE_OLE_CLASSID_INFORMATION OleClassIdInformation
;
1151 FILE_OBJECTID_INFORMATION ObjectIdInformation
;
1152 FILE_STORAGE_TYPE StorageType
;
1155 ULONG NumberOfStreamReferences
;
1158 BOOLEAN ContentIndexDisable
;
1159 BOOLEAN InheritContentIndexDisable
;
1160 FILE_NAME_INFORMATION NameInformation
;
1161 } FILE_OLE_ALL_INFORMATION
, *PFILE_OLE_ALL_INFORMATION
;
1163 typedef struct _FILE_OLE_DIR_INFORMATION
{
1164 ULONG NextEntryOffset
;
1166 LARGE_INTEGER CreationTime
;
1167 LARGE_INTEGER LastAccessTime
;
1168 LARGE_INTEGER LastWriteTime
;
1169 LARGE_INTEGER ChangeTime
;
1170 LARGE_INTEGER EndOfFile
;
1171 LARGE_INTEGER AllocationSize
;
1172 ULONG FileAttributes
;
1173 ULONG FileNameLength
;
1174 FILE_STORAGE_TYPE StorageType
;
1177 BOOLEAN ContentIndexDisable
;
1178 BOOLEAN InheritContentIndexDisable
;
1180 } FILE_OLE_DIR_INFORMATION
, *PFILE_OLE_DIR_INFORMATION
;
1182 typedef struct _FILE_OLE_INFORMATION
{
1183 LARGE_INTEGER SecurityChangeTime
;
1184 FILE_OLE_CLASSID_INFORMATION OleClassIdInformation
;
1185 FILE_OBJECTID_INFORMATION ObjectIdInformation
;
1186 FILE_STORAGE_TYPE StorageType
;
1188 BOOLEAN ContentIndexDisable
;
1189 BOOLEAN InheritContentIndexDisable
;
1190 } FILE_OLE_INFORMATION
, *PFILE_OLE_INFORMATION
;
1192 typedef struct _FILE_OLE_STATE_BITS_INFORMATION
{
1194 ULONG StateBitsMask
;
1195 } FILE_OLE_STATE_BITS_INFORMATION
, *PFILE_OLE_STATE_BITS_INFORMATION
;
1197 typedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER
{
1200 } FILE_PIPE_ASSIGN_EVENT_BUFFER
, *PFILE_PIPE_ASSIGN_EVENT_BUFFER
;
1202 typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER
{
1203 PVOID ClientSession
;
1204 PVOID ClientProcess
;
1205 } FILE_PIPE_CLIENT_PROCESS_BUFFER
, *PFILE_PIPE_CLIENT_PROCESS_BUFFER
;
1207 typedef struct _FILE_PIPE_EVENT_BUFFER
{
1208 ULONG NamedPipeState
;
1212 ULONG NumberRequests
;
1213 } FILE_PIPE_EVENT_BUFFER
, *PFILE_PIPE_EVENT_BUFFER
;
1215 typedef struct _FILE_PIPE_PEEK_BUFFER
1217 ULONG NamedPipeState
;
1218 ULONG ReadDataAvailable
;
1219 ULONG NumberOfMessages
;
1220 ULONG MessageLength
;
1222 } FILE_PIPE_PEEK_BUFFER
, *PFILE_PIPE_PEEK_BUFFER
;
1224 typedef struct _FILE_PIPE_INFORMATION
{
1226 ULONG CompletionMode
;
1227 } FILE_PIPE_INFORMATION
, *PFILE_PIPE_INFORMATION
;
1229 typedef struct _FILE_PIPE_LOCAL_INFORMATION
{
1230 ULONG NamedPipeType
;
1231 ULONG NamedPipeConfiguration
;
1232 ULONG MaximumInstances
;
1233 ULONG CurrentInstances
;
1235 ULONG ReadDataAvailable
;
1236 ULONG OutboundQuota
;
1237 ULONG WriteQuotaAvailable
;
1238 ULONG NamedPipeState
;
1240 } FILE_PIPE_LOCAL_INFORMATION
, *PFILE_PIPE_LOCAL_INFORMATION
;
1242 typedef struct _FILE_PIPE_REMOTE_INFORMATION
{
1243 LARGE_INTEGER CollectDataTime
;
1244 ULONG MaximumCollectionCount
;
1245 } FILE_PIPE_REMOTE_INFORMATION
, *PFILE_PIPE_REMOTE_INFORMATION
;
1247 typedef struct _FILE_PIPE_WAIT_FOR_BUFFER
{
1248 LARGE_INTEGER Timeout
;
1250 BOOLEAN TimeoutSpecified
;
1252 } FILE_PIPE_WAIT_FOR_BUFFER
, *PFILE_PIPE_WAIT_FOR_BUFFER
;
1254 typedef struct _FILE_RENAME_INFORMATION
{
1255 BOOLEAN ReplaceIfExists
;
1256 HANDLE RootDirectory
;
1257 ULONG FileNameLength
;
1259 } FILE_RENAME_INFORMATION
, *PFILE_RENAME_INFORMATION
;
1261 typedef struct _FILE_STREAM_INFORMATION
{
1262 ULONG NextEntryOffset
;
1263 ULONG StreamNameLength
;
1264 LARGE_INTEGER StreamSize
;
1265 LARGE_INTEGER StreamAllocationSize
;
1266 WCHAR StreamName
[1];
1267 } FILE_STREAM_INFORMATION
, *PFILE_STREAM_INFORMATION
;
1269 typedef struct _FILE_TRACKING_INFORMATION
{
1270 HANDLE DestinationFile
;
1271 ULONG ObjectInformationLength
;
1272 CHAR ObjectInformation
[1];
1273 } FILE_TRACKING_INFORMATION
, *PFILE_TRACKING_INFORMATION
;
1275 #if (VER_PRODUCTBUILD >= 2195)
1276 typedef struct _FILE_ZERO_DATA_INFORMATION
{
1277 LARGE_INTEGER FileOffset
;
1278 LARGE_INTEGER BeyondFinalZero
;
1279 } FILE_ZERO_DATA_INFORMATION
, *PFILE_ZERO_DATA_INFORMATION
;
1281 typedef struct FILE_ALLOCATED_RANGE_BUFFER
{
1282 LARGE_INTEGER FileOffset
;
1283 LARGE_INTEGER Length
;
1284 } FILE_ALLOCATED_RANGE_BUFFER
, *PFILE_ALLOCATED_RANGE_BUFFER
;
1285 #endif /* (VER_PRODUCTBUILD >= 2195) */
1287 typedef struct _FSRTL_COMMON_FCB_HEADER
{
1288 CSHORT NodeTypeCode
;
1289 CSHORT NodeByteSize
;
1291 UCHAR IsFastIoPossible
;
1292 #if (VER_PRODUCTBUILD >= 1381)
1295 #endif /* (VER_PRODUCTBUILD >= 1381) */
1296 PERESOURCE Resource
;
1297 PERESOURCE PagingIoResource
;
1298 LARGE_INTEGER AllocationSize
;
1299 LARGE_INTEGER FileSize
;
1300 LARGE_INTEGER ValidDataLength
;
1301 } FSRTL_COMMON_FCB_HEADER
, *PFSRTL_COMMON_FCB_HEADER
;
1303 #if (VER_PRODUCTBUILD >= 2600)
1305 typedef struct _FSRTL_ADVANCED_FCB_HEADER
{
1306 CSHORT NodeTypeCode
;
1307 CSHORT NodeByteSize
;
1309 UCHAR IsFastIoPossible
;
1313 PERESOURCE Resource
;
1314 PERESOURCE PagingIoResource
;
1315 LARGE_INTEGER AllocationSize
;
1316 LARGE_INTEGER FileSize
;
1317 LARGE_INTEGER ValidDataLength
;
1318 PFAST_MUTEX FastMutex
;
1319 LIST_ENTRY FilterContexts
;
1320 EX_PUSH_LOCK PushLock
;
1321 PVOID
*FileContextSupportPointer
;
1322 } FSRTL_ADVANCED_FCB_HEADER
, *PFSRTL_ADVANCED_FCB_HEADER
;
1324 typedef struct _FSRTL_PER_STREAM_CONTEXT
{
1328 PFREE_FUNCTION FreeCallback
;
1329 } FSRTL_PER_STREAM_CONTEXT
, *PFSRTL_PER_STREAM_CONTEXT
;
1331 typedef struct _FSRTL_PER_FILEOBJECT_CONTEXT
1336 } FSRTL_PER_FILEOBJECT_CONTEXT
, *PFSRTL_PER_FILEOBJECT_CONTEXT
;
1338 #endif /* (VER_PRODUCTBUILD >= 2600) */
1340 typedef struct _BASE_MCB
1342 ULONG MaximumPairCount
;
1347 } BASE_MCB
, *PBASE_MCB
;
1349 typedef struct _LARGE_MCB
1351 PKGUARDED_MUTEX GuardedMutex
;
1353 } LARGE_MCB
, *PLARGE_MCB
;
1357 LARGE_MCB DummyFieldThatSizesThisStructureCorrectly
;
1360 typedef struct _GENERATE_NAME_CONTEXT
{
1362 BOOLEAN CheckSumInserted
;
1364 WCHAR NameBuffer
[8];
1365 ULONG ExtensionLength
;
1366 WCHAR ExtensionBuffer
[4];
1367 ULONG LastIndexValue
;
1368 } GENERATE_NAME_CONTEXT
, *PGENERATE_NAME_CONTEXT
;
1370 typedef struct _MAPPING_PAIR
{
1373 } MAPPING_PAIR
, *PMAPPING_PAIR
;
1375 typedef struct _GET_RETRIEVAL_DESCRIPTOR
{
1376 ULONG NumberOfPairs
;
1378 MAPPING_PAIR Pair
[1];
1379 } GET_RETRIEVAL_DESCRIPTOR
, *PGET_RETRIEVAL_DESCRIPTOR
;
1381 typedef struct _KQUEUE
{
1382 DISPATCHER_HEADER Header
;
1383 LIST_ENTRY EntryListHead
;
1386 LIST_ENTRY ThreadListHead
;
1387 } KQUEUE
, *PKQUEUE
, *RESTRICTED_POINTER PRKQUEUE
;
1389 #define ASSERT_QUEUE(Q) ASSERT(((Q)->Header.Type & KOBJECT_TYPE_MASK) == QueueObject);
1391 typedef struct _MBCB
{
1392 CSHORT NodeTypeCode
;
1393 CSHORT NodeIsInZone
;
1397 LIST_ENTRY BitmapRanges
;
1398 LONGLONG ResumeWritePage
;
1399 BITMAP_RANGE BitmapRange1
;
1400 BITMAP_RANGE BitmapRange2
;
1401 BITMAP_RANGE BitmapRange3
;
1404 typedef struct _MOVEFILE_DESCRIPTOR
{
1407 LARGE_INTEGER StartVcn
;
1408 LARGE_INTEGER TargetLcn
;
1411 } MOVEFILE_DESCRIPTOR
, *PMOVEFILE_DESCRIPTOR
;
1413 typedef struct _OBJECT_BASIC_INFO
{
1415 ACCESS_MASK GrantedAccess
;
1417 ULONG ReferenceCount
;
1418 ULONG PagedPoolUsage
;
1419 ULONG NonPagedPoolUsage
;
1421 ULONG NameInformationLength
;
1422 ULONG TypeInformationLength
;
1423 ULONG SecurityDescriptorLength
;
1424 LARGE_INTEGER CreateTime
;
1425 } OBJECT_BASIC_INFO
, *POBJECT_BASIC_INFO
;
1427 typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFO
{
1429 BOOLEAN ProtectFromClose
;
1430 } OBJECT_HANDLE_ATTRIBUTE_INFO
, *POBJECT_HANDLE_ATTRIBUTE_INFO
;
1432 typedef struct _OBJECT_NAME_INFO
{
1433 UNICODE_STRING ObjectName
;
1434 WCHAR ObjectNameBuffer
[1];
1435 } OBJECT_NAME_INFO
, *POBJECT_NAME_INFO
;
1437 typedef struct _OBJECT_PROTECTION_INFO
{
1439 BOOLEAN ProtectHandle
;
1440 } OBJECT_PROTECTION_INFO
, *POBJECT_PROTECTION_INFO
;
1442 typedef struct _OBJECT_TYPE_INFO
{
1443 UNICODE_STRING ObjectTypeName
;
1444 UCHAR Unknown
[0x58];
1445 WCHAR ObjectTypeNameBuffer
[1];
1446 } OBJECT_TYPE_INFO
, *POBJECT_TYPE_INFO
;
1448 typedef struct _OBJECT_ALL_TYPES_INFO
{
1449 ULONG NumberOfObjectTypes
;
1450 OBJECT_TYPE_INFO ObjectsTypeInfo
[1];
1451 } OBJECT_ALL_TYPES_INFO
, *POBJECT_ALL_TYPES_INFO
;
1454 typedef struct _PATHNAME_BUFFER
{
1455 ULONG PathNameLength
;
1457 } PATHNAME_BUFFER
, *PPATHNAME_BUFFER
;
1459 typedef enum _RTL_GENERIC_COMPARE_RESULTS
1464 } RTL_GENERIC_COMPARE_RESULTS
;
1466 typedef enum _TABLE_SEARCH_RESULT
1472 } TABLE_SEARCH_RESULT
;
1475 (NTAPI
*PRTL_AVL_MATCH_FUNCTION
)(
1476 struct _RTL_AVL_TABLE
*Table
,
1481 typedef RTL_GENERIC_COMPARE_RESULTS
1482 (NTAPI
*PRTL_AVL_COMPARE_ROUTINE
) (
1483 struct _RTL_AVL_TABLE
*Table
,
1488 typedef RTL_GENERIC_COMPARE_RESULTS
1489 (NTAPI
*PRTL_GENERIC_COMPARE_ROUTINE
) (
1490 struct _RTL_GENERIC_TABLE
*Table
,
1496 (NTAPI
*PRTL_GENERIC_ALLOCATE_ROUTINE
) (
1497 struct _RTL_GENERIC_TABLE
*Table
,
1502 (NTAPI
*PRTL_GENERIC_FREE_ROUTINE
) (
1503 struct _RTL_GENERIC_TABLE
*Table
,
1508 (NTAPI
*PRTL_AVL_ALLOCATE_ROUTINE
) (
1509 struct _RTL_AVL_TABLE
*Table
,
1514 (NTAPI
*PRTL_AVL_FREE_ROUTINE
) (
1515 struct _RTL_AVL_TABLE
*Table
,
1519 typedef struct _PUBLIC_BCB
{
1520 CSHORT NodeTypeCode
;
1521 CSHORT NodeByteSize
;
1523 LARGE_INTEGER MappedFileOffset
;
1524 } PUBLIC_BCB
, *PPUBLIC_BCB
;
1526 typedef struct _QUERY_PATH_REQUEST
{
1527 ULONG PathNameLength
;
1528 PIO_SECURITY_CONTEXT SecurityContext
;
1529 WCHAR FilePathName
[1];
1530 } QUERY_PATH_REQUEST
, *PQUERY_PATH_REQUEST
;
1532 typedef struct _QUERY_PATH_RESPONSE
{
1533 ULONG LengthAccepted
;
1534 } QUERY_PATH_RESPONSE
, *PQUERY_PATH_RESPONSE
;
1536 typedef struct _RETRIEVAL_POINTERS_BUFFER
{
1538 LARGE_INTEGER StartingVcn
;
1540 LARGE_INTEGER NextVcn
;
1543 } RETRIEVAL_POINTERS_BUFFER
, *PRETRIEVAL_POINTERS_BUFFER
;
1545 typedef struct _RTL_SPLAY_LINKS
{
1546 struct _RTL_SPLAY_LINKS
*Parent
;
1547 struct _RTL_SPLAY_LINKS
*LeftChild
;
1548 struct _RTL_SPLAY_LINKS
*RightChild
;
1549 } RTL_SPLAY_LINKS
, *PRTL_SPLAY_LINKS
;
1551 typedef struct _RTL_BALANCED_LINKS
1553 struct _RTL_BALANCED_LINKS
*Parent
;
1554 struct _RTL_BALANCED_LINKS
*LeftChild
;
1555 struct _RTL_BALANCED_LINKS
*RightChild
;
1558 } RTL_BALANCED_LINKS
, *PRTL_BALANCED_LINKS
;
1560 typedef struct _RTL_GENERIC_TABLE
1562 PRTL_SPLAY_LINKS TableRoot
;
1563 LIST_ENTRY InsertOrderList
;
1564 PLIST_ENTRY OrderedPointer
;
1565 ULONG WhichOrderedElement
;
1566 ULONG NumberGenericTableElements
;
1567 PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine
;
1568 PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine
;
1569 PRTL_GENERIC_FREE_ROUTINE FreeRoutine
;
1571 } RTL_GENERIC_TABLE
, *PRTL_GENERIC_TABLE
;
1573 typedef struct _RTL_AVL_TABLE
1575 RTL_BALANCED_LINKS BalancedRoot
;
1576 PVOID OrderedPointer
;
1577 ULONG WhichOrderedElement
;
1578 ULONG NumberGenericTableElements
;
1580 PRTL_BALANCED_LINKS RestartKey
;
1582 PRTL_AVL_COMPARE_ROUTINE CompareRoutine
;
1583 PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine
;
1584 PRTL_AVL_FREE_ROUTINE FreeRoutine
;
1586 } RTL_AVL_TABLE
, *PRTL_AVL_TABLE
;
1591 RtlInitializeGenericTableAvl(
1592 PRTL_AVL_TABLE Table
,
1593 PRTL_AVL_COMPARE_ROUTINE CompareRoutine
,
1594 PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine
,
1595 PRTL_AVL_FREE_ROUTINE FreeRoutine
,
1599 #if defined(USE_LPC6432)
1600 #define LPC_CLIENT_ID CLIENT_ID64
1601 #define LPC_SIZE_T ULONGLONG
1602 #define LPC_PVOID ULONGLONG
1603 #define LPC_HANDLE ULONGLONG
1605 #define LPC_CLIENT_ID CLIENT_ID
1606 #define LPC_SIZE_T SIZE_T
1607 #define LPC_PVOID PVOID
1608 #define LPC_HANDLE HANDLE
1611 typedef struct _PORT_MESSAGE
1627 CSHORT DataInfoOffset
;
1633 LPC_CLIENT_ID ClientId
;
1634 double DoNotUseThisField
;
1639 LPC_SIZE_T ClientViewSize
;
1642 } PORT_MESSAGE
, *PPORT_MESSAGE
;
1644 #define LPC_KERNELMODE_MESSAGE (CSHORT)((USHORT)0x8000)
1646 typedef struct _PORT_VIEW
1649 LPC_HANDLE SectionHandle
;
1650 ULONG SectionOffset
;
1651 LPC_SIZE_T ViewSize
;
1653 LPC_PVOID ViewRemoteBase
;
1654 } PORT_VIEW
, *PPORT_VIEW
;
1656 typedef struct _REMOTE_PORT_VIEW
1659 LPC_SIZE_T ViewSize
;
1661 } REMOTE_PORT_VIEW
, *PREMOTE_PORT_VIEW
;
1663 typedef struct _SE_EXPORTS
{
1665 LUID SeCreateTokenPrivilege
;
1666 LUID SeAssignPrimaryTokenPrivilege
;
1667 LUID SeLockMemoryPrivilege
;
1668 LUID SeIncreaseQuotaPrivilege
;
1669 LUID SeUnsolicitedInputPrivilege
;
1670 LUID SeTcbPrivilege
;
1671 LUID SeSecurityPrivilege
;
1672 LUID SeTakeOwnershipPrivilege
;
1673 LUID SeLoadDriverPrivilege
;
1674 LUID SeCreatePagefilePrivilege
;
1675 LUID SeIncreaseBasePriorityPrivilege
;
1676 LUID SeSystemProfilePrivilege
;
1677 LUID SeSystemtimePrivilege
;
1678 LUID SeProfileSingleProcessPrivilege
;
1679 LUID SeCreatePermanentPrivilege
;
1680 LUID SeBackupPrivilege
;
1681 LUID SeRestorePrivilege
;
1682 LUID SeShutdownPrivilege
;
1683 LUID SeDebugPrivilege
;
1684 LUID SeAuditPrivilege
;
1685 LUID SeSystemEnvironmentPrivilege
;
1686 LUID SeChangeNotifyPrivilege
;
1687 LUID SeRemoteShutdownPrivilege
;
1692 PSID SeCreatorOwnerSid
;
1693 PSID SeCreatorGroupSid
;
1695 PSID SeNtAuthoritySid
;
1699 PSID SeInteractiveSid
;
1700 PSID SeLocalSystemSid
;
1701 PSID SeAliasAdminsSid
;
1702 PSID SeAliasUsersSid
;
1703 PSID SeAliasGuestsSid
;
1704 PSID SeAliasPowerUsersSid
;
1705 PSID SeAliasAccountOpsSid
;
1706 PSID SeAliasSystemOpsSid
;
1707 PSID SeAliasPrintOpsSid
;
1708 PSID SeAliasBackupOpsSid
;
1710 PSID SeAuthenticatedUsersSid
;
1712 PSID SeRestrictedSid
;
1713 PSID SeAnonymousLogonSid
;
1715 LUID SeUndockPrivilege
;
1716 LUID SeSyncAgentPrivilege
;
1717 LUID SeEnableDelegationPrivilege
;
1719 } SE_EXPORTS
, *PSE_EXPORTS
;
1723 LARGE_INTEGER StartingLcn
;
1724 } STARTING_LCN_INPUT_BUFFER
, *PSTARTING_LCN_INPUT_BUFFER
;
1726 typedef struct _STARTING_VCN_INPUT_BUFFER
{
1727 LARGE_INTEGER StartingVcn
;
1728 } STARTING_VCN_INPUT_BUFFER
, *PSTARTING_VCN_INPUT_BUFFER
;
1730 typedef struct _SECURITY_CLIENT_CONTEXT
{
1731 SECURITY_QUALITY_OF_SERVICE SecurityQos
;
1732 PACCESS_TOKEN ClientToken
;
1733 BOOLEAN DirectlyAccessClientToken
;
1734 BOOLEAN DirectAccessEffectiveOnly
;
1735 BOOLEAN ServerIsRemote
;
1736 TOKEN_CONTROL ClientTokenControl
;
1737 } SECURITY_CLIENT_CONTEXT
, *PSECURITY_CLIENT_CONTEXT
;
1739 typedef struct _ACE_HEADER
1744 } ACE_HEADER
, *PACE_HEADER
;
1746 typedef struct _ACCESS_ALLOWED_ACE
1751 } ACCESS_ALLOWED_ACE
, *PACCESS_ALLOWED_ACE
;
1753 typedef struct _ACCESS_DENIED_ACE
1758 } ACCESS_DENIED_ACE
, *PACCESS_DENIED_ACE
;
1760 typedef struct _SYSTEM_AUDIT_ACE
1765 } SYSTEM_AUDIT_ACE
, *PSYSTEM_AUDIT_ACE
;
1767 typedef struct _SYSTEM_ALARM_ACE
1772 } SYSTEM_ALARM_ACE
, *PSYSTEM_ALARM_ACE
;
1774 typedef struct _SYSTEM_MANDATORY_LABEL_ACE
1779 } SYSTEM_MANDATORY_LABEL_ACE
, *PSYSTEM_MANDATORY_LABEL_ACE
;
1781 typedef struct _TUNNEL
{
1783 PRTL_SPLAY_LINKS Cache
;
1784 LIST_ENTRY TimerQueue
;
1788 typedef struct _VAD_HEADER
{
1791 PVAD_HEADER ParentLink
;
1792 PVAD_HEADER LeftLink
;
1793 PVAD_HEADER RightLink
;
1794 ULONG Flags
; /* LSB = CommitCharge */
1796 PVOID FirstProtoPte
;
1800 } VAD_HEADER
, *PVAD_HEADER
;
1804 LARGE_INTEGER StartingLcn
;
1805 LARGE_INTEGER BitmapSize
;
1807 } VOLUME_BITMAP_BUFFER
, *PVOLUME_BITMAP_BUFFER
;
1809 #if (VER_PRODUCTBUILD >= 2600)
1812 (NTAPI
*PFILTER_REPORT_CHANGE
) (
1813 IN PVOID NotifyContext
,
1814 IN PVOID FilterContext
1817 typedef enum _FS_FILTER_SECTION_SYNC_TYPE
{
1819 SyncTypeCreateSection
1820 } FS_FILTER_SECTION_SYNC_TYPE
, *PFS_FILTER_SECTION_SYNC_TYPE
;
1822 typedef enum _FS_FILTER_STREAM_FO_NOTIFICATION_TYPE
{
1823 NotifyTypeCreate
= 0,
1825 } FS_FILTER_STREAM_FO_NOTIFICATION_TYPE
, *PFS_FILTER_STREAM_FO_NOTIFICATION_TYPE
;
1827 typedef union _FS_FILTER_PARAMETERS
{
1829 PLARGE_INTEGER EndingOffset
;
1830 PERESOURCE
*ResourceToRelease
;
1831 } AcquireForModifiedPageWriter
;
1834 PERESOURCE ResourceToRelease
;
1835 } ReleaseForModifiedPageWriter
;
1838 FS_FILTER_SECTION_SYNC_TYPE SyncType
;
1839 ULONG PageProtection
;
1840 } AcquireForSectionSynchronization
;
1843 FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType
;
1844 BOOLEAN POINTER_ALIGNMENT SafeToRecurse
;
1845 } NotifyStreamFileObject
;
1854 } FS_FILTER_PARAMETERS
, *PFS_FILTER_PARAMETERS
;
1856 typedef struct _FS_FILTER_CALLBACK_DATA
{
1857 ULONG SizeOfFsFilterCallbackData
;
1860 struct _DEVICE_OBJECT
*DeviceObject
;
1861 struct _FILE_OBJECT
*FileObject
;
1862 FS_FILTER_PARAMETERS Parameters
;
1863 } FS_FILTER_CALLBACK_DATA
, *PFS_FILTER_CALLBACK_DATA
;
1866 (NTAPI
*PFS_FILTER_CALLBACK
) (
1867 IN PFS_FILTER_CALLBACK_DATA Data
,
1868 OUT PVOID
*CompletionContext
1872 (NTAPI
*PFS_FILTER_COMPLETION_CALLBACK
) (
1873 IN PFS_FILTER_CALLBACK_DATA Data
,
1874 IN NTSTATUS OperationStatus
,
1875 IN PVOID CompletionContext
1878 typedef struct _FS_FILTER_CALLBACKS
{
1879 ULONG SizeOfFsFilterCallbacks
;
1881 PFS_FILTER_CALLBACK PreAcquireForSectionSynchronization
;
1882 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization
;
1883 PFS_FILTER_CALLBACK PreReleaseForSectionSynchronization
;
1884 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization
;
1885 PFS_FILTER_CALLBACK PreAcquireForCcFlush
;
1886 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush
;
1887 PFS_FILTER_CALLBACK PreReleaseForCcFlush
;
1888 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush
;
1889 PFS_FILTER_CALLBACK PreAcquireForModifiedPageWriter
;
1890 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter
;
1891 PFS_FILTER_CALLBACK PreReleaseForModifiedPageWriter
;
1892 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter
;
1893 } FS_FILTER_CALLBACKS
, *PFS_FILTER_CALLBACKS
;
1895 typedef struct _READ_LIST
{
1896 PFILE_OBJECT FileObject
;
1897 ULONG NumberOfEntries
;
1899 FILE_SEGMENT_ELEMENT List
[ANYSIZE_ARRAY
];
1900 } READ_LIST
, *PREAD_LIST
;
1905 (NTAPI
* PRTL_HEAP_COMMIT_ROUTINE
) (
1907 IN OUT PVOID
*CommitAddress
,
1908 IN OUT PSIZE_T CommitSize
1911 typedef struct _RTL_HEAP_PARAMETERS
{
1913 SIZE_T SegmentReserve
;
1914 SIZE_T SegmentCommit
;
1915 SIZE_T DeCommitFreeBlockThreshold
;
1916 SIZE_T DeCommitTotalFreeThreshold
;
1917 SIZE_T MaximumAllocationSize
;
1918 SIZE_T VirtualMemoryThreshold
;
1919 SIZE_T InitialCommit
;
1920 SIZE_T InitialReserve
;
1921 PRTL_HEAP_COMMIT_ROUTINE CommitRoutine
;
1923 } RTL_HEAP_PARAMETERS
, *PRTL_HEAP_PARAMETERS
;
1929 IN PFILE_OBJECT FileObject
,
1930 IN ULONG BytesToWrite
,
1939 IN PFILE_OBJECT FileObject
,
1940 IN PLARGE_INTEGER FileOffset
,
1944 OUT PIO_STATUS_BLOCK IoStatus
1951 IN PFILE_OBJECT FileObject
,
1952 IN PLARGE_INTEGER FileOffset
,
1958 #define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
1960 typedef VOID (NTAPI
*PCC_POST_DEFERRED_WRITE
) (
1969 IN PFILE_OBJECT FileObject
,
1970 IN PCC_POST_DEFERRED_WRITE PostRoutine
,
1973 IN ULONG BytesToWrite
,
1981 IN PFILE_OBJECT FileObject
,
1982 IN ULONG FileOffset
,
1986 OUT PIO_STATUS_BLOCK IoStatus
1993 IN PFILE_OBJECT FileObject
,
1994 IN ULONG FileOffset
,
2003 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
2004 IN PLARGE_INTEGER FileOffset OPTIONAL
,
2006 OUT PIO_STATUS_BLOCK IoStatus OPTIONAL
2009 typedef VOID (*PDIRTY_PAGE_ROUTINE
) (
2010 IN PFILE_OBJECT FileObject
,
2011 IN PLARGE_INTEGER FileOffset
,
2013 IN PLARGE_INTEGER OldestLsn
,
2014 IN PLARGE_INTEGER NewestLsn
,
2024 IN PDIRTY_PAGE_ROUTINE DirtyPageRoutine
,
2032 CcGetFileObjectFromBcb (
2039 CcGetFileObjectFromSectionPtrs (
2040 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
2043 #define CcGetFileSizePointer(FO) ( \
2044 ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
2047 #if (VER_PRODUCTBUILD >= 2195)
2052 CcGetFlushedValidData (
2053 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
2054 IN BOOLEAN BcbListHeld
2057 #endif /* (VER_PRODUCTBUILD >= 2195) */
2062 CcGetLsnForFileObject (
2063 IN PFILE_OBJECT FileObject
,
2064 OUT PLARGE_INTEGER OldestLsn OPTIONAL
2067 typedef BOOLEAN (NTAPI
*PACQUIRE_FOR_LAZY_WRITE
) (
2072 typedef VOID (NTAPI
*PRELEASE_FROM_LAZY_WRITE
) (
2076 typedef BOOLEAN (NTAPI
*PACQUIRE_FOR_READ_AHEAD
) (
2081 typedef VOID (NTAPI
*PRELEASE_FROM_READ_AHEAD
) (
2085 typedef struct _CACHE_MANAGER_CALLBACKS
{
2086 PACQUIRE_FOR_LAZY_WRITE AcquireForLazyWrite
;
2087 PRELEASE_FROM_LAZY_WRITE ReleaseFromLazyWrite
;
2088 PACQUIRE_FOR_READ_AHEAD AcquireForReadAhead
;
2089 PRELEASE_FROM_READ_AHEAD ReleaseFromReadAhead
;
2090 } CACHE_MANAGER_CALLBACKS
, *PCACHE_MANAGER_CALLBACKS
;
2095 CcInitializeCacheMap (
2096 IN PFILE_OBJECT FileObject
,
2097 IN PCC_FILE_SIZES FileSizes
,
2098 IN BOOLEAN PinAccess
,
2099 IN PCACHE_MANAGER_CALLBACKS Callbacks
,
2100 IN PVOID LazyWriteContext
2103 #define CcIsFileCached(FO) ( \
2104 ((FO)->SectionObjectPointer != NULL) && \
2105 (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
2108 extern ULONG CcFastMdlReadWait
;
2113 CcIsThereDirtyData (
2121 IN PFILE_OBJECT FileObject
,
2122 IN PLARGE_INTEGER FileOffset
,
2133 IN PFILE_OBJECT FileObject
,
2134 IN PLARGE_INTEGER FileOffset
,
2137 OUT PIO_STATUS_BLOCK IoStatus
2144 IN PFILE_OBJECT FileObject
,
2151 CcMdlWriteComplete (
2152 IN PFILE_OBJECT FileObject
,
2153 IN PLARGE_INTEGER FileOffset
,
2163 IN PFILE_OBJECT FileObject
,
2164 IN PLARGE_INTEGER FileOffset
,
2174 IN PFILE_OBJECT FileObject
,
2175 IN PLARGE_INTEGER FileOffset
,
2186 IN PFILE_OBJECT FileObject
,
2187 IN PLARGE_INTEGER FileOffset
,
2190 OUT PIO_STATUS_BLOCK IoStatus
2197 IN PFILE_OBJECT FileObject
,
2198 IN PLARGE_INTEGER FileOffset
,
2209 CcPurgeCacheSection (
2210 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
2211 IN PLARGE_INTEGER FileOffset OPTIONAL
,
2213 IN BOOLEAN UninitializeCacheMaps
2216 #define CcReadAhead(FO, FOFF, LEN) ( \
2217 if ((LEN) >= 256) { \
2218 CcScheduleReadAhead((FO), (FOFF), (LEN)); \
2222 #if (VER_PRODUCTBUILD >= 2195)
2231 #endif /* (VER_PRODUCTBUILD >= 2195) */
2243 CcScheduleReadAhead (
2244 IN PFILE_OBJECT FileObject
,
2245 IN PLARGE_INTEGER FileOffset
,
2252 CcSetAdditionalCacheAttributes (
2253 IN PFILE_OBJECT FileObject
,
2254 IN BOOLEAN DisableReadAhead
,
2255 IN BOOLEAN DisableWriteBehind
2261 CcSetBcbOwnerPointer (
2263 IN PVOID OwnerPointer
2269 CcSetDirtyPageThreshold (
2270 IN PFILE_OBJECT FileObject
,
2271 IN ULONG DirtyPageThreshold
2277 CcSetDirtyPinnedData (
2279 IN PLARGE_INTEGER Lsn OPTIONAL
2286 IN PFILE_OBJECT FileObject
,
2287 IN PCC_FILE_SIZES FileSizes
2290 typedef VOID (NTAPI
*PFLUSH_TO_LSN
) (
2292 IN LARGE_INTEGER Lsn
2298 CcSetLogHandleForFile (
2299 IN PFILE_OBJECT FileObject
,
2301 IN PFLUSH_TO_LSN FlushToLsnRoutine
2307 CcSetReadAheadGranularity (
2308 IN PFILE_OBJECT FileObject
,
2309 IN ULONG Granularity
/* default: PAGE_SIZE */
2310 /* allowed: 2^n * PAGE_SIZE */
2316 CcUninitializeCacheMap (
2317 IN PFILE_OBJECT FileObject
,
2318 IN PLARGE_INTEGER TruncateSize OPTIONAL
,
2319 IN PCACHE_UNINITIALIZE_EVENT UninitializeCompleteEvent OPTIONAL
2332 CcUnpinDataForThread (
2334 IN ERESOURCE_THREAD ResourceThreadId
2340 CcUnpinRepinnedBcb (
2342 IN BOOLEAN WriteThrough
,
2343 OUT PIO_STATUS_BLOCK IoStatus
2346 #if (VER_PRODUCTBUILD >= 2195)
2351 CcWaitForCurrentLazyWriterActivity (
2355 #endif /* (VER_PRODUCTBUILD >= 2195) */
2361 IN PFILE_OBJECT FileObject
,
2362 IN PLARGE_INTEGER StartOffset
,
2363 IN PLARGE_INTEGER EndOffset
,
2370 ExDisableResourceBoostLite (
2371 IN PERESOURCE Resource
2377 ExQueryPoolBlockSize (
2379 OUT PBOOLEAN QuotaCharged
2382 #if (VER_PRODUCTBUILD >= 2600)
2384 #ifndef __NTOSKRNL__
2388 ExInitializeRundownProtection (
2389 IN PEX_RUNDOWN_REF RunRef
2395 ExReInitializeRundownProtection (
2396 IN PEX_RUNDOWN_REF RunRef
2402 ExAcquireRundownProtection (
2403 IN PEX_RUNDOWN_REF RunRef
2409 ExAcquireRundownProtectionEx (
2410 IN PEX_RUNDOWN_REF RunRef
,
2417 ExReleaseRundownProtection (
2418 IN PEX_RUNDOWN_REF RunRef
2424 ExReleaseRundownProtectionEx (
2425 IN PEX_RUNDOWN_REF RunRef
,
2432 ExRundownCompleted (
2433 IN PEX_RUNDOWN_REF RunRef
2439 ExWaitForRundownProtectionRelease (
2440 IN PEX_RUNDOWN_REF RunRef
2444 #endif /* (VER_PRODUCTBUILD >= 2600) */
2446 #define FlagOn(x, f) ((x) & (f))
2451 FsRtlAddToTunnelCache (
2453 IN ULONGLONG DirectoryKey
,
2454 IN PUNICODE_STRING ShortName
,
2455 IN PUNICODE_STRING LongName
,
2456 IN BOOLEAN KeyByShortName
,
2457 IN ULONG DataLength
,
2461 #if (VER_PRODUCTBUILD >= 2195)
2465 FsRtlAllocateFileLock (
2466 IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL
,
2467 IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
2470 #endif /* (VER_PRODUCTBUILD >= 2195) */
2476 IN POOL_TYPE PoolType
,
2477 IN ULONG NumberOfBytes
2483 FsRtlAllocatePoolWithQuota (
2484 IN POOL_TYPE PoolType
,
2485 IN ULONG NumberOfBytes
2491 FsRtlAllocatePoolWithQuotaTag (
2492 IN POOL_TYPE PoolType
,
2493 IN ULONG NumberOfBytes
,
2500 FsRtlAllocatePoolWithTag (
2501 IN POOL_TYPE PoolType
,
2502 IN ULONG NumberOfBytes
,
2509 FsRtlAreNamesEqual (
2510 IN PCUNICODE_STRING Name1
,
2511 IN PCUNICODE_STRING Name2
,
2512 IN BOOLEAN IgnoreCase
,
2513 IN PCWCH UpcaseTable OPTIONAL
2516 #define FsRtlAreThereCurrentFileLocks(FL) ( \
2517 ((FL)->FastIoIsQuestionable) \
2521 FsRtlCheckLockForReadAccess:
2523 All this really does is pick out the lock parameters from the irp (io stack
2524 location?), get IoGetRequestorProcess, and pass values on to
2525 FsRtlFastCheckLockForRead.
2530 FsRtlCheckLockForReadAccess (
2531 IN PFILE_LOCK FileLock
,
2536 FsRtlCheckLockForWriteAccess:
2538 All this really does is pick out the lock parameters from the irp (io stack
2539 location?), get IoGetRequestorProcess, and pass values on to
2540 FsRtlFastCheckLockForWrite.
2545 FsRtlCheckLockForWriteAccess (
2546 IN PFILE_LOCK FileLock
,
2552 (NTAPI
*POPLOCK_WAIT_COMPLETE_ROUTINE
) (
2559 (NTAPI
*POPLOCK_FS_PREPOST_IRP
) (
2571 IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL
,
2572 IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL
2579 IN PFILE_OBJECT FileObject
,
2580 IN PLARGE_INTEGER FileOffset
,
2585 OUT PIO_STATUS_BLOCK IoStatus
,
2586 IN PDEVICE_OBJECT DeviceObject
2593 IN PFILE_OBJECT FileObject
,
2594 IN PLARGE_INTEGER FileOffset
,
2599 OUT PIO_STATUS_BLOCK IoStatus
,
2600 IN PDEVICE_OBJECT DeviceObject
2608 IN PVOID HeapBase OPTIONAL
,
2609 IN SIZE_T ReserveSize OPTIONAL
,
2610 IN SIZE_T CommitSize OPTIONAL
,
2611 IN PVOID Lock OPTIONAL
,
2612 IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL
2618 FsRtlCurrentBatchOplock (
2625 FsRtlDeleteKeyFromTunnelCache (
2627 IN ULONGLONG DirectoryKey
2633 FsRtlDeleteTunnelCache (
2640 FsRtlDeregisterUncProvider (
2655 IN ANSI_STRING Name
,
2656 OUT PANSI_STRING FirstPart
,
2657 OUT PANSI_STRING RemainingPart
2664 IN UNICODE_STRING Name
,
2665 OUT PUNICODE_STRING FirstPart
,
2666 OUT PUNICODE_STRING RemainingPart
2672 FsRtlDoesDbcsContainWildCards (
2673 IN PANSI_STRING Name
2679 FsRtlDoesNameContainWildCards (
2680 IN PUNICODE_STRING Name
2683 #define FsRtlCompleteRequest(IRP,STATUS) { \
2684 (IRP)->IoStatus.Status = (STATUS); \
2685 IoCompleteRequest( (IRP), IO_DISK_INCREMENT ); \
2688 #define FsRtlEnterFileSystem KeEnterCriticalRegion
2690 #define FsRtlExitFileSystem KeLeaveCriticalRegion
2695 FsRtlFastCheckLockForRead (
2696 IN PFILE_LOCK FileLock
,
2697 IN PLARGE_INTEGER FileOffset
,
2698 IN PLARGE_INTEGER Length
,
2700 IN PFILE_OBJECT FileObject
,
2701 IN PEPROCESS Process
2707 FsRtlFastCheckLockForWrite (
2708 IN PFILE_LOCK FileLock
,
2709 IN PLARGE_INTEGER FileOffset
,
2710 IN PLARGE_INTEGER Length
,
2712 IN PFILE_OBJECT FileObject
,
2713 IN PEPROCESS Process
2716 #define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) ( \
2717 FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11) \
2723 FsRtlFastUnlockAll (
2724 IN PFILE_LOCK FileLock
,
2725 IN PFILE_OBJECT FileObject
,
2726 IN PEPROCESS Process
,
2727 IN PVOID Context OPTIONAL
2729 /* ret: STATUS_RANGE_NOT_LOCKED */
2734 FsRtlFastUnlockAllByKey (
2735 IN PFILE_LOCK FileLock
,
2736 IN PFILE_OBJECT FileObject
,
2737 IN PEPROCESS Process
,
2739 IN PVOID Context OPTIONAL
2741 /* ret: STATUS_RANGE_NOT_LOCKED */
2746 FsRtlFastUnlockSingle (
2747 IN PFILE_LOCK FileLock
,
2748 IN PFILE_OBJECT FileObject
,
2749 IN PLARGE_INTEGER FileOffset
,
2750 IN PLARGE_INTEGER Length
,
2751 IN PEPROCESS Process
,
2753 IN PVOID Context OPTIONAL
,
2754 IN BOOLEAN AlreadySynchronized
2756 /* ret: STATUS_RANGE_NOT_LOCKED */
2761 FsRtlFindInTunnelCache (
2763 IN ULONGLONG DirectoryKey
,
2764 IN PUNICODE_STRING Name
,
2765 OUT PUNICODE_STRING ShortName
,
2766 OUT PUNICODE_STRING LongName
,
2767 IN OUT PULONG DataLength
,
2771 #if (VER_PRODUCTBUILD >= 2195)
2777 IN PFILE_LOCK FileLock
2780 #endif /* (VER_PRODUCTBUILD >= 2195) */
2786 IN PFILE_OBJECT FileObject
,
2787 IN OUT PLARGE_INTEGER FileSize
2791 FsRtlGetNextFileLock:
2793 ret: NULL if no more locks
2796 FsRtlGetNextFileLock uses FileLock->LastReturnedLockInfo and
2797 FileLock->LastReturnedLock as storage.
2798 LastReturnedLock is a pointer to the 'raw' lock inkl. double linked
2799 list, and FsRtlGetNextFileLock needs this to get next lock on subsequent
2800 calls with Restart = FALSE.
2805 FsRtlGetNextFileLock (
2806 IN PFILE_LOCK FileLock
,
2813 FsRtlInitializeFileLock (
2814 IN PFILE_LOCK FileLock
,
2815 IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL
,
2816 IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
2822 FsRtlInitializeOplock (
2823 IN OUT POPLOCK Oplock
2829 FsRtlInitializeTunnelCache (
2836 FsRtlIsNameInExpression (
2837 IN PUNICODE_STRING Expression
,
2838 IN PUNICODE_STRING Name
,
2839 IN BOOLEAN IgnoreCase
,
2840 IN PWCHAR UpcaseTable OPTIONAL
2846 FsRtlIsNtstatusExpected (
2847 IN NTSTATUS Ntstatus
2850 #define NLS_OEM_LEAD_BYTE_INFO NlsOemLeadByteInfo
2852 extern PUSHORT NlsOemLeadByteInfo
;
2854 #define FsRtlIsLeadDbcsCharacter(DBCS_CHAR) ( \
2855 (BOOLEAN)((UCHAR)(DBCS_CHAR) < 0x80 ? FALSE : \
2856 (NLS_MB_CODE_PAGE_TAG && \
2857 (NLS_OEM_LEAD_BYTE_INFO[(UCHAR)(DBCS_CHAR)] != 0))) \
2860 #define FsRtlIsAnsiCharacterWild(C) ( \
2861 FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], FSRTL_WILD_CHARACTER ) \
2864 #define FsRtlIsUnicodeCharacterWild(C) ( \
2867 FlagOn(FsRtlLegalAnsiCharacterArray[(C)], FSRTL_WILD_CHARACTER )) \
2874 IN PFILE_OBJECT FileObject
,
2875 IN PLARGE_INTEGER FileOffset
,
2879 OUT PIO_STATUS_BLOCK IoStatus
,
2880 IN PDEVICE_OBJECT DeviceObject
2886 FsRtlMdlReadComplete (
2887 IN PFILE_OBJECT FileObject
,
2894 FsRtlMdlReadCompleteDev (
2895 IN PFILE_OBJECT FileObject
,
2897 IN PDEVICE_OBJECT DeviceObject
2903 FsRtlPrepareMdlWriteDev (
2904 IN PFILE_OBJECT FileObject
,
2905 IN PLARGE_INTEGER FileOffset
,
2909 OUT PIO_STATUS_BLOCK IoStatus
,
2910 IN PDEVICE_OBJECT DeviceObject
2916 FsRtlMdlWriteComplete (
2917 IN PFILE_OBJECT FileObject
,
2918 IN PLARGE_INTEGER FileOffset
,
2925 FsRtlMdlWriteCompleteDev (
2926 IN PFILE_OBJECT FileObject
,
2927 IN PLARGE_INTEGER FileOffset
,
2929 IN PDEVICE_OBJECT DeviceObject
2935 FsRtlNormalizeNtstatus (
2936 IN NTSTATUS Exception
,
2937 IN NTSTATUS GenericException
2943 FsRtlNotifyChangeDirectory (
2944 IN PNOTIFY_SYNC NotifySync
,
2946 IN PSTRING FullDirectoryName
,
2947 IN PLIST_ENTRY NotifyList
,
2948 IN BOOLEAN WatchTree
,
2949 IN ULONG CompletionFilter
,
2956 FsRtlNotifyCleanup (
2957 IN PNOTIFY_SYNC NotifySync
,
2958 IN PLIST_ENTRY NotifyList
,
2962 typedef BOOLEAN (*PCHECK_FOR_TRAVERSE_ACCESS
) (
2963 IN PVOID NotifyContext
,
2964 IN PVOID TargetContext
,
2965 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
2971 FsRtlNotifyFullChangeDirectory (
2972 IN PNOTIFY_SYNC NotifySync
,
2973 IN PLIST_ENTRY NotifyList
,
2975 IN PSTRING FullDirectoryName
,
2976 IN BOOLEAN WatchTree
,
2977 IN BOOLEAN IgnoreBuffer
,
2978 IN ULONG CompletionFilter
,
2980 IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL
,
2981 IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL
2987 FsRtlNotifyFullReportChange (
2988 IN PNOTIFY_SYNC NotifySync
,
2989 IN PLIST_ENTRY NotifyList
,
2990 IN PSTRING FullTargetName
,
2991 IN USHORT TargetNameOffset
,
2992 IN PSTRING StreamName OPTIONAL
,
2993 IN PSTRING NormalizedParentName OPTIONAL
,
2994 IN ULONG FilterMatch
,
2996 IN PVOID TargetContext
3002 FsRtlNotifyInitializeSync (
3003 IN PNOTIFY_SYNC
*NotifySync
3009 FsRtlNotifyReportChange (
3010 IN PNOTIFY_SYNC NotifySync
,
3011 IN PLIST_ENTRY NotifyList
,
3012 IN PSTRING FullTargetName
,
3013 IN PUSHORT FileNamePartLength
,
3014 IN ULONG FilterMatch
3020 FsRtlNotifyUninitializeSync (
3021 IN PNOTIFY_SYNC
*NotifySync
3024 #if (VER_PRODUCTBUILD >= 2195)
3029 FsRtlNotifyVolumeEvent (
3030 IN PFILE_OBJECT FileObject
,
3034 #endif /* (VER_PRODUCTBUILD >= 2195) */
3048 FsRtlOplockIsFastIoPossible (
3055 ret: IoStatus->Status: STATUS_PENDING, STATUS_LOCK_NOT_GRANTED
3058 -Calls IoCompleteRequest if Irp
3059 -Uses exception handling / ExRaiseStatus with STATUS_INSUFFICIENT_RESOURCES
3065 IN PFILE_LOCK FileLock
,
3066 IN PFILE_OBJECT FileObject
,
3067 IN PLARGE_INTEGER FileOffset
,
3068 IN PLARGE_INTEGER Length
,
3069 IN PEPROCESS Process
,
3071 IN BOOLEAN FailImmediately
,
3072 IN BOOLEAN ExclusiveLock
,
3073 OUT PIO_STATUS_BLOCK IoStatus
,
3074 IN PIRP Irp OPTIONAL
,
3076 IN BOOLEAN AlreadySynchronized
3080 FsRtlProcessFileLock:
3083 -STATUS_INVALID_DEVICE_REQUEST
3084 -STATUS_RANGE_NOT_LOCKED from unlock routines.
3085 -STATUS_PENDING, STATUS_LOCK_NOT_GRANTED from FsRtlPrivateLock
3086 (redirected IoStatus->Status).
3089 -switch ( Irp->CurrentStackLocation->MinorFunction )
3090 lock: return FsRtlPrivateLock;
3091 unlocksingle: return FsRtlFastUnlockSingle;
3092 unlockall: return FsRtlFastUnlockAll;
3093 unlockallbykey: return FsRtlFastUnlockAllByKey;
3094 default: IofCompleteRequest with STATUS_INVALID_DEVICE_REQUEST;
3095 return STATUS_INVALID_DEVICE_REQUEST;
3097 -'AllwaysZero' is passed thru as 'AllwaysZero' to lock / unlock routines.
3098 -'Irp' is passet thru as 'Irp' to FsRtlPrivateLock.
3103 FsRtlProcessFileLock (
3104 IN PFILE_LOCK FileLock
,
3106 IN PVOID Context OPTIONAL
3112 FsRtlRegisterUncProvider (
3113 IN OUT PHANDLE MupHandle
,
3114 IN PUNICODE_STRING RedirectorDeviceName
,
3115 IN BOOLEAN MailslotsSupported
3119 (NTAPI
*PFSRTL_STACK_OVERFLOW_ROUTINE
) (
3127 FsRtlPostStackOverflow (
3130 IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine
3136 FsRtlPostPagingFileStackOverflow (
3139 IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine
3145 FsRtlUninitializeFileLock (
3146 IN PFILE_LOCK FileLock
3152 FsRtlUninitializeOplock (
3153 IN OUT POPLOCK Oplock
3166 KeSetIdealProcessorThread(
3167 IN OUT PKTHREAD Thread
,
3174 IoAttachDeviceToDeviceStackSafe(
3175 IN PDEVICE_OBJECT SourceDevice
,
3176 IN PDEVICE_OBJECT TargetDevice
,
3177 OUT PDEVICE_OBJECT
*AttachedToDeviceObject
3183 IoAcquireVpbSpinLock (
3190 IoCheckDesiredAccess (
3191 IN OUT PACCESS_MASK DesiredAccess
,
3192 IN ACCESS_MASK GrantedAccess
3198 IoCheckEaBufferValidity (
3199 IN PFILE_FULL_EA_INFORMATION EaBuffer
,
3201 OUT PULONG ErrorOffset
3207 IoCheckFunctionAccess (
3208 IN ACCESS_MASK GrantedAccess
,
3209 IN UCHAR MajorFunction
,
3210 IN UCHAR MinorFunction
,
3211 IN ULONG IoControlCode
,
3212 IN PVOID Argument1 OPTIONAL
,
3213 IN PVOID Argument2 OPTIONAL
3216 #if (VER_PRODUCTBUILD >= 2195)
3221 IoCheckQuotaBufferValidity (
3222 IN PFILE_QUOTA_INFORMATION QuotaBuffer
,
3223 IN ULONG QuotaLength
,
3224 OUT PULONG ErrorOffset
3227 #endif /* (VER_PRODUCTBUILD >= 2195) */
3232 IoCreateStreamFileObject (
3233 IN PFILE_OBJECT FileObject OPTIONAL
,
3234 IN PDEVICE_OBJECT DeviceObject OPTIONAL
3237 #if (VER_PRODUCTBUILD >= 2195)
3242 IoCreateStreamFileObjectLite (
3243 IN PFILE_OBJECT FileObject OPTIONAL
,
3244 IN PDEVICE_OBJECT DeviceObject OPTIONAL
3247 #endif /* (VER_PRODUCTBUILD >= 2195) */
3252 IoFastQueryNetworkAttributes (
3253 IN POBJECT_ATTRIBUTES ObjectAttributes
,
3254 IN ACCESS_MASK DesiredAccess
,
3255 IN ULONG OpenOptions
,
3256 OUT PIO_STATUS_BLOCK IoStatus
,
3257 OUT PFILE_NETWORK_OPEN_INFORMATION Buffer
3263 IoGetAttachedDevice (
3264 IN PDEVICE_OBJECT DeviceObject
3270 IoGetBaseFileSystemDeviceObject (
3271 IN PFILE_OBJECT FileObject
3277 IoGetRequestorProcess (
3281 #if (VER_PRODUCTBUILD >= 2195)
3286 IoGetRequestorProcessId (
3290 #endif /* (VER_PRODUCTBUILD >= 2195) */
3299 #define IoIsFileOpenedExclusively(FileObject) ( \
3301 (FileObject)->SharedRead || \
3302 (FileObject)->SharedWrite || \
3303 (FileObject)->SharedDelete \
3310 IoIsOperationSynchronous (
3321 #if (VER_PRODUCTBUILD >= 2195)
3326 IoIsValidNameGraftingBuffer (
3328 IN PREPARSE_DATA_BUFFER ReparseBuffer
3331 #endif /* (VER_PRODUCTBUILD >= 2195) */
3337 IN PFILE_OBJECT FileObject
,
3339 IN PLARGE_INTEGER Offset
,
3341 OUT PIO_STATUS_BLOCK IoStatusBlock
3347 IoQueryFileInformation (
3348 IN PFILE_OBJECT FileObject
,
3349 IN FILE_INFORMATION_CLASS FileInformationClass
,
3351 OUT PVOID FileInformation
,
3352 OUT PULONG ReturnedLength
3358 IoQueryVolumeInformation (
3359 IN PFILE_OBJECT FileObject
,
3360 IN FS_INFORMATION_CLASS FsInformationClass
,
3362 OUT PVOID FsInformation
,
3363 OUT PULONG ReturnedLength
3376 IoRegisterFileSystem (
3377 IN OUT PDEVICE_OBJECT DeviceObject
3380 #if (VER_PRODUCTBUILD >= 1381)
3382 typedef VOID (NTAPI
*PDRIVER_FS_NOTIFICATION
) (
3383 IN PDEVICE_OBJECT DeviceObject
,
3384 IN BOOLEAN DriverActive
3390 IoRegisterFsRegistrationChange (
3391 IN PDRIVER_OBJECT DriverObject
,
3392 IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
3395 #endif /* (VER_PRODUCTBUILD >= 1381) */
3400 IoReleaseVpbSpinLock (
3407 IoSetDeviceToVerify (
3409 IN PDEVICE_OBJECT DeviceObject
3416 IN PFILE_OBJECT FileObject
,
3417 IN FILE_INFORMATION_CLASS FileInformationClass
,
3419 IN PVOID FileInformation
3432 IoSynchronousPageWrite (
3433 IN PFILE_OBJECT FileObject
,
3435 IN PLARGE_INTEGER FileOffset
,
3437 OUT PIO_STATUS_BLOCK IoStatusBlock
3450 IoUnregisterFileSystem (
3451 IN OUT PDEVICE_OBJECT DeviceObject
3454 #if (VER_PRODUCTBUILD >= 1381)
3459 IoUnregisterFsRegistrationChange (
3460 IN PDRIVER_OBJECT DriverObject
,
3461 IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
3464 #endif /* (VER_PRODUCTBUILD >= 1381) */
3470 IN PDEVICE_OBJECT DeviceObject
,
3471 IN BOOLEAN AllowRawMount
3477 KeAcquireQueuedSpinLock (
3478 IN KSPIN_LOCK_QUEUE_NUMBER Number
3484 KeReleaseQueuedSpinLock (
3485 IN KSPIN_LOCK_QUEUE_NUMBER Number
,
3493 IN PKPROCESS Process
3508 IN ULONG Count OPTIONAL
3516 IN PLIST_ENTRY Entry
3524 IN PLIST_ENTRY Entry
3539 IN KPROCESSOR_MODE WaitMode
,
3540 IN PLARGE_INTEGER Timeout OPTIONAL
3553 KeInitializeMutant (
3554 IN PRKMUTANT Mutant
,
3555 IN BOOLEAN InitialOwner
3569 IN PRKMUTANT Mutant
,
3570 IN KPRIORITY Increment
,
3571 IN BOOLEAN Abandoned
,
3575 #if (VER_PRODUCTBUILD >= 2195)
3580 KeStackAttachProcess (
3581 IN PKPROCESS Process
,
3582 OUT PKAPC_STATE ApcState
3588 KeUnstackDetachProcess (
3589 IN PKAPC_STATE ApcState
3592 #endif /* (VER_PRODUCTBUILD >= 2195) */
3597 KeSetKernelStackSwapEnable(
3604 MmCanFileBeTruncated (
3605 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
3606 IN PLARGE_INTEGER NewFileSize
3612 MmFlushImageSection (
3613 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
3614 IN MMFLUSH_TYPE FlushType
3620 MmForceSectionClosed (
3621 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
,
3622 IN BOOLEAN DelayClose
3625 #if (VER_PRODUCTBUILD >= 1381)
3630 MmIsRecursiveIoFault (
3636 #define MmIsRecursiveIoFault() ( \
3637 (PsGetCurrentThread()->DisablePageFaultClustering) | \
3638 (PsGetCurrentThread()->ForwardClusterOnly) \
3647 MmSetAddressRangeModified (
3656 IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL
,
3657 IN POBJECT_TYPE ObjectType
,
3658 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL
,
3659 IN KPROCESSOR_MODE AccessMode
,
3660 IN OUT PVOID ParseContext OPTIONAL
,
3661 IN ULONG ObjectSize
,
3662 IN ULONG PagedPoolCharge OPTIONAL
,
3663 IN ULONG NonPagedPoolCharge OPTIONAL
,
3670 ObGetObjectPointerCount (
3679 IN PACCESS_STATE PassedAccessState OPTIONAL
,
3680 IN ACCESS_MASK DesiredAccess
,
3681 IN ULONG AdditionalReferences
,
3682 OUT PVOID
*ReferencedObject OPTIONAL
,
3689 ObMakeTemporaryObject (
3696 ObOpenObjectByPointer (
3698 IN ULONG HandleAttributes
,
3699 IN PACCESS_STATE PassedAccessState OPTIONAL
,
3700 IN ACCESS_MASK DesiredAccess OPTIONAL
,
3701 IN POBJECT_TYPE ObjectType OPTIONAL
,
3702 IN KPROCESSOR_MODE AccessMode
,
3711 OUT POBJECT_NAME_INFORMATION ObjectNameInfo
,
3713 OUT PULONG ReturnLength
3719 ObQueryObjectAuditingByHandle (
3721 OUT PBOOLEAN GenerateOnClose
3727 ObReferenceObjectByName (
3728 IN PUNICODE_STRING ObjectName
,
3729 IN ULONG Attributes
,
3730 IN PACCESS_STATE PassedAccessState OPTIONAL
,
3731 IN ACCESS_MASK DesiredAccess OPTIONAL
,
3732 IN POBJECT_TYPE ObjectType
,
3733 IN KPROCESSOR_MODE AccessMode
,
3734 IN OUT PVOID ParseContext OPTIONAL
,
3741 PsAssignImpersonationToken (
3750 IN PEPROCESS Process
,
3751 IN POOL_TYPE PoolType
,
3758 PsChargeProcessPoolQuota (
3759 IN PEPROCESS Process
,
3760 IN POOL_TYPE PoolType
,
3764 #define PsDereferenceImpersonationToken(T) \
3765 {if (ARGUMENT_PRESENT(T)) { \
3766 (ObDereferenceObject((T))); \
3772 #define PsDereferencePrimaryToken(T) (ObDereferenceObject((T)))
3777 PsDisableImpersonation(
3779 IN PSE_IMPERSONATION_STATE ImpersonationState
3785 PsGetProcessExitTime (
3792 PsImpersonateClient(
3794 IN PACCESS_TOKEN Token
,
3795 IN BOOLEAN CopyOnOpen
,
3796 IN BOOLEAN EffectiveOnly
,
3797 IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
3810 PsIsThreadTerminating (
3817 PsLookupProcessByProcessId (
3818 IN HANDLE ProcessId
,
3819 OUT PEPROCESS
*Process
3825 PsLookupProcessThreadByCid (
3827 OUT PEPROCESS
*Process OPTIONAL
,
3828 OUT PETHREAD
*Thread
3834 PsLookupThreadByThreadId (
3835 IN HANDLE UniqueThreadId
,
3836 OUT PETHREAD
*Thread
3842 PsReferenceImpersonationToken (
3844 OUT PBOOLEAN CopyOnUse
,
3845 OUT PBOOLEAN EffectiveOnly
,
3846 OUT PSECURITY_IMPERSONATION_LEVEL Level
3852 PsReferencePrimaryToken (
3853 IN PEPROCESS Process
3859 PsRestoreImpersonation(
3861 IN PSE_IMPERSONATION_STATE ImpersonationState
3868 IN PEPROCESS Process
,
3869 IN POOL_TYPE PoolType
,
3883 RtlAbsoluteToSelfRelativeSD (
3884 IN PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor
,
3885 IN OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor
,
3886 IN PULONG BufferLength
3893 IN HANDLE HeapHandle
,
3901 RtlAppendStringToString(
3902 PSTRING Destination
,
3903 const STRING
*Source
3909 RtlCaptureStackBackTrace (
3910 IN ULONG FramesToSkip
,
3911 IN ULONG FramesToCapture
,
3912 OUT PVOID
*BackTrace
,
3913 OUT PULONG BackTraceHash OPTIONAL
3919 RtlCompareMemoryUlong (
3929 IN USHORT CompressionFormatAndEngine
,
3930 IN PUCHAR UncompressedBuffer
,
3931 IN ULONG UncompressedBufferSize
,
3932 OUT PUCHAR CompressedBuffer
,
3933 IN ULONG CompressedBufferSize
,
3934 IN ULONG UncompressedChunkSize
,
3935 OUT PULONG FinalCompressedSize
,
3943 IN PUCHAR UncompressedBuffer
,
3944 IN ULONG UncompressedBufferSize
,
3945 OUT PUCHAR CompressedBuffer
,
3946 IN ULONG CompressedBufferSize
,
3947 IN OUT PCOMPRESSED_DATA_INFO CompressedDataInfo
,
3948 IN ULONG CompressedDataInfoLength
,
3955 RtlConvertSidToUnicodeString (
3956 OUT PUNICODE_STRING DestinationString
,
3958 IN BOOLEAN AllocateDestinationString
3966 IN PSID Destination
,
3973 RtlCreateUnicodeString(
3974 PUNICODE_STRING DestinationString
,
3981 RtlDecompressBuffer (
3982 IN USHORT CompressionFormat
,
3983 OUT PUCHAR UncompressedBuffer
,
3984 IN ULONG UncompressedBufferSize
,
3985 IN PUCHAR CompressedBuffer
,
3986 IN ULONG CompressedBufferSize
,
3987 OUT PULONG FinalUncompressedSize
3993 RtlDecompressChunks (
3994 OUT PUCHAR UncompressedBuffer
,
3995 IN ULONG UncompressedBufferSize
,
3996 IN PUCHAR CompressedBuffer
,
3997 IN ULONG CompressedBufferSize
,
3998 IN PUCHAR CompressedTail
,
3999 IN ULONG CompressedTailSize
,
4000 IN PCOMPRESSED_DATA_INFO CompressedDataInfo
4006 RtlDecompressFragment (
4007 IN USHORT CompressionFormat
,
4008 OUT PUCHAR UncompressedFragment
,
4009 IN ULONG UncompressedFragmentSize
,
4010 IN PUCHAR CompressedBuffer
,
4011 IN ULONG CompressedBufferSize
,
4012 IN ULONG FragmentOffset
,
4013 OUT PULONG FinalUncompressedSize
,
4021 IN USHORT CompressionFormat
,
4022 IN OUT PUCHAR
*CompressedBuffer
,
4023 IN PUCHAR EndOfCompressedBufferPlus1
,
4024 OUT PUCHAR
*ChunkBuffer
,
4025 OUT PULONG ChunkSize
4031 RtlDowncaseUnicodeString(
4032 IN OUT PUNICODE_STRING UniDest
,
4033 IN PCUNICODE_STRING UniSource
,
4034 IN BOOLEAN AllocateDestinationString
4040 RtlDuplicateUnicodeString(
4042 IN PCUNICODE_STRING SourceString
,
4043 OUT PUNICODE_STRING DestinationString
4057 RtlFillMemoryUlong (
4058 IN PVOID Destination
,
4067 IN HANDLE HeapHandle
,
4075 RtlGenerate8dot3Name (
4076 IN PUNICODE_STRING Name
,
4077 IN BOOLEAN AllowExtendedCharacters
,
4078 IN OUT PGENERATE_NAME_CONTEXT Context
,
4079 OUT PUNICODE_STRING Name8dot3
4085 RtlGetCompressionWorkSpaceSize (
4086 IN USHORT CompressionFormatAndEngine
,
4087 OUT PULONG CompressBufferWorkSpaceSize
,
4088 OUT PULONG CompressFragmentWorkSpaceSize
4094 RtlGetDaclSecurityDescriptor (
4095 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4096 OUT PBOOLEAN DaclPresent
,
4098 OUT PBOOLEAN DaclDefaulted
4104 RtlGetGroupSecurityDescriptor (
4105 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4107 OUT PBOOLEAN GroupDefaulted
4113 RtlGetOwnerSecurityDescriptor (
4114 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4116 OUT PBOOLEAN OwnerDefaulted
4124 IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority
,
4125 IN UCHAR SubAuthorityCount
4131 RtlIsNameLegalDOS8Dot3(
4132 IN PCUNICODE_STRING Name
,
4133 IN OUT POEM_STRING OemName OPTIONAL
,
4134 IN OUT PBOOLEAN NameContainsSpaces OPTIONAL
4140 RtlLengthRequiredSid (
4141 IN ULONG SubAuthorityCount
4154 RtlNtStatusToDosError (
4161 RtlOemStringToUnicodeString(
4162 IN OUT PUNICODE_STRING DestinationString
,
4163 IN PCOEM_STRING SourceString
,
4164 IN BOOLEAN AllocateDestinationString
4170 RtlUnicodeStringToOemString(
4171 IN OUT POEM_STRING DestinationString
,
4172 IN PCUNICODE_STRING SourceString
,
4173 IN BOOLEAN AllocateDestinationString
4180 IN USHORT CompressionFormat
,
4181 IN OUT PUCHAR
*CompressedBuffer
,
4182 IN PUCHAR EndOfCompressedBufferPlus1
,
4183 OUT PUCHAR
*ChunkBuffer
,
4190 RtlSecondsSince1970ToTime (
4191 IN ULONG SecondsSince1970
,
4192 OUT PLARGE_INTEGER Time
4198 RtlSetGroupSecurityDescriptor (
4199 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
4201 IN BOOLEAN GroupDefaulted
4207 RtlSetOwnerSecurityDescriptor (
4208 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
4210 IN BOOLEAN OwnerDefaulted
4216 RtlSetSaclSecurityDescriptor (
4217 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
4218 IN BOOLEAN SaclPresent
,
4220 IN BOOLEAN SaclDefaulted
4226 RtlSubAuthorityCountSid (
4233 RtlSubAuthoritySid (
4235 IN ULONG SubAuthority
4241 RtlUnicodeToMultiByteN(
4242 OUT PCHAR MultiByteString
,
4243 IN ULONG MaxBytesInMultiByteString
,
4244 OUT PULONG BytesInMultiByteString OPTIONAL
,
4245 IN PWCH UnicodeString
,
4246 IN ULONG BytesInUnicodeString
4249 /* RTL Splay Tree Functions */
4253 RtlSplay(PRTL_SPLAY_LINKS Links
);
4258 RtlDelete(PRTL_SPLAY_LINKS Links
);
4264 PRTL_SPLAY_LINKS Links
,
4265 PRTL_SPLAY_LINKS
*Root
4271 RtlSubtreeSuccessor(PRTL_SPLAY_LINKS Links
);
4276 RtlSubtreePredecessor(PRTL_SPLAY_LINKS Links
);
4281 RtlRealSuccessor(PRTL_SPLAY_LINKS Links
);
4286 RtlRealPredecessor(PRTL_SPLAY_LINKS Links
);
4288 #define RtlIsLeftChild(Links) \
4289 (RtlLeftChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
4291 #define RtlIsRightChild(Links) \
4292 (RtlRightChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
4294 #define RtlRightChild(Links) \
4295 ((PRTL_SPLAY_LINKS)(Links))->RightChild
4297 #define RtlIsRoot(Links) \
4298 (RtlParent(Links) == (PRTL_SPLAY_LINKS)(Links))
4300 #define RtlLeftChild(Links) \
4301 ((PRTL_SPLAY_LINKS)(Links))->LeftChild
4303 #define RtlParent(Links) \
4304 ((PRTL_SPLAY_LINKS)(Links))->Parent
4306 #define RtlInitializeSplayLinks(Links) \
4308 PRTL_SPLAY_LINKS _SplayLinks; \
4309 _SplayLinks = (PRTL_SPLAY_LINKS)(Links); \
4310 _SplayLinks->Parent = _SplayLinks; \
4311 _SplayLinks->LeftChild = NULL; \
4312 _SplayLinks->RightChild = NULL; \
4315 #define RtlInsertAsLeftChild(ParentLinks,ChildLinks) \
4317 PRTL_SPLAY_LINKS _SplayParent; \
4318 PRTL_SPLAY_LINKS _SplayChild; \
4319 _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
4320 _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \
4321 _SplayParent->LeftChild = _SplayChild; \
4322 _SplayChild->Parent = _SplayParent; \
4325 #define RtlInsertAsRightChild(ParentLinks,ChildLinks) \
4327 PRTL_SPLAY_LINKS _SplayParent; \
4328 PRTL_SPLAY_LINKS _SplayChild; \
4329 _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
4330 _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \
4331 _SplayParent->RightChild = _SplayChild; \
4332 _SplayChild->Parent = _SplayParent; \
4345 SeAppendPrivileges (
4346 PACCESS_STATE AccessState
,
4347 PPRIVILEGE_SET Privileges
4353 SeAuditingFileEvents (
4354 IN BOOLEAN AccessGranted
,
4355 IN PSECURITY_DESCRIPTOR SecurityDescriptor
4361 SeAuditingFileOrGlobalEvents (
4362 IN BOOLEAN AccessGranted
,
4363 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4364 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4370 SeCaptureSubjectContext (
4371 OUT PSECURITY_SUBJECT_CONTEXT SubjectContext
4377 SeCreateClientSecurity (
4379 IN PSECURITY_QUALITY_OF_SERVICE QualityOfService
,
4380 IN BOOLEAN RemoteClient
,
4381 OUT PSECURITY_CLIENT_CONTEXT ClientContext
4384 #if (VER_PRODUCTBUILD >= 2195)
4389 SeCreateClientSecurityFromSubjectContext (
4390 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
,
4391 IN PSECURITY_QUALITY_OF_SERVICE QualityOfService
,
4392 IN BOOLEAN ServerIsRemote
,
4393 OUT PSECURITY_CLIENT_CONTEXT ClientContext
4396 #endif /* (VER_PRODUCTBUILD >= 2195) */
4399 #define SeLengthSid( Sid ) \
4400 (8 + (4 * ((SID *)Sid)->SubAuthorityCount))
4402 #define SeDeleteClientSecurity(C) { \
4403 if (SeTokenType((C)->ClientToken) == TokenPrimary) { \
4404 PsDereferencePrimaryToken( (C)->ClientToken ); \
4406 PsDereferenceImpersonationToken( (C)->ClientToken ); \
4413 SeDeleteObjectAuditAlarm (
4418 #define SeEnableAccessToExports() SeExports = *(PSE_EXPORTS *)SeExports;
4424 IN PPRIVILEGE_SET Privileges
4430 SeImpersonateClient (
4431 IN PSECURITY_CLIENT_CONTEXT ClientContext
,
4432 IN PETHREAD ServerThread OPTIONAL
4435 #if (VER_PRODUCTBUILD >= 2195)
4440 SeImpersonateClientEx (
4441 IN PSECURITY_CLIENT_CONTEXT ClientContext
,
4442 IN PETHREAD ServerThread OPTIONAL
4445 #endif /* (VER_PRODUCTBUILD >= 2195) */
4450 SeLockSubjectContext (
4451 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4457 SeMarkLogonSessionForTerminationNotification (
4464 SeOpenObjectAuditAlarm (
4465 IN PUNICODE_STRING ObjectTypeName
,
4466 IN PVOID Object OPTIONAL
,
4467 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL
,
4468 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4469 IN PACCESS_STATE AccessState
,
4470 IN BOOLEAN ObjectCreated
,
4471 IN BOOLEAN AccessGranted
,
4472 IN KPROCESSOR_MODE AccessMode
,
4473 OUT PBOOLEAN GenerateOnClose
4479 SeOpenObjectForDeleteAuditAlarm (
4480 IN PUNICODE_STRING ObjectTypeName
,
4481 IN PVOID Object OPTIONAL
,
4482 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL
,
4483 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4484 IN PACCESS_STATE AccessState
,
4485 IN BOOLEAN ObjectCreated
,
4486 IN BOOLEAN AccessGranted
,
4487 IN KPROCESSOR_MODE AccessMode
,
4488 OUT PBOOLEAN GenerateOnClose
4495 IN OUT PPRIVILEGE_SET RequiredPrivileges
,
4496 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
,
4497 IN KPROCESSOR_MODE AccessMode
4503 SeQueryAuthenticationIdToken (
4504 IN PACCESS_TOKEN Token
,
4508 #if (VER_PRODUCTBUILD >= 2195)
4513 SeQueryInformationToken (
4514 IN PACCESS_TOKEN Token
,
4515 IN TOKEN_INFORMATION_CLASS TokenInformationClass
,
4516 OUT PVOID
*TokenInformation
4519 #endif /* (VER_PRODUCTBUILD >= 2195) */
4524 SeQuerySecurityDescriptorInfo (
4525 IN PSECURITY_INFORMATION SecurityInformation
,
4526 OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
4527 IN OUT PULONG Length
,
4528 IN PSECURITY_DESCRIPTOR
*ObjectsSecurityDescriptor
4531 #if (VER_PRODUCTBUILD >= 2195)
4536 SeQuerySessionIdToken (
4537 IN PACCESS_TOKEN Token
,
4541 #endif /* (VER_PRODUCTBUILD >= 2195) */
4543 #define SeQuerySubjectContextToken( SubjectContext ) \
4544 ( ARGUMENT_PRESENT( \
4545 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken \
4547 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken : \
4548 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
4550 typedef NTSTATUS (*PSE_LOGON_SESSION_TERMINATED_ROUTINE
) (
4557 SeRegisterLogonSessionTerminatedRoutine (
4558 IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
4564 SeReleaseSubjectContext (
4565 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4571 SeSetAccessStateGenericMapping (
4572 PACCESS_STATE AccessState
,
4573 PGENERIC_MAPPING GenericMapping
4579 SeSetSecurityDescriptorInfo (
4580 IN PVOID Object OPTIONAL
,
4581 IN PSECURITY_INFORMATION SecurityInformation
,
4582 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4583 IN OUT PSECURITY_DESCRIPTOR
*ObjectsSecurityDescriptor
,
4584 IN POOL_TYPE PoolType
,
4585 IN PGENERIC_MAPPING GenericMapping
4588 #if (VER_PRODUCTBUILD >= 2195)
4593 SeSetSecurityDescriptorInfoEx (
4594 IN PVOID Object OPTIONAL
,
4595 IN PSECURITY_INFORMATION SecurityInformation
,
4596 IN PSECURITY_DESCRIPTOR ModificationDescriptor
,
4597 IN OUT PSECURITY_DESCRIPTOR
*ObjectsSecurityDescriptor
,
4598 IN ULONG AutoInheritFlags
,
4599 IN POOL_TYPE PoolType
,
4600 IN PGENERIC_MAPPING GenericMapping
4607 IN PACCESS_TOKEN Token
4613 SeTokenIsRestricted (
4614 IN PACCESS_TOKEN Token
4620 SeLocateProcessImageName(
4621 IN PEPROCESS Process
,
4622 OUT PUNICODE_STRING
*pImageFileName
4625 #endif /* (VER_PRODUCTBUILD >= 2195) */
4631 IN PACCESS_TOKEN Token
4637 SeUnlockSubjectContext (
4638 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4644 SeUnregisterLogonSessionTerminatedRoutine (
4645 IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
4648 #if (VER_PRODUCTBUILD >= 2195)
4653 ZwAdjustPrivilegesToken (
4654 IN HANDLE TokenHandle
,
4655 IN BOOLEAN DisableAllPrivileges
,
4656 IN PTOKEN_PRIVILEGES NewState
,
4657 IN ULONG BufferLength
,
4658 OUT PTOKEN_PRIVILEGES PreviousState OPTIONAL
,
4659 OUT PULONG ReturnLength
4662 #endif /* (VER_PRODUCTBUILD >= 2195) */
4668 IN HANDLE ThreadHandle
4674 ZwAllocateVirtualMemory (
4675 IN HANDLE ProcessHandle
,
4676 IN OUT PVOID
*BaseAddress
,
4678 IN OUT PSIZE_T RegionSize
,
4679 IN ULONG AllocationType
,
4685 NtAccessCheckByTypeAndAuditAlarm(
4686 IN PUNICODE_STRING SubsystemName
,
4688 IN PUNICODE_STRING ObjectTypeName
,
4689 IN PUNICODE_STRING ObjectName
,
4690 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4691 IN PSID PrincipalSelfSid
,
4692 IN ACCESS_MASK DesiredAccess
,
4693 IN AUDIT_EVENT_TYPE AuditType
,
4695 IN POBJECT_TYPE_LIST ObjectTypeList
,
4696 IN ULONG ObjectTypeLength
,
4697 IN PGENERIC_MAPPING GenericMapping
,
4698 IN BOOLEAN ObjectCreation
,
4699 OUT PACCESS_MASK GrantedAccess
,
4700 OUT PNTSTATUS AccessStatus
,
4701 OUT PBOOLEAN GenerateOnClose
4706 NtAccessCheckByTypeResultListAndAuditAlarm(
4707 IN PUNICODE_STRING SubsystemName
,
4709 IN PUNICODE_STRING ObjectTypeName
,
4710 IN PUNICODE_STRING ObjectName
,
4711 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4712 IN PSID PrincipalSelfSid
,
4713 IN ACCESS_MASK DesiredAccess
,
4714 IN AUDIT_EVENT_TYPE AuditType
,
4716 IN POBJECT_TYPE_LIST ObjectTypeList
,
4717 IN ULONG ObjectTypeLength
,
4718 IN PGENERIC_MAPPING GenericMapping
,
4719 IN BOOLEAN ObjectCreation
,
4720 OUT PACCESS_MASK GrantedAccess
,
4721 OUT PNTSTATUS AccessStatus
,
4722 OUT PBOOLEAN GenerateOnClose
4727 NtAccessCheckByTypeResultListAndAuditAlarmByHandle(
4728 IN PUNICODE_STRING SubsystemName
,
4730 IN HANDLE ClientToken
,
4731 IN PUNICODE_STRING ObjectTypeName
,
4732 IN PUNICODE_STRING ObjectName
,
4733 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4734 IN PSID PrincipalSelfSid
,
4735 IN ACCESS_MASK DesiredAccess
,
4736 IN AUDIT_EVENT_TYPE AuditType
,
4738 IN POBJECT_TYPE_LIST ObjectTypeList
,
4739 IN ULONG ObjectTypeLength
,
4740 IN PGENERIC_MAPPING GenericMapping
,
4741 IN BOOLEAN ObjectCreation
,
4742 OUT PACCESS_MASK GrantedAccess
,
4743 OUT PNTSTATUS AccessStatus
,
4744 OUT PBOOLEAN GenerateOnClose
4750 ZwAccessCheckAndAuditAlarm (
4751 IN PUNICODE_STRING SubsystemName
,
4753 IN PUNICODE_STRING ObjectTypeName
,
4754 IN PUNICODE_STRING ObjectName
,
4755 IN PSECURITY_DESCRIPTOR SecurityDescriptor
,
4756 IN ACCESS_MASK DesiredAccess
,
4757 IN PGENERIC_MAPPING GenericMapping
,
4758 IN BOOLEAN ObjectCreation
,
4759 OUT PACCESS_MASK GrantedAccess
,
4760 OUT PBOOLEAN AccessStatus
,
4761 OUT PBOOLEAN GenerateOnClose
4764 #if (VER_PRODUCTBUILD >= 2195)
4770 IN HANDLE FileHandle
,
4771 OUT PIO_STATUS_BLOCK IoStatusBlock
4774 #endif /* (VER_PRODUCTBUILD >= 2195) */
4780 IN HANDLE EventHandle
4786 ZwCloseObjectAuditAlarm (
4787 IN PUNICODE_STRING SubsystemName
,
4789 IN BOOLEAN GenerateOnClose
4796 OUT PHANDLE SectionHandle
,
4797 IN ACCESS_MASK DesiredAccess
,
4798 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL
,
4799 IN PLARGE_INTEGER MaximumSize OPTIONAL
,
4800 IN ULONG SectionPageProtection
,
4801 IN ULONG AllocationAttributes
,
4802 IN HANDLE FileHandle OPTIONAL
4808 ZwCreateSymbolicLinkObject (
4809 OUT PHANDLE SymbolicLinkHandle
,
4810 IN ACCESS_MASK DesiredAccess
,
4811 IN POBJECT_ATTRIBUTES ObjectAttributes
,
4812 IN PUNICODE_STRING TargetName
4819 IN POBJECT_ATTRIBUTES ObjectAttributes
4827 IN PUNICODE_STRING Name
4833 ZwDeviceIoControlFile (
4834 IN HANDLE FileHandle
,
4835 IN HANDLE Event OPTIONAL
,
4836 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
4837 IN PVOID ApcContext OPTIONAL
,
4838 OUT PIO_STATUS_BLOCK IoStatusBlock
,
4839 IN ULONG IoControlCode
,
4840 IN PVOID InputBuffer OPTIONAL
,
4841 IN ULONG InputBufferLength
,
4842 OUT PVOID OutputBuffer OPTIONAL
,
4843 IN ULONG OutputBufferLength
4850 IN PUNICODE_STRING String
4857 IN HANDLE SourceProcessHandle
,
4858 IN HANDLE SourceHandle
,
4859 IN HANDLE TargetProcessHandle OPTIONAL
,
4860 OUT PHANDLE TargetHandle OPTIONAL
,
4861 IN ACCESS_MASK DesiredAccess
,
4862 IN ULONG HandleAttributes
,
4870 IN HANDLE ExistingTokenHandle
,
4871 IN ACCESS_MASK DesiredAccess
,
4872 IN POBJECT_ATTRIBUTES ObjectAttributes
,
4873 IN BOOLEAN EffectiveOnly
,
4874 IN TOKEN_TYPE TokenType
,
4875 OUT PHANDLE NewTokenHandle
4881 IN HANDLE ExistingTokenHandle
,
4883 IN PTOKEN_GROUPS SidsToDisable OPTIONAL
,
4884 IN PTOKEN_PRIVILEGES PrivilegesToDelete OPTIONAL
,
4885 IN PTOKEN_GROUPS RestrictedSids OPTIONAL
,
4886 OUT PHANDLE NewTokenHandle
4892 ZwFlushInstructionCache (
4893 IN HANDLE ProcessHandle
,
4894 IN PVOID BaseAddress OPTIONAL
,
4902 IN HANDLE FileHandle
,
4903 OUT PIO_STATUS_BLOCK IoStatusBlock
4906 #if (VER_PRODUCTBUILD >= 2195)
4911 ZwFlushVirtualMemory (
4912 IN HANDLE ProcessHandle
,
4913 IN OUT PVOID
*BaseAddress
,
4914 IN OUT PULONG FlushSize
,
4915 OUT PIO_STATUS_BLOCK IoStatusBlock
4918 #endif /* (VER_PRODUCTBUILD >= 2195) */
4923 ZwFreeVirtualMemory (
4924 IN HANDLE ProcessHandle
,
4925 IN OUT PVOID
*BaseAddress
,
4926 IN OUT PSIZE_T RegionSize
,
4934 IN HANDLE FileHandle
,
4935 IN HANDLE Event OPTIONAL
,
4936 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
4937 IN PVOID ApcContext OPTIONAL
,
4938 OUT PIO_STATUS_BLOCK IoStatusBlock
,
4939 IN ULONG FsControlCode
,
4940 IN PVOID InputBuffer OPTIONAL
,
4941 IN ULONG InputBufferLength
,
4942 OUT PVOID OutputBuffer OPTIONAL
,
4943 IN ULONG OutputBufferLength
4946 #if (VER_PRODUCTBUILD >= 2195)
4951 ZwInitiatePowerAction (
4952 IN POWER_ACTION SystemAction
,
4953 IN SYSTEM_POWER_STATE MinSystemState
,
4955 IN BOOLEAN Asynchronous
4958 #endif /* (VER_PRODUCTBUILD >= 2195) */
4964 /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
4965 IN PUNICODE_STRING RegistryPath
4972 IN POBJECT_ATTRIBUTES KeyObjectAttributes
,
4973 IN POBJECT_ATTRIBUTES FileObjectAttributes
4980 IN HANDLE KeyHandle
,
4981 IN HANDLE EventHandle OPTIONAL
,
4982 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
4983 IN PVOID ApcContext OPTIONAL
,
4984 OUT PIO_STATUS_BLOCK IoStatusBlock
,
4985 IN ULONG NotifyFilter
,
4986 IN BOOLEAN WatchSubtree
,
4988 IN ULONG BufferLength
,
4989 IN BOOLEAN Asynchronous
4995 ZwOpenDirectoryObject (
4996 OUT PHANDLE DirectoryHandle
,
4997 IN ACCESS_MASK DesiredAccess
,
4998 IN POBJECT_ATTRIBUTES ObjectAttributes
5005 OUT PHANDLE EventHandle
,
5006 IN ACCESS_MASK DesiredAccess
,
5007 IN POBJECT_ATTRIBUTES ObjectAttributes
5014 OUT PHANDLE ProcessHandle
,
5015 IN ACCESS_MASK DesiredAccess
,
5016 IN POBJECT_ATTRIBUTES ObjectAttributes
,
5017 IN PCLIENT_ID ClientId OPTIONAL
5023 ZwOpenProcessToken (
5024 IN HANDLE ProcessHandle
,
5025 IN ACCESS_MASK DesiredAccess
,
5026 OUT PHANDLE TokenHandle
5033 OUT PHANDLE ThreadHandle
,
5034 IN ACCESS_MASK DesiredAccess
,
5035 IN POBJECT_ATTRIBUTES ObjectAttributes
,
5036 IN PCLIENT_ID ClientId
5043 IN HANDLE ThreadHandle
,
5044 IN ACCESS_MASK DesiredAccess
,
5045 IN BOOLEAN OpenAsSelf
,
5046 OUT PHANDLE TokenHandle
5049 #if (VER_PRODUCTBUILD >= 2195)
5054 ZwPowerInformation (
5055 IN POWER_INFORMATION_LEVEL PowerInformationLevel
,
5056 IN PVOID InputBuffer OPTIONAL
,
5057 IN ULONG InputBufferLength
,
5058 OUT PVOID OutputBuffer OPTIONAL
,
5059 IN ULONG OutputBufferLength
5062 #endif /* (VER_PRODUCTBUILD >= 2195) */
5068 IN HANDLE EventHandle
,
5069 OUT PLONG PreviousState OPTIONAL
5075 ZwQueryDefaultLocale (
5076 IN BOOLEAN ThreadOrSystem
,
5083 ZwQueryDirectoryFile (
5084 IN HANDLE FileHandle
,
5085 IN HANDLE Event OPTIONAL
,
5086 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL
,
5087 IN PVOID ApcContext OPTIONAL
,
5088 OUT PIO_STATUS_BLOCK IoStatusBlock
,
5089 OUT PVOID FileInformation
,
5091 IN FILE_INFORMATION_CLASS FileInformationClass
,
5092 IN BOOLEAN ReturnSingleEntry
,
5093 IN PUNICODE_STRING FileName OPTIONAL
,
5094 IN BOOLEAN RestartScan
5097 #if (VER_PRODUCTBUILD >= 2195)
5102 ZwQueryDirectoryObject (
5103 IN HANDLE DirectoryHandle
,
5106 IN BOOLEAN ReturnSingleEntry
,
5107 IN BOOLEAN RestartScan
,
5108 IN OUT PULONG Context
,
5109 OUT PULONG ReturnLength OPTIONAL
5116 IN HANDLE FileHandle
,
5117 OUT PIO_STATUS_BLOCK IoStatusBlock
,
5120 IN BOOLEAN ReturnSingleEntry
,
5121 IN PVOID EaList OPTIONAL
,
5122 IN ULONG EaListLength
,
5123 IN PULONG EaIndex OPTIONAL
,
5124 IN BOOLEAN RestartScan
5127 #endif /* (VER_PRODUCTBUILD >= 2195) */
5132 ZwQueryInformationProcess (
5133 IN HANDLE ProcessHandle
,
5134 IN PROCESSINFOCLASS ProcessInformationClass
,
5135 OUT PVOID ProcessInformation
,
5136 IN ULONG ProcessInformationLength
,
5137 OUT PULONG ReturnLength OPTIONAL
5143 ZwQueryInformationToken (
5144 IN HANDLE TokenHandle
,
5145 IN TOKEN_INFORMATION_CLASS TokenInformationClass
,
5146 OUT PVOID TokenInformation
,
5148 OUT PULONG ResultLength
5154 ZwQuerySecurityObject (
5155 IN HANDLE FileHandle
,
5156 IN SECURITY_INFORMATION SecurityInformation
,
5157 OUT PSECURITY_DESCRIPTOR SecurityDescriptor
,
5159 OUT PULONG ResultLength
5165 ZwQueryVolumeInformationFile (
5166 IN HANDLE FileHandle
,
5167 OUT PIO_STATUS_BLOCK IoStatusBlock
,
5168 OUT PVOID FsInformation
,
5170 IN FS_INFORMATION_CLASS FsInformationClass
5177 IN POBJECT_ATTRIBUTES NewFileObjectAttributes
,
5178 IN HANDLE KeyHandle
,
5179 IN POBJECT_ATTRIBUTES OldFileObjectAttributes
5186 IN HANDLE EventHandle
,
5187 OUT PLONG PreviousState OPTIONAL
5190 #if (VER_PRODUCTBUILD >= 2195)
5196 IN HANDLE KeyHandle
,
5197 IN HANDLE FileHandle
,
5201 #endif /* (VER_PRODUCTBUILD >= 2195) */
5207 IN HANDLE KeyHandle
,
5208 IN HANDLE FileHandle
5214 ZwSetDefaultLocale (
5215 IN BOOLEAN ThreadOrSystem
,
5219 #if (VER_PRODUCTBUILD >= 2195)
5224 ZwSetDefaultUILanguage (
5225 IN LANGID LanguageId
5232 IN HANDLE FileHandle
,
5233 OUT PIO_STATUS_BLOCK IoStatusBlock
,
5238 #endif /* (VER_PRODUCTBUILD >= 2195) */
5244 IN HANDLE EventHandle
,
5245 OUT PLONG PreviousState OPTIONAL
5251 ZwSetInformationProcess (
5252 IN HANDLE ProcessHandle
,
5253 IN PROCESSINFOCLASS ProcessInformationClass
,
5254 IN PVOID ProcessInformation
,
5255 IN ULONG ProcessInformationLength
5258 #if (VER_PRODUCTBUILD >= 2195)
5263 ZwSetSecurityObject (
5265 IN SECURITY_INFORMATION SecurityInformation
,
5266 IN PSECURITY_DESCRIPTOR SecurityDescriptor
5269 #endif /* (VER_PRODUCTBUILD >= 2195) */
5275 IN PLARGE_INTEGER NewTime
,
5276 OUT PLARGE_INTEGER OldTime OPTIONAL
5279 #if (VER_PRODUCTBUILD >= 2195)
5284 ZwSetVolumeInformationFile (
5285 IN HANDLE FileHandle
,
5286 OUT PIO_STATUS_BLOCK IoStatusBlock
,
5287 IN PVOID FsInformation
,
5289 IN FS_INFORMATION_CLASS FsInformationClass
5292 #endif /* (VER_PRODUCTBUILD >= 2195) */
5297 ZwTerminateProcess (
5298 IN HANDLE ProcessHandle OPTIONAL
,
5299 IN NTSTATUS ExitStatus
5306 /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
5307 IN PUNICODE_STRING RegistryPath
5314 IN POBJECT_ATTRIBUTES KeyObjectAttributes
5320 ZwWaitForSingleObject (
5322 IN BOOLEAN Alertable
,
5323 IN PLARGE_INTEGER Timeout OPTIONAL
5329 ZwWaitForMultipleObjects (
5330 IN ULONG HandleCount
,
5332 IN WAIT_TYPE WaitType
,
5333 IN BOOLEAN Alertable
,
5334 IN PLARGE_INTEGER Timeout OPTIONAL
5350 #endif /* _NTIFS_ */