Partially implemented (handlers only)
[reactos.git] / reactos / include / ddk / zw.h
1
2 /* $Id: zw.h,v 1.29 2000/04/25 23:22:49 ea Exp $
3 *
4 * COPYRIGHT: See COPYING in the top level directory
5 * PROJECT: ReactOS kernel
6 * PURPOSE: System call definitions
7 * FILE: include/ddk/zw.h
8 * REVISION HISTORY:
9 * ??/??/??: First few functions (David Welch)
10 * ??/??/??: Complete implementation by Ariadne
11 * 13/07/98: Reorganised things a bit (David Welch)
12 * 04/08/98: Added some documentation (Ariadne)
13 * 14/08/98: Added type TIME and change variable type from [1] to [0]
14 * 14/09/98: Added for each Nt call a corresponding Zw Call
15 */
16
17 #ifndef __DDK_ZW_H
18 #define __DDK_ZW_H
19
20 #include <security.h>
21
22 #define LCID ULONG
23 //#define SECURITY_INFORMATION ULONG
24 //typedef ULONG SECURITY_INFORMATION;
25
26
27 /*
28 * FUNCTION: Checks a clients access rights to a object
29 * ARGUMENTS:
30 * SecurityDescriptor = Security information against which the access is checked
31 * ClientToken = Represents a client
32 * DesiredAcces =
33 * GenericMapping =
34 * PrivilegeSet =
35 * ReturnLength = Bytes written
36 * GrantedAccess =
37 * AccessStatus = Indicates if the ClientToken allows the requested access
38 * REMARKS: The arguments map to the win32 AccessCheck
39 * RETURNS: Status
40 */
41
42 NTSTATUS
43 STDCALL
44 NtAccessCheck(
45 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
46 IN HANDLE ClientToken,
47 IN ACCESS_MASK DesiredAcces,
48 IN PGENERIC_MAPPING GenericMapping,
49 OUT PPRIVILEGE_SET PrivilegeSet,
50 OUT PULONG ReturnLength,
51 OUT PULONG GrantedAccess,
52 OUT PBOOLEAN AccessStatus
53 );
54
55 NTSTATUS
56 STDCALL
57 ZwAccessCheck(
58 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
59 IN HANDLE ClientToken,
60 IN ACCESS_MASK DesiredAcces,
61 IN PGENERIC_MAPPING GenericMapping,
62 OUT PPRIVILEGE_SET PrivilegeSet,
63 OUT PULONG ReturnLength,
64 OUT PULONG GrantedAccess,
65 OUT PBOOLEAN AccessStatus
66 );
67
68 /*
69 * FUNCTION: Checks a clients access rights to a object and issues a audit a alarm. ( it logs the access )
70 * ARGUMENTS:
71 * SubsystemName = Specifies the name of the subsystem, can be "WIN32" or "DEBUG"
72 * ObjectHandle =
73 * ObjectAttributes =
74 * DesiredAcces =
75 * GenericMapping =
76 * ObjectCreation =
77 * GrantedAccess =
78 * AccessStatus =
79 * GenerateOnClose =
80 * REMARKS: The arguments map to the win32 AccessCheck
81 * RETURNS: Status
82 */
83
84 NTSTATUS
85 STDCALL
86 NtAccessCheckAndAuditAlarm(
87 IN PUNICODE_STRING SubsystemName,
88 IN PHANDLE ObjectHandle,
89 IN POBJECT_ATTRIBUTES ObjectAttributes,
90 IN ACCESS_MASK DesiredAccess,
91 IN PGENERIC_MAPPING GenericMapping,
92 IN BOOLEAN ObjectCreation,
93 OUT PULONG GrantedAccess,
94 OUT PBOOLEAN AccessStatus,
95 OUT PBOOLEAN GenerateOnClose
96 );
97
98 NTSTATUS
99 STDCALL
100 ZwAccessCheckAndAuditAlarm(
101 IN PUNICODE_STRING SubsystemName,
102 IN PHANDLE ObjectHandle,
103 IN POBJECT_ATTRIBUTES ObjectAttributes,
104 IN ACCESS_MASK DesiredAccess,
105 IN PGENERIC_MAPPING GenericMapping,
106 IN BOOLEAN ObjectCreation,
107 OUT PULONG GrantedAccess,
108 OUT PBOOLEAN AccessStatus,
109 OUT PBOOLEAN GenerateOnClose
110 );
111
112 /*
113 * FUNCTION: Adds an atom to the global atom table
114 * ARGUMENTS:
115 * Atom (OUT) = Caller supplies storage for the resulting atom.
116 * AtomString = The string to add to the atom table.
117 * REMARKS: The arguments map to the win32 add GlobalAddAtom.
118 * RETURNS: Status
119 */
120 NTSTATUS
121 STDCALL
122 NtAddAtom(
123 OUT ATOM *Atom,
124 IN PUNICODE_STRING AtomString
125 );
126
127
128 NTSTATUS
129 STDCALL
130 ZwAddAtom(
131 OUT ATOM *Atom,
132 IN PUNICODE_STRING AtomString
133 );
134
135
136 /*
137 * FUNCTION: Adjusts the groups in an access token
138 * ARGUMENTS:
139 * TokenHandle = Specifies the access token
140 * ResetToDefault = If true the NewState parameter is ignored and the groups are set to
141 * their default state, if false the groups specified in
142 * NewState are set.
143 * NewState =
144 * BufferLength = Specifies the size of the buffer for the PreviousState.
145 * PreviousState =
146 * ReturnLength = Bytes written in PreviousState buffer.
147 * REMARKS: The arguments map to the win32 AdjustTokenGroups
148 * RETURNS: Status
149 */
150
151 NTSTATUS
152 STDCALL
153 NtAdjustGroupsToken(
154 IN HANDLE TokenHandle,
155 IN BOOLEAN ResetToDefault,
156 IN PTOKEN_GROUPS NewState,
157 IN ULONG BufferLength,
158 OUT PTOKEN_GROUPS PreviousState OPTIONAL,
159 OUT PULONG ReturnLength
160 );
161
162 NTSTATUS
163 STDCALL
164 ZwAdjustGroupsToken(
165 IN HANDLE TokenHandle,
166 IN BOOLEAN ResetToDefault,
167 IN PTOKEN_GROUPS NewState,
168 IN ULONG BufferLength,
169 OUT PTOKEN_GROUPS PreviousState,
170 OUT PULONG ReturnLength
171 );
172
173
174 /*
175 * FUNCTION:
176 *
177 * ARGUMENTS:
178 * TokenHandle = Handle to the access token
179 * DisableAllPrivileges = The resulting suspend count.
180 NewState =
181 BufferLength =
182 PreviousState =
183 ReturnLength =
184 * REMARK:
185 * The arguments map to the win32 AdjustTokenPrivileges
186 * RETURNS: Status
187 */
188
189 NTSTATUS
190 STDCALL
191 NtAdjustPrivilegesToken(
192 IN HANDLE TokenHandle,
193 IN BOOLEAN DisableAllPrivileges,
194 IN PTOKEN_PRIVILEGES NewState,
195 IN ULONG BufferLength,
196 OUT PTOKEN_PRIVILEGES PreviousState,
197 OUT PULONG ReturnLength
198 );
199
200 NTSTATUS
201 STDCALL
202 ZwAdjustPrivilegesToken(
203 IN HANDLE TokenHandle,
204 IN BOOLEAN DisableAllPrivileges,
205 IN PTOKEN_PRIVILEGES NewState,
206 IN ULONG BufferLength,
207 OUT PTOKEN_PRIVILEGES PreviousState,
208 OUT PULONG ReturnLength
209 );
210
211
212 /*
213 * FUNCTION: Decrements a thread's suspend count and places it in an alerted
214 * state.
215 * ARGUMENTS:
216 * ThreadHandle = Handle to the thread that should be resumed
217 * SuspendCount = The resulting suspend count.
218 * REMARK:
219 * A thread is resumed if its suspend count is 0
220 * RETURNS: Status
221 */
222 NTSTATUS
223 STDCALL
224 NtAlertResumeThread(
225 IN HANDLE ThreadHandle,
226 OUT PULONG SuspendCount
227 );
228
229 NTSTATUS
230 STDCALL
231 ZwAlertResumeThread(
232 IN HANDLE ThreadHandle,
233 OUT PULONG SuspendCount
234 );
235
236 /*
237 * FUNCTION: Puts the thread in a alerted state
238 * ARGUMENTS:
239 * ThreadHandle = Handle to the thread that should be alerted
240 * RETURNS: Status
241 */
242 NTSTATUS
243 STDCALL
244 NtAlertThread(
245 IN HANDLE ThreadHandle
246 );
247
248 NTSTATUS
249 STDCALL
250 ZwAlertThread(
251 IN HANDLE ThreadHandle
252 );
253
254
255 /*
256 * FUNCTION: Allocates a locally unique id
257 * ARGUMENTS:
258 * LocallyUniqueId = Locally unique number
259 * RETURNS: Status
260 */
261 NTSTATUS
262 STDCALL
263 NtAllocateLocallyUniqueId(
264 OUT LUID *LocallyUniqueId
265 );
266
267 NTSTATUS
268 STDCALL
269 ZwAllocateLocallyUniqueId(
270 OUT LUID *LocallyUniqueId
271 );
272
273 NTSTATUS
274 STDCALL
275 NtAllocateUuids(
276 PLARGE_INTEGER Time,
277 PULONG Version, // ???
278 PULONG ClockCycle
279 );
280
281 NTSTATUS
282 STDCALL
283 ZwAllocateUuids(
284 PLARGE_INTEGER Time,
285 PULONG Version, // ???
286 PULONG ClockCycle
287 );
288
289
290 /*
291 * FUNCTION: Allocates a block of virtual memory in the process address space
292 * ARGUMENTS:
293 * ProcessHandle = The handle of the process which owns the virtual memory
294 * BaseAddress = A pointer to the virtual memory allocated. If you supply a non zero
295 * value the system will try to allocate the memory at the address supplied. It rounds
296 * it down to a multiple if the page size.
297 * ZeroBits = (OPTIONAL) You can specify the number of high order bits that must be zero, ensuring that
298 * the memory will be allocated at a address below a certain value.
299 * RegionSize = The number of bytes to allocate
300 * AllocationType = Indicates the type of virtual memory you like to allocated,
301 * can be one of the values : MEM_COMMIT, MEM_RESERVE, MEM_RESET, MEM_TOP_DOWN
302 * Protect = Indicates the protection type of the pages allocated, can be a combination of
303 * PAGE_READONLY, PAGE_READWRITE, PAGE_EXECUTE_READ,
304 * PAGE_EXECUTE_READWRITE, PAGE_GUARD, PAGE_NOACCESS, PAGE_NOACCESS
305 * REMARKS:
306 * This function maps to the win32 VirtualAllocEx. Virtual memory is process based so the
307 * protocol starts with a ProcessHandle. I splitted the functionality of obtaining the actual address and specifying
308 * the start address in two parameters ( BaseAddress and StartAddress ) The NumberOfBytesAllocated specify the range
309 * and the AllocationType and ProctectionType map to the other two parameters.
310 * RETURNS: Status
311 */
312 NTSTATUS
313 STDCALL
314 NtAllocateVirtualMemory (
315 IN HANDLE ProcessHandle,
316 IN OUT PVOID *BaseAddress,
317 IN ULONG ZeroBits,
318 IN OUT PULONG RegionSize,
319 IN ULONG AllocationType,
320 IN ULONG Protect
321 );
322
323 NTSTATUS
324 STDCALL
325 ZwAllocateVirtualMemory (
326 IN HANDLE ProcessHandle,
327 IN OUT PVOID *BaseAddress,
328 IN ULONG ZeroBits,
329 IN OUT PULONG RegionSize,
330 IN ULONG AllocationType,
331 IN ULONG Protect);
332
333 /*
334 * FUNCTION: Returns from a callback into user mode
335 * ARGUMENTS:
336 * RETURN Status
337 */
338 //FIXME: this function might need 3 parameters
339 NTSTATUS
340 STDCALL
341 NtCallbackReturn(
342 VOID
343 );
344
345 NTSTATUS
346 STDCALL
347 ZwCallbackReturn(
348 VOID
349 );
350
351 /*
352 * FUNCTION: Cancels a IO request
353 * ARGUMENTS:
354 * FileHandle = Handle to the file
355 * IoStatusBlock =
356 *
357 * REMARKS:
358 * This function maps to the win32 CancelIo.
359 * RETURNS: Status
360 */
361 NTSTATUS
362 STDCALL
363 NtCancelIoFile(
364 IN HANDLE FileHandle,
365 OUT PIO_STATUS_BLOCK IoStatusBlock
366 );
367
368 NTSTATUS
369 STDCALL
370 ZwCancelIoFile(
371 IN HANDLE FileHandle,
372 OUT PIO_STATUS_BLOCK IoStatusBlock
373 );
374 /*
375 * FUNCTION: Cancels a timer
376 * ARGUMENTS:
377 * TimerHandle = Handle to the timer
378 * CurrentState = Specifies the state of the timer when cancelled.
379 * REMARKS:
380 * The arguments to this function map to the function CancelWaitableTimer.
381 * RETURNS: Status
382 */
383 NTSTATUS
384 STDCALL
385 NtCancelTimer(
386 IN HANDLE TimerHandle,
387 OUT PBOOLEAN CurrentState OPTIONAL
388 );
389
390 NTSTATUS
391 STDCALL
392 ZwCancelTimer(
393 IN HANDLE TimerHandle,
394 OUT ULONG ElapsedTime
395 );
396 /*
397 * FUNCTION: Sets the status of the event back to non-signaled
398 * ARGUMENTS:
399 * EventHandle = Handle to the event
400 * REMARKS:
401 * This function maps to win32 function ResetEvent.
402 * RETURcNS: Status
403 */
404
405 NTSTATUS
406 STDCALL
407 NtClearEvent(
408 IN HANDLE EventHandle
409 );
410
411 NTSTATUS
412 STDCALL
413 ZwClearEvent(
414 IN HANDLE EventHandle
415 );
416
417 /*
418 * FUNCTION: Closes an object handle
419 * ARGUMENTS:
420 * Handle = Handle to the object
421 * REMARKS:
422 * This function maps to the win32 function CloseHandle.
423 * RETURNS: Status
424 */
425
426 NTSTATUS
427 STDCALL
428 NtClose(
429 IN HANDLE Handle
430 );
431
432 NTSTATUS
433 STDCALL
434 ZwClose(
435 IN HANDLE Handle
436 );
437
438 /*
439 * FUNCTION: Generates an audit message when a handle to an object is dereferenced
440 * ARGUMENTS:
441 * SubsystemName =
442 HandleId = Handle to the object
443 GenerateOnClose =
444 * REMARKS:
445 * This function maps to the win32 function ObjectCloseAuditAlarm.
446 * RETURNS: Status
447 */
448
449
450
451 NTSTATUS
452 STDCALL
453 NtCloseObjectAuditAlarm(
454 IN PUNICODE_STRING SubsystemName,
455 IN PVOID HandleId,
456 IN BOOLEAN GenerateOnClose
457 );
458
459 NTSTATUS
460 STDCALL
461 ZwCloseObjectAuditAlarm(
462 IN PUNICODE_STRING SubsystemName,
463 IN PVOID HandleId,
464 IN BOOLEAN GenerateOnClose
465 );
466
467
468
469 /*
470 * FUNCTION: Continues a thread with the specified context
471 * ARGUMENTS:
472 * Context = Specifies the processor context
473 * IrqLevel = Specifies the Interupt Request Level to continue with. Can
474 * be PASSIVE_LEVEL or APC_LEVEL
475 * REMARKS
476 * NtContinue can be used to continue after an exception or apc.
477 * RETURNS: Status
478 */
479 //FIXME This function might need another parameter
480
481 NTSTATUS
482 STDCALL
483 NtContinue(
484 IN PCONTEXT Context,
485 IN CINT IrqLevel
486 );
487
488 NTSTATUS STDCALL ZwContinue(IN PCONTEXT Context, IN CINT IrqLevel);
489
490
491 /*
492 * FUNCTION: Creates a directory object
493 * ARGUMENTS:
494 * DirectoryHandle (OUT) = Caller supplied storage for the resulting handle
495 * DesiredAccess = Specifies access to the directory
496 * ObjectAttribute = Initialized attributes for the object
497 * REMARKS: This function maps to the win32 CreateDirectory. A directory is like a file so it needs a
498 * handle, a access mask and a OBJECT_ATTRIBUTES structure to map the path name and the SECURITY_ATTRIBUTES.
499 * RETURNS: Status
500 */
501
502 NTSTATUS
503 STDCALL
504 NtCreateDirectoryObject(
505 OUT PHANDLE DirectoryHandle,
506 IN ACCESS_MASK DesiredAccess,
507 IN POBJECT_ATTRIBUTES ObjectAttributes
508 );
509
510 NTSTATUS
511 STDCALL
512 ZwCreateDirectoryObject(
513 OUT PHANDLE DirectoryHandle,
514 IN ACCESS_MASK DesiredAccess,
515 IN POBJECT_ATTRIBUTES ObjectAttributes
516 );
517
518 /*
519 * FUNCTION: Creates an event object
520 * ARGUMENTS:
521 * EventHandle (OUT) = Caller supplied storage for the resulting handle
522 * DesiredAccess = Specifies access to the event
523 * ObjectAttribute = Initialized attributes for the object
524 * ManualReset = manual-reset or auto-reset if true you have to reset the state of the event manually
525 * using NtResetEvent/NtClearEvent. if false the system will reset the event to a non-signalled state
526 * automatically after the system has rescheduled a thread waiting on the event.
527 * InitialState = specifies the initial state of the event to be signaled ( TRUE ) or non-signalled (FALSE).
528 * REMARKS: This function maps to the win32 CreateEvent. Demanding a out variable of type HANDLE,
529 * a access mask and a OBJECT_ATTRIBUTES structure mapping to the SECURITY_ATTRIBUTES. ManualReset and InitialState are
530 * both parameters aswell ( possibly the order is reversed ).
531 * RETURNS: Status
532 */
533
534 NTSTATUS
535 STDCALL
536 NtCreateEvent(
537 OUT PHANDLE EventHandle,
538 IN ACCESS_MASK DesiredAccess,
539 IN POBJECT_ATTRIBUTES ObjectAttributes,
540 IN BOOLEAN ManualReset,
541 IN BOOLEAN InitialState
542 );
543
544 NTSTATUS
545 STDCALL
546 ZwCreateEvent(
547 OUT PHANDLE EventHandle,
548 IN ACCESS_MASK DesiredAccess,
549 IN POBJECT_ATTRIBUTES ObjectAttributes,
550 IN BOOLEAN ManualReset,
551 IN BOOLEAN InitialState
552 );
553
554 /*
555 * FUNCTION: Creates an eventpair object
556 * ARGUMENTS:
557 * EventPairHandle (OUT) = Caller supplied storage for the resulting handle
558 * DesiredAccess = Specifies access to the event
559 * ObjectAttribute = Initialized attributes for the object
560 */
561
562 NTSTATUS
563 STDCALL
564 NtCreateEventPair(
565 OUT PHANDLE EventPairHandle,
566 IN ACCESS_MASK DesiredAccess,
567 IN POBJECT_ATTRIBUTES ObjectAttributes
568 );
569
570 NTSTATUS
571 STDCALL
572 ZwCreateEventPair(
573 OUT PHANDLE EventPairHandle,
574 IN ACCESS_MASK DesiredAccess,
575 IN POBJECT_ATTRIBUTES ObjectAttributes
576 );
577
578
579 /*
580 * FUNCTION: Creates or opens a file, directory or device object.
581 * ARGUMENTS:
582 * FileHandle (OUT) = Caller supplied storage for the resulting handle
583 * DesiredAccess = Specifies the allowed or desired access to the file can
584 * be a combination of DELETE | FILE_READ_DATA ..
585 * ObjectAttribute = Initialized attributes for the object, contains the rootdirectory and the filename
586 * IoStatusBlock (OUT) = Caller supplied storage for the resulting status information, indicating if the
587 * the file is created and opened or allready existed and is just opened.
588 * FileAttributes = file attributes can be a combination of FILE_ATTRIBUTE_READONLY | FILE_ATTRIBUTE_HIDDEN ...
589 * ShareAccess = can be a combination of the following: FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE
590 * CreateDisposition = specifies what the behavior of the system if the file allready exists.
591 * CreateOptions = specifies the behavior of the system on file creation.
592 * EaBuffer (OPTIONAL) = Extended Attributes buffer, applies only to files and directories.
593 * EaLength = Extended Attributes buffer size, applies only to files and directories.
594 * REMARKS: This function maps to the win32 CreateFile.
595 * RETURNS: Status
596 */
597
598 NTSTATUS
599 STDCALL
600 NtCreateFile(
601 OUT PHANDLE FileHandle,
602 IN ACCESS_MASK DesiredAccess,
603 IN POBJECT_ATTRIBUTES ObjectAttributes,
604 OUT PIO_STATUS_BLOCK IoStatusBlock,
605 IN PLARGE_INTEGER AllocationSize OPTIONAL,
606 IN ULONG FileAttributes,
607 IN ULONG ShareAccess,
608 IN ULONG CreateDisposition,
609 IN ULONG CreateOptions,
610 IN PVOID EaBuffer OPTIONAL,
611 IN ULONG EaLength
612 );
613
614 NTSTATUS
615 STDCALL
616 ZwCreateFile(
617 OUT PHANDLE FileHandle,
618 IN ACCESS_MASK DesiredAccess,
619 IN POBJECT_ATTRIBUTES ObjectAttributes,
620 OUT PIO_STATUS_BLOCK IoStatusBlock,
621 IN PLARGE_INTEGER AllocationSize OPTIONAL,
622 IN ULONG FileAttributes,
623 IN ULONG ShareAccess,
624 IN ULONG CreateDisposition,
625 IN ULONG CreateOptions,
626 IN PVOID EaBuffer OPTIONAL,
627 IN ULONG EaLength
628 );
629
630 /*
631 * FUNCTION: Creates or opens a file, directory or device object.
632 * ARGUMENTS:
633 * CompletionPort (OUT) = Caller supplied storage for the resulting handle
634 * DesiredAccess = Specifies the allowed or desired access to the port
635 * IoStatusBlock =
636 * NumberOfConcurrentThreads =
637 * REMARKS: This function maps to the win32 CreateIoCompletionPort
638 * RETURNS:
639 * Status
640 */
641
642 NTSTATUS
643 STDCALL
644 NtCreateIoCompletion(
645 OUT PHANDLE CompletionPort,
646 IN ACCESS_MASK DesiredAccess,
647 OUT PIO_STATUS_BLOCK IoStatusBlock,
648 IN ULONG NumberOfConcurrentThreads
649 );
650
651 NTSTATUS
652 STDCALL
653 ZwCreateIoCompletion(
654 OUT PHANDLE CompletionPort,
655 IN ACCESS_MASK DesiredAccess,
656 OUT PIO_STATUS_BLOCK IoStatusBlock,
657 IN ULONG NumberOfConcurrentThreads
658 );
659
660
661 /*
662 * FUNCTION: Creates a mail slot file
663 * ARGUMENTS:
664 * MailSlotFileHandle (OUT) = Caller supplied storage for the resulting handle
665 * DesiredAccess = Specifies the allowed or desired access to the file
666 * ObjectAttributes = Contains the name of the mailslotfile.
667 * IoStatusBlock =
668 * FileAttributes =
669 * ShareAccess =
670 * MaxMessageSize =
671 * TimeOut =
672 *
673 * REMARKS: This funciton maps to the win32 function CreateMailSlot
674 * RETURNS:
675 * Status
676 */
677
678 NTSTATUS
679 STDCALL
680 NtCreateMailslotFile(
681 OUT PHANDLE MailSlotFileHandle,
682 IN ACCESS_MASK DesiredAccess,
683 IN POBJECT_ATTRIBUTES ObjectAttributes,
684 OUT PIO_STATUS_BLOCK IoStatusBlock,
685 IN ULONG FileAttributes,
686 IN ULONG ShareAccess,
687 IN ULONG MaxMessageSize,
688 IN PLARGE_INTEGER TimeOut
689 );
690
691 NTSTATUS
692 STDCALL
693 ZwCreateMailslotFile(
694 OUT PHANDLE MailSlotFileHandle,
695 IN ACCESS_MASK DesiredAccess,
696 IN POBJECT_ATTRIBUTES ObjectAttributes,
697 OUT PIO_STATUS_BLOCK IoStatusBlock,
698 IN ULONG FileAttributes,
699 IN ULONG ShareAccess,
700 IN ULONG MaxMessageSize,
701 IN PLARGE_INTEGER TimeOut
702 );
703
704 /*
705 * FUNCTION: Creates or opens a mutex
706 * ARGUMENTS:
707 * MutantHandle (OUT) = Caller supplied storage for the resulting handle
708 * DesiredAccess = Specifies the allowed or desired access to the port
709 * ObjectAttributes = Contains the name of the mutex.
710 * InitialOwner = If true the calling thread acquires ownership
711 * of the mutex.
712 * REMARKS: This funciton maps to the win32 function CreateMutex
713 * RETURNS:
714 * Status
715 */
716 NTSTATUS
717 STDCALL
718 NtCreateMutant(
719 OUT PHANDLE MutantHandle,
720 IN ACCESS_MASK DesiredAccess,
721 IN POBJECT_ATTRIBUTES ObjectAttributes,
722 IN BOOLEAN InitialOwner
723 );
724
725 NTSTATUS
726 STDCALL
727 ZwCreateMutant(
728 OUT PHANDLE MutantHandle,
729 IN ACCESS_MASK DesiredAccess,
730 IN POBJECT_ATTRIBUTES ObjectAttributes,
731 IN BOOLEAN InitialOwner
732 );
733
734 /*
735 * FUNCTION: Creates a named pipe
736 * ARGUMENTS:
737 * NamedPipeFileHandle (OUT) = Caller supplied storage for the resulting handle
738 * DesiredAccess = Specifies the allowed or desired access to the mutex
739 * ObjectAttributes = Contains the name of the mutex.
740 * IoStatusBlock =
741 * FileAttributes =
742 * ShareAccess =
743 * OpenMode =
744 * PipeType =
745 * PipeRead =
746 * PipeWait =
747 * MaxInstances =
748 * InBufferSize =
749 * OutBufferSize =
750 * TimeOut =
751 * REMARKS: This funciton maps to the win32 function CreateNamedPipe
752 * RETURNS:
753 * Status
754 */
755
756 NTSTATUS
757 STDCALL
758 NtCreateNamedPipeFile(
759 OUT PHANDLE NamedPipeFileHandle,
760 IN ACCESS_MASK DesiredAccess,
761 IN POBJECT_ATTRIBUTES ObjectAttributes,
762 OUT PIO_STATUS_BLOCK IoStatusBlock,
763 IN ULONG FileAttributes,
764 IN ULONG ShareAccess,
765 IN ULONG OpenMode,
766 IN ULONG PipeType,
767 IN ULONG PipeRead,
768 IN ULONG PipeWait,
769 IN ULONG MaxInstances,
770 IN ULONG InBufferSize,
771 IN ULONG OutBufferSize,
772 IN PLARGE_INTEGER TimeOut
773 );
774
775 NTSTATUS
776 STDCALL
777 ZwCreateNamedPipeFile(
778 OUT PHANDLE NamedPipeFileHandle,
779 IN ACCESS_MASK DesiredAccess,
780 IN POBJECT_ATTRIBUTES ObjectAttributes,
781 OUT PIO_STATUS_BLOCK IoStatusBlock,
782 IN ULONG FileAttributes,
783 IN ULONG ShareAccess,
784 IN ULONG OpenMode,
785 IN ULONG PipeType,
786 IN ULONG PipeRead,
787 IN ULONG PipeWait,
788 IN ULONG MaxInstances,
789 IN ULONG InBufferSize,
790 IN ULONG OutBufferSize,
791 IN PLARGE_INTEGER TimeOut
792 );
793
794
795 /*
796 * FUNCTION: Creates a paging file.
797 * ARGUMENTS:
798 * PageFileName = Name of the pagefile
799 * MinimumSize = Specifies the minimum size
800 * MaximumSize = Specifies the maximum size
801 * ActualSize(OUT) = Specifies the actual size
802 * RETURNS: Status
803 */
804
805 NTSTATUS
806 STDCALL
807 NtCreatePagingFile(
808 IN PUNICODE_STRING PageFileName,
809 IN ULONG MiniumSize,
810 IN ULONG MaxiumSize,
811 OUT PULONG ActualSize
812 );
813
814 NTSTATUS
815 STDCALL
816 ZwCreatePagingFile(
817 IN PUNICODE_STRING PageFileName,
818 IN ULONG MiniumSize,
819 IN ULONG MaxiumSize,
820 OUT PULONG ActualSize
821 );
822
823 /*
824 * FUNCTION: Creates a process.
825 * ARGUMENTS:
826 * ProcessHandle (OUT) = Caller supplied storage for the resulting handle
827 * DesiredAccess = Specifies the allowed or desired access to the process can
828 * be a combinate of STANDARD_RIGHTS_REQUIRED| ..
829 * ObjectAttribute = Initialized attributes for the object, contains the rootdirectory and the filename
830 * ParentProcess = Handle to the parent process.
831 * InheritObjectTable = Specifies to inherit the objects of the parent process if true.
832 * SectionHandle = Handle to a section object to back the image file
833 * DebugPort = Handle to a DebugPort if NULL the system default debug port will be used.
834 * ExceptionPort = Handle to a exception port.
835 * REMARKS:
836 * This function maps to the win32 CreateProcess.
837 * RETURNS: Status
838 */
839 NTSTATUS
840 STDCALL
841 NtCreateProcess(
842 OUT PHANDLE ProcessHandle,
843 IN ACCESS_MASK DesiredAccess,
844 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
845 IN HANDLE ParentProcess,
846 IN BOOLEAN InheritObjectTable,
847 IN HANDLE SectionHandle OPTIONAL,
848 IN HANDLE DebugPort OPTIONAL,
849 IN HANDLE ExceptionPort OPTIONAL
850 );
851
852 NTSTATUS
853 STDCALL
854 ZwCreateProcess(
855 OUT PHANDLE ProcessHandle,
856 IN ACCESS_MASK DesiredAccess,
857 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
858 IN HANDLE ParentProcess,
859 IN BOOLEAN InheritObjectTable,
860 IN HANDLE SectionHandle OPTIONAL,
861 IN HANDLE DebugPort OPTIONAL,
862 IN HANDLE ExceptionPort OPTIONAL
863 );
864
865 /*
866 * FUNCTION: Creates a profile
867 * ARGUMENTS:
868 * ProfileHandle (OUT) = Caller supplied storage for the resulting handle
869 * ObjectAttribute = Initialized attributes for the object
870 * ImageBase = Start address of executable image
871 * ImageSize = Size of the image
872 * Granularity = Bucket size
873 * Buffer = Caller supplies buffer for profiling info
874 * ProfilingSize = Buffer size
875 * ClockSource = Specify 0 / FALSE ??
876 * ProcessorMask = A value of -1 indicates disables per processor profiling,
877 otherwise bit set for the processor to profile.
878 * REMARKS:
879 * This function maps to the win32 CreateProcess.
880 * RETURNS: Status
881 */
882
883 NTSTATUS
884 STDCALL
885 NtCreateProfile(
886 OUT PHANDLE ProfileHandle,
887 IN POBJECT_ATTRIBUTES ObjectAttributes,
888 IN ULONG ImageBase,
889 IN ULONG ImageSize,
890 IN ULONG Granularity,
891 OUT PVOID Buffer,
892 IN ULONG ProfilingSize,
893 IN ULONG ClockSource,
894 IN ULONG ProcessorMask
895 );
896
897 NTSTATUS
898 STDCALL
899 ZwCreateProfile(
900 OUT PHANDLE ProfileHandle,
901 IN POBJECT_ATTRIBUTES ObjectAttributes,
902 IN ULONG ImageBase,
903 IN ULONG ImageSize,
904 IN ULONG Granularity,
905 OUT PVOID Buffer,
906 IN ULONG ProfilingSize,
907 IN ULONG ClockSource,
908 IN ULONG ProcessorMask
909 );
910
911 /*
912 * FUNCTION: Creates a section object.
913 * ARGUMENTS:
914 * SectionHandle (OUT) = Caller supplied storage for the resulting handle
915 * DesiredAccess = Specifies the desired access to the section can be a combination of STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_WRITE |
916 * SECTION_MAP_READ | SECTION_MAP_EXECUTE.
917 * ObjectAttribute = Initialized attributes for the object can be used to create a named section
918 * MaxiumSize = Maximizes the size of the memory section. Must be non-NULL for a page-file backed section.
919 * If value specified for a mapped file and the file is not large enough, file will be extended.
920 * SectionPageProtection = Can be a combination of PAGE_READONLY | PAGE_READWRITE | PAGE_WRITEONLY | PAGE_WRITECOPY.
921 * AllocationAttributes = can be a combination of SEC_IMAGE | SEC_RESERVE
922 * FileHanlde = Handle to a file to create a section mapped to a file instead of a memory backed section.
923 * RETURNS: Status
924 */
925
926 NTSTATUS
927 STDCALL
928 NtCreateSection(
929 OUT PHANDLE SectionHandle,
930 IN ACCESS_MASK DesiredAccess,
931 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
932 IN PLARGE_INTEGER MaximumSize OPTIONAL,
933 IN ULONG SectionPageProtection OPTIONAL,
934 IN ULONG AllocationAttributes,
935 IN HANDLE FileHandle OPTIONAL
936 );
937
938 NTSTATUS
939 STDCALL
940 ZwCreateSection(
941 OUT PHANDLE SectionHandle,
942 IN ACCESS_MASK DesiredAccess,
943 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
944 IN PLARGE_INTEGER MaximumSize OPTIONAL,
945 IN ULONG SectionPageProtection OPTIONAL,
946 IN ULONG AllocationAttributes,
947 IN HANDLE FileHandle OPTIONAL
948 );
949
950 /*
951 * FUNCTION: Creates a semaphore object for interprocess synchronization.
952 * ARGUMENTS:
953 * SemaphoreHandle (OUT) = Caller supplied storage for the resulting handle
954 * DesiredAccess = Specifies the allowed or desired access to the semaphore.
955 * ObjectAttribute = Initialized attributes for the object.
956 * InitialCount = Not necessary zero, might be smaller than zero.
957 * MaximumCount = Maxiumum count the semaphore can reach.
958 * RETURNS: Status
959 * REMARKS:
960 * The semaphore is set to signaled when its count is greater than zero, and non-signaled when its count is zero.
961 */
962
963 //FIXME: should a semaphore's initial count allowed to be smaller than zero ??
964 NTSTATUS
965 STDCALL
966 NtCreateSemaphore(
967 OUT PHANDLE SemaphoreHandle,
968 IN ACCESS_MASK DesiredAccess,
969 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
970 IN ULONG InitialCount,
971 IN ULONG MaximumCount
972 );
973
974 NTSTATUS
975 STDCALL
976 ZwCreateSemaphore(
977 OUT PHANDLE SemaphoreHandle,
978 IN ACCESS_MASK DesiredAccess,
979 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
980 IN ULONG InitialCount,
981 IN ULONG MaximumCount
982 );
983
984 /*
985 * FUNCTION: Creates a symbolic link object
986 * ARGUMENTS:
987 * SymbolicLinkHandle (OUT) = Caller supplied storage for the resulting handle
988 * DesiredAccess = Specifies the allowed or desired access to the thread.
989 * ObjectAttributes = Initialized attributes for the object.
990 * Name = Target name of the symbolic link
991 * RETURNS: Status
992 */
993 NTSTATUS
994 STDCALL
995 NtCreateSymbolicLinkObject(
996 OUT PHANDLE SymbolicLinkHandle,
997 IN ACCESS_MASK DesiredAccess,
998 IN POBJECT_ATTRIBUTES ObjectAttributes,
999 IN PUNICODE_STRING Name
1000 );
1001
1002 NTSTATUS
1003 STDCALL
1004 ZwCreateSymbolicLinkObject(
1005 OUT PHANDLE SymbolicLinkHandle,
1006 IN ACCESS_MASK DesiredAccess,
1007 IN POBJECT_ATTRIBUTES ObjectAttributes,
1008 IN PUNICODE_STRING Name
1009 );
1010
1011 /*
1012 * FUNCTION: Creates a user mode thread
1013 * ARGUMENTS:
1014 * ThreadHandle (OUT) = Caller supplied storage for the resulting handle
1015 * DesiredAccess = Specifies the allowed or desired access to the thread.
1016 * ObjectAttributes = Initialized attributes for the object.
1017 * ProcessHandle = Handle to the threads parent process.
1018 * ClientId (OUT) = Caller supplies storage for returned process id and thread id.
1019 * ThreadContext = Initial processor context for the thread.
1020 * InitialTeb = Initial user mode stack context for the thread.
1021 * CreateSuspended = Specifies if the thread is ready for scheduling
1022 * REMARKS:
1023 * This function maps to the win32 function CreateThread.
1024 * RETURNS: Status
1025 */
1026 NTSTATUS
1027 STDCALL
1028 NtCreateThread(
1029 OUT PHANDLE ThreadHandle,
1030 IN ACCESS_MASK DesiredAccess,
1031 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
1032 IN HANDLE ProcessHandle,
1033 OUT PCLIENT_ID ClientId,
1034 IN PCONTEXT ThreadContext,
1035 IN PINITIAL_TEB InitialTeb,
1036 IN BOOLEAN CreateSuspended
1037 );
1038
1039 NTSTATUS
1040 STDCALL
1041 ZwCreateThread(
1042 OUT PHANDLE ThreadHandle,
1043 IN ACCESS_MASK DesiredAccess,
1044 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
1045 IN HANDLE ProcessHandle,
1046 OUT PCLIENT_ID ClientId,
1047 IN PCONTEXT ThreadContext,
1048 IN PINITIAL_TEB InitialTeb,
1049 IN BOOLEAN CreateSuspended
1050 );
1051 /*
1052 * FUNCTION: Creates a waitable timer.
1053 * ARGUMENTS:
1054 * TimerHandle (OUT) = Caller supplied storage for the resulting handle
1055 * DesiredAccess = Specifies the allowed or desired access to the timer.
1056 * ObjectAttributes = Initialized attributes for the object.
1057 * TimerType = Specifies if the timer should be reset manually.
1058 * REMARKS:
1059 * This function maps to the win32 CreateWaitableTimer. lpTimerAttributes and lpTimerName map to
1060 * corresponding fields in OBJECT_ATTRIBUTES structure.
1061 * RETURNS: Status
1062 */
1063
1064 NTSTATUS
1065 STDCALL
1066 NtCreateTimer(
1067 OUT PHANDLE TimerHandle,
1068 IN ACCESS_MASK DesiredAccess,
1069 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
1070 IN CINT TimerType
1071 );
1072
1073 NTSTATUS
1074 STDCALL
1075 ZwCreateTimer(
1076 OUT PHANDLE TimerHandle,
1077 IN ACCESS_MASK DesiredAccess,
1078 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
1079 IN CINT TimerType
1080 );
1081
1082 /*
1083 * FUNCTION: Creates a token.
1084 * ARGUMENTS:
1085 * TokenHandle (OUT) = Caller supplied storage for the resulting handle
1086 * DesiredAccess = Specifies the allowed or desired access to the process can
1087 * be a combinate of STANDARD_RIGHTS_REQUIRED| ..
1088 * ObjectAttribute = Initialized attributes for the object, contains the rootdirectory and the filename
1089 * TokenType =
1090 * AuthenticationId =
1091 * ExpirationTime =
1092 * TokenUser =
1093 * TokenGroups =
1094 * TokenPrivileges =
1095 * TokenOwner =
1096 * TokenPrimaryGroup =
1097 * TokenDefaultDacl =
1098 * TokenSource =
1099 * REMARKS:
1100 * This function does not map to a win32 function
1101 * RETURNS: Status
1102 */
1103
1104 NTSTATUS
1105 STDCALL
1106 NtCreateToken(
1107 OUT PHANDLE TokenHandle,
1108 IN ACCESS_MASK DesiredAccess,
1109 IN POBJECT_ATTRIBUTES ObjectAttributes,
1110 IN TOKEN_TYPE TokenType,
1111 IN PLUID AuthenticationId,
1112 IN PLARGE_INTEGER ExpirationTime,
1113 IN PTOKEN_USER TokenUser,
1114 IN PTOKEN_GROUPS TokenGroups,
1115 IN PTOKEN_PRIVILEGES TokenPrivileges,
1116 IN PTOKEN_OWNER TokenOwner,
1117 IN PTOKEN_PRIMARY_GROUP TokenPrimaryGroup,
1118 IN PTOKEN_DEFAULT_DACL TokenDefaultDacl,
1119 IN PTOKEN_SOURCE TokenSource
1120 );
1121
1122 NTSTATUS
1123 STDCALL
1124 ZwCreateToken(
1125 OUT PHANDLE TokenHandle,
1126 IN ACCESS_MASK DesiredAccess,
1127 IN POBJECT_ATTRIBUTES ObjectAttributes,
1128 IN TOKEN_TYPE TokenType,
1129 IN PLUID AuthenticationId,
1130 IN PLARGE_INTEGER ExpirationTime,
1131 IN PTOKEN_USER TokenUser,
1132 IN PTOKEN_GROUPS TokenGroups,
1133 IN PTOKEN_PRIVILEGES TokenPrivileges,
1134 IN PTOKEN_OWNER TokenOwner,
1135 IN PTOKEN_PRIMARY_GROUP TokenPrimaryGroup,
1136 IN PTOKEN_DEFAULT_DACL TokenDefaultDacl,
1137 IN PTOKEN_SOURCE TokenSource
1138 );
1139
1140 /*
1141 * FUNCTION: Returns the callers thread TEB.
1142 * RETURNS: The resulting teb.
1143 */
1144 #if 0
1145 NT_TEB *
1146 STDCALL
1147 NtCurrentTeb(VOID
1148 );
1149 #endif
1150
1151 /*
1152 * FUNCTION: Delays the execution of the calling thread.
1153 * ARGUMENTS:
1154 * Alertable = If TRUE the thread is alertable during is wait period
1155 * Interval = Specifies the interval to wait.
1156 * RETURNS: Status
1157 */
1158 NTSTATUS STDCALL NtDelayExecution(IN ULONG Alertable, IN TIME* Interval);
1159
1160 NTSTATUS
1161 STDCALL
1162 ZwDelayExecution(
1163 IN BOOLEAN Alertable,
1164 IN TIME *Interval
1165 );
1166
1167
1168 /*
1169 * FUNCTION: Deletes an atom from the global atom table
1170 * ARGUMENTS:
1171 * Atom = Identifies the atom to delete
1172 * REMARKS:
1173 * The function maps to the win32 GlobalDeleteAtom
1174 * RETURNS: Status
1175 */
1176 NTSTATUS
1177 STDCALL
1178 NtDeleteAtom(
1179 IN ATOM Atom
1180 );
1181
1182 NTSTATUS
1183 STDCALL
1184 ZwDeleteAtom(
1185 IN ATOM Atom
1186 );
1187
1188 /*
1189 * FUNCTION: Deletes a file or a directory
1190 * ARGUMENTS:
1191 * ObjectAttributes = Name of the file which should be deleted
1192 * REMARKS:
1193 * This system call is functionally equivalent to NtSetInformationFile
1194 * setting the disposition information.
1195 * The function maps to the win32 DeleteFile.
1196 * RETURNS: Status
1197 */
1198 NTSTATUS
1199 STDCALL
1200 NtDeleteFile(
1201 IN POBJECT_ATTRIBUTES ObjectAttributes
1202 );
1203
1204 NTSTATUS
1205 STDCALL
1206 ZwDeleteFile(
1207 IN POBJECT_ATTRIBUTES ObjectAttributes
1208 );
1209
1210 /*
1211 * FUNCTION: Deletes a registry key
1212 * ARGUMENTS:
1213 * KeyHandle = Handle of the key
1214 * RETURNS: Status
1215 */
1216 NTSTATUS
1217 STDCALL
1218 NtDeleteKey(
1219 IN HANDLE KeyHandle
1220 );
1221 NTSTATUS
1222 STDCALL
1223 ZwDeleteKey(
1224 IN HANDLE KeyHandle
1225 );
1226
1227 /*
1228 * FUNCTION: Generates a audit message when an object is deleted
1229 * ARGUMENTS:
1230 * SubsystemName = Spefies the name of the subsystem can be 'WIN32' or 'DEBUG'
1231 * HandleId= Handle to an audit object
1232 * GenerateOnClose = Value returned by NtAccessCheckAndAuditAlarm
1233 * REMARKS: This function maps to the win32 ObjectCloseAuditAlarm
1234 * RETURNS: Status
1235 */
1236
1237 NTSTATUS
1238 STDCALL
1239 NtDeleteObjectAuditAlarm (
1240 IN PUNICODE_STRING SubsystemName,
1241 IN PVOID HandleId,
1242 IN BOOLEAN GenerateOnClose
1243 );
1244
1245 NTSTATUS
1246 STDCALL
1247 ZwDeleteObjectAuditAlarm (
1248 IN PUNICODE_STRING SubsystemName,
1249 IN PVOID HandleId,
1250 IN BOOLEAN GenerateOnClose
1251 );
1252
1253
1254 /*
1255 * FUNCTION: Deletes a value from a registry key
1256 * ARGUMENTS:
1257 * KeyHandle = Handle of the key
1258 * ValueName = Name of the value to delete
1259 * RETURNS: Status
1260 */
1261
1262 NTSTATUS
1263 STDCALL
1264 NtDeleteValueKey(
1265 IN HANDLE KeyHandle,
1266 IN PUNICODE_STRING ValueName
1267 );
1268
1269 NTSTATUS
1270 STDCALL
1271 ZwDeleteValueKey(
1272 IN HANDLE KeyHandle,
1273 IN PUNICODE_STRING ValueName
1274 );
1275 /*
1276 * FUNCTION: Sends IOCTL to the io sub system
1277 * ARGUMENTS:
1278 * DeviceHandle = Points to the handle that is created by NtCreateFile
1279 * Event = Event to synchronize on STATUS_PENDING
1280 * ApcRoutine = Asynchroneous procedure callback
1281 * ApcContext = Callback context.
1282 * IoStatusBlock = Caller should supply storage for extra information..
1283 * IoControlCode = Contains the IO Control command. This is an
1284 * index to the structures in InputBuffer and OutputBuffer.
1285 * InputBuffer = Caller should supply storage for input buffer if IOTL expects one.
1286 * InputBufferSize = Size of the input bufffer
1287 * OutputBuffer = Caller should supply storage for output buffer if IOTL expects one.
1288 * OutputBufferSize = Size of the input bufffer
1289 * RETURNS: Status
1290 */
1291
1292 NTSTATUS
1293 STDCALL
1294 NtDeviceIoControlFile(
1295 IN HANDLE DeviceHandle,
1296 IN HANDLE Event OPTIONAL,
1297 IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,
1298 IN PVOID UserApcContext OPTIONAL,
1299 OUT PIO_STATUS_BLOCK IoStatusBlock,
1300 IN ULONG IoControlCode,
1301 IN PVOID InputBuffer,
1302 IN ULONG InputBufferSize,
1303 OUT PVOID OutputBuffer,
1304 IN ULONG OutputBufferSize
1305 );
1306
1307 NTSTATUS
1308 STDCALL
1309 ZwDeviceIoControlFile(
1310 IN HANDLE DeviceHandle,
1311 IN HANDLE Event OPTIONAL,
1312 IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,
1313 IN PVOID UserApcContext OPTIONAL,
1314 OUT PIO_STATUS_BLOCK IoStatusBlock,
1315 IN ULONG IoControlCode,
1316 IN PVOID InputBuffer,
1317 IN ULONG InputBufferSize,
1318 OUT PVOID OutputBuffer,
1319 IN ULONG OutputBufferSize
1320 );
1321 /*
1322 * FUNCTION: Displays a string on the blue screen
1323 * ARGUMENTS:
1324 * DisplayString = The string to display
1325 * RETURNS: Status
1326 */
1327
1328 NTSTATUS
1329 STDCALL
1330 NtDisplayString(
1331 IN PUNICODE_STRING DisplayString
1332 );
1333
1334 NTSTATUS
1335 STDCALL
1336 ZwDisplayString(
1337 IN PUNICODE_STRING DisplayString
1338 );
1339
1340 /*
1341 * FUNCTION: Copies a handle from one process space to another
1342 * ARGUMENTS:
1343 * SourceProcessHandle = The source process owning the handle. The source process should have opened
1344 * the SourceHandle with PROCESS_DUP_HANDLE access.
1345 * SourceHandle = The handle to the object.
1346 * TargetProcessHandle = The destination process owning the handle
1347 * TargetHandle (OUT) = Caller should supply storage for the duplicated handle.
1348 * DesiredAccess = The desired access to the handle.
1349 * InheritHandle = Indicates wheter the new handle will be inheritable or not.
1350 * Options = Specifies special actions upon duplicating the handle. Can be
1351 * one of the values DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS.
1352 * DUPLICATE_CLOSE_SOURCE specifies that the source handle should be
1353 * closed after duplicating. DUPLICATE_SAME_ACCESS specifies to ignore
1354 * the DesiredAccess paramter and just grant the same access to the new
1355 * handle.
1356 * RETURNS: Status
1357 * REMARKS: This function maps to the win32 DuplicateHandle.
1358 */
1359
1360 NTSTATUS
1361 STDCALL
1362 NtDuplicateObject(
1363 IN HANDLE SourceProcessHandle,
1364 IN PHANDLE SourceHandle,
1365 IN HANDLE TargetProcessHandle,
1366 OUT PHANDLE TargetHandle,
1367 IN ACCESS_MASK DesiredAccess,
1368 IN BOOLEAN InheritHandle,
1369 IN ULONG Options
1370 );
1371
1372 NTSTATUS
1373 STDCALL
1374 ZwDuplicateObject(
1375 IN HANDLE SourceProcessHandle,
1376 IN PHANDLE SourceHandle,
1377 IN HANDLE TargetProcessHandle,
1378 OUT PHANDLE TargetHandle,
1379 IN ACCESS_MASK DesiredAccess,
1380 IN BOOLEAN InheritHandle,
1381 IN ULONG Options
1382 );
1383
1384 NTSTATUS
1385 STDCALL
1386 NtDuplicateToken(
1387 IN HANDLE ExistingToken,
1388 IN ACCESS_MASK DesiredAccess,
1389 IN POBJECT_ATTRIBUTES ObjectAttributes,
1390 IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
1391 IN TOKEN_TYPE TokenType,
1392 OUT PHANDLE NewToken
1393 );
1394
1395 NTSTATUS
1396 STDCALL
1397 ZwDuplicateToken(
1398 IN HANDLE ExistingToken,
1399 IN ACCESS_MASK DesiredAccess,
1400 IN POBJECT_ATTRIBUTES ObjectAttributes,
1401 IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
1402 IN TOKEN_TYPE TokenType,
1403 OUT PHANDLE NewToken
1404 );
1405 /*
1406 * FUNCTION: Returns information about the subkeys of an open key
1407 * ARGUMENTS:
1408 * KeyHandle = Handle of the key whose subkeys are to enumerated
1409 * Index = zero based index of the subkey for which information is
1410 * request
1411 * KeyInformationClass = Type of information returned
1412 * KeyInformation (OUT) = Caller allocated buffer for the information
1413 * about the key
1414 * Length = Length in bytes of the KeyInformation buffer
1415 * ResultLength (OUT) = Caller allocated storage which holds
1416 * the number of bytes of information retrieved
1417 * on return
1418 * RETURNS: Status
1419 */
1420 NTSTATUS
1421 STDCALL
1422 NtEnumerateKey(
1423 IN HANDLE KeyHandle,
1424 IN ULONG Index,
1425 IN KEY_INFORMATION_CLASS KeyInformationClass,
1426 OUT PVOID KeyInformation,
1427 IN ULONG Length,
1428 OUT PULONG ResultLength
1429 );
1430
1431 NTSTATUS
1432 STDCALL
1433 ZwEnumerateKey(
1434 IN HANDLE KeyHandle,
1435 IN ULONG Index,
1436 IN KEY_INFORMATION_CLASS KeyInformationClass,
1437 OUT PVOID KeyInformation,
1438 IN ULONG Length,
1439 OUT PULONG ResultLength
1440 );
1441 /*
1442 * FUNCTION: Returns information about the value entries of an open key
1443 * ARGUMENTS:
1444 * KeyHandle = Handle of the key whose value entries are to enumerated
1445 * Index = zero based index of the subkey for which information is
1446 * request
1447 * KeyInformationClass = Type of information returned
1448 * KeyInformation (OUT) = Caller allocated buffer for the information
1449 * about the key
1450 * Length = Length in bytes of the KeyInformation buffer
1451 * ResultLength (OUT) = Caller allocated storage which holds
1452 * the number of bytes of information retrieved
1453 * on return
1454 * RETURNS: Status
1455 */
1456 NTSTATUS
1457 STDCALL
1458 NtEnumerateValueKey(
1459 IN HANDLE KeyHandle,
1460 IN ULONG Index,
1461 IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
1462 OUT PVOID KeyValueInformation,
1463 IN ULONG Length,
1464 OUT PULONG ResultLength
1465 );
1466
1467 NTSTATUS
1468 STDCALL
1469 ZwEnumerateValueKey(
1470 IN HANDLE KeyHandle,
1471 IN ULONG Index,
1472 IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
1473 OUT PVOID KeyValueInformation,
1474 IN ULONG Length,
1475 OUT PULONG ResultLength
1476 );
1477 /*
1478 * FUNCTION: Extends a section
1479 * ARGUMENTS:
1480 * SectionHandle = Handle to the section
1481 * NewMaximumSize = Adjusted size
1482 * RETURNS: Status
1483 */
1484 NTSTATUS
1485 STDCALL
1486 NtExtendSection(
1487 IN HANDLE SectionHandle,
1488 IN ULONG NewMaximumSize
1489 );
1490 NTSTATUS
1491 STDCALL
1492 ZwExtendSection(
1493 IN HANDLE SectionHandle,
1494 IN ULONG NewMaximumSize
1495 );
1496
1497 /*
1498 * FUNCTION: Finds a atom
1499 * ARGUMENTS:
1500 * Atom = Caller supplies storage for the resulting atom
1501 * AtomString = String to search for.
1502 * RETURNS: Status
1503 * REMARKS:
1504 * This funciton maps to the win32 GlobalFindAtom
1505 */
1506 NTSTATUS
1507 STDCALL
1508 NtFindAtom(
1509 OUT ATOM *Atom,
1510 IN PUNICODE_STRING AtomString
1511 );
1512
1513 NTSTATUS
1514 STDCALL
1515 ZwFindAtom(
1516 OUT ATOM *Atom,
1517 IN PUNICODE_STRING AtomString
1518 );
1519 /*
1520 * FUNCTION: Flushes chached file data to disk
1521 * ARGUMENTS:
1522 * FileHandle = Points to the file
1523 * IoStatusBlock = Caller must supply storage to receive the result of the flush
1524 * buffers operation. The information field is set to number of bytes
1525 * flushed to disk.
1526 * RETURNS: Status
1527 * REMARKS:
1528 * This funciton maps to the win32 FlushFileBuffers
1529 */
1530 NTSTATUS
1531 STDCALL
1532 NtFlushBuffersFile(
1533 IN HANDLE FileHandle,
1534 OUT PIO_STATUS_BLOCK IoStatusBlock
1535 );
1536
1537 NTSTATUS
1538 STDCALL
1539 ZwFlushBuffersFile(
1540 IN HANDLE FileHandle,
1541 OUT PIO_STATUS_BLOCK IoStatusBlock
1542 );
1543 /*
1544 * FUNCTION: Flushes a the processors instruction cache
1545 * ARGUMENTS:
1546 * ProcessHandle = Points to the process owning the cache
1547 * BaseAddress = // might this be a image address ????
1548 * NumberOfBytesToFlush =
1549 * RETURNS: Status
1550 * REMARKS:
1551 * This funciton is used by debuggers
1552 */
1553 NTSTATUS
1554 STDCALL
1555 NtFlushInstructionCache(
1556 IN HANDLE ProcessHandle,
1557 IN PVOID BaseAddress,
1558 IN UINT NumberOfBytesToFlush
1559 );
1560 NTSTATUS
1561 STDCALL
1562 ZwFlushInstructionCache(
1563 IN HANDLE ProcessHandle,
1564 IN PVOID BaseAddress,
1565 IN UINT NumberOfBytesToFlush
1566 );
1567 /*
1568 * FUNCTION: Flushes a registry key to disk
1569 * ARGUMENTS:
1570 * KeyHandle = Points to the registry key handle
1571 * RETURNS: Status
1572 * REMARKS:
1573 * This funciton maps to the win32 RegFlushKey.
1574 */
1575 NTSTATUS
1576 STDCALL
1577 NtFlushKey(
1578 IN HANDLE KeyHandle
1579 );
1580
1581 NTSTATUS
1582 STDCALL
1583 ZwFlushKey(
1584 IN HANDLE KeyHandle
1585 );
1586
1587 /*
1588 * FUNCTION: Flushes virtual memory to file
1589 * ARGUMENTS:
1590 * ProcessHandle = Points to the process that allocated the virtual memory
1591 * BaseAddress = Points to the memory address
1592 * NumberOfBytesToFlush = Limits the range to flush,
1593 * NumberOfBytesFlushed = Actual number of bytes flushed
1594 * RETURNS: Status
1595 * REMARKS:
1596 * Check return status on STATUS_NOT_MAPPED_DATA
1597 */
1598 NTSTATUS
1599 STDCALL
1600 NtFlushVirtualMemory(
1601 IN HANDLE ProcessHandle,
1602 IN PVOID BaseAddress,
1603 IN ULONG NumberOfBytesToFlush,
1604 OUT PULONG NumberOfBytesFlushed OPTIONAL
1605 );
1606 NTSTATUS
1607 STDCALL
1608 ZwFlushVirtualMemory(
1609 IN HANDLE ProcessHandle,
1610 IN PVOID BaseAddress,
1611 IN ULONG NumberOfBytesToFlush,
1612 OUT PULONG NumberOfBytesFlushed OPTIONAL
1613 );
1614
1615 /*
1616 * FUNCTION: Flushes the dirty pages to file
1617 * RETURNS: Status
1618 * FIXME: Not sure this does (how is the file specified)
1619 */
1620 NTSTATUS STDCALL NtFlushWriteBuffer(VOID);
1621 NTSTATUS STDCALL ZwFlushWriteBuffer(VOID);
1622
1623 /*
1624 * FUNCTION: Frees a range of virtual memory
1625 * ARGUMENTS:
1626 * ProcessHandle = Points to the process that allocated the virtual
1627 * memory
1628 * BaseAddress = Points to the memory address, rounded down to a
1629 * multiple of the pagesize
1630 * RegionSize = Limits the range to free, rounded up to a multiple of
1631 * the paging size
1632 * FreeType = Can be one of the values: MEM_DECOMMIT, or MEM_RELEASE
1633 * RETURNS: Status
1634 */
1635 NTSTATUS STDCALL NtFreeVirtualMemory(IN HANDLE ProcessHandle,
1636 IN PVOID *BaseAddress,
1637 IN PULONG RegionSize,
1638 IN ULONG FreeType);
1639 NTSTATUS STDCALL ZwFreeVirtualMemory(IN HANDLE ProcessHandle,
1640 IN PVOID *BaseAddress,
1641 IN PULONG RegionSize,
1642 IN ULONG FreeType);
1643
1644 /*
1645 * FUNCTION: Sends FSCTL to the filesystem
1646 * ARGUMENTS:
1647 * DeviceHandle = Points to the handle that is created by NtCreateFile
1648 * Event = Event to synchronize on STATUS_PENDING
1649 * ApcRoutine =
1650 * ApcContext =
1651 * IoStatusBlock = Caller should supply storage for
1652 * IoControlCode = Contains the File System Control command. This is an
1653 * index to the structures in InputBuffer and OutputBuffer.
1654 * FSCTL_GET_RETRIEVAL_POINTERS MAPPING_PAIR
1655 * FSCTL_GET_RETRIEVAL_POINTERS GET_RETRIEVAL_DESCRIPTOR
1656 * FSCTL_GET_VOLUME_BITMAP BITMAP_DESCRIPTOR
1657 * FSCTL_MOVE_FILE MOVEFILE_DESCRIPTOR
1658 *
1659 * InputBuffer = Caller should supply storage for input buffer if FCTL expects one.
1660 * InputBufferSize = Size of the input bufffer
1661 * OutputBuffer = Caller should supply storage for output buffer if FCTL expects one.
1662 * OutputBufferSize = Size of the input bufffer
1663 * RETURNS: Status [ STATUS_SUCCESS | STATUS_PENDING | STATUS_ACCESS_DENIED | STATUS_INSUFFICIENT_RESOURCES |
1664 * STATUS_INVALID_PARAMETER | STATUS_INVALID_DEVICE_REQUEST ]
1665 */
1666 NTSTATUS
1667 STDCALL
1668 NtFsControlFile(
1669 IN HANDLE DeviceHandle,
1670 IN HANDLE Event OPTIONAL,
1671 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
1672 IN PVOID ApcContext OPTIONAL,
1673 OUT PIO_STATUS_BLOCK IoStatusBlock,
1674 IN ULONG IoControlCode,
1675 IN PVOID InputBuffer,
1676 IN ULONG InputBufferSize,
1677 OUT PVOID OutputBuffer,
1678 IN ULONG OutputBufferSize
1679 );
1680
1681 NTSTATUS
1682 STDCALL
1683 ZwFsControlFile(
1684 IN HANDLE DeviceHandle,
1685 IN HANDLE Event OPTIONAL,
1686 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
1687 IN PVOID ApcContext OPTIONAL,
1688 OUT PIO_STATUS_BLOCK IoStatusBlock,
1689 IN ULONG IoControlCode,
1690 IN PVOID InputBuffer,
1691 IN ULONG InputBufferSize,
1692 OUT PVOID OutputBuffer,
1693 IN ULONG OutputBufferSize
1694 );
1695
1696 /*
1697 * FUNCTION: Retrieves the processor context of a thread
1698 * ARGUMENTS:
1699 * ThreadHandle = Handle to a thread
1700 * Context (OUT) = Caller allocated storage for the processor context
1701 * RETURNS: Status
1702 */
1703
1704 NTSTATUS
1705 STDCALL
1706 NtGetContextThread(
1707 IN HANDLE ThreadHandle,
1708 OUT PCONTEXT Context
1709 );
1710
1711 NTSTATUS
1712 STDCALL
1713 ZwGetContextThread(
1714 IN HANDLE ThreadHandle,
1715 OUT PCONTEXT Context
1716 );
1717 /*
1718 * FUNCTION: Retrieves the uptime of the system
1719 * ARGUMENTS:
1720 * UpTime = Number of clock ticks since boot.
1721 * RETURNS: Status
1722 */
1723 NTSTATUS
1724 STDCALL
1725 NtGetTickCount(
1726 PULONG UpTime
1727 );
1728
1729 NTSTATUS
1730 STDCALL
1731 ZwGetTickCount(
1732 PULONG UpTime
1733 );
1734
1735 /*
1736 * FUNCTION: Sets a thread to impersonate another
1737 * ARGUMENTS:
1738 * ThreadHandle = Server thread that will impersonate a client.
1739 ThreadToImpersonate = Client thread that will be impersonated
1740 SecurityQualityOfService = Specifies the impersonation level.
1741 * RETURNS: Status
1742 */
1743
1744 NTSTATUS
1745 STDCALL
1746 NtImpersonateThread(
1747 IN HANDLE ThreadHandle,
1748 IN HANDLE ThreadToImpersonate,
1749 IN PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService
1750 );
1751
1752 NTSTATUS
1753 STDCALL
1754 ZwImpersonateThread(
1755 IN HANDLE ThreadHandle,
1756 IN HANDLE ThreadToImpersonate,
1757 IN PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService
1758 );
1759
1760 /*
1761 * FUNCTION: Initializes the registry.
1762 * ARGUMENTS:
1763 * SetUpBoot = This parameter is true for a setup boot.
1764 * RETURNS: Status
1765 */
1766 NTSTATUS
1767 STDCALL
1768 NtInitializeRegistry(
1769 BOOLEAN SetUpBoot
1770 );
1771 NTSTATUS
1772 STDCALL
1773 ZwInitializeRegistry(
1774 BOOLEAN SetUpBoot
1775 );
1776
1777 /*
1778 * FUNCTION: Loads a driver.
1779 * ARGUMENTS:
1780 * DriverServiceName = Name of the driver to load
1781 * RETURNS: Status
1782 */
1783 NTSTATUS
1784 STDCALL
1785 NtLoadDriver(
1786 IN PUNICODE_STRING DriverServiceName
1787 );
1788
1789 NTSTATUS
1790 STDCALL
1791 ZwLoadDriver(
1792 IN PUNICODE_STRING DriverServiceName
1793 );
1794
1795 //-- NtLoadKey2
1796 /*
1797 * FUNCTION: Loads a registry key.
1798 * ARGUMENTS:
1799 * KeyHandle = Handle to the registry key
1800 ObjectAttributes = ???
1801 * REMARK:
1802 This procedure maps to the win32 procedure RegLoadKey
1803 * RETURNS: Status
1804 */
1805 NTSTATUS
1806 STDCALL
1807 NtLoadKey(
1808 PHANDLE KeyHandle,
1809 OBJECT_ATTRIBUTES ObjectAttributes
1810 );
1811 NTSTATUS
1812 STDCALL
1813 ZwLoadKey(
1814 PHANDLE KeyHandle,
1815 OBJECT_ATTRIBUTES ObjectAttributes
1816 );
1817 /*
1818 * FUNCTION: Locks a range of bytes in a file.
1819 * ARGUMENTS:
1820 * FileHandle = Handle to the file
1821 * Event = Should be null if apc is specified.
1822 * ApcRoutine = Asynchroneous Procedure Callback
1823 * ApcContext = Argument to the callback
1824 * IoStatusBlock (OUT) = Caller should supply storage for a structure containing
1825 * the completion status and information about the requested lock operation.
1826 * ByteOffset = Offset
1827 * Length = Number of bytes to lock.
1828 * Key = Special value to give other threads the possibility to unlock the file
1829 by supplying the key in a call to NtUnlockFile.
1830 * FailImmediatedly = If false the request will block untill the lock is obtained.
1831 * ExclusiveLock = Specifies whether a exclusive or a shared lock is obtained.
1832 * REMARK:
1833 This procedure maps to the win32 procedure LockFileEx. STATUS_PENDING is returned if the lock could
1834 not be obtained immediately, the device queue is busy and the IRP is queued.
1835 * RETURNS: Status [ STATUS_SUCCESS | STATUS_PENDING | STATUS_ACCESS_DENIED | STATUS_INSUFFICIENT_RESOURCES |
1836 STATUS_INVALID_PARAMETER | STATUS_INVALID_DEVICE_REQUEST | STATUS_LOCK_NOT_GRANTED ]
1837
1838 */
1839 NTSTATUS
1840 STDCALL
1841 NtLockFile(
1842 IN HANDLE FileHandle,
1843 IN HANDLE Event OPTIONAL,
1844 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
1845 IN PVOID ApcContext OPTIONAL,
1846 OUT PIO_STATUS_BLOCK IoStatusBlock,
1847 IN PLARGE_INTEGER ByteOffset,
1848 IN PLARGE_INTEGER Length,
1849 IN PULONG Key,
1850 IN BOOLEAN FailImmediatedly,
1851 IN BOOLEAN ExclusiveLock
1852 );
1853
1854 NTSTATUS
1855 STDCALL
1856 ZwLockFile(
1857 IN HANDLE FileHandle,
1858 IN HANDLE Event OPTIONAL,
1859 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
1860 IN PVOID ApcContext OPTIONAL,
1861 OUT PIO_STATUS_BLOCK IoStatusBlock,
1862 IN PLARGE_INTEGER ByteOffset,
1863 IN PLARGE_INTEGER Length,
1864 IN PULONG Key,
1865 IN BOOLEAN FailImmediatedly,
1866 IN BOOLEAN ExclusiveLock
1867 );
1868 /*
1869 * FUNCTION: Locks a range of virtual memory.
1870 * ARGUMENTS:
1871 * ProcessHandle = Handle to the process
1872 * BaseAddress = Lower boundary of the range of bytes to lock.
1873 * NumberOfBytesLock = Offset to the upper boundary.
1874 * NumberOfBytesLocked (OUT) = Number of bytes actually locked.
1875 * REMARK:
1876 This procedure maps to the win32 procedure VirtualLock
1877 * RETURNS: Status [STATUS_SUCCESS | STATUS_WAS_LOCKED ]
1878 */
1879 NTSTATUS
1880 STDCALL
1881 NtLockVirtualMemory(
1882 HANDLE ProcessHandle,
1883 PVOID BaseAddress,
1884 ULONG NumberOfBytesToLock,
1885 PULONG NumberOfBytesLocked
1886 );
1887 NTSTATUS
1888 STDCALL
1889 ZwLockVirtualMemory(
1890 HANDLE ProcessHandle,
1891 PVOID BaseAddress,
1892 ULONG NumberOfBytesToLock,
1893 PULONG NumberOfBytesLocked
1894 );
1895 /*
1896 * FUNCTION: Makes temporary object that will be removed at next boot.
1897 * ARGUMENTS:
1898 * Handle = Handle to object
1899 * RETURNS: Status
1900 */
1901
1902 NTSTATUS
1903 STDCALL
1904 NtMakeTemporaryObject(
1905 IN HANDLE Handle
1906 );
1907
1908 NTSTATUS
1909 STDCALL
1910 ZwMakeTemporaryObject(
1911 IN HANDLE Handle
1912 );
1913 /*
1914 * FUNCTION: Maps a view of a section into the virtual address space of a
1915 * process
1916 * ARGUMENTS:
1917 * SectionHandle = Handle of the section
1918 * ProcessHandle = Handle of the process
1919 * BaseAddress = Desired base address (or NULL) on entry
1920 * Actual base address of the view on exit
1921 * ZeroBits = Number of high order address bits that must be zero
1922 * CommitSize = Size in bytes of the initially committed section of
1923 * the view
1924 * SectionOffset = Offset in bytes from the beginning of the section
1925 * to the beginning of the view
1926 * ViewSize = Desired length of map (or zero to map all) on entry
1927 * Actual length mapped on exit
1928 * InheritDisposition = Specified how the view is to be shared with
1929 * child processes
1930 * AllocateType = Type of allocation for the pages
1931 * Protect = Protection for the committed region of the view
1932 * RETURNS: Status
1933 */
1934 NTSTATUS
1935 STDCALL
1936 NtMapViewOfSection(
1937 IN HANDLE SectionHandle,
1938 IN HANDLE ProcessHandle,
1939 IN OUT PVOID *BaseAddress,
1940 IN ULONG ZeroBits,
1941 IN ULONG CommitSize,
1942 IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,
1943 IN OUT PULONG ViewSize,
1944 IN SECTION_INHERIT InheritDisposition,
1945 IN ULONG AllocationType,
1946 IN ULONG AccessProtection
1947 );
1948
1949 NTSTATUS
1950 STDCALL
1951 ZwMapViewOfSection(
1952 IN HANDLE SectionHandle,
1953 IN HANDLE ProcessHandle,
1954 IN OUT PVOID *BaseAddress,
1955 IN ULONG ZeroBits,
1956 IN ULONG CommitSize,
1957 IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,
1958 IN OUT PULONG ViewSize,
1959 IN SECTION_INHERIT InheritDisposition,
1960 IN ULONG AllocationType,
1961 IN ULONG AccessProtection
1962 );
1963
1964 /*
1965 * FUNCTION: Installs a notify for the change of a directory's contents
1966 * ARGUMENTS:
1967 * FileHandle = Handle to the directory
1968 Event =
1969 * ApcRoutine = Start address
1970 * ApcContext = Delimits the range of virtual memory
1971 * for which the new access protection holds
1972 * IoStatusBlock = The new access proctection for the pages
1973 * Buffer = Caller supplies storage for resulting information --> FILE_NOTIFY_INFORMATION
1974 * BufferSize = Size of the buffer
1975 CompletionFilter = Can be one of the following values:
1976 FILE_NOTIFY_CHANGE_FILE_NAME
1977 FILE_NOTIFY_CHANGE_DIR_NAME
1978 FILE_NOTIFY_CHANGE_NAME ( FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_DIR_NAME )
1979 FILE_NOTIFY_CHANGE_ATTRIBUTES
1980 FILE_NOTIFY_CHANGE_SIZE
1981 FILE_NOTIFY_CHANGE_LAST_WRITE
1982 FILE_NOTIFY_CHANGE_LAST_ACCESS
1983 FILE_NOTIFY_CHANGE_CREATION ( change of creation timestamp )
1984 FILE_NOTIFY_CHANGE_EA
1985 FILE_NOTIFY_CHANGE_SECURITY
1986 FILE_NOTIFY_CHANGE_STREAM_NAME
1987 FILE_NOTIFY_CHANGE_STREAM_SIZE
1988 FILE_NOTIFY_CHANGE_STREAM_WRITE
1989 WatchTree = If true the notify will be installed recursively on the targetdirectory and all subdirectories.
1990 *
1991 * REMARKS:
1992 * The function maps to the win32 FindFirstChangeNotification, FindNextChangeNotification
1993 * RETURNS: Status
1994 */
1995 NTSTATUS
1996 STDCALL
1997 NtNotifyChangeDirectoryFile(
1998 IN HANDLE FileHandle,
1999 IN HANDLE Event OPTIONAL,
2000 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
2001 IN PVOID ApcContext OPTIONAL,
2002 OUT PIO_STATUS_BLOCK IoStatusBlock,
2003 OUT PVOID Buffer,
2004 IN ULONG BufferSize,
2005 IN ULONG CompletionFilter,
2006 IN BOOLEAN WatchTree
2007 );
2008
2009 NTSTATUS
2010 STDCALL
2011 ZwNotifyChangeDirectoryFile(
2012 IN HANDLE FileHandle,
2013 IN HANDLE Event OPTIONAL,
2014 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
2015 IN PVOID ApcContext OPTIONAL,
2016 OUT PIO_STATUS_BLOCK IoStatusBlock,
2017 OUT PVOID Buffer,
2018 IN ULONG BufferSize,
2019 IN ULONG CompletionFilter,
2020 IN BOOLEAN WatchTree
2021 );
2022
2023 /*
2024 * FUNCTION: Installs a notfication callback on registry changes
2025 * ARGUMENTS:
2026 KeyHandle = Handle to the registry key
2027 Event = Event that should be signalled on modification of the key
2028 ApcRoutine = Routine that should be called on modification of the key
2029 ApcContext = Argument to the ApcRoutine
2030 IoStatusBlock = ???
2031 CompletionFilter = Specifies the kind of notification the caller likes to receive.
2032 Can be a combination of the following values:
2033
2034 REG_NOTIFY_CHANGE_NAME
2035 REG_NOTIFY_CHANGE_ATTRIBUTES
2036 REG_NOTIFY_CHANGE_LAST_SET
2037 REG_NOTIFY_CHANGE_SECURITY
2038
2039
2040 Asynchroneous = If TRUE the changes are reported by signalling an event if false
2041 the function will not return before a change occurs.
2042 ChangeBuffer = Will return the old value
2043 Length = Size of the change buffer
2044 WatchSubtree = Indicates if the caller likes to receive a notification of changes in
2045 sub keys or not.
2046 * REMARKS: If the key is closed the event is signalled aswell.
2047 * RETURNS: Status
2048 */
2049
2050 NTSTATUS
2051 STDCALL
2052 NtNotifyChangeKey(
2053 IN HANDLE KeyHandle,
2054 IN HANDLE Event,
2055 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
2056 IN PVOID ApcContext OPTIONAL,
2057 OUT PIO_STATUS_BLOCK IoStatusBlock,
2058 IN ULONG CompletionFilter,
2059 IN BOOLEAN Asynchroneous,
2060 OUT PVOID ChangeBuffer,
2061 IN ULONG Length,
2062 IN BOOLEAN WatchSubtree
2063 );
2064
2065 NTSTATUS
2066 STDCALL
2067 ZwNotifyChangeKey(
2068 IN HANDLE KeyHandle,
2069 IN HANDLE Event,
2070 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
2071 IN PVOID ApcContext OPTIONAL,
2072 OUT PIO_STATUS_BLOCK IoStatusBlock,
2073 IN ULONG CompletionFilter,
2074 IN BOOLEAN Asynchroneous,
2075 OUT PVOID ChangeBuffer,
2076 IN ULONG Length,
2077 IN BOOLEAN WatchSubtree
2078 );
2079
2080 /*
2081 * FUNCTION: Opens an existing directory object
2082 * ARGUMENTS:
2083 * FileHandle (OUT) = Caller supplied storage for the resulting handle
2084 * DesiredAccess = Requested access to the directory
2085 * ObjectAttributes = Initialized attributes for the object
2086 * RETURNS: Status
2087 */
2088
2089 NTSTATUS
2090 STDCALL
2091 NtOpenDirectoryObject(
2092 OUT PHANDLE FileHandle,
2093 IN ACCESS_MASK DesiredAccess,
2094 IN POBJECT_ATTRIBUTES ObjectAttributes
2095 );
2096 NTSTATUS
2097 STDCALL
2098 ZwOpenDirectoryObject(
2099 OUT PHANDLE FileHandle,
2100 IN ACCESS_MASK DesiredAccess,
2101 IN POBJECT_ATTRIBUTES ObjectAttributes
2102 );
2103
2104 /*
2105 * FUNCTION: Opens an existing event
2106 * ARGUMENTS:
2107 * EventHandle (OUT) = Caller supplied storage for the resulting handle
2108 * DesiredAccess = Requested access to the event
2109 * ObjectAttributes = Initialized attributes for the object
2110 * RETURNS: Status
2111 */
2112 NTSTATUS
2113 STDCALL
2114 NtOpenEvent(
2115 OUT PHANDLE EventHandle,
2116 IN ACCESS_MASK DesiredAccess,
2117 IN POBJECT_ATTRIBUTES ObjectAttributes
2118 );
2119
2120 NTSTATUS
2121 STDCALL
2122 ZwOpenEvent(
2123 OUT PHANDLE EventHandle,
2124 IN ACCESS_MASK DesiredAccess,
2125 IN POBJECT_ATTRIBUTES ObjectAttributes
2126 );
2127
2128 /*
2129 * FUNCTION: Opens an existing event pair
2130 * ARGUMENTS:
2131 * EventHandle (OUT) = Caller supplied storage for the resulting handle
2132 * DesiredAccess = Requested access to the event
2133 * ObjectAttributes = Initialized attributes for the object
2134 * RETURNS: Status
2135 */
2136
2137 NTSTATUS
2138 STDCALL
2139 NtOpenEventPair(
2140 OUT PHANDLE EventPairHandle,
2141 IN ACCESS_MASK DesiredAccess,
2142 IN POBJECT_ATTRIBUTES ObjectAttributes
2143 );
2144
2145 NTSTATUS
2146 STDCALL
2147 ZwOpenEventPair(
2148 OUT PHANDLE EventPairHandle,
2149 IN ACCESS_MASK DesiredAccess,
2150 IN POBJECT_ATTRIBUTES ObjectAttributes
2151 );
2152 /*
2153 * FUNCTION: Opens an existing file
2154 * ARGUMENTS:
2155 * FileHandle (OUT) = Caller supplied storage for the resulting handle
2156 * DesiredAccess = Requested access to the file
2157 * ObjectAttributes = Initialized attributes for the object
2158 * IoStatusBlock =
2159 * ShareAccess =
2160 * OpenOptions =
2161 * RETURNS: Status
2162 */
2163 NTSTATUS
2164 STDCALL
2165 NtOpenFile(
2166 OUT PHANDLE FileHandle,
2167 IN ACCESS_MASK DesiredAccess,
2168 IN POBJECT_ATTRIBUTES ObjectAttributes,
2169 OUT PIO_STATUS_BLOCK IoStatusBlock,
2170 IN ULONG ShareAccess,
2171 IN ULONG OpenOptions
2172 );
2173
2174 NTSTATUS
2175 STDCALL
2176 ZwOpenFile(
2177 OUT PHANDLE FileHandle,
2178 IN ACCESS_MASK DesiredAccess,
2179 IN POBJECT_ATTRIBUTES ObjectAttributes,
2180 OUT PIO_STATUS_BLOCK IoStatusBlock,
2181 IN ULONG ShareAccess,
2182 IN ULONG OpenOptions
2183 );
2184
2185 /*
2186 * FUNCTION: Opens an existing io completion object
2187 * ARGUMENTS:
2188 * CompletionPort (OUT) = Caller supplied storage for the resulting handle
2189 * DesiredAccess = Requested access to the io completion object
2190 * ObjectAttributes = Initialized attributes for the object
2191 * RETURNS: Status
2192 */
2193
2194 NTSTATUS
2195 STDCALL
2196 NtOpenIoCompletion(
2197 OUT PHANDLE CompetionPort,
2198 IN ACCESS_MASK DesiredAccess,
2199 IN POBJECT_ATTRIBUTES ObjectAttributes
2200 );
2201
2202 NTSTATUS
2203 STDCALL
2204 ZwOpenIoCompletion(
2205 OUT PHANDLE CompetionPort,
2206 IN ACCESS_MASK DesiredAccess,
2207 IN POBJECT_ATTRIBUTES ObjectAttributes
2208 );
2209
2210 /*
2211 * FUNCTION: Opens an existing key in the registry
2212 * ARGUMENTS:
2213 * KeyHandle (OUT) = Caller supplied storage for the resulting handle
2214 * DesiredAccess = Requested access to the key
2215 * ObjectAttributes = Initialized attributes for the object
2216 * RETURNS: Status
2217 */
2218 NTSTATUS
2219 STDCALL
2220 NtOpenKey(
2221 OUT PHANDLE KeyHandle,
2222 IN ACCESS_MASK DesiredAccess,
2223 IN POBJECT_ATTRIBUTES ObjectAttributes
2224 );
2225
2226 NTSTATUS
2227 STDCALL
2228 ZwOpenKey(
2229 OUT PHANDLE KeyHandle,
2230 IN ACCESS_MASK DesiredAccess,
2231 IN POBJECT_ATTRIBUTES ObjectAttributes
2232 );
2233 /*
2234 * FUNCTION: Opens an existing key in the registry
2235 * ARGUMENTS:
2236 * MutantHandle (OUT) = Caller supplied storage for the resulting handle
2237 * DesiredAccess = Requested access to the mutant
2238 * ObjectAttribute = Initialized attributes for the object
2239 * RETURNS: Status
2240 */
2241 NTSTATUS
2242 STDCALL
2243 NtOpenMutant(
2244 OUT PHANDLE MutantHandle,
2245 IN ACCESS_MASK DesiredAccess,
2246 IN POBJECT_ATTRIBUTES ObjectAttributes
2247 );
2248 NTSTATUS
2249 STDCALL
2250 ZwOpenMutant(
2251 OUT PHANDLE MutantHandle,
2252 IN ACCESS_MASK DesiredAccess,
2253 IN POBJECT_ATTRIBUTES ObjectAttributes
2254 );
2255
2256 NTSTATUS
2257 STDCALL
2258 NtOpenObjectAuditAlarm(
2259 IN PUNICODE_STRING SubsystemName,
2260 IN PVOID HandleId,
2261 IN POBJECT_ATTRIBUTES ObjectAttributes,
2262 IN HANDLE ClientToken,
2263 IN ULONG DesiredAccess,
2264 IN ULONG GrantedAccess,
2265 IN PPRIVILEGE_SET Privileges,
2266 IN BOOLEAN ObjectCreation,
2267 IN BOOLEAN AccessGranted,
2268 OUT PBOOLEAN GenerateOnClose
2269 );
2270
2271 NTSTATUS
2272 STDCALL
2273 ZwOpenObjectAuditAlarm(
2274 IN PUNICODE_STRING SubsystemName,
2275 IN PVOID HandleId,
2276 IN POBJECT_ATTRIBUTES ObjectAttributes,
2277 IN HANDLE ClientToken,
2278 IN ULONG DesiredAccess,
2279 IN ULONG GrantedAccess,
2280 IN PPRIVILEGE_SET Privileges,
2281 IN BOOLEAN ObjectCreation,
2282 IN BOOLEAN AccessGranted,
2283 OUT PBOOLEAN GenerateOnClose
2284 );
2285 /*
2286 * FUNCTION: Opens an existing process
2287 * ARGUMENTS:
2288 * ProcessHandle (OUT) = Caller supplied storage for the resulting handle
2289 * DesiredAccess = Requested access to the process
2290 * ObjectAttribute = Initialized attributes for the object
2291 * ClientId = Identifies the process id to open
2292 * RETURNS: Status
2293 */
2294 NTSTATUS
2295 STDCALL
2296 NtOpenProcess (
2297 OUT PHANDLE ProcessHandle,
2298 IN ACCESS_MASK DesiredAccess,
2299 IN POBJECT_ATTRIBUTES ObjectAttributes,
2300 IN PCLIENT_ID ClientId
2301 );
2302 NTSTATUS
2303 STDCALL
2304 ZwOpenProcess (
2305 OUT PHANDLE ProcessHandle,
2306 IN ACCESS_MASK DesiredAccess,
2307 IN POBJECT_ATTRIBUTES ObjectAttributes,
2308 IN PCLIENT_ID ClientId
2309 );
2310 /*
2311 * FUNCTION: Opens an existing process
2312 * ARGUMENTS:
2313 * ProcessHandle = Handle of the process of which owns the token
2314 * DesiredAccess = Requested access to the token
2315 * TokenHandle (OUT) = Caller supplies storage for the resulting token.
2316 * REMARKS:
2317 This function maps to the win32
2318 * RETURNS: Status
2319 */
2320
2321 NTSTATUS
2322 STDCALL
2323 NtOpenProcessToken(
2324 IN HANDLE ProcessHandle,
2325 IN ACCESS_MASK DesiredAccess,
2326 OUT PHANDLE TokenHandle
2327 );
2328
2329 NTSTATUS
2330 STDCALL
2331 ZwOpenProcessToken(
2332 IN HANDLE ProcessHandle,
2333 IN ACCESS_MASK DesiredAccess,
2334 OUT PHANDLE TokenHandle
2335 );
2336
2337 /*
2338 * FUNCTION: Opens an existing section object
2339 * ARGUMENTS:
2340 * KeyHandle (OUT) = Caller supplied storage for the resulting handle
2341 * DesiredAccess = Requested access to the key
2342 * ObjectAttribute = Initialized attributes for the object
2343 * RETURNS: Status
2344 */
2345
2346 NTSTATUS
2347 STDCALL
2348 NtOpenSection(
2349 OUT PHANDLE SectionHandle,
2350 IN ACCESS_MASK DesiredAccess,
2351 IN POBJECT_ATTRIBUTES ObjectAttributes
2352 );
2353 NTSTATUS
2354 STDCALL
2355 ZwOpenSection(
2356 OUT PHANDLE SectionHandle,
2357 IN ACCESS_MASK DesiredAccess,
2358 IN POBJECT_ATTRIBUTES ObjectAttributes
2359 );
2360 /*
2361 * FUNCTION: Opens an existing semaphore
2362 * ARGUMENTS:
2363 * SemaphoreHandle (OUT) = Caller supplied storage for the resulting handle
2364 * DesiredAccess = Requested access to the semaphore
2365 * ObjectAttribute = Initialized attributes for the object
2366 * RETURNS: Status
2367 */
2368 NTSTATUS
2369 STDCALL
2370 NtOpenSemaphore(
2371 IN HANDLE SemaphoreHandle,
2372 IN ACCESS_MASK DesiredAcces,
2373 IN POBJECT_ATTRIBUTES ObjectAttributes
2374 );
2375 NTSTATUS
2376 STDCALL
2377 ZwOpenSemaphore(
2378 IN HANDLE SemaphoreHandle,
2379 IN ACCESS_MASK DesiredAcces,
2380 IN POBJECT_ATTRIBUTES ObjectAttributes
2381 );
2382 /*
2383 * FUNCTION: Opens an existing symbolic link
2384 * ARGUMENTS:
2385 * SymbolicLinkHandle (OUT) = Caller supplied storage for the resulting handle
2386 * DesiredAccess = Requested access to the symbolic link
2387 * ObjectAttribute = Initialized attributes for the object
2388 * RETURNS: Status
2389 */
2390 NTSTATUS
2391 STDCALL
2392 NtOpenSymbolicLinkObject(
2393 OUT PHANDLE SymbolicLinkHandle,
2394 IN ACCESS_MASK DesiredAccess,
2395 IN POBJECT_ATTRIBUTES ObjectAttributes
2396 );
2397 NTSTATUS
2398 STDCALL
2399 ZwOpenSymbolicLinkObject(
2400 OUT PHANDLE SymbolicLinkHandle,
2401 IN ACCESS_MASK DesiredAccess,
2402 IN POBJECT_ATTRIBUTES ObjectAttributes
2403 );
2404 /*
2405 * FUNCTION: Opens an existing thread
2406 * ARGUMENTS:
2407 * ThreadHandle (OUT) = Caller supplied storage for the resulting handle
2408 * DesiredAccess = Requested access to the thread
2409 * ObjectAttribute = Initialized attributes for the object
2410 * ClientId = Identifies the thread to open.
2411 * RETURNS: Status
2412 */
2413 NTSTATUS
2414 STDCALL
2415 NtOpenThread(
2416 OUT PHANDLE ThreadHandle,
2417 IN ACCESS_MASK DesiredAccess,
2418 IN POBJECT_ATTRIBUTES ObjectAttributes,
2419 IN PCLIENT_ID ClientId
2420 );
2421 NTSTATUS
2422 STDCALL
2423 ZwOpenThread(
2424 OUT PHANDLE ThreadHandle,
2425 IN ACCESS_MASK DesiredAccess,
2426 IN POBJECT_ATTRIBUTES ObjectAttributes,
2427 IN PCLIENT_ID ClientId
2428 );
2429
2430 NTSTATUS
2431 STDCALL
2432 NtOpenThreadToken(
2433 IN HANDLE ThreadHandle,
2434 IN ACCESS_MASK DesiredAccess,
2435 IN BOOLEAN OpenAsSelf,
2436 OUT PHANDLE TokenHandle
2437 );
2438
2439 NTSTATUS
2440 STDCALL
2441 ZwOpenThreadToken(
2442 IN HANDLE ThreadHandle,
2443 IN ACCESS_MASK DesiredAccess,
2444 IN BOOLEAN OpenAsSelf,
2445 OUT PHANDLE TokenHandle
2446 );
2447 /*
2448 * FUNCTION: Opens an existing timer
2449 * ARGUMENTS:
2450 * TimerHandle (OUT) = Caller supplied storage for the resulting handle
2451 * DesiredAccess = Requested access to the timer
2452 * ObjectAttribute = Initialized attributes for the object
2453 * RETURNS: Status
2454 */
2455 NTSTATUS
2456 STDCALL
2457 NtOpenTimer(
2458 OUT PHANDLE TimerHandle,
2459 IN ACCESS_MASK DesiredAccess,
2460 IN POBJECT_ATTRIBUTES ObjectAttributes
2461 );
2462 NTSTATUS
2463 STDCALL
2464 ZwOpenTimer(
2465 OUT PHANDLE TimerHandle,
2466 IN ACCESS_MASK DesiredAccess,
2467 IN POBJECT_ATTRIBUTES ObjectAttributes
2468 );
2469
2470 /*
2471 * FUNCTION: Checks an access token for specific privileges
2472 * ARGUMENTS:
2473 * ClientToken = Handle to a access token structure
2474 * RequiredPrivileges = Specifies the requested privileges.
2475 * Result = Caller supplies storage for the result. If PRIVILEGE_SET_ALL_NECESSARY is
2476 set in the Control member of PRIVILEGES_SET Result
2477 will only be TRUE if all privileges are present in the access token.
2478 * RETURNS: Status
2479 */
2480
2481 NTSTATUS
2482 STDCALL
2483 NtPrivilegeCheck(
2484 IN HANDLE ClientToken,
2485 IN PPRIVILEGE_SET RequiredPrivileges,
2486 IN PBOOLEAN Result
2487 );
2488
2489 NTSTATUS
2490 STDCALL
2491 ZwPrivilegeCheck(
2492 IN HANDLE ClientToken,
2493 IN PPRIVILEGE_SET RequiredPrivileges,
2494 IN PBOOLEAN Result
2495 );
2496
2497 NTSTATUS
2498 STDCALL
2499 NtPrivilegedServiceAuditAlarm(
2500 IN PUNICODE_STRING SubsystemName,
2501 IN PUNICODE_STRING ServiceName,
2502 IN HANDLE ClientToken,
2503 IN PPRIVILEGE_SET Privileges,
2504 IN BOOLEAN AccessGranted
2505 );
2506
2507 NTSTATUS
2508 STDCALL
2509 ZwPrivilegedServiceAuditAlarm(
2510 IN PUNICODE_STRING SubsystemName,
2511 IN PUNICODE_STRING ServiceName,
2512 IN HANDLE ClientToken,
2513 IN PPRIVILEGE_SET Privileges,
2514 IN BOOLEAN AccessGranted
2515 );
2516
2517 NTSTATUS
2518 STDCALL
2519 NtPrivilegeObjectAuditAlarm(
2520 IN PUNICODE_STRING SubsystemName,
2521 IN PVOID HandleId,
2522 IN HANDLE ClientToken,
2523 IN ULONG DesiredAccess,
2524 IN PPRIVILEGE_SET Privileges,
2525 IN BOOLEAN AccessGranted
2526 );
2527
2528 NTSTATUS
2529 STDCALL
2530 ZwPrivilegeObjectAuditAlarm(
2531 IN PUNICODE_STRING SubsystemName,
2532 IN PVOID HandleId,
2533 IN HANDLE ClientToken,
2534 IN ULONG DesiredAccess,
2535 IN PPRIVILEGE_SET Privileges,
2536 IN BOOLEAN AccessGranted
2537 );
2538
2539 /*
2540 * FUNCTION: Entry point for native applications
2541 * ARGUMENTS:
2542 * Peb = Pointes to the Process Environment Block (PEB)
2543 * REMARKS:
2544 * Native applications should use this function instead of a main.
2545 * Calling proces should terminate itself.
2546 * RETURNS: Status
2547 */
2548 VOID
2549 NtProcessStartup(
2550 IN PPEB Peb
2551 );
2552
2553 /*
2554 * FUNCTION: Set the access protection of a range of virtual memory
2555 * ARGUMENTS:
2556 * ProcessHandle = Handle to process owning the virtual address space
2557 * BaseAddress = Start address
2558 * NumberOfBytesToProtect = Delimits the range of virtual memory
2559 * for which the new access protection holds
2560 * NewAccessProtection = The new access proctection for the pages
2561 * OldAccessProtection = Caller should supply storage for the old
2562 * access protection
2563 *
2564 * REMARKS:
2565 * The function maps to the win32 VirtualProtectEx
2566 * RETURNS: Status
2567 */
2568 NTSTATUS
2569 STDCALL
2570 NtProtectVirtualMemory(
2571 IN HANDLE ProcessHandle,
2572 IN PVOID BaseAddress,
2573 IN ULONG NumberOfBytesToProtect,
2574 IN ULONG NewAccessProtection,
2575 OUT PULONG OldAccessProtection
2576 );
2577
2578 NTSTATUS
2579 STDCALL
2580 ZwProtectVirtualMemory(
2581 IN HANDLE ProcessHandle,
2582 IN PVOID BaseAddress,
2583 IN ULONG NumberOfBytesToProtect,
2584 IN ULONG NewAccessProtection,
2585 OUT PULONG OldAccessProtection
2586 );
2587
2588
2589 /*
2590 * FUNCTION: Signals an event and resets it afterwards.
2591 * ARGUMENTS:
2592 * EventHandle = Handle to the event
2593 * PulseCount = Number of times the action is repeated
2594 * RETURNS: Status
2595 */
2596 NTSTATUS
2597 STDCALL
2598 NtPulseEvent(
2599 IN HANDLE EventHandle,
2600 IN PULONG PulseCount OPTIONAL
2601 );
2602
2603 NTSTATUS
2604 STDCALL
2605 ZwPulseEvent(
2606 IN HANDLE EventHandle,
2607 IN PULONG PulseCount OPTIONAL
2608 );
2609
2610 /*
2611 * FUNCTION: Queries the attributes of a file
2612 * ARGUMENTS:
2613 * FileHandle = Handle to the file
2614 * Buffer = Caller supplies storage for the attributes
2615 * RETURNS: Status
2616 */
2617
2618 NTSTATUS
2619 STDCALL
2620 NtQueryAttributesFile(
2621 IN HANDLE FileHandle,
2622 IN PVOID Buffer
2623 );
2624
2625 NTSTATUS
2626 STDCALL
2627 ZwQueryAttributesFile(
2628 IN HANDLE FileHandle,
2629 IN PVOID Buffer
2630 );
2631
2632
2633 /*
2634 * FUNCTION: Queries a directory file.
2635 * ARGUMENTS:
2636 * FileHandle = Handle to a directory file
2637 * EventHandle = Handle to the event signaled on completion
2638 * ApcRoutine = Asynchroneous procedure callback, called on completion
2639 * ApcContext = Argument to the apc.
2640 * IoStatusBlock = Caller supplies storage for extended status information.
2641 * FileInformation = Caller supplies storage for the resulting information.
2642 *
2643 * FileNameInformation FILE_NAMES_INFORMATION
2644 * FileDirectoryInformation FILE_DIRECTORY_INFORMATION
2645 * FileFullDirectoryInformation FILE_FULL_DIRECTORY_INFORMATION
2646 * FileBothDirectoryInformation FILE_BOTH_DIR_INFORMATION
2647 *
2648 * Length = Size of the storage supplied
2649 * FileInformationClass = Indicates the type of information requested.
2650 * ReturnSingleEntry = Specify true if caller only requests the first directory found.
2651 * FileName = Initial directory name to query, that may contain wild cards.
2652 * RestartScan = Number of times the action should be repeated
2653 * RETURNS: Status [ STATUS_SUCCESS, STATUS_ACCESS_DENIED, STATUS_INSUFFICIENT_RESOURCES,
2654 * STATUS_INVALID_PARAMETER, STATUS_INVALID_DEVICE_REQUEST, STATUS_BUFFER_OVERFLOW,
2655 * STATUS_INVALID_INFO_CLASS, STATUS_NO_SUCH_FILE, STATUS_NO_MORE_FILES ]
2656 */
2657
2658 NTSTATUS
2659 STDCALL
2660 NtQueryDirectoryFile(
2661 IN HANDLE FileHandle,
2662 IN HANDLE Event OPTIONAL,
2663 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
2664 IN PVOID ApcContext OPTIONAL,
2665 OUT PIO_STATUS_BLOCK IoStatusBlock,
2666 OUT PVOID FileInformation,
2667 IN ULONG Length,
2668 IN FILE_INFORMATION_CLASS FileInformationClass,
2669 IN BOOLEAN ReturnSingleEntry,
2670 IN PUNICODE_STRING FileName OPTIONAL,
2671 IN BOOLEAN RestartScan
2672 );
2673
2674 NTSTATUS
2675 STDCALL
2676 ZwQueryDirectoryFile(
2677 IN HANDLE FileHandle,
2678 IN HANDLE Event OPTIONAL,
2679 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
2680 IN PVOID ApcContext OPTIONAL,
2681 OUT PIO_STATUS_BLOCK IoStatusBlock,
2682 OUT PVOID FileInformation,
2683 IN ULONG Length,
2684 IN FILE_INFORMATION_CLASS FileInformationClass,
2685 IN BOOLEAN ReturnSingleEntry,
2686 IN PUNICODE_STRING FileName OPTIONAL,
2687 IN BOOLEAN RestartScan
2688 );
2689
2690 /*
2691 * FUNCTION: Query information about the content of a directory object
2692 * ARGUMENTS:
2693 DirObjInformation = Buffer must be large enough to hold the name strings too
2694 GetNextIndex = If TRUE :return the index of the next object in this directory in ObjectIndex
2695 If FALSE: return the number of objects in this directory in ObjectIndex
2696 IgnoreInputIndex= If TRUE: ignore input value of ObjectIndex always start at index 0
2697 If FALSE use input value of ObjectIndex
2698 ObjectIndex = zero based index of object in the directory depends on GetNextIndex and IgnoreInputIndex
2699 DataWritten = Actual size of the ObjectIndex ???
2700 * RETURNS: Status
2701 */
2702 NTSTATUS
2703 STDCALL
2704 NtQueryDirectoryObject(
2705 IN HANDLE DirObjHandle,
2706 OUT POBJDIR_INFORMATION DirObjInformation,
2707 IN ULONG BufferLength,
2708 IN BOOLEAN GetNextIndex,
2709 IN BOOLEAN IgnoreInputIndex,
2710 IN OUT PULONG ObjectIndex,
2711 OUT PULONG DataWritten OPTIONAL
2712 );
2713
2714 NTSTATUS
2715 STDCALL
2716 ZwQueryDirectoryObject(
2717 IN HANDLE DirObjHandle,
2718 OUT POBJDIR_INFORMATION DirObjInformation,
2719 IN ULONG BufferLength,
2720 IN BOOLEAN GetNextIndex,
2721 IN BOOLEAN IgnoreInputIndex,
2722 IN OUT PULONG ObjectIndex,
2723 OUT PULONG DataWritten OPTIONAL
2724 );
2725
2726 /*
2727 * FUNCTION: Queries the extended attributes of a file
2728 * ARGUMENTS:
2729 * FileHandle = Handle to the event
2730 * IoStatusBlock = Number of times the action is repeated
2731 * Buffer
2732 * Length
2733 * ReturnSingleEntry
2734 * EaList
2735 * EaListLength
2736 * EaIndex
2737 * RestartScan
2738 * RETURNS: Status
2739 */
2740
2741 NTSTATUS
2742 STDCALL
2743 NtQueryEaFile(
2744 IN HANDLE FileHandle,
2745 OUT PIO_STATUS_BLOCK IoStatusBlock,
2746 OUT PVOID Buffer,
2747 IN ULONG Length,
2748 IN BOOLEAN ReturnSingleEntry,
2749 IN PVOID EaList OPTIONAL,
2750 IN ULONG EaListLength,
2751 IN PULONG EaIndex OPTIONAL,
2752 IN BOOLEAN RestartScan
2753 );
2754
2755 NTSTATUS
2756 STDCALL
2757 ZwQueryEaFile(
2758 IN HANDLE FileHandle,
2759 OUT PIO_STATUS_BLOCK IoStatusBlock,
2760 OUT PVOID Buffer,
2761 IN ULONG Length,
2762 IN BOOLEAN ReturnSingleEntry,
2763 IN PVOID EaList OPTIONAL,
2764 IN ULONG EaListLength,
2765 IN PULONG EaIndex OPTIONAL,
2766 IN BOOLEAN RestartScan
2767 );
2768 /*
2769 * FUNCTION: Queries an event
2770 * ARGUMENTS:
2771 * EventHandle = Handle to the event
2772 * EventInformationClass = Index of the information structure
2773
2774 EventBasicInformation EVENT_BASIC_INFORMATION
2775
2776 * EventInformation = Caller supplies storage for the information structure
2777 * EventInformationLength = Size of the information structure
2778 * ReturnLength = Data written
2779 * RETURNS: Status
2780 */
2781
2782
2783 NTSTATUS
2784 STDCALL
2785 NtQueryEvent(
2786 IN HANDLE EventHandle,
2787 IN CINT EventInformationClass,
2788 OUT PVOID EventInformation,
2789 IN ULONG EventInformationLength,
2790 OUT PULONG ReturnLength
2791 );
2792
2793 NTSTATUS
2794 STDCALL
2795 ZwQueryEvent(
2796 IN HANDLE EventHandle,
2797 IN CINT EventInformationClass,
2798 OUT PVOID EventInformation,
2799 IN ULONG EventInformationLength,
2800 OUT PULONG ReturnLength
2801 );
2802 NTSTATUS
2803 STDCALL
2804 NtQueryFullAttributesFile(
2805 IN HANDLE FileHandle,
2806 IN PVOID Attributes
2807 );
2808 NTSTATUS
2809 STDCALL
2810 ZwQueryFullAttributesFile(
2811 IN HANDLE FileHandle,
2812 IN PVOID Attributes
2813 );
2814
2815 NTSTATUS
2816 STDCALL
2817 NtQueryInformationAtom(
2818 IN HANDLE AtomHandle,
2819 IN CINT AtomInformationClass,
2820 OUT PVOID AtomInformation,
2821 IN ULONG AtomInformationLength,
2822 OUT PULONG ReturnLength
2823 );
2824 NTSTATUS
2825 STDCALL
2826 NtQueryInformationAtom(
2827 IN HANDLE AtomHandle,
2828 IN CINT AtomInformationClass,
2829 OUT PVOID AtomInformation,
2830 IN ULONG AtomInformationLength,
2831 OUT PULONG ReturnLength
2832 );
2833
2834
2835
2836 /*
2837 * FUNCTION: Queries the information of a file object.
2838 * ARGUMENTS:
2839 * FileHandle = Handle to the file object
2840 * IoStatusBlock = Caller supplies storage for extended information
2841 * on the current operation.
2842 * FileInformation = Storage for the new file information
2843 * Lenght = Size of the storage for the file information.
2844 * FileInformationClass = Indicates which file information is queried
2845
2846 FileDirectoryInformation FILE_DIRECTORY_INFORMATION
2847 FileFullDirectoryInformation FILE_FULL_DIRECTORY_INFORMATION
2848 FileBothDirectoryInformation FILE_BOTH_DIRECTORY_INFORMATION
2849 FileBasicInformation FILE_BASIC_INFORMATION
2850 FileStandardInformation FILE_STANDARD_INFORMATION
2851 FileInternalInformation FILE_INTERNAL_INFORMATION
2852 FileEaInformation FILE_EA_INFORMATION
2853 FileAccessInformation FILE_ACCESS_INFORMATION
2854 FileNameInformation FILE_NAME_INFORMATION
2855 FileRenameInformation FILE_RENAME_INFORMATION
2856 FileLinkInformation
2857 FileNamesInformation FILE_NAMES_INFORMATION
2858 FileDispositionInformation FILE_DISPOSITION_INFORMATION
2859 FilePositionInformation FILE_POSITION_INFORMATION
2860 FileFullEaInformation FILE_FULL_EA_INFORMATION
2861 FileModeInformation FILE_MODE_INFORMATION
2862 FileAlignmentInformation FILE_ALIGNMENT_INFORMATION
2863 FileAllInformation FILE_ALL_INFORMATION
2864
2865 FileEndOfFileInformation FILE_END_OF_FILE_INFORMATION
2866 FileAlternateNameInformation
2867 FileStreamInformation FILE_STREAM_INFORMATION
2868 FilePipeInformation
2869 FilePipeLocalInformation
2870 FilePipeRemoteInformation
2871 FileMailslotQueryInformation
2872 FileMailslotSetInformation
2873 FileCompressionInformation FILE_COMPRESSION_INFORMATION
2874 FileCopyOnWriteInformation
2875 FileCompletionInformation IO_COMPLETION_CONTEXT
2876 FileMoveClusterInformation
2877 FileOleClassIdInformation
2878 FileOleStateBitsInformation
2879 FileNetworkOpenInformation FILE_NETWORK_OPEN_INFORMATION
2880 FileObjectIdInformation
2881 FileOleAllInformation
2882 FileOleDirectoryInformation
2883 FileContentIndexInformation
2884 FileInheritContentIndexInformation
2885 FileOleInformation
2886 FileMaximumInformation
2887
2888 * REMARK:
2889 * This procedure maps to the win32 GetShortPathName, GetLongPathName,
2890 GetFullPathName, GetFileType, GetFileSize, GetFileTime functions.
2891 * RETURNS: Status
2892 */
2893 NTSTATUS
2894 STDCALL
2895 NtQueryInformationFile(
2896 IN HANDLE FileHandle,
2897 OUT PIO_STATUS_BLOCK IoStatusBlock,
2898 OUT PVOID FileInformation,
2899 IN ULONG Length,
2900 IN FILE_INFORMATION_CLASS FileInformationClass
2901 );
2902
2903 NTSTATUS
2904 STDCALL
2905 ZwQueryInformationFile(
2906 HANDLE FileHandle,
2907 PIO_STATUS_BLOCK IoStatusBlock,
2908 PVOID FileInformation,
2909 ULONG Length,
2910 FILE_INFORMATION_CLASS FileInformationClass
2911 );
2912
2913 /*
2914 * FUNCTION: Queries the information of a process object.
2915 * ARGUMENTS:
2916 * ProcessHandle = Handle to the process object
2917 * ProcessInformation = Index to a certain information structure
2918
2919 ProcessBasicInformation PROCESS_BASIC_INFORMATION
2920 ProcessQuotaLimits QUOTA_LIMITS
2921 ProcessIoCounters IO_COUNTERS
2922 ProcessVmCounters VM_COUNTERS
2923 ProcessTimes KERNEL_USER_TIMES
2924 ProcessBasePriority KPRIORITY
2925 ProcessRaisePriority KPRIORITY
2926 ProcessDebugPort HANDLE
2927 ProcessExceptionPort HANDLE
2928 ProcessAccessToken PROCESS_ACCESS_TOKEN
2929 ProcessLdtInformation LDT_ENTRY ??
2930 ProcessLdtSize ULONG
2931 ProcessDefaultHardErrorMode ULONG
2932 ProcessIoPortHandlers // kernel mode only
2933 ProcessPooledUsageAndLimits POOLED_USAGE_AND_LIMITS
2934 ProcessWorkingSetWatch PROCESS_WS_WATCH_INFORMATION
2935 ProcessUserModeIOPL (I/O Privilege Level)
2936 ProcessEnableAlignmentFaultFixup BOOLEAN
2937 ProcessPriorityClass ULONG
2938 ProcessWx86Information ULONG
2939 ProcessHandleCount ULONG
2940 ProcessAffinityMask ULONG
2941 ProcessPooledQuotaLimits QUOTA_LIMITS
2942 MaxProcessInfoClass
2943
2944 * ProcessInformation = Caller supplies storage for the process information structure
2945 * ProcessInformationLength = Size of the process information structure
2946 * ReturnLength = Actual number of bytes written
2947
2948 * REMARK:
2949 * This procedure maps to the win32 GetProcessTimes, GetProcessVersion,
2950 GetProcessWorkingSetSize, GetProcessPriorityBoost, GetProcessAffinityMask, GetPriorityClass,
2951 GetProcessShutdownParameters functions.
2952 * RETURNS: Status
2953 */
2954
2955 NTSTATUS
2956 STDCALL
2957 NtQueryInformationProcess(
2958 IN HANDLE ProcessHandle,
2959 IN CINT ProcessInformationClass,
2960 OUT PVOID ProcessInformation,
2961 IN ULONG ProcessInformationLength,
2962 OUT PULONG ReturnLength
2963 );
2964
2965 NTSTATUS
2966 STDCALL
2967 ZwQueryInformationProcess(
2968 IN HANDLE ProcessHandle,
2969 IN CINT ProcessInformationClass,
2970 OUT PVOID ProcessInformation,
2971 IN ULONG ProcessInformationLength,
2972 OUT PULONG ReturnLength
2973 );
2974
2975
2976 /*
2977 * FUNCTION: Queries the information of a thread object.
2978 * ARGUMENTS:
2979 * ThreadHandle = Handle to the thread object
2980 * ThreadInformationClass = Index to a certain information structure
2981
2982 ThreadBasicInformation THREAD_BASIC_INFORMATION
2983 ThreadTimes KERNEL_USER_TIMES
2984 ThreadPriority KPRIORITY
2985 ThreadBasePriority KPRIORITY
2986 ThreadAffinityMask KAFFINITY
2987 ThreadImpersonationToken
2988 ThreadDescriptorTableEntry
2989 ThreadEnableAlignmentFaultFixup
2990 ThreadEventPair
2991 ThreadQuerySetWin32StartAddress
2992 ThreadZeroTlsCell
2993 ThreadPerformanceCount
2994 ThreadAmILastThread BOOLEAN
2995 ThreadIdealProcessor ULONG
2996 ThreadPriorityBoost ULONG
2997 MaxThreadInfoClass
2998
2999
3000 * ThreadInformation = Caller supplies torage for the thread information
3001 * ThreadInformationLength = Size of the thread information structure
3002 * ReturnLength = Actual number of bytes written
3003
3004 * REMARK:
3005 * This procedure maps to the win32 GetThreadTimes, GetThreadPriority,
3006 GetThreadPriorityBoost functions.
3007 * RETURNS: Status
3008 */
3009
3010
3011 NTSTATUS
3012 STDCALL
3013 NtQueryInformationThread(
3014 IN HANDLE ThreadHandle,
3015 IN THREADINFOCLASS ThreadInformationClass,
3016 OUT PVOID ThreadInformation,
3017 IN ULONG ThreadInformationLength,
3018 OUT PULONG ReturnLength
3019 );
3020
3021
3022 NTSTATUS
3023 STDCALL
3024 NtQueryInformationToken(
3025 IN HANDLE TokenHandle,
3026 IN TOKEN_INFORMATION_CLASS TokenInformationClass,
3027 OUT PVOID TokenInformation,
3028 IN ULONG TokenInformationLength,
3029 OUT PULONG ReturnLength
3030 );
3031
3032 NTSTATUS
3033 STDCALL
3034 ZwQueryInformationToken(
3035 IN HANDLE TokenHandle,
3036 IN TOKEN_INFORMATION_CLASS TokenInformationClass,
3037 OUT PVOID TokenInformation,
3038 IN ULONG TokenInformationLength,
3039 OUT PULONG ReturnLength
3040 );
3041
3042 /*
3043 * FUNCTION: Query the interval and the clocksource for profiling
3044 * ARGUMENTS:
3045 Interval =
3046 ClockSource =
3047 * RETURNS: Status
3048 */
3049 NTSTATUS
3050 STDCALL
3051 NtQueryIntervalProfile(
3052 OUT PULONG Interval,
3053 OUT PULONG ClockSource
3054 );
3055
3056 NTSTATUS
3057 STDCALL
3058 ZwQueryIntervalProfile(
3059 OUT PULONG Interval,
3060 OUT PULONG ClockSource
3061 );
3062
3063
3064
3065 NTSTATUS
3066 STDCALL
3067 NtQueryIoCompletion(
3068 IN HANDLE CompletionPort,
3069 IN ULONG CompletionKey,
3070 OUT PIO_STATUS_BLOCK IoStatusBlock,
3071 OUT PULONG NumberOfBytesTransferred
3072 );
3073 NTSTATUS
3074 STDCALL
3075 ZwQueryIoCompletion(
3076 IN HANDLE CompletionPort,
3077 IN ULONG CompletionKey,
3078 OUT PIO_STATUS_BLOCK IoStatusBlock,
3079 OUT PULONG NumberOfBytesTransferred
3080 );
3081
3082
3083 /*
3084 * FUNCTION: Queries the information of a registry key object.
3085 * ARGUMENTS:
3086 KeyHandle = Handle to a registry key
3087 KeyInformationClass = Index to a certain information structure
3088 KeyInformation = Caller supplies storage for resulting information
3089 Length = Size of the supplied storage
3090 ResultLength = Bytes written
3091 */
3092 NTSTATUS
3093 STDCALL
3094 NtQueryKey(
3095 IN HANDLE KeyHandle,
3096 IN KEY_INFORMATION_CLASS KeyInformationClass,
3097 OUT PVOID KeyInformation,
3098 IN ULONG Length,
3099 OUT PULONG ResultLength
3100 );
3101
3102 NTSTATUS
3103 STDCALL
3104 ZwQueryKey(
3105 IN HANDLE KeyHandle,
3106 IN KEY_INFORMATION_CLASS KeyInformationClass,
3107 OUT PVOID KeyInformation,
3108 IN ULONG Length,
3109 OUT PULONG ResultLength
3110 );
3111
3112
3113 // draft
3114
3115 NTSTATUS
3116 STDCALL
3117 NtQueryMultipleValueKey(
3118 HANDLE KeyHandle,
3119 PVALENT ListOfValuesToQuery,
3120 ULONG NumberOfItems,
3121 PVOID MultipleValueInformation,
3122 ULONG Length,
3123 PULONG ReturnLength
3124 );
3125
3126 NTSTATUS
3127 STDCALL
3128 ZwQueryMultipleValueKey(
3129 HANDLE KeyHandle,
3130 PVALENT ListOfValuesToQuery,
3131 ULONG NumberOfItems,
3132 PVOID MultipleValueInformation,
3133 ULONG Length,
3134 PULONG ReturnLength
3135 );
3136
3137 /*
3138 * FUNCTION: Queries the information of a mutant object.
3139 * ARGUMENTS:
3140 MutantHandle = Handle to a mutant
3141 MutantInformationClass = Index to a certain information structure
3142 MutantInformation = Caller supplies storage for resulting information
3143 Length = Size of the supplied storage
3144 ResultLength = Bytes written
3145 */
3146 NTSTATUS
3147 STDCALL
3148 NtQueryMutant(
3149 IN HANDLE MutantHandle,
3150 IN CINT MutantInformationClass,
3151 OUT PVOID MutantInformation,
3152 IN ULONG Length,
3153 OUT PULONG ResultLength
3154 );
3155
3156 NTSTATUS
3157 STDCALL
3158 ZwQueryMutant(
3159 IN HANDLE MutantHandle,
3160 IN CINT MutantInformationClass,
3161 OUT PVOID MutantInformation,
3162 IN ULONG Length,
3163 OUT PULONG ResultLength
3164 );
3165 /*
3166 * FUNCTION: Queries the information of a object.
3167 * ARGUMENTS:
3168 ObjectHandle = Handle to a object
3169 ObjectInformationClass = Index to a certain information structure
3170
3171 ObjectBasicInformation
3172 ObjectTypeInformation OBJECT_TYPE_INFORMATION
3173 ObjectNameInformation OBJECT_NAME_INFORMATION
3174 ObjectDataInformation OBJECT_DATA_INFORMATION
3175
3176 ObjectInformation = Caller supplies storage for resulting information
3177 Length = Size of the supplied storage
3178 ResultLength = Bytes written
3179 */
3180
3181 NTSTATUS
3182 STDCALL
3183 NtQueryObject(
3184 IN HANDLE ObjectHandle,
3185 IN CINT ObjectInformationClass,
3186 OUT PVOID ObjectInformation,
3187 IN ULONG Length,
3188 OUT PULONG ResultLength
3189 );
3190
3191 NTSTATUS
3192 STDCALL
3193 ZwQueryObject(
3194 IN HANDLE ObjectHandle,
3195 IN CINT ObjectInformationClass,
3196 OUT PVOID ObjectInformation,
3197 IN ULONG Length,
3198 OUT PULONG ResultLength
3199 );
3200
3201 /*
3202 * FUNCTION: Queries the system ( high-resolution ) performance counter.
3203 * ARGUMENTS:
3204 * Counter = Performance counter
3205 * Frequency = Performance frequency
3206 * REMARKS:
3207 This procedure queries a tick count faster than 10ms ( The resolution for IntelĀ®-based CPUs is about 0.8 microseconds.)
3208 This procedure maps to the win32 QueryPerformanceCounter, QueryPerformanceFrequency
3209 * RETURNS: Status
3210 *
3211 */
3212 NTSTATUS
3213 STDCALL
3214 NtQueryPerformanceCounter(
3215 IN PLARGE_INTEGER Counter,
3216 IN PLARGE_INTEGER Frequency
3217 );
3218
3219 NTSTATUS
3220 STDCALL
3221 ZwQueryPerformanceCounter(
3222 IN PLARGE_INTEGER Counter,
3223 IN PLARGE_INTEGER Frequency
3224 );
3225 /*
3226 * FUNCTION: Queries the information of a section object.
3227 * ARGUMENTS:
3228 * SectionHandle = Handle to the section link object
3229 * SectionInformationClass = Index to a certain information structure
3230 * SectionInformation (OUT)= Caller supplies storage for resulting information
3231 * Length = Size of the supplied storage
3232 * ResultLength = Data written
3233 * RETURNS: Status
3234 *
3235 */
3236 NTSTATUS
3237 STDCALL
3238 NtQuerySection(
3239 IN HANDLE SectionHandle,
3240 IN CINT SectionInformationClass,
3241 OUT PVOID SectionInformation,
3242 IN ULONG Length,
3243 OUT PULONG ResultLength
3244 );
3245
3246 NTSTATUS
3247 STDCALL
3248 ZwQuerySection(
3249 IN HANDLE SectionHandle,
3250 IN CINT SectionInformationClass,
3251 OUT PVOID SectionInformation,
3252 IN ULONG Length,
3253 OUT PULONG ResultLength
3254 );
3255
3256 NTSTATUS
3257 STDCALL
3258 NtQuerySecurityObject(
3259 IN HANDLE Object,
3260 IN CINT SecurityObjectInformationClass,
3261 OUT PVOID SecurityObjectInformation,
3262 IN ULONG Length,
3263 OUT PULONG ReturnLength
3264 );
3265
3266 NTSTATUS
3267 STDCALL
3268 ZwQuerySecurityObject(
3269 IN HANDLE Object,
3270 IN CINT SecurityObjectInformationClass,
3271 OUT PVOID SecurityObjectInformation,
3272 IN ULONG Length,
3273 OUT PULONG ReturnLength
3274 );
3275
3276
3277 /*
3278 * FUNCTION: Queries the information of a semaphore.
3279 * ARGUMENTS:
3280 * SemaphoreHandle = Handle to the semaphore object
3281 * SemaphoreInformationClass = Index to a certain information structure
3282
3283 SemaphoreBasicInformation SEMAPHORE_BASIC_INFORMATION
3284
3285 * SemaphoreInformation = Caller supplies storage for the semaphore information structure
3286 * Length = Size of the infomation structure
3287 */
3288
3289 NTSTATUS
3290 STDCALL
3291 NtQuerySemaphore(
3292 HANDLE SemaphoreHandle,
3293 CINT SemaphoreInformationClass,
3294 OUT PVOID SemaphoreInformation,
3295 ULONG Length,
3296 PULONG ReturnLength
3297 );
3298
3299 NTSTATUS
3300 STDCALL
3301 ZwQuerySemaphore(
3302 HANDLE SemaphoreHandle,
3303 CINT SemaphoreInformationClass,
3304 OUT PVOID SemaphoreInformation,
3305 ULONG Length,
3306 PULONG ReturnLength
3307 );
3308
3309 /*
3310 * FUNCTION: Queries the information of a symbolic link object.
3311 * ARGUMENTS:
3312 * SymbolicLinkHandle = Handle to the symbolic link object
3313 * LinkTarget = resolved name of link
3314 * DataWritten = size of the LinkName.
3315 * RETURNS: Status
3316 *
3317 */
3318 NTSTATUS
3319 STDCALL
3320 NtQuerySymbolicLinkObject(
3321 IN HANDLE SymLinkObjHandle,
3322 OUT PUNICODE_STRING LinkTarget,
3323 OUT PULONG DataWritten OPTIONAL
3324 );
3325
3326 NTSTATUS
3327 STDCALL
3328 ZwQuerySymbolicLinkObject(
3329 IN HANDLE SymLinkObjHandle,
3330 OUT PUNICODE_STRING LinkName,
3331 OUT PULONG DataWritten OPTIONAL
3332 );
3333
3334
3335 /*
3336 * FUNCTION: Queries a system environment variable.
3337 * ARGUMENTS:
3338 * Name = Name of the variable
3339 * Value (OUT) = value of the variable
3340 * Length = size of the buffer
3341 * ReturnLength = data written
3342 * RETURNS: Status
3343 *
3344 */
3345 NTSTATUS
3346 STDCALL
3347 NtQuerySystemEnvironmentValue(
3348 IN PUNICODE_STRING Name,
3349 OUT PVOID Value,
3350 ULONG Length,
3351 PULONG ReturnLength
3352 );
3353
3354 NTSTATUS
3355 STDCALL
3356 ZwQuerySystemEnvironmentValue(
3357 IN PUNICODE_STRING Name,
3358 OUT PVOID Value,
3359 ULONG Length,
3360 PULONG ReturnLength
3361 );
3362
3363
3364 /*
3365 * FUNCTION: Queries the system information.
3366 * ARGUMENTS:
3367 * SystemInformationClass = Index to a certain information structure
3368
3369 SystemTimeAdjustmentInformation SYSTEM_TIME_ADJUSTMENT
3370 SystemCacheInformation SYSTEM_CACHE_INFORMATION
3371 SystemConfigurationInformation CONFIGURATION_INFORMATION
3372
3373 * SystemInformation = caller supplies storage for the information structure
3374 * Length = size of the structure
3375 ResultLength = Data written
3376 * RETURNS: Status
3377 *
3378 */
3379 NTSTATUS
3380 STDCALL
3381 NtQuerySystemInformation(
3382 IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
3383 OUT PVOID SystemInformation,
3384 IN ULONG Length,
3385 OUT PULONG ResultLength
3386 );
3387
3388 NTSTATUS
3389 STDCALL
3390 ZwQuerySystemInformation(
3391 IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
3392 OUT PVOID SystemInformation,
3393 IN ULONG Length,
3394 OUT PULONG ResultLength
3395 );
3396
3397 /*
3398 * FUNCTION: Retrieves the system time
3399 * ARGUMENTS:
3400 * CurrentTime (OUT) = Caller should supply storage for the resulting time.
3401 * RETURNS: Status
3402 *
3403 */
3404
3405 NTSTATUS
3406 STDCALL
3407 NtQuerySystemTime (
3408 OUT TIME *CurrentTime
3409 );
3410
3411 NTSTATUS
3412 STDCALL
3413 ZwQuerySystemTime (
3414 OUT TIME *CurrentTime
3415 );
3416
3417 /*
3418 * FUNCTION: Queries information about a timer
3419 * ARGUMENTS:
3420 * TimerHandle = Handle to the timer
3421 TimerValueInformationClass = Index to a certain information structure
3422 TimerValueInformation = Caller supplies storage for the information structure
3423 Length = Size of the information structure
3424 ResultLength = Data written
3425 * RETURNS: Status
3426 *
3427 */
3428 NTSTATUS
3429 STDCALL
3430 NtQueryTimer(
3431 IN HANDLE TimerHandle,
3432 IN CINT TimerInformationClass,
3433 OUT PVOID TimerInformation,
3434 IN ULONG Length,
3435 OUT PULONG ResultLength
3436 );
3437 NTSTATUS
3438 STDCALL
3439 ZwQueryTimer(
3440 IN HANDLE TimerHandle,
3441 IN CINT TimerInformationClass,
3442 OUT PVOID TimerInformation,
3443 IN ULONG Length,
3444 OUT PULONG ResultLength
3445 );
3446
3447 /*
3448 * FUNCTION: Queries the timer resolution
3449 * ARGUMENTS:
3450 * MinimumResolution (OUT) = Caller should supply storage for the resulting time.
3451 Maximum Resolution (OUT) = Caller should supply storage for the resulting time.
3452 ActualResolution (OUT) = Caller should supply storage for the resulting time.
3453 * RETURNS: Status
3454 *
3455 */
3456
3457
3458 NTSTATUS
3459 STDCALL
3460 NtQueryTimerResolution (
3461 OUT PULONG MinimumResolution,
3462 OUT PULONG MaximumResolution,
3463 OUT PULONG ActualResolution
3464 );
3465
3466 NTSTATUS
3467 STDCALL
3468 ZwQueryTimerResolution (
3469 OUT PULONG MinimumResolution,
3470 OUT PULONG MaximumResolution,
3471 OUT PULONG ActualResolution
3472 );
3473
3474 /*
3475 * FUNCTION: Queries a registry key value
3476 * ARGUMENTS:
3477 * KeyHandle = Handle to the registry key
3478 ValueName = Name of the value in the registry key
3479 KeyValueInformationClass = Index to a certain information structure
3480
3481 KeyValueBasicInformation = KEY_VALUE_BASIC_INFORMATION
3482 KeyValueFullInformation = KEY_FULL_INFORMATION
3483 KeyValuePartialInformation = KEY_VALUE_PARTIAL_INFORMATION
3484
3485 KeyValueInformation = Caller supplies storage for the information structure
3486 Length = Size of the information structure
3487 ResultLength = Data written
3488 * RETURNS: Status
3489 *
3490 */
3491 NTSTATUS
3492 STDCALL
3493 NtQueryValueKey(
3494 IN HANDLE KeyHandle,
3495 IN PUNICODE_STRING ValueName,
3496 IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
3497 OUT PVOID KeyValueInformation,
3498 IN ULONG Length,
3499 OUT PULONG ResultLength
3500 );
3501
3502 NTSTATUS
3503 STDCALL
3504 ZwQueryValueKey(
3505 IN HANDLE KeyHandle,
3506 IN PUNICODE_STRING ValueName,
3507 IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
3508 OUT PVOID KeyValueInformation,
3509 IN ULONG Length,
3510 OUT PULONG ResultLength
3511 );
3512
3513
3514
3515
3516 /*
3517 * FUNCTION: Queries the virtual memory information.
3518 * ARGUMENTS:
3519 ProcessHandle = Process owning the virtual address space
3520 BaseAddress = Points to the page where the information is queried for.
3521 * VirtualMemoryInformationClass = Index to a certain information structure
3522
3523 MemoryBasicInformation MEMORY_BASIC_INFORMATION
3524
3525 * VirtualMemoryInformation = caller supplies storage for the information structure
3526 * Length = size of the structure
3527 ResultLength = Data written
3528 * RETURNS: Status
3529 *
3530 */
3531
3532 NTSTATUS
3533 STDCALL
3534 NtQueryVirtualMemory(
3535 IN HANDLE ProcessHandle,
3536 IN PVOID Address,
3537 IN IN CINT VirtualMemoryInformationClass,
3538 OUT PVOID VirtualMemoryInformation,
3539 IN ULONG Length,
3540 OUT PULONG ResultLength
3541 );
3542 NTSTATUS
3543 STDCALL
3544 ZwQueryVirtualMemory(
3545 IN HANDLE ProcessHandle,
3546 IN PVOID Address,
3547 IN IN CINT VirtualMemoryInformationClass,
3548 OUT PVOID VirtualMemoryInformation,
3549 IN ULONG Length,
3550 OUT PULONG ResultLength
3551 );
3552
3553 /*
3554 * FUNCTION: Queries the volume information
3555 * ARGUMENTS:
3556 * FileHandle = Handle to a file object on the target volume
3557 ReturnLength = DataWritten
3558 FsInformation = Caller should supply storage for the information structure.
3559 Length = Size of the information structure
3560 FsInformationClass = Index to a information structure
3561
3562 FileFsVolumeInformation FILE_FS_VOLUME_INFORMATION
3563 FileFsLabelInformation FILE_FS_LABEL_INFORMATION
3564 FileFsSizeInformation FILE_FS_SIZE_INFORMATION
3565 FileFsDeviceInformation FILE_FS_DEVICE_INFORMATION
3566 FileFsAttributeInformation FILE_FS_ATTRIBUTE_INFORMATION
3567 FileFsControlInformation
3568 FileFsQuotaQueryInformation --
3569 FileFsQuotaSetInformation --
3570 FileFsMaximumInformation
3571
3572 * RETURNS: Status [ STATUS_SUCCESS | STATUS_INSUFFICIENT_RESOURCES | STATUS_INVALID_PARAMETER |
3573 STATUS_INVALID_DEVICE_REQUEST | STATUS_BUFFER_OVERFLOW ]
3574 *
3575 */
3576 NTSTATUS
3577 STDCALL
3578 NtQueryVolumeInformationFile(
3579 IN HANDLE FileHandle,
3580 OUT PIO_STATUS_BLOCK IoStatusBlock,
3581 OUT PVOID FsInformation,
3582 IN ULONG Length,
3583 IN FS_INFORMATION_CLASS FsInformationClass
3584 );
3585
3586 NTSTATUS
3587 STDCALL
3588 ZwQueryVolumeInformationFile(
3589 IN HANDLE FileHandle,
3590 OUT PIO_STATUS_BLOCK IoStatusBlock,
3591 OUT PVOID FsInformation,
3592 IN ULONG Length,
3593 IN FS_INFORMATION_CLASS FsInformationClass
3594 );
3595 // draft
3596 // FIXME: Should I specify if the apc is user or kernel mode somewhere ??
3597 /*
3598 * FUNCTION: Queues a (user) apc to a thread.
3599 * ARGUMENTS:
3600 ThreadHandle = Thread to which the apc is queued.
3601 ApcRoutine = Points to the apc routine
3602 NormalContext = Argument to Apc Routine
3603 * SystemArgument1 = Argument of the Apc Routine
3604 SystemArgument2 = Argument of the Apc Routine
3605 * REMARK: If the apc is queued against a thread of a different process than the calling thread
3606 the apc routine should be specified in the address space of the queued thread's process.
3607 * RETURNS: Status
3608 */
3609
3610 NTSTATUS
3611 STDCALL
3612 NtQueueApcThread(
3613 HANDLE ThreadHandle,
3614 PKNORMAL_ROUTINE ApcRoutine,
3615 PVOID NormalContext,
3616 PVOID SystemArgument1,
3617 PVOID SystemArgument2);
3618
3619 NTSTATUS
3620 STDCALL
3621 ZwQueueApcThread(
3622 HANDLE ThreadHandle,
3623 PKNORMAL_ROUTINE ApcRoutine,
3624 PVOID NormalContext,
3625 PVOID SystemArgument1,
3626 PVOID SystemArgument2);
3627
3628
3629 /*
3630 * FUNCTION: Raises an exception
3631 * ARGUMENTS:
3632 ExceptionRecord = Structure specifying the exception
3633 Context = Context in which the excpetion is raised
3634 * IsDebugger =
3635 * RETURNS: Status
3636 *
3637 */
3638
3639 NTSTATUS
3640 STDCALL
3641 NtRaiseException(
3642 IN PEXCEPTION_RECORD ExceptionRecord,
3643 IN PCONTEXT Context,
3644 IN BOOL IsDebugger OPTIONAL
3645 );
3646
3647 NTSTATUS
3648 STDCALL
3649 ZwRaiseException(
3650 IN PEXCEPTION_RECORD ExceptionRecord,
3651 IN PCONTEXT Context,
3652 IN BOOL IsDebugger OPTIONAL
3653 );
3654
3655 //NtRaiseHardError
3656 /*
3657 * FUNCTION: Read a file
3658 * ARGUMENTS:
3659 FileHandle = Handle of a file to read
3660 Event = This event is signalled when the read operation completes
3661 * UserApcRoutine = Call back , if supplied Event should be NULL
3662 UserApcContext = Argument to the callback
3663 IoStatusBlock = Caller should supply storage for additional status information
3664 Buffer = Caller should supply storage to receive the information
3665 BufferLength = Size of the buffer
3666 ByteOffset = Offset to start reading the file
3667 Key = If a range is lock a matching key will allow the read to continue.
3668 * RETURNS: Status
3669 *
3670 */
3671
3672
3673 NTSTATUS
3674 STDCALL
3675 NtReadFile(
3676 IN HANDLE FileHandle,
3677 IN HANDLE Event OPTIONAL,
3678 IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,
3679 IN PVOID UserApcContext OPTIONAL,
3680 OUT PIO_STATUS_BLOCK IoStatusBlock,
3681 OUT PVOID Buffer,
3682 IN ULONG BufferLength,
3683 IN PLARGE_INTEGER ByteOffset OPTIONAL,
3684 IN PULONG Key OPTIONAL
3685 );
3686
3687 NTSTATUS
3688 STDCALL
3689 ZwReadFile(
3690 IN HANDLE FileHandle,
3691 IN HANDLE Event OPTIONAL,
3692 IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,
3693 IN PVOID UserApcContext OPTIONAL,
3694 OUT PIO_STATUS_BLOCK IoStatusBlock,
3695 OUT PVOID Buffer,
3696 IN ULONG BufferLength,
3697 IN PLARGE_INTEGER ByteOffset OPTIONAL,
3698 IN PULONG Key OPTIONAL
3699 );
3700 /*
3701 * FUNCTION: Read a file using scattered io
3702 * ARGUMENTS:
3703 FileHandle = Handle of a file to read
3704 Event = This event is signalled when the read operation completes
3705 * UserApcRoutine = Call back , if supplied Event should be NULL
3706 UserApcContext = Argument to the callback
3707 IoStatusBlock = Caller should supply storage for additional status information
3708 BufferDescription = Caller should supply storage to receive the information
3709 BufferLength = Size of the buffer
3710 ByteOffset = Offset to start reading the file
3711 Key = Key = If a range is lock a matching key will allow the read to continue.
3712 * RETURNS: Status
3713 *
3714 */
3715 NTSTATUS
3716 STDCALL
3717 NtReadFileScatter(
3718 IN HANDLE FileHandle,
3719 IN HANDLE Event OPTIONAL,
3720 IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,
3721 IN PVOID UserApcContext OPTIONAL,
3722 OUT PIO_STATUS_BLOCK UserIoStatusBlock,
3723 IN FILE_SEGMENT_ELEMENT BufferDescription[],
3724 IN ULONG BufferLength,
3725 IN PLARGE_INTEGER ByteOffset,
3726 IN PULONG Key OPTIONAL
3727 );
3728
3729 NTSTATUS
3730 STDCALL
3731 ZwReadFileScatter(
3732 IN HANDLE FileHandle,
3733 IN HANDLE Event OPTIONAL,
3734 IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,
3735 IN PVOID UserApcContext OPTIONAL,
3736 OUT PIO_STATUS_BLOCK UserIoStatusBlock,
3737 IN FILE_SEGMENT_ELEMENT BufferDescription[],
3738 IN ULONG BufferLength,
3739 IN PLARGE_INTEGER ByteOffset,
3740 IN PULONG Key OPTIONAL
3741 );
3742 /*
3743 * FUNCTION: Copies a range of virtual memory to a buffer
3744 * ARGUMENTS:
3745 * ProcessHandle = Specifies the process owning the virtual address space
3746 * BaseAddress = Points to the address of virtual memory to start the read
3747 * Buffer = Caller supplies storage to copy the virtual memory to.
3748 * NumberOfBytesToRead = Limits the range to read
3749 * NumberOfBytesRead = The actual number of bytes read.
3750 * RETURNS: Status
3751 */
3752
3753 NTSTATUS
3754 STDCALL
3755 NtReadVirtualMemory(
3756 IN HANDLE ProcessHandle,
3757 IN PVOID BaseAddress,
3758 OUT PVOID Buffer,
3759 IN ULONG NumberOfBytesToRead,
3760 OUT PULONG NumberOfBytesRead
3761 );
3762 NTSTATUS
3763 STDCALL
3764 ZwReadVirtualMemory(
3765 IN HANDLE ProcessHandle,
3766 IN PVOID BaseAddress,
3767 OUT PVOID Buffer,
3768 IN ULONG NumberOfBytesToRead,
3769 OUT PULONG NumberOfBytesRead
3770 );
3771
3772
3773 /*
3774 * FUNCTION: Debugger can register for thread termination
3775 * ARGUMENTS:
3776 * TerminationPort = Port on which the debugger likes to be notified.
3777 * RETURNS: Status
3778 */
3779
3780 NTSTATUS
3781 STDCALL
3782 NtRegisterThreadTerminatePort(
3783 HANDLE TerminationPort
3784 );
3785 NTSTATUS
3786 STDCALL
3787 ZwRegisterThreadTerminatePort(
3788 HANDLE TerminationPort
3789 );
3790 /*
3791 * FUNCTION: Releases a mutant
3792 * ARGUMENTS:
3793 * MutantHandle = Handle to the mutant
3794 * ReleaseCount =
3795 * RETURNS: Status
3796 */
3797 NTSTATUS
3798 STDCALL
3799 NtReleaseMutant(
3800 IN HANDLE MutantHandle,
3801 IN PULONG ReleaseCount OPTIONAL
3802 );
3803
3804 NTSTATUS
3805 STDCALL
3806 ZwReleaseMutant(
3807 IN HANDLE MutantHandle,
3808 IN PULONG ReleaseCount OPTIONAL
3809 );
3810 /*
3811 * FUNCTION: Releases a semaphore
3812 * ARGUMENTS:
3813 * SemaphoreHandle = Handle to the semaphore object
3814 * ReleaseCount = Number to decrease the semaphore count
3815 * PreviousCount = Previous semaphore count
3816 * RETURNS: Status
3817 */
3818 NTSTATUS
3819 STDCALL
3820 NtReleaseSemaphore(
3821 IN HANDLE SemaphoreHandle,
3822 IN ULONG ReleaseCount,
3823 IN PULONG PreviousCount
3824 );
3825
3826 NTSTATUS
3827 STDCALL
3828 ZwReleaseSemaphore(
3829 IN HANDLE SemaphoreHandle,
3830 IN ULONG ReleaseCount,
3831 IN PULONG PreviousCount
3832 );
3833 /*
3834 * FUNCTION: Removes an io completion
3835 * ARGUMENTS:
3836 * CompletionPort (OUT) = Caller supplied storage for the resulting handle
3837 * CompletionKey = Requested access to the key
3838 * IoStatusBlock = Caller provides storage for extended status information
3839 * CompletionStatus = Current status of the io operation.
3840 * WaitTime = Time to wait if ..
3841 * RETURNS: Status
3842 */
3843 NTSTATUS
3844 STDCALL
3845 NtRemoveIoCompletion(
3846 IN HANDLE CompletionPort,
3847 OUT PULONG CompletionKey,
3848 OUT PIO_STATUS_BLOCK IoStatusBlock,
3849 OUT PULONG CompletionStatus,
3850 IN PLARGE_INTEGER WaitTime
3851 );
3852
3853 NTSTATUS
3854 STDCALL
3855 ZwRemoveIoCompletion(
3856 IN HANDLE CompletionPort,
3857 OUT PULONG CompletionKey,
3858 OUT PIO_STATUS_BLOCK IoStatusBlock,
3859 OUT PULONG CompletionStatus,
3860 IN PLARGE_INTEGER WaitTime
3861 );
3862 /*
3863 * FUNCTION: Replaces one registry key with another
3864 * ARGUMENTS:
3865 * ObjectAttributes = Specifies the attributes of the key
3866 * Key = Handle to the key
3867 * ReplacedObjectAttributes = The function returns the old object attributes
3868 * RETURNS: Status
3869 */
3870 NTSTATUS
3871 STDCALL
3872 NtReplaceKey(
3873 IN POBJECT_ATTRIBUTES ObjectAttributes,
3874 IN HANDLE Key,
3875 IN POBJECT_ATTRIBUTES ReplacedObjectAttributes
3876 );
3877 NTSTATUS
3878 STDCALL
3879 ZwReplaceKey(
3880 IN POBJECT_ATTRIBUTES ObjectAttributes,
3881 IN HANDLE Key,
3882 IN POBJECT_ATTRIBUTES ReplacedObjectAttributes
3883 );
3884
3885 /*
3886 * FUNCTION: Resets a event to a non signaled state
3887 * ARGUMENTS:
3888 * EventHandle = Handle to the event that should be reset
3889 * NumberOfWaitingThreads = The number of threads released.
3890 * RETURNS: Status
3891 */
3892 NTSTATUS
3893 STDCALL
3894 NtResetEvent(
3895 HANDLE EventHandle,
3896 PULONG NumberOfWaitingThreads OPTIONAL
3897 );
3898 NTSTATUS
3899 STDCALL
3900 ZwResetEvent(
3901 HANDLE EventHandle,
3902 PULONG NumberOfWaitingThreads OPTIONAL
3903 );
3904 //draft
3905 NTSTATUS
3906 STDCALL
3907 NtRestoreKey(
3908 HANDLE KeyHandle,
3909 HANDLE FileHandle,
3910 ULONG RestoreFlags
3911 );
3912
3913 NTSTATUS
3914 STDCALL
3915 ZwRestoreKey(
3916 HANDLE KeyHandle,
3917 HANDLE FileHandle,
3918 ULONG RestoreFlags
3919 );
3920 /*
3921 * FUNCTION: Decrements a thread's resume count
3922 * ARGUMENTS:
3923 * ThreadHandle = Handle to the thread that should be resumed
3924 * ResumeCount = The resulting resume count.
3925 * REMARK:
3926 * A thread is resumed if its suspend count is 0. This procedure maps to
3927 * the win32 ResumeThread function. ( documentation about the the suspend count can be found here aswell )
3928 * RETURNS: Status
3929 */
3930 NTSTATUS
3931 STDCALL
3932 NtResumeThread(
3933 IN HANDLE ThreadHandle,
3934 OUT PULONG SuspendCount
3935 );
3936 NTSTATUS
3937 STDCALL
3938 ZwResumeThread(
3939 IN HANDLE ThreadHandle,
3940 OUT PULONG SuspendCount
3941 );
3942 /*
3943 * FUNCTION: Writes the content of a registry key to ascii file
3944 * ARGUMENTS:
3945 * KeyHandle = Handle to the key
3946 * FileHandle = Handle of the file
3947 * REMARKS:
3948 This function maps to the Win32 RegSaveKey.
3949 * RETURNS: Status
3950 */
3951
3952 NTSTATUS
3953 STDCALL
3954 NtSaveKey(
3955 IN HANDLE KeyHandle,
3956 IN HANDLE FileHandle
3957 );
3958 NTSTATUS
3959 STDCALL
3960 ZwSaveKey(
3961 IN HANDLE KeyHandle,
3962 IN HANDLE FileHandle
3963 );
3964 /*
3965 * FUNCTION: Sets the context of a specified thread.
3966 * ARGUMENTS:
3967 * ThreadHandle = Handle to the thread
3968 * Context = The processor context.
3969 * RETURNS: Status
3970 */
3971
3972 NTSTATUS
3973 STDCALL
3974 NtSetContextThread(
3975 IN HANDLE ThreadHandle,
3976 IN PCONTEXT Context
3977 );