reactos/include/ntos/zw.h

   1
   2 /* $Id: zw.h,v 1.25 2004/06/13 10:35:51 navaraf Exp $
   3  *
   4  * COPYRIGHT:        See COPYING in the top level directory
   5  * PROJECT:          ReactOS kernel
   6  * PURPOSE:          System call definitions
   7  * FILE:             include/ddk/zw.h
   8  * REVISION HISTORY:
   9  *              ??/??/??: First few functions (David Welch)
  10  *              ??/??/??: Complete implementation by Ariadne
  11  *              13/07/98: Reorganised things a bit (David Welch)
  12  *              04/08/98: Added some documentation (Ariadne)
  13  *              14/08/98: Added type TIME and change variable type from [1] to [0]
  14  *              14/09/98: Added for each Nt call a corresponding Zw Call
  15  *              09/08/03: Added ThreadEventPair routines
  16  */
  17
  18 #ifndef __DDK_ZW_H
  19 #define __DDK_ZW_H
  20
  21 #include <ntos/security.h>
  22 #include <ntos/zwtypes.h>
  23 #include <napi/npipe.h>
  24
  25 #ifndef _RTLGETPROCESSHEAP_DEFINED_
  26 #define _RTLGETPROCESSHEAP_DEFINED_
  27 #define RtlGetProcessHeap() (NtCurrentPeb()->ProcessHeap)
  28 #endif
  29
  30 // semaphore information
  31
  32 typedef enum _SEMAPHORE_INFORMATION_CLASS
  33 {
  34         SemaphoreBasicInformation               = 0
  35 } SEMAPHORE_INFORMATION_CLASS;
  36
  37 typedef struct _SEMAPHORE_BASIC_INFORMATION
  38 {
  39         LONG CurrentCount;
  40         LONG MaximumCount;
  41 } SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;
  42
  43 // event information
  44
  45 typedef enum _EVENT_INFORMATION_CLASS
  46 {
  47         EventBasicInformation                   = 0
  48 } EVENT_INFORMATION_CLASS;
  49
  50 typedef struct _EVENT_BASIC_INFORMATION
  51 {
  52         EVENT_TYPE EventType;
  53         LONG EventState;
  54 } EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;
  55
  56 //#define LCID ULONG
  57 //#define SECURITY_INFORMATION ULONG
  58 //typedef ULONG SECURITY_INFORMATION;
  59
  60 #ifndef __USE_NT_LPC__
  61 NTSTATUS STDCALL
  62 NtAcceptConnectPort (PHANDLE PortHandle,
  63                      HANDLE NamedPortHandle,
  64                      PLPC_MESSAGE ServerReply,
  65                      BOOLEAN AcceptIt,
  66                      PLPC_SECTION_WRITE WriteMap,
  67                      PLPC_SECTION_READ ReadMap);
  68 #else
  69 NTSTATUS STDCALL
  70 NtAcceptConnectPort (PHANDLE PortHandle,
  71                      ULONG PortIdentifier,
  72                      PLPC_MESSAGE ServerReply,
  73                      BOOLEAN AcceptIt,
  74                      PLPC_SECTION_WRITE WriteMap,
  75                      PLPC_SECTION_READ ReadMap);
  76 #endif /* ndef __USE_NT_LPC__ */
  77
  78 /*
  79  * FUNCTION: Adjusts the groups in an access token
  80  * ARGUMENTS:
  81  *        TokenHandle = Specifies the access token
  82  *        ResetToDefault = If true the NewState parameter is ignored and the groups are set to
  83  *                      their default state, if false the groups specified in
  84  *                      NewState are set.
  85  *        NewState =
  86  *        BufferLength = Specifies the size of the buffer for the PreviousState.
  87  *        PreviousState =
  88  *        ReturnLength = Bytes written in PreviousState buffer.
  89  * REMARKS: The arguments map to the win32 AdjustTokenGroups
  90  * RETURNS: Status
  91  */
  92
  93 NTSTATUS
  94 STDCALL
  95 NtAdjustGroupsToken(
  96         IN HANDLE TokenHandle,
  97         IN BOOLEAN  ResetToDefault,
  98         IN PTOKEN_GROUPS  NewState,
  99         IN ULONG  BufferLength,
 100         OUT PTOKEN_GROUPS  PreviousState OPTIONAL,
 101         OUT PULONG  ReturnLength
 102         );
 103
 104 NTSTATUS
 105 STDCALL
 106 ZwAdjustGroupsToken(
 107         IN HANDLE TokenHandle,
 108         IN BOOLEAN  ResetToDefault,
 109         IN PTOKEN_GROUPS  NewState,
 110         IN ULONG  BufferLength,
 111         OUT PTOKEN_GROUPS  PreviousState,
 112         OUT PULONG  ReturnLength
 113         );
 114
 115
 116 /*
 117  * FUNCTION:
 118  *
 119  * ARGUMENTS:
 120  *        TokenHandle = Handle to the access token
 121  *        DisableAllPrivileges =  The resulting suspend count.
 122           NewState =
 123           BufferLength =
 124           PreviousState =
 125           ReturnLength =
 126  * REMARK:
 127  *        The arguments map to the win32 AdjustTokenPrivileges
 128  * RETURNS: Status
 129  */
 130
 131 NTSTATUS
 132 STDCALL
 133 NtAdjustPrivilegesToken(
 134         IN HANDLE  TokenHandle,
 135         IN BOOLEAN  DisableAllPrivileges,
 136         IN PTOKEN_PRIVILEGES  NewState,
 137         IN ULONG  BufferLength,
 138         OUT PTOKEN_PRIVILEGES  PreviousState,
 139         OUT PULONG ReturnLength
 140         );
 141
 142 NTSTATUS
 143 STDCALL
 144 ZwAdjustPrivilegesToken(
 145         IN HANDLE  TokenHandle,
 146         IN BOOLEAN  DisableAllPrivileges,
 147         IN PTOKEN_PRIVILEGES  NewState,
 148         IN ULONG  BufferLength,
 149         OUT PTOKEN_PRIVILEGES  PreviousState,
 150         OUT PULONG ReturnLength
 151         );
 152
 153
 154 /*
 155  * FUNCTION: Decrements a thread's suspend count and places it in an alerted
 156  *           state.
 157  * ARGUMENTS:
 158  *        ThreadHandle = Handle to the thread that should be resumed
 159  *        SuspendCount =  The resulting suspend count.
 160  * REMARK:
 161  *        A thread is resumed if its suspend count is 0
 162  * RETURNS: Status
 163  */
 164 NTSTATUS
 165 STDCALL
 166 NtAlertResumeThread(
 167         IN HANDLE ThreadHandle,
 168         OUT PULONG SuspendCount
 169         );
 170
 171 NTSTATUS
 172 STDCALL
 173 ZwAlertResumeThread(
 174         IN HANDLE ThreadHandle,
 175         OUT PULONG SuspendCount
 176         );
 177
 178 /*
 179  * FUNCTION: Puts the thread in a alerted state
 180  * ARGUMENTS:
 181  *        ThreadHandle = Handle to the thread that should be alerted
 182  * RETURNS: Status
 183  */
 184 NTSTATUS
 185 STDCALL
 186 NtAlertThread(
 187         IN HANDLE ThreadHandle
 188         );
 189
 190 NTSTATUS
 191 STDCALL
 192 ZwAlertThread(
 193         IN HANDLE ThreadHandle
 194         );
 195
 196
 197 /*
 198  * FUNCTION: Allocates a locally unique id
 199  * ARGUMENTS:
 200  *        LocallyUniqueId = Locally unique number
 201  * RETURNS: Status
 202  */
 203 NTSTATUS
 204 STDCALL
 205 NtAllocateLocallyUniqueId(
 206         OUT LUID *LocallyUniqueId
 207         );
 208
 209 NTSTATUS
 210 STDCALL
 211 ZwAllocateLocallyUniqueId(
 212         OUT PLUID Luid
 213         );
 214
 215 /*
 216  * FUNCTION: Allocates a block of virtual memory in the process address space
 217  * ARGUMENTS:
 218  *      ProcessHandle = The handle of the process which owns the virtual memory
 219  *      BaseAddress   = A pointer to the virtual memory allocated. If you supply a non zero
 220  *                      value the system will try to allocate the memory at the address supplied. It rounds
 221  *                      it down to a multiple if the page size.
 222  *      ZeroBits  = (OPTIONAL) You can specify the number of high order bits that must be zero, ensuring that
 223  *                      the memory will be allocated at a address below a certain value.
 224  *      RegionSize = The number of bytes to allocate
 225  *      AllocationType = Indicates the type of virtual memory you like to allocated,
 226  *                       can be one of the values : MEM_COMMIT, MEM_RESERVE, MEM_RESET, MEM_TOP_DOWN
 227  *      Protect = Indicates the protection type of the pages allocated, can be a combination of
 228  *                      PAGE_READONLY, PAGE_READWRITE, PAGE_EXECUTE_READ,
 229  *                      PAGE_EXECUTE_READWRITE, PAGE_GUARD, PAGE_NOACCESS, PAGE_NOACCESS
 230  * REMARKS:
 231  *       This function maps to the win32 VirtualAllocEx. Virtual memory is process based so the
 232  *       protocol starts with a ProcessHandle. I splitted the functionality of obtaining the actual address and specifying
 233  *       the start address in two parameters ( BaseAddress and StartAddress ) The NumberOfBytesAllocated specify the range
 234  *       and the AllocationType and ProctectionType map to the other two parameters.
 235  * RETURNS: Status
 236  */
 237 NTSTATUS
 238 STDCALL
 239 NtAllocateVirtualMemory (
 240         IN HANDLE ProcessHandle,
 241         IN OUT PVOID *BaseAddress,
 242         IN ULONG  ZeroBits,
 243         IN OUT PULONG  RegionSize,
 244         IN ULONG  AllocationType,
 245         IN ULONG  Protect
 246         );
 247
 248 NTSTATUS
 249 STDCALL
 250 ZwAllocateVirtualMemory (
 251         IN HANDLE ProcessHandle,
 252         IN OUT PVOID *BaseAddress,
 253         IN ULONG  ZeroBits,
 254         IN OUT PULONG  RegionSize,
 255         IN ULONG  AllocationType,
 256         IN ULONG  Protect);
 257
 258 /*
 259  * FUNCTION: Returns from a callback into user mode
 260  * ARGUMENTS:
 261  * RETURN Status
 262  */
 263 //FIXME: this function might need 3 parameters
 264 NTSTATUS STDCALL NtCallbackReturn(PVOID Result,
 265                                   ULONG ResultLength,
 266                                   NTSTATUS Status);
 267
 268 NTSTATUS STDCALL ZwCallbackReturn(PVOID Result,
 269                                   ULONG ResultLength,
 270                                   NTSTATUS Status);
 271
 272 /*
 273  * FUNCTION: Cancels a IO request
 274  * ARGUMENTS:
 275  *        FileHandle = Handle to the file
 276  *        IoStatusBlock  =
 277  *
 278  * REMARKS:
 279  *        This function maps to the win32 CancelIo.
 280  * RETURNS: Status
 281  */
 282 NTSTATUS
 283 STDCALL
 284 NtCancelIoFile(
 285         IN HANDLE FileHandle,
 286         OUT PIO_STATUS_BLOCK IoStatusBlock
 287         );
 288
 289 NTSTATUS
 290 STDCALL
 291 ZwCancelIoFile(
 292         IN HANDLE FileHandle,
 293         OUT PIO_STATUS_BLOCK IoStatusBlock
 294         );
 295
 296 /*
 297  * FUNCTION: Sets the status of the event back to non-signaled
 298  * ARGUMENTS:
 299  *        EventHandle = Handle to the event
 300  * REMARKS:
 301  *       This function maps to win32 function ResetEvent.
 302  * RETURcNS: Status
 303  */
 304
 305 NTSTATUS
 306 STDCALL
 307 NtClearEvent(
 308         IN HANDLE  EventHandle
 309         );
 310
 311 NTSTATUS
 312 STDCALL
 313 ZwClearEvent(
 314         IN HANDLE  EventHandle
 315         );
 316
 317 /*
 318  * FUNCTION: Closes an object handle
 319  * ARGUMENTS:
 320  *         Handle = Handle to the object
 321  * REMARKS:
 322  *       This function maps to the win32 function CloseHandle.
 323  * RETURNS: Status
 324  */
 325
 326 NTSTATUS
 327 STDCALL
 328 NtClose(
 329         IN HANDLE Handle
 330         );
 331
 332 NTSTATUS
 333 STDCALL
 334 ZwClose(
 335         IN HANDLE Handle
 336         );
 337
 338 /*
 339  * FUNCTION: Generates an audit message when a handle to an object is dereferenced
 340  * ARGUMENTS:
 341  *         SubsystemName   =
 342            HandleId        = Handle to the object
 343            GenerateOnClose =
 344  * REMARKS:
 345  *       This function maps to the win32 function ObjectCloseAuditAlarm.
 346  * RETURNS: Status
 347  */
 348
 349 NTSTATUS
 350 STDCALL
 351 NtCloseObjectAuditAlarm(
 352         IN PUNICODE_STRING SubsystemName,
 353         IN PVOID HandleId,
 354         IN BOOLEAN GenerateOnClose
 355         );
 356
 357 NTSTATUS
 358 STDCALL
 359 ZwCloseObjectAuditAlarm(
 360         IN PUNICODE_STRING SubsystemName,
 361         IN PVOID HandleId,
 362         IN BOOLEAN GenerateOnClose
 363         );
 364
 365
 366 NTSTATUS STDCALL
 367 NtCompleteConnectPort (HANDLE PortHandle);
 368
 369 NTSTATUS STDCALL
 370 ZwCompleteConnectPort (HANDLE PortHandle);
 371
 372
 373 NTSTATUS STDCALL
 374 NtConnectPort (PHANDLE PortHandle,
 375                PUNICODE_STRING PortName,
 376                PSECURITY_QUALITY_OF_SERVICE SecurityQos,
 377                PLPC_SECTION_WRITE SectionInfo,
 378                PLPC_SECTION_READ MapInfo,
 379                PULONG MaxMessageSize,
 380                PVOID ConnectInfo,
 381                PULONG ConnectInfoLength);
 382
 383 NTSTATUS STDCALL
 384 ZwConnectPort (PHANDLE PortHandle,
 385                PUNICODE_STRING PortName,
 386                PSECURITY_QUALITY_OF_SERVICE SecurityQos,
 387                PLPC_SECTION_WRITE SectionInfo,
 388                PLPC_SECTION_READ MapInfo,
 389                PULONG MaxMessageSize,
 390                PVOID ConnectInfo,
 391                PULONG ConnectInfoLength);
 392
 393 /*
 394  * FUNCTION: Creates a directory object
 395  * ARGUMENTS:
 396  *        DirectoryHandle (OUT) = Caller supplied storage for the resulting handle
 397  *        DesiredAccess = Specifies access to the directory
 398  *        ObjectAttribute = Initialized attributes for the object
 399  * REMARKS: This function maps to the win32 CreateDirectory. A directory is like a file so it needs a
 400  *          handle, a access mask and a OBJECT_ATTRIBUTES structure to map the path name and the SECURITY_ATTRIBUTES.
 401  * RETURNS: Status
 402  */
 403
 404 NTSTATUS
 405 STDCALL
 406 NtCreateDirectoryObject(
 407         OUT PHANDLE DirectoryHandle,
 408         IN ACCESS_MASK DesiredAccess,
 409         IN POBJECT_ATTRIBUTES ObjectAttributes
 410         );
 411
 412 NTSTATUS
 413 STDCALL
 414 ZwCreateDirectoryObject(
 415         OUT PHANDLE DirectoryHandle,
 416         IN ACCESS_MASK DesiredAccess,
 417         IN POBJECT_ATTRIBUTES ObjectAttributes
 418         );
 419
 420 /*
 421  * FUNCTION: Creates an event object
 422  * ARGUMENTS:
 423  *        EventHandle (OUT) = Caller supplied storage for the resulting handle
 424  *        DesiredAccess = Specifies access to the event
 425  *        ObjectAttribute = Initialized attributes for the object
 426  *        ManualReset = manual-reset or auto-reset if true you have to reset the state of the event manually
 427  *                       using NtResetEvent/NtClearEvent. if false the system will reset the event to a non-signalled state
 428  *                       automatically after the system has rescheduled a thread waiting on the event.
 429  *        InitialState = specifies the initial state of the event to be signaled ( TRUE ) or non-signalled (FALSE).
 430  * REMARKS: This function maps to the win32 CreateEvent. Demanding a out variable  of type HANDLE,
 431  *          a access mask and a OBJECT_ATTRIBUTES structure mapping to the SECURITY_ATTRIBUTES. ManualReset and InitialState are
 432  *          both parameters aswell ( possibly the order is reversed ).
 433  * RETURNS: Status
 434  */
 435
 436 NTSTATUS
 437 STDCALL
 438 NtCreateEvent(
 439         OUT PHANDLE EventHandle,
 440         IN ACCESS_MASK DesiredAccess,
 441         IN POBJECT_ATTRIBUTES ObjectAttributes,
 442         IN BOOLEAN ManualReset,
 443         IN BOOLEAN InitialState
 444         );
 445
 446 NTSTATUS
 447 STDCALL
 448 ZwCreateEvent(
 449         OUT PHANDLE EventHandle,
 450         IN ACCESS_MASK DesiredAccess,
 451         IN POBJECT_ATTRIBUTES ObjectAttributes,
 452         IN BOOLEAN ManualReset,
 453         IN BOOLEAN InitialState
 454         );
 455
 456 /*
 457  * FUNCTION: Creates an eventpair object
 458  * ARGUMENTS:
 459  *        EventPairHandle (OUT) = Caller supplied storage for the resulting handle
 460  *        DesiredAccess = Specifies access to the event
 461  *        ObjectAttribute = Initialized attributes for the object
 462  */
 463
 464 NTSTATUS
 465 STDCALL
 466 NtCreateEventPair(
 467         OUT PHANDLE EventPairHandle,
 468         IN ACCESS_MASK DesiredAccess,
 469         IN POBJECT_ATTRIBUTES ObjectAttributes
 470         );
 471
 472 NTSTATUS
 473 STDCALL
 474 ZwCreateEventPair(
 475         OUT PHANDLE EventPairHandle,
 476         IN ACCESS_MASK DesiredAccess,
 477         IN POBJECT_ATTRIBUTES ObjectAttributes
 478         );
 479
 480
 481 /*
 482  * FUNCTION: Creates or opens a file, directory or device object.
 483  * ARGUMENTS:
 484  *        FileHandle (OUT) = Caller supplied storage for the resulting handle
 485  *        DesiredAccess = Specifies the allowed or desired access to the file can
 486  *                        be a combination of DELETE | FILE_READ_DATA ..
 487  *        ObjectAttribute = Initialized attributes for the object, contains the rootdirectory and the filename
 488  *        IoStatusBlock (OUT) = Caller supplied storage for the resulting status information, indicating if the
 489  *                              the file is created and opened or allready existed and is just opened.
 490  *        FileAttributes = file attributes can be a combination of FILE_ATTRIBUTE_READONLY | FILE_ATTRIBUTE_HIDDEN ...
 491  *        ShareAccess = can be a combination of the following: FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE
 492  *        CreateDisposition = specifies what the behavior of the system if the file allready exists.
 493  *        CreateOptions = specifies the behavior of the system on file creation.
 494  *        EaBuffer (OPTIONAL) = Extended Attributes buffer, applies only to files and directories.
 495  *        EaLength = Extended Attributes buffer size,  applies only to files and directories.
 496  * REMARKS: This function maps to the win32 CreateFile.
 497  * RETURNS: Status
 498  */
 499
 500 NTSTATUS
 501 STDCALL
 502 NtCreateFile(
 503         OUT PHANDLE FileHandle,
 504         IN ACCESS_MASK DesiredAccess,
 505         IN POBJECT_ATTRIBUTES ObjectAttributes,
 506         OUT PIO_STATUS_BLOCK IoStatusBlock,
 507         IN PLARGE_INTEGER AllocationSize OPTIONAL,
 508         IN ULONG FileAttributes,
 509         IN ULONG ShareAccess,
 510         IN ULONG CreateDisposition,
 511         IN ULONG CreateOptions,
 512         IN PVOID EaBuffer OPTIONAL,
 513         IN ULONG EaLength
 514         );
 515
 516 NTSTATUS
 517 STDCALL
 518 ZwCreateFile(
 519         OUT PHANDLE FileHandle,
 520         IN ACCESS_MASK DesiredAccess,
 521         IN POBJECT_ATTRIBUTES ObjectAttributes,
 522         OUT PIO_STATUS_BLOCK IoStatusBlock,
 523         IN PLARGE_INTEGER AllocationSize OPTIONAL,
 524         IN ULONG FileAttributes,
 525         IN ULONG ShareAccess,
 526         IN ULONG CreateDisposition,
 527         IN ULONG CreateOptions,
 528         IN PVOID EaBuffer OPTIONAL,
 529         IN ULONG EaLength
 530         );
 531
 532 /*
 533  * FUNCTION: Creates or opens a file, directory or device object.
 534  * ARGUMENTS:
 535  *        CompletionPort (OUT) = Caller supplied storage for the resulting handle
 536  *        DesiredAccess = Specifies the allowed or desired access to the port
 537  *        IoStatusBlock =
 538  *        NumberOfConcurrentThreads =
 539  * REMARKS: This function maps to the win32 CreateIoCompletionPort
 540  * RETURNS:
 541  *      Status
 542  */
 543
 544 NTSTATUS
 545 STDCALL
 546 NtCreateIoCompletion(
 547    OUT PHANDLE             IoCompletionHandle,
 548    IN  ACCESS_MASK         DesiredAccess,
 549    IN  POBJECT_ATTRIBUTES  ObjectAttributes,
 550    IN  ULONG               NumberOfConcurrentThreads
 551    );
 552
 553 NTSTATUS
 554 STDCALL
 555 ZwCreateIoCompletion(
 556    OUT PHANDLE             IoCompletionHandle,
 557    IN  ACCESS_MASK         DesiredAccess,
 558    IN  POBJECT_ATTRIBUTES  ObjectAttributes,
 559    IN  ULONG               NumberOfConcurrentThreads
 560    );
 561
 562 /*
 563  * FUNCTION: Creates a registry key
 564  * ARGUMENTS:
 565  *        KeyHandle (OUT) = Caller supplied storage for the resulting handle
 566  *        DesiredAccess = Specifies the allowed or desired access to the key
 567  *          It can have a combination of the following values:
 568  *          KEY_READ | KEY_WRITE | KEY_EXECUTE | KEY_ALL_ACCESS
 569  *          or
 570  *          KEY_QUERY_VALUE The values of the key can be queried.
 571  *          KEY_SET_VALUE The values of the key can be modified.
 572  *          KEY_CREATE_SUB_KEYS The key may contain subkeys.
 573  *          KEY_ENUMERATE_SUB_KEYS Subkeys can be queried.
 574  *          KEY_NOTIFY
 575  *          KEY_CREATE_LINK A symbolic link to the key can be created.
 576  *        ObjectAttributes = The name of the key may be specified directly in the name field
 577  *          of object attributes or relative to a key in rootdirectory.
 578  *        TitleIndex = Might specify the position in the sequential order of subkeys.
 579  *        Class = Specifies the kind of data, for example REG_SZ for string data. [ ??? ]
 580  *        CreateOptions = Specifies additional options with which the key is created
 581  *          REG_OPTION_VOLATILE  The key is not preserved across boots.
 582  *          REG_OPTION_NON_VOLATILE  The key is preserved accross boots.
 583  *          REG_OPTION_CREATE_LINK  The key is a symbolic link to another key.
 584  *          REG_OPTION_BACKUP_RESTORE  Key is being opened or created for backup/restore operations.
 585  *        Disposition = Indicates if the call to NtCreateKey resulted in the creation of a key it
 586  *          can have the following values: REG_CREATED_NEW_KEY | REG_OPENED_EXISTING_KEY
 587  * RETURNS:
 588  *  Status
 589  */
 590
 591 NTSTATUS STDCALL
 592 NtCreateKey(OUT PHANDLE KeyHandle,
 593             IN ACCESS_MASK DesiredAccess,
 594             IN POBJECT_ATTRIBUTES ObjectAttributes,
 595             IN ULONG TitleIndex,
 596             IN PUNICODE_STRING Class OPTIONAL,
 597             IN ULONG CreateOptions,
 598             IN PULONG Disposition OPTIONAL);
 599
 600 NTSTATUS STDCALL
 601 ZwCreateKey(OUT PHANDLE KeyHandle,
 602             IN ACCESS_MASK DesiredAccess,
 603             IN POBJECT_ATTRIBUTES ObjectAttributes,
 604             IN ULONG TitleIndex,
 605             IN PUNICODE_STRING Class OPTIONAL,
 606             IN ULONG CreateOptions,
 607             IN PULONG Disposition OPTIONAL);
 608
 609 /*
 610  * FUNCTION: Creates a mail slot file
 611  * ARGUMENTS:
 612  *        MailSlotFileHandle (OUT) = Caller supplied storage for the resulting handle
 613  *        DesiredAccess = Specifies the allowed or desired access to the file
 614  *        ObjectAttributes = Contains the name of the mailslotfile.
 615  *        IoStatusBlock =
 616  *        FileAttributes =
 617  *        ShareAccess =
 618  *        MaxMessageSize =
 619  *        TimeOut =
 620  *
 621  * REMARKS: This funciton maps to the win32 function CreateMailSlot
 622  * RETURNS:
 623  *      Status
 624  */
 625
 626 NTSTATUS
 627 STDCALL
 628 NtCreateMailslotFile(
 629         OUT PHANDLE MailSlotFileHandle,
 630         IN ACCESS_MASK DesiredAccess,
 631         IN POBJECT_ATTRIBUTES ObjectAttributes,
 632         OUT PIO_STATUS_BLOCK IoStatusBlock,
 633         IN ULONG FileAttributes,
 634         IN ULONG ShareAccess,
 635         IN ULONG MaxMessageSize,
 636         IN PLARGE_INTEGER TimeOut
 637         );
 638
 639 NTSTATUS
 640 STDCALL
 641 ZwCreateMailslotFile(
 642         OUT PHANDLE MailSlotFileHandle,
 643         IN ACCESS_MASK DesiredAccess,
 644         IN POBJECT_ATTRIBUTES ObjectAttributes,
 645         OUT PIO_STATUS_BLOCK IoStatusBlock,
 646         IN ULONG FileAttributes,
 647         IN ULONG ShareAccess,
 648         IN ULONG MaxMessageSize,
 649         IN PLARGE_INTEGER TimeOut
 650         );
 651
 652 /*
 653  * FUNCTION: Creates or opens a mutex
 654  * ARGUMENTS:
 655  *        MutantHandle (OUT) = Caller supplied storage for the resulting handle
 656  *        DesiredAccess = Specifies the allowed or desired access to the port
 657  *        ObjectAttributes = Contains the name of the mutex.
 658  *        InitialOwner = If true the calling thread acquires ownership
 659  *                      of the mutex.
 660  * REMARKS: This funciton maps to the win32 function CreateMutex
 661  * RETURNS:
 662  *      Status
 663  */
 664 NTSTATUS
 665 STDCALL
 666 NtCreateMutant(
 667         OUT PHANDLE MutantHandle,
 668         IN ACCESS_MASK DesiredAccess,
 669         IN POBJECT_ATTRIBUTES ObjectAttributes,
 670         IN BOOLEAN InitialOwner
 671         );
 672
 673 NTSTATUS
 674 STDCALL
 675 ZwCreateMutant(
 676         OUT PHANDLE MutantHandle,
 677         IN ACCESS_MASK DesiredAccess,
 678         IN POBJECT_ATTRIBUTES ObjectAttributes,
 679         IN BOOLEAN InitialOwner
 680         );
 681
 682 /*
 683  * FUNCTION: Creates a named pipe
 684  * ARGUMENTS:
 685  *        NamedPipeFileHandle (OUT) = Caller supplied storage for the
 686  *                                    resulting handle
 687  *        DesiredAccess = Specifies the type of access that the caller
 688  *                        requires to the file boject
 689  *        ObjectAttributes = Points to a structure that specifies the
 690  *                           object attributes.
 691  *        IoStatusBlock = Points to a variable that receives the final
 692  *                        completion status and information
 693  *        ShareAccess = Specifies the limitations on sharing of the file.
 694  *                      This parameter can be zero or any compatible
 695  *                      combination of the following flags
 696  *                         FILE_SHARE_READ
 697  *                         FILE_SHARE_WRITE
 698  *        CreateDisposition = Specifies what to do depending on whether
 699  *                            the file already exists. This must be one of
 700  *                            the following values
 701  *                                  FILE_OPEN
 702  *                                  FILE_CREATE
 703  *                                  FILE_OPEN_IF
 704  *        CreateOptions = Specifies the options to be applied when
 705  *                        creating or opening the file, as a compatible
 706  *                        combination of the following flags
 707  *                            FILE_WRITE_THROUGH
 708  *                            FILE_SYNCHRONOUS_IO_ALERT
 709  *                            FILE_SYNCHRONOUS_IO_NONALERT
 710  *        TypeMessage = Specifies whether the data written to the pipe is
 711  *                      interpreted as a sequence of messages or as a
 712  *                      stream of bytes
 713  *        ReadModeMessage = Specifies whether the data read from the pipe
 714  *                          is interpreted as a sequence of messages or as
 715  *                          a stream of bytes
 716  *        NonBlocking = Specifies whether non-blocking mode is enabled
 717  *        MaxInstances = Specifies the maximum number of instancs that can
 718  *                       be created for this pipe
 719  *        InBufferSize = Specifies the number of bytes to reserve for the
 720  *                       input buffer
 721  *        OutBufferSize = Specifies the number of bytes to reserve for the
 722  *                        output buffer
 723  *        DefaultTimeout = Optionally points to a variable that specifies
 724  *                         the default timeout value in units of
 725  *                         100-nanoseconds.
 726  * REMARKS: This funciton maps to the win32 function CreateNamedPipe
 727  * RETURNS:
 728  *      Status
 729  */
 730 NTSTATUS STDCALL
 731 NtCreateNamedPipeFile (OUT PHANDLE NamedPipeFileHandle,
 732                        IN ACCESS_MASK DesiredAccess,
 733                        IN POBJECT_ATTRIBUTES ObjectAttributes,
 734                        OUT PIO_STATUS_BLOCK IoStatusBlock,
 735                        IN ULONG ShareAccess,
 736                        IN ULONG CreateDisposition,
 737                        IN ULONG CreateOptions,
 738                        IN BOOLEAN WriteModeMessage,
 739                        IN BOOLEAN ReadModeMessage,
 740                        IN BOOLEAN NonBlocking,
 741                        IN ULONG MaxInstances,
 742                        IN ULONG InBufferSize,
 743                        IN ULONG OutBufferSize,
 744                        IN PLARGE_INTEGER DefaultTimeOut);
 745
 746 NTSTATUS STDCALL
 747 ZwCreateNamedPipeFile (OUT PHANDLE NamedPipeFileHandle,
 748                        IN ACCESS_MASK DesiredAccess,
 749                        IN POBJECT_ATTRIBUTES ObjectAttributes,
 750                        OUT PIO_STATUS_BLOCK IoStatusBlock,
 751                        IN ULONG ShareAccess,
 752                        IN ULONG CreateDisposition,
 753                        IN ULONG CreateOptions,
 754                        IN BOOLEAN WriteModeMessage,
 755                        IN BOOLEAN ReadModeMessage,
 756                        IN BOOLEAN NonBlocking,
 757                        IN ULONG MaxInstances,
 758                        IN ULONG InBufferSize,
 759                        IN ULONG OutBufferSize,
 760                        IN PLARGE_INTEGER DefaultTimeOut);
 761
 762
 763 NTSTATUS STDCALL
 764 NtCreatePort (PHANDLE PortHandle,
 765               POBJECT_ATTRIBUTES ObjectAttributes,
 766               ULONG MaxConnectInfoLength,
 767               ULONG MaxDataLength,
 768               ULONG NPMessageQueueSize OPTIONAL);
 769
 770 NTSTATUS STDCALL
 771 NtCreatePort (PHANDLE PortHandle,
 772               POBJECT_ATTRIBUTES ObjectAttributes,
 773               ULONG MaxConnectInfoLength,
 774               ULONG MaxDataLength,
 775               ULONG NPMessageQueueSize OPTIONAL);
 776
 777
 778 /*
 779  * FUNCTION: Creates a process.
 780  * ARGUMENTS:
 781  *        ProcessHandle (OUT) = Caller supplied storage for the resulting handle
 782  *        DesiredAccess = Specifies the allowed or desired access to the process can
 783  *                        be a combinate of STANDARD_RIGHTS_REQUIRED| ..
 784  *        ObjectAttribute = Initialized attributes for the object, contains the rootdirectory and the filename
 785  *        ParentProcess = Handle to the parent process.
 786  *        InheritObjectTable = Specifies to inherit the objects of the parent process if true.
 787  *        SectionHandle = Handle to a section object to back the image file
 788  *        DebugPort = Handle to a DebugPort if NULL the system default debug port will be used.
 789  *        ExceptionPort = Handle to a exception port.
 790  * REMARKS:
 791  *        This function maps to the win32 CreateProcess.
 792  * RETURNS: Status
 793  */
 794 NTSTATUS
 795 STDCALL
 796 NtCreateProcess(
 797         OUT PHANDLE ProcessHandle,
 798         IN ACCESS_MASK DesiredAccess,
 799         IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
 800         IN HANDLE ParentProcess,
 801         IN BOOLEAN InheritObjectTable,
 802         IN HANDLE SectionHandle OPTIONAL,
 803         IN HANDLE DebugPort OPTIONAL,
 804         IN HANDLE ExceptionPort OPTIONAL
 805         );
 806
 807 NTSTATUS
 808 STDCALL
 809 ZwCreateProcess(
 810         OUT PHANDLE ProcessHandle,
 811         IN ACCESS_MASK DesiredAccess,
 812         IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
 813         IN HANDLE ParentProcess,
 814         IN BOOLEAN InheritObjectTable,
 815         IN HANDLE SectionHandle OPTIONAL,
 816         IN HANDLE DebugPort OPTIONAL,
 817         IN HANDLE ExceptionPort OPTIONAL
 818         );
 819
 820 /*
 821  * FUNCTION: Creates a section object.
 822  * ARGUMENTS:
 823  *        SectionHandle (OUT) = Caller supplied storage for the resulting handle
 824  *        DesiredAccess = Specifies the desired access to the section can be a combination of STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_WRITE |
 825  *                        SECTION_MAP_READ | SECTION_MAP_EXECUTE.
 826  *        ObjectAttribute = Initialized attributes for the object can be used to create a named section
 827  *        MaxiumSize = Maximizes the size of the memory section. Must be non-NULL for a page-file backed section.
 828  *                     If value specified for a mapped file and the file is not large enough, file will be extended.
 829  *        SectionPageProtection = Can be a combination of PAGE_READONLY | PAGE_READWRITE | PAGE_WRITEONLY | PAGE_WRITECOPY.
 830  *        AllocationAttributes = can be a combination of SEC_IMAGE | SEC_RESERVE
 831  *        FileHanlde = Handle to a file to create a section mapped to a file instead of a memory backed section.
 832  * RETURNS: Status
 833  */
 834
 835 NTSTATUS
 836 STDCALL
 837 NtCreateSection(
 838         OUT PHANDLE SectionHandle,
 839         IN ACCESS_MASK DesiredAccess,
 840         IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
 841         IN PLARGE_INTEGER MaximumSize OPTIONAL,
 842         IN ULONG SectionPageProtection OPTIONAL,
 843         IN ULONG AllocationAttributes,
 844         IN HANDLE FileHandle OPTIONAL
 845         );
 846
 847 NTSTATUS
 848 STDCALL
 849 ZwCreateSection(
 850         OUT PHANDLE SectionHandle,
 851         IN ACCESS_MASK DesiredAccess,
 852         IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
 853         IN PLARGE_INTEGER MaximumSize OPTIONAL,
 854         IN ULONG SectionPageProtection OPTIONAL,
 855         IN ULONG AllocationAttributes,
 856         IN HANDLE FileHandle OPTIONAL
 857         );
 858
 859 /*
 860  * FUNCTION: Creates a semaphore object for interprocess synchronization.
 861  * ARGUMENTS:
 862  *        SemaphoreHandle (OUT) = Caller supplied storage for the resulting handle
 863  *        DesiredAccess = Specifies the allowed or desired access to the semaphore.
 864  *        ObjectAttribute = Initialized attributes for the object.
 865  *        InitialCount = Not necessary zero, might be smaller than zero.
 866  *        MaximumCount = Maxiumum count the semaphore can reach.
 867  * RETURNS: Status
 868  * REMARKS:
 869  *        The semaphore is set to signaled when its count is greater than zero, and non-signaled when its count is zero.
 870  */
 871
 872 //FIXME: should a semaphore's initial count allowed to be smaller than zero ??
 873 NTSTATUS
 874 STDCALL
 875 NtCreateSemaphore(
 876         OUT PHANDLE SemaphoreHandle,
 877         IN ACCESS_MASK DesiredAccess,
 878         IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
 879         IN LONG InitialCount,
 880         IN LONG MaximumCount
 881         );
 882
 883 NTSTATUS
 884 STDCALL
 885 ZwCreateSemaphore(
 886         OUT PHANDLE SemaphoreHandle,
 887         IN ACCESS_MASK DesiredAccess,
 888         IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
 889         IN LONG InitialCount,
 890         IN LONG MaximumCount
 891         );
 892
 893 /*
 894  * FUNCTION: Creates a symbolic link object
 895  * ARGUMENTS:
 896  *        SymbolicLinkHandle (OUT) = Caller supplied storage for the resulting handle
 897  *        DesiredAccess = Specifies the allowed or desired access to the thread.
 898  *        ObjectAttributes = Initialized attributes for the object.
 899  *        Name = Target name of the symbolic link
 900  * RETURNS: Status
 901  */
 902 NTSTATUS
 903 STDCALL
 904 NtCreateSymbolicLinkObject(
 905         OUT PHANDLE SymbolicLinkHandle,
 906         IN ACCESS_MASK DesiredAccess,
 907         IN POBJECT_ATTRIBUTES ObjectAttributes,
 908         IN PUNICODE_STRING Name
 909         );
 910
 911 NTSTATUS
 912 STDCALL
 913 ZwCreateSymbolicLinkObject(
 914         OUT PHANDLE SymbolicLinkHandle,
 915         IN ACCESS_MASK DesiredAccess,
 916         IN POBJECT_ATTRIBUTES ObjectAttributes,
 917         IN PUNICODE_STRING Name
 918         );
 919
 920 /*
 921  * FUNCTION: Creates a waitable timer.
 922  * ARGUMENTS:
 923  *        TimerHandle (OUT) = Caller supplied storage for the resulting handle
 924  *        DesiredAccess = Specifies the allowed or desired access to the timer.
 925  *        ObjectAttributes = Initialized attributes for the object.
 926  *        TimerType = Specifies if the timer should be reset manually.
 927  * REMARKS:
 928  *       This function maps to the win32  CreateWaitableTimer. lpTimerAttributes and lpTimerName map to
 929  *       corresponding fields in OBJECT_ATTRIBUTES structure.
 930  * RETURNS: Status
 931  */
 932 NTSTATUS
 933 STDCALL
 934 NtCreateTimer(
 935         OUT PHANDLE TimerHandle,
 936         IN ACCESS_MASK DesiredAccess,
 937         IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
 938         IN TIMER_TYPE TimerType
 939         );
 940
 941 NTSTATUS
 942 STDCALL
 943 ZwCreateTimer(
 944         OUT PHANDLE TimerHandle,
 945         IN ACCESS_MASK DesiredAccess,
 946         IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
 947         IN TIMER_TYPE TimerType
 948         );
 949
 950 /*
 951  * FUNCTION: Creates a token.
 952  * ARGUMENTS:
 953  *        TokenHandle (OUT) = Caller supplied storage for the resulting handle
 954  *        DesiredAccess = Specifies the allowed or desired access to the process can
 955  *                        be a combinate of STANDARD_RIGHTS_REQUIRED| ..
 956  *        ObjectAttribute = Initialized attributes for the object, contains the rootdirectory and the filename
 957  *        TokenType =
 958  *        AuthenticationId =
 959  *        ExpirationTime =
 960  *        TokenUser =
 961  *        TokenGroups =
 962  *        TokenPrivileges =
 963  *        TokenOwner =
 964  *        TokenPrimaryGroup =
 965  *        TokenDefaultDacl =
 966  *        TokenSource =
 967  * REMARKS:
 968  *        This function does not map to a win32 function
 969  * RETURNS: Status
 970  */
 971
 972 NTSTATUS
 973 STDCALL
 974 NtCreateToken(
 975         OUT PHANDLE TokenHandle,
 976         IN ACCESS_MASK DesiredAccess,
 977         IN POBJECT_ATTRIBUTES ObjectAttributes,
 978         IN TOKEN_TYPE TokenType,
 979         IN PLUID AuthenticationId,
 980         IN PLARGE_INTEGER ExpirationTime,
 981         IN PTOKEN_USER TokenUser,
 982         IN PTOKEN_GROUPS TokenGroups,
 983         IN PTOKEN_PRIVILEGES TokenPrivileges,
 984         IN PTOKEN_OWNER TokenOwner,
 985         IN PTOKEN_PRIMARY_GROUP TokenPrimaryGroup,
 986         IN PTOKEN_DEFAULT_DACL TokenDefaultDacl,
 987         IN PTOKEN_SOURCE TokenSource
 988         );
 989
 990 NTSTATUS
 991 STDCALL
 992 ZwCreateToken(
 993         OUT PHANDLE TokenHandle,
 994         IN ACCESS_MASK DesiredAccess,
 995         IN POBJECT_ATTRIBUTES ObjectAttributes,
 996         IN TOKEN_TYPE TokenType,
 997         IN PLUID AuthenticationId,
 998         IN PLARGE_INTEGER ExpirationTime,
 999         IN PTOKEN_USER TokenUser,
1000         IN PTOKEN_GROUPS TokenGroups,
1001         IN PTOKEN_PRIVILEGES TokenPrivileges,
1002         IN PTOKEN_OWNER TokenOwner,
1003         IN PTOKEN_PRIMARY_GROUP TokenPrimaryGroup,
1004         IN PTOKEN_DEFAULT_DACL TokenDefaultDacl,
1005         IN PTOKEN_SOURCE TokenSource
1006         );
1007
1008 /*
1009  * FUNCTION: Returns the callers thread TEB.
1010  * RETURNS: The resulting teb.
1011  */
1012 #if 0
1013  NT_TEB *
1014 STDCALL
1015 NtCurrentTeb(VOID
1016         );
1017 #endif
1018
1019
1020 NTSTATUS STDCALL
1021 NtCreateWaitablePort (PHANDLE PortHandle,
1022                       POBJECT_ATTRIBUTES ObjectAttributes,
1023                       ULONG MaxConnectInfoLength,
1024                       ULONG MaxDataLength,
1025                       ULONG NPMessageQueueSize OPTIONAL);
1026
1027 NTSTATUS STDCALL
1028 ZwCreateWaitablePort (PHANDLE PortHandle,
1029                       POBJECT_ATTRIBUTES ObjectAttributes,
1030                       ULONG MaxConnectInfoLength,
1031                       ULONG MaxDataLength,
1032                       ULONG NPMessageQueueSize OPTIONAL);
1033
1034
1035 /*
1036  * FUNCTION: Deletes an atom from the global atom table
1037  * ARGUMENTS:
1038  *        Atom = Identifies the atom to delete
1039  * REMARKS:
1040  *       The function maps to the win32 GlobalDeleteAtom
1041  * RETURNS: Status
1042  */
1043 NTSTATUS
1044 STDCALL
1045 NtDeleteAtom(
1046         IN RTL_ATOM Atom
1047         );
1048
1049 NTSTATUS
1050 STDCALL
1051 ZwDeleteAtom(
1052         IN RTL_ATOM Atom
1053         );
1054
1055 /*
1056  * FUNCTION: Deletes a file or a directory
1057  * ARGUMENTS:
1058  *        ObjectAttributes = Name of the file which should be deleted
1059  * REMARKS:
1060  *       This system call is functionally equivalent to NtSetInformationFile
1061  *       setting the disposition information.
1062  *       The function maps to the win32 DeleteFile.
1063  * RETURNS: Status
1064  */
1065 NTSTATUS
1066 STDCALL
1067 NtDeleteFile(
1068         IN POBJECT_ATTRIBUTES ObjectAttributes
1069         );
1070
1071 NTSTATUS
1072 STDCALL
1073 ZwDeleteFile(
1074         IN POBJECT_ATTRIBUTES ObjectAttributes
1075         );
1076
1077 /*
1078  * FUNCTION: Deletes a registry key
1079  * ARGUMENTS:
1080  *         KeyHandle = Handle of the key
1081  * RETURNS: Status
1082  */
1083 NTSTATUS
1084 STDCALL
1085 NtDeleteKey(
1086         IN HANDLE KeyHandle
1087         );
1088 NTSTATUS
1089 STDCALL
1090 ZwDeleteKey(
1091         IN HANDLE KeyHandle
1092         );
1093
1094 /*
1095  * FUNCTION: Generates a audit message when an object is deleted
1096  * ARGUMENTS:
1097  *         SubsystemName = Spefies the name of the subsystem can be 'WIN32' or 'DEBUG'
1098  *         HandleId= Handle to an audit object
1099  *         GenerateOnClose = Value returned by NtAccessCheckAndAuditAlarm
1100  * REMARKS: This function maps to the win32 ObjectCloseAuditAlarm
1101  * RETURNS: Status
1102  */
1103
1104 NTSTATUS
1105 STDCALL
1106 NtDeleteObjectAuditAlarm (
1107         IN PUNICODE_STRING SubsystemName,
1108         IN PVOID HandleId,
1109         IN BOOLEAN GenerateOnClose
1110         );
1111
1112 NTSTATUS
1113 STDCALL
1114 ZwDeleteObjectAuditAlarm (
1115         IN PUNICODE_STRING SubsystemName,
1116         IN PVOID HandleId,
1117         IN BOOLEAN GenerateOnClose
1118         );
1119
1120
1121 /*
1122  * FUNCTION: Deletes a value from a registry key
1123  * ARGUMENTS:
1124  *         KeyHandle = Handle of the key
1125  *         ValueName = Name of the value to delete
1126  * RETURNS: Status
1127  */
1128
1129 NTSTATUS
1130 STDCALL
1131 NtDeleteValueKey(
1132         IN HANDLE KeyHandle,
1133         IN PUNICODE_STRING ValueName
1134         );
1135
1136 NTSTATUS
1137 STDCALL
1138 ZwDeleteValueKey(
1139         IN HANDLE KeyHandle,
1140         IN PUNICODE_STRING ValueName
1141         );
1142 /*
1143  * FUNCTION: Sends IOCTL to the io sub system
1144  * ARGUMENTS:
1145  *        DeviceHandle = Points to the handle that is created by NtCreateFile
1146  *        Event = Event to synchronize on STATUS_PENDING
1147  *        ApcRoutine = Asynchroneous procedure callback
1148  *        ApcContext = Callback context.
1149  *        IoStatusBlock = Caller should supply storage for extra information..
1150  *        IoControlCode = Contains the IO Control command. This is an
1151  *                      index to the structures in InputBuffer and OutputBuffer.
1152  *        InputBuffer = Caller should supply storage for input buffer if IOTL expects one.
1153  *        InputBufferSize = Size of the input bufffer
1154  *        OutputBuffer = Caller should supply storage for output buffer if IOTL expects one.
1155  *        OutputBufferSize  = Size of the input bufffer
1156  * RETURNS: Status
1157  */
1158
1159 NTSTATUS
1160 STDCALL
1161 NtDeviceIoControlFile(
1162         IN HANDLE DeviceHandle,
1163         IN HANDLE Event OPTIONAL,
1164         IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,
1165         IN PVOID UserApcContext OPTIONAL,
1166         OUT PIO_STATUS_BLOCK IoStatusBlock,
1167         IN ULONG IoControlCode,
1168         IN PVOID InputBuffer,
1169         IN ULONG InputBufferSize,
1170         OUT PVOID OutputBuffer,
1171         IN ULONG OutputBufferSize
1172         );
1173
1174 NTSTATUS
1175 STDCALL
1176 ZwDeviceIoControlFile(
1177         IN HANDLE DeviceHandle,
1178         IN HANDLE Event OPTIONAL,
1179         IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,
1180         IN PVOID UserApcContext OPTIONAL,
1181         OUT PIO_STATUS_BLOCK IoStatusBlock,
1182         IN ULONG IoControlCode,
1183         IN PVOID InputBuffer,
1184         IN ULONG InputBufferSize,
1185         OUT PVOID OutputBuffer,
1186         IN ULONG OutputBufferSize
1187         );
1188 /*
1189  * FUNCTION: Displays a string on the blue screen
1190  * ARGUMENTS:
1191  *         DisplayString = The string to display
1192  * RETURNS: Status
1193  */
1194
1195 NTSTATUS
1196 STDCALL
1197 NtDisplayString(
1198         IN PUNICODE_STRING DisplayString
1199         );
1200
1201 NTSTATUS
1202 STDCALL
1203 ZwDisplayString(
1204         IN PUNICODE_STRING DisplayString
1205         );
1206
1207 /*
1208  * FUNCTION: Returns information about the subkeys of an open key
1209  * ARGUMENTS:
1210  *         KeyHandle = Handle of the key whose subkeys are to enumerated
1211  *         Index = zero based index of the subkey for which information is
1212  *                 request
1213  *         KeyInformationClass = Type of information returned
1214  *         KeyInformation (OUT) = Caller allocated buffer for the information
1215  *                                about the key
1216  *         Length = Length in bytes of the KeyInformation buffer
1217  *         ResultLength (OUT) = Caller allocated storage which holds
1218  *                              the number of bytes of information retrieved
1219  *                              on return
1220  * RETURNS: Status
1221  */
1222 NTSTATUS
1223 STDCALL
1224 NtEnumerateKey(
1225         IN HANDLE KeyHandle,
1226         IN ULONG Index,
1227         IN KEY_INFORMATION_CLASS KeyInformationClass,
1228         OUT PVOID KeyInformation,
1229         IN ULONG Length,
1230         OUT PULONG ResultLength
1231         );
1232
1233 NTSTATUS
1234 STDCALL
1235 ZwEnumerateKey(
1236         IN HANDLE KeyHandle,
1237         IN ULONG Index,
1238         IN KEY_INFORMATION_CLASS KeyInformationClass,
1239         OUT PVOID KeyInformation,
1240         IN ULONG Length,
1241         OUT PULONG ResultLength
1242         );
1243 /*
1244  * FUNCTION: Returns information about the value entries of an open key
1245  * ARGUMENTS:
1246  *         KeyHandle = Handle of the key whose value entries are to enumerated
1247  *         Index = zero based index of the subkey for which information is
1248  *                 request
1249  *         KeyInformationClass = Type of information returned
1250  *         KeyInformation (OUT) = Caller allocated buffer for the information
1251  *                                about the key
1252  *         Length = Length in bytes of the KeyInformation buffer
1253  *         ResultLength (OUT) = Caller allocated storage which holds
1254  *                              the number of bytes of information retrieved
1255  *                              on return
1256  * RETURNS: Status
1257  */
1258 NTSTATUS
1259 STDCALL
1260 NtEnumerateValueKey(
1261         IN HANDLE KeyHandle,
1262         IN ULONG Index,
1263         IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
1264         OUT PVOID KeyValueInformation,
1265         IN ULONG Length,
1266         OUT PULONG ResultLength
1267         );
1268
1269 NTSTATUS
1270 STDCALL
1271 ZwEnumerateValueKey(
1272         IN HANDLE KeyHandle,
1273         IN ULONG Index,
1274         IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
1275         OUT PVOID KeyValueInformation,
1276         IN ULONG Length,
1277         OUT PULONG ResultLength
1278         );
1279
1280 /*
1281  * FUNCTION: Flushes chached file data to disk
1282  * ARGUMENTS:
1283  *       FileHandle = Points to the file
1284  *       IoStatusBlock = Caller must supply storage to receive the result of the flush
1285  *              buffers operation. The information field is set to number of bytes
1286  *              flushed to disk.
1287  * RETURNS: Status
1288  * REMARKS:
1289  *      This funciton maps to the win32 FlushFileBuffers
1290  */
1291 NTSTATUS
1292 STDCALL
1293 NtFlushBuffersFile(
1294         IN HANDLE FileHandle,
1295         OUT PIO_STATUS_BLOCK IoStatusBlock
1296         );
1297
1298 NTSTATUS
1299 STDCALL
1300 ZwFlushBuffersFile(
1301         IN HANDLE FileHandle,
1302         OUT PIO_STATUS_BLOCK IoStatusBlock
1303         );
1304
1305 /*
1306  * FUNCTION: Flushes a registry key to disk
1307  * ARGUMENTS:
1308  *       KeyHandle = Points to the registry key handle
1309  * RETURNS: Status
1310  * REMARKS:
1311  *      This funciton maps to the win32 RegFlushKey.
1312  */
1313 NTSTATUS
1314 STDCALL
1315 NtFlushKey(
1316         IN HANDLE KeyHandle
1317         );
1318
1319 NTSTATUS
1320 STDCALL
1321 ZwFlushKey(
1322         IN HANDLE KeyHandle
1323         );
1324
1325 /*
1326  * FUNCTION: Flushes the dirty pages to file
1327  * RETURNS: Status
1328  * FIXME: Not sure this does (how is the file specified)
1329  */
1330 NTSTATUS STDCALL NtFlushWriteBuffer(VOID);
1331 NTSTATUS STDCALL ZwFlushWriteBuffer(VOID);
1332
1333  /*
1334  * FUNCTION: Frees a range of virtual memory
1335  * ARGUMENTS:
1336  *        ProcessHandle = Points to the process that allocated the virtual
1337  *                        memory
1338  *        BaseAddress = Points to the memory address, rounded down to a
1339  *                      multiple of the pagesize
1340  *        RegionSize = Limits the range to free, rounded up to a multiple of
1341  *                     the paging size
1342  *        FreeType = Can be one of the values:  MEM_DECOMMIT, or MEM_RELEASE
1343  * RETURNS: Status
1344  */
1345 NTSTATUS STDCALL NtFreeVirtualMemory(IN HANDLE ProcessHandle,
1346                                      IN PVOID  *BaseAddress,
1347                                      IN PULONG  RegionSize,
1348                                      IN ULONG  FreeType);
1349 NTSTATUS STDCALL ZwFreeVirtualMemory(IN HANDLE ProcessHandle,
1350                                      IN PVOID  *BaseAddress,
1351                                      IN PULONG  RegionSize,
1352                                      IN ULONG  FreeType);
1353
1354 /*
1355  * FUNCTION: Sends FSCTL to the filesystem
1356  * ARGUMENTS:
1357  *        DeviceHandle = Points to the handle that is created by NtCreateFile
1358  *        Event = Event to synchronize on STATUS_PENDING
1359  *        ApcRoutine =
1360  *        ApcContext =
1361  *        IoStatusBlock = Caller should supply storage for
1362  *        IoControlCode = Contains the File System Control command. This is an
1363  *                      index to the structures in InputBuffer and OutputBuffer.
1364  *              FSCTL_GET_RETRIEVAL_POINTERS    MAPPING_PAIR
1365  *              FSCTL_GET_RETRIEVAL_POINTERS    GET_RETRIEVAL_DESCRIPTOR
1366  *              FSCTL_GET_VOLUME_BITMAP         BITMAP_DESCRIPTOR
1367  *              FSCTL_MOVE_FILE                 MOVEFILE_DESCRIPTOR
1368  *
1369  *        InputBuffer = Caller should supply storage for input buffer if FCTL expects one.
1370  *        InputBufferSize = Size of the input bufffer
1371  *        OutputBuffer = Caller should supply storage for output buffer if FCTL expects one.
1372  *        OutputBufferSize  = Size of the input bufffer
1373  * RETURNS: Status [ STATUS_SUCCESS | STATUS_PENDING | STATUS_ACCESS_DENIED | STATUS_INSUFFICIENT_RESOURCES |
1374  *              STATUS_INVALID_PARAMETER | STATUS_INVALID_DEVICE_REQUEST ]
1375  */
1376 NTSTATUS
1377 STDCALL
1378 NtFsControlFile(
1379         IN HANDLE DeviceHandle,
1380         IN HANDLE Event OPTIONAL,
1381         IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
1382         IN PVOID ApcContext OPTIONAL,
1383         OUT PIO_STATUS_BLOCK IoStatusBlock,
1384         IN ULONG IoControlCode,
1385         IN PVOID InputBuffer,
1386         IN ULONG InputBufferSize,
1387         OUT PVOID OutputBuffer,
1388         IN ULONG OutputBufferSize
1389         );
1390
1391 NTSTATUS
1392 STDCALL
1393 ZwFsControlFile(
1394         IN HANDLE DeviceHandle,
1395         IN HANDLE Event OPTIONAL,
1396         IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
1397         IN PVOID ApcContext OPTIONAL,
1398         OUT PIO_STATUS_BLOCK IoStatusBlock,
1399         IN ULONG IoControlCode,
1400         IN PVOID InputBuffer,
1401         IN ULONG InputBufferSize,
1402         OUT PVOID OutputBuffer,
1403         IN ULONG OutputBufferSize
1404         );
1405
1406 /*
1407  * FUNCTION: Retrieves the processor context of a thread
1408  * ARGUMENTS:
1409  *        ThreadHandle = Handle to a thread
1410  *        Context (OUT) = Caller allocated storage for the processor context
1411  * RETURNS: Status
1412  */
1413
1414 NTSTATUS
1415 STDCALL
1416 NtGetContextThread(
1417         IN HANDLE ThreadHandle,
1418         OUT PCONTEXT Context
1419         );
1420
1421 NTSTATUS
1422 STDCALL
1423 ZwGetContextThread(
1424         IN HANDLE ThreadHandle,
1425         OUT PCONTEXT Context
1426         );
1427
1428
1429 NTSTATUS STDCALL
1430 NtImpersonateClientOfPort (HANDLE PortHandle,
1431                            PLPC_MESSAGE ClientMessage);
1432
1433 NTSTATUS STDCALL
1434 ZwImpersonateClientOfPort (HANDLE PortHandle,
1435                            PLPC_MESSAGE ClientMessage);
1436
1437 /*
1438  * FUNCTION: Sets a thread to impersonate another
1439  * ARGUMENTS:
1440  *        ThreadHandle = Server thread that will impersonate a client.
1441           ThreadToImpersonate = Client thread that will be impersonated
1442           SecurityQualityOfService = Specifies the impersonation level.
1443  * RETURNS: Status
1444  */
1445
1446 NTSTATUS
1447 STDCALL
1448 NtImpersonateThread(
1449         IN HANDLE ThreadHandle,
1450         IN HANDLE ThreadToImpersonate,
1451         IN PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService
1452         );
1453
1454 NTSTATUS
1455 STDCALL
1456 ZwImpersonateThread(
1457         IN HANDLE ThreadHandle,
1458         IN HANDLE ThreadToImpersonate,
1459         IN PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService
1460         );
1461
1462 /*
1463  * FUNCTION: Initializes the registry.
1464  * ARGUMENTS:
1465  *        SetUpBoot = This parameter is true for a setup boot.
1466  * RETURNS: Status
1467  */
1468 NTSTATUS
1469 STDCALL
1470 NtInitializeRegistry(
1471         BOOLEAN SetUpBoot
1472         );
1473 NTSTATUS
1474 STDCALL
1475 ZwInitializeRegistry(
1476         BOOLEAN SetUpBoot
1477         );
1478
1479
1480 NTSTATUS STDCALL
1481 NtListenPort (HANDLE PortHandle,
1482               PLPC_MESSAGE LpcMessage);
1483
1484 NTSTATUS STDCALL
1485 ZwListenPort (HANDLE PortHandle,
1486               PLPC_MESSAGE LpcMessage);
1487
1488
1489 /*
1490  * FUNCTION: Loads a driver.
1491  * ARGUMENTS:
1492  *      DriverServiceName = Name of the driver to load
1493  * RETURNS: Status
1494  */
1495 NTSTATUS
1496 STDCALL
1497 NtLoadDriver(
1498         IN PUNICODE_STRING DriverServiceName
1499         );
1500
1501 NTSTATUS
1502 STDCALL
1503 ZwLoadDriver(
1504         IN PUNICODE_STRING DriverServiceName
1505         );
1506
1507 /*
1508  * FUNCTION: Locks a range of bytes in a file.
1509  * ARGUMENTS:
1510  *       FileHandle = Handle to the file
1511  *       Event = Should be null if apc is specified.
1512  *       ApcRoutine = Asynchroneous Procedure Callback
1513  *       ApcContext = Argument to the callback
1514  *       IoStatusBlock (OUT) = Caller should supply storage for a structure containing
1515  *                       the completion status and information about the requested lock operation.
1516  *       ByteOffset = Offset
1517  *       Length = Number of bytes to lock.
1518  *       Key  = Special value to give other threads the possibility to unlock the file
1519                 by supplying the key in a call to NtUnlockFile.
1520  *       FailImmediatedly = If false the request will block untill the lock is obtained.
1521  *       ExclusiveLock = Specifies whether a exclusive or a shared lock is obtained.
1522  * REMARK:
1523         This procedure maps to the win32 procedure LockFileEx. STATUS_PENDING is returned if the lock could
1524         not be obtained immediately, the device queue is busy and the IRP is queued.
1525  * RETURNS: Status [ STATUS_SUCCESS | STATUS_PENDING | STATUS_ACCESS_DENIED | STATUS_INSUFFICIENT_RESOURCES |
1526                 STATUS_INVALID_PARAMETER | STATUS_INVALID_DEVICE_REQUEST | STATUS_LOCK_NOT_GRANTED ]
1527
1528  */
1529 NTSTATUS
1530 STDCALL
1531 NtLockFile(
1532         IN  HANDLE FileHandle,
1533         IN  HANDLE Event OPTIONAL,
1534         IN  PIO_APC_ROUTINE ApcRoutine OPTIONAL,
1535         IN  PVOID ApcContext OPTIONAL,
1536         OUT PIO_STATUS_BLOCK IoStatusBlock,
1537         IN  PLARGE_INTEGER ByteOffset,
1538         IN  PLARGE_INTEGER Length,
1539         IN  PULONG Key,
1540         IN  BOOLEAN FailImmediatedly,
1541         IN  BOOLEAN ExclusiveLock
1542         );
1543
1544 NTSTATUS
1545 STDCALL
1546 ZwLockFile(
1547         IN  HANDLE FileHandle,
1548         IN  HANDLE Event OPTIONAL,
1549         IN  PIO_APC_ROUTINE ApcRoutine OPTIONAL,
1550         IN  PVOID ApcContext OPTIONAL,
1551         OUT PIO_STATUS_BLOCK IoStatusBlock,
1552         IN  PLARGE_INTEGER ByteOffset,
1553         IN  PLARGE_INTEGER Length,
1554         IN  PULONG Key,
1555         IN  BOOLEAN FailImmediatedly,
1556         IN  BOOLEAN ExclusiveLock
1557         );
1558
1559 /*
1560  * FUNCTION: Makes temporary object that will be removed at next boot.
1561  * ARGUMENTS:
1562  *       Handle = Handle to object
1563  * RETURNS: Status
1564  */
1565
1566 NTSTATUS
1567 STDCALL
1568 NtMakeTemporaryObject(
1569         IN HANDLE Handle
1570         );
1571
1572 NTSTATUS
1573 STDCALL
1574 ZwMakeTemporaryObject(
1575         IN HANDLE Handle
1576         );
1577 /*
1578  * FUNCTION: Maps a view of a section into the virtual address space of a
1579  *           process
1580  * ARGUMENTS:
1581  *        SectionHandle = Handle of the section
1582  *        ProcessHandle = Handle of the process
1583  *        BaseAddress = Desired base address (or NULL) on entry
1584  *                      Actual base address of the view on exit
1585  *        ZeroBits = Number of high order address bits that must be zero
1586  *        CommitSize = Size in bytes of the initially committed section of
1587  *                     the view
1588  *        SectionOffset = Offset in bytes from the beginning of the section
1589  *                        to the beginning of the view
1590  *        ViewSize = Desired length of map (or zero to map all) on entry
1591  *                   Actual length mapped on exit
1592  *        InheritDisposition = Specified how the view is to be shared with
1593  *                            child processes
1594  *        AllocateType = Type of allocation for the pages
1595  *        Protect = Protection for the committed region of the view
1596  * RETURNS: Status
1597  */
1598 NTSTATUS
1599 STDCALL
1600 NtMapViewOfSection(
1601         IN HANDLE SectionHandle,
1602         IN HANDLE ProcessHandle,
1603         IN OUT PVOID *BaseAddress,
1604         IN ULONG ZeroBits,
1605         IN ULONG CommitSize,
1606         IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,
1607         IN OUT PULONG ViewSize,
1608         IN SECTION_INHERIT InheritDisposition,
1609         IN ULONG AllocationType,
1610         IN ULONG AccessProtection
1611         );
1612
1613 NTSTATUS
1614 STDCALL
1615 ZwMapViewOfSection(
1616         IN HANDLE SectionHandle,
1617         IN HANDLE ProcessHandle,
1618         IN OUT PVOID *BaseAddress,
1619         IN ULONG ZeroBits,
1620         IN ULONG CommitSize,
1621         IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,
1622         IN OUT PULONG ViewSize,
1623         IN SECTION_INHERIT InheritDisposition,
1624         IN ULONG AllocationType,
1625         IN ULONG AccessProtection
1626         );
1627
1628 /*
1629  * FUNCTION: Installs a notify for the change of a directory's contents
1630  * ARGUMENTS:
1631  *        FileHandle = Handle to the directory
1632           Event =
1633  *        ApcRoutine   = Start address
1634  *        ApcContext = Delimits the range of virtual memory
1635  *                              for which the new access protection holds
1636  *        IoStatusBlock = The new access proctection for the pages
1637  *        Buffer = Caller supplies storage for resulting information --> FILE_NOTIFY_INFORMATION
1638  *        BufferSize =  Size of the buffer
1639           CompletionFilter = Can be one of the following values:
1640                         FILE_NOTIFY_CHANGE_FILE_NAME
1641                         FILE_NOTIFY_CHANGE_DIR_NAME
1642                         FILE_NOTIFY_CHANGE_NAME ( FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_DIR_NAME )
1643                         FILE_NOTIFY_CHANGE_ATTRIBUTES
1644                         FILE_NOTIFY_CHANGE_SIZE
1645                         FILE_NOTIFY_CHANGE_LAST_WRITE
1646                         FILE_NOTIFY_CHANGE_LAST_ACCESS
1647                         FILE_NOTIFY_CHANGE_CREATION ( change of creation timestamp )
1648                         FILE_NOTIFY_CHANGE_EA
1649                         FILE_NOTIFY_CHANGE_SECURITY
1650                         FILE_NOTIFY_CHANGE_STREAM_NAME
1651                         FILE_NOTIFY_CHANGE_STREAM_SIZE
1652                         FILE_NOTIFY_CHANGE_STREAM_WRITE
1653           WatchTree = If true the notify will be installed recursively on the targetdirectory and all subdirectories.
1654  *
1655  * REMARKS:
1656  *       The function maps to the win32 FindFirstChangeNotification, FindNextChangeNotification
1657  * RETURNS: Status
1658  */
1659 NTSTATUS
1660 STDCALL
1661 NtNotifyChangeDirectoryFile(
1662         IN HANDLE FileHandle,
1663         IN HANDLE Event OPTIONAL,
1664         IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
1665         IN PVOID ApcContext OPTIONAL,
1666         OUT PIO_STATUS_BLOCK IoStatusBlock,
1667         OUT PVOID Buffer,
1668         IN ULONG BufferSize,
1669         IN ULONG CompletionFilter,
1670         IN BOOLEAN WatchTree
1671         );
1672
1673 NTSTATUS
1674 STDCALL
1675 ZwNotifyChangeDirectoryFile(
1676         IN HANDLE FileHandle,
1677         IN HANDLE Event OPTIONAL,
1678         IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
1679         IN PVOID ApcContext OPTIONAL,
1680         OUT PIO_STATUS_BLOCK IoStatusBlock,
1681         OUT PVOID Buffer,
1682         IN ULONG BufferSize,
1683         IN ULONG CompletionFilter,
1684         IN BOOLEAN WatchTree
1685         );
1686
1687 /*
1688  * FUNCTION: Installs a notfication callback on registry changes
1689  * ARGUMENTS:
1690         KeyHandle = Handle to the registry key
1691         Event = Event that should be signalled on modification of the key
1692         ApcRoutine = Routine that should be called on modification of the key
1693         ApcContext = Argument to the ApcRoutine
1694         IoStatusBlock = ???
1695         CompletionFilter = Specifies the kind of notification the caller likes to receive.
1696                         Can be a combination of the following values:
1697
1698                         REG_NOTIFY_CHANGE_NAME
1699                         REG_NOTIFY_CHANGE_ATTRIBUTES
1700                         REG_NOTIFY_CHANGE_LAST_SET
1701                         REG_NOTIFY_CHANGE_SECURITY
1702
1703
1704         Asynchroneous = If TRUE the changes are reported by signalling an event if false
1705                         the function will not return before a change occurs.
1706         ChangeBuffer =  Will return the old value
1707         Length = Size of the change buffer
1708         WatchSubtree =  Indicates if the caller likes to receive a notification of changes in
1709                         sub keys or not.
1710  * REMARKS: If the key is closed the event is signalled aswell.
1711  * RETURNS: Status
1712  */
1713
1714 NTSTATUS
1715 STDCALL
1716 NtNotifyChangeKey(
1717         IN HANDLE KeyHandle,
1718         IN HANDLE Event,
1719         IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
1720         IN PVOID ApcContext OPTIONAL,
1721         OUT PIO_STATUS_BLOCK IoStatusBlock,
1722         IN ULONG CompletionFilter,
1723         IN BOOLEAN Asynchroneous,
1724         OUT PVOID ChangeBuffer,
1725         IN ULONG Length,
1726         IN BOOLEAN WatchSubtree
1727         );
1728
1729 NTSTATUS
1730 STDCALL
1731 ZwNotifyChangeKey(
1732         IN HANDLE KeyHandle,
1733         IN HANDLE Event,
1734         IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
1735         IN PVOID ApcContext OPTIONAL,
1736         OUT PIO_STATUS_BLOCK IoStatusBlock,
1737         IN ULONG CompletionFilter,
1738         IN BOOLEAN Asynchroneous,
1739         OUT PVOID ChangeBuffer,
1740         IN ULONG Length,
1741         IN BOOLEAN WatchSubtree
1742         );
1743
1744 /*
1745  * FUNCTION: Opens an existing directory object
1746  * ARGUMENTS:
1747  *        FileHandle (OUT) = Caller supplied storage for the resulting handle
1748  *        DesiredAccess = Requested access to the directory
1749  *        ObjectAttributes = Initialized attributes for the object
1750  * RETURNS: Status
1751  */
1752
1753 NTSTATUS
1754 STDCALL
1755 NtOpenDirectoryObject(
1756         OUT PHANDLE FileHandle,
1757         IN ACCESS_MASK DesiredAccess,
1758         IN POBJECT_ATTRIBUTES ObjectAttributes
1759         );
1760 NTSTATUS
1761 STDCALL
1762 ZwOpenDirectoryObject(
1763         OUT PHANDLE FileHandle,
1764         IN ACCESS_MASK DesiredAccess,
1765         IN POBJECT_ATTRIBUTES ObjectAttributes
1766         );
1767
1768 /*
1769  * FUNCTION: Opens an existing event
1770  * ARGUMENTS:
1771  *        EventHandle (OUT) = Caller supplied storage for the resulting handle
1772  *        DesiredAccess = Requested access to the event
1773  *        ObjectAttributes = Initialized attributes for the object
1774  * RETURNS: Status
1775  */
1776 NTSTATUS
1777 STDCALL
1778 NtOpenEvent(
1779         OUT PHANDLE EventHandle,
1780         IN ACCESS_MASK DesiredAccess,
1781         IN POBJECT_ATTRIBUTES ObjectAttributes
1782         );
1783
1784 NTSTATUS
1785 STDCALL
1786 ZwOpenEvent(
1787         OUT PHANDLE EventHandle,
1788         IN ACCESS_MASK DesiredAccess,
1789         IN POBJECT_ATTRIBUTES ObjectAttributes
1790         );
1791
1792 /*
1793  * FUNCTION: Opens an existing event pair
1794  * ARGUMENTS:
1795  *        EventHandle (OUT) = Caller supplied storage for the resulting handle
1796  *        DesiredAccess = Requested access to the event
1797  *        ObjectAttributes = Initialized attributes for the object
1798  * RETURNS: Status
1799  */
1800
1801 NTSTATUS
1802 STDCALL
1803 NtOpenEventPair(
1804         OUT PHANDLE EventPairHandle,
1805         IN ACCESS_MASK DesiredAccess,
1806         IN POBJECT_ATTRIBUTES ObjectAttributes
1807         );
1808
1809 NTSTATUS
1810 STDCALL
1811 ZwOpenEventPair(
1812         OUT PHANDLE EventPairHandle,
1813         IN ACCESS_MASK DesiredAccess,
1814         IN POBJECT_ATTRIBUTES ObjectAttributes
1815         );
1816 /*
1817  * FUNCTION: Opens an existing file
1818  * ARGUMENTS:
1819  *        FileHandle (OUT) = Caller supplied storage for the resulting handle
1820  *        DesiredAccess = Requested access to the file
1821  *        ObjectAttributes = Initialized attributes for the object
1822  *        IoStatusBlock =
1823  *        ShareAccess =
1824  *        OpenOptions =
1825  * RETURNS: Status
1826  */
1827 NTSTATUS
1828 STDCALL
1829 NtOpenFile(
1830         OUT PHANDLE FileHandle,
1831         IN ACCESS_MASK DesiredAccess,
1832         IN POBJECT_ATTRIBUTES ObjectAttributes,
1833         OUT PIO_STATUS_BLOCK IoStatusBlock,
1834         IN ULONG ShareAccess,
1835         IN ULONG OpenOptions
1836         );
1837
1838 NTSTATUS
1839 STDCALL
1840 ZwOpenFile(
1841         OUT PHANDLE FileHandle,
1842         IN ACCESS_MASK DesiredAccess,
1843         IN POBJECT_ATTRIBUTES ObjectAttributes,
1844         OUT PIO_STATUS_BLOCK IoStatusBlock,
1845         IN ULONG ShareAccess,
1846         IN ULONG OpenOptions
1847         );
1848
1849 /*
1850  * FUNCTION: Opens an existing io completion object
1851  * ARGUMENTS:
1852  *        CompletionPort (OUT) = Caller supplied storage for the resulting handle
1853  *        DesiredAccess = Requested access to the io completion object
1854  *        ObjectAttributes = Initialized attributes for the object
1855  * RETURNS: Status
1856  */
1857
1858 NTSTATUS
1859 STDCALL
1860 NtOpenIoCompletion(
1861         OUT PHANDLE CompetionPort,
1862         IN ACCESS_MASK DesiredAccess,
1863         IN POBJECT_ATTRIBUTES ObjectAttributes
1864         );
1865
1866 NTSTATUS
1867 STDCALL
1868 ZwOpenIoCompletion(
1869         OUT PHANDLE CompetionPort,
1870         IN ACCESS_MASK DesiredAccess,
1871         IN POBJECT_ATTRIBUTES ObjectAttributes
1872         );
1873
1874 /*
1875  * FUNCTION: Opens an existing key in the registry
1876  * ARGUMENTS:
1877  *        KeyHandle (OUT) = Caller supplied storage for the resulting handle
1878  *        DesiredAccess = Requested access to the key
1879  *        ObjectAttributes = Initialized attributes for the object
1880  * RETURNS: Status
1881  */
1882 NTSTATUS
1883 STDCALL
1884 NtOpenKey(
1885         OUT PHANDLE KeyHandle,
1886         IN ACCESS_MASK DesiredAccess,
1887         IN POBJECT_ATTRIBUTES ObjectAttributes
1888         );
1889
1890 NTSTATUS
1891 STDCALL
1892 ZwOpenKey(
1893         OUT PHANDLE KeyHandle,
1894         IN ACCESS_MASK DesiredAccess,
1895         IN POBJECT_ATTRIBUTES ObjectAttributes
1896         );
1897 /*
1898  * FUNCTION: Opens an existing key in the registry
1899  * ARGUMENTS:
1900  *        MutantHandle (OUT) = Caller supplied storage for the resulting handle
1901  *        DesiredAccess = Requested access to the mutant
1902  *        ObjectAttribute = Initialized attributes for the object
1903  * RETURNS: Status
1904  */
1905 NTSTATUS
1906 STDCALL
1907 NtOpenMutant(
1908         OUT PHANDLE MutantHandle,
1909         IN ACCESS_MASK DesiredAccess,
1910         IN POBJECT_ATTRIBUTES ObjectAttributes
1911         );
1912 NTSTATUS
1913 STDCALL
1914 ZwOpenMutant(
1915         OUT PHANDLE MutantHandle,
1916         IN ACCESS_MASK DesiredAccess,
1917         IN POBJECT_ATTRIBUTES ObjectAttributes
1918         );
1919
1920 /*
1921  * FUNCTION: Opens an existing process
1922  * ARGUMENTS:
1923  *        ProcessHandle (OUT) = Caller supplied storage for the resulting handle
1924  *        DesiredAccess = Requested access to the process
1925  *        ObjectAttribute = Initialized attributes for the object
1926  *        ClientId = Identifies the process id to open
1927  * RETURNS: Status
1928  */
1929 NTSTATUS
1930 STDCALL
1931 NtOpenProcess (
1932         OUT PHANDLE ProcessHandle,
1933         IN ACCESS_MASK DesiredAccess,
1934         IN POBJECT_ATTRIBUTES ObjectAttributes,
1935         IN PCLIENT_ID ClientId
1936         );
1937 NTSTATUS
1938 STDCALL
1939 ZwOpenProcess (
1940         OUT PHANDLE ProcessHandle,
1941         IN ACCESS_MASK DesiredAccess,
1942         IN POBJECT_ATTRIBUTES ObjectAttributes,
1943         IN PCLIENT_ID ClientId
1944         );
1945 /*
1946  * FUNCTION: Opens an existing process
1947  * ARGUMENTS:
1948  *        ProcessHandle  = Handle of the process of which owns the token
1949  *        DesiredAccess = Requested access to the token
1950  *        TokenHandle (OUT) = Caller supplies storage for the resulting token.
1951  * REMARKS:
1952         This function maps to the win32
1953  * RETURNS: Status
1954  */
1955
1956 NTSTATUS
1957 STDCALL
1958 NtOpenProcessToken(
1959         IN HANDLE ProcessHandle,
1960         IN ACCESS_MASK DesiredAccess,
1961         OUT PHANDLE TokenHandle
1962         );
1963
1964 NTSTATUS
1965 STDCALL
1966 ZwOpenProcessToken(
1967         IN HANDLE ProcessHandle,
1968         IN ACCESS_MASK DesiredAccess,
1969         OUT PHANDLE TokenHandle
1970         );
1971
1972 /*
1973  * FUNCTION: Opens an existing section object
1974  * ARGUMENTS:
1975  *        KeyHandle (OUT) = Caller supplied storage for the resulting handle
1976  *        DesiredAccess = Requested access to the key
1977  *        ObjectAttribute = Initialized attributes for the object
1978  * RETURNS: Status
1979  */
1980
1981 NTSTATUS
1982 STDCALL
1983 NtOpenSection(
1984         OUT PHANDLE SectionHandle,
1985         IN ACCESS_MASK DesiredAccess,
1986         IN POBJECT_ATTRIBUTES ObjectAttributes
1987         );
1988 NTSTATUS
1989 STDCALL
1990 ZwOpenSection(
1991         OUT PHANDLE SectionHandle,
1992         IN ACCESS_MASK DesiredAccess,
1993         IN POBJECT_ATTRIBUTES ObjectAttributes
1994         );
1995 /*
1996  * FUNCTION: Opens an existing semaphore
1997  * ARGUMENTS:
1998  *        SemaphoreHandle (OUT) = Caller supplied storage for the resulting handle
1999  *        DesiredAccess = Requested access to the semaphore
2000  *        ObjectAttribute = Initialized attributes for the object
2001  * RETURNS: Status
2002  */
2003 NTSTATUS
2004 STDCALL
2005 NtOpenSemaphore(
2006         IN HANDLE SemaphoreHandle,
2007         IN ACCESS_MASK DesiredAcces,
2008         IN POBJECT_ATTRIBUTES ObjectAttributes
2009         );
2010 NTSTATUS
2011 STDCALL
2012 ZwOpenSemaphore(
2013         IN HANDLE SemaphoreHandle,
2014         IN ACCESS_MASK DesiredAcces,
2015         IN POBJECT_ATTRIBUTES ObjectAttributes
2016         );
2017 /*
2018  * FUNCTION: Opens an existing symbolic link
2019  * ARGUMENTS:
2020  *        SymbolicLinkHandle (OUT) = Caller supplied storage for the resulting handle
2021  *        DesiredAccess = Requested access to the symbolic link
2022  *        ObjectAttribute = Initialized attributes for the object
2023  * RETURNS: Status
2024  */
2025 NTSTATUS
2026 STDCALL
2027 NtOpenSymbolicLinkObject(
2028         OUT PHANDLE SymbolicLinkHandle,
2029         IN ACCESS_MASK DesiredAccess,
2030         IN POBJECT_ATTRIBUTES ObjectAttributes
2031         );
2032 NTSTATUS
2033 STDCALL
2034 ZwOpenSymbolicLinkObject(
2035         OUT PHANDLE SymbolicLinkHandle,
2036         IN ACCESS_MASK DesiredAccess,
2037         IN POBJECT_ATTRIBUTES ObjectAttributes
2038         );
2039 /*
2040  * FUNCTION: Opens an existing thread
2041  * ARGUMENTS:
2042  *        ThreadHandle (OUT) = Caller supplied storage for the resulting handle
2043  *        DesiredAccess = Requested access to the thread
2044  *        ObjectAttribute = Initialized attributes for the object
2045  *        ClientId = Identifies the thread to open.
2046  * RETURNS: Status
2047  */
2048 NTSTATUS
2049 STDCALL
2050 NtOpenThread(
2051         OUT PHANDLE ThreadHandle,
2052         IN ACCESS_MASK DesiredAccess,
2053         IN POBJECT_ATTRIBUTES ObjectAttributes,
2054         IN PCLIENT_ID ClientId
2055         );
2056 NTSTATUS
2057 STDCALL
2058 ZwOpenThread(
2059         OUT PHANDLE ThreadHandle,
2060         IN ACCESS_MASK DesiredAccess,
2061         IN POBJECT_ATTRIBUTES ObjectAttributes,
2062         IN PCLIENT_ID ClientId
2063         );
2064
2065 NTSTATUS
2066 STDCALL
2067 NtOpenThreadToken(
2068         IN HANDLE ThreadHandle,
2069         IN ACCESS_MASK DesiredAccess,
2070         IN BOOLEAN OpenAsSelf,
2071         OUT PHANDLE TokenHandle
2072         );
2073
2074 NTSTATUS
2075 STDCALL
2076 ZwOpenThreadToken(
2077         IN HANDLE ThreadHandle,
2078         IN ACCESS_MASK DesiredAccess,
2079         IN BOOLEAN OpenAsSelf,
2080         OUT PHANDLE TokenHandle
2081         );
2082 /*
2083  * FUNCTION: Opens an existing timer
2084  * ARGUMENTS:
2085  *        TimerHandle (OUT) = Caller supplied storage for the resulting handle
2086  *        DesiredAccess = Requested access to the timer
2087  *        ObjectAttribute = Initialized attributes for the object
2088  * RETURNS: Status
2089  */
2090 NTSTATUS
2091 STDCALL
2092 NtOpenTimer(
2093         OUT PHANDLE TimerHandle,
2094         IN ACCESS_MASK DesiredAccess,
2095         IN POBJECT_ATTRIBUTES ObjectAttributes
2096         );
2097 NTSTATUS
2098 STDCALL
2099 ZwOpenTimer(
2100         OUT PHANDLE TimerHandle,
2101         IN ACCESS_MASK DesiredAccess,
2102         IN POBJECT_ATTRIBUTES ObjectAttributes
2103         );
2104
2105 /*
2106  * FUNCTION: Checks an access token for specific privileges
2107  * ARGUMENTS:
2108  *        ClientToken = Handle to a access token structure
2109  *        RequiredPrivileges = Specifies the requested privileges.
2110  *        Result = Caller supplies storage for the result. If PRIVILEGE_SET_ALL_NECESSARY is
2111                    set in the Control member of PRIVILEGES_SET Result
2112                    will only be TRUE if all privileges are present in the access token.
2113  * RETURNS: Status
2114  */
2115
2116 NTSTATUS
2117 STDCALL
2118 NtPrivilegeCheck(
2119         IN HANDLE ClientToken,
2120         IN PPRIVILEGE_SET RequiredPrivileges,
2121         IN PBOOLEAN Result
2122         );
2123
2124 NTSTATUS
2125 STDCALL
2126 ZwPrivilegeCheck(
2127         IN HANDLE ClientToken,
2128         IN PPRIVILEGE_SET RequiredPrivileges,
2129         IN PBOOLEAN Result
2130         );
2131
2132 NTSTATUS
2133 STDCALL
2134 NtPrivilegedServiceAuditAlarm(
2135         IN PUNICODE_STRING SubsystemName,
2136         IN PUNICODE_STRING ServiceName,
2137         IN HANDLE ClientToken,
2138         IN PPRIVILEGE_SET Privileges,
2139         IN BOOLEAN AccessGranted
2140         );
2141
2142 NTSTATUS
2143 STDCALL
2144 ZwPrivilegedServiceAuditAlarm(
2145         IN PUNICODE_STRING SubsystemName,
2146         IN PUNICODE_STRING ServiceName,
2147         IN HANDLE ClientToken,
2148         IN PPRIVILEGE_SET Privileges,
2149         IN BOOLEAN AccessGranted
2150         );
2151
2152 NTSTATUS
2153 STDCALL
2154 NtPrivilegeObjectAuditAlarm(
2155         IN PUNICODE_STRING SubsystemName,
2156         IN PVOID HandleId,
2157         IN HANDLE ClientToken,
2158         IN ULONG DesiredAccess,
2159         IN PPRIVILEGE_SET Privileges,
2160         IN BOOLEAN AccessGranted
2161         );
2162
2163 NTSTATUS
2164 STDCALL
2165 ZwPrivilegeObjectAuditAlarm(
2166         IN PUNICODE_STRING SubsystemName,
2167         IN PVOID HandleId,
2168         IN HANDLE ClientToken,
2169         IN ULONG DesiredAccess,
2170         IN PPRIVILEGE_SET Privileges,
2171         IN BOOLEAN AccessGranted
2172         );
2173
2174 /*
2175  * FUNCTION: Entry point for native applications
2176  * ARGUMENTS:
2177  *      Peb = Pointes to the Process Environment Block (PEB)
2178  * REMARKS:
2179  *      Native applications should use this function instead of a main.
2180  *      Calling proces should terminate itself.
2181  * RETURNS: Status
2182  */
2183 VOID STDCALL
2184 NtProcessStartup(
2185         IN      PPEB    Peb
2186         );
2187
2188
2189 /*
2190  * FUNCTION: Signals an event and resets it afterwards.
2191  * ARGUMENTS:
2192  *        EventHandle  = Handle to the event
2193  *        PulseCount = Number of times the action is repeated
2194  * RETURNS: Status
2195  */
2196 NTSTATUS
2197 STDCALL
2198 NtPulseEvent(
2199         IN HANDLE EventHandle,
2200         IN PULONG PulseCount OPTIONAL
2201         );
2202
2203 NTSTATUS
2204 STDCALL
2205 ZwPulseEvent(
2206         IN HANDLE EventHandle,
2207         IN PULONG PulseCount OPTIONAL
2208         );
2209
2210 /*
2211  * FUNCTION: Queries the attributes of a file
2212  * ARGUMENTS:
2213  *        ObjectAttributes = Initialized attributes for the object
2214  *        Buffer = Caller supplies storage for the attributes
2215  * RETURNS: Status
2216  */
2217
2218 NTSTATUS STDCALL
2219 NtQueryAttributesFile(IN POBJECT_ATTRIBUTES ObjectAttributes,
2220                       OUT PFILE_BASIC_INFORMATION FileInformation);
2221
2222 NTSTATUS STDCALL
2223 ZwQueryAttributesFile(IN POBJECT_ATTRIBUTES ObjectAttributes,
2224                       OUT PFILE_BASIC_INFORMATION FileInformation);
2225
2226 /*
2227  * FUNCTION: Queries the default locale id
2228  * ARGUMENTS:
2229  *        UserProfile = Type of locale id
2230  *              TRUE: thread locale id
2231  *              FALSE: system locale id
2232  *        DefaultLocaleId = Caller supplies storage for the locale id
2233  * RETURNS: Status
2234  */
2235
2236 NTSTATUS
2237 STDCALL
2238 NtQueryDefaultLocale(
2239         IN BOOLEAN UserProfile,
2240         OUT PLCID DefaultLocaleId
2241         );
2242
2243 NTSTATUS
2244 STDCALL
2245 ZwQueryDefaultLocale(
2246         IN BOOLEAN UserProfile,
2247         OUT PLCID DefaultLocaleId
2248         );
2249
2250 /*
2251  * FUNCTION: Queries a directory file.
2252  * ARGUMENTS:
2253  *        FileHandle = Handle to a directory file
2254  *        EventHandle  = Handle to the event signaled on completion
2255  *        ApcRoutine = Asynchroneous procedure callback, called on completion
2256  *        ApcContext = Argument to the apc.
2257  *        IoStatusBlock = Caller supplies storage for extended status information.
2258  *        FileInformation = Caller supplies storage for the resulting information.
2259  *
2260  *              FileNameInformation             FILE_NAMES_INFORMATION
2261  *              FileDirectoryInformation        FILE_DIRECTORY_INFORMATION
2262  *              FileFullDirectoryInformation    FILE_FULL_DIRECTORY_INFORMATION
2263  *              FileBothDirectoryInformation    FILE_BOTH_DIR_INFORMATION
2264  *
2265  *        Length = Size of the storage supplied
2266  *        FileInformationClass = Indicates the type of information requested.
2267  *        ReturnSingleEntry = Specify true if caller only requests the first directory found.
2268  *        FileName = Initial directory name to query, that may contain wild cards.
2269  *        RestartScan = Number of times the action should be repeated
2270  * RETURNS: Status [ STATUS_SUCCESS, STATUS_ACCESS_DENIED, STATUS_INSUFFICIENT_RESOURCES,
2271  *                   STATUS_INVALID_PARAMETER, STATUS_INVALID_DEVICE_REQUEST, STATUS_BUFFER_OVERFLOW,
2272  *                   STATUS_INVALID_INFO_CLASS, STATUS_NO_SUCH_FILE, STATUS_NO_MORE_FILES ]
2273  */
2274
2275 NTSTATUS
2276 STDCALL
2277 NtQueryDirectoryFile(
2278         IN HANDLE FileHandle,
2279         IN HANDLE Event OPTIONAL,
2280         IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
2281         IN PVOID ApcContext OPTIONAL,
2282         OUT PIO_STATUS_BLOCK IoStatusBlock,
2283         OUT PVOID FileInformation,
2284         IN ULONG Length,
2285         IN FILE_INFORMATION_CLASS FileInformationClass,
2286         IN BOOLEAN ReturnSingleEntry,
2287         IN PUNICODE_STRING FileName OPTIONAL,
2288         IN BOOLEAN RestartScan
2289         );
2290
2291 NTSTATUS
2292 STDCALL
2293 ZwQueryDirectoryFile(
2294         IN HANDLE FileHandle,
2295         IN HANDLE Event OPTIONAL,
2296         IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
2297         IN PVOID ApcContext OPTIONAL,
2298         OUT PIO_STATUS_BLOCK IoStatusBlock,
2299         OUT PVOID FileInformation,
2300         IN ULONG Length,
2301         IN FILE_INFORMATION_CLASS FileInformationClass,
2302         IN BOOLEAN ReturnSingleEntry,
2303         IN PUNICODE_STRING FileName OPTIONAL,
2304         IN BOOLEAN RestartScan
2305         );
2306
2307 /*
2308  * FUNCTION: Queries the extended attributes of a file
2309  * ARGUMENTS:
2310  *        FileHandle  = Handle to the event
2311  *        IoStatusBlock = Number of times the action is repeated
2312  *        Buffer
2313  *        Length
2314  *        ReturnSingleEntry
2315  *        EaList
2316  *        EaListLength
2317  *        EaIndex
2318  *        RestartScan
2319  * RETURNS: Status
2320  */
2321
2322 NTSTATUS
2323 STDCALL
2324 NtQueryEaFile(
2325         IN HANDLE FileHandle,
2326         OUT PIO_STATUS_BLOCK IoStatusBlock,
2327         OUT PVOID Buffer,
2328         IN ULONG Length,
2329         IN BOOLEAN ReturnSingleEntry,
2330         IN PVOID EaList OPTIONAL,
2331         IN ULONG EaListLength,
2332         IN PULONG EaIndex OPTIONAL,
2333         IN BOOLEAN RestartScan
2334         );
2335
2336 NTSTATUS
2337 STDCALL
2338 ZwQueryEaFile(
2339         IN HANDLE FileHandle,
2340         OUT PIO_STATUS_BLOCK IoStatusBlock,
2341         OUT PVOID Buffer,
2342         IN ULONG Length,
2343         IN BOOLEAN ReturnSingleEntry,
2344         IN PVOID EaList OPTIONAL,
2345         IN ULONG EaListLength,
2346         IN PULONG EaIndex OPTIONAL,
2347         IN BOOLEAN RestartScan
2348         );
2349
2350 /*
2351  * FUNCTION: Queries an event
2352  * ARGUMENTS:
2353  *        EventHandle  = Handle to the event
2354  *        EventInformationClass = Index of the information structure
2355
2356           EventBasicInformation         EVENT_BASIC_INFORMATION
2357
2358  *        EventInformation = Caller supplies storage for the information structure
2359  *        EventInformationLength =  Size of the information structure
2360  *        ReturnLength = Data written
2361  * RETURNS: Status
2362  */
2363 NTSTATUS
2364 STDCALL
2365 NtQueryEvent(
2366         IN HANDLE EventHandle,
2367         IN EVENT_INFORMATION_CLASS EventInformationClass,
2368         OUT PVOID EventInformation,
2369         IN ULONG EventInformationLength,
2370         OUT PULONG ReturnLength
2371         );
2372 NTSTATUS
2373 STDCALL
2374 ZwQueryEvent(
2375         IN HANDLE EventHandle,
2376         IN EVENT_INFORMATION_CLASS EventInformationClass,
2377         OUT PVOID EventInformation,
2378         IN ULONG EventInformationLength,
2379         OUT PULONG ReturnLength
2380         );
2381
2382 NTSTATUS STDCALL
2383 NtQueryFullAttributesFile(IN POBJECT_ATTRIBUTES ObjectAttributes,
2384                           OUT PFILE_NETWORK_OPEN_INFORMATION FileInformation);
2385
2386 NTSTATUS STDCALL
2387 ZwQueryFullAttributesFile(IN POBJECT_ATTRIBUTES ObjectAttributes,
2388                           OUT PFILE_NETWORK_OPEN_INFORMATION FileInformation);
2389
2390 /*
2391  * FUNCTION: Queries the information of a file object.
2392  * ARGUMENTS:
2393  *        FileHandle = Handle to the file object
2394  *        IoStatusBlock = Caller supplies storage for extended information
2395  *                        on the current operation.
2396  *        FileInformation = Storage for the new file information
2397  *        Lenght = Size of the storage for the file information.
2398  *        FileInformationClass = Indicates which file information is queried
2399
2400           FileDirectoryInformation              FILE_DIRECTORY_INFORMATION
2401           FileFullDirectoryInformation          FILE_FULL_DIRECTORY_INFORMATION
2402           FileBothDirectoryInformation          FILE_BOTH_DIRECTORY_INFORMATION
2403           FileBasicInformation                  FILE_BASIC_INFORMATION
2404           FileStandardInformation               FILE_STANDARD_INFORMATION
2405           FileInternalInformation               FILE_INTERNAL_INFORMATION
2406           FileEaInformation                     FILE_EA_INFORMATION
2407           FileAccessInformation                 FILE_ACCESS_INFORMATION
2408           FileNameInformation                   FILE_NAME_INFORMATION
2409           FileRenameInformation                 FILE_RENAME_INFORMATION
2410           FileLinkInformation
2411           FileNamesInformation                  FILE_NAMES_INFORMATION
2412           FileDispositionInformation            FILE_DISPOSITION_INFORMATION
2413           FilePositionInformation               FILE_POSITION_INFORMATION
2414           FileFullEaInformation                 FILE_FULL_EA_INFORMATION
2415           FileModeInformation                   FILE_MODE_INFORMATION
2416           FileAlignmentInformation              FILE_ALIGNMENT_INFORMATION
2417           FileAllInformation                    FILE_ALL_INFORMATION
2418
2419           FileEndOfFileInformation              FILE_END_OF_FILE_INFORMATION
2420           FileAlternateNameInformation
2421           FileStreamInformation                 FILE_STREAM_INFORMATION
2422           FilePipeInformation
2423           FilePipeLocalInformation
2424           FilePipeRemoteInformation
2425           FileMailslotQueryInformation
2426           FileMailslotSetInformation
2427           FileCompressionInformation            FILE_COMPRESSION_INFORMATION
2428           FileCopyOnWriteInformation
2429           FileCompletionInformation             IO_COMPLETION_CONTEXT
2430           FileMoveClusterInformation
2431           FileOleClassIdInformation
2432           FileOleStateBitsInformation
2433           FileNetworkOpenInformation            FILE_NETWORK_OPEN_INFORMATION
2434           FileObjectIdInformation
2435           FileOleAllInformation
2436           FileOleDirectoryInformation
2437           FileContentIndexInformation
2438           FileInheritContentIndexInformation
2439           FileOleInformation
2440           FileMaximumInformation
2441
2442  * REMARK:
2443  *        This procedure maps to the win32 GetShortPathName, GetLongPathName,
2444           GetFullPathName, GetFileType, GetFileSize, GetFileTime  functions.
2445  * RETURNS: Status
2446  */
2447 NTSTATUS
2448 STDCALL
2449 NtQueryInformationFile(
2450         IN HANDLE FileHandle,
2451         OUT PIO_STATUS_BLOCK IoStatusBlock,
2452         OUT PVOID FileInformation,
2453         IN ULONG Length,
2454         IN FILE_INFORMATION_CLASS FileInformationClass
2455         );
2456
2457 NTSTATUS
2458 STDCALL
2459 ZwQueryInformationFile(
2460         HANDLE FileHandle,
2461         PIO_STATUS_BLOCK IoStatusBlock,
2462         PVOID FileInformation,
2463         ULONG Length,
2464         FILE_INFORMATION_CLASS FileInformationClass
2465         );
2466
2467
2468 NTSTATUS STDCALL
2469 NtQueryInformationPort (HANDLE PortHandle,
2470                         CINT PortInformationClass,
2471                         PVOID PortInformation,
2472                         ULONG PortInformationLength,
2473                         PULONG ReturnLength);
2474
2475 #ifndef __USE_W32API
2476 NTSTATUS STDCALL
2477 ZwQueryInformationPort (HANDLE PortHandle,
2478                         CINT PortInformationClass,
2479                         PVOID PortInformation,
2480                         ULONG PortInformationLength,
2481                         PULONG ReturnLength);
2482 #endif
2483
2484 /*
2485  * FUNCTION: Queries the information of a thread object.
2486  * ARGUMENTS:
2487  *        ThreadHandle = Handle to the thread object
2488  *        ThreadInformationClass = Index to a certain information structure
2489
2490                 ThreadBasicInformation                  THREAD_BASIC_INFORMATION
2491                 ThreadTimes                             KERNEL_USER_TIMES
2492                 ThreadPriority                          KPRIORITY
2493                 ThreadBasePriority                      KPRIORITY
2494                 ThreadAffinityMask                      KAFFINITY
2495                 ThreadImpersonationToken
2496                 ThreadDescriptorTableEntry
2497                 ThreadEnableAlignmentFaultFixup
2498                 ThreadEventPair
2499                 ThreadQuerySetWin32StartAddress
2500                 ThreadZeroTlsCell
2501                 ThreadPerformanceCount
2502                 ThreadAmILastThread                     BOOLEAN
2503                 ThreadIdealProcessor                    ULONG
2504                 ThreadPriorityBoost                     ULONG
2505                 MaxThreadInfoClass
2506
2507
2508  *        ThreadInformation = Caller supplies torage for the thread information
2509  *        ThreadInformationLength = Size of the thread information structure
2510  *        ReturnLength  = Actual number of bytes written
2511
2512  * REMARK:
2513  *        This procedure maps to the win32 GetThreadTimes, GetThreadPriority,
2514           GetThreadPriorityBoost   functions.
2515  * RETURNS: Status
2516 */
2517
2518
2519 NTSTATUS
2520 STDCALL
2521 NtQueryInformationThread(
2522         IN HANDLE ThreadHandle,
2523         IN THREADINFOCLASS ThreadInformationClass,
2524         OUT PVOID ThreadInformation,
2525         IN ULONG ThreadInformationLength,
2526         OUT PULONG ReturnLength
2527         );
2528
2529
2530 NTSTATUS
2531 STDCALL
2532 NtQueryInformationToken(
2533         IN HANDLE TokenHandle,
2534         IN TOKEN_INFORMATION_CLASS TokenInformationClass,
2535         OUT PVOID TokenInformation,
2536         IN ULONG TokenInformationLength,
2537         OUT PULONG ReturnLength
2538         );
2539
2540 NTSTATUS
2541 STDCALL
2542 ZwQueryInformationToken(
2543         IN HANDLE TokenHandle,
2544         IN TOKEN_INFORMATION_CLASS TokenInformationClass,
2545         OUT PVOID TokenInformation,
2546         IN ULONG TokenInformationLength,
2547         OUT PULONG ReturnLength
2548         );
2549
2550 NTSTATUS
2551 STDCALL
2552 NtQueryIoCompletion(
2553    IN  HANDLE                          IoCompletionHandle,
2554    IN  IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass,
2555    OUT PVOID                           IoCompletionInformation,
2556    IN  ULONG                           IoCompletionInformationLength,
2557    OUT PULONG                          ResultLength OPTIONAL
2558    );
2559
2560 NTSTATUS
2561 STDCALL
2562 ZwQueryIoCompletion(
2563    IN  HANDLE                          IoCompletionHandle,
2564    IN  IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass,
2565    OUT PVOID                           IoCompletionInformation,
2566    IN  ULONG                           IoCompletionInformationLength,
2567    OUT PULONG                          ResultLength OPTIONAL
2568    );
2569
2570 /*
2571  * FUNCTION: Queries the information of a registry key object.
2572  * ARGUMENTS:
2573         KeyHandle = Handle to a registry key
2574         KeyInformationClass = Index to a certain information structure
2575         KeyInformation = Caller supplies storage for resulting information
2576         Length = Size of the supplied storage
2577         ResultLength = Bytes written
2578  */
2579 NTSTATUS
2580 STDCALL
2581 NtQueryKey(
2582         IN HANDLE KeyHandle,
2583         IN KEY_INFORMATION_CLASS KeyInformationClass,
2584         OUT PVOID KeyInformation,
2585         IN ULONG Length,
2586         OUT PULONG ResultLength
2587         );
2588
2589 NTSTATUS
2590 STDCALL
2591 ZwQueryKey(
2592         IN HANDLE KeyHandle,
2593         IN KEY_INFORMATION_CLASS KeyInformationClass,
2594         OUT PVOID KeyInformation,
2595         IN ULONG Length,
2596         OUT PULONG ResultLength
2597         );
2598
2599
2600 // draft
2601
2602 NTSTATUS
2603 STDCALL
2604 NtQueryMultipleValueKey(
2605         IN HANDLE KeyHandle,
2606         IN OUT PKEY_VALUE_ENTRY ValueList,
2607         IN ULONG NumberOfValues,
2608         OUT PVOID Buffer,
2609         IN OUT PULONG Length,
2610         OUT PULONG ReturnLength
2611         );
2612
2613 NTSTATUS
2614 STDCALL
2615 ZwQueryMultipleValueKey(
2616         IN HANDLE KeyHandle,
2617         IN OUT PKEY_VALUE_ENTRY ValueList,
2618         IN ULONG NumberOfValues,
2619         OUT PVOID Buffer,
2620         IN OUT PULONG Length,
2621         OUT PULONG ReturnLength
2622         );
2623
2624 /*
2625  * FUNCTION: Queries the information of a mutant object.
2626  * ARGUMENTS:
2627         MutantHandle = Handle to a mutant
2628         MutantInformationClass = Index to a certain information structure
2629         MutantInformation = Caller supplies storage for resulting information
2630         Length = Size of the supplied storage
2631         ResultLength = Bytes written
2632  */
2633 NTSTATUS
2634 STDCALL
2635 NtQueryMutant(
2636         IN HANDLE MutantHandle,
2637         IN CINT MutantInformationClass,
2638         OUT PVOID MutantInformation,
2639         IN ULONG Length,
2640         OUT PULONG ResultLength
2641         );
2642
2643 NTSTATUS
2644 STDCALL
2645 ZwQueryMutant(
2646         IN HANDLE MutantHandle,
2647         IN CINT MutantInformationClass,
2648         OUT PVOID MutantInformation,
2649         IN ULONG Length,
2650         OUT PULONG ResultLength
2651         );
2652
2653 /*
2654  * FUNCTION: Queries the system ( high-resolution ) performance counter.
2655  * ARGUMENTS:
2656  *        Counter = Performance counter
2657  *        Frequency = Performance frequency
2658  * REMARKS:
2659         This procedure queries a tick count faster than 10ms ( The resolution for  Intel®-based CPUs is about 0.8 microseconds.)
2660         This procedure maps to the win32 QueryPerformanceCounter, QueryPerformanceFrequency
2661  * RETURNS: Status
2662  *
2663 */
2664 NTSTATUS
2665 STDCALL
2666 NtQueryPerformanceCounter(
2667         IN PLARGE_INTEGER Counter,
2668         IN PLARGE_INTEGER Frequency
2669         );
2670
2671 NTSTATUS
2672 STDCALL
2673 ZwQueryPerformanceCounter(
2674         IN PLARGE_INTEGER Counter,
2675         IN PLARGE_INTEGER Frequency
2676         );
2677
2678 /*
2679  * FUNCTION: Queries the information of a semaphore.
2680  * ARGUMENTS:
2681  *        SemaphoreHandle = Handle to the semaphore object
2682  *        SemaphoreInformationClass = Index to a certain information structure
2683
2684           SemaphoreBasicInformation     SEMAPHORE_BASIC_INFORMATION
2685
2686  *        SemaphoreInformation = Caller supplies storage for the semaphore information structure
2687  *        Length = Size of the infomation structure
2688  */
2689 NTSTATUS
2690 STDCALL
2691 NtQuerySemaphore(
2692         IN      HANDLE                          SemaphoreHandle,
2693         IN      SEMAPHORE_INFORMATION_CLASS     SemaphoreInformationClass,
2694         OUT     PVOID                           SemaphoreInformation,
2695         IN      ULONG                           Length,
2696         OUT     PULONG                          ReturnLength
2697         );
2698
2699 NTSTATUS
2700 STDCALL
2701 ZwQuerySemaphore(
2702         IN      HANDLE                          SemaphoreHandle,
2703         IN      SEMAPHORE_INFORMATION_CLASS     SemaphoreInformationClass,
2704         OUT     PVOID                           SemaphoreInformation,
2705         IN      ULONG                           Length,
2706         OUT     PULONG                          ReturnLength
2707         );
2708
2709
2710 /*
2711  * FUNCTION: Queries the information of a symbolic link object.
2712  * ARGUMENTS:
2713  *        SymbolicLinkHandle = Handle to the symbolic link object
2714  *        LinkTarget = resolved name of link
2715  *        DataWritten = size of the LinkName.
2716  * RETURNS: Status
2717  *
2718 */
2719 NTSTATUS
2720 STDCALL
2721 NtQuerySymbolicLinkObject(
2722         IN HANDLE               SymLinkObjHandle,
2723         OUT PUNICODE_STRING     LinkTarget,
2724         OUT PULONG              DataWritten OPTIONAL
2725         );
2726
2727 NTSTATUS
2728 STDCALL
2729 ZwQuerySymbolicLinkObject(
2730         IN HANDLE               SymLinkObjHandle,
2731         OUT PUNICODE_STRING     LinkName,
2732         OUT PULONG              DataWritten OPTIONAL
2733         );
2734
2735
2736 /*
2737  * FUNCTION: Queries a system environment variable.
2738  * ARGUMENTS:
2739  *        Name = Name of the variable
2740  *        Value (OUT) = value of the variable
2741  *        Length = size of the buffer
2742  *        ReturnLength = data written
2743  * RETURNS: Status
2744  *
2745 */
2746 NTSTATUS
2747 STDCALL
2748 NtQuerySystemEnvironmentValue(
2749         IN PUNICODE_STRING Name,
2750         OUT PVOID Value,
2751         ULONG Length,
2752         PULONG ReturnLength
2753         );
2754
2755 NTSTATUS
2756 STDCALL
2757 ZwQuerySystemEnvironmentValue(
2758         IN PUNICODE_STRING Name,
2759         OUT PVOID Value,
2760         ULONG Length,
2761         PULONG ReturnLength
2762         );
2763
2764
2765 /*
2766  * FUNCTION: Queries the system information.
2767  * ARGUMENTS:
2768  *        SystemInformationClass = Index to a certain information structure
2769
2770           SystemTimeAdjustmentInformation       SYSTEM_TIME_ADJUSTMENT
2771           SystemCacheInformation                SYSTEM_CACHE_INFORMATION
2772           SystemConfigurationInformation        CONFIGURATION_INFORMATION
2773
2774  *        SystemInformation = caller supplies storage for the information structure
2775  *        Length = size of the structure
2776           ResultLength = Data written
2777  * RETURNS: Status
2778  *
2779 */
2780 NTSTATUS
2781 STDCALL
2782 NtQuerySystemInformation(
2783         IN      SYSTEM_INFORMATION_CLASS        SystemInformationClass,
2784         OUT     PVOID                           SystemInformation,
2785         IN      ULONG                           Length,
2786         OUT     PULONG                          ResultLength
2787         );
2788
2789 NTSTATUS
2790 STDCALL
2791 ZwQuerySystemInformation(
2792         IN      SYSTEM_INFORMATION_CLASS        SystemInformationClass,
2793         OUT     PVOID                           SystemInformation,
2794         IN      ULONG                           Length,
2795         OUT     PULONG                          ResultLength
2796         );
2797
2798 /*
2799  * FUNCTION: Queries information about a timer
2800  * ARGUMENTS:
2801  *        TimerHandle  = Handle to the timer
2802           TimerValueInformationClass = Index to a certain information structure
2803           TimerValueInformation = Caller supplies storage for the information structure
2804           Length = Size of the information structure
2805           ResultLength = Data written
2806  * RETURNS: Status
2807  *
2808 */
2809 NTSTATUS
2810 STDCALL
2811 NtQueryTimer(
2812         IN HANDLE TimerHandle,
2813         IN CINT TimerInformationClass,
2814         OUT PVOID TimerInformation,
2815         IN ULONG Length,
2816         OUT PULONG ResultLength
2817         );
2818 NTSTATUS
2819 STDCALL
2820 ZwQueryTimer(
2821         IN HANDLE TimerHandle,
2822         IN CINT TimerInformationClass,
2823         OUT PVOID TimerInformation,
2824         IN ULONG Length,
2825         OUT PULONG ResultLength
2826         );
2827
2828 /*
2829  * FUNCTION: Queries the timer resolution
2830  * ARGUMENTS:
2831  *        MinimumResolution (OUT) = Caller should supply storage for the resulting time.
2832           Maximum Resolution (OUT) = Caller should supply storage for the resulting time.
2833           ActualResolution (OUT) = Caller should supply storage for the resulting time.
2834  * RETURNS: Status
2835  *
2836 */
2837
2838
2839 NTSTATUS
2840 STDCALL
2841 NtQueryTimerResolution (
2842         OUT PULONG MinimumResolution,
2843         OUT PULONG MaximumResolution,
2844         OUT PULONG ActualResolution
2845         );
2846
2847 NTSTATUS
2848 STDCALL
2849 ZwQueryTimerResolution (
2850         OUT PULONG MinimumResolution,
2851         OUT PULONG MaximumResolution,
2852         OUT PULONG ActualResolution
2853         );
2854
2855 /*
2856  * FUNCTION: Queries a registry key value
2857  * ARGUMENTS:
2858  *        KeyHandle  = Handle to the registry key
2859           ValueName = Name of the value in the registry key
2860           KeyValueInformationClass = Index to a certain information structure
2861
2862                 KeyValueBasicInformation = KEY_VALUE_BASIC_INFORMATION
2863                 KeyValueFullInformation = KEY_FULL_INFORMATION
2864                 KeyValuePartialInformation = KEY_VALUE_PARTIAL_INFORMATION
2865
2866           KeyValueInformation = Caller supplies storage for the information structure
2867           Length = Size of the information structure
2868           ResultLength = Data written
2869  * RETURNS: Status
2870  *
2871 */
2872 NTSTATUS
2873 STDCALL
2874 NtQueryValueKey(
2875         IN HANDLE KeyHandle,
2876         IN PUNICODE_STRING ValueName,
2877         IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
2878         OUT PVOID KeyValueInformation,
2879         IN ULONG Length,
2880         OUT PULONG ResultLength
2881         );
2882
2883 NTSTATUS
2884 STDCALL
2885 ZwQueryValueKey(
2886         IN HANDLE KeyHandle,
2887         IN PUNICODE_STRING ValueName,
2888         IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
2889         OUT PVOID KeyValueInformation,
2890         IN ULONG Length,
2891         OUT PULONG ResultLength
2892         );
2893
2894 /*
2895  * FUNCTION: Queries the volume information
2896  * ARGUMENTS:
2897  *        FileHandle  = Handle to a file object on the target volume
2898  *        IoStatusBlock = Caller should supply storage for additional status information
2899  *        ReturnLength = DataWritten
2900  *        FsInformation = Caller should supply storage for the information structure.
2901  *        Length = Size of the information structure
2902  *        FsInformationClass = Index to a information structure
2903
2904                 FileFsVolumeInformation         FILE_FS_VOLUME_INFORMATION
2905                 FileFsLabelInformation          FILE_FS_LABEL_INFORMATION
2906                 FileFsSizeInformation           FILE_FS_SIZE_INFORMATION
2907                 FileFsDeviceInformation         FILE_FS_DEVICE_INFORMATION
2908                 FileFsAttributeInformation      FILE_FS_ATTRIBUTE_INFORMATION
2909                 FileFsControlInformation
2910                 FileFsQuotaQueryInformation     --
2911                 FileFsQuotaSetInformation       --
2912                 FileFsMaximumInformation
2913
2914  * RETURNS: Status [ STATUS_SUCCESS | STATUS_INSUFFICIENT_RESOURCES | STATUS_INVALID_PARAMETER |
2915                  STATUS_INVALID_DEVICE_REQUEST | STATUS_BUFFER_OVERFLOW ]
2916  *
2917 */
2918 NTSTATUS
2919 STDCALL
2920 NtQueryVolumeInformationFile(
2921         IN HANDLE FileHandle,
2922         OUT PIO_STATUS_BLOCK IoStatusBlock,
2923         OUT PVOID FsInformation,
2924         IN ULONG Length,
2925         IN FS_INFORMATION_CLASS FsInformationClass
2926         );
2927
2928 NTSTATUS
2929 STDCALL
2930 ZwQueryVolumeInformationFile(
2931         IN HANDLE FileHandle,
2932         OUT PIO_STATUS_BLOCK IoStatusBlock,
2933         OUT PVOID FsInformation,
2934         IN ULONG Length,
2935         IN FS_INFORMATION_CLASS FsInformationClass
2936         );
2937 // draft
2938 // FIXME: Should I specify if the apc is user or kernel mode somewhere ??
2939 /*
2940  * FUNCTION: Queues a (user) apc to a thread.
2941  * ARGUMENTS:
2942           ThreadHandle = Thread to which the apc is queued.
2943           ApcRoutine = Points to the apc routine
2944           NormalContext = Argument to Apc Routine
2945  *        SystemArgument1 = Argument of the Apc Routine
2946           SystemArgument2 = Argument of the Apc Routine
2947  * REMARK: If the apc is queued against a thread of a different process than the calling thread
2948                 the apc routine should be specified in the address space of the queued thread's process.
2949  * RETURNS: Status
2950 */
2951
2952 NTSTATUS
2953 STDCALL
2954 NtQueueApcThread(
2955         HANDLE ThreadHandle,
2956         PKNORMAL_ROUTINE ApcRoutine,
2957         PVOID NormalContext,
2958         PVOID SystemArgument1,
2959         PVOID SystemArgument2);
2960
2961 NTSTATUS
2962 STDCALL
2963 ZwQueueApcThread(
2964         HANDLE ThreadHandle,
2965         PKNORMAL_ROUTINE ApcRoutine,
2966         PVOID NormalContext,
2967         PVOID SystemArgument1,
2968         PVOID SystemArgument2);
2969
2970
2971 /*
2972  * FUNCTION: Raises an exception
2973  * ARGUMENTS:
2974  *        ExceptionRecord = Structure specifying the exception
2975  *        Context = Context in which the excpetion is raised
2976  *        IsDebugger =
2977  * RETURNS: Status
2978  *
2979 */
2980
2981 NTSTATUS
2982 STDCALL
2983 NtRaiseException(
2984         IN PEXCEPTION_RECORD ExceptionRecord,
2985         IN PCONTEXT Context,
2986         IN BOOLEAN SearchFrames
2987         );
2988
2989 NTSTATUS
2990 STDCALL
2991 ZwRaiseException(
2992         IN PEXCEPTION_RECORD ExceptionRecord,
2993         IN PCONTEXT Context,
2994         IN BOOLEAN SearchFrames
2995         );
2996
2997 /*
2998  * FUNCTION: Read a file
2999  * ARGUMENTS:
3000  *        FileHandle = Handle of a file to read
3001  *        Event = This event is signalled when the read operation completes
3002  *        UserApcRoutine = Call back , if supplied Event should be NULL
3003  *        UserApcContext = Argument to the callback
3004  *        IoStatusBlock = Caller should supply storage for additional status information
3005  *        Buffer = Caller should supply storage to receive the information
3006  *        BufferLength = Size of the buffer
3007  *        ByteOffset = Offset to start reading the file
3008  *        Key = If a range is lock a matching key will allow the read to continue.
3009  * RETURNS: Status
3010  *
3011  */
3012
3013 NTSTATUS
3014 STDCALL
3015 NtReadFile(
3016         IN HANDLE FileHandle,
3017         IN HANDLE Event OPTIONAL,
3018         IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,
3019         IN PVOID UserApcContext OPTIONAL,
3020         OUT PIO_STATUS_BLOCK IoStatusBlock,
3021         OUT PVOID Buffer,
3022         IN ULONG BufferLength,
3023         IN PLARGE_INTEGER ByteOffset OPTIONAL,
3024         IN PULONG Key OPTIONAL
3025         );
3026
3027 NTSTATUS
3028 STDCALL
3029 ZwReadFile(
3030         IN HANDLE FileHandle,
3031         IN HANDLE Event OPTIONAL,
3032         IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,
3033         IN PVOID UserApcContext OPTIONAL,
3034         OUT PIO_STATUS_BLOCK IoStatusBlock,
3035         OUT PVOID Buffer,
3036         IN ULONG BufferLength,
3037         IN PLARGE_INTEGER ByteOffset OPTIONAL,
3038         IN PULONG Key OPTIONAL
3039         );
3040 /*
3041  * FUNCTION: Read a file using scattered io
3042  * ARGUMENTS:
3043           FileHandle = Handle of a file to read
3044           Event = This event is signalled when the read operation completes
3045  *        UserApcRoutine = Call back , if supplied Event should be NULL
3046           UserApcContext = Argument to the callback
3047           IoStatusBlock = Caller should supply storage for additional status information
3048           BufferDescription = Caller should supply storage to receive the information
3049           BufferLength = Size of the buffer
3050           ByteOffset = Offset to start reading the file
3051           Key =  Key = If a range is lock a matching key will allow the read to continue.
3052  * RETURNS: Status
3053  *
3054 */
3055 NTSTATUS
3056 STDCALL
3057 NtReadFileScatter(
3058         IN HANDLE FileHandle,
3059         IN HANDLE Event OPTIONAL,
3060         IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,
3061         IN  PVOID UserApcContext OPTIONAL,
3062         OUT PIO_STATUS_BLOCK UserIoStatusBlock,
3063         IN FILE_SEGMENT_ELEMENT BufferDescription[],
3064         IN ULONG BufferLength,
3065         IN PLARGE_INTEGER ByteOffset,
3066         IN PULONG Key OPTIONAL
3067         );
3068
3069 NTSTATUS
3070 STDCALL
3071 ZwReadFileScatter(
3072         IN HANDLE FileHandle,
3073         IN HANDLE Event OPTIONAL,
3074         IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,
3075         IN  PVOID UserApcContext OPTIONAL,
3076         OUT PIO_STATUS_BLOCK UserIoStatusBlock,
3077         IN FILE_SEGMENT_ELEMENT BufferDescription[],
3078         IN ULONG BufferLength,
3079         IN PLARGE_INTEGER ByteOffset,
3080         IN PULONG Key OPTIONAL
3081         );
3082
3083
3084 NTSTATUS STDCALL
3085 NtReadRequestData (HANDLE PortHandle,
3086                    PLPC_MESSAGE Message,
3087                    ULONG Index,
3088                    PVOID Buffer,
3089                    ULONG BufferLength,
3090                    PULONG ReturnLength);
3091
3092 NTSTATUS STDCALL
3093 ZwReadRequestData (HANDLE PortHandle,
3094                    PLPC_MESSAGE Message,
3095                    ULONG Index,
3096                    PVOID Buffer,
3097                    ULONG BufferLength,
3098                    PULONG ReturnLength);
3099
3100
3101 /*
3102  * FUNCTION: Copies a range of virtual memory to a buffer
3103  * ARGUMENTS:
3104  *       ProcessHandle = Specifies the process owning the virtual address space
3105  *       BaseAddress =  Points to the address of virtual memory to start the read
3106  *       Buffer = Caller supplies storage to copy the virtual memory to.
3107  *       NumberOfBytesToRead = Limits the range to read
3108  *       NumberOfBytesRead = The actual number of bytes read.
3109  * RETURNS: Status
3110  */
3111
3112 NTSTATUS
3113 STDCALL
3114 NtReadVirtualMemory(
3115         IN HANDLE ProcessHandle,
3116         IN PVOID BaseAddress,
3117         OUT PVOID Buffer,
3118         IN ULONG  NumberOfBytesToRead,
3119         OUT PULONG NumberOfBytesRead
3120         );
3121 NTSTATUS
3122 STDCALL
3123 ZwReadVirtualMemory(
3124         IN HANDLE ProcessHandle,
3125         IN PVOID BaseAddress,
3126         OUT PVOID Buffer,
3127         IN ULONG  NumberOfBytesToRead,
3128         OUT PULONG NumberOfBytesRead
3129         );
3130
3131
3132 /*
3133  * FUNCTION: Debugger can register for thread termination
3134  * ARGUMENTS:
3135  *       TerminationPort = Port on which the debugger likes to be notified.
3136  * RETURNS: Status
3137  */
3138 NTSTATUS
3139 STDCALL
3140 NtRegisterThreadTerminatePort(
3141         HANDLE TerminationPort
3142         );
3143 NTSTATUS
3144 STDCALL
3145 ZwRegisterThreadTerminatePort(
3146         HANDLE TerminationPort
3147         );
3148
3149 /*
3150  * FUNCTION: Releases a mutant
3151  * ARGUMENTS:
3152  *       MutantHandle = Handle to the mutant
3153  *       ReleaseCount =
3154  * RETURNS: Status
3155  */
3156 NTSTATUS
3157 STDCALL
3158 NtReleaseMutant(
3159         IN HANDLE MutantHandle,
3160         IN PULONG ReleaseCount OPTIONAL
3161         );
3162
3163 NTSTATUS
3164 STDCALL
3165 ZwReleaseMutant(
3166         IN HANDLE MutantHandle,
3167         IN PULONG ReleaseCount OPTIONAL
3168         );
3169
3170 /*
3171  * FUNCTION: Releases a semaphore
3172  * ARGUMENTS:
3173  *       SemaphoreHandle = Handle to the semaphore object
3174  *       ReleaseCount = Number to decrease the semaphore count
3175  *       PreviousCount = Previous semaphore count
3176  * RETURNS: Status
3177  */
3178 NTSTATUS
3179 STDCALL
3180 NtReleaseSemaphore(
3181         IN      HANDLE  SemaphoreHandle,
3182         IN      LONG    ReleaseCount,
3183         OUT     PLONG   PreviousCount
3184         );
3185
3186 NTSTATUS
3187 STDCALL
3188 ZwReleaseSemaphore(
3189         IN      HANDLE  SemaphoreHandle,
3190         IN      LONG    ReleaseCount,
3191         OUT     PLONG   PreviousCount
3192         );
3193
3194 /*
3195  * FUNCTION: Removes an io completion
3196  * ARGUMENTS:
3197  *        CompletionPort (OUT) = Caller supplied storage for the resulting handle
3198  *        CompletionKey = Requested access to the key
3199  *        IoStatusBlock = Caller provides storage for extended status information
3200  *        CompletionStatus = Current status of the io operation.
3201  *        WaitTime = Time to wait if ..
3202  * RETURNS: Status
3203  */
3204 NTSTATUS
3205 STDCALL
3206 NtRemoveIoCompletion(
3207    IN  HANDLE           IoCompletionHandle,
3208    OUT PULONG           CompletionKey,
3209    OUT PULONG           CompletionValue,
3210    OUT PIO_STATUS_BLOCK IoStatusBlock,
3211    IN  PLARGE_INTEGER   Timeout OPTIONAL
3212    );
3213
3214 NTSTATUS
3215 STDCALL
3216 ZwRemoveIoCompletion(
3217    IN  HANDLE           IoCompletionHandle,
3218    OUT PULONG           CompletionKey,
3219    OUT PULONG           CompletionValue,
3220    OUT PIO_STATUS_BLOCK IoStatusBlock,
3221    IN  PLARGE_INTEGER   Timeout OPTIONAL
3222    );
3223
3224 /*
3225  * FUNCTION: Replaces one registry key with another
3226  * ARGUMENTS:
3227  *       ObjectAttributes = Specifies the attributes of the key
3228  *       Key =  Handle to the key
3229  *       ReplacedObjectAttributes = The function returns the old object attributes
3230  * RETURNS: Status
3231  */
3232 NTSTATUS
3233 STDCALL
3234 NtReplaceKey(
3235         IN POBJECT_ATTRIBUTES ObjectAttributes,
3236         IN HANDLE Key,
3237         IN POBJECT_ATTRIBUTES ReplacedObjectAttributes
3238         );
3239 NTSTATUS
3240 STDCALL
3241 ZwReplaceKey(
3242         IN POBJECT_ATTRIBUTES ObjectAttributes,
3243         IN HANDLE Key,
3244         IN POBJECT_ATTRIBUTES ReplacedObjectAttributes
3245         );
3246
3247
3248 NTSTATUS STDCALL
3249 NtReplyPort (HANDLE PortHandle,
3250              PLPC_MESSAGE LpcReply);
3251
3252 NTSTATUS STDCALL
3253 ZwReplyPort (HANDLE PortHandle,
3254              PLPC_MESSAGE LpcReply);
3255
3256
3257 NTSTATUS STDCALL
3258 NtReplyWaitReceivePort (HANDLE PortHandle,
3259                         PULONG PortId,
3260                         PLPC_MESSAGE MessageReply,
3261                         PLPC_MESSAGE MessageRequest);
3262
3263 NTSTATUS STDCALL
3264 ZwReplyWaitReceivePort (HANDLE PortHandle,
3265                         PULONG PortId,
3266                         PLPC_MESSAGE MessageReply,
3267                         PLPC_MESSAGE MessageRequest);
3268
3269
3270 NTSTATUS STDCALL
3271 NtReplyWaitReplyPort (HANDLE PortHandle,
3272                       PLPC_MESSAGE ReplyMessage);
3273
3274 NTSTATUS STDCALL
3275 ZwReplyWaitReplyPort (HANDLE PortHandle,
3276                       PLPC_MESSAGE ReplyMessage);
3277
3278
3279 NTSTATUS STDCALL
3280 NtRequestPort (HANDLE PortHandle,
3281                PLPC_MESSAGE LpcMessage);
3282
3283 NTSTATUS STDCALL
3284 ZwRequestPort (HANDLE PortHandle,
3285                PLPC_MESSAGE LpcMessage);
3286
3287
3288 NTSTATUS STDCALL
3289 NtRequestWaitReplyPort (HANDLE PortHandle,
3290                         PLPC_MESSAGE LpcReply,
3291                         PLPC_MESSAGE LpcRequest);
3292
3293 NTSTATUS STDCALL
3294 ZwRequestWaitReplyPort (HANDLE PortHandle,
3295                         PLPC_MESSAGE LpcReply,
3296                         PLPC_MESSAGE LpcRequest);
3297
3298 /*
3299  * FUNCTION: Resets a event to a non signaled state
3300  * ARGUMENTS:
3301  *       EventHandle = Handle to the event that should be reset
3302  *       NumberOfWaitingThreads =  The number of threads released.
3303  * RETURNS: Status
3304  */
3305 NTSTATUS
3306 STDCALL
3307 NtResetEvent(
3308         HANDLE EventHandle,
3309         PULONG NumberOfWaitingThreads OPTIONAL
3310         );
3311 NTSTATUS
3312 STDCALL
3313 ZwResetEvent(
3314         HANDLE EventHandle,
3315         PULONG NumberOfWaitingThreads OPTIONAL
3316         );
3317 //draft
3318 NTSTATUS
3319 STDCALL
3320 NtRestoreKey(
3321         HANDLE KeyHandle,
3322         HANDLE FileHandle,
3323         ULONG RestoreFlags
3324         );
3325
3326 NTSTATUS
3327 STDCALL
3328 ZwRestoreKey(
3329         HANDLE KeyHandle,
3330         HANDLE FileHandle,
3331         ULONG RestoreFlags
3332         );
3333 /*
3334  * FUNCTION: Decrements a thread's resume count
3335  * ARGUMENTS:
3336  *        ThreadHandle = Handle to the thread that should be resumed
3337  *        ResumeCount =  The resulting resume count.
3338  * REMARK:
3339  *        A thread is resumed if its suspend count is 0. This procedure maps to
3340  *        the win32 ResumeThread function. ( documentation about the the suspend count can be found here aswell )
3341  * RETURNS: Status
3342  */
3343 NTSTATUS
3344 STDCALL
3345 NtResumeThread(
3346         IN HANDLE ThreadHandle,
3347         OUT PULONG SuspendCount
3348         );
3349 NTSTATUS
3350 STDCALL
3351 ZwResumeThread(
3352         IN HANDLE ThreadHandle,
3353         OUT PULONG SuspendCount
3354         );
3355 /*
3356  * FUNCTION: Writes the content of a registry key to ascii file
3357  * ARGUMENTS:
3358  *        KeyHandle = Handle to the key
3359  *        FileHandle =  Handle of the file
3360  * REMARKS:
3361           This function maps to the Win32 RegSaveKey.
3362  * RETURNS: Status
3363  */
3364
3365 NTSTATUS
3366 STDCALL
3367 NtSaveKey(
3368         IN HANDLE KeyHandle,
3369         IN HANDLE FileHandle
3370         );
3371 NTSTATUS
3372 STDCALL
3373 ZwSaveKey(
3374         IN HANDLE KeyHandle,
3375         IN HANDLE FileHandle
3376         );
3377
3378 /*
3379  * FUNCTION: Sets the context of a specified thread.
3380  * ARGUMENTS:
3381  *        ThreadHandle = Handle to the thread
3382  *        Context =  The processor context.
3383  * RETURNS: Status
3384  */
3385
3386 NTSTATUS
3387 STDCALL
3388 NtSetContextThread(
3389         IN HANDLE ThreadHandle,
3390         IN PCONTEXT Context
3391         );
3392 NTSTATUS
3393 STDCALL
3394 ZwSetContextThread(
3395         IN HANDLE ThreadHandle,
3396         IN PCONTEXT Context
3397         );
3398
3399 /*
3400  * FUNCTION: Sets the default locale id
3401  * ARGUMENTS:
3402  *        UserProfile = Type of locale id
3403  *              TRUE: thread locale id
3404  *              FALSE: system locale id
3405  *        DefaultLocaleId = Locale id
3406  * RETURNS: Status
3407  */
3408
3409 NTSTATUS
3410 STDCALL
3411 NtSetDefaultLocale(
3412         IN BOOLEAN UserProfile,
3413         IN LCID DefaultLocaleId
3414         );
3415
3416 NTSTATUS
3417 STDCALL
3418 ZwSetDefaultLocale(
3419         IN BOOLEAN UserProfile,
3420         IN LCID DefaultLocaleId
3421         );
3422
3423 /*
3424  * FUNCTION: Sets the default hard error port
3425  * ARGUMENTS:
3426  *        PortHandle = Handle to the port
3427  * NOTE: The hard error port is used for first change exception handling
3428  * RETURNS: Status
3429  */
3430 NTSTATUS
3431 STDCALL
3432 NtSetDefaultHardErrorPort(
3433         IN HANDLE PortHandle
3434         );
3435 NTSTATUS
3436 STDCALL
3437 ZwSetDefaultHardErrorPort(
3438         IN HANDLE PortHandle
3439         );
3440
3441 /*
3442  * FUNCTION: Sets the extended attributes of a file.
3443  * ARGUMENTS:
3444  *        FileHandle = Handle to the file
3445  *        IoStatusBlock = Storage for a resulting status and information
3446  *                        on the current operation.
3447  *        EaBuffer = Extended Attributes buffer.
3448  *        EaBufferSize = Size of the extended attributes buffer
3449  * RETURNS: Status
3450  */
3451 NTSTATUS
3452 STDCALL
3453 NtSetEaFile(
3454         IN HANDLE FileHandle,
3455         IN PIO_STATUS_BLOCK IoStatusBlock,
3456         PVOID EaBuffer,
3457         ULONG EaBufferSize
3458         );
3459 NTSTATUS
3460 STDCALL
3461 ZwSetEaFile(
3462         IN HANDLE FileHandle,
3463         IN PIO_STATUS_BLOCK IoStatusBlock,
3464         PVOID EaBuffer,
3465         ULONG EaBufferSize
3466         );
3467
3468 //FIXME: should I return the event state ?
3469
3470 /*
3471  * FUNCTION: Sets the  event to a signalled state.
3472  * ARGUMENTS:
3473  *        EventHandle = Handle to the event
3474  *        NumberOfThreadsReleased =  The number of threads released
3475  * REMARK:
3476  *        This procedure maps to the win32 SetEvent function.
3477  * RETURNS: Status
3478  */
3479
3480 NTSTATUS
3481 STDCALL
3482 NtSetEvent(
3483         IN HANDLE EventHandle,
3484         PULONG NumberOfThreadsReleased
3485         );
3486
3487 NTSTATUS
3488 STDCALL
3489 ZwSetEvent(
3490         IN HANDLE EventHandle,
3491         PULONG NumberOfThreadsReleased
3492         );
3493
3494 /*
3495  * FUNCTION: Sets the high part of an event pair
3496  * ARGUMENTS:
3497         EventPair = Handle to the event pair
3498  * RETURNS: Status
3499 */
3500
3501 NTSTATUS
3502 STDCALL
3503 NtSetHighEventPair(
3504         IN HANDLE EventPairHandle
3505         );
3506
3507 NTSTATUS
3508 STDCALL
3509 ZwSetHighEventPair(
3510         IN HANDLE EventPairHandle
3511         );
3512 /*
3513  * FUNCTION: Sets the high part of an event pair and wait for the low part
3514  * ARGUMENTS:
3515         EventPair = Handle to the event pair
3516  * RETURNS: Status
3517 */
3518 NTSTATUS
3519 STDCALL
3520 NtSetHighWaitLowEventPair(
3521         IN HANDLE EventPairHandle
3522         );
3523 NTSTATUS
3524 STDCALL
3525 ZwSetHighWaitLowEventPair(
3526         IN HANDLE EventPairHandle
3527         );
3528
3529 /*
3530  * FUNCTION: Sets the information of a file object.
3531  * ARGUMENTS:
3532  *        FileHandle = Handle to the file object
3533  *        IoStatusBlock = Caller supplies storage for extended information
3534  *                        on the current operation.
3535  *        FileInformation = Storage for the new file information
3536  *        Lenght = Size of the new file information.
3537  *        FileInformationClass = Indicates to a certain information structure
3538
3539           FileNameInformation                   FILE_NAME_INFORMATION
3540           FileRenameInformation                 FILE_RENAME_INFORMATION
3541           FileStreamInformation                 FILE_STREAM_INFORMATION
3542  *        FileCompletionInformation             IO_COMPLETION_CONTEXT
3543
3544  * REMARK:
3545  *        This procedure maps to the win32 SetEndOfFile, SetFileAttributes,
3546  *        SetNamedPipeHandleState, SetMailslotInfo functions.
3547  * RETURNS: Status
3548  */
3549
3550
3551 NTSTATUS
3552 STDCALL
3553 NtSetInformationFile(
3554         IN      HANDLE                  FileHandle,
3555         IN      PIO_STATUS_BLOCK        IoStatusBlock,
3556         IN      PVOID                   FileInformation,
3557         IN      ULONG                   Length,
3558         IN      FILE_INFORMATION_CLASS  FileInformationClass
3559         );
3560 NTSTATUS
3561 STDCALL
3562 ZwSetInformationFile(
3563         IN      HANDLE                  FileHandle,
3564         IN      PIO_STATUS_BLOCK        IoStatusBlock,
3565         IN      PVOID                   FileInformation,
3566         IN      ULONG                   Length,
3567         IN      FILE_INFORMATION_CLASS  FileInformationClass
3568         );
3569
3570 /*
3571  * FUNCTION: Changes a set of thread specific parameters
3572  * ARGUMENTS:
3573  *      ThreadHandle = Handle to the thread
3574  *      ThreadInformationClass = Index to the set of parameters to change.
3575  *      Can be one of the following values:
3576  *
3577  *      ThreadBasicInformation                  THREAD_BASIC_INFORMATION
3578  *      ThreadPriority                          KPRIORITY //???
3579  *      ThreadBasePriority                      KPRIORITY
3580  *      ThreadAffinityMask                      KAFFINITY //??
3581  *      ThreadImpersonationToken                ACCESS_TOKEN
3582  *      ThreadIdealProcessor                    ULONG
3583  *      ThreadPriorityBoost                     ULONG
3584  *
3585  *      ThreadInformation = Caller supplies storage for parameters to set.
3586  *      ThreadInformationLength = Size of the storage supplied
3587  * RETURNS: Status
3588 */
3589 NTSTATUS
3590 STDCALL
3591 NtSetInformationThread(
3592         IN HANDLE ThreadHandle,
3593         IN THREADINFOCLASS ThreadInformationClass,
3594         IN PVOID ThreadInformation,
3595         IN ULONG ThreadInformationLength
3596         );
3597 NTSTATUS
3598 STDCALL
3599 ZwSetInformationThread(
3600         IN HANDLE ThreadHandle,
3601         IN THREADINFOCLASS ThreadInformationClass,
3602         IN PVOID ThreadInformation,
3603         IN ULONG ThreadInformationLength
3604         );
3605
3606 /*
3607  * FUNCTION: Changes a set of token specific parameters
3608  * ARGUMENTS:
3609  *      TokenHandle = Handle to the token
3610  *      TokenInformationClass = Index to a certain information structure.
3611  *      Can be one of the following values:
3612  *
3613                 TokenUser               TOKEN_USER
3614                 TokenGroups             TOKEN_GROUPS
3615                 TokenPrivileges         TOKEN_PRIVILEGES
3616                 TokenOwner              TOKEN_OWNER
3617                 TokenPrimaryGroup       TOKEN_PRIMARY_GROUP
3618                 TokenDefaultDacl        TOKEN_DEFAULT_DACL
3619                 TokenSource             TOKEN_SOURCE
3620                 TokenType               TOKEN_TYPE
3621                 TokenImpersonationLevel TOKEN_IMPERSONATION_LEVEL
3622                 TokenStatistics         TOKEN_STATISTICS
3623  *
3624  *      TokenInformation = Caller supplies storage for information structure.
3625  *      TokenInformationLength = Size of the information structure
3626  * RETURNS: Status
3627 */
3628
3629 NTSTATUS
3630 STDCALL
3631 NtSetInformationToken(
3632         IN HANDLE TokenHandle,
3633         IN TOKEN_INFORMATION_CLASS TokenInformationClass,
3634         OUT PVOID TokenInformation,
3635         IN ULONG TokenInformationLength
3636         );
3637
3638 NTSTATUS
3639 STDCALL
3640 ZwSetInformationToken(
3641         IN HANDLE TokenHandle,
3642         IN TOKEN_INFORMATION_CLASS TokenInformationClass,
3643         OUT PVOID TokenInformation,
3644         IN ULONG TokenInformationLength
3645         );
3646
3647
3648 /*
3649  * FUNCTION: Sets an io completion
3650  * ARGUMENTS:
3651  *      CompletionPort =
3652  *      CompletionKey =
3653  *      IoStatusBlock =
3654  *      NumberOfBytesToTransfer =
3655  *      NumberOfBytesTransferred =
3656  * RETURNS: Status
3657 */
3658 NTSTATUS
3659 STDCALL
3660 NtSetIoCompletion(
3661    IN HANDLE   IoCompletionPortHandle,
3662    IN ULONG    CompletionKey,
3663    IN ULONG    CompletionValue,
3664    IN NTSTATUS CompletionStatus,
3665    IN ULONG    CompletionInformation
3666    );
3667
3668 NTSTATUS
3669 STDCALL
3670 ZwSetIoCompletion(
3671    IN HANDLE   IoCompletionPortHandle,
3672    IN ULONG    CompletionKey,
3673    IN ULONG    CompletionValue,
3674    IN NTSTATUS CompletionStatus,
3675    IN ULONG    CompletionInformation
3676    );
3677
3678 /*
3679  * FUNCTION: Set properties for profiling
3680  * ARGUMENTS:
3681  *      Interval =
3682  *      ClockSource =
3683  * RETURNS: Status
3684  *
3685  */
3686
3687 NTSTATUS
3688 STDCALL
3689 NtSetIntervalProfile(
3690         ULONG Interval,
3691         KPROFILE_SOURCE ClockSource
3692         );
3693
3694 NTSTATUS
3695 STDCALL
3696 ZwSetIntervalProfile(
3697         ULONG Interval,
3698         KPROFILE_SOURCE ClockSource
3699         );
3700
3701
3702 /*
3703  * FUNCTION: Sets the low part of an event pair
3704  * ARGUMENTS:
3705         EventPair = Handle to the event pair
3706  * RETURNS: Status
3707 */
3708
3709 NTSTATUS
3710 STDCALL
3711 NtSetLowEventPair(
3712         HANDLE EventPair
3713         );
3714 NTSTATUS
3715 STDCALL
3716 ZwSetLowEventPair(
3717         HANDLE EventPair
3718         );
3719 /*
3720  * FUNCTION: Sets the low part of an event pair and wait for the high part
3721  * ARGUMENTS:
3722         EventPair = Handle to the event pair
3723  * RETURNS: Status
3724 */
3725 NTSTATUS
3726 STDCALL
3727 NtSetLowWaitHighEventPair(
3728         HANDLE EventPair
3729         );
3730 NTSTATUS
3731 STDCALL
3732 ZwSetLowWaitHighEventPair(
3733         HANDLE EventPair
3734         );
3735
3736 /* NtSetLowWaitHighThread effectively invokes NtSetLowWaitHighEventPair on the
3737  * event pair of the thread.
3738  */
3739 NTSTATUS
3740 STDCALL
3741 NtSetLowWaitHighThread(
3742         VOID
3743         );
3744 /* ZwSetLowWaitHighThread effectively invokes ZwSetLowWaitHighEventPair on the
3745  * event pair of the thread.
3746  */
3747 NTSTATUS
3748 STDCALL
3749 ZwSetLowWaitHighThread(
3750         VOID
3751         );
3752
3753 /* NtSetHighWaitLowThread effectively invokes NtSetHighWaitLowEventPair on the
3754  * event pair of the thread.
3755  */
3756 NTSTATUS
3757 STDCALL
3758 NtSetHighWaitLowThread(
3759         VOID
3760         );
3761
3762 /* ZwSetHighWaitLowThread effectively invokes ZwSetHighWaitLowEventPair on the
3763  * event pair of the thread.
3764  */
3765 NTSTATUS
3766 STDCALL
3767 ZwSetHighWaitLowThread(
3768         VOID
3769         );
3770
3771 NTSTATUS
3772 STDCALL
3773 NtSetSecurityObject(
3774         IN HANDLE Handle,
3775         IN SECURITY_INFORMATION SecurityInformation,
3776         IN PSECURITY_DESCRIPTOR SecurityDescriptor
3777         );
3778
3779 NTSTATUS
3780 STDCALL
3781 ZwSetSecurityObject(
3782         IN HANDLE Handle,
3783         IN SECURITY_INFORMATION SecurityInformation,
3784         IN PSECURITY_DESCRIPTOR SecurityDescriptor
3785         );
3786
3787
3788 /*
3789  * FUNCTION: Sets a system environment variable
3790  * ARGUMENTS:
3791  *      ValueName = Name of the environment variable
3792  *      Value = Value of the environment variable
3793  * RETURNS: Status
3794 */
3795 NTSTATUS
3796 STDCALL
3797 NtSetSystemEnvironmentValue(
3798         IN PUNICODE_STRING VariableName,
3799         IN PUNICODE_STRING Value
3800         );
3801 NTSTATUS
3802 STDCALL
3803 ZwSetSystemEnvironmentValue(
3804         IN PUNICODE_STRING VariableName,
3805         IN PUNICODE_STRING Value
3806         );
3807 /*
3808  * FUNCTION: Sets system parameters
3809  * ARGUMENTS:
3810  *      SystemInformationClass = Index to a particular set of system parameters
3811  *                      Can be one of the following values:
3812  *
3813  *      SystemTimeAdjustmentInformation         SYSTEM_TIME_ADJUSTMENT
3814  *
3815  *      SystemInformation = Structure containing the parameters.
3816  *      SystemInformationLength = Size of the structure.
3817  * RETURNS: Status
3818 */
3819 NTSTATUS
3820 STDCALL
3821 NtSetSystemInformation(
3822         IN      SYSTEM_INFORMATION_CLASS        SystemInformationClass,
3823         IN      PVOID                           SystemInformation,
3824         IN      ULONG                           SystemInformationLength
3825         );
3826
3827 NTSTATUS
3828 STDCALL
3829 ZwSetSystemInformation(
3830         IN      SYSTEM_INFORMATION_CLASS        SystemInformationClass,
3831         IN      PVOID                           SystemInformation,
3832         IN      ULONG                           SystemInformationLength
3833         );
3834
3835 /*
3836  * FUNCTION: Sets the system time
3837  * ARGUMENTS:
3838  *      SystemTime = Old System time
3839  *      NewSystemTime = New System time
3840  * RETURNS: Status
3841 */
3842 NTSTATUS
3843 STDCALL
3844 NtSetSystemTime(
3845         IN PLARGE_INTEGER SystemTime,
3846         IN PLARGE_INTEGER NewSystemTime OPTIONAL
3847         );
3848 NTSTATUS
3849 STDCALL
3850 ZwSetSystemTime(
3851         IN PLARGE_INTEGER SystemTime,
3852         IN PLARGE_INTEGER NewSystemTime OPTIONAL
3853         );
3854
3855 /*
3856  * FUNCTION: Sets the frequency of the system timer
3857  * ARGUMENTS:
3858  *      RequestedResolution =
3859  *      SetOrUnset =
3860  *      ActualResolution =
3861  * RETURNS: Status
3862 */
3863 NTSTATUS
3864 STDCALL
3865 NtSetTimerResolution(
3866         IN ULONG RequestedResolution,
3867         IN BOOL SetOrUnset,
3868         OUT PULONG ActualResolution
3869         );
3870 NTSTATUS
3871 STDCALL
3872 ZwSetTimerResolution(
3873         IN ULONG RequestedResolution,
3874         IN BOOL SetOrUnset,
3875         OUT PULONG ActualResolution
3876         );
3877
3878 /*
3879  * FUNCTION: Sets the value of a registry key
3880  * ARGUMENTS:
3881  *      KeyHandle = Handle to a registry key
3882  *      ValueName = Name of the value entry to change
3883  *      TitleIndex = pointer to a structure containing the new volume information
3884  *      Type = Type of the registry key. Can be one of the values:
3885  *              REG_BINARY                      Unspecified binary data
3886  *              REG_DWORD                       A 32 bit value
3887  *              REG_DWORD_LITTLE_ENDIAN         Same as REG_DWORD
3888  *              REG_DWORD_BIG_ENDIAN            A 32 bit value whose least significant byte is at the highest address
3889  *              REG_EXPAND_SZ                   A zero terminated wide character string with unexpanded environment variables  ( "%PATH%" )
3890  *              REG_LINK                        A zero terminated wide character string referring to a symbolic link.
3891  *              REG_MULTI_SZ                    A series of zero-terminated strings including a additional trailing zero
3892  *              REG_NONE                        Unspecified type
3893  *              REG_SZ                          A wide character string ( zero terminated )
3894  *              REG_RESOURCE_LIST               ??
3895  *              REG_RESOURCE_REQUIREMENTS_LIST  ??
3896  *              REG_FULL_RESOURCE_DESCRIPTOR    ??
3897  *      Data = Contains the data for the registry key.
3898  *      DataSize = size of the data.
3899  * RETURNS: Status
3900  */
3901 NTSTATUS
3902 STDCALL
3903 NtSetValueKey(
3904         IN HANDLE KeyHandle,
3905         IN PUNICODE_STRING ValueName,
3906         IN ULONG TitleIndex OPTIONAL,
3907         IN ULONG Type,
3908         IN PVOID Data,
3909         IN ULONG DataSize
3910         );
3911 NTSTATUS
3912 STDCALL
3913 ZwSetValueKey(
3914         IN HANDLE KeyHandle,
3915         IN PUNICODE_STRING ValueName,
3916         IN ULONG TitleIndex OPTIONAL,
3917         IN ULONG Type,
3918         IN PVOID Data,
3919         IN ULONG DataSize
3920         );
3921
3922 /*
3923  * FUNCTION: Sets the volume information.
3924  * ARGUMENTS:
3925  *      FileHandle = Handle to the file
3926  *      IoStatusBlock = Caller should supply storage for additional status information
3927  *      VolumeInformation = pointer to a structure containing the new volume information
3928  *      Length = size of the structure.
3929  *      VolumeInformationClass = specifies the particular volume information to set
3930  * RETURNS: Status
3931  */
3932 NTSTATUS
3933 STDCALL
3934 NtSetVolumeInformationFile(
3935         IN HANDLE FileHandle,
3936         OUT PIO_STATUS_BLOCK IoStatusBlock,
3937         IN PVOID FsInformation,
3938         IN ULONG Length,
3939         IN FS_INFORMATION_CLASS FsInformationClass
3940         );
3941
3942 NTSTATUS
3943 STDCALL
3944 ZwSetVolumeInformationFile(
3945         IN HANDLE FileHandle,
3946         OUT PIO_STATUS_BLOCK IoStatusBlock,
3947         IN PVOID FsInformation,
3948         IN ULONG Length,
3949         IN FS_INFORMATION_CLASS FsInformationClass
3950         );
3951
3952 /*
3953  * FUNCTION: Shuts the system down
3954  * ARGUMENTS:
3955  *        Action = Specifies the type of shutdown, it can be one of the following values:
3956  *              ShutdownNoReboot, ShutdownReboot, ShutdownPowerOff
3957  * RETURNS: Status
3958  */
3959 NTSTATUS
3960 STDCALL
3961 NtShutdownSystem(
3962         IN SHUTDOWN_ACTION Action
3963         );
3964
3965 NTSTATUS
3966 STDCALL
3967 ZwShutdownSystem(
3968         IN SHUTDOWN_ACTION Action
3969         );
3970
3971 /*
3972  * FUNCTION: Signals an object and wait for an other one.
3973  * ARGUMENTS:
3974  *        SignalObject = Handle to the object that should be signaled
3975  *        WaitObject = Handle to the object that should be waited for
3976  *        Alertable = True if the wait is alertable
3977  *        Time = The time to wait
3978  * RETURNS: Status
3979  */
3980 NTSTATUS
3981 STDCALL
3982 NtSignalAndWaitForSingleObject(
3983         IN      HANDLE          SignalObject,
3984         IN      HANDLE          WaitObject,
3985         IN      BOOLEAN         Alertable,
3986         IN      PLARGE_INTEGER  Time
3987         );
3988
3989 NTSTATUS
3990 STDCALL
3991 NtSignalAndWaitForSingleObject(
3992         IN      HANDLE          SignalObject,
3993         IN      HANDLE          WaitObject,
3994         IN      BOOLEAN         Alertable,
3995         IN      PLARGE_INTEGER  Time
3996         );
3997
3998 /*
3999  * FUNCTION: Starts profiling
4000  * ARGUMENTS:
4001  *       ProfileHandle = Handle to the profile
4002  * RETURNS: Status
4003  */
4004
4005 NTSTATUS
4006 STDCALL
4007 NtStartProfile(
4008         HANDLE ProfileHandle
4009         );
4010
4011 NTSTATUS
4012 STDCALL
4013 ZwStartProfile(
4014         HANDLE ProfileHandle
4015         );
4016
4017 /*
4018  * FUNCTION: Stops profiling
4019  * ARGUMENTS:
4020  *       ProfileHandle = Handle to the profile
4021  * RETURNS: Status
4022  */
4023
4024 NTSTATUS
4025 STDCALL
4026 NtStopProfile(
4027         HANDLE ProfileHandle
4028         );
4029
4030 NTSTATUS
4031 STDCALL
4032 ZwStopProfile(
4033         HANDLE ProfileHandle
4034         );
4035
4036 /* --- PROCESS MANAGEMENT --- */
4037
4038 //--NtSystemDebugControl
4039 /*
4040  * FUNCTION: Terminates the execution of a process.
4041  * ARGUMENTS:
4042  *      ThreadHandle = Handle to the process
4043  *      ExitStatus  = The exit status of the process to terminate with.
4044  * REMARKS
4045  *      Native applications should kill themselves using this function.
4046  * RETURNS: Status
4047  */
4048 NTSTATUS
4049 STDCALL
4050 NtTerminateProcess(
4051         IN HANDLE ProcessHandle,
4052         IN NTSTATUS ExitStatus
4053         );
4054 NTSTATUS
4055 STDCALL
4056 ZwTerminateProcess(
4057         IN HANDLE ProcessHandle,
4058         IN NTSTATUS ExitStatus
4059         );
4060
4061 /*
4062  * FUNCTION: Unloads a driver.
4063  * ARGUMENTS:
4064  *      DriverServiceName = Name of the driver to unload
4065  * RETURNS: Status
4066  */
4067 NTSTATUS
4068 STDCALL
4069 NtUnloadDriver(
4070         IN PUNICODE_STRING DriverServiceName
4071         );
4072 NTSTATUS
4073 STDCALL
4074 ZwUnloadDriver(
4075         IN PUNICODE_STRING DriverServiceName
4076         );
4077
4078 /*
4079  * FUNCTION: Unmaps a piece of virtual memory backed by a file.
4080  * ARGUMENTS:
4081  *       ProcessHandle = Handle to the process
4082  *       BaseAddress =  The address where the mapping begins
4083  * REMARK:
4084         This procedure maps to the win32 UnMapViewOfFile
4085  * RETURNS: Status
4086  */
4087 NTSTATUS
4088 STDCALL
4089 NtUnmapViewOfSection(
4090         IN HANDLE ProcessHandle,
4091         IN PVOID BaseAddress
4092         );
4093 NTSTATUS
4094 STDCALL
4095 ZwUnmapViewOfSection(
4096         IN HANDLE ProcessHandle,
4097         IN PVOID BaseAddress
4098         );
4099
4100
4101 NTSTATUS STDCALL
4102 NtWriteRequestData (HANDLE PortHandle,
4103                     PLPC_MESSAGE Message,
4104                     ULONG Index,
4105                     PVOID Buffer,
4106                     ULONG BufferLength,
4107                     PULONG ReturnLength);
4108
4109 NTSTATUS STDCALL
4110 ZwWriteRequestData (HANDLE PortHandle,
4111                     PLPC_MESSAGE Message,
4112                     ULONG Index,
4113                     PVOID Buffer,
4114                     ULONG BufferLength,
4115                     PULONG ReturnLength);
4116
4117
4118 /*
4119  * FUNCTION: Writes a range of virtual memory
4120  * ARGUMENTS:
4121  *       ProcessHandle = The handle to the process owning the address space.
4122  *       BaseAddress  = The points to the address to  write to
4123  *       Buffer = Pointer to the buffer to write
4124  *       NumberOfBytesToWrite = Offset to the upper boundary to write
4125  *       NumberOfBytesWritten = Total bytes written
4126  * REMARKS:
4127  *       This function maps to the win32 WriteProcessMemory
4128  * RETURNS: Status
4129  */
4130 NTSTATUS
4131 STDCALL
4132 NtWriteVirtualMemory(
4133         IN HANDLE ProcessHandle,
4134         IN PVOID  BaseAddress,
4135         IN PVOID Buffer,
4136         IN ULONG NumberOfBytesToWrite,
4137         OUT PULONG NumberOfBytesWritten
4138         );
4139
4140 NTSTATUS
4141 STDCALL
4142 ZwWriteVirtualMemory(
4143         IN HANDLE ProcessHandle,
4144         IN PVOID  BaseAddress,
4145         IN PVOID Buffer,
4146         IN ULONG NumberOfBytesToWrite,
4147         OUT PULONG NumberOfBytesWritten
4148         );
4149
4150
4151 /*
4152  * FUNCTION: Waits for an object to become signalled.
4153  * ARGUMENTS:
4154  *       Object = The object handle
4155  *       Alertable = If true the wait is alertable.
4156  *       Time = The maximum wait time.
4157  * REMARKS:
4158  *       This function maps to the win32 WaitForSingleObjectEx.
4159  * RETURNS: Status
4160  */
4161 NTSTATUS
4162 STDCALL
4163 NtWaitForSingleObject (
4164         IN HANDLE Object,
4165         IN BOOLEAN Alertable,
4166         IN PLARGE_INTEGER Time
4167         );
4168
4169 NTSTATUS
4170 STDCALL
4171 ZwWaitForSingleObject (
4172         IN HANDLE Object,
4173         IN BOOLEAN Alertable,
4174         IN PLARGE_INTEGER Time
4175         );
4176
4177 /* --- EVENT PAIR OBJECT --- */
4178
4179 /*
4180  * FUNCTION: Waits for the high part of an eventpair to become signalled
4181  * ARGUMENTS:
4182  *       EventPairHandle = Handle to the event pair.
4183  * RETURNS: Status
4184  */
4185
4186 NTSTATUS
4187 STDCALL
4188 NtWaitHighEventPair(
4189         IN HANDLE EventPairHandle
4190         );
4191
4192 NTSTATUS
4193 STDCALL
4194 ZwWaitHighEventPair(
4195         IN HANDLE EventPairHandle
4196         );
4197
4198 /*
4199  * FUNCTION: Waits for the low part of an eventpair to become signalled
4200  * ARGUMENTS:
4201  *       EventPairHandle = Handle to the event pair.
4202  * RETURNS: Status
4203  */
4204 NTSTATUS
4205 STDCALL
4206 NtWaitLowEventPair(
4207         IN HANDLE EventPairHandle
4208         );
4209
4210 NTSTATUS
4211 STDCALL
4212 ZwWaitLowEventPair(
4213         IN HANDLE EventPairHandle
4214         );
4215
4216 /* --- FILE MANAGEMENT --- */
4217
4218 /*
4219  * FUNCTION: Unlocks a range of bytes in a file.
4220  * ARGUMENTS:
4221  *       FileHandle = Handle to the file
4222  *       IoStatusBlock = Caller should supply storage for a structure containing
4223  *                       the completion status and information about the requested unlock operation.
4224                         The information field is set to the number of bytes unlocked.
4225  *       ByteOffset = Offset to start the range of bytes to unlock
4226  *       Length = Number of bytes to unlock.
4227  *       Key = Special value to enable other threads to unlock a file than the
4228                 thread that locked the file. The key supplied must match with the one obtained
4229                 in a previous call to NtLockFile.
4230  * REMARK:
4231         This procedure maps to the win32 procedure UnlockFileEx. STATUS_PENDING is returned if the lock could
4232         not be obtained immediately, the device queue is busy and the IRP is queued.
4233  * RETURNS: Status [ STATUS_SUCCESS | STATUS_PENDING | STATUS_ACCESS_DENIED | STATUS_INSUFFICIENT_RESOURCES |
4234         STATUS_INVALID_PARAMETER | STATUS_INVALID_DEVICE_REQUEST | STATUS_RANGE_NOT_LOCKED ]
4235  */
4236 NTSTATUS
4237 STDCALL
4238 NtUnlockFile(
4239         IN HANDLE FileHandle,
4240         OUT PIO_STATUS_BLOCK IoStatusBlock,
4241         IN PLARGE_INTEGER ByteOffset,
4242         IN PLARGE_INTEGER Lenght,
4243         OUT PULONG Key OPTIONAL
4244         );
4245 NTSTATUS
4246 STDCALL
4247 ZwUnlockFile(
4248         IN HANDLE FileHandle,
4249         OUT PIO_STATUS_BLOCK IoStatusBlock,
4250         IN PLARGE_INTEGER ByteOffset,
4251         IN PLARGE_INTEGER Lenght,
4252         OUT PULONG Key OPTIONAL
4253         );
4254
4255 /*
4256  * FUNCTION: Writes data to a file
4257  * ARGUMENTS:
4258  *       FileHandle = The handle a file ( from NtCreateFile )
4259  *       Event  = Specifies a event that will become signalled when the write operation completes.
4260  *       ApcRoutine = Asynchroneous Procedure Callback [ Should not be used by device drivers ]
4261  *       ApcContext = Argument to the Apc Routine
4262  *       IoStatusBlock = Caller should supply storage for a structure containing the completion status and information about the requested write operation.
4263  *       Buffer = Caller should supply storage for a buffer that will contain the information to be written to file.
4264  *       Length = Size in bytest of the buffer
4265  *       ByteOffset = Points to a file offset. If a combination of Length and BytesOfSet is past the end-of-file mark the file will be enlarged.
4266  *                    BytesOffset is ignored if the file is created with FILE_APPEND_DATA in the DesiredAccess. BytesOffset is also ignored if
4267  *                    the file is created with CreateOptions flags FILE_SYNCHRONOUS_IO_ALERT or FILE_SYNCHRONOUS_IO_NONALERT set, in that case a offset
4268  *                    should be created by specifying FILE_USE_FILE_POINTER_POSITION.
4269  *       Key =  Unused
4270  * REMARKS:
4271  *       This function maps to the win32 WriteFile.
4272  *       Callers to NtWriteFile should run at IRQL PASSIVE_LEVEL.
4273  * RETURNS: Status [ STATUS_SUCCESS | STATUS_PENDING | STATUS_ACCESS_DENIED | STATUS_INSUFFICIENT_RESOURCES
4274         STATUS_INVALID_PARAMETER | STATUS_INVALID_DEVICE_REQUEST | STATUS_FILE_LOCK_CONFLICT ]
4275  */
4276 NTSTATUS
4277 STDCALL
4278 NtWriteFile(
4279         IN HANDLE FileHandle,
4280         IN HANDLE Event OPTIONAL,
4281         IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4282         IN PVOID ApcContext OPTIONAL,
4283         OUT PIO_STATUS_BLOCK IoStatusBlock,
4284         IN PVOID Buffer,
4285         IN ULONG Length,
4286         IN PLARGE_INTEGER ByteOffset,
4287         IN PULONG Key OPTIONAL
4288     );
4289
4290 NTSTATUS
4291 STDCALL
4292 ZwWriteFile(
4293         IN HANDLE FileHandle,
4294         IN HANDLE Event OPTIONAL,
4295         IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4296         IN PVOID ApcContext OPTIONAL,
4297         OUT PIO_STATUS_BLOCK IoStatusBlock,
4298         IN PVOID Buffer,
4299         IN ULONG Length,
4300         IN PLARGE_INTEGER ByteOffset ,
4301         IN PULONG Key OPTIONAL
4302     );
4303
4304 /*
4305  * FUNCTION: Writes a file
4306  * ARGUMENTS:
4307  *       FileHandle = The handle of the file
4308  *       Event  =
4309  *       ApcRoutine = Asynchroneous Procedure Callback [ Should not be used by device drivers ]
4310  *       ApcContext = Argument to the Apc Routine
4311  *       IoStatusBlock = Caller should supply storage for a structure containing the completion status and information about the requested write operation.
4312  *       BufferDescription = Caller should supply storage for a buffer that will contain the information to be written to file.
4313  *       BufferLength = Size in bytest of the buffer
4314  *       ByteOffset = Points to a file offset. If a combination of Length and BytesOfSet is past the end-of-file mark the file will be enlarged.
4315  *                    BytesOffset is ignored if the file is created with FILE_APPEND_DATA in the DesiredAccess. BytesOffset is also ignored if
4316  *                    the file is created with CreateOptions flags FILE_SYNCHRONOUS_IO_ALERT or FILE_SYNCHRONOUS_IO_NONALERT set, in that case a offset
4317  *                    should be created by specifying FILE_USE_FILE_POINTER_POSITION. Use FILE_WRITE_TO_END_OF_FILE to write to the EOF.
4318  *       Key = If a matching key [ a key provided at NtLockFile ] is provided the write operation will continue even if a byte range is locked.
4319  * REMARKS:
4320  *       This function maps to the win32 WriteFile.
4321  *       Callers to NtWriteFile should run at IRQL PASSIVE_LEVEL.
4322  * RETURNS: Status [ STATUS_SUCCESS | STATUS_PENDING | STATUS_ACCESS_DENIED | STATUS_INSUFFICIENT_RESOURCES
4323                 STATUS_INVALID_PARAMETER | STATUS_INVALID_DEVICE_REQUEST | STATUS_FILE_LOCK_CONFLICT ]
4324  */
4325
4326 NTSTATUS
4327 STDCALL
4328 NtWriteFileGather(
4329         IN HANDLE FileHandle,
4330         IN HANDLE Event OPTIONAL,
4331         IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4332         IN PVOID ApcContext OPTIONAL,
4333         OUT PIO_STATUS_BLOCK IoStatusBlock,
4334         IN FILE_SEGMENT_ELEMENT BufferDescription[],
4335         IN ULONG BufferLength,
4336         IN PLARGE_INTEGER ByteOffset,
4337         IN PULONG Key OPTIONAL
4338         );
4339
4340 NTSTATUS
4341 STDCALL
4342 ZwWriteFileGather(
4343         IN HANDLE FileHandle,
4344         IN HANDLE Event OPTIONAL,
4345         IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4346         IN PVOID ApcContext OPTIONAL,
4347         OUT PIO_STATUS_BLOCK IoStatusBlock,
4348         IN FILE_SEGMENT_ELEMENT BufferDescription[],
4349         IN ULONG BufferLength,
4350         IN PLARGE_INTEGER ByteOffset,
4351         IN PULONG Key OPTIONAL
4352         );
4353
4354
4355 /* --- THREAD MANAGEMENT --- */
4356
4357 /*
4358  * FUNCTION: Increments a thread's resume count
4359  * ARGUMENTS:
4360  *        ThreadHandle = Handle to the thread that should be resumed
4361  *        PreviousSuspendCount =  The resulting/previous suspend count.
4362  * REMARK:
4363  *        A thread will be suspended if its suspend count is greater than 0. This procedure maps to
4364  *        the win32 SuspendThread function. ( documentation about the the suspend count can be found here aswell )
4365  *        The suspend count is not increased if it is greater than MAXIMUM_SUSPEND_COUNT.
4366  * RETURNS: Status
4367  */
4368 NTSTATUS
4369 STDCALL
4370 NtSuspendThread(
4371         IN HANDLE ThreadHandle,
4372         IN PULONG PreviousSuspendCount
4373         );
4374
4375 NTSTATUS
4376 STDCALL
4377 ZwSuspendThread(
4378         IN HANDLE ThreadHandle,
4379         IN PULONG PreviousSuspendCount
4380         );
4381
4382 /*
4383  * FUNCTION: Terminates the execution of a thread.
4384  * ARGUMENTS:
4385  *      ThreadHandle = Handle to the thread
4386  *      ExitStatus  = The exit status of the thread to terminate with.
4387  * RETURNS: Status
4388  */
4389 NTSTATUS
4390 STDCALL
4391 NtTerminateThread(
4392         IN HANDLE ThreadHandle ,
4393         IN NTSTATUS ExitStatus
4394         );
4395 NTSTATUS
4396 STDCALL
4397 ZwTerminateThread(
4398         IN HANDLE ThreadHandle ,
4399         IN NTSTATUS ExitStatus
4400         );
4401 /*
4402  * FUNCTION: Tests to see if there are any pending alerts for the calling thread
4403  * RETURNS: Status
4404  */
4405 NTSTATUS
4406 STDCALL
4407 NtTestAlert(
4408         VOID
4409         );
4410 NTSTATUS
4411 STDCALL
4412 ZwTestAlert(
4413         VOID
4414         );
4415
4416 /*
4417  * FUNCTION: Yields the callers thread.
4418  * RETURNS: Status
4419  */
4420 NTSTATUS
4421 STDCALL
4422 NtYieldExecution(
4423         VOID
4424         );
4425
4426 NTSTATUS
4427 STDCALL
4428 ZwYieldExecution(
4429         VOID
4430         );
4431
4432 /* --- PLUG AND PLAY --- */
4433
4434 NTSTATUS
4435 STDCALL
4436 NtPlugPlayControl (DWORD Unknown1,
4437                    DWORD Unknown2,
4438                    DWORD Unknown3);
4439
4440 NTSTATUS
4441 STDCALL
4442 NtGetPlugPlayEvent (ULONG Reserved1,
4443                     ULONG Reserved2,
4444                     PVOID Buffer,
4445                     ULONG BufferLength);
4446
4447 /* --- POWER MANAGEMENT --- */
4448
4449 #ifndef __USE_W32API
4450 NTSTATUS STDCALL
4451 NtSetSystemPowerState(IN POWER_ACTION SystemAction,
4452                       IN SYSTEM_POWER_STATE MinSystemState,
4453                       IN ULONG Flags);
4454 #endif
4455
4456 /* --- DEBUG SUBSYSTEM --- */
4457
4458 NTSTATUS STDCALL
4459 NtSystemDebugControl(DEBUG_CONTROL_CODE ControlCode,
4460                      PVOID InputBuffer,
4461                      ULONG InputBufferLength,
4462                      PVOID OutputBuffer,
4463                      ULONG OutputBufferLength,
4464                      PULONG ReturnLength);
4465
4466 /* --- VIRTUAL DOS MACHINE (VDM) --- */
4467
4468 NTSTATUS
4469 STDCALL
4470 NtVdmControl (ULONG ControlCode, PVOID ControlData);
4471
4472
4473 /* --- WIN32 --- */
4474
4475 NTSTATUS STDCALL
4476 NtW32Call(IN ULONG RoutineIndex,
4477           IN PVOID Argument,
4478           IN ULONG ArgumentLength,
4479           OUT PVOID* Result OPTIONAL,
4480           OUT PULONG ResultLength OPTIONAL);
4481
4482 /* --- CHANNELS --- */
4483
4484 NTSTATUS
4485 STDCALL
4486 NtCreateChannel (
4487         VOID
4488         );
4489
4490 NTSTATUS
4491 STDCALL
4492 NtListenChannel (
4493         VOID
4494         );
4495
4496 NTSTATUS
4497 STDCALL
4498 NtOpenChannel (
4499         VOID
4500         );
4501
4502 NTSTATUS
4503 STDCALL
4504 NtReplyWaitSendChannel (
4505         VOID
4506         );
4507
4508 NTSTATUS
4509 STDCALL
4510 NtSendWaitReplyChannel (
4511         VOID
4512         );
4513
4514 NTSTATUS
4515 STDCALL
4516 NtSetContextChannel (
4517         VOID
4518         );
4519
4520 /* --- MISCELLANEA --- */
4521
4522 //NTSTATUS STDCALL NtSetLdtEntries(VOID);
4523 NTSTATUS
4524 STDCALL
4525 NtSetLdtEntries (ULONG Selector1,
4526                  LDT_ENTRY LdtEntry1,
4527                  ULONG Selector2,
4528                  LDT_ENTRY LdtEntry2);
4529
4530 NTSTATUS
4531 STDCALL
4532 NtQueryOleDirectoryFile (
4533         VOID
4534         );
4535
4536 /*
4537  * FUNCTION: Checks a clients access rights to a object
4538  * ARGUMENTS:
4539  *        SecurityDescriptor = Security information against which the access is checked
4540  *        ClientToken = Represents a client
4541  *        DesiredAcces =
4542  *        GenericMapping =
4543  *        PrivilegeSet =
4544  *        ReturnLength = Bytes written
4545  *        GrantedAccess =
4546  *        AccessStatus = Indicates if the ClientToken allows the requested access
4547  * REMARKS: The arguments map to the win32 AccessCheck
4548  * RETURNS: Status
4549  */
4550
4551 NTSTATUS
4552 STDCALL
4553 NtAccessCheck(
4554         IN PSECURITY_DESCRIPTOR SecurityDescriptor,
4555         IN HANDLE ClientToken,
4556         IN ACCESS_MASK DesiredAcces,
4557         IN PGENERIC_MAPPING GenericMapping,
4558         OUT PPRIVILEGE_SET PrivilegeSet,
4559         OUT PULONG ReturnLength,
4560         OUT PULONG GrantedAccess,
4561         OUT PBOOLEAN AccessStatus
4562         );
4563
4564 NTSTATUS
4565 STDCALL
4566 ZwAccessCheck(
4567         IN PSECURITY_DESCRIPTOR SecurityDescriptor,
4568         IN HANDLE ClientToken,
4569         IN ACCESS_MASK DesiredAcces,
4570         IN PGENERIC_MAPPING GenericMapping,
4571         OUT PPRIVILEGE_SET PrivilegeSet,
4572         OUT PULONG ReturnLength,
4573         OUT PULONG GrantedAccess,
4574         OUT PBOOLEAN AccessStatus
4575         );
4576
4577 NTSTATUS
4578 STDCALL
4579 RtlOpenCurrentUser(
4580   IN  ACCESS_MASK  DesiredAccess,
4581   OUT  PHANDLE  KeyHandle);
4582
4583 /*
4584  * FUNCTION: Checks a clients access rights to a object and issues a audit a alarm. ( it logs the access )
4585  * ARGUMENTS:
4586  *        SubsystemName = Specifies the name of the subsystem, can be "WIN32" or "DEBUG"
4587  *        ObjectHandle =
4588  *        ObjectTypeName =
4589  *        ObjectName =
4590  *        SecurityDescriptor =
4591  *        DesiredAcces =
4592  *        GenericMapping =
4593  *        ObjectCreation =
4594  *        GrantedAccess =
4595  *        AccessStatus =
4596  *        GenerateOnClose =
4597  * REMARKS: The arguments map to the win32 AccessCheck
4598  * RETURNS: Status
4599  */
4600
4601 NTSTATUS
4602 STDCALL
4603 NtAccessCheckAndAuditAlarm(
4604         IN PUNICODE_STRING SubsystemName,
4605         IN PHANDLE ObjectHandle,
4606         IN PUNICODE_STRING ObjectTypeName,
4607         IN PUNICODE_STRING ObjectName,
4608         IN PSECURITY_DESCRIPTOR SecurityDescriptor,
4609         IN ACCESS_MASK DesiredAccess,
4610         IN PGENERIC_MAPPING GenericMapping,
4611         IN BOOLEAN ObjectCreation,
4612         OUT PACCESS_MASK GrantedAccess,
4613         OUT PNTSTATUS AccessStatus,
4614         OUT PBOOLEAN GenerateOnClose
4615         );
4616
4617 /*
4618  * FUNCTION: Cancels a timer
4619  * ARGUMENTS:
4620  *        TimerHandle = Handle to the timer
4621  *        CurrentState = Specifies the state of the timer when cancelled.
4622  * REMARKS:
4623  *        The arguments to this function map to the function CancelWaitableTimer.
4624  * RETURNS: Status
4625  */
4626 NTSTATUS
4627 STDCALL
4628 NtCancelTimer(
4629         IN HANDLE TimerHandle,
4630         OUT PBOOLEAN CurrentState OPTIONAL
4631         );
4632
4633 /*
4634  * FUNCTION: Continues a thread with the specified context
4635  * ARGUMENTS:
4636  *        Context = Specifies the processor context
4637  *        IrqLevel = Specifies the Interupt Request Level to continue with. Can
4638  *                      be PASSIVE_LEVEL or APC_LEVEL
4639  * REMARKS
4640  *        NtContinue can be used to continue after an exception or apc.
4641  * RETURNS: Status
4642  */
4643 //FIXME This function might need another parameter
4644
4645 NTSTATUS
4646 STDCALL
4647 NtContinue(
4648         IN PCONTEXT Context,
4649         IN BOOLEAN TestAlert
4650         );
4651
4652 /*
4653  * FUNCTION: Creates a paging file.
4654  * ARGUMENTS:
4655  *        FileName  = Name of the pagefile
4656  *        InitialSize = Specifies the initial size in bytes
4657  *        MaximumSize = Specifies the maximum size in bytes
4658  *        Reserved = Reserved for future use
4659  * RETURNS: Status
4660  */
4661 NTSTATUS
4662 STDCALL
4663 NtCreatePagingFile(
4664         IN PUNICODE_STRING FileName,
4665         IN PLARGE_INTEGER InitialSize,
4666         IN PLARGE_INTEGER MaxiumSize,
4667         IN ULONG Reserved
4668         );
4669
4670
4671 /*
4672  * FUNCTION: Creates a profile
4673  * ARGUMENTS:
4674  *        ProfileHandle (OUT) = Caller supplied storage for the resulting handle
4675  *        ObjectAttribute = Initialized attributes for the object
4676  *        ImageBase = Start address of executable image
4677  *        ImageSize = Size of the image
4678  *        Granularity = Bucket size
4679  *        Buffer =  Caller supplies buffer for profiling info
4680  *        ProfilingSize = Buffer size
4681  *        ClockSource = Specify 0 / FALSE ??
4682  *        ProcessorMask = A value of -1 indicates disables  per processor profiling,
4683                           otherwise bit set for the processor to profile.
4684  * REMARKS:
4685  *        This function maps to the win32 CreateProcess.
4686  * RETURNS: Status
4687  */
4688
4689 NTSTATUS
4690 STDCALL
4691 NtCreateProfile(OUT PHANDLE ProfileHandle,
4692                 IN HANDLE ProcessHandle,
4693                 IN PVOID ImageBase,
4694                 IN ULONG ImageSize,
4695                 IN ULONG Granularity,
4696                 OUT PULONG Buffer,
4697                 IN ULONG ProfilingSize,
4698                 IN KPROFILE_SOURCE Source,
4699                 IN ULONG ProcessorMask);
4700
4701 /*
4702  * FUNCTION: Creates a user mode thread
4703  * ARGUMENTS:
4704  *        ThreadHandle (OUT) = Caller supplied storage for the resulting handle
4705  *        DesiredAccess = Specifies the allowed or desired access to the thread.
4706  *        ObjectAttributes = Initialized attributes for the object.
4707  *        ProcessHandle = Handle to the threads parent process.
4708  *        ClientId (OUT) = Caller supplies storage for returned process id and thread id.
4709  *        ThreadContext = Initial processor context for the thread.
4710  *        InitialTeb = Initial user mode stack context for the thread.
4711  *        CreateSuspended = Specifies if the thread is ready for scheduling
4712  * REMARKS:
4713  *        This function maps to the win32 function CreateThread.
4714  * RETURNS: Status
4715  */
4716 NTSTATUS
4717 STDCALL
4718 NtCreateThread(
4719         OUT     PHANDLE                 ThreadHandle,
4720         IN      ACCESS_MASK             DesiredAccess,
4721         IN      POBJECT_ATTRIBUTES      ObjectAttributes        OPTIONAL,
4722         IN      HANDLE                  ProcessHandle,
4723         OUT     PCLIENT_ID              ClientId,
4724         IN      PCONTEXT                ThreadContext,
4725         IN      PUSER_STACK             UserStack,
4726         IN      BOOLEAN                 CreateSuspended
4727         );
4728
4729 /*
4730  * FUNCTION: Delays the execution of the calling thread.
4731  * ARGUMENTS:
4732  *        Alertable = If TRUE the thread is alertable during is wait period
4733  *        Interval  = Specifies the interval to wait.
4734  * RETURNS: Status
4735  */
4736
4737 NTSTATUS
4738 STDCALL
4739 NtDelayExecution(
4740         IN ULONG Alertable,
4741         IN TIME *Interval
4742         );
4743
4744 /*
4745  * FUNCTION: Extends a section
4746  * ARGUMENTS:
4747  *       SectionHandle = Handle to the section
4748  *       NewMaximumSize = Adjusted size
4749  * RETURNS: Status
4750  */
4751 NTSTATUS
4752 STDCALL
4753 NtExtendSection(
4754         IN HANDLE SectionHandle,
4755         IN ULONG NewMaximumSize
4756         );
4757
4758 /*
4759  * FUNCTION: Flushes a the processors instruction cache
4760  * ARGUMENTS:
4761  *       ProcessHandle = Points to the process owning the cache
4762  *       BaseAddress = // might this be a image address ????
4763  *       NumberOfBytesToFlush =
4764  * RETURNS: Status
4765  * REMARKS:
4766  *      This funciton is used by debuggers
4767  */
4768 NTSTATUS
4769 STDCALL
4770 NtFlushInstructionCache(
4771         IN HANDLE ProcessHandle,
4772         IN PVOID BaseAddress,
4773         IN UINT NumberOfBytesToFlush
4774         );
4775
4776 /*
4777  * FUNCTION: Flushes virtual memory to file
4778  * ARGUMENTS:
4779  *        ProcessHandle = Points to the process that allocated the virtual memory
4780  *        BaseAddress = Points to the memory address
4781  *        NumberOfBytesToFlush = Limits the range to flush,
4782  *        NumberOfBytesFlushed = Actual number of bytes flushed
4783  * RETURNS: Status
4784  * REMARKS:
4785  *        Check return status on STATUS_NOT_MAPPED_DATA
4786  */
4787 NTSTATUS
4788 STDCALL
4789 NtFlushVirtualMemory(
4790         IN HANDLE ProcessHandle,
4791         IN PVOID BaseAddress,
4792         IN ULONG NumberOfBytesToFlush,
4793         OUT PULONG NumberOfBytesFlushed OPTIONAL
4794         );
4795
4796 /*
4797  * FUNCTION: Retrieves the uptime of the system
4798  * ARGUMENTS:
4799  *        UpTime = Number of clock ticks since boot.
4800  * RETURNS: Status
4801  */
4802 ULONG
4803 STDCALL
4804 NtGetTickCount(
4805         VOID
4806         );
4807
4808 /*
4809  * FUNCTION: Loads a registry key.
4810  * ARGUMENTS:
4811  *       KeyObjectAttributes = Key to be loaded
4812  *       FileObjectAttributes = File to load the key from
4813  * REMARK:
4814  *      This procedure maps to the win32 procedure RegLoadKey
4815  * RETURNS: Status
4816  */
4817 NTSTATUS
4818 STDCALL
4819 NtLoadKey(
4820         IN      POBJECT_ATTRIBUTES      KeyObjectAttributes,
4821         IN      POBJECT_ATTRIBUTES      FileObjectAttributes
4822         );
4823
4824
4825 /*
4826  * FUNCTION: Locks a range of virtual memory.
4827  * ARGUMENTS:
4828  *       ProcessHandle = Handle to the process
4829  *       BaseAddress =  Lower boundary of the range of bytes to lock.
4830  *       NumberOfBytesLock = Offset to the upper boundary.
4831  *       NumberOfBytesLocked (OUT) = Number of bytes actually locked.
4832  * REMARK:
4833         This procedure maps to the win32 procedure VirtualLock.
4834  * RETURNS: Status [STATUS_SUCCESS | STATUS_WAS_LOCKED ]
4835  */
4836 NTSTATUS
4837 STDCALL
4838 NtLockVirtualMemory(
4839         HANDLE ProcessHandle,
4840         PVOID BaseAddress,
4841         ULONG NumberOfBytesToLock,
4842         PULONG NumberOfBytesLocked
4843         );
4844
4845 NTSTATUS
4846 STDCALL
4847 NtOpenObjectAuditAlarm(
4848         IN PUNICODE_STRING SubsystemName,
4849         IN PVOID HandleId,
4850         IN PUNICODE_STRING ObjectTypeName,
4851         IN PUNICODE_STRING ObjectName,
4852         IN PSECURITY_DESCRIPTOR SecurityDescriptor,
4853         IN HANDLE ClientToken,
4854         IN ULONG DesiredAccess,
4855         IN ULONG GrantedAccess,
4856         IN PPRIVILEGE_SET Privileges,
4857         IN BOOLEAN ObjectCreation,
4858         IN BOOLEAN AccessGranted,
4859         OUT PBOOLEAN GenerateOnClose
4860         );
4861
4862 /*
4863  * FUNCTION: Set the access protection of a range of virtual memory
4864  * ARGUMENTS:
4865  *        ProcessHandle = Handle to process owning the virtual address space
4866  *        BaseAddress   = Start address
4867  *        NumberOfBytesToProtect = Delimits the range of virtual memory
4868  *                              for which the new access protection holds
4869  *        NewAccessProtection = The new access proctection for the pages
4870  *        OldAccessProtection = Caller should supply storage for the old
4871  *                              access protection
4872  *
4873  * REMARKS:
4874  *       The function maps to the win32 VirtualProtectEx
4875  * RETURNS: Status
4876  */
4877 NTSTATUS
4878 STDCALL
4879 NtProtectVirtualMemory(
4880         IN HANDLE ProcessHandle,
4881         IN PVOID *BaseAddress,
4882         IN ULONG *NumberOfBytesToProtect,
4883         IN ULONG NewAccessProtection,
4884         OUT PULONG OldAccessProtection
4885         );
4886
4887 /*
4888  * FUNCTION: Query information about the content of a directory object
4889  * ARGUMENTS:
4890         DirectoryHandle =
4891         Buffer =   Buffer must be large enough to hold the name strings too
4892         ReturnSingleEntry = If TRUE :return the index of the next object in this directory in ObjectIndex
4893                             If FALSE:  return the number of objects in this directory in ObjectIndex
4894         RestartScan = If TRUE:  ignore input value of ObjectIndex  always start at index 0
4895                       If FALSE use input value of ObjectIndex
4896         Context =   zero based index of object in the directory  depends on GetNextIndex and IgnoreInputIndex
4897         ReturnLength  = Actual size of the ObjectIndex ???
4898  * RETURNS: Status
4899  */
4900 NTSTATUS
4901 STDCALL
4902 NtQueryDirectoryObject(
4903         IN      HANDLE  DirectoryHandle,
4904         OUT     PVOID   Buffer,
4905         IN      ULONG   BufferLength,
4906         IN      BOOLEAN ReturnSingleEntry,
4907         IN      BOOLEAN RestartScan,
4908         IN OUT  PULONG  Context,
4909         OUT     PULONG  ReturnLength OPTIONAL
4910         );
4911
4912 /*
4913  * FUNCTION: Query the interval and the clocksource for profiling
4914  * ARGUMENTS:
4915         Interval =
4916         ClockSource =
4917  * RETURNS: Status
4918  */
4919 NTSTATUS
4920 STDCALL
4921 NtQueryIntervalProfile(
4922         OUT PULONG Interval,
4923         OUT KPROFILE_SOURCE ClockSource
4924         );
4925
4926 /*
4927  * FUNCTION: Queries the information of a section object.
4928  * ARGUMENTS:
4929  *        SectionHandle = Handle to the section link object
4930  *        SectionInformationClass = Index to a certain information structure
4931  *        SectionInformation (OUT)= Caller supplies storage for resulting information
4932  *        Length =  Size of the supplied storage
4933  *        ResultLength = Data written
4934  * RETURNS: Status
4935  *
4936 */
4937 NTSTATUS
4938 STDCALL
4939 NtQuerySection(
4940         IN HANDLE SectionHandle,
4941         IN CINT SectionInformationClass,
4942         OUT PVOID SectionInformation,
4943         IN ULONG Length,
4944         OUT PULONG ResultLength
4945         );
4946
4947 /*
4948  * FUNCTION: Queries the virtual memory information.
4949  * ARGUMENTS:
4950           ProcessHandle = Process owning the virtual address space
4951           BaseAddress = Points to the page where the information is queried for.
4952  *        VirtualMemoryInformationClass = Index to a certain information structure
4953
4954           MemoryBasicInformation                MEMORY_BASIC_INFORMATION
4955
4956  *        VirtualMemoryInformation = caller supplies storage for the information structure
4957  *        Length = size of the structure
4958           ResultLength = Data written
4959  * RETURNS: Status
4960  *
4961 */
4962
4963 NTSTATUS
4964 STDCALL
4965 NtQueryVirtualMemory(
4966         IN HANDLE ProcessHandle,
4967         IN PVOID Address,
4968         IN IN CINT VirtualMemoryInformationClass,
4969         OUT PVOID VirtualMemoryInformation,
4970         IN ULONG Length,
4971         OUT PULONG ResultLength
4972         );
4973
4974 /*
4975  * FUNCTION: Raises a hard error (stops the system)
4976  * ARGUMENTS:
4977  *        Status = Status code of the hard error
4978  *        Unknown2 = ??
4979  *        Unknown3 = ??
4980  *        Unknown4 = ??
4981  *        Unknown5 = ??
4982  *        Unknown6 = ??
4983  * RETURNS: Status
4984  *
4985  */
4986
4987 NTSTATUS
4988 STDCALL
4989 NtRaiseHardError(
4990         IN NTSTATUS Status,
4991         ULONG Unknown2,
4992         ULONG Unknown3,
4993         ULONG Unknown4,
4994         ULONG Unknown5,
4995         ULONG Unknown6
4996         );
4997
4998 /*
4999  * FUNCTION: Sets the information of a registry key.
5000  * ARGUMENTS:
5001  *       KeyHandle = Handle to the registry key
5002  *       KeyInformationClass =  Index to the a certain information structure.
5003  *              Can be one of the following values:
5004  *
5005  *       KeyLastWriteTimeInformation  KEY_LAST_WRITE_TIME_INFORMATION
5006  *
5007  *       KeyInformation = Storage for the new information
5008  *       KeyInformationLength = Size of the information strucure
5009  * RETURNS: Status
5010  */
5011
5012 NTSTATUS
5013 STDCALL
5014 NtSetInformationKey(
5015         IN HANDLE KeyHandle,
5016         IN KEY_SET_INFORMATION_CLASS KeyInformationClass,
5017         IN PVOID KeyInformation,
5018         IN ULONG KeyInformationLength
5019         );
5020
5021 /*
5022  * FUNCTION: Changes a set of object specific parameters
5023  * ARGUMENTS:
5024  *      ObjectHandle =
5025  *      ObjectInformationClass = Index to the set of parameters to change.
5026
5027         ObjectHandleInformation         OBJECT_HANDLE_ATTRIBUTE_INFORMATION
5028
5029
5030  *      ObjectInformation = Caller supplies storage for parameters to set.
5031  *      Length = Size of the storage supplied
5032  * RETURNS: Status
5033 */
5034 NTSTATUS
5035 STDCALL
5036 NtSetInformationObject(
5037         IN HANDLE ObjectHandle,
5038         IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
5039         IN PVOID ObjectInformation,
5040         IN ULONG Length
5041         );
5042
5043 /*
5044  * FUNCTION: Sets the characteristics of a timer
5045  * ARGUMENTS:
5046  *      TimerHandle = Handle to the timer
5047  *      DueTime = Time before the timer becomes signalled for the first time.
5048  *      TimerApcRoutine = Completion routine can be called on time completion
5049  *      TimerContext = Argument to the completion routine
5050  *      Resume = Specifies if the timer should repeated after completing one cycle
5051  *      Period = Cycle of the timer
5052  * REMARKS: This routine maps to the win32 SetWaitableTimer.
5053  * RETURNS: Status
5054 */
5055 NTSTATUS
5056 STDCALL
5057 NtSetTimer(
5058         IN HANDLE TimerHandle,
5059         IN PLARGE_INTEGER DueTime,
5060         IN PTIMERAPCROUTINE TimerApcRoutine,
5061         IN PVOID TimerContext,
5062         IN BOOL WakeTimer,
5063         IN ULONG Period OPTIONAL,
5064         OUT PBOOLEAN PreviousState OPTIONAL
5065         );
5066
5067 /*
5068  * FUNCTION: Unloads a registry key.
5069  * ARGUMENTS:
5070  *       KeyHandle = Handle to the registry key
5071  * REMARK:
5072  *       This procedure maps to the win32 procedure RegUnloadKey
5073  * RETURNS: Status
5074  */
5075 NTSTATUS
5076 STDCALL
5077 NtUnloadKey(
5078         IN      POBJECT_ATTRIBUTES      KeyObjectAttributes
5079         );
5080
5081 /*
5082  * FUNCTION: Unlocks a range of virtual memory.
5083  * ARGUMENTS:
5084  *       ProcessHandle = Handle to the process
5085  *       BaseAddress =   Lower boundary of the range of bytes to unlock.
5086  *       NumberOfBytesToUnlock = Offset to the upper boundary to unlock.
5087  *       NumberOfBytesUnlocked (OUT) = Number of bytes actually unlocked.
5088  * REMARK:
5089         This procedure maps to the win32 procedure VirtualUnlock
5090  * RETURNS: Status [ STATUS_SUCCESS | STATUS_PAGE_WAS_ULOCKED ]
5091  */
5092 NTSTATUS
5093 STDCALL
5094 NtUnlockVirtualMemory(
5095         IN HANDLE ProcessHandle,
5096         IN PVOID BaseAddress,
5097         IN ULONG  NumberOfBytesToUnlock,
5098         OUT PULONG NumberOfBytesUnlocked OPTIONAL
5099         );
5100
5101 /*
5102  * FUNCTION: Waits for multiple objects to become signalled.
5103  * ARGUMENTS:
5104  *       Count = The number of objects
5105  *       Object = The array of object handles
5106  *       WaitType = Can be one of the values UserMode or KernelMode
5107  *       Alertable = If true the wait is alertable.
5108  *       Time = The maximum wait time.
5109  * REMARKS:
5110  *       This function maps to the win32 WaitForMultipleObjectEx.
5111  * RETURNS: Status
5112  */
5113 NTSTATUS
5114 STDCALL
5115 NtWaitForMultipleObjects (
5116         IN ULONG Count,
5117         IN HANDLE Object[],
5118         IN WAIT_TYPE WaitType,
5119         IN BOOLEAN Alertable,
5120         IN PLARGE_INTEGER Time
5121         );
5122
5123
5124
5125
5126
5127 #ifndef __USE_W32API
5128
5129 /*
5130  * FUNCTION: Continues a thread with the specified context
5131  * ARGUMENTS:
5132  *        Context = Specifies the processor context
5133  *        IrqLevel = Specifies the Interupt Request Level to continue with. Can
5134  *                      be PASSIVE_LEVEL or APC_LEVEL
5135  * REMARKS
5136  *        NtContinue can be used to continue after an exception or apc.
5137  * RETURNS: Status
5138  */
5139 //FIXME This function might need another parameter
5140
5141 NTSTATUS STDCALL ZwContinue(IN PCONTEXT Context, IN CINT IrqLevel);
5142
5143 /*
5144  * FUNCTION: Retrieves the system time
5145  * ARGUMENTS:
5146  *        CurrentTime (OUT) = Caller should supply storage for the resulting time.
5147  * RETURNS: Status
5148  *
5149 */
5150
5151 NTSTATUS
5152 STDCALL
5153 ZwQuerySystemTime (
5154         OUT PLARGE_INTEGER CurrentTime
5155         );
5156
5157 /*
5158  * FUNCTION: Copies a handle from one process space to another
5159  * ARGUMENTS:
5160  *         SourceProcessHandle = The source process owning the handle. The source process should have opened
5161  *                      the SourceHandle with PROCESS_DUP_HANDLE access.
5162  *         SourceHandle = The handle to the object.
5163  *         TargetProcessHandle = The destination process owning the handle
5164  *         TargetHandle (OUT) = Caller should supply storage for the duplicated handle.
5165  *         DesiredAccess = The desired access to the handle.
5166  *         InheritHandle = Indicates wheter the new handle will be inheritable or not.
5167  *         Options = Specifies special actions upon duplicating the handle. Can be
5168  *                      one of the values DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS.
5169  *                      DUPLICATE_CLOSE_SOURCE specifies that the source handle should be
5170  *                      closed after duplicating. DUPLICATE_SAME_ACCESS specifies to ignore
5171  *                      the DesiredAccess paramter and just grant the same access to the new
5172  *                      handle.
5173  * RETURNS: Status
5174  * REMARKS: This function maps to the win32 DuplicateHandle.
5175  */
5176
5177 NTSTATUS
5178 STDCALL
5179 NtDuplicateObject(
5180         IN HANDLE SourceProcessHandle,
5181         IN HANDLE SourceHandle,
5182         IN HANDLE TargetProcessHandle,
5183         OUT PHANDLE TargetHandle,
5184         IN ACCESS_MASK DesiredAccess,
5185         IN BOOLEAN InheritHandle,
5186         IN ULONG Options
5187         );
5188
5189 NTSTATUS
5190 STDCALL
5191 ZwDuplicateObject(
5192         IN HANDLE SourceProcessHandle,
5193         IN PHANDLE SourceHandle,
5194         IN HANDLE TargetProcessHandle,
5195         OUT PHANDLE TargetHandle,
5196         IN ACCESS_MASK DesiredAccess,
5197         IN BOOLEAN InheritHandle,
5198         IN ULONG Options
5199         );
5200
5201 /*
5202  * FUNCTION: Checks a clients access rights to a object and issues a audit a alarm. ( it logs the access )
5203  * ARGUMENTS:
5204  *        SubsystemName = Specifies the name of the subsystem, can be "WIN32" or "DEBUG"
5205  *        ObjectHandle =
5206  *        ObjectTypeName =
5207  *        ObjectName =
5208  *        SecurityDescriptor =
5209  *        DesiredAcces =
5210  *        GenericMapping =
5211  *        ObjectCreation =
5212  *        GrantedAccess =
5213  *        AccessStatus =
5214  *        GenerateOnClose =
5215  * REMARKS: The arguments map to the win32 AccessCheck
5216  * RETURNS: Status
5217  */
5218
5219 NTSTATUS
5220 STDCALL
5221 ZwAccessCheckAndAuditAlarm(
5222         IN PUNICODE_STRING SubsystemName,
5223         IN PHANDLE ObjectHandle,
5224         IN PUNICODE_STRING ObjectTypeName,
5225         IN PUNICODE_STRING ObjectName,
5226         IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5227         IN ACCESS_MASK DesiredAccess,
5228         IN PGENERIC_MAPPING GenericMapping,
5229         IN BOOLEAN ObjectCreation,
5230         OUT PACCESS_MASK GrantedAccess,
5231         OUT PNTSTATUS AccessStatus,
5232         OUT PBOOLEAN GenerateOnClose
5233         );
5234
5235 /*
5236  * FUNCTION: Adds an atom to the global atom table
5237  * ARGUMENTS:
5238  *       AtomName = The string to add to the atom table.
5239  *       AtomNameLength = Length of the atom name
5240  *       Atom (OUT) = Caller supplies storage for the resulting atom.
5241  * REMARKS: The arguments map to the win32 add GlobalAddAtom.
5242  * RETURNS: Status
5243  */
5244 NTSTATUS
5245 STDCALL
5246 NtAddAtom(
5247         IN      PWSTR           AtomName,
5248         IN      ULONG           AtomNameLength,
5249         IN OUT  PRTL_ATOM       Atom
5250         );
5251
5252
5253 NTSTATUS
5254 STDCALL
5255 ZwAddAtom(
5256         IN      PWSTR           AtomName,
5257         IN      ULONG           AtomNameLength,
5258         IN OUT  PRTL_ATOM       Atom
5259         );
5260
5261 NTSTATUS
5262 STDCALL
5263 NtAllocateUuids(
5264         PULARGE_INTEGER Time,
5265         PULONG Range,
5266         PULONG Sequence
5267         );
5268
5269 NTSTATUS
5270 STDCALL
5271 ZwAllocateUuids(
5272         PULARGE_INTEGER Time,
5273         PULONG Range,
5274         PULONG Sequence
5275         );
5276
5277 NTSTATUS
5278 STDCALL
5279 ZwCancelTimer(
5280         IN HANDLE TimerHandle,
5281         OUT ULONG ElapsedTime
5282         );
5283
5284 /*
5285  * FUNCTION: Creates a paging file.
5286  * ARGUMENTS:
5287  *        FileName  = Name of the pagefile
5288  *        InitialSize = Specifies the initial size in bytes
5289  *        MaximumSize = Specifies the maximum size in bytes
5290  *        Reserved = Reserved for future use
5291  * RETURNS: Status
5292  */
5293 NTSTATUS
5294 STDCALL
5295 ZwCreatePagingFile(
5296         IN PUNICODE_STRING FileName,
5297         IN PLARGE_INTEGER InitialSize,
5298         IN PLARGE_INTEGER MaxiumSize,
5299         IN ULONG Reserved
5300         );
5301
5302 /*
5303  * FUNCTION: Creates a user mode thread
5304  * ARGUMENTS:
5305  *        ThreadHandle (OUT) = Caller supplied storage for the resulting handle
5306  *        DesiredAccess = Specifies the allowed or desired access to the thread.
5307  *        ObjectAttributes = Initialized attributes for the object.
5308  *        ProcessHandle = Handle to the threads parent process.
5309  *        ClientId (OUT) = Caller supplies storage for returned process id and thread id.
5310  *        ThreadContext = Initial processor context for the thread.
5311  *        InitialTeb = Initial user mode stack context for the thread.
5312  *        CreateSuspended = Specifies if the thread is ready for scheduling
5313  * REMARKS:
5314  *        This function maps to the win32 function CreateThread.
5315  * RETURNS: Status
5316  */
5317 NTSTATUS
5318 STDCALL
5319 ZwCreateThread(
5320         OUT PHANDLE ThreadHandle,
5321         IN ACCESS_MASK DesiredAccess,
5322         IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
5323         IN HANDLE ProcessHandle,
5324         OUT PCLIENT_ID ClientId,
5325         IN PCONTEXT ThreadContext,
5326         IN PUSER_STACK UserStack,
5327         IN BOOLEAN CreateSuspended
5328         );
5329
5330 NTSTATUS
5331 STDCALL
5332 NtDuplicateToken(
5333         IN HANDLE ExistingToken,
5334         IN ACCESS_MASK DesiredAccess,
5335         IN POBJECT_ATTRIBUTES ObjectAttributes,
5336         IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
5337         IN TOKEN_TYPE TokenType,
5338         OUT PHANDLE NewToken
5339         );
5340
5341 NTSTATUS
5342 STDCALL
5343 ZwDuplicateToken(
5344         IN HANDLE ExistingToken,
5345         IN ACCESS_MASK DesiredAccess,
5346         IN POBJECT_ATTRIBUTES ObjectAttributes,
5347         IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
5348         IN TOKEN_TYPE TokenType,
5349         OUT PHANDLE NewToken
5350         );
5351
5352 /*
5353  * FUNCTION: Finds a atom
5354  * ARGUMENTS:
5355  *       AtomName = Name to search for.
5356  *       AtomNameLength = Length of the atom name
5357  *       Atom = Caller supplies storage for the resulting atom
5358  * RETURNS: Status
5359  * REMARKS:
5360  *      This funciton maps to the win32 GlobalFindAtom
5361  */
5362 NTSTATUS
5363 STDCALL
5364 NtFindAtom(
5365         IN      PWSTR           AtomName,
5366         IN      ULONG           AtomNameLength,
5367         OUT     PRTL_ATOM       Atom OPTIONAL
5368         );
5369
5370 NTSTATUS
5371 STDCALL
5372 ZwFindAtom(
5373         IN      PWSTR           AtomName,
5374         IN      ULONG           AtomNameLength,
5375         OUT     PRTL_ATOM       Atom OPTIONAL
5376         );
5377
5378 /*
5379  * FUNCTION: Flushes a the processors instruction cache
5380  * ARGUMENTS:
5381  *       ProcessHandle = Points to the process owning the cache
5382  *       BaseAddress = // might this be a image address ????
5383  *       NumberOfBytesToFlush =
5384  * RETURNS: Status
5385  * REMARKS:
5386  *      This funciton is used by debuggers
5387  */
5388 NTSTATUS
5389 STDCALL
5390 ZwFlushInstructionCache(
5391         IN HANDLE ProcessHandle,
5392         IN PVOID BaseAddress,
5393         IN UINT NumberOfBytesToFlush
5394         );
5395
5396 /*
5397  * FUNCTION: Flushes virtual memory to file
5398  * ARGUMENTS:
5399  *        ProcessHandle = Points to the process that allocated the virtual memory
5400  *        BaseAddress = Points to the memory address
5401  *        NumberOfBytesToFlush = Limits the range to flush,
5402  *        NumberOfBytesFlushed = Actual number of bytes flushed
5403  * RETURNS: Status
5404  * REMARKS:
5405  *        Check return status on STATUS_NOT_MAPPED_DATA
5406  */
5407 NTSTATUS
5408 STDCALL
5409 ZwFlushVirtualMemory(
5410         IN HANDLE ProcessHandle,
5411         IN PVOID BaseAddress,
5412         IN ULONG NumberOfBytesToFlush,
5413         OUT PULONG NumberOfBytesFlushed OPTIONAL
5414         );
5415
5416 /*
5417  * FUNCTION: Retrieves the uptime of the system
5418  * ARGUMENTS:
5419  *        UpTime = Number of clock ticks since boot.
5420  * RETURNS: Status
5421  */
5422 ULONG
5423 STDCALL
5424 ZwGetTickCount(
5425         VOID
5426         );
5427
5428 /*
5429  * FUNCTION: Loads a registry key.
5430  * ARGUMENTS:
5431  *       KeyObjectAttributes = Key to be loaded
5432  *       FileObjectAttributes = File to load the key from
5433  * REMARK:
5434  *      This procedure maps to the win32 procedure RegLoadKey
5435  * RETURNS: Status
5436  */
5437 NTSTATUS
5438 STDCALL
5439 ZwLoadKey(
5440         IN      POBJECT_ATTRIBUTES      KeyObjectAttributes,
5441         IN      POBJECT_ATTRIBUTES      FileObjectAttributes
5442         );
5443
5444 /*
5445  * FUNCTION: Locks a range of virtual memory.
5446  * ARGUMENTS:
5447  *       ProcessHandle = Handle to the process
5448  *       BaseAddress =  Lower boundary of the range of bytes to lock.
5449  *       NumberOfBytesLock = Offset to the upper boundary.
5450  *       NumberOfBytesLocked (OUT) = Number of bytes actually locked.
5451  * REMARK:
5452         This procedure maps to the win32 procedure VirtualLock.
5453  * RETURNS: Status [STATUS_SUCCESS | STATUS_WAS_LOCKED ]
5454  */
5455 NTSTATUS
5456 STDCALL
5457 ZwLockVirtualMemory(
5458         HANDLE ProcessHandle,
5459         PVOID BaseAddress,
5460         ULONG NumberOfBytesToLock,
5461         PULONG NumberOfBytesLocked
5462         );
5463
5464 NTSTATUS
5465 STDCALL
5466 ZwOpenObjectAuditAlarm(
5467         IN PUNICODE_STRING SubsystemName,
5468         IN PVOID HandleId,
5469         IN PUNICODE_STRING ObjectTypeName,
5470         IN PUNICODE_STRING ObjectName,
5471         IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5472         IN HANDLE ClientToken,
5473         IN ULONG DesiredAccess,
5474         IN ULONG GrantedAccess,
5475         IN PPRIVILEGE_SET Privileges,
5476         IN BOOLEAN ObjectCreation,
5477         IN BOOLEAN AccessGranted,
5478         OUT PBOOLEAN GenerateOnClose
5479         );
5480
5481 /*
5482  * FUNCTION: Set the access protection of a range of virtual memory
5483  * ARGUMENTS:
5484  *        ProcessHandle = Handle to process owning the virtual address space
5485  *        BaseAddress   = Start address
5486  *        NumberOfBytesToProtect = Delimits the range of virtual memory
5487  *                              for which the new access protection holds
5488  *        NewAccessProtection = The new access proctection for the pages
5489  *        OldAccessProtection = Caller should supply storage for the old
5490  *                              access protection
5491  *
5492  * REMARKS:
5493  *       The function maps to the win32 VirtualProtectEx
5494  * RETURNS: Status
5495  */
5496 NTSTATUS
5497 STDCALL
5498 ZwProtectVirtualMemory(
5499         IN HANDLE ProcessHandle,
5500         IN PVOID *BaseAddress,
5501         IN ULONG *NumberOfBytesToProtect,
5502         IN ULONG NewAccessProtection,
5503         OUT PULONG OldAccessProtection
5504         );
5505
5506 NTSTATUS
5507 STDCALL
5508 NtQueryInformationAtom(
5509         IN      RTL_ATOM                Atom,
5510         IN      ATOM_INFORMATION_CLASS  AtomInformationClass,
5511         OUT     PVOID                   AtomInformation,
5512         IN      ULONG                   AtomInformationLength,
5513         OUT     PULONG                  ReturnLength OPTIONAL
5514         );
5515
5516 NTSTATUS
5517 STDCALL
5518 ZwQueryInformationAtom(
5519         IN      RTL_ATOM                Atom,
5520         IN      ATOM_INFORMATION_CLASS  AtomInformationClass,
5521         OUT     PVOID                   AtomInformation,
5522         IN      ULONG                   AtomInformationLength,
5523         OUT     PULONG                  ReturnLength OPTIONAL
5524         );
5525
5526 /*
5527  * FUNCTION: Query information about the content of a directory object
5528  * ARGUMENTS:
5529         DirectoryHandle =
5530         Buffer =   Buffer must be large enough to hold the name strings too
5531         ReturnSingleEntry = If TRUE :return the index of the next object in this directory in ObjectIndex
5532                             If FALSE:  return the number of objects in this directory in ObjectIndex
5533         RestartScan = If TRUE:  ignore input value of ObjectIndex  always start at index 0
5534                       If FALSE use input value of ObjectIndex
5535         Context =   zero based index of object in the directory  depends on GetNextIndex and IgnoreInputIndex
5536         ReturnLength  = Actual size of the ObjectIndex ???
5537  * RETURNS: Status
5538  */
5539 NTSTATUS
5540 STDCALL
5541 ZwQueryDirectoryObject(
5542         IN      HANDLE  DirectoryHandle,
5543         OUT     PVOID   Buffer,
5544         IN      ULONG   BufferLength,
5545         IN      BOOLEAN ReturnSingleEntry,
5546         IN      BOOLEAN RestartScan,
5547         IN OUT  PULONG  Context,
5548         OUT     PULONG  ReturnLength OPTIONAL
5549         );
5550
5551 /*
5552  * FUNCTION: Queries the information of a process object.
5553  * ARGUMENTS:
5554  *        ProcessHandle = Handle to the process object
5555  *        ProcessInformation = Index to a certain information structure
5556
5557                 ProcessBasicInformation          PROCESS_BASIC_INFORMATION
5558                 ProcessQuotaLimits               QUOTA_LIMITS
5559                 ProcessIoCounters                IO_COUNTERS
5560                 ProcessVmCounters                VM_COUNTERS
5561                 ProcessTimes                     KERNEL_USER_TIMES
5562                 ProcessBasePriority              KPRIORITY
5563                 ProcessRaisePriority             KPRIORITY
5564                 ProcessDebugPort                 HANDLE
5565                 ProcessExceptionPort             HANDLE
5566                 ProcessAccessToken               PROCESS_ACCESS_TOKEN
5567                 ProcessLdtInformation            LDT_ENTRY ??
5568                 ProcessLdtSize                   ULONG
5569                 ProcessDefaultHardErrorMode      ULONG
5570                 ProcessIoPortHandlers            // kernel mode only
5571                 ProcessPooledUsageAndLimits      POOLED_USAGE_AND_LIMITS
5572                 ProcessWorkingSetWatch           PROCESS_WS_WATCH_INFORMATION
5573                 ProcessUserModeIOPL              (I/O Privilege Level)
5574                 ProcessEnableAlignmentFaultFixup BOOLEAN
5575                 ProcessPriorityClass             ULONG
5576                 ProcessWx86Information           ULONG
5577                 ProcessHandleCount               ULONG
5578                 ProcessAffinityMask              ULONG
5579                 ProcessPooledQuotaLimits         QUOTA_LIMITS
5580                 MaxProcessInfoClass
5581
5582  *        ProcessInformation = Caller supplies storage for the process information structure
5583  *        ProcessInformationLength = Size of the process information structure
5584  *        ReturnLength  = Actual number of bytes written
5585
5586  * REMARK:
5587  *        This procedure maps to the win32 GetProcessTimes, GetProcessVersion,
5588           GetProcessWorkingSetSize, GetProcessPriorityBoost, GetProcessAffinityMask, GetPriorityClass,
5589           GetProcessShutdownParameters  functions.
5590  * RETURNS: Status
5591 */
5592
5593 NTSTATUS
5594 STDCALL
5595 NtQueryInformationProcess(
5596         IN HANDLE ProcessHandle,
5597         IN CINT ProcessInformationClass,
5598         OUT PVOID ProcessInformation,
5599         IN ULONG ProcessInformationLength,
5600         OUT PULONG ReturnLength
5601         );
5602
5603 NTSTATUS
5604 STDCALL
5605 ZwQueryInformationProcess(
5606         IN HANDLE ProcessHandle,
5607         IN CINT ProcessInformationClass,
5608         OUT PVOID ProcessInformation,
5609         IN ULONG ProcessInformationLength,
5610         OUT PULONG ReturnLength
5611         );
5612
5613 /*
5614  * FUNCTION: Query the interval and the clocksource for profiling
5615  * ARGUMENTS:
5616         Interval =
5617         ClockSource =
5618  * RETURNS: Status
5619  */
5620 NTSTATUS
5621 STDCALL
5622 ZwQueryIntervalProfile(
5623         OUT PULONG Interval,
5624         OUT KPROFILE_SOURCE ClockSource
5625         );
5626
5627 /*
5628  * FUNCTION: Queries the information of a  object.
5629  * ARGUMENTS:
5630         ObjectHandle = Handle to a object
5631         ObjectInformationClass = Index to a certain information structure
5632
5633         ObjectBasicInformation          OBJECT_BASIC_INFORMATION
5634         ObjectNameInformation           OBJECT_NAME_INFORMATION
5635         ObjectTypeInformation           OBJECT_TYPE_INFORMATION
5636         ObjectAllTypesInformation       OBJECT_ALL_TYPES_INFORMATION
5637         ObjectHandleInformation         OBJECT_HANDLE_ATTRIBUTES_INFORMATION
5638
5639         ObjectInformation = Caller supplies storage for resulting information
5640         Length = Size of the supplied storage
5641         ResultLength = Bytes written
5642  */
5643
5644 NTSTATUS
5645 STDCALL
5646 ZwQueryObject(
5647         IN HANDLE ObjectHandle,
5648         IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
5649         OUT PVOID ObjectInformation,
5650         IN ULONG Length,
5651         OUT PULONG ResultLength OPTIONAL
5652         );
5653
5654 NTSTATUS
5655 STDCALL
5656 NtQuerySecurityObject(
5657         IN HANDLE Handle,
5658         IN SECURITY_INFORMATION SecurityInformation,
5659         OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
5660         IN ULONG Length,
5661         OUT PULONG ResultLength
5662         );
5663
5664 NTSTATUS
5665 STDCALL
5666 ZwQuerySecurityObject(
5667         IN HANDLE Handle,
5668         IN SECURITY_INFORMATION SecurityInformation,
5669         OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
5670         IN ULONG Length,
5671         OUT PULONG ResultLength
5672         );
5673
5674 /*
5675  * FUNCTION: Queries the virtual memory information.
5676  * ARGUMENTS:
5677           ProcessHandle = Process owning the virtual address space
5678           BaseAddress = Points to the page where the information is queried for.
5679  *        VirtualMemoryInformationClass = Index to a certain information structure
5680
5681           MemoryBasicInformation                MEMORY_BASIC_INFORMATION
5682
5683  *        VirtualMemoryInformation = caller supplies storage for the information structure
5684  *        Length = size of the structure
5685           ResultLength = Data written
5686  * RETURNS: Status
5687  *
5688 */
5689
5690 NTSTATUS
5691 STDCALL
5692 ZwQueryVirtualMemory(
5693         IN HANDLE ProcessHandle,
5694         IN PVOID Address,
5695         IN IN CINT VirtualMemoryInformationClass,
5696         OUT PVOID VirtualMemoryInformation,
5697         IN ULONG Length,
5698         OUT PULONG ResultLength
5699         );
5700
5701 /*
5702  * FUNCTION: Raises a hard error (stops the system)
5703  * ARGUMENTS:
5704  *        Status = Status code of the hard error
5705  *        Unknown2 = ??
5706  *        Unknown3 = ??
5707  *        Unknown4 = ??
5708  *        Unknown5 = ??
5709  *        Unknown6 = ??
5710  * RETURNS: Status
5711  *
5712  */
5713 NTSTATUS
5714 STDCALL
5715 ZwRaiseHardError(
5716         IN NTSTATUS Status,
5717         ULONG Unknown2,
5718         ULONG Unknown3,
5719         ULONG Unknown4,
5720         ULONG Unknown5,
5721         ULONG Unknown6
5722         );
5723
5724 /*
5725  * FUNCTION: Sets the information of a registry key.
5726  * ARGUMENTS:
5727  *       KeyHandle = Handle to the registry key
5728  *       KeyInformationClass =  Index to the a certain information structure.
5729                         Can be one of the following values:
5730
5731  *       KeyLastWriteTimeInformation  KEY_LAST_WRITE_TIME_INFORMATION
5732
5733          KeyInformation = Storage for the new information
5734  *       KeyInformationLength = Size of the information strucure
5735  * RETURNS: Status
5736  */
5737
5738 NTSTATUS
5739 STDCALL
5740 ZwSetInformationKey(
5741         IN HANDLE KeyHandle,
5742         IN KEY_SET_INFORMATION_CLASS KeyInformationClass,
5743         IN PVOID KeyInformation,
5744         IN ULONG KeyInformationLength
5745         );
5746
5747 /*
5748  * FUNCTION: Changes a set of object specific parameters
5749  * ARGUMENTS:
5750  *      ObjectHandle =
5751  *      ObjectInformationClass = Index to the set of parameters to change.
5752
5753         ObjectHandleInformation         OBJECT_HANDLE_ATTRIBUTE_INFORMATION
5754
5755
5756  *      ObjectInformation = Caller supplies storage for parameters to set.
5757  *      Length = Size of the storage supplied
5758  * RETURNS: Status
5759 */
5760 NTSTATUS
5761 STDCALL
5762 ZwSetInformationObject(
5763         IN HANDLE ObjectHandle,
5764         IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
5765         IN PVOID ObjectInformation,
5766         IN ULONG Length
5767         );
5768
5769 /*
5770  * FUNCTION: Changes a set of process specific parameters
5771  * ARGUMENTS:
5772  *      ProcessHandle = Handle to the process
5773  *      ProcessInformationClass = Index to a information structure.
5774  *
5775  *      ProcessBasicInformation                 PROCESS_BASIC_INFORMATION
5776  *      ProcessQuotaLimits                      QUOTA_LIMITS
5777  *      ProcessBasePriority                     KPRIORITY
5778  *      ProcessRaisePriority                    KPRIORITY
5779  *      ProcessDebugPort                        HANDLE
5780  *      ProcessExceptionPort                    HANDLE
5781  *      ProcessAccessToken                      PROCESS_ACCESS_TOKEN
5782  *      ProcessDefaultHardErrorMode             ULONG
5783  *      ProcessPriorityClass                    ULONG
5784  *      ProcessAffinityMask                     KAFFINITY //??
5785  *
5786  *      ProcessInformation = Caller supplies storage for information to set.
5787  *      ProcessInformationLength = Size of the information structure
5788  * RETURNS: Status
5789 */
5790 NTSTATUS
5791 STDCALL
5792 NtSetInformationProcess(
5793         IN HANDLE ProcessHandle,
5794         IN CINT ProcessInformationClass,
5795         IN PVOID ProcessInformation,
5796         IN ULONG ProcessInformationLength
5797         );
5798
5799 NTSTATUS
5800 STDCALL
5801 ZwSetInformationProcess(
5802         IN HANDLE ProcessHandle,
5803         IN CINT ProcessInformationClass,
5804         IN PVOID ProcessInformation,
5805         IN ULONG ProcessInformationLength
5806         );
5807
5808 /*
5809  * FUNCTION: Sets the characteristics of a timer
5810  * ARGUMENTS:
5811  *      TimerHandle = Handle to the timer
5812  *      DueTime = Time before the timer becomes signalled for the first time.
5813  *      TimerApcRoutine = Completion routine can be called on time completion
5814  *      TimerContext = Argument to the completion routine
5815  *      Resume = Specifies if the timer should repeated after completing one cycle
5816  *      Period = Cycle of the timer
5817  * REMARKS: This routine maps to the win32 SetWaitableTimer.
5818  * RETURNS: Status
5819 */
5820 NTSTATUS
5821 STDCALL
5822 ZwSetTimer(
5823         IN HANDLE TimerHandle,
5824         IN PLARGE_INTEGER DueTime,
5825         IN PTIMERAPCROUTINE TimerApcRoutine,
5826         IN PVOID TimerContext,
5827         IN BOOL WakeTimer,
5828         IN ULONG Period OPTIONAL,
5829         OUT PBOOLEAN PreviousState OPTIONAL
5830         );
5831
5832 /*
5833  * FUNCTION: Unloads a registry key.
5834  * ARGUMENTS:
5835  *       KeyHandle = Handle to the registry key
5836  * REMARK:
5837  *       This procedure maps to the win32 procedure RegUnloadKey
5838  * RETURNS: Status
5839  */
5840 NTSTATUS
5841 STDCALL
5842 ZwUnloadKey(
5843         IN      POBJECT_ATTRIBUTES      KeyObjectAttributes
5844         );
5845
5846 /*
5847  * FUNCTION: Unlocks a range of virtual memory.
5848  * ARGUMENTS:
5849  *       ProcessHandle = Handle to the process
5850  *       BaseAddress =   Lower boundary of the range of bytes to unlock.
5851  *       NumberOfBytesToUnlock = Offset to the upper boundary to unlock.
5852  *       NumberOfBytesUnlocked (OUT) = Number of bytes actually unlocked.
5853  * REMARK:
5854         This procedure maps to the win32 procedure VirtualUnlock
5855  * RETURNS: Status [ STATUS_SUCCESS | STATUS_PAGE_WAS_ULOCKED ]
5856  */
5857 NTSTATUS
5858 STDCALL
5859 ZwUnlockVirtualMemory(
5860         IN HANDLE ProcessHandle,
5861         IN PVOID BaseAddress,
5862         IN ULONG  NumberOfBytesToUnlock,
5863         OUT PULONG NumberOfBytesUnlocked OPTIONAL
5864         );
5865
5866 /*
5867  * FUNCTION: Waits for multiple objects to become signalled.
5868  * ARGUMENTS:
5869  *       Count = The number of objects
5870  *       Object = The array of object handles
5871  *       WaitType = Can be one of the values UserMode or KernelMode
5872  *       Alertable = If true the wait is alertable.
5873  *       Time = The maximum wait time.
5874  * REMARKS:
5875  *       This function maps to the win32 WaitForMultipleObjectEx.
5876  * RETURNS: Status
5877  */
5878 NTSTATUS
5879 STDCALL
5880 ZwWaitForMultipleObjects (
5881         IN ULONG Count,
5882         IN HANDLE Object[],
5883         IN WAIT_TYPE WaitType,
5884         IN BOOLEAN Alertable,
5885         IN PLARGE_INTEGER Time
5886         );
5887
5888 /*
5889  * FUNCTION: Creates a profile
5890  * ARGUMENTS:
5891  *        ProfileHandle (OUT) = Caller supplied storage for the resulting handle
5892  *        ObjectAttribute = Initialized attributes for the object
5893  *        ImageBase = Start address of executable image
5894  *        ImageSize = Size of the image
5895  *        Granularity = Bucket size
5896  *        Buffer =  Caller supplies buffer for profiling info
5897  *        ProfilingSize = Buffer size
5898  *        ClockSource = Specify 0 / FALSE ??
5899  *        ProcessorMask = A value of -1 indicates disables  per processor profiling,
5900                           otherwise bit set for the processor to profile.
5901  * REMARKS:
5902  *        This function maps to the win32 CreateProcess.
5903  * RETURNS: Status
5904  */
5905
5906 NTSTATUS
5907 STDCALL
5908 ZwCreateProfile(
5909         OUT PHANDLE ProfileHandle,
5910         IN POBJECT_ATTRIBUTES ObjectAttributes,
5911         IN ULONG ImageBase,
5912         IN ULONG ImageSize,
5913         IN ULONG Granularity,
5914         OUT PVOID Buffer,
5915         IN ULONG ProfilingSize,
5916         IN ULONG ClockSource,
5917         IN ULONG ProcessorMask
5918         );
5919
5920 /*
5921  * FUNCTION: Delays the execution of the calling thread.
5922  * ARGUMENTS:
5923  *        Alertable = If TRUE the thread is alertable during is wait period
5924  *        Interval  = Specifies the interval to wait.
5925  * RETURNS: Status
5926  */
5927 NTSTATUS
5928 STDCALL
5929 ZwDelayExecution(
5930         IN BOOLEAN Alertable,
5931         IN TIME *Interval
5932         );
5933
5934 /*
5935  * FUNCTION: Extends a section
5936  * ARGUMENTS:
5937  *       SectionHandle = Handle to the section
5938  *       NewMaximumSize = Adjusted size
5939  * RETURNS: Status
5940  */
5941 NTSTATUS
5942 STDCALL
5943 ZwExtendSection(
5944         IN HANDLE SectionHandle,
5945         IN ULONG NewMaximumSize
5946         );
5947
5948 /*
5949  * FUNCTION: Queries the information of a section object.
5950  * ARGUMENTS:
5951  *        SectionHandle = Handle to the section link object
5952  *        SectionInformationClass = Index to a certain information structure
5953  *        SectionInformation (OUT)= Caller supplies storage for resulting information
5954  *        Length =  Size of the supplied storage
5955  *        ResultLength = Data written
5956  * RETURNS: Status
5957  *
5958 */
5959 NTSTATUS
5960 STDCALL
5961 ZwQuerySection(
5962         IN HANDLE SectionHandle,
5963         IN CINT SectionInformationClass,
5964         OUT PVOID SectionInformation,
5965         IN ULONG Length,
5966         OUT PULONG ResultLength
5967         );
5968
5969 typedef struct _SECTION_IMAGE_INFORMATION
5970 {
5971   PVOID EntryPoint;
5972   ULONG Unknown1;
5973   ULONG StackReserve;
5974   ULONG StackCommit;
5975   ULONG Subsystem;
5976   USHORT MinorSubsystemVersion;
5977   USHORT MajorSubsystemVersion;
5978   ULONG Unknown2;
5979   ULONG Characteristics;
5980   USHORT ImageNumber;
5981   BOOLEAN Executable;
5982   UCHAR Unknown3;
5983   ULONG Unknown4[3];
5984 } SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;
5985
5986 #endif /* !__USE_W32API */
5987
5988 /*
5989  * FUNCTION: Loads a registry key.
5990  * ARGUMENTS:
5991  *       KeyObjectAttributes = Key to be loaded
5992  *       FileObjectAttributes = File to load the key from
5993  *       Flags = ???
5994  * REMARK:
5995  *       This procedure maps to the win32 procedure RegLoadKey
5996  * RETURNS: Status
5997  */
5998 NTSTATUS
5999 STDCALL
6000 NtLoadKey2(
6001         IN      POBJECT_ATTRIBUTES      KeyObjectAttributes,
6002         IN      POBJECT_ATTRIBUTES      FileObjectAttributes,
6003         IN      ULONG                   Flags
6004         );
6005
6006 NTSTATUS
6007 STDCALL
6008 ZwLoadKey2(
6009         IN      POBJECT_ATTRIBUTES      KeyObjectAttributes,
6010         IN      POBJECT_ATTRIBUTES      FileObjectAttributes,
6011         IN      ULONG                   Flags
6012         );
6013
6014 /*
6015  * FUNCTION: Retrieves the system time
6016  * ARGUMENTS:
6017  *        CurrentTime (OUT) = Caller should supply storage for the resulting time.
6018  * RETURNS: Status
6019  *
6020 */
6021
6022 NTSTATUS
6023 STDCALL
6024 NtQuerySystemTime (
6025         OUT PLARGE_INTEGER CurrentTime
6026         );
6027
6028 /*
6029  * FUNCTION: Queries the information of a  object.
6030  * ARGUMENTS:
6031         ObjectHandle = Handle to a object
6032         ObjectInformationClass = Index to a certain information structure
6033
6034         ObjectBasicInformation          OBJECT_BASIC_INFORMATION
6035         ObjectNameInformation           OBJECT_NAME_INFORMATION
6036         ObjectTypeInformation           OBJECT_TYPE_INFORMATION
6037         ObjectAllTypesInformation       OBJECT_ALL_TYPES_INFORMATION
6038         ObjectHandleInformation         OBJECT_HANDLE_ATTRIBUTE_INFORMATION
6039
6040         ObjectInformation = Caller supplies storage for resulting information
6041         Length = Size of the supplied storage
6042         ResultLength = Bytes written
6043  */
6044
6045 NTSTATUS
6046 STDCALL
6047 NtQueryObject(
6048         IN HANDLE ObjectHandle,
6049         IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
6050         OUT PVOID ObjectInformation,
6051         IN ULONG Length,
6052         OUT PULONG ResultLength OPTIONAL
6053         );
6054
6055 /* BEGIN REACTOS ONLY */
6056
6057 BOOLEAN STDCALL
6058 ExInitializeBinaryTree(IN PBINARY_TREE  Tree,
6059   IN PKEY_COMPARATOR  Compare,
6060   IN BOOLEAN  UseNonPagedPool);
6061
6062 VOID STDCALL
6063 ExDeleteBinaryTree(IN PBINARY_TREE  Tree);
6064
6065 VOID STDCALL
6066 ExInsertBinaryTree(IN PBINARY_TREE  Tree,
6067   IN PVOID  Key,
6068   IN PVOID  Value);
6069
6070 BOOLEAN STDCALL
6071 ExSearchBinaryTree(IN PBINARY_TREE  Tree,
6072   IN PVOID  Key,
6073   OUT PVOID  * Value);
6074
6075 BOOLEAN STDCALL
6076 ExRemoveBinaryTree(IN PBINARY_TREE  Tree,
6077   IN PVOID  Key,
6078   IN PVOID  * Value);
6079
6080 BOOLEAN STDCALL
6081 ExTraverseBinaryTree(IN PBINARY_TREE  Tree,
6082   IN TRAVERSE_METHOD  Method,
6083   IN PTRAVERSE_ROUTINE  Routine,
6084   IN PVOID  Context);
6085
6086 BOOLEAN STDCALL
6087 ExInitializeSplayTree(IN PSPLAY_TREE  Tree,
6088   IN PKEY_COMPARATOR  Compare,
6089   IN BOOLEAN  Weighted,
6090   IN BOOLEAN  UseNonPagedPool);
6091
6092 VOID STDCALL
6093 ExDeleteSplayTree(IN PSPLAY_TREE  Tree);
6094
6095 VOID STDCALL
6096 ExInsertSplayTree(IN PSPLAY_TREE  Tree,
6097   IN PVOID  Key,
6098   IN PVOID  Value);
6099
6100 BOOLEAN STDCALL
6101 ExSearchSplayTree(IN PSPLAY_TREE  Tree,
6102   IN PVOID  Key,
6103   OUT PVOID  * Value);
6104
6105 BOOLEAN STDCALL
6106 ExRemoveSplayTree(IN PSPLAY_TREE  Tree,
6107   IN PVOID  Key,
6108   IN PVOID  * Value);
6109
6110 BOOLEAN STDCALL
6111 ExWeightOfSplayTree(IN PSPLAY_TREE  Tree,
6112   OUT PULONG  Weight);
6113
6114 BOOLEAN STDCALL
6115 ExTraverseSplayTree(IN PSPLAY_TREE  Tree,
6116   IN TRAVERSE_METHOD  Method,
6117   IN PTRAVERSE_ROUTINE  Routine,
6118   IN PVOID  Context);
6119
6120 BOOLEAN STDCALL
6121 ExInitializeHashTable(IN PHASH_TABLE  HashTable,
6122   IN ULONG  HashTableSize,
6123   IN PKEY_COMPARATOR  Compare  OPTIONAL,
6124   IN BOOLEAN  UseNonPagedPool);
6125
6126 VOID STDCALL
6127 ExDeleteHashTable(IN PHASH_TABLE  HashTable);
6128
6129 VOID STDCALL
6130 ExInsertHashTable(IN PHASH_TABLE  HashTable,
6131   IN PVOID  Key,
6132   IN ULONG  KeyLength,
6133   IN PVOID  Value);
6134
6135 BOOLEAN STDCALL
6136 ExSearchHashTable(IN PHASH_TABLE  HashTable,
6137   IN PVOID  Key,
6138   IN ULONG  KeyLength,
6139   OUT PVOID  * Value);
6140
6141 BOOLEAN STDCALL
6142 ExRemoveHashTable(IN PHASH_TABLE  HashTable,
6143   IN PVOID  Key,
6144   IN ULONG  KeyLength,
6145   IN PVOID  * Value);
6146
6147 /* END REACTOS ONLY */
6148
6149 #endif /* __DDK_ZW_H */