50ce7b86e588f38055f743ef37cafba11737eab0
[reactos.git] / reactos / w32api / include / ddk / ntifs.h
1 /*
2 * ntifs.h
3 *
4 * Windows NT Filesystem Driver Developer Kit
5 *
6 * This file is part of the w32api package.
7 *
8 * Contributors:
9 * Created by Bo Brantén <bosse@acc.umu.se>
10 *
11 * THIS SOFTWARE IS NOT COPYRIGHTED
12 *
13 * This source code is offered for use in the public domain. You may
14 * use, modify or distribute it freely.
15 *
16 * This code is distributed in the hope that it will be useful but
17 * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
18 * DISCLAIMED. This includes but is not limited to warranties of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 */
22
23 #ifndef _NTIFS_
24 #define _NTIFS_
25 #define _GNU_NTIFS_
26
27 #if __GNUC__ >= 3
28 #pragma GCC system_header
29 #endif
30
31 #include "ntddk.h"
32 #include "csq.h"
33
34 #ifdef __cplusplus
35 extern "C" {
36 #endif
37
38 #pragma pack(push,4)
39
40 #define VER_PRODUCTBUILD 10000
41
42 #ifndef NTSYSAPI
43 #define NTSYSAPI
44 #endif
45
46 #ifndef NTKERNELAPI
47 #define NTKERNELAPI DECLSPEC_IMPORT
48 #endif
49
50 typedef struct _SE_EXPORTS *PSE_EXPORTS;
51
52 #ifdef _NTOSKRNL_
53 extern PUCHAR FsRtlLegalAnsiCharacterArray;
54 #else
55 extern DECLSPEC_IMPORT PUCHAR FsRtlLegalAnsiCharacterArray;
56 #endif
57 extern PSE_EXPORTS SeExports;
58 extern PACL SePublicDefaultDacl;
59 extern PACL SeSystemDefaultDacl;
60
61 extern KSPIN_LOCK IoStatisticsLock;
62 extern ULONG IoReadOperationCount;
63 extern ULONG IoWriteOperationCount;
64 extern ULONG IoOtherOperationCount;
65 extern LARGE_INTEGER IoReadTransferCount;
66 extern LARGE_INTEGER IoWriteTransferCount;
67 extern LARGE_INTEGER IoOtherTransferCount;
68
69 #define ANSI_DOS_STAR ('<')
70 #define ANSI_DOS_QM ('>')
71 #define ANSI_DOS_DOT ('"')
72
73 #define DOS_STAR (L'<')
74 #define DOS_QM (L'>')
75 #define DOS_DOT (L'"')
76
77 /* also in winnt.h */
78 #define ACCESS_MIN_MS_ACE_TYPE (0x0)
79 #define ACCESS_ALLOWED_ACE_TYPE (0x0)
80 #define ACCESS_DENIED_ACE_TYPE (0x1)
81 #define SYSTEM_AUDIT_ACE_TYPE (0x2)
82 #define SYSTEM_ALARM_ACE_TYPE (0x3)
83 #define ACCESS_MAX_MS_V2_ACE_TYPE (0x3)
84 #define ACCESS_ALLOWED_COMPOUND_ACE_TYPE (0x4)
85 #define ACCESS_MAX_MS_V3_ACE_TYPE (0x4)
86 #define ACCESS_MIN_MS_OBJECT_ACE_TYPE (0x5)
87 #define ACCESS_ALLOWED_OBJECT_ACE_TYPE (0x5)
88 #define ACCESS_DENIED_OBJECT_ACE_TYPE (0x6)
89 #define SYSTEM_AUDIT_OBJECT_ACE_TYPE (0x7)
90 #define SYSTEM_ALARM_OBJECT_ACE_TYPE (0x8)
91 #define ACCESS_MAX_MS_OBJECT_ACE_TYPE (0x8)
92 #define ACCESS_MAX_MS_V4_ACE_TYPE (0x8)
93 #define ACCESS_MAX_MS_ACE_TYPE (0x8)
94 #define ACCESS_ALLOWED_CALLBACK_ACE_TYPE (0x9)
95 #define ACCESS_DENIED_CALLBACK_ACE_TYPE (0xA)
96 #define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE (0xB)
97 #define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE (0xC)
98 #define SYSTEM_AUDIT_CALLBACK_ACE_TYPE (0xD)
99 #define SYSTEM_ALARM_CALLBACK_ACE_TYPE (0xE)
100 #define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE (0xF)
101 #define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE (0x10)
102 #define ACCESS_MAX_MS_V5_ACE_TYPE (0x10)
103
104 #define COMPRESSION_FORMAT_NONE (0x0000)
105 #define COMPRESSION_FORMAT_DEFAULT (0x0001)
106 #define COMPRESSION_FORMAT_LZNT1 (0x0002)
107 #define COMPRESSION_ENGINE_STANDARD (0x0000)
108 #define COMPRESSION_ENGINE_MAXIMUM (0x0100)
109 #define COMPRESSION_ENGINE_HIBER (0x0200)
110
111 #define FILE_ACTION_ADDED 0x00000001
112 #define FILE_ACTION_REMOVED 0x00000002
113 #define FILE_ACTION_MODIFIED 0x00000003
114 #define FILE_ACTION_RENAMED_OLD_NAME 0x00000004
115 #define FILE_ACTION_RENAMED_NEW_NAME 0x00000005
116 #define FILE_ACTION_ADDED_STREAM 0x00000006
117 #define FILE_ACTION_REMOVED_STREAM 0x00000007
118 #define FILE_ACTION_MODIFIED_STREAM 0x00000008
119 #define FILE_ACTION_REMOVED_BY_DELETE 0x00000009
120 #define FILE_ACTION_ID_NOT_TUNNELLED 0x0000000A
121 #define FILE_ACTION_TUNNELLED_ID_COLLISION 0x0000000B
122 /* end winnt.h */
123
124 #define FILE_EA_TYPE_BINARY 0xfffe
125 #define FILE_EA_TYPE_ASCII 0xfffd
126 #define FILE_EA_TYPE_BITMAP 0xfffb
127 #define FILE_EA_TYPE_METAFILE 0xfffa
128 #define FILE_EA_TYPE_ICON 0xfff9
129 #define FILE_EA_TYPE_EA 0xffee
130 #define FILE_EA_TYPE_MVMT 0xffdf
131 #define FILE_EA_TYPE_MVST 0xffde
132 #define FILE_EA_TYPE_ASN1 0xffdd
133 #define FILE_EA_TYPE_FAMILY_IDS 0xff01
134
135 #define FILE_NEED_EA 0x00000080
136
137 /* also in winnt.h */
138 #define FILE_NOTIFY_CHANGE_FILE_NAME 0x00000001
139 #define FILE_NOTIFY_CHANGE_DIR_NAME 0x00000002
140 #define FILE_NOTIFY_CHANGE_NAME 0x00000003
141 #define FILE_NOTIFY_CHANGE_ATTRIBUTES 0x00000004
142 #define FILE_NOTIFY_CHANGE_SIZE 0x00000008
143 #define FILE_NOTIFY_CHANGE_LAST_WRITE 0x00000010
144 #define FILE_NOTIFY_CHANGE_LAST_ACCESS 0x00000020
145 #define FILE_NOTIFY_CHANGE_CREATION 0x00000040
146 #define FILE_NOTIFY_CHANGE_EA 0x00000080
147 #define FILE_NOTIFY_CHANGE_SECURITY 0x00000100
148 #define FILE_NOTIFY_CHANGE_STREAM_NAME 0x00000200
149 #define FILE_NOTIFY_CHANGE_STREAM_SIZE 0x00000400
150 #define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
151 #define FILE_NOTIFY_VALID_MASK 0x00000fff
152 /* end winnt.h */
153
154 #define FILE_OPLOCK_BROKEN_TO_LEVEL_2 0x00000007
155 #define FILE_OPLOCK_BROKEN_TO_NONE 0x00000008
156
157 #define FILE_OPBATCH_BREAK_UNDERWAY 0x00000009
158
159 #define FILE_CASE_SENSITIVE_SEARCH 0x00000001
160 #define FILE_CASE_PRESERVED_NAMES 0x00000002
161 #define FILE_UNICODE_ON_DISK 0x00000004
162 #define FILE_PERSISTENT_ACLS 0x00000008
163 #define FILE_FILE_COMPRESSION 0x00000010
164 #define FILE_VOLUME_QUOTAS 0x00000020
165 #define FILE_SUPPORTS_SPARSE_FILES 0x00000040
166 #define FILE_SUPPORTS_REPARSE_POINTS 0x00000080
167 #define FILE_SUPPORTS_REMOTE_STORAGE 0x00000100
168 #define FS_LFN_APIS 0x00004000
169 #define FILE_VOLUME_IS_COMPRESSED 0x00008000
170 #define FILE_SUPPORTS_OBJECT_IDS 0x00010000
171 #define FILE_SUPPORTS_ENCRYPTION 0x00020000
172 #define FILE_NAMED_STREAMS 0x00040000
173
174 #define FILE_PIPE_BYTE_STREAM_TYPE 0x00000000
175 #define FILE_PIPE_MESSAGE_TYPE 0x00000001
176
177 #define FILE_PIPE_BYTE_STREAM_MODE 0x00000000
178 #define FILE_PIPE_MESSAGE_MODE 0x00000001
179
180 #define FILE_PIPE_QUEUE_OPERATION 0x00000000
181 #define FILE_PIPE_COMPLETE_OPERATION 0x00000001
182
183 #define FILE_PIPE_INBOUND 0x00000000
184 #define FILE_PIPE_OUTBOUND 0x00000001
185 #define FILE_PIPE_FULL_DUPLEX 0x00000002
186
187 #define FILE_PIPE_DISCONNECTED_STATE 0x00000001
188 #define FILE_PIPE_LISTENING_STATE 0x00000002
189 #define FILE_PIPE_CONNECTED_STATE 0x00000003
190 #define FILE_PIPE_CLOSING_STATE 0x00000004
191
192 #define FILE_PIPE_CLIENT_END 0x00000000
193 #define FILE_PIPE_SERVER_END 0x00000001
194
195 #define FILE_PIPE_READ_DATA 0x00000000
196 #define FILE_PIPE_WRITE_SPACE 0x00000001
197
198 #define FILE_STORAGE_TYPE_SPECIFIED 0x00000041 /* FILE_DIRECTORY_FILE | FILE_NON_DIRECTORY_FILE */
199 #define FILE_STORAGE_TYPE_DEFAULT (StorageTypeDefault << FILE_STORAGE_TYPE_SHIFT)
200 #define FILE_STORAGE_TYPE_DIRECTORY (StorageTypeDirectory << FILE_STORAGE_TYPE_SHIFT)
201 #define FILE_STORAGE_TYPE_FILE (StorageTypeFile << FILE_STORAGE_TYPE_SHIFT)
202 #define FILE_STORAGE_TYPE_DOCFILE (StorageTypeDocfile << FILE_STORAGE_TYPE_SHIFT)
203 #define FILE_STORAGE_TYPE_JUNCTION_POINT (StorageTypeJunctionPoint << FILE_STORAGE_TYPE_SHIFT)
204 #define FILE_STORAGE_TYPE_CATALOG (StorageTypeCatalog << FILE_STORAGE_TYPE_SHIFT)
205 #define FILE_STORAGE_TYPE_STRUCTURED_STORAGE (StorageTypeStructuredStorage << FILE_STORAGE_TYPE_SHIFT)
206 #define FILE_STORAGE_TYPE_EMBEDDING (StorageTypeEmbedding << FILE_STORAGE_TYPE_SHIFT)
207 #define FILE_STORAGE_TYPE_STREAM (StorageTypeStream << FILE_STORAGE_TYPE_SHIFT)
208 #define FILE_MINIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_DEFAULT
209 #define FILE_MAXIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_STREAM
210 #define FILE_STORAGE_TYPE_MASK 0x000f0000
211 #define FILE_STORAGE_TYPE_SHIFT 16
212
213 #define FILE_VC_QUOTA_NONE 0x00000000
214 #define FILE_VC_QUOTA_TRACK 0x00000001
215 #define FILE_VC_QUOTA_ENFORCE 0x00000002
216 #define FILE_VC_QUOTA_MASK 0x00000003
217
218 #define FILE_VC_QUOTAS_LOG_VIOLATIONS 0x00000004
219 #define FILE_VC_CONTENT_INDEX_DISABLED 0x00000008
220
221 #define FILE_VC_LOG_QUOTA_THRESHOLD 0x00000010
222 #define FILE_VC_LOG_QUOTA_LIMIT 0x00000020
223 #define FILE_VC_LOG_VOLUME_THRESHOLD 0x00000040
224 #define FILE_VC_LOG_VOLUME_LIMIT 0x00000080
225
226 #define FILE_VC_QUOTAS_INCOMPLETE 0x00000100
227 #define FILE_VC_QUOTAS_REBUILDING 0x00000200
228
229 #define FILE_VC_VALID_MASK 0x000003ff
230
231 #define FSRTL_FLAG_FILE_MODIFIED (0x01)
232 #define FSRTL_FLAG_FILE_LENGTH_CHANGED (0x02)
233 #define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04)
234 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08)
235 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10)
236 #define FSRTL_FLAG_USER_MAPPED_FILE (0x20)
237 #define FSRTL_FLAG_EOF_ADVANCE_ACTIVE (0x80)
238
239 #define FSRTL_FLAG2_DO_MODIFIED_WRITE (0x01)
240
241 #define FSRTL_FSP_TOP_LEVEL_IRP (0x01)
242 #define FSRTL_CACHE_TOP_LEVEL_IRP (0x02)
243 #define FSRTL_MOD_WRITE_TOP_LEVEL_IRP (0x03)
244 #define FSRTL_FAST_IO_TOP_LEVEL_IRP (0x04)
245 #define FSRTL_MAX_TOP_LEVEL_IRP_FLAG (0x04)
246
247 #define FSRTL_VOLUME_DISMOUNT 1
248 #define FSRTL_VOLUME_DISMOUNT_FAILED 2
249 #define FSRTL_VOLUME_LOCK 3
250 #define FSRTL_VOLUME_LOCK_FAILED 4
251 #define FSRTL_VOLUME_UNLOCK 5
252 #define FSRTL_VOLUME_MOUNT 6
253
254 #define FSRTL_WILD_CHARACTER 0x08
255
256 #define FSRTL_FAT_LEGAL 0x01
257 #define FSRTL_HPFS_LEGAL 0x02
258 #define FSRTL_NTFS_LEGAL 0x04
259 #define FSRTL_WILD_CHARACTER 0x08
260 #define FSRTL_OLE_LEGAL 0x10
261 #define FSRTL_NTFS_STREAM_LEGAL 0x14
262
263 #ifdef _X86_
264 #define HARDWARE_PTE HARDWARE_PTE_X86
265 #define PHARDWARE_PTE PHARDWARE_PTE_X86
266 #else
267 #define HARDWARE_PTE ULONG
268 #define PHARDWARE_PTE PULONG
269 #endif
270
271 #define IO_CHECK_CREATE_PARAMETERS 0x0200
272 #define IO_ATTACH_DEVICE 0x0400
273
274 #define IO_ATTACH_DEVICE_API 0x80000000
275 /* also in winnt.h */
276 #define IO_COMPLETION_QUERY_STATE 0x0001
277 #define IO_COMPLETION_MODIFY_STATE 0x0002
278 #define IO_COMPLETION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3)
279 /* end winnt.h */
280 #define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE 64
281 #define IO_FILE_OBJECT_PAGED_POOL_CHARGE 1024
282
283 #define IO_TYPE_APC 18
284 #define IO_TYPE_DPC 19
285 #define IO_TYPE_DEVICE_QUEUE 20
286 #define IO_TYPE_EVENT_PAIR 21
287 #define IO_TYPE_INTERRUPT 22
288 #define IO_TYPE_PROFILE 23
289
290 #define IRP_BEING_VERIFIED 0x10
291
292 #define MAILSLOT_CLASS_FIRSTCLASS 1
293 #define MAILSLOT_CLASS_SECONDCLASS 2
294
295 #define MAILSLOT_SIZE_AUTO 0
296
297 #define MAP_PROCESS 1L
298 #define MAP_SYSTEM 2L
299 #define MEM_DOS_LIM 0x40000000
300 /* also in winnt.h */
301 #define MEM_IMAGE SEC_IMAGE
302 /* end winnt.h */
303 #define OB_TYPE_TYPE 1
304 #define OB_TYPE_DIRECTORY 2
305 #define OB_TYPE_SYMBOLIC_LINK 3
306 #define OB_TYPE_TOKEN 4
307 #define OB_TYPE_PROCESS 5
308 #define OB_TYPE_THREAD 6
309 #define OB_TYPE_EVENT 7
310 #define OB_TYPE_EVENT_PAIR 8
311 #define OB_TYPE_MUTANT 9
312 #define OB_TYPE_SEMAPHORE 10
313 #define OB_TYPE_TIMER 11
314 #define OB_TYPE_PROFILE 12
315 #define OB_TYPE_WINDOW_STATION 13
316 #define OB_TYPE_DESKTOP 14
317 #define OB_TYPE_SECTION 15
318 #define OB_TYPE_KEY 16
319 #define OB_TYPE_PORT 17
320 #define OB_TYPE_ADAPTER 18
321 #define OB_TYPE_CONTROLLER 19
322 #define OB_TYPE_DEVICE 20
323 #define OB_TYPE_DRIVER 21
324 #define OB_TYPE_IO_COMPLETION 22
325 #define OB_TYPE_FILE 23
326
327 #define PIN_WAIT (1)
328 #define PIN_EXCLUSIVE (2)
329 #define PIN_NO_READ (4)
330 #define PIN_IF_BCB (8)
331
332 /* also in winnt.h */
333 #define SEC_BASED 0x00200000
334 #define SEC_NO_CHANGE 0x00400000
335 #define SEC_FILE 0x00800000
336 #define SEC_IMAGE 0x01000000
337 #define SEC_VLM 0x02000000
338 #define SEC_RESERVE 0x04000000
339 #define SEC_COMMIT 0x08000000
340 #define SEC_NOCACHE 0x10000000
341
342 #define SECURITY_WORLD_SID_AUTHORITY {0,0,0,0,0,1}
343 #define SECURITY_WORLD_RID (0x00000000L)
344
345 #define SID_REVISION 1
346 #define SID_MAX_SUB_AUTHORITIES 15
347 #define SID_RECOMMENDED_SUB_AUTHORITIES 1
348
349 #define TOKEN_ASSIGN_PRIMARY (0x0001)
350 #define TOKEN_DUPLICATE (0x0002)
351 #define TOKEN_IMPERSONATE (0x0004)
352 #define TOKEN_QUERY (0x0008)
353 #define TOKEN_QUERY_SOURCE (0x0010)
354 #define TOKEN_ADJUST_PRIVILEGES (0x0020)
355 #define TOKEN_ADJUST_GROUPS (0x0040)
356 #define TOKEN_ADJUST_DEFAULT (0x0080)
357 #define TOKEN_ADJUST_SESSIONID (0x0100)
358
359 #define TOKEN_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED |\
360 TOKEN_ASSIGN_PRIMARY |\
361 TOKEN_DUPLICATE |\
362 TOKEN_IMPERSONATE |\
363 TOKEN_QUERY |\
364 TOKEN_QUERY_SOURCE |\
365 TOKEN_ADJUST_PRIVILEGES |\
366 TOKEN_ADJUST_GROUPS |\
367 TOKEN_ADJUST_DEFAULT |\
368 TOKEN_ADJUST_SESSIONID)
369
370 #define TOKEN_READ (STANDARD_RIGHTS_READ |\
371 TOKEN_QUERY)
372
373 #define TOKEN_WRITE (STANDARD_RIGHTS_WRITE |\
374 TOKEN_ADJUST_PRIVILEGES |\
375 TOKEN_ADJUST_GROUPS |\
376 TOKEN_ADJUST_DEFAULT)
377
378 #define TOKEN_EXECUTE (STANDARD_RIGHTS_EXECUTE)
379
380 #define TOKEN_SOURCE_LENGTH 8
381 /* end winnt.h */
382
383 #define TOKEN_HAS_TRAVERSE_PRIVILEGE 0x01
384 #define TOKEN_HAS_BACKUP_PRIVILEGE 0x02
385 #define TOKEN_HAS_RESTORE_PRIVILEGE 0x04
386 #define TOKEN_HAS_ADMIN_GROUP 0x08
387 #define TOKEN_IS_RESTRICTED 0x10
388
389 #define VACB_MAPPING_GRANULARITY (0x40000)
390 #define VACB_OFFSET_SHIFT (18)
391
392 #define SE_OWNER_DEFAULTED 0x0001
393 #define SE_GROUP_DEFAULTED 0x0002
394 #define SE_DACL_PRESENT 0x0004
395 #define SE_DACL_DEFAULTED 0x0008
396 #define SE_SACL_PRESENT 0x0010
397 #define SE_SACL_DEFAULTED 0x0020
398 #define SE_DACL_UNTRUSTED 0x0040
399 #define SE_SERVER_SECURITY 0x0080
400 #define SE_DACL_AUTO_INHERIT_REQ 0x0100
401 #define SE_SACL_AUTO_INHERIT_REQ 0x0200
402 #define SE_DACL_AUTO_INHERITED 0x0400
403 #define SE_SACL_AUTO_INHERITED 0x0800
404 #define SE_DACL_PROTECTED 0x1000
405 #define SE_SACL_PROTECTED 0x2000
406 #define SE_RM_CONTROL_VALID 0x4000
407 #define SE_SELF_RELATIVE 0x8000
408
409 #define FSCTL_REQUEST_OPLOCK_LEVEL_1 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
410 #define FSCTL_REQUEST_OPLOCK_LEVEL_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
411 #define FSCTL_REQUEST_BATCH_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
412 #define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 3, METHOD_BUFFERED, FILE_ANY_ACCESS)
413 #define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
414 #define FSCTL_OPLOCK_BREAK_NOTIFY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 5, METHOD_BUFFERED, FILE_ANY_ACCESS)
415 #define FSCTL_LOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
416 #define FSCTL_UNLOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
417 #define FSCTL_DISMOUNT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
418
419 #define FSCTL_IS_VOLUME_MOUNTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
420 #define FSCTL_IS_PATHNAME_VALID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
421 #define FSCTL_MARK_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
422
423 #define FSCTL_QUERY_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER, FILE_ANY_ACCESS)
424 #define FSCTL_GET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
425 #define FSCTL_SET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
426
427
428 #define FSCTL_MARK_AS_SYSTEM_HIVE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS)
429 #define FSCTL_OPLOCK_BREAK_ACK_NO_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
430 #define FSCTL_INVALIDATE_VOLUMES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
431 #define FSCTL_QUERY_FAT_BPB CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS)
432 #define FSCTL_REQUEST_FILTER_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
433 #define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS)
434
435 #if (VER_PRODUCTBUILD >= 1381)
436
437 #define FSCTL_GET_NTFS_VOLUME_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS)
438 #define FSCTL_GET_NTFS_FILE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS)
439 #define FSCTL_GET_VOLUME_BITMAP CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER, FILE_ANY_ACCESS)
440 #define FSCTL_GET_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER, FILE_ANY_ACCESS)
441 #define FSCTL_MOVE_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_ANY_ACCESS)
442 #define FSCTL_IS_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
443 #define FSCTL_GET_HFS_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS)
444 #define FSCTL_ALLOW_EXTENDED_DASD_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER, FILE_ANY_ACCESS)
445
446 #endif /* (VER_PRODUCTBUILD >= 1381) */
447
448 #if (VER_PRODUCTBUILD >= 2195)
449
450 #define FSCTL_READ_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 33, METHOD_NEITHER, FILE_ANY_ACCESS)
451 #define FSCTL_WRITE_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 34, METHOD_NEITHER, FILE_ANY_ACCESS)
452 #define FSCTL_FIND_FILES_BY_SID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS)
453
454 #define FSCTL_DUMP_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 37, METHOD_NEITHER, FILE_ANY_ACCESS)
455 #define FSCTL_SET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_WRITE_DATA)
456 #define FSCTL_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS)
457 #define FSCTL_DELETE_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_WRITE_DATA)
458 #define FSCTL_SET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_WRITE_DATA)
459 #define FSCTL_GET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS)
460 #define FSCTL_DELETE_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_WRITE_DATA)
461 #define FSCTL_ENUM_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER, FILE_READ_DATA)
462 #define FSCTL_SECURITY_ID_CHECK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45, METHOD_NEITHER, FILE_READ_DATA)
463 #define FSCTL_READ_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46, METHOD_NEITHER, FILE_READ_DATA)
464 #define FSCTL_SET_OBJECT_ID_EXTENDED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_WRITE_DATA)
465 #define FSCTL_CREATE_OR_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS)
466 #define FSCTL_SET_SPARSE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_WRITE_DATA)
467 #define FSCTL_SET_ZERO_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA)
468 #define FSCTL_QUERY_ALLOCATED_RANGES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51, METHOD_NEITHER, FILE_READ_DATA)
469 #define FSCTL_ENABLE_UPGRADE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA)
470 #define FSCTL_SET_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_BUFFERED, FILE_ANY_ACCESS)
471 #define FSCTL_ENCRYPTION_FSCTL_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54, METHOD_NEITHER, FILE_ANY_ACCESS)
472 #define FSCTL_WRITE_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55, METHOD_NEITHER, FILE_ANY_ACCESS)
473 #define FSCTL_READ_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56, METHOD_NEITHER, FILE_ANY_ACCESS)
474 #define FSCTL_CREATE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57, METHOD_NEITHER, FILE_READ_DATA)
475 #define FSCTL_READ_FILE_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58, METHOD_NEITHER, FILE_READ_DATA)
476 #define FSCTL_WRITE_USN_CLOSE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59, METHOD_NEITHER, FILE_READ_DATA)
477 #define FSCTL_EXTEND_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
478 #define FSCTL_QUERY_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
479 #define FSCTL_DELETE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
480 #define FSCTL_MARK_HANDLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS)
481 #define FSCTL_SIS_COPYFILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS)
482 #define FSCTL_SIS_LINK_FILES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
483 #define FSCTL_HSM_MSG CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
484 #define FSCTL_NSS_CONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 67, METHOD_BUFFERED, FILE_WRITE_DATA)
485 #define FSCTL_HSM_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
486 #define FSCTL_RECALL_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS)
487 #define FSCTL_NSS_RCONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 70, METHOD_BUFFERED, FILE_READ_DATA)
488 #define FSCTL_READ_FROM_PLEX CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA)
489 #define FSCTL_FILE_PREFETCH CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
490
491 #endif /* (VER_PRODUCTBUILD >= 2195) */
492
493 #define FSCTL_MAILSLOT_PEEK CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)
494
495 #define FSCTL_NETWORK_SET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 102, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
496 #define FSCTL_NETWORK_GET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 103, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
497 #define FSCTL_NETWORK_GET_CONNECTION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 104, METHOD_NEITHER, FILE_ANY_ACCESS)
498 #define FSCTL_NETWORK_ENUMERATE_CONNECTIONS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 105, METHOD_NEITHER, FILE_ANY_ACCESS)
499 #define FSCTL_NETWORK_DELETE_CONNECTION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 107, METHOD_BUFFERED, FILE_ANY_ACCESS)
500 #define FSCTL_NETWORK_GET_STATISTICS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 116, METHOD_BUFFERED, FILE_ANY_ACCESS)
501 #define FSCTL_NETWORK_SET_DOMAIN_NAME CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_ANY_ACCESS)
502 #define FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_ANY_ACCESS)
503
504 #define FSCTL_PIPE_ASSIGN_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
505 #define FSCTL_PIPE_DISCONNECT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
506 #define FSCTL_PIPE_LISTEN CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
507 #define FSCTL_PIPE_PEEK CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
508 #define FSCTL_PIPE_QUERY_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
509 #define FSCTL_PIPE_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
510 #define FSCTL_PIPE_WAIT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
511 #define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
512 #define FSCTL_PIPE_SET_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
513 #define FSCTL_PIPE_QUERY_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
514 #define FSCTL_PIPE_INTERNAL_READ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
515 #define FSCTL_PIPE_INTERNAL_WRITE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
516 #define FSCTL_PIPE_INTERNAL_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
517 #define FSCTL_PIPE_INTERNAL_READ_OVFLOW CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
518
519 #define IOCTL_REDIR_QUERY_PATH CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
520
521 typedef PVOID OPLOCK, *POPLOCK;
522
523 typedef struct _CACHE_MANAGER_CALLBACKS *PCACHE_MANAGER_CALLBACKS;
524 typedef struct _FILE_GET_QUOTA_INFORMATION *PFILE_GET_QUOTA_INFORMATION;
525 typedef struct _HANDLE_TABLE *PHANDLE_TABLE;
526 typedef struct _KPROCESS *PKPROCESS;
527 typedef struct _KQUEUE *PKQUEUE;
528 typedef struct _KTRAP_FRAME *PKTRAP_FRAME;
529 typedef struct _OBJECT_DIRECTORY *POBJECT_DIRECTORY;
530 typedef struct _SECTION_OBJECT *PSECTION_OBJECT;
531 typedef struct _SHARED_CACHE_MAP *PSHARED_CACHE_MAP;
532 typedef struct _VACB *PVACB;
533 typedef struct _VAD_HEADER *PVAD_HEADER;
534
535 typedef ULONG LBN;
536 typedef LBN *PLBN;
537
538 typedef ULONG VBN;
539 typedef VBN *PVBN;
540
541 typedef struct _NOTIFY_SYNC
542 {
543 ULONG Unknown0;
544 ULONG Unknown1;
545 ULONG Unknown2;
546 USHORT Unknown3;
547 USHORT Unknown4;
548 ULONG Unknown5;
549 ULONG Unknown6;
550 ULONG Unknown7;
551 ULONG Unknown8;
552 ULONG Unknown9;
553 ULONG Unknown10;
554 } NOTIFY_SYNC, * PNOTIFY_SYNC;
555
556 typedef enum _FAST_IO_POSSIBLE {
557 FastIoIsNotPossible,
558 FastIoIsPossible,
559 FastIoIsQuestionable
560 } FAST_IO_POSSIBLE;
561
562 typedef enum _FILE_STORAGE_TYPE {
563 StorageTypeDefault = 1,
564 StorageTypeDirectory,
565 StorageTypeFile,
566 StorageTypeJunctionPoint,
567 StorageTypeCatalog,
568 StorageTypeStructuredStorage,
569 StorageTypeEmbedding,
570 StorageTypeStream
571 } FILE_STORAGE_TYPE;
572
573 typedef enum _OBJECT_INFO_CLASS {
574 ObjectBasicInfo,
575 ObjectNameInfo,
576 ObjectTypeInfo,
577 ObjectAllTypesInfo,
578 ObjectProtectionInfo
579 } OBJECT_INFO_CLASS;
580
581 typedef struct _KAPC_STATE {
582 LIST_ENTRY ApcListHead[2];
583 PKPROCESS Process;
584 BOOLEAN KernelApcInProgress;
585 BOOLEAN KernelApcPending;
586 BOOLEAN UserApcPending;
587 } KAPC_STATE, *PKAPC_STATE, *RESTRICTED_POINTER PRKAPC_STATE;
588
589 typedef struct _BITMAP_RANGE {
590 LIST_ENTRY Links;
591 LARGE_INTEGER BasePage;
592 ULONG FirstDirtyPage;
593 ULONG LastDirtyPage;
594 ULONG DirtyPages;
595 PULONG Bitmap;
596 } BITMAP_RANGE, *PBITMAP_RANGE;
597
598 typedef struct _CACHE_UNINITIALIZE_EVENT {
599 struct _CACHE_UNINITIALIZE_EVENT *Next;
600 KEVENT Event;
601 } CACHE_UNINITIALIZE_EVENT, *PCACHE_UNINITIALIZE_EVENT;
602
603 typedef struct _CC_FILE_SIZES {
604 LARGE_INTEGER AllocationSize;
605 LARGE_INTEGER FileSize;
606 LARGE_INTEGER ValidDataLength;
607 } CC_FILE_SIZES, *PCC_FILE_SIZES;
608
609 typedef struct _COMPRESSED_DATA_INFO {
610 USHORT CompressionFormatAndEngine;
611 UCHAR CompressionUnitShift;
612 UCHAR ChunkShift;
613 UCHAR ClusterShift;
614 UCHAR Reserved;
615 USHORT NumberOfChunks;
616 ULONG CompressedChunkSizes[ANYSIZE_ARRAY];
617 } COMPRESSED_DATA_INFO, *PCOMPRESSED_DATA_INFO;
618
619 #define EX_RUNDOWN_ACTIVE 0x1
620 #define EX_RUNDOWN_COUNT_SHIFT 0x1
621 #define EX_RUNDOWN_COUNT_INC (1 << EX_RUNDOWN_COUNT_SHIFT)
622
623 typedef struct _EX_RUNDOWN_REF {
624 _ANONYMOUS_UNION union {
625 ULONG Count;
626 PVOID Ptr;
627 } DUMMYUNIONNAME;
628 } EX_RUNDOWN_REF, *PEX_RUNDOWN_REF;
629
630 typedef struct _FILE_ACCESS_INFORMATION {
631 ACCESS_MASK AccessFlags;
632 } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
633
634 typedef struct _FILE_ALLOCATION_INFORMATION {
635 LARGE_INTEGER AllocationSize;
636 } FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;
637
638 typedef struct _FILE_BOTH_DIR_INFORMATION {
639 ULONG NextEntryOffset;
640 ULONG FileIndex;
641 LARGE_INTEGER CreationTime;
642 LARGE_INTEGER LastAccessTime;
643 LARGE_INTEGER LastWriteTime;
644 LARGE_INTEGER ChangeTime;
645 LARGE_INTEGER EndOfFile;
646 LARGE_INTEGER AllocationSize;
647 ULONG FileAttributes;
648 ULONG FileNameLength;
649 ULONG EaSize;
650 CCHAR ShortNameLength;
651 WCHAR ShortName[12];
652 WCHAR FileName[1];
653 } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
654
655 typedef struct _FILE_COMPLETION_INFORMATION {
656 HANDLE Port;
657 PVOID Key;
658 } FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;
659
660 typedef struct _FILE_COMPRESSION_INFORMATION {
661 LARGE_INTEGER CompressedFileSize;
662 USHORT CompressionFormat;
663 UCHAR CompressionUnitShift;
664 UCHAR ChunkShift;
665 UCHAR ClusterShift;
666 UCHAR Reserved[3];
667 } FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
668
669 typedef struct _FILE_COPY_ON_WRITE_INFORMATION {
670 BOOLEAN ReplaceIfExists;
671 HANDLE RootDirectory;
672 ULONG FileNameLength;
673 WCHAR FileName[1];
674 } FILE_COPY_ON_WRITE_INFORMATION, *PFILE_COPY_ON_WRITE_INFORMATION;
675
676 typedef struct _FILE_DIRECTORY_INFORMATION {
677 ULONG NextEntryOffset;
678 ULONG FileIndex;
679 LARGE_INTEGER CreationTime;
680 LARGE_INTEGER LastAccessTime;
681 LARGE_INTEGER LastWriteTime;
682 LARGE_INTEGER ChangeTime;
683 LARGE_INTEGER EndOfFile;
684 LARGE_INTEGER AllocationSize;
685 ULONG FileAttributes;
686 ULONG FileNameLength;
687 WCHAR FileName[1];
688 } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
689
690 typedef struct _FILE_FULL_DIRECTORY_INFORMATION {
691 ULONG NextEntryOffset;
692 ULONG FileIndex;
693 LARGE_INTEGER CreationTime;
694 LARGE_INTEGER LastAccessTime;
695 LARGE_INTEGER LastWriteTime;
696 LARGE_INTEGER ChangeTime;
697 LARGE_INTEGER EndOfFile;
698 LARGE_INTEGER AllocationSize;
699 ULONG FileAttributes;
700 ULONG FileNameLength;
701 ULONG EaSize;
702 WCHAR FileName[0];
703 } FILE_FULL_DIRECTORY_INFORMATION, *PFILE_FULL_DIRECTORY_INFORMATION;
704
705 typedef struct _FILE_BOTH_DIRECTORY_INFORMATION {
706 ULONG NextEntryOffset;
707 ULONG FileIndex;
708 LARGE_INTEGER CreationTime;
709 LARGE_INTEGER LastAccessTime;
710 LARGE_INTEGER LastWriteTime;
711 LARGE_INTEGER ChangeTime;
712 LARGE_INTEGER EndOfFile;
713 LARGE_INTEGER AllocationSize;
714 ULONG FileAttributes;
715 ULONG FileNameLength;
716 ULONG EaSize;
717 CHAR ShortNameLength;
718 WCHAR ShortName[12];
719 WCHAR FileName[0];
720 } FILE_BOTH_DIRECTORY_INFORMATION, *PFILE_BOTH_DIRECTORY_INFORMATION;
721
722 typedef struct _FILE_EA_INFORMATION {
723 ULONG EaSize;
724 } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
725
726 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {
727 ULONG FileSystemAttributes;
728 ULONG MaximumComponentNameLength;
729 ULONG FileSystemNameLength;
730 WCHAR FileSystemName[1];
731 } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
732
733 typedef struct _FILE_FS_CONTROL_INFORMATION {
734 LARGE_INTEGER FreeSpaceStartFiltering;
735 LARGE_INTEGER FreeSpaceThreshold;
736 LARGE_INTEGER FreeSpaceStopFiltering;
737 LARGE_INTEGER DefaultQuotaThreshold;
738 LARGE_INTEGER DefaultQuotaLimit;
739 ULONG FileSystemControlFlags;
740 } FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;
741
742 typedef struct _FILE_FS_FULL_SIZE_INFORMATION {
743 LARGE_INTEGER TotalAllocationUnits;
744 LARGE_INTEGER CallerAvailableAllocationUnits;
745 LARGE_INTEGER ActualAvailableAllocationUnits;
746 ULONG SectorsPerAllocationUnit;
747 ULONG BytesPerSector;
748 } FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
749
750 typedef struct _FILE_FS_LABEL_INFORMATION {
751 ULONG VolumeLabelLength;
752 WCHAR VolumeLabel[1];
753 } FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
754
755 #if (VER_PRODUCTBUILD >= 2195)
756
757 typedef struct _FILE_FS_OBJECT_ID_INFORMATION {
758 UCHAR ObjectId[16];
759 UCHAR ExtendedInfo[48];
760 } FILE_FS_OBJECT_ID_INFORMATION, *PFILE_FS_OBJECT_ID_INFORMATION;
761
762 #endif /* (VER_PRODUCTBUILD >= 2195) */
763
764 typedef struct _FILE_FS_SIZE_INFORMATION {
765 LARGE_INTEGER TotalAllocationUnits;
766 LARGE_INTEGER AvailableAllocationUnits;
767 ULONG SectorsPerAllocationUnit;
768 ULONG BytesPerSector;
769 } FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
770
771 typedef struct _FILE_FS_VOLUME_INFORMATION {
772 LARGE_INTEGER VolumeCreationTime;
773 ULONG VolumeSerialNumber;
774 ULONG VolumeLabelLength;
775 BOOLEAN SupportsObjects;
776 WCHAR VolumeLabel[1];
777 } FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
778
779 typedef struct _FILE_FULL_DIR_INFORMATION {
780 ULONG NextEntryOffset;
781 ULONG FileIndex;
782 LARGE_INTEGER CreationTime;
783 LARGE_INTEGER LastAccessTime;
784 LARGE_INTEGER LastWriteTime;
785 LARGE_INTEGER ChangeTime;
786 LARGE_INTEGER EndOfFile;
787 LARGE_INTEGER AllocationSize;
788 ULONG FileAttributes;
789 ULONG FileNameLength;
790 ULONG EaSize;
791 WCHAR FileName[1];
792 } FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
793
794 typedef struct _FILE_GET_EA_INFORMATION {
795 ULONG NextEntryOffset;
796 UCHAR EaNameLength;
797 CHAR EaName[1];
798 } FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
799
800 typedef struct _FILE_GET_QUOTA_INFORMATION {
801 ULONG NextEntryOffset;
802 ULONG SidLength;
803 SID Sid;
804 } FILE_GET_QUOTA_INFORMATION, *PFILE_GET_QUOTA_INFORMATION;
805
806 typedef struct _FILE_INTERNAL_INFORMATION {
807 LARGE_INTEGER IndexNumber;
808 } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
809
810 typedef struct _FILE_LINK_INFORMATION {
811 BOOLEAN ReplaceIfExists;
812 HANDLE RootDirectory;
813 ULONG FileNameLength;
814 WCHAR FileName[1];
815 } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
816
817 typedef struct _FILE_LOCK_INFO {
818 LARGE_INTEGER StartingByte;
819 LARGE_INTEGER Length;
820 BOOLEAN ExclusiveLock;
821 ULONG Key;
822 PFILE_OBJECT FileObject;
823 PEPROCESS Process;
824 LARGE_INTEGER EndingByte;
825 } FILE_LOCK_INFO, *PFILE_LOCK_INFO;
826
827 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
828 typedef struct _FILE_SHARED_LOCK_ENTRY {
829 PVOID Unknown1;
830 PVOID Unknown2;
831 FILE_LOCK_INFO FileLock;
832 } FILE_SHARED_LOCK_ENTRY, *PFILE_SHARED_LOCK_ENTRY;
833
834 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
835 typedef struct _FILE_EXCLUSIVE_LOCK_ENTRY {
836 LIST_ENTRY ListEntry;
837 PVOID Unknown1;
838 PVOID Unknown2;
839 FILE_LOCK_INFO FileLock;
840 } FILE_EXCLUSIVE_LOCK_ENTRY, *PFILE_EXCLUSIVE_LOCK_ENTRY;
841
842 typedef NTSTATUS (*PCOMPLETE_LOCK_IRP_ROUTINE) (
843 IN PVOID Context,
844 IN PIRP Irp
845 );
846
847 typedef VOID (NTAPI *PUNLOCK_ROUTINE) (
848 IN PVOID Context,
849 IN PFILE_LOCK_INFO FileLockInfo
850 );
851
852 typedef struct _FILE_LOCK {
853 PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine;
854 PUNLOCK_ROUTINE UnlockRoutine;
855 BOOLEAN FastIoIsQuestionable;
856 BOOLEAN Pad[3];
857 PVOID LockInformation;
858 FILE_LOCK_INFO LastReturnedLockInfo;
859 PVOID LastReturnedLock;
860 } FILE_LOCK, *PFILE_LOCK;
861
862 typedef struct _FILE_MAILSLOT_PEEK_BUFFER {
863 ULONG ReadDataAvailable;
864 ULONG NumberOfMessages;
865 ULONG MessageLength;
866 } FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER;
867
868 typedef struct _FILE_MAILSLOT_QUERY_INFORMATION {
869 ULONG MaximumMessageSize;
870 ULONG MailslotQuota;
871 ULONG NextMessageSize;
872 ULONG MessagesAvailable;
873 LARGE_INTEGER ReadTimeout;
874 } FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION;
875
876 typedef struct _FILE_MAILSLOT_SET_INFORMATION {
877 LARGE_INTEGER ReadTimeout;
878 } FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
879
880 typedef struct _FILE_MODE_INFORMATION {
881 ULONG Mode;
882 } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
883
884 typedef struct _FILE_ALL_INFORMATION {
885 FILE_BASIC_INFORMATION BasicInformation;
886 FILE_STANDARD_INFORMATION StandardInformation;
887 FILE_INTERNAL_INFORMATION InternalInformation;
888 FILE_EA_INFORMATION EaInformation;
889 FILE_ACCESS_INFORMATION AccessInformation;
890 FILE_POSITION_INFORMATION PositionInformation;
891 FILE_MODE_INFORMATION ModeInformation;
892 FILE_ALIGNMENT_INFORMATION AlignmentInformation;
893 FILE_NAME_INFORMATION NameInformation;
894 } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
895
896 typedef struct _FILE_NAMES_INFORMATION {
897 ULONG NextEntryOffset;
898 ULONG FileIndex;
899 ULONG FileNameLength;
900 WCHAR FileName[1];
901 } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
902
903 typedef struct _FILE_OBJECTID_INFORMATION {
904 LONGLONG FileReference;
905 UCHAR ObjectId[16];
906 _ANONYMOUS_UNION union {
907 struct {
908 UCHAR BirthVolumeId[16];
909 UCHAR BirthObjectId[16];
910 UCHAR DomainId[16];
911 } ;
912 UCHAR ExtendedInfo[48];
913 } DUMMYUNIONNAME;
914 } FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION;
915
916 typedef struct _FILE_OLE_CLASSID_INFORMATION {
917 GUID ClassId;
918 } FILE_OLE_CLASSID_INFORMATION, *PFILE_OLE_CLASSID_INFORMATION;
919
920 typedef struct _FILE_OLE_ALL_INFORMATION {
921 FILE_BASIC_INFORMATION BasicInformation;
922 FILE_STANDARD_INFORMATION StandardInformation;
923 FILE_INTERNAL_INFORMATION InternalInformation;
924 FILE_EA_INFORMATION EaInformation;
925 FILE_ACCESS_INFORMATION AccessInformation;
926 FILE_POSITION_INFORMATION PositionInformation;
927 FILE_MODE_INFORMATION ModeInformation;
928 FILE_ALIGNMENT_INFORMATION AlignmentInformation;
929 USN LastChangeUsn;
930 USN ReplicationUsn;
931 LARGE_INTEGER SecurityChangeTime;
932 FILE_OLE_CLASSID_INFORMATION OleClassIdInformation;
933 FILE_OBJECTID_INFORMATION ObjectIdInformation;
934 FILE_STORAGE_TYPE StorageType;
935 ULONG OleStateBits;
936 ULONG OleId;
937 ULONG NumberOfStreamReferences;
938 ULONG StreamIndex;
939 ULONG SecurityId;
940 BOOLEAN ContentIndexDisable;
941 BOOLEAN InheritContentIndexDisable;
942 FILE_NAME_INFORMATION NameInformation;
943 } FILE_OLE_ALL_INFORMATION, *PFILE_OLE_ALL_INFORMATION;
944
945 typedef struct _FILE_OLE_DIR_INFORMATION {
946 ULONG NextEntryOffset;
947 ULONG FileIndex;
948 LARGE_INTEGER CreationTime;
949 LARGE_INTEGER LastAccessTime;
950 LARGE_INTEGER LastWriteTime;
951 LARGE_INTEGER ChangeTime;
952 LARGE_INTEGER EndOfFile;
953 LARGE_INTEGER AllocationSize;
954 ULONG FileAttributes;
955 ULONG FileNameLength;
956 FILE_STORAGE_TYPE StorageType;
957 GUID OleClassId;
958 ULONG OleStateBits;
959 BOOLEAN ContentIndexDisable;
960 BOOLEAN InheritContentIndexDisable;
961 WCHAR FileName[1];
962 } FILE_OLE_DIR_INFORMATION, *PFILE_OLE_DIR_INFORMATION;
963
964 typedef struct _FILE_OLE_INFORMATION {
965 LARGE_INTEGER SecurityChangeTime;
966 FILE_OLE_CLASSID_INFORMATION OleClassIdInformation;
967 FILE_OBJECTID_INFORMATION ObjectIdInformation;
968 FILE_STORAGE_TYPE StorageType;
969 ULONG OleStateBits;
970 BOOLEAN ContentIndexDisable;
971 BOOLEAN InheritContentIndexDisable;
972 } FILE_OLE_INFORMATION, *PFILE_OLE_INFORMATION;
973
974 typedef struct _FILE_OLE_STATE_BITS_INFORMATION {
975 ULONG StateBits;
976 ULONG StateBitsMask;
977 } FILE_OLE_STATE_BITS_INFORMATION, *PFILE_OLE_STATE_BITS_INFORMATION;
978
979 typedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER {
980 HANDLE EventHandle;
981 ULONG KeyValue;
982 } FILE_PIPE_ASSIGN_EVENT_BUFFER, *PFILE_PIPE_ASSIGN_EVENT_BUFFER;
983
984 typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER {
985 PVOID ClientSession;
986 PVOID ClientProcess;
987 } FILE_PIPE_CLIENT_PROCESS_BUFFER, *PFILE_PIPE_CLIENT_PROCESS_BUFFER;
988
989 typedef struct _FILE_PIPE_EVENT_BUFFER {
990 ULONG NamedPipeState;
991 ULONG EntryType;
992 ULONG ByteCount;
993 ULONG KeyValue;
994 ULONG NumberRequests;
995 } FILE_PIPE_EVENT_BUFFER, *PFILE_PIPE_EVENT_BUFFER;
996
997 typedef struct _FILE_PIPE_PEEK_BUFFER
998 {
999 ULONG NamedPipeState;
1000 ULONG ReadDataAvailable;
1001 ULONG NumberOfMessages;
1002 ULONG MessageLength;
1003 CHAR Data[1];
1004 } FILE_PIPE_PEEK_BUFFER, *PFILE_PIPE_PEEK_BUFFER;
1005
1006 typedef struct _FILE_PIPE_INFORMATION {
1007 ULONG ReadMode;
1008 ULONG CompletionMode;
1009 } FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;
1010
1011 typedef struct _FILE_PIPE_LOCAL_INFORMATION {
1012 ULONG NamedPipeType;
1013 ULONG NamedPipeConfiguration;
1014 ULONG MaximumInstances;
1015 ULONG CurrentInstances;
1016 ULONG InboundQuota;
1017 ULONG ReadDataAvailable;
1018 ULONG OutboundQuota;
1019 ULONG WriteQuotaAvailable;
1020 ULONG NamedPipeState;
1021 ULONG NamedPipeEnd;
1022 } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
1023
1024 typedef struct _FILE_PIPE_REMOTE_INFORMATION {
1025 LARGE_INTEGER CollectDataTime;
1026 ULONG MaximumCollectionCount;
1027 } FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION;
1028
1029 typedef struct _FILE_PIPE_WAIT_FOR_BUFFER {
1030 LARGE_INTEGER Timeout;
1031 ULONG NameLength;
1032 BOOLEAN TimeoutSpecified;
1033 WCHAR Name[1];
1034 } FILE_PIPE_WAIT_FOR_BUFFER, *PFILE_PIPE_WAIT_FOR_BUFFER;
1035
1036 typedef struct _FILE_RENAME_INFORMATION {
1037 BOOLEAN ReplaceIfExists;
1038 HANDLE RootDirectory;
1039 ULONG FileNameLength;
1040 WCHAR FileName[1];
1041 } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
1042
1043 typedef struct _FILE_STREAM_INFORMATION {
1044 ULONG NextEntryOffset;
1045 ULONG StreamNameLength;
1046 LARGE_INTEGER StreamSize;
1047 LARGE_INTEGER StreamAllocationSize;
1048 WCHAR StreamName[1];
1049 } FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;
1050
1051 typedef struct _FILE_TRACKING_INFORMATION {
1052 HANDLE DestinationFile;
1053 ULONG ObjectInformationLength;
1054 CHAR ObjectInformation[1];
1055 } FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION;
1056
1057 #if (VER_PRODUCTBUILD >= 2195)
1058 typedef struct _FILE_ZERO_DATA_INFORMATION {
1059 LARGE_INTEGER FileOffset;
1060 LARGE_INTEGER BeyondFinalZero;
1061 } FILE_ZERO_DATA_INFORMATION, *PFILE_ZERO_DATA_INFORMATION;
1062
1063 typedef struct FILE_ALLOCATED_RANGE_BUFFER {
1064 LARGE_INTEGER FileOffset;
1065 LARGE_INTEGER Length;
1066 } FILE_ALLOCATED_RANGE_BUFFER, *PFILE_ALLOCATED_RANGE_BUFFER;
1067 #endif /* (VER_PRODUCTBUILD >= 2195) */
1068
1069 typedef struct _FSRTL_COMMON_FCB_HEADER {
1070 CSHORT NodeTypeCode;
1071 CSHORT NodeByteSize;
1072 UCHAR Flags;
1073 UCHAR IsFastIoPossible;
1074 #if (VER_PRODUCTBUILD >= 1381)
1075 UCHAR Flags2;
1076 UCHAR Reserved;
1077 #endif /* (VER_PRODUCTBUILD >= 1381) */
1078 PERESOURCE Resource;
1079 PERESOURCE PagingIoResource;
1080 LARGE_INTEGER AllocationSize;
1081 LARGE_INTEGER FileSize;
1082 LARGE_INTEGER ValidDataLength;
1083 } FSRTL_COMMON_FCB_HEADER, *PFSRTL_COMMON_FCB_HEADER;
1084
1085 #if (VER_PRODUCTBUILD >= 2600)
1086
1087 typedef struct _FSRTL_ADVANCED_FCB_HEADER {
1088 CSHORT NodeTypeCode;
1089 CSHORT NodeByteSize;
1090 UCHAR Flags;
1091 UCHAR IsFastIoPossible;
1092 UCHAR Flags2;
1093 UCHAR Reserved;
1094 PERESOURCE Resource;
1095 PERESOURCE PagingIoResource;
1096 LARGE_INTEGER AllocationSize;
1097 LARGE_INTEGER FileSize;
1098 LARGE_INTEGER ValidDataLength;
1099 PFAST_MUTEX FastMutex;
1100 LIST_ENTRY FilterContexts;
1101 } FSRTL_ADVANCED_FCB_HEADER, *PFSRTL_ADVANCED_FCB_HEADER;
1102
1103 typedef struct _FSRTL_PER_STREAM_CONTEXT {
1104 LIST_ENTRY Links;
1105 PVOID OwnerId;
1106 PVOID InstanceId;
1107 PFREE_FUNCTION FreeCallback;
1108 } FSRTL_PER_STREAM_CONTEXT, *PFSRTL_PER_STREAM_CONTEXT;
1109
1110 #endif /* (VER_PRODUCTBUILD >= 2600) */
1111
1112 typedef struct _BASE_MCB
1113 {
1114 ULONG MaximumPairCount;
1115 ULONG PairCount;
1116 POOL_TYPE PoolType;
1117 PVOID Mapping;
1118 } BASE_MCB;
1119 typedef BASE_MCB *PBASE_MCB;
1120
1121 typedef struct _LARGE_MCB
1122 {
1123 PFAST_MUTEX FastMutex;
1124 BASE_MCB BaseMcb;
1125 } LARGE_MCB;
1126 typedef LARGE_MCB *PLARGE_MCB;
1127
1128 typedef struct _MCB
1129 {
1130 LARGE_MCB DummyFieldThatSizesThisStructureCorrectly;
1131 } MCB;
1132 typedef MCB *PMCB;
1133
1134 typedef struct _GENERATE_NAME_CONTEXT {
1135 USHORT Checksum;
1136 BOOLEAN CheckSumInserted;
1137 UCHAR NameLength;
1138 WCHAR NameBuffer[8];
1139 ULONG ExtensionLength;
1140 WCHAR ExtensionBuffer[4];
1141 ULONG LastIndexValue;
1142 } GENERATE_NAME_CONTEXT, *PGENERATE_NAME_CONTEXT;
1143
1144 typedef struct _MAPPING_PAIR {
1145 ULONGLONG Vcn;
1146 ULONGLONG Lcn;
1147 } MAPPING_PAIR, *PMAPPING_PAIR;
1148
1149 typedef struct _GET_RETRIEVAL_DESCRIPTOR {
1150 ULONG NumberOfPairs;
1151 ULONGLONG StartVcn;
1152 MAPPING_PAIR Pair[1];
1153 } GET_RETRIEVAL_DESCRIPTOR, *PGET_RETRIEVAL_DESCRIPTOR;
1154
1155 typedef struct _IO_CLIENT_EXTENSION {
1156 struct _IO_CLIENT_EXTENSION *NextExtension;
1157 PVOID ClientIdentificationAddress;
1158 } IO_CLIENT_EXTENSION, *PIO_CLIENT_EXTENSION;
1159
1160 typedef struct _IO_COMPLETION_BASIC_INFORMATION {
1161 LONG Depth;
1162 } IO_COMPLETION_BASIC_INFORMATION, *PIO_COMPLETION_BASIC_INFORMATION;
1163
1164 typedef struct _KQUEUE {
1165 DISPATCHER_HEADER Header;
1166 LIST_ENTRY EntryListHead;
1167 ULONG CurrentCount;
1168 ULONG MaximumCount;
1169 LIST_ENTRY ThreadListHead;
1170 } KQUEUE, *PKQUEUE, *RESTRICTED_POINTER PRKQUEUE;
1171
1172 typedef struct _MBCB {
1173 CSHORT NodeTypeCode;
1174 CSHORT NodeIsInZone;
1175 ULONG PagesToWrite;
1176 ULONG DirtyPages;
1177 ULONG Reserved;
1178 LIST_ENTRY BitmapRanges;
1179 LONGLONG ResumeWritePage;
1180 BITMAP_RANGE BitmapRange1;
1181 BITMAP_RANGE BitmapRange2;
1182 BITMAP_RANGE BitmapRange3;
1183 } MBCB, *PMBCB;
1184
1185 typedef struct _MOVEFILE_DESCRIPTOR {
1186 HANDLE FileHandle;
1187 ULONG Reserved;
1188 LARGE_INTEGER StartVcn;
1189 LARGE_INTEGER TargetLcn;
1190 ULONG NumVcns;
1191 ULONG Reserved1;
1192 } MOVEFILE_DESCRIPTOR, *PMOVEFILE_DESCRIPTOR;
1193
1194 typedef struct _OBJECT_BASIC_INFO {
1195 ULONG Attributes;
1196 ACCESS_MASK GrantedAccess;
1197 ULONG HandleCount;
1198 ULONG ReferenceCount;
1199 ULONG PagedPoolUsage;
1200 ULONG NonPagedPoolUsage;
1201 ULONG Reserved[3];
1202 ULONG NameInformationLength;
1203 ULONG TypeInformationLength;
1204 ULONG SecurityDescriptorLength;
1205 LARGE_INTEGER CreateTime;
1206 } OBJECT_BASIC_INFO, *POBJECT_BASIC_INFO;
1207
1208 typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFO {
1209 BOOLEAN Inherit;
1210 BOOLEAN ProtectFromClose;
1211 } OBJECT_HANDLE_ATTRIBUTE_INFO, *POBJECT_HANDLE_ATTRIBUTE_INFO;
1212
1213 typedef struct _OBJECT_NAME_INFO {
1214 UNICODE_STRING ObjectName;
1215 WCHAR ObjectNameBuffer[1];
1216 } OBJECT_NAME_INFO, *POBJECT_NAME_INFO;
1217
1218 typedef struct _OBJECT_PROTECTION_INFO {
1219 BOOLEAN Inherit;
1220 BOOLEAN ProtectHandle;
1221 } OBJECT_PROTECTION_INFO, *POBJECT_PROTECTION_INFO;
1222
1223 typedef struct _OBJECT_TYPE_INFO {
1224 UNICODE_STRING ObjectTypeName;
1225 UCHAR Unknown[0x58];
1226 WCHAR ObjectTypeNameBuffer[1];
1227 } OBJECT_TYPE_INFO, *POBJECT_TYPE_INFO;
1228
1229 typedef struct _OBJECT_ALL_TYPES_INFO {
1230 ULONG NumberOfObjectTypes;
1231 OBJECT_TYPE_INFO ObjectsTypeInfo[1];
1232 } OBJECT_ALL_TYPES_INFO, *POBJECT_ALL_TYPES_INFO;
1233
1234
1235 typedef struct _PATHNAME_BUFFER {
1236 ULONG PathNameLength;
1237 WCHAR Name[1];
1238 } PATHNAME_BUFFER, *PPATHNAME_BUFFER;
1239
1240 #if (VER_PRODUCTBUILD >= 2600)
1241
1242 typedef struct _PRIVATE_CACHE_MAP_FLAGS {
1243 ULONG DontUse : 16;
1244 ULONG ReadAheadActive : 1;
1245 ULONG ReadAheadEnabled : 1;
1246 ULONG Available : 14;
1247 } PRIVATE_CACHE_MAP_FLAGS, *PPRIVATE_CACHE_MAP_FLAGS;
1248
1249 typedef struct _PRIVATE_CACHE_MAP {
1250 _ANONYMOUS_UNION union {
1251 CSHORT NodeTypeCode;
1252 PRIVATE_CACHE_MAP_FLAGS Flags;
1253 ULONG UlongFlags;
1254 } DUMMYUNIONNAME;
1255 ULONG ReadAheadMask;
1256 PFILE_OBJECT FileObject;
1257 LARGE_INTEGER FileOffset1;
1258 LARGE_INTEGER BeyondLastByte1;
1259 LARGE_INTEGER FileOffset2;
1260 LARGE_INTEGER BeyondLastByte2;
1261 LARGE_INTEGER ReadAheadOffset[2];
1262 ULONG ReadAheadLength[2];
1263 KSPIN_LOCK ReadAheadSpinLock;
1264 LIST_ENTRY PrivateLinks;
1265 } PRIVATE_CACHE_MAP, *PPRIVATE_CACHE_MAP;
1266
1267 #endif
1268
1269 typedef struct _PUBLIC_BCB {
1270 CSHORT NodeTypeCode;
1271 CSHORT NodeByteSize;
1272 ULONG MappedLength;
1273 LARGE_INTEGER MappedFileOffset;
1274 } PUBLIC_BCB, *PPUBLIC_BCB;
1275
1276 typedef struct _QUERY_PATH_REQUEST {
1277 ULONG PathNameLength;
1278 PIO_SECURITY_CONTEXT SecurityContext;
1279 WCHAR FilePathName[1];
1280 } QUERY_PATH_REQUEST, *PQUERY_PATH_REQUEST;
1281
1282 typedef struct _QUERY_PATH_RESPONSE {
1283 ULONG LengthAccepted;
1284 } QUERY_PATH_RESPONSE, *PQUERY_PATH_RESPONSE;
1285
1286 #pragma pack(push,8)
1287 typedef struct _RETRIEVAL_POINTERS_BUFFER {
1288 ULONG ExtentCount;
1289 LARGE_INTEGER StartingVcn;
1290 struct {
1291 LARGE_INTEGER NextVcn;
1292 LARGE_INTEGER Lcn;
1293 } Extents[1];
1294 } RETRIEVAL_POINTERS_BUFFER, *PRETRIEVAL_POINTERS_BUFFER;
1295 #pragma pack(pop)
1296
1297 typedef struct _RTL_SPLAY_LINKS {
1298 struct _RTL_SPLAY_LINKS *Parent;
1299 struct _RTL_SPLAY_LINKS *LeftChild;
1300 struct _RTL_SPLAY_LINKS *RightChild;
1301 } RTL_SPLAY_LINKS, *PRTL_SPLAY_LINKS;
1302
1303 typedef struct _SE_EXPORTS {
1304
1305 LUID SeCreateTokenPrivilege;
1306 LUID SeAssignPrimaryTokenPrivilege;
1307 LUID SeLockMemoryPrivilege;
1308 LUID SeIncreaseQuotaPrivilege;
1309 LUID SeUnsolicitedInputPrivilege;
1310 LUID SeTcbPrivilege;
1311 LUID SeSecurityPrivilege;
1312 LUID SeTakeOwnershipPrivilege;
1313 LUID SeLoadDriverPrivilege;
1314 LUID SeCreatePagefilePrivilege;
1315 LUID SeIncreaseBasePriorityPrivilege;
1316 LUID SeSystemProfilePrivilege;
1317 LUID SeSystemtimePrivilege;
1318 LUID SeProfileSingleProcessPrivilege;
1319 LUID SeCreatePermanentPrivilege;
1320 LUID SeBackupPrivilege;
1321 LUID SeRestorePrivilege;
1322 LUID SeShutdownPrivilege;
1323 LUID SeDebugPrivilege;
1324 LUID SeAuditPrivilege;
1325 LUID SeSystemEnvironmentPrivilege;
1326 LUID SeChangeNotifyPrivilege;
1327 LUID SeRemoteShutdownPrivilege;
1328
1329 PSID SeNullSid;
1330 PSID SeWorldSid;
1331 PSID SeLocalSid;
1332 PSID SeCreatorOwnerSid;
1333 PSID SeCreatorGroupSid;
1334
1335 PSID SeNtAuthoritySid;
1336 PSID SeDialupSid;
1337 PSID SeNetworkSid;
1338 PSID SeBatchSid;
1339 PSID SeInteractiveSid;
1340 PSID SeLocalSystemSid;
1341 PSID SeAliasAdminsSid;
1342 PSID SeAliasUsersSid;
1343 PSID SeAliasGuestsSid;
1344 PSID SeAliasPowerUsersSid;
1345 PSID SeAliasAccountOpsSid;
1346 PSID SeAliasSystemOpsSid;
1347 PSID SeAliasPrintOpsSid;
1348 PSID SeAliasBackupOpsSid;
1349
1350 PSID SeAuthenticatedUsersSid;
1351
1352 PSID SeRestrictedSid;
1353 PSID SeAnonymousLogonSid;
1354
1355 LUID SeUndockPrivilege;
1356 LUID SeSyncAgentPrivilege;
1357 LUID SeEnableDelegationPrivilege;
1358
1359 } SE_EXPORTS, *PSE_EXPORTS;
1360
1361 typedef struct _STARTING_VCN_INPUT_BUFFER {
1362 LARGE_INTEGER StartingVcn;
1363 } STARTING_VCN_INPUT_BUFFER, *PSTARTING_VCN_INPUT_BUFFER;
1364
1365 typedef struct _SECURITY_CLIENT_CONTEXT {
1366 SECURITY_QUALITY_OF_SERVICE SecurityQos;
1367 PACCESS_TOKEN ClientToken;
1368 BOOLEAN DirectlyAccessClientToken;
1369 BOOLEAN DirectAccessEffectiveOnly;
1370 BOOLEAN ServerIsRemote;
1371 TOKEN_CONTROL ClientTokenControl;
1372 } SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;
1373
1374 typedef struct _TUNNEL {
1375 FAST_MUTEX Mutex;
1376 PRTL_SPLAY_LINKS Cache;
1377 LIST_ENTRY TimerQueue;
1378 USHORT NumEntries;
1379 } TUNNEL, *PTUNNEL;
1380
1381 typedef struct _VACB {
1382 PVOID BaseAddress;
1383 PSHARED_CACHE_MAP SharedCacheMap;
1384 union {
1385 LARGE_INTEGER FileOffset;
1386 USHORT ActiveCount;
1387 } Overlay;
1388 LIST_ENTRY LruList;
1389 } VACB, *PVACB;
1390
1391 typedef struct _VAD_HEADER {
1392 PVOID StartVPN;
1393 PVOID EndVPN;
1394 PVAD_HEADER ParentLink;
1395 PVAD_HEADER LeftLink;
1396 PVAD_HEADER RightLink;
1397 ULONG Flags; /* LSB = CommitCharge */
1398 PVOID ControlArea;
1399 PVOID FirstProtoPte;
1400 PVOID LastPTE;
1401 ULONG Unknown;
1402 LIST_ENTRY Secured;
1403 } VAD_HEADER, *PVAD_HEADER;
1404
1405 #if (VER_PRODUCTBUILD >= 2600)
1406
1407 typedef BOOLEAN
1408 (NTAPI *PFILTER_REPORT_CHANGE) (
1409 IN PVOID NotifyContext,
1410 IN PVOID FilterContext
1411 );
1412
1413 typedef enum _FS_FILTER_SECTION_SYNC_TYPE {
1414 SyncTypeOther = 0,
1415 SyncTypeCreateSection
1416 } FS_FILTER_SECTION_SYNC_TYPE, *PFS_FILTER_SECTION_SYNC_TYPE;
1417
1418 typedef union _FS_FILTER_PARAMETERS {
1419 struct {
1420 PLARGE_INTEGER EndingOffset;
1421 } AcquireForModifiedPageWriter;
1422
1423 struct {
1424 PERESOURCE ResourceToRelease;
1425 } ReleaseForModifiedPageWriter;
1426
1427 struct {
1428 FS_FILTER_SECTION_SYNC_TYPE SyncType;
1429 ULONG PageProtection;
1430 } AcquireForSectionSynchronization;
1431
1432 struct {
1433 PVOID Argument1;
1434 PVOID Argument2;
1435 PVOID Argument3;
1436 PVOID Argument4;
1437 PVOID Argument5;
1438 } Others;
1439 } FS_FILTER_PARAMETERS, *PFS_FILTER_PARAMETERS;
1440
1441 typedef struct _FS_FILTER_CALLBACK_DATA {
1442 ULONG SizeOfFsFilterCallbackData;
1443 UCHAR Operation;
1444 UCHAR Reserved;
1445 struct _DEVICE_OBJECT *DeviceObject;
1446 struct _FILE_OBJECT *FileObject;
1447 FS_FILTER_PARAMETERS Parameters;
1448 } FS_FILTER_CALLBACK_DATA, *PFS_FILTER_CALLBACK_DATA;
1449
1450 typedef NTSTATUS
1451 (NTAPI *PFS_FILTER_CALLBACK) (
1452 IN PFS_FILTER_CALLBACK_DATA Data,
1453 OUT PVOID *CompletionContext
1454 );
1455
1456 typedef VOID
1457 (NTAPI *PFS_FILTER_COMPLETION_CALLBACK) (
1458 IN PFS_FILTER_CALLBACK_DATA Data,
1459 IN NTSTATUS OperationStatus,
1460 IN PVOID CompletionContext
1461 );
1462
1463 typedef struct _FS_FILTER_CALLBACKS {
1464 ULONG SizeOfFsFilterCallbacks;
1465 ULONG Reserved;
1466 PFS_FILTER_CALLBACK PreAcquireForSectionSynchronization;
1467 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization;
1468 PFS_FILTER_CALLBACK PreReleaseForSectionSynchronization;
1469 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization;
1470 PFS_FILTER_CALLBACK PreAcquireForCcFlush;
1471 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush;
1472 PFS_FILTER_CALLBACK PreReleaseForCcFlush;
1473 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush;
1474 PFS_FILTER_CALLBACK PreAcquireForModifiedPageWriter;
1475 PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter;
1476 PFS_FILTER_CALLBACK PreReleaseForModifiedPageWriter;
1477 PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter;
1478 } FS_FILTER_CALLBACKS, *PFS_FILTER_CALLBACKS;
1479
1480 typedef struct _READ_LIST {
1481 PFILE_OBJECT FileObject;
1482 ULONG NumberOfEntries;
1483 LOGICAL IsImage;
1484 FILE_SEGMENT_ELEMENT List[ANYSIZE_ARRAY];
1485 } READ_LIST, *PREAD_LIST;
1486
1487 #endif
1488
1489 NTKERNELAPI
1490 BOOLEAN
1491 NTAPI
1492 CcCanIWrite (
1493 IN PFILE_OBJECT FileObject,
1494 IN ULONG BytesToWrite,
1495 IN BOOLEAN Wait,
1496 IN BOOLEAN Retrying
1497 );
1498
1499 NTKERNELAPI
1500 BOOLEAN
1501 NTAPI
1502 CcCopyRead (
1503 IN PFILE_OBJECT FileObject,
1504 IN PLARGE_INTEGER FileOffset,
1505 IN ULONG Length,
1506 IN BOOLEAN Wait,
1507 OUT PVOID Buffer,
1508 OUT PIO_STATUS_BLOCK IoStatus
1509 );
1510
1511 NTKERNELAPI
1512 BOOLEAN
1513 NTAPI
1514 CcCopyWrite (
1515 IN PFILE_OBJECT FileObject,
1516 IN PLARGE_INTEGER FileOffset,
1517 IN ULONG Length,
1518 IN BOOLEAN Wait,
1519 IN PVOID Buffer
1520 );
1521
1522 #define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
1523
1524 typedef VOID (NTAPI *PCC_POST_DEFERRED_WRITE) (
1525 IN PVOID Context1,
1526 IN PVOID Context2
1527 );
1528
1529 NTKERNELAPI
1530 VOID
1531 NTAPI
1532 CcDeferWrite (
1533 IN PFILE_OBJECT FileObject,
1534 IN PCC_POST_DEFERRED_WRITE PostRoutine,
1535 IN PVOID Context1,
1536 IN PVOID Context2,
1537 IN ULONG BytesToWrite,
1538 IN BOOLEAN Retrying
1539 );
1540
1541 NTKERNELAPI
1542 VOID
1543 NTAPI
1544 CcFastCopyRead (
1545 IN PFILE_OBJECT FileObject,
1546 IN ULONG FileOffset,
1547 IN ULONG Length,
1548 IN ULONG PageCount,
1549 OUT PVOID Buffer,
1550 OUT PIO_STATUS_BLOCK IoStatus
1551 );
1552
1553 NTKERNELAPI
1554 VOID
1555 NTAPI
1556 CcFastCopyWrite (
1557 IN PFILE_OBJECT FileObject,
1558 IN ULONG FileOffset,
1559 IN ULONG Length,
1560 IN PVOID Buffer
1561 );
1562
1563 NTKERNELAPI
1564 VOID
1565 NTAPI
1566 CcFlushCache (
1567 IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
1568 IN PLARGE_INTEGER FileOffset OPTIONAL,
1569 IN ULONG Length,
1570 OUT PIO_STATUS_BLOCK IoStatus OPTIONAL
1571 );
1572
1573 typedef VOID (*PDIRTY_PAGE_ROUTINE) (
1574 IN PFILE_OBJECT FileObject,
1575 IN PLARGE_INTEGER FileOffset,
1576 IN ULONG Length,
1577 IN PLARGE_INTEGER OldestLsn,
1578 IN PLARGE_INTEGER NewestLsn,
1579 IN PVOID Context1,
1580 IN PVOID Context2
1581 );
1582
1583 NTKERNELAPI
1584 LARGE_INTEGER
1585 NTAPI
1586 CcGetDirtyPages (
1587 IN PVOID LogHandle,
1588 IN PDIRTY_PAGE_ROUTINE DirtyPageRoutine,
1589 IN PVOID Context1,
1590 IN PVOID Context2
1591 );
1592
1593 NTKERNELAPI
1594 PFILE_OBJECT
1595 NTAPI
1596 CcGetFileObjectFromBcb (
1597 IN PVOID Bcb
1598 );
1599
1600 NTKERNELAPI
1601 PFILE_OBJECT
1602 NTAPI
1603 CcGetFileObjectFromSectionPtrs (
1604 IN PSECTION_OBJECT_POINTERS SectionObjectPointer
1605 );
1606
1607 #define CcGetFileSizePointer(FO) ( \
1608 ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
1609 )
1610
1611 #if (VER_PRODUCTBUILD >= 2195)
1612
1613 NTKERNELAPI
1614 LARGE_INTEGER
1615 NTAPI
1616 CcGetFlushedValidData (
1617 IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
1618 IN BOOLEAN BcbListHeld
1619 );
1620
1621 #endif /* (VER_PRODUCTBUILD >= 2195) */
1622
1623 NTKERNELAPI
1624 LARGE_INTEGER
1625 NTAPI
1626 CcGetLsnForFileObject (
1627 IN PFILE_OBJECT FileObject,
1628 OUT PLARGE_INTEGER OldestLsn OPTIONAL
1629 );
1630
1631 typedef BOOLEAN (NTAPI *PACQUIRE_FOR_LAZY_WRITE) (
1632 IN PVOID Context,
1633 IN BOOLEAN Wait
1634 );
1635
1636 typedef VOID (NTAPI *PRELEASE_FROM_LAZY_WRITE) (
1637 IN PVOID Context
1638 );
1639
1640 typedef BOOLEAN (NTAPI *PACQUIRE_FOR_READ_AHEAD) (
1641 IN PVOID Context,
1642 IN BOOLEAN Wait
1643 );
1644
1645 typedef VOID (NTAPI *PRELEASE_FROM_READ_AHEAD) (
1646 IN PVOID Context
1647 );
1648
1649 typedef struct _CACHE_MANAGER_CALLBACKS {
1650 PACQUIRE_FOR_LAZY_WRITE AcquireForLazyWrite;
1651 PRELEASE_FROM_LAZY_WRITE ReleaseFromLazyWrite;
1652 PACQUIRE_FOR_READ_AHEAD AcquireForReadAhead;
1653 PRELEASE_FROM_READ_AHEAD ReleaseFromReadAhead;
1654 } CACHE_MANAGER_CALLBACKS, *PCACHE_MANAGER_CALLBACKS;
1655
1656 NTKERNELAPI
1657 VOID
1658 NTAPI
1659 CcInitializeCacheMap (
1660 IN PFILE_OBJECT FileObject,
1661 IN PCC_FILE_SIZES FileSizes,
1662 IN BOOLEAN PinAccess,
1663 IN PCACHE_MANAGER_CALLBACKS Callbacks,
1664 IN PVOID LazyWriteContext
1665 );
1666
1667 #define CcIsFileCached(FO) ( \
1668 ((FO)->SectionObjectPointer != NULL) && \
1669 (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
1670 )
1671
1672 NTKERNELAPI
1673 BOOLEAN
1674 NTAPI
1675 CcIsThereDirtyData (
1676 IN PVPB Vpb
1677 );
1678
1679 NTKERNELAPI
1680 BOOLEAN
1681 NTAPI
1682 CcMapData (
1683 IN PFILE_OBJECT FileObject,
1684 IN PLARGE_INTEGER FileOffset,
1685 IN ULONG Length,
1686 IN BOOLEAN Wait,
1687 OUT PVOID *Bcb,
1688 OUT PVOID *Buffer
1689 );
1690
1691 NTKERNELAPI
1692 VOID
1693 NTAPI
1694 CcMdlRead (
1695 IN PFILE_OBJECT FileObject,
1696 IN PLARGE_INTEGER FileOffset,
1697 IN ULONG Length,
1698 OUT PMDL *MdlChain,
1699 OUT PIO_STATUS_BLOCK IoStatus
1700 );
1701
1702 NTKERNELAPI
1703 VOID
1704 NTAPI
1705 CcMdlReadComplete (
1706 IN PFILE_OBJECT FileObject,
1707 IN PMDL MdlChain
1708 );
1709
1710 NTKERNELAPI
1711 VOID
1712 NTAPI
1713 CcMdlWriteComplete (
1714 IN PFILE_OBJECT FileObject,
1715 IN PLARGE_INTEGER FileOffset,
1716 IN PMDL MdlChain
1717 );
1718
1719 NTKERNELAPI
1720 BOOLEAN
1721 NTAPI
1722 CcPinMappedData (
1723 IN PFILE_OBJECT FileObject,
1724 IN PLARGE_INTEGER FileOffset,
1725 IN ULONG Length,
1726 #if (VER_PRODUCTBUILD >= 2195)
1727 IN ULONG Flags,
1728 #else
1729 IN BOOLEAN Wait,
1730 #endif
1731 IN OUT PVOID *Bcb
1732 );
1733
1734 NTKERNELAPI
1735 BOOLEAN
1736 NTAPI
1737 CcPinRead (
1738 IN PFILE_OBJECT FileObject,
1739 IN PLARGE_INTEGER FileOffset,
1740 IN ULONG Length,
1741 #if (VER_PRODUCTBUILD >= 2195)
1742 IN ULONG Flags,
1743 #else
1744 IN BOOLEAN Wait,
1745 #endif
1746 OUT PVOID *Bcb,
1747 OUT PVOID *Buffer
1748 );
1749
1750 NTKERNELAPI
1751 VOID
1752 NTAPI
1753 CcPrepareMdlWrite (
1754 IN PFILE_OBJECT FileObject,
1755 IN PLARGE_INTEGER FileOffset,
1756 IN ULONG Length,
1757 OUT PMDL *MdlChain,
1758 OUT PIO_STATUS_BLOCK IoStatus
1759 );
1760
1761 NTKERNELAPI
1762 BOOLEAN
1763 NTAPI
1764 CcPreparePinWrite (
1765 IN PFILE_OBJECT FileObject,
1766 IN PLARGE_INTEGER FileOffset,
1767 IN ULONG Length,
1768 IN BOOLEAN Zero,
1769 #if (VER_PRODUCTBUILD >= 2195)
1770 IN ULONG Flags,
1771 #else
1772 IN BOOLEAN Wait,
1773 #endif
1774 OUT PVOID *Bcb,
1775 OUT PVOID *Buffer
1776 );
1777
1778 NTKERNELAPI
1779 BOOLEAN
1780 NTAPI
1781 CcPurgeCacheSection (
1782 IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
1783 IN PLARGE_INTEGER FileOffset OPTIONAL,
1784 IN ULONG Length,
1785 IN BOOLEAN UninitializeCacheMaps
1786 );
1787
1788 #define CcReadAhead(FO, FOFF, LEN) ( \
1789 if ((LEN) >= 256) { \
1790 CcScheduleReadAhead((FO), (FOFF), (LEN)); \
1791 } \
1792 )
1793
1794 #if (VER_PRODUCTBUILD >= 2195)
1795
1796 NTKERNELAPI
1797 PVOID
1798 NTAPI
1799 CcRemapBcb (
1800 IN PVOID Bcb
1801 );
1802
1803 #endif /* (VER_PRODUCTBUILD >= 2195) */
1804
1805 NTKERNELAPI
1806 VOID
1807 NTAPI
1808 CcRepinBcb (
1809 IN PVOID Bcb
1810 );
1811
1812 NTKERNELAPI
1813 VOID
1814 NTAPI
1815 CcScheduleReadAhead (
1816 IN PFILE_OBJECT FileObject,
1817 IN PLARGE_INTEGER FileOffset,
1818 IN ULONG Length
1819 );
1820
1821 NTKERNELAPI
1822 VOID
1823 NTAPI
1824 CcSetAdditionalCacheAttributes (
1825 IN PFILE_OBJECT FileObject,
1826 IN BOOLEAN DisableReadAhead,
1827 IN BOOLEAN DisableWriteBehind
1828 );
1829
1830 NTKERNELAPI
1831 VOID
1832 NTAPI
1833 CcSetBcbOwnerPointer (
1834 IN PVOID Bcb,
1835 IN PVOID OwnerPointer
1836 );
1837
1838 NTKERNELAPI
1839 VOID
1840 NTAPI
1841 CcSetDirtyPageThreshold (
1842 IN PFILE_OBJECT FileObject,
1843 IN ULONG DirtyPageThreshold
1844 );
1845
1846 NTKERNELAPI
1847 VOID
1848 NTAPI
1849 CcSetDirtyPinnedData (
1850 IN PVOID BcbVoid,
1851 IN PLARGE_INTEGER Lsn OPTIONAL
1852 );
1853
1854 NTKERNELAPI
1855 VOID
1856 NTAPI
1857 CcSetFileSizes (
1858 IN PFILE_OBJECT FileObject,
1859 IN PCC_FILE_SIZES FileSizes
1860 );
1861
1862 typedef VOID (NTAPI *PFLUSH_TO_LSN) (
1863 IN PVOID LogHandle,
1864 IN PLARGE_INTEGER Lsn
1865 );
1866
1867 NTKERNELAPI
1868 VOID
1869 NTAPI
1870 CcSetLogHandleForFile (
1871 IN PFILE_OBJECT FileObject,
1872 IN PVOID LogHandle,
1873 IN PFLUSH_TO_LSN FlushToLsnRoutine
1874 );
1875
1876 NTKERNELAPI
1877 VOID
1878 NTAPI
1879 CcSetReadAheadGranularity (
1880 IN PFILE_OBJECT FileObject,
1881 IN ULONG Granularity /* default: PAGE_SIZE */
1882 /* allowed: 2^n * PAGE_SIZE */
1883 );
1884
1885 NTKERNELAPI
1886 BOOLEAN
1887 NTAPI
1888 CcUninitializeCacheMap (
1889 IN PFILE_OBJECT FileObject,
1890 IN PLARGE_INTEGER TruncateSize OPTIONAL,
1891 IN PCACHE_UNINITIALIZE_EVENT UninitializeCompleteEvent OPTIONAL
1892 );
1893
1894 NTKERNELAPI
1895 VOID
1896 NTAPI
1897 CcUnpinData (
1898 IN PVOID Bcb
1899 );
1900
1901 NTKERNELAPI
1902 VOID
1903 NTAPI
1904 CcUnpinDataForThread (
1905 IN PVOID Bcb,
1906 IN ERESOURCE_THREAD ResourceThreadId
1907 );
1908
1909 NTKERNELAPI
1910 VOID
1911 NTAPI
1912 CcUnpinRepinnedBcb (
1913 IN PVOID Bcb,
1914 IN BOOLEAN WriteThrough,
1915 OUT PIO_STATUS_BLOCK IoStatus
1916 );
1917
1918 #if (VER_PRODUCTBUILD >= 2195)
1919
1920 NTKERNELAPI
1921 NTSTATUS
1922 NTAPI
1923 CcWaitForCurrentLazyWriterActivity (
1924 VOID
1925 );
1926
1927 #endif /* (VER_PRODUCTBUILD >= 2195) */
1928
1929 NTKERNELAPI
1930 BOOLEAN
1931 NTAPI
1932 CcZeroData (
1933 IN PFILE_OBJECT FileObject,
1934 IN PLARGE_INTEGER StartOffset,
1935 IN PLARGE_INTEGER EndOffset,
1936 IN BOOLEAN Wait
1937 );
1938
1939 NTKERNELAPI
1940 VOID
1941 NTAPI
1942 ExDisableResourceBoostLite (
1943 IN PERESOURCE Resource
1944 );
1945
1946 NTKERNELAPI
1947 ULONG
1948 NTAPI
1949 ExQueryPoolBlockSize (
1950 IN PVOID PoolBlock,
1951 OUT PBOOLEAN QuotaCharged
1952 );
1953
1954 #if (VER_PRODUCTBUILD >= 2600)
1955
1956 NTKERNELAPI
1957 VOID
1958 FASTCALL
1959 ExInitializeRundownProtection (
1960 IN PEX_RUNDOWN_REF RunRef
1961 );
1962
1963 NTKERNELAPI
1964 VOID
1965 FASTCALL
1966 ExReInitializeRundownProtection (
1967 IN PEX_RUNDOWN_REF RunRef
1968 );
1969
1970 NTKERNELAPI
1971 BOOLEAN
1972 FASTCALL
1973 ExAcquireRundownProtection (
1974 IN PEX_RUNDOWN_REF RunRef
1975 );
1976
1977 NTKERNELAPI
1978 BOOLEAN
1979 FASTCALL
1980 ExAcquireRundownProtectionEx (
1981 IN PEX_RUNDOWN_REF RunRef,
1982 IN ULONG Count
1983 );
1984
1985 NTKERNELAPI
1986 VOID
1987 FASTCALL
1988 ExReleaseRundownProtection (
1989 IN PEX_RUNDOWN_REF RunRef
1990 );
1991
1992 NTKERNELAPI
1993 VOID
1994 FASTCALL
1995 ExReleaseRundownProtectionEx (
1996 IN PEX_RUNDOWN_REF RunRef,
1997 IN ULONG Count
1998 );
1999
2000 NTKERNELAPI
2001 VOID
2002 FASTCALL
2003 ExRundownCompleted (
2004 IN PEX_RUNDOWN_REF RunRef
2005 );
2006
2007 NTKERNELAPI
2008 VOID
2009 FASTCALL
2010 ExWaitForRundownProtectionRelease (
2011 IN PEX_RUNDOWN_REF RunRef
2012 );
2013
2014 #endif /* (VER_PRODUCTBUILD >= 2600) */
2015
2016 #define FlagOn(x, f) ((x) & (f))
2017
2018 NTKERNELAPI
2019 VOID
2020 NTAPI
2021 FsRtlAddToTunnelCache (
2022 IN PTUNNEL Cache,
2023 IN ULONGLONG DirectoryKey,
2024 IN PUNICODE_STRING ShortName,
2025 IN PUNICODE_STRING LongName,
2026 IN BOOLEAN KeyByShortName,
2027 IN ULONG DataLength,
2028 IN PVOID Data
2029 );
2030
2031 #if (VER_PRODUCTBUILD >= 2195)
2032
2033 PFILE_LOCK
2034 NTAPI
2035 FsRtlAllocateFileLock (
2036 IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL,
2037 IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
2038 );
2039
2040 #endif /* (VER_PRODUCTBUILD >= 2195) */
2041
2042 NTKERNELAPI
2043 PVOID
2044 NTAPI
2045 FsRtlAllocatePool (
2046 IN POOL_TYPE PoolType,
2047 IN ULONG NumberOfBytes
2048 );
2049
2050 NTKERNELAPI
2051 PVOID
2052 NTAPI
2053 FsRtlAllocatePoolWithQuota (
2054 IN POOL_TYPE PoolType,
2055 IN ULONG NumberOfBytes
2056 );
2057
2058 NTKERNELAPI
2059 PVOID
2060 NTAPI
2061 FsRtlAllocatePoolWithQuotaTag (
2062 IN POOL_TYPE PoolType,
2063 IN ULONG NumberOfBytes,
2064 IN ULONG Tag
2065 );
2066
2067 NTKERNELAPI
2068 PVOID
2069 NTAPI
2070 FsRtlAllocatePoolWithTag (
2071 IN POOL_TYPE PoolType,
2072 IN ULONG NumberOfBytes,
2073 IN ULONG Tag
2074 );
2075
2076 NTKERNELAPI
2077 BOOLEAN
2078 NTAPI
2079 FsRtlAreNamesEqual (
2080 IN PUNICODE_STRING Name1,
2081 IN PUNICODE_STRING Name2,
2082 IN BOOLEAN IgnoreCase,
2083 IN PWCHAR UpcaseTable OPTIONAL
2084 );
2085
2086 #define FsRtlAreThereCurrentFileLocks(FL) ( \
2087 ((FL)->FastIoIsQuestionable) \
2088 )
2089
2090 /*
2091 FsRtlCheckLockForReadAccess:
2092
2093 All this really does is pick out the lock parameters from the irp (io stack
2094 location?), get IoGetRequestorProcess, and pass values on to
2095 FsRtlFastCheckLockForRead.
2096 */
2097 NTKERNELAPI
2098 BOOLEAN
2099 NTAPI
2100 FsRtlCheckLockForReadAccess (
2101 IN PFILE_LOCK FileLock,
2102 IN PIRP Irp
2103 );
2104
2105 /*
2106 FsRtlCheckLockForWriteAccess:
2107
2108 All this really does is pick out the lock parameters from the irp (io stack
2109 location?), get IoGetRequestorProcess, and pass values on to
2110 FsRtlFastCheckLockForWrite.
2111 */
2112 NTKERNELAPI
2113 BOOLEAN
2114 NTAPI
2115 FsRtlCheckLockForWriteAccess (
2116 IN PFILE_LOCK FileLock,
2117 IN PIRP Irp
2118 );
2119
2120 typedef
2121 VOID
2122 (NTAPI*POPLOCK_WAIT_COMPLETE_ROUTINE) (
2123 IN PVOID Context,
2124 IN PIRP Irp
2125 );
2126
2127 typedef
2128 VOID
2129 (NTAPI*POPLOCK_FS_PREPOST_IRP) (
2130 IN PVOID Context,
2131 IN PIRP Irp
2132 );
2133
2134 NTKERNELAPI
2135 NTSTATUS
2136 NTAPI
2137 FsRtlCheckOplock (
2138 IN POPLOCK Oplock,
2139 IN PIRP Irp,
2140 IN PVOID Context,
2141 IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
2142 IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL
2143 );
2144
2145 NTKERNELAPI
2146 BOOLEAN
2147 NTAPI
2148 FsRtlCopyRead (
2149 IN PFILE_OBJECT FileObject,
2150 IN PLARGE_INTEGER FileOffset,
2151 IN ULONG Length,
2152 IN BOOLEAN Wait,
2153 IN ULONG LockKey,
2154 OUT PVOID Buffer,
2155 OUT PIO_STATUS_BLOCK IoStatus,
2156 IN PDEVICE_OBJECT DeviceObject
2157 );
2158
2159 NTKERNELAPI
2160 BOOLEAN
2161 NTAPI
2162 FsRtlCopyWrite (
2163 IN PFILE_OBJECT FileObject,
2164 IN PLARGE_INTEGER FileOffset,
2165 IN ULONG Length,
2166 IN BOOLEAN Wait,
2167 IN ULONG LockKey,
2168 IN PVOID Buffer,
2169 OUT PIO_STATUS_BLOCK IoStatus,
2170 IN PDEVICE_OBJECT DeviceObject
2171 );
2172
2173 NTKERNELAPI
2174 BOOLEAN
2175 NTAPI
2176 FsRtlCurrentBatchOplock (
2177 IN POPLOCK Oplock
2178 );
2179
2180 NTKERNELAPI
2181 VOID
2182 NTAPI
2183 FsRtlDeleteKeyFromTunnelCache (
2184 IN PTUNNEL Cache,
2185 IN ULONGLONG DirectoryKey
2186 );
2187
2188 NTKERNELAPI
2189 VOID
2190 NTAPI
2191 FsRtlDeleteTunnelCache (
2192 IN PTUNNEL Cache
2193 );
2194
2195 NTKERNELAPI
2196 VOID
2197 NTAPI
2198 FsRtlDeregisterUncProvider (
2199 IN HANDLE Handle
2200 );
2201
2202 NTKERNELAPI
2203 VOID
2204 NTAPI
2205 FsRtlDissectDbcs (
2206 IN ANSI_STRING Name,
2207 OUT PANSI_STRING FirstPart,
2208 OUT PANSI_STRING RemainingPart
2209 );
2210
2211 NTKERNELAPI
2212 VOID
2213 NTAPI
2214 FsRtlDissectName (
2215 IN UNICODE_STRING Name,
2216 OUT PUNICODE_STRING FirstPart,
2217 OUT PUNICODE_STRING RemainingPart
2218 );
2219
2220 NTKERNELAPI
2221 BOOLEAN
2222 NTAPI
2223 FsRtlDoesDbcsContainWildCards (
2224 IN PANSI_STRING Name
2225 );
2226
2227 NTKERNELAPI
2228 BOOLEAN
2229 NTAPI
2230 FsRtlDoesNameContainWildCards (
2231 IN PUNICODE_STRING Name
2232 );
2233
2234 #define FsRtlEnterFileSystem KeEnterCriticalRegion
2235
2236 #define FsRtlExitFileSystem KeLeaveCriticalRegion
2237
2238 NTKERNELAPI
2239 BOOLEAN
2240 NTAPI
2241 FsRtlFastCheckLockForRead (
2242 IN PFILE_LOCK FileLock,
2243 IN PLARGE_INTEGER FileOffset,
2244 IN PLARGE_INTEGER Length,
2245 IN ULONG Key,
2246 IN PFILE_OBJECT FileObject,
2247 IN PEPROCESS Process
2248 );
2249
2250 NTKERNELAPI
2251 BOOLEAN
2252 NTAPI
2253 FsRtlFastCheckLockForWrite (
2254 IN PFILE_LOCK FileLock,
2255 IN PLARGE_INTEGER FileOffset,
2256 IN PLARGE_INTEGER Length,
2257 IN ULONG Key,
2258 IN PFILE_OBJECT FileObject,
2259 IN PEPROCESS Process
2260 );
2261
2262 #define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) ( \
2263 FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11) \
2264 )
2265
2266 NTKERNELAPI
2267 NTSTATUS
2268 NTAPI
2269 FsRtlFastUnlockAll (
2270 IN PFILE_LOCK FileLock,
2271 IN PFILE_OBJECT FileObject,
2272 IN PEPROCESS Process,
2273 IN PVOID Context OPTIONAL
2274 );
2275 /* ret: STATUS_RANGE_NOT_LOCKED */
2276
2277 NTKERNELAPI
2278 NTSTATUS
2279 NTAPI
2280 FsRtlFastUnlockAllByKey (
2281 IN PFILE_LOCK FileLock,
2282 IN PFILE_OBJECT FileObject,
2283 IN PEPROCESS Process,
2284 IN ULONG Key,
2285 IN PVOID Context OPTIONAL
2286 );
2287 /* ret: STATUS_RANGE_NOT_LOCKED */
2288
2289 NTKERNELAPI
2290 NTSTATUS
2291 NTAPI
2292 FsRtlFastUnlockSingle (
2293 IN PFILE_LOCK FileLock,
2294 IN PFILE_OBJECT FileObject,
2295 IN PLARGE_INTEGER FileOffset,
2296 IN PLARGE_INTEGER Length,
2297 IN PEPROCESS Process,
2298 IN ULONG Key,
2299 IN PVOID Context OPTIONAL,
2300 IN BOOLEAN AlreadySynchronized
2301 );
2302 /* ret: STATUS_RANGE_NOT_LOCKED */
2303
2304 NTKERNELAPI
2305 BOOLEAN
2306 NTAPI
2307 FsRtlFindInTunnelCache (
2308 IN PTUNNEL Cache,
2309 IN ULONGLONG DirectoryKey,
2310 IN PUNICODE_STRING Name,
2311 OUT PUNICODE_STRING ShortName,
2312 OUT PUNICODE_STRING LongName,
2313 IN OUT PULONG DataLength,
2314 OUT PVOID Data
2315 );
2316
2317 #if (VER_PRODUCTBUILD >= 2195)
2318
2319 NTKERNELAPI
2320 VOID
2321 NTAPI
2322 FsRtlFreeFileLock (
2323 IN PFILE_LOCK FileLock
2324 );
2325
2326 #endif /* (VER_PRODUCTBUILD >= 2195) */
2327
2328 NTKERNELAPI
2329 NTSTATUS
2330 NTAPI
2331 FsRtlGetFileSize (
2332 IN PFILE_OBJECT FileObject,
2333 IN OUT PLARGE_INTEGER FileSize
2334 );
2335
2336 /*
2337 FsRtlGetNextFileLock:
2338
2339 ret: NULL if no more locks
2340
2341 Internals:
2342 FsRtlGetNextFileLock uses FileLock->LastReturnedLockInfo and
2343 FileLock->LastReturnedLock as storage.
2344 LastReturnedLock is a pointer to the 'raw' lock inkl. double linked
2345 list, and FsRtlGetNextFileLock needs this to get next lock on subsequent
2346 calls with Restart = FALSE.
2347 */
2348 NTKERNELAPI
2349 PFILE_LOCK_INFO
2350 NTAPI
2351 FsRtlGetNextFileLock (
2352 IN PFILE_LOCK FileLock,
2353 IN BOOLEAN Restart
2354 );
2355
2356 NTKERNELAPI
2357 VOID
2358 NTAPI
2359 FsRtlInitializeFileLock (
2360 IN PFILE_LOCK FileLock,
2361 IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL,
2362 IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
2363 );
2364
2365 NTKERNELAPI
2366 VOID
2367 NTAPI
2368 FsRtlInitializeOplock (
2369 IN OUT POPLOCK Oplock
2370 );
2371
2372 NTKERNELAPI
2373 VOID
2374 NTAPI
2375 FsRtlInitializeTunnelCache (
2376 IN PTUNNEL Cache
2377 );
2378
2379 NTKERNELAPI
2380 BOOLEAN
2381 NTAPI
2382 FsRtlIsNameInExpression (
2383 IN PUNICODE_STRING Expression,
2384 IN PUNICODE_STRING Name,
2385 IN BOOLEAN IgnoreCase,
2386 IN PWCHAR UpcaseTable OPTIONAL
2387 );
2388
2389 NTKERNELAPI
2390 BOOLEAN
2391 NTAPI
2392 FsRtlIsNtstatusExpected (
2393 IN NTSTATUS Ntstatus
2394 );
2395
2396 #define NLS_MB_CODE_PAGE_TAG NlsMbCodePageTag
2397 #define NLS_MB_OEM_CODE_PAGE_TAG NlsMbOemCodePageTag
2398 #define NLS_MB_CODE_PAGE_TAG NlsMbOemCodePageTag
2399 #define NLS_OEM_LEAD_BYTE_INFO NlsOemLeadByteInfo
2400
2401 extern BOOLEAN NlsMbCodePageTag;
2402 extern BOOLEAN NlsMbOemCodePageTag;
2403 extern PUSHORT NlsOemLeadByteInfo;
2404
2405 #define FsRtlIsLeadDbcsCharacter(DBCS_CHAR) ( \
2406 (BOOLEAN)((UCHAR)(DBCS_CHAR) < 0x80 ? FALSE : \
2407 (NLS_MB_CODE_PAGE_TAG && \
2408 (NLS_OEM_LEAD_BYTE_INFO[(UCHAR)(DBCS_CHAR)] != 0))) \
2409 )
2410
2411 #define FsRtlIsAnsiCharacterWild(C) ( \
2412 FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], FSRTL_WILD_CHARACTER ) \
2413 )
2414
2415 #define FsRtlIsUnicodeCharacterWild(C) ( \
2416 (((C) >= 0x40) ? \
2417 FALSE : \
2418 FlagOn(FsRtlLegalAnsiCharacterArray[(C)], FSRTL_WILD_CHARACTER )) \
2419 )
2420
2421 NTKERNELAPI
2422 BOOLEAN
2423 NTAPI
2424 FsRtlMdlReadDev (
2425 IN PFILE_OBJECT FileObject,
2426 IN PLARGE_INTEGER FileOffset,
2427 IN ULONG Length,
2428 IN ULONG LockKey,
2429 OUT PMDL *MdlChain,
2430 OUT PIO_STATUS_BLOCK IoStatus,
2431 IN PDEVICE_OBJECT DeviceObject
2432 );
2433
2434 NTKERNELAPI
2435 BOOLEAN
2436 NTAPI
2437 FsRtlMdlReadComplete (
2438 IN PFILE_OBJECT FileObject,
2439 IN PMDL MdlChain
2440 );
2441
2442 NTKERNELAPI
2443 BOOLEAN
2444 NTAPI
2445 FsRtlMdlReadCompleteDev (
2446 IN PFILE_OBJECT FileObject,
2447 IN PMDL MdlChain,
2448 IN PDEVICE_OBJECT DeviceObject
2449 );
2450
2451 NTKERNELAPI
2452 BOOLEAN
2453 NTAPI
2454 FsRtlPrepareMdlWriteDev (
2455 IN PFILE_OBJECT FileObject,
2456 IN PLARGE_INTEGER FileOffset,
2457 IN ULONG Length,
2458 IN ULONG LockKey,
2459 OUT PMDL *MdlChain,
2460 OUT PIO_STATUS_BLOCK IoStatus,
2461 IN PDEVICE_OBJECT DeviceObject
2462 );
2463
2464 NTKERNELAPI
2465 BOOLEAN
2466 NTAPI
2467 FsRtlMdlWriteComplete (
2468 IN PFILE_OBJECT FileObject,
2469 IN PLARGE_INTEGER FileOffset,
2470 IN PMDL MdlChain
2471 );
2472
2473 NTKERNELAPI
2474 BOOLEAN
2475 NTAPI
2476 FsRtlMdlWriteCompleteDev (
2477 IN PFILE_OBJECT FileObject,
2478 IN PLARGE_INTEGER FileOffset,
2479 IN PMDL MdlChain,
2480 IN PDEVICE_OBJECT DeviceObject
2481 );
2482
2483 NTKERNELAPI
2484 NTSTATUS
2485 NTAPI
2486 FsRtlNormalizeNtstatus (
2487 IN NTSTATUS Exception,
2488 IN NTSTATUS GenericException
2489 );
2490
2491 NTKERNELAPI
2492 VOID
2493 NTAPI
2494 FsRtlNotifyChangeDirectory (
2495 IN PNOTIFY_SYNC NotifySync,
2496 IN PVOID FsContext,
2497 IN PSTRING FullDirectoryName,
2498 IN PLIST_ENTRY NotifyList,
2499 IN BOOLEAN WatchTree,
2500 IN ULONG CompletionFilter,
2501 IN PIRP NotifyIrp
2502 );
2503
2504 NTKERNELAPI
2505 VOID
2506 NTAPI
2507 FsRtlNotifyCleanup (
2508 IN PNOTIFY_SYNC NotifySync,
2509 IN PLIST_ENTRY NotifyList,
2510 IN PVOID FsContext
2511 );
2512
2513 typedef BOOLEAN (*PCHECK_FOR_TRAVERSE_ACCESS) (
2514 IN PVOID NotifyContext,
2515 IN PVOID TargetContext,
2516 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
2517 );
2518
2519 NTKERNELAPI
2520 VOID
2521 NTAPI
2522 FsRtlNotifyFullChangeDirectory (
2523 IN PNOTIFY_SYNC NotifySync,
2524 IN PLIST_ENTRY NotifyList,
2525 IN PVOID FsContext,
2526 IN PSTRING FullDirectoryName,
2527 IN BOOLEAN WatchTree,
2528 IN BOOLEAN IgnoreBuffer,
2529 IN ULONG CompletionFilter,
2530 IN PIRP NotifyIrp,
2531 IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL,
2532 IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL
2533 );
2534
2535 NTKERNELAPI
2536 VOID
2537 NTAPI
2538 FsRtlNotifyFullReportChange (
2539 IN PNOTIFY_SYNC NotifySync,
2540 IN PLIST_ENTRY NotifyList,
2541 IN PSTRING FullTargetName,
2542 IN USHORT TargetNameOffset,
2543 IN PSTRING StreamName OPTIONAL,
2544 IN PSTRING NormalizedParentName OPTIONAL,
2545 IN ULONG FilterMatch,
2546 IN ULONG Action,
2547 IN PVOID TargetContext
2548 );
2549
2550 NTKERNELAPI
2551 VOID
2552 NTAPI
2553 FsRtlNotifyInitializeSync (
2554 IN PNOTIFY_SYNC *NotifySync
2555 );
2556
2557 NTKERNELAPI
2558 VOID
2559 NTAPI
2560 FsRtlNotifyReportChange (
2561 IN PNOTIFY_SYNC NotifySync,
2562 IN PLIST_ENTRY NotifyList,
2563 IN PSTRING FullTargetName,
2564 IN PUSHORT FileNamePartLength,
2565 IN ULONG FilterMatch
2566 );
2567
2568 NTKERNELAPI
2569 VOID
2570 NTAPI
2571 FsRtlNotifyUninitializeSync (
2572 IN PNOTIFY_SYNC *NotifySync
2573 );
2574
2575 #if (VER_PRODUCTBUILD >= 2195)
2576
2577 NTKERNELAPI
2578 NTSTATUS
2579 NTAPI
2580 FsRtlNotifyVolumeEvent (
2581 IN PFILE_OBJECT FileObject,
2582 IN ULONG EventCode
2583 );
2584
2585 #endif /* (VER_PRODUCTBUILD >= 2195) */
2586
2587 NTKERNELAPI
2588 NTSTATUS
2589 NTAPI
2590 FsRtlOplockFsctrl (
2591 IN POPLOCK Oplock,
2592 IN PIRP Irp,
2593 IN ULONG OpenCount
2594 );
2595
2596 NTKERNELAPI
2597 BOOLEAN
2598 NTAPI
2599 FsRtlOplockIsFastIoPossible (
2600 IN POPLOCK Oplock
2601 );
2602
2603 /*
2604 FsRtlPrivateLock:
2605
2606 ret: IoStatus->Status: STATUS_PENDING, STATUS_LOCK_NOT_GRANTED
2607
2608 Internals:
2609 -Calls IoCompleteRequest if Irp
2610 -Uses exception handling / ExRaiseStatus with STATUS_INSUFFICIENT_RESOURCES
2611 */
2612 NTKERNELAPI
2613 BOOLEAN
2614 NTAPI
2615 FsRtlPrivateLock (
2616 IN PFILE_LOCK FileLock,
2617 IN PFILE_OBJECT FileObject,
2618 IN PLARGE_INTEGER FileOffset,
2619 IN PLARGE_INTEGER Length,
2620 IN PEPROCESS Process,
2621 IN ULONG Key,
2622 IN BOOLEAN FailImmediately,
2623 IN BOOLEAN ExclusiveLock,
2624 OUT PIO_STATUS_BLOCK IoStatus,
2625 IN PIRP Irp OPTIONAL,
2626 IN PVOID Context,
2627 IN BOOLEAN AlreadySynchronized
2628 );
2629
2630 /*
2631 FsRtlProcessFileLock:
2632
2633 ret:
2634 -STATUS_INVALID_DEVICE_REQUEST
2635 -STATUS_RANGE_NOT_LOCKED from unlock routines.
2636 -STATUS_PENDING, STATUS_LOCK_NOT_GRANTED from FsRtlPrivateLock
2637 (redirected IoStatus->Status).
2638
2639 Internals:
2640 -switch ( Irp->CurrentStackLocation->MinorFunction )
2641 lock: return FsRtlPrivateLock;
2642 unlocksingle: return FsRtlFastUnlockSingle;
2643 unlockall: return FsRtlFastUnlockAll;
2644 unlockallbykey: return FsRtlFastUnlockAllByKey;
2645 default: IofCompleteRequest with STATUS_INVALID_DEVICE_REQUEST;
2646 return STATUS_INVALID_DEVICE_REQUEST;
2647
2648 -'AllwaysZero' is passed thru as 'AllwaysZero' to lock / unlock routines.
2649 -'Irp' is passet thru as 'Irp' to FsRtlPrivateLock.
2650 */
2651 NTKERNELAPI
2652 NTSTATUS
2653 NTAPI
2654 FsRtlProcessFileLock (
2655 IN PFILE_LOCK FileLock,
2656 IN PIRP Irp,
2657 IN PVOID Context OPTIONAL
2658 );
2659
2660 NTKERNELAPI
2661 NTSTATUS
2662 NTAPI
2663 FsRtlRegisterUncProvider (
2664 IN OUT PHANDLE MupHandle,
2665 IN PUNICODE_STRING RedirectorDeviceName,
2666 IN BOOLEAN MailslotsSupported
2667 );
2668
2669 typedef VOID
2670 (NTAPI *PFSRTL_STACK_OVERFLOW_ROUTINE) (
2671 IN PVOID Context,
2672 IN PKEVENT Event
2673 );
2674
2675 NTKERNELAPI
2676 VOID
2677 NTAPI
2678 FsRtlPostStackOverflow (
2679 IN PVOID Context,
2680 IN PKEVENT Event,
2681 IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine
2682 );
2683
2684 NTKERNELAPI
2685 VOID
2686 NTAPI
2687 FsRtlPostPagingFileStackOverflow (
2688 IN PVOID Context,
2689 IN PKEVENT Event,
2690 IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine
2691 );
2692
2693 NTKERNELAPI
2694 VOID
2695 NTAPI
2696 FsRtlUninitializeFileLock (
2697 IN PFILE_LOCK FileLock
2698 );
2699
2700 NTKERNELAPI
2701 VOID
2702 NTAPI
2703 FsRtlUninitializeOplock (
2704 IN OUT POPLOCK Oplock
2705 );
2706
2707 NTSYSAPI
2708 VOID
2709 NTAPI
2710 HalDisplayString (
2711 IN PCHAR String
2712 );
2713
2714 NTSYSAPI
2715 VOID
2716 NTAPI
2717 HalQueryRealTimeClock (
2718 IN OUT PTIME_FIELDS TimeFields
2719 );
2720
2721 NTSYSAPI
2722 VOID
2723 NTAPI
2724 HalSetRealTimeClock (
2725 IN PTIME_FIELDS TimeFields
2726 );
2727
2728 NTKERNELAPI
2729 NTSTATUS
2730 NTAPI
2731 IoAttachDeviceToDeviceStackSafe(
2732 IN PDEVICE_OBJECT SourceDevice,
2733 IN PDEVICE_OBJECT TargetDevice,
2734 OUT PDEVICE_OBJECT *AttachedToDeviceObject
2735 );
2736
2737 NTKERNELAPI
2738 VOID
2739 NTAPI
2740 IoAcquireVpbSpinLock (
2741 OUT PKIRQL Irql
2742 );
2743
2744 NTKERNELAPI
2745 NTSTATUS
2746 NTAPI
2747 IoCheckDesiredAccess (
2748 IN OUT PACCESS_MASK DesiredAccess,
2749 IN ACCESS_MASK GrantedAccess
2750 );
2751
2752 NTKERNELAPI
2753 NTSTATUS
2754 NTAPI
2755 IoCheckEaBufferValidity (
2756 IN PFILE_FULL_EA_INFORMATION EaBuffer,
2757 IN ULONG EaLength,
2758 OUT PULONG ErrorOffset
2759 );
2760
2761 NTKERNELAPI
2762 NTSTATUS
2763 NTAPI
2764 IoCheckFunctionAccess (
2765 IN ACCESS_MASK GrantedAccess,
2766 IN UCHAR MajorFunction,
2767 IN UCHAR MinorFunction,
2768 IN ULONG IoControlCode,
2769 IN PVOID Argument1 OPTIONAL,
2770 IN PVOID Argument2 OPTIONAL
2771 );
2772
2773 #if (VER_PRODUCTBUILD >= 2195)
2774
2775 NTKERNELAPI
2776 NTSTATUS
2777 NTAPI
2778 IoCheckQuotaBufferValidity (
2779 IN PFILE_QUOTA_INFORMATION QuotaBuffer,
2780 IN ULONG QuotaLength,
2781 OUT PULONG ErrorOffset
2782 );
2783
2784 #endif /* (VER_PRODUCTBUILD >= 2195) */
2785
2786 NTKERNELAPI
2787 PFILE_OBJECT
2788 NTAPI
2789 IoCreateStreamFileObject (
2790 IN PFILE_OBJECT FileObject OPTIONAL,
2791 IN PDEVICE_OBJECT DeviceObject OPTIONAL
2792 );
2793
2794 #if (VER_PRODUCTBUILD >= 2195)
2795
2796 NTKERNELAPI
2797 PFILE_OBJECT
2798 NTAPI
2799 IoCreateStreamFileObjectLite (
2800 IN PFILE_OBJECT FileObject OPTIONAL,
2801 IN PDEVICE_OBJECT DeviceObject OPTIONAL
2802 );
2803
2804 #endif /* (VER_PRODUCTBUILD >= 2195) */
2805
2806 NTKERNELAPI
2807 BOOLEAN
2808 NTAPI
2809 IoFastQueryNetworkAttributes (
2810 IN POBJECT_ATTRIBUTES ObjectAttributes,
2811 IN ACCESS_MASK DesiredAccess,
2812 IN ULONG OpenOptions,
2813 OUT PIO_STATUS_BLOCK IoStatus,
2814 OUT PFILE_NETWORK_OPEN_INFORMATION Buffer
2815 );
2816
2817 NTKERNELAPI
2818 PDEVICE_OBJECT
2819 NTAPI
2820 IoGetAttachedDevice (
2821 IN PDEVICE_OBJECT DeviceObject
2822 );
2823
2824 NTKERNELAPI
2825 PDEVICE_OBJECT
2826 NTAPI
2827 IoGetBaseFileSystemDeviceObject (
2828 IN PFILE_OBJECT FileObject
2829 );
2830
2831 NTKERNELAPI
2832 PEPROCESS
2833 NTAPI
2834 IoGetRequestorProcess (
2835 IN PIRP Irp
2836 );
2837
2838 #if (VER_PRODUCTBUILD >= 2195)
2839
2840 NTKERNELAPI
2841 ULONG
2842 NTAPI
2843 IoGetRequestorProcessId (
2844 IN PIRP Irp
2845 );
2846
2847 #endif /* (VER_PRODUCTBUILD >= 2195) */
2848
2849 NTKERNELAPI
2850 PIRP
2851 NTAPI
2852 IoGetTopLevelIrp (
2853 VOID
2854 );
2855
2856 #define IoIsFileOpenedExclusively(FileObject) ( \
2857 (BOOLEAN) !( \
2858 (FileObject)->SharedRead || \
2859 (FileObject)->SharedWrite || \
2860 (FileObject)->SharedDelete \
2861 ) \
2862 )
2863
2864 NTKERNELAPI
2865 BOOLEAN
2866 NTAPI
2867 IoIsOperationSynchronous (
2868 IN PIRP Irp
2869 );
2870
2871 NTKERNELAPI
2872 BOOLEAN
2873 NTAPI
2874 IoIsSystemThread (
2875 IN PETHREAD Thread
2876 );
2877
2878 #if (VER_PRODUCTBUILD >= 2195)
2879
2880 NTKERNELAPI
2881 BOOLEAN
2882 NTAPI
2883 IoIsValidNameGraftingBuffer (
2884 IN PIRP Irp,
2885 IN PREPARSE_DATA_BUFFER ReparseBuffer
2886 );
2887
2888 #endif /* (VER_PRODUCTBUILD >= 2195) */
2889
2890 NTKERNELAPI
2891 NTSTATUS
2892 NTAPI
2893 IoPageRead (
2894 IN PFILE_OBJECT FileObject,
2895 IN PMDL Mdl,
2896 IN PLARGE_INTEGER Offset,
2897 IN PKEVENT Event,
2898 OUT PIO_STATUS_BLOCK IoStatusBlock
2899 );
2900
2901 NTKERNELAPI
2902 NTSTATUS
2903 NTAPI
2904 IoQueryFileInformation (
2905 IN PFILE_OBJECT FileObject,
2906 IN FILE_INFORMATION_CLASS FileInformationClass,
2907 IN ULONG Length,
2908 OUT PVOID FileInformation,
2909 OUT PULONG ReturnedLength
2910 );
2911
2912 NTKERNELAPI
2913 NTSTATUS
2914 NTAPI
2915 IoQueryVolumeInformation (
2916 IN PFILE_OBJECT FileObject,
2917 IN FS_INFORMATION_CLASS FsInformationClass,
2918 IN ULONG Length,
2919 OUT PVOID FsInformation,
2920 OUT PULONG ReturnedLength
2921 );
2922
2923 NTKERNELAPI
2924 VOID
2925 NTAPI
2926 IoQueueThreadIrp(
2927 IN PIRP Irp
2928 );
2929
2930 NTKERNELAPI
2931 VOID
2932 NTAPI
2933 IoRegisterFileSystem (
2934 IN OUT PDEVICE_OBJECT DeviceObject
2935 );
2936
2937 #if (VER_PRODUCTBUILD >= 1381)
2938
2939 typedef VOID (NTAPI *PDRIVER_FS_NOTIFICATION) (
2940 IN PDEVICE_OBJECT DeviceObject,
2941 IN BOOLEAN DriverActive
2942 );
2943
2944 NTKERNELAPI
2945 NTSTATUS
2946 NTAPI
2947 IoRegisterFsRegistrationChange (
2948 IN PDRIVER_OBJECT DriverObject,
2949 IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
2950 );
2951
2952 #endif /* (VER_PRODUCTBUILD >= 1381) */
2953
2954 NTKERNELAPI
2955 VOID
2956 NTAPI
2957 IoReleaseVpbSpinLock (
2958 IN KIRQL Irql
2959 );
2960
2961 NTKERNELAPI
2962 VOID
2963 NTAPI
2964 IoSetDeviceToVerify (
2965 IN PETHREAD Thread,
2966 IN PDEVICE_OBJECT DeviceObject
2967 );
2968
2969 NTKERNELAPI
2970 NTSTATUS
2971 NTAPI
2972 IoSetInformation (
2973 IN PFILE_OBJECT FileObject,
2974 IN FILE_INFORMATION_CLASS FileInformationClass,
2975 IN ULONG Length,
2976 IN PVOID FileInformation
2977 );
2978
2979 NTKERNELAPI
2980 VOID
2981 NTAPI
2982 IoSetTopLevelIrp (
2983 IN PIRP Irp
2984 );
2985
2986 NTKERNELAPI
2987 NTSTATUS
2988 NTAPI
2989 IoSynchronousPageWrite (
2990 IN PFILE_OBJECT FileObject,
2991 IN PMDL Mdl,
2992 IN PLARGE_INTEGER FileOffset,
2993 IN PKEVENT Event,
2994 OUT PIO_STATUS_BLOCK IoStatusBlock
2995 );
2996
2997 NTKERNELAPI
2998 PEPROCESS
2999 NTAPI
3000 IoThreadToProcess (
3001 IN PETHREAD Thread
3002 );
3003
3004 NTKERNELAPI
3005 VOID
3006 NTAPI
3007 IoUnregisterFileSystem (
3008 IN OUT PDEVICE_OBJECT DeviceObject
3009 );
3010
3011 #if (VER_PRODUCTBUILD >= 1381)
3012
3013 NTKERNELAPI
3014 VOID
3015 NTAPI
3016 IoUnregisterFsRegistrationChange (
3017 IN PDRIVER_OBJECT DriverObject,
3018 IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
3019 );
3020
3021 #endif /* (VER_PRODUCTBUILD >= 1381) */
3022
3023 NTKERNELAPI
3024 NTSTATUS
3025 NTAPI
3026 IoVerifyVolume (
3027 IN PDEVICE_OBJECT DeviceObject,
3028 IN BOOLEAN AllowRawMount
3029 );
3030
3031 NTKERNELAPI
3032 VOID
3033 NTAPI
3034 KeAttachProcess (
3035 IN PKPROCESS Process
3036 );
3037
3038 NTKERNELAPI
3039 VOID
3040 NTAPI
3041 KeDetachProcess (
3042 VOID
3043 );
3044
3045 NTKERNELAPI
3046 VOID
3047 NTAPI
3048 KeInitializeQueue (
3049 IN PRKQUEUE Queue,
3050 IN ULONG Count OPTIONAL
3051 );
3052
3053 NTKERNELAPI
3054 LONG
3055 NTAPI
3056 KeInsertHeadQueue (
3057 IN PRKQUEUE Queue,
3058 IN PLIST_ENTRY Entry
3059 );
3060
3061 NTKERNELAPI
3062 LONG
3063 NTAPI
3064 KeInsertQueue (
3065 IN PRKQUEUE Queue,
3066 IN PLIST_ENTRY Entry
3067 );
3068
3069 NTKERNELAPI
3070 BOOLEAN
3071 NTAPI
3072 KeInsertQueueApc (
3073 IN PKAPC Apc,
3074 IN PVOID SystemArgument1,
3075 IN PVOID SystemArgument2,
3076 IN KPRIORITY PriorityBoost
3077 );
3078
3079 NTKERNELAPI
3080 LONG
3081 NTAPI
3082 KeReadStateQueue (
3083 IN PRKQUEUE Queue
3084 );
3085
3086 NTKERNELAPI
3087 PLIST_ENTRY
3088 NTAPI
3089 KeRemoveQueue (
3090 IN PRKQUEUE Queue,
3091 IN KPROCESSOR_MODE WaitMode,
3092 IN PLARGE_INTEGER Timeout OPTIONAL
3093 );
3094
3095 NTKERNELAPI
3096 PLIST_ENTRY
3097 NTAPI
3098 KeRundownQueue (
3099 IN PRKQUEUE Queue
3100 );
3101
3102 NTKERNELAPI
3103 VOID
3104 NTAPI
3105 KeInitializeMutant (
3106 IN PRKMUTANT Mutant,
3107 IN BOOLEAN InitialOwner
3108 );
3109
3110 NTKERNELAPI
3111 LONG
3112 NTAPI
3113 KeReadStateMutant (
3114 IN PRKMUTANT Mutant
3115 );
3116
3117 NTKERNELAPI
3118 LONG
3119 NTAPI
3120 KeReleaseMutant (
3121 IN PRKMUTANT Mutant,
3122 IN KPRIORITY Increment,
3123 IN BOOLEAN Abandoned,
3124 IN BOOLEAN Wait
3125 );
3126
3127 #if (VER_PRODUCTBUILD >= 2195)
3128
3129 NTKERNELAPI
3130 VOID
3131 NTAPI
3132 KeStackAttachProcess (
3133 IN PKPROCESS Process,
3134 OUT PKAPC_STATE ApcState
3135 );
3136
3137 NTKERNELAPI
3138 VOID
3139 NTAPI
3140 KeUnstackDetachProcess (
3141 IN PKAPC_STATE ApcState
3142 );
3143
3144 #endif /* (VER_PRODUCTBUILD >= 2195) */
3145
3146 NTKERNELAPI
3147 BOOLEAN
3148 NTAPI
3149 MmCanFileBeTruncated (
3150 IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
3151 IN PLARGE_INTEGER NewFileSize
3152 );
3153
3154 NTKERNELAPI
3155 BOOLEAN
3156 NTAPI
3157 MmFlushImageSection (
3158 IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
3159 IN MMFLUSH_TYPE FlushType
3160 );
3161
3162 NTKERNELAPI
3163 BOOLEAN
3164 NTAPI
3165 MmForceSectionClosed (
3166 IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
3167 IN BOOLEAN DelayClose
3168 );
3169
3170 #if (VER_PRODUCTBUILD >= 1381)
3171
3172 NTKERNELAPI
3173 BOOLEAN
3174 NTAPI
3175 MmIsRecursiveIoFault (
3176 VOID
3177 );
3178
3179 #else
3180
3181 #define MmIsRecursiveIoFault() ( \
3182 (PsGetCurrentThread()->DisablePageFaultClustering) | \
3183 (PsGetCurrentThread()->ForwardClusterOnly) \
3184 )
3185
3186 #endif
3187
3188 NTKERNELAPI
3189 NTSTATUS
3190 NTAPI
3191 MmMapViewOfSection (
3192 IN PVOID SectionObject,
3193 IN PEPROCESS Process,
3194 IN OUT PVOID *BaseAddress,
3195 IN ULONG ZeroBits,
3196 IN ULONG CommitSize,
3197 IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,
3198 IN OUT PULONG ViewSize,
3199 IN SECTION_INHERIT InheritDisposition,
3200 IN ULONG AllocationType,
3201 IN ULONG Protect
3202 );
3203
3204 NTKERNELAPI
3205 BOOLEAN
3206 NTAPI
3207 MmSetAddressRangeModified (
3208 IN PVOID Address,
3209 IN ULONG Length
3210 );
3211
3212 NTKERNELAPI
3213 NTSTATUS
3214 NTAPI
3215 ObCreateObject (
3216 IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL,
3217 IN POBJECT_TYPE ObjectType,
3218 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
3219 IN KPROCESSOR_MODE AccessMode,
3220 IN OUT PVOID ParseContext OPTIONAL,
3221 IN ULONG ObjectSize,
3222 IN ULONG PagedPoolCharge OPTIONAL,
3223 IN ULONG NonPagedPoolCharge OPTIONAL,
3224 OUT PVOID *Object
3225 );
3226
3227 NTKERNELAPI
3228 ULONG
3229 NTAPI
3230 ObGetObjectPointerCount (
3231 IN PVOID Object
3232 );
3233
3234 NTKERNELAPI
3235 NTSTATUS
3236 NTAPI
3237 ObInsertObject (
3238 IN PVOID Object,
3239 IN PACCESS_STATE PassedAccessState OPTIONAL,
3240 IN ACCESS_MASK DesiredAccess,
3241 IN ULONG AdditionalReferences,
3242 OUT PVOID *ReferencedObject OPTIONAL,
3243 OUT PHANDLE Handle
3244 );
3245
3246 NTKERNELAPI
3247 VOID
3248 NTAPI
3249 ObMakeTemporaryObject (
3250 IN PVOID Object
3251 );
3252
3253 NTKERNELAPI
3254 NTSTATUS
3255 NTAPI
3256 ObOpenObjectByPointer (
3257 IN PVOID Object,
3258 IN ULONG HandleAttributes,
3259 IN PACCESS_STATE PassedAccessState OPTIONAL,
3260 IN ACCESS_MASK DesiredAccess OPTIONAL,
3261 IN POBJECT_TYPE ObjectType OPTIONAL,
3262 IN KPROCESSOR_MODE AccessMode,
3263 OUT PHANDLE Handle
3264 );
3265
3266 NTKERNELAPI
3267 NTSTATUS
3268 NTAPI
3269 ObQueryNameString (
3270 IN PVOID Object,
3271 OUT POBJECT_NAME_INFORMATION ObjectNameInfo,
3272 IN ULONG Length,
3273 OUT PULONG ReturnLength
3274 );
3275
3276 NTKERNELAPI
3277 NTSTATUS
3278 NTAPI
3279 ObQueryObjectAuditingByHandle (
3280 IN HANDLE Handle,
3281 OUT PBOOLEAN GenerateOnClose
3282 );
3283
3284 NTKERNELAPI
3285 NTSTATUS
3286 NTAPI
3287 ObReferenceObjectByName (
3288 IN PUNICODE_STRING ObjectName,
3289 IN ULONG Attributes,
3290 IN PACCESS_STATE PassedAccessState OPTIONAL,
3291 IN ACCESS_MASK DesiredAccess OPTIONAL,
3292 IN POBJECT_TYPE ObjectType,
3293 IN KPROCESSOR_MODE AccessMode,
3294 IN OUT PVOID ParseContext OPTIONAL,
3295 OUT PVOID *Object
3296 );
3297
3298 NTKERNELAPI
3299 NTSTATUS
3300 NTAPI
3301 PsAssignImpersonationToken (
3302 IN PETHREAD Thread,
3303 IN HANDLE Token
3304 );
3305
3306 NTKERNELAPI
3307 VOID
3308 NTAPI
3309 PsChargePoolQuota (
3310 IN PEPROCESS Process,
3311 IN POOL_TYPE PoolType,
3312 IN ULONG Amount
3313 );
3314
3315 NTKERNELAPI
3316 NTSTATUS
3317 NTAPI
3318 PsChargeProcessPoolQuota (
3319 IN PEPROCESS Process,
3320 IN POOL_TYPE PoolType,
3321 IN ULONG_PTR Amount
3322 );
3323
3324 #define PsDereferenceImpersonationToken(T) \
3325 {if (ARGUMENT_PRESENT(T)) { \
3326 (ObDereferenceObject((T))); \
3327 } else { \
3328 ; \
3329 } \
3330 }
3331
3332 #define PsDereferencePrimaryToken(T) (ObDereferenceObject((T)))
3333
3334 NTKERNELAPI
3335 BOOLEAN
3336 NTAPI
3337 PsDisableImpersonation(
3338 IN PETHREAD Thread,
3339 IN PSE_IMPERSONATION_STATE ImpersonationState
3340 );
3341
3342 NTKERNELAPI
3343 LARGE_INTEGER
3344 NTAPI
3345 PsGetProcessExitTime (
3346 VOID
3347 );
3348
3349 NTKERNELAPI
3350 NTSTATUS
3351 NTAPI
3352 PsImpersonateClient(
3353 IN PETHREAD Thread,
3354 IN PACCESS_TOKEN Token,
3355 IN BOOLEAN CopyOnOpen,
3356 IN BOOLEAN EffectiveOnly,
3357 IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
3358 );
3359
3360 NTKERNELAPI
3361 BOOLEAN
3362 NTAPI
3363 PsIsSystemThread(
3364 IN PETHREAD Thread
3365 );
3366
3367 NTKERNELAPI
3368 BOOLEAN
3369 NTAPI
3370 PsIsThreadTerminating (
3371 IN PETHREAD Thread
3372 );
3373
3374 NTKERNELAPI
3375 NTSTATUS
3376 NTAPI
3377 PsLookupProcessByProcessId (
3378 IN HANDLE ProcessId,
3379 OUT PEPROCESS *Process
3380 );
3381
3382 NTKERNELAPI
3383 NTSTATUS
3384 NTAPI
3385 PsLookupProcessThreadByCid (
3386 IN PCLIENT_ID Cid,
3387 OUT PEPROCESS *Process OPTIONAL,
3388 OUT PETHREAD *Thread
3389 );
3390
3391 NTKERNELAPI
3392 NTSTATUS
3393 NTAPI
3394 PsLookupThreadByThreadId (
3395 IN HANDLE UniqueThreadId,
3396 OUT PETHREAD *Thread
3397 );
3398
3399 NTKERNELAPI
3400 PACCESS_TOKEN
3401 NTAPI
3402 PsReferenceImpersonationToken (
3403 IN PETHREAD Thread,
3404 OUT PBOOLEAN CopyOnUse,
3405 OUT PBOOLEAN EffectiveOnly,
3406 OUT PSECURITY_IMPERSONATION_LEVEL Level
3407 );
3408
3409 NTKERNELAPI
3410 HANDLE
3411 NTAPI
3412 PsReferencePrimaryToken (
3413 IN PEPROCESS Process
3414 );
3415
3416 NTKERNELAPI
3417 VOID
3418 NTAPI
3419 PsRestoreImpersonation(
3420 IN PETHREAD Thread,
3421 IN PSE_IMPERSONATION_STATE ImpersonationState
3422 );
3423
3424 NTKERNELAPI
3425 VOID
3426 NTAPI
3427 PsReturnPoolQuota (
3428 IN PEPROCESS Process,
3429 IN POOL_TYPE PoolType,
3430 IN ULONG Amount
3431 );
3432
3433 NTKERNELAPI
3434 VOID
3435 NTAPI
3436 PsRevertToSelf (
3437 VOID
3438 );
3439
3440 NTSYSAPI
3441 NTSTATUS
3442 NTAPI
3443 RtlAbsoluteToSelfRelativeSD (
3444 IN PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor,
3445 IN OUT PISECURITY_DESCRIPTOR_RELATIVE SelfRelativeSecurityDescriptor,
3446 IN PULONG BufferLength
3447 );
3448
3449 NTSYSAPI
3450 PVOID
3451 NTAPI
3452 RtlAllocateHeap (
3453 IN HANDLE HeapHandle,
3454 IN ULONG Flags,
3455 IN ULONG Size
3456 );
3457
3458 NTSYSAPI
3459 NTSTATUS
3460 NTAPI
3461 RtlCompressBuffer (
3462 IN USHORT CompressionFormatAndEngine,
3463 IN PUCHAR UncompressedBuffer,
3464 IN ULONG UncompressedBufferSize,
3465 OUT PUCHAR CompressedBuffer,
3466 IN ULONG CompressedBufferSize,
3467 IN ULONG UncompressedChunkSize,
3468 OUT PULONG FinalCompressedSize,
3469 IN PVOID WorkSpace
3470 );
3471
3472 NTSYSAPI
3473 NTSTATUS
3474 NTAPI
3475 RtlCompressChunks (
3476 IN PUCHAR UncompressedBuffer,
3477 IN ULONG UncompressedBufferSize,
3478 OUT PUCHAR CompressedBuffer,
3479 IN ULONG CompressedBufferSize,
3480 IN OUT PCOMPRESSED_DATA_INFO CompressedDataInfo,
3481 IN ULONG CompressedDataInfoLength,
3482 IN PVOID WorkSpace
3483 );
3484
3485 NTSYSAPI
3486 NTSTATUS
3487 NTAPI
3488 RtlConvertSidToUnicodeString (
3489 OUT PUNICODE_STRING DestinationString,
3490 IN PSID Sid,
3491 IN BOOLEAN AllocateDestinationString
3492 );
3493
3494 NTSYSAPI
3495 NTSTATUS
3496 NTAPI
3497 RtlCopySid (
3498 IN ULONG Length,
3499 IN PSID Destination,
3500 IN PSID Source
3501 );
3502
3503 NTSYSAPI
3504 NTSTATUS
3505 NTAPI
3506 RtlDecompressBuffer (
3507 IN USHORT CompressionFormat,
3508 OUT PUCHAR UncompressedBuffer,
3509 IN ULONG UncompressedBufferSize,
3510 IN PUCHAR CompressedBuffer,
3511 IN ULONG CompressedBufferSize,
3512 OUT PULONG FinalUncompressedSize
3513 );
3514
3515 NTSYSAPI
3516 NTSTATUS
3517 NTAPI
3518 RtlDecompressChunks (
3519 OUT PUCHAR UncompressedBuffer,
3520 IN ULONG UncompressedBufferSize,
3521 IN PUCHAR CompressedBuffer,
3522 IN ULONG CompressedBufferSize,
3523 IN PUCHAR CompressedTail,
3524 IN ULONG CompressedTailSize,
3525 IN PCOMPRESSED_DATA_INFO CompressedDataInfo
3526 );
3527
3528 NTSYSAPI
3529 NTSTATUS
3530 NTAPI
3531 RtlDecompressFragment (
3532 IN USHORT CompressionFormat,
3533 OUT PUCHAR UncompressedFragment,
3534 IN ULONG UncompressedFragmentSize,
3535 IN PUCHAR CompressedBuffer,
3536 IN ULONG CompressedBufferSize,
3537 IN ULONG FragmentOffset,
3538 OUT PULONG FinalUncompressedSize,
3539 IN PVOID WorkSpace
3540 );
3541
3542 NTSYSAPI
3543 NTSTATUS
3544 NTAPI
3545 RtlDescribeChunk (
3546 IN USHORT CompressionFormat,
3547 IN OUT PUCHAR *CompressedBuffer,
3548 IN PUCHAR EndOfCompressedBufferPlus1,
3549 OUT PUCHAR *ChunkBuffer,
3550 OUT PULONG ChunkSize
3551 );
3552
3553 NTSYSAPI
3554 BOOLEAN
3555 NTAPI
3556 RtlEqualSid (
3557 IN PSID Sid1,
3558 IN PSID Sid2
3559 );
3560
3561 NTSYSAPI
3562 VOID
3563 NTAPI
3564 RtlFillMemoryUlong (
3565 IN PVOID Destination,
3566 IN ULONG Length,
3567 IN ULONG Fill
3568 );
3569
3570 NTSYSAPI
3571 BOOLEAN
3572 NTAPI
3573 RtlFreeHeap (
3574 IN HANDLE HeapHandle,
3575 IN ULONG Flags,
3576 IN PVOID P
3577 );
3578
3579 NTSYSAPI
3580 VOID
3581 NTAPI
3582 RtlGenerate8dot3Name (
3583 IN PUNICODE_STRING Name,
3584 IN BOOLEAN AllowExtendedCharacters,
3585 IN OUT PGENERATE_NAME_CONTEXT Context,
3586 OUT PUNICODE_STRING Name8dot3
3587 );
3588
3589 NTSYSAPI
3590 NTSTATUS
3591 NTAPI
3592 RtlGetCompressionWorkSpaceSize (
3593 IN USHORT CompressionFormatAndEngine,
3594 OUT PULONG CompressBufferWorkSpaceSize,
3595 OUT PULONG CompressFragmentWorkSpaceSize
3596 );
3597
3598 NTSYSAPI
3599 NTSTATUS
3600 NTAPI
3601 RtlGetDaclSecurityDescriptor (
3602 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3603 OUT PBOOLEAN DaclPresent,
3604 OUT PACL *Dacl,
3605 OUT PBOOLEAN DaclDefaulted
3606 );
3607
3608 NTSYSAPI
3609 NTSTATUS
3610 NTAPI
3611 RtlGetGroupSecurityDescriptor (
3612 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3613 OUT PSID *Group,
3614 OUT PBOOLEAN GroupDefaulted
3615 );
3616
3617 NTSYSAPI
3618 NTSTATUS
3619 NTAPI
3620 RtlGetOwnerSecurityDescriptor (
3621 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3622 OUT PSID *Owner,
3623 OUT PBOOLEAN OwnerDefaulted
3624 );
3625
3626 NTSYSAPI
3627 NTSTATUS
3628 NTAPI
3629 RtlInitializeSid (
3630 IN OUT PSID Sid,
3631 IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,
3632 IN UCHAR SubAuthorityCount
3633 );
3634
3635 NTSYSAPI
3636 BOOLEAN
3637 NTAPI
3638 RtlIsNameLegalDOS8Dot3 (
3639 IN PUNICODE_STRING UnicodeName,
3640 IN PANSI_STRING AnsiName,
3641 PBOOLEAN Unknown
3642 );
3643
3644 NTSYSAPI
3645 ULONG
3646 NTAPI
3647 RtlLengthRequiredSid (
3648 IN UCHAR SubAuthorityCount
3649 );
3650
3651 NTSYSAPI
3652 ULONG
3653 NTAPI
3654 RtlLengthSid (
3655 IN PSID Sid
3656 );
3657
3658 NTSYSAPI
3659 ULONG
3660 NTAPI
3661 RtlNtStatusToDosError (
3662 IN NTSTATUS Status
3663 );
3664
3665 NTSYSAPI
3666 NTSTATUS
3667 NTAPI
3668 RtlReserveChunk (
3669 IN USHORT CompressionFormat,
3670 IN OUT PUCHAR *CompressedBuffer,
3671 IN PUCHAR EndOfCompressedBufferPlus1,
3672 OUT PUCHAR *ChunkBuffer,
3673 IN ULONG ChunkSize
3674 );
3675
3676 NTSYSAPI
3677 VOID
3678 NTAPI
3679 RtlSecondsSince1970ToTime (
3680 IN ULONG SecondsSince1970,
3681 OUT PLARGE_INTEGER Time
3682 );
3683
3684 NTSYSAPI
3685 NTSTATUS
3686 NTAPI
3687 RtlSetGroupSecurityDescriptor (
3688 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
3689 IN PSID Group,
3690 IN BOOLEAN GroupDefaulted
3691 );
3692
3693 NTSYSAPI
3694 NTSTATUS
3695 NTAPI
3696 RtlSetOwnerSecurityDescriptor (
3697 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
3698 IN PSID Owner,
3699 IN BOOLEAN OwnerDefaulted
3700 );
3701
3702 NTSYSAPI
3703 NTSTATUS
3704 NTAPI
3705 RtlSetSaclSecurityDescriptor (
3706 IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
3707 IN BOOLEAN SaclPresent,
3708 IN PACL Sacl,
3709 IN BOOLEAN SaclDefaulted
3710 );
3711
3712 NTSYSAPI
3713 PUCHAR
3714 NTAPI
3715 RtlSubAuthorityCountSid (
3716 IN PSID Sid
3717 );
3718
3719 NTSYSAPI
3720 PULONG
3721 NTAPI
3722 RtlSubAuthoritySid (
3723 IN PSID Sid,
3724 IN ULONG SubAuthority
3725 );
3726
3727 NTSYSAPI
3728 BOOLEAN
3729 NTAPI
3730 RtlValidSid (
3731 IN PSID Sid
3732 );
3733
3734 NTKERNELAPI
3735 NTSTATUS
3736 NTAPI
3737 SeAppendPrivileges (
3738 PACCESS_STATE AccessState,
3739 PPRIVILEGE_SET Privileges
3740 );
3741
3742 NTKERNELAPI
3743 BOOLEAN
3744 NTAPI
3745 SeAuditingFileEvents (
3746 IN BOOLEAN AccessGranted,
3747 IN PSECURITY_DESCRIPTOR SecurityDescriptor
3748 );
3749
3750 NTKERNELAPI
3751 BOOLEAN
3752 NTAPI
3753 SeAuditingFileOrGlobalEvents (
3754 IN BOOLEAN AccessGranted,
3755 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3756 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
3757 );
3758
3759 NTKERNELAPI
3760 VOID
3761 NTAPI
3762 SeCaptureSubjectContext (
3763 OUT PSECURITY_SUBJECT_CONTEXT SubjectContext
3764 );
3765
3766 NTKERNELAPI
3767 NTSTATUS
3768 NTAPI
3769 SeCreateClientSecurity (
3770 IN PETHREAD Thread,
3771 IN PSECURITY_QUALITY_OF_SERVICE QualityOfService,
3772 IN BOOLEAN RemoteClient,
3773 OUT PSECURITY_CLIENT_CONTEXT ClientContext
3774 );
3775
3776 #if (VER_PRODUCTBUILD >= 2195)
3777
3778 NTKERNELAPI
3779 NTSTATUS
3780 NTAPI
3781 SeCreateClientSecurityFromSubjectContext (
3782 IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
3783 IN PSECURITY_QUALITY_OF_SERVICE QualityOfService,
3784 IN BOOLEAN ServerIsRemote,
3785 OUT PSECURITY_CLIENT_CONTEXT ClientContext
3786 );
3787
3788 #endif /* (VER_PRODUCTBUILD >= 2195) */
3789
3790 #define SeDeleteClientSecurity(C) { \
3791 if (SeTokenType((C)->ClientToken) == TokenPrimary) { \
3792 PsDereferencePrimaryToken( (C)->ClientToken ); \
3793 } else { \
3794 PsDereferenceImpersonationToken( (C)->ClientToken ); \
3795 } \
3796 }
3797
3798 NTKERNELAPI
3799 VOID
3800 NTAPI
3801 SeDeleteObjectAuditAlarm (
3802 IN PVOID Object,
3803 IN HANDLE Handle
3804 );
3805
3806 #define SeEnableAccessToExports() SeExports = *(PSE_EXPORTS *)SeExports;
3807
3808 NTKERNELAPI
3809 VOID
3810 NTAPI
3811 SeFreePrivileges (
3812 IN PPRIVILEGE_SET Privileges
3813 );
3814
3815 NTKERNELAPI
3816 VOID
3817 NTAPI
3818 SeImpersonateClient (
3819 IN PSECURITY_CLIENT_CONTEXT ClientContext,
3820 IN PETHREAD ServerThread OPTIONAL
3821 );
3822
3823 #if (VER_PRODUCTBUILD >= 2195)
3824
3825 NTKERNELAPI
3826 NTSTATUS
3827 NTAPI
3828 SeImpersonateClientEx (
3829 IN PSECURITY_CLIENT_CONTEXT ClientContext,
3830 IN PETHREAD ServerThread OPTIONAL
3831 );
3832
3833 #endif /* (VER_PRODUCTBUILD >= 2195) */
3834
3835 NTKERNELAPI
3836 VOID
3837 NTAPI
3838 SeLockSubjectContext (
3839 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
3840 );
3841
3842 NTKERNELAPI
3843 NTSTATUS
3844 NTAPI
3845 SeMarkLogonSessionForTerminationNotification (
3846 IN PLUID LogonId
3847 );
3848
3849 NTKERNELAPI
3850 VOID
3851 NTAPI
3852 SeOpenObjectAuditAlarm (
3853 IN PUNICODE_STRING ObjectTypeName,
3854 IN PVOID Object OPTIONAL,
3855 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
3856 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3857 IN PACCESS_STATE AccessState,
3858 IN BOOLEAN ObjectCreated,
3859 IN BOOLEAN AccessGranted,
3860 IN KPROCESSOR_MODE AccessMode,
3861 OUT PBOOLEAN GenerateOnClose
3862 );
3863
3864 NTKERNELAPI
3865 VOID
3866 NTAPI
3867 SeOpenObjectForDeleteAuditAlarm (
3868 IN PUNICODE_STRING ObjectTypeName,
3869 IN PVOID Object OPTIONAL,
3870 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
3871 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3872 IN PACCESS_STATE AccessState,
3873 IN BOOLEAN ObjectCreated,
3874 IN BOOLEAN AccessGranted,
3875 IN KPROCESSOR_MODE AccessMode,
3876 OUT PBOOLEAN GenerateOnClose
3877 );
3878
3879 NTKERNELAPI
3880 BOOLEAN
3881 NTAPI
3882 SePrivilegeCheck (
3883 IN OUT PPRIVILEGE_SET RequiredPrivileges,
3884 IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
3885 IN KPROCESSOR_MODE AccessMode
3886 );
3887
3888 NTKERNELAPI
3889 NTSTATUS
3890 NTAPI
3891 SeQueryAuthenticationIdToken (
3892 IN PACCESS_TOKEN Token,
3893 OUT PLUID LogonId
3894 );
3895
3896 #if (VER_PRODUCTBUILD >= 2195)
3897
3898 NTKERNELAPI
3899 NTSTATUS
3900 NTAPI
3901 SeQueryInformationToken (
3902 IN PACCESS_TOKEN Token,
3903 IN TOKEN_INFORMATION_CLASS TokenInformationClass,
3904 OUT PVOID *TokenInformation
3905 );
3906
3907 #endif /* (VER_PRODUCTBUILD >= 2195) */
3908
3909 NTKERNELAPI
3910 NTSTATUS
3911 NTAPI
3912 SeQuerySecurityDescriptorInfo (
3913 IN PSECURITY_INFORMATION SecurityInformation,
3914 OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
3915 IN OUT PULONG Length,
3916 IN PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor
3917 );
3918
3919 #if (VER_PRODUCTBUILD >= 2195)
3920
3921 NTKERNELAPI
3922 NTSTATUS
3923 NTAPI
3924 SeQuerySessionIdToken (
3925 IN PACCESS_TOKEN Token,
3926 IN PULONG SessionId
3927 );
3928
3929 #endif /* (VER_PRODUCTBUILD >= 2195) */
3930
3931 #define SeQuerySubjectContextToken( SubjectContext ) \
3932 ( ARGUMENT_PRESENT( \
3933 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken \
3934 ) ? \
3935 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken : \
3936 ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
3937
3938 typedef NTSTATUS (*PSE_LOGON_SESSION_TERMINATED_ROUTINE) (
3939 IN PLUID LogonId
3940 );
3941
3942 NTKERNELAPI
3943 NTSTATUS
3944 NTAPI
3945 SeRegisterLogonSessionTerminatedRoutine (
3946 IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
3947 );
3948
3949 NTKERNELAPI
3950 VOID
3951 NTAPI
3952 SeReleaseSubjectContext (
3953 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
3954 );
3955
3956 NTKERNELAPI
3957 VOID
3958 NTAPI
3959 SeSetAccessStateGenericMapping (
3960 PACCESS_STATE AccessState,
3961 PGENERIC_MAPPING GenericMapping
3962 );
3963
3964 NTKERNELAPI
3965 NTSTATUS
3966 NTAPI
3967 SeSetSecurityDescriptorInfo (
3968 IN PVOID Object OPTIONAL,
3969 IN PSECURITY_INFORMATION SecurityInformation,
3970 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3971 IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
3972 IN POOL_TYPE PoolType,
3973 IN PGENERIC_MAPPING GenericMapping
3974 );
3975
3976 #if (VER_PRODUCTBUILD >= 2195)
3977
3978 NTKERNELAPI
3979 NTSTATUS
3980 NTAPI
3981 SeSetSecurityDescriptorInfoEx (
3982 IN PVOID Object OPTIONAL,
3983 IN PSECURITY_INFORMATION SecurityInformation,
3984 IN PSECURITY_DESCRIPTOR ModificationDescriptor,
3985 IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
3986 IN ULONG AutoInheritFlags,
3987 IN POOL_TYPE PoolType,
3988 IN PGENERIC_MAPPING GenericMapping
3989 );
3990
3991 NTKERNELAPI
3992 BOOLEAN
3993 NTAPI
3994 SeTokenIsAdmin (
3995 IN PACCESS_TOKEN Token
3996 );
3997
3998 NTKERNELAPI
3999 BOOLEAN
4000 NTAPI
4001 SeTokenIsRestricted (
4002 IN PACCESS_TOKEN Token
4003 );
4004
4005 #endif /* (VER_PRODUCTBUILD >= 2195) */
4006
4007 NTKERNELAPI
4008 TOKEN_TYPE
4009 NTAPI
4010 SeTokenType (
4011 IN PACCESS_TOKEN Token
4012 );
4013
4014 NTKERNELAPI
4015 VOID
4016 NTAPI
4017 SeUnlockSubjectContext (
4018 IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4019 );
4020
4021 NTKERNELAPI
4022 NTSTATUS
4023 NTAPI
4024 SeUnregisterLogonSessionTerminatedRoutine (
4025 IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
4026 );
4027
4028 #if (VER_PRODUCTBUILD >= 2195)
4029
4030 NTSYSAPI
4031 NTSTATUS
4032 NTAPI
4033 ZwAdjustPrivilegesToken (
4034 IN HANDLE TokenHandle,
4035 IN BOOLEAN DisableAllPrivileges,
4036 IN PTOKEN_PRIVILEGES NewState,
4037 IN ULONG BufferLength,
4038 OUT PTOKEN_PRIVILEGES PreviousState OPTIONAL,
4039 OUT PULONG ReturnLength
4040 );
4041
4042 #endif /* (VER_PRODUCTBUILD >= 2195) */
4043
4044 NTSYSAPI
4045 NTSTATUS
4046 NTAPI
4047 ZwAlertThread (
4048 IN HANDLE ThreadHandle
4049 );
4050
4051 NTSYSAPI
4052 NTSTATUS
4053 NTAPI
4054 ZwAllocateVirtualMemory (
4055 IN HANDLE ProcessHandle,
4056 IN OUT PVOID *BaseAddress,
4057 IN ULONG ZeroBits,
4058 IN OUT PULONG RegionSize,
4059 IN ULONG AllocationType,
4060 IN ULONG Protect
4061 );
4062
4063 NTSYSAPI
4064 NTSTATUS
4065 NTAPI
4066 ZwAccessCheckAndAuditAlarm (
4067 IN PUNICODE_STRING SubsystemName,
4068 IN PVOID HandleId,
4069 IN PUNICODE_STRING ObjectTypeName,
4070 IN PUNICODE_STRING ObjectName,
4071 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
4072 IN ACCESS_MASK DesiredAccess,
4073 IN PGENERIC_MAPPING GenericMapping,
4074 IN BOOLEAN ObjectCreation,
4075 OUT PACCESS_MASK GrantedAccess,
4076 OUT PBOOLEAN AccessStatus,
4077 OUT PBOOLEAN GenerateOnClose
4078 );
4079
4080 #if (VER_PRODUCTBUILD >= 2195)
4081
4082 NTSYSAPI
4083 NTSTATUS
4084 NTAPI
4085 ZwCancelIoFile (
4086 IN HANDLE FileHandle,
4087 OUT PIO_STATUS_BLOCK IoStatusBlock
4088 );
4089
4090 #endif /* (VER_PRODUCTBUILD >= 2195) */
4091
4092 NTSYSAPI
4093 NTSTATUS
4094 NTAPI
4095 ZwClearEvent (
4096 IN HANDLE EventHandle
4097 );
4098
4099 NTSYSAPI
4100 NTSTATUS
4101 NTAPI
4102 ZwCloseObjectAuditAlarm (
4103 IN PUNICODE_STRING SubsystemName,
4104 IN PVOID HandleId,
4105 IN BOOLEAN GenerateOnClose
4106 );
4107
4108 NTSYSAPI
4109 NTSTATUS
4110 NTAPI
4111 ZwCreateSection (
4112 OUT PHANDLE SectionHandle,
4113 IN ACCESS_MASK DesiredAccess,
4114 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
4115 IN PLARGE_INTEGER MaximumSize OPTIONAL,
4116 IN ULONG SectionPageProtection,
4117 IN ULONG AllocationAttributes,
4118 IN HANDLE FileHandle OPTIONAL
4119 );
4120
4121 NTSYSAPI
4122 NTSTATUS
4123 NTAPI
4124 ZwCreateSymbolicLinkObject (
4125 OUT PHANDLE SymbolicLinkHandle,
4126 IN ACCESS_MASK DesiredAccess,
4127 IN POBJECT_ATTRIBUTES ObjectAttributes,
4128 IN PUNICODE_STRING TargetName
4129 );
4130
4131 NTSYSAPI
4132 NTSTATUS
4133 NTAPI
4134 ZwDeleteFile (
4135 IN POBJECT_ATTRIBUTES ObjectAttributes
4136 );
4137
4138 NTSYSAPI
4139 NTSTATUS
4140 NTAPI
4141 ZwDeleteValueKey (
4142 IN HANDLE Handle,
4143 IN PUNICODE_STRING Name
4144 );
4145
4146 NTSYSAPI
4147 NTSTATUS
4148 NTAPI
4149 ZwDeviceIoControlFile (
4150 IN HANDLE FileHandle,
4151 IN HANDLE Event OPTIONAL,
4152 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4153 IN PVOID ApcContext OPTIONAL,
4154 OUT PIO_STATUS_BLOCK IoStatusBlock,
4155 IN ULONG IoControlCode,
4156 IN PVOID InputBuffer OPTIONAL,
4157 IN ULONG InputBufferLength,
4158 OUT PVOID OutputBuffer OPTIONAL,
4159 IN ULONG OutputBufferLength
4160 );
4161
4162 NTSYSAPI
4163 NTSTATUS
4164 NTAPI
4165 ZwDisplayString (
4166 IN PUNICODE_STRING String
4167 );
4168
4169 NTSYSAPI
4170 NTSTATUS
4171 NTAPI
4172 ZwDuplicateObject (
4173 IN HANDLE SourceProcessHandle,
4174 IN HANDLE SourceHandle,
4175 IN HANDLE TargetProcessHandle OPTIONAL,
4176 OUT PHANDLE TargetHandle OPTIONAL,
4177 IN ACCESS_MASK DesiredAccess,
4178 IN ULONG HandleAttributes,
4179 IN ULONG Options
4180 );
4181
4182 NTSYSAPI
4183 NTSTATUS
4184 NTAPI
4185 ZwDuplicateToken (
4186 IN HANDLE ExistingTokenHandle,
4187 IN ACCESS_MASK DesiredAccess,
4188 IN POBJECT_ATTRIBUTES ObjectAttributes,
4189 IN BOOLEAN EffectiveOnly,
4190 IN TOKEN_TYPE TokenType,
4191 OUT PHANDLE NewTokenHandle
4192 );
4193
4194 NTSYSAPI
4195 NTSTATUS
4196 NTAPI
4197 ZwFlushInstructionCache (
4198 IN HANDLE ProcessHandle,
4199 IN PVOID BaseAddress OPTIONAL,
4200 IN ULONG FlushSize
4201 );
4202
4203 #if (VER_PRODUCTBUILD >= 2195)
4204
4205 NTSYSAPI
4206 NTSTATUS
4207 NTAPI
4208 ZwFlushVirtualMemory (
4209 IN HANDLE ProcessHandle,
4210 IN OUT PVOID *BaseAddress,
4211 IN OUT PULONG FlushSize,
4212 OUT PIO_STATUS_BLOCK IoStatusBlock
4213 );
4214
4215 #endif /* (VER_PRODUCTBUILD >= 2195) */
4216
4217 NTSYSAPI
4218 NTSTATUS
4219 NTAPI
4220 ZwFreeVirtualMemory (
4221 IN HANDLE ProcessHandle,
4222 IN OUT PVOID *BaseAddress,
4223 IN OUT PULONG RegionSize,
4224 IN ULONG FreeType
4225 );
4226
4227 NTSYSAPI
4228 NTSTATUS
4229 NTAPI
4230 ZwFsControlFile (
4231 IN HANDLE FileHandle,
4232 IN HANDLE Event OPTIONAL,
4233 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4234 IN PVOID ApcContext OPTIONAL,
4235 OUT PIO_STATUS_BLOCK IoStatusBlock,
4236 IN ULONG FsControlCode,
4237 IN PVOID InputBuffer OPTIONAL,
4238 IN ULONG InputBufferLength,
4239 OUT PVOID OutputBuffer OPTIONAL,
4240 IN ULONG OutputBufferLength
4241 );
4242
4243 #if (VER_PRODUCTBUILD >= 2195)
4244
4245 NTSYSAPI
4246 NTSTATUS
4247 NTAPI
4248 ZwInitiatePowerAction (
4249 IN POWER_ACTION SystemAction,
4250 IN SYSTEM_POWER_STATE MinSystemState,
4251 IN ULONG Flags,
4252 IN BOOLEAN Asynchronous
4253 );
4254
4255 #endif /* (VER_PRODUCTBUILD >= 2195) */
4256
4257 NTSYSAPI
4258 NTSTATUS
4259 NTAPI
4260 ZwLoadDriver (
4261 /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
4262 IN PUNICODE_STRING RegistryPath
4263 );
4264
4265 NTSYSAPI
4266 NTSTATUS
4267 NTAPI
4268 ZwLoadKey (
4269 IN POBJECT_ATTRIBUTES KeyObjectAttributes,
4270 IN POBJECT_ATTRIBUTES FileObjectAttributes
4271 );
4272
4273 NTSYSAPI
4274 NTSTATUS
4275 NTAPI
4276 ZwNotifyChangeKey (
4277 IN HANDLE KeyHandle,
4278 IN HANDLE EventHandle OPTIONAL,
4279 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4280 IN PVOID ApcContext OPTIONAL,
4281 OUT PIO_STATUS_BLOCK IoStatusBlock,
4282 IN ULONG NotifyFilter,
4283 IN BOOLEAN WatchSubtree,
4284 IN PVOID Buffer,
4285 IN ULONG BufferLength,
4286 IN BOOLEAN Asynchronous
4287 );
4288
4289 NTSYSAPI
4290 NTSTATUS
4291 NTAPI
4292 ZwOpenDirectoryObject (
4293 OUT PHANDLE DirectoryHandle,
4294 IN ACCESS_MASK DesiredAccess,
4295 IN POBJECT_ATTRIBUTES ObjectAttributes
4296 );
4297
4298 NTSYSAPI
4299 NTSTATUS
4300 NTAPI
4301 ZwOpenEvent (
4302 OUT PHANDLE EventHandle,
4303 IN ACCESS_MASK DesiredAccess,
4304 IN POBJECT_ATTRIBUTES ObjectAttributes
4305 );
4306
4307 NTSYSAPI
4308 NTSTATUS
4309 NTAPI
4310 ZwOpenProcess (
4311 OUT PHANDLE ProcessHandle,
4312 IN ACCESS_MASK DesiredAccess,
4313 IN POBJECT_ATTRIBUTES ObjectAttributes,
4314 IN PCLIENT_ID ClientId OPTIONAL
4315 );
4316
4317 NTSYSAPI
4318 NTSTATUS
4319 NTAPI
4320 ZwOpenProcessToken (
4321 IN HANDLE ProcessHandle,
4322 IN ACCESS_MASK DesiredAccess,
4323 OUT PHANDLE TokenHandle
4324 );
4325
4326 NTSYSAPI
4327 NTSTATUS
4328 NTAPI
4329 ZwOpenThread (
4330 OUT PHANDLE ThreadHandle,
4331 IN ACCESS_MASK DesiredAccess,
4332 IN POBJECT_ATTRIBUTES ObjectAttributes,
4333 IN PCLIENT_ID ClientId
4334 );
4335
4336 NTSYSAPI
4337 NTSTATUS
4338 NTAPI
4339 ZwOpenThreadToken (
4340 IN HANDLE ThreadHandle,
4341 IN ACCESS_MASK DesiredAccess,
4342 IN BOOLEAN OpenAsSelf,
4343 OUT PHANDLE TokenHandle
4344 );
4345
4346 #if (VER_PRODUCTBUILD >= 2195)
4347
4348 NTSYSAPI
4349 NTSTATUS
4350 NTAPI
4351 ZwPowerInformation (
4352 IN POWER_INFORMATION_LEVEL PowerInformationLevel,
4353 IN PVOID InputBuffer OPTIONAL,
4354 IN ULONG InputBufferLength,
4355 OUT PVOID OutputBuffer OPTIONAL,
4356 IN ULONG OutputBufferLength
4357 );
4358
4359 #endif /* (VER_PRODUCTBUILD >= 2195) */
4360
4361 NTSYSAPI
4362 NTSTATUS
4363 NTAPI
4364 ZwPulseEvent (
4365 IN HANDLE EventHandle,
4366 OUT PLONG PreviousState OPTIONAL
4367 );
4368
4369 NTSYSAPI
4370 NTSTATUS
4371 NTAPI
4372 ZwQueryDefaultLocale (
4373 IN BOOLEAN ThreadOrSystem,
4374 OUT PLCID Locale
4375 );
4376
4377 NTSYSAPI
4378 NTSTATUS
4379 NTAPI
4380 ZwQueryDirectoryFile (
4381 IN HANDLE FileHandle,
4382 IN HANDLE Event OPTIONAL,
4383 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4384 IN PVOID ApcContext OPTIONAL,
4385 OUT PIO_STATUS_BLOCK IoStatusBlock,
4386 OUT PVOID FileInformation,
4387 IN ULONG Length,
4388 IN FILE_INFORMATION_CLASS FileInformationClass,
4389 IN BOOLEAN ReturnSingleEntry,
4390 IN PUNICODE_STRING FileName OPTIONAL,
4391 IN BOOLEAN RestartScan
4392 );
4393
4394 #if (VER_PRODUCTBUILD >= 2195)
4395
4396 NTSYSAPI
4397 NTSTATUS
4398 NTAPI
4399 ZwQueryDirectoryObject (
4400 IN HANDLE DirectoryHandle,
4401 OUT PVOID Buffer,
4402 IN ULONG Length,
4403 IN BOOLEAN ReturnSingleEntry,
4404 IN BOOLEAN RestartScan,
4405 IN OUT PULONG Context,
4406 OUT PULONG ReturnLength OPTIONAL
4407 );
4408
4409 NTSYSAPI
4410 NTSTATUS
4411 NTAPI
4412 ZwQueryEaFile (
4413 IN HANDLE FileHandle,
4414 OUT PIO_STATUS_BLOCK IoStatusBlock,
4415 OUT PVOID Buffer,
4416 IN ULONG Length,
4417 IN BOOLEAN ReturnSingleEntry,
4418 IN PVOID EaList OPTIONAL,
4419 IN ULONG EaListLength,
4420 IN PULONG EaIndex OPTIONAL,
4421 IN BOOLEAN RestartScan
4422 );
4423
4424 #endif /* (VER_PRODUCTBUILD >= 2195) */
4425
4426 NTSYSAPI
4427 NTSTATUS
4428 NTAPI
4429 ZwQueryInformationProcess (
4430 IN HANDLE ProcessHandle,
4431 IN PROCESSINFOCLASS ProcessInformationClass,
4432 OUT PVOID ProcessInformation,
4433 IN ULONG ProcessInformationLength,
4434 OUT PULONG ReturnLength OPTIONAL
4435 );
4436
4437 NTSYSAPI
4438 NTSTATUS
4439 NTAPI
4440 ZwQueryInformationToken (
4441 IN HANDLE TokenHandle,
4442 IN TOKEN_INFORMATION_CLASS TokenInformationClass,
4443 OUT PVOID TokenInformation,
4444 IN ULONG Length,
4445 OUT PULONG ResultLength
4446 );
4447
4448 NTSYSAPI
4449 NTSTATUS
4450 NTAPI
4451 ZwQuerySecurityObject (
4452 IN HANDLE FileHandle,
4453 IN SECURITY_INFORMATION SecurityInformation,
4454 OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
4455 IN ULONG Length,
4456 OUT PULONG ResultLength
4457 );
4458
4459 NTSYSAPI
4460 NTSTATUS
4461 NTAPI
4462 ZwQueryVolumeInformationFile (
4463 IN HANDLE FileHandle,
4464 OUT PIO_STATUS_BLOCK IoStatusBlock,
4465 OUT PVOID FsInformation,
4466 IN ULONG Length,
4467 IN FS_INFORMATION_CLASS FsInformationClass
4468 );
4469
4470 NTSYSAPI
4471 NTSTATUS
4472 NTAPI
4473 ZwReplaceKey (
4474 IN POBJECT_ATTRIBUTES NewFileObjectAttributes,
4475 IN HANDLE KeyHandle,
4476 IN POBJECT_ATTRIBUTES OldFileObjectAttributes
4477 );
4478
4479 NTSYSAPI
4480 NTSTATUS
4481 NTAPI
4482 ZwResetEvent (
4483 IN HANDLE EventHandle,
4484 OUT PLONG PreviousState OPTIONAL
4485 );
4486
4487 #if (VER_PRODUCTBUILD >= 2195)
4488
4489 NTSYSAPI
4490 NTSTATUS
4491 NTAPI
4492 ZwRestoreKey (
4493 IN HANDLE KeyHandle,
4494 IN HANDLE FileHandle,
4495 IN ULONG Flags
4496 );
4497
4498 #endif /* (VER_PRODUCTBUILD >= 2195) */
4499
4500 NTSYSAPI
4501 NTSTATUS
4502 NTAPI
4503 ZwSaveKey (
4504 IN HANDLE KeyHandle,
4505 IN HANDLE FileHandle
4506 );
4507
4508 NTSYSAPI
4509 NTSTATUS
4510 NTAPI
4511 ZwSetDefaultLocale (
4512 IN BOOLEAN ThreadOrSystem,
4513 IN LCID Locale
4514 );
4515
4516 #if (VER_PRODUCTBUILD >= 2195)
4517
4518 NTSYSAPI
4519 NTSTATUS
4520 NTAPI
4521 ZwSetDefaultUILanguage (
4522 IN LANGID LanguageId
4523 );
4524
4525 NTSYSAPI
4526 NTSTATUS
4527 NTAPI
4528 ZwSetEaFile (
4529 IN HANDLE FileHandle,
4530 OUT PIO_STATUS_BLOCK IoStatusBlock,
4531 OUT PVOID Buffer,
4532 IN ULONG Length
4533 );
4534
4535 #endif /* (VER_PRODUCTBUILD >= 2195) */
4536
4537 NTSYSAPI
4538 NTSTATUS
4539 NTAPI
4540 ZwSetEvent (
4541 IN HANDLE EventHandle,
4542 OUT PLONG PreviousState OPTIONAL
4543 );
4544
4545 NTSYSAPI
4546 NTSTATUS
4547 NTAPI
4548 ZwSetInformationProcess (
4549 IN HANDLE ProcessHandle,
4550 IN PROCESSINFOCLASS ProcessInformationClass,
4551 IN PVOID ProcessInformation,
4552 IN ULONG ProcessInformationLength
4553 );
4554
4555 #if (VER_PRODUCTBUILD >= 2195)
4556
4557 NTSYSAPI
4558 NTSTATUS
4559 NTAPI
4560 ZwSetSecurityObject (
4561 IN HANDLE Handle,
4562 IN SECURITY_INFORMATION SecurityInformation,
4563 IN PSECURITY_DESCRIPTOR SecurityDescriptor
4564 );
4565
4566 #endif /* (VER_PRODUCTBUILD >= 2195) */
4567
4568 NTSYSAPI
4569 NTSTATUS
4570 NTAPI
4571 ZwSetSystemTime (
4572 IN PLARGE_INTEGER NewTime,
4573 OUT PLARGE_INTEGER OldTime OPTIONAL
4574 );
4575
4576 #if (VER_PRODUCTBUILD >= 2195)
4577
4578 NTSYSAPI
4579 NTSTATUS
4580 NTAPI
4581 ZwSetVolumeInformationFile (
4582 IN HANDLE FileHandle,
4583 OUT PIO_STATUS_BLOCK IoStatusBlock,
4584 IN PVOID FsInformation,
4585 IN ULONG Length,
4586 IN FS_INFORMATION_CLASS FsInformationClass
4587 );
4588
4589 #endif /* (VER_PRODUCTBUILD >= 2195) */
4590
4591 NTSYSAPI
4592 NTSTATUS
4593 NTAPI
4594 ZwTerminateProcess (
4595 IN HANDLE ProcessHandle OPTIONAL,
4596 IN NTSTATUS ExitStatus
4597 );
4598
4599 NTSYSAPI
4600 NTSTATUS
4601 NTAPI
4602 ZwUnloadDriver (
4603 /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
4604 IN PUNICODE_STRING RegistryPath
4605 );
4606
4607 NTSYSAPI
4608 NTSTATUS
4609 NTAPI
4610 ZwUnloadKey (
4611 IN POBJECT_ATTRIBUTES KeyObjectAttributes
4612 );
4613
4614 NTSYSAPI
4615 NTSTATUS
4616 NTAPI
4617 ZwWaitForSingleObject (
4618 IN HANDLE Handle,