reactos/w32api/include/ddk/ntifs.h

   1 /*
   2  * ntifs.h
   3  *
   4  * Windows NT Filesystem Driver Developer Kit
   5  *
   6  * This file is part of the w32api package.
   7  *
   8  * Contributors:
   9  *   Created by Bo Brantén <bosse@acc.umu.se>
  10  *
  11  * THIS SOFTWARE IS NOT COPYRIGHTED
  12  *
  13  * This source code is offered for use in the public domain. You may
  14  * use, modify or distribute it freely.
  15  *
  16  * This code is distributed in the hope that it will be useful but
  17  * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
  18  * DISCLAIMED. This includes but is not limited to warranties of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  */
  22
  23 #ifndef _NTIFS_
  24 #define _NTIFS_
  25 #define _GNU_NTIFS_
  26
  27 #if __GNUC__ >= 3
  28 #pragma GCC system_header
  29 #endif
  30
  31 #include "ntddk.h"
  32 #include "ntapi.h"
  33
  34 #ifdef __cplusplus
  35 extern "C" {
  36 #endif
  37
  38 #pragma pack(push,4)
  39
  40 #define VER_PRODUCTBUILD 10000
  41
  42 #ifndef NTSYSAPI
  43 #define NTSYSAPI
  44 #endif
  45
  46 #ifndef NTKERNELAPI
  47 #define NTKERNELAPI DECLSPEC_IMPORT
  48 #endif
  49
  50 typedef struct _SE_EXPORTS                  *PSE_EXPORTS;
  51
  52 #ifdef _NTOSKRNL_
  53 extern PUCHAR                       FsRtlLegalAnsiCharacterArray;
  54 #else
  55 extern DECLSPEC_IMPORT PUCHAR       FsRtlLegalAnsiCharacterArray;
  56 #endif
  57 extern PSE_EXPORTS                  SeExports;
  58 extern PACL                         SePublicDefaultDacl;
  59 extern PACL                         SeSystemDefaultDacl;
  60
  61 extern KSPIN_LOCK                   IoStatisticsLock;
  62 extern ULONG                        IoReadOperationCount;
  63 extern ULONG                        IoWriteOperationCount;
  64 extern ULONG                        IoOtherOperationCount;
  65 extern LARGE_INTEGER                IoReadTransferCount;
  66 extern LARGE_INTEGER                IoWriteTransferCount;
  67 extern LARGE_INTEGER                IoOtherTransferCount;
  68
  69 #define ANSI_DOS_STAR                   ('<')
  70 #define ANSI_DOS_QM                     ('>')
  71 #define ANSI_DOS_DOT                    ('"')
  72
  73 #define DOS_STAR                        (L'<')
  74 #define DOS_QM                          (L'>')
  75 #define DOS_DOT                         (L'"')
  76
  77 /* also in winnt.h */
  78 #define ACCESS_MIN_MS_ACE_TYPE                  (0x0)
  79 #define ACCESS_ALLOWED_ACE_TYPE                 (0x0)
  80 #define ACCESS_DENIED_ACE_TYPE                  (0x1)
  81 #define SYSTEM_AUDIT_ACE_TYPE                   (0x2)
  82 #define SYSTEM_ALARM_ACE_TYPE                   (0x3)
  83 #define ACCESS_MAX_MS_V2_ACE_TYPE               (0x3)
  84 #define ACCESS_ALLOWED_COMPOUND_ACE_TYPE        (0x4)
  85 #define ACCESS_MAX_MS_V3_ACE_TYPE               (0x4)
  86 #define ACCESS_MIN_MS_OBJECT_ACE_TYPE           (0x5)
  87 #define ACCESS_ALLOWED_OBJECT_ACE_TYPE          (0x5)
  88 #define ACCESS_DENIED_OBJECT_ACE_TYPE           (0x6)
  89 #define SYSTEM_AUDIT_OBJECT_ACE_TYPE            (0x7)
  90 #define SYSTEM_ALARM_OBJECT_ACE_TYPE            (0x8)
  91 #define ACCESS_MAX_MS_OBJECT_ACE_TYPE           (0x8)
  92 #define ACCESS_MAX_MS_V4_ACE_TYPE               (0x8)
  93 #define ACCESS_MAX_MS_ACE_TYPE                  (0x8)
  94 #define ACCESS_ALLOWED_CALLBACK_ACE_TYPE        (0x9)
  95 #define ACCESS_DENIED_CALLBACK_ACE_TYPE         (0xA)
  96 #define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE (0xB)
  97 #define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE  (0xC)
  98 #define SYSTEM_AUDIT_CALLBACK_ACE_TYPE          (0xD)
  99 #define SYSTEM_ALARM_CALLBACK_ACE_TYPE          (0xE)
 100 #define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE   (0xF)
 101 #define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE   (0x10)
 102 #define ACCESS_MAX_MS_V5_ACE_TYPE               (0x10)
 103
 104 #define COMPRESSION_FORMAT_NONE         (0x0000)
 105 #define COMPRESSION_FORMAT_DEFAULT      (0x0001)
 106 #define COMPRESSION_FORMAT_LZNT1        (0x0002)
 107 #define COMPRESSION_ENGINE_STANDARD     (0x0000)
 108 #define COMPRESSION_ENGINE_MAXIMUM      (0x0100)
 109 #define COMPRESSION_ENGINE_HIBER        (0x0200)
 110
 111 #define FILE_ACTION_ADDED                   0x00000001
 112 #define FILE_ACTION_REMOVED                 0x00000002
 113 #define FILE_ACTION_MODIFIED                0x00000003
 114 #define FILE_ACTION_RENAMED_OLD_NAME        0x00000004
 115 #define FILE_ACTION_RENAMED_NEW_NAME        0x00000005
 116 #define FILE_ACTION_ADDED_STREAM            0x00000006
 117 #define FILE_ACTION_REMOVED_STREAM          0x00000007
 118 #define FILE_ACTION_MODIFIED_STREAM         0x00000008
 119 #define FILE_ACTION_REMOVED_BY_DELETE       0x00000009
 120 #define FILE_ACTION_ID_NOT_TUNNELLED        0x0000000A
 121 #define FILE_ACTION_TUNNELLED_ID_COLLISION  0x0000000B
 122 /* end  winnt.h */
 123
 124 #define FILE_EA_TYPE_BINARY             0xfffe
 125 #define FILE_EA_TYPE_ASCII              0xfffd
 126 #define FILE_EA_TYPE_BITMAP             0xfffb
 127 #define FILE_EA_TYPE_METAFILE           0xfffa
 128 #define FILE_EA_TYPE_ICON               0xfff9
 129 #define FILE_EA_TYPE_EA                 0xffee
 130 #define FILE_EA_TYPE_MVMT               0xffdf
 131 #define FILE_EA_TYPE_MVST               0xffde
 132 #define FILE_EA_TYPE_ASN1               0xffdd
 133 #define FILE_EA_TYPE_FAMILY_IDS         0xff01
 134
 135 #define FILE_NEED_EA                    0x00000080
 136
 137 /* also in winnt.h */
 138 #define FILE_NOTIFY_CHANGE_FILE_NAME    0x00000001
 139 #define FILE_NOTIFY_CHANGE_DIR_NAME     0x00000002
 140 #define FILE_NOTIFY_CHANGE_NAME         0x00000003
 141 #define FILE_NOTIFY_CHANGE_ATTRIBUTES   0x00000004
 142 #define FILE_NOTIFY_CHANGE_SIZE         0x00000008
 143 #define FILE_NOTIFY_CHANGE_LAST_WRITE   0x00000010
 144 #define FILE_NOTIFY_CHANGE_LAST_ACCESS  0x00000020
 145 #define FILE_NOTIFY_CHANGE_CREATION     0x00000040
 146 #define FILE_NOTIFY_CHANGE_EA           0x00000080
 147 #define FILE_NOTIFY_CHANGE_SECURITY     0x00000100
 148 #define FILE_NOTIFY_CHANGE_STREAM_NAME  0x00000200
 149 #define FILE_NOTIFY_CHANGE_STREAM_SIZE  0x00000400
 150 #define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
 151 #define FILE_NOTIFY_VALID_MASK          0x00000fff
 152 /* end winnt.h */
 153
 154 #define FILE_OPLOCK_BROKEN_TO_LEVEL_2   0x00000007
 155 #define FILE_OPLOCK_BROKEN_TO_NONE      0x00000008
 156
 157 #define FILE_OPBATCH_BREAK_UNDERWAY     0x00000009
 158
 159 #define FILE_CASE_SENSITIVE_SEARCH      0x00000001
 160 #define FILE_CASE_PRESERVED_NAMES       0x00000002
 161 #define FILE_UNICODE_ON_DISK            0x00000004
 162 #define FILE_PERSISTENT_ACLS            0x00000008
 163 #define FILE_FILE_COMPRESSION           0x00000010
 164 #define FILE_VOLUME_QUOTAS              0x00000020
 165 #define FILE_SUPPORTS_SPARSE_FILES      0x00000040
 166 #define FILE_SUPPORTS_REPARSE_POINTS    0x00000080
 167 #define FILE_SUPPORTS_REMOTE_STORAGE    0x00000100
 168 #define FS_LFN_APIS                     0x00004000
 169 #define FILE_VOLUME_IS_COMPRESSED       0x00008000
 170 #define FILE_SUPPORTS_OBJECT_IDS        0x00010000
 171 #define FILE_SUPPORTS_ENCRYPTION        0x00020000
 172 #define FILE_NAMED_STREAMS              0x00040000
 173
 174 #define FILE_PIPE_BYTE_STREAM_TYPE      0x00000000
 175 #define FILE_PIPE_MESSAGE_TYPE          0x00000001
 176
 177 #define FILE_PIPE_BYTE_STREAM_MODE      0x00000000
 178 #define FILE_PIPE_MESSAGE_MODE          0x00000001
 179
 180 #define FILE_PIPE_QUEUE_OPERATION       0x00000000
 181 #define FILE_PIPE_COMPLETE_OPERATION    0x00000001
 182
 183 #define FILE_PIPE_INBOUND               0x00000000
 184 #define FILE_PIPE_OUTBOUND              0x00000001
 185 #define FILE_PIPE_FULL_DUPLEX           0x00000002
 186
 187 #define FILE_PIPE_DISCONNECTED_STATE    0x00000001
 188 #define FILE_PIPE_LISTENING_STATE       0x00000002
 189 #define FILE_PIPE_CONNECTED_STATE       0x00000003
 190 #define FILE_PIPE_CLOSING_STATE         0x00000004
 191
 192 #define FILE_PIPE_CLIENT_END            0x00000000
 193 #define FILE_PIPE_SERVER_END            0x00000001
 194
 195 #define FILE_PIPE_READ_DATA             0x00000000
 196 #define FILE_PIPE_WRITE_SPACE           0x00000001
 197
 198 #define FILE_STORAGE_TYPE_SPECIFIED             0x00000041  /* FILE_DIRECTORY_FILE | FILE_NON_DIRECTORY_FILE */
 199 #define FILE_STORAGE_TYPE_DEFAULT               (StorageTypeDefault << FILE_STORAGE_TYPE_SHIFT)
 200 #define FILE_STORAGE_TYPE_DIRECTORY             (StorageTypeDirectory << FILE_STORAGE_TYPE_SHIFT)
 201 #define FILE_STORAGE_TYPE_FILE                  (StorageTypeFile << FILE_STORAGE_TYPE_SHIFT)
 202 #define FILE_STORAGE_TYPE_DOCFILE               (StorageTypeDocfile << FILE_STORAGE_TYPE_SHIFT)
 203 #define FILE_STORAGE_TYPE_JUNCTION_POINT        (StorageTypeJunctionPoint << FILE_STORAGE_TYPE_SHIFT)
 204 #define FILE_STORAGE_TYPE_CATALOG               (StorageTypeCatalog << FILE_STORAGE_TYPE_SHIFT)
 205 #define FILE_STORAGE_TYPE_STRUCTURED_STORAGE    (StorageTypeStructuredStorage << FILE_STORAGE_TYPE_SHIFT)
 206 #define FILE_STORAGE_TYPE_EMBEDDING             (StorageTypeEmbedding << FILE_STORAGE_TYPE_SHIFT)
 207 #define FILE_STORAGE_TYPE_STREAM                (StorageTypeStream << FILE_STORAGE_TYPE_SHIFT)
 208 #define FILE_MINIMUM_STORAGE_TYPE               FILE_STORAGE_TYPE_DEFAULT
 209 #define FILE_MAXIMUM_STORAGE_TYPE               FILE_STORAGE_TYPE_STREAM
 210 #define FILE_STORAGE_TYPE_MASK                  0x000f0000
 211 #define FILE_STORAGE_TYPE_SHIFT                 16
 212
 213 #define FILE_VC_QUOTA_NONE              0x00000000
 214 #define FILE_VC_QUOTA_TRACK             0x00000001
 215 #define FILE_VC_QUOTA_ENFORCE           0x00000002
 216 #define FILE_VC_QUOTA_MASK              0x00000003
 217
 218 #define FILE_VC_QUOTAS_LOG_VIOLATIONS   0x00000004
 219 #define FILE_VC_CONTENT_INDEX_DISABLED  0x00000008
 220
 221 #define FILE_VC_LOG_QUOTA_THRESHOLD     0x00000010
 222 #define FILE_VC_LOG_QUOTA_LIMIT         0x00000020
 223 #define FILE_VC_LOG_VOLUME_THRESHOLD    0x00000040
 224 #define FILE_VC_LOG_VOLUME_LIMIT        0x00000080
 225
 226 #define FILE_VC_QUOTAS_INCOMPLETE       0x00000100
 227 #define FILE_VC_QUOTAS_REBUILDING       0x00000200
 228
 229 #define FILE_VC_VALID_MASK              0x000003ff
 230
 231 #define FSRTL_FLAG_FILE_MODIFIED        (0x01)
 232 #define FSRTL_FLAG_FILE_LENGTH_CHANGED  (0x02)
 233 #define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04)
 234 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08)
 235 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10)
 236 #define FSRTL_FLAG_USER_MAPPED_FILE     (0x20)
 237 #define FSRTL_FLAG_EOF_ADVANCE_ACTIVE   (0x80)
 238
 239 #define FSRTL_FLAG2_DO_MODIFIED_WRITE   (0x01)
 240
 241 #define FSRTL_FSP_TOP_LEVEL_IRP         (0x01)
 242 #define FSRTL_CACHE_TOP_LEVEL_IRP       (0x02)
 243 #define FSRTL_MOD_WRITE_TOP_LEVEL_IRP   (0x03)
 244 #define FSRTL_FAST_IO_TOP_LEVEL_IRP     (0x04)
 245 #define FSRTL_MAX_TOP_LEVEL_IRP_FLAG    (0x04)
 246
 247 #define FSRTL_VOLUME_DISMOUNT           1
 248 #define FSRTL_VOLUME_DISMOUNT_FAILED    2
 249 #define FSRTL_VOLUME_LOCK               3
 250 #define FSRTL_VOLUME_LOCK_FAILED        4
 251 #define FSRTL_VOLUME_UNLOCK             5
 252 #define FSRTL_VOLUME_MOUNT              6
 253
 254 #define FSRTL_WILD_CHARACTER            0x08
 255
 256 #define FSRTL_FAT_LEGAL                 0x01
 257 #define FSRTL_HPFS_LEGAL                0x02
 258 #define FSRTL_NTFS_LEGAL                0x04
 259 #define FSRTL_WILD_CHARACTER            0x08
 260 #define FSRTL_OLE_LEGAL                 0x10
 261 #define FSRTL_NTFS_STREAM_LEGAL         0x14
 262
 263 #ifdef _X86_
 264 #define HARDWARE_PTE    HARDWARE_PTE_X86
 265 #define PHARDWARE_PTE   PHARDWARE_PTE_X86
 266 #else
 267 #define HARDWARE_PTE    ULONG
 268 #define PHARDWARE_PTE   PULONG
 269 #endif
 270
 271 #define IO_CHECK_CREATE_PARAMETERS      0x0200
 272 #define IO_ATTACH_DEVICE                0x0400
 273
 274 #define IO_ATTACH_DEVICE_API            0x80000000
 275 /* also in winnt.h */
 276 #define IO_COMPLETION_QUERY_STATE       0x0001
 277 #define IO_COMPLETION_MODIFY_STATE      0x0002
 278 #define IO_COMPLETION_ALL_ACCESS        (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3)
 279 /* end winnt.h */
 280 #define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE    64
 281 #define IO_FILE_OBJECT_PAGED_POOL_CHARGE        1024
 282
 283 #define IO_TYPE_APC                     18
 284 #define IO_TYPE_DPC                     19
 285 #define IO_TYPE_DEVICE_QUEUE            20
 286 #define IO_TYPE_EVENT_PAIR              21
 287 #define IO_TYPE_INTERRUPT               22
 288 #define IO_TYPE_PROFILE                 23
 289
 290 #define IRP_BEING_VERIFIED              0x10
 291
 292 #define MAILSLOT_CLASS_FIRSTCLASS       1
 293 #define MAILSLOT_CLASS_SECONDCLASS      2
 294
 295 #define MAILSLOT_SIZE_AUTO              0
 296
 297 #define MAP_PROCESS                     1L
 298 #define MAP_SYSTEM                      2L
 299 #define MEM_DOS_LIM                     0x40000000
 300 /* also in winnt.h */
 301 #define MEM_IMAGE                       SEC_IMAGE
 302 /* end winnt.h */
 303 #define OB_TYPE_TYPE                    1
 304 #define OB_TYPE_DIRECTORY               2
 305 #define OB_TYPE_SYMBOLIC_LINK           3
 306 #define OB_TYPE_TOKEN                   4
 307 #define OB_TYPE_PROCESS                 5
 308 #define OB_TYPE_THREAD                  6
 309 #define OB_TYPE_EVENT                   7
 310 #define OB_TYPE_EVENT_PAIR              8
 311 #define OB_TYPE_MUTANT                  9
 312 #define OB_TYPE_SEMAPHORE               10
 313 #define OB_TYPE_TIMER                   11
 314 #define OB_TYPE_PROFILE                 12
 315 #define OB_TYPE_WINDOW_STATION          13
 316 #define OB_TYPE_DESKTOP                 14
 317 #define OB_TYPE_SECTION                 15
 318 #define OB_TYPE_KEY                     16
 319 #define OB_TYPE_PORT                    17
 320 #define OB_TYPE_ADAPTER                 18
 321 #define OB_TYPE_CONTROLLER              19
 322 #define OB_TYPE_DEVICE                  20
 323 #define OB_TYPE_DRIVER                  21
 324 #define OB_TYPE_IO_COMPLETION           22
 325 #define OB_TYPE_FILE                    23
 326
 327 #define PIN_WAIT                        (1)
 328 #define PIN_EXCLUSIVE                   (2)
 329 #define PIN_NO_READ                     (4)
 330 #define PIN_IF_BCB                      (8)
 331
 332 #define PORT_CONNECT                    0x0001
 333 #define PORT_ALL_ACCESS                 (STANDARD_RIGHTS_ALL |\
 334                                          PORT_CONNECT)
 335 /* also in winnt.h */
 336 #define SEC_BASED       0x00200000
 337 #define SEC_NO_CHANGE   0x00400000
 338 #define SEC_FILE        0x00800000
 339 #define SEC_IMAGE       0x01000000
 340 #define SEC_VLM         0x02000000
 341 #define SEC_RESERVE     0x04000000
 342 #define SEC_COMMIT      0x08000000
 343 #define SEC_NOCACHE     0x10000000
 344
 345 #define SECURITY_WORLD_SID_AUTHORITY    {0,0,0,0,0,1}
 346 #define SECURITY_WORLD_RID              (0x00000000L)
 347
 348 #define SID_REVISION                    1
 349 #define SID_MAX_SUB_AUTHORITIES         15
 350 #define SID_RECOMMENDED_SUB_AUTHORITIES 1
 351
 352 #define TOKEN_ASSIGN_PRIMARY            (0x0001)
 353 #define TOKEN_DUPLICATE                 (0x0002)
 354 #define TOKEN_IMPERSONATE               (0x0004)
 355 #define TOKEN_QUERY                     (0x0008)
 356 #define TOKEN_QUERY_SOURCE              (0x0010)
 357 #define TOKEN_ADJUST_PRIVILEGES         (0x0020)
 358 #define TOKEN_ADJUST_GROUPS             (0x0040)
 359 #define TOKEN_ADJUST_DEFAULT            (0x0080)
 360 #define TOKEN_ADJUST_SESSIONID          (0x0100)
 361
 362 #define TOKEN_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED |\
 363                           TOKEN_ASSIGN_PRIMARY     |\
 364                           TOKEN_DUPLICATE          |\
 365                           TOKEN_IMPERSONATE        |\
 366                           TOKEN_QUERY              |\
 367                           TOKEN_QUERY_SOURCE       |\
 368                           TOKEN_ADJUST_PRIVILEGES  |\
 369                           TOKEN_ADJUST_GROUPS      |\
 370                           TOKEN_ADJUST_DEFAULT     |\
 371                           TOKEN_ADJUST_SESSIONID)
 372
 373 #define TOKEN_READ       (STANDARD_RIGHTS_READ     |\
 374                           TOKEN_QUERY)
 375
 376 #define TOKEN_WRITE      (STANDARD_RIGHTS_WRITE    |\
 377                           TOKEN_ADJUST_PRIVILEGES  |\
 378                           TOKEN_ADJUST_GROUPS      |\
 379                           TOKEN_ADJUST_DEFAULT)
 380
 381 #define TOKEN_EXECUTE    (STANDARD_RIGHTS_EXECUTE)
 382
 383 #define TOKEN_SOURCE_LENGTH 8
 384 /* end winnt.h */
 385
 386 #define TOKEN_HAS_TRAVERSE_PRIVILEGE    0x01
 387 #define TOKEN_HAS_BACKUP_PRIVILEGE      0x02
 388 #define TOKEN_HAS_RESTORE_PRIVILEGE     0x04
 389 #define TOKEN_HAS_ADMIN_GROUP           0x08
 390 #define TOKEN_IS_RESTRICTED             0x10
 391
 392 #define VACB_MAPPING_GRANULARITY        (0x40000)
 393 #define VACB_OFFSET_SHIFT               (18)
 394
 395 #define SE_OWNER_DEFAULTED              0x0001
 396 #define SE_GROUP_DEFAULTED              0x0002
 397 #define SE_DACL_PRESENT                 0x0004
 398 #define SE_DACL_DEFAULTED               0x0008
 399 #define SE_SACL_PRESENT                 0x0010
 400 #define SE_SACL_DEFAULTED               0x0020
 401 #define SE_DACL_UNTRUSTED               0x0040
 402 #define SE_SERVER_SECURITY              0x0080
 403 #define SE_DACL_AUTO_INHERIT_REQ        0x0100
 404 #define SE_SACL_AUTO_INHERIT_REQ        0x0200
 405 #define SE_DACL_AUTO_INHERITED          0x0400
 406 #define SE_SACL_AUTO_INHERITED          0x0800
 407 #define SE_DACL_PROTECTED               0x1000
 408 #define SE_SACL_PROTECTED               0x2000
 409 #define SE_RM_CONTROL_VALID             0x4000
 410 #define SE_SELF_RELATIVE                0x8000
 411
 412 #define FSCTL_REQUEST_OPLOCK_LEVEL_1    CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  0, METHOD_BUFFERED, FILE_ANY_ACCESS)
 413 #define FSCTL_REQUEST_OPLOCK_LEVEL_2    CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  1, METHOD_BUFFERED, FILE_ANY_ACCESS)
 414 #define FSCTL_REQUEST_BATCH_OPLOCK      CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  2, METHOD_BUFFERED, FILE_ANY_ACCESS)
 415 #define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE  CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  3, METHOD_BUFFERED, FILE_ANY_ACCESS)
 416 #define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  4, METHOD_BUFFERED, FILE_ANY_ACCESS)
 417 #define FSCTL_OPLOCK_BREAK_NOTIFY       CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  5, METHOD_BUFFERED, FILE_ANY_ACCESS)
 418 #define FSCTL_LOCK_VOLUME               CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  6, METHOD_BUFFERED, FILE_ANY_ACCESS)
 419 #define FSCTL_UNLOCK_VOLUME             CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  7, METHOD_BUFFERED, FILE_ANY_ACCESS)
 420 #define FSCTL_DISMOUNT_VOLUME           CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  8, METHOD_BUFFERED, FILE_ANY_ACCESS)
 421
 422 #define FSCTL_IS_VOLUME_MOUNTED         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
 423 #define FSCTL_IS_PATHNAME_VALID         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
 424 #define FSCTL_MARK_VOLUME_DIRTY         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
 425
 426 #define FSCTL_QUERY_RETRIEVAL_POINTERS  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14,  METHOD_NEITHER, FILE_ANY_ACCESS)
 427 #define FSCTL_GET_COMPRESSION           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
 428 #define FSCTL_SET_COMPRESSION           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
 429
 430
 431 #define FSCTL_MARK_AS_SYSTEM_HIVE       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19,  METHOD_NEITHER, FILE_ANY_ACCESS)
 432 #define FSCTL_OPLOCK_BREAK_ACK_NO_2     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
 433 #define FSCTL_INVALIDATE_VOLUMES        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
 434 #define FSCTL_QUERY_FAT_BPB             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS)
 435 #define FSCTL_REQUEST_FILTER_OPLOCK     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
 436 #define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS)
 437
 438 #if (VER_PRODUCTBUILD >= 1381)
 439
 440 #define FSCTL_GET_NTFS_VOLUME_DATA      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS)
 441 #define FSCTL_GET_NTFS_FILE_RECORD      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS)
 442 #define FSCTL_GET_VOLUME_BITMAP         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27,  METHOD_NEITHER, FILE_ANY_ACCESS)
 443 #define FSCTL_GET_RETRIEVAL_POINTERS    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28,  METHOD_NEITHER, FILE_ANY_ACCESS)
 444 #define FSCTL_MOVE_FILE                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_ANY_ACCESS)
 445 #define FSCTL_IS_VOLUME_DIRTY           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
 446 #define FSCTL_GET_HFS_INFORMATION       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS)
 447 #define FSCTL_ALLOW_EXTENDED_DASD_IO    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER,  FILE_ANY_ACCESS)
 448
 449 #endif /* (VER_PRODUCTBUILD >= 1381) */
 450
 451 #if (VER_PRODUCTBUILD >= 2195)
 452
 453 #define FSCTL_READ_PROPERTY_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 33, METHOD_NEITHER, FILE_ANY_ACCESS)
 454 #define FSCTL_WRITE_PROPERTY_DATA       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 34, METHOD_NEITHER, FILE_ANY_ACCESS)
 455 #define FSCTL_FIND_FILES_BY_SID         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS)
 456
 457 #define FSCTL_DUMP_PROPERTY_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 37,  METHOD_NEITHER, FILE_ANY_ACCESS)
 458 #define FSCTL_SET_OBJECT_ID             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_WRITE_DATA)
 459 #define FSCTL_GET_OBJECT_ID             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS)
 460 #define FSCTL_DELETE_OBJECT_ID          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_WRITE_DATA)
 461 #define FSCTL_SET_REPARSE_POINT         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_WRITE_DATA)
 462 #define FSCTL_GET_REPARSE_POINT         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS)
 463 #define FSCTL_DELETE_REPARSE_POINT      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_WRITE_DATA)
 464 #define FSCTL_ENUM_USN_DATA             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44,  METHOD_NEITHER, FILE_READ_DATA)
 465 #define FSCTL_SECURITY_ID_CHECK         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45,  METHOD_NEITHER, FILE_READ_DATA)
 466 #define FSCTL_READ_USN_JOURNAL          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46,  METHOD_NEITHER, FILE_READ_DATA)
 467 #define FSCTL_SET_OBJECT_ID_EXTENDED    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_WRITE_DATA)
 468 #define FSCTL_CREATE_OR_GET_OBJECT_ID   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS)
 469 #define FSCTL_SET_SPARSE                CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_WRITE_DATA)
 470 #define FSCTL_SET_ZERO_DATA             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA)
 471 #define FSCTL_QUERY_ALLOCATED_RANGES    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51,  METHOD_NEITHER, FILE_READ_DATA)
 472 #define FSCTL_ENABLE_UPGRADE            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA)
 473 #define FSCTL_SET_ENCRYPTION            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_BUFFERED, FILE_ANY_ACCESS)
 474 #define FSCTL_ENCRYPTION_FSCTL_IO       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54,  METHOD_NEITHER, FILE_ANY_ACCESS)
 475 #define FSCTL_WRITE_RAW_ENCRYPTED       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55,  METHOD_NEITHER, FILE_ANY_ACCESS)
 476 #define FSCTL_READ_RAW_ENCRYPTED        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56,  METHOD_NEITHER, FILE_ANY_ACCESS)
 477 #define FSCTL_CREATE_USN_JOURNAL        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57,  METHOD_NEITHER, FILE_READ_DATA)
 478 #define FSCTL_READ_FILE_USN_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58,  METHOD_NEITHER, FILE_READ_DATA)
 479 #define FSCTL_WRITE_USN_CLOSE_RECORD    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59,  METHOD_NEITHER, FILE_READ_DATA)
 480 #define FSCTL_EXTEND_VOLUME             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
 481 #define FSCTL_QUERY_USN_JOURNAL         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
 482 #define FSCTL_DELETE_USN_JOURNAL        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
 483 #define FSCTL_MARK_HANDLE               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS)
 484 #define FSCTL_SIS_COPYFILE              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS)
 485 #define FSCTL_SIS_LINK_FILES            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
 486 #define FSCTL_HSM_MSG                   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
 487 #define FSCTL_NSS_CONTROL               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 67, METHOD_BUFFERED, FILE_WRITE_DATA)
 488 #define FSCTL_HSM_DATA                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
 489 #define FSCTL_RECALL_FILE               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS)
 490 #define FSCTL_NSS_RCONTROL              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 70, METHOD_BUFFERED, FILE_READ_DATA)
 491 #define FSCTL_READ_FROM_PLEX            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA)
 492 #define FSCTL_FILE_PREFETCH             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
 493
 494 #endif /* (VER_PRODUCTBUILD >= 2195) */
 495
 496 #define FSCTL_MAILSLOT_PEEK             CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)
 497
 498 #define FSCTL_NETWORK_SET_CONFIGURATION_INFO    CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 102, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
 499 #define FSCTL_NETWORK_GET_CONFIGURATION_INFO    CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 103, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
 500 #define FSCTL_NETWORK_GET_CONNECTION_INFO       CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 104, METHOD_NEITHER, FILE_ANY_ACCESS)
 501 #define FSCTL_NETWORK_ENUMERATE_CONNECTIONS     CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 105, METHOD_NEITHER, FILE_ANY_ACCESS)
 502 #define FSCTL_NETWORK_DELETE_CONNECTION         CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 107, METHOD_BUFFERED, FILE_ANY_ACCESS)
 503 #define FSCTL_NETWORK_GET_STATISTICS            CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 116, METHOD_BUFFERED, FILE_ANY_ACCESS)
 504 #define FSCTL_NETWORK_SET_DOMAIN_NAME           CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_ANY_ACCESS)
 505 #define FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT     CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_ANY_ACCESS)
 506
 507 #define FSCTL_PIPE_ASSIGN_EVENT         CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
 508 #define FSCTL_PIPE_DISCONNECT           CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
 509 #define FSCTL_PIPE_LISTEN               CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
 510 #define FSCTL_PIPE_PEEK                 CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
 511 #define FSCTL_PIPE_QUERY_EVENT          CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
 512 #define FSCTL_PIPE_TRANSCEIVE           CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER,  FILE_READ_DATA | FILE_WRITE_DATA)
 513 #define FSCTL_PIPE_WAIT                 CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
 514 #define FSCTL_PIPE_IMPERSONATE          CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
 515 #define FSCTL_PIPE_SET_CLIENT_PROCESS   CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
 516 #define FSCTL_PIPE_QUERY_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
 517 #define FSCTL_PIPE_INTERNAL_READ        CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
 518 #define FSCTL_PIPE_INTERNAL_WRITE       CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
 519 #define FSCTL_PIPE_INTERNAL_TRANSCEIVE  CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
 520 #define FSCTL_PIPE_INTERNAL_READ_OVFLOW CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
 521
 522 #define IOCTL_REDIR_QUERY_PATH          CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
 523
 524 typedef PVOID OPLOCK, *POPLOCK;
 525
 526 typedef struct _CACHE_MANAGER_CALLBACKS         *PCACHE_MANAGER_CALLBACKS;
 527 typedef struct _EPROCESS_QUOTA_BLOCK            *PEPROCESS_QUOTA_BLOCK;
 528 typedef struct _FILE_GET_QUOTA_INFORMATION      *PFILE_GET_QUOTA_INFORMATION;
 529 typedef struct _HANDLE_TABLE                    *PHANDLE_TABLE;
 530 typedef struct _KPROCESS                        *PKPROCESS;
 531 typedef struct _KQUEUE                          *PKQUEUE;
 532 typedef struct _KTRAP_FRAME                     *PKTRAP_FRAME;
 533 typedef struct _MMWSL                           *PMMWSL;
 534 typedef struct _OBJECT_DIRECTORY                *POBJECT_DIRECTORY;
 535 typedef struct _PAGEFAULT_HISTORY               *PPAGEFAULT_HISTORY;
 536 typedef struct _PS_IMPERSONATION_INFORMATION    *PPS_IMPERSONATION_INFORMATION;
 537 typedef struct _SECTION_OBJECT                  *PSECTION_OBJECT;
 538 typedef struct _SHARED_CACHE_MAP                *PSHARED_CACHE_MAP;
 539 typedef struct _VACB                            *PVACB;
 540 typedef struct _VAD_HEADER                      *PVAD_HEADER;
 541
 542 typedef struct _NOTIFY_SYNC
 543 {
 544     ULONG Unknown0;
 545     ULONG Unknown1;
 546     ULONG Unknown2;
 547     USHORT Unknown3;
 548     USHORT Unknown4;
 549     ULONG Unknown5;
 550     ULONG Unknown6;
 551     ULONG Unknown7;
 552     ULONG Unknown8;
 553     ULONG Unknown9;
 554     ULONG Unknown10;
 555 } NOTIFY_SYNC, * PNOTIFY_SYNC;
 556
 557 typedef enum _FAST_IO_POSSIBLE {
 558     FastIoIsNotPossible,
 559     FastIoIsPossible,
 560     FastIoIsQuestionable
 561 } FAST_IO_POSSIBLE;
 562
 563 typedef enum _FILE_STORAGE_TYPE {
 564     StorageTypeDefault = 1,
 565     StorageTypeDirectory,
 566     StorageTypeFile,
 567     StorageTypeJunctionPoint,
 568     StorageTypeCatalog,
 569     StorageTypeStructuredStorage,
 570     StorageTypeEmbedding,
 571     StorageTypeStream
 572 } FILE_STORAGE_TYPE;
 573
 574 typedef enum _OBJECT_INFO_CLASS {
 575     ObjectBasicInfo,
 576     ObjectNameInfo,
 577     ObjectTypeInfo,
 578     ObjectAllTypesInfo,
 579     ObjectProtectionInfo
 580 } OBJECT_INFO_CLASS;
 581
 582 typedef struct _KAPC_STATE {
 583     LIST_ENTRY  ApcListHead[2];
 584     PKPROCESS   Process;
 585     BOOLEAN     KernelApcInProgress;
 586     BOOLEAN     KernelApcPending;
 587     BOOLEAN     UserApcPending;
 588 } KAPC_STATE, *PKAPC_STATE, *RESTRICTED_POINTER PRKAPC_STATE;
 589
 590 #if (VER_PRODUCTBUILD >= 2600)
 591
 592 typedef struct _MMSUPPORT_FLAGS {
 593     ULONG SessionSpace              : 1;
 594     ULONG BeingTrimmed              : 1;
 595     ULONG SessionLeader             : 1;
 596     ULONG TrimHard                  : 1;
 597     ULONG WorkingSetHard            : 1;
 598     ULONG AddressSpaceBeingDeleted  : 1;
 599     ULONG Available                 : 10;
 600     ULONG AllowWorkingSetAdjustment : 8;
 601     ULONG MemoryPriority            : 8;
 602 } MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS;
 603
 604 #else
 605
 606 typedef struct _MMSUPPORT_FLAGS {
 607     ULONG SessionSpace      : 1;
 608     ULONG BeingTrimmed      : 1;
 609     ULONG ProcessInSession  : 1;
 610     ULONG SessionLeader     : 1;
 611     ULONG TrimHard          : 1;
 612     ULONG WorkingSetHard    : 1;
 613     ULONG WriteWatch        : 1;
 614     ULONG Filler            : 25;
 615 } MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS;
 616
 617 #endif
 618
 619 #if (VER_PRODUCTBUILD >= 2600)
 620
 621 typedef struct _MMSUPPORT {
 622     LARGE_INTEGER   LastTrimTime;
 623     MMSUPPORT_FLAGS Flags;
 624     ULONG           PageFaultCount;
 625     ULONG           PeakWorkingSetSize;
 626     ULONG           WorkingSetSize;
 627     ULONG           MinimumWorkingSetSize;
 628     ULONG           MaximumWorkingSetSize;
 629     PMMWSL          VmWorkingSetList;
 630     LIST_ENTRY      WorkingSetExpansionLinks;
 631     ULONG           Claim;
 632     ULONG           NextEstimationSlot;
 633     ULONG           NextAgingSlot;
 634     ULONG           EstimatedAvailable;
 635     ULONG           GrowthSinceLastEstimate;
 636 } MMSUPPORT, *PMMSUPPORT;
 637
 638 #else
 639
 640 typedef struct _MMSUPPORT {
 641     LARGE_INTEGER   LastTrimTime;
 642     ULONG           LastTrimFaultCount;
 643     ULONG           PageFaultCount;
 644     ULONG           PeakWorkingSetSize;
 645     ULONG           WorkingSetSize;
 646     ULONG           MinimumWorkingSetSize;
 647     ULONG           MaximumWorkingSetSize;
 648     PMMWSL          VmWorkingSetList;
 649     LIST_ENTRY      WorkingSetExpansionLinks;
 650     BOOLEAN         AllowWorkingSetAdjustment;
 651     BOOLEAN         AddressSpaceBeingDeleted;
 652     UCHAR           ForegroundSwitchCount;
 653     UCHAR           MemoryPriority;
 654 #if (VER_PRODUCTBUILD >= 2195)
 655     union {
 656         ULONG           LongFlags;
 657         MMSUPPORT_FLAGS Flags;
 658     } u;
 659     ULONG           Claim;
 660     ULONG           NextEstimationSlot;
 661     ULONG           NextAgingSlot;
 662     ULONG           EstimatedAvailable;
 663     ULONG           GrowthSinceLastEstimate;
 664 #endif /* (VER_PRODUCTBUILD >= 2195) */
 665 } MMSUPPORT, *PMMSUPPORT;
 666
 667 #endif
 668
 669 typedef struct _SE_AUDIT_PROCESS_CREATION_INFO {
 670     POBJECT_NAME_INFORMATION ImageFileName;
 671 } SE_AUDIT_PROCESS_CREATION_INFO, *PSE_AUDIT_PROCESS_CREATION_INFO;
 672
 673 typedef struct _BITMAP_RANGE {
 674     LIST_ENTRY      Links;
 675     LARGE_INTEGER   BasePage;
 676     ULONG           FirstDirtyPage;
 677     ULONG           LastDirtyPage;
 678     ULONG           DirtyPages;
 679     PULONG          Bitmap;
 680 } BITMAP_RANGE, *PBITMAP_RANGE;
 681
 682 typedef struct _CACHE_UNINITIALIZE_EVENT {
 683     struct _CACHE_UNINITIALIZE_EVENT    *Next;
 684     KEVENT                              Event;
 685 } CACHE_UNINITIALIZE_EVENT, *PCACHE_UNINITIALIZE_EVENT;
 686
 687 typedef struct _CC_FILE_SIZES {
 688     LARGE_INTEGER AllocationSize;
 689     LARGE_INTEGER FileSize;
 690     LARGE_INTEGER ValidDataLength;
 691 } CC_FILE_SIZES, *PCC_FILE_SIZES;
 692
 693 typedef struct _COMPRESSED_DATA_INFO {
 694     USHORT  CompressionFormatAndEngine;
 695     UCHAR   CompressionUnitShift;
 696     UCHAR   ChunkShift;
 697     UCHAR   ClusterShift;
 698     UCHAR   Reserved;
 699     USHORT  NumberOfChunks;
 700     ULONG   CompressedChunkSizes[ANYSIZE_ARRAY];
 701 } COMPRESSED_DATA_INFO, *PCOMPRESSED_DATA_INFO;
 702
 703 typedef struct _DEVICE_MAP {
 704     POBJECT_DIRECTORY   DosDevicesDirectory;
 705     POBJECT_DIRECTORY   GlobalDosDevicesDirectory;
 706     ULONG               ReferenceCount;
 707     ULONG               DriveMap;
 708     UCHAR               DriveType[32];
 709 } DEVICE_MAP, *PDEVICE_MAP;
 710
 711 #if (VER_PRODUCTBUILD >= 2600)
 712
 713 typedef struct _EX_FAST_REF {
 714     _ANONYMOUS_UNION union {
 715         PVOID Object;
 716         ULONG RefCnt : 3;
 717         ULONG Value;
 718     } DUMMYUNIONNAME;
 719 } EX_FAST_REF, *PEX_FAST_REF;
 720
 721 typedef struct _EX_PUSH_LOCK {
 722     _ANONYMOUS_UNION union {
 723         _ANONYMOUS_STRUCT struct {
 724             ULONG   Waiting     : 1;
 725             ULONG   Exclusive   : 1;
 726             ULONG   Shared      : 30;
 727         } DUMMYSTRUCTNAME;
 728         ULONG   Value;
 729         PVOID   Ptr;
 730     } DUMMYUNIONNAME;
 731 } EX_PUSH_LOCK, *PEX_PUSH_LOCK;
 732
 733 #define EX_RUNDOWN_ACTIVE               0x1
 734 #define EX_RUNDOWN_COUNT_SHIFT          0x1
 735 #define EX_RUNDOWN_COUNT_INC            (1 << EX_RUNDOWN_COUNT_SHIFT)
 736
 737 typedef struct _EX_RUNDOWN_REF {
 738     _ANONYMOUS_UNION union {
 739         ULONG Count;
 740         PVOID Ptr;
 741     } DUMMYUNIONNAME;
 742 } EX_RUNDOWN_REF, *PEX_RUNDOWN_REF;
 743
 744 #endif
 745
 746 typedef struct _EPROCESS_QUOTA_ENTRY {
 747     ULONG Usage;
 748     ULONG Limit;
 749     ULONG Peak;
 750     ULONG Return;
 751 } EPROCESS_QUOTA_ENTRY, *PEPROCESS_QUOTA_ENTRY;
 752
 753 typedef struct _EPROCESS_QUOTA_BLOCK {
 754     EPROCESS_QUOTA_ENTRY    QuotaEntry[3];
 755     LIST_ENTRY              QuotaList;
 756     ULONG                   ReferenceCount;
 757     ULONG                   ProcessCount;
 758 } EPROCESS_QUOTA_BLOCK, *PEPROCESS_QUOTA_BLOCK;
 759
 760 typedef struct _FILE_ACCESS_INFORMATION {
 761     ACCESS_MASK AccessFlags;
 762 } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
 763
 764 typedef struct _FILE_ALLOCATION_INFORMATION {
 765     LARGE_INTEGER AllocationSize;
 766 } FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;
 767
 768 typedef struct _FILE_BOTH_DIR_INFORMATION {
 769     ULONG           NextEntryOffset;
 770     ULONG           FileIndex;
 771     LARGE_INTEGER   CreationTime;
 772     LARGE_INTEGER   LastAccessTime;
 773     LARGE_INTEGER   LastWriteTime;
 774     LARGE_INTEGER   ChangeTime;
 775     LARGE_INTEGER   EndOfFile;
 776     LARGE_INTEGER   AllocationSize;
 777     ULONG           FileAttributes;
 778     ULONG           FileNameLength;
 779     ULONG           EaSize;
 780     CCHAR           ShortNameLength;
 781     WCHAR           ShortName[12];
 782     WCHAR           FileName[1];
 783 } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
 784
 785 typedef struct _FILE_COMPLETION_INFORMATION {
 786     HANDLE  Port;
 787     PVOID   Key;
 788 } FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;
 789
 790 typedef struct _FILE_COMPRESSION_INFORMATION {
 791     LARGE_INTEGER   CompressedFileSize;
 792     USHORT          CompressionFormat;
 793     UCHAR           CompressionUnitShift;
 794     UCHAR           ChunkShift;
 795     UCHAR           ClusterShift;
 796     UCHAR           Reserved[3];
 797 } FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
 798
 799 typedef struct _FILE_COPY_ON_WRITE_INFORMATION {
 800     BOOLEAN ReplaceIfExists;
 801     HANDLE  RootDirectory;
 802     ULONG   FileNameLength;
 803     WCHAR   FileName[1];
 804 } FILE_COPY_ON_WRITE_INFORMATION, *PFILE_COPY_ON_WRITE_INFORMATION;
 805
 806 typedef struct _FILE_DIRECTORY_INFORMATION {
 807     ULONG           NextEntryOffset;
 808     ULONG           FileIndex;
 809     LARGE_INTEGER   CreationTime;
 810     LARGE_INTEGER   LastAccessTime;
 811     LARGE_INTEGER   LastWriteTime;
 812     LARGE_INTEGER   ChangeTime;
 813     LARGE_INTEGER   EndOfFile;
 814     LARGE_INTEGER   AllocationSize;
 815     ULONG           FileAttributes;
 816     ULONG           FileNameLength;
 817     WCHAR           FileName[1];
 818 } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
 819
 820 typedef struct _FILE_FULL_DIRECTORY_INFORMATION {
 821     ULONG           NextEntryOffset;
 822     ULONG           FileIndex;
 823     LARGE_INTEGER   CreationTime;
 824     LARGE_INTEGER   LastAccessTime;
 825     LARGE_INTEGER   LastWriteTime;
 826     LARGE_INTEGER   ChangeTime;
 827     LARGE_INTEGER   EndOfFile;
 828     LARGE_INTEGER   AllocationSize;
 829     ULONG           FileAttributes;
 830     ULONG           FileNameLength;
 831     ULONG           EaSize;
 832     WCHAR           FileName[0];
 833 } FILE_FULL_DIRECTORY_INFORMATION, *PFILE_FULL_DIRECTORY_INFORMATION;
 834
 835 typedef struct _FILE_BOTH_DIRECTORY_INFORMATION {
 836     ULONG         NextEntryOffset;
 837     ULONG         FileIndex;
 838     LARGE_INTEGER CreationTime;
 839     LARGE_INTEGER LastAccessTime;
 840     LARGE_INTEGER LastWriteTime;
 841     LARGE_INTEGER ChangeTime;
 842     LARGE_INTEGER EndOfFile;
 843     LARGE_INTEGER AllocationSize;
 844     ULONG         FileAttributes;
 845     ULONG         FileNameLength;
 846     ULONG         EaSize;
 847     CHAR          ShortNameLength;
 848     WCHAR         ShortName[12];
 849     WCHAR         FileName[0];
 850 } FILE_BOTH_DIRECTORY_INFORMATION, *PFILE_BOTH_DIRECTORY_INFORMATION;
 851
 852 typedef struct _FILE_EA_INFORMATION {
 853     ULONG EaSize;
 854 } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
 855
 856 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {
 857     ULONG   FileSystemAttributes;
 858     ULONG   MaximumComponentNameLength;
 859     ULONG   FileSystemNameLength;
 860     WCHAR   FileSystemName[1];
 861 } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
 862
 863 typedef struct _FILE_FS_CONTROL_INFORMATION {
 864     LARGE_INTEGER   FreeSpaceStartFiltering;
 865     LARGE_INTEGER   FreeSpaceThreshold;
 866     LARGE_INTEGER   FreeSpaceStopFiltering;
 867     LARGE_INTEGER   DefaultQuotaThreshold;
 868     LARGE_INTEGER   DefaultQuotaLimit;
 869     ULONG           FileSystemControlFlags;
 870 } FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;
 871
 872 typedef struct _FILE_FS_FULL_SIZE_INFORMATION {
 873     LARGE_INTEGER   TotalAllocationUnits;
 874     LARGE_INTEGER   CallerAvailableAllocationUnits;
 875     LARGE_INTEGER   ActualAvailableAllocationUnits;
 876     ULONG           SectorsPerAllocationUnit;
 877     ULONG           BytesPerSector;
 878 } FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
 879
 880 typedef struct _FILE_FS_LABEL_INFORMATION {
 881     ULONG VolumeLabelLength;
 882     WCHAR VolumeLabel[1];
 883 } FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
 884
 885 #if (VER_PRODUCTBUILD >= 2195)
 886
 887 typedef struct _FILE_FS_OBJECT_ID_INFORMATION {
 888     UCHAR ObjectId[16];
 889     UCHAR ExtendedInfo[48];
 890 } FILE_FS_OBJECT_ID_INFORMATION, *PFILE_FS_OBJECT_ID_INFORMATION;
 891
 892 #endif /* (VER_PRODUCTBUILD >= 2195) */
 893
 894 typedef struct _FILE_FS_SIZE_INFORMATION {
 895     LARGE_INTEGER   TotalAllocationUnits;
 896     LARGE_INTEGER   AvailableAllocationUnits;
 897     ULONG           SectorsPerAllocationUnit;
 898     ULONG           BytesPerSector;
 899 } FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
 900
 901 typedef struct _FILE_FS_VOLUME_INFORMATION {
 902     LARGE_INTEGER   VolumeCreationTime;
 903     ULONG           VolumeSerialNumber;
 904     ULONG           VolumeLabelLength;
 905     BOOLEAN         SupportsObjects;
 906     WCHAR           VolumeLabel[1];
 907 } FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
 908
 909 typedef struct _FILE_FULL_DIR_INFORMATION {
 910     ULONG           NextEntryOffset;
 911     ULONG           FileIndex;
 912     LARGE_INTEGER   CreationTime;
 913     LARGE_INTEGER   LastAccessTime;
 914     LARGE_INTEGER   LastWriteTime;
 915     LARGE_INTEGER   ChangeTime;
 916     LARGE_INTEGER   EndOfFile;
 917     LARGE_INTEGER   AllocationSize;
 918     ULONG           FileAttributes;
 919     ULONG           FileNameLength;
 920     ULONG           EaSize;
 921     WCHAR           FileName[1];
 922 } FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
 923
 924 typedef struct _FILE_GET_EA_INFORMATION {
 925     ULONG   NextEntryOffset;
 926     UCHAR   EaNameLength;
 927     CHAR    EaName[1];
 928 } FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
 929
 930 typedef struct _FILE_GET_QUOTA_INFORMATION {
 931     ULONG   NextEntryOffset;
 932     ULONG   SidLength;
 933     SID     Sid;
 934 } FILE_GET_QUOTA_INFORMATION, *PFILE_GET_QUOTA_INFORMATION;
 935
 936 typedef struct _FILE_INTERNAL_INFORMATION {
 937     LARGE_INTEGER IndexNumber;
 938 } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
 939
 940 typedef struct _FILE_LINK_INFORMATION {
 941     BOOLEAN ReplaceIfExists;
 942     HANDLE  RootDirectory;
 943     ULONG   FileNameLength;
 944     WCHAR   FileName[1];
 945 } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
 946
 947 typedef struct _FILE_LOCK_INFO {
 948     LARGE_INTEGER   StartingByte;
 949     LARGE_INTEGER   Length;
 950     BOOLEAN         ExclusiveLock;
 951     ULONG           Key;
 952     PFILE_OBJECT    FileObject;
 953     PEPROCESS       Process;
 954     LARGE_INTEGER   EndingByte;
 955 } FILE_LOCK_INFO, *PFILE_LOCK_INFO;
 956
 957 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
 958 typedef struct _FILE_SHARED_LOCK_ENTRY {
 959     PVOID           Unknown1;
 960     PVOID           Unknown2;
 961     FILE_LOCK_INFO  FileLock;
 962 } FILE_SHARED_LOCK_ENTRY, *PFILE_SHARED_LOCK_ENTRY;
 963
 964 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
 965 typedef struct _FILE_EXCLUSIVE_LOCK_ENTRY {
 966     LIST_ENTRY      ListEntry;
 967     PVOID           Unknown1;
 968     PVOID           Unknown2;
 969     FILE_LOCK_INFO  FileLock;
 970 } FILE_EXCLUSIVE_LOCK_ENTRY, *PFILE_EXCLUSIVE_LOCK_ENTRY;
 971
 972 typedef NTSTATUS (*PCOMPLETE_LOCK_IRP_ROUTINE) (
 973     IN PVOID    Context,
 974     IN PIRP     Irp
 975 );
 976
 977 typedef VOID (NTAPI *PUNLOCK_ROUTINE) (
 978     IN PVOID            Context,
 979     IN PFILE_LOCK_INFO  FileLockInfo
 980 );
 981
 982 typedef struct _FILE_LOCK {
 983     PCOMPLETE_LOCK_IRP_ROUTINE  CompleteLockIrpRoutine;
 984     PUNLOCK_ROUTINE             UnlockRoutine;
 985     BOOLEAN                     FastIoIsQuestionable;
 986     BOOLEAN                     Pad[3];
 987     PVOID                       LockInformation;
 988     FILE_LOCK_INFO              LastReturnedLockInfo;
 989     PVOID                       LastReturnedLock;
 990 } FILE_LOCK, *PFILE_LOCK;
 991
 992 typedef struct _FILE_MAILSLOT_PEEK_BUFFER {
 993     ULONG ReadDataAvailable;
 994     ULONG NumberOfMessages;
 995     ULONG MessageLength;
 996 } FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER;
 997
 998 typedef struct _FILE_MAILSLOT_QUERY_INFORMATION {
 999     ULONG           MaximumMessageSize;
1000     ULONG           MailslotQuota;
1001     ULONG           NextMessageSize;
1002     ULONG           MessagesAvailable;
1003     LARGE_INTEGER   ReadTimeout;
1004 } FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION;
1005
1006 typedef struct _FILE_MAILSLOT_SET_INFORMATION {
1007     LARGE_INTEGER ReadTimeout;
1008 } FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
1009
1010 typedef struct _FILE_MODE_INFORMATION {
1011     ULONG Mode;
1012 } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
1013
1014 typedef struct _FILE_ALL_INFORMATION {
1015     FILE_BASIC_INFORMATION      BasicInformation;
1016     FILE_STANDARD_INFORMATION   StandardInformation;
1017     FILE_INTERNAL_INFORMATION   InternalInformation;
1018     FILE_EA_INFORMATION         EaInformation;
1019     FILE_ACCESS_INFORMATION     AccessInformation;
1020     FILE_POSITION_INFORMATION   PositionInformation;
1021     FILE_MODE_INFORMATION       ModeInformation;
1022     FILE_ALIGNMENT_INFORMATION  AlignmentInformation;
1023     FILE_NAME_INFORMATION       NameInformation;
1024 } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
1025
1026 typedef struct _FILE_NAMES_INFORMATION {
1027     ULONG NextEntryOffset;
1028     ULONG FileIndex;
1029     ULONG FileNameLength;
1030     WCHAR FileName[1];
1031 } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
1032
1033 typedef struct _FILE_OBJECTID_INFORMATION {
1034     LONGLONG        FileReference;
1035     UCHAR           ObjectId[16];
1036     _ANONYMOUS_UNION union {
1037         struct {
1038             UCHAR   BirthVolumeId[16];
1039             UCHAR   BirthObjectId[16];
1040             UCHAR   DomainId[16];
1041         } ;
1042         UCHAR       ExtendedInfo[48];
1043     } DUMMYUNIONNAME;
1044 } FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION;
1045
1046 typedef struct _FILE_OLE_CLASSID_INFORMATION {
1047     GUID ClassId;
1048 } FILE_OLE_CLASSID_INFORMATION, *PFILE_OLE_CLASSID_INFORMATION;
1049
1050 typedef struct _FILE_OLE_ALL_INFORMATION {
1051     FILE_BASIC_INFORMATION          BasicInformation;
1052     FILE_STANDARD_INFORMATION       StandardInformation;
1053     FILE_INTERNAL_INFORMATION       InternalInformation;
1054     FILE_EA_INFORMATION             EaInformation;
1055     FILE_ACCESS_INFORMATION         AccessInformation;
1056     FILE_POSITION_INFORMATION       PositionInformation;
1057     FILE_MODE_INFORMATION           ModeInformation;
1058     FILE_ALIGNMENT_INFORMATION      AlignmentInformation;
1059     USN                             LastChangeUsn;
1060     USN                             ReplicationUsn;
1061     LARGE_INTEGER                   SecurityChangeTime;
1062     FILE_OLE_CLASSID_INFORMATION    OleClassIdInformation;
1063     FILE_OBJECTID_INFORMATION       ObjectIdInformation;
1064     FILE_STORAGE_TYPE               StorageType;
1065     ULONG                           OleStateBits;
1066     ULONG                           OleId;
1067     ULONG                           NumberOfStreamReferences;
1068     ULONG                           StreamIndex;
1069     ULONG                           SecurityId;
1070     BOOLEAN                         ContentIndexDisable;
1071     BOOLEAN                         InheritContentIndexDisable;
1072     FILE_NAME_INFORMATION           NameInformation;
1073 } FILE_OLE_ALL_INFORMATION, *PFILE_OLE_ALL_INFORMATION;
1074
1075 typedef struct _FILE_OLE_DIR_INFORMATION {
1076     ULONG               NextEntryOffset;
1077     ULONG               FileIndex;
1078     LARGE_INTEGER       CreationTime;
1079     LARGE_INTEGER       LastAccessTime;
1080     LARGE_INTEGER       LastWriteTime;
1081     LARGE_INTEGER       ChangeTime;
1082     LARGE_INTEGER       EndOfFile;
1083     LARGE_INTEGER       AllocationSize;
1084     ULONG               FileAttributes;
1085     ULONG               FileNameLength;
1086     FILE_STORAGE_TYPE   StorageType;
1087     GUID                OleClassId;
1088     ULONG               OleStateBits;
1089     BOOLEAN             ContentIndexDisable;
1090     BOOLEAN             InheritContentIndexDisable;
1091     WCHAR               FileName[1];
1092 } FILE_OLE_DIR_INFORMATION, *PFILE_OLE_DIR_INFORMATION;
1093
1094 typedef struct _FILE_OLE_INFORMATION {
1095     LARGE_INTEGER                   SecurityChangeTime;
1096     FILE_OLE_CLASSID_INFORMATION    OleClassIdInformation;
1097     FILE_OBJECTID_INFORMATION       ObjectIdInformation;
1098     FILE_STORAGE_TYPE               StorageType;
1099     ULONG                           OleStateBits;
1100     BOOLEAN                         ContentIndexDisable;
1101     BOOLEAN                         InheritContentIndexDisable;
1102 } FILE_OLE_INFORMATION, *PFILE_OLE_INFORMATION;
1103
1104 typedef struct _FILE_OLE_STATE_BITS_INFORMATION {
1105     ULONG StateBits;
1106     ULONG StateBitsMask;
1107 } FILE_OLE_STATE_BITS_INFORMATION, *PFILE_OLE_STATE_BITS_INFORMATION;
1108
1109 typedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER {
1110     HANDLE  EventHandle;
1111     ULONG   KeyValue;
1112 } FILE_PIPE_ASSIGN_EVENT_BUFFER, *PFILE_PIPE_ASSIGN_EVENT_BUFFER;
1113
1114 typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER {
1115     PVOID ClientSession;
1116     PVOID ClientProcess;
1117 } FILE_PIPE_CLIENT_PROCESS_BUFFER, *PFILE_PIPE_CLIENT_PROCESS_BUFFER;
1118
1119 typedef struct _FILE_PIPE_EVENT_BUFFER {
1120     ULONG NamedPipeState;
1121     ULONG EntryType;
1122     ULONG ByteCount;
1123     ULONG KeyValue;
1124     ULONG NumberRequests;
1125 } FILE_PIPE_EVENT_BUFFER, *PFILE_PIPE_EVENT_BUFFER;
1126
1127 typedef struct _FILE_PIPE_PEEK_BUFFER
1128 {
1129     ULONG NamedPipeState;
1130     ULONG ReadDataAvailable;
1131     ULONG NumberOfMessages;
1132     ULONG MessageLength;
1133     CHAR Data[1];
1134 } FILE_PIPE_PEEK_BUFFER, *PFILE_PIPE_PEEK_BUFFER;
1135
1136 typedef struct _FILE_PIPE_INFORMATION {
1137     ULONG ReadMode;
1138     ULONG CompletionMode;
1139 } FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;
1140
1141 typedef struct _FILE_PIPE_LOCAL_INFORMATION {
1142     ULONG NamedPipeType;
1143     ULONG NamedPipeConfiguration;
1144     ULONG MaximumInstances;
1145     ULONG CurrentInstances;
1146     ULONG InboundQuota;
1147     ULONG ReadDataAvailable;
1148     ULONG OutboundQuota;
1149     ULONG WriteQuotaAvailable;
1150     ULONG NamedPipeState;
1151     ULONG NamedPipeEnd;
1152 } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
1153
1154 typedef struct _FILE_PIPE_REMOTE_INFORMATION {
1155     LARGE_INTEGER   CollectDataTime;
1156     ULONG           MaximumCollectionCount;
1157 } FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION;
1158
1159 typedef struct _FILE_PIPE_WAIT_FOR_BUFFER {
1160     LARGE_INTEGER   Timeout;
1161     ULONG           NameLength;
1162     BOOLEAN         TimeoutSpecified;
1163     WCHAR           Name[1];
1164 } FILE_PIPE_WAIT_FOR_BUFFER, *PFILE_PIPE_WAIT_FOR_BUFFER;
1165
1166 typedef struct _FILE_RENAME_INFORMATION {
1167     BOOLEAN ReplaceIfExists;
1168     HANDLE  RootDirectory;
1169     ULONG   FileNameLength;
1170     WCHAR   FileName[1];
1171 } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
1172
1173 typedef struct _FILE_STREAM_INFORMATION {
1174     ULONG           NextEntryOffset;
1175     ULONG           StreamNameLength;
1176     LARGE_INTEGER   StreamSize;
1177     LARGE_INTEGER   StreamAllocationSize;
1178     WCHAR           StreamName[1];
1179 } FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;
1180
1181 typedef struct _FILE_TRACKING_INFORMATION {
1182     HANDLE  DestinationFile;
1183     ULONG   ObjectInformationLength;
1184     CHAR    ObjectInformation[1];
1185 } FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION;
1186
1187 #if (VER_PRODUCTBUILD >= 2195)
1188 typedef struct _FILE_ZERO_DATA_INFORMATION {
1189     LARGE_INTEGER FileOffset;
1190     LARGE_INTEGER BeyondFinalZero;
1191 } FILE_ZERO_DATA_INFORMATION, *PFILE_ZERO_DATA_INFORMATION;
1192
1193 typedef struct FILE_ALLOCATED_RANGE_BUFFER {
1194     LARGE_INTEGER FileOffset;
1195     LARGE_INTEGER Length;
1196 } FILE_ALLOCATED_RANGE_BUFFER, *PFILE_ALLOCATED_RANGE_BUFFER;
1197 #endif /* (VER_PRODUCTBUILD >= 2195) */
1198
1199 typedef struct _FSRTL_COMMON_FCB_HEADER {
1200     CSHORT          NodeTypeCode;
1201     CSHORT          NodeByteSize;
1202     UCHAR           Flags;
1203     UCHAR           IsFastIoPossible;
1204 #if (VER_PRODUCTBUILD >= 1381)
1205     UCHAR           Flags2;
1206     UCHAR           Reserved;
1207 #endif /* (VER_PRODUCTBUILD >= 1381) */
1208     PERESOURCE      Resource;
1209     PERESOURCE      PagingIoResource;
1210     LARGE_INTEGER   AllocationSize;
1211     LARGE_INTEGER   FileSize;
1212     LARGE_INTEGER   ValidDataLength;
1213 } FSRTL_COMMON_FCB_HEADER, *PFSRTL_COMMON_FCB_HEADER;
1214
1215 #if (VER_PRODUCTBUILD >= 2600)
1216
1217 typedef struct _FSRTL_ADVANCED_FCB_HEADER {
1218     CSHORT          NodeTypeCode;
1219     CSHORT          NodeByteSize;
1220     UCHAR           Flags;
1221     UCHAR           IsFastIoPossible;
1222     UCHAR           Flags2;
1223     UCHAR           Reserved;
1224     PERESOURCE      Resource;
1225     PERESOURCE      PagingIoResource;
1226     LARGE_INTEGER   AllocationSize;
1227     LARGE_INTEGER   FileSize;
1228     LARGE_INTEGER   ValidDataLength;
1229     PFAST_MUTEX     FastMutex;
1230     LIST_ENTRY      FilterContexts;
1231 } FSRTL_ADVANCED_FCB_HEADER, *PFSRTL_ADVANCED_FCB_HEADER;
1232
1233 typedef struct _FSRTL_PER_STREAM_CONTEXT {
1234     LIST_ENTRY     Links;
1235     PVOID          OwnerId;
1236     PVOID          InstanceId;
1237     PFREE_FUNCTION FreeCallback;
1238 } FSRTL_PER_STREAM_CONTEXT, *PFSRTL_PER_STREAM_CONTEXT;
1239
1240 #endif /* (VER_PRODUCTBUILD >= 2600) */
1241
1242 typedef struct _GENERATE_NAME_CONTEXT {
1243     USHORT  Checksum;
1244     BOOLEAN CheckSumInserted;
1245     UCHAR   NameLength;
1246     WCHAR   NameBuffer[8];
1247     ULONG   ExtensionLength;
1248     WCHAR   ExtensionBuffer[4];
1249     ULONG   LastIndexValue;
1250 } GENERATE_NAME_CONTEXT, *PGENERATE_NAME_CONTEXT;
1251
1252 typedef struct _MAPPING_PAIR {
1253     ULONGLONG Vcn;
1254     ULONGLONG Lcn;
1255 } MAPPING_PAIR, *PMAPPING_PAIR;
1256
1257 typedef struct _GET_RETRIEVAL_DESCRIPTOR {
1258     ULONG           NumberOfPairs;
1259     ULONGLONG       StartVcn;
1260     MAPPING_PAIR    Pair[1];
1261 } GET_RETRIEVAL_DESCRIPTOR, *PGET_RETRIEVAL_DESCRIPTOR;
1262
1263 typedef struct _IO_CLIENT_EXTENSION {
1264     struct _IO_CLIENT_EXTENSION *NextExtension;
1265     PVOID                       ClientIdentificationAddress;
1266 } IO_CLIENT_EXTENSION, *PIO_CLIENT_EXTENSION;
1267
1268 typedef struct _IO_COMPLETION_BASIC_INFORMATION {
1269     LONG Depth;
1270 } IO_COMPLETION_BASIC_INFORMATION, *PIO_COMPLETION_BASIC_INFORMATION;
1271
1272 typedef struct _KQUEUE {
1273     DISPATCHER_HEADER   Header;
1274     LIST_ENTRY          EntryListHead;
1275     ULONG               CurrentCount;
1276     ULONG               MaximumCount;
1277     LIST_ENTRY          ThreadListHead;
1278 } KQUEUE, *PKQUEUE, *RESTRICTED_POINTER PRKQUEUE;
1279
1280 typedef struct _MBCB {
1281     CSHORT          NodeTypeCode;
1282     CSHORT          NodeIsInZone;
1283     ULONG           PagesToWrite;
1284     ULONG           DirtyPages;
1285     ULONG           Reserved;
1286     LIST_ENTRY      BitmapRanges;
1287     LONGLONG        ResumeWritePage;
1288     BITMAP_RANGE    BitmapRange1;
1289     BITMAP_RANGE    BitmapRange2;
1290     BITMAP_RANGE    BitmapRange3;
1291 } MBCB, *PMBCB;
1292
1293 typedef struct _MOVEFILE_DESCRIPTOR {
1294      HANDLE         FileHandle;
1295      ULONG          Reserved;
1296      LARGE_INTEGER  StartVcn;
1297      LARGE_INTEGER  TargetLcn;
1298      ULONG          NumVcns;
1299      ULONG          Reserved1;
1300 } MOVEFILE_DESCRIPTOR, *PMOVEFILE_DESCRIPTOR;
1301
1302 typedef struct _OBJECT_BASIC_INFO {
1303     ULONG           Attributes;
1304     ACCESS_MASK     GrantedAccess;
1305     ULONG           HandleCount;
1306     ULONG           ReferenceCount;
1307     ULONG           PagedPoolUsage;
1308     ULONG           NonPagedPoolUsage;
1309     ULONG           Reserved[3];
1310     ULONG           NameInformationLength;
1311     ULONG           TypeInformationLength;
1312     ULONG           SecurityDescriptorLength;
1313     LARGE_INTEGER   CreateTime;
1314 } OBJECT_BASIC_INFO, *POBJECT_BASIC_INFO;
1315
1316 typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFO {
1317     BOOLEAN Inherit;
1318     BOOLEAN ProtectFromClose;
1319 } OBJECT_HANDLE_ATTRIBUTE_INFO, *POBJECT_HANDLE_ATTRIBUTE_INFO;
1320
1321 typedef struct _OBJECT_NAME_INFO {
1322     UNICODE_STRING  ObjectName;
1323     WCHAR           ObjectNameBuffer[1];
1324 } OBJECT_NAME_INFO, *POBJECT_NAME_INFO;
1325
1326 typedef struct _OBJECT_PROTECTION_INFO {
1327     BOOLEAN Inherit;
1328     BOOLEAN ProtectHandle;
1329 } OBJECT_PROTECTION_INFO, *POBJECT_PROTECTION_INFO;
1330
1331 typedef struct _OBJECT_TYPE_INFO {
1332     UNICODE_STRING  ObjectTypeName;
1333     UCHAR           Unknown[0x58];
1334     WCHAR           ObjectTypeNameBuffer[1];
1335 } OBJECT_TYPE_INFO, *POBJECT_TYPE_INFO;
1336
1337 typedef struct _OBJECT_ALL_TYPES_INFO {
1338     ULONG               NumberOfObjectTypes;
1339     OBJECT_TYPE_INFO    ObjectsTypeInfo[1];
1340 } OBJECT_ALL_TYPES_INFO, *POBJECT_ALL_TYPES_INFO;
1341
1342
1343 typedef struct _PATHNAME_BUFFER {
1344     ULONG PathNameLength;
1345     WCHAR Name[1];
1346 } PATHNAME_BUFFER, *PPATHNAME_BUFFER;
1347
1348 #if (VER_PRODUCTBUILD >= 2600)
1349
1350 typedef struct _PRIVATE_CACHE_MAP_FLAGS {
1351     ULONG DontUse           : 16;
1352     ULONG ReadAheadActive   : 1;
1353     ULONG ReadAheadEnabled  : 1;
1354     ULONG Available         : 14;
1355 } PRIVATE_CACHE_MAP_FLAGS, *PPRIVATE_CACHE_MAP_FLAGS;
1356
1357 typedef struct _PRIVATE_CACHE_MAP {
1358     _ANONYMOUS_UNION union {
1359         CSHORT                  NodeTypeCode;
1360         PRIVATE_CACHE_MAP_FLAGS Flags;
1361         ULONG                   UlongFlags;
1362     } DUMMYUNIONNAME;
1363     ULONG                       ReadAheadMask;
1364     PFILE_OBJECT                FileObject;
1365     LARGE_INTEGER               FileOffset1;
1366     LARGE_INTEGER               BeyondLastByte1;
1367     LARGE_INTEGER               FileOffset2;
1368     LARGE_INTEGER               BeyondLastByte2;
1369     LARGE_INTEGER               ReadAheadOffset[2];
1370     ULONG                       ReadAheadLength[2];
1371     KSPIN_LOCK                  ReadAheadSpinLock;
1372     LIST_ENTRY                  PrivateLinks;
1373 } PRIVATE_CACHE_MAP, *PPRIVATE_CACHE_MAP;
1374
1375 #endif
1376
1377 typedef struct _PS_IMPERSONATION_INFORMATION {
1378     PACCESS_TOKEN                   Token;
1379     BOOLEAN                         CopyOnOpen;
1380     BOOLEAN                         EffectiveOnly;
1381     SECURITY_IMPERSONATION_LEVEL    ImpersonationLevel;
1382 } PS_IMPERSONATION_INFORMATION, *PPS_IMPERSONATION_INFORMATION;
1383
1384 typedef struct _PUBLIC_BCB {
1385     CSHORT          NodeTypeCode;
1386     CSHORT          NodeByteSize;
1387     ULONG           MappedLength;
1388     LARGE_INTEGER   MappedFileOffset;
1389 } PUBLIC_BCB, *PPUBLIC_BCB;
1390
1391 typedef struct _QUERY_PATH_REQUEST {
1392     ULONG                   PathNameLength;
1393     PIO_SECURITY_CONTEXT    SecurityContext;
1394     WCHAR                   FilePathName[1];
1395 } QUERY_PATH_REQUEST, *PQUERY_PATH_REQUEST;
1396
1397 typedef struct _QUERY_PATH_RESPONSE {
1398     ULONG LengthAccepted;
1399 } QUERY_PATH_RESPONSE, *PQUERY_PATH_RESPONSE;
1400
1401 #pragma pack(push,8)
1402 typedef struct _RETRIEVAL_POINTERS_BUFFER {
1403     ULONG               ExtentCount;
1404     LARGE_INTEGER       StartingVcn;
1405     struct {
1406         LARGE_INTEGER   NextVcn;
1407         LARGE_INTEGER   Lcn;
1408     } Extents[1];
1409 } RETRIEVAL_POINTERS_BUFFER, *PRETRIEVAL_POINTERS_BUFFER;
1410 #pragma pack(pop)
1411
1412 typedef struct _RTL_SPLAY_LINKS {
1413     struct _RTL_SPLAY_LINKS *Parent;
1414     struct _RTL_SPLAY_LINKS *LeftChild;
1415     struct _RTL_SPLAY_LINKS *RightChild;
1416 } RTL_SPLAY_LINKS, *PRTL_SPLAY_LINKS;
1417
1418 typedef struct _SE_EXPORTS {
1419
1420     LUID    SeCreateTokenPrivilege;
1421     LUID    SeAssignPrimaryTokenPrivilege;
1422     LUID    SeLockMemoryPrivilege;
1423     LUID    SeIncreaseQuotaPrivilege;
1424     LUID    SeUnsolicitedInputPrivilege;
1425     LUID    SeTcbPrivilege;
1426     LUID    SeSecurityPrivilege;
1427     LUID    SeTakeOwnershipPrivilege;
1428     LUID    SeLoadDriverPrivilege;
1429     LUID    SeCreatePagefilePrivilege;
1430     LUID    SeIncreaseBasePriorityPrivilege;
1431     LUID    SeSystemProfilePrivilege;
1432     LUID    SeSystemtimePrivilege;
1433     LUID    SeProfileSingleProcessPrivilege;
1434     LUID    SeCreatePermanentPrivilege;
1435     LUID    SeBackupPrivilege;
1436     LUID    SeRestorePrivilege;
1437     LUID    SeShutdownPrivilege;
1438     LUID    SeDebugPrivilege;
1439     LUID    SeAuditPrivilege;
1440     LUID    SeSystemEnvironmentPrivilege;
1441     LUID    SeChangeNotifyPrivilege;
1442     LUID    SeRemoteShutdownPrivilege;
1443
1444     PSID    SeNullSid;
1445     PSID    SeWorldSid;
1446     PSID    SeLocalSid;
1447     PSID    SeCreatorOwnerSid;
1448     PSID    SeCreatorGroupSid;
1449
1450     PSID    SeNtAuthoritySid;
1451     PSID    SeDialupSid;
1452     PSID    SeNetworkSid;
1453     PSID    SeBatchSid;
1454     PSID    SeInteractiveSid;
1455     PSID    SeLocalSystemSid;
1456     PSID    SeAliasAdminsSid;
1457     PSID    SeAliasUsersSid;
1458     PSID    SeAliasGuestsSid;
1459     PSID    SeAliasPowerUsersSid;
1460     PSID    SeAliasAccountOpsSid;
1461     PSID    SeAliasSystemOpsSid;
1462     PSID    SeAliasPrintOpsSid;
1463     PSID    SeAliasBackupOpsSid;
1464
1465     PSID    SeAuthenticatedUsersSid;
1466
1467     PSID    SeRestrictedSid;
1468     PSID    SeAnonymousLogonSid;
1469
1470     LUID    SeUndockPrivilege;
1471     LUID    SeSyncAgentPrivilege;
1472     LUID    SeEnableDelegationPrivilege;
1473
1474 } SE_EXPORTS, *PSE_EXPORTS;
1475
1476 #if (VER_PRODUCTBUILD >= 2600)
1477
1478 typedef struct _SHARED_CACHE_MAP {
1479     CSHORT                      NodeTypeCode;
1480     CSHORT                      NodeByteSize;
1481     ULONG                       OpenCount;
1482     LARGE_INTEGER               FileSize;
1483     LIST_ENTRY                  BcbList;
1484     LARGE_INTEGER               SectionSize;
1485     LARGE_INTEGER               ValidDataLength;
1486     LARGE_INTEGER               ValidDataGoal;
1487     PVACB                       InitialVacbs[4];
1488     PVACB                       *Vacbs;
1489     PFILE_OBJECT                FileObject;
1490     PVACB                       ActiveVacb;
1491     PVOID                       NeedToZero;
1492     ULONG                       ActivePage;
1493     ULONG                       NeedToZeroPage;
1494     KSPIN_LOCK                  ActiveVacbSpinLock;
1495     ULONG                       VacbActiveCount;
1496     ULONG                       DirtyPages;
1497     LIST_ENTRY                  SharedCacheMapLinks;
1498     ULONG                       Flags;
1499     NTSTATUS                    Status;
1500     PMBCB                       Mbcb;
1501     PVOID                       Section;
1502     PKEVENT                     CreateEvent;
1503     PKEVENT                     WaitOnActiveCount;
1504     ULONG                       PagesToWrite;
1505     LONGLONG                    BeyondLastFlush;
1506     PCACHE_MANAGER_CALLBACKS    Callbacks;
1507     PVOID                       LazyWriteContext;
1508     LIST_ENTRY                  PrivateList;
1509     PVOID                       LogHandle;
1510     PVOID                       FlushToLsnRoutine;
1511     ULONG                       DirtyPageThreshold;
1512     ULONG                       LazyWritePassCount;
1513     PCACHE_UNINITIALIZE_EVENT   UninitializeEvent;
1514     PVACB                       NeedToZeroVacb;
1515     KSPIN_LOCK                  BcbSpinLock;
1516     PVOID                       Reserved;
1517     KEVENT                      Event;
1518     EX_PUSH_LOCK                VacbPushLock;
1519     PRIVATE_CACHE_MAP           PrivateCacheMap;
1520 } SHARED_CACHE_MAP, *PSHARED_CACHE_MAP;
1521
1522 #endif
1523
1524 typedef struct _STARTING_VCN_INPUT_BUFFER {
1525     LARGE_INTEGER StartingVcn;
1526 } STARTING_VCN_INPUT_BUFFER, *PSTARTING_VCN_INPUT_BUFFER;
1527
1528 typedef struct _SECURITY_CLIENT_CONTEXT {
1529     SECURITY_QUALITY_OF_SERVICE SecurityQos;
1530     PACCESS_TOKEN               ClientToken;
1531     BOOLEAN                     DirectlyAccessClientToken;
1532     BOOLEAN                     DirectAccessEffectiveOnly;
1533     BOOLEAN                     ServerIsRemote;
1534     TOKEN_CONTROL               ClientTokenControl;
1535 } SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;
1536
1537 typedef struct _TUNNEL {
1538     FAST_MUTEX          Mutex;
1539     PRTL_SPLAY_LINKS    Cache;
1540     LIST_ENTRY          TimerQueue;
1541     USHORT              NumEntries;
1542 } TUNNEL, *PTUNNEL;
1543
1544 typedef struct _VACB {
1545     PVOID               BaseAddress;
1546     PSHARED_CACHE_MAP   SharedCacheMap;
1547     union {
1548         LARGE_INTEGER   FileOffset;
1549         USHORT          ActiveCount;
1550     } Overlay;
1551     LIST_ENTRY          LruList;
1552 } VACB, *PVACB;
1553
1554 typedef struct _VAD_HEADER {
1555     PVOID       StartVPN;
1556     PVOID       EndVPN;
1557     PVAD_HEADER ParentLink;
1558     PVAD_HEADER LeftLink;
1559     PVAD_HEADER RightLink;
1560     ULONG       Flags;          /* LSB = CommitCharge */
1561     PVOID       ControlArea;
1562     PVOID       FirstProtoPte;
1563     PVOID       LastPTE;
1564     ULONG       Unknown;
1565     LIST_ENTRY  Secured;
1566 } VAD_HEADER, *PVAD_HEADER;
1567
1568 #if (VER_PRODUCTBUILD >= 2600)
1569
1570 typedef BOOLEAN
1571 (NTAPI *PFILTER_REPORT_CHANGE) (
1572     IN PVOID  NotifyContext,
1573     IN PVOID  FilterContext
1574 );
1575
1576 typedef enum _FS_FILTER_SECTION_SYNC_TYPE {
1577     SyncTypeOther = 0,
1578     SyncTypeCreateSection
1579 } FS_FILTER_SECTION_SYNC_TYPE, *PFS_FILTER_SECTION_SYNC_TYPE;
1580
1581 typedef union _FS_FILTER_PARAMETERS {
1582     struct {
1583         PLARGE_INTEGER  EndingOffset;
1584     } AcquireForModifiedPageWriter;
1585
1586     struct {
1587         PERESOURCE  ResourceToRelease;
1588     } ReleaseForModifiedPageWriter;
1589
1590     struct {
1591         FS_FILTER_SECTION_SYNC_TYPE  SyncType;
1592         ULONG  PageProtection;
1593     } AcquireForSectionSynchronization;
1594
1595     struct {
1596         PVOID  Argument1;
1597         PVOID  Argument2;
1598         PVOID  Argument3;
1599         PVOID  Argument4;
1600         PVOID  Argument5;
1601     } Others;
1602 } FS_FILTER_PARAMETERS, *PFS_FILTER_PARAMETERS;
1603
1604 typedef struct _FS_FILTER_CALLBACK_DATA {
1605     ULONG                  SizeOfFsFilterCallbackData;
1606     UCHAR                  Operation;
1607     UCHAR                  Reserved;
1608     struct _DEVICE_OBJECT  *DeviceObject;
1609     struct _FILE_OBJECT    *FileObject;
1610     FS_FILTER_PARAMETERS   Parameters;
1611 } FS_FILTER_CALLBACK_DATA, *PFS_FILTER_CALLBACK_DATA;
1612
1613 typedef NTSTATUS
1614 (NTAPI *PFS_FILTER_CALLBACK) (
1615     IN PFS_FILTER_CALLBACK_DATA  Data,
1616     OUT PVOID                    *CompletionContext
1617 );
1618
1619 typedef VOID
1620 (NTAPI *PFS_FILTER_COMPLETION_CALLBACK) (
1621     IN PFS_FILTER_CALLBACK_DATA  Data,
1622     IN NTSTATUS                  OperationStatus,
1623     IN PVOID                     CompletionContext
1624 );
1625
1626 typedef struct _FS_FILTER_CALLBACKS {
1627     ULONG                           SizeOfFsFilterCallbacks;
1628     ULONG                           Reserved;
1629     PFS_FILTER_CALLBACK             PreAcquireForSectionSynchronization;
1630     PFS_FILTER_COMPLETION_CALLBACK  PostAcquireForSectionSynchronization;
1631     PFS_FILTER_CALLBACK             PreReleaseForSectionSynchronization;
1632     PFS_FILTER_COMPLETION_CALLBACK  PostReleaseForSectionSynchronization;
1633     PFS_FILTER_CALLBACK             PreAcquireForCcFlush;
1634     PFS_FILTER_COMPLETION_CALLBACK  PostAcquireForCcFlush;
1635     PFS_FILTER_CALLBACK             PreReleaseForCcFlush;
1636     PFS_FILTER_COMPLETION_CALLBACK  PostReleaseForCcFlush;
1637     PFS_FILTER_CALLBACK             PreAcquireForModifiedPageWriter;
1638     PFS_FILTER_COMPLETION_CALLBACK  PostAcquireForModifiedPageWriter;
1639     PFS_FILTER_CALLBACK             PreReleaseForModifiedPageWriter;
1640     PFS_FILTER_COMPLETION_CALLBACK  PostReleaseForModifiedPageWriter;
1641 } FS_FILTER_CALLBACKS, *PFS_FILTER_CALLBACKS;
1642
1643 typedef struct _READ_LIST {
1644     PFILE_OBJECT          FileObject;
1645     ULONG                 NumberOfEntries;
1646     LOGICAL               IsImage;
1647     FILE_SEGMENT_ELEMENT  List[ANYSIZE_ARRAY];
1648 } READ_LIST, *PREAD_LIST;
1649
1650 #endif
1651
1652 NTKERNELAPI
1653 BOOLEAN
1654 NTAPI
1655 CcCanIWrite (
1656     IN PFILE_OBJECT FileObject,
1657     IN ULONG        BytesToWrite,
1658     IN BOOLEAN      Wait,
1659     IN BOOLEAN      Retrying
1660 );
1661
1662 NTKERNELAPI
1663 BOOLEAN
1664 NTAPI
1665 CcCopyRead (
1666     IN PFILE_OBJECT         FileObject,
1667     IN PLARGE_INTEGER       FileOffset,
1668     IN ULONG                Length,
1669     IN BOOLEAN              Wait,
1670     OUT PVOID               Buffer,
1671     OUT PIO_STATUS_BLOCK    IoStatus
1672 );
1673
1674 NTKERNELAPI
1675 BOOLEAN
1676 NTAPI
1677 CcCopyWrite (
1678     IN PFILE_OBJECT     FileObject,
1679     IN PLARGE_INTEGER   FileOffset,
1680     IN ULONG            Length,
1681     IN BOOLEAN          Wait,
1682     IN PVOID            Buffer
1683 );
1684
1685 #define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
1686
1687 typedef VOID (NTAPI *PCC_POST_DEFERRED_WRITE) (
1688     IN PVOID Context1,
1689     IN PVOID Context2
1690 );
1691
1692 NTKERNELAPI
1693 VOID
1694 NTAPI
1695 CcDeferWrite (
1696     IN PFILE_OBJECT             FileObject,
1697     IN PCC_POST_DEFERRED_WRITE  PostRoutine,
1698     IN PVOID                    Context1,
1699     IN PVOID                    Context2,
1700     IN ULONG                    BytesToWrite,
1701     IN BOOLEAN                  Retrying
1702 );
1703
1704 NTKERNELAPI
1705 VOID
1706 NTAPI
1707 CcFastCopyRead (
1708     IN PFILE_OBJECT         FileObject,
1709     IN ULONG                FileOffset,
1710     IN ULONG                Length,
1711     IN ULONG                PageCount,
1712     OUT PVOID               Buffer,
1713     OUT PIO_STATUS_BLOCK    IoStatus
1714 );
1715
1716 NTKERNELAPI
1717 VOID
1718 NTAPI
1719 CcFastCopyWrite (
1720     IN PFILE_OBJECT FileObject,
1721     IN ULONG        FileOffset,
1722     IN ULONG        Length,
1723     IN PVOID        Buffer
1724 );
1725
1726 NTKERNELAPI
1727 VOID
1728 NTAPI
1729 CcFlushCache (
1730     IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
1731     IN PLARGE_INTEGER           FileOffset OPTIONAL,
1732     IN ULONG                    Length,
1733     OUT PIO_STATUS_BLOCK        IoStatus OPTIONAL
1734 );
1735
1736 typedef VOID (*PDIRTY_PAGE_ROUTINE) (
1737     IN PFILE_OBJECT     FileObject,
1738     IN PLARGE_INTEGER   FileOffset,
1739     IN ULONG            Length,
1740     IN PLARGE_INTEGER   OldestLsn,
1741     IN PLARGE_INTEGER   NewestLsn,
1742     IN PVOID            Context1,
1743     IN PVOID            Context2
1744 );
1745
1746 NTKERNELAPI
1747 LARGE_INTEGER
1748 NTAPI
1749 CcGetDirtyPages (
1750     IN PVOID                LogHandle,
1751     IN PDIRTY_PAGE_ROUTINE  DirtyPageRoutine,
1752     IN PVOID                Context1,
1753     IN PVOID                Context2
1754 );
1755
1756 NTKERNELAPI
1757 PFILE_OBJECT
1758 NTAPI
1759 CcGetFileObjectFromBcb (
1760     IN PVOID Bcb
1761 );
1762
1763 NTKERNELAPI
1764 PFILE_OBJECT
1765 NTAPI
1766 CcGetFileObjectFromSectionPtrs (
1767     IN PSECTION_OBJECT_POINTERS SectionObjectPointer
1768 );
1769
1770 #define CcGetFileSizePointer(FO) (                                     \
1771     ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
1772 )
1773
1774 #if (VER_PRODUCTBUILD >= 2195)
1775
1776 NTKERNELAPI
1777 LARGE_INTEGER
1778 NTAPI
1779 CcGetFlushedValidData (
1780     IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
1781     IN BOOLEAN                  BcbListHeld
1782 );
1783
1784 #endif /* (VER_PRODUCTBUILD >= 2195) */
1785
1786 NTKERNELAPI
1787 LARGE_INTEGER
1788 NTAPI
1789 CcGetLsnForFileObject (
1790     IN PFILE_OBJECT     FileObject,
1791     OUT PLARGE_INTEGER  OldestLsn OPTIONAL
1792 );
1793
1794 typedef BOOLEAN (NTAPI *PACQUIRE_FOR_LAZY_WRITE) (
1795     IN PVOID    Context,
1796     IN BOOLEAN  Wait
1797 );
1798
1799 typedef VOID (NTAPI *PRELEASE_FROM_LAZY_WRITE) (
1800     IN PVOID Context
1801 );
1802
1803 typedef BOOLEAN (NTAPI *PACQUIRE_FOR_READ_AHEAD) (
1804     IN PVOID    Context,
1805     IN BOOLEAN  Wait
1806 );
1807
1808 typedef VOID (NTAPI *PRELEASE_FROM_READ_AHEAD) (
1809     IN PVOID Context
1810 );
1811
1812 typedef struct _CACHE_MANAGER_CALLBACKS {
1813     PACQUIRE_FOR_LAZY_WRITE     AcquireForLazyWrite;
1814     PRELEASE_FROM_LAZY_WRITE    ReleaseFromLazyWrite;
1815     PACQUIRE_FOR_READ_AHEAD     AcquireForReadAhead;
1816     PRELEASE_FROM_READ_AHEAD    ReleaseFromReadAhead;
1817 } CACHE_MANAGER_CALLBACKS, *PCACHE_MANAGER_CALLBACKS;
1818
1819 NTKERNELAPI
1820 VOID
1821 NTAPI
1822 CcInitializeCacheMap (
1823     IN PFILE_OBJECT             FileObject,
1824     IN PCC_FILE_SIZES           FileSizes,
1825     IN BOOLEAN                  PinAccess,
1826     IN PCACHE_MANAGER_CALLBACKS Callbacks,
1827     IN PVOID                    LazyWriteContext
1828 );
1829
1830 #define CcIsFileCached(FO) (                                                         \
1831     ((FO)->SectionObjectPointer != NULL) &&                                          \
1832     (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
1833 )
1834
1835 NTKERNELAPI
1836 BOOLEAN
1837 NTAPI
1838 CcIsThereDirtyData (
1839     IN PVPB Vpb
1840 );
1841
1842 NTKERNELAPI
1843 BOOLEAN
1844 NTAPI
1845 CcMapData (
1846     IN PFILE_OBJECT     FileObject,
1847     IN PLARGE_INTEGER   FileOffset,
1848     IN ULONG            Length,
1849     IN BOOLEAN          Wait,
1850     OUT PVOID           *Bcb,
1851     OUT PVOID           *Buffer
1852 );
1853
1854 NTKERNELAPI
1855 VOID
1856 NTAPI
1857 CcMdlRead (
1858     IN PFILE_OBJECT         FileObject,
1859     IN PLARGE_INTEGER       FileOffset,
1860     IN ULONG                Length,
1861     OUT PMDL                *MdlChain,
1862     OUT PIO_STATUS_BLOCK    IoStatus
1863 );
1864
1865 NTKERNELAPI
1866 VOID
1867 NTAPI
1868 CcMdlReadComplete (
1869     IN PFILE_OBJECT FileObject,
1870     IN PMDL         MdlChain
1871 );
1872
1873 NTKERNELAPI
1874 VOID
1875 NTAPI
1876 CcMdlWriteComplete (
1877     IN PFILE_OBJECT     FileObject,
1878     IN PLARGE_INTEGER   FileOffset,
1879     IN PMDL             MdlChain
1880 );
1881
1882 NTKERNELAPI
1883 BOOLEAN
1884 NTAPI
1885 CcPinMappedData (
1886     IN PFILE_OBJECT     FileObject,
1887     IN PLARGE_INTEGER   FileOffset,
1888     IN ULONG            Length,
1889 #if (VER_PRODUCTBUILD >= 2195)
1890     IN ULONG            Flags,
1891 #else
1892     IN BOOLEAN          Wait,
1893 #endif
1894     IN OUT PVOID        *Bcb
1895 );
1896
1897 NTKERNELAPI
1898 BOOLEAN
1899 NTAPI
1900 CcPinRead (
1901     IN PFILE_OBJECT     FileObject,
1902     IN PLARGE_INTEGER   FileOffset,
1903     IN ULONG            Length,
1904 #if (VER_PRODUCTBUILD >= 2195)
1905     IN ULONG            Flags,
1906 #else
1907     IN BOOLEAN          Wait,
1908 #endif
1909     OUT PVOID           *Bcb,
1910     OUT PVOID           *Buffer
1911 );
1912
1913 NTKERNELAPI
1914 VOID
1915 NTAPI
1916 CcPrepareMdlWrite (
1917     IN PFILE_OBJECT         FileObject,
1918     IN PLARGE_INTEGER       FileOffset,
1919     IN ULONG                Length,
1920     OUT PMDL                *MdlChain,
1921     OUT PIO_STATUS_BLOCK    IoStatus
1922 );
1923
1924 NTKERNELAPI
1925 BOOLEAN
1926 NTAPI
1927 CcPreparePinWrite (
1928     IN PFILE_OBJECT     FileObject,
1929     IN PLARGE_INTEGER   FileOffset,
1930     IN ULONG            Length,
1931     IN BOOLEAN          Zero,
1932 #if (VER_PRODUCTBUILD >= 2195)
1933     IN ULONG            Flags,
1934 #else
1935     IN BOOLEAN          Wait,
1936 #endif
1937     OUT PVOID           *Bcb,
1938     OUT PVOID           *Buffer
1939 );
1940
1941 NTKERNELAPI
1942 BOOLEAN
1943 NTAPI
1944 CcPurgeCacheSection (
1945     IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
1946     IN PLARGE_INTEGER           FileOffset OPTIONAL,
1947     IN ULONG                    Length,
1948     IN BOOLEAN                  UninitializeCacheMaps
1949 );
1950
1951 #define CcReadAhead(FO, FOFF, LEN) (                \
1952     if ((LEN) >= 256) {                             \
1953         CcScheduleReadAhead((FO), (FOFF), (LEN));   \
1954     }                                               \
1955 )
1956
1957 #if (VER_PRODUCTBUILD >= 2195)
1958
1959 NTKERNELAPI
1960 PVOID
1961 NTAPI
1962 CcRemapBcb (
1963     IN PVOID Bcb
1964 );
1965
1966 #endif /* (VER_PRODUCTBUILD >= 2195) */
1967
1968 NTKERNELAPI
1969 VOID
1970 NTAPI
1971 CcRepinBcb (
1972     IN PVOID Bcb
1973 );
1974
1975 NTKERNELAPI
1976 VOID
1977 NTAPI
1978 CcScheduleReadAhead (
1979     IN PFILE_OBJECT     FileObject,
1980     IN PLARGE_INTEGER   FileOffset,
1981     IN ULONG            Length
1982 );
1983
1984 NTKERNELAPI
1985 VOID
1986 NTAPI
1987 CcSetAdditionalCacheAttributes (
1988     IN PFILE_OBJECT FileObject,
1989     IN BOOLEAN      DisableReadAhead,
1990     IN BOOLEAN      DisableWriteBehind
1991 );
1992
1993 NTKERNELAPI
1994 VOID
1995 NTAPI
1996 CcSetBcbOwnerPointer (
1997     IN PVOID Bcb,
1998     IN PVOID OwnerPointer
1999 );
2000
2001 NTKERNELAPI
2002 VOID
2003 NTAPI
2004 CcSetDirtyPageThreshold (
2005     IN PFILE_OBJECT FileObject,
2006     IN ULONG        DirtyPageThreshold
2007 );
2008
2009 NTKERNELAPI
2010 VOID
2011 NTAPI
2012 CcSetDirtyPinnedData (
2013     IN PVOID            BcbVoid,
2014     IN PLARGE_INTEGER   Lsn OPTIONAL
2015 );
2016
2017 NTKERNELAPI
2018 VOID
2019 NTAPI
2020 CcSetFileSizes (
2021     IN PFILE_OBJECT     FileObject,
2022     IN PCC_FILE_SIZES   FileSizes
2023 );
2024
2025 typedef VOID (NTAPI *PFLUSH_TO_LSN) (
2026     IN PVOID            LogHandle,
2027     IN PLARGE_INTEGER   Lsn
2028 );
2029
2030 NTKERNELAPI
2031 VOID
2032 NTAPI
2033 CcSetLogHandleForFile (
2034     IN PFILE_OBJECT     FileObject,
2035     IN PVOID            LogHandle,
2036     IN PFLUSH_TO_LSN    FlushToLsnRoutine
2037 );
2038
2039 NTKERNELAPI
2040 VOID
2041 NTAPI
2042 CcSetReadAheadGranularity (
2043     IN PFILE_OBJECT FileObject,
2044     IN ULONG        Granularity     /* default: PAGE_SIZE */
2045                                     /* allowed: 2^n * PAGE_SIZE */
2046 );
2047
2048 NTKERNELAPI
2049 BOOLEAN
2050 NTAPI
2051 CcUninitializeCacheMap (
2052     IN PFILE_OBJECT                 FileObject,
2053     IN PLARGE_INTEGER               TruncateSize OPTIONAL,
2054     IN PCACHE_UNINITIALIZE_EVENT    UninitializeCompleteEvent OPTIONAL
2055 );
2056
2057 NTKERNELAPI
2058 VOID
2059 NTAPI
2060 CcUnpinData (
2061     IN PVOID Bcb
2062 );
2063
2064 NTKERNELAPI
2065 VOID
2066 NTAPI
2067 CcUnpinDataForThread (
2068     IN PVOID            Bcb,
2069     IN ERESOURCE_THREAD ResourceThreadId
2070 );
2071
2072 NTKERNELAPI
2073 VOID
2074 NTAPI
2075 CcUnpinRepinnedBcb (
2076     IN PVOID                Bcb,
2077     IN BOOLEAN              WriteThrough,
2078     OUT PIO_STATUS_BLOCK    IoStatus
2079 );
2080
2081 #if (VER_PRODUCTBUILD >= 2195)
2082
2083 NTKERNELAPI
2084 NTSTATUS
2085 NTAPI
2086 CcWaitForCurrentLazyWriterActivity (
2087     VOID
2088 );
2089
2090 #endif /* (VER_PRODUCTBUILD >= 2195) */
2091
2092 NTKERNELAPI
2093 BOOLEAN
2094 NTAPI
2095 CcZeroData (
2096     IN PFILE_OBJECT     FileObject,
2097     IN PLARGE_INTEGER   StartOffset,
2098     IN PLARGE_INTEGER   EndOffset,
2099     IN BOOLEAN          Wait
2100 );
2101
2102 NTKERNELAPI
2103 VOID
2104 NTAPI
2105 ExDisableResourceBoostLite (
2106     IN PERESOURCE  Resource
2107 );
2108
2109 NTKERNELAPI
2110 ULONG
2111 NTAPI
2112 ExQueryPoolBlockSize (
2113     IN PVOID      PoolBlock,
2114     OUT PBOOLEAN  QuotaCharged
2115 );
2116
2117 #if (VER_PRODUCTBUILD >= 2600)
2118
2119 NTKERNELAPI
2120 VOID
2121 FASTCALL
2122 ExInitializeRundownProtection (
2123     IN PEX_RUNDOWN_REF  RunRef
2124 );
2125
2126 NTKERNELAPI
2127 VOID
2128 FASTCALL
2129 ExReInitializeRundownProtection (
2130     IN PEX_RUNDOWN_REF  RunRef
2131 );
2132
2133 NTKERNELAPI
2134 BOOLEAN
2135 FASTCALL
2136 ExAcquireRundownProtection (
2137     IN PEX_RUNDOWN_REF  RunRef
2138 );
2139
2140 NTKERNELAPI
2141 BOOLEAN
2142 FASTCALL
2143 ExAcquireRundownProtectionEx (
2144     IN PEX_RUNDOWN_REF  RunRef,
2145     IN ULONG            Count
2146 );
2147
2148 NTKERNELAPI
2149 VOID
2150 FASTCALL
2151 ExReleaseRundownProtection (
2152     IN PEX_RUNDOWN_REF  RunRef
2153 );
2154
2155 NTKERNELAPI
2156 VOID
2157 FASTCALL
2158 ExReleaseRundownProtectionEx (
2159     IN PEX_RUNDOWN_REF  RunRef,
2160     IN ULONG            Count
2161 );
2162
2163 NTKERNELAPI
2164 VOID
2165 FASTCALL
2166 ExRundownCompleted (
2167     IN PEX_RUNDOWN_REF  RunRef
2168 );
2169
2170 NTKERNELAPI
2171 VOID
2172 FASTCALL
2173 ExWaitForRundownProtectionRelease (
2174     IN PEX_RUNDOWN_REF  RunRef
2175 );
2176
2177 #endif /* (VER_PRODUCTBUILD >= 2600) */
2178
2179 #define FlagOn(x, f) ((x) & (f))
2180
2181 NTKERNELAPI
2182 VOID
2183 NTAPI
2184 FsRtlAddToTunnelCache (
2185     IN PTUNNEL          Cache,
2186     IN ULONGLONG        DirectoryKey,
2187     IN PUNICODE_STRING  ShortName,
2188     IN PUNICODE_STRING  LongName,
2189     IN BOOLEAN          KeyByShortName,
2190     IN ULONG            DataLength,
2191     IN PVOID            Data
2192 );
2193
2194 #if (VER_PRODUCTBUILD >= 2195)
2195
2196 PFILE_LOCK
2197 NTAPI
2198 FsRtlAllocateFileLock (
2199     IN PCOMPLETE_LOCK_IRP_ROUTINE   CompleteLockIrpRoutine OPTIONAL,
2200     IN PUNLOCK_ROUTINE              UnlockRoutine OPTIONAL
2201 );
2202
2203 #endif /* (VER_PRODUCTBUILD >= 2195) */
2204
2205 NTKERNELAPI
2206 PVOID
2207 NTAPI
2208 FsRtlAllocatePool (
2209     IN POOL_TYPE    PoolType,
2210     IN ULONG        NumberOfBytes
2211 );
2212
2213 NTKERNELAPI
2214 PVOID
2215 NTAPI
2216 FsRtlAllocatePoolWithQuota (
2217     IN POOL_TYPE    PoolType,
2218     IN ULONG        NumberOfBytes
2219 );
2220
2221 NTKERNELAPI
2222 PVOID
2223 NTAPI
2224 FsRtlAllocatePoolWithQuotaTag (
2225     IN POOL_TYPE    PoolType,
2226     IN ULONG        NumberOfBytes,
2227     IN ULONG        Tag
2228 );
2229
2230 NTKERNELAPI
2231 PVOID
2232 NTAPI
2233 FsRtlAllocatePoolWithTag (
2234     IN POOL_TYPE    PoolType,
2235     IN ULONG        NumberOfBytes,
2236     IN ULONG        Tag
2237 );
2238
2239 NTKERNELAPI
2240 BOOLEAN
2241 NTAPI
2242 FsRtlAreNamesEqual (
2243     IN PUNICODE_STRING  Name1,
2244     IN PUNICODE_STRING  Name2,
2245     IN BOOLEAN          IgnoreCase,
2246     IN PWCHAR           UpcaseTable OPTIONAL
2247 );
2248
2249 #define FsRtlAreThereCurrentFileLocks(FL) ( \
2250     ((FL)->FastIoIsQuestionable)            \
2251 )
2252
2253 /*
2254   FsRtlCheckLockForReadAccess:
2255
2256   All this really does is pick out the lock parameters from the irp (io stack
2257   location?), get IoGetRequestorProcess, and pass values on to
2258   FsRtlFastCheckLockForRead.
2259 */
2260 NTKERNELAPI
2261 BOOLEAN
2262 NTAPI
2263 FsRtlCheckLockForReadAccess (
2264     IN PFILE_LOCK   FileLock,
2265     IN PIRP         Irp
2266 );
2267
2268 /*
2269   FsRtlCheckLockForWriteAccess:
2270
2271   All this really does is pick out the lock parameters from the irp (io stack
2272   location?), get IoGetRequestorProcess, and pass values on to
2273   FsRtlFastCheckLockForWrite.
2274 */
2275 NTKERNELAPI
2276 BOOLEAN
2277 NTAPI
2278 FsRtlCheckLockForWriteAccess (
2279     IN PFILE_LOCK   FileLock,
2280     IN PIRP         Irp
2281 );
2282
2283 typedef
2284 VOID
2285 (NTAPI*POPLOCK_WAIT_COMPLETE_ROUTINE) (
2286     IN PVOID    Context,
2287     IN PIRP     Irp
2288 );
2289
2290 typedef
2291 VOID
2292 (NTAPI*POPLOCK_FS_PREPOST_IRP) (
2293     IN PVOID    Context,
2294     IN PIRP     Irp
2295 );
2296
2297 NTKERNELAPI
2298 NTSTATUS
2299 NTAPI
2300 FsRtlCheckOplock (
2301     IN POPLOCK                          Oplock,
2302     IN PIRP                             Irp,
2303     IN PVOID                            Context,
2304     IN POPLOCK_WAIT_COMPLETE_ROUTINE    CompletionRoutine OPTIONAL,
2305     IN POPLOCK_FS_PREPOST_IRP           PostIrpRoutine OPTIONAL
2306 );
2307
2308 NTKERNELAPI
2309 BOOLEAN
2310 NTAPI
2311 FsRtlCopyRead (
2312     IN PFILE_OBJECT         FileObject,
2313     IN PLARGE_INTEGER       FileOffset,
2314     IN ULONG                Length,
2315     IN BOOLEAN              Wait,
2316     IN ULONG                LockKey,
2317     OUT PVOID               Buffer,
2318     OUT PIO_STATUS_BLOCK    IoStatus,
2319     IN PDEVICE_OBJECT       DeviceObject
2320 );
2321
2322 NTKERNELAPI
2323 BOOLEAN
2324 NTAPI
2325 FsRtlCopyWrite (
2326     IN PFILE_OBJECT         FileObject,
2327     IN PLARGE_INTEGER       FileOffset,
2328     IN ULONG                Length,
2329     IN BOOLEAN              Wait,
2330     IN ULONG                LockKey,
2331     IN PVOID                Buffer,
2332     OUT PIO_STATUS_BLOCK    IoStatus,
2333     IN PDEVICE_OBJECT       DeviceObject
2334 );
2335
2336 NTKERNELAPI
2337 BOOLEAN
2338 NTAPI
2339 FsRtlCurrentBatchOplock (
2340     IN POPLOCK Oplock
2341 );
2342
2343 NTKERNELAPI
2344 VOID
2345 NTAPI
2346 FsRtlDeleteKeyFromTunnelCache (
2347     IN PTUNNEL      Cache,
2348     IN ULONGLONG    DirectoryKey
2349 );
2350
2351 NTKERNELAPI
2352 VOID
2353 NTAPI
2354 FsRtlDeleteTunnelCache (
2355     IN PTUNNEL Cache
2356 );
2357
2358 NTKERNELAPI
2359 VOID
2360 NTAPI
2361 FsRtlDeregisterUncProvider (
2362     IN HANDLE Handle
2363 );
2364
2365 NTKERNELAPI
2366 VOID
2367 NTAPI
2368 FsRtlDissectDbcs (
2369     IN ANSI_STRING Name,
2370     OUT PANSI_STRING FirstPart,
2371     OUT PANSI_STRING RemainingPart
2372 );
2373
2374 NTKERNELAPI
2375 VOID
2376 NTAPI
2377 FsRtlDissectName (
2378     IN UNICODE_STRING Name,
2379     OUT PUNICODE_STRING FirstPart,
2380     OUT PUNICODE_STRING RemainingPart
2381 );
2382
2383 NTKERNELAPI
2384 BOOLEAN
2385 NTAPI
2386 FsRtlDoesDbcsContainWildCards (
2387     IN PANSI_STRING Name
2388 );
2389
2390 NTKERNELAPI
2391 BOOLEAN
2392 NTAPI
2393 FsRtlDoesNameContainWildCards (
2394     IN PUNICODE_STRING Name
2395 );
2396
2397 #define FsRtlEnterFileSystem    KeEnterCriticalRegion
2398
2399 #define FsRtlExitFileSystem     KeLeaveCriticalRegion
2400
2401 NTKERNELAPI
2402 BOOLEAN
2403 NTAPI
2404 FsRtlFastCheckLockForRead (
2405     IN PFILE_LOCK           FileLock,
2406     IN PLARGE_INTEGER       FileOffset,
2407     IN PLARGE_INTEGER       Length,
2408     IN ULONG                Key,
2409     IN PFILE_OBJECT         FileObject,
2410     IN PEPROCESS            Process
2411 );
2412
2413 NTKERNELAPI
2414 BOOLEAN
2415 NTAPI
2416 FsRtlFastCheckLockForWrite (
2417     IN PFILE_LOCK           FileLock,
2418     IN PLARGE_INTEGER       FileOffset,
2419     IN PLARGE_INTEGER       Length,
2420     IN ULONG                Key,
2421     IN PFILE_OBJECT         FileObject,
2422     IN PEPROCESS            Process
2423 );
2424
2425 #define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) (       \
2426      FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11)   \
2427 )
2428
2429 NTKERNELAPI
2430 NTSTATUS
2431 NTAPI
2432 FsRtlFastUnlockAll (
2433     IN PFILE_LOCK           FileLock,
2434     IN PFILE_OBJECT         FileObject,
2435     IN PEPROCESS            Process,
2436     IN PVOID                Context OPTIONAL
2437 );
2438 /* ret: STATUS_RANGE_NOT_LOCKED */
2439
2440 NTKERNELAPI
2441 NTSTATUS
2442 NTAPI
2443 FsRtlFastUnlockAllByKey (
2444     IN PFILE_LOCK           FileLock,
2445     IN PFILE_OBJECT         FileObject,
2446     IN PEPROCESS            Process,
2447     IN ULONG                Key,
2448     IN PVOID                Context OPTIONAL
2449 );
2450 /* ret: STATUS_RANGE_NOT_LOCKED */
2451
2452 NTKERNELAPI
2453 NTSTATUS
2454 NTAPI
2455 FsRtlFastUnlockSingle (
2456     IN PFILE_LOCK           FileLock,
2457     IN PFILE_OBJECT         FileObject,
2458     IN PLARGE_INTEGER       FileOffset,
2459     IN PLARGE_INTEGER       Length,
2460     IN PEPROCESS            Process,
2461     IN ULONG                Key,
2462     IN PVOID                Context OPTIONAL,
2463     IN BOOLEAN              AlreadySynchronized
2464 );
2465 /* ret:  STATUS_RANGE_NOT_LOCKED */
2466
2467 NTKERNELAPI
2468 BOOLEAN
2469 NTAPI
2470 FsRtlFindInTunnelCache (
2471     IN PTUNNEL          Cache,
2472     IN ULONGLONG        DirectoryKey,
2473     IN PUNICODE_STRING  Name,
2474     OUT PUNICODE_STRING ShortName,
2475     OUT PUNICODE_STRING LongName,
2476     IN OUT PULONG       DataLength,
2477     OUT PVOID           Data
2478 );
2479
2480 #if (VER_PRODUCTBUILD >= 2195)
2481
2482 NTKERNELAPI
2483 VOID
2484 NTAPI
2485 FsRtlFreeFileLock (
2486     IN PFILE_LOCK FileLock
2487 );
2488
2489 #endif /* (VER_PRODUCTBUILD >= 2195) */
2490
2491 NTKERNELAPI
2492 NTSTATUS
2493 NTAPI
2494 FsRtlGetFileSize (
2495     IN PFILE_OBJECT         FileObject,
2496     IN OUT PLARGE_INTEGER   FileSize
2497 );
2498
2499 /*
2500   FsRtlGetNextFileLock:
2501
2502   ret: NULL if no more locks
2503
2504   Internals:
2505     FsRtlGetNextFileLock uses FileLock->LastReturnedLockInfo and
2506     FileLock->LastReturnedLock as storage.
2507     LastReturnedLock is a pointer to the 'raw' lock inkl. double linked
2508     list, and FsRtlGetNextFileLock needs this to get next lock on subsequent
2509     calls with Restart = FALSE.
2510 */
2511 NTKERNELAPI
2512 PFILE_LOCK_INFO
2513 NTAPI
2514 FsRtlGetNextFileLock (
2515     IN PFILE_LOCK   FileLock,
2516     IN BOOLEAN      Restart
2517 );
2518
2519 NTKERNELAPI
2520 VOID
2521 NTAPI
2522 FsRtlInitializeFileLock (
2523     IN PFILE_LOCK                   FileLock,
2524     IN PCOMPLETE_LOCK_IRP_ROUTINE   CompleteLockIrpRoutine OPTIONAL,
2525     IN PUNLOCK_ROUTINE              UnlockRoutine OPTIONAL
2526 );
2527
2528 NTKERNELAPI
2529 VOID
2530 NTAPI
2531 FsRtlInitializeOplock (
2532     IN OUT POPLOCK Oplock
2533 );
2534
2535 NTKERNELAPI
2536 VOID
2537 NTAPI
2538 FsRtlInitializeTunnelCache (
2539     IN PTUNNEL Cache
2540 );
2541
2542 NTKERNELAPI
2543 BOOLEAN
2544 NTAPI
2545 FsRtlIsNameInExpression (
2546     IN PUNICODE_STRING  Expression,
2547     IN PUNICODE_STRING  Name,
2548     IN BOOLEAN          IgnoreCase,
2549     IN PWCHAR           UpcaseTable OPTIONAL
2550 );
2551
2552 NTKERNELAPI
2553 BOOLEAN
2554 NTAPI
2555 FsRtlIsNtstatusExpected (
2556     IN NTSTATUS Ntstatus
2557 );
2558
2559 #define FsRtlIsLeadDbcsCharacter(DBCS_CHAR) (                               \
2560     (BOOLEAN)((UCHAR)(DBCS_CHAR) < 0x80 ? FALSE :                           \
2561               (NLS_MB_CODE_PAGE_TAG &&                                      \
2562                (NLS_OEM_LEAD_BYTE_INFO[(UCHAR)(DBCS_CHAR)] != 0)))          \
2563 )
2564
2565 #define FsRtlIsAnsiCharacterWild(C) (                                       \
2566     FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], FSRTL_WILD_CHARACTER ) \
2567 )
2568
2569 #define FsRtlIsUnicodeCharacterWild(C) (                                    \
2570     (((C) >= 0x40) ?                                                        \
2571     FALSE :                                                                 \
2572     FlagOn(FsRtlLegalAnsiCharacterArray[(C)], FSRTL_WILD_CHARACTER ))       \
2573 )
2574
2575 NTKERNELAPI
2576 BOOLEAN
2577 NTAPI
2578 FsRtlMdlReadDev (
2579     IN PFILE_OBJECT       FileObject,
2580     IN PLARGE_INTEGER     FileOffset,
2581     IN ULONG              Length,
2582     IN ULONG              LockKey,
2583     OUT PMDL              *MdlChain,
2584     OUT PIO_STATUS_BLOCK  IoStatus,
2585     IN PDEVICE_OBJECT     DeviceObject
2586 );
2587
2588 NTKERNELAPI
2589 BOOLEAN
2590 NTAPI
2591 FsRtlMdlReadComplete (
2592     IN PFILE_OBJECT     FileObject,
2593     IN PMDL             MdlChain
2594 );
2595
2596 NTKERNELAPI
2597 BOOLEAN
2598 NTAPI
2599 FsRtlMdlReadCompleteDev (
2600     IN PFILE_OBJECT     FileObject,
2601     IN PMDL             MdlChain,
2602     IN PDEVICE_OBJECT   DeviceObject
2603 );
2604
2605 NTKERNELAPI
2606 BOOLEAN
2607 NTAPI
2608 FsRtlPrepareMdlWriteDev (
2609     IN PFILE_OBJECT       FileObject,
2610     IN PLARGE_INTEGER     FileOffset,
2611     IN ULONG              Length,
2612     IN ULONG              LockKey,
2613     OUT PMDL              *MdlChain,
2614     OUT PIO_STATUS_BLOCK  IoStatus,
2615     IN PDEVICE_OBJECT     DeviceObject
2616 );
2617
2618 NTKERNELAPI
2619 BOOLEAN
2620 NTAPI
2621 FsRtlMdlWriteComplete (
2622     IN PFILE_OBJECT     FileObject,
2623     IN PLARGE_INTEGER   FileOffset,
2624     IN PMDL             MdlChain
2625 );
2626
2627 NTKERNELAPI
2628 BOOLEAN
2629 NTAPI
2630 FsRtlMdlWriteCompleteDev (
2631     IN PFILE_OBJECT     FileObject,
2632     IN PLARGE_INTEGER   FileOffset,
2633     IN PMDL             MdlChain,
2634     IN PDEVICE_OBJECT   DeviceObject
2635 );
2636
2637 NTKERNELAPI
2638 NTSTATUS
2639 NTAPI
2640 FsRtlNormalizeNtstatus (
2641     IN NTSTATUS Exception,
2642     IN NTSTATUS GenericException
2643 );
2644
2645 NTKERNELAPI
2646 VOID
2647 NTAPI
2648 FsRtlNotifyChangeDirectory (
2649     IN PNOTIFY_SYNC NotifySync,
2650     IN PVOID        FsContext,
2651     IN PSTRING      FullDirectoryName,
2652     IN PLIST_ENTRY  NotifyList,
2653     IN BOOLEAN      WatchTree,
2654     IN ULONG        CompletionFilter,
2655     IN PIRP         NotifyIrp
2656 );
2657
2658 NTKERNELAPI
2659 VOID
2660 NTAPI
2661 FsRtlNotifyCleanup (
2662     IN PNOTIFY_SYNC NotifySync,
2663     IN PLIST_ENTRY  NotifyList,
2664     IN PVOID        FsContext
2665 );
2666
2667 typedef BOOLEAN (*PCHECK_FOR_TRAVERSE_ACCESS) (
2668     IN PVOID                        NotifyContext,
2669     IN PVOID                        TargetContext,
2670     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext
2671 );
2672
2673 NTKERNELAPI
2674 VOID
2675 NTAPI
2676 FsRtlNotifyFullChangeDirectory (
2677     IN PNOTIFY_SYNC                 NotifySync,
2678     IN PLIST_ENTRY                  NotifyList,
2679     IN PVOID                        FsContext,
2680     IN PSTRING                      FullDirectoryName,
2681     IN BOOLEAN                      WatchTree,
2682     IN BOOLEAN                      IgnoreBuffer,
2683     IN ULONG                        CompletionFilter,
2684     IN PIRP                         NotifyIrp,
2685     IN PCHECK_FOR_TRAVERSE_ACCESS   TraverseCallback OPTIONAL,
2686     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext OPTIONAL
2687 );
2688
2689 NTKERNELAPI
2690 VOID
2691 NTAPI
2692 FsRtlNotifyFullReportChange (
2693     IN PNOTIFY_SYNC NotifySync,
2694     IN PLIST_ENTRY  NotifyList,
2695     IN PSTRING      FullTargetName,
2696     IN USHORT       TargetNameOffset,
2697     IN PSTRING      StreamName OPTIONAL,
2698     IN PSTRING      NormalizedParentName OPTIONAL,
2699     IN ULONG        FilterMatch,
2700     IN ULONG        Action,
2701     IN PVOID        TargetContext
2702 );
2703
2704 NTKERNELAPI
2705 VOID
2706 NTAPI
2707 FsRtlNotifyInitializeSync (
2708     IN PNOTIFY_SYNC *NotifySync
2709 );
2710
2711 NTKERNELAPI
2712 VOID
2713 NTAPI
2714 FsRtlNotifyReportChange (
2715     IN PNOTIFY_SYNC NotifySync,
2716     IN PLIST_ENTRY  NotifyList,
2717     IN PSTRING      FullTargetName,
2718     IN PUSHORT      FileNamePartLength,
2719     IN ULONG        FilterMatch
2720 );
2721
2722 NTKERNELAPI
2723 VOID
2724 NTAPI
2725 FsRtlNotifyUninitializeSync (
2726     IN PNOTIFY_SYNC *NotifySync
2727 );
2728
2729 #if (VER_PRODUCTBUILD >= 2195)
2730
2731 NTKERNELAPI
2732 NTSTATUS
2733 NTAPI
2734 FsRtlNotifyVolumeEvent (
2735     IN PFILE_OBJECT FileObject,
2736     IN ULONG        EventCode
2737 );
2738
2739 #endif /* (VER_PRODUCTBUILD >= 2195) */
2740
2741 NTKERNELAPI
2742 NTSTATUS
2743 NTAPI
2744 FsRtlOplockFsctrl (
2745     IN POPLOCK  Oplock,
2746     IN PIRP     Irp,
2747     IN ULONG    OpenCount
2748 );
2749
2750 NTKERNELAPI
2751 BOOLEAN
2752 NTAPI
2753 FsRtlOplockIsFastIoPossible (
2754     IN POPLOCK Oplock
2755 );
2756
2757 /*
2758   FsRtlPrivateLock:
2759
2760   ret: IoStatus->Status: STATUS_PENDING, STATUS_LOCK_NOT_GRANTED
2761
2762   Internals:
2763     -Calls IoCompleteRequest if Irp
2764     -Uses exception handling / ExRaiseStatus with STATUS_INSUFFICIENT_RESOURCES
2765 */
2766 NTKERNELAPI
2767 BOOLEAN
2768 NTAPI
2769 FsRtlPrivateLock (
2770     IN PFILE_LOCK           FileLock,
2771     IN PFILE_OBJECT         FileObject,
2772     IN PLARGE_INTEGER       FileOffset,
2773     IN PLARGE_INTEGER       Length,
2774     IN PEPROCESS            Process,
2775     IN ULONG                Key,
2776     IN BOOLEAN              FailImmediately,
2777     IN BOOLEAN              ExclusiveLock,
2778     OUT PIO_STATUS_BLOCK    IoStatus,
2779     IN PIRP                 Irp OPTIONAL,
2780     IN PVOID                Context,
2781     IN BOOLEAN              AlreadySynchronized
2782 );
2783
2784 /*
2785   FsRtlProcessFileLock:
2786
2787   ret:
2788     -STATUS_INVALID_DEVICE_REQUEST
2789     -STATUS_RANGE_NOT_LOCKED from unlock routines.
2790     -STATUS_PENDING, STATUS_LOCK_NOT_GRANTED from FsRtlPrivateLock
2791     (redirected IoStatus->Status).
2792
2793   Internals:
2794     -switch ( Irp->CurrentStackLocation->MinorFunction )
2795         lock: return FsRtlPrivateLock;
2796         unlocksingle: return FsRtlFastUnlockSingle;
2797         unlockall: return FsRtlFastUnlockAll;
2798         unlockallbykey: return FsRtlFastUnlockAllByKey;
2799         default: IofCompleteRequest with STATUS_INVALID_DEVICE_REQUEST;
2800                  return STATUS_INVALID_DEVICE_REQUEST;
2801
2802     -'AllwaysZero' is passed thru as 'AllwaysZero' to lock / unlock routines.
2803     -'Irp' is passet thru as 'Irp' to FsRtlPrivateLock.
2804 */
2805 NTKERNELAPI
2806 NTSTATUS
2807 NTAPI
2808 FsRtlProcessFileLock (
2809     IN PFILE_LOCK   FileLock,
2810     IN PIRP         Irp,
2811     IN PVOID        Context OPTIONAL
2812 );
2813
2814 NTKERNELAPI
2815 NTSTATUS
2816 NTAPI
2817 FsRtlRegisterUncProvider (
2818     IN OUT PHANDLE      MupHandle,
2819     IN PUNICODE_STRING  RedirectorDeviceName,
2820     IN BOOLEAN          MailslotsSupported
2821 );
2822
2823 typedef VOID
2824 (NTAPI *PFSRTL_STACK_OVERFLOW_ROUTINE) (
2825     IN PVOID    Context,
2826     IN PKEVENT  Event
2827 );
2828
2829 NTKERNELAPI
2830 VOID
2831 NTAPI
2832 FsRtlPostStackOverflow (
2833     IN PVOID                          Context,
2834     IN PKEVENT                        Event,
2835     IN PFSRTL_STACK_OVERFLOW_ROUTINE  StackOverflowRoutine
2836 );
2837
2838 NTKERNELAPI
2839 VOID
2840 NTAPI
2841 FsRtlPostPagingFileStackOverflow (
2842     IN PVOID                          Context,
2843     IN PKEVENT                        Event,
2844     IN PFSRTL_STACK_OVERFLOW_ROUTINE  StackOverflowRoutine
2845 );
2846
2847 NTKERNELAPI
2848 VOID
2849 NTAPI
2850 FsRtlUninitializeFileLock (
2851     IN PFILE_LOCK FileLock
2852 );
2853
2854 NTKERNELAPI
2855 VOID
2856 NTAPI
2857 FsRtlUninitializeOplock (
2858     IN OUT POPLOCK Oplock
2859 );
2860
2861 NTSYSAPI
2862 VOID
2863 NTAPI
2864 HalDisplayString (
2865     IN PCHAR String
2866 );
2867
2868 NTSYSAPI
2869 VOID
2870 NTAPI
2871 HalQueryRealTimeClock (
2872     IN OUT PTIME_FIELDS TimeFields
2873 );
2874
2875 NTSYSAPI
2876 VOID
2877 NTAPI
2878 HalSetRealTimeClock (
2879     IN PTIME_FIELDS TimeFields
2880 );
2881
2882 NTKERNELAPI
2883 NTSTATUS
2884 NTAPI
2885 IoAttachDeviceToDeviceStackSafe(
2886     IN PDEVICE_OBJECT   SourceDevice,
2887     IN PDEVICE_OBJECT   TargetDevice,
2888     OUT PDEVICE_OBJECT  *AttachedToDeviceObject
2889 );
2890
2891 NTKERNELAPI
2892 VOID
2893 NTAPI
2894 IoAcquireVpbSpinLock (
2895     OUT PKIRQL Irql
2896 );
2897
2898 NTKERNELAPI
2899 NTSTATUS
2900 NTAPI
2901 IoCheckDesiredAccess (
2902     IN OUT PACCESS_MASK DesiredAccess,
2903     IN ACCESS_MASK      GrantedAccess
2904 );
2905
2906 NTKERNELAPI
2907 NTSTATUS
2908 NTAPI
2909 IoCheckEaBufferValidity (
2910     IN PFILE_FULL_EA_INFORMATION    EaBuffer,
2911     IN ULONG                        EaLength,
2912     OUT PULONG                      ErrorOffset
2913 );
2914
2915 NTKERNELAPI
2916 NTSTATUS
2917 NTAPI
2918 IoCheckFunctionAccess (
2919     IN ACCESS_MASK              GrantedAccess,
2920     IN UCHAR                    MajorFunction,
2921     IN UCHAR                    MinorFunction,
2922     IN ULONG                    IoControlCode,
2923     IN PVOID                    Argument1 OPTIONAL,
2924     IN PVOID                    Argument2 OPTIONAL
2925 );
2926
2927 #if (VER_PRODUCTBUILD >= 2195)
2928
2929 NTKERNELAPI
2930 NTSTATUS
2931 NTAPI
2932 IoCheckQuotaBufferValidity (
2933     IN PFILE_QUOTA_INFORMATION  QuotaBuffer,
2934     IN ULONG                    QuotaLength,
2935     OUT PULONG                  ErrorOffset
2936 );
2937
2938 #endif /* (VER_PRODUCTBUILD >= 2195) */
2939
2940 NTKERNELAPI
2941 PFILE_OBJECT
2942 NTAPI
2943 IoCreateStreamFileObject (
2944     IN PFILE_OBJECT     FileObject OPTIONAL,
2945     IN PDEVICE_OBJECT   DeviceObject OPTIONAL
2946 );
2947
2948 #if (VER_PRODUCTBUILD >= 2195)
2949
2950 NTKERNELAPI
2951 PFILE_OBJECT
2952 NTAPI
2953 IoCreateStreamFileObjectLite (
2954     IN PFILE_OBJECT     FileObject OPTIONAL,
2955     IN PDEVICE_OBJECT   DeviceObject OPTIONAL
2956 );
2957
2958 #endif /* (VER_PRODUCTBUILD >= 2195) */
2959
2960 NTKERNELAPI
2961 BOOLEAN
2962 NTAPI
2963 IoFastQueryNetworkAttributes (
2964     IN POBJECT_ATTRIBUTES               ObjectAttributes,
2965     IN ACCESS_MASK                      DesiredAccess,
2966     IN ULONG                            OpenOptions,
2967     OUT PIO_STATUS_BLOCK                IoStatus,
2968     OUT PFILE_NETWORK_OPEN_INFORMATION  Buffer
2969 );
2970
2971 NTKERNELAPI
2972 PDEVICE_OBJECT
2973 NTAPI
2974 IoGetAttachedDevice (
2975     IN PDEVICE_OBJECT DeviceObject
2976 );
2977
2978 NTKERNELAPI
2979 PDEVICE_OBJECT
2980 NTAPI
2981 IoGetBaseFileSystemDeviceObject (
2982     IN PFILE_OBJECT FileObject
2983 );
2984
2985 NTKERNELAPI
2986 PEPROCESS
2987 NTAPI
2988 IoGetRequestorProcess (
2989     IN PIRP Irp
2990 );
2991
2992 #if (VER_PRODUCTBUILD >= 2195)
2993
2994 NTKERNELAPI
2995 ULONG
2996 NTAPI
2997 IoGetRequestorProcessId (
2998     IN PIRP Irp
2999 );
3000
3001 #endif /* (VER_PRODUCTBUILD >= 2195) */
3002
3003 NTKERNELAPI
3004 PIRP
3005 NTAPI
3006 IoGetTopLevelIrp (
3007     VOID
3008 );
3009
3010 #define IoIsFileOpenedExclusively(FileObject) ( \
3011     (BOOLEAN) !(                                \
3012     (FileObject)->SharedRead ||                 \
3013     (FileObject)->SharedWrite ||                \
3014     (FileObject)->SharedDelete                  \
3015     )                                           \
3016 )
3017
3018 NTKERNELAPI
3019 BOOLEAN
3020 NTAPI
3021 IoIsOperationSynchronous (
3022     IN PIRP Irp
3023 );
3024
3025 NTKERNELAPI
3026 BOOLEAN
3027 NTAPI
3028 IoIsSystemThread (
3029     IN PETHREAD Thread
3030 );
3031
3032 #if (VER_PRODUCTBUILD >= 2195)
3033
3034 NTKERNELAPI
3035 BOOLEAN
3036 NTAPI
3037 IoIsValidNameGraftingBuffer (
3038     IN PIRP                 Irp,
3039     IN PREPARSE_DATA_BUFFER ReparseBuffer
3040 );
3041
3042 #endif /* (VER_PRODUCTBUILD >= 2195) */
3043
3044 NTKERNELAPI
3045 NTSTATUS
3046 NTAPI
3047 IoPageRead (
3048     IN PFILE_OBJECT         FileObject,
3049     IN PMDL                 Mdl,
3050     IN PLARGE_INTEGER       Offset,
3051     IN PKEVENT              Event,
3052     OUT PIO_STATUS_BLOCK    IoStatusBlock
3053 );
3054
3055 NTKERNELAPI
3056 NTSTATUS
3057 NTAPI
3058 IoQueryFileInformation (
3059     IN PFILE_OBJECT             FileObject,
3060     IN FILE_INFORMATION_CLASS   FileInformationClass,
3061     IN ULONG                    Length,
3062     OUT PVOID                   FileInformation,
3063     OUT PULONG                  ReturnedLength
3064 );
3065
3066 NTKERNELAPI
3067 NTSTATUS
3068 NTAPI
3069 IoQueryVolumeInformation (
3070     IN PFILE_OBJECT         FileObject,
3071     IN FS_INFORMATION_CLASS FsInformationClass,
3072     IN ULONG                Length,
3073     OUT PVOID               FsInformation,
3074     OUT PULONG              ReturnedLength
3075 );
3076
3077 NTKERNELAPI
3078 VOID
3079 NTAPI
3080 IoQueueThreadIrp(
3081     IN PIRP Irp
3082 );
3083
3084 NTKERNELAPI
3085 VOID
3086 NTAPI
3087 IoRegisterFileSystem (
3088     IN OUT PDEVICE_OBJECT DeviceObject
3089 );
3090
3091 #if (VER_PRODUCTBUILD >= 1381)
3092
3093 typedef VOID (NTAPI *PDRIVER_FS_NOTIFICATION) (
3094     IN PDEVICE_OBJECT DeviceObject,
3095     IN BOOLEAN        DriverActive
3096 );
3097
3098 NTKERNELAPI
3099 NTSTATUS
3100 NTAPI
3101 IoRegisterFsRegistrationChange (
3102     IN PDRIVER_OBJECT           DriverObject,
3103     IN PDRIVER_FS_NOTIFICATION  DriverNotificationRoutine
3104 );
3105
3106 #endif /* (VER_PRODUCTBUILD >= 1381) */
3107
3108 NTKERNELAPI
3109 VOID
3110 NTAPI
3111 IoReleaseVpbSpinLock (
3112     IN KIRQL Irql
3113 );
3114
3115 NTKERNELAPI
3116 VOID
3117 NTAPI
3118 IoSetDeviceToVerify (
3119     IN PETHREAD         Thread,
3120     IN PDEVICE_OBJECT   DeviceObject
3121 );
3122
3123 NTKERNELAPI
3124 NTSTATUS
3125 NTAPI
3126 IoSetInformation (
3127     IN PFILE_OBJECT             FileObject,
3128     IN FILE_INFORMATION_CLASS   FileInformationClass,
3129     IN ULONG                    Length,
3130     IN PVOID                    FileInformation
3131 );
3132
3133 NTKERNELAPI
3134 VOID
3135 NTAPI
3136 IoSetTopLevelIrp (
3137     IN PIRP Irp
3138 );
3139
3140 NTKERNELAPI
3141 NTSTATUS
3142 NTAPI
3143 IoSynchronousPageWrite (
3144     IN PFILE_OBJECT         FileObject,
3145     IN PMDL                 Mdl,
3146     IN PLARGE_INTEGER       FileOffset,
3147     IN PKEVENT              Event,
3148     OUT PIO_STATUS_BLOCK    IoStatusBlock
3149 );
3150
3151 NTKERNELAPI
3152 PEPROCESS
3153 NTAPI
3154 IoThreadToProcess (
3155     IN PETHREAD Thread
3156 );
3157
3158 NTKERNELAPI
3159 VOID
3160 NTAPI
3161 IoUnregisterFileSystem (
3162     IN OUT PDEVICE_OBJECT DeviceObject
3163 );
3164
3165 #if (VER_PRODUCTBUILD >= 1381)
3166
3167 NTKERNELAPI
3168 VOID
3169 NTAPI
3170 IoUnregisterFsRegistrationChange (
3171     IN PDRIVER_OBJECT           DriverObject,
3172     IN PDRIVER_FS_NOTIFICATION  DriverNotificationRoutine
3173 );
3174
3175 #endif /* (VER_PRODUCTBUILD >= 1381) */
3176
3177 NTKERNELAPI
3178 NTSTATUS
3179 NTAPI
3180 IoVerifyVolume (
3181     IN PDEVICE_OBJECT   DeviceObject,
3182     IN BOOLEAN          AllowRawMount
3183 );
3184
3185 NTKERNELAPI
3186 VOID
3187 NTAPI
3188 KeAttachProcess (
3189     IN PKPROCESS Process
3190 );
3191
3192 NTKERNELAPI
3193 VOID
3194 NTAPI
3195 KeDetachProcess (
3196     VOID
3197 );
3198
3199 NTKERNELAPI
3200 VOID
3201 NTAPI
3202 KeInitializeQueue (
3203     IN PRKQUEUE Queue,
3204     IN ULONG    Count OPTIONAL
3205 );
3206
3207 NTKERNELAPI
3208 LONG
3209 NTAPI
3210 KeInsertHeadQueue (
3211     IN PRKQUEUE     Queue,
3212     IN PLIST_ENTRY  Entry
3213 );
3214
3215 NTKERNELAPI
3216 LONG
3217 NTAPI
3218 KeInsertQueue (
3219     IN PRKQUEUE     Queue,
3220     IN PLIST_ENTRY  Entry
3221 );
3222
3223 NTKERNELAPI
3224 BOOLEAN
3225 NTAPI
3226 KeInsertQueueApc (
3227     IN PKAPC      Apc,
3228     IN PVOID      SystemArgument1,
3229     IN PVOID      SystemArgument2,
3230     IN KPRIORITY  PriorityBoost
3231 );
3232
3233 NTKERNELAPI
3234 LONG
3235 NTAPI
3236 KeReadStateQueue (
3237     IN PRKQUEUE Queue
3238 );
3239
3240 NTKERNELAPI
3241 PLIST_ENTRY
3242 NTAPI
3243 KeRemoveQueue (
3244     IN PRKQUEUE         Queue,
3245     IN KPROCESSOR_MODE  WaitMode,
3246     IN PLARGE_INTEGER   Timeout OPTIONAL
3247 );
3248
3249 NTKERNELAPI
3250 PLIST_ENTRY
3251 NTAPI
3252 KeRundownQueue (
3253     IN PRKQUEUE Queue
3254 );
3255
3256 NTKERNELAPI
3257 VOID
3258 NTAPI
3259 KeInitializeMutant (
3260     IN PRKMUTANT  Mutant,
3261     IN BOOLEAN    InitialOwner
3262 );
3263
3264 NTKERNELAPI
3265 LONG
3266 NTAPI
3267 KeReadStateMutant (
3268     IN PRKMUTANT  Mutant
3269 );
3270
3271 NTKERNELAPI
3272 LONG
3273 NTAPI
3274 KeReleaseMutant (
3275     IN PRKMUTANT  Mutant,
3276     IN KPRIORITY  Increment,
3277     IN BOOLEAN    Abandoned,
3278     IN BOOLEAN    Wait
3279 );
3280
3281 #if (VER_PRODUCTBUILD >= 2195)
3282
3283 NTKERNELAPI
3284 VOID
3285 NTAPI
3286 KeStackAttachProcess (
3287     IN PKPROCESS    Process,
3288     OUT PKAPC_STATE ApcState
3289 );
3290
3291 NTKERNELAPI
3292 VOID
3293 NTAPI
3294 KeUnstackDetachProcess (
3295     IN PKAPC_STATE ApcState
3296 );
3297
3298 #endif /* (VER_PRODUCTBUILD >= 2195) */
3299
3300 NTKERNELAPI
3301 BOOLEAN
3302 NTAPI
3303 MmCanFileBeTruncated (
3304     IN PSECTION_OBJECT_POINTERS     SectionObjectPointer,
3305     IN PLARGE_INTEGER               NewFileSize
3306 );
3307
3308 NTKERNELAPI
3309 BOOLEAN
3310 NTAPI
3311 MmFlushImageSection (
3312     IN PSECTION_OBJECT_POINTERS     SectionObjectPointer,
3313     IN MMFLUSH_TYPE                 FlushType
3314 );
3315
3316 NTKERNELAPI
3317 BOOLEAN
3318 NTAPI
3319 MmForceSectionClosed (
3320     IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
3321     IN BOOLEAN                  DelayClose
3322 );
3323
3324 #if (VER_PRODUCTBUILD >= 1381)
3325
3326 NTKERNELAPI
3327 BOOLEAN
3328 NTAPI
3329 MmIsRecursiveIoFault (
3330     VOID
3331 );
3332
3333 #else
3334
3335 #define MmIsRecursiveIoFault() (                            \
3336     (PsGetCurrentThread()->DisablePageFaultClustering) |    \
3337     (PsGetCurrentThread()->ForwardClusterOnly)              \
3338 )
3339
3340 #endif
3341
3342 NTKERNELAPI
3343 NTSTATUS
3344 NTAPI
3345 MmMapViewOfSection (
3346     IN PVOID                SectionObject,
3347     IN PEPROCESS            Process,
3348     IN OUT PVOID            *BaseAddress,
3349     IN ULONG                ZeroBits,
3350     IN ULONG                CommitSize,
3351     IN OUT PLARGE_INTEGER   SectionOffset OPTIONAL,
3352     IN OUT PULONG           ViewSize,
3353     IN SECTION_INHERIT      InheritDisposition,
3354     IN ULONG                AllocationType,
3355     IN ULONG                Protect
3356 );
3357
3358 NTKERNELAPI
3359 BOOLEAN
3360 NTAPI
3361 MmSetAddressRangeModified (
3362     IN PVOID    Address,
3363     IN ULONG    Length
3364 );
3365
3366 NTKERNELAPI
3367 NTSTATUS
3368 NTAPI
3369 ObCreateObject (
3370     IN KPROCESSOR_MODE      ObjectAttributesAccessMode OPTIONAL,
3371     IN POBJECT_TYPE         ObjectType,
3372     IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
3373     IN KPROCESSOR_MODE      AccessMode,
3374     IN OUT PVOID            ParseContext OPTIONAL,
3375     IN ULONG                ObjectSize,
3376     IN ULONG                PagedPoolCharge OPTIONAL,
3377     IN ULONG                NonPagedPoolCharge OPTIONAL,
3378     OUT PVOID               *Object
3379 );
3380
3381 NTKERNELAPI
3382 ULONG
3383 NTAPI
3384 ObGetObjectPointerCount (
3385     IN PVOID Object
3386 );
3387
3388 NTKERNELAPI
3389 NTSTATUS
3390 NTAPI
3391 ObInsertObject (
3392     IN PVOID            Object,
3393     IN PACCESS_STATE    PassedAccessState OPTIONAL,
3394     IN ACCESS_MASK      DesiredAccess,
3395     IN ULONG            AdditionalReferences,
3396     OUT PVOID           *ReferencedObject OPTIONAL,
3397     OUT PHANDLE         Handle
3398 );
3399
3400 NTKERNELAPI
3401 VOID
3402 NTAPI
3403 ObMakeTemporaryObject (
3404     IN PVOID Object
3405 );
3406
3407 NTKERNELAPI
3408 NTSTATUS
3409 NTAPI
3410 ObOpenObjectByPointer (
3411     IN PVOID            Object,
3412     IN ULONG            HandleAttributes,
3413     IN PACCESS_STATE    PassedAccessState OPTIONAL,
3414     IN ACCESS_MASK      DesiredAccess OPTIONAL,
3415     IN POBJECT_TYPE     ObjectType OPTIONAL,
3416     IN KPROCESSOR_MODE  AccessMode,
3417     OUT PHANDLE         Handle
3418 );
3419
3420 NTKERNELAPI
3421 NTSTATUS
3422 NTAPI
3423 ObQueryNameString (
3424     IN PVOID                        Object,
3425     OUT POBJECT_NAME_INFORMATION    ObjectNameInfo,
3426     IN ULONG                        Length,
3427     OUT PULONG                      ReturnLength
3428 );
3429
3430 NTKERNELAPI
3431 NTSTATUS
3432 NTAPI
3433 ObQueryObjectAuditingByHandle (
3434     IN HANDLE       Handle,
3435     OUT PBOOLEAN    GenerateOnClose
3436 );
3437
3438 NTKERNELAPI
3439 NTSTATUS
3440 NTAPI
3441 ObReferenceObjectByName (
3442     IN PUNICODE_STRING  ObjectName,
3443     IN ULONG            Attributes,
3444     IN PACCESS_STATE    PassedAccessState OPTIONAL,
3445     IN ACCESS_MASK      DesiredAccess OPTIONAL,
3446     IN POBJECT_TYPE     ObjectType,
3447     IN KPROCESSOR_MODE  AccessMode,
3448     IN OUT PVOID        ParseContext OPTIONAL,
3449     OUT PVOID           *Object
3450 );
3451
3452 NTKERNELAPI
3453 NTSTATUS
3454 NTAPI
3455 PsAssignImpersonationToken (
3456     IN PETHREAD     Thread,
3457     IN HANDLE       Token
3458 );
3459
3460 NTKERNELAPI
3461 VOID
3462 NTAPI
3463 PsChargePoolQuota (
3464     IN PEPROCESS    Process,
3465     IN POOL_TYPE    PoolType,
3466     IN ULONG        Amount
3467 );
3468
3469 NTKERNELAPI
3470 NTSTATUS
3471 NTAPI
3472 PsChargeProcessPoolQuota (
3473     IN PEPROCESS    Process,
3474     IN POOL_TYPE    PoolType,
3475     IN ULONG_PTR    Amount
3476 );
3477
3478 #define PsDereferenceImpersonationToken(T)  \
3479             {if (ARGUMENT_PRESENT(T)) {     \
3480                 (ObDereferenceObject((T))); \
3481             } else {                        \
3482                 ;                           \
3483             }                               \
3484 }
3485
3486 #define PsDereferencePrimaryToken(T) (ObDereferenceObject((T)))
3487
3488 NTKERNELAPI
3489 BOOLEAN
3490 NTAPI
3491 PsDisableImpersonation(
3492     IN PETHREAD                 Thread,
3493     IN PSE_IMPERSONATION_STATE  ImpersonationState
3494 );
3495
3496 NTKERNELAPI
3497 LARGE_INTEGER
3498 NTAPI
3499 PsGetProcessExitTime (
3500     VOID
3501 );
3502
3503 NTKERNELAPI
3504 NTSTATUS
3505 NTAPI
3506 PsImpersonateClient(
3507     IN PETHREAD                      Thread,
3508     IN PACCESS_TOKEN                 Token,
3509     IN BOOLEAN                       CopyOnOpen,
3510     IN BOOLEAN                       EffectiveOnly,
3511     IN SECURITY_IMPERSONATION_LEVEL  ImpersonationLevel
3512 );
3513
3514 NTKERNELAPI
3515 BOOLEAN
3516 NTAPI
3517 PsIsSystemThread(
3518     IN PETHREAD Thread
3519 );
3520
3521 NTKERNELAPI
3522 BOOLEAN
3523 NTAPI
3524 PsIsThreadTerminating (
3525     IN PETHREAD Thread
3526 );
3527
3528 NTKERNELAPI
3529 NTSTATUS
3530 NTAPI
3531 PsLookupProcessByProcessId (
3532     IN HANDLE       ProcessId,
3533     OUT PEPROCESS   *Process
3534 );
3535
3536 NTKERNELAPI
3537 NTSTATUS
3538 NTAPI
3539 PsLookupProcessThreadByCid (
3540     IN PCLIENT_ID   Cid,
3541     OUT PEPROCESS   *Process OPTIONAL,
3542     OUT PETHREAD    *Thread
3543 );
3544
3545 NTKERNELAPI
3546 NTSTATUS
3547 NTAPI
3548 PsLookupThreadByThreadId (
3549     IN HANDLE       UniqueThreadId,
3550     OUT PETHREAD    *Thread
3551 );
3552
3553 NTKERNELAPI
3554 PACCESS_TOKEN
3555 NTAPI
3556 PsReferenceImpersonationToken (
3557     IN PETHREAD                         Thread,
3558     OUT PBOOLEAN                        CopyOnUse,
3559     OUT PBOOLEAN                        EffectiveOnly,
3560     OUT PSECURITY_IMPERSONATION_LEVEL   Level
3561 );
3562
3563 NTKERNELAPI
3564 HANDLE
3565 NTAPI
3566 PsReferencePrimaryToken (
3567     IN PEPROCESS Process
3568 );
3569
3570 NTKERNELAPI
3571 VOID
3572 NTAPI
3573 PsRestoreImpersonation(
3574     IN PETHREAD                 Thread,
3575     IN PSE_IMPERSONATION_STATE  ImpersonationState
3576 );
3577
3578 NTKERNELAPI
3579 VOID
3580 NTAPI
3581 PsReturnPoolQuota (
3582     IN PEPROCESS    Process,
3583     IN POOL_TYPE    PoolType,
3584     IN ULONG        Amount
3585 );
3586
3587 NTKERNELAPI
3588 VOID
3589 NTAPI
3590 PsRevertToSelf (
3591     VOID
3592 );
3593
3594 NTSYSAPI
3595 NTSTATUS
3596 NTAPI
3597 RtlAbsoluteToSelfRelativeSD (
3598     IN PSECURITY_DESCRIPTOR              AbsoluteSecurityDescriptor,
3599     IN OUT PSECURITY_DESCRIPTOR_RELATIVE SelfRelativeSecurityDescriptor,
3600     IN PULONG                            BufferLength
3601 );
3602
3603 NTSYSAPI
3604 PVOID
3605 NTAPI
3606 RtlAllocateHeap (
3607     IN HANDLE  HeapHandle,
3608     IN ULONG   Flags,
3609     IN ULONG   Size
3610 );
3611
3612 NTSYSAPI
3613 NTSTATUS
3614 NTAPI
3615 RtlCompressBuffer (
3616     IN USHORT   CompressionFormatAndEngine,
3617     IN PUCHAR   UncompressedBuffer,
3618     IN ULONG    UncompressedBufferSize,
3619     OUT PUCHAR  CompressedBuffer,
3620     IN ULONG    CompressedBufferSize,
3621     IN ULONG    UncompressedChunkSize,
3622     OUT PULONG  FinalCompressedSize,
3623     IN PVOID    WorkSpace
3624 );
3625
3626 NTSYSAPI
3627 NTSTATUS
3628 NTAPI
3629 RtlCompressChunks (
3630     IN PUCHAR                       UncompressedBuffer,
3631     IN ULONG                        UncompressedBufferSize,
3632     OUT PUCHAR                      CompressedBuffer,
3633     IN ULONG                        CompressedBufferSize,
3634     IN OUT PCOMPRESSED_DATA_INFO    CompressedDataInfo,
3635     IN ULONG                        CompressedDataInfoLength,
3636     IN PVOID                        WorkSpace
3637 );
3638
3639 NTSYSAPI
3640 NTSTATUS
3641 NTAPI
3642 RtlConvertSidToUnicodeString (
3643     OUT PUNICODE_STRING DestinationString,
3644     IN PSID             Sid,
3645     IN BOOLEAN          AllocateDestinationString
3646 );
3647
3648 NTSYSAPI
3649 NTSTATUS
3650 NTAPI
3651 RtlCopySid (
3652     IN ULONG   Length,
3653     IN PSID    Destination,
3654     IN PSID    Source
3655 );
3656
3657 NTSYSAPI
3658 NTSTATUS
3659 NTAPI
3660 RtlDecompressBuffer (
3661     IN USHORT   CompressionFormat,
3662     OUT PUCHAR  UncompressedBuffer,
3663     IN ULONG    UncompressedBufferSize,
3664     IN PUCHAR   CompressedBuffer,
3665     IN ULONG    CompressedBufferSize,
3666     OUT PULONG  FinalUncompressedSize
3667 );
3668
3669 NTSYSAPI
3670 NTSTATUS
3671 NTAPI
3672 RtlDecompressChunks (
3673     OUT PUCHAR                  UncompressedBuffer,
3674     IN ULONG                    UncompressedBufferSize,
3675     IN PUCHAR                   CompressedBuffer,
3676     IN ULONG                    CompressedBufferSize,
3677     IN PUCHAR                   CompressedTail,
3678     IN ULONG                    CompressedTailSize,
3679     IN PCOMPRESSED_DATA_INFO    CompressedDataInfo
3680 );
3681
3682 NTSYSAPI
3683 NTSTATUS
3684 NTAPI
3685 RtlDecompressFragment (
3686     IN USHORT   CompressionFormat,
3687     OUT PUCHAR  UncompressedFragment,
3688     IN ULONG    UncompressedFragmentSize,
3689     IN PUCHAR   CompressedBuffer,
3690     IN ULONG    CompressedBufferSize,
3691     IN ULONG    FragmentOffset,
3692     OUT PULONG  FinalUncompressedSize,
3693     IN PVOID    WorkSpace
3694 );
3695
3696 NTSYSAPI
3697 NTSTATUS
3698 NTAPI
3699 RtlDescribeChunk (
3700     IN USHORT       CompressionFormat,
3701     IN OUT PUCHAR   *CompressedBuffer,
3702     IN PUCHAR       EndOfCompressedBufferPlus1,
3703     OUT PUCHAR      *ChunkBuffer,
3704     OUT PULONG      ChunkSize
3705 );
3706
3707 NTSYSAPI
3708 BOOLEAN
3709 NTAPI
3710 RtlEqualSid (
3711     IN PSID Sid1,
3712     IN PSID Sid2
3713 );
3714
3715 NTSYSAPI
3716 VOID
3717 NTAPI
3718 RtlFillMemoryUlong (
3719     IN PVOID    Destination,
3720     IN ULONG    Length,
3721     IN ULONG    Fill
3722 );
3723
3724 NTSYSAPI
3725 BOOLEAN
3726 NTAPI
3727 RtlFreeHeap (
3728     IN HANDLE  HeapHandle,
3729     IN ULONG   Flags,
3730     IN PVOID   P
3731 );
3732
3733 NTSYSAPI
3734 VOID
3735 NTAPI
3736 RtlGenerate8dot3Name (
3737     IN PUNICODE_STRING              Name,
3738     IN BOOLEAN                      AllowExtendedCharacters,
3739     IN OUT PGENERATE_NAME_CONTEXT   Context,
3740     OUT PUNICODE_STRING             Name8dot3
3741 );
3742
3743 NTSYSAPI
3744 NTSTATUS
3745 NTAPI
3746 RtlGetCompressionWorkSpaceSize (
3747     IN USHORT   CompressionFormatAndEngine,
3748     OUT PULONG  CompressBufferWorkSpaceSize,
3749     OUT PULONG  CompressFragmentWorkSpaceSize
3750 );
3751
3752 NTSYSAPI
3753 NTSTATUS
3754 NTAPI
3755 RtlGetDaclSecurityDescriptor (
3756     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3757     OUT PBOOLEAN            DaclPresent,
3758     OUT PACL                *Dacl,
3759     OUT PBOOLEAN            DaclDefaulted
3760 );
3761
3762 NTSYSAPI
3763 NTSTATUS
3764 NTAPI
3765 RtlGetGroupSecurityDescriptor (
3766     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3767     OUT PSID                *Group,
3768     OUT PBOOLEAN            GroupDefaulted
3769 );
3770
3771 NTSYSAPI
3772 NTSTATUS
3773 NTAPI
3774 RtlGetOwnerSecurityDescriptor (
3775     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
3776     OUT PSID                *Owner,
3777     OUT PBOOLEAN            OwnerDefaulted
3778 );
3779
3780 NTSYSAPI
3781 NTSTATUS
3782 NTAPI
3783 RtlInitializeSid (
3784     IN OUT PSID                     Sid,
3785     IN PSID_IDENTIFIER_AUTHORITY    IdentifierAuthority,
3786     IN UCHAR                        SubAuthorityCount
3787 );
3788
3789 NTSYSAPI
3790 BOOLEAN
3791 NTAPI
3792 RtlIsNameLegalDOS8Dot3 (
3793     IN PUNICODE_STRING UnicodeName,
3794     IN PANSI_STRING    AnsiName,
3795     PBOOLEAN           Unknown
3796 );
3797
3798 NTSYSAPI
3799 ULONG
3800 NTAPI
3801 RtlLengthRequiredSid (
3802     IN UCHAR SubAuthorityCount
3803 );
3804
3805 NTSYSAPI
3806 ULONG
3807 NTAPI
3808 RtlLengthSid (
3809     IN PSID Sid
3810 );
3811
3812 NTSYSAPI
3813 ULONG
3814 NTAPI
3815 RtlNtStatusToDosError (
3816     IN NTSTATUS Status
3817 );
3818
3819 NTSYSAPI
3820 NTSTATUS
3821 NTAPI
3822 RtlReserveChunk (
3823     IN USHORT       CompressionFormat,
3824     IN OUT PUCHAR   *CompressedBuffer,
3825     IN PUCHAR       EndOfCompressedBufferPlus1,
3826     OUT PUCHAR      *ChunkBuffer,
3827     IN ULONG        ChunkSize
3828 );
3829
3830 NTSYSAPI
3831 VOID
3832 NTAPI
3833 RtlSecondsSince1970ToTime (
3834     IN ULONG            SecondsSince1970,
3835     OUT PLARGE_INTEGER  Time
3836 );
3837
3838 NTSYSAPI
3839 NTSTATUS
3840 NTAPI
3841 RtlSetGroupSecurityDescriptor (
3842     IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
3843     IN PSID                     Group,
3844     IN BOOLEAN                  GroupDefaulted
3845 );
3846
3847 NTSYSAPI
3848 NTSTATUS
3849 NTAPI
3850 RtlSetOwnerSecurityDescriptor (
3851     IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
3852     IN PSID                     Owner,
3853     IN BOOLEAN                  OwnerDefaulted
3854 );
3855
3856 NTSYSAPI
3857 NTSTATUS
3858 NTAPI
3859 RtlSetSaclSecurityDescriptor (
3860     IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
3861     IN BOOLEAN                  SaclPresent,
3862     IN PACL                     Sacl,
3863     IN BOOLEAN                  SaclDefaulted
3864 );
3865
3866 NTSYSAPI
3867 PUCHAR
3868 NTAPI
3869 RtlSubAuthorityCountSid (
3870     IN PSID Sid
3871 );
3872
3873 NTSYSAPI
3874 PULONG
3875 NTAPI
3876 RtlSubAuthoritySid (
3877     IN PSID    Sid,
3878     IN ULONG   SubAuthority
3879 );
3880
3881 NTSYSAPI
3882 BOOLEAN
3883 NTAPI
3884 RtlValidSid (
3885     IN PSID Sid
3886 );
3887
3888 NTKERNELAPI
3889 NTSTATUS
3890 NTAPI
3891 SeAppendPrivileges (
3892     PACCESS_STATE   AccessState,
3893     PPRIVILEGE_SET  Privileges
3894 );
3895
3896 NTKERNELAPI
3897 BOOLEAN
3898 NTAPI
3899 SeAuditingFileEvents (
3900     IN BOOLEAN              AccessGranted,
3901     IN PSECURITY_DESCRIPTOR SecurityDescriptor
3902 );
3903
3904 NTKERNELAPI
3905 BOOLEAN
3906 NTAPI
3907 SeAuditingFileOrGlobalEvents (
3908     IN BOOLEAN                      AccessGranted,
3909     IN PSECURITY_DESCRIPTOR         SecurityDescriptor,
3910     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext
3911 );
3912
3913 NTKERNELAPI
3914 VOID
3915 NTAPI
3916 SeCaptureSubjectContext (
3917     OUT PSECURITY_SUBJECT_CONTEXT SubjectContext
3918 );
3919
3920 NTKERNELAPI
3921 NTSTATUS
3922 NTAPI
3923 SeCreateClientSecurity (
3924     IN PETHREAD                     Thread,
3925     IN PSECURITY_QUALITY_OF_SERVICE QualityOfService,
3926     IN BOOLEAN                      RemoteClient,
3927     OUT PSECURITY_CLIENT_CONTEXT    ClientContext
3928 );
3929
3930 #if (VER_PRODUCTBUILD >= 2195)
3931
3932 NTKERNELAPI
3933 NTSTATUS
3934 NTAPI
3935 SeCreateClientSecurityFromSubjectContext (
3936     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext,
3937     IN PSECURITY_QUALITY_OF_SERVICE QualityOfService,
3938     IN BOOLEAN                      ServerIsRemote,
3939     OUT PSECURITY_CLIENT_CONTEXT    ClientContext
3940 );
3941
3942 #endif /* (VER_PRODUCTBUILD >= 2195) */
3943
3944 #define SeDeleteClientSecurity(C)  {                                           \
3945             if (SeTokenType((C)->ClientToken) == TokenPrimary) {               \
3946                 PsDereferencePrimaryToken( (C)->ClientToken );                 \
3947             } else {                                                           \
3948                 PsDereferenceImpersonationToken( (C)->ClientToken );           \
3949             }                                                                  \
3950 }
3951
3952 NTKERNELAPI
3953 VOID
3954 NTAPI
3955 SeDeleteObjectAuditAlarm (
3956     IN PVOID    Object,
3957     IN HANDLE   Handle
3958 );
3959
3960 #define SeEnableAccessToExports() SeExports = *(PSE_EXPORTS *)SeExports;
3961
3962 NTKERNELAPI
3963 VOID
3964 NTAPI
3965 SeFreePrivileges (
3966     IN PPRIVILEGE_SET Privileges
3967 );
3968
3969 NTKERNELAPI
3970 VOID
3971 NTAPI
3972 SeImpersonateClient (
3973     IN PSECURITY_CLIENT_CONTEXT ClientContext,
3974     IN PETHREAD                 ServerThread OPTIONAL
3975 );
3976
3977 #if (VER_PRODUCTBUILD >= 2195)
3978
3979 NTKERNELAPI
3980 NTSTATUS
3981 NTAPI
3982 SeImpersonateClientEx (
3983     IN PSECURITY_CLIENT_CONTEXT ClientContext,
3984     IN PETHREAD                 ServerThread OPTIONAL
3985 );
3986
3987 #endif /* (VER_PRODUCTBUILD >= 2195) */
3988
3989 NTKERNELAPI
3990 VOID
3991 NTAPI
3992 SeLockSubjectContext (
3993     IN PSECURITY_SUBJECT_CONTEXT SubjectContext
3994 );
3995
3996 NTKERNELAPI
3997 NTSTATUS
3998 NTAPI
3999 SeMarkLogonSessionForTerminationNotification (
4000     IN PLUID LogonId
4001 );
4002
4003 NTKERNELAPI
4004 VOID
4005 NTAPI
4006 SeOpenObjectAuditAlarm (
4007     IN PUNICODE_STRING      ObjectTypeName,
4008     IN PVOID                Object OPTIONAL,
4009     IN PUNICODE_STRING      AbsoluteObjectName OPTIONAL,
4010     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
4011     IN PACCESS_STATE        AccessState,
4012     IN BOOLEAN              ObjectCreated,
4013     IN BOOLEAN              AccessGranted,
4014     IN KPROCESSOR_MODE      AccessMode,
4015     OUT PBOOLEAN            GenerateOnClose
4016 );
4017
4018 NTKERNELAPI
4019 VOID
4020 NTAPI
4021 SeOpenObjectForDeleteAuditAlarm (
4022     IN PUNICODE_STRING      ObjectTypeName,
4023     IN PVOID                Object OPTIONAL,
4024     IN PUNICODE_STRING      AbsoluteObjectName OPTIONAL,
4025     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
4026     IN PACCESS_STATE        AccessState,
4027     IN BOOLEAN              ObjectCreated,
4028     IN BOOLEAN              AccessGranted,
4029     IN KPROCESSOR_MODE      AccessMode,
4030     OUT PBOOLEAN            GenerateOnClose
4031 );
4032
4033 NTKERNELAPI
4034 BOOLEAN
4035 NTAPI
4036 SePrivilegeCheck (
4037     IN OUT PPRIVILEGE_SET           RequiredPrivileges,
4038     IN PSECURITY_SUBJECT_CONTEXT    SubjectContext,
4039     IN KPROCESSOR_MODE              AccessMode
4040 );
4041
4042 NTKERNELAPI
4043 NTSTATUS
4044 NTAPI
4045 SeQueryAuthenticationIdToken (
4046     IN PACCESS_TOKEN    Token,
4047     OUT PLUID           LogonId
4048 );
4049
4050 #if (VER_PRODUCTBUILD >= 2195)
4051
4052 NTKERNELAPI
4053 NTSTATUS
4054 NTAPI
4055 SeQueryInformationToken (
4056     IN PACCESS_TOKEN           Token,
4057     IN TOKEN_INFORMATION_CLASS TokenInformationClass,
4058     OUT PVOID                  *TokenInformation
4059 );
4060
4061 #endif /* (VER_PRODUCTBUILD >= 2195) */
4062
4063 NTKERNELAPI
4064 NTSTATUS
4065 NTAPI
4066 SeQuerySecurityDescriptorInfo (
4067     IN PSECURITY_INFORMATION    SecurityInformation,
4068     OUT PSECURITY_DESCRIPTOR    SecurityDescriptor,
4069     IN OUT PULONG               Length,
4070     IN PSECURITY_DESCRIPTOR     *ObjectsSecurityDescriptor
4071 );
4072
4073 #if (VER_PRODUCTBUILD >= 2195)
4074
4075 NTKERNELAPI
4076 NTSTATUS
4077 NTAPI
4078 SeQuerySessionIdToken (
4079     IN PACCESS_TOKEN    Token,
4080     IN PULONG           SessionId
4081 );
4082
4083 #endif /* (VER_PRODUCTBUILD >= 2195) */
4084
4085 #define SeQuerySubjectContextToken( SubjectContext )                \
4086     ( ARGUMENT_PRESENT(                                             \
4087         ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken   \
4088         ) ?                                                         \
4089     ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken :     \
4090     ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
4091
4092 typedef NTSTATUS (*PSE_LOGON_SESSION_TERMINATED_ROUTINE) (
4093     IN PLUID LogonId
4094 );
4095
4096 NTKERNELAPI
4097 NTSTATUS
4098 NTAPI
4099 SeRegisterLogonSessionTerminatedRoutine (
4100     IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
4101 );
4102
4103 NTKERNELAPI
4104 VOID
4105 NTAPI
4106 SeReleaseSubjectContext (
4107     IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4108 );
4109
4110 NTKERNELAPI
4111 VOID
4112 NTAPI
4113 SeSetAccessStateGenericMapping (
4114     PACCESS_STATE       AccessState,
4115     PGENERIC_MAPPING    GenericMapping
4116 );
4117
4118 NTKERNELAPI
4119 NTSTATUS
4120 NTAPI
4121 SeSetSecurityDescriptorInfo (
4122     IN PVOID                    Object OPTIONAL,
4123     IN PSECURITY_INFORMATION    SecurityInformation,
4124     IN PSECURITY_DESCRIPTOR     SecurityDescriptor,
4125     IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
4126     IN POOL_TYPE                PoolType,
4127     IN PGENERIC_MAPPING         GenericMapping
4128 );
4129
4130 #if (VER_PRODUCTBUILD >= 2195)
4131
4132 NTKERNELAPI
4133 NTSTATUS
4134 NTAPI
4135 SeSetSecurityDescriptorInfoEx (
4136     IN PVOID                    Object OPTIONAL,
4137     IN PSECURITY_INFORMATION    SecurityInformation,
4138     IN PSECURITY_DESCRIPTOR     ModificationDescriptor,
4139     IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
4140     IN ULONG                    AutoInheritFlags,
4141     IN POOL_TYPE                PoolType,
4142     IN PGENERIC_MAPPING         GenericMapping
4143 );
4144
4145 NTKERNELAPI
4146 BOOLEAN
4147 NTAPI
4148 SeTokenIsAdmin (
4149     IN PACCESS_TOKEN Token
4150 );
4151
4152 NTKERNELAPI
4153 BOOLEAN
4154 NTAPI
4155 SeTokenIsRestricted (
4156     IN PACCESS_TOKEN Token
4157 );
4158
4159 #endif /* (VER_PRODUCTBUILD >= 2195) */
4160
4161 NTKERNELAPI
4162 TOKEN_TYPE
4163 NTAPI
4164 SeTokenType (
4165     IN PACCESS_TOKEN Token
4166 );
4167
4168 NTKERNELAPI
4169 VOID
4170 NTAPI
4171 SeUnlockSubjectContext (
4172     IN PSECURITY_SUBJECT_CONTEXT SubjectContext
4173 );
4174
4175 NTKERNELAPI
4176 NTSTATUS
4177 NTAPI
4178 SeUnregisterLogonSessionTerminatedRoutine (
4179     IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
4180 );
4181
4182 #if (VER_PRODUCTBUILD >= 2195)
4183
4184 NTSYSAPI
4185 NTSTATUS
4186 NTAPI
4187 ZwAdjustPrivilegesToken (
4188     IN HANDLE               TokenHandle,
4189     IN BOOLEAN              DisableAllPrivileges,
4190     IN PTOKEN_PRIVILEGES    NewState,
4191     IN ULONG                BufferLength,
4192     OUT PTOKEN_PRIVILEGES   PreviousState OPTIONAL,
4193     OUT PULONG              ReturnLength
4194 );
4195
4196 #endif /* (VER_PRODUCTBUILD >= 2195) */
4197
4198 NTSYSAPI
4199 NTSTATUS
4200 NTAPI
4201 ZwAlertThread (
4202     IN HANDLE ThreadHandle
4203 );
4204
4205 NTSYSAPI
4206 NTSTATUS
4207 NTAPI
4208 ZwAllocateVirtualMemory (
4209     IN HANDLE       ProcessHandle,
4210     IN OUT PVOID    *BaseAddress,
4211     IN ULONG        ZeroBits,
4212     IN OUT PULONG   RegionSize,
4213     IN ULONG        AllocationType,
4214     IN ULONG        Protect
4215 );
4216
4217 NTSYSAPI
4218 NTSTATUS
4219 NTAPI
4220 ZwAccessCheckAndAuditAlarm (
4221     IN PUNICODE_STRING      SubsystemName,
4222     IN PVOID                HandleId,
4223     IN PUNICODE_STRING      ObjectTypeName,
4224     IN PUNICODE_STRING      ObjectName,
4225     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
4226     IN ACCESS_MASK          DesiredAccess,
4227     IN PGENERIC_MAPPING     GenericMapping,
4228     IN BOOLEAN              ObjectCreation,
4229     OUT PACCESS_MASK        GrantedAccess,
4230     OUT PBOOLEAN            AccessStatus,
4231     OUT PBOOLEAN            GenerateOnClose
4232 );
4233
4234 #if (VER_PRODUCTBUILD >= 2195)
4235
4236 NTSYSAPI
4237 NTSTATUS
4238 NTAPI
4239 ZwCancelIoFile (
4240     IN HANDLE               FileHandle,
4241     OUT PIO_STATUS_BLOCK    IoStatusBlock
4242 );
4243
4244 #endif /* (VER_PRODUCTBUILD >= 2195) */
4245
4246 NTSYSAPI
4247 NTSTATUS
4248 NTAPI
4249 ZwClearEvent (
4250     IN HANDLE EventHandle
4251 );
4252
4253 NTSYSAPI
4254 NTSTATUS
4255 NTAPI
4256 ZwCloseObjectAuditAlarm (
4257     IN PUNICODE_STRING  SubsystemName,
4258     IN PVOID            HandleId,
4259     IN BOOLEAN          GenerateOnClose
4260 );
4261
4262 NTSYSAPI
4263 NTSTATUS
4264 NTAPI
4265 ZwCreateSection (
4266     OUT PHANDLE             SectionHandle,
4267     IN ACCESS_MASK          DesiredAccess,
4268     IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
4269     IN PLARGE_INTEGER       MaximumSize OPTIONAL,
4270     IN ULONG                SectionPageProtection,
4271     IN ULONG                AllocationAttributes,
4272     IN HANDLE               FileHandle OPTIONAL
4273 );
4274
4275 NTSYSAPI
4276 NTSTATUS
4277 NTAPI
4278 ZwCreateSymbolicLinkObject (
4279     OUT PHANDLE             SymbolicLinkHandle,
4280     IN ACCESS_MASK          DesiredAccess,
4281     IN POBJECT_ATTRIBUTES   ObjectAttributes,
4282     IN PUNICODE_STRING      TargetName
4283 );
4284
4285 NTSYSAPI
4286 NTSTATUS
4287 NTAPI
4288 ZwDeleteFile (
4289     IN POBJECT_ATTRIBUTES ObjectAttributes
4290 );
4291
4292 NTSYSAPI
4293 NTSTATUS
4294 NTAPI
4295 ZwDeleteValueKey (
4296     IN HANDLE           Handle,
4297     IN PUNICODE_STRING  Name
4298 );
4299
4300 NTSYSAPI
4301 NTSTATUS
4302 NTAPI
4303 ZwDeviceIoControlFile (
4304     IN HANDLE               FileHandle,
4305     IN HANDLE               Event OPTIONAL,
4306     IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
4307     IN PVOID                ApcContext OPTIONAL,
4308     OUT PIO_STATUS_BLOCK    IoStatusBlock,
4309     IN ULONG                IoControlCode,
4310     IN PVOID                InputBuffer OPTIONAL,
4311     IN ULONG                InputBufferLength,
4312     OUT PVOID               OutputBuffer OPTIONAL,
4313     IN ULONG                OutputBufferLength
4314 );
4315
4316 NTSYSAPI
4317 NTSTATUS
4318 NTAPI
4319 ZwDisplayString (
4320     IN PUNICODE_STRING String
4321 );
4322
4323 NTSYSAPI
4324 NTSTATUS
4325 NTAPI
4326 ZwDuplicateObject (
4327     IN HANDLE       SourceProcessHandle,
4328     IN HANDLE       SourceHandle,
4329     IN HANDLE       TargetProcessHandle OPTIONAL,
4330     OUT PHANDLE     TargetHandle OPTIONAL,
4331     IN ACCESS_MASK  DesiredAccess,
4332     IN ULONG        HandleAttributes,
4333     IN ULONG        Options
4334 );
4335
4336 NTSYSAPI
4337 NTSTATUS
4338 NTAPI
4339 ZwDuplicateToken (
4340     IN HANDLE               ExistingTokenHandle,
4341     IN ACCESS_MASK          DesiredAccess,
4342     IN POBJECT_ATTRIBUTES   ObjectAttributes,
4343     IN BOOLEAN              EffectiveOnly,
4344     IN TOKEN_TYPE           TokenType,
4345     OUT PHANDLE             NewTokenHandle
4346 );
4347
4348 NTSYSAPI
4349 NTSTATUS
4350 NTAPI
4351 ZwFlushInstructionCache (
4352     IN HANDLE   ProcessHandle,
4353     IN PVOID    BaseAddress OPTIONAL,
4354     IN ULONG    FlushSize
4355 );
4356
4357 #if (VER_PRODUCTBUILD >= 2195)
4358
4359 NTSYSAPI
4360 NTSTATUS
4361 NTAPI
4362 ZwFlushVirtualMemory (
4363     IN HANDLE               ProcessHandle,
4364     IN OUT PVOID            *BaseAddress,
4365     IN OUT PULONG           FlushSize,
4366     OUT PIO_STATUS_BLOCK    IoStatusBlock
4367 );
4368
4369 #endif /* (VER_PRODUCTBUILD >= 2195) */
4370
4371 NTSYSAPI
4372 NTSTATUS
4373 NTAPI
4374 ZwFreeVirtualMemory (
4375     IN HANDLE       ProcessHandle,
4376     IN OUT PVOID    *BaseAddress,
4377     IN OUT PULONG   RegionSize,
4378     IN ULONG        FreeType
4379 );
4380
4381 NTSYSAPI
4382 NTSTATUS
4383 NTAPI
4384 ZwFsControlFile (
4385     IN HANDLE               FileHandle,
4386     IN HANDLE               Event OPTIONAL,
4387     IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
4388     IN PVOID                ApcContext OPTIONAL,
4389     OUT PIO_STATUS_BLOCK    IoStatusBlock,
4390     IN ULONG                FsControlCode,
4391     IN PVOID                InputBuffer OPTIONAL,
4392     IN ULONG                InputBufferLength,
4393     OUT PVOID               OutputBuffer OPTIONAL,
4394     IN ULONG                OutputBufferLength
4395 );
4396
4397 #if (VER_PRODUCTBUILD >= 2195)
4398
4399 NTSYSAPI
4400 NTSTATUS
4401 NTAPI
4402 ZwInitiatePowerAction (
4403     IN POWER_ACTION         SystemAction,
4404     IN SYSTEM_POWER_STATE   MinSystemState,
4405     IN ULONG                Flags,
4406     IN BOOLEAN              Asynchronous
4407 );
4408
4409 #endif /* (VER_PRODUCTBUILD >= 2195) */
4410
4411 NTSYSAPI
4412 NTSTATUS
4413 NTAPI
4414 ZwLoadDriver (
4415     /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
4416     IN PUNICODE_STRING RegistryPath
4417 );
4418
4419 NTSYSAPI
4420 NTSTATUS
4421 NTAPI
4422 ZwLoadKey (
4423     IN POBJECT_ATTRIBUTES KeyObjectAttributes,
4424     IN POBJECT_ATTRIBUTES FileObjectAttributes
4425 );
4426
4427 NTSYSAPI
4428 NTSTATUS
4429 NTAPI
4430 ZwNotifyChangeKey (
4431     IN HANDLE               KeyHandle,
4432     IN HANDLE               EventHandle OPTIONAL,
4433     IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
4434     IN PVOID                ApcContext OPTIONAL,
4435     OUT PIO_STATUS_BLOCK    IoStatusBlock,
4436     IN ULONG                NotifyFilter,
4437     IN BOOLEAN              WatchSubtree,
4438     IN PVOID                Buffer,
4439     IN ULONG                BufferLength,
4440     IN BOOLEAN              Asynchronous
4441 );
4442
4443 NTSYSAPI
4444 NTSTATUS
4445 NTAPI
4446 ZwOpenDirectoryObject (
4447     OUT PHANDLE             DirectoryHandle,
4448     IN ACCESS_MASK          DesiredAccess,
4449     IN POBJECT_ATTRIBUTES   ObjectAttributes
4450 );
4451
4452 NTSYSAPI
4453 NTSTATUS
4454 NTAPI
4455 ZwOpenEvent (
4456     OUT PHANDLE             EventHandle,
4457     IN ACCESS_MASK          DesiredAccess,
4458     IN POBJECT_ATTRIBUTES   ObjectAttributes
4459 );
4460
4461 NTSYSAPI
4462 NTSTATUS
4463 NTAPI
4464 ZwOpenProcess (
4465     OUT PHANDLE             ProcessHandle,
4466     IN ACCESS_MASK          DesiredAccess,
4467     IN POBJECT_ATTRIBUTES   ObjectAttributes,
4468     IN PCLIENT_ID           ClientId OPTIONAL
4469 );
4470
4471 NTSYSAPI
4472 NTSTATUS
4473 NTAPI
4474 ZwOpenProcessToken (
4475     IN HANDLE       ProcessHandle,
4476     IN ACCESS_MASK  DesiredAccess,
4477     OUT PHANDLE     TokenHandle
4478 );
4479
4480 NTSYSAPI
4481 NTSTATUS
4482 NTAPI
4483 ZwOpenThread (
4484     OUT PHANDLE             ThreadHandle,
4485     IN ACCESS_MASK          DesiredAccess,
4486     IN POBJECT_ATTRIBUTES   ObjectAttributes,
4487     IN PCLIENT_ID           ClientId
4488 );
4489
4490 NTSYSAPI
4491 NTSTATUS
4492 NTAPI
4493 ZwOpenThreadToken (
4494     IN HANDLE       ThreadHandle,
4495     IN ACCESS_MASK  DesiredAccess,
4496     IN BOOLEAN      OpenAsSelf,
4497     OUT PHANDLE     TokenHandle
4498 );
4499
4500 #if (VER_PRODUCTBUILD >= 2195)
4501
4502 NTSYSAPI
4503 NTSTATUS
4504 NTAPI
4505 ZwPowerInformation (
4506     IN POWER_INFORMATION_LEVEL  PowerInformationLevel,
4507     IN PVOID                    InputBuffer OPTIONAL,
4508     IN ULONG                    InputBufferLength,
4509     OUT PVOID                   OutputBuffer OPTIONAL,
4510     IN ULONG                    OutputBufferLength
4511 );
4512
4513 #endif /* (VER_PRODUCTBUILD >= 2195) */
4514
4515 NTSYSAPI
4516 NTSTATUS
4517 NTAPI
4518 ZwPulseEvent (
4519     IN HANDLE   EventHandle,
4520     OUT PLONG   PreviousState OPTIONAL
4521 );
4522
4523 NTSYSAPI
4524 NTSTATUS
4525 NTAPI
4526 ZwQueryDefaultLocale (
4527     IN BOOLEAN  ThreadOrSystem,
4528     OUT PLCID   Locale
4529 );
4530
4531 NTSYSAPI
4532 NTSTATUS
4533 NTAPI
4534 ZwQueryDirectoryFile (
4535     IN HANDLE                   FileHandle,
4536     IN HANDLE                   Event OPTIONAL,
4537     IN PIO_APC_ROUTINE          ApcRoutine OPTIONAL,
4538     IN PVOID                    ApcContext OPTIONAL,
4539     OUT PIO_STATUS_BLOCK        IoStatusBlock,
4540     OUT PVOID                   FileInformation,
4541     IN ULONG                    Length,
4542     IN FILE_INFORMATION_CLASS   FileInformationClass,
4543     IN BOOLEAN                  ReturnSingleEntry,
4544     IN PUNICODE_STRING          FileName OPTIONAL,
4545     IN BOOLEAN                  RestartScan
4546 );
4547
4548 #if (VER_PRODUCTBUILD >= 2195)
4549
4550 NTSYSAPI
4551 NTSTATUS
4552 NTAPI
4553 ZwQueryDirectoryObject (
4554     IN HANDLE       DirectoryHandle,
4555     OUT PVOID       Buffer,
4556     IN ULONG        Length,
4557     IN BOOLEAN      ReturnSingleEntry,
4558     IN BOOLEAN      RestartScan,
4559     IN OUT PULONG   Context,
4560     OUT PULONG      ReturnLength OPTIONAL
4561 );
4562
4563 NTSYSAPI
4564 NTSTATUS
4565 NTAPI
4566 ZwQueryEaFile (
4567     IN HANDLE               FileHandle,
4568     OUT PIO_STATUS_BLOCK    IoStatusBlock,
4569     OUT PVOID               Buffer,
4570     IN ULONG                Length,
4571     IN BOOLEAN              ReturnSingleEntry,
4572     IN PVOID                EaList OPTIONAL,
4573     IN ULONG                EaListLength,
4574     IN PULONG               EaIndex OPTIONAL,
4575     IN BOOLEAN              RestartScan
4576 );
4577
4578 #endif /* (VER_PRODUCTBUILD >= 2195) */
4579
4580 NTSYSAPI
4581 NTSTATUS
4582 NTAPI
4583 ZwQueryInformationProcess (
4584     IN HANDLE           ProcessHandle,
4585     IN PROCESSINFOCLASS ProcessInformationClass,
4586     OUT PVOID           ProcessInformation,
4587     IN ULONG            ProcessInformationLength,
4588     OUT PULONG          ReturnLength OPTIONAL
4589 );
4590
4591 NTSYSAPI
4592 NTSTATUS
4593 NTAPI
4594 ZwQueryInformationToken (
4595     IN HANDLE                   TokenHandle,
4596     IN TOKEN_INFORMATION_CLASS  TokenInformationClass,
4597     OUT PVOID                   TokenInformation,
4598     IN ULONG                    Length,
4599     OUT PULONG                  ResultLength
4600 );
4601
4602 NTSYSAPI
4603 NTSTATUS
4604 NTAPI
4605 ZwQuerySecurityObject (
4606     IN HANDLE                   FileHandle,
4607     IN SECURITY_INFORMATION     SecurityInformation,
4608     OUT PSECURITY_DESCRIPTOR    SecurityDescriptor,
4609     IN ULONG                    Length,
4610     OUT PULONG                  ResultLength
4611 );
4612
4613 NTSYSAPI
4614 NTSTATUS
4615 NTAPI
4616 ZwQueryVolumeInformationFile (
4617     IN HANDLE               FileHandle,
4618     OUT PIO_STATUS_BLOCK    IoStatusBlock,
4619     OUT PVOID               FsInformation,
4620     IN ULONG                Length,
4621     IN FS_INFORMATION_CLASS FsInformationClass
4622 );
4623
4624 NTSYSAPI
4625 NTSTATUS
4626 NTAPI
4627 ZwReplaceKey (
4628     IN POBJECT_ATTRIBUTES   NewFileObjectAttributes,
4629     IN HANDLE               KeyHandle,
4630     IN POBJECT_ATTRIBUTES   OldFileObjectAttributes
4631 );
4632
4633 NTSYSAPI
4634 NTSTATUS
4635 NTAPI
4636 ZwResetEvent (
4637     IN HANDLE   EventHandle,
4638     OUT PLONG   PreviousState OPTIONAL
4639 );
4640
4641 #if (VER_PRODUCTBUILD >= 2195)
4642
4643 NTSYSAPI
4644 NTSTATUS
4645 NTAPI
4646 ZwRestoreKey (
4647     IN HANDLE   KeyHandle,
4648     IN HANDLE   FileHandle,
4649     IN ULONG    Flags
4650 );
4651
4652 #endif /* (VER_PRODUCTBUILD >= 2195) */
4653
4654 NTSYSAPI
4655 NTSTATUS
4656 NTAPI
4657 ZwSaveKey (
4658     IN HANDLE KeyHandle,
4659     IN HANDLE FileHandle
4660 );
4661
4662 NTSYSAPI
4663 NTSTATUS
4664 NTAPI
4665 ZwSetDefaultLocale (
4666     IN BOOLEAN  ThreadOrSystem,
4667     IN LCID     Locale
4668 );
4669
4670 #if (VER_PRODUCTBUILD >= 2195)
4671
4672 NTSYSAPI
4673 NTSTATUS
4674 NTAPI
4675 ZwSetDefaultUILanguage (
4676     IN LANGID LanguageId
4677 );
4678
4679 NTSYSAPI
4680 NTSTATUS
4681 NTAPI
4682 ZwSetEaFile (
4683     IN HANDLE               FileHandle,
4684     OUT PIO_STATUS_BLOCK    IoStatusBlock,
4685     OUT PVOID               Buffer,
4686     IN ULONG                Length
4687 );
4688
4689 #endif /* (VER_PRODUCTBUILD >= 2195) */
4690
4691 NTSYSAPI
4692 NTSTATUS
4693 NTAPI
4694 ZwSetEvent (
4695     IN HANDLE   EventHandle,
4696     OUT PLONG   PreviousState OPTIONAL
4697 );
4698
4699 NTSYSAPI
4700 NTSTATUS
4701 NTAPI
4702 ZwSetInformationProcess (
4703     IN HANDLE           ProcessHandle,
4704     IN PROCESSINFOCLASS ProcessInformationClass,
4705     IN PVOID            ProcessInformation,
4706     IN ULONG            ProcessInformationLength
4707 );
4708
4709 #if (VER_PRODUCTBUILD >= 2195)
4710
4711 NTSYSAPI
4712 NTSTATUS
4713 NTAPI
4714 ZwSetSecurityObject (
4715     IN HANDLE               Handle,
4716     IN SECURITY_INFORMATION SecurityInformation,
4717     IN PSECURITY_DESCRIPTOR SecurityDescriptor
4718 );
4719
4720 #endif /* (VER_PRODUCTBUILD >= 2195) */
4721
4722 NTSYSAPI
4723 NTSTATUS
4724 NTAPI
4725 ZwSetSystemTime (
4726     IN PLARGE_INTEGER   NewTime,
4727     OUT PLARGE_INTEGER  OldTime OPTIONAL
4728 );
4729
4730 #if (VER_PRODUCTBUILD >= 2195)
4731
4732 NTSYSAPI
4733 NTSTATUS
4734 NTAPI
4735 ZwSetVolumeInformationFile (
4736     IN HANDLE               FileHandle,
4737     OUT PIO_STATUS_BLOCK    IoStatusBlock,
4738     IN PVOID                FsInformation,
4739     IN ULONG                Length,
4740     IN FS_INFORMATION_CLASS FsInformationClass
4741 );
4742
4743 #endif /* (VER_PRODUCTBUILD >= 2195) */
4744
4745 NTSYSAPI
4746 NTSTATUS
4747 NTAPI
4748 ZwTerminateProcess (
4749     IN HANDLE   ProcessHandle OPTIONAL,
4750     IN NTSTATUS ExitStatus
4751 );
4752
4753 NTSYSAPI
4754 NTSTATUS
4755 NTAPI
4756 ZwUnloadDriver (
4757     /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
4758     IN PUNICODE_STRING RegistryPath
4759 );
4760
4761 NTSYSAPI
4762 NTSTATUS
4763 NTAPI
4764 ZwUnloadKey (
4765     IN POBJECT_ATTRIBUTES KeyObjectAttributes
4766 );
4767
4768 NTSYSAPI
4769 NTSTATUS
4770 NTAPI
4771 ZwWaitForSingleObject (
4772     IN HANDLE           Handle,
4773     IN BOOLEAN          Alertable,
4774     IN PLARGE_INTEGER   Timeout OPTIONAL
4775 );
4776
4777 NTSYSAPI
4778 NTSTATUS
4779 NTAPI
4780 ZwWaitForMultipleObjects (
4781     IN ULONG            HandleCount,
4782     IN PHANDLE          Handles,
4783     IN WAIT_TYPE        WaitType,
4784     IN BOOLEAN          Alertable,
4785     IN PLARGE_INTEGER   Timeout OPTIONAL
4786 );
4787
4788 NTSYSAPI
4789 NTSTATUS
4790 NTAPI
4791 ZwYieldExecution (
4792     VOID
4793 );
4794
4795 #pragma pack(pop)
4796
4797 #ifdef __cplusplus
4798 }
4799 #endif
4800
4801 #endif /* _NTIFS_ */