MandatoryLevelCount
} MANDATORY_LEVEL, *PMANDATORY_LEVEL;
+typedef enum _OBJECT_INFORMATION_CLASS {
+ ObjectBasicInformation = 0,
+ ObjectNameInformation = 1, /* FIXME, not in WDK */
+ ObjectTypeInformation = 2,
+ ObjectTypesInformation = 3, /* FIXME, not in WDK */
+ ObjectHandleFlagInformation = 4, /* FIXME, not in WDK */
+ ObjectSessionInformation = 5, /* FIXME, not in WDK */
+ MaxObjectInfoClass /* FIXME, not in WDK */
+} OBJECT_INFORMATION_CLASS;
+
#if (NTDDI_VERSION >= NTDDI_NT4)
NTSYSCALLAPI
RtlIsValidOemCharacter(
IN OUT PWCHAR Char);
-typedef struct _RTL_SPLAY_LINKS {
- struct _RTL_SPLAY_LINKS *Parent;
- struct _RTL_SPLAY_LINKS *LeftChild;
- struct _RTL_SPLAY_LINKS *RightChild;
-} RTL_SPLAY_LINKS, *PRTL_SPLAY_LINKS;
-
typedef struct _PREFIX_TABLE_ENTRY {
CSHORT NodeTypeCode;
CSHORT NameLength;
#define RTL_SYSTEM_VOLUME_INFORMATION_FOLDER L"System Volume Information"
-#define DEVICE_TYPE ULONG
-
-#define FILE_DEVICE_BEEP 0x00000001
-#define FILE_DEVICE_CD_ROM 0x00000002
-#define FILE_DEVICE_CD_ROM_FILE_SYSTEM 0x00000003
-#define FILE_DEVICE_CONTROLLER 0x00000004
-#define FILE_DEVICE_DATALINK 0x00000005
-#define FILE_DEVICE_DFS 0x00000006
-#define FILE_DEVICE_DISK 0x00000007
-#define FILE_DEVICE_DISK_FILE_SYSTEM 0x00000008
-#define FILE_DEVICE_FILE_SYSTEM 0x00000009
-#define FILE_DEVICE_INPORT_PORT 0x0000000a
-#define FILE_DEVICE_KEYBOARD 0x0000000b
-#define FILE_DEVICE_MAILSLOT 0x0000000c
-#define FILE_DEVICE_MIDI_IN 0x0000000d
-#define FILE_DEVICE_MIDI_OUT 0x0000000e
-#define FILE_DEVICE_MOUSE 0x0000000f
-#define FILE_DEVICE_MULTI_UNC_PROVIDER 0x00000010
-#define FILE_DEVICE_NAMED_PIPE 0x00000011
-#define FILE_DEVICE_NETWORK 0x00000012
-#define FILE_DEVICE_NETWORK_BROWSER 0x00000013
-#define FILE_DEVICE_NETWORK_FILE_SYSTEM 0x00000014
-#define FILE_DEVICE_NULL 0x00000015
-#define FILE_DEVICE_PARALLEL_PORT 0x00000016
-#define FILE_DEVICE_PHYSICAL_NETCARD 0x00000017
-#define FILE_DEVICE_PRINTER 0x00000018
-#define FILE_DEVICE_SCANNER 0x00000019
-#define FILE_DEVICE_SERIAL_MOUSE_PORT 0x0000001a
-#define FILE_DEVICE_SERIAL_PORT 0x0000001b
-#define FILE_DEVICE_SCREEN 0x0000001c
-#define FILE_DEVICE_SOUND 0x0000001d
-#define FILE_DEVICE_STREAMS 0x0000001e
-#define FILE_DEVICE_TAPE 0x0000001f
-#define FILE_DEVICE_TAPE_FILE_SYSTEM 0x00000020
-#define FILE_DEVICE_TRANSPORT 0x00000021
-#define FILE_DEVICE_UNKNOWN 0x00000022
-#define FILE_DEVICE_VIDEO 0x00000023
-#define FILE_DEVICE_VIRTUAL_DISK 0x00000024
-#define FILE_DEVICE_WAVE_IN 0x00000025
-#define FILE_DEVICE_WAVE_OUT 0x00000026
-#define FILE_DEVICE_8042_PORT 0x00000027
-#define FILE_DEVICE_NETWORK_REDIRECTOR 0x00000028
-#define FILE_DEVICE_BATTERY 0x00000029
-#define FILE_DEVICE_BUS_EXTENDER 0x0000002a
-#define FILE_DEVICE_MODEM 0x0000002b
-#define FILE_DEVICE_VDM 0x0000002c
-#define FILE_DEVICE_MASS_STORAGE 0x0000002d
-#define FILE_DEVICE_SMB 0x0000002e
-#define FILE_DEVICE_KS 0x0000002f
-#define FILE_DEVICE_CHANGER 0x00000030
-#define FILE_DEVICE_SMARTCARD 0x00000031
-#define FILE_DEVICE_ACPI 0x00000032
-#define FILE_DEVICE_DVD 0x00000033
-#define FILE_DEVICE_FULLSCREEN_VIDEO 0x00000034
-#define FILE_DEVICE_DFS_FILE_SYSTEM 0x00000035
-#define FILE_DEVICE_DFS_VOLUME 0x00000036
-#define FILE_DEVICE_SERENUM 0x00000037
-#define FILE_DEVICE_TERMSRV 0x00000038
-#define FILE_DEVICE_KSEC 0x00000039
-#define FILE_DEVICE_FIPS 0x0000003A
-#define FILE_DEVICE_INFINIBAND 0x0000003B
-#define FILE_DEVICE_VMBUS 0x0000003E
-#define FILE_DEVICE_CRYPT_PROVIDER 0x0000003F
-#define FILE_DEVICE_WPD 0x00000040
-#define FILE_DEVICE_BLUETOOTH 0x00000041
-#define FILE_DEVICE_MT_COMPOSITE 0x00000042
-#define FILE_DEVICE_MT_TRANSPORT 0x00000043
-#define FILE_DEVICE_BIOMETRIC 0x00000044
-#define FILE_DEVICE_PMI 0x00000045
-
-#define CTL_CODE(DeviceType, Function, Method, Access) \
- (((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method))
-
-#define DEVICE_TYPE_FROM_CTL_CODE(ctl) (((ULONG) (ctl & 0xffff0000)) >> 16)
-
#define METHOD_FROM_CTL_CODE(ctrlCode) ((ULONG)(ctrlCode & 3))
-#define METHOD_BUFFERED 0
-#define METHOD_IN_DIRECT 1
-#define METHOD_OUT_DIRECT 2
-#define METHOD_NEITHER 3
#define METHOD_DIRECT_TO_HARDWARE METHOD_IN_DIRECT
#define METHOD_DIRECT_FROM_HARDWARE METHOD_OUT_DIRECT
-#define FILE_ANY_ACCESS 0x00000000
-#define FILE_SPECIAL_ACCESS FILE_ANY_ACCESS
-#define FILE_READ_ACCESS 0x00000001
-#define FILE_WRITE_ACCESS 0x00000002
-
typedef ULONG LSA_OPERATIONAL_MODE, *PLSA_OPERATIONAL_MODE;
typedef enum _SECURITY_LOGON_TYPE {
#ifndef _NTLSA_AUDIT_
#define _NTLSA_AUDIT_
-typedef enum _SE_ADT_PARAMETER_TYPE {
- SeAdtParmTypeNone = 0,
- SeAdtParmTypeString,
- SeAdtParmTypeFileSpec,
- SeAdtParmTypeUlong,
- SeAdtParmTypeSid,
- SeAdtParmTypeLogonId,
- SeAdtParmTypeNoLogonId,
- SeAdtParmTypeAccessMask,
- SeAdtParmTypePrivs,
- SeAdtParmTypeObjectTypes,
- SeAdtParmTypeHexUlong,
- SeAdtParmTypePtr,
- SeAdtParmTypeTime,
- SeAdtParmTypeGuid,
- SeAdtParmTypeLuid,
- SeAdtParmTypeHexInt64,
- SeAdtParmTypeStringList,
- SeAdtParmTypeSidList,
- SeAdtParmTypeDuration,
- SeAdtParmTypeUserAccountControl,
- SeAdtParmTypeNoUac,
- SeAdtParmTypeMessage,
- SeAdtParmTypeDateTime,
- SeAdtParmTypeSockAddr,
- SeAdtParmTypeSD,
- SeAdtParmTypeLogonHours,
- SeAdtParmTypeLogonIdNoSid,
- SeAdtParmTypeUlongNoConv,
- SeAdtParmTypeSockAddrNoPort,
- SeAdtParmTypeAccessReason
-} SE_ADT_PARAMETER_TYPE, *PSE_ADT_PARAMETER_TYPE;
-
#ifndef GUID_DEFINED
#include <guiddef.h>
#endif
-typedef struct _SE_ADT_OBJECT_TYPE {
- GUID ObjectType;
- USHORT Flags;
-#define SE_ADT_OBJECT_ONLY 0x1
- USHORT Level;
- ACCESS_MASK AccessMask;
-} SE_ADT_OBJECT_TYPE, *PSE_ADT_OBJECT_TYPE;
-
-typedef struct _SE_ADT_PARAMETER_ARRAY_ENTRY {
- SE_ADT_PARAMETER_TYPE Type;
- ULONG Length;
- ULONG_PTR Data[2];
- PVOID Address;
-} SE_ADT_PARAMETER_ARRAY_ENTRY, *PSE_ADT_PARAMETER_ARRAY_ENTRY;
-
-typedef struct _SE_ADT_ACCESS_REASON {
- ACCESS_MASK AccessMask;
- ULONG AccessReasons[32];
- ULONG ObjectTypeIndex;
- ULONG AccessGranted;
- PSECURITY_DESCRIPTOR SecurityDescriptor;
-} SE_ADT_ACCESS_REASON, *PSE_ADT_ACCESS_REASON;
-
-#define SE_MAX_AUDIT_PARAMETERS 32
-#define SE_MAX_GENERIC_AUDIT_PARAMETERS 28
-
-typedef struct _SE_ADT_PARAMETER_ARRAY {
- ULONG CategoryId;
- ULONG AuditId;
- ULONG ParameterCount;
- ULONG Length;
- USHORT FlatSubCategoryId;
- USHORT Type;
- ULONG Flags;
- SE_ADT_PARAMETER_ARRAY_ENTRY Parameters[ SE_MAX_AUDIT_PARAMETERS ];
-} SE_ADT_PARAMETER_ARRAY, *PSE_ADT_PARAMETER_ARRAY;
-
-#define SE_ADT_PARAMETERS_SELF_RELATIVE 0x00000001
-#define SE_ADT_PARAMETERS_SEND_TO_LSA 0x00000002
-#define SE_ADT_PARAMETER_EXTENSIBLE_AUDIT 0x00000004
-#define SE_ADT_PARAMETER_GENERIC_AUDIT 0x00000008
-#define SE_ADT_PARAMETER_WRITE_SYNCHRONOUS 0x00000010
-
-#define LSAP_SE_ADT_PARAMETER_ARRAY_TRUE_SIZE(AuditParameters) \
- ( sizeof(SE_ADT_PARAMETER_ARRAY) - \
- sizeof(SE_ADT_PARAMETER_ARRAY_ENTRY) * \
- (SE_MAX_AUDIT_PARAMETERS - AuditParameters->ParameterCount) )
-
#endif /* _NTLSA_AUDIT_ */
NTSTATUS
#define FSCTL_IS_VOLUME_MOUNTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_IS_PATHNAME_VALID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_MARK_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
-#define FSCTL_QUERY_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_QUERY_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER, FILE_ANY_ACCESS)
#define FSCTL_GET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_SET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
-#define FSCTL_SET_BOOTLOADER_ACCESSED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_SET_BOOTLOADER_ACCESSED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS)
#define FSCTL_OPLOCK_BREAK_ACK_NO_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_INVALIDATE_VOLUMES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_GET_NTFS_VOLUME_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_GET_NTFS_FILE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS)
-#define FSCTL_GET_VOLUME_BITMAP CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER, FILE_ANY_ACCESS)
-#define FSCTL_GET_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_GET_VOLUME_BITMAP CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_GET_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER, FILE_ANY_ACCESS)
#define FSCTL_MOVE_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_IS_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_ALLOW_EXTENDED_DASD_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER, FILE_ANY_ACCESS)
#if (_WIN32_WINNT >= 0x0500)
-#define FSCTL_FIND_FILES_BY_SID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_FIND_FILES_BY_SID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS)
#define FSCTL_SET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_WRITE_DATA)
#define FSCTL_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_DELETE_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_WRITE_DATA)
#define FSCTL_SET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_WRITE_DATA)
#define FSCTL_GET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_DELETE_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_WRITE_DATA)
-#define FSCTL_ENUM_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER, FILE_READ_DATA)
-#define FSCTL_SECURITY_ID_CHECK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45, METHOD_NEITHER, FILE_READ_DATA)
-#define FSCTL_READ_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46, METHOD_NEITHER, FILE_READ_DATA)
+#define FSCTL_ENUM_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER, FILE_READ_DATA)
+#define FSCTL_SECURITY_ID_CHECK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45, METHOD_NEITHER, FILE_READ_DATA)
+#define FSCTL_READ_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46, METHOD_NEITHER, FILE_READ_DATA)
#define FSCTL_SET_OBJECT_ID_EXTENDED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_WRITE_DATA)
#define FSCTL_CREATE_OR_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_SET_SPARSE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_WRITE_DATA)
#define FSCTL_SET_ZERO_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA)
-#define FSCTL_QUERY_ALLOCATED_RANGES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51, METHOD_NEITHER, FILE_READ_DATA)
+#define FSCTL_QUERY_ALLOCATED_RANGES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51, METHOD_NEITHER, FILE_READ_DATA)
#define FSCTL_ENABLE_UPGRADE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA)
#define FSCTL_SET_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_BUFFERED, FILE_ANY_ACCESS)
-#define FSCTL_ENCRYPTION_FSCTL_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54, METHOD_NEITHER, FILE_ANY_ACCESS)
-#define FSCTL_WRITE_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55, METHOD_NEITHER, FILE_ANY_ACCESS)
-#define FSCTL_READ_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56, METHOD_NEITHER, FILE_ANY_ACCESS)
-#define FSCTL_CREATE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57, METHOD_NEITHER, FILE_READ_DATA)
-#define FSCTL_READ_FILE_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58, METHOD_NEITHER, FILE_READ_DATA)
-#define FSCTL_WRITE_USN_CLOSE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59, METHOD_NEITHER, FILE_READ_DATA)
+#define FSCTL_ENCRYPTION_FSCTL_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_WRITE_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_READ_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_CREATE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57, METHOD_NEITHER, FILE_READ_DATA)
+#define FSCTL_READ_FILE_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58, METHOD_NEITHER, FILE_READ_DATA)
+#define FSCTL_WRITE_USN_CLOSE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59, METHOD_NEITHER, FILE_READ_DATA)
#define FSCTL_EXTEND_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_QUERY_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_DELETE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_GET_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 103, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_WAIT_FOR_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 104, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_INITIATE_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 106, METHOD_BUFFERED, FILE_ANY_ACCESS)
-#define FSCTL_CSC_INTERNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 107, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_CSC_INTERNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 107, METHOD_NEITHER, FILE_ANY_ACCESS)
#define FSCTL_SHRINK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 108, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
#define FSCTL_SET_SHORT_NAME_BEHAVIOR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 109, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define FSCTL_DFSR_SET_GHOST_HANDLE_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 110, METHOD_BUFFERED, FILE_ANY_ACCESS)
UCHAR TargetLinkTrackingInformationBuffer[1];
} REMOTE_LINK_TRACKING_INFORMATION, *PREMOTE_LINK_TRACKING_INFORMATION;
-typedef enum _OBJECT_INFORMATION_CLASS {
- ObjectBasicInformation = 0,
- ObjectTypeInformation = 2
-} OBJECT_INFORMATION_CLASS;
-
typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION {
ULONG Attributes;
ACCESS_MASK GrantedAccess;
TOKEN_CONTROL ClientTokenControl;
} SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;
-#define EVENT_INCREMENT 1
-#define IO_NO_INCREMENT 0
-#define IO_CD_ROM_INCREMENT 1
-#define IO_DISK_INCREMENT 1
-#define IO_MAILSLOT_INCREMENT 2
-#define IO_NAMED_PIPE_INCREMENT 2
-#define IO_NETWORK_INCREMENT 2
-#define SEMAPHORE_INCREMENT 1
-
#define SYSTEM_PAGE_PRIORITY_BITS 3
#define SYSTEM_PAGE_PRIORITY_LEVELS (1 << SYSTEM_PAGE_PRIORITY_BITS)
#if (NTDDI_VERSION >= NTDDI_WINXP)
-NTHALAPI
+_DECL_HAL_KE_IMPORT
KIRQL
FASTCALL
KeAcquireQueuedSpinLock(
IN OUT KSPIN_LOCK_QUEUE_NUMBER Number,
IN KIRQL OldIrql);
-NTHALAPI
+_DECL_HAL_KE_IMPORT
LOGICAL
FASTCALL
KeTryToAcquireQueuedSpinLock(
KeGetProcessorIndexFromNumber(
IN PPROCESSOR_NUMBER ProcNumber);
-#pragma pack(push,4)
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
-#ifndef VER_PRODUCTBUILD
-#define VER_PRODUCTBUILD 10000
-#endif
+NTKERNELAPI
+SIZE_T
+NTAPI
+ExQueryPoolBlockSize(
+ IN PVOID PoolBlock,
+ OUT PBOOLEAN QuotaCharged);
-#define EX_PUSH_LOCK ULONG_PTR
-#define PEX_PUSH_LOCK PULONG_PTR
+VOID
+ExAdjustLookasideDepth(
+ VOID);
-#include "csq.h"
+NTKERNELAPI
+VOID
+NTAPI
+ExDisableResourceBoostLite(
+ IN PERESOURCE Resource);
-#ifdef _NTOSKRNL_
-extern PUCHAR FsRtlLegalAnsiCharacterArray;
-#else
-extern DECLSPEC_IMPORT PUCHAR FsRtlLegalAnsiCharacterArray;
#endif
-extern PACL SePublicDefaultDacl;
-extern PACL SeSystemDefaultDacl;
-
-extern KSPIN_LOCK IoStatisticsLock;
-extern ULONG IoReadOperationCount;
-extern ULONG IoWriteOperationCount;
-extern ULONG IoOtherOperationCount;
-extern LARGE_INTEGER IoReadTransferCount;
-extern LARGE_INTEGER IoWriteTransferCount;
-extern LARGE_INTEGER IoOtherTransferCount;
-#define FS_LFN_APIS 0x00004000
+#define ExDisableResourceBoost ExDisableResourceBoostLite
-#define FILE_STORAGE_TYPE_SPECIFIED 0x00000041 /* FILE_DIRECTORY_FILE | FILE_NON_DIRECTORY_FILE */
-#define FILE_STORAGE_TYPE_DEFAULT (StorageTypeDefault << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_DIRECTORY (StorageTypeDirectory << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_FILE (StorageTypeFile << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_DOCFILE (StorageTypeDocfile << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_JUNCTION_POINT (StorageTypeJunctionPoint << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_CATALOG (StorageTypeCatalog << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_STRUCTURED_STORAGE (StorageTypeStructuredStorage << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_EMBEDDING (StorageTypeEmbedding << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_STREAM (StorageTypeStream << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_MINIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_DEFAULT
-#define FILE_MAXIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_STREAM
-#define FILE_STORAGE_TYPE_MASK 0x000f0000
-#define FILE_STORAGE_TYPE_SHIFT 16
+#define EX_PUSH_LOCK ULONG_PTR
+#define PEX_PUSH_LOCK PULONG_PTR
-#define FILE_VC_QUOTAS_LOG_VIOLATIONS 0x00000004
+VOID
+ExInitializePushLock (
+ OUT PEX_PUSH_LOCK PushLock);
-#define FSRTL_FLAG_FILE_MODIFIED (0x01)
-#define FSRTL_FLAG_FILE_LENGTH_CHANGED (0x02)
-#define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04)
-#define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08)
-#define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10)
-#define FSRTL_FLAG_USER_MAPPED_FILE (0x20)
-#define FSRTL_FLAG_ADVANCED_HEADER (0x40)
-#define FSRTL_FLAG_EOF_ADVANCE_ACTIVE (0x80)
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+PSLIST_ENTRY
+FASTCALL
+InterlockedPushListSList(
+ IN OUT PSLIST_HEADER ListHead,
+ IN OUT PSLIST_ENTRY List,
+ IN OUT PSLIST_ENTRY ListEnd,
+ IN ULONG Count);
-#define FSRTL_FLAG2_DO_MODIFIED_WRITE (0x01)
-#define FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS (0x02)
-#define FSRTL_FLAG2_PURGE_WHEN_MAPPED (0x04)
-#define FSRTL_FLAG2_IS_PAGING_FILE (0x08)
+#endif
-#define FSRTL_FSP_TOP_LEVEL_IRP (0x01)
-#define FSRTL_CACHE_TOP_LEVEL_IRP (0x02)
-#define FSRTL_MOD_WRITE_TOP_LEVEL_IRP (0x03)
-#define FSRTL_FAST_IO_TOP_LEVEL_IRP (0x04)
-#define FSRTL_MAX_TOP_LEVEL_IRP_FLAG (0x04)
+/* #if !defined(_X86AMD64_) FIXME : WHAT ?! */
+#if defined(_WIN64)
-#define FSRTL_VOLUME_DISMOUNT 1
-#define FSRTL_VOLUME_DISMOUNT_FAILED 2
-#define FSRTL_VOLUME_LOCK 3
-#define FSRTL_VOLUME_LOCK_FAILED 4
-#define FSRTL_VOLUME_UNLOCK 5
-#define FSRTL_VOLUME_MOUNT 6
+C_ASSERT(sizeof(ERESOURCE) == 0x68);
+C_ASSERT(FIELD_OFFSET(ERESOURCE,ActiveCount) == 0x18);
+C_ASSERT(FIELD_OFFSET(ERESOURCE,Flag) == 0x1a);
-#define FSRTL_WILD_CHARACTER 0x08
+#else
-#define FSRTL_FAT_LEGAL 0x01
-#define FSRTL_HPFS_LEGAL 0x02
-#define FSRTL_NTFS_LEGAL 0x04
-#define FSRTL_WILD_CHARACTER 0x08
-#define FSRTL_OLE_LEGAL 0x10
-#define FSRTL_NTFS_STREAM_LEGAL 0x14
+C_ASSERT(sizeof(ERESOURCE) == 0x38);
+C_ASSERT(FIELD_OFFSET(ERESOURCE,ActiveCount) == 0x0c);
+C_ASSERT(FIELD_OFFSET(ERESOURCE,Flag) == 0x0e);
-#ifdef _X86_
-#define HARDWARE_PTE HARDWARE_PTE_X86
-#define PHARDWARE_PTE PHARDWARE_PTE_X86
#endif
+/* #endif */
+
+#define TOKEN_HAS_TRAVERSE_PRIVILEGE 0x0001
+#define TOKEN_HAS_BACKUP_PRIVILEGE 0x0002
+#define TOKEN_HAS_RESTORE_PRIVILEGE 0x0004
+#define TOKEN_WRITE_RESTRICTED 0x0008
+#define TOKEN_IS_RESTRICTED 0x0010
+#define TOKEN_SESSION_NOT_REFERENCED 0x0020
+#define TOKEN_SANDBOX_INERT 0x0040
+#define TOKEN_HAS_IMPERSONATE_PRIVILEGE 0x0080
+#define SE_BACKUP_PRIVILEGES_CHECKED 0x0100
+#define TOKEN_VIRTUALIZE_ALLOWED 0x0200
+#define TOKEN_VIRTUALIZE_ENABLED 0x0400
+#define TOKEN_IS_FILTERED 0x0800
+#define TOKEN_UIACCESS 0x1000
+#define TOKEN_NOT_LOW 0x2000
-#define IO_CHECK_CREATE_PARAMETERS 0x0200
-#define IO_ATTACH_DEVICE 0x0400
+typedef struct _SE_EXPORTS {
+ LUID SeCreateTokenPrivilege;
+ LUID SeAssignPrimaryTokenPrivilege;
+ LUID SeLockMemoryPrivilege;
+ LUID SeIncreaseQuotaPrivilege;
+ LUID SeUnsolicitedInputPrivilege;
+ LUID SeTcbPrivilege;
+ LUID SeSecurityPrivilege;
+ LUID SeTakeOwnershipPrivilege;
+ LUID SeLoadDriverPrivilege;
+ LUID SeCreatePagefilePrivilege;
+ LUID SeIncreaseBasePriorityPrivilege;
+ LUID SeSystemProfilePrivilege;
+ LUID SeSystemtimePrivilege;
+ LUID SeProfileSingleProcessPrivilege;
+ LUID SeCreatePermanentPrivilege;
+ LUID SeBackupPrivilege;
+ LUID SeRestorePrivilege;
+ LUID SeShutdownPrivilege;
+ LUID SeDebugPrivilege;
+ LUID SeAuditPrivilege;
+ LUID SeSystemEnvironmentPrivilege;
+ LUID SeChangeNotifyPrivilege;
+ LUID SeRemoteShutdownPrivilege;
+ PSID SeNullSid;
+ PSID SeWorldSid;
+ PSID SeLocalSid;
+ PSID SeCreatorOwnerSid;
+ PSID SeCreatorGroupSid;
+ PSID SeNtAuthoritySid;
+ PSID SeDialupSid;
+ PSID SeNetworkSid;
+ PSID SeBatchSid;
+ PSID SeInteractiveSid;
+ PSID SeLocalSystemSid;
+ PSID SeAliasAdminsSid;
+ PSID SeAliasUsersSid;
+ PSID SeAliasGuestsSid;
+ PSID SeAliasPowerUsersSid;
+ PSID SeAliasAccountOpsSid;
+ PSID SeAliasSystemOpsSid;
+ PSID SeAliasPrintOpsSid;
+ PSID SeAliasBackupOpsSid;
+ PSID SeAuthenticatedUsersSid;
+ PSID SeRestrictedSid;
+ PSID SeAnonymousLogonSid;
+ LUID SeUndockPrivilege;
+ LUID SeSyncAgentPrivilege;
+ LUID SeEnableDelegationPrivilege;
+ PSID SeLocalServiceSid;
+ PSID SeNetworkServiceSid;
+ LUID SeManageVolumePrivilege;
+ LUID SeImpersonatePrivilege;
+ LUID SeCreateGlobalPrivilege;
+ LUID SeTrustedCredManAccessPrivilege;
+ LUID SeRelabelPrivilege;
+ LUID SeIncreaseWorkingSetPrivilege;
+ LUID SeTimeZonePrivilege;
+ LUID SeCreateSymbolicLinkPrivilege;
+ PSID SeIUserSid;
+ PSID SeUntrustedMandatorySid;
+ PSID SeLowMandatorySid;
+ PSID SeMediumMandatorySid;
+ PSID SeHighMandatorySid;
+ PSID SeSystemMandatorySid;
+ PSID SeOwnerRightsSid;
+} SE_EXPORTS, *PSE_EXPORTS;
-#define IO_ATTACH_DEVICE_API 0x80000000
+typedef NTSTATUS
+(NTAPI *PSE_LOGON_SESSION_TERMINATED_ROUTINE)(
+ IN PLUID LogonId);
-#define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE 64
-#define IO_FILE_OBJECT_PAGED_POOL_CHARGE 1024
+#define SeLengthSid( Sid ) \
+ (8 + (4 * ((SID *)Sid)->SubAuthorityCount))
-#define IO_TYPE_APC 18
-#define IO_TYPE_DPC 19
-#define IO_TYPE_DEVICE_QUEUE 20
-#define IO_TYPE_EVENT_PAIR 21
-#define IO_TYPE_INTERRUPT 22
-#define IO_TYPE_PROFILE 23
+#define SeDeleteClientSecurity(C) { \
+ if (SeTokenType((C)->ClientToken) == TokenPrimary) { \
+ PsDereferencePrimaryToken( (C)->ClientToken ); \
+ } else { \
+ PsDereferenceImpersonationToken( (C)->ClientToken ); \
+ } \
+}
-#define IRP_BEING_VERIFIED 0x10
+#define SeStopImpersonatingClient() PsRevertToSelf()
-#define MAILSLOT_CLASS_FIRSTCLASS 1
-#define MAILSLOT_CLASS_SECONDCLASS 2
+#define SeQuerySubjectContextToken( SubjectContext ) \
+ ( ARGUMENT_PRESENT( \
+ ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken \
+ ) ? \
+ ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken : \
+ ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
-#define MAILSLOT_SIZE_AUTO 0
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
-#define MEM_DOS_LIM 0x40000000
+NTKERNELAPI
+VOID
+NTAPI
+SeReleaseSubjectContext(
+ IN PSECURITY_SUBJECT_CONTEXT SubjectContext);
-#define MCB_FLAG_RAISE_ON_ALLOCATION_FAILURE 1
+NTKERNELAPI
+BOOLEAN
+NTAPI
+SePrivilegeCheck(
+ IN OUT PPRIVILEGE_SET RequiredPrivileges,
+ IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
+ IN KPROCESSOR_MODE AccessMode);
-#define OB_TYPE_TYPE 1
-#define OB_TYPE_DIRECTORY 2
-#define OB_TYPE_SYMBOLIC_LINK 3
-#define OB_TYPE_TOKEN 4
-#define OB_TYPE_PROCESS 5
-#define OB_TYPE_THREAD 6
-#define OB_TYPE_EVENT 7
-#define OB_TYPE_EVENT_PAIR 8
-#define OB_TYPE_MUTANT 9
-#define OB_TYPE_SEMAPHORE 10
-#define OB_TYPE_TIMER 11
-#define OB_TYPE_PROFILE 12
-#define OB_TYPE_WINDOW_STATION 13
-#define OB_TYPE_DESKTOP 14
-#define OB_TYPE_SECTION 15
-#define OB_TYPE_KEY 16
-#define OB_TYPE_PORT 17
-#define OB_TYPE_ADAPTER 18
-#define OB_TYPE_CONTROLLER 19
-#define OB_TYPE_DEVICE 20
-#define OB_TYPE_DRIVER 21
-#define OB_TYPE_IO_COMPLETION 22
-#define OB_TYPE_FILE 23
+NTKERNELAPI
+VOID
+NTAPI
+SeOpenObjectAuditAlarm(
+ IN PUNICODE_STRING ObjectTypeName,
+ IN PVOID Object OPTIONAL,
+ IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
+ IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+ IN PACCESS_STATE AccessState,
+ IN BOOLEAN ObjectCreated,
+ IN BOOLEAN AccessGranted,
+ IN KPROCESSOR_MODE AccessMode,
+ OUT PBOOLEAN GenerateOnClose);
-#define PIN_WAIT (1)
-#define PIN_EXCLUSIVE (2)
-#define PIN_NO_READ (4)
-#define PIN_IF_BCB (8)
+NTKERNELAPI
+VOID
+NTAPI
+SeOpenObjectForDeleteAuditAlarm(
+ IN PUNICODE_STRING ObjectTypeName,
+ IN PVOID Object OPTIONAL,
+ IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
+ IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+ IN PACCESS_STATE AccessState,
+ IN BOOLEAN ObjectCreated,
+ IN BOOLEAN AccessGranted,
+ IN KPROCESSOR_MODE AccessMode,
+ OUT PBOOLEAN GenerateOnClose);
-#define SEC_BASED 0x00200000
+NTKERNELAPI
+VOID
+NTAPI
+SeDeleteObjectAuditAlarm(
+ IN PVOID Object,
+ IN HANDLE Handle);
-#define SECURITY_WORLD_SID_AUTHORITY {0,0,0,0,0,1}
-#define SECURITY_WORLD_RID (0x00000000L)
+NTKERNELAPI
+TOKEN_TYPE
+NTAPI
+SeTokenType(
+ IN PACCESS_TOKEN Token);
-/* end winnt.h */
+NTKERNELAPI
+BOOLEAN
+NTAPI
+SeTokenIsAdmin(
+ IN PACCESS_TOKEN Token);
-#define TOKEN_HAS_TRAVERSE_PRIVILEGE 0x01
-#define TOKEN_HAS_BACKUP_PRIVILEGE 0x02
-#define TOKEN_HAS_RESTORE_PRIVILEGE 0x04
-#define TOKEN_HAS_ADMIN_GROUP 0x08
-#define TOKEN_WRITE_RESTRICTED 0x08
-#define TOKEN_IS_RESTRICTED 0x10
-#define SE_BACKUP_PRIVILEGES_CHECKED 0x0100
+NTKERNELAPI
+BOOLEAN
+NTAPI
+SeTokenIsRestricted(
+ IN PACCESS_TOKEN Token);
-#define VACB_MAPPING_GRANULARITY (0x40000)
-#define VACB_OFFSET_SHIFT (18)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+SeQueryAuthenticationIdToken(
+ IN PACCESS_TOKEN Token,
+ OUT PLUID AuthenticationId);
-#if (VER_PRODUCTBUILD >= 1381)
-#define FSCTL_MARK_AS_SYSTEM_HIVE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS)
-#define FSCTL_GET_HFS_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS)
-#endif /* (VER_PRODUCTBUILD >= 1381) */
+NTKERNELAPI
+NTSTATUS
+NTAPI
+SeQuerySessionIdToken(
+ IN PACCESS_TOKEN Token,
+ OUT PULONG SessionId);
-#if (VER_PRODUCTBUILD >= 2195)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+SeCreateClientSecurity(
+ IN PETHREAD ClientThread,
+ IN PSECURITY_QUALITY_OF_SERVICE ClientSecurityQos,
+ IN BOOLEAN RemoteSession,
+ OUT PSECURITY_CLIENT_CONTEXT ClientContext);
-#define FSCTL_READ_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 33, METHOD_NEITHER, FILE_ANY_ACCESS)
-#define FSCTL_WRITE_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 34, METHOD_NEITHER, FILE_ANY_ACCESS)
+NTKERNELAPI
+VOID
+NTAPI
+SeImpersonateClient(
+ IN PSECURITY_CLIENT_CONTEXT ClientContext,
+ IN PETHREAD ServerThread OPTIONAL);
-#define FSCTL_DUMP_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 37, METHOD_NEITHER, FILE_ANY_ACCESS)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+SeImpersonateClientEx(
+ IN PSECURITY_CLIENT_CONTEXT ClientContext,
+ IN PETHREAD ServerThread OPTIONAL);
-#define FSCTL_HSM_MSG CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
-#define FSCTL_NSS_CONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 67, METHOD_BUFFERED, FILE_WRITE_DATA)
-#define FSCTL_HSM_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
-#define FSCTL_NSS_RCONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 70, METHOD_BUFFERED, FILE_READ_DATA)
-#endif /* (VER_PRODUCTBUILD >= 2195) */
+NTKERNELAPI
+NTSTATUS
+NTAPI
+SeCreateClientSecurityFromSubjectContext(
+ IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
+ IN PSECURITY_QUALITY_OF_SERVICE ClientSecurityQos,
+ IN BOOLEAN ServerIsRemote,
+ OUT PSECURITY_CLIENT_CONTEXT ClientContext);
-#define FSCTL_NETWORK_SET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 102, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
-#define FSCTL_NETWORK_GET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 103, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
-#define FSCTL_NETWORK_GET_CONNECTION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 104, METHOD_NEITHER, FILE_ANY_ACCESS)
-#define FSCTL_NETWORK_ENUMERATE_CONNECTIONS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 105, METHOD_NEITHER, FILE_ANY_ACCESS)
-#define FSCTL_NETWORK_DELETE_CONNECTION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 107, METHOD_BUFFERED, FILE_ANY_ACCESS)
-#define FSCTL_NETWORK_GET_STATISTICS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 116, METHOD_BUFFERED, FILE_ANY_ACCESS)
-#define FSCTL_NETWORK_SET_DOMAIN_NAME CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_ANY_ACCESS)
-#define FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_ANY_ACCESS)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+SeQuerySecurityDescriptorInfo(
+ IN PSECURITY_INFORMATION SecurityInformation,
+ OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
+ IN OUT PULONG Length,
+ IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor);
-#define IOCTL_REDIR_QUERY_PATH CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+SeSetSecurityDescriptorInfo(
+ IN PVOID Object OPTIONAL,
+ IN PSECURITY_INFORMATION SecurityInformation,
+ IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+ IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
+ IN POOL_TYPE PoolType,
+ IN PGENERIC_MAPPING GenericMapping);
-typedef PVOID OPLOCK, *POPLOCK;
+NTKERNELAPI
+NTSTATUS
+NTAPI
+SeSetSecurityDescriptorInfoEx(
+ IN PVOID Object OPTIONAL,
+ IN PSECURITY_INFORMATION SecurityInformation,
+ IN PSECURITY_DESCRIPTOR ModificationDescriptor,
+ IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
+ IN ULONG AutoInheritFlags,
+ IN POOL_TYPE PoolType,
+ IN PGENERIC_MAPPING GenericMapping);
-//
-// Forwarders
-//
-struct _RTL_AVL_TABLE;
-struct _RTL_GENERIC_TABLE;
+NTKERNELAPI
+NTSTATUS
+NTAPI
+SeAppendPrivileges(
+ IN OUT PACCESS_STATE AccessState,
+ IN PPRIVILEGE_SET Privileges);
-typedef ULONG LBN;
-typedef LBN *PLBN;
+NTKERNELAPI
+BOOLEAN
+NTAPI
+SeAuditingFileEvents(
+ IN BOOLEAN AccessGranted,
+ IN PSECURITY_DESCRIPTOR SecurityDescriptor);
-typedef ULONG VBN;
-typedef VBN *PVBN;
+NTKERNELAPI
+BOOLEAN
+NTAPI
+SeAuditingFileOrGlobalEvents(
+ IN BOOLEAN AccessGranted,
+ IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+ IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext);
-typedef PVOID PNOTIFY_SYNC;
+VOID
+NTAPI
+SeSetAccessStateGenericMapping(
+ IN OUT PACCESS_STATE AccessState,
+ IN PGENERIC_MAPPING GenericMapping);
-typedef enum _FAST_IO_POSSIBLE {
- FastIoIsNotPossible,
- FastIoIsPossible,
- FastIoIsQuestionable
-} FAST_IO_POSSIBLE;
+NTKERNELAPI
+NTSTATUS
+NTAPI
+SeRegisterLogonSessionTerminatedRoutine(
+ IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine);
-typedef enum _FILE_STORAGE_TYPE {
- StorageTypeDefault = 1,
- StorageTypeDirectory,
- StorageTypeFile,
- StorageTypeJunctionPoint,
- StorageTypeCatalog,
- StorageTypeStructuredStorage,
- StorageTypeEmbedding,
- StorageTypeStream
-} FILE_STORAGE_TYPE;
+NTKERNELAPI
+NTSTATUS
+NTAPI
+SeUnregisterLogonSessionTerminatedRoutine(
+ IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine);
-typedef struct _OBJECT_BASIC_INFORMATION
-{
- ULONG Attributes;
- ACCESS_MASK GrantedAccess;
- ULONG HandleCount;
- ULONG PointerCount;
- ULONG PagedPoolCharge;
- ULONG NonPagedPoolCharge;
- ULONG Reserved[ 3 ];
- ULONG NameInfoSize;
- ULONG TypeInfoSize;
- ULONG SecurityDescriptorSize;
- LARGE_INTEGER CreationTime;
-} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
+NTKERNELAPI
+NTSTATUS
+NTAPI
+SeMarkLogonSessionForTerminationNotification(
+ IN PLUID LogonId);
-typedef struct _BITMAP_RANGE {
- LIST_ENTRY Links;
- LONGLONG BasePage;
- ULONG FirstDirtyPage;
- ULONG LastDirtyPage;
- ULONG DirtyPages;
- PULONG Bitmap;
-} BITMAP_RANGE, *PBITMAP_RANGE;
+NTKERNELAPI
+NTSTATUS
+NTAPI
+SeQueryInformationToken(
+ IN PACCESS_TOKEN Token,
+ IN TOKEN_INFORMATION_CLASS TokenInformationClass,
+ OUT PVOID *TokenInformation);
-typedef struct _CACHE_UNINITIALIZE_EVENT {
- struct _CACHE_UNINITIALIZE_EVENT *Next;
- KEVENT Event;
-} CACHE_UNINITIALIZE_EVENT, *PCACHE_UNINITIALIZE_EVENT;
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
-typedef struct _CC_FILE_SIZES {
- LARGE_INTEGER AllocationSize;
- LARGE_INTEGER FileSize;
- LARGE_INTEGER ValidDataLength;
-} CC_FILE_SIZES, *PCC_FILE_SIZES;
+#if (NTDDI_VERSION >= NTDDI_WIN2KSP3)
+NTKERNELAPI
+BOOLEAN
+NTAPI
+SeAuditingHardLinkEvents(
+ IN BOOLEAN AccessGranted,
+ IN PSECURITY_DESCRIPTOR SecurityDescriptor);
+#endif
-typedef struct _FILE_COPY_ON_WRITE_INFORMATION {
- BOOLEAN ReplaceIfExists;
- HANDLE RootDirectory;
- ULONG FileNameLength;
- WCHAR FileName[1];
-} FILE_COPY_ON_WRITE_INFORMATION, *PFILE_COPY_ON_WRITE_INFORMATION;
+#if (NTDDI_VERSION >= NTDDI_WINXP)
-typedef struct _FILE_FULL_DIRECTORY_INFORMATION {
- ULONG NextEntryOffset;
- ULONG FileIndex;
- LARGE_INTEGER CreationTime;
- LARGE_INTEGER LastAccessTime;
- LARGE_INTEGER LastWriteTime;
- LARGE_INTEGER ChangeTime;
- LARGE_INTEGER EndOfFile;
- LARGE_INTEGER AllocationSize;
- ULONG FileAttributes;
- ULONG FileNameLength;
- ULONG EaSize;
- WCHAR FileName[ANYSIZE_ARRAY];
-} FILE_FULL_DIRECTORY_INFORMATION, *PFILE_FULL_DIRECTORY_INFORMATION;
+NTKERNELAPI
+NTSTATUS
+NTAPI
+SeFilterToken(
+ IN PACCESS_TOKEN ExistingToken,
+ IN ULONG Flags,
+ IN PTOKEN_GROUPS SidsToDisable OPTIONAL,
+ IN PTOKEN_PRIVILEGES PrivilegesToDelete OPTIONAL,
+ IN PTOKEN_GROUPS RestrictedSids OPTIONAL,
+ OUT PACCESS_TOKEN *FilteredToken);
-typedef struct _FILE_FS_FULL_SIZE_INFORMATION {
- LARGE_INTEGER TotalAllocationUnits;
- LARGE_INTEGER CallerAvailableAllocationUnits;
- LARGE_INTEGER ActualAvailableAllocationUnits;
- ULONG SectorsPerAllocationUnit;
- ULONG BytesPerSector;
-} FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
+NTKERNELAPI
+VOID
+NTAPI
+SeAuditHardLinkCreation(
+ IN PUNICODE_STRING FileName,
+ IN PUNICODE_STRING LinkName,
+ IN BOOLEAN bSuccess);
-typedef struct _FILE_FS_LABEL_INFORMATION {
- ULONG VolumeLabelLength;
- WCHAR VolumeLabel[1];
-} FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
-#if (VER_PRODUCTBUILD >= 2195)
+#if (NTDDI_VERSION >= NTDDI_WINXPSP2)
-typedef struct _FILE_FS_OBJECT_ID_INFORMATION {
- UCHAR ObjectId[16];
- UCHAR ExtendedInfo[48];
-} FILE_FS_OBJECT_ID_INFORMATION, *PFILE_FS_OBJECT_ID_INFORMATION;
+NTKERNELAPI
+BOOLEAN
+NTAPI
+SeAuditingFileEventsWithContext(
+ IN BOOLEAN AccessGranted,
+ IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+ IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext OPTIONAL);
-#endif /* (VER_PRODUCTBUILD >= 2195) */
+NTKERNELAPI
+BOOLEAN
+NTAPI
+SeAuditingHardLinkEventsWithContext(
+ IN BOOLEAN AccessGranted,
+ IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+ IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext OPTIONAL);
-typedef struct _FILE_FS_SIZE_INFORMATION {
- LARGE_INTEGER TotalAllocationUnits;
- LARGE_INTEGER AvailableAllocationUnits;
- ULONG SectorsPerAllocationUnit;
- ULONG BytesPerSector;
-} FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
+#endif
-typedef struct _FILE_FS_VOLUME_INFORMATION {
- LARGE_INTEGER VolumeCreationTime;
- ULONG VolumeSerialNumber;
- ULONG VolumeLabelLength;
- BOOLEAN SupportsObjects;
- WCHAR VolumeLabel[1];
-} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
+#if (NTDDI_VERSION >= NTDDI_VISTA)
-typedef struct _FILE_FS_OBJECTID_INFORMATION
-{
- UCHAR ObjectId[16];
- UCHAR ExtendedInfo[48];
-} FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION;
+NTKERNELAPI
+VOID
+NTAPI
+SeOpenObjectAuditAlarmWithTransaction(
+ IN PUNICODE_STRING ObjectTypeName,
+ IN PVOID Object OPTIONAL,
+ IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
+ IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+ IN PACCESS_STATE AccessState,
+ IN BOOLEAN ObjectCreated,
+ IN BOOLEAN AccessGranted,
+ IN KPROCESSOR_MODE AccessMode,
+ IN GUID *TransactionId OPTIONAL,
+ OUT PBOOLEAN GenerateOnClose);
-typedef struct _FILE_LOCK_INFO
-{
- LARGE_INTEGER StartingByte;
- LARGE_INTEGER Length;
- BOOLEAN ExclusiveLock;
- ULONG Key;
- PFILE_OBJECT FileObject;
- PVOID ProcessId;
- LARGE_INTEGER EndingByte;
-} FILE_LOCK_INFO, *PFILE_LOCK_INFO;
+NTKERNELAPI
+VOID
+NTAPI
+SeOpenObjectForDeleteAuditAlarmWithTransaction(
+ IN PUNICODE_STRING ObjectTypeName,
+ IN PVOID Object OPTIONAL,
+ IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
+ IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+ IN PACCESS_STATE AccessState,
+ IN BOOLEAN ObjectCreated,
+ IN BOOLEAN AccessGranted,
+ IN KPROCESSOR_MODE AccessMode,
+ IN GUID *TransactionId OPTIONAL,
+ OUT PBOOLEAN GenerateOnClose);
-/* raw internal file lock struct returned from FsRtlGetNextFileLock */
-typedef struct _FILE_SHARED_LOCK_ENTRY {
- PVOID Unknown1;
- PVOID Unknown2;
- FILE_LOCK_INFO FileLock;
-} FILE_SHARED_LOCK_ENTRY, *PFILE_SHARED_LOCK_ENTRY;
+NTKERNELAPI
+VOID
+NTAPI
+SeExamineSacl(
+ IN PACL Sacl,
+ IN PACCESS_TOKEN Token,
+ IN ACCESS_MASK DesiredAccess,
+ IN BOOLEAN AccessGranted,
+ OUT PBOOLEAN GenerateAudit,
+ OUT PBOOLEAN GenerateAlarm);
-/* raw internal file lock struct returned from FsRtlGetNextFileLock */
-typedef struct _FILE_EXCLUSIVE_LOCK_ENTRY {
- LIST_ENTRY ListEntry;
- PVOID Unknown1;
- PVOID Unknown2;
- FILE_LOCK_INFO FileLock;
-} FILE_EXCLUSIVE_LOCK_ENTRY, *PFILE_EXCLUSIVE_LOCK_ENTRY;
+NTKERNELAPI
+VOID
+NTAPI
+SeDeleteObjectAuditAlarmWithTransaction(
+ IN PVOID Object,
+ IN HANDLE Handle,
+ IN GUID *TransactionId OPTIONAL);
-typedef NTSTATUS (NTAPI *PCOMPLETE_LOCK_IRP_ROUTINE) (
- IN PVOID Context,
- IN PIRP Irp
-);
+NTKERNELAPI
+VOID
+NTAPI
+SeQueryTokenIntegrity(
+ IN PACCESS_TOKEN Token,
+ IN OUT PSID_AND_ATTRIBUTES IntegritySA);
-typedef VOID (NTAPI *PUNLOCK_ROUTINE) (
- IN PVOID Context,
- IN PFILE_LOCK_INFO FileLockInfo
-);
+NTKERNELAPI
+NTSTATUS
+NTAPI
+SeSetSessionIdToken(
+ IN PACCESS_TOKEN Token,
+ IN ULONG SessionId);
-typedef struct _FILE_LOCK {
- PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine;
- PUNLOCK_ROUTINE UnlockRoutine;
- BOOLEAN FastIoIsQuestionable;
- BOOLEAN Pad[3];
- PVOID LockInformation;
- FILE_LOCK_INFO LastReturnedLockInfo;
- PVOID LastReturnedLock;
-} FILE_LOCK, *PFILE_LOCK;
+NTKERNELAPI
+VOID
+NTAPI
+SeAuditHardLinkCreationWithTransaction(
+ IN PUNICODE_STRING FileName,
+ IN PUNICODE_STRING LinkName,
+ IN BOOLEAN bSuccess,
+ IN GUID *TransactionId OPTIONAL);
-typedef struct _FILE_MAILSLOT_PEEK_BUFFER {
- ULONG ReadDataAvailable;
- ULONG NumberOfMessages;
- ULONG MessageLength;
-} FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER;
+NTKERNELAPI
+VOID
+NTAPI
+SeAuditTransactionStateChange(
+ IN GUID *TransactionId,
+ IN GUID *ResourceManagerId,
+ IN ULONG NewTransactionState);
-typedef struct _FILE_OLE_CLASSID_INFORMATION {
- GUID ClassId;
-} FILE_OLE_CLASSID_INFORMATION, *PFILE_OLE_CLASSID_INFORMATION;
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
-typedef struct _FILE_OLE_ALL_INFORMATION {
- FILE_BASIC_INFORMATION BasicInformation;
- FILE_STANDARD_INFORMATION StandardInformation;
- FILE_INTERNAL_INFORMATION InternalInformation;
- FILE_EA_INFORMATION EaInformation;
- FILE_ACCESS_INFORMATION AccessInformation;
- FILE_POSITION_INFORMATION PositionInformation;
- FILE_MODE_INFORMATION ModeInformation;
- FILE_ALIGNMENT_INFORMATION AlignmentInformation;
- USN LastChangeUsn;
- USN ReplicationUsn;
- LARGE_INTEGER SecurityChangeTime;
- FILE_OLE_CLASSID_INFORMATION OleClassIdInformation;
- FILE_OBJECTID_INFORMATION ObjectIdInformation;
- FILE_STORAGE_TYPE StorageType;
- ULONG OleStateBits;
- ULONG OleId;
- ULONG NumberOfStreamReferences;
- ULONG StreamIndex;
- ULONG SecurityId;
- BOOLEAN ContentIndexDisable;
- BOOLEAN InheritContentIndexDisable;
- FILE_NAME_INFORMATION NameInformation;
-} FILE_OLE_ALL_INFORMATION, *PFILE_OLE_ALL_INFORMATION;
+#if (NTDDI_VERSION >= NTDDI_VISTA || (NTDDI_VERSION >= NTDDI_WINXPSP2 && NTDDI_VERSION < NTDDI_WS03))
+NTKERNELAPI
+BOOLEAN
+NTAPI
+SeTokenIsWriteRestricted(
+ IN PACCESS_TOKEN Token);
+#endif
-typedef struct _FILE_OLE_DIR_INFORMATION {
- ULONG NextEntryOffset;
- ULONG FileIndex;
- LARGE_INTEGER CreationTime;
- LARGE_INTEGER LastAccessTime;
- LARGE_INTEGER LastWriteTime;
- LARGE_INTEGER ChangeTime;
- LARGE_INTEGER EndOfFile;
- LARGE_INTEGER AllocationSize;
- ULONG FileAttributes;
- ULONG FileNameLength;
- FILE_STORAGE_TYPE StorageType;
- GUID OleClassId;
- ULONG OleStateBits;
- BOOLEAN ContentIndexDisable;
- BOOLEAN InheritContentIndexDisable;
- WCHAR FileName[1];
-} FILE_OLE_DIR_INFORMATION, *PFILE_OLE_DIR_INFORMATION;
+#if (NTDDI_VERSION >= NTDDI_WIN7)
-typedef struct _FILE_OLE_INFORMATION {
- LARGE_INTEGER SecurityChangeTime;
- FILE_OLE_CLASSID_INFORMATION OleClassIdInformation;
- FILE_OBJECTID_INFORMATION ObjectIdInformation;
- FILE_STORAGE_TYPE StorageType;
- ULONG OleStateBits;
- BOOLEAN ContentIndexDisable;
- BOOLEAN InheritContentIndexDisable;
-} FILE_OLE_INFORMATION, *PFILE_OLE_INFORMATION;
+NTKERNELAPI
+BOOLEAN
+NTAPI
+SeAuditingAnyFileEventsWithContext(
+ IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+ IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext OPTIONAL);
-typedef struct _FILE_OLE_STATE_BITS_INFORMATION {
- ULONG StateBits;
- ULONG StateBitsMask;
-} FILE_OLE_STATE_BITS_INFORMATION, *PFILE_OLE_STATE_BITS_INFORMATION;
+NTKERNELAPI
+VOID
+NTAPI
+SeExamineGlobalSacl(
+ IN PUNICODE_STRING ObjectType,
+ IN PACCESS_TOKEN Token,
+ IN ACCESS_MASK DesiredAccess,
+ IN BOOLEAN AccessGranted,
+ IN OUT PBOOLEAN GenerateAudit,
+ IN OUT PBOOLEAN GenerateAlarm OPTIONAL);
-#if (VER_PRODUCTBUILD >= 2195)
-typedef struct FILE_ALLOCATED_RANGE_BUFFER {
- LARGE_INTEGER FileOffset;
- LARGE_INTEGER Length;
-} FILE_ALLOCATED_RANGE_BUFFER, *PFILE_ALLOCATED_RANGE_BUFFER;
-#endif /* (VER_PRODUCTBUILD >= 2195) */
+NTKERNELAPI
+VOID
+NTAPI
+SeMaximumAuditMaskFromGlobalSacl(
+ IN PUNICODE_STRING ObjectTypeName OPTIONAL,
+ IN ACCESS_MASK GrantedAccess,
+ IN PACCESS_TOKEN Token,
+ IN OUT PACCESS_MASK AuditMask);
-#define FSRTL_FCB_HEADER_V0 (0x00)
-#define FSRTL_FCB_HEADER_V1 (0x01)
+#endif
+NTSTATUS
+NTAPI
+SeReportSecurityEventWithSubCategory(
+ IN ULONG Flags,
+ IN PUNICODE_STRING SourceName,
+ IN PSID UserSid OPTIONAL,
+ IN PSE_ADT_PARAMETER_ARRAY AuditParameters,
+ IN ULONG AuditSubcategoryId);
-typedef struct _FSRTL_COMMON_FCB_HEADER {
- CSHORT NodeTypeCode;
- CSHORT NodeByteSize;
- UCHAR Flags;
- UCHAR IsFastIoPossible;
-#if (VER_PRODUCTBUILD >= 1381)
- UCHAR Flags2;
- UCHAR Reserved;
-#endif /* (VER_PRODUCTBUILD >= 1381) */
- PERESOURCE Resource;
- PERESOURCE PagingIoResource;
- LARGE_INTEGER AllocationSize;
- LARGE_INTEGER FileSize;
- LARGE_INTEGER ValidDataLength;
-} FSRTL_COMMON_FCB_HEADER, *PFSRTL_COMMON_FCB_HEADER;
+BOOLEAN
+NTAPI
+SeAccessCheckFromState(
+ IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+ IN PTOKEN_ACCESS_INFORMATION PrimaryTokenInformation,
+ IN PTOKEN_ACCESS_INFORMATION ClientTokenInformation OPTIONAL,
+ IN ACCESS_MASK DesiredAccess,
+ IN ACCESS_MASK PreviouslyGrantedAccess,
+ OUT PPRIVILEGE_SET *Privileges OPTIONAL,
+ IN PGENERIC_MAPPING GenericMapping,
+ IN KPROCESSOR_MODE AccessMode,
+ OUT PACCESS_MASK GrantedAccess,
+ OUT PNTSTATUS AccessStatus);
-typedef enum _FSRTL_COMPARISON_RESULT
-{
- LessThan = -1,
- EqualTo = 0,
- GreaterThan = 1
-} FSRTL_COMPARISON_RESULT;
-
-#if (VER_PRODUCTBUILD >= 2600)
+NTKERNELAPI
+VOID
+NTAPI
+SeFreePrivileges(
+ IN PPRIVILEGE_SET Privileges);
-typedef struct _FSRTL_ADVANCED_FCB_HEADER {
- CSHORT NodeTypeCode;
- CSHORT NodeByteSize;
- UCHAR Flags;
- UCHAR IsFastIoPossible;
- UCHAR Flags2;
- UCHAR Reserved: 4;
- UCHAR Version: 4;
- PERESOURCE Resource;
- PERESOURCE PagingIoResource;
- LARGE_INTEGER AllocationSize;
- LARGE_INTEGER FileSize;
- LARGE_INTEGER ValidDataLength;
- PFAST_MUTEX FastMutex;
- LIST_ENTRY FilterContexts;
- EX_PUSH_LOCK PushLock;
- PVOID *FileContextSupportPointer;
-} FSRTL_ADVANCED_FCB_HEADER, *PFSRTL_ADVANCED_FCB_HEADER;
+NTSTATUS
+NTAPI
+SeLocateProcessImageName(
+ IN OUT PEPROCESS Process,
+ OUT PUNICODE_STRING *pImageFileName);
-typedef struct _FSRTL_PER_STREAM_CONTEXT {
- LIST_ENTRY Links;
- PVOID OwnerId;
- PVOID InstanceId;
- PFREE_FUNCTION FreeCallback;
-} FSRTL_PER_STREAM_CONTEXT, *PFSRTL_PER_STREAM_CONTEXT;
+extern NTKERNELAPI PSE_EXPORTS SeExports;
-typedef struct _FSRTL_PER_FILEOBJECT_CONTEXT
-{
- LIST_ENTRY Links;
- PVOID OwnerId;
- PVOID InstanceId;
-} FSRTL_PER_FILEOBJECT_CONTEXT, *PFSRTL_PER_FILEOBJECT_CONTEXT;
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
-#endif /* (VER_PRODUCTBUILD >= 2600) */
+NTKERNELAPI
+PACCESS_TOKEN
+NTAPI
+PsReferenceImpersonationToken(
+ IN OUT PETHREAD Thread,
+ OUT PBOOLEAN CopyOnOpen,
+ OUT PBOOLEAN EffectiveOnly,
+ OUT PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel);
-typedef struct _BASE_MCB
-{
- ULONG MaximumPairCount;
- ULONG PairCount;
- USHORT PoolType;
- USHORT Flags;
- PVOID Mapping;
-} BASE_MCB, *PBASE_MCB;
+NTKERNELAPI
+LARGE_INTEGER
+NTAPI
+PsGetProcessExitTime(
+ VOID);
-typedef struct _LARGE_MCB
-{
- PKGUARDED_MUTEX GuardedMutex;
- BASE_MCB BaseMcb;
-} LARGE_MCB, *PLARGE_MCB;
+NTKERNELAPI
+BOOLEAN
+NTAPI
+PsIsThreadTerminating(
+ IN PETHREAD Thread);
-typedef struct _MCB
-{
- LARGE_MCB DummyFieldThatSizesThisStructureCorrectly;
-} MCB, *PMCB;
+NTKERNELAPI
+NTSTATUS
+NTAPI
+PsImpersonateClient(
+ IN OUT PETHREAD Thread,
+ IN PACCESS_TOKEN Token,
+ IN BOOLEAN CopyOnOpen,
+ IN BOOLEAN EffectiveOnly,
+ IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel);
-typedef struct _MAPPING_PAIR {
- ULONGLONG Vcn;
- ULONGLONG Lcn;
-} MAPPING_PAIR, *PMAPPING_PAIR;
+NTKERNELAPI
+BOOLEAN
+NTAPI
+PsDisableImpersonation(
+ IN OUT PETHREAD Thread,
+ IN OUT PSE_IMPERSONATION_STATE ImpersonationState);
-typedef struct _GET_RETRIEVAL_DESCRIPTOR {
- ULONG NumberOfPairs;
- ULONGLONG StartVcn;
- MAPPING_PAIR Pair[1];
-} GET_RETRIEVAL_DESCRIPTOR, *PGET_RETRIEVAL_DESCRIPTOR;
+NTKERNELAPI
+VOID
+NTAPI
+PsRestoreImpersonation(
+ IN PETHREAD Thread,
+ IN PSE_IMPERSONATION_STATE ImpersonationState);
-#define ASSERT_QUEUE(Q) ASSERT(((Q)->Header.Type & KOBJECT_TYPE_MASK) == QueueObject);
+NTKERNELAPI
+VOID
+NTAPI
+PsRevertToSelf(
+ VOID);
-typedef struct _MBCB {
- CSHORT NodeTypeCode;
- CSHORT NodeIsInZone;
- ULONG PagesToWrite;
- ULONG DirtyPages;
- ULONG Reserved;
- LIST_ENTRY BitmapRanges;
- LONGLONG ResumeWritePage;
- BITMAP_RANGE BitmapRange1;
- BITMAP_RANGE BitmapRange2;
- BITMAP_RANGE BitmapRange3;
-} MBCB, *PMBCB;
+NTKERNELAPI
+VOID
+NTAPI
+PsChargePoolQuota(
+ IN PEPROCESS Process,
+ IN POOL_TYPE PoolType,
+ IN ULONG_PTR Amount);
-typedef enum _MMFLUSH_TYPE {
- MmFlushForDelete,
- MmFlushForWrite
-} MMFLUSH_TYPE;
+NTKERNELAPI
+VOID
+NTAPI
+PsReturnPoolQuota(
+ IN PEPROCESS Process,
+ IN POOL_TYPE PoolType,
+ IN ULONG_PTR Amount);
-typedef struct _MOVEFILE_DESCRIPTOR {
- HANDLE FileHandle;
- ULONG Reserved;
- LARGE_INTEGER StartVcn;
- LARGE_INTEGER TargetLcn;
- ULONG NumVcns;
- ULONG Reserved1;
-} MOVEFILE_DESCRIPTOR, *PMOVEFILE_DESCRIPTOR;
+#endif
-typedef struct _OBJECT_BASIC_INFO {
- ULONG Attributes;
- ACCESS_MASK GrantedAccess;
- ULONG HandleCount;
- ULONG ReferenceCount;
- ULONG PagedPoolUsage;
- ULONG NonPagedPoolUsage;
- ULONG Reserved[3];
- ULONG NameInformationLength;
- ULONG TypeInformationLength;
- ULONG SecurityDescriptorLength;
- LARGE_INTEGER CreateTime;
-} OBJECT_BASIC_INFO, *POBJECT_BASIC_INFO;
+#if (NTDDI_VERSION >= NTDDI_WINXP)
-typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFO {
- BOOLEAN Inherit;
- BOOLEAN ProtectFromClose;
-} OBJECT_HANDLE_ATTRIBUTE_INFO, *POBJECT_HANDLE_ATTRIBUTE_INFO;
+NTKERNELAPI
+VOID
+NTAPI
+PsDereferencePrimaryToken(
+ IN PACCESS_TOKEN PrimaryToken);
-typedef struct _OBJECT_NAME_INFO {
- UNICODE_STRING ObjectName;
- WCHAR ObjectNameBuffer[1];
-} OBJECT_NAME_INFO, *POBJECT_NAME_INFO;
+NTKERNELAPI
+VOID
+NTAPI
+PsDereferenceImpersonationToken(
+ IN PACCESS_TOKEN ImpersonationToken);
-typedef struct _OBJECT_PROTECTION_INFO {
- BOOLEAN Inherit;
- BOOLEAN ProtectHandle;
-} OBJECT_PROTECTION_INFO, *POBJECT_PROTECTION_INFO;
+NTKERNELAPI
+NTSTATUS
+NTAPI
+PsChargeProcessPoolQuota(
+ IN PEPROCESS Process,
+ IN POOL_TYPE PoolType,
+ IN ULONG_PTR Amount);
-typedef struct _OBJECT_TYPE_INFO {
- UNICODE_STRING ObjectTypeName;
- UCHAR Unknown[0x58];
- WCHAR ObjectTypeNameBuffer[1];
-} OBJECT_TYPE_INFO, *POBJECT_TYPE_INFO;
+NTKERNELAPI
+BOOLEAN
+NTAPI
+PsIsSystemThread(
+ IN PETHREAD Thread);
-typedef struct _OBJECT_ALL_TYPES_INFO {
- ULONG NumberOfObjectTypes;
- OBJECT_TYPE_INFO ObjectsTypeInfo[1];
-} OBJECT_ALL_TYPES_INFO, *POBJECT_ALL_TYPES_INFO;
+#endif
-typedef enum _RTL_GENERIC_COMPARE_RESULTS
-{
- GenericLessThan,
- GenericGreaterThan,
- GenericEqual
-} RTL_GENERIC_COMPARE_RESULTS;
+NTKERNELAPI
+NTSTATUS
+NTAPI
+PsLookupProcessByProcessId(
+ IN HANDLE ProcessId,
+ OUT PEPROCESS *Process);
-typedef enum _TABLE_SEARCH_RESULT
-{
- TableEmptyTree,
- TableFoundNode,
- TableInsertAsLeft,
- TableInsertAsRight
-} TABLE_SEARCH_RESULT;
+NTKERNELAPI
+NTSTATUS
+NTAPI
+PsLookupThreadByThreadId(
+ IN HANDLE UniqueThreadId,
+ OUT PETHREAD *Thread);
-typedef NTSTATUS
-(NTAPI *PRTL_AVL_MATCH_FUNCTION)(
- struct _RTL_AVL_TABLE *Table,
- PVOID UserData,
- PVOID MatchData
-);
+#define IO_OPEN_PAGING_FILE 0x0002
+#define IO_OPEN_TARGET_DIRECTORY 0x0004
+#define IO_STOP_ON_SYMLINK 0x0008
+#define IO_MM_PAGING_FILE 0x0010
-typedef RTL_GENERIC_COMPARE_RESULTS
-(NTAPI *PRTL_AVL_COMPARE_ROUTINE) (
- struct _RTL_AVL_TABLE *Table,
- PVOID FirstStruct,
- PVOID SecondStruct
-);
+typedef VOID
+(NTAPI *PDRIVER_FS_NOTIFICATION) (
+ IN PDEVICE_OBJECT DeviceObject,
+ IN BOOLEAN FsActive);
-typedef RTL_GENERIC_COMPARE_RESULTS
-(NTAPI *PRTL_GENERIC_COMPARE_ROUTINE) (
- struct _RTL_GENERIC_TABLE *Table,
- PVOID FirstStruct,
- PVOID SecondStruct
-);
+typedef enum _FS_FILTER_SECTION_SYNC_TYPE {
+ SyncTypeOther = 0,
+ SyncTypeCreateSection
+} FS_FILTER_SECTION_SYNC_TYPE, *PFS_FILTER_SECTION_SYNC_TYPE;
-typedef PVOID
-(NTAPI *PRTL_GENERIC_ALLOCATE_ROUTINE) (
- struct _RTL_GENERIC_TABLE *Table,
- CLONG ByteSize
-);
+typedef enum _FS_FILTER_STREAM_FO_NOTIFICATION_TYPE {
+ NotifyTypeCreate = 0,
+ NotifyTypeRetired
+} FS_FILTER_STREAM_FO_NOTIFICATION_TYPE, *PFS_FILTER_STREAM_FO_NOTIFICATION_TYPE;
-typedef VOID
-(NTAPI *PRTL_GENERIC_FREE_ROUTINE) (
- struct _RTL_GENERIC_TABLE *Table,
- PVOID Buffer
-);
+typedef union _FS_FILTER_PARAMETERS {
+ struct {
+ PLARGE_INTEGER EndingOffset;
+ PERESOURCE *ResourceToRelease;
+ } AcquireForModifiedPageWriter;
+ struct {
+ PERESOURCE ResourceToRelease;
+ } ReleaseForModifiedPageWriter;
+ struct {
+ FS_FILTER_SECTION_SYNC_TYPE SyncType;
+ ULONG PageProtection;
+ } AcquireForSectionSynchronization;
+ struct {
+ FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType;
+ BOOLEAN POINTER_ALIGNMENT SafeToRecurse;
+ } NotifyStreamFileObject;
+ struct {
+ PVOID Argument1;
+ PVOID Argument2;
+ PVOID Argument3;
+ PVOID Argument4;
+ PVOID Argument5;
+ } Others;
+} FS_FILTER_PARAMETERS, *PFS_FILTER_PARAMETERS;
-typedef PVOID
-(NTAPI *PRTL_AVL_ALLOCATE_ROUTINE) (
- struct _RTL_AVL_TABLE *Table,
- CLONG ByteSize
-);
+#define FS_FILTER_ACQUIRE_FOR_SECTION_SYNCHRONIZATION (UCHAR)-1
+#define FS_FILTER_RELEASE_FOR_SECTION_SYNCHRONIZATION (UCHAR)-2
+#define FS_FILTER_ACQUIRE_FOR_MOD_WRITE (UCHAR)-3
+#define FS_FILTER_RELEASE_FOR_MOD_WRITE (UCHAR)-4
+#define FS_FILTER_ACQUIRE_FOR_CC_FLUSH (UCHAR)-5
+#define FS_FILTER_RELEASE_FOR_CC_FLUSH (UCHAR)-6
-typedef VOID
-(NTAPI *PRTL_AVL_FREE_ROUTINE) (
- struct _RTL_AVL_TABLE *Table,
- PVOID Buffer
-);
+typedef struct _FS_FILTER_CALLBACK_DATA {
+ ULONG SizeOfFsFilterCallbackData;
+ UCHAR Operation;
+ UCHAR Reserved;
+ struct _DEVICE_OBJECT *DeviceObject;
+ struct _FILE_OBJECT *FileObject;
+ FS_FILTER_PARAMETERS Parameters;
+} FS_FILTER_CALLBACK_DATA, *PFS_FILTER_CALLBACK_DATA;
-typedef struct _PUBLIC_BCB {
- CSHORT NodeTypeCode;
- CSHORT NodeByteSize;
- ULONG MappedLength;
- LARGE_INTEGER MappedFileOffset;
-} PUBLIC_BCB, *PPUBLIC_BCB;
+typedef NTSTATUS
+(NTAPI *PFS_FILTER_CALLBACK) (
+ IN PFS_FILTER_CALLBACK_DATA Data,
+ OUT PVOID *CompletionContext);
-typedef struct _QUERY_PATH_REQUEST {
- ULONG PathNameLength;
- PIO_SECURITY_CONTEXT SecurityContext;
- WCHAR FilePathName[1];
-} QUERY_PATH_REQUEST, *PQUERY_PATH_REQUEST;
+typedef VOID
+(NTAPI *PFS_FILTER_COMPLETION_CALLBACK) (
+ IN PFS_FILTER_CALLBACK_DATA Data,
+ IN NTSTATUS OperationStatus,
+ IN PVOID CompletionContext);
-typedef struct _QUERY_PATH_RESPONSE {
- ULONG LengthAccepted;
-} QUERY_PATH_RESPONSE, *PQUERY_PATH_RESPONSE;
+typedef struct _FS_FILTER_CALLBACKS {
+ ULONG SizeOfFsFilterCallbacks;
+ ULONG Reserved;
+ PFS_FILTER_CALLBACK PreAcquireForSectionSynchronization;
+ PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization;
+ PFS_FILTER_CALLBACK PreReleaseForSectionSynchronization;
+ PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization;
+ PFS_FILTER_CALLBACK PreAcquireForCcFlush;
+ PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush;
+ PFS_FILTER_CALLBACK PreReleaseForCcFlush;
+ PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush;
+ PFS_FILTER_CALLBACK PreAcquireForModifiedPageWriter;
+ PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter;
+ PFS_FILTER_CALLBACK PreReleaseForModifiedPageWriter;
+ PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter;
+} FS_FILTER_CALLBACKS, *PFS_FILTER_CALLBACKS;
-typedef struct _RTL_BALANCED_LINKS
-{
- struct _RTL_BALANCED_LINKS *Parent;
- struct _RTL_BALANCED_LINKS *LeftChild;
- struct _RTL_BALANCED_LINKS *RightChild;
- CHAR Balance;
- UCHAR Reserved[3];
-} RTL_BALANCED_LINKS, *PRTL_BALANCED_LINKS;
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlRegisterFileSystemFilterCallbacks(
+ IN struct _DRIVER_OBJECT *FilterDriverObject,
+ IN PFS_FILTER_CALLBACKS Callbacks);
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
-typedef struct _RTL_GENERIC_TABLE
-{
- PRTL_SPLAY_LINKS TableRoot;
- LIST_ENTRY InsertOrderList;
- PLIST_ENTRY OrderedPointer;
- ULONG WhichOrderedElement;
- ULONG NumberGenericTableElements;
- PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine;
- PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine;
- PRTL_GENERIC_FREE_ROUTINE FreeRoutine;
- PVOID TableContext;
-} RTL_GENERIC_TABLE, *PRTL_GENERIC_TABLE;
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlNotifyStreamFileObject(
+ IN struct _FILE_OBJECT * StreamFileObject,
+ IN struct _DEVICE_OBJECT *DeviceObjectHint OPTIONAL,
+ IN FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType,
+ IN BOOLEAN SafeToRecurse);
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
-#undef PRTL_GENERIC_COMPARE_ROUTINE
-#undef PRTL_GENERIC_ALLOCATE_ROUTINE
-#undef PRTL_GENERIC_FREE_ROUTINE
-#undef RTL_GENERIC_TABLE
-#undef PRTL_GENERIC_TABLE
+#define DO_VERIFY_VOLUME 0x00000002
+#define DO_BUFFERED_IO 0x00000004
+#define DO_EXCLUSIVE 0x00000008
+#define DO_DIRECT_IO 0x00000010
+#define DO_MAP_IO_BUFFER 0x00000020
+#define DO_DEVICE_HAS_NAME 0x00000040
+#define DO_DEVICE_INITIALIZING 0x00000080
+#define DO_SYSTEM_BOOT_PARTITION 0x00000100
+#define DO_LONG_TERM_REQUESTS 0x00000200
+#define DO_NEVER_LAST_DEVICE 0x00000400
+#define DO_SHUTDOWN_REGISTERED 0x00000800
+#define DO_BUS_ENUMERATED_DEVICE 0x00001000
+#define DO_POWER_PAGABLE 0x00002000
+#define DO_POWER_INRUSH 0x00004000
+#define DO_LOW_PRIORITY_FILESYSTEM 0x00010000
+#define DO_SUPPORTS_TRANSACTIONS 0x00040000
+#define DO_FORCE_NEITHER_IO 0x00080000
+#define DO_VOLUME_DEVICE_OBJECT 0x00100000
+#define DO_SYSTEM_SYSTEM_PARTITION 0x00200000
+#define DO_SYSTEM_CRITICAL_PARTITION 0x00400000
+#define DO_DISALLOW_EXECUTE 0x00800000
-#define PRTL_GENERIC_COMPARE_ROUTINE PRTL_AVL_COMPARE_ROUTINE
-#define PRTL_GENERIC_ALLOCATE_ROUTINE PRTL_AVL_ALLOCATE_ROUTINE
-#define PRTL_GENERIC_FREE_ROUTINE PRTL_AVL_FREE_ROUTINE
-#define RTL_GENERIC_TABLE RTL_AVL_TABLE
-#define PRTL_GENERIC_TABLE PRTL_AVL_TABLE
+extern KSPIN_LOCK IoStatisticsLock;
+extern ULONG IoReadOperationCount;
+extern ULONG IoWriteOperationCount;
+extern ULONG IoOtherOperationCount;
+extern LARGE_INTEGER IoReadTransferCount;
+extern LARGE_INTEGER IoWriteTransferCount;
+extern LARGE_INTEGER IoOtherTransferCount;
-#define RtlInitializeGenericTable RtlInitializeGenericTableAvl
-#define RtlInsertElementGenericTable RtlInsertElementGenericTableAvl
-#define RtlInsertElementGenericTableFull RtlInsertElementGenericTableFullAvl
-#define RtlDeleteElementGenericTable RtlDeleteElementGenericTableAvl
-#define RtlLookupElementGenericTable RtlLookupElementGenericTableAvl
-#define RtlLookupElementGenericTableFull RtlLookupElementGenericTableFullAvl
-#define RtlEnumerateGenericTable RtlEnumerateGenericTableAvl
-#define RtlEnumerateGenericTableWithoutSplaying RtlEnumerateGenericTableWithoutSplayingAvl
-#define RtlGetElementGenericTable RtlGetElementGenericTableAvl
-#define RtlNumberGenericTableElements RtlNumberGenericTableElementsAvl
-#define RtlIsGenericTableEmpty RtlIsGenericTableEmptyAvl
+#define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE 64
+#define IO_FILE_OBJECT_PAGED_POOL_CHARGE 1024
-typedef struct _RTL_AVL_TABLE
-{
- RTL_BALANCED_LINKS BalancedRoot;
- PVOID OrderedPointer;
- ULONG WhichOrderedElement;
- ULONG NumberGenericTableElements;
- ULONG DepthOfTree;
- PRTL_BALANCED_LINKS RestartKey;
- ULONG DeleteCount;
- PRTL_AVL_COMPARE_ROUTINE CompareRoutine;
- PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine;
- PRTL_AVL_FREE_ROUTINE FreeRoutine;
- PVOID TableContext;
-} RTL_AVL_TABLE, *PRTL_AVL_TABLE;
+#if (NTDDI_VERSION == NTDDI_WIN2K)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoRegisterFsRegistrationChangeEx(
+ IN PDRIVER_OBJECT DriverObject,
+ IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine);
+#endif
-NTSYSAPI
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
+NTKERNELAPI
VOID
NTAPI
-RtlInitializeGenericTableAvl(
- PRTL_AVL_TABLE Table,
- PRTL_AVL_COMPARE_ROUTINE CompareRoutine,
- PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine,
- PRTL_AVL_FREE_ROUTINE FreeRoutine,
- PVOID TableContext
-);
+IoAcquireVpbSpinLock(
+ OUT PKIRQL Irql);
-NTSYSAPI
-PVOID
+NTKERNELAPI
+NTSTATUS
NTAPI
-RtlInsertElementGenericTableAvl (
- PRTL_AVL_TABLE Table,
- PVOID Buffer,
- CLONG BufferSize,
- PBOOLEAN NewElement OPTIONAL
- );
-
-NTSYSAPI
-BOOLEAN
+IoCheckDesiredAccess(
+ IN OUT PACCESS_MASK DesiredAccess,
+ IN ACCESS_MASK GrantedAccess);
+
+NTKERNELAPI
+NTSTATUS
NTAPI
-RtlDeleteElementGenericTableAvl (
- PRTL_AVL_TABLE Table,
- PVOID Buffer
- );
-
-NTSYSAPI
-PVOID
+IoCheckEaBufferValidity(
+ IN PFILE_FULL_EA_INFORMATION EaBuffer,
+ IN ULONG EaLength,
+ OUT PULONG ErrorOffset);
+
+NTKERNELAPI
+NTSTATUS
NTAPI
-RtlLookupElementGenericTableAvl (
- PRTL_AVL_TABLE Table,
- PVOID Buffer
- );
-
-NTSYSAPI
-PVOID
+IoCheckFunctionAccess(
+ IN ACCESS_MASK GrantedAccess,
+ IN UCHAR MajorFunction,
+ IN UCHAR MinorFunction,
+ IN ULONG IoControlCode,
+ IN PVOID Argument1 OPTIONAL,
+ IN PVOID Argument2 OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
NTAPI
-RtlEnumerateGenericTableWithoutSplayingAvl (
- PRTL_AVL_TABLE Table,
- PVOID *RestartKey
- );
+IoCheckQuerySetFileInformation(
+ IN FILE_INFORMATION_CLASS FileInformationClass,
+ IN ULONG Length,
+ IN BOOLEAN SetOperation);
-#if defined(USE_LPC6432)
-#define LPC_CLIENT_ID CLIENT_ID64
-#define LPC_SIZE_T ULONGLONG
-#define LPC_PVOID ULONGLONG
-#define LPC_HANDLE ULONGLONG
-#else
-#define LPC_CLIENT_ID CLIENT_ID
-#define LPC_SIZE_T SIZE_T
-#define LPC_PVOID PVOID
-#define LPC_HANDLE HANDLE
-#endif
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoCheckQuerySetVolumeInformation(
+ IN FS_INFORMATION_CLASS FsInformationClass,
+ IN ULONG Length,
+ IN BOOLEAN SetOperation);
-typedef struct _PORT_MESSAGE
-{
- union
- {
- struct
- {
- CSHORT DataLength;
- CSHORT TotalLength;
- } s1;
- ULONG Length;
- } u1;
- union
- {
- struct
- {
- CSHORT Type;
- CSHORT DataInfoOffset;
- } s2;
- ULONG ZeroInit;
- } u2;
- __GNU_EXTENSION union
- {
- LPC_CLIENT_ID ClientId;
- double DoNotUseThisField;
- };
- ULONG MessageId;
- __GNU_EXTENSION union
- {
- LPC_SIZE_T ClientViewSize;
- ULONG CallbackId;
- };
-} PORT_MESSAGE, *PPORT_MESSAGE;
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoCheckQuotaBufferValidity(
+ IN PFILE_QUOTA_INFORMATION QuotaBuffer,
+ IN ULONG QuotaLength,
+ OUT PULONG ErrorOffset);
-#define LPC_KERNELMODE_MESSAGE (CSHORT)((USHORT)0x8000)
+NTKERNELAPI
+PFILE_OBJECT
+NTAPI
+IoCreateStreamFileObject(
+ IN PFILE_OBJECT FileObject OPTIONAL,
+ IN PDEVICE_OBJECT DeviceObject OPTIONAL);
-typedef struct _PORT_VIEW
-{
- ULONG Length;
- LPC_HANDLE SectionHandle;
- ULONG SectionOffset;
- LPC_SIZE_T ViewSize;
- LPC_PVOID ViewBase;
- LPC_PVOID ViewRemoteBase;
-} PORT_VIEW, *PPORT_VIEW;
-
-typedef struct _REMOTE_PORT_VIEW
-{
- ULONG Length;
- LPC_SIZE_T ViewSize;
- LPC_PVOID ViewBase;
-} REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW;
-
-typedef struct _SE_EXPORTS {
-
- LUID SeCreateTokenPrivilege;
- LUID SeAssignPrimaryTokenPrivilege;
- LUID SeLockMemoryPrivilege;
- LUID SeIncreaseQuotaPrivilege;
- LUID SeUnsolicitedInputPrivilege;
- LUID SeTcbPrivilege;
- LUID SeSecurityPrivilege;
- LUID SeTakeOwnershipPrivilege;
- LUID SeLoadDriverPrivilege;
- LUID SeCreatePagefilePrivilege;
- LUID SeIncreaseBasePriorityPrivilege;
- LUID SeSystemProfilePrivilege;
- LUID SeSystemtimePrivilege;
- LUID SeProfileSingleProcessPrivilege;
- LUID SeCreatePermanentPrivilege;
- LUID SeBackupPrivilege;
- LUID SeRestorePrivilege;
- LUID SeShutdownPrivilege;
- LUID SeDebugPrivilege;
- LUID SeAuditPrivilege;
- LUID SeSystemEnvironmentPrivilege;
- LUID SeChangeNotifyPrivilege;
- LUID SeRemoteShutdownPrivilege;
-
- PSID SeNullSid;
- PSID SeWorldSid;
- PSID SeLocalSid;
- PSID SeCreatorOwnerSid;
- PSID SeCreatorGroupSid;
-
- PSID SeNtAuthoritySid;
- PSID SeDialupSid;
- PSID SeNetworkSid;
- PSID SeBatchSid;
- PSID SeInteractiveSid;
- PSID SeLocalSystemSid;
- PSID SeAliasAdminsSid;
- PSID SeAliasUsersSid;
- PSID SeAliasGuestsSid;
- PSID SeAliasPowerUsersSid;
- PSID SeAliasAccountOpsSid;
- PSID SeAliasSystemOpsSid;
- PSID SeAliasPrintOpsSid;
- PSID SeAliasBackupOpsSid;
-
- PSID SeAuthenticatedUsersSid;
-
- PSID SeRestrictedSid;
- PSID SeAnonymousLogonSid;
-
- LUID SeUndockPrivilege;
- LUID SeSyncAgentPrivilege;
- LUID SeEnableDelegationPrivilege;
-
-} SE_EXPORTS, *PSE_EXPORTS;
-
-extern PSE_EXPORTS SeExports;
-
-typedef struct _TUNNEL {
- FAST_MUTEX Mutex;
- PRTL_SPLAY_LINKS Cache;
- LIST_ENTRY TimerQueue;
- USHORT NumEntries;
-} TUNNEL, *PTUNNEL;
-
-typedef struct _VAD_HEADER {
- PVOID StartVPN;
- PVOID EndVPN;
- struct _VAD_HEADER* ParentLink;
- struct _VAD_HEADER* LeftLink;
- struct _VAD_HEADER* RightLink;
- ULONG Flags; /* LSB = CommitCharge */
- PVOID ControlArea;
- PVOID FirstProtoPte;
- PVOID LastPTE;
- ULONG Unknown;
- LIST_ENTRY Secured;
-} VAD_HEADER, *PVAD_HEADER;
-
-#if (VER_PRODUCTBUILD >= 2600)
-
-typedef BOOLEAN
-(NTAPI *PFILTER_REPORT_CHANGE) (
- IN PVOID NotifyContext,
- IN PVOID FilterContext
-);
-
-typedef enum _FS_FILTER_SECTION_SYNC_TYPE {
- SyncTypeOther = 0,
- SyncTypeCreateSection
-} FS_FILTER_SECTION_SYNC_TYPE, *PFS_FILTER_SECTION_SYNC_TYPE;
-
-typedef enum _FS_FILTER_STREAM_FO_NOTIFICATION_TYPE {
- NotifyTypeCreate = 0,
- NotifyTypeRetired
-} FS_FILTER_STREAM_FO_NOTIFICATION_TYPE, *PFS_FILTER_STREAM_FO_NOTIFICATION_TYPE;
-
-typedef union _FS_FILTER_PARAMETERS {
- struct {
- PLARGE_INTEGER EndingOffset;
- PERESOURCE *ResourceToRelease;
- } AcquireForModifiedPageWriter;
-
- struct {
- PERESOURCE ResourceToRelease;
- } ReleaseForModifiedPageWriter;
-
- struct {
- FS_FILTER_SECTION_SYNC_TYPE SyncType;
- ULONG PageProtection;
- } AcquireForSectionSynchronization;
-
- struct {
- FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType;
- BOOLEAN POINTER_ALIGNMENT SafeToRecurse;
- } NotifyStreamFileObject;
-
- struct {
- PVOID Argument1;
- PVOID Argument2;
- PVOID Argument3;
- PVOID Argument4;
- PVOID Argument5;
- } Others;
-} FS_FILTER_PARAMETERS, *PFS_FILTER_PARAMETERS;
-
-typedef struct _FS_FILTER_CALLBACK_DATA {
- ULONG SizeOfFsFilterCallbackData;
- UCHAR Operation;
- UCHAR Reserved;
- struct _DEVICE_OBJECT *DeviceObject;
- struct _FILE_OBJECT *FileObject;
- FS_FILTER_PARAMETERS Parameters;
-} FS_FILTER_CALLBACK_DATA, *PFS_FILTER_CALLBACK_DATA;
-
-typedef NTSTATUS
-(NTAPI *PFS_FILTER_CALLBACK) (
- IN PFS_FILTER_CALLBACK_DATA Data,
- OUT PVOID *CompletionContext
-);
-
-typedef VOID
-(NTAPI *PFS_FILTER_COMPLETION_CALLBACK) (
- IN PFS_FILTER_CALLBACK_DATA Data,
- IN NTSTATUS OperationStatus,
- IN PVOID CompletionContext
-);
-
-typedef struct _FS_FILTER_CALLBACKS {
- ULONG SizeOfFsFilterCallbacks;
- ULONG Reserved;
- PFS_FILTER_CALLBACK PreAcquireForSectionSynchronization;
- PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization;
- PFS_FILTER_CALLBACK PreReleaseForSectionSynchronization;
- PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization;
- PFS_FILTER_CALLBACK PreAcquireForCcFlush;
- PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush;
- PFS_FILTER_CALLBACK PreReleaseForCcFlush;
- PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush;
- PFS_FILTER_CALLBACK PreAcquireForModifiedPageWriter;
- PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter;
- PFS_FILTER_CALLBACK PreReleaseForModifiedPageWriter;
- PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter;
-} FS_FILTER_CALLBACKS, *PFS_FILTER_CALLBACKS;
-
-typedef struct _READ_LIST {
- PFILE_OBJECT FileObject;
- ULONG NumberOfEntries;
- LOGICAL IsImage;
- FILE_SEGMENT_ELEMENT List[ANYSIZE_ARRAY];
-} READ_LIST, *PREAD_LIST;
-
-#endif
+NTKERNELAPI
+PFILE_OBJECT
+NTAPI
+IoCreateStreamFileObjectLite(
+ IN PFILE_OBJECT FileObject OPTIONAL,
+ IN PDEVICE_OBJECT DeviceObject OPTIONAL);
NTKERNELAPI
BOOLEAN
NTAPI
-CcCanIWrite (
- IN PFILE_OBJECT FileObject,
- IN ULONG BytesToWrite,
- IN BOOLEAN Wait,
- IN BOOLEAN Retrying
-);
+IoFastQueryNetworkAttributes(
+ IN POBJECT_ATTRIBUTES ObjectAttributes,
+ IN ACCESS_MASK DesiredAccess,
+ IN ULONG OpenOptions,
+ OUT PIO_STATUS_BLOCK IoStatus,
+ OUT PFILE_NETWORK_OPEN_INFORMATION Buffer);
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-CcCopyRead (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN ULONG Length,
- IN BOOLEAN Wait,
- OUT PVOID Buffer,
- OUT PIO_STATUS_BLOCK IoStatus
-);
+IoPageRead(
+ IN PFILE_OBJECT FileObject,
+ IN PMDL Mdl,
+ IN PLARGE_INTEGER Offset,
+ IN PKEVENT Event,
+ OUT PIO_STATUS_BLOCK IoStatusBlock);
NTKERNELAPI
-BOOLEAN
+PDEVICE_OBJECT
NTAPI
-CcCopyWrite (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN ULONG Length,
- IN BOOLEAN Wait,
- IN PVOID Buffer
-);
-
-#define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
-
-typedef VOID (NTAPI *PCC_POST_DEFERRED_WRITE) (
- IN PVOID Context1,
- IN PVOID Context2
-);
+IoGetBaseFileSystemDeviceObject(
+ IN PFILE_OBJECT FileObject);
NTKERNELAPI
-VOID
+PCONFIGURATION_INFORMATION
NTAPI
-CcDeferWrite (
- IN PFILE_OBJECT FileObject,
- IN PCC_POST_DEFERRED_WRITE PostRoutine,
- IN PVOID Context1,
- IN PVOID Context2,
- IN ULONG BytesToWrite,
- IN BOOLEAN Retrying
-);
+IoGetConfigurationInformation(
+ VOID);
NTKERNELAPI
-VOID
+ULONG
NTAPI
-CcFastCopyRead (
- IN PFILE_OBJECT FileObject,
- IN ULONG FileOffset,
- IN ULONG Length,
- IN ULONG PageCount,
- OUT PVOID Buffer,
- OUT PIO_STATUS_BLOCK IoStatus
-);
+IoGetRequestorProcessId(
+ IN PIRP Irp);
NTKERNELAPI
-VOID
+PEPROCESS
NTAPI
-CcFastCopyWrite (
- IN PFILE_OBJECT FileObject,
- IN ULONG FileOffset,
- IN ULONG Length,
- IN PVOID Buffer
-);
+IoGetRequestorProcess(
+ IN PIRP Irp);
NTKERNELAPI
-VOID
+PIRP
NTAPI
-CcFlushCache (
- IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
- IN PLARGE_INTEGER FileOffset OPTIONAL,
- IN ULONG Length,
- OUT PIO_STATUS_BLOCK IoStatus OPTIONAL
-);
-
-typedef VOID (NTAPI *PDIRTY_PAGE_ROUTINE) (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN ULONG Length,
- IN PLARGE_INTEGER OldestLsn,
- IN PLARGE_INTEGER NewestLsn,
- IN PVOID Context1,
- IN PVOID Context2
-);
+IoGetTopLevelIrp(
+ VOID);
NTKERNELAPI
-LARGE_INTEGER
+BOOLEAN
NTAPI
-CcGetDirtyPages (
- IN PVOID LogHandle,
- IN PDIRTY_PAGE_ROUTINE DirtyPageRoutine,
- IN PVOID Context1,
- IN PVOID Context2
-);
+IoIsOperationSynchronous(
+ IN PIRP Irp);
NTKERNELAPI
-PFILE_OBJECT
+BOOLEAN
NTAPI
-CcGetFileObjectFromBcb (
- IN PVOID Bcb
-);
+IoIsSystemThread(
+ IN PETHREAD Thread);
NTKERNELAPI
-PFILE_OBJECT
+BOOLEAN
NTAPI
-CcGetFileObjectFromSectionPtrs (
- IN PSECTION_OBJECT_POINTERS SectionObjectPointer
-);
-
-#define CcGetFileSizePointer(FO) ( \
- ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
-)
-
-#if (VER_PRODUCTBUILD >= 2195)
+IoIsValidNameGraftingBuffer(
+ IN PIRP Irp,
+ IN PREPARSE_DATA_BUFFER ReparseBuffer);
NTKERNELAPI
-LARGE_INTEGER
+NTSTATUS
NTAPI
-CcGetFlushedValidData (
- IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
- IN BOOLEAN BcbListHeld
-);
-
-#endif /* (VER_PRODUCTBUILD >= 2195) */
+IoQueryFileInformation(
+ IN PFILE_OBJECT FileObject,
+ IN FILE_INFORMATION_CLASS FileInformationClass,
+ IN ULONG Length,
+ OUT PVOID FileInformation,
+ OUT PULONG ReturnedLength);
NTKERNELAPI
-LARGE_INTEGER
+NTSTATUS
NTAPI
-CcGetLsnForFileObject (
- IN PFILE_OBJECT FileObject,
- OUT PLARGE_INTEGER OldestLsn OPTIONAL
-);
-
-typedef BOOLEAN (NTAPI *PACQUIRE_FOR_LAZY_WRITE) (
- IN PVOID Context,
- IN BOOLEAN Wait
-);
-
-typedef VOID (NTAPI *PRELEASE_FROM_LAZY_WRITE) (
- IN PVOID Context
-);
-
-typedef BOOLEAN (NTAPI *PACQUIRE_FOR_READ_AHEAD) (
- IN PVOID Context,
- IN BOOLEAN Wait
-);
-
-typedef VOID (NTAPI *PRELEASE_FROM_READ_AHEAD) (
- IN PVOID Context
-);
-
-typedef struct _CACHE_MANAGER_CALLBACKS {
- PACQUIRE_FOR_LAZY_WRITE AcquireForLazyWrite;
- PRELEASE_FROM_LAZY_WRITE ReleaseFromLazyWrite;
- PACQUIRE_FOR_READ_AHEAD AcquireForReadAhead;
- PRELEASE_FROM_READ_AHEAD ReleaseFromReadAhead;
-} CACHE_MANAGER_CALLBACKS, *PCACHE_MANAGER_CALLBACKS;
+IoQueryVolumeInformation(
+ IN PFILE_OBJECT FileObject,
+ IN FS_INFORMATION_CLASS FsInformationClass,
+ IN ULONG Length,
+ OUT PVOID FsInformation,
+ OUT PULONG ReturnedLength);
NTKERNELAPI
VOID
NTAPI
-CcInitializeCacheMap (
- IN PFILE_OBJECT FileObject,
- IN PCC_FILE_SIZES FileSizes,
- IN BOOLEAN PinAccess,
- IN PCACHE_MANAGER_CALLBACKS Callbacks,
- IN PVOID LazyWriteContext
-);
-
-#define CcIsFileCached(FO) ( \
- ((FO)->SectionObjectPointer != NULL) && \
- (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
-)
-
-extern ULONG CcFastMdlReadWait;
+IoQueueThreadIrp(
+ IN PIRP Irp);
NTKERNELAPI
-BOOLEAN
+VOID
NTAPI
-CcIsThereDirtyData (
- IN PVPB Vpb
-);
+IoRegisterFileSystem(
+ IN PDEVICE_OBJECT DeviceObject);
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-CcMapData (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN ULONG Length,
- IN ULONG Flags,
- OUT PVOID *Bcb,
- OUT PVOID *Buffer
-);
+IoRegisterFsRegistrationChange(
+ IN PDRIVER_OBJECT DriverObject,
+ IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine);
NTKERNELAPI
VOID
NTAPI
-CcMdlRead (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN ULONG Length,
- OUT PMDL *MdlChain,
- OUT PIO_STATUS_BLOCK IoStatus
-);
+IoReleaseVpbSpinLock(
+ IN KIRQL Irql);
NTKERNELAPI
VOID
NTAPI
-CcMdlReadComplete (
- IN PFILE_OBJECT FileObject,
- IN PMDL MdlChain
-);
+IoSetDeviceToVerify(
+ IN PETHREAD Thread,
+ IN PDEVICE_OBJECT DeviceObject OPTIONAL);
NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-CcMdlWriteComplete (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN PMDL MdlChain
-);
+IoSetInformation(
+ IN PFILE_OBJECT FileObject,
+ IN FILE_INFORMATION_CLASS FileInformationClass,
+ IN ULONG Length,
+ IN PVOID FileInformation);
-#define MAP_WAIT 1
+NTKERNELAPI
+VOID
+NTAPI
+IoSetTopLevelIrp(
+ IN PIRP Irp OPTIONAL);
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-CcPinMappedData (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN ULONG Length,
- IN ULONG Flags,
- IN OUT PVOID *Bcb
-);
+IoSynchronousPageWrite(
+ IN PFILE_OBJECT FileObject,
+ IN PMDL Mdl,
+ IN PLARGE_INTEGER FileOffset,
+ IN PKEVENT Event,
+ OUT PIO_STATUS_BLOCK IoStatusBlock);
NTKERNELAPI
-BOOLEAN
+PEPROCESS
NTAPI
-CcPinRead (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN ULONG Length,
- IN ULONG Flags,
- OUT PVOID *Bcb,
- OUT PVOID *Buffer
-);
+IoThreadToProcess(
+ IN PETHREAD Thread);
NTKERNELAPI
VOID
NTAPI
-CcPrepareMdlWrite (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN ULONG Length,
- OUT PMDL *MdlChain,
- OUT PIO_STATUS_BLOCK IoStatus
-);
+IoUnregisterFileSystem(
+ IN PDEVICE_OBJECT DeviceObject);
NTKERNELAPI
-BOOLEAN
+VOID
NTAPI
-CcPreparePinWrite (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN ULONG Length,
- IN BOOLEAN Zero,
- IN ULONG Flags,
- OUT PVOID *Bcb,
- OUT PVOID *Buffer
-);
+IoUnregisterFsRegistrationChange(
+ IN PDRIVER_OBJECT DriverObject,
+ IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine);
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-CcPurgeCacheSection (
- IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
- IN PLARGE_INTEGER FileOffset OPTIONAL,
- IN ULONG Length,
- IN BOOLEAN UninitializeCacheMaps
-);
-
-#define CcReadAhead(FO, FOFF, LEN) ( \
- if ((LEN) >= 256) { \
- CcScheduleReadAhead((FO), (FOFF), (LEN)); \
- } \
-)
-
-#if (VER_PRODUCTBUILD >= 2195)
+IoVerifyVolume(
+ IN PDEVICE_OBJECT DeviceObject,
+ IN BOOLEAN AllowRawMount);
NTKERNELAPI
-PVOID
+NTSTATUS
NTAPI
-CcRemapBcb (
- IN PVOID Bcb
-);
+IoGetRequestorSessionId(
+ IN PIRP Irp,
+ OUT PULONG pSessionId);
-#endif /* (VER_PRODUCTBUILD >= 2195) */
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
-NTKERNELAPI
-VOID
-NTAPI
-CcRepinBcb (
- IN PVOID Bcb
-);
+#if (NTDDI_VERSION >= NTDDI_WINXP)
NTKERNELAPI
-VOID
+PFILE_OBJECT
NTAPI
-CcScheduleReadAhead (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN ULONG Length
-);
+IoCreateStreamFileObjectEx(
+ IN PFILE_OBJECT FileObject OPTIONAL,
+ IN PDEVICE_OBJECT DeviceObject OPTIONAL,
+ OUT PHANDLE FileObjectHandle OPTIONAL);
NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-CcSetAdditionalCacheAttributes (
- IN PFILE_OBJECT FileObject,
- IN BOOLEAN DisableReadAhead,
- IN BOOLEAN DisableWriteBehind
-);
+IoQueryFileDosDeviceName(
+ IN PFILE_OBJECT FileObject,
+ OUT POBJECT_NAME_INFORMATION *ObjectNameInformation);
NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-CcSetBcbOwnerPointer (
- IN PVOID Bcb,
- IN PVOID OwnerPointer
-);
+IoEnumerateDeviceObjectList(
+ IN PDRIVER_OBJECT DriverObject,
+ OUT PDEVICE_OBJECT *DeviceObjectList,
+ IN ULONG DeviceObjectListSize,
+ OUT PULONG ActualNumberDeviceObjects);
NTKERNELAPI
-VOID
+PDEVICE_OBJECT
NTAPI
-CcSetDirtyPageThreshold (
- IN PFILE_OBJECT FileObject,
- IN ULONG DirtyPageThreshold
-);
+IoGetLowerDeviceObject(
+ IN PDEVICE_OBJECT DeviceObject);
NTKERNELAPI
-VOID
+PDEVICE_OBJECT
NTAPI
-CcSetDirtyPinnedData (
- IN PVOID BcbVoid,
- IN PLARGE_INTEGER Lsn OPTIONAL
-);
+IoGetDeviceAttachmentBaseRef(
+ IN PDEVICE_OBJECT DeviceObject);
NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-CcSetFileSizes (
- IN PFILE_OBJECT FileObject,
- IN PCC_FILE_SIZES FileSizes
-);
+IoGetDiskDeviceObject(
+ IN PDEVICE_OBJECT FileSystemDeviceObject,
+ OUT PDEVICE_OBJECT *DiskDeviceObject);
-typedef VOID (NTAPI *PFLUSH_TO_LSN) (
- IN PVOID LogHandle,
- IN LARGE_INTEGER Lsn
-);
+#endif
+#if (NTDDI_VERSION >= NTDDI_WS03SP1)
NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-CcSetLogHandleForFile (
- IN PFILE_OBJECT FileObject,
- IN PVOID LogHandle,
- IN PFLUSH_TO_LSN FlushToLsnRoutine
-);
+IoEnumerateRegisteredFiltersList(
+ OUT PDRIVER_OBJECT *DriverObjectList,
+ IN ULONG DriverObjectListSize,
+ OUT PULONG ActualNumberDriverObjects);
+#endif
-NTKERNELAPI
+#if (NTDDI_VERSION >= NTDDI_VISTA)
VOID
+FORCEINLINE
NTAPI
-CcSetReadAheadGranularity (
- IN PFILE_OBJECT FileObject,
- IN ULONG Granularity /* default: PAGE_SIZE */
- /* allowed: 2^n * PAGE_SIZE */
-);
+IoInitializePriorityInfo(
+ IN PIO_PRIORITY_INFO PriorityInfo)
+{
+ PriorityInfo->Size = sizeof(IO_PRIORITY_INFO);
+ PriorityInfo->ThreadPriority = 0xffff;
+ PriorityInfo->IoPriority = IoPriorityNormal;
+ PriorityInfo->PagePriority = 0;
+}
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-CcUninitializeCacheMap (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER TruncateSize OPTIONAL,
- IN PCACHE_UNINITIALIZE_EVENT UninitializeCompleteEvent OPTIONAL
-);
+IoRegisterFsRegistrationChangeMountAware(
+ IN PDRIVER_OBJECT DriverObject,
+ IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine,
+ IN BOOLEAN SynchronizeWithMounts);
NTKERNELAPI
-VOID
-NTAPI
-CcUnpinData (
- IN PVOID Bcb
-);
-
-NTKERNELAPI
-VOID
-NTAPI
-CcUnpinDataForThread (
- IN PVOID Bcb,
- IN ERESOURCE_THREAD ResourceThreadId
-);
-
-NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-CcUnpinRepinnedBcb (
- IN PVOID Bcb,
- IN BOOLEAN WriteThrough,
- OUT PIO_STATUS_BLOCK IoStatus
-);
+IoReplaceFileObjectName(
+ IN PFILE_OBJECT FileObject,
+ IN PWSTR NewFileName,
+ IN USHORT FileNameLength);
-#if (VER_PRODUCTBUILD >= 2195)
+#endif
-NTKERNELAPI
-NTSTATUS
-NTAPI
-CcWaitForCurrentLazyWriterActivity (
- VOID
-);
+#define IoIsFileOpenedExclusively(FileObject) ( \
+ (BOOLEAN) !( \
+ (FileObject)->SharedRead || \
+ (FileObject)->SharedWrite || \
+ (FileObject)->SharedDelete \
+ ) \
+)
-#endif /* (VER_PRODUCTBUILD >= 2195) */
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+typedef struct _IO_PRIORITY_INFO {
+ ULONG Size;
+ ULONG ThreadPriority;
+ ULONG PagePriority;
+ IO_PRIORITY_HINT IoPriority;
+} IO_PRIORITY_INFO, *PIO_PRIORITY_INFO;
+#endif
-NTKERNELAPI
-BOOLEAN
-NTAPI
-CcZeroData (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER StartOffset,
- IN PLARGE_INTEGER EndOffset,
- IN BOOLEAN Wait
-);
+#define PO_CB_SYSTEM_POWER_POLICY 0
+#define PO_CB_AC_STATUS 1
+#define PO_CB_BUTTON_COLLISION 2
+#define PO_CB_SYSTEM_STATE_LOCK 3
+#define PO_CB_LID_SWITCH_STATE 4
+#define PO_CB_PROCESSOR_POWER_POLICY 5
+#if (NTDDI_VERSION >= NTDDI_WINXP)
NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-ExDisableResourceBoostLite (
- IN PERESOURCE Resource
-);
+PoQueueShutdownWorkItem(
+ IN OUT PWORK_QUEUE_ITEM WorkItem);
+#endif
-NTKERNELAPI
-SIZE_T
+#if defined(_IA64_)
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+//DECLSPEC_DEPRECATED_DDK
+NTHALAPI
+ULONG
NTAPI
-ExQueryPoolBlockSize (
- IN PVOID PoolBlock,
- OUT PBOOLEAN QuotaCharged
-);
-
-#if (VER_PRODUCTBUILD >= 2600)
-
-#ifndef __NTOSKRNL__
-NTKERNELAPI
-VOID
-FASTCALL
-ExInitializeRundownProtection (
- IN PEX_RUNDOWN_REF RunRef
-);
-
-NTKERNELAPI
-VOID
-FASTCALL
-ExReInitializeRundownProtection (
- IN PEX_RUNDOWN_REF RunRef
-);
-
-NTKERNELAPI
-BOOLEAN
-FASTCALL
-ExAcquireRundownProtection (
- IN PEX_RUNDOWN_REF RunRef
-);
-
-NTKERNELAPI
-BOOLEAN
-FASTCALL
-ExAcquireRundownProtectionEx (
- IN PEX_RUNDOWN_REF RunRef,
- IN ULONG Count
-);
-
-NTKERNELAPI
-VOID
-FASTCALL
-ExReleaseRundownProtection (
- IN PEX_RUNDOWN_REF RunRef
-);
-
-NTKERNELAPI
-VOID
-FASTCALL
-ExReleaseRundownProtectionEx (
- IN PEX_RUNDOWN_REF RunRef,
- IN ULONG Count
-);
-
-NTKERNELAPI
-VOID
-FASTCALL
-ExRundownCompleted (
- IN PEX_RUNDOWN_REF RunRef
-);
-
-NTKERNELAPI
-VOID
-FASTCALL
-ExWaitForRundownProtectionRelease (
- IN PEX_RUNDOWN_REF RunRef
-);
+HalGetDmaAlignmentRequirement(
+ VOID);
+#endif
+#endif
+#if defined(_M_IX86) || defined(_M_AMD64)
+#define HalGetDmaAlignmentRequirement() 1L
#endif
-#endif /* (VER_PRODUCTBUILD >= 2600) */
+typedef enum _MMFLUSH_TYPE {
+ MmFlushForDelete,
+ MmFlushForWrite
+} MMFLUSH_TYPE;
-#define FsRtlSetupAdvancedHeader( _advhdr, _fmutx ) \
-{ \
- SetFlag( (_advhdr)->Flags, FSRTL_FLAG_ADVANCED_HEADER ); \
- SetFlag( (_advhdr)->Flags2, FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS ); \
- (_advhdr)->Version = FSRTL_FCB_HEADER_V1; \
- InitializeListHead( &(_advhdr)->FilterContexts ); \
- if ((_fmutx) != NULL) { \
- (_advhdr)->FastMutex = (_fmutx); \
- } \
- *((PULONG_PTR)(&(_advhdr)->PushLock)) = 0; \
- /*ExInitializePushLock( &(_advhdr)->PushLock ); API Not avaliable downlevel*/\
- (_advhdr)->FileContextSupportPointer = NULL; \
-}
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlAddBaseMcbEntry (
- IN PBASE_MCB Mcb,
- IN LONGLONG Vbn,
- IN LONGLONG Lbn,
- IN LONGLONG SectorCount
-);
+MmIsRecursiveIoFault(
+ VOID);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlAddLargeMcbEntry (
- IN PLARGE_MCB Mcb,
- IN LONGLONG Vbn,
- IN LONGLONG Lbn,
- IN LONGLONG SectorCount
-);
+MmForceSectionClosed(
+ IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+ IN BOOLEAN DelayClose);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlAddMcbEntry (
- IN PMCB Mcb,
- IN VBN Vbn,
- IN LBN Lbn,
- IN ULONG SectorCount
-);
-
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlAddToTunnelCache (
- IN PTUNNEL Cache,
- IN ULONGLONG DirectoryKey,
- IN PUNICODE_STRING ShortName,
- IN PUNICODE_STRING LongName,
- IN BOOLEAN KeyByShortName,
- IN ULONG DataLength,
- IN PVOID Data
-);
-
-#if (VER_PRODUCTBUILD >= 2195)
-
-PFILE_LOCK
-NTAPI
-FsRtlAllocateFileLock (
- IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL,
- IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
-);
-
-#endif /* (VER_PRODUCTBUILD >= 2195) */
-
-NTKERNELAPI
-PVOID
-NTAPI
-FsRtlAllocatePool (
- IN POOL_TYPE PoolType,
- IN ULONG NumberOfBytes
-);
-
-NTKERNELAPI
-PVOID
-NTAPI
-FsRtlAllocatePoolWithQuota (
- IN POOL_TYPE PoolType,
- IN ULONG NumberOfBytes
-);
-
-NTKERNELAPI
-PVOID
-NTAPI
-FsRtlAllocatePoolWithQuotaTag (
- IN POOL_TYPE PoolType,
- IN ULONG NumberOfBytes,
- IN ULONG Tag
-);
-
-NTKERNELAPI
-PVOID
-NTAPI
-FsRtlAllocatePoolWithTag (
- IN POOL_TYPE PoolType,
- IN ULONG NumberOfBytes,
- IN ULONG Tag
-);
+MmFlushImageSection(
+ IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+ IN MMFLUSH_TYPE FlushType);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlAreNamesEqual (
- IN PCUNICODE_STRING Name1,
- IN PCUNICODE_STRING Name2,
- IN BOOLEAN IgnoreCase,
- IN PCWCH UpcaseTable OPTIONAL
-);
-
-#define FsRtlAreThereCurrentFileLocks(FL) ( \
- ((FL)->FastIoIsQuestionable) \
-)
-
-/*
- FsRtlCheckLockForReadAccess:
+MmCanFileBeTruncated(
+ IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+ IN PLARGE_INTEGER NewFileSize OPTIONAL);
- All this really does is pick out the lock parameters from the irp (io stack
- location?), get IoGetRequestorProcess, and pass values on to
- FsRtlFastCheckLockForRead.
-*/
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlCheckLockForReadAccess (
- IN PFILE_LOCK FileLock,
- IN PIRP Irp
-);
+MmSetAddressRangeModified(
+ IN PVOID Address,
+ IN SIZE_T Length);
-/*
- FsRtlCheckLockForWriteAccess:
+#endif
- All this really does is pick out the lock parameters from the irp (io stack
- location?), get IoGetRequestorProcess, and pass values on to
- FsRtlFastCheckLockForWrite.
-*/
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlCheckLockForWriteAccess (
- IN PFILE_LOCK FileLock,
- IN PIRP Irp
-);
+typedef struct _READ_LIST {
+ PFILE_OBJECT FileObject;
+ ULONG NumberOfEntries;
+ LOGICAL IsImage;
+ FILE_SEGMENT_ELEMENT List[ANYSIZE_ARRAY];
+} READ_LIST, *PREAD_LIST;
-typedef
-VOID
-(NTAPI*POPLOCK_WAIT_COMPLETE_ROUTINE) (
- IN PVOID Context,
- IN PIRP Irp
-);
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+typedef union _MM_PREFETCH_FLAGS {
+ struct {
+ ULONG Priority : SYSTEM_PAGE_PRIORITY_BITS;
+ ULONG RepurposePriority : SYSTEM_PAGE_PRIORITY_BITS;
+ } Flags;
+ ULONG AllFlags;
+} MM_PREFETCH_FLAGS, *PMM_PREFETCH_FLAGS;
-typedef
-VOID
-(NTAPI*POPLOCK_FS_PREPOST_IRP) (
- IN PVOID Context,
- IN PIRP Irp
-);
+#define MM_PREFETCH_FLAGS_MASK ((1 << (2*SYSTEM_PAGE_PRIORITY_BITS)) - 1)
NTKERNELAPI
NTSTATUS
NTAPI
-FsRtlCheckOplock (
- IN POPLOCK Oplock,
- IN PIRP Irp,
- IN PVOID Context,
- IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
- IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL
-);
+MmPrefetchPages(
+ IN ULONG NumberOfLists,
+ IN PREAD_LIST *ReadLists);
+#endif
+#if (NTDDI_VERSION >= NTDDI_VISTA)
NTKERNELAPI
-BOOLEAN
+ULONG
NTAPI
-FsRtlCopyRead (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN ULONG Length,
- IN BOOLEAN Wait,
- IN ULONG LockKey,
- OUT PVOID Buffer,
- OUT PIO_STATUS_BLOCK IoStatus,
- IN PDEVICE_OBJECT DeviceObject
-);
+MmDoesFileHaveUserWritableReferences(
+ IN PSECTION_OBJECT_POINTERS SectionPointer);
+#endif
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlCopyWrite (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN ULONG Length,
- IN BOOLEAN Wait,
- IN ULONG LockKey,
- IN PVOID Buffer,
- OUT PIO_STATUS_BLOCK IoStatus,
- IN PDEVICE_OBJECT DeviceObject
-);
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-FsRtlCurrentBatchOplock (
- IN POPLOCK Oplock
-);
+ObInsertObject(
+ IN PVOID Object,
+ IN OUT PACCESS_STATE PassedAccessState OPTIONAL,
+ IN ACCESS_MASK DesiredAccess OPTIONAL,
+ IN ULONG ObjectPointerBias,
+ OUT PVOID *NewObject OPTIONAL,
+ OUT PHANDLE Handle OPTIONAL);
NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-FsRtlDeleteKeyFromTunnelCache (
- IN PTUNNEL Cache,
- IN ULONGLONG DirectoryKey
-);
+ObOpenObjectByPointer(
+ IN PVOID Object,
+ IN ULONG HandleAttributes,
+ IN PACCESS_STATE PassedAccessState OPTIONAL,
+ IN ACCESS_MASK DesiredAccess OPTIONAL,
+ IN POBJECT_TYPE ObjectType OPTIONAL,
+ IN KPROCESSOR_MODE AccessMode,
+ OUT PHANDLE Handle);
NTKERNELAPI
VOID
NTAPI
-FsRtlDeleteTunnelCache (
- IN PTUNNEL Cache
-);
+ObMakeTemporaryObject(
+ IN PVOID Object);
NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-FsRtlDeregisterUncProvider (
- IN HANDLE Handle
-);
+ObQueryNameString(
+ IN PVOID Object,
+ OUT POBJECT_NAME_INFORMATION ObjectNameInfo OPTIONAL,
+ IN ULONG Length,
+ OUT PULONG ReturnLength);
NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-FsRtlDissectDbcs (
- IN ANSI_STRING Name,
- OUT PANSI_STRING FirstPart,
- OUT PANSI_STRING RemainingPart
-);
+ObQueryObjectAuditingByHandle(
+ IN HANDLE Handle,
+ OUT PBOOLEAN GenerateOnClose);
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlDissectName (
- IN UNICODE_STRING Name,
- OUT PUNICODE_STRING FirstPart,
- OUT PUNICODE_STRING RemainingPart
-);
+#endif
+#if (NTDDI_VERSION >= NTDDI_VISTA)
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlDoesDbcsContainWildCards (
- IN PANSI_STRING Name
-);
+ObIsKernelHandle(
+ IN HANDLE Handle);
+#endif
+#if (NTDDI_VERSION >= NTDDI_WIN7)
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-FsRtlDoesNameContainWildCards (
- IN PUNICODE_STRING Name
-);
+ObOpenObjectByPointerWithTag(
+ IN PVOID Object,
+ IN ULONG HandleAttributes,
+ IN PACCESS_STATE PassedAccessState OPTIONAL,
+ IN ACCESS_MASK DesiredAccess,
+ IN POBJECT_TYPE ObjectType OPTIONAL,
+ IN KPROCESSOR_MODE AccessMode,
+ IN ULONG Tag,
+ OUT PHANDLE Handle);
+#endif
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlIsFatDbcsLegal (
- IN ANSI_STRING DbcsName,
- IN BOOLEAN WildCardsPermissible,
- IN BOOLEAN PathNamePermissible,
- IN BOOLEAN LeadingBackslashPermissible
- );
+typedef ULONG LBN;
+typedef LBN *PLBN;
+typedef ULONG VBN;
+typedef VBN *PVBN;
-#define FsRtlCompleteRequest(IRP,STATUS) { \
- (IRP)->IoStatus.Status = (STATUS); \
- IoCompleteRequest( (IRP), IO_DISK_INCREMENT ); \
-}
+typedef enum _FAST_IO_POSSIBLE {
+ FastIoIsNotPossible = 0,
+ FastIoIsPossible,
+ FastIoIsQuestionable
+} FAST_IO_POSSIBLE;
-#define FsRtlEnterFileSystem KeEnterCriticalRegion
+typedef struct _FSRTL_COMMON_FCB_HEADER {
+ CSHORT NodeTypeCode;
+ CSHORT NodeByteSize;
+ UCHAR Flags;
+ UCHAR IsFastIoPossible;
+ UCHAR Flags2;
+ UCHAR Reserved:4;
+ UCHAR Version:4;
+ PERESOURCE Resource;
+ PERESOURCE PagingIoResource;
+ LARGE_INTEGER AllocationSize;
+ LARGE_INTEGER FileSize;
+ LARGE_INTEGER ValidDataLength;
+} FSRTL_COMMON_FCB_HEADER, *PFSRTL_COMMON_FCB_HEADER;
+
+#ifdef __cplusplus
+typedef struct _FSRTL_ADVANCED_FCB_HEADER:FSRTL_COMMON_FCB_HEADER {
+#else /* __cplusplus */
+typedef struct _FSRTL_ADVANCED_FCB_HEADER {
+ FSRTL_COMMON_FCB_HEADER DUMMYSTRUCTNAME;
+#endif /* __cplusplus */
+ PFAST_MUTEX FastMutex;
+ LIST_ENTRY FilterContexts;
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+ EX_PUSH_LOCK PushLock;
+ PVOID *FileContextSupportPointer;
+#endif
+} FSRTL_ADVANCED_FCB_HEADER, *PFSRTL_ADVANCED_FCB_HEADER;
+
+#define FSRTL_FCB_HEADER_V0 (0x00)
+#define FSRTL_FCB_HEADER_V1 (0x01)
+
+#define FSRTL_FLAG_FILE_MODIFIED (0x01)
+#define FSRTL_FLAG_FILE_LENGTH_CHANGED (0x02)
+#define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04)
+#define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08)
+#define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10)
+#define FSRTL_FLAG_USER_MAPPED_FILE (0x20)
+#define FSRTL_FLAG_ADVANCED_HEADER (0x40)
+#define FSRTL_FLAG_EOF_ADVANCE_ACTIVE (0x80)
+
+#define FSRTL_FLAG2_DO_MODIFIED_WRITE (0x01)
+#define FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS (0x02)
+#define FSRTL_FLAG2_PURGE_WHEN_MAPPED (0x04)
+#define FSRTL_FLAG2_IS_PAGING_FILE (0x08)
+
+#define FSRTL_FSP_TOP_LEVEL_IRP (0x01)
+#define FSRTL_CACHE_TOP_LEVEL_IRP (0x02)
+#define FSRTL_MOD_WRITE_TOP_LEVEL_IRP (0x03)
+#define FSRTL_FAST_IO_TOP_LEVEL_IRP (0x04)
+#define FSRTL_NETWORK1_TOP_LEVEL_IRP ((LONG_PTR)0x05)
+#define FSRTL_NETWORK2_TOP_LEVEL_IRP ((LONG_PTR)0x06)
+#define FSRTL_MAX_TOP_LEVEL_IRP_FLAG ((LONG_PTR)0xFFFF)
+
+typedef struct _EOF_WAIT_BLOCK {
+ LIST_ENTRY EofWaitLinks;
+ KEVENT Event;
+} EOF_WAIT_BLOCK, *PEOF_WAIT_BLOCK;
+
+typedef struct _FSRTL_AUXILIARY_BUFFER {
+ PVOID Buffer;
+ ULONG Length;
+ ULONG Flags;
+ PMDL Mdl;
+} FSRTL_AUXILIARY_BUFFER, *PFSRTL_AUXILIARY_BUFFER;
+
+#define FSRTL_AUXILIARY_FLAG_DEALLOCATE 0x00000001
+
+typedef struct _FILE_LOCK_INFO {
+ LARGE_INTEGER StartingByte;
+ LARGE_INTEGER Length;
+ BOOLEAN ExclusiveLock;
+ ULONG Key;
+ PFILE_OBJECT FileObject;
+ PVOID ProcessId;
+ LARGE_INTEGER EndingByte;
+} FILE_LOCK_INFO, *PFILE_LOCK_INFO;
+
+typedef NTSTATUS
+(NTAPI *PCOMPLETE_LOCK_IRP_ROUTINE) (
+ IN PVOID Context,
+ IN PIRP Irp);
+
+typedef VOID
+(NTAPI *PUNLOCK_ROUTINE) (
+ IN PVOID Context,
+ IN PFILE_LOCK_INFO FileLockInfo);
+
+typedef struct _FILE_LOCK {
+ PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine;
+ PUNLOCK_ROUTINE UnlockRoutine;
+ BOOLEAN FastIoIsQuestionable;
+ BOOLEAN SpareC[3];
+ PVOID LockInformation;
+ FILE_LOCK_INFO LastReturnedLockInfo;
+ PVOID LastReturnedLock;
+ LONG volatile LockRequestsInProgress;
+} FILE_LOCK, *PFILE_LOCK;
+
+typedef struct _TUNNEL {
+ FAST_MUTEX Mutex;
+ PRTL_SPLAY_LINKS Cache;
+ LIST_ENTRY TimerQueue;
+ USHORT NumEntries;
+} TUNNEL, *PTUNNEL;
+
+typedef enum _FSRTL_COMPARISON_RESULT {
+ LessThan = -1,
+ EqualTo = 0,
+ GreaterThan = 1
+} FSRTL_COMPARISON_RESULT;
+
+#define FSRTL_FAT_LEGAL 0x01
+#define FSRTL_HPFS_LEGAL 0x02
+#define FSRTL_NTFS_LEGAL 0x04
+#define FSRTL_WILD_CHARACTER 0x08
+#define FSRTL_OLE_LEGAL 0x10
+#define FSRTL_NTFS_STREAM_LEGAL (FSRTL_NTFS_LEGAL | FSRTL_OLE_LEGAL)
+
+typedef struct _BASE_MCB {
+ ULONG MaximumPairCount;
+ ULONG PairCount;
+ USHORT PoolType;
+ USHORT Flags;
+ PVOID Mapping;
+} BASE_MCB, *PBASE_MCB;
+
+typedef struct _LARGE_MCB {
+ PKGUARDED_MUTEX GuardedMutex;
+ BASE_MCB BaseMcb;
+} LARGE_MCB, *PLARGE_MCB;
+
+#define MCB_FLAG_RAISE_ON_ALLOCATION_FAILURE 1
+
+typedef struct _MCB {
+ LARGE_MCB DummyFieldThatSizesThisStructureCorrectly;
+} MCB, *PMCB;
+
+typedef PVOID OPLOCK, *POPLOCK;
+
+typedef VOID
+(NTAPI *POPLOCK_WAIT_COMPLETE_ROUTINE) (
+ IN PVOID Context,
+ IN PIRP Irp);
+
+typedef VOID
+(NTAPI *POPLOCK_FS_PREPOST_IRP) (
+ IN PVOID Context,
+ IN PIRP Irp);
+
+#if (NTDDI_VERSION >= NTDDI_VISTASP1)
+#define OPLOCK_FLAG_COMPLETE_IF_OPLOCKED 0x00000001
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+#define OPLOCK_FLAG_OPLOCK_KEY_CHECK_ONLY 0x00000002
+#define OPLOCK_FLAG_BACK_OUT_ATOMIC_OPLOCK 0x00000004
+#define OPLOCK_FLAG_IGNORE_OPLOCK_KEYS 0x00000008
+#define OPLOCK_FSCTRL_FLAG_ALL_KEYS_MATCH 0x00000001
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+
+typedef struct _OPLOCK_KEY_ECP_CONTEXT {
+ GUID OplockKey;
+ ULONG Reserved;
+} OPLOCK_KEY_ECP_CONTEXT, *POPLOCK_KEY_ECP_CONTEXT;
+
+DEFINE_GUID( GUID_ECP_OPLOCK_KEY, 0x48850596, 0x3050, 0x4be7, 0x98, 0x63, 0xfe, 0xc3, 0x50, 0xce, 0x8d, 0x7f );
+
+#endif
+
+#define FSRTL_VOLUME_DISMOUNT 1
+#define FSRTL_VOLUME_DISMOUNT_FAILED 2
+#define FSRTL_VOLUME_LOCK 3
+#define FSRTL_VOLUME_LOCK_FAILED 4
+#define FSRTL_VOLUME_UNLOCK 5
+#define FSRTL_VOLUME_MOUNT 6
+#define FSRTL_VOLUME_NEEDS_CHKDSK 7
+#define FSRTL_VOLUME_WORM_NEAR_FULL 8
+#define FSRTL_VOLUME_WEARING_OUT 9
+#define FSRTL_VOLUME_FORCED_CLOSED 10
+#define FSRTL_VOLUME_INFO_MAKE_COMPAT 11
+#define FSRTL_VOLUME_PREPARING_EJECT 12
+#define FSRTL_VOLUME_CHANGE_SIZE 13
+#define FSRTL_VOLUME_BACKGROUND_FORMAT 14
+
+typedef PVOID PNOTIFY_SYNC;
+
+typedef BOOLEAN
+(NTAPI *PCHECK_FOR_TRAVERSE_ACCESS) (
+ IN PVOID NotifyContext,
+ IN PVOID TargetContext OPTIONAL,
+ IN PSECURITY_SUBJECT_CONTEXT SubjectContext);
+
+typedef BOOLEAN
+(NTAPI *PFILTER_REPORT_CHANGE) (
+ IN PVOID NotifyContext,
+ IN PVOID FilterContext);
+
+typedef VOID
+(NTAPI *PFSRTL_STACK_OVERFLOW_ROUTINE) (
+ IN PVOID Context,
+ IN PKEVENT Event);
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+
+#define FSRTL_UNC_PROVIDER_FLAGS_MAILSLOTS_SUPPORTED 0x00000001
+#define FSRTL_UNC_PROVIDER_FLAGS_CSC_ENABLED 0x00000002
+#define FSRTL_UNC_PROVIDER_FLAGS_DOMAIN_SVC_AWARE 0x00000004
+
+#define FSRTL_ALLOCATE_ECPLIST_FLAG_CHARGE_QUOTA 0x00000001
+
+#define FSRTL_ALLOCATE_ECP_FLAG_CHARGE_QUOTA 0x00000001
+#define FSRTL_ALLOCATE_ECP_FLAG_NONPAGED_POOL 0x00000002
+
+#define FSRTL_ECP_LOOKASIDE_FLAG_NONPAGED_POOL 0x00000002
+
+#define FSRTL_VIRTDISK_FULLY_ALLOCATED 0x00000001
+#define FSRTL_VIRTDISK_NO_DRIVE_LETTER 0x00000002
+
+typedef struct _FSRTL_MUP_PROVIDER_INFO_LEVEL_1 {
+ ULONG32 ProviderId;
+} FSRTL_MUP_PROVIDER_INFO_LEVEL_1, *PFSRTL_MUP_PROVIDER_INFO_LEVEL_1;
+
+typedef struct _FSRTL_MUP_PROVIDER_INFO_LEVEL_2 {
+ ULONG32 ProviderId;
+ UNICODE_STRING ProviderName;
+} FSRTL_MUP_PROVIDER_INFO_LEVEL_2, *PFSRTL_MUP_PROVIDER_INFO_LEVEL_2;
+
+typedef VOID
+(*PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK) (
+ IN OUT PVOID EcpContext,
+ IN LPCGUID EcpType);
+
+typedef struct _ECP_LIST ECP_LIST, *PECP_LIST;
+
+typedef ULONG FSRTL_ALLOCATE_ECPLIST_FLAGS;
+typedef ULONG FSRTL_ALLOCATE_ECP_FLAGS;
+typedef ULONG FSRTL_ECP_LOOKASIDE_FLAGS;
+
+typedef enum _FSRTL_CHANGE_BACKING_TYPE {
+ ChangeDataControlArea,
+ ChangeImageControlArea,
+ ChangeSharedCacheMap
+} FSRTL_CHANGE_BACKING_TYPE, *PFSRTL_CHANGE_BACKING_TYPE;
+
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+
+typedef struct _FSRTL_PER_FILE_CONTEXT {
+ LIST_ENTRY Links;
+ PVOID OwnerId;
+ PVOID InstanceId;
+ PFREE_FUNCTION FreeCallback;
+} FSRTL_PER_FILE_CONTEXT, *PFSRTL_PER_FILE_CONTEXT;
+
+typedef struct _FSRTL_PER_STREAM_CONTEXT {
+ LIST_ENTRY Links;
+ PVOID OwnerId;
+ PVOID InstanceId;
+ PFREE_FUNCTION FreeCallback;
+} FSRTL_PER_STREAM_CONTEXT, *PFSRTL_PER_STREAM_CONTEXT;
+
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+typedef VOID
+(*PFN_FSRTLTEARDOWNPERSTREAMCONTEXTS) (
+ IN PFSRTL_ADVANCED_FCB_HEADER AdvancedHeader);
+#endif
+
+typedef struct _FSRTL_PER_FILEOBJECT_CONTEXT {
+ LIST_ENTRY Links;
+ PVOID OwnerId;
+ PVOID InstanceId;
+} FSRTL_PER_FILEOBJECT_CONTEXT, *PFSRTL_PER_FILEOBJECT_CONTEXT;
+
+#define FsRtlEnterFileSystem KeEnterCriticalRegion
#define FsRtlExitFileSystem KeLeaveCriticalRegion
+#define FSRTL_CC_FLUSH_ERROR_FLAG_NO_HARD_ERROR 0x1
+#define FSRTL_CC_FLUSH_ERROR_FLAG_NO_LOG_ENTRY 0x2
+
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlFastCheckLockForRead (
- IN PFILE_LOCK FileLock,
- IN PLARGE_INTEGER FileOffset,
- IN PLARGE_INTEGER Length,
- IN ULONG Key,
- IN PFILE_OBJECT FileObject,
- IN PVOID Process
-);
+FsRtlCopyRead(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length,
+ IN BOOLEAN Wait,
+ IN ULONG LockKey,
+ OUT PVOID Buffer,
+ OUT PIO_STATUS_BLOCK IoStatus,
+ IN PDEVICE_OBJECT DeviceObject);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlFastCheckLockForWrite (
- IN PFILE_LOCK FileLock,
- IN PLARGE_INTEGER FileOffset,
- IN PLARGE_INTEGER Length,
- IN ULONG Key,
- IN PFILE_OBJECT FileObject,
- IN PVOID Process
-);
-
-#define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) ( \
- FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11) \
-)
+FsRtlCopyWrite(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length,
+ IN BOOLEAN Wait,
+ IN ULONG LockKey,
+ IN PVOID Buffer,
+ OUT PIO_STATUS_BLOCK IoStatus,
+ IN PDEVICE_OBJECT DeviceObject);
NTKERNELAPI
-NTSTATUS
+BOOLEAN
NTAPI
-FsRtlFastUnlockAll (
- IN PFILE_LOCK FileLock,
- IN PFILE_OBJECT FileObject,
- IN PEPROCESS Process,
- IN PVOID Context OPTIONAL
-);
-/* ret: STATUS_RANGE_NOT_LOCKED */
+FsRtlMdlReadDev(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length,
+ IN ULONG LockKey,
+ OUT PMDL *MdlChain,
+ OUT PIO_STATUS_BLOCK IoStatus,
+ IN PDEVICE_OBJECT DeviceObject OPTIONAL);
NTKERNELAPI
-NTSTATUS
+BOOLEAN
NTAPI
-FsRtlFastUnlockAllByKey (
- IN PFILE_LOCK FileLock,
- IN PFILE_OBJECT FileObject,
- IN PEPROCESS Process,
- IN ULONG Key,
- IN PVOID Context OPTIONAL
-);
-/* ret: STATUS_RANGE_NOT_LOCKED */
+FsRtlMdlReadCompleteDev(
+ IN PFILE_OBJECT FileObject,
+ IN PMDL MdlChain,
+ IN PDEVICE_OBJECT DeviceObject OPTIONAL);
NTKERNELAPI
-NTSTATUS
+BOOLEAN
NTAPI
-FsRtlFastUnlockSingle (
- IN PFILE_LOCK FileLock,
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN PLARGE_INTEGER Length,
- IN PEPROCESS Process,
- IN ULONG Key,
- IN PVOID Context OPTIONAL,
- IN BOOLEAN AlreadySynchronized
-);
-/* ret: STATUS_RANGE_NOT_LOCKED */
+FsRtlPrepareMdlWriteDev(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length,
+ IN ULONG LockKey,
+ OUT PMDL *MdlChain,
+ OUT PIO_STATUS_BLOCK IoStatus,
+ IN PDEVICE_OBJECT DeviceObject);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlFindInTunnelCache (
- IN PTUNNEL Cache,
- IN ULONGLONG DirectoryKey,
- IN PUNICODE_STRING Name,
- OUT PUNICODE_STRING ShortName,
- OUT PUNICODE_STRING LongName,
- IN OUT PULONG DataLength,
- OUT PVOID Data
-);
-
-#if (VER_PRODUCTBUILD >= 2195)
+FsRtlMdlWriteCompleteDev(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN PMDL MdlChain,
+ IN PDEVICE_OBJECT DeviceObject);
NTKERNELAPI
VOID
NTAPI
-FsRtlFreeFileLock (
- IN PFILE_LOCK FileLock
-);
-
-#endif /* (VER_PRODUCTBUILD >= 2195) */
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-FsRtlGetFileSize (
- IN PFILE_OBJECT FileObject,
- IN OUT PLARGE_INTEGER FileSize
-);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlGetNextBaseMcbEntry (
- IN PBASE_MCB Mcb,
- IN ULONG RunIndex,
- OUT PLONGLONG Vbn,
- OUT PLONGLONG Lbn,
- OUT PLONGLONG SectorCount
-);
-
-/*
- FsRtlGetNextFileLock:
-
- ret: NULL if no more locks
+FsRtlAcquireFileExclusive(
+ IN PFILE_OBJECT FileObject);
- Internals:
- FsRtlGetNextFileLock uses FileLock->LastReturnedLockInfo and
- FileLock->LastReturnedLock as storage.
- LastReturnedLock is a pointer to the 'raw' lock inkl. double linked
- list, and FsRtlGetNextFileLock needs this to get next lock on subsequent
- calls with Restart = FALSE.
-*/
NTKERNELAPI
-PFILE_LOCK_INFO
+VOID
NTAPI
-FsRtlGetNextFileLock (
- IN PFILE_LOCK FileLock,
- IN BOOLEAN Restart
-);
+FsRtlReleaseFile(
+ IN PFILE_OBJECT FileObject);
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-FsRtlGetNextLargeMcbEntry (
- IN PLARGE_MCB Mcb,
- IN ULONG RunIndex,
- OUT PLONGLONG Vbn,
- OUT PLONGLONG Lbn,
- OUT PLONGLONG SectorCount
-);
+FsRtlGetFileSize(
+ IN PFILE_OBJECT FileObject,
+ OUT PLARGE_INTEGER FileSize);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlGetNextMcbEntry (
- IN PMCB Mcb,
- IN ULONG RunIndex,
- OUT PVBN Vbn,
- OUT PLBN Lbn,
- OUT PULONG SectorCount
-);
-
-#define FsRtlGetPerStreamContextPointer(FO) ( \
- (PFSRTL_ADVANCED_FCB_HEADER)(FO)->FsContext \
-)
+FsRtlIsTotalDeviceFailure(
+ IN NTSTATUS Status);
NTKERNELAPI
-VOID
+PFILE_LOCK
NTAPI
-FsRtlInitializeBaseMcb (
- IN PBASE_MCB Mcb,
- IN POOL_TYPE PoolType
-);
+FsRtlAllocateFileLock(
+ IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL,
+ IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL);
NTKERNELAPI
VOID
NTAPI
-FsRtlInitializeFileLock (
- IN PFILE_LOCK FileLock,
- IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL,
- IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL
-);
+FsRtlFreeFileLock(
+ IN PFILE_LOCK FileLock);
NTKERNELAPI
VOID
NTAPI
-FsRtlInitializeLargeMcb (
- IN PLARGE_MCB Mcb,
- IN POOL_TYPE PoolType
-);
+FsRtlInitializeFileLock(
+ IN PFILE_LOCK FileLock,
+ IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL,
+ IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL);
NTKERNELAPI
VOID
NTAPI
-FsRtlInitializeMcb (
- IN PMCB Mcb,
- IN POOL_TYPE PoolType
-);
+FsRtlUninitializeFileLock(
+ IN PFILE_LOCK FileLock);
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlInitializeOplock (
- IN OUT POPLOCK Oplock
-);
+/*
+ FsRtlProcessFileLock:
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlInitializeTunnelCache (
- IN PTUNNEL Cache
-);
+ ret:
+ -STATUS_INVALID_DEVICE_REQUEST
+ -STATUS_RANGE_NOT_LOCKED from unlock routines.
+ -STATUS_PENDING, STATUS_LOCK_NOT_GRANTED from FsRtlPrivateLock
+ (redirected IoStatus->Status).
-#define FsRtlInitPerStreamContext(PSC, O, I, FC) ( \
- (PSC)->OwnerId = (O), \
- (PSC)->InstanceId = (I), \
- (PSC)->FreeCallback = (FC) \
-)
+ Internals:
+ -switch ( Irp->CurrentStackLocation->MinorFunction )
+ lock: return FsRtlPrivateLock;
+ unlocksingle: return FsRtlFastUnlockSingle;
+ unlockall: return FsRtlFastUnlockAll;
+ unlockallbykey: return FsRtlFastUnlockAllByKey;
+ default: IofCompleteRequest with STATUS_INVALID_DEVICE_REQUEST;
+ return STATUS_INVALID_DEVICE_REQUEST;
+ -'AllwaysZero' is passed thru as 'AllwaysZero' to lock / unlock routines.
+ -'Irp' is passet thru as 'Irp' to FsRtlPrivateLock.
+*/
NTKERNELAPI
NTSTATUS
NTAPI
-FsRtlInsertPerStreamContext (
- IN PFSRTL_ADVANCED_FCB_HEADER PerStreamContext,
- IN PFSRTL_PER_STREAM_CONTEXT Ptr
-);
-
-#define FsRtlIsAnsiCharacterLegalFat(C, WILD) ( \
- FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_FAT_LEGAL) | \
- ((WILD) ? FSRTL_WILD_CHARACTER : 0 )) \
-)
-
-#define FsRtlIsAnsiCharacterLegalHpfs(C, WILD) ( \
- FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_HPFS_LEGAL) | \
- ((WILD) ? FSRTL_WILD_CHARACTER : 0 )) \
-)
-
-#define FsRtlIsAnsiCharacterLegalNtfs(C, WILD) ( \
- FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_NTFS_LEGAL) | \
- ((WILD) ? FSRTL_WILD_CHARACTER : 0 )) \
-)
+FsRtlProcessFileLock(
+ IN PFILE_LOCK FileLock,
+ IN PIRP Irp,
+ IN PVOID Context OPTIONAL);
-#define FsRtlIsAnsiCharacterWild(C) ( \
- FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], FSRTL_WILD_CHARACTER ) \
-)
+/*
+ FsRtlCheckLockForReadAccess:
+ All this really does is pick out the lock parameters from the irp (io stack
+ location?), get IoGetRequestorProcess, and pass values on to
+ FsRtlFastCheckLockForRead.
+*/
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlIsFatDbcsLegal (
- IN ANSI_STRING DbcsName,
- IN BOOLEAN WildCardsPermissible,
- IN BOOLEAN PathNamePermissible,
- IN BOOLEAN LeadingBackslashPermissible
-);
+FsRtlCheckLockForReadAccess(
+ IN PFILE_LOCK FileLock,
+ IN PIRP Irp);
+
+/*
+ FsRtlCheckLockForWriteAccess:
+ All this really does is pick out the lock parameters from the irp (io stack
+ location?), get IoGetRequestorProcess, and pass values on to
+ FsRtlFastCheckLockForWrite.
+*/
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlIsHpfsDbcsLegal (
- IN ANSI_STRING DbcsName,
- IN BOOLEAN WildCardsPermissible,
- IN BOOLEAN PathNamePermissible,
- IN BOOLEAN LeadingBackslashPermissible
-);
+FsRtlCheckLockForWriteAccess(
+ IN PFILE_LOCK FileLock,
+ IN PIRP Irp);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlIsNameInExpression (
- IN PUNICODE_STRING Expression,
- IN PUNICODE_STRING Name,
- IN BOOLEAN IgnoreCase,
- IN PWCHAR UpcaseTable OPTIONAL
-);
+FsRtlFastCheckLockForRead(
+ IN PFILE_LOCK FileLock,
+ IN PLARGE_INTEGER FileOffset,
+ IN PLARGE_INTEGER Length,
+ IN ULONG Key,
+ IN PFILE_OBJECT FileObject,
+ IN PVOID Process);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlIsNtstatusExpected (
- IN NTSTATUS Ntstatus
-);
-
-#define NLS_OEM_LEAD_BYTE_INFO NlsOemLeadByteInfo
-
-extern PUSHORT NlsOemLeadByteInfo;
+FsRtlFastCheckLockForWrite(
+ IN PFILE_LOCK FileLock,
+ IN PLARGE_INTEGER FileOffset,
+ IN PLARGE_INTEGER Length,
+ IN ULONG Key,
+ IN PFILE_OBJECT FileObject,
+ IN PVOID Process);
-#define FsRtlIsLeadDbcsCharacter(DBCS_CHAR) ( \
- (BOOLEAN)((UCHAR)(DBCS_CHAR) < 0x80 ? FALSE : \
- (NLS_MB_CODE_PAGE_TAG && \
- (NLS_OEM_LEAD_BYTE_INFO[(UCHAR)(DBCS_CHAR)] != 0))) \
-)
+/*
+ FsRtlGetNextFileLock:
-#define FsRtlIsUnicodeCharacterWild(C) ( \
- (((C) >= 0x40) ? \
- FALSE : \
- FlagOn(FsRtlLegalAnsiCharacterArray[(C)], FSRTL_WILD_CHARACTER )) \
-)
+ ret: NULL if no more locks
+ Internals:
+ FsRtlGetNextFileLock uses FileLock->LastReturnedLockInfo and
+ FileLock->LastReturnedLock as storage.
+ LastReturnedLock is a pointer to the 'raw' lock inkl. double linked
+ list, and FsRtlGetNextFileLock needs this to get next lock on subsequent
+ calls with Restart = FALSE.
+*/
NTKERNELAPI
-BOOLEAN
+PFILE_LOCK_INFO
NTAPI
-FsRtlLookupBaseMcbEntry (
- IN PBASE_MCB Mcb,
- IN LONGLONG Vbn,
- OUT PLONGLONG Lbn OPTIONAL,
- OUT PLONGLONG SectorCountFromLbn OPTIONAL,
- OUT PLONGLONG StartingLbn OPTIONAL,
- OUT PLONGLONG SectorCountFromStartingLbn OPTIONAL,
- OUT PULONG Index OPTIONAL
-);
+FsRtlGetNextFileLock(
+ IN PFILE_LOCK FileLock,
+ IN BOOLEAN Restart);
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-FsRtlLookupLargeMcbEntry (
- IN PLARGE_MCB Mcb,
- IN LONGLONG Vbn,
- OUT PLONGLONG Lbn OPTIONAL,
- OUT PLONGLONG SectorCountFromLbn OPTIONAL,
- OUT PLONGLONG StartingLbn OPTIONAL,
- OUT PLONGLONG SectorCountFromStartingLbn OPTIONAL,
- OUT PULONG Index OPTIONAL
-);
+FsRtlFastUnlockSingle(
+ IN PFILE_LOCK FileLock,
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN PLARGE_INTEGER Length,
+ IN PEPROCESS Process,
+ IN ULONG Key,
+ IN PVOID Context OPTIONAL,
+ IN BOOLEAN AlreadySynchronized);
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-FsRtlLookupLastBaseMcbEntry (
- IN PBASE_MCB Mcb,
- OUT PLONGLONG Vbn,
- OUT PLONGLONG Lbn
-);
+FsRtlFastUnlockAll(
+ IN PFILE_LOCK FileLock,
+ IN PFILE_OBJECT FileObject,
+ IN PEPROCESS Process,
+ IN PVOID Context OPTIONAL);
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-FsRtlLookupLastLargeMcbEntry (
- IN PLARGE_MCB Mcb,
- OUT PLONGLONG Vbn,
- OUT PLONGLONG Lbn
-);
+FsRtlFastUnlockAllByKey(
+ IN PFILE_LOCK FileLock,
+ IN PFILE_OBJECT FileObject,
+ IN PEPROCESS Process,
+ IN ULONG Key,
+ IN PVOID Context OPTIONAL);
+/*
+ FsRtlPrivateLock:
+
+ ret: IoStatus->Status: STATUS_PENDING, STATUS_LOCK_NOT_GRANTED
+
+ Internals:
+ -Calls IoCompleteRequest if Irp
+ -Uses exception handling / ExRaiseStatus with STATUS_INSUFFICIENT_RESOURCES
+*/
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlLookupLastMcbEntry (
- IN PMCB Mcb,
- OUT PVBN Vbn,
- OUT PLBN Lbn
-);
+FsRtlPrivateLock(
+ IN PFILE_LOCK FileLock,
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN PLARGE_INTEGER Length,
+ IN PEPROCESS Process,
+ IN ULONG Key,
+ IN BOOLEAN FailImmediately,
+ IN BOOLEAN ExclusiveLock,
+ OUT PIO_STATUS_BLOCK IoStatus,
+ IN PIRP Irp OPTIONAL,
+ IN PVOID Context,
+ IN BOOLEAN AlreadySynchronized);
NTKERNELAPI
-BOOLEAN
+VOID
NTAPI
-FsRtlLookupLastBaseMcbEntryAndIndex (
- IN PBASE_MCB OpaqueMcb,
- IN OUT PLONGLONG LargeVbn,
- IN OUT PLONGLONG LargeLbn,
- IN OUT PULONG Index
-);
+FsRtlInitializeTunnelCache(
+ IN PTUNNEL Cache);
NTKERNELAPI
-BOOLEAN
+VOID
NTAPI
-FsRtlLookupLastLargeMcbEntryAndIndex (
- IN PLARGE_MCB OpaqueMcb,
- OUT PLONGLONG LargeVbn,
- OUT PLONGLONG LargeLbn,
- OUT PULONG Index
-);
+FsRtlAddToTunnelCache(
+ IN PTUNNEL Cache,
+ IN ULONGLONG DirectoryKey,
+ IN PUNICODE_STRING ShortName,
+ IN PUNICODE_STRING LongName,
+ IN BOOLEAN KeyByShortName,
+ IN ULONG DataLength,
+ IN PVOID Data);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlLookupMcbEntry (
- IN PMCB Mcb,
- IN VBN Vbn,
- OUT PLBN Lbn,
- OUT PULONG SectorCount OPTIONAL,
- OUT PULONG Index
-);
+FsRtlFindInTunnelCache(
+ IN PTUNNEL Cache,
+ IN ULONGLONG DirectoryKey,
+ IN PUNICODE_STRING Name,
+ OUT PUNICODE_STRING ShortName,
+ OUT PUNICODE_STRING LongName,
+ IN OUT PULONG DataLength,
+ OUT PVOID Data);
NTKERNELAPI
-PFSRTL_PER_STREAM_CONTEXT
+VOID
NTAPI
-FsRtlLookupPerStreamContextInternal (
- IN PFSRTL_ADVANCED_FCB_HEADER StreamContext,
- IN PVOID OwnerId OPTIONAL,
- IN PVOID InstanceId OPTIONAL
-);
+FsRtlDeleteKeyFromTunnelCache(
+ IN PTUNNEL Cache,
+ IN ULONGLONG DirectoryKey);
NTKERNELAPI
-BOOLEAN
+VOID
NTAPI
-FsRtlMdlReadDev (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN ULONG Length,
- IN ULONG LockKey,
- OUT PMDL *MdlChain,
- OUT PIO_STATUS_BLOCK IoStatus,
- IN PDEVICE_OBJECT DeviceObject
-);
+FsRtlDeleteTunnelCache(
+ IN PTUNNEL Cache);
NTKERNELAPI
-BOOLEAN
+VOID
NTAPI
-FsRtlMdlReadComplete (
- IN PFILE_OBJECT FileObject,
- IN PMDL MdlChain
-);
+FsRtlDissectDbcs(
+ IN ANSI_STRING Name,
+ OUT PANSI_STRING FirstPart,
+ OUT PANSI_STRING RemainingPart);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlMdlReadCompleteDev (
- IN PFILE_OBJECT FileObject,
- IN PMDL MdlChain,
- IN PDEVICE_OBJECT DeviceObject
-);
+FsRtlDoesDbcsContainWildCards(
+ IN PANSI_STRING Name);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlPrepareMdlWriteDev (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN ULONG Length,
- IN ULONG LockKey,
- OUT PMDL *MdlChain,
- OUT PIO_STATUS_BLOCK IoStatus,
- IN PDEVICE_OBJECT DeviceObject
-);
+FsRtlIsDbcsInExpression(
+ IN PANSI_STRING Expression,
+ IN PANSI_STRING Name);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlMdlWriteComplete (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN PMDL MdlChain
-);
+FsRtlIsFatDbcsLegal(
+ IN ANSI_STRING DbcsName,
+ IN BOOLEAN WildCardsPermissible,
+ IN BOOLEAN PathNamePermissible,
+ IN BOOLEAN LeadingBackslashPermissible);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlMdlWriteCompleteDev (
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN PMDL MdlChain,
- IN PDEVICE_OBJECT DeviceObject
-);
+FsRtlIsHpfsDbcsLegal(
+ IN ANSI_STRING DbcsName,
+ IN BOOLEAN WildCardsPermissible,
+ IN BOOLEAN PathNamePermissible,
+ IN BOOLEAN LeadingBackslashPermissible);
NTKERNELAPI
NTSTATUS
NTAPI
-FsRtlNormalizeNtstatus (
- IN NTSTATUS Exception,
- IN NTSTATUS GenericException
-);
+FsRtlNormalizeNtstatus(
+ IN NTSTATUS Exception,
+ IN NTSTATUS GenericException);
NTKERNELAPI
-VOID
+BOOLEAN
NTAPI
-FsRtlNotifyChangeDirectory (
- IN PNOTIFY_SYNC NotifySync,
- IN PVOID FsContext,
- IN PSTRING FullDirectoryName,
- IN PLIST_ENTRY NotifyList,
- IN BOOLEAN WatchTree,
- IN ULONG CompletionFilter,
- IN PIRP NotifyIrp
-);
+FsRtlIsNtstatusExpected(
+ IN NTSTATUS Ntstatus);
NTKERNELAPI
-VOID
+PERESOURCE
NTAPI
-FsRtlNotifyCleanup (
- IN PNOTIFY_SYNC NotifySync,
- IN PLIST_ENTRY NotifyList,
- IN PVOID FsContext
-);
-
-typedef BOOLEAN (NTAPI *PCHECK_FOR_TRAVERSE_ACCESS) (
- IN PVOID NotifyContext,
- IN PVOID TargetContext,
- IN PSECURITY_SUBJECT_CONTEXT SubjectContext
-);
+FsRtlAllocateResource(
+ VOID);
NTKERNELAPI
VOID
NTAPI
-FsRtlNotifyFilterChangeDirectory (
- IN PNOTIFY_SYNC NotifySync,
- IN PLIST_ENTRY NotifyList,
- IN PVOID FsContext,
- IN PSTRING FullDirectoryName,
- IN BOOLEAN WatchTree,
- IN BOOLEAN IgnoreBuffer,
- IN ULONG CompletionFilter,
- IN PIRP NotifyIrp,
- IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL,
- IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL,
- IN PFILTER_REPORT_CHANGE FilterCallback OPTIONAL);
+FsRtlInitializeLargeMcb(
+ IN PLARGE_MCB Mcb,
+ IN POOL_TYPE PoolType);
NTKERNELAPI
VOID
NTAPI
-FsRtlNotifyFilterReportChange (
- IN PNOTIFY_SYNC NotifySync,
- IN PLIST_ENTRY NotifyList,
- IN PSTRING FullTargetName,
- IN USHORT TargetNameOffset,
- IN PSTRING StreamName OPTIONAL,
- IN PSTRING NormalizedParentName OPTIONAL,
- IN ULONG FilterMatch,
- IN ULONG Action,
- IN PVOID TargetContext,
- IN PVOID FilterContext);
+FsRtlUninitializeLargeMcb(
+ IN PLARGE_MCB Mcb);
NTKERNELAPI
VOID
NTAPI
-FsRtlNotifyFullChangeDirectory (
- IN PNOTIFY_SYNC NotifySync,
- IN PLIST_ENTRY NotifyList,
- IN PVOID FsContext,
- IN PSTRING FullDirectoryName,
- IN BOOLEAN WatchTree,
- IN BOOLEAN IgnoreBuffer,
- IN ULONG CompletionFilter,
- IN PIRP NotifyIrp,
- IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL,
- IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL
-);
+FsRtlResetLargeMcb(
+ IN PLARGE_MCB Mcb,
+ IN BOOLEAN SelfSynchronized);
NTKERNELAPI
VOID
NTAPI
-FsRtlNotifyFullReportChange (
- IN PNOTIFY_SYNC NotifySync,
- IN PLIST_ENTRY NotifyList,
- IN PSTRING FullTargetName,
- IN USHORT TargetNameOffset,
- IN PSTRING StreamName OPTIONAL,
- IN PSTRING NormalizedParentName OPTIONAL,
- IN ULONG FilterMatch,
- IN ULONG Action,
- IN PVOID TargetContext
-);
+FsRtlTruncateLargeMcb(
+ IN PLARGE_MCB Mcb,
+ IN LONGLONG Vbn);
NTKERNELAPI
-VOID
+BOOLEAN
NTAPI
-FsRtlNotifyInitializeSync (
- IN PNOTIFY_SYNC *NotifySync
-);
+FsRtlAddLargeMcbEntry(
+ IN PLARGE_MCB Mcb,
+ IN LONGLONG Vbn,
+ IN LONGLONG Lbn,
+ IN LONGLONG SectorCount);
NTKERNELAPI
VOID
NTAPI
-FsRtlNotifyUninitializeSync (
- IN PNOTIFY_SYNC *NotifySync
-);
-
-#if (VER_PRODUCTBUILD >= 2195)
+FsRtlRemoveLargeMcbEntry(
+ IN PLARGE_MCB Mcb,
+ IN LONGLONG Vbn,
+ IN LONGLONG SectorCount);
NTKERNELAPI
-NTSTATUS
+BOOLEAN
NTAPI
-FsRtlNotifyVolumeEvent (
- IN PFILE_OBJECT FileObject,
- IN ULONG EventCode
-);
-
-#endif /* (VER_PRODUCTBUILD >= 2195) */
+FsRtlLookupLargeMcbEntry(
+ IN PLARGE_MCB Mcb,
+ IN LONGLONG Vbn,
+ OUT PLONGLONG Lbn OPTIONAL,
+ OUT PLONGLONG SectorCountFromLbn OPTIONAL,
+ OUT PLONGLONG StartingLbn OPTIONAL,
+ OUT PLONGLONG SectorCountFromStartingLbn OPTIONAL,
+ OUT PULONG Index OPTIONAL);
NTKERNELAPI
-ULONG
+BOOLEAN
NTAPI
-FsRtlNumberOfRunsInBaseMcb (
- IN PBASE_MCB Mcb
-);
+FsRtlLookupLastLargeMcbEntry(
+ IN PLARGE_MCB Mcb,
+ OUT PLONGLONG Vbn,
+ OUT PLONGLONG Lbn);
NTKERNELAPI
-ULONG
+BOOLEAN
NTAPI
-FsRtlNumberOfRunsInLargeMcb (
- IN PLARGE_MCB Mcb
-);
+FsRtlLookupLastLargeMcbEntryAndIndex(
+ IN PLARGE_MCB OpaqueMcb,
+ OUT PLONGLONG LargeVbn,
+ OUT PLONGLONG LargeLbn,
+ OUT PULONG Index);
NTKERNELAPI
ULONG
NTAPI
-FsRtlNumberOfRunsInMcb (
- IN PMCB Mcb
-);
+FsRtlNumberOfRunsInLargeMcb(
+ IN PLARGE_MCB Mcb);
NTKERNELAPI
-NTSTATUS
+BOOLEAN
NTAPI
-FsRtlOplockFsctrl (
- IN POPLOCK Oplock,
- IN PIRP Irp,
- IN ULONG OpenCount
-);
+FsRtlGetNextLargeMcbEntry(
+ IN PLARGE_MCB Mcb,
+ IN ULONG RunIndex,
+ OUT PLONGLONG Vbn,
+ OUT PLONGLONG Lbn,
+ OUT PLONGLONG SectorCount);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlOplockIsFastIoPossible (
- IN POPLOCK Oplock
-);
-
-typedef VOID
-(NTAPI *PFSRTL_STACK_OVERFLOW_ROUTINE) (
- IN PVOID Context,
- IN PKEVENT Event
-);
+FsRtlSplitLargeMcb(
+ IN PLARGE_MCB Mcb,
+ IN LONGLONG Vbn,
+ IN LONGLONG Amount);
NTKERNELAPI
VOID
NTAPI
-FsRtlPostPagingFileStackOverflow (
- IN PVOID Context,
- IN PKEVENT Event,
- IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine
-);
+FsRtlInitializeMcb(
+ IN PMCB Mcb,
+ IN POOL_TYPE PoolType);
NTKERNELAPI
VOID
NTAPI
-FsRtlPostStackOverflow (
- IN PVOID Context,
- IN PKEVENT Event,
- IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine
-);
-
-/*
- FsRtlPrivateLock:
+FsRtlUninitializeMcb(
+ IN PMCB Mcb);
- ret: IoStatus->Status: STATUS_PENDING, STATUS_LOCK_NOT_GRANTED
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlTruncateMcb(
+ IN PMCB Mcb,
+ IN VBN Vbn);
- Internals:
- -Calls IoCompleteRequest if Irp
- -Uses exception handling / ExRaiseStatus with STATUS_INSUFFICIENT_RESOURCES
-*/
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlPrivateLock (
- IN PFILE_LOCK FileLock,
- IN PFILE_OBJECT FileObject,
- IN PLARGE_INTEGER FileOffset,
- IN PLARGE_INTEGER Length,
- IN PEPROCESS Process,
- IN ULONG Key,
- IN BOOLEAN FailImmediately,
- IN BOOLEAN ExclusiveLock,
- OUT PIO_STATUS_BLOCK IoStatus,
- IN PIRP Irp OPTIONAL,
- IN PVOID Context,
- IN BOOLEAN AlreadySynchronized
-);
-
-/*
- FsRtlProcessFileLock:
+FsRtlAddMcbEntry(
+ IN PMCB Mcb,
+ IN VBN Vbn,
+ IN LBN Lbn,
+ IN ULONG SectorCount);
- ret:
- -STATUS_INVALID_DEVICE_REQUEST
- -STATUS_RANGE_NOT_LOCKED from unlock routines.
- -STATUS_PENDING, STATUS_LOCK_NOT_GRANTED from FsRtlPrivateLock
- (redirected IoStatus->Status).
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlRemoveMcbEntry(
+ IN PMCB Mcb,
+ IN VBN Vbn,
+ IN ULONG SectorCount);
- Internals:
- -switch ( Irp->CurrentStackLocation->MinorFunction )
- lock: return FsRtlPrivateLock;
- unlocksingle: return FsRtlFastUnlockSingle;
- unlockall: return FsRtlFastUnlockAll;
- unlockallbykey: return FsRtlFastUnlockAllByKey;
- default: IofCompleteRequest with STATUS_INVALID_DEVICE_REQUEST;
- return STATUS_INVALID_DEVICE_REQUEST;
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlLookupMcbEntry(
+ IN PMCB Mcb,
+ IN VBN Vbn,
+ OUT PLBN Lbn,
+ OUT PULONG SectorCount OPTIONAL,
+ OUT PULONG Index);
- -'AllwaysZero' is passed thru as 'AllwaysZero' to lock / unlock routines.
- -'Irp' is passet thru as 'Irp' to FsRtlPrivateLock.
-*/
NTKERNELAPI
-NTSTATUS
+BOOLEAN
NTAPI
-FsRtlProcessFileLock (
- IN PFILE_LOCK FileLock,
- IN PIRP Irp,
- IN PVOID Context OPTIONAL
-);
+FsRtlLookupLastMcbEntry(
+ IN PMCB Mcb,
+ OUT PVBN Vbn,
+ OUT PLBN Lbn);
NTKERNELAPI
-NTSTATUS
+ULONG
NTAPI
-FsRtlRegisterUncProvider (
- IN OUT PHANDLE MupHandle,
- IN PUNICODE_STRING RedirectorDeviceName,
- IN BOOLEAN MailslotsSupported
-);
+FsRtlNumberOfRunsInMcb(
+ IN PMCB Mcb);
NTKERNELAPI
-VOID
+BOOLEAN
NTAPI
-FsRtlRemoveBaseMcbEntry (
- IN PBASE_MCB Mcb,
- IN LONGLONG Vbn,
- IN LONGLONG SectorCount
-);
+FsRtlGetNextMcbEntry(
+ IN PMCB Mcb,
+ IN ULONG RunIndex,
+ OUT PVBN Vbn,
+ OUT PLBN Lbn,
+ OUT PULONG SectorCount);
NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-FsRtlRemoveLargeMcbEntry (
- IN PLARGE_MCB Mcb,
- IN LONGLONG Vbn,
- IN LONGLONG SectorCount
-);
+FsRtlBalanceReads(
+ IN PDEVICE_OBJECT TargetDevice);
NTKERNELAPI
VOID
NTAPI
-FsRtlRemoveMcbEntry (
- IN PMCB Mcb,
- IN VBN Vbn,
- IN ULONG SectorCount
-);
+FsRtlInitializeOplock(
+ IN OUT POPLOCK Oplock);
NTKERNELAPI
-PFSRTL_PER_STREAM_CONTEXT
+VOID
NTAPI
-FsRtlRemovePerStreamContext (
- IN PFSRTL_ADVANCED_FCB_HEADER StreamContext,
- IN PVOID OwnerId OPTIONAL,
- IN PVOID InstanceId OPTIONAL
-);
+FsRtlUninitializeOplock(
+ IN OUT POPLOCK Oplock);
NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-FsRtlResetBaseMcb (
- IN PBASE_MCB Mcb
-);
+FsRtlOplockFsctrl(
+ IN POPLOCK Oplock,
+ IN PIRP Irp,
+ IN ULONG OpenCount);
NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-FsRtlResetLargeMcb (
- IN PLARGE_MCB Mcb,
- IN BOOLEAN SelfSynchronized
-);
+FsRtlCheckOplock(
+ IN POPLOCK Oplock,
+ IN PIRP Irp,
+ IN PVOID Context,
+ IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
+ IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlSplitBaseMcb (
- IN PBASE_MCB Mcb,
- IN LONGLONG Vbn,
- IN LONGLONG Amount
-);
+FsRtlOplockIsFastIoPossible(
+ IN POPLOCK Oplock);
NTKERNELAPI
BOOLEAN
NTAPI
-FsRtlSplitLargeMcb (
- IN PLARGE_MCB Mcb,
- IN LONGLONG Vbn,
- IN LONGLONG Amount
-);
+FsRtlCurrentBatchOplock(
+ IN POPLOCK Oplock);
-#define FsRtlSupportsPerStreamContexts(FO) ( \
- (BOOLEAN)((NULL != FsRtlGetPerStreamContextPointer(FO) && \
- FlagOn(FsRtlGetPerStreamContextPointer(FO)->Flags2, \
- FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS)) \
-)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlNotifyVolumeEvent(
+ IN PFILE_OBJECT FileObject,
+ IN ULONG EventCode);
NTKERNELAPI
VOID
NTAPI
-FsRtlTruncateBaseMcb (
- IN PBASE_MCB Mcb,
- IN LONGLONG Vbn
-);
+FsRtlNotifyInitializeSync(
+ IN PNOTIFY_SYNC *NotifySync);
NTKERNELAPI
VOID
NTAPI
-FsRtlTruncateLargeMcb (
- IN PLARGE_MCB Mcb,
- IN LONGLONG Vbn
-);
+FsRtlNotifyUninitializeSync(
+ IN PNOTIFY_SYNC *NotifySync);
NTKERNELAPI
VOID
NTAPI
-FsRtlTruncateMcb (
- IN PMCB Mcb,
- IN VBN Vbn
-);
+FsRtlNotifyFullChangeDirectory(
+ IN PNOTIFY_SYNC NotifySync,
+ IN PLIST_ENTRY NotifyList,
+ IN PVOID FsContext,
+ IN PSTRING FullDirectoryName,
+ IN BOOLEAN WatchTree,
+ IN BOOLEAN IgnoreBuffer,
+ IN ULONG CompletionFilter,
+ IN PIRP NotifyIrp OPTIONAL,
+ IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL,
+ IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL);
NTKERNELAPI
VOID
NTAPI
-FsRtlUninitializeBaseMcb (
- IN PBASE_MCB Mcb
-);
+FsRtlNotifyFilterReportChange(
+ IN PNOTIFY_SYNC NotifySync,
+ IN PLIST_ENTRY NotifyList,
+ IN PSTRING FullTargetName,
+ IN USHORT TargetNameOffset,
+ IN PSTRING StreamName OPTIONAL,
+ IN PSTRING NormalizedParentName OPTIONAL,
+ IN ULONG FilterMatch,
+ IN ULONG Action,
+ IN PVOID TargetContext OPTIONAL,
+ IN PVOID FilterContext OPTIONAL);
NTKERNELAPI
VOID
NTAPI
-FsRtlUninitializeFileLock (
- IN PFILE_LOCK FileLock
-);
+FsRtlNotifyFullReportChange(
+ IN PNOTIFY_SYNC NotifySync,
+ IN PLIST_ENTRY NotifyList,
+ IN PSTRING FullTargetName,
+ IN USHORT TargetNameOffset,
+ IN PSTRING StreamName OPTIONAL,
+ IN PSTRING NormalizedParentName OPTIONAL,
+ IN ULONG FilterMatch,
+ IN ULONG Action,
+ IN PVOID TargetContext OPTIONAL);
NTKERNELAPI
VOID
NTAPI
-FsRtlUninitializeLargeMcb (
- IN PLARGE_MCB Mcb
-);
+FsRtlNotifyCleanup(
+ IN PNOTIFY_SYNC NotifySync,
+ IN PLIST_ENTRY NotifyList,
+ IN PVOID FsContext);
NTKERNELAPI
VOID
NTAPI
-FsRtlUninitializeMcb (
- IN PMCB Mcb
-);
+FsRtlDissectName(
+ IN UNICODE_STRING Name,
+ OUT PUNICODE_STRING FirstPart,
+ OUT PUNICODE_STRING RemainingPart);
NTKERNELAPI
-VOID
+BOOLEAN
NTAPI
-FsRtlUninitializeOplock (
- IN OUT POPLOCK Oplock
-);
+FsRtlDoesNameContainWildCards(
+ IN PUNICODE_STRING Name);
NTKERNELAPI
-NTSTATUS
+BOOLEAN
NTAPI
-IoAttachDeviceToDeviceStackSafe(
- IN PDEVICE_OBJECT SourceDevice,
- IN PDEVICE_OBJECT TargetDevice,
- OUT PDEVICE_OBJECT *AttachedToDeviceObject
-);
+FsRtlAreNamesEqual(
+ IN PCUNICODE_STRING Name1,
+ IN PCUNICODE_STRING Name2,
+ IN BOOLEAN IgnoreCase,
+ IN PCWCH UpcaseTable OPTIONAL);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlIsNameInExpression(
+ IN PUNICODE_STRING Expression,
+ IN PUNICODE_STRING Name,
+ IN BOOLEAN IgnoreCase,
+ IN PWCHAR UpcaseTable OPTIONAL);
NTKERNELAPI
VOID
NTAPI
-IoAcquireVpbSpinLock (
- OUT PKIRQL Irql
-);
+FsRtlPostPagingFileStackOverflow(
+ IN PVOID Context,
+ IN PKEVENT Event,
+ IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine);
NTKERNELAPI
-NTSTATUS
+VOID
NTAPI
-IoCheckDesiredAccess (
- IN OUT PACCESS_MASK DesiredAccess,
- IN ACCESS_MASK GrantedAccess
-);
+FsRtlPostStackOverflow (
+ IN PVOID Context,
+ IN PKEVENT Event,
+ IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine);
NTKERNELAPI
NTSTATUS
NTAPI
-IoCheckEaBufferValidity (
- IN PFILE_FULL_EA_INFORMATION EaBuffer,
- IN ULONG EaLength,
- OUT PULONG ErrorOffset
-);
+FsRtlRegisterUncProvider(
+ OUT PHANDLE MupHandle,
+ IN PUNICODE_STRING RedirectorDeviceName,
+ IN BOOLEAN MailslotsSupported);
NTKERNELAPI
-NTSTATUS
+VOID
NTAPI
-IoCheckFunctionAccess (
- IN ACCESS_MASK GrantedAccess,
- IN UCHAR MajorFunction,
- IN UCHAR MinorFunction,
- IN ULONG IoControlCode,
- IN PVOID Argument1 OPTIONAL,
- IN PVOID Argument2 OPTIONAL
-);
+FsRtlDeregisterUncProvider(
+ IN HANDLE Handle);
-#if (VER_PRODUCTBUILD >= 2195)
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlTeardownPerStreamContexts(
+ IN PFSRTL_ADVANCED_FCB_HEADER AdvancedHeader);
NTKERNELAPI
NTSTATUS
NTAPI
-IoCheckQuotaBufferValidity (
- IN PFILE_QUOTA_INFORMATION QuotaBuffer,
- IN ULONG QuotaLength,
- OUT PULONG ErrorOffset
-);
+FsRtlCreateSectionForDataScan(
+ OUT PHANDLE SectionHandle,
+ OUT PVOID *SectionObject,
+ OUT PLARGE_INTEGER SectionFileSize OPTIONAL,
+ IN PFILE_OBJECT FileObject,
+ IN ACCESS_MASK DesiredAccess,
+ IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
+ IN PLARGE_INTEGER MaximumSize OPTIONAL,
+ IN ULONG SectionPageProtection,
+ IN ULONG AllocationAttributes,
+ IN ULONG Flags);
-#endif /* (VER_PRODUCTBUILD >= 2195) */
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+
+#if (NTDDI_VERSION >= NTDDI_WINXP)
NTKERNELAPI
-PFILE_OBJECT
+VOID
NTAPI
-IoCreateStreamFileObject (
- IN PFILE_OBJECT FileObject OPTIONAL,
- IN PDEVICE_OBJECT DeviceObject OPTIONAL
-);
-
-#if (VER_PRODUCTBUILD >= 2195)
+FsRtlNotifyFilterChangeDirectory(
+ IN PNOTIFY_SYNC NotifySync,
+ IN PLIST_ENTRY NotifyList,
+ IN PVOID FsContext,
+ IN PSTRING FullDirectoryName,
+ IN BOOLEAN WatchTree,
+ IN BOOLEAN IgnoreBuffer,
+ IN ULONG CompletionFilter,
+ IN PIRP NotifyIrp OPTIONAL,
+ IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL,
+ IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL,
+ IN PFILTER_REPORT_CHANGE FilterCallback OPTIONAL);
NTKERNELAPI
-PFILE_OBJECT
+NTSTATUS
NTAPI
-IoCreateStreamFileObjectLite (
- IN PFILE_OBJECT FileObject OPTIONAL,
- IN PDEVICE_OBJECT DeviceObject OPTIONAL
-);
-
-#endif /* (VER_PRODUCTBUILD >= 2195) */
+FsRtlInsertPerStreamContext(
+ IN PFSRTL_ADVANCED_FCB_HEADER PerStreamContext,
+ IN PFSRTL_PER_STREAM_CONTEXT Ptr);
NTKERNELAPI
-BOOLEAN
+PFSRTL_PER_STREAM_CONTEXT
NTAPI
-IoFastQueryNetworkAttributes (
- IN POBJECT_ATTRIBUTES ObjectAttributes,
- IN ACCESS_MASK DesiredAccess,
- IN ULONG OpenOptions,
- OUT PIO_STATUS_BLOCK IoStatus,
- OUT PFILE_NETWORK_OPEN_INFORMATION Buffer
-);
+FsRtlLookupPerStreamContextInternal(
+ IN PFSRTL_ADVANCED_FCB_HEADER StreamContext,
+ IN PVOID OwnerId OPTIONAL,
+ IN PVOID InstanceId OPTIONAL);
NTKERNELAPI
-PDEVICE_OBJECT
+PFSRTL_PER_STREAM_CONTEXT
NTAPI
-IoGetAttachedDevice (
- IN PDEVICE_OBJECT DeviceObject
-);
+FsRtlRemovePerStreamContext(
+ IN PFSRTL_ADVANCED_FCB_HEADER StreamContext,
+ IN PVOID OwnerId OPTIONAL,
+ IN PVOID InstanceId OPTIONAL);
NTKERNELAPI
-PDEVICE_OBJECT
+VOID
NTAPI
-IoGetBaseFileSystemDeviceObject (
- IN PFILE_OBJECT FileObject
-);
-
-#if (VER_PRODUCTBUILD >= 2600)
+FsRtlIncrementCcFastReadNotPossible(
+ VOID);
NTKERNELAPI
-PDEVICE_OBJECT
+VOID
NTAPI
-IoGetDeviceAttachmentBaseRef (
- IN PDEVICE_OBJECT DeviceObject
-);
+FsRtlIncrementCcFastReadWait(
+ VOID);
NTKERNELAPI
-NTSTATUS
+VOID
NTAPI
-IoGetDiskDeviceObject (
- IN PDEVICE_OBJECT FileSystemDeviceObject,
- OUT PDEVICE_OBJECT *DiskDeviceObject
-);
+FsRtlIncrementCcFastReadNoWait(
+ VOID);
NTKERNELAPI
-PDEVICE_OBJECT
+VOID
NTAPI
-IoGetLowerDeviceObject (
- IN PDEVICE_OBJECT DeviceObject
-);
-
-#endif /* (VER_PRODUCTBUILD >= 2600) */
+FsRtlIncrementCcFastReadResourceMiss(
+ VOID);
NTKERNELAPI
-PEPROCESS
+LOGICAL
NTAPI
-IoGetRequestorProcess (
- IN PIRP Irp
-);
+FsRtlIsPagingFile(
+ IN PFILE_OBJECT FileObject);
-#if (VER_PRODUCTBUILD >= 2195)
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
+
+#if (NTDDI_VERSION >= NTDDI_WS03)
NTKERNELAPI
-ULONG
+VOID
NTAPI
-IoGetRequestorProcessId (
- IN PIRP Irp
-);
+FsRtlInitializeBaseMcb(
+ IN PBASE_MCB Mcb,
+ IN POOL_TYPE PoolType);
-#endif /* (VER_PRODUCTBUILD >= 2195) */
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlUninitializeBaseMcb(
+ IN PBASE_MCB Mcb);
NTKERNELAPI
-PIRP
+VOID
NTAPI
-IoGetTopLevelIrp (
- VOID
-);
+FsRtlResetBaseMcb(
+ IN PBASE_MCB Mcb);
-#define IoIsFileOpenedExclusively(FileObject) ( \
- (BOOLEAN) !( \
- (FileObject)->SharedRead || \
- (FileObject)->SharedWrite || \
- (FileObject)->SharedDelete \
- ) \
-)
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlTruncateBaseMcb(
+ IN PBASE_MCB Mcb,
+ IN LONGLONG Vbn);
NTKERNELAPI
BOOLEAN
NTAPI
-IoIsOperationSynchronous (
- IN PIRP Irp
-);
+FsRtlAddBaseMcbEntry(
+ IN PBASE_MCB Mcb,
+ IN LONGLONG Vbn,
+ IN LONGLONG Lbn,
+ IN LONGLONG SectorCount);
NTKERNELAPI
BOOLEAN
NTAPI
-IoIsSystemThread (
- IN PETHREAD Thread
-);
-
-#if (VER_PRODUCTBUILD >= 2195)
+FsRtlRemoveBaseMcbEntry(
+ IN PBASE_MCB Mcb,
+ IN LONGLONG Vbn,
+ IN LONGLONG SectorCount);
NTKERNELAPI
BOOLEAN
NTAPI
-IoIsValidNameGraftingBuffer (
- IN PIRP Irp,
- IN PREPARSE_DATA_BUFFER ReparseBuffer
-);
-
-#endif /* (VER_PRODUCTBUILD >= 2195) */
+FsRtlLookupBaseMcbEntry(
+ IN PBASE_MCB Mcb,
+ IN LONGLONG Vbn,
+ OUT PLONGLONG Lbn OPTIONAL,
+ OUT PLONGLONG SectorCountFromLbn OPTIONAL,
+ OUT PLONGLONG StartingLbn OPTIONAL,
+ OUT PLONGLONG SectorCountFromStartingLbn OPTIONAL,
+ OUT PULONG Index OPTIONAL);
NTKERNELAPI
-NTSTATUS
+BOOLEAN
NTAPI
-IoPageRead (
- IN PFILE_OBJECT FileObject,
- IN PMDL Mdl,
- IN PLARGE_INTEGER Offset,
- IN PKEVENT Event,
- OUT PIO_STATUS_BLOCK IoStatusBlock
-);
+FsRtlLookupLastBaseMcbEntry(
+ IN PBASE_MCB Mcb,
+ OUT PLONGLONG Vbn,
+ OUT PLONGLONG Lbn);
NTKERNELAPI
-NTSTATUS
+BOOLEAN
NTAPI
-IoQueryFileInformation (
- IN PFILE_OBJECT FileObject,
- IN FILE_INFORMATION_CLASS FileInformationClass,
- IN ULONG Length,
- OUT PVOID FileInformation,
- OUT PULONG ReturnedLength
-);
+FsRtlLookupLastBaseMcbEntryAndIndex(
+ IN PBASE_MCB OpaqueMcb,
+ IN OUT PLONGLONG LargeVbn,
+ IN OUT PLONGLONG LargeLbn,
+ IN OUT PULONG Index);
NTKERNELAPI
-NTSTATUS
+ULONG
NTAPI
-IoQueryVolumeInformation (
- IN PFILE_OBJECT FileObject,
- IN FS_INFORMATION_CLASS FsInformationClass,
- IN ULONG Length,
- OUT PVOID FsInformation,
- OUT PULONG ReturnedLength
-);
+FsRtlNumberOfRunsInBaseMcb(
+ IN PBASE_MCB Mcb);
NTKERNELAPI
-VOID
+BOOLEAN
NTAPI
-IoQueueThreadIrp(
- IN PIRP Irp
-);
+FsRtlGetNextBaseMcbEntry(
+ IN PBASE_MCB Mcb,
+ IN ULONG RunIndex,
+ OUT PLONGLONG Vbn,
+ OUT PLONGLONG Lbn,
+ OUT PLONGLONG SectorCount);
NTKERNELAPI
-VOID
+BOOLEAN
NTAPI
-IoRegisterFileSystem (
- IN OUT PDEVICE_OBJECT DeviceObject
-);
+FsRtlSplitBaseMcb(
+ IN PBASE_MCB Mcb,
+ IN LONGLONG Vbn,
+ IN LONGLONG Amount);
-#if (VER_PRODUCTBUILD >= 1381)
+#endif /* (NTDDI_VERSION >= NTDDI_WS03) */
-typedef VOID (NTAPI *PDRIVER_FS_NOTIFICATION) (
- IN PDEVICE_OBJECT DeviceObject,
- IN BOOLEAN DriverActive
-);
+#if (NTDDI_VERSION >= NTDDI_VISTA)
-NTKERNELAPI
-NTSTATUS
+BOOLEAN
NTAPI
-IoRegisterFsRegistrationChange (
- IN PDRIVER_OBJECT DriverObject,
- IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
-);
+FsRtlInitializeBaseMcbEx(
+ IN PBASE_MCB Mcb,
+ IN POOL_TYPE PoolType,
+ IN USHORT Flags);
-#endif /* (VER_PRODUCTBUILD >= 1381) */
+NTSTATUS
+NTAPI
+FsRtlAddBaseMcbEntryEx(
+ IN PBASE_MCB Mcb,
+ IN LONGLONG Vbn,
+ IN LONGLONG Lbn,
+ IN LONGLONG SectorCount);
NTKERNELAPI
-VOID
+BOOLEAN
NTAPI
-IoReleaseVpbSpinLock (
- IN KIRQL Irql
-);
+FsRtlCurrentOplock(
+ IN POPLOCK Oplock);
NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-IoSetDeviceToVerify (
- IN PETHREAD Thread,
- IN PDEVICE_OBJECT DeviceObject
-);
+FsRtlOplockBreakToNone(
+ IN OUT POPLOCK Oplock,
+ IN PIO_STACK_LOCATION IrpSp OPTIONAL,
+ IN PIRP Irp,
+ IN PVOID Context OPTIONAL,
+ IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
+ IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
NTKERNELAPI
NTSTATUS
NTAPI
-IoSetInformation (
- IN PFILE_OBJECT FileObject,
- IN FILE_INFORMATION_CLASS FileInformationClass,
- IN ULONG Length,
- IN PVOID FileInformation
-);
+FsRtlNotifyVolumeEventEx(
+ IN PFILE_OBJECT FileObject,
+ IN ULONG EventCode,
+ IN PTARGET_DEVICE_CUSTOM_NOTIFICATION Event);
NTKERNELAPI
VOID
NTAPI
-IoSetTopLevelIrp (
- IN PIRP Irp
-);
+FsRtlNotifyCleanupAll(
+ IN PNOTIFY_SYNC NotifySync,
+ IN PLIST_ENTRY NotifyList);
+
+NTSTATUS
+NTAPI
+FsRtlRegisterUncProviderEx(
+ OUT PHANDLE MupHandle,
+ IN PUNICODE_STRING RedirDevName,
+ IN PDEVICE_OBJECT DeviceObject,
+ IN ULONG Flags);
NTKERNELAPI
NTSTATUS
NTAPI
-IoSynchronousPageWrite (
- IN PFILE_OBJECT FileObject,
- IN PMDL Mdl,
- IN PLARGE_INTEGER FileOffset,
- IN PKEVENT Event,
- OUT PIO_STATUS_BLOCK IoStatusBlock
-);
+FsRtlCancellableWaitForSingleObject(
+ IN PVOID Object,
+ IN PLARGE_INTEGER Timeout OPTIONAL,
+ IN PIRP Irp OPTIONAL);
NTKERNELAPI
-PEPROCESS
+NTSTATUS
NTAPI
-IoThreadToProcess (
- IN PETHREAD Thread
-);
+FsRtlCancellableWaitForMultipleObjects(
+ IN ULONG Count,
+ IN PVOID ObjectArray[],
+ IN WAIT_TYPE WaitType,
+ IN PLARGE_INTEGER Timeout OPTIONAL,
+ IN PKWAIT_BLOCK WaitBlockArray OPTIONAL,
+ IN PIRP Irp OPTIONAL);
NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-IoUnregisterFileSystem (
- IN OUT PDEVICE_OBJECT DeviceObject
-);
+FsRtlMupGetProviderInfoFromFileObject(
+ IN PFILE_OBJECT pFileObject,
+ IN ULONG Level,
+ OUT PVOID pBuffer,
+ IN OUT PULONG pBufferSize);
-#if (VER_PRODUCTBUILD >= 1381)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlMupGetProviderIdFromName(
+ IN PUNICODE_STRING pProviderName,
+ OUT PULONG32 pProviderId);
NTKERNELAPI
VOID
NTAPI
-IoUnregisterFsRegistrationChange (
- IN PDRIVER_OBJECT DriverObject,
- IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
-);
-
-#endif /* (VER_PRODUCTBUILD >= 1381) */
+FsRtlIncrementCcFastMdlReadWait(
+ VOID);
NTKERNELAPI
NTSTATUS
NTAPI
-IoVerifyVolume (
- IN PDEVICE_OBJECT DeviceObject,
- IN BOOLEAN AllowRawMount
-);
+FsRtlValidateReparsePointBuffer(
+ IN ULONG BufferLength,
+ IN PREPARSE_DATA_BUFFER ReparseBuffer);
NTKERNELAPI
-KIRQL
-FASTCALL
-KeAcquireQueuedSpinLock (
- IN KSPIN_LOCK_QUEUE_NUMBER Number
-);
+NTSTATUS
+NTAPI
+FsRtlRemoveDotsFromPath(
+ IN OUT PWSTR OriginalString,
+ IN USHORT PathLength,
+ OUT USHORT *NewLength);
NTKERNELAPI
-VOID
-FASTCALL
-KeReleaseQueuedSpinLock (
- IN KSPIN_LOCK_QUEUE_NUMBER Number,
- IN KIRQL OldIrql
-);
+NTSTATUS
+NTAPI
+FsRtlAllocateExtraCreateParameterList(
+ IN FSRTL_ALLOCATE_ECPLIST_FLAGS Flags,
+ OUT PECP_LIST *EcpList);
NTKERNELAPI
-LOGICAL
-KeTryToAcquireQueuedSpinLock(
- KSPIN_LOCK_QUEUE_NUMBER Number,
- PKIRQL OldIrql);
+VOID
+NTAPI
+FsRtlFreeExtraCreateParameterList(
+ IN PECP_LIST EcpList);
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-MmCanFileBeTruncated (
- IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
- IN PLARGE_INTEGER NewFileSize
-);
+FsRtlAllocateExtraCreateParameter(
+ IN LPCGUID EcpType,
+ IN ULONG SizeOfContext,
+ IN FSRTL_ALLOCATE_ECP_FLAGS Flags,
+ IN PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback OPTIONAL,
+ IN ULONG PoolTag,
+ OUT PVOID *EcpContext);
NTKERNELAPI
-BOOLEAN
+VOID
NTAPI
-MmFlushImageSection (
- IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
- IN MMFLUSH_TYPE FlushType
-);
+FsRtlFreeExtraCreateParameter(
+ IN PVOID EcpContext);
NTKERNELAPI
-BOOLEAN
+VOID
NTAPI
-MmForceSectionClosed (
- IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
- IN BOOLEAN DelayClose
-);
+FsRtlInitExtraCreateParameterLookasideList(
+ IN OUT PVOID Lookaside,
+ IN FSRTL_ECP_LOOKASIDE_FLAGS Flags,
+ IN SIZE_T Size,
+ IN ULONG Tag);
-#if (VER_PRODUCTBUILD >= 1381)
+VOID
+NTAPI
+FsRtlDeleteExtraCreateParameterLookasideList(
+ IN OUT PVOID Lookaside,
+ IN FSRTL_ECP_LOOKASIDE_FLAGS Flags);
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-MmIsRecursiveIoFault (
- VOID
-);
-
-#else
-
-#define MmIsRecursiveIoFault() ( \
- (PsGetCurrentThread()->DisablePageFaultClustering) | \
- (PsGetCurrentThread()->ForwardClusterOnly) \
-)
-
-#endif
-
+FsRtlAllocateExtraCreateParameterFromLookasideList(
+ IN LPCGUID EcpType,
+ IN ULONG SizeOfContext,
+ IN FSRTL_ALLOCATE_ECP_FLAGS Flags,
+ IN PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback OPTIONAL,
+ IN OUT PVOID LookasideList,
+ OUT PVOID *EcpContext);
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-MmSetAddressRangeModified (
- IN PVOID Address,
- IN SIZE_T Length
-);
+FsRtlInsertExtraCreateParameter(
+ IN OUT PECP_LIST EcpList,
+ IN OUT PVOID EcpContext);
NTKERNELAPI
NTSTATUS
NTAPI
-ObCreateObject (
- IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL,
- IN POBJECT_TYPE ObjectType,
- IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
- IN KPROCESSOR_MODE AccessMode,
- IN OUT PVOID ParseContext OPTIONAL,
- IN ULONG ObjectSize,
- IN ULONG PagedPoolCharge OPTIONAL,
- IN ULONG NonPagedPoolCharge OPTIONAL,
- OUT PVOID *Object
-);
+FsRtlFindExtraCreateParameter(
+ IN PECP_LIST EcpList,
+ IN LPCGUID EcpType,
+ OUT PVOID *EcpContext OPTIONAL,
+ OUT ULONG *EcpContextSize OPTIONAL);
NTKERNELAPI
-ULONG
+NTSTATUS
NTAPI
-ObGetObjectPointerCount (
- IN PVOID Object
-);
+FsRtlRemoveExtraCreateParameter(
+ IN OUT PECP_LIST EcpList,
+ IN LPCGUID EcpType,
+ OUT PVOID *EcpContext,
+ OUT ULONG *EcpContextSize OPTIONAL);
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlGetEcpListFromIrp(
+ IN PIRP Irp,
+ OUT PECP_LIST *EcpList OPTIONAL);
NTKERNELAPI
NTSTATUS
NTAPI
-ObInsertObject (
- IN PVOID Object,
- IN PACCESS_STATE PassedAccessState OPTIONAL,
- IN ACCESS_MASK DesiredAccess OPTIONAL,
- IN ULONG ObjectPointerBias,
- OUT PVOID *NewObject OPTIONAL,
- OUT PHANDLE Handle OPTIONAL);
+FsRtlSetEcpListIntoIrp(
+ IN OUT PIRP Irp,
+ IN PECP_LIST EcpList);
NTKERNELAPI
NTSTATUS
NTAPI
-ObOpenObjectByPointer (
- IN PVOID Object,
- IN ULONG HandleAttributes,
- IN PACCESS_STATE PassedAccessState OPTIONAL,
- IN ACCESS_MASK DesiredAccess OPTIONAL,
- IN POBJECT_TYPE ObjectType OPTIONAL,
- IN KPROCESSOR_MODE AccessMode,
- OUT PHANDLE Handle);
+FsRtlGetNextExtraCreateParameter(
+ IN PECP_LIST EcpList,
+ IN PVOID CurrentEcpContext OPTIONAL,
+ OUT LPGUID NextEcpType OPTIONAL,
+ OUT PVOID *NextEcpContext OPTIONAL,
+ OUT ULONG *NextEcpContextSize OPTIONAL);
NTKERNELAPI
VOID
NTAPI
-ObMakeTemporaryObject (
- IN PVOID Object);
+FsRtlAcknowledgeEcp(
+ IN PVOID EcpContext);
NTKERNELAPI
-NTSTATUS
+BOOLEAN
NTAPI
-ObQueryObjectAuditingByHandle (
- IN HANDLE Handle,
- OUT PBOOLEAN GenerateOnClose);
+FsRtlIsEcpAcknowledged(
+ IN PVOID EcpContext);
-#endif
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlIsEcpFromUserMode(
+ IN PVOID EcpContext);
NTKERNELAPI
NTSTATUS
NTAPI
-ObQueryNameString (
- IN PVOID Object,
- OUT POBJECT_NAME_INFORMATION ObjectNameInfo,
- IN ULONG Length,
- OUT PULONG ReturnLength
-);
+FsRtlChangeBackingFileObject(
+ IN PFILE_OBJECT CurrentFileObject OPTIONAL,
+ IN PFILE_OBJECT NewFileObject,
+ IN FSRTL_CHANGE_BACKING_TYPE ChangeBackingType,
+ IN ULONG Flags);
NTKERNELAPI
NTSTATUS
NTAPI
-ObReferenceObjectByName (
- IN PUNICODE_STRING ObjectName,
- IN ULONG Attributes,
- IN PACCESS_STATE PassedAccessState OPTIONAL,
- IN ACCESS_MASK DesiredAccess OPTIONAL,
- IN POBJECT_TYPE ObjectType,
- IN KPROCESSOR_MODE AccessMode,
- IN OUT PVOID ParseContext OPTIONAL,
- OUT PVOID *Object
-);
+FsRtlLogCcFlushError(
+ IN PUNICODE_STRING FileName,
+ IN PDEVICE_OBJECT DeviceObject,
+ IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+ IN NTSTATUS FlushError,
+ IN ULONG Flags);
NTKERNELAPI
-NTSTATUS
+BOOLEAN
NTAPI
-PsAssignImpersonationToken (
- IN PETHREAD Thread,
- IN HANDLE Token
-);
+FsRtlAreVolumeStartupApplicationsComplete(
+ VOID);
NTKERNELAPI
-VOID
+ULONG
NTAPI
-PsChargePoolQuota (
- IN PEPROCESS Process,
- IN POOL_TYPE PoolType,
- IN SIZE_T Amount
-);
+FsRtlQueryMaximumVirtualDiskNestingLevel(
+ VOID);
NTKERNELAPI
NTSTATUS
NTAPI
-PsChargeProcessPoolQuota (
- IN PEPROCESS Process,
- IN POOL_TYPE PoolType,
- IN SIZE_T Amount
-);
+FsRtlGetVirtualDiskNestingLevel(
+ IN PDEVICE_OBJECT DeviceObject,
+ OUT PULONG NestingLevel,
+ OUT PULONG NestingFlags OPTIONAL);
-#define PsDereferenceImpersonationToken(T) \
- {if (ARGUMENT_PRESENT(T)) { \
- (ObDereferenceObject((T))); \
- } else { \
- ; \
- } \
-}
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+
+#if (NTDDI_VERSION >= NTDDI_VISTASP1)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlCheckOplockEx(
+ IN POPLOCK Oplock,
+ IN PIRP Irp,
+ IN ULONG Flags,
+ IN PVOID Context OPTIONAL,
+ IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
+ IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
+
+#endif
-#define PsDereferencePrimaryToken(T) (ObDereferenceObject((T)))
+#if (NTDDI_VERSION >= NTDDI_WIN7)
NTKERNELAPI
BOOLEAN
NTAPI
-PsDisableImpersonation(
- IN PETHREAD Thread,
- IN PSE_IMPERSONATION_STATE ImpersonationState
-);
+FsRtlAreThereCurrentOrInProgressFileLocks(
+ IN PFILE_LOCK FileLock);
NTKERNELAPI
-LARGE_INTEGER
+BOOLEAN
NTAPI
-PsGetProcessExitTime (
- VOID
-);
+FsRtlOplockIsSharedRequest(
+ IN PIRP Irp);
NTKERNELAPI
NTSTATUS
NTAPI
-PsImpersonateClient(
- IN PETHREAD Thread,
- IN PACCESS_TOKEN Token,
- IN BOOLEAN CopyOnOpen,
- IN BOOLEAN EffectiveOnly,
- IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel
-);
+FsRtlOplockBreakH(
+ IN POPLOCK Oplock,
+ IN PIRP Irp,
+ IN ULONG Flags,
+ IN PVOID Context OPTIONAL,
+ IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
+ IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
NTKERNELAPI
BOOLEAN
NTAPI
-PsIsSystemThread(
- IN PETHREAD Thread
-);
+FsRtlCurrentOplockH(
+ IN POPLOCK Oplock);
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-PsIsThreadTerminating (
- IN PETHREAD Thread
-);
+FsRtlOplockBreakToNoneEx(
+ IN OUT POPLOCK Oplock,
+ IN PIRP Irp,
+ IN ULONG Flags,
+ IN PVOID Context OPTIONAL,
+ IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
+ IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
NTKERNELAPI
NTSTATUS
NTAPI
-PsLookupProcessByProcessId (
- IN HANDLE ProcessId,
- OUT PEPROCESS *Process
-);
+FsRtlOplockFsctrlEx(
+ IN POPLOCK Oplock,
+ IN PIRP Irp,
+ IN ULONG OpenCount,
+ IN ULONG Flags);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlOplockKeysEqual(
+ IN PFILE_OBJECT Fo1 OPTIONAL,
+ IN PFILE_OBJECT Fo2 OPTIONAL);
NTKERNELAPI
NTSTATUS
NTAPI
-PsLookupProcessThreadByCid (
- IN PCLIENT_ID Cid,
- OUT PEPROCESS *Process OPTIONAL,
- OUT PETHREAD *Thread
-);
+FsRtlInitializeExtraCreateParameterList(
+ IN OUT PECP_LIST EcpList);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlInitializeExtraCreateParameter(
+ IN PECP_HEADER Ecp,
+ IN ULONG EcpFlags,
+ IN PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback OPTIONAL,
+ IN ULONG TotalSize,
+ IN LPCGUID EcpType,
+ IN PVOID ListAllocatedFrom OPTIONAL);
+
+#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
NTKERNELAPI
NTSTATUS
NTAPI
-PsLookupThreadByThreadId (
- IN HANDLE UniqueThreadId,
- OUT PETHREAD *Thread
-);
+FsRtlInsertPerFileContext(
+ IN PVOID* PerFileContextPointer,
+ IN PFSRTL_PER_FILE_CONTEXT Ptr);
NTKERNELAPI
-PACCESS_TOKEN
+PFSRTL_PER_FILE_CONTEXT
NTAPI
-PsReferenceImpersonationToken (
- IN PETHREAD Thread,
- OUT PBOOLEAN CopyOnUse,
- OUT PBOOLEAN EffectiveOnly,
- OUT PSECURITY_IMPERSONATION_LEVEL Level
-);
+FsRtlLookupPerFileContext(
+ IN PVOID* PerFileContextPointer,
+ IN PVOID OwnerId OPTIONAL,
+ IN PVOID InstanceId OPTIONAL);
NTKERNELAPI
-HANDLE
+PFSRTL_PER_FILE_CONTEXT
NTAPI
-PsReferencePrimaryToken (
- IN PEPROCESS Process
-);
+FsRtlRemovePerFileContext(
+ IN PVOID* PerFileContextPointer,
+ IN PVOID OwnerId OPTIONAL,
+ IN PVOID InstanceId OPTIONAL);
NTKERNELAPI
VOID
NTAPI
-PsRestoreImpersonation(
- IN PETHREAD Thread,
- IN PSE_IMPERSONATION_STATE ImpersonationState
-);
+FsRtlTeardownPerFileContexts(
+ IN PVOID* PerFileContextPointer);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlInsertPerFileObjectContext(
+ IN PFILE_OBJECT FileObject,
+ IN PFSRTL_PER_FILEOBJECT_CONTEXT Ptr);
+
+NTKERNELAPI
+PFSRTL_PER_FILEOBJECT_CONTEXT
+NTAPI
+FsRtlLookupPerFileObjectContext(
+ IN PFILE_OBJECT FileObject,
+ IN PVOID OwnerId OPTIONAL,
+ IN PVOID InstanceId OPTIONAL);
NTKERNELAPI
+PFSRTL_PER_FILEOBJECT_CONTEXT
+NTAPI
+FsRtlRemovePerFileObjectContext(
+ IN PFILE_OBJECT FileObject,
+ IN PVOID OwnerId OPTIONAL,
+ IN PVOID InstanceId OPTIONAL);
+
+#define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) ( \
+ FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11) \
+)
+
+#define FsRtlAreThereCurrentFileLocks(FL) ( \
+ ((FL)->FastIoIsQuestionable) \
+)
+
+#define FsRtlIncrementLockRequestsInProgress(FL) { \
+ ASSERT( (FL)->LockRequestsInProgress >= 0 ); \
+ (void) \
+ (InterlockedIncrement((LONG volatile *)&((FL)->LockRequestsInProgress)));\
+}
+
+#define FsRtlDecrementLockRequestsInProgress(FL) { \
+ ASSERT( (FL)->LockRequestsInProgress > 0 ); \
+ (void) \
+ (InterlockedDecrement((LONG volatile *)&((FL)->LockRequestsInProgress)));\
+}
+
+#ifdef NLS_MB_CODE_PAGE_TAG
+#undef NLS_MB_CODE_PAGE_TAG
+#endif
+
+#define LEGAL_ANSI_CHARACTER_ARRAY FsRtlLegalAnsiCharacterArray
+#define NLS_MB_CODE_PAGE_TAG NlsMbOemCodePageTag
+#define NLS_OEM_LEAD_BYTE_INFO NlsOemLeadByteInfo
+
+extern UCHAR const* const LEGAL_ANSI_CHARACTER_ARRAY;
+extern PUSHORT NLS_OEM_LEAD_BYTE_INFO;
+
+#define FsRtlIsAnsiCharacterWild(C) ( \
+ FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], FSRTL_WILD_CHARACTER ) \
+)
+
+#define FsRtlIsAnsiCharacterLegalFat(C, WILD) ( \
+ FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_FAT_LEGAL) | \
+ ((WILD) ? FSRTL_WILD_CHARACTER : 0 )) \
+)
+
+#define FsRtlIsAnsiCharacterLegalHpfs(C, WILD) ( \
+ FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_HPFS_LEGAL) | \
+ ((WILD) ? FSRTL_WILD_CHARACTER : 0 )) \
+)
+
+#define FsRtlIsAnsiCharacterLegalNtfs(C, WILD) ( \
+ FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_NTFS_LEGAL) | \
+ ((WILD) ? FSRTL_WILD_CHARACTER : 0 )) \
+)
+
+#define FsRtlIsAnsiCharacterLegalNtfsStream(C,WILD_OK) ( \
+ FsRtlTestAnsiCharacter((C), TRUE, (WILD_OK), FSRTL_NTFS_STREAM_LEGAL) \
+)
+
+#define FsRtlIsAnsiCharacterLegal(C,FLAGS) ( \
+ FsRtlTestAnsiCharacter((C), TRUE, FALSE, (FLAGS)) \
+)
+
+#define FsRtlTestAnsiCharacter(C, DEFAULT_RET, WILD_OK, FLAGS) ( \
+ ((SCHAR)(C) < 0) ? DEFAULT_RET : \
+ FlagOn( LEGAL_ANSI_CHARACTER_ARRAY[(C)], \
+ (FLAGS) | \
+ ((WILD_OK) ? FSRTL_WILD_CHARACTER : 0) ) \
+)
+
+#define FsRtlIsLeadDbcsCharacter(DBCS_CHAR) ( \
+ (BOOLEAN)((UCHAR)(DBCS_CHAR) < 0x80 ? FALSE : \
+ (NLS_MB_CODE_PAGE_TAG && \
+ (NLS_OEM_LEAD_BYTE_INFO[(UCHAR)(DBCS_CHAR)] != 0))) \
+)
+
+#define FsRtlIsUnicodeCharacterWild(C) ( \
+ (((C) >= 0x40) ? \
+ FALSE : \
+ FlagOn(FsRtlLegalAnsiCharacterArray[(C)], FSRTL_WILD_CHARACTER )) \
+)
+
+#define FsRtlInitPerFileContext( _fc, _owner, _inst, _cb) \
+ ((_fc)->OwnerId = (_owner), \
+ (_fc)->InstanceId = (_inst), \
+ (_fc)->FreeCallback = (_cb))
+
+#define FsRtlGetPerFileContextPointer(_fo) \
+ (FsRtlSupportsPerFileContexts(_fo) ? \
+ FsRtlGetPerStreamContextPointer(_fo)->FileContextSupportPointer : \
+ NULL)
+
+#define FsRtlSupportsPerFileContexts(_fo) \
+ ((FsRtlGetPerStreamContextPointer(_fo) != NULL) && \
+ (FsRtlGetPerStreamContextPointer(_fo)->Version >= FSRTL_FCB_HEADER_V1) && \
+ (FsRtlGetPerStreamContextPointer(_fo)->FileContextSupportPointer != NULL))
+
+#define FsRtlSetupAdvancedHeaderEx( _advhdr, _fmutx, _fctxptr ) \
+{ \
+ FsRtlSetupAdvancedHeader( _advhdr, _fmutx ); \
+ if ((_fctxptr) != NULL) { \
+ (_advhdr)->FileContextSupportPointer = (_fctxptr); \
+ } \
+}
+
+#define FsRtlGetPerStreamContextPointer(FO) ( \
+ (PFSRTL_ADVANCED_FCB_HEADER)(FO)->FsContext \
+)
+
+#define FsRtlInitPerStreamContext(PSC, O, I, FC) ( \
+ (PSC)->OwnerId = (O), \
+ (PSC)->InstanceId = (I), \
+ (PSC)->FreeCallback = (FC) \
+)
+
+#define FsRtlSupportsPerStreamContexts(FO) ( \
+ (BOOLEAN)((NULL != FsRtlGetPerStreamContextPointer(FO) && \
+ FlagOn(FsRtlGetPerStreamContextPointer(FO)->Flags2, \
+ FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS)) \
+)
+
+#define FsRtlLookupPerStreamContext(_sc, _oid, _iid) \
+ (((NULL != (_sc)) && \
+ FlagOn((_sc)->Flags2,FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS) && \
+ !IsListEmpty(&(_sc)->FilterContexts)) ? \
+ FsRtlLookupPerStreamContextInternal((_sc), (_oid), (_iid)) : \
+ NULL)
+
VOID
+FORCEINLINE
NTAPI
-PsReturnPoolQuota (
- IN PEPROCESS Process,
- IN POOL_TYPE PoolType,
- IN SIZE_T Amount
+FsRtlSetupAdvancedHeader(
+ IN PVOID AdvHdr,
+ IN PFAST_MUTEX FMutex )
+{
+ PFSRTL_ADVANCED_FCB_HEADER localAdvHdr = (PFSRTL_ADVANCED_FCB_HEADER)AdvHdr;
+
+ localAdvHdr->Flags |= FSRTL_FLAG_ADVANCED_HEADER;
+ localAdvHdr->Flags2 |= FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS;
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+ localAdvHdr->Version = FSRTL_FCB_HEADER_V1;
+#else
+ localAdvHdr->Version = FSRTL_FCB_HEADER_V0;
+#endif
+ InitializeListHead( &localAdvHdr->FilterContexts );
+ if (FMutex != NULL) {
+ localAdvHdr->FastMutex = FMutex;
+ }
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+ *((PULONG_PTR)(&localAdvHdr->PushLock)) = 0;
+ localAdvHdr->FileContextSupportPointer = NULL;
+#endif
+}
+
+#define FsRtlInitPerFileObjectContext(_fc, _owner, _inst) \
+ ((_fc)->OwnerId = (_owner), (_fc)->InstanceId = (_inst))
+
+#define FsRtlCompleteRequest(IRP,STATUS) { \
+ (IRP)->IoStatus.Status = (STATUS); \
+ IoCompleteRequest( (IRP), IO_DISK_INCREMENT ); \
+}
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+typedef struct _ECP_HEADER ECP_HEADER, *PECP_HEADER;
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+
+typedef enum _NETWORK_OPEN_LOCATION_QUALIFIER {
+ NetworkOpenLocationAny,
+ NetworkOpenLocationRemote,
+ NetworkOpenLocationLoopback
+} NETWORK_OPEN_LOCATION_QUALIFIER;
+
+typedef enum _NETWORK_OPEN_INTEGRITY_QUALIFIER {
+ NetworkOpenIntegrityAny,
+ NetworkOpenIntegrityNone,
+ NetworkOpenIntegritySigned,
+ NetworkOpenIntegrityEncrypted,
+ NetworkOpenIntegrityMaximum
+} NETWORK_OPEN_INTEGRITY_QUALIFIER;
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+
+#define NETWORK_OPEN_ECP_IN_FLAG_DISABLE_HANDLE_COLLAPSING 0x1
+#define NETWORK_OPEN_ECP_IN_FLAG_DISABLE_HANDLE_DURABILITY 0x2
+#define NETWORK_OPEN_ECP_IN_FLAG_FORCE_BUFFERED_SYNCHRONOUS_IO_HACK 0x80000000
+
+typedef struct _NETWORK_OPEN_ECP_CONTEXT {
+ USHORT Size;
+ USHORT Reserved;
+ struct {
+ struct {
+ NETWORK_OPEN_LOCATION_QUALIFIER Location;
+ NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
+ ULONG Flags;
+ } in;
+ struct {
+ NETWORK_OPEN_LOCATION_QUALIFIER Location;
+ NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
+ ULONG Flags;
+ } out;
+ } DUMMYSTRUCTNAME;
+} NETWORK_OPEN_ECP_CONTEXT, *PNETWORK_OPEN_ECP_CONTEXT;
+
+typedef struct _NETWORK_OPEN_ECP_CONTEXT_V0 {
+ USHORT Size;
+ USHORT Reserved;
+ struct {
+ struct {
+ NETWORK_OPEN_LOCATION_QUALIFIER Location;
+ NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
+ } in;
+ struct {
+ NETWORK_OPEN_LOCATION_QUALIFIER Location;
+ NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
+ } out;
+ } DUMMYSTRUCTNAME;
+} NETWORK_OPEN_ECP_CONTEXT_V0, *PNETWORK_OPEN_ECP_CONTEXT_V0;
+
+#elif (NTDDI_VERSION >= NTDDI_VISTA)
+typedef struct _NETWORK_OPEN_ECP_CONTEXT {
+ USHORT Size;
+ USHORT Reserved;
+ struct {
+ struct {
+ NETWORK_OPEN_LOCATION_QUALIFIER Location;
+ NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
+ } in;
+ struct {
+ NETWORK_OPEN_LOCATION_QUALIFIER Location;
+ NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
+ } out;
+ } DUMMYSTRUCTNAME;
+} NETWORK_OPEN_ECP_CONTEXT, *PNETWORK_OPEN_ECP_CONTEXT;
+#endif
+
+DEFINE_GUID(GUID_ECP_NETWORK_OPEN_CONTEXT, 0xc584edbf, 0x00df, 0x4d28, 0xb8, 0x84, 0x35, 0xba, 0xca, 0x89, 0x11, 0xe8 );
+
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+
+typedef struct _PREFETCH_OPEN_ECP_CONTEXT {
+ PVOID Context;
+} PREFETCH_OPEN_ECP_CONTEXT, *PPREFETCH_OPEN_ECP_CONTEXT;
+
+DEFINE_GUID(GUID_ECP_PREFETCH_OPEN, 0xe1777b21, 0x847e, 0x4837, 0xaa, 0x45, 0x64, 0x16, 0x1d, 0x28, 0x6, 0x55 );
+
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+
+DEFINE_GUID (GUID_ECP_NFS_OPEN, 0xf326d30c, 0xe5f8, 0x4fe7, 0xab, 0x74, 0xf5, 0xa3, 0x19, 0x6d, 0x92, 0xdb);
+DEFINE_GUID(GUID_ECP_SRV_OPEN, 0xbebfaebc, 0xaabf, 0x489d, 0x9d, 0x2c, 0xe9, 0xe3, 0x61, 0x10, 0x28, 0x53 );
+
+typedef struct sockaddr_storage *PSOCKADDR_STORAGE_NFS;
+
+typedef struct _NFS_OPEN_ECP_CONTEXT {
+ PUNICODE_STRING ExportAlias;
+ PSOCKADDR_STORAGE_NFS ClientSocketAddress;
+} NFS_OPEN_ECP_CONTEXT, *PNFS_OPEN_ECP_CONTEXT, **PPNFS_OPEN_ECP_CONTEXT;
+
+typedef struct _SRV_OPEN_ECP_CONTEXT {
+ PUNICODE_STRING ShareName;
+ PSOCKADDR_STORAGE_NFS SocketAddress;
+ BOOLEAN OplockBlockState;
+ BOOLEAN OplockAppState;
+ BOOLEAN OplockFinalState;
+} SRV_OPEN_ECP_CONTEXT, *PSRV_OPEN_ECP_CONTEXT;
+
+#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
+
+#define VACB_MAPPING_GRANULARITY (0x40000)
+#define VACB_OFFSET_SHIFT (18)
+
+typedef struct _PUBLIC_BCB {
+ CSHORT NodeTypeCode;
+ CSHORT NodeByteSize;
+ ULONG MappedLength;
+ LARGE_INTEGER MappedFileOffset;
+} PUBLIC_BCB, *PPUBLIC_BCB;
+
+typedef struct _CC_FILE_SIZES {
+ LARGE_INTEGER AllocationSize;
+ LARGE_INTEGER FileSize;
+ LARGE_INTEGER ValidDataLength;
+} CC_FILE_SIZES, *PCC_FILE_SIZES;
+
+typedef BOOLEAN
+(NTAPI *PACQUIRE_FOR_LAZY_WRITE) (
+ IN PVOID Context,
+ IN BOOLEAN Wait);
+
+typedef VOID
+(NTAPI *PRELEASE_FROM_LAZY_WRITE) (
+ IN PVOID Context);
+
+typedef BOOLEAN
+(NTAPI *PACQUIRE_FOR_READ_AHEAD) (
+ IN PVOID Context,
+ IN BOOLEAN Wait);
+
+typedef VOID
+(NTAPI *PRELEASE_FROM_READ_AHEAD) (
+ IN PVOID Context);
+
+typedef struct _CACHE_MANAGER_CALLBACKS {
+ PACQUIRE_FOR_LAZY_WRITE AcquireForLazyWrite;
+ PRELEASE_FROM_LAZY_WRITE ReleaseFromLazyWrite;
+ PACQUIRE_FOR_READ_AHEAD AcquireForReadAhead;
+ PRELEASE_FROM_READ_AHEAD ReleaseFromReadAhead;
+} CACHE_MANAGER_CALLBACKS, *PCACHE_MANAGER_CALLBACKS;
+
+typedef struct _CACHE_UNINITIALIZE_EVENT {
+ struct _CACHE_UNINITIALIZE_EVENT *Next;
+ KEVENT Event;
+} CACHE_UNINITIALIZE_EVENT, *PCACHE_UNINITIALIZE_EVENT;
+
+typedef VOID
+(NTAPI *PDIRTY_PAGE_ROUTINE) (
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length,
+ IN PLARGE_INTEGER OldestLsn,
+ IN PLARGE_INTEGER NewestLsn,
+ IN PVOID Context1,
+ IN PVOID Context2);
+
+typedef VOID
+(NTAPI *PFLUSH_TO_LSN) (
+ IN PVOID LogHandle,
+ IN LARGE_INTEGER Lsn);
+
+typedef VOID
+(NTAPI *PCC_POST_DEFERRED_WRITE) (
+ IN PVOID Context1,
+ IN PVOID Context2);
+
+#define CcIsFileCached(FO) ( \
+ ((FO)->SectionObjectPointer != NULL) && \
+ (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
+)
+
+extern ULONG CcFastMdlReadWait;
+
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
+NTKERNELAPI
+VOID
+NTAPI
+CcInitializeCacheMap(
+ IN PFILE_OBJECT FileObject,
+ IN PCC_FILE_SIZES FileSizes,
+ IN BOOLEAN PinAccess,
+ IN PCACHE_MANAGER_CALLBACKS Callbacks,
+ IN PVOID LazyWriteContext);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcUninitializeCacheMap(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER TruncateSize OPTIONAL,
+ IN PCACHE_UNINITIALIZE_EVENT UninitializeCompleteEvent OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetFileSizes(
+ IN PFILE_OBJECT FileObject,
+ IN PCC_FILE_SIZES FileSizes);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetDirtyPageThreshold(
+ IN PFILE_OBJECT FileObject,
+ IN ULONG DirtyPageThreshold);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcFlushCache(
+ IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+ IN PLARGE_INTEGER FileOffset OPTIONAL,
+ IN ULONG Length,
+ OUT PIO_STATUS_BLOCK IoStatus OPTIONAL);
+
+NTKERNELAPI
+LARGE_INTEGER
+NTAPI
+CcGetFlushedValidData(
+ IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+ IN BOOLEAN BcbListHeld);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcZeroData(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER StartOffset,
+ IN PLARGE_INTEGER EndOffset,
+ IN BOOLEAN Wait);
+
+NTKERNELAPI
+PVOID
+NTAPI
+CcRemapBcb(
+ IN PVOID Bcb);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcRepinBcb(
+ IN PVOID Bcb);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcUnpinRepinnedBcb(
+ IN PVOID Bcb,
+ IN BOOLEAN WriteThrough,
+ OUT PIO_STATUS_BLOCK IoStatus);
+
+NTKERNELAPI
+PFILE_OBJECT
+NTAPI
+CcGetFileObjectFromSectionPtrs(
+ IN PSECTION_OBJECT_POINTERS SectionObjectPointer);
+
+NTKERNELAPI
+PFILE_OBJECT
+NTAPI
+CcGetFileObjectFromBcb(
+ IN PVOID Bcb);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcCanIWrite(
+ IN PFILE_OBJECT FileObject,
+ IN ULONG BytesToWrite,
+ IN BOOLEAN Wait,
+ IN BOOLEAN Retrying);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcDeferWrite(
+ IN PFILE_OBJECT FileObject,
+ IN PCC_POST_DEFERRED_WRITE PostRoutine,
+ IN PVOID Context1,
+ IN PVOID Context2,
+ IN ULONG BytesToWrite,
+ IN BOOLEAN Retrying);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcCopyRead(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length,
+ IN BOOLEAN Wait,
+ OUT PVOID Buffer,
+ OUT PIO_STATUS_BLOCK IoStatus);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcFastCopyRead(
+ IN PFILE_OBJECT FileObject,
+ IN ULONG FileOffset,
+ IN ULONG Length,
+ IN ULONG PageCount,
+ OUT PVOID Buffer,
+ OUT PIO_STATUS_BLOCK IoStatus);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcCopyWrite(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length,
+ IN BOOLEAN Wait,
+ IN PVOID Buffer);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcFastCopyWrite(
+ IN PFILE_OBJECT FileObject,
+ IN ULONG FileOffset,
+ IN ULONG Length,
+ IN PVOID Buffer);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcMdlRead(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length,
+ OUT PMDL *MdlChain,
+ OUT PIO_STATUS_BLOCK IoStatus);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcMdlReadComplete(
+ IN PFILE_OBJECT FileObject,
+ IN PMDL MdlChain);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcPrepareMdlWrite(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length,
+ OUT PMDL *MdlChain,
+ OUT PIO_STATUS_BLOCK IoStatus);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcMdlWriteComplete(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN PMDL MdlChain);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcScheduleReadAhead(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+CcWaitForCurrentLazyWriterActivity(
+ VOID);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetReadAheadGranularity(
+ IN PFILE_OBJECT FileObject,
+ IN ULONG Granularity);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcPinRead(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length,
+ IN ULONG Flags,
+ OUT PVOID *Bcb,
+ OUT PVOID *Buffer);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcPinMappedData(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length,
+ IN ULONG Flags,
+ IN OUT PVOID *Bcb);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcPreparePinWrite(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length,
+ IN BOOLEAN Zero,
+ IN ULONG Flags,
+ OUT PVOID *Bcb,
+ OUT PVOID *Buffer);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetDirtyPinnedData(
+ IN PVOID BcbVoid,
+ IN PLARGE_INTEGER Lsn OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcUnpinData(
+ IN PVOID Bcb);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetBcbOwnerPointer(
+ IN PVOID Bcb,
+ IN PVOID OwnerPointer);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcUnpinDataForThread(
+ IN PVOID Bcb,
+ IN ERESOURCE_THREAD ResourceThreadId);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetAdditionalCacheAttributes(
+ IN PFILE_OBJECT FileObject,
+ IN BOOLEAN DisableReadAhead,
+ IN BOOLEAN DisableWriteBehind);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcIsThereDirtyData(
+ IN PVPB Vpb);
+
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+
+NTKERNELAPI
+VOID
+NTAPI
+CcMdlWriteAbort(
+ IN PFILE_OBJECT FileObject,
+ IN PMDL MdlChain);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetLogHandleForFile(
+ IN PFILE_OBJECT FileObject,
+ IN PVOID LogHandle,
+ IN PFLUSH_TO_LSN FlushToLsnRoutine);
+
+NTKERNELAPI
+LARGE_INTEGER
+NTAPI
+CcGetDirtyPages(
+ IN PVOID LogHandle,
+ IN PDIRTY_PAGE_ROUTINE DirtyPageRoutine,
+ IN PVOID Context1,
+ IN PVOID Context2);
+
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcMapData(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length,
+ IN ULONG Flags,
+ OUT PVOID *Bcb,
+ OUT PVOID *Buffer);
+#elif (NTDDI_VERSION >= NTDDI_WIN2K)
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcMapData(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length,
+ IN BOOLEAN Wait,
+ OUT PVOID *Bcb,
+ OUT PVOID *Buffer);
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+CcSetFileSizesEx(
+ IN PFILE_OBJECT FileObject,
+ IN PCC_FILE_SIZES FileSizes);
+
+NTKERNELAPI
+PFILE_OBJECT
+NTAPI
+CcGetFileObjectFromSectionPtrsRef(
+ IN PSECTION_OBJECT_POINTERS SectionObjectPointer);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetParallelFlushFile(
+ IN PFILE_OBJECT FileObject,
+ IN BOOLEAN EnableParallelFlush);
+
+NTKERNELAPI
+BOOLEAN
+CcIsThereDirtyDataEx(
+ IN PVPB Vpb,
+ IN PULONG NumberOfDirtyPages OPTIONAL);
+
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+NTKERNELAPI
+VOID
+NTAPI
+CcCoherencyFlushAndPurgeCache(
+ IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+ IN PLARGE_INTEGER FileOffset OPTIONAL,
+ IN ULONG Length,
+ OUT PIO_STATUS_BLOCK IoStatus,
+ IN ULONG Flags OPTIONAL);
+#endif
+
+#define CcGetFileSizePointer(FO) ( \
+ ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
+)
+
+#define UNINITIALIZE_CACHE_MAPS (1)
+#define DO_NOT_RETRY_PURGE (2)
+#define DO_NOT_PURGE_DIRTY_PAGES (0x4)
+
+#define CC_FLUSH_AND_PURGE_NO_PURGE (0x1)
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcPurgeCacheSection(
+ IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+ IN PLARGE_INTEGER FileOffset OPTIONAL,
+ IN ULONG Length,
+ IN ULONG Flags);
+#elif (NTDDI_VERSION >= NTDDI_WIN2K)
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcPurgeCacheSection(
+ IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+ IN PLARGE_INTEGER FileOffset OPTIONAL,
+ IN ULONG Length,
+ IN BOOLEAN UninitializeCacheMaps);
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcCopyWriteWontFlush(
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN ULONG Length);
+#else
+#define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
+#endif
+
+#define CcReadAhead(FO, FOFF, LEN) ( \
+ if ((LEN) >= 256) { \
+ CcScheduleReadAhead((FO), (FOFF), (LEN)); \
+ } \
+)
+
+#define PIN_WAIT (1)
+#define PIN_EXCLUSIVE (2)
+#define PIN_NO_READ (4)
+#define PIN_IF_BCB (8)
+#define PIN_CALLER_TRACKS_DIRTY_DATA (32)
+#define PIN_HIGH_PRIORITY (64)
+
+#define MAP_WAIT 1
+#define MAP_NO_READ (16)
+#define MAP_HIGH_PRIORITY (64)
+
+#define IOCTL_REDIR_QUERY_PATH CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define IOCTL_REDIR_QUERY_PATH_EX CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 100, METHOD_NEITHER, FILE_ANY_ACCESS)
+
+typedef struct _QUERY_PATH_REQUEST {
+ ULONG PathNameLength;
+ PIO_SECURITY_CONTEXT SecurityContext;
+ WCHAR FilePathName[1];
+} QUERY_PATH_REQUEST, *PQUERY_PATH_REQUEST;
+
+typedef struct _QUERY_PATH_REQUEST_EX {
+ PIO_SECURITY_CONTEXT pSecurityContext;
+ ULONG EaLength;
+ PVOID pEaBuffer;
+ UNICODE_STRING PathName;
+ UNICODE_STRING DomainServiceName;
+ ULONG_PTR Reserved[ 3 ];
+} QUERY_PATH_REQUEST_EX, *PQUERY_PATH_REQUEST_EX;
+
+typedef struct _QUERY_PATH_RESPONSE {
+ ULONG LengthAccepted;
+} QUERY_PATH_RESPONSE, *PQUERY_PATH_RESPONSE;
+
+#define VOLSNAPCONTROLTYPE 0x00000053
+#define IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES CTL_CODE(VOLSNAPCONTROLTYPE, 0, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwQueryObject(
+ IN HANDLE Handle OPTIONAL,
+ IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
+ OUT PVOID ObjectInformation OPTIONAL,
+ IN ULONG ObjectInformationLength,
+ OUT PULONG ReturnLength OPTIONAL);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwNotifyChangeKey(
+ IN HANDLE KeyHandle,
+ IN HANDLE EventHandle OPTIONAL,
+ IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
+ IN PVOID ApcContext OPTIONAL,
+ OUT PIO_STATUS_BLOCK IoStatusBlock,
+ IN ULONG NotifyFilter,
+ IN BOOLEAN WatchSubtree,
+ OUT PVOID Buffer,
+ IN ULONG BufferLength,
+ IN BOOLEAN Asynchronous);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwCreateEvent(
+ OUT PHANDLE EventHandle,
+ IN ACCESS_MASK DesiredAccess,
+ IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
+ IN EVENT_TYPE EventType,
+ IN BOOLEAN InitialState);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwDeleteFile(
+ IN POBJECT_ATTRIBUTES ObjectAttributes);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwDeviceIoControlFile(
+ IN HANDLE FileHandle,
+ IN HANDLE Event OPTIONAL,
+ IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
+ IN PVOID ApcContext OPTIONAL,
+ OUT PIO_STATUS_BLOCK IoStatusBlock,
+ IN ULONG IoControlCode,
+ IN PVOID InputBuffer OPTIONAL,
+ IN ULONG InputBufferLength,
+ OUT PVOID OutputBuffer OPTIONAL,
+ IN ULONG OutputBufferLength);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwQueryDirectoryFile(
+ IN HANDLE FileHandle,
+ IN HANDLE Event OPTIONAL,
+ IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
+ IN PVOID ApcContext OPTIONAL,
+ OUT PIO_STATUS_BLOCK IoStatusBlock,
+ OUT PVOID FileInformation,
+ IN ULONG Length,
+ IN FILE_INFORMATION_CLASS FileInformationClass,
+ IN BOOLEAN ReturnSingleEntry,
+ IN PUNICODE_STRING FileName OPTIONAL,
+ IN BOOLEAN RestartScan);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwQueryVolumeInformationFile(
+ IN HANDLE FileHandle,
+ OUT PIO_STATUS_BLOCK IoStatusBlock,
+ OUT PVOID FsInformation,
+ IN ULONG Length,
+ IN FS_INFORMATION_CLASS FsInformationClass);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwSetVolumeInformationFile(
+ IN HANDLE FileHandle,
+ OUT PIO_STATUS_BLOCK IoStatusBlock,
+ IN PVOID FsInformation,
+ IN ULONG Length,
+ IN FS_INFORMATION_CLASS FsInformationClass);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwFsControlFile(
+ IN HANDLE FileHandle,
+ IN HANDLE Event OPTIONAL,
+ IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
+ IN PVOID ApcContext OPTIONAL,
+ OUT PIO_STATUS_BLOCK IoStatusBlock,
+ IN ULONG FsControlCode,
+ IN PVOID InputBuffer OPTIONAL,
+ IN ULONG InputBufferLength,
+ OUT PVOID OutputBuffer OPTIONAL,
+ IN ULONG OutputBufferLength);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwDuplicateObject(
+ IN HANDLE SourceProcessHandle,
+ IN HANDLE SourceHandle,
+ IN HANDLE TargetProcessHandle OPTIONAL,
+ OUT PHANDLE TargetHandle OPTIONAL,
+ IN ACCESS_MASK DesiredAccess,
+ IN ULONG HandleAttributes,
+ IN ULONG Options);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwOpenDirectoryObject(
+ OUT PHANDLE DirectoryHandle,
+ IN ACCESS_MASK DesiredAccess,
+ IN POBJECT_ATTRIBUTES ObjectAttributes);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwAllocateVirtualMemory(
+ IN HANDLE ProcessHandle,
+ IN OUT PVOID *BaseAddress,
+ IN ULONG_PTR ZeroBits,
+ IN OUT PSIZE_T RegionSize,
+ IN ULONG AllocationType,
+ IN ULONG Protect);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwFreeVirtualMemory(
+ IN HANDLE ProcessHandle,
+ IN OUT PVOID *BaseAddress,
+ IN OUT PSIZE_T RegionSize,
+ IN ULONG FreeType);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwWaitForSingleObject(
+ IN HANDLE Handle,
+ IN BOOLEAN Alertable,
+ IN PLARGE_INTEGER Timeout OPTIONAL);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwSetEvent(
+ IN HANDLE EventHandle,
+ OUT PLONG PreviousState OPTIONAL);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwFlushVirtualMemory(
+ IN HANDLE ProcessHandle,
+ IN OUT PVOID *BaseAddress,
+ IN OUT PSIZE_T RegionSize,
+ OUT PIO_STATUS_BLOCK IoStatusBlock);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwQueryInformationToken(
+ IN HANDLE TokenHandle,
+ IN TOKEN_INFORMATION_CLASS TokenInformationClass,
+ OUT PVOID TokenInformation,
+ IN ULONG Length,
+ OUT PULONG ResultLength);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwSetSecurityObject(
+ IN HANDLE Handle,
+ IN SECURITY_INFORMATION SecurityInformation,
+ IN PSECURITY_DESCRIPTOR SecurityDescriptor);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwQuerySecurityObject(
+ IN HANDLE FileHandle,
+ IN SECURITY_INFORMATION SecurityInformation,
+ OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
+ IN ULONG Length,
+ OUT PULONG ResultLength);
+
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwOpenProcessTokenEx(
+ IN HANDLE ProcessHandle,
+ IN ACCESS_MASK DesiredAccess,
+ IN ULONG HandleAttributes,
+ OUT PHANDLE TokenHandle);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwOpenThreadTokenEx(
+ IN HANDLE ThreadHandle,
+ IN ACCESS_MASK DesiredAccess,
+ IN BOOLEAN OpenAsSelf,
+ IN ULONG HandleAttributes,
+ OUT PHANDLE TokenHandle);
+
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwLockFile(
+ IN HANDLE FileHandle,
+ IN HANDLE Event OPTIONAL,
+ IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
+ IN PVOID ApcContext OPTIONAL,
+ OUT PIO_STATUS_BLOCK IoStatusBlock,
+ IN PLARGE_INTEGER ByteOffset,
+ IN PLARGE_INTEGER Length,
+ IN ULONG Key,
+ IN BOOLEAN FailImmediately,
+ IN BOOLEAN ExclusiveLock);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwUnlockFile(
+ IN HANDLE FileHandle,
+ OUT PIO_STATUS_BLOCK IoStatusBlock,
+ IN PLARGE_INTEGER ByteOffset,
+ IN PLARGE_INTEGER Length,
+ IN ULONG Key);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwQueryQuotaInformationFile(
+ IN HANDLE FileHandle,
+ OUT PIO_STATUS_BLOCK IoStatusBlock,
+ OUT PVOID Buffer,
+ IN ULONG Length,
+ IN BOOLEAN ReturnSingleEntry,
+ IN PVOID SidList,
+ IN ULONG SidListLength,
+ IN PSID StartSid OPTIONAL,
+ IN BOOLEAN RestartScan);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwSetQuotaInformationFile(
+ IN HANDLE FileHandle,
+ OUT PIO_STATUS_BLOCK IoStatusBlock,
+ IN PVOID Buffer,
+ IN ULONG Length);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwFlushBuffersFile(
+ IN HANDLE FileHandle,
+ OUT PIO_STATUS_BLOCK IoStatusBlock);
+
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwSetInformationToken(
+ IN HANDLE TokenHandle,
+ IN TOKEN_INFORMATION_CLASS TokenInformationClass,
+ IN PVOID TokenInformation,
+ IN ULONG TokenInformationLength);
+#endif
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwQueryEaFile(
+ IN HANDLE FileHandle,
+ OUT PIO_STATUS_BLOCK IoStatusBlock,
+ OUT PVOID Buffer,
+ IN ULONG Length,
+ IN BOOLEAN ReturnSingleEntry,
+ IN PVOID EaList OPTIONAL,
+ IN ULONG EaListLength,
+ IN PULONG EaIndex OPTIONAL,
+ IN BOOLEAN RestartScan);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwSetEaFile(
+ IN HANDLE FileHandle,
+ OUT PIO_STATUS_BLOCK IoStatusBlock,
+ OUT PVOID Buffer,
+ IN ULONG Length);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwDuplicateToken(
+ IN HANDLE ExistingTokenHandle,
+ IN ACCESS_MASK DesiredAccess,
+ IN POBJECT_ATTRIBUTES ObjectAttributes,
+ IN BOOLEAN EffectiveOnly,
+ IN TOKEN_TYPE TokenType,
+ OUT PHANDLE NewTokenHandle);
+
+#pragma pack(push,4)
+
+#ifndef VER_PRODUCTBUILD
+#define VER_PRODUCTBUILD 10000
+#endif
+
+#include "csq.h"
+
+#ifdef _NTOSKRNL_
+extern PUCHAR FsRtlLegalAnsiCharacterArray;
+#else
+extern DECLSPEC_IMPORT PUCHAR FsRtlLegalAnsiCharacterArray;
+#endif
+extern PACL SePublicDefaultDacl;
+extern PACL SeSystemDefaultDacl;
+
+#define FS_LFN_APIS 0x00004000
+
+#define FILE_STORAGE_TYPE_SPECIFIED 0x00000041 /* FILE_DIRECTORY_FILE | FILE_NON_DIRECTORY_FILE */
+#define FILE_STORAGE_TYPE_DEFAULT (StorageTypeDefault << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_DIRECTORY (StorageTypeDirectory << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_FILE (StorageTypeFile << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_DOCFILE (StorageTypeDocfile << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_JUNCTION_POINT (StorageTypeJunctionPoint << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_CATALOG (StorageTypeCatalog << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_STRUCTURED_STORAGE (StorageTypeStructuredStorage << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_EMBEDDING (StorageTypeEmbedding << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_STREAM (StorageTypeStream << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_MINIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_DEFAULT
+#define FILE_MAXIMUM_STORAGE_TYPE FILE_STORAGE_TYPE_STREAM
+#define FILE_STORAGE_TYPE_MASK 0x000f0000
+#define FILE_STORAGE_TYPE_SHIFT 16
+
+#define FILE_VC_QUOTAS_LOG_VIOLATIONS 0x00000004
+
+#define FSRTL_WILD_CHARACTER 0x08
+
+#ifdef _X86_
+#define HARDWARE_PTE HARDWARE_PTE_X86
+#define PHARDWARE_PTE PHARDWARE_PTE_X86
+#endif
+
+#define IO_CHECK_CREATE_PARAMETERS 0x0200
+#define IO_ATTACH_DEVICE 0x0400
+
+#define IO_ATTACH_DEVICE_API 0x80000000
+
+#define IO_TYPE_APC 18
+#define IO_TYPE_DPC 19
+#define IO_TYPE_DEVICE_QUEUE 20
+#define IO_TYPE_EVENT_PAIR 21
+#define IO_TYPE_INTERRUPT 22
+#define IO_TYPE_PROFILE 23
+
+#define IRP_BEING_VERIFIED 0x10
+
+#define MAILSLOT_CLASS_FIRSTCLASS 1
+#define MAILSLOT_CLASS_SECONDCLASS 2
+
+#define MAILSLOT_SIZE_AUTO 0
+
+#define MEM_DOS_LIM 0x40000000
+
+#define OB_TYPE_TYPE 1
+#define OB_TYPE_DIRECTORY 2
+#define OB_TYPE_SYMBOLIC_LINK 3
+#define OB_TYPE_TOKEN 4
+#define OB_TYPE_PROCESS 5
+#define OB_TYPE_THREAD 6
+#define OB_TYPE_EVENT 7
+#define OB_TYPE_EVENT_PAIR 8
+#define OB_TYPE_MUTANT 9
+#define OB_TYPE_SEMAPHORE 10
+#define OB_TYPE_TIMER 11
+#define OB_TYPE_PROFILE 12
+#define OB_TYPE_WINDOW_STATION 13
+#define OB_TYPE_DESKTOP 14
+#define OB_TYPE_SECTION 15
+#define OB_TYPE_KEY 16
+#define OB_TYPE_PORT 17
+#define OB_TYPE_ADAPTER 18
+#define OB_TYPE_CONTROLLER 19
+#define OB_TYPE_DEVICE 20
+#define OB_TYPE_DRIVER 21
+#define OB_TYPE_IO_COMPLETION 22
+#define OB_TYPE_FILE 23
+
+#define SEC_BASED 0x00200000
+
+#define SECURITY_WORLD_SID_AUTHORITY {0,0,0,0,0,1}
+#define SECURITY_WORLD_RID (0x00000000L)
+
+/* end winnt.h */
+
+#define TOKEN_HAS_ADMIN_GROUP 0x08
+
+#if (VER_PRODUCTBUILD >= 1381)
+#define FSCTL_GET_HFS_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#endif /* (VER_PRODUCTBUILD >= 1381) */
+
+#if (VER_PRODUCTBUILD >= 2195)
+
+#define FSCTL_READ_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 33, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_WRITE_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 34, METHOD_NEITHER, FILE_ANY_ACCESS)
+
+#define FSCTL_DUMP_PROPERTY_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 37, METHOD_NEITHER, FILE_ANY_ACCESS)
+
+#define FSCTL_HSM_MSG CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
+#define FSCTL_NSS_CONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 67, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_HSM_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
+#define FSCTL_NSS_RCONTROL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 70, METHOD_BUFFERED, FILE_READ_DATA)
+#endif /* (VER_PRODUCTBUILD >= 2195) */
+
+#define FSCTL_NETWORK_SET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 102, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
+#define FSCTL_NETWORK_GET_CONFIGURATION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 103, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
+#define FSCTL_NETWORK_GET_CONNECTION_INFO CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 104, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_NETWORK_ENUMERATE_CONNECTIONS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 105, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_NETWORK_DELETE_CONNECTION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 107, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_NETWORK_GET_STATISTICS CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 116, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_NETWORK_SET_DOMAIN_NAME CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+//
+// Forwarders
+//
+struct _RTL_AVL_TABLE;
+struct _RTL_GENERIC_TABLE;
+
+typedef enum _FILE_STORAGE_TYPE {
+ StorageTypeDefault = 1,
+ StorageTypeDirectory,
+ StorageTypeFile,
+ StorageTypeJunctionPoint,
+ StorageTypeCatalog,
+ StorageTypeStructuredStorage,
+ StorageTypeEmbedding,
+ StorageTypeStream
+} FILE_STORAGE_TYPE;
+
+typedef struct _OBJECT_BASIC_INFORMATION
+{
+ ULONG Attributes;
+ ACCESS_MASK GrantedAccess;
+ ULONG HandleCount;
+ ULONG PointerCount;
+ ULONG PagedPoolCharge;
+ ULONG NonPagedPoolCharge;
+ ULONG Reserved[ 3 ];
+ ULONG NameInfoSize;
+ ULONG TypeInfoSize;
+ ULONG SecurityDescriptorSize;
+ LARGE_INTEGER CreationTime;
+} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
+
+typedef struct _BITMAP_RANGE {
+ LIST_ENTRY Links;
+ LONGLONG BasePage;
+ ULONG FirstDirtyPage;
+ ULONG LastDirtyPage;
+ ULONG DirtyPages;
+ PULONG Bitmap;
+} BITMAP_RANGE, *PBITMAP_RANGE;
+
+typedef struct _FILE_COPY_ON_WRITE_INFORMATION {
+ BOOLEAN ReplaceIfExists;
+ HANDLE RootDirectory;
+ ULONG FileNameLength;
+ WCHAR FileName[1];
+} FILE_COPY_ON_WRITE_INFORMATION, *PFILE_COPY_ON_WRITE_INFORMATION;
+
+typedef struct _FILE_FULL_DIRECTORY_INFORMATION {
+ ULONG NextEntryOffset;
+ ULONG FileIndex;
+ LARGE_INTEGER CreationTime;
+ LARGE_INTEGER LastAccessTime;
+ LARGE_INTEGER LastWriteTime;
+ LARGE_INTEGER ChangeTime;
+ LARGE_INTEGER EndOfFile;
+ LARGE_INTEGER AllocationSize;
+ ULONG FileAttributes;
+ ULONG FileNameLength;
+ ULONG EaSize;
+ WCHAR FileName[ANYSIZE_ARRAY];
+} FILE_FULL_DIRECTORY_INFORMATION, *PFILE_FULL_DIRECTORY_INFORMATION;
+
+typedef struct _FILE_FS_FULL_SIZE_INFORMATION {
+ LARGE_INTEGER TotalAllocationUnits;
+ LARGE_INTEGER CallerAvailableAllocationUnits;
+ LARGE_INTEGER ActualAvailableAllocationUnits;
+ ULONG SectorsPerAllocationUnit;
+ ULONG BytesPerSector;
+} FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
+
+typedef struct _FILE_FS_LABEL_INFORMATION {
+ ULONG VolumeLabelLength;
+ WCHAR VolumeLabel[1];
+} FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
+
+#if (VER_PRODUCTBUILD >= 2195)
+
+typedef struct _FILE_FS_OBJECT_ID_INFORMATION {
+ UCHAR ObjectId[16];
+ UCHAR ExtendedInfo[48];
+} FILE_FS_OBJECT_ID_INFORMATION, *PFILE_FS_OBJECT_ID_INFORMATION;
+
+#endif /* (VER_PRODUCTBUILD >= 2195) */
+
+typedef struct _FILE_FS_SIZE_INFORMATION {
+ LARGE_INTEGER TotalAllocationUnits;
+ LARGE_INTEGER AvailableAllocationUnits;
+ ULONG SectorsPerAllocationUnit;
+ ULONG BytesPerSector;
+} FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
+
+typedef struct _FILE_FS_VOLUME_INFORMATION {
+ LARGE_INTEGER VolumeCreationTime;
+ ULONG VolumeSerialNumber;
+ ULONG VolumeLabelLength;
+ BOOLEAN SupportsObjects;
+ WCHAR VolumeLabel[1];
+} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
+
+typedef struct _FILE_FS_OBJECTID_INFORMATION
+{
+ UCHAR ObjectId[16];
+ UCHAR ExtendedInfo[48];
+} FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION;
+
+/* raw internal file lock struct returned from FsRtlGetNextFileLock */
+typedef struct _FILE_SHARED_LOCK_ENTRY {
+ PVOID Unknown1;
+ PVOID Unknown2;
+ FILE_LOCK_INFO FileLock;
+} FILE_SHARED_LOCK_ENTRY, *PFILE_SHARED_LOCK_ENTRY;
+
+/* raw internal file lock struct returned from FsRtlGetNextFileLock */
+typedef struct _FILE_EXCLUSIVE_LOCK_ENTRY {
+ LIST_ENTRY ListEntry;
+ PVOID Unknown1;
+ PVOID Unknown2;
+ FILE_LOCK_INFO FileLock;
+} FILE_EXCLUSIVE_LOCK_ENTRY, *PFILE_EXCLUSIVE_LOCK_ENTRY;
+
+typedef struct _FILE_MAILSLOT_PEEK_BUFFER {
+ ULONG ReadDataAvailable;
+ ULONG NumberOfMessages;
+ ULONG MessageLength;
+} FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER;
+
+typedef struct _FILE_OLE_CLASSID_INFORMATION {
+ GUID ClassId;
+} FILE_OLE_CLASSID_INFORMATION, *PFILE_OLE_CLASSID_INFORMATION;
+
+typedef struct _FILE_OLE_ALL_INFORMATION {
+ FILE_BASIC_INFORMATION BasicInformation;
+ FILE_STANDARD_INFORMATION StandardInformation;
+ FILE_INTERNAL_INFORMATION InternalInformation;
+ FILE_EA_INFORMATION EaInformation;
+ FILE_ACCESS_INFORMATION AccessInformation;
+ FILE_POSITION_INFORMATION PositionInformation;
+ FILE_MODE_INFORMATION ModeInformation;
+ FILE_ALIGNMENT_INFORMATION AlignmentInformation;
+ USN LastChangeUsn;
+ USN ReplicationUsn;
+ LARGE_INTEGER SecurityChangeTime;
+ FILE_OLE_CLASSID_INFORMATION OleClassIdInformation;
+ FILE_OBJECTID_INFORMATION ObjectIdInformation;
+ FILE_STORAGE_TYPE StorageType;
+ ULONG OleStateBits;
+ ULONG OleId;
+ ULONG NumberOfStreamReferences;
+ ULONG StreamIndex;
+ ULONG SecurityId;
+ BOOLEAN ContentIndexDisable;
+ BOOLEAN InheritContentIndexDisable;
+ FILE_NAME_INFORMATION NameInformation;
+} FILE_OLE_ALL_INFORMATION, *PFILE_OLE_ALL_INFORMATION;
+
+typedef struct _FILE_OLE_DIR_INFORMATION {
+ ULONG NextEntryOffset;
+ ULONG FileIndex;
+ LARGE_INTEGER CreationTime;
+ LARGE_INTEGER LastAccessTime;
+ LARGE_INTEGER LastWriteTime;
+ LARGE_INTEGER ChangeTime;
+ LARGE_INTEGER EndOfFile;
+ LARGE_INTEGER AllocationSize;
+ ULONG FileAttributes;
+ ULONG FileNameLength;
+ FILE_STORAGE_TYPE StorageType;
+ GUID OleClassId;
+ ULONG OleStateBits;
+ BOOLEAN ContentIndexDisable;
+ BOOLEAN InheritContentIndexDisable;
+ WCHAR FileName[1];
+} FILE_OLE_DIR_INFORMATION, *PFILE_OLE_DIR_INFORMATION;
+
+typedef struct _FILE_OLE_INFORMATION {
+ LARGE_INTEGER SecurityChangeTime;
+ FILE_OLE_CLASSID_INFORMATION OleClassIdInformation;
+ FILE_OBJECTID_INFORMATION ObjectIdInformation;
+ FILE_STORAGE_TYPE StorageType;
+ ULONG OleStateBits;
+ BOOLEAN ContentIndexDisable;
+ BOOLEAN InheritContentIndexDisable;
+} FILE_OLE_INFORMATION, *PFILE_OLE_INFORMATION;
+
+typedef struct _FILE_OLE_STATE_BITS_INFORMATION {
+ ULONG StateBits;
+ ULONG StateBitsMask;
+} FILE_OLE_STATE_BITS_INFORMATION, *PFILE_OLE_STATE_BITS_INFORMATION;
+
+typedef struct _MAPPING_PAIR {
+ ULONGLONG Vcn;
+ ULONGLONG Lcn;
+} MAPPING_PAIR, *PMAPPING_PAIR;
+
+typedef struct _GET_RETRIEVAL_DESCRIPTOR {
+ ULONG NumberOfPairs;
+ ULONGLONG StartVcn;
+ MAPPING_PAIR Pair[1];
+} GET_RETRIEVAL_DESCRIPTOR, *PGET_RETRIEVAL_DESCRIPTOR;
+
+#define ASSERT_QUEUE(Q) ASSERT(((Q)->Header.Type & KOBJECT_TYPE_MASK) == QueueObject);
+
+typedef struct _MBCB {
+ CSHORT NodeTypeCode;
+ CSHORT NodeIsInZone;
+ ULONG PagesToWrite;
+ ULONG DirtyPages;
+ ULONG Reserved;
+ LIST_ENTRY BitmapRanges;
+ LONGLONG ResumeWritePage;
+ BITMAP_RANGE BitmapRange1;
+ BITMAP_RANGE BitmapRange2;
+ BITMAP_RANGE BitmapRange3;
+} MBCB, *PMBCB;
+
+typedef struct _MOVEFILE_DESCRIPTOR {
+ HANDLE FileHandle;
+ ULONG Reserved;
+ LARGE_INTEGER StartVcn;
+ LARGE_INTEGER TargetLcn;
+ ULONG NumVcns;
+ ULONG Reserved1;
+} MOVEFILE_DESCRIPTOR, *PMOVEFILE_DESCRIPTOR;
+
+typedef struct _OBJECT_BASIC_INFO {
+ ULONG Attributes;
+ ACCESS_MASK GrantedAccess;
+ ULONG HandleCount;
+ ULONG ReferenceCount;
+ ULONG PagedPoolUsage;
+ ULONG NonPagedPoolUsage;
+ ULONG Reserved[3];
+ ULONG NameInformationLength;
+ ULONG TypeInformationLength;
+ ULONG SecurityDescriptorLength;
+ LARGE_INTEGER CreateTime;
+} OBJECT_BASIC_INFO, *POBJECT_BASIC_INFO;
+
+typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFO {
+ BOOLEAN Inherit;
+ BOOLEAN ProtectFromClose;
+} OBJECT_HANDLE_ATTRIBUTE_INFO, *POBJECT_HANDLE_ATTRIBUTE_INFO;
+
+typedef struct _OBJECT_NAME_INFO {
+ UNICODE_STRING ObjectName;
+ WCHAR ObjectNameBuffer[1];
+} OBJECT_NAME_INFO, *POBJECT_NAME_INFO;
+
+typedef struct _OBJECT_PROTECTION_INFO {
+ BOOLEAN Inherit;
+ BOOLEAN ProtectHandle;
+} OBJECT_PROTECTION_INFO, *POBJECT_PROTECTION_INFO;
+
+typedef struct _OBJECT_TYPE_INFO {
+ UNICODE_STRING ObjectTypeName;
+ UCHAR Unknown[0x58];
+ WCHAR ObjectTypeNameBuffer[1];
+} OBJECT_TYPE_INFO, *POBJECT_TYPE_INFO;
+
+typedef struct _OBJECT_ALL_TYPES_INFO {
+ ULONG NumberOfObjectTypes;
+ OBJECT_TYPE_INFO ObjectsTypeInfo[1];
+} OBJECT_ALL_TYPES_INFO, *POBJECT_ALL_TYPES_INFO;
+
+typedef enum _RTL_GENERIC_COMPARE_RESULTS
+{
+ GenericLessThan,
+ GenericGreaterThan,
+ GenericEqual
+} RTL_GENERIC_COMPARE_RESULTS;
+
+typedef enum _TABLE_SEARCH_RESULT
+{
+ TableEmptyTree,
+ TableFoundNode,
+ TableInsertAsLeft,
+ TableInsertAsRight
+} TABLE_SEARCH_RESULT;
+
+typedef NTSTATUS
+(NTAPI *PRTL_AVL_MATCH_FUNCTION)(
+ struct _RTL_AVL_TABLE *Table,
+ PVOID UserData,
+ PVOID MatchData
+);
+
+typedef RTL_GENERIC_COMPARE_RESULTS
+(NTAPI *PRTL_AVL_COMPARE_ROUTINE) (
+ struct _RTL_AVL_TABLE *Table,
+ PVOID FirstStruct,
+ PVOID SecondStruct
+);
+
+typedef RTL_GENERIC_COMPARE_RESULTS
+(NTAPI *PRTL_GENERIC_COMPARE_ROUTINE) (
+ struct _RTL_GENERIC_TABLE *Table,
+ PVOID FirstStruct,
+ PVOID SecondStruct
);
-NTKERNELAPI
-VOID
-NTAPI
-PsRevertToSelf (
- VOID
+typedef PVOID
+(NTAPI *PRTL_GENERIC_ALLOCATE_ROUTINE) (
+ struct _RTL_GENERIC_TABLE *Table,
+ CLONG ByteSize
);
-NTSYSAPI
-VOID
-NTAPI
-RtlSecondsSince1970ToTime (
- IN ULONG SecondsSince1970,
- OUT PLARGE_INTEGER Time
+typedef VOID
+(NTAPI *PRTL_GENERIC_FREE_ROUTINE) (
+ struct _RTL_GENERIC_TABLE *Table,
+ PVOID Buffer
);
-NTSYSAPI
-NTSTATUS
-NTAPI
-RtlSetSaclSecurityDescriptor (
- IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
- IN BOOLEAN SaclPresent,
- IN PACL Sacl,
- IN BOOLEAN SaclDefaulted
+typedef PVOID
+(NTAPI *PRTL_AVL_ALLOCATE_ROUTINE) (
+ struct _RTL_AVL_TABLE *Table,
+ CLONG ByteSize
);
-NTSYSAPI
-NTSTATUS
-NTAPI
-RtlUnicodeStringToCountedOemString (
- IN OUT POEM_STRING DestinationString,
- IN PCUNICODE_STRING SourceString,
- IN BOOLEAN AllocateDestinationString
+typedef VOID
+(NTAPI *PRTL_AVL_FREE_ROUTINE) (
+ struct _RTL_AVL_TABLE *Table,
+ PVOID Buffer
);
-/* RTL Splay Tree Functions */
-NTSYSAPI
-PRTL_SPLAY_LINKS
-NTAPI
-RtlSplay(PRTL_SPLAY_LINKS Links);
+typedef struct _RTL_BALANCED_LINKS
+{
+ struct _RTL_BALANCED_LINKS *Parent;
+ struct _RTL_BALANCED_LINKS *LeftChild;
+ struct _RTL_BALANCED_LINKS *RightChild;
+ CHAR Balance;
+ UCHAR Reserved[3];
+} RTL_BALANCED_LINKS, *PRTL_BALANCED_LINKS;
-NTSYSAPI
-PRTL_SPLAY_LINKS
-NTAPI
-RtlDelete(PRTL_SPLAY_LINKS Links);
+typedef struct _RTL_GENERIC_TABLE
+{
+ PRTL_SPLAY_LINKS TableRoot;
+ LIST_ENTRY InsertOrderList;
+ PLIST_ENTRY OrderedPointer;
+ ULONG WhichOrderedElement;
+ ULONG NumberGenericTableElements;
+ PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine;
+ PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine;
+ PRTL_GENERIC_FREE_ROUTINE FreeRoutine;
+ PVOID TableContext;
+} RTL_GENERIC_TABLE, *PRTL_GENERIC_TABLE;
+
+#undef PRTL_GENERIC_COMPARE_ROUTINE
+#undef PRTL_GENERIC_ALLOCATE_ROUTINE
+#undef PRTL_GENERIC_FREE_ROUTINE
+#undef RTL_GENERIC_TABLE
+#undef PRTL_GENERIC_TABLE
+
+#define PRTL_GENERIC_COMPARE_ROUTINE PRTL_AVL_COMPARE_ROUTINE
+#define PRTL_GENERIC_ALLOCATE_ROUTINE PRTL_AVL_ALLOCATE_ROUTINE
+#define PRTL_GENERIC_FREE_ROUTINE PRTL_AVL_FREE_ROUTINE
+#define RTL_GENERIC_TABLE RTL_AVL_TABLE
+#define PRTL_GENERIC_TABLE PRTL_AVL_TABLE
+
+#define RtlInitializeGenericTable RtlInitializeGenericTableAvl
+#define RtlInsertElementGenericTable RtlInsertElementGenericTableAvl
+#define RtlInsertElementGenericTableFull RtlInsertElementGenericTableFullAvl
+#define RtlDeleteElementGenericTable RtlDeleteElementGenericTableAvl
+#define RtlLookupElementGenericTable RtlLookupElementGenericTableAvl
+#define RtlLookupElementGenericTableFull RtlLookupElementGenericTableFullAvl
+#define RtlEnumerateGenericTable RtlEnumerateGenericTableAvl
+#define RtlEnumerateGenericTableWithoutSplaying RtlEnumerateGenericTableWithoutSplayingAvl
+#define RtlGetElementGenericTable RtlGetElementGenericTableAvl
+#define RtlNumberGenericTableElements RtlNumberGenericTableElementsAvl
+#define RtlIsGenericTableEmpty RtlIsGenericTableEmptyAvl
+
+typedef struct _RTL_AVL_TABLE
+{
+ RTL_BALANCED_LINKS BalancedRoot;
+ PVOID OrderedPointer;
+ ULONG WhichOrderedElement;
+ ULONG NumberGenericTableElements;
+ ULONG DepthOfTree;
+ PRTL_BALANCED_LINKS RestartKey;
+ ULONG DeleteCount;
+ PRTL_AVL_COMPARE_ROUTINE CompareRoutine;
+ PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine;
+ PRTL_AVL_FREE_ROUTINE FreeRoutine;
+ PVOID TableContext;
+} RTL_AVL_TABLE, *PRTL_AVL_TABLE;
NTSYSAPI
VOID
NTAPI
-RtlDeleteNoSplay(
- PRTL_SPLAY_LINKS Links,
- PRTL_SPLAY_LINKS *Root
+RtlInitializeGenericTableAvl(
+ PRTL_AVL_TABLE Table,
+ PRTL_AVL_COMPARE_ROUTINE CompareRoutine,
+ PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine,
+ PRTL_AVL_FREE_ROUTINE FreeRoutine,
+ PVOID TableContext
);
NTSYSAPI
-PRTL_SPLAY_LINKS
+PVOID
NTAPI
-RtlSubtreeSuccessor(PRTL_SPLAY_LINKS Links);
-
+RtlInsertElementGenericTableAvl (
+ PRTL_AVL_TABLE Table,
+ PVOID Buffer,
+ CLONG BufferSize,
+ PBOOLEAN NewElement OPTIONAL
+ );
+
NTSYSAPI
-PRTL_SPLAY_LINKS
+BOOLEAN
NTAPI
-RtlSubtreePredecessor(PRTL_SPLAY_LINKS Links);
-
+RtlDeleteElementGenericTableAvl (
+ PRTL_AVL_TABLE Table,
+ PVOID Buffer
+ );
+
NTSYSAPI
-PRTL_SPLAY_LINKS
+PVOID
NTAPI
-RtlRealSuccessor(PRTL_SPLAY_LINKS Links);
-
+RtlLookupElementGenericTableAvl (
+ PRTL_AVL_TABLE Table,
+ PVOID Buffer
+ );
+
NTSYSAPI
-PRTL_SPLAY_LINKS
+PVOID
NTAPI
-RtlRealPredecessor(PRTL_SPLAY_LINKS Links);
-
-#define RtlIsLeftChild(Links) \
- (RtlLeftChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
-
-#define RtlIsRightChild(Links) \
- (RtlRightChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
-
-#define RtlRightChild(Links) \
- ((PRTL_SPLAY_LINKS)(Links))->RightChild
-
-#define RtlIsRoot(Links) \
- (RtlParent(Links) == (PRTL_SPLAY_LINKS)(Links))
+RtlEnumerateGenericTableWithoutSplayingAvl (
+ PRTL_AVL_TABLE Table,
+ PVOID *RestartKey
+ );
-#define RtlLeftChild(Links) \
- ((PRTL_SPLAY_LINKS)(Links))->LeftChild
+#if defined(USE_LPC6432)
+#define LPC_CLIENT_ID CLIENT_ID64
+#define LPC_SIZE_T ULONGLONG
+#define LPC_PVOID ULONGLONG
+#define LPC_HANDLE ULONGLONG
+#else
+#define LPC_CLIENT_ID CLIENT_ID
+#define LPC_SIZE_T SIZE_T
+#define LPC_PVOID PVOID
+#define LPC_HANDLE HANDLE
+#endif
-#define RtlParent(Links) \
- ((PRTL_SPLAY_LINKS)(Links))->Parent
+typedef struct _PORT_MESSAGE
+{
+ union
+ {
+ struct
+ {
+ CSHORT DataLength;
+ CSHORT TotalLength;
+ } s1;
+ ULONG Length;
+ } u1;
+ union
+ {
+ struct
+ {
+ CSHORT Type;
+ CSHORT DataInfoOffset;
+ } s2;
+ ULONG ZeroInit;
+ } u2;
+ __GNU_EXTENSION union
+ {
+ LPC_CLIENT_ID ClientId;
+ double DoNotUseThisField;
+ };
+ ULONG MessageId;
+ __GNU_EXTENSION union
+ {
+ LPC_SIZE_T ClientViewSize;
+ ULONG CallbackId;
+ };
+} PORT_MESSAGE, *PPORT_MESSAGE;
-#define RtlInitializeSplayLinks(Links) \
- { \
- PRTL_SPLAY_LINKS _SplayLinks; \
- _SplayLinks = (PRTL_SPLAY_LINKS)(Links); \
- _SplayLinks->Parent = _SplayLinks; \
- _SplayLinks->LeftChild = NULL; \
- _SplayLinks->RightChild = NULL; \
- }
+#define LPC_KERNELMODE_MESSAGE (CSHORT)((USHORT)0x8000)
-#define RtlInsertAsLeftChild(ParentLinks,ChildLinks) \
- { \
- PRTL_SPLAY_LINKS _SplayParent; \
- PRTL_SPLAY_LINKS _SplayChild; \
- _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
- _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \
- _SplayParent->LeftChild = _SplayChild; \
- _SplayChild->Parent = _SplayParent; \
- }
+typedef struct _PORT_VIEW
+{
+ ULONG Length;
+ LPC_HANDLE SectionHandle;
+ ULONG SectionOffset;
+ LPC_SIZE_T ViewSize;
+ LPC_PVOID ViewBase;
+ LPC_PVOID ViewRemoteBase;
+} PORT_VIEW, *PPORT_VIEW;
-#define RtlInsertAsRightChild(ParentLinks,ChildLinks) \
- { \
- PRTL_SPLAY_LINKS _SplayParent; \
- PRTL_SPLAY_LINKS _SplayChild; \
- _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
- _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \
- _SplayParent->RightChild = _SplayChild; \
- _SplayChild->Parent = _SplayParent; \
- }
+typedef struct _REMOTE_PORT_VIEW
+{
+ ULONG Length;
+ LPC_SIZE_T ViewSize;
+ LPC_PVOID ViewBase;
+} REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW;
-//
-// RTL time functions
-//
+typedef struct _VAD_HEADER {
+ PVOID StartVPN;
+ PVOID EndVPN;
+ struct _VAD_HEADER* ParentLink;
+ struct _VAD_HEADER* LeftLink;
+ struct _VAD_HEADER* RightLink;
+ ULONG Flags; /* LSB = CommitCharge */
+ PVOID ControlArea;
+ PVOID FirstProtoPte;
+ PVOID LastPTE;
+ ULONG Unknown;
+ LIST_ENTRY Secured;
+} VAD_HEADER, *PVAD_HEADER;
NTKERNELAPI
-NTSTATUS
+LARGE_INTEGER
NTAPI
-SeAppendPrivileges (
- PACCESS_STATE AccessState,
- PPRIVILEGE_SET Privileges
+CcGetLsnForFileObject (
+ IN PFILE_OBJECT FileObject,
+ OUT PLARGE_INTEGER OldestLsn OPTIONAL
+);
+
+#if (VER_PRODUCTBUILD >= 2600)
+
+#ifndef __NTOSKRNL__
+NTKERNELAPI
+VOID
+FASTCALL
+ExInitializeRundownProtection (
+ IN PEX_RUNDOWN_REF RunRef
+);
+
+NTKERNELAPI
+VOID
+FASTCALL
+ExReInitializeRundownProtection (
+ IN PEX_RUNDOWN_REF RunRef
);
NTKERNELAPI
BOOLEAN
-NTAPI
-SeAuditingFileEvents (
- IN BOOLEAN AccessGranted,
- IN PSECURITY_DESCRIPTOR SecurityDescriptor
+FASTCALL
+ExAcquireRundownProtection (
+ IN PEX_RUNDOWN_REF RunRef
);
NTKERNELAPI
BOOLEAN
-NTAPI
-SeAuditingFileOrGlobalEvents (
- IN BOOLEAN AccessGranted,
- IN PSECURITY_DESCRIPTOR SecurityDescriptor,
- IN PSECURITY_SUBJECT_CONTEXT SubjectContext
+FASTCALL
+ExAcquireRundownProtectionEx (
+ IN PEX_RUNDOWN_REF RunRef,
+ IN ULONG Count
);
NTKERNELAPI
VOID
-NTAPI
-SeCaptureSubjectContext (
- OUT PSECURITY_SUBJECT_CONTEXT SubjectContext
+FASTCALL
+ExReleaseRundownProtection (
+ IN PEX_RUNDOWN_REF RunRef
);
NTKERNELAPI
-NTSTATUS
-NTAPI
-SeCreateClientSecurity (
- IN PETHREAD Thread,
- IN PSECURITY_QUALITY_OF_SERVICE QualityOfService,
- IN BOOLEAN RemoteClient,
- OUT PSECURITY_CLIENT_CONTEXT ClientContext
+VOID
+FASTCALL
+ExReleaseRundownProtectionEx (
+ IN PEX_RUNDOWN_REF RunRef,
+ IN ULONG Count
);
-#if (VER_PRODUCTBUILD >= 2195)
-
NTKERNELAPI
-NTSTATUS
-NTAPI
-SeCreateClientSecurityFromSubjectContext (
- IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
- IN PSECURITY_QUALITY_OF_SERVICE QualityOfService,
- IN BOOLEAN ServerIsRemote,
- OUT PSECURITY_CLIENT_CONTEXT ClientContext
+VOID
+FASTCALL
+ExRundownCompleted (
+ IN PEX_RUNDOWN_REF RunRef
);
-#endif /* (VER_PRODUCTBUILD >= 2195) */
-
+NTKERNELAPI
+VOID
+FASTCALL
+ExWaitForRundownProtectionRelease (
+ IN PEX_RUNDOWN_REF RunRef
+);
-#define SeLengthSid( Sid ) \
- (8 + (4 * ((SID *)Sid)->SubAuthorityCount))
+#endif
+#endif /* (VER_PRODUCTBUILD >= 2600) */
-#define SeDeleteClientSecurity(C) { \
- if (SeTokenType((C)->ClientToken) == TokenPrimary) { \
- PsDereferencePrimaryToken( (C)->ClientToken ); \
- } else { \
- PsDereferenceImpersonationToken( (C)->ClientToken ); \
- } \
-}
+NTKERNELAPI
+PVOID
+NTAPI
+FsRtlAllocatePool (
+ IN POOL_TYPE PoolType,
+ IN ULONG NumberOfBytes
+);
NTKERNELAPI
-VOID
+PVOID
NTAPI
-SeDeleteObjectAuditAlarm (
- IN PVOID Object,
- IN HANDLE Handle
+FsRtlAllocatePoolWithQuota (
+ IN POOL_TYPE PoolType,
+ IN ULONG NumberOfBytes
);
-#define SeEnableAccessToExports() SeExports = *(PSE_EXPORTS *)SeExports;
+NTKERNELAPI
+PVOID
+NTAPI
+FsRtlAllocatePoolWithQuotaTag (
+ IN POOL_TYPE PoolType,
+ IN ULONG NumberOfBytes,
+ IN ULONG Tag
+);
NTKERNELAPI
-VOID
+PVOID
NTAPI
-SeFreePrivileges (
- IN PPRIVILEGE_SET Privileges
+FsRtlAllocatePoolWithTag (
+ IN POOL_TYPE PoolType,
+ IN ULONG NumberOfBytes,
+ IN ULONG Tag
);
NTKERNELAPI
-VOID
+BOOLEAN
NTAPI
-SeImpersonateClient (
- IN PSECURITY_CLIENT_CONTEXT ClientContext,
- IN PETHREAD ServerThread OPTIONAL
+FsRtlIsFatDbcsLegal (
+ IN ANSI_STRING DbcsName,
+ IN BOOLEAN WildCardsPermissible,
+ IN BOOLEAN PathNamePermissible,
+ IN BOOLEAN LeadingBackslashPermissible
);
-#if (VER_PRODUCTBUILD >= 2195)
+extern PUSHORT NlsOemLeadByteInfo;
NTKERNELAPI
-NTSTATUS
+BOOLEAN
NTAPI
-SeImpersonateClientEx (
- IN PSECURITY_CLIENT_CONTEXT ClientContext,
- IN PETHREAD ServerThread OPTIONAL
+FsRtlMdlReadComplete (
+ IN PFILE_OBJECT FileObject,
+ IN PMDL MdlChain
);
-#endif /* (VER_PRODUCTBUILD >= 2195) */
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlMdlWriteComplete (
+ IN PFILE_OBJECT FileObject,
+ IN PLARGE_INTEGER FileOffset,
+ IN PMDL MdlChain
+);
NTKERNELAPI
VOID
NTAPI
-SeLockSubjectContext (
- IN PSECURITY_SUBJECT_CONTEXT SubjectContext
+FsRtlNotifyChangeDirectory (
+ IN PNOTIFY_SYNC NotifySync,
+ IN PVOID FsContext,
+ IN PSTRING FullDirectoryName,
+ IN PLIST_ENTRY NotifyList,
+ IN BOOLEAN WatchTree,
+ IN ULONG CompletionFilter,
+ IN PIRP NotifyIrp
);
NTKERNELAPI
NTSTATUS
NTAPI
-SeMarkLogonSessionForTerminationNotification (
- IN PLUID LogonId
+IoAttachDeviceToDeviceStackSafe(
+ IN PDEVICE_OBJECT SourceDevice,
+ IN PDEVICE_OBJECT TargetDevice,
+ OUT PDEVICE_OBJECT *AttachedToDeviceObject
);
NTKERNELAPI
-VOID
+NTSTATUS
NTAPI
-SeOpenObjectAuditAlarm (
- IN PUNICODE_STRING ObjectTypeName,
- IN PVOID Object OPTIONAL,
- IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
- IN PSECURITY_DESCRIPTOR SecurityDescriptor,
- IN PACCESS_STATE AccessState,
- IN BOOLEAN ObjectCreated,
- IN BOOLEAN AccessGranted,
+ObCreateObject (
+ IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL,
+ IN POBJECT_TYPE ObjectType,
+ IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN KPROCESSOR_MODE AccessMode,
- OUT PBOOLEAN GenerateOnClose
+ IN OUT PVOID ParseContext OPTIONAL,
+ IN ULONG ObjectSize,
+ IN ULONG PagedPoolCharge OPTIONAL,
+ IN ULONG NonPagedPoolCharge OPTIONAL,
+ OUT PVOID *Object
);
NTKERNELAPI
-VOID
+ULONG
NTAPI
-SeOpenObjectForDeleteAuditAlarm (
- IN PUNICODE_STRING ObjectTypeName,
- IN PVOID Object OPTIONAL,
- IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
- IN PSECURITY_DESCRIPTOR SecurityDescriptor,
- IN PACCESS_STATE AccessState,
- IN BOOLEAN ObjectCreated,
- IN BOOLEAN AccessGranted,
- IN KPROCESSOR_MODE AccessMode,
- OUT PBOOLEAN GenerateOnClose
+ObGetObjectPointerCount (
+ IN PVOID Object
);
NTKERNELAPI
-BOOLEAN
+NTSTATUS
NTAPI
-SePrivilegeCheck (
- IN OUT PPRIVILEGE_SET RequiredPrivileges,
- IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
- IN KPROCESSOR_MODE AccessMode
+ObReferenceObjectByName (
+ IN PUNICODE_STRING ObjectName,
+ IN ULONG Attributes,
+ IN PACCESS_STATE PassedAccessState OPTIONAL,
+ IN ACCESS_MASK DesiredAccess OPTIONAL,
+ IN POBJECT_TYPE ObjectType,
+ IN KPROCESSOR_MODE AccessMode,
+ IN OUT PVOID ParseContext OPTIONAL,
+ OUT PVOID *Object
);
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
NTKERNELAPI
NTSTATUS
NTAPI
-SeQueryAuthenticationIdToken (
- IN PACCESS_TOKEN Token,
- OUT PLUID LogonId
-);
+PsAssignImpersonationToken(
+ IN PETHREAD Thread,
+ IN HANDLE Token OPTIONAL);
-#if (VER_PRODUCTBUILD >= 2195)
+NTKERNELAPI
+HANDLE
+NTAPI
+PsReferencePrimaryToken(
+ IN OUT PEPROCESS Process);
+
+#endif
+
+#define PsDereferenceImpersonationToken(T) \
+ {if (ARGUMENT_PRESENT(T)) { \
+ (ObDereferenceObject((T))); \
+ } else { \
+ ; \
+ } \
+}
NTKERNELAPI
NTSTATUS
NTAPI
-SeQueryInformationToken (
- IN PACCESS_TOKEN Token,
- IN TOKEN_INFORMATION_CLASS TokenInformationClass,
- OUT PVOID *TokenInformation
+PsLookupProcessThreadByCid (
+ IN PCLIENT_ID Cid,
+ OUT PEPROCESS *Process OPTIONAL,
+ OUT PETHREAD *Thread
);
-#endif /* (VER_PRODUCTBUILD >= 2195) */
+NTSYSAPI
+VOID
+NTAPI
+RtlSecondsSince1970ToTime (
+ IN ULONG SecondsSince1970,
+ OUT PLARGE_INTEGER Time
+);
-NTKERNELAPI
+NTSYSAPI
NTSTATUS
NTAPI
-SeQuerySecurityDescriptorInfo (
- IN PSECURITY_INFORMATION SecurityInformation,
- OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
- IN OUT PULONG Length,
- IN PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor
+RtlSetSaclSecurityDescriptor (
+ IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
+ IN BOOLEAN SaclPresent,
+ IN PACL Sacl,
+ IN BOOLEAN SaclDefaulted
);
-#if (VER_PRODUCTBUILD >= 2195)
-
-NTKERNELAPI
+NTSYSAPI
NTSTATUS
NTAPI
-SeQuerySessionIdToken (
- IN PACCESS_TOKEN Token,
- IN PULONG SessionId
+RtlUnicodeStringToCountedOemString (
+ IN OUT POEM_STRING DestinationString,
+ IN PCUNICODE_STRING SourceString,
+ IN BOOLEAN AllocateDestinationString
);
-#endif /* (VER_PRODUCTBUILD >= 2195) */
+/* RTL Splay Tree Functions */
+NTSYSAPI
+PRTL_SPLAY_LINKS
+NTAPI
+RtlSplay(PRTL_SPLAY_LINKS Links);
-#define SeQuerySubjectContextToken( SubjectContext ) \
- ( ARGUMENT_PRESENT( \
- ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken \
- ) ? \
- ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken : \
- ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
+NTSYSAPI
+PRTL_SPLAY_LINKS
+NTAPI
+RtlDelete(PRTL_SPLAY_LINKS Links);
-typedef NTSTATUS (NTAPI *PSE_LOGON_SESSION_TERMINATED_ROUTINE) (
- IN PLUID LogonId
+NTSYSAPI
+VOID
+NTAPI
+RtlDeleteNoSplay(
+ PRTL_SPLAY_LINKS Links,
+ PRTL_SPLAY_LINKS *Root
);
-NTKERNELAPI
-NTSTATUS
+NTSYSAPI
+PRTL_SPLAY_LINKS
NTAPI
-SeRegisterLogonSessionTerminatedRoutine (
- IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
-);
+RtlSubtreeSuccessor(PRTL_SPLAY_LINKS Links);
-NTKERNELAPI
-VOID
+NTSYSAPI
+PRTL_SPLAY_LINKS
NTAPI
-SeReleaseSubjectContext (
- IN PSECURITY_SUBJECT_CONTEXT SubjectContext
-);
+RtlSubtreePredecessor(PRTL_SPLAY_LINKS Links);
-NTKERNELAPI
-VOID
+NTSYSAPI
+PRTL_SPLAY_LINKS
NTAPI
-SeSetAccessStateGenericMapping (
- PACCESS_STATE AccessState,
- PGENERIC_MAPPING GenericMapping
-);
+RtlRealSuccessor(PRTL_SPLAY_LINKS Links);
-NTKERNELAPI
-NTSTATUS
+NTSYSAPI
+PRTL_SPLAY_LINKS
NTAPI
-SeSetSecurityDescriptorInfo (
- IN PVOID Object OPTIONAL,
- IN PSECURITY_INFORMATION SecurityInformation,
- IN PSECURITY_DESCRIPTOR SecurityDescriptor,
- IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
- IN POOL_TYPE PoolType,
- IN PGENERIC_MAPPING GenericMapping
-);
+RtlRealPredecessor(PRTL_SPLAY_LINKS Links);
-#if (VER_PRODUCTBUILD >= 2195)
+#define RtlIsLeftChild(Links) \
+ (RtlLeftChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
-NTKERNELAPI
-NTSTATUS
-NTAPI
-SeSetSecurityDescriptorInfoEx (
- IN PVOID Object OPTIONAL,
- IN PSECURITY_INFORMATION SecurityInformation,
- IN PSECURITY_DESCRIPTOR ModificationDescriptor,
- IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
- IN ULONG AutoInheritFlags,
- IN POOL_TYPE PoolType,
- IN PGENERIC_MAPPING GenericMapping
-);
+#define RtlIsRightChild(Links) \
+ (RtlRightChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
-NTKERNELAPI
-BOOLEAN
-NTAPI
-SeTokenIsAdmin (
- IN PACCESS_TOKEN Token
-);
+#define RtlRightChild(Links) \
+ ((PRTL_SPLAY_LINKS)(Links))->RightChild
-NTKERNELAPI
-BOOLEAN
-NTAPI
-SeTokenIsRestricted (
- IN PACCESS_TOKEN Token
-);
+#define RtlIsRoot(Links) \
+ (RtlParent(Links) == (PRTL_SPLAY_LINKS)(Links))
+#define RtlLeftChild(Links) \
+ ((PRTL_SPLAY_LINKS)(Links))->LeftChild
-NTSTATUS
-NTAPI
-SeLocateProcessImageName(
- IN PEPROCESS Process,
- OUT PUNICODE_STRING *pImageFileName
-);
+#define RtlParent(Links) \
+ ((PRTL_SPLAY_LINKS)(Links))->Parent
-#endif /* (VER_PRODUCTBUILD >= 2195) */
+#define RtlInitializeSplayLinks(Links) \
+ { \
+ PRTL_SPLAY_LINKS _SplayLinks; \
+ _SplayLinks = (PRTL_SPLAY_LINKS)(Links); \
+ _SplayLinks->Parent = _SplayLinks; \
+ _SplayLinks->LeftChild = NULL; \
+ _SplayLinks->RightChild = NULL; \
+ }
-NTKERNELAPI
-TOKEN_TYPE
-NTAPI
-SeTokenType (
- IN PACCESS_TOKEN Token
-);
+#define RtlInsertAsLeftChild(ParentLinks,ChildLinks) \
+ { \
+ PRTL_SPLAY_LINKS _SplayParent; \
+ PRTL_SPLAY_LINKS _SplayChild; \
+ _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
+ _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \
+ _SplayParent->LeftChild = _SplayChild; \
+ _SplayChild->Parent = _SplayParent; \
+ }
-NTKERNELAPI
-VOID
-NTAPI
-SeUnlockSubjectContext (
- IN PSECURITY_SUBJECT_CONTEXT SubjectContext
-);
+#define RtlInsertAsRightChild(ParentLinks,ChildLinks) \
+ { \
+ PRTL_SPLAY_LINKS _SplayParent; \
+ PRTL_SPLAY_LINKS _SplayChild; \
+ _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
+ _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \
+ _SplayParent->RightChild = _SplayChild; \
+ _SplayChild->Parent = _SplayParent; \
+ }
-NTKERNELAPI
-NTSTATUS
-NTAPI
-SeUnregisterLogonSessionTerminatedRoutine (
- IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
-);
+//
+// RTL time functions
+//
+
+#define SeEnableAccessToExports() SeExports = *(PSE_EXPORTS *)SeExports;
#if (VER_PRODUCTBUILD >= 2195)
IN HANDLE ThreadHandle
);
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwAllocateVirtualMemory (
- IN HANDLE ProcessHandle,
- IN OUT PVOID *BaseAddress,
- IN ULONG_PTR ZeroBits,
- IN OUT PSIZE_T RegionSize,
- IN ULONG AllocationType,
- IN ULONG Protect
-);
-
NTSYSAPI
NTSTATUS
NTAPI
IN BOOLEAN GenerateOnClose
);
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwCreateSection (
- OUT PHANDLE SectionHandle,
- IN ACCESS_MASK DesiredAccess,
- IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
- IN PLARGE_INTEGER MaximumSize OPTIONAL,
- IN ULONG SectionPageProtection,
- IN ULONG AllocationAttributes,
- IN HANDLE FileHandle OPTIONAL
-);
-
NTSYSAPI
NTSTATUS
NTAPI
IN PUNICODE_STRING TargetName
);
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwDeleteFile (
- IN POBJECT_ATTRIBUTES ObjectAttributes
-);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwDeleteValueKey (
- IN HANDLE Handle,
- IN PUNICODE_STRING Name
-);
-
-
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwDeviceIoControlFile (
- IN HANDLE FileHandle,
- IN HANDLE Event OPTIONAL,
- IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
- IN PVOID ApcContext OPTIONAL,
- OUT PIO_STATUS_BLOCK IoStatusBlock,
- IN ULONG IoControlCode,
- IN PVOID InputBuffer OPTIONAL,
- IN ULONG InputBufferLength,
- OUT PVOID OutputBuffer OPTIONAL,
- IN ULONG OutputBufferLength);
-#endif
-
NTSYSAPI
NTSTATUS
NTAPI
IN PUNICODE_STRING String
);
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwDuplicateObject (
- IN HANDLE SourceProcessHandle,
- IN HANDLE SourceHandle,
- IN HANDLE TargetProcessHandle OPTIONAL,
- OUT PHANDLE TargetHandle OPTIONAL,
- IN ACCESS_MASK DesiredAccess,
- IN ULONG HandleAttributes,
- IN ULONG Options
-);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwDuplicateToken (
- IN HANDLE ExistingTokenHandle,
- IN ACCESS_MASK DesiredAccess,
- IN POBJECT_ATTRIBUTES ObjectAttributes,
- IN BOOLEAN EffectiveOnly,
- IN TOKEN_TYPE TokenType,
- OUT PHANDLE NewTokenHandle
-);
-
NTSYSAPI
NTSTATUS
NTAPI
#if (VER_PRODUCTBUILD >= 2195)
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwFlushVirtualMemory (
- IN HANDLE ProcessHandle,
- IN OUT PVOID *BaseAddress,
- IN OUT PULONG FlushSize,
- OUT PIO_STATUS_BLOCK IoStatusBlock
-);
-
-#endif /* (VER_PRODUCTBUILD >= 2195) */
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwFreeVirtualMemory (
- IN HANDLE ProcessHandle,
- IN OUT PVOID *BaseAddress,
- IN OUT PSIZE_T RegionSize,
- IN ULONG FreeType
-);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwFsControlFile (
- IN HANDLE FileHandle,
- IN HANDLE Event OPTIONAL,
- IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
- IN PVOID ApcContext OPTIONAL,
- OUT PIO_STATUS_BLOCK IoStatusBlock,
- IN ULONG FsControlCode,
- IN PVOID InputBuffer OPTIONAL,
- IN ULONG InputBufferLength,
- OUT PVOID OutputBuffer OPTIONAL,
- IN ULONG OutputBufferLength
-);
-
-#if (VER_PRODUCTBUILD >= 2195)
-
NTSYSAPI
NTSTATUS
NTAPI
#endif /* (VER_PRODUCTBUILD >= 2195) */
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwLoadDriver (
- /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
- IN PUNICODE_STRING RegistryPath
-);
-
NTSYSAPI
NTSTATUS
NTAPI
IN POBJECT_ATTRIBUTES FileObjectAttributes
);
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwNotifyChangeKey (
- IN HANDLE KeyHandle,
- IN HANDLE EventHandle OPTIONAL,
- IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
- IN PVOID ApcContext OPTIONAL,
- OUT PIO_STATUS_BLOCK IoStatusBlock,
- IN ULONG NotifyFilter,
- IN BOOLEAN WatchSubtree,
- IN PVOID Buffer,
- IN ULONG BufferLength,
- IN BOOLEAN Asynchronous
-);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwOpenDirectoryObject (
- OUT PHANDLE DirectoryHandle,
- IN ACCESS_MASK DesiredAccess,
- IN POBJECT_ATTRIBUTES ObjectAttributes
-);
-
NTSYSAPI
NTSTATUS
NTAPI
OUT PLCID Locale
);
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwQueryDirectoryFile (
- IN HANDLE FileHandle,
- IN HANDLE Event OPTIONAL,
- IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
- IN PVOID ApcContext OPTIONAL,
- OUT PIO_STATUS_BLOCK IoStatusBlock,
- OUT PVOID FileInformation,
- IN ULONG Length,
- IN FILE_INFORMATION_CLASS FileInformationClass,
- IN BOOLEAN ReturnSingleEntry,
- IN PUNICODE_STRING FileName OPTIONAL,
- IN BOOLEAN RestartScan
-);
-
#if (VER_PRODUCTBUILD >= 2195)
NTSYSAPI
OUT PULONG ReturnLength OPTIONAL
);
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwQueryEaFile (
- IN HANDLE FileHandle,
- OUT PIO_STATUS_BLOCK IoStatusBlock,
- OUT PVOID Buffer,
- IN ULONG Length,
- IN BOOLEAN ReturnSingleEntry,
- IN PVOID EaList OPTIONAL,
- IN ULONG EaListLength,
- IN PULONG EaIndex OPTIONAL,
- IN BOOLEAN RestartScan
-);
-
#endif /* (VER_PRODUCTBUILD >= 2195) */
NTSYSAPI
OUT PULONG ReturnLength OPTIONAL
);
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwQueryInformationToken (
- IN HANDLE TokenHandle,
- IN TOKEN_INFORMATION_CLASS TokenInformationClass,
- OUT PVOID TokenInformation,
- IN ULONG Length,
- OUT PULONG ResultLength
-);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwQuerySecurityObject (
- IN HANDLE FileHandle,
- IN SECURITY_INFORMATION SecurityInformation,
- OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
- IN ULONG Length,
- OUT PULONG ResultLength
-);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwQueryVolumeInformationFile (
- IN HANDLE FileHandle,
- OUT PIO_STATUS_BLOCK IoStatusBlock,
- OUT PVOID FsInformation,
- IN ULONG Length,
- IN FS_INFORMATION_CLASS FsInformationClass
-);
-
NTSYSAPI
NTSTATUS
NTAPI
IN LANGID LanguageId
);
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwSetEaFile (
- IN HANDLE FileHandle,
- OUT PIO_STATUS_BLOCK IoStatusBlock,
- OUT PVOID Buffer,
- IN ULONG Length
-);
-
#endif /* (VER_PRODUCTBUILD >= 2195) */
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwSetEvent (
- IN HANDLE EventHandle,
- OUT PLONG PreviousState OPTIONAL
-);
-
NTSYSAPI
NTSTATUS
NTAPI
IN ULONG ProcessInformationLength
);
-#if (VER_PRODUCTBUILD >= 2195)
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwSetSecurityObject (
- IN HANDLE Handle,
- IN SECURITY_INFORMATION SecurityInformation,
- IN PSECURITY_DESCRIPTOR SecurityDescriptor
-);
-
-#endif /* (VER_PRODUCTBUILD >= 2195) */
-
NTSYSAPI
NTSTATUS
NTAPI
OUT PLARGE_INTEGER OldTime OPTIONAL
);
-#if (VER_PRODUCTBUILD >= 2195)
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwSetVolumeInformationFile (
- IN HANDLE FileHandle,
- OUT PIO_STATUS_BLOCK IoStatusBlock,
- IN PVOID FsInformation,
- IN ULONG Length,
- IN FS_INFORMATION_CLASS FsInformationClass
-);
-
-#endif /* (VER_PRODUCTBUILD >= 2195) */
-
NTSYSAPI
NTSTATUS
NTAPI
IN NTSTATUS ExitStatus
);
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwUnloadDriver (
- /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
- IN PUNICODE_STRING RegistryPath
-);
-
NTSYSAPI
NTSTATUS
NTAPI
IN POBJECT_ATTRIBUTES KeyObjectAttributes
);
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwWaitForSingleObject (
- IN HANDLE Handle,
- IN BOOLEAN Alertable,
- IN PLARGE_INTEGER Timeout OPTIONAL);
-#endif
-
NTSYSAPI
NTSTATUS
NTAPI
projects / reactos.git / blobdiff