@ stdcall RtlGetSecurityDescriptorRMControl(ptr ptr)
@ stdcall RtlGetSetBootStatusData(ptr long long ptr long long)
@ stdcall RtlGetThreadErrorMode()
-@ stdcall -stub RtlGetUnloadEventTrace()
+@ stdcall RtlGetUnloadEventTrace()
@ stdcall RtlGetUserInfoHeap(ptr long ptr ptr ptr)
@ stdcall RtlGetVersion(ptr)
@ stdcall RtlHashUnicodeString(ptr long long ptr)
//
// Unload Event Trace Structure for RtlGetUnloadEventTrace
//
+#define RTL_UNLOAD_EVENT_TRACE_NUMBER 64
+
typedef struct _RTL_UNLOAD_EVENT_TRACE
{
PVOID BaseAddress;
#define NDEBUG
#include <debug.h>
+static RTL_UNLOAD_EVENT_TRACE RtlpUnloadEventTrace[RTL_UNLOAD_EVENT_TRACE_NUMBER];
+
/* FUNCTIONS ******************************************************************/
+PRTL_UNLOAD_EVENT_TRACE
+NTAPI
+RtlGetUnloadEventTrace(VOID)
+{
+ /* Just return a pointer to an array, according to MSDN */
+ return RtlpUnloadEventTrace;
+}
+
BOOLEAN
NTAPI
RtlTraceDatabaseAdd(IN PRTL_TRACE_DATABASE Database,