[XDK]
authorAmine Khaldi <amine.khaldi@reactos.org>
Sat, 27 Mar 2010 15:31:25 +0000 (15:31 +0000)
committerAmine Khaldi <amine.khaldi@reactos.org>
Sat, 27 Mar 2010 15:31:25 +0000 (15:31 +0000)
- Autogenerate ntifs.h based on ntifs.template.h
- Remove some duplicate definitions between WDM and NTDDK.

[DDK]
- Remove wmlib.h
- Reflect the recent XDK changes.

svn path=/branches/header-work/; revision=46490

26 files changed:
include/ddk/ntddk.h
include/ddk/ntifs.h
include/ddk/wdm.h
include/ddk/wmlib.h [deleted file]
include/xdk/ccfuncs.h [new file with mode: 0644]
include/xdk/cctypes.h [new file with mode: 0644]
include/xdk/exfuncs.h
include/xdk/fsrtlfuncs.h [new file with mode: 0644]
include/xdk/fsrtltypes.h [new file with mode: 0644]
include/xdk/generate.bat
include/xdk/iofuncs.h
include/xdk/iotypes.h
include/xdk/kefuncs.h
include/xdk/mmfuncs.h
include/xdk/mmtypes.h
include/xdk/ntddk.template.h
include/xdk/ntifs.template.h [new file with mode: 0644]
include/xdk/obfuncs.h
include/xdk/pofuncs.h
include/xdk/potypes.h
include/xdk/psfuncs.h
include/xdk/rtlfuncs.h
include/xdk/rtltypes.h
include/xdk/sefuncs.h
include/xdk/setypes.h
include/xdk/zwfuncs.h

index ee43630..602a32a 100644 (file)
 #include <ntdef.h>
 #include <ntstatus.h>
 #include <mce.h>
-
-/* FIXME
 #include <bugcodes.h>
 #include <ntiologc.h>
-*/
 
 #include <stdarg.h> // FIXME
 #include <basetyps.h> // FIXME
@@ -2509,7 +2506,6 @@ extern NTKERNELAPI PEPROCESS PsInitialSystemProcess;
  ******************************************************************************/
 
 
-
 #ifndef _RTL_RUN_ONCE_DEF
 #define _RTL_RUN_ONCE_DEF
 
@@ -2875,8 +2871,6 @@ typedef enum _WELL_KNOWN_SID_TYPE {
   WinThisOrganizationCertificateSid = 82,
 } WELL_KNOWN_SID_TYPE;
 
-
-
 #if defined(_M_IX86)
 
 #define PAUSE_PROCESSOR YieldProcessor();
@@ -3330,6 +3324,7 @@ Exfi386InterlockedExchangeUlong(
   IN ULONG  Value);
 #endif
 
+
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 NTKERNELAPI
 NTSTATUS
@@ -3377,6 +3372,7 @@ ExRaiseDatatypeMisalignment(VOID);
 
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
+
 /* Hardware Abstraction Layer Functions */
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
@@ -3878,6 +3874,7 @@ NTAPI
 IoSetThreadHardErrorMode(
   IN BOOLEAN EnableHardErrors);
 
+
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
 #if (NTDDI_VERSION >= NTDDI_WIN2KSP3)
@@ -4023,8 +4020,8 @@ IoGetPagingIoPriority(
   IN PIRP Irp);
 
 #endif /* (NTDDI_VERSION >= NTDDI_WS03) */
-
 #if (NTDDI_VERSION >= NTDDI_WS03SP1)
+
 BOOLEAN
 NTAPI
 IoTranslateBusAddress(
@@ -4033,7 +4030,7 @@ IoTranslateBusAddress(
   IN PHYSICAL_ADDRESS BusAddress,
   IN OUT PULONG AddressSpace,
   OUT PPHYSICAL_ADDRESS TranslatedAddress);
-#endif
+#endif /* (NTDDI_VERSION >= NTDDI_WS03SP1) */
 
 #if (NTDDI_VERSION >= NTDDI_VISTA)
 NTKERNELAPI
@@ -4094,6 +4091,7 @@ IoIsFileObjectIgnoringSharing(
 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
 
 #if (NTDDI_VERSION >= NTDDI_WIN7)
+
 NTSTATUS
 NTAPI
 IoSetFileObjectIgnoreSharing(
@@ -4115,6 +4113,7 @@ DbgPrompt(
 /******************************************************************************
  *                              Kernel Functions                              *
  ******************************************************************************/
+
 NTKERNELAPI
 VOID
 FASTCALL
@@ -4122,7 +4121,6 @@ KeInvalidateRangeAllCaches(
   IN PVOID BaseAddress,
   IN ULONG Length);
 
-
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 
 NTKERNELAPI
@@ -4163,8 +4161,6 @@ VOID
 NTAPI
 KeBugCheck(
   IN ULONG BugCheckCode);
-
-
 #if defined(SINGLE_GROUP_LEGACY_API)
 
 
@@ -4179,22 +4175,20 @@ NTKERNELAPI
 KAFFINITY
 NTAPI
 KeQueryActiveProcessors(VOID);
-
 #endif /* defined(SINGLE_GROUP_LEGACY_API) */
 
 
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
 #if (NTDDI_VERSION >= NTDDI_WINXP)
+
 NTKERNELAPI
 BOOLEAN
 NTAPI
 KeAreApcsDisabled(VOID);
 
-
 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
-
 #if (NTDDI_VERSION >= NTDDI_WS03)
 
 
@@ -4202,9 +4196,7 @@ NTKERNELAPI
 BOOLEAN
 NTAPI
 KeInvalidateAllCaches(VOID);
-
 #endif /* (NTDDI_VERSION >= NTDDI_WS03) */
-
 #if (NTDDI_VERSION >= NTDDI_WS03SP1)
 
 NTKERNELAPI
@@ -4224,14 +4216,11 @@ NTKERNELAPI
 VOID
 NTAPI
 KeLeaveGuardedRegion(VOID);
-
-
 #endif /* (NTDDI_VERSION >= NTDDI_WS03SP1) */
 
 #if (NTDDI_VERSION >= NTDDI_VISTA)
-
-
 #if defined(SINGLE_GROUP_LEGACY_API)
+
 NTKERNELAPI
 ULONG
 NTAPI
@@ -4242,12 +4231,10 @@ NTKERNELAPI
 ULONG
 NTAPI
 KeQueryMaximumProcessorCount(VOID);
-
 #endif /* SINGLE_GROUP_LEGACY_API */
 
 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
 
-
 #if (NTDDI_VERSION >= NTDDI_WIN7)
 
 NTKERNELAPI
@@ -4331,16 +4318,14 @@ KeQueryHardwareCounterConfiguration(
   OUT PHARDWARE_COUNTER CounterArray,
   IN ULONG MaximumCount,
   OUT PULONG Count);
-
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
 
-
 /******************************************************************************
  *                       Memory manager Functions                             *
  ******************************************************************************/
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
+
 NTKERNELAPI
 PPHYSICAL_MEMORY_RANGE
 NTAPI
@@ -4515,78 +4500,17 @@ MmFreeContiguousMemorySpecifyCache(
   IN SIZE_T NumberOfBytes,
   IN MEMORY_CACHING_TYPE CacheType);
 
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
-#if (NTDDI_VERSION >= NTDDI_WINXP)
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-MmAdvanceMdl(
-  IN OUT PMDL Mdl,
-  IN ULONG NumberOfBytes);
-
-NTKERNELAPI
-PVOID
-NTAPI
-MmAllocateMappingAddress(
-  IN SIZE_T NumberOfBytes,
-  IN ULONG PoolTag);
-
-NTKERNELAPI
-VOID
-NTAPI
-MmFreeMappingAddress(
-  IN PVOID BaseAddress,
-  IN ULONG PoolTag);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-MmIsVerifierEnabled(
-  OUT PULONG VerifierFlags);
-
-NTKERNELAPI
-PVOID
-NTAPI
-MmMapLockedPagesWithReservedMapping(
-  IN PVOID MappingAddress,
-  IN ULONG PoolTag,
-  IN PMDL MemoryDescriptorList,
-  IN MEMORY_CACHING_TYPE CacheType);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-MmProtectMdlSystemAddress(
-  IN PMDL MemoryDescriptorList,
-  IN ULONG NewProtect);
-
-NTKERNELAPI
-VOID
-NTAPI
-MmUnmapReservedMapping(
-  IN PVOID BaseAddress,
-  IN ULONG PoolTag,
-  IN PMDL MemoryDescriptorList);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-MmAddVerifierThunks(
-  IN PVOID ThunkBuffer,
-  IN ULONG ThunkBufferSize);
-
-#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
 #if (NTDDI_VERSION >= NTDDI_WS03)
+
 NTKERNELAPI
 NTSTATUS
 NTAPI
 MmCreateMirror(VOID);
-#endif
-
+#endif /* (NTDDI_VERSION >= NTDDI_WS03) */
 
 #if (NTDDI_VERSION >= NTDDI_VISTA)
 NTSTATUS
@@ -4598,8 +4522,7 @@ MmRotatePhysicalView(
   IN MM_ROTATE_DIRECTION Direction,
   IN PMM_ROTATE_COPY_CALLBACK_FUNCTION CopyFunction,
   IN PVOID Context OPTIONAL);
-
-#endif
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
 
 /******************************************************************************
  *                          Process Manager Functions                         *
@@ -4664,9 +4587,7 @@ PsGetVersion(
   OUT PULONG MinorVersion OPTIONAL,
   OUT PULONG BuildNumber OPTIONAL,
   OUT PUNICODE_STRING CSDVersion OPTIONAL);
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
-
 #if (NTDDI_VERSION >= NTDDI_WINXP)
 
 NTKERNELAPI
@@ -4698,7 +4619,6 @@ LONGLONG
 NTAPI
 PsGetProcessCreateTimeQuadPart(
   IN PEPROCESS Process);
-
 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
 #if (NTDDI_VERSION >= NTDDI_WS03)
@@ -4736,8 +4656,8 @@ PsSetCreateProcessNotifyRoutineEx(
  *                         Runtime Library Functions                          *
  ******************************************************************************/
 
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
 
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
 
 
 #ifndef RTL_USE_AVL_TABLES
@@ -4972,13 +4892,13 @@ RtlWalkFrameChain(
   IN ULONG Flags);
 
 
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
 
 #if (NTDDI_VERSION >= NTDDI_WINXP)
 
 
+
 NTSYSAPI
 VOID
 NTAPI
@@ -5086,9 +5006,9 @@ RtlIsGenericTableEmptyAvl(
   IN PRTL_AVL_TABLE Table);
 
 
-
 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
+
 #if (NTDDI_VERSION >= NTDDI_VISTA)
 
 
@@ -5134,7 +5054,6 @@ RtlGetProductInfo(
   OUT PULONG ReturnedProductType);
 
 
-
 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
 
 #if (NTDDI_VERSION >= NTDDI_WIN7)
@@ -5241,7 +5160,6 @@ RtlContractHashTable(
   IN PRTL_DYNAMIC_HASH_TABLE HashTable);
 
 
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
 
 
@@ -5480,6 +5398,7 @@ RtlActiveEnumeratorsHashTable(
  ******************************************************************************/
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
+
 NTKERNELAPI
 BOOLEAN
 NTAPI
@@ -5487,15 +5406,14 @@ SeSinglePrivilegeCheck(
   IN LUID PrivilegeValue,
   IN KPROCESSOR_MODE PreviousMode);
 
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
+
 /******************************************************************************
  *                            ZwXxx Functions                                 *
  ******************************************************************************/
 
 
-
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -5518,10 +5436,8 @@ ZwOpenProcess(
   IN POBJECT_ATTRIBUTES ObjectAttributes,
   IN PCLIENT_ID ClientId OPTIONAL);
 
-
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 
-
 NTSTATUS
 NTAPI
 ZwCancelTimer(
@@ -5604,8 +5520,6 @@ ZwDeviceIoControlFile(
   OUT PVOID OutputBuffer OPTIONAL,
   IN ULONG OutputBufferLength);
 
-
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
 
@@ -5618,8 +5532,6 @@ ZwSetTimerEx(
   IN TIMER_SET_INFORMATION_CLASS TimerSetInformationClass,
   IN OUT PVOID TimerSetInformation,
   IN ULONG TimerSetInformationLength);
-
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
 
 
index 7e14da7..73ae594 100644 (file)
@@ -3,10 +3,11 @@
  *
  * Windows NT Filesystem Driver Developer Kit
  *
- * This file is part of the w32api package.
+ * This file is part of the ReactOS DDK package.
  *
  * Contributors:
- *   Created by Bo Brantén <bosse@acc.umu.se>
+ *   Amine Khaldi
+ *   Timo Kreuzer (timo.kreuzer@reactos.org)
  *
  * THIS SOFTWARE IS NOT COPYRIGHTED
  *
@@ -36,7 +37,8 @@ extern "C" {
 #include <ntnls.h>
 #include <ntstatus.h>
 #include <bugcodes.h>
-/* FIXME : #include <ntiologc.h> */
+#include <ntiologc.h>
+
 
 #ifndef FlagOn
 #define FlagOn(_F,_SF)        ((_F) & (_SF))
@@ -58,6 +60,9 @@ typedef UNICODE_STRING LSA_UNICODE_STRING, *PLSA_UNICODE_STRING;
 typedef STRING LSA_STRING, *PLSA_STRING;
 typedef OBJECT_ATTRIBUTES LSA_OBJECT_ATTRIBUTES, *PLSA_OBJECT_ATTRIBUTES;
 
+/******************************************************************************
+ *                            Security Manager Types                          *
+ ******************************************************************************/
 #ifndef SID_IDENTIFIER_AUTHORITY_DEFINED
 #define SID_IDENTIFIER_AUTHORITY_DEFINED
 typedef struct _SID_IDENTIFIER_AUTHORITY {
@@ -709,1659 +714,1713 @@ typedef enum _MANDATORY_LEVEL {
   MandatoryLevelCount
 } MANDATORY_LEVEL, *PMANDATORY_LEVEL;
 
-typedef enum _OBJECT_INFORMATION_CLASS {
-  ObjectBasicInformation = 0,
-  ObjectNameInformation = 1, /* FIXME, not in WDK */
-  ObjectTypeInformation = 2,
-  ObjectTypesInformation = 3, /* FIXME, not in WDK */
-  ObjectHandleFlagInformation = 4, /* FIXME, not in WDK */
-  ObjectSessionInformation = 5, /* FIXME, not in WDK */
-  MaxObjectInfoClass /* FIXME, not in WDK */
-} OBJECT_INFORMATION_CLASS;
+#define TOKEN_HAS_TRAVERSE_PRIVILEGE    0x0001
+#define TOKEN_HAS_BACKUP_PRIVILEGE      0x0002
+#define TOKEN_HAS_RESTORE_PRIVILEGE     0x0004
+#define TOKEN_WRITE_RESTRICTED          0x0008
+#define TOKEN_IS_RESTRICTED             0x0010
+#define TOKEN_SESSION_NOT_REFERENCED    0x0020
+#define TOKEN_SANDBOX_INERT             0x0040
+#define TOKEN_HAS_IMPERSONATE_PRIVILEGE 0x0080
+#define SE_BACKUP_PRIVILEGES_CHECKED    0x0100
+#define TOKEN_VIRTUALIZE_ALLOWED        0x0200
+#define TOKEN_VIRTUALIZE_ENABLED        0x0400
+#define TOKEN_IS_FILTERED               0x0800
+#define TOKEN_UIACCESS                  0x1000
+#define TOKEN_NOT_LOW                   0x2000
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-NtQueryObject(
-  IN HANDLE Handle OPTIONAL,
-  IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
-  OUT PVOID ObjectInformation OPTIONAL,
-  IN ULONG ObjectInformationLength,
-  OUT PULONG ReturnLength OPTIONAL);
+typedef struct _SE_EXPORTS {
+  LUID SeCreateTokenPrivilege;
+  LUID SeAssignPrimaryTokenPrivilege;
+  LUID SeLockMemoryPrivilege;
+  LUID SeIncreaseQuotaPrivilege;
+  LUID SeUnsolicitedInputPrivilege;
+  LUID SeTcbPrivilege;
+  LUID SeSecurityPrivilege;
+  LUID SeTakeOwnershipPrivilege;
+  LUID SeLoadDriverPrivilege;
+  LUID SeCreatePagefilePrivilege;
+  LUID SeIncreaseBasePriorityPrivilege;
+  LUID SeSystemProfilePrivilege;
+  LUID SeSystemtimePrivilege;
+  LUID SeProfileSingleProcessPrivilege;
+  LUID SeCreatePermanentPrivilege;
+  LUID SeBackupPrivilege;
+  LUID SeRestorePrivilege;
+  LUID SeShutdownPrivilege;
+  LUID SeDebugPrivilege;
+  LUID SeAuditPrivilege;
+  LUID SeSystemEnvironmentPrivilege;
+  LUID SeChangeNotifyPrivilege;
+  LUID SeRemoteShutdownPrivilege;
+  PSID SeNullSid;
+  PSID SeWorldSid;
+  PSID SeLocalSid;
+  PSID SeCreatorOwnerSid;
+  PSID SeCreatorGroupSid;
+  PSID SeNtAuthoritySid;
+  PSID SeDialupSid;
+  PSID SeNetworkSid;
+  PSID SeBatchSid;
+  PSID SeInteractiveSid;
+  PSID SeLocalSystemSid;
+  PSID SeAliasAdminsSid;
+  PSID SeAliasUsersSid;
+  PSID SeAliasGuestsSid;
+  PSID SeAliasPowerUsersSid;
+  PSID SeAliasAccountOpsSid;
+  PSID SeAliasSystemOpsSid;
+  PSID SeAliasPrintOpsSid;
+  PSID SeAliasBackupOpsSid;
+  PSID SeAuthenticatedUsersSid;
+  PSID SeRestrictedSid;
+  PSID SeAnonymousLogonSid;
+  LUID SeUndockPrivilege;
+  LUID SeSyncAgentPrivilege;
+  LUID SeEnableDelegationPrivilege;
+  PSID SeLocalServiceSid;
+  PSID SeNetworkServiceSid;
+  LUID SeManageVolumePrivilege;
+  LUID SeImpersonatePrivilege;
+  LUID SeCreateGlobalPrivilege;
+  LUID SeTrustedCredManAccessPrivilege;
+  LUID SeRelabelPrivilege;
+  LUID SeIncreaseWorkingSetPrivilege;
+  LUID SeTimeZonePrivilege;
+  LUID SeCreateSymbolicLinkPrivilege;
+  PSID SeIUserSid;
+  PSID SeUntrustedMandatorySid;
+  PSID SeLowMandatorySid;
+  PSID SeMediumMandatorySid;
+  PSID SeHighMandatorySid;
+  PSID SeSystemMandatorySid;
+  PSID SeOwnerRightsSid;
+} SE_EXPORTS, *PSE_EXPORTS;
 
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
+typedef NTSTATUS
+(NTAPI *PSE_LOGON_SESSION_TERMINATED_ROUTINE)(
+  IN PLUID LogonId);
+/******************************************************************************
+ *                           Runtime Library Types                            *
+ ******************************************************************************/
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-NtOpenThreadToken(
-  IN HANDLE ThreadHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN BOOLEAN OpenAsSelf,
-  OUT PHANDLE TokenHandle);
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-NtOpenProcessToken(
-  IN HANDLE ProcessHandle,
-  IN ACCESS_MASK DesiredAccess,
-  OUT PHANDLE TokenHandle);
+#define RTL_SYSTEM_VOLUME_INFORMATION_FOLDER    L"System Volume Information"
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-NtQueryInformationToken(
-  IN HANDLE TokenHandle,
-  IN TOKEN_INFORMATION_CLASS TokenInformationClass,
-  OUT PVOID TokenInformation OPTIONAL,
-  IN ULONG TokenInformationLength,
-  OUT PULONG ReturnLength);
+typedef PVOID
+(NTAPI *PRTL_ALLOCATE_STRING_ROUTINE)(
+  IN SIZE_T NumberOfBytes);
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-NtAdjustPrivilegesToken(
-  IN HANDLE TokenHandle,
-  IN BOOLEAN DisableAllPrivileges,
-  IN PTOKEN_PRIVILEGES NewState OPTIONAL,
-  IN ULONG BufferLength,
-  OUT PTOKEN_PRIVILEGES PreviousState,
-  OUT PULONG ReturnLength OPTIONAL);
+#if _WIN32_WINNT >= 0x0600
+typedef PVOID
+(NTAPI *PRTL_REALLOCATE_STRING_ROUTINE)(
+  IN SIZE_T NumberOfBytes,
+  IN PVOID Buffer);
+#endif
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-NtCreateFile(
-  OUT PHANDLE FileHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN POBJECT_ATTRIBUTES ObjectAttributes,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN PLARGE_INTEGER AllocationSize OPTIONAL,
-  IN ULONG FileAttributes,
-  IN ULONG ShareAccess,
-  IN ULONG CreateDisposition,
-  IN ULONG CreateOptions,
-  IN PVOID EaBuffer,
-  IN ULONG EaLength);
+typedef VOID
+(NTAPI *PRTL_FREE_STRING_ROUTINE)(
+  IN PVOID Buffer);
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-NtDeviceIoControlFile(
-  IN HANDLE FileHandle,
-  IN HANDLE Event OPTIONAL,
-  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
-  IN PVOID ApcContext OPTIONAL,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN ULONG IoControlCode,
-  IN PVOID InputBuffer OPTIONAL,
-  IN ULONG InputBufferLength,
-  OUT PVOID OutputBuffer OPTIONAL,
-  IN ULONG OutputBufferLength);
+extern const PRTL_ALLOCATE_STRING_ROUTINE RtlAllocateStringRoutine;
+extern const PRTL_FREE_STRING_ROUTINE RtlFreeStringRoutine;
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-NtFsControlFile(
-  IN HANDLE FileHandle,
-  IN HANDLE Event OPTIONAL,
-  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
-  IN PVOID ApcContext OPTIONAL,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN ULONG FsControlCode,
-  IN PVOID InputBuffer OPTIONAL,
-  IN ULONG InputBufferLength,
-  OUT PVOID OutputBuffer OPTIONAL,
-  IN ULONG OutputBufferLength);
+#if _WIN32_WINNT >= 0x0600
+extern const PRTL_REALLOCATE_STRING_ROUTINE RtlReallocateStringRoutine;
+#endif
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-NtLockFile(
-  IN HANDLE FileHandle,
-  IN HANDLE Event OPTIONAL,
-  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
-  IN PVOID ApcContext OPTIONAL,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN PLARGE_INTEGER ByteOffset,
-  IN PLARGE_INTEGER Length,
-  IN ULONG Key,
-  IN BOOLEAN FailImmediately,
-  IN BOOLEAN ExclusiveLock);
+typedef NTSTATUS
+(NTAPI * PRTL_HEAP_COMMIT_ROUTINE) (
+  IN PVOID Base,
+  IN OUT PVOID *CommitAddress,
+  IN OUT PSIZE_T CommitSize);
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-NtOpenFile(
-  OUT PHANDLE FileHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN POBJECT_ATTRIBUTES ObjectAttributes,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN ULONG ShareAccess,
-  IN ULONG OpenOptions);
+typedef struct _RTL_HEAP_PARAMETERS {
+  ULONG Length;
+  SIZE_T SegmentReserve;
+  SIZE_T SegmentCommit;
+  SIZE_T DeCommitFreeBlockThreshold;
+  SIZE_T DeCommitTotalFreeThreshold;
+  SIZE_T MaximumAllocationSize;
+  SIZE_T VirtualMemoryThreshold;
+  SIZE_T InitialCommit;
+  SIZE_T InitialReserve;
+  PRTL_HEAP_COMMIT_ROUTINE CommitRoutine;
+  SIZE_T Reserved[2];
+} RTL_HEAP_PARAMETERS, *PRTL_HEAP_PARAMETERS;
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-NtQueryDirectoryFile(
-  IN HANDLE FileHandle,
-  IN HANDLE Event OPTIONAL,
-  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
-  IN PVOID ApcContext OPTIONAL,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  OUT PVOID FileInformation,
-  IN ULONG Length,
-  IN FILE_INFORMATION_CLASS FileInformationClass,
-  IN BOOLEAN ReturnSingleEntry,
-  IN PUNICODE_STRING FileName OPTIONAL,
-  IN BOOLEAN RestartScan);
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
 
-NTSYSCALLAPI
-NTSTATUS
+typedef struct _GENERATE_NAME_CONTEXT {
+  USHORT Checksum;
+  BOOLEAN CheckSumInserted;
+  UCHAR NameLength;
+  WCHAR NameBuffer[8];
+  ULONG ExtensionLength;
+  WCHAR ExtensionBuffer[4];
+  ULONG LastIndexValue;
+} GENERATE_NAME_CONTEXT, *PGENERATE_NAME_CONTEXT;
+
+typedef struct _PREFIX_TABLE_ENTRY {
+  CSHORT NodeTypeCode;
+  CSHORT NameLength;
+  struct _PREFIX_TABLE_ENTRY *NextPrefixTree;
+  RTL_SPLAY_LINKS Links;
+  PSTRING Prefix;
+} PREFIX_TABLE_ENTRY, *PPREFIX_TABLE_ENTRY;
+
+typedef struct _PREFIX_TABLE {
+  CSHORT NodeTypeCode;
+  CSHORT NameLength;
+  PPREFIX_TABLE_ENTRY NextPrefixTree;
+} PREFIX_TABLE, *PPREFIX_TABLE;
+
+typedef struct _UNICODE_PREFIX_TABLE_ENTRY {
+  CSHORT NodeTypeCode;
+  CSHORT NameLength;
+  struct _UNICODE_PREFIX_TABLE_ENTRY *NextPrefixTree;
+  struct _UNICODE_PREFIX_TABLE_ENTRY *CaseMatch;
+  RTL_SPLAY_LINKS Links;
+  PUNICODE_STRING Prefix;
+} UNICODE_PREFIX_TABLE_ENTRY, *PUNICODE_PREFIX_TABLE_ENTRY;
+
+typedef struct _UNICODE_PREFIX_TABLE {
+  CSHORT NodeTypeCode;
+  CSHORT NameLength;
+  PUNICODE_PREFIX_TABLE_ENTRY NextPrefixTree;
+  PUNICODE_PREFIX_TABLE_ENTRY LastNextEntry;
+} UNICODE_PREFIX_TABLE, *PUNICODE_PREFIX_TABLE;
+
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+typedef struct _COMPRESSED_DATA_INFO {
+  USHORT CompressionFormatAndEngine;
+  UCHAR CompressionUnitShift;
+  UCHAR ChunkShift;
+  UCHAR ClusterShift;
+  UCHAR Reserved;
+  USHORT NumberOfChunks;
+  ULONG CompressedChunkSizes[ANYSIZE_ARRAY];
+} COMPRESSED_DATA_INFO, *PCOMPRESSED_DATA_INFO;
+#endif
+/******************************************************************************
+ *                         Runtime Library Functions                          *
+ ******************************************************************************/
+
+
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
+
+NTSYSAPI
+PVOID
 NTAPI
-NtQueryInformationFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  OUT PVOID FileInformation,
-  IN ULONG Length,
-  IN FILE_INFORMATION_CLASS FileInformationClass);
+RtlAllocateHeap(
+  IN HANDLE HeapHandle,
+  IN ULONG Flags OPTIONAL,
+  IN SIZE_T Size);
 
-NTSYSCALLAPI
-NTSTATUS
+NTSYSAPI
+BOOLEAN
 NTAPI
-NtQueryQuotaInformationFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  OUT PVOID Buffer,
-  IN ULONG Length,
-  IN BOOLEAN ReturnSingleEntry,
-  IN PVOID SidList,
-  IN ULONG SidListLength,
-  IN PSID StartSid OPTIONAL,
-  IN BOOLEAN RestartScan);
+RtlFreeHeap(
+  IN PVOID HeapHandle,
+  IN ULONG Flags OPTIONAL,
+  IN PVOID BaseAddress);
 
-NTSYSCALLAPI
-NTSTATUS
+NTSYSAPI
+VOID
 NTAPI
-NtQueryVolumeInformationFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  OUT PVOID FsInformation,
-  IN ULONG Length,
-  IN FS_INFORMATION_CLASS FsInformationClass);
+RtlCaptureContext(
+  OUT PCONTEXT ContextRecord);
 
-NTSYSCALLAPI
-NTSTATUS
+NTSYSAPI
+ULONG
 NTAPI
-NtReadFile(
-  IN HANDLE FileHandle,
-  IN HANDLE Event OPTIONAL,
-  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
-  IN PVOID ApcContext OPTIONAL,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  OUT PVOID Buffer,
-  IN ULONG Length,
-  IN PLARGE_INTEGER ByteOffset OPTIONAL,
-  IN PULONG Key OPTIONAL);
+RtlRandom(
+  IN OUT PULONG Seed);
 
-NTSYSCALLAPI
-NTSTATUS
+NTSYSAPI
+BOOLEAN
 NTAPI
-NtSetInformationFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN PVOID FileInformation,
-  IN ULONG Length,
-  IN FILE_INFORMATION_CLASS FileInformationClass);
+RtlCreateUnicodeString(
+  OUT PUNICODE_STRING DestinationString,
+  IN PCWSTR SourceString);
 
-NTSYSCALLAPI
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtSetQuotaInformationFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN PVOID Buffer,
-  IN ULONG Length);
+RtlAppendStringToString(
+  IN OUT PSTRING Destination,
+  IN const STRING *Source);
 
-NTSYSCALLAPI
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtSetVolumeInformationFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN PVOID FsInformation,
-  IN ULONG Length,
-  IN FS_INFORMATION_CLASS FsInformationClass);
+RtlOemStringToUnicodeString(
+  IN OUT PUNICODE_STRING DestinationString,
+  IN PCOEM_STRING SourceString,
+  IN BOOLEAN AllocateDestinationString);
 
-NTSYSCALLAPI
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtWriteFile(
-  IN HANDLE FileHandle,
-  IN HANDLE Event OPTIONAL,
-  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
-  IN PVOID ApcContext OPTIONAL,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN PVOID Buffer,
-  IN ULONG Length,
-  IN PLARGE_INTEGER ByteOffset OPTIONAL,
-  IN PULONG Key OPTIONAL);
+RtlUnicodeStringToOemString(
+  IN OUT POEM_STRING DestinationString,
+  IN PCUNICODE_STRING SourceString,
+  IN BOOLEAN AllocateDestinationString);
 
-NTSYSCALLAPI
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtUnlockFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN PLARGE_INTEGER ByteOffset,
-  IN PLARGE_INTEGER Length,
-  IN ULONG Key);
+RtlUpcaseUnicodeStringToOemString(
+  IN OUT POEM_STRING DestinationString,
+  IN PCUNICODE_STRING SourceString,
+  IN BOOLEAN AllocateDestinationString);
 
-NTSYSCALLAPI
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtSetSecurityObject(
-  IN HANDLE Handle,
-  IN SECURITY_INFORMATION SecurityInformation,
-  IN PSECURITY_DESCRIPTOR SecurityDescriptor);
+RtlOemStringToCountedUnicodeString(
+  IN OUT PUNICODE_STRING DestinationString,
+  IN PCOEM_STRING SourceString,
+  IN BOOLEAN AllocateDestinationString);
 
-NTSYSCALLAPI
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtQuerySecurityObject(
-  IN HANDLE Handle,
-  IN SECURITY_INFORMATION SecurityInformation,
-  OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
-  IN ULONG Length,
-  OUT PULONG LengthNeeded);
+RtlUnicodeStringToCountedOemString(
+  IN OUT POEM_STRING DestinationString,
+  IN PCUNICODE_STRING SourceString,
+  IN BOOLEAN AllocateDestinationString);
 
-NTSYSCALLAPI
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtClose(
-  IN HANDLE Handle);
+RtlUpcaseUnicodeStringToCountedOemString(
+  IN OUT POEM_STRING DestinationString,
+  IN PCUNICODE_STRING SourceString,
+  IN BOOLEAN AllocateDestinationString);
 
-NTSYSCALLAPI
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtAllocateVirtualMemory(
-  IN HANDLE ProcessHandle,
-  IN OUT PVOID *BaseAddress,
-  IN ULONG_PTR ZeroBits,
-  IN OUT PSIZE_T RegionSize,
-  IN ULONG AllocationType,
-  IN ULONG Protect);
+RtlDowncaseUnicodeString(
+  IN OUT PUNICODE_STRING UniDest,
+  IN PCUNICODE_STRING UniSource,
+  IN BOOLEAN AllocateDestinationString);
 
-NTSYSCALLAPI
-NTSTATUS
+NTSYSAPI
+VOID
 NTAPI
-NtFreeVirtualMemory(
-  IN HANDLE ProcessHandle,
-  IN OUT PVOID *BaseAddress,
-  IN OUT PSIZE_T RegionSize,
-  IN ULONG FreeType);
+RtlFreeOemString (
+  IN OUT POEM_STRING OemString);
 
-#endif
+NTSYSAPI
+ULONG
+NTAPI
+RtlxUnicodeStringToOemSize(
+  IN PCUNICODE_STRING UnicodeString);
 
-#if (NTDDI_VERSION >= NTDDI_WINXP)
+NTSYSAPI
+ULONG
+NTAPI
+RtlxOemStringToUnicodeSize(
+  IN PCOEM_STRING OemString);
 
-NTSYSCALLAPI
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtOpenThreadTokenEx(
-  IN HANDLE ThreadHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN BOOLEAN OpenAsSelf,
-  IN ULONG HandleAttributes,
-  OUT PHANDLE TokenHandle);
+RtlMultiByteToUnicodeN(
+  OUT PWCH UnicodeString,
+  IN ULONG MaxBytesInUnicodeString,
+  OUT PULONG BytesInUnicodeString OPTIONAL,
+  IN const CHAR *MultiByteString,
+  IN ULONG BytesInMultiByteString);
 
-NTSYSCALLAPI
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtOpenProcessTokenEx(
-  IN HANDLE ProcessHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN ULONG HandleAttributes,
-  OUT PHANDLE TokenHandle);
+RtlMultiByteToUnicodeSize(
+  OUT PULONG BytesInUnicodeString,
+  IN const CHAR *MultiByteString,
+  IN ULONG BytesInMultiByteString);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-NtOpenJobObjectToken(
-  IN HANDLE JobHandle,
-  IN ACCESS_MASK DesiredAccess,
-  OUT PHANDLE TokenHandle);
+RtlUnicodeToMultiByteSize(
+  OUT PULONG BytesInMultiByteString,
+  IN PCWCH UnicodeString,
+  IN ULONG BytesInUnicodeString);
 
-NTSYSCALLAPI
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtDuplicateToken(
-  IN HANDLE ExistingTokenHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN POBJECT_ATTRIBUTES ObjectAttributes,
-  IN BOOLEAN EffectiveOnly,
-  IN TOKEN_TYPE TokenType,
-  OUT PHANDLE NewTokenHandle);
+RtlUnicodeToMultiByteN(
+  OUT PCHAR MultiByteString,
+  IN ULONG MaxBytesInMultiByteString,
+  OUT PULONG BytesInMultiByteString OPTIONAL,
+  IN PWCH UnicodeString,
+  IN ULONG BytesInUnicodeString);
 
-NTSYSCALLAPI
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtFilterToken(
-  IN HANDLE ExistingTokenHandle,
-  IN ULONG Flags,
-  IN PTOKEN_GROUPS SidsToDisable OPTIONAL,
-  IN PTOKEN_PRIVILEGES PrivilegesToDelete OPTIONAL,
-  IN PTOKEN_GROUPS RestrictedSids OPTIONAL,
-  OUT PHANDLE NewTokenHandle);
+RtlUpcaseUnicodeToMultiByteN(
+  OUT PCHAR MultiByteString,
+  IN ULONG MaxBytesInMultiByteString,
+  OUT PULONG BytesInMultiByteString OPTIONAL,
+  IN PCWCH UnicodeString,
+  IN ULONG BytesInUnicodeString);
 
-NTSYSCALLAPI
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtImpersonateAnonymousToken(
-  IN HANDLE ThreadHandle);
+RtlOemToUnicodeN(
+  OUT PWSTR UnicodeString,
+  IN ULONG MaxBytesInUnicodeString,
+  OUT PULONG BytesInUnicodeString OPTIONAL,
+  IN PCCH OemString,
+  IN ULONG BytesInOemString);
 
-NTSYSCALLAPI
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtSetInformationToken(
-  IN HANDLE TokenHandle,
-  IN TOKEN_INFORMATION_CLASS TokenInformationClass,
-  IN PVOID TokenInformation,
-  IN ULONG TokenInformationLength);
+RtlUnicodeToOemN(
+  OUT PCHAR OemString,
+  IN ULONG MaxBytesInOemString,
+  OUT PULONG BytesInOemString OPTIONAL,
+  IN PCWCH UnicodeString,
+  IN ULONG BytesInUnicodeString);
 
-NTSYSCALLAPI
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtAdjustGroupsToken(
-  IN HANDLE TokenHandle,
-  IN BOOLEAN ResetToDefault,
-  IN PTOKEN_GROUPS NewState OPTIONAL,
-  IN ULONG BufferLength OPTIONAL,
-  OUT PTOKEN_GROUPS PreviousState,
-  OUT PULONG ReturnLength);
+RtlUpcaseUnicodeToOemN(
+  OUT PCHAR OemString,
+  IN ULONG MaxBytesInOemString,
+  OUT PULONG BytesInOemString OPTIONAL,
+  IN PCWCH UnicodeString,
+  IN ULONG BytesInUnicodeString);
 
-NTSYSCALLAPI
+#if (NTDDI_VERSION >= NTDDI_VISTASP1)
+NTSYSAPI
 NTSTATUS
 NTAPI
-NtPrivilegeCheck(
-  IN HANDLE ClientToken,
-  IN OUT PPRIVILEGE_SET RequiredPrivileges,
-  OUT PBOOLEAN Result);
-
-NTSYSCALLAPI
-NTSTATUS
+RtlGenerate8dot3Name(
+  IN PCUNICODE_STRING Name,
+  IN BOOLEAN AllowExtendedCharacters,
+  IN OUT PGENERATE_NAME_CONTEXT Context,
+  IN OUT PUNICODE_STRING Name8dot3);
+#else
+NTSYSAPI
+VOID
 NTAPI
-NtAccessCheckAndAuditAlarm(
-  IN PUNICODE_STRING SubsystemName,
-  IN PVOID HandleId OPTIONAL,
-  IN PUNICODE_STRING ObjectTypeName,
-  IN PUNICODE_STRING ObjectName,
-  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
-  IN ACCESS_MASK DesiredAccess,
-  IN PGENERIC_MAPPING GenericMapping,
-  IN BOOLEAN ObjectCreation,
-  OUT PACCESS_MASK GrantedAccess,
-  OUT PNTSTATUS AccessStatus,
-  OUT PBOOLEAN GenerateOnClose);
+RtlGenerate8dot3Name(
+  IN PCUNICODE_STRING Name,
+  IN BOOLEAN AllowExtendedCharacters,
+  IN OUT PGENERATE_NAME_CONTEXT Context,
+  IN OUT PUNICODE_STRING Name8dot3);
+#endif
 
-NTSYSCALLAPI
-NTSTATUS
+NTSYSAPI
+BOOLEAN
 NTAPI
-NtAccessCheckByTypeAndAuditAlarm(
-  IN PUNICODE_STRING SubsystemName,
-  IN PVOID HandleId,
-  IN PUNICODE_STRING ObjectTypeName,
-  IN PUNICODE_STRING ObjectName,
-  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
-  IN PSID PrincipalSelfSid OPTIONAL,
-  IN ACCESS_MASK DesiredAccess,
-  IN AUDIT_EVENT_TYPE AuditType,
-  IN ULONG Flags,
-  IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
-  IN ULONG ObjectTypeLength,
-  IN PGENERIC_MAPPING GenericMapping,
-  IN BOOLEAN ObjectCreation,
-  OUT PACCESS_MASK GrantedAccess,
-  OUT PNTSTATUS AccessStatus,
-  OUT PBOOLEAN GenerateOnClose);
+RtlIsNameLegalDOS8Dot3(
+  IN PCUNICODE_STRING Name,
+  IN OUT POEM_STRING OemName OPTIONAL,
+  IN OUT PBOOLEAN NameContainsSpaces OPTIONAL);
 
-NTSYSCALLAPI
-NTSTATUS
+NTSYSAPI
+BOOLEAN
 NTAPI
-NtAccessCheckByTypeResultListAndAuditAlarm(
-  IN PUNICODE_STRING SubsystemName,
-  IN PVOID HandleId OPTIONAL,
-  IN PUNICODE_STRING ObjectTypeName,
-  IN PUNICODE_STRING ObjectName,
-  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
-  IN PSID PrincipalSelfSid OPTIONAL,
-  IN ACCESS_MASK DesiredAccess,
-  IN AUDIT_EVENT_TYPE AuditType,
-  IN ULONG Flags,
-  IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
-  IN ULONG ObjectTypeLength,
-  IN PGENERIC_MAPPING GenericMapping,
-  IN BOOLEAN ObjectCreation,
-  OUT PACCESS_MASK GrantedAccess,
-  OUT PNTSTATUS AccessStatus,
-  OUT PBOOLEAN GenerateOnClose);
+RtlIsValidOemCharacter(
+  IN OUT PWCHAR Char);
 
-NTSTATUS
+NTSYSAPI
+VOID
 NTAPI
-NtAccessCheckByTypeResultListAndAuditAlarmByHandle(
-  IN PUNICODE_STRING SubsystemName,
-  IN PVOID HandleId OPTIONAL,
-  IN HANDLE ClientToken,
-  IN PUNICODE_STRING ObjectTypeName,
-  IN PUNICODE_STRING ObjectName,
-  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
-  IN PSID PrincipalSelfSid OPTIONAL,
-  IN ACCESS_MASK DesiredAccess,
-  IN AUDIT_EVENT_TYPE AuditType,
-  IN ULONG Flags,
-  IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
-  IN ULONG ObjectTypeLength,
-  IN PGENERIC_MAPPING GenericMapping,
-  IN BOOLEAN ObjectCreation,
-  OUT PACCESS_MASK GrantedAccess,
-  OUT PNTSTATUS AccessStatus,
-  OUT PBOOLEAN GenerateOnClose);
+PfxInitialize(
+  OUT PPREFIX_TABLE PrefixTable);
 
-NTSYSCALLAPI
-NTSTATUS
+NTSYSAPI
+BOOLEAN
 NTAPI
-NtOpenObjectAuditAlarm(
-  IN PUNICODE_STRING SubsystemName,
-  IN PVOID HandleId OPTIONAL,
-  IN PUNICODE_STRING ObjectTypeName,
-  IN PUNICODE_STRING ObjectName,
-  IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL,
-  IN HANDLE ClientToken,
-  IN ACCESS_MASK DesiredAccess,
-  IN ACCESS_MASK GrantedAccess,
-  IN PPRIVILEGE_SET Privileges OPTIONAL,
-  IN BOOLEAN ObjectCreation,
-  IN BOOLEAN AccessGranted,
-  OUT PBOOLEAN GenerateOnClose);
+PfxInsertPrefix(
+  IN PPREFIX_TABLE PrefixTable,
+  IN PSTRING Prefix,
+  OUT PPREFIX_TABLE_ENTRY PrefixTableEntry);
 
-NTSYSCALLAPI
-NTSTATUS
+NTSYSAPI
+VOID
 NTAPI
-NtPrivilegeObjectAuditAlarm(
-  IN PUNICODE_STRING SubsystemName,
-  IN PVOID HandleId OPTIONAL,
-  IN HANDLE ClientToken,
-  IN ACCESS_MASK DesiredAccess,
-  IN PPRIVILEGE_SET Privileges,
-  IN BOOLEAN AccessGranted);
+PfxRemovePrefix(
+  IN PPREFIX_TABLE PrefixTable,
+  IN PPREFIX_TABLE_ENTRY PrefixTableEntry);
 
-NTSYSCALLAPI
-NTSTATUS
+NTSYSAPI
+PPREFIX_TABLE_ENTRY
 NTAPI
-NtCloseObjectAuditAlarm(
-  IN PUNICODE_STRING SubsystemName,
-  IN PVOID HandleId OPTIONAL,
-  IN BOOLEAN GenerateOnClose);
+PfxFindPrefix(
+  IN PPREFIX_TABLE PrefixTable,
+  IN PSTRING FullName);
 
-NTSYSCALLAPI
-NTSTATUS
+NTSYSAPI
+VOID
 NTAPI
-NtDeleteObjectAuditAlarm(
-  IN PUNICODE_STRING SubsystemName,
-  IN PVOID HandleId OPTIONAL,
-  IN BOOLEAN GenerateOnClose);
+RtlInitializeUnicodePrefix(
+  OUT PUNICODE_PREFIX_TABLE PrefixTable);
 
-NTSYSCALLAPI
-NTSTATUS
+NTSYSAPI
+BOOLEAN
 NTAPI
-NtPrivilegedServiceAuditAlarm(
-  IN PUNICODE_STRING SubsystemName,
-  IN PUNICODE_STRING ServiceName,
-  IN HANDLE ClientToken,
-  IN PPRIVILEGE_SET Privileges,
-  IN BOOLEAN AccessGranted);
+RtlInsertUnicodePrefix(
+  IN PUNICODE_PREFIX_TABLE PrefixTable,
+  IN PUNICODE_STRING Prefix,
+  OUT PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry);
 
-NTSYSCALLAPI
-NTSTATUS
+NTSYSAPI
+VOID
 NTAPI
-NtSetInformationThread(
-  IN HANDLE ThreadHandle,
-  IN THREADINFOCLASS ThreadInformationClass,
-  IN PVOID ThreadInformation,
-  IN ULONG ThreadInformationLength);
+RtlRemoveUnicodePrefix(
+  IN PUNICODE_PREFIX_TABLE PrefixTable,
+  IN PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry);
 
-NTSYSCALLAPI
-NTSTATUS
+NTSYSAPI
+PUNICODE_PREFIX_TABLE_ENTRY
 NTAPI
-NtCreateSection(
-  OUT PHANDLE SectionHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
-  IN PLARGE_INTEGER MaximumSize OPTIONAL,
-  IN ULONG SectionPageProtection,
-  IN ULONG AllocationAttributes,
-  IN HANDLE FileHandle OPTIONAL);
-
-#endif
+RtlFindUnicodePrefix(
+  IN PUNICODE_PREFIX_TABLE PrefixTable,
+  IN PUNICODE_STRING FullName,
+  IN ULONG CaseInsensitiveIndex);
 
-typedef NTSTATUS
-(NTAPI * PRTL_HEAP_COMMIT_ROUTINE) (
-  IN PVOID Base,
-  IN OUT PVOID *CommitAddress,
-  IN OUT PSIZE_T CommitSize);
+NTSYSAPI
+PUNICODE_PREFIX_TABLE_ENTRY
+NTAPI
+RtlNextUnicodePrefix(
+  IN PUNICODE_PREFIX_TABLE PrefixTable,
+  IN BOOLEAN Restart);
 
-typedef struct _RTL_HEAP_PARAMETERS {
-  ULONG Length;
-  SIZE_T SegmentReserve;
-  SIZE_T SegmentCommit;
-  SIZE_T DeCommitFreeBlockThreshold;
-  SIZE_T DeCommitTotalFreeThreshold;
-  SIZE_T MaximumAllocationSize;
-  SIZE_T VirtualMemoryThreshold;
-  SIZE_T InitialCommit;
-  SIZE_T InitialReserve;
-  PRTL_HEAP_COMMIT_ROUTINE CommitRoutine;
-  SIZE_T Reserved[2];
-} RTL_HEAP_PARAMETERS, *PRTL_HEAP_PARAMETERS;
+NTSYSAPI
+SIZE_T
+NTAPI
+RtlCompareMemoryUlong(
+  IN PVOID Source,
+  IN SIZE_T Length,
+  IN ULONG Pattern);
 
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
+NTSYSAPI
+BOOLEAN
+NTAPI
+RtlTimeToSecondsSince1980(
+  IN PLARGE_INTEGER Time,
+  OUT PULONG ElapsedSeconds);
 
 NTSYSAPI
-PVOID
+VOID
 NTAPI
-RtlAllocateHeap(
-  IN HANDLE HeapHandle,
-  IN ULONG Flags OPTIONAL,
-  IN SIZE_T Size);
+RtlSecondsSince1980ToTime(
+  IN ULONG ElapsedSeconds,
+  OUT PLARGE_INTEGER Time);
 
 NTSYSAPI
 BOOLEAN
 NTAPI
-RtlFreeHeap(
-  IN PVOID HeapHandle,
-  IN ULONG Flags OPTIONAL,
-  IN PVOID BaseAddress);
+RtlTimeToSecondsSince1970(
+  IN PLARGE_INTEGER Time,
+  OUT PULONG ElapsedSeconds);
 
 NTSYSAPI
 VOID
 NTAPI
-RtlCaptureContext(
-  OUT PCONTEXT ContextRecord);
+RtlSecondsSince1970ToTime(
+  IN ULONG ElapsedSeconds,
+  OUT PLARGE_INTEGER Time);
 
 NTSYSAPI
-ULONG
+BOOLEAN
 NTAPI
-RtlRandom(
-  IN OUT PULONG Seed);
+RtlValidSid(
+  IN PSID Sid);
 
 NTSYSAPI
 BOOLEAN
 NTAPI
-RtlCreateUnicodeString(
-  OUT PUNICODE_STRING DestinationString,
-  IN PCWSTR SourceString);
+RtlEqualSid(
+  IN PSID Sid1,
+  IN PSID Sid2);
 
 NTSYSAPI
-NTSTATUS
+BOOLEAN
 NTAPI
-RtlAppendStringToString(
-  IN OUT PSTRING Destination,
-  IN const STRING *Source);
+RtlEqualPrefixSid(
+  IN PSID Sid1,
+  IN PSID Sid2);
 
 NTSYSAPI
-NTSTATUS
+ULONG
 NTAPI
-RtlOemStringToUnicodeString(
-  IN OUT PUNICODE_STRING DestinationString,
-  IN PCOEM_STRING SourceString,
-  IN BOOLEAN AllocateDestinationString);
+RtlLengthRequiredSid(
+  IN ULONG SubAuthorityCount);
 
 NTSYSAPI
-NTSTATUS
+PVOID
 NTAPI
-RtlUnicodeStringToOemString(
-  IN OUT POEM_STRING DestinationString,
-  IN PCUNICODE_STRING SourceString,
-  IN BOOLEAN AllocateDestinationString);
+RtlFreeSid(
+  IN PSID Sid);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlUpcaseUnicodeStringToOemString(
-  IN OUT POEM_STRING DestinationString,
-  IN PCUNICODE_STRING SourceString,
-  IN BOOLEAN AllocateDestinationString);
+RtlAllocateAndInitializeSid(
+  IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,
+  IN UCHAR SubAuthorityCount,
+  IN ULONG SubAuthority0,
+  IN ULONG SubAuthority1,
+  IN ULONG SubAuthority2,
+  IN ULONG SubAuthority3,
+  IN ULONG SubAuthority4,
+  IN ULONG SubAuthority5,
+  IN ULONG SubAuthority6,
+  IN ULONG SubAuthority7,
+  OUT PSID *Sid);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlOemStringToCountedUnicodeString(
-  IN OUT PUNICODE_STRING DestinationString,
-  IN PCOEM_STRING SourceString,
-  IN BOOLEAN AllocateDestinationString);
+RtlInitializeSid(
+  OUT PSID Sid,
+  IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,
+  IN UCHAR SubAuthorityCount);
 
 NTSYSAPI
-NTSTATUS
+PULONG
 NTAPI
-RtlUnicodeStringToCountedOemString(
-  IN OUT POEM_STRING DestinationString,
-  IN PCUNICODE_STRING SourceString,
-  IN BOOLEAN AllocateDestinationString);
+RtlSubAuthoritySid(
+  IN PSID Sid,
+  IN ULONG SubAuthority);
+
+NTSYSAPI
+ULONG
+NTAPI
+RtlLengthSid(
+  IN PSID Sid);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlUpcaseUnicodeStringToCountedOemString(
-  IN OUT POEM_STRING DestinationString,
-  IN PCUNICODE_STRING SourceString,
-  IN BOOLEAN AllocateDestinationString);
+RtlCopySid(
+  IN ULONG Length,
+  IN PSID Destination,
+  IN PSID Source);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlDowncaseUnicodeString(
-  IN OUT PUNICODE_STRING UniDest,
-  IN PCUNICODE_STRING UniSource,
+RtlConvertSidToUnicodeString(
+  IN OUT PUNICODE_STRING UnicodeString,
+  IN PSID Sid,
   IN BOOLEAN AllocateDestinationString);
 
 NTSYSAPI
 VOID
 NTAPI
-RtlFreeOemString (
-  IN OUT POEM_STRING OemString);
+RtlCopyLuid(
+  OUT PLUID DestinationLuid,
+  IN PLUID SourceLuid);
 
 NTSYSAPI
-ULONG
+NTSTATUS
 NTAPI
-RtlxUnicodeStringToOemSize(
-  IN PCUNICODE_STRING UnicodeString);
+RtlCreateAcl(
+  OUT PACL Acl,
+  IN ULONG AclLength,
+  IN ULONG AclRevision);
 
 NTSYSAPI
-ULONG
+NTSTATUS
 NTAPI
-RtlxOemStringToUnicodeSize(
-  IN PCOEM_STRING OemString);
+RtlAddAce(
+  IN OUT PACL Acl,
+  IN ULONG AceRevision,
+  IN ULONG StartingAceIndex,
+  IN PVOID AceList,
+  IN ULONG AceListLength);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlMultiByteToUnicodeN(
-  OUT PWCH UnicodeString,
-  IN ULONG MaxBytesInUnicodeString,
-  OUT PULONG BytesInUnicodeString OPTIONAL,
-  IN const CHAR *MultiByteString,
-  IN ULONG BytesInMultiByteString);
+RtlDeleteAce(
+  IN OUT PACL Acl,
+  IN ULONG AceIndex);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlMultiByteToUnicodeSize(
-  OUT PULONG BytesInUnicodeString,
-  IN const CHAR *MultiByteString,
-  IN ULONG BytesInMultiByteString);
+RtlGetAce(
+  IN PACL Acl,
+  IN ULONG AceIndex,
+  OUT PVOID *Ace);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlUnicodeToMultiByteSize(
-  OUT PULONG BytesInMultiByteString,
-  IN PCWCH UnicodeString,
-  IN ULONG BytesInUnicodeString);
+RtlAddAccessAllowedAce(
+  IN OUT PACL Acl,
+  IN ULONG AceRevision,
+  IN ACCESS_MASK AccessMask,
+  IN PSID Sid);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlUnicodeToMultiByteN(
-  OUT PCHAR MultiByteString,
-  IN ULONG MaxBytesInMultiByteString,
-  OUT PULONG BytesInMultiByteString OPTIONAL,
-  IN PWCH UnicodeString,
-  IN ULONG BytesInUnicodeString);
+RtlAddAccessAllowedAceEx(
+  IN OUT PACL Acl,
+  IN ULONG AceRevision,
+  IN ULONG AceFlags,
+  IN ACCESS_MASK AccessMask,
+  IN PSID Sid);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlUpcaseUnicodeToMultiByteN(
-  OUT PCHAR MultiByteString,
-  IN ULONG MaxBytesInMultiByteString,
-  OUT PULONG BytesInMultiByteString OPTIONAL,
-  IN PCWCH UnicodeString,
-  IN ULONG BytesInUnicodeString);
+RtlCreateSecurityDescriptorRelative(
+  OUT PISECURITY_DESCRIPTOR_RELATIVE SecurityDescriptor,
+  IN ULONG Revision);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlOemToUnicodeN(
-  OUT PWSTR UnicodeString,
-  IN ULONG MaxBytesInUnicodeString,
-  OUT PULONG BytesInUnicodeString OPTIONAL,
-  IN PCCH OemString,
-  IN ULONG BytesInOemString);
+RtlGetDaclSecurityDescriptor(
+  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+  OUT PBOOLEAN DaclPresent,
+  OUT PACL *Dacl,
+  OUT PBOOLEAN DaclDefaulted);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlUnicodeToOemN(
-  OUT PCHAR OemString,
-  IN ULONG MaxBytesInOemString,
-  OUT PULONG BytesInOemString OPTIONAL,
-  IN PCWCH UnicodeString,
-  IN ULONG BytesInUnicodeString);
+RtlSetOwnerSecurityDescriptor(
+  IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
+  IN PSID Owner OPTIONAL,
+  IN BOOLEAN OwnerDefaulted);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlUpcaseUnicodeToOemN(
-  OUT PCHAR OemString,
-  IN ULONG MaxBytesInOemString,
-  OUT PULONG BytesInOemString OPTIONAL,
-  IN PCWCH UnicodeString,
-  IN ULONG BytesInUnicodeString);
-
-typedef struct _GENERATE_NAME_CONTEXT {
-  USHORT Checksum;
-  BOOLEAN CheckSumInserted;
-  UCHAR NameLength;
-  WCHAR NameBuffer[8];
-  ULONG ExtensionLength;
-  WCHAR ExtensionBuffer[4];
-  ULONG LastIndexValue;
-} GENERATE_NAME_CONTEXT, *PGENERATE_NAME_CONTEXT;
+RtlGetOwnerSecurityDescriptor(
+  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+  OUT PSID *Owner,
+  OUT PBOOLEAN OwnerDefaulted);
 
-#if (NTDDI_VERSION >= NTDDI_VISTASP1)
 NTSYSAPI
-NTSTATUS
+ULONG
 NTAPI
-RtlGenerate8dot3Name(
-  IN PCUNICODE_STRING Name,
-  IN BOOLEAN AllowExtendedCharacters,
-  IN OUT PGENERATE_NAME_CONTEXT Context,
-  IN OUT PUNICODE_STRING Name8dot3);
-#else
+RtlNtStatusToDosError(
+  IN NTSTATUS Status);
+
 NTSYSAPI
-VOID
+NTSTATUS
 NTAPI
-RtlGenerate8dot3Name(
-  IN PCUNICODE_STRING Name,
-  IN BOOLEAN AllowExtendedCharacters,
-  IN OUT PGENERATE_NAME_CONTEXT Context,
-  IN OUT PUNICODE_STRING Name8dot3);
-#endif
+RtlCustomCPToUnicodeN(
+  IN PCPTABLEINFO CustomCP,
+  OUT PWCH UnicodeString,
+  IN ULONG MaxBytesInUnicodeString,
+  OUT PULONG BytesInUnicodeString OPTIONAL,
+  IN PCH CustomCPString,
+  IN ULONG BytesInCustomCPString);
 
 NTSYSAPI
-BOOLEAN
+NTSTATUS
 NTAPI
-RtlIsNameLegalDOS8Dot3(
-  IN PCUNICODE_STRING Name,
-  IN OUT POEM_STRING OemName OPTIONAL,
-  IN OUT PBOOLEAN NameContainsSpaces OPTIONAL);
+RtlUnicodeToCustomCPN(
+  IN PCPTABLEINFO CustomCP,
+  OUT PCH CustomCPString,
+  IN ULONG MaxBytesInCustomCPString,
+  OUT PULONG BytesInCustomCPString OPTIONAL,
+  IN PWCH UnicodeString,
+  IN ULONG BytesInUnicodeString);
 
 NTSYSAPI
-BOOLEAN
+NTSTATUS
 NTAPI
-RtlIsValidOemCharacter(
-  IN OUT PWCHAR Char);
-
-typedef struct _PREFIX_TABLE_ENTRY {
-  CSHORT NodeTypeCode;
-  CSHORT NameLength;
-  struct _PREFIX_TABLE_ENTRY *NextPrefixTree;
-  RTL_SPLAY_LINKS Links;
-  PSTRING Prefix;
-} PREFIX_TABLE_ENTRY, *PPREFIX_TABLE_ENTRY;
-
-typedef struct _PREFIX_TABLE {
-  CSHORT NodeTypeCode;
-  CSHORT NameLength;
-  PPREFIX_TABLE_ENTRY NextPrefixTree;
-} PREFIX_TABLE, *PPREFIX_TABLE;
+RtlUpcaseUnicodeToCustomCPN(
+  IN PCPTABLEINFO CustomCP,
+  OUT PCH CustomCPString,
+  IN ULONG MaxBytesInCustomCPString,
+  OUT PULONG BytesInCustomCPString OPTIONAL,
+  IN PWCH UnicodeString,
+  IN ULONG BytesInUnicodeString);
 
 NTSYSAPI
 VOID
 NTAPI
-PfxInitialize(
-  OUT PPREFIX_TABLE PrefixTable);
+RtlInitCodePageTable(
+  IN PUSHORT TableBase,
+  IN OUT PCPTABLEINFO CodePageTable);
 
-NTSYSAPI
-BOOLEAN
-NTAPI
-PfxInsertPrefix(
-  IN PPREFIX_TABLE PrefixTable,
-  IN PSTRING Prefix,
-  OUT PPREFIX_TABLE_ENTRY PrefixTableEntry);
 
-NTSYSAPI
-VOID
-NTAPI
-PfxRemovePrefix(
-  IN PPREFIX_TABLE PrefixTable,
-  IN PPREFIX_TABLE_ENTRY PrefixTableEntry);
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
-NTSYSAPI
-PPREFIX_TABLE_ENTRY
-NTAPI
-PfxFindPrefix(
-  IN PPREFIX_TABLE PrefixTable,
-  IN PSTRING FullName);
 
-typedef struct _UNICODE_PREFIX_TABLE_ENTRY {
-  CSHORT NodeTypeCode;
-  CSHORT NameLength;
-  struct _UNICODE_PREFIX_TABLE_ENTRY *NextPrefixTree;
-  struct _UNICODE_PREFIX_TABLE_ENTRY *CaseMatch;
-  RTL_SPLAY_LINKS Links;
-  PUNICODE_STRING Prefix;
-} UNICODE_PREFIX_TABLE_ENTRY, *PUNICODE_PREFIX_TABLE_ENTRY;
+#if (NTDDI_VERSION >= NTDDI_WINXP)
 
-typedef struct _UNICODE_PREFIX_TABLE {
-  CSHORT NodeTypeCode;
-  CSHORT NameLength;
-  PUNICODE_PREFIX_TABLE_ENTRY NextPrefixTree;
-  PUNICODE_PREFIX_TABLE_ENTRY LastNextEntry;
-} UNICODE_PREFIX_TABLE, *PUNICODE_PREFIX_TABLE;
 
-NTSYSAPI
-VOID
-NTAPI
-RtlInitializeUnicodePrefix(
-  OUT PUNICODE_PREFIX_TABLE PrefixTable);
 
 NTSYSAPI
-BOOLEAN
+PVOID
 NTAPI
-RtlInsertUnicodePrefix(
-  IN PUNICODE_PREFIX_TABLE PrefixTable,
-  IN PUNICODE_STRING Prefix,
-  OUT PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry);
+RtlCreateHeap(
+  IN ULONG Flags,
+  IN PVOID HeapBase OPTIONAL,
+  IN SIZE_T ReserveSize OPTIONAL,
+  IN SIZE_T CommitSize OPTIONAL,
+  IN PVOID Lock OPTIONAL,
+  IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL);
 
 NTSYSAPI
-VOID
+PVOID
 NTAPI
-RtlRemoveUnicodePrefix(
-  IN PUNICODE_PREFIX_TABLE PrefixTable,
-  IN PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry);
+RtlDestroyHeap(
+  IN PVOID HeapHandle);
 
 NTSYSAPI
-PUNICODE_PREFIX_TABLE_ENTRY
+USHORT
 NTAPI
-RtlFindUnicodePrefix(
-  IN PUNICODE_PREFIX_TABLE PrefixTable,
-  IN PUNICODE_STRING FullName,
-  IN ULONG CaseInsensitiveIndex);
+RtlCaptureStackBackTrace(
+  IN ULONG FramesToSkip,
+  IN ULONG FramesToCapture,
+  OUT PVOID *BackTrace,
+  OUT PULONG BackTraceHash OPTIONAL);
 
 NTSYSAPI
-PUNICODE_PREFIX_TABLE_ENTRY
+ULONG
 NTAPI
-RtlNextUnicodePrefix(
-  IN PUNICODE_PREFIX_TABLE PrefixTable,
-  IN BOOLEAN Restart);
+RtlRandomEx(
+  IN OUT PULONG Seed);
 
 NTSYSAPI
-SIZE_T
+NTSTATUS
 NTAPI
-RtlCompareMemoryUlong(
-  IN PVOID Source,
-  IN SIZE_T Length,
-  IN ULONG Pattern);
+RtlInitUnicodeStringEx(
+  OUT PUNICODE_STRING DestinationString,
+  IN PCWSTR SourceString OPTIONAL);
 
 NTSYSAPI
-BOOLEAN
+NTSTATUS
 NTAPI
-RtlTimeToSecondsSince1980(
-  IN PLARGE_INTEGER Time,
-  OUT PULONG ElapsedSeconds);
+RtlValidateUnicodeString(
+  IN ULONG Flags,
+  IN PCUNICODE_STRING String);
 
 NTSYSAPI
-VOID
+NTSTATUS
 NTAPI
-RtlSecondsSince1980ToTime(
-  IN ULONG ElapsedSeconds,
-  OUT PLARGE_INTEGER Time);
+RtlDuplicateUnicodeString(
+  IN ULONG Flags,
+  IN PCUNICODE_STRING SourceString,
+  OUT PUNICODE_STRING DestinationString);
 
 NTSYSAPI
-BOOLEAN
+NTSTATUS
 NTAPI
-RtlTimeToSecondsSince1970(
-  IN PLARGE_INTEGER Time,
-  OUT PULONG ElapsedSeconds);
+RtlGetCompressionWorkSpaceSize(
+  IN USHORT CompressionFormatAndEngine,
+  OUT PULONG CompressBufferWorkSpaceSize,
+  OUT PULONG CompressFragmentWorkSpaceSize);
 
 NTSYSAPI
-VOID
+NTSTATUS
 NTAPI
-RtlSecondsSince1970ToTime(
-  IN ULONG ElapsedSeconds,
-  OUT PLARGE_INTEGER Time);
+RtlCompressBuffer(
+  IN USHORT CompressionFormatAndEngine,
+  IN PUCHAR UncompressedBuffer,
+  IN ULONG UncompressedBufferSize,
+  OUT PUCHAR CompressedBuffer,
+  IN ULONG CompressedBufferSize,
+  IN ULONG UncompressedChunkSize,
+  OUT PULONG FinalCompressedSize,
+  IN PVOID WorkSpace);
 
 NTSYSAPI
-BOOLEAN
+NTSTATUS
 NTAPI
-RtlValidSid(
-  IN PSID Sid);
+RtlDecompressBuffer(
+  IN USHORT CompressionFormat,
+  OUT PUCHAR UncompressedBuffer,
+  IN ULONG UncompressedBufferSize,
+  IN PUCHAR CompressedBuffer,
+  IN ULONG CompressedBufferSize,
+  OUT PULONG FinalUncompressedSize);
 
 NTSYSAPI
-BOOLEAN
+NTSTATUS
 NTAPI
-RtlEqualSid(
-  IN PSID Sid1,
-  IN PSID Sid2);
+RtlDecompressFragment(
+  IN USHORT CompressionFormat,
+  OUT PUCHAR UncompressedFragment,
+  IN ULONG UncompressedFragmentSize,
+  IN PUCHAR CompressedBuffer,
+  IN ULONG CompressedBufferSize,
+  IN ULONG FragmentOffset,
+  OUT PULONG FinalUncompressedSize,
+  IN PVOID WorkSpace);
 
 NTSYSAPI
-BOOLEAN
+NTSTATUS
 NTAPI
-RtlEqualPrefixSid(
-  IN PSID Sid1,
-  IN PSID Sid2);
+RtlDescribeChunk(
+  IN USHORT CompressionFormat,
+  IN OUT PUCHAR *CompressedBuffer,
+  IN PUCHAR EndOfCompressedBufferPlus1,
+  OUT PUCHAR *ChunkBuffer,
+  OUT PULONG ChunkSize);
 
 NTSYSAPI
-ULONG
+NTSTATUS
 NTAPI
-RtlLengthRequiredSid(
-  IN ULONG SubAuthorityCount);
+RtlReserveChunk(
+  IN USHORT CompressionFormat,
+  IN OUT PUCHAR *CompressedBuffer,
+  IN PUCHAR EndOfCompressedBufferPlus1,
+  OUT PUCHAR *ChunkBuffer,
+  IN ULONG ChunkSize);
 
 NTSYSAPI
-PVOID
+NTSTATUS
 NTAPI
-RtlFreeSid(
-  IN PSID Sid);
+RtlDecompressChunks(
+  OUT PUCHAR UncompressedBuffer,
+  IN ULONG UncompressedBufferSize,
+  IN PUCHAR CompressedBuffer,
+  IN ULONG CompressedBufferSize,
+  IN PUCHAR CompressedTail,
+  IN ULONG CompressedTailSize,
+  IN PCOMPRESSED_DATA_INFO CompressedDataInfo);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlAllocateAndInitializeSid(
-  IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,
-  IN UCHAR SubAuthorityCount,
-  IN ULONG SubAuthority0,
-  IN ULONG SubAuthority1,
-  IN ULONG SubAuthority2,
-  IN ULONG SubAuthority3,
-  IN ULONG SubAuthority4,
-  IN ULONG SubAuthority5,
-  IN ULONG SubAuthority6,
-  IN ULONG SubAuthority7,
-  OUT PSID *Sid);
+RtlCompressChunks(
+  IN PUCHAR UncompressedBuffer,
+  IN ULONG UncompressedBufferSize,
+  OUT PUCHAR CompressedBuffer,
+  IN ULONG CompressedBufferSize,
+  IN OUT PCOMPRESSED_DATA_INFO CompressedDataInfo,
+  IN ULONG CompressedDataInfoLength,
+  IN PVOID WorkSpace);
 
 NTSYSAPI
-NTSTATUS
+PSID_IDENTIFIER_AUTHORITY
 NTAPI
-RtlInitializeSid(
-  OUT PSID Sid,
-  IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,
-  IN UCHAR SubAuthorityCount);
+RtlIdentifierAuthoritySid(
+  IN PSID Sid);
 
 NTSYSAPI
-PULONG
+PUCHAR
 NTAPI
-RtlSubAuthoritySid(
-  IN PSID Sid,
-  IN ULONG SubAuthority);
+RtlSubAuthorityCountSid(
+  IN PSID Sid);
 
 NTSYSAPI
 ULONG
 NTAPI
-RtlLengthSid(
-  IN PSID Sid);
+RtlNtStatusToDosErrorNoTeb(
+  IN NTSTATUS Status);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlCopySid(
-  IN ULONG Length,
-  IN PSID Destination,
-  IN PSID Source);
+RtlCreateSystemVolumeInformationFolder(
+  IN PCUNICODE_STRING VolumeRootPath);
+
+#if defined(_M_AMD64)
+
+FORCEINLINE
+VOID
+RtlFillMemoryUlong (
+  OUT PVOID Destination,
+  IN SIZE_T Length,
+  IN ULONG Pattern)
+{
+  PULONG Address = (PULONG)Destination;
+  if ((Length /= 4) != 0) {
+    if (((ULONG64)Address & 4) != 0) {
+      *Address = Pattern;
+      if ((Length -= 1) == 0) {
+        return;
+      }
+    Address += 1;
+    }
+    __stosq((PULONG64)(Address), Pattern | ((ULONG64)Pattern << 32), Length / 2);
+    if ((Length & 1) != 0) Address[Length - 1] = Pattern;
+  }
+  return;
+}
+
+#define RtlFillMemoryUlonglong(Destination, Length, Pattern)                \
+    __stosq((PULONG64)(Destination), Pattern, (Length) / 8)
+
+#else
 
 NTSYSAPI
-NTSTATUS
+VOID
 NTAPI
-RtlConvertSidToUnicodeString(
-  IN OUT PUNICODE_STRING UnicodeString,
-  IN PSID Sid,
-  IN BOOLEAN AllocateDestinationString);
+RtlFillMemoryUlong(
+  OUT PVOID Destination,
+  IN SIZE_T Length,
+  IN ULONG Pattern);
 
 NTSYSAPI
 VOID
 NTAPI
-RtlCopyLuid(
-  OUT PLUID DestinationLuid,
-  IN PLUID SourceLuid);
+RtlFillMemoryUlonglong(
+  OUT PVOID Destination,
+  IN SIZE_T Length,
+  IN ULONGLONG Pattern);
+
+#endif /* defined(_M_AMD64) */
+
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
+#if (NTDDI_VERSION >= NTDDI_WS03)
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlCreateAcl(
-  OUT PACL Acl,
-  IN ULONG AclLength,
-  IN ULONG AclRevision);
+RtlInitAnsiStringEx(
+  OUT PANSI_STRING DestinationString,
+  IN PCSZ SourceString OPTIONAL);
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_WS03SP1)
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlAddAce(
-  IN OUT PACL Acl,
-  IN ULONG AceRevision,
-  IN ULONG StartingAceIndex,
-  IN PVOID AceList,
-  IN ULONG AceListLength);
+RtlGetSaclSecurityDescriptor(
+  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+  OUT PBOOLEAN SaclPresent,
+  OUT PACL *Sacl,
+  OUT PBOOLEAN SaclDefaulted);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlDeleteAce(
-  IN OUT PACL Acl,
-  IN ULONG AceIndex);
+RtlSetGroupSecurityDescriptor(
+  IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
+  IN PSID Group OPTIONAL,
+  IN BOOLEAN GroupDefaulted OPTIONAL);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlGetAce(
-  IN PACL Acl,
-  IN ULONG AceIndex,
-  OUT PVOID *Ace);
+RtlGetGroupSecurityDescriptor(
+  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+  OUT PSID *Group,
+  OUT PBOOLEAN GroupDefaulted);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlAddAccessAllowedAce(
-  IN OUT PACL Acl,
-  IN ULONG AceRevision,
-  IN ACCESS_MASK AccessMask,
-  IN PSID Sid);
+RtlAbsoluteToSelfRelativeSD(
+  IN PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor,
+  OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor OPTIONAL,
+  IN OUT PULONG BufferLength);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlAddAccessAllowedAceEx(
-  IN OUT PACL Acl,
-  IN ULONG AceRevision,
-  IN ULONG AceFlags,
-  IN ACCESS_MASK AccessMask,
-  IN PSID Sid);
+RtlSelfRelativeToAbsoluteSD(
+  IN PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor,
+  OUT PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor OPTIONAL,
+  IN OUT PULONG AbsoluteSecurityDescriptorSize,
+  OUT PACL Dacl OPTIONAL,
+  IN OUT PULONG DaclSize,
+  OUT PACL Sacl OPTIONAL,
+  IN OUT PULONG SaclSize,
+  OUT PSID Owner OPTIONAL,
+  IN OUT PULONG OwnerSize,
+  OUT PSID PrimaryGroup OPTIONAL,
+  IN OUT PULONG PrimaryGroupSize);
+
+#endif /* (NTDDI_VERSION >= NTDDI_WS03SP1) */
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlCreateSecurityDescriptorRelative(
-  OUT PISECURITY_DESCRIPTOR_RELATIVE SecurityDescriptor,
-  IN ULONG Revision);
+RtlNormalizeString(
+  IN ULONG NormForm,
+  IN PCWSTR SourceString,
+  IN LONG SourceStringLength,
+  OUT PWSTR DestinationString,
+  IN OUT PLONG DestinationStringLength);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlGetDaclSecurityDescriptor(
-  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
-  OUT PBOOLEAN DaclPresent,
-  OUT PACL *Dacl,
-  OUT PBOOLEAN DaclDefaulted);
+RtlIsNormalizedString(
+  IN ULONG NormForm,
+  IN PCWSTR SourceString,
+  IN LONG SourceStringLength,
+  OUT PBOOLEAN Normalized);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlSetOwnerSecurityDescriptor(
-  IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
-  IN PSID Owner OPTIONAL,
-  IN BOOLEAN OwnerDefaulted);
+RtlIdnToAscii(
+  IN ULONG Flags,
+  IN PCWSTR SourceString,
+  IN LONG SourceStringLength,
+  OUT PWSTR DestinationString,
+  IN OUT PLONG DestinationStringLength);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlGetOwnerSecurityDescriptor(
-  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
-  OUT PSID *Owner,
-  OUT PBOOLEAN OwnerDefaulted);
+RtlIdnToUnicode(
+  IN ULONG Flags,
+  IN PCWSTR SourceString,
+  IN LONG SourceStringLength,
+  OUT PWSTR DestinationString,
+  IN OUT PLONG DestinationStringLength);
 
 NTSYSAPI
-ULONG
+NTSTATUS
 NTAPI
-RtlNtStatusToDosError(
-  IN NTSTATUS Status);
+RtlIdnToNameprepUnicode(
+  IN ULONG Flags,
+  IN PCWSTR SourceString,
+  IN LONG SourceStringLength,
+  OUT PWSTR DestinationString,
+  IN OUT PLONG DestinationStringLength);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlCustomCPToUnicodeN(
-  IN PCPTABLEINFO CustomCP,
-  OUT PWCH UnicodeString,
-  IN ULONG MaxBytesInUnicodeString,
-  OUT PULONG BytesInUnicodeString OPTIONAL,
-  IN PCH CustomCPString,
-  IN ULONG BytesInCustomCPString);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-RtlUnicodeToCustomCPN(
-  IN PCPTABLEINFO CustomCP,
-  OUT PCH CustomCPString,
-  IN ULONG MaxBytesInCustomCPString,
-  OUT PULONG BytesInCustomCPString OPTIONAL,
-  IN PWCH UnicodeString,
-  IN ULONG BytesInUnicodeString);
+RtlCreateServiceSid(
+  IN PUNICODE_STRING ServiceName,
+  OUT PSID ServiceSid,
+  IN OUT PULONG ServiceSidLength);
 
 NTSYSAPI
-NTSTATUS
+LONG
 NTAPI
-RtlUpcaseUnicodeToCustomCPN(
-  IN PCPTABLEINFO CustomCP,
-  OUT PCH CustomCPString,
-  IN ULONG MaxBytesInCustomCPString,
-  OUT PULONG BytesInCustomCPString OPTIONAL,
-  IN PWCH UnicodeString,
-  IN ULONG BytesInUnicodeString);
+RtlCompareAltitudes(
+  IN PCUNICODE_STRING Altitude1,
+  IN PCUNICODE_STRING Altitude2);
 
-NTSYSAPI
-VOID
-NTAPI
-RtlInitCodePageTable(
-  IN PUSHORT TableBase,
-  IN OUT PCPTABLEINFO CodePageTable);
 
-#endif
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
 
-#if (NTDDI_VERSION >= NTDDI_WINXP)
+#if (NTDDI_VERSION >= NTDDI_WIN7)
 
 NTSYSAPI
-PVOID
+NTSTATUS
 NTAPI
-RtlCreateHeap(
-  IN ULONG Flags,
-  IN PVOID HeapBase OPTIONAL,
-  IN SIZE_T ReserveSize OPTIONAL,
-  IN SIZE_T CommitSize OPTIONAL,
-  IN PVOID Lock OPTIONAL,
-  IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL);
+RtlUnicodeToUTF8N(
+  OUT PCHAR UTF8StringDestination,
+  IN ULONG UTF8StringMaxByteCount,
+  OUT PULONG UTF8StringActualByteCount,
+  IN PCWCH UnicodeStringSource,
+  IN ULONG UnicodeStringByteCount);
 
 NTSYSAPI
-PVOID
+NTSTATUS
 NTAPI
-RtlDestroyHeap(
-  IN PVOID HeapHandle);
+RtlUTF8ToUnicodeN(
+  OUT PWSTR UnicodeStringDestination,
+  IN ULONG UnicodeStringMaxByteCount,
+  OUT PULONG UnicodeStringActualByteCount,
+  IN PCCH UTF8StringSource,
+  IN ULONG UTF8StringByteCount);
 
 NTSYSAPI
-USHORT
+NTSTATUS
 NTAPI
-RtlCaptureStackBackTrace(
-  IN ULONG FramesToSkip,
-  IN ULONG FramesToCapture,
-  OUT PVOID *BackTrace,
-  OUT PULONG BackTraceHash OPTIONAL);
+RtlReplaceSidInSd(
+  IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
+  IN PSID OldSid,
+  IN PSID NewSid,
+  OUT ULONG *NumChanges);
 
 NTSYSAPI
-ULONG
+NTSTATUS
 NTAPI
-RtlRandomEx(
-  IN OUT PULONG Seed);
+RtlCreateVirtualAccountSid(
+  IN PCUNICODE_STRING Name,
+  IN ULONG BaseSubAuthority,
+  OUT PSID Sid,
+  IN OUT PULONG SidLength);
 
-NTSYSAPI
+#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
+
+
+#if defined(_AMD64_) || defined(_IA64_)
+
+
+
+#endif /* defined(_AMD64_) || defined(_IA64_) */
+
+
+
+#define RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE 1
+#define RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING 2
+
+#define RtlUnicodeStringToOemSize(STRING) (NLS_MB_OEM_CODE_PAGE_TAG ?                                \
+                                           RtlxUnicodeStringToOemSize(STRING) :                      \
+                                           ((STRING)->Length + sizeof(UNICODE_NULL)) / sizeof(WCHAR) \
+)
+
+#define RtlOemStringToUnicodeSize(STRING) (                 \
+    NLS_MB_OEM_CODE_PAGE_TAG ?                              \
+    RtlxOemStringToUnicodeSize(STRING) :                    \
+    ((STRING)->Length + sizeof(ANSI_NULL)) * sizeof(WCHAR)  \
+)
+
+#define RtlOemStringToCountedUnicodeSize(STRING) (                    \
+    (ULONG)(RtlOemStringToUnicodeSize(STRING) - sizeof(UNICODE_NULL)) \
+)
+
+#define RtlOffsetToPointer(B,O) ((PCHAR)(((PCHAR)(B)) + ((ULONG_PTR)(O))))
+#define RtlPointerToOffset(B,P) ((ULONG)(((PCHAR)(P)) - ((PCHAR)(B))))
+
+typedef enum _OBJECT_INFORMATION_CLASS {
+  ObjectBasicInformation = 0,
+  ObjectNameInformation = 1, /* FIXME, not in WDK */
+  ObjectTypeInformation = 2,
+  ObjectTypesInformation = 3, /* FIXME, not in WDK */
+  ObjectHandleFlagInformation = 4, /* FIXME, not in WDK */
+  ObjectSessionInformation = 5, /* FIXME, not in WDK */
+  MaxObjectInfoClass /* FIXME, not in WDK */
+} OBJECT_INFORMATION_CLASS;
+
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlInitUnicodeStringEx(
-  OUT PUNICODE_STRING DestinationString,
-  IN PCWSTR SourceString OPTIONAL);
+NtQueryObject(
+  IN HANDLE Handle OPTIONAL,
+  IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
+  OUT PVOID ObjectInformation OPTIONAL,
+  IN ULONG ObjectInformationLength,
+  OUT PULONG ReturnLength OPTIONAL);
 
-NTSYSAPI
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlValidateUnicodeString(
-  IN ULONG Flags,
-  IN PCUNICODE_STRING String);
+NtOpenThreadToken(
+  IN HANDLE ThreadHandle,
+  IN ACCESS_MASK DesiredAccess,
+  IN BOOLEAN OpenAsSelf,
+  OUT PHANDLE TokenHandle);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlDuplicateUnicodeString(
-  IN ULONG Flags,
-  IN PCUNICODE_STRING SourceString,
-  OUT PUNICODE_STRING DestinationString);
+NtOpenProcessToken(
+  IN HANDLE ProcessHandle,
+  IN ACCESS_MASK DesiredAccess,
+  OUT PHANDLE TokenHandle);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlGetCompressionWorkSpaceSize(
-  IN USHORT CompressionFormatAndEngine,
-  OUT PULONG CompressBufferWorkSpaceSize,
-  OUT PULONG CompressFragmentWorkSpaceSize);
+NtQueryInformationToken(
+  IN HANDLE TokenHandle,
+  IN TOKEN_INFORMATION_CLASS TokenInformationClass,
+  OUT PVOID TokenInformation OPTIONAL,
+  IN ULONG TokenInformationLength,
+  OUT PULONG ReturnLength);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlCompressBuffer(
-  IN USHORT CompressionFormatAndEngine,
-  IN PUCHAR UncompressedBuffer,
-  IN ULONG UncompressedBufferSize,
-  OUT PUCHAR CompressedBuffer,
-  IN ULONG CompressedBufferSize,
-  IN ULONG UncompressedChunkSize,
-  OUT PULONG FinalCompressedSize,
-  IN PVOID WorkSpace);
+NtAdjustPrivilegesToken(
+  IN HANDLE TokenHandle,
+  IN BOOLEAN DisableAllPrivileges,
+  IN PTOKEN_PRIVILEGES NewState OPTIONAL,
+  IN ULONG BufferLength,
+  OUT PTOKEN_PRIVILEGES PreviousState,
+  OUT PULONG ReturnLength OPTIONAL);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlDecompressBuffer(
-  IN USHORT CompressionFormat,
-  OUT PUCHAR UncompressedBuffer,
-  IN ULONG UncompressedBufferSize,
-  IN PUCHAR CompressedBuffer,
-  IN ULONG CompressedBufferSize,
-  OUT PULONG FinalUncompressedSize);
+NtCreateFile(
+  OUT PHANDLE FileHandle,
+  IN ACCESS_MASK DesiredAccess,
+  IN POBJECT_ATTRIBUTES ObjectAttributes,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  IN PLARGE_INTEGER AllocationSize OPTIONAL,
+  IN ULONG FileAttributes,
+  IN ULONG ShareAccess,
+  IN ULONG CreateDisposition,
+  IN ULONG CreateOptions,
+  IN PVOID EaBuffer,
+  IN ULONG EaLength);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlDecompressFragment(
-  IN USHORT CompressionFormat,
-  OUT PUCHAR UncompressedFragment,
-  IN ULONG UncompressedFragmentSize,
-  IN PUCHAR CompressedBuffer,
-  IN ULONG CompressedBufferSize,
-  IN ULONG FragmentOffset,
-  OUT PULONG FinalUncompressedSize,
-  IN PVOID WorkSpace);
+NtDeviceIoControlFile(
+  IN HANDLE FileHandle,
+  IN HANDLE Event OPTIONAL,
+  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
+  IN PVOID ApcContext OPTIONAL,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  IN ULONG IoControlCode,
+  IN PVOID InputBuffer OPTIONAL,
+  IN ULONG InputBufferLength,
+  OUT PVOID OutputBuffer OPTIONAL,
+  IN ULONG OutputBufferLength);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlDescribeChunk(
-  IN USHORT CompressionFormat,
-  IN OUT PUCHAR *CompressedBuffer,
-  IN PUCHAR EndOfCompressedBufferPlus1,
-  OUT PUCHAR *ChunkBuffer,
-  OUT PULONG ChunkSize);
+NtFsControlFile(
+  IN HANDLE FileHandle,
+  IN HANDLE Event OPTIONAL,
+  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
+  IN PVOID ApcContext OPTIONAL,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  IN ULONG FsControlCode,
+  IN PVOID InputBuffer OPTIONAL,
+  IN ULONG InputBufferLength,
+  OUT PVOID OutputBuffer OPTIONAL,
+  IN ULONG OutputBufferLength);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlReserveChunk(
-  IN USHORT CompressionFormat,
-  IN OUT PUCHAR *CompressedBuffer,
-  IN PUCHAR EndOfCompressedBufferPlus1,
-  OUT PUCHAR *ChunkBuffer,
-  IN ULONG ChunkSize);
-
-typedef struct _COMPRESSED_DATA_INFO {
-  USHORT CompressionFormatAndEngine;
-  UCHAR CompressionUnitShift;
-  UCHAR ChunkShift;
-  UCHAR ClusterShift;
-  UCHAR Reserved;
-  USHORT NumberOfChunks;
-  ULONG CompressedChunkSizes[ANYSIZE_ARRAY];
-} COMPRESSED_DATA_INFO, *PCOMPRESSED_DATA_INFO;
+NtLockFile(
+  IN HANDLE FileHandle,
+  IN HANDLE Event OPTIONAL,
+  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
+  IN PVOID ApcContext OPTIONAL,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  IN PLARGE_INTEGER ByteOffset,
+  IN PLARGE_INTEGER Length,
+  IN ULONG Key,
+  IN BOOLEAN FailImmediately,
+  IN BOOLEAN ExclusiveLock);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlDecompressChunks(
-  OUT PUCHAR UncompressedBuffer,
-  IN ULONG UncompressedBufferSize,
-  IN PUCHAR CompressedBuffer,
-  IN ULONG CompressedBufferSize,
-  IN PUCHAR CompressedTail,
-  IN ULONG CompressedTailSize,
-  IN PCOMPRESSED_DATA_INFO CompressedDataInfo);
+NtOpenFile(
+  OUT PHANDLE FileHandle,
+  IN ACCESS_MASK DesiredAccess,
+  IN POBJECT_ATTRIBUTES ObjectAttributes,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  IN ULONG ShareAccess,
+  IN ULONG OpenOptions);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlCompressChunks(
-  IN PUCHAR UncompressedBuffer,
-  IN ULONG UncompressedBufferSize,
-  OUT PUCHAR CompressedBuffer,
-  IN ULONG CompressedBufferSize,
-  IN OUT PCOMPRESSED_DATA_INFO CompressedDataInfo,
-  IN ULONG CompressedDataInfoLength,
-  IN PVOID WorkSpace);
+NtQueryDirectoryFile(
+  IN HANDLE FileHandle,
+  IN HANDLE Event OPTIONAL,
+  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
+  IN PVOID ApcContext OPTIONAL,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  OUT PVOID FileInformation,
+  IN ULONG Length,
+  IN FILE_INFORMATION_CLASS FileInformationClass,
+  IN BOOLEAN ReturnSingleEntry,
+  IN PUNICODE_STRING FileName OPTIONAL,
+  IN BOOLEAN RestartScan);
 
-NTSYSAPI
-PSID_IDENTIFIER_AUTHORITY
+NTSYSCALLAPI
+NTSTATUS
 NTAPI
-RtlIdentifierAuthoritySid(
-  IN PSID Sid);
+NtQueryInformationFile(
+  IN HANDLE FileHandle,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  OUT PVOID FileInformation,
+  IN ULONG Length,
+  IN FILE_INFORMATION_CLASS FileInformationClass);
 
-NTSYSAPI
-PUCHAR
+NTSYSCALLAPI
+NTSTATUS
 NTAPI
-RtlSubAuthorityCountSid(
-  IN PSID Sid);
+NtQueryQuotaInformationFile(
+  IN HANDLE FileHandle,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  OUT PVOID Buffer,
+  IN ULONG Length,
+  IN BOOLEAN ReturnSingleEntry,
+  IN PVOID SidList,
+  IN ULONG SidListLength,
+  IN PSID StartSid OPTIONAL,
+  IN BOOLEAN RestartScan);
 
-NTSYSAPI
-ULONG
+NTSYSCALLAPI
+NTSTATUS
 NTAPI
-RtlNtStatusToDosErrorNoTeb(
-  IN NTSTATUS Status);
+NtQueryVolumeInformationFile(
+  IN HANDLE FileHandle,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  OUT PVOID FsInformation,
+  IN ULONG Length,
+  IN FS_INFORMATION_CLASS FsInformationClass);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlCreateSystemVolumeInformationFolder(
-  IN PCUNICODE_STRING VolumeRootPath);
-
-#endif
-
-#if defined(_M_AMD64)
-
-FORCEINLINE
-VOID
-RtlFillMemoryUlong (
-  OUT PVOID Destination,
-  IN SIZE_T Length,
-  IN ULONG Pattern)
-{
-  PULONG Address = (PULONG)Destination;
-  if ((Length /= 4) != 0) {
-    if (((ULONG64)Address & 4) != 0) {
-      *Address = Pattern;
-      if ((Length -= 1) == 0) {
-        return;
-      }
-    Address += 1;
-    }
-    __stosq((PULONG64)(Address), Pattern | ((ULONG64)Pattern << 32), Length / 2);
-    if ((Length & 1) != 0) Address[Length - 1] = Pattern;
-  }
-  return;
-}
-
-#define RtlFillMemoryUlonglong(Destination, Length, Pattern)                \
-    __stosq((PULONG64)(Destination), Pattern, (Length) / 8)
-
-#else
-
-#if (NTDDI_VERSION >= NTDDI_WINXP)
+NtReadFile(
+  IN HANDLE FileHandle,
+  IN HANDLE Event OPTIONAL,
+  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
+  IN PVOID ApcContext OPTIONAL,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  OUT PVOID Buffer,
+  IN ULONG Length,
+  IN PLARGE_INTEGER ByteOffset OPTIONAL,
+  IN PULONG Key OPTIONAL);
 
-NTSYSAPI
-VOID
+NTSYSCALLAPI
+NTSTATUS
 NTAPI
-RtlFillMemoryUlong(
-  OUT PVOID Destination,
-  IN SIZE_T Length,
-  IN ULONG Pattern);
+NtSetInformationFile(
+  IN HANDLE FileHandle,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  IN PVOID FileInformation,
+  IN ULONG Length,
+  IN FILE_INFORMATION_CLASS FileInformationClass);
 
-NTSYSAPI
-VOID
+NTSYSCALLAPI
+NTSTATUS
 NTAPI
-RtlFillMemoryUlonglong(
-  OUT PVOID Destination,
-  IN SIZE_T Length,
-  IN ULONGLONG Pattern);
-
-#endif
-
-#endif // defined(_M_AMD64)
-
-#if (NTDDI_VERSION >= NTDDI_WS03)
+NtSetQuotaInformationFile(
+  IN HANDLE FileHandle,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  IN PVOID Buffer,
+  IN ULONG Length);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlInitAnsiStringEx(
-  OUT PANSI_STRING DestinationString,
-  IN PCSZ SourceString OPTIONAL);
-
-#endif
+NtSetVolumeInformationFile(
+  IN HANDLE FileHandle,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  IN PVOID FsInformation,
+  IN ULONG Length,
+  IN FS_INFORMATION_CLASS FsInformationClass);
 
-#if (NTDDI_VERSION >= NTDDI_WS03SP1)
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtWriteFile(
+  IN HANDLE FileHandle,
+  IN HANDLE Event OPTIONAL,
+  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
+  IN PVOID ApcContext OPTIONAL,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  IN PVOID Buffer,
+  IN ULONG Length,
+  IN PLARGE_INTEGER ByteOffset OPTIONAL,
+  IN PULONG Key OPTIONAL);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlGetSaclSecurityDescriptor(
-  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
-  OUT PBOOLEAN SaclPresent,
-  OUT PACL *Sacl,
-  OUT PBOOLEAN SaclDefaulted);
+NtUnlockFile(
+  IN HANDLE FileHandle,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  IN PLARGE_INTEGER ByteOffset,
+  IN PLARGE_INTEGER Length,
+  IN ULONG Key);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlSetGroupSecurityDescriptor(
-  IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
-  IN PSID Group OPTIONAL,
-  IN BOOLEAN GroupDefaulted OPTIONAL);
+NtSetSecurityObject(
+  IN HANDLE Handle,
+  IN SECURITY_INFORMATION SecurityInformation,
+  IN PSECURITY_DESCRIPTOR SecurityDescriptor);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlGetGroupSecurityDescriptor(
-  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
-  OUT PSID *Group,
-  OUT PBOOLEAN GroupDefaulted);
+NtQuerySecurityObject(
+  IN HANDLE Handle,
+  IN SECURITY_INFORMATION SecurityInformation,
+  OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
+  IN ULONG Length,
+  OUT PULONG LengthNeeded);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlAbsoluteToSelfRelativeSD(
-  IN PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor,
-  OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor OPTIONAL,
-  IN OUT PULONG BufferLength);
+NtClose(
+  IN HANDLE Handle);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlSelfRelativeToAbsoluteSD(
-  IN PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor,
-  OUT PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor OPTIONAL,
-  IN OUT PULONG AbsoluteSecurityDescriptorSize,
-  OUT PACL Dacl OPTIONAL,
-  IN OUT PULONG DaclSize,
-  OUT PACL Sacl OPTIONAL,
-  IN OUT PULONG SaclSize,
-  OUT PSID Owner OPTIONAL,
-  IN OUT PULONG OwnerSize,
-  OUT PSID PrimaryGroup OPTIONAL,
-  IN OUT PULONG PrimaryGroupSize);
+NtAllocateVirtualMemory(
+  IN HANDLE ProcessHandle,
+  IN OUT PVOID *BaseAddress,
+  IN ULONG_PTR ZeroBits,
+  IN OUT PSIZE_T RegionSize,
+  IN ULONG AllocationType,
+  IN ULONG Protect);
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtFreeVirtualMemory(
+  IN HANDLE ProcessHandle,
+  IN OUT PVOID *BaseAddress,
+  IN OUT PSIZE_T RegionSize,
+  IN ULONG FreeType);
 
 #endif
 
-#if (NTDDI_VERSION >= NTDDI_VISTA)
+#if (NTDDI_VERSION >= NTDDI_WINXP)
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlNormalizeString(
-  IN ULONG NormForm,
-  IN PCWSTR SourceString,
-  IN LONG SourceStringLength,
-  OUT PWSTR DestinationString,
-  IN OUT PLONG DestinationStringLength);
+NtOpenThreadTokenEx(
+  IN HANDLE ThreadHandle,
+  IN ACCESS_MASK DesiredAccess,
+  IN BOOLEAN OpenAsSelf,
+  IN ULONG HandleAttributes,
+  OUT PHANDLE TokenHandle);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlIsNormalizedString(
-  IN ULONG NormForm,
-  IN PCWSTR SourceString,
-  IN LONG SourceStringLength,
-  OUT PBOOLEAN Normalized);
+NtOpenProcessTokenEx(
+  IN HANDLE ProcessHandle,
+  IN ACCESS_MASK DesiredAccess,
+  IN ULONG HandleAttributes,
+  OUT PHANDLE TokenHandle);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-RtlIdnToAscii(
-  IN ULONG Flags,
-  IN PCWSTR SourceString,
-  IN LONG SourceStringLength,
-  OUT PWSTR DestinationString,
-  IN OUT PLONG DestinationStringLength);
+NtOpenJobObjectToken(
+  IN HANDLE JobHandle,
+  IN ACCESS_MASK DesiredAccess,
+  OUT PHANDLE TokenHandle);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlIdnToUnicode(
-  IN ULONG Flags,
-  IN PCWSTR SourceString,
-  IN LONG SourceStringLength,
-  OUT PWSTR DestinationString,
-  IN OUT PLONG DestinationStringLength);
+NtDuplicateToken(
+  IN HANDLE ExistingTokenHandle,
+  IN ACCESS_MASK DesiredAccess,
+  IN POBJECT_ATTRIBUTES ObjectAttributes,
+  IN BOOLEAN EffectiveOnly,
+  IN TOKEN_TYPE TokenType,
+  OUT PHANDLE NewTokenHandle);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlIdnToNameprepUnicode(
+NtFilterToken(
+  IN HANDLE ExistingTokenHandle,
   IN ULONG Flags,
-  IN PCWSTR SourceString,
-  IN LONG SourceStringLength,
-  OUT PWSTR DestinationString,
-  IN OUT PLONG DestinationStringLength);
+  IN PTOKEN_GROUPS SidsToDisable OPTIONAL,
+  IN PTOKEN_PRIVILEGES PrivilegesToDelete OPTIONAL,
+  IN PTOKEN_GROUPS RestrictedSids OPTIONAL,
+  OUT PHANDLE NewTokenHandle);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlCreateServiceSid(
-  IN PUNICODE_STRING ServiceName,
-  OUT PSID ServiceSid,
-  IN OUT PULONG ServiceSidLength);
+NtImpersonateAnonymousToken(
+  IN HANDLE ThreadHandle);
 
-NTSYSAPI
-LONG
+NTSYSCALLAPI
+NTSTATUS
 NTAPI
-RtlCompareAltitudes(
-  IN PCUNICODE_STRING Altitude1,
-  IN PCUNICODE_STRING Altitude2);
-
-#endif
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
+NtSetInformationToken(
+  IN HANDLE TokenHandle,
+  IN TOKEN_INFORMATION_CLASS TokenInformationClass,
+  IN PVOID TokenInformation,
+  IN ULONG TokenInformationLength);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlUnicodeToUTF8N(
-  OUT PCHAR UTF8StringDestination,
-  IN ULONG UTF8StringMaxByteCount,
-  OUT PULONG UTF8StringActualByteCount,
-  IN PCWCH UnicodeStringSource,
-  IN ULONG UnicodeStringByteCount);
+NtAdjustGroupsToken(
+  IN HANDLE TokenHandle,
+  IN BOOLEAN ResetToDefault,
+  IN PTOKEN_GROUPS NewState OPTIONAL,
+  IN ULONG BufferLength OPTIONAL,
+  OUT PTOKEN_GROUPS PreviousState,
+  OUT PULONG ReturnLength);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlUTF8ToUnicodeN(
-  OUT PWSTR UnicodeStringDestination,
-  IN ULONG UnicodeStringMaxByteCount,
-  OUT PULONG UnicodeStringActualByteCount,
-  IN PCCH UTF8StringSource,
-  IN ULONG UTF8StringByteCount);
+NtPrivilegeCheck(
+  IN HANDLE ClientToken,
+  IN OUT PPRIVILEGE_SET RequiredPrivileges,
+  OUT PBOOLEAN Result);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlReplaceSidInSd(
-  IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
-  IN PSID OldSid,
-  IN PSID NewSid,
-  OUT ULONG *NumChanges);
+NtAccessCheckAndAuditAlarm(
+  IN PUNICODE_STRING SubsystemName,
+  IN PVOID HandleId OPTIONAL,
+  IN PUNICODE_STRING ObjectTypeName,
+  IN PUNICODE_STRING ObjectName,
+  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+  IN ACCESS_MASK DesiredAccess,
+  IN PGENERIC_MAPPING GenericMapping,
+  IN BOOLEAN ObjectCreation,
+  OUT PACCESS_MASK GrantedAccess,
+  OUT PNTSTATUS AccessStatus,
+  OUT PBOOLEAN GenerateOnClose);
 
-NTSYSAPI
+NTSYSCALLAPI
 NTSTATUS
 NTAPI
-RtlCreateVirtualAccountSid(
-  IN PCUNICODE_STRING Name,
-  IN ULONG BaseSubAuthority,
-  OUT PSID Sid,
-  IN OUT PULONG SidLength);
+NtAccessCheckByTypeAndAuditAlarm(
+  IN PUNICODE_STRING SubsystemName,
+  IN PVOID HandleId,
+  IN PUNICODE_STRING ObjectTypeName,
+  IN PUNICODE_STRING ObjectName,
+  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+  IN PSID PrincipalSelfSid OPTIONAL,
+  IN ACCESS_MASK DesiredAccess,
+  IN AUDIT_EVENT_TYPE AuditType,
+  IN ULONG Flags,
+  IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
+  IN ULONG ObjectTypeLength,
+  IN PGENERIC_MAPPING GenericMapping,
+  IN BOOLEAN ObjectCreation,
+  OUT PACCESS_MASK GrantedAccess,
+  OUT PNTSTATUS AccessStatus,
+  OUT PBOOLEAN GenerateOnClose);
 
-#endif
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtAccessCheckByTypeResultListAndAuditAlarm(
+  IN PUNICODE_STRING SubsystemName,
+  IN PVOID HandleId OPTIONAL,
+  IN PUNICODE_STRING ObjectTypeName,
+  IN PUNICODE_STRING ObjectName,
+  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+  IN PSID PrincipalSelfSid OPTIONAL,
+  IN ACCESS_MASK DesiredAccess,
+  IN AUDIT_EVENT_TYPE AuditType,
+  IN ULONG Flags,
+  IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
+  IN ULONG ObjectTypeLength,
+  IN PGENERIC_MAPPING GenericMapping,
+  IN BOOLEAN ObjectCreation,
+  OUT PACCESS_MASK GrantedAccess,
+  OUT PNTSTATUS AccessStatus,
+  OUT PBOOLEAN GenerateOnClose);
 
-#define HEAP_NO_SERIALIZE               0x00000001
-#define HEAP_GROWABLE                   0x00000002
-#define HEAP_GENERATE_EXCEPTIONS        0x00000004
-#define HEAP_ZERO_MEMORY                0x00000008
-#define HEAP_REALLOC_IN_PLACE_ONLY      0x00000010
-#define HEAP_TAIL_CHECKING_ENABLED      0x00000020
-#define HEAP_FREE_CHECKING_ENABLED      0x00000040
-#define HEAP_DISABLE_COALESCE_ON_FREE   0x00000080
+NTSTATUS
+NTAPI
+NtAccessCheckByTypeResultListAndAuditAlarmByHandle(
+  IN PUNICODE_STRING SubsystemName,
+  IN PVOID HandleId OPTIONAL,
+  IN HANDLE ClientToken,
+  IN PUNICODE_STRING ObjectTypeName,
+  IN PUNICODE_STRING ObjectName,
+  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+  IN PSID PrincipalSelfSid OPTIONAL,
+  IN ACCESS_MASK DesiredAccess,
+  IN AUDIT_EVENT_TYPE AuditType,
+  IN ULONG Flags,
+  IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
+  IN ULONG ObjectTypeLength,
+  IN PGENERIC_MAPPING GenericMapping,
+  IN BOOLEAN ObjectCreation,
+  OUT PACCESS_MASK GrantedAccess,
+  OUT PNTSTATUS AccessStatus,
+  OUT PBOOLEAN GenerateOnClose);
 
-#define HEAP_CREATE_ALIGN_16            0x00010000
-#define HEAP_CREATE_ENABLE_TRACING      0x00020000
-#define HEAP_CREATE_ENABLE_EXECUTE      0x00040000
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtOpenObjectAuditAlarm(
+  IN PUNICODE_STRING SubsystemName,
+  IN PVOID HandleId OPTIONAL,
+  IN PUNICODE_STRING ObjectTypeName,
+  IN PUNICODE_STRING ObjectName,
+  IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL,
+  IN HANDLE ClientToken,
+  IN ACCESS_MASK DesiredAccess,
+  IN ACCESS_MASK GrantedAccess,
+  IN PPRIVILEGE_SET Privileges OPTIONAL,
+  IN BOOLEAN ObjectCreation,
+  IN BOOLEAN AccessGranted,
+  OUT PBOOLEAN GenerateOnClose);
 
-#define HEAP_SETTABLE_USER_VALUE        0x00000100
-#define HEAP_SETTABLE_USER_FLAG1        0x00000200
-#define HEAP_SETTABLE_USER_FLAG2        0x00000400
-#define HEAP_SETTABLE_USER_FLAG3        0x00000800
-#define HEAP_SETTABLE_USER_FLAGS        0x00000E00
-
-#define HEAP_CLASS_0                    0x00000000
-#define HEAP_CLASS_1                    0x00001000
-#define HEAP_CLASS_2                    0x00002000
-#define HEAP_CLASS_3                    0x00003000
-#define HEAP_CLASS_4                    0x00004000
-#define HEAP_CLASS_5                    0x00005000
-#define HEAP_CLASS_6                    0x00006000
-#define HEAP_CLASS_7                    0x00007000
-#define HEAP_CLASS_8                    0x00008000
-#define HEAP_CLASS_MASK                 0x0000F000
-
-#define HEAP_MAXIMUM_TAG                0x0FFF
-#define HEAP_GLOBAL_TAG                 0x0800
-#define HEAP_PSEUDO_TAG_FLAG            0x8000
-#define HEAP_TAG_SHIFT                  18
-#define HEAP_TAG_MASK                  (HEAP_MAXIMUM_TAG << HEAP_TAG_SHIFT)
-
-#define HEAP_CREATE_VALID_MASK         (HEAP_NO_SERIALIZE |             \
-                                        HEAP_GROWABLE |                 \
-                                        HEAP_GENERATE_EXCEPTIONS |      \
-                                        HEAP_ZERO_MEMORY |              \
-                                        HEAP_REALLOC_IN_PLACE_ONLY |    \
-                                        HEAP_TAIL_CHECKING_ENABLED |    \
-                                        HEAP_FREE_CHECKING_ENABLED |    \
-                                        HEAP_DISABLE_COALESCE_ON_FREE | \
-                                        HEAP_CLASS_MASK |               \
-                                        HEAP_CREATE_ALIGN_16 |          \
-                                        HEAP_CREATE_ENABLE_TRACING |    \
-                                        HEAP_CREATE_ENABLE_EXECUTE)
-
-FORCEINLINE
-ULONG
-HEAP_MAKE_TAG_FLAGS(
-  IN ULONG TagBase,
-  IN ULONG Tag)
-{
-  //__assume_bound(TagBase); // FIXME
-  return ((ULONG)((TagBase) + ((Tag) << HEAP_TAG_SHIFT)));
-}
-
-#define RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE 1
-#define RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING 2
-
-#define RtlUnicodeStringToOemSize(STRING) (NLS_MB_OEM_CODE_PAGE_TAG ?                                \
-                                           RtlxUnicodeStringToOemSize(STRING) :                      \
-                                           ((STRING)->Length + sizeof(UNICODE_NULL)) / sizeof(WCHAR) \
-)
-
-#define RtlOemStringToUnicodeSize(STRING) (                 \
-    NLS_MB_OEM_CODE_PAGE_TAG ?                              \
-    RtlxOemStringToUnicodeSize(STRING) :                    \
-    ((STRING)->Length + sizeof(ANSI_NULL)) * sizeof(WCHAR)  \
-)
-
-#define RtlOemStringToCountedUnicodeSize(STRING) (                    \
-    (ULONG)(RtlOemStringToUnicodeSize(STRING) - sizeof(UNICODE_NULL)) \
-)
-
-typedef PVOID
-(NTAPI *PRTL_ALLOCATE_STRING_ROUTINE)(
-  IN SIZE_T NumberOfBytes);
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtPrivilegeObjectAuditAlarm(
+  IN PUNICODE_STRING SubsystemName,
+  IN PVOID HandleId OPTIONAL,
+  IN HANDLE ClientToken,
+  IN ACCESS_MASK DesiredAccess,
+  IN PPRIVILEGE_SET Privileges,
+  IN BOOLEAN AccessGranted);
 
-#if _WIN32_WINNT >= 0x0600
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtCloseObjectAuditAlarm(
+  IN PUNICODE_STRING SubsystemName,
+  IN PVOID HandleId OPTIONAL,
+  IN BOOLEAN GenerateOnClose);
 
-typedef PVOID
-(NTAPI *PRTL_REALLOCATE_STRING_ROUTINE)(
-  IN SIZE_T NumberOfBytes,
-  IN PVOID Buffer);
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtDeleteObjectAuditAlarm(
+  IN PUNICODE_STRING SubsystemName,
+  IN PVOID HandleId OPTIONAL,
+  IN BOOLEAN GenerateOnClose);
 
-#endif
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtPrivilegedServiceAuditAlarm(
+  IN PUNICODE_STRING SubsystemName,
+  IN PUNICODE_STRING ServiceName,
+  IN HANDLE ClientToken,
+  IN PPRIVILEGE_SET Privileges,
+  IN BOOLEAN AccessGranted);
 
-typedef VOID
-(NTAPI *PRTL_FREE_STRING_ROUTINE)(
-  IN PVOID Buffer);
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtSetInformationThread(
+  IN HANDLE ThreadHandle,
+  IN THREADINFOCLASS ThreadInformationClass,
+  IN PVOID ThreadInformation,
+  IN ULONG ThreadInformationLength);
 
-extern const PRTL_ALLOCATE_STRING_ROUTINE RtlAllocateStringRoutine;
-extern const PRTL_FREE_STRING_ROUTINE RtlFreeStringRoutine;
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtCreateSection(
+  OUT PHANDLE SectionHandle,
+  IN ACCESS_MASK DesiredAccess,
+  IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
+  IN PLARGE_INTEGER MaximumSize OPTIONAL,
+  IN ULONG SectionPageProtection,
+  IN ULONG AllocationAttributes,
+  IN HANDLE FileHandle OPTIONAL);
 
-#if _WIN32_WINNT >= 0x0600
-extern const PRTL_REALLOCATE_STRING_ROUTINE RtlReallocateStringRoutine;
 #endif
 
 #define COMPRESSION_FORMAT_NONE         (0x0000)
@@ -2371,19 +2430,14 @@ extern const PRTL_REALLOCATE_STRING_ROUTINE RtlReallocateStringRoutine;
 #define COMPRESSION_ENGINE_MAXIMUM      (0x0100)
 #define COMPRESSION_ENGINE_HIBER        (0x0200)
 
-#define RtlOffsetToPointer(B,O)  ((PCHAR)( ((PCHAR)(B)) + ((ULONG_PTR)(O))  ))
-#define RtlPointerToOffset(B,P)  ((ULONG)( ((PCHAR)(P)) - ((PCHAR)(B))  ))
-
 #define MAX_UNICODE_STACK_BUFFER_LENGTH 256
 
-#define RTL_SYSTEM_VOLUME_INFORMATION_FOLDER    L"System Volume Information"
-
 #define METHOD_FROM_CTL_CODE(ctrlCode)          ((ULONG)(ctrlCode & 3))
 
 #define METHOD_DIRECT_TO_HARDWARE       METHOD_IN_DIRECT
 #define METHOD_DIRECT_FROM_HARDWARE     METHOD_OUT_DIRECT
 
-typedef ULONG  LSA_OPERATIONAL_MODE, *PLSA_OPERATIONAL_MODE;
+typedef ULONG LSA_OPERATIONAL_MODE, *PLSA_OPERATIONAL_MODE;
 
 typedef enum _SECURITY_LOGON_TYPE {
   UndefinedLogonType = 0,
@@ -2784,6 +2838,8 @@ typedef struct _MSV1_0_GETUSERINFO_RESPONSE {
   SECURITY_LOGON_TYPE LogonType;
 } MSV1_0_GETUSERINFO_RESPONSE, *PMSV1_0_GETUSERINFO_RESPONSE;
 
+
+
 #define FILE_OPLOCK_BROKEN_TO_LEVEL_2   0x00000007
 #define FILE_OPLOCK_BROKEN_TO_NONE      0x00000008
 #define FILE_OPBATCH_BREAK_UNDERWAY     0x00000009
@@ -4518,52 +4574,221 @@ typedef struct _REMOTE_LINK_TRACKING_INFORMATION {
   UCHAR TargetLinkTrackingInformationBuffer[1];
 } REMOTE_LINK_TRACKING_INFORMATION, *PREMOTE_LINK_TRACKING_INFORMATION;
 
-typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION {
-  ULONG Attributes;
-  ACCESS_MASK GrantedAccess;
-  ULONG HandleCount;
-  ULONG PointerCount;
-  ULONG Reserved[10];
-} PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION;
+#define IO_OPEN_PAGING_FILE             0x0002
+#define IO_OPEN_TARGET_DIRECTORY        0x0004
+#define IO_STOP_ON_SYMLINK              0x0008
+#define IO_MM_PAGING_FILE               0x0010
 
-typedef struct _PUBLIC_OBJECT_TYPE_INFORMATION {
-  UNICODE_STRING TypeName;
-  ULONG Reserved [22];
-} PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION;
+typedef VOID
+(NTAPI *PDRIVER_FS_NOTIFICATION) (
+  IN PDEVICE_OBJECT DeviceObject,
+  IN BOOLEAN FsActive);
 
-typedef struct _SECURITY_CLIENT_CONTEXT {
-  SECURITY_QUALITY_OF_SERVICE SecurityQos;
-  PACCESS_TOKEN ClientToken;
-  BOOLEAN DirectlyAccessClientToken;
-  BOOLEAN DirectAccessEffectiveOnly;
-  BOOLEAN ServerIsRemote;
-  TOKEN_CONTROL ClientTokenControl;
-} SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;
+typedef enum _FS_FILTER_SECTION_SYNC_TYPE {
+  SyncTypeOther = 0,
+  SyncTypeCreateSection
+} FS_FILTER_SECTION_SYNC_TYPE, *PFS_FILTER_SECTION_SYNC_TYPE;
 
-#define SYSTEM_PAGE_PRIORITY_BITS       3
-#define SYSTEM_PAGE_PRIORITY_LEVELS     (1 << SYSTEM_PAGE_PRIORITY_BITS)
+typedef enum _FS_FILTER_STREAM_FO_NOTIFICATION_TYPE {
+  NotifyTypeCreate = 0,
+  NotifyTypeRetired
+} FS_FILTER_STREAM_FO_NOTIFICATION_TYPE, *PFS_FILTER_STREAM_FO_NOTIFICATION_TYPE;
 
-typedef struct _KAPC_STATE {
-  LIST_ENTRY ApcListHead[MaximumMode];
-  PKPROCESS Process;
-  BOOLEAN KernelApcInProgress;
-  BOOLEAN KernelApcPending;
-  BOOLEAN UserApcPending;
-} KAPC_STATE, *PKAPC_STATE, *RESTRICTED_POINTER PRKAPC_STATE;
+typedef union _FS_FILTER_PARAMETERS {
+  struct {
+    PLARGE_INTEGER EndingOffset;
+    PERESOURCE *ResourceToRelease;
+  } AcquireForModifiedPageWriter;
+  struct {
+    PERESOURCE ResourceToRelease;
+  } ReleaseForModifiedPageWriter;
+  struct {
+    FS_FILTER_SECTION_SYNC_TYPE SyncType;
+    ULONG PageProtection;
+  } AcquireForSectionSynchronization;
+  struct {
+    FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType;
+    BOOLEAN POINTER_ALIGNMENT SafeToRecurse;
+  } NotifyStreamFileObject;
+  struct {
+    PVOID Argument1;
+    PVOID Argument2;
+    PVOID Argument3;
+    PVOID Argument4;
+    PVOID Argument5;
+  } Others;
+} FS_FILTER_PARAMETERS, *PFS_FILTER_PARAMETERS;
 
-#define KAPC_STATE_ACTUAL_LENGTH (FIELD_OFFSET(KAPC_STATE, UserApcPending) + sizeof(BOOLEAN))
+#define FS_FILTER_ACQUIRE_FOR_SECTION_SYNCHRONIZATION      (UCHAR)-1
+#define FS_FILTER_RELEASE_FOR_SECTION_SYNCHRONIZATION      (UCHAR)-2
+#define FS_FILTER_ACQUIRE_FOR_MOD_WRITE                    (UCHAR)-3
+#define FS_FILTER_RELEASE_FOR_MOD_WRITE                    (UCHAR)-4
+#define FS_FILTER_ACQUIRE_FOR_CC_FLUSH                     (UCHAR)-5
+#define FS_FILTER_RELEASE_FOR_CC_FLUSH                     (UCHAR)-6
+
+typedef struct _FS_FILTER_CALLBACK_DATA {
+  ULONG SizeOfFsFilterCallbackData;
+  UCHAR Operation;
+  UCHAR Reserved;
+  struct _DEVICE_OBJECT *DeviceObject;
+  struct _FILE_OBJECT *FileObject;
+  FS_FILTER_PARAMETERS Parameters;
+} FS_FILTER_CALLBACK_DATA, *PFS_FILTER_CALLBACK_DATA;
+
+typedef NTSTATUS
+(NTAPI *PFS_FILTER_CALLBACK) (
+  IN PFS_FILTER_CALLBACK_DATA Data,
+  OUT PVOID *CompletionContext);
+
+typedef VOID
+(NTAPI *PFS_FILTER_COMPLETION_CALLBACK) (
+  IN PFS_FILTER_CALLBACK_DATA Data,
+  IN NTSTATUS OperationStatus,
+  IN PVOID CompletionContext);
+
+typedef struct _FS_FILTER_CALLBACKS {
+  ULONG SizeOfFsFilterCallbacks;
+  ULONG Reserved;
+  PFS_FILTER_CALLBACK PreAcquireForSectionSynchronization;
+  PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization;
+  PFS_FILTER_CALLBACK PreReleaseForSectionSynchronization;
+  PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization;
+  PFS_FILTER_CALLBACK PreAcquireForCcFlush;
+  PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush;
+  PFS_FILTER_CALLBACK PreReleaseForCcFlush;
+  PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush;
+  PFS_FILTER_CALLBACK PreAcquireForModifiedPageWriter;
+  PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter;
+  PFS_FILTER_CALLBACK PreReleaseForModifiedPageWriter;
+  PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter;
+} FS_FILTER_CALLBACKS, *PFS_FILTER_CALLBACKS;
+
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlRegisterFileSystemFilterCallbacks(
+  IN struct _DRIVER_OBJECT *FilterDriverObject,
+  IN PFS_FILTER_CALLBACKS Callbacks);
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlNotifyStreamFileObject(
+  IN struct _FILE_OBJECT * StreamFileObject,
+  IN struct _DEVICE_OBJECT *DeviceObjectHint OPTIONAL,
+  IN FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType,
+  IN BOOLEAN SafeToRecurse);
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+
+#define DO_VERIFY_VOLUME                    0x00000002
+#define DO_BUFFERED_IO                      0x00000004
+#define DO_EXCLUSIVE                        0x00000008
+#define DO_DIRECT_IO                        0x00000010
+#define DO_MAP_IO_BUFFER                    0x00000020
+#define DO_DEVICE_HAS_NAME                  0x00000040
+#define DO_DEVICE_INITIALIZING              0x00000080
+#define DO_SYSTEM_BOOT_PARTITION            0x00000100
+#define DO_LONG_TERM_REQUESTS               0x00000200
+#define DO_NEVER_LAST_DEVICE                0x00000400
+#define DO_SHUTDOWN_REGISTERED              0x00000800
+#define DO_BUS_ENUMERATED_DEVICE            0x00001000
+#define DO_POWER_PAGABLE                    0x00002000
+#define DO_POWER_INRUSH                     0x00004000
+#define DO_LOW_PRIORITY_FILESYSTEM          0x00010000
+#define DO_SUPPORTS_TRANSACTIONS            0x00040000
+#define DO_FORCE_NEITHER_IO                 0x00080000
+#define DO_VOLUME_DEVICE_OBJECT             0x00100000
+#define DO_SYSTEM_SYSTEM_PARTITION          0x00200000
+#define DO_SYSTEM_CRITICAL_PARTITION        0x00400000
+#define DO_DISALLOW_EXECUTE                 0x00800000
+
+extern KSPIN_LOCK                   IoStatisticsLock;
+extern ULONG                        IoReadOperationCount;
+extern ULONG                        IoWriteOperationCount;
+extern ULONG                        IoOtherOperationCount;
+extern LARGE_INTEGER                IoReadTransferCount;
+extern LARGE_INTEGER                IoWriteTransferCount;
+extern LARGE_INTEGER                IoOtherTransferCount;
+
+#define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE    64
+#define IO_FILE_OBJECT_PAGED_POOL_CHARGE        1024
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+typedef struct _IO_PRIORITY_INFO {
+  ULONG Size;
+  ULONG ThreadPriority;
+  ULONG PagePriority;
+  IO_PRIORITY_HINT IoPriority;
+} IO_PRIORITY_INFO, *PIO_PRIORITY_INFO;
+#endif
+
+typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION {
+  ULONG Attributes;
+  ACCESS_MASK GrantedAccess;
+  ULONG HandleCount;
+  ULONG PointerCount;
+  ULONG Reserved[10];
+} PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION;
+
+typedef struct _PUBLIC_OBJECT_TYPE_INFORMATION {
+  UNICODE_STRING TypeName;
+  ULONG Reserved [22];
+} PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION;
+
+typedef struct _SECURITY_CLIENT_CONTEXT {
+  SECURITY_QUALITY_OF_SERVICE SecurityQos;
+  PACCESS_TOKEN ClientToken;
+  BOOLEAN DirectlyAccessClientToken;
+  BOOLEAN DirectAccessEffectiveOnly;
+  BOOLEAN ServerIsRemote;
+  TOKEN_CONTROL ClientTokenControl;
+} SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;
+
+#define SYSTEM_PAGE_PRIORITY_BITS       3
+#define SYSTEM_PAGE_PRIORITY_LEVELS     (1 << SYSTEM_PAGE_PRIORITY_BITS)
+
+typedef struct _KAPC_STATE {
+  LIST_ENTRY ApcListHead[MaximumMode];
+  PKPROCESS Process;
+  BOOLEAN KernelApcInProgress;
+  BOOLEAN KernelApcPending;
+  BOOLEAN UserApcPending;
+} KAPC_STATE, *PKAPC_STATE, *RESTRICTED_POINTER PRKAPC_STATE;
+
+#define KAPC_STATE_ACTUAL_LENGTH (FIELD_OFFSET(KAPC_STATE, UserApcPending) + sizeof(BOOLEAN))
+
+#define ASSERT_QUEUE(Q) ASSERT(((Q)->Header.Type & KOBJECT_TYPE_MASK) == QueueObject);
+
+typedef struct _KQUEUE {
+  DISPATCHER_HEADER Header;
+  LIST_ENTRY EntryListHead;
+  volatile ULONG CurrentCount;
+  ULONG MaximumCount;
+  LIST_ENTRY ThreadListHead;
+} KQUEUE, *PKQUEUE, *RESTRICTED_POINTER PRKQUEUE;
+
+/******************************************************************************
+ *                              Kernel Functions                              *
+ ******************************************************************************/
+
+NTSTATUS
+NTAPI
+KeGetProcessorNumberFromIndex(
+  IN ULONG ProcIndex,
+  OUT PPROCESSOR_NUMBER ProcNumber);
+
+ULONG
+NTAPI
+KeGetProcessorIndexFromNumber(
+  IN PPROCESSOR_NUMBER ProcNumber);
+
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
 
-#define ASSERT_QUEUE(Q) ASSERT(((Q)->Header.Type & KOBJECT_TYPE_MASK) == QueueObject);
 
-typedef struct _KQUEUE {
-  DISPATCHER_HEADER Header;
-  LIST_ENTRY EntryListHead;
-  volatile ULONG CurrentCount;
-  ULONG MaximumCount;
-  LIST_ENTRY ThreadListHead;
-} KQUEUE, *PKQUEUE, *RESTRICTED_POINTER PRKQUEUE;
 
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
 
 NTKERNELAPI
 VOID
@@ -4683,6 +4908,7 @@ KeAcquireSpinLockRaiseToSynch(
 
 #if (NTDDI_VERSION >= NTDDI_WINXP)
 
+
 _DECL_HAL_KE_IMPORT
 KIRQL
 FASTCALL
@@ -4705,6 +4931,10 @@ KeTryToAcquireQueuedSpinLock(
 
 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
+
+
+
+
 #if (NTDDI_VERSION >= NTDDI_VISTA)
 
 NTKERNELAPI
@@ -4725,18 +4955,18 @@ KeRemoveQueueEx (
 
 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
 
-#define INVALID_PROCESSOR_INDEX     0xffffffff
 
-NTSTATUS
-NTAPI
-KeGetProcessorNumberFromIndex(
-  IN ULONG ProcIndex,
-  OUT PPROCESSOR_NUMBER ProcNumber);
 
-ULONG
-NTAPI
-KeGetProcessorIndexFromNumber(
-  IN PPROCESSOR_NUMBER ProcNumber);
+/******************************************************************************
+ *                          Executive Functions                               *
+ ******************************************************************************/
+
+
+#define ExDisableResourceBoost ExDisableResourceBoostLite
+
+VOID
+ExInitializePushLock (
+  OUT PEX_PUSH_LOCK PushLock);
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 
@@ -4756,19 +4986,10 @@ VOID
 NTAPI
 ExDisableResourceBoostLite(
   IN PERESOURCE Resource);
-
-#endif
-
-#define ExDisableResourceBoost ExDisableResourceBoostLite
-
-#define EX_PUSH_LOCK ULONG_PTR
-#define PEX_PUSH_LOCK PULONG_PTR
-
-VOID
-ExInitializePushLock (
-  OUT PEX_PUSH_LOCK PushLock);
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
 #if (NTDDI_VERSION >= NTDDI_WINXP)
+
 PSLIST_ENTRY
 FASTCALL
 InterlockedPushListSList(
@@ -4776,175 +4997,56 @@ InterlockedPushListSList(
   IN OUT PSLIST_ENTRY List,
   IN OUT PSLIST_ENTRY ListEnd,
   IN ULONG Count);
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
-#endif
+/******************************************************************************
+ *                            Security Manager Functions                      *
+ ******************************************************************************/
 
-/* #if !defined(_X86AMD64_)  FIXME : WHAT ?! */
-#if defined(_WIN64)
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
 
-C_ASSERT(sizeof(ERESOURCE) == 0x68);
-C_ASSERT(FIELD_OFFSET(ERESOURCE,ActiveCount) == 0x18);
-C_ASSERT(FIELD_OFFSET(ERESOURCE,Flag) == 0x1a);
 
-#else
+NTKERNELAPI
+VOID
+NTAPI
+SeReleaseSubjectContext(
+  IN PSECURITY_SUBJECT_CONTEXT SubjectContext);
 
-C_ASSERT(sizeof(ERESOURCE) == 0x38);
-C_ASSERT(FIELD_OFFSET(ERESOURCE,ActiveCount) == 0x0c);
-C_ASSERT(FIELD_OFFSET(ERESOURCE,Flag) == 0x0e);
+NTKERNELAPI
+BOOLEAN
+NTAPI
+SePrivilegeCheck(
+  IN OUT PPRIVILEGE_SET RequiredPrivileges,
+  IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
+  IN KPROCESSOR_MODE AccessMode);
 
-#endif
-/* #endif */
+NTKERNELAPI
+VOID
+NTAPI
+SeOpenObjectAuditAlarm(
+  IN PUNICODE_STRING ObjectTypeName,
+  IN PVOID Object OPTIONAL,
+  IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
+  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+  IN PACCESS_STATE AccessState,
+  IN BOOLEAN ObjectCreated,
+  IN BOOLEAN AccessGranted,
+  IN KPROCESSOR_MODE AccessMode,
+  OUT PBOOLEAN GenerateOnClose);
 
-#define TOKEN_HAS_TRAVERSE_PRIVILEGE    0x0001
-#define TOKEN_HAS_BACKUP_PRIVILEGE      0x0002
-#define TOKEN_HAS_RESTORE_PRIVILEGE     0x0004
-#define TOKEN_WRITE_RESTRICTED          0x0008
-#define TOKEN_IS_RESTRICTED             0x0010
-#define TOKEN_SESSION_NOT_REFERENCED    0x0020
-#define TOKEN_SANDBOX_INERT             0x0040
-#define TOKEN_HAS_IMPERSONATE_PRIVILEGE 0x0080
-#define SE_BACKUP_PRIVILEGES_CHECKED    0x0100
-#define TOKEN_VIRTUALIZE_ALLOWED        0x0200
-#define TOKEN_VIRTUALIZE_ENABLED        0x0400
-#define TOKEN_IS_FILTERED               0x0800
-#define TOKEN_UIACCESS                  0x1000
-#define TOKEN_NOT_LOW                   0x2000
-
-typedef struct _SE_EXPORTS {
-  LUID SeCreateTokenPrivilege;
-  LUID SeAssignPrimaryTokenPrivilege;
-  LUID SeLockMemoryPrivilege;
-  LUID SeIncreaseQuotaPrivilege;
-  LUID SeUnsolicitedInputPrivilege;
-  LUID SeTcbPrivilege;
-  LUID SeSecurityPrivilege;
-  LUID SeTakeOwnershipPrivilege;
-  LUID SeLoadDriverPrivilege;
-  LUID SeCreatePagefilePrivilege;
-  LUID SeIncreaseBasePriorityPrivilege;
-  LUID SeSystemProfilePrivilege;
-  LUID SeSystemtimePrivilege;
-  LUID SeProfileSingleProcessPrivilege;
-  LUID SeCreatePermanentPrivilege;
-  LUID SeBackupPrivilege;
-  LUID SeRestorePrivilege;
-  LUID SeShutdownPrivilege;
-  LUID SeDebugPrivilege;
-  LUID SeAuditPrivilege;
-  LUID SeSystemEnvironmentPrivilege;
-  LUID SeChangeNotifyPrivilege;
-  LUID SeRemoteShutdownPrivilege;
-  PSID SeNullSid;
-  PSID SeWorldSid;
-  PSID SeLocalSid;
-  PSID SeCreatorOwnerSid;
-  PSID SeCreatorGroupSid;
-  PSID SeNtAuthoritySid;
-  PSID SeDialupSid;
-  PSID SeNetworkSid;
-  PSID SeBatchSid;
-  PSID SeInteractiveSid;
-  PSID SeLocalSystemSid;
-  PSID SeAliasAdminsSid;
-  PSID SeAliasUsersSid;
-  PSID SeAliasGuestsSid;
-  PSID SeAliasPowerUsersSid;
-  PSID SeAliasAccountOpsSid;
-  PSID SeAliasSystemOpsSid;
-  PSID SeAliasPrintOpsSid;
-  PSID SeAliasBackupOpsSid;
-  PSID SeAuthenticatedUsersSid;
-  PSID SeRestrictedSid;
-  PSID SeAnonymousLogonSid;
-  LUID SeUndockPrivilege;
-  LUID SeSyncAgentPrivilege;
-  LUID SeEnableDelegationPrivilege;
-  PSID SeLocalServiceSid;
-  PSID SeNetworkServiceSid;
-  LUID SeManageVolumePrivilege;
-  LUID SeImpersonatePrivilege;
-  LUID SeCreateGlobalPrivilege;
-  LUID SeTrustedCredManAccessPrivilege;
-  LUID SeRelabelPrivilege;
-  LUID SeIncreaseWorkingSetPrivilege;
-  LUID SeTimeZonePrivilege;
-  LUID SeCreateSymbolicLinkPrivilege;
-  PSID SeIUserSid;
-  PSID SeUntrustedMandatorySid;
-  PSID SeLowMandatorySid;
-  PSID SeMediumMandatorySid;
-  PSID SeHighMandatorySid;
-  PSID SeSystemMandatorySid;
-  PSID SeOwnerRightsSid;
-} SE_EXPORTS, *PSE_EXPORTS;
-
-typedef NTSTATUS
-(NTAPI *PSE_LOGON_SESSION_TERMINATED_ROUTINE)(
-  IN PLUID LogonId);
-
-#define SeLengthSid( Sid ) \
-    (8 + (4 * ((SID *)Sid)->SubAuthorityCount))
-
-#define SeDeleteClientSecurity(C)  {                                           \
-            if (SeTokenType((C)->ClientToken) == TokenPrimary) {               \
-                PsDereferencePrimaryToken( (C)->ClientToken );                 \
-            } else {                                                           \
-                PsDereferenceImpersonationToken( (C)->ClientToken );           \
-            }                                                                  \
-}
-
-#define SeStopImpersonatingClient() PsRevertToSelf()
-
-#define SeQuerySubjectContextToken( SubjectContext )                \
-    ( ARGUMENT_PRESENT(                                             \
-        ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken   \
-        ) ?                                                         \
-    ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken :     \
-    ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
-
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-
-NTKERNELAPI
-VOID
-NTAPI
-SeReleaseSubjectContext(
-  IN PSECURITY_SUBJECT_CONTEXT SubjectContext);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-SePrivilegeCheck(
-  IN OUT PPRIVILEGE_SET RequiredPrivileges,
-  IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
-  IN KPROCESSOR_MODE AccessMode);
-
-NTKERNELAPI
-VOID
-NTAPI
-SeOpenObjectAuditAlarm(
-  IN PUNICODE_STRING ObjectTypeName,
-  IN PVOID Object OPTIONAL,
-  IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
-  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
-  IN PACCESS_STATE AccessState,
-  IN BOOLEAN ObjectCreated,
-  IN BOOLEAN AccessGranted,
-  IN KPROCESSOR_MODE AccessMode,
-  OUT PBOOLEAN GenerateOnClose);
-
-NTKERNELAPI
-VOID
-NTAPI
-SeOpenObjectForDeleteAuditAlarm(
-  IN PUNICODE_STRING ObjectTypeName,
-  IN PVOID Object OPTIONAL,
-  IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
-  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
-  IN PACCESS_STATE AccessState,
-  IN BOOLEAN ObjectCreated,
-  IN BOOLEAN AccessGranted,
-  IN KPROCESSOR_MODE AccessMode,
-  OUT PBOOLEAN GenerateOnClose);
+NTKERNELAPI
+VOID
+NTAPI
+SeOpenObjectForDeleteAuditAlarm(
+  IN PUNICODE_STRING ObjectTypeName,
+  IN PVOID Object OPTIONAL,
+  IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
+  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
+  IN PACCESS_STATE AccessState,
+  IN BOOLEAN ObjectCreated,
+  IN BOOLEAN AccessGranted,
+  IN KPROCESSOR_MODE AccessMode,
+  OUT PBOOLEAN GenerateOnClose);
 
 NTKERNELAPI
 VOID
@@ -5104,7 +5206,6 @@ SeQueryInformationToken(
   OUT PVOID *TokenInformation);
 
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
-
 #if (NTDDI_VERSION >= NTDDI_WIN2KSP3)
 NTKERNELAPI
 BOOLEAN
@@ -5157,6 +5258,7 @@ SeAuditingHardLinkEventsWithContext(
 
 #endif
 
+
 #if (NTDDI_VERSION >= NTDDI_VISTA)
 
 NTKERNELAPI
@@ -5238,7 +5340,6 @@ SeAuditTransactionStateChange(
   IN GUID *TransactionId,
   IN GUID *ResourceManagerId,
   IN ULONG NewTransactionState);
-
 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
 
 #if (NTDDI_VERSION >= NTDDI_VISTA || (NTDDI_VERSION >= NTDDI_WINXPSP2 && NTDDI_VERSION < NTDDI_WS03))
@@ -5278,7 +5379,7 @@ SeMaximumAuditMaskFromGlobalSacl(
   IN PACCESS_TOKEN Token,
   IN OUT PACCESS_MASK AuditMask);
 
-#endif
+#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
 
 NTSTATUS
 NTAPI
@@ -5315,10 +5416,48 @@ SeLocateProcessImageName(
   IN OUT PEPROCESS Process,
   OUT PUNICODE_STRING *pImageFileName);
 
+#define SeLengthSid( Sid ) \
+    (8 + (4 * ((SID *)Sid)->SubAuthorityCount))
+
+#define SeDeleteClientSecurity(C)  {                                           \
+            if (SeTokenType((C)->ClientToken) == TokenPrimary) {               \
+                PsDereferencePrimaryToken( (C)->ClientToken );                 \
+            } else {                                                           \
+                PsDereferenceImpersonationToken( (C)->ClientToken );           \
+            }                                                                  \
+}
+
+#define SeStopImpersonatingClient() PsRevertToSelf()
+
+#define SeQuerySubjectContextToken( SubjectContext )                \
+    ( ARGUMENT_PRESENT(                                             \
+        ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken   \
+        ) ?                                                         \
+    ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken :     \
+    ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
+
 extern NTKERNELAPI PSE_EXPORTS SeExports;
+/******************************************************************************
+ *                          Process Manager Functions                         *
+ ******************************************************************************/
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+PsLookupProcessByProcessId(
+  IN HANDLE ProcessId,
+  OUT PEPROCESS *Process);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+PsLookupThreadByThreadId(
+  IN HANDLE UniqueThreadId,
+  OUT PETHREAD *Thread);
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 
+
 NTKERNELAPI
 PACCESS_TOKEN
 NTAPI
@@ -5331,8 +5470,7 @@ PsReferenceImpersonationToken(
 NTKERNELAPI
 LARGE_INTEGER
 NTAPI
-PsGetProcessExitTime(
-  VOID);
+PsGetProcessExitTime(VOID);
 
 NTKERNELAPI
 BOOLEAN
@@ -5367,8 +5505,7 @@ PsRestoreImpersonation(
 NTKERNELAPI
 VOID
 NTAPI
-PsRevertToSelf(
-  VOID);
+PsRevertToSelf(VOID);
 
 NTKERNELAPI
 VOID
@@ -5398,11 +5535,10 @@ HANDLE
 NTAPI
 PsReferencePrimaryToken(
   IN OUT PEPROCESS Process);
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
-
 #if (NTDDI_VERSION >= NTDDI_WINXP)
 
+
 NTKERNELAPI
 VOID
 NTAPI
@@ -5428,231 +5564,86 @@ BOOLEAN
 NTAPI
 PsIsSystemThread(
   IN PETHREAD Thread);
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
+
+/******************************************************************************
+ *                         I/O Manager Functions                              *
+ ******************************************************************************/
+
+#define IoIsFileOpenedExclusively(FileObject) ( \
+    (BOOLEAN) !(                                \
+    (FileObject)->SharedRead ||                 \
+    (FileObject)->SharedWrite ||                \
+    (FileObject)->SharedDelete                  \
+    )                                           \
+)
 
+#if (NTDDI_VERSION == NTDDI_WIN2K)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoRegisterFsRegistrationChangeEx(
+  IN PDRIVER_OBJECT DriverObject,
+  IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine);
 #endif
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
+
+NTKERNELAPI
+VOID
+NTAPI
+IoAcquireVpbSpinLock(
+  OUT PKIRQL Irql);
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-PsLookupProcessByProcessId(
-  IN HANDLE ProcessId,
-  OUT PEPROCESS *Process);
+IoCheckDesiredAccess(
+  IN OUT PACCESS_MASK DesiredAccess,
+  IN ACCESS_MASK GrantedAccess);
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-PsLookupThreadByThreadId(
-  IN HANDLE UniqueThreadId,
-  OUT PETHREAD *Thread);
+IoCheckEaBufferValidity(
+  IN PFILE_FULL_EA_INFORMATION EaBuffer,
+  IN ULONG EaLength,
+  OUT PULONG ErrorOffset);
 
-#define IO_OPEN_PAGING_FILE             0x0002
-#define IO_OPEN_TARGET_DIRECTORY        0x0004
-#define IO_STOP_ON_SYMLINK              0x0008
-#define IO_MM_PAGING_FILE               0x0010
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoCheckFunctionAccess(
+  IN ACCESS_MASK GrantedAccess,
+  IN UCHAR MajorFunction,
+  IN UCHAR MinorFunction,
+  IN ULONG IoControlCode,
+  IN PVOID Argument1 OPTIONAL,
+  IN PVOID Argument2 OPTIONAL);
 
-typedef VOID
-(NTAPI *PDRIVER_FS_NOTIFICATION) (
-  IN PDEVICE_OBJECT DeviceObject,
-  IN BOOLEAN FsActive);
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoCheckQuerySetFileInformation(
+  IN FILE_INFORMATION_CLASS FileInformationClass,
+  IN ULONG Length,
+  IN BOOLEAN SetOperation);
 
-typedef enum _FS_FILTER_SECTION_SYNC_TYPE {
-  SyncTypeOther = 0,
-  SyncTypeCreateSection
-} FS_FILTER_SECTION_SYNC_TYPE, *PFS_FILTER_SECTION_SYNC_TYPE;
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoCheckQuerySetVolumeInformation(
+  IN FS_INFORMATION_CLASS FsInformationClass,
+  IN ULONG Length,
+  IN BOOLEAN SetOperation);
 
-typedef enum _FS_FILTER_STREAM_FO_NOTIFICATION_TYPE {
-  NotifyTypeCreate = 0,
-  NotifyTypeRetired
-} FS_FILTER_STREAM_FO_NOTIFICATION_TYPE, *PFS_FILTER_STREAM_FO_NOTIFICATION_TYPE;
-
-typedef union _FS_FILTER_PARAMETERS {
-  struct {
-    PLARGE_INTEGER EndingOffset;
-    PERESOURCE *ResourceToRelease;
-  } AcquireForModifiedPageWriter;
-  struct {
-    PERESOURCE ResourceToRelease;
-  } ReleaseForModifiedPageWriter;
-  struct {
-    FS_FILTER_SECTION_SYNC_TYPE SyncType;
-    ULONG PageProtection;
-  } AcquireForSectionSynchronization;
-  struct {
-    FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType;
-    BOOLEAN POINTER_ALIGNMENT SafeToRecurse;
-  } NotifyStreamFileObject;
-  struct {
-    PVOID Argument1;
-    PVOID Argument2;
-    PVOID Argument3;
-    PVOID Argument4;
-    PVOID Argument5;
-  } Others;
-} FS_FILTER_PARAMETERS, *PFS_FILTER_PARAMETERS;
-
-#define FS_FILTER_ACQUIRE_FOR_SECTION_SYNCHRONIZATION      (UCHAR)-1
-#define FS_FILTER_RELEASE_FOR_SECTION_SYNCHRONIZATION      (UCHAR)-2
-#define FS_FILTER_ACQUIRE_FOR_MOD_WRITE                    (UCHAR)-3
-#define FS_FILTER_RELEASE_FOR_MOD_WRITE                    (UCHAR)-4
-#define FS_FILTER_ACQUIRE_FOR_CC_FLUSH                     (UCHAR)-5
-#define FS_FILTER_RELEASE_FOR_CC_FLUSH                     (UCHAR)-6
-
-typedef struct _FS_FILTER_CALLBACK_DATA {
-  ULONG SizeOfFsFilterCallbackData;
-  UCHAR Operation;
-  UCHAR Reserved;
-  struct _DEVICE_OBJECT *DeviceObject;
-  struct _FILE_OBJECT *FileObject;
-  FS_FILTER_PARAMETERS Parameters;
-} FS_FILTER_CALLBACK_DATA, *PFS_FILTER_CALLBACK_DATA;
-
-typedef NTSTATUS
-(NTAPI *PFS_FILTER_CALLBACK) (
-  IN PFS_FILTER_CALLBACK_DATA Data,
-  OUT PVOID *CompletionContext);
-
-typedef VOID
-(NTAPI *PFS_FILTER_COMPLETION_CALLBACK) (
-  IN PFS_FILTER_CALLBACK_DATA Data,
-  IN NTSTATUS OperationStatus,
-  IN PVOID CompletionContext);
-
-typedef struct _FS_FILTER_CALLBACKS {
-  ULONG SizeOfFsFilterCallbacks;
-  ULONG Reserved;
-  PFS_FILTER_CALLBACK PreAcquireForSectionSynchronization;
-  PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization;
-  PFS_FILTER_CALLBACK PreReleaseForSectionSynchronization;
-  PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization;
-  PFS_FILTER_CALLBACK PreAcquireForCcFlush;
-  PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush;
-  PFS_FILTER_CALLBACK PreReleaseForCcFlush;
-  PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush;
-  PFS_FILTER_CALLBACK PreAcquireForModifiedPageWriter;
-  PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter;
-  PFS_FILTER_CALLBACK PreReleaseForModifiedPageWriter;
-  PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter;
-} FS_FILTER_CALLBACKS, *PFS_FILTER_CALLBACKS;
-
-#if (NTDDI_VERSION >= NTDDI_WINXP)
-NTKERNELAPI
-NTSTATUS
-NTAPI
-FsRtlRegisterFileSystemFilterCallbacks(
-  IN struct _DRIVER_OBJECT *FilterDriverObject,
-  IN PFS_FILTER_CALLBACKS Callbacks);
-#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
-
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-NTKERNELAPI
-NTSTATUS
-NTAPI
-FsRtlNotifyStreamFileObject(
-  IN struct _FILE_OBJECT * StreamFileObject,
-  IN struct _DEVICE_OBJECT *DeviceObjectHint OPTIONAL,
-  IN FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType,
-  IN BOOLEAN SafeToRecurse);
-#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
-
-#define DO_VERIFY_VOLUME                    0x00000002
-#define DO_BUFFERED_IO                      0x00000004
-#define DO_EXCLUSIVE                        0x00000008
-#define DO_DIRECT_IO                        0x00000010
-#define DO_MAP_IO_BUFFER                    0x00000020
-#define DO_DEVICE_HAS_NAME                  0x00000040
-#define DO_DEVICE_INITIALIZING              0x00000080
-#define DO_SYSTEM_BOOT_PARTITION            0x00000100
-#define DO_LONG_TERM_REQUESTS               0x00000200
-#define DO_NEVER_LAST_DEVICE                0x00000400
-#define DO_SHUTDOWN_REGISTERED              0x00000800
-#define DO_BUS_ENUMERATED_DEVICE            0x00001000
-#define DO_POWER_PAGABLE                    0x00002000
-#define DO_POWER_INRUSH                     0x00004000
-#define DO_LOW_PRIORITY_FILESYSTEM          0x00010000
-#define DO_SUPPORTS_TRANSACTIONS            0x00040000
-#define DO_FORCE_NEITHER_IO                 0x00080000
-#define DO_VOLUME_DEVICE_OBJECT             0x00100000
-#define DO_SYSTEM_SYSTEM_PARTITION          0x00200000
-#define DO_SYSTEM_CRITICAL_PARTITION        0x00400000
-#define DO_DISALLOW_EXECUTE                 0x00800000
-
-extern KSPIN_LOCK                   IoStatisticsLock;
-extern ULONG                        IoReadOperationCount;
-extern ULONG                        IoWriteOperationCount;
-extern ULONG                        IoOtherOperationCount;
-extern LARGE_INTEGER                IoReadTransferCount;
-extern LARGE_INTEGER                IoWriteTransferCount;
-extern LARGE_INTEGER                IoOtherTransferCount;
-
-#define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE    64
-#define IO_FILE_OBJECT_PAGED_POOL_CHARGE        1024
-
-#if (NTDDI_VERSION == NTDDI_WIN2K)
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoRegisterFsRegistrationChangeEx(
-  IN PDRIVER_OBJECT DriverObject,
-  IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine);
-#endif
-
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-
-NTKERNELAPI
-VOID
-NTAPI
-IoAcquireVpbSpinLock(
-  OUT PKIRQL Irql);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoCheckDesiredAccess(
-  IN OUT PACCESS_MASK DesiredAccess,
-  IN ACCESS_MASK GrantedAccess);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoCheckEaBufferValidity(
-  IN PFILE_FULL_EA_INFORMATION EaBuffer,
-  IN ULONG EaLength,
-  OUT PULONG ErrorOffset);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoCheckFunctionAccess(
-  IN ACCESS_MASK GrantedAccess,
-  IN UCHAR MajorFunction,
-  IN UCHAR MinorFunction,
-  IN ULONG IoControlCode,
-  IN PVOID Argument1 OPTIONAL,
-  IN PVOID Argument2 OPTIONAL);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoCheckQuerySetFileInformation(
-  IN FILE_INFORMATION_CLASS FileInformationClass,
-  IN ULONG Length,
-  IN BOOLEAN SetOperation);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoCheckQuerySetVolumeInformation(
-  IN FS_INFORMATION_CLASS FsInformationClass,
-  IN ULONG Length,
-  IN BOOLEAN SetOperation);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoCheckQuotaBufferValidity(
-  IN PFILE_QUOTA_INFORMATION QuotaBuffer,
-  IN ULONG QuotaLength,
-  OUT PULONG ErrorOffset);
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoCheckQuotaBufferValidity(
+  IN PFILE_QUOTA_INFORMATION QuotaBuffer,
+  IN ULONG QuotaLength,
+  OUT PULONG ErrorOffset);
 
 NTKERNELAPI
 PFILE_OBJECT
@@ -5697,8 +5688,7 @@ IoGetBaseFileSystemDeviceObject(
 NTKERNELAPI
 PCONFIGURATION_INFORMATION
 NTAPI
-IoGetConfigurationInformation(
-  VOID);
+IoGetConfigurationInformation(VOID);
 
 NTKERNELAPI
 ULONG
@@ -5715,8 +5705,7 @@ IoGetRequestorProcess(
 NTKERNELAPI
 PIRP
 NTAPI
-IoGetTopLevelIrp(
-  VOID);
+IoGetTopLevelIrp(VOID);
 
 NTKERNELAPI
 BOOLEAN
@@ -5849,8 +5838,10 @@ IoGetRequestorSessionId(
 
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
+
 #if (NTDDI_VERSION >= NTDDI_WINXP)
 
+
 NTKERNELAPI
 PFILE_OBJECT
 NTAPI
@@ -5894,9 +5885,11 @@ IoGetDiskDeviceObject(
   IN PDEVICE_OBJECT FileSystemDeviceObject,
   OUT PDEVICE_OBJECT *DiskDeviceObject);
 
-#endif
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
 #if (NTDDI_VERSION >= NTDDI_WS03SP1)
+
+
 NTKERNELAPI
 NTSTATUS
 NTAPI
@@ -5904,9 +5897,10 @@ IoEnumerateRegisteredFiltersList(
   OUT PDRIVER_OBJECT *DriverObjectList,
   IN ULONG DriverObjectListSize,
   OUT PULONG ActualNumberDriverObjects);
-#endif
+#endif /* (NTDDI_VERSION >= NTDDI_WS03SP1) */
 
 #if (NTDDI_VERSION >= NTDDI_VISTA)
+
 VOID
 FORCEINLINE
 NTAPI
@@ -5918,10 +5912,11 @@ IoInitializePriorityInfo(
   PriorityInfo->IoPriority = IoPriorityNormal;
   PriorityInfo->PagePriority = 0;
 }
-#endif
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
 
 #if (NTDDI_VERSION >= NTDDI_WIN7)
 
+
 NTKERNELAPI
 NTSTATUS
 NTAPI
@@ -5937,25 +5932,8 @@ IoReplaceFileObjectName(
   IN PFILE_OBJECT FileObject,
   IN PWSTR NewFileName,
   IN USHORT FileNameLength);
+#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
 
-#endif
-
-#define IoIsFileOpenedExclusively(FileObject) ( \
-    (BOOLEAN) !(                                \
-    (FileObject)->SharedRead ||                 \
-    (FileObject)->SharedWrite ||                \
-    (FileObject)->SharedDelete                  \
-    )                                           \
-)
-
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-typedef struct _IO_PRIORITY_INFO {
-  ULONG Size;
-  ULONG ThreadPriority;
-  ULONG PagePriority;
-  IO_PRIORITY_HINT IoPriority;
-} IO_PRIORITY_INFO, *PIO_PRIORITY_INFO;
-#endif
 
 #define PO_CB_SYSTEM_POWER_POLICY       0
 #define PO_CB_AC_STATUS                 1
@@ -5964,6 +5942,7 @@ typedef struct _IO_PRIORITY_INFO {
 #define PO_CB_LID_SWITCH_STATE          4
 #define PO_CB_PROCESSOR_POWER_POLICY    5
 
+
 #if (NTDDI_VERSION >= NTDDI_WINXP)
 NTKERNELAPI
 NTSTATUS
@@ -5971,65 +5950,14 @@ NTAPI
 PoQueueShutdownWorkItem(
   IN OUT PWORK_QUEUE_ITEM WorkItem);
 #endif
-
-#if defined(_IA64_)
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-//DECLSPEC_DEPRECATED_DDK
-NTHALAPI
-ULONG
-NTAPI
-HalGetDmaAlignmentRequirement(
-  VOID);
-#endif
-#endif
-
-#if defined(_M_IX86) || defined(_M_AMD64)
-#define HalGetDmaAlignmentRequirement() 1L
-#endif
-
+/******************************************************************************
+ *                         Memory manager Types                               *
+ ******************************************************************************/
 typedef enum _MMFLUSH_TYPE {
   MmFlushForDelete,
   MmFlushForWrite
 } MMFLUSH_TYPE;
 
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-MmIsRecursiveIoFault(
-  VOID);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-MmForceSectionClosed(
-  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
-  IN BOOLEAN DelayClose);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-MmFlushImageSection(
-  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
-  IN MMFLUSH_TYPE FlushType);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-MmCanFileBeTruncated(
-  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
-  IN PLARGE_INTEGER NewFileSize OPTIONAL);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-MmSetAddressRangeModified(
-  IN PVOID Address,
-  IN SIZE_T Length);
-
-#endif
-
 typedef struct _READ_LIST {
   PFILE_OBJECT FileObject;
   ULONG NumberOfEntries;
@@ -6038,6 +5966,7 @@ typedef struct _READ_LIST {
 } READ_LIST, *PREAD_LIST;
 
 #if (NTDDI_VERSION >= NTDDI_WINXP)
+
 typedef union _MM_PREFETCH_FLAGS {
   struct {
     ULONG Priority : SYSTEM_PAGE_PRIORITY_BITS;
@@ -6048,21 +5977,131 @@ typedef union _MM_PREFETCH_FLAGS {
 
 #define MM_PREFETCH_FLAGS_MASK ((1 << (2*SYSTEM_PAGE_PRIORITY_BITS)) - 1)
 
-NTKERNELAPI
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
+
+#define HEAP_NO_SERIALIZE               0x00000001
+#define HEAP_GROWABLE                   0x00000002
+#define HEAP_GENERATE_EXCEPTIONS        0x00000004
+#define HEAP_ZERO_MEMORY                0x00000008
+#define HEAP_REALLOC_IN_PLACE_ONLY      0x00000010
+#define HEAP_TAIL_CHECKING_ENABLED      0x00000020
+#define HEAP_FREE_CHECKING_ENABLED      0x00000040
+#define HEAP_DISABLE_COALESCE_ON_FREE   0x00000080
+
+#define HEAP_CREATE_ALIGN_16            0x00010000
+#define HEAP_CREATE_ENABLE_TRACING      0x00020000
+#define HEAP_CREATE_ENABLE_EXECUTE      0x00040000
+
+#define HEAP_SETTABLE_USER_VALUE        0x00000100
+#define HEAP_SETTABLE_USER_FLAG1        0x00000200
+#define HEAP_SETTABLE_USER_FLAG2        0x00000400
+#define HEAP_SETTABLE_USER_FLAG3        0x00000800
+#define HEAP_SETTABLE_USER_FLAGS        0x00000E00
+
+#define HEAP_CLASS_0                    0x00000000
+#define HEAP_CLASS_1                    0x00001000
+#define HEAP_CLASS_2                    0x00002000
+#define HEAP_CLASS_3                    0x00003000
+#define HEAP_CLASS_4                    0x00004000
+#define HEAP_CLASS_5                    0x00005000
+#define HEAP_CLASS_6                    0x00006000
+#define HEAP_CLASS_7                    0x00007000
+#define HEAP_CLASS_8                    0x00008000
+#define HEAP_CLASS_MASK                 0x0000F000
+
+#define HEAP_MAXIMUM_TAG                0x0FFF
+#define HEAP_GLOBAL_TAG                 0x0800
+#define HEAP_PSEUDO_TAG_FLAG            0x8000
+#define HEAP_TAG_SHIFT                  18
+#define HEAP_TAG_MASK                  (HEAP_MAXIMUM_TAG << HEAP_TAG_SHIFT)
+
+#define HEAP_CREATE_VALID_MASK         (HEAP_NO_SERIALIZE |             \
+                                        HEAP_GROWABLE |                 \
+                                        HEAP_GENERATE_EXCEPTIONS |      \
+                                        HEAP_ZERO_MEMORY |              \
+                                        HEAP_REALLOC_IN_PLACE_ONLY |    \
+                                        HEAP_TAIL_CHECKING_ENABLED |    \
+                                        HEAP_FREE_CHECKING_ENABLED |    \
+                                        HEAP_DISABLE_COALESCE_ON_FREE | \
+                                        HEAP_CLASS_MASK |               \
+                                        HEAP_CREATE_ALIGN_16 |          \
+                                        HEAP_CREATE_ENABLE_TRACING |    \
+                                        HEAP_CREATE_ENABLE_EXECUTE)
+
+/******************************************************************************
+ *                       Memory manager Functions                             *
+ ******************************************************************************/
+
+FORCEINLINE
+ULONG
+HEAP_MAKE_TAG_FLAGS(
+  IN ULONG TagBase,
+  IN ULONG Tag)
+{
+  //__assume_bound(TagBase); // FIXME
+  return ((ULONG)((TagBase) + ((Tag) << HEAP_TAG_SHIFT)));
+}
+
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+MmIsRecursiveIoFault(
+  VOID);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+MmForceSectionClosed(
+  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+  IN BOOLEAN DelayClose);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+MmFlushImageSection(
+  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+  IN MMFLUSH_TYPE FlushType);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+MmCanFileBeTruncated(
+  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+  IN PLARGE_INTEGER NewFileSize OPTIONAL);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+MmSetAddressRangeModified(
+  IN PVOID Address,
+  IN SIZE_T Length);
+
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+
+
+NTKERNELAPI
 NTSTATUS
 NTAPI
 MmPrefetchPages(
   IN ULONG NumberOfLists,
   IN PREAD_LIST *ReadLists);
-#endif
+
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
+
 
 #if (NTDDI_VERSION >= NTDDI_VISTA)
+
 NTKERNELAPI
 ULONG
 NTAPI
 MmDoesFileHaveUserWritableReferences(
   IN PSECTION_OBJECT_POINTERS SectionPointer);
-#endif
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 
@@ -6110,10 +6149,10 @@ NTAPI
 ObQueryObjectAuditingByHandle(
   IN HANDLE Handle,
   OUT PBOOLEAN GenerateOnClose);
-
-#endif
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
 #if (NTDDI_VERSION >= NTDDI_VISTA)
+
 NTKERNELAPI
 BOOLEAN
 NTAPI
@@ -6121,7 +6160,9 @@ ObIsKernelHandle(
   IN HANDLE Handle);
 #endif
 
+
 #if (NTDDI_VERSION >= NTDDI_WIN7)
+
 NTKERNELAPI
 NTSTATUS
 NTAPI
@@ -6134,19 +6175,9 @@ ObOpenObjectByPointerWithTag(
   IN KPROCESSOR_MODE AccessMode,
   IN ULONG Tag,
   OUT PHANDLE Handle);
-#endif
-
-typedef ULONG LBN;
-typedef LBN *PLBN;
-
-typedef ULONG VBN;
-typedef VBN *PVBN;
+#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
 
-typedef enum _FAST_IO_POSSIBLE {
-  FastIoIsNotPossible = 0,
-  FastIoIsPossible,
-  FastIoIsQuestionable
-} FAST_IO_POSSIBLE;
+/* FSRTL Types */
 
 typedef struct _FSRTL_COMMON_FCB_HEADER {
   CSHORT NodeTypeCode;
@@ -6202,11 +6233,6 @@ typedef struct _FSRTL_ADVANCED_FCB_HEADER {
 #define FSRTL_NETWORK2_TOP_LEVEL_IRP    ((LONG_PTR)0x06)
 #define FSRTL_MAX_TOP_LEVEL_IRP_FLAG    ((LONG_PTR)0xFFFF)
 
-typedef struct _EOF_WAIT_BLOCK {
-  LIST_ENTRY EofWaitLinks;
-  KEVENT Event;
-} EOF_WAIT_BLOCK, *PEOF_WAIT_BLOCK;
-
 typedef struct _FSRTL_AUXILIARY_BUFFER {
   PVOID Buffer;
   ULONG Length;
@@ -6216,44 +6242,6 @@ typedef struct _FSRTL_AUXILIARY_BUFFER {
 
 #define FSRTL_AUXILIARY_FLAG_DEALLOCATE 0x00000001
 
-typedef struct _FILE_LOCK_INFO {
-  LARGE_INTEGER StartingByte;
-  LARGE_INTEGER Length;
-  BOOLEAN ExclusiveLock;
-  ULONG Key;
-  PFILE_OBJECT FileObject;
-  PVOID ProcessId;
-  LARGE_INTEGER EndingByte;
-} FILE_LOCK_INFO, *PFILE_LOCK_INFO;
-
-typedef NTSTATUS
-(NTAPI *PCOMPLETE_LOCK_IRP_ROUTINE) (
-  IN PVOID Context,
-  IN PIRP Irp);
-
-typedef VOID
-(NTAPI *PUNLOCK_ROUTINE) (
-  IN PVOID Context,
-  IN PFILE_LOCK_INFO FileLockInfo);
-
-typedef struct _FILE_LOCK {
-  PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine;
-  PUNLOCK_ROUTINE UnlockRoutine;
-  BOOLEAN FastIoIsQuestionable;
-  BOOLEAN SpareC[3];
-  PVOID LockInformation;
-  FILE_LOCK_INFO LastReturnedLockInfo;
-  PVOID LastReturnedLock;
-  LONG volatile LockRequestsInProgress;
-} FILE_LOCK, *PFILE_LOCK;
-
-typedef struct _TUNNEL {
-  FAST_MUTEX Mutex;
-  PRTL_SPLAY_LINKS Cache;
-  LIST_ENTRY TimerQueue;
-  USHORT NumEntries;
-} TUNNEL, *PTUNNEL;
-
 typedef enum _FSRTL_COMPARISON_RESULT {
   LessThan = -1,
   EqualTo = 0,
@@ -6267,59 +6255,6 @@ typedef enum _FSRTL_COMPARISON_RESULT {
 #define FSRTL_OLE_LEGAL                 0x10
 #define FSRTL_NTFS_STREAM_LEGAL         (FSRTL_NTFS_LEGAL | FSRTL_OLE_LEGAL)
 
-typedef struct _BASE_MCB {
-  ULONG MaximumPairCount;
-  ULONG PairCount;
-  USHORT PoolType;
-  USHORT Flags;
-  PVOID Mapping;
-} BASE_MCB, *PBASE_MCB;
-
-typedef struct _LARGE_MCB {
-  PKGUARDED_MUTEX GuardedMutex;
-  BASE_MCB BaseMcb;
-} LARGE_MCB, *PLARGE_MCB;
-
-#define MCB_FLAG_RAISE_ON_ALLOCATION_FAILURE 1
-
-typedef struct _MCB {
-  LARGE_MCB DummyFieldThatSizesThisStructureCorrectly;
-} MCB, *PMCB;
-
-typedef PVOID OPLOCK, *POPLOCK;
-
-typedef VOID
-(NTAPI *POPLOCK_WAIT_COMPLETE_ROUTINE) (
-  IN PVOID Context,
-  IN PIRP Irp);
-
-typedef VOID
-(NTAPI *POPLOCK_FS_PREPOST_IRP) (
-  IN PVOID Context,
-  IN PIRP Irp);
-
-#if (NTDDI_VERSION >= NTDDI_VISTASP1)
-#define OPLOCK_FLAG_COMPLETE_IF_OPLOCKED    0x00000001
-#endif
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-#define OPLOCK_FLAG_OPLOCK_KEY_CHECK_ONLY   0x00000002
-#define OPLOCK_FLAG_BACK_OUT_ATOMIC_OPLOCK  0x00000004
-#define OPLOCK_FLAG_IGNORE_OPLOCK_KEYS      0x00000008
-#define OPLOCK_FSCTRL_FLAG_ALL_KEYS_MATCH   0x00000001
-#endif
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-
-typedef struct _OPLOCK_KEY_ECP_CONTEXT {
-  GUID OplockKey;
-  ULONG Reserved;
-} OPLOCK_KEY_ECP_CONTEXT, *POPLOCK_KEY_ECP_CONTEXT;
-
-DEFINE_GUID( GUID_ECP_OPLOCK_KEY, 0x48850596, 0x3050, 0x4be7, 0x98, 0x63, 0xfe, 0xc3, 0x50, 0xce, 0x8d, 0x7f );
-
-#endif
-
 #define FSRTL_VOLUME_DISMOUNT           1
 #define FSRTL_VOLUME_DISMOUNT_FAILED    2
 #define FSRTL_VOLUME_LOCK               3
@@ -6335,19 +6270,6 @@ DEFINE_GUID( GUID_ECP_OPLOCK_KEY, 0x48850596, 0x3050, 0x4be7, 0x98, 0x63, 0xfe,
 #define FSRTL_VOLUME_CHANGE_SIZE        13
 #define FSRTL_VOLUME_BACKGROUND_FORMAT  14
 
-typedef PVOID PNOTIFY_SYNC;
-
-typedef BOOLEAN
-(NTAPI *PCHECK_FOR_TRAVERSE_ACCESS) (
-  IN PVOID NotifyContext,
-  IN PVOID TargetContext OPTIONAL,
-  IN PSECURITY_SUBJECT_CONTEXT SubjectContext);
-
-typedef BOOLEAN
-(NTAPI *PFILTER_REPORT_CHANGE) (
-  IN PVOID NotifyContext,
-  IN PVOID FilterContext);
-
 typedef VOID
 (NTAPI *PFSRTL_STACK_OVERFLOW_ROUTINE) (
   IN PVOID Context,
@@ -6423,11 +6345,12 @@ typedef struct _FSRTL_PER_FILEOBJECT_CONTEXT {
   PVOID InstanceId;
 } FSRTL_PER_FILEOBJECT_CONTEXT, *PFSRTL_PER_FILEOBJECT_CONTEXT;
 
-#define FsRtlEnterFileSystem    KeEnterCriticalRegion
-#define FsRtlExitFileSystem     KeLeaveCriticalRegion
-
 #define FSRTL_CC_FLUSH_ERROR_FLAG_NO_HARD_ERROR  0x1
 #define FSRTL_CC_FLUSH_ERROR_FLAG_NO_LOG_ENTRY   0x2
+/* FSRTL Functions */
+
+#define FsRtlEnterFileSystem    KeEnterCriticalRegion
+#define FsRtlExitFileSystem     KeLeaveCriticalRegion
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 
@@ -7792,14 +7715,6 @@ FsRtlRemovePerFileObjectContext(
     (InterlockedDecrement((LONG volatile *)&((FL)->LockRequestsInProgress)));\
 }
 
-extern NTKERNELAPI PUSHORT NlsOemLeadByteInfo;
-#define NLS_OEM_LEAD_BYTE_INFO            NlsOemLeadByteInfo
-
-#ifdef NLS_MB_CODE_PAGE_TAG
-#undef NLS_MB_CODE_PAGE_TAG
-#endif
-#define NLS_MB_CODE_PAGE_TAG              NlsMbOemCodePageTag
-
 /* GCC compatible definition, MS one is retarded */
 extern NTKERNELAPI const UCHAR * const FsRtlLegalAnsiCharacterArray;
 #define LEGAL_ANSI_CHARACTER_ARRAY        FsRtlLegalAnsiCharacterArray
@@ -7929,118 +7844,7 @@ FsRtlSetupAdvancedHeader(
     (IRP)->IoStatus.Status = (STATUS);             \
     IoCompleteRequest( (IRP), IO_DISK_INCREMENT ); \
 }
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-typedef struct _ECP_HEADER ECP_HEADER, *PECP_HEADER;
-#endif
-
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-
-typedef enum _NETWORK_OPEN_LOCATION_QUALIFIER {
-  NetworkOpenLocationAny,
-  NetworkOpenLocationRemote,
-  NetworkOpenLocationLoopback
-} NETWORK_OPEN_LOCATION_QUALIFIER;
-
-typedef enum _NETWORK_OPEN_INTEGRITY_QUALIFIER {
-  NetworkOpenIntegrityAny,
-  NetworkOpenIntegrityNone,
-  NetworkOpenIntegritySigned,
-  NetworkOpenIntegrityEncrypted,
-  NetworkOpenIntegrityMaximum
-} NETWORK_OPEN_INTEGRITY_QUALIFIER;
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-
-#define NETWORK_OPEN_ECP_IN_FLAG_DISABLE_HANDLE_COLLAPSING 0x1
-#define NETWORK_OPEN_ECP_IN_FLAG_DISABLE_HANDLE_DURABILITY 0x2
-#define NETWORK_OPEN_ECP_IN_FLAG_FORCE_BUFFERED_SYNCHRONOUS_IO_HACK 0x80000000
-
-typedef struct _NETWORK_OPEN_ECP_CONTEXT {
-  USHORT Size;
-  USHORT Reserved;
-  struct {
-    struct {
-      NETWORK_OPEN_LOCATION_QUALIFIER Location;
-      NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
-      ULONG Flags;
-    } in;
-    struct {
-      NETWORK_OPEN_LOCATION_QUALIFIER Location;
-      NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
-      ULONG Flags;
-    } out;
-  } DUMMYSTRUCTNAME;
-} NETWORK_OPEN_ECP_CONTEXT, *PNETWORK_OPEN_ECP_CONTEXT;
-
-typedef struct _NETWORK_OPEN_ECP_CONTEXT_V0 {
-  USHORT Size;
-  USHORT Reserved;
-  struct {
-    struct {
-    NETWORK_OPEN_LOCATION_QUALIFIER Location;
-    NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
-    } in;
-    struct {
-      NETWORK_OPEN_LOCATION_QUALIFIER Location;
-      NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
-    } out;
-  } DUMMYSTRUCTNAME;
-} NETWORK_OPEN_ECP_CONTEXT_V0, *PNETWORK_OPEN_ECP_CONTEXT_V0;
-
-#elif (NTDDI_VERSION >= NTDDI_VISTA)
-typedef struct _NETWORK_OPEN_ECP_CONTEXT {
-  USHORT Size;
-  USHORT Reserved;
-  struct {
-    struct {
-      NETWORK_OPEN_LOCATION_QUALIFIER Location;
-      NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
-    } in;
-    struct {
-      NETWORK_OPEN_LOCATION_QUALIFIER Location;
-      NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
-    } out;
-  } DUMMYSTRUCTNAME;
-} NETWORK_OPEN_ECP_CONTEXT, *PNETWORK_OPEN_ECP_CONTEXT;
-#endif
-
-DEFINE_GUID(GUID_ECP_NETWORK_OPEN_CONTEXT, 0xc584edbf, 0x00df, 0x4d28, 0xb8, 0x84, 0x35, 0xba, 0xca, 0x89, 0x11, 0xe8 );
-
-#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
-
-
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-
-typedef struct _PREFETCH_OPEN_ECP_CONTEXT {
-  PVOID Context;
-} PREFETCH_OPEN_ECP_CONTEXT, *PPREFETCH_OPEN_ECP_CONTEXT;
-
-DEFINE_GUID(GUID_ECP_PREFETCH_OPEN, 0xe1777b21, 0x847e, 0x4837, 0xaa, 0x45, 0x64, 0x16, 0x1d, 0x28, 0x6, 0x55 );
-
-#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-
-DEFINE_GUID (GUID_ECP_NFS_OPEN, 0xf326d30c, 0xe5f8, 0x4fe7, 0xab, 0x74, 0xf5, 0xa3, 0x19, 0x6d, 0x92, 0xdb);
-DEFINE_GUID(GUID_ECP_SRV_OPEN, 0xbebfaebc, 0xaabf, 0x489d, 0x9d, 0x2c, 0xe9, 0xe3, 0x61, 0x10, 0x28, 0x53 );
-
-typedef struct sockaddr_storage *PSOCKADDR_STORAGE_NFS;
-
-typedef struct _NFS_OPEN_ECP_CONTEXT {
-  PUNICODE_STRING ExportAlias;
-  PSOCKADDR_STORAGE_NFS ClientSocketAddress;
-} NFS_OPEN_ECP_CONTEXT, *PNFS_OPEN_ECP_CONTEXT, **PPNFS_OPEN_ECP_CONTEXT;
-
-typedef struct _SRV_OPEN_ECP_CONTEXT {
-  PUNICODE_STRING ShareName;
-  PSOCKADDR_STORAGE_NFS SocketAddress;
-  BOOLEAN OplockBlockState;
-  BOOLEAN OplockAppState;
-  BOOLEAN OplockFinalState;
-} SRV_OPEN_ECP_CONTEXT, *PSRV_OPEN_ECP_CONTEXT;
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
+/* Common Cache Types */
 
 #define VACB_MAPPING_GRANULARITY        (0x40000)
 #define VACB_OFFSET_SHIFT               (18)
@@ -8108,6 +7912,13 @@ typedef VOID
   IN PVOID Context1,
   IN PVOID Context2);
 
+#define UNINITIALIZE_CACHE_MAPS          (1)
+#define DO_NOT_RETRY_PURGE               (2)
+#define DO_NOT_PURGE_DIRTY_PAGES         (0x4)
+
+#define CC_FLUSH_AND_PURGE_NO_PURGE     (0x1)
+/* Common Cache Functions */
+
 #define CcIsFileCached(FO) (                                                         \
     ((FO)->SectionObjectPointer != NULL) &&                                          \
     (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
@@ -8497,12 +8308,6 @@ CcCoherencyFlushAndPurgeCache(
     ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
 )
 
-#define UNINITIALIZE_CACHE_MAPS          (1)
-#define DO_NOT_RETRY_PURGE               (2)
-#define DO_NOT_PURGE_DIRTY_PAGES         (0x4)
-
-#define CC_FLUSH_AND_PURGE_NO_PURGE     (0x1)
-
 #if (NTDDI_VERSION >= NTDDI_VISTA)
 NTKERNELAPI
 BOOLEAN
@@ -8540,42 +8345,45 @@ CcCopyWriteWontFlush(
         CcScheduleReadAhead((FO), (FOFF), (LEN));   \
     }                                               \
 )
+/******************************************************************************
+ *                            ZwXxx Functions                                 *
+ ******************************************************************************/
 
-#define PIN_WAIT                        (1)
-#define PIN_EXCLUSIVE                   (2)
-#define PIN_NO_READ                     (4)
-#define PIN_IF_BCB                      (8)
-#define PIN_CALLER_TRACKS_DIRTY_DATA    (32)
-#define PIN_HIGH_PRIORITY               (64)
-
-#define MAP_WAIT                          1
-#define MAP_NO_READ                       (16)
-#define MAP_HIGH_PRIORITY                 (64)
-
-#define IOCTL_REDIR_QUERY_PATH          CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
-#define IOCTL_REDIR_QUERY_PATH_EX       CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 100, METHOD_NEITHER, FILE_ANY_ACCESS)
 
-typedef struct _QUERY_PATH_REQUEST {
-  ULONG PathNameLength;
-  PIO_SECURITY_CONTEXT SecurityContext;
-  WCHAR FilePathName[1];
-} QUERY_PATH_REQUEST, *PQUERY_PATH_REQUEST;
 
-typedef struct _QUERY_PATH_REQUEST_EX {
-  PIO_SECURITY_CONTEXT pSecurityContext;
-  ULONG EaLength;
-  PVOID pEaBuffer;
-  UNICODE_STRING PathName;
-  UNICODE_STRING DomainServiceName;
-  ULONG_PTR Reserved[ 3 ];
-} QUERY_PATH_REQUEST_EX, *PQUERY_PATH_REQUEST_EX;
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwQueryEaFile(
+  IN HANDLE FileHandle,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  OUT PVOID Buffer,
+  IN ULONG Length,
+  IN BOOLEAN ReturnSingleEntry,
+  IN PVOID EaList OPTIONAL,
+  IN ULONG EaListLength,
+  IN PULONG EaIndex OPTIONAL,
+  IN BOOLEAN RestartScan);
 
-typedef struct _QUERY_PATH_RESPONSE {
-  ULONG LengthAccepted;
-} QUERY_PATH_RESPONSE, *PQUERY_PATH_RESPONSE;
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwSetEaFile(
+  IN HANDLE FileHandle,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  OUT PVOID Buffer,
+  IN ULONG Length);
 
-#define VOLSNAPCONTROLTYPE                              0x00000053
-#define IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES             CTL_CODE(VOLSNAPCONTROLTYPE, 0, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwDuplicateToken(
+  IN HANDLE ExistingTokenHandle,
+  IN ACCESS_MASK DesiredAccess,
+  IN POBJECT_ATTRIBUTES ObjectAttributes,
+  IN BOOLEAN EffectiveOnly,
+  IN TOKEN_TYPE TokenType,
+  OUT PHANDLE NewTokenHandle);
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 
@@ -8752,7 +8560,6 @@ ZwQuerySecurityObject(
   OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
   IN ULONG Length,
   OUT PULONG ResultLength);
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
 #if (NTDDI_VERSION >= NTDDI_WINXP)
@@ -8776,7 +8583,7 @@ ZwOpenThreadTokenEx(
   IN ULONG HandleAttributes,
   OUT PHANDLE TokenHandle);
 
-#endif
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
 #if (NTDDI_VERSION >= NTDDI_VISTA)
 
@@ -8834,10 +8641,9 @@ NTAPI
 ZwFlushBuffersFile(
   IN HANDLE FileHandle,
   OUT PIO_STATUS_BLOCK IoStatusBlock);
-
 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
-
 #if (NTDDI_VERSION >= NTDDI_WIN7)
+
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -8846,42 +8652,323 @@ ZwSetInformationToken(
   IN TOKEN_INFORMATION_CLASS TokenInformationClass,
   IN PVOID TokenInformation,
   IN ULONG TokenInformationLength);
+#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
+
+
+#define INVALID_PROCESSOR_INDEX     0xffffffff
+
+#define EX_PUSH_LOCK ULONG_PTR
+#define PEX_PUSH_LOCK PULONG_PTR
+
+/* #if !defined(_X86AMD64_)  FIXME : WHAT ?! */
+#if defined(_WIN64)
+
+C_ASSERT(sizeof(ERESOURCE) == 0x68);
+C_ASSERT(FIELD_OFFSET(ERESOURCE,ActiveCount) == 0x18);
+C_ASSERT(FIELD_OFFSET(ERESOURCE,Flag) == 0x1a);
+
+#else
+
+C_ASSERT(sizeof(ERESOURCE) == 0x38);
+C_ASSERT(FIELD_OFFSET(ERESOURCE,ActiveCount) == 0x0c);
+C_ASSERT(FIELD_OFFSET(ERESOURCE,Flag) == 0x0e);
+
 #endif
+/* #endif */
 
-NTSYSAPI
-NTSTATUS
+#if defined(_IA64_)
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+//DECLSPEC_DEPRECATED_DDK
+NTHALAPI
+ULONG
 NTAPI
-ZwQueryEaFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  OUT PVOID Buffer,
-  IN ULONG Length,
-  IN BOOLEAN ReturnSingleEntry,
-  IN PVOID EaList OPTIONAL,
-  IN ULONG EaListLength,
-  IN PULONG EaIndex OPTIONAL,
-  IN BOOLEAN RestartScan);
+HalGetDmaAlignmentRequirement(
+  VOID);
+#endif
+#endif
 
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwSetEaFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  OUT PVOID Buffer,
-  IN ULONG Length);
+#if defined(_M_IX86) || defined(_M_AMD64)
+#define HalGetDmaAlignmentRequirement() 1L
+#endif
 
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwDuplicateToken(
-  IN HANDLE ExistingTokenHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN POBJECT_ATTRIBUTES ObjectAttributes,
-  IN BOOLEAN EffectiveOnly,
-  IN TOKEN_TYPE TokenType,
-  OUT PHANDLE NewTokenHandle);
+typedef ULONG LBN;
+typedef LBN *PLBN;
+
+typedef ULONG VBN;
+typedef VBN *PVBN;
+
+typedef enum _FAST_IO_POSSIBLE {
+  FastIoIsNotPossible = 0,
+  FastIoIsPossible,
+  FastIoIsQuestionable
+} FAST_IO_POSSIBLE;
+
+typedef struct _EOF_WAIT_BLOCK {
+  LIST_ENTRY EofWaitLinks;
+  KEVENT Event;
+} EOF_WAIT_BLOCK, *PEOF_WAIT_BLOCK;
+
+typedef struct _FILE_LOCK_INFO {
+  LARGE_INTEGER StartingByte;
+  LARGE_INTEGER Length;
+  BOOLEAN ExclusiveLock;
+  ULONG Key;
+  PFILE_OBJECT FileObject;
+  PVOID ProcessId;
+  LARGE_INTEGER EndingByte;
+} FILE_LOCK_INFO, *PFILE_LOCK_INFO;
+
+typedef NTSTATUS
+(NTAPI *PCOMPLETE_LOCK_IRP_ROUTINE) (
+  IN PVOID Context,
+  IN PIRP Irp);
+
+typedef VOID
+(NTAPI *PUNLOCK_ROUTINE) (
+  IN PVOID Context,
+  IN PFILE_LOCK_INFO FileLockInfo);
+
+typedef struct _FILE_LOCK {
+  PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine;
+  PUNLOCK_ROUTINE UnlockRoutine;
+  BOOLEAN FastIoIsQuestionable;
+  BOOLEAN SpareC[3];
+  PVOID LockInformation;
+  FILE_LOCK_INFO LastReturnedLockInfo;
+  PVOID LastReturnedLock;
+  LONG volatile LockRequestsInProgress;
+} FILE_LOCK, *PFILE_LOCK;
+
+typedef struct _TUNNEL {
+  FAST_MUTEX Mutex;
+  PRTL_SPLAY_LINKS Cache;
+  LIST_ENTRY TimerQueue;
+  USHORT NumEntries;
+} TUNNEL, *PTUNNEL;
+
+typedef struct _BASE_MCB {
+  ULONG MaximumPairCount;
+  ULONG PairCount;
+  USHORT PoolType;
+  USHORT Flags;
+  PVOID Mapping;
+} BASE_MCB, *PBASE_MCB;
+
+typedef struct _LARGE_MCB {
+  PKGUARDED_MUTEX GuardedMutex;
+  BASE_MCB BaseMcb;
+} LARGE_MCB, *PLARGE_MCB;
+
+#define MCB_FLAG_RAISE_ON_ALLOCATION_FAILURE 1
+
+typedef struct _MCB {
+  LARGE_MCB DummyFieldThatSizesThisStructureCorrectly;
+} MCB, *PMCB;
+
+typedef PVOID OPLOCK, *POPLOCK;
+
+typedef VOID
+(NTAPI *POPLOCK_WAIT_COMPLETE_ROUTINE) (
+  IN PVOID Context,
+  IN PIRP Irp);
+
+typedef VOID
+(NTAPI *POPLOCK_FS_PREPOST_IRP) (
+  IN PVOID Context,
+  IN PIRP Irp);
+
+#if (NTDDI_VERSION >= NTDDI_VISTASP1)
+#define OPLOCK_FLAG_COMPLETE_IF_OPLOCKED    0x00000001
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+#define OPLOCK_FLAG_OPLOCK_KEY_CHECK_ONLY   0x00000002
+#define OPLOCK_FLAG_BACK_OUT_ATOMIC_OPLOCK  0x00000004
+#define OPLOCK_FLAG_IGNORE_OPLOCK_KEYS      0x00000008
+#define OPLOCK_FSCTRL_FLAG_ALL_KEYS_MATCH   0x00000001
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+
+typedef struct _OPLOCK_KEY_ECP_CONTEXT {
+  GUID OplockKey;
+  ULONG Reserved;
+} OPLOCK_KEY_ECP_CONTEXT, *POPLOCK_KEY_ECP_CONTEXT;
+
+DEFINE_GUID( GUID_ECP_OPLOCK_KEY, 0x48850596, 0x3050, 0x4be7, 0x98, 0x63, 0xfe, 0xc3, 0x50, 0xce, 0x8d, 0x7f );
+
+#endif
+
+typedef PVOID PNOTIFY_SYNC;
+
+typedef BOOLEAN
+(NTAPI *PCHECK_FOR_TRAVERSE_ACCESS) (
+  IN PVOID NotifyContext,
+  IN PVOID TargetContext OPTIONAL,
+  IN PSECURITY_SUBJECT_CONTEXT SubjectContext);
+
+typedef BOOLEAN
+(NTAPI *PFILTER_REPORT_CHANGE) (
+  IN PVOID NotifyContext,
+  IN PVOID FilterContext);
+
+extern NTKERNELAPI PUSHORT NlsOemLeadByteInfo;
+#define NLS_OEM_LEAD_BYTE_INFO            NlsOemLeadByteInfo
+
+#ifdef NLS_MB_CODE_PAGE_TAG
+#undef NLS_MB_CODE_PAGE_TAG
+#endif
+#define NLS_MB_CODE_PAGE_TAG              NlsMbOemCodePageTag
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+typedef struct _ECP_HEADER ECP_HEADER, *PECP_HEADER;
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+
+typedef enum _NETWORK_OPEN_LOCATION_QUALIFIER {
+  NetworkOpenLocationAny,
+  NetworkOpenLocationRemote,
+  NetworkOpenLocationLoopback
+} NETWORK_OPEN_LOCATION_QUALIFIER;
+
+typedef enum _NETWORK_OPEN_INTEGRITY_QUALIFIER {
+  NetworkOpenIntegrityAny,
+  NetworkOpenIntegrityNone,
+  NetworkOpenIntegritySigned,
+  NetworkOpenIntegrityEncrypted,
+  NetworkOpenIntegrityMaximum
+} NETWORK_OPEN_INTEGRITY_QUALIFIER;
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+
+#define NETWORK_OPEN_ECP_IN_FLAG_DISABLE_HANDLE_COLLAPSING 0x1
+#define NETWORK_OPEN_ECP_IN_FLAG_DISABLE_HANDLE_DURABILITY 0x2
+#define NETWORK_OPEN_ECP_IN_FLAG_FORCE_BUFFERED_SYNCHRONOUS_IO_HACK 0x80000000
+
+typedef struct _NETWORK_OPEN_ECP_CONTEXT {
+  USHORT Size;
+  USHORT Reserved;
+  struct {
+    struct {
+      NETWORK_OPEN_LOCATION_QUALIFIER Location;
+      NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
+      ULONG Flags;
+    } in;
+    struct {
+      NETWORK_OPEN_LOCATION_QUALIFIER Location;
+      NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
+      ULONG Flags;
+    } out;
+  } DUMMYSTRUCTNAME;
+} NETWORK_OPEN_ECP_CONTEXT, *PNETWORK_OPEN_ECP_CONTEXT;
+
+typedef struct _NETWORK_OPEN_ECP_CONTEXT_V0 {
+  USHORT Size;
+  USHORT Reserved;
+  struct {
+    struct {
+    NETWORK_OPEN_LOCATION_QUALIFIER Location;
+    NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
+    } in;
+    struct {
+      NETWORK_OPEN_LOCATION_QUALIFIER Location;
+      NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
+    } out;
+  } DUMMYSTRUCTNAME;
+} NETWORK_OPEN_ECP_CONTEXT_V0, *PNETWORK_OPEN_ECP_CONTEXT_V0;
+
+#elif (NTDDI_VERSION >= NTDDI_VISTA)
+typedef struct _NETWORK_OPEN_ECP_CONTEXT {
+  USHORT Size;
+  USHORT Reserved;
+  struct {
+    struct {
+      NETWORK_OPEN_LOCATION_QUALIFIER Location;
+      NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
+    } in;
+    struct {
+      NETWORK_OPEN_LOCATION_QUALIFIER Location;
+      NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
+    } out;
+  } DUMMYSTRUCTNAME;
+} NETWORK_OPEN_ECP_CONTEXT, *PNETWORK_OPEN_ECP_CONTEXT;
+#endif
+
+DEFINE_GUID(GUID_ECP_NETWORK_OPEN_CONTEXT, 0xc584edbf, 0x00df, 0x4d28, 0xb8, 0x84, 0x35, 0xba, 0xca, 0x89, 0x11, 0xe8 );
+
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+
+typedef struct _PREFETCH_OPEN_ECP_CONTEXT {
+  PVOID Context;
+} PREFETCH_OPEN_ECP_CONTEXT, *PPREFETCH_OPEN_ECP_CONTEXT;
+
+DEFINE_GUID(GUID_ECP_PREFETCH_OPEN, 0xe1777b21, 0x847e, 0x4837, 0xaa, 0x45, 0x64, 0x16, 0x1d, 0x28, 0x6, 0x55 );
+
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+
+DEFINE_GUID (GUID_ECP_NFS_OPEN, 0xf326d30c, 0xe5f8, 0x4fe7, 0xab, 0x74, 0xf5, 0xa3, 0x19, 0x6d, 0x92, 0xdb);
+DEFINE_GUID(GUID_ECP_SRV_OPEN, 0xbebfaebc, 0xaabf, 0x489d, 0x9d, 0x2c, 0xe9, 0xe3, 0x61, 0x10, 0x28, 0x53 );
+
+typedef struct sockaddr_storage *PSOCKADDR_STORAGE_NFS;
+
+typedef struct _NFS_OPEN_ECP_CONTEXT {
+  PUNICODE_STRING ExportAlias;
+  PSOCKADDR_STORAGE_NFS ClientSocketAddress;
+} NFS_OPEN_ECP_CONTEXT, *PNFS_OPEN_ECP_CONTEXT, **PPNFS_OPEN_ECP_CONTEXT;
+
+typedef struct _SRV_OPEN_ECP_CONTEXT {
+  PUNICODE_STRING ShareName;
+  PSOCKADDR_STORAGE_NFS SocketAddress;
+  BOOLEAN OplockBlockState;
+  BOOLEAN OplockAppState;
+  BOOLEAN OplockFinalState;
+} SRV_OPEN_ECP_CONTEXT, *PSRV_OPEN_ECP_CONTEXT;
+
+#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
+
+#define PIN_WAIT                        (1)
+#define PIN_EXCLUSIVE                   (2)
+#define PIN_NO_READ                     (4)
+#define PIN_IF_BCB                      (8)
+#define PIN_CALLER_TRACKS_DIRTY_DATA    (32)
+#define PIN_HIGH_PRIORITY               (64)
+
+#define MAP_WAIT                          1
+#define MAP_NO_READ                       (16)
+#define MAP_HIGH_PRIORITY                 (64)
+
+#define IOCTL_REDIR_QUERY_PATH          CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define IOCTL_REDIR_QUERY_PATH_EX       CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 100, METHOD_NEITHER, FILE_ANY_ACCESS)
+
+typedef struct _QUERY_PATH_REQUEST {
+  ULONG PathNameLength;
+  PIO_SECURITY_CONTEXT SecurityContext;
+  WCHAR FilePathName[1];
+} QUERY_PATH_REQUEST, *PQUERY_PATH_REQUEST;
+
+typedef struct _QUERY_PATH_REQUEST_EX {
+  PIO_SECURITY_CONTEXT pSecurityContext;
+  ULONG EaLength;
+  PVOID pEaBuffer;
+  UNICODE_STRING PathName;
+  UNICODE_STRING DomainServiceName;
+  ULONG_PTR Reserved[ 3 ];
+} QUERY_PATH_REQUEST_EX, *PQUERY_PATH_REQUEST_EX;
+
+typedef struct _QUERY_PATH_RESPONSE {
+  ULONG LengthAccepted;
+} QUERY_PATH_RESPONSE, *PQUERY_PATH_RESPONSE;
+
+#define VOLSNAPCONTROLTYPE                              0x00000053
+#define IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES             CTL_CODE(VOLSNAPCONTROLTYPE, 0, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
 
+/* FIXME : These definitions below don't belong here (or anywhere in ddk really) */
 #pragma pack(push,4)
 
 #ifndef VER_PRODUCTBUILD
index 6c3f09e..014a58d 100644 (file)
@@ -551,7 +551,6 @@ typedef BOOLEAN
 (*PFN_RTL_IS_SERVICE_PACK_VERSION_INSTALLED)(
   IN ULONG Version);
 
-
 /******************************************************************************
  *                              Kernel Types                                  *
  ******************************************************************************/
@@ -2271,7 +2270,6 @@ typedef struct _SE_ADT_PARAMETER_ARRAY {
 
 #endif /* !_NTLSA_AUDIT_ */
 #endif /* !_NTLSA_IFS_ */
-
 /******************************************************************************
  *                            Power Management Support Types                  *
  ******************************************************************************/
@@ -2683,7 +2681,6 @@ NTSTATUS
   IN OUT PVOID Context OPTIONAL);
 typedef POWER_SETTING_CALLBACK *PPOWER_SETTING_CALLBACK;
 
-
 /******************************************************************************
  *                            Configuration Manager Types                     *
  ******************************************************************************/
@@ -8399,8 +8396,6 @@ RtlStringFromGUID(
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 
-
-
 NTSYSAPI
 BOOLEAN
 NTAPI
@@ -8879,7 +8874,6 @@ RtlSetDaclSecurityDescriptor(
 #define RtlStoreUlongPtr(Address,Value) RtlStoreUlong(Address,Value)
 #endif /* _WIN64 */
 
-
 NTSYSAPI
 BOOLEAN
 NTAPI
@@ -8988,7 +8982,6 @@ RtlPrefetchMemoryNonTemporal(
 #if (NTDDI_VERSION >= NTDDI_WINXP)
 
 
-
 NTSYSAPI
 VOID
 NTAPI
@@ -9026,11 +9019,11 @@ RtlHashUnicodeString(
   OUT PULONG HashValue);
 
 
-#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
-#if (NTDDI_VERSION >= NTDDI_VISTA)
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
 
+#if (NTDDI_VERSION >= NTDDI_VISTA)
 
 NTSYSAPI
 ULONG
@@ -9086,8 +9079,6 @@ RtlCmEncodeMemIoResource(
 
 #if (NTDDI_VERSION >= NTDDI_WIN7)
 
-
-
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -9663,7 +9654,6 @@ RTLVERLIB_DDI(RtlIsServicePackVersionInstalled)(
 /******************************************************************************
  *                              Kernel Functions                              *
  ******************************************************************************/
-
 NTKERNELAPI
 VOID
 NTAPI
@@ -9680,7 +9670,6 @@ KeClearEvent(
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 
-
 #if defined(_NTDDK_) || defined(_NTIFS_)
 NTKERNELAPI
 VOID
@@ -9699,7 +9688,6 @@ ProbeForWrite(
   IN SIZE_T Length,
   IN ULONG Alignment);
 
-
 #if defined(SINGLE_GROUP_LEGACY_API)
 
 NTKERNELAPI
@@ -9724,8 +9712,6 @@ NTKERNELAPI
 KAFFINITY
 NTAPI
 KeQueryActiveProcessors(VOID);
-
-
 #endif /* defined(SINGLE_GROUP_LEGACY_API) */
 
 #if !defined(_M_AMD64)
@@ -10164,7 +10150,6 @@ VOID
 NTAPI
 KeFlushQueuedDpcs(VOID);
 #endif /* (NTDDI_VERSION >= NTDDI_WINXPSP2) */
-
 #if (NTDDI_VERSION >= NTDDI_WS03)
 
 NTKERNELAPI
@@ -10214,12 +10199,9 @@ FASTCALL
 KeTestSpinLock(
   IN PKSPIN_LOCK SpinLock);
 
-
 #endif /* (NTDDI_VERSION >= NTDDI_WS03) */
-
 #if (NTDDI_VERSION >= NTDDI_WS03SP1)
 
-
 NTKERNELAPI
 BOOLEAN
 FASTCALL
@@ -10276,11 +10258,9 @@ BOOLEAN
 FASTCALL
 KeTryToAcquireGuardedMutex(
   IN OUT PKGUARDED_MUTEX GuardedMutex);
-
 #endif /* (NTDDI_VERSION >= NTDDI_WS03SP1) */
 
 #if (NTDDI_VERSION >= NTDDI_VISTA)
-
 NTKERNELAPI
 VOID
 FASTCALL
@@ -10299,7 +10279,6 @@ NTSTATUS
 NTAPI
 KeQueryDpcWatchdogInformation(
   OUT PKDPC_WATCHDOG_INFORMATION WatchdogInformation);
-
 #if defined(SINGLE_GROUP_LEGACY_API)
 
 NTKERNELAPI
@@ -10341,10 +10320,8 @@ KeDeregisterProcessorChangeCallback(
   IN PVOID CallbackHandle);
 
 #endif /* (NTDDI_VERSION >= NTDDI_WS08) */
-
 #if (NTDDI_VERSION >= NTDDI_WIN7)
 
-
 ULONG64
 NTAPI
 KeQueryTotalCycleTimeProcess(
@@ -10482,9 +10459,7 @@ ULONG
 NTAPI
 KeGetProcessorIndexFromNumber(
   IN PPROCESSOR_NUMBER ProcNumber);
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
-
 #if !defined(_IA64_)
 NTHALAPI
 VOID
@@ -10699,7 +10674,6 @@ KeFlushWriteBuffer(VOID);
 }
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
-
 NTKERNELAPI
 PVOID
 NTAPI
@@ -10946,7 +10920,6 @@ MmAddVerifierThunks(
   IN ULONG ThunkBufferSize);
 
 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
-
 #if (NTDDI_VERSION >= NTDDI_WS03)
 NTKERNELAPI
 LOGICAL
@@ -10954,8 +10927,8 @@ NTAPI
 MmIsIoSpaceActive(
   IN PHYSICAL_ADDRESS StartAddress,
   IN SIZE_T NumberOfBytes);
-#endif
 
+#endif /* (NTDDI_VERSION >= NTDDI_WS03) */
 #if (NTDDI_VERSION >= NTDDI_WS03SP1)
 NTKERNELAPI
 PMDL
@@ -10970,20 +10943,18 @@ MmAllocatePagesForMdlEx(
 #endif
 
 #if (NTDDI_VERSION >= NTDDI_VISTA)
-
 NTKERNELAPI
 LOGICAL
 NTAPI
 MmIsDriverVerifyingByAddress(
   IN PVOID AddressWithinSection);
-#endif
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
 
 /******************************************************************************
  *                            Security Manager Functions                      *
  ******************************************************************************/
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
-
 NTKERNELAPI
 BOOLEAN
 NTAPI
@@ -11068,6 +11039,7 @@ NTAPI
 SeLockSubjectContext(
   IN PSECURITY_SUBJECT_CONTEXT SubjectContext);
 
+
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
 #if (NTDDI_VERSION >= NTDDI_WS03SP1)
@@ -11091,7 +11063,6 @@ SeReportSecurityEvent(
 #endif /* (NTDDI_VERSION >= NTDDI_WS03SP1) */
 
 #if (NTDDI_VERSION >= NTDDI_VISTA)
-
 NTKERNELAPI
 ULONG
 NTAPI
@@ -11108,7 +11079,6 @@ SeGetWorldRights(
   IN PGENERIC_MAPPING GenericMapping,
   OUT PACCESS_MASK GrantedAccess);
 #endif /* SE_NTFS_WORLD_CACHE */
-
 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
 /******************************************************************************
  *                         Configuration Manager Functions                    *
@@ -12374,8 +12344,10 @@ NTAPI
 IoSetTopLevelIrp(
   IN PIRP Irp OPTIONAL);
 
+
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
+
 #if (NTDDI_VERSION >= NTDDI_WINXP)
 
 NTKERNELAPI
@@ -12570,6 +12542,7 @@ IoCsqInsertIrpEx(
   IN PVOID InsertContext OPTIONAL);
 #endif /* (NTDDI_VERSION >= NTDDI_WS03) */
 
+
 #if (NTDDI_VERSION >= NTDDI_VISTA)
 NTKERNELAPI
 NTSTATUS
@@ -12719,6 +12692,7 @@ IoReplacePartitionUnit(
 #endif
 
 #if (NTDDI_VERSION >= NTDDI_WIN7)
+
 NTKERNELAPI
 NTSTATUS
 NTAPI
@@ -13401,6 +13375,7 @@ ExInitializeFastMutex(
   return;
 }
 
+
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 NTKERNELAPI
 VOID
@@ -13823,7 +13798,6 @@ VOID
 FASTCALL
 ExWaitForRundownProtectionRelease(
   IN OUT PEX_RUNDOWN_REF RunRef);
-
 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
 #if (NTDDI_VERSION >= NTDDI_WINXPSP2)
@@ -14066,7 +14040,6 @@ ExFreeToNPagedLookasideList(
  ******************************************************************************/
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
-
 NTKERNELAPI
 LONG_PTR
 FASTCALL
@@ -14115,7 +14088,6 @@ NTAPI
 ObReleaseObjectSecurity(
   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
   IN BOOLEAN MemoryAllocated);
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
 #if (NTDDI_VERSION >= NTDDI_VISTA)
@@ -14148,7 +14120,6 @@ ObGetFilterVersion(VOID);
 #endif /* (NTDDI_VERSION >= NTDDI_VISTASP1) */
 
 #if (NTDDI_VERSION >= NTDDI_WIN7)
-
 NTKERNELAPI
 NTSTATUS
 NTAPI
@@ -14196,10 +14167,8 @@ ObDereferenceObjectDeferDeleteWithTag(
 #define ObReferenceObject ObfReferenceObject
 #define ObDereferenceObjectWithTag ObfDereferenceObjectWithTag
 #define ObReferenceObjectWithTag ObfReferenceObjectWithTag
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
 
-
 /******************************************************************************
  *                          Process Manager Functions                         *
  ******************************************************************************/
@@ -14249,9 +14218,9 @@ NTAPI
 PsTerminateSystemThread(
   IN NTSTATUS ExitStatus);
 
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
+
 /******************************************************************************
  *                          WMI Library Support Functions                     *
  ******************************************************************************/
@@ -15321,11 +15290,8 @@ NtPropagationFailed(
 #define ZwCurrentThread() NtCurrentThread()
 
 
-
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 
-
-
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -15591,7 +15557,6 @@ ZwQueryFullAttributesFile(
   IN POBJECT_ATTRIBUTES ObjectAttributes,
   OUT PFILE_NETWORK_OPEN_INFORMATION FileInformation);
 
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
 
@@ -15927,15 +15892,9 @@ NTAPI
 ZwSinglePhaseReject(
   IN HANDLE EnlistmentHandle,
   IN PLARGE_INTEGER TmVirtualClock OPTIONAL);
-
-
 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
-
-
 #if (NTDDI_VERSION >= NTDDI_WIN7)
 
-
-
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -15999,7 +15958,6 @@ ZwSetInformationKey(
   IN PVOID KeySetInformation,
   IN ULONG KeySetInformationLength);
 
-
 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
 
 
diff --git a/include/ddk/wmlib.h b/include/ddk/wmlib.h
deleted file mode 100644 (file)
index 98b8575..0000000
+++ /dev/null
@@ -1,129 +0,0 @@
-
-#ifndef _WMILIB_
-#define _WMILIB_
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-typedef struct _WMIGUIDREGINFO {
-  LPCGUID Guid;
-  ULONG InstanceCount;
-  ULONG Flags;
-} WMIGUIDREGINFO, *PWMIGUIDREGINFO;
-
-typedef enum _WMIENABLEDISABLECONTROL {
-  WmiEventControl,
-  WmiDataBlockControl
-} WMIENABLEDISABLECONTROL, *PWMIENABLEDISABLECONTROL;
-
-typedef enum _SYSCTL_IRP_DISPOSITION {
-  IrpProcessed,
-  IrpNotCompleted,
-  IrpNotWmi,
-  IrpForward
-} SYSCTL_IRP_DISPOSITION, *PSYSCTL_IRP_DISPOSITION;
-
-typedef
-NTSTATUS
-(NTAPI WMI_QUERY_REGINFO_CALLBACK)(
-  IN OUT PDEVICE_OBJECT DeviceObject,
-  IN OUT PULONG RegFlags,
-  IN OUT PUNICODE_STRING InstanceName,
-  IN OUT PUNICODE_STRING *RegistryPath OPTIONAL,
-  IN OUT PUNICODE_STRING MofResourceName,
-  OUT PDEVICE_OBJECT *Pdo OPTIONAL);
-
-typedef WMI_QUERY_REGINFO_CALLBACK *PWMI_QUERY_REGINFO;
-
-typedef
-NTSTATUS
-(NTAPI WMI_QUERY_DATABLOCK_CALLBACK)(
-  IN OUT PDEVICE_OBJECT DeviceObject,
-  IN OUT PIRP Irp,
-  IN OUT ULONG GuidIndex,
-  IN ULONG InstanceIndex,
-  IN ULONG InstanceCount,
-  OUT PULONG InstanceLengthArray OPTIONAL,
-  IN ULONG BufferAvail,
-  OUT PUCHAR Buffer OPTIONAL);
-
-typedef WMI_QUERY_DATABLOCK_CALLBACK *PWMI_QUERY_DATABLOCK;
-
-typedef
-NTSTATUS
-(NTAPI WMI_SET_DATABLOCK_CALLBACK)(
-  IN OUT PDEVICE_OBJECT DeviceObject,
-  IN OUT PIRP Irp,
-  IN ULONG GuidIndex,
-  IN ULONG InstanceIndex,
-  IN ULONG BufferSize,
-  IN  PUCHAR Buffer);
-
-typedef WMI_SET_DATABLOCK_CALLBACK *PWMI_SET_DATABLOCK;
-
-typedef
-NTSTATUS
-(NTAPI WMI_SET_DATAITEM_CALLBACK)(
-  IN OUT PDEVICE_OBJECT DeviceObject,
-  IN OUT PIRP Irp,
-  IN ULONG GuidIndex,
-  IN ULONG InstanceIndex,
-  IN ULONG DataItemId,
-  IN ULONG BufferSize,
-  IN PUCHAR Buffer);
-
-typedef WMI_SET_DATAITEM_CALLBACK *PWMI_SET_DATAITEM;
-
-typedef
-NTSTATUS
-(NTAPI WMI_EXECUTE_METHOD_CALLBACK)(
-  IN OUT PDEVICE_OBJECT DeviceObject,
-  IN OUT PIRP Irp,
-  IN ULONG GuidIndex,
-  IN ULONG InstanceIndex,
-  IN ULONG MethodId,
-  IN ULONG InBufferSize,
-  IN ULONG OutBufferSize,
-  IN OUT PUCHAR Buffer);
-
-typedef WMI_EXECUTE_METHOD_CALLBACK *PWMI_EXECUTE_METHOD;
-
-typedef
-NTSTATUS
-(NTAPI WMI_FUNCTION_CONTROL_CALLBACK)(
-  IN OUT PDEVICE_OBJECT DeviceObject,
-  IN OUT PIRP Irp,
-  IN ULONG GuidIndex,
-  IN WMIENABLEDISABLECONTROL Function,
-  IN BOOLEAN Enable);
-
-typedef WMI_FUNCTION_CONTROL_CALLBACK *PWMI_FUNCTION_CONTROL;
-
-typedef struct _WMILIB_CONTEXT {
-  ULONG GuidCount;
-  PWMIGUIDREGINFO GuidList;
-  PWMI_QUERY_REGINFO QueryWmiRegInfo;
-  PWMI_QUERY_DATABLOCK QueryWmiDataBlock;
-  PWMI_SET_DATABLOCK SetWmiDataBlock;
-  PWMI_SET_DATAITEM SetWmiDataItem;
-  PWMI_EXECUTE_METHOD ExecuteWmiMethod;
-  PWMI_FUNCTION_CONTROL WmiFunctionControl;
-} WMILIB_CONTEXT, *PWMILIB_CONTEXT;
-
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-NTSTATUS
-NTAPI
-WmiSystemControl(
-  IN PWMILIB_CONTEXT WmiLibInfo,
-  IN PDEVICE_OBJECT DeviceObject,
-  IN OUT PIRP Irp,
-  OUT PSYSCTL_IRP_DISPOSITION IrpDisposition);
-#endif
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* !_WMILIB_ */
-
diff --git a/include/xdk/ccfuncs.h b/include/xdk/ccfuncs.h
new file mode 100644 (file)
index 0000000..ff15927
--- /dev/null
@@ -0,0 +1,430 @@
+$if (_NTIFS_)
+/* Common Cache Functions */
+
+#define CcIsFileCached(FO) (                                                         \
+    ((FO)->SectionObjectPointer != NULL) &&                                          \
+    (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
+)
+
+extern ULONG CcFastMdlReadWait;
+
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
+NTKERNELAPI
+VOID
+NTAPI
+CcInitializeCacheMap(
+  IN PFILE_OBJECT FileObject,
+  IN PCC_FILE_SIZES FileSizes,
+  IN BOOLEAN PinAccess,
+  IN PCACHE_MANAGER_CALLBACKS Callbacks,
+  IN PVOID LazyWriteContext);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcUninitializeCacheMap(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER TruncateSize OPTIONAL,
+  IN PCACHE_UNINITIALIZE_EVENT UninitializeCompleteEvent OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetFileSizes(
+  IN PFILE_OBJECT FileObject,
+  IN PCC_FILE_SIZES FileSizes);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetDirtyPageThreshold(
+  IN PFILE_OBJECT FileObject,
+  IN ULONG DirtyPageThreshold);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcFlushCache(
+  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+  IN PLARGE_INTEGER FileOffset OPTIONAL,
+  IN ULONG Length,
+  OUT PIO_STATUS_BLOCK IoStatus OPTIONAL);
+
+NTKERNELAPI
+LARGE_INTEGER
+NTAPI
+CcGetFlushedValidData(
+  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+  IN BOOLEAN BcbListHeld);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcZeroData(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER StartOffset,
+  IN PLARGE_INTEGER EndOffset,
+  IN BOOLEAN Wait);
+
+NTKERNELAPI
+PVOID
+NTAPI
+CcRemapBcb(
+  IN PVOID Bcb);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcRepinBcb(
+  IN PVOID Bcb);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcUnpinRepinnedBcb(
+  IN PVOID Bcb,
+  IN BOOLEAN WriteThrough,
+  OUT PIO_STATUS_BLOCK IoStatus);
+
+NTKERNELAPI
+PFILE_OBJECT
+NTAPI
+CcGetFileObjectFromSectionPtrs(
+  IN PSECTION_OBJECT_POINTERS SectionObjectPointer);
+
+NTKERNELAPI
+PFILE_OBJECT
+NTAPI
+CcGetFileObjectFromBcb(
+  IN PVOID Bcb);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcCanIWrite(
+  IN PFILE_OBJECT FileObject,
+  IN ULONG BytesToWrite,
+  IN BOOLEAN Wait,
+  IN BOOLEAN Retrying);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcDeferWrite(
+  IN PFILE_OBJECT FileObject,
+  IN PCC_POST_DEFERRED_WRITE PostRoutine,
+  IN PVOID Context1,
+  IN PVOID Context2,
+  IN ULONG BytesToWrite,
+  IN BOOLEAN Retrying);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcCopyRead(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN BOOLEAN Wait,
+  OUT PVOID Buffer,
+  OUT PIO_STATUS_BLOCK IoStatus);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcFastCopyRead(
+  IN PFILE_OBJECT FileObject,
+  IN ULONG FileOffset,
+  IN ULONG Length,
+  IN ULONG PageCount,
+  OUT PVOID Buffer,
+  OUT PIO_STATUS_BLOCK IoStatus);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcCopyWrite(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN BOOLEAN Wait,
+  IN PVOID Buffer);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcFastCopyWrite(
+  IN PFILE_OBJECT FileObject,
+  IN ULONG FileOffset,
+  IN ULONG Length,
+  IN PVOID Buffer);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcMdlRead(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  OUT PMDL *MdlChain,
+  OUT PIO_STATUS_BLOCK IoStatus);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcMdlReadComplete(
+  IN PFILE_OBJECT FileObject,
+  IN PMDL MdlChain);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcPrepareMdlWrite(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  OUT PMDL *MdlChain,
+  OUT PIO_STATUS_BLOCK IoStatus);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcMdlWriteComplete(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN PMDL MdlChain);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcScheduleReadAhead(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+CcWaitForCurrentLazyWriterActivity(
+  VOID);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetReadAheadGranularity(
+  IN PFILE_OBJECT FileObject,
+  IN ULONG Granularity);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcPinRead(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN ULONG Flags,
+  OUT PVOID *Bcb,
+  OUT PVOID *Buffer);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcPinMappedData(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN ULONG Flags,
+  IN OUT PVOID *Bcb);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcPreparePinWrite(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN BOOLEAN Zero,
+  IN ULONG Flags,
+  OUT PVOID *Bcb,
+  OUT PVOID *Buffer);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetDirtyPinnedData(
+  IN PVOID BcbVoid,
+  IN PLARGE_INTEGER Lsn OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcUnpinData(
+  IN PVOID Bcb);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetBcbOwnerPointer(
+  IN PVOID Bcb,
+  IN PVOID OwnerPointer);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcUnpinDataForThread(
+  IN PVOID Bcb,
+  IN ERESOURCE_THREAD ResourceThreadId);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetAdditionalCacheAttributes(
+  IN PFILE_OBJECT FileObject,
+  IN BOOLEAN DisableReadAhead,
+  IN BOOLEAN DisableWriteBehind);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcIsThereDirtyData(
+  IN PVPB Vpb);
+
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+
+NTKERNELAPI
+VOID
+NTAPI
+CcMdlWriteAbort(
+  IN PFILE_OBJECT FileObject,
+  IN PMDL MdlChain);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetLogHandleForFile(
+  IN PFILE_OBJECT FileObject,
+  IN PVOID LogHandle,
+  IN PFLUSH_TO_LSN FlushToLsnRoutine);
+
+NTKERNELAPI
+LARGE_INTEGER
+NTAPI
+CcGetDirtyPages(
+  IN PVOID LogHandle,
+  IN PDIRTY_PAGE_ROUTINE DirtyPageRoutine,
+  IN PVOID Context1,
+  IN PVOID Context2);
+
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcMapData(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN ULONG Flags,
+  OUT PVOID *Bcb,
+  OUT PVOID *Buffer);
+#elif (NTDDI_VERSION >= NTDDI_WIN2K)
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcMapData(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN BOOLEAN Wait,
+  OUT PVOID *Bcb,
+  OUT PVOID *Buffer);
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+CcSetFileSizesEx(
+  IN PFILE_OBJECT FileObject,
+  IN PCC_FILE_SIZES FileSizes);
+
+NTKERNELAPI
+PFILE_OBJECT
+NTAPI
+CcGetFileObjectFromSectionPtrsRef(
+  IN PSECTION_OBJECT_POINTERS SectionObjectPointer);
+
+NTKERNELAPI
+VOID
+NTAPI
+CcSetParallelFlushFile(
+  IN PFILE_OBJECT FileObject,
+  IN BOOLEAN EnableParallelFlush);
+
+NTKERNELAPI
+BOOLEAN
+CcIsThereDirtyDataEx(
+  IN PVPB Vpb,
+  IN PULONG NumberOfDirtyPages OPTIONAL);
+
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+NTKERNELAPI
+VOID
+NTAPI
+CcCoherencyFlushAndPurgeCache(
+  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+  IN PLARGE_INTEGER FileOffset OPTIONAL,
+  IN ULONG Length,
+  OUT PIO_STATUS_BLOCK IoStatus,
+  IN ULONG Flags OPTIONAL);
+#endif
+
+#define CcGetFileSizePointer(FO) (                                     \
+    ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
+)
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcPurgeCacheSection(
+  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+  IN PLARGE_INTEGER FileOffset OPTIONAL,
+  IN ULONG Length,
+  IN ULONG Flags);
+#elif (NTDDI_VERSION >= NTDDI_WIN2K)
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcPurgeCacheSection(
+  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+  IN PLARGE_INTEGER FileOffset OPTIONAL,
+  IN ULONG Length,
+  IN BOOLEAN UninitializeCacheMaps);
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+NTKERNELAPI
+BOOLEAN
+NTAPI
+CcCopyWriteWontFlush(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length);
+#else
+#define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
+#endif
+
+#define CcReadAhead(FO, FOFF, LEN) (                \
+    if ((LEN) >= 256) {                             \
+        CcScheduleReadAhead((FO), (FOFF), (LEN));   \
+    }                                               \
+)
+$endif (_NTIFS_)
diff --git a/include/xdk/cctypes.h b/include/xdk/cctypes.h
new file mode 100644 (file)
index 0000000..972abb7
--- /dev/null
@@ -0,0 +1,75 @@
+$if (_NTIFS_)
+/* Common Cache Types */
+
+#define VACB_MAPPING_GRANULARITY        (0x40000)
+#define VACB_OFFSET_SHIFT               (18)
+
+typedef struct _PUBLIC_BCB {
+  CSHORT NodeTypeCode;
+  CSHORT NodeByteSize;
+  ULONG MappedLength;
+  LARGE_INTEGER MappedFileOffset;
+} PUBLIC_BCB, *PPUBLIC_BCB;
+
+typedef struct _CC_FILE_SIZES {
+  LARGE_INTEGER AllocationSize;
+  LARGE_INTEGER FileSize;
+  LARGE_INTEGER ValidDataLength;
+} CC_FILE_SIZES, *PCC_FILE_SIZES;
+
+typedef BOOLEAN
+(NTAPI *PACQUIRE_FOR_LAZY_WRITE) (
+  IN PVOID Context,
+  IN BOOLEAN Wait);
+
+typedef VOID
+(NTAPI *PRELEASE_FROM_LAZY_WRITE) (
+  IN PVOID Context);
+
+typedef BOOLEAN
+(NTAPI *PACQUIRE_FOR_READ_AHEAD) (
+  IN PVOID Context,
+  IN BOOLEAN Wait);
+
+typedef VOID
+(NTAPI *PRELEASE_FROM_READ_AHEAD) (
+  IN PVOID Context);
+
+typedef struct _CACHE_MANAGER_CALLBACKS {
+  PACQUIRE_FOR_LAZY_WRITE AcquireForLazyWrite;
+  PRELEASE_FROM_LAZY_WRITE ReleaseFromLazyWrite;
+  PACQUIRE_FOR_READ_AHEAD AcquireForReadAhead;
+  PRELEASE_FROM_READ_AHEAD ReleaseFromReadAhead;
+} CACHE_MANAGER_CALLBACKS, *PCACHE_MANAGER_CALLBACKS;
+
+typedef struct _CACHE_UNINITIALIZE_EVENT {
+  struct _CACHE_UNINITIALIZE_EVENT *Next;
+  KEVENT Event;
+} CACHE_UNINITIALIZE_EVENT, *PCACHE_UNINITIALIZE_EVENT;
+
+typedef VOID
+(NTAPI *PDIRTY_PAGE_ROUTINE) (
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN PLARGE_INTEGER OldestLsn,
+  IN PLARGE_INTEGER NewestLsn,
+  IN PVOID Context1,
+  IN PVOID Context2);
+
+typedef VOID
+(NTAPI *PFLUSH_TO_LSN) (
+  IN PVOID LogHandle,
+  IN LARGE_INTEGER Lsn);
+
+typedef VOID
+(NTAPI *PCC_POST_DEFERRED_WRITE) (
+  IN PVOID Context1,
+  IN PVOID Context2);
+
+#define UNINITIALIZE_CACHE_MAPS          (1)
+#define DO_NOT_RETRY_PURGE               (2)
+#define DO_NOT_PURGE_DIRTY_PAGES         (0x4)
+
+#define CC_FLUSH_AND_PURGE_NO_PURGE     (0x1)
+$endif (_NTIFS_)
index 3b215d9..a04b7ae 100644 (file)
@@ -2,100 +2,6 @@
  *                          Executive Functions                               *
  ******************************************************************************/
 
-$if (_NTDDK_)
-static __inline PVOID
-ExAllocateFromZone(
-  IN PZONE_HEADER Zone)
-{
-  if (Zone->FreeList.Next)
-    Zone->FreeList.Next = Zone->FreeList.Next->Next;
-  return (PVOID) Zone->FreeList.Next;
-}
-
-static __inline PVOID
-ExFreeToZone(
-  IN PZONE_HEADER Zone,
-  IN PVOID Block)
-{
-  ((PSINGLE_LIST_ENTRY) Block)->Next = Zone->FreeList.Next;
-  Zone->FreeList.Next = ((PSINGLE_LIST_ENTRY) Block);
-  return ((PSINGLE_LIST_ENTRY) Block)->Next;
-}
-
-/*
- * PVOID
- * ExInterlockedAllocateFromZone(
- *   IN PZONE_HEADER  Zone,
- *   IN PKSPIN_LOCK  Lock)
- */
-#define ExInterlockedAllocateFromZone(Zone, Lock) \
-    ((PVOID) ExInterlockedPopEntryList(&Zone->FreeList, Lock))
-
-/* PVOID
- * ExInterlockedFreeToZone(
- *  IN PZONE_HEADER  Zone,
- *  IN PVOID  Block,
- *  IN PKSPIN_LOCK  Lock);
- */
-#define ExInterlockedFreeToZone(Zone, Block, Lock) \
-    ExInterlockedPushEntryList(&(Zone)->FreeList, (PSINGLE_LIST_ENTRY)(Block), Lock)
-
-/*
- * BOOLEAN
- * ExIsFullZone(
- *  IN PZONE_HEADER  Zone)
- */
-#define ExIsFullZone(Zone) \
-  ((Zone)->FreeList.Next == (PSINGLE_LIST_ENTRY) NULL)
-
-/* BOOLEAN
- * ExIsObjectInFirstZoneSegment(
- *     IN PZONE_HEADER Zone,
- *     IN PVOID Object);
- */
-#define ExIsObjectInFirstZoneSegment(Zone,Object) \
-    ((BOOLEAN)( ((PUCHAR)(Object) >= (PUCHAR)(Zone)->SegmentList.Next) && \
-                ((PUCHAR)(Object) <  (PUCHAR)(Zone)->SegmentList.Next + \
-                         (Zone)->TotalSegmentSize)) )
-
-#define ExAcquireResourceExclusive ExAcquireResourceExclusiveLite
-#define ExAcquireResourceShared ExAcquireResourceSharedLite
-#define ExConvertExclusiveToShared ExConvertExclusiveToSharedLite
-#define ExDeleteResource ExDeleteResourceLite
-#define ExInitializeResource ExInitializeResourceLite
-#define ExIsResourceAcquiredExclusive ExIsResourceAcquiredExclusiveLite
-#define ExIsResourceAcquiredShared ExIsResourceAcquiredSharedLite
-#define ExIsResourceAcquired ExIsResourceAcquiredSharedLite
-#define ExReleaseResourceForThread ExReleaseResourceForThreadLite
-
-typedef enum _INTERLOCKED_RESULT {
-  ResultNegative = RESULT_NEGATIVE,
-  ResultZero = RESULT_ZERO,
-  ResultPositive = RESULT_POSITIVE
-} INTERLOCKED_RESULT;
-
-#ifdef _X86_
-NTKERNELAPI
-INTERLOCKED_RESULT
-FASTCALL
-Exfi386InterlockedIncrementLong(
-  IN OUT LONG volatile *Addend);
-
-NTKERNELAPI
-INTERLOCKED_RESULT
-FASTCALL
-Exfi386InterlockedDecrementLong(
-  IN PLONG  Addend);
-
-NTKERNELAPI
-ULONG
-FASTCALL
-Exfi386InterlockedExchangeUlong(
-  IN PULONG  Target,
-  IN ULONG  Value);
-#endif
-
-$endif  (_NTDDK_)
 $if (_WDMDDK_)
 #define ExInterlockedIncrementLong(Addend,Lock) Exfi386InterlockedIncrementLong(Addend)
 #define ExInterlockedDecrementLong(Addend,Lock) Exfi386InterlockedDecrementLong(Addend)
@@ -327,53 +233,110 @@ ExInitializeFastMutex(
 }
 
 $endif (_WDMDDK_)
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
 $if (_NTDDK_)
-NTKERNELAPI
-NTSTATUS
-NTAPI
-ExExtendZone(
-  IN OUT PZONE_HEADER Zone,
-  IN OUT PVOID Segment,
-  IN ULONG SegmentSize);
+static __inline PVOID
+ExAllocateFromZone(
+  IN PZONE_HEADER Zone)
+{
+  if (Zone->FreeList.Next)
+    Zone->FreeList.Next = Zone->FreeList.Next->Next;
+  return (PVOID) Zone->FreeList.Next;
+}
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-ExInitializeZone(
-  OUT PZONE_HEADER Zone,
-  IN ULONG BlockSize,
-  IN OUT PVOID InitialSegment,
-  IN ULONG InitialSegmentSize);
+static __inline PVOID
+ExFreeToZone(
+  IN PZONE_HEADER Zone,
+  IN PVOID Block)
+{
+  ((PSINGLE_LIST_ENTRY) Block)->Next = Zone->FreeList.Next;
+  Zone->FreeList.Next = ((PSINGLE_LIST_ENTRY) Block);
+  return ((PSINGLE_LIST_ENTRY) Block)->Next;
+}
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-ExInterlockedExtendZone(
-  IN OUT PZONE_HEADER Zone,
-  IN OUT PVOID Segment,
-  IN ULONG SegmentSize,
-  IN OUT PKSPIN_LOCK Lock);
+/*
+ * PVOID
+ * ExInterlockedAllocateFromZone(
+ *   IN PZONE_HEADER  Zone,
+ *   IN PKSPIN_LOCK  Lock)
+ */
+#define ExInterlockedAllocateFromZone(Zone, Lock) \
+    ((PVOID) ExInterlockedPopEntryList(&Zone->FreeList, Lock))
+
+/* PVOID
+ * ExInterlockedFreeToZone(
+ *  IN PZONE_HEADER  Zone,
+ *  IN PVOID  Block,
+ *  IN PKSPIN_LOCK  Lock);
+ */
+#define ExInterlockedFreeToZone(Zone, Block, Lock) \
+    ExInterlockedPushEntryList(&(Zone)->FreeList, (PSINGLE_LIST_ENTRY)(Block), Lock)
+
+/*
+ * BOOLEAN
+ * ExIsFullZone(
+ *  IN PZONE_HEADER  Zone)
+ */
+#define ExIsFullZone(Zone) \
+  ((Zone)->FreeList.Next == (PSINGLE_LIST_ENTRY) NULL)
+
+/* BOOLEAN
+ * ExIsObjectInFirstZoneSegment(
+ *     IN PZONE_HEADER Zone,
+ *     IN PVOID Object);
+ */
+#define ExIsObjectInFirstZoneSegment(Zone,Object) \
+    ((BOOLEAN)( ((PUCHAR)(Object) >= (PUCHAR)(Zone)->SegmentList.Next) && \
+                ((PUCHAR)(Object) <  (PUCHAR)(Zone)->SegmentList.Next + \
+                         (Zone)->TotalSegmentSize)) )
+
+#define ExAcquireResourceExclusive ExAcquireResourceExclusiveLite
+#define ExAcquireResourceShared ExAcquireResourceSharedLite
+#define ExConvertExclusiveToShared ExConvertExclusiveToSharedLite
+#define ExDeleteResource ExDeleteResourceLite
+#define ExInitializeResource ExInitializeResourceLite
+#define ExIsResourceAcquiredExclusive ExIsResourceAcquiredExclusiveLite
+#define ExIsResourceAcquiredShared ExIsResourceAcquiredSharedLite
+#define ExIsResourceAcquired ExIsResourceAcquiredSharedLite
+#define ExReleaseResourceForThread ExReleaseResourceForThreadLite
+
+typedef enum _INTERLOCKED_RESULT {
+  ResultNegative = RESULT_NEGATIVE,
+  ResultZero = RESULT_ZERO,
+  ResultPositive = RESULT_POSITIVE
+} INTERLOCKED_RESULT;
 
+#ifdef _X86_
 NTKERNELAPI
-NTSTATUS
-NTAPI
-ExUuidCreate(
-  OUT UUID *Uuid);
+INTERLOCKED_RESULT
+FASTCALL
+Exfi386InterlockedIncrementLong(
+  IN OUT LONG volatile *Addend);
 
 NTKERNELAPI
-DECLSPEC_NORETURN
-VOID
-NTAPI
-ExRaiseAccessViolation(VOID);
+INTERLOCKED_RESULT
+FASTCALL
+Exfi386InterlockedDecrementLong(
+  IN PLONG  Addend);
 
 NTKERNELAPI
-DECLSPEC_NORETURN
+ULONG
+FASTCALL
+Exfi386InterlockedExchangeUlong(
+  IN PULONG  Target,
+  IN ULONG  Value);
+#endif
+
+$endif (_NTDDK_)
+$if (_NTIFS_)
+
+#define ExDisableResourceBoost ExDisableResourceBoostLite
+
 VOID
-NTAPI
-ExRaiseDatatypeMisalignment(VOID);
+ExInitializePushLock (
+  OUT PEX_PUSH_LOCK PushLock);
+$endif (_NTIFS_)
 
-$endif  (_NTDDK_)
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
 $if (_WDMDDK_)
 NTKERNELAPI
 VOID
@@ -751,11 +714,78 @@ NTAPI
 ExUnregisterCallback(
   IN OUT PVOID CbRegistration);
 
-$endif  (_WDMDDK_)
+$endif (_WDMDDK_)
+$if (_NTDDK_)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+ExExtendZone(
+  IN OUT PZONE_HEADER Zone,
+  IN OUT PVOID Segment,
+  IN ULONG SegmentSize);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+ExInitializeZone(
+  OUT PZONE_HEADER Zone,
+  IN ULONG BlockSize,
+  IN OUT PVOID InitialSegment,
+  IN ULONG InitialSegmentSize);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+ExInterlockedExtendZone(
+  IN OUT PZONE_HEADER Zone,
+  IN OUT PVOID Segment,
+  IN ULONG SegmentSize,
+  IN OUT PKSPIN_LOCK Lock);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+ExUuidCreate(
+  OUT UUID *Uuid);
+
+NTKERNELAPI
+DECLSPEC_NORETURN
+VOID
+NTAPI
+ExRaiseAccessViolation(VOID);
+
+NTKERNELAPI
+DECLSPEC_NORETURN
+VOID
+NTAPI
+ExRaiseDatatypeMisalignment(VOID);
+
+$endif (_NTDDK_)
+$if (_NTIFS_)
+
+NTKERNELAPI
+SIZE_T
+NTAPI
+ExQueryPoolBlockSize(
+  IN PVOID PoolBlock,
+  OUT PBOOLEAN QuotaCharged);
+
+VOID
+ExAdjustLookasideDepth(
+  VOID);
+
+NTKERNELAPI
+VOID
+NTAPI
+ExDisableResourceBoostLite(
+  IN PERESOURCE Resource);
+$endif (_NTIFS_)
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
-$if (_WDMDDK_)
+$if (_WDMDDK_ || _NTIFS_)
 #if (NTDDI_VERSION >= NTDDI_WINXP)
+$endif
+$if (_WDMDDK_)
 
 NTKERNELAPI
 BOOLEAN
@@ -798,9 +828,22 @@ VOID
 FASTCALL
 ExWaitForRundownProtectionRelease(
   IN OUT PEX_RUNDOWN_REF RunRef);
+$endif (_WDMDDK_)
+$if (_NTIFS_)
 
+PSLIST_ENTRY
+FASTCALL
+InterlockedPushListSList(
+  IN OUT PSLIST_HEADER ListHead,
+  IN OUT PSLIST_ENTRY List,
+  IN OUT PSLIST_ENTRY ListEnd,
+  IN ULONG Count);
+$endif (_NTIFS_)
+$if (_WDMDDK_ || _NTIFS_)
 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
+$endif
 
+$if (_WDMDDK_)
 #if (NTDDI_VERSION >= NTDDI_WINXPSP2)
 
 NTKERNELAPI
diff --git a/include/xdk/fsrtlfuncs.h b/include/xdk/fsrtlfuncs.h
new file mode 100644 (file)
index 0000000..05fdb7e
--- /dev/null
@@ -0,0 +1,1499 @@
+$if (_NTIFS_)
+/* FSRTL Functions */
+
+#define FsRtlEnterFileSystem    KeEnterCriticalRegion
+#define FsRtlExitFileSystem     KeLeaveCriticalRegion
+
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlCopyRead(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN BOOLEAN Wait,
+  IN ULONG LockKey,
+  OUT PVOID Buffer,
+  OUT PIO_STATUS_BLOCK IoStatus,
+  IN PDEVICE_OBJECT DeviceObject);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlCopyWrite(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN BOOLEAN Wait,
+  IN ULONG LockKey,
+  IN PVOID Buffer,
+  OUT PIO_STATUS_BLOCK IoStatus,
+  IN PDEVICE_OBJECT DeviceObject);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlMdlReadDev(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN ULONG LockKey,
+  OUT PMDL *MdlChain,
+  OUT PIO_STATUS_BLOCK IoStatus,
+  IN PDEVICE_OBJECT DeviceObject OPTIONAL);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlMdlReadCompleteDev(
+  IN PFILE_OBJECT FileObject,
+  IN PMDL MdlChain,
+  IN PDEVICE_OBJECT DeviceObject OPTIONAL);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlPrepareMdlWriteDev(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN ULONG LockKey,
+  OUT PMDL *MdlChain,
+  OUT PIO_STATUS_BLOCK IoStatus,
+  IN PDEVICE_OBJECT DeviceObject);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlMdlWriteCompleteDev(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN PMDL MdlChain,
+  IN PDEVICE_OBJECT DeviceObject);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlAcquireFileExclusive(
+  IN PFILE_OBJECT FileObject);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlReleaseFile(
+  IN PFILE_OBJECT FileObject);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlGetFileSize(
+  IN PFILE_OBJECT FileObject,
+  OUT PLARGE_INTEGER FileSize);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlIsTotalDeviceFailure(
+  IN NTSTATUS Status);
+
+NTKERNELAPI
+PFILE_LOCK
+NTAPI
+FsRtlAllocateFileLock(
+  IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL,
+  IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlFreeFileLock(
+  IN PFILE_LOCK FileLock);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlInitializeFileLock(
+  IN PFILE_LOCK FileLock,
+  IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL,
+  IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlUninitializeFileLock(
+  IN PFILE_LOCK FileLock);
+
+/*
+  FsRtlProcessFileLock:
+
+  ret:
+    -STATUS_INVALID_DEVICE_REQUEST
+    -STATUS_RANGE_NOT_LOCKED from unlock routines.
+    -STATUS_PENDING, STATUS_LOCK_NOT_GRANTED from FsRtlPrivateLock
+    (redirected IoStatus->Status).
+
+  Internals:
+    -switch ( Irp->CurrentStackLocation->MinorFunction )
+        lock: return FsRtlPrivateLock;
+        unlocksingle: return FsRtlFastUnlockSingle;
+        unlockall: return FsRtlFastUnlockAll;
+        unlockallbykey: return FsRtlFastUnlockAllByKey;
+        default: IofCompleteRequest with STATUS_INVALID_DEVICE_REQUEST;
+                 return STATUS_INVALID_DEVICE_REQUEST;
+
+    -'AllwaysZero' is passed thru as 'AllwaysZero' to lock / unlock routines.
+    -'Irp' is passet thru as 'Irp' to FsRtlPrivateLock.
+*/
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlProcessFileLock(
+  IN PFILE_LOCK FileLock,
+  IN PIRP Irp,
+  IN PVOID Context OPTIONAL);
+
+/*
+  FsRtlCheckLockForReadAccess:
+
+  All this really does is pick out the lock parameters from the irp (io stack
+  location?), get IoGetRequestorProcess, and pass values on to
+  FsRtlFastCheckLockForRead.
+*/
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlCheckLockForReadAccess(
+  IN PFILE_LOCK FileLock,
+  IN PIRP Irp);
+
+/*
+  FsRtlCheckLockForWriteAccess:
+
+  All this really does is pick out the lock parameters from the irp (io stack
+  location?), get IoGetRequestorProcess, and pass values on to
+  FsRtlFastCheckLockForWrite.
+*/
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlCheckLockForWriteAccess(
+  IN PFILE_LOCK FileLock,
+  IN PIRP Irp);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlFastCheckLockForRead(
+  IN PFILE_LOCK FileLock,
+  IN PLARGE_INTEGER FileOffset,
+  IN PLARGE_INTEGER Length,
+  IN ULONG Key,
+  IN PFILE_OBJECT FileObject,
+  IN PVOID Process);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlFastCheckLockForWrite(
+  IN PFILE_LOCK FileLock,
+  IN PLARGE_INTEGER FileOffset,
+  IN PLARGE_INTEGER Length,
+  IN ULONG Key,
+  IN PFILE_OBJECT FileObject,
+  IN PVOID Process);
+
+/*
+  FsRtlGetNextFileLock:
+
+  ret: NULL if no more locks
+
+  Internals:
+    FsRtlGetNextFileLock uses FileLock->LastReturnedLockInfo and
+    FileLock->LastReturnedLock as storage.
+    LastReturnedLock is a pointer to the 'raw' lock inkl. double linked
+    list, and FsRtlGetNextFileLock needs this to get next lock on subsequent
+    calls with Restart = FALSE.
+*/
+NTKERNELAPI
+PFILE_LOCK_INFO
+NTAPI
+FsRtlGetNextFileLock(
+  IN PFILE_LOCK FileLock,
+  IN BOOLEAN Restart);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlFastUnlockSingle(
+  IN PFILE_LOCK FileLock,
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN PLARGE_INTEGER Length,
+  IN PEPROCESS Process,
+  IN ULONG Key,
+  IN PVOID Context OPTIONAL,
+  IN BOOLEAN AlreadySynchronized);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlFastUnlockAll(
+  IN PFILE_LOCK FileLock,
+  IN PFILE_OBJECT FileObject,
+  IN PEPROCESS Process,
+  IN PVOID Context OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlFastUnlockAllByKey(
+  IN PFILE_LOCK FileLock,
+  IN PFILE_OBJECT FileObject,
+  IN PEPROCESS Process,
+  IN ULONG Key,
+  IN PVOID Context OPTIONAL);
+
+/*
+  FsRtlPrivateLock:
+
+  ret: IoStatus->Status: STATUS_PENDING, STATUS_LOCK_NOT_GRANTED
+
+  Internals:
+    -Calls IoCompleteRequest if Irp
+    -Uses exception handling / ExRaiseStatus with STATUS_INSUFFICIENT_RESOURCES
+*/
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlPrivateLock(
+  IN PFILE_LOCK FileLock,
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN PLARGE_INTEGER Length,
+  IN PEPROCESS Process,
+  IN ULONG Key,
+  IN BOOLEAN FailImmediately,
+  IN BOOLEAN ExclusiveLock,
+  OUT PIO_STATUS_BLOCK IoStatus,
+  IN PIRP Irp OPTIONAL,
+  IN PVOID Context,
+  IN BOOLEAN AlreadySynchronized);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlInitializeTunnelCache(
+  IN PTUNNEL Cache);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlAddToTunnelCache(
+  IN PTUNNEL Cache,
+  IN ULONGLONG DirectoryKey,
+  IN PUNICODE_STRING ShortName,
+  IN PUNICODE_STRING LongName,
+  IN BOOLEAN KeyByShortName,
+  IN ULONG DataLength,
+  IN PVOID Data);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlFindInTunnelCache(
+  IN PTUNNEL Cache,
+  IN ULONGLONG DirectoryKey,
+  IN PUNICODE_STRING Name,
+  OUT PUNICODE_STRING ShortName,
+  OUT PUNICODE_STRING LongName,
+  IN OUT PULONG DataLength,
+  OUT PVOID Data);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlDeleteKeyFromTunnelCache(
+  IN PTUNNEL Cache,
+  IN ULONGLONG DirectoryKey);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlDeleteTunnelCache(
+  IN PTUNNEL Cache);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlDissectDbcs(
+  IN ANSI_STRING Name,
+  OUT PANSI_STRING FirstPart,
+  OUT PANSI_STRING RemainingPart);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlDoesDbcsContainWildCards(
+  IN PANSI_STRING Name);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlIsDbcsInExpression(
+  IN PANSI_STRING Expression,
+  IN PANSI_STRING Name);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlIsFatDbcsLegal(
+  IN ANSI_STRING DbcsName,
+  IN BOOLEAN WildCardsPermissible,
+  IN BOOLEAN PathNamePermissible,
+  IN BOOLEAN LeadingBackslashPermissible);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlIsHpfsDbcsLegal(
+  IN ANSI_STRING DbcsName,
+  IN BOOLEAN WildCardsPermissible,
+  IN BOOLEAN PathNamePermissible,
+  IN BOOLEAN LeadingBackslashPermissible);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlNormalizeNtstatus(
+  IN NTSTATUS Exception,
+  IN NTSTATUS GenericException);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlIsNtstatusExpected(
+  IN NTSTATUS Ntstatus);
+
+NTKERNELAPI
+PERESOURCE
+NTAPI
+FsRtlAllocateResource(
+  VOID);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlInitializeLargeMcb(
+  IN PLARGE_MCB Mcb,
+  IN POOL_TYPE PoolType);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlUninitializeLargeMcb(
+  IN PLARGE_MCB Mcb);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlResetLargeMcb(
+  IN PLARGE_MCB Mcb,
+  IN BOOLEAN SelfSynchronized);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlTruncateLargeMcb(
+  IN PLARGE_MCB Mcb,
+  IN LONGLONG Vbn);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlAddLargeMcbEntry(
+  IN PLARGE_MCB Mcb,
+  IN LONGLONG Vbn,
+  IN LONGLONG Lbn,
+  IN LONGLONG SectorCount);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlRemoveLargeMcbEntry(
+  IN PLARGE_MCB Mcb,
+  IN LONGLONG Vbn,
+  IN LONGLONG SectorCount);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlLookupLargeMcbEntry(
+  IN PLARGE_MCB Mcb,
+  IN LONGLONG Vbn,
+  OUT PLONGLONG Lbn OPTIONAL,
+  OUT PLONGLONG SectorCountFromLbn OPTIONAL,
+  OUT PLONGLONG StartingLbn OPTIONAL,
+  OUT PLONGLONG SectorCountFromStartingLbn OPTIONAL,
+  OUT PULONG Index OPTIONAL);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlLookupLastLargeMcbEntry(
+  IN PLARGE_MCB Mcb,
+  OUT PLONGLONG Vbn,
+  OUT PLONGLONG Lbn);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlLookupLastLargeMcbEntryAndIndex(
+  IN PLARGE_MCB OpaqueMcb,
+  OUT PLONGLONG LargeVbn,
+  OUT PLONGLONG LargeLbn,
+  OUT PULONG Index);
+
+NTKERNELAPI
+ULONG
+NTAPI
+FsRtlNumberOfRunsInLargeMcb(
+  IN PLARGE_MCB Mcb);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlGetNextLargeMcbEntry(
+  IN PLARGE_MCB Mcb,
+  IN ULONG RunIndex,
+  OUT PLONGLONG Vbn,
+  OUT PLONGLONG Lbn,
+  OUT PLONGLONG SectorCount);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlSplitLargeMcb(
+  IN PLARGE_MCB Mcb,
+  IN LONGLONG Vbn,
+  IN LONGLONG Amount);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlInitializeMcb(
+  IN PMCB Mcb,
+  IN POOL_TYPE PoolType);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlUninitializeMcb(
+  IN PMCB Mcb);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlTruncateMcb(
+  IN PMCB Mcb,
+  IN VBN Vbn);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlAddMcbEntry(
+  IN PMCB Mcb,
+  IN VBN Vbn,
+  IN LBN Lbn,
+  IN ULONG SectorCount);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlRemoveMcbEntry(
+  IN PMCB Mcb,
+  IN VBN Vbn,
+  IN ULONG SectorCount);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlLookupMcbEntry(
+  IN PMCB Mcb,
+  IN VBN Vbn,
+  OUT PLBN Lbn,
+  OUT PULONG SectorCount OPTIONAL,
+  OUT PULONG Index);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlLookupLastMcbEntry(
+  IN PMCB Mcb,
+  OUT PVBN Vbn,
+  OUT PLBN Lbn);
+
+NTKERNELAPI
+ULONG
+NTAPI
+FsRtlNumberOfRunsInMcb(
+  IN PMCB Mcb);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlGetNextMcbEntry(
+  IN PMCB Mcb,
+  IN ULONG RunIndex,
+  OUT PVBN Vbn,
+  OUT PLBN Lbn,
+  OUT PULONG SectorCount);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlBalanceReads(
+  IN PDEVICE_OBJECT TargetDevice);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlInitializeOplock(
+  IN OUT POPLOCK Oplock);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlUninitializeOplock(
+  IN OUT POPLOCK Oplock);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlOplockFsctrl(
+  IN POPLOCK Oplock,
+  IN PIRP Irp,
+  IN ULONG OpenCount);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlCheckOplock(
+  IN POPLOCK Oplock,
+  IN PIRP Irp,
+  IN PVOID Context,
+  IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
+  IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlOplockIsFastIoPossible(
+  IN POPLOCK Oplock);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlCurrentBatchOplock(
+  IN POPLOCK Oplock);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlNotifyVolumeEvent(
+  IN PFILE_OBJECT FileObject,
+  IN ULONG EventCode);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlNotifyInitializeSync(
+  IN PNOTIFY_SYNC *NotifySync);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlNotifyUninitializeSync(
+  IN PNOTIFY_SYNC *NotifySync);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlNotifyFullChangeDirectory(
+  IN PNOTIFY_SYNC NotifySync,
+  IN PLIST_ENTRY NotifyList,
+  IN PVOID FsContext,
+  IN PSTRING FullDirectoryName,
+  IN BOOLEAN WatchTree,
+  IN BOOLEAN IgnoreBuffer,
+  IN ULONG CompletionFilter,
+  IN PIRP NotifyIrp OPTIONAL,
+  IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL,
+  IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlNotifyFilterReportChange(
+  IN PNOTIFY_SYNC NotifySync,
+  IN PLIST_ENTRY NotifyList,
+  IN PSTRING FullTargetName,
+  IN USHORT TargetNameOffset,
+  IN PSTRING StreamName OPTIONAL,
+  IN PSTRING NormalizedParentName OPTIONAL,
+  IN ULONG FilterMatch,
+  IN ULONG Action,
+  IN PVOID TargetContext OPTIONAL,
+  IN PVOID FilterContext OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlNotifyFullReportChange(
+  IN PNOTIFY_SYNC NotifySync,
+  IN PLIST_ENTRY NotifyList,
+  IN PSTRING FullTargetName,
+  IN USHORT TargetNameOffset,
+  IN PSTRING StreamName OPTIONAL,
+  IN PSTRING NormalizedParentName OPTIONAL,
+  IN ULONG FilterMatch,
+  IN ULONG Action,
+  IN PVOID TargetContext OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlNotifyCleanup(
+  IN PNOTIFY_SYNC NotifySync,
+  IN PLIST_ENTRY NotifyList,
+  IN PVOID FsContext);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlDissectName(
+  IN UNICODE_STRING Name,
+  OUT PUNICODE_STRING FirstPart,
+  OUT PUNICODE_STRING RemainingPart);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlDoesNameContainWildCards(
+  IN PUNICODE_STRING Name);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlAreNamesEqual(
+  IN PCUNICODE_STRING Name1,
+  IN PCUNICODE_STRING Name2,
+  IN BOOLEAN IgnoreCase,
+  IN PCWCH UpcaseTable OPTIONAL);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlIsNameInExpression(
+  IN PUNICODE_STRING Expression,
+  IN PUNICODE_STRING Name,
+  IN BOOLEAN IgnoreCase,
+  IN PWCHAR UpcaseTable OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlPostPagingFileStackOverflow(
+  IN PVOID Context,
+  IN PKEVENT Event,
+  IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlPostStackOverflow (
+  IN PVOID Context,
+  IN PKEVENT Event,
+  IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlRegisterUncProvider(
+  OUT PHANDLE MupHandle,
+  IN PUNICODE_STRING RedirectorDeviceName,
+  IN BOOLEAN MailslotsSupported);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlDeregisterUncProvider(
+  IN HANDLE Handle);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlTeardownPerStreamContexts(
+  IN PFSRTL_ADVANCED_FCB_HEADER AdvancedHeader);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlCreateSectionForDataScan(
+  OUT PHANDLE SectionHandle,
+  OUT PVOID *SectionObject,
+  OUT PLARGE_INTEGER SectionFileSize OPTIONAL,
+  IN PFILE_OBJECT FileObject,
+  IN ACCESS_MASK DesiredAccess,
+  IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
+  IN PLARGE_INTEGER MaximumSize OPTIONAL,
+  IN ULONG SectionPageProtection,
+  IN ULONG AllocationAttributes,
+  IN ULONG Flags);
+
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlNotifyFilterChangeDirectory(
+  IN PNOTIFY_SYNC NotifySync,
+  IN PLIST_ENTRY NotifyList,
+  IN PVOID FsContext,
+  IN PSTRING FullDirectoryName,
+  IN BOOLEAN WatchTree,
+  IN BOOLEAN IgnoreBuffer,
+  IN ULONG CompletionFilter,
+  IN PIRP NotifyIrp OPTIONAL,
+  IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL,
+  IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL,
+  IN PFILTER_REPORT_CHANGE FilterCallback OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlInsertPerStreamContext(
+  IN PFSRTL_ADVANCED_FCB_HEADER PerStreamContext,
+  IN PFSRTL_PER_STREAM_CONTEXT Ptr);
+
+NTKERNELAPI
+PFSRTL_PER_STREAM_CONTEXT
+NTAPI
+FsRtlLookupPerStreamContextInternal(
+  IN PFSRTL_ADVANCED_FCB_HEADER StreamContext,
+  IN PVOID OwnerId OPTIONAL,
+  IN PVOID InstanceId OPTIONAL);
+
+NTKERNELAPI
+PFSRTL_PER_STREAM_CONTEXT
+NTAPI
+FsRtlRemovePerStreamContext(
+  IN PFSRTL_ADVANCED_FCB_HEADER StreamContext,
+  IN PVOID OwnerId OPTIONAL,
+  IN PVOID InstanceId OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlIncrementCcFastReadNotPossible(
+  VOID);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlIncrementCcFastReadWait(
+  VOID);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlIncrementCcFastReadNoWait(
+  VOID);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlIncrementCcFastReadResourceMiss(
+  VOID);
+
+NTKERNELAPI
+LOGICAL
+NTAPI
+FsRtlIsPagingFile(
+  IN PFILE_OBJECT FileObject);
+
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
+
+#if (NTDDI_VERSION >= NTDDI_WS03)
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlInitializeBaseMcb(
+  IN PBASE_MCB Mcb,
+  IN POOL_TYPE PoolType);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlUninitializeBaseMcb(
+  IN PBASE_MCB Mcb);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlResetBaseMcb(
+  IN PBASE_MCB Mcb);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlTruncateBaseMcb(
+  IN PBASE_MCB Mcb,
+  IN LONGLONG Vbn);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlAddBaseMcbEntry(
+  IN PBASE_MCB Mcb,
+  IN LONGLONG Vbn,
+  IN LONGLONG Lbn,
+  IN LONGLONG SectorCount);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlRemoveBaseMcbEntry(
+  IN PBASE_MCB Mcb,
+  IN LONGLONG Vbn,
+  IN LONGLONG SectorCount);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlLookupBaseMcbEntry(
+  IN PBASE_MCB Mcb,
+  IN LONGLONG Vbn,
+  OUT PLONGLONG Lbn OPTIONAL,
+  OUT PLONGLONG SectorCountFromLbn OPTIONAL,
+  OUT PLONGLONG StartingLbn OPTIONAL,
+  OUT PLONGLONG SectorCountFromStartingLbn OPTIONAL,
+  OUT PULONG Index OPTIONAL);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlLookupLastBaseMcbEntry(
+  IN PBASE_MCB Mcb,
+  OUT PLONGLONG Vbn,
+  OUT PLONGLONG Lbn);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlLookupLastBaseMcbEntryAndIndex(
+  IN PBASE_MCB OpaqueMcb,
+  IN OUT PLONGLONG LargeVbn,
+  IN OUT PLONGLONG LargeLbn,
+  IN OUT PULONG Index);
+
+NTKERNELAPI
+ULONG
+NTAPI
+FsRtlNumberOfRunsInBaseMcb(
+  IN PBASE_MCB Mcb);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlGetNextBaseMcbEntry(
+  IN PBASE_MCB Mcb,
+  IN ULONG RunIndex,
+  OUT PLONGLONG Vbn,
+  OUT PLONGLONG Lbn,
+  OUT PLONGLONG SectorCount);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlSplitBaseMcb(
+  IN PBASE_MCB Mcb,
+  IN LONGLONG Vbn,
+  IN LONGLONG Amount);
+
+#endif /* (NTDDI_VERSION >= NTDDI_WS03) */
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+
+BOOLEAN
+NTAPI
+FsRtlInitializeBaseMcbEx(
+  IN PBASE_MCB Mcb,
+  IN POOL_TYPE PoolType,
+  IN USHORT Flags);
+
+NTSTATUS
+NTAPI
+FsRtlAddBaseMcbEntryEx(
+  IN PBASE_MCB Mcb,
+  IN LONGLONG Vbn,
+  IN LONGLONG Lbn,
+  IN LONGLONG SectorCount);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlCurrentOplock(
+  IN POPLOCK Oplock);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlOplockBreakToNone(
+  IN OUT POPLOCK Oplock,
+  IN PIO_STACK_LOCATION IrpSp OPTIONAL,
+  IN PIRP Irp,
+  IN PVOID Context OPTIONAL,
+  IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
+  IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlNotifyVolumeEventEx(
+  IN PFILE_OBJECT FileObject,
+  IN ULONG EventCode,
+  IN PTARGET_DEVICE_CUSTOM_NOTIFICATION Event);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlNotifyCleanupAll(
+  IN PNOTIFY_SYNC NotifySync,
+  IN PLIST_ENTRY NotifyList);
+
+NTSTATUS
+NTAPI
+FsRtlRegisterUncProviderEx(
+  OUT PHANDLE MupHandle,
+  IN PUNICODE_STRING RedirDevName,
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG Flags);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlCancellableWaitForSingleObject(
+  IN PVOID Object,
+  IN PLARGE_INTEGER Timeout OPTIONAL,
+  IN PIRP Irp OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlCancellableWaitForMultipleObjects(
+  IN ULONG Count,
+  IN PVOID ObjectArray[],
+  IN WAIT_TYPE WaitType,
+  IN PLARGE_INTEGER Timeout OPTIONAL,
+  IN PKWAIT_BLOCK WaitBlockArray OPTIONAL,
+  IN PIRP Irp OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlMupGetProviderInfoFromFileObject(
+  IN PFILE_OBJECT pFileObject,
+  IN ULONG Level,
+  OUT PVOID pBuffer,
+  IN OUT PULONG pBufferSize);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlMupGetProviderIdFromName(
+  IN PUNICODE_STRING pProviderName,
+  OUT PULONG32 pProviderId);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlIncrementCcFastMdlReadWait(
+  VOID);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlValidateReparsePointBuffer(
+  IN ULONG BufferLength,
+  IN PREPARSE_DATA_BUFFER ReparseBuffer);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlRemoveDotsFromPath(
+  IN OUT PWSTR OriginalString,
+  IN USHORT PathLength,
+  OUT USHORT *NewLength);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlAllocateExtraCreateParameterList(
+  IN FSRTL_ALLOCATE_ECPLIST_FLAGS Flags,
+  OUT PECP_LIST *EcpList);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlFreeExtraCreateParameterList(
+  IN PECP_LIST EcpList);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlAllocateExtraCreateParameter(
+  IN LPCGUID EcpType,
+  IN ULONG SizeOfContext,
+  IN FSRTL_ALLOCATE_ECP_FLAGS Flags,
+  IN PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback OPTIONAL,
+  IN ULONG PoolTag,
+  OUT PVOID *EcpContext);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlFreeExtraCreateParameter(
+  IN PVOID EcpContext);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlInitExtraCreateParameterLookasideList(
+  IN OUT PVOID Lookaside,
+  IN FSRTL_ECP_LOOKASIDE_FLAGS Flags,
+  IN SIZE_T Size,
+  IN ULONG Tag);
+
+VOID
+NTAPI
+FsRtlDeleteExtraCreateParameterLookasideList(
+  IN OUT PVOID Lookaside,
+  IN FSRTL_ECP_LOOKASIDE_FLAGS Flags);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlAllocateExtraCreateParameterFromLookasideList(
+  IN LPCGUID EcpType,
+  IN ULONG SizeOfContext,
+  IN FSRTL_ALLOCATE_ECP_FLAGS Flags,
+  IN PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback OPTIONAL,
+  IN OUT PVOID LookasideList,
+  OUT PVOID *EcpContext);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlInsertExtraCreateParameter(
+  IN OUT PECP_LIST EcpList,
+  IN OUT PVOID EcpContext);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlFindExtraCreateParameter(
+  IN PECP_LIST EcpList,
+  IN LPCGUID EcpType,
+  OUT PVOID *EcpContext OPTIONAL,
+  OUT ULONG *EcpContextSize OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlRemoveExtraCreateParameter(
+  IN OUT PECP_LIST EcpList,
+  IN LPCGUID EcpType,
+  OUT PVOID *EcpContext,
+  OUT ULONG *EcpContextSize OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlGetEcpListFromIrp(
+  IN PIRP Irp,
+  OUT PECP_LIST *EcpList OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlSetEcpListIntoIrp(
+  IN OUT PIRP Irp,
+  IN PECP_LIST EcpList);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlGetNextExtraCreateParameter(
+  IN PECP_LIST EcpList,
+  IN PVOID CurrentEcpContext OPTIONAL,
+  OUT LPGUID NextEcpType OPTIONAL,
+  OUT PVOID *NextEcpContext OPTIONAL,
+  OUT ULONG *NextEcpContextSize OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlAcknowledgeEcp(
+  IN PVOID EcpContext);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlIsEcpAcknowledged(
+  IN PVOID EcpContext);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlIsEcpFromUserMode(
+  IN PVOID EcpContext);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlChangeBackingFileObject(
+  IN PFILE_OBJECT CurrentFileObject OPTIONAL,
+  IN PFILE_OBJECT NewFileObject,
+  IN FSRTL_CHANGE_BACKING_TYPE ChangeBackingType,
+  IN ULONG Flags);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlLogCcFlushError(
+  IN PUNICODE_STRING FileName,
+  IN PDEVICE_OBJECT DeviceObject,
+  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+  IN NTSTATUS FlushError,
+  IN ULONG Flags);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlAreVolumeStartupApplicationsComplete(
+  VOID);
+
+NTKERNELAPI
+ULONG
+NTAPI
+FsRtlQueryMaximumVirtualDiskNestingLevel(
+  VOID);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlGetVirtualDiskNestingLevel(
+  IN PDEVICE_OBJECT DeviceObject,
+  OUT PULONG NestingLevel,
+  OUT PULONG NestingFlags OPTIONAL);
+
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+
+#if (NTDDI_VERSION >= NTDDI_VISTASP1)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlCheckOplockEx(
+  IN POPLOCK Oplock,
+  IN PIRP Irp,
+  IN ULONG Flags,
+  IN PVOID Context OPTIONAL,
+  IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
+  IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
+
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlAreThereCurrentOrInProgressFileLocks(
+  IN PFILE_LOCK FileLock);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlOplockIsSharedRequest(
+  IN PIRP Irp);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlOplockBreakH(
+  IN POPLOCK Oplock,
+  IN PIRP Irp,
+  IN ULONG Flags,
+  IN PVOID Context OPTIONAL,
+  IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
+  IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlCurrentOplockH(
+  IN POPLOCK Oplock);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlOplockBreakToNoneEx(
+  IN OUT POPLOCK Oplock,
+  IN PIRP Irp,
+  IN ULONG Flags,
+  IN PVOID Context OPTIONAL,
+  IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
+  IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlOplockFsctrlEx(
+  IN POPLOCK Oplock,
+  IN PIRP Irp,
+  IN ULONG OpenCount,
+  IN ULONG Flags);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlOplockKeysEqual(
+  IN PFILE_OBJECT Fo1 OPTIONAL,
+  IN PFILE_OBJECT Fo2 OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlInitializeExtraCreateParameterList(
+  IN OUT PECP_LIST EcpList);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlInitializeExtraCreateParameter(
+  IN PECP_HEADER Ecp,
+  IN ULONG EcpFlags,
+  IN PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback OPTIONAL,
+  IN ULONG TotalSize,
+  IN LPCGUID EcpType,
+  IN PVOID ListAllocatedFrom OPTIONAL);
+
+#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlInsertPerFileContext(
+  IN PVOID* PerFileContextPointer,
+  IN PFSRTL_PER_FILE_CONTEXT Ptr);
+
+NTKERNELAPI
+PFSRTL_PER_FILE_CONTEXT
+NTAPI
+FsRtlLookupPerFileContext(
+  IN PVOID* PerFileContextPointer,
+  IN PVOID OwnerId OPTIONAL,
+  IN PVOID InstanceId OPTIONAL);
+
+NTKERNELAPI
+PFSRTL_PER_FILE_CONTEXT
+NTAPI
+FsRtlRemovePerFileContext(
+  IN PVOID* PerFileContextPointer,
+  IN PVOID OwnerId OPTIONAL,
+  IN PVOID InstanceId OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlTeardownPerFileContexts(
+  IN PVOID* PerFileContextPointer);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlInsertPerFileObjectContext(
+  IN PFILE_OBJECT FileObject,
+  IN PFSRTL_PER_FILEOBJECT_CONTEXT Ptr);
+
+NTKERNELAPI
+PFSRTL_PER_FILEOBJECT_CONTEXT
+NTAPI
+FsRtlLookupPerFileObjectContext(
+  IN PFILE_OBJECT FileObject,
+  IN PVOID OwnerId OPTIONAL,
+  IN PVOID InstanceId OPTIONAL);
+
+NTKERNELAPI
+PFSRTL_PER_FILEOBJECT_CONTEXT
+NTAPI
+FsRtlRemovePerFileObjectContext(
+  IN PFILE_OBJECT FileObject,
+  IN PVOID OwnerId OPTIONAL,
+  IN PVOID InstanceId OPTIONAL);
+
+#define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) (       \
+     FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11)   \
+)
+
+#define FsRtlAreThereCurrentFileLocks(FL) ( \
+    ((FL)->FastIoIsQuestionable)            \
+)
+
+#define FsRtlIncrementLockRequestsInProgress(FL) {                           \
+    ASSERT( (FL)->LockRequestsInProgress >= 0 );                             \
+    (void)                                                                   \
+    (InterlockedIncrement((LONG volatile *)&((FL)->LockRequestsInProgress)));\
+}
+
+#define FsRtlDecrementLockRequestsInProgress(FL) {                           \
+    ASSERT( (FL)->LockRequestsInProgress > 0 );                              \
+    (void)                                                                   \
+    (InterlockedDecrement((LONG volatile *)&((FL)->LockRequestsInProgress)));\
+}
+
+/* GCC compatible definition, MS one is retarded */
+extern NTKERNELAPI const UCHAR * const FsRtlLegalAnsiCharacterArray;
+#define LEGAL_ANSI_CHARACTER_ARRAY        FsRtlLegalAnsiCharacterArray
+
+#define FsRtlIsAnsiCharacterWild(C) (                                       \
+    FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], FSRTL_WILD_CHARACTER ) \
+)
+
+#define FsRtlIsAnsiCharacterLegalFat(C, WILD) (                                \
+    FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_FAT_LEGAL) |       \
+                                        ((WILD) ? FSRTL_WILD_CHARACTER : 0 ))  \
+)
+
+#define FsRtlIsAnsiCharacterLegalHpfs(C, WILD) (                               \
+    FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_HPFS_LEGAL) |      \
+                                        ((WILD) ? FSRTL_WILD_CHARACTER : 0 ))  \
+)
+
+#define FsRtlIsAnsiCharacterLegalNtfs(C, WILD) (                               \
+    FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_NTFS_LEGAL) |      \
+                                        ((WILD) ? FSRTL_WILD_CHARACTER : 0 ))  \
+)
+
+#define FsRtlIsAnsiCharacterLegalNtfsStream(C,WILD_OK) (                    \
+    FsRtlTestAnsiCharacter((C), TRUE, (WILD_OK), FSRTL_NTFS_STREAM_LEGAL)   \
+)
+
+#define FsRtlIsAnsiCharacterLegal(C,FLAGS) (          \
+    FsRtlTestAnsiCharacter((C), TRUE, FALSE, (FLAGS)) \
+)
+
+#define FsRtlTestAnsiCharacter(C, DEFAULT_RET, WILD_OK, FLAGS) (            \
+        ((SCHAR)(C) < 0) ? DEFAULT_RET :                                    \
+                           FlagOn( LEGAL_ANSI_CHARACTER_ARRAY[(C)],         \
+                                   (FLAGS) |                                \
+                                   ((WILD_OK) ? FSRTL_WILD_CHARACTER : 0) ) \
+)
+
+#define FsRtlIsLeadDbcsCharacter(DBCS_CHAR) (                               \
+    (BOOLEAN)((UCHAR)(DBCS_CHAR) < 0x80 ? FALSE :                           \
+              (NLS_MB_CODE_PAGE_TAG &&                                      \
+               (NLS_OEM_LEAD_BYTE_INFO[(UCHAR)(DBCS_CHAR)] != 0)))          \
+)
+
+#define FsRtlIsUnicodeCharacterWild(C) (                                    \
+    (((C) >= 0x40) ?                                                        \
+    FALSE :                                                                 \
+    FlagOn(FsRtlLegalAnsiCharacterArray[(C)], FSRTL_WILD_CHARACTER ))       \
+)
+
+#define FsRtlInitPerFileContext( _fc, _owner, _inst, _cb)   \
+    ((_fc)->OwnerId = (_owner),                               \
+     (_fc)->InstanceId = (_inst),                             \
+     (_fc)->FreeCallback = (_cb))
+
+#define FsRtlGetPerFileContextPointer(_fo) \
+    (FsRtlSupportsPerFileContexts(_fo) ? \
+        FsRtlGetPerStreamContextPointer(_fo)->FileContextSupportPointer : \
+        NULL)
+
+#define FsRtlSupportsPerFileContexts(_fo)                     \
+    ((FsRtlGetPerStreamContextPointer(_fo) != NULL) &&        \
+     (FsRtlGetPerStreamContextPointer(_fo)->Version >= FSRTL_FCB_HEADER_V1) &&  \
+     (FsRtlGetPerStreamContextPointer(_fo)->FileContextSupportPointer != NULL))
+
+#define FsRtlSetupAdvancedHeaderEx( _advhdr, _fmutx, _fctxptr )                     \
+{                                                                                   \
+    FsRtlSetupAdvancedHeader( _advhdr, _fmutx );                                    \
+    if ((_fctxptr) != NULL) {                                                       \
+        (_advhdr)->FileContextSupportPointer = (_fctxptr);                          \
+    }                                                                               \
+}
+
+#define FsRtlGetPerStreamContextPointer(FO) (   \
+    (PFSRTL_ADVANCED_FCB_HEADER)(FO)->FsContext \
+)
+
+#define FsRtlInitPerStreamContext(PSC, O, I, FC) ( \
+    (PSC)->OwnerId = (O),                          \
+    (PSC)->InstanceId = (I),                       \
+    (PSC)->FreeCallback = (FC)                     \
+)
+
+#define FsRtlSupportsPerStreamContexts(FO) (                       \
+    (BOOLEAN)((NULL != FsRtlGetPerStreamContextPointer(FO) &&     \
+              FlagOn(FsRtlGetPerStreamContextPointer(FO)->Flags2, \
+              FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS))               \
+)
+
+#define FsRtlLookupPerStreamContext(_sc, _oid, _iid)                          \
+ (((NULL != (_sc)) &&                                                         \
+   FlagOn((_sc)->Flags2,FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS) &&              \
+   !IsListEmpty(&(_sc)->FilterContexts)) ?                                    \
+        FsRtlLookupPerStreamContextInternal((_sc), (_oid), (_iid)) :          \
+        NULL)
+
+VOID
+FORCEINLINE
+NTAPI
+FsRtlSetupAdvancedHeader(
+  IN PVOID AdvHdr,
+  IN PFAST_MUTEX FMutex )
+{
+  PFSRTL_ADVANCED_FCB_HEADER localAdvHdr = (PFSRTL_ADVANCED_FCB_HEADER)AdvHdr;
+
+  localAdvHdr->Flags |= FSRTL_FLAG_ADVANCED_HEADER;
+  localAdvHdr->Flags2 |= FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS;
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+  localAdvHdr->Version = FSRTL_FCB_HEADER_V1;
+#else
+  localAdvHdr->Version = FSRTL_FCB_HEADER_V0;
+#endif
+  InitializeListHead( &localAdvHdr->FilterContexts );
+  if (FMutex != NULL) {
+    localAdvHdr->FastMutex = FMutex;
+  }
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+  *((PULONG_PTR)(&localAdvHdr->PushLock)) = 0;
+  localAdvHdr->FileContextSupportPointer = NULL;
+#endif
+}
+
+#define FsRtlInitPerFileObjectContext(_fc, _owner, _inst)         \
+           ((_fc)->OwnerId = (_owner), (_fc)->InstanceId = (_inst))
+
+#define FsRtlCompleteRequest(IRP,STATUS) {         \
+    (IRP)->IoStatus.Status = (STATUS);             \
+    IoCompleteRequest( (IRP), IO_DISK_INCREMENT ); \
+}
+$endif (_NTIFS_)
diff --git a/include/xdk/fsrtltypes.h b/include/xdk/fsrtltypes.h
new file mode 100644 (file)
index 0000000..497d0dd
--- /dev/null
@@ -0,0 +1,172 @@
+$if (_NTIFS_)
+/* FSRTL Types */
+
+typedef struct _FSRTL_COMMON_FCB_HEADER {
+  CSHORT NodeTypeCode;
+  CSHORT NodeByteSize;
+  UCHAR Flags;
+  UCHAR IsFastIoPossible;
+  UCHAR Flags2;
+  UCHAR Reserved:4;
+  UCHAR Version:4;
+  PERESOURCE Resource;
+  PERESOURCE PagingIoResource;
+  LARGE_INTEGER AllocationSize;
+  LARGE_INTEGER FileSize;
+  LARGE_INTEGER ValidDataLength;
+} FSRTL_COMMON_FCB_HEADER, *PFSRTL_COMMON_FCB_HEADER;
+
+#ifdef __cplusplus
+typedef struct _FSRTL_ADVANCED_FCB_HEADER:FSRTL_COMMON_FCB_HEADER {
+#else /* __cplusplus */
+typedef struct _FSRTL_ADVANCED_FCB_HEADER {
+  FSRTL_COMMON_FCB_HEADER DUMMYSTRUCTNAME;
+#endif  /* __cplusplus */
+  PFAST_MUTEX FastMutex;
+  LIST_ENTRY FilterContexts;
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+  EX_PUSH_LOCK PushLock;
+  PVOID *FileContextSupportPointer;
+#endif
+} FSRTL_ADVANCED_FCB_HEADER, *PFSRTL_ADVANCED_FCB_HEADER;
+
+#define FSRTL_FCB_HEADER_V0             (0x00)
+#define FSRTL_FCB_HEADER_V1             (0x01)
+
+#define FSRTL_FLAG_FILE_MODIFIED        (0x01)
+#define FSRTL_FLAG_FILE_LENGTH_CHANGED  (0x02)
+#define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04)
+#define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08)
+#define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10)
+#define FSRTL_FLAG_USER_MAPPED_FILE     (0x20)
+#define FSRTL_FLAG_ADVANCED_HEADER      (0x40)
+#define FSRTL_FLAG_EOF_ADVANCE_ACTIVE   (0x80)
+
+#define FSRTL_FLAG2_DO_MODIFIED_WRITE        (0x01)
+#define FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS (0x02)
+#define FSRTL_FLAG2_PURGE_WHEN_MAPPED        (0x04)
+#define FSRTL_FLAG2_IS_PAGING_FILE           (0x08)
+
+#define FSRTL_FSP_TOP_LEVEL_IRP         (0x01)
+#define FSRTL_CACHE_TOP_LEVEL_IRP       (0x02)
+#define FSRTL_MOD_WRITE_TOP_LEVEL_IRP   (0x03)
+#define FSRTL_FAST_IO_TOP_LEVEL_IRP     (0x04)
+#define FSRTL_NETWORK1_TOP_LEVEL_IRP    ((LONG_PTR)0x05)
+#define FSRTL_NETWORK2_TOP_LEVEL_IRP    ((LONG_PTR)0x06)
+#define FSRTL_MAX_TOP_LEVEL_IRP_FLAG    ((LONG_PTR)0xFFFF)
+
+typedef struct _FSRTL_AUXILIARY_BUFFER {
+  PVOID Buffer;
+  ULONG Length;
+  ULONG Flags;
+  PMDL Mdl;
+} FSRTL_AUXILIARY_BUFFER, *PFSRTL_AUXILIARY_BUFFER;
+
+#define FSRTL_AUXILIARY_FLAG_DEALLOCATE 0x00000001
+
+typedef enum _FSRTL_COMPARISON_RESULT {
+  LessThan = -1,
+  EqualTo = 0,
+  GreaterThan = 1
+} FSRTL_COMPARISON_RESULT;
+
+#define FSRTL_FAT_LEGAL                 0x01
+#define FSRTL_HPFS_LEGAL                0x02
+#define FSRTL_NTFS_LEGAL                0x04
+#define FSRTL_WILD_CHARACTER            0x08
+#define FSRTL_OLE_LEGAL                 0x10
+#define FSRTL_NTFS_STREAM_LEGAL         (FSRTL_NTFS_LEGAL | FSRTL_OLE_LEGAL)
+
+#define FSRTL_VOLUME_DISMOUNT           1
+#define FSRTL_VOLUME_DISMOUNT_FAILED    2
+#define FSRTL_VOLUME_LOCK               3
+#define FSRTL_VOLUME_LOCK_FAILED        4
+#define FSRTL_VOLUME_UNLOCK             5
+#define FSRTL_VOLUME_MOUNT              6
+#define FSRTL_VOLUME_NEEDS_CHKDSK       7
+#define FSRTL_VOLUME_WORM_NEAR_FULL     8
+#define FSRTL_VOLUME_WEARING_OUT        9
+#define FSRTL_VOLUME_FORCED_CLOSED      10
+#define FSRTL_VOLUME_INFO_MAKE_COMPAT   11
+#define FSRTL_VOLUME_PREPARING_EJECT    12
+#define FSRTL_VOLUME_CHANGE_SIZE        13
+#define FSRTL_VOLUME_BACKGROUND_FORMAT  14
+
+typedef VOID
+(NTAPI *PFSRTL_STACK_OVERFLOW_ROUTINE) (
+  IN PVOID Context,
+  IN PKEVENT Event);
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+
+#define FSRTL_UNC_PROVIDER_FLAGS_MAILSLOTS_SUPPORTED    0x00000001
+#define FSRTL_UNC_PROVIDER_FLAGS_CSC_ENABLED            0x00000002
+#define FSRTL_UNC_PROVIDER_FLAGS_DOMAIN_SVC_AWARE       0x00000004
+
+#define FSRTL_ALLOCATE_ECPLIST_FLAG_CHARGE_QUOTA           0x00000001
+
+#define FSRTL_ALLOCATE_ECP_FLAG_CHARGE_QUOTA               0x00000001
+#define FSRTL_ALLOCATE_ECP_FLAG_NONPAGED_POOL              0x00000002
+
+#define FSRTL_ECP_LOOKASIDE_FLAG_NONPAGED_POOL             0x00000002
+
+#define FSRTL_VIRTDISK_FULLY_ALLOCATED  0x00000001
+#define FSRTL_VIRTDISK_NO_DRIVE_LETTER  0x00000002
+
+typedef struct _FSRTL_MUP_PROVIDER_INFO_LEVEL_1 {
+  ULONG32 ProviderId;
+} FSRTL_MUP_PROVIDER_INFO_LEVEL_1, *PFSRTL_MUP_PROVIDER_INFO_LEVEL_1;
+
+typedef struct _FSRTL_MUP_PROVIDER_INFO_LEVEL_2 {
+  ULONG32 ProviderId;
+  UNICODE_STRING ProviderName;
+} FSRTL_MUP_PROVIDER_INFO_LEVEL_2, *PFSRTL_MUP_PROVIDER_INFO_LEVEL_2;
+
+typedef VOID
+(*PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK) (
+  IN OUT PVOID EcpContext,
+  IN LPCGUID EcpType);
+
+typedef struct _ECP_LIST ECP_LIST, *PECP_LIST;
+
+typedef ULONG FSRTL_ALLOCATE_ECPLIST_FLAGS;
+typedef ULONG FSRTL_ALLOCATE_ECP_FLAGS;
+typedef ULONG FSRTL_ECP_LOOKASIDE_FLAGS;
+
+typedef enum _FSRTL_CHANGE_BACKING_TYPE {
+  ChangeDataControlArea,
+  ChangeImageControlArea,
+  ChangeSharedCacheMap
+} FSRTL_CHANGE_BACKING_TYPE, *PFSRTL_CHANGE_BACKING_TYPE;
+
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+
+typedef struct _FSRTL_PER_FILE_CONTEXT {
+  LIST_ENTRY Links;
+  PVOID OwnerId;
+  PVOID InstanceId;
+  PFREE_FUNCTION FreeCallback;
+} FSRTL_PER_FILE_CONTEXT, *PFSRTL_PER_FILE_CONTEXT;
+
+typedef struct _FSRTL_PER_STREAM_CONTEXT {
+  LIST_ENTRY Links;
+  PVOID OwnerId;
+  PVOID InstanceId;
+  PFREE_FUNCTION FreeCallback;
+} FSRTL_PER_STREAM_CONTEXT, *PFSRTL_PER_STREAM_CONTEXT;
+
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+typedef VOID
+(*PFN_FSRTLTEARDOWNPERSTREAMCONTEXTS) (
+  IN PFSRTL_ADVANCED_FCB_HEADER AdvancedHeader);
+#endif
+
+typedef struct _FSRTL_PER_FILEOBJECT_CONTEXT {
+  LIST_ENTRY Links;
+  PVOID OwnerId;
+  PVOID InstanceId;
+} FSRTL_PER_FILEOBJECT_CONTEXT, *PFSRTL_PER_FILEOBJECT_CONTEXT;
+
+#define FSRTL_CC_FLUSH_ERROR_FLAG_NO_HARD_ERROR  0x1
+#define FSRTL_CC_FLUSH_ERROR_FLAG_NO_LOG_ENTRY   0x2
+$endif (_NTIFS_)
index c5653ff..782f92f 100644 (file)
@@ -2,4 +2,5 @@
 
 ..\..\output-i386\tools\hpp\hpp.exe wdm.template.h wdm.h
 ..\..\output-i386\tools\hpp\hpp.exe ntddk.template.h ntddk.h
+..\..\output-i386\tools\hpp\hpp.exe ntifs.template.h ntifs.h
 ..\..\output-i386\tools\hpp\hpp.exe devioctl.template.h devioctl.h
index 16724c0..526dab3 100644 (file)
@@ -2,33 +2,6 @@
  *                         I/O Manager Functions                              *
  ******************************************************************************/
 
-$if (_NTDDK_)
-/*
- * VOID IoAssignArcName(
- *   IN PUNICODE_STRING  ArcName,
- *   IN PUNICODE_STRING  DeviceName);
- */
-#define IoAssignArcName(_ArcName, _DeviceName) ( \
-  IoCreateSymbolicLink((_ArcName), (_DeviceName)))
-
-/*
- * VOID
- * IoDeassignArcName(
- *   IN PUNICODE_STRING  ArcName)
- */
-#define IoDeassignArcName IoDeleteSymbolicLink
-
-VOID
-FORCEINLINE
-NTAPI
-IoInitializeDriverCreateContext(
-  PIO_DRIVER_CREATE_CONTEXT DriverContext)
-{
-  RtlZeroMemory(DriverContext, sizeof(IO_DRIVER_CREATE_CONTEXT));
-  DriverContext->Size = sizeof(IO_DRIVER_CREATE_CONTEXT);
-}
-
-$endif (_NTDDK_)
 $if (_WDMDDK_)
 /*
  * NTSTATUS
@@ -573,208 +546,53 @@ IoMapTransfer(
 #endif
 
 $endif (_WDMDDK_)
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-
 $if (_NTDDK_)
-#if !(defined(USE_DMA_MACROS) && (defined(_NTDDK_) || defined(_NTDRIVER_)) || defined(_WDM_INCLUDED_))
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoAllocateAdapterChannel(
-  IN PADAPTER_OBJECT AdapterObject,
-  IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG NumberOfMapRegisters,
-  IN PDRIVER_CONTROL ExecutionRoutine,
-  IN PVOID Context);
-#endif
-
-#if !defined(DMA_MACROS_DEFINED)
-//DECLSPEC_DEPRECATED_DDK
-NTHALAPI
-PHYSICAL_ADDRESS
-NTAPI
-IoMapTransfer(
-  IN PADAPTER_OBJECT AdapterObject,
-  IN PMDL Mdl,
-  IN PVOID MapRegisterBase,
-  IN PVOID CurrentVa,
-  IN OUT PULONG Length,
-  IN BOOLEAN WriteToDevice);
-#endif
-
-NTKERNELAPI
-VOID
-NTAPI
-IoAllocateController(
-  IN PCONTROLLER_OBJECT ControllerObject,
-  IN PDEVICE_OBJECT DeviceObject,
-  IN PDRIVER_CONTROL ExecutionRoutine,
-  IN PVOID Context OPTIONAL);
-
-NTKERNELAPI
-PCONTROLLER_OBJECT
-NTAPI
-IoCreateController(
-  IN ULONG Size);
-
-NTKERNELAPI
-VOID
-NTAPI
-IoDeleteController(
-  IN PCONTROLLER_OBJECT ControllerObject);
-
-NTKERNELAPI
-VOID
-NTAPI
-IoFreeController(
-  IN PCONTROLLER_OBJECT ControllerObject);
-
-NTKERNELAPI
-PCONFIGURATION_INFORMATION
-NTAPI
-IoGetConfigurationInformation(VOID);
-
-NTKERNELAPI
-PDEVICE_OBJECT
-NTAPI
-IoGetDeviceToVerify(
-  IN PETHREAD Thread);
-
-NTKERNELAPI
-VOID
-NTAPI
-IoCancelFileOpen(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN PFILE_OBJECT FileObject);
-
-NTKERNELAPI
-PGENERIC_MAPPING
-NTAPI
-IoGetFileObjectGenericMapping(VOID);
-
-NTKERNELAPI
-PIRP
-NTAPI
-IoMakeAssociatedIrp(
-  IN PIRP Irp,
-  IN CCHAR StackSize);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoQueryDeviceDescription(
-  IN PINTERFACE_TYPE BusType OPTIONAL,
-  IN PULONG BusNumber OPTIONAL,
-  IN PCONFIGURATION_TYPE ControllerType OPTIONAL,
-  IN PULONG ControllerNumber OPTIONAL,
-  IN PCONFIGURATION_TYPE PeripheralType OPTIONAL,
-  IN PULONG PeripheralNumber OPTIONAL,
-  IN PIO_QUERY_DEVICE_ROUTINE CalloutRoutine,
-  IN OUT PVOID Context OPTIONAL);
-
-NTKERNELAPI
-VOID
-NTAPI
-IoRaiseHardError(
-  IN PIRP Irp,
-  IN PVPB Vpb OPTIONAL,
-  IN PDEVICE_OBJECT RealDeviceObject);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-IoRaiseInformationalHardError(
-  IN NTSTATUS ErrorStatus,
-  IN PUNICODE_STRING String OPTIONAL,
-  IN PKTHREAD Thread OPTIONAL);
+/*
+ * VOID IoAssignArcName(
+ *   IN PUNICODE_STRING  ArcName,
+ *   IN PUNICODE_STRING  DeviceName);
+ */
+#define IoAssignArcName(_ArcName, _DeviceName) ( \
+  IoCreateSymbolicLink((_ArcName), (_DeviceName)))
 
-NTKERNELAPI
-VOID
-NTAPI
-IoRegisterBootDriverReinitialization(
-  IN PDRIVER_OBJECT DriverObject,
-  IN PDRIVER_REINITIALIZE DriverReinitializationRoutine,
-  IN PVOID Context OPTIONAL);
+/*
+ * VOID
+ * IoDeassignArcName(
+ *   IN PUNICODE_STRING  ArcName)
+ */
+#define IoDeassignArcName IoDeleteSymbolicLink
 
-NTKERNELAPI
 VOID
+FORCEINLINE
 NTAPI
-IoRegisterDriverReinitialization(
-  IN PDRIVER_OBJECT DriverObject,
-  IN PDRIVER_REINITIALIZE DriverReinitializationRoutine,
-  IN PVOID Context OPTIONAL);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoAttachDeviceByPointer(
-  IN PDEVICE_OBJECT SourceDevice,
-  IN PDEVICE_OBJECT TargetDevice);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoReportDetectedDevice(
-  IN PDRIVER_OBJECT DriverObject,
-  IN INTERFACE_TYPE LegacyBusType,
-  IN ULONG BusNumber,
-  IN ULONG SlotNumber,
-  IN PCM_RESOURCE_LIST ResourceList OPTIONAL,
-  IN PIO_RESOURCE_REQUIREMENTS_LIST ResourceRequirements OPTIONAL,
-  IN BOOLEAN ResourceAssigned,
-  IN OUT PDEVICE_OBJECT *DeviceObject OPTIONAL);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoReportResourceForDetection(
-  IN PDRIVER_OBJECT DriverObject,
-  IN PCM_RESOURCE_LIST DriverList OPTIONAL,
-  IN ULONG DriverListSize OPTIONAL,
-  IN PDEVICE_OBJECT DeviceObject OPTIONAL,
-  IN PCM_RESOURCE_LIST DeviceList OPTIONAL,
-  IN ULONG DeviceListSize OPTIONAL,
-  OUT PBOOLEAN ConflictDetected);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoReportResourceUsage(
-  IN PUNICODE_STRING DriverClassName OPTIONAL,
-  IN PDRIVER_OBJECT DriverObject,
-  IN PCM_RESOURCE_LIST DriverList OPTIONAL,
-  IN ULONG DriverListSize OPTIONAL,
-  IN PDEVICE_OBJECT DeviceObject,
-  IN PCM_RESOURCE_LIST DeviceList OPTIONAL,
-  IN ULONG DeviceListSize OPTIONAL,
-  IN BOOLEAN OverrideConflict,
-  OUT PBOOLEAN ConflictDetected);
+IoInitializeDriverCreateContext(
+  PIO_DRIVER_CREATE_CONTEXT DriverContext)
+{
+  RtlZeroMemory(DriverContext, sizeof(IO_DRIVER_CREATE_CONTEXT));
+  DriverContext->Size = sizeof(IO_DRIVER_CREATE_CONTEXT);
+}
 
-NTKERNELAPI
-VOID
-NTAPI
-IoSetHardErrorOrVerifyDevice(
-  IN PIRP Irp,
-  IN PDEVICE_OBJECT DeviceObject);
+$endif (_NTDDK_)
+$if (_NTIFS_)
+#define IoIsFileOpenedExclusively(FileObject) ( \
+    (BOOLEAN) !(                                \
+    (FileObject)->SharedRead ||                 \
+    (FileObject)->SharedWrite ||                \
+    (FileObject)->SharedDelete                  \
+    )                                           \
+)
 
+#if (NTDDI_VERSION == NTDDI_WIN2K)
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoAssignResources(
-  IN PUNICODE_STRING RegistryPath,
-  IN PUNICODE_STRING DriverClassName OPTIONAL,
+IoRegisterFsRegistrationChangeEx(
   IN PDRIVER_OBJECT DriverObject,
-  IN PDEVICE_OBJECT DeviceObject OPTIONAL,
-  IN PIO_RESOURCE_REQUIREMENTS_LIST RequestedResources OPTIONAL,
-  IN OUT PCM_RESOURCE_LIST *AllocatedResources);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-IoSetThreadHardErrorMode(
-  IN BOOLEAN EnableHardErrors);
+  IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine);
+#endif
+$endif (_NTIFS_)
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
 
-$endif (_NTDDK_)
 $if (_WDMDDK_)
 NTKERNELAPI
 VOID
@@ -1425,144 +1243,479 @@ IoSetTopLevelIrp(
   IN PIRP Irp OPTIONAL);
 
 $endif (_WDMDDK_)
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
-
 $if (_NTDDK_)
-#if (NTDDI_VERSION >= NTDDI_WIN2KSP3)
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-IoIsFileOriginRemote(
-  IN PFILE_OBJECT FileObject);
-
+#if !(defined(USE_DMA_MACROS) && (defined(_NTDDK_) || defined(_NTDRIVER_)) || defined(_WDM_INCLUDED_))
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoSetFileOrigin(
-  IN PFILE_OBJECT FileObject,
-  IN BOOLEAN Remote);
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2KSP3) */
+IoAllocateAdapterChannel(
+  IN PADAPTER_OBJECT AdapterObject,
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG NumberOfMapRegisters,
+  IN PDRIVER_CONTROL ExecutionRoutine,
+  IN PVOID Context);
+#endif
 
-$endif (_NTDDK_)
-#if (NTDDI_VERSION >= NTDDI_WINXP)
+#if !defined(DMA_MACROS_DEFINED)
+//DECLSPEC_DEPRECATED_DDK
+NTHALAPI
+PHYSICAL_ADDRESS
+NTAPI
+IoMapTransfer(
+  IN PADAPTER_OBJECT AdapterObject,
+  IN PMDL Mdl,
+  IN PVOID MapRegisterBase,
+  IN PVOID CurrentVa,
+  IN OUT PULONG Length,
+  IN BOOLEAN WriteToDevice);
+#endif
 
-$if (_NTDDK_)
 NTKERNELAPI
-NTSTATUS
-FASTCALL
-IoReadPartitionTable(
+VOID
+NTAPI
+IoAllocateController(
+  IN PCONTROLLER_OBJECT ControllerObject,
   IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG SectorSize,
-  IN BOOLEAN ReturnRecognizedPartitions,
-  OUT struct _DRIVE_LAYOUT_INFORMATION **PartitionBuffer);
+  IN PDRIVER_CONTROL ExecutionRoutine,
+  IN PVOID Context OPTIONAL);
+
+NTKERNELAPI
+PCONTROLLER_OBJECT
+NTAPI
+IoCreateController(
+  IN ULONG Size);
+
+NTKERNELAPI
+VOID
+NTAPI
+IoDeleteController(
+  IN PCONTROLLER_OBJECT ControllerObject);
+
+NTKERNELAPI
+VOID
+NTAPI
+IoFreeController(
+  IN PCONTROLLER_OBJECT ControllerObject);
+
+NTKERNELAPI
+PCONFIGURATION_INFORMATION
+NTAPI
+IoGetConfigurationInformation(VOID);
+
+NTKERNELAPI
+PDEVICE_OBJECT
+NTAPI
+IoGetDeviceToVerify(
+  IN PETHREAD Thread);
+
+NTKERNELAPI
+VOID
+NTAPI
+IoCancelFileOpen(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN PFILE_OBJECT FileObject);
+
+NTKERNELAPI
+PGENERIC_MAPPING
+NTAPI
+IoGetFileObjectGenericMapping(VOID);
+
+NTKERNELAPI
+PIRP
+NTAPI
+IoMakeAssociatedIrp(
+  IN PIRP Irp,
+  IN CCHAR StackSize);
 
 NTKERNELAPI
 NTSTATUS
-FASTCALL
-IoSetPartitionInformation(
+NTAPI
+IoQueryDeviceDescription(
+  IN PINTERFACE_TYPE BusType OPTIONAL,
+  IN PULONG BusNumber OPTIONAL,
+  IN PCONFIGURATION_TYPE ControllerType OPTIONAL,
+  IN PULONG ControllerNumber OPTIONAL,
+  IN PCONFIGURATION_TYPE PeripheralType OPTIONAL,
+  IN PULONG PeripheralNumber OPTIONAL,
+  IN PIO_QUERY_DEVICE_ROUTINE CalloutRoutine,
+  IN OUT PVOID Context OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+IoRaiseHardError(
+  IN PIRP Irp,
+  IN PVPB Vpb OPTIONAL,
+  IN PDEVICE_OBJECT RealDeviceObject);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+IoRaiseInformationalHardError(
+  IN NTSTATUS ErrorStatus,
+  IN PUNICODE_STRING String OPTIONAL,
+  IN PKTHREAD Thread OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+IoRegisterBootDriverReinitialization(
+  IN PDRIVER_OBJECT DriverObject,
+  IN PDRIVER_REINITIALIZE DriverReinitializationRoutine,
+  IN PVOID Context OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+IoRegisterDriverReinitialization(
+  IN PDRIVER_OBJECT DriverObject,
+  IN PDRIVER_REINITIALIZE DriverReinitializationRoutine,
+  IN PVOID Context OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoAttachDeviceByPointer(
+  IN PDEVICE_OBJECT SourceDevice,
+  IN PDEVICE_OBJECT TargetDevice);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoReportDetectedDevice(
+  IN PDRIVER_OBJECT DriverObject,
+  IN INTERFACE_TYPE LegacyBusType,
+  IN ULONG BusNumber,
+  IN ULONG SlotNumber,
+  IN PCM_RESOURCE_LIST ResourceList OPTIONAL,
+  IN PIO_RESOURCE_REQUIREMENTS_LIST ResourceRequirements OPTIONAL,
+  IN BOOLEAN ResourceAssigned,
+  IN OUT PDEVICE_OBJECT *DeviceObject OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoReportResourceForDetection(
+  IN PDRIVER_OBJECT DriverObject,
+  IN PCM_RESOURCE_LIST DriverList OPTIONAL,
+  IN ULONG DriverListSize OPTIONAL,
+  IN PDEVICE_OBJECT DeviceObject OPTIONAL,
+  IN PCM_RESOURCE_LIST DeviceList OPTIONAL,
+  IN ULONG DeviceListSize OPTIONAL,
+  OUT PBOOLEAN ConflictDetected);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoReportResourceUsage(
+  IN PUNICODE_STRING DriverClassName OPTIONAL,
+  IN PDRIVER_OBJECT DriverObject,
+  IN PCM_RESOURCE_LIST DriverList OPTIONAL,
+  IN ULONG DriverListSize OPTIONAL,
   IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG SectorSize,
-  IN ULONG PartitionNumber,
-  IN ULONG PartitionType);
+  IN PCM_RESOURCE_LIST DeviceList OPTIONAL,
+  IN ULONG DeviceListSize OPTIONAL,
+  IN BOOLEAN OverrideConflict,
+  OUT PBOOLEAN ConflictDetected);
+
+NTKERNELAPI
+VOID
+NTAPI
+IoSetHardErrorOrVerifyDevice(
+  IN PIRP Irp,
+  IN PDEVICE_OBJECT DeviceObject);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoAssignResources(
+  IN PUNICODE_STRING RegistryPath,
+  IN PUNICODE_STRING DriverClassName OPTIONAL,
+  IN PDRIVER_OBJECT DriverObject,
+  IN PDEVICE_OBJECT DeviceObject OPTIONAL,
+  IN PIO_RESOURCE_REQUIREMENTS_LIST RequestedResources OPTIONAL,
+  IN OUT PCM_RESOURCE_LIST *AllocatedResources);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+IoSetThreadHardErrorMode(
+  IN BOOLEAN EnableHardErrors);
+
+$endif (_NTDDK_)
+$if (_NTIFS_)
+
+NTKERNELAPI
+VOID
+NTAPI
+IoAcquireVpbSpinLock(
+  OUT PKIRQL Irql);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoCheckDesiredAccess(
+  IN OUT PACCESS_MASK DesiredAccess,
+  IN ACCESS_MASK GrantedAccess);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoCheckEaBufferValidity(
+  IN PFILE_FULL_EA_INFORMATION EaBuffer,
+  IN ULONG EaLength,
+  OUT PULONG ErrorOffset);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoCheckFunctionAccess(
+  IN ACCESS_MASK GrantedAccess,
+  IN UCHAR MajorFunction,
+  IN UCHAR MinorFunction,
+  IN ULONG IoControlCode,
+  IN PVOID Argument1 OPTIONAL,
+  IN PVOID Argument2 OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoCheckQuerySetFileInformation(
+  IN FILE_INFORMATION_CLASS FileInformationClass,
+  IN ULONG Length,
+  IN BOOLEAN SetOperation);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoCheckQuerySetVolumeInformation(
+  IN FS_INFORMATION_CLASS FsInformationClass,
+  IN ULONG Length,
+  IN BOOLEAN SetOperation);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoCheckQuotaBufferValidity(
+  IN PFILE_QUOTA_INFORMATION QuotaBuffer,
+  IN ULONG QuotaLength,
+  OUT PULONG ErrorOffset);
+
+NTKERNELAPI
+PFILE_OBJECT
+NTAPI
+IoCreateStreamFileObject(
+  IN PFILE_OBJECT FileObject OPTIONAL,
+  IN PDEVICE_OBJECT DeviceObject OPTIONAL);
+
+NTKERNELAPI
+PFILE_OBJECT
+NTAPI
+IoCreateStreamFileObjectLite(
+  IN PFILE_OBJECT FileObject OPTIONAL,
+  IN PDEVICE_OBJECT DeviceObject OPTIONAL);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+IoFastQueryNetworkAttributes(
+  IN POBJECT_ATTRIBUTES ObjectAttributes,
+  IN ACCESS_MASK DesiredAccess,
+  IN ULONG OpenOptions,
+  OUT PIO_STATUS_BLOCK IoStatus,
+  OUT PFILE_NETWORK_OPEN_INFORMATION Buffer);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoPageRead(
+  IN PFILE_OBJECT FileObject,
+  IN PMDL Mdl,
+  IN PLARGE_INTEGER Offset,
+  IN PKEVENT Event,
+  OUT PIO_STATUS_BLOCK IoStatusBlock);
+
+NTKERNELAPI
+PDEVICE_OBJECT
+NTAPI
+IoGetBaseFileSystemDeviceObject(
+  IN PFILE_OBJECT FileObject);
+
+NTKERNELAPI
+PCONFIGURATION_INFORMATION
+NTAPI
+IoGetConfigurationInformation(VOID);
+
+NTKERNELAPI
+ULONG
+NTAPI
+IoGetRequestorProcessId(
+  IN PIRP Irp);
+
+NTKERNELAPI
+PEPROCESS
+NTAPI
+IoGetRequestorProcess(
+  IN PIRP Irp);
+
+NTKERNELAPI
+PIRP
+NTAPI
+IoGetTopLevelIrp(VOID);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+IoIsOperationSynchronous(
+  IN PIRP Irp);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+IoIsSystemThread(
+  IN PETHREAD Thread);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+IoIsValidNameGraftingBuffer(
+  IN PIRP Irp,
+  IN PREPARSE_DATA_BUFFER ReparseBuffer);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoQueryFileInformation(
+  IN PFILE_OBJECT FileObject,
+  IN FILE_INFORMATION_CLASS FileInformationClass,
+  IN ULONG Length,
+  OUT PVOID FileInformation,
+  OUT PULONG ReturnedLength);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoQueryVolumeInformation(
+  IN PFILE_OBJECT FileObject,
+  IN FS_INFORMATION_CLASS FsInformationClass,
+  IN ULONG Length,
+  OUT PVOID FsInformation,
+  OUT PULONG ReturnedLength);
+
+NTKERNELAPI
+VOID
+NTAPI
+IoQueueThreadIrp(
+  IN PIRP Irp);
+
+NTKERNELAPI
+VOID
+NTAPI
+IoRegisterFileSystem(
+  IN PDEVICE_OBJECT DeviceObject);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoRegisterFsRegistrationChange(
+  IN PDRIVER_OBJECT DriverObject,
+  IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine);
 
 NTKERNELAPI
-NTSTATUS
-FASTCALL
-IoWritePartitionTable(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG SectorSize,
-  IN ULONG SectorsPerTrack,
-  IN ULONG NumberOfHeads,
-  IN struct _DRIVE_LAYOUT_INFORMATION *PartitionBuffer);
+VOID
+NTAPI
+IoReleaseVpbSpinLock(
+  IN KIRQL Irql);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-IoCreateDisk(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN struct _CREATE_DISK* Disk OPTIONAL);
+IoSetDeviceToVerify(
+  IN PETHREAD Thread,
+  IN PDEVICE_OBJECT DeviceObject OPTIONAL);
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoReadDiskSignature(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG BytesPerSector,
-  OUT PDISK_SIGNATURE Signature);
+IoSetInformation(
+  IN PFILE_OBJECT FileObject,
+  IN FILE_INFORMATION_CLASS FileInformationClass,
+  IN ULONG Length,
+  IN PVOID FileInformation);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-IoReadPartitionTableEx(
-  IN PDEVICE_OBJECT DeviceObject,
-  OUT struct _DRIVE_LAYOUT_INFORMATION_EX **PartitionBuffer);
+IoSetTopLevelIrp(
+  IN PIRP Irp OPTIONAL);
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoSetPartitionInformationEx(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG PartitionNumber,
-  IN struct _SET_PARTITION_INFORMATION_EX *PartitionInfo);
+IoSynchronousPageWrite(
+  IN PFILE_OBJECT FileObject,
+  IN PMDL Mdl,
+  IN PLARGE_INTEGER FileOffset,
+  IN PKEVENT Event,
+  OUT PIO_STATUS_BLOCK IoStatusBlock);
 
 NTKERNELAPI
-NTSTATUS
+PEPROCESS
 NTAPI
-IoSetSystemPartition(
-  IN PUNICODE_STRING VolumeNameString);
+IoThreadToProcess(
+  IN PETHREAD Thread);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-IoVerifyPartitionTable(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN BOOLEAN FixErrors);
+IoUnregisterFileSystem(
+  IN PDEVICE_OBJECT DeviceObject);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-IoVolumeDeviceToDosName(
-  IN PVOID VolumeDeviceObject,
-  OUT PUNICODE_STRING DosName);
+IoUnregisterFsRegistrationChange(
+  IN PDRIVER_OBJECT DriverObject,
+  IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine);
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoWritePartitionTableEx(
+IoVerifyVolume(
   IN PDEVICE_OBJECT DeviceObject,
-  IN struct _DRIVE_LAYOUT_INFORMATION_EX *DriveLayout);
+  IN BOOLEAN AllowRawMount);
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoCreateFileSpecifyDeviceObjectHint(
-  OUT PHANDLE FileHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN POBJECT_ATTRIBUTES ObjectAttributes,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN PLARGE_INTEGER AllocationSize OPTIONAL,
-  IN ULONG FileAttributes,
-  IN ULONG ShareAccess,
-  IN ULONG Disposition,
-  IN ULONG CreateOptions,
-  IN PVOID EaBuffer OPTIONAL,
-  IN ULONG EaLength,
-  IN CREATE_FILE_TYPE CreateFileType,
-  IN PVOID InternalParameters OPTIONAL,
-  IN ULONG Options,
-  IN PVOID DeviceObject OPTIONAL);
+IoGetRequestorSessionId(
+  IN PIRP Irp,
+  OUT PULONG pSessionId);
+$endif (_NTIFS_)
+
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+
+$if (_NTDDK_)
+#if (NTDDI_VERSION >= NTDDI_WIN2KSP3)
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+IoIsFileOriginRemote(
+  IN PFILE_OBJECT FileObject);
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoAttachDeviceToDeviceStackSafe(
-  IN PDEVICE_OBJECT SourceDevice,
-  IN PDEVICE_OBJECT TargetDevice,
-  OUT PDEVICE_OBJECT *AttachedToDeviceObject);
+IoSetFileOrigin(
+  IN PFILE_OBJECT FileObject,
+  IN BOOLEAN Remote);
 
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2KSP3) */
 $endif (_NTDDK_)
+
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+
 $if (_WDMDDK_)
 NTKERNELAPI
 NTSTATUS
@@ -1616,112 +1769,272 @@ IoFreeErrorLogEntry(
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoSetCompletionRoutineEx(
+IoSetCompletionRoutineEx(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN PIRP Irp,
+  IN PIO_COMPLETION_ROUTINE CompletionRoutine,
+  IN PVOID Context,
+  IN BOOLEAN InvokeOnSuccess,
+  IN BOOLEAN InvokeOnError,
+  IN BOOLEAN InvokeOnCancel);
+
+VOID
+NTAPI
+IoSetStartIoAttributes(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN BOOLEAN DeferredStartIo,
+  IN BOOLEAN NonCancelable);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoWMIDeviceObjectToInstanceName(
+  IN PVOID DataBlockObject,
+  IN PDEVICE_OBJECT DeviceObject,
+  OUT PUNICODE_STRING InstanceName);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoWMIExecuteMethod(
+  IN PVOID DataBlockObject,
+  IN PUNICODE_STRING InstanceName,
+  IN ULONG MethodId,
+  IN ULONG InBufferSize,
+  IN OUT PULONG OutBufferSize,
+  IN OUT  PUCHAR InOutBuffer);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoWMIHandleToInstanceName(
+  IN PVOID DataBlockObject,
+  IN HANDLE FileHandle,
+  OUT PUNICODE_STRING InstanceName);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoWMIOpenBlock(
+  IN GUID *DataBlockGuid,
+  IN ULONG DesiredAccess,
+  OUT PVOID *DataBlockObject);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoWMIQueryAllData(
+  IN PVOID DataBlockObject,
+  IN OUT ULONG *InOutBufferSize,
+  OUT PVOID OutBuffer);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoWMIQueryAllDataMultiple(
+  IN PVOID *DataBlockObjectList,
+  IN ULONG ObjectCount,
+  IN OUT ULONG *InOutBufferSize,
+  OUT PVOID OutBuffer);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoWMIQuerySingleInstance(
+  IN PVOID DataBlockObject,
+  IN PUNICODE_STRING InstanceName,
+  IN OUT ULONG *InOutBufferSize,
+  OUT PVOID OutBuffer);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoWMISetNotificationCallback(
+  IN OUT PVOID Object,
+  IN WMI_NOTIFICATION_CALLBACK Callback,
+  IN PVOID Context OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoWMISetSingleInstance(
+  IN PVOID DataBlockObject,
+  IN PUNICODE_STRING InstanceName,
+  IN ULONG Version,
+  IN ULONG ValueBufferSize,
+  IN PVOID ValueBuffer);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoWMISetSingleItem(
+  IN PVOID DataBlockObject,
+  IN PUNICODE_STRING InstanceName,
+  IN ULONG DataItemId,
+  IN ULONG Version,
+  IN ULONG ValueBufferSize,
+  IN PVOID ValueBuffer);
+$endif (_WDMDDK_)
+$if (_NTDDK_)
+NTKERNELAPI
+NTSTATUS
+FASTCALL
+IoReadPartitionTable(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG SectorSize,
+  IN BOOLEAN ReturnRecognizedPartitions,
+  OUT struct _DRIVE_LAYOUT_INFORMATION **PartitionBuffer);
+
+NTKERNELAPI
+NTSTATUS
+FASTCALL
+IoSetPartitionInformation(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG SectorSize,
+  IN ULONG PartitionNumber,
+  IN ULONG PartitionType);
+
+NTKERNELAPI
+NTSTATUS
+FASTCALL
+IoWritePartitionTable(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG SectorSize,
+  IN ULONG SectorsPerTrack,
+  IN ULONG NumberOfHeads,
+  IN struct _DRIVE_LAYOUT_INFORMATION *PartitionBuffer);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoCreateDisk(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN struct _CREATE_DISK* Disk OPTIONAL);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoReadDiskSignature(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG BytesPerSector,
+  OUT PDISK_SIGNATURE Signature);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoReadPartitionTableEx(
+  IN PDEVICE_OBJECT DeviceObject,
+  OUT struct _DRIVE_LAYOUT_INFORMATION_EX **PartitionBuffer);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoSetPartitionInformationEx(
   IN PDEVICE_OBJECT DeviceObject,
-  IN PIRP Irp,
-  IN PIO_COMPLETION_ROUTINE CompletionRoutine,
-  IN PVOID Context,
-  IN BOOLEAN InvokeOnSuccess,
-  IN BOOLEAN InvokeOnError,
-  IN BOOLEAN InvokeOnCancel);
+  IN ULONG PartitionNumber,
+  IN struct _SET_PARTITION_INFORMATION_EX *PartitionInfo);
 
-VOID
+NTKERNELAPI
+NTSTATUS
 NTAPI
-IoSetStartIoAttributes(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN BOOLEAN DeferredStartIo,
-  IN BOOLEAN NonCancelable);
+IoSetSystemPartition(
+  IN PUNICODE_STRING VolumeNameString);
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoWMIDeviceObjectToInstanceName(
-  IN PVOID DataBlockObject,
+IoVerifyPartitionTable(
   IN PDEVICE_OBJECT DeviceObject,
-  OUT PUNICODE_STRING InstanceName);
+  IN BOOLEAN FixErrors);
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoWMIExecuteMethod(
-  IN PVOID DataBlockObject,
-  IN PUNICODE_STRING InstanceName,
-  IN ULONG MethodId,
-  IN ULONG InBufferSize,
-  IN OUT PULONG OutBufferSize,
-  IN OUT  PUCHAR InOutBuffer);
+IoVolumeDeviceToDosName(
+  IN PVOID VolumeDeviceObject,
+  OUT PUNICODE_STRING DosName);
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoWMIHandleToInstanceName(
-  IN PVOID DataBlockObject,
-  IN HANDLE FileHandle,
-  OUT PUNICODE_STRING InstanceName);
+IoWritePartitionTableEx(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN struct _DRIVE_LAYOUT_INFORMATION_EX *DriveLayout);
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoWMIOpenBlock(
-  IN GUID *DataBlockGuid,
-  IN ULONG DesiredAccess,
-  OUT PVOID *DataBlockObject);
+IoCreateFileSpecifyDeviceObjectHint(
+  OUT PHANDLE FileHandle,
+  IN ACCESS_MASK DesiredAccess,
+  IN POBJECT_ATTRIBUTES ObjectAttributes,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  IN PLARGE_INTEGER AllocationSize OPTIONAL,
+  IN ULONG FileAttributes,
+  IN ULONG ShareAccess,
+  IN ULONG Disposition,
+  IN ULONG CreateOptions,
+  IN PVOID EaBuffer OPTIONAL,
+  IN ULONG EaLength,
+  IN CREATE_FILE_TYPE CreateFileType,
+  IN PVOID InternalParameters OPTIONAL,
+  IN ULONG Options,
+  IN PVOID DeviceObject OPTIONAL);
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoWMIQueryAllData(
-  IN PVOID DataBlockObject,
-  IN OUT ULONG *InOutBufferSize,
-  OUT PVOID OutBuffer);
+IoAttachDeviceToDeviceStackSafe(
+  IN PDEVICE_OBJECT SourceDevice,
+  IN PDEVICE_OBJECT TargetDevice,
+  OUT PDEVICE_OBJECT *AttachedToDeviceObject);
+
+$endif (_NTDDK_)
+$if (_NTIFS_)
 
 NTKERNELAPI
-NTSTATUS
+PFILE_OBJECT
 NTAPI
-IoWMIQueryAllDataMultiple(
-  IN PVOID *DataBlockObjectList,
-  IN ULONG ObjectCount,
-  IN OUT ULONG *InOutBufferSize,
-  OUT PVOID OutBuffer);
+IoCreateStreamFileObjectEx(
+  IN PFILE_OBJECT FileObject OPTIONAL,
+  IN PDEVICE_OBJECT DeviceObject OPTIONAL,
+  OUT PHANDLE FileObjectHandle OPTIONAL);
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoWMIQuerySingleInstance(
-  IN PVOID DataBlockObject,
-  IN PUNICODE_STRING InstanceName,
-  IN OUT ULONG *InOutBufferSize,
-  OUT PVOID OutBuffer);
+IoQueryFileDosDeviceName(
+  IN PFILE_OBJECT FileObject,
+  OUT POBJECT_NAME_INFORMATION *ObjectNameInformation);
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoWMISetNotificationCallback(
-  IN OUT PVOID Object,
-  IN WMI_NOTIFICATION_CALLBACK Callback,
-  IN PVOID Context OPTIONAL);
+IoEnumerateDeviceObjectList(
+  IN PDRIVER_OBJECT DriverObject,
+  OUT PDEVICE_OBJECT *DeviceObjectList,
+  IN ULONG DeviceObjectListSize,
+  OUT PULONG ActualNumberDeviceObjects);
 
 NTKERNELAPI
-NTSTATUS
+PDEVICE_OBJECT
 NTAPI
-IoWMISetSingleInstance(
-  IN PVOID DataBlockObject,
-  IN PUNICODE_STRING InstanceName,
-  IN ULONG Version,
-  IN ULONG ValueBufferSize,
-  IN PVOID ValueBuffer);
+IoGetLowerDeviceObject(
+  IN PDEVICE_OBJECT DeviceObject);
+
+NTKERNELAPI
+PDEVICE_OBJECT
+NTAPI
+IoGetDeviceAttachmentBaseRef(
+  IN PDEVICE_OBJECT DeviceObject);
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoWMISetSingleItem(
-  IN PVOID DataBlockObject,
-  IN PUNICODE_STRING InstanceName,
-  IN ULONG DataItemId,
-  IN ULONG Version,
-  IN ULONG ValueBufferSize,
-  IN PVOID ValueBuffer);
-$endif (_WDMDDK_)
+IoGetDiskDeviceObject(
+  IN PDEVICE_OBJECT FileSystemDeviceObject,
+  OUT PDEVICE_OBJECT *DiskDeviceObject);
+$endif (_NTIFS_)
 
 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
@@ -1736,7 +2049,9 @@ IoValidateDeviceIoControlAccess(
 #endif
 
 $endif (_WDMDDK_)
+$if (_WDMDDK_ || _NTDDK_)
 #if (NTDDI_VERSION >= NTDDI_WS03)
+$endif
 $if (_NTDDK_)
 NTKERNELAPI
 IO_PAGING_PRIORITY
@@ -1767,10 +2082,14 @@ IoCsqInsertIrpEx(
   IN PIO_CSQ_IRP_CONTEXT Context OPTIONAL,
   IN PVOID InsertContext OPTIONAL);
 $endif (_WDMDDK_)
+$if (_WDMDDK_ || _NTDDK_)
 #endif /* (NTDDI_VERSION >= NTDDI_WS03) */
+$endif
+$if (_NTDDK_ || _NTIFS_)
+#if (NTDDI_VERSION >= NTDDI_WS03SP1)
+$endif
 
 $if (_NTDDK_)
-#if (NTDDI_VERSION >= NTDDI_WS03SP1)
 BOOLEAN
 NTAPI
 IoTranslateBusAddress(
@@ -1779,67 +2098,22 @@ IoTranslateBusAddress(
   IN PHYSICAL_ADDRESS BusAddress,
   IN OUT PULONG AddressSpace,
   OUT PPHYSICAL_ADDRESS TranslatedAddress);
-#endif
-
 $endif (_NTDDK_)
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-$if (_NTDDK_)
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoUpdateDiskGeometry(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN struct _DISK_GEOMETRY_EX* OldDiskGeometry,
-  IN struct _DISK_GEOMETRY_EX* NewDiskGeometry);
-
-PTXN_PARAMETER_BLOCK
-NTAPI
-IoGetTransactionParameterBlock(
-  IN PFILE_OBJECT FileObject);
+$if (_NTIFS_)
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-IoCreateFileEx(
-  OUT PHANDLE FileHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN POBJECT_ATTRIBUTES ObjectAttributes,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN PLARGE_INTEGER AllocationSize OPTIONAL,
-  IN ULONG FileAttributes,
-  IN ULONG ShareAccess,
-  IN ULONG Disposition,
-  IN ULONG CreateOptions,
-  IN PVOID EaBuffer OPTIONAL,
-  IN ULONG EaLength,
-  IN CREATE_FILE_TYPE CreateFileType,
-  IN PVOID InternalParameters OPTIONAL,
-  IN ULONG Options,
-  IN PIO_DRIVER_CREATE_CONTEXT DriverContext OPTIONAL);
-
-NTSTATUS
-NTAPI
-IoSetIrpExtraCreateParameter(
-  IN OUT PIRP Irp,
-  IN struct _ECP_LIST *ExtraCreateParameter);
-
-VOID
-NTAPI
-IoClearIrpExtraCreateParameter(
-  IN OUT PIRP Irp);
-
-NTSTATUS
-NTAPI
-IoGetIrpExtraCreateParameter(
-  IN PIRP Irp,
-  OUT struct _ECP_LIST **ExtraCreateParameter OPTIONAL);
-
-BOOLEAN
-NTAPI
-IoIsFileObjectIgnoringSharing(
-  IN PFILE_OBJECT FileObject);
+IoEnumerateRegisteredFiltersList(
+  OUT PDRIVER_OBJECT *DriverObjectList,
+  IN ULONG DriverObjectListSize,
+  OUT PULONG ActualNumberDriverObjects);
+$endif (_NTIFS_)
+$if (_NTDDK_ || _NTIFS_)
+#endif /* (NTDDI_VERSION >= NTDDI_WS03SP1) */
+$endif
 
-$endif (_NTDDK_)
+#if (NTDDI_VERSION >= NTDDI_VISTA)
 $if (_WDMDDK_)
 NTKERNELAPI
 NTSTATUS
@@ -1975,6 +2249,77 @@ IoGetDevicePropertyData(
   PDEVPROPTYPE Type);
 
 $endif (_WDMDDK_)
+$if (_NTDDK_)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoUpdateDiskGeometry(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN struct _DISK_GEOMETRY_EX* OldDiskGeometry,
+  IN struct _DISK_GEOMETRY_EX* NewDiskGeometry);
+
+PTXN_PARAMETER_BLOCK
+NTAPI
+IoGetTransactionParameterBlock(
+  IN PFILE_OBJECT FileObject);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoCreateFileEx(
+  OUT PHANDLE FileHandle,
+  IN ACCESS_MASK DesiredAccess,
+  IN POBJECT_ATTRIBUTES ObjectAttributes,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  IN PLARGE_INTEGER AllocationSize OPTIONAL,
+  IN ULONG FileAttributes,
+  IN ULONG ShareAccess,
+  IN ULONG Disposition,
+  IN ULONG CreateOptions,
+  IN PVOID EaBuffer OPTIONAL,
+  IN ULONG EaLength,
+  IN CREATE_FILE_TYPE CreateFileType,
+  IN PVOID InternalParameters OPTIONAL,
+  IN ULONG Options,
+  IN PIO_DRIVER_CREATE_CONTEXT DriverContext OPTIONAL);
+
+NTSTATUS
+NTAPI
+IoSetIrpExtraCreateParameter(
+  IN OUT PIRP Irp,
+  IN struct _ECP_LIST *ExtraCreateParameter);
+
+VOID
+NTAPI
+IoClearIrpExtraCreateParameter(
+  IN OUT PIRP Irp);
+
+NTSTATUS
+NTAPI
+IoGetIrpExtraCreateParameter(
+  IN PIRP Irp,
+  OUT struct _ECP_LIST **ExtraCreateParameter OPTIONAL);
+
+BOOLEAN
+NTAPI
+IoIsFileObjectIgnoringSharing(
+  IN PFILE_OBJECT FileObject);
+
+$endif (_NTDDK_)
+$if (_NTIFS_)
+
+VOID
+FORCEINLINE
+NTAPI
+IoInitializePriorityInfo(
+  IN PIO_PRIORITY_INFO PriorityInfo)
+{
+  PriorityInfo->Size = sizeof(IO_PRIORITY_INFO);
+  PriorityInfo->ThreadPriority = 0xffff;
+  PriorityInfo->IoPriority = IoPriorityNormal;
+  PriorityInfo->PagePriority = 0;
+}
+$endif (_NTIFS_)
 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
 
 $if (_WDMDDK_)
@@ -1992,13 +2337,7 @@ IoReplacePartitionUnit(
 
 $endif (_WDMDDK_)
 #if (NTDDI_VERSION >= NTDDI_WIN7)
-$if (_NTDDK_)
-NTSTATUS
-NTAPI
-IoSetFileObjectIgnoreSharing(
-  IN PFILE_OBJECT FileObject);
 
-$endif (_NTDDK_)
 $if (_WDMDDK_)
 NTKERNELAPI
 NTSTATUS
@@ -2043,6 +2382,31 @@ IoGetDeviceNumaNode(
   OUT PUSHORT NodeNumber);
 
 $endif (_WDMDDK_)
+$if (_NTDDK_)
+NTSTATUS
+NTAPI
+IoSetFileObjectIgnoreSharing(
+  IN PFILE_OBJECT FileObject);
+
+$endif (_NTDDK_)
+$if (_NTIFS_)
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoRegisterFsRegistrationChangeMountAware(
+  IN PDRIVER_OBJECT DriverObject,
+  IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine,
+  IN BOOLEAN SynchronizeWithMounts);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+IoReplaceFileObjectName(
+  IN PFILE_OBJECT FileObject,
+  IN PWSTR NewFileName,
+  IN USHORT FileNameLength);
+$endif (_NTIFS_)
 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
 
 $if (_WDMDDK_)
index 9a0552e..09ff65a 100644 (file)
@@ -4891,3 +4891,1890 @@ typedef enum _BUS_DATA_TYPE {
 } BUS_DATA_TYPE, *PBUS_DATA_TYPE;
 
 $endif (_NTDDK_)
+$if (_NTIFS_)
+
+#define FILE_OPLOCK_BROKEN_TO_LEVEL_2   0x00000007
+#define FILE_OPLOCK_BROKEN_TO_NONE      0x00000008
+#define FILE_OPBATCH_BREAK_UNDERWAY     0x00000009
+
+/* also in winnt.h */
+#define FILE_NOTIFY_CHANGE_FILE_NAME    0x00000001
+#define FILE_NOTIFY_CHANGE_DIR_NAME     0x00000002
+#define FILE_NOTIFY_CHANGE_NAME         0x00000003
+#define FILE_NOTIFY_CHANGE_ATTRIBUTES   0x00000004
+#define FILE_NOTIFY_CHANGE_SIZE         0x00000008
+#define FILE_NOTIFY_CHANGE_LAST_WRITE   0x00000010
+#define FILE_NOTIFY_CHANGE_LAST_ACCESS  0x00000020
+#define FILE_NOTIFY_CHANGE_CREATION     0x00000040
+#define FILE_NOTIFY_CHANGE_EA           0x00000080
+#define FILE_NOTIFY_CHANGE_SECURITY     0x00000100
+#define FILE_NOTIFY_CHANGE_STREAM_NAME  0x00000200
+#define FILE_NOTIFY_CHANGE_STREAM_SIZE  0x00000400
+#define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
+#define FILE_NOTIFY_VALID_MASK          0x00000fff
+
+#define FILE_ACTION_ADDED                   0x00000001
+#define FILE_ACTION_REMOVED                 0x00000002
+#define FILE_ACTION_MODIFIED                0x00000003
+#define FILE_ACTION_RENAMED_OLD_NAME        0x00000004
+#define FILE_ACTION_RENAMED_NEW_NAME        0x00000005
+#define FILE_ACTION_ADDED_STREAM            0x00000006
+#define FILE_ACTION_REMOVED_STREAM          0x00000007
+#define FILE_ACTION_MODIFIED_STREAM         0x00000008
+#define FILE_ACTION_REMOVED_BY_DELETE       0x00000009
+#define FILE_ACTION_ID_NOT_TUNNELLED        0x0000000A
+#define FILE_ACTION_TUNNELLED_ID_COLLISION  0x0000000B
+/* end  winnt.h */
+
+#define FILE_PIPE_BYTE_STREAM_TYPE      0x00000000
+#define FILE_PIPE_MESSAGE_TYPE          0x00000001
+
+#define FILE_PIPE_ACCEPT_REMOTE_CLIENTS     0x00000000
+#define FILE_PIPE_REJECT_REMOTE_CLIENTS     0x00000002
+
+#define FILE_PIPE_ACCEPT_REMOTE_CLIENTS     0x00000000
+#define FILE_PIPE_REJECT_REMOTE_CLIENTS     0x00000002
+#define FILE_PIPE_TYPE_VALID_MASK           0x00000003
+
+#define FILE_PIPE_BYTE_STREAM_MODE      0x00000000
+#define FILE_PIPE_MESSAGE_MODE          0x00000001
+
+#define FILE_PIPE_QUEUE_OPERATION       0x00000000
+#define FILE_PIPE_COMPLETE_OPERATION    0x00000001
+
+#define FILE_PIPE_INBOUND               0x00000000
+#define FILE_PIPE_OUTBOUND              0x00000001
+#define FILE_PIPE_FULL_DUPLEX           0x00000002
+
+#define FILE_PIPE_DISCONNECTED_STATE    0x00000001
+#define FILE_PIPE_LISTENING_STATE       0x00000002
+#define FILE_PIPE_CONNECTED_STATE       0x00000003
+#define FILE_PIPE_CLOSING_STATE         0x00000004
+
+#define FILE_PIPE_CLIENT_END            0x00000000
+#define FILE_PIPE_SERVER_END            0x00000001
+
+#define FILE_CASE_SENSITIVE_SEARCH        0x00000001
+#define FILE_CASE_PRESERVED_NAMES         0x00000002
+#define FILE_UNICODE_ON_DISK              0x00000004
+#define FILE_PERSISTENT_ACLS              0x00000008
+#define FILE_FILE_COMPRESSION             0x00000010
+#define FILE_VOLUME_QUOTAS                0x00000020
+#define FILE_SUPPORTS_SPARSE_FILES        0x00000040
+#define FILE_SUPPORTS_REPARSE_POINTS      0x00000080
+#define FILE_SUPPORTS_REMOTE_STORAGE      0x00000100
+#define FILE_VOLUME_IS_COMPRESSED         0x00008000
+#define FILE_SUPPORTS_OBJECT_IDS          0x00010000
+#define FILE_SUPPORTS_ENCRYPTION          0x00020000
+#define FILE_NAMED_STREAMS                0x00040000
+#define FILE_READ_ONLY_VOLUME             0x00080000
+#define FILE_SEQUENTIAL_WRITE_ONCE        0x00100000
+#define FILE_SUPPORTS_TRANSACTIONS        0x00200000
+#define FILE_SUPPORTS_HARD_LINKS          0x00400000
+#define FILE_SUPPORTS_EXTENDED_ATTRIBUTES 0x00800000
+#define FILE_SUPPORTS_OPEN_BY_FILE_ID     0x01000000
+#define FILE_SUPPORTS_USN_JOURNAL         0x02000000
+
+#define FILE_NEED_EA                    0x00000080
+
+#define FILE_EA_TYPE_BINARY             0xfffe
+#define FILE_EA_TYPE_ASCII              0xfffd
+#define FILE_EA_TYPE_BITMAP             0xfffb
+#define FILE_EA_TYPE_METAFILE           0xfffa
+#define FILE_EA_TYPE_ICON               0xfff9
+#define FILE_EA_TYPE_EA                 0xffee
+#define FILE_EA_TYPE_MVMT               0xffdf
+#define FILE_EA_TYPE_MVST               0xffde
+#define FILE_EA_TYPE_ASN1               0xffdd
+#define FILE_EA_TYPE_FAMILY_IDS         0xff01
+
+typedef struct _FILE_NOTIFY_INFORMATION {
+  ULONG NextEntryOffset;
+  ULONG Action;
+  ULONG FileNameLength;
+  WCHAR FileName[1];
+} FILE_NOTIFY_INFORMATION, *PFILE_NOTIFY_INFORMATION;
+
+typedef struct _FILE_DIRECTORY_INFORMATION {
+  ULONG NextEntryOffset;
+  ULONG FileIndex;
+  LARGE_INTEGER CreationTime;
+  LARGE_INTEGER LastAccessTime;
+  LARGE_INTEGER LastWriteTime;
+  LARGE_INTEGER ChangeTime;
+  LARGE_INTEGER EndOfFile;
+  LARGE_INTEGER AllocationSize;
+  ULONG FileAttributes;
+  ULONG FileNameLength;
+  WCHAR FileName[1];
+} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
+
+typedef struct _FILE_FULL_DIR_INFORMATION {
+  ULONG NextEntryOffset;
+  ULONG FileIndex;
+  LARGE_INTEGER CreationTime;
+  LARGE_INTEGER LastAccessTime;
+  LARGE_INTEGER LastWriteTime;
+  LARGE_INTEGER ChangeTime;
+  LARGE_INTEGER EndOfFile;
+  LARGE_INTEGER AllocationSize;
+  ULONG FileAttributes;
+  ULONG FileNameLength;
+  ULONG EaSize;
+  WCHAR FileName[1];
+} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
+
+typedef struct _FILE_ID_FULL_DIR_INFORMATION {
+  ULONG NextEntryOffset;
+  ULONG FileIndex;
+  LARGE_INTEGER CreationTime;
+  LARGE_INTEGER LastAccessTime;
+  LARGE_INTEGER LastWriteTime;
+  LARGE_INTEGER ChangeTime;
+  LARGE_INTEGER EndOfFile;
+  LARGE_INTEGER AllocationSize;
+  ULONG FileAttributes;
+  ULONG FileNameLength;
+  ULONG EaSize;
+  LARGE_INTEGER FileId;
+  WCHAR FileName[1];
+} FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION;
+
+typedef struct _FILE_BOTH_DIR_INFORMATION {
+  ULONG NextEntryOffset;
+  ULONG FileIndex;
+  LARGE_INTEGER CreationTime;
+  LARGE_INTEGER LastAccessTime;
+  LARGE_INTEGER LastWriteTime;
+  LARGE_INTEGER ChangeTime;
+  LARGE_INTEGER EndOfFile;
+  LARGE_INTEGER AllocationSize;
+  ULONG FileAttributes;
+  ULONG FileNameLength;
+  ULONG EaSize;
+  CCHAR ShortNameLength;
+  WCHAR ShortName[12];
+  WCHAR FileName[1];
+} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
+
+typedef struct _FILE_ID_BOTH_DIR_INFORMATION {
+  ULONG NextEntryOffset;
+  ULONG FileIndex;
+  LARGE_INTEGER CreationTime;
+  LARGE_INTEGER LastAccessTime;
+  LARGE_INTEGER LastWriteTime;
+  LARGE_INTEGER ChangeTime;
+  LARGE_INTEGER EndOfFile;
+  LARGE_INTEGER AllocationSize;
+  ULONG FileAttributes;
+  ULONG FileNameLength;
+  ULONG EaSize;
+  CCHAR ShortNameLength;
+  WCHAR ShortName[12];
+  LARGE_INTEGER FileId;
+  WCHAR FileName[1];
+} FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;
+
+typedef struct _FILE_NAMES_INFORMATION {
+  ULONG NextEntryOffset;
+  ULONG FileIndex;
+  ULONG FileNameLength;
+  WCHAR FileName[1];
+} FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
+
+typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION {
+  ULONG NextEntryOffset;
+  ULONG FileIndex;
+  LARGE_INTEGER CreationTime;
+  LARGE_INTEGER LastAccessTime;
+  LARGE_INTEGER LastWriteTime;
+  LARGE_INTEGER ChangeTime;
+  LARGE_INTEGER EndOfFile;
+  LARGE_INTEGER AllocationSize;
+  ULONG FileAttributes;
+  ULONG FileNameLength;
+  LARGE_INTEGER FileId;
+  GUID LockingTransactionId;
+  ULONG TxInfoFlags;
+  WCHAR FileName[1];
+} FILE_ID_GLOBAL_TX_DIR_INFORMATION, *PFILE_ID_GLOBAL_TX_DIR_INFORMATION;
+
+#define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_WRITELOCKED         0x00000001
+#define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_TO_TX       0x00000002
+#define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_OUTSIDE_TX  0x00000004
+
+typedef struct _FILE_OBJECTID_INFORMATION {
+  LONGLONG FileReference;
+  UCHAR ObjectId[16];
+  _ANONYMOUS_UNION union {
+    __GNU_EXTENSION struct {
+      UCHAR BirthVolumeId[16];
+      UCHAR BirthObjectId[16];
+      UCHAR DomainId[16];
+    };
+    UCHAR ExtendedInfo[48];
+  } DUMMYUNIONNAME;
+} FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION;
+
+#define ANSI_DOS_STAR                   ('<')
+#define ANSI_DOS_QM                     ('>')
+#define ANSI_DOS_DOT                    ('"')
+
+#define DOS_STAR                        (L'<')
+#define DOS_QM                          (L'>')
+#define DOS_DOT                         (L'"')
+
+typedef struct _FILE_INTERNAL_INFORMATION {
+  LARGE_INTEGER IndexNumber;
+} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
+
+typedef struct _FILE_EA_INFORMATION {
+  ULONG EaSize;
+} FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
+
+typedef struct _FILE_ACCESS_INFORMATION {
+  ACCESS_MASK AccessFlags;
+} FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
+
+typedef struct _FILE_MODE_INFORMATION {
+  ULONG Mode;
+} FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
+
+typedef struct _FILE_ALL_INFORMATION {
+  FILE_BASIC_INFORMATION BasicInformation;
+  FILE_STANDARD_INFORMATION StandardInformation;
+  FILE_INTERNAL_INFORMATION InternalInformation;
+  FILE_EA_INFORMATION EaInformation;
+  FILE_ACCESS_INFORMATION AccessInformation;
+  FILE_POSITION_INFORMATION PositionInformation;
+  FILE_MODE_INFORMATION ModeInformation;
+  FILE_ALIGNMENT_INFORMATION AlignmentInformation;
+  FILE_NAME_INFORMATION NameInformation;
+} FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
+
+typedef struct _FILE_ALLOCATION_INFORMATION {
+  LARGE_INTEGER AllocationSize;
+} FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;
+
+typedef struct _FILE_COMPRESSION_INFORMATION {
+  LARGE_INTEGER CompressedFileSize;
+  USHORT CompressionFormat;
+  UCHAR CompressionUnitShift;
+  UCHAR ChunkShift;
+  UCHAR ClusterShift;
+  UCHAR Reserved[3];
+} FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
+
+typedef struct _FILE_LINK_INFORMATION {
+  BOOLEAN ReplaceIfExists;
+  HANDLE RootDirectory;
+  ULONG FileNameLength;
+  WCHAR FileName[1];
+} FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
+
+typedef struct _FILE_MOVE_CLUSTER_INFORMATION {
+  ULONG ClusterCount;
+  HANDLE RootDirectory;
+  ULONG FileNameLength;
+  WCHAR FileName[1];
+} FILE_MOVE_CLUSTER_INFORMATION, *PFILE_MOVE_CLUSTER_INFORMATION;
+
+typedef struct _FILE_RENAME_INFORMATION {
+  BOOLEAN ReplaceIfExists;
+  HANDLE RootDirectory;
+  ULONG FileNameLength;
+  WCHAR FileName[1];
+} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
+
+typedef struct _FILE_STREAM_INFORMATION {
+  ULONG NextEntryOffset;
+  ULONG StreamNameLength;
+  LARGE_INTEGER StreamSize;
+  LARGE_INTEGER StreamAllocationSize;
+  WCHAR StreamName[1];
+} FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;
+
+typedef struct _FILE_TRACKING_INFORMATION {
+  HANDLE DestinationFile;
+  ULONG ObjectInformationLength;
+  CHAR ObjectInformation[1];
+} FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION;
+
+typedef struct _FILE_COMPLETION_INFORMATION {
+  HANDLE Port;
+  PVOID Key;
+} FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;
+
+typedef struct _FILE_PIPE_INFORMATION {
+  ULONG ReadMode;
+  ULONG CompletionMode;
+} FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;
+
+typedef struct _FILE_PIPE_LOCAL_INFORMATION {
+  ULONG NamedPipeType;
+  ULONG NamedPipeConfiguration;
+  ULONG MaximumInstances;
+  ULONG CurrentInstances;
+  ULONG InboundQuota;
+  ULONG ReadDataAvailable;
+  ULONG OutboundQuota;
+  ULONG WriteQuotaAvailable;
+  ULONG NamedPipeState;
+  ULONG NamedPipeEnd;
+} FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
+
+typedef struct _FILE_PIPE_REMOTE_INFORMATION {
+  LARGE_INTEGER CollectDataTime;
+  ULONG MaximumCollectionCount;
+} FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION;
+
+typedef struct _FILE_MAILSLOT_QUERY_INFORMATION {
+  ULONG MaximumMessageSize;
+  ULONG MailslotQuota;
+  ULONG NextMessageSize;
+  ULONG MessagesAvailable;
+  LARGE_INTEGER ReadTimeout;
+} FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION;
+
+typedef struct _FILE_MAILSLOT_SET_INFORMATION {
+  PLARGE_INTEGER ReadTimeout;
+} FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
+
+typedef struct _FILE_REPARSE_POINT_INFORMATION {
+  LONGLONG FileReference;
+  ULONG Tag;
+} FILE_REPARSE_POINT_INFORMATION, *PFILE_REPARSE_POINT_INFORMATION;
+
+typedef struct _FILE_LINK_ENTRY_INFORMATION {
+  ULONG NextEntryOffset;
+  LONGLONG ParentFileId;
+  ULONG FileNameLength;
+  WCHAR FileName[1];
+} FILE_LINK_ENTRY_INFORMATION, *PFILE_LINK_ENTRY_INFORMATION;
+
+typedef struct _FILE_LINKS_INFORMATION {
+  ULONG BytesNeeded;
+  ULONG EntriesReturned;
+  FILE_LINK_ENTRY_INFORMATION Entry;
+} FILE_LINKS_INFORMATION, *PFILE_LINKS_INFORMATION;
+
+typedef struct _FILE_NETWORK_PHYSICAL_NAME_INFORMATION {
+  ULONG FileNameLength;
+  WCHAR FileName[1];
+} FILE_NETWORK_PHYSICAL_NAME_INFORMATION, *PFILE_NETWORK_PHYSICAL_NAME_INFORMATION;
+
+typedef struct _FILE_STANDARD_LINK_INFORMATION {
+  ULONG NumberOfAccessibleLinks;
+  ULONG TotalNumberOfLinks;
+  BOOLEAN DeletePending;
+  BOOLEAN Directory;
+} FILE_STANDARD_LINK_INFORMATION, *PFILE_STANDARD_LINK_INFORMATION;
+
+typedef struct _FILE_GET_EA_INFORMATION {
+  ULONG NextEntryOffset;
+  UCHAR EaNameLength;
+  CHAR  EaName[1];
+} FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
+
+#define REMOTE_PROTOCOL_FLAG_LOOPBACK       0x00000001
+#define REMOTE_PROTOCOL_FLAG_OFFLINE        0x00000002
+
+typedef struct _FILE_REMOTE_PROTOCOL_INFORMATION {
+  USHORT StructureVersion;
+  USHORT StructureSize;
+  ULONG  Protocol;
+  USHORT ProtocolMajorVersion;
+  USHORT ProtocolMinorVersion;
+  USHORT ProtocolRevision;
+  USHORT Reserved;
+  ULONG  Flags;
+  struct {
+    ULONG Reserved[8];
+  } GenericReserved;
+  struct {
+    ULONG Reserved[16];
+  } ProtocolSpecificReserved;
+} FILE_REMOTE_PROTOCOL_INFORMATION, *PFILE_REMOTE_PROTOCOL_INFORMATION;
+
+typedef struct _FILE_GET_QUOTA_INFORMATION {
+  ULONG NextEntryOffset;
+  ULONG SidLength;
+  SID Sid;
+} FILE_GET_QUOTA_INFORMATION, *PFILE_GET_QUOTA_INFORMATION;
+
+typedef struct _FILE_QUOTA_INFORMATION {
+  ULONG NextEntryOffset;
+  ULONG SidLength;
+  LARGE_INTEGER ChangeTime;
+  LARGE_INTEGER QuotaUsed;
+  LARGE_INTEGER QuotaThreshold;
+  LARGE_INTEGER QuotaLimit;
+  SID Sid;
+} FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION;
+
+typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {
+  ULONG FileSystemAttributes;
+  ULONG MaximumComponentNameLength;
+  ULONG FileSystemNameLength;
+  WCHAR FileSystemName[1];
+} FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
+
+typedef struct _FILE_FS_DRIVER_PATH_INFORMATION {
+  BOOLEAN DriverInPath;
+  ULONG DriverNameLength;
+  WCHAR DriverName[1];
+} FILE_FS_DRIVER_PATH_INFORMATION, *PFILE_FS_DRIVER_PATH_INFORMATION;
+
+typedef struct _FILE_FS_VOLUME_FLAGS_INFORMATION {
+  ULONG Flags;
+} FILE_FS_VOLUME_FLAGS_INFORMATION, *PFILE_FS_VOLUME_FLAGS_INFORMATION;
+
+#define FILE_VC_QUOTA_NONE              0x00000000
+#define FILE_VC_QUOTA_TRACK             0x00000001
+#define FILE_VC_QUOTA_ENFORCE           0x00000002
+#define FILE_VC_QUOTA_MASK              0x00000003
+#define FILE_VC_CONTENT_INDEX_DISABLED  0x00000008
+#define FILE_VC_LOG_QUOTA_THRESHOLD     0x00000010
+#define FILE_VC_LOG_QUOTA_LIMIT         0x00000020
+#define FILE_VC_LOG_VOLUME_THRESHOLD    0x00000040
+#define FILE_VC_LOG_VOLUME_LIMIT        0x00000080
+#define FILE_VC_QUOTAS_INCOMPLETE       0x00000100
+#define FILE_VC_QUOTAS_REBUILDING       0x00000200
+#define FILE_VC_VALID_MASK              0x000003ff
+
+typedef struct _FILE_FS_CONTROL_INFORMATION {
+  LARGE_INTEGER FreeSpaceStartFiltering;
+  LARGE_INTEGER FreeSpaceThreshold;
+  LARGE_INTEGER FreeSpaceStopFiltering;
+  LARGE_INTEGER DefaultQuotaThreshold;
+  LARGE_INTEGER DefaultQuotaLimit;
+  ULONG FileSystemControlFlags;
+} FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;
+
+#ifndef _FILESYSTEMFSCTL_
+#define _FILESYSTEMFSCTL_
+
+#define FSCTL_REQUEST_OPLOCK_LEVEL_1    CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  0, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_REQUEST_OPLOCK_LEVEL_2    CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  1, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_REQUEST_BATCH_OPLOCK      CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  2, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE  CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  3, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  4, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_OPLOCK_BREAK_NOTIFY       CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  5, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_LOCK_VOLUME               CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  6, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_UNLOCK_VOLUME             CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  7, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_DISMOUNT_VOLUME           CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  8, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_IS_VOLUME_MOUNTED         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_IS_PATHNAME_VALID         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_MARK_VOLUME_DIRTY         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_QUERY_RETRIEVAL_POINTERS  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER,  FILE_ANY_ACCESS)
+#define FSCTL_GET_COMPRESSION           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SET_COMPRESSION           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
+#define FSCTL_SET_BOOTLOADER_ACCESSED   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER,  FILE_ANY_ACCESS)
+
+#define FSCTL_OPLOCK_BREAK_ACK_NO_2     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_INVALIDATE_VOLUMES        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_QUERY_FAT_BPB             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_REQUEST_FILTER_OPLOCK     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#if (_WIN32_WINNT >= 0x0400)
+
+#define FSCTL_GET_NTFS_VOLUME_DATA      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_GET_NTFS_FILE_RECORD      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_GET_VOLUME_BITMAP         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER,  FILE_ANY_ACCESS)
+#define FSCTL_GET_RETRIEVAL_POINTERS    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER,  FILE_ANY_ACCESS)
+#define FSCTL_MOVE_FILE                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_IS_VOLUME_DIRTY           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_ALLOW_EXTENDED_DASD_IO    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER,  FILE_ANY_ACCESS)
+
+#endif
+
+#if (_WIN32_WINNT >= 0x0500)
+
+#define FSCTL_FIND_FILES_BY_SID         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER,  FILE_ANY_ACCESS)
+#define FSCTL_SET_OBJECT_ID             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_GET_OBJECT_ID             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_DELETE_OBJECT_ID          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_SET_REPARSE_POINT         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_GET_REPARSE_POINT         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_DELETE_REPARSE_POINT      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_ENUM_USN_DATA             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER,  FILE_READ_DATA)
+#define FSCTL_SECURITY_ID_CHECK         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45, METHOD_NEITHER,  FILE_READ_DATA)
+#define FSCTL_READ_USN_JOURNAL          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46, METHOD_NEITHER,  FILE_READ_DATA)
+#define FSCTL_SET_OBJECT_ID_EXTENDED    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_CREATE_OR_GET_OBJECT_ID   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SET_SPARSE                CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_SET_ZERO_DATA             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_QUERY_ALLOCATED_RANGES    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51, METHOD_NEITHER,  FILE_READ_DATA)
+#define FSCTL_ENABLE_UPGRADE            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_SET_ENCRYPTION            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_ENCRYPTION_FSCTL_IO       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54, METHOD_NEITHER,  FILE_ANY_ACCESS)
+#define FSCTL_WRITE_RAW_ENCRYPTED       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55, METHOD_NEITHER,  FILE_ANY_ACCESS)
+#define FSCTL_READ_RAW_ENCRYPTED        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56, METHOD_NEITHER,  FILE_ANY_ACCESS)
+#define FSCTL_CREATE_USN_JOURNAL        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57, METHOD_NEITHER,  FILE_READ_DATA)
+#define FSCTL_READ_FILE_USN_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58, METHOD_NEITHER,  FILE_READ_DATA)
+#define FSCTL_WRITE_USN_CLOSE_RECORD    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59, METHOD_NEITHER,  FILE_READ_DATA)
+#define FSCTL_EXTEND_VOLUME             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_QUERY_USN_JOURNAL         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_DELETE_USN_JOURNAL        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_MARK_HANDLE               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SIS_COPYFILE              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SIS_LINK_FILES            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
+#define FSCTL_RECALL_FILE               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_READ_FROM_PLEX            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA)
+#define FSCTL_FILE_PREFETCH             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+
+#endif
+
+#if (_WIN32_WINNT >= 0x0600)
+
+#define FSCTL_MAKE_MEDIA_COMPATIBLE         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 76, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_SET_DEFECT_MANAGEMENT         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 77, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_QUERY_SPARING_INFO            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 78, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_QUERY_ON_DISK_VOLUME_INFO     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 79, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SET_VOLUME_COMPRESSION_STATE  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 80, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+#define FSCTL_TXFS_MODIFY_RM                CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 81, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_TXFS_QUERY_RM_INFORMATION     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 82, METHOD_BUFFERED, FILE_READ_DATA)
+#define FSCTL_TXFS_ROLLFORWARD_REDO         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 84, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_TXFS_ROLLFORWARD_UNDO         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 85, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_TXFS_START_RM                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 86, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_TXFS_SHUTDOWN_RM              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 87, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_TXFS_READ_BACKUP_INFORMATION  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 88, METHOD_BUFFERED, FILE_READ_DATA)
+#define FSCTL_TXFS_WRITE_BACKUP_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 89, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_TXFS_CREATE_SECONDARY_RM      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 90, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_TXFS_GET_METADATA_INFO        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 91, METHOD_BUFFERED, FILE_READ_DATA)
+#define FSCTL_TXFS_GET_TRANSACTED_VERSION   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 92, METHOD_BUFFERED, FILE_READ_DATA)
+#define FSCTL_TXFS_SAVEPOINT_INFORMATION    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 94, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_TXFS_CREATE_MINIVERSION       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 95, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_TXFS_TRANSACTION_ACTIVE       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 99, METHOD_BUFFERED, FILE_READ_DATA)
+#define FSCTL_SET_ZERO_ON_DEALLOCATION      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 101, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+#define FSCTL_SET_REPAIR                    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 102, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_GET_REPAIR                    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 103, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_WAIT_FOR_REPAIR               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 104, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_INITIATE_REPAIR               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 106, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CSC_INTERNAL                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 107, METHOD_NEITHER,  FILE_ANY_ACCESS)
+#define FSCTL_SHRINK_VOLUME                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 108, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
+#define FSCTL_SET_SHORT_NAME_BEHAVIOR       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 109, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_DFSR_SET_GHOST_HANDLE_STATE   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 110, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_TXFS_LIST_TRANSACTION_LOCKED_FILES \
+                                            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_READ_DATA)
+#define FSCTL_TXFS_LIST_TRANSACTIONS        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 121, METHOD_BUFFERED, FILE_READ_DATA)
+#define FSCTL_QUERY_PAGEFILE_ENCRYPTION     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 122, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_RESET_VOLUME_ALLOCATION_HINTS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 123, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_TXFS_READ_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 126, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#endif
+
+#if (_WIN32_WINNT >= 0x0601)
+
+#define FSCTL_QUERY_DEPENDENT_VOLUME        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 124, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SD_GLOBAL_CHANGE              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 125, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_LOOKUP_STREAM_FROM_CLUSTER    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 127, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_TXFS_WRITE_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 128, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_FILE_TYPE_NOTIFICATION        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 129, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_GET_BOOT_AREA_INFO            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 140, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_GET_RETRIEVAL_POINTER_BASE    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 141, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_SET_PERSISTENT_VOLUME_STATE   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 142, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_QUERY_PERSISTENT_VOLUME_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 143, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_REQUEST_OPLOCK                CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 144, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_CSV_TUNNEL_REQUEST            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 145, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_IS_CSV_FILE                   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 146, METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+#define FSCTL_QUERY_FILE_SYSTEM_RECOGNITION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 147, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CSV_GET_VOLUME_PATH_NAME      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 148, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CSV_GET_VOLUME_NAME_FOR_VOLUME_MOUNT_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 149, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_CSV_GET_VOLUME_PATH_NAMES_FOR_VOLUME_NAME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 150,  METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_IS_FILE_ON_CSV_VOLUME         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 151,  METHOD_BUFFERED, FILE_ANY_ACCESS)
+
+typedef struct _CSV_NAMESPACE_INFO {
+  ULONG Version;
+  ULONG DeviceNumber;
+  LARGE_INTEGER StartingOffset;
+  ULONG SectorSize;
+} CSV_NAMESPACE_INFO, *PCSV_NAMESPACE_INFO;
+
+#define CSV_NAMESPACE_INFO_V1 (sizeof(CSV_NAMESPACE_INFO))
+#define CSV_INVALID_DEVICE_NUMBER 0xFFFFFFFF
+
+#endif
+
+#define FSCTL_MARK_AS_SYSTEM_HIVE           FSCTL_SET_BOOTLOADER_ACCESSED
+
+typedef struct _PATHNAME_BUFFER {
+  ULONG PathNameLength;
+  WCHAR Name[1];
+} PATHNAME_BUFFER, *PPATHNAME_BUFFER;
+
+typedef struct _FSCTL_QUERY_FAT_BPB_BUFFER {
+  UCHAR First0x24BytesOfBootSector[0x24];
+} FSCTL_QUERY_FAT_BPB_BUFFER, *PFSCTL_QUERY_FAT_BPB_BUFFER;
+
+#if (_WIN32_WINNT >= 0x0400)
+
+typedef struct _NTFS_VOLUME_DATA_BUFFER {
+  LARGE_INTEGER VolumeSerialNumber;
+  LARGE_INTEGER NumberSectors;
+  LARGE_INTEGER TotalClusters;
+  LARGE_INTEGER FreeClusters;
+  LARGE_INTEGER TotalReserved;
+  ULONG BytesPerSector;
+  ULONG BytesPerCluster;
+  ULONG BytesPerFileRecordSegment;
+  ULONG ClustersPerFileRecordSegment;
+  LARGE_INTEGER MftValidDataLength;
+  LARGE_INTEGER MftStartLcn;
+  LARGE_INTEGER Mft2StartLcn;
+  LARGE_INTEGER MftZoneStart;
+  LARGE_INTEGER MftZoneEnd;
+} NTFS_VOLUME_DATA_BUFFER, *PNTFS_VOLUME_DATA_BUFFER;
+
+typedef struct _NTFS_EXTENDED_VOLUME_DATA {
+  ULONG ByteCount;
+  USHORT MajorVersion;
+  USHORT MinorVersion;
+} NTFS_EXTENDED_VOLUME_DATA, *PNTFS_EXTENDED_VOLUME_DATA;
+
+typedef struct _STARTING_LCN_INPUT_BUFFER {
+  LARGE_INTEGER StartingLcn;
+} STARTING_LCN_INPUT_BUFFER, *PSTARTING_LCN_INPUT_BUFFER;
+
+typedef struct _VOLUME_BITMAP_BUFFER {
+  LARGE_INTEGER StartingLcn;
+  LARGE_INTEGER BitmapSize;
+  UCHAR Buffer[1];
+} VOLUME_BITMAP_BUFFER, *PVOLUME_BITMAP_BUFFER;
+
+typedef struct _STARTING_VCN_INPUT_BUFFER {
+  LARGE_INTEGER StartingVcn;
+} STARTING_VCN_INPUT_BUFFER, *PSTARTING_VCN_INPUT_BUFFER;
+
+typedef struct _RETRIEVAL_POINTERS_BUFFER {
+  ULONG ExtentCount;
+  LARGE_INTEGER StartingVcn;
+  struct {
+    LARGE_INTEGER NextVcn;
+    LARGE_INTEGER Lcn;
+  } Extents[1];
+} RETRIEVAL_POINTERS_BUFFER, *PRETRIEVAL_POINTERS_BUFFER;
+
+typedef struct _NTFS_FILE_RECORD_INPUT_BUFFER {
+  LARGE_INTEGER FileReferenceNumber;
+} NTFS_FILE_RECORD_INPUT_BUFFER, *PNTFS_FILE_RECORD_INPUT_BUFFER;
+
+typedef struct _NTFS_FILE_RECORD_OUTPUT_BUFFER {
+  LARGE_INTEGER FileReferenceNumber;
+  ULONG FileRecordLength;
+  UCHAR FileRecordBuffer[1];
+} NTFS_FILE_RECORD_OUTPUT_BUFFER, *PNTFS_FILE_RECORD_OUTPUT_BUFFER;
+
+typedef struct _MOVE_FILE_DATA {
+  HANDLE FileHandle;
+  LARGE_INTEGER StartingVcn;
+  LARGE_INTEGER StartingLcn;
+  ULONG ClusterCount;
+} MOVE_FILE_DATA, *PMOVE_FILE_DATA;
+
+typedef struct _MOVE_FILE_RECORD_DATA {
+  HANDLE FileHandle;
+  LARGE_INTEGER SourceFileRecord;
+  LARGE_INTEGER TargetFileRecord;
+} MOVE_FILE_RECORD_DATA, *PMOVE_FILE_RECORD_DATA;
+
+#if defined(_WIN64)
+typedef struct _MOVE_FILE_DATA32 {
+  UINT32 FileHandle;
+  LARGE_INTEGER StartingVcn;
+  LARGE_INTEGER StartingLcn;
+  ULONG ClusterCount;
+} MOVE_FILE_DATA32, *PMOVE_FILE_DATA32;
+#endif
+
+#endif /* (_WIN32_WINNT >= 0x0400) */
+
+#if (_WIN32_WINNT >= 0x0500)
+
+typedef struct _FIND_BY_SID_DATA {
+  ULONG Restart;
+  SID Sid;
+} FIND_BY_SID_DATA, *PFIND_BY_SID_DATA;
+
+typedef struct _FIND_BY_SID_OUTPUT {
+  ULONG NextEntryOffset;
+  ULONG FileIndex;
+  ULONG FileNameLength;
+  WCHAR FileName[1];
+} FIND_BY_SID_OUTPUT, *PFIND_BY_SID_OUTPUT;
+
+typedef struct _MFT_ENUM_DATA {
+  ULONGLONG StartFileReferenceNumber;
+  USN LowUsn;
+  USN HighUsn;
+} MFT_ENUM_DATA, *PMFT_ENUM_DATA;
+
+typedef struct _CREATE_USN_JOURNAL_DATA {
+  ULONGLONG MaximumSize;
+  ULONGLONG AllocationDelta;
+} CREATE_USN_JOURNAL_DATA, *PCREATE_USN_JOURNAL_DATA;
+
+typedef struct _READ_USN_JOURNAL_DATA {
+  USN StartUsn;
+  ULONG ReasonMask;
+  ULONG ReturnOnlyOnClose;
+  ULONGLONG Timeout;
+  ULONGLONG BytesToWaitFor;
+  ULONGLONG UsnJournalID;
+} READ_USN_JOURNAL_DATA, *PREAD_USN_JOURNAL_DATA;
+
+typedef struct _USN_RECORD {
+  ULONG RecordLength;
+  USHORT MajorVersion;
+  USHORT MinorVersion;
+  ULONGLONG FileReferenceNumber;
+  ULONGLONG ParentFileReferenceNumber;
+  USN Usn;
+  LARGE_INTEGER TimeStamp;
+  ULONG Reason;
+  ULONG SourceInfo;
+  ULONG SecurityId;
+  ULONG FileAttributes;
+  USHORT FileNameLength;
+  USHORT FileNameOffset;
+  WCHAR FileName[1];
+} USN_RECORD, *PUSN_RECORD;
+
+#define USN_PAGE_SIZE                    (0x1000)
+
+#define USN_REASON_DATA_OVERWRITE        (0x00000001)
+#define USN_REASON_DATA_EXTEND           (0x00000002)
+#define USN_REASON_DATA_TRUNCATION       (0x00000004)
+#define USN_REASON_NAMED_DATA_OVERWRITE  (0x00000010)
+#define USN_REASON_NAMED_DATA_EXTEND     (0x00000020)
+#define USN_REASON_NAMED_DATA_TRUNCATION (0x00000040)
+#define USN_REASON_FILE_CREATE           (0x00000100)
+#define USN_REASON_FILE_DELETE           (0x00000200)
+#define USN_REASON_EA_CHANGE             (0x00000400)
+#define USN_REASON_SECURITY_CHANGE       (0x00000800)
+#define USN_REASON_RENAME_OLD_NAME       (0x00001000)
+#define USN_REASON_RENAME_NEW_NAME       (0x00002000)
+#define USN_REASON_INDEXABLE_CHANGE      (0x00004000)
+#define USN_REASON_BASIC_INFO_CHANGE     (0x00008000)
+#define USN_REASON_HARD_LINK_CHANGE      (0x00010000)
+#define USN_REASON_COMPRESSION_CHANGE    (0x00020000)
+#define USN_REASON_ENCRYPTION_CHANGE     (0x00040000)
+#define USN_REASON_OBJECT_ID_CHANGE      (0x00080000)
+#define USN_REASON_REPARSE_POINT_CHANGE  (0x00100000)
+#define USN_REASON_STREAM_CHANGE         (0x00200000)
+#define USN_REASON_TRANSACTED_CHANGE     (0x00400000)
+#define USN_REASON_CLOSE                 (0x80000000)
+
+typedef struct _USN_JOURNAL_DATA {
+  ULONGLONG UsnJournalID;
+  USN FirstUsn;
+  USN NextUsn;
+  USN LowestValidUsn;
+  USN MaxUsn;
+  ULONGLONG MaximumSize;
+  ULONGLONG AllocationDelta;
+} USN_JOURNAL_DATA, *PUSN_JOURNAL_DATA;
+
+typedef struct _DELETE_USN_JOURNAL_DATA {
+  ULONGLONG UsnJournalID;
+  ULONG DeleteFlags;
+} DELETE_USN_JOURNAL_DATA, *PDELETE_USN_JOURNAL_DATA;
+
+#define USN_DELETE_FLAG_DELETE              (0x00000001)
+#define USN_DELETE_FLAG_NOTIFY              (0x00000002)
+#define USN_DELETE_VALID_FLAGS              (0x00000003)
+
+typedef struct _MARK_HANDLE_INFO {
+  ULONG UsnSourceInfo;
+  HANDLE VolumeHandle;
+  ULONG HandleInfo;
+} MARK_HANDLE_INFO, *PMARK_HANDLE_INFO;
+
+#if defined(_WIN64)
+typedef struct _MARK_HANDLE_INFO32 {
+  ULONG UsnSourceInfo;
+  UINT32 VolumeHandle;
+  ULONG HandleInfo;
+} MARK_HANDLE_INFO32, *PMARK_HANDLE_INFO32;
+#endif
+
+#define USN_SOURCE_DATA_MANAGEMENT          (0x00000001)
+#define USN_SOURCE_AUXILIARY_DATA           (0x00000002)
+#define USN_SOURCE_REPLICATION_MANAGEMENT   (0x00000004)
+
+#define MARK_HANDLE_PROTECT_CLUSTERS        (0x00000001)
+#define MARK_HANDLE_TXF_SYSTEM_LOG          (0x00000004)
+#define MARK_HANDLE_NOT_TXF_SYSTEM_LOG      (0x00000008)
+
+typedef struct _BULK_SECURITY_TEST_DATA {
+  ACCESS_MASK DesiredAccess;
+  ULONG SecurityIds[1];
+} BULK_SECURITY_TEST_DATA, *PBULK_SECURITY_TEST_DATA;
+
+#define VOLUME_IS_DIRTY                  (0x00000001)
+#define VOLUME_UPGRADE_SCHEDULED         (0x00000002)
+#define VOLUME_SESSION_OPEN              (0x00000004)
+
+typedef struct _FILE_PREFETCH {
+  ULONG Type;
+  ULONG Count;
+  ULONGLONG Prefetch[1];
+} FILE_PREFETCH, *PFILE_PREFETCH;
+
+typedef struct _FILE_PREFETCH_EX {
+  ULONG Type;
+  ULONG Count;
+  PVOID Context;
+  ULONGLONG Prefetch[1];
+} FILE_PREFETCH_EX, *PFILE_PREFETCH_EX;
+
+#define FILE_PREFETCH_TYPE_FOR_CREATE       0x1
+#define FILE_PREFETCH_TYPE_FOR_DIRENUM      0x2
+#define FILE_PREFETCH_TYPE_FOR_CREATE_EX    0x3
+#define FILE_PREFETCH_TYPE_FOR_DIRENUM_EX   0x4
+
+#define FILE_PREFETCH_TYPE_MAX              0x4
+
+typedef struct _FILE_OBJECTID_BUFFER {
+  UCHAR ObjectId[16];
+  union {
+    struct {
+      UCHAR BirthVolumeId[16];
+      UCHAR BirthObjectId[16];
+      UCHAR DomainId[16];
+    } DUMMYSTRUCTNAME;
+    UCHAR ExtendedInfo[48];
+  } DUMMYUNIONNAME;
+} FILE_OBJECTID_BUFFER, *PFILE_OBJECTID_BUFFER;
+
+typedef struct _FILE_SET_SPARSE_BUFFER {
+  BOOLEAN SetSparse;
+} FILE_SET_SPARSE_BUFFER, *PFILE_SET_SPARSE_BUFFER;
+
+typedef struct _FILE_ZERO_DATA_INFORMATION {
+  LARGE_INTEGER FileOffset;
+  LARGE_INTEGER BeyondFinalZero;
+} FILE_ZERO_DATA_INFORMATION, *PFILE_ZERO_DATA_INFORMATION;
+
+typedef struct _FILE_ALLOCATED_RANGE_BUFFER {
+  LARGE_INTEGER FileOffset;
+  LARGE_INTEGER Length;
+} FILE_ALLOCATED_RANGE_BUFFER, *PFILE_ALLOCATED_RANGE_BUFFER;
+
+typedef struct _ENCRYPTION_BUFFER {
+  ULONG EncryptionOperation;
+  UCHAR Private[1];
+} ENCRYPTION_BUFFER, *PENCRYPTION_BUFFER;
+
+#define FILE_SET_ENCRYPTION         0x00000001
+#define FILE_CLEAR_ENCRYPTION       0x00000002
+#define STREAM_SET_ENCRYPTION       0x00000003
+#define STREAM_CLEAR_ENCRYPTION     0x00000004
+
+#define MAXIMUM_ENCRYPTION_VALUE    0x00000004
+
+typedef struct _DECRYPTION_STATUS_BUFFER {
+  BOOLEAN NoEncryptedStreams;
+} DECRYPTION_STATUS_BUFFER, *PDECRYPTION_STATUS_BUFFER;
+
+#define ENCRYPTION_FORMAT_DEFAULT        (0x01)
+
+#define COMPRESSION_FORMAT_SPARSE        (0x4000)
+
+typedef struct _REQUEST_RAW_ENCRYPTED_DATA {
+  LONGLONG FileOffset;
+  ULONG Length;
+} REQUEST_RAW_ENCRYPTED_DATA, *PREQUEST_RAW_ENCRYPTED_DATA;
+
+typedef struct _ENCRYPTED_DATA_INFO {
+  ULONGLONG StartingFileOffset;
+  ULONG OutputBufferOffset;
+  ULONG BytesWithinFileSize;
+  ULONG BytesWithinValidDataLength;
+  USHORT CompressionFormat;
+  UCHAR DataUnitShift;
+  UCHAR ChunkShift;
+  UCHAR ClusterShift;
+  UCHAR EncryptionFormat;
+  USHORT NumberOfDataBlocks;
+  ULONG DataBlockSize[ANYSIZE_ARRAY];
+} ENCRYPTED_DATA_INFO, *PENCRYPTED_DATA_INFO;
+
+typedef struct _PLEX_READ_DATA_REQUEST {
+  LARGE_INTEGER ByteOffset;
+  ULONG ByteLength;
+  ULONG PlexNumber;
+} PLEX_READ_DATA_REQUEST, *PPLEX_READ_DATA_REQUEST;
+
+typedef struct _SI_COPYFILE {
+  ULONG SourceFileNameLength;
+  ULONG DestinationFileNameLength;
+  ULONG Flags;
+  WCHAR FileNameBuffer[1];
+} SI_COPYFILE, *PSI_COPYFILE;
+
+#define COPYFILE_SIS_LINK       0x0001
+#define COPYFILE_SIS_REPLACE    0x0002
+#define COPYFILE_SIS_FLAGS      0x0003
+
+#endif /* (_WIN32_WINNT >= 0x0500) */
+
+#if (_WIN32_WINNT >= 0x0600)
+
+typedef struct _FILE_MAKE_COMPATIBLE_BUFFER {
+  BOOLEAN CloseDisc;
+} FILE_MAKE_COMPATIBLE_BUFFER, *PFILE_MAKE_COMPATIBLE_BUFFER;
+
+typedef struct _FILE_SET_DEFECT_MGMT_BUFFER {
+    BOOLEAN Disable;
+} FILE_SET_DEFECT_MGMT_BUFFER, *PFILE_SET_DEFECT_MGMT_BUFFER;
+
+typedef struct _FILE_QUERY_SPARING_BUFFER {
+  ULONG SparingUnitBytes;
+  BOOLEAN SoftwareSparing;
+  ULONG TotalSpareBlocks;
+  ULONG FreeSpareBlocks;
+} FILE_QUERY_SPARING_BUFFER, *PFILE_QUERY_SPARING_BUFFER;
+
+typedef struct _FILE_QUERY_ON_DISK_VOL_INFO_BUFFER {
+  LARGE_INTEGER DirectoryCount;
+  LARGE_INTEGER FileCount;
+  USHORT FsFormatMajVersion;
+  USHORT FsFormatMinVersion;
+  WCHAR FsFormatName[12];
+  LARGE_INTEGER FormatTime;
+  LARGE_INTEGER LastUpdateTime;
+  WCHAR CopyrightInfo[34];
+  WCHAR AbstractInfo[34];
+  WCHAR FormattingImplementationInfo[34];
+  WCHAR LastModifyingImplementationInfo[34];
+} FILE_QUERY_ON_DISK_VOL_INFO_BUFFER, *PFILE_QUERY_ON_DISK_VOL_INFO_BUFFER;
+
+#define SET_REPAIR_ENABLED                                      (0x00000001)
+#define SET_REPAIR_VOLUME_BITMAP_SCAN                           (0x00000002)
+#define SET_REPAIR_DELETE_CROSSLINK                             (0x00000004)
+#define SET_REPAIR_WARN_ABOUT_DATA_LOSS                         (0x00000008)
+#define SET_REPAIR_DISABLED_AND_BUGCHECK_ON_CORRUPT             (0x00000010)
+#define SET_REPAIR_VALID_MASK                                   (0x0000001F)
+
+typedef enum _SHRINK_VOLUME_REQUEST_TYPES {
+  ShrinkPrepare = 1,
+  ShrinkCommit,
+  ShrinkAbort
+} SHRINK_VOLUME_REQUEST_TYPES, *PSHRINK_VOLUME_REQUEST_TYPES;
+
+typedef struct _SHRINK_VOLUME_INFORMATION {
+  SHRINK_VOLUME_REQUEST_TYPES ShrinkRequestType;
+  ULONGLONG Flags;
+  LONGLONG NewNumberOfSectors;
+} SHRINK_VOLUME_INFORMATION, *PSHRINK_VOLUME_INFORMATION;
+
+#define TXFS_RM_FLAG_LOGGING_MODE                           0x00000001
+#define TXFS_RM_FLAG_RENAME_RM                              0x00000002
+#define TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX                0x00000004
+#define TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN                0x00000008
+#define TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS    0x00000010
+#define TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT           0x00000020
+#define TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE             0x00000040
+#define TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX             0x00000080
+#define TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN             0x00000100
+#define TXFS_RM_FLAG_GROW_LOG                               0x00000400
+#define TXFS_RM_FLAG_SHRINK_LOG                             0x00000800
+#define TXFS_RM_FLAG_ENFORCE_MINIMUM_SIZE                   0x00001000
+#define TXFS_RM_FLAG_PRESERVE_CHANGES                       0x00002000
+#define TXFS_RM_FLAG_RESET_RM_AT_NEXT_START                 0x00004000
+#define TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START          0x00008000
+#define TXFS_RM_FLAG_PREFER_CONSISTENCY                     0x00010000
+#define TXFS_RM_FLAG_PREFER_AVAILABILITY                    0x00020000
+
+#define TXFS_LOGGING_MODE_SIMPLE        (0x0001)
+#define TXFS_LOGGING_MODE_FULL          (0x0002)
+
+#define TXFS_TRANSACTION_STATE_NONE         0x00
+#define TXFS_TRANSACTION_STATE_ACTIVE       0x01
+#define TXFS_TRANSACTION_STATE_PREPARED     0x02
+#define TXFS_TRANSACTION_STATE_NOTACTIVE    0x03
+
+#define TXFS_MODIFY_RM_VALID_FLAGS                                      \
+                (TXFS_RM_FLAG_LOGGING_MODE                          |   \
+                 TXFS_RM_FLAG_RENAME_RM                             |   \
+                 TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX               |   \
+                 TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN               |   \
+                 TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS   |   \
+                 TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT          |   \
+                 TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE            |   \
+                 TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX            |   \
+                 TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN            |   \
+                 TXFS_RM_FLAG_SHRINK_LOG                            |   \
+                 TXFS_RM_FLAG_GROW_LOG                              |   \
+                 TXFS_RM_FLAG_ENFORCE_MINIMUM_SIZE                  |   \
+                 TXFS_RM_FLAG_PRESERVE_CHANGES                      |   \
+                 TXFS_RM_FLAG_RESET_RM_AT_NEXT_START                |   \
+                 TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START         |   \
+                 TXFS_RM_FLAG_PREFER_CONSISTENCY                    |   \
+                 TXFS_RM_FLAG_PREFER_AVAILABILITY)
+
+typedef struct _TXFS_MODIFY_RM {
+  ULONG Flags;
+  ULONG LogContainerCountMax;
+  ULONG LogContainerCountMin;
+  ULONG LogContainerCount;
+  ULONG LogGrowthIncrement;
+  ULONG LogAutoShrinkPercentage;
+  ULONGLONG Reserved;
+  USHORT LoggingMode;
+} TXFS_MODIFY_RM, *PTXFS_MODIFY_RM;
+
+#define TXFS_RM_STATE_NOT_STARTED       0
+#define TXFS_RM_STATE_STARTING          1
+#define TXFS_RM_STATE_ACTIVE            2
+#define TXFS_RM_STATE_SHUTTING_DOWN     3
+
+#define TXFS_QUERY_RM_INFORMATION_VALID_FLAGS                           \
+                (TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS   |   \
+                 TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT          |   \
+                 TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX            |   \
+                 TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN            |   \
+                 TXFS_RM_FLAG_RESET_RM_AT_NEXT_START                |   \
+                 TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START         |   \
+                 TXFS_RM_FLAG_PREFER_CONSISTENCY                    |   \
+                 TXFS_RM_FLAG_PREFER_AVAILABILITY)
+
+typedef struct _TXFS_QUERY_RM_INFORMATION {
+  ULONG BytesRequired;
+  ULONGLONG TailLsn;
+  ULONGLONG CurrentLsn;
+  ULONGLONG ArchiveTailLsn;
+  ULONGLONG LogContainerSize;
+  LARGE_INTEGER HighestVirtualClock;
+  ULONG LogContainerCount;
+  ULONG LogContainerCountMax;
+  ULONG LogContainerCountMin;
+  ULONG LogGrowthIncrement;
+  ULONG LogAutoShrinkPercentage;
+  ULONG Flags;
+  USHORT LoggingMode;
+  USHORT Reserved;
+  ULONG RmState;
+  ULONGLONG LogCapacity;
+  ULONGLONG LogFree;
+  ULONGLONG TopsSize;
+  ULONGLONG TopsUsed;
+  ULONGLONG TransactionCount;
+  ULONGLONG OnePCCount;
+  ULONGLONG TwoPCCount;
+  ULONGLONG NumberLogFileFull;
+  ULONGLONG OldestTransactionAge;
+  GUID RMName;
+  ULONG TmLogPathOffset;
+} TXFS_QUERY_RM_INFORMATION, *PTXFS_QUERY_RM_INFORMATION;
+
+#define TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_REDO_LSN        0x01
+#define TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_VIRTUAL_CLOCK   0x02
+
+#define TXFS_ROLLFORWARD_REDO_VALID_FLAGS                               \
+                (TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_REDO_LSN |         \
+                 TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_VIRTUAL_CLOCK)
+
+typedef struct _TXFS_ROLLFORWARD_REDO_INFORMATION {
+  LARGE_INTEGER LastVirtualClock;
+  ULONGLONG LastRedoLsn;
+  ULONGLONG HighestRecoveryLsn;
+  ULONG Flags;
+} TXFS_ROLLFORWARD_REDO_INFORMATION, *PTXFS_ROLLFORWARD_REDO_INFORMATION;
+
+#define TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MAX              0x00000001
+#define TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MIN              0x00000002
+#define TXFS_START_RM_FLAG_LOG_CONTAINER_SIZE                   0x00000004
+#define TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS  0x00000008
+#define TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT         0x00000010
+#define TXFS_START_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE           0x00000020
+#define TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX           0x00000040
+#define TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN           0x00000080
+
+#define TXFS_START_RM_FLAG_RECOVER_BEST_EFFORT                  0x00000200
+#define TXFS_START_RM_FLAG_LOGGING_MODE                         0x00000400
+#define TXFS_START_RM_FLAG_PRESERVE_CHANGES                     0x00000800
+
+#define TXFS_START_RM_FLAG_PREFER_CONSISTENCY                   0x00001000
+#define TXFS_START_RM_FLAG_PREFER_AVAILABILITY                  0x00002000
+
+#define TXFS_START_RM_VALID_FLAGS                                           \
+                (TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MAX             |   \
+                 TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MIN             |   \
+                 TXFS_START_RM_FLAG_LOG_CONTAINER_SIZE                  |   \
+                 TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS |   \
+                 TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT        |   \
+                 TXFS_START_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE          |   \
+                 TXFS_START_RM_FLAG_RECOVER_BEST_EFFORT                 |   \
+                 TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX          |   \
+                 TXFS_START_RM_FLAG_LOGGING_MODE                        |   \
+                 TXFS_START_RM_FLAG_PRESERVE_CHANGES                    |   \
+                 TXFS_START_RM_FLAG_PREFER_CONSISTENCY                  |   \
+                 TXFS_START_RM_FLAG_PREFER_AVAILABILITY)
+
+typedef struct _TXFS_START_RM_INFORMATION {
+  ULONG Flags;
+  ULONGLONG LogContainerSize;
+  ULONG LogContainerCountMin;
+  ULONG LogContainerCountMax;
+  ULONG LogGrowthIncrement;
+  ULONG LogAutoShrinkPercentage;
+  ULONG TmLogPathOffset;
+  USHORT TmLogPathLength;
+  USHORT LoggingMode;
+  USHORT LogPathLength;
+  USHORT Reserved;
+  WCHAR LogPath[1];
+} TXFS_START_RM_INFORMATION, *PTXFS_START_RM_INFORMATION;
+
+typedef struct _TXFS_GET_METADATA_INFO_OUT {
+  struct {
+    LONGLONG LowPart;
+    LONGLONG HighPart;
+  } TxfFileId;
+  GUID LockingTransaction;
+  ULONGLONG LastLsn;
+  ULONG TransactionState;
+} TXFS_GET_METADATA_INFO_OUT, *PTXFS_GET_METADATA_INFO_OUT;
+
+#define TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_CREATED   0x00000001
+#define TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_DELETED   0x00000002
+
+typedef struct _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY {
+  ULONGLONG Offset;
+  ULONG NameFlags;
+  LONGLONG FileId;
+  ULONG Reserved1;
+  ULONG Reserved2;
+  LONGLONG Reserved3;
+  WCHAR FileName[1];
+} TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY, *PTXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY;
+
+typedef struct _TXFS_LIST_TRANSACTION_LOCKED_FILES {
+  GUID KtmTransaction;
+  ULONGLONG NumberOfFiles;
+  ULONGLONG BufferSizeRequired;
+  ULONGLONG Offset;
+} TXFS_LIST_TRANSACTION_LOCKED_FILES, *PTXFS_LIST_TRANSACTION_LOCKED_FILES;
+
+typedef struct _TXFS_LIST_TRANSACTIONS_ENTRY {
+  GUID TransactionId;
+  ULONG TransactionState;
+  ULONG Reserved1;
+  ULONG Reserved2;
+  LONGLONG Reserved3;
+} TXFS_LIST_TRANSACTIONS_ENTRY, *PTXFS_LIST_TRANSACTIONS_ENTRY;
+
+typedef struct _TXFS_LIST_TRANSACTIONS {
+  ULONGLONG NumberOfTransactions;
+  ULONGLONG BufferSizeRequired;
+} TXFS_LIST_TRANSACTIONS, *PTXFS_LIST_TRANSACTIONS;
+
+typedef struct _TXFS_READ_BACKUP_INFORMATION_OUT {
+  union {
+    ULONG BufferLength;
+    UCHAR Buffer[1];
+  } DUMMYUNIONNAME;
+} TXFS_READ_BACKUP_INFORMATION_OUT, *PTXFS_READ_BACKUP_INFORMATION_OUT;
+
+typedef struct _TXFS_WRITE_BACKUP_INFORMATION {
+  UCHAR Buffer[1];
+} TXFS_WRITE_BACKUP_INFORMATION, *PTXFS_WRITE_BACKUP_INFORMATION;
+
+#define TXFS_TRANSACTED_VERSION_NONTRANSACTED   0xFFFFFFFE
+#define TXFS_TRANSACTED_VERSION_UNCOMMITTED     0xFFFFFFFF
+
+typedef struct _TXFS_GET_TRANSACTED_VERSION {
+  ULONG ThisBaseVersion;
+  ULONG LatestVersion;
+  USHORT ThisMiniVersion;
+  USHORT FirstMiniVersion;
+  USHORT LatestMiniVersion;
+} TXFS_GET_TRANSACTED_VERSION, *PTXFS_GET_TRANSACTED_VERSION;
+
+#define TXFS_SAVEPOINT_SET                      0x00000001
+#define TXFS_SAVEPOINT_ROLLBACK                 0x00000002
+#define TXFS_SAVEPOINT_CLEAR                    0x00000004
+#define TXFS_SAVEPOINT_CLEAR_ALL                0x00000010
+
+typedef struct _TXFS_SAVEPOINT_INFORMATION {
+  HANDLE KtmTransaction;
+  ULONG ActionCode;
+  ULONG SavepointId;
+} TXFS_SAVEPOINT_INFORMATION, *PTXFS_SAVEPOINT_INFORMATION;
+
+typedef struct _TXFS_CREATE_MINIVERSION_INFO {
+  USHORT StructureVersion;
+  USHORT StructureLength;
+  ULONG BaseVersion;
+  USHORT MiniVersion;
+} TXFS_CREATE_MINIVERSION_INFO, *PTXFS_CREATE_MINIVERSION_INFO;
+
+typedef struct _TXFS_TRANSACTION_ACTIVE_INFO {
+  BOOLEAN TransactionsActiveAtSnapshot;
+} TXFS_TRANSACTION_ACTIVE_INFO, *PTXFS_TRANSACTION_ACTIVE_INFO;
+
+#endif /* (_WIN32_WINNT >= 0x0600) */
+
+#if (_WIN32_WINNT >= 0x0601)
+
+#define MARK_HANDLE_REALTIME                (0x00000020)
+#define MARK_HANDLE_NOT_REALTIME            (0x00000040)
+
+#define NO_8DOT3_NAME_PRESENT               (0x00000001)
+#define REMOVED_8DOT3_NAME                  (0x00000002)
+
+#define PERSISTENT_VOLUME_STATE_SHORT_NAME_CREATION_DISABLED        (0x00000001)
+
+typedef struct _BOOT_AREA_INFO {
+  ULONG BootSectorCount;
+  struct {
+    LARGE_INTEGER Offset;
+  } BootSectors[2];
+} BOOT_AREA_INFO, *PBOOT_AREA_INFO;
+
+typedef struct _RETRIEVAL_POINTER_BASE {
+  LARGE_INTEGER FileAreaOffset;
+} RETRIEVAL_POINTER_BASE, *PRETRIEVAL_POINTER_BASE;
+
+typedef struct _FILE_FS_PERSISTENT_VOLUME_INFORMATION {
+  ULONG VolumeFlags;
+  ULONG FlagMask;
+  ULONG Version;
+  ULONG Reserved;
+} FILE_FS_PERSISTENT_VOLUME_INFORMATION, *PFILE_FS_PERSISTENT_VOLUME_INFORMATION;
+
+typedef struct _FILE_SYSTEM_RECOGNITION_INFORMATION {
+  CHAR FileSystem[9];
+} FILE_SYSTEM_RECOGNITION_INFORMATION, *PFILE_SYSTEM_RECOGNITION_INFORMATION;
+
+#define OPLOCK_LEVEL_CACHE_READ         (0x00000001)
+#define OPLOCK_LEVEL_CACHE_HANDLE       (0x00000002)
+#define OPLOCK_LEVEL_CACHE_WRITE        (0x00000004)
+
+#define REQUEST_OPLOCK_INPUT_FLAG_REQUEST               (0x00000001)
+#define REQUEST_OPLOCK_INPUT_FLAG_ACK                   (0x00000002)
+#define REQUEST_OPLOCK_INPUT_FLAG_COMPLETE_ACK_ON_CLOSE (0x00000004)
+
+#define REQUEST_OPLOCK_CURRENT_VERSION          1
+
+typedef struct _REQUEST_OPLOCK_INPUT_BUFFER {
+  USHORT StructureVersion;
+  USHORT StructureLength;
+  ULONG RequestedOplockLevel;
+  ULONG Flags;
+} REQUEST_OPLOCK_INPUT_BUFFER, *PREQUEST_OPLOCK_INPUT_BUFFER;
+
+#define REQUEST_OPLOCK_OUTPUT_FLAG_ACK_REQUIRED     (0x00000001)
+#define REQUEST_OPLOCK_OUTPUT_FLAG_MODES_PROVIDED   (0x00000002)
+
+typedef struct _REQUEST_OPLOCK_OUTPUT_BUFFER {
+  USHORT StructureVersion;
+  USHORT StructureLength;
+  ULONG OriginalOplockLevel;
+  ULONG NewOplockLevel;
+  ULONG Flags;
+  ACCESS_MASK AccessMode;
+  USHORT ShareMode;
+} REQUEST_OPLOCK_OUTPUT_BUFFER, *PREQUEST_OPLOCK_OUTPUT_BUFFER;
+
+#define SD_GLOBAL_CHANGE_TYPE_MACHINE_SID   1
+
+typedef struct _SD_CHANGE_MACHINE_SID_INPUT {
+  USHORT CurrentMachineSIDOffset;
+  USHORT CurrentMachineSIDLength;
+  USHORT NewMachineSIDOffset;
+  USHORT NewMachineSIDLength;
+} SD_CHANGE_MACHINE_SID_INPUT, *PSD_CHANGE_MACHINE_SID_INPUT;
+
+typedef struct _SD_CHANGE_MACHINE_SID_OUTPUT {
+  ULONGLONG NumSDChangedSuccess;
+  ULONGLONG NumSDChangedFail;
+  ULONGLONG NumSDUnused;
+  ULONGLONG NumSDTotal;
+  ULONGLONG NumMftSDChangedSuccess;
+  ULONGLONG NumMftSDChangedFail;
+  ULONGLONG NumMftSDTotal;
+} SD_CHANGE_MACHINE_SID_OUTPUT, *PSD_CHANGE_MACHINE_SID_OUTPUT;
+
+typedef struct _SD_GLOBAL_CHANGE_INPUT {
+  ULONG Flags;
+  ULONG ChangeType;
+  union {
+    SD_CHANGE_MACHINE_SID_INPUT SdChange;
+  };
+} SD_GLOBAL_CHANGE_INPUT, *PSD_GLOBAL_CHANGE_INPUT;
+
+typedef struct _SD_GLOBAL_CHANGE_OUTPUT {
+  ULONG Flags;
+  ULONG ChangeType;
+  union {
+    SD_CHANGE_MACHINE_SID_OUTPUT SdChange;
+  };
+} SD_GLOBAL_CHANGE_OUTPUT, *PSD_GLOBAL_CHANGE_OUTPUT;
+
+#define ENCRYPTED_DATA_INFO_SPARSE_FILE    1
+
+typedef struct _EXTENDED_ENCRYPTED_DATA_INFO {
+  ULONG ExtendedCode;
+  ULONG Length;
+  ULONG Flags;
+  ULONG Reserved;
+} EXTENDED_ENCRYPTED_DATA_INFO, *PEXTENDED_ENCRYPTED_DATA_INFO;
+
+typedef struct _LOOKUP_STREAM_FROM_CLUSTER_INPUT {
+  ULONG Flags;
+  ULONG NumberOfClusters;
+  LARGE_INTEGER Cluster[1];
+} LOOKUP_STREAM_FROM_CLUSTER_INPUT, *PLOOKUP_STREAM_FROM_CLUSTER_INPUT;
+
+typedef struct _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT {
+  ULONG Offset;
+  ULONG NumberOfMatches;
+  ULONG BufferSizeRequired;
+} LOOKUP_STREAM_FROM_CLUSTER_OUTPUT, *PLOOKUP_STREAM_FROM_CLUSTER_OUTPUT;
+
+#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_PAGE_FILE          0x00000001
+#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_DENY_DEFRAG_SET    0x00000002
+#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_FS_SYSTEM_FILE     0x00000004
+#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_TXF_SYSTEM_FILE    0x00000008
+
+#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_MASK          0xff000000
+#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_DATA          0x01000000
+#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_INDEX         0x02000000
+#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_SYSTEM        0x03000000
+
+typedef struct _LOOKUP_STREAM_FROM_CLUSTER_ENTRY {
+  ULONG OffsetToNext;
+  ULONG Flags;
+  LARGE_INTEGER Reserved;
+  LARGE_INTEGER Cluster;
+  WCHAR FileName[1];
+} LOOKUP_STREAM_FROM_CLUSTER_ENTRY, *PLOOKUP_STREAM_FROM_CLUSTER_ENTRY;
+
+typedef struct _FILE_TYPE_NOTIFICATION_INPUT {
+  ULONG Flags;
+  ULONG NumFileTypeIDs;
+  GUID FileTypeID[1];
+} FILE_TYPE_NOTIFICATION_INPUT, *PFILE_TYPE_NOTIFICATION_INPUT;
+
+#define FILE_TYPE_NOTIFICATION_FLAG_USAGE_BEGIN     0x00000001
+#define FILE_TYPE_NOTIFICATION_FLAG_USAGE_END       0x00000002
+
+DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_PAGE_FILE,         0x0d0a64a1, 0x38fc, 0x4db8, 0x9f, 0xe7, 0x3f, 0x43, 0x52, 0xcd, 0x7c, 0x5c );
+DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_HIBERNATION_FILE,  0xb7624d64, 0xb9a3, 0x4cf8, 0x80, 0x11, 0x5b, 0x86, 0xc9, 0x40, 0xe7, 0xb7 );
+DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_CRASHDUMP_FILE,    0x9d453eb7, 0xd2a6, 0x4dbd, 0xa2, 0xe3, 0xfb, 0xd0, 0xed, 0x91, 0x09, 0xa9 );
+
+#ifndef _VIRTUAL_STORAGE_TYPE_DEFINED
+#define _VIRTUAL_STORAGE_TYPE_DEFINED
+typedef struct _VIRTUAL_STORAGE_TYPE {
+  ULONG DeviceId;
+  GUID  VendorId;
+} VIRTUAL_STORAGE_TYPE, *PVIRTUAL_STORAGE_TYPE;
+#endif
+
+typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST {
+  ULONG RequestLevel;
+  ULONG RequestFlags;
+} STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST, *PSTORAGE_QUERY_DEPENDENT_VOLUME_REQUEST;
+
+#define QUERY_DEPENDENT_VOLUME_REQUEST_FLAG_HOST_VOLUMES    0x1
+#define QUERY_DEPENDENT_VOLUME_REQUEST_FLAG_GUEST_VOLUMES   0x2
+
+typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY {
+  ULONG EntryLength;
+  ULONG DependencyTypeFlags;
+  ULONG ProviderSpecificFlags;
+  VIRTUAL_STORAGE_TYPE VirtualStorageType;
+} STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY, *PSTORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY;
+
+typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY {
+  ULONG EntryLength;
+  ULONG DependencyTypeFlags;
+  ULONG ProviderSpecificFlags;
+  VIRTUAL_STORAGE_TYPE VirtualStorageType;
+  ULONG AncestorLevel;
+  ULONG HostVolumeNameOffset;
+  ULONG HostVolumeNameSize;
+  ULONG DependentVolumeNameOffset;
+  ULONG DependentVolumeNameSize;
+  ULONG RelativePathOffset;
+  ULONG RelativePathSize;
+  ULONG DependentDeviceNameOffset;
+  ULONG DependentDeviceNameSize;
+} STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY, *PSTORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY;
+
+typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE {
+  ULONG ResponseLevel;
+  ULONG NumberEntries;
+  union {
+    STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY Lev1Depends[];
+    STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY Lev2Depends[];
+  };
+} STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE, *PSTORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE;
+
+#endif /* (_WIN32_WINNT >= 0x0601) */
+
+typedef struct _FILESYSTEM_STATISTICS {
+  USHORT FileSystemType;
+  USHORT Version;
+  ULONG SizeOfCompleteStructure;
+  ULONG UserFileReads;
+  ULONG UserFileReadBytes;
+  ULONG UserDiskReads;
+  ULONG UserFileWrites;
+  ULONG UserFileWriteBytes;
+  ULONG UserDiskWrites;
+  ULONG MetaDataReads;
+  ULONG MetaDataReadBytes;
+  ULONG MetaDataDiskReads;
+  ULONG MetaDataWrites;
+  ULONG MetaDataWriteBytes;
+  ULONG MetaDataDiskWrites;
+} FILESYSTEM_STATISTICS, *PFILESYSTEM_STATISTICS;
+
+#define FILESYSTEM_STATISTICS_TYPE_NTFS     1
+#define FILESYSTEM_STATISTICS_TYPE_FAT      2
+#define FILESYSTEM_STATISTICS_TYPE_EXFAT    3
+
+typedef struct _FAT_STATISTICS {
+  ULONG CreateHits;
+  ULONG SuccessfulCreates;
+  ULONG FailedCreates;
+  ULONG NonCachedReads;
+  ULONG NonCachedReadBytes;
+  ULONG NonCachedWrites;
+  ULONG NonCachedWriteBytes;
+  ULONG NonCachedDiskReads;
+  ULONG NonCachedDiskWrites;
+} FAT_STATISTICS, *PFAT_STATISTICS;
+
+typedef struct _EXFAT_STATISTICS {
+  ULONG CreateHits;
+  ULONG SuccessfulCreates;
+  ULONG FailedCreates;
+  ULONG NonCachedReads;
+  ULONG NonCachedReadBytes;
+  ULONG NonCachedWrites;
+  ULONG NonCachedWriteBytes;
+  ULONG NonCachedDiskReads;
+  ULONG NonCachedDiskWrites;
+} EXFAT_STATISTICS, *PEXFAT_STATISTICS;
+
+typedef struct _NTFS_STATISTICS {
+  ULONG LogFileFullExceptions;
+  ULONG OtherExceptions;
+  ULONG MftReads;
+  ULONG MftReadBytes;
+  ULONG MftWrites;
+  ULONG MftWriteBytes;
+  struct {
+    USHORT Write;
+    USHORT Create;
+    USHORT SetInfo;
+    USHORT Flush;
+  } MftWritesUserLevel;
+  USHORT MftWritesFlushForLogFileFull;
+  USHORT MftWritesLazyWriter;
+  USHORT MftWritesUserRequest;
+  ULONG Mft2Writes;
+  ULONG Mft2WriteBytes;
+  struct {
+    USHORT Write;
+    USHORT Create;
+    USHORT SetInfo;
+    USHORT Flush;
+  } Mft2WritesUserLevel;
+  USHORT Mft2WritesFlushForLogFileFull;
+  USHORT Mft2WritesLazyWriter;
+  USHORT Mft2WritesUserRequest;
+  ULONG RootIndexReads;
+  ULONG RootIndexReadBytes;
+  ULONG RootIndexWrites;
+  ULONG RootIndexWriteBytes;
+  ULONG BitmapReads;
+  ULONG BitmapReadBytes;
+  ULONG BitmapWrites;
+  ULONG BitmapWriteBytes;
+  USHORT BitmapWritesFlushForLogFileFull;
+  USHORT BitmapWritesLazyWriter;
+  USHORT BitmapWritesUserRequest;
+  struct {
+    USHORT Write;
+    USHORT Create;
+    USHORT SetInfo;
+  } BitmapWritesUserLevel;
+  ULONG MftBitmapReads;
+  ULONG MftBitmapReadBytes;
+  ULONG MftBitmapWrites;
+  ULONG MftBitmapWriteBytes;
+  USHORT MftBitmapWritesFlushForLogFileFull;
+  USHORT MftBitmapWritesLazyWriter;
+  USHORT MftBitmapWritesUserRequest;
+  struct {
+    USHORT Write;
+    USHORT Create;
+    USHORT SetInfo;
+    USHORT Flush;
+  } MftBitmapWritesUserLevel;
+  ULONG UserIndexReads;
+  ULONG UserIndexReadBytes;
+  ULONG UserIndexWrites;
+  ULONG UserIndexWriteBytes;
+  ULONG LogFileReads;
+  ULONG LogFileReadBytes;
+  ULONG LogFileWrites;
+  ULONG LogFileWriteBytes;
+  struct {
+    ULONG Calls;
+    ULONG Clusters;
+    ULONG Hints;
+    ULONG RunsReturned;
+    ULONG HintsHonored;
+    ULONG HintsClusters;
+    ULONG Cache;
+    ULONG CacheClusters;
+    ULONG CacheMiss;
+    ULONG CacheMissClusters;
+  } Allocate;
+} NTFS_STATISTICS, *PNTFS_STATISTICS;
+
+#endif // _FILESYSTEMFSCTL_
+
+#define SYMLINK_FLAG_RELATIVE   1
+
+typedef struct _REPARSE_DATA_BUFFER {
+  ULONG ReparseTag;
+  USHORT ReparseDataLength;
+  USHORT Reserved;
+  __GNU_EXTENSION union {
+    struct {
+      USHORT SubstituteNameOffset;
+      USHORT SubstituteNameLength;
+      USHORT PrintNameOffset;
+      USHORT PrintNameLength;
+      ULONG Flags;
+      WCHAR PathBuffer[1];
+    } SymbolicLinkReparseBuffer;
+    struct {
+      USHORT SubstituteNameOffset;
+      USHORT SubstituteNameLength;
+      USHORT PrintNameOffset;
+      USHORT PrintNameLength;
+      WCHAR PathBuffer[1];
+    } MountPointReparseBuffer;
+    struct {
+      UCHAR DataBuffer[1];
+    } GenericReparseBuffer;
+  };
+} REPARSE_DATA_BUFFER, *PREPARSE_DATA_BUFFER;
+
+#define REPARSE_DATA_BUFFER_HEADER_SIZE   FIELD_OFFSET(REPARSE_DATA_BUFFER, GenericReparseBuffer)
+
+typedef struct _REPARSE_GUID_DATA_BUFFER {
+  ULONG ReparseTag;
+  USHORT ReparseDataLength;
+  USHORT Reserved;
+  GUID ReparseGuid;
+  struct {
+    UCHAR DataBuffer[1];
+  } GenericReparseBuffer;
+} REPARSE_GUID_DATA_BUFFER, *PREPARSE_GUID_DATA_BUFFER;
+
+#define REPARSE_GUID_DATA_BUFFER_HEADER_SIZE   FIELD_OFFSET(REPARSE_GUID_DATA_BUFFER, GenericReparseBuffer)
+
+#define MAXIMUM_REPARSE_DATA_BUFFER_SIZE      ( 16 * 1024 )
+
+/* Reserved reparse tags */
+#define IO_REPARSE_TAG_RESERVED_ZERO            (0)
+#define IO_REPARSE_TAG_RESERVED_ONE             (1)
+#define IO_REPARSE_TAG_RESERVED_RANGE           IO_REPARSE_TAG_RESERVED_ONE
+
+#define IsReparseTagMicrosoft(_tag) (((_tag) & 0x80000000))
+#define IsReparseTagNameSurrogate(_tag) (((_tag) & 0x20000000))
+
+#define IO_REPARSE_TAG_VALID_VALUES     (0xF000FFFF)
+
+#define IsReparseTagValid(tag) (                               \
+                  !((tag) & ~IO_REPARSE_TAG_VALID_VALUES) &&   \
+                  ((tag) > IO_REPARSE_TAG_RESERVED_RANGE)      \
+                 )
+
+/* MicroSoft reparse point tags */
+#define IO_REPARSE_TAG_MOUNT_POINT              (0xA0000003L)
+#define IO_REPARSE_TAG_HSM                      (0xC0000004L)
+#define IO_REPARSE_TAG_DRIVE_EXTENDER           (0x80000005L)
+#define IO_REPARSE_TAG_HSM2                     (0x80000006L)
+#define IO_REPARSE_TAG_SIS                      (0x80000007L)
+#define IO_REPARSE_TAG_WIM                      (0x80000008L)
+#define IO_REPARSE_TAG_CSV                      (0x80000009L)
+#define IO_REPARSE_TAG_DFS                      (0x8000000AL)
+#define IO_REPARSE_TAG_FILTER_MANAGER           (0x8000000BL)
+#define IO_REPARSE_TAG_SYMLINK                  (0xA000000CL)
+#define IO_REPARSE_TAG_IIS_CACHE                (0xA0000010L)
+#define IO_REPARSE_TAG_DFSR                     (0x80000012L)
+
+#pragma pack(4)
+typedef struct _REPARSE_INDEX_KEY {
+  ULONG FileReparseTag;
+  LARGE_INTEGER FileId;
+} REPARSE_INDEX_KEY, *PREPARSE_INDEX_KEY;
+#pragma pack()
+
+#define FSCTL_LMR_GET_LINK_TRACKING_INFORMATION   CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,58,METHOD_BUFFERED,FILE_ANY_ACCESS)
+#define FSCTL_LMR_SET_LINK_TRACKING_INFORMATION   CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,59,METHOD_BUFFERED,FILE_ANY_ACCESS)
+#define IOCTL_LMR_ARE_FILE_OBJECTS_ON_SAME_SERVER CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,60,METHOD_BUFFERED,FILE_ANY_ACCESS)
+
+#define FSCTL_PIPE_ASSIGN_EVENT         CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_PIPE_DISCONNECT           CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_PIPE_LISTEN               CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_PIPE_PEEK                 CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
+#define FSCTL_PIPE_QUERY_EVENT          CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_PIPE_TRANSCEIVE           CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER,  FILE_READ_DATA | FILE_WRITE_DATA)
+#define FSCTL_PIPE_WAIT                 CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_PIPE_IMPERSONATE          CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_PIPE_SET_CLIENT_PROCESS   CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_PIPE_QUERY_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_PIPE_GET_PIPE_ATTRIBUTE       CTL_CODE(FILE_DEVICE_NAMED_PIPE, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_PIPE_SET_PIPE_ATTRIBUTE       CTL_CODE(FILE_DEVICE_NAMED_PIPE, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_PIPE_SET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 13, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_PIPE_GET_HANDLE_ATTRIBUTE     CTL_CODE(FILE_DEVICE_NAMED_PIPE, 14, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_PIPE_SET_HANDLE_ATTRIBUTE     CTL_CODE(FILE_DEVICE_NAMED_PIPE, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_PIPE_FLUSH                    CTL_CODE(FILE_DEVICE_NAMED_PIPE, 16, METHOD_BUFFERED, FILE_WRITE_DATA)
+
+#define FSCTL_PIPE_INTERNAL_READ        CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
+#define FSCTL_PIPE_INTERNAL_WRITE       CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_PIPE_INTERNAL_TRANSCEIVE  CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
+#define FSCTL_PIPE_INTERNAL_READ_OVFLOW CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
+
+#define FILE_PIPE_READ_DATA             0x00000000
+#define FILE_PIPE_WRITE_SPACE           0x00000001
+
+typedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER {
+  HANDLE EventHandle;
+  ULONG KeyValue;
+} FILE_PIPE_ASSIGN_EVENT_BUFFER, *PFILE_PIPE_ASSIGN_EVENT_BUFFER;
+
+typedef struct _FILE_PIPE_EVENT_BUFFER {
+  ULONG NamedPipeState;
+  ULONG EntryType;
+  ULONG ByteCount;
+  ULONG KeyValue;
+  ULONG NumberRequests;
+} FILE_PIPE_EVENT_BUFFER, *PFILE_PIPE_EVENT_BUFFER;
+
+typedef struct _FILE_PIPE_PEEK_BUFFER {
+  ULONG NamedPipeState;
+  ULONG ReadDataAvailable;
+  ULONG NumberOfMessages;
+  ULONG MessageLength;
+  CHAR Data[1];
+} FILE_PIPE_PEEK_BUFFER, *PFILE_PIPE_PEEK_BUFFER;
+
+typedef struct _FILE_PIPE_WAIT_FOR_BUFFER {
+  LARGE_INTEGER Timeout;
+  ULONG NameLength;
+  BOOLEAN TimeoutSpecified;
+  WCHAR Name[1];
+} FILE_PIPE_WAIT_FOR_BUFFER, *PFILE_PIPE_WAIT_FOR_BUFFER;
+
+typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER {
+#if !defined(BUILD_WOW6432)
+  PVOID ClientSession;
+  PVOID ClientProcess;
+#else
+  ULONGLONG ClientSession;
+  ULONGLONG ClientProcess;
+#endif
+} FILE_PIPE_CLIENT_PROCESS_BUFFER, *PFILE_PIPE_CLIENT_PROCESS_BUFFER;
+
+#define FILE_PIPE_COMPUTER_NAME_LENGTH 15
+
+typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX {
+#if !defined(BUILD_WOW6432)
+  PVOID ClientSession;
+  PVOID ClientProcess;
+#else
+  ULONGLONG ClientSession;
+  ULONGLONG ClientProcess;
+#endif
+  USHORT ClientComputerNameLength;
+  WCHAR ClientComputerBuffer[FILE_PIPE_COMPUTER_NAME_LENGTH+1];
+} FILE_PIPE_CLIENT_PROCESS_BUFFER_EX, *PFILE_PIPE_CLIENT_PROCESS_BUFFER_EX;
+
+#define FSCTL_MAILSLOT_PEEK             CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)
+
+typedef enum _LINK_TRACKING_INFORMATION_TYPE {
+  NtfsLinkTrackingInformation,
+  DfsLinkTrackingInformation
+} LINK_TRACKING_INFORMATION_TYPE, *PLINK_TRACKING_INFORMATION_TYPE;
+
+typedef struct _LINK_TRACKING_INFORMATION {
+  LINK_TRACKING_INFORMATION_TYPE Type;
+  UCHAR VolumeId[16];
+} LINK_TRACKING_INFORMATION, *PLINK_TRACKING_INFORMATION;
+
+typedef struct _REMOTE_LINK_TRACKING_INFORMATION {
+  PVOID TargetFileObject;
+  ULONG TargetLinkTrackingInformationLength;
+  UCHAR TargetLinkTrackingInformationBuffer[1];
+} REMOTE_LINK_TRACKING_INFORMATION, *PREMOTE_LINK_TRACKING_INFORMATION;
+
+#define IO_OPEN_PAGING_FILE             0x0002
+#define IO_OPEN_TARGET_DIRECTORY        0x0004
+#define IO_STOP_ON_SYMLINK              0x0008
+#define IO_MM_PAGING_FILE               0x0010
+
+typedef VOID
+(NTAPI *PDRIVER_FS_NOTIFICATION) (
+  IN PDEVICE_OBJECT DeviceObject,
+  IN BOOLEAN FsActive);
+
+typedef enum _FS_FILTER_SECTION_SYNC_TYPE {
+  SyncTypeOther = 0,
+  SyncTypeCreateSection
+} FS_FILTER_SECTION_SYNC_TYPE, *PFS_FILTER_SECTION_SYNC_TYPE;
+
+typedef enum _FS_FILTER_STREAM_FO_NOTIFICATION_TYPE {
+  NotifyTypeCreate = 0,
+  NotifyTypeRetired
+} FS_FILTER_STREAM_FO_NOTIFICATION_TYPE, *PFS_FILTER_STREAM_FO_NOTIFICATION_TYPE;
+
+typedef union _FS_FILTER_PARAMETERS {
+  struct {
+    PLARGE_INTEGER EndingOffset;
+    PERESOURCE *ResourceToRelease;
+  } AcquireForModifiedPageWriter;
+  struct {
+    PERESOURCE ResourceToRelease;
+  } ReleaseForModifiedPageWriter;
+  struct {
+    FS_FILTER_SECTION_SYNC_TYPE SyncType;
+    ULONG PageProtection;
+  } AcquireForSectionSynchronization;
+  struct {
+    FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType;
+    BOOLEAN POINTER_ALIGNMENT SafeToRecurse;
+  } NotifyStreamFileObject;
+  struct {
+    PVOID Argument1;
+    PVOID Argument2;
+    PVOID Argument3;
+    PVOID Argument4;
+    PVOID Argument5;
+  } Others;
+} FS_FILTER_PARAMETERS, *PFS_FILTER_PARAMETERS;
+
+#define FS_FILTER_ACQUIRE_FOR_SECTION_SYNCHRONIZATION      (UCHAR)-1
+#define FS_FILTER_RELEASE_FOR_SECTION_SYNCHRONIZATION      (UCHAR)-2
+#define FS_FILTER_ACQUIRE_FOR_MOD_WRITE                    (UCHAR)-3
+#define FS_FILTER_RELEASE_FOR_MOD_WRITE                    (UCHAR)-4
+#define FS_FILTER_ACQUIRE_FOR_CC_FLUSH                     (UCHAR)-5
+#define FS_FILTER_RELEASE_FOR_CC_FLUSH                     (UCHAR)-6
+
+typedef struct _FS_FILTER_CALLBACK_DATA {
+  ULONG SizeOfFsFilterCallbackData;
+  UCHAR Operation;
+  UCHAR Reserved;
+  struct _DEVICE_OBJECT *DeviceObject;
+  struct _FILE_OBJECT *FileObject;
+  FS_FILTER_PARAMETERS Parameters;
+} FS_FILTER_CALLBACK_DATA, *PFS_FILTER_CALLBACK_DATA;
+
+typedef NTSTATUS
+(NTAPI *PFS_FILTER_CALLBACK) (
+  IN PFS_FILTER_CALLBACK_DATA Data,
+  OUT PVOID *CompletionContext);
+
+typedef VOID
+(NTAPI *PFS_FILTER_COMPLETION_CALLBACK) (
+  IN PFS_FILTER_CALLBACK_DATA Data,
+  IN NTSTATUS OperationStatus,
+  IN PVOID CompletionContext);
+
+typedef struct _FS_FILTER_CALLBACKS {
+  ULONG SizeOfFsFilterCallbacks;
+  ULONG Reserved;
+  PFS_FILTER_CALLBACK PreAcquireForSectionSynchronization;
+  PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization;
+  PFS_FILTER_CALLBACK PreReleaseForSectionSynchronization;
+  PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization;
+  PFS_FILTER_CALLBACK PreAcquireForCcFlush;
+  PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush;
+  PFS_FILTER_CALLBACK PreReleaseForCcFlush;
+  PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush;
+  PFS_FILTER_CALLBACK PreAcquireForModifiedPageWriter;
+  PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter;
+  PFS_FILTER_CALLBACK PreReleaseForModifiedPageWriter;
+  PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter;
+} FS_FILTER_CALLBACKS, *PFS_FILTER_CALLBACKS;
+
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlRegisterFileSystemFilterCallbacks(
+  IN struct _DRIVER_OBJECT *FilterDriverObject,
+  IN PFS_FILTER_CALLBACKS Callbacks);
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlNotifyStreamFileObject(
+  IN struct _FILE_OBJECT * StreamFileObject,
+  IN struct _DEVICE_OBJECT *DeviceObjectHint OPTIONAL,
+  IN FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType,
+  IN BOOLEAN SafeToRecurse);
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+
+#define DO_VERIFY_VOLUME                    0x00000002
+#define DO_BUFFERED_IO                      0x00000004
+#define DO_EXCLUSIVE                        0x00000008
+#define DO_DIRECT_IO                        0x00000010
+#define DO_MAP_IO_BUFFER                    0x00000020
+#define DO_DEVICE_HAS_NAME                  0x00000040
+#define DO_DEVICE_INITIALIZING              0x00000080
+#define DO_SYSTEM_BOOT_PARTITION            0x00000100
+#define DO_LONG_TERM_REQUESTS               0x00000200
+#define DO_NEVER_LAST_DEVICE                0x00000400
+#define DO_SHUTDOWN_REGISTERED              0x00000800
+#define DO_BUS_ENUMERATED_DEVICE            0x00001000
+#define DO_POWER_PAGABLE                    0x00002000
+#define DO_POWER_INRUSH                     0x00004000
+#define DO_LOW_PRIORITY_FILESYSTEM          0x00010000
+#define DO_SUPPORTS_TRANSACTIONS            0x00040000
+#define DO_FORCE_NEITHER_IO                 0x00080000
+#define DO_VOLUME_DEVICE_OBJECT             0x00100000
+#define DO_SYSTEM_SYSTEM_PARTITION          0x00200000
+#define DO_SYSTEM_CRITICAL_PARTITION        0x00400000
+#define DO_DISALLOW_EXECUTE                 0x00800000
+
+extern KSPIN_LOCK                   IoStatisticsLock;
+extern ULONG                        IoReadOperationCount;
+extern ULONG                        IoWriteOperationCount;
+extern ULONG                        IoOtherOperationCount;
+extern LARGE_INTEGER                IoReadTransferCount;
+extern LARGE_INTEGER                IoWriteTransferCount;
+extern LARGE_INTEGER                IoOtherTransferCount;
+
+#define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE    64
+#define IO_FILE_OBJECT_PAGED_POOL_CHARGE        1024
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+typedef struct _IO_PRIORITY_INFO {
+  ULONG Size;
+  ULONG ThreadPriority;
+  ULONG PagePriority;
+  IO_PRIORITY_HINT IoPriority;
+} IO_PRIORITY_INFO, *PIO_PRIORITY_INFO;
+#endif
+$endif (_NTIFS_)
index 716ee87..27049e6 100644 (file)
@@ -1,15 +1,6 @@
 /******************************************************************************
  *                              Kernel Functions                              *
  ******************************************************************************/
-$if (_NTDDK_)
-NTKERNELAPI
-VOID
-FASTCALL
-KeInvalidateRangeAllCaches(
-  IN PVOID BaseAddress,
-  IN ULONG Length);
-$endif
-
 $if (_WDMDDK_)
 NTKERNELAPI
 VOID
@@ -24,10 +15,52 @@ VOID
 NTAPI
 KeClearEvent(
   IN OUT PRKEVENT Event);
-$endif
+$endif (_WDMDDK_)
+$if (_NTDDK_)
+
+NTKERNELAPI
+VOID
+FASTCALL
+KeInvalidateRangeAllCaches(
+  IN PVOID BaseAddress,
+  IN ULONG Length);
+$endif (_NTDDK_)
+$if (_NTIFS_)
+
+NTSTATUS
+NTAPI
+KeGetProcessorNumberFromIndex(
+  IN ULONG ProcIndex,
+  OUT PPROCESSOR_NUMBER ProcNumber);
+
+ULONG
+NTAPI
+KeGetProcessorIndexFromNumber(
+  IN PPROCESSOR_NUMBER ProcNumber);
+$endif (_NTIFS_)
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 
+$if (_WDMDDK_)
+#if defined(_NTDDK_) || defined(_NTIFS_)
+NTKERNELAPI
+VOID
+NTAPI
+ProbeForRead(
+  IN CONST VOID *Address, /* CONST is added */
+  IN SIZE_T Length,
+  IN ULONG Alignment);
+#endif /* defined(_NTDDK_) || defined(_NTIFS_) */
+
+NTKERNELAPI
+VOID
+NTAPI
+ProbeForWrite(
+  IN PVOID Address,
+  IN SIZE_T Length,
+  IN ULONG Alignment);
+
+$endif (_WDMDDK_)
 $if (_NTDDK_)
 NTKERNELAPI
 VOID
@@ -67,30 +100,10 @@ VOID
 NTAPI
 KeBugCheck(
   IN ULONG BugCheckCode);
-$endif /* _NTDDK_ */
-
-$if (_WDMDDK_)
-#if defined(_NTDDK_) || defined(_NTIFS_)
-NTKERNELAPI
-VOID
-NTAPI
-ProbeForRead(
-  IN CONST VOID *Address, /* CONST is added */
-  IN SIZE_T Length,
-  IN ULONG Alignment);
-#endif /* defined(_NTDDK_) || defined(_NTIFS_) */
-
-NTKERNELAPI
-VOID
-NTAPI
-ProbeForWrite(
-  IN PVOID Address,
-  IN SIZE_T Length,
-  IN ULONG Alignment);
-
-$endif /* _WDMDDK_ */
-
+$endif(_NTDDK_)
+$if (_WDMDDK_ || _NTDDK_)
 #if defined(SINGLE_GROUP_LEGACY_API)
+$endif
 
 $if (_WDMDDK_)
 NTKERNELAPI
@@ -115,9 +128,9 @@ NTKERNELAPI
 KAFFINITY
 NTAPI
 KeQueryActiveProcessors(VOID);
-$endif
-
+$endif (_WDMDDK_)
 $if (_NTDDK_)
+
 NTKERNELAPI
 VOID
 NTAPI
@@ -129,9 +142,10 @@ NTKERNELAPI
 KAFFINITY
 NTAPI
 KeQueryActiveProcessors(VOID);
-$endif
-
+$endif (_NTDDK_)
+$if (_WDMDDK_ || _NTDDK_)
 #endif /* defined(SINGLE_GROUP_LEGACY_API) */
+$endif
 
 $if (_WDMDDK_)
 #if !defined(_M_AMD64)
@@ -475,18 +489,128 @@ KeWaitForSingleObject(
   IN KPROCESSOR_MODE WaitMode,
   IN BOOLEAN Alertable,
   IN PLARGE_INTEGER Timeout OPTIONAL);
-$endif
+$endif (_WDMDDK_)
+$if (_NTIFS_)
 
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+NTKERNELAPI
+VOID
+NTAPI
+KeInitializeMutant(
+  OUT PRKMUTANT Mutant,
+  IN BOOLEAN InitialOwner);
+
+NTKERNELAPI
+LONG
+NTAPI
+KeReadStateMutant(
+  IN PRKMUTANT Mutant);
+
+NTKERNELAPI
+LONG
+NTAPI
+KeReleaseMutant(
+  IN OUT PRKMUTANT Mutant,
+  IN KPRIORITY Increment,
+  IN BOOLEAN Abandoned,
+  IN BOOLEAN Wait);
+
+NTKERNELAPI
+VOID
+NTAPI
+KeInitializeQueue(
+  OUT PRKQUEUE Queue,
+  IN ULONG Count);
+
+NTKERNELAPI
+LONG
+NTAPI
+KeReadStateQueue(
+  IN PRKQUEUE Queue);
+
+NTKERNELAPI
+LONG
+NTAPI
+KeInsertQueue(
+  IN OUT PRKQUEUE Queue,
+  IN OUT PLIST_ENTRY Entry);
+
+NTKERNELAPI
+LONG
+NTAPI
+KeInsertHeadQueue(
+  IN OUT PRKQUEUE Queue,
+  IN OUT PLIST_ENTRY Entry);
+
+NTKERNELAPI
+PLIST_ENTRY
+NTAPI
+KeRemoveQueue(
+  IN OUT PRKQUEUE Queue,
+  IN KPROCESSOR_MODE WaitMode,
+  IN PLARGE_INTEGER Timeout OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+KeAttachProcess(
+  IN OUT PKPROCESS Process);
+
+NTKERNELAPI
+VOID
+NTAPI
+KeDetachProcess(
+  VOID);
+
+NTKERNELAPI
+PLIST_ENTRY
+NTAPI
+KeRundownQueue(
+  IN OUT PRKQUEUE Queue);
+
+NTKERNELAPI
+VOID
+NTAPI
+KeStackAttachProcess(
+  IN OUT PKPROCESS Process,
+  OUT PKAPC_STATE ApcState);
+
+NTKERNELAPI
+VOID
+NTAPI
+KeUnstackDetachProcess(
+  IN PKAPC_STATE ApcState);
+
+NTKERNELAPI
+UCHAR
+NTAPI
+KeSetIdealProcessorThread(
+  IN OUT PKTHREAD Thread,
+  IN UCHAR Processor);
 
-#if (NTDDI_VERSION >= NTDDI_WINXP)
-$if (_NTDDK_)
 NTKERNELAPI
 BOOLEAN
 NTAPI
-KeAreApcsDisabled(VOID);
+KeSetKernelStackSwapEnable(
+  IN BOOLEAN Enable);
+
+#if defined(_X86_)
+NTHALAPI
+KIRQL
+FASTCALL
+KeAcquireSpinLockRaiseToSynch(
+  IN OUT PKSPIN_LOCK SpinLock);
+#else
+NTKERNELAPI
+KIRQL
+KeAcquireSpinLockRaiseToSynch(
+  IN OUT PKSPIN_LOCK SpinLock);
+#endif
 $endif
 
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+
 $if (_WDMDDK_)
 _DECL_HAL_KE_IMPORT
 VOID
@@ -550,7 +674,35 @@ VOID
 FASTCALL
 KeReleaseInStackQueuedSpinLock(
   IN PKLOCK_QUEUE_HANDLE LockHandle);
-$endif
+$endif (_WDMDDK_)
+$if (_NTDDK_)
+NTKERNELAPI
+BOOLEAN
+NTAPI
+KeAreApcsDisabled(VOID);
+$endif (_NTDDK_)
+$if (_NTIFS_)
+
+_DECL_HAL_KE_IMPORT
+KIRQL
+FASTCALL
+KeAcquireQueuedSpinLock(
+  IN OUT KSPIN_LOCK_QUEUE_NUMBER Number);
+
+_DECL_HAL_KE_IMPORT
+VOID
+FASTCALL
+KeReleaseQueuedSpinLock(
+  IN OUT KSPIN_LOCK_QUEUE_NUMBER Number,
+  IN KIRQL OldIrql);
+
+_DECL_HAL_KE_IMPORT
+LOGICAL
+FASTCALL
+KeTryToAcquireQueuedSpinLock(
+  IN KSPIN_LOCK_QUEUE_NUMBER Number,
+  OUT PKIRQL OldIrql);
+$endif (_NTIFS_)
 
 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
@@ -580,9 +732,10 @@ VOID
 NTAPI
 KeFlushQueuedDpcs(VOID);
 #endif /* (NTDDI_VERSION >= NTDDI_WINXPSP2) */
-$endif /* _WDMDDK_ */
-
+$endif (_WDMDDK_)
+$if (_WDMDDK_ || _NTDDK_)
 #if (NTDDI_VERSION >= NTDDI_WS03)
+$endif
 
 $if (_WDMDDK_)
 NTKERNELAPI
@@ -631,38 +784,20 @@ BOOLEAN
 FASTCALL
 KeTestSpinLock(
   IN PKSPIN_LOCK SpinLock);
-$endif /* _WDMDDK_ */
+$endif (_WDMDDK_)
 
 $if (_NTDDK_)
 NTKERNELAPI
 BOOLEAN
 NTAPI
 KeInvalidateAllCaches(VOID);
-$endif /* _NTDDK_ */
-
+$endif (_NTDDK_)
+$if (_WDMDDK_ || _NTDDK_)
 #endif /* (NTDDI_VERSION >= NTDDI_WS03) */
-
+$endif
+$if (_WDMDDK_ || _NTDDK_)
 #if (NTDDI_VERSION >= NTDDI_WS03SP1)
-
-$if (_NTDDK_)
-NTKERNELAPI
-NTSTATUS
-NTAPI
-KeExpandKernelStackAndCallout(
-  IN PEXPAND_STACK_CALLOUT Callout,
-  IN PVOID Parameter OPTIONAL,
-  IN SIZE_T Size);
-
-NTKERNELAPI
-VOID
-NTAPI
-KeEnterGuardedRegion(VOID);
-
-NTKERNELAPI
-VOID
-NTAPI
-KeLeaveGuardedRegion(VOID);
-$endif /* _NTDDK_ */
+$endif
 
 $if (_WDMDDK_)
 NTKERNELAPI
@@ -721,12 +856,31 @@ BOOLEAN
 FASTCALL
 KeTryToAcquireGuardedMutex(
   IN OUT PKGUARDED_MUTEX GuardedMutex);
-$endif /* _WDMDDK_ */
+$endif (_WDMDDK_)
+$if (_NTDDK_)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+KeExpandKernelStackAndCallout(
+  IN PEXPAND_STACK_CALLOUT Callout,
+  IN PVOID Parameter OPTIONAL,
+  IN SIZE_T Size);
+
+NTKERNELAPI
+VOID
+NTAPI
+KeEnterGuardedRegion(VOID);
 
+NTKERNELAPI
+VOID
+NTAPI
+KeLeaveGuardedRegion(VOID);
+$endif (_NTDDK_)
+$if (_WDMDDK_ || _NTDDK_)
 #endif /* (NTDDI_VERSION >= NTDDI_WS03SP1) */
+$endif
 
 #if (NTDDI_VERSION >= NTDDI_VISTA)
-
 $if (_WDMDDK_)
 NTKERNELAPI
 VOID
@@ -746,21 +900,10 @@ NTSTATUS
 NTAPI
 KeQueryDpcWatchdogInformation(
   OUT PKDPC_WATCHDOG_INFORMATION WatchdogInformation);
-$endif /* _WDMDDK_ */
-
+$endif (_WDMDDK_)
+$if (_WDMDDK_ || _NTDDK_)
 #if defined(SINGLE_GROUP_LEGACY_API)
-$if (_NTDDK_)
-NTKERNELAPI
-ULONG
-NTAPI
-KeQueryActiveProcessorCount(
-  OUT PKAFFINITY ActiveProcessors OPTIONAL);
-
-NTKERNELAPI
-ULONG
-NTAPI
-KeQueryMaximumProcessorCount(VOID);
-$endif /* _NTDDK_ */
+$endif
 
 $if (_WDMDDK_)
 NTKERNELAPI
@@ -785,8 +928,39 @@ NTKERNELAPI
 ULONG
 NTAPI
 KeQueryMaximumProcessorCount(VOID);
-$endif /* _WDMDDK_ */
+$endif (_WDMDDK_)
+$if (_NTDDK_)
+NTKERNELAPI
+ULONG
+NTAPI
+KeQueryActiveProcessorCount(
+  OUT PKAFFINITY ActiveProcessors OPTIONAL);
+
+NTKERNELAPI
+ULONG
+NTAPI
+KeQueryMaximumProcessorCount(VOID);
+$endif (_NTDDK_)
+$if (_WDMDDK_ || _NTDDK_)
 #endif /* SINGLE_GROUP_LEGACY_API */
+$endif
+$if (_NTIFS_)
+NTKERNELAPI
+VOID
+KeQueryOwnerMutant(
+  IN PKMUTANT Mutant,
+  OUT PCLIENT_ID ClientId);
+
+NTKERNELAPI
+ULONG
+KeRemoveQueueEx (
+  IN OUT PKQUEUE Queue,
+  IN KPROCESSOR_MODE WaitMode,
+  IN BOOLEAN Alertable,
+  IN PLARGE_INTEGER Timeout OPTIONAL,
+  OUT PLIST_ENTRY *EntryArray,
+  IN ULONG Count);
+$endif (_NTIFS_)
 
 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
 
@@ -804,11 +978,59 @@ KeDeregisterProcessorChangeCallback(
   IN PVOID CallbackHandle);
 
 #endif /* (NTDDI_VERSION >= NTDDI_WS08) */
-$endif /* _WDMDDK_ */
-
+$endif (_WDMDDK_)
+$if (_WDMDDK_ || _NTDDK_)
 #if (NTDDI_VERSION >= NTDDI_WIN7)
+$endif
+
+$if (_WDMDDK_)
+ULONG64
+NTAPI
+KeQueryTotalCycleTimeProcess(
+  IN OUT PKPROCESS Process,
+  OUT PULONG64 CycleTimeStamp);
+
+ULONG64
+NTAPI
+KeQueryTotalCycleTimeThread(
+  IN OUT PKTHREAD Thread,
+  OUT PULONG64 CycleTimeStamp);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+KeSetTargetProcessorDpcEx(
+  IN OUT PKDPC Dpc,
+  IN PPROCESSOR_NUMBER ProcNumber);
+
+NTKERNELAPI
+VOID
+NTAPI
+KeSetSystemGroupAffinityThread(
+  IN PGROUP_AFFINITY Affinity,
+  OUT PGROUP_AFFINITY PreviousAffinity OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+KeRevertToUserGroupAffinityThread(
+  IN PGROUP_AFFINITY PreviousAffinity);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+KeSetCoalescableTimer(
+  IN OUT PKTIMER Timer,
+  IN LARGE_INTEGER DueTime,
+  IN ULONG Period,
+  IN ULONG TolerableDelay,
+  IN PKDPC Dpc OPTIONAL);
+
+NTKERNELAPI
+ULONGLONG
+NTAPI
+KeQueryUnbiasedInterruptTime(VOID);
 
-$if (_NTDDK_)
 NTKERNELAPI
 ULONG
 NTAPI
@@ -879,67 +1101,28 @@ KeQueryLogicalProcessorRelationship(
 NTKERNELAPI
 NTSTATUS
 NTAPI
-KeSetHardwareCounterConfiguration(
-  IN PHARDWARE_COUNTER CounterArray,
-  IN ULONG Count);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-KeQueryHardwareCounterConfiguration(
-  OUT PHARDWARE_COUNTER CounterArray,
-  IN ULONG MaximumCount,
-  OUT PULONG Count);
-$endif /* _NTDDK_ */
-
-$if (_WDMDDK_)
-ULONG64
-NTAPI
-KeQueryTotalCycleTimeProcess(
-  IN OUT PKPROCESS Process,
-  OUT PULONG64 CycleTimeStamp);
-
-ULONG64
-NTAPI
-KeQueryTotalCycleTimeThread(
-  IN OUT PKTHREAD Thread,
-  OUT PULONG64 CycleTimeStamp);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-KeSetTargetProcessorDpcEx(
-  IN OUT PKDPC Dpc,
-  IN PPROCESSOR_NUMBER ProcNumber);
-
-NTKERNELAPI
-VOID
-NTAPI
-KeSetSystemGroupAffinityThread(
-  IN PGROUP_AFFINITY Affinity,
-  OUT PGROUP_AFFINITY PreviousAffinity OPTIONAL);
+KeSaveExtendedProcessorState(
+  IN ULONG64 Mask,
+  OUT PXSTATE_SAVE XStateSave);
 
 NTKERNELAPI
 VOID
 NTAPI
-KeRevertToUserGroupAffinityThread(
-  IN PGROUP_AFFINITY PreviousAffinity);
+KeRestoreExtendedProcessorState(
+  IN PXSTATE_SAVE XStateSave);
 
-NTKERNELAPI
-BOOLEAN
+NTSTATUS
 NTAPI
-KeSetCoalescableTimer(
-  IN OUT PKTIMER Timer,
-  IN LARGE_INTEGER DueTime,
-  IN ULONG Period,
-  IN ULONG TolerableDelay,
-  IN PKDPC Dpc OPTIONAL);
+KeGetProcessorNumberFromIndex(
+  IN ULONG ProcIndex,
+  OUT PPROCESSOR_NUMBER ProcNumber);
 
-NTKERNELAPI
-ULONGLONG
+ULONG
 NTAPI
-KeQueryUnbiasedInterruptTime(VOID);
-
+KeGetProcessorIndexFromNumber(
+  IN PPROCESSOR_NUMBER ProcNumber);
+$endif (_WDMDDK_)
+$if (_NTDDK_)
 NTKERNELAPI
 ULONG
 NTAPI
@@ -1010,30 +1193,21 @@ KeQueryLogicalProcessorRelationship(
 NTKERNELAPI
 NTSTATUS
 NTAPI
-KeSaveExtendedProcessorState(
-  IN ULONG64 Mask,
-  OUT PXSTATE_SAVE XStateSave);
+KeSetHardwareCounterConfiguration(
+  IN PHARDWARE_COUNTER CounterArray,
+  IN ULONG Count);
 
 NTKERNELAPI
-VOID
-NTAPI
-KeRestoreExtendedProcessorState(
-  IN PXSTATE_SAVE XStateSave);
-
 NTSTATUS
 NTAPI
-KeGetProcessorNumberFromIndex(
-  IN ULONG ProcIndex,
-  OUT PPROCESSOR_NUMBER ProcNumber);
-
-ULONG
-NTAPI
-KeGetProcessorIndexFromNumber(
-  IN PPROCESSOR_NUMBER ProcNumber);
-$endif
-
+KeQueryHardwareCounterConfiguration(
+  OUT PHARDWARE_COUNTER CounterArray,
+  IN ULONG MaximumCount,
+  OUT PULONG Count);
+$endif (_NTDDK_)
+$if (_WDMDDK_ || _NTDDK_)
 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
-
+$endif
 $if (_WDMDDK_)
 #if !defined(_IA64_)
 NTHALAPI
@@ -1071,5 +1245,5 @@ KeFlushWriteBuffer(VOID);
 #endif /* DBG */
 
 #define PAGED_CODE_LOCKED() NOP_FUNCTION;
-$endif
+$endif (_WDMDDK_)
 
index b714f97..f3a0cea 100644 (file)
@@ -174,10 +174,207 @@ $if (_WDMDDK_)
     ASSERT(((_Mdl)->MdlFlags & MDL_MAPPED_TO_SYSTEM_VA) == 0); \
   } \
 }
-$endif
+$endif (_WDMDDK_)
+$if (_NTIFS_)
+
+FORCEINLINE
+ULONG
+HEAP_MAKE_TAG_FLAGS(
+  IN ULONG TagBase,
+  IN ULONG Tag)
+{
+  //__assume_bound(TagBase); // FIXME
+  return ((ULONG)((TagBase) + ((Tag) << HEAP_TAG_SHIFT)));
+}
+$endif (_NTIFS_)
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
+$if (_WDMDDK_)
+NTKERNELAPI
+PVOID
+NTAPI
+MmAllocateContiguousMemory(
+  IN SIZE_T NumberOfBytes,
+  IN PHYSICAL_ADDRESS HighestAcceptableAddress);
+
+NTKERNELAPI
+PVOID
+NTAPI
+MmAllocateContiguousMemorySpecifyCache(
+  IN SIZE_T NumberOfBytes,
+  IN PHYSICAL_ADDRESS LowestAcceptableAddress,
+  IN PHYSICAL_ADDRESS HighestAcceptableAddress,
+  IN PHYSICAL_ADDRESS BoundaryAddressMultiple OPTIONAL,
+  IN MEMORY_CACHING_TYPE CacheType);
+
+NTKERNELAPI
+PMDL
+NTAPI
+MmAllocatePagesForMdl(
+  IN PHYSICAL_ADDRESS LowAddress,
+  IN PHYSICAL_ADDRESS HighAddress,
+  IN PHYSICAL_ADDRESS SkipBytes,
+  IN SIZE_T TotalBytes);
+
+NTKERNELAPI
+VOID
+NTAPI
+MmBuildMdlForNonPagedPool(
+  IN OUT PMDLX MemoryDescriptorList);
+
+//DECLSPEC_DEPRECATED_DDK
+NTKERNELAPI
+PMDL
+NTAPI
+MmCreateMdl(
+  IN PMDL MemoryDescriptorList OPTIONAL,
+  IN PVOID Base,
+  IN SIZE_T Length);
+
+NTKERNELAPI
+VOID
+NTAPI
+MmFreeContiguousMemory(
+  IN PVOID BaseAddress);
+
+NTKERNELAPI
+VOID
+NTAPI
+MmFreeContiguousMemorySpecifyCache(
+  IN PVOID BaseAddress,
+  IN SIZE_T NumberOfBytes,
+  IN MEMORY_CACHING_TYPE CacheType);
+
+NTKERNELAPI
+VOID
+NTAPI
+MmFreePagesFromMdl(
+  IN PMDLX MemoryDescriptorList);
+
+NTKERNELAPI
+PVOID
+NTAPI
+MmGetSystemRoutineAddress(
+  IN PUNICODE_STRING SystemRoutineName);
+
+NTKERNELAPI
+LOGICAL
+NTAPI
+MmIsDriverVerifying(
+  IN struct _DRIVER_OBJECT *DriverObject);
+
+NTKERNELAPI
+PVOID
+NTAPI
+MmLockPagableDataSection(
+  IN PVOID AddressWithinSection);
+
+NTKERNELAPI
+PVOID
+NTAPI
+MmMapIoSpace(
+  IN PHYSICAL_ADDRESS PhysicalAddress,
+  IN SIZE_T NumberOfBytes,
+  IN MEMORY_CACHING_TYPE CacheEnable);
+
+NTKERNELAPI
+PVOID
+NTAPI
+MmMapLockedPages(
+  IN PMDL MemoryDescriptorList,
+  IN KPROCESSOR_MODE AccessMode);
+
+NTKERNELAPI
+PVOID
+NTAPI
+MmMapLockedPagesSpecifyCache(
+  IN PMDLX MemoryDescriptorList,
+  IN KPROCESSOR_MODE AccessMode,
+  IN MEMORY_CACHING_TYPE CacheType,
+  IN PVOID BaseAddress OPTIONAL,
+  IN ULONG BugCheckOnFailure,
+  IN MM_PAGE_PRIORITY Priority);
+
+NTKERNELAPI
+PVOID
+NTAPI
+MmPageEntireDriver(
+  IN PVOID AddressWithinSection);
+
+NTKERNELAPI
+VOID
+NTAPI
+MmProbeAndLockPages(
+  IN OUT PMDL MemoryDescriptorList,
+  IN KPROCESSOR_MODE AccessMode,
+  IN LOCK_OPERATION Operation);
+
+NTKERNELAPI
+MM_SYSTEMSIZE
+NTAPI
+MmQuerySystemSize(VOID);
+
+NTKERNELAPI
+VOID
+NTAPI
+MmResetDriverPaging(
+  IN PVOID AddressWithinSection);
+
+NTKERNELAPI
+SIZE_T
+NTAPI
+MmSizeOfMdl(
+  IN PVOID Base,
+  IN SIZE_T Length);
+
+NTKERNELAPI
+VOID
+NTAPI
+MmUnlockPagableImageSection(
+  IN PVOID ImageSectionHandle);
+
+NTKERNELAPI
+VOID
+NTAPI
+MmUnlockPages(
+  IN OUT PMDL MemoryDescriptorList);
+
+NTKERNELAPI
+VOID
+NTAPI
+MmUnmapIoSpace(
+  IN PVOID BaseAddress,
+  IN SIZE_T NumberOfBytes);
+
+NTKERNELAPI
+VOID
+NTAPI
+MmProbeAndLockProcessPages(
+  IN OUT PMDL MemoryDescriptorList,
+  IN PEPROCESS Process,
+  IN KPROCESSOR_MODE AccessMode,
+  IN LOCK_OPERATION Operation);
+
+NTKERNELAPI
+VOID
+NTAPI
+MmUnmapLockedPages(
+  IN PVOID BaseAddress,
+  IN PMDL MemoryDescriptorList);
+
+NTKERNELAPI
+PVOID
+NTAPI
+MmAllocateContiguousMemorySpecifyCacheNode(
+  IN SIZE_T NumberOfBytes,
+  IN PHYSICAL_ADDRESS LowestAcceptableAddress,
+  IN PHYSICAL_ADDRESS HighestAcceptableAddress,
+  IN PHYSICAL_ADDRESS BoundaryAddressMultiple OPTIONAL,
+  IN MEMORY_CACHING_TYPE CacheType,
+  IN NODE_REQUIREMENT PreferredNode);
+$endif (_WDMDDK_)
 $if (_NTDDK_)
+
 NTKERNELAPI
 PPHYSICAL_MEMORY_RANGE
 NTAPI
@@ -351,197 +548,51 @@ MmFreeContiguousMemorySpecifyCache(
   IN PVOID BaseAddress,
   IN SIZE_T NumberOfBytes,
   IN MEMORY_CACHING_TYPE CacheType);
-$endif
-
-$if (_WDMDDK_)
-NTKERNELAPI
-PVOID
-NTAPI
-MmAllocateContiguousMemory(
-  IN SIZE_T NumberOfBytes,
-  IN PHYSICAL_ADDRESS HighestAcceptableAddress);
-
-NTKERNELAPI
-PVOID
-NTAPI
-MmAllocateContiguousMemorySpecifyCache(
-  IN SIZE_T NumberOfBytes,
-  IN PHYSICAL_ADDRESS LowestAcceptableAddress,
-  IN PHYSICAL_ADDRESS HighestAcceptableAddress,
-  IN PHYSICAL_ADDRESS BoundaryAddressMultiple OPTIONAL,
-  IN MEMORY_CACHING_TYPE CacheType);
-
-NTKERNELAPI
-PMDL
-NTAPI
-MmAllocatePagesForMdl(
-  IN PHYSICAL_ADDRESS LowAddress,
-  IN PHYSICAL_ADDRESS HighAddress,
-  IN PHYSICAL_ADDRESS SkipBytes,
-  IN SIZE_T TotalBytes);
-
-NTKERNELAPI
-VOID
-NTAPI
-MmBuildMdlForNonPagedPool(
-  IN OUT PMDLX MemoryDescriptorList);
-
-//DECLSPEC_DEPRECATED_DDK
-NTKERNELAPI
-PMDL
-NTAPI
-MmCreateMdl(
-  IN PMDL MemoryDescriptorList OPTIONAL,
-  IN PVOID Base,
-  IN SIZE_T Length);
-
-NTKERNELAPI
-VOID
-NTAPI
-MmFreeContiguousMemory(
-  IN PVOID BaseAddress);
-
-NTKERNELAPI
-VOID
-NTAPI
-MmFreeContiguousMemorySpecifyCache(
-  IN PVOID BaseAddress,
-  IN SIZE_T NumberOfBytes,
-  IN MEMORY_CACHING_TYPE CacheType);
+$endif (_NTDDK_)
+$if (_NTIFS_)
 
 NTKERNELAPI
-VOID
-NTAPI
-MmFreePagesFromMdl(
-  IN PMDLX MemoryDescriptorList);
-
-NTKERNELAPI
-PVOID
-NTAPI
-MmGetSystemRoutineAddress(
-  IN PUNICODE_STRING SystemRoutineName);
-
-NTKERNELAPI
-LOGICAL
-NTAPI
-MmIsDriverVerifying(
-  IN struct _DRIVER_OBJECT *DriverObject);
-
-NTKERNELAPI
-PVOID
-NTAPI
-MmLockPagableDataSection(
-  IN PVOID AddressWithinSection);
-
-NTKERNELAPI
-PVOID
-NTAPI
-MmMapIoSpace(
-  IN PHYSICAL_ADDRESS PhysicalAddress,
-  IN SIZE_T NumberOfBytes,
-  IN MEMORY_CACHING_TYPE CacheEnable);
-
-NTKERNELAPI
-PVOID
-NTAPI
-MmMapLockedPages(
-  IN PMDL MemoryDescriptorList,
-  IN KPROCESSOR_MODE AccessMode);
-
-NTKERNELAPI
-PVOID
+BOOLEAN
 NTAPI
-MmMapLockedPagesSpecifyCache(
-  IN PMDLX MemoryDescriptorList,
-  IN KPROCESSOR_MODE AccessMode,
-  IN MEMORY_CACHING_TYPE CacheType,
-  IN PVOID BaseAddress OPTIONAL,
-  IN ULONG BugCheckOnFailure,
-  IN MM_PAGE_PRIORITY Priority);
+MmIsRecursiveIoFault(
+  VOID);
 
 NTKERNELAPI
-PVOID
-NTAPI
-MmPageEntireDriver(
-  IN PVOID AddressWithinSection);
-
-NTKERNELAPI
-VOID
+BOOLEAN
 NTAPI
-MmProbeAndLockPages(
-  IN OUT PMDL MemoryDescriptorList,
-  IN KPROCESSOR_MODE AccessMode,
-  IN LOCK_OPERATION Operation);
+MmForceSectionClosed(
+  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+  IN BOOLEAN DelayClose);
 
 NTKERNELAPI
-MM_SYSTEMSIZE
+BOOLEAN
 NTAPI
-MmQuerySystemSize(VOID);
+MmFlushImageSection(
+  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+  IN MMFLUSH_TYPE FlushType);
 
 NTKERNELAPI
-VOID
+BOOLEAN
 NTAPI
-MmResetDriverPaging(
-  IN PVOID AddressWithinSection);
+MmCanFileBeTruncated(
+  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+  IN PLARGE_INTEGER NewFileSize OPTIONAL);
 
 NTKERNELAPI
-SIZE_T
+BOOLEAN
 NTAPI
-MmSizeOfMdl(
-  IN PVOID Base,
+MmSetAddressRangeModified(
+  IN PVOID Address,
   IN SIZE_T Length);
-
-NTKERNELAPI
-VOID
-NTAPI
-MmUnlockPagableImageSection(
-  IN PVOID ImageSectionHandle);
-
-NTKERNELAPI
-VOID
-NTAPI
-MmUnlockPages(
-  IN OUT PMDL MemoryDescriptorList);
-
-NTKERNELAPI
-VOID
-NTAPI
-MmUnmapIoSpace(
-  IN PVOID BaseAddress,
-  IN SIZE_T NumberOfBytes);
-
-NTKERNELAPI
-VOID
-NTAPI
-MmProbeAndLockProcessPages(
-  IN OUT PMDL MemoryDescriptorList,
-  IN PEPROCESS Process,
-  IN KPROCESSOR_MODE AccessMode,
-  IN LOCK_OPERATION Operation);
-
-NTKERNELAPI
-VOID
-NTAPI
-MmUnmapLockedPages(
-  IN PVOID BaseAddress,
-  IN PMDL MemoryDescriptorList);
-
-NTKERNELAPI
-PVOID
-NTAPI
-MmAllocateContiguousMemorySpecifyCacheNode(
-  IN SIZE_T NumberOfBytes,
-  IN PHYSICAL_ADDRESS LowestAcceptableAddress,
-  IN PHYSICAL_ADDRESS HighestAcceptableAddress,
-  IN PHYSICAL_ADDRESS BoundaryAddressMultiple OPTIONAL,
-  IN MEMORY_CACHING_TYPE CacheType,
-  IN NODE_REQUIREMENT PreferredNode);
-$endif
+$endif (_NTIFS_)
 
 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
+$if (_WDMDDK_ || _NTIFS_)
 #if (NTDDI_VERSION >= NTDDI_WINXP)
+$endif
 
+$if (_WDMDDK_)
 NTKERNELAPI
 NTSTATUS
 NTAPI
@@ -599,15 +650,22 @@ NTAPI
 MmAddVerifierThunks(
   IN PVOID ThunkBuffer,
   IN ULONG ThunkBufferSize);
+$endif (_WDMDDK_)
+$if (_NTIFS_)
 
-#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
-
-#if (NTDDI_VERSION >= NTDDI_WS03)
-$if (_NTDDK_)
 NTKERNELAPI
 NTSTATUS
 NTAPI
-MmCreateMirror(VOID);
+MmPrefetchPages(
+  IN ULONG NumberOfLists,
+  IN PREAD_LIST *ReadLists);
+$endif (_NTIFS_)
+
+$if (_WDMDDK_ || _NTIFS_)
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
+$endif
+$if (_WDMDDK_ || _NTDDK_)
+#if (NTDDI_VERSION >= NTDDI_WS03)
 $endif
 $if (_WDMDDK_)
 NTKERNELAPI
@@ -616,9 +674,17 @@ NTAPI
 MmIsIoSpaceActive(
   IN PHYSICAL_ADDRESS StartAddress,
   IN SIZE_T NumberOfBytes);
-$endif
-#endif
+$endif (_WDMDDK_)
 
+$if (_NTDDK_)
+NTKERNELAPI
+NTSTATUS
+NTAPI
+MmCreateMirror(VOID);
+$endif (_NTDDK_)
+$if (_WDMDDK_ || _NTDDK_)
+#endif /* (NTDDI_VERSION >= NTDDI_WS03) */
+$endif
 $if (_WDMDDK_)
 #if (NTDDI_VERSION >= NTDDI_WS03SP1)
 NTKERNELAPI
@@ -635,6 +701,13 @@ MmAllocatePagesForMdlEx(
 $endif
 
 #if (NTDDI_VERSION >= NTDDI_VISTA)
+$if (_WDMDDK_)
+NTKERNELAPI
+LOGICAL
+NTAPI
+MmIsDriverVerifyingByAddress(
+  IN PVOID AddressWithinSection);
+$endif (_WDMDDK_)
 $if (_NTDDK_)
 NTSTATUS
 NTAPI
@@ -645,14 +718,14 @@ MmRotatePhysicalView(
   IN MM_ROTATE_DIRECTION Direction,
   IN PMM_ROTATE_COPY_CALLBACK_FUNCTION CopyFunction,
   IN PVOID Context OPTIONAL);
-$endif
+$endif (_NTDDK_)
+$if (_NTIFS_)
 
-$if (_WDMDDK_)
 NTKERNELAPI
-LOGICAL
+ULONG
 NTAPI
-MmIsDriverVerifyingByAddress(
-  IN PVOID AddressWithinSection);
-$endif
-#endif
+MmDoesFileHaveUserWritableReferences(
+  IN PSECTION_OBJECT_POINTERS SectionPointer);
+$endif (_NTIFS_)
+#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
 
index e4a23f4..82dc4f5 100644 (file)
@@ -145,7 +145,7 @@ typedef enum _MM_SYSTEM_SIZE {
 extern NTKERNELAPI BOOLEAN Mm64BitPhysicalAddress;
 extern PVOID MmBadPointer;
 
-$endif /* _WDMDDK_ */
+$endif (_WDMDDK_)
 $if (_NTDDK_)
 
 typedef struct _PHYSICAL_MEMORY_RANGE {
@@ -167,5 +167,81 @@ typedef enum _MM_ROTATE_DIRECTION {
   MmMaximumRotateDirection
 } MM_ROTATE_DIRECTION, *PMM_ROTATE_DIRECTION;
 
-$endif /* _NTDDK_ */
+$endif (_NTDDK_)
+$if (_NTIFS_)
+typedef enum _MMFLUSH_TYPE {
+  MmFlushForDelete,
+  MmFlushForWrite
+} MMFLUSH_TYPE;
+
+typedef struct _READ_LIST {
+  PFILE_OBJECT FileObject;
+  ULONG NumberOfEntries;
+  LOGICAL IsImage;
+  FILE_SEGMENT_ELEMENT List[ANYSIZE_ARRAY];
+} READ_LIST, *PREAD_LIST;
+
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+
+typedef union _MM_PREFETCH_FLAGS {
+  struct {
+    ULONG Priority : SYSTEM_PAGE_PRIORITY_BITS;
+    ULONG RepurposePriority : SYSTEM_PAGE_PRIORITY_BITS;
+  } Flags;
+  ULONG AllFlags;
+} MM_PREFETCH_FLAGS, *PMM_PREFETCH_FLAGS;
+
+#define MM_PREFETCH_FLAGS_MASK ((1 << (2*SYSTEM_PAGE_PRIORITY_BITS)) - 1)
+
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
+
+#define HEAP_NO_SERIALIZE               0x00000001
+#define HEAP_GROWABLE                   0x00000002
+#define HEAP_GENERATE_EXCEPTIONS        0x00000004
+#define HEAP_ZERO_MEMORY                0x00000008
+#define HEAP_REALLOC_IN_PLACE_ONLY      0x00000010
+#define HEAP_TAIL_CHECKING_ENABLED      0x00000020
+#define HEAP_FREE_CHECKING_ENABLED      0x00000040
+#define HEAP_DISABLE_COALESCE_ON_FREE   0x00000080
+
+#define HEAP_CREATE_ALIGN_16            0x00010000
+#define HEAP_CREATE_ENABLE_TRACING      0x00020000
+#define HEAP_CREATE_ENABLE_EXECUTE      0x00040000
+
+#define HEAP_SETTABLE_USER_VALUE        0x00000100
+#define HEAP_SETTABLE_USER_FLAG1        0x00000200
+#define HEAP_SETTABLE_USER_FLAG2        0x00000400
+#define HEAP_SETTABLE_USER_FLAG3        0x00000800
+#define HEAP_SETTABLE_USER_FLAGS        0x00000E00
+
+#define HEAP_CLASS_0                    0x00000000
+#define HEAP_CLASS_1                    0x00001000
+#define HEAP_CLASS_2                    0x00002000
+#define HEAP_CLASS_3                    0x00003000
+#define HEAP_CLASS_4                    0x00004000
+#define HEAP_CLASS_5                    0x00005000
+#define HEAP_CLASS_6                    0x00006000
+#define HEAP_CLASS_7                    0x00007000
+#define HEAP_CLASS_8                    0x00008000
+#define HEAP_CLASS_MASK                 0x0000F000
+
+#define HEAP_MAXIMUM_TAG                0x0FFF
+#define HEAP_GLOBAL_TAG                 0x0800
+#define HEAP_PSEUDO_TAG_FLAG            0x8000
+#define HEAP_TAG_SHIFT                  18
+#define HEAP_TAG_MASK                  (HEAP_MAXIMUM_TAG << HEAP_TAG_SHIFT)
+
+#define HEAP_CREATE_VALID_MASK         (HEAP_NO_SERIALIZE |             \
+                                        HEAP_GROWABLE |                 \
+                                        HEAP_GENERATE_EXCEPTIONS |      \
+                                        HEAP_ZERO_MEMORY |              \
+                                        HEAP_REALLOC_IN_PLACE_ONLY |    \
+                                        HEAP_TAIL_CHECKING_ENABLED |    \
+                                        HEAP_FREE_CHECKING_ENABLED |    \
+                                        HEAP_DISABLE_COALESCE_ON_FREE | \
+                                        HEAP_CLASS_MASK |               \
+                                        HEAP_CREATE_ALIGN_16 |          \
+                                        HEAP_CREATE_ENABLE_TRACING |    \
+                                        HEAP_CREATE_ENABLE_EXECUTE)
+$endif (_NTIFS_)
 
index 003e9b7..2d038a1 100644 (file)
 #include <ntdef.h>
 #include <ntstatus.h>
 #include <mce.h>
-
-/* FIXME
 #include <bugcodes.h>
 #include <ntiologc.h>
-*/
 
 #include <stdarg.h> // FIXME
 #include <basetyps.h> // FIXME
diff --git a/include/xdk/ntifs.template.h b/include/xdk/ntifs.template.h
new file mode 100644 (file)
index 0000000..8004464
--- /dev/null
@@ -0,0 +1,2238 @@
+/*
+ * ntifs.h
+ *
+ * Windows NT Filesystem Driver Developer Kit
+ *
+ * This file is part of the ReactOS DDK package.
+ *
+ * Contributors:
+ *   Amine Khaldi
+ *   Timo Kreuzer (timo.kreuzer@reactos.org)
+ *
+ * THIS SOFTWARE IS NOT COPYRIGHTED
+ *
+ * This source code is offered for use in the public domain. You may
+ * use, modify or distribute it freely.
+ *
+ * This code is distributed in the hope that it will be useful but
+ * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
+ * DISCLAIMED. This includes but is not limited to warranties of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ */
+
+#pragma once
+
+#define _NTIFS_INCLUDED_
+#define _GNU_NTIFS_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Dependencies */
+#include <ntddk.h>
+#include <excpt.h>
+#include <ntdef.h>
+#include <ntnls.h>
+#include <ntstatus.h>
+#include <bugcodes.h>
+#include <ntiologc.h>
+
+$define (_NTIFS_)
+
+#ifndef FlagOn
+#define FlagOn(_F,_SF)        ((_F) & (_SF))
+#endif
+
+#ifndef BooleanFlagOn
+#define BooleanFlagOn(F,SF)   ((BOOLEAN)(((F) & (SF)) != 0))
+#endif
+
+#ifndef SetFlag
+#define SetFlag(_F,_SF)       ((_F) |= (_SF))
+#endif
+
+#ifndef ClearFlag
+#define ClearFlag(_F,_SF)     ((_F) &= ~(_SF))
+#endif
+
+typedef UNICODE_STRING LSA_UNICODE_STRING, *PLSA_UNICODE_STRING;
+typedef STRING LSA_STRING, *PLSA_STRING;
+typedef OBJECT_ATTRIBUTES LSA_OBJECT_ATTRIBUTES, *PLSA_OBJECT_ATTRIBUTES;
+
+$include (setypes.h)
+$include (rtltypes.h)
+$include (rtlfuncs.h)
+
+typedef enum _OBJECT_INFORMATION_CLASS {
+  ObjectBasicInformation = 0,
+  ObjectNameInformation = 1, /* FIXME, not in WDK */
+  ObjectTypeInformation = 2,
+  Ob