Revert r46582, to see if it fixes the regtests
authorTimo Kreuzer <timo.kreuzer@reactos.org>
Mon, 19 Apr 2010 15:41:21 +0000 (15:41 +0000)
committerTimo Kreuzer <timo.kreuzer@reactos.org>
Mon, 19 Apr 2010 15:41:21 +0000 (15:41 +0000)
svn path=/trunk/; revision=46942

reactos/include/ddk/ntddk.h
reactos/include/ddk/ntifs.h
reactos/include/ddk/ntimage.h
reactos/include/ddk/wdm.h
reactos/include/ndk/ketypes.h

index fdd99d9..62c1f78 100644 (file)
@@ -1,13 +1,12 @@
 /*
  * ntddk.h
  *
- * Windows NT Device Driver Kit
+ * Windows Device Driver Kit
  *
- * This file is part of the ReactOS DDK package.
+ * This file is part of the w32api package.
  *
  * Contributors:
- *   Amine Khaldi
- *   Timo Kreuzer (timo.kreuzer@reactos.org)
+ *   Created by Casper S. Hornstrup <chorns@users.sourceforge.net>
  *
  * THIS SOFTWARE IS NOT COPYRIGHTED
  *
  * DISCLAIMED. This includes but is not limited to warranties of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
  *
+ * DEFINES:
+ *    DBG          - Debugging enabled/disabled (0/1)
+ *    POOL_TAGGING - Enable pool tagging
+ *    _X86_        - X86 environment
  */
 
-#pragma once
-
+#ifndef _NTDDK_
 #define _NTDDK_
 
 #if !defined(_NTHAL_) && !defined(_NTIFS_)
@@ -39,7 +41,6 @@
 #include <excpt.h>
 #include <ntdef.h>
 #include <ntstatus.h>
-#include <mce.h>
 
 /* FIXME
 #include <bugcodes.h>
 extern "C" {
 #endif
 
-/* GUID and UUID */
-#ifndef _NTLSA_IFS_
-#ifndef _NTLSA_AUDIT_
-#define _NTLSA_AUDIT_
+struct _LOADER_PARAMETER_BLOCK;
+struct _CREATE_DISK;
+struct _DRIVE_LAYOUT_INFORMATION_EX;
+struct _SET_PARTITION_INFORMATION_EX;
 
+//
+// GUID and UUID
+//
 #ifndef GUID_DEFINED
 #include <guiddef.h>
 #endif
-
-#endif /* _NTLSA_AUDIT_ */
-#endif /* _NTLSA_IFS_ */
-
 typedef GUID UUID;
 
-struct _LOADER_PARAMETER_BLOCK;
-struct _CREATE_DISK;
-struct _DRIVE_LAYOUT_INFORMATION_EX;
-struct _SET_PARTITION_INFORMATION_EX;
-
 typedef struct _BUS_HANDLER *PBUS_HANDLER;
-typedef struct _DEVICE_HANDLER_OBJECT *PDEVICE_HANDLER_OBJECT;
-#if defined(_NTHAL_INCLUDED_)
-typedef struct _KAFFINITY_EX *PKAFFINITY_EX;
-#endif
-typedef struct _PEB *PPEB;
 
-#ifndef _NTIMAGE_
+typedef struct _PEB *PPEB;
 
-typedef struct _IMAGE_NT_HEADERS *PIMAGE_NT_HEADERS32;
-typedef struct _IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64;
+#define EXCEPTION_READ_FAULT    0
+#define EXCEPTION_WRITE_FAULT   1
+#define EXCEPTION_EXECUTE_FAULT 8
 
-#ifdef _WIN64
-typedef PIMAGE_NT_HEADERS64 PIMAGE_NT_HEADERS;
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+extern NTSYSAPI volatile CCHAR KeNumberProcessors;
+#elif (NTDDI_VERSION >= NTDDI_WINXP)
+extern NTSYSAPI CCHAR KeNumberProcessors;
 #else
-typedef PIMAGE_NT_HEADERS32 PIMAGE_NT_HEADERS;
+extern PCCHAR KeNumberProcessors;
 #endif
 
-#endif /* _NTIMAGE_ */
-
-/******************************************************************************
- *                            Executive Types                                 *
- ******************************************************************************/
-
-typedef struct _ZONE_SEGMENT_HEADER {
-  SINGLE_LIST_ENTRY SegmentList;
-  PVOID Reserved;
-} ZONE_SEGMENT_HEADER, *PZONE_SEGMENT_HEADER;
-
-typedef struct _ZONE_HEADER {
-  SINGLE_LIST_ENTRY FreeList;
-  SINGLE_LIST_ENTRY SegmentList;
-  ULONG BlockSize;
-  ULONG TotalSegmentSize;
-} ZONE_HEADER, *PZONE_HEADER;
-
-#define PROTECTED_POOL                    0x80000000
-
-
-/******************************************************************************
- *                         I/O Manager Types                                  *
- ******************************************************************************/
-
-/* DEVICE_OBJECT.Flags */
-#define DO_DEVICE_HAS_NAME                0x00000040
-#define DO_SYSTEM_BOOT_PARTITION          0x00000100
-#define DO_LONG_TERM_REQUESTS             0x00000200
-#define DO_NEVER_LAST_DEVICE              0x00000400
-#define DO_LOW_PRIORITY_FILESYSTEM        0x00010000
-#define DO_SUPPORTS_TRANSACTIONS          0x00040000
-#define DO_FORCE_NEITHER_IO               0x00080000
-#define DO_VOLUME_DEVICE_OBJECT           0x00100000
-#define DO_SYSTEM_SYSTEM_PARTITION        0x00200000
-#define DO_SYSTEM_CRITICAL_PARTITION      0x00400000
-#define DO_DISALLOW_EXECUTE               0x00800000
+#define MAX_WOW64_SHARED_ENTRIES 16
 
-#ifndef _ARC_DDK_
-#define _ARC_DDK_
-typedef enum _CONFIGURATION_TYPE {
-  ArcSystem,
-  CentralProcessor,
-  FloatingPointProcessor,
-  PrimaryIcache,
-  PrimaryDcache,
-  SecondaryIcache,
-  SecondaryDcache,
-  SecondaryCache,
-  EisaAdapter,
-  TcAdapter,
-  ScsiAdapter,
-  DtiAdapter,
-  MultiFunctionAdapter,
-  DiskController,
-  TapeController,
-  CdromController,
-  WormController,
-  SerialController,
-  NetworkController,
-  DisplayController,
-  ParallelController,
-  PointerController,
-  KeyboardController,
-  AudioController,
-  OtherController,
-  DiskPeripheral,
-  FloppyDiskPeripheral,
-  TapePeripheral,
-  ModemPeripheral,
-  MonitorPeripheral,
-  PrinterPeripheral,
-  PointerPeripheral,
-  KeyboardPeripheral,
-  TerminalPeripheral,
-  OtherPeripheral,
-  LinePeripheral,
-  NetworkPeripheral,
-  SystemMemory,
-  DockingInformation,
-  RealModeIrqRoutingTable,
-  RealModePCIEnumeration,
-  MaximumType
-} CONFIGURATION_TYPE, *PCONFIGURATION_TYPE;
-#endif /* !_ARC_DDK_ */
+#define NX_SUPPORT_POLICY_ALWAYSOFF 0
+#define NX_SUPPORT_POLICY_ALWAYSON 1
+#define NX_SUPPORT_POLICY_OPTIN 2
+#define NX_SUPPORT_POLICY_OPTOUT 3
 
 /*
 ** IRP function codes
@@ -210,118 +124,102 @@ typedef enum _CONFIGURATION_TYPE {
 
 #define IRP_MN_QUERY_LEGACY_BUS_INFORMATION 0x18
 
-#define IO_CHECK_CREATE_PARAMETERS      0x0200
-#define IO_ATTACH_DEVICE                0x0400
-#define IO_IGNORE_SHARE_ACCESS_CHECK    0x0800
+typedef struct _IO_COUNTERS {
+  ULONGLONG ReadOperationCount;
+  ULONGLONG WriteOperationCount;
+  ULONGLONG OtherOperationCount;
+  ULONGLONG ReadTransferCount;
+  ULONGLONG WriteTransferCount;
+  ULONGLONG OtherTransferCount;
+} IO_COUNTERS, *PIO_COUNTERS;
 
-typedef
-NTSTATUS
-(NTAPI *PIO_QUERY_DEVICE_ROUTINE)(
-  IN PVOID Context,
-  IN PUNICODE_STRING PathName,
-  IN INTERFACE_TYPE BusType,
-  IN ULONG BusNumber,
-  IN PKEY_VALUE_FULL_INFORMATION *BusInformation,
-  IN CONFIGURATION_TYPE ControllerType,
-  IN ULONG ControllerNumber,
-  IN PKEY_VALUE_FULL_INFORMATION *ControllerInformation,
-  IN CONFIGURATION_TYPE PeripheralType,
-  IN ULONG PeripheralNumber,
-  IN PKEY_VALUE_FULL_INFORMATION *PeripheralInformation);
+typedef struct _VM_COUNTERS {
+  SIZE_T PeakVirtualSize;
+  SIZE_T VirtualSize;
+  ULONG PageFaultCount;
+  SIZE_T PeakWorkingSetSize;
+  SIZE_T WorkingSetSize;
+  SIZE_T QuotaPeakPagedPoolUsage;
+  SIZE_T QuotaPagedPoolUsage;
+  SIZE_T QuotaPeakNonPagedPoolUsage;
+  SIZE_T QuotaNonPagedPoolUsage;
+  SIZE_T PagefileUsage;
+  SIZE_T PeakPagefileUsage;
+} VM_COUNTERS, *PVM_COUNTERS;
 
-typedef enum _IO_QUERY_DEVICE_DATA_FORMAT {
-  IoQueryDeviceIdentifier = 0,
-  IoQueryDeviceConfigurationData,
-  IoQueryDeviceComponentInformation,
-  IoQueryDeviceMaxData
-} IO_QUERY_DEVICE_DATA_FORMAT, *PIO_QUERY_DEVICE_DATA_FORMAT;
+typedef struct _VM_COUNTERS_EX
+{
+  SIZE_T PeakVirtualSize;
+  SIZE_T VirtualSize;
+  ULONG PageFaultCount;
+  SIZE_T PeakWorkingSetSize;
+  SIZE_T WorkingSetSize;
+  SIZE_T QuotaPeakPagedPoolUsage;
+  SIZE_T QuotaPagedPoolUsage;
+  SIZE_T QuotaPeakNonPagedPoolUsage;
+  SIZE_T QuotaNonPagedPoolUsage;
+  SIZE_T PagefileUsage;
+  SIZE_T PeakPagefileUsage;
+  SIZE_T PrivateUsage;
+} VM_COUNTERS_EX, *PVM_COUNTERS_EX;
 
-typedef VOID
-(NTAPI *PDRIVER_REINITIALIZE)(
-  IN struct _DRIVER_OBJECT *DriverObject,
-  IN PVOID Context OPTIONAL,
-  IN ULONG Count);
+typedef struct _POOLED_USAGE_AND_LIMITS
+{
+  SIZE_T PeakPagedPoolUsage;
+  SIZE_T PagedPoolUsage;
+  SIZE_T PagedPoolLimit;
+  SIZE_T PeakNonPagedPoolUsage;
+  SIZE_T NonPagedPoolUsage;
+  SIZE_T NonPagedPoolLimit;
+  SIZE_T PeakPagefileUsage;
+  SIZE_T PagefileUsage;
+  SIZE_T PagefileLimit;
+} POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS;
 
-typedef struct _CONTROLLER_OBJECT {
-  CSHORT Type;
-  CSHORT Size;
-  PVOID ControllerExtension;
-  KDEVICE_QUEUE DeviceWaitQueue;
-  ULONG Spare1;
-  LARGE_INTEGER Spare2;
-} CONTROLLER_OBJECT, *PCONTROLLER_OBJECT;
+/* DEVICE_OBJECT.Flags */
+
+#define DO_VERIFY_VOLUME                    0x00000002
+#define DO_BUFFERED_IO                      0x00000004
+#define DO_EXCLUSIVE                        0x00000008
+#define DO_DIRECT_IO                        0x00000010
+#define DO_MAP_IO_BUFFER                    0x00000020
+#define DO_DEVICE_HAS_NAME                  0x00000040
+#define DO_DEVICE_INITIALIZING              0x00000080
+#define DO_SYSTEM_BOOT_PARTITION            0x00000100
+#define DO_LONG_TERM_REQUESTS               0x00000200
+#define DO_NEVER_LAST_DEVICE                0x00000400
+#define DO_SHUTDOWN_REGISTERED              0x00000800
+#define DO_BUS_ENUMERATED_DEVICE            0x00001000
+#define DO_POWER_PAGABLE                    0x00002000
+#define DO_POWER_INRUSH                     0x00004000
+#define DO_LOW_PRIORITY_FILESYSTEM          0x00010000
+#define DO_SUPPORTS_TRANSACTIONS            0x00040000
+#define DO_FORCE_NEITHER_IO                 0x00080000
+#define DO_VOLUME_DEVICE_OBJECT             0x00100000
+#define DO_SYSTEM_SYSTEM_PARTITION          0x00200000
+#define DO_SYSTEM_CRITICAL_PARTITION        0x00400000
+#define DO_DISALLOW_EXECUTE                 0x00800000
 
 #define DRVO_REINIT_REGISTERED          0x00000008
 #define DRVO_INITIALIZED                0x00000010
 #define DRVO_BOOTREINIT_REGISTERED      0x00000020
 #define DRVO_LEGACY_RESOURCES           0x00000040
 
-typedef struct _CONFIGURATION_INFORMATION {
-  ULONG DiskCount;
-  ULONG FloppyCount;
-  ULONG CdRomCount;
-  ULONG TapeCount;
-  ULONG ScsiPortCount;
-  ULONG SerialCount;
-  ULONG ParallelCount;
-  BOOLEAN AtDiskPrimaryAddressClaimed;
-  BOOLEAN AtDiskSecondaryAddressClaimed;
-  ULONG Version;
-  ULONG MediumChangerCount;
-} CONFIGURATION_INFORMATION, *PCONFIGURATION_INFORMATION;
-
-typedef struct _DISK_SIGNATURE {
-  ULONG PartitionStyle;
-  _ANONYMOUS_UNION union {
-    struct {
-      ULONG Signature;
-      ULONG CheckSum;
-    } Mbr;
-    struct {
-      GUID DiskId;
-    } Gpt;
-  } DUMMYUNIONNAME;
-} DISK_SIGNATURE, *PDISK_SIGNATURE;
-
-typedef struct _TXN_PARAMETER_BLOCK {
-  USHORT Length;
-  USHORT TxFsContext;
-  PVOID TransactionObject;
-} TXN_PARAMETER_BLOCK, *PTXN_PARAMETER_BLOCK;
-
-#define TXF_MINIVERSION_DEFAULT_VIEW        (0xFFFE)
-
-typedef struct _IO_DRIVER_CREATE_CONTEXT {
-  CSHORT Size;
-  struct _ECP_LIST *ExtraCreateParameter;
-  PVOID DeviceObjectHint;
-  PTXN_PARAMETER_BLOCK TxnParameters;
-} IO_DRIVER_CREATE_CONTEXT, *PIO_DRIVER_CREATE_CONTEXT;
-
-typedef struct _AGP_TARGET_BUS_INTERFACE_STANDARD {
-  USHORT Size;
-  USHORT Version;
-  PVOID Context;
-  PINTERFACE_REFERENCE InterfaceReference;
-  PINTERFACE_DEREFERENCE InterfaceDereference;
-  PGET_SET_DEVICE_DATA SetBusData;
-  PGET_SET_DEVICE_DATA GetBusData;
-  UCHAR CapabilityID;
-} AGP_TARGET_BUS_INTERFACE_STANDARD, *PAGP_TARGET_BUS_INTERFACE_STANDARD;
-
-typedef NTSTATUS
-(NTAPI *PGET_LOCATION_STRING)(
-  IN OUT PVOID Context OPTIONAL,
-  OUT PWCHAR *LocationStrings);
+typedef enum _ARBITER_REQUEST_SOURCE {
+  ArbiterRequestUndefined = -1,
+  ArbiterRequestLegacyReported,
+  ArbiterRequestHalReported,
+  ArbiterRequestLegacyAssigned,
+  ArbiterRequestPnpDetected,
+  ArbiterRequestPnpEnumerated
+} ARBITER_REQUEST_SOURCE;
 
-typedef struct _PNP_LOCATION_INTERFACE {
-  USHORT Size;
-  USHORT Version;
-  PVOID Context;
-  PINTERFACE_REFERENCE InterfaceReference;
-  PINTERFACE_DEREFERENCE InterfaceDereference;
-  PGET_LOCATION_STRING GetLocationString;
-} PNP_LOCATION_INTERFACE, *PPNP_LOCATION_INTERFACE;
+typedef enum _ARBITER_RESULT {
+  ArbiterResultUndefined = -1,
+  ArbiterResultSuccess,
+  ArbiterResultExternalConflict,
+  ArbiterResultNullRequest
+} ARBITER_RESULT;
 
 typedef enum _ARBITER_ACTION {
   ArbiterActionTestAllocation,
@@ -342,69 +240,39 @@ typedef struct _ARBITER_CONFLICT_INFO {
   ULONGLONG End;
 } ARBITER_CONFLICT_INFO, *PARBITER_CONFLICT_INFO;
 
-typedef struct _ARBITER_TEST_ALLOCATION_PARAMETERS {
+typedef struct _ARBITER_PARAMETERS {
+  union {
+    struct {
       IN OUT PLIST_ENTRY ArbitrationList;
       IN ULONG AllocateFromCount;
       IN PCM_PARTIAL_RESOURCE_DESCRIPTOR AllocateFrom;
-} ARBITER_TEST_ALLOCATION_PARAMETERS, *PARBITER_TEST_ALLOCATION_PARAMETERS;
-
-typedef struct _ARBITER_RETEST_ALLOCATION_PARAMETERS {
+    } TestAllocation;
+    struct {
       IN OUT PLIST_ENTRY ArbitrationList;
       IN ULONG AllocateFromCount;
       IN PCM_PARTIAL_RESOURCE_DESCRIPTOR AllocateFrom;
-} ARBITER_RETEST_ALLOCATION_PARAMETERS, *PARBITER_RETEST_ALLOCATION_PARAMETERS;
-
-typedef struct _ARBITER_BOOT_ALLOCATION_PARAMETERS {
+    } RetestAllocation;
+    struct {
       IN OUT PLIST_ENTRY ArbitrationList;
-} ARBITER_BOOT_ALLOCATION_PARAMETERS, *PARBITER_BOOT_ALLOCATION_PARAMETERS;
-
-typedef struct _ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS {
+    } BootAllocation;
+    struct {
       OUT PCM_PARTIAL_RESOURCE_LIST *AllocatedResources;
-} ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS, *PARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS;
-
-typedef struct _ARBITER_QUERY_CONFLICT_PARAMETERS {
+    } QueryAllocatedResources;
+    struct {
       IN PDEVICE_OBJECT PhysicalDeviceObject;
       IN PIO_RESOURCE_DESCRIPTOR ConflictingResource;
       OUT PULONG ConflictCount;
       OUT PARBITER_CONFLICT_INFO *Conflicts;
-} ARBITER_QUERY_CONFLICT_PARAMETERS, *PARBITER_QUERY_CONFLICT_PARAMETERS;
-
-typedef struct _ARBITER_QUERY_ARBITRATE_PARAMETERS {
+    } QueryConflict;
+    struct {
       IN PLIST_ENTRY ArbitrationList;
-} ARBITER_QUERY_ARBITRATE_PARAMETERS, *PARBITER_QUERY_ARBITRATE_PARAMETERS;
-
-typedef struct _ARBITER_ADD_RESERVED_PARAMETERS {
+    } QueryArbitrate;
+    struct {
       IN PDEVICE_OBJECT ReserveDevice;
-} ARBITER_ADD_RESERVED_PARAMETERS, *PARBITER_ADD_RESERVED_PARAMETERS;
-
-typedef struct _ARBITER_PARAMETERS {
-  union {
-    ARBITER_TEST_ALLOCATION_PARAMETERS TestAllocation;
-    ARBITER_RETEST_ALLOCATION_PARAMETERS RetestAllocation;
-    ARBITER_BOOT_ALLOCATION_PARAMETERS BootAllocation;
-    ARBITER_QUERY_ALLOCATED_RESOURCES_PARAMETERS QueryAllocatedResources;
-    ARBITER_QUERY_CONFLICT_PARAMETERS QueryConflict;
-    ARBITER_QUERY_ARBITRATE_PARAMETERS QueryArbitrate;
-    ARBITER_ADD_RESERVED_PARAMETERS AddReserved;
+    } AddReserved;
   } Parameters;
 } ARBITER_PARAMETERS, *PARBITER_PARAMETERS;
 
-typedef enum _ARBITER_REQUEST_SOURCE {
-  ArbiterRequestUndefined = -1,
-  ArbiterRequestLegacyReported,
-  ArbiterRequestHalReported,
-  ArbiterRequestLegacyAssigned,
-  ArbiterRequestPnpDetected,
-  ArbiterRequestPnpEnumerated
-} ARBITER_REQUEST_SOURCE;
-
-typedef enum _ARBITER_RESULT {
-  ArbiterResultUndefined = -1,
-  ArbiterResultSuccess,
-  ArbiterResultExternalConflict,
-  ArbiterResultNullRequest
-} ARBITER_RESULT;
-
 #define ARBITER_FLAG_BOOT_CONFIG 0x00000001
 
 typedef struct _ARBITER_LIST_ENTRY {
@@ -441,826 +309,6 @@ typedef struct _ARBITER_INTERFACE {
   ULONG Flags;
 } ARBITER_INTERFACE, *PARBITER_INTERFACE;
 
-typedef enum _RESOURCE_TRANSLATION_DIRECTION {
-  TranslateChildToParent,
-  TranslateParentToChild
-} RESOURCE_TRANSLATION_DIRECTION;
-
-typedef NTSTATUS
-(NTAPI *PTRANSLATE_RESOURCE_HANDLER)(
-  IN OUT PVOID Context OPTIONAL,
-  IN PCM_PARTIAL_RESOURCE_DESCRIPTOR Source,
-  IN RESOURCE_TRANSLATION_DIRECTION Direction,
-  IN ULONG AlternativesCount OPTIONAL,
-  IN IO_RESOURCE_DESCRIPTOR Alternatives[],
-  IN PDEVICE_OBJECT PhysicalDeviceObject,
-  OUT PCM_PARTIAL_RESOURCE_DESCRIPTOR Target);
-
-typedef NTSTATUS
-(NTAPI *PTRANSLATE_RESOURCE_REQUIREMENTS_HANDLER)(
-  IN OUT PVOID Context OPTIONAL,
-  IN PIO_RESOURCE_DESCRIPTOR Source,
-  IN PDEVICE_OBJECT PhysicalDeviceObject,
-  OUT PULONG TargetCount,
-  OUT PIO_RESOURCE_DESCRIPTOR *Target);
-
-typedef struct _TRANSLATOR_INTERFACE {
-  USHORT Size;
-  USHORT Version;
-  PVOID Context;
-  PINTERFACE_REFERENCE InterfaceReference;
-  PINTERFACE_DEREFERENCE InterfaceDereference;
-  PTRANSLATE_RESOURCE_HANDLER TranslateResources;
-  PTRANSLATE_RESOURCE_REQUIREMENTS_HANDLER TranslateResourceRequirements;
-} TRANSLATOR_INTERFACE, *PTRANSLATOR_INTERFACE;
-
-typedef struct _PCI_AGP_CAPABILITY {
-  PCI_CAPABILITIES_HEADER Header;
-  USHORT Minor:4;
-  USHORT Major:4;
-  USHORT Rsvd1:8;
-  struct _PCI_AGP_STATUS {
-    ULONG Rate:3;
-    ULONG Agp3Mode:1;
-    ULONG FastWrite:1;
-    ULONG FourGB:1;
-    ULONG HostTransDisable:1;
-    ULONG Gart64:1;
-    ULONG ITA_Coherent:1;
-    ULONG SideBandAddressing:1;
-    ULONG CalibrationCycle:3;
-    ULONG AsyncRequestSize:3;
-    ULONG Rsvd1:1;
-    ULONG Isoch:1;
-    ULONG Rsvd2:6;
-    ULONG RequestQueueDepthMaximum:8;
-  } AGPStatus;
-  struct _PCI_AGP_COMMAND {
-    ULONG Rate:3;
-    ULONG Rsvd1:1;
-    ULONG FastWriteEnable:1;
-    ULONG FourGBEnable:1;
-    ULONG Rsvd2:1;
-    ULONG Gart64:1;
-    ULONG AGPEnable:1;
-    ULONG SBAEnable:1;
-    ULONG CalibrationCycle:3;
-    ULONG AsyncReqSize:3;
-    ULONG Rsvd3:8;
-    ULONG RequestQueueDepth:8;
-  } AGPCommand;
-} PCI_AGP_CAPABILITY, *PPCI_AGP_CAPABILITY;
-
-typedef enum _EXTENDED_AGP_REGISTER {
-  IsochStatus,
-  AgpControl,
-  ApertureSize,
-  AperturePageSize,
-  GartLow,
-  GartHigh,
-  IsochCommand
-} EXTENDED_AGP_REGISTER, *PEXTENDED_AGP_REGISTER;
-
-typedef struct _PCI_AGP_ISOCH_STATUS {
-  ULONG ErrorCode:2;
-  ULONG Rsvd1:1;
-  ULONG Isoch_L:3;
-  ULONG Isoch_Y:2;
-  ULONG Isoch_N:8;
-  ULONG Rsvd2:16;
-} PCI_AGP_ISOCH_STATUS, *PPCI_AGP_ISOCH_STATUS;
-
-typedef struct _PCI_AGP_CONTROL {
-  ULONG Rsvd1:7;
-  ULONG GTLB_Enable:1;
-  ULONG AP_Enable:1;
-  ULONG CAL_Disable:1;
-  ULONG Rsvd2:22;
-} PCI_AGP_CONTROL, *PPCI_AGP_CONTROL;
-
-typedef struct _PCI_AGP_APERTURE_PAGE_SIZE {
-  USHORT PageSizeMask:11;
-  USHORT Rsvd1:1;
-  USHORT PageSizeSelect:4;
-} PCI_AGP_APERTURE_PAGE_SIZE, *PPCI_AGP_APERTURE_PAGE_SIZE;
-
-typedef struct _PCI_AGP_ISOCH_COMMAND {
-  USHORT Rsvd1:6;
-  USHORT Isoch_Y:2;
-  USHORT Isoch_N:8;
-} PCI_AGP_ISOCH_COMMAND, *PPCI_AGP_ISOCH_COMMAND;
-
-typedef struct PCI_AGP_EXTENDED_CAPABILITY {
-  PCI_AGP_ISOCH_STATUS IsochStatus;
-  PCI_AGP_CONTROL AgpControl;
-  USHORT ApertureSize;
-  PCI_AGP_APERTURE_PAGE_SIZE AperturePageSize;
-  ULONG GartLow;
-  ULONG GartHigh;
-  PCI_AGP_ISOCH_COMMAND IsochCommand;
-} PCI_AGP_EXTENDED_CAPABILITY, *PPCI_AGP_EXTENDED_CAPABILITY;
-
-#define PCI_AGP_RATE_1X     0x1
-#define PCI_AGP_RATE_2X     0x2
-#define PCI_AGP_RATE_4X     0x4
-
-#define PCIX_MODE_CONVENTIONAL_PCI  0x0
-#define PCIX_MODE1_66MHZ            0x1
-#define PCIX_MODE1_100MHZ           0x2
-#define PCIX_MODE1_133MHZ           0x3
-#define PCIX_MODE2_266_66MHZ        0x9
-#define PCIX_MODE2_266_100MHZ       0xA
-#define PCIX_MODE2_266_133MHZ       0xB
-#define PCIX_MODE2_533_66MHZ        0xD
-#define PCIX_MODE2_533_100MHZ       0xE
-#define PCIX_MODE2_533_133MHZ       0xF
-
-#define PCIX_VERSION_MODE1_ONLY     0x0
-#define PCIX_VERSION_MODE2_ECC      0x1
-#define PCIX_VERSION_DUAL_MODE_ECC  0x2
-
-typedef struct _PCIX_BRIDGE_CAPABILITY {
-  PCI_CAPABILITIES_HEADER Header;
-  union {
-    struct {
-      USHORT Bus64Bit:1;
-      USHORT Bus133MHzCapable:1;
-      USHORT SplitCompletionDiscarded:1;
-      USHORT UnexpectedSplitCompletion:1;
-      USHORT SplitCompletionOverrun:1;
-      USHORT SplitRequestDelayed:1;
-      USHORT BusModeFrequency:4;
-      USHORT Rsvd:2;
-      USHORT Version:2;
-      USHORT Bus266MHzCapable:1;
-      USHORT Bus533MHzCapable:1;
-    } DUMMYSTRUCTNAME;
-  USHORT AsUSHORT;
-  } SecondaryStatus;
-  union {
-    struct {
-      ULONG FunctionNumber:3;
-      ULONG DeviceNumber:5;
-      ULONG BusNumber:8;
-      ULONG Device64Bit:1;
-      ULONG Device133MHzCapable:1;
-      ULONG SplitCompletionDiscarded:1;
-      ULONG UnexpectedSplitCompletion:1;
-      ULONG SplitCompletionOverrun:1;
-      ULONG SplitRequestDelayed:1;
-      ULONG Rsvd:7;
-      ULONG DIMCapable:1;
-      ULONG Device266MHzCapable:1;
-      ULONG Device533MHzCapable:1;
-    } DUMMYSTRUCTNAME;
-    ULONG AsULONG;
-  } BridgeStatus;
-  USHORT UpstreamSplitTransactionCapacity;
-  USHORT UpstreamSplitTransactionLimit;
-  USHORT DownstreamSplitTransactionCapacity;
-  USHORT DownstreamSplitTransactionLimit;
-  union {
-    struct {
-      ULONG SelectSecondaryRegisters:1;
-      ULONG ErrorPresentInOtherBank:1;
-      ULONG AdditionalCorrectableError:1;
-      ULONG AdditionalUncorrectableError:1;
-      ULONG ErrorPhase:3;
-      ULONG ErrorCorrected:1;
-      ULONG Syndrome:8;
-      ULONG ErrorFirstCommand:4;
-      ULONG ErrorSecondCommand:4;
-      ULONG ErrorUpperAttributes:4;
-      ULONG ControlUpdateEnable:1;
-      ULONG Rsvd:1;
-      ULONG DisableSingleBitCorrection:1;
-      ULONG EccMode:1;
-    } DUMMYSTRUCTNAME;
-  ULONG AsULONG;
-  } EccControlStatus;
-  ULONG EccFirstAddress;
-  ULONG EccSecondAddress;
-  ULONG EccAttribute;
-} PCIX_BRIDGE_CAPABILITY, *PPCIX_BRIDGE_CAPABILITY;
-
-typedef struct _PCI_SUBSYSTEM_IDS_CAPABILITY {
-  PCI_CAPABILITIES_HEADER Header;
-  USHORT Reserved;
-  USHORT SubVendorID;
-  USHORT SubSystemID;
-} PCI_SUBSYSTEM_IDS_CAPABILITY, *PPCI_SUBSYSTEM_IDS_CAPABILITY;
-
-#define OSC_FIRMWARE_FAILURE                            0x02
-#define OSC_UNRECOGNIZED_UUID                           0x04
-#define OSC_UNRECOGNIZED_REVISION                       0x08
-#define OSC_CAPABILITIES_MASKED                         0x10
-
-#define PCI_ROOT_BUS_OSC_METHOD_CAPABILITY_REVISION     0x01
-
-typedef struct _PCI_ROOT_BUS_OSC_SUPPORT_FIELD {
-  union {
-    struct {
-      ULONG ExtendedConfigOpRegions:1;
-      ULONG ActiveStatePowerManagement:1;
-      ULONG ClockPowerManagement:1;
-      ULONG SegmentGroups:1;
-      ULONG MessageSignaledInterrupts:1;
-      ULONG WindowsHardwareErrorArchitecture:1;
-      ULONG Reserved:26;
-    } DUMMYSTRUCTNAME;
-    ULONG AsULONG;
-  } u;
-} PCI_ROOT_BUS_OSC_SUPPORT_FIELD, *PPCI_ROOT_BUS_OSC_SUPPORT_FIELD;
-
-typedef struct _PCI_ROOT_BUS_OSC_CONTROL_FIELD {
-  union {
-    struct {
-      ULONG ExpressNativeHotPlug:1;
-      ULONG ShpcNativeHotPlug:1;
-      ULONG ExpressNativePME:1;
-      ULONG ExpressAdvancedErrorReporting:1;
-      ULONG ExpressCapabilityStructure:1;
-      ULONG Reserved:27;
-    } DUMMYSTRUCTNAME;
-  ULONG AsULONG;
-  } u;
-} PCI_ROOT_BUS_OSC_CONTROL_FIELD, *PPCI_ROOT_BUS_OSC_CONTROL_FIELD;
-
-typedef enum _PCI_HARDWARE_INTERFACE {
-  PciConventional,
-  PciXMode1,
-  PciXMode2,
-  PciExpress
-} PCI_HARDWARE_INTERFACE, *PPCI_HARDWARE_INTERFACE;
-
-typedef enum {
-  BusWidth32Bits,
-  BusWidth64Bits
-} PCI_BUS_WIDTH;
-
-typedef struct _PCI_ROOT_BUS_HARDWARE_CAPABILITY {
-  PCI_HARDWARE_INTERFACE SecondaryInterface;
-  struct {
-    BOOLEAN BusCapabilitiesFound;
-    ULONG CurrentSpeedAndMode;
-    ULONG SupportedSpeedsAndModes;
-    BOOLEAN DeviceIDMessagingCapable;
-    PCI_BUS_WIDTH SecondaryBusWidth;
-  } DUMMYSTRUCTNAME;
-  PCI_ROOT_BUS_OSC_SUPPORT_FIELD OscFeatureSupport;
-  PCI_ROOT_BUS_OSC_CONTROL_FIELD OscControlRequest;
-  PCI_ROOT_BUS_OSC_CONTROL_FIELD OscControlGranted;
-} PCI_ROOT_BUS_HARDWARE_CAPABILITY, *PPCI_ROOT_BUS_HARDWARE_CAPABILITY;
-
-typedef union _PCI_EXPRESS_CAPABILITIES_REGISTER {
-  struct {
-    USHORT CapabilityVersion:4;
-    USHORT DeviceType:4;
-    USHORT SlotImplemented:1;
-    USHORT InterruptMessageNumber:5;
-    USHORT Rsvd:2;
-  } DUMMYSTRUCTNAME;
-  USHORT AsUSHORT;
-} PCI_EXPRESS_CAPABILITIES_REGISTER, *PPCI_EXPRESS_CAPABILITIES_REGISTER;
-
-typedef union _PCI_EXPRESS_DEVICE_CAPABILITIES_REGISTER {
-  struct {
-    ULONG MaxPayloadSizeSupported:3;
-    ULONG PhantomFunctionsSupported:2;
-    ULONG ExtendedTagSupported:1;
-    ULONG L0sAcceptableLatency:3;
-    ULONG L1AcceptableLatency:3;
-    ULONG Undefined:3;
-    ULONG RoleBasedErrorReporting:1;
-    ULONG Rsvd1:2;
-    ULONG CapturedSlotPowerLimit:8;
-    ULONG CapturedSlotPowerLimitScale:2;
-    ULONG Rsvd2:4;
-  } DUMMYSTRUCTNAME;
-  ULONG AsULONG;
-} PCI_EXPRESS_DEVICE_CAPABILITIES_REGISTER, *PPCI_EXPRESS_DEVICE_CAPABILITIES_REGISTER;
-
-#define PCI_EXPRESS_AER_DEVICE_CONTROL_MASK 0x07;
-
-typedef union _PCI_EXPRESS_DEVICE_CONTROL_REGISTER {
-  struct {
-    USHORT CorrectableErrorEnable:1;
-    USHORT NonFatalErrorEnable:1;
-    USHORT FatalErrorEnable:1;
-    USHORT UnsupportedRequestErrorEnable:1;
-    USHORT EnableRelaxedOrder:1;
-    USHORT MaxPayloadSize:3;
-    USHORT ExtendedTagEnable:1;
-    USHORT PhantomFunctionsEnable:1;
-    USHORT AuxPowerEnable:1;
-    USHORT NoSnoopEnable:1;
-    USHORT MaxReadRequestSize:3;
-    USHORT BridgeConfigRetryEnable:1;
-  } DUMMYSTRUCTNAME;
-  USHORT AsUSHORT;
-} PCI_EXPRESS_DEVICE_CONTROL_REGISTER, *PPCI_EXPRESS_DEVICE_CONTROL_REGISTER;
-
-#define PCI_EXPRESS_AER_DEVICE_STATUS_MASK 0x0F;
-
-typedef union _PCI_EXPRESS_DEVICE_STATUS_REGISTER {
-  struct {
-    USHORT CorrectableErrorDetected:1;
-    USHORT NonFatalErrorDetected:1;
-    USHORT FatalErrorDetected:1;
-    USHORT UnsupportedRequestDetected:1;
-    USHORT AuxPowerDetected:1;
-    USHORT TransactionsPending:1;
-    USHORT Rsvd:10;
-  } DUMMYSTRUCTNAME;
-  USHORT AsUSHORT;
-} PCI_EXPRESS_DEVICE_STATUS_REGISTER, *PPCI_EXPRESS_DEVICE_STATUS_REGISTER;
-
-typedef union _PCI_EXPRESS_LINK_CAPABILITIES_REGISTER {
-  struct {
-    ULONG MaximumLinkSpeed:4;
-    ULONG MaximumLinkWidth:6;
-    ULONG ActiveStatePMSupport:2;
-    ULONG L0sExitLatency:3;
-    ULONG L1ExitLatency:3;
-    ULONG ClockPowerManagement:1;
-    ULONG SurpriseDownErrorReportingCapable:1;
-    ULONG DataLinkLayerActiveReportingCapable:1;
-    ULONG Rsvd:3;
-    ULONG PortNumber:8;
-  } DUMMYSTRUCTNAME;
-  ULONG AsULONG;
-} PCI_EXPRESS_LINK_CAPABILITIES_REGISTER, *PPCI_EXPRESS_LINK_CAPABILITIES_REGISTER;
-
-typedef union _PCI_EXPRESS_LINK_CONTROL_REGISTER {
-  struct {
-    USHORT ActiveStatePMControl:2;
-    USHORT Rsvd1:1;
-    USHORT ReadCompletionBoundary:1;
-    USHORT LinkDisable:1;
-    USHORT RetrainLink:1;
-    USHORT CommonClockConfig:1;
-    USHORT ExtendedSynch:1;
-    USHORT EnableClockPowerManagement:1;
-    USHORT Rsvd2:7;
-  } DUMMYSTRUCTNAME;
-  USHORT AsUSHORT;
-} PCI_EXPRESS_LINK_CONTROL_REGISTER, *PPCI_EXPRESS_LINK_CONTROL_REGISTER;
-
-typedef union _PCI_EXPRESS_LINK_STATUS_REGISTER {
-  struct {
-    USHORT LinkSpeed:4;
-    USHORT LinkWidth:6;
-    USHORT Undefined:1;
-    USHORT LinkTraining:1;
-    USHORT SlotClockConfig:1;
-    USHORT DataLinkLayerActive:1;
-    USHORT Rsvd:2;
-  } DUMMYSTRUCTNAME;
-  USHORT AsUSHORT;
-} PCI_EXPRESS_LINK_STATUS_REGISTER, *PPCI_EXPRESS_LINK_STATUS_REGISTER;
-
-typedef union _PCI_EXPRESS_SLOT_CAPABILITIES_REGISTER {
-  struct {
-    ULONG AttentionButtonPresent:1;
-    ULONG PowerControllerPresent:1;
-    ULONG MRLSensorPresent:1;
-    ULONG AttentionIndicatorPresent:1;
-    ULONG PowerIndicatorPresent:1;
-    ULONG HotPlugSurprise:1;
-    ULONG HotPlugCapable:1;
-    ULONG SlotPowerLimit:8;
-    ULONG SlotPowerLimitScale:2;
-    ULONG ElectromechanicalLockPresent:1;
-    ULONG NoCommandCompletedSupport:1;
-    ULONG PhysicalSlotNumber:13;
-  } DUMMYSTRUCTNAME;
-  ULONG AsULONG;
-} PCI_EXPRESS_SLOT_CAPABILITIES_REGISTER, *PPCI_EXPRESS_SLOT_CAPABILITIES_REGISTER;
-
-typedef union _PCI_EXPRESS_SLOT_CONTROL_REGISTER {
-  struct {
-    USHORT AttentionButtonEnable:1;
-    USHORT PowerFaultDetectEnable:1;
-    USHORT MRLSensorEnable:1;
-    USHORT PresenceDetectEnable:1;
-    USHORT CommandCompletedEnable:1;
-    USHORT HotPlugInterruptEnable:1;
-    USHORT AttentionIndicatorControl:2;
-    USHORT PowerIndicatorControl:2;
-    USHORT PowerControllerControl:1;
-    USHORT ElectromechanicalLockControl:1;
-    USHORT DataLinkStateChangeEnable:1;
-    USHORT Rsvd:3;
-  } DUMMYSTRUCTNAME;
-  USHORT AsUSHORT;
-} PCI_EXPRESS_SLOT_CONTROL_REGISTER, *PPCI_EXPRESS_SLOT_CONTROL_REGISTER;
-
-typedef union _PCI_EXPRESS_SLOT_STATUS_REGISTER {
-  struct {
-    USHORT AttentionButtonPressed:1;
-    USHORT PowerFaultDetected:1;
-    USHORT MRLSensorChanged:1;
-    USHORT PresenceDetectChanged:1;
-    USHORT CommandCompleted:1;
-    USHORT MRLSensorState:1;
-    USHORT PresenceDetectState:1;
-    USHORT ElectromechanicalLockEngaged:1;
-    USHORT DataLinkStateChanged:1;
-    USHORT Rsvd:7;
-  } DUMMYSTRUCTNAME;
-  USHORT AsUSHORT;
-} PCI_EXPRESS_SLOT_STATUS_REGISTER, *PPCI_EXPRESS_SLOT_STATUS_REGISTER;
-
-typedef union _PCI_EXPRESS_ROOT_CONTROL_REGISTER {
-  struct {
-    USHORT CorrectableSerrEnable:1;
-    USHORT NonFatalSerrEnable:1;
-    USHORT FatalSerrEnable:1;
-    USHORT PMEInterruptEnable:1;
-    USHORT CRSSoftwareVisibilityEnable:1;
-    USHORT Rsvd:11;
-  } DUMMYSTRUCTNAME;
-  USHORT AsUSHORT;
-} PCI_EXPRESS_ROOT_CONTROL_REGISTER, *PPCI_EXPRESS_ROOT_CONTROL_REGISTER;
-
-typedef union _PCI_EXPRESS_ROOT_CAPABILITIES_REGISTER {
-  struct {
-    USHORT CRSSoftwareVisibility:1;
-    USHORT Rsvd:15;
-  } DUMMYSTRUCTNAME;
-  USHORT AsUSHORT;
-} PCI_EXPRESS_ROOT_CAPABILITIES_REGISTER, *PPCI_EXPRESS_ROOT_CAPABILITIES_REGISTER;
-
-typedef union _PCI_EXPRESS_ROOT_STATUS_REGISTER {
-  struct {
-    ULONG PMERequestorId:16;
-    ULONG PMEStatus:1;
-    ULONG PMEPending:1;
-    ULONG Rsvd:14;
-  } DUMMYSTRUCTNAME;
-  ULONG AsULONG;
-} PCI_EXPRESS_ROOT_STATUS_REGISTER, *PPCI_EXPRESS_ROOT_STATUS_REGISTER;
-
-typedef struct _PCI_EXPRESS_CAPABILITY {
-  PCI_CAPABILITIES_HEADER Header;
-  PCI_EXPRESS_CAPABILITIES_REGISTER ExpressCapabilities;
-  PCI_EXPRESS_DEVICE_CAPABILITIES_REGISTER DeviceCapabilities;
-  PCI_EXPRESS_DEVICE_CONTROL_REGISTER DeviceControl;
-  PCI_EXPRESS_DEVICE_STATUS_REGISTER DeviceStatus;
-  PCI_EXPRESS_LINK_CAPABILITIES_REGISTER LinkCapabilities;
-  PCI_EXPRESS_LINK_CONTROL_REGISTER LinkControl;
-  PCI_EXPRESS_LINK_STATUS_REGISTER LinkStatus;
-  PCI_EXPRESS_SLOT_CAPABILITIES_REGISTER SlotCapabilities;
-  PCI_EXPRESS_SLOT_CONTROL_REGISTER SlotControl;
-  PCI_EXPRESS_SLOT_STATUS_REGISTER SlotStatus;
-  PCI_EXPRESS_ROOT_CONTROL_REGISTER RootControl;
-  PCI_EXPRESS_ROOT_CAPABILITIES_REGISTER RootCapabilities;
-  PCI_EXPRESS_ROOT_STATUS_REGISTER RootStatus;
-} PCI_EXPRESS_CAPABILITY, *PPCI_EXPRESS_CAPABILITY;
-
-typedef enum {
-  MRLClosed = 0,
-  MRLOpen
-} PCI_EXPRESS_MRL_STATE;
-
-typedef enum {
-  SlotEmpty = 0,
-  CardPresent
-} PCI_EXPRESS_CARD_PRESENCE;
-
-typedef enum {
-  IndicatorOn = 1,
-  IndicatorBlink,
-  IndicatorOff
-} PCI_EXPRESS_INDICATOR_STATE;
-
-typedef enum {
-  PowerOn = 0,
-  PowerOff
-} PCI_EXPRESS_POWER_STATE;
-
-typedef enum {
-  L0sEntrySupport = 1,
-  L0sAndL1EntrySupport = 3
-} PCI_EXPRESS_ASPM_SUPPORT;
-
-typedef enum {
-  L0sAndL1EntryDisabled,
-  L0sEntryEnabled,
-  L1EntryEnabled,
-  L0sAndL1EntryEnabled
-} PCI_EXPRESS_ASPM_CONTROL;
-
-typedef enum {
-  L0s_Below64ns = 0,
-  L0s_64ns_128ns,
-  L0s_128ns_256ns,
-  L0s_256ns_512ns,
-  L0s_512ns_1us,
-  L0s_1us_2us,
-  L0s_2us_4us,
-  L0s_Above4us
-} PCI_EXPRESS_L0s_EXIT_LATENCY;
-
-typedef enum {
-  L1_Below1us = 0,
-  L1_1us_2us,
-  L1_2us_4us,
-  L1_4us_8us,
-  L1_8us_16us,
-  L1_16us_32us,
-  L1_32us_64us,
-  L1_Above64us
-} PCI_EXPRESS_L1_EXIT_LATENCY;
-
-typedef enum {
-  PciExpressEndpoint = 0,
-  PciExpressLegacyEndpoint,
-  PciExpressRootPort = 4,
-  PciExpressUpstreamSwitchPort,
-  PciExpressDownstreamSwitchPort,
-  PciExpressToPciXBridge,
-  PciXToExpressBridge,
-  PciExpressRootComplexIntegratedEndpoint,
-  PciExpressRootComplexEventCollector
-} PCI_EXPRESS_DEVICE_TYPE;
-
-typedef enum {
-  MaxPayload128Bytes = 0,
-  MaxPayload256Bytes,
-  MaxPayload512Bytes,
-  MaxPayload1024Bytes,
-  MaxPayload2048Bytes,
-  MaxPayload4096Bytes
-} PCI_EXPRESS_MAX_PAYLOAD_SIZE;
-
-typedef union _PCI_EXPRESS_PME_REQUESTOR_ID {
-  struct {
-    USHORT FunctionNumber:3;
-    USHORT DeviceNumber:5;
-    USHORT BusNumber:8;
-  } DUMMYSTRUCTNAME;
-  USHORT AsUSHORT;
-} PCI_EXPRESS_PME_REQUESTOR_ID, *PPCI_EXPRESS_PME_REQUESTOR_ID;
-
-#if defined(_WIN64)
-
-#ifndef USE_DMA_MACROS
-#define USE_DMA_MACROS
-#endif
-
-#ifndef NO_LEGACY_DRIVERS
-#define NO_LEGACY_DRIVERS
-#endif
-
-#endif /* defined(_WIN64) */
-
-typedef enum _PHYSICAL_COUNTER_RESOURCE_DESCRIPTOR_TYPE {
-  ResourceTypeSingle = 0,
-  ResourceTypeRange,
-  ResourceTypeExtendedCounterConfiguration,
-  ResourceTypeOverflow,
-  ResourceTypeMax
-} PHYSICAL_COUNTER_RESOURCE_DESCRIPTOR_TYPE;
-
-typedef struct _PHYSICAL_COUNTER_RESOURCE_DESCRIPTOR {
-  PHYSICAL_COUNTER_RESOURCE_DESCRIPTOR_TYPE Type;
-  ULONG Flags;
-  union {
-    ULONG CounterIndex;
-    ULONG ExtendedRegisterAddress;
-    struct {
-      ULONG Begin;
-      ULONG End;
-    } Range;
-  } u;
-} PHYSICAL_COUNTER_RESOURCE_DESCRIPTOR, *PPHYSICAL_COUNTER_RESOURCE_DESCRIPTOR;
-
-typedef struct _PHYSICAL_COUNTER_RESOURCE_LIST {
-  ULONG Count;
-  PHYSICAL_COUNTER_RESOURCE_DESCRIPTOR Descriptors[ANYSIZE_ARRAY];
-} PHYSICAL_COUNTER_RESOURCE_LIST, *PPHYSICAL_COUNTER_RESOURCE_LIST;
-
-typedef VOID
-(NTAPI *PciPin2Line)(
-  IN struct _BUS_HANDLER *BusHandler,
-  IN struct _BUS_HANDLER *RootHandler,
-  IN PCI_SLOT_NUMBER SlotNumber,
-  IN PPCI_COMMON_CONFIG PciData);
-
-typedef VOID
-(NTAPI *PciLine2Pin)(
-  IN struct _BUS_HANDLER *BusHandler,
-  IN struct _BUS_HANDLER *RootHandler,
-  IN PCI_SLOT_NUMBER SlotNumber,
-  IN PPCI_COMMON_CONFIG PciNewData,
-  IN PPCI_COMMON_CONFIG PciOldData);
-
-typedef VOID
-(NTAPI *PciReadWriteConfig)(
-  IN struct _BUS_HANDLER *BusHandler,
-  IN PCI_SLOT_NUMBER Slot,
-  IN PVOID Buffer,
-  IN ULONG Offset,
-  IN ULONG Length);
-
-#define PCI_DATA_TAG ' ICP'
-#define PCI_DATA_VERSION 1
-
-typedef struct _PCIBUSDATA {
-  ULONG Tag;
-  ULONG Version;
-  PciReadWriteConfig ReadConfig;
-  PciReadWriteConfig WriteConfig;
-  PciPin2Line Pin2Line;
-  PciLine2Pin Line2Pin;
-  PCI_SLOT_NUMBER ParentSlot;
-  PVOID Reserved[4];
-} PCIBUSDATA, *PPCIBUSDATA;
-
-#ifndef _PCIINTRF_X_
-#define _PCIINTRF_X_
-
-typedef ULONG
-(NTAPI *PCI_READ_WRITE_CONFIG)(
-  IN PVOID Context,
-  IN ULONG BusOffset,
-  IN ULONG Slot,
-  IN PVOID Buffer,
-  IN ULONG Offset,
-  IN ULONG Length);
-
-typedef VOID
-(NTAPI *PCI_PIN_TO_LINE)(
-  IN PVOID Context,
-  IN PPCI_COMMON_CONFIG PciData);
-
-typedef VOID
-(NTAPI *PCI_LINE_TO_PIN)(
-  IN PVOID Context,
-  IN PPCI_COMMON_CONFIG PciNewData,
-  IN PPCI_COMMON_CONFIG PciOldData);
-
-typedef VOID
-(NTAPI *PCI_ROOT_BUS_CAPABILITY)(
-  IN PVOID Context,
-  OUT PPCI_ROOT_BUS_HARDWARE_CAPABILITY HardwareCapability);
-
-typedef VOID
-(NTAPI *PCI_EXPRESS_WAKE_CONTROL)(
-  IN PVOID Context,
-  IN BOOLEAN EnableWake);
-
-typedef struct _PCI_BUS_INTERFACE_STANDARD {
-  USHORT Size;
-  USHORT Version;
-  PVOID Context;
-  PINTERFACE_REFERENCE InterfaceReference;
-  PINTERFACE_DEREFERENCE InterfaceDereference;
-  PCI_READ_WRITE_CONFIG ReadConfig;
-  PCI_READ_WRITE_CONFIG WriteConfig;
-  PCI_PIN_TO_LINE PinToLine;
-  PCI_LINE_TO_PIN LineToPin;
-  PCI_ROOT_BUS_CAPABILITY RootBusCapability;
-  PCI_EXPRESS_WAKE_CONTROL ExpressWakeControl;
-} PCI_BUS_INTERFACE_STANDARD, *PPCI_BUS_INTERFACE_STANDARD;
-
-#define PCI_BUS_INTERFACE_STANDARD_VERSION 1
-
-#endif /* _PCIINTRF_X_ */
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-
-#define FILE_CHARACTERISTICS_EXPECT_ORDERLY_REMOVAL_EX     0x00004000
-#define FILE_CHARACTERISTICS_EXPECT_SURPRISE_REMOVAL_EX    0x00008000
-#define FILE_CHARACTERISTICS_REMOVAL_POLICY_MASK_EX \
-    (FILE_CHARACTERISTICS_EXPECT_ORDERLY_REMOVAL_EX | \
-     FILE_CHARACTERISTICS_EXPECT_SURPRISE_REMOVAL_EX)
-
-#define FILE_CHARACTERISTICS_EXPECT_ORDERLY_REMOVAL_DEPRECATED 0x00000200
-#define FILE_CHARACTERISTICS_EXPECT_SURPRISE_REMOVAL_DEPRECATED 0x00000300
-#define FILE_CHARACTERISTICS_REMOVAL_POLICY_MASK_DEPRECATED 0x00000300
-
-#else
-
-#define FILE_CHARACTERISTICS_EXPECT_ORDERLY_REMOVAL     0x00000200
-#define FILE_CHARACTERISTICS_EXPECT_SURPRISE_REMOVAL    0x00000300
-#define FILE_CHARACTERISTICS_REMOVAL_POLICY_MASK        0x00000300
-
-#define FILE_CHARACTERISTICS_EXPECT_ORDERLY_REMOVAL_EX FILE_CHARACTERISTICS_EXPECT_ORDERLY_REMOVAL
-#define FILE_CHARACTERISTICS_EXPECT_SURPRISE_REMOVAL_EX FILE_CHARACTERISTICS_EXPECT_SURPRISE_REMOVAL
-#define FILE_CHARACTERISTICS_REMOVAL_POLICY_MASK_EX FILE_CHARACTERISTICS_REMOVAL_POLICY_MASK
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
-
-#define FILE_CHARACTERISTICS_PROPAGATED (   FILE_REMOVABLE_MEDIA   | \
-                                            FILE_READ_ONLY_DEVICE  | \
-                                            FILE_FLOPPY_DISKETTE   | \
-                                            FILE_WRITE_ONCE_MEDIA  | \
-                                            FILE_DEVICE_SECURE_OPEN  )
-
-typedef struct _FILE_ALIGNMENT_INFORMATION {
-  ULONG AlignmentRequirement;
-} FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION;
-
-typedef struct _FILE_NAME_INFORMATION {
-  ULONG FileNameLength;
-  WCHAR FileName[1];
-} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;
-
-
-typedef struct _FILE_ATTRIBUTE_TAG_INFORMATION {
-  ULONG FileAttributes;
-  ULONG ReparseTag;
-} FILE_ATTRIBUTE_TAG_INFORMATION, *PFILE_ATTRIBUTE_TAG_INFORMATION;
-
-typedef struct _FILE_DISPOSITION_INFORMATION {
-  BOOLEAN DeleteFile;
-} FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;
-
-typedef struct _FILE_END_OF_FILE_INFORMATION {
-  LARGE_INTEGER EndOfFile;
-} FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;
-
-typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION {
-  LARGE_INTEGER ValidDataLength;
-} FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION;
-
-typedef struct _FILE_FS_LABEL_INFORMATION {
-  ULONG VolumeLabelLength;
-  WCHAR VolumeLabel[1];
-} FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
-
-typedef struct _FILE_FS_VOLUME_INFORMATION {
-  LARGE_INTEGER VolumeCreationTime;
-  ULONG VolumeSerialNumber;
-  ULONG VolumeLabelLength;
-  BOOLEAN SupportsObjects;
-  WCHAR VolumeLabel[1];
-} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
-
-typedef struct _FILE_FS_SIZE_INFORMATION {
-  LARGE_INTEGER TotalAllocationUnits;
-  LARGE_INTEGER AvailableAllocationUnits;
-  ULONG SectorsPerAllocationUnit;
-  ULONG BytesPerSector;
-} FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
-
-typedef struct _FILE_FS_FULL_SIZE_INFORMATION {
-  LARGE_INTEGER TotalAllocationUnits;
-  LARGE_INTEGER CallerAvailableAllocationUnits;
-  LARGE_INTEGER ActualAvailableAllocationUnits;
-  ULONG SectorsPerAllocationUnit;
-  ULONG BytesPerSector;
-} FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
-
-typedef struct _FILE_FS_OBJECTID_INFORMATION {
-  UCHAR ObjectId[16];
-  UCHAR ExtendedInfo[48];
-} FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION;
-
-typedef union _FILE_SEGMENT_ELEMENT {
-  PVOID64 Buffer;
-  ULONGLONG Alignment;
-}FILE_SEGMENT_ELEMENT, *PFILE_SEGMENT_ELEMENT;
-
-#define IOCTL_AVIO_ALLOCATE_STREAM      CTL_CODE(FILE_DEVICE_AVIO, 1, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
-#define IOCTL_AVIO_FREE_STREAM          CTL_CODE(FILE_DEVICE_AVIO, 2, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
-#define IOCTL_AVIO_MODIFY_STREAM        CTL_CODE(FILE_DEVICE_AVIO, 3, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
-
-typedef enum _BUS_DATA_TYPE {
-  ConfigurationSpaceUndefined = -1,
-  Cmos,
-  EisaConfiguration,
-  Pos,
-  CbusConfiguration,
-  PCIConfiguration,
-  VMEConfiguration,
-  NuBusConfiguration,
-  PCMCIAConfiguration,
-  MPIConfiguration,
-  MPSAConfiguration,
-  PNPISAConfiguration,
-  SgiInternalConfiguration,
-  MaximumBusDataType
-} BUS_DATA_TYPE, *PBUS_DATA_TYPE;
-
-/* Hardware Abstraction Layer Types */
-
-typedef BOOLEAN
-(NTAPI *PHAL_RESET_DISPLAY_PARAMETERS)(
-  IN ULONG Columns,
-  IN ULONG Rows);
-
-typedef PBUS_HANDLER
-(FASTCALL *pHalHandlerForBus)(
-  IN INTERFACE_TYPE InterfaceType,
-  IN ULONG BusNumber);
-
-typedef VOID
-(FASTCALL *pHalReferenceBusHandler)(
-  IN PBUS_HANDLER BusHandler);
-
 typedef enum _HAL_QUERY_INFORMATION_CLASS {
   HalInstalledBusInformation,
   HalProfileSourceInformation,
@@ -1307,36 +355,110 @@ typedef enum _HAL_SET_INFORMATION_CLASS {
   HalProfileDpgoSourceInterruptHandler
 } HAL_SET_INFORMATION_CLASS, *PHAL_SET_INFORMATION_CLASS;
 
-typedef NTSTATUS
-(NTAPI *pHalQuerySystemInformation)(
-  IN HAL_QUERY_INFORMATION_CLASS InformationClass,
-  IN ULONG BufferSize,
-  IN OUT PVOID Buffer,
-  OUT PULONG ReturnedLength);
+typedef struct _HAL_PROFILE_SOURCE_INTERVAL {
+  KPROFILE_SOURCE Source;
+  ULONG_PTR Interval;
+} HAL_PROFILE_SOURCE_INTERVAL, *PHAL_PROFILE_SOURCE_INTERVAL;
 
-typedef NTSTATUS
-(NTAPI *pHalSetSystemInformation)(
-  IN HAL_SET_INFORMATION_CLASS InformationClass,
-  IN ULONG BufferSize,
-  IN PVOID Buffer);
+typedef struct _HAL_PROFILE_SOURCE_INFORMATION {
+  KPROFILE_SOURCE Source;
+  BOOLEAN Supported;
+  ULONG Interval;
+} HAL_PROFILE_SOURCE_INFORMATION, *PHAL_PROFILE_SOURCE_INFORMATION;
 
-typedef VOID
-(FASTCALL *pHalExamineMBR)(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG SectorSize,
-  IN ULONG MBRTypeIdentifier,
-  OUT PVOID *Buffer);
+typedef struct _MAP_REGISTER_ENTRY {
+  PVOID MapRegister;
+  BOOLEAN WriteToDevice;
+} MAP_REGISTER_ENTRY, *PMAP_REGISTER_ENTRY;
 
-typedef NTSTATUS
-(FASTCALL *pHalIoReadPartitionTable)(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG SectorSize,
-  IN BOOLEAN ReturnRecognizedPartitions,
-  OUT struct _DRIVE_LAYOUT_INFORMATION **PartitionBuffer);
+typedef struct _DEBUG_DEVICE_ADDRESS {
+  UCHAR Type;
+  BOOLEAN Valid;
+  UCHAR Reserved[2];
+  PUCHAR TranslatedAddress;
+  ULONG Length;
+} DEBUG_DEVICE_ADDRESS, *PDEBUG_DEVICE_ADDRESS;
 
-typedef NTSTATUS
-(FASTCALL *pHalIoSetPartitionInformation)(
-  IN PDEVICE_OBJECT DeviceObject,
+typedef struct _DEBUG_MEMORY_REQUIREMENTS {
+  PHYSICAL_ADDRESS Start;
+  PHYSICAL_ADDRESS MaxEnd;
+  PVOID VirtualAddress;
+  ULONG Length;
+  BOOLEAN Cached;
+  BOOLEAN Aligned;
+} DEBUG_MEMORY_REQUIREMENTS, *PDEBUG_MEMORY_REQUIREMENTS;
+
+typedef struct _DEBUG_DEVICE_DESCRIPTOR {
+  ULONG Bus;
+  ULONG Slot;
+  USHORT Segment;
+  USHORT VendorID;
+  USHORT DeviceID;
+  UCHAR BaseClass;
+  UCHAR SubClass;
+  UCHAR ProgIf;
+  BOOLEAN Initialized;
+  BOOLEAN Configured;
+  DEBUG_DEVICE_ADDRESS BaseAddress[6];
+  DEBUG_MEMORY_REQUIREMENTS Memory;
+} DEBUG_DEVICE_DESCRIPTOR, *PDEBUG_DEVICE_DESCRIPTOR;
+
+typedef struct _PM_DISPATCH_TABLE {
+  ULONG Signature;
+  ULONG Version;
+  PVOID Function[1];
+} PM_DISPATCH_TABLE, *PPM_DISPATCH_TABLE;
+
+typedef enum _RESOURCE_TRANSLATION_DIRECTION {
+  TranslateChildToParent,
+  TranslateParentToChild
+} RESOURCE_TRANSLATION_DIRECTION;
+
+typedef NTSTATUS
+(NTAPI *PTRANSLATE_RESOURCE_HANDLER)(
+  IN OUT PVOID Context,
+  IN PCM_PARTIAL_RESOURCE_DESCRIPTOR Source,
+  IN RESOURCE_TRANSLATION_DIRECTION Direction,
+  IN ULONG AlternativesCount OPTIONAL,
+  IN IO_RESOURCE_DESCRIPTOR Alternatives[],
+  IN PDEVICE_OBJECT PhysicalDeviceObject,
+  OUT PCM_PARTIAL_RESOURCE_DESCRIPTOR Target);
+
+typedef NTSTATUS
+(NTAPI *PTRANSLATE_RESOURCE_REQUIREMENTS_HANDLER)(
+  IN PVOID Context OPTIONAL,
+  IN PIO_RESOURCE_DESCRIPTOR Source,
+  IN PDEVICE_OBJECT PhysicalDeviceObject,
+  OUT PULONG TargetCount,
+  OUT PIO_RESOURCE_DESCRIPTOR *Target);
+
+typedef struct _TRANSLATOR_INTERFACE {
+  USHORT Size;
+  USHORT Version;
+  PVOID Context;
+  PINTERFACE_REFERENCE InterfaceReference;
+  PINTERFACE_DEREFERENCE InterfaceDereference;
+  PTRANSLATE_RESOURCE_HANDLER TranslateResources;
+  PTRANSLATE_RESOURCE_REQUIREMENTS_HANDLER TranslateResourceRequirements;
+} TRANSLATOR_INTERFACE, *PTRANSLATOR_INTERFACE;
+
+typedef VOID
+(FASTCALL *pHalExamineMBR)(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG SectorSize,
+  IN ULONG MBRTypeIdentifier,
+  OUT PVOID *Buffer);
+
+typedef NTSTATUS
+(FASTCALL *pHalIoReadPartitionTable)(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG SectorSize,
+  IN BOOLEAN ReturnRecognizedPartitions,
+  OUT struct _DRIVE_LAYOUT_INFORMATION **PartitionBuffer);
+
+typedef NTSTATUS
+(FASTCALL *pHalIoSetPartitionInformation)(
+  IN PDEVICE_OBJECT DeviceObject,
   IN ULONG SectorSize,
   IN ULONG PartitionNumber,
   IN ULONG PartitionType);
@@ -1349,6 +471,28 @@ typedef NTSTATUS
   IN ULONG NumberOfHeads,
   IN struct _DRIVE_LAYOUT_INFORMATION *PartitionBuffer);
 
+typedef PBUS_HANDLER
+(FASTCALL *pHalHandlerForBus)(
+  IN INTERFACE_TYPE InterfaceType,
+  IN ULONG BusNumber);
+
+typedef VOID
+(FASTCALL *pHalReferenceBusHandler)(
+  IN PBUS_HANDLER BusHandler);
+
+typedef NTSTATUS
+(NTAPI *pHalQuerySystemInformation)(
+  IN HAL_QUERY_INFORMATION_CLASS InformationClass,
+  IN ULONG BufferSize,
+  IN OUT PVOID Buffer,
+  OUT PULONG ReturnedLength);
+
+typedef NTSTATUS
+(NTAPI *pHalSetSystemInformation)(
+  IN HAL_SET_INFORMATION_CLASS InformationClass,
+  IN ULONG BufferSize,
+  IN PVOID Buffer);
+
 typedef NTSTATUS
 (NTAPI *pHalQueryBusSlots)(
   IN PBUS_HANDLER BusHandler,
@@ -1360,12 +504,6 @@ typedef NTSTATUS
 (NTAPI *pHalInitPnpDriver)(
   VOID);
 
-typedef struct _PM_DISPATCH_TABLE {
-  ULONG Signature;
-  ULONG Version;
-  PVOID Function[1];
-} PM_DISPATCH_TABLE, *PPM_DISPATCH_TABLE;
-
 typedef NTSTATUS
 (NTAPI *pHalInitPowerManagement)(
   IN PPM_DISPATCH_TABLE PmDriverDispatchTable,
@@ -1405,7 +543,12 @@ typedef NTSTATUS
   IN PHYSICAL_ADDRESS PhysicalAddress,
   IN LARGE_INTEGER NumberOfBytes);
 
-typedef BOOLEAN
+typedef VOID
+(NTAPI *pHalEndOfBoot)(
+  VOID);
+
+typedef
+BOOLEAN
 (NTAPI *pHalTranslateBusAddress)(
   IN INTERFACE_TYPE InterfaceType,
   IN ULONG BusNumber,
@@ -1413,7 +556,8 @@ typedef BOOLEAN
   IN OUT PULONG AddressSpace,
   OUT PPHYSICAL_ADDRESS TranslatedAddress);
 
-typedef NTSTATUS
+typedef
+NTSTATUS
 (NTAPI *pHalAssignSlotResources)(
   IN PUNICODE_STRING RegistryPath,
   IN PUNICODE_STRING DriverClassName OPTIONAL,
@@ -1424,24 +568,23 @@ typedef NTSTATUS
   IN ULONG SlotNumber,
   IN OUT PCM_RESOURCE_LIST *AllocatedResources);
 
-typedef VOID
+typedef
+VOID
 (NTAPI *pHalHaltSystem)(
   VOID);
 
-typedef BOOLEAN
+typedef
+BOOLEAN
 (NTAPI *pHalResetDisplay)(
   VOID);
 
-typedef struct _MAP_REGISTER_ENTRY {
-  PVOID MapRegister;
-  BOOLEAN WriteToDevice;
-} MAP_REGISTER_ENTRY, *PMAP_REGISTER_ENTRY;
-
-typedef UCHAR
+typedef
+UCHAR
 (NTAPI *pHalVectorToIDTEntry)(
   ULONG Vector);
 
-typedef BOOLEAN
+typedef
+BOOLEAN
 (NTAPI *pHalFindBusAddressTranslation)(
   IN PHYSICAL_ADDRESS BusAddress,
   IN OUT PULONG AddressSpace,
@@ -1449,33 +592,94 @@ typedef BOOLEAN
   IN OUT PULONG_PTR Context,
   IN BOOLEAN NextBus);
 
-typedef VOID
-(NTAPI *pHalEndOfBoot)(
-  VOID);
+typedef
+NTSTATUS
+(NTAPI *pKdSetupPciDeviceForDebugging)(
+  IN PVOID LoaderBlock OPTIONAL,
+  IN OUT PDEBUG_DEVICE_DESCRIPTOR PciDevice);
+
+typedef
+NTSTATUS
+(NTAPI *pKdReleasePciDeviceForDebugging)(
+  IN OUT PDEBUG_DEVICE_DESCRIPTOR PciDevice);
+
+typedef
+PVOID
+(NTAPI *pKdGetAcpiTablePhase0)(
+  IN struct _LOADER_PARAMETER_BLOCK *LoaderBlock,
+  IN ULONG Signature);
 
-typedef PVOID
+typedef
+PVOID
 (NTAPI *pHalGetAcpiTable)(
   IN ULONG Signature,
   IN PCSTR OemId OPTIONAL,
   IN PCSTR OemTableId OPTIONAL);
   
-#if defined(_IA64_)
-typedef NTSTATUS
-(*pHalGetErrorCapList)(
-  IN OUT PULONG CapsListLength,
-  IN OUT PUCHAR ErrorCapList);
+typedef
+VOID
+(NTAPI *pKdCheckPowerButton)(
+  VOID);
 
-typedef NTSTATUS
-(*pHalInjectError)(
-  IN ULONG BufferLength,
-  IN PUCHAR Buffer);
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+typedef
+PVOID
+(NTAPI *pKdMapPhysicalMemory64)(
+  IN PHYSICAL_ADDRESS PhysicalAddress,
+  IN ULONG NumberPages,
+  IN BOOLEAN FlushCurrentTLB);
+
+typedef
+VOID
+(NTAPI *pKdUnmapVirtualAddress)(
+  IN PVOID VirtualAddress,
+  IN ULONG NumberPages,
+  IN BOOLEAN FlushCurrentTLB);
+#else
+typedef
+PVOID
+(NTAPI *pKdMapPhysicalMemory64)(
+  IN PHYSICAL_ADDRESS PhysicalAddress,
+  IN ULONG NumberPages);
+
+typedef
+VOID
+(NTAPI *pKdUnmapVirtualAddress)(
+  IN PVOID VirtualAddress,
+  IN ULONG NumberPages);
 #endif
 
-typedef VOID
+
+typedef
+ULONG
+(NTAPI *pKdGetPciDataByOffset)(
+  IN ULONG BusNumber,
+  IN ULONG SlotNumber,
+  OUT PVOID Buffer,
+  IN ULONG Offset,
+  IN ULONG Length);
+
+typedef
+ULONG
+(NTAPI *pKdSetPciDataByOffset)(
+  IN ULONG BusNumber,
+  IN ULONG SlotNumber,
+  IN PVOID Buffer,
+  IN ULONG Offset,
+  IN ULONG Length);
+
+typedef BOOLEAN
+(NTAPI *PHAL_RESET_DISPLAY_PARAMETERS)(
+  IN ULONG Columns,
+  IN ULONG Rows);
+
+typedef
+VOID
 (NTAPI *PCI_ERROR_HANDLER_CALLBACK)(
   VOID);
 
-typedef VOID
+typedef
+VOID
 (NTAPI *pHalSetPciErrorHandlerCallback)(
   IN PCI_ERROR_HANDLER_CALLBACK Callback);
 
@@ -1549,263 +753,323 @@ extern NTKERNELAPI HAL_DISPATCH HalDispatchTable;
 #define HalMirrorPhysicalMemory         HALDISPATCH->HalMirrorPhysicalMemory
 #define HalEndOfBoot                    HALDISPATCH->HalEndOfBoot
 #define HalMirrorVerify                 HALDISPATCH->HalMirrorVerify
-#define HalGetCachedAcpiTable           HALDISPATCH->HalGetCachedAcpiTable
-#define HalSetPciErrorHandlerCallback   HALDISPATCH->HalSetPciErrorHandlerCallback
-#if defined(_IA64_)
-#define HalGetErrorCapList              HALDISPATCH->HalGetErrorCapList
-#define HalInjectError                  HALDISPATCH->HalInjectError
-#endif
-
-typedef struct _HAL_BUS_INFORMATION {
-  INTERFACE_TYPE BusType;
-  BUS_DATA_TYPE ConfigurationType;
-  ULONG BusNumber;
-  ULONG Reserved;
-} HAL_BUS_INFORMATION, *PHAL_BUS_INFORMATION;
-
-typedef struct _HAL_PROFILE_SOURCE_INFORMATION {
-  KPROFILE_SOURCE Source;
-  BOOLEAN Supported;
-  ULONG Interval;
-} HAL_PROFILE_SOURCE_INFORMATION, *PHAL_PROFILE_SOURCE_INFORMATION;
-
-typedef struct _HAL_PROFILE_SOURCE_INFORMATION_EX {
-  KPROFILE_SOURCE Source;
-  BOOLEAN Supported;
-  ULONG_PTR Interval;
-  ULONG_PTR DefInterval;
-  ULONG_PTR MaxInterval;
-  ULONG_PTR MinInterval;
-} HAL_PROFILE_SOURCE_INFORMATION_EX, *PHAL_PROFILE_SOURCE_INFORMATION_EX;
 
-typedef struct _HAL_PROFILE_SOURCE_INTERVAL {
-  KPROFILE_SOURCE Source;
-  ULONG_PTR Interval;
-} HAL_PROFILE_SOURCE_INTERVAL, *PHAL_PROFILE_SOURCE_INTERVAL;
+typedef struct _FILE_ALIGNMENT_INFORMATION {
+  ULONG AlignmentRequirement;
+} FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION;
 
-typedef struct _HAL_PROFILE_SOURCE_LIST {
-  KPROFILE_SOURCE Source;
-  PWSTR Description;
-} HAL_PROFILE_SOURCE_LIST, *PHAL_PROFILE_SOURCE_LIST;
+typedef struct _FILE_NAME_INFORMATION {
+  ULONG FileNameLength;
+  WCHAR FileName[1];
+} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;
 
-typedef enum _HAL_DISPLAY_BIOS_INFORMATION {
-  HalDisplayInt10Bios,
-  HalDisplayEmulatedBios,
-  HalDisplayNoBios
-} HAL_DISPLAY_BIOS_INFORMATION, *PHAL_DISPLAY_BIOS_INFORMATION;
 
-typedef struct _HAL_POWER_INFORMATION {
-  ULONG TBD;
-} HAL_POWER_INFORMATION, *PHAL_POWER_INFORMATION;
+typedef struct _FILE_ATTRIBUTE_TAG_INFORMATION {
+  ULONG FileAttributes;
+  ULONG ReparseTag;
+} FILE_ATTRIBUTE_TAG_INFORMATION, *PFILE_ATTRIBUTE_TAG_INFORMATION;
 
-typedef struct _HAL_PROCESSOR_SPEED_INFO {
-  ULONG ProcessorSpeed;
-} HAL_PROCESSOR_SPEED_INFORMATION, *PHAL_PROCESSOR_SPEED_INFORMATION;
+typedef struct _FILE_DISPOSITION_INFORMATION {
+  BOOLEAN DeleteFile;
+} FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;
 
-typedef struct _HAL_CALLBACKS {
-  PCALLBACK_OBJECT SetSystemInformation;
-  PCALLBACK_OBJECT BusCheck;
-} HAL_CALLBACKS, *PHAL_CALLBACKS;
+typedef struct _FILE_END_OF_FILE_INFORMATION {
+  LARGE_INTEGER EndOfFile;
+} FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;
 
-typedef struct _HAL_PROCESSOR_FEATURE {
-  ULONG UsableFeatureBits;
-} HAL_PROCESSOR_FEATURE;
+typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION {
+  LARGE_INTEGER ValidDataLength;
+} FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION;
 
-typedef NTSTATUS
-(NTAPI *PHALIOREADWRITEHANDLER)(
-  IN BOOLEAN fRead,
-  IN ULONG dwAddr,
-  IN ULONG dwSize,
-  IN OUT PULONG pdwData);
-
-typedef struct _HAL_AMLI_BAD_IO_ADDRESS_LIST {
-  ULONG BadAddrBegin;
-  ULONG BadAddrSize;
-  ULONG OSVersionTrigger;
-  PHALIOREADWRITEHANDLER IOHandler;
-} HAL_AMLI_BAD_IO_ADDRESS_LIST, *PHAL_AMLI_BAD_IO_ADDRESS_LIST;
-
-#if defined(_X86_) || defined(_IA64_) || defined(_AMD64_)
-
-typedef VOID
-(NTAPI *PHALMCAINTERFACELOCK)(
-  VOID);
-
-typedef VOID
-(NTAPI *PHALMCAINTERFACEUNLOCK)(
-  VOID);
+typedef union _FILE_SEGMENT_ELEMENT {
+  PVOID64 Buffer;
+  ULONGLONG Alignment;
+}FILE_SEGMENT_ELEMENT, *PFILE_SEGMENT_ELEMENT;
 
-typedef NTSTATUS
-(NTAPI *PHALMCAINTERFACEREADREGISTER)(
-  IN UCHAR BankNumber,
-  IN OUT PVOID Exception);
-
-typedef struct _HAL_MCA_INTERFACE {
-  PHALMCAINTERFACELOCK Lock;
-  PHALMCAINTERFACEUNLOCK Unlock;
-  PHALMCAINTERFACEREADREGISTER ReadRegister;
-} HAL_MCA_INTERFACE;
-
-typedef enum {
-  ApicDestinationModePhysical = 1,
-  ApicDestinationModeLogicalFlat,
-  ApicDestinationModeLogicalClustered,
-  ApicDestinationModeUnknown
-} HAL_APIC_DESTINATION_MODE, *PHAL_APIC_DESTINATION_MODE;
-
-#if defined(_AMD64_)
-
-struct _KTRAP_FRAME;
-struct _KEXCEPTION_FRAME;
-
-typedef ERROR_SEVERITY
-(NTAPI *PDRIVER_EXCPTN_CALLBACK)(
-  IN PVOID Context,
-  IN struct _KTRAP_FRAME *TrapFrame,
-  IN struct _KEXCEPTION_FRAME *ExceptionFrame,
-  IN PMCA_EXCEPTION Exception);
+#define SE_UNSOLICITED_INPUT_PRIVILEGE    6
 
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+NTSYSAPI
+ULONGLONG
+NTAPI
+VerSetConditionMask(
+  IN ULONGLONG ConditionMask,
+  IN ULONG TypeMask,
+  IN UCHAR Condition);
 #endif
 
-#if defined(_X86_) || defined(_IA64_)
-typedef
-#if defined(_IA64_)
-ERROR_SEVERITY
-#else
-VOID
-#endif
-(NTAPI *PDRIVER_EXCPTN_CALLBACK)(
-  IN PVOID Context,
-  IN PMCA_EXCEPTION BankLog);
-#endif
+#define VER_SET_CONDITION(ConditionMask, TypeBitMask, ComparisonType)  \
+        ((ConditionMask) = VerSetConditionMask((ConditionMask), \
+        (TypeBitMask), (ComparisonType)))
 
-typedef PDRIVER_EXCPTN_CALLBACK PDRIVER_MCA_EXCEPTION_CALLBACK;
+/* RtlVerifyVersionInfo() TypeMask */
 
-typedef struct _MCA_DRIVER_INFO {
-  PDRIVER_MCA_EXCEPTION_CALLBACK ExceptionCallback;
-  PKDEFERRED_ROUTINE DpcCallback;
-  PVOID DeviceContext;
-} MCA_DRIVER_INFO, *PMCA_DRIVER_INFO;
+#define VER_MINORVERSION                  0x0000001
+#define VER_MAJORVERSION                  0x0000002
+#define VER_BUILDNUMBER                   0x0000004
+#define VER_PLATFORMID                    0x0000008
+#define VER_SERVICEPACKMINOR              0x0000010
+#define VER_SERVICEPACKMAJOR              0x0000020
+#define VER_SUITENAME                     0x0000040
+#define VER_PRODUCT_TYPE                  0x0000080
 
-typedef struct _HAL_ERROR_INFO {
-  ULONG Version;
-  ULONG InitMaxSize;
-  ULONG McaMaxSize;
-  ULONG McaPreviousEventsCount;
-  ULONG McaCorrectedEventsCount;
-  ULONG McaKernelDeliveryFails;
-  ULONG McaDriverDpcQueueFails;
-  ULONG McaReserved;
-  ULONG CmcMaxSize;
-  ULONG CmcPollingInterval;
-  ULONG CmcInterruptsCount;
-  ULONG CmcKernelDeliveryFails;
-  ULONG CmcDriverDpcQueueFails;
-  ULONG CmcGetStateFails;
-  ULONG CmcClearStateFails;
-  ULONG CmcReserved;
-  ULONGLONG CmcLogId;
-  ULONG CpeMaxSize;
-  ULONG CpePollingInterval;
-  ULONG CpeInterruptsCount;
-  ULONG CpeKernelDeliveryFails;
-  ULONG CpeDriverDpcQueueFails;
-  ULONG CpeGetStateFails;
-  ULONG CpeClearStateFails;
-  ULONG CpeInterruptSources;
-  ULONGLONG CpeLogId;
-  ULONGLONG KernelReserved[4];
-} HAL_ERROR_INFO, *PHAL_ERROR_INFO;
-
-#define HAL_MCE_INTERRUPTS_BASED ((ULONG)-1)
-#define HAL_MCE_DISABLED          ((ULONG)0)
-
-#define HAL_CMC_INTERRUPTS_BASED  HAL_MCE_INTERRUPTS_BASED
-#define HAL_CMC_DISABLED          HAL_MCE_DISABLED
-
-#define HAL_CPE_INTERRUPTS_BASED  HAL_MCE_INTERRUPTS_BASED
-#define HAL_CPE_DISABLED          HAL_MCE_DISABLED
-
-#define HAL_MCA_INTERRUPTS_BASED  HAL_MCE_INTERRUPTS_BASED
-#define HAL_MCA_DISABLED          HAL_MCE_DISABLED
+/* RtlVerifyVersionInfo() ComparisonType */
 
-typedef VOID
-(NTAPI *PDRIVER_CMC_EXCEPTION_CALLBACK)(
-  IN PVOID Context,
-  IN PCMC_EXCEPTION CmcLog);
+#define VER_EQUAL                       1
+#define VER_GREATER                     2
+#define VER_GREATER_EQUAL               3
+#define VER_LESS                        4
+#define VER_LESS_EQUAL                  5
+#define VER_AND                         6
+#define VER_OR                          7
 
-typedef VOID
-(NTAPI *PDRIVER_CPE_EXCEPTION_CALLBACK)(
-  IN PVOID Context,
-  IN PCPE_EXCEPTION CmcLog);
+#define VER_CONDITION_MASK              7
+#define VER_NUM_BITS_PER_CONDITION_MASK 3
 
-typedef struct _CMC_DRIVER_INFO {
-  PDRIVER_CMC_EXCEPTION_CALLBACK ExceptionCallback;
-  PKDEFERRED_ROUTINE DpcCallback;
-  PVOID DeviceContext;
-} CMC_DRIVER_INFO, *PCMC_DRIVER_INFO;
+typedef struct _IMAGE_INFO {
+  _ANONYMOUS_UNION union {
+    ULONG Properties;
+    _ANONYMOUS_STRUCT struct {
+      ULONG ImageAddressingMode:8;
+      ULONG SystemModeImage:1;
+      ULONG ImageMappedToAllPids:1;
+      ULONG ExtendedInfoPresent:1;
+      ULONG Reserved:22;
+    } DUMMYSTRUCTNAME;
+  } DUMMYUNIONNAME;
+  PVOID ImageBase;
+  ULONG ImageSelector;
+  SIZE_T ImageSize;
+  ULONG ImageSectionNumber;
+} IMAGE_INFO, *PIMAGE_INFO;
 
-typedef struct _CPE_DRIVER_INFO {
-  PDRIVER_CPE_EXCEPTION_CALLBACK ExceptionCallback;
-  PKDEFERRED_ROUTINE DpcCallback;
-  PVOID DeviceContext;
-} CPE_DRIVER_INFO, *PCPE_DRIVER_INFO;
+#define IMAGE_ADDRESSING_MODE_32BIT       3
 
-#endif // defined(_X86_) || defined(_IA64_) || defined(_AMD64_)
+typedef enum _BUS_DATA_TYPE {
+  ConfigurationSpaceUndefined = -1,
+  Cmos,
+  EisaConfiguration,
+  Pos,
+  CbusConfiguration,
+  PCIConfiguration,
+  VMEConfiguration,
+  NuBusConfiguration,
+  PCMCIAConfiguration,
+  MPIConfiguration,
+  MPSAConfiguration,
+  PNPISAConfiguration,
+  SgiInternalConfiguration,
+  MaximumBusDataType
+} BUS_DATA_TYPE, *PBUS_DATA_TYPE;
 
-#if defined(_IA64_)
+typedef struct _NT_TIB {
+  struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList;
+  PVOID StackBase;
+  PVOID StackLimit;
+  PVOID SubSystemTib;
+  _ANONYMOUS_UNION union {
+    PVOID FiberData;
+    ULONG Version;
+  } DUMMYUNIONNAME;
+  PVOID ArbitraryUserPointer;
+  struct _NT_TIB *Self;
+} NT_TIB, *PNT_TIB;
 
-typedef NTSTATUS
-(*HALSENDCROSSPARTITIONIPI)(
-  IN USHORT ProcessorID,
-  IN UCHAR HardwareVector);
+typedef struct _NT_TIB32 {
+  ULONG ExceptionList;
+  ULONG StackBase;
+  ULONG StackLimit;
+  ULONG SubSystemTib;
+  __GNU_EXTENSION union {
+    ULONG FiberData;
+    ULONG Version;
+  };
+  ULONG ArbitraryUserPointer;
+  ULONG Self;
+} NT_TIB32,*PNT_TIB32;
 
-typedef NTSTATUS
-(*HALRESERVECROSSPARTITIONINTERRUPTVECTOR)(
-  OUT PULONG Vector,
-  OUT PKIRQL Irql,
-  IN OUT PGROUP_AFFINITY Affinity,
-  OUT PUCHAR HardwareVector);
+typedef struct _NT_TIB64 {
+  ULONG64 ExceptionList;
+  ULONG64 StackBase;
+  ULONG64 StackLimit;
+  ULONG64 SubSystemTib;
+  __GNU_EXTENSION union {
+    ULONG64 FiberData;
+    ULONG Version;
+  };
+  ULONG64 ArbitraryUserPointer;
+  ULONG64 Self;
+} NT_TIB64,*PNT_TIB64;
 
-typedef VOID
-(*HALFREECROSSPARTITIONINTERRUPTVECTOR)(
-  IN ULONG Vector,
-  IN PGROUP_AFFINITY Affinity);
+typedef enum _PROCESSINFOCLASS {
+  ProcessBasicInformation,
+  ProcessQuotaLimits,
+  ProcessIoCounters,
+  ProcessVmCounters,
+  ProcessTimes,
+  ProcessBasePriority,
+  ProcessRaisePriority,
+  ProcessDebugPort,
+  ProcessExceptionPort,
+  ProcessAccessToken,
+  ProcessLdtInformation,
+  ProcessLdtSize,
+  ProcessDefaultHardErrorMode,
+  ProcessIoPortHandlers,
+  ProcessPooledUsageAndLimits,
+  ProcessWorkingSetWatch,
+  ProcessUserModeIOPL,
+  ProcessEnableAlignmentFaultFixup,
+  ProcessPriorityClass,
+  ProcessWx86Information,
+  ProcessHandleCount,
+  ProcessAffinityMask,
+  ProcessPriorityBoost,
+  ProcessDeviceMap,
+  ProcessSessionInformation,
+  ProcessForegroundInformation,
+  ProcessWow64Information,
+  ProcessImageFileName,
+  ProcessLUIDDeviceMapsEnabled,
+  ProcessBreakOnTermination,
+  ProcessDebugObjectHandle,
+  ProcessDebugFlags,
+  ProcessHandleTracing,
+  ProcessIoPriority,
+  ProcessExecuteFlags,
+  ProcessTlsInformation,
+  ProcessCookie,
+  ProcessImageInformation,
+  ProcessCycleTime,
+  ProcessPagePriority,
+  ProcessInstrumentationCallback,
+  ProcessThreadStackAllocation,
+  ProcessWorkingSetWatchEx,
+  ProcessImageFileNameWin32,
+  ProcessImageFileMapping,
+  ProcessAffinityUpdateMode,
+  ProcessMemoryAllocationMode,
+  ProcessGroupInformation,
+  ProcessTokenVirtualizationEnabled,
+  ProcessConsoleHostProcess,
+  ProcessWindowInformation,
+  MaxProcessInfoClass
+} PROCESSINFOCLASS;
 
-typedef struct _HAL_CROSS_PARTITION_IPI_INTERFACE {
-  HALSENDCROSSPARTITIONIPI HalSendCrossPartitionIpi;
-  HALRESERVECROSSPARTITIONINTERRUPTVECTOR HalReserveCrossPartitionInterruptVector;
-  HALFREECROSSPARTITIONINTERRUPTVECTOR HalFreeCrossPartitionInterruptVector;
-} HAL_CROSS_PARTITION_IPI_INTERFACE;
+typedef enum _THREADINFOCLASS {
+  ThreadBasicInformation,
+  ThreadTimes,
+  ThreadPriority,
+  ThreadBasePriority,
+  ThreadAffinityMask,
+  ThreadImpersonationToken,
+  ThreadDescriptorTableEntry,
+  ThreadEnableAlignmentFaultFixup,
+  ThreadEventPair_Reusable,
+  ThreadQuerySetWin32StartAddress,
+  ThreadZeroTlsCell,
+  ThreadPerformanceCount,
+  ThreadAmILastThread,
+  ThreadIdealProcessor,
+  ThreadPriorityBoost,
+  ThreadSetTlsArrayAddress,
+  ThreadIsIoPending,
+  ThreadHideFromDebugger,
+  ThreadBreakOnTermination,
+  ThreadSwitchLegacyState,
+  ThreadIsTerminated,
+  ThreadLastSystemCall,
+  ThreadIoPriority,
+  ThreadCycleTime,
+  ThreadPagePriority,
+  ThreadActualBasePriority,
+  ThreadTebInformation,
+  ThreadCSwitchMon,
+  ThreadCSwitchPmu,
+  ThreadWow64Context,
+  ThreadGroupInformation,
+  ThreadUmsInformation,
+  ThreadCounterProfiling,
+  ThreadIdealProcessorEx,
+  MaxThreadInfoClass
+} THREADINFOCLASS;
 
-#define HAL_CROSS_PARTITION_IPI_INTERFACE_MINIMUM_SIZE \
-    FIELD_OFFSET(HAL_CROSS_PARTITION_IPI_INTERFACE,    \
-                 HalFreeCrossPartitionInterruptVector)
+typedef struct _PROCESS_BASIC_INFORMATION {
+  NTSTATUS ExitStatus;
+  struct _PEB *PebBaseAddress;
+  ULONG_PTR AffinityMask;
+  KPRIORITY BasePriority;
+  ULONG_PTR UniqueProcessId;
+  ULONG_PTR InheritedFromUniqueProcessId;
+} PROCESS_BASIC_INFORMATION,*PPROCESS_BASIC_INFORMATION;
 
-#endif /* defined(_IA64_) */
+typedef struct _PROCESS_WS_WATCH_INFORMATION {
+  PVOID FaultingPc;
+  PVOID FaultingVa;
+} PROCESS_WS_WATCH_INFORMATION, *PPROCESS_WS_WATCH_INFORMATION;
 
-typedef struct _HAL_PLATFORM_INFORMATION {
-  ULONG PlatformFlags;
-} HAL_PLATFORM_INFORMATION, *PHAL_PLATFORM_INFORMATION;
+typedef struct _PROCESS_DEVICEMAP_INFORMATION {
+  __GNU_EXTENSION union {
+    struct {
+      HANDLE DirectoryHandle;
+    } Set;
+    struct {
+      ULONG DriveMap;
+      UCHAR DriveType[32];
+    } Query;
+  };
+} PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION;
 
-#define HAL_PLATFORM_DISABLE_WRITE_COMBINING      0x01L
-#define HAL_PLATFORM_DISABLE_PTCG                 0x04L
-#define HAL_PLATFORM_DISABLE_UC_MAIN_MEMORY       0x08L
-#define HAL_PLATFORM_ENABLE_WRITE_COMBINING_MMIO  0x10L
-#define HAL_PLATFORM_ACPI_TABLES_CACHED           0x20L
+typedef struct _KERNEL_USER_TIMES {
+  LARGE_INTEGER CreateTime;
+  LARGE_INTEGER ExitTime;
+  LARGE_INTEGER KernelTime;
+  LARGE_INTEGER UserTime;
+} KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
 
-/******************************************************************************
- *                              Kernel Types                                  *
- ******************************************************************************/
+typedef struct _PROCESS_ACCESS_TOKEN {
+  HANDLE Token;
+  HANDLE Thread;
+} PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;
 
-#define NX_SUPPORT_POLICY_ALWAYSOFF 0
-#define NX_SUPPORT_POLICY_ALWAYSON 1
-#define NX_SUPPORT_POLICY_OPTIN 2
-#define NX_SUPPORT_POLICY_OPTOUT 3
+typedef struct _PROCESS_SESSION_INFORMATION {
+  ULONG SessionId;
+} PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;
 
-typedef VOID
-(NTAPI *PEXPAND_STACK_CALLOUT)(
-  IN PVOID Parameter OPTIONAL);
+typedef enum _IO_QUERY_DEVICE_DATA_FORMAT {
+  IoQueryDeviceIdentifier = 0,
+  IoQueryDeviceConfigurationData,
+  IoQueryDeviceComponentInformation,
+  IoQueryDeviceMaxData
+} IO_QUERY_DEVICE_DATA_FORMAT, *PIO_QUERY_DEVICE_DATA_FORMAT;
+
+typedef struct _DISK_SIGNATURE {
+  ULONG PartitionStyle;
+  _ANONYMOUS_UNION union {
+    struct {
+      ULONG Signature;
+      ULONG CheckSum;
+    } Mbr;
+    struct {
+      GUID DiskId;
+    } Gpt;
+  } DUMMYUNIONNAME;
+} DISK_SIGNATURE, *PDISK_SIGNATURE;
+
+typedef ULONG_PTR
+(NTAPI *PDRIVER_VERIFIER_THUNK_ROUTINE)(
+  IN PVOID Context);
+
+typedef struct _DRIVER_VERIFIER_THUNK_PAIRS {
+  PDRIVER_VERIFIER_THUNK_ROUTINE PristineRoutine;
+  PDRIVER_VERIFIER_THUNK_ROUTINE NewRoutine;
+} DRIVER_VERIFIER_THUNK_PAIRS, *PDRIVER_VERIFIER_THUNK_PAIRS;
+
+#define DRIVER_VERIFIER_SPECIAL_POOLING             0x0001
+#define DRIVER_VERIFIER_FORCE_IRQL_CHECKING         0x0002
+#define DRIVER_VERIFIER_INJECT_ALLOCATION_FAILURES  0x0004
+#define DRIVER_VERIFIER_TRACK_POOL_ALLOCATIONS      0x0008
+#define DRIVER_VERIFIER_IO_CHECKING                 0x0010
 
 typedef VOID
 (NTAPI *PTIMER_APC_ROUTINE)(
@@ -1813,3545 +1077,1651 @@ typedef VOID
   IN ULONG TimerLowValue,
   IN LONG TimerHighValue);
 
-typedef enum _TIMER_SET_INFORMATION_CLASS {
-  TimerSetCoalescableTimer,
-  MaxTimerInfoClass 
-} TIMER_SET_INFORMATION_CLASS;
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-typedef struct _TIMER_SET_COALESCABLE_TIMER_INFO {
-  IN LARGE_INTEGER DueTime;
-  IN PTIMER_APC_ROUTINE TimerApcRoutine OPTIONAL;
-  IN PVOID TimerContext OPTIONAL;
-  IN struct _COUNTED_REASON_CONTEXT *WakeContext OPTIONAL;
-  IN ULONG Period OPTIONAL;
-  IN ULONG TolerableDelay;
-  OUT PBOOLEAN PreviousState OPTIONAL;
-} TIMER_SET_COALESCABLE_TIMER_INFO, *PTIMER_SET_COALESCABLE_TIMER_INFO;
-#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
-
-#define XSTATE_LEGACY_FLOATING_POINT        0
-#define XSTATE_LEGACY_SSE                   1
-#define XSTATE_GSSE                         2
-
-#define XSTATE_MASK_LEGACY_FLOATING_POINT   (1i64 << (XSTATE_LEGACY_FLOATING_POINT))
-#define XSTATE_MASK_LEGACY_SSE              (1i64 << (XSTATE_LEGACY_SSE))
-#define XSTATE_MASK_LEGACY                  (XSTATE_MASK_LEGACY_FLOATING_POINT | XSTATE_MASK_LEGACY_SSE)
-#define XSTATE_MASK_GSSE                    (1i64 << (XSTATE_GSSE))
-
-#define MAXIMUM_XSTATE_FEATURES             64
-
-typedef struct _XSTATE_FEATURE {
-  ULONG Offset;
-  ULONG Size;
-} XSTATE_FEATURE, *PXSTATE_FEATURE;
-
-typedef struct _XSTATE_CONFIGURATION {
-  ULONG64 EnabledFeatures;
-  ULONG Size;
-  ULONG OptimizedSave:1;
-  XSTATE_FEATURE Features[MAXIMUM_XSTATE_FEATURES];
-} XSTATE_CONFIGURATION, *PXSTATE_CONFIGURATION;
-
-#define MAX_WOW64_SHARED_ENTRIES 16
-
-typedef struct _KUSER_SHARED_DATA {
-  ULONG TickCountLowDeprecated;
-  ULONG TickCountMultiplier;
-  volatile KSYSTEM_TIME InterruptTime;
-  volatile KSYSTEM_TIME SystemTime;
-  volatile KSYSTEM_TIME TimeZoneBias;
-  USHORT ImageNumberLow;
-  USHORT ImageNumberHigh;
-  WCHAR NtSystemRoot[260];
-  ULONG MaxStackTraceDepth;
-  ULONG CryptoExponent;
-  ULONG TimeZoneId;
-  ULONG LargePageMinimum;
-  ULONG Reserved2[7];
-  NT_PRODUCT_TYPE NtProductType;
-  BOOLEAN ProductTypeIsValid;
-  ULONG NtMajorVersion;
-  ULONG NtMinorVersion;
-  BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];
-  ULONG Reserved1;
-  ULONG Reserved3;
-  volatile ULONG TimeSlip;
-  ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
-  ULONG AltArchitecturePad[1];
-  LARGE_INTEGER SystemExpirationDate;
-  ULONG SuiteMask;
-  BOOLEAN KdDebuggerEnabled;
+typedef struct _KUSER_SHARED_DATA
+{
+    ULONG TickCountLowDeprecated;
+    ULONG TickCountMultiplier;
+    volatile KSYSTEM_TIME InterruptTime;
+    volatile KSYSTEM_TIME SystemTime;
+    volatile KSYSTEM_TIME TimeZoneBias;
+    USHORT ImageNumberLow;
+    USHORT ImageNumberHigh;
+    WCHAR NtSystemRoot[260];
+    ULONG MaxStackTraceDepth;
+    ULONG CryptoExponent;
+    ULONG TimeZoneId;
+    ULONG LargePageMinimum;
+    ULONG Reserved2[7];
+    NT_PRODUCT_TYPE NtProductType;
+    BOOLEAN ProductTypeIsValid;
+    ULONG NtMajorVersion;
+    ULONG NtMinorVersion;
+    BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];
+    ULONG Reserved1;
+    ULONG Reserved3;
+    volatile ULONG TimeSlip;
+    ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
+    ULONG AltArchitecturePad[1];
+    LARGE_INTEGER SystemExpirationDate;
+    ULONG SuiteMask;
+    BOOLEAN KdDebuggerEnabled;
 #if (NTDDI_VERSION >= NTDDI_WINXPSP2)
-  UCHAR NXSupportPolicy;
+    UCHAR NXSupportPolicy;
 #endif
-  volatile ULONG ActiveConsoleId;
-  volatile ULONG DismountCount;
-  ULONG ComPlusPackage;
-  ULONG LastSystemRITEventTickCount;
-  ULONG NumberOfPhysicalPages;
-  BOOLEAN SafeBootMode;
+    volatile ULONG ActiveConsoleId;
+    volatile ULONG DismountCount;
+    ULONG ComPlusPackage;
+    ULONG LastSystemRITEventTickCount;
+    ULONG NumberOfPhysicalPages;
+    BOOLEAN SafeBootMode;
 #if (NTDDI_VERSION >= NTDDI_WIN7)
-  union {
-    UCHAR TscQpcData;
-    struct {
-      UCHAR TscQpcEnabled:1;
-      UCHAR TscQpcSpareFlag:1;
-      UCHAR TscQpcShift:6;
-    } DUMMYSTRUCTNAME;
-  } DUMMYUNIONNAME;
-  UCHAR TscQpcPad[2];
+    union {
+        UCHAR TscQpcData;
+        struct {
+            UCHAR TscQpcEnabled:1;
+            UCHAR TscQpcSpareFlag:1;
+            UCHAR TscQpcShift:6;
+        } DUMMYSTRUCTNAME;
+    } DUMMYUNIONNAME;
+    UCHAR TscQpcPad[2];
 #endif
 #if (NTDDI_VERSION >= NTDDI_VISTA)
-  union {
-    ULONG SharedDataFlags;
-    struct {
-      ULONG DbgErrorPortPresent:1;
-      ULONG DbgElevationEnabled:1;
-      ULONG DbgVirtEnabled:1;
-      ULONG DbgInstallerDetectEnabled:1;
-      ULONG DbgSystemDllRelocated:1;
-      ULONG DbgDynProcessorEnabled:1;
-      ULONG DbgSEHValidationEnabled:1;
-      ULONG SpareBits:25;
-    } DUMMYSTRUCTNAME2;
-  } DUMMYUNIONNAME2;
+    union {
+        ULONG SharedDataFlags;
+        struct {
+            ULONG DbgErrorPortPresent:1;
+            ULONG DbgElevationEnabled:1;
+            ULONG DbgVirtEnabled:1;
+            ULONG DbgInstallerDetectEnabled:1;
+            ULONG DbgSystemDllRelocated:1;
+            ULONG DbgDynProcessorEnabled:1;
+            ULONG DbgSEHValidationEnabled:1;
+            ULONG SpareBits:25;
+        } DUMMYSTRUCTNAME2;
+    } DUMMYUNIONNAME2;
 #else
-  ULONG TraceLogging;
+    ULONG TraceLogging;
 #endif
-  ULONG DataFlagsPad[1];
-  ULONGLONG TestRetInstruction;
-  ULONG SystemCall;
-  ULONG SystemCallReturn;
-  ULONGLONG SystemCallPad[3];
-  _ANONYMOUS_UNION union {
-    volatile KSYSTEM_TIME TickCount;
-    volatile ULONG64 TickCountQuad;
-    _ANONYMOUS_STRUCT struct {
-      ULONG ReservedTickCountOverlay[3];
-      ULONG TickCountPad[1];
-    } DUMMYSTRUCTNAME;
-  } DUMMYUNIONNAME3;
-  ULONG Cookie;
-  ULONG CookiePad[1];
+    ULONG DataFlagsPad[1];
+    ULONGLONG TestRetInstruction;
+    ULONG SystemCall;
+    ULONG SystemCallReturn;
+    ULONGLONG SystemCallPad[3];
+    _ANONYMOUS_UNION union {
+        volatile KSYSTEM_TIME TickCount;
+        volatile ULONG64 TickCountQuad;
+        _ANONYMOUS_STRUCT struct {
+            ULONG ReservedTickCountOverlay[3];
+            ULONG TickCountPad[1];
+        } DUMMYSTRUCTNAME;
+    } DUMMYUNIONNAME3;
+    ULONG Cookie;
+    ULONG CookiePad[1];
 #if (NTDDI_VERSION >= NTDDI_WS03)
-  LONGLONG ConsoleSessionForegroundProcessId;
-  ULONG Wow64SharedInformation[MAX_WOW64_SHARED_ENTRIES];
+    LONGLONG ConsoleSessionForegroundProcessId;
+    ULONG Wow64SharedInformation[MAX_WOW64_SHARED_ENTRIES];
 #endif
 #if (NTDDI_VERSION >= NTDDI_VISTA)
 #if (NTDDI_VERSION >= NTDDI_WIN7)
-  USHORT UserModeGlobalLogger[16];
+    USHORT UserModeGlobalLogger[16];
 #else
-  USHORT UserModeGlobalLogger[8];
-  ULONG HeapTracingPid[2];
-  ULONG CritSecTracingPid[2];
+    USHORT UserModeGlobalLogger[8];
+    ULONG HeapTracingPid[2];
+    ULONG CritSecTracingPid[2];
 #endif
-  ULONG ImageFileExecutionOptions;
+    ULONG ImageFileExecutionOptions;
 #if (NTDDI_VERSION >= NTDDI_VISTASP1)
-  ULONG LangGenerationCount;
+    ULONG LangGenerationCount;
 #else
-  /* 4 bytes padding */
+    /* 4 bytes padding */
 #endif
-  ULONGLONG Reserved5;
-  volatile ULONG64 InterruptTimeBias;
+    ULONGLONG Reserved5;
+    volatile ULONG64 InterruptTimeBias;
 #endif
 #if (NTDDI_VERSION >= NTDDI_WIN7)
-  volatile ULONG64 TscQpcBias;
-  volatile ULONG ActiveProcessorCount;
-  volatile USHORT ActiveGroupCount;
-  USHORT Reserved4;
-  volatile ULONG AitSamplingValue;
-  volatile ULONG AppCompatFlag;
-  ULONGLONG SystemDllNativeRelocation;
-  ULONG SystemDllWowRelocation;
-  ULONG XStatePad[1];
-  XSTATE_CONFIGURATION XState;
+    volatile ULONG64 TscQpcBias;
+    volatile ULONG ActiveProcessorCount;
+    volatile USHORT ActiveGroupCount;
+    USHORT Reserved4;
+    volatile ULONG AitSamplingValue;
+    volatile ULONG AppCompatFlag;
+    ULONGLONG SystemDllNativeRelocation;
+    ULONG SystemDllWowRelocation;
+    ULONG XStatePad[1];
+    XSTATE_CONFIGURATION XState;
 #endif
 } KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;
 
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-extern NTSYSAPI volatile CCHAR KeNumberProcessors;
-#elif (NTDDI_VERSION >= NTDDI_WINXP)
-extern NTSYSAPI CCHAR KeNumberProcessors;
+extern NTKERNELAPI PVOID MmHighestUserAddress;
+extern NTKERNELAPI PVOID MmSystemRangeStart;
+extern NTKERNELAPI ULONG MmUserProbeAddress;
+
+
+#ifdef _X86_
+
+#define MM_HIGHEST_USER_ADDRESS MmHighestUserAddress
+#define MM_SYSTEM_RANGE_START MmSystemRangeStart
+#if defined(_LOCAL_COPY_USER_PROBE_ADDRESS_)
+#define MM_USER_PROBE_ADDRESS _LOCAL_COPY_USER_PROBE_ADDRESS_
+extern ULONG _LOCAL_COPY_USER_PROBE_ADDRESS_;
 #else
-extern PCCHAR KeNumberProcessors;
+#define MM_USER_PROBE_ADDRESS MmUserProbeAddress
+#endif
+#define MM_LOWEST_USER_ADDRESS (PVOID)0x10000
+#define MM_KSEG0_BASE       MM_SYSTEM_RANGE_START
+#define MM_SYSTEM_SPACE_END 0xFFFFFFFF
+#if !defined (_X86PAE_)
+#define MM_LOWEST_SYSTEM_ADDRESS (PVOID)0xC0800000
+#else
+#define MM_LOWEST_SYSTEM_ADDRESS (PVOID)0xC0C00000
 #endif
 
+#define KeGetPcr()                      PCR
 
-/******************************************************************************
- *                          Kernel Debugger Types                             *
- ******************************************************************************/
-typedef struct _DEBUG_DEVICE_ADDRESS {
-  UCHAR Type;
-  BOOLEAN Valid;
-  UCHAR Reserved[2];
-  PUCHAR TranslatedAddress;
-  ULONG Length;
-} DEBUG_DEVICE_ADDRESS, *PDEBUG_DEVICE_ADDRESS;
+#define KERNEL_STACK_SIZE                   12288
+#define KERNEL_LARGE_STACK_SIZE             61440
+#define KERNEL_LARGE_STACK_COMMIT           12288
 
-typedef struct _DEBUG_MEMORY_REQUIREMENTS {
-  PHYSICAL_ADDRESS Start;
-  PHYSICAL_ADDRESS MaxEnd;
-  PVOID VirtualAddress;
-  ULONG Length;
-  BOOLEAN Cached;
-  BOOLEAN Aligned;
-} DEBUG_MEMORY_REQUIREMENTS, *PDEBUG_MEMORY_REQUIREMENTS;
+#define SIZE_OF_80387_REGISTERS   80
 
-typedef struct _DEBUG_DEVICE_DESCRIPTOR {
-  ULONG Bus;
-  ULONG Slot;
-  USHORT Segment;
-  USHORT VendorID;
-  USHORT DeviceID;
-  UCHAR BaseClass;
-  UCHAR SubClass;
-  UCHAR ProgIf;
-  BOOLEAN Initialized;
-  BOOLEAN Configured;
-  DEBUG_DEVICE_ADDRESS BaseAddress[6];
-  DEBUG_MEMORY_REQUIREMENTS Memory;
-} DEBUG_DEVICE_DESCRIPTOR, *PDEBUG_DEVICE_DESCRIPTOR;
+#define PCR_MINOR_VERSION 1
+#define PCR_MAJOR_VERSION 1
 
-typedef NTSTATUS
-(NTAPI *pKdSetupPciDeviceForDebugging)(
-  IN PVOID LoaderBlock OPTIONAL,
-  IN OUT PDEBUG_DEVICE_DESCRIPTOR PciDevice);
+#if !defined(RC_INVOKED)
 
-typedef NTSTATUS
-(NTAPI *pKdReleasePciDeviceForDebugging)(
-  IN OUT PDEBUG_DEVICE_DESCRIPTOR PciDevice);
+#define CONTEXT_i386               0x10000
+#define CONTEXT_i486               0x10000
+#define CONTEXT_CONTROL            (CONTEXT_i386|0x00000001L)
+#define CONTEXT_INTEGER            (CONTEXT_i386|0x00000002L)
+#define CONTEXT_SEGMENTS           (CONTEXT_i386|0x00000004L)
+#define CONTEXT_FLOATING_POINT     (CONTEXT_i386|0x00000008L)
+#define CONTEXT_DEBUG_REGISTERS    (CONTEXT_i386|0x00000010L)
+#define CONTEXT_EXTENDED_REGISTERS (CONTEXT_i386|0x00000020L)
 
-typedef PVOID
-(NTAPI *pKdGetAcpiTablePhase0)(
-  IN struct _LOADER_PARAMETER_BLOCK *LoaderBlock,
-  IN ULONG Signature);
+#define CONTEXT_FULL  (CONTEXT_CONTROL|CONTEXT_INTEGER|CONTEXT_SEGMENTS)
 
-typedef VOID
-(NTAPI *pKdCheckPowerButton)(
-  VOID);
+#endif /* !defined(RC_INVOKED) */
 
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-typedef PVOID
-(NTAPI *pKdMapPhysicalMemory64)(
-  IN PHYSICAL_ADDRESS PhysicalAddress,
-  IN ULONG NumberPages,
-  IN BOOLEAN FlushCurrentTLB);
+typedef struct _KPCR {
+  union {
+    NT_TIB NtTib;
+    struct {
+      struct _EXCEPTION_REGISTRATION_RECORD *Used_ExceptionList;
+      PVOID Used_StackBase;
+      PVOID Spare2;
+      PVOID TssCopy;
+      ULONG ContextSwitches;
+      KAFFINITY SetMemberCopy;
+      PVOID Used_Self;
+    };
+  };
+  struct _KPCR *SelfPcr;
+  struct _KPRCB *Prcb;
+  KIRQL Irql;
+  ULONG IRR;
+  ULONG IrrActive;
+  ULONG IDR;
+  PVOID KdVersionBlock;
+  struct _KIDTENTRY *IDT;
+  struct _KGDTENTRY *GDT;
+  struct _KTSS *TSS;
+  USHORT MajorVersion;
+  USHORT MinorVersion;
+  KAFFINITY SetMember;
+  ULONG StallScaleFactor;
+  UCHAR SpareUnused;
+  UCHAR Number;
+  UCHAR Spare0;
+  UCHAR SecondLevelCacheAssociativity;
+  ULONG VdmAlert;
+  ULONG KernelReserved[14];
+  ULONG SecondLevelCacheSize;
+  ULONG HalReserved[16];
+} KPCR, *PKPCR;
 
-typedef VOID
-(NTAPI *pKdUnmapVirtualAddress)(
-  IN PVOID VirtualAddress,
-  IN ULONG NumberPages,
-  IN BOOLEAN FlushCurrentTLB);
-#else
-typedef PVOID
-(NTAPI *pKdMapPhysicalMemory64)(
-  IN PHYSICAL_ADDRESS PhysicalAddress,
-  IN ULONG NumberPages);
+FORCEINLINE
+ULONG
+KeGetCurrentProcessorNumber(VOID)
+{
+    return (ULONG)__readfsbyte(FIELD_OFFSET(KPCR, Number));
+}
 
-typedef VOID
-(NTAPI *pKdUnmapVirtualAddress)(
-  IN PVOID VirtualAddress,
-  IN ULONG NumberPages);
-#endif
+typedef struct _FLOATING_SAVE_AREA {
+  ULONG ControlWord;
+  ULONG StatusWord;
+  ULONG TagWord;
+  ULONG ErrorOffset;
+  ULONG ErrorSelector;
+  ULONG DataOffset;
+  ULONG DataSelector;
+  UCHAR RegisterArea[SIZE_OF_80387_REGISTERS];
+  ULONG Cr0NpxState;
+} FLOATING_SAVE_AREA, *PFLOATING_SAVE_AREA;
 
-typedef ULONG
-(NTAPI *pKdGetPciDataByOffset)(
-  IN ULONG BusNumber,
-  IN ULONG SlotNumber,
-  OUT PVOID Buffer,
-  IN ULONG Offset,
-  IN ULONG Length);
+#include "pshpack4.h"
+typedef struct _CONTEXT {
+  ULONG ContextFlags;
+  ULONG Dr0;
+  ULONG Dr1;
+  ULONG Dr2;
+  ULONG Dr3;
+  ULONG Dr6;
+  ULONG Dr7;
+  FLOATING_SAVE_AREA FloatSave;
+  ULONG SegGs;
+  ULONG SegFs;
+  ULONG SegEs;
+  ULONG SegDs;
+  ULONG Edi;
+  ULONG Esi;
+  ULONG Ebx;
+  ULONG Edx;
+  ULONG Ecx;
+  ULONG Eax;
+  ULONG Ebp;
+  ULONG Eip;
+  ULONG SegCs;
+  ULONG EFlags;
+  ULONG Esp;
+  ULONG SegSs;
+  UCHAR ExtendedRegisters[MAXIMUM_SUPPORTED_EXTENSION];
+} CONTEXT;
+#include "poppack.h"
 
-typedef ULONG
-(NTAPI *pKdSetPciDataByOffset)(
-  IN ULONG BusNumber,
-  IN ULONG SlotNumber,
-  IN PVOID Buffer,
-  IN ULONG Offset,
-  IN ULONG Length);
-/******************************************************************************
- *                         Memory manager Types                               *
- ******************************************************************************/
+#endif /* _X86_ */
 
-typedef struct _PHYSICAL_MEMORY_RANGE {
-  PHYSICAL_ADDRESS BaseAddress;
-  LARGE_INTEGER NumberOfBytes;
-} PHYSICAL_MEMORY_RANGE, *PPHYSICAL_MEMORY_RANGE;
+#ifdef _AMD64_
 
-typedef NTSTATUS
-(NTAPI *PMM_ROTATE_COPY_CALLBACK_FUNCTION)(
-  IN PMDL DestinationMdl,
-  IN PMDL SourceMdl,
-  IN PVOID Context);
-
-typedef enum _MM_ROTATE_DIRECTION {
-  MmToFrameBuffer,
-  MmToFrameBufferNoCopy,
-  MmToRegularMemory,
-  MmToRegularMemoryNoCopy,
-  MmMaximumRotateDirection
-} MM_ROTATE_DIRECTION, *PMM_ROTATE_DIRECTION;
-
-
-/******************************************************************************
- *                           Process Manager Types                            *
- ******************************************************************************/
-
-#define QUOTA_LIMITS_HARDWS_MIN_ENABLE  0x00000001
-#define QUOTA_LIMITS_HARDWS_MIN_DISABLE 0x00000002
-#define QUOTA_LIMITS_HARDWS_MAX_ENABLE  0x00000004
-#define QUOTA_LIMITS_HARDWS_MAX_DISABLE 0x00000008
-#define QUOTA_LIMITS_USE_DEFAULT_LIMITS 0x00000010
-
-typedef struct _QUOTA_LIMITS {
-  SIZE_T PagedPoolLimit;
-  SIZE_T NonPagedPoolLimit;
-  SIZE_T MinimumWorkingSetSize;
-  SIZE_T MaximumWorkingSetSize;
-  SIZE_T PagefileLimit;
-  LARGE_INTEGER TimeLimit;
-} QUOTA_LIMITS, *PQUOTA_LIMITS;
-
-typedef union _RATE_QUOTA_LIMIT {
-  ULONG RateData;
-  struct {
-    ULONG RatePercent:7;
-    ULONG Reserved0:25;
-  } DUMMYSTRUCTNAME;
-} RATE_QUOTA_LIMIT, *PRATE_QUOTA_LIMIT;
-
-typedef struct _QUOTA_LIMITS_EX {
-  SIZE_T PagedPoolLimit;
-  SIZE_T NonPagedPoolLimit;
-  SIZE_T MinimumWorkingSetSize;
-  SIZE_T MaximumWorkingSetSize;
-  SIZE_T PagefileLimit;
-  LARGE_INTEGER TimeLimit;
-  SIZE_T WorkingSetLimit;
-  SIZE_T Reserved2;
-  SIZE_T Reserved3;
-  SIZE_T Reserved4;
-  ULONG Flags;
-  RATE_QUOTA_LIMIT CpuRateLimit;
-} QUOTA_LIMITS_EX, *PQUOTA_LIMITS_EX;
-
-typedef struct _IO_COUNTERS {
-  ULONGLONG ReadOperationCount;
-  ULONGLONG WriteOperationCount;
-  ULONGLONG OtherOperationCount;
-  ULONGLONG ReadTransferCount;
-  ULONGLONG WriteTransferCount;
-  ULONGLONG OtherTransferCount;
-} IO_COUNTERS, *PIO_COUNTERS;
-
-typedef struct _VM_COUNTERS {
-  SIZE_T PeakVirtualSize;
-  SIZE_T VirtualSize;
-  ULONG PageFaultCount;
-  SIZE_T PeakWorkingSetSize;
-  SIZE_T WorkingSetSize;
-  SIZE_T QuotaPeakPagedPoolUsage;
-  SIZE_T QuotaPagedPoolUsage;
-  SIZE_T QuotaPeakNonPagedPoolUsage;
-  SIZE_T QuotaNonPagedPoolUsage;
-  SIZE_T PagefileUsage;
-  SIZE_T PeakPagefileUsage;
-} VM_COUNTERS, *PVM_COUNTERS;
-
-typedef struct _VM_COUNTERS_EX {
-  SIZE_T PeakVirtualSize;
-  SIZE_T VirtualSize;
-  ULONG PageFaultCount;
-  SIZE_T PeakWorkingSetSize;
-  SIZE_T WorkingSetSize;
-  SIZE_T QuotaPeakPagedPoolUsage;
-  SIZE_T QuotaPagedPoolUsage;
-  SIZE_T QuotaPeakNonPagedPoolUsage;
-  SIZE_T QuotaNonPagedPoolUsage;
-  SIZE_T PagefileUsage;
-  SIZE_T PeakPagefileUsage;
-  SIZE_T PrivateUsage;
-} VM_COUNTERS_EX, *PVM_COUNTERS_EX;
-
-#define MAX_HW_COUNTERS 16
-#define THREAD_PROFILING_FLAG_DISPATCH  0x00000001
-
-typedef enum _HARDWARE_COUNTER_TYPE {
-  PMCCounter,
-  MaxHardwareCounterType
-} HARDWARE_COUNTER_TYPE, *PHARDWARE_COUNTER_TYPE;
-
-typedef struct _HARDWARE_COUNTER {
-  HARDWARE_COUNTER_TYPE Type;
-  ULONG Reserved;
-  ULONG64 Index;
-} HARDWARE_COUNTER, *PHARDWARE_COUNTER;
-
-typedef struct _POOLED_USAGE_AND_LIMITS {
-  SIZE_T PeakPagedPoolUsage;
-  SIZE_T PagedPoolUsage;
-  SIZE_T PagedPoolLimit;
-  SIZE_T PeakNonPagedPoolUsage;
-  SIZE_T NonPagedPoolUsage;
-  SIZE_T NonPagedPoolLimit;
-  SIZE_T PeakPagefileUsage;
-  SIZE_T PagefileUsage;
-  SIZE_T PagefileLimit;
-} POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS;
-
-typedef struct _PROCESS_ACCESS_TOKEN {
-  HANDLE Token;
-  HANDLE Thread;
-} PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;
-
-#define PROCESS_EXCEPTION_PORT_ALL_STATE_BITS     0x00000003UL
-#define PROCESS_EXCEPTION_PORT_ALL_STATE_FLAGS    ((ULONG_PTR)((1UL << PROCESS_EXCEPTION_PORT_ALL_STATE_BITS) - 1))
-
-typedef struct _PROCESS_EXCEPTION_PORT {
-  IN HANDLE ExceptionPortHandle;
-  IN OUT ULONG StateFlags;
-} PROCESS_EXCEPTION_PORT, *PPROCESS_EXCEPTION_PORT;
-
-typedef VOID
-(NTAPI *PCREATE_PROCESS_NOTIFY_ROUTINE)(
-  IN HANDLE ParentId,
-  IN HANDLE ProcessId,
-  IN BOOLEAN Create);
-
-typedef struct _PS_CREATE_NOTIFY_INFO {
-  IN SIZE_T Size;
-  union {
-    IN ULONG Flags;
-    struct {
-      IN ULONG FileOpenNameAvailable:1;
-      IN ULONG Reserved:31;
-    };
-  };
-  IN HANDLE ParentProcessId;
-  IN CLIENT_ID CreatingThreadId;
-  IN OUT struct _FILE_OBJECT *FileObject;
-  IN PCUNICODE_STRING ImageFileName;
-  IN PCUNICODE_STRING CommandLine OPTIONAL;
-  IN OUT NTSTATUS CreationStatus;
-} PS_CREATE_NOTIFY_INFO, *PPS_CREATE_NOTIFY_INFO;
-
-typedef VOID
-(NTAPI *PCREATE_PROCESS_NOTIFY_ROUTINE_EX)(
-  IN OUT PEPROCESS Process,
-  IN HANDLE ProcessId,
-  IN PPS_CREATE_NOTIFY_INFO CreateInfo OPTIONAL);
-
-typedef VOID
-(NTAPI *PCREATE_THREAD_NOTIFY_ROUTINE)(
-  IN HANDLE ProcessId,
-  IN HANDLE ThreadId,
-  IN BOOLEAN Create);
-
-#define IMAGE_ADDRESSING_MODE_32BIT       3
-
-typedef struct _IMAGE_INFO {
-  _ANONYMOUS_UNION union {
-    ULONG Properties;
-    _ANONYMOUS_STRUCT struct {
-      ULONG ImageAddressingMode:8;
-      ULONG SystemModeImage:1;
-      ULONG ImageMappedToAllPids:1;
-      ULONG ExtendedInfoPresent:1;
-      ULONG Reserved:21;
-    } DUMMYSTRUCTNAME;
-  } DUMMYUNIONNAME;
-  PVOID ImageBase;
-  ULONG ImageSelector;
-  SIZE_T ImageSize;
-  ULONG ImageSectionNumber;
-} IMAGE_INFO, *PIMAGE_INFO;
-
-typedef struct _IMAGE_INFO_EX {
-  SIZE_T Size;
-  IMAGE_INFO ImageInfo;
-  struct _FILE_OBJECT *FileObject;
-} IMAGE_INFO_EX, *PIMAGE_INFO_EX;
-
-typedef VOID
-(NTAPI *PLOAD_IMAGE_NOTIFY_ROUTINE)(
-  IN PUNICODE_STRING FullImageName,
-  IN HANDLE ProcessId,
-  IN PIMAGE_INFO ImageInfo);
-
-#define THREAD_CSWITCH_PMU_DISABLE  FALSE
-#define THREAD_CSWITCH_PMU_ENABLE   TRUE
-
-#define PROCESS_LUID_DOSDEVICES_ONLY 0x00000001
-
-#define PROCESS_HANDLE_TRACING_MAX_STACKS 16
-
-typedef struct _NT_TIB {
-  struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList;
-  PVOID StackBase;
-  PVOID StackLimit;
-  PVOID SubSystemTib;
-  _ANONYMOUS_UNION union {
-    PVOID FiberData;
-    ULONG Version;
-  } DUMMYUNIONNAME;
-  PVOID ArbitraryUserPointer;
-  struct _NT_TIB *Self;
-} NT_TIB, *PNT_TIB;
-
-typedef struct _NT_TIB32 {
-  ULONG ExceptionList;
-  ULONG StackBase;
-  ULONG StackLimit;
-  ULONG SubSystemTib;
-  __GNU_EXTENSION union {
-    ULONG FiberData;
-    ULONG Version;
-  };
-  ULONG ArbitraryUserPointer;
-  ULONG Self;
-} NT_TIB32,*PNT_TIB32;
-
-typedef struct _NT_TIB64 {
-  ULONG64 ExceptionList;
-  ULONG64 StackBase;
-  ULONG64 StackLimit;
-  ULONG64 SubSystemTib;
-  __GNU_EXTENSION union {
-    ULONG64 FiberData;
-    ULONG Version;
-  };
-  ULONG64 ArbitraryUserPointer;
-  ULONG64 Self;
-} NT_TIB64,*PNT_TIB64;
-
-typedef enum _PROCESSINFOCLASS {
-  ProcessBasicInformation,
-  ProcessQuotaLimits,
-  ProcessIoCounters,
-  ProcessVmCounters,
-  ProcessTimes,
-  ProcessBasePriority,
-  ProcessRaisePriority,
-  ProcessDebugPort,
-  ProcessExceptionPort,
-  ProcessAccessToken,
-  ProcessLdtInformation,
-  ProcessLdtSize,
-  ProcessDefaultHardErrorMode,
-  ProcessIoPortHandlers,
-  ProcessPooledUsageAndLimits,
-  ProcessWorkingSetWatch,
-  ProcessUserModeIOPL,
-  ProcessEnableAlignmentFaultFixup,
-  ProcessPriorityClass,
-  ProcessWx86Information,
-  ProcessHandleCount,
-  ProcessAffinityMask,
-  ProcessPriorityBoost,
-  ProcessDeviceMap,
-  ProcessSessionInformation,
-  ProcessForegroundInformation,
-  ProcessWow64Information,
-  ProcessImageFileName,
-  ProcessLUIDDeviceMapsEnabled,
-  ProcessBreakOnTermination,
-  ProcessDebugObjectHandle,
-  ProcessDebugFlags,
-  ProcessHandleTracing,
-  ProcessIoPriority,
-  ProcessExecuteFlags,
-  ProcessTlsInformation,
-  ProcessCookie,
-  ProcessImageInformation,
-  ProcessCycleTime,
-  ProcessPagePriority,
-  ProcessInstrumentationCallback,
-  ProcessThreadStackAllocation,
-  ProcessWorkingSetWatchEx,
-  ProcessImageFileNameWin32,
-  ProcessImageFileMapping,
-  ProcessAffinityUpdateMode,
-  ProcessMemoryAllocationMode,
-  ProcessGroupInformation,
-  ProcessTokenVirtualizationEnabled,
-  ProcessConsoleHostProcess,
-  ProcessWindowInformation,
-  MaxProcessInfoClass
-} PROCESSINFOCLASS;
-
-typedef enum _THREADINFOCLASS {
-  ThreadBasicInformation,
-  ThreadTimes,
-  ThreadPriority,
-  ThreadBasePriority,
-  ThreadAffinityMask,
-  ThreadImpersonationToken,
-  ThreadDescriptorTableEntry,
-  ThreadEnableAlignmentFaultFixup,
-  ThreadEventPair_Reusable,
-  ThreadQuerySetWin32StartAddress,
-  ThreadZeroTlsCell,
-  ThreadPerformanceCount,
-  ThreadAmILastThread,
-  ThreadIdealProcessor,
-  ThreadPriorityBoost,
-  ThreadSetTlsArrayAddress,
-  ThreadIsIoPending,
-  ThreadHideFromDebugger,
-  ThreadBreakOnTermination,
-  ThreadSwitchLegacyState,
-  ThreadIsTerminated,
-  ThreadLastSystemCall,
-  ThreadIoPriority,
-  ThreadCycleTime,
-  ThreadPagePriority,
-  ThreadActualBasePriority,
-  ThreadTebInformation,
-  ThreadCSwitchMon,
-  ThreadCSwitchPmu,
-  ThreadWow64Context,
-  ThreadGroupInformation,
-  ThreadUmsInformation,
-  ThreadCounterProfiling,
-  ThreadIdealProcessorEx,
-  MaxThreadInfoClass
-} THREADINFOCLASS;
-
-typedef struct _PAGE_PRIORITY_INFORMATION {
-  ULONG PagePriority;
-} PAGE_PRIORITY_INFORMATION, *PPAGE_PRIORITY_INFORMATION;
-
-typedef struct _PROCESS_WS_WATCH_INFORMATION {
-  PVOID FaultingPc;
-  PVOID FaultingVa;
-} PROCESS_WS_WATCH_INFORMATION, *PPROCESS_WS_WATCH_INFORMATION;
-
-typedef struct _PROCESS_BASIC_INFORMATION {
-  NTSTATUS ExitStatus;
-  struct _PEB *PebBaseAddress;
-  ULONG_PTR AffinityMask;
-  KPRIORITY BasePriority;
-  ULONG_PTR UniqueProcessId;
-  ULONG_PTR InheritedFromUniqueProcessId;
-} PROCESS_BASIC_INFORMATION,*PPROCESS_BASIC_INFORMATION;
-
-typedef struct _PROCESS_EXTENDED_BASIC_INFORMATION {
-  SIZE_T Size;
-  PROCESS_BASIC_INFORMATION BasicInfo;
-  union {
-    ULONG Flags;
-    struct {
-      ULONG IsProtectedProcess:1;
-      ULONG IsWow64Process:1;
-      ULONG IsProcessDeleting:1;
-      ULONG IsCrossSessionCreate:1;
-      ULONG SpareBits:28;
-    } DUMMYSTRUCTNAME;
-  } DUMMYUNIONNAME;
-} PROCESS_EXTENDED_BASIC_INFORMATION, *PPROCESS_EXTENDED_BASIC_INFORMATION;
-
-typedef struct _PROCESS_DEVICEMAP_INFORMATION {
-  __GNU_EXTENSION union {
-    struct {
-      HANDLE DirectoryHandle;
-    } Set;
-    struct {
-      ULONG DriveMap;
-      UCHAR DriveType[32];
-    } Query;
-  };
-} PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION;
-
-typedef struct _PROCESS_DEVICEMAP_INFORMATION_EX {
-  union {
-    struct {
-      HANDLE DirectoryHandle;
-    } Set;
-    struct {
-      ULONG DriveMap;
-      UCHAR DriveType[32];
-    } Query;
-  } DUMMYUNIONNAME;
-  ULONG Flags;
-} PROCESS_DEVICEMAP_INFORMATION_EX, *PPROCESS_DEVICEMAP_INFORMATION_EX;
-
-typedef struct _PROCESS_SESSION_INFORMATION {
-  ULONG SessionId;
-} PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;
-
-typedef struct _PROCESS_HANDLE_TRACING_ENABLE {
-  ULONG Flags;
-} PROCESS_HANDLE_TRACING_ENABLE, *PPROCESS_HANDLE_TRACING_ENABLE;
-
-typedef struct _PROCESS_HANDLE_TRACING_ENABLE_EX {
-  ULONG Flags;
-  ULONG TotalSlots;
-} PROCESS_HANDLE_TRACING_ENABLE_EX, *PPROCESS_HANDLE_TRACING_ENABLE_EX;
-
-typedef struct _PROCESS_HANDLE_TRACING_ENTRY {
-  HANDLE Handle;
-  CLIENT_ID ClientId;
-  ULONG Type;
-  PVOID Stacks[PROCESS_HANDLE_TRACING_MAX_STACKS];
-} PROCESS_HANDLE_TRACING_ENTRY, *PPROCESS_HANDLE_TRACING_ENTRY;
-
-typedef struct _PROCESS_HANDLE_TRACING_QUERY {
-  HANDLE Handle;
-  ULONG TotalTraces;
-  PROCESS_HANDLE_TRACING_ENTRY HandleTrace[1];
-} PROCESS_HANDLE_TRACING_QUERY, *PPROCESS_HANDLE_TRACING_QUERY;
-
-extern NTKERNELAPI PEPROCESS PsInitialSystemProcess;
-
-
-/******************************************************************************
- *                           Runtime Library Types                            *
- ******************************************************************************/
-
-
-
-#ifndef _RTL_RUN_ONCE_DEF
-#define _RTL_RUN_ONCE_DEF
-
-#define RTL_RUN_ONCE_INIT {0}
-
-#define RTL_RUN_ONCE_CHECK_ONLY     0x00000001UL
-#define RTL_RUN_ONCE_ASYNC          0x00000002UL
-#define RTL_RUN_ONCE_INIT_FAILED    0x00000004UL
-
-#define RTL_RUN_ONCE_CTX_RESERVED_BITS 2
-
-#define RTL_HASH_ALLOCATED_HEADER            0x00000001
-
-#define RTL_HASH_RESERVED_SIGNATURE 0
-
-/* RtlVerifyVersionInfo() ComparisonType */
-
-#define VER_EQUAL                       1
-#define VER_GREATER                     2
-#define VER_GREATER_EQUAL               3
-#define VER_LESS                        4
-#define VER_LESS_EQUAL                  5
-#define VER_AND                         6
-#define VER_OR                          7
-
-#define VER_CONDITION_MASK              7
-#define VER_NUM_BITS_PER_CONDITION_MASK 3
-
-/* RtlVerifyVersionInfo() TypeMask */
-
-#define VER_MINORVERSION                  0x0000001
-#define VER_MAJORVERSION                  0x0000002
-#define VER_BUILDNUMBER                   0x0000004
-#define VER_PLATFORMID                    0x0000008
-#define VER_SERVICEPACKMINOR              0x0000010
-#define VER_SERVICEPACKMAJOR              0x0000020
-#define VER_SUITENAME                     0x0000040
-#define VER_PRODUCT_TYPE                  0x0000080
-
-#define VER_NT_WORKSTATION              0x0000001
-#define VER_NT_DOMAIN_CONTROLLER        0x0000002
-#define VER_NT_SERVER                   0x0000003
-
-#define VER_PLATFORM_WIN32s             0
-#define VER_PLATFORM_WIN32_WINDOWS      1
-#define VER_PLATFORM_WIN32_NT           2
-
-typedef union _RTL_RUN_ONCE {
-  PVOID Ptr;
-} RTL_RUN_ONCE, *PRTL_RUN_ONCE;
-
-typedef ULONG /* LOGICAL */
-(NTAPI *PRTL_RUN_ONCE_INIT_FN) (
-  IN OUT PRTL_RUN_ONCE RunOnce,
-  IN OUT PVOID Parameter OPTIONAL,
-  IN OUT PVOID *Context OPTIONAL);
-
-#endif /* _RTL_RUN_ONCE_DEF */
-
-typedef enum _TABLE_SEARCH_RESULT {
-  TableEmptyTree,
-  TableFoundNode,
-  TableInsertAsLeft,
-  TableInsertAsRight
-} TABLE_SEARCH_RESULT;
-
-typedef enum _RTL_GENERIC_COMPARE_RESULTS {
-  GenericLessThan,
-  GenericGreaterThan,
-  GenericEqual
-} RTL_GENERIC_COMPARE_RESULTS;
-
-// Forwarder
-struct _RTL_AVL_TABLE;
-
-typedef RTL_GENERIC_COMPARE_RESULTS
-(NTAPI *PRTL_AVL_COMPARE_ROUTINE) (
-  IN struct _RTL_AVL_TABLE *Table,
-  IN PVOID FirstStruct,
-  IN PVOID SecondStruct);
-
-typedef PVOID
-(NTAPI *PRTL_AVL_ALLOCATE_ROUTINE) (
-  IN struct _RTL_AVL_TABLE *Table,
-  IN CLONG ByteSize);
-
-typedef VOID
-(NTAPI *PRTL_AVL_FREE_ROUTINE) (
-  IN struct _RTL_AVL_TABLE *Table,
-  IN PVOID Buffer);
-
-typedef NTSTATUS
-(NTAPI *PRTL_AVL_MATCH_FUNCTION) (
-  IN struct _RTL_AVL_TABLE *Table,
-  IN PVOID UserData,
-  IN PVOID MatchData);
-
-typedef struct _RTL_BALANCED_LINKS {
-  struct _RTL_BALANCED_LINKS *Parent;
-  struct _RTL_BALANCED_LINKS *LeftChild;
-  struct _RTL_BALANCED_LINKS *RightChild;
-  CHAR Balance;
-  UCHAR Reserved[3];
-} RTL_BALANCED_LINKS, *PRTL_BALANCED_LINKS;
-
-typedef struct _RTL_AVL_TABLE {
-  RTL_BALANCED_LINKS BalancedRoot;
-  PVOID OrderedPointer;
-  ULONG WhichOrderedElement;
-  ULONG NumberGenericTableElements;
-  ULONG DepthOfTree;
-  PRTL_BALANCED_LINKS RestartKey;
-  ULONG DeleteCount;
-  PRTL_AVL_COMPARE_ROUTINE CompareRoutine;
-  PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine;
-  PRTL_AVL_FREE_ROUTINE FreeRoutine;
-  PVOID TableContext;
-} RTL_AVL_TABLE, *PRTL_AVL_TABLE;
-
-#ifndef RTL_USE_AVL_TABLES
-
-struct _RTL_GENERIC_TABLE;
-
-typedef RTL_GENERIC_COMPARE_RESULTS
-(NTAPI *PRTL_GENERIC_COMPARE_ROUTINE) (
-  IN struct _RTL_GENERIC_TABLE *Table,
-  IN PVOID FirstStruct,
-  IN PVOID SecondStruct);
-
-typedef PVOID
-(NTAPI *PRTL_GENERIC_ALLOCATE_ROUTINE) (
-  IN struct _RTL_GENERIC_TABLE *Table,
-  IN CLONG ByteSize);
-
-typedef VOID
-(NTAPI *PRTL_GENERIC_FREE_ROUTINE) (
-  IN struct _RTL_GENERIC_TABLE *Table,
-  IN PVOID Buffer);
-
-typedef struct _RTL_SPLAY_LINKS {
-  struct _RTL_SPLAY_LINKS *Parent;
-  struct _RTL_SPLAY_LINKS *LeftChild;
-  struct _RTL_SPLAY_LINKS *RightChild;
-} RTL_SPLAY_LINKS, *PRTL_SPLAY_LINKS;
-
-typedef struct _RTL_GENERIC_TABLE {
-  PRTL_SPLAY_LINKS TableRoot;
-  LIST_ENTRY InsertOrderList;
-  PLIST_ENTRY OrderedPointer;
-  ULONG WhichOrderedElement;
-  ULONG NumberGenericTableElements;
-  PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine;
-  PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine;
-  PRTL_GENERIC_FREE_ROUTINE FreeRoutine;
-  PVOID TableContext;
-} RTL_GENERIC_TABLE, *PRTL_GENERIC_TABLE;
-
-#endif /* !RTL_USE_AVL_TABLES */
-
-#ifdef RTL_USE_AVL_TABLES
-
-#undef PRTL_GENERIC_COMPARE_ROUTINE
-#undef RTL_GENERIC_COMPARE_ROUTINE
-#undef PRTL_GENERIC_ALLOCATE_ROUTINE
-#undef RTL_GENERIC_ALLOCATE_ROUTINE
-#undef PRTL_GENERIC_FREE_ROUTINE
-#undef RTL_GENERIC_FREE_ROUTINE
-#undef RTL_GENERIC_TABLE
-#undef PRTL_GENERIC_TABLE
-
-#define PRTL_GENERIC_COMPARE_ROUTINE PRTL_AVL_COMPARE_ROUTINE
-#define RTL_GENERIC_COMPARE_ROUTINE RTL_AVL_COMPARE_ROUTINE
-#define PRTL_GENERIC_ALLOCATE_ROUTINE PRTL_AVL_ALLOCATE_ROUTINE
-#define RTL_GENERIC_ALLOCATE_ROUTINE RTL_AVL_ALLOCATE_ROUTINE
-#define PRTL_GENERIC_FREE_ROUTINE PRTL_AVL_FREE_ROUTINE
-#define RTL_GENERIC_FREE_ROUTINE RTL_AVL_FREE_ROUTINE
-#define RTL_GENERIC_TABLE RTL_AVL_TABLE
-#define PRTL_GENERIC_TABLE PRTL_AVL_TABLE
-
-#endif /* RTL_USE_AVL_TABLES */
-
-typedef struct _RTL_DYNAMIC_HASH_TABLE_ENTRY {
-  LIST_ENTRY Linkage;
-  ULONG_PTR Signature;
-} RTL_DYNAMIC_HASH_TABLE_ENTRY, *PRTL_DYNAMIC_HASH_TABLE_ENTRY;
-
-typedef struct _RTL_DYNAMIC_HASH_TABLE_CONTEXT {
-  PLIST_ENTRY ChainHead;
-  PLIST_ENTRY PrevLinkage;
-  ULONG_PTR Signature;
-} RTL_DYNAMIC_HASH_TABLE_CONTEXT, *PRTL_DYNAMIC_HASH_TABLE_CONTEXT;
-
-typedef struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR {
-  RTL_DYNAMIC_HASH_TABLE_ENTRY HashEntry;
-  PLIST_ENTRY ChainHead;
-  ULONG BucketIndex;
-} RTL_DYNAMIC_HASH_TABLE_ENUMERATOR, *PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR;
-
-typedef struct _RTL_DYNAMIC_HASH_TABLE {
-  ULONG Flags;
-  ULONG Shift;
-  ULONG TableSize;
-  ULONG Pivot;
-  ULONG DivisorMask;
-  ULONG NumEntries;
-  ULONG NonEmptyBuckets;
-  ULONG NumEnumerators;
-  PVOID Directory;
-} RTL_DYNAMIC_HASH_TABLE, *PRTL_DYNAMIC_HASH_TABLE;
-
-typedef struct _OSVERSIONINFOA {
-  ULONG dwOSVersionInfoSize;
-  ULONG dwMajorVersion;
-  ULONG dwMinorVersion;
-  ULONG dwBuildNumber;
-  ULONG dwPlatformId;
-  CHAR szCSDVersion[128];
-} OSVERSIONINFOA, *POSVERSIONINFOA, *LPOSVERSIONINFOA;
-
-typedef struct _OSVERSIONINFOW {
-  ULONG dwOSVersionInfoSize;
-  ULONG dwMajorVersion;
-  ULONG dwMinorVersion;
-  ULONG dwBuildNumber;
-  ULONG dwPlatformId;
-  WCHAR szCSDVersion[128];
-} OSVERSIONINFOW, *POSVERSIONINFOW, *LPOSVERSIONINFOW, RTL_OSVERSIONINFOW, *PRTL_OSVERSIONINFOW;
-
-typedef struct _OSVERSIONINFOEXA {
-  ULONG dwOSVersionInfoSize;
-  ULONG dwMajorVersion;
-  ULONG dwMinorVersion;
-  ULONG dwBuildNumber;
-  ULONG dwPlatformId;
-  CHAR szCSDVersion[128];
-  USHORT wServicePackMajor;
-  USHORT wServicePackMinor;
-  USHORT wSuiteMask;
-  UCHAR wProductType;
-  UCHAR wReserved;
-} OSVERSIONINFOEXA, *POSVERSIONINFOEXA, *LPOSVERSIONINFOEXA;
-
-typedef struct _OSVERSIONINFOEXW {
-  ULONG dwOSVersionInfoSize;
-  ULONG dwMajorVersion;
-  ULONG dwMinorVersion;
-  ULONG dwBuildNumber;
-  ULONG dwPlatformId;
-  WCHAR szCSDVersion[128];
-  USHORT wServicePackMajor;
-  USHORT wServicePackMinor;
-  USHORT wSuiteMask;
-  UCHAR wProductType;
-  UCHAR wReserved;
-} OSVERSIONINFOEXW, *POSVERSIONINFOEXW, *LPOSVERSIONINFOEXW, RTL_OSVERSIONINFOEXW, *PRTL_OSVERSIONINFOEXW;
-
-#ifdef UNICODE
-typedef OSVERSIONINFOEXW OSVERSIONINFOEX;
-typedef POSVERSIONINFOEXW POSVERSIONINFOEX;
-typedef LPOSVERSIONINFOEXW LPOSVERSIONINFOEX;
-typedef OSVERSIONINFOW OSVERSIONINFO;
-typedef POSVERSIONINFOW POSVERSIONINFO;
-typedef LPOSVERSIONINFOW LPOSVERSIONINFO;
-#else
-typedef OSVERSIONINFOEXA OSVERSIONINFOEX;
-typedef POSVERSIONINFOEXA POSVERSIONINFOEX;
-typedef LPOSVERSIONINFOEXA LPOSVERSIONINFOEX;
-typedef OSVERSIONINFOA OSVERSIONINFO;
-typedef POSVERSIONINFOA POSVERSIONINFO;
-typedef LPOSVERSIONINFOA LPOSVERSIONINFO;
-#endif /* UNICODE */
-
-#define HASH_ENTRY_KEY(x)    ((x)->Signature)
-
-/******************************************************************************
- *                            Security Manager Types                          *
- ******************************************************************************/
-#define SE_UNSOLICITED_INPUT_PRIVILEGE    6
-
-typedef enum _WELL_KNOWN_SID_TYPE {
-  WinNullSid = 0,
-  WinWorldSid = 1,
-  WinLocalSid = 2,
-  WinCreatorOwnerSid = 3,
-  WinCreatorGroupSid = 4,
-  WinCreatorOwnerServerSid = 5,
-  WinCreatorGroupServerSid = 6,
-  WinNtAuthoritySid = 7,
-  WinDialupSid = 8,
-  WinNetworkSid = 9,
-  WinBatchSid = 10,
-  WinInteractiveSid = 11,
-  WinServiceSid = 12,
-  WinAnonymousSid = 13,
-  WinProxySid = 14,
-  WinEnterpriseControllersSid = 15,
-  WinSelfSid = 16,
-  WinAuthenticatedUserSid = 17,
-  WinRestrictedCodeSid = 18,
-  WinTerminalServerSid = 19,
-  WinRemoteLogonIdSid = 20,
-  WinLogonIdsSid = 21,
-  WinLocalSystemSid = 22,
-  WinLocalServiceSid = 23,
-  WinNetworkServiceSid = 24,
-  WinBuiltinDomainSid = 25,
-  WinBuiltinAdministratorsSid = 26,
-  WinBuiltinUsersSid = 27,
-  WinBuiltinGuestsSid = 28,
-  WinBuiltinPowerUsersSid = 29,
-  WinBuiltinAccountOperatorsSid = 30,
-  WinBuiltinSystemOperatorsSid = 31,
-  WinBuiltinPrintOperatorsSid = 32,
-  WinBuiltinBackupOperatorsSid = 33,
-  WinBuiltinReplicatorSid = 34,
-  WinBuiltinPreWindows2000CompatibleAccessSid = 35,
-  WinBuiltinRemoteDesktopUsersSid = 36,
-  WinBuiltinNetworkConfigurationOperatorsSid = 37,
-  WinAccountAdministratorSid = 38,
-  WinAccountGuestSid = 39,
-  WinAccountKrbtgtSid = 40,
-  WinAccountDomainAdminsSid = 41,
-  WinAccountDomainUsersSid = 42,
-  WinAccountDomainGuestsSid = 43,
-  WinAccountComputersSid = 44,
-  WinAccountControllersSid = 45,
-  WinAccountCertAdminsSid = 46,
-  WinAccountSchemaAdminsSid = 47,
-  WinAccountEnterpriseAdminsSid = 48,
-  WinAccountPolicyAdminsSid = 49,
-  WinAccountRasAndIasServersSid = 50,
-  WinNTLMAuthenticationSid = 51,
-  WinDigestAuthenticationSid = 52,
-  WinSChannelAuthenticationSid = 53,
-  WinThisOrganizationSid = 54,
-  WinOtherOrganizationSid = 55,
-  WinBuiltinIncomingForestTrustBuildersSid = 56,
-  WinBuiltinPerfMonitoringUsersSid = 57,
-  WinBuiltinPerfLoggingUsersSid = 58,
-  WinBuiltinAuthorizationAccessSid = 59,
-  WinBuiltinTerminalServerLicenseServersSid = 60,
-  WinBuiltinDCOMUsersSid = 61,
-  WinBuiltinIUsersSid = 62,
-  WinIUserSid = 63,
-  WinBuiltinCryptoOperatorsSid = 64,
-  WinUntrustedLabelSid = 65,
-  WinLowLabelSid = 66,
-  WinMediumLabelSid = 67,
-  WinHighLabelSid = 68,
-  WinSystemLabelSid = 69,
-  WinWriteRestrictedCodeSid = 70,
-  WinCreatorOwnerRightsSid = 71,
-  WinCacheablePrincipalsGroupSid = 72,
-  WinNonCacheablePrincipalsGroupSid = 73,
-  WinEnterpriseReadonlyControllersSid = 74,
-  WinAccountReadonlyControllersSid = 75,
-  WinBuiltinEventLogReadersGroup = 76,
-  WinNewEnterpriseReadonlyControllersSid = 77,
-  WinBuiltinCertSvcDComAccessGroup = 78,
-  WinMediumPlusLabelSid = 79,
-  WinLocalLogonSid = 80,
-  WinConsoleLogonSid = 81,
-  WinThisOrganizationCertificateSid = 82,
-} WELL_KNOWN_SID_TYPE;
-
-
-
-#if defined(_M_IX86)
-
-#define PAUSE_PROCESSOR YieldProcessor();
-
-#define KERNEL_STACK_SIZE                   12288
-#define KERNEL_LARGE_STACK_SIZE             61440
-#define KERNEL_LARGE_STACK_COMMIT           12288
-
-#define SIZE_OF_80387_REGISTERS   80
-
-#if !defined(RC_INVOKED)
-
-#define CONTEXT_i386               0x10000
-#define CONTEXT_i486               0x10000
-#define CONTEXT_CONTROL            (CONTEXT_i386|0x00000001L)
-#define CONTEXT_INTEGER            (CONTEXT_i386|0x00000002L)
-#define CONTEXT_SEGMENTS           (CONTEXT_i386|0x00000004L)
-#define CONTEXT_FLOATING_POINT     (CONTEXT_i386|0x00000008L)
-#define CONTEXT_DEBUG_REGISTERS    (CONTEXT_i386|0x00000010L)
-#define CONTEXT_EXTENDED_REGISTERS (CONTEXT_i386|0x00000020L)
-
-#define CONTEXT_FULL  (CONTEXT_CONTROL|CONTEXT_INTEGER|CONTEXT_SEGMENTS)
-#define CONTEXT_ALL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS |  \
-                     CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS |      \
-                     CONTEXT_EXTENDED_REGISTERS)
-
-#define CONTEXT_XSTATE          (CONTEXT_i386 | 0x00000040L)
-
-#endif /* !defined(RC_INVOKED) */
-
-typedef struct _FLOATING_SAVE_AREA {
-  ULONG ControlWord;
-  ULONG StatusWord;
-  ULONG TagWord;
-  ULONG ErrorOffset;
-  ULONG ErrorSelector;
-  ULONG DataOffset;
-  ULONG DataSelector;
-  UCHAR RegisterArea[SIZE_OF_80387_REGISTERS];
-  ULONG Cr0NpxState;
-} FLOATING_SAVE_AREA, *PFLOATING_SAVE_AREA;
-
-#include "pshpack4.h"
-typedef struct _CONTEXT {
-  ULONG ContextFlags;
-  ULONG Dr0;
-  ULONG Dr1;
-  ULONG Dr2;
-  ULONG Dr3;
-  ULONG Dr6;
-  ULONG Dr7;
-  FLOATING_SAVE_AREA FloatSave;
-  ULONG SegGs;
-  ULONG SegFs;
-  ULONG SegEs;
-  ULONG SegDs;
-  ULONG Edi;
-  ULONG Esi;
-  ULONG Ebx;
-  ULONG Edx;
-  ULONG Ecx;
-  ULONG Eax;
-  ULONG Ebp;
-  ULONG Eip;
-  ULONG SegCs;
-  ULONG EFlags;
-  ULONG Esp;
-  ULONG SegSs;
-  UCHAR ExtendedRegisters[MAXIMUM_SUPPORTED_EXTENSION];
-} CONTEXT;
-#include "poppack.h"
-
-#define KeGetPcr()                      PCR
-
-#define PCR_MINOR_VERSION 1
-#define PCR_MAJOR_VERSION 1
-
-typedef struct _KPCR {
-  union {
-    NT_TIB NtTib;
-    struct {
-      struct _EXCEPTION_REGISTRATION_RECORD *Used_ExceptionList;
-      PVOID Used_StackBase;
-      PVOID Spare2;
-      PVOID TssCopy;
-      ULONG ContextSwitches;
-      KAFFINITY SetMemberCopy;
-      PVOID Used_Self;
-    };
-  };
-  struct _KPCR *SelfPcr;
-  struct _KPRCB *Prcb;
-  KIRQL Irql;
-  ULONG IRR;
-  ULONG IrrActive;
-  ULONG IDR;
-  PVOID KdVersionBlock;
-  struct _KIDTENTRY *IDT;
-  struct _KGDTENTRY *GDT;
-  struct _KTSS *TSS;
-  USHORT MajorVersion;
-  USHORT MinorVersion;
-  KAFFINITY SetMember;
-  ULONG StallScaleFactor;
-  UCHAR SpareUnused;
-  UCHAR Number;
-  UCHAR Spare0;
-  UCHAR SecondLevelCacheAssociativity;
-  ULONG VdmAlert;
-  ULONG KernelReserved[14];
-  ULONG SecondLevelCacheSize;
-  ULONG HalReserved[16];
-} KPCR, *PKPCR;
-
-FORCEINLINE
-ULONG
-KeGetCurrentProcessorNumber(VOID)
-{
-    return (ULONG)__readfsbyte(FIELD_OFFSET(KPCR, Number));
-}
-
-
-
-
-
-
-extern NTKERNELAPI PVOID MmHighestUserAddress;
-extern NTKERNELAPI PVOID MmSystemRangeStart;
-extern NTKERNELAPI ULONG MmUserProbeAddress;
-
-#define MM_HIGHEST_USER_ADDRESS           MmHighestUserAddress
-#define MM_SYSTEM_RANGE_START             MmSystemRangeStart
-#if defined(_LOCAL_COPY_USER_PROBE_ADDRESS_)
-#define MM_USER_PROBE_ADDRESS _LOCAL_COPY_USER_PROBE_ADDRESS_
-extern ULONG _LOCAL_COPY_USER_PROBE_ADDRESS_;
-#else
-#define MM_USER_PROBE_ADDRESS             MmUserProbeAddress
-#endif
-#define MM_LOWEST_USER_ADDRESS   (PVOID)0x10000
-#define MM_KSEG0_BASE       MM_SYSTEM_RANGE_START
-#define MM_SYSTEM_SPACE_END 0xFFFFFFFF
-#if !defined (_X86PAE_)
-#define MM_LOWEST_SYSTEM_ADDRESS (PVOID)0xC0800000
-#else
-#define MM_LOWEST_SYSTEM_ADDRESS (PVOID)0xC0C00000
-#endif
-
-#elif defined(_M_AMD64)
-
-#define PAUSE_PROCESSOR YieldProcessor();
-
-#define KERNEL_STACK_SIZE 0x6000
-#define KERNEL_LARGE_STACK_SIZE 0x12000
-#define KERNEL_LARGE_STACK_COMMIT KERNEL_STACK_SIZE
-
-#define KERNEL_MCA_EXCEPTION_STACK_SIZE 0x2000
-
-#define EXCEPTION_READ_FAULT    0
-#define EXCEPTION_WRITE_FAULT   1
-#define EXCEPTION_EXECUTE_FAULT 8
-
-#if !defined(RC_INVOKED)
-
-#define CONTEXT_AMD64 0x100000
-
-#define CONTEXT_CONTROL (CONTEXT_AMD64 | 0x1L)
-#define CONTEXT_INTEGER (CONTEXT_AMD64 | 0x2L)
-#define CONTEXT_SEGMENTS (CONTEXT_AMD64 | 0x4L)
-#define CONTEXT_FLOATING_POINT (CONTEXT_AMD64 | 0x8L)
-#define CONTEXT_DEBUG_REGISTERS (CONTEXT_AMD64 | 0x10L)
-
-#define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_FLOATING_POINT)
-#define CONTEXT_ALL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS)
-
-#define CONTEXT_XSTATE (CONTEXT_AMD64 | 0x20L)
-
-#define CONTEXT_EXCEPTION_ACTIVE 0x8000000
-#define CONTEXT_SERVICE_ACTIVE 0x10000000
-#define CONTEXT_EXCEPTION_REQUEST 0x40000000
-#define CONTEXT_EXCEPTION_REPORTING 0x80000000
-
-#endif /* !defined(RC_INVOKED) */
-
-#define INITIAL_MXCSR                  0x1f80
-#define INITIAL_FPCSR                  0x027f
-
-typedef struct DECLSPEC_ALIGN(16) _CONTEXT {
-    ULONG64 P1Home;
-    ULONG64 P2Home;
-    ULONG64 P3Home;
-    ULONG64 P4Home;
-    ULONG64 P5Home;
-    ULONG64 P6Home;
-    ULONG ContextFlags;
-    ULONG MxCsr;
-    USHORT SegCs;
-    USHORT SegDs;
-    USHORT SegEs;
-    USHORT SegFs;
-    USHORT SegGs;
-    USHORT SegSs;
-    ULONG EFlags;
-    ULONG64 Dr0;
-    ULONG64 Dr1;
-    ULONG64 Dr2;
-    ULONG64 Dr3;
-    ULONG64 Dr6;
-    ULONG64 Dr7;
-    ULONG64 Rax;
-    ULONG64 Rcx;
-    ULONG64 Rdx;
-    ULONG64 Rbx;
-    ULONG64 Rsp;
-    ULONG64 Rbp;
-    ULONG64 Rsi;
-    ULONG64 Rdi;
-    ULONG64 R8;
-    ULONG64 R9;
-    ULONG64 R10;
-    ULONG64 R11;
-    ULONG64 R12;
-    ULONG64 R13;
-    ULONG64 R14;
-    ULONG64 R15;
-    ULONG64 Rip;
-   union {
-       XMM_SAVE_AREA32 FltSave;
-       struct {
-           M128A Header[2];
-           M128A Legacy[8];
-           M128A Xmm0;
-           M128A Xmm1;
-           M128A Xmm2;
-           M128A Xmm3;
-           M128A Xmm4;
-           M128A Xmm5;
-           M128A Xmm6;
-           M128A Xmm7;
-           M128A Xmm8;
-           M128A Xmm9;
-           M128A Xmm10;
-           M128A Xmm11;
-           M128A Xmm12;
-           M128A Xmm13;
-           M128A Xmm14;
-           M128A Xmm15;
-      } DUMMYSTRUCTNAME;
-    } DUMMYUNIONNAME;
-    M128A VectorRegister[26];
-    ULONG64 VectorControl;
-    ULONG64 DebugControl;
-    ULONG64 LastBranchToRip;
-    ULONG64 LastBranchFromRip;
-    ULONG64 LastExceptionToRip;
-    ULONG64 LastExceptionFromRip;
-} CONTEXT;
-
-#define PCR_MINOR_VERSION 1
-#define PCR_MAJOR_VERSION 1
-
-typedef struct _KPCR
-{
-    _ANONYMOUS_UNION union
-    {
-        NT_TIB NtTib;
-        _ANONYMOUS_STRUCT struct
-        {
-            union _KGDTENTRY64 *GdtBase;
-            struct _KTSS64 *TssBase;
-            ULONG64 UserRsp;
-            struct _KPCR *Self;
-            struct _KPRCB *CurrentPrcb;
-            PKSPIN_LOCK_QUEUE LockArray;
-            PVOID Used_Self;
-        };
-    };
-    union _KIDTENTRY64 *IdtBase;
-    ULONG64 Unused[2];
-    KIRQL Irql;
-    UCHAR SecondLevelCacheAssociativity;
-    UCHAR ObsoleteNumber;
-    UCHAR Fill0;
-    ULONG Unused0[3];
-    USHORT MajorVersion;
-    USHORT MinorVersion;
-    ULONG StallScaleFactor;
-    PVOID Unused1[3];
-    ULONG KernelReserved[15];
-    ULONG SecondLevelCacheSize;
-    ULONG HalReserved[16];
-    ULONG Unused2;
-    PVOID KdVersionBlock;
-    PVOID Unused3;
-    ULONG PcrAlign1[24];
-} KPCR, *PKPCR;
-
-FORCEINLINE
-PKPCR
-KeGetPcr(VOID)
-{
-    return (PKPCR)__readgsqword(FIELD_OFFSET(KPCR, Self));
-}
-
-FORCEINLINE
-ULONG
-KeGetCurrentProcessorNumber(VOID)
-{
-    return (ULONG)__readgsword(0x184);
-}
-
-
-#define PTI_SHIFT  12L
-#define PDI_SHIFT  21L
-#define PPI_SHIFT  30L
-#define PXI_SHIFT  39L
-#define PTE_PER_PAGE 512
-#define PDE_PER_PAGE 512
-#define PPE_PER_PAGE 512
-#define PXE_PER_PAGE 512
-#define PTI_MASK_AMD64 (PTE_PER_PAGE - 1)
-#define PDI_MASK_AMD64 (PDE_PER_PAGE - 1)
-#define PPI_MASK (PPE_PER_PAGE - 1)
-#define PXI_MASK (PXE_PER_PAGE - 1)
-
-#define PXE_BASE    0xFFFFF6FB7DBED000ULL
-#define PXE_SELFMAP 0xFFFFF6FB7DBEDF68ULL
-#define PPE_BASE    0xFFFFF6FB7DA00000ULL
-#define PDE_BASE    0xFFFFF6FB40000000ULL
-#define PTE_BASE    0xFFFFF68000000000ULL
-#define PXE_TOP     0xFFFFF6FB7DBEDFFFULL
-#define PPE_TOP     0xFFFFF6FB7DBFFFFFULL
-#define PDE_TOP     0xFFFFF6FB7FFFFFFFULL
-#define PTE_TOP     0xFFFFF6FFFFFFFFFFULL
-
-extern NTKERNELAPI PVOID MmHighestUserAddress;
-extern NTKERNELAPI PVOID MmSystemRangeStart;
-extern NTKERNELAPI ULONG64 MmUserProbeAddress;
-
-#define MM_HIGHEST_USER_ADDRESS           MmHighestUserAddress
-#define MM_SYSTEM_RANGE_START             MmSystemRangeStart
-#define MM_USER_PROBE_ADDRESS             MmUserProbeAddress
-#define MM_LOWEST_USER_ADDRESS   (PVOID)0x10000
-#define MM_LOWEST_SYSTEM_ADDRESS (PVOID)0xFFFF080000000000ULL
-
-
-#elif defined(_M_IA64)
-
-#elif defined(_M_PPC)
-
-
-#elif defined(_M_MIPS)
-
-#elif defined(_M_ARM)
-#else
-#error Unknown Architecture
-#endif
-
-/******************************************************************************
- *                          Executive Functions                               *
- ******************************************************************************/
-static __inline PVOID
-ExAllocateFromZone(
-  IN PZONE_HEADER Zone)
-{
-  if (Zone->FreeList.Next)
-    Zone->FreeList.Next = Zone->FreeList.Next->Next;
-  return (PVOID) Zone->FreeList.Next;
-}
-
-static __inline PVOID
-ExFreeToZone(
-  IN PZONE_HEADER  Zone,
-  IN PVOID  Block)
-{
-  ((PSINGLE_LIST_ENTRY) Block)->Next = Zone->FreeList.Next;
-  Zone->FreeList.Next = ((PSINGLE_LIST_ENTRY) Block);
-  return ((PSINGLE_LIST_ENTRY) Block)->Next;
-}
-
-/*
- * PVOID
- * ExInterlockedAllocateFromZone(
- *   IN PZONE_HEADER  Zone,
- *   IN PKSPIN_LOCK  Lock)
- */
-#define ExInterlockedAllocateFromZone(Zone, Lock) \
-    ((PVOID) ExInterlockedPopEntryList(&Zone->FreeList, Lock))
-
-/* PVOID
- * ExInterlockedFreeToZone(
- *  IN PZONE_HEADER  Zone,
- *  IN PVOID  Block,
- *  IN PKSPIN_LOCK  Lock);
- */
-#define ExInterlockedFreeToZone(Zone, Block, Lock) \
-    ExInterlockedPushEntryList(&(Zone)->FreeList, (PSINGLE_LIST_ENTRY)(Block), Lock)
-
-/*
- * BOOLEAN
- * ExIsFullZone(
- *  IN PZONE_HEADER  Zone)
- */
-#define ExIsFullZone(Zone) \
-  ((Zone)->FreeList.Next == (PSINGLE_LIST_ENTRY) NULL)
-
-/* BOOLEAN
- * ExIsObjectInFirstZoneSegment(
- *     IN PZONE_HEADER Zone,
- *     IN PVOID Object);
- */
-#define ExIsObjectInFirstZoneSegment(Zone,Object) \
-    ((BOOLEAN)( ((PUCHAR)(Object) >= (PUCHAR)(Zone)->SegmentList.Next) && \
-                ((PUCHAR)(Object) <  (PUCHAR)(Zone)->SegmentList.Next + \
-                         (Zone)->TotalSegmentSize)) )
-
-#define ExAcquireResourceExclusive ExAcquireResourceExclusiveLite
-#define ExAcquireResourceShared ExAcquireResourceSharedLite
-#define ExConvertExclusiveToShared ExConvertExclusiveToSharedLite
-#define ExDeleteResource ExDeleteResourceLite
-#define ExInitializeResource ExInitializeResourceLite
-#define ExIsResourceAcquiredExclusive ExIsResourceAcquiredExclusiveLite
-#define ExIsResourceAcquiredShared ExIsResourceAcquiredSharedLite
-#define ExIsResourceAcquired ExIsResourceAcquiredSharedLite
-#define ExReleaseResourceForThread ExReleaseResourceForThreadLite
-
-#ifdef _X86_
-
-typedef enum _INTERLOCKED_RESULT {
-  ResultNegative = RESULT_NEGATIVE,
-  ResultZero = RESULT_ZERO,
-  ResultPositive = RESULT_POSITIVE
-} INTERLOCKED_RESULT;
-
-NTKERNELAPI
-INTERLOCKED_RESULT
-FASTCALL
-Exfi386InterlockedIncrementLong(
-  IN OUT LONG volatile *Addend);
-
-NTKERNELAPI
-INTERLOCKED_RESULT
-FASTCALL
-Exfi386InterlockedDecrementLong(
-  IN PLONG  Addend);
-
-NTKERNELAPI
-ULONG
-FASTCALL
-Exfi386InterlockedExchangeUlong(
-  IN PULONG  Target,
-  IN ULONG  Value);
-#endif
-
-
-
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-NTKERNELAPI
-NTSTATUS
-NTAPI
-ExExtendZone(
-  IN OUT PZONE_HEADER Zone,
-  IN OUT PVOID Segment,
-  IN ULONG SegmentSize);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-ExInitializeZone(
-  OUT PZONE_HEADER Zone,
-  IN ULONG BlockSize,
-  IN OUT PVOID InitialSegment,
-  IN ULONG InitialSegmentSize);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-ExInterlockedExtendZone(
-  IN OUT PZONE_HEADER Zone,
-  IN OUT PVOID Segment,
-  IN ULONG SegmentSize,
-  IN OUT PKSPIN_LOCK Lock);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-ExUuidCreate(
-  OUT UUID *Uuid);
-
-NTKERNELAPI
-DECLSPEC_NORETURN
-VOID
-NTAPI
-ExRaiseAccessViolation(VOID);
-
-NTKERNELAPI
-DECLSPEC_NORETURN
-VOID
-NTAPI
-ExRaiseDatatypeMisalignment(VOID);
-
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
-
-
-/* Hardware Abstraction Layer Functions */
-
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-
-#if defined(USE_DMA_MACROS) && !defined(_NTHAL_) && (defined(_NTDDK_) || defined(_NTDRIVER_)) || defined(_WDM_INCLUDED_)
-
-/* Nothing here */
-
-#else /* USE_DMA_MACROS ... */
-
-//DECLSPEC_DEPRECATED_DDK
-NTHALAPI
-VOID
-NTAPI
-IoFreeAdapterChannel(
-  IN PADAPTER_OBJECT AdapterObject);
-
-//DECLSPEC_DEPRECATED_DDK
-NTHALAPI
-BOOLEAN
-NTAPI
-IoFlushAdapterBuffers(
-  IN PADAPTER_OBJECT AdapterObject,
-  IN PMDL Mdl,
-  IN PVOID MapRegisterBase,
-  IN PVOID CurrentVa,
-  IN ULONG Length,
-  IN BOOLEAN WriteToDevice);
-
-//DECLSPEC_DEPRECATED_DDK
-NTHALAPI
-VOID
-NTAPI
-IoFreeMapRegisters(
-  IN PADAPTER_OBJECT AdapterObject,
-  IN PVOID MapRegisterBase,
-  IN ULONG NumberOfMapRegisters);
-
-//DECLSPEC_DEPRECATED_DDK
-NTHALAPI
-PVOID
-NTAPI
-HalAllocateCommonBuffer(
-  IN PADAPTER_OBJECT AdapterObject,
-  IN ULONG Length,
-  OUT PPHYSICAL_ADDRESS LogicalAddress,
-  IN BOOLEAN CacheEnabled);
-
-//DECLSPEC_DEPRECATED_DDK
-NTHALAPI
-VOID
-NTAPI
-HalFreeCommonBuffer(
-  IN PADAPTER_OBJECT AdapterObject,
-  IN ULONG Length,
-  IN PHYSICAL_ADDRESS LogicalAddress,
-  IN PVOID VirtualAddress,
-  IN BOOLEAN CacheEnabled);
-
-//DECLSPEC_DEPRECATED_DDK
-NTHALAPI
-ULONG
-NTAPI
-HalReadDmaCounter(
-  IN PADAPTER_OBJECT AdapterObject);
-
-NTHALAPI
-NTSTATUS
-NTAPI
-HalAllocateAdapterChannel(
-  IN PADAPTER_OBJECT  AdapterObject,
-  IN PWAIT_CONTEXT_BLOCK  Wcb,
-  IN ULONG  NumberOfMapRegisters,
-  IN PDRIVER_CONTROL  ExecutionRoutine);
-
-#endif /* USE_DMA_MACROS ... */
-
-#if !defined(NO_LEGACY_DRIVERS)
-NTHALAPI
-NTSTATUS
-NTAPI
-HalAssignSlotResources(
-  IN PUNICODE_STRING RegistryPath,
-  IN PUNICODE_STRING DriverClassName,
-  IN PDRIVER_OBJECT DriverObject,
-  IN PDEVICE_OBJECT DeviceObject,
-  IN INTERFACE_TYPE BusType,
-  IN ULONG BusNumber,
-  IN ULONG SlotNumber,
-  IN OUT PCM_RESOURCE_LIST *AllocatedResources);
-
-NTHALAPI
-ULONG
-NTAPI
-HalGetInterruptVector(
-  IN INTERFACE_TYPE InterfaceType,
-  IN ULONG BusNumber,
-  IN ULONG BusInterruptLevel,
-  IN ULONG BusInterruptVector,
-  OUT PKIRQL Irql,
-  OUT PKAFFINITY Affinity);
-
-NTHALAPI
-ULONG
-NTAPI
-HalSetBusData(
-  IN BUS_DATA_TYPE BusDataType,
-  IN ULONG BusNumber,
-  IN ULONG SlotNumber,
-  IN PVOID Buffer,
-  IN ULONG Length);
-
-NTHALAPI
-ULONG
-NTAPI
-HalGetBusData(
-  IN BUS_DATA_TYPE BusDataType,
-  IN ULONG BusNumber,
-  IN ULONG SlotNumber,
-  OUT PVOID Buffer,
-  IN ULONG Length);
-
-NTHALAPI
-BOOLEAN
-NTAPI
-HalMakeBeep(
-  IN ULONG Frequency);
-#endif /* !defined(NO_LEGACY_DRIVERS) */
-
-NTHALAPI
-PADAPTER_OBJECT
-NTAPI
-HalGetAdapter(
-  IN PDEVICE_DESCRIPTION DeviceDescription,
-  OUT PULONG NumberOfMapRegisters);
-
-VOID
-NTAPI
-HalPutDmaAdapter(
-  IN PADAPTER_OBJECT DmaAdapter);
-
-NTHALAPI
-VOID
-NTAPI
-HalAcquireDisplayOwnership(
-  IN PHAL_RESET_DISPLAY_PARAMETERS ResetDisplayParameters);
-
-NTHALAPI
-ULONG
-NTAPI
-HalGetBusDataByOffset(
-  IN BUS_DATA_TYPE BusDataType,
-  IN ULONG BusNumber,
-  IN ULONG SlotNumber,
-  OUT PVOID Buffer,
-  IN ULONG Offset,
-  IN ULONG Length);
-
-NTHALAPI
-ULONG
-NTAPI
-HalSetBusDataByOffset(
-  IN BUS_DATA_TYPE BusDataType,
-  IN ULONG BusNumber,
-  IN ULONG SlotNumber,
-  IN PVOID Buffer,
-  IN ULONG Offset,
-  IN ULONG Length);
-
-NTHALAPI
-BOOLEAN
-NTAPI
-HalTranslateBusAddress(
-  IN INTERFACE_TYPE InterfaceType,
-  IN ULONG BusNumber,
-  IN PHYSICAL_ADDRESS BusAddress,
-  IN OUT PULONG AddressSpace,
-  OUT PPHYSICAL_ADDRESS TranslatedAddress);
-
-NTHALAPI
-PVOID
-NTAPI
-HalAllocateCrashDumpRegisters(
-  IN PADAPTER_OBJECT AdapterObject,
-  IN OUT PULONG NumberOfMapRegisters);
-
-NTSTATUS
-NTAPI
-HalGetScatterGatherList(
-  IN PADAPTER_OBJECT DmaAdapter,
-  IN PDEVICE_OBJECT DeviceObject,
-  IN PMDL Mdl,
-  IN PVOID CurrentVa,
-  IN ULONG Length,
-  IN PDRIVER_LIST_CONTROL ExecutionRoutine,
-  IN PVOID Context,
-  IN BOOLEAN WriteToDevice);
-
-VOID
-NTAPI
-HalPutScatterGatherList(
-  IN PADAPTER_OBJECT DmaAdapter,
-  IN PSCATTER_GATHER_LIST ScatterGather,
-  IN BOOLEAN WriteToDevice);
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
-
-#if (NTDDI_VERSION >= NTDDI_WINXP)
-NTKERNELAPI
-VOID
-FASTCALL
-HalExamineMBR(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG SectorSize,
-  IN ULONG MBRTypeIdentifier,
-  OUT PVOID *Buffer);
-#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-
-NTSTATUS
-NTAPI
-HalAllocateHardwareCounters(
-  IN PGROUP_AFFINITY GroupAffinty,
-  IN ULONG GroupCount,
-  IN PPHYSICAL_COUNTER_RESOURCE_LIST ResourceList,
-  OUT PHANDLE CounterSetHandle);
-
-NTSTATUS
-NTAPI
-HalFreeHardwareCounters(
-  IN HANDLE CounterSetHandle);
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
-
-#if defined(_IA64_)
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-NTHALAPI
-ULONG
-NTAPI
-HalGetDmaAlignmentRequirement(VOID);
-#endif
-#endif /* defined(_IA64_) */
-
-#if defined(_M_IX86) || defined(_M_AMD64)
-#define HalGetDmaAlignmentRequirement() 1L
-#endif
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-
-typedef struct _WHEA_ERROR_SOURCE_DESCRIPTOR *PWHEA_ERROR_SOURCE_DESCRIPTOR;
-typedef struct _WHEA_ERROR_RECORD *PWHEA_ERROR_RECORD;
-
-NTHALAPI
-VOID
-NTAPI
-HalBugCheckSystem(
-  IN PWHEA_ERROR_SOURCE_DESCRIPTOR ErrorSource,
-  IN PWHEA_ERROR_RECORD ErrorRecord);
-
-#else
-
-typedef struct _WHEA_ERROR_RECORD *PWHEA_ERROR_RECORD;
-
-NTHALAPI
-VOID
-NTAPI
-HalBugCheckSystem(
-  IN PWHEA_ERROR_RECORD ErrorRecord);
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
-
-
-/******************************************************************************
- *                         I/O Manager Functions                              *
- ******************************************************************************/
-/*
- * VOID IoAssignArcName(
- *   IN PUNICODE_STRING  ArcName,
- *   IN PUNICODE_STRING  DeviceName);
- */
-#define IoAssignArcName(_ArcName, _DeviceName) ( \
-  IoCreateSymbolicLink((_ArcName), (_DeviceName)))
-
-/*
- * VOID
- * IoDeassignArcName(
- *   IN PUNICODE_STRING  ArcName)
- */
-#define IoDeassignArcName IoDeleteSymbolicLink
-
-VOID
-FORCEINLINE
-NTAPI
-IoInitializeDriverCreateContext(
-  PIO_DRIVER_CREATE_CONTEXT DriverContext)
-{
-  RtlZeroMemory(DriverContext, sizeof(IO_DRIVER_CREATE_CONTEXT));
-  DriverContext->Size = sizeof(IO_DRIVER_CREATE_CONTEXT);
-}
-
-
-
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-#if !(defined(USE_DMA_MACROS) && (defined(_NTDDK_) || defined(_NTDRIVER_)) || defined(_WDM_INCLUDED_))
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoAllocateAdapterChannel(
-  IN PADAPTER_OBJECT AdapterObject,
-  IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG NumberOfMapRegisters,
-  IN PDRIVER_CONTROL ExecutionRoutine,
-  IN PVOID Context);
-#endif
-
-#if !defined(DMA_MACROS_DEFINED)
-//DECLSPEC_DEPRECATED_DDK
-NTHALAPI
-PHYSICAL_ADDRESS
-NTAPI
-IoMapTransfer(
-  IN PADAPTER_OBJECT AdapterObject,
-  IN PMDL Mdl,
-  IN PVOID MapRegisterBase,
-  IN PVOID CurrentVa,
-  IN OUT PULONG Length,
-  IN BOOLEAN WriteToDevice);
-#endif
-
-NTKERNELAPI
-VOID
-NTAPI
-IoAllocateController(
-  IN PCONTROLLER_OBJECT ControllerObject,
-  IN PDEVICE_OBJECT DeviceObject,
-  IN PDRIVER_CONTROL ExecutionRoutine,
-  IN PVOID Context OPTIONAL);
-
-NTKERNELAPI
-PCONTROLLER_OBJECT
-NTAPI
-IoCreateController(
-  IN ULONG Size);
-
-NTKERNELAPI
-VOID
-NTAPI
-IoDeleteController(
-  IN PCONTROLLER_OBJECT ControllerObject);
-
-NTKERNELAPI
-VOID
-NTAPI
-IoFreeController(
-  IN PCONTROLLER_OBJECT ControllerObject);
-
-NTKERNELAPI
-PCONFIGURATION_INFORMATION
-NTAPI
-IoGetConfigurationInformation(VOID);
-
-NTKERNELAPI
-PDEVICE_OBJECT
-NTAPI
-IoGetDeviceToVerify(
-  IN PETHREAD Thread);
-
-NTKERNELAPI
-VOID
-NTAPI
-IoCancelFileOpen(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN PFILE_OBJECT FileObject);
-
-NTKERNELAPI
-PGENERIC_MAPPING
-NTAPI
-IoGetFileObjectGenericMapping(VOID);
-
-NTKERNELAPI
-PIRP
-NTAPI
-IoMakeAssociatedIrp(
-  IN PIRP Irp,
-  IN CCHAR StackSize);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoQueryDeviceDescription(
-  IN PINTERFACE_TYPE BusType OPTIONAL,
-  IN PULONG BusNumber OPTIONAL,
-  IN PCONFIGURATION_TYPE ControllerType OPTIONAL,
-  IN PULONG ControllerNumber OPTIONAL,
-  IN PCONFIGURATION_TYPE PeripheralType OPTIONAL,
-  IN PULONG PeripheralNumber OPTIONAL,
-  IN PIO_QUERY_DEVICE_ROUTINE CalloutRoutine,
-  IN OUT PVOID Context OPTIONAL);
-
-NTKERNELAPI
-VOID
-NTAPI
-IoRaiseHardError(
-  IN PIRP Irp,
-  IN PVPB Vpb OPTIONAL,
-  IN PDEVICE_OBJECT RealDeviceObject);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-IoRaiseInformationalHardError(
-  IN NTSTATUS ErrorStatus,
-  IN PUNICODE_STRING String OPTIONAL,
-  IN PKTHREAD Thread OPTIONAL);
-
-NTKERNELAPI
-VOID
-NTAPI
-IoRegisterBootDriverReinitialization(
-  IN PDRIVER_OBJECT DriverObject,
-  IN PDRIVER_REINITIALIZE DriverReinitializationRoutine,
-  IN PVOID Context OPTIONAL);
-
-NTKERNELAPI
-VOID
-NTAPI
-IoRegisterDriverReinitialization(
-  IN PDRIVER_OBJECT DriverObject,
-  IN PDRIVER_REINITIALIZE DriverReinitializationRoutine,
-  IN PVOID Context OPTIONAL);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoAttachDeviceByPointer(
-  IN PDEVICE_OBJECT SourceDevice,
-  IN PDEVICE_OBJECT TargetDevice);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoReportDetectedDevice(
-  IN PDRIVER_OBJECT DriverObject,
-  IN INTERFACE_TYPE LegacyBusType,
-  IN ULONG BusNumber,
-  IN ULONG SlotNumber,
-  IN PCM_RESOURCE_LIST ResourceList OPTIONAL,
-  IN PIO_RESOURCE_REQUIREMENTS_LIST ResourceRequirements OPTIONAL,
-  IN BOOLEAN ResourceAssigned,
-  IN OUT PDEVICE_OBJECT *DeviceObject OPTIONAL);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoReportResourceForDetection(
-  IN PDRIVER_OBJECT DriverObject,
-  IN PCM_RESOURCE_LIST DriverList OPTIONAL,
-  IN ULONG DriverListSize OPTIONAL,
-  IN PDEVICE_OBJECT DeviceObject OPTIONAL,
-  IN PCM_RESOURCE_LIST DeviceList OPTIONAL,
-  IN ULONG DeviceListSize OPTIONAL,
-  OUT PBOOLEAN ConflictDetected);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoReportResourceUsage(
-  IN PUNICODE_STRING DriverClassName OPTIONAL,
-  IN PDRIVER_OBJECT DriverObject,
-  IN PCM_RESOURCE_LIST DriverList OPTIONAL,
-  IN ULONG DriverListSize OPTIONAL,
-  IN PDEVICE_OBJECT DeviceObject,
-  IN PCM_RESOURCE_LIST DeviceList OPTIONAL,
-  IN ULONG DeviceListSize OPTIONAL,
-  IN BOOLEAN OverrideConflict,
-  OUT PBOOLEAN ConflictDetected);
-
-NTKERNELAPI
-VOID
-NTAPI
-IoSetHardErrorOrVerifyDevice(
-  IN PIRP Irp,
-  IN PDEVICE_OBJECT DeviceObject);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoAssignResources(
-  IN PUNICODE_STRING RegistryPath,
-  IN PUNICODE_STRING DriverClassName OPTIONAL,
-  IN PDRIVER_OBJECT DriverObject,
-  IN PDEVICE_OBJECT DeviceObject OPTIONAL,
-  IN PIO_RESOURCE_REQUIREMENTS_LIST RequestedResources OPTIONAL,
-  IN OUT PCM_RESOURCE_LIST *AllocatedResources);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-IoSetThreadHardErrorMode(
-  IN BOOLEAN EnableHardErrors);
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
-
-#if (NTDDI_VERSION >= NTDDI_WIN2KSP3)
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-IoIsFileOriginRemote(
-  IN PFILE_OBJECT FileObject);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoSetFileOrigin(
-  IN PFILE_OBJECT FileObject,
-  IN BOOLEAN Remote);
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2KSP3) */
-
-#if (NTDDI_VERSION >= NTDDI_WINXP)
-NTKERNELAPI
-NTSTATUS
-FASTCALL
-IoReadPartitionTable(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG SectorSize,
-  IN BOOLEAN ReturnRecognizedPartitions,
-  OUT struct _DRIVE_LAYOUT_INFORMATION **PartitionBuffer);
-
-NTKERNELAPI
-NTSTATUS
-FASTCALL
-IoSetPartitionInformation(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG SectorSize,
-  IN ULONG PartitionNumber,
-  IN ULONG PartitionType);
-
-NTKERNELAPI
-NTSTATUS
-FASTCALL
-IoWritePartitionTable(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG SectorSize,
-  IN ULONG SectorsPerTrack,
-  IN ULONG NumberOfHeads,
-  IN struct _DRIVE_LAYOUT_INFORMATION *PartitionBuffer);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoCreateDisk(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN struct _CREATE_DISK* Disk OPTIONAL);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoReadDiskSignature(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG BytesPerSector,
-  OUT PDISK_SIGNATURE Signature);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoReadPartitionTableEx(
-  IN PDEVICE_OBJECT DeviceObject,
-  OUT struct _DRIVE_LAYOUT_INFORMATION_EX **PartitionBuffer);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoSetPartitionInformationEx(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG PartitionNumber,
-  IN struct _SET_PARTITION_INFORMATION_EX *PartitionInfo);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoSetSystemPartition(
-  IN PUNICODE_STRING VolumeNameString);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoVerifyPartitionTable(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN BOOLEAN FixErrors);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoVolumeDeviceToDosName(
-  IN PVOID VolumeDeviceObject,
-  OUT PUNICODE_STRING DosName);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoWritePartitionTableEx(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN struct _DRIVE_LAYOUT_INFORMATION_EX *DriveLayout);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoCreateFileSpecifyDeviceObjectHint(
-  OUT PHANDLE FileHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN POBJECT_ATTRIBUTES ObjectAttributes,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN PLARGE_INTEGER AllocationSize OPTIONAL,
-  IN ULONG FileAttributes,
-  IN ULONG ShareAccess,
-  IN ULONG Disposition,
-  IN ULONG CreateOptions,
-  IN PVOID EaBuffer OPTIONAL,
-  IN ULONG EaLength,
-  IN CREATE_FILE_TYPE CreateFileType,
-  IN PVOID InternalParameters OPTIONAL,
-  IN ULONG Options,
-  IN PVOID DeviceObject OPTIONAL);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoAttachDeviceToDeviceStackSafe(
-  IN PDEVICE_OBJECT SourceDevice,
-  IN PDEVICE_OBJECT TargetDevice,
-  OUT PDEVICE_OBJECT *AttachedToDeviceObject);
-
-#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
-
-
-#if (NTDDI_VERSION >= NTDDI_WS03)
-NTKERNELAPI
-IO_PAGING_PRIORITY
-FASTCALL
-IoGetPagingIoPriority(
-  IN PIRP Irp);
-
-#endif /* (NTDDI_VERSION >= NTDDI_WS03) */
-
-#if (NTDDI_VERSION >= NTDDI_WS03SP1)
-BOOLEAN
-NTAPI
-IoTranslateBusAddress(
-  IN INTERFACE_TYPE InterfaceType,
-  IN ULONG BusNumber,
-  IN PHYSICAL_ADDRESS BusAddress,
-  IN OUT PULONG AddressSpace,
-  OUT PPHYSICAL_ADDRESS TranslatedAddress);
-#endif
-
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoUpdateDiskGeometry(
-  IN PDEVICE_OBJECT DeviceObject,
-  IN struct _DISK_GEOMETRY_EX* OldDiskGeometry,
-  IN struct _DISK_GEOMETRY_EX* NewDiskGeometry);
+#define PTI_SHIFT  12L
+#define PDI_SHIFT  21L
+#define PPI_SHIFT  30L
+#define PXI_SHIFT  39L
+#define PTE_PER_PAGE 512
+#define PDE_PER_PAGE 512
+#define PPE_PER_PAGE 512
+#define PXE_PER_PAGE 512
+#define PTI_MASK_AMD64 (PTE_PER_PAGE - 1)
+#define PDI_MASK_AMD64 (PDE_PER_PAGE - 1)
+#define PPI_MASK (PPE_PER_PAGE - 1)
+#define PXI_MASK (PXE_PER_PAGE - 1)
 
-PTXN_PARAMETER_BLOCK
-NTAPI
-IoGetTransactionParameterBlock(
-  IN PFILE_OBJECT FileObject);
+#define PXE_BASE    0xFFFFF6FB7DBED000ULL
+#define PXE_SELFMAP 0xFFFFF6FB7DBEDF68ULL
+#define PPE_BASE    0xFFFFF6FB7DA00000ULL
+#define PDE_BASE    0xFFFFF6FB40000000ULL
+#define PTE_BASE    0xFFFFF68000000000ULL
+#define PXE_TOP     0xFFFFF6FB7DBEDFFFULL
+#define PPE_TOP     0xFFFFF6FB7DBFFFFFULL
+#define PDE_TOP     0xFFFFF6FB7FFFFFFFULL
+#define PTE_TOP     0xFFFFF6FFFFFFFFFFULL
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-IoCreateFileEx(
-  OUT PHANDLE FileHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN POBJECT_ATTRIBUTES ObjectAttributes,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN PLARGE_INTEGER AllocationSize OPTIONAL,
-  IN ULONG FileAttributes,
-  IN ULONG ShareAccess,
-  IN ULONG Disposition,
-  IN ULONG CreateOptions,
-  IN PVOID EaBuffer OPTIONAL,
-  IN ULONG EaLength,
-  IN CREATE_FILE_TYPE CreateFileType,
-  IN PVOID InternalParameters OPTIONAL,
-  IN ULONG Options,
-  IN PIO_DRIVER_CREATE_CONTEXT DriverContext OPTIONAL);
+#define MM_HIGHEST_USER_ADDRESS           MmHighestUserAddress
+#define MM_SYSTEM_RANGE_START             MmSystemRangeStart
+#define MM_USER_PROBE_ADDRESS             MmUserProbeAddress
+#define MM_LOWEST_USER_ADDRESS   (PVOID)0x10000
+#define MM_LOWEST_SYSTEM_ADDRESS (PVOID)0xFFFF080000000000ULL
+#define KI_USER_SHARED_DATA       0xFFFFF78000000000ULL
 
-NTSTATUS
-NTAPI
-IoSetIrpExtraCreateParameter(
-  IN OUT PIRP Irp,
-  IN struct _ECP_LIST *ExtraCreateParameter);
+typedef struct DECLSPEC_ALIGN(16) _CONTEXT {
+    ULONG64 P1Home;
+    ULONG64 P2Home;
+    ULONG64 P3Home;
+    ULONG64 P4Home;
+    ULONG64 P5Home;
+    ULONG64 P6Home;
 
-VOID
-NTAPI
-IoClearIrpExtraCreateParameter(
-  IN OUT PIRP Irp);
+    /* Control flags */
+    ULONG ContextFlags;
+    ULONG MxCsr;
 
-NTSTATUS
-NTAPI
-IoGetIrpExtraCreateParameter(
-  IN PIRP Irp,
-  OUT struct _ECP_LIST **ExtraCreateParameter OPTIONAL);
+    /* Segment */
+    USHORT SegCs;
+    USHORT SegDs;
+    USHORT SegEs;
+    USHORT SegFs;
+    USHORT SegGs;
+    USHORT SegSs;
+    ULONG EFlags;
 
-BOOLEAN
-NTAPI
-IoIsFileObjectIgnoringSharing(
-  IN PFILE_OBJECT FileObject);
+    /* Debug */
+    ULONG64 Dr0;
+    ULONG64 Dr1;
+    ULONG64 Dr2;
+    ULONG64 Dr3;
+    ULONG64 Dr6;
+    ULONG64 Dr7;
 
+    /* Integer */
+    ULONG64 Rax;
+    ULONG64 Rcx;
+    ULONG64 Rdx;
+    ULONG64 Rbx;
+    ULONG64 Rsp;
+    ULONG64 Rbp;
+    ULONG64 Rsi;
+    ULONG64 Rdi;
+    ULONG64 R8;
+    ULONG64 R9;
+    ULONG64 R10;
+    ULONG64 R11;
+    ULONG64 R12;
+    ULONG64 R13;
+    ULONG64 R14;
+    ULONG64 R15;
 
-#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+    /* Counter */
+    ULONG64 Rip;
 
+   /* Floating point */
+   union {
+       XMM_SAVE_AREA32 FltSave;
+       struct {
+           M128A Header[2];
+           M128A Legacy[8];
+           M128A Xmm0;
+           M128A Xmm1;
+           M128A Xmm2;
+           M128A Xmm3;
+           M128A Xmm4;
+           M128A Xmm5;
+           M128A Xmm6;
+           M128A Xmm7;
+           M128A Xmm8;
+           M128A Xmm9;
+           M128A Xmm10;
+           M128A Xmm11;
+           M128A Xmm12;
+           M128A Xmm13;
+           M128A Xmm14;
+           M128A Xmm15;
+      } DUMMYSTRUCTNAME;
+    } DUMMYUNIONNAME;
 
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-NTSTATUS
-NTAPI
-IoSetFileObjectIgnoreSharing(
-  IN PFILE_OBJECT FileObject);
+     /* Vector */
+    M128A VectorRegister[26];
+    ULONG64 VectorControl;
 
+    /* Debug control */
+    ULONG64 DebugControl;
+    ULONG64 LastBranchToRip;
+    ULONG64 LastBranchFromRip;
+    ULONG64 LastExceptionToRip;
+    ULONG64 LastExceptionFromRip;
+} CONTEXT;
 
-#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
+typedef struct _KPCR
+{
+    _ANONYMOUS_UNION union
+    {
+        NT_TIB NtTib;
+        _ANONYMOUS_STRUCT struct
+        {
+            union _KGDTENTRY64 *GdtBase;
+            struct _KTSS64 *TssBase;
+            ULONG64 UserRsp;
+            struct _KPCR *Self;
+            struct _KPRCB *CurrentPrcb;
+            PKSPIN_LOCK_QUEUE LockArray;
+            PVOID Used_Self;
+        };
+    };
+    union _KIDTENTRY64 *IdtBase;
+    ULONG64 Unused[2];
+    KIRQL Irql;
+    UCHAR SecondLevelCacheAssociativity;
+    UCHAR ObsoleteNumber;
+    UCHAR Fill0;
+    ULONG Unused0[3];
+    USHORT MajorVersion;
+    USHORT MinorVersion;
+    ULONG StallScaleFactor;
+    PVOID Unused1[3];
+    ULONG KernelReserved[15];
+    ULONG SecondLevelCacheSize;
+    ULONG HalReserved[16];
+    ULONG Unused2;
+    PVOID KdVersionBlock;
+    PVOID Unused3;
+    ULONG PcrAlign1[24];
+} KPCR, *PKPCR;
 
+FORCEINLINE
+PKPCR
+KeGetPcr(VOID)
+{
+    return (PKPCR)__readgsqword(FIELD_OFFSET(KPCR, Self));
+}
 
-/******************************************************************************
- *                          Kernel Debugger Functions                         *
- ******************************************************************************/
-NTSYSAPI
+FORCEINLINE
 ULONG
-NTAPI
-DbgPrompt(
-  IN PCCH Prompt,
-  OUT PCH Response,
-  IN ULONG MaximumResponseLength);
+KeGetCurrentProcessorNumber(VOID)
+{
+    return (ULONG)__readgsword(0x184);
+}
 
-/******************************************************************************
- *                              Kernel Functions                              *
- ******************************************************************************/
-NTKERNELAPI
-VOID
-FASTCALL
-KeInvalidateRangeAllCaches(
-  IN PVOID BaseAddress,
-  IN ULONG Length);
+#if !defined(RC_INVOKED)
 
+#define CONTEXT_AMD64 0x100000
 
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
+#define CONTEXT_CONTROL (CONTEXT_AMD64 | 0x1L)
+#define CONTEXT_INTEGER (CONTEXT_AMD64 | 0x2L)
+#define CONTEXT_SEGMENTS (CONTEXT_AMD64 | 0x4L)
+#define CONTEXT_FLOATING_POINT (CONTEXT_AMD64 | 0x8L)
+#define CONTEXT_DEBUG_REGISTERS (CONTEXT_AMD64 | 0x10L)
 
-NTKERNELAPI
-VOID
-NTAPI
-KeSetImportanceDpc(
-  IN OUT PRKDPC Dpc,
-  IN KDPC_IMPORTANCE Importance);
+#define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_FLOATING_POINT)
+#define CONTEXT_ALL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS)
 
-NTKERNELAPI
-LONG
-NTAPI
-KePulseEvent(
-  IN OUT PRKEVENT Event,
-  IN KPRIORITY Increment,
-  IN BOOLEAN Wait);
+#define CONTEXT_XSTATE (CONTEXT_AMD64 | 0x20L)
 
-NTKERNELAPI
-LONG
-NTAPI
-KeSetBasePriorityThread(
-  IN OUT PRKTHREAD Thread,
-  IN LONG Increment);
+#define CONTEXT_EXCEPTION_ACTIVE 0x8000000
+#define CONTEXT_SERVICE_ACTIVE 0x10000000
+#define CONTEXT_EXCEPTION_REQUEST 0x40000000
+#define CONTEXT_EXCEPTION_REPORTING 0x80000000
 
-NTKERNELAPI
-VOID
-NTAPI
-KeEnterCriticalRegion(VOID);
+#endif /* RC_INVOKED */
 
-NTKERNELAPI
-VOID
-NTAPI
-KeLeaveCriticalRegion(VOID);
+#endif /* _AMD64_ */
 
-NTKERNELAPI
-DECLSPEC_NORETURN
-VOID
-NTAPI
-KeBugCheck(
-  IN ULONG BugCheckCode);
+typedef enum _INTERLOCKED_RESULT {
+  ResultNegative = RESULT_NEGATIVE,
+  ResultZero = RESULT_ZERO,
+  ResultPositive = RESULT_POSITIVE
+} INTERLOCKED_RESULT;
+
+typedef struct _OSVERSIONINFOA {
+  ULONG dwOSVersionInfoSize;
+  ULONG dwMajorVersion;
+  ULONG dwMinorVersion;
+  ULONG dwBuildNumber;
+  ULONG dwPlatformId;
+  CHAR szCSDVersion[128];
+} OSVERSIONINFOA, *POSVERSIONINFOA, *LPOSVERSIONINFOA;
 
+typedef struct _OSVERSIONINFOW {
+  ULONG dwOSVersionInfoSize;
+  ULONG dwMajorVersion;
+  ULONG dwMinorVersion;
+  ULONG dwBuildNumber;
+  ULONG dwPlatformId;
+  WCHAR szCSDVersion[128];
+} OSVERSIONINFOW, *POSVERSIONINFOW, *LPOSVERSIONINFOW, RTL_OSVERSIONINFOW, *PRTL_OSVERSIONINFOW;
 
-#if defined(SINGLE_GROUP_LEGACY_API)
+typedef struct _OSVERSIONINFOEXA {
+  ULONG dwOSVersionInfoSize;
+  ULONG dwMajorVersion;
+  ULONG dwMinorVersion;
+  ULONG dwBuildNumber;
+  ULONG dwPlatformId;
+  CHAR szCSDVersion[128];
+  USHORT wServicePackMajor;
+  USHORT wServicePackMinor;
+  USHORT wSuiteMask;
+  UCHAR wProductType;
+  UCHAR wReserved;
+} OSVERSIONINFOEXA, *POSVERSIONINFOEXA, *LPOSVERSIONINFOEXA;
 
+typedef struct _OSVERSIONINFOEXW {
+  ULONG dwOSVersionInfoSize;
+  ULONG dwMajorVersion;
+  ULONG dwMinorVersion;
+  ULONG dwBuildNumber;
+  ULONG dwPlatformId;
+  WCHAR szCSDVersion[128];
+  USHORT wServicePackMajor;
+  USHORT wServicePackMinor;
+  USHORT wSuiteMask;
+  UCHAR wProductType;
+  UCHAR wReserved;
+} OSVERSIONINFOEXW, *POSVERSIONINFOEXW, *LPOSVERSIONINFOEXW, RTL_OSVERSIONINFOEXW, *PRTL_OSVERSIONINFOEXW;
 
-NTKERNELAPI
-VOID
-NTAPI
-KeSetTargetProcessorDpc(
-  IN OUT PRKDPC Dpc,
-  IN CCHAR Number);
+#ifdef UNICODE
+typedef OSVERSIONINFOEXW OSVERSIONINFOEX;
+typedef POSVERSIONINFOEXW POSVERSIONINFOEX;
+typedef LPOSVERSIONINFOEXW LPOSVERSIONINFOEX;
+typedef OSVERSIONINFOW OSVERSIONINFO;
+typedef POSVERSIONINFOW POSVERSIONINFO;
+typedef LPOSVERSIONINFOW LPOSVERSIONINFO;
+#else
+typedef OSVERSIONINFOEXA OSVERSIONINFOEX;
+typedef POSVERSIONINFOEXA POSVERSIONINFOEX;
+typedef LPOSVERSIONINFOEXA LPOSVERSIONINFOEX;
+typedef OSVERSIONINFOA OSVERSIONINFO;
+typedef POSVERSIONINFOA POSVERSIONINFO;
+typedef LPOSVERSIONINFOA LPOSVERSIONINFO;
+#endif /* UNICODE */
 
-NTKERNELAPI
-KAFFINITY
-NTAPI
-KeQueryActiveProcessors(VOID);
+/* Executive Types */
 
-#endif /* defined(SINGLE_GROUP_LEGACY_API) */
+#define PROTECTED_POOL                    0x80000000
 
+typedef struct _ZONE_SEGMENT_HEADER {
+  SINGLE_LIST_ENTRY SegmentList;
+  PVOID Reserved;
+} ZONE_SEGMENT_HEADER, *PZONE_SEGMENT_HEADER;
 
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+typedef struct _ZONE_HEADER {
+  SINGLE_LIST_ENTRY FreeList;
+  SINGLE_LIST_ENTRY SegmentList;
+  ULONG BlockSize;
+  ULONG TotalSegmentSize;
+} ZONE_HEADER, *PZONE_HEADER;
 
-#if (NTDDI_VERSION >= NTDDI_WINXP)
-NTKERNELAPI
-BOOLEAN
-NTAPI
-KeAreApcsDisabled(VOID);
+/* Executive Functions */
 
+static __inline PVOID
+ExAllocateFromZone(
+  IN PZONE_HEADER Zone)
+{
+  if (Zone->FreeList.Next)
+    Zone->FreeList.Next = Zone->FreeList.Next->Next;
+  return (PVOID) Zone->FreeList.Next;
+}
 
-#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
+static __inline PVOID
+ExFreeToZone(
+  IN PZONE_HEADER  Zone,
+  IN PVOID  Block)
+{
+  ((PSINGLE_LIST_ENTRY) Block)->Next = Zone->FreeList.Next;
+  Zone->FreeList.Next = ((PSINGLE_LIST_ENTRY) Block);
+  return ((PSINGLE_LIST_ENTRY) Block)->Next;
+}
 
+/*
+ * PVOID
+ * ExInterlockedAllocateFromZone(
+ *   IN PZONE_HEADER  Zone,
+ *   IN PKSPIN_LOCK  Lock)
+ */
+#define ExInterlockedAllocateFromZone(Zone, Lock) \
+    ((PVOID) ExInterlockedPopEntryList(&Zone->FreeList, Lock))
 
-#if (NTDDI_VERSION >= NTDDI_WS03)
+/* PVOID
+ * ExInterlockedFreeToZone(
+ *  IN PZONE_HEADER  Zone,
+ *  IN PVOID  Block,
+ *  IN PKSPIN_LOCK  Lock);
+ */
+#define ExInterlockedFreeToZone(Zone, Block, Lock) \
+    ExInterlockedPushEntryList(&(Zone)->FreeList, (PSINGLE_LIST_ENTRY)(Block), Lock)
 
+/*
+ * BOOLEAN
+ * ExIsFullZone(
+ *  IN PZONE_HEADER  Zone)
+ */
+#define ExIsFullZone(Zone) \
+  ((Zone)->FreeList.Next == (PSINGLE_LIST_ENTRY) NULL)
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-KeInvalidateAllCaches(VOID);
+/* BOOLEAN
+ * ExIsObjectInFirstZoneSegment(
+ *     IN PZONE_HEADER Zone,
+ *     IN PVOID Object);
+ */
+#define ExIsObjectInFirstZoneSegment(Zone,Object) \
+    ((BOOLEAN)( ((PUCHAR)(Object) >= (PUCHAR)(Zone)->SegmentList.Next) && \
+                ((PUCHAR)(Object) <  (PUCHAR)(Zone)->SegmentList.Next + \
+                         (Zone)->TotalSegmentSize)) )
 
-#endif /* (NTDDI_VERSION >= NTDDI_WS03) */
+#define ExAcquireResourceExclusive ExAcquireResourceExclusiveLite
+#define ExAcquireResourceShared ExAcquireResourceSharedLite
+#define ExConvertExclusiveToShared ExConvertExclusiveToSharedLite
+#define ExDeleteResource ExDeleteResourceLite
+#define ExInitializeResource ExInitializeResourceLite
+#define ExIsResourceAcquiredExclusive ExIsResourceAcquiredExclusiveLite
+#define ExIsResourceAcquiredShared ExIsResourceAcquiredSharedLite
+#define ExIsResourceAcquired ExIsResourceAcquiredSharedLite
+#define ExReleaseResourceForThread ExReleaseResourceForThreadLite
 
-#if (NTDDI_VERSION >= NTDDI_WS03SP1)
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-KeExpandKernelStackAndCallout(
-  IN PEXPAND_STACK_CALLOUT Callout,
-  IN PVOID Parameter OPTIONAL,
-  IN SIZE_T Size);
+ExExtendZone(
+  IN OUT PZONE_HEADER Zone,
+  IN OUT PVOID Segment,
+  IN ULONG SegmentSize);
 
 NTKERNELAPI
-VOID
+NTSTATUS
 NTAPI
-KeEnterGuardedRegion(VOID);
+ExInitializeZone(
+  OUT PZONE_HEADER Zone,
+  IN ULONG BlockSize,
+  IN OUT PVOID InitialSegment,
+  IN ULONG InitialSegmentSize);
 
 NTKERNELAPI
-VOID
+NTSTATUS
 NTAPI
-KeLeaveGuardedRegion(VOID);
-
-
-#endif /* (NTDDI_VERSION >= NTDDI_WS03SP1) */
-
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-
+ExInterlockedExtendZone(
+  IN OUT PZONE_HEADER Zone,
+  IN OUT PVOID Segment,
+  IN ULONG SegmentSize,
+  IN OUT PKSPIN_LOCK Lock);
 
-#if defined(SINGLE_GROUP_LEGACY_API)
 NTKERNELAPI
-ULONG
+NTSTATUS
 NTAPI
-KeQueryActiveProcessorCount(
-  OUT PKAFFINITY ActiveProcessors OPTIONAL);
+ExUuidCreate(
+  OUT UUID *Uuid);
 
 NTKERNELAPI
-ULONG
+DECLSPEC_NORETURN
+VOID
 NTAPI
-KeQueryMaximumProcessorCount(VOID);
-
-#endif /* SINGLE_GROUP_LEGACY_API */
-
-#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
-
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
+ExRaiseAccessViolation(
+  VOID);
 
 NTKERNELAPI
-ULONG
+DECLSPEC_NORETURN
+VOID
 NTAPI
-KeQueryActiveProcessorCountEx(
-  IN USHORT GroupNumber);
+ExRaiseDatatypeMisalignment(
+  VOID);
 
-NTKERNELAPI
-ULONG
-NTAPI
-KeQueryMaximumProcessorCountEx(
-  IN USHORT GroupNumber);
+#endif
 
-NTKERNELAPI
-USHORT
-NTAPI
-KeQueryActiveGroupCount(VOID);
+#ifdef _X86_
 
 NTKERNELAPI
-USHORT
-NTAPI
-KeQueryMaximumGroupCount(VOID);
+INTERLOCKED_RESULT
+FASTCALL
+Exfi386InterlockedIncrementLong(
+  IN OUT LONG volatile *Addend);
 
 NTKERNELAPI
-KAFFINITY
-NTAPI
-KeQueryGroupAffinity(
-  IN USHORT GroupNumber);
+INTERLOCKED_RESULT
+FASTCALL
+Exfi386InterlockedDecrementLong(
+  IN PLONG  Addend);
 
 NTKERNELAPI
 ULONG
-NTAPI
-KeGetCurrentProcessorNumberEx(
-  OUT PPROCESSOR_NUMBER ProcNumber OPTIONAL);
+FASTCALL
+Exfi386InterlockedExchangeUlong(
+  IN PULONG  Target,
+  IN ULONG  Value);
 
-NTKERNELAPI
-VOID
-NTAPI
-KeQueryNodeActiveAffinity(
-  IN USHORT NodeNumber,
-  OUT PGROUP_AFFINITY Affinity OPTIONAL,
-  OUT PUSHORT Count OPTIONAL);
+#endif /* _X86_ */
 
-NTKERNELAPI
-USHORT
-NTAPI
-KeQueryNodeMaximumProcessorCount(
-  IN USHORT NodeNumber);
+#ifndef _ARC_DDK_
+#define _ARC_DDK_
+typedef enum _CONFIGURATION_TYPE {
+  ArcSystem,
+  CentralProcessor,
+  FloatingPointProcessor,
+  PrimaryIcache,
+  PrimaryDcache,
+  SecondaryIcache,
+  SecondaryDcache,
+  SecondaryCache,
+  EisaAdapter,
+  TcAdapter,
+  ScsiAdapter,
+  DtiAdapter,
+  MultiFunctionAdapter,
+  DiskController,
+  TapeController,
+  CdromController,
+  WormController,
+  SerialController,
+  NetworkController,
+  DisplayController,
+  ParallelController,
+  PointerController,
+  KeyboardController,
+  AudioController,
+  OtherController,
+  DiskPeripheral,
+  FloppyDiskPeripheral,
+  TapePeripheral,
+  ModemPeripheral,
+  MonitorPeripheral,
+  PrinterPeripheral,
+  PointerPeripheral,
+  KeyboardPeripheral,
+  TerminalPeripheral,
+  OtherPeripheral,
+  LinePeripheral,
+  NetworkPeripheral,
+  SystemMemory,
+  DockingInformation,
+  RealModeIrqRoutingTable,
+  RealModePCIEnumeration,
+  MaximumType
+} CONFIGURATION_TYPE, *PCONFIGURATION_TYPE;
+#endif /* !_ARC_DDK_ */
 
-NTKERNELAPI
-USHORT
-NTAPI
-KeQueryHighestNodeNumber(VOID);
+typedef struct _CONTROLLER_OBJECT {
+  CSHORT Type;
+  CSHORT Size;
+  PVOID ControllerExtension;
+  KDEVICE_QUEUE DeviceWaitQueue;
+  ULONG Spare1;
+  LARGE_INTEGER Spare2;
+} CONTROLLER_OBJECT, *PCONTROLLER_OBJECT;
 
-NTKERNELAPI
-USHORT
-NTAPI
-KeGetCurrentNodeNumber(VOID);
+typedef struct _CONFIGURATION_INFORMATION {
+  ULONG DiskCount;
+  ULONG FloppyCount;
+  ULONG CdRomCount;
+  ULONG TapeCount;
+  ULONG ScsiPortCount;
+  ULONG SerialCount;
+  ULONG ParallelCount;
+  BOOLEAN AtDiskPrimaryAddressClaimed;
+  BOOLEAN AtDiskSecondaryAddressClaimed;
+  ULONG Version;
+  ULONG MediumChangerCount;
+} CONFIGURATION_INFORMATION, *PCONFIGURATION_INFORMATION;
 
-NTKERNELAPI
+typedef
 NTSTATUS
-NTAPI
-KeQueryLogicalProcessorRelationship(
-  IN PPROCESSOR_NUMBER ProcessorNumber OPTIONAL,
-  IN LOGICAL_PROCESSOR_RELATIONSHIP RelationshipType,
-  OUT PSYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX Information OPTIONAL,
-  IN OUT PULONG Length);
+(NTAPI *PIO_QUERY_DEVICE_ROUTINE)(
+  IN PVOID Context,
+  IN PUNICODE_STRING PathName,
+  IN INTERFACE_TYPE BusType,
+  IN ULONG BusNumber,
+  IN PKEY_VALUE_FULL_INFORMATION *BusInformation,
+  IN CONFIGURATION_TYPE ControllerType,
+  IN ULONG ControllerNumber,
+  IN PKEY_VALUE_FULL_INFORMATION *ControllerInformation,
+  IN CONFIGURATION_TYPE PeripheralType,
+  IN ULONG PeripheralNumber,
+  IN PKEY_VALUE_FULL_INFORMATION *PeripheralInformation);
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-KeSetHardwareCounterConfiguration(
-  IN PHARDWARE_COUNTER CounterArray,
+typedef
+VOID
+(NTAPI DRIVER_REINITIALIZE)(
+  IN struct _DRIVER_OBJECT *DriverObject,
+  IN PVOID Context,
   IN ULONG Count);
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-KeQueryHardwareCounterConfiguration(
-  OUT PHARDWARE_COUNTER CounterArray,
-  IN ULONG MaximumCount,
-  OUT PULONG Count);
-
+typedef DRIVER_REINITIALIZE *PDRIVER_REINITIALIZE;
 
-#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
-
-
-/******************************************************************************
- *                       Memory manager Functions                             *
- ******************************************************************************/
+/** Filesystem runtime library routines **/
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 NTKERNELAPI
-PPHYSICAL_MEMORY_RANGE
+BOOLEAN
 NTAPI
-MmGetPhysicalMemoryRanges(VOID);
+FsRtlIsTotalDeviceFailure(
+  IN NTSTATUS Status);
+#endif
 
-NTKERNELAPI
-PHYSICAL_ADDRESS
-NTAPI
-MmGetPhysicalAddress(
-  IN PVOID BaseAddress);
+/* Hardware Abstraction Layer Types */
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-MmIsNonPagedSystemAddressValid(
-  IN PVOID VirtualAddress);
+typedef VOID
+(NTAPI *PciPin2Line)(
+  IN struct _BUS_HANDLER *BusHandler,
+  IN struct _BUS_HANDLER *RootHandler,
+  IN PCI_SLOT_NUMBER SlotNumber,
+  IN PPCI_COMMON_CONFIG PciData);
 
-NTKERNELAPI
-PVOID
-NTAPI
-MmAllocateNonCachedMemory(
-  IN SIZE_T NumberOfBytes);
+typedef VOID
+(NTAPI *PciLine2Pin)(
+  IN struct _BUS_HANDLER *BusHandler,
+  IN struct _BUS_HANDLER *RootHandler,
+  IN PCI_SLOT_NUMBER SlotNumber,
+  IN PPCI_COMMON_CONFIG PciNewData,
+  IN PPCI_COMMON_CONFIG PciOldData);
 
-NTKERNELAPI
-VOID
-NTAPI
-MmFreeNonCachedMemory(
-  IN PVOID BaseAddress,
-  IN SIZE_T NumberOfBytes);
+typedef VOID
+(NTAPI *PciReadWriteConfig)(
+  IN struct _BUS_HANDLER *BusHandler,
+  IN PCI_SLOT_NUMBER Slot,
+  IN PVOID Buffer,
+  IN ULONG Offset,
+  IN ULONG Length);
 
-NTKERNELAPI
-PVOID
-NTAPI
-MmGetVirtualForPhysical(
-  IN PHYSICAL_ADDRESS PhysicalAddress);
+#define PCI_DATA_TAG ' ICP'
+#define PCI_DATA_VERSION 1
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-MmMapUserAddressesToPage(
-  IN PVOID BaseAddress,
-  IN SIZE_T NumberOfBytes,
-  IN PVOID PageAddress);
+typedef struct _PCIBUSDATA {
+  ULONG Tag;
+  ULONG Version;
+  PciReadWriteConfig ReadConfig;
+  PciReadWriteConfig WriteConfig;
+  PciPin2Line Pin2Line;
+  PciLine2Pin Line2Pin;
+  PCI_SLOT_NUMBER ParentSlot;
+  PVOID Reserved[4];
+} PCIBUSDATA, *PPCIBUSDATA;
 
-NTKERNELAPI
-PVOID
-NTAPI
-MmMapVideoDisplay(
-  IN PHYSICAL_ADDRESS PhysicalAddress,
-  IN SIZE_T NumberOfBytes,
-  IN MEMORY_CACHING_TYPE CacheType);
+/* Hardware Abstraction Layer Functions */
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-MmMapViewInSessionSpace(
-  IN PVOID Section,
-  OUT PVOID *MappedBase,
-  IN OUT PSIZE_T ViewSize);
+#if !defined(NO_LEGACY_DRIVERS)
 
-NTKERNELAPI
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
+NTHALAPI
 NTSTATUS
 NTAPI
-MmMapViewInSystemSpace(
-  IN PVOID Section,
-  OUT PVOID *MappedBase,
-  IN OUT PSIZE_T ViewSize);
+HalAssignSlotResources(
+  IN PUNICODE_STRING RegistryPath,
+  IN PUNICODE_STRING DriverClassName,
+  IN PDRIVER_OBJECT DriverObject,
+  IN PDEVICE_OBJECT DeviceObject,
+  IN INTERFACE_TYPE BusType,
+  IN ULONG BusNumber,
+  IN ULONG SlotNumber,
+  IN OUT PCM_RESOURCE_LIST *AllocatedResources);
 
-NTKERNELAPI
-BOOLEAN
+NTHALAPI
+ULONG
 NTAPI
-MmIsAddressValid(
-  IN PVOID VirtualAddress);
+HalGetInterruptVector(
+  IN INTERFACE_TYPE InterfaceType,
+  IN ULONG BusNumber,
+  IN ULONG BusInterruptLevel,
+  IN ULONG BusInterruptVector,
+  OUT PKIRQL Irql,
+  OUT PKAFFINITY Affinity);
 
-NTKERNELAPI
-BOOLEAN
+NTHALAPI
+ULONG
 NTAPI
-MmIsThisAnNtAsSystem(VOID);
+HalSetBusData(
+  IN BUS_DATA_TYPE BusDataType,
+  IN ULONG BusNumber,
+  IN ULONG SlotNumber,
+  IN PVOID Buffer,
+  IN ULONG Length);
 
-NTKERNELAPI
-VOID
-NTAPI
-MmLockPagableSectionByHandle(
-  IN PVOID ImageSectionHandle);
+#endif
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-MmUnmapViewInSessionSpace(
-  IN PVOID MappedBase);
+#endif /* !defined(NO_LEGACY_DRIVERS) */
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-MmUnmapViewInSystemSpace(
-  IN PVOID MappedBase);
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
 
-NTKERNELAPI
-VOID
+NTHALAPI
+PADAPTER_OBJECT
 NTAPI
-MmUnsecureVirtualMemory(
-  IN HANDLE SecureHandle);
+HalGetAdapter(
+  IN PDEVICE_DESCRIPTION DeviceDescription,
+  IN OUT PULONG NumberOfMapRegisters);
 
-NTKERNELAPI
-NTSTATUS
+NTHALAPI
+BOOLEAN
 NTAPI
-MmRemovePhysicalMemory(
-  IN PPHYSICAL_ADDRESS StartAddress,
-  IN OUT PLARGE_INTEGER NumberOfBytes);
+HalMakeBeep(
+  IN ULONG Frequency);
 
-NTKERNELAPI
-HANDLE
+VOID
 NTAPI
-MmSecureVirtualMemory(
-  IN PVOID Address,
-  IN SIZE_T Size,
-  IN ULONG ProbeMode);
+HalPutDmaAdapter(
+  IN PADAPTER_OBJECT DmaAdapter);
 
-NTKERNELAPI
+NTHALAPI
 VOID
 NTAPI
-MmUnmapVideoDisplay(
-  IN PVOID BaseAddress,
-  IN SIZE_T NumberOfBytes);
+HalAcquireDisplayOwnership(
+  IN PHAL_RESET_DISPLAY_PARAMETERS ResetDisplayParameters);
 
-NTKERNELAPI
-NTSTATUS
+NTHALAPI
+ULONG
 NTAPI
-MmAddPhysicalMemory(
-  IN PPHYSICAL_ADDRESS StartAddress,
-  IN OUT PLARGE_INTEGER NumberOfBytes);
+HalGetBusData(
+  IN BUS_DATA_TYPE BusDataType,
+  IN ULONG BusNumber,
+  IN ULONG SlotNumber,
+  OUT PVOID Buffer,
+  IN ULONG Length);
 
-NTKERNELAPI
-PVOID
+NTHALAPI
+ULONG
 NTAPI
-MmAllocateContiguousMemory(
-  IN SIZE_T NumberOfBytes,
-  IN PHYSICAL_ADDRESS HighestAcceptableAddress);
+HalGetBusDataByOffset(
+  IN BUS_DATA_TYPE BusDataType,
+  IN ULONG BusNumber,
+  IN ULONG SlotNumber,
+  OUT PVOID Buffer,
+  IN ULONG Offset,
+  IN ULONG Length);
 
-NTKERNELAPI
-PVOID
+NTHALAPI
+ULONG
 NTAPI
-MmAllocateContiguousMemorySpecifyCache(
-  IN SIZE_T NumberOfBytes,
-  IN PHYSICAL_ADDRESS LowestAcceptableAddress,
-  IN PHYSICAL_ADDRESS HighestAcceptableAddress,
-  IN PHYSICAL_ADDRESS BoundaryAddressMultiple OPTIONAL,
-  IN MEMORY_CACHING_TYPE CacheType);
+HalSetBusDataByOffset(
+  IN BUS_DATA_TYPE BusDataType,
+  IN ULONG BusNumber,
+  IN ULONG SlotNumber,
+  IN PVOID Buffer,
+  IN ULONG Offset,
+  IN ULONG Length);
 
-NTKERNELAPI
-PVOID
+NTHALAPI
+BOOLEAN
 NTAPI
-MmAllocateContiguousMemorySpecifyCacheNode(
-  IN SIZE_T NumberOfBytes,
-  IN PHYSICAL_ADDRESS LowestAcceptableAddress,
-  IN PHYSICAL_ADDRESS HighestAcceptableAddress,
-  IN PHYSICAL_ADDRESS BoundaryAddressMultiple OPTIONAL,
-  IN MEMORY_CACHING_TYPE CacheType,
-  IN NODE_REQUIREMENT PreferredNode);
+HalTranslateBusAddress(
+  IN INTERFACE_TYPE InterfaceType,
+  IN ULONG BusNumber,
+  IN PHYSICAL_ADDRESS BusAddress,
+  IN OUT PULONG AddressSpace,
+  OUT PPHYSICAL_ADDRESS TranslatedAddress);
 
-NTKERNELAPI
-VOID
-NTAPI
-MmFreeContiguousMemory(
-  IN PVOID BaseAddress);
+#endif
 
+#if (NTDDI_VERSION >= NTDDI_WINXP)
 NTKERNELAPI
 VOID
-NTAPI
-MmFreeContiguousMemorySpecifyCache(
-  IN PVOID BaseAddress,
-  IN SIZE_T NumberOfBytes,
-  IN MEMORY_CACHING_TYPE CacheType);
-
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+FASTCALL
+HalExamineMBR(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG SectorSize,
+  IN ULONG MBRTypeIdentifier,
+  OUT PVOID *Buffer);
+#endif
 
-#if (NTDDI_VERSION >= NTDDI_WINXP)
+#if defined(USE_DMA_MACROS) && !defined(_NTHAL_) && (defined(_NTDDK_) || defined(_NTDRIVER_)) || defined(_WDM_INCLUDED_) 
+// nothing here
+#else
 
-NTKERNELAPI
-NTSTATUS
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+//DECLSPEC_DEPRECATED_DDK
+NTHALAPI
+VOID
 NTAPI
-MmAdvanceMdl(
-  IN OUT PMDL Mdl,
-  IN ULONG NumberOfBytes);
+IoFreeAdapterChannel(
+  IN PADAPTER_OBJECT AdapterObject);
 
-NTKERNELAPI
-PVOID
+//DECLSPEC_DEPRECATED_DDK
+NTHALAPI
+BOOLEAN
 NTAPI
-MmAllocateMappingAddress(
-  IN SIZE_T NumberOfBytes,
-  IN ULONG PoolTag);
+IoFlushAdapterBuffers(
+  IN PADAPTER_OBJECT AdapterObject,
+  IN PMDL Mdl,
+  IN PVOID MapRegisterBase,
+  IN PVOID CurrentVa,
+  IN ULONG Length,
+  IN BOOLEAN WriteToDevice);
 
-NTKERNELAPI
+//DECLSPEC_DEPRECATED_DDK
+NTHALAPI
 VOID
 NTAPI
-MmFreeMappingAddress(
-  IN PVOID BaseAddress,
-  IN ULONG PoolTag);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-MmIsVerifierEnabled(
-  OUT PULONG VerifierFlags);
+IoFreeMapRegisters(
+  IN PADAPTER_OBJECT AdapterObject,
+  IN PVOID MapRegisterBase,
+  IN ULONG NumberOfMapRegisters);
 
-NTKERNELAPI
+//DECLSPEC_DEPRECATED_DDK
+NTHALAPI
 PVOID
 NTAPI
-MmMapLockedPagesWithReservedMapping(
-  IN PVOID MappingAddress,
-  IN ULONG PoolTag,
-  IN PMDL MemoryDescriptorList,
-  IN MEMORY_CACHING_TYPE CacheType);
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-MmProtectMdlSystemAddress(
-  IN PMDL MemoryDescriptorList,
-  IN ULONG NewProtect);
+HalAllocateCommonBuffer(
+  IN PADAPTER_OBJECT AdapterObject,
+  IN ULONG Length,
+  OUT PPHYSICAL_ADDRESS LogicalAddress,
+  IN BOOLEAN CacheEnabled);
 
-NTKERNELAPI
+//DECLSPEC_DEPRECATED_DDK
+NTHALAPI
 VOID
 NTAPI
-MmUnmapReservedMapping(
-  IN PVOID BaseAddress,
-  IN ULONG PoolTag,
-  IN PMDL MemoryDescriptorList);
+HalFreeCommonBuffer(
+  IN PADAPTER_OBJECT AdapterObject,
+  IN ULONG Length,
+  IN PHYSICAL_ADDRESS LogicalAddress,
+  IN PVOID VirtualAddress,
+  IN BOOLEAN CacheEnabled);
 
-NTKERNELAPI
-NTSTATUS
+//DECLSPEC_DEPRECATED_DDK
+NTHALAPI
+ULONG
 NTAPI
-MmAddVerifierThunks(
-  IN PVOID ThunkBuffer,
-  IN ULONG ThunkBufferSize);
-
-#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
+HalReadDmaCounter(
+  IN PADAPTER_OBJECT AdapterObject);
 
-#if (NTDDI_VERSION >= NTDDI_WS03)
-NTKERNELAPI
+NTHALAPI
 NTSTATUS
 NTAPI
-MmCreateMirror(VOID);
-#endif
-
+HalAllocateAdapterChannel(
+  IN PADAPTER_OBJECT  AdapterObject,
+  IN PWAIT_CONTEXT_BLOCK  Wcb,
+  IN ULONG  NumberOfMapRegisters,
+  IN PDRIVER_CONTROL  ExecutionRoutine);
 
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-NTSTATUS
-NTAPI
-MmRotatePhysicalView(
-  IN PVOID VirtualAddress,
-  IN OUT PSIZE_T NumberOfBytes,
-  IN PMDLX NewMdl OPTIONAL,
-  IN MM_ROTATE_DIRECTION Direction,
-  IN PMM_ROTATE_COPY_CALLBACK_FUNCTION CopyFunction,
-  IN PVOID Context OPTIONAL);
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
-#endif
+#endif /* defined(USE_DMA_MACROS) && !defined(_NTHAL_) && (defined(_NTDDK_) || defined(_NTDRIVER_)) || defined(_WDM_INCLUDED_)  */
 
-/******************************************************************************
- *                          Process Manager Functions                         *
- ******************************************************************************/
+/* I/O Manager Functions */
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-NtOpenProcess(
-  OUT PHANDLE ProcessHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN POBJECT_ATTRIBUTES ObjectAttributes,
-  IN PCLIENT_ID ClientId OPTIONAL);
+/*
+ * VOID IoAssignArcName(
+ *   IN PUNICODE_STRING  ArcName,
+ *   IN PUNICODE_STRING  DeviceName);
+ */
+#define IoAssignArcName(_ArcName, _DeviceName) ( \
+  IoCreateSymbolicLink((_ArcName), (_DeviceName)))
 
-NTSYSCALLAPI
-NTSTATUS
-NTAPI
-NtQueryInformationProcess(
-  IN HANDLE ProcessHandle,
-  IN PROCESSINFOCLASS ProcessInformationClass,
-  OUT PVOID ProcessInformation OPTIONAL,
-  IN ULONG ProcessInformationLength,
-  OUT PULONG ReturnLength OPTIONAL);
+/*
+ * VOID
+ * IoDeassignArcName(
+ *   IN PUNICODE_STRING  ArcName)
+ */
+#define IoDeassignArcName IoDeleteSymbolicLink
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 
-
+#if !(defined(USE_DMA_MACROS) && (defined(_NTDDK_) || defined(_NTDRIVER_)) || defined(_WDM_INCLUDED_))
 NTKERNELAPI
 NTSTATUS
 NTAPI
-PsSetCreateProcessNotifyRoutine(
-  IN PCREATE_PROCESS_NOTIFY_ROUTINE NotifyRoutine,
-  IN BOOLEAN Remove);
+IoAllocateAdapterChannel(
+  IN PADAPTER_OBJECT AdapterObject,
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG NumberOfMapRegisters,
+  IN PDRIVER_CONTROL ExecutionRoutine,
+  IN PVOID Context);
+#endif
 
-NTKERNELAPI
-NTSTATUS
+//DECLSPEC_DEPRECATED_DDK
+NTHALAPI
+PHYSICAL_ADDRESS
 NTAPI
-PsSetCreateThreadNotifyRoutine(
-  IN PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine);
+IoMapTransfer(
+  IN PADAPTER_OBJECT AdapterObject,
+  IN PMDL Mdl,
+  IN PVOID MapRegisterBase,
+  IN PVOID CurrentVa,
+  IN OUT PULONG Length,
+  IN BOOLEAN WriteToDevice);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-PsSetLoadImageNotifyRoutine(
-  IN PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine);
+IoAllocateController(
+  IN PCONTROLLER_OBJECT ControllerObject,
+  IN PDEVICE_OBJECT DeviceObject,
+  IN PDRIVER_CONTROL ExecutionRoutine,
+  IN PVOID Context OPTIONAL);
 
 NTKERNELAPI
-HANDLE
+PCONTROLLER_OBJECT
 NTAPI
-PsGetCurrentProcessId(VOID);
+IoCreateController(
+  IN ULONG Size);
 
 NTKERNELAPI
-HANDLE
+VOID
 NTAPI
-PsGetCurrentThreadId(VOID);
+IoDeleteController(
+  IN PCONTROLLER_OBJECT ControllerObject);
 
 NTKERNELAPI
-BOOLEAN
+VOID
 NTAPI
-PsGetVersion(
-  OUT PULONG MajorVersion OPTIONAL,
-  OUT PULONG MinorVersion OPTIONAL,
-  OUT PULONG BuildNumber OPTIONAL,
-  OUT PUNICODE_STRING CSDVersion OPTIONAL);
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
-
-#if (NTDDI_VERSION >= NTDDI_WINXP)
+IoFreeController(
+  IN PCONTROLLER_OBJECT ControllerObject);
 
 NTKERNELAPI
-HANDLE
+PCONFIGURATION_INFORMATION
 NTAPI
-PsGetProcessId(
-  IN PEPROCESS Process);
+IoGetConfigurationInformation(
+  VOID);
 
 NTKERNELAPI
-HANDLE
+PDEVICE_OBJECT
 NTAPI
-PsGetThreadId(
+IoGetDeviceToVerify(
   IN PETHREAD Thread);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-PsRemoveCreateThreadNotifyRoutine(
-  IN PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine);
+IoCancelFileOpen(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN PFILE_OBJECT FileObject);
 
 NTKERNELAPI
-NTSTATUS
+PGENERIC_MAPPING
 NTAPI
-PsRemoveLoadImageNotifyRoutine(
-  IN PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine);
+IoGetFileObjectGenericMapping(
+  VOID);
 
 NTKERNELAPI
-LONGLONG
+PIRP
 NTAPI
-PsGetProcessCreateTimeQuadPart(
-  IN PEPROCESS Process);
-
-#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
+IoMakeAssociatedIrp(
+  IN PIRP Irp,
+  IN CCHAR StackSize);
 
-#if (NTDDI_VERSION >= NTDDI_WS03)
 NTKERNELAPI
-HANDLE
+NTSTATUS
 NTAPI
-PsGetThreadProcessId(
-  IN PETHREAD Thread);
-#endif /* (NTDDI_VERSION >= NTDDI_WS03) */
-
-#if (NTDDI_VERSION >= NTDDI_VISTA)
+IoQueryDeviceDescription(
+  IN PINTERFACE_TYPE BusType OPTIONAL,
+  IN PULONG BusNumber OPTIONAL,
+  IN PCONFIGURATION_TYPE ControllerType OPTIONAL,
+  IN PULONG ControllerNumber OPTIONAL,
+  IN PCONFIGURATION_TYPE PeripheralType OPTIONAL,
+  IN PULONG PeripheralNumber OPTIONAL,
+  IN PIO_QUERY_DEVICE_ROUTINE CalloutRoutine,
+  IN OUT PVOID Context OPTIONAL);
 
 NTKERNELAPI
-BOOLEAN
+VOID
 NTAPI
-PsSetCurrentThreadPrefetching(
-  IN BOOLEAN Prefetching);
+IoRaiseHardError(
+  IN PIRP Irp,
+  IN PVPB Vpb OPTIONAL,
+  IN PDEVICE_OBJECT RealDeviceObject);
 
 NTKERNELAPI
 BOOLEAN
 NTAPI
-PsIsCurrentThreadPrefetching(VOID);
-
-#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+IoRaiseInformationalHardError(
+  IN NTSTATUS ErrorStatus,
+  IN PUNICODE_STRING String OPTIONAL,
+  IN PKTHREAD Thread OPTIONAL);
 
-#if (NTDDI_VERSION >= NTDDI_VISTASP1)
 NTKERNELAPI
-NTSTATUS
-NTAPI
-PsSetCreateProcessNotifyRoutineEx(
-  IN PCREATE_PROCESS_NOTIFY_ROUTINE_EX NotifyRoutine,
-  IN BOOLEAN Remove);
-#endif /* (NTDDI_VERSION >= NTDDI_VISTASP1) */
-/******************************************************************************
- *                         Runtime Library Functions                          *
- ******************************************************************************/
-
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-
-
-
-#ifndef RTL_USE_AVL_TABLES
-
-NTSYSAPI
 VOID
 NTAPI
-RtlInitializeGenericTable(
-  OUT PRTL_GENERIC_TABLE Table,
-  IN PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine,
-  IN PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine,
-  IN PRTL_GENERIC_FREE_ROUTINE FreeRoutine,
-  IN PVOID TableContext OPTIONAL);
-
-NTSYSAPI
-PVOID
-NTAPI
-RtlInsertElementGenericTable(
-  IN PRTL_GENERIC_TABLE Table,
-  IN PVOID Buffer,
-  IN CLONG BufferSize,
-  OUT PBOOLEAN NewElement OPTIONAL);
-
-NTSYSAPI
-PVOID
-NTAPI
-RtlInsertElementGenericTableFull(
-  IN PRTL_GENERIC_TABLE Table,
-  IN PVOID Buffer,
-  IN CLONG BufferSize,
-  OUT PBOOLEAN NewElement OPTIONAL,
-  IN PVOID NodeOrParent,
-  IN TABLE_SEARCH_RESULT SearchResult);
-
-NTSYSAPI
-BOOLEAN
-NTAPI
-RtlDeleteElementGenericTable(
-  IN PRTL_GENERIC_TABLE Table,
-  IN PVOID Buffer);
+IoRegisterBootDriverReinitialization(
+  IN PDRIVER_OBJECT DriverObject,
+  IN PDRIVER_REINITIALIZE DriverReinitializationRoutine,
+  IN PVOID Context OPTIONAL);
 
-NTSYSAPI
-PVOID
+NTKERNELAPI
+VOID
 NTAPI
-RtlLookupElementGenericTable(
-  IN PRTL_GENERIC_TABLE Table,
-  IN PVOID Buffer);
+IoRegisterDriverReinitialization(
+  IN PDRIVER_OBJECT DriverObject,
+  IN PDRIVER_REINITIALIZE DriverReinitializationRoutine,
+  IN PVOID Context OPTIONAL);
 
-NTSYSAPI
-PVOID
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlLookupElementGenericTableFull(
-  IN PRTL_GENERIC_TABLE Table,
-  IN PVOID Buffer,
-  OUT PVOID *NodeOrParent,
-  OUT TABLE_SEARCH_RESULT *SearchResult);
+IoAttachDeviceByPointer(
+  IN PDEVICE_OBJECT SourceDevice,
+  IN PDEVICE_OBJECT TargetDevice);
 
-NTSYSAPI
-PVOID
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlEnumerateGenericTable(
-  IN PRTL_GENERIC_TABLE Table,
-  IN BOOLEAN Restart);
+IoReportDetectedDevice(
+  IN PDRIVER_OBJECT DriverObject,
+  IN INTERFACE_TYPE LegacyBusType,
+  IN ULONG BusNumber,
+  IN ULONG SlotNumber,
+  IN PCM_RESOURCE_LIST ResourceList OPTIONAL,
+  IN PIO_RESOURCE_REQUIREMENTS_LIST ResourceRequirements OPTIONAL,
+  IN BOOLEAN ResourceAssigned,
+  IN OUT PDEVICE_OBJECT *DeviceObject);
 
-NTSYSAPI
-PVOID
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlEnumerateGenericTableWithoutSplaying(
-  IN PRTL_GENERIC_TABLE Table,
-  IN OUT PVOID *RestartKey);
+IoReportResourceForDetection(
+  IN PDRIVER_OBJECT DriverObject,
+  IN PCM_RESOURCE_LIST DriverList OPTIONAL,
+  IN ULONG DriverListSize OPTIONAL,
+  IN PDEVICE_OBJECT DeviceObject OPTIONAL,
+  IN PCM_RESOURCE_LIST DeviceList OPTIONAL,
+  IN ULONG DeviceListSize OPTIONAL,
+  OUT PBOOLEAN ConflictDetected);
 
-NTSYSAPI
-PVOID
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlGetElementGenericTable(
-  IN PRTL_GENERIC_TABLE Table,
-  IN ULONG I);
+IoReportResourceUsage(
+  IN PUNICODE_STRING DriverClassName OPTIONAL,
+  IN PDRIVER_OBJECT DriverObject,
+  IN PCM_RESOURCE_LIST DriverList OPTIONAL,
+  IN ULONG DriverListSize OPTIONAL,
+  IN PDEVICE_OBJECT DeviceObject,
+  IN PCM_RESOURCE_LIST DeviceList OPTIONAL,
+  IN ULONG DeviceListSize OPTIONAL,
+  IN BOOLEAN OverrideConflict,
+  OUT PBOOLEAN ConflictDetected);
 
-NTSYSAPI
-ULONG
+NTKERNELAPI
+VOID
 NTAPI
-RtlNumberGenericTableElements(
-  IN PRTL_GENERIC_TABLE Table);
+IoSetHardErrorOrVerifyDevice(
+  IN PIRP Irp,
+  IN PDEVICE_OBJECT DeviceObject);
 
-NTSYSAPI
-BOOLEAN
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlIsGenericTableEmpty(
-  IN PRTL_GENERIC_TABLE Table);
+IoAssignResources(
+  IN PUNICODE_STRING RegistryPath,
+  IN PUNICODE_STRING DriverClassName OPTIONAL,
+  IN PDRIVER_OBJECT DriverObject,
+  IN PDEVICE_OBJECT DeviceObject OPTIONAL,
+  IN PIO_RESOURCE_REQUIREMENTS_LIST RequestedResources OPTIONAL,
+  IN OUT PCM_RESOURCE_LIST *AllocatedResources);
 
-#endif /* !RTL_USE_AVL_TABLES */
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
-#define RTL_STACK_WALKING_MODE_FRAMES_TO_SKIP_SHIFT     8
+#if (NTDDI_VERSION >= NTDDI_WINXP)
 
-NTSYSAPI
-PRTL_SPLAY_LINKS
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlSplay(
-  IN OUT PRTL_SPLAY_LINKS Links);
+IoCreateDisk(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN struct _CREATE_DISK* Disk OPTIONAL);
 
-NTSYSAPI
-PRTL_SPLAY_LINKS
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlDelete(
-  IN PRTL_SPLAY_LINKS Links);
+IoReadDiskSignature(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG BytesPerSector,
+  OUT PDISK_SIGNATURE Signature);
 
-NTSYSAPI
-VOID
-NTAPI
-RtlDeleteNoSplay(
-  IN PRTL_SPLAY_LINKS Links,
-  IN OUT PRTL_SPLAY_LINKS *Root);
+NTKERNELAPI
+NTSTATUS
+FASTCALL
+IoReadPartitionTable(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG SectorSize,
+  IN BOOLEAN ReturnRecognizedPartitions,
+  OUT struct _DRIVE_LAYOUT_INFORMATION **PartitionBuffer);
 
-NTSYSAPI
-PRTL_SPLAY_LINKS
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlSubtreeSuccessor(
-  IN PRTL_SPLAY_LINKS Links);
+IoReadPartitionTableEx(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN struct _DRIVE_LAYOUT_INFORMATION_EX **PartitionBuffer);
 
-NTSYSAPI
-PRTL_SPLAY_LINKS
-NTAPI
-RtlSubtreePredecessor(
-  IN PRTL_SPLAY_LINKS Links);
+NTKERNELAPI
+NTSTATUS
+FASTCALL
+IoSetPartitionInformation(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG SectorSize,
+  IN ULONG PartitionNumber,
+  IN ULONG PartitionType);
 
-NTSYSAPI
-PRTL_SPLAY_LINKS
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlRealSuccessor(
-  IN PRTL_SPLAY_LINKS Links);
+IoSetPartitionInformationEx(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG PartitionNumber,
+  IN struct _SET_PARTITION_INFORMATION_EX *PartitionInfo);
 
-NTSYSAPI
-PRTL_SPLAY_LINKS
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlRealPredecessor(
-  IN PRTL_SPLAY_LINKS Links);
+IoSetSystemPartition(
+  IN PUNICODE_STRING VolumeNameString);
 
-NTSYSAPI
+NTKERNELAPI
 BOOLEAN
 NTAPI
-RtlPrefixUnicodeString(
-  IN PCUNICODE_STRING  String1,
-  IN PCUNICODE_STRING  String2,
-  IN BOOLEAN  CaseInSensitive);
-
-NTSYSAPI
-VOID
-NTAPI
-RtlUpperString(
-  IN OUT PSTRING  DestinationString,
-  IN const PSTRING  SourceString);
+IoSetThreadHardErrorMode(
+  IN BOOLEAN EnableHardErrors);
 
-NTSYSAPI
+NTKERNELAPI
 NTSTATUS
 NTAPI
-RtlUpcaseUnicodeString(
-  IN OUT PUNICODE_STRING DestinationString,
-  IN PCUNICODE_STRING  SourceString,
-  IN BOOLEAN  AllocateDestinationString);
-
-NTSYSAPI
-VOID
-NTAPI
-RtlMapGenericMask(
-  IN OUT PACCESS_MASK AccessMask,
-  IN PGENERIC_MAPPING GenericMapping);
+IoVerifyPartitionTable(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN BOOLEAN FixErrors);
 
-NTSYSAPI
+NTKERNELAPI
 NTSTATUS
 NTAPI
-RtlVolumeDeviceToDosName(
+IoVolumeDeviceToDosName(
   IN PVOID VolumeDeviceObject,
   OUT PUNICODE_STRING DosName);
 
-NTSYSAPI
+NTKERNELAPI
 NTSTATUS
-NTAPI
-RtlGetVersion(
-  IN OUT PRTL_OSVERSIONINFOW lpVersionInformation);
+FASTCALL
+IoWritePartitionTable(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG SectorSize,
+  IN ULONG SectorsPerTrack,
+  IN ULONG NumberOfHeads,
+  IN struct _DRIVE_LAYOUT_INFORMATION *PartitionBuffer);
 
-NTSYSAPI
+NTKERNELAPI
 NTSTATUS
 NTAPI
-RtlVerifyVersionInfo(
-  IN PRTL_OSVERSIONINFOEXW VersionInfo,
-  IN ULONG TypeMask,
-  IN ULONGLONG ConditionMask);
+IoWritePartitionTableEx(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN struct _DRIVE_LAYOUT_INFORMATION_EX *DriveLayout);
 
-NTSYSAPI
-LONG
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlCompareString(
-  IN const PSTRING String1,
-  IN const PSTRING String2,
-  IN BOOLEAN CaseInSensitive);
+IoAttachDeviceToDeviceStackSafe(
+  IN PDEVICE_OBJECT SourceDevice,
+  IN PDEVICE_OBJECT TargetDevice,
+  OUT PDEVICE_OBJECT *AttachedToDeviceObject);
 
-NTSYSAPI
-VOID
-NTAPI
-RtlCopyString(
-  OUT PSTRING DestinationString,
-  IN const PSTRING SourceString OPTIONAL);
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
-NTSYSAPI
-BOOLEAN
-NTAPI
-RtlEqualString(
-  IN const PSTRING String1,
-  IN const PSTRING String2,
-  IN BOOLEAN CaseInSensitive);
+/** Kernel debugger routines **/
 
 NTSYSAPI
-NTSTATUS
+ULONG
 NTAPI
-RtlCharToInteger(
-  IN PCSZ String,
-  IN ULONG Base OPTIONAL,
-  OUT PULONG Value);
+DbgPrompt(
+  IN PCCH Prompt,
+  OUT PCH Response,
+  IN ULONG MaximumResponseLength);
 
-NTSYSAPI
-CHAR
-NTAPI
-RtlUpperChar(
-  IN CHAR Character);
+/* Kernel Functions */
 
-NTSYSAPI
-ULONG
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
+NTKERNELAPI
+DECLSPEC_NORETURN
+VOID
 NTAPI
-RtlWalkFrameChain(
-  OUT PVOID *Callers,
-  IN ULONG Count,
-  IN ULONG Flags);
+KeBugCheck(
+  IN ULONG BugCheckCode);
 
+NTKERNELAPI
+LONG
+NTAPI
+KePulseEvent(
+  IN OUT PRKEVENT Event,
+  IN KPRIORITY Increment,
+  IN BOOLEAN Wait);
 
+NTKERNELAPI
+LONG
+NTAPI
+KeSetBasePriorityThread(
+  IN OUT PRKTHREAD Thread,
+  IN LONG Increment);
 
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+#endif
 
+/* Memory Manager Types */
 
-#if (NTDDI_VERSION >= NTDDI_WINXP)
+typedef struct _PHYSICAL_MEMORY_RANGE {
+  PHYSICAL_ADDRESS BaseAddress;
+  LARGE_INTEGER NumberOfBytes;
+} PHYSICAL_MEMORY_RANGE, *PPHYSICAL_MEMORY_RANGE;
 
+/* Memory Manager Functions */
 
-NTSYSAPI
-VOID
-NTAPI
-RtlInitializeGenericTableAvl(
-  OUT PRTL_AVL_TABLE Table,
-  IN PRTL_AVL_COMPARE_ROUTINE CompareRoutine,
-  IN PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine,
-  IN PRTL_AVL_FREE_ROUTINE FreeRoutine,
-  IN PVOID TableContext OPTIONAL);
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
 
-NTSYSAPI
-PVOID
+NTKERNELAPI
+PPHYSICAL_MEMORY_RANGE
 NTAPI
-RtlInsertElementGenericTableAvl(
-  IN PRTL_AVL_TABLE Table,
-  IN PVOID Buffer,
-  IN CLONG BufferSize,
-  OUT PBOOLEAN NewElement OPTIONAL);
+MmGetPhysicalMemoryRanges(
+  VOID);
 
-NTSYSAPI
-PVOID
+NTKERNELAPI
+PHYSICAL_ADDRESS
 NTAPI
-RtlInsertElementGenericTableFullAvl(
-  IN PRTL_AVL_TABLE Table,
-  IN PVOID Buffer,
-  IN CLONG BufferSize,
-  OUT PBOOLEAN NewElement OPTIONAL,
-  IN PVOID NodeOrParent,
-  IN TABLE_SEARCH_RESULT SearchResult);
+MmGetPhysicalAddress(
+  IN PVOID BaseAddress);
 
-NTSYSAPI
+NTKERNELAPI
 BOOLEAN
 NTAPI
-RtlDeleteElementGenericTableAvl(
-  IN PRTL_AVL_TABLE Table,
-  IN PVOID Buffer);
+MmIsNonPagedSystemAddressValid(
+  IN PVOID VirtualAddress);
 
-NTSYSAPI
+NTKERNELAPI
 PVOID
 NTAPI
-RtlLookupElementGenericTableAvl(
-  IN PRTL_AVL_TABLE Table,
-  IN PVOID Buffer);
+MmAllocateNonCachedMemory(
+  IN SIZE_T NumberOfBytes);
 
-NTSYSAPI
-PVOID
+NTKERNELAPI
+VOID
 NTAPI
-RtlLookupElementGenericTableFullAvl(
-  IN PRTL_AVL_TABLE Table,
-  IN PVOID Buffer,
-  OUT PVOID *NodeOrParent,
-  OUT TABLE_SEARCH_RESULT *SearchResult);
+MmFreeNonCachedMemory(
+  IN PVOID BaseAddress,
+  IN SIZE_T NumberOfBytes);
 
-NTSYSAPI
+NTKERNELAPI
 PVOID
 NTAPI
-RtlEnumerateGenericTableAvl(
-  IN PRTL_AVL_TABLE Table,
-  IN BOOLEAN Restart);
+MmGetVirtualForPhysical(
+  IN PHYSICAL_ADDRESS PhysicalAddress);
 
-NTSYSAPI
-PVOID
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlEnumerateGenericTableWithoutSplayingAvl(
-  IN PRTL_AVL_TABLE Table,
-  IN OUT PVOID *RestartKey);
+MmMapUserAddressesToPage(
+  IN PVOID BaseAddress,
+  IN SIZE_T NumberOfBytes,
+  IN PVOID PageAddress);
 
-NTSYSAPI
+NTKERNELAPI
 PVOID
 NTAPI
-RtlLookupFirstMatchingElementGenericTableAvl(
-  IN PRTL_AVL_TABLE Table,
-  IN PVOID Buffer,
-  OUT PVOID *RestartKey);
+MmMapVideoDisplay(
+  IN PHYSICAL_ADDRESS PhysicalAddress,
+  IN SIZE_T NumberOfBytes,
+  IN MEMORY_CACHING_TYPE CacheType);
 
-NTSYSAPI
-PVOID
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlEnumerateGenericTableLikeADirectory(
-  IN PRTL_AVL_TABLE Table,
-  IN PRTL_AVL_MATCH_FUNCTION MatchFunction OPTIONAL,
-  IN PVOID MatchData OPTIONAL,
-  IN ULONG NextFlag,
-  IN OUT PVOID *RestartKey,
-  IN OUT PULONG DeleteCount,
-  IN PVOID Buffer);
+MmMapViewInSessionSpace(
+  IN PVOID Section,
+  OUT PVOID *MappedBase,
+  IN OUT PSIZE_T ViewSize);
 
-NTSYSAPI
-PVOID
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlGetElementGenericTableAvl(
-  IN PRTL_AVL_TABLE Table,
-  IN ULONG I);
+MmMapViewInSystemSpace(
+  IN PVOID Section,
+  OUT PVOID *MappedBase,
+  IN OUT PSIZE_T ViewSize);
 
-NTSYSAPI
-ULONG
+NTKERNELAPI
+BOOLEAN
 NTAPI
-RtlNumberGenericTableElementsAvl(
-  IN PRTL_AVL_TABLE Table);
+MmIsAddressValid(
+  IN PVOID VirtualAddress);
 
-NTSYSAPI
+NTKERNELAPI
 BOOLEAN
 NTAPI
-RtlIsGenericTableEmptyAvl(
-  IN PRTL_AVL_TABLE Table);
-
-
-
-#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
-
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-
+MmIsThisAnNtAsSystem(
+  VOID);
 
-NTSYSAPI
+NTKERNELAPI
 VOID
 NTAPI
-RtlRunOnceInitialize(
-  OUT PRTL_RUN_ONCE RunOnce);
+MmLockPagableSectionByHandle(
+  IN PVOID ImageSectionHandle);
 
-NTSYSAPI
+NTKERNELAPI
 NTSTATUS
 NTAPI
-RtlRunOnceExecuteOnce(
-  IN OUT PRTL_RUN_ONCE RunOnce,
-  IN PRTL_RUN_ONCE_INIT_FN InitFn,
-  IN OUT PVOID Parameter OPTIONAL,
-  OUT PVOID *Context OPTIONAL);
+MmUnmapViewInSessionSpace(
+  IN PVOID MappedBase);
 
-NTSYSAPI
+NTKERNELAPI
 NTSTATUS
 NTAPI
-RtlRunOnceBeginInitialize(
-  IN OUT PRTL_RUN_ONCE RunOnce,
-  IN ULONG Flags,
-  OUT PVOID *Context OPTIONAL);
+MmUnmapViewInSystemSpace(
+  IN PVOID MappedBase);
 
-NTSYSAPI
-NTSTATUS
+NTKERNELAPI
+VOID
 NTAPI
-RtlRunOnceComplete(
-  IN OUT PRTL_RUN_ONCE RunOnce,
-  IN ULONG Flags,
-  IN PVOID Context OPTIONAL);
+MmUnsecureVirtualMemory(
+  IN HANDLE SecureHandle);
 
-NTSYSAPI
-BOOLEAN
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlGetProductInfo(
-  IN ULONG OSMajorVersion,
-  IN ULONG OSMinorVersion,
-  IN ULONG SpMajorVersion,
-  IN ULONG SpMinorVersion,
-  OUT PULONG ReturnedProductType);
-
+MmRemovePhysicalMemory(
+  IN PPHYSICAL_ADDRESS StartAddress,
+  IN OUT PLARGE_INTEGER NumberOfBytes);
 
+NTKERNELAPI
+HANDLE
+NTAPI
+MmSecureVirtualMemory(
+  IN PVOID Address,
+  IN SIZE_T Size,
+  IN ULONG ProbeMode);
 
-#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+NTKERNELAPI
+VOID
+NTAPI
+MmUnmapVideoDisplay(
+  IN PVOID BaseAddress,
+  IN SIZE_T NumberOfBytes);
 
-#if (NTDDI_VERSION >= NTDDI_WIN7)
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
+/* NtXxx Functions */
 
-NTSYSAPI
-BOOLEAN
+NTSYSCALLAPI
+NTSTATUS
 NTAPI
-RtlCreateHashTable(
-  IN OUT PRTL_DYNAMIC_HASH_TABLE *HashTable OPTIONAL,
-  IN ULONG Shift,
-  IN ULONG Flags);
+NtOpenProcess(
+  OUT PHANDLE ProcessHandle,
+  IN ACCESS_MASK DesiredAccess,
+  IN POBJECT_ATTRIBUTES ObjectAttributes,
+  IN PCLIENT_ID ClientId OPTIONAL);
 
-NTSYSAPI
-VOID
+NTSYSCALLAPI
+NTSTATUS
 NTAPI
-RtlDeleteHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable);
+NtQueryInformationProcess(
+  IN HANDLE ProcessHandle,
+  IN PROCESSINFOCLASS ProcessInformationClass,
+  OUT PVOID ProcessInformation OPTIONAL,
+  IN ULONG ProcessInformationLength,
+  OUT PULONG ReturnLength OPTIONAL);
 
-NTSYSAPI
-BOOLEAN
-NTAPI
-RtlInsertEntryHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable,
-  IN PRTL_DYNAMIC_HASH_TABLE_ENTRY Entry,
-  IN ULONG_PTR Signature,
-  IN OUT PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context OPTIONAL);
+/** Process manager types **/
 
-NTSYSAPI
-BOOLEAN
-NTAPI
-RtlRemoveEntryHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable,
-  IN PRTL_DYNAMIC_HASH_TABLE_ENTRY Entry,
-  IN OUT PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context OPTIONAL);
+typedef VOID
+(NTAPI *PCREATE_PROCESS_NOTIFY_ROUTINE)(
+  IN HANDLE ParentId,
+  IN HANDLE ProcessId,
+  IN BOOLEAN Create);
 
-NTSYSAPI
-PRTL_DYNAMIC_HASH_TABLE_ENTRY
-NTAPI
-RtlLookupEntryHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable,
-  IN ULONG_PTR Signature,
-  OUT PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context OPTIONAL);
+typedef VOID
+(NTAPI *PCREATE_THREAD_NOTIFY_ROUTINE)(
+  IN HANDLE ProcessId,
+  IN HANDLE ThreadId,
+  IN BOOLEAN Create);
 
-NTSYSAPI
-PRTL_DYNAMIC_HASH_TABLE_ENTRY
-NTAPI
-RtlGetNextEntryHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable,
-  IN PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context);
+typedef VOID
+(NTAPI *PLOAD_IMAGE_NOTIFY_ROUTINE)(
+  IN PUNICODE_STRING FullImageName,
+  IN HANDLE ProcessId,
+  IN PIMAGE_INFO ImageInfo);
 
-NTSYSAPI
-BOOLEAN
-NTAPI
-RtlInitEnumerationHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable,
-  OUT PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator);
+/** Process manager routines **/
 
-NTSYSAPI
-PRTL_DYNAMIC_HASH_TABLE_ENTRY
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlEnumerateEntryHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable,
-  IN OUT PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator);
+PsSetLoadImageNotifyRoutine(
+  IN PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine);
 
-NTSYSAPI
-VOID
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlEndEnumerationHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable,
-  IN OUT PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator);
+PsSetCreateThreadNotifyRoutine(
+  IN PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine);
 
-NTSYSAPI
-BOOLEAN
+NTKERNELAPI
+NTSTATUS
 NTAPI
-RtlInitWeakEnumerationHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable,
-  OUT PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator);
+PsSetCreateProcessNotifyRoutine(
+  IN PCREATE_PROCESS_NOTIFY_ROUTINE NotifyRoutine,
+  IN BOOLEAN Remove);
 
-NTSYSAPI
-PRTL_DYNAMIC_HASH_TABLE_ENTRY
+NTKERNELAPI
+HANDLE
 NTAPI
-RtlWeaklyEnumerateEntryHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable,
-  IN OUT PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator);
+PsGetCurrentProcessId(
+  VOID);
 
-NTSYSAPI
-VOID
+NTKERNELAPI
+HANDLE
 NTAPI
-RtlEndWeakEnumerationHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable,
-  IN OUT PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator);
+PsGetCurrentThreadId(
+  VOID);
 
-NTSYSAPI
+NTKERNELAPI
 BOOLEAN
 NTAPI
-RtlExpandHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable);
+PsGetVersion(
+  OUT PULONG MajorVersion OPTIONAL,
+  OUT PULONG MinorVersion OPTIONAL,
+  OUT PULONG BuildNumber OPTIONAL,
+  OUT PUNICODE_STRING CSDVersion OPTIONAL);
 
-NTSYSAPI
-BOOLEAN
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+
+#if (NTDDI_VERSION >= NTDDI_WINXP)
+
+NTKERNELAPI
+HANDLE
 NTAPI
-RtlContractHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable);
+PsGetProcessId(
+  IN PEPROCESS Process);
 
+NTKERNELAPI
+NTSTATUS
+NTAPI
+PsRemoveCreateThreadNotifyRoutine(
+  IN PCREATE_THREAD_NOTIFY_ROUTINE NotifyRoutine);
 
+NTKERNELAPI
+NTSTATUS
+NTAPI
+PsRemoveLoadImageNotifyRoutine(
+  IN PLOAD_IMAGE_NOTIFY_ROUTINE NotifyRoutine);
 
-#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
+#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
 
+extern NTKERNELAPI PEPROCESS PsInitialSystemProcess;
 
-#if defined(_AMD64_) || defined(_IA64_)
+/* RTL Types */
 
+typedef struct _RTL_SPLAY_LINKS {
+  struct _RTL_SPLAY_LINKS *Parent;
+  struct _RTL_SPLAY_LINKS *LeftChild;
+  struct _RTL_SPLAY_LINKS *RightChild;
+} RTL_SPLAY_LINKS, *PRTL_SPLAY_LINKS;
 
+/* RTL Functions */
 
-//DECLSPEC_DEPRECATED_DDK_WINXP
-FORCEINLINE
-LARGE_INTEGER
-NTAPI_INLINE
-RtlLargeIntegerDivide(
-  IN LARGE_INTEGER Dividend,
-  IN LARGE_INTEGER Divisor,
-  OUT PLARGE_INTEGER Remainder OPTIONAL)
-{
-  LARGE_INTEGER ret;
-  ret.QuadPart = Dividend.QuadPart / Divisor.QuadPart;
-  if (Remainder)
-    Remainder->QuadPart = Dividend.QuadPart % Divisor.QuadPart;
-  return ret;
-}
+#if (defined(_M_AMD64) || defined(_M_IA64)) && !defined(_REALLY_GET_CALLERS_CALLER_)
 
+#define RtlGetCallersAddress(CallersAddress, CallersCaller) \
+    *CallersAddress = (PVOID)_ReturnAddress(); \
+    *CallersCaller = NULL;
 #else
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 NTSYSAPI
-LARGE_INTEGER
+VOID
 NTAPI
-RtlLargeIntegerDivide(
-  IN LARGE_INTEGER Dividend,
-  IN LARGE_INTEGER Divisor,
-  OUT PLARGE_INTEGER Remainder OPTIONAL);
+RtlGetCallersAddress(
+  OUT PVOID *CallersAddress,
+  OUT PVOID *CallersCaller);
 #endif
 
-
-#endif /* defined(_AMD64_) || defined(_IA64_) */
-
-
-
-#ifdef RTL_USE_AVL_TABLES
-
-#define RtlInitializeGenericTable               RtlInitializeGenericTableAvl
-#define RtlInsertElementGenericTable            RtlInsertElementGenericTableAvl
-#define RtlInsertElementGenericTableFull        RtlInsertElementGenericTableFullAvl
-#define RtlDeleteElementGenericTable            RtlDeleteElementGenericTableAvl
-#define RtlLookupElementGenericTable            RtlLookupElementGenericTableAvl
-#define RtlLookupElementGenericTableFull        RtlLookupElementGenericTableFullAvl
-#define RtlEnumerateGenericTable                RtlEnumerateGenericTableAvl
-#define RtlEnumerateGenericTableWithoutSplaying RtlEnumerateGenericTableWithoutSplayingAvl
-#define RtlGetElementGenericTable               RtlGetElementGenericTableAvl
-#define RtlNumberGenericTableElements           RtlNumberGenericTableElementsAvl
-#define RtlIsGenericTableEmpty                  RtlIsGenericTableEmptyAvl
-
-#endif /* RTL_USE_AVL_TABLES */
-
-#define RtlInitializeSplayLinks(Links) {    \
-  PRTL_SPLAY_LINKS _SplayLinks;            \
-  _SplayLinks = (PRTL_SPLAY_LINKS)(Links); \
-  _SplayLinks->Parent = _SplayLinks;   \
-  _SplayLinks->LeftChild = NULL;       \
-  _SplayLinks->RightChild = NULL;      \
-}
-
-#define RtlIsLeftChild(Links) \
-    (RtlLeftChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
-
-#define RtlIsRightChild(Links) \
-    (RtlRightChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
-
-#define RtlRightChild(Links) \
-    ((PRTL_SPLAY_LINKS)(Links))->RightChild
-
-#define RtlIsRoot(Links) \
-    (RtlParent(Links) == (PRTL_SPLAY_LINKS)(Links))
-
-#define RtlLeftChild(Links) \
-    ((PRTL_SPLAY_LINKS)(Links))->LeftChild
-
-#define RtlParent(Links) \
-    ((PRTL_SPLAY_LINKS)(Links))->Parent
-
-#define RtlInsertAsLeftChild(ParentLinks,ChildLinks)    \
-    {                                                   \
-        PRTL_SPLAY_LINKS _SplayParent;                  \
-        PRTL_SPLAY_LINKS _SplayChild;                   \
-        _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
-        _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks);   \
-        _SplayParent->LeftChild = _SplayChild;          \
-        _SplayChild->Parent = _SplayParent;             \
-    }
-
-#define RtlInsertAsRightChild(ParentLinks,ChildLinks)   \
-    {                                                   \
-        PRTL_SPLAY_LINKS _SplayParent;                  \
-        PRTL_SPLAY_LINKS _SplayChild;                   \
-        _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
-        _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks);   \
-        _SplayParent->RightChild = _SplayChild;         \
-        _SplayChild->Parent = _SplayParent;             \
-    }
+#endif
 
 #if !defined(MIDL_PASS)
 
@@ -5376,160 +2746,160 @@ NTAPI_INLINE
 RtlConvertUlongToLuid(
   IN ULONG Val)
 {
-  LUID Luid;
-
-  Luid.LowPart = Val;
-  Luid.HighPart = 0;
-  return Luid;
+  LUID Luid;
+
+  Luid.LowPart = Val;
+  Luid.HighPart = 0;
+  return Luid;
+}
+
+#endif
+
+#if defined(_AMD64_) || defined(_IA64_)
+//DECLSPEC_DEPRECATED_DDK_WINXP
+__inline
+LARGE_INTEGER
+NTAPI_INLINE
+RtlLargeIntegerDivide(
+  IN LARGE_INTEGER Dividend,
+  IN LARGE_INTEGER Divisor,
+  OUT PLARGE_INTEGER Remainder OPTIONAL)
+{
+  LARGE_INTEGER ret;
+  ret.QuadPart = Dividend.QuadPart / Divisor.QuadPart;
+  if (Remainder)
+    Remainder->QuadPart = Dividend.QuadPart % Divisor.QuadPart;
+  return ret;
 }
 
-#endif /* !defined(MIDL_PASS) */
-
-#if (defined(_M_AMD64) || defined(_M_IA64)) && !defined(_REALLY_GET_CALLERS_CALLER_)
-#define RtlGetCallersAddress(CallersAddress, CallersCaller) \
-    *CallersAddress = (PVOID)_ReturnAddress(); \
-    *CallersCaller = NULL;
 #else
+
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 NTSYSAPI
-VOID
+LARGE_INTEGER
 NTAPI
-RtlGetCallersAddress(
-  OUT PVOID *CallersAddress,
-  OUT PVOID *CallersCaller);
-#endif
+RtlLargeIntegerDivide(
+  IN LARGE_INTEGER Dividend,
+  IN LARGE_INTEGER Divisor,
+  OUT PLARGE_INTEGER Remainder OPTIONAL);
 #endif
 
-#if !defined(MIDL_PASS) && !defined(SORTPP_PASS)
+#endif /* defined(_AMD64_) || defined(_IA64_) */
 
-#if (NTDDI_VERSION >= NTDDI_WIN7)
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
 
-FORCEINLINE
-VOID
+NTSYSAPI
+BOOLEAN
 NTAPI
-RtlInitHashTableContext(
-  IN OUT PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context)
-{
-  Context->ChainHead = NULL;
-  Context->PrevLinkage = NULL;
-}
+RtlPrefixUnicodeString(
+  IN PCUNICODE_STRING  String1,
+  IN PCUNICODE_STRING  String2,
+  IN BOOLEAN  CaseInSensitive);
 
-FORCEINLINE
+NTSYSAPI
 VOID
 NTAPI
-RtlInitHashTableContextFromEnumerator(
-  IN OUT PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context,
-  IN PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator)
-{
-  Context->ChainHead = Enumerator->ChainHead;
-  Context->PrevLinkage = Enumerator->HashEntry.Linkage.Blink;
-}
+RtlUpperString(
+  IN OUT PSTRING  DestinationString,
+  IN const PSTRING  SourceString);
 
-FORCEINLINE
-VOID
+NTSYSAPI
+NTSTATUS
 NTAPI
-RtlReleaseHashTableContext(
-  IN OUT PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context)
-{
-  UNREFERENCED_PARAMETER(Context);
-  return;
-}
+RtlUpcaseUnicodeString(
+  IN OUT PUNICODE_STRING DestinationString,
+  IN PCUNICODE_STRING  SourceString,
+  IN BOOLEAN  AllocateDestinationString);
 
-FORCEINLINE
-ULONG
+NTSYSAPI
+VOID
 NTAPI
-RtlTotalBucketsHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable)
-{
-  return HashTable->TableSize;
-}
+RtlMapGenericMask(
+  IN OUT PACCESS_MASK AccessMask,
+  IN PGENERIC_MAPPING GenericMapping);
 
-FORCEINLINE
-ULONG
+NTSYSAPI
+NTSTATUS
 NTAPI
-RtlNonEmptyBucketsHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable)
-{
-  return HashTable->NonEmptyBuckets;
-}
+RtlVolumeDeviceToDosName(
+  IN PVOID VolumeDeviceObject,
+  OUT PUNICODE_STRING DosName);
 
-FORCEINLINE
-ULONG
+NTSYSAPI
+NTSTATUS
 NTAPI
-RtlEmptyBucketsHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable)
-{
-  return HashTable->TableSize - HashTable->NonEmptyBuckets;
-}
+RtlGetVersion(
+  IN OUT PRTL_OSVERSIONINFOW lpVersionInformation);
 
-FORCEINLINE
-ULONG
+NTSYSAPI
+NTSTATUS
 NTAPI
-RtlTotalEntriesHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable)
-{
-  return HashTable->NumEntries;
-}
+RtlVerifyVersionInfo(
+  IN PRTL_OSVERSIONINFOEXW VersionInfo,
+  IN ULONG TypeMask,
+  IN ULONGLONG ConditionMask);
 
-FORCEINLINE
-ULONG
+NTSYSAPI
+LONG
 NTAPI
-RtlActiveEnumeratorsHashTable(
-  IN PRTL_DYNAMIC_HASH_TABLE HashTable)
-{
-  return HashTable->NumEnumerators;
-}
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
-
-#endif /* !defined(MIDL_PASS) && !defined(SORTPP_PASS) */
+RtlCompareString(
+  IN const PSTRING String1,
+  IN const PSTRING String2,
+  BOOLEAN CaseInSensitive);
 
-/******************************************************************************
- *                            Security Manager Functions                      *
- ******************************************************************************/
+NTSYSAPI
+VOID
+NTAPI
+RtlCopyString(
+  OUT PSTRING DestinationString,
+  IN const PSTRING SourceString OPTIONAL);
 
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-NTKERNELAPI
+NTSYSAPI
 BOOLEAN
 NTAPI
-SeSinglePrivilegeCheck(
-  IN LUID PrivilegeValue,
-  IN KPROCESSOR_MODE PreviousMode);
-
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
-
-/******************************************************************************
- *                            ZwXxx Functions                                 *
- ******************************************************************************/
-
-
+RtlEqualString(
+  IN const PSTRING String1,
+  IN const PSTRING String2,
+  IN BOOLEAN CaseInSensitive);
 
 NTSYSAPI
 NTSTATUS
 NTAPI
-ZwAllocateLocallyUniqueId(
-  OUT PLUID Luid);
+RtlCharToInteger(
+  IN PCSZ String,
+  IN ULONG Base OPTIONAL,
+  OUT PULONG Value);
 
 NTSYSAPI
-NTSTATUS
+CHAR
 NTAPI
-ZwTerminateProcess(
-  IN HANDLE ProcessHandle OPTIONAL,
-  IN NTSTATUS ExitStatus);
+RtlUpperChar(
+  IN CHAR Character);
 
 NTSYSAPI
-NTSTATUS
+ULONG
 NTAPI
-ZwOpenProcess(
-  OUT PHANDLE ProcessHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN POBJECT_ATTRIBUTES ObjectAttributes,
-  IN PCLIENT_ID ClientId OPTIONAL);
+RtlWalkFrameChain(
+  OUT PVOID *Callers,
+  IN ULONG Count,
+  IN ULONG Flags);
+
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
+/* Security reference monitor routines */
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
+NTKERNELAPI
+BOOLEAN
+NTAPI
+SeSinglePrivilegeCheck(
+  IN LUID PrivilegeValue,
+  IN KPROCESSOR_MODE PreviousMode);
+#endif
 
+/* ZwXxx Functions */
+
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
 
 NTSTATUS
 NTAPI
@@ -5572,190 +2942,12 @@ ZwSetTimer(
   IN LONG Period OPTIONAL,
   OUT PBOOLEAN PreviousState OPTIONAL);
 
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwDisplayString(
-  IN PUNICODE_STRING String);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwPowerInformation(
-  IN POWER_INFORMATION_LEVEL PowerInformationLevel,
-  IN PVOID InputBuffer OPTIONAL,
-  IN ULONG InputBufferLength,
-  OUT PVOID OutputBuffer OPTIONAL,
-  IN ULONG OutputBufferLength);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwQueryVolumeInformationFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  OUT PVOID FsInformation,
-  IN ULONG Length,
-  IN FS_INFORMATION_CLASS FsInformationClass);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwDeviceIoControlFile(
-  IN HANDLE FileHandle,
-  IN HANDLE Event OPTIONAL,
-  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
-  IN PVOID ApcContext OPTIONAL,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN ULONG IoControlCode,
-  IN PVOID InputBuffer OPTIONAL,
-  IN ULONG InputBufferLength,
-  OUT PVOID OutputBuffer OPTIONAL,
-  IN ULONG OutputBufferLength);
-
-
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
-
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-
-NTSTATUS
-NTAPI
-ZwSetTimerEx(
-  IN HANDLE TimerHandle,
-  IN TIMER_SET_INFORMATION_CLASS TimerSetInformationClass,
-  IN OUT PVOID TimerSetInformation,
-  IN ULONG TimerSetInformationLength);
-
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
-
-
-
-/* UNSORTED */
-
-#define VER_SET_CONDITION(ConditionMask, TypeBitMask, ComparisonType)  \
-        ((ConditionMask) = VerSetConditionMask((ConditionMask), \
-        (TypeBitMask), (ComparisonType)))
-
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-NTSYSAPI
-ULONGLONG
-NTAPI
-VerSetConditionMask(
-  IN ULONGLONG ConditionMask,
-  IN ULONG TypeMask,
-  IN UCHAR Condition);
-#endif
-
-typedef struct _KERNEL_USER_TIMES {
-  LARGE_INTEGER CreateTime;
-  LARGE_INTEGER ExitTime;
-  LARGE_INTEGER KernelTime;
-  LARGE_INTEGER UserTime;
-} KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
-
-/* NtXxx Functions */
-
-typedef enum _SYSTEM_FIRMWARE_TABLE_ACTION {
-  SystemFirmwareTable_Enumerate,
-  SystemFirmwareTable_Get
-} SYSTEM_FIRMWARE_TABLE_ACTION;
-
-typedef struct _SYSTEM_FIRMWARE_TABLE_INFORMATION {
-  ULONG ProviderSignature;
-  SYSTEM_FIRMWARE_TABLE_ACTION Action;
-  ULONG TableID;
-  ULONG TableBufferLength;
-  UCHAR TableBuffer[ANYSIZE_ARRAY];
-} SYSTEM_FIRMWARE_TABLE_INFORMATION, *PSYSTEM_FIRMWARE_TABLE_INFORMATION;
-
-typedef NTSTATUS
-(__cdecl *PFNFTH)(
-  IN OUT PSYSTEM_FIRMWARE_TABLE_INFORMATION SystemFirmwareTableInfo);
-
-typedef struct _SYSTEM_FIRMWARE_TABLE_HANDLER {
-  ULONG ProviderSignature;
-  BOOLEAN Register;
-  PFNFTH FirmwareTableHandler;
-  PVOID DriverObject;
-} SYSTEM_FIRMWARE_TABLE_HANDLER, *PSYSTEM_FIRMWARE_TABLE_HANDLER;
-
-typedef ULONG_PTR
-(NTAPI *PDRIVER_VERIFIER_THUNK_ROUTINE)(
-  IN PVOID Context);
-
-typedef struct _DRIVER_VERIFIER_THUNK_PAIRS {
-  PDRIVER_VERIFIER_THUNK_ROUTINE PristineRoutine;
-  PDRIVER_VERIFIER_THUNK_ROUTINE NewRoutine;
-} DRIVER_VERIFIER_THUNK_PAIRS, *PDRIVER_VERIFIER_THUNK_PAIRS;
-
-#define DRIVER_VERIFIER_SPECIAL_POOLING             0x0001
-#define DRIVER_VERIFIER_FORCE_IRQL_CHECKING         0x0002
-#define DRIVER_VERIFIER_INJECT_ALLOCATION_FAILURES  0x0004
-#define DRIVER_VERIFIER_TRACK_POOL_ALLOCATIONS      0x0008
-#define DRIVER_VERIFIER_IO_CHECKING                 0x0010
-
-#define SHARED_GLOBAL_FLAGS_ERROR_PORT_V        0x0
-#define SHARED_GLOBAL_FLAGS_ERROR_PORT          (1UL << SHARED_GLOBAL_FLAGS_ERROR_PORT_V)
-
-#define SHARED_GLOBAL_FLAGS_ELEVATION_ENABLED_V 0x1
-#define SHARED_GLOBAL_FLAGS_ELEVATION_ENABLED   (1UL << SHARED_GLOBAL_FLAGS_ELEVATION_ENABLED_V)
-
-#define SHARED_GLOBAL_FLAGS_VIRT_ENABLED_V      0x2
-#define SHARED_GLOBAL_FLAGS_VIRT_ENABLED        (1UL << SHARED_GLOBAL_FLAGS_VIRT_ENABLED_V)
-
-#define SHARED_GLOBAL_FLAGS_INSTALLER_DETECT_ENABLED_V  0x3
-#define SHARED_GLOBAL_FLAGS_INSTALLER_DETECT_ENABLED    \
-    (1UL << SHARED_GLOBAL_FLAGS_INSTALLER_DETECT_ENABLED_V)
-
-#define SHARED_GLOBAL_FLAGS_SPARE_V                     0x4
-#define SHARED_GLOBAL_FLAGS_SPARE                       \
-    (1UL << SHARED_GLOBAL_FLAGS_SPARE_V)
-
-#define SHARED_GLOBAL_FLAGS_DYNAMIC_PROC_ENABLED_V      0x5
-#define SHARED_GLOBAL_FLAGS_DYNAMIC_PROC_ENABLED        \
-    (1UL << SHARED_GLOBAL_FLAGS_DYNAMIC_PROC_ENABLED_V)
-
-#define SHARED_GLOBAL_FLAGS_SEH_VALIDATION_ENABLED_V    0x6
-#define SHARED_GLOBAL_FLAGS_SEH_VALIDATION_ENABLED        \
-    (1UL << SHARED_GLOBAL_FLAGS_SEH_VALIDATION_ENABLED_V)
-
-#define EX_INIT_BITS(Flags, Bit) \
-    *((Flags)) |= (Bit)             // Safe to use before concurrently accessible
-
-#define EX_TEST_SET_BIT(Flags, Bit) \
-    InterlockedBitTestAndSet ((PLONG)(Flags), (Bit))
-
-#define EX_TEST_CLEAR_BIT(Flags, Bit) \
-    InterlockedBitTestAndReset ((PLONG)(Flags), (Bit))
-
-#define PCCARD_MAP_ERROR               0x01
-#define PCCARD_DEVICE_PCI              0x10
-
-#define PCCARD_SCAN_DISABLED           0x01
-#define PCCARD_MAP_ZERO                0x02
-#define PCCARD_NO_TIMER                0x03
-#define PCCARD_NO_PIC                  0x04
-#define PCCARD_NO_LEGACY_BASE          0x05
-#define PCCARD_DUP_LEGACY_BASE         0x06
-#define PCCARD_NO_CONTROLLERS          0x07
-
-#define MAXIMUM_EXPANSION_SIZE (KERNEL_LARGE_STACK_SIZE - (PAGE_SIZE / 2))
-
-/* Filesystem runtime library routines */
-
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlIsTotalDeviceFailure(
-  IN NTSTATUS Status);
 #endif
 
-/* FIXME : These definitions below doesn't belong to NTDDK */
 
 #ifdef __cplusplus
 }
 #endif
+
+
+#endif /* _NTDDK_ */
index 15bace8..87d0470 100644 (file)
 #define _NTIFS_INCLUDED_
 #define _GNU_NTIFS_
 
+/* Helper macro to enable gcc's extension.  */
+#ifndef __GNU_EXTENSION
+#ifdef __GNUC__
+#define __GNU_EXTENSION __extension__
+#else
+#define __GNU_EXTENSION
+#endif
+#endif
+
 #ifdef __cplusplus
 extern "C" {
 #endif
 
+#if !defined(_NTHALDLL_) && !defined(_BLDR_)
+#define NTHALAPI DECLSPEC_IMPORT
+#else
+#define NTHALAPI
+#endif
+
+/* For ReactOS */
+#if !defined(_NTOSKRNL_) && !defined(_BLDR_)
+#define NTKERNELAPI DECLSPEC_IMPORT
+#else
+#define NTKERNELAPI
+#endif
+
 /* Dependencies */
 #include <ntddk.h>
 #include <excpt.h>
@@ -54,6 +76,16 @@ extern "C" {
 #define ClearFlag(_F,_SF)     ((_F) &= ~(_SF))
 #endif
 
+#define PsGetCurrentProcess IoGetCurrentProcess
+
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+extern NTSYSAPI volatile CCHAR KeNumberProcessors;
+#elif (NTDDI_VERSION >= NTDDI_WINXP)
+extern NTSYSAPI CCHAR KeNumberProcessors;
+#else
+extern PCCHAR KeNumberProcessors;
+#endif
+
 typedef UNICODE_STRING LSA_UNICODE_STRING, *PLSA_UNICODE_STRING;
 typedef STRING LSA_STRING, *PLSA_STRING;
 typedef OBJECT_ATTRIBUTES LSA_OBJECT_ATTRIBUTES, *PLSA_OBJECT_ATTRIBUTES;
@@ -719,6 +751,8 @@ typedef enum _OBJECT_INFORMATION_CLASS {
   MaxObjectInfoClass /* FIXME, not in WDK */
 } OBJECT_INFORMATION_CLASS;
 
+#if (NTDDI_VERSION >= NTDDI_NT4)
+
 NTSYSCALLAPI
 NTSTATUS
 NTAPI
@@ -729,6 +763,8 @@ NtQueryObject(
   IN ULONG ObjectInformationLength,
   OUT PULONG ReturnLength OPTIONAL);
 
+#endif
+
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 
 NTSYSCALLAPI
@@ -2378,11 +2414,95 @@ extern const PRTL_REALLOCATE_STRING_ROUTINE RtlReallocateStringRoutine;
 
 #define RTL_SYSTEM_VOLUME_INFORMATION_FOLDER    L"System Volume Information"
 
+#define DEVICE_TYPE ULONG
+
+#define FILE_DEVICE_BEEP                0x00000001
+#define FILE_DEVICE_CD_ROM              0x00000002
+#define FILE_DEVICE_CD_ROM_FILE_SYSTEM  0x00000003
+#define FILE_DEVICE_CONTROLLER          0x00000004
+#define FILE_DEVICE_DATALINK            0x00000005
+#define FILE_DEVICE_DFS                 0x00000006
+#define FILE_DEVICE_DISK                0x00000007
+#define FILE_DEVICE_DISK_FILE_SYSTEM    0x00000008
+#define FILE_DEVICE_FILE_SYSTEM         0x00000009
+#define FILE_DEVICE_INPORT_PORT         0x0000000a
+#define FILE_DEVICE_KEYBOARD            0x0000000b
+#define FILE_DEVICE_MAILSLOT            0x0000000c
+#define FILE_DEVICE_MIDI_IN             0x0000000d
+#define FILE_DEVICE_MIDI_OUT            0x0000000e
+#define FILE_DEVICE_MOUSE               0x0000000f
+#define FILE_DEVICE_MULTI_UNC_PROVIDER  0x00000010
+#define FILE_DEVICE_NAMED_PIPE          0x00000011
+#define FILE_DEVICE_NETWORK             0x00000012
+#define FILE_DEVICE_NETWORK_BROWSER     0x00000013
+#define FILE_DEVICE_NETWORK_FILE_SYSTEM 0x00000014
+#define FILE_DEVICE_NULL                0x00000015
+#define FILE_DEVICE_PARALLEL_PORT       0x00000016
+#define FILE_DEVICE_PHYSICAL_NETCARD    0x00000017
+#define FILE_DEVICE_PRINTER             0x00000018
+#define FILE_DEVICE_SCANNER             0x00000019
+#define FILE_DEVICE_SERIAL_MOUSE_PORT   0x0000001a
+#define FILE_DEVICE_SERIAL_PORT         0x0000001b
+#define FILE_DEVICE_SCREEN              0x0000001c
+#define FILE_DEVICE_SOUND               0x0000001d
+#define FILE_DEVICE_STREAMS             0x0000001e
+#define FILE_DEVICE_TAPE                0x0000001f
+#define FILE_DEVICE_TAPE_FILE_SYSTEM    0x00000020
+#define FILE_DEVICE_TRANSPORT           0x00000021
+#define FILE_DEVICE_UNKNOWN             0x00000022
+#define FILE_DEVICE_VIDEO               0x00000023
+#define FILE_DEVICE_VIRTUAL_DISK        0x00000024
+#define FILE_DEVICE_WAVE_IN             0x00000025
+#define FILE_DEVICE_WAVE_OUT            0x00000026
+#define FILE_DEVICE_8042_PORT           0x00000027
+#define FILE_DEVICE_NETWORK_REDIRECTOR  0x00000028
+#define FILE_DEVICE_BATTERY             0x00000029
+#define FILE_DEVICE_BUS_EXTENDER        0x0000002a
+#define FILE_DEVICE_MODEM               0x0000002b
+#define FILE_DEVICE_VDM                 0x0000002c
+#define FILE_DEVICE_MASS_STORAGE        0x0000002d
+#define FILE_DEVICE_SMB                 0x0000002e
+#define FILE_DEVICE_KS                  0x0000002f
+#define FILE_DEVICE_CHANGER             0x00000030
+#define FILE_DEVICE_SMARTCARD           0x00000031
+#define FILE_DEVICE_ACPI                0x00000032
+#define FILE_DEVICE_DVD                 0x00000033
+#define FILE_DEVICE_FULLSCREEN_VIDEO    0x00000034
+#define FILE_DEVICE_DFS_FILE_SYSTEM     0x00000035
+#define FILE_DEVICE_DFS_VOLUME          0x00000036
+#define FILE_DEVICE_SERENUM             0x00000037
+#define FILE_DEVICE_TERMSRV             0x00000038
+#define FILE_DEVICE_KSEC                0x00000039
+#define FILE_DEVICE_FIPS                0x0000003A
+#define FILE_DEVICE_INFINIBAND          0x0000003B
+#define FILE_DEVICE_VMBUS               0x0000003E
+#define FILE_DEVICE_CRYPT_PROVIDER      0x0000003F
+#define FILE_DEVICE_WPD                 0x00000040
+#define FILE_DEVICE_BLUETOOTH           0x00000041
+#define FILE_DEVICE_MT_COMPOSITE        0x00000042
+#define FILE_DEVICE_MT_TRANSPORT        0x00000043
+#define FILE_DEVICE_BIOMETRIC           0x00000044
+#define FILE_DEVICE_PMI                 0x00000045
+
+#define CTL_CODE(DeviceType, Function, Method, Access) \
+  (((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method))
+
+#define DEVICE_TYPE_FROM_CTL_CODE(ctl) (((ULONG) (ctl & 0xffff0000)) >> 16)
+
 #define METHOD_FROM_CTL_CODE(ctrlCode)          ((ULONG)(ctrlCode & 3))
 
+#define METHOD_BUFFERED                 0
+#define METHOD_IN_DIRECT                1
+#define METHOD_OUT_DIRECT               2
+#define METHOD_NEITHER                  3
 #define METHOD_DIRECT_TO_HARDWARE       METHOD_IN_DIRECT
 #define METHOD_DIRECT_FROM_HARDWARE     METHOD_OUT_DIRECT
 
+#define FILE_ANY_ACCESS                   0x00000000
+#define FILE_SPECIAL_ACCESS               FILE_ANY_ACCESS
+#define FILE_READ_ACCESS                  0x00000001
+#define FILE_WRITE_ACCESS                 0x00000002
+
 typedef ULONG  LSA_OPERATIONAL_MODE, *PLSA_OPERATIONAL_MODE;
 
 typedef enum _SECURITY_LOGON_TYPE {
@@ -4553,8 +4673,6 @@ typedef struct _KAPC_STATE {
 
 #define KAPC_STATE_ACTUAL_LENGTH (FIELD_OFFSET(KAPC_STATE, UserApcPending) + sizeof(BOOLEAN))
 
-#define ASSERT_QUEUE(Q) ASSERT(((Q)->Header.Type & KOBJECT_TYPE_MASK) == QueueObject);
-
 typedef struct _KQUEUE {
   DISPATCHER_HEADER Header;
   LIST_ENTRY EntryListHead;
@@ -4689,7 +4807,7 @@ FASTCALL
 KeAcquireQueuedSpinLock(
   IN OUT KSPIN_LOCK_QUEUE_NUMBER Number);
 
-_DECL_HAL_KE_IMPORT
+NTHALAPI
 VOID
 FASTCALL
 KeReleaseQueuedSpinLock(
@@ -4904,6 +5022,24 @@ typedef NTSTATUS
 
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 
+NTKERNELAPI
+VOID
+NTAPI
+SeCaptureSubjectContext(
+  OUT PSECURITY_SUBJECT_CONTEXT SubjectContext);
+
+NTKERNELAPI
+VOID
+NTAPI
+SeLockSubjectContext(
+  IN PSECURITY_SUBJECT_CONTEXT SubjectContext);
+
+NTKERNELAPI
+VOID
+NTAPI
+SeUnlockSubjectContext(
+  IN PSECURITY_SUBJECT_CONTEXT SubjectContext);
+
 NTKERNELAPI
 VOID
 NTAPI
@@ -5317,6 +5453,18 @@ SeLocateProcessImageName(
 
 extern NTKERNELAPI PSE_EXPORTS SeExports;
 
+#if !defined(_PSGETCURRENTTHREAD_)
+#define _PSGETCURRENTTHREAD_
+
+FORCEINLINE
+PETHREAD
+PsGetCurrentThread(
+  VOID)
+{
+  return (PETHREAD)KeGetCurrentThread();
+}
+#endif
+
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 
 NTKERNELAPI
@@ -5386,20 +5534,7 @@ PsReturnPoolQuota(
   IN POOL_TYPE PoolType,
   IN ULONG_PTR Amount);
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-PsAssignImpersonationToken(
-  IN PETHREAD Thread,
-  IN HANDLE Token OPTIONAL);
-
-NTKERNELAPI
-HANDLE
-NTAPI
-PsReferencePrimaryToken(
-  IN OUT PEPROCESS Process);
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+#endif
 
 #if (NTDDI_VERSION >= NTDDI_WINXP)
 
@@ -5688,6 +5823,18 @@ IoPageRead(
   IN PKEVENT Event,
   OUT PIO_STATUS_BLOCK IoStatusBlock);
 
+NTKERNELAPI
+PDEVICE_OBJECT
+NTAPI
+IoGetAttachedDevice(
+  IN PDEVICE_OBJECT DeviceObject);
+
+NTKERNELAPI
+PDEVICE_OBJECT
+NTAPI
+IoGetAttachedDeviceReference(
+  IN PDEVICE_OBJECT DeviceObject);
+
 NTKERNELAPI
 PDEVICE_OBJECT
 NTAPI
@@ -5804,6 +5951,42 @@ NTAPI
 IoSetTopLevelIrp(
   IN PIRP Irp OPTIONAL);
 
+NTKERNELAPI
+VOID
+NTAPI
+IoStartNextPacket(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN BOOLEAN Cancelable);
+
+NTKERNELAPI
+VOID
+NTAPI
+IoStartNextPacketByKey(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN BOOLEAN Cancelable,
+  IN ULONG Key);
+
+NTKERNELAPI
+VOID
+NTAPI
+IoStartPacket(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN PIRP Irp,
+  IN PULONG Key OPTIONAL,
+  IN PDRIVER_CANCEL CancelFunction OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+IoStartTimer(
+  IN PDEVICE_OBJECT DeviceObject);
+
+NTKERNELAPI
+VOID
+NTAPI
+IoStopTimer(
+  IN PDEVICE_OBJECT DeviceObject);
+
 NTKERNELAPI
 NTSTATUS
 NTAPI
@@ -5840,6 +6023,12 @@ IoVerifyVolume(
   IN PDEVICE_OBJECT DeviceObject,
   IN BOOLEAN AllowRawMount);
 
+NTKERNELAPI
+VOID
+NTAPI
+IoWriteErrorLogEntry(
+  IN PVOID ElEntry);
+
 NTKERNELAPI
 NTSTATUS
 NTAPI
@@ -5866,6 +6055,13 @@ IoQueryFileDosDeviceName(
   IN PFILE_OBJECT FileObject,
   OUT POBJECT_NAME_INFORMATION *ObjectNameInformation);
 
+VOID
+NTAPI
+IoSetStartIoAttributes(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN BOOLEAN DeferredStartIo,
+  IN BOOLEAN NonCancelable);
+
 NTKERNELAPI
 NTSTATUS
 NTAPI
@@ -5964,6 +6160,53 @@ typedef struct _IO_PRIORITY_INFO {
 #define PO_CB_LID_SWITCH_STATE          4
 #define PO_CB_PROCESSOR_POWER_POLICY    5
 
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
+NTKERNELAPI
+PVOID
+NTAPI
+PoRegisterSystemState(
+  IN OUT PVOID StateHandle OPTIONAL,
+  IN EXECUTION_STATE Flags);
+
+NTKERNELAPI
+VOID
+NTAPI
+PoUnregisterSystemState(
+  IN OUT PVOID StateHandle);
+
+NTKERNELAPI
+POWER_STATE
+NTAPI
+PoSetPowerState(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN POWER_STATE_TYPE Type,
+  IN POWER_STATE State);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+PoCallDriver(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN OUT PIRP Irp);
+
+NTKERNELAPI
+VOID
+NTAPI
+PoStartNextPowerIrp(
+  IN OUT PIRP Irp);
+
+NTKERNELAPI
+PULONG
+NTAPI
+PoRegisterDeviceForIdleDetection(
+  IN PDEVICE_OBJECT DeviceObject,
+  IN ULONG ConservationIdleTime,
+  IN ULONG PerformanceIdleTime,
+  IN DEVICE_POWER_STATE State);
+
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+
 #if (NTDDI_VERSION >= NTDDI_WINXP)
 NTKERNELAPI
 NTSTATUS
@@ -5972,6 +6215,84 @@ PoQueueShutdownWorkItem(
   IN OUT PWORK_QUEUE_ITEM WorkItem);
 #endif
 
+#if (NTDDI_VERSION >= NTDDI_VISTA)
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+PoRegisterPowerSettingCallback(
+  IN PDEVICE_OBJECT DeviceObject OPTIONAL,
+  IN LPCGUID SettingGuid,
+  IN PPOWER_SETTING_CALLBACK Callback,
+  IN PVOID Context OPTIONAL,
+  OUT PVOID *Handle);
+
+NTKERNELAPI
+NTSTATUS
+PoUnregisterPowerSettingCallback(
+  IN OUT PVOID Handle);
+
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_WIN6SP1)
+NTKERNELAPI
+VOID
+NTAPI
+PoSetDeviceBusyEx(
+  IN OUT PULONG IdlePointer);
+#endif
+
+#if (NTDDI_VERSION >= NTDDI_WIN7)
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+PoCreatePowerRequest(
+  OUT PVOID *PowerRequest,
+  IN PDEVICE_OBJECT DeviceObject,
+  IN PCOUNTED_REASON_CONTEXT Context);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+PoSetPowerRequest(
+  IN OUT PVOID PowerRequest,
+  IN POWER_REQUEST_TYPE Type);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+PoClearPowerRequest(
+  IN OUT PVOID PowerRequest,
+  IN POWER_REQUEST_TYPE Type);
+
+NTKERNELAPI
+VOID
+NTAPI
+PoDeletePowerRequest(
+  IN OUT PVOID PowerRequest);
+
+NTKERNELAPI
+VOID
+NTAPI
+PoStartDeviceBusy(
+  IN OUT PULONG IdlePointer);
+
+NTKERNELAPI
+VOID
+NTAPI
+PoEndDeviceBusy(
+  IN OUT PULONG IdlePointer);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+PoQueryWatchdogTime(
+  IN PDEVICE_OBJECT Pdo,
+  OUT PULONG SecondsRemaining);
+
+#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
+
 #if defined(_IA64_)
 #if (NTDDI_VERSION >= NTDDI_WIN2K)
 //DECLSPEC_DEPRECATED_DDK
@@ -6247,247 +6568,65 @@ typedef struct _FILE_LOCK {
   LONG volatile LockRequestsInProgress;
 } FILE_LOCK, *PFILE_LOCK;
 
-typedef struct _TUNNEL {
-  FAST_MUTEX Mutex;
-  PRTL_SPLAY_LINKS Cache;
-  LIST_ENTRY TimerQueue;
-  USHORT NumEntries;
-} TUNNEL, *PTUNNEL;
-
-typedef enum _FSRTL_COMPARISON_RESULT {
-  LessThan = -1,
-  EqualTo = 0,
-  GreaterThan = 1
-} FSRTL_COMPARISON_RESULT;
-
-#define FSRTL_FAT_LEGAL                 0x01
-#define FSRTL_HPFS_LEGAL                0x02
-#define FSRTL_NTFS_LEGAL                0x04
-#define FSRTL_WILD_CHARACTER            0x08
-#define FSRTL_OLE_LEGAL                 0x10
-#define FSRTL_NTFS_STREAM_LEGAL         (FSRTL_NTFS_LEGAL | FSRTL_OLE_LEGAL)
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
 
-typedef struct _BASE_MCB {
-  ULONG MaximumPairCount;
-  ULONG PairCount;
-  USHORT PoolType;
-  USHORT Flags;
-  PVOID Mapping;
-} BASE_MCB, *PBASE_MCB;
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlCopyRead(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN BOOLEAN Wait,
+  IN ULONG LockKey,
+  OUT PVOID Buffer,
+  OUT PIO_STATUS_BLOCK IoStatus,
+  IN PDEVICE_OBJECT DeviceObject);
 
-typedef struct _LARGE_MCB {
-  PKGUARDED_MUTEX GuardedMutex;
-  BASE_MCB BaseMcb;
-} LARGE_MCB, *PLARGE_MCB;
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlCopyWrite(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN BOOLEAN Wait,
+  IN ULONG LockKey,
+  IN PVOID Buffer,
+  OUT PIO_STATUS_BLOCK IoStatus,
+  IN PDEVICE_OBJECT DeviceObject);
 
-#define MCB_FLAG_RAISE_ON_ALLOCATION_FAILURE 1
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlMdlReadDev(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN ULONG LockKey,
+  OUT PMDL *MdlChain,
+  OUT PIO_STATUS_BLOCK IoStatus,
+  IN PDEVICE_OBJECT DeviceObject OPTIONAL);
 
-typedef struct _MCB {
-  LARGE_MCB DummyFieldThatSizesThisStructureCorrectly;
-} MCB, *PMCB;
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlMdlReadCompleteDev(
+  IN PFILE_OBJECT FileObject,
+  IN PMDL MdlChain,
+  IN PDEVICE_OBJECT DeviceObject OPTIONAL);
 
-typedef PVOID OPLOCK, *POPLOCK;
-
-typedef VOID
-(NTAPI *POPLOCK_WAIT_COMPLETE_ROUTINE) (
-  IN PVOID Context,
-  IN PIRP Irp);
-
-typedef VOID
-(NTAPI *POPLOCK_FS_PREPOST_IRP) (
-  IN PVOID Context,
-  IN PIRP Irp);
-
-#if (NTDDI_VERSION >= NTDDI_VISTASP1)
-#define OPLOCK_FLAG_COMPLETE_IF_OPLOCKED    0x00000001
-#endif
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-#define OPLOCK_FLAG_OPLOCK_KEY_CHECK_ONLY   0x00000002
-#define OPLOCK_FLAG_BACK_OUT_ATOMIC_OPLOCK  0x00000004
-#define OPLOCK_FLAG_IGNORE_OPLOCK_KEYS      0x00000008
-#define OPLOCK_FSCTRL_FLAG_ALL_KEYS_MATCH   0x00000001
-#endif
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-
-typedef struct _OPLOCK_KEY_ECP_CONTEXT {
-  GUID OplockKey;
-  ULONG Reserved;
-} OPLOCK_KEY_ECP_CONTEXT, *POPLOCK_KEY_ECP_CONTEXT;
-
-DEFINE_GUID( GUID_ECP_OPLOCK_KEY, 0x48850596, 0x3050, 0x4be7, 0x98, 0x63, 0xfe, 0xc3, 0x50, 0xce, 0x8d, 0x7f );
-
-#endif
-
-#define FSRTL_VOLUME_DISMOUNT           1
-#define FSRTL_VOLUME_DISMOUNT_FAILED    2
-#define FSRTL_VOLUME_LOCK               3
-#define FSRTL_VOLUME_LOCK_FAILED        4
-#define FSRTL_VOLUME_UNLOCK             5
-#define FSRTL_VOLUME_MOUNT              6
-#define FSRTL_VOLUME_NEEDS_CHKDSK       7
-#define FSRTL_VOLUME_WORM_NEAR_FULL     8
-#define FSRTL_VOLUME_WEARING_OUT        9
-#define FSRTL_VOLUME_FORCED_CLOSED      10
-#define FSRTL_VOLUME_INFO_MAKE_COMPAT   11
-#define FSRTL_VOLUME_PREPARING_EJECT    12
-#define FSRTL_VOLUME_CHANGE_SIZE        13
-#define FSRTL_VOLUME_BACKGROUND_FORMAT  14
-
-typedef PVOID PNOTIFY_SYNC;
-
-typedef BOOLEAN
-(NTAPI *PCHECK_FOR_TRAVERSE_ACCESS) (
-  IN PVOID NotifyContext,
-  IN PVOID TargetContext OPTIONAL,
-  IN PSECURITY_SUBJECT_CONTEXT SubjectContext);
-
-typedef BOOLEAN
-(NTAPI *PFILTER_REPORT_CHANGE) (
-  IN PVOID NotifyContext,
-  IN PVOID FilterContext);
-
-typedef VOID
-(NTAPI *PFSRTL_STACK_OVERFLOW_ROUTINE) (
-  IN PVOID Context,
-  IN PKEVENT Event);
-
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-
-#define FSRTL_UNC_PROVIDER_FLAGS_MAILSLOTS_SUPPORTED    0x00000001
-#define FSRTL_UNC_PROVIDER_FLAGS_CSC_ENABLED            0x00000002
-#define FSRTL_UNC_PROVIDER_FLAGS_DOMAIN_SVC_AWARE       0x00000004
-
-#define FSRTL_ALLOCATE_ECPLIST_FLAG_CHARGE_QUOTA           0x00000001
-
-#define FSRTL_ALLOCATE_ECP_FLAG_CHARGE_QUOTA               0x00000001
-#define FSRTL_ALLOCATE_ECP_FLAG_NONPAGED_POOL              0x00000002
-
-#define FSRTL_ECP_LOOKASIDE_FLAG_NONPAGED_POOL             0x00000002
-
-#define FSRTL_VIRTDISK_FULLY_ALLOCATED  0x00000001
-#define FSRTL_VIRTDISK_NO_DRIVE_LETTER  0x00000002
-
-typedef struct _FSRTL_MUP_PROVIDER_INFO_LEVEL_1 {
-  ULONG32 ProviderId;
-} FSRTL_MUP_PROVIDER_INFO_LEVEL_1, *PFSRTL_MUP_PROVIDER_INFO_LEVEL_1;
-
-typedef struct _FSRTL_MUP_PROVIDER_INFO_LEVEL_2 {
-  ULONG32 ProviderId;
-  UNICODE_STRING ProviderName;
-} FSRTL_MUP_PROVIDER_INFO_LEVEL_2, *PFSRTL_MUP_PROVIDER_INFO_LEVEL_2;
-
-typedef VOID
-(*PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK) (
-  IN OUT PVOID EcpContext,
-  IN LPCGUID EcpType);
-
-typedef struct _ECP_LIST ECP_LIST, *PECP_LIST;
-
-typedef ULONG FSRTL_ALLOCATE_ECPLIST_FLAGS;
-typedef ULONG FSRTL_ALLOCATE_ECP_FLAGS;
-typedef ULONG FSRTL_ECP_LOOKASIDE_FLAGS;
-
-typedef enum _FSRTL_CHANGE_BACKING_TYPE {
-  ChangeDataControlArea,
-  ChangeImageControlArea,
-  ChangeSharedCacheMap
-} FSRTL_CHANGE_BACKING_TYPE, *PFSRTL_CHANGE_BACKING_TYPE;
-
-#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
-
-typedef struct _FSRTL_PER_FILE_CONTEXT {
-  LIST_ENTRY Links;
-  PVOID OwnerId;
-  PVOID InstanceId;
-  PFREE_FUNCTION FreeCallback;
-} FSRTL_PER_FILE_CONTEXT, *PFSRTL_PER_FILE_CONTEXT;
-
-typedef struct _FSRTL_PER_STREAM_CONTEXT {
-  LIST_ENTRY Links;
-  PVOID OwnerId;
-  PVOID InstanceId;
-  PFREE_FUNCTION FreeCallback;
-} FSRTL_PER_STREAM_CONTEXT, *PFSRTL_PER_STREAM_CONTEXT;
-
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-typedef VOID
-(*PFN_FSRTLTEARDOWNPERSTREAMCONTEXTS) (
-  IN PFSRTL_ADVANCED_FCB_HEADER AdvancedHeader);
-#endif
-
-typedef struct _FSRTL_PER_FILEOBJECT_CONTEXT {
-  LIST_ENTRY Links;
-  PVOID OwnerId;
-  PVOID InstanceId;
-} FSRTL_PER_FILEOBJECT_CONTEXT, *PFSRTL_PER_FILEOBJECT_CONTEXT;
-
-#define FsRtlEnterFileSystem    KeEnterCriticalRegion
-#define FsRtlExitFileSystem     KeLeaveCriticalRegion
-
-#define FSRTL_CC_FLUSH_ERROR_FLAG_NO_HARD_ERROR  0x1
-#define FSRTL_CC_FLUSH_ERROR_FLAG_NO_LOG_ENTRY   0x2
-
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlCopyRead(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN ULONG Length,
-  IN BOOLEAN Wait,
-  IN ULONG LockKey,
-  OUT PVOID Buffer,
-  OUT PIO_STATUS_BLOCK IoStatus,
-  IN PDEVICE_OBJECT DeviceObject);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlCopyWrite(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN ULONG Length,
-  IN BOOLEAN Wait,
-  IN ULONG LockKey,
-  IN PVOID Buffer,
-  OUT PIO_STATUS_BLOCK IoStatus,
-  IN PDEVICE_OBJECT DeviceObject);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlMdlReadDev(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN ULONG Length,
-  IN ULONG LockKey,
-  OUT PMDL *MdlChain,
-  OUT PIO_STATUS_BLOCK IoStatus,
-  IN PDEVICE_OBJECT DeviceObject OPTIONAL);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlMdlReadCompleteDev(
-  IN PFILE_OBJECT FileObject,
-  IN PMDL MdlChain,
-  IN PDEVICE_OBJECT DeviceObject OPTIONAL);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlPrepareMdlWriteDev(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN ULONG Length,
-  IN ULONG LockKey,
-  OUT PMDL *MdlChain,
-  OUT PIO_STATUS_BLOCK IoStatus,
-  IN PDEVICE_OBJECT DeviceObject);
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlPrepareMdlWriteDev(
+  IN PFILE_OBJECT FileObject,
+  IN PLARGE_INTEGER FileOffset,
+  IN ULONG Length,
+  IN ULONG LockKey,
+  OUT PMDL *MdlChain,
+  OUT PIO_STATUS_BLOCK IoStatus,
+  IN PDEVICE_OBJECT DeviceObject);
 
 NTKERNELAPI
 BOOLEAN
@@ -6706,2633 +6845,1754 @@ FsRtlPrivateLock(
   IN PVOID Context,
   IN BOOLEAN AlreadySynchronized);
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlInitializeTunnelCache(
-  IN PTUNNEL Cache);
-
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlAddToTunnelCache(
-  IN PTUNNEL Cache,
-  IN ULONGLONG DirectoryKey,
-  IN PUNICODE_STRING ShortName,
-  IN PUNICODE_STRING LongName,
-  IN BOOLEAN KeyByShortName,
-  IN ULONG DataLength,
-  IN PVOID Data);
+#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
 
+#if (NTDDI_VERSION >= NTDDI_WIN7)
 NTKERNELAPI
 BOOLEAN
 NTAPI
-FsRtlFindInTunnelCache(
-  IN PTUNNEL Cache,
-  IN ULONGLONG DirectoryKey,
-  IN PUNICODE_STRING Name,
-  OUT PUNICODE_STRING ShortName,
-  OUT PUNICODE_STRING LongName,
-  IN OUT PULONG DataLength,
-  OUT PVOID Data);
+FsRtlAreThereCurrentOrInProgressFileLocks(
+  IN PFILE_LOCK FileLock);
+#endif
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlDeleteKeyFromTunnelCache(
-  IN PTUNNEL Cache,
-  IN ULONGLONG DirectoryKey);
+#pragma pack(push,4)
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlDeleteTunnelCache(
-  IN PTUNNEL Cache);
+#ifndef VER_PRODUCTBUILD
+#define VER_PRODUCTBUILD 10000
+#endif
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlDissectDbcs(
-  IN ANSI_STRING Name,
-  OUT PANSI_STRING FirstPart,
-  OUT PANSI_STRING RemainingPart);
+#include "csq.h"
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlDoesDbcsContainWildCards(
-  IN PANSI_STRING Name);
-    
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlIsDbcsInExpression(
-  IN PANSI_STRING Expression,
-  IN PANSI_STRING Name);
-    
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlIsFatDbcsLegal(
-  IN ANSI_STRING DbcsName,
-  IN BOOLEAN WildCardsPermissible,
-  IN BOOLEAN PathNamePermissible,
-  IN BOOLEAN LeadingBackslashPermissible);
-    
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlIsHpfsDbcsLegal(
-  IN ANSI_STRING DbcsName,
-  IN BOOLEAN WildCardsPermissible,
-  IN BOOLEAN PathNamePermissible,
-  IN BOOLEAN LeadingBackslashPermissible);
+#ifdef _NTOSKRNL_
+extern PUCHAR                       FsRtlLegalAnsiCharacterArray;
+#else
+extern DECLSPEC_IMPORT PUCHAR       FsRtlLegalAnsiCharacterArray;
+#endif
+extern PACL                         SePublicDefaultDacl;
+extern PACL                         SeSystemDefaultDacl;
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-FsRtlNormalizeNtstatus(
-  IN NTSTATUS Exception,
-  IN NTSTATUS GenericException);
+#define FS_LFN_APIS                     0x00004000
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlIsNtstatusExpected(
-  IN NTSTATUS Ntstatus);
+#define FILE_STORAGE_TYPE_SPECIFIED             0x00000041  /* FILE_DIRECTORY_FILE | FILE_NON_DIRECTORY_FILE */
+#define FILE_STORAGE_TYPE_DEFAULT               (StorageTypeDefault << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_DIRECTORY             (StorageTypeDirectory << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_FILE                  (StorageTypeFile << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_DOCFILE               (StorageTypeDocfile << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_JUNCTION_POINT        (StorageTypeJunctionPoint << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_CATALOG               (StorageTypeCatalog << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_STRUCTURED_STORAGE    (StorageTypeStructuredStorage << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_EMBEDDING             (StorageTypeEmbedding << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_STORAGE_TYPE_STREAM                (StorageTypeStream << FILE_STORAGE_TYPE_SHIFT)
+#define FILE_MINIMUM_STORAGE_TYPE               FILE_STORAGE_TYPE_DEFAULT
+#define FILE_MAXIMUM_STORAGE_TYPE               FILE_STORAGE_TYPE_STREAM
+#define FILE_STORAGE_TYPE_MASK                  0x000f0000
+#define FILE_STORAGE_TYPE_SHIFT                 16
 
-NTKERNELAPI
-PERESOURCE
-NTAPI
-FsRtlAllocateResource(
-  VOID);
+#define FILE_VC_QUOTAS_LOG_VIOLATIONS   0x00000004
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlInitializeLargeMcb(
-  IN PLARGE_MCB Mcb,
-  IN POOL_TYPE PoolType);
+#define FSRTL_VOLUME_DISMOUNT           1
+#define FSRTL_VOLUME_DISMOUNT_FAILED    2
+#define FSRTL_VOLUME_LOCK               3
+#define FSRTL_VOLUME_LOCK_FAILED        4
+#define FSRTL_VOLUME_UNLOCK             5
+#define FSRTL_VOLUME_MOUNT              6
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlUninitializeLargeMcb(
-  IN PLARGE_MCB Mcb);
+#define FSRTL_WILD_CHARACTER            0x08
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlResetLargeMcb(
-  IN PLARGE_MCB Mcb,
-  IN BOOLEAN SelfSynchronized);
+#define FSRTL_FAT_LEGAL                 0x01
+#define FSRTL_HPFS_LEGAL                0x02
+#define FSRTL_NTFS_LEGAL                0x04
+#define FSRTL_WILD_CHARACTER            0x08
+#define FSRTL_OLE_LEGAL                 0x10
+#define FSRTL_NTFS_STREAM_LEGAL         0x14
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlTruncateLargeMcb(
-  IN PLARGE_MCB Mcb,
-  IN LONGLONG Vbn);
+#ifdef _X86_
+#define HARDWARE_PTE    HARDWARE_PTE_X86
+#define PHARDWARE_PTE   PHARDWARE_PTE_X86
+#endif
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlAddLargeMcbEntry(
-  IN PLARGE_MCB Mcb,
-  IN LONGLONG Vbn,
-  IN LONGLONG Lbn,
-  IN LONGLONG SectorCount);
+#define IO_CHECK_CREATE_PARAMETERS      0x0200
+#define IO_ATTACH_DEVICE                0x0400
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlRemoveLargeMcbEntry(
-  IN PLARGE_MCB Mcb,
-  IN LONGLONG Vbn,
-  IN LONGLONG SectorCount);
+#define IO_ATTACH_DEVICE_API            0x80000000
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlLookupLargeMcbEntry(
-  IN PLARGE_MCB Mcb,
-  IN LONGLONG Vbn,
-  OUT PLONGLONG Lbn OPTIONAL,
-  OUT PLONGLONG SectorCountFromLbn OPTIONAL,
-  OUT PLONGLONG StartingLbn OPTIONAL,
-  OUT PLONGLONG SectorCountFromStartingLbn OPTIONAL,
-  OUT PULONG Index OPTIONAL);
+#define IO_TYPE_APC                     18
+#define IO_TYPE_DPC                     19
+#define IO_TYPE_DEVICE_QUEUE            20
+#define IO_TYPE_EVENT_PAIR              21
+#define IO_TYPE_INTERRUPT               22
+#define IO_TYPE_PROFILE                 23
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlLookupLastLargeMcbEntry(
-  IN PLARGE_MCB Mcb,
-  OUT PLONGLONG Vbn,
-  OUT PLONGLONG Lbn);
+#define IRP_BEING_VERIFIED              0x10
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlLookupLastLargeMcbEntryAndIndex(
-  IN PLARGE_MCB OpaqueMcb,
-  OUT PLONGLONG LargeVbn,
-  OUT PLONGLONG LargeLbn,
-  OUT PULONG Index);
+#define MAILSLOT_CLASS_FIRSTCLASS       1
+#define MAILSLOT_CLASS_SECONDCLASS      2
 
-NTKERNELAPI
-ULONG
-NTAPI
-FsRtlNumberOfRunsInLargeMcb(
-  IN PLARGE_MCB Mcb);
+#define MAILSLOT_SIZE_AUTO              0
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlGetNextLargeMcbEntry(
-  IN PLARGE_MCB Mcb,
-  IN ULONG RunIndex,
-  OUT PLONGLONG Vbn,
-  OUT PLONGLONG Lbn,
-  OUT PLONGLONG SectorCount);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlSplitLargeMcb(
-  IN PLARGE_MCB Mcb,
-  IN LONGLONG Vbn,
-  IN LONGLONG Amount);
-
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlInitializeMcb(
-  IN PMCB Mcb,
-  IN POOL_TYPE PoolType);
+#define MEM_DOS_LIM                     0x40000000
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlUninitializeMcb(
-  IN PMCB Mcb);
+#define MCB_FLAG_RAISE_ON_ALLOCATION_FAILURE 1
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlTruncateMcb(
-  IN PMCB Mcb,
-  IN VBN Vbn);
+#define OB_TYPE_TYPE                    1
+#define OB_TYPE_DIRECTORY               2
+#define OB_TYPE_SYMBOLIC_LINK           3
+#define OB_TYPE_TOKEN                   4
+#define OB_TYPE_PROCESS                 5
+#define OB_TYPE_THREAD                  6
+#define OB_TYPE_EVENT                   7
+#define OB_TYPE_EVENT_PAIR              8
+#define OB_TYPE_MUTANT                  9
+#define OB_TYPE_SEMAPHORE               10
+#define OB_TYPE_TIMER                   11
+#define OB_TYPE_PROFILE                 12
+#define OB_TYPE_WINDOW_STATION          13
+#define OB_TYPE_DESKTOP                 14
+#define OB_TYPE_SECTION                 15
+#define OB_TYPE_KEY                     16
+#define OB_TYPE_PORT                    17
+#define OB_TYPE_ADAPTER                 18
+#define OB_TYPE_CONTROLLER              19
+#define OB_TYPE_DEVICE                  20
+#define OB_TYPE_DRIVER                  21
+#define OB_TYPE_IO_COMPLETION           22
+#define OB_TYPE_FILE                    23
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlAddMcbEntry(
-  IN PMCB Mcb,
-  IN VBN Vbn,
-  IN LBN Lbn,
-  IN ULONG SectorCount);
+#define PIN_WAIT                        (1)
+#define PIN_EXCLUSIVE                   (2)
+#define PIN_NO_READ                     (4)
+#define PIN_IF_BCB                      (8)
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlRemoveMcbEntry(
-  IN PMCB Mcb,
-  IN VBN Vbn,
-  IN ULONG SectorCount);
+#define SEC_BASED      0x00200000
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlLookupMcbEntry(
-  IN PMCB Mcb,
-  IN VBN Vbn,
-  OUT PLBN Lbn,
-  OUT PULONG SectorCount OPTIONAL,
-  OUT PULONG Index);
+#define SECURITY_WORLD_SID_AUTHORITY    {0,0,0,0,0,1}
+#define SECURITY_WORLD_RID              (0x00000000L)
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlLookupLastMcbEntry(
-  IN PMCB Mcb,
-  OUT PVBN Vbn,
-  OUT PLBN Lbn);
+/* end winnt.h */
 
-NTKERNELAPI
-ULONG
-NTAPI
-FsRtlNumberOfRunsInMcb(
-  IN PMCB Mcb);
+#define TOKEN_HAS_ADMIN_GROUP           0x08
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlGetNextMcbEntry(
-  IN PMCB Mcb,
-  IN ULONG RunIndex,
-  OUT PVBN Vbn,
-  OUT PLBN Lbn,
-  OUT PULONG SectorCount);
+#define VACB_MAPPING_GRANULARITY        (0x40000)
+#define VACB_OFFSET_SHIFT               (18)
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-FsRtlBalanceReads(
-  IN PDEVICE_OBJECT TargetDevice);
+#if (VER_PRODUCTBUILD >= 1381)
+#define FSCTL_GET_HFS_INFORMATION       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#endif /* (VER_PRODUCTBUILD >= 1381) */
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlInitializeOplock(
-  IN OUT POPLOCK Oplock);
+#if (VER_PRODUCTBUILD >= 2195)
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlUninitializeOplock(
-  IN OUT POPLOCK Oplock);
+#define FSCTL_READ_PROPERTY_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 33, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_WRITE_PROPERTY_DATA       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 34, METHOD_NEITHER, FILE_ANY_ACCESS)
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-FsRtlOplockFsctrl(
-  IN POPLOCK Oplock,
-  IN PIRP Irp,
-  IN ULONG OpenCount);
+#define FSCTL_DUMP_PROPERTY_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 37,  METHOD_NEITHER, FILE_ANY_ACCESS)
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-FsRtlCheckOplock(
-  IN POPLOCK Oplock,
-  IN PIRP Irp,
-  IN PVOID Context,
-  IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
-  IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
+#define FSCTL_HSM_MSG                   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
+#define FSCTL_NSS_CONTROL               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 67, METHOD_BUFFERED, FILE_WRITE_DATA)
+#define FSCTL_HSM_DATA                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
+#define FSCTL_NSS_RCONTROL              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 70, METHOD_BUFFERED, FILE_READ_DATA)
+#endif /* (VER_PRODUCTBUILD >= 2195) */
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlOplockIsFastIoPossible(
-  IN POPLOCK Oplock);
+#define FSCTL_NETWORK_SET_CONFIGURATION_INFO    CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 102, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
+#define FSCTL_NETWORK_GET_CONFIGURATION_INFO    CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 103, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
+#define FSCTL_NETWORK_GET_CONNECTION_INFO       CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 104, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_NETWORK_ENUMERATE_CONNECTIONS     CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 105, METHOD_NEITHER, FILE_ANY_ACCESS)
+#define FSCTL_NETWORK_DELETE_CONNECTION         CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 107, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_NETWORK_GET_STATISTICS            CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 116, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_NETWORK_SET_DOMAIN_NAME           CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_ANY_ACCESS)
+#define FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT     CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_ANY_ACCESS)
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlCurrentBatchOplock(
-  IN POPLOCK Oplock);
+#define IOCTL_REDIR_QUERY_PATH          CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-FsRtlNotifyVolumeEvent(
-    IN PFILE_OBJECT     FileObject,
-  IN ULONG EventCode);
+typedef PVOID OPLOCK, *POPLOCK;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlNotifyInitializeSync(
-  IN PNOTIFY_SYNC *NotifySync);
+//
+// Forwarders
+//
+struct _RTL_AVL_TABLE;
+struct _RTL_GENERIC_TABLE;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlNotifyUninitializeSync(
-  IN PNOTIFY_SYNC *NotifySync);
+typedef PVOID PNOTIFY_SYNC;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlNotifyFullChangeDirectory(
-  IN PNOTIFY_SYNC NotifySync,
-  IN PLIST_ENTRY NotifyList,
-  IN PVOID FsContext,
-  IN PSTRING FullDirectoryName,
-  IN BOOLEAN WatchTree,
-  IN BOOLEAN IgnoreBuffer,
-  IN ULONG CompletionFilter,
-  IN PIRP NotifyIrp OPTIONAL,
-  IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL,
-  IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL);
+typedef enum _FILE_STORAGE_TYPE {
+    StorageTypeDefault = 1,
+    StorageTypeDirectory,
+    StorageTypeFile,
+    StorageTypeJunctionPoint,
+    StorageTypeCatalog,
+    StorageTypeStructuredStorage,
+    StorageTypeEmbedding,
+    StorageTypeStream
+} FILE_STORAGE_TYPE;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlNotifyFilterReportChange(
-  IN PNOTIFY_SYNC NotifySync,
-  IN PLIST_ENTRY NotifyList,
-  IN PSTRING FullTargetName,
-  IN USHORT TargetNameOffset,
-  IN PSTRING StreamName OPTIONAL,
-  IN PSTRING NormalizedParentName OPTIONAL,
-  IN ULONG FilterMatch,
-  IN ULONG Action,
-  IN PVOID TargetContext OPTIONAL,
-  IN PVOID FilterContext OPTIONAL);
+typedef struct _OBJECT_BASIC_INFORMATION
+{
+    ULONG Attributes;
+    ACCESS_MASK GrantedAccess;
+    ULONG HandleCount;
+    ULONG PointerCount;
+    ULONG PagedPoolCharge;
+    ULONG NonPagedPoolCharge;
+    ULONG Reserved[ 3 ];
+    ULONG NameInfoSize;
+    ULONG TypeInfoSize;
+    ULONG SecurityDescriptorSize;
+    LARGE_INTEGER CreationTime;
+} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlNotifyFullReportChange(
-  IN PNOTIFY_SYNC NotifySync,
-  IN PLIST_ENTRY NotifyList,
-  IN PSTRING FullTargetName,
-  IN USHORT TargetNameOffset,
-  IN PSTRING StreamName OPTIONAL,
-  IN PSTRING NormalizedParentName OPTIONAL,
-  IN ULONG FilterMatch,
-  IN ULONG Action,
-  IN PVOID TargetContext OPTIONAL);
+typedef struct _BITMAP_RANGE {
+    LIST_ENTRY      Links;
+    LONGLONG        BasePage;
+    ULONG           FirstDirtyPage;
+    ULONG           LastDirtyPage;
+    ULONG           DirtyPages;
+    PULONG          Bitmap;
+} BITMAP_RANGE, *PBITMAP_RANGE;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlNotifyCleanup(
-  IN PNOTIFY_SYNC NotifySync,
-  IN PLIST_ENTRY NotifyList,
-  IN PVOID FsContext);
+typedef struct _CACHE_UNINITIALIZE_EVENT {
+    struct _CACHE_UNINITIALIZE_EVENT    *Next;
+    KEVENT                              Event;
+} CACHE_UNINITIALIZE_EVENT, *PCACHE_UNINITIALIZE_EVENT;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlDissectName(
-  IN UNICODE_STRING Name,
-  OUT PUNICODE_STRING FirstPart,
-  OUT PUNICODE_STRING RemainingPart);
+typedef struct _CC_FILE_SIZES {
+    LARGE_INTEGER AllocationSize;
+    LARGE_INTEGER FileSize;
+    LARGE_INTEGER ValidDataLength;
+} CC_FILE_SIZES, *PCC_FILE_SIZES;
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlDoesNameContainWildCards(
-  IN PUNICODE_STRING Name);
+typedef struct _FILE_COPY_ON_WRITE_INFORMATION {
+    BOOLEAN ReplaceIfExists;
+    HANDLE  RootDirectory;
+    ULONG   FileNameLength;
+    WCHAR   FileName[1];
+} FILE_COPY_ON_WRITE_INFORMATION, *PFILE_COPY_ON_WRITE_INFORMATION;
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlAreNamesEqual(
-  IN PCUNICODE_STRING Name1,
-  IN PCUNICODE_STRING Name2,
-  IN BOOLEAN IgnoreCase,
-  IN PCWCH UpcaseTable OPTIONAL);
+typedef struct _FILE_FULL_DIRECTORY_INFORMATION {
+    ULONG           NextEntryOffset;
+    ULONG           FileIndex;
+    LARGE_INTEGER   CreationTime;
+    LARGE_INTEGER   LastAccessTime;
+    LARGE_INTEGER   LastWriteTime;
+    LARGE_INTEGER   ChangeTime;
+    LARGE_INTEGER   EndOfFile;
+    LARGE_INTEGER   AllocationSize;
+    ULONG           FileAttributes;
+    ULONG           FileNameLength;
+    ULONG           EaSize;
+    WCHAR           FileName[ANYSIZE_ARRAY];
+} FILE_FULL_DIRECTORY_INFORMATION, *PFILE_FULL_DIRECTORY_INFORMATION;
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlIsNameInExpression(
-  IN PUNICODE_STRING Expression,
-  IN PUNICODE_STRING Name,
-  IN BOOLEAN IgnoreCase,
-  IN PWCHAR UpcaseTable OPTIONAL);
+typedef struct _FILE_FS_FULL_SIZE_INFORMATION {
+    LARGE_INTEGER   TotalAllocationUnits;
+    LARGE_INTEGER   CallerAvailableAllocationUnits;
+    LARGE_INTEGER   ActualAvailableAllocationUnits;
+    ULONG           SectorsPerAllocationUnit;
+    ULONG           BytesPerSector;
+} FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlPostPagingFileStackOverflow(
-  IN PVOID Context,
-  IN PKEVENT Event,
-  IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine);
+typedef struct _FILE_FS_LABEL_INFORMATION {
+    ULONG VolumeLabelLength;
+    WCHAR VolumeLabel[1];
+} FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlPostStackOverflow (
-  IN PVOID Context,
-  IN PKEVENT Event,
-  IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine);
+#if (VER_PRODUCTBUILD >= 2195)
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-FsRtlRegisterUncProvider(
-  OUT PHANDLE MupHandle,
-  IN PUNICODE_STRING RedirectorDeviceName,
-  IN BOOLEAN MailslotsSupported);
+typedef struct _FILE_FS_OBJECT_ID_INFORMATION {
+    UCHAR ObjectId[16];
+    UCHAR ExtendedInfo[48];
+} FILE_FS_OBJECT_ID_INFORMATION, *PFILE_FS_OBJECT_ID_INFORMATION;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlDeregisterUncProvider(
-  IN HANDLE Handle);
+#endif /* (VER_PRODUCTBUILD >= 2195) */
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlTeardownPerStreamContexts(
-  IN PFSRTL_ADVANCED_FCB_HEADER AdvancedHeader);
+typedef struct _FILE_FS_SIZE_INFORMATION {
+    LARGE_INTEGER   TotalAllocationUnits;
+    LARGE_INTEGER   AvailableAllocationUnits;
+    ULONG           SectorsPerAllocationUnit;
+    ULONG           BytesPerSector;
+} FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
+
+typedef struct _FILE_FS_VOLUME_INFORMATION {
+    LARGE_INTEGER   VolumeCreationTime;
+    ULONG           VolumeSerialNumber;
+    ULONG           VolumeLabelLength;
+    BOOLEAN         SupportsObjects;
+    WCHAR           VolumeLabel[1];
+} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
+
+typedef struct _FILE_FS_OBJECTID_INFORMATION
+{
+    UCHAR ObjectId[16];
+    UCHAR ExtendedInfo[48];
+} FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION;
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-FsRtlCreateSectionForDataScan(
-  OUT PHANDLE SectionHandle,
-  OUT PVOID *SectionObject,
-  OUT PLARGE_INTEGER SectionFileSize OPTIONAL,
-    IN PFILE_OBJECT FileObject,
-  IN ACCESS_MASK DesiredAccess,
-  IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
-  IN PLARGE_INTEGER MaximumSize OPTIONAL,
-  IN ULONG SectionPageProtection,
-  IN ULONG AllocationAttributes,
-  IN ULONG Flags);
+/* raw internal file lock struct returned from FsRtlGetNextFileLock */
+typedef struct _FILE_SHARED_LOCK_ENTRY {
+    PVOID           Unknown1;
+    PVOID           Unknown2;
+    FILE_LOCK_INFO  FileLock;
+} FILE_SHARED_LOCK_ENTRY, *PFILE_SHARED_LOCK_ENTRY;
 
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
+/* raw internal file lock struct returned from FsRtlGetNextFileLock */
+typedef struct _FILE_EXCLUSIVE_LOCK_ENTRY {
+    LIST_ENTRY      ListEntry;
+    PVOID           Unknown1;
+    PVOID           Unknown2;
+    FILE_LOCK_INFO  FileLock;
+} FILE_EXCLUSIVE_LOCK_ENTRY, *PFILE_EXCLUSIVE_LOCK_ENTRY;
 
-#if (NTDDI_VERSION >= NTDDI_WINXP)
+typedef struct _FILE_MAILSLOT_PEEK_BUFFER {
+    ULONG ReadDataAvailable;
+    ULONG NumberOfMessages;
+    ULONG MessageLength;
+} FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlNotifyFilterChangeDirectory(
-  IN PNOTIFY_SYNC NotifySync,
-  IN PLIST_ENTRY NotifyList,
-  IN PVOID FsContext,
-  IN PSTRING FullDirectoryName,
-  IN BOOLEAN WatchTree,
-  IN BOOLEAN IgnoreBuffer,
-  IN ULONG CompletionFilter,
-  IN PIRP NotifyIrp OPTIONAL,
-  IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL,
-  IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL,
-  IN PFILTER_REPORT_CHANGE FilterCallback OPTIONAL);
+typedef struct _FILE_OLE_CLASSID_INFORMATION {
+    GUID ClassId;
+} FILE_OLE_CLASSID_INFORMATION, *PFILE_OLE_CLASSID_INFORMATION;
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-FsRtlInsertPerStreamContext(
-  IN PFSRTL_ADVANCED_FCB_HEADER PerStreamContext,
-  IN PFSRTL_PER_STREAM_CONTEXT Ptr);
+typedef struct _FILE_OLE_ALL_INFORMATION {
+    FILE_BASIC_INFORMATION          BasicInformation;
+    FILE_STANDARD_INFORMATION       StandardInformation;
+    FILE_INTERNAL_INFORMATION       InternalInformation;
+    FILE_EA_INFORMATION             EaInformation;
+    FILE_ACCESS_INFORMATION         AccessInformation;
+    FILE_POSITION_INFORMATION       PositionInformation;
+    FILE_MODE_INFORMATION           ModeInformation;
+    FILE_ALIGNMENT_INFORMATION      AlignmentInformation;
+    USN                             LastChangeUsn;
+    USN                             ReplicationUsn;
+    LARGE_INTEGER                   SecurityChangeTime;
+    FILE_OLE_CLASSID_INFORMATION    OleClassIdInformation;
+    FILE_OBJECTID_INFORMATION       ObjectIdInformation;
+    FILE_STORAGE_TYPE               StorageType;
+    ULONG                           OleStateBits;
+    ULONG                           OleId;
+    ULONG                           NumberOfStreamReferences;
+    ULONG                           StreamIndex;
+    ULONG                           SecurityId;
+    BOOLEAN                         ContentIndexDisable;
+    BOOLEAN                         InheritContentIndexDisable;
+    FILE_NAME_INFORMATION           NameInformation;
+} FILE_OLE_ALL_INFORMATION, *PFILE_OLE_ALL_INFORMATION;
 
-NTKERNELAPI
-PFSRTL_PER_STREAM_CONTEXT
-NTAPI
-FsRtlLookupPerStreamContextInternal(
-  IN PFSRTL_ADVANCED_FCB_HEADER StreamContext,
-  IN PVOID OwnerId OPTIONAL,
-  IN PVOID InstanceId OPTIONAL);
+typedef struct _FILE_OLE_DIR_INFORMATION {
+    ULONG               NextEntryOffset;
+    ULONG               FileIndex;
+    LARGE_INTEGER       CreationTime;
+    LARGE_INTEGER       LastAccessTime;
+    LARGE_INTEGER       LastWriteTime;
+    LARGE_INTEGER       ChangeTime;
+    LARGE_INTEGER       EndOfFile;
+    LARGE_INTEGER       AllocationSize;
+    ULONG               FileAttributes;
+    ULONG               FileNameLength;
+    FILE_STORAGE_TYPE   StorageType;
+    GUID                OleClassId;
+    ULONG               OleStateBits;
+    BOOLEAN             ContentIndexDisable;
+    BOOLEAN             InheritContentIndexDisable;
+    WCHAR               FileName[1];
+} FILE_OLE_DIR_INFORMATION, *PFILE_OLE_DIR_INFORMATION;
 
-NTKERNELAPI
-PFSRTL_PER_STREAM_CONTEXT
-NTAPI
-FsRtlRemovePerStreamContext(
-  IN PFSRTL_ADVANCED_FCB_HEADER StreamContext,
-  IN PVOID OwnerId OPTIONAL,
-  IN PVOID InstanceId OPTIONAL);
+typedef struct _FILE_OLE_INFORMATION {
+    LARGE_INTEGER                   SecurityChangeTime;
+    FILE_OLE_CLASSID_INFORMATION    OleClassIdInformation;
+    FILE_OBJECTID_INFORMATION       ObjectIdInformation;
+    FILE_STORAGE_TYPE               StorageType;
+    ULONG                           OleStateBits;
+    BOOLEAN                         ContentIndexDisable;
+    BOOLEAN                         InheritContentIndexDisable;
+} FILE_OLE_INFORMATION, *PFILE_OLE_INFORMATION;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlIncrementCcFastReadNotPossible(
-  VOID);
+typedef struct _FILE_OLE_STATE_BITS_INFORMATION {
+    ULONG StateBits;
+    ULONG StateBitsMask;
+} FILE_OLE_STATE_BITS_INFORMATION, *PFILE_OLE_STATE_BITS_INFORMATION;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlIncrementCcFastReadWait(
-  VOID);
+typedef enum _FSRTL_COMPARISON_RESULT
+{
+    LessThan = -1,
+    EqualTo = 0,
+    GreaterThan = 1
+} FSRTL_COMPARISON_RESULT;
+    
+#if (VER_PRODUCTBUILD >= 2600)
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlIncrementCcFastReadNoWait(
-  VOID);
+typedef struct _FSRTL_PER_STREAM_CONTEXT {
+    LIST_ENTRY     Links;
+    PVOID          OwnerId;
+    PVOID          InstanceId;
+    PFREE_FUNCTION FreeCallback;
+} FSRTL_PER_STREAM_CONTEXT, *PFSRTL_PER_STREAM_CONTEXT;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlIncrementCcFastReadResourceMiss(
-  VOID);
+typedef struct _FSRTL_PER_FILEOBJECT_CONTEXT
+{
+    LIST_ENTRY Links;
+    PVOID OwnerId;
+    PVOID InstanceId;
+} FSRTL_PER_FILEOBJECT_CONTEXT, *PFSRTL_PER_FILEOBJECT_CONTEXT;
 
-NTKERNELAPI
-LOGICAL
-NTAPI
-FsRtlIsPagingFile(
-  IN PFILE_OBJECT FileObject);
+#endif /* (VER_PRODUCTBUILD >= 2600) */
 
-#endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
+typedef struct _BASE_MCB
+{
+    ULONG MaximumPairCount;
+    ULONG PairCount;
+    USHORT PoolType;
+    USHORT Flags;
+    PVOID Mapping;
+} BASE_MCB, *PBASE_MCB;
 
-#if (NTDDI_VERSION >= NTDDI_WS03)
+typedef struct _LARGE_MCB
+{
+    PKGUARDED_MUTEX GuardedMutex;
+    BASE_MCB BaseMcb;
+} LARGE_MCB, *PLARGE_MCB;
 
-NTKERNELAPI
-    VOID
-NTAPI
-FsRtlInitializeBaseMcb(
-  IN PBASE_MCB Mcb,
-  IN POOL_TYPE PoolType);
+typedef struct _MCB
+{
+    LARGE_MCB DummyFieldThatSizesThisStructureCorrectly;
+} MCB, *PMCB;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlUninitializeBaseMcb(
-  IN PBASE_MCB Mcb);
+typedef struct _MAPPING_PAIR {
+    ULONGLONG Vcn;
+    ULONGLONG Lcn;
+} MAPPING_PAIR, *PMAPPING_PAIR;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlResetBaseMcb(
-  IN PBASE_MCB Mcb);
+typedef struct _GET_RETRIEVAL_DESCRIPTOR {
+    ULONG           NumberOfPairs;
+    ULONGLONG       StartVcn;
+    MAPPING_PAIR    Pair[1];
+} GET_RETRIEVAL_DESCRIPTOR, *PGET_RETRIEVAL_DESCRIPTOR;
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlTruncateBaseMcb(
-  IN PBASE_MCB Mcb,
-  IN LONGLONG Vbn);
+#define ASSERT_QUEUE(Q) ASSERT(((Q)->Header.Type & KOBJECT_TYPE_MASK) == QueueObject);
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlAddBaseMcbEntry(
-  IN PBASE_MCB Mcb,
-  IN LONGLONG Vbn,
-  IN LONGLONG Lbn,
-  IN LONGLONG SectorCount);
+typedef struct _MBCB {
+    CSHORT          NodeTypeCode;
+    CSHORT          NodeIsInZone;
+    ULONG           PagesToWrite;
+    ULONG           DirtyPages;
+    ULONG           Reserved;
+    LIST_ENTRY      BitmapRanges;
+    LONGLONG        ResumeWritePage;
+    BITMAP_RANGE    BitmapRange1;
+    BITMAP_RANGE    BitmapRange2;
+    BITMAP_RANGE    BitmapRange3;
+} MBCB, *PMBCB;
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlRemoveBaseMcbEntry(
-  IN PBASE_MCB Mcb,
-  IN LONGLONG Vbn,
-  IN LONGLONG SectorCount);
+typedef struct _MOVEFILE_DESCRIPTOR {
+     HANDLE         FileHandle;
+     ULONG          Reserved;
+     LARGE_INTEGER  StartVcn;
+     LARGE_INTEGER  TargetLcn;
+     ULONG          NumVcns;
+     ULONG          Reserved1;
+} MOVEFILE_DESCRIPTOR, *PMOVEFILE_DESCRIPTOR;
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlLookupBaseMcbEntry(
-  IN PBASE_MCB Mcb,
-  IN LONGLONG Vbn,
-  OUT PLONGLONG Lbn OPTIONAL,
-  OUT PLONGLONG SectorCountFromLbn OPTIONAL,
-  OUT PLONGLONG StartingLbn OPTIONAL,
-  OUT PLONGLONG SectorCountFromStartingLbn OPTIONAL,
-  OUT PULONG Index OPTIONAL);
+typedef struct _OBJECT_BASIC_INFO {
+    ULONG           Attributes;
+    ACCESS_MASK     GrantedAccess;
+    ULONG           HandleCount;
+    ULONG           ReferenceCount;
+    ULONG           PagedPoolUsage;
+    ULONG           NonPagedPoolUsage;
+    ULONG           Reserved[3];
+    ULONG           NameInformationLength;
+    ULONG           TypeInformationLength;
+    ULONG           SecurityDescriptorLength;
+    LARGE_INTEGER   CreateTime;
+} OBJECT_BASIC_INFO, *POBJECT_BASIC_INFO;
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlLookupLastBaseMcbEntry(
-  IN PBASE_MCB Mcb,
-  OUT PLONGLONG Vbn,
-  OUT PLONGLONG Lbn);
+typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFO {
+    BOOLEAN Inherit;
+    BOOLEAN ProtectFromClose;
+} OBJECT_HANDLE_ATTRIBUTE_INFO, *POBJECT_HANDLE_ATTRIBUTE_INFO;
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlLookupLastBaseMcbEntryAndIndex(
-  IN PBASE_MCB OpaqueMcb,
-  IN OUT PLONGLONG LargeVbn,
-  IN OUT PLONGLONG LargeLbn,
-  IN OUT PULONG Index);
+typedef struct _OBJECT_NAME_INFO {
+    UNICODE_STRING  ObjectName;
+    WCHAR           ObjectNameBuffer[1];
+} OBJECT_NAME_INFO, *POBJECT_NAME_INFO;
 
-NTKERNELAPI
-ULONG
-NTAPI
-FsRtlNumberOfRunsInBaseMcb(
-  IN PBASE_MCB Mcb);
+typedef struct _OBJECT_PROTECTION_INFO {
+    BOOLEAN Inherit;
+    BOOLEAN ProtectHandle;
+} OBJECT_PROTECTION_INFO, *POBJECT_PROTECTION_INFO;
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlGetNextBaseMcbEntry(
-  IN PBASE_MCB Mcb,
-  IN ULONG RunIndex,
-  OUT PLONGLONG Vbn,
-  OUT PLONGLONG Lbn,
-  OUT PLONGLONG SectorCount);
+typedef struct _OBJECT_TYPE_INFO {
+    UNICODE_STRING  ObjectTypeName;
+    UCHAR           Unknown[0x58];
+    WCHAR           ObjectTypeNameBuffer[1];
+} OBJECT_TYPE_INFO, *POBJECT_TYPE_INFO;
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlSplitBaseMcb(
-    IN PBASE_MCB  Mcb,
-    IN LONGLONG   Vbn,
-  IN LONGLONG Amount);
+typedef struct _OBJECT_ALL_TYPES_INFO {
+    ULONG               NumberOfObjectTypes;
+    OBJECT_TYPE_INFO    ObjectsTypeInfo[1];
+} OBJECT_ALL_TYPES_INFO, *POBJECT_ALL_TYPES_INFO;
 
-#endif /* (NTDDI_VERSION >= NTDDI_WS03) */
+typedef enum _RTL_GENERIC_COMPARE_RESULTS
+{
+    GenericLessThan,
+    GenericGreaterThan,
+    GenericEqual
+} RTL_GENERIC_COMPARE_RESULTS;
 
-#if (NTDDI_VERSION >= NTDDI_VISTA)
+typedef enum _TABLE_SEARCH_RESULT
+{
+    TableEmptyTree,
+    TableFoundNode,
+    TableInsertAsLeft,
+    TableInsertAsRight
+} TABLE_SEARCH_RESULT;
 
-BOOLEAN
-NTAPI
-FsRtlInitializeBaseMcbEx(
-  IN PBASE_MCB Mcb,
-  IN POOL_TYPE PoolType,
-  IN USHORT Flags);
+typedef NTSTATUS
+(NTAPI *PRTL_AVL_MATCH_FUNCTION)(
+    struct _RTL_AVL_TABLE *Table,
+    PVOID UserData,
+    PVOID MatchData
+);
 
-NTSTATUS
-NTAPI
-FsRtlAddBaseMcbEntryEx(
-  IN PBASE_MCB Mcb,
-    IN LONGLONG    Vbn,
-    IN LONGLONG    Lbn,
-  IN LONGLONG SectorCount);
+typedef RTL_GENERIC_COMPARE_RESULTS
+(NTAPI *PRTL_AVL_COMPARE_ROUTINE) (
+    struct _RTL_AVL_TABLE *Table,
+    PVOID FirstStruct,
+    PVOID SecondStruct
+);
 
-NTKERNELAPI
-BOOLEAN
-NTAPI
-FsRtlCurrentOplock(
-  IN POPLOCK Oplock);
+typedef RTL_GENERIC_COMPARE_RESULTS
+(NTAPI *PRTL_GENERIC_COMPARE_ROUTINE) (
+    struct _RTL_GENERIC_TABLE *Table,
+    PVOID FirstStruct,
+    PVOID SecondStruct
+);
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-FsRtlOplockBreakToNone(
-  IN OUT POPLOCK Oplock,
-  IN PIO_STACK_LOCATION IrpSp OPTIONAL,
-  IN PIRP Irp,
-  IN PVOID Context OPTIONAL,
-  IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
-  IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
+typedef PVOID
+(NTAPI *PRTL_GENERIC_ALLOCATE_ROUTINE) (
+    struct _RTL_GENERIC_TABLE *Table,
+    CLONG ByteSize
+);
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-FsRtlNotifyVolumeEventEx(
-  IN PFILE_OBJECT FileObject,
-  IN ULONG EventCode,
-  IN PTARGET_DEVICE_CUSTOM_NOTIFICATION Event);
+typedef VOID
+(NTAPI *PRTL_GENERIC_FREE_ROUTINE) (
+    struct _RTL_GENERIC_TABLE *Table,
+    PVOID Buffer
+);
 
-NTKERNELAPI
-VOID
-NTAPI
-FsRtlNotifyCleanupAll(
-  IN PNOTIFY_SYNC NotifySync,
-  IN PLIST_ENTRY NotifyList);
+typedef PVOID
+(NTAPI *PRTL_AVL_ALLOCATE_ROUTINE) (
+    struct _RTL_AVL_TABLE *Table,
+    CLONG ByteSize
+);
 
-NTSTATUS
-NTAPI
-FsRtlRegisterUncProviderEx(
-  OUT PHANDLE MupHandle,
-  IN PUNICODE_STRING RedirDevName,
-  IN PDEVICE_OBJECT DeviceObject,
-  IN ULONG Flags);
+typedef VOID
+(NTAPI *PRTL_AVL_FREE_ROUTINE) (
+    struct _RTL_AVL_TABLE *Table,
+    PVOID Buffer
+);
 
-NTKERNELAPI
-NTSTATUS
-NTAPI
-FsRtlCancellableWaitForSingleObject(
-  IN PVOID Object,
-  IN PLARGE_INTEGER Timeout OPTIONAL,
-  IN PIRP Irp OPTIONAL);
+typedef struct _PUBLIC_BCB {
+    CSHORT          NodeTypeCode;
+    CSHORT          NodeByteSize;
+    ULONG           MappedLength;
+    LARGE_INTEGER   MappedFileOffset;
+} PUBLIC_BCB, *PPUBLIC_BCB;
 
-NTKERNELAPI
-NTSTATUS
+typedef struct _QUERY_PATH_REQUEST {
+    ULONG                   PathNameLength;
+    PIO_SECURITY_CONTEXT    SecurityContext;
+    WCHAR                   FilePathName[1];
+} QUERY_PATH_REQUEST, *PQUERY_PATH_REQUEST;
+
+typedef struct _QUERY_PATH_RESPONSE {
+    ULONG LengthAccepted;
+} QUERY_PATH_RESPONSE, *PQUERY_PATH_RESPONSE;
+
+typedef struct _RTL_BALANCED_LINKS
+{
+    struct _RTL_BALANCED_LINKS *Parent;
+    struct _RTL_BALANCED_LINKS *LeftChild;
+    struct _RTL_BALANCED_LINKS *RightChild;
+    CHAR Balance;
+    UCHAR Reserved[3];
+} RTL_BALANCED_LINKS, *PRTL_BALANCED_LINKS;
+
+typedef struct _RTL_GENERIC_TABLE
+{
+    PRTL_SPLAY_LINKS TableRoot;
+    LIST_ENTRY InsertOrderList;
+    PLIST_ENTRY OrderedPointer;
+    ULONG WhichOrderedElement;
+    ULONG NumberGenericTableElements;
+    PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine;
+    PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine;
+    PRTL_GENERIC_FREE_ROUTINE FreeRoutine;
+    PVOID TableContext;
+} RTL_GENERIC_TABLE, *PRTL_GENERIC_TABLE;
+
+#undef PRTL_GENERIC_COMPARE_ROUTINE
+#undef PRTL_GENERIC_ALLOCATE_ROUTINE
+#undef PRTL_GENERIC_FREE_ROUTINE
+#undef RTL_GENERIC_TABLE
+#undef PRTL_GENERIC_TABLE
+
+#define PRTL_GENERIC_COMPARE_ROUTINE PRTL_AVL_COMPARE_ROUTINE
+#define PRTL_GENERIC_ALLOCATE_ROUTINE PRTL_AVL_ALLOCATE_ROUTINE
+#define PRTL_GENERIC_FREE_ROUTINE PRTL_AVL_FREE_ROUTINE
+#define RTL_GENERIC_TABLE RTL_AVL_TABLE
+#define PRTL_GENERIC_TABLE PRTL_AVL_TABLE
+
+#define RtlInitializeGenericTable               RtlInitializeGenericTableAvl
+#define RtlInsertElementGenericTable            RtlInsertElementGenericTableAvl
+#define RtlInsertElementGenericTableFull        RtlInsertElementGenericTableFullAvl
+#define RtlDeleteElementGenericTable            RtlDeleteElementGenericTableAvl
+#define RtlLookupElementGenericTable            RtlLookupElementGenericTableAvl
+#define RtlLookupElementGenericTableFull        RtlLookupElementGenericTableFullAvl
+#define RtlEnumerateGenericTable                RtlEnumerateGenericTableAvl
+#define RtlEnumerateGenericTableWithoutSplaying RtlEnumerateGenericTableWithoutSplayingAvl
+#define RtlGetElementGenericTable               RtlGetElementGenericTableAvl
+#define RtlNumberGenericTableElements           RtlNumberGenericTableElementsAvl
+#define RtlIsGenericTableEmpty                  RtlIsGenericTableEmptyAvl
+
+typedef struct _RTL_AVL_TABLE
+{
+    RTL_BALANCED_LINKS BalancedRoot;
+    PVOID OrderedPointer;
+    ULONG WhichOrderedElement;
+    ULONG NumberGenericTableElements;
+    ULONG DepthOfTree;
+    PRTL_BALANCED_LINKS RestartKey;
+    ULONG DeleteCount;
+    PRTL_AVL_COMPARE_ROUTINE CompareRoutine;
+    PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine;
+    PRTL_AVL_FREE_ROUTINE FreeRoutine;
+    PVOID TableContext;
+} RTL_AVL_TABLE, *PRTL_AVL_TABLE;
+
+NTSYSAPI
+VOID
+NTAPI
+RtlInitializeGenericTableAvl(
+    PRTL_AVL_TABLE Table,
+    PRTL_AVL_COMPARE_ROUTINE CompareRoutine,
+    PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine,
+    PRTL_AVL_FREE_ROUTINE FreeRoutine,
+    PVOID TableContext
+);
+
+NTSYSAPI
+PVOID
 NTAPI
-FsRtlCancellableWaitForMultipleObjects(
-  IN ULONG Count,
-  IN PVOID ObjectArray[],
-  IN WAIT_TYPE WaitType,
-  IN PLARGE_INTEGER Timeout OPTIONAL,
-  IN PKWAIT_BLOCK WaitBlockArray OPTIONAL,
-  IN PIRP Irp OPTIONAL);
+RtlInsertElementGenericTableAvl (
+    PRTL_AVL_TABLE Table,
+    PVOID Buffer,
+    CLONG BufferSize,
+    PBOOLEAN NewElement OPTIONAL
+    );
+    
+NTSYSAPI
+BOOLEAN
+NTAPI
+RtlDeleteElementGenericTableAvl (
+    PRTL_AVL_TABLE Table,
+    PVOID Buffer
+    );
+    
+NTSYSAPI
+PVOID
+NTAPI
+RtlLookupElementGenericTableAvl (
+    PRTL_AVL_TABLE Table,
+    PVOID Buffer
+    );
+    
+NTSYSAPI
+PVOID
+NTAPI
+RtlEnumerateGenericTableWithoutSplayingAvl (
+    PRTL_AVL_TABLE Table,
+    PVOID *RestartKey
+    );
+
+#if defined(USE_LPC6432)
+#define LPC_CLIENT_ID CLIENT_ID64
+#define LPC_SIZE_T ULONGLONG
+#define LPC_PVOID ULONGLONG
+#define LPC_HANDLE ULONGLONG
+#else
+#define LPC_CLIENT_ID CLIENT_ID
+#define LPC_SIZE_T SIZE_T
+#define LPC_PVOID PVOID
+#define LPC_HANDLE HANDLE
+#endif
+
+typedef struct _PORT_MESSAGE
+{
+    union
+    {
+        struct
+        {
+            CSHORT DataLength;
+            CSHORT TotalLength;
+        } s1;
+        ULONG Length;
+    } u1;
+    union
+    {
+        struct
+        {
+            CSHORT Type;
+            CSHORT DataInfoOffset;
+        } s2;
+        ULONG ZeroInit;
+    } u2;
+    __GNU_EXTENSION union
+    {
+        LPC_CLIENT_ID ClientId;
+        double DoNotUseThisField;
+    };
+    ULONG MessageId;
+    __GNU_EXTENSION union
+    {
+        LPC_SIZE_T ClientViewSize;
+        ULONG CallbackId;
+    };
+} PORT_MESSAGE, *PPORT_MESSAGE;
+
+#define LPC_KERNELMODE_MESSAGE      (CSHORT)((USHORT)0x8000)
+
+typedef struct _PORT_VIEW
+{
+    ULONG Length;
+    LPC_HANDLE SectionHandle;
+    ULONG SectionOffset;
+    LPC_SIZE_T ViewSize;
+    LPC_PVOID ViewBase;
+    LPC_PVOID ViewRemoteBase;
+} PORT_VIEW, *PPORT_VIEW;
+
+typedef struct _REMOTE_PORT_VIEW
+{
+    ULONG Length;
+    LPC_SIZE_T ViewSize;
+    LPC_PVOID ViewBase;
+} REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW;
+
+typedef struct _TUNNEL {
+    FAST_MUTEX          Mutex;
+    PRTL_SPLAY_LINKS    Cache;
+    LIST_ENTRY          TimerQueue;
+    USHORT              NumEntries;
+} TUNNEL, *PTUNNEL;
+
+typedef struct _VAD_HEADER {
+    PVOID       StartVPN;
+    PVOID       EndVPN;
+    struct _VAD_HEADER* ParentLink;
+    struct _VAD_HEADER* LeftLink;
+    struct _VAD_HEADER* RightLink;
+    ULONG       Flags;          /* LSB = CommitCharge */
+    PVOID       ControlArea;
+    PVOID       FirstProtoPte;
+    PVOID       LastPTE;
+    ULONG       Unknown;
+    LIST_ENTRY  Secured;
+} VAD_HEADER, *PVAD_HEADER;
+
+#if (VER_PRODUCTBUILD >= 2600)
+
+typedef BOOLEAN
+(NTAPI *PFILTER_REPORT_CHANGE) (
+    IN PVOID  NotifyContext,
+    IN PVOID  FilterContext
+);
+
+#endif
 
 NTKERNELAPI
-NTSTATUS
+BOOLEAN
 NTAPI
-FsRtlMupGetProviderInfoFromFileObject(
-  IN PFILE_OBJECT pFileObject,
-  IN ULONG Level,
-  OUT PVOID pBuffer,
-  IN OUT PULONG pBufferSize);
+CcCanIWrite (
+    IN PFILE_OBJECT FileObject,
+    IN ULONG        BytesToWrite,
+    IN BOOLEAN      Wait,
+    IN BOOLEAN      Retrying
+);
 
 NTKERNELAPI
-NTSTATUS
+BOOLEAN
 NTAPI
-FsRtlMupGetProviderIdFromName(
-  IN PUNICODE_STRING pProviderName,
-  OUT PULONG32 pProviderId);
+CcCopyRead (
+    IN PFILE_OBJECT         FileObject,
+    IN PLARGE_INTEGER       FileOffset,
+    IN ULONG                Length,
+    IN BOOLEAN              Wait,
+    OUT PVOID               Buffer,
+    OUT PIO_STATUS_BLOCK    IoStatus
+);
 
 NTKERNELAPI
-VOID
+BOOLEAN
 NTAPI
-FsRtlIncrementCcFastMdlReadWait(
-  VOID);
+CcCopyWrite (
+    IN PFILE_OBJECT     FileObject,
+    IN PLARGE_INTEGER   FileOffset,
+    IN ULONG            Length,
+    IN BOOLEAN          Wait,
+    IN PVOID            Buffer
+);
+
+#define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
+
+typedef VOID (NTAPI *PCC_POST_DEFERRED_WRITE) (
+    IN PVOID Context1,
+    IN PVOID Context2
+);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-FsRtlValidateReparsePointBuffer(
-  IN ULONG BufferLength,
-  IN PREPARSE_DATA_BUFFER ReparseBuffer);
+CcDeferWrite (
+    IN PFILE_OBJECT             FileObject,
+    IN PCC_POST_DEFERRED_WRITE  PostRoutine,
+    IN PVOID                    Context1,
+    IN PVOID                    Context2,
+    IN ULONG                    BytesToWrite,
+    IN BOOLEAN                  Retrying
+);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-FsRtlRemoveDotsFromPath(
-  IN OUT PWSTR OriginalString,
-  IN USHORT PathLength,
-  OUT USHORT *NewLength);
+CcFastCopyRead (
+    IN PFILE_OBJECT         FileObject,
+    IN ULONG                FileOffset,
+    IN ULONG                Length,
+    IN ULONG                PageCount,
+    OUT PVOID               Buffer,
+    OUT PIO_STATUS_BLOCK    IoStatus
+);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-FsRtlAllocateExtraCreateParameterList(
-  IN FSRTL_ALLOCATE_ECPLIST_FLAGS Flags,
-  OUT PECP_LIST *EcpList);
+CcFastCopyWrite (
+    IN PFILE_OBJECT FileObject,
+    IN ULONG        FileOffset,
+    IN ULONG        Length,
+    IN PVOID        Buffer
+);
 
 NTKERNELAPI
 VOID
 NTAPI
-FsRtlFreeExtraCreateParameterList(
-  IN PECP_LIST EcpList);
+CcFlushCache (
+    IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+    IN PLARGE_INTEGER           FileOffset OPTIONAL,
+    IN ULONG                    Length,
+    OUT PIO_STATUS_BLOCK        IoStatus OPTIONAL
+);
+
+typedef VOID (NTAPI *PDIRTY_PAGE_ROUTINE) (
+    IN PFILE_OBJECT     FileObject,
+    IN PLARGE_INTEGER   FileOffset,
+    IN ULONG            Length,
+    IN PLARGE_INTEGER   OldestLsn,
+    IN PLARGE_INTEGER   NewestLsn,
+    IN PVOID            Context1,
+    IN PVOID            Context2
+);
 
 NTKERNELAPI
-NTSTATUS
+LARGE_INTEGER
 NTAPI
-FsRtlAllocateExtraCreateParameter(
-  IN LPCGUID EcpType,
-  IN ULONG SizeOfContext,
-  IN FSRTL_ALLOCATE_ECP_FLAGS Flags,
-  IN PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback OPTIONAL,
-  IN ULONG PoolTag,
-  OUT PVOID *EcpContext);
+CcGetDirtyPages (
+    IN PVOID                LogHandle,
+    IN PDIRTY_PAGE_ROUTINE  DirtyPageRoutine,
+    IN PVOID                Context1,
+    IN PVOID                Context2
+);
 
 NTKERNELAPI
-VOID
+PFILE_OBJECT
 NTAPI
-FsRtlFreeExtraCreateParameter(
-  IN PVOID EcpContext);
+CcGetFileObjectFromBcb (
+    IN PVOID Bcb
+);
 
 NTKERNELAPI
-VOID
+PFILE_OBJECT
 NTAPI
-FsRtlInitExtraCreateParameterLookasideList(
-  IN OUT PVOID Lookaside,
-  IN FSRTL_ECP_LOOKASIDE_FLAGS Flags,
-  IN SIZE_T Size,
-  IN ULONG Tag);
+CcGetFileObjectFromSectionPtrs (
+    IN PSECTION_OBJECT_POINTERS SectionObjectPointer
+);
 
-VOID
-NTAPI
-FsRtlDeleteExtraCreateParameterLookasideList(
-  IN OUT PVOID Lookaside,
-  IN FSRTL_ECP_LOOKASIDE_FLAGS Flags);
+#define CcGetFileSizePointer(FO) (                                     \
+    ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
+)
+
+#if (VER_PRODUCTBUILD >= 2195)
 
 NTKERNELAPI
-NTSTATUS
+LARGE_INTEGER
 NTAPI
-FsRtlAllocateExtraCreateParameterFromLookasideList(
-  IN LPCGUID EcpType,
-  IN ULONG SizeOfContext,
-  IN FSRTL_ALLOCATE_ECP_FLAGS Flags,
-  IN PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback OPTIONAL,
-  IN OUT PVOID LookasideList,
-  OUT PVOID *EcpContext);
+CcGetFlushedValidData (
+    IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+    IN BOOLEAN                  BcbListHeld
+);
+
+#endif /* (VER_PRODUCTBUILD >= 2195) */
 
 NTKERNELAPI
-NTSTATUS
+LARGE_INTEGER
 NTAPI
-FsRtlInsertExtraCreateParameter(
-  IN OUT PECP_LIST EcpList,
-  IN OUT PVOID EcpContext);
+CcGetLsnForFileObject (
+    IN PFILE_OBJECT     FileObject,
+    OUT PLARGE_INTEGER  OldestLsn OPTIONAL
+);
+
+typedef BOOLEAN (NTAPI *PACQUIRE_FOR_LAZY_WRITE) (
+    IN PVOID    Context,
+    IN BOOLEAN  Wait
+);
+
+typedef VOID (NTAPI *PRELEASE_FROM_LAZY_WRITE) (
+    IN PVOID Context
+);
+
+typedef BOOLEAN (NTAPI *PACQUIRE_FOR_READ_AHEAD) (
+    IN PVOID    Context,
+    IN BOOLEAN  Wait
+);
+
+typedef VOID (NTAPI *PRELEASE_FROM_READ_AHEAD) (
+    IN PVOID Context
+);
+
+typedef struct _CACHE_MANAGER_CALLBACKS {
+    PACQUIRE_FOR_LAZY_WRITE     AcquireForLazyWrite;
+    PRELEASE_FROM_LAZY_WRITE    ReleaseFromLazyWrite;
+    PACQUIRE_FOR_READ_AHEAD     AcquireForReadAhead;
+    PRELEASE_FROM_READ_AHEAD    ReleaseFromReadAhead;
+} CACHE_MANAGER_CALLBACKS, *PCACHE_MANAGER_CALLBACKS;
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-FsRtlFindExtraCreateParameter(
-  IN PECP_LIST EcpList,
-  IN LPCGUID EcpType,
-  OUT PVOID *EcpContext OPTIONAL,
-  OUT ULONG *EcpContextSize OPTIONAL);
+CcInitializeCacheMap (
+    IN PFILE_OBJECT             FileObject,
+    IN PCC_FILE_SIZES           FileSizes,
+    IN BOOLEAN                  PinAccess,
+    IN PCACHE_MANAGER_CALLBACKS Callbacks,
+    IN PVOID                    LazyWriteContext
+);
+
+#define CcIsFileCached(FO) (                                                         \
+    ((FO)->SectionObjectPointer != NULL) &&                                          \
+    (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
+)
+
+extern ULONG CcFastMdlReadWait;
 
 NTKERNELAPI
-NTSTATUS
+BOOLEAN
 NTAPI
-FsRtlRemoveExtraCreateParameter(
-  IN OUT PECP_LIST EcpList,
-  IN LPCGUID EcpType,
-  OUT PVOID *EcpContext,
-  OUT ULONG *EcpContextSize OPTIONAL);
+CcIsThereDirtyData (
+    IN PVPB Vpb
+);
 
 NTKERNELAPI
-NTSTATUS
+BOOLEAN
 NTAPI
-FsRtlGetEcpListFromIrp(
-  IN PIRP Irp,
-  OUT PECP_LIST *EcpList OPTIONAL);
+CcMapData (
+    IN PFILE_OBJECT     FileObject,
+    IN PLARGE_INTEGER   FileOffset,
+    IN ULONG            Length,
+    IN ULONG            Flags,
+    OUT PVOID           *Bcb,
+    OUT PVOID           *Buffer
+);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-FsRtlSetEcpListIntoIrp(
-  IN OUT PIRP Irp,
-  IN PECP_LIST EcpList);
+CcMdlRead (
+    IN PFILE_OBJECT         FileObject,
+    IN PLARGE_INTEGER       FileOffset,
+    IN ULONG                Length,
+    OUT PMDL                *MdlChain,
+    OUT PIO_STATUS_BLOCK    IoStatus
+);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-FsRtlGetNextExtraCreateParameter(
-  IN PECP_LIST EcpList,
-  IN PVOID CurrentEcpContext OPTIONAL,
-  OUT LPGUID NextEcpType OPTIONAL,
-  OUT PVOID *NextEcpContext OPTIONAL,
-  OUT ULONG *NextEcpContextSize OPTIONAL);
+CcMdlReadComplete (
+    IN PFILE_OBJECT FileObject,
+    IN PMDL         MdlChain
+);
 
 NTKERNELAPI
 VOID
 NTAPI
-FsRtlAcknowledgeEcp(
-  IN PVOID EcpContext);
+CcMdlWriteComplete (
+    IN PFILE_OBJECT     FileObject,
+    IN PLARGE_INTEGER   FileOffset,
+    IN PMDL             MdlChain
+);
+
+#define MAP_WAIT        1
 
 NTKERNELAPI
 BOOLEAN
 NTAPI
-FsRtlIsEcpAcknowledged(
-  IN PVOID EcpContext);
+CcPinMappedData (
+    IN PFILE_OBJECT     FileObject,
+    IN PLARGE_INTEGER   FileOffset,
+    IN ULONG            Length,
+    IN ULONG            Flags,
+    IN OUT PVOID        *Bcb
+);
 
 NTKERNELAPI
 BOOLEAN
 NTAPI
-FsRtlIsEcpFromUserMode(
-  IN PVOID EcpContext);
+CcPinRead (
+    IN PFILE_OBJECT     FileObject,
+    IN PLARGE_INTEGER   FileOffset,
+    IN ULONG            Length,
+    IN ULONG            Flags,
+    OUT PVOID           *Bcb,
+    OUT PVOID           *Buffer
+);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-FsRtlChangeBackingFileObject(
-  IN PFILE_OBJECT CurrentFileObject OPTIONAL,
-  IN PFILE_OBJECT NewFileObject,
-  IN FSRTL_CHANGE_BACKING_TYPE ChangeBackingType,
-  IN ULONG Flags);
+CcPrepareMdlWrite (
+    IN PFILE_OBJECT         FileObject,
+    IN PLARGE_INTEGER       FileOffset,
+    IN ULONG                Length,
+    OUT PMDL                *MdlChain,
+    OUT PIO_STATUS_BLOCK    IoStatus
+);
 
 NTKERNELAPI
-NTSTATUS
+BOOLEAN
 NTAPI
-FsRtlLogCcFlushError(
-  IN PUNICODE_STRING FileName,
-  IN PDEVICE_OBJECT DeviceObject,
-  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
-  IN NTSTATUS FlushError,
-  IN ULONG Flags);
+CcPreparePinWrite (
+    IN PFILE_OBJECT     FileObject,
+    IN PLARGE_INTEGER   FileOffset,
+    IN ULONG            Length,
+    IN BOOLEAN          Zero,
+    IN ULONG            Flags,
+    OUT PVOID           *Bcb,
+    OUT PVOID           *Buffer
+);
 
 NTKERNELAPI
 BOOLEAN
 NTAPI
-FsRtlAreVolumeStartupApplicationsComplete(
-  VOID);
+CcPurgeCacheSection (
+    IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
+    IN PLARGE_INTEGER           FileOffset OPTIONAL,
+    IN ULONG                    Length,
+    IN BOOLEAN                  UninitializeCacheMaps
+);
+
+#define CcReadAhead(FO, FOFF, LEN) (                \
+    if ((LEN) >= 256) {                             \
+        CcScheduleReadAhead((FO), (FOFF), (LEN));   \
+    }                                               \
+)
+
+#if (VER_PRODUCTBUILD >= 2195)
 
 NTKERNELAPI
-ULONG
+PVOID
 NTAPI
-FsRtlQueryMaximumVirtualDiskNestingLevel(
-  VOID);
+CcRemapBcb (
+    IN PVOID Bcb
+);
+
+#endif /* (VER_PRODUCTBUILD >= 2195) */
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-FsRtlGetVirtualDiskNestingLevel(
-  IN PDEVICE_OBJECT DeviceObject,
-  OUT PULONG NestingLevel,
-  OUT PULONG NestingFlags OPTIONAL);
-
-#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
+CcRepinBcb (
+    IN PVOID Bcb
+);
 
-#if (NTDDI_VERSION >= NTDDI_VISTASP1)
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-FsRtlCheckOplockEx(
-  IN POPLOCK Oplock,
-  IN PIRP Irp,
-  IN ULONG Flags,
-  IN PVOID Context OPTIONAL,
-  IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
-  IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
-
-#endif
+CcScheduleReadAhead (
+    IN PFILE_OBJECT     FileObject,
+    IN PLARGE_INTEGER   FileOffset,
+    IN ULONG            Length
+);
 
-#if (NTDDI_VERSION >= NTDDI_WIN7)
+NTKERNELAPI
+VOID
+NTAPI
+CcSetAdditionalCacheAttributes (
+    IN PFILE_OBJECT FileObject,
+    IN BOOLEAN      DisableReadAhead,
+    IN BOOLEAN      DisableWriteBehind
+);
 
 NTKERNELAPI
-BOOLEAN
+VOID
 NTAPI
-FsRtlAreThereCurrentOrInProgressFileLocks(
-  IN PFILE_LOCK FileLock);
+CcSetBcbOwnerPointer (
+    IN PVOID Bcb,
+    IN PVOID OwnerPointer
+);
 
 NTKERNELAPI
-BOOLEAN
+VOID
 NTAPI
-FsRtlOplockIsSharedRequest(
-  IN PIRP Irp);
+CcSetDirtyPageThreshold (
+    IN PFILE_OBJECT FileObject,
+    IN ULONG        DirtyPageThreshold
+);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-FsRtlOplockBreakH(
-  IN POPLOCK Oplock,
-  IN PIRP Irp,
-  IN ULONG Flags,
-  IN PVOID Context OPTIONAL,
-  IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
-  IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
+CcSetDirtyPinnedData (
+    IN PVOID            BcbVoid,
+    IN PLARGE_INTEGER   Lsn OPTIONAL
+);
 
 NTKERNELAPI
-BOOLEAN
+VOID
 NTAPI
-FsRtlCurrentOplockH(
-  IN POPLOCK Oplock);
+CcSetFileSizes (
+    IN PFILE_OBJECT     FileObject,
+    IN PCC_FILE_SIZES   FileSizes
+);
+
+typedef VOID (NTAPI *PFLUSH_TO_LSN) (
+    IN PVOID            LogHandle,
+    IN LARGE_INTEGER    Lsn
+);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-FsRtlOplockBreakToNoneEx(
-  IN OUT POPLOCK Oplock,
-  IN PIRP Irp,
-  IN ULONG Flags,
-  IN PVOID Context OPTIONAL,
-  IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
-  IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
+CcSetLogHandleForFile (
+    IN PFILE_OBJECT     FileObject,
+    IN PVOID            LogHandle,
+    IN PFLUSH_TO_LSN    FlushToLsnRoutine
+);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-FsRtlOplockFsctrlEx(
-  IN POPLOCK Oplock,
-  IN PIRP Irp,
-  IN ULONG OpenCount,
-  IN ULONG Flags);
+CcSetReadAheadGranularity (
+    IN PFILE_OBJECT FileObject,
+    IN ULONG        Granularity     /* default: PAGE_SIZE */
+                                    /* allowed: 2^n * PAGE_SIZE */
+);
 
 NTKERNELAPI
 BOOLEAN
 NTAPI
-FsRtlOplockKeysEqual(
-  IN PFILE_OBJECT Fo1 OPTIONAL,
-  IN PFILE_OBJECT Fo2 OPTIONAL);
+CcUninitializeCacheMap (
+    IN PFILE_OBJECT                 FileObject,
+    IN PLARGE_INTEGER               TruncateSize OPTIONAL,
+    IN PCACHE_UNINITIALIZE_EVENT    UninitializeCompleteEvent OPTIONAL
+);
 
 NTKERNELAPI
-NTSTATUS
+VOID
 NTAPI
-FsRtlInitializeExtraCreateParameterList(
-  IN OUT PECP_LIST EcpList);
+CcUnpinData (
+    IN PVOID Bcb
+);
 
 NTKERNELAPI
 VOID
 NTAPI
-FsRtlInitializeExtraCreateParameter(
-  IN PECP_HEADER Ecp,
-  IN ULONG EcpFlags,
-  IN PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback OPTIONAL,
-  IN ULONG TotalSize,
-  IN LPCGUID EcpType,
-  IN PVOID ListAllocatedFrom OPTIONAL);
+CcUnpinDataForThread (
+    IN PVOID            Bcb,
+    IN ERESOURCE_THREAD ResourceThreadId
+);
 
-#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
+NTKERNELAPI
+VOID
+NTAPI
+CcUnpinRepinnedBcb (
+    IN PVOID                Bcb,
+    IN BOOLEAN              WriteThrough,
+    OUT PIO_STATUS_BLOCK    IoStatus
+);
+
+#if (VER_PRODUCTBUILD >= 2195)
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-FsRtlInsertPerFileContext(
-  IN PVOID* PerFileContextPointer,
-  IN PFSRTL_PER_FILE_CONTEXT Ptr);
+CcWaitForCurrentLazyWriterActivity (
+    VOID
+);
+
+#endif /* (VER_PRODUCTBUILD >= 2195) */
 
 NTKERNELAPI
-PFSRTL_PER_FILE_CONTEXT
+BOOLEAN
 NTAPI
-FsRtlLookupPerFileContext(
-  IN PVOID* PerFileContextPointer,
-  IN PVOID OwnerId OPTIONAL,
-  IN PVOID InstanceId OPTIONAL);
+CcZeroData (
+    IN PFILE_OBJECT     FileObject,
+    IN PLARGE_INTEGER   StartOffset,
+    IN PLARGE_INTEGER   EndOffset,
+    IN BOOLEAN          Wait
+);
 
+#if (VER_PRODUCTBUILD >= 2600)
+
+#ifndef __NTOSKRNL__
 NTKERNELAPI
-PFSRTL_PER_FILE_CONTEXT
-NTAPI
-FsRtlRemovePerFileContext(
-  IN PVOID* PerFileContextPointer,
-  IN PVOID OwnerId OPTIONAL,
-  IN PVOID InstanceId OPTIONAL);
+VOID
+FASTCALL
+ExInitializeRundownProtection (
+    IN PEX_RUNDOWN_REF  RunRef
+);
 
 NTKERNELAPI
 VOID
-NTAPI
-FsRtlTeardownPerFileContexts(
-  IN PVOID* PerFileContextPointer);
+FASTCALL
+ExReInitializeRundownProtection (
+    IN PEX_RUNDOWN_REF  RunRef
+);
 
 NTKERNELAPI
-NTSTATUS
-NTAPI
-FsRtlInsertPerFileObjectContext(
-  IN PFILE_OBJECT FileObject,
-  IN PFSRTL_PER_FILEOBJECT_CONTEXT Ptr);
+BOOLEAN
+FASTCALL
+ExAcquireRundownProtection (
+    IN PEX_RUNDOWN_REF  RunRef
+);
 
 NTKERNELAPI
-PFSRTL_PER_FILEOBJECT_CONTEXT
-NTAPI
-FsRtlLookupPerFileObjectContext(
-  IN PFILE_OBJECT FileObject,
-  IN PVOID OwnerId OPTIONAL,
-  IN PVOID InstanceId OPTIONAL);
+BOOLEAN
+FASTCALL
+ExAcquireRundownProtectionEx (
+    IN PEX_RUNDOWN_REF  RunRef,
+    IN ULONG            Count
+);
 
 NTKERNELAPI
-PFSRTL_PER_FILEOBJECT_CONTEXT
-NTAPI
-FsRtlRemovePerFileObjectContext(
-  IN PFILE_OBJECT FileObject,
-  IN PVOID OwnerId OPTIONAL,
-  IN PVOID InstanceId OPTIONAL);
+VOID
+FASTCALL
+ExReleaseRundownProtection (
+    IN PEX_RUNDOWN_REF  RunRef
+);
 
-#define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) (       \
-     FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11)   \
-)
+NTKERNELAPI
+VOID
+FASTCALL
+ExReleaseRundownProtectionEx (
+    IN PEX_RUNDOWN_REF  RunRef,
+    IN ULONG            Count
+);
 
-#define FsRtlAreThereCurrentFileLocks(FL) ( \
-    ((FL)->FastIoIsQuestionable)            \
-)
+NTKERNELAPI
+VOID
+FASTCALL
+ExRundownCompleted (
+    IN PEX_RUNDOWN_REF  RunRef
+);
 
-#define FsRtlIncrementLockRequestsInProgress(FL) {                           \
-    ASSERT( (FL)->LockRequestsInProgress >= 0 );                             \
-    (void)                                                                   \
-    (InterlockedIncrement((LONG volatile *)&((FL)->LockRequestsInProgress)));\
-}
+NTKERNELAPI
+VOID
+FASTCALL
+ExWaitForRundownProtectionRelease (
+    IN PEX_RUNDOWN_REF  RunRef
+);
 
-#define FsRtlDecrementLockRequestsInProgress(FL) {                           \
-    ASSERT( (FL)->LockRequestsInProgress > 0 );                              \
-    (void)                                                                   \
-    (InterlockedDecrement((LONG volatile *)&((FL)->LockRequestsInProgress)));\
+#endif
+#endif /* (VER_PRODUCTBUILD >= 2600) */
+
+
+#define FsRtlSetupAdvancedHeader( _advhdr, _fmutx )                         \
+{                                                                           \
+    SetFlag( (_advhdr)->Flags, FSRTL_FLAG_ADVANCED_HEADER );                \
+    SetFlag( (_advhdr)->Flags2, FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS );     \
+    (_advhdr)->Version = FSRTL_FCB_HEADER_V1;                               \
+    InitializeListHead( &(_advhdr)->FilterContexts );                       \
+    if ((_fmutx) != NULL) {                                                 \
+        (_advhdr)->FastMutex = (_fmutx);                                    \
+    }                                                                       \
+    *((PULONG_PTR)(&(_advhdr)->PushLock)) = 0;                              \
+    /*ExInitializePushLock( &(_advhdr)->PushLock ); API Not avaliable downlevel*/\
+    (_advhdr)->FileContextSupportPointer = NULL;                            \
 }
 
-extern NTKERNELAPI PUSHORT NlsOemLeadByteInfo;
-#define NLS_OEM_LEAD_BYTE_INFO            NlsOemLeadByteInfo
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlAddBaseMcbEntry (
+    IN PBASE_MCB  Mcb,
+    IN LONGLONG   Vbn,
+    IN LONGLONG   Lbn,
+    IN LONGLONG   SectorCount
+);
 
-#ifdef NLS_MB_CODE_PAGE_TAG
-#undef NLS_MB_CODE_PAGE_TAG
-#endif
-#define NLS_MB_CODE_PAGE_TAG              NlsMbOemCodePageTag
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlAddLargeMcbEntry (
+    IN PLARGE_MCB  Mcb,
+    IN LONGLONG    Vbn,
+    IN LONGLONG    Lbn,
+    IN LONGLONG    SectorCount
+);
 
-/* GCC compatible definition, MS one is retarded */
-extern NTKERNELAPI const UCHAR * const FsRtlLegalAnsiCharacterArray;
-#define LEGAL_ANSI_CHARACTER_ARRAY        FsRtlLegalAnsiCharacterArray
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlAddMcbEntry (
+    IN PMCB   Mcb,
+    IN VBN    Vbn,
+    IN LBN    Lbn,
+    IN ULONG  SectorCount
+);
 
-#define FsRtlIsAnsiCharacterWild(C) (                                       \
-    FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], FSRTL_WILD_CHARACTER ) \
-)
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlAddToTunnelCache (
+    IN PTUNNEL          Cache,
+    IN ULONGLONG        DirectoryKey,
+    IN PUNICODE_STRING  ShortName,
+    IN PUNICODE_STRING  LongName,
+    IN BOOLEAN          KeyByShortName,
+    IN ULONG            DataLength,
+    IN PVOID            Data
+);
 
-#define FsRtlIsAnsiCharacterLegalFat(C, WILD) (                                \
-    FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_FAT_LEGAL) |       \
-                                        ((WILD) ? FSRTL_WILD_CHARACTER : 0 ))  \
-)
+NTKERNELAPI
+PVOID
+NTAPI
+FsRtlAllocatePool (
+    IN POOL_TYPE    PoolType,
+    IN ULONG        NumberOfBytes
+);
 
-#define FsRtlIsAnsiCharacterLegalHpfs(C, WILD) (                               \
-    FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_HPFS_LEGAL) |      \
-                                        ((WILD) ? FSRTL_WILD_CHARACTER : 0 ))  \
-)
+NTKERNELAPI
+PVOID
+NTAPI
+FsRtlAllocatePoolWithQuota (
+    IN POOL_TYPE    PoolType,
+    IN ULONG        NumberOfBytes
+);
 
-#define FsRtlIsAnsiCharacterLegalNtfs(C, WILD) (                               \
-    FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_NTFS_LEGAL) |      \
-                                        ((WILD) ? FSRTL_WILD_CHARACTER : 0 ))  \
-)
+NTKERNELAPI
+PVOID
+NTAPI
+FsRtlAllocatePoolWithQuotaTag (
+    IN POOL_TYPE    PoolType,
+    IN ULONG        NumberOfBytes,
+    IN ULONG        Tag
+);
 
-#define FsRtlIsAnsiCharacterLegalNtfsStream(C,WILD_OK) (                    \
-    FsRtlTestAnsiCharacter((C), TRUE, (WILD_OK), FSRTL_NTFS_STREAM_LEGAL)   \
-)
+NTKERNELAPI
+PVOID
+NTAPI
+FsRtlAllocatePoolWithTag (
+    IN POOL_TYPE    PoolType,
+    IN ULONG        NumberOfBytes,
+    IN ULONG        Tag
+);
 
-#define FsRtlIsAnsiCharacterLegal(C,FLAGS) (          \
-    FsRtlTestAnsiCharacter((C), TRUE, FALSE, (FLAGS)) \
-)
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlAreNamesEqual (
+    IN PCUNICODE_STRING  Name1,
+    IN PCUNICODE_STRING  Name2,
+    IN BOOLEAN           IgnoreCase,
+    IN PCWCH             UpcaseTable OPTIONAL
+);
 
-#define FsRtlTestAnsiCharacter(C, DEFAULT_RET, WILD_OK, FLAGS) (            \
-        ((SCHAR)(C) < 0) ? DEFAULT_RET :                                    \
-                           FlagOn( LEGAL_ANSI_CHARACTER_ARRAY[(C)],         \
-                                   (FLAGS) |                                \
-                                   ((WILD_OK) ? FSRTL_WILD_CHARACTER : 0) ) \
+#define FsRtlAreThereCurrentFileLocks(FL) ( \
+    ((FL)->FastIoIsQuestionable)            \
 )
 
-#define FsRtlIsLeadDbcsCharacter(DBCS_CHAR) (                               \
-    (BOOLEAN)((UCHAR)(DBCS_CHAR) < 0x80 ? FALSE :                           \
-              (NLS_MB_CODE_PAGE_TAG &&                                      \
-               (NLS_OEM_LEAD_BYTE_INFO[(UCHAR)(DBCS_CHAR)] != 0)))          \
-)
+typedef
+VOID
+(NTAPI*POPLOCK_WAIT_COMPLETE_ROUTINE) (
+    IN PVOID    Context,
+    IN PIRP     Irp
+);
 
-#define FsRtlIsUnicodeCharacterWild(C) (                                    \
-    (((C) >= 0x40) ?                                                        \
-    FALSE :                                                                 \
-    FlagOn(FsRtlLegalAnsiCharacterArray[(C)], FSRTL_WILD_CHARACTER ))       \
-)
+typedef
+VOID
+(NTAPI*POPLOCK_FS_PREPOST_IRP) (
+    IN PVOID    Context,
+    IN PIRP     Irp
+);
 
-#define FsRtlInitPerFileContext( _fc, _owner, _inst, _cb)   \
-    ((_fc)->OwnerId = (_owner),                               \
-     (_fc)->InstanceId = (_inst),                             \
-     (_fc)->FreeCallback = (_cb))
-
-#define FsRtlGetPerFileContextPointer(_fo) \
-    (FsRtlSupportsPerFileContexts(_fo) ? \
-        FsRtlGetPerStreamContextPointer(_fo)->FileContextSupportPointer : \
-        NULL)
-
-#define FsRtlSupportsPerFileContexts(_fo)                     \
-    ((FsRtlGetPerStreamContextPointer(_fo) != NULL) &&        \
-     (FsRtlGetPerStreamContextPointer(_fo)->Version >= FSRTL_FCB_HEADER_V1) &&  \
-     (FsRtlGetPerStreamContextPointer(_fo)->FileContextSupportPointer != NULL))
-
-#define FsRtlSetupAdvancedHeaderEx( _advhdr, _fmutx, _fctxptr )                     \
-{                                                                                   \
-    FsRtlSetupAdvancedHeader( _advhdr, _fmutx );                                    \
-    if ((_fctxptr) != NULL) {                                                       \
-        (_advhdr)->FileContextSupportPointer = (_fctxptr);                          \
-    }                                                                               \
-}
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlCheckOplock (
+    IN POPLOCK                          Oplock,
+    IN PIRP                             Irp,
+    IN PVOID                            Context,
+    IN POPLOCK_WAIT_COMPLETE_ROUTINE    CompletionRoutine OPTIONAL,
+    IN POPLOCK_FS_PREPOST_IRP           PostIrpRoutine OPTIONAL
+);
 
-#define FsRtlGetPerStreamContextPointer(FO) (   \
-    (PFSRTL_ADVANCED_FCB_HEADER)(FO)->FsContext \
-)
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlCurrentBatchOplock (
+    IN POPLOCK Oplock
+);
 
-#define FsRtlInitPerStreamContext(PSC, O, I, FC) ( \
-    (PSC)->OwnerId = (O),                          \
-    (PSC)->InstanceId = (I),                       \
-    (PSC)->FreeCallback = (FC)                     \
-)
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlDeleteKeyFromTunnelCache (
+    IN PTUNNEL      Cache,
+    IN ULONGLONG    DirectoryKey
+);
 
-#define FsRtlSupportsPerStreamContexts(FO) (                       \
-    (BOOLEAN)((NULL != FsRtlGetPerStreamContextPointer(FO) &&     \
-              FlagOn(FsRtlGetPerStreamContextPointer(FO)->Flags2, \
-              FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS))               \
-)
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlDeleteTunnelCache (
+    IN PTUNNEL Cache
+);
 
-#define FsRtlLookupPerStreamContext(_sc, _oid, _iid)                          \
- (((NULL != (_sc)) &&                                                         \
-   FlagOn((_sc)->Flags2,FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS) &&              \
-   !IsListEmpty(&(_sc)->FilterContexts)) ?                                    \
-        FsRtlLookupPerStreamContextInternal((_sc), (_oid), (_iid)) :          \
-        NULL)
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlDeregisterUncProvider (
+    IN HANDLE Handle
+);
 
+NTKERNELAPI
 VOID
-FORCEINLINE
 NTAPI
-FsRtlSetupAdvancedHeader(
-  IN PVOID AdvHdr,
-  IN PFAST_MUTEX FMutex )
-{
-  PFSRTL_ADVANCED_FCB_HEADER localAdvHdr = (PFSRTL_ADVANCED_FCB_HEADER)AdvHdr;
-
-  localAdvHdr->Flags |= FSRTL_FLAG_ADVANCED_HEADER;
-  localAdvHdr->Flags2 |= FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS;
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-  localAdvHdr->Version = FSRTL_FCB_HEADER_V1;
-#else
-  localAdvHdr->Version = FSRTL_FCB_HEADER_V0;
-#endif
-  InitializeListHead( &localAdvHdr->FilterContexts );
-  if (FMutex != NULL) {
-    localAdvHdr->FastMutex = FMutex;
-  }
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-  *((PULONG_PTR)(&localAdvHdr->PushLock)) = 0;
-  localAdvHdr->FileContextSupportPointer = NULL;
-#endif
-}
-
-#define FsRtlInitPerFileObjectContext(_fc, _owner, _inst)         \
-           ((_fc)->OwnerId = (_owner), (_fc)->InstanceId = (_inst))
-
-#define FsRtlCompleteRequest(IRP,STATUS) {         \
-    (IRP)->IoStatus.Status = (STATUS);             \
-    IoCompleteRequest( (IRP), IO_DISK_INCREMENT ); \
-}
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-typedef struct _ECP_HEADER ECP_HEADER, *PECP_HEADER;
-#endif
-
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-
-typedef enum _NETWORK_OPEN_LOCATION_QUALIFIER {
-  NetworkOpenLocationAny,
-  NetworkOpenLocationRemote,
-  NetworkOpenLocationLoopback
-} NETWORK_OPEN_LOCATION_QUALIFIER;
-
-typedef enum _NETWORK_OPEN_INTEGRITY_QUALIFIER {
-  NetworkOpenIntegrityAny,
-  NetworkOpenIntegrityNone,
-  NetworkOpenIntegritySigned,
-  NetworkOpenIntegrityEncrypted,
-  NetworkOpenIntegrityMaximum
-} NETWORK_OPEN_INTEGRITY_QUALIFIER;
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-
-#define NETWORK_OPEN_ECP_IN_FLAG_DISABLE_HANDLE_COLLAPSING 0x1
-#define NETWORK_OPEN_ECP_IN_FLAG_DISABLE_HANDLE_DURABILITY 0x2
-#define NETWORK_OPEN_ECP_IN_FLAG_FORCE_BUFFERED_SYNCHRONOUS_IO_HACK 0x80000000
-
-typedef struct _NETWORK_OPEN_ECP_CONTEXT {
-  USHORT Size;
-  USHORT Reserved;
-  struct {
-    struct {
-      NETWORK_OPEN_LOCATION_QUALIFIER Location;
-      NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
-      ULONG Flags;
-    } in;
-    struct {
-      NETWORK_OPEN_LOCATION_QUALIFIER Location;
-      NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
-      ULONG Flags;
-    } out;
-  } DUMMYSTRUCTNAME;
-} NETWORK_OPEN_ECP_CONTEXT, *PNETWORK_OPEN_ECP_CONTEXT;
-
-typedef struct _NETWORK_OPEN_ECP_CONTEXT_V0 {
-  USHORT Size;
-  USHORT Reserved;
-  struct {
-    struct {
-    NETWORK_OPEN_LOCATION_QUALIFIER Location;
-    NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
-    } in;
-    struct {
-      NETWORK_OPEN_LOCATION_QUALIFIER Location;
-      NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
-    } out;
-  } DUMMYSTRUCTNAME;
-} NETWORK_OPEN_ECP_CONTEXT_V0, *PNETWORK_OPEN_ECP_CONTEXT_V0;
-
-#elif (NTDDI_VERSION >= NTDDI_VISTA)
-typedef struct _NETWORK_OPEN_ECP_CONTEXT {
-  USHORT Size;
-  USHORT Reserved;
-  struct {
-    struct {
-      NETWORK_OPEN_LOCATION_QUALIFIER Location;
-      NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
-    } in;
-    struct {
-      NETWORK_OPEN_LOCATION_QUALIFIER Location;
-      NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
-    } out;
-  } DUMMYSTRUCTNAME;
-} NETWORK_OPEN_ECP_CONTEXT, *PNETWORK_OPEN_ECP_CONTEXT;
-#endif
-
-DEFINE_GUID(GUID_ECP_NETWORK_OPEN_CONTEXT, 0xc584edbf, 0x00df, 0x4d28, 0xb8, 0x84, 0x35, 0xba, 0xca, 0x89, 0x11, 0xe8 );
-
-#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
-
-
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-
-typedef struct _PREFETCH_OPEN_ECP_CONTEXT {
-  PVOID Context;
-} PREFETCH_OPEN_ECP_CONTEXT, *PPREFETCH_OPEN_ECP_CONTEXT;
-
-DEFINE_GUID(GUID_ECP_PREFETCH_OPEN, 0xe1777b21, 0x847e, 0x4837, 0xaa, 0x45, 0x64, 0x16, 0x1d, 0x28, 0x6, 0x55 );
-
-#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-
-DEFINE_GUID (GUID_ECP_NFS_OPEN, 0xf326d30c, 0xe5f8, 0x4fe7, 0xab, 0x74, 0xf5, 0xa3, 0x19, 0x6d, 0x92, 0xdb);
-DEFINE_GUID(GUID_ECP_SRV_OPEN, 0xbebfaebc, 0xaabf, 0x489d, 0x9d, 0x2c, 0xe9, 0xe3, 0x61, 0x10, 0x28, 0x53 );
-
-typedef struct sockaddr_storage *PSOCKADDR_STORAGE_NFS;
-
-typedef struct _NFS_OPEN_ECP_CONTEXT {
-  PUNICODE_STRING ExportAlias;
-  PSOCKADDR_STORAGE_NFS ClientSocketAddress;
-} NFS_OPEN_ECP_CONTEXT, *PNFS_OPEN_ECP_CONTEXT, **PPNFS_OPEN_ECP_CONTEXT;
-
-typedef struct _SRV_OPEN_ECP_CONTEXT {
-  PUNICODE_STRING ShareName;
-  PSOCKADDR_STORAGE_NFS SocketAddress;
-  BOOLEAN OplockBlockState;
-  BOOLEAN OplockAppState;
-  BOOLEAN OplockFinalState;
-} SRV_OPEN_ECP_CONTEXT, *PSRV_OPEN_ECP_CONTEXT;
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
-
-#define VACB_MAPPING_GRANULARITY        (0x40000)
-#define VACB_OFFSET_SHIFT               (18)
-
-typedef struct _PUBLIC_BCB {
-  CSHORT NodeTypeCode;
-  CSHORT NodeByteSize;
-  ULONG MappedLength;
-  LARGE_INTEGER MappedFileOffset;
-} PUBLIC_BCB, *PPUBLIC_BCB;
-
-typedef struct _CC_FILE_SIZES {
-  LARGE_INTEGER AllocationSize;
-  LARGE_INTEGER FileSize;
-  LARGE_INTEGER ValidDataLength;
-} CC_FILE_SIZES, *PCC_FILE_SIZES;
-
-typedef BOOLEAN
-(NTAPI *PACQUIRE_FOR_LAZY_WRITE) (
-  IN PVOID Context,
-  IN BOOLEAN Wait);
-
-typedef VOID
-(NTAPI *PRELEASE_FROM_LAZY_WRITE) (
-  IN PVOID Context);
-
-typedef BOOLEAN
-(NTAPI *PACQUIRE_FOR_READ_AHEAD) (
-  IN PVOID Context,
-  IN BOOLEAN Wait);
-
-typedef VOID
-(NTAPI *PRELEASE_FROM_READ_AHEAD) (
-  IN PVOID Context);
-
-typedef struct _CACHE_MANAGER_CALLBACKS {
-  PACQUIRE_FOR_LAZY_WRITE AcquireForLazyWrite;
-  PRELEASE_FROM_LAZY_WRITE ReleaseFromLazyWrite;
-  PACQUIRE_FOR_READ_AHEAD AcquireForReadAhead;
-  PRELEASE_FROM_READ_AHEAD ReleaseFromReadAhead;
-} CACHE_MANAGER_CALLBACKS, *PCACHE_MANAGER_CALLBACKS;
-
-typedef struct _CACHE_UNINITIALIZE_EVENT {
-  struct _CACHE_UNINITIALIZE_EVENT *Next;
-  KEVENT Event;
-} CACHE_UNINITIALIZE_EVENT, *PCACHE_UNINITIALIZE_EVENT;
-
-typedef VOID
-(NTAPI *PDIRTY_PAGE_ROUTINE) (
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN ULONG Length,
-  IN PLARGE_INTEGER OldestLsn,
-  IN PLARGE_INTEGER NewestLsn,
-  IN PVOID Context1,
-  IN PVOID Context2);
-
-typedef VOID
-(NTAPI *PFLUSH_TO_LSN) (
-  IN PVOID LogHandle,
-  IN LARGE_INTEGER Lsn);
-
-typedef VOID
-(NTAPI *PCC_POST_DEFERRED_WRITE) (
-  IN PVOID Context1,
-  IN PVOID Context2);
-
-#define CcIsFileCached(FO) (                                                         \
-    ((FO)->SectionObjectPointer != NULL) &&                                          \
-    (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
-)
-
-extern ULONG CcFastMdlReadWait;
-
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
+FsRtlDissectDbcs (
+    IN ANSI_STRING    Name,
+    OUT PANSI_STRING  FirstPart,
+    OUT PANSI_STRING  RemainingPart
+);
 
 NTKERNELAPI
 VOID
 NTAPI
-CcInitializeCacheMap(
-  IN PFILE_OBJECT FileObject,
-  IN PCC_FILE_SIZES FileSizes,
-  IN BOOLEAN PinAccess,
-  IN PCACHE_MANAGER_CALLBACKS Callbacks,
-  IN PVOID LazyWriteContext);
+FsRtlDissectName (
+    IN UNICODE_STRING    Name,
+    OUT PUNICODE_STRING  FirstPart,
+    OUT PUNICODE_STRING  RemainingPart
+);
 
 NTKERNELAPI
 BOOLEAN
 NTAPI
-CcUninitializeCacheMap(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER TruncateSize OPTIONAL,
-  IN PCACHE_UNINITIALIZE_EVENT UninitializeCompleteEvent OPTIONAL);
-
-NTKERNELAPI
-VOID
-NTAPI
-CcSetFileSizes(
-  IN PFILE_OBJECT FileObject,
-  IN PCC_FILE_SIZES FileSizes);
-
-NTKERNELAPI
-VOID
-NTAPI
-CcSetDirtyPageThreshold(
-  IN PFILE_OBJECT FileObject,
-  IN ULONG DirtyPageThreshold);
-
-NTKERNELAPI
-VOID
-NTAPI
-CcFlushCache(
-  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
-  IN PLARGE_INTEGER FileOffset OPTIONAL,
-  IN ULONG Length,
-  OUT PIO_STATUS_BLOCK IoStatus OPTIONAL);
+FsRtlDoesDbcsContainWildCards (
+    IN PANSI_STRING Name
+);
 
 NTKERNELAPI
-LARGE_INTEGER
+BOOLEAN
 NTAPI
-CcGetFlushedValidData(
-  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
-  IN BOOLEAN BcbListHeld);
+FsRtlDoesNameContainWildCards (
+    IN PUNICODE_STRING Name
+);
 
 NTKERNELAPI
 BOOLEAN
 NTAPI
-CcZeroData(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER StartOffset,
-  IN PLARGE_INTEGER EndOffset,
-  IN BOOLEAN Wait);
+FsRtlIsFatDbcsLegal (
+    IN ANSI_STRING DbcsName,
+    IN BOOLEAN WildCardsPermissible,
+    IN BOOLEAN PathNamePermissible,
+    IN BOOLEAN LeadingBackslashPermissible
+    );
 
-NTKERNELAPI
-PVOID
-NTAPI
-CcRemapBcb(
-  IN PVOID Bcb);
 
-NTKERNELAPI
-VOID
-NTAPI
-CcRepinBcb(
-  IN PVOID Bcb);
+#define FsRtlCompleteRequest(IRP,STATUS) {         \
+    (IRP)->IoStatus.Status = (STATUS);             \
+    IoCompleteRequest( (IRP), IO_DISK_INCREMENT ); \
+}
 
-NTKERNELAPI
-VOID
-NTAPI
-CcUnpinRepinnedBcb(
-  IN PVOID Bcb,
-  IN BOOLEAN WriteThrough,
-  OUT PIO_STATUS_BLOCK IoStatus);
+#define FsRtlEnterFileSystem    KeEnterCriticalRegion
 
-NTKERNELAPI
-PFILE_OBJECT
-NTAPI
-CcGetFileObjectFromSectionPtrs(
-  IN PSECTION_OBJECT_POINTERS SectionObjectPointer);
+#define FsRtlExitFileSystem     KeLeaveCriticalRegion
 
-NTKERNELAPI
-PFILE_OBJECT
-NTAPI
-CcGetFileObjectFromBcb(
-  IN PVOID Bcb);
+#define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) (       \
+     FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11)   \
+)
 
 NTKERNELAPI
 BOOLEAN
 NTAPI
-CcCanIWrite(
-    IN PFILE_OBJECT     FileObject,
-  IN ULONG BytesToWrite,
-  IN BOOLEAN Wait,
-  IN BOOLEAN Retrying);
-
-NTKERNELAPI
-VOID
-NTAPI
-CcDeferWrite(
-  IN PFILE_OBJECT FileObject,
-  IN PCC_POST_DEFERRED_WRITE PostRoutine,
-  IN PVOID Context1,
-  IN PVOID Context2,
-  IN ULONG BytesToWrite,
-  IN BOOLEAN Retrying);
+FsRtlFindInTunnelCache (
+    IN PTUNNEL          Cache,
+    IN ULONGLONG        DirectoryKey,
+    IN PUNICODE_STRING  Name,
+    OUT PUNICODE_STRING ShortName,
+    OUT PUNICODE_STRING LongName,
+    IN OUT PULONG       DataLength,
+    OUT PVOID           Data
+);
 
 NTKERNELAPI
 BOOLEAN
 NTAPI
-CcCopyRead(
-    IN PFILE_OBJECT     FileObject,
-    IN PLARGE_INTEGER   FileOffset,
-  IN ULONG Length,
-  IN BOOLEAN Wait,
-  OUT PVOID Buffer,
-  OUT PIO_STATUS_BLOCK IoStatus);
+FsRtlGetNextBaseMcbEntry (
+    IN PBASE_MCB   Mcb,
+    IN ULONG       RunIndex,
+    OUT PLONGLONG  Vbn,
+    OUT PLONGLONG  Lbn,
+    OUT PLONGLONG  SectorCount
+);
 
 NTKERNELAPI
-VOID
+BOOLEAN
 NTAPI
-CcFastCopyRead(
-  IN PFILE_OBJECT FileObject,
-  IN ULONG FileOffset,
-  IN ULONG Length,
-  IN ULONG PageCount,
-  OUT PVOID Buffer,
-  OUT PIO_STATUS_BLOCK IoStatus);
+FsRtlGetNextLargeMcbEntry (
+    IN PLARGE_MCB  Mcb,
+    IN ULONG       RunIndex,
+    OUT PLONGLONG  Vbn,
+    OUT PLONGLONG  Lbn,
+    OUT PLONGLONG  SectorCount
+);
 
 NTKERNELAPI
 BOOLEAN
 NTAPI
-CcCopyWrite(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN ULONG Length,
-  IN BOOLEAN Wait,
-  IN PVOID Buffer);
+FsRtlGetNextMcbEntry (
+    IN PMCB     Mcb,
+    IN ULONG    RunIndex,
+    OUT PVBN    Vbn,
+    OUT PLBN    Lbn,
+    OUT PULONG  SectorCount
+);
 
-NTKERNELAPI
-VOID
-NTAPI
-CcFastCopyWrite(
-  IN PFILE_OBJECT FileObject,
-  IN ULONG FileOffset,
-  IN ULONG Length,
-  IN PVOID Buffer);
+#define FsRtlGetPerStreamContextPointer(FO) (   \
+    (PFSRTL_ADVANCED_FCB_HEADER)(FO)->FsContext \
+)
 
 NTKERNELAPI
 VOID
 NTAPI
-CcMdlRead(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN ULONG Length,
-  OUT PMDL *MdlChain,
-  OUT PIO_STATUS_BLOCK IoStatus);
+FsRtlInitializeBaseMcb (
+    IN PBASE_MCB  Mcb,
+    IN POOL_TYPE  PoolType
+);
 
 NTKERNELAPI
 VOID
 NTAPI
-CcMdlReadComplete(
-  IN PFILE_OBJECT FileObject,
-  IN PMDL MdlChain);
+FsRtlInitializeLargeMcb (
+    IN PLARGE_MCB  Mcb,
+    IN POOL_TYPE   PoolType
+);
 
 NTKERNELAPI
 VOID
 NTAPI
-CcPrepareMdlWrite(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN ULONG Length,
-  OUT PMDL *MdlChain,
-  OUT PIO_STATUS_BLOCK IoStatus);
+FsRtlInitializeMcb (
+    IN PMCB       Mcb,
+    IN POOL_TYPE  PoolType
+);
 
 NTKERNELAPI
 VOID
 NTAPI
-CcMdlWriteComplete(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN PMDL MdlChain);
+FsRtlInitializeOplock (
+    IN OUT POPLOCK Oplock
+);
 
 NTKERNELAPI
 VOID
 NTAPI
-CcScheduleReadAhead(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN ULONG Length);
+FsRtlInitializeTunnelCache (
+    IN PTUNNEL Cache
+);
+
+#define FsRtlInitPerStreamContext(PSC, O, I, FC) ( \
+    (PSC)->OwnerId = (O),                          \
+    (PSC)->InstanceId = (I),                       \
+    (PSC)->FreeCallback = (FC)                     \
+)
 
 NTKERNELAPI
 NTSTATUS
 NTAPI
-CcWaitForCurrentLazyWriterActivity(
-  VOID);
+FsRtlInsertPerStreamContext (
+    IN PFSRTL_ADVANCED_FCB_HEADER  PerStreamContext,
+    IN PFSRTL_PER_STREAM_CONTEXT   Ptr
+);
+
+#define FsRtlIsAnsiCharacterLegalFat(C, WILD) (                                \
+    FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_FAT_LEGAL) |       \
+                                        ((WILD) ? FSRTL_WILD_CHARACTER : 0 ))  \
+)
+
+#define FsRtlIsAnsiCharacterLegalHpfs(C, WILD) (                               \
+    FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_HPFS_LEGAL) |      \
+                                        ((WILD) ? FSRTL_WILD_CHARACTER : 0 ))  \
+)
+
+#define FsRtlIsAnsiCharacterLegalNtfs(C, WILD) (                               \
+    FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_NTFS_LEGAL) |      \
+                                        ((WILD) ? FSRTL_WILD_CHARACTER : 0 ))  \
+)
+
+#define FsRtlIsAnsiCharacterWild(C) (                                       \
+    FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], FSRTL_WILD_CHARACTER ) \
+)
 
 NTKERNELAPI
-VOID
+BOOLEAN
 NTAPI
-CcSetReadAheadGranularity(
-  IN PFILE_OBJECT FileObject,
-  IN ULONG Granularity);
+FsRtlIsFatDbcsLegal (
+    IN ANSI_STRING  DbcsName,
+    IN BOOLEAN      WildCardsPermissible,
+    IN BOOLEAN      PathNamePermissible,
+    IN BOOLEAN      LeadingBackslashPermissible
+);
 
 NTKERNELAPI
 BOOLEAN
 NTAPI
-CcPinRead(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN ULONG Length,
-  IN ULONG Flags,
-  OUT PVOID *Bcb,
-  OUT PVOID *Buffer);
+FsRtlIsHpfsDbcsLegal (
+    IN ANSI_STRING  DbcsName,
+    IN BOOLEAN      WildCardsPermissible,
+    IN BOOLEAN      PathNamePermissible,
+    IN BOOLEAN      LeadingBackslashPermissible
+);
 
 NTKERNELAPI
 BOOLEAN
 NTAPI
-CcPinMappedData(
-    IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN ULONG Length,
-  IN ULONG Flags,
-  IN OUT PVOID *Bcb);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-CcPreparePinWrite(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN ULONG Length,
-  IN BOOLEAN Zero,
-  IN ULONG Flags,
-  OUT PVOID *Bcb,
-  OUT PVOID *Buffer);
-
-NTKERNELAPI
-VOID
-NTAPI
-CcSetDirtyPinnedData(
-  IN PVOID BcbVoid,
-  IN PLARGE_INTEGER Lsn OPTIONAL);
-
-NTKERNELAPI
-VOID
-NTAPI
-CcUnpinData(
-  IN PVOID Bcb);
-
-NTKERNELAPI
-VOID
-NTAPI
-CcSetBcbOwnerPointer(
-  IN PVOID Bcb,
-  IN PVOID OwnerPointer);
-
-NTKERNELAPI
-VOID
-NTAPI
-CcUnpinDataForThread(
-  IN PVOID Bcb,
-  IN ERESOURCE_THREAD ResourceThreadId);
-
-NTKERNELAPI
-VOID
-NTAPI
-CcSetAdditionalCacheAttributes(
-  IN PFILE_OBJECT FileObject,
-  IN BOOLEAN DisableReadAhead,
-  IN BOOLEAN DisableWriteBehind);
-
-NTKERNELAPI
-BOOLEAN
-NTAPI
-CcIsThereDirtyData(
-  IN PVPB Vpb);
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
-
-#if (NTDDI_VERSION >= NTDDI_WINXP)
-
-NTKERNELAPI
-VOID
-NTAPI
-CcMdlWriteAbort(
-  IN PFILE_OBJECT FileObject,
-  IN PMDL MdlChain);
-
-NTKERNELAPI
-VOID
-NTAPI
-CcSetLogHandleForFile(
-  IN PFILE_OBJECT FileObject,
-  IN PVOID LogHandle,
-  IN PFLUSH_TO_LSN FlushToLsnRoutine);
-
-NTKERNELAPI
-LARGE_INTEGER
-NTAPI
-CcGetDirtyPages(
-  IN PVOID LogHandle,
-  IN PDIRTY_PAGE_ROUTINE DirtyPageRoutine,
-  IN PVOID Context1,
-  IN PVOID Context2);
-
-#endif
-
-#if (NTDDI_VERSION >= NTDDI_WINXP)
-NTKERNELAPI
-BOOLEAN
-NTAPI
-CcMapData(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN ULONG Length,
-  IN ULONG Flags,
-  OUT PVOID *Bcb,
-  OUT PVOID *Buffer);
-#elif (NTDDI_VERSION >= NTDDI_WIN2K)
-NTKERNELAPI
-BOOLEAN
-NTAPI
-CcMapData(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN ULONG Length,
-  IN BOOLEAN Wait,
-  OUT PVOID *Bcb,
-  OUT PVOID *Buffer);
-#endif
-
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-
-NTKERNELAPI
-NTSTATUS
-NTAPI
-CcSetFileSizesEx(
-  IN PFILE_OBJECT FileObject,
-  IN PCC_FILE_SIZES FileSizes);
-
-NTKERNELAPI
-PFILE_OBJECT
-NTAPI
-CcGetFileObjectFromSectionPtrsRef(
-  IN PSECTION_OBJECT_POINTERS SectionObjectPointer);
-
-NTKERNELAPI
-VOID
-NTAPI
-CcSetParallelFlushFile(
-  IN PFILE_OBJECT FileObject,
-  IN BOOLEAN EnableParallelFlush);
+FsRtlIsNameInExpression (
+    IN PUNICODE_STRING  Expression,
+    IN PUNICODE_STRING  Name,
+    IN BOOLEAN          IgnoreCase,
+    IN PWCHAR           UpcaseTable OPTIONAL
+);
 
 NTKERNELAPI
 BOOLEAN
-CcIsThereDirtyDataEx(
-  IN PVPB Vpb,
-  IN PULONG NumberOfDirtyPages OPTIONAL);
-
-#endif
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-NTKERNELAPI
-VOID
 NTAPI
-CcCoherencyFlushAndPurgeCache(
-  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
-  IN PLARGE_INTEGER FileOffset OPTIONAL,
-  IN ULONG Length,
-  OUT PIO_STATUS_BLOCK IoStatus,
-  IN ULONG Flags OPTIONAL);
-#endif
-
-#define CcGetFileSizePointer(FO) (                                     \
-    ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
-)
-
-#define UNINITIALIZE_CACHE_MAPS          (1)
-#define DO_NOT_RETRY_PURGE               (2)
-#define DO_NOT_PURGE_DIRTY_PAGES         (0x4)
-
-#define CC_FLUSH_AND_PURGE_NO_PURGE     (0x1)
+FsRtlIsNtstatusExpected (
+    IN NTSTATUS Ntstatus
+);
 
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-NTKERNELAPI
-BOOLEAN
-NTAPI
-CcPurgeCacheSection(
-  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
-  IN PLARGE_INTEGER FileOffset OPTIONAL,
-  IN ULONG Length,
-  IN ULONG Flags);
-#elif (NTDDI_VERSION >= NTDDI_WIN2K)
-NTKERNELAPI
-BOOLEAN
-NTAPI
-CcPurgeCacheSection(
-  IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
-  IN PLARGE_INTEGER FileOffset OPTIONAL,
-  IN ULONG Length,
-  IN BOOLEAN UninitializeCacheMaps);
-#endif
+#define NLS_OEM_LEAD_BYTE_INFO NlsOemLeadByteInfo
 
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-NTKERNELAPI
-BOOLEAN
-NTAPI
-CcCopyWriteWontFlush(
-  IN PFILE_OBJECT FileObject,
-  IN PLARGE_INTEGER FileOffset,
-  IN ULONG Length);
-#else
-#define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
-#endif
+extern PUSHORT NlsOemLeadByteInfo;
 
-#define CcReadAhead(FO, FOFF, LEN) (                \
-    if ((LEN) >= 256) {                             \
-        CcScheduleReadAhead((FO), (FOFF), (LEN));   \
-    }                                               \
+#define FsRtlIsLeadDbcsCharacter(DBCS_CHAR) (                               \
+    (BOOLEAN)((UCHAR)(DBCS_CHAR) < 0x80 ? FALSE :                           \
+              (NLS_MB_CODE_PAGE_TAG &&                                      \
+               (NLS_OEM_LEAD_BYTE_INFO[(UCHAR)(DBCS_CHAR)] != 0)))          \
 )
 
-#define PIN_WAIT                        (1)
-#define PIN_EXCLUSIVE                   (2)
-#define PIN_NO_READ                     (4)
-#define PIN_IF_BCB                      (8)
-#define PIN_CALLER_TRACKS_DIRTY_DATA    (32)
-#define PIN_HIGH_PRIORITY               (64)
-
-#define MAP_WAIT                          1
-#define MAP_NO_READ                       (16)
-#define MAP_HIGH_PRIORITY                 (64)
-
-#define IOCTL_REDIR_QUERY_PATH          CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
-#define IOCTL_REDIR_QUERY_PATH_EX       CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 100, METHOD_NEITHER, FILE_ANY_ACCESS)
-
-typedef struct _QUERY_PATH_REQUEST {
-  ULONG PathNameLength;
-  PIO_SECURITY_CONTEXT SecurityContext;
-  WCHAR FilePathName[1];
-} QUERY_PATH_REQUEST, *PQUERY_PATH_REQUEST;
-
-typedef struct _QUERY_PATH_REQUEST_EX {
-  PIO_SECURITY_CONTEXT pSecurityContext;
-  ULONG EaLength;
-  PVOID pEaBuffer;
-  UNICODE_STRING PathName;
-  UNICODE_STRING DomainServiceName;
-  ULONG_PTR Reserved[ 3 ];
-} QUERY_PATH_REQUEST_EX, *PQUERY_PATH_REQUEST_EX;
-
-typedef struct _QUERY_PATH_RESPONSE {
-  ULONG LengthAccepted;
-} QUERY_PATH_RESPONSE, *PQUERY_PATH_RESPONSE;
-
-#define VOLSNAPCONTROLTYPE                              0x00000053
-#define IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES             CTL_CODE(VOLSNAPCONTROLTYPE, 0, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
-
-#if (NTDDI_VERSION >= NTDDI_WIN2K)
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwQueryObject(
-  IN HANDLE Handle OPTIONAL,
-  IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
-  OUT PVOID ObjectInformation OPTIONAL,
-  IN ULONG ObjectInformationLength,
-  OUT PULONG ReturnLength OPTIONAL);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwNotifyChangeKey(
-  IN HANDLE KeyHandle,
-  IN HANDLE EventHandle OPTIONAL,
-  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
-  IN PVOID ApcContext OPTIONAL,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN ULONG NotifyFilter,
-  IN BOOLEAN WatchSubtree,
-  OUT PVOID Buffer,
-  IN ULONG BufferLength,
-  IN BOOLEAN Asynchronous);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwCreateEvent(
-  OUT PHANDLE EventHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
-  IN EVENT_TYPE EventType,
-  IN BOOLEAN InitialState);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwDeleteFile(
-  IN POBJECT_ATTRIBUTES ObjectAttributes);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwQueryDirectoryFile(
-  IN HANDLE FileHandle,
-  IN HANDLE Event OPTIONAL,
-  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
-  IN PVOID ApcContext OPTIONAL,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  OUT PVOID FileInformation,
-  IN ULONG Length,
-  IN FILE_INFORMATION_CLASS FileInformationClass,
-  IN BOOLEAN ReturnSingleEntry,
-  IN PUNICODE_STRING FileName OPTIONAL,
-  IN BOOLEAN RestartScan);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwSetVolumeInformationFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN PVOID FsInformation,
-  IN ULONG Length,
-  IN FS_INFORMATION_CLASS FsInformationClass);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwFsControlFile(
-  IN HANDLE FileHandle,
-  IN HANDLE Event OPTIONAL,
-  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
-  IN PVOID ApcContext OPTIONAL,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN ULONG FsControlCode,
-  IN PVOID InputBuffer OPTIONAL,
-  IN ULONG InputBufferLength,
-  OUT PVOID OutputBuffer OPTIONAL,
-  IN ULONG OutputBufferLength);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwDuplicateObject(
-  IN HANDLE SourceProcessHandle,
-  IN HANDLE SourceHandle,
-  IN HANDLE TargetProcessHandle OPTIONAL,
-  OUT PHANDLE TargetHandle OPTIONAL,
-  IN ACCESS_MASK DesiredAccess,
-  IN ULONG HandleAttributes,
-  IN ULONG Options);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwOpenDirectoryObject(
-  OUT PHANDLE DirectoryHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN POBJECT_ATTRIBUTES ObjectAttributes);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwAllocateVirtualMemory(
-  IN HANDLE ProcessHandle,
-  IN OUT PVOID *BaseAddress,
-  IN ULONG_PTR ZeroBits,
-  IN OUT PSIZE_T RegionSize,
-  IN ULONG AllocationType,
-  IN ULONG Protect);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwFreeVirtualMemory(
-  IN HANDLE ProcessHandle,
-  IN OUT PVOID *BaseAddress,
-  IN OUT PSIZE_T RegionSize,
-  IN ULONG FreeType);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwWaitForSingleObject(
-  IN HANDLE Handle,
-  IN BOOLEAN Alertable,
-  IN PLARGE_INTEGER Timeout OPTIONAL);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwSetEvent(
-  IN HANDLE EventHandle,
-  OUT PLONG PreviousState OPTIONAL);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwFlushVirtualMemory(
-  IN HANDLE ProcessHandle,
-  IN OUT PVOID *BaseAddress,
-  IN OUT PSIZE_T RegionSize,
-  OUT PIO_STATUS_BLOCK IoStatusBlock);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwQueryInformationToken(
-  IN HANDLE TokenHandle,
-  IN TOKEN_INFORMATION_CLASS TokenInformationClass,
-  OUT PVOID TokenInformation,
-  IN ULONG Length,
-  OUT PULONG ResultLength);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwSetSecurityObject(
-  IN HANDLE Handle,
-  IN SECURITY_INFORMATION SecurityInformation,
-  IN PSECURITY_DESCRIPTOR SecurityDescriptor);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwQuerySecurityObject(
-  IN HANDLE FileHandle,
-  IN SECURITY_INFORMATION SecurityInformation,
-  OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
-  IN ULONG Length,
-  OUT PULONG ResultLength);
-
-#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
-
-#if (NTDDI_VERSION >= NTDDI_WINXP)
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwOpenProcessTokenEx(
-  IN HANDLE ProcessHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN ULONG HandleAttributes,
-  OUT PHANDLE TokenHandle);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwOpenThreadTokenEx(
-  IN HANDLE ThreadHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN BOOLEAN OpenAsSelf,
-  IN ULONG HandleAttributes,
-  OUT PHANDLE TokenHandle);
-
-#endif
-
-#if (NTDDI_VERSION >= NTDDI_VISTA)
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwLockFile(
-  IN HANDLE FileHandle,
-  IN HANDLE Event OPTIONAL,
-  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
-  IN PVOID ApcContext OPTIONAL,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN PLARGE_INTEGER ByteOffset,
-  IN PLARGE_INTEGER Length,
-  IN ULONG Key,
-  IN BOOLEAN FailImmediately,
-  IN BOOLEAN ExclusiveLock);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwUnlockFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN PLARGE_INTEGER ByteOffset,
-  IN PLARGE_INTEGER Length,
-  IN ULONG Key);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwQueryQuotaInformationFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  OUT PVOID Buffer,
-  IN ULONG Length,
-  IN BOOLEAN ReturnSingleEntry,
-  IN PVOID SidList,
-  IN ULONG SidListLength,
-  IN PSID StartSid OPTIONAL,
-  IN BOOLEAN RestartScan);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwSetQuotaInformationFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  IN PVOID Buffer,
-  IN ULONG Length);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwFlushBuffersFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock);
-
-#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
-
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwSetInformationToken(
-  IN HANDLE TokenHandle,
-  IN TOKEN_INFORMATION_CLASS TokenInformationClass,
-  IN PVOID TokenInformation,
-  IN ULONG TokenInformationLength);
-#endif
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwQueryEaFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  OUT PVOID Buffer,
-  IN ULONG Length,
-  IN BOOLEAN ReturnSingleEntry,
-  IN PVOID EaList OPTIONAL,
-  IN ULONG EaListLength,
-  IN PULONG EaIndex OPTIONAL,
-  IN BOOLEAN RestartScan);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwSetEaFile(
-  IN HANDLE FileHandle,
-  OUT PIO_STATUS_BLOCK IoStatusBlock,
-  OUT PVOID Buffer,
-  IN ULONG Length);
-
-NTSYSAPI
-NTSTATUS
-NTAPI
-ZwDuplicateToken(
-  IN HANDLE ExistingTokenHandle,
-  IN ACCESS_MASK DesiredAccess,
-  IN POBJECT_ATTRIBUTES ObjectAttributes,
-  IN BOOLEAN EffectiveOnly,
-  IN TOKEN_TYPE TokenType,
-  OUT PHANDLE NewTokenHandle);
-
-#pragma pack(push,4)
-
-#ifndef VER_PRODUCTBUILD
-#define VER_PRODUCTBUILD 10000
-#endif
-
-#include "csq.h"
-
-extern PACL                         SePublicDefaultDacl;
-extern PACL                         SeSystemDefaultDacl;
-
-#define FS_LFN_APIS                     0x00004000
-
-#define FILE_STORAGE_TYPE_SPECIFIED             0x00000041  /* FILE_DIRECTORY_FILE | FILE_NON_DIRECTORY_FILE */
-#define FILE_STORAGE_TYPE_DEFAULT               (StorageTypeDefault << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_DIRECTORY             (StorageTypeDirectory << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_FILE                  (StorageTypeFile << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_DOCFILE               (StorageTypeDocfile << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_JUNCTION_POINT        (StorageTypeJunctionPoint << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_CATALOG               (StorageTypeCatalog << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_STRUCTURED_STORAGE    (StorageTypeStructuredStorage << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_EMBEDDING             (StorageTypeEmbedding << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_STORAGE_TYPE_STREAM                (StorageTypeStream << FILE_STORAGE_TYPE_SHIFT)
-#define FILE_MINIMUM_STORAGE_TYPE               FILE_STORAGE_TYPE_DEFAULT
-#define FILE_MAXIMUM_STORAGE_TYPE               FILE_STORAGE_TYPE_STREAM
-#define FILE_STORAGE_TYPE_MASK                  0x000f0000
-#define FILE_STORAGE_TYPE_SHIFT                 16
-
-#define FILE_VC_QUOTAS_LOG_VIOLATIONS   0x00000004
-
-#ifdef _X86_
-#define HARDWARE_PTE    HARDWARE_PTE_X86
-#define PHARDWARE_PTE   PHARDWARE_PTE_X86
-#endif
-
-#define IO_ATTACH_DEVICE_API            0x80000000
-
-#define IO_TYPE_APC                     18
-#define IO_TYPE_DPC                     19
-#define IO_TYPE_DEVICE_QUEUE            20
-#define IO_TYPE_EVENT_PAIR              21
-#define IO_TYPE_INTERRUPT               22
-#define IO_TYPE_PROFILE                 23
-
-#define IRP_BEING_VERIFIED              0x10
-
-#define MAILSLOT_CLASS_FIRSTCLASS       1
-#define MAILSLOT_CLASS_SECONDCLASS      2
-
-#define MAILSLOT_SIZE_AUTO              0
-
-#define MEM_DOS_LIM                     0x40000000
-
-#define OB_TYPE_TYPE                    1
-#define OB_TYPE_DIRECTORY               2
-#define OB_TYPE_SYMBOLIC_LINK           3
-#define OB_TYPE_TOKEN                   4
-#define OB_TYPE_PROCESS                 5
-#define OB_TYPE_THREAD                  6
-#define OB_TYPE_EVENT                   7
-#define OB_TYPE_EVENT_PAIR              8
-#define OB_TYPE_MUTANT                  9
-#define OB_TYPE_SEMAPHORE               10
-#define OB_TYPE_TIMER                   11
-#define OB_TYPE_PROFILE                 12
-#define OB_TYPE_WINDOW_STATION          13
-#define OB_TYPE_DESKTOP                 14
-#define OB_TYPE_SECTION                 15
-#define OB_TYPE_KEY                     16
-#define OB_TYPE_PORT                    17
-#define OB_TYPE_ADAPTER                 18
-#define OB_TYPE_CONTROLLER              19
-#define OB_TYPE_DEVICE                  20
-#define OB_TYPE_DRIVER                  21
-#define OB_TYPE_IO_COMPLETION           22
-#define OB_TYPE_FILE                    23
-
-#define SEC_BASED      0x00200000
-
-/* end winnt.h */
-
-#define TOKEN_HAS_ADMIN_GROUP           0x08
-
-#if (VER_PRODUCTBUILD >= 1381)
-#define FSCTL_GET_HFS_INFORMATION       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS)
-#endif /* (VER_PRODUCTBUILD >= 1381) */
-
-#if (VER_PRODUCTBUILD >= 2195)
-
-#define FSCTL_READ_PROPERTY_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 33, METHOD_NEITHER, FILE_ANY_ACCESS)
-#define FSCTL_WRITE_PROPERTY_DATA       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 34, METHOD_NEITHER, FILE_ANY_ACCESS)
-
-#define FSCTL_DUMP_PROPERTY_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 37,  METHOD_NEITHER, FILE_ANY_ACCESS)
-
-#define FSCTL_HSM_MSG                   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
-#define FSCTL_NSS_CONTROL               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 67, METHOD_BUFFERED, FILE_WRITE_DATA)
-#define FSCTL_HSM_DATA                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
-#define FSCTL_NSS_RCONTROL              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 70, METHOD_BUFFERED, FILE_READ_DATA)
-#endif /* (VER_PRODUCTBUILD >= 2195) */
-
-#define FSCTL_NETWORK_SET_CONFIGURATION_INFO    CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 102, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
-#define FSCTL_NETWORK_GET_CONFIGURATION_INFO    CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 103, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
-#define FSCTL_NETWORK_GET_CONNECTION_INFO       CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 104, METHOD_NEITHER, FILE_ANY_ACCESS)
-#define FSCTL_NETWORK_ENUMERATE_CONNECTIONS     CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 105, METHOD_NEITHER, FILE_ANY_ACCESS)
-#define FSCTL_NETWORK_DELETE_CONNECTION         CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 107, METHOD_BUFFERED, FILE_ANY_ACCESS)
-#define FSCTL_NETWORK_GET_STATISTICS            CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 116, METHOD_BUFFERED, FILE_ANY_ACCESS)
-#define FSCTL_NETWORK_SET_DOMAIN_NAME           CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_ANY_ACCESS)
-#define FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT     CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_ANY_ACCESS)
-
-typedef enum _FILE_STORAGE_TYPE {
-    StorageTypeDefault = 1,
-    StorageTypeDirectory,
-    StorageTypeFile,
-    StorageTypeJunctionPoint,
-    StorageTypeCatalog,
-    StorageTypeStructuredStorage,
-    StorageTypeEmbedding,
-    StorageTypeStream
-} FILE_STORAGE_TYPE;
-
-typedef struct _OBJECT_BASIC_INFORMATION
-{
-    ULONG Attributes;
-    ACCESS_MASK GrantedAccess;
-    ULONG HandleCount;
-    ULONG PointerCount;
-    ULONG PagedPoolCharge;
-    ULONG NonPagedPoolCharge;
-    ULONG Reserved[ 3 ];
-    ULONG NameInfoSize;
-    ULONG TypeInfoSize;
-    ULONG SecurityDescriptorSize;
-    LARGE_INTEGER CreationTime;
-} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
-
-typedef struct _BITMAP_RANGE {
-    LIST_ENTRY      Links;
-    LONGLONG        BasePage;
-    ULONG           FirstDirtyPage;
-    ULONG           LastDirtyPage;
-    ULONG           DirtyPages;
-    PULONG          Bitmap;
-} BITMAP_RANGE, *PBITMAP_RANGE;
-
-typedef struct _FILE_COPY_ON_WRITE_INFORMATION {
-    BOOLEAN ReplaceIfExists;
-    HANDLE  RootDirectory;
-    ULONG   FileNameLength;
-    WCHAR   FileName[1];
-} FILE_COPY_ON_WRITE_INFORMATION, *PFILE_COPY_ON_WRITE_INFORMATION;
-
-typedef struct _FILE_FULL_DIRECTORY_INFORMATION {
-    ULONG           NextEntryOffset;
-    ULONG           FileIndex;
-    LARGE_INTEGER   CreationTime;
-    LARGE_INTEGER   LastAccessTime;
-    LARGE_INTEGER   LastWriteTime;
-    LARGE_INTEGER   ChangeTime;
-    LARGE_INTEGER   EndOfFile;
-    LARGE_INTEGER   AllocationSize;
-    ULONG           FileAttributes;
-    ULONG           FileNameLength;
-    ULONG           EaSize;
-    WCHAR           FileName[ANYSIZE_ARRAY];
-} FILE_FULL_DIRECTORY_INFORMATION, *PFILE_FULL_DIRECTORY_INFORMATION;
-
-/* raw internal file lock struct returned from FsRtlGetNextFileLock */
-typedef struct _FILE_SHARED_LOCK_ENTRY {
-    PVOID           Unknown1;
-    PVOID           Unknown2;
-    FILE_LOCK_INFO  FileLock;
-} FILE_SHARED_LOCK_ENTRY, *PFILE_SHARED_LOCK_ENTRY;
-
-/* raw internal file lock struct returned from FsRtlGetNextFileLock */
-typedef struct _FILE_EXCLUSIVE_LOCK_ENTRY {
-    LIST_ENTRY      ListEntry;
-    PVOID           Unknown1;
-    PVOID           Unknown2;
-    FILE_LOCK_INFO  FileLock;
-} FILE_EXCLUSIVE_LOCK_ENTRY, *PFILE_EXCLUSIVE_LOCK_ENTRY;
-
-typedef struct _FILE_MAILSLOT_PEEK_BUFFER {
-    ULONG ReadDataAvailable;
-    ULONG NumberOfMessages;
-    ULONG MessageLength;
-} FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER;
-
-typedef struct _FILE_OLE_CLASSID_INFORMATION {
-    GUID ClassId;
-} FILE_OLE_CLASSID_INFORMATION, *PFILE_OLE_CLASSID_INFORMATION;
-
-typedef struct _FILE_OLE_ALL_INFORMATION {
-    FILE_BASIC_INFORMATION          BasicInformation;
-    FILE_STANDARD_INFORMATION       StandardInformation;
-    FILE_INTERNAL_INFORMATION       InternalInformation;
-    FILE_EA_INFORMATION             EaInformation;
-    FILE_ACCESS_INFORMATION         AccessInformation;
-    FILE_POSITION_INFORMATION       PositionInformation;
-    FILE_MODE_INFORMATION           ModeInformation;
-    FILE_ALIGNMENT_INFORMATION      AlignmentInformation;
-    USN                             LastChangeUsn;
-    USN                             ReplicationUsn;
-    LARGE_INTEGER                   SecurityChangeTime;
-    FILE_OLE_CLASSID_INFORMATION    OleClassIdInformation;
-    FILE_OBJECTID_INFORMATION       ObjectIdInformation;
-    FILE_STORAGE_TYPE               StorageType;
-    ULONG                           OleStateBits;
-    ULONG                           OleId;
-    ULONG                           NumberOfStreamReferences;
-    ULONG                           StreamIndex;
-    ULONG                           SecurityId;
-    BOOLEAN                         ContentIndexDisable;
-    BOOLEAN                         InheritContentIndexDisable;
-    FILE_NAME_INFORMATION           NameInformation;
-} FILE_OLE_ALL_INFORMATION, *PFILE_OLE_ALL_INFORMATION;
-
-typedef struct _FILE_OLE_DIR_INFORMATION {
-    ULONG               NextEntryOffset;
-    ULONG               FileIndex;
-    LARGE_INTEGER       CreationTime;
-    LARGE_INTEGER       LastAccessTime;
-    LARGE_INTEGER       LastWriteTime;
-    LARGE_INTEGER       ChangeTime;
-    LARGE_INTEGER       EndOfFile;
-    LARGE_INTEGER       AllocationSize;
-    ULONG               FileAttributes;
-    ULONG               FileNameLength;
-    FILE_STORAGE_TYPE   StorageType;
-    GUID                OleClassId;
-    ULONG               OleStateBits;
-    BOOLEAN             ContentIndexDisable;
-    BOOLEAN             InheritContentIndexDisable;
-    WCHAR               FileName[1];
-} FILE_OLE_DIR_INFORMATION, *PFILE_OLE_DIR_INFORMATION;
-
-typedef struct _FILE_OLE_INFORMATION {
-    LARGE_INTEGER                   SecurityChangeTime;
-    FILE_OLE_CLASSID_INFORMATION    OleClassIdInformation;
-    FILE_OBJECTID_INFORMATION       ObjectIdInformation;
-    FILE_STORAGE_TYPE               StorageType;
-    ULONG                           OleStateBits;
-    BOOLEAN                         ContentIndexDisable;
-    BOOLEAN                         InheritContentIndexDisable;
-} FILE_OLE_INFORMATION, *PFILE_OLE_INFORMATION;
-
-typedef struct _FILE_OLE_STATE_BITS_INFORMATION {
-    ULONG StateBits;
-    ULONG StateBitsMask;
-} FILE_OLE_STATE_BITS_INFORMATION, *PFILE_OLE_STATE_BITS_INFORMATION;
-
-typedef struct _MAPPING_PAIR {
-    ULONGLONG Vcn;
-    ULONGLONG Lcn;
-} MAPPING_PAIR, *PMAPPING_PAIR;
-
-typedef struct _GET_RETRIEVAL_DESCRIPTOR {
-    ULONG           NumberOfPairs;
-    ULONGLONG       StartVcn;
-    MAPPING_PAIR    Pair[1];
-} GET_RETRIEVAL_DESCRIPTOR, *PGET_RETRIEVAL_DESCRIPTOR;
-
-typedef struct _MBCB {
-    CSHORT          NodeTypeCode;
-    CSHORT          NodeIsInZone;
-    ULONG           PagesToWrite;
-    ULONG           DirtyPages;
-    ULONG           Reserved;
-    LIST_ENTRY      BitmapRanges;
-    LONGLONG        ResumeWritePage;
-    BITMAP_RANGE    BitmapRange1;
-    BITMAP_RANGE    BitmapRange2;
-    BITMAP_RANGE    BitmapRange3;
-} MBCB, *PMBCB;
-
-typedef struct _MOVEFILE_DESCRIPTOR {
-     HANDLE         FileHandle;
-     ULONG          Reserved;
-     LARGE_INTEGER  StartVcn;
-     LARGE_INTEGER  TargetLcn;
-     ULONG          NumVcns;
-     ULONG          Reserved1;
-} MOVEFILE_DESCRIPTOR, *PMOVEFILE_DESCRIPTOR;
-
-typedef struct _OBJECT_BASIC_INFO {
-    ULONG           Attributes;
-    ACCESS_MASK     GrantedAccess;
-    ULONG           HandleCount;
-    ULONG           ReferenceCount;
-    ULONG           PagedPoolUsage;
-    ULONG           NonPagedPoolUsage;
-    ULONG           Reserved[3];
-    ULONG           NameInformationLength;
-    ULONG           TypeInformationLength;
-    ULONG           SecurityDescriptorLength;
-    LARGE_INTEGER   CreateTime;
-} OBJECT_BASIC_INFO, *POBJECT_BASIC_INFO;
-
-typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFO {
-    BOOLEAN Inherit;
-    BOOLEAN ProtectFromClose;
-} OBJECT_HANDLE_ATTRIBUTE_INFO, *POBJECT_HANDLE_ATTRIBUTE_INFO;
-
-typedef struct _OBJECT_NAME_INFO {
-    UNICODE_STRING  ObjectName;
-    WCHAR           ObjectNameBuffer[1];
-} OBJECT_NAME_INFO, *POBJECT_NAME_INFO;
-
-typedef struct _OBJECT_PROTECTION_INFO {
-    BOOLEAN Inherit;
-    BOOLEAN ProtectHandle;
-} OBJECT_PROTECTION_INFO, *POBJECT_PROTECTION_INFO;
-
-typedef struct _OBJECT_TYPE_INFO {
-    UNICODE_STRING  ObjectTypeName;
-    UCHAR           Unknown[0x58];
-    WCHAR           ObjectTypeNameBuffer[1];
-} OBJECT_TYPE_INFO, *POBJECT_TYPE_INFO;
-
-typedef struct _OBJECT_ALL_TYPES_INFO {
-    ULONG               NumberOfObjectTypes;
-    OBJECT_TYPE_INFO    ObjectsTypeInfo[1];
-} OBJECT_ALL_TYPES_INFO, *POBJECT_ALL_TYPES_INFO;
-
-#if defined(USE_LPC6432)
-#define LPC_CLIENT_ID CLIENT_ID64
-#define LPC_SIZE_T ULONGLONG
-#define LPC_PVOID ULONGLONG
-#define LPC_HANDLE ULONGLONG
-#else
-#define LPC_CLIENT_ID CLIENT_ID
-#define LPC_SIZE_T SIZE_T
-#define LPC_PVOID PVOID
-#define LPC_HANDLE HANDLE
-#endif
-
-typedef struct _PORT_MESSAGE
-{
-    union
-    {
-        struct
-        {
-            CSHORT DataLength;
-            CSHORT TotalLength;
-        } s1;
-        ULONG Length;
-    } u1;
-    union
-    {
-        struct
-        {
-            CSHORT Type;
-            CSHORT DataInfoOffset;
-        } s2;
-        ULONG ZeroInit;
-    } u2;
-    __GNU_EXTENSION union
-    {
-        LPC_CLIENT_ID ClientId;
-        double DoNotUseThisField;
-    };
-    ULONG MessageId;
-    __GNU_EXTENSION union
-    {
-        LPC_SIZE_T ClientViewSize;
-        ULONG CallbackId;
-    };
-} PORT_MESSAGE, *PPORT_MESSAGE;
-
-#define LPC_KERNELMODE_MESSAGE      (CSHORT)((USHORT)0x8000)
-
-typedef struct _PORT_VIEW
-{
-    ULONG Length;
-    LPC_HANDLE SectionHandle;
-    ULONG SectionOffset;
-    LPC_SIZE_T ViewSize;
-    LPC_PVOID ViewBase;
-    LPC_PVOID ViewRemoteBase;
-} PORT_VIEW, *PPORT_VIEW;
+#define FsRtlIsUnicodeCharacterWild(C) (                                    \
+    (((C) >= 0x40) ?                                                        \
+    FALSE :                                                                 \
+    FlagOn(FsRtlLegalAnsiCharacterArray[(C)], FSRTL_WILD_CHARACTER ))       \
+)
 
-typedef struct _REMOTE_PORT_VIEW
-{
-    ULONG Length;
-    LPC_SIZE_T ViewSize;
-    LPC_PVOID ViewBase;
-} REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW;
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlLookupBaseMcbEntry (
+    IN PBASE_MCB   Mcb,
+    IN LONGLONG    Vbn,
+    OUT PLONGLONG  Lbn OPTIONAL,
+    OUT PLONGLONG  SectorCountFromLbn OPTIONAL,
+    OUT PLONGLONG  StartingLbn OPTIONAL,
+    OUT PLONGLONG  SectorCountFromStartingLbn OPTIONAL,
+    OUT PULONG     Index OPTIONAL
+);
 
-typedef struct _VAD_HEADER {
-    PVOID       StartVPN;
-    PVOID       EndVPN;
-    struct _VAD_HEADER* ParentLink;
-    struct _VAD_HEADER* LeftLink;
-    struct _VAD_HEADER* RightLink;
-    ULONG       Flags;          /* LSB = CommitCharge */
-    PVOID       ControlArea;
-    PVOID       FirstProtoPte;
-    PVOID       LastPTE;
-    ULONG       Unknown;
-    LIST_ENTRY  Secured;
-} VAD_HEADER, *PVAD_HEADER;
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlLookupLargeMcbEntry (
+    IN PLARGE_MCB  Mcb,
+    IN LONGLONG    Vbn,
+    OUT PLONGLONG  Lbn OPTIONAL,
+    OUT PLONGLONG  SectorCountFromLbn OPTIONAL,
+    OUT PLONGLONG  StartingLbn OPTIONAL,
+    OUT PLONGLONG  SectorCountFromStartingLbn OPTIONAL,
+    OUT PULONG     Index OPTIONAL
+);
 
 NTKERNELAPI
-LARGE_INTEGER
+BOOLEAN
 NTAPI
-CcGetLsnForFileObject (
-    IN PFILE_OBJECT     FileObject,
-    OUT PLARGE_INTEGER  OldestLsn OPTIONAL
+FsRtlLookupLastBaseMcbEntry (
+    IN PBASE_MCB   Mcb,
+    OUT PLONGLONG  Vbn,
+    OUT PLONGLONG  Lbn
 );
 
 NTKERNELAPI
-PVOID
+BOOLEAN
 NTAPI
-FsRtlAllocatePool (
-    IN POOL_TYPE    PoolType,
-    IN ULONG        NumberOfBytes
+FsRtlLookupLastLargeMcbEntry (
+    IN PLARGE_MCB  Mcb,
+    OUT PLONGLONG  Vbn,
+    OUT PLONGLONG  Lbn
 );
 
 NTKERNELAPI
-PVOID
+BOOLEAN
 NTAPI
-FsRtlAllocatePoolWithQuota (
-    IN POOL_TYPE    PoolType,
-    IN ULONG        NumberOfBytes
+FsRtlLookupLastMcbEntry (
+    IN PMCB   Mcb,
+    OUT PVBN  Vbn,
+    OUT PLBN  Lbn
 );
 
 NTKERNELAPI
-PVOID
+BOOLEAN
 NTAPI
-FsRtlAllocatePoolWithQuotaTag (
-    IN POOL_TYPE    PoolType,
-    IN ULONG        NumberOfBytes,
-    IN ULONG        Tag
+FsRtlLookupLastBaseMcbEntryAndIndex (
+    IN PBASE_MCB      OpaqueMcb,
+    IN OUT PLONGLONG  LargeVbn,
+    IN OUT PLONGLONG  LargeLbn,
+    IN OUT PULONG     Index
 );
 
 NTKERNELAPI
-PVOID
+BOOLEAN
 NTAPI
-FsRtlAllocatePoolWithTag (
-    IN POOL_TYPE    PoolType,
-    IN ULONG        NumberOfBytes,
-    IN ULONG        Tag
+FsRtlLookupLastLargeMcbEntryAndIndex (
+    IN PLARGE_MCB  OpaqueMcb,
+    OUT PLONGLONG  LargeVbn,
+    OUT PLONGLONG  LargeLbn,
+    OUT PULONG     Index
 );
 
 NTKERNELAPI
 BOOLEAN
 NTAPI
-FsRtlIsFatDbcsLegal (
-    IN ANSI_STRING  DbcsName,
-    IN BOOLEAN      WildCardsPermissible,
-    IN BOOLEAN      PathNamePermissible,
-    IN BOOLEAN      LeadingBackslashPermissible
+FsRtlLookupMcbEntry (
+    IN PMCB     Mcb,
+    IN VBN      Vbn,
+    OUT PLBN    Lbn,
+    OUT PULONG  SectorCount OPTIONAL,
+    OUT PULONG  Index
+);
+
+NTKERNELAPI
+PFSRTL_PER_STREAM_CONTEXT
+NTAPI
+FsRtlLookupPerStreamContextInternal (
+    IN PFSRTL_ADVANCED_FCB_HEADER  StreamContext,
+    IN PVOID                       OwnerId OPTIONAL,
+    IN PVOID                       InstanceId OPTIONAL
 );
 
 NTKERNELAPI
@@ -9352,6 +8612,14 @@ FsRtlMdlWriteComplete (
     IN PMDL             MdlChain
 );
 
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlNormalizeNtstatus (
+    IN NTSTATUS Exception,
+    IN NTSTATUS GenericException
+);
+
 NTKERNELAPI
 VOID
 NTAPI
@@ -9365,6 +8633,306 @@ FsRtlNotifyChangeDirectory (
     IN PIRP         NotifyIrp
 );
 
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlNotifyCleanup (
+    IN PNOTIFY_SYNC NotifySync,
+    IN PLIST_ENTRY  NotifyList,
+    IN PVOID        FsContext
+);
+
+typedef BOOLEAN (NTAPI *PCHECK_FOR_TRAVERSE_ACCESS) (
+    IN PVOID                        NotifyContext,
+    IN PVOID                        TargetContext,
+    IN PSECURITY_SUBJECT_CONTEXT    SubjectContext
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlNotifyFilterChangeDirectory (
+    IN PNOTIFY_SYNC                 NotifySync,
+    IN PLIST_ENTRY                  NotifyList,
+    IN PVOID                        FsContext,
+    IN PSTRING                      FullDirectoryName,
+    IN BOOLEAN                      WatchTree,
+    IN BOOLEAN                      IgnoreBuffer,
+    IN ULONG                        CompletionFilter,
+    IN PIRP                         NotifyIrp,
+    IN PCHECK_FOR_TRAVERSE_ACCESS   TraverseCallback OPTIONAL,
+    IN PSECURITY_SUBJECT_CONTEXT    SubjectContext OPTIONAL,
+    IN PFILTER_REPORT_CHANGE        FilterCallback OPTIONAL);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlNotifyFilterReportChange (
+    IN PNOTIFY_SYNC   NotifySync,
+    IN PLIST_ENTRY    NotifyList,
+    IN PSTRING        FullTargetName,
+    IN USHORT         TargetNameOffset,
+    IN PSTRING        StreamName OPTIONAL,
+    IN PSTRING        NormalizedParentName OPTIONAL,
+    IN ULONG          FilterMatch,
+    IN ULONG          Action,
+    IN PVOID          TargetContext,
+    IN PVOID          FilterContext);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlNotifyFullChangeDirectory (
+    IN PNOTIFY_SYNC                 NotifySync,
+    IN PLIST_ENTRY                  NotifyList,
+    IN PVOID                        FsContext,
+    IN PSTRING                      FullDirectoryName,
+    IN BOOLEAN                      WatchTree,
+    IN BOOLEAN                      IgnoreBuffer,
+    IN ULONG                        CompletionFilter,
+    IN PIRP                         NotifyIrp,
+    IN PCHECK_FOR_TRAVERSE_ACCESS   TraverseCallback OPTIONAL,
+    IN PSECURITY_SUBJECT_CONTEXT    SubjectContext OPTIONAL
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlNotifyFullReportChange (
+    IN PNOTIFY_SYNC NotifySync,
+    IN PLIST_ENTRY  NotifyList,
+    IN PSTRING      FullTargetName,
+    IN USHORT       TargetNameOffset,
+    IN PSTRING      StreamName OPTIONAL,
+    IN PSTRING      NormalizedParentName OPTIONAL,
+    IN ULONG        FilterMatch,
+    IN ULONG        Action,
+    IN PVOID        TargetContext
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlNotifyInitializeSync (
+    IN PNOTIFY_SYNC *NotifySync
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlNotifyUninitializeSync (
+    IN PNOTIFY_SYNC *NotifySync
+);
+
+#if (VER_PRODUCTBUILD >= 2195)
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlNotifyVolumeEvent (
+    IN PFILE_OBJECT FileObject,
+    IN ULONG        EventCode
+);
+
+#endif /* (VER_PRODUCTBUILD >= 2195) */
+
+NTKERNELAPI
+ULONG
+NTAPI
+FsRtlNumberOfRunsInBaseMcb (
+    IN PBASE_MCB Mcb
+);
+
+NTKERNELAPI
+ULONG
+NTAPI
+FsRtlNumberOfRunsInLargeMcb (
+    IN PLARGE_MCB Mcb
+);
+
+NTKERNELAPI
+ULONG
+NTAPI
+FsRtlNumberOfRunsInMcb (
+    IN PMCB Mcb
+);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlOplockFsctrl (
+    IN POPLOCK  Oplock,
+    IN PIRP     Irp,
+    IN ULONG    OpenCount
+);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlOplockIsFastIoPossible (
+    IN POPLOCK Oplock
+);
+
+typedef VOID
+(NTAPI *PFSRTL_STACK_OVERFLOW_ROUTINE) (
+    IN PVOID    Context,
+    IN PKEVENT  Event
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlPostPagingFileStackOverflow (
+    IN PVOID                          Context,
+    IN PKEVENT                        Event,
+    IN PFSRTL_STACK_OVERFLOW_ROUTINE  StackOverflowRoutine
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlPostStackOverflow (
+    IN PVOID                          Context,
+    IN PKEVENT                        Event,
+    IN PFSRTL_STACK_OVERFLOW_ROUTINE  StackOverflowRoutine
+);
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+FsRtlRegisterUncProvider (
+    IN OUT PHANDLE      MupHandle,
+    IN PUNICODE_STRING  RedirectorDeviceName,
+    IN BOOLEAN          MailslotsSupported
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlRemoveBaseMcbEntry (
+    IN PBASE_MCB  Mcb,
+    IN LONGLONG   Vbn,
+    IN LONGLONG   SectorCount
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlRemoveLargeMcbEntry (
+    IN PLARGE_MCB  Mcb,
+    IN LONGLONG    Vbn,
+    IN LONGLONG    SectorCount
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlRemoveMcbEntry (
+    IN PMCB   Mcb,
+    IN VBN    Vbn,
+    IN ULONG  SectorCount
+);
+
+NTKERNELAPI
+PFSRTL_PER_STREAM_CONTEXT
+NTAPI
+FsRtlRemovePerStreamContext (
+    IN PFSRTL_ADVANCED_FCB_HEADER  StreamContext,
+    IN PVOID                       OwnerId OPTIONAL,
+    IN PVOID                       InstanceId OPTIONAL
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlResetBaseMcb (
+    IN PBASE_MCB Mcb
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlResetLargeMcb (
+    IN PLARGE_MCB  Mcb,
+    IN BOOLEAN     SelfSynchronized
+);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlSplitBaseMcb (
+    IN PBASE_MCB  Mcb,
+    IN LONGLONG   Vbn,
+    IN LONGLONG   Amount
+);
+
+NTKERNELAPI
+BOOLEAN
+NTAPI
+FsRtlSplitLargeMcb (
+    IN PLARGE_MCB  Mcb,
+    IN LONGLONG    Vbn,
+    IN LONGLONG    Amount
+);
+
+#define FsRtlSupportsPerStreamContexts(FO) (                       \
+    (BOOLEAN)((NULL != FsRtlGetPerStreamContextPointer(FO) &&     \
+              FlagOn(FsRtlGetPerStreamContextPointer(FO)->Flags2, \
+              FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS))               \
+)
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlTruncateBaseMcb (
+    IN PBASE_MCB  Mcb,
+    IN LONGLONG   Vbn
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlTruncateLargeMcb (
+    IN PLARGE_MCB  Mcb,
+    IN LONGLONG    Vbn
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlTruncateMcb (
+    IN PMCB  Mcb,
+    IN VBN   Vbn
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlUninitializeBaseMcb (
+    IN PBASE_MCB Mcb
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlUninitializeLargeMcb (
+    IN PLARGE_MCB Mcb
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlUninitializeMcb (
+    IN PMCB Mcb
+);
+
+NTKERNELAPI
+VOID
+NTAPI
+FsRtlUninitializeOplock (
+    IN OUT POPLOCK Oplock
+);
+
 NTKERNELAPI
 NTSTATUS
 NTAPI
@@ -9401,6 +8969,23 @@ ObReferenceObjectByName (
     OUT PVOID           *Object
 );
 
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+
+NTKERNELAPI
+NTSTATUS
+NTAPI
+PsAssignImpersonationToken(
+  IN PETHREAD Thread,
+  IN HANDLE Token OPTIONAL);
+
+NTKERNELAPI
+HANDLE
+NTAPI
+PsReferencePrimaryToken(
+  IN OUT PEPROCESS Process);
+
+#endif
+
 #define PsDereferenceImpersonationToken(T)  \
             {if (ARGUMENT_PRESENT(T)) {     \
                 (ObDereferenceObject((T))); \
@@ -9418,6 +9003,14 @@ PsLookupProcessThreadByCid (
     OUT PETHREAD    *Thread
 );
 
+NTSYSAPI
+VOID
+NTAPI
+RtlSecondsSince1970ToTime (
+    IN ULONG            SecondsSince1970,
+    OUT PLARGE_INTEGER  Time
+);
+
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -9428,6 +9021,105 @@ RtlSetSaclSecurityDescriptor (
     IN BOOLEAN                  SaclDefaulted
 );
 
+NTSYSAPI
+NTSTATUS
+NTAPI
+RtlUnicodeStringToCountedOemString (
+    IN OUT POEM_STRING  DestinationString,
+    IN PCUNICODE_STRING SourceString,
+    IN BOOLEAN          AllocateDestinationString
+);
+
+/* RTL Splay Tree Functions */
+NTSYSAPI
+PRTL_SPLAY_LINKS
+NTAPI
+RtlSplay(PRTL_SPLAY_LINKS Links);
+
+NTSYSAPI
+PRTL_SPLAY_LINKS
+NTAPI
+RtlDelete(PRTL_SPLAY_LINKS Links);
+
+NTSYSAPI
+VOID
+NTAPI
+RtlDeleteNoSplay(
+    PRTL_SPLAY_LINKS Links,
+    PRTL_SPLAY_LINKS *Root
+);
+
+NTSYSAPI
+PRTL_SPLAY_LINKS
+NTAPI
+RtlSubtreeSuccessor(PRTL_SPLAY_LINKS Links);
+
+NTSYSAPI
+PRTL_SPLAY_LINKS
+NTAPI
+RtlSubtreePredecessor(PRTL_SPLAY_LINKS Links);
+
+NTSYSAPI
+PRTL_SPLAY_LINKS
+NTAPI
+RtlRealSuccessor(PRTL_SPLAY_LINKS Links);
+
+NTSYSAPI
+PRTL_SPLAY_LINKS
+NTAPI
+RtlRealPredecessor(PRTL_SPLAY_LINKS Links);
+
+#define RtlIsLeftChild(Links) \
+    (RtlLeftChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
+
+#define RtlIsRightChild(Links) \
+    (RtlRightChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links))
+
+#define RtlRightChild(Links) \
+    ((PRTL_SPLAY_LINKS)(Links))->RightChild
+
+#define RtlIsRoot(Links) \
+    (RtlParent(Links) == (PRTL_SPLAY_LINKS)(Links))
+
+#define RtlLeftChild(Links) \
+    ((PRTL_SPLAY_LINKS)(Links))->LeftChild
+
+#define RtlParent(Links) \
+    ((PRTL_SPLAY_LINKS)(Links))->Parent
+
+#define RtlInitializeSplayLinks(Links)                  \
+    {                                                   \
+        PRTL_SPLAY_LINKS _SplayLinks;                   \
+        _SplayLinks = (PRTL_SPLAY_LINKS)(Links);        \
+        _SplayLinks->Parent = _SplayLinks;              \
+        _SplayLinks->LeftChild = NULL;                  \
+        _SplayLinks->RightChild = NULL;                 \
+    }
+
+#define RtlInsertAsLeftChild(ParentLinks,ChildLinks)    \
+    {                                                   \
+        PRTL_SPLAY_LINKS _SplayParent;                  \
+        PRTL_SPLAY_LINKS _SplayChild;                   \
+        _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
+        _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks);   \
+        _SplayParent->LeftChild = _SplayChild;          \
+        _SplayChild->Parent = _SplayParent;             \
+    }
+
+#define RtlInsertAsRightChild(ParentLinks,ChildLinks)   \
+    {                                                   \
+        PRTL_SPLAY_LINKS _SplayParent;                  \
+        PRTL_SPLAY_LINKS _SplayChild;                   \
+        _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \
+        _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks);   \
+        _SplayParent->RightChild = _SplayChild;         \
+        _SplayChild->Parent = _SplayParent;             \
+    }
+
+//
+// RTL time functions
+//
+
 #define SeEnableAccessToExports() SeExports = *(PSE_EXPORTS *)SeExports;
 
 #if (VER_PRODUCTBUILD >= 2195)
@@ -9453,6 +9145,18 @@ ZwAlertThread (
     IN HANDLE ThreadHandle
 );
 
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwAllocateVirtualMemory (
+    IN HANDLE       ProcessHandle,
+    IN OUT PVOID    *BaseAddress,
+    IN ULONG_PTR    ZeroBits,
+    IN OUT PSIZE_T  RegionSize,
+    IN ULONG        AllocationType,
+    IN ULONG        Protect
+);
+
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -9498,6 +9202,19 @@ ZwCloseObjectAuditAlarm (
     IN BOOLEAN          GenerateOnClose
 );
 
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwCreateSection (
+    OUT PHANDLE             SectionHandle,
+    IN ACCESS_MASK          DesiredAccess,
+    IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
+    IN PLARGE_INTEGER       MaximumSize OPTIONAL,
+    IN ULONG                SectionPageProtection,
+    IN ULONG                AllocationAttributes,
+    IN HANDLE               FileHandle OPTIONAL
+);
+
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -9508,6 +9225,71 @@ ZwCreateSymbolicLinkObject (
     IN PUNICODE_STRING      TargetName
 );
 
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwDeleteFile (
+    IN POBJECT_ATTRIBUTES ObjectAttributes
+);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwDeleteValueKey (
+    IN HANDLE           Handle,
+    IN PUNICODE_STRING  Name
+);
+
+
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwDeviceIoControlFile (
+  IN HANDLE FileHandle,
+  IN HANDLE Event OPTIONAL,
+  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
+  IN PVOID ApcContext OPTIONAL,
+  OUT PIO_STATUS_BLOCK IoStatusBlock,
+  IN ULONG IoControlCode,
+  IN PVOID InputBuffer OPTIONAL,
+  IN ULONG InputBufferLength,
+  OUT PVOID OutputBuffer OPTIONAL,
+  IN ULONG OutputBufferLength);
+#endif
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwDisplayString (
+    IN PUNICODE_STRING String
+);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwDuplicateObject (
+    IN HANDLE       SourceProcessHandle,
+    IN HANDLE       SourceHandle,
+    IN HANDLE       TargetProcessHandle OPTIONAL,
+    OUT PHANDLE     TargetHandle OPTIONAL,
+    IN ACCESS_MASK  DesiredAccess,
+    IN ULONG        HandleAttributes,
+    IN ULONG        Options
+);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwDuplicateToken (
+    IN HANDLE               ExistingTokenHandle,
+    IN ACCESS_MASK          DesiredAccess,
+    IN POBJECT_ATTRIBUTES   ObjectAttributes,
+    IN BOOLEAN              EffectiveOnly,
+    IN TOKEN_TYPE           TokenType,
+    OUT PHANDLE             NewTokenHandle
+);
+
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -9527,6 +9309,46 @@ ZwFlushBuffersFile(
 
 #if (VER_PRODUCTBUILD >= 2195)
 
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwFlushVirtualMemory (
+    IN HANDLE               ProcessHandle,
+    IN OUT PVOID            *BaseAddress,
+    IN OUT PULONG           FlushSize,
+    OUT PIO_STATUS_BLOCK    IoStatusBlock
+);
+
+#endif /* (VER_PRODUCTBUILD >= 2195) */
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwFreeVirtualMemory (
+    IN HANDLE       ProcessHandle,
+    IN OUT PVOID    *BaseAddress,
+    IN OUT PSIZE_T  RegionSize,
+    IN ULONG        FreeType
+);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwFsControlFile (
+    IN HANDLE               FileHandle,
+    IN HANDLE               Event OPTIONAL,
+    IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
+    IN PVOID                ApcContext OPTIONAL,
+    OUT PIO_STATUS_BLOCK    IoStatusBlock,
+    IN ULONG                FsControlCode,
+    IN PVOID                InputBuffer OPTIONAL,
+    IN ULONG                InputBufferLength,
+    OUT PVOID               OutputBuffer OPTIONAL,
+    IN ULONG                OutputBufferLength
+);
+
+#if (VER_PRODUCTBUILD >= 2195)
+
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -9539,6 +9361,14 @@ ZwInitiatePowerAction (
 
 #endif /* (VER_PRODUCTBUILD >= 2195) */
 
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwLoadDriver (
+    /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
+    IN PUNICODE_STRING RegistryPath
+);
+
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -9547,6 +9377,41 @@ ZwLoadKey (
     IN POBJECT_ATTRIBUTES FileObjectAttributes
 );
 
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwNotifyChangeKey (
+    IN HANDLE               KeyHandle,
+    IN HANDLE               EventHandle OPTIONAL,
+    IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
+    IN PVOID                ApcContext OPTIONAL,
+    OUT PIO_STATUS_BLOCK    IoStatusBlock,
+    IN ULONG                NotifyFilter,
+    IN BOOLEAN              WatchSubtree,
+    IN PVOID                Buffer,
+    IN ULONG                BufferLength,
+    IN BOOLEAN              Asynchronous
+);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwOpenDirectoryObject (
+    OUT PHANDLE             DirectoryHandle,
+    IN ACCESS_MASK          DesiredAccess,
+    IN POBJECT_ATTRIBUTES   ObjectAttributes
+);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwOpenProcess (
+    OUT PHANDLE             ProcessHandle,
+    IN ACCESS_MASK          DesiredAccess,
+    IN POBJECT_ATTRIBUTES   ObjectAttributes,
+    IN PCLIENT_ID           ClientId OPTIONAL
+);
+
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -9576,6 +9441,21 @@ ZwOpenThreadToken (
     OUT PHANDLE     TokenHandle
 );
 
+#if (VER_PRODUCTBUILD >= 2195)
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwPowerInformation (
+    IN POWER_INFORMATION_LEVEL  PowerInformationLevel,
+    IN PVOID                    InputBuffer OPTIONAL,
+    IN ULONG                    InputBufferLength,
+    OUT PVOID                   OutputBuffer OPTIONAL,
+    IN ULONG                    OutputBufferLength
+);
+
+#endif /* (VER_PRODUCTBUILD >= 2195) */
+
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -9592,6 +9472,23 @@ ZwQueryDefaultLocale (
     OUT PLCID   Locale
 );
 
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwQueryDirectoryFile (
+    IN HANDLE                   FileHandle,
+    IN HANDLE                   Event OPTIONAL,
+    IN PIO_APC_ROUTINE          ApcRoutine OPTIONAL,
+    IN PVOID                    ApcContext OPTIONAL,
+    OUT PIO_STATUS_BLOCK        IoStatusBlock,
+    OUT PVOID                   FileInformation,
+    IN ULONG                    Length,
+    IN FILE_INFORMATION_CLASS   FileInformationClass,
+    IN BOOLEAN                  ReturnSingleEntry,
+    IN PUNICODE_STRING          FileName OPTIONAL,
+    IN BOOLEAN                  RestartScan
+);
+
 #if (VER_PRODUCTBUILD >= 2195)
 
 NTSYSAPI
@@ -9607,6 +9504,21 @@ ZwQueryDirectoryObject (
     OUT PULONG      ReturnLength OPTIONAL
 );
 
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwQueryEaFile (
+    IN HANDLE               FileHandle,
+    OUT PIO_STATUS_BLOCK    IoStatusBlock,
+    OUT PVOID               Buffer,
+    IN ULONG                Length,
+    IN BOOLEAN              ReturnSingleEntry,
+    IN PVOID                EaList OPTIONAL,
+    IN ULONG                EaListLength,
+    IN PULONG               EaIndex OPTIONAL,
+    IN BOOLEAN              RestartScan
+);
+
 #endif /* (VER_PRODUCTBUILD >= 2195) */
 
 NTSYSAPI
@@ -9620,6 +9532,39 @@ ZwQueryInformationProcess (
     OUT PULONG          ReturnLength OPTIONAL
 );
 
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwQueryInformationToken (
+    IN HANDLE                   TokenHandle,
+    IN TOKEN_INFORMATION_CLASS  TokenInformationClass,
+    OUT PVOID                   TokenInformation,
+    IN ULONG                    Length,
+    OUT PULONG                  ResultLength
+);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwQuerySecurityObject (
+    IN HANDLE                   FileHandle,
+    IN SECURITY_INFORMATION     SecurityInformation,
+    OUT PSECURITY_DESCRIPTOR    SecurityDescriptor,
+    IN ULONG                    Length,
+    OUT PULONG                  ResultLength
+);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwQueryVolumeInformationFile (
+    IN HANDLE               FileHandle,
+    OUT PIO_STATUS_BLOCK    IoStatusBlock,
+    OUT PVOID               FsInformation,
+    IN ULONG                Length,
+    IN FS_INFORMATION_CLASS FsInformationClass
+);
+
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -9675,8 +9620,26 @@ ZwSetDefaultUILanguage (
     IN LANGID LanguageId
 );
 
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwSetEaFile (
+    IN HANDLE               FileHandle,
+    OUT PIO_STATUS_BLOCK    IoStatusBlock,
+    OUT PVOID               Buffer,
+    IN ULONG                Length
+);
+
 #endif /* (VER_PRODUCTBUILD >= 2195) */
 
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwSetEvent (
+    IN HANDLE   EventHandle,
+    OUT PLONG   PreviousState OPTIONAL
+);
+
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -9687,6 +9650,19 @@ ZwSetInformationProcess (
     IN ULONG            ProcessInformationLength
 );
 
+#if (VER_PRODUCTBUILD >= 2195)
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwSetSecurityObject (
+    IN HANDLE               Handle,
+    IN SECURITY_INFORMATION SecurityInformation,
+    IN PSECURITY_DESCRIPTOR SecurityDescriptor
+);
+
+#endif /* (VER_PRODUCTBUILD >= 2195) */
+
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -9695,6 +9671,37 @@ ZwSetSystemTime (
     OUT PLARGE_INTEGER  OldTime OPTIONAL
 );
 
+#if (VER_PRODUCTBUILD >= 2195)
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwSetVolumeInformationFile (
+    IN HANDLE               FileHandle,
+    OUT PIO_STATUS_BLOCK    IoStatusBlock,
+    IN PVOID                FsInformation,
+    IN ULONG                Length,
+    IN FS_INFORMATION_CLASS FsInformationClass
+);
+
+#endif /* (VER_PRODUCTBUILD >= 2195) */
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwTerminateProcess (
+    IN HANDLE   ProcessHandle OPTIONAL,
+    IN NTSTATUS ExitStatus
+);
+
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwUnloadDriver (
+    /* "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\<DriverName>" */
+    IN PUNICODE_STRING RegistryPath
+);
+
 NTSYSAPI
 NTSTATUS
 NTAPI
@@ -9702,6 +9709,16 @@ ZwUnloadKey (
     IN POBJECT_ATTRIBUTES KeyObjectAttributes
 );
 
+#if (NTDDI_VERSION >= NTDDI_WIN2K)
+NTSYSAPI
+NTSTATUS
+NTAPI
+ZwWaitForSingleObject (
+  IN HANDLE Handle,
+  IN BOOLEAN Alertable,
+  IN PLARGE_INTEGER Timeout OPTIONAL);
+#endif
+
 NTSYSAPI
 NTSTATUS
 NTAPI
index 8df9847..e008a2d 100644 (file)
@@ -394,33 +394,22 @@ typedef struct _IMAGE_NT_HEADERS64 {
     ULONG Signature;
     IMAGE_FILE_HEADER FileHeader;
     IMAGE_OPTIONAL_HEADER64 OptionalHeader;
-} IMAGE_NT_HEADERS64;
+} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;
 
 typedef struct _IMAGE_NT_HEADERS {
     ULONG Signature;
     IMAGE_FILE_HEADER FileHeader;
     IMAGE_OPTIONAL_HEADER32 OptionalHeader;
-} IMAGE_NT_HEADERS32;
+} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;
 
 #ifdef _WIN64
 typedef IMAGE_NT_HEADERS64                  IMAGE_NT_HEADERS;
-#else
-typedef IMAGE_NT_HEADERS32                  IMAGE_NT_HEADERS;
-#endif
-
-#ifndef _NTDDK_
-
-typedef struct _IMAGE_NT_HEADERS *PIMAGE_NT_HEADERS32;
-typedef struct _IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64;
-
-#ifdef _WIN64
 typedef PIMAGE_NT_HEADERS64                 PIMAGE_NT_HEADERS;
 #else
+typedef IMAGE_NT_HEADERS32                  IMAGE_NT_HEADERS;
 typedef PIMAGE_NT_HEADERS32                 PIMAGE_NT_HEADERS;
 #endif
 
-#endif /* _NTDDK_ */
-
 //
 // Retreives the first image section header from the Nt Header
 //
index 3a52323..ee2f034 100644 (file)
 #include <excpt.h>
 #include <ntdef.h>
 #include <ntstatus.h>
-#include <ntiologc.h>
 
 #ifndef GUID_DEFINED
 #include <guiddef.h>
 #endif
 
-#ifdef _MAC
-#ifndef _INC_STRING
-#include <string.h>
-#endif /* _INC_STRING */
-#else
-#include <string.h>
-#endif /* _MAC */
-
 #ifndef _KTMTYPES_
 typedef GUID UOW, *PUOW;
 #endif
 
-typedef GUID *PGUID;
-
 #if (NTDDI_VERSION >= NTDDI_WINXP)
 #include <dpfilter.h>
 #endif
@@ -144,6 +133,8 @@ struct _IO_RESOURCE_DESCRIPTOR;
 typedef struct _OBJECT_TYPE *POBJECT_TYPE;
 typedef struct _HAL_DISPATCH_TABLE *PHAL_DISPATCH_TABLE;
 typedef struct _HAL_PRIVATE_DISPATCH_TABLE *PHAL_PRIVATE_DISPATCH_TABLE;
+typedef struct _DEVICE_HANDLER_OBJECT *PDEVICE_HANDLER_OBJECT;
+typedef struct _ADAPTER_OBJECT *PADAPTER_OBJECT; 
 typedef struct _CALLBACK_OBJECT *PCALLBACK_OBJECT;
 typedef struct _EPROCESS *PEPROCESS;
 typedef struct _ETHREAD *PETHREAD;
@@ -153,42 +144,6 @@ typedef struct _KPROCESS *PKPROCESS;
 typedef struct _KTHREAD *PKTHREAD, *PRKTHREAD;
 typedef struct _CONTEXT *PCONTEXT;
 
-#if defined(USE_DMA_MACROS) && !defined(_NTHAL_) && ( defined(_NTDDK_) || defined(_NTDRIVER_) || defined(_NTOSP_))
-typedef struct _DMA_ADAPTER *PADAPTER_OBJECT;
-#elif defined(_WDM_INCLUDED_)
-typedef struct _DMA_ADAPTER *PADAPTER_OBJECT;
-#else
-typedef struct _ADAPTER_OBJECT *PADAPTER_OBJECT; 
-#endif
-
-#ifndef DEFINE_GUIDEX
-#ifdef _MSC_VER
-#define DEFINE_GUIDEX(name) EXTERN_C const CDECL GUID name
-#else
-#define DEFINE_GUIDEX(name) EXTERN_C const GUID name
-#endif
-#endif /* DEFINE_GUIDEX */
-
-#ifndef STATICGUIDOF
-#define STATICGUIDOF(guid) STATIC_##guid
-#endif
-
-/* GUID Comparison */
-#ifndef __IID_ALIGNED__
-#define __IID_ALIGNED__
-#ifdef __cplusplus
-inline int IsEqualGUIDAligned(REFGUID guid1, REFGUID guid2)
-{
-    return ( (*(PLONGLONG)(&guid1) == *(PLONGLONG)(&guid2)) && 
-             (*((PLONGLONG)(&guid1) + 1) == *((PLONGLONG)(&guid2) + 1)) );
-}
-#else
-#define IsEqualGUIDAligned(guid1, guid2) \
-           ( (*(PLONGLONG)(guid1) == *(PLONGLONG)(guid2)) && \
-             (*((PLONGLONG)(guid1) + 1) == *((PLONGLONG)(guid2) + 1)) )
-#endif /* __cplusplus */
-#endif /* !__IID_ALIGNED__ */
-
 
 /******************************************************************************
  *                           INTERLOCKED Functions                            *
@@ -527,29 +482,17 @@ typedef SLIST_HEADER SLIST_HEADER32, *PSLIST_HEADER32;
 
 #endif /* _SLIST_HEADER_ */
 
-/* MS definition is broken! */
-extern BOOLEAN NTSYSAPI NlsMbCodePageTag;
-extern BOOLEAN NTSYSAPI NlsMbOemCodePageTag;
+
+/* HACK HACK HACK - GCC (or perhaps LD) is messing this up */
+#if defined(_NTSYSTEM_) || defined(__GNUC__)
 #define NLS_MB_CODE_PAGE_TAG NlsMbCodePageTag
 #define NLS_MB_OEM_CODE_PAGE_TAG NlsMbOemCodePageTag
-
-#define SHORT_LEAST_SIGNIFICANT_BIT       0
-#define SHORT_MOST_SIGNIFICANT_BIT        1
-
-#define LONG_LEAST_SIGNIFICANT_BIT        0
-#define LONG_3RD_MOST_SIGNIFICANT_BIT     1
-#define LONG_2ND_MOST_SIGNIFICANT_BIT     2
-#define LONG_MOST_SIGNIFICANT_BIT         3
-
-#define RTLVERLIB_DDI(x) Wdmlib##x
-
-typedef BOOLEAN
-(*PFN_RTL_IS_NTDDI_VERSION_AVAILABLE)(
-  IN ULONG Version);
-
-typedef BOOLEAN
-(*PFN_RTL_IS_SERVICE_PACK_VERSION_INSTALLED)(
-  IN ULONG Version);
+#else
+#define NLS_MB_CODE_PAGE_TAG (*NlsMbCodePageTag)
+#define NLS_MB_OEM_CODE_PAGE_TAG (*NlsMbOemCodePageTag)
+#endif /* _NT_SYSTEM */
+extern BOOLEAN NTSYSAPI NLS_MB_CODE_PAGE_TAG;
+extern BOOLEAN NTSYSAPI NLS_MB_OEM_CODE_PAGE_TAG;
 
 
 /******************************************************************************
@@ -560,116 +503,18 @@ typedef UCHAR KIRQL, *PKIRQL;
 typedef CCHAR KPROCESSOR_MODE;
 typedef LONG KPRIORITY;
 
+typedef ULONG EXECUTION_STATE;
+
 typedef enum _MODE {
   KernelMode,
   UserMode,
   MaximumMode
 } MODE;
 
-#define CACHE_FULLY_ASSOCIATIVE 0xFF
-#define MAXIMUM_SUSPEND_COUNT   MAXCHAR
-
-#define EVENT_QUERY_STATE (0x0001)
-#define EVENT_MODIFY_STATE (0x0002)
-#define EVENT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3)
-
-#define LTP_PC_SMT 0x1
-
 #if (NTDDI_VERSION < NTDDI_WIN7) || defined(_X86_) || !defined(NT_PROCESSOR_GROUPS)
 #define SINGLE_GROUP_LEGACY_API        1
 #endif
 
-#define SEMAPHORE_QUERY_STATE (0x0001)
-#define SEMAPHORE_MODIFY_STATE (0x0002)
-#define SEMAPHORE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3)
-
-typedef enum _LOGICAL_PROCESSOR_RELATIONSHIP {
-  RelationProcessorCore,
-  RelationNumaNode,
-  RelationCache,
-  RelationProcessorPackage,
-  RelationGroup,
-  RelationAll = 0xffff
-} LOGICAL_PROCESSOR_RELATIONSHIP;
-
-typedef enum _PROCESSOR_CACHE_TYPE {
-  CacheUnified,
-  CacheInstruction,
-  CacheData,
-  CacheTrace
-} PROCESSOR_CACHE_TYPE;
-
-typedef struct _CACHE_DESCRIPTOR {
-  UCHAR Level;
-  UCHAR Associativity;
-  USHORT LineSize;
-  ULONG Size;
-  PROCESSOR_CACHE_TYPE Type;
-} CACHE_DESCRIPTOR, *PCACHE_DESCRIPTOR;
-
-typedef struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION {
-  ULONG_PTR ProcessorMask;
-  LOGICAL_PROCESSOR_RELATIONSHIP Relationship;
-  union {
-    struct {
-      UCHAR Flags;
-    } ProcessorCore;
-    struct {
-      ULONG NodeNumber;
-    } NumaNode;
-    CACHE_DESCRIPTOR Cache;
-    ULONGLONG  Reserved[2];
-  } DUMMYUNIONNAME;
-} SYSTEM_LOGICAL_PROCESSOR_INFORMATION, *PSYSTEM_LOGICAL_PROCESSOR_INFORMATION;
-
-typedef struct _PROCESSOR_RELATIONSHIP {
-  UCHAR Flags;
-  UCHAR Reserved[21];
-  USHORT GroupCount;
-  GROUP_AFFINITY GroupMask[ANYSIZE_ARRAY];
-} PROCESSOR_RELATIONSHIP, *PPROCESSOR_RELATIONSHIP;
-
-typedef struct _NUMA_NODE_RELATIONSHIP {
-  ULONG NodeNumber;
-  UCHAR Reserved[20];
-  GROUP_AFFINITY GroupMask;
-} NUMA_NODE_RELATIONSHIP, *PNUMA_NODE_RELATIONSHIP;
-
-typedef struct _CACHE_RELATIONSHIP {
-  UCHAR Level;
-  UCHAR Associativity;
-  USHORT LineSize;
-  ULONG CacheSize;
-  PROCESSOR_CACHE_TYPE Type;
-  UCHAR Reserved[20];
-  GROUP_AFFINITY GroupMask;
-} CACHE_RELATIONSHIP, *PCACHE_RELATIONSHIP;
-
-typedef struct _PROCESSOR_GROUP_INFO {
-  UCHAR MaximumProcessorCount;
-  UCHAR ActiveProcessorCount;
-  UCHAR Reserved[38];
-  KAFFINITY ActiveProcessorMask;
-} PROCESSOR_GROUP_INFO, *PPROCESSOR_GROUP_INFO;
-
-typedef struct _GROUP_RELATIONSHIP {
-  USHORT MaximumGroupCount;
-  USHORT ActiveGroupCount;
-  UCHAR Reserved[20];
-  PROCESSOR_GROUP_INFO GroupInfo[ANYSIZE_ARRAY];
-} GROUP_RELATIONSHIP, *PGROUP_RELATIONSHIP;
-
-typedef struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX {
-  LOGICAL_PROCESSOR_RELATIONSHIP Relationship;
-  ULONG Size;
-  union {
-    PROCESSOR_RELATIONSHIP Processor;
-    NUMA_NODE_RELATIONSHIP NumaNode;
-    CACHE_RELATIONSHIP Cache;
-    GROUP_RELATIONSHIP Group;
-  } DUMMYUNIONNAME;
-} SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX, *PSYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX;;
-
 /* Processor features */
 #define PF_FLOATING_POINT_PRECISION_ERRATA  0   
 #define PF_FLOATING_POINT_EMULATED          1   
@@ -690,6 +535,7 @@ typedef struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX {
 #define PF_CHANNELS_ENABLED                16   
 #define PF_XSAVE_ENABLED                   17   
 
+#define MAXIMUM_SUPPORTED_EXTENSION  512
 #define MAXIMUM_WAIT_OBJECTS              64
 
 #define ASSERT_APC(Object) NT_ASSERT((Object)->Type == ApcObject)
@@ -757,23 +603,6 @@ typedef struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX {
 #define EXCEPTION_NONCONTINUABLE 1
 #define EXCEPTION_MAXIMUM_PARAMETERS 15
 
-#define EXCEPTION_DIVIDED_BY_ZERO       0
-#define EXCEPTION_DEBUG                 1
-#define EXCEPTION_NMI                   2
-#define EXCEPTION_INT3                  3
-#define EXCEPTION_BOUND_CHECK           5
-#define EXCEPTION_INVALID_OPCODE        6
-#define EXCEPTION_NPX_NOT_AVAILABLE     7
-#define EXCEPTION_DOUBLE_FAULT          8
-#define EXCEPTION_NPX_OVERRUN           9
-#define EXCEPTION_INVALID_TSS           0x0A
-#define EXCEPTION_SEGMENT_NOT_PRESENT   0x0B
-#define EXCEPTION_STACK_FAULT           0x0C
-#define EXCEPTION_GP_FAULT              0x0D
-#define EXCEPTION_RESERVED_TRAP         0x0F
-#define EXCEPTION_NPX_ERROR             0x010
-#define EXCEPTION_ALIGNMENT_CHECK       0x011
-
 typedef struct _EXCEPTION_RECORD {
     NTSTATUS ExceptionCode;
     ULONG ExceptionFlags;
@@ -825,42 +654,6 @@ typedef VOID
   IN ULONG  ReasonSpecificDataLength);
 typedef KBUGCHECK_REASON_CALLBACK_ROUTINE *PKBUGCHECK_REASON_CALLBACK_ROUTINE;
 
-typedef struct _KBUGCHECK_ADD_PAGES {
-  IN OUT PVOID Context;
-  IN OUT ULONG Flags;
-  IN ULONG BugCheckCode;
-  OUT ULONG_PTR Address;
-  OUT ULONG_PTR Count;
-} KBUGCHECK_ADD_PAGES, *PKBUGCHECK_ADD_PAGES;
-
-typedef struct _KBUGCHECK_SECONDARY_DUMP_DATA {
-  IN PVOID InBuffer;
-  IN ULONG InBufferLength;
-  IN ULONG MaximumAllowed;
-  OUT GUID Guid;
-  OUT PVOID OutBuffer;
-  OUT ULONG OutBufferLength;
-} KBUGCHECK_SECONDARY_DUMP_DATA, *PKBUGCHECK_SECONDARY_DUMP_DATA;
-
-typedef enum _KBUGCHECK_DUMP_IO_TYPE {
-  KbDumpIoInvalid,
-  KbDumpIoHeader,
-  KbDumpIoBody,
-  KbDumpIoSecondaryData,
-  KbDumpIoComplete
-} KBUGCHECK_DUMP_IO_TYPE;
-
-typedef struct _KBUGCHECK_DUMP_IO {
-  IN ULONG64 Offset;
-  IN PVOID Buffer;
-  IN ULONG BufferLength;
-  IN KBUGCHECK_DUMP_IO_TYPE Type;
-} KBUGCHECK_DUMP_IO, *PKBUGCHECK_DUMP_IO;
-
-#define KB_ADD_PAGES_FLAG_VIRTUAL_ADDRESS         0x00000001UL
-#define KB_ADD_PAGES_FLAG_PHYSICAL_ADDRESS        0x00000002UL
-#define KB_ADD_PAGES_FLAG_ADDITIONAL_RANGES_EXIST 0x80000000UL
-
 typedef struct _KBUGCHECK_REASON_CALLBACK_RECORD {
   LIST_ENTRY  Entry;
   PKBUGCHECK_REASON_CALLBACK_ROUTINE  CallbackRoutine;
@@ -900,31 +693,20 @@ typedef BOOLEAN
     IN BOOLEAN Handled);
 typedef NMI_CALLBACK *PNMI_CALLBACK;
 
-typedef enum _KE_PROCESSOR_CHANGE_NOTIFY_STATE {
-  KeProcessorAddStartNotify = 0,
-  KeProcessorAddCompleteNotify,
-  KeProcessorAddFailureNotify
-} KE_PROCESSOR_CHANGE_NOTIFY_STATE;
-
-typedef struct _KE_PROCESSOR_CHANGE_NOTIFY_CONTEXT {
-  KE_PROCESSOR_CHANGE_NOTIFY_STATE State;
-  ULONG NtNumber;
-  NTSTATUS Status;
-#if (NTDDI_VERSION >= NTDDI_WIN7)
-  PROCESSOR_NUMBER ProcNumber;
-#endif
-} KE_PROCESSOR_CHANGE_NOTIFY_CONTEXT, *PKE_PROCESSOR_CHANGE_NOTIFY_CONTEXT;
-
-typedef VOID
-(NTAPI PROCESSOR_CALLBACK_FUNCTION)(
-  IN PVOID CallbackContext,
-  IN PKE_PROCESSOR_CHANGE_NOTIFY_CONTEXT ChangeContext,
-  IN OUT PNTSTATUS OperationStatus);
-typedef PROCESSOR_CALLBACK_FUNCTION *PPROCESSOR_CALLBACK_FUNCTION;
-
-#define KE_PROCESSOR_CHANGE_ADD_EXISTING         1
-
-#define INVALID_PROCESSOR_INDEX     0xffffffff
+typedef enum _TRACE_INFORMATION_CLASS {
+  TraceIdClass,
+  TraceHandleClass,
+  TraceEnableFlagsClass,
+  TraceEnableLevelClass,
+  GlobalLoggerHandleClass,
+  EventLoggerHandleClass,
+  AllLoggerHandlesClass,
+  TraceHandleByNameClass,
+  LoggerEventsLostClass,
+  TraceSessionSettingsClass,
+  LoggerEventsLoggedClass,
+  MaxTraceInformationClass
+} TRACE_INFORMATION_CLASS;
 
 typedef enum _KINTERRUPT_POLARITY {
   InterruptPolarityUnknown,
@@ -1021,32 +803,36 @@ typedef enum _KINTERRUPT_MODE {
 
 #define THREAD_WAIT_OBJECTS 3
 
-typedef VOID
-(NTAPI KSTART_ROUTINE)(
-  IN PVOID StartContext);
-typedef KSTART_ROUTINE *PKSTART_ROUTINE;
-
 typedef VOID
 (NTAPI *PKINTERRUPT_ROUTINE)(
   VOID);
 
-typedef BOOLEAN
-(NTAPI KSERVICE_ROUTINE)(
-  IN struct _KINTERRUPT *Interrupt,
-  IN PVOID ServiceContext);
-typedef KSERVICE_ROUTINE *PKSERVICE_ROUTINE;
-
-typedef BOOLEAN
-(NTAPI KMESSAGE_SERVICE_ROUTINE)(
-  IN struct _KINTERRUPT *Interrupt,
-  IN PVOID ServiceContext,
-  IN ULONG MessageID);
-typedef KMESSAGE_SERVICE_ROUTINE *PKMESSAGE_SERVICE_ROUTINE;
-
 typedef enum _KD_OPTION {
     KD_OPTION_SET_BLOCK_ENABLE,
 } KD_OPTION;
 
+typedef enum _INTERFACE_TYPE {
+  InterfaceTypeUndefined = -1,
+  Internal,
+  Isa,
+  Eisa,
+  MicroChannel,