-typedef struct _OBJDIR_INFORMATION {
- UNICODE_STRING ObjectName;
- UNICODE_STRING ObjectTypeName; // Directory, Device ...
- UCHAR Data[0];
-} OBJDIR_INFORMATION, *POBJDIR_INFORMATION;
-
-
-/*
- * FUNCTION: Closes an object handle
- * ARGUMENTS:
- * Handle = Handle to the object
- * RETURNS: Status
- */
-NTSTATUS ZwClose(HANDLE Handle);
-
-/*
- * FUNCTION: Creates or opens a directory object, which is a container for
- * other objects
- * ARGUMENTS:
- * DirectoryHandle (OUT) = Points to a variable which stores the
- * handle for the directory on success
- * DesiredAccess = Type of access the caller requires to the directory
- * ObjectAttributes = Structures specifing the object attributes,
- * initialized with InitializeObjectAttributes
- * RETURNS: Status
- */
-NTSTATUS ZwCreateDirectoryObject(PHANDLE DirectoryHandle,
- ACCESS_MASK DesiredAccess,
- POBJECT_ATTRIBUTES ObjectAttributes);
-
-/*
- * FUNCTION: Creates or opens a registry key
- * ARGUMENTS:
- * KeyHandle (OUT) = Points to a variable which stores the handle
- * for the key on success
- * DesiredAccess = Access desired by the caller to the key
- * ObjectAttributes = Initialized object attributes for the key
- * TitleIndex = Who knows?
- * Class = Object class of the key?
- * CreateOptions = Options for the key creation
- * Disposition (OUT) = Points to a variable which a status value
- * indicating whether a new key was created
- * RETURNS: Status
- */
-NTSTATUS ZwCreateKey(PHANDLE KeyHandle, ACCESS_MASK DesiredAccess,
- POBJECT_ATTRIBUTES ObjectAttributes,
- ULONG TitleIndex, PUNICODE_STRING Class,
- ULONG CreateOptions, PULONG Disposition);
-
-/*
- * FUNCTION: Deletes a registry key
- * ARGUMENTS:
- * KeyHandle = Handle of the key
- * RETURNS: Status
- */
-NTSTATUS ZwDeleteKey(HANDLE KeyHandle);
-
-/*
- * FUNCTION: Returns information about the subkeys of an open key
- * ARGUMENTS:
- * KeyHandle = Handle of the key whose subkeys are to enumerated
- * Index = zero based index of the subkey for which information is
- * request
- * KeyInformationClass = Type of information returned
- * KeyInformation (OUT) = Caller allocated buffer for the information
- * about the key
- * Length = Length in bytes of the KeyInformation buffer
- * ResultLength (OUT) = Caller allocated storage which holds
- * the number of bytes of information retrieved
- * on return
- * RETURNS: Status
- */
-NTSTATUS ZwEnumerateKey(HANDLE KeyHandle, ULONG Index,
- KEY_INFORMATION_CLASS KeyInformationClass,
- PVOID KeyInformation, ULONG Length,
- PULONG ResultLength);
-
-/*
- * FUNCTION: Returns information about the value entries of an open key
- * ARGUMENTS:
- * KeyHandle = Handle of the key whose value entries are to enumerated
- * Index = zero based index of the subkey for which information is
- * request
- * KeyInformationClass = Type of information returned
- * KeyInformation (OUT) = Caller allocated buffer for the information
- * about the key
- * Length = Length in bytes of the KeyInformation buffer
- * ResultLength (OUT) = Caller allocated storage which holds
- * the number of bytes of information retrieved
- * on return
- * RETURNS: Status
- */
-NTSTATUS ZwEnumerateValueKey(HANDLE KeyHandle, ULONG Index,
- KEY_VALUE_INFORMATION_CLASS KeyInformationClass,
- PVOID KeyInformation, ULONG Length,
- PULONG ResultLength);
-
-
-/*
- * FUNCTION: Forces a registry key to be committed to disk
- * ARGUMENTS:
- * KeyHandle = Handle of the key to be written to disk
- * RETURNS: Status
- */
-NTSTATUS ZwFlushKey(HANDLE KeyHandle);
-
-/*
- * FUNCTION: Changes the attributes of an object to temporary
- * ARGUMENTS:
- * Handle = Handle for the object
- * RETURNS: Status
- */
-NTSTATUS ZwMakeTemporaryObject(HANDLE Handle);
-
-/*
- * FUNCTION: Maps a view of a section into the virtual address space of a
- * process
- * ARGUMENTS:
- * SectionHandle = Handle of the section
- * ProcessHandle = Handle of the process
- * BaseAddress = Desired base address (or NULL) on entry
- * Actual base address of the view on exit
- * ZeroBits = Number of high order address bits that must be zero
- * CommitSize = Size in bytes of the initially committed section of
- * the view
- * SectionOffset = Offset in bytes from the beginning of the section
- * to the beginning of the view
- * ViewSize = Desired length of map (or zero to map all) on entry
- * Actual length mapped on exit
- * InheritDisposition = Specified how the view is to be shared with
- * child processes
- * AllocateType = Type of allocation for the pages
- * Protect = Protection for the committed region of the view
- * RETURNS: Status
- */
-NTSTATUS ZwMapViewOfSection(HANDLE SectionHandle,
- HANDLE ProcessHandle,
- PVOID* BaseAddress,
- ULONG ZeroBits,
- ULONG CommitSize,
- PLARGE_INTEGER SectionOffset,
- PULONG ViewSize,
- SECTION_INHERIT InheritDisposition,
- ULONG AllocationType,
- ULONG Protect);
-
-/*
- * FUNCTION: Opens an existing key in the registry
- * ARGUMENTS:
- * KeyHandle (OUT) = Caller supplied storage for the resulting handle
- * DesiredAccess = Requested access to the key
- * ObjectAttribute = Initialized attributes for the object
- * RETURNS: Status
- */
-NTSTATUS ZwOpenKey(PHANDLE KeyHandle, ACCESS_MASK DesiredAccess,
- POBJECT_ATTRIBUTES ObjectAttributes);
-
-/*
- * FUNCTION: Opens an existing section object
- * ARGUMENTS:
- * KeyHandle (OUT) = Caller supplied storage for the resulting handle
- * DesiredAccess = Requested access to the key
- * ObjectAttribute = Initialized attributes for the object
- * RETURNS: Status
- */
-NTSTATUS ZwOpenSection(PHANDLE KeyHandle, ACCESS_MASK DesiredAccess,
- POBJECT_ATTRIBUTES ObjectAttributes);
-
-NTSTATUS ZwQueryDirectoryObject(IN HANDLE DirObjHandle,
- OUT POBJDIR_INFORMATION DirObjInformation,
- IN ULONG BufferLength,
- IN BOOLEAN GetNextIndex,
- IN BOOLEAN IgnoreInputIndex,
- IN OUT PULONG ObjectIndex,
- OUT PULONG DataWritten OPTIONAL);
-
-/*
- * FUNCTION: Returns information about an open file
- * ARGUMENTS:
- * FileHandle = Handle of the file to be queried
- * IoStatusBlock (OUT) = Caller supplied storage for the result
- * FileInformation (OUT) = Caller supplied storage for the file
- * information
- * Length = Length in bytes of the buffer for file information
- * FileInformationClass = Type of information to be returned
- * RETURNS: Status
- */
-NTSTATUS ZwQueryInformationFile(HANDLE FileHandle,
- PIO_STATUS_BLOCK IoStatusBlock,
- PVOID FileInformation,
- ULONG Length,
- FILE_INFORMATION_CLASS FileInformationClass);
-
-
-
-NTSTATUS ZwReadFile(HANDLE FileHandle,
- HANDLE EventHandle,
- PIO_APC_ROUTINE ApcRoutine,
- PVOID ApcContext,
- PIO_STATUS_BLOCK IoStatusBlock,
- PVOID Buffer,
- ULONG Length,
- PLARGE_INTEGER ByteOffset,
- PULONG Key);
-
-
-
-
-
-#define NtCurrentProcess() ( (HANDLE) 0xFFFFFFFF )
-#define NtCurrentThread() ( (HANDLE) 0xFFFFFFFE )
-
-
-
-// event access mask
-
-#define EVENT_READ_ACCESS 1
-#define EVENT_WRITE_ACCESS 2
-
-
-// file creation flags
-
-#define FILE_DIRECTORY_FILE 0x00000001
-#define FILE_WRITE_THROUGH 0x00000002
-#define FILE_SEQUENTIAL_ONLY 0x00000004
-#define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008
-
-#define FILE_SYNCHRONOUS_IO_ALERT 0x00000010
-#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
-#define FILE_NON_DIRECTORY_FILE 0x00000040
-#define FILE_CREATE_TREE_CONNECTION 0x00000080
-
-#define FILE_COMPLETE_IF_OPLOCKED 0x00000100
-#define FILE_NO_EA_KNOWLEDGE 0x00000200
-
-#define FILE_RANDOM_ACCESS 0x00000800
-
-#define FILE_DELETE_ON_CLOSE 0x00001000
-#define FILE_OPEN_BY_FILE_ID 0x00002000
-#define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000
-#define FILE_NO_COMPRESSION 0x00008000
-
-#define FILE_RESERVE_OPFILTER 0x00100000
-#define FILE_TRANSACTED_MODE 0x00200000
-#define FILE_OPEN_OFFLINE_FILE 0x00400000
-
-#define FILE_VALID_OPTION_FLAGS 0x007fffff
-#define FILE_VALID_PIPE_OPTION_FLAGS 0x00000032
-#define FILE_VALID_MAILSLOT_OPTION_FLAGS 0x00000032
-#define FILE_VALID_SET_FLAGS 0x00001036
-
-
-// file disposition values
-
-
-#define FILE_SUPERSEDE 0x0000
-#define FILE_OPEN 0x0001
-#define FILE_CREATE 0x0002
-#define FILE_OPEN_IF 0x0003
-#define FILE_OVERWRITE 0x0004
-#define FILE_OVERWRITE_IF 0x0005
-#define FILE_MAXIMUM_DISPOSITION 0x0005
-
-
-
-
-//process query / set information class
-
-#define ProcessBasicInformation 0
-#define ProcessQuotaLimits 1
-#define ProcessIoCounters 2
-#define ProcessVmCounters 3
-#define ProcessTimes 4
-#define ProcessBasePriority 5
-#define ProcessRaisePriority 6
-#define ProcessDebugPort 7
-#define ProcessExceptionPort 8
-#define ProcessAccessToken 9
-#define ProcessLdtInformation 10
-#define ProcessLdtSize 11
-#define ProcessDefaultHardErrorMode 12
-#define ProcessIoPortHandlers 13
-#define ProcessPooledUsageAndLimits 14
-#define ProcessWorkingSetWatch 15
-#define ProcessUserModeIOPL 16
-#define ProcessEnableAlignmentFaultFixup 17
-#define ProcessPriorityClass 18
-#define ProcessWx86Information 19
-#define ProcessHandleCount 20
-#define ProcessAffinityMask 21
-#define MaxProcessInfoClass 22
-
-// thread query / set information class
-#define ThreadBasicInformation 0
-#define ThreadTimes 1
-#define ThreadPriority 2
-#define ThreadBasePriority 3
-#define ThreadAffinityMask 4
-#define ThreadImpersonationToken 5
-#define ThreadDescriptorTableEntry 6
-#define ThreadEnableAlignmentFaultFixup 7
-#define ThreadEventPair 8
-#define ThreadQuerySetWin32StartAddress 9
-#define ThreadZeroTlsCell 10
-#define ThreadPerformanceCount 11
-#define ThreadAmILastThread 12
-#define ThreadIdealProcessor 13
-#define ThreadPriorityBoost 14
-#define MaxThreadInfoClass 15
-
-
-
-// key query information class
-
-#define KeyBasicInformation 0
-#define KeyNodeInformation 1
-#define KeyFullInformation 2
-
-
-// key set information class
-
-#define KeyWriteTimeInformation 0
-
-// key value information class
-
-#define KeyValueBasicInformation 0
-#define KeyValueFullInformation 1
-#define KeyValuePartialInformation 2
-
-// object handle information
-
-#define ObjectBasicInformation 0
-#define ObjectNameInformation 1
-#define ObjectTypeInformation 2
-#define ObjectAllInformation 3
-#define ObjectDataInformation 4
-
-// semaphore information
-
-#define SemaphoreBasicInformation 0
-
-// event information
-
-#define EventBasicInformation 0
-
-
-// system information
-
-#define SystemPerformanceInformation 5
-#define SystemCacheInformation 21
-#define SystemTimeAdjustmentInformation 28
-
-
-// file information
-
-
-#define FileDirectoryInformation 1
-#define FileFullDirectoryInformation 2
-#define FileBothDirectoryInformation 3
-#define FileBasicInformation 4
-#define FileStandardInformation 5
-#define FileInternalInformation 6
-#define FileEaInformation 7
-#define FileAccessInformation 8
-#define FileNameInformation 9
-#define FileRenameInformation 10
-#define FileLinkInformation 11
-#define FileNamesInformation 12
-#define FileDispositionInformation 13
-#define FilePositionInformation 14
-#define FileFullEaInformation 15
-#define FileModeInformation 16
-#define FileAlignmentInformation 17
-#define FileAllInformation 18
-#define FileAllocationInformation 19
-#define FileEndOfFileInformation 20
-#define FileAlternateNameInformation 21
-#define FileStreamInformation 22
-#define FilePipeInformation 23
-#define FilePipeLocalInformation 24
-#define FilePipeRemoteInformation 25
-#define FileMailslotQueryInformation 26
-#define FileMailslotSetInformation 27
-#define FileCompressionInformation 28
-#define FileCopyOnWriteInformation 29
-#define FileCompletionInformation 30
-#define FileMoveClusterInformation 31
-#define FileOleClassIdInformation 32
-#define FileOleStateBitsInformation 33
-#define FileNetworkOpenInformation 34
-#define FileObjectIdInformation 35
-#define FileOleAllInformation 36
-#define FileOleDirectoryInformation 37
-#define FileContentIndexInformation 38
-#define FileInheritContentIndexInformation 39
-#define FileOleInformation 40
-#define FileMaximumInformation 41
-
-
-
-//file system information class values
-
-
-
-#define FileFsVolumeInformation 1
-#define FileFsLabelInformation 2
-#define FileFsSizeInformation 3
-#define FileFsDeviceInformation 4
-#define FileFsAttributeInformation 5
-#define FileFsControlInformation 6
-#define FileFsQuotaQueryInformation 7
-#define FileFsQuotaSetInformation 8
-#define FileFsMaximumInformation 9
-
-
-// shutdown action
-
-typedef enum SHUTDOWN_ACTION_TAG {
- ShutdownNoReboot,
- ShutdownReboot,
- ShutdownPowerOff
-} SHUTDOWN_ACTION;
-
-
-
-// wait type
-
-#define WaitAll 0
-#define WaitAny 1
-
-
-// key restore flags
-
-#define REG_WHOLE_HIVE_VOLATILE 1
-#define REG_REFRESH_HIVE 2
-
-
-// object type access rights
-
-#define OBJECT_TYPE_CREATE 0x0001
-#define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
-
-
-// directory access rights
-
-#define DIRECTORY_QUERY 0x0001
-#define DIRECTORY_TRAVERSE 0x0002
-#define DIRECTORY_CREATE_OBJECT 0x0004
-#define DIRECTORY_CREATE_SUBDIRECTORY 0x0008
-
-#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)
-
-// symbolic link access rights
-
-#define SYMBOLIC_LINK_QUERY 0x0001
-#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
-
-typedef struct _PROCESS_WS_WATCH_INFORMATION
-{
- PVOID FaultingPc;
- PVOID FaultingVa;
-} PROCESS_WS_WATCH_INFORMATION, *PPROCESS_WS_WATCH_INFORMATION;
-
-typedef struct _PROCESS_BASIC_INFORMATION
-{
- NTSTATUS ExitStatus;
- PNT_PEB PebBaseAddress;
- KAFFINITY AffinityMask;
- KPRIORITY BasePriority;
- ULONG UniqueProcessId;
- ULONG InheritedFromUniqueProcessId;
-} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
-
-typedef struct _QUOTA_LIMITS
-{
- ULONG PagedPoolLimit;
- ULONG NonPagedPoolLimit;
- ULONG MinimumWorkingSetSize;
- ULONG MaximumWorkingSetSize;
- ULONG PagefileLimit;
- TIME TimeLimit;
-} QUOTA_LIMITS, *PQUOTA_LIMITS;
-
-typedef struct _IO_COUNTERS
-{
- ULONG ReadOperationCount;
- ULONG WriteOperationCount;
- ULONG OtherOperationCount;
- LARGE_INTEGER ReadTransferCount;
- LARGE_INTEGER WriteTransferCount;
- LARGE_INTEGER OtherTransferCount;
-} IO_COUNTERS, *PIO_COUNTERS;
-
-
-typedef struct _VM_COUNTERS_
-{
- ULONG PeakVirtualSize;
- ULONG VirtualSize;
- ULONG PageFaultCount;
- ULONG PeakWorkingSetSize;
- ULONG WorkingSetSize;
- ULONG QuotaPeakPagedPoolUsage;
- ULONG QuotaPagedPoolUsage;
- ULONG QuotaPeakNonPagedPoolUsage;
- ULONG QuotaNonPagedPoolUsage;
- ULONG PagefileUsage;
- ULONG PeakPagefileUsage;
-} VM_COUNTERS, *PVM_COUNTERS;
-
-
-typedef struct _POOLED_USAGE_AND_LIMITS_
-{
- ULONG PeakPagedPoolUsage;
- ULONG PagedPoolUsage;
- ULONG PagedPoolLimit;
- ULONG PeakNonPagedPoolUsage;
- ULONG NonPagedPoolUsage;
- ULONG NonPagedPoolLimit;
- ULONG PeakPagefileUsage;
- ULONG PagefileUsage;
- ULONG PagefileLimit;
-} POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS;
-
-
-typedef struct _PROCESS_ACCESS_TOKEN
-{
- HANDLE Token;
- HANDLE Thread;
-} PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;
-
-typedef struct _KERNEL_USER_TIMES
-{
- TIME CreateTime;
- TIME ExitTime;
- TIME KernelTime;
- TIME UserTime;
-} KERNEL_USER_TIMES;
-typedef KERNEL_USER_TIMES *PKERNEL_USER_TIMES;
-
-// thread information
-
-// incompatible with MS NT
-
-typedef struct _THREAD_BASIC_INFORMATION
-{
- NTSTATUS ExitStatus;
- PVOID TebBaseAddress;
- KAFFINITY AffinityMask;
- KPRIORITY BasePriority;
- ULONG UniqueThreadId;
-} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
-
-// object information
-
-typedef struct _OBJECT_NAME_INFORMATION
-{
- UNICODE_STRING Name;
-} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
-
-
-
-typedef struct _OBJECT_DATA_INFORMATION
-{
- BOOL bInheritHanlde;
- BOOL bProtectFromClose;
-} OBJECT_DATA_INFORMATION, *POBJECT_DATA_INFORMATION;
-
-
-typedef struct _OBJECT_TYPE_INFORMATION
-{
- UNICODE_STRING Name;
- UNICODE_STRING Type;
- ULONG TotalHandles;
- ULONG ReferenceCount;
-} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;
-
-// system information
-
-typedef struct _SYSTEM_TIME_ADJUSTMENT
-{
- ULONG TimeAdjustment;
- BOOL TimeAdjustmentDisabled;
-} SYSTEM_TIME_ADJUSTMENT, *PSYSTEM_TIME_ADJUSTMENT;
-
-typedef struct _SYSTEM_CONFIGURATION_INFO {
- union {
- ULONG OemId;
- struct {
- WORD ProcessorArchitecture;
- WORD Reserved;
- } tag1;
- } tag2;
- ULONG PageSize;
- PVOID MinimumApplicationAddress;
- PVOID MaximumApplicationAddress;
- ULONG ActiveProcessorMask;
- ULONG NumberOfProcessors;
- ULONG ProcessorType;
- ULONG AllocationGranularity;
- WORD ProcessorLevel;
- WORD ProcessorRevision;
-} SYSTEM_CONFIGURATION_INFO, *PSYSTEM_CONFIGURATION_INFO;
-
-
-typedef struct _SYSTEM_CACHE_INFORMATION {
- ULONG CurrentSize;
- ULONG PeakSize;
- ULONG PageFaultCount;
- ULONG MinimumWorkingSet;
- ULONG MaximumWorkingSet;
- ULONG Unused[4];
-} SYSTEM_CACHE_INFORMATION;
-
-
-
-// file information
-
-typedef struct _FILE_BASIC_INFORMATION
-{
- TIME CreationTime;
- TIME LastAccessTime;
- TIME LastWriteTime;
- TIME ChangeTime;
- ULONG FileAttributes;
-} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
-
-typedef struct _FILE_STANDARD_INFORMATION
-{
- LARGE_INTEGER AllocationSize;
- LARGE_INTEGER EndOfFile;
- ULONG NumberOfLinks;
- BOOLEAN DeletePending;
- BOOLEAN Directory;
-} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;
-
-typedef struct _FILE_POSITION_INFORMATION
-{
- LARGE_INTEGER CurrentByteOffset;
-} FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;
-
-typedef struct _FILE_ALIGNMENT_INFORMATION
-{
- ULONG AlignmentRequirement;
-} FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION;
-
-typedef struct _FILE_DISPOSITION_INFORMATION
-{
- BOOLEAN DeleteFile;
-} FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;
-
-typedef struct _FILE_END_OF_FILE_INFORMATION
-{
- LARGE_INTEGER EndOfFile;
-} FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;
-
-typedef struct _FILE_NETWORK_OPEN_INFORMATION {
- TIME CreationTime;
- TIME LastAccessTime;
- TIME LastWriteTime;
- TIME ChangeTime;
- LARGE_INTEGER AllocationSize;
- LARGE_INTEGER EndOfFile;
- ULONG FileAttributes;
-} FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;
-
-typedef struct _FILE_FULL_EA_INFORMATION
-{
- ULONG NextEntryOffset;
- UCHAR Flags;
- UCHAR EaNameLength;
- USHORT EaValueLength;
- CHAR *EaName;
-} FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;
-
-
-typedef struct _FILE_EA_INFORMATION {
- ULONG EaSize;
-} FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
-
-
-typedef struct _FILE_GET_EA_INFORMATION {
- ULONG NextEntryOffset;
- UCHAR EaNameLength;
- CHAR EaName[0];
-} FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
-
-typedef struct _FILE_STREAM_INFORMATION {
- ULONG NextEntryOffset;
- ULONG StreamNameLength;
- LARGE_INTEGER StreamSize;
- LARGE_INTEGER StreamAllocationSize;
- WCHAR StreamName[0];
-} FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;
-
-typedef struct _FILE_ALLOCATION_INFORMATION {
- LARGE_INTEGER AllocationSize;
-} FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;
-
-typedef struct _FILE_NAME_INFORMATION {
- ULONG FileNameLength;
- WCHAR FileName[0];
-} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;
-
-typedef struct _FILE_NAMES_INFORMATION {
- ULONG NextEntryOffset;
- ULONG FileIndex;
- ULONG FileNameLength;
- WCHAR FileName[0];
-} FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
-
-
-typedef struct _FILE_RENAME_INFORMATION {
- BOOLEAN Replace;
- HANDLE RootDir;
- ULONG FileNameLength;
- WCHAR FileName[0];
-} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
-
-
-typedef struct _FILE_INTERNAL_INFORMATION {
- LARGE_INTEGER IndexNumber;
-} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
-
-typedef struct _FILE_ACCESS_INFORMATION {
- ACCESS_MASK AccessFlags;
-} FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
-
-
-typedef struct _FILE_MODE_INFORMATION {
- ULONG Mode;
-} FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
-
-typedef struct _FILE_COMPRESSION_INFORMATION {
- LARGE_INTEGER CompressedFileSize;
- USHORT CompressionFormat;
- UCHAR CompressionUnitShift;
- UCHAR ChunkShift;
- UCHAR ClusterShift;
- UCHAR Reserved[3];
-} FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
-
-typedef struct _FILE_ALL_INFORMATION {
- FILE_BASIC_INFORMATION BasicInformation;
- FILE_STANDARD_INFORMATION StandardInformation;
- FILE_INTERNAL_INFORMATION InternalInformation;
- FILE_EA_INFORMATION EaInformation;
- FILE_ACCESS_INFORMATION AccessInformation;
- FILE_POSITION_INFORMATION PositionInformation;
- FILE_MODE_INFORMATION ModeInformation;
- FILE_ALIGNMENT_INFORMATION AlignmentInformation;
- FILE_NAME_INFORMATION NameInformation;
-} FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
-
-// file system information structures
-
-typedef struct _FILE_FS_DEVICE_INFORMATION {
- DEVICE_TYPE DeviceType;
- ULONG Characteristics;
-} FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;
-
-
-/* device type can be one of the following values:
-
- FILE_DEVICE_BEEP 0x00000001
- FILE_DEVICE_CD_ROM 0x00000002
- FILE_DEVICE_CD_ROM_FILE_SYSTEM 0x00000003
- FILE_DEVICE_CONTROLLER 0x00000004
- FILE_DEVICE_DATALINK 0x00000005
- FILE_DEVICE_DFS 0x00000006
- FILE_DEVICE_DISK 0x00000007
- FILE_DEVICE_DISK_FILE_SYSTEM 0x00000008
- FILE_DEVICE_FILE_SYSTEM 0x00000009
- FILE_DEVICE_INPORT_PORT 0x0000000a
- FILE_DEVICE_KEYBOARD 0x0000000b
- FILE_DEVICE_MAILSLOT 0x0000000c
- FILE_DEVICE_MIDI_IN 0x0000000d
- FILE_DEVICE_MIDI_OUT 0x0000000e
- FILE_DEVICE_MOUSE 0x0000000f
- FILE_DEVICE_MULTI_UNC_PROVIDER 0x00000010
- FILE_DEVICE_NAMED_PIPE 0x00000011
- FILE_DEVICE_NETWORK 0x00000012
- FILE_DEVICE_NETWORK_BROWSER 0x00000013
- FILE_DEVICE_NETWORK_FILE_SYSTEM 0x00000014
- FILE_DEVICE_NULL 0x00000015
- FILE_DEVICE_PARALLEL_PORT 0x00000016
- FILE_DEVICE_PHYSICAL_NETCARD 0x00000017
- FILE_DEVICE_PRINTER 0x00000018
- FILE_DEVICE_SCANNER 0x00000019
- FILE_DEVICE_SERIAL_MOUSE_PORT 0x0000001a
- FILE_DEVICE_SERIAL_PORT 0x0000001b
- FILE_DEVICE_SCREEN 0x0000001c
- FILE_DEVICE_SOUND 0x0000001d
- FILE_DEVICE_STREAMS 0x0000001e
- FILE_DEVICE_TAPE 0x0000001f
- FILE_DEVICE_TAPE_FILE_SYSTEM 0x00000020
- FILE_DEVICE_TRANSPORT 0x00000021
- FILE_DEVICE_UNKNOWN 0x00000022
- FILE_DEVICE_VIDEO 0x00000023
- FILE_DEVICE_VIRTUAL_DISK 0x00000024
- FILE_DEVICE_WAVE_IN 0x00000025
- FILE_DEVICE_WAVE_OUT 0x00000026
- FILE_DEVICE_8042_PORT 0x00000027
- FILE_DEVICE_NETWORK_REDIRECTOR 0x00000028
- FILE_DEVICE_BATTERY 0x00000029
- FILE_DEVICE_BUS_EXTENDER 0x0000002a
- FILE_DEVICE_MODEM 0x0000002b
- FILE_DEVICE_VDM 0x0000002c
- */
-
-/*
- characteristics is one of the following values:
-
- FILE_REMOVABLE_MEDIA 0x00000001
- FILE_READ_ONLY_DEVICE 0x00000002
- FILE_FLOPPY_DISKETTE 0x00000004
- FILE_WRITE_ONCE_MEDIA 0x00000008
- FILE_REMOTE_DEVICE 0x00000010
- FILE_DEVICE_IS_MOUNTED 0x00000020
- FILE_VIRTUAL_VOLUME 0x00000040
-*/
-
-typedef struct _FILE_FS_VOLUME_INFORMATION {
- TIME VolumeCreationTime;
- ULONG VolumeSerialNumber;
- ULONG VolumeLabelLength;
- BOOLEAN SupportsObjects;
- WCHAR VolumeLabel[0];
-} FILE_FS_VOLUME_INFORMATION;
-
-typedef struct _FILE_FS_SIZE_INFORMATION {
- LARGE_INTEGER TotalAllocationUnits;
- LARGE_INTEGER AvailableAllocationUnits;
- ULONG SectorsPerAllocationUnit;
- ULONG BytesPerSector;
-} FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
-
-typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {
- ULONG FileSystemAttributes;
- LONG MaximumComponentNameLength;
- ULONG FileSystemNameLength;
- WCHAR FileSystemName[0];
-} FILE_FS_ATTRIBUTE_INFORMATION;
-
-/*
- FileSystemAttributes is one of the following values:
-
- FILE_CASE_SENSITIVE_SEARCH 0x00000001
- FILE_CASE_PRESERVED_NAMES 0x00000002
- FILE_UNICODE_ON_DISK 0x00000004
- FILE_PERSISTENT_ACLS 0x00000008
- FILE_FILE_COMPRESSION 0x00000010
- FILE_VOLUME_QUOTAS 0x00000020
- FILE_VOLUME_IS_COMPRESSED 0x00008000
-*/
-typedef struct _FILE_FS_LABEL_INFORMATION {
- ULONG VolumeLabelLength;
- WCHAR VolumeLabel[0];
-} FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
-
-// read file scatter / write file scatter
-//FIXME I am a win32 struct aswell
-
-typedef union _FILE_SEGMENT_ELEMENT {
- PVOID Buffer;
- ULONG Alignment;
-}FILE_SEGMENT_ELEMENT, *PFILE_SEGMENT_ELEMENT;
-
-// directory information
-
-
-typedef struct _FILE_DIRECTORY_INFORMATION {
- ULONG NextEntryOffset;
- ULONG FileIndex;
- TIME CreationTime;
- TIME LastAccessTime;
- TIME LastWriteTime;
- TIME ChangeTime;
- LARGE_INTEGER EndOfFile;
- LARGE_INTEGER AllocationSize;
- ULONG FileAttributes;
- ULONG FileNameLength;
- WCHAR FileName[0];
-} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
-
-typedef struct _FILE_FULL_DIRECTORY_INFORMATION {
- ULONG NextEntryOffset;
- ULONG FileIndex;
- TIME CreationTime;
- TIME LastAccessTime;
- TIME LastWriteTime;
- TIME ChangeTime;
- LARGE_INTEGER EndOfFile;
- LARGE_INTEGER AllocationSize;
- ULONG FileAttributes;
- ULONG FileNameLength;
- ULONG EaSize;
- WCHAR FileName[0];
-} FILE_FULL_DIRECTORY_INFORMATION, *PFILE_FULL_DIRECTORY_INFORMATION;
-
-
-typedef struct _FILE_BOTH_DIRECTORY_INFORMATION {
- ULONG NextEntryOffset;
- ULONG FileIndex;
- TIME CreationTime;
- TIME LastAccessTime;
- TIME LastWriteTime;
- TIME ChangeTime;
- LARGE_INTEGER EndOfFile;
- LARGE_INTEGER AllocationSize;
- ULONG FileAttributes;
- ULONG FileNameLength;
- ULONG EaSize;
- CHAR ShortNameLength;
- WCHAR ShortName[12]; // 8.3 name
- WCHAR FileName[0];
-} FILE_BOTH_DIRECTORY_INFORMATION, *PFILE_BOTH_DIRECTORY_INFORMATION;
-
-
-/*
- NotifyFilter / CompletionFilter:
-
- FILE_NOTIFY_CHANGE_FILE_NAME 0x00000001
- FILE_NOTIFY_CHANGE_DIR_NAME 0x00000002
- FILE_NOTIFY_CHANGE_NAME 0x00000003
- FILE_NOTIFY_CHANGE_ATTRIBUTES 0x00000004
- FILE_NOTIFY_CHANGE_SIZE 0x00000008
- FILE_NOTIFY_CHANGE_LAST_WRITE 0x00000010
- FILE_NOTIFY_CHANGE_LAST_ACCESS 0x00000020
- FILE_NOTIFY_CHANGE_CREATION 0x00000040
- FILE_NOTIFY_CHANGE_EA 0x00000080
- FILE_NOTIFY_CHANGE_SECURITY 0x00000100
- FILE_NOTIFY_CHANGE_STREAM_NAME 0x00000200
- FILE_NOTIFY_CHANGE_STREAM_SIZE 0x00000400
- FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
-*/
-
-typedef struct _FILE_NOTIFY_INFORMATION {
- ULONG NextEntryOffset;
- ULONG Action;
- ULONG FileNameLength;
- WCHAR FileName[0];
-} FILE_NOTIFY_INFORMATION;
-
-
-/*
- Action is one of the following values:
-
- FILE_ACTION_ADDED 0x00000001
- FILE_ACTION_REMOVED 0x00000002
- FILE_ACTION_MODIFIED 0x00000003
- FILE_ACTION_RENAMED_OLD_NAME 0x00000004
- FILE_ACTION_RENAMED_NEW_NAME 0x00000005
- FILE_ACTION_ADDED_STREAM 0x00000006
- FILE_ACTION_REMOVED_STREAM 0x00000007
- FILE_ACTION_MODIFIED_STREAM 0x00000008
-
-*/
-
-
-//FIXME: I am a win32 object
-typedef
-VOID
-(*PTIMERAPCROUTINE)(
- LPVOID lpArgToCompletionRoutine,
- DWORD dwTimerLowValue,
- DWORD dwTimerHighValue
- );
-
-// NtProcessStartup parameters
-
-typedef struct _ENVIRONMENT_INFORMATION {
- ULONG Unknown[21];
- UNICODE_STRING CommandLine;
- UNICODE_STRING ImageFile;
-} ENVIRONMENT_INFORMATION, *PENVIRONMENT_INFORMATION;
-
-
-typedef struct _STARTUP_ARGUMENT {
- ULONG Unknown[3];
- PENVIRONMENT_INFORMATION Environment;
-} STARTUP_ARGUMENT, *PSTARTUP_ARGUMENT;
-
-
-// File System Control commands ( related to defragging )
-
-#define FSCTL_READ_MFT_RECORD 0x90068 // NTFS only
-#define FSCTL_GET_VOLUME_BITMAP 0x9006F
-#define FSCTL_GET_RETRIEVAL_POINTERS 0x90073
-#define FSCTL_MOVE_FILE 0x90074
-
-typedef struct _MAPPING_PAIR
-{
- ULONGLONG Vcn;
- ULONGLONG Lcn;
-} MAPPING_PAIR, *PMAPPING_PAIR;
-
-typedef struct _GET_RETRIEVAL_DESCRIPTOR
-{
- ULONG NumberOfPairs;
- ULONGLONG StartVcn;
- MAPPING_PAIR Pair[0];
-} GET_RETRIEVAL_DESCRIPTOR, *PGET_RETRIEVAL_DESCRIPTOR;
-
-typedef struct _BITMAP_DESCRIPTOR
-{
- ULONGLONG StartLcn;
- ULONGLONG ClustersToEndOfVol;
- BYTE Map[0];
-} BITMAP_DESCRIPTOR, *PBITMAP_DESCRIPTOR;
-
-typedef struct _MOVEFILE_DESCRIPTOR
-{
- HANDLE FileHandle;
- ULONG Reserved;
- LARGE_INTEGER StartVcn;
- LARGE_INTEGER TargetLcn;
- ULONG NumVcns;
- ULONG Reserved1;
-} MOVEFILE_DESCRIPTOR, *PMOVEFILE_DESCRIPTOR;
-
-
-// semaphore information
-
-typedef struct _SEMAPHORE_BASIC_INFORMATION
-{
- ULONG CurrentCount;
- ULONG MaximumCount;
-} SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;
-
-// event information
-
-typedef struct _EVENT_BASIC_INFORMATION
-{
- BOOL AutomaticReset;
- BOOL Signaled;
-} EVENT_BASIC_INFORMATION, *PEVENT_INFORMATION;
-
-
-