?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
winemac.drv: Don't filter non active displays out.
[wine/zf.git] / include / winternl.h
blob7632cfcb999a6b7f89f1b8eb4cf749e6bcf17612
1 /*
2 * Internal NT APIs and data structures
3 *
4 * Copyright (C) the Wine project
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
19 */
20
21 #ifndef __WINE_WINTERNL_H
22 #define __WINE_WINTERNL_H
23
24 #include <ntdef.h>
25 #include <windef.h>
26
27 #ifdef __cplusplus
28 extern "C" {
29 #endif /* defined(__cplusplus) */
30
31
32 /**********************************************************************
33 * Fundamental types and data structures
34 */
35
36 #ifndef WINE_NTSTATUS_DECLARED
37 #define WINE_NTSTATUS_DECLARED
38 typedef LONG NTSTATUS;
39 #endif
40
41 typedef const char *PCSZ;
42
43 typedef short CSHORT;
44 typedef CSHORT *PCSHORT;
45
46 #ifndef __STRING_DEFINED__
47 #define __STRING_DEFINED__
48 typedef struct _STRING {
49 USHORT Length;
50 USHORT MaximumLength;
51 PCHAR Buffer;
52 } STRING, *PSTRING;
53 #endif
54
55 typedef STRING ANSI_STRING;
56 typedef PSTRING PANSI_STRING;
57 typedef const STRING *PCANSI_STRING;
58
59 typedef STRING OEM_STRING;
60 typedef PSTRING POEM_STRING;
61 typedef const STRING *PCOEM_STRING;
62
63 #ifndef __UNICODE_STRING_DEFINED__
64 #define __UNICODE_STRING_DEFINED__
65 typedef struct _UNICODE_STRING {
66 USHORT Length; /* bytes */
67 USHORT MaximumLength; /* bytes */
68 PWSTR Buffer;
69 } UNICODE_STRING, *PUNICODE_STRING;
70 #endif
71
72 typedef const UNICODE_STRING *PCUNICODE_STRING;
73
74 #ifndef _FILETIME_
75 #define _FILETIME_
76 /* 64 bit number of 100 nanoseconds intervals since January 1, 1601 */
77 typedef struct _FILETIME
78 {
79 #ifdef WORDS_BIGENDIAN
80 DWORD dwHighDateTime;
81 DWORD dwLowDateTime;
82 #else
83 DWORD dwLowDateTime;
84 DWORD dwHighDateTime;
85 #endif
86 } FILETIME, *PFILETIME, *LPFILETIME;
87 #endif /* _FILETIME_ */
88
89 /*
90 * RTL_SYSTEM_TIME and RTL_TIME_ZONE_INFORMATION are the same as
91 * the SYSTEMTIME and TIME_ZONE_INFORMATION structures defined
92 * in winbase.h, however we need to define them separately so
93 * winternl.h doesn't depend on winbase.h. They are used by
94 * RtlQueryTimeZoneInformation and RtlSetTimeZoneInformation.
95 * The names are guessed; if anybody knows the real names, let me know.
96 */
97 typedef struct _RTL_SYSTEM_TIME {
98 WORD wYear;
99 WORD wMonth;
100 WORD wDayOfWeek;
101 WORD wDay;
102 WORD wHour;
103 WORD wMinute;
104 WORD wSecond;
105 WORD wMilliseconds;
106 } RTL_SYSTEM_TIME, *PRTL_SYSTEM_TIME;
107
108 typedef struct _RTL_TIME_ZONE_INFORMATION {
109 LONG Bias;
110 WCHAR StandardName[32];
111 RTL_SYSTEM_TIME StandardDate;
112 LONG StandardBias;
113 WCHAR DaylightName[32];
114 RTL_SYSTEM_TIME DaylightDate;
115 LONG DaylightBias;
116 } RTL_TIME_ZONE_INFORMATION, *PRTL_TIME_ZONE_INFORMATION;
117
118 typedef struct _RTL_TIME_DYNAMIC_ZONE_INFORMATION
119 {
120 LONG Bias;
121 WCHAR StandardName[32];
122 RTL_SYSTEM_TIME StandardDate;
123 LONG StandardBias;
124 WCHAR DaylightName[32];
125 RTL_SYSTEM_TIME DaylightDate;
126 LONG DaylightBias;
127 WCHAR TimeZoneKeyName[128];
128 BOOLEAN DynamicDaylightTimeDisabled;
129 } RTL_DYNAMIC_TIME_ZONE_INFORMATION, *PRTL_DYNAMIC_TIME_ZONE_INFORMATION;
130
131 typedef struct _CLIENT_ID
132 {
133 HANDLE UniqueProcess;
134 HANDLE UniqueThread;
135 } CLIENT_ID, *PCLIENT_ID;
136
137 typedef struct _CURDIR
138 {
139 UNICODE_STRING DosPath;
140 PVOID Handle;
141 } CURDIR, *PCURDIR;
142
143 typedef struct RTL_DRIVE_LETTER_CURDIR
144 {
145 USHORT Flags;
146 USHORT Length;
147 ULONG TimeStamp;
148 UNICODE_STRING DosPath;
149 } RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
150
151 typedef struct _RTL_RELATIVE_NAME
152 {
153 UNICODE_STRING RelativeName;
154 HANDLE ContainerDirectory;
155 void *CurDirRef;
156 } RTL_RELATIVE_NAME, *PRTL_RELATIVE_NAME;
157
158 typedef struct tagRTL_BITMAP {
159 ULONG SizeOfBitMap; /* Number of bits in the bitmap */
160 PULONG Buffer; /* Bitmap data, assumed sized to a DWORD boundary */
161 } RTL_BITMAP, *PRTL_BITMAP;
162
163 typedef const RTL_BITMAP *PCRTL_BITMAP;
164
165 typedef struct tagRTL_BITMAP_RUN {
166 ULONG StartingIndex; /* Bit position at which run starts */
167 ULONG NumberOfBits; /* Size of the run in bits */
168 } RTL_BITMAP_RUN, *PRTL_BITMAP_RUN;
169
170 typedef const RTL_BITMAP_RUN *PCRTL_BITMAP_RUN;
171
172 typedef struct _RTL_USER_PROCESS_PARAMETERS
173 {
174 ULONG AllocationSize;
175 ULONG Size;
176 ULONG Flags;
177 ULONG DebugFlags;
178 HANDLE ConsoleHandle;
179 ULONG ConsoleFlags;
180 HANDLE hStdInput;
181 HANDLE hStdOutput;
182 HANDLE hStdError;
183 CURDIR CurrentDirectory;
184 UNICODE_STRING DllPath;
185 UNICODE_STRING ImagePathName;
186 UNICODE_STRING CommandLine;
187 PWSTR Environment;
188 ULONG dwX;
189 ULONG dwY;
190 ULONG dwXSize;
191 ULONG dwYSize;
192 ULONG dwXCountChars;
193 ULONG dwYCountChars;
194 ULONG dwFillAttribute;
195 ULONG dwFlags;
196 ULONG wShowWindow;
197 UNICODE_STRING WindowTitle;
198 UNICODE_STRING Desktop;
199 UNICODE_STRING ShellInfo;
200 UNICODE_STRING RuntimeInfo;
201 RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];
202 ULONG EnvironmentSize;
203 ULONG EnvironmentVersion;
204 PVOID PackageDependencyData;
205 ULONG ProcessGroupId;
206 ULONG LoaderThreads;
207 } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
208
209 /* value for Flags field (FIXME: not the correct name) */
210 #define PROCESS_PARAMS_FLAG_NORMALIZED 1
211
212 typedef struct _PEB_LDR_DATA
213 {
214 ULONG Length;
215 BOOLEAN Initialized;
216 PVOID SsHandle;
217 LIST_ENTRY InLoadOrderModuleList;
218 LIST_ENTRY InMemoryOrderModuleList;
219 LIST_ENTRY InInitializationOrderModuleList;
220 PVOID EntryInProgress;
221 BOOLEAN ShutdownInProgress;
222 HANDLE ShutdownThreadId;
223 } PEB_LDR_DATA, *PPEB_LDR_DATA;
224
225 typedef struct _GDI_TEB_BATCH
226 {
227 ULONG Offset;
228 HANDLE HDC;
229 ULONG Buffer[0x136];
230 } GDI_TEB_BATCH;
231
232 typedef struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME
233 {
234 struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME *Previous;
235 struct _ACTIVATION_CONTEXT *ActivationContext;
236 ULONG Flags;
237 } RTL_ACTIVATION_CONTEXT_STACK_FRAME, *PRTL_ACTIVATION_CONTEXT_STACK_FRAME;
238
239 typedef struct _ACTIVATION_CONTEXT_STACK
240 {
241 RTL_ACTIVATION_CONTEXT_STACK_FRAME *ActiveFrame;
242 LIST_ENTRY FrameListCache;
243 ULONG Flags;
244 ULONG NextCookieSequenceNumber;
245 ULONG_PTR StackId;
246 } ACTIVATION_CONTEXT_STACK, *PACTIVATION_CONTEXT_STACK;
247
248 typedef struct _TEB_ACTIVE_FRAME_CONTEXT
249 {
250 ULONG Flags;
251 const char *FrameName;
252 } TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;
253
254 typedef struct _TEB_ACTIVE_FRAME_CONTEXT_EX
255 {
256 TEB_ACTIVE_FRAME_CONTEXT BasicContext;
257 const char *SourceLocation;
258 } TEB_ACTIVE_FRAME_CONTEXT_EX, *PTEB_ACTIVE_FRAME_CONTEXT_EX;
259
260 typedef struct _TEB_ACTIVE_FRAME
261 {
262 ULONG Flags;
263 struct _TEB_ACTIVE_FRAME *Previous;
264 TEB_ACTIVE_FRAME_CONTEXT *Context;
265 } TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
266
267 typedef struct _TEB_ACTIVE_FRAME_EX
268 {
269 TEB_ACTIVE_FRAME BasicFrame;
270 void *ExtensionIdentifier;
271 } TEB_ACTIVE_FRAME_EX, *PTEB_ACTIVE_FRAME_EX;
272
273 typedef struct _FLS_CALLBACK
274 {
275 void *unknown;
276 PFLS_CALLBACK_FUNCTION callback; /* ~0 if NULL callback is set, NULL if FLS index is free. */
277 } FLS_CALLBACK, *PFLS_CALLBACK;
278
279 typedef struct _FLS_INFO_CHUNK
280 {
281 ULONG count; /* number of allocated FLS indexes in the chunk. */
282 FLS_CALLBACK callbacks[1]; /* the size is 0x10 for chunk 0 and is twice as
283 * the previous chunk size for the rest. */
284 } FLS_INFO_CHUNK, *PFLS_INFO_CHUNK;
285
286 typedef struct _GLOBAL_FLS_DATA
287 {
288 FLS_INFO_CHUNK *fls_callback_chunks[8];
289 LIST_ENTRY fls_list_head;
290 ULONG fls_high_index;
291 } GLOBAL_FLS_DATA, *PGLOBAL_FLS_DATA;
292
293 typedef struct _TEB_FLS_DATA
294 {
295 LIST_ENTRY fls_list_entry;
296 void **fls_data_chunks[8];
297 } TEB_FLS_DATA, *PTEB_FLS_DATA;
298
299 #define TEB_ACTIVE_FRAME_CONTEXT_FLAG_EXTENDED 0x00000001
300 #define TEB_ACTIVE_FRAME_FLAG_EXTENDED 0x00000001
301
302 /***********************************************************************
303 * PEB data structure
304 */
305 typedef struct _PEB
306 { /* win32/win64 */
307 BOOLEAN InheritedAddressSpace; /* 000/000 */
308 BOOLEAN ReadImageFileExecOptions; /* 001/001 */
309 BOOLEAN BeingDebugged; /* 002/002 */
310 BOOLEAN SpareBool; /* 003/003 */
311 HANDLE Mutant; /* 004/008 */
312 HMODULE ImageBaseAddress; /* 008/010 */
313 PPEB_LDR_DATA LdrData; /* 00c/018 */
314 RTL_USER_PROCESS_PARAMETERS *ProcessParameters; /* 010/020 */
315 PVOID SubSystemData; /* 014/028 */
316 HANDLE ProcessHeap; /* 018/030 */
317 PRTL_CRITICAL_SECTION FastPebLock; /* 01c/038 */
318 PVOID /*PPEBLOCKROUTINE*/ FastPebLockRoutine; /* 020/040 */
319 PVOID /*PPEBLOCKROUTINE*/ FastPebUnlockRoutine; /* 024/048 */
320 ULONG EnvironmentUpdateCount; /* 028/050 */
321 PVOID KernelCallbackTable; /* 02c/058 */
322 ULONG Reserved; /* 030/060 */
323 ULONG AtlThunkSListPtr32; /* 034/064 */
324 PVOID /*PPEB_FREE_BLOCK*/ FreeList; /* 038/068 */
325 ULONG TlsExpansionCounter; /* 03c/070 */
326 PRTL_BITMAP TlsBitmap; /* 040/078 */
327 ULONG TlsBitmapBits[2]; /* 044/080 */
328 PVOID ReadOnlySharedMemoryBase; /* 04c/088 */
329 PVOID ReadOnlySharedMemoryHeap; /* 050/090 */
330 PVOID *ReadOnlyStaticServerData; /* 054/098 */
331 PVOID AnsiCodePageData; /* 058/0a0 */
332 PVOID OemCodePageData; /* 05c/0a8 */
333 PVOID UnicodeCaseTableData; /* 060/0b0 */
334 ULONG NumberOfProcessors; /* 064/0b8 */
335 ULONG NtGlobalFlag; /* 068/0bc */
336 LARGE_INTEGER CriticalSectionTimeout; /* 070/0c0 */
337 SIZE_T HeapSegmentReserve; /* 078/0c8 */
338 SIZE_T HeapSegmentCommit; /* 07c/0d0 */
339 SIZE_T HeapDeCommitTotalFreeThreshold; /* 080/0d8 */
340 SIZE_T HeapDeCommitFreeBlockThreshold; /* 084/0e0 */
341 ULONG NumberOfHeaps; /* 088/0e8 */
342 ULONG MaximumNumberOfHeaps; /* 08c/0ec */
343 PVOID *ProcessHeaps; /* 090/0f0 */
344 PVOID GdiSharedHandleTable; /* 094/0f8 */
345 PVOID ProcessStarterHelper; /* 098/100 */
346 PVOID GdiDCAttributeList; /* 09c/108 */
347 PVOID LoaderLock; /* 0a0/110 */
348 ULONG OSMajorVersion; /* 0a4/118 */
349 ULONG OSMinorVersion; /* 0a8/11c */
350 ULONG OSBuildNumber; /* 0ac/120 */
351 ULONG OSPlatformId; /* 0b0/124 */
352 ULONG ImageSubSystem; /* 0b4/128 */
353 ULONG ImageSubSystemMajorVersion; /* 0b8/12c */
354 ULONG ImageSubSystemMinorVersion; /* 0bc/130 */
355 ULONG ImageProcessAffinityMask; /* 0c0/134 */
356 HANDLE GdiHandleBuffer[28]; /* 0c4/138 */
357 ULONG unknown[6]; /* 134/218 */
358 PVOID PostProcessInitRoutine; /* 14c/230 */
359 PRTL_BITMAP TlsExpansionBitmap; /* 150/238 */
360 ULONG TlsExpansionBitmapBits[32]; /* 154/240 */
361 ULONG SessionId; /* 1d4/2c0 */
362 ULARGE_INTEGER AppCompatFlags; /* 1d8/2c8 */
363 ULARGE_INTEGER AppCompatFlagsUser; /* 1e0/2d0 */
364 PVOID ShimData; /* 1e8/2d8 */
365 PVOID AppCompatInfo; /* 1ec/2e0 */
366 UNICODE_STRING CSDVersion; /* 1f0/2e8 */
367 PVOID ActivationContextData; /* 1f8/2f8 */
368 PVOID ProcessAssemblyStorageMap; /* 1fc/300 */
369 PVOID SystemDefaultActivationData; /* 200/308 */
370 PVOID SystemAssemblyStorageMap; /* 204/310 */
371 SIZE_T MinimumStackCommit; /* 208/318 */
372 PVOID *FlsCallback; /* 20c/320 */
373 LIST_ENTRY FlsListHead; /* 210/328 */
374 PRTL_BITMAP FlsBitmap; /* 218/338 */
375 ULONG FlsBitmapBits[4]; /* 21c/340 */
376 ULONG FlsHighIndex; /* 22c/350 */
377 PVOID WerRegistrationData; /* 230/358 */
378 PVOID WerShipAssertPtr; /* 234/360 */
379 PVOID pUnused; /* 238/368 */
380 PVOID pImageHeaderHash; /* 23c/370 */
381 ULONG TracingFlags; /* 240/378 */
382 ULONGLONG CsrServerReadOnlySharedMemoryBase; /* 248/380 */
383 ULONG TppWorkerpListLock; /* 250/388 */
384 LIST_ENTRY TppWorkerpList; /* 254/390 */
385 PVOID WaitOnAddressHashTable [0x80]; /* 25c/3a0 */
386 PVOID TelemetryCoverageHeader; /* 45c/7a0 */
387 ULONG CloudFileFlags; /* 460/7a8 */
388 ULONG CloudFileDiagFlags; /* 464/7ac */
389 CHAR PlaceholderCompatibilityMode; /* 468/7b0 */
390 CHAR PlaceholderCompatibilityModeReserved[7]; /* 469/7b1 */
391 PVOID LeapSecondData; /* 470/7b8 */
392 ULONG LeapSecondFlags; /* 474/7c0 */
393 ULONG NtGlobalFlag2; /* 478/7c4 */
394 } PEB, *PPEB;
395
396
397 /***********************************************************************
398 * TEB data structure
399 */
400 typedef struct _TEB
401 { /* win32/win64 */
402 NT_TIB Tib; /* 000/0000 */
403 PVOID EnvironmentPointer; /* 01c/0038 */
404 CLIENT_ID ClientId; /* 020/0040 */
405 PVOID ActiveRpcHandle; /* 028/0050 */
406 PVOID ThreadLocalStoragePointer; /* 02c/0058 */
407 PPEB Peb; /* 030/0060 */
408 ULONG LastErrorValue; /* 034/0068 */
409 ULONG CountOfOwnedCriticalSections; /* 038/006c */
410 PVOID CsrClientThread; /* 03c/0070 */
411 PVOID Win32ThreadInfo; /* 040/0078 */
412 ULONG User32Reserved[26]; /* 044/0080 */
413 ULONG UserReserved[5]; /* 0ac/00e8 */
414 PVOID WOW32Reserved; /* 0c0/0100 */
415 ULONG CurrentLocale; /* 0c4/0108 */
416 ULONG FpSoftwareStatusRegister; /* 0c8/010c */
417 PVOID ReservedForDebuggerInstrumentation[16]; /* 0cc/0110 */
418 #ifdef _WIN64
419 PVOID SystemReserved1[30]; /* /0190 */
420 #else
421 PVOID SystemReserved1[26]; /* 10c/ used for krnl386 private data in Wine */
422 #endif
423 char PlaceholderCompatibilityMode; /* 174/0280 */
424 char PlaceholderReserved[11]; /* 175/0281 */
425 DWORD ProxiedProcessId; /* 180/028c */
426 ACTIVATION_CONTEXT_STACK ActivationContextStack; /* 184/0290 */
427 UCHAR WorkingOnBehalfOfTicket[8]; /* 19c/02b8 */
428 LONG ExceptionCode; /* 1a4/02c0 */
429 ACTIVATION_CONTEXT_STACK *ActivationContextStackPointer; /* 1a8/02c8 */
430 ULONG_PTR InstrumentationCallbackSp; /* 1ac/02d0 */
431 ULONG_PTR InstrumentationCallbackPreviousPc; /* 1b0/02d8 */
432 ULONG_PTR InstrumentationCallbackPreviousSp; /* 1b4/02e0 */
433 #ifdef _WIN64
434 ULONG TxFsContext; /* /02e8 */
435 BOOLEAN InstrumentationCallbackDisabled; /* /02ec */
436 #else
437 BOOLEAN InstrumentationCallbackDisabled; /* 1b8/ */
438 BYTE SpareBytes1[23]; /* 1b9/ */
439 ULONG TxFsContext; /* 1d0/ */
440 #endif
441 GDI_TEB_BATCH GdiTebBatch; /* 1d4/02f0 used for ntdll private data in Wine */
442 CLIENT_ID RealClientId; /* 6b4/07d8 */
443 HANDLE GdiCachedProcessHandle; /* 6bc/07e8 */
444 ULONG GdiClientPID; /* 6c0/07f0 */
445 ULONG GdiClientTID; /* 6c4/07f4 */
446 PVOID GdiThreadLocaleInfo; /* 6c8/07f8 */
447 ULONG_PTR Win32ClientInfo[62]; /* 6cc/0800 used for user32 private data in Wine */
448 PVOID glDispatchTable[233]; /* 7c4/09f0 */
449 PVOID glReserved1[29]; /* b68/1138 */
450 PVOID glReserved2; /* bdc/1220 */
451 PVOID glSectionInfo; /* be0/1228 */
452 PVOID glSection; /* be4/1230 */
453 PVOID glTable; /* be8/1238 */
454 PVOID glCurrentRC; /* bec/1240 */
455 PVOID glContext; /* bf0/1248 */
456 ULONG LastStatusValue; /* bf4/1250 */
457 UNICODE_STRING StaticUnicodeString; /* bf8/1258 */
458 WCHAR StaticUnicodeBuffer[261]; /* c00/1268 */
459 PVOID DeallocationStack; /* e0c/1478 */
460 PVOID TlsSlots[64]; /* e10/1480 */
461 LIST_ENTRY TlsLinks; /* f10/1680 */
462 PVOID Vdm; /* f18/1690 */
463 PVOID ReservedForNtRpc; /* f1c/1698 */
464 PVOID DbgSsReserved[2]; /* f20/16a0 */
465 ULONG HardErrorDisabled; /* f28/16b0 */
466 PVOID Instrumentation[16]; /* f2c/16b8 */
467 PVOID WinSockData; /* f6c/1738 */
468 ULONG GdiBatchCount; /* f70/1740 */
469 ULONG Spare2; /* f74/1744 */
470 ULONG GuaranteedStackBytes; /* f78/1748 */
471 PVOID ReservedForPerf; /* f7c/1750 */
472 PVOID ReservedForOle; /* f80/1758 */
473 ULONG WaitingOnLoaderLock; /* f84/1760 */
474 PVOID Reserved5[3]; /* f88/1768 */
475 PVOID *TlsExpansionSlots; /* f94/1780 */
476 #ifdef _WIN64
477 PVOID DeallocationBStore; /* /1788 */
478 PVOID BStoreLimit; /* /1790 */
479 #endif
480 ULONG ImpersonationLocale; /* f98/1798 */
481 ULONG IsImpersonating; /* f9c/179c */
482 PVOID NlsCache; /* fa0/17a0 */
483 PVOID ShimData; /* fa4/17a8 */
484 ULONG HeapVirtualAffinity; /* fa8/17b0 */
485 PVOID CurrentTransactionHandle; /* fac/17b8 */
486 TEB_ACTIVE_FRAME *ActiveFrame; /* fb0/17c0 */
487 TEB_FLS_DATA *FlsSlots; /* fb4/17c8 */
488 PVOID PreferredLanguages; /* fb8/17d0 */
489 PVOID UserPrefLanguages; /* fbc/17d8 */
490 PVOID MergedPrefLanguages; /* fc0/17e0 */
491 ULONG MuiImpersonation; /* fc4/17e8 */
492 USHORT CrossTebFlags; /* fc8/17ec */
493 USHORT SameTebFlags; /* fca/17ee */
494 PVOID TxnScopeEnterCallback; /* fcc/17f0 */
495 PVOID TxnScopeExitCallback; /* fd0/17f8 */
496 PVOID TxnScopeContext; /* fd4/1800 */
497 ULONG LockCount; /* fd8/1808 */
498 LONG WowTebOffset; /* fdc/180c */
499 PVOID ResourceRetValue; /* fe0/1810 */
500 PVOID ReservedForWdf; /* fe4/1818 */
501 ULONGLONG ReservedForCrt; /* fe8/1820 */
502 GUID EffectiveContainerId; /* ff0/1828 */
503 } TEB, *PTEB;
504
505
506 /***********************************************************************
507 * The 32-bit/64-bit version of the PEB and TEB for WoW64
508 */
509 typedef struct _NT_TIB32
510 {
511 ULONG ExceptionList; /* 0000 */
512 ULONG StackBase; /* 0004 */
513 ULONG StackLimit; /* 0008 */
514 ULONG SubSystemTib; /* 000c */
515 ULONG FiberData; /* 0010 */
516 ULONG ArbitraryUserPointer; /* 0014 */
517 ULONG Self; /* 0018 */
518 } NT_TIB32;
519
520 typedef struct _NT_TIB64
521 {
522 ULONG64 ExceptionList; /* 0000 */
523 ULONG64 StackBase; /* 0008 */
524 ULONG64 StackLimit; /* 0010 */
525 ULONG64 SubSystemTib; /* 0018 */
526 ULONG64 FiberData; /* 0020 */
527 ULONG64 ArbitraryUserPointer; /* 0028 */
528 ULONG64 Self; /* 0030 */
529 } NT_TIB64;
530
531 typedef struct _CLIENT_ID32
532 {
533 ULONG UniqueProcess;
534 ULONG UniqueThread;
535 } CLIENT_ID32;
536
537 typedef struct _CLIENT_ID64
538 {
539 ULONG64 UniqueProcess;
540 ULONG64 UniqueThread;
541 } CLIENT_ID64;
542
543 typedef struct _LIST_ENTRY32
544 {
545 ULONG Flink;
546 ULONG Blink;
547 } LIST_ENTRY32;
548
549 typedef struct _LIST_ENTRY64
550 {
551 ULONG64 Flink;
552 ULONG64 Blink;
553 } LIST_ENTRY64;
554
555 typedef struct _UNICODE_STRING32
556 {
557 USHORT Length;
558 USHORT MaximumLength;
559 ULONG Buffer;
560 } UNICODE_STRING32;
561
562 typedef struct _UNICODE_STRING64
563 {
564 USHORT Length;
565 USHORT MaximumLength;
566 ULONG64 Buffer;
567 } UNICODE_STRING64;
568
569 typedef struct _ACTIVATION_CONTEXT_STACK32
570 {
571 ULONG ActiveFrame;
572 LIST_ENTRY32 FrameListCache;
573 ULONG Flags;
574 ULONG NextCookieSequenceNumber;
575 ULONG32 StackId;
576 } ACTIVATION_CONTEXT_STACK32;
577
578 typedef struct _ACTIVATION_CONTEXT_STACK64
579 {
580 ULONG64 ActiveFrame;
581 LIST_ENTRY64 FrameListCache;
582 ULONG Flags;
583 ULONG NextCookieSequenceNumber;
584 ULONG64 StackId;
585 } ACTIVATION_CONTEXT_STACK64;
586
587 typedef struct _PEB_LDR_DATA32
588 {
589 ULONG Length;
590 BOOLEAN Initialized;
591 ULONG SsHandle;
592 LIST_ENTRY32 InLoadOrderModuleList;
593 LIST_ENTRY32 InMemoryOrderModuleList;
594 LIST_ENTRY32 InInitializationOrderModuleList;
595 ULONG EntryInProgress;
596 BOOLEAN ShutdownInProgress;
597 ULONG ShutdownThreadId;
598 } PEB_LDR_DATA32, *PPEB_LDR_DATA32;
599
600 typedef struct _PEB_LDR_DATA64
601 {
602 ULONG Length;
603 BOOLEAN Initialized;
604 ULONG64 SsHandle;
605 LIST_ENTRY64 InLoadOrderModuleList;
606 LIST_ENTRY64 InMemoryOrderModuleList;
607 LIST_ENTRY64 InInitializationOrderModuleList;
608 ULONG64 EntryInProgress;
609 BOOLEAN ShutdownInProgress;
610 ULONG64 ShutdownThreadId;
611 } PEB_LDR_DATA64, *PPEB_LDR_DATA64;
612
613 typedef struct _PEB32
614 {
615 BOOLEAN InheritedAddressSpace; /* 0000 */
616 BOOLEAN ReadImageFileExecOptions; /* 0001 */
617 BOOLEAN BeingDebugged; /* 0002 */
618 BOOLEAN SpareBool; /* 0003 */
619 ULONG Mutant; /* 0004 */
620 ULONG ImageBaseAddress; /* 0008 */
621 ULONG LdrData; /* 000c */
622 ULONG ProcessParameters; /* 0010 */
623 ULONG SubSystemData; /* 0014 */
624 ULONG ProcessHeap; /* 0018 */
625 ULONG FastPebLock; /* 001c */
626 ULONG FastPebLockRoutine; /* 0020 */
627 ULONG FastPebUnlockRoutine; /* 0024 */
628 ULONG EnvironmentUpdateCount; /* 0028 */
629 ULONG KernelCallbackTable; /* 002c */
630 ULONG Reserved; /* 0030 */
631 ULONG AtlThunkSListPtr32; /* 0034 */
632 ULONG FreeList; /* 0038 */
633 ULONG TlsExpansionCounter; /* 003c */
634 ULONG TlsBitmap; /* 0040 */
635 ULONG TlsBitmapBits[2]; /* 0044 */
636 ULONG ReadOnlySharedMemoryBase; /* 004c */
637 ULONG ReadOnlySharedMemoryHeap; /* 0050 */
638 ULONG ReadOnlyStaticServerData; /* 0054 */
639 ULONG AnsiCodePageData; /* 0058 */
640 ULONG OemCodePageData; /* 005c */
641 ULONG UnicodeCaseTableData; /* 0060 */
642 ULONG NumberOfProcessors; /* 0064 */
643 ULONG NtGlobalFlag; /* 0068 */
644 LARGE_INTEGER CriticalSectionTimeout; /* 0070 */
645 ULONG HeapSegmentReserve; /* 0078 */
646 ULONG HeapSegmentCommit; /* 007c */
647 ULONG HeapDeCommitTotalFreeThreshold; /* 0080 */
648 ULONG HeapDeCommitFreeBlockThreshold; /* 0084 */
649 ULONG NumberOfHeaps; /* 0088 */
650 ULONG MaximumNumberOfHeaps; /* 008c */
651 ULONG ProcessHeaps; /* 0090 */
652 ULONG GdiSharedHandleTable; /* 0094 */
653 ULONG ProcessStarterHelper; /* 0098 */
654 ULONG GdiDCAttributeList; /* 009c */
655 ULONG LoaderLock; /* 00a0 */
656 ULONG OSMajorVersion; /* 00a4 */
657 ULONG OSMinorVersion; /* 00a8 */
658 ULONG OSBuildNumber; /* 00ac */
659 ULONG OSPlatformId; /* 00b0 */
660 ULONG ImageSubSystem; /* 00b4 */
661 ULONG ImageSubSystemMajorVersion; /* 00b8 */
662 ULONG ImageSubSystemMinorVersion; /* 00bc */
663 ULONG ImageProcessAffinityMask; /* 00c0 */
664 ULONG GdiHandleBuffer[28]; /* 00c4 */
665 ULONG unknown[6]; /* 0134 */
666 ULONG PostProcessInitRoutine; /* 014c */
667 ULONG TlsExpansionBitmap; /* 0150 */
668 ULONG TlsExpansionBitmapBits[32]; /* 0154 */
669 ULONG SessionId; /* 01d4 */
670 ULARGE_INTEGER AppCompatFlags; /* 01d8 */
671 ULARGE_INTEGER AppCompatFlagsUser; /* 01e0 */
672 ULONG ShimData; /* 01e8 */
673 ULONG AppCompatInfo; /* 01ec */
674 UNICODE_STRING CSDVersion; /* 01f0 */
675 ULONG ActivationContextData; /* 01f8 */
676 ULONG ProcessAssemblyStorageMap; /* 01fc */
677 ULONG SystemDefaultActivationData; /* 0200 */
678 ULONG SystemAssemblyStorageMap; /* 0204 */
679 ULONG MinimumStackCommit; /* 0208 */
680 ULONG FlsCallback; /* 020c */
681 LIST_ENTRY FlsListHead; /* 0210 */
682 ULONG FlsBitmap; /* 0218 */
683 ULONG FlsBitmapBits[4]; /* 021c */
684 ULONG FlsHighIndex; /* 022c */
685 ULONG WerRegistrationData; /* 0230 */
686 ULONG WerShipAssertPtr; /* 0234 */
687 ULONG pUnused; /* 0238 */
688 ULONG pImageHeaderHash; /* 023c */
689 ULONG TracingFlags; /* 0240 */
690 ULONGLONG CsrServerReadOnlySharedMemoryBase; /* 0248 */
691 ULONG TppWorkerpListLock; /* 0250 */
692 LIST_ENTRY TppWorkerpList; /* 0254 */
693 ULONG WaitOnAddressHashTable [0x80]; /* 025c */
694 ULONG TelemetryCoverageHeader; /* 045c */
695 ULONG CloudFileFlags; /* 0460 */
696 ULONG CloudFileDiagFlags; /* 0464 */
697 CHAR PlaceholderCompatibilityMode; /* 0468 */
698 CHAR PlaceholderCompatibilityModeReserved[7]; /* 0469 */
699 ULONG LeapSecondData; /* 0470 */
700 ULONG LeapSecondFlags; /* 0474 */
701 ULONG NtGlobalFlag2; /* 0478 */
702 } PEB32;
703
704 typedef struct _PEB64
705 {
706 BOOLEAN InheritedAddressSpace; /* 0000 */
707 BOOLEAN ReadImageFileExecOptions; /* 0001 */
708 BOOLEAN BeingDebugged; /* 0002 */
709 BOOLEAN SpareBool; /* 0003 */
710 ULONG64 Mutant; /* 0008 */
711 ULONG64 ImageBaseAddress; /* 0010 */
712 ULONG64 LdrData; /* 0018 */
713 ULONG64 ProcessParameters; /* 0020 */
714 ULONG64 SubSystemData; /* 0028 */
715 ULONG64 ProcessHeap; /* 0030 */
716 ULONG64 FastPebLock; /* 0038 */
717 ULONG64 FastPebLockRoutine; /* 0040 */
718 ULONG64 FastPebUnlockRoutine; /* 0048 */
719 ULONG EnvironmentUpdateCount; /* 0050 */
720 ULONG64 KernelCallbackTable; /* 0058 */
721 ULONG Reserved; /* 0060 */
722 ULONG AtlThunkSListPtr32; /* 0064 */
723 ULONG64 FreeList; /* 0068 */
724 ULONG TlsExpansionCounter; /* 0070 */
725 ULONG64 TlsBitmap; /* 0078 */
726 ULONG TlsBitmapBits[2]; /* 0080 */
727 ULONG64 ReadOnlySharedMemoryBase; /* 0088 */
728 ULONG64 ReadOnlySharedMemoryHeap; /* 0090 */
729 ULONG64 ReadOnlyStaticServerData; /* 0098 */
730 ULONG64 AnsiCodePageData; /* 00a0 */
731 ULONG64 OemCodePageData; /* 00a8 */
732 ULONG64 UnicodeCaseTableData; /* 00b0 */
733 ULONG NumberOfProcessors; /* 00b8 */
734 ULONG NtGlobalFlag; /* 00bc */
735 LARGE_INTEGER CriticalSectionTimeout; /* 00c0 */
736 ULONG64 HeapSegmentReserve; /* 00c8 */
737 ULONG64 HeapSegmentCommit; /* 00d0 */
738 ULONG64 HeapDeCommitTotalFreeThreshold; /* 00d8 */
739 ULONG64 HeapDeCommitFreeBlockThreshold; /* 00e0 */
740 ULONG NumberOfHeaps; /* 00e8 */
741 ULONG MaximumNumberOfHeaps; /* 00ec */
742 ULONG64 ProcessHeaps; /* 00f0 */
743 ULONG64 GdiSharedHandleTable; /* 00f8 */
744 ULONG64 ProcessStarterHelper; /* 0100 */
745 ULONG64 GdiDCAttributeList; /* 0108 */
746 ULONG64 LoaderLock; /* 0110 */
747 ULONG OSMajorVersion; /* 0118 */
748 ULONG OSMinorVersion; /* 011c */
749 ULONG OSBuildNumber; /* 0120 */
750 ULONG OSPlatformId; /* 0124 */
751 ULONG ImageSubSystem; /* 0128 */
752 ULONG ImageSubSystemMajorVersion; /* 012c */
753 ULONG ImageSubSystemMinorVersion; /* 0130 */
754 ULONG ImageProcessAffinityMask; /* 0134 */
755 ULONG64 GdiHandleBuffer[28]; /* 0138 */
756 ULONG unknown[6]; /* 0218 */
757 ULONG64 PostProcessInitRoutine; /* 0230 */
758 ULONG64 TlsExpansionBitmap; /* 0238 */
759 ULONG TlsExpansionBitmapBits[32]; /* 0240 */
760 ULONG SessionId; /* 02c0 */
761 ULARGE_INTEGER AppCompatFlags; /* 02c8 */
762 ULARGE_INTEGER AppCompatFlagsUser; /* 02d0 */
763 ULONG64 ShimData; /* 02d8 */
764 ULONG64 AppCompatInfo; /* 02e0 */
765 UNICODE_STRING64 CSDVersion; /* 02e8 */
766 ULONG64 ActivationContextData; /* 02f8 */
767 ULONG64 ProcessAssemblyStorageMap; /* 0300 */
768 ULONG64 SystemDefaultActivationData; /* 0308 */
769 ULONG64 SystemAssemblyStorageMap; /* 0310 */
770 ULONG64 MinimumStackCommit; /* 0318 */
771 ULONG64 FlsCallback; /* 0320 */
772 LIST_ENTRY64 FlsListHead; /* 0328 */
773 ULONG64 FlsBitmap; /* 0338 */
774 ULONG FlsBitmapBits[4]; /* 0340 */
775 ULONG FlsHighIndex; /* 0350 */
776 ULONG64 WerRegistrationData; /* 0358 */
777 ULONG64 WerShipAssertPtr; /* 0360 */
778 ULONG64 pUnused; /* 0368 */
779 ULONG64 pImageHeaderHash; /* 0370 */
780 ULONG TracingFlags; /* 0378 */
781 ULONGLONG CsrServerReadOnlySharedMemoryBase; /* 0380 */
782 ULONG TppWorkerpListLock; /* 0388 */
783 LIST_ENTRY64 TppWorkerpList; /* 0390 */
784 ULONG64 WaitOnAddressHashTable [0x80]; /* 03a0 */
785 ULONG64 TelemetryCoverageHeader; /* 07a0 */
786 ULONG CloudFileFlags; /* 07a8 */
787 ULONG CloudFileDiagFlags; /* 07ac */
788 CHAR PlaceholderCompatibilityMode; /* 07b0 */
789 CHAR PlaceholderCompatibilityModeReserved[7]; /* 07b1 */
790 ULONG64 LeapSecondData; /* 07b8 */
791 ULONG LeapSecondFlags; /* 07c0 */
792 ULONG NtGlobalFlag2; /* 07c4 */
793 } PEB64;
794
795 typedef struct _TEB32
796 {
797 NT_TIB32 Tib; /* 0000 */
798 ULONG EnvironmentPointer; /* 001c */
799 CLIENT_ID32 ClientId; /* 0020 */
800 ULONG ActiveRpcHandle; /* 0028 */
801 ULONG ThreadLocalStoragePointer; /* 002c */
802 ULONG Peb; /* 0030 */
803 ULONG LastErrorValue; /* 0034 */
804 ULONG CountOfOwnedCriticalSections; /* 0038 */
805 ULONG CsrClientThread; /* 003c */
806 ULONG Win32ThreadInfo; /* 0040 */
807 ULONG User32Reserved[26]; /* 0044 */
808 ULONG UserReserved[5]; /* 00ac */
809 ULONG WOW32Reserved; /* 00c0 */
810 ULONG CurrentLocale; /* 00c4 */
811 ULONG FpSoftwareStatusRegister; /* 00c8 */
812 ULONG ReservedForDebuggerInstrumentation[16]; /* 00cc */
813 ULONG SystemReserved1[26]; /* 010c */
814 char PlaceholderCompatibilityMode; /* 0174 */
815 char PlaceholderReserved[11]; /* 0175 */
816 DWORD ProxiedProcessId; /* 0180 */
817 ACTIVATION_CONTEXT_STACK32 ActivationContextStack; /* 0184 */
818 UCHAR WorkingOnBehalfOfTicket[8]; /* 019c */
819 LONG ExceptionCode; /* 01a4 */
820 ULONG ActivationContextStackPointer; /* 01a8 */
821 ULONG InstrumentationCallbackSp; /* 01ac */
822 ULONG InstrumentationCallbackPreviousPc; /* 01b0 */
823 ULONG InstrumentationCallbackPreviousSp; /* 01b4 */
824 BOOLEAN InstrumentationCallbackDisabled; /* 01b8 */
825 BYTE SpareBytes1[23]; /* 01b9 */
826 ULONG TxFsContext; /* 01d0 */
827 ULONG GdiTebBatch[0x138]; /* 01d4 */
828 CLIENT_ID32 RealClientId; /* 06b4 */
829 ULONG GdiCachedProcessHandle; /* 06bc */
830 ULONG GdiClientPID; /* 06c0 */
831 ULONG GdiClientTID; /* 06c4 */
832 ULONG GdiThreadLocaleInfo; /* 06c8 */
833 ULONG Win32ClientInfo[62]; /* 06cc */
834 ULONG glDispatchTable[233]; /* 07c4 */
835 ULONG glReserved1[29]; /* 0b68 */
836 ULONG glReserved2; /* 0bdc */
837 ULONG glSectionInfo; /* 0be0 */
838 ULONG glSection; /* 0be4 */
839 ULONG glTable; /* 0be8 */
840 ULONG glCurrentRC; /* 0bec */
841 ULONG glContext; /* 0bf0 */
842 ULONG LastStatusValue; /* 0bf4 */
843 UNICODE_STRING32 StaticUnicodeString; /* 0bf8 */
844 WCHAR StaticUnicodeBuffer[261]; /* 0c00 */
845 ULONG DeallocationStack; /* 0e0c */
846 ULONG TlsSlots[64]; /* 0e10 */
847 LIST_ENTRY32 TlsLinks; /* 0f10 */
848 ULONG Vdm; /* 0f18 */
849 ULONG ReservedForNtRpc; /* 0f1c */
850 ULONG DbgSsReserved[2]; /* 0f20 */
851 ULONG HardErrorDisabled; /* 0f28 */
852 ULONG Instrumentation[16]; /* 0f2c */
853 ULONG WinSockData; /* 0f6c */
854 ULONG GdiBatchCount; /* 0f70 */
855 ULONG Spare2; /* 0f74 */
856 ULONG GuaranteedStackBytes; /* 0f78 */
857 ULONG ReservedForPerf; /* 0f7c */
858 ULONG ReservedForOle; /* 0f80 */
859 ULONG WaitingOnLoaderLock; /* 0f84 */
860 ULONG Reserved5[3]; /* 0f88 */
861 ULONG TlsExpansionSlots; /* 0f94 */
862 ULONG ImpersonationLocale; /* 0f98 */
863 ULONG IsImpersonating; /* 0f9c */
864 ULONG NlsCache; /* 0fa0 */
865 ULONG ShimData; /* 0fa4 */
866 ULONG HeapVirtualAffinity; /* 0fa8 */
867 ULONG CurrentTransactionHandle; /* 0fac */
868 ULONG ActiveFrame; /* 0fb0 */
869 ULONG FlsSlots; /* 0fb4 */
870 ULONG PreferredLanguages; /* 0fb8 */
871 ULONG UserPrefLanguages; /* 0fbc */
872 ULONG MergedPrefLanguages; /* 0fc0 */
873 ULONG MuiImpersonation; /* 0fc4 */
874 USHORT CrossTebFlags; /* 0fc8 */
875 USHORT SameTebFlags; /* 0fca */
876 ULONG TxnScopeEnterCallback; /* 0fcc */
877 ULONG TxnScopeExitCallback; /* 0fd0 */
878 ULONG TxnScopeContext; /* 0fd4 */
879 ULONG LockCount; /* 0fd8 */
880 LONG WowTebOffset; /* 0fdc */
881 ULONG ResourceRetValue; /* 0fe0 */
882 ULONG ReservedForWdf; /* 0fe4 */
883 ULONGLONG ReservedForCrt; /* 0fe8 */
884 GUID EffectiveContainerId; /* 0ff0 */
885 } TEB32;
886
887 typedef struct _TEB64
888 {
889 NT_TIB64 Tib; /* 0000 */
890 ULONG64 EnvironmentPointer; /* 0038 */
891 CLIENT_ID64 ClientId; /* 0040 */
892 ULONG64 ActiveRpcHandle; /* 0050 */
893 ULONG64 ThreadLocalStoragePointer; /* 0058 */
894 ULONG64 Peb; /* 0060 */
895 ULONG LastErrorValue; /* 0068 */
896 ULONG CountOfOwnedCriticalSections; /* 006c */
897 ULONG64 CsrClientThread; /* 0070 */
898 ULONG64 Win32ThreadInfo; /* 0078 */
899 ULONG User32Reserved[26]; /* 0080 */
900 ULONG UserReserved[5]; /* 00e8 */
901 ULONG64 WOW32Reserved; /* 0100 */
902 ULONG CurrentLocale; /* 0108 */
903 ULONG FpSoftwareStatusRegister; /* 010c */
904 ULONG64 ReservedForDebuggerInstrumentation[16]; /* 0110 */
905 ULONG64 SystemReserved1[30]; /* 0190 */
906 char PlaceholderCompatibilityMode; /* 0280 */
907 char PlaceholderReserved[11]; /* 0281 */
908 DWORD ProxiedProcessId; /* 028c */
909 ACTIVATION_CONTEXT_STACK64 ActivationContextStack; /* 0290 */
910 UCHAR WorkingOnBehalfOfTicket[8]; /* 02b8 */
911 LONG ExceptionCode; /* 02c0 */
912 ULONG64 ActivationContextStackPointer; /* 02c8 */
913 ULONG64 InstrumentationCallbackSp; /* 02d0 */
914 ULONG64 InstrumentationCallbackPreviousPc; /* 02d8 */
915 ULONG64 InstrumentationCallbackPreviousSp; /* 02e0 */
916 ULONG TxFsContext; /* 02e8 */
917 BOOLEAN InstrumentationCallbackDisabled; /* 02ec */
918 ULONG64 GdiTebBatch[0x9d]; /* 02f0 */
919 CLIENT_ID64 RealClientId; /* 07d8 */
920 ULONG64 GdiCachedProcessHandle; /* 07e8 */
921 ULONG GdiClientPID; /* 07f0 */
922 ULONG GdiClientTID; /* 07f4 */
923 ULONG64 GdiThreadLocaleInfo; /* 07f8 */
924 ULONG64 Win32ClientInfo[62]; /* 0800 */
925 ULONG64 glDispatchTable[233]; /* 09f0 */
926 ULONG64 glReserved1[29]; /* 1138 */
927 ULONG64 glReserved2; /* 1220 */
928 ULONG64 glSectionInfo; /* 1228 */
929 ULONG64 glSection; /* 1230 */
930 ULONG64 glTable; /* 1238 */
931 ULONG64 glCurrentRC; /* 1240 */
932 ULONG64 glContext; /* 1248 */
933 ULONG LastStatusValue; /* 1250 */
934 UNICODE_STRING64 StaticUnicodeString; /* 1258 */
935 WCHAR StaticUnicodeBuffer[261]; /* 1268 */
936 ULONG64 DeallocationStack; /* 1478 */
937 ULONG64 TlsSlots[64]; /* 1480 */
938 LIST_ENTRY64 TlsLinks; /* 1680 */
939 ULONG64 Vdm; /* 1690 */
940 ULONG64 ReservedForNtRpc; /* 1698 */
941 ULONG64 DbgSsReserved[2]; /* 16a0 */
942 ULONG HardErrorDisabled; /* 16b0 */
943 ULONG64 Instrumentation[16]; /* 16b8 */
944 ULONG64 WinSockData; /* 1738 */
945 ULONG GdiBatchCount; /* 1740 */
946 ULONG Spare2; /* 1744 */
947 ULONG GuaranteedStackBytes; /* 1748 */
948 ULONG64 ReservedForPerf; /* 1750 */
949 ULONG64 ReservedForOle; /* 1758 */
950 ULONG WaitingOnLoaderLock; /* 1760 */
951 ULONG64 Reserved5[3]; /* 1768 */
952 ULONG64 TlsExpansionSlots; /* 1780 */
953 ULONG64 DeallocationBStore; /* 1788 */
954 ULONG64 BStoreLimit; /* 1790 */
955 ULONG ImpersonationLocale; /* 1798 */
956 ULONG IsImpersonating; /* 179c */
957 ULONG64 NlsCache; /* 17a0 */
958 ULONG64 ShimData; /* 17a8 */
959 ULONG HeapVirtualAffinity; /* 17b0 */
960 ULONG64 CurrentTransactionHandle; /* 17b8 */
961 ULONG64 ActiveFrame; /* 17c0 */
962 ULONG64 FlsSlots; /* 17c8 */
963 ULONG64 PreferredLanguages; /* 17d0 */
964 ULONG64 UserPrefLanguages; /* 17d8 */
965 ULONG64 MergedPrefLanguages; /* 17e0 */
966 ULONG MuiImpersonation; /* 17e8 */
967 USHORT CrossTebFlags; /* 17ec */
968 USHORT SameTebFlags; /* 17ee */
969 ULONG64 TxnScopeEnterCallback; /* 17f0 */
970 ULONG64 TxnScopeExitCallback; /* 17f8 */
971 ULONG64 TxnScopeContext; /* 1800 */
972 ULONG LockCount; /* 1808 */
973 LONG WowTebOffset; /* 180c */
974 ULONG64 ResourceRetValue; /* 1810 */
975 ULONG64 ReservedForWdf; /* 1818 */
976 ULONGLONG ReservedForCrt; /* 1820 */
977 GUID EffectiveContainerId; /* 1828 */
978 } TEB64;
979
980 /* reserved TEB64 TLS slots for Wow64 */
981 #define WOW64_TLS_FILESYSREDIR 8
982
983
984 /***********************************************************************
985 * Enums
986 */
987
988 typedef enum _FILE_INFORMATION_CLASS {
989 FileDirectoryInformation = 1,
990 FileFullDirectoryInformation,
991 FileBothDirectoryInformation,
992 FileBasicInformation,
993 FileStandardInformation,
994 FileInternalInformation,
995 FileEaInformation,
996 FileAccessInformation,
997 FileNameInformation,
998 FileRenameInformation,
999 FileLinkInformation,
1000 FileNamesInformation,
1001 FileDispositionInformation,
1002 FilePositionInformation,
1003 FileFullEaInformation,
1004 FileModeInformation,
1005 FileAlignmentInformation,
1006 FileAllInformation,
1007 FileAllocationInformation,
1008 FileEndOfFileInformation,
1009 FileAlternateNameInformation,
1010 FileStreamInformation,
1011 FilePipeInformation,
1012 FilePipeLocalInformation,
1013 FilePipeRemoteInformation,
1014 FileMailslotQueryInformation,
1015 FileMailslotSetInformation,
1016 FileCompressionInformation,
1017 FileObjectIdInformation,
1018 FileCompletionInformation,
1019 FileMoveClusterInformation,
1020 FileQuotaInformation,
1021 FileReparsePointInformation,
1022 FileNetworkOpenInformation,
1023 FileAttributeTagInformation,
1024 FileTrackingInformation,
1025 FileIdBothDirectoryInformation,
1026 FileIdFullDirectoryInformation,
1027 FileValidDataLengthInformation,
1028 FileShortNameInformation,
1029 FileIoCompletionNotificationInformation,
1030 FileIoStatusBlockRangeInformation,
1031 FileIoPriorityHintInformation,
1032 FileSfioReserveInformation,
1033 FileSfioVolumeInformation,
1034 FileHardLinkInformation,
1035 FileProcessIdsUsingFileInformation,
1036 FileNormalizedNameInformation,
1037 FileNetworkPhysicalNameInformation,
1038 FileIdGlobalTxDirectoryInformation,
1039 FileIsRemoteDeviceInformation,
1040 FileAttributeCacheInformation,
1041 FileNumaNodeInformation,
1042 FileStandardLinkInformation,
1043 FileRemoteProtocolInformation,
1044 FileRenameInformationBypassAccessCheck,
1045 FileLinkInformationBypassAccessCheck,
1046 FileVolumeNameInformation,
1047 FileIdInformation,
1048 FileIdExtdDirectoryInformation,
1049 FileReplaceCompletionInformation,
1050 FileHardLinkFullIdInformation,
1051 FileIdExtdBothDirectoryInformation,
1052 FileMaximumInformation
1053 } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
1054
1055 typedef struct _FILE_DIRECTORY_INFORMATION {
1056 ULONG NextEntryOffset;
1057 ULONG FileIndex;
1058 LARGE_INTEGER CreationTime;
1059 LARGE_INTEGER LastAccessTime;
1060 LARGE_INTEGER LastWriteTime;
1061 LARGE_INTEGER ChangeTime;
1062 LARGE_INTEGER EndOfFile;
1063 LARGE_INTEGER AllocationSize;
1064 ULONG FileAttributes;
1065 ULONG FileNameLength;
1066 WCHAR FileName[ANYSIZE_ARRAY];
1067 } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
1068
1069 typedef struct _FILE_FULL_DIRECTORY_INFORMATION {
1070 ULONG NextEntryOffset;
1071 ULONG FileIndex;
1072 LARGE_INTEGER CreationTime;
1073 LARGE_INTEGER LastAccessTime;
1074 LARGE_INTEGER LastWriteTime;
1075 LARGE_INTEGER ChangeTime;
1076 LARGE_INTEGER EndOfFile;
1077 LARGE_INTEGER AllocationSize;
1078 ULONG FileAttributes;
1079 ULONG FileNameLength;
1080 ULONG EaSize;
1081 WCHAR FileName[ANYSIZE_ARRAY];
1082 } FILE_FULL_DIRECTORY_INFORMATION, *PFILE_FULL_DIRECTORY_INFORMATION,
1083 FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
1084
1085 typedef struct _FILE_ID_FULL_DIRECTORY_INFORMATION {
1086 ULONG NextEntryOffset;
1087 ULONG FileIndex;
1088 LARGE_INTEGER CreationTime;
1089 LARGE_INTEGER LastAccessTime;
1090 LARGE_INTEGER LastWriteTime;
1091 LARGE_INTEGER ChangeTime;
1092 LARGE_INTEGER EndOfFile;
1093 LARGE_INTEGER AllocationSize;
1094 ULONG FileAttributes;
1095 ULONG FileNameLength;
1096 ULONG EaSize;
1097 LARGE_INTEGER FileId;
1098 WCHAR FileName[ANYSIZE_ARRAY];
1099 } FILE_ID_FULL_DIRECTORY_INFORMATION, *PFILE_ID_FULL_DIRECTORY_INFORMATION;
1100
1101 typedef struct _FILE_BOTH_DIRECTORY_INFORMATION {
1102 ULONG NextEntryOffset;
1103 ULONG FileIndex;
1104 LARGE_INTEGER CreationTime;
1105 LARGE_INTEGER LastAccessTime;
1106 LARGE_INTEGER LastWriteTime;
1107 LARGE_INTEGER ChangeTime;
1108 LARGE_INTEGER EndOfFile;
1109 LARGE_INTEGER AllocationSize;
1110 ULONG FileAttributes;
1111 ULONG FileNameLength;
1112 ULONG EaSize;
1113 CHAR ShortNameLength;
1114 WCHAR ShortName[12];
1115 WCHAR FileName[ANYSIZE_ARRAY];
1116 } FILE_BOTH_DIRECTORY_INFORMATION, *PFILE_BOTH_DIRECTORY_INFORMATION,
1117 FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
1118
1119 typedef struct _FILE_ID_BOTH_DIRECTORY_INFORMATION {
1120 ULONG NextEntryOffset;
1121 ULONG FileIndex;
1122 LARGE_INTEGER CreationTime;
1123 LARGE_INTEGER LastAccessTime;
1124 LARGE_INTEGER LastWriteTime;
1125 LARGE_INTEGER ChangeTime;
1126 LARGE_INTEGER EndOfFile;
1127 LARGE_INTEGER AllocationSize;
1128 ULONG FileAttributes;
1129 ULONG FileNameLength;
1130 ULONG EaSize;
1131 CHAR ShortNameLength;
1132 WCHAR ShortName[12];
1133 LARGE_INTEGER FileId;
1134 WCHAR FileName[ANYSIZE_ARRAY];
1135 } FILE_ID_BOTH_DIRECTORY_INFORMATION, *PFILE_ID_BOTH_DIRECTORY_INFORMATION;
1136
1137 typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION {
1138 ULONG NextEntryOffset;
1139 ULONG FileIndex;
1140 LARGE_INTEGER CreationTime;
1141 LARGE_INTEGER LastAccessTime;
1142 LARGE_INTEGER LastWriteTime;
1143 LARGE_INTEGER ChangeTime;
1144 LARGE_INTEGER EndOfFile;
1145 LARGE_INTEGER AllocationSize;
1146 ULONG FileAttributes;
1147 ULONG FileNameLength;
1148 LARGE_INTEGER FileId;
1149 GUID LockingTransactionId;
1150 ULONG TxInfoFlags;
1151 WCHAR FileName[ANYSIZE_ARRAY];
1152 } FILE_ID_GLOBAL_TX_DIR_INFORMATION, *PFILE_ID_GLOBAL_TX_DIR_INFORMATION;
1153
1154 typedef struct _FILE_BASIC_INFORMATION {
1155 LARGE_INTEGER CreationTime;
1156 LARGE_INTEGER LastAccessTime;
1157 LARGE_INTEGER LastWriteTime;
1158 LARGE_INTEGER ChangeTime;
1159 ULONG FileAttributes;
1160 } FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
1161
1162 typedef struct _FILE_STANDARD_INFORMATION {
1163 LARGE_INTEGER AllocationSize;
1164 LARGE_INTEGER EndOfFile;
1165 ULONG NumberOfLinks;
1166 BOOLEAN DeletePending;
1167 BOOLEAN Directory;
1168 } FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;
1169
1170 typedef struct _FILE_INTERNAL_INFORMATION {
1171 LARGE_INTEGER IndexNumber;
1172 } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
1173
1174 typedef struct _FILE_ID_128 {
1175 UCHAR Identifier[16];
1176 } FILE_ID_128, *PFILE_ID_128;
1177
1178 typedef struct _FILE_ID_INFORMATION {
1179 ULONGLONG VolumeSerialNumber;
1180 FILE_ID_128 FileId;
1181 } FILE_ID_INFORMATION, *PFILE_ID_INFORMATION;
1182
1183 typedef struct _FILE_EA_INFORMATION {
1184 ULONG EaSize;
1185 } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
1186
1187 typedef struct _FILE_ACCESS_INFORMATION {
1188 ACCESS_MASK AccessFlags;
1189 } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
1190
1191 typedef struct _FILE_NAME_INFORMATION {
1192 ULONG FileNameLength;
1193 WCHAR FileName[1];
1194 } FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;
1195
1196 typedef struct _FILE_RENAME_INFORMATION {
1197 BOOLEAN ReplaceIfExists;
1198 HANDLE RootDirectory;
1199 ULONG FileNameLength;
1200 WCHAR FileName[1];
1201 } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
1202
1203 typedef struct _FILE_LINK_INFORMATION {
1204 BOOLEAN ReplaceIfExists;
1205 HANDLE RootDirectory;
1206 ULONG FileNameLength;
1207 WCHAR FileName[1];
1208 } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
1209
1210 typedef struct _FILE_NAMES_INFORMATION {
1211 ULONG NextEntryOffset;
1212 ULONG FileIndex;
1213 ULONG FileNameLength;
1214 WCHAR FileName[1];
1215 } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
1216
1217 typedef struct _FILE_DISPOSITION_INFORMATION {
1218 BOOLEAN DoDeleteFile;
1219 } FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;
1220
1221 typedef struct _FILE_POSITION_INFORMATION {
1222 LARGE_INTEGER CurrentByteOffset;
1223 } FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;
1224
1225 typedef struct _FILE_ALIGNMENT_INFORMATION {
1226 ULONG AlignmentRequirement;
1227 } FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION;
1228
1229 typedef struct _FILE_ALLOCATION_INFORMATION {
1230 LARGE_INTEGER AllocationSize;
1231 } FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;
1232
1233 typedef struct _FILE_END_OF_FILE_INFORMATION {
1234 LARGE_INTEGER EndOfFile;
1235 } FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;
1236
1237 typedef struct _FILE_NETWORK_OPEN_INFORMATION {
1238 LARGE_INTEGER CreationTime;
1239 LARGE_INTEGER LastAccessTime;
1240 LARGE_INTEGER LastWriteTime;
1241 LARGE_INTEGER ChangeTime;
1242 LARGE_INTEGER AllocationSize;
1243 LARGE_INTEGER EndOfFile;
1244 ULONG FileAttributes;
1245 } FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;
1246
1247 typedef struct _FILE_FULL_EA_INFORMATION {
1248 ULONG NextEntryOffset;
1249 UCHAR Flags;
1250 UCHAR EaNameLength;
1251 USHORT EaValueLength;
1252 CHAR EaName[1];
1253 } FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;
1254
1255 typedef struct _FILE_MODE_INFORMATION {
1256 ULONG Mode;
1257 } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
1258
1259 typedef struct _FILE_STREAM_INFORMATION
1260 {
1261 ULONG NextEntryOffset;
1262 ULONG StreamNameLength;
1263 LARGE_INTEGER StreamSize;
1264 LARGE_INTEGER StreamAllocationSize;
1265 WCHAR StreamName[1];
1266 } FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;
1267
1268 typedef struct _FILE_ATTRIBUTE_TAG_INFORMATION
1269 {
1270 ULONG FileAttributes;
1271 ULONG ReparseTag;
1272 } FILE_ATTRIBUTE_TAG_INFORMATION, *PFILE_ATTRIBUTE_TAG_INFORMATION;
1273
1274 typedef struct _FILE_MAILSLOT_QUERY_INFORMATION {
1275 ULONG MaximumMessageSize;
1276 ULONG MailslotQuota;
1277 ULONG NextMessageSize;
1278 ULONG MessagesAvailable;
1279 LARGE_INTEGER ReadTimeout;
1280 } FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION;
1281
1282 typedef struct _FILE_MAILSLOT_SET_INFORMATION {
1283 LARGE_INTEGER ReadTimeout;
1284 } FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
1285
1286 typedef struct _FILE_PIPE_INFORMATION {
1287 ULONG ReadMode;
1288 ULONG CompletionMode;
1289 } FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;
1290
1291 typedef struct _FILE_PIPE_LOCAL_INFORMATION {
1292 ULONG NamedPipeType;
1293 ULONG NamedPipeConfiguration;
1294 ULONG MaximumInstances;
1295 ULONG CurrentInstances;
1296 ULONG InboundQuota;
1297 ULONG ReadDataAvailable;
1298 ULONG OutboundQuota;
1299 ULONG WriteQuotaAvailable;
1300 ULONG NamedPipeState;
1301 ULONG NamedPipeEnd;
1302 } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
1303
1304 #define FILE_PIPE_DISCONNECTED_STATE 0x00000001
1305 #define FILE_PIPE_LISTENING_STATE 0x00000002
1306 #define FILE_PIPE_CONNECTED_STATE 0x00000003
1307 #define FILE_PIPE_CLOSING_STATE 0x00000004
1308
1309 typedef struct _FILE_OBJECTID_BUFFER
1310 {
1311 BYTE ObjectId[16];
1312 union
1313 {
1314 struct
1315 {
1316 BYTE BirthVolumeId[16];
1317 BYTE BirthObjectId[16];
1318 BYTE DomainId[16];
1319 } DUMMYSTRUCTNAME;
1320 BYTE ExtendedInfo[48];
1321 } DUMMYUNIONNAME;
1322 } FILE_OBJECTID_BUFFER, *PFILE_OBJECTID_BUFFER;
1323
1324 typedef struct _FILE_OBJECTID_INFORMATION {
1325 LONGLONG FileReference;
1326 UCHAR ObjectId[16];
1327 union {
1328 struct {
1329 UCHAR BirthVolumeId[16];
1330 UCHAR BirthObjectId[16];
1331 UCHAR DomainId[16];
1332 } DUMMYSTRUCTNAME;
1333 UCHAR ExtendedInfo[48];
1334 } DUMMYUNIONNAME;
1335 } FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION;
1336
1337 typedef struct _FILE_QUOTA_INFORMATION {
1338 ULONG NextEntryOffset;
1339 ULONG SidLength;
1340 LARGE_INTEGER ChangeTime;
1341 LARGE_INTEGER QuotaUsed;
1342 LARGE_INTEGER QuotaThreshold;
1343 LARGE_INTEGER QuotaLimit;
1344 SID Sid;
1345 } FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION;
1346
1347 typedef struct _FILE_REPARSE_POINT_INFORMATION {
1348 LONGLONG FileReference;
1349 ULONG Tag;
1350 } FILE_REPARSE_POINT_INFORMATION, *PFILE_REPARSE_POINT_INFORMATION;
1351
1352 typedef struct _FILE_ALL_INFORMATION {
1353 FILE_BASIC_INFORMATION BasicInformation;
1354 FILE_STANDARD_INFORMATION StandardInformation;
1355 FILE_INTERNAL_INFORMATION InternalInformation;
1356 FILE_EA_INFORMATION EaInformation;
1357 FILE_ACCESS_INFORMATION AccessInformation;
1358 FILE_POSITION_INFORMATION PositionInformation;
1359 FILE_MODE_INFORMATION ModeInformation;
1360 FILE_ALIGNMENT_INFORMATION AlignmentInformation;
1361 FILE_NAME_INFORMATION NameInformation;
1362 } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
1363
1364 typedef struct _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION {
1365 ULONG Flags;
1366 } FILE_IO_COMPLETION_NOTIFICATION_INFORMATION, *PFILE_IO_COMPLETION_NOTIFICATION_INFORMATION;
1367
1368 #define FILE_SKIP_COMPLETION_PORT_ON_SUCCESS 0x1
1369 #define FILE_SKIP_SET_EVENT_ON_HANDLE 0x2
1370 #define FILE_SKIP_SET_USER_EVENT_ON_FAST_IO 0x4
1371
1372 typedef enum _FSINFOCLASS {
1373 FileFsVolumeInformation = 1,
1374 FileFsLabelInformation,
1375 FileFsSizeInformation,
1376 FileFsDeviceInformation,
1377 FileFsAttributeInformation,
1378 FileFsControlInformation,
1379 FileFsFullSizeInformation,
1380 FileFsObjectIdInformation,
1381 FileFsMaximumInformation
1382 } FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;
1383
1384 typedef enum _KEY_INFORMATION_CLASS {
1385 KeyBasicInformation,
1386 KeyNodeInformation,
1387 KeyFullInformation,
1388 KeyNameInformation,
1389 KeyCachedInformation,
1390 KeyFlagsInformation,
1391 KeyVirtualizationInformation,
1392 KeyHandleTagsInformation,
1393 MaxKeyInfoClass
1394 } KEY_INFORMATION_CLASS;
1395
1396 typedef enum _KEY_VALUE_INFORMATION_CLASS {
1397 KeyValueBasicInformation,
1398 KeyValueFullInformation,
1399 KeyValuePartialInformation,
1400 KeyValueFullInformationAlign64,
1401 KeyValuePartialInformationAlign64
1402 } KEY_VALUE_INFORMATION_CLASS;
1403
1404 typedef enum _OBJECT_INFORMATION_CLASS {
1405 ObjectBasicInformation,
1406 ObjectNameInformation,
1407 ObjectTypeInformation,
1408 ObjectTypesInformation,
1409 ObjectDataInformation
1410 } OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS;
1411
1412 typedef enum _PROCESSINFOCLASS {
1413 ProcessBasicInformation = 0,
1414 ProcessQuotaLimits = 1,
1415 ProcessIoCounters = 2,
1416 ProcessVmCounters = 3,
1417 ProcessTimes = 4,
1418 ProcessBasePriority = 5,
1419 ProcessRaisePriority = 6,
1420 ProcessDebugPort = 7,
1421 ProcessExceptionPort = 8,
1422 ProcessAccessToken = 9,
1423 ProcessLdtInformation = 10,
1424 ProcessLdtSize = 11,
1425 ProcessDefaultHardErrorMode = 12,
1426 ProcessIoPortHandlers = 13,
1427 ProcessPooledUsageAndLimits = 14,
1428 ProcessWorkingSetWatch = 15,
1429 ProcessUserModeIOPL = 16,
1430 ProcessEnableAlignmentFaultFixup = 17,
1431 ProcessPriorityClass = 18,
1432 ProcessWx86Information = 19,
1433 ProcessHandleCount = 20,
1434 ProcessAffinityMask = 21,
1435 ProcessPriorityBoost = 22,
1436 ProcessDeviceMap = 23,
1437 ProcessSessionInformation = 24,
1438 ProcessForegroundInformation = 25,
1439 ProcessWow64Information = 26,
1440 ProcessImageFileName = 27,
1441 ProcessLUIDDeviceMapsEnabled = 28,
1442 ProcessBreakOnTermination = 29,
1443 ProcessDebugObjectHandle = 30,
1444 ProcessDebugFlags = 31,
1445 ProcessHandleTracing = 32,
1446 ProcessIoPriority = 33,
1447 ProcessExecuteFlags = 34,
1448 ProcessTlsInformation = 35,
1449 ProcessCookie = 36,
1450 ProcessImageInformation = 37,
1451 ProcessCycleTime = 38,
1452 ProcessPagePriority = 39,
1453 ProcessInstrumentationCallback = 40,
1454 ProcessThreadStackAllocation = 41,
1455 ProcessWorkingSetWatchEx = 42,
1456 ProcessImageFileNameWin32 = 43,
1457 MaxProcessInfoClass
1458 } PROCESSINFOCLASS, PROCESS_INFORMATION_CLASS;
1459
1460 #define MEM_EXECUTE_OPTION_DISABLE 0x01
1461 #define MEM_EXECUTE_OPTION_ENABLE 0x02
1462 #define MEM_EXECUTE_OPTION_DISABLE_THUNK_EMULATION 0x04
1463 #define MEM_EXECUTE_OPTION_PERMANENT 0x08
1464
1465 typedef enum _SECTION_INHERIT {
1466 ViewShare = 1,
1467 ViewUnmap = 2
1468 } SECTION_INHERIT;
1469
1470 typedef enum _SYSTEM_INFORMATION_CLASS {
1471 SystemBasicInformation = 0,
1472 SystemCpuInformation = 1,
1473 SystemPerformanceInformation = 2,
1474 SystemTimeOfDayInformation = 3, /* was SystemTimeInformation */
1475 SystemPathInformation = 4,
1476 SystemProcessInformation = 5,
1477 SystemCallCountInformation = 6,
1478 SystemDeviceInformation = 7,
1479 SystemProcessorPerformanceInformation = 8,
1480 SystemFlagsInformation = 9,
1481 SystemCallTimeInformation = 10,
1482 SystemModuleInformation = 11,
1483 SystemLocksInformation = 12,
1484 SystemStackTraceInformation = 13,
1485 SystemPagedPoolInformation = 14,
1486 SystemNonPagedPoolInformation = 15,
1487 SystemHandleInformation = 16,
1488 SystemObjectInformation = 17,
1489 SystemPageFileInformation = 18,
1490 SystemVdmInstemulInformation = 19,
1491 SystemVdmBopInformation = 20,
1492 SystemFileCacheInformation = 21,
1493 SystemPoolTagInformation = 22,
1494 SystemInterruptInformation = 23,
1495 SystemDpcBehaviorInformation = 24,
1496 SystemFullMemoryInformation = 25,
1497 SystemNotImplemented6 = 25,
1498 SystemLoadGdiDriverInformation = 26,
1499 SystemUnloadGdiDriverInformation = 27,
1500 SystemTimeAdjustmentInformation = 28,
1501 SystemTimeAdjustment = 28,
1502 SystemSummaryMemoryInformation = 29,
1503 SystemMirrorMemoryInformation = 30,
1504 SystemPerformanceTraceInformation = 31,
1505 SystemObsolete0 = 32,
1506 SystemExceptionInformation = 33,
1507 SystemCrashDumpStateInformation = 34,
1508 SystemKernelDebuggerInformation = 35,
1509 SystemContextSwitchInformation = 36,
1510 SystemRegistryQuotaInformation = 37,
1511 SystemExtendServiceTableInformation = 38,
1512 SystemPrioritySeperation = 39,
1513 SystemVerifierAddDriverInformation = 40,
1514 SystemVerifierRemoveDriverInformation = 41,
1515 SystemProcessorIdleInformation = 42,
1516 SystemLegacyDriverInformation = 43,
1517 SystemCurrentTimeZoneInformation = 44,
1518 SystemLookasideInformation = 45,
1519 SystemTimeSlipNotification = 46,
1520 SystemSessionCreate = 47,
1521 SystemSessionDetach = 48,
1522 SystemSessionInformation = 49,
1523 SystemRangeStartInformation = 50,
1524 SystemVerifierInformation = 51,
1525 SystemVerifierThunkExtend = 52,
1526 SystemSessionProcessesInformation = 53,
1527 SystemLoadGdiDriverInSystemSpace = 54,
1528 SystemNumaProcessorMap = 55,
1529 SystemPrefetcherInformation = 56,
1530 SystemExtendedProcessInformation = 57,
1531 SystemRecommendedSharedDataAlignment = 58,
1532 SystemComPlusPackage = 59,
1533 SystemNumaAvailableMemory = 60,
1534 SystemProcessorPowerInformation = 61,
1535 SystemEmulationBasicInformation = 62,
1536 SystemEmulationProcessorInformation = 63,
1537 SystemExtendedHandleInformation = 64,
1538 SystemLostDelayedWriteInformation = 65,
1539 SystemBigPoolInformation = 66,
1540 SystemSessionPoolTagInformation = 67,
1541 SystemSessionMappedViewInformation = 68,
1542 SystemHotpatchInformation = 69,
1543 SystemObjectSecurityMode = 70,
1544 SystemWatchdogTimerHandler = 71,
1545 SystemWatchdogTimerInformation = 72,
1546 SystemLogicalProcessorInformation = 73,
1547 SystemWow64SharedInformationObsolete = 74,
1548 SystemRegisterFirmwareTableInformationHandler = 75,
1549 SystemFirmwareTableInformation = 76,
1550 SystemModuleInformationEx = 77,
1551 SystemVerifierTriageInformation = 78,
1552 SystemSuperfetchInformation = 79,
1553 SystemMemoryListInformation = 80,
1554 SystemFileCacheInformationEx = 81,
1555 SystemThreadPriorityClientIdInformation = 82,
1556 SystemProcessorIdleCycleTimeInformation = 83,
1557 SystemVerifierCancellationInformation = 84,
1558 SystemProcessorPowerInformationEx = 85,
1559 SystemRefTraceInformation = 86,
1560 SystemSpecialPoolInformation = 87,
1561 SystemProcessIdInformation = 88,
1562 SystemErrorPortInformation = 89,
1563 SystemBootEnvironmentInformation = 90,
1564 SystemHypervisorInformation = 91,
1565 SystemVerifierInformationEx = 92,
1566 SystemTimeZoneInformation = 93,
1567 SystemImageFileExecutionOptionsInformation = 94,
1568 SystemCoverageInformation = 95,
1569 SystemPrefetchPatchInformation = 96,
1570 SystemVerifierFaultsInformation = 97,
1571 SystemSystemPartitionInformation = 98,
1572 SystemSystemDiskInformation = 99,
1573 SystemProcessorPerformanceDistribution = 100,
1574 SystemNumaProximityNodeInformation = 101,
1575 SystemDynamicTimeZoneInformation = 102,
1576 SystemCodeIntegrityInformation = 103,
1577 SystemProcessorMicrocodeUpdateInformation = 104,
1578 SystemProcessorBrandString = 105,
1579 SystemVirtualAddressInformation = 106,
1580 SystemLogicalProcessorInformationEx = 107,
1581 SystemProcessorCycleTimeInformation = 108,
1582 SystemStoreInformation = 109,
1583 SystemRegistryAppendString = 110,
1584 SystemAitSamplingValue = 111,
1585 SystemVhdBootInformation = 112,
1586 SystemCpuQuotaInformation = 113,
1587 SystemNativeBasicInformation = 114,
1588 SystemErrorPortTimeouts = 115,
1589 SystemLowPriorityIoInformation = 116,
1590 SystemTpmBootEntropyInformation = 117,
1591 SystemVerifierCountersInformation = 118,
1592 SystemPagedPoolInformationEx = 119,
1593 SystemSystemPtesInformationEx = 120,
1594 SystemNodeDistanceInformation = 121,
1595 SystemAcpiAuditInformation = 122,
1596 SystemBasicPerformanceInformation = 123,
1597 SystemQueryPerformanceCounterInformation = 124,
1598 SystemSessionBigPoolInformation = 125,
1599 SystemBootGraphicsInformation = 126,
1600 SystemScrubPhysicalMemoryInformation = 127,
1601 SystemBadPageInformation = 128,
1602 SystemProcessorProfileControlArea = 129,
1603 SystemCombinePhysicalMemoryInformation = 130,
1604 SystemEntropyInterruptTimingInformation = 131,
1605 SystemConsoleInformation = 132,
1606 SystemPlatformBinaryInformation = 133,
1607 SystemPolicyInformation = 134,
1608 SystemHypervisorProcessorCountInformation = 135,
1609 SystemDeviceDataInformation = 136,
1610 SystemDeviceDataEnumerationInformation = 137,
1611 SystemMemoryTopologyInformation = 138,
1612 SystemMemoryChannelInformation = 139,
1613 SystemBootLogoInformation = 140,
1614 SystemProcessorPerformanceInformationEx = 141,
1615 SystemCriticalProcessErrorLogInformation = 142,
1616 SystemSecureBootPolicyInformation = 143,
1617 SystemPageFileInformationEx = 144,
1618 SystemSecureBootInformation = 145,
1619 SystemEntropyInterruptTimingRawInformation = 146,
1620 SystemPortableWorkspaceEfiLauncherInformation = 147,
1621 SystemFullProcessInformation = 148,
1622 SystemKernelDebuggerInformationEx = 149,
1623 SystemBootMetadataInformation = 150,
1624 SystemSoftRebootInformation = 151,
1625 SystemElamCertificateInformation = 152,
1626 SystemOfflineDumpConfigInformation = 153,
1627 SystemProcessorFeaturesInformation = 154,
1628 SystemRegistryReconciliationInformation = 155,
1629 SystemEdidInformation = 156,
1630 SystemManufacturingInformation = 157,
1631 SystemEnergyEstimationConfigInformation = 158,
1632 SystemHypervisorDetailInformation = 159,
1633 SystemProcessorCycleStatsInformation = 160,
1634 SystemVmGenerationCountInformation = 161,
1635 SystemTrustedPlatformModuleInformation = 162,
1636 SystemKernelDebuggerFlags = 163,
1637 SystemCodeIntegrityPolicyInformation = 164,
1638 SystemIsolatedUserModeInformation = 165,
1639 SystemHardwareSecurityTestInterfaceResultsInformation = 166,
1640 SystemSingleModuleInformation = 167,
1641 SystemAllowedCpuSetsInformation = 168,
1642 SystemVsmProtectionInformation = 169,
1643 SystemInterruptCpuSetsInformation = 170,
1644 SystemSecureBootPolicyFullInformation = 171,
1645 SystemCodeIntegrityPolicyFullInformation = 172,
1646 SystemAffinitizedInterruptProcessorInformation = 173,
1647 SystemRootSiloInformation = 174,
1648 SystemCpuSetInformation = 175,
1649 SystemCpuSetTagInformation = 176,
1650 SystemWin32WerStartCallout = 177,
1651 SystemSecureKernelProfileInformation = 178,
1652 SystemCodeIntegrityPlatformManifestInformation = 179,
1653 SystemInterruptSteeringInformation = 180,
1654 SystemSupportedProcessorArchitectures = 181,
1655 SystemMemoryUsageInformation = 182,
1656 SystemCodeIntegrityCertificateInformation = 183,
1657 SystemPhysicalMemoryInformation = 184,
1658 SystemControlFlowTransition = 185,
1659 SystemKernelDebuggingAllowed = 186,
1660 SystemActivityModerationExeState = 187,
1661 SystemActivityModerationUserSettings = 188,
1662 SystemCodeIntegrityPoliciesFullInformation = 189,
1663 SystemCodeIntegrityUnlockInformation = 190,
1664 SystemIntegrityQuotaInformation = 191,
1665 SystemFlushInformation = 192,
1666 SystemProcessorIdleMaskInformation = 193,
1667 SystemSecureDumpEncryptionInformation = 194,
1668 SystemWriteConstraintInformation = 195,
1669 SystemKernelVaShadowInformation = 196,
1670 SystemHypervisorSharedPageInformation = 197,
1671 SystemFirmwareBootPerformanceInformation = 198,
1672 SystemCodeIntegrityVerificationInformation = 199,
1673 SystemFirmwarePartitionInformation = 200,
1674 SystemSpeculationControlInformation = 201,
1675 SystemDmaGuardPolicyInformation = 202,
1676 SystemEnclaveLaunchControlInformation = 203,
1677 SystemWorkloadAllowedCpuSetsInformation = 204,
1678 SystemCodeIntegrityUnlockModeInformation = 205,
1679 SystemLeapSecondInformation = 206,
1680 SystemFlags2Information = 207,
1681 SystemSecurityModelInformation = 208,
1682 SystemCodeIntegritySyntheticCacheInformation = 209,
1683 SystemFeatureConfigurationInformation = 210,
1684 SystemFeatureConfigurationSectionInformation = 211,
1685 SystemFeatureUsageSubscriptionInformation = 212,
1686 SystemSecureSpeculationControlInformation = 213,
1687 SystemSpacesBootInformation = 214,
1688 SystemFwRamdiskInformation = 215,
1689 SystemWheaIpmiHardwareInformation = 216,
1690 SystemDifSetRuleClassInformation = 217,
1691 SystemDifClearRuleClassInformation = 218,
1692 SystemDifApplyPluginVerificationOnDriver = 219,
1693 SystemDifRemovePluginVerificationOnDriver = 220,
1694 SystemShadowStackInformation = 221,
1695 SystemBuildVersionInformation = 222,
1696 #ifdef __WINESRC__
1697 SystemWineVersionInformation = 1000,
1698 #endif
1699 } SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;
1700
1701 typedef struct _SYSTEM_CODEINTEGRITY_INFORMATION
1702 {
1703 ULONG Length;
1704 ULONG CodeIntegrityOptions;
1705 } SYSTEM_CODEINTEGRITY_INFORMATION, *PSYSTEM_CODEINTEGRITY_INFORMATION;
1706
1707 #define CODEINTEGRITY_OPTION_ENABLED 0x0001
1708 #define CODEINTEGRITY_OPTION_TESTSIGN 0x0002
1709 #define CODEINTEGRITY_OPTION_UMCI_ENABLED 0x0004
1710 #define CODEINTEGRITY_OPTION_UMCI_AUDITMODE_ENABLED 0x0008
1711 #define CODEINTEGRITY_OPTION_UMCI_EXCLUSIONPATHS_ENABLED 0x0010
1712 #define CODEINTEGRITY_OPTION_TEST_BUILD 0x0020
1713 #define CODEINTEGRITY_OPTION_PREPRODUCTION_BUILD 0x0040
1714 #define CODEINTEGRITY_OPTION_DEBUGMODE_ENABLED 0x0080
1715 #define CODEINTEGRITY_OPTION_FLIGHT_BUILD 0x0100
1716 #define CODEINTEGRITY_OPTION_FLIGHTING_ENABLED 0x0200
1717 #define CODEINTEGRITY_OPTION_HVCI_KMCI_ENABLED 0x0400
1718 #define CODEINTEGRITY_OPTION_HVCI_KMCI_AUDITMODE_ENABLED 0x0800
1719 #define CODEINTEGRITY_OPTION_HVCI_KMCI_STRICTMODE_ENABLED 0x1000
1720 #define CODEINTEGRITY_OPTION_HVCI_IUM_ENABLED 0x2000
1721
1722 typedef enum _THREADINFOCLASS {
1723 ThreadBasicInformation = 0,
1724 ThreadTimes,
1725 ThreadPriority,
1726 ThreadBasePriority,
1727 ThreadAffinityMask,
1728 ThreadImpersonationToken,
1729 ThreadDescriptorTableEntry,
1730 ThreadEnableAlignmentFaultFixup,
1731 ThreadEventPair_Reusable,
1732 ThreadQuerySetWin32StartAddress,
1733 ThreadZeroTlsCell,
1734 ThreadPerformanceCount,
1735 ThreadAmILastThread,
1736 ThreadIdealProcessor,
1737 ThreadPriorityBoost,
1738 ThreadSetTlsArrayAddress,
1739 ThreadIsIoPending,
1740 ThreadHideFromDebugger,
1741 ThreadBreakOnTermination,
1742 ThreadSwitchLegacyState,
1743 ThreadIsTerminated,
1744 ThreadLastSystemCall,
1745 ThreadIoPriority,
1746 ThreadCycleTime,
1747 ThreadPagePriority,
1748 ThreadActualBasePriority,
1749 ThreadTebInformation,
1750 ThreadCSwitchMon,
1751 ThreadCSwitchPmu,
1752 ThreadWow64Context,
1753 ThreadGroupInformation,
1754 ThreadUmsInformation,
1755 ThreadCounterProfiling,
1756 ThreadIdealProcessorEx,
1757 ThreadSuspendCount = 35,
1758 ThreadDescription = 38,
1759 MaxThreadInfoClass
1760 } THREADINFOCLASS;
1761
1762 typedef struct _THREAD_BASIC_INFORMATION
1763 {
1764 NTSTATUS ExitStatus;
1765 PVOID TebBaseAddress;
1766 CLIENT_ID ClientId;
1767 ULONG_PTR AffinityMask;
1768 LONG Priority;
1769 LONG BasePriority;
1770 } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
1771
1772 typedef struct _THREAD_DESCRIPTOR_INFORMATION
1773 {
1774 DWORD Selector;
1775 LDT_ENTRY Entry;
1776 } THREAD_DESCRIPTOR_INFORMATION, *PTHREAD_DESCRIPTOR_INFORMATION;
1777
1778 typedef struct _THREAD_DESCRIPTION_INFORMATION
1779 {
1780 UNICODE_STRING Description;
1781 } THREAD_DESCRIPTION_INFORMATION, *PTHREAD_DESCRIPTION_INFORMATION;
1782
1783 typedef struct _KERNEL_USER_TIMES {
1784 LARGE_INTEGER CreateTime;
1785 LARGE_INTEGER ExitTime;
1786 LARGE_INTEGER KernelTime;
1787 LARGE_INTEGER UserTime;
1788 } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
1789
1790 typedef enum _WINSTATIONINFOCLASS {
1791 WinStationInformation = 8
1792 } WINSTATIONINFOCLASS;
1793
1794 typedef enum _MEMORY_INFORMATION_CLASS {
1795 MemoryBasicInformation,
1796 MemoryWorkingSetList,
1797 MemorySectionName,
1798 MemoryBasicVlmInformation,
1799 MemoryWorkingSetExInformation
1800 } MEMORY_INFORMATION_CLASS;
1801
1802 typedef struct _MEMORY_SECTION_NAME
1803 {
1804 UNICODE_STRING SectionFileName;
1805 } MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME;
1806
1807 typedef union _MEMORY_WORKING_SET_EX_BLOCK {
1808 ULONG_PTR Flags;
1809 struct {
1810 ULONG_PTR Valid : 1;
1811 ULONG_PTR ShareCount : 3;
1812 ULONG_PTR Win32Protection : 11;
1813 ULONG_PTR Shared : 1;
1814 ULONG_PTR Node : 6;
1815 ULONG_PTR Locked : 1;
1816 ULONG_PTR LargePage : 1;
1817 } DUMMYSTRUCTNAME;
1818 } MEMORY_WORKING_SET_EX_BLOCK, *PMEMORY_WORKING_SET_EX_BLOCK;
1819
1820 typedef struct _MEMORY_WORKING_SET_EX_INFORMATION {
1821 PVOID VirtualAddress;
1822 MEMORY_WORKING_SET_EX_BLOCK VirtualAttributes;
1823 } MEMORY_WORKING_SET_EX_INFORMATION, *PMEMORY_WORKING_SET_EX_INFORMATION;
1824
1825 typedef enum _MUTANT_INFORMATION_CLASS
1826 {
1827 MutantBasicInformation
1828 } MUTANT_INFORMATION_CLASS, *PMUTANT_INFORMATION_CLASS;
1829
1830 typedef struct _MUTANT_BASIC_INFORMATION {
1831 LONG CurrentCount;
1832 BOOLEAN OwnedByCaller;
1833 BOOLEAN AbandonedState;
1834 } MUTANT_BASIC_INFORMATION, *PMUTANT_BASIC_INFORMATION;
1835
1836 typedef enum _TIMER_INFORMATION_CLASS
1837 {
1838 TimerBasicInformation = 0
1839 } TIMER_INFORMATION_CLASS;
1840
1841 typedef struct _TIMER_BASIC_INFORMATION
1842 {
1843 LARGE_INTEGER RemainingTime;
1844 BOOLEAN TimerState;
1845 } TIMER_BASIC_INFORMATION, *PTIMER_BASIC_INFORMATION;
1846
1847
1848 /* return type of RtlDetermineDosPathNameType_U (FIXME: not the correct names) */
1849 typedef enum
1850 {
1851 INVALID_PATH = 0,
1852 UNC_PATH, /* "//foo" */
1853 ABSOLUTE_DRIVE_PATH, /* "c:/foo" */
1854 RELATIVE_DRIVE_PATH, /* "c:foo" */
1855 ABSOLUTE_PATH, /* "/foo" */
1856 RELATIVE_PATH, /* "foo" */
1857 DEVICE_PATH, /* "//./foo" */
1858 UNC_DOT_PATH /* "//." */
1859 } DOS_PATHNAME_TYPE;
1860
1861
1862 /***********************************************************************
1863 * Types and data structures
1864 */
1865
1866 /* This is used by NtQuerySystemInformation */
1867 typedef struct _SYSTEM_THREAD_INFORMATION
1868 { /* win32/win64 */
1869 LARGE_INTEGER KernelTime; /* 00/00 */
1870 LARGE_INTEGER UserTime; /* 08/08 */
1871 LARGE_INTEGER CreateTime; /* 10/10 */
1872 DWORD dwTickCount; /* 18/18 */
1873 LPVOID StartAddress; /* 1c/20 */
1874 CLIENT_ID ClientId; /* 20/28 */
1875 DWORD dwCurrentPriority; /* 28/38 */
1876 DWORD dwBasePriority; /* 2c/3c */
1877 DWORD dwContextSwitches; /* 30/40 */
1878 DWORD dwThreadState; /* 34/44 */
1879 DWORD dwWaitReason; /* 38/48 */
1880 DWORD dwUnknown; /* 3c/4c */
1881 } SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
1882
1883 typedef struct _IO_STATUS_BLOCK {
1884 union {
1885 NTSTATUS Status;
1886 PVOID Pointer;
1887 } DUMMYUNIONNAME;
1888
1889 ULONG_PTR Information;
1890 } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
1891
1892 typedef void (WINAPI * PIO_APC_ROUTINE)(PVOID,PIO_STATUS_BLOCK,ULONG);
1893
1894 typedef struct _KEY_BASIC_INFORMATION {
1895 LARGE_INTEGER LastWriteTime;
1896 ULONG TitleIndex;
1897 ULONG NameLength;
1898 WCHAR Name[1];
1899 } KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;
1900
1901 typedef struct _KEY_NODE_INFORMATION
1902 {
1903 LARGE_INTEGER LastWriteTime;
1904 ULONG TitleIndex;
1905 ULONG ClassOffset;
1906 ULONG ClassLength;
1907 ULONG NameLength;
1908 WCHAR Name[1];
1909 /* Class[1]; */
1910 } KEY_NODE_INFORMATION, *PKEY_NODE_INFORMATION;
1911
1912 typedef struct _KEY_FULL_INFORMATION
1913 {
1914 LARGE_INTEGER LastWriteTime;
1915 ULONG TitleIndex;
1916 ULONG ClassOffset;
1917 ULONG ClassLength;
1918 ULONG SubKeys;
1919 ULONG MaxNameLen;
1920 ULONG MaxClassLen;
1921 ULONG Values;
1922 ULONG MaxValueNameLen;
1923 ULONG MaxValueDataLen;
1924 WCHAR Class[1];
1925 } KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION;
1926
1927 typedef struct _KEY_NAME_INFORMATION {
1928 ULONG NameLength;
1929 WCHAR Name[1];
1930 } KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION;
1931
1932 typedef struct _KEY_CACHED_INFORMATION
1933 {
1934 LARGE_INTEGER LastWriteTime;
1935 ULONG TitleIndex;
1936 ULONG SubKeys;
1937 ULONG MaxNameLen;
1938 ULONG Values;
1939 ULONG MaxValueNameLen;
1940 ULONG MaxValueDataLen;
1941 ULONG NameLength;
1942 } KEY_CACHED_INFORMATION, *PKEY_CACHED_INFORMATION;
1943
1944 typedef struct _KEY_VALUE_ENTRY
1945 {
1946 PUNICODE_STRING ValueName;
1947 ULONG DataLength;
1948 ULONG DataOffset;
1949 ULONG Type;
1950 } KEY_VALUE_ENTRY, *PKEY_VALUE_ENTRY;
1951
1952 typedef struct _KEY_VALUE_BASIC_INFORMATION {
1953 ULONG TitleIndex;
1954 ULONG Type;
1955 ULONG NameLength;
1956 WCHAR Name[1];
1957 } KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION;
1958
1959 typedef struct _KEY_VALUE_FULL_INFORMATION {
1960 ULONG TitleIndex;
1961 ULONG Type;
1962 ULONG DataOffset;
1963 ULONG DataLength;
1964 ULONG NameLength;
1965 WCHAR Name[1];
1966 } KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;
1967
1968 typedef struct _KEY_VALUE_PARTIAL_INFORMATION {
1969 ULONG TitleIndex;
1970 ULONG Type;
1971 ULONG DataLength;
1972 UCHAR Data[1];
1973 } KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;
1974
1975 #ifndef __OBJECT_ATTRIBUTES_DEFINED__
1976 #define __OBJECT_ATTRIBUTES_DEFINED__
1977 typedef struct _OBJECT_ATTRIBUTES {
1978 ULONG Length;
1979 HANDLE RootDirectory;
1980 PUNICODE_STRING ObjectName;
1981 ULONG Attributes;
1982 PVOID SecurityDescriptor; /* type SECURITY_DESCRIPTOR */
1983 PVOID SecurityQualityOfService; /* type SECURITY_QUALITY_OF_SERVICE */
1984 } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
1985 #endif
1986
1987 typedef struct _OBJECT_DATA_INFORMATION {
1988 BOOLEAN InheritHandle;
1989 BOOLEAN ProtectFromClose;
1990 } OBJECT_DATA_INFORMATION, *POBJECT_DATA_INFORMATION;
1991
1992 typedef struct _OBJECT_BASIC_INFORMATION {
1993 ULONG Attributes;
1994 ACCESS_MASK GrantedAccess;
1995 ULONG HandleCount;
1996 ULONG PointerCount;
1997 ULONG PagedPoolUsage;
1998 ULONG NonPagedPoolUsage;
1999 ULONG Reserved[3];
2000 ULONG NameInformationLength;
2001 ULONG TypeInformationLength;
2002 ULONG SecurityDescriptorLength;
2003 LARGE_INTEGER CreateTime;
2004 } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
2005
2006 typedef struct _OBJECT_NAME_INFORMATION {
2007 UNICODE_STRING Name;
2008 } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
2009
2010 typedef struct __OBJECT_TYPE_INFORMATION {
2011 UNICODE_STRING TypeName;
2012 ULONG TotalNumberOfObjects;
2013 ULONG TotalNumberOfHandles;
2014 ULONG TotalPagedPoolUsage;
2015 ULONG TotalNonPagedPoolUsage;
2016 ULONG TotalNamePoolUsage;
2017 ULONG TotalHandleTableUsage;
2018 ULONG HighWaterNumberOfObjects;
2019 ULONG HighWaterNumberOfHandles;
2020 ULONG HighWaterPagedPoolUsage;
2021 ULONG HighWaterNonPagedPoolUsage;
2022 ULONG HighWaterNamePoolUsage;
2023 ULONG HighWaterHandleTableUsage;
2024 ULONG InvalidAttributes;
2025 GENERIC_MAPPING GenericMapping;
2026 ULONG ValidAccessMask;
2027 BOOLEAN SecurityRequired;
2028 BOOLEAN MaintainHandleCount;
2029 UCHAR TypeIndex;
2030 CHAR ReservedByte;
2031 ULONG PoolType;
2032 ULONG DefaultPagedPoolCharge;
2033 ULONG DefaultNonPagedPoolCharge;
2034 } OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;
2035
2036 typedef struct _OBJECT_TYPES_INFORMATION
2037 {
2038 ULONG NumberOfTypes;
2039 } OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION;
2040
2041 typedef struct _PROCESS_BASIC_INFORMATION {
2042 #ifdef __WINESRC__
2043 DWORD_PTR ExitStatus;
2044 PPEB PebBaseAddress;
2045 DWORD_PTR AffinityMask;
2046 DWORD_PTR BasePriority;
2047 ULONG_PTR UniqueProcessId;
2048 ULONG_PTR InheritedFromUniqueProcessId;
2049 #else
2050 PVOID Reserved1;
2051 PPEB PebBaseAddress;
2052 PVOID Reserved2[2];
2053 ULONG_PTR UniqueProcessId;
2054 PVOID Reserved3;
2055 #endif
2056 } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
2057
2058 #define PROCESS_PRIOCLASS_IDLE 1
2059 #define PROCESS_PRIOCLASS_NORMAL 2
2060 #define PROCESS_PRIOCLASS_HIGH 3
2061 #define PROCESS_PRIOCLASS_REALTIME 4
2062 #define PROCESS_PRIOCLASS_BELOW_NORMAL 5
2063 #define PROCESS_PRIOCLASS_ABOVE_NORMAL 6
2064
2065 typedef struct _PROCESS_PRIORITY_CLASS {
2066 BOOLEAN Foreground;
2067 UCHAR PriorityClass;
2068 } PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS;
2069
2070 typedef struct _PROCESS_STACK_ALLOCATION_INFORMATION
2071 {
2072 SIZE_T ReserveSize;
2073 SIZE_T ZeroBits;
2074 PVOID StackBase;
2075 } PROCESS_STACK_ALLOCATION_INFORMATION, *PPROCESS_STACK_ALLOCATION_INFORMATION;
2076
2077 typedef struct _PROCESS_STACK_ALLOCATION_INFORMATION_EX
2078 {
2079 ULONG PreferredNode;
2080 ULONG Reserved0;
2081 ULONG Reserved1;
2082 ULONG Reserved2;
2083 PROCESS_STACK_ALLOCATION_INFORMATION AllocInfo;
2084 } PROCESS_STACK_ALLOCATION_INFORMATION_EX, *PPROCESS_STACK_ALLOCATION_INFORMATION_EX;
2085
2086 typedef struct _RTL_HEAP_DEFINITION {
2087 ULONG Length; /* = sizeof(RTL_HEAP_DEFINITION) */
2088
2089 ULONG Unknown[11];
2090 } RTL_HEAP_DEFINITION, *PRTL_HEAP_DEFINITION;
2091
2092 typedef struct _RTL_RWLOCK {
2093 RTL_CRITICAL_SECTION rtlCS;
2094
2095 HANDLE hSharedReleaseSemaphore;
2096 UINT uSharedWaiters;
2097
2098 HANDLE hExclusiveReleaseSemaphore;
2099 UINT uExclusiveWaiters;
2100
2101 INT iNumberActive;
2102 HANDLE hOwningThreadId;
2103 DWORD dwTimeoutBoost;
2104 PVOID pDebugInfo;
2105 } RTL_RWLOCK, *LPRTL_RWLOCK;
2106
2107 /* System Information Class 0x00 */
2108
2109 typedef struct _SYSTEM_BASIC_INFORMATION {
2110 #ifdef __WINESRC__
2111 DWORD unknown;
2112 ULONG KeMaximumIncrement;
2113 ULONG PageSize;
2114 ULONG MmNumberOfPhysicalPages;
2115 ULONG MmLowestPhysicalPage;
2116 ULONG MmHighestPhysicalPage;
2117 ULONG_PTR AllocationGranularity;
2118 PVOID LowestUserAddress;
2119 PVOID HighestUserAddress;
2120 ULONG_PTR ActiveProcessorsAffinityMask;
2121 BYTE NumberOfProcessors;
2122 #else
2123 BYTE Reserved1[24];
2124 PVOID Reserved2[4];
2125 CCHAR NumberOfProcessors;
2126 #endif
2127 } SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;
2128
2129 /* System Information Class 0x01 */
2130
2131 typedef struct _SYSTEM_CPU_INFORMATION {
2132 WORD Architecture;
2133 WORD Level;
2134 WORD Revision; /* combination of CPU model and stepping */
2135 WORD Reserved; /* always zero */
2136 DWORD FeatureSet; /* see bit flags below */
2137 } SYSTEM_CPU_INFORMATION, *PSYSTEM_CPU_INFORMATION;
2138
2139 /* definitions of bits in the Feature set for the x86 processors */
2140 #define CPU_FEATURE_VME 0x00000005 /* Virtual 86 Mode Extensions */
2141 #define CPU_FEATURE_TSC 0x00000002 /* Time Stamp Counter available */
2142 #define CPU_FEATURE_CMOV 0x00000008 /* Conditional Move instruction*/
2143 #define CPU_FEATURE_PGE 0x00000014 /* Page table Entry Global bit */
2144 #define CPU_FEATURE_PSE 0x00000024 /* Page Size Extension */
2145 #define CPU_FEATURE_MTRR 0x00000040 /* Memory Type Range Registers */
2146 #define CPU_FEATURE_CX8 0x00000080 /* Compare and eXchange 8 byte instr. */
2147 #define CPU_FEATURE_MMX 0x00000100 /* Multi Media eXtensions */
2148 #define CPU_FEATURE_X86 0x00000200 /* seems to be always ON, on the '86 */
2149 #define CPU_FEATURE_PAT 0x00000400 /* Page Attribute Table */
2150 #define CPU_FEATURE_FXSR 0x00000800 /* FXSAVE and FXSTORE instructions */
2151 #define CPU_FEATURE_SEP 0x00001000 /* SYSENTER and SYSEXIT instructions */
2152 #define CPU_FEATURE_SSE 0x00002000 /* SSE extensions (ext. MMX) */
2153 #define CPU_FEATURE_3DNOW 0x00004000 /* 3DNOW instructions available */
2154 #define CPU_FEATURE_SSE2 0x00010000 /* SSE2 extensions (XMMI64) */
2155 #define CPU_FEATURE_DS 0x00020000 /* Debug Store */
2156 #define CPU_FEATURE_HTT 0x00040000 /* Hyper Threading Technology */
2157 #define CPU_FEATURE_SSE3 0x00080000 /* SSE3 extensions */
2158 #define CPU_FEATURE_CX128 0x00100000 /* cmpxchg16b instruction */
2159 #define CPU_FEATURE_XSAVE 0x00800000 /* XSAVE instructions */
2160 #define CPU_FEATURE_2NDLEV 0x04000000 /* Second-level address translation */
2161 #define CPU_FEATURE_VIRT 0x08000000 /* Virtualization support */
2162 #define CPU_FEATURE_RDFS 0x10000000 /* RDFSBASE etc. instructions */
2163 #define CPU_FEATURE_NX 0x20000000 /* Data execution prevention */
2164
2165 /* FIXME: following values are made up, actual flags are unknown */
2166 #define CPU_FEATURE_SSSE3 0x00008000 /* SSSE3 instructions */
2167 #define CPU_FEATURE_SSE41 0x01000000 /* SSE41 instructions */
2168 #define CPU_FEATURE_SSE42 0x02000000 /* SSE42 instructions */
2169 #define CPU_FEATURE_AVX 0x40000000 /* AVX instructions */
2170 #define CPU_FEATURE_AVX2 0x80000000 /* AVX2 instructions */
2171 #define CPU_FEATURE_PAE 0x00200000
2172 #define CPU_FEATURE_DAZ 0x00400000
2173
2174 #define CPU_FEATURE_ARM_VFP_32 0x00000001
2175 #define CPU_FEATURE_ARM_NEON 0x00000002
2176 #define CPU_FEATURE_ARM_V8_CRC32 0x00000004
2177 #define CPU_FEATURE_ARM_V8_CRYPTO 0x00000008
2178
2179 /* System Information Class 0x02 */
2180
2181 /* Documented in "Windows NT/2000 Native API Reference" by Gary Nebbett. */
2182 typedef struct _SYSTEM_PERFORMANCE_INFORMATION {
2183 LARGE_INTEGER IdleTime;
2184 LARGE_INTEGER ReadTransferCount;
2185 LARGE_INTEGER WriteTransferCount;
2186 LARGE_INTEGER OtherTransferCount;
2187 ULONG ReadOperationCount;
2188 ULONG WriteOperationCount;
2189 ULONG OtherOperationCount;
2190 ULONG AvailablePages;
2191 ULONG TotalCommittedPages;
2192 ULONG TotalCommitLimit;
2193 ULONG PeakCommitment;
2194 ULONG PageFaults;
2195 ULONG WriteCopyFaults;
2196 ULONG TransitionFaults;
2197 ULONG Reserved1;
2198 ULONG DemandZeroFaults;
2199 ULONG PagesRead;
2200 ULONG PageReadIos;
2201 ULONG Reserved2[2];
2202 ULONG PagefilePagesWritten;
2203 ULONG PagefilePageWriteIos;
2204 ULONG MappedFilePagesWritten;
2205 ULONG MappedFilePageWriteIos;
2206 ULONG PagedPoolUsage;
2207 ULONG NonPagedPoolUsage;
2208 ULONG PagedPoolAllocs;
2209 ULONG PagedPoolFrees;
2210 ULONG NonPagedPoolAllocs;
2211 ULONG NonPagedPoolFrees;
2212 ULONG TotalFreeSystemPtes;
2213 ULONG SystemCodePage;
2214 ULONG TotalSystemDriverPages;
2215 ULONG TotalSystemCodePages;
2216 ULONG SmallNonPagedLookasideListAllocateHits;
2217 ULONG SmallPagedLookasideListAllocateHits;
2218 ULONG Reserved3;
2219 ULONG MmSystemCachePage;
2220 ULONG PagedPoolPage;
2221 ULONG SystemDriverPage;
2222 ULONG FastReadNoWait;
2223 ULONG FastReadWait;
2224 ULONG FastReadResourceMiss;
2225 ULONG FastReadNotPossible;
2226 ULONG FastMdlReadNoWait;
2227 ULONG FastMdlReadWait;
2228 ULONG FastMdlReadResourceMiss;
2229 ULONG FastMdlReadNotPossible;
2230 ULONG MapDataNoWait;
2231 ULONG MapDataWait;
2232 ULONG MapDataNoWaitMiss;
2233 ULONG MapDataWaitMiss;
2234 ULONG PinMappedDataCount;
2235 ULONG PinReadNoWait;
2236 ULONG PinReadWait;
2237 ULONG PinReadNoWaitMiss;
2238 ULONG PinReadWaitMiss;
2239 ULONG CopyReadNoWait;
2240 ULONG CopyReadWait;
2241 ULONG CopyReadNoWaitMiss;
2242 ULONG CopyReadWaitMiss;
2243 ULONG MdlReadNoWait;
2244 ULONG MdlReadWait;
2245 ULONG MdlReadNoWaitMiss;
2246 ULONG MdlReadWaitMiss;
2247 ULONG ReadAheadIos;
2248 ULONG LazyWriteIos;
2249 ULONG LazyWritePages;
2250 ULONG DataFlushes;
2251 ULONG DataPages;
2252 ULONG ContextSwitches;
2253 ULONG FirstLevelTbFills;
2254 ULONG SecondLevelTbFills;
2255 ULONG SystemCalls;
2256 } SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;
2257
2258 /* System Information Class 0x03 */
2259
2260 typedef struct _SYSTEM_TIMEOFDAY_INFORMATION {
2261 #ifdef __WINESRC__
2262 LARGE_INTEGER BootTime;
2263 LARGE_INTEGER SystemTime;
2264 LARGE_INTEGER TimeZoneBias;
2265 ULONG TimeZoneId;
2266 ULONG Reserved;
2267 ULONGLONG BootTimeBias;
2268 ULONGLONG SleepTimeBias;
2269 #else
2270 BYTE Reserved1[48];
2271 #endif
2272 } SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION; /* was SYSTEM_TIME_INFORMATION */
2273
2274 /* System Information Class 0x08 */
2275
2276 typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION {
2277 LARGE_INTEGER IdleTime;
2278 LARGE_INTEGER KernelTime;
2279 LARGE_INTEGER UserTime;
2280 LARGE_INTEGER Reserved1[2];
2281 ULONG Reserved2;
2282 } SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;
2283
2284 /* System Information Class 0x0b */
2285
2286 typedef struct _SYSTEM_DRIVER_INFORMATION {
2287 PVOID pvAddress;
2288 DWORD dwUnknown1;
2289 DWORD dwUnknown2;
2290 DWORD dwEntryIndex;
2291 DWORD dwUnknown3;
2292 char szName[MAX_PATH + 1];
2293 } SYSTEM_DRIVER_INFORMATION, *PSYSTEM_DRIVER_INFORMATION;
2294
2295 /* System Information Class 0x10 */
2296
2297 typedef struct _SYSTEM_HANDLE_ENTRY {
2298 ULONG OwnerPid;
2299 BYTE ObjectType;
2300 BYTE HandleFlags;
2301 USHORT HandleValue;
2302 PVOID ObjectPointer;
2303 ULONG AccessMask;
2304 } SYSTEM_HANDLE_ENTRY, *PSYSTEM_HANDLE_ENTRY;
2305
2306 typedef struct _SYSTEM_HANDLE_INFORMATION {
2307 ULONG Count;
2308 SYSTEM_HANDLE_ENTRY Handle[1];
2309 } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
2310
2311 typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX
2312 {
2313 void *Object;
2314 ULONG_PTR UniqueProcessId;
2315 ULONG_PTR HandleValue;
2316 ULONG GrantedAccess;
2317 USHORT CreatorBackTraceIndex;
2318 USHORT ObjectTypeIndex;
2319 ULONG HandleAttributes;
2320 ULONG Reserved;
2321 } SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX;
2322
2323 typedef struct _SYSTEM_HANDLE_INFORMATION_EX
2324 {
2325 ULONG_PTR NumberOfHandles;
2326 ULONG_PTR Reserved;
2327 SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1];
2328 } SYSTEM_HANDLE_INFORMATION_EX;
2329
2330 /* System Information Class 0x15 */
2331
2332 typedef struct _SYSTEM_CACHE_INFORMATION {
2333 ULONG CurrentSize;
2334 ULONG PeakSize;
2335 ULONG PageFaultCount;
2336 ULONG MinimumWorkingSet;
2337 ULONG MaximumWorkingSet;
2338 ULONG unused[4];
2339 #ifdef _WIN64
2340 ULONG unknown64[7];
2341 #endif
2342 } SYSTEM_CACHE_INFORMATION, *PSYSTEM_CACHE_INFORMATION;
2343
2344 /* System Information Class 0x17 */
2345
2346 typedef struct _SYSTEM_INTERRUPT_INFORMATION {
2347 BYTE Reserved1[24];
2348 } SYSTEM_INTERRUPT_INFORMATION, *PSYSTEM_INTERRUPT_INFORMATION;
2349
2350 typedef struct _SYSTEM_CONFIGURATION_INFO {
2351 union {
2352 ULONG OemId;
2353 struct {
2354 WORD ProcessorArchitecture;
2355 WORD Reserved;
2356 } tag1;
2357 } tag2;
2358 ULONG PageSize;
2359 PVOID MinimumApplicationAddress;
2360 PVOID MaximumApplicationAddress;
2361 ULONG ActiveProcessorMask;
2362 ULONG NumberOfProcessors;
2363 ULONG ProcessorType;
2364 ULONG AllocationGranularity;
2365 WORD ProcessorLevel;
2366 WORD ProcessorRevision;
2367 } SYSTEM_CONFIGURATION_INFO, *PSYSTEM_CONFIGURATION_INFO;
2368
2369 typedef struct _SYSTEM_EXCEPTION_INFORMATION {
2370 BYTE Reserved1[16];
2371 } SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION;
2372
2373 typedef struct _SYSTEM_LOOKASIDE_INFORMATION {
2374 BYTE Reserved1[32];
2375 } SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION;
2376
2377 typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION {
2378 BOOLEAN DebuggerEnabled;
2379 BOOLEAN DebuggerNotPresent;
2380 } SYSTEM_KERNEL_DEBUGGER_INFORMATION, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION;
2381
2382 typedef struct _VM_COUNTERS
2383 {
2384 SIZE_T PeakVirtualSize;
2385 SIZE_T VirtualSize;
2386 ULONG PageFaultCount;
2387 SIZE_T PeakWorkingSetSize;
2388 SIZE_T WorkingSetSize;
2389 SIZE_T QuotaPeakPagedPoolUsage;
2390 SIZE_T QuotaPagedPoolUsage;
2391 SIZE_T QuotaPeakNonPagedPoolUsage;
2392 SIZE_T QuotaNonPagedPoolUsage;
2393 SIZE_T PagefileUsage;
2394 SIZE_T PeakPagefileUsage;
2395 } VM_COUNTERS, *PVM_COUNTERS;
2396
2397 typedef struct _VM_COUNTERS_EX
2398 {
2399 SIZE_T PeakVirtualSize;
2400 SIZE_T VirtualSize;
2401 ULONG PageFaultCount;
2402 SIZE_T PeakWorkingSetSize;
2403 SIZE_T WorkingSetSize;
2404 SIZE_T QuotaPeakPagedPoolUsage;
2405 SIZE_T QuotaPagedPoolUsage;
2406 SIZE_T QuotaPeakNonPagedPoolUsage;
2407 SIZE_T QuotaNonPagedPoolUsage;
2408 SIZE_T PagefileUsage;
2409 SIZE_T PeakPagefileUsage;
2410 SIZE_T PrivateUsage;
2411 } VM_COUNTERS_EX, *PVM_COUNTERS_EX;
2412
2413 typedef struct _SYSTEM_PROCESS_INFORMATION {
2414 #ifdef __WINESRC__ /* win32/win64 */
2415 ULONG NextEntryOffset; /* 00/00 */
2416 DWORD dwThreadCount; /* 04/04 */
2417 DWORD dwUnknown1[6]; /* 08/08 */
2418 LARGE_INTEGER CreationTime; /* 20/20 */
2419 LARGE_INTEGER UserTime; /* 28/28 */
2420 LARGE_INTEGER KernelTime; /* 30/30 */
2421 UNICODE_STRING ProcessName; /* 38/38 */
2422 DWORD dwBasePriority; /* 40/48 */
2423 HANDLE UniqueProcessId; /* 44/50 */
2424 HANDLE ParentProcessId; /* 48/58 */
2425 ULONG HandleCount; /* 4c/60 */
2426 ULONG SessionId; /* 50/64 */
2427 DWORD dwUnknown4; /* 54/68 */
2428 VM_COUNTERS_EX vmCounters; /* 58/70 */
2429 IO_COUNTERS ioCounters; /* 88/d0 */
2430 SYSTEM_THREAD_INFORMATION ti[1]; /* b8/100 */
2431 #else
2432 ULONG NextEntryOffset; /* 00/00 */
2433 BYTE Reserved1[52]; /* 04/04 */
2434 PVOID Reserved2[3]; /* 38/38 */
2435 HANDLE UniqueProcessId; /* 44/50 */
2436 PVOID Reserved3; /* 48/58 */
2437 ULONG HandleCount; /* 4c/60 */
2438 BYTE Reserved4[4]; /* 50/64 */
2439 PVOID Reserved5[11]; /* 54/68 */
2440 SIZE_T PeakPagefileUsage; /* 80/c0 */
2441 SIZE_T PrivatePageCount; /* 84/c8 */
2442 LARGE_INTEGER Reserved6[6]; /* 88/d0 */
2443 #endif
2444 } SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
2445
2446 typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION {
2447 ULONG RegistryQuotaAllowed;
2448 ULONG RegistryQuotaUsed;
2449 PVOID Reserved1;
2450 } SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION;
2451
2452 typedef struct _SYSTEM_TIME_ADJUSTMENT_QUERY {
2453 ULONG TimeAdjustment;
2454 ULONG TimeIncrement;
2455 BOOLEAN TimeAdjustmentDisabled;
2456 } SYSTEM_TIME_ADJUSTMENT_QUERY, *PSYSTEM_TIME_ADJUSTMENT_QUERY;
2457
2458 typedef struct _SYSTEM_TIME_ADJUSTMENT {
2459 ULONG TimeAdjustment;
2460 BOOLEAN TimeAdjustmentDisabled;
2461 } SYSTEM_TIME_ADJUSTMENT, *PSYSTEM_TIME_ADJUSTMENT;
2462
2463 typedef enum _SYSTEM_FIRMWARE_TABLE_ACTION
2464 {
2465 SystemFirmwareTable_Enumerate = 0,
2466 SystemFirmwareTable_Get = 1
2467 } SYSTEM_FIRMWARE_TABLE_ACTION, *PSYSTEM_FIRMWARE_TABLE_ACTION;
2468
2469 /* System Information Class 0x4C */
2470
2471 typedef struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
2472 {
2473 ULONG ProviderSignature;
2474 SYSTEM_FIRMWARE_TABLE_ACTION Action;
2475 ULONG TableID;
2476 ULONG TableBufferLength;
2477 UCHAR TableBuffer[1];
2478 } SYSTEM_FIRMWARE_TABLE_INFORMATION, *PSYSTEM_FIRMWARE_TABLE_INFORMATION;
2479
2480 typedef struct _TIME_FIELDS
2481 { CSHORT Year;
2482 CSHORT Month;
2483 CSHORT Day;
2484 CSHORT Hour;
2485 CSHORT Minute;
2486 CSHORT Second;
2487 CSHORT Milliseconds;
2488 CSHORT Weekday;
2489 } TIME_FIELDS, *PTIME_FIELDS;
2490
2491 typedef struct _WINSTATIONINFORMATIONW {
2492 BYTE Reserved2[70];
2493 ULONG LogonId;
2494 BYTE Reserved3[1140];
2495 } WINSTATIONINFORMATIONW, *PWINSTATIONINFORMATIONW;
2496
2497 typedef BOOLEAN (WINAPI * PWINSTATIONQUERYINFORMATIONW)(HANDLE,ULONG,WINSTATIONINFOCLASS,PVOID,ULONG,PULONG);
2498
2499 typedef struct _LDR_RESOURCE_INFO
2500 {
2501 ULONG_PTR Type;
2502 ULONG_PTR Name;
2503 ULONG Language;
2504 } LDR_RESOURCE_INFO, *PLDR_RESOURCE_INFO;
2505
2506
2507 /* debug buffer definitions */
2508
2509 typedef struct _DEBUG_BUFFER {
2510 HANDLE SectionHandle;
2511 PVOID SectionBase;
2512 PVOID RemoteSectionBase;
2513 ULONG SectionBaseDelta;
2514 HANDLE EventPairHandle;
2515 ULONG Unknown[2];
2516 HANDLE RemoteThreadHandle;
2517 ULONG InfoClassMask;
2518 ULONG SizeOfInfo;
2519 ULONG AllocatedSize;
2520 ULONG SectionSize;
2521 PVOID ModuleInformation;
2522 PVOID BackTraceInformation;
2523 PVOID HeapInformation;
2524 PVOID LockInformation;
2525 PVOID Reserved[8];
2526 } DEBUG_BUFFER, *PDEBUG_BUFFER;
2527
2528 #define PDI_MODULES 0x01
2529 #define PDI_BACKTRACE 0x02
2530 #define PDI_HEAPS 0x04
2531 #define PDI_HEAP_TAGS 0x08
2532 #define PDI_HEAP_BLOCKS 0x10
2533 #define PDI_LOCKS 0x20
2534
2535 typedef struct _DEBUG_MODULE_INFORMATION {
2536 ULONG Reserved[2];
2537 ULONG Base;
2538 ULONG Size;
2539 ULONG Flags;
2540 USHORT Index;
2541 USHORT Unknown;
2542 USHORT LoadCount;
2543 USHORT ModuleNameOffset;
2544 CHAR ImageName[256];
2545 } DEBUG_MODULE_INFORMATION, *PDEBUG_MODULE_INFORMATION;
2546
2547 typedef struct _DEBUG_HEAP_INFORMATION {
2548 ULONG Base;
2549 ULONG Flags;
2550 USHORT Granularity;
2551 USHORT Unknown;
2552 ULONG Allocated;
2553 ULONG Committed;
2554 ULONG TagCount;
2555 ULONG BlockCount;
2556 ULONG Reserved[7];
2557 PVOID Tags;
2558 PVOID Blocks;
2559 } DEBUG_HEAP_INFORMATION, *PDEBUG_HEAP_INFORMATION;
2560
2561 typedef struct _DEBUG_LOCK_INFORMATION {
2562 PVOID Address;
2563 USHORT Type;
2564 USHORT CreatorBackTraceIndex;
2565 ULONG OwnerThreadId;
2566 ULONG ActiveCount;
2567 ULONG ContentionCount;
2568 ULONG EntryCount;
2569 ULONG RecursionCount;
2570 ULONG NumberOfSharedWaiters;
2571 ULONG NumberOfExclusiveWaiters;
2572 } DEBUG_LOCK_INFORMATION, *PDEBUG_LOCK_INFORMATION;
2573
2574 typedef struct _PORT_MESSAGE_HEADER {
2575 USHORT DataSize;
2576 USHORT MessageSize;
2577 USHORT MessageType;
2578 USHORT VirtualRangesOffset;
2579 CLIENT_ID ClientId;
2580 ULONG MessageId;
2581 ULONG SectionSize;
2582 } PORT_MESSAGE_HEADER, *PPORT_MESSAGE_HEADER, PORT_MESSAGE, *PPORT_MESSAGE;
2583
2584 typedef unsigned short RTL_ATOM, *PRTL_ATOM;
2585
2586 typedef enum _ATOM_INFORMATION_CLASS {
2587 AtomBasicInformation = 0,
2588 AtomTableInformation = 1,
2589 } ATOM_INFORMATION_CLASS;
2590
2591 typedef struct _ATOM_BASIC_INFORMATION {
2592 USHORT ReferenceCount;
2593 USHORT Pinned;
2594 USHORT NameLength;
2595 WCHAR Name[1];
2596 } ATOM_BASIC_INFORMATION, *PATOM_BASIC_INFORMATION;
2597
2598 /* FIXME: names probably not correct */
2599 typedef struct _RTL_HANDLE
2600 {
2601 struct _RTL_HANDLE * Next;
2602 } RTL_HANDLE;
2603
2604 /* FIXME: names probably not correct */
2605 typedef struct _RTL_HANDLE_TABLE
2606 {
2607 ULONG MaxHandleCount; /* 0x00 */
2608 ULONG HandleSize; /* 0x04 */
2609 ULONG Unused[2]; /* 0x08-0x0c */
2610 PVOID NextFree; /* 0x10 */
2611 PVOID FirstHandle; /* 0x14 */
2612 PVOID ReservedMemory; /* 0x18 */
2613 PVOID MaxHandle; /* 0x1c */
2614 } RTL_HANDLE_TABLE;
2615
2616 typedef struct _RTL_ATOM_TABLE_ENTRY
2617 {
2618 struct _RTL_ATOM_TABLE_ENTRY *HashLink;
2619 WORD HandleIndex;
2620 WORD Atom;
2621 WORD ReferenceCount;
2622 UCHAR Flags;
2623 UCHAR NameLength;
2624 WCHAR Name[1];
2625 } RTL_ATOM_TABLE_ENTRY, *PRTL_ATOM_TABLE_ENTRY;
2626
2627 typedef struct _RTL_ATOM_TABLE
2628 {
2629 ULONG Signature;
2630 RTL_CRITICAL_SECTION CriticalSection;
2631 RTL_HANDLE_TABLE HandleTable;
2632 ULONG NumberOfBuckets;
2633 RTL_ATOM_TABLE_ENTRY *Buckets[1];
2634 } *RTL_ATOM_TABLE, **PRTL_ATOM_TABLE;
2635
2636 /***********************************************************************
2637 * Defines
2638 */
2639
2640 /* flags for NtCreateFile and NtOpenFile */
2641 #define FILE_DIRECTORY_FILE 0x00000001
2642 #define FILE_WRITE_THROUGH 0x00000002
2643 #define FILE_SEQUENTIAL_ONLY 0x00000004
2644 #define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008
2645 #define FILE_SYNCHRONOUS_IO_ALERT 0x00000010
2646 #define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
2647 #define FILE_NON_DIRECTORY_FILE 0x00000040
2648 #define FILE_CREATE_TREE_CONNECTION 0x00000080
2649 #define FILE_COMPLETE_IF_OPLOCKED 0x00000100
2650 #define FILE_NO_EA_KNOWLEDGE 0x00000200
2651 #define FILE_OPEN_FOR_RECOVERY 0x00000400
2652 #define FILE_RANDOM_ACCESS 0x00000800
2653 #define FILE_DELETE_ON_CLOSE 0x00001000
2654 #define FILE_OPEN_BY_FILE_ID 0x00002000
2655 #define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000
2656 #define FILE_NO_COMPRESSION 0x00008000
2657 #define FILE_RESERVE_OPFILTER 0x00100000
2658 #define FILE_OPEN_REPARSE_POINT 0x00200000
2659 #define FILE_OPEN_OFFLINE_FILE 0x00400000
2660 #define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000
2661
2662 #define FILE_ATTRIBUTE_VALID_FLAGS 0x00007fb7
2663 #define FILE_ATTRIBUTE_VALID_SET_FLAGS 0x000031a7
2664
2665 /* status for NtCreateFile or NtOpenFile */
2666 #define FILE_SUPERSEDED 0
2667 #define FILE_OPENED 1
2668 #define FILE_CREATED 2
2669 #define FILE_OVERWRITTEN 3
2670 #define FILE_EXISTS 4
2671 #define FILE_DOES_NOT_EXIST 5
2672
2673 /* disposition for NtCreateFile */
2674 #define FILE_SUPERSEDE 0
2675 #define FILE_OPEN 1
2676 #define FILE_CREATE 2
2677 #define FILE_OPEN_IF 3
2678 #define FILE_OVERWRITE 4
2679 #define FILE_OVERWRITE_IF 5
2680 #define FILE_MAXIMUM_DISPOSITION 5
2681
2682 /* Characteristics of a File System */
2683 #define FILE_REMOVABLE_MEDIA 0x00000001
2684 #define FILE_READ_ONLY_DEVICE 0x00000002
2685 #define FILE_FLOPPY_DISKETTE 0x00000004
2686 #define FILE_WRITE_ONE_MEDIA 0x00000008
2687 #define FILE_REMOTE_DEVICE 0x00000010
2688 #define FILE_DEVICE_IS_MOUNTED 0x00000020
2689 #define FILE_VIRTUAL_VOLUME 0x00000040
2690 #define FILE_AUTOGENERATED_DEVICE_NAME 0x00000080
2691 #define FILE_DEVICE_SECURE_OPEN 0x00000100
2692 #define FILE_CHARACTERISTIC_PNP_DEVICE 0x00000800
2693 #define FILE_CHARACTERISTIC_TS_DEVICE 0x00001000
2694 #define FILE_CHARACTERISTIC_WEBDAV_DEVICE 0x00002000
2695 #define FILE_CHARACTERISTIC_CSV 0x00010000
2696 #define FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL 0x00020000
2697 #define FILE_PORTABLE_DEVICE 0x00040000
2698
2699 /* options for NtCreateNamedPipeFile */
2700 #define FILE_PIPE_INBOUND 0x00000000
2701 #define FILE_PIPE_OUTBOUND 0x00000001
2702 #define FILE_PIPE_FULL_DUPLEX 0x00000002
2703
2704 /* options for pipe's type */
2705 #define FILE_PIPE_TYPE_MESSAGE 0x00000001
2706 #define FILE_PIPE_TYPE_BYTE 0x00000000
2707 /* options for pipe's message mode */
2708 #define FILE_PIPE_MESSAGE_MODE 0x00000001
2709 #define FILE_PIPE_BYTE_STREAM_MODE 0x00000000
2710 /* options for pipe's blocking mode */
2711 #define FILE_PIPE_COMPLETE_OPERATION 0x00000001
2712 #define FILE_PIPE_QUEUE_OPERATION 0x00000000
2713 /* and client / server end */
2714 #define FILE_PIPE_SERVER_END 0x00000001
2715 #define FILE_PIPE_CLIENT_END 0x00000000
2716
2717 #define INTERNAL_TS_ACTIVE_CONSOLE_ID ( *((volatile ULONG*)(0x7ffe02d8)) )
2718
2719 #define LOGONID_CURRENT ((ULONG)-1)
2720
2721 #define OBJ_PROTECT_CLOSE 0x00000001
2722 #define OBJ_INHERIT 0x00000002
2723 #define OBJ_PERMANENT 0x00000010
2724 #define OBJ_EXCLUSIVE 0x00000020
2725 #define OBJ_CASE_INSENSITIVE 0x00000040
2726 #define OBJ_OPENIF 0x00000080
2727 #define OBJ_OPENLINK 0x00000100
2728 #define OBJ_KERNEL_HANDLE 0x00000200
2729 #define OBJ_VALID_ATTRIBUTES 0x000003F2
2730
2731 #define SERVERNAME_CURRENT ((HANDLE)NULL)
2732
2733 typedef void (CALLBACK *PNTAPCFUNC)(ULONG_PTR,ULONG_PTR,ULONG_PTR); /* FIXME: not the right name */
2734 typedef void (CALLBACK *PRTL_THREAD_START_ROUTINE)(LPVOID); /* FIXME: not the right name */
2735 typedef DWORD (CALLBACK *PRTL_WORK_ITEM_ROUTINE)(LPVOID); /* FIXME: not the right name */
2736 typedef void (NTAPI *RTL_WAITORTIMERCALLBACKFUNC)(PVOID,BOOLEAN); /* FIXME: not the right name */
2737
2738
2739 /* DbgPrintEx default levels */
2740 #define DPFLTR_ERROR_LEVEL 0
2741 #define DPFLTR_WARNING_LEVEL 1
2742 #define DPFLTR_TRACE_LEVEL 2
2743 #define DPFLTR_INFO_LEVEL 3
2744 #define DPFLTR_MASK 0x8000000
2745
2746 /* Well-known LUID values */
2747 #define SE_MIN_WELL_KNOWN_PRIVILEGE 2
2748 #define SE_CREATE_TOKEN_PRIVILEGE 2
2749 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 3
2750 #define SE_LOCK_MEMORY_PRIVILEGE 4
2751 #define SE_INCREASE_QUOTA_PRIVILEGE 5
2752 #define SE_UNSOLICITED_INPUT_PRIVILEGE 6 /* obsolete */
2753 #define SE_MACHINE_ACCOUNT_PRIVILEGE 6
2754 #define SE_TCB_PRIVILEGE 7
2755 #define SE_SECURITY_PRIVILEGE 8
2756 #define SE_TAKE_OWNERSHIP_PRIVILEGE 9
2757 #define SE_LOAD_DRIVER_PRIVILEGE 10
2758 #define SE_SYSTEM_PROFILE_PRIVILEGE 11
2759 #define SE_SYSTEMTIME_PRIVILEGE 12
2760 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13
2761 #define SE_INC_BASE_PRIORITY_PRIVILEGE 14
2762 #define SE_CREATE_PAGEFILE_PRIVILEGE 15
2763 #define SE_CREATE_PERMANENT_PRIVILEGE 16
2764 #define SE_BACKUP_PRIVILEGE 17
2765 #define SE_RESTORE_PRIVILEGE 18
2766 #define SE_SHUTDOWN_PRIVILEGE 19
2767 #define SE_DEBUG_PRIVILEGE 20
2768 #define SE_AUDIT_PRIVILEGE 21
2769 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22
2770 #define SE_CHANGE_NOTIFY_PRIVILEGE 23
2771 #define SE_REMOTE_SHUTDOWN_PRIVILEGE 24
2772 #define SE_UNDOCK_PRIVILEGE 25
2773 #define SE_SYNC_AGENT_PRIVILEGE 26
2774 #define SE_ENABLE_DELEGATION_PRIVILEGE 27
2775 #define SE_MANAGE_VOLUME_PRIVILEGE 28
2776 #define SE_IMPERSONATE_PRIVILEGE 29
2777 #define SE_CREATE_GLOBAL_PRIVILEGE 30
2778 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_GLOBAL_PRIVILEGE
2779
2780 /* NtGlobalFlag bits */
2781 #define FLG_STOP_ON_EXCEPTION 0x00000001
2782 #define FLG_SHOW_LDR_SNAPS 0x00000002
2783 #define FLG_DEBUG_INITIAL_COMMAND 0x00000004
2784 #define FLG_STOP_ON_HUNG_GUI 0x00000008
2785 #define FLG_HEAP_ENABLE_TAIL_CHECK 0x00000010
2786 #define FLG_HEAP_ENABLE_FREE_CHECK 0x00000020
2787 #define FLG_HEAP_VALIDATE_PARAMETERS 0x00000040
2788 #define FLG_HEAP_VALIDATE_ALL 0x00000080
2789 #define FLG_APPLICATION_VERIFIER 0x00000100
2790 #define FLG_POOL_ENABLE_TAGGING 0x00000400
2791 #define FLG_HEAP_ENABLE_TAGGING 0x00000800
2792 #define FLG_USER_STACK_TRACE_DB 0x00001000
2793 #define FLG_KERNEL_STACK_TRACE_DB 0x00002000
2794 #define FLG_MAINTAIN_OBJECT_TYPELIST 0x00004000
2795 #define FLG_HEAP_ENABLE_TAG_BY_DLL 0x00008000
2796 #define FLG_DISABLE_STACK_EXTENSION 0x00010000
2797 #define FLG_ENABLE_CSRDEBUG 0x00020000
2798 #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x00040000
2799 #define FLG_DISABLE_PAGE_KERNEL_STACKS 0x00080000
2800 #define FLG_ENABLE_SYSTEM_CRIT_BREAKS 0x00100000
2801 #define FLG_HEAP_DISABLE_COALESCING 0x00200000
2802 #define FLG_ENABLE_CLOSE_EXCEPTIONS 0x00400000
2803 #define FLG_ENABLE_EXCEPTION_LOGGING 0x00800000
2804 #define FLG_ENABLE_HANDLE_TYPE_TAGGING 0x01000000
2805 #define FLG_HEAP_PAGE_ALLOCS 0x02000000
2806 #define FLG_DEBUG_INITIAL_COMMAND_EX 0x04000000
2807 #define FLG_DISABLE_DBGPRINT 0x08000000
2808 #define FLG_CRITSEC_EVENT_CREATION 0x10000000
2809 #define FLG_LDR_TOP_DOWN 0x20000000
2810 #define FLG_ENABLE_HANDLE_EXCEPTIONS 0x40000000
2811 #define FLG_DISABLE_PROTDLLS 0x80000000
2812
2813 /* Rtl*Registry* functions structs and defines */
2814 #define RTL_REGISTRY_ABSOLUTE 0
2815 #define RTL_REGISTRY_SERVICES 1
2816 #define RTL_REGISTRY_CONTROL 2
2817 #define RTL_REGISTRY_WINDOWS_NT 3
2818 #define RTL_REGISTRY_DEVICEMAP 4
2819 #define RTL_REGISTRY_USER 5
2820
2821 #define RTL_REGISTRY_HANDLE 0x40000000
2822 #define RTL_REGISTRY_OPTIONAL 0x80000000
2823
2824 #define RTL_QUERY_REGISTRY_SUBKEY 0x00000001
2825 #define RTL_QUERY_REGISTRY_TOPKEY 0x00000002
2826 #define RTL_QUERY_REGISTRY_REQUIRED 0x00000004
2827 #define RTL_QUERY_REGISTRY_NOVALUE 0x00000008
2828 #define RTL_QUERY_REGISTRY_NOEXPAND 0x00000010
2829 #define RTL_QUERY_REGISTRY_DIRECT 0x00000020
2830 #define RTL_QUERY_REGISTRY_DELETE 0x00000040
2831 #define RTL_QUERY_REGISTRY_TYPECHECK 0x00000100
2832
2833 #define RTL_QUERY_REGISTRY_TYPECHECK_SHIFT 24
2834
2835 typedef NTSTATUS (WINAPI *PRTL_QUERY_REGISTRY_ROUTINE)( PCWSTR ValueName,
2836 ULONG ValueType,
2837 PVOID ValueData,
2838 ULONG ValueLength,
2839 PVOID Context,
2840 PVOID EntryContext);
2841
2842 typedef struct _RTL_QUERY_REGISTRY_TABLE
2843 {
2844 PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine;
2845 ULONG Flags;
2846 PWSTR Name;
2847 PVOID EntryContext;
2848 ULONG DefaultType;
2849 PVOID DefaultData;
2850 ULONG DefaultLength;
2851 } RTL_QUERY_REGISTRY_TABLE, *PRTL_QUERY_REGISTRY_TABLE;
2852
2853 typedef struct _KEY_MULTIPLE_VALUE_INFORMATION
2854 {
2855 PUNICODE_STRING ValueName;
2856 ULONG DataLength;
2857 ULONG DataOffset;
2858 ULONG Type;
2859 } KEY_MULTIPLE_VALUE_INFORMATION, *PKEY_MULTIPLE_VALUE_INFORMATION;
2860
2861 typedef VOID (CALLBACK *PRTL_OVERLAPPED_COMPLETION_ROUTINE)(DWORD,DWORD,LPVOID);
2862
2863 typedef VOID (CALLBACK *PTIMER_APC_ROUTINE) ( PVOID, ULONG, LONG );
2864
2865 typedef enum _EVENT_INFORMATION_CLASS {
2866 EventBasicInformation
2867 } EVENT_INFORMATION_CLASS, *PEVENT_INFORMATION_CLASS;
2868
2869 typedef struct _EVENT_BASIC_INFORMATION {
2870 EVENT_TYPE EventType;
2871 LONG EventState;
2872 } EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;
2873
2874 typedef enum _SEMAPHORE_INFORMATION_CLASS {
2875 SemaphoreBasicInformation
2876 } SEMAPHORE_INFORMATION_CLASS, *PSEMAPHORE_INFORMATION_CLASS;
2877
2878 typedef struct _SEMAPHORE_BASIC_INFORMATION {
2879 ULONG CurrentCount;
2880 ULONG MaximumCount;
2881 } SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;
2882
2883 typedef enum _SECTION_INFORMATION_CLASS
2884 {
2885 SectionBasicInformation,
2886 SectionImageInformation,
2887 SectionRelocationInformation,
2888 SectionOriginalBaseInformation,
2889 SectionInternalImageInformation
2890 } SECTION_INFORMATION_CLASS;
2891
2892 typedef struct _SECTION_BASIC_INFORMATION {
2893 PVOID BaseAddress;
2894 ULONG Attributes;
2895 LARGE_INTEGER Size;
2896 } SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;
2897
2898 typedef struct _SECTION_IMAGE_INFORMATION {
2899 PVOID TransferAddress;
2900 ULONG ZeroBits;
2901 SIZE_T MaximumStackSize;
2902 SIZE_T CommittedStackSize;
2903 ULONG SubSystemType;
2904 USHORT MinorSubsystemVersion;
2905 USHORT MajorSubsystemVersion;
2906 USHORT MajorOperatingSystemVersion;
2907 USHORT MinorOperatingSystemVersion;
2908 USHORT ImageCharacteristics;
2909 USHORT DllCharacteristics;
2910 USHORT Machine;
2911 BOOLEAN ImageContainsCode;
2912 union
2913 {
2914 UCHAR ImageFlags;
2915 struct
2916 {
2917 UCHAR ComPlusNativeReady : 1;
2918 UCHAR ComPlusILOnly : 1;
2919 UCHAR ImageDynamicallyRelocated : 1;
2920 UCHAR ImageMappedFlat : 1;
2921 UCHAR BaseBelow4gb : 1;
2922 UCHAR ComPlusPrefer32bit : 1;
2923 #ifdef __WINESRC__ /* Wine extensions */
2924 UCHAR WineBuiltin : 1;
2925 UCHAR WineFakeDll : 1;
2926 #else
2927 UCHAR Reserved : 2;
2928 #endif
2929 } DUMMYSTRUCTNAME;
2930 } DUMMYUNIONNAME;
2931 ULONG LoaderFlags;
2932 ULONG ImageFileSize;
2933 ULONG CheckSum;
2934 } SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;
2935
2936 typedef struct _LPC_SECTION_WRITE {
2937 ULONG Length;
2938 HANDLE SectionHandle;
2939 ULONG SectionOffset;
2940 ULONG ViewSize;
2941 PVOID ViewBase;
2942 PVOID TargetViewBase;
2943 } LPC_SECTION_WRITE, *PLPC_SECTION_WRITE;
2944
2945 typedef struct _LPC_SECTION_READ {
2946 ULONG Length;
2947 ULONG ViewSize;
2948 PVOID ViewBase;
2949 } LPC_SECTION_READ, *PLPC_SECTION_READ;
2950
2951 typedef struct _LPC_MESSAGE {
2952 USHORT DataSize;
2953 USHORT MessageSize;
2954 USHORT MessageType;
2955 USHORT VirtualRangesOffset;
2956 CLIENT_ID ClientId;
2957 ULONG_PTR MessageId;
2958 ULONG_PTR SectionSize;
2959 UCHAR Data[ANYSIZE_ARRAY];
2960 } LPC_MESSAGE, *PLPC_MESSAGE;
2961
2962 typedef struct _RTL_USER_PROCESS_INFORMATION
2963 {
2964 ULONG Length;
2965 HANDLE Process;
2966 HANDLE Thread;
2967 CLIENT_ID ClientId;
2968 SECTION_IMAGE_INFORMATION ImageInformation;
2969 } RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION;
2970
2971 typedef enum _SHUTDOWN_ACTION {
2972 ShutdownNoReboot,
2973 ShutdownReboot,
2974 ShutdownPowerOff
2975 } SHUTDOWN_ACTION, *PSHUTDOWN_ACTION;
2976
2977 typedef struct _COUNTED_REASON_CONTEXT
2978 {
2979 ULONG Version;
2980 ULONG Flags;
2981 union
2982 {
2983 struct
2984 {
2985 UNICODE_STRING ResourceFileName;
2986 USHORT ResourceReasonId;
2987 ULONG StringCount;
2988 UNICODE_STRING *ReasonStrings;
2989 } DUMMYSTRUCTNAME;
2990 UNICODE_STRING SimpleString;
2991 } DUMMYUNIONNAME;
2992 } COUNTED_REASON_CONTEXT, *PCOUNTED_REASON_CONTEXT;
2993
2994 typedef enum _KPROFILE_SOURCE {
2995 ProfileTime,
2996 ProfileAlignmentFixup,
2997 ProfileTotalIssues,
2998 ProfilePipelineDry,
2999 ProfileLoadInstructions,
3000 ProfilePipelineFrozen,
3001 ProfileBranchInstructions,
3002 ProfileTotalNonissues,
3003 ProfileDcacheMisses,
3004 ProfileIcacheMisses,
3005 ProfileCacheMisses,
3006 ProfileBranchMispredictions,
3007 ProfileStoreInstructions,
3008 ProfileFpInstructions,
3009 ProfileIntegerInstructions,
3010 Profile2Issue,
3011 Profile3Issue,
3012 Profile4Issue,
3013 ProfileSpecialInstructions,
3014 ProfileTotalCycles,
3015 ProfileIcacheIssues,
3016 ProfileDcacheAccesses,
3017 ProfileMemoryBarrierCycles,
3018 ProfileLoadLinkedIssues,
3019 ProfileMaximum
3020 } KPROFILE_SOURCE, *PKPROFILE_SOURCE;
3021
3022 typedef struct _DIRECTORY_BASIC_INFORMATION {
3023 UNICODE_STRING ObjectName;
3024 UNICODE_STRING ObjectTypeName;
3025 } DIRECTORY_BASIC_INFORMATION, *PDIRECTORY_BASIC_INFORMATION;
3026
3027 typedef struct _INITIAL_TEB {
3028 void *OldStackBase;
3029 void *OldStackLimit;
3030 void *StackBase;
3031 void *StackLimit;
3032 void *DeallocationStack;
3033 } INITIAL_TEB, *PINITIAL_TEB;
3034
3035 typedef enum _PORT_INFORMATION_CLASS {
3036 PortNoInformation
3037 } PORT_INFORMATION_CLASS, *PPORT_INFORMATION_CLASS;
3038
3039 typedef enum _IO_COMPLETION_INFORMATION_CLASS {
3040 IoCompletionBasicInformation
3041 } IO_COMPLETION_INFORMATION_CLASS, *PIO_COMPLETION_INFORMATION_CLASS;
3042
3043 typedef struct _FILE_COMPLETION_INFORMATION {
3044 HANDLE CompletionPort;
3045 ULONG_PTR CompletionKey;
3046 } FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;
3047
3048 #define IO_COMPLETION_QUERY_STATE 0x0001
3049 #define IO_COMPLETION_MODIFY_STATE 0x0002
3050 #define IO_COMPLETION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3)
3051
3052 typedef struct _FILE_IO_COMPLETION_INFORMATION {
3053 ULONG_PTR CompletionKey;
3054 ULONG_PTR CompletionValue;
3055 IO_STATUS_BLOCK IoStatusBlock;
3056 } FILE_IO_COMPLETION_INFORMATION, *PFILE_IO_COMPLETION_INFORMATION;
3057
3058 typedef enum _HARDERROR_RESPONSE_OPTION {
3059 OptionAbortRetryIgnore,
3060 OptionOk,
3061 OptionOkCancel,
3062 OptionRetryCancel,
3063 OptionYesNo,
3064 OptionYesNoCancel,
3065 OptionShutdownSystem
3066 } HARDERROR_RESPONSE_OPTION, *PHARDERROR_RESPONSE_OPTION;
3067
3068 typedef enum _HARDERROR_RESPONSE {
3069 ResponseReturnToCaller,
3070 ResponseNotHandled,
3071 ResponseAbort,
3072 ResponseCancel,
3073 ResponseIgnore,
3074 ResponseNo,
3075 ResponseOk,
3076 ResponseRetry,
3077 ResponseYes
3078 } HARDERROR_RESPONSE, *PHARDERROR_RESPONSE;
3079
3080 typedef enum _SYSDBG_COMMAND {
3081 SysDbgQueryModuleInformation,
3082 SysDbgQueryTraceInformation,
3083 SysDbgSetTracepoint,
3084 SysDbgSetSpecialCall,
3085 SysDbgClearSpecialCalls,
3086 SysDbgQuerySpecialCalls,
3087 SysDbgBreakPoint,
3088 SysDbgQueryVersion,
3089 SysDbgReadVirtual,
3090 SysDbgWriteVirtual,
3091 SysDbgReadPhysical,
3092 SysDbgWritePhysical,
3093 SysDbgReadControlSpace,
3094 SysDbgWriteControlSpace,
3095 SysDbgReadIoSpace,
3096 SysDbgWriteIoSpace,
3097 SysDbgReadMsr,
3098 SysDbgWriteMsr,
3099 SysDbgReadBusData,
3100 SysDbgWriteBusData
3101 } SYSDBG_COMMAND, *PSYSDBG_COMMAND;
3102
3103 typedef struct _CPTABLEINFO
3104 {
3105 USHORT CodePage;
3106 USHORT MaximumCharacterSize;
3107 USHORT DefaultChar;
3108 USHORT UniDefaultChar;
3109 USHORT TransDefaultChar;
3110 USHORT TransUniDefaultChar;
3111 USHORT DBCSCodePage;
3112 UCHAR LeadByte[12];
3113 USHORT *MultiByteTable;
3114 void *WideCharTable;
3115 USHORT *DBCSRanges;
3116 USHORT *DBCSOffsets;
3117 } CPTABLEINFO, *PCPTABLEINFO;
3118
3119 typedef struct _NLSTABLEINFO
3120 {
3121 CPTABLEINFO OemTableInfo;
3122 CPTABLEINFO AnsiTableInfo;
3123 USHORT *UpperCaseTable;
3124 USHORT *LowerCaseTable;
3125 } NLSTABLEINFO, *PNLSTABLEINFO;
3126
3127 /*************************************************************************
3128 * Loader structures
3129 *
3130 * Those are not part of standard Winternl.h
3131 */
3132
3133 typedef struct _LDR_SERVICE_TAG_RECORD
3134 {
3135 struct _LDR_SERVICE_TAG_RECORD *Next;
3136 ULONG ServiceTag;
3137 } LDR_SERVICE_TAG_RECORD, *PLDR_SERVICE_TAG_RECORD;
3138
3139 typedef struct _LDRP_CSLIST
3140 {
3141 SINGLE_LIST_ENTRY *Tail;
3142 } LDRP_CSLIST, *PLDRP_CSLIST;
3143
3144 typedef enum _LDR_DDAG_STATE
3145 {
3146 LdrModulesMerged = -5,
3147 LdrModulesInitError = -4,
3148 LdrModulesSnapError = -3,
3149 LdrModulesUnloaded = -2,
3150 LdrModulesUnloading = -1,
3151 LdrModulesPlaceHolder = 0,
3152 LdrModulesMapping = 1,
3153 LdrModulesMapped = 2,
3154 LdrModulesWaitingForDependencies = 3,
3155 LdrModulesSnapping = 4,
3156 LdrModulesSnapped = 5,
3157 LdrModulesCondensed = 6,
3158 LdrModulesReadyToInit = 7,
3159 LdrModulesInitializing = 8,
3160 LdrModulesReadyToRun = 9,
3161 } LDR_DDAG_STATE;
3162
3163 typedef struct _LDR_DDAG_NODE
3164 {
3165 LIST_ENTRY Modules;
3166 LDR_SERVICE_TAG_RECORD *ServiceTagList;
3167 ULONG LoadCount;
3168 ULONG ReferenceCount;
3169 ULONG DependencyCount;
3170 union
3171 {
3172 LDRP_CSLIST Dependencies;
3173 SINGLE_LIST_ENTRY RemovalLink;
3174 };
3175 LDRP_CSLIST IncomingDependencies;
3176 LDR_DDAG_STATE State;
3177 SINGLE_LIST_ENTRY CondenseLink;
3178 ULONG PreorderNumber;
3179 ULONG LowestLink;
3180 } LDR_DDAG_NODE, *PLDR_DDAG_NODE;
3181
3182 typedef enum _LDR_DLL_LOAD_REASON
3183 {
3184 LoadReasonStaticDependency,
3185 LoadReasonStaticForwarderDependency,
3186 LoadReasonDynamicForwarderDependency,
3187 LoadReasonDelayloadDependency,
3188 LoadReasonDynamicLoad,
3189 LoadReasonAsImageLoad,
3190 LoadReasonAsDataLoad,
3191 LoadReasonUnknown = -1
3192 } LDR_DLL_LOAD_REASON, *PLDR_DLL_LOAD_REASON;
3193
3194 typedef struct _LDR_DATA_TABLE_ENTRY
3195 {
3196 LIST_ENTRY InLoadOrderLinks;
3197 LIST_ENTRY InMemoryOrderLinks;
3198 LIST_ENTRY InInitializationOrderLinks;
3199 void* DllBase;
3200 void* EntryPoint;
3201 ULONG SizeOfImage;
3202 UNICODE_STRING FullDllName;
3203 UNICODE_STRING BaseDllName;
3204 ULONG Flags;
3205 SHORT LoadCount;
3206 SHORT TlsIndex;
3207 HANDLE SectionHandle;
3208 ULONG CheckSum;
3209 ULONG TimeDateStamp;
3210 HANDLE ActivationContext;
3211 void* Lock;
3212 LDR_DDAG_NODE* DdagNode;
3213 LIST_ENTRY NodeModuleLink;
3214 struct _LDRP_LOAD_CONTEXT *LoadContext;
3215 void* ParentDllBase;
3216 void* SwitchBackContext;
3217 RTL_BALANCED_NODE BaseAddressIndexNode;
3218 RTL_BALANCED_NODE MappingInfoIndexNode;
3219 ULONG_PTR OriginalBase;
3220 LARGE_INTEGER LoadTime;
3221 ULONG BaseNameHashValue;
3222 LDR_DLL_LOAD_REASON LoadReason;
3223 ULONG ImplicitPathOptions;
3224 ULONG ReferenceCount;
3225 } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
3226
3227 typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA
3228 {
3229 ULONG Flags;
3230 const UNICODE_STRING *FullDllName;
3231 const UNICODE_STRING *BaseDllName;
3232 void *DllBase;
3233 ULONG SizeOfImage;
3234 } LDR_DLL_LOADED_NOTIFICATION_DATA, *PLDR_DLL_LOADED_NOTIFICATION_DATA;
3235
3236 typedef struct _LDR_DLL_UNLOADED_NOTIFICATION_DATA
3237 {
3238 ULONG Flags;
3239 const UNICODE_STRING *FullDllName;
3240 const UNICODE_STRING *BaseDllName;
3241 void *DllBase;
3242 ULONG SizeOfImage;
3243 } LDR_DLL_UNLOADED_NOTIFICATION_DATA, *PLDR_DLL_UNLOADED_NOTIFICATION_DATA;
3244
3245 typedef union _LDR_DLL_NOTIFICATION_DATA
3246 {
3247 LDR_DLL_LOADED_NOTIFICATION_DATA Loaded;
3248 LDR_DLL_UNLOADED_NOTIFICATION_DATA Unloaded;
3249 } LDR_DLL_NOTIFICATION_DATA, *PLDR_DLL_NOTIFICATION_DATA;
3250
3251 typedef void (CALLBACK *PLDR_DLL_NOTIFICATION_FUNCTION)(ULONG, LDR_DLL_NOTIFICATION_DATA*, void*);
3252
3253 /* those defines are (some of the) regular LDR_DATA_TABLE_ENTRY.Flags values */
3254 #define LDR_IMAGE_IS_DLL 0x00000004
3255 #define LDR_LOAD_IN_PROGRESS 0x00001000
3256 #define LDR_UNLOAD_IN_PROGRESS 0x00002000
3257 #define LDR_NO_DLL_CALLS 0x00040000
3258 #define LDR_PROCESS_ATTACHED 0x00080000
3259 #define LDR_COR_IMAGE 0x00400000
3260 #define LDR_COR_ILONLY 0x01000000
3261
3262 /* these ones is Wine specific */
3263 #define LDR_DONT_RESOLVE_REFS 0x40000000
3264 #define LDR_WINE_INTERNAL 0x80000000
3265
3266 /* flag for LdrAddRefDll */
3267 #define LDR_ADDREF_DLL_PIN 0x00000001
3268
3269 #define LDR_DLL_NOTIFICATION_REASON_LOADED 1
3270 #define LDR_DLL_NOTIFICATION_REASON_UNLOADED 2
3271
3272 /* FIXME: to be checked */
3273 #define MAXIMUM_FILENAME_LENGTH 256
3274
3275 typedef struct _SYSTEM_MODULE
3276 {
3277 PVOID Section; /* 00/00 */
3278 PVOID MappedBaseAddress; /* 04/08 */
3279 PVOID ImageBaseAddress; /* 08/10 */
3280 ULONG ImageSize; /* 0c/18 */
3281 ULONG Flags; /* 10/1c */
3282 WORD LoadOrderIndex; /* 14/20 */
3283 WORD InitOrderIndex; /* 16/22 */
3284 WORD LoadCount; /* 18/24 */
3285 WORD NameOffset; /* 1a/26 */
3286 BYTE Name[MAXIMUM_FILENAME_LENGTH]; /* 1c/28 */
3287 } SYSTEM_MODULE, *PSYSTEM_MODULE;
3288
3289 typedef struct _SYSTEM_MODULE_INFORMATION
3290 {
3291 ULONG ModulesCount;
3292 SYSTEM_MODULE Modules[1]; /* FIXME: should be Modules[0] */
3293 } SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
3294
3295 #define PROCESS_CREATE_FLAGS_BREAKAWAY 0x00000001
3296 #define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT 0x00000002
3297 #define PROCESS_CREATE_FLAGS_INHERIT_HANDLES 0x00000004
3298 #define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008
3299 #define PROCESS_CREATE_FLAGS_LARGE_PAGES 0x00000010
3300 #define PROCESS_CREATE_FLAGS_LARGE_PAGE_SYSTEM_DLL 0x00000020
3301 #define PROCESS_CREATE_FLAGS_PROTECTED_PROCESS 0x00000040
3302 #define PROCESS_CREATE_FLAGS_CREATE_SESSION 0x00000080
3303 #define PROCESS_CREATE_FLAGS_INHERIT_FROM_PARENT 0x00000100
3304 #define PROCESS_CREATE_FLAGS_SUSPENDED 0x00000200
3305 #define PROCESS_CREATE_FLAGS_EXTENDED_UNKNOWN 0x00000400
3306
3307 typedef struct _RTL_PROCESS_MODULE_INFORMATION_EX
3308 {
3309 USHORT NextOffset;
3310 SYSTEM_MODULE BaseInfo;
3311 ULONG ImageCheckSum;
3312 ULONG TimeDateStamp;
3313 void *DefaultBase;
3314 } RTL_PROCESS_MODULE_INFORMATION_EX;
3315
3316 #define THREAD_CREATE_FLAGS_CREATE_SUSPENDED 0x00000001
3317 #define THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH 0x00000002
3318 #define THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER 0x00000004
3319 #define THREAD_CREATE_FLAGS_HAS_SECURITY_DESCRIPTOR 0x00000010
3320 #define THREAD_CREATE_FLAGS_ACCESS_CHECK_IN_TARGET 0x00000020
3321 #define THREAD_CREATE_FLAGS_INITIAL_THREAD 0x00000080
3322
3323 typedef LONG (CALLBACK *PRTL_EXCEPTION_FILTER)(PEXCEPTION_POINTERS);
3324
3325 typedef void (CALLBACK *PTP_IO_CALLBACK)(PTP_CALLBACK_INSTANCE,void*,void*,IO_STATUS_BLOCK*,PTP_IO);
3326
3327 #define PS_ATTRIBUTE_THREAD 0x00010000
3328 #define PS_ATTRIBUTE_INPUT 0x00020000
3329 #define PS_ATTRIBUTE_ADDITIVE 0x00040000
3330
3331 typedef enum _PS_ATTRIBUTE_NUM
3332 {
3333 PsAttributeParentProcess,
3334 PsAttributeDebugPort,
3335 PsAttributeToken,
3336 PsAttributeClientId,
3337 PsAttributeTebAddress,
3338 PsAttributeImageName,
3339 PsAttributeImageInfo,
3340 PsAttributeMemoryReserve,
3341 PsAttributePriorityClass,
3342 PsAttributeErrorMode,
3343 PsAttributeStdHandleInfo,
3344 PsAttributeHandleList,
3345 PsAttributeGroupAffinity,
3346 PsAttributePreferredNode,
3347 PsAttributeIdealProcessor,
3348 PsAttributeUmsThread,
3349 PsAttributeMitigationOptions,
3350 PsAttributeProtectionLevel,
3351 PsAttributeSecureProcess,
3352 PsAttributeJobList,
3353 PsAttributeChildProcessPolicy,
3354 PsAttributeAllApplicationPackagesPolicy,
3355 PsAttributeWin32kFilter,
3356 PsAttributeSafeOpenPromptOriginClaim,
3357 PsAttributeBnoIsolation,
3358 PsAttributeDesktopAppPolicy,
3359 PsAttributeChpe,
3360 PsAttributeMax
3361 } PS_ATTRIBUTE_NUM;
3362
3363 #define PS_ATTRIBUTE_PARENT_PROCESS (PsAttributeParentProcess | PS_ATTRIBUTE_INPUT | PS_ATTRIBUTE_ADDITIVE)
3364 #define PS_ATTRIBUTE_DEBUG_PORT (PsAttributeDebugPort | PS_ATTRIBUTE_INPUT | PS_ATTRIBUTE_ADDITIVE)
3365 #define PS_ATTRIBUTE_TOKEN (PsAttributeToken | PS_ATTRIBUTE_INPUT | PS_ATTRIBUTE_ADDITIVE)
3366 #define PS_ATTRIBUTE_CLIENT_ID (PsAttributeClientId | PS_ATTRIBUTE_THREAD)
3367 #define PS_ATTRIBUTE_TEB_ADDRESS (PsAttributeTebAddress | PS_ATTRIBUTE_THREAD)
3368 #define PS_ATTRIBUTE_IMAGE_NAME (PsAttributeImageName | PS_ATTRIBUTE_INPUT)
3369 #define PS_ATTRIBUTE_IMAGE_INFO (PsAttributeImageInfo)
3370 #define PS_ATTRIBUTE_MEMORY_RESERVE (PsAttributeMemoryReserve | PS_ATTRIBUTE_INPUT)
3371 #define PS_ATTRIBUTE_PRIORITY_CLASS (PsAttributePriorityClass | PS_ATTRIBUTE_INPUT)
3372 #define PS_ATTRIBUTE_ERROR_MODE (PsAttributeErrorMode | PS_ATTRIBUTE_INPUT)
3373 #define PS_ATTRIBUTE_STD_HANDLE_INFO (PsAttributeStdHandleInfo | PS_ATTRIBUTE_INPUT)
3374 #define PS_ATTRIBUTE_HANDLE_LIST (PsAttributeHandleList | PS_ATTRIBUTE_INPUT)
3375 #define PS_ATTRIBUTE_GROUP_AFFINITY (PsAttributeGroupAffinity | PS_ATTRIBUTE_THREAD | PS_ATTRIBUTE_INPUT)
3376 #define PS_ATTRIBUTE_PREFERRED_NODE (PsAttributePreferredNode | PS_ATTRIBUTE_INPUT)
3377 #define PS_ATTRIBUTE_IDEAL_PROCESSOR (PsAttributeIdealProcessor | PS_ATTRIBUTE_THREAD | PS_ATTRIBUTE_INPUT)
3378 #define PS_ATTRIBUTE_MITIGATION_OPTIONS (PsAttributeMitigationOptions | PS_ATTRIBUTE_INPUT | PS_ATTRIBUTE_UNKNOWN)
3379 #define PS_ATTRIBUTE_PROTECTION_LEVEL (PsAttributeProtectionLevel | PS_ATTRIBUTE_INPUT | PS_ATTRIBUTE_UNKNOWN)
3380 #define PS_ATTRIBUTE_SECURE_PROCESS (PsAttributeSecureProcess | PS_ATTRIBUTE_INPUT)
3381 #define PS_ATTRIBUTE_JOB_LIST (PsAttributeJobList | PS_ATTRIBUTE_INPUT)
3382 #define PS_ATTRIBUTE_CHILD_PROCESS_POLICY (PsAttributeChildProcessPolicy | PS_ATTRIBUTE_INPUT)
3383 #define PS_ATTRIBUTE_ALL_APPLICATION_PACKAGES_POLICY (PsAttributeAllApplicationPackagesPolicy | PS_ATTRIBUTE_INPUT)
3384 #define PS_ATTRIBUTE_WIN32K_FILTER (PsAttributeWin32kFilter | PS_ATTRIBUTE_INPUT)
3385 #define PS_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM (PsAttributeSafeOpenPromptOriginClaim | PS_ATTRIBUTE_INPUT)
3386 #define PS_ATTRIBUTE_BNO_ISOLATION (PsAttributeBnoIsolation | PS_ATTRIBUTE_INPUT)
3387 #define PS_ATTRIBUTE_DESKTOP_APP_POLICY (PsAttributeDesktopAppPolicy | PS_ATTRIBUTE_INPUT)
3388
3389 typedef struct _PS_ATTRIBUTE
3390 {
3391 ULONG_PTR Attribute;
3392 SIZE_T Size;
3393 union
3394 {
3395 ULONG_PTR Value;
3396 void *ValuePtr;
3397 };
3398 SIZE_T *ReturnLength;
3399 } PS_ATTRIBUTE;
3400
3401 typedef struct _PS_ATTRIBUTE_LIST
3402 {
3403 SIZE_T TotalLength;
3404 PS_ATTRIBUTE Attributes[1];
3405 } PS_ATTRIBUTE_LIST, *PPS_ATTRIBUTE_LIST;
3406
3407 typedef enum _PS_CREATE_STATE
3408 {
3409 PsCreateInitialState,
3410 PsCreateFailOnFileOpen,
3411 PsCreateFailOnSectionCreate,
3412 PsCreateFailExeFormat,
3413 PsCreateFailMachineMismatch,
3414 PsCreateFailExeName,
3415 PsCreateSuccess,
3416 PsCreateMaximumStates
3417 } PS_CREATE_STATE;
3418
3419 typedef struct _PS_CREATE_INFO
3420 {
3421 SIZE_T Size;
3422 PS_CREATE_STATE State;
3423 union
3424 {
3425 struct
3426 {
3427 union
3428 {
3429 ULONG InitFlags;
3430 struct
3431 {
3432 UCHAR WriteOutputOnExit : 1;
3433 UCHAR DetectManifest : 1;
3434 UCHAR IFEOSkipDebugger : 1;
3435 UCHAR IFEODoNotPropagateKeyState : 1;
3436 UCHAR SpareBits1 : 4;
3437 UCHAR SpareBits2 : 8;
3438 USHORT ProhibitedImageCharacteristics : 16;
3439 };
3440 };
3441 ACCESS_MASK AdditionalFileAccess;
3442 } InitState;
3443 struct
3444 {
3445 HANDLE FileHandle;
3446 } FailSection;
3447 struct
3448 {
3449 USHORT DllCharacteristics;
3450 } ExeFormat;
3451 struct
3452 {
3453 HANDLE IFEOKey;
3454 } ExeName;
3455 struct
3456 {
3457 union
3458 {
3459 ULONG OutputFlags;
3460 struct
3461 {
3462 UCHAR ProtectedProcess : 1;
3463 UCHAR AddressSpaceOverride : 1;
3464 UCHAR DevOverrideEnabled : 1;
3465 UCHAR ManifestDetected : 1;
3466 UCHAR ProtectedProcessLight : 1;
3467 UCHAR SpareBits1 : 3;
3468 UCHAR SpareBits2 : 8;
3469 USHORT SpareBits3 : 16;
3470 };
3471 };
3472 HANDLE FileHandle;
3473 HANDLE SectionHandle;
3474 ULONGLONG UserProcessParametersNative;
3475 ULONG UserProcessParametersWow64;
3476 ULONG CurrentParameterFlags;
3477 ULONGLONG PebAddressNative;
3478 ULONG PebAddressWow64;
3479 ULONGLONG ManifestAddress;
3480 ULONG ManifestSize;
3481 } SuccessState;
3482 };
3483 } PS_CREATE_INFO, *PPS_CREATE_INFO;
3484
3485 typedef struct _DBGKM_EXCEPTION
3486 {
3487 EXCEPTION_RECORD ExceptionRecord;
3488 ULONG FirstChance;
3489 } DBGKM_EXCEPTION, *PDBGKM_EXCEPTION;
3490
3491 typedef struct _DBGKM_CREATE_THREAD
3492 {
3493 ULONG SubSystemKey;
3494 PVOID StartAddress;
3495 } DBGKM_CREATE_THREAD, *PDBGKM_CREATE_THREAD;
3496
3497 typedef struct _DBGKM_CREATE_PROCESS
3498 {
3499 ULONG SubSystemKey;
3500 HANDLE FileHandle;
3501 PVOID BaseOfImage;
3502 ULONG DebugInfoFileOffset;
3503 ULONG DebugInfoSize;
3504 DBGKM_CREATE_THREAD InitialThread;
3505 } DBGKM_CREATE_PROCESS, *PDBGKM_CREATE_PROCESS;
3506
3507 typedef struct _DBGKM_EXIT_THREAD
3508 {
3509 NTSTATUS ExitStatus;
3510 } DBGKM_EXIT_THREAD, *PDBGKM_EXIT_THREAD;
3511
3512 typedef struct _DBGKM_EXIT_PROCESS
3513 {
3514 NTSTATUS ExitStatus;
3515 } DBGKM_EXIT_PROCESS, *PDBGKM_EXIT_PROCESS;
3516
3517 typedef struct _DBGKM_LOAD_DLL
3518 {
3519 HANDLE FileHandle;
3520 PVOID BaseOfDll;
3521 ULONG DebugInfoFileOffset;
3522 ULONG DebugInfoSize;
3523 PVOID NamePointer;
3524 } DBGKM_LOAD_DLL, *PDBGKM_LOAD_DLL;
3525
3526 typedef struct _DBGKM_UNLOAD_DLL
3527 {
3528 PVOID BaseAddress;
3529 } DBGKM_UNLOAD_DLL, *PDBGKM_UNLOAD_DLL;
3530
3531 typedef enum _DBG_STATE
3532 {
3533 DbgIdle,
3534 DbgReplyPending,
3535 DbgCreateThreadStateChange,
3536 DbgCreateProcessStateChange,
3537 DbgExitThreadStateChange,
3538 DbgExitProcessStateChange,
3539 DbgExceptionStateChange,
3540 DbgBreakpointStateChange,
3541 DbgSingleStepStateChange,
3542 DbgLoadDllStateChange,
3543 DbgUnloadDllStateChange
3544 } DBG_STATE, *PDBG_STATE;
3545
3546 typedef struct _DBGUI_CREATE_THREAD
3547 {
3548 HANDLE HandleToThread;
3549 DBGKM_CREATE_THREAD NewThread;
3550 } DBGUI_CREATE_THREAD, *PDBGUI_CREATE_THREAD;
3551
3552 typedef struct _DBGUI_CREATE_PROCESS
3553 {
3554 HANDLE HandleToProcess;
3555 HANDLE HandleToThread;
3556 DBGKM_CREATE_PROCESS NewProcess;
3557 } DBGUI_CREATE_PROCESS, *PDBGUI_CREATE_PROCESS;
3558
3559 typedef struct _DBGUI_WAIT_STATE_CHANGE
3560 {
3561 DBG_STATE NewState;
3562 CLIENT_ID AppClientId;
3563 union
3564 {
3565 DBGKM_EXCEPTION Exception;
3566 DBGUI_CREATE_THREAD CreateThread;
3567 DBGUI_CREATE_PROCESS CreateProcessInfo;
3568 DBGKM_EXIT_THREAD ExitThread;
3569 DBGKM_EXIT_PROCESS ExitProcess;
3570 DBGKM_LOAD_DLL LoadDll;
3571 DBGKM_UNLOAD_DLL UnloadDll;
3572 } StateInfo;
3573 } DBGUI_WAIT_STATE_CHANGE, *PDBGUI_WAIT_STATE_CHANGE;
3574
3575 struct _DEBUG_EVENT;
3576
3577 #define DEBUG_READ_EVENT 0x0001
3578 #define DEBUG_PROCESS_ASSIGN 0x0002
3579 #define DEBUG_SET_INFORMATION 0x0004
3580 #define DEBUG_QUERY_INFORMATION 0x0008
3581 #define DEBUG_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x0f)
3582
3583 #define DEBUG_KILL_ON_CLOSE 0x1
3584
3585 typedef enum _DEBUGOBJECTINFOCLASS
3586 {
3587 DebugObjectKillProcessOnExitInformation = 1,
3588 MaxDebugObjectInfoClass
3589 } DEBUGOBJECTINFOCLASS, *PDEBUGOBJECTINFOCLASS;
3590
3591 /***********************************************************************
3592 * Function declarations
3593 */
3594
3595 NTSYSAPI void WINAPI DbgBreakPoint(void);
3596 NTSYSAPI NTSTATUS WINAPIV DbgPrint(LPCSTR fmt, ...);
3597 NTSYSAPI NTSTATUS WINAPIV DbgPrintEx(ULONG iComponentId, ULONG Level, LPCSTR fmt, ...);
3598 NTSYSAPI NTSTATUS WINAPI DbgUiConnectToDbg(void);
3599 NTSYSAPI NTSTATUS WINAPI DbgUiContinue(CLIENT_ID*,NTSTATUS);
3600 NTSYSAPI NTSTATUS WINAPI DbgUiConvertStateChangeStructure(DBGUI_WAIT_STATE_CHANGE*,struct _DEBUG_EVENT*);
3601 NTSYSAPI NTSTATUS WINAPI DbgUiDebugActiveProcess(HANDLE);
3602 NTSYSAPI HANDLE WINAPI DbgUiGetThreadDebugObject(void);
3603 NTSYSAPI NTSTATUS WINAPI DbgUiIssueRemoteBreakin(HANDLE);
3604 NTSYSAPI void WINAPI DbgUiRemoteBreakin(void*);
3605 NTSYSAPI void WINAPI DbgUiSetThreadDebugObject(HANDLE);
3606 NTSYSAPI NTSTATUS WINAPI DbgUiStopDebugging(HANDLE);
3607 NTSYSAPI NTSTATUS WINAPI DbgUiWaitStateChange(DBGUI_WAIT_STATE_CHANGE*,LARGE_INTEGER*);
3608 NTSYSAPI void WINAPI DbgUserBreakPoint(void);
3609 NTSYSAPI NTSTATUS WINAPI LdrAccessResource(HMODULE,const IMAGE_RESOURCE_DATA_ENTRY*,void**,PULONG);
3610 NTSYSAPI NTSTATUS WINAPI LdrAddDllDirectory(const UNICODE_STRING*,void**);
3611 NTSYSAPI NTSTATUS WINAPI LdrAddRefDll(ULONG,HMODULE);
3612 NTSYSAPI NTSTATUS WINAPI LdrDisableThreadCalloutsForDll(HMODULE);
3613 NTSYSAPI NTSTATUS WINAPI LdrFindEntryForAddress(const void*, PLDR_DATA_TABLE_ENTRY*);
3614 NTSYSAPI NTSTATUS WINAPI LdrFindResourceDirectory_U(HMODULE,const LDR_RESOURCE_INFO*,ULONG,const IMAGE_RESOURCE_DIRECTORY**);
3615 NTSYSAPI NTSTATUS WINAPI LdrFindResource_U(HMODULE,const LDR_RESOURCE_INFO*,ULONG,const IMAGE_RESOURCE_DATA_ENTRY**);
3616 NTSYSAPI NTSTATUS WINAPI LdrGetDllDirectory(UNICODE_STRING*);
3617 NTSYSAPI NTSTATUS WINAPI LdrGetDllHandle(LPCWSTR, ULONG, const UNICODE_STRING*, HMODULE*);
3618 NTSYSAPI NTSTATUS WINAPI LdrGetDllPath(PCWSTR,ULONG,PWSTR*,PWSTR*);
3619 NTSYSAPI NTSTATUS WINAPI LdrGetProcedureAddress(HMODULE, const ANSI_STRING*, ULONG, void**);
3620 NTSYSAPI NTSTATUS WINAPI LdrLoadDll(LPCWSTR, DWORD, const UNICODE_STRING*, HMODULE*);
3621 NTSYSAPI NTSTATUS WINAPI LdrLockLoaderLock(ULONG,ULONG*,ULONG_PTR*);
3622 IMAGE_BASE_RELOCATION * WINAPI LdrProcessRelocationBlock(void*,UINT,USHORT*,INT_PTR);
3623 NTSYSAPI NTSTATUS WINAPI LdrQueryImageFileExecutionOptions(const UNICODE_STRING*,LPCWSTR,ULONG,void*,ULONG,ULONG*);
3624 NTSYSAPI NTSTATUS WINAPI LdrQueryProcessModuleInformation(SYSTEM_MODULE_INFORMATION*, ULONG, ULONG*);
3625 NTSYSAPI NTSTATUS WINAPI LdrRegisterDllNotification(ULONG,PLDR_DLL_NOTIFICATION_FUNCTION,void*,void**);
3626 NTSYSAPI NTSTATUS WINAPI LdrRemoveDllDirectory(void*);
3627 NTSYSAPI NTSTATUS WINAPI LdrSetDefaultDllDirectories(ULONG);
3628 NTSYSAPI NTSTATUS WINAPI LdrSetDllDirectory(const UNICODE_STRING*);
3629 NTSYSAPI void WINAPI LdrShutdownProcess(void);
3630 NTSYSAPI void WINAPI LdrShutdownThread(void);
3631 NTSYSAPI NTSTATUS WINAPI LdrUnloadDll(HMODULE);
3632 NTSYSAPI NTSTATUS WINAPI LdrUnlockLoaderLock(ULONG,ULONG_PTR);
3633 NTSYSAPI NTSTATUS WINAPI LdrUnregisterDllNotification(void*);
3634 NTSYSAPI NTSTATUS WINAPI NtAcceptConnectPort(PHANDLE,ULONG,PLPC_MESSAGE,BOOLEAN,PLPC_SECTION_WRITE,PLPC_SECTION_READ);
3635 NTSYSAPI NTSTATUS WINAPI NtAccessCheck(PSECURITY_DESCRIPTOR,HANDLE,ACCESS_MASK,PGENERIC_MAPPING,PPRIVILEGE_SET,PULONG,PULONG,NTSTATUS*);
3636 NTSYSAPI NTSTATUS WINAPI NtAccessCheckAndAuditAlarm(PUNICODE_STRING,HANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,ACCESS_MASK,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PBOOLEAN,PBOOLEAN);
3637 NTSYSAPI NTSTATUS WINAPI NtAddAtom(const WCHAR*,ULONG,RTL_ATOM*);
3638 NTSYSAPI NTSTATUS WINAPI NtAdjustGroupsToken(HANDLE,BOOLEAN,PTOKEN_GROUPS,ULONG,PTOKEN_GROUPS,PULONG);
3639 NTSYSAPI NTSTATUS WINAPI NtAdjustPrivilegesToken(HANDLE,BOOLEAN,PTOKEN_PRIVILEGES,DWORD,PTOKEN_PRIVILEGES,PDWORD);
3640 NTSYSAPI NTSTATUS WINAPI NtAlertResumeThread(HANDLE,PULONG);
3641 NTSYSAPI NTSTATUS WINAPI NtAlertThread(HANDLE ThreadHandle);
3642 NTSYSAPI NTSTATUS WINAPI NtAllocateLocallyUniqueId(PLUID lpLuid);
3643 NTSYSAPI NTSTATUS WINAPI NtAllocateUuids(PULARGE_INTEGER,PULONG,PULONG,PUCHAR);
3644 NTSYSAPI NTSTATUS WINAPI NtAllocateVirtualMemory(HANDLE,PVOID*,ULONG_PTR,SIZE_T*,ULONG,ULONG);
3645 NTSYSAPI NTSTATUS WINAPI NtAllocateVirtualMemoryEx(HANDLE,PVOID*,SIZE_T*,ULONG,ULONG,MEM_EXTENDED_PARAMETER*,ULONG);
3646 NTSYSAPI NTSTATUS WINAPI NtAreMappedFilesTheSame(PVOID,PVOID);
3647 NTSYSAPI NTSTATUS WINAPI NtAssignProcessToJobObject(HANDLE,HANDLE);
3648 NTSYSAPI NTSTATUS WINAPI NtCallbackReturn(PVOID,ULONG,NTSTATUS);
3649 NTSYSAPI NTSTATUS WINAPI NtCancelIoFile(HANDLE,PIO_STATUS_BLOCK);
3650 NTSYSAPI NTSTATUS WINAPI NtCancelIoFileEx(HANDLE,PIO_STATUS_BLOCK,PIO_STATUS_BLOCK);
3651 NTSYSAPI NTSTATUS WINAPI NtCancelTimer(HANDLE, BOOLEAN*);
3652 NTSYSAPI NTSTATUS WINAPI NtClearEvent(HANDLE);
3653 NTSYSAPI NTSTATUS WINAPI NtClearPowerRequest(HANDLE,POWER_REQUEST_TYPE);
3654 NTSYSAPI NTSTATUS WINAPI NtClose(HANDLE);
3655 NTSYSAPI NTSTATUS WINAPI NtCloseObjectAuditAlarm(PUNICODE_STRING,HANDLE,BOOLEAN);
3656 NTSYSAPI NTSTATUS WINAPI NtCompleteConnectPort(HANDLE);
3657 NTSYSAPI NTSTATUS WINAPI NtConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
3658 NTSYSAPI NTSTATUS WINAPI NtContinue(PCONTEXT,BOOLEAN);
3659 NTSYSAPI NTSTATUS WINAPI NtCreateDebugObject(HANDLE*,ACCESS_MASK,OBJECT_ATTRIBUTES*,ULONG);
3660 NTSYSAPI NTSTATUS WINAPI NtCreateDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
3661 NTSYSAPI NTSTATUS WINAPI NtCreateEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *,EVENT_TYPE,BOOLEAN);
3662 NTSYSAPI NTSTATUS WINAPI NtCreateEventPair(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
3663 NTSYSAPI NTSTATUS WINAPI NtCreateFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG);
3664 NTSYSAPI NTSTATUS WINAPI NtCreateIoCompletion(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,ULONG);
3665 NTSYSAPI NTSTATUS WINAPI NtCreateJobObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3666 NTSYSAPI NTSTATUS WINAPI NtCreateKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,PULONG);
3667 NTSYSAPI NTSTATUS WINAPI NtCreateKeyTransacted(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,HANDLE,ULONG*);
3668 NTSYSAPI NTSTATUS WINAPI NtCreateKeyedEvent(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG);
3669 NTSYSAPI NTSTATUS WINAPI NtCreateMailslotFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG,ULONG,PLARGE_INTEGER);
3670 NTSYSAPI NTSTATUS WINAPI NtCreateMutant(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,BOOLEAN);
3671 NTSYSAPI NTSTATUS WINAPI NtCreateNamedPipeFile(PHANDLE,ULONG,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,PLARGE_INTEGER);
3672 NTSYSAPI NTSTATUS WINAPI NtCreatePagingFile(PUNICODE_STRING,PLARGE_INTEGER,PLARGE_INTEGER,PLARGE_INTEGER);
3673 NTSYSAPI NTSTATUS WINAPI NtCreatePort(PHANDLE,POBJECT_ATTRIBUTES,ULONG,ULONG,PULONG);
3674 NTSYSAPI NTSTATUS WINAPI NtCreatePowerRequest(HANDLE*,COUNTED_REASON_CONTEXT*);
3675 NTSYSAPI NTSTATUS WINAPI NtCreateProcess(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,HANDLE,BOOLEAN,HANDLE,HANDLE,HANDLE);
3676 NTSYSAPI NTSTATUS WINAPI NtCreateProfile(PHANDLE,HANDLE,PVOID,ULONG,ULONG,PVOID,ULONG,KPROFILE_SOURCE,KAFFINITY);
3677 NTSYSAPI NTSTATUS WINAPI NtCreateSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const LARGE_INTEGER*,ULONG,ULONG,HANDLE);
3678 NTSYSAPI NTSTATUS WINAPI NtCreateSemaphore(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,LONG,LONG);
3679 NTSYSAPI NTSTATUS WINAPI NtCreateSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PUNICODE_STRING);
3680 NTSYSAPI NTSTATUS WINAPI NtCreateThread(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,HANDLE,PCLIENT_ID,PCONTEXT,PINITIAL_TEB,BOOLEAN);
3681 NTSYSAPI NTSTATUS WINAPI NtCreateThreadEx(HANDLE*,ACCESS_MASK,OBJECT_ATTRIBUTES*,HANDLE,PRTL_THREAD_START_ROUTINE,void*,ULONG,SIZE_T,SIZE_T,SIZE_T,PS_ATTRIBUTE_LIST*);
3682 NTSYSAPI NTSTATUS WINAPI NtCreateTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*, TIMER_TYPE);
3683 NTSYSAPI NTSTATUS WINAPI NtCreateToken(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,TOKEN_TYPE,PLUID,PLARGE_INTEGER,PTOKEN_USER,PTOKEN_GROUPS,PTOKEN_PRIVILEGES,PTOKEN_OWNER,PTOKEN_PRIMARY_GROUP,PTOKEN_DEFAULT_DACL,PTOKEN_SOURCE);
3684 NTSYSAPI NTSTATUS WINAPI NtCreateUserProcess(HANDLE*,HANDLE*,ACCESS_MASK,ACCESS_MASK,OBJECT_ATTRIBUTES*,OBJECT_ATTRIBUTES*,ULONG,ULONG,RTL_USER_PROCESS_PARAMETERS*,PS_CREATE_INFO*,PS_ATTRIBUTE_LIST*);
3685 NTSYSAPI NTSTATUS WINAPI NtDebugActiveProcess(HANDLE,HANDLE);
3686 NTSYSAPI NTSTATUS WINAPI NtDebugContinue(HANDLE,CLIENT_ID*,NTSTATUS);
3687 NTSYSAPI NTSTATUS WINAPI NtDelayExecution(BOOLEAN,const LARGE_INTEGER*);
3688 NTSYSAPI NTSTATUS WINAPI NtDeleteAtom(RTL_ATOM);
3689 NTSYSAPI NTSTATUS WINAPI NtDeleteFile(POBJECT_ATTRIBUTES);
3690 NTSYSAPI NTSTATUS WINAPI NtDeleteKey(HANDLE);
3691 NTSYSAPI NTSTATUS WINAPI NtDeleteValueKey(HANDLE,const UNICODE_STRING *);
3692 NTSYSAPI NTSTATUS WINAPI NtDeviceIoControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
3693 NTSYSAPI NTSTATUS WINAPI NtDisplayString(PUNICODE_STRING);
3694 NTSYSAPI NTSTATUS WINAPI NtDuplicateObject(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,ULONG,ULONG);
3695 NTSYSAPI NTSTATUS WINAPI NtDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
3696 NTSYSAPI NTSTATUS WINAPI NtEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
3697 NTSYSAPI NTSTATUS WINAPI NtEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3698 NTSYSAPI NTSTATUS WINAPI NtExtendSection(HANDLE,PLARGE_INTEGER);
3699 NTSYSAPI NTSTATUS WINAPI NtFilterToken(HANDLE,ULONG,TOKEN_GROUPS*,TOKEN_PRIVILEGES*,TOKEN_GROUPS*,HANDLE*);
3700 NTSYSAPI NTSTATUS WINAPI NtFindAtom(const WCHAR*,ULONG,RTL_ATOM*);
3701 NTSYSAPI NTSTATUS WINAPI NtFlushBuffersFile(HANDLE,IO_STATUS_BLOCK*);
3702 NTSYSAPI NTSTATUS WINAPI NtFlushInstructionCache(HANDLE,LPCVOID,SIZE_T);
3703 NTSYSAPI NTSTATUS WINAPI NtFlushKey(HANDLE);
3704 NTSYSAPI void WINAPI NtFlushProcessWriteBuffers(void);
3705 NTSYSAPI NTSTATUS WINAPI NtFlushVirtualMemory(HANDLE,LPCVOID*,SIZE_T*,ULONG);
3706 NTSYSAPI NTSTATUS WINAPI NtFlushWriteBuffer(VOID);
3707 NTSYSAPI NTSTATUS WINAPI NtFreeVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
3708 NTSYSAPI NTSTATUS WINAPI NtFsControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
3709 NTSYSAPI NTSTATUS WINAPI NtGetContextThread(HANDLE,CONTEXT*);
3710 NTSYSAPI ULONG WINAPI NtGetCurrentProcessorNumber(void);
3711 NTSYSAPI NTSTATUS WINAPI NtGetNlsSectionPtr(ULONG,ULONG,void*,void**,SIZE_T*);
3712 NTSYSAPI NTSTATUS WINAPI NtGetPlugPlayEvent(ULONG,ULONG,PVOID,ULONG);
3713 NTSYSAPI ULONG WINAPI NtGetTickCount(VOID);
3714 NTSYSAPI NTSTATUS WINAPI NtGetWriteWatch(HANDLE,ULONG,PVOID,SIZE_T,PVOID*,ULONG_PTR*,ULONG*);
3715 NTSYSAPI NTSTATUS WINAPI NtImpersonateAnonymousToken(HANDLE);
3716 NTSYSAPI NTSTATUS WINAPI NtImpersonateClientOfPort(HANDLE,PPORT_MESSAGE);
3717 NTSYSAPI NTSTATUS WINAPI NtImpersonateThread(HANDLE,HANDLE,PSECURITY_QUALITY_OF_SERVICE);
3718 NTSYSAPI NTSTATUS WINAPI NtInitializeRegistry(BOOLEAN);
3719 NTSYSAPI NTSTATUS WINAPI NtInitiatePowerAction(POWER_ACTION,SYSTEM_POWER_STATE,ULONG,BOOLEAN);
3720 NTSYSAPI NTSTATUS WINAPI NtIsProcessInJob(HANDLE,HANDLE);
3721 NTSYSAPI NTSTATUS WINAPI NtListenPort(HANDLE,PLPC_MESSAGE);
3722 NTSYSAPI NTSTATUS WINAPI NtLoadDriver(const UNICODE_STRING *);
3723 NTSYSAPI NTSTATUS WINAPI NtLoadKey(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *);
3724 NTSYSAPI NTSTATUS WINAPI NtLockFile(HANDLE,HANDLE,PIO_APC_ROUTINE,void*,PIO_STATUS_BLOCK,PLARGE_INTEGER,PLARGE_INTEGER,ULONG*,BOOLEAN,BOOLEAN);
3725 NTSYSAPI NTSTATUS WINAPI NtLockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
3726 NTSYSAPI NTSTATUS WINAPI NtMakeTemporaryObject(HANDLE);
3727 NTSYSAPI NTSTATUS WINAPI NtMapViewOfSection(HANDLE,HANDLE,PVOID*,ULONG_PTR,SIZE_T,const LARGE_INTEGER*,SIZE_T*,SECTION_INHERIT,ULONG,ULONG);
3728 NTSYSAPI NTSTATUS WINAPI NtNotifyChangeDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,ULONG,BOOLEAN);
3729 NTSYSAPI NTSTATUS WINAPI NtNotifyChangeKey(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
3730 NTSYSAPI NTSTATUS WINAPI NtNotifyChangeMultipleKeys(HANDLE,ULONG,OBJECT_ATTRIBUTES*,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
3731 NTSYSAPI NTSTATUS WINAPI NtOpenDirectoryObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3732 NTSYSAPI NTSTATUS WINAPI NtOpenEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
3733 NTSYSAPI NTSTATUS WINAPI NtOpenEventPair(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3734 NTSYSAPI NTSTATUS WINAPI NtOpenFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG);
3735 NTSYSAPI NTSTATUS WINAPI NtOpenIoCompletion(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3736 NTSYSAPI NTSTATUS WINAPI NtOpenJobObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3737 NTSYSAPI NTSTATUS WINAPI NtOpenKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
3738 NTSYSAPI NTSTATUS WINAPI NtOpenKeyEx(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG);
3739 NTSYSAPI NTSTATUS WINAPI NtOpenKeyTransacted(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,HANDLE);
3740 NTSYSAPI NTSTATUS WINAPI NtOpenKeyTransactedEx(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,HANDLE);
3741 NTSYSAPI NTSTATUS WINAPI NtOpenKeyedEvent(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3742 NTSYSAPI NTSTATUS WINAPI NtOpenMutant(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3743 NTSYSAPI NTSTATUS WINAPI NtOpenObjectAuditAlarm(PUNICODE_STRING,PHANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,HANDLE,ACCESS_MASK,ACCESS_MASK,PPRIVILEGE_SET,BOOLEAN,BOOLEAN,PBOOLEAN);
3744 NTSYSAPI NTSTATUS WINAPI NtOpenProcess(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
3745 NTSYSAPI NTSTATUS WINAPI NtOpenProcessToken(HANDLE,DWORD,HANDLE *);
3746 NTSYSAPI NTSTATUS WINAPI NtOpenProcessTokenEx(HANDLE,DWORD,DWORD,HANDLE *);
3747 NTSYSAPI NTSTATUS WINAPI NtOpenSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3748 NTSYSAPI NTSTATUS WINAPI NtOpenSemaphore(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3749 NTSYSAPI NTSTATUS WINAPI NtOpenSymbolicLinkObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3750 NTSYSAPI NTSTATUS WINAPI NtOpenThread(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
3751 NTSYSAPI NTSTATUS WINAPI NtOpenThreadToken(HANDLE,DWORD,BOOLEAN,HANDLE *);
3752 NTSYSAPI NTSTATUS WINAPI NtOpenThreadTokenEx(HANDLE,DWORD,BOOLEAN,DWORD,HANDLE *);
3753 NTSYSAPI NTSTATUS WINAPI NtOpenTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*);
3754 NTSYSAPI NTSTATUS WINAPI NtPowerInformation(POWER_INFORMATION_LEVEL,PVOID,ULONG,PVOID,ULONG);
3755 NTSYSAPI NTSTATUS WINAPI NtPrivilegeCheck(HANDLE,PPRIVILEGE_SET,PBOOLEAN);
3756 NTSYSAPI NTSTATUS WINAPI NtPrivilegeObjectAuditAlarm(PUNICODE_STRING,HANDLE,HANDLE,ULONG,PPRIVILEGE_SET,BOOLEAN);
3757 NTSYSAPI NTSTATUS WINAPI NtPrivilegedServiceAuditAlarm(PUNICODE_STRING,PUNICODE_STRING,HANDLE,PPRIVILEGE_SET,BOOLEAN);
3758 NTSYSAPI NTSTATUS WINAPI NtProtectVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG,ULONG*);
3759 NTSYSAPI NTSTATUS WINAPI NtPulseEvent(HANDLE,LONG*);
3760 NTSYSAPI NTSTATUS WINAPI NtQueueApcThread(HANDLE,PNTAPCFUNC,ULONG_PTR,ULONG_PTR,ULONG_PTR);
3761 NTSYSAPI NTSTATUS WINAPI NtQueryAttributesFile(const OBJECT_ATTRIBUTES*,FILE_BASIC_INFORMATION*);
3762 NTSYSAPI NTSTATUS WINAPI NtQueryDefaultLocale(BOOLEAN,LCID*);
3763 NTSYSAPI NTSTATUS WINAPI NtQueryDefaultUILanguage(LANGID*);
3764 NTSYSAPI NTSTATUS WINAPI NtQueryDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS,BOOLEAN,PUNICODE_STRING,BOOLEAN);
3765 NTSYSAPI NTSTATUS WINAPI NtQueryDirectoryObject(HANDLE,PDIRECTORY_BASIC_INFORMATION,ULONG,BOOLEAN,BOOLEAN,PULONG,PULONG);
3766 NTSYSAPI NTSTATUS WINAPI NtQueryEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,BOOLEAN,PVOID,ULONG,PULONG,BOOLEAN);
3767 NTSYSAPI NTSTATUS WINAPI NtQueryEvent(HANDLE,EVENT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3768 NTSYSAPI NTSTATUS WINAPI NtQueryFullAttributesFile(const OBJECT_ATTRIBUTES*,FILE_NETWORK_OPEN_INFORMATION*);
3769 NTSYSAPI NTSTATUS WINAPI NtQueryInformationAtom(RTL_ATOM,ATOM_INFORMATION_CLASS,PVOID,ULONG,ULONG*);
3770 NTSYSAPI NTSTATUS WINAPI NtQueryInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,LONG,FILE_INFORMATION_CLASS);
3771 NTSYSAPI NTSTATUS WINAPI NtQueryInformationJobObject(HANDLE,JOBOBJECTINFOCLASS,PVOID,ULONG,PULONG);
3772 NTSYSAPI NTSTATUS WINAPI NtQueryInformationPort(HANDLE,PORT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3773 NTSYSAPI NTSTATUS WINAPI NtQueryInformationProcess(HANDLE,PROCESSINFOCLASS,PVOID,ULONG,PULONG);
3774 NTSYSAPI NTSTATUS WINAPI NtQueryInformationThread(HANDLE,THREADINFOCLASS,PVOID,ULONG,PULONG);
3775 NTSYSAPI NTSTATUS WINAPI NtQueryInformationToken(HANDLE,TOKEN_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3776 NTSYSAPI NTSTATUS WINAPI NtQueryInstallUILanguage(LANGID*);
3777 NTSYSAPI NTSTATUS WINAPI NtQueryIntervalProfile(KPROFILE_SOURCE,PULONG);
3778 NTSYSAPI NTSTATUS WINAPI NtQueryIoCompletion(HANDLE,IO_COMPLETION_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3779 NTSYSAPI NTSTATUS WINAPI NtQueryKey(HANDLE,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
3780 NTSYSAPI NTSTATUS WINAPI NtQueryMultipleValueKey(HANDLE,PKEY_MULTIPLE_VALUE_INFORMATION,ULONG,PVOID,ULONG,PULONG);
3781 NTSYSAPI NTSTATUS WINAPI NtQueryMutant(HANDLE,MUTANT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3782 NTSYSAPI NTSTATUS WINAPI NtQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
3783 NTSYSAPI NTSTATUS WINAPI NtQueryOpenSubKeys(POBJECT_ATTRIBUTES,PULONG);
3784 NTSYSAPI NTSTATUS WINAPI NtQueryPerformanceCounter(PLARGE_INTEGER, PLARGE_INTEGER);
3785 NTSYSAPI NTSTATUS WINAPI NtQuerySecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR,ULONG,PULONG);
3786 NTSYSAPI NTSTATUS WINAPI NtQuerySection(HANDLE,SECTION_INFORMATION_CLASS,PVOID,SIZE_T,SIZE_T*);
3787 NTSYSAPI NTSTATUS WINAPI NtQuerySemaphore(HANDLE,SEMAPHORE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3788 NTSYSAPI NTSTATUS WINAPI NtQuerySymbolicLinkObject(HANDLE,PUNICODE_STRING,PULONG);
3789 NTSYSAPI NTSTATUS WINAPI NtQuerySystemEnvironmentValue(PUNICODE_STRING,PWCHAR,ULONG,PULONG);
3790 NTSYSAPI NTSTATUS WINAPI NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3791 NTSYSAPI NTSTATUS WINAPI NtQuerySystemInformationEx(SYSTEM_INFORMATION_CLASS,void*,ULONG,void*,ULONG,ULONG*);
3792 NTSYSAPI NTSTATUS WINAPI NtQuerySystemTime(PLARGE_INTEGER);
3793 NTSYSAPI NTSTATUS WINAPI NtQueryTimer(HANDLE,TIMER_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3794 NTSYSAPI NTSTATUS WINAPI NtQueryTimerResolution(PULONG,PULONG,PULONG);
3795 NTSYSAPI NTSTATUS WINAPI NtQueryValueKey(HANDLE,const UNICODE_STRING *,KEY_VALUE_INFORMATION_CLASS,void *,DWORD,DWORD *);
3796 NTSYSAPI NTSTATUS WINAPI NtQueryLicenseValue(const UNICODE_STRING *,ULONG *,PVOID,ULONG,ULONG *);
3797 NTSYSAPI NTSTATUS WINAPI NtQueryVirtualMemory(HANDLE,LPCVOID,MEMORY_INFORMATION_CLASS,PVOID,SIZE_T,SIZE_T*);
3798 NTSYSAPI NTSTATUS WINAPI NtQueryVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
3799 NTSYSAPI NTSTATUS WINAPI NtRaiseException(PEXCEPTION_RECORD,PCONTEXT,BOOL);
3800 NTSYSAPI NTSTATUS WINAPI NtRaiseHardError(NTSTATUS,ULONG,PUNICODE_STRING,PVOID*,HARDERROR_RESPONSE_OPTION,PHARDERROR_RESPONSE);
3801 NTSYSAPI NTSTATUS WINAPI NtReadFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG);
3802 NTSYSAPI NTSTATUS WINAPI NtReadFileScatter(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,FILE_SEGMENT_ELEMENT*,ULONG,PLARGE_INTEGER,PULONG);
3803 NTSYSAPI NTSTATUS WINAPI NtReadRequestData(HANDLE,PLPC_MESSAGE,ULONG,PVOID,ULONG,PULONG);
3804 NTSYSAPI NTSTATUS WINAPI NtReadVirtualMemory(HANDLE,const void*,void*,SIZE_T,SIZE_T*);
3805 NTSYSAPI NTSTATUS WINAPI NtRegisterThreadTerminatePort(HANDLE);
3806 NTSYSAPI NTSTATUS WINAPI NtReleaseKeyedEvent(HANDLE,const void*,BOOLEAN,const LARGE_INTEGER*);
3807 NTSYSAPI NTSTATUS WINAPI NtReleaseMutant(HANDLE,PLONG);
3808 NTSYSAPI NTSTATUS WINAPI NtReleaseSemaphore(HANDLE,ULONG,PULONG);
3809 NTSYSAPI NTSTATUS WINAPI NtRemoveIoCompletion(HANDLE,PULONG_PTR,PULONG_PTR,PIO_STATUS_BLOCK,PLARGE_INTEGER);
3810 NTSYSAPI NTSTATUS WINAPI NtRemoveIoCompletionEx(HANDLE,FILE_IO_COMPLETION_INFORMATION*,ULONG,ULONG*,LARGE_INTEGER*,BOOLEAN);
3811 NTSYSAPI NTSTATUS WINAPI NtRemoveProcessDebug(HANDLE,HANDLE);
3812 NTSYSAPI NTSTATUS WINAPI NtRenameKey(HANDLE,UNICODE_STRING*);
3813 NTSYSAPI NTSTATUS WINAPI NtReplaceKey(POBJECT_ATTRIBUTES,HANDLE,POBJECT_ATTRIBUTES);
3814 NTSYSAPI NTSTATUS WINAPI NtReplyPort(HANDLE,PLPC_MESSAGE);
3815 NTSYSAPI NTSTATUS WINAPI NtReplyWaitReceivePort(HANDLE,PULONG,PLPC_MESSAGE,PLPC_MESSAGE);
3816 NTSYSAPI NTSTATUS WINAPI NtReplyWaitReceivePortEx(HANDLE,PVOID*,PPORT_MESSAGE,PPORT_MESSAGE,PLARGE_INTEGER);
3817 NTSYSAPI NTSTATUS WINAPI NtReplyWaitReplyPort(HANDLE,PLPC_MESSAGE);
3818 NTSYSAPI NTSTATUS WINAPI NtRequestPort(HANDLE,PLPC_MESSAGE);
3819 NTSYSAPI NTSTATUS WINAPI NtRequestWaitReplyPort(HANDLE,PLPC_MESSAGE,PLPC_MESSAGE);
3820 NTSYSAPI NTSTATUS WINAPI NtResetEvent(HANDLE,LONG*);
3821 NTSYSAPI NTSTATUS WINAPI NtResetWriteWatch(HANDLE,PVOID,SIZE_T);
3822 NTSYSAPI NTSTATUS WINAPI NtRestoreKey(HANDLE,HANDLE,ULONG);
3823 NTSYSAPI NTSTATUS WINAPI NtResumeProcess(HANDLE);
3824 NTSYSAPI NTSTATUS WINAPI NtResumeThread(HANDLE,PULONG);
3825 NTSYSAPI NTSTATUS WINAPI NtSaveKey(HANDLE,HANDLE);
3826 NTSYSAPI NTSTATUS WINAPI NtSecureConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PSID,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
3827 NTSYSAPI NTSTATUS WINAPI NtSetContextThread(HANDLE,const CONTEXT*);
3828 NTSYSAPI NTSTATUS WINAPI NtSetDefaultHardErrorPort(HANDLE);
3829 NTSYSAPI NTSTATUS WINAPI NtSetDefaultLocale(BOOLEAN,LCID);
3830 NTSYSAPI NTSTATUS WINAPI NtSetDefaultUILanguage(LANGID);
3831 NTSYSAPI NTSTATUS WINAPI NtSetEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG);
3832 NTSYSAPI NTSTATUS WINAPI NtSetEvent(HANDLE,LONG*);
3833 NTSYSAPI NTSTATUS WINAPI NtSetHighEventPair(HANDLE);
3834 NTSYSAPI NTSTATUS WINAPI NtSetHighWaitLowEventPair(HANDLE);
3835 NTSYSAPI NTSTATUS WINAPI NtSetHighWaitLowThread(VOID);
3836 NTSYSAPI NTSTATUS WINAPI NtSetInformationDebugObject(HANDLE,DEBUGOBJECTINFOCLASS,PVOID,ULONG,ULONG*);
3837 NTSYSAPI NTSTATUS WINAPI NtSetInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS);
3838 NTSYSAPI NTSTATUS WINAPI NtSetInformationJobObject(HANDLE,JOBOBJECTINFOCLASS,PVOID,ULONG);
3839 NTSYSAPI NTSTATUS WINAPI NtSetInformationKey(HANDLE,const int,PVOID,ULONG);
3840 NTSYSAPI NTSTATUS WINAPI NtSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG);
3841 NTSYSAPI NTSTATUS WINAPI NtSetInformationProcess(HANDLE,PROCESS_INFORMATION_CLASS,PVOID,ULONG);
3842 NTSYSAPI NTSTATUS WINAPI NtSetInformationThread(HANDLE,THREADINFOCLASS,LPCVOID,ULONG);
3843 NTSYSAPI NTSTATUS WINAPI NtSetInformationToken(HANDLE,TOKEN_INFORMATION_CLASS,PVOID,ULONG);
3844 NTSYSAPI NTSTATUS WINAPI NtSetIntervalProfile(ULONG,KPROFILE_SOURCE);
3845 NTSYSAPI NTSTATUS WINAPI NtSetIoCompletion(HANDLE,ULONG_PTR,ULONG_PTR,NTSTATUS,SIZE_T);
3846 NTSYSAPI NTSTATUS WINAPI NtSetLdtEntries(ULONG,LDT_ENTRY,ULONG,LDT_ENTRY);
3847 NTSYSAPI NTSTATUS WINAPI NtSetLowEventPair(HANDLE);
3848 NTSYSAPI NTSTATUS WINAPI NtSetLowWaitHighEventPair(HANDLE);
3849 NTSYSAPI NTSTATUS WINAPI NtSetLowWaitHighThread(VOID);
3850 NTSYSAPI NTSTATUS WINAPI NtSetPowerRequest(HANDLE,POWER_REQUEST_TYPE);
3851 NTSYSAPI NTSTATUS WINAPI NtSetSecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR);
3852 NTSYSAPI NTSTATUS WINAPI NtSetSystemEnvironmentValue(PUNICODE_STRING,PUNICODE_STRING);
3853 NTSYSAPI NTSTATUS WINAPI NtSetSystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG);
3854 NTSYSAPI NTSTATUS WINAPI NtSetSystemPowerState(POWER_ACTION,SYSTEM_POWER_STATE,ULONG);
3855 NTSYSAPI NTSTATUS WINAPI NtSetSystemTime(const LARGE_INTEGER*,LARGE_INTEGER*);
3856 NTSYSAPI NTSTATUS WINAPI NtSetThreadExecutionState(EXECUTION_STATE,EXECUTION_STATE*);
3857 NTSYSAPI NTSTATUS WINAPI NtSetTimer(HANDLE, const LARGE_INTEGER*, PTIMER_APC_ROUTINE, PVOID, BOOLEAN, ULONG, BOOLEAN*);
3858 NTSYSAPI NTSTATUS WINAPI NtSetTimerResolution(ULONG,BOOLEAN,PULONG);
3859 NTSYSAPI NTSTATUS WINAPI NtSetValueKey(HANDLE,const UNICODE_STRING *,ULONG,ULONG,const void *,ULONG);
3860 NTSYSAPI NTSTATUS WINAPI NtSetVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
3861 NTSYSAPI NTSTATUS WINAPI NtSignalAndWaitForSingleObject(HANDLE,HANDLE,BOOLEAN,const LARGE_INTEGER*);
3862 NTSYSAPI NTSTATUS WINAPI NtShutdownSystem(SHUTDOWN_ACTION);
3863 NTSYSAPI NTSTATUS WINAPI NtStartProfile(HANDLE);
3864 NTSYSAPI NTSTATUS WINAPI NtStopProfile(HANDLE);
3865 NTSYSAPI NTSTATUS WINAPI NtSuspendProcess(HANDLE);
3866 NTSYSAPI NTSTATUS WINAPI NtSuspendThread(HANDLE,PULONG);
3867 NTSYSAPI NTSTATUS WINAPI NtSystemDebugControl(SYSDBG_COMMAND,PVOID,ULONG,PVOID,ULONG,PULONG);
3868 NTSYSAPI NTSTATUS WINAPI NtTerminateJobObject(HANDLE,NTSTATUS);
3869 NTSYSAPI NTSTATUS WINAPI NtTerminateProcess(HANDLE,LONG);
3870 NTSYSAPI NTSTATUS WINAPI NtTerminateThread(HANDLE,LONG);
3871 NTSYSAPI NTSTATUS WINAPI NtTestAlert(VOID);
3872 NTSYSAPI NTSTATUS WINAPI NtUnloadDriver(const UNICODE_STRING *);
3873 NTSYSAPI NTSTATUS WINAPI NtUnloadKey(POBJECT_ATTRIBUTES);
3874 NTSYSAPI NTSTATUS WINAPI NtUnloadKeyEx(POBJECT_ATTRIBUTES,HANDLE);
3875 NTSYSAPI NTSTATUS WINAPI NtUnlockFile(HANDLE,PIO_STATUS_BLOCK,PLARGE_INTEGER,PLARGE_INTEGER,PULONG);
3876 NTSYSAPI NTSTATUS WINAPI NtUnlockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
3877 NTSYSAPI NTSTATUS WINAPI NtUnmapViewOfSection(HANDLE,PVOID);
3878 NTSYSAPI NTSTATUS WINAPI NtVdmControl(ULONG,PVOID);
3879 NTSYSAPI NTSTATUS WINAPI NtWaitForDebugEvent(HANDLE,BOOLEAN,LARGE_INTEGER*,DBGUI_WAIT_STATE_CHANGE*);
3880 NTSYSAPI NTSTATUS WINAPI NtWaitForKeyedEvent(HANDLE,const void*,BOOLEAN,const LARGE_INTEGER*);
3881 NTSYSAPI NTSTATUS WINAPI NtWaitForSingleObject(HANDLE,BOOLEAN,const LARGE_INTEGER*);
3882 NTSYSAPI NTSTATUS WINAPI NtWaitForMultipleObjects(ULONG,const HANDLE*,BOOLEAN,BOOLEAN,const LARGE_INTEGER*);
3883 NTSYSAPI NTSTATUS WINAPI NtWaitHighEventPair(HANDLE);
3884 NTSYSAPI NTSTATUS WINAPI NtWaitLowEventPair(HANDLE);
3885 NTSYSAPI NTSTATUS WINAPI NtWriteFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,const void*,ULONG,PLARGE_INTEGER,PULONG);
3886 NTSYSAPI NTSTATUS WINAPI NtWriteFileGather(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,FILE_SEGMENT_ELEMENT*,ULONG,PLARGE_INTEGER,PULONG);
3887 NTSYSAPI NTSTATUS WINAPI NtWriteRequestData(HANDLE,PLPC_MESSAGE,ULONG,PVOID,ULONG,PULONG);
3888 NTSYSAPI NTSTATUS WINAPI NtWriteVirtualMemory(HANDLE,void*,const void*,SIZE_T,SIZE_T*);
3889 NTSYSAPI NTSTATUS WINAPI NtYieldExecution(void);
3890
3891 NTSYSAPI NTSTATUS WINAPI RtlAbsoluteToSelfRelativeSD(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR,PULONG);
3892 NTSYSAPI void WINAPI RtlAcquirePebLock(void);
3893 NTSYSAPI BYTE WINAPI RtlAcquireResourceExclusive(LPRTL_RWLOCK,BYTE);
3894 NTSYSAPI BYTE WINAPI RtlAcquireResourceShared(LPRTL_RWLOCK,BYTE);
3895 NTSYSAPI void WINAPI RtlAcquireSRWLockExclusive(RTL_SRWLOCK*);
3896 NTSYSAPI void WINAPI RtlAcquireSRWLockShared(RTL_SRWLOCK*);
3897 NTSYSAPI NTSTATUS WINAPI RtlActivateActivationContext(DWORD,HANDLE,ULONG_PTR*);
3898 NTSYSAPI NTSTATUS WINAPI RtlActivateActivationContextEx(ULONG,TEB*,HANDLE,ULONG_PTR*);
3899 NTSYSAPI NTSTATUS WINAPI RtlAddAce(PACL,DWORD,DWORD,PACE_HEADER,DWORD);
3900 NTSYSAPI NTSTATUS WINAPI RtlAddAccessAllowedAce(PACL,DWORD,DWORD,PSID);
3901 NTSYSAPI NTSTATUS WINAPI RtlAddAccessAllowedAceEx(PACL,DWORD,DWORD,DWORD,PSID);
3902 NTSYSAPI NTSTATUS WINAPI RtlAddAccessAllowedObjectAce(PACL,DWORD,DWORD,DWORD,GUID*,GUID*,PSID);
3903 NTSYSAPI NTSTATUS WINAPI RtlAddAccessDeniedAce(PACL,DWORD,DWORD,PSID);
3904 NTSYSAPI NTSTATUS WINAPI RtlAddAccessDeniedAceEx(PACL,DWORD,DWORD,DWORD,PSID);
3905 NTSYSAPI NTSTATUS WINAPI RtlAddAccessDeniedObjectAce(PACL,DWORD,DWORD,DWORD,GUID*,GUID*,PSID);
3906 NTSYSAPI NTSTATUS WINAPI RtlAddAtomToAtomTable(RTL_ATOM_TABLE,const WCHAR*,RTL_ATOM*);
3907 NTSYSAPI NTSTATUS WINAPI RtlAddAuditAccessAce(PACL,DWORD,DWORD,PSID,BOOL,BOOL);
3908 NTSYSAPI NTSTATUS WINAPI RtlAddAuditAccessAceEx(PACL,DWORD,DWORD,DWORD,PSID,BOOL,BOOL);
3909 NTSYSAPI NTSTATUS WINAPI RtlAddAuditAccessObjectAce(PACL,DWORD,DWORD,DWORD,GUID*,GUID*,PSID,BOOL,BOOL);
3910 NTSYSAPI NTSTATUS WINAPI RtlAddMandatoryAce(PACL,DWORD,DWORD,DWORD,DWORD,PSID);
3911 NTSYSAPI void WINAPI RtlAddRefActivationContext(HANDLE);
3912 NTSYSAPI PVOID WINAPI RtlAddVectoredExceptionHandler(ULONG,PVECTORED_EXCEPTION_HANDLER);
3913 NTSYSAPI NTSTATUS WINAPI RtlAdjustPrivilege(ULONG,BOOLEAN,BOOLEAN,PBOOLEAN);
3914 NTSYSAPI NTSTATUS WINAPI RtlAllocateAndInitializeSid(PSID_IDENTIFIER_AUTHORITY,BYTE,DWORD,DWORD,DWORD,DWORD,DWORD,DWORD,DWORD,DWORD,PSID *);
3915 NTSYSAPI RTL_HANDLE * WINAPI RtlAllocateHandle(RTL_HANDLE_TABLE *,ULONG *);
3916 NTSYSAPI PVOID WINAPI RtlAllocateHeap(HANDLE,ULONG,SIZE_T) __WINE_ALLOC_SIZE(3);
3917 NTSYSAPI WCHAR WINAPI RtlAnsiCharToUnicodeChar(LPSTR *);
3918 NTSYSAPI DWORD WINAPI RtlAnsiStringToUnicodeSize(const STRING *);
3919 NTSYSAPI NTSTATUS WINAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING,PCANSI_STRING,BOOLEAN);
3920 NTSYSAPI NTSTATUS WINAPI RtlAppendAsciizToString(STRING *,LPCSTR);
3921 NTSYSAPI NTSTATUS WINAPI RtlAppendStringToString(STRING *,const STRING *);
3922 NTSYSAPI NTSTATUS WINAPI RtlAppendUnicodeStringToString(UNICODE_STRING *,const UNICODE_STRING *);
3923 NTSYSAPI NTSTATUS WINAPI RtlAppendUnicodeToString(UNICODE_STRING *,LPCWSTR);
3924 NTSYSAPI BOOLEAN WINAPI RtlAreAllAccessesGranted(ACCESS_MASK,ACCESS_MASK);
3925 NTSYSAPI BOOLEAN WINAPI RtlAreAnyAccessesGranted(ACCESS_MASK,ACCESS_MASK);
3926 NTSYSAPI BOOLEAN WINAPI RtlAreBitsSet(PCRTL_BITMAP,ULONG,ULONG);
3927 NTSYSAPI BOOLEAN WINAPI RtlAreBitsClear(PCRTL_BITMAP,ULONG,ULONG);
3928 NTSYSAPI NTSTATUS WINAPI RtlCharToInteger(PCSZ,ULONG,PULONG);
3929 NTSYSAPI NTSTATUS WINAPI RtlCheckRegistryKey(ULONG, PWSTR);
3930 NTSYSAPI void WINAPI RtlClearAllBits(PRTL_BITMAP);
3931 NTSYSAPI void WINAPI RtlClearBits(PRTL_BITMAP,ULONG,ULONG);
3932 NTSYSAPI NTSTATUS WINAPI RtlCreateActivationContext(HANDLE*,const void*);
3933 NTSYSAPI PDEBUG_BUFFER WINAPI RtlCreateQueryDebugBuffer(ULONG,BOOLEAN);
3934 NTSYSAPI NTSTATUS WINAPI RtlCreateRegistryKey(ULONG,PWSTR);
3935 NTSYSAPI ULONG WINAPI RtlCompactHeap(HANDLE,ULONG);
3936 NTSYSAPI LONG WINAPI RtlCompareString(const STRING*,const STRING*,BOOLEAN);
3937 NTSYSAPI LONG WINAPI RtlCompareUnicodeString(const UNICODE_STRING*,const UNICODE_STRING*,BOOLEAN);
3938 NTSYSAPI LONG WINAPI RtlCompareUnicodeStrings(const WCHAR*,SIZE_T,const WCHAR*,SIZE_T,BOOLEAN);
3939 NTSYSAPI NTSTATUS WINAPI RtlCompressBuffer(USHORT,PUCHAR,ULONG,PUCHAR,ULONG,ULONG,PULONG,PVOID);
3940 NTSYSAPI DWORD WINAPI RtlComputeCrc32(DWORD,const BYTE*,INT);
3941 NTSYSAPI NTSTATUS WINAPI RtlConvertSidToUnicodeString(PUNICODE_STRING,PSID,BOOLEAN);
3942 NTSYSAPI NTSTATUS WINAPI RtlConvertToAutoInheritSecurityObject(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR*,GUID*,BOOL,PGENERIC_MAPPING);
3943 NTSYSAPI void WINAPI RtlCopyLuid(PLUID,const LUID*);
3944 NTSYSAPI void WINAPI RtlCopyLuidAndAttributesArray(ULONG,const LUID_AND_ATTRIBUTES*,PLUID_AND_ATTRIBUTES);
3945 NTSYSAPI BOOLEAN WINAPI RtlCopySid(DWORD,PSID,PSID);
3946 NTSYSAPI NTSTATUS WINAPI RtlCopySecurityDescriptor(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR);
3947 NTSYSAPI void WINAPI RtlCopyString(STRING*,const STRING*);
3948 NTSYSAPI void WINAPI RtlCopyUnicodeString(UNICODE_STRING*,const UNICODE_STRING*);
3949 NTSYSAPI NTSTATUS WINAPI RtlCreateAcl(PACL,DWORD,DWORD);
3950 NTSYSAPI NTSTATUS WINAPI RtlCreateAtomTable(ULONG,RTL_ATOM_TABLE*);
3951 NTSYSAPI NTSTATUS WINAPI RtlCreateEnvironment(BOOLEAN, PWSTR*);
3952 NTSYSAPI HANDLE WINAPI RtlCreateHeap(ULONG,PVOID,SIZE_T,SIZE_T,PVOID,PRTL_HEAP_DEFINITION);
3953 NTSYSAPI NTSTATUS WINAPI RtlCreateProcessParameters(RTL_USER_PROCESS_PARAMETERS**,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*,PWSTR,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*);
3954 NTSYSAPI NTSTATUS WINAPI RtlCreateProcessParametersEx(RTL_USER_PROCESS_PARAMETERS**,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*,PWSTR,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*,ULONG);
3955 NTSYSAPI NTSTATUS WINAPI RtlCreateSecurityDescriptor(PSECURITY_DESCRIPTOR,DWORD);
3956 NTSYSAPI NTSTATUS WINAPI RtlCreateTimerQueue(PHANDLE);
3957 NTSYSAPI NTSTATUS WINAPI RtlCreateTimer(PHANDLE, HANDLE, RTL_WAITORTIMERCALLBACKFUNC, PVOID, DWORD, DWORD, ULONG);
3958 NTSYSAPI BOOLEAN WINAPI RtlCreateUnicodeString(PUNICODE_STRING,LPCWSTR);
3959 NTSYSAPI BOOLEAN WINAPI RtlCreateUnicodeStringFromAsciiz(PUNICODE_STRING,LPCSTR);
3960 NTSYSAPI NTSTATUS WINAPI RtlCreateUserProcess(UNICODE_STRING*,ULONG,RTL_USER_PROCESS_PARAMETERS*,SECURITY_DESCRIPTOR*,SECURITY_DESCRIPTOR*,HANDLE,BOOLEAN,HANDLE,HANDLE,RTL_USER_PROCESS_INFORMATION*);
3961 NTSYSAPI NTSTATUS WINAPI RtlCreateUserThread(HANDLE,SECURITY_DESCRIPTOR*,BOOLEAN,PVOID,SIZE_T,SIZE_T,PRTL_THREAD_START_ROUTINE,void*,HANDLE*,CLIENT_ID*);
3962 NTSYSAPI NTSTATUS WINAPI RtlCreateUserStack(SIZE_T,SIZE_T,ULONG,SIZE_T,SIZE_T,INITIAL_TEB*);
3963 NTSYSAPI NTSTATUS WINAPI RtlCustomCPToUnicodeN(CPTABLEINFO*,WCHAR*,DWORD,DWORD*,const char*,DWORD);
3964 NTSYSAPI void WINAPI RtlDeactivateActivationContext(DWORD,ULONG_PTR);
3965 NTSYSAPI PVOID WINAPI RtlDecodePointer(PVOID);
3966 NTSYSAPI NTSTATUS WINAPI RtlDecompressBuffer(USHORT,PUCHAR,ULONG,PUCHAR,ULONG,PULONG);
3967 NTSYSAPI NTSTATUS WINAPI RtlDecompressFragment(USHORT,PUCHAR,ULONG,PUCHAR,ULONG,ULONG,PULONG,PVOID);
3968 NTSYSAPI NTSTATUS WINAPI RtlDeleteAce(PACL,DWORD);
3969 NTSYSAPI NTSTATUS WINAPI RtlDeleteAtomFromAtomTable(RTL_ATOM_TABLE,RTL_ATOM);
3970 NTSYSAPI NTSTATUS WINAPI RtlDeleteCriticalSection(RTL_CRITICAL_SECTION *);
3971 NTSYSAPI NTSTATUS WINAPI RtlDeleteRegistryValue(ULONG, PCWSTR, PCWSTR);
3972 NTSYSAPI void WINAPI RtlDeleteResource(LPRTL_RWLOCK);
3973 NTSYSAPI NTSTATUS WINAPI RtlDeleteSecurityObject(PSECURITY_DESCRIPTOR*);
3974 NTSYSAPI NTSTATUS WINAPI RtlDeleteTimer(HANDLE, HANDLE, HANDLE);
3975 NTSYSAPI NTSTATUS WINAPI RtlDeleteTimerQueueEx(HANDLE, HANDLE);
3976 NTSYSAPI PRTL_USER_PROCESS_PARAMETERS WINAPI RtlDeNormalizeProcessParams(RTL_USER_PROCESS_PARAMETERS*);
3977 NTSYSAPI NTSTATUS WINAPI RtlDeregisterWait(HANDLE);
3978 NTSYSAPI NTSTATUS WINAPI RtlDeregisterWaitEx(HANDLE,HANDLE);
3979 NTSYSAPI NTSTATUS WINAPI RtlDestroyAtomTable(RTL_ATOM_TABLE);
3980 NTSYSAPI NTSTATUS WINAPI RtlDestroyEnvironment(PWSTR);
3981 NTSYSAPI NTSTATUS WINAPI RtlDestroyHandleTable(RTL_HANDLE_TABLE *);
3982 NTSYSAPI HANDLE WINAPI RtlDestroyHeap(HANDLE);
3983 NTSYSAPI void WINAPI RtlDestroyProcessParameters(RTL_USER_PROCESS_PARAMETERS*);
3984 NTSYSAPI NTSTATUS WINAPI RtlDestroyQueryDebugBuffer(PDEBUG_BUFFER);
3985 NTSYSAPI DOS_PATHNAME_TYPE WINAPI RtlDetermineDosPathNameType_U(PCWSTR);
3986 NTSYSAPI BOOLEAN WINAPI RtlDllShutdownInProgress(void);
3987 NTSYSAPI BOOLEAN WINAPI RtlDoesFileExists_U(LPCWSTR);
3988 NTSYSAPI BOOLEAN WINAPI RtlDosPathNameToNtPathName_U(PCWSTR,PUNICODE_STRING,PWSTR*,CURDIR*);
3989 NTSYSAPI NTSTATUS WINAPI RtlDosPathNameToNtPathName_U_WithStatus(PCWSTR,PUNICODE_STRING,PWSTR*,CURDIR*);
3990 NTSYSAPI ULONG WINAPI RtlDosSearchPath_U(LPCWSTR, LPCWSTR, LPCWSTR, ULONG, LPWSTR, LPWSTR*);
3991 NTSYSAPI WCHAR WINAPI RtlDowncaseUnicodeChar(WCHAR);
3992 NTSYSAPI NTSTATUS WINAPI RtlDowncaseUnicodeString(UNICODE_STRING*,const UNICODE_STRING*,BOOLEAN);
3993 NTSYSAPI void WINAPI RtlDumpResource(LPRTL_RWLOCK);
3994 NTSYSAPI NTSTATUS WINAPI RtlDuplicateUnicodeString(int,const UNICODE_STRING*,UNICODE_STRING*);
3995 NTSYSAPI NTSTATUS WINAPI RtlEmptyAtomTable(RTL_ATOM_TABLE,BOOLEAN);
3996 NTSYSAPI PVOID WINAPI RtlEncodePointer(PVOID);
3997 NTSYSAPI NTSTATUS WINAPI RtlEnterCriticalSection(RTL_CRITICAL_SECTION *);
3998 NTSYSAPI void WINAPI RtlEraseUnicodeString(UNICODE_STRING*);
3999 NTSYSAPI NTSTATUS WINAPI RtlEqualComputerName(const UNICODE_STRING*,const UNICODE_STRING*);
4000 NTSYSAPI NTSTATUS WINAPI RtlEqualDomainName(const UNICODE_STRING*,const UNICODE_STRING*);
4001 NTSYSAPI BOOLEAN WINAPI RtlEqualLuid(const LUID*,const LUID*);
4002 NTSYSAPI BOOL WINAPI RtlEqualPrefixSid(PSID,PSID);
4003 NTSYSAPI BOOL WINAPI RtlEqualSid(PSID,PSID);
4004 NTSYSAPI BOOLEAN WINAPI RtlEqualString(const STRING*,const STRING*,BOOLEAN);
4005 NTSYSAPI BOOLEAN WINAPI RtlEqualUnicodeString(const UNICODE_STRING*,const UNICODE_STRING*,BOOLEAN);
4006 NTSYSAPI void DECLSPEC_NORETURN WINAPI RtlExitUserProcess(ULONG);
4007 NTSYSAPI void DECLSPEC_NORETURN WINAPI RtlExitUserThread(ULONG);
4008 NTSYSAPI NTSTATUS WINAPI RtlExpandEnvironmentStrings(const WCHAR*,WCHAR*,SIZE_T,WCHAR*,SIZE_T,SIZE_T*);
4009 NTSYSAPI NTSTATUS WINAPI RtlExpandEnvironmentStrings_U(PCWSTR, const UNICODE_STRING*, UNICODE_STRING*, ULONG*);
4010 NTSYSAPI NTSTATUS WINAPI RtlFindActivationContextSectionString(ULONG,const GUID*,ULONG,const UNICODE_STRING*,PVOID);
4011 NTSYSAPI NTSTATUS WINAPI RtlFindActivationContextSectionGuid(ULONG,const GUID*,ULONG,const GUID*,PVOID);
4012 NTSYSAPI NTSTATUS WINAPI RtlFindCharInUnicodeString(int,const UNICODE_STRING*,const UNICODE_STRING*,USHORT*);
4013 NTSYSAPI ULONG WINAPI RtlFindClearBits(PCRTL_BITMAP,ULONG,ULONG);
4014 NTSYSAPI ULONG WINAPI RtlFindClearBitsAndSet(PRTL_BITMAP,ULONG,ULONG);
4015 NTSYSAPI ULONG WINAPI RtlFindClearRuns(PCRTL_BITMAP,PRTL_BITMAP_RUN,ULONG,BOOLEAN);
4016 NTSYSAPI ULONG WINAPI RtlFindLastBackwardRunSet(PCRTL_BITMAP,ULONG,PULONG);
4017 NTSYSAPI ULONG WINAPI RtlFindLastBackwardRunClear(PCRTL_BITMAP,ULONG,PULONG);
4018 NTSYSAPI CCHAR WINAPI RtlFindLeastSignificantBit(ULONGLONG);
4019 NTSYSAPI ULONG WINAPI RtlFindLongestRunSet(PCRTL_BITMAP,PULONG);
4020 NTSYSAPI ULONG WINAPI RtlFindLongestRunClear(PCRTL_BITMAP,PULONG);
4021 NTSYSAPI NTSTATUS WINAPI RtlFindMessage(HMODULE,ULONG,ULONG,ULONG,const MESSAGE_RESOURCE_ENTRY**);
4022 NTSYSAPI CCHAR WINAPI RtlFindMostSignificantBit(ULONGLONG);
4023 NTSYSAPI ULONG WINAPI RtlFindNextForwardRunSet(PCRTL_BITMAP,ULONG,PULONG);
4024 NTSYSAPI ULONG WINAPI RtlFindNextForwardRunClear(PCRTL_BITMAP,ULONG,PULONG);
4025 NTSYSAPI ULONG WINAPI RtlFindSetBits(PCRTL_BITMAP,ULONG,ULONG);
4026 NTSYSAPI ULONG WINAPI RtlFindSetBitsAndClear(PRTL_BITMAP,ULONG,ULONG);
4027 NTSYSAPI ULONG WINAPI RtlFindSetRuns(PCRTL_BITMAP,PRTL_BITMAP_RUN,ULONG,BOOLEAN);
4028 NTSYSAPI BOOLEAN WINAPI RtlFirstFreeAce(PACL,PACE_HEADER *);
4029 NTSYSAPI NTSTATUS WINAPI RtlFlsAlloc(PFLS_CALLBACK_FUNCTION,ULONG *);
4030 NTSYSAPI NTSTATUS WINAPI RtlFlsFree(ULONG);
4031 NTSYSAPI NTSTATUS WINAPI RtlFlsGetValue(ULONG,void **);
4032 NTSYSAPI NTSTATUS WINAPI RtlFlsSetValue(ULONG,void *);
4033 NTSYSAPI NTSTATUS WINAPI RtlFormatCurrentUserKeyPath(PUNICODE_STRING);
4034 NTSYSAPI NTSTATUS WINAPI RtlFormatMessage(LPCWSTR,ULONG,BOOLEAN,BOOLEAN,BOOLEAN,__ms_va_list *,LPWSTR,ULONG,ULONG*);
4035 NTSYSAPI NTSTATUS WINAPI RtlFormatMessageEx(LPCWSTR,ULONG,BOOLEAN,BOOLEAN,BOOLEAN,__ms_va_list *,LPWSTR,ULONG,ULONG*,ULONG);
4036 NTSYSAPI void WINAPI RtlFreeAnsiString(PANSI_STRING);
4037 NTSYSAPI BOOLEAN WINAPI RtlFreeHandle(RTL_HANDLE_TABLE *,RTL_HANDLE *);
4038 NTSYSAPI BOOLEAN WINAPI RtlFreeHeap(HANDLE,ULONG,PVOID);
4039 NTSYSAPI void WINAPI RtlFreeOemString(POEM_STRING);
4040 NTSYSAPI DWORD WINAPI RtlFreeSid(PSID);
4041 NTSYSAPI void WINAPI RtlFreeThreadActivationContextStack(void);
4042 NTSYSAPI void WINAPI RtlFreeUnicodeString(PUNICODE_STRING);
4043 NTSYSAPI void WINAPI RtlFreeUserStack(void*);
4044 NTSYSAPI NTSTATUS WINAPI RtlGetAce(PACL,DWORD,LPVOID *);
4045 NTSYSAPI NTSTATUS WINAPI RtlGetActiveActivationContext(HANDLE*);
4046 NTSYSAPI NTSTATUS WINAPI RtlGetCompressionWorkSpaceSize(USHORT,PULONG,PULONG);
4047 NTSYSAPI NTSTATUS WINAPI RtlGetControlSecurityDescriptor(PSECURITY_DESCRIPTOR, PSECURITY_DESCRIPTOR_CONTROL,LPDWORD);
4048 NTSYSAPI ULONG WINAPI RtlGetCurrentDirectory_U(ULONG, LPWSTR);
4049 NTSYSAPI PEB * WINAPI RtlGetCurrentPeb(void);
4050 NTSYSAPI NTSTATUS WINAPI RtlGetDaclSecurityDescriptor(PSECURITY_DESCRIPTOR,PBOOLEAN,PACL *,PBOOLEAN);
4051 NTSYSAPI NTSTATUS WINAPI RtlGetExePath(PCWSTR,PWSTR*);
4052 NTSYSAPI TEB_ACTIVE_FRAME * WINAPI RtlGetFrame(void);
4053 NTSYSAPI ULONG WINAPI RtlGetFullPathName_U(PCWSTR,ULONG,PWSTR,PWSTR*);
4054 NTSYSAPI NTSTATUS WINAPI RtlGetGroupSecurityDescriptor(PSECURITY_DESCRIPTOR,PSID *,PBOOLEAN);
4055 NTSYSAPI NTSTATUS WINAPI RtlGetLastNtStatus(void);
4056 NTSYSAPI DWORD WINAPI RtlGetLastWin32Error(void);
4057 NTSYSAPI DWORD WINAPI RtlGetLongestNtPathLength(void);
4058 NTSYSAPI ULONG WINAPI RtlGetNtGlobalFlags(void);
4059 NTSYSAPI BOOLEAN WINAPI RtlGetNtProductType(LPDWORD);
4060 NTSYSAPI NTSTATUS WINAPI RtlGetOwnerSecurityDescriptor(PSECURITY_DESCRIPTOR,PSID *,PBOOLEAN);
4061 NTSYSAPI ULONG WINAPI RtlGetProcessHeaps(ULONG,HANDLE*);
4062 NTSYSAPI NTSTATUS WINAPI RtlGetProcessPreferredUILanguages(DWORD,ULONG*,WCHAR*,ULONG*);
4063 NTSYSAPI NTSTATUS WINAPI RtlGetSaclSecurityDescriptor(PSECURITY_DESCRIPTOR,PBOOLEAN,PACL *,PBOOLEAN);
4064 NTSYSAPI NTSTATUS WINAPI RtlGetSearchPath(PWSTR*);
4065 NTSYSAPI NTSTATUS WINAPI RtlGetSystemPreferredUILanguages(DWORD,ULONG,ULONG*,WCHAR*,ULONG*);
4066 NTSYSAPI LONGLONG WINAPI RtlGetSystemTimePrecise(void);
4067 NTSYSAPI DWORD WINAPI RtlGetThreadErrorMode(void);
4068 NTSYSAPI NTSTATUS WINAPI RtlGetThreadPreferredUILanguages(DWORD,ULONG*,WCHAR*,ULONG*);
4069 NTSYSAPI NTSTATUS WINAPI RtlGetUserPreferredUILanguages(DWORD,ULONG,ULONG*,WCHAR*,ULONG*);
4070 NTSYSAPI NTSTATUS WINAPI RtlGetVersion(RTL_OSVERSIONINFOEXW*);
4071 NTSYSAPI NTSTATUS WINAPI RtlGUIDFromString(PUNICODE_STRING,GUID*);
4072 NTSYSAPI PSID_IDENTIFIER_AUTHORITY WINAPI RtlIdentifierAuthoritySid(PSID);
4073 NTSYSAPI NTSTATUS WINAPI RtlIdnToAscii(DWORD,const WCHAR*,INT,WCHAR*,INT*);
4074 NTSYSAPI NTSTATUS WINAPI RtlIdnToNameprepUnicode(DWORD,const WCHAR*,INT,WCHAR*,INT*);
4075 NTSYSAPI NTSTATUS WINAPI RtlIdnToUnicode(DWORD,const WCHAR*,INT,WCHAR*,INT*);
4076 NTSYSAPI PVOID WINAPI RtlImageDirectoryEntryToData(HMODULE,BOOL,WORD,ULONG *);
4077 NTSYSAPI PIMAGE_NT_HEADERS WINAPI RtlImageNtHeader(HMODULE);
4078 NTSYSAPI PIMAGE_SECTION_HEADER WINAPI RtlImageRvaToSection(const IMAGE_NT_HEADERS *,HMODULE,DWORD);
4079 NTSYSAPI PVOID WINAPI RtlImageRvaToVa(const IMAGE_NT_HEADERS *,HMODULE,DWORD,IMAGE_SECTION_HEADER **);
4080 NTSYSAPI NTSTATUS WINAPI RtlImpersonateSelf(SECURITY_IMPERSONATION_LEVEL);
4081 NTSYSAPI void WINAPI RtlInitString(PSTRING,PCSZ);
4082 NTSYSAPI void WINAPI RtlInitAnsiString(PANSI_STRING,PCSZ);
4083 NTSYSAPI NTSTATUS WINAPI RtlInitAnsiStringEx(PANSI_STRING,PCSZ);
4084 NTSYSAPI void WINAPI RtlInitCodePageTable(USHORT*,CPTABLEINFO*);
4085 NTSYSAPI void WINAPI RtlInitNlsTables(USHORT*,USHORT*,USHORT*,NLSTABLEINFO*);
4086 NTSYSAPI void WINAPI RtlInitUnicodeString(PUNICODE_STRING,PCWSTR);
4087 NTSYSAPI NTSTATUS WINAPI RtlInitUnicodeStringEx(PUNICODE_STRING,PCWSTR);
4088 NTSYSAPI void WINAPI RtlInitializeBitMap(PRTL_BITMAP,PULONG,ULONG);
4089 NTSYSAPI void WINAPI RtlInitializeConditionVariable(RTL_CONDITION_VARIABLE *);
4090 NTSYSAPI NTSTATUS WINAPI RtlInitializeCriticalSection(RTL_CRITICAL_SECTION *);
4091 NTSYSAPI NTSTATUS WINAPI RtlInitializeCriticalSectionAndSpinCount(RTL_CRITICAL_SECTION *,ULONG);
4092 NTSYSAPI NTSTATUS WINAPI RtlInitializeCriticalSectionEx(RTL_CRITICAL_SECTION *,ULONG,ULONG);
4093 NTSYSAPI void WINAPI RtlInitializeHandleTable(ULONG,ULONG,RTL_HANDLE_TABLE *);
4094 NTSYSAPI void WINAPI RtlInitializeResource(LPRTL_RWLOCK);
4095 NTSYSAPI void WINAPI RtlInitializeSRWLock(RTL_SRWLOCK*);
4096 NTSYSAPI BOOL WINAPI RtlInitializeSid(PSID,PSID_IDENTIFIER_AUTHORITY,BYTE);
4097 NTSYSAPI NTSTATUS WINAPI RtlInt64ToUnicodeString(ULONGLONG,ULONG,UNICODE_STRING *);
4098 NTSYSAPI NTSTATUS WINAPI RtlIntegerToChar(ULONG,ULONG,ULONG,PCHAR);
4099 NTSYSAPI NTSTATUS WINAPI RtlIntegerToUnicodeString(ULONG,ULONG,UNICODE_STRING *);
4100 NTSYSAPI BOOLEAN WINAPI RtlIsActivationContextActive(HANDLE);
4101 NTSYSAPI BOOL WINAPI RtlIsCriticalSectionLocked(RTL_CRITICAL_SECTION *);
4102 NTSYSAPI BOOL WINAPI RtlIsCriticalSectionLockedByThread(RTL_CRITICAL_SECTION *);
4103 NTSYSAPI ULONG WINAPI RtlIsDosDeviceName_U(PCWSTR);
4104 NTSYSAPI BOOLEAN WINAPI RtlIsNameLegalDOS8Dot3(const UNICODE_STRING*,POEM_STRING,PBOOLEAN);
4105 NTSYSAPI NTSTATUS WINAPI RtlIsNormalizedString(ULONG,const WCHAR*,INT,BOOLEAN*);
4106 NTSYSAPI BOOLEAN WINAPI RtlIsProcessorFeaturePresent(UINT);
4107 NTSYSAPI BOOLEAN WINAPI RtlIsTextUnicode(LPCVOID,INT,INT *);
4108 NTSYSAPI BOOLEAN WINAPI RtlIsValidHandle(const RTL_HANDLE_TABLE *, const RTL_HANDLE *);
4109 NTSYSAPI BOOLEAN WINAPI RtlIsValidIndexHandle(const RTL_HANDLE_TABLE *, ULONG Index, RTL_HANDLE **);
4110 NTSYSAPI NTSTATUS WINAPI RtlLeaveCriticalSection(RTL_CRITICAL_SECTION *);
4111 NTSYSAPI DWORD WINAPI RtlLengthRequiredSid(DWORD);
4112 NTSYSAPI ULONG WINAPI RtlLengthSecurityDescriptor(PSECURITY_DESCRIPTOR);
4113 NTSYSAPI DWORD WINAPI RtlLengthSid(PSID);
4114 NTSYSAPI NTSTATUS WINAPI RtlLocalTimeToSystemTime(const LARGE_INTEGER*,PLARGE_INTEGER);
4115 NTSYSAPI NTSTATUS WINAPI RtlLocaleNameToLcid(const WCHAR*,LCID*,ULONG);
4116 NTSYSAPI BOOLEAN WINAPI RtlLockHeap(HANDLE);
4117 NTSYSAPI NTSTATUS WINAPI RtlLookupAtomInAtomTable(RTL_ATOM_TABLE,const WCHAR*,RTL_ATOM*);
4118 NTSYSAPI NTSTATUS WINAPI RtlMakeSelfRelativeSD(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR,LPDWORD);
4119 NTSYSAPI void WINAPI RtlMapGenericMask(PACCESS_MASK,const GENERIC_MAPPING*);
4120 NTSYSAPI NTSTATUS WINAPI RtlMultiByteToUnicodeN(LPWSTR,DWORD,LPDWORD,LPCSTR,DWORD);
4121 NTSYSAPI NTSTATUS WINAPI RtlMultiByteToUnicodeSize(DWORD*,LPCSTR,UINT);
4122 NTSYSAPI NTSTATUS WINAPI RtlNewSecurityObject(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR*,BOOLEAN,HANDLE,PGENERIC_MAPPING);
4123 NTSYSAPI PRTL_USER_PROCESS_PARAMETERS WINAPI RtlNormalizeProcessParams(RTL_USER_PROCESS_PARAMETERS*);
4124 NTSYSAPI NTSTATUS WINAPI RtlNormalizeString(ULONG,const WCHAR*,INT,WCHAR*,INT*);
4125 NTSYSAPI ULONG WINAPI RtlNtStatusToDosError(NTSTATUS);
4126 NTSYSAPI ULONG WINAPI RtlNtStatusToDosErrorNoTeb(NTSTATUS);
4127 NTSYSAPI ULONG WINAPI RtlNumberOfSetBits(PCRTL_BITMAP);
4128 NTSYSAPI ULONG WINAPI RtlNumberOfClearBits(PCRTL_BITMAP);
4129 NTSYSAPI UINT WINAPI RtlOemStringToUnicodeSize(const STRING*);
4130 NTSYSAPI NTSTATUS WINAPI RtlOemStringToUnicodeString(UNICODE_STRING*,const STRING*,BOOLEAN);
4131 NTSYSAPI NTSTATUS WINAPI RtlOemToUnicodeN(LPWSTR,DWORD,LPDWORD,LPCSTR,DWORD);
4132 NTSYSAPI NTSTATUS WINAPI RtlOpenCurrentUser(ACCESS_MASK,PHANDLE);
4133 NTSYSAPI PVOID WINAPI RtlPcToFileHeader(PVOID,PVOID*);
4134 NTSYSAPI NTSTATUS WINAPI RtlPinAtomInAtomTable(RTL_ATOM_TABLE,RTL_ATOM);
4135 NTSYSAPI void WINAPI RtlPopFrame(TEB_ACTIVE_FRAME*);
4136 NTSYSAPI BOOLEAN WINAPI RtlPrefixString(const STRING*,const STRING*,BOOLEAN);
4137 NTSYSAPI BOOLEAN WINAPI RtlPrefixUnicodeString(const UNICODE_STRING*,const UNICODE_STRING*,BOOLEAN);
4138 NTSYSAPI void WINAPI RtlProcessFlsData(void*,ULONG);
4139 NTSYSAPI void WINAPI RtlPushFrame(TEB_ACTIVE_FRAME*);
4140 NTSYSAPI NTSTATUS WINAPI RtlQueryActivationContextApplicationSettings(DWORD,HANDLE,const WCHAR*,const WCHAR*,WCHAR*,SIZE_T,SIZE_T*);
4141 NTSYSAPI NTSTATUS WINAPI RtlQueryAtomInAtomTable(RTL_ATOM_TABLE,RTL_ATOM,ULONG*,ULONG*,WCHAR*,ULONG*);
4142 NTSYSAPI NTSTATUS WINAPI RtlQueryDynamicTimeZoneInformation(RTL_DYNAMIC_TIME_ZONE_INFORMATION*);
4143 NTSYSAPI NTSTATUS WINAPI RtlQueryEnvironmentVariable(WCHAR*,const WCHAR*,SIZE_T,WCHAR*,SIZE_T,SIZE_T*);
4144 NTSYSAPI NTSTATUS WINAPI RtlQueryEnvironmentVariable_U(PWSTR,PUNICODE_STRING,PUNICODE_STRING);
4145 NTSYSAPI NTSTATUS WINAPI RtlQueryHeapInformation(HANDLE,HEAP_INFORMATION_CLASS,PVOID,SIZE_T,PSIZE_T);
4146 NTSYSAPI NTSTATUS WINAPI RtlQueryInformationAcl(PACL,LPVOID,DWORD,ACL_INFORMATION_CLASS);
4147 NTSYSAPI NTSTATUS WINAPI RtlQueryInformationActivationContext(ULONG,HANDLE,PVOID,ULONG,PVOID,SIZE_T,SIZE_T*);
4148 NTSYSAPI BOOL WINAPI RtlQueryPerformanceCounter(LARGE_INTEGER*);
4149 NTSYSAPI BOOL WINAPI RtlQueryPerformanceFrequency(LARGE_INTEGER*);
4150 NTSYSAPI NTSTATUS WINAPI RtlQueryProcessDebugInformation(ULONG,ULONG,PDEBUG_BUFFER);
4151 NTSYSAPI NTSTATUS WINAPI RtlQueryRegistryValues(ULONG, PCWSTR, PRTL_QUERY_REGISTRY_TABLE, PVOID, PVOID);
4152 NTSYSAPI NTSTATUS WINAPI RtlQueryTimeZoneInformation(RTL_TIME_ZONE_INFORMATION*);
4153 NTSYSAPI BOOL WINAPI RtlQueryUnbiasedInterruptTime(ULONGLONG*);
4154 NTSYSAPI NTSTATUS WINAPI RtlQueueWorkItem(PRTL_WORK_ITEM_ROUTINE,PVOID,ULONG);
4155 NTSYSAPI void WINAPI RtlRaiseException(PEXCEPTION_RECORD);
4156 NTSYSAPI void WINAPI RtlRaiseStatus(NTSTATUS);
4157 NTSYSAPI ULONG WINAPI RtlRandom(PULONG);
4158 NTSYSAPI PVOID WINAPI RtlReAllocateHeap(HANDLE,ULONG,PVOID,SIZE_T);
4159 NTSYSAPI NTSTATUS WINAPI RtlRegisterWait(PHANDLE,HANDLE,RTL_WAITORTIMERCALLBACKFUNC,PVOID,ULONG,ULONG);
4160 NTSYSAPI void WINAPI RtlReleaseActivationContext(HANDLE);
4161 NTSYSAPI void WINAPI RtlReleasePath(PWSTR);
4162 NTSYSAPI void WINAPI RtlReleasePebLock(void);
4163 NTSYSAPI void WINAPI RtlReleaseResource(LPRTL_RWLOCK);
4164 NTSYSAPI void WINAPI RtlReleaseSRWLockExclusive(RTL_SRWLOCK*);
4165 NTSYSAPI void WINAPI RtlReleaseSRWLockShared(RTL_SRWLOCK*);
4166 NTSYSAPI ULONG WINAPI RtlRemoveVectoredExceptionHandler(PVOID);
4167 NTSYSAPI void WINAPI RtlResetRtlTranslations(const NLSTABLEINFO*);
4168 NTSYSAPI void WINAPI RtlRestoreLastWin32Error(DWORD);
4169 NTSYSAPI void WINAPI RtlSecondsSince1970ToTime(DWORD,LARGE_INTEGER *);
4170 NTSYSAPI void WINAPI RtlSecondsSince1980ToTime(DWORD,LARGE_INTEGER *);
4171 NTSYSAPI NTSTATUS WINAPI RtlSelfRelativeToAbsoluteSD(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR,PDWORD,PACL,PDWORD,PACL,PDWORD,PSID,PDWORD,PSID,PDWORD);
4172 NTSYSAPI void WINAPI RtlSetAllBits(PRTL_BITMAP);
4173 NTSYSAPI void WINAPI RtlSetBits(PRTL_BITMAP,ULONG,ULONG);
4174 NTSYSAPI ULONG WINAPI RtlSetCriticalSectionSpinCount(RTL_CRITICAL_SECTION*,ULONG);
4175 NTSYSAPI NTSTATUS WINAPI RtlSetControlSecurityDescriptor(PSECURITY_DESCRIPTOR,SECURITY_DESCRIPTOR_CONTROL,SECURITY_DESCRIPTOR_CONTROL);
4176 NTSYSAPI NTSTATUS WINAPI RtlSetCurrentDirectory_U(const UNICODE_STRING*);
4177 NTSYSAPI void WINAPI RtlSetCurrentEnvironment(PWSTR, PWSTR*);
4178 NTSYSAPI NTSTATUS WINAPI RtlSetDaclSecurityDescriptor(PSECURITY_DESCRIPTOR,BOOLEAN,PACL,BOOLEAN);
4179 NTSYSAPI NTSTATUS WINAPI RtlSetEnvironmentVariable(PWSTR*,PUNICODE_STRING,PUNICODE_STRING);
4180 NTSYSAPI NTSTATUS WINAPI RtlSetHeapInformation(HANDLE,HEAP_INFORMATION_CLASS,PVOID,SIZE_T);
4181 NTSYSAPI NTSTATUS WINAPI RtlSetOwnerSecurityDescriptor(PSECURITY_DESCRIPTOR,PSID,BOOLEAN);
4182 NTSYSAPI NTSTATUS WINAPI RtlSetGroupSecurityDescriptor(PSECURITY_DESCRIPTOR,PSID,BOOLEAN);
4183 NTSYSAPI NTSTATUS WINAPI RtlSetIoCompletionCallback(HANDLE,PRTL_OVERLAPPED_COMPLETION_ROUTINE,ULONG);
4184 NTSYSAPI void WINAPI RtlSetLastWin32Error(DWORD);
4185 NTSYSAPI void WINAPI RtlSetLastWin32ErrorAndNtStatusFromNtStatus(NTSTATUS);
4186 NTSYSAPI NTSTATUS WINAPI RtlSetProcessPreferredUILanguages(DWORD,PCZZWSTR,ULONG*);
4187 NTSYSAPI NTSTATUS WINAPI RtlSetSaclSecurityDescriptor(PSECURITY_DESCRIPTOR,BOOLEAN,PACL,BOOLEAN);
4188 NTSYSAPI NTSTATUS WINAPI RtlSetSearchPathMode(ULONG);
4189 NTSYSAPI NTSTATUS WINAPI RtlSetThreadErrorMode(DWORD,LPDWORD);
4190 NTSYSAPI NTSTATUS WINAPI RtlSetThreadPreferredUILanguages(DWORD,PCZZWSTR,ULONG*);
4191 NTSYSAPI NTSTATUS WINAPI RtlSetTimeZoneInformation(const RTL_TIME_ZONE_INFORMATION*);
4192 NTSYSAPI void WINAPI RtlSetUnhandledExceptionFilter(PRTL_EXCEPTION_FILTER);
4193 NTSYSAPI SIZE_T WINAPI RtlSizeHeap(HANDLE,ULONG,const void*);
4194 NTSYSAPI NTSTATUS WINAPI RtlSleepConditionVariableCS(RTL_CONDITION_VARIABLE*,RTL_CRITICAL_SECTION*,const LARGE_INTEGER*);
4195 NTSYSAPI NTSTATUS WINAPI RtlSleepConditionVariableSRW(RTL_CONDITION_VARIABLE*,RTL_SRWLOCK*,const LARGE_INTEGER*,ULONG);
4196 NTSYSAPI NTSTATUS WINAPI RtlStringFromGUID(REFGUID,PUNICODE_STRING);
4197 NTSYSAPI LPDWORD WINAPI RtlSubAuthoritySid(PSID,DWORD);
4198 NTSYSAPI LPBYTE WINAPI RtlSubAuthorityCountSid(PSID);
4199 NTSYSAPI NTSTATUS WINAPI RtlSystemTimeToLocalTime(const LARGE_INTEGER*,PLARGE_INTEGER);
4200 NTSYSAPI void WINAPI RtlTimeToTimeFields(const LARGE_INTEGER*,PTIME_FIELDS);
4201 NTSYSAPI BOOLEAN WINAPI RtlTimeFieldsToTime(PTIME_FIELDS,PLARGE_INTEGER);
4202 NTSYSAPI void WINAPI RtlTimeToElapsedTimeFields(const LARGE_INTEGER *,PTIME_FIELDS);
4203 NTSYSAPI BOOLEAN WINAPI RtlTimeToSecondsSince1970(const LARGE_INTEGER *,LPDWORD);
4204 NTSYSAPI BOOLEAN WINAPI RtlTimeToSecondsSince1980(const LARGE_INTEGER *,LPDWORD);
4205 NTSYSAPI BOOLEAN WINAPI RtlTryAcquireSRWLockExclusive(RTL_SRWLOCK *);
4206 NTSYSAPI BOOLEAN WINAPI RtlTryAcquireSRWLockShared(RTL_SRWLOCK *);
4207 NTSYSAPI BOOL WINAPI RtlTryEnterCriticalSection(RTL_CRITICAL_SECTION *);
4208 NTSYSAPI NTSTATUS WINAPI RtlUTF8ToUnicodeN(WCHAR*,DWORD,DWORD*,const char*,DWORD);
4209 NTSYSAPI ULONGLONG __cdecl RtlUlonglongByteSwap(ULONGLONG);
4210 NTSYSAPI DWORD WINAPI RtlUnicodeStringToAnsiSize(const UNICODE_STRING*);
4211 NTSYSAPI NTSTATUS WINAPI RtlUnicodeStringToAnsiString(PANSI_STRING,PCUNICODE_STRING,BOOLEAN);
4212 NTSYSAPI NTSTATUS WINAPI RtlUnicodeStringToInteger(const UNICODE_STRING *,ULONG,ULONG *);
4213 NTSYSAPI DWORD WINAPI RtlUnicodeStringToOemSize(const UNICODE_STRING*);
4214 NTSYSAPI NTSTATUS WINAPI RtlUnicodeStringToOemString(POEM_STRING,PCUNICODE_STRING,BOOLEAN);
4215 NTSYSAPI NTSTATUS WINAPI RtlUnicodeToCustomCPN(CPTABLEINFO*,char*,DWORD,DWORD*,const WCHAR*,DWORD);
4216 NTSYSAPI NTSTATUS WINAPI RtlUnicodeToMultiByteN(LPSTR,DWORD,LPDWORD,LPCWSTR,DWORD);
4217 NTSYSAPI NTSTATUS WINAPI RtlUnicodeToMultiByteSize(PULONG,PCWSTR,ULONG);
4218 NTSYSAPI NTSTATUS WINAPI RtlUnicodeToOemN(LPSTR,DWORD,LPDWORD,LPCWSTR,DWORD);
4219 NTSYSAPI NTSTATUS WINAPI RtlUnicodeToUTF8N(LPSTR,DWORD,LPDWORD,LPCWSTR,DWORD);
4220 NTSYSAPI ULONG WINAPI RtlUniform(PULONG);
4221 NTSYSAPI BOOLEAN WINAPI RtlUnlockHeap(HANDLE);
4222 NTSYSAPI void WINAPI RtlUnwind(PVOID,PVOID,PEXCEPTION_RECORD,PVOID);
4223 #ifdef __x86_64__
4224 NTSYSAPI void WINAPI RtlUnwindEx(PVOID,PVOID,PEXCEPTION_RECORD,PVOID,PCONTEXT,PUNWIND_HISTORY_TABLE);
4225 #elif defined(__ia64__)
4226 NTSYSAPI void WINAPI RtlUnwind2(FRAME_POINTERS,PVOID,PEXCEPTION_RECORD,PVOID,PCONTEXT);
4227 NTSYSAPI void WINAPI RtlUnwindEx(FRAME_POINTERS,PVOID,PEXCEPTION_RECORD,PVOID,PCONTEXT,PUNWIND_HISTORY_TABLE);
4228 #endif
4229 NTSYSAPI WCHAR WINAPI RtlUpcaseUnicodeChar(WCHAR);
4230 NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeString(UNICODE_STRING*,const UNICODE_STRING *,BOOLEAN);
4231 NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeStringToAnsiString(STRING*,const UNICODE_STRING*,BOOLEAN);
4232 NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeStringToCountedOemString(STRING*,const UNICODE_STRING*,BOOLEAN);
4233 NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeStringToOemString(STRING*,const UNICODE_STRING*,BOOLEAN);
4234 NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeToCustomCPN(CPTABLEINFO*,char*,DWORD,DWORD*,const WCHAR*,DWORD);
4235 NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeToMultiByteN(LPSTR,DWORD,LPDWORD,LPCWSTR,DWORD);
4236 NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeToOemN(LPSTR,DWORD,LPDWORD,LPCWSTR,DWORD);
4237 NTSYSAPI NTSTATUS WINAPI RtlUpdateTimer(HANDLE, HANDLE, DWORD, DWORD);
4238 NTSYSAPI CHAR WINAPI RtlUpperChar(CHAR);
4239 NTSYSAPI void WINAPI RtlUpperString(STRING *,const STRING *);
4240 NTSYSAPI void WINAPI RtlUserThreadStart(PRTL_THREAD_START_ROUTINE,void*);
4241 NTSYSAPI NTSTATUS WINAPI RtlValidSecurityDescriptor(PSECURITY_DESCRIPTOR);
4242 NTSYSAPI BOOLEAN WINAPI RtlValidRelativeSecurityDescriptor(PSECURITY_DESCRIPTOR,ULONG,SECURITY_INFORMATION);
4243 NTSYSAPI BOOLEAN WINAPI RtlValidAcl(PACL);
4244 NTSYSAPI BOOLEAN WINAPI RtlValidSid(PSID);
4245 NTSYSAPI BOOLEAN WINAPI RtlValidateHeap(HANDLE,ULONG,LPCVOID);
4246 NTSYSAPI NTSTATUS WINAPI RtlVerifyVersionInfo(const RTL_OSVERSIONINFOEXW*,DWORD,DWORDLONG);
4247 NTSYSAPI NTSTATUS WINAPI RtlWaitOnAddress(const void *,const void *,SIZE_T,const LARGE_INTEGER *);
4248 NTSYSAPI void WINAPI RtlWakeAddressAll(const void *);
4249 NTSYSAPI void WINAPI RtlWakeAddressSingle(const void *);
4250 NTSYSAPI void WINAPI RtlWakeAllConditionVariable(RTL_CONDITION_VARIABLE *);
4251 NTSYSAPI void WINAPI RtlWakeConditionVariable(RTL_CONDITION_VARIABLE *);
4252 NTSYSAPI NTSTATUS WINAPI RtlWalkHeap(HANDLE,PVOID);
4253 NTSYSAPI NTSTATUS WINAPI RtlWow64EnableFsRedirection(BOOLEAN);
4254 NTSYSAPI NTSTATUS WINAPI RtlWow64EnableFsRedirectionEx(ULONG,ULONG*);
4255 #ifdef __x86_64__
4256 NTSYSAPI NTSTATUS WINAPI RtlWow64GetThreadContext(HANDLE, WOW64_CONTEXT *);
4257 NTSYSAPI NTSTATUS WINAPI RtlWow64SetThreadContext(HANDLE, const WOW64_CONTEXT *);
4258 #endif
4259 NTSYSAPI NTSTATUS WINAPI RtlWriteRegistryValue(ULONG,PCWSTR,PCWSTR,ULONG,PVOID,ULONG);
4260 NTSYSAPI NTSTATUS WINAPI RtlZombifyActivationContext(HANDLE);
4261 NTSYSAPI NTSTATUS WINAPI RtlpNtCreateKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,PULONG);
4262 NTSYSAPI NTSTATUS WINAPI RtlpNtEnumerateSubKey(HANDLE,UNICODE_STRING *, ULONG);
4263 NTSYSAPI NTSTATUS WINAPI RtlpWaitForCriticalSection(RTL_CRITICAL_SECTION *);
4264 NTSYSAPI NTSTATUS WINAPI RtlpUnWaitCriticalSection(RTL_CRITICAL_SECTION *);
4265 NTSYSAPI NTSTATUS WINAPI vDbgPrintEx(ULONG,ULONG,LPCSTR,__ms_va_list);
4266 NTSYSAPI NTSTATUS WINAPI vDbgPrintExWithPrefix(LPCSTR,ULONG,ULONG,LPCSTR,__ms_va_list);
4267
4268 #if defined(__x86_64__) || defined(__i386__)
4269 NTSYSAPI NTSTATUS WINAPI RtlCopyExtendedContext(CONTEXT_EX*,ULONG,CONTEXT_EX*);
4270 NTSYSAPI NTSTATUS WINAPI RtlInitializeExtendedContext(void*,ULONG,CONTEXT_EX**);
4271 NTSYSAPI NTSTATUS WINAPI RtlInitializeExtendedContext2(void*,ULONG,CONTEXT_EX**,ULONG64);
4272 NTSYSAPI ULONG64 WINAPI RtlGetEnabledExtendedFeatures(ULONG64);
4273 NTSYSAPI NTSTATUS WINAPI RtlGetExtendedContextLength(ULONG,ULONG*);
4274 NTSYSAPI NTSTATUS WINAPI RtlGetExtendedContextLength2(ULONG,ULONG*,ULONG64);
4275 NTSYSAPI void * WINAPI RtlLocateLegacyContext(CONTEXT_EX*,ULONG*);
4276 NTSYSAPI void * WINAPI RtlLocateExtendedFeature(CONTEXT_EX*,ULONG,ULONG*);
4277 NTSYSAPI void * WINAPI RtlLocateExtendedFeature2(CONTEXT_EX*,ULONG,XSTATE_CONFIGURATION*,ULONG*);
4278 NTSYSAPI ULONG64 WINAPI RtlGetExtendedFeaturesMask(CONTEXT_EX*);
4279 NTSYSAPI void WINAPI RtlSetExtendedFeaturesMask(CONTEXT_EX*,ULONG64);
4280 #endif
4281
4282 #ifndef __WINE_USE_MSVCRT
4283 NTSYSAPI int __cdecl _strnicmp(LPCSTR,LPCSTR,size_t);
4284 #endif
4285
4286 /* 32-bit only functions */
4287
4288 #ifndef _WIN64
4289 NTSYSAPI LONGLONG WINAPI RtlConvertLongToLargeInteger(LONG);
4290 NTSYSAPI ULONGLONG WINAPI RtlConvertUlongToLargeInteger(ULONG);
4291 NTSYSAPI LONGLONG WINAPI RtlEnlargedIntegerMultiply(INT,INT);
4292 NTSYSAPI ULONGLONG WINAPI RtlEnlargedUnsignedMultiply(UINT,UINT);
4293 NTSYSAPI UINT WINAPI RtlEnlargedUnsignedDivide(ULONGLONG,UINT,UINT *);
4294 NTSYSAPI LONGLONG WINAPI RtlExtendedMagicDivide(LONGLONG,LONGLONG,INT);
4295 NTSYSAPI LONGLONG WINAPI RtlExtendedIntegerMultiply(LONGLONG,INT);
4296 NTSYSAPI LONGLONG WINAPI RtlExtendedLargeIntegerDivide(LONGLONG,INT,INT *);
4297 NTSYSAPI LONGLONG WINAPI RtlInterlockedCompareExchange64(LONGLONG*,LONGLONG,LONGLONG);
4298 NTSYSAPI LONGLONG WINAPI RtlLargeIntegerAdd(LONGLONG,LONGLONG);
4299 NTSYSAPI LONGLONG WINAPI RtlLargeIntegerArithmeticShift(LONGLONG,INT);
4300 NTSYSAPI ULONGLONG WINAPI RtlLargeIntegerDivide( ULONGLONG,ULONGLONG,ULONGLONG *);
4301 NTSYSAPI LONGLONG WINAPI RtlLargeIntegerNegate(LONGLONG);
4302 NTSYSAPI LONGLONG WINAPI RtlLargeIntegerShiftLeft(LONGLONG,INT);
4303 NTSYSAPI LONGLONG WINAPI RtlLargeIntegerShiftRight(LONGLONG,INT);
4304 NTSYSAPI LONGLONG WINAPI RtlLargeIntegerSubtract(LONGLONG,LONGLONG);
4305 NTSYSAPI NTSTATUS WINAPI RtlLargeIntegerToChar(const ULONGLONG *,ULONG,ULONG,PCHAR);
4306 #endif
4307
4308 /* Threadpool functions */
4309
4310 NTSYSAPI NTSTATUS WINAPI TpAllocCleanupGroup(TP_CLEANUP_GROUP **);
4311 NTSYSAPI NTSTATUS WINAPI TpAllocIoCompletion(TP_IO **,HANDLE,PTP_IO_CALLBACK,void *,TP_CALLBACK_ENVIRON *);
4312 NTSYSAPI NTSTATUS WINAPI TpAllocPool(TP_POOL **,PVOID);
4313 NTSYSAPI NTSTATUS WINAPI TpAllocTimer(TP_TIMER **,PTP_TIMER_CALLBACK,PVOID,TP_CALLBACK_ENVIRON *);
4314 NTSYSAPI NTSTATUS WINAPI TpAllocWait(TP_WAIT **,PTP_WAIT_CALLBACK,PVOID,TP_CALLBACK_ENVIRON *);
4315 NTSYSAPI NTSTATUS WINAPI TpAllocWork(TP_WORK **,PTP_WORK_CALLBACK,PVOID,TP_CALLBACK_ENVIRON *);
4316 NTSYSAPI void WINAPI TpCallbackLeaveCriticalSectionOnCompletion(TP_CALLBACK_INSTANCE *,RTL_CRITICAL_SECTION *);
4317 NTSYSAPI NTSTATUS WINAPI TpCallbackMayRunLong(TP_CALLBACK_INSTANCE *);
4318 NTSYSAPI void WINAPI TpCallbackReleaseMutexOnCompletion(TP_CALLBACK_INSTANCE *,HANDLE);
4319 NTSYSAPI void WINAPI TpCallbackReleaseSemaphoreOnCompletion(TP_CALLBACK_INSTANCE *,HANDLE,DWORD);
4320 NTSYSAPI void WINAPI TpCallbackSetEventOnCompletion(TP_CALLBACK_INSTANCE *,HANDLE);
4321 NTSYSAPI void WINAPI TpCallbackUnloadDllOnCompletion(TP_CALLBACK_INSTANCE *,HMODULE);
4322 NTSYSAPI void WINAPI TpCancelAsyncIoOperation(TP_IO *);
4323 NTSYSAPI void WINAPI TpDisassociateCallback(TP_CALLBACK_INSTANCE *);
4324 NTSYSAPI BOOL WINAPI TpIsTimerSet(TP_TIMER *);
4325 NTSYSAPI void WINAPI TpPostWork(TP_WORK *);
4326 NTSYSAPI NTSTATUS WINAPI TpQueryPoolStackInformation(TP_POOL *, TP_POOL_STACK_INFORMATION *stack_info);
4327 NTSYSAPI void WINAPI TpReleaseCleanupGroup(TP_CLEANUP_GROUP *);
4328 NTSYSAPI void WINAPI TpReleaseCleanupGroupMembers(TP_CLEANUP_GROUP *,BOOL,PVOID);
4329 NTSYSAPI void WINAPI TpReleaseIoCompletion(TP_IO *);
4330 NTSYSAPI void WINAPI TpReleasePool(TP_POOL *);
4331 NTSYSAPI void WINAPI TpReleaseTimer(TP_TIMER *);
4332 NTSYSAPI void WINAPI TpReleaseWait(TP_WAIT *);
4333 NTSYSAPI void WINAPI TpReleaseWork(TP_WORK *);
4334 NTSYSAPI void WINAPI TpSetPoolMaxThreads(TP_POOL *,DWORD);
4335 NTSYSAPI BOOL WINAPI TpSetPoolMinThreads(TP_POOL *,DWORD);
4336 NTSYSAPI NTSTATUS WINAPI TpSetPoolStackInformation(TP_POOL *, TP_POOL_STACK_INFORMATION *stack_info);
4337 NTSYSAPI void WINAPI TpSetTimer(TP_TIMER *, LARGE_INTEGER *,LONG,LONG);
4338 NTSYSAPI void WINAPI TpSetWait(TP_WAIT *,HANDLE,LARGE_INTEGER *);
4339 NTSYSAPI NTSTATUS WINAPI TpSimpleTryPost(PTP_SIMPLE_CALLBACK,PVOID,TP_CALLBACK_ENVIRON *);
4340 NTSYSAPI void WINAPI TpStartAsyncIoOperation(TP_IO *);
4341 NTSYSAPI void WINAPI TpWaitForIoCompletion(TP_IO *,BOOL);
4342 NTSYSAPI void WINAPI TpWaitForTimer(TP_TIMER *,BOOL);
4343 NTSYSAPI void WINAPI TpWaitForWait(TP_WAIT *,BOOL);
4344 NTSYSAPI void WINAPI TpWaitForWork(TP_WORK *,BOOL);
4345
4346 /* Wine internal functions */
4347
4348 NTSYSAPI NTSTATUS CDECL wine_nt_to_unix_file_name( const UNICODE_STRING *nameW, char *nameA, SIZE_T *size,
4349 UINT disposition );
4350 NTSYSAPI NTSTATUS CDECL wine_unix_to_nt_file_name( const char *name, WCHAR *buffer, SIZE_T *size );
4351
4352
4353 /***********************************************************************
4354 * Inline functions
4355 */
4356
4357 #define InitializeObjectAttributes(p,n,a,r,s) \
4358 do { \
4359 (p)->Length = sizeof(OBJECT_ATTRIBUTES); \
4360 (p)->RootDirectory = r; \
4361 (p)->Attributes = a; \
4362 (p)->ObjectName = n; \
4363 (p)->SecurityDescriptor = s; \
4364 (p)->SecurityQualityOfService = NULL; \
4365 } while (0)
4366
4367 #define NtCurrentProcess() ((HANDLE)-1)
4368
4369 #define RtlFillMemory(Destination,Length,Fill) memset((Destination),(Fill),(Length))
4370 #define RtlMoveMemory(Destination,Source,Length) memmove((Destination),(Source),(Length))
4371 #define RtlStoreUlong(p,v) do { ULONG _v = (v); memcpy((p), &_v, sizeof(_v)); } while (0)
4372 #define RtlStoreUlonglong(p,v) do { ULONGLONG _v = (v); memcpy((p), &_v, sizeof(_v)); } while (0)
4373 #define RtlRetrieveUlong(p,s) memcpy((p), (s), sizeof(ULONG))
4374 #define RtlRetrieveUlonglong(p,s) memcpy((p), (s), sizeof(ULONGLONG))
4375 #define RtlZeroMemory(Destination,Length) memset((Destination),0,(Length))
4376
4377 static inline BOOLEAN RtlCheckBit(PCRTL_BITMAP lpBits, ULONG ulBit)
4378 {
4379 if (lpBits && ulBit < lpBits->SizeOfBitMap &&
4380 lpBits->Buffer[ulBit >> 5] & (1 << (ulBit & 31)))
4381 return TRUE;
4382 return FALSE;
4383 }
4384
4385 /* These are implemented as __fastcall, so we can't let Winelib apps link with them */
4386 static inline USHORT RtlUshortByteSwap(USHORT s)
4387 {
4388 return (s >> 8) | (s << 8);
4389 }
4390 static inline ULONG RtlUlongByteSwap(ULONG i)
4391 {
4392 #if defined(__i386__) && defined(__GNUC__)
4393 ULONG ret;
4394 __asm__("bswap %0" : "=r" (ret) : "0" (i) );
4395 return ret;
4396 #else
4397 return ((ULONG)RtlUshortByteSwap((USHORT)i) << 16) | RtlUshortByteSwap((USHORT)(i >> 16));
4398 #endif
4399 }
4400
4401 /* list manipulation macros */
4402 #define InitializeListHead(le) (void)((le)->Flink = (le)->Blink = (le))
4403 #define InsertHeadList(le,e) do { PLIST_ENTRY f = (le)->Flink; (e)->Flink = f; (e)->Blink = (le); f->Blink = (e); (le)->Flink = (e); } while (0)
4404 #define InsertTailList(le,e) do { PLIST_ENTRY b = (le)->Blink; (e)->Flink = (le); (e)->Blink = b; b->Flink = (e); (le)->Blink = (e); } while (0)
4405 #define IsListEmpty(le) ((le)->Flink == (le))
4406 #define RemoveEntryList(e) do { PLIST_ENTRY f = (e)->Flink, b = (e)->Blink; f->Blink = b; b->Flink = f; (e)->Flink = (e)->Blink = NULL; } while (0)
4407 static inline PLIST_ENTRY RemoveHeadList(PLIST_ENTRY le)
4408 {
4409 PLIST_ENTRY f, b, e;
4410
4411 e = le->Flink;
4412 f = le->Flink->Flink;
4413 b = le->Flink->Blink;
4414 f->Blink = b;
4415 b->Flink = f;
4416
4417 if (e != le) e->Flink = e->Blink = NULL;
4418 return e;
4419 }
4420 static inline PLIST_ENTRY RemoveTailList(PLIST_ENTRY le)
4421 {
4422 PLIST_ENTRY f, b, e;
4423
4424 e = le->Blink;
4425 f = le->Blink->Flink;
4426 b = le->Blink->Blink;
4427 f->Blink = b;
4428 b->Flink = f;
4429
4430 if (e != le) e->Flink = e->Blink = NULL;
4431 return e;
4432 }
4433
4434
4435 #ifdef __WINESRC__
4436
4437 /* Wine internal functions */
4438 extern NTSTATUS CDECL __wine_init_unix_lib( HMODULE module, DWORD reason, const void *ptr_in, void *ptr_out );
4439
4440 /* The thread information for 16-bit threads */
4441 /* NtCurrentTeb()->SubSystemTib points to this */
4442 typedef struct
4443 {
4444 void *unknown; /* 00 unknown */
4445 UNICODE_STRING *exe_name; /* 04 exe module name */
4446
4447 /* the following fields do not exist under Windows */
4448 UNICODE_STRING exe_str; /* exe name string pointed to by exe_name */
4449 CURDIR curdir; /* current directory */
4450 WCHAR curdir_buffer[MAX_PATH];
4451 } WIN16_SUBSYSTEM_TIB;
4452
4453 #endif /* __WINESRC__ */
4454
4455 #ifdef __cplusplus
4456 } /* extern "C" */
4457 #endif /* defined(__cplusplus) */
4458
4459 #endif /* __WINE_WINTERNL_H */
Zebediah Figura's local tree