include/ddk/wdm.h

   1 /*
   2  * Copyright 2004-2005 Ivan Leo Puoti
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #ifndef _WDMDDK_
  20 #define _WDMDDK_
  21 #define _NTDDK_
  22
  23 #include <ntstatus.h>
  24
  25 #ifdef _WIN64
  26 #define POINTER_ALIGNMENT DECLSPEC_ALIGN(8)
  27 #else
  28 #define POINTER_ALIGNMENT
  29 #endif
  30
  31 /* FIXME: We suppose that page size is 4096 */
  32 #undef PAGE_SIZE
  33 #undef PAGE_SHIFT
  34 #define PAGE_SIZE   0x1000
  35 #define PAGE_SHIFT  12
  36
  37 #define BYTE_OFFSET(va) ((ULONG)((ULONG_PTR)(va) & (PAGE_SIZE - 1)))
  38 #define PAGE_ALIGN(va)  ((PVOID)((ULONG_PTR)(va) & ~(PAGE_SIZE - 1)))
  39 #define ADDRESS_AND_SIZE_TO_SPAN_PAGES(va, length) \
  40     ((BYTE_OFFSET(va) + ((SIZE_T)(length)) + (PAGE_SIZE - 1)) >> PAGE_SHIFT)
  41
  42 typedef LONG KPRIORITY;
  43
  44 typedef ULONG_PTR KSPIN_LOCK, *PKSPIN_LOCK;
  45
  46 typedef ULONG_PTR ERESOURCE_THREAD;
  47 typedef ERESOURCE_THREAD *PERESOURCE_THREAD;
  48 typedef struct _FILE_GET_QUOTA_INFORMATION *PFILE_GET_QUOTA_INFORMATION;
  49
  50 struct _KDPC;
  51 struct _KAPC;
  52 struct _IRP;
  53 struct _DEVICE_OBJECT;
  54 struct _DRIVER_OBJECT;
  55 struct _KPROCESS;
  56
  57 typedef VOID (WINAPI *PKDEFERRED_ROUTINE)(struct _KDPC *, PVOID, PVOID, PVOID);
  58 typedef VOID (WINAPI *PKSTART_ROUTINE)(PVOID);
  59
  60 typedef NTSTATUS (WINAPI *PDRIVER_INITIALIZE)(struct _DRIVER_OBJECT *, PUNICODE_STRING);
  61 typedef NTSTATUS (WINAPI *PDRIVER_DISPATCH)(struct _DEVICE_OBJECT *, struct _IRP *);
  62 typedef void (WINAPI *PDRIVER_STARTIO)(struct _DEVICE_OBJECT *, struct _IRP *);
  63 typedef void (WINAPI *PDRIVER_UNLOAD)(struct _DRIVER_OBJECT *);
  64 typedef NTSTATUS (WINAPI *PDRIVER_ADD_DEVICE)(struct _DRIVER_OBJECT *, struct _DEVICE_OBJECT *);
  65
  66 typedef struct _DISPATCHER_HEADER {
  67   UCHAR  Type;
  68   UCHAR  Absolute;
  69   UCHAR  Size;
  70   UCHAR  Inserted;
  71   LONG  SignalState;
  72   LIST_ENTRY  WaitListHead;
  73 } DISPATCHER_HEADER, *PDISPATCHER_HEADER;
  74
  75 typedef struct _KEVENT {
  76   DISPATCHER_HEADER  Header;
  77 } KEVENT, *PKEVENT, *RESTRICTED_POINTER PRKEVENT;
  78
  79 typedef struct _KSEMAPHORE {
  80   DISPATCHER_HEADER  Header;
  81   LONG Limit;
  82 } KSEMAPHORE, *PKSEMAPHORE, *PRKSEMAPHORE;
  83
  84 typedef struct _KDPC {
  85   CSHORT  Type;
  86   UCHAR  Number;
  87   UCHAR  Importance;
  88   LIST_ENTRY  DpcListEntry;
  89   PKDEFERRED_ROUTINE  DeferredRoutine;
  90   PVOID  DeferredContext;
  91   PVOID  SystemArgument1;
  92   PVOID  SystemArgument2;
  93   PULONG_PTR  Lock;
  94 } KDPC, *PKDPC, *RESTRICTED_POINTER PRKDPC;
  95
  96 typedef enum _KDPC_IMPORTANCE {
  97   LowImportance,
  98   MediumImportance,
  99   HighImportance,
 100   MediumHighImportance
 101 } KDPC_IMPORTANCE;
 102
 103 typedef struct _KDEVICE_QUEUE_ENTRY {
 104   LIST_ENTRY  DeviceListEntry;
 105   ULONG  SortKey;
 106   BOOLEAN  Inserted;
 107 } KDEVICE_QUEUE_ENTRY, *PKDEVICE_QUEUE_ENTRY,
 108 *RESTRICTED_POINTER PRKDEVICE_QUEUE_ENTRY;
 109
 110 typedef struct _KDEVICE_QUEUE {
 111   CSHORT  Type;
 112   CSHORT  Size;
 113   LIST_ENTRY  DeviceListHead;
 114   KSPIN_LOCK  Lock;
 115   BOOLEAN  Busy;
 116 } KDEVICE_QUEUE, *PKDEVICE_QUEUE, *RESTRICTED_POINTER PRKDEVICE_QUEUE;
 117
 118 typedef struct _KMUTANT {
 119     DISPATCHER_HEADER Header;
 120     LIST_ENTRY MutantListEntry;
 121     struct _KTHREAD *RESTRICTED_POINTER OwnerThread;
 122     BOOLEAN Abandoned;
 123     UCHAR ApcDisable;
 124 } KMUTANT, *PKMUTANT, *RESTRICTED_POINTER PRKMUTANT, KMUTEX, *PKMUTEX, *RESTRICTED_POINTER PRKMUTEX;
 125
 126 typedef struct _DEFERRED_REVERSE_BARRIER
 127 {
 128     ULONG Barrier;
 129     ULONG TotalProcessors;
 130 } DEFERRED_REVERSE_BARRIER;
 131
 132 typedef enum _KWAIT_REASON
 133 {
 134     Executive,
 135     FreePage,
 136     PageIn,
 137     PoolAllocation,
 138     DelayExecution,
 139     Suspended,
 140     UserRequest,
 141     WrExecutive,
 142     WrFreePage,
 143     WrPageIn,
 144     WrDelayExecution,
 145     WrSuspended,
 146     WrUserRequest,
 147     WrQueue,
 148     WrLpcReceive,
 149     WrLpcReply,
 150     WrVirtualMemory,
 151     WrPageOut,
 152     WrRendezvous,
 153     Spare2,
 154     Spare3,
 155     Spare4,
 156     Spare5,
 157     Spare6,
 158     WrKernel,
 159     MaximumWaitReason,
 160 } KWAIT_REASON;
 161
 162 typedef struct _KWAIT_BLOCK {
 163     LIST_ENTRY WaitListEntry;
 164     struct _KTHREAD *RESTRICTED_POINTER Thread;
 165     PVOID Object;
 166     struct _KWAIT_BLOCK *RESTRICTED_POINTER NextWaitBlock;
 167     USHORT WaitKey;
 168     USHORT WaitType;
 169 } KWAIT_BLOCK, *PKWAIT_BLOCK, *RESTRICTED_POINTER PRKWAIT_BLOCK;
 170
 171 typedef struct _OWNER_ENTRY
 172 {
 173     ERESOURCE_THREAD OwnerThread;
 174     union
 175     {
 176         struct
 177         {
 178             ULONG IoPriorityBoosted : 1;
 179             ULONG OwnerReferenced : 1;
 180             ULONG IoQoSPriorityBoosted : 1;
 181             ULONG OwnerCount : 29;
 182         };
 183         ULONG TableSize;
 184     };
 185 } OWNER_ENTRY, *POWNER_ENTRY;
 186
 187 #define ResourceNeverExclusive       0x0010
 188 #define ResourceReleaseByOtherThread 0x0020
 189 #define ResourceOwnedExclusive       0x0080
 190
 191 typedef struct _ERESOURCE
 192 {
 193     LIST_ENTRY SystemResourcesList;
 194     OWNER_ENTRY *OwnerTable;
 195     SHORT ActiveCount;
 196     union
 197     {
 198         USHORT Flag;
 199         struct
 200         {
 201             UCHAR ReservedLowFlags;
 202             UCHAR WaiterPriority;
 203         };
 204     };
 205     KSEMAPHORE *SharedWaiters;
 206     KEVENT *ExclusiveWaiters;
 207     OWNER_ENTRY OwnerEntry;
 208     ULONG ActiveEntries;
 209     ULONG ContentionCount;
 210     ULONG NumberOfSharedWaiters;
 211     ULONG NumberOfExclusiveWaiters;
 212 #ifdef _WIN64
 213     void *Reserved2;
 214 #endif
 215     union
 216     {
 217         void *Address;
 218         ULONG_PTR CreatorBackTraceIndex;
 219     };
 220     KSPIN_LOCK SpinLock;
 221 } ERESOURCE, *PERESOURCE;
 222
 223 typedef struct _IO_TIMER *PIO_TIMER;
 224 typedef struct _IO_TIMER_ROUTINE *PIO_TIMER_ROUTINE;
 225 typedef struct _ETHREAD *PETHREAD;
 226 typedef struct _KTHREAD *PKTHREAD, *PRKTHREAD;
 227 typedef struct _EPROCESS *PEPROCESS;
 228 typedef struct _KPROCESS KPROCESS, *PKPROCESS, *PRKPROCESS;
 229 typedef struct _IO_WORKITEM *PIO_WORKITEM;
 230 typedef struct _OBJECT_TYPE *POBJECT_TYPE;
 231 typedef struct _OBJECT_HANDLE_INFORMATION *POBJECT_HANDLE_INFORMATION;
 232 typedef struct _ZONE_HEADER *PZONE_HEADER;
 233 typedef struct _LOOKASIDE_LIST_EX *PLOOKASIDE_LIST_EX;
 234
 235 typedef struct _KAPC_STATE
 236 {
 237      LIST_ENTRY ApcListHead[2];
 238      PKPROCESS Process;
 239      UCHAR KernelApcInProgress;
 240      UCHAR KernelApcPending;
 241      UCHAR UserApcPending;
 242 } KAPC_STATE, *PKAPC_STATE;
 243
 244 #define FM_LOCK_BIT 0x1
 245
 246 typedef struct _FAST_MUTEX
 247 {
 248     LONG Count;
 249     PKTHREAD Owner;
 250     ULONG Contention;
 251     KEVENT Event;
 252     ULONG OldIrql;
 253 } FAST_MUTEX, *PFAST_MUTEX;
 254
 255 #define MAXIMUM_VOLUME_LABEL_LENGTH       (32 * sizeof(WCHAR))
 256
 257 typedef struct _VPB {
 258   CSHORT  Type;
 259   CSHORT  Size;
 260   USHORT  Flags;
 261   USHORT  VolumeLabelLength;
 262   struct _DEVICE_OBJECT  *DeviceObject;
 263   struct _DEVICE_OBJECT  *RealDevice;
 264   ULONG  SerialNumber;
 265   ULONG  ReferenceCount;
 266   WCHAR  VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH / sizeof(WCHAR)];
 267 } VPB, *PVPB;
 268
 269 #define POOL_QUOTA_FAIL_INSTEAD_OF_RAISE 0x0008
 270 #define POOL_RAISE_IF_ALLOCATION_FAILURE 0x0010
 271 #define POOL_COLD_ALLOCATION             0x0100
 272 #define POOL_NX_ALLOCATION               0x0200
 273
 274 typedef enum _POOL_TYPE {
 275   NonPagedPool,
 276   PagedPool,
 277   NonPagedPoolMustSucceed,
 278   DontUseThisType,
 279   NonPagedPoolCacheAligned,
 280   PagedPoolCacheAligned,
 281   NonPagedPoolCacheAlignedMustS,
 282   MaxPoolType
 283 } POOL_TYPE;
 284
 285 typedef struct _WAIT_CONTEXT_BLOCK {
 286   KDEVICE_QUEUE_ENTRY  WaitQueueEntry;
 287   struct _DRIVER_CONTROL  *DeviceRoutine;
 288   PVOID  DeviceContext;
 289   ULONG  NumberOfMapRegisters;
 290   PVOID  DeviceObject;
 291   PVOID  CurrentIrp;
 292   PKDPC  BufferChainingDpc;
 293 } WAIT_CONTEXT_BLOCK, *PWAIT_CONTEXT_BLOCK;
 294
 295 #define DO_BUFFERED_IO                  0x00000004
 296 #define DO_EXCLUSIVE                    0x00000008
 297 #define DO_DIRECT_IO                    0x00000010
 298 #define DO_MAP_IO_BUFFER                0x00000020
 299 #define DO_DEVICE_INITIALIZING          0x00000080
 300 #define DO_SHUTDOWN_REGISTERED          0x00000800
 301 #define DO_BUS_ENUMERATED_DEVICE        0x00001000
 302 #define DO_POWER_PAGABLE                0x00002000
 303 #define DO_POWER_INRUSH                 0x00004000
 304
 305 #define IO_NO_INCREMENT                     0
 306 #define IO_CD_ROM_INCREMENT                 1
 307 #define IO_DISK_INCREMENT                   1
 308 #define IO_KEYBOARD_INCREMENT               6
 309 #define IO_MAILSLOT_INCREMENT               2
 310 #define IO_MOUSE_INCREMENT                  6
 311 #define IO_NAMED_PIPE_INCREMENT             2
 312 #define IO_NETWORK_INCREMENT                2
 313 #define IO_PARALLEL_INCREMENT               1
 314 #define IO_SERIAL_INCREMENT                 2
 315 #define IO_SOUND_INCREMENT                  8
 316 #define IO_VIDEO_INCREMENT                  1
 317
 318 #ifndef DEVICE_TYPE
 319 #define DEVICE_TYPE ULONG
 320 #endif
 321 #define IRP_MJ_MAXIMUM_FUNCTION           0x1b
 322 #define IRP_MJ_CREATE                     0x00
 323 #define IRP_MJ_CREATE_NAMED_PIPE          0x01
 324 #define IRP_MJ_CLOSE                      0x02
 325 #define IRP_MJ_READ                       0x03
 326 #define IRP_MJ_WRITE                      0x04
 327 #define IRP_MJ_QUERY_INFORMATION          0x05
 328 #define IRP_MJ_SET_INFORMATION            0x06
 329 #define IRP_MJ_QUERY_EA                   0x07
 330 #define IRP_MJ_SET_EA                     0x08
 331 #define IRP_MJ_FLUSH_BUFFERS              0x09
 332 #define IRP_MJ_QUERY_VOLUME_INFORMATION   0x0a
 333 #define IRP_MJ_SET_VOLUME_INFORMATION     0x0b
 334 #define IRP_MJ_DIRECTORY_CONTROL          0x0c
 335 #define IRP_MJ_FILE_SYSTEM_CONTROL        0x0d
 336 #define IRP_MJ_DEVICE_CONTROL             0x0e
 337 #define IRP_MJ_INTERNAL_DEVICE_CONTROL    0x0f
 338 #define IRP_MJ_SHUTDOWN                   0x10
 339 #define IRP_MJ_LOCK_CONTROL               0x11
 340 #define IRP_MJ_CLEANUP                    0x12
 341 #define IRP_MJ_CREATE_MAILSLOT            0x13
 342 #define IRP_MJ_QUERY_SECURITY             0x14
 343 #define IRP_MJ_SET_SECURITY               0x15
 344 #define IRP_MJ_POWER                      0x16
 345 #define IRP_MJ_SYSTEM_CONTROL             0x17
 346 #define IRP_MJ_DEVICE_CHANGE              0x18
 347 #define IRP_MJ_QUERY_QUOTA                0x19
 348 #define IRP_MJ_SET_QUOTA                  0x1a
 349 #define IRP_MJ_PNP                        0x1b
 350
 351 #define IRP_MN_START_DEVICE                 0x00
 352 #define IRP_MN_QUERY_REMOVE_DEVICE          0x01
 353 #define IRP_MN_REMOVE_DEVICE                0x02
 354 #define IRP_MN_CANCEL_REMOVE_DEVICE         0x03
 355 #define IRP_MN_STOP_DEVICE                  0x04
 356 #define IRP_MN_QUERY_STOP_DEVICE            0x05
 357 #define IRP_MN_CANCEL_STOP_DEVICE           0x06
 358 #define IRP_MN_QUERY_DEVICE_RELATIONS       0x07
 359 #define IRP_MN_QUERY_INTERFACE              0x08
 360 #define IRP_MN_QUERY_CAPABILITIES           0x09
 361 #define IRP_MN_QUERY_RESOURCES              0x0A
 362 #define IRP_MN_QUERY_RESOURCE_REQUIREMENTS  0x0B
 363 #define IRP_MN_QUERY_DEVICE_TEXT            0x0C
 364 #define IRP_MN_FILTER_RESOURCE_REQUIREMENTS 0x0D
 365 #define IRP_MN_READ_CONFIG                  0x0F
 366 #define IRP_MN_WRITE_CONFIG                 0x10
 367 #define IRP_MN_EJECT                        0x11
 368 #define IRP_MN_SET_LOCK                     0x12
 369 #define IRP_MN_QUERY_ID                     0x13
 370 #define IRP_MN_QUERY_PNP_DEVICE_STATE       0x14
 371 #define IRP_MN_QUERY_BUS_INFORMATION        0x15
 372 #define IRP_MN_DEVICE_USAGE_NOTIFICATION    0x16
 373 #define IRP_MN_SURPRISE_REMOVAL             0x17
 374 #define IRP_MN_QUERY_LEGACY_BUS_INFORMATION 0x18
 375
 376 #define IRP_MN_WAIT_WAKE                    0x00
 377 #define IRP_MN_POWER_SEQUENCE               0x01
 378 #define IRP_MN_SET_POWER                    0x02
 379 #define IRP_MN_QUERY_POWER                  0x03
 380
 381 #define IRP_QUOTA_CHARGED               0x01
 382 #define IRP_ALLOCATED_MUST_SUCCEED      0x02
 383 #define IRP_ALLOCATED_FIXED_SIZE        0x04
 384 #define IRP_LOOKASIDE_ALLOCATION        0x08
 385
 386 #define IO_TYPE_ADAPTER                 0x01
 387 #define IO_TYPE_CONTROLLER              0x02
 388 #define IO_TYPE_DEVICE                  0x03
 389 #define IO_TYPE_DRIVER                  0x04
 390 #define IO_TYPE_FILE                    0x05
 391 #define IO_TYPE_IRP                     0x06
 392 #define IO_TYPE_MASTER_ADAPTER          0x07
 393 #define IO_TYPE_OPEN_PACKET             0x08
 394 #define IO_TYPE_TIMER                   0x09
 395 #define IO_TYPE_VPB                     0x0a
 396 #define IO_TYPE_ERROR_LOG               0x0b
 397 #define IO_TYPE_ERROR_MESSAGE           0x0c
 398 #define IO_TYPE_DEVICE_OBJECT_EXTENSION 0x0d
 399
 400 typedef struct _DEVICE_OBJECT {
 401   CSHORT  Type;
 402   USHORT  Size;
 403   LONG  ReferenceCount;
 404   struct _DRIVER_OBJECT  *DriverObject;
 405   struct _DEVICE_OBJECT  *NextDevice;
 406   struct _DEVICE_OBJECT  *AttachedDevice;
 407   struct _IRP  *CurrentIrp;
 408   PIO_TIMER  Timer;
 409   ULONG  Flags;
 410   ULONG  Characteristics;
 411   PVPB  Vpb;
 412   PVOID  DeviceExtension;
 413   DEVICE_TYPE  DeviceType;
 414   CCHAR  StackSize;
 415   union {
 416     LIST_ENTRY  ListEntry;
 417     WAIT_CONTEXT_BLOCK  Wcb;
 418   } Queue;
 419   ULONG  AlignmentRequirement;
 420   KDEVICE_QUEUE  DeviceQueue;
 421   KDPC  Dpc;
 422   ULONG  ActiveThreadCount;
 423   PSECURITY_DESCRIPTOR  SecurityDescriptor;
 424   KEVENT  DeviceLock;
 425   USHORT  SectorSize;
 426   USHORT  Spare1;
 427   struct _DEVOBJ_EXTENSION  *DeviceObjectExtension;
 428   PVOID  Reserved;
 429 } DEVICE_OBJECT;
 430 typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT;
 431
 432 typedef struct _DEVICE_RELATIONS {
 433   ULONG Count;
 434   PDEVICE_OBJECT Objects[1];
 435 } DEVICE_RELATIONS;
 436 typedef struct _DEVICE_RELATIONS *PDEVICE_RELATIONS;
 437
 438 typedef struct _DRIVER_EXTENSION {
 439   struct _DRIVER_OBJECT  *DriverObject;
 440   PDRIVER_ADD_DEVICE AddDevice;
 441   ULONG  Count;
 442   UNICODE_STRING  ServiceKeyName;
 443 } DRIVER_EXTENSION, *PDRIVER_EXTENSION;
 444
 445 typedef struct _DRIVER_OBJECT {
 446   CSHORT  Type;
 447   CSHORT  Size;
 448   PDEVICE_OBJECT  DeviceObject;
 449   ULONG  Flags;
 450   PVOID  DriverStart;
 451   ULONG  DriverSize;
 452   PVOID  DriverSection;
 453   PDRIVER_EXTENSION  DriverExtension;
 454   UNICODE_STRING  DriverName;
 455   PUNICODE_STRING  HardwareDatabase;
 456   PVOID  FastIoDispatch;
 457   PDRIVER_INITIALIZE DriverInit;
 458   PDRIVER_STARTIO    DriverStartIo;
 459   PDRIVER_UNLOAD     DriverUnload;
 460   PDRIVER_DISPATCH   MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];
 461 } DRIVER_OBJECT;
 462 typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT;
 463
 464 /* Irp definitions */
 465 typedef UCHAR KIRQL, *PKIRQL;
 466 typedef CCHAR KPROCESSOR_MODE;
 467 typedef enum _KAPC_ENVIRONMENT
 468 {
 469     OriginalApcEnvironment,
 470     AttachedApcEnvironment,
 471     CurrentApcEnvironment,
 472     InsertApcEnvironment
 473 } KAPC_ENVIRONMENT, *PKAPC_ENVIRONMENT;
 474
 475 typedef VOID (WINAPI *PDRIVER_CANCEL)(
 476   IN struct _DEVICE_OBJECT  *DeviceObject,
 477   IN struct _IRP  *Irp);
 478
 479 typedef VOID (WINAPI *PKNORMAL_ROUTINE)(
 480   IN PVOID  NormalContext,
 481   IN PVOID  SystemArgument1,
 482   IN PVOID  SystemArgument2);
 483
 484 typedef VOID (WINAPI *PKKERNEL_ROUTINE)(
 485   IN struct _KAPC  *Apc,
 486   IN OUT PKNORMAL_ROUTINE  *NormalRoutine,
 487   IN OUT PVOID  *NormalContext,
 488   IN OUT PVOID  *SystemArgument1,
 489   IN OUT PVOID  *SystemArgument2);
 490
 491 typedef VOID (WINAPI *PKRUNDOWN_ROUTINE)(
 492   IN struct _KAPC  *Apc);
 493
 494 typedef struct _KAPC {
 495   CSHORT  Type;
 496   CSHORT  Size;
 497   ULONG  Spare0;
 498   struct _KTHREAD  *Thread;
 499   LIST_ENTRY  ApcListEntry;
 500   PKKERNEL_ROUTINE  KernelRoutine;
 501   PKRUNDOWN_ROUTINE  RundownRoutine;
 502   PKNORMAL_ROUTINE  NormalRoutine;
 503   PVOID  NormalContext;
 504   PVOID  SystemArgument1;
 505   PVOID  SystemArgument2;
 506   CCHAR  ApcStateIndex;
 507   KPROCESSOR_MODE  ApcMode;
 508   BOOLEAN  Inserted;
 509 } KAPC, *PKAPC, *RESTRICTED_POINTER PRKAPC;
 510
 511 typedef struct _IRP {
 512   CSHORT  Type;
 513   USHORT  Size;
 514   struct _MDL  *MdlAddress;
 515   ULONG  Flags;
 516   union {
 517     struct _IRP  *MasterIrp;
 518     LONG  IrpCount;
 519     PVOID  SystemBuffer;
 520   } AssociatedIrp;
 521   LIST_ENTRY  ThreadListEntry;
 522   IO_STATUS_BLOCK  IoStatus;
 523   KPROCESSOR_MODE  RequestorMode;
 524   BOOLEAN  PendingReturned;
 525   CHAR  StackCount;
 526   CHAR  CurrentLocation;
 527   BOOLEAN  Cancel;
 528   KIRQL  CancelIrql;
 529   CCHAR  ApcEnvironment;
 530   UCHAR  AllocationFlags;
 531   PIO_STATUS_BLOCK  UserIosb;
 532   PKEVENT  UserEvent;
 533   union {
 534     struct {
 535       PIO_APC_ROUTINE  UserApcRoutine;
 536       PVOID  UserApcContext;
 537     } AsynchronousParameters;
 538     LARGE_INTEGER  AllocationSize;
 539   } Overlay;
 540   PDRIVER_CANCEL  CancelRoutine;
 541   PVOID  UserBuffer;
 542   union {
 543     struct {
 544        union {
 545         KDEVICE_QUEUE_ENTRY  DeviceQueueEntry;
 546         struct {
 547           PVOID  DriverContext[4];
 548         } DUMMYSTRUCTNAME;
 549       } DUMMYUNIONNAME1;
 550       PETHREAD  Thread;
 551       PCHAR  AuxiliaryBuffer;
 552       struct {
 553         LIST_ENTRY  ListEntry;
 554         union {
 555           struct _IO_STACK_LOCATION  *CurrentStackLocation;
 556           ULONG  PacketType;
 557         } DUMMYUNIONNAME2;
 558       } DUMMYSTRUCTNAME;
 559       struct _FILE_OBJECT  *OriginalFileObject;
 560     } Overlay;
 561     KAPC  Apc;
 562     PVOID  CompletionKey;
 563   } Tail;
 564 } IRP;
 565 typedef struct _IRP *PIRP;
 566
 567 #define IRP_NOCACHE               0x0001
 568 #define IRP_PAGING_IO             0x0002
 569 #define IRP_MOUNT_COMPLETION      0x0002
 570 #define IRP_SYNCHRONOUS_API       0x0004
 571 #define IRP_ASSOCIATED_IRP        0x0008
 572 #define IRP_BUFFERED_IO           0x0010
 573 #define IRP_DEALLOCATE_BUFFER     0x0020
 574 #define IRP_INPUT_OPERATION       0x0040
 575 #define IRP_SYNCHRONOUS_PAGING_IO 0x0040
 576 #define IRP_CREATE_OPERATION      0x0080
 577 #define IRP_READ_OPERATION        0x0100
 578 #define IRP_WRITE_OPERATION       0x0200
 579 #define IRP_CLOSE_OPERATION       0x0400
 580 #define IRP_DEFER_IO_COMPLETION   0x0800
 581 #define IRP_OB_QUERY_NAME         0x1000
 582 #define IRP_HOLD_DEVICE_QUEUE     0x2000
 583
 584 typedef VOID (WINAPI *PINTERFACE_REFERENCE)(
 585   PVOID  Context);
 586
 587 typedef VOID (WINAPI *PINTERFACE_DEREFERENCE)(
 588   PVOID Context);
 589
 590 typedef struct _INTERFACE {
 591   USHORT  Size;
 592   USHORT  Version;
 593   PVOID  Context;
 594   PINTERFACE_REFERENCE  InterfaceReference;
 595   PINTERFACE_DEREFERENCE  InterfaceDereference;
 596 } INTERFACE, *PINTERFACE;
 597
 598 typedef struct _SECTION_OBJECT_POINTERS {
 599   PVOID  DataSectionObject;
 600   PVOID  SharedCacheMap;
 601   PVOID  ImageSectionObject;
 602 } SECTION_OBJECT_POINTERS, *PSECTION_OBJECT_POINTERS;
 603
 604 typedef struct _IO_COMPLETION_CONTEXT {
 605   PVOID  Port;
 606   PVOID  Key;
 607 } IO_COMPLETION_CONTEXT, *PIO_COMPLETION_CONTEXT;
 608
 609 typedef enum _DEVICE_RELATION_TYPE {
 610   BusRelations,
 611   EjectionRelations,
 612   PowerRelations,
 613   RemovalRelations,
 614   TargetDeviceRelation,
 615   SingleBusRelations
 616 } DEVICE_RELATION_TYPE, *PDEVICE_RELATION_TYPE;
 617
 618 typedef struct _FILE_OBJECT {
 619   CSHORT  Type;
 620   CSHORT  Size;
 621   PDEVICE_OBJECT  DeviceObject;
 622   PVPB  Vpb;
 623   PVOID  FsContext;
 624   PVOID  FsContext2;
 625   PSECTION_OBJECT_POINTERS  SectionObjectPointer;
 626   PVOID  PrivateCacheMap;
 627   NTSTATUS  FinalStatus;
 628   struct _FILE_OBJECT  *RelatedFileObject;
 629   BOOLEAN  LockOperation;
 630   BOOLEAN  DeletePending;
 631   BOOLEAN  ReadAccess;
 632   BOOLEAN  WriteAccess;
 633   BOOLEAN  DeleteAccess;
 634   BOOLEAN  SharedRead;
 635   BOOLEAN  SharedWrite;
 636   BOOLEAN  SharedDelete;
 637   ULONG  Flags;
 638   UNICODE_STRING  FileName;
 639   LARGE_INTEGER  CurrentByteOffset;
 640   ULONG  Waiters;
 641   ULONG  Busy;
 642   PVOID  LastLock;
 643   KEVENT  Lock;
 644   KEVENT  Event;
 645   PIO_COMPLETION_CONTEXT  CompletionContext;
 646 } FILE_OBJECT;
 647 typedef struct _FILE_OBJECT *PFILE_OBJECT;
 648
 649 #define INITIAL_PRIVILEGE_COUNT           3
 650
 651 typedef struct _INITIAL_PRIVILEGE_SET {
 652   ULONG  PrivilegeCount;
 653   ULONG  Control;
 654   LUID_AND_ATTRIBUTES  Privilege[INITIAL_PRIVILEGE_COUNT];
 655 } INITIAL_PRIVILEGE_SET, * PINITIAL_PRIVILEGE_SET;
 656
 657 typedef struct _SECURITY_SUBJECT_CONTEXT {
 658   PACCESS_TOKEN  ClientToken;
 659   SECURITY_IMPERSONATION_LEVEL  ImpersonationLevel;
 660   PACCESS_TOKEN  PrimaryToken;
 661   PVOID  ProcessAuditId;
 662 } SECURITY_SUBJECT_CONTEXT, *PSECURITY_SUBJECT_CONTEXT;
 663
 664 typedef struct _ACCESS_STATE {
 665   LUID  OperationID;
 666   BOOLEAN  SecurityEvaluated;
 667   BOOLEAN  GenerateAudit;
 668   BOOLEAN  GenerateOnClose;
 669   BOOLEAN  PrivilegesAllocated;
 670   ULONG  Flags;
 671   ACCESS_MASK  RemainingDesiredAccess;
 672   ACCESS_MASK  PreviouslyGrantedAccess;
 673   ACCESS_MASK  OriginalDesiredAccess;
 674   SECURITY_SUBJECT_CONTEXT  SubjectSecurityContext;
 675   PSECURITY_DESCRIPTOR  SecurityDescriptor;
 676   PVOID  AuxData;
 677   union {
 678     INITIAL_PRIVILEGE_SET  InitialPrivilegeSet;
 679     PRIVILEGE_SET  PrivilegeSet;
 680   } Privileges;
 681
 682   BOOLEAN  AuditPrivileges;
 683   UNICODE_STRING  ObjectName;
 684   UNICODE_STRING  ObjectTypeName;
 685 } ACCESS_STATE, *PACCESS_STATE;
 686
 687 typedef struct _IO_SECURITY_CONTEXT {
 688   PSECURITY_QUALITY_OF_SERVICE  SecurityQos;
 689   PACCESS_STATE  AccessState;
 690   ACCESS_MASK  DesiredAccess;
 691   ULONG  FullCreateOptions;
 692 } IO_SECURITY_CONTEXT, *PIO_SECURITY_CONTEXT;
 693
 694 typedef struct _DEVICE_CAPABILITIES {
 695   USHORT  Size;
 696   USHORT  Version;
 697   ULONG  DeviceD1 : 1;
 698   ULONG  DeviceD2 : 1;
 699   ULONG  LockSupported : 1;
 700   ULONG  EjectSupported : 1;
 701   ULONG  Removable : 1;
 702   ULONG  DockDevice : 1;
 703   ULONG  UniqueID : 1;
 704   ULONG  SilentInstall : 1;
 705   ULONG  RawDeviceOK : 1;
 706   ULONG  SurpriseRemovalOK : 1;
 707   ULONG  WakeFromD0 : 1;
 708   ULONG  WakeFromD1 : 1;
 709   ULONG  WakeFromD2 : 1;
 710   ULONG  WakeFromD3 : 1;
 711   ULONG  HardwareDisabled : 1;
 712   ULONG  NonDynamic : 1;
 713   ULONG  WarmEjectSupported : 1;
 714   ULONG  NoDisplayInUI : 1;
 715   ULONG  Reserved : 14;
 716   ULONG  Address;
 717   ULONG  UINumber;
 718   DEVICE_POWER_STATE  DeviceState[PowerSystemMaximum];
 719   SYSTEM_POWER_STATE  SystemWake;
 720   DEVICE_POWER_STATE  DeviceWake;
 721   ULONG  D1Latency;
 722   ULONG  D2Latency;
 723   ULONG  D3Latency;
 724 } DEVICE_CAPABILITIES, *PDEVICE_CAPABILITIES;
 725
 726 typedef struct _DEVICE_INTERFACE_CHANGE_NOTIFICATION {
 727   USHORT Version;
 728   USHORT Size;
 729   GUID Event;
 730   GUID InterfaceClassGuid;
 731   PUNICODE_STRING SymbolicLinkName;
 732 } DEVICE_INTERFACE_CHANGE_NOTIFICATION, *PDEVICE_INTERFACE_CHANGE_NOTIFICATION;
 733
 734 typedef enum _INTERFACE_TYPE {
 735   InterfaceTypeUndefined = -1,
 736   Internal,
 737   Isa,
 738   Eisa,
 739   MicroChannel,
 740   TurboChannel,
 741   PCIBus,
 742   VMEBus,
 743   NuBus,
 744   PCMCIABus,
 745   CBus,
 746   MPIBus,
 747   MPSABus,
 748   ProcessorInternal,
 749   InternalPowerBus,
 750   PNPISABus,
 751   PNPBus,
 752   MaximumInterfaceType
 753 } INTERFACE_TYPE, *PINTERFACE_TYPE;
 754
 755 typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS;
 756
 757 #define IO_RESOURCE_PREFERRED             0x01
 758 #define IO_RESOURCE_DEFAULT               0x02
 759 #define IO_RESOURCE_ALTERNATIVE           0x08
 760
 761 typedef struct _IO_RESOURCE_DESCRIPTOR {
 762   UCHAR  Option;
 763   UCHAR  Type;
 764   UCHAR  ShareDisposition;
 765   UCHAR  Spare1;
 766   USHORT  Flags;
 767   USHORT  Spare2;
 768   union {
 769     struct {
 770       ULONG  Length;
 771       ULONG  Alignment;
 772       PHYSICAL_ADDRESS  MinimumAddress;
 773       PHYSICAL_ADDRESS  MaximumAddress;
 774     } Port;
 775     struct {
 776       ULONG  Length;
 777       ULONG  Alignment;
 778       PHYSICAL_ADDRESS  MinimumAddress;
 779       PHYSICAL_ADDRESS  MaximumAddress;
 780     } Memory;
 781     struct {
 782       ULONG  MinimumVector;
 783       ULONG  MaximumVector;
 784     } Interrupt;
 785     struct {
 786       ULONG  MinimumChannel;
 787       ULONG  MaximumChannel;
 788     } Dma;
 789     struct {
 790       ULONG  Length;
 791       ULONG  Alignment;
 792       PHYSICAL_ADDRESS  MinimumAddress;
 793       PHYSICAL_ADDRESS  MaximumAddress;
 794     } Generic;
 795     struct {
 796       ULONG  Data[3];
 797     } DevicePrivate;
 798     struct {
 799       ULONG  Length;
 800       ULONG  MinBusNumber;
 801       ULONG  MaxBusNumber;
 802       ULONG  Reserved;
 803     } BusNumber;
 804     struct {
 805       ULONG  Priority;
 806       ULONG  Reserved1;
 807       ULONG  Reserved2;
 808     } ConfigData;
 809   } u;
 810 } IO_RESOURCE_DESCRIPTOR, *PIO_RESOURCE_DESCRIPTOR;
 811
 812 typedef struct _IO_RESOURCE_LIST {
 813   USHORT  Version;
 814   USHORT  Revision;
 815   ULONG  Count;
 816   IO_RESOURCE_DESCRIPTOR  Descriptors[1];
 817 } IO_RESOURCE_LIST, *PIO_RESOURCE_LIST;
 818
 819 typedef struct _IO_RESOURCE_REQUIREMENTS_LIST {
 820   ULONG  ListSize;
 821   INTERFACE_TYPE  InterfaceType;
 822   ULONG  BusNumber;
 823   ULONG  SlotNumber;
 824   ULONG  Reserved[3];
 825   ULONG  AlternativeLists;
 826   IO_RESOURCE_LIST  List[1];
 827 } IO_RESOURCE_REQUIREMENTS_LIST, *PIO_RESOURCE_REQUIREMENTS_LIST;
 828
 829 typedef enum _BUS_QUERY_ID_TYPE {
 830   BusQueryDeviceID,
 831   BusQueryHardwareIDs,
 832   BusQueryCompatibleIDs,
 833   BusQueryInstanceID,
 834   BusQueryDeviceSerialNumber
 835 } BUS_QUERY_ID_TYPE, *PBUS_QUERY_ID_TYPE;
 836
 837 typedef enum _CREATE_FILE_TYPE {
 838   CreateFileTypeNone,
 839   CreateFileTypeNamedPipe,
 840   CreateFileTypeMailslot
 841 } CREATE_FILE_TYPE;
 842
 843 typedef enum {
 844   DevicePropertyDeviceDescription,
 845   DevicePropertyHardwareID,
 846   DevicePropertyCompatibleIDs,
 847   DevicePropertyBootConfiguration,
 848   DevicePropertyBootConfigurationTranslated,
 849   DevicePropertyClassName,
 850   DevicePropertyClassGuid,
 851   DevicePropertyDriverKeyName,
 852   DevicePropertyManufacturer,
 853   DevicePropertyFriendlyName,
 854   DevicePropertyLocationInformation,
 855   DevicePropertyPhysicalDeviceObjectName,
 856   DevicePropertyBusTypeGuid,
 857   DevicePropertyLegacyBusType,
 858   DevicePropertyBusNumber,
 859   DevicePropertyEnumeratorName,
 860   DevicePropertyAddress,
 861   DevicePropertyUINumber,
 862   DevicePropertyInstallState,
 863   DevicePropertyRemovalPolicy
 864 } DEVICE_REGISTRY_PROPERTY;
 865
 866 typedef enum _DEVICE_TEXT_TYPE {
 867   DeviceTextDescription,
 868   DeviceTextLocationInformation
 869 } DEVICE_TEXT_TYPE, *PDEVICE_TEXT_TYPE;
 870
 871 typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE {
 872   DeviceUsageTypeUndefined,
 873   DeviceUsageTypePaging,
 874   DeviceUsageTypeHibernation,
 875   DeviceUsageTypeDumpFile
 876 } DEVICE_USAGE_NOTIFICATION_TYPE;
 877
 878 typedef struct _POWER_SEQUENCE {
 879   ULONG  SequenceD1;
 880   ULONG  SequenceD2;
 881   ULONG  SequenceD3;
 882 } POWER_SEQUENCE, *PPOWER_SEQUENCE;
 883
 884 typedef enum _POWER_STATE_TYPE {
 885   SystemPowerState,
 886   DevicePowerState
 887 } POWER_STATE_TYPE, *PPOWER_STATE_TYPE;
 888
 889 typedef union _POWER_STATE {
 890   SYSTEM_POWER_STATE  SystemState;
 891   DEVICE_POWER_STATE  DeviceState;
 892 } POWER_STATE, *PPOWER_STATE;
 893
 894 typedef struct _CM_PARTIAL_RESOURCE_DESCRIPTOR {
 895   UCHAR Type;
 896   UCHAR ShareDisposition;
 897   USHORT Flags;
 898   union {
 899     struct {
 900       PHYSICAL_ADDRESS Start;
 901       ULONG Length;
 902     } Generic;
 903     struct {
 904       PHYSICAL_ADDRESS Start;
 905       ULONG Length;
 906     } Port;
 907     struct {
 908       ULONG Level;
 909       ULONG Vector;
 910       ULONG Affinity;
 911     } Interrupt;
 912     struct {
 913       PHYSICAL_ADDRESS Start;
 914       ULONG Length;
 915     } Memory;
 916     struct {
 917       ULONG Channel;
 918       ULONG Port;
 919       ULONG Reserved1;
 920     } Dma;
 921     struct {
 922       ULONG Data[3];
 923     } DevicePrivate;
 924     struct {
 925       ULONG Start;
 926       ULONG Length;
 927       ULONG Reserved;
 928     } BusNumber;
 929     struct {
 930       ULONG DataSize;
 931       ULONG Reserved1;
 932       ULONG Reserved2;
 933     } DeviceSpecificData;
 934   } u;
 935 } CM_PARTIAL_RESOURCE_DESCRIPTOR, *PCM_PARTIAL_RESOURCE_DESCRIPTOR;
 936
 937 typedef struct _CM_PARTIAL_RESOURCE_LIST {
 938   USHORT  Version;
 939   USHORT  Revision;
 940   ULONG  Count;
 941   CM_PARTIAL_RESOURCE_DESCRIPTOR PartialDescriptors[1];
 942 } CM_PARTIAL_RESOURCE_LIST, *PCM_PARTIAL_RESOURCE_LIST;
 943
 944 typedef struct _CM_FULL_RESOURCE_DESCRIPTOR {
 945   INTERFACE_TYPE  InterfaceType;
 946   ULONG  BusNumber;
 947   CM_PARTIAL_RESOURCE_LIST  PartialResourceList;
 948 } CM_FULL_RESOURCE_DESCRIPTOR, *PCM_FULL_RESOURCE_DESCRIPTOR;
 949
 950 typedef struct _CM_RESOURCE_LIST {
 951   ULONG  Count;
 952   CM_FULL_RESOURCE_DESCRIPTOR  List[1];
 953 } CM_RESOURCE_LIST, *PCM_RESOURCE_LIST;
 954
 955 typedef NTSTATUS (WINAPI *PIO_COMPLETION_ROUTINE)(
 956   IN struct _DEVICE_OBJECT  *DeviceObject,
 957   IN struct _IRP  *Irp,
 958   IN PVOID  Context);
 959
 960 #define SL_PENDING_RETURNED             0x01
 961 #define SL_INVOKE_ON_CANCEL             0x20
 962 #define SL_INVOKE_ON_SUCCESS            0x40
 963 #define SL_INVOKE_ON_ERROR              0x80
 964
 965 #if !defined(_WIN64)
 966 #include <pshpack4.h>
 967 #endif
 968 typedef struct _IO_STACK_LOCATION {
 969   UCHAR  MajorFunction;
 970   UCHAR  MinorFunction;
 971   UCHAR  Flags;
 972   UCHAR  Control;
 973   union {
 974     struct {
 975       PIO_SECURITY_CONTEXT  SecurityContext;
 976       ULONG  Options;
 977       USHORT POINTER_ALIGNMENT  FileAttributes;
 978       USHORT  ShareAccess;
 979       ULONG POINTER_ALIGNMENT  EaLength;
 980     } Create;
 981     struct {
 982       ULONG  Length;
 983       ULONG POINTER_ALIGNMENT  Key;
 984       LARGE_INTEGER  ByteOffset;
 985     } Read;
 986     struct {
 987       ULONG  Length;
 988       ULONG POINTER_ALIGNMENT  Key;
 989       LARGE_INTEGER  ByteOffset;
 990     } Write;
 991     struct {
 992       ULONG  Length;
 993       FILE_INFORMATION_CLASS POINTER_ALIGNMENT  FileInformationClass;
 994     } QueryFile;
 995     struct {
 996       ULONG  Length;
 997       FILE_INFORMATION_CLASS POINTER_ALIGNMENT  FileInformationClass;
 998       PFILE_OBJECT  FileObject;
 999       union {
1000         struct {
1001           BOOLEAN  ReplaceIfExists;
1002           BOOLEAN  AdvanceOnly;
1003         } DUMMYSTRUCTNAME;
1004         ULONG  ClusterCount;
1005         HANDLE  DeleteHandle;
1006       } DUMMYUNIONNAME;
1007     } SetFile;
1008     struct {
1009       ULONG  Length;
1010       FS_INFORMATION_CLASS POINTER_ALIGNMENT  FsInformationClass;
1011     } QueryVolume;
1012     struct {
1013       ULONG  OutputBufferLength;
1014       ULONG POINTER_ALIGNMENT  InputBufferLength;
1015       ULONG POINTER_ALIGNMENT  IoControlCode;
1016       PVOID  Type3InputBuffer;
1017     } DeviceIoControl;
1018     struct {
1019       SECURITY_INFORMATION  SecurityInformation;
1020       ULONG POINTER_ALIGNMENT  Length;
1021     } QuerySecurity;
1022     struct {
1023       SECURITY_INFORMATION  SecurityInformation;
1024       PSECURITY_DESCRIPTOR  SecurityDescriptor;
1025     } SetSecurity;
1026     struct {
1027       PVPB  Vpb;
1028       PDEVICE_OBJECT  DeviceObject;
1029     } MountVolume;
1030     struct {
1031       PVPB  Vpb;
1032       PDEVICE_OBJECT  DeviceObject;
1033     } VerifyVolume;
1034     struct {
1035       struct _SCSI_REQUEST_BLOCK  *Srb;
1036     } Scsi;
1037     struct {
1038       DEVICE_RELATION_TYPE  Type;
1039     } QueryDeviceRelations;
1040     struct {
1041       const GUID  *InterfaceType;
1042       USHORT  Size;
1043       USHORT  Version;
1044       PINTERFACE  Interface;
1045       PVOID  InterfaceSpecificData;
1046     } QueryInterface;
1047     struct {
1048       PDEVICE_CAPABILITIES  Capabilities;
1049     } DeviceCapabilities;
1050     struct {
1051       PIO_RESOURCE_REQUIREMENTS_LIST  IoResourceRequirementList;
1052     } FilterResourceRequirements;
1053     struct {
1054       ULONG  WhichSpace;
1055       PVOID  Buffer;
1056       ULONG  Offset;
1057       ULONG POINTER_ALIGNMENT  Length;
1058     } ReadWriteConfig;
1059     struct {
1060       BOOLEAN  Lock;
1061     } SetLock;
1062     struct {
1063       BUS_QUERY_ID_TYPE  IdType;
1064     } QueryId;
1065     struct {
1066       DEVICE_TEXT_TYPE  DeviceTextType;
1067       LCID POINTER_ALIGNMENT  LocaleId;
1068     } QueryDeviceText;
1069     struct {
1070       BOOLEAN  InPath;
1071       BOOLEAN  Reserved[3];
1072       DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT  Type;
1073     } UsageNotification;
1074     struct {
1075       SYSTEM_POWER_STATE  PowerState;
1076     } WaitWake;
1077     struct {
1078       PPOWER_SEQUENCE  PowerSequence;
1079     } PowerSequence;
1080     struct {
1081       ULONG  SystemContext;
1082       POWER_STATE_TYPE POINTER_ALIGNMENT  Type;
1083       POWER_STATE POINTER_ALIGNMENT  State;
1084       POWER_ACTION POINTER_ALIGNMENT  ShutdownType;
1085     } Power;
1086     struct {
1087       PCM_RESOURCE_LIST  AllocatedResources;
1088       PCM_RESOURCE_LIST  AllocatedResourcesTranslated;
1089     } StartDevice;
1090     struct {
1091       ULONG_PTR  ProviderId;
1092       PVOID  DataPath;
1093       ULONG  BufferSize;
1094       PVOID  Buffer;
1095     } WMI;
1096     struct {
1097       PVOID  Argument1;
1098       PVOID  Argument2;
1099       PVOID  Argument3;
1100       PVOID  Argument4;
1101     } Others;
1102   } Parameters;
1103   PDEVICE_OBJECT  DeviceObject;
1104   PFILE_OBJECT  FileObject;
1105   PIO_COMPLETION_ROUTINE  CompletionRoutine;
1106   PVOID  Context;
1107 } IO_STACK_LOCATION, *PIO_STACK_LOCATION;
1108 #if !defined(_WIN64)
1109 #include <poppack.h>
1110 #endif
1111
1112 /* MDL definitions */
1113
1114 #define MDL_MAPPED_TO_SYSTEM_VA     0x0001
1115 #define MDL_PAGES_LOCKED            0x0002
1116 #define MDL_SOURCE_IS_NONPAGED_POOL 0x0004
1117 #define MDL_ALLOCATED_FIXED_SIZE    0x0008
1118 #define MDL_PARTIAL                 0x0010
1119 #define MDL_PARTIAL_HAS_BEEN_MAPPED 0x0020
1120 #define MDL_IO_PAGE_READ            0x0040
1121 #define MDL_WRITE_OPERATION         0x0080
1122 #define MDL_PARENT_MAPPED_SYSTEM_VA 0x0100
1123 #define MDL_FREE_EXTRA_PTES         0x0200
1124 #define MDL_DESCRIBES_AWE           0x0400
1125 #define MDL_IO_SPACE                0x0800
1126 #define MDL_NETWORK_HEADER          0x1000
1127 #define MDL_MAPPING_CAN_FAIL        0x2000
1128 #define MDL_ALLOCATED_MUST_SUCCEED  0x4000
1129 #define MDL_INTERNAL                0x8000
1130
1131 #define MDL_MAPPING_FLAGS (MDL_MAPPED_TO_SYSTEM_VA     | \
1132                            MDL_PAGES_LOCKED            | \
1133                            MDL_SOURCE_IS_NONPAGED_POOL | \
1134                            MDL_PARTIAL_HAS_BEEN_MAPPED | \
1135                            MDL_PARENT_MAPPED_SYSTEM_VA | \
1136                            MDL_SYSTEM_VA               | \
1137                            MDL_IO_SPACE )
1138
1139 typedef struct _MDL {
1140   struct _MDL  *Next;
1141   CSHORT  Size;
1142   CSHORT  MdlFlags;
1143   struct _EPROCESS  *Process;
1144   PVOID  MappedSystemVa;
1145   PVOID  StartVa;
1146   ULONG  ByteCount;
1147   ULONG  ByteOffset;
1148 } MDL, *PMDL;
1149
1150 typedef MDL *PMDLX;
1151 typedef ULONG PFN_NUMBER, *PPFN_NUMBER;
1152
1153 static inline void MmInitializeMdl(MDL *mdl, void *va, SIZE_T length)
1154 {
1155     mdl->Next       = NULL;
1156     mdl->Size       = sizeof(MDL) + sizeof(PFN_NUMBER) * ADDRESS_AND_SIZE_TO_SPAN_PAGES(va, length);
1157     mdl->MdlFlags   = 0;
1158     mdl->StartVa    = (void *)PAGE_ALIGN(va);
1159     mdl->ByteOffset = BYTE_OFFSET(va);
1160     mdl->ByteCount  = length;
1161 }
1162
1163 typedef struct _KTIMER {
1164     DISPATCHER_HEADER Header;
1165     ULARGE_INTEGER DueTime;
1166     LIST_ENTRY TimerListEntry;
1167     struct _KDPC *Dpc;
1168     LONG Period;
1169 } KTIMER, *PKTIMER;
1170
1171 typedef struct _KSYSTEM_TIME {
1172     ULONG LowPart;
1173     LONG High1Time;
1174     LONG High2Time;
1175 } KSYSTEM_TIME, *PKSYSTEM_TIME;
1176
1177 typedef enum _NT_PRODUCT_TYPE {
1178     NtProductWinNt = 1,
1179     NtProductLanManNt,
1180     NtProductServer
1181 } NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;
1182
1183 #define PROCESSOR_FEATURE_MAX 64
1184
1185 typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
1186 {
1187    StandardDesign,
1188    NEC98x86,
1189    EndAlternatives
1190 } ALTERNATIVE_ARCHITECTURE_TYPE;
1191
1192 #define NX_SUPPORT_POLICY_ALWAYSOFF     0
1193 #define NX_SUPPORT_POLICY_ALWAYSON      1
1194 #define NX_SUPPORT_POLICY_OPTIN         2
1195 #define NX_SUPPORT_POLICY_OPTOUT        3
1196
1197 #define XSTATE_LEGACY_FLOATING_POINT        0
1198 #define XSTATE_LEGACY_SSE                   1
1199 #define XSTATE_GSSE                         2
1200
1201 #define XSTATE_MASK_LEGACY_FLOATING_POINT   (1 << XSTATE_LEGACY_FLOATING_POINT)
1202 #define XSTATE_MASK_LEGACY_SSE              (1 << XSTATE_LEGACY_SSE)
1203 #define XSTATE_MASK_LEGACY                  (XSTATE_MASK_LEGACY_FLOATING_POINT | XSTATE_MASK_LEGACY_SSE)
1204 #define XSTATE_MASK_GSSE                    (1 << XSTATE_GSSE)
1205
1206 #define MAXIMUM_XSTATE_FEATURES             64
1207
1208 typedef struct _XSTATE_FEATURE
1209 {
1210     ULONG Offset;
1211     ULONG Size;
1212 } XSTATE_FEATURE, *PXSTATE_FEATURE;
1213
1214 typedef struct _XSTATE_CONFIGURATION
1215 {
1216     ULONG64 EnabledFeatures;
1217     ULONG64 EnabledVolatileFeatures;
1218     ULONG Size;
1219     ULONG OptimizedSave:1;
1220     ULONG CompactionEnabled:1;
1221     XSTATE_FEATURE Features[MAXIMUM_XSTATE_FEATURES];
1222
1223     ULONG64 EnabledSupervisorFeatures;
1224     ULONG64 AlignedFeatures;
1225     ULONG AllFeatureSize;
1226     ULONG AllFeatures[MAXIMUM_XSTATE_FEATURES];
1227     ULONG64 EnabledUserVisibleSupervisorFeatures;
1228 } XSTATE_CONFIGURATION, *PXSTATE_CONFIGURATION;
1229
1230 typedef struct _KUSER_SHARED_DATA {
1231     ULONG TickCountLowDeprecated;                          /* 0x000 */
1232     ULONG TickCountMultiplier;                             /* 0x004 */
1233     volatile KSYSTEM_TIME InterruptTime;                   /* 0x008 */
1234     volatile KSYSTEM_TIME SystemTime;                      /* 0x014 */
1235     volatile KSYSTEM_TIME TimeZoneBias;                    /* 0x020 */
1236     USHORT ImageNumberLow;                                 /* 0x02c */
1237     USHORT ImageNumberHigh;                                /* 0x02e */
1238     WCHAR NtSystemRoot[260];                               /* 0x030 */
1239     ULONG MaxStackTraceDepth;                              /* 0x238 */
1240     ULONG CryptoExponent;                                  /* 0x23c */
1241     ULONG TimeZoneId;                                      /* 0x240 */
1242     ULONG LargePageMinimum;                                /* 0x244 */
1243     ULONG AitSamplingValue;                                /* 0x248 */
1244     ULONG AppCompatFlag;                                   /* 0x24c */
1245     ULONGLONG RNGSeedVersion;                              /* 0x250 */
1246     ULONG GlobalValidationRunLevel;                        /* 0x258 */
1247     volatile ULONG TimeZoneBiasStamp;                      /* 0x25c */
1248     ULONG NtBuildNumber;                                   /* 0x260 */
1249     NT_PRODUCT_TYPE NtProductType;                         /* 0x264 */
1250     BOOLEAN ProductTypeIsValid;                            /* 0x268 */
1251     USHORT NativeProcessorArchitecture;                    /* 0x26a */
1252     ULONG NtMajorVersion;                                  /* 0x26c */
1253     ULONG NtMinorVersion;                                  /* 0x270 */
1254     BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];      /* 0x274 */
1255     ULONG Reserved1;                                       /* 0x2b4 */
1256     ULONG Reserved3;                                       /* 0x2b8 */
1257     volatile ULONG TimeSlip;                               /* 0x2bc */
1258     ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture; /* 0x2c0 */
1259     ULONG BootId;                                          /* 0x2c4 */
1260     LARGE_INTEGER SystemExpirationDate;                    /* 0x2c8 */
1261     ULONG SuiteMask;                                       /* 0x2d0 */
1262     BOOLEAN KdDebuggerEnabled;                             /* 0x2d4 */
1263     UCHAR NXSupportPolicy;                                 /* 0x2d5 */
1264     USHORT CyclesPerYield;                                 /* 0x2d6 */
1265     volatile ULONG ActiveConsoleId;                        /* 0x2d8 */
1266     volatile ULONG DismountCount;                          /* 0x2dc */
1267     ULONG ComPlusPackage;                                  /* 0x2e0 */
1268     ULONG LastSystemRITEventTickCount;                     /* 0x2e4 */
1269     ULONG NumberOfPhysicalPages;                           /* 0x2e8 */
1270     BOOLEAN SafeBootMode;                                  /* 0x2ec */
1271     UCHAR VirtualizationFlags;                             /* 0x2ed */
1272     union {
1273         ULONG SharedDataFlags;                             /* 0x2f0 */
1274         struct {
1275             ULONG DbgErrorPortPresent       : 1;
1276             ULONG DbgElevationEnabed        : 1;
1277             ULONG DbgVirtEnabled            : 1;
1278             ULONG DbgInstallerDetectEnabled : 1;
1279             ULONG DbgLkgEnabled             : 1;
1280             ULONG DbgDynProcessorEnabled    : 1;
1281             ULONG DbgConsoleBrokerEnabled   : 1;
1282             ULONG DbgSecureBootEnabled      : 1;
1283             ULONG DbgMultiSessionSku        : 1;
1284             ULONG DbgMultiUsersInSessionSku : 1;
1285             ULONG DbgStateSeparationEnabled : 1;
1286             ULONG SpareBits                 : 21;
1287         } DUMMYSTRUCTNAME2;
1288     } DUMMYUNIONNAME2;
1289     ULONG DataFlagsPad[1];                                 /* 0x2f4 */
1290     ULONGLONG TestRetInstruction;                          /* 0x2f8 */
1291     LONGLONG QpcFrequency;                                 /* 0x300 */
1292     ULONG SystemCall;                                      /* 0x308 */
1293     union {
1294         ULONG AllFlags;                                    /* 0x30c */
1295         struct {
1296             ULONG Win32Process            : 1;
1297             ULONG Sgx2Enclave             : 1;
1298             ULONG VbsBasicEnclave         : 1;
1299             ULONG SpareBits               : 29;
1300         } DUMMYSTRUCTNAME;
1301     } UserCetAvailableEnvironments;
1302     ULONGLONG SystemCallPad[2];                            /* 0x310 */
1303     union {
1304         volatile KSYSTEM_TIME TickCount;                   /* 0x320 */
1305         volatile ULONG64 TickCountQuad;
1306     } DUMMYUNIONNAME;
1307     ULONG Cookie;                                          /* 0x330 */
1308     ULONG CookiePad[1];                                    /* 0x334 */
1309     LONGLONG ConsoleSessionForegroundProcessId;            /* 0x338 */
1310     ULONGLONG TimeUpdateLock;                              /* 0x340 */
1311     ULONGLONG BaselineSystemTimeQpc;                       /* 0x348 */
1312     ULONGLONG BaselineInterruptTimeQpc;                    /* 0x350 */
1313     ULONGLONG QpcSystemTimeIncrement;                      /* 0x358 */
1314     ULONGLONG QpcInterruptTimeIncrement;                   /* 0x360 */
1315     UCHAR QpcSystemTimeIncrementShift;                     /* 0x368 */
1316     UCHAR QpcInterruptTimeIncrementShift;                  /* 0x369 */
1317     USHORT UnparkedProcessorCount;                         /* 0x36a */
1318     ULONG EnclaveFeatureMask[4];                           /* 0x36c */
1319     ULONG TelemetryCoverageRound;                          /* 0x37c */
1320     USHORT UserModeGlobalLogger[16];                       /* 0x380 */
1321     ULONG ImageFileExecutionOptions;                       /* 0x3a0 */
1322     ULONG LangGenerationCount;                             /* 0x3a4 */
1323     ULONG ActiveProcessorAffinity;                         /* 0x3a8 */
1324     volatile ULONGLONG InterruptTimeBias;                  /* 0x3b0 */
1325     volatile ULONGLONG QpcBias;                            /* 0x3b8 */
1326     ULONG ActiveProcessorCount;                            /* 0x3c0 */
1327     volatile UCHAR ActiveGroupCount;                       /* 0x3c4 */
1328     USHORT QpcData;                                        /* 0x3c6 */
1329     LARGE_INTEGER TimeZoneBiasEffectiveStart;              /* 0x3c8 */
1330     LARGE_INTEGER TimeZoneBiasEffectiveEnd;                /* 0x3d0 */
1331     XSTATE_CONFIGURATION XState;                           /* 0x3d8 */
1332 } KSHARED_USER_DATA, *PKSHARED_USER_DATA;
1333
1334 typedef enum _MEMORY_CACHING_TYPE {
1335     MmNonCached = 0,
1336     MmCached = 1,
1337     MmWriteCombined = 2,
1338     MmHardwareCoherentCached = 3,
1339     MmNonCachedUnordered = 4,
1340     MmUSWCCached = 5,
1341     MmMaximumCacheType = 6
1342 } MEMORY_CACHING_TYPE;
1343
1344 typedef enum _MM_PAGE_PRIORITY {
1345     LowPagePriority,
1346     NormalPagePriority = 16,
1347     HighPagePriority = 32
1348 } MM_PAGE_PRIORITY;
1349
1350 typedef enum _MM_SYSTEM_SIZE
1351 {
1352     MmSmallSystem,
1353     MmMediumSystem,
1354     MmLargeSystem
1355 } MM_SYSTEMSIZE;
1356
1357 typedef struct _IO_REMOVE_LOCK_COMMON_BLOCK {
1358     BOOLEAN Removed;
1359     BOOLEAN Reserved[3];
1360     LONG IoCount;
1361     KEVENT RemoveEvent;
1362 } IO_REMOVE_LOCK_COMMON_BLOCK;
1363
1364 typedef struct _IO_REMOVE_LOCK_TRACKING_BLOCK *PIO_REMOVE_LOCK_TRACKING_BLOCK;
1365
1366 typedef struct _IO_REMOVE_LOCK_DBG_BLOCK {
1367     LONG Signature;
1368     LONG HighWatermark;
1369     LONGLONG MaxLockedTicks;
1370     LONG AllocateTag;
1371     LIST_ENTRY LockList;
1372     KSPIN_LOCK Spin;
1373     LONG LowMemoryCount;
1374     ULONG Reserved1[4];
1375     PVOID Reserved2;
1376     PIO_REMOVE_LOCK_TRACKING_BLOCK Blocks;
1377 } IO_REMOVE_LOCK_DBG_BLOCK;
1378
1379 typedef struct _IO_REMOVE_LOCK {
1380     IO_REMOVE_LOCK_COMMON_BLOCK Common;
1381     IO_REMOVE_LOCK_DBG_BLOCK Dbg;
1382 } IO_REMOVE_LOCK, *PIO_REMOVE_LOCK;
1383
1384 typedef enum  {
1385     IoReadAccess,
1386     IoWriteAccess,
1387     IoModifyAccess
1388 } LOCK_OPERATION;
1389
1390 typedef struct _CALLBACK_OBJECT
1391 {
1392     ULONG Signature;
1393     KSPIN_LOCK Lock;
1394     LIST_ENTRY RegisteredCallbacks;
1395     BOOLEAN AllowMultipleCallbacks;
1396     UCHAR reserved[3];
1397 } CALLBACK_OBJECT, *PCALLBACK_OBJECT;
1398
1399 typedef struct _KSPIN_LOCK_QUEUE {
1400     struct _KSPIN_LOCK_QUEUE * volatile Next;
1401     volatile PKSPIN_LOCK Lock;
1402 } KSPIN_LOCK_QUEUE, *PKSPIN_LOCK_QUEUE;
1403
1404 typedef struct _KLOCK_QUEUE_HANDLE {
1405     KSPIN_LOCK_QUEUE LockQueue;
1406     KIRQL OldIrql;
1407 } KLOCK_QUEUE_HANDLE, *PKLOCK_QUEUE_HANDLE;
1408
1409 typedef void * (NTAPI *PALLOCATE_FUNCTION)(POOL_TYPE, SIZE_T, ULONG);
1410 typedef void * (NTAPI *PALLOCATE_FUNCTION_EX)(POOL_TYPE, SIZE_T, ULONG, PLOOKASIDE_LIST_EX);
1411 typedef void (NTAPI *PFREE_FUNCTION)(void *);
1412 typedef void (NTAPI *PFREE_FUNCTION_EX)(void *, PLOOKASIDE_LIST_EX);
1413 typedef void (NTAPI *PCALLBACK_FUNCTION)(void *, void *, void *);
1414
1415 #ifdef _WIN64
1416 #define LOOKASIDE_ALIGN DECLSPEC_CACHEALIGN
1417 #else
1418 #define LOOKASIDE_ALIGN
1419 #endif
1420
1421 #define LOOKASIDE_MINIMUM_BLOCK_SIZE (RTL_SIZEOF_THROUGH_FIELD(SLIST_ENTRY, Next))
1422
1423 #define GENERAL_LOOKASIDE_LAYOUT           \
1424     union                                  \
1425     {                                      \
1426         SLIST_HEADER ListHead;             \
1427         SINGLE_LIST_ENTRY SingleListHead;  \
1428     } DUMMYUNIONNAME;                      \
1429     USHORT Depth;                          \
1430     USHORT MaximumDepth;                   \
1431     ULONG TotalAllocates;                  \
1432     union                                  \
1433     {                                      \
1434         ULONG AllocateMisses;              \
1435         ULONG AllocateHits;                \
1436     } DUMMYUNIONNAME2;                     \
1437     ULONG TotalFrees;                      \
1438     union                                  \
1439     {                                      \
1440         ULONG FreeMisses;                  \
1441         ULONG FreeHits;                    \
1442     } DUMMYUNIONNAME3;                     \
1443     POOL_TYPE Type;                        \
1444     ULONG Tag;                             \
1445     ULONG Size;                            \
1446     union                                  \
1447     {                                      \
1448         PALLOCATE_FUNCTION_EX AllocateEx;  \
1449         PALLOCATE_FUNCTION Allocate;       \
1450     } DUMMYUNIONNAME4;                     \
1451     union                                  \
1452     {                                      \
1453         PFREE_FUNCTION_EX FreeEx;          \
1454         PFREE_FUNCTION Free;               \
1455     } DUMMYUNIONNAME5;                     \
1456     LIST_ENTRY ListEntry;                  \
1457     ULONG LastTotalAllocates;              \
1458     union                                  \
1459     {                                      \
1460         ULONG LastAllocateMisses;          \
1461         ULONG LastAllocateHits;            \
1462     } DUMMYUNIONNAME6;                     \
1463     ULONG Future[2];
1464
1465 typedef struct LOOKASIDE_ALIGN _GENERAL_LOOKASIDE
1466 {
1467     GENERAL_LOOKASIDE_LAYOUT
1468 } GENERAL_LOOKASIDE;
1469
1470 typedef struct _GENERAL_LOOKASIDE_POOL
1471 {
1472     GENERAL_LOOKASIDE_LAYOUT
1473 } GENERAL_LOOKASIDE_POOL, *PGENERAL_LOOKASIDE_POOL;
1474
1475 typedef struct _LOOKASIDE_LIST_EX
1476 {
1477     GENERAL_LOOKASIDE_POOL L;
1478 } LOOKASIDE_LIST_EX;
1479
1480 typedef struct LOOKASIDE_ALIGN _NPAGED_LOOKASIDE_LIST
1481 {
1482     GENERAL_LOOKASIDE L;
1483 #if defined(__i386__)
1484     KSPIN_LOCK Lock__ObsoleteButDoNotDelete;
1485 #endif
1486 } NPAGED_LOOKASIDE_LIST, *PNPAGED_LOOKASIDE_LIST;
1487
1488 typedef struct LOOKASIDE_ALIGN _PAGED_LOOKASIDE_LIST
1489 {
1490     GENERAL_LOOKASIDE L;
1491 #if defined(__i386__)
1492     FAST_MUTEX Lock__ObsoleteButDoNotDelete;
1493 #endif
1494 } PAGED_LOOKASIDE_LIST, *PPAGED_LOOKASIDE_LIST;
1495
1496 typedef NTSTATUS (NTAPI EX_CALLBACK_FUNCTION)(void *CallbackContext, void *Argument1, void *Argument2);
1497 typedef EX_CALLBACK_FUNCTION *PEX_CALLBACK_FUNCTION;
1498
1499 typedef ULONG OB_OPERATION;
1500
1501 typedef struct _OB_PRE_CREATE_HANDLE_INFORMATION {
1502     ACCESS_MASK DesiredAccess;
1503     ACCESS_MASK OriginalDesiredAccess;
1504 } OB_PRE_CREATE_HANDLE_INFORMATION, *POB_PRE_CREATE_HANDLE_INFORMATION;
1505
1506 typedef struct _OB_PRE_DUPLICATE_HANDLE_INFORMATION {
1507     ACCESS_MASK DesiredAccess;
1508     ACCESS_MASK OriginalDesiredAccess;
1509     PVOID SourceProcess;
1510     PVOID TargetProcess;
1511 } OB_PRE_DUPLICATE_HANDLE_INFORMATION, *POB_PRE_DUPLICATE_HANDLE_INFORMATION;
1512
1513 typedef union _OB_PRE_OPERATION_PARAMETERS {
1514     OB_PRE_CREATE_HANDLE_INFORMATION CreateHandleInformation;
1515     OB_PRE_DUPLICATE_HANDLE_INFORMATION DuplicateHandleInformation;
1516 } OB_PRE_OPERATION_PARAMETERS, *POB_PRE_OPERATION_PARAMETERS;
1517
1518 typedef struct _OB_PRE_OPERATION_INFORMATION {
1519     OB_OPERATION Operation;
1520     union {
1521         ULONG Flags;
1522         struct {
1523             ULONG KernelHandle:1;
1524             ULONG Reserved:31;
1525         } DUMMYSTRUCTNAME;
1526     } DUMMYUNIONNAME;
1527     PVOID Object;
1528     POBJECT_TYPE ObjectType;
1529     PVOID CallContext;
1530     POB_PRE_OPERATION_PARAMETERS Parameters;
1531 } OB_PRE_OPERATION_INFORMATION, *POB_PRE_OPERATION_INFORMATION;
1532
1533 typedef struct _OB_POST_CREATE_HANDLE_INFORMATION {
1534     ACCESS_MASK GrantedAccess;
1535 } OB_POST_CREATE_HANDLE_INFORMATION, *POB_POST_CREATE_HANDLE_INFORMATION;
1536
1537 typedef struct _OB_POST_DUPLICATE_HANDLE_INFORMATION {
1538     ACCESS_MASK GrantedAccess;
1539 } OB_POST_DUPLICATE_HANDLE_INFORMATION, *POB_POST_DUPLICATE_HANDLE_INFORMATION;
1540
1541 typedef union _OB_POST_OPERATION_PARAMETERS {
1542     OB_POST_CREATE_HANDLE_INFORMATION CreateHandleInformation;
1543     OB_POST_DUPLICATE_HANDLE_INFORMATION DuplicateHandleInformation;
1544 } OB_POST_OPERATION_PARAMETERS, *POB_POST_OPERATION_PARAMETERS;
1545
1546 typedef struct _OB_POST_OPERATION_INFORMATION {
1547     OB_OPERATION Operation;
1548     union {
1549         ULONG Flags;
1550         struct {
1551             ULONG KernelHandle:1;
1552             ULONG Reserved:31;
1553         } DUMMYSTRUCTNAME;
1554     } DUMMYUNIONNAME;
1555     PVOID Object;
1556     POBJECT_TYPE ObjectType;
1557     PVOID CallContext;
1558     NTSTATUS ReturnStatus;
1559     POB_POST_OPERATION_PARAMETERS Parameters;
1560 } OB_POST_OPERATION_INFORMATION,*POB_POST_OPERATION_INFORMATION;
1561
1562 typedef enum _OB_PREOP_CALLBACK_STATUS {
1563     OB_PREOP_SUCCESS
1564 } OB_PREOP_CALLBACK_STATUS, *POB_PREOP_CALLBACK_STATUS;
1565
1566 typedef OB_PREOP_CALLBACK_STATUS (WINAPI *POB_PRE_OPERATION_CALLBACK)(void *context, POB_PRE_OPERATION_INFORMATION information);
1567 typedef void (WINAPI *POB_POST_OPERATION_CALLBACK)(void *context, POB_POST_OPERATION_INFORMATION information);
1568
1569 typedef struct _OB_OPERATION_REGISTRATION {
1570     POBJECT_TYPE *ObjectType;
1571     OB_OPERATION Operations;
1572     POB_PRE_OPERATION_CALLBACK PreOperation;
1573     POB_POST_OPERATION_CALLBACK PostOperation;
1574 } OB_OPERATION_REGISTRATION, *POB_OPERATION_REGISTRATION;
1575
1576 typedef struct _OB_CALLBACK_REGISTRATION {
1577     USHORT Version;
1578     USHORT OperationRegistrationCount;
1579     UNICODE_STRING Altitude;
1580     PVOID RegistrationContext;
1581     OB_OPERATION_REGISTRATION *OperationRegistration;
1582 } OB_CALLBACK_REGISTRATION, *POB_CALLBACK_REGISTRATION;
1583
1584 #define OB_FLT_REGISTRATION_VERSION_0100  0x0100
1585 #define OB_FLT_REGISTRATION_VERSION OB_FLT_REGISTRATION_VERSION_0100
1586
1587 typedef enum _DIRECTORY_NOTIFY_INFORMATION_CLASS {
1588     DirectoryNotifyInformation = 1,
1589     DirectoryNotifyExtendedInformation
1590 } DIRECTORY_NOTIFY_INFORMATION_CLASS, *PDIRECTORY_NOTIFY_INFORMATION_CLASS;
1591
1592 typedef enum _WORK_QUEUE_TYPE {
1593     CriticalWorkQueue,
1594     DelayedWorkQueue,
1595     HyperCriticalWorkQueue,
1596     MaximumWorkQueue
1597 } WORK_QUEUE_TYPE;
1598
1599 typedef void (WINAPI *PIO_WORKITEM_ROUTINE)(PDEVICE_OBJECT,void*);
1600
1601 NTSTATUS WINAPI ObCloseHandle(IN HANDLE handle);
1602
1603 #ifdef NONAMELESSUNION
1604 # ifdef NONAMELESSSTRUCT
1605 #  define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.u2.CurrentStackLocation)
1606 #  define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.u2.CurrentStackLocation - 1)
1607    static inline void IoSkipCurrentIrpStackLocation(IRP *irp) {irp->Tail.Overlay.s.u2.CurrentStackLocation++; irp->CurrentLocation++;}
1608 # else
1609 #  define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.u2.CurrentStackLocation)
1610 #  define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.u2.CurrentStackLocation - 1)
1611    static inline void IoSkipCurrentIrpStackLocation(IRP *irp) {irp->Tail.Overlay.u2.CurrentStackLocation++; irp->CurrentLocation++;}
1612 # endif
1613 #else
1614 # ifdef NONAMELESSSTRUCT
1615 #  define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.CurrentStackLocation)
1616 #  define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.s.CurrentStackLocation - 1)
1617     static inline void IoSkipCurrentIrpStackLocation(IRP *irp) {irp->Tail.Overlay.s.CurrentStackLocation++; irp->CurrentLocation++;}
1618 # else
1619 #  define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.CurrentStackLocation)
1620 #  define IoGetNextIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.CurrentStackLocation - 1)
1621     static inline void IoSkipCurrentIrpStackLocation(IRP *irp) {irp->Tail.Overlay.CurrentStackLocation++; irp->CurrentLocation++;}
1622 # endif
1623 #endif
1624
1625 #define IoSetCancelRoutine(irp, routine) \
1626     ((PDRIVER_CANCEL)InterlockedExchangePointer((void **)&(irp)->CancelRoutine, routine))
1627
1628 static inline void IoSetCompletionRoutine(IRP *irp, PIO_COMPLETION_ROUTINE routine, void *context,
1629                                           BOOLEAN on_success, BOOLEAN on_error, BOOLEAN on_cancel)
1630 {
1631     IO_STACK_LOCATION *irpsp = IoGetNextIrpStackLocation(irp);
1632     irpsp->CompletionRoutine = routine;
1633     irpsp->Context = context;
1634     irpsp->Control = 0;
1635     if (on_success) irpsp->Control |= SL_INVOKE_ON_SUCCESS;
1636     if (on_error)   irpsp->Control |= SL_INVOKE_ON_ERROR;
1637     if (on_cancel)  irpsp->Control |= SL_INVOKE_ON_CANCEL;
1638 }
1639
1640 static inline void IoMarkIrpPending(IRP *irp)
1641 {
1642     IoGetCurrentIrpStackLocation(irp)->Control |= SL_PENDING_RETURNED;
1643 }
1644
1645 static inline void IoCopyCurrentIrpStackLocationToNext(IRP *irp)
1646 {
1647     IO_STACK_LOCATION *current = IoGetCurrentIrpStackLocation(irp);
1648     IO_STACK_LOCATION *next = IoGetNextIrpStackLocation(irp);
1649     memcpy(next, current, FIELD_OFFSET(IO_STACK_LOCATION, CompletionRoutine));
1650     next->Control = 0;
1651 }
1652
1653 #define KernelMode 0
1654 #define UserMode   1
1655
1656 /* directory object access rights */
1657 #define DIRECTORY_QUERY                 0x0001
1658 #define DIRECTORY_TRAVERSE              0x0002
1659 #define DIRECTORY_CREATE_OBJECT         0x0004
1660 #define DIRECTORY_CREATE_SUBDIRECTORY   0x0008
1661 #define DIRECTORY_ALL_ACCESS            (STANDARD_RIGHTS_REQUIRED | 0xF)
1662
1663 /* symbolic link access rights */
1664 #define SYMBOLIC_LINK_QUERY             0x0001
1665 #define SYMBOLIC_LINK_ALL_ACCESS        (STANDARD_RIGHTS_REQUIRED | 0x1)
1666
1667 NTSTATUS  WINAPI DbgQueryDebugFilterState(ULONG, ULONG);
1668 void    FASTCALL ExAcquireFastMutexUnsafe(PFAST_MUTEX);
1669 BOOLEAN   WINAPI ExAcquireResourceExclusiveLite(ERESOURCE*,BOOLEAN);
1670 BOOLEAN   WINAPI ExAcquireResourceSharedLite(ERESOURCE*,BOOLEAN);
1671 BOOLEAN   WINAPI ExAcquireSharedStarveExclusive(ERESOURCE*,BOOLEAN);
1672 BOOLEAN   WINAPI ExAcquireSharedWaitForExclusive(ERESOURCE*,BOOLEAN);
1673 PVOID     WINAPI ExAllocatePool(POOL_TYPE,SIZE_T);
1674 PVOID     WINAPI ExAllocatePoolWithQuota(POOL_TYPE,SIZE_T);
1675 PVOID     WINAPI ExAllocatePoolWithTag(POOL_TYPE,SIZE_T,ULONG);
1676 PVOID     WINAPI ExAllocatePoolWithQuotaTag(POOL_TYPE,SIZE_T,ULONG);
1677 void      WINAPI ExDeleteNPagedLookasideList(PNPAGED_LOOKASIDE_LIST);
1678 void      WINAPI ExDeletePagedLookasideList(PPAGED_LOOKASIDE_LIST);
1679 NTSTATUS  WINAPI ExDeleteResourceLite(ERESOURCE*);
1680 void      WINAPI ExFreePool(PVOID);
1681 void      WINAPI ExFreePoolWithTag(PVOID,ULONG);
1682 ULONG     WINAPI ExGetExclusiveWaiterCount(ERESOURCE*);
1683 ULONG     WINAPI ExGetSharedWaiterCount(ERESOURCE*);
1684 void      WINAPI ExInitializeNPagedLookasideList(PNPAGED_LOOKASIDE_LIST,PALLOCATE_FUNCTION,PFREE_FUNCTION,ULONG,SIZE_T,ULONG,USHORT);
1685 void      WINAPI ExInitializePagedLookasideList(PPAGED_LOOKASIDE_LIST,PALLOCATE_FUNCTION,PFREE_FUNCTION,ULONG,SIZE_T,ULONG,USHORT);
1686 NTSTATUS  WINAPI ExInitializeResourceLite(ERESOURCE*);
1687 PSLIST_ENTRY WINAPI ExInterlockedFlushSList(PSLIST_HEADER);
1688 PSLIST_ENTRY WINAPI ExInterlockedPopEntrySList(PSLIST_HEADER,PKSPIN_LOCK);
1689 PSLIST_ENTRY WINAPI ExInterlockedPushEntrySList(PSLIST_HEADER,PSLIST_ENTRY,PKSPIN_LOCK);
1690 LIST_ENTRY * WINAPI ExInterlockedRemoveHeadList(LIST_ENTRY*,KSPIN_LOCK*);
1691 BOOLEAN   WINAPI ExIsResourceAcquiredExclusiveLite(ERESOURCE*);
1692 ULONG     WINAPI ExIsResourceAcquiredSharedLite(ERESOURCE*);
1693 void *    WINAPI ExRegisterCallback(PCALLBACK_OBJECT,PCALLBACK_FUNCTION,void*);
1694 void    FASTCALL ExReleaseFastMutexUnsafe(PFAST_MUTEX);
1695 void      WINAPI ExReleaseResourceForThreadLite(ERESOURCE*,ERESOURCE_THREAD);
1696 ULONG     WINAPI ExSetTimerResolution(ULONG,BOOLEAN);
1697 void      WINAPI ExUnregisterCallback(void*);
1698
1699 void      WINAPI IoAcquireCancelSpinLock(KIRQL*);
1700 NTSTATUS  WINAPI IoAcquireRemoveLockEx(IO_REMOVE_LOCK*,void*,const char*,ULONG, ULONG);
1701 NTSTATUS  WINAPI IoAllocateDriverObjectExtension(PDRIVER_OBJECT,PVOID,ULONG,PVOID*);
1702 PVOID     WINAPI IoAllocateErrorLogEntry(PVOID,UCHAR);
1703 PIRP      WINAPI IoAllocateIrp(CCHAR,BOOLEAN);
1704 PMDL      WINAPI IoAllocateMdl(PVOID,ULONG,BOOLEAN,BOOLEAN,IRP*);
1705 PIO_WORKITEM WINAPI IoAllocateWorkItem(PDEVICE_OBJECT);
1706 void      WINAPI IoDetachDevice(PDEVICE_OBJECT);
1707 PDEVICE_OBJECT WINAPI IoAttachDeviceToDeviceStack(PDEVICE_OBJECT,PDEVICE_OBJECT);
1708 PIRP      WINAPI IoBuildAsynchronousFsdRequest(ULONG,DEVICE_OBJECT*,void*,ULONG,LARGE_INTEGER*,IO_STATUS_BLOCK*);
1709 PIRP      WINAPI IoBuildDeviceIoControlRequest(ULONG,DEVICE_OBJECT*,PVOID,ULONG,PVOID,ULONG,BOOLEAN,PKEVENT,IO_STATUS_BLOCK*);
1710 PIRP      WINAPI IoBuildSynchronousFsdRequest(ULONG,DEVICE_OBJECT*,PVOID,ULONG,PLARGE_INTEGER,PKEVENT,IO_STATUS_BLOCK*);
1711 NTSTATUS  WINAPI IoCallDriver(DEVICE_OBJECT*,IRP*);
1712 BOOLEAN   WINAPI IoCancelIrp(IRP*);
1713 VOID      WINAPI IoCompleteRequest(IRP*,UCHAR);
1714 NTSTATUS  WINAPI IoCreateDevice(DRIVER_OBJECT*,ULONG,UNICODE_STRING*,DEVICE_TYPE,ULONG,BOOLEAN,DEVICE_OBJECT**);
1715 NTSTATUS  WINAPI IoCreateDriver(UNICODE_STRING*,PDRIVER_INITIALIZE);
1716 NTSTATUS  WINAPI IoCreateSymbolicLink(UNICODE_STRING*,UNICODE_STRING*);
1717 PKEVENT   WINAPI IoCreateSynchronizationEvent(UNICODE_STRING*,HANDLE*);
1718 void      WINAPI IoDeleteDevice(DEVICE_OBJECT*);
1719 void      WINAPI IoDeleteDriver(DRIVER_OBJECT*);
1720 NTSTATUS  WINAPI IoDeleteSymbolicLink(UNICODE_STRING*);
1721 void      WINAPI IoFreeIrp(IRP*);
1722 void      WINAPI IoFreeMdl(MDL*);
1723 void      WINAPI IoFreeWorkItem(PIO_WORKITEM);
1724 DEVICE_OBJECT * WINAPI IoGetAttachedDeviceReference(DEVICE_OBJECT*);
1725 PEPROCESS WINAPI IoGetCurrentProcess(void);
1726 NTSTATUS  WINAPI IoGetDeviceInterfaces(const GUID*,PDEVICE_OBJECT,ULONG,PWSTR*);
1727 NTSTATUS  WINAPI IoGetDeviceObjectPointer(UNICODE_STRING*,ACCESS_MASK,PFILE_OBJECT*,PDEVICE_OBJECT*);
1728 NTSTATUS  WINAPI IoGetDeviceProperty(PDEVICE_OBJECT,DEVICE_REGISTRY_PROPERTY,ULONG,PVOID,PULONG);
1729 PVOID     WINAPI IoGetDriverObjectExtension(PDRIVER_OBJECT,PVOID);
1730 PDEVICE_OBJECT WINAPI IoGetRelatedDeviceObject(PFILE_OBJECT);
1731 void      WINAPI IoGetStackLimits(ULONG_PTR*,ULONG_PTR*);
1732 void      WINAPI IoInitializeIrp(IRP*,USHORT,CCHAR);
1733 VOID      WINAPI IoInitializeRemoveLockEx(PIO_REMOVE_LOCK,ULONG,ULONG,ULONG,ULONG);
1734 void      WINAPI IoInvalidateDeviceRelations(PDEVICE_OBJECT,DEVICE_RELATION_TYPE);
1735 #ifdef _WIN64
1736 BOOLEAN   WINAPI IoIs32bitProcess(IRP*);
1737 #endif
1738 NTSTATUS  WINAPI IoOpenDeviceRegistryKey(DEVICE_OBJECT*,ULONG,ACCESS_MASK,HANDLE*);
1739 void      WINAPI IoQueueWorkItem(PIO_WORKITEM,PIO_WORKITEM_ROUTINE,WORK_QUEUE_TYPE,void*);
1740 NTSTATUS  WINAPI IoRegisterDeviceInterface(PDEVICE_OBJECT,const GUID*,PUNICODE_STRING,PUNICODE_STRING);
1741 void      WINAPI IoReleaseCancelSpinLock(KIRQL);
1742 void      WINAPI IoReleaseRemoveLockAndWaitEx(IO_REMOVE_LOCK*,void*,ULONG);
1743 void      WINAPI IoReleaseRemoveLockEx(IO_REMOVE_LOCK*,void*,ULONG);
1744 void      WINAPI IoReuseIrp(IRP*,NTSTATUS);
1745 NTSTATUS  WINAPI IoSetDeviceInterfaceState(UNICODE_STRING*,BOOLEAN);
1746 NTSTATUS  WINAPI IoWMIRegistrationControl(PDEVICE_OBJECT,ULONG);
1747
1748 void    FASTCALL KeAcquireInStackQueuedSpinLockAtDpcLevel(KSPIN_LOCK*,KLOCK_QUEUE_HANDLE*);
1749 #ifdef __i386__
1750 void      WINAPI KeAcquireSpinLock(KSPIN_LOCK*,KIRQL*);
1751 #else
1752 #define KeAcquireSpinLock( lock, irql ) *(irql) = KeAcquireSpinLockRaiseToDpc( lock )
1753 KIRQL     WINAPI KeAcquireSpinLockRaiseToDpc(KSPIN_LOCK*);
1754 #endif
1755 void      WINAPI KeAcquireSpinLockAtDpcLevel(KSPIN_LOCK*);
1756 void      WINAPI DECLSPEC_NORETURN KeBugCheckEx(ULONG,ULONG_PTR,ULONG_PTR,ULONG_PTR,ULONG_PTR);
1757 BOOLEAN   WINAPI KeCancelTimer(KTIMER*);
1758 void      WINAPI KeClearEvent(PRKEVENT);
1759 NTSTATUS  WINAPI KeDelayExecutionThread(KPROCESSOR_MODE,BOOLEAN,LARGE_INTEGER*);
1760 void      WINAPI KeEnterCriticalRegion(void);
1761 void      WINAPI KeGenericCallDpc(PKDEFERRED_ROUTINE,PVOID);
1762 ULONG     WINAPI KeGetCurrentProcessorNumber(void);
1763 PKTHREAD  WINAPI KeGetCurrentThread(void);
1764 void      WINAPI KeInitializeDpc(KDPC*,PKDEFERRED_ROUTINE,void*);
1765 void      WINAPI KeInitializeEvent(PRKEVENT,EVENT_TYPE,BOOLEAN);
1766 void      WINAPI KeInitializeMutex(PRKMUTEX,ULONG);
1767 void      WINAPI KeInitializeSemaphore(PRKSEMAPHORE,LONG,LONG);
1768 void      WINAPI KeInitializeSpinLock(KSPIN_LOCK*);
1769 void      WINAPI KeInitializeTimerEx(PKTIMER,TIMER_TYPE);
1770 void      WINAPI KeInitializeTimer(KTIMER*);
1771 void      WINAPI KeLeaveCriticalRegion(void);
1772 ULONG     WINAPI KeQueryActiveProcessorCountEx(USHORT);
1773 KAFFINITY WINAPI KeQueryActiveProcessors(void);
1774 void      WINAPI KeQuerySystemTime(LARGE_INTEGER*);
1775 void      WINAPI KeQueryTickCount(LARGE_INTEGER*);
1776 ULONG     WINAPI KeQueryTimeIncrement(void);
1777 LONG      WINAPI KeReadStateEvent(PRKEVENT);
1778 void    FASTCALL KeReleaseInStackQueuedSpinLockFromDpcLevel(KLOCK_QUEUE_HANDLE*);
1779 LONG      WINAPI KeReleaseMutex(PRKMUTEX,BOOLEAN);
1780 LONG      WINAPI KeReleaseSemaphore(PRKSEMAPHORE,KPRIORITY,LONG,BOOLEAN);
1781 void      WINAPI KeReleaseSpinLock(KSPIN_LOCK*,KIRQL);
1782 void      WINAPI KeReleaseSpinLockFromDpcLevel(KSPIN_LOCK*);
1783 LONG      WINAPI KeResetEvent(PRKEVENT);
1784 void      WINAPI KeRevertToUserAffinityThread(void);
1785 void      WINAPI KeRevertToUserAffinityThreadEx(KAFFINITY affinity);
1786 LONG      WINAPI KeSetEvent(PRKEVENT,KPRIORITY,BOOLEAN);
1787 KPRIORITY WINAPI KeSetPriorityThread(PKTHREAD,KPRIORITY);
1788 void      WINAPI KeSetSystemAffinityThread(KAFFINITY);
1789 KAFFINITY WINAPI KeSetSystemAffinityThreadEx(KAFFINITY affinity);
1790 BOOLEAN   WINAPI KeSetTimer(KTIMER*,LARGE_INTEGER,KDPC*);
1791 BOOLEAN   WINAPI KeSetTimerEx(KTIMER*,LARGE_INTEGER,LONG,KDPC*);
1792 void      WINAPI KeSignalCallDpcDone(void*);
1793 BOOLEAN   WINAPI KeSignalCallDpcSynchronize(void*);
1794 NTSTATUS  WINAPI KeWaitForMultipleObjects(ULONG,void*[],WAIT_TYPE,KWAIT_REASON,KPROCESSOR_MODE,BOOLEAN,LARGE_INTEGER*,KWAIT_BLOCK*);
1795 NTSTATUS  WINAPI KeWaitForSingleObject(void*,KWAIT_REASON,KPROCESSOR_MODE,BOOLEAN,LARGE_INTEGER*);
1796
1797 PVOID     WINAPI MmAllocateContiguousMemory(SIZE_T,PHYSICAL_ADDRESS);
1798 PVOID     WINAPI MmAllocateNonCachedMemory(SIZE_T);
1799 PMDL      WINAPI MmAllocatePagesForMdl(PHYSICAL_ADDRESS,PHYSICAL_ADDRESS,PHYSICAL_ADDRESS,SIZE_T);
1800 void      WINAPI MmBuildMdlForNonPagedPool(MDL*);
1801 NTSTATUS  WINAPI MmCopyVirtualMemory(PEPROCESS,void*,PEPROCESS,void*,SIZE_T,KPROCESSOR_MODE,SIZE_T*);
1802 void      WINAPI MmFreeNonCachedMemory(PVOID,SIZE_T);
1803 void *    WINAPI MmGetSystemRoutineAddress(UNICODE_STRING*);
1804 PVOID     WINAPI MmMapLockedPagesSpecifyCache(PMDLX,KPROCESSOR_MODE,MEMORY_CACHING_TYPE,PVOID,ULONG,MM_PAGE_PRIORITY);
1805 MM_SYSTEMSIZE WINAPI MmQuerySystemSize(void);
1806 void      WINAPI MmProbeAndLockPages(PMDLX, KPROCESSOR_MODE, LOCK_OPERATION);
1807 void      WINAPI MmUnmapLockedPages(void*, PMDL);
1808
1809 static inline void *MmGetSystemAddressForMdlSafe(MDL *mdl, ULONG priority)
1810 {
1811     if (mdl->MdlFlags & (MDL_MAPPED_TO_SYSTEM_VA | MDL_SOURCE_IS_NONPAGED_POOL))
1812         return mdl->MappedSystemVa;
1813     else
1814         return MmMapLockedPagesSpecifyCache(mdl, KernelMode, MmCached, NULL, FALSE, priority);
1815 }
1816
1817 void    FASTCALL ObfReferenceObject(void*);
1818 void      WINAPI ObDereferenceObject(void*);
1819 USHORT    WINAPI ObGetFilterVersion(void);
1820 NTSTATUS  WINAPI ObRegisterCallbacks(POB_CALLBACK_REGISTRATION, void**);
1821 NTSTATUS  WINAPI ObReferenceObjectByHandle(HANDLE,ACCESS_MASK,POBJECT_TYPE,KPROCESSOR_MODE,PVOID*,POBJECT_HANDLE_INFORMATION);
1822 NTSTATUS  WINAPI ObReferenceObjectByName(UNICODE_STRING*,ULONG,ACCESS_STATE*,ACCESS_MASK,POBJECT_TYPE,KPROCESSOR_MODE,void*,void**);
1823 NTSTATUS  WINAPI ObReferenceObjectByPointer(void*,ACCESS_MASK,POBJECT_TYPE,KPROCESSOR_MODE);
1824 void      WINAPI ObUnRegisterCallbacks(void*);
1825
1826 NTSTATUS  WINAPI PoCallDriver(DEVICE_OBJECT*,IRP*);
1827 POWER_STATE WINAPI PoSetPowerState(PDEVICE_OBJECT,POWER_STATE_TYPE,POWER_STATE);
1828 void      WINAPI PoStartNextPowerIrp(IRP*);
1829
1830 NTSTATUS  WINAPI PsCreateSystemThread(PHANDLE,ULONG,POBJECT_ATTRIBUTES,HANDLE,PCLIENT_ID,PKSTART_ROUTINE,PVOID);
1831 #define          PsGetCurrentProcess() IoGetCurrentProcess()
1832 #define          PsGetCurrentThread() ((PETHREAD)KeGetCurrentThread())
1833 HANDLE    WINAPI PsGetCurrentProcessId(void);
1834 HANDLE    WINAPI PsGetCurrentThreadId(void);
1835 HANDLE    WINAPI PsGetProcessInheritedFromUniqueProcessId(PEPROCESS);
1836 BOOLEAN   WINAPI PsGetVersion(ULONG*,ULONG*,ULONG*,UNICODE_STRING*);
1837 NTSTATUS  WINAPI PsTerminateSystemThread(NTSTATUS);
1838
1839 #if defined(__x86_64__) || defined(__i386__)
1840 NTSTATUS  WINAPI RtlCopyExtendedContext(CONTEXT_EX*,ULONG,CONTEXT_EX*);
1841 NTSTATUS  WINAPI RtlInitializeExtendedContext(void*,ULONG,CONTEXT_EX**);
1842 NTSTATUS  WINAPI RtlInitializeExtendedContext2(void*,ULONG,CONTEXT_EX**,ULONG64);
1843 ULONG64   WINAPI RtlGetEnabledExtendedFeatures(ULONG64);
1844 NTSTATUS  WINAPI RtlGetExtendedContextLength(ULONG,ULONG*);
1845 NTSTATUS  WINAPI RtlGetExtendedContextLength2(ULONG,ULONG*,ULONG64);
1846 void *    WINAPI RtlLocateLegacyContext(CONTEXT_EX*,ULONG*);
1847 void *    WINAPI RtlLocateExtendedFeature(CONTEXT_EX*,ULONG,ULONG*);
1848 void *    WINAPI RtlLocateExtendedFeature2(CONTEXT_EX*,ULONG,XSTATE_CONFIGURATION*,ULONG*);
1849 ULONG64   WINAPI RtlGetExtendedFeaturesMask(CONTEXT_EX*);
1850 void      WINAPI RtlSetExtendedFeaturesMask(CONTEXT_EX*,ULONG64);
1851 #endif
1852
1853 #ifdef __x86_64__
1854 void      WINAPI RtlCopyMemoryNonTemporal(void*,const void*,SIZE_T);
1855 #else
1856 #define RtlCopyMemoryNonTemporal RtlCopyMemory
1857 #endif
1858 BOOLEAN   WINAPI RtlIsNtDdiVersionAvailable(ULONG);
1859
1860 NTSTATUS  WINAPI ZwAddBootEntry(PUNICODE_STRING,PUNICODE_STRING);
1861 NTSTATUS  WINAPI ZwAccessCheckAndAuditAlarm(PUNICODE_STRING,HANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,ACCESS_MASK,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PBOOLEAN,PBOOLEAN);
1862 NTSTATUS  WINAPI ZwAdjustPrivilegesToken(HANDLE,BOOLEAN,PTOKEN_PRIVILEGES,DWORD,PTOKEN_PRIVILEGES,PDWORD);
1863 NTSTATUS  WINAPI ZwAlertThread(HANDLE ThreadHandle);
1864 NTSTATUS  WINAPI ZwAllocateVirtualMemory(HANDLE,PVOID*,ULONG,SIZE_T*,ULONG,ULONG);
1865 NTSTATUS  WINAPI ZwCancelIoFile(HANDLE,PIO_STATUS_BLOCK);
1866 NTSTATUS  WINAPI ZwCancelTimer(HANDLE, BOOLEAN*);
1867 NTSTATUS  WINAPI ZwClearEvent(HANDLE);
1868 NTSTATUS  WINAPI ZwClose(HANDLE);
1869 NTSTATUS  WINAPI ZwCloseObjectAuditAlarm(PUNICODE_STRING,HANDLE,BOOLEAN);
1870 NTSTATUS  WINAPI ZwConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
1871 NTSTATUS  WINAPI ZwCreateDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
1872 NTSTATUS  WINAPI ZwCreateEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *,BOOLEAN,BOOLEAN);
1873 NTSTATUS  WINAPI ZwCreateFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG);
1874 NTSTATUS  WINAPI ZwCreateKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,PULONG);
1875 NTSTATUS  WINAPI ZwCreateSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const LARGE_INTEGER*,ULONG,ULONG,HANDLE);
1876 NTSTATUS  WINAPI ZwCreateSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PUNICODE_STRING);
1877 NTSTATUS  WINAPI ZwCreateTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*, TIMER_TYPE);
1878 NTSTATUS  WINAPI ZwDeleteAtom(RTL_ATOM);
1879 NTSTATUS  WINAPI ZwDeleteFile(POBJECT_ATTRIBUTES);
1880 NTSTATUS  WINAPI ZwDeleteKey(HANDLE);
1881 NTSTATUS  WINAPI ZwDeleteValueKey(HANDLE,const UNICODE_STRING *);
1882 NTSTATUS  WINAPI ZwDeviceIoControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
1883 NTSTATUS  WINAPI ZwDisplayString(PUNICODE_STRING);
1884 NTSTATUS  WINAPI ZwDuplicateObject(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,ULONG,ULONG);
1885 NTSTATUS  WINAPI ZwDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
1886 NTSTATUS  WINAPI ZwEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
1887 NTSTATUS  WINAPI ZwEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
1888 NTSTATUS  WINAPI ZwFlushInstructionCache(HANDLE,LPCVOID,SIZE_T);
1889 NTSTATUS  WINAPI ZwFlushKey(HANDLE);
1890 NTSTATUS  WINAPI ZwFlushVirtualMemory(HANDLE,LPCVOID*,SIZE_T*,ULONG);
1891 NTSTATUS  WINAPI ZwFreeVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
1892 NTSTATUS  WINAPI ZwFsControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
1893 NTSTATUS  WINAPI ZwInitiatePowerAction(POWER_ACTION,SYSTEM_POWER_STATE,ULONG,BOOLEAN);
1894 NTSTATUS  WINAPI ZwLoadDriver(const UNICODE_STRING *);
1895 NTSTATUS  WINAPI ZwLoadKey(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *);
1896 NTSTATUS  WINAPI ZwLockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
1897 NTSTATUS  WINAPI ZwMakeTemporaryObject(HANDLE);
1898 NTSTATUS  WINAPI ZwMapViewOfSection(HANDLE,HANDLE,PVOID*,ULONG,SIZE_T,const LARGE_INTEGER*,SIZE_T*,SECTION_INHERIT,ULONG,ULONG);
1899 NTSTATUS  WINAPI ZwNotifyChangeKey(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
1900 NTSTATUS  WINAPI ZwOpenDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
1901 NTSTATUS  WINAPI ZwOpenEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
1902 NTSTATUS  WINAPI ZwOpenFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG);
1903 NTSTATUS  WINAPI ZwOpenKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
1904 NTSTATUS  WINAPI ZwOpenProcess(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
1905 NTSTATUS  WINAPI ZwOpenProcessToken(HANDLE,DWORD,HANDLE *);
1906 NTSTATUS  WINAPI ZwOpenSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
1907 NTSTATUS  WINAPI ZwOpenSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
1908 NTSTATUS  WINAPI ZwOpenThread(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
1909 NTSTATUS  WINAPI ZwOpenThreadToken(HANDLE,DWORD,BOOLEAN,HANDLE *);
1910 NTSTATUS  WINAPI ZwOpenTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*);
1911 NTSTATUS  WINAPI ZwPowerInformation(POWER_INFORMATION_LEVEL,PVOID,ULONG,PVOID,ULONG);
1912 NTSTATUS  WINAPI ZwPulseEvent(HANDLE,PULONG);
1913 NTSTATUS  WINAPI ZwQueryDefaultLocale(BOOLEAN,LCID*);
1914 NTSTATUS  WINAPI ZwQueryDefaultUILanguage(LANGID*);
1915 NTSTATUS  WINAPI ZwQueryDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS,BOOLEAN,PUNICODE_STRING,BOOLEAN);
1916 NTSTATUS  WINAPI ZwQueryDirectoryObject(HANDLE,PDIRECTORY_BASIC_INFORMATION,ULONG,BOOLEAN,BOOLEAN,PULONG,PULONG);
1917 NTSTATUS  WINAPI ZwQueryEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,BOOLEAN,PVOID,ULONG,PVOID,BOOLEAN);
1918 NTSTATUS  WINAPI ZwQueryFullAttributesFile(const OBJECT_ATTRIBUTES*,FILE_NETWORK_OPEN_INFORMATION*);
1919 NTSTATUS  WINAPI ZwQueryInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,LONG,FILE_INFORMATION_CLASS);
1920 NTSTATUS  WINAPI ZwQueryInformationThread(HANDLE,THREADINFOCLASS,PVOID,ULONG,PULONG);
1921 NTSTATUS  WINAPI ZwQueryInformationToken(HANDLE,DWORD,PVOID,DWORD,LPDWORD);
1922 NTSTATUS  WINAPI ZwQueryInstallUILanguage(LANGID*);
1923 NTSTATUS  WINAPI ZwQueryKey(HANDLE,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
1924 NTSTATUS  WINAPI ZwQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
1925 NTSTATUS  WINAPI ZwQuerySecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR,ULONG,PULONG);
1926 NTSTATUS  WINAPI ZwQuerySection(HANDLE,SECTION_INFORMATION_CLASS,PVOID,ULONG,PULONG);
1927 NTSTATUS  WINAPI ZwQuerySymbolicLinkObject(HANDLE,PUNICODE_STRING,PULONG);
1928 NTSTATUS  WINAPI ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG);
1929 NTSTATUS  WINAPI ZwQueryTimerResolution(PULONG,PULONG,PULONG);
1930 NTSTATUS  WINAPI ZwQueryValueKey(HANDLE,const UNICODE_STRING *,KEY_VALUE_INFORMATION_CLASS,void *,DWORD,DWORD *);
1931 NTSTATUS  WINAPI ZwQueryVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
1932 NTSTATUS  WINAPI ZwReadFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG);
1933 NTSTATUS  WINAPI ZwReplaceKey(POBJECT_ATTRIBUTES,HANDLE,POBJECT_ATTRIBUTES);
1934 NTSTATUS  WINAPI ZwRequestWaitReplyPort(HANDLE,PLPC_MESSAGE,PLPC_MESSAGE);
1935 NTSTATUS  WINAPI ZwResetEvent(HANDLE,PULONG);
1936 NTSTATUS  WINAPI ZwRestoreKey(HANDLE,HANDLE,ULONG);
1937 NTSTATUS  WINAPI ZwSaveKey(HANDLE,HANDLE);
1938 NTSTATUS  WINAPI ZwSecureConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PSID,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
1939 NTSTATUS  WINAPI ZwSetDefaultLocale(BOOLEAN,LCID);
1940 NTSTATUS  WINAPI ZwSetDefaultUILanguage(LANGID);
1941 NTSTATUS  WINAPI ZwSetEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG);
1942 NTSTATUS  WINAPI ZwSetEvent(HANDLE,PULONG);
1943 NTSTATUS  WINAPI ZwSetInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS);
1944 NTSTATUS  WINAPI ZwSetInformationKey(HANDLE,const int,PVOID,ULONG);
1945 NTSTATUS  WINAPI ZwSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG);
1946 NTSTATUS  WINAPI ZwSetInformationProcess(HANDLE,PROCESS_INFORMATION_CLASS,PVOID,ULONG);
1947 NTSTATUS  WINAPI ZwSetInformationThread(HANDLE,THREADINFOCLASS,LPCVOID,ULONG);
1948 NTSTATUS  WINAPI ZwSetIoCompletion(HANDLE,ULONG,ULONG,NTSTATUS,ULONG);
1949 NTSTATUS  WINAPI ZwSetLdtEntries(ULONG,ULONG,ULONG,ULONG,ULONG,ULONG);
1950 NTSTATUS  WINAPI ZwSetSecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR);
1951 NTSTATUS  WINAPI ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG);
1952 NTSTATUS  WINAPI ZwSetSystemTime(const LARGE_INTEGER*,LARGE_INTEGER*);
1953 NTSTATUS  WINAPI ZwSetTimer(HANDLE, const LARGE_INTEGER*, PTIMER_APC_ROUTINE, PVOID, BOOLEAN, ULONG, BOOLEAN*);
1954 NTSTATUS  WINAPI ZwSetValueKey(HANDLE,const UNICODE_STRING *,ULONG,ULONG,const void *,ULONG);
1955 NTSTATUS  WINAPI ZwSetVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
1956 NTSTATUS  WINAPI ZwSuspendThread(HANDLE,PULONG);
1957 NTSTATUS  WINAPI ZwTerminateProcess(HANDLE,LONG);
1958 NTSTATUS  WINAPI ZwUnloadDriver(const UNICODE_STRING *);
1959 NTSTATUS  WINAPI ZwUnloadKey(HANDLE);
1960 NTSTATUS  WINAPI ZwUnmapViewOfSection(HANDLE,PVOID);
1961 NTSTATUS  WINAPI ZwWaitForSingleObject(HANDLE,BOOLEAN,const LARGE_INTEGER*);
1962 NTSTATUS  WINAPI ZwWaitForMultipleObjects(ULONG,const HANDLE*,BOOLEAN,BOOLEAN,const LARGE_INTEGER*);
1963 NTSTATUS  WINAPI ZwWriteFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,const void*,ULONG,PLARGE_INTEGER,PULONG);
1964 NTSTATUS  WINAPI ZwYieldExecution(void);
1965
1966 static inline void ExInitializeFastMutex( FAST_MUTEX *mutex )
1967 {
1968     mutex->Count = FM_LOCK_BIT;
1969     mutex->Owner = NULL;
1970     mutex->Contention = 0;
1971     KeInitializeEvent( &mutex->Event, SynchronizationEvent, FALSE );
1972 }
1973
1974 #endif