1 /* ntdll.h. Contains ntdll specific stuff not defined elsewhere.
3 Copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008,
4 2009, 2010, 2011 Red Hat, Inc.
6 This file is part of Cygwin.
8 This software is a copyrighted work licensed under the terms of the
9 Cygwin license. Please consult the file "CYGWIN_LICENSE" for
15 /* NTSTATUS values. */
16 #define STATUS_NOT_ALL_ASSIGNED ((NTSTATUS) 0x00000106)
17 #define STATUS_OBJECT_NAME_EXISTS ((NTSTATUS) 0x40000000)
18 #define STATUS_BUFFER_OVERFLOW ((NTSTATUS) 0x80000005)
19 #define STATUS_NO_MORE_FILES ((NTSTATUS) 0x80000006)
20 #ifdef STATUS_INVALID_INFO_CLASS /* Defined as unsigned value in subauth.h */
21 #undef STATUS_INVALID_INFO_CLASS
23 #define STATUS_INVALID_INFO_CLASS ((NTSTATUS) 0xc0000003)
24 #define STATUS_NOT_IMPLEMENTED ((NTSTATUS) 0xc0000002)
25 #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS) 0xc0000004)
26 #ifdef STATUS_INVALID_HANDLE /* Defined as unsigned value in winbase.h */
27 #undef STATUS_INVALID_HANDLE
29 #define STATUS_INVALID_HANDLE ((NTSTATUS) 0xc0000008)
30 #define STATUS_INVALID_PARAMETER ((NTSTATUS) 0xc000000d)
31 #define STATUS_NO_SUCH_FILE ((NTSTATUS) 0xc000000f)
32 #define STATUS_INVALID_DEVICE_REQUEST ((NTSTATUS) 0xc0000010)
33 #define STATUS_END_OF_FILE ((NTSTATUS) 0xc0000011)
34 #define STATUS_NO_MEDIA_IN_DEVICE ((NTSTATUS) 0xc0000013)
35 #define STATUS_ACCESS_DENIED ((NTSTATUS) 0xc0000022)
36 #define STATUS_BUFFER_TOO_SMALL ((NTSTATUS) 0xc0000023)
37 #define STATUS_OBJECT_TYPE_MISMATCH ((NTSTATUS) 0xc0000024)
38 #define STATUS_OBJECT_NAME_INVALID ((NTSTATUS) 0xc0000033)
39 #define STATUS_OBJECT_NAME_NOT_FOUND ((NTSTATUS) 0xc0000034)
40 #define STATUS_OBJECT_NAME_COLLISION ((NTSTATUS) 0xc0000035)
41 #define STATUS_OBJECT_PATH_NOT_FOUND ((NTSTATUS) 0xc000003A)
42 #define STATUS_SHARING_VIOLATION ((NTSTATUS) 0xc0000043)
43 #define STATUS_EAS_NOT_SUPPORTED ((NTSTATUS) 0xc000004f)
44 #define STATUS_EA_TOO_LARGE ((NTSTATUS) 0xc0000050)
45 #define STATUS_NONEXISTENT_EA_ENTRY ((NTSTATUS) 0xc0000051)
46 #define STATUS_NO_EAS_ON_FILE ((NTSTATUS) 0xc0000052)
47 #define STATUS_LOCK_NOT_GRANTED ((NTSTATUS) 0xc0000055)
48 #define STATUS_DELETE_PENDING ((NTSTATUS) 0xc0000056)
49 #define STATUS_PROCEDURE_NOT_FOUND ((NTSTATUS) 0xc000007a)
50 #define STATUS_DISK_FULL ((NTSTATUS) 0xc000007f)
51 #define STATUS_WORKING_SET_QUOTA ((NTSTATUS) 0xc00000a1)
52 #define STATUS_INSTANCE_NOT_AVAILABLE ((NTSTATUS) 0xc00000ab)
53 #define STATUS_PIPE_NOT_AVAILABLE ((NTSTATUS) 0xc00000ac)
54 #define STATUS_INVALID_PIPE_STATE ((NTSTATUS) 0xc00000ad)
55 #define STATUS_PIPE_BUSY ((NTSTATUS) 0xc00000ae)
56 #define STATUS_NOT_SUPPORTED ((NTSTATUS) 0xc00000bb)
57 #define STATUS_BAD_NETWORK_PATH ((NTSTATUS) 0xc00000be)
58 #define STATUS_INVALID_NETWORK_RESPONSE ((NTSTATUS) 0xc00000c3)
59 #define STATUS_BAD_NETWORK_NAME ((NTSTATUS) 0xc00000cc)
60 #define STATUS_DIRECTORY_NOT_EMPTY ((NTSTATUS) 0xc0000101)
61 #define STATUS_PROCESS_IS_TERMINATING ((NTSTATUS) 0xc000010a)
62 #define STATUS_CANNOT_DELETE ((NTSTATUS) 0xc0000121)
63 #define STATUS_INVALID_LEVEL ((NTSTATUS) 0xc0000148)
64 #define STATUS_DLL_NOT_FOUND ((NTSTATUS) 0xc0000135)
65 #define STATUS_ENTRYPOINT_NOT_FOUND ((NTSTATUS) 0xc0000139)
66 #define STATUS_NOT_FOUND ((NTSTATUS) 0xc0000225)
67 #define STATUS_BAD_DLL_ENTRYPOINT ((NTSTATUS) 0xc0000251)
68 #define STATUS_ILLEGAL_DLL_RELOCATION ((NTSTATUS) 0xc0000269)
69 /* custom status code: */
70 #define STATUS_ILLEGAL_DLL_PSEUDO_RELOCATION ((NTSTATUS) 0xe0000269)
72 #define NtCurrentProcess() ((HANDLE) 0xffffffff)
73 #define NtCurrentThread() ((HANDLE) 0xfffffffe)
75 /* CreateDisposition in NtCreateFile call. */
76 #define FILE_SUPERSEDED 0
78 #define FILE_CREATED 2
79 #define FILE_OVERWRITTEN 3
81 #define FILE_DOES_NOT_EXIST 5
83 /* Relative file position values in NtWriteFile call. */
84 #define FILE_WRITE_TO_END_OF_FILE (-1LL)
85 #define FILE_USE_FILE_POINTER_POSITION (-2LL)
87 /* Device Characteristics. */
88 #define FILE_REMOVABLE_MEDIA 0x00000001
89 #define FILE_READ_ONLY_DEVICE 0x00000002
90 #define FILE_FLOPPY_DISKETTE 0x00000004
91 #define FILE_WRITE_ONCE_MEDIA 0x00000008
92 #define FILE_REMOTE_DEVICE 0x00000010
93 #define FILE_DEVICE_IS_MOUNTED 0x00000020
94 #define FILE_VIRTUAL_VOLUME 0x00000040
95 #define FILE_AUTOGENERATED_DEVICE_NAME 0x00000080
96 #define FILE_DEVICE_SECURE_OPEN 0x00000100
98 /* Allocation type values in NtMapViewOfSection call. */
99 #define AT_EXTENDABLE_FILE 0x00002000
100 #define AT_ROUND_TO_PAGE 0x40000000
102 /* Lock type in NtLockVirtualMemory/NtUnlockVirtualMemory call. */
103 #define MAP_PROCESS 1
106 /* Directory access rights (only in NT namespace). */
107 #define DIRECTORY_QUERY 1
108 #define DIRECTORY_TRAVERSE 2
109 #define DIRECTORY_CREATE_OBJECT 4
110 #define DIRECTORY_CREATE_SUBDIRECTORY 8
111 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|0x0f)
113 /* Symbolic link access rights (only in NT namespace). */
114 #define SYMBOLIC_LINK_QUERY 1
116 /* Transaction access rights. */
117 #define TRANSACTION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x3F)
119 /* Event object access rights. */
120 #define EVENT_QUERY_STATE 1
122 /* Semaphore access rights. */
123 #define SEMAPHORE_QUERY_STATE 1
125 /* Specific ACCESS_MASKSs for objects created in Cygwin. */
126 #define CYG_SHARED_DIR_ACCESS (DIRECTORY_QUERY \
127 | DIRECTORY_TRAVERSE \
128 | DIRECTORY_CREATE_SUBDIRECTORY \
129 | DIRECTORY_CREATE_OBJECT \
131 #define CYG_MUTANT_ACCESS (MUTANT_QUERY_STATE \
134 #define CYG_EVENT_ACCESS (EVENT_QUERY_STATE \
135 | EVENT_MODIFY_STATE \
138 #define CYG_SEMAPHORE_ACCESS (SEMAPHORE_QUERY_STATE \
139 | SEMAPHORE_MODIFY_STATE \
143 /* Definitions for first parameter of RtlQueryRegistryValues. */
144 #define RTL_REGISTRY_ABSOLUTE 0
145 #define RTL_REGISTRY_SERVICES 1
146 #define RTL_REGISTRY_CONTROL 2
147 #define RTL_REGISTRY_WINDOWS_NT 3
148 #define RTL_REGISTRY_DEVICEMAP 4
149 #define RTL_REGISTRY_USER 5
150 #define RTL_REGISTRY_HANDLE 0x40000000
151 #define RTL_REGISTRY_OPTIONAL 0x80000000
153 /* Flags values for QueryTable parameter of RtlQueryRegistryValues. */
154 #define RTL_QUERY_REGISTRY_SUBKEY 0x01
155 #define RTL_QUERY_REGISTRY_TOPKEY 0x02
156 #define RTL_QUERY_REGISTRY_REQUIRED 0x04
157 #define RTL_QUERY_REGISTRY_NOVALUE 0x08
158 #define RTL_QUERY_REGISTRY_NOEXPAND 0x10
159 #define RTL_QUERY_REGISTRY_DIRECT 0x20
160 #define RTL_QUERY_REGISTRY_DELETE 0x40
161 #define RTL_QUERY_REGISTRY_NOSTRING 0x80
163 /* What RtlQueryProcessDebugInformation shall return. */
164 #define PDI_MODULES 0x01
165 #define PDI_HEAPS 0x04
166 #define PDI_HEAP_BLOCKS 0x10
168 /* VM working set list protection values. Returned by NtQueryVirtualMemory. */
169 #define WSLE_PAGE_READONLY 0x001
170 #define WSLE_PAGE_EXECUTE 0x002
171 #define WSLE_PAGE_EXECUTE_READ 0x003
172 #define WSLE_PAGE_READWRITE 0x004
173 #define WSLE_PAGE_WRITECOPY 0x005
174 #define WSLE_PAGE_EXECUTE_READWRITE 0x006
175 #define WSLE_PAGE_EXECUTE_WRITECOPY 0x007
176 #define WSLE_PAGE_SHARE_COUNT_MASK 0x0E0
177 #define WSLE_PAGE_SHAREABLE 0x100
179 /* Known debug heap flags */
180 #define HEAP_FLAG_NOSERIALIZE 0x1
181 #define HEAP_FLAG_GROWABLE 0x2
182 #define HEAP_FLAG_EXCEPTIONS 0x4
183 #define HEAP_FLAG_NONDEFAULT 0x1000
184 #define HEAP_FLAG_SHAREABLE 0x8000
185 #define HEAP_FLAG_EXECUTABLE 0x40000
186 #define HEAP_FLAG_DEBUGGED 0x40000000
188 /* IOCTL code to impersonate client of named pipe. */
189 #define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, \
190 METHOD_BUFFERED, FILE_ANY_ACCESS)
192 typedef enum _FILE_INFORMATION_CLASS
194 FileDirectoryInformation = 1,
195 FileFullDirectoryInformation, // 2
196 FileBothDirectoryInformation, // 3
197 FileBasicInformation, // 4 wdm
198 FileStandardInformation, // 5 wdm
199 FileInternalInformation, // 6
200 FileEaInformation, // 7
201 FileAccessInformation, // 8
202 FileNameInformation, // 9
203 FileRenameInformation, // 10
204 FileLinkInformation, // 11
205 FileNamesInformation, // 12
206 FileDispositionInformation, // 13
207 FilePositionInformation, // 14 wdm
208 FileFullEaInformation, // 15
209 FileModeInformation, // 16
210 FileAlignmentInformation, // 17
211 FileAllInformation, // 18
212 FileAllocationInformation, // 19
213 FileEndOfFileInformation, // 20 wdm
214 FileAlternateNameInformation, // 21
215 FileStreamInformation, // 22
216 FilePipeInformation, // 23
217 FilePipeLocalInformation, // 24
218 FilePipeRemoteInformation, // 25
219 FileMailslotQueryInformation, // 26
220 FileMailslotSetInformation, // 27
221 FileCompressionInformation, // 28
222 FileObjectIdInformation, // 29
223 FileCompletionInformation, // 30
224 FileMoveClusterInformation, // 31
225 FileQuotaInformation, // 32
226 FileReparsePointInformation, // 33
227 FileNetworkOpenInformation, // 34
228 FileAttributeTagInformation, // 35
229 FileTrackingInformation, // 36
230 FileIdBothDirectoryInformation, // 37
231 FileIdFullDirectoryInformation, // 38
232 FileValidDataLengthInformation, // 39
233 FileShortNameInformation, // 40
234 FileMaximumInformation
235 } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
237 typedef struct _FILE_NAMES_INFORMATION
239 ULONG NextEntryOffset;
241 ULONG FileNameLength;
243 } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
245 typedef struct _FILE_DIRECTORY_INFORMATION {
246 ULONG NextEntryOffset;
248 LARGE_INTEGER CreationTime;
249 LARGE_INTEGER LastAccessTime;
250 LARGE_INTEGER LastWriteTime;
251 LARGE_INTEGER ChangeTime;
252 LARGE_INTEGER EndOfFile;
253 LARGE_INTEGER AllocationSize;
254 ULONG FileAttributes;
255 ULONG FileNameLength;
257 } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
259 typedef struct _FILE_BOTH_DIRECTORY_INFORMATION
261 ULONG NextEntryOffset;
263 LARGE_INTEGER CreationTime;
264 LARGE_INTEGER LastAccessTime;
265 LARGE_INTEGER LastWriteTime;
266 LARGE_INTEGER ChangeTime;
267 LARGE_INTEGER EndOfFile;
268 LARGE_INTEGER AllocationSize;
269 ULONG FileAttributes;
270 ULONG FileNameLength;
272 CCHAR ShortNameLength;
275 } FILE_BOTH_DIRECTORY_INFORMATION, *PFILE_BOTH_DIRECTORY_INFORMATION;
277 typedef struct _FILE_ID_BOTH_DIR_INFORMATION
279 ULONG NextEntryOffset;
281 LARGE_INTEGER CreationTime;
282 LARGE_INTEGER LastAccessTime;
283 LARGE_INTEGER LastWriteTime;
284 LARGE_INTEGER ChangeTime;
285 LARGE_INTEGER EndOfFile;
286 LARGE_INTEGER AllocationSize;
287 ULONG FileAttributes;
288 ULONG FileNameLength;
290 CCHAR ShortNameLength;
292 LARGE_INTEGER FileId;
294 } FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;
296 typedef ULONG KAFFINITY;
298 typedef enum _SYSTEM_INFORMATION_CLASS
300 SystemBasicInformation = 0,
301 SystemPerformanceInformation = 2,
302 SystemTimeOfDayInformation = 3,
303 SystemProcessesAndThreadsInformation = 5,
304 SystemProcessorTimes = 8,
305 SystemHandleInformation = 16,
306 SystemPagefileInformation = 18,
307 /* There are a lot more of these... */
308 } SYSTEM_INFORMATION_CLASS;
310 typedef struct _SYSTEM_BASIC_INFORMATION
313 ULONG MaximumIncrement;
314 ULONG PhysicalPageSize;
315 ULONG NumberOfPhysicalPages;
316 ULONG LowestPhysicalPage;
317 ULONG HighestPhysicalPage;
318 ULONG AllocationGranularity;
319 ULONG LowestUserAddress;
320 ULONG HighestUserAddress;
321 ULONG ActiveProcessors;
322 UCHAR NumberProcessors;
323 } SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;
325 typedef struct _SYSTEM_PAGEFILE_INFORMATION
327 ULONG NextEntryOffset;
331 UNICODE_STRING FileName;
332 } SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION;
334 typedef struct __attribute__ ((aligned (8))) _SYSTEM_PROCESSOR_TIMES
336 LARGE_INTEGER IdleTime;
337 LARGE_INTEGER KernelTime;
338 LARGE_INTEGER UserTime;
339 LARGE_INTEGER DpcTime;
340 LARGE_INTEGER InterruptTime;
341 ULONG InterruptCount;
342 } SYSTEM_PROCESSOR_TIMES, *PSYSTEM_PROCESSOR_TIMES;
344 typedef LONG KPRIORITY;
345 typedef struct _VM_COUNTERS
347 ULONG PeakVirtualSize;
349 ULONG PageFaultCount;
350 ULONG PeakWorkingSetSize;
351 ULONG WorkingSetSize;
352 ULONG QuotaPeakPagedPoolUsage;
353 ULONG QuotaPagedPoolUsage;
354 ULONG QuotaPeakNonPagedPoolUsage;
355 ULONG QuotaNonPagedPoolUsage;
357 ULONG PeakPagefileUsage;
358 } VM_COUNTERS, *PVM_COUNTERS;
360 typedef struct _CLIENT_ID
362 HANDLE UniqueProcess;
364 } CLIENT_ID, *PCLIENT_ID;
410 typedef struct _SYSTEM_THREADS
412 LARGE_INTEGER KernelTime;
413 LARGE_INTEGER UserTime;
414 LARGE_INTEGER CreateTime;
419 KPRIORITY BasePriority;
420 ULONG ContextSwitchCount;
422 KWAIT_REASON WaitReason;
424 } SYSTEM_THREADS, *PSYSTEM_THREADS;
426 typedef struct _SYSTEM_PROCESSES
428 ULONG NextEntryDelta;
431 LARGE_INTEGER CreateTime;
432 LARGE_INTEGER UserTime;
433 LARGE_INTEGER KernelTime;
434 UNICODE_STRING ProcessName;
435 KPRIORITY BasePriority;
437 ULONG InheritedFromProcessId;
440 VM_COUNTERS VmCounters;
441 IO_COUNTERS IoCounters;
442 SYSTEM_THREADS Threads[1];
443 } SYSTEM_PROCESSES, *PSYSTEM_PROCESSES;
445 typedef struct _IO_STATUS_BLOCK
449 } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
451 typedef struct _SYSTEM_PERFORMANCE_INFORMATION
453 LARGE_INTEGER IdleTime;
454 LARGE_INTEGER ReadTransferCount;
455 LARGE_INTEGER WriteTransferCount;
456 LARGE_INTEGER OtherTransferCount;
457 ULONG ReadOperationCount;
458 ULONG WriteOperationCount;
459 ULONG OtherOperationCount;
460 ULONG AvailablePages;
461 ULONG TotalCommittedPages;
462 ULONG TotalCommitLimit;
463 ULONG PeakCommitment;
465 ULONG WriteCopyFaults;
466 ULONG TransitionFaults;
468 ULONG DemandZeroFaults;
472 ULONG PagefilePagesWritten;
473 ULONG PagefilePageWriteIos;
474 ULONG MappedFilePagesWritten;
475 ULONG MappedFilePageWriteIos;
476 ULONG PagedPoolUsage;
477 ULONG NonPagedPoolUsage;
478 ULONG PagedPoolAllocs;
479 ULONG PagedPoolFrees;
480 ULONG NonPagedPoolAllocs;
481 ULONG NonPagedPoolFrees;
482 ULONG TotalFreeSystemPtes;
483 ULONG SystemCodePage;
484 ULONG TotalSystemDriverPages;
485 ULONG TotalSystemCodePages;
486 ULONG SmallNonPagedLookasideListAllocateHits;
487 ULONG SmallPagedLookasideListAllocateHits;
489 ULONG MmSystemCachePage;
491 ULONG SystemDriverPage;
492 ULONG FastReadNoWait;
494 ULONG FastReadResourceMiss;
495 ULONG FastReadNotPossible;
496 ULONG FastMdlReadNoWait;
497 ULONG FastMdlReadWait;
498 ULONG FastMdlReadResourceMiss;
499 ULONG FastMdlReadNotPossible;
502 ULONG MapDataNoWaitMiss;
503 ULONG MapDataWaitMiss;
504 ULONG PinMappedDataCount;
507 ULONG PinReadNoWaitMiss;
508 ULONG PinReadWaitMiss;
509 ULONG CopyReadNoWait;
511 ULONG CopyReadNoWaitMiss;
512 ULONG CopyReadWaitMiss;
515 ULONG MdlReadNoWaitMiss;
516 ULONG MdlReadWaitMiss;
519 ULONG LazyWritePages;
522 ULONG ContextSwitches;
523 ULONG FirstLevelTbFills;
524 ULONG SecondLevelTbFills;
526 } SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;
528 typedef struct __attribute__ ((aligned(8))) _SYSTEM_TIME_OF_DAY_INFORMATION
530 LARGE_INTEGER BootTime;
531 LARGE_INTEGER CurrentTime;
532 LARGE_INTEGER TimeZoneBias;
533 ULONG CurrentTimeZoneId;
534 } SYSTEM_TIME_OF_DAY_INFORMATION, *PSYSTEM_TIME_OF_DAY_INFORMATION;
536 typedef enum _PROCESSINFOCLASS
538 ProcessBasicInformation = 0,
539 ProcessQuotaLimits = 1,
540 ProcessVmCounters = 3,
542 ProcessSessionInformation = 24,
543 ProcessWow64Information = 26
546 typedef struct _DEBUG_BUFFER
548 HANDLE SectionHandle;
550 PVOID RemoteSectionBase;
551 ULONG SectionBaseDelta;
552 HANDLE EventPairHandle;
554 HANDLE RemoteThreadHandle;
559 PVOID ModuleInformation;
560 PVOID BackTraceInformation;
561 PVOID HeapInformation;
562 PVOID LockInformation;
564 } DEBUG_BUFFER, *PDEBUG_BUFFER;
566 typedef struct _DEBUG_HEAP_INFORMATION
579 } DEBUG_HEAP_INFORMATION, *PDEBUG_HEAP_INFORMATION;
581 typedef struct _DEBUG_HEAP_ARRAY
584 DEBUG_HEAP_INFORMATION Heaps[1];
585 } DEBUG_HEAP_ARRAY, *PDEBUG_HEAP_ARRAY;
587 typedef struct _DEBUG_HEAP_BLOCK
593 } DEBUG_HEAP_BLOCK, *PDEBUG_HEAP_BLOCK;
595 typedef struct _DEBUG_MODULE_INFORMATION
604 USHORT ModuleNameOffset;
606 } DEBUG_MODULE_INFORMATION, *PDEBUG_MODULE_INFORMATION;
608 typedef struct _DEBUG_MODULE_ARRAY
611 DEBUG_MODULE_INFORMATION Modules[1];
612 } DEBUG_MODULE_ARRAY, *PDEBUG_MODULE_ARRAY;
614 typedef struct _KERNEL_USER_TIMES
616 LARGE_INTEGER CreateTime;
617 LARGE_INTEGER ExitTime;
618 LARGE_INTEGER KernelTime;
619 LARGE_INTEGER UserTime;
620 } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
622 typedef struct _LDR_DATA_TABLE_ENTRY
624 LIST_ENTRY InLoadOrderLinks;
625 LIST_ENTRY InMemoryOrderLinks;
626 LIST_ENTRY InInitializationOrderLinks;
630 UNICODE_STRING FullDllName;
631 UNICODE_STRING BaseDllName;
634 /* More follows. Left out since it's just not used. The aforementioned
635 part of the structure is stable from at least NT4 up to Windows 7,
637 } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
639 typedef struct _PEB_LDR_DATA
644 LIST_ENTRY InLoadOrderModuleList;
645 LIST_ENTRY InMemoryOrderModuleList;
646 LIST_ENTRY InInitializationOrderModuleList;
647 PVOID EntryInProgress;
648 } PEB_LDR_DATA, *PPEB_LDR_DATA;
650 typedef struct _RTL_USER_PROCESS_PARAMETERS
652 ULONG AllocationSize;
661 UNICODE_STRING CurrentDirectoryName;
662 HANDLE CurrentDirectoryHandle;
663 UNICODE_STRING DllPath;
664 UNICODE_STRING ImagePathName;
665 UNICODE_STRING CommandLine;
673 ULONG dwFillAttribute;
676 UNICODE_STRING WindowTitle;
677 UNICODE_STRING DesktopInfo;
678 UNICODE_STRING ShellInfo;
679 UNICODE_STRING RuntimeInfo;
680 } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
688 PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
691 PRTL_CRITICAL_SECTION FastPebLock;
696 /* Simplified definition, just to get stuff we're interested in. */
700 PVOID EnvironmentPointer;
702 PVOID ActiveRpcHandle;
703 PVOID ThreadLocalStoragePointer;
705 ULONG LastErrorValue;
706 ULONG CountOfOwnedCriticalSections;
708 ULONG _reserved2[31];
711 ULONG FpSoftwareStatusRegister;
712 PVOID SystemReserved1[54];
714 PVOID ActivationContextStackPointer;
715 UCHAR SpareBytes1[36];
717 ULONG GdiTebBatch[312];
718 CLIENT_ID RealClientId;
719 PVOID GdiCachedProcessHandle;
722 PVOID GdiThreadLocalInfo;
723 ULONG Win32ClientInfo[62];
724 PVOID glDispatchTable[233];
725 ULONG glReserved1[29];
726 PVOID glReserved2[6];
727 ULONG LastStatusValue;
728 UNICODE_STRING StaticUnicodeString;
729 WCHAR StaticUnicodeBuffer[261];
730 PVOID DeallocationStack;
731 /* A lot more follows... */
734 typedef struct _KSYSTEM_TIME
739 } KSYSTEM_TIME, *PKSYSTEM_TIME;
741 typedef struct _KUSER_SHARED_DATA
743 BYTE Reserved1[0x08];
744 KSYSTEM_TIME InterruptTime;
745 BYTE Reserved2[0x2c8];
747 /* A lot more follows... */
748 } KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;
750 typedef struct _PROCESS_BASIC_INFORMATION
754 KAFFINITY AffinityMask;
755 KPRIORITY BasePriority;
756 ULONG UniqueProcessId;
757 ULONG InheritedFromUniqueProcessId;
758 } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
760 typedef struct _PROCESS_SESSION_INFORMATION
763 } PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;
765 typedef enum _MEMORY_INFORMATION_CLASS
767 MemoryBasicInformation,
768 MemoryWorkingSetList,
770 MemoryBasicVlmInformation
771 } MEMORY_INFORMATION_CLASS;
773 typedef struct _MEMORY_WORKING_SET_LIST
776 ULONG WorkingSetList[1];
777 } MEMORY_WORKING_SET_LIST, *PMEMORY_WORKING_SET_LIST;
779 typedef struct _MEMORY_SECTION_NAME
781 UNICODE_STRING SectionFileName;
782 } MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME;
784 typedef struct _FILE_BASIC_INFORMATION {
785 LARGE_INTEGER CreationTime;
786 LARGE_INTEGER LastAccessTime;
787 LARGE_INTEGER LastWriteTime;
788 LARGE_INTEGER ChangeTime;
789 ULONG FileAttributes;
790 } FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
792 typedef struct _FILE_STANDARD_INFORMATION {
793 LARGE_INTEGER AllocationSize;
794 LARGE_INTEGER EndOfFile;
796 BOOLEAN DeletePending;
798 } FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;
800 typedef struct _FILE_NETWORK_OPEN_INFORMATION {
801 LARGE_INTEGER CreationTime;
802 LARGE_INTEGER LastAccessTime;
803 LARGE_INTEGER LastWriteTime;
804 LARGE_INTEGER ChangeTime;
805 LARGE_INTEGER AllocationSize;
806 LARGE_INTEGER EndOfFile;
807 ULONG FileAttributes;
808 } FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;
810 typedef struct _FILE_INTERNAL_INFORMATION {
811 LARGE_INTEGER FileId;
812 } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
814 typedef struct _FILE_EA_INFORMATION {
816 } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
818 typedef struct _FILE_ACCESS_INFORMATION {
819 ACCESS_MASK AccessFlags;
820 } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
822 typedef struct _FILE_DISPOSITION_INFORMATION {
824 } FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;
826 typedef struct _FILE_POSITION_INFORMATION {
827 LARGE_INTEGER CurrentByteOffset;
828 } FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;
830 typedef struct _FILE_END_OF_FILE_INFORMATION {
831 LARGE_INTEGER EndOfFile;
832 } FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;
834 typedef struct _FILE_MODE_INFORMATION {
836 } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
838 typedef struct _FILE_ALIGNMENT_INFORMATION {
839 ULONG AlignmentRequirement;
840 } FILE_ALIGNMENT_INFORMATION;
842 typedef struct _FILE_NAME_INFORMATION {
843 ULONG FileNameLength;
845 } FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;
847 typedef struct _FILE_LINK_INFORMATION {
848 BOOLEAN ReplaceIfExists;
849 HANDLE RootDirectory;
850 ULONG FileNameLength;
852 } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
854 typedef struct _FILE_RENAME_INFORMATION {
855 BOOLEAN ReplaceIfExists;
856 HANDLE RootDirectory;
857 ULONG FileNameLength;
859 } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
861 typedef struct _FILE_ALL_INFORMATION {
862 FILE_BASIC_INFORMATION BasicInformation;
863 FILE_STANDARD_INFORMATION StandardInformation;
864 FILE_INTERNAL_INFORMATION InternalInformation;
865 FILE_EA_INFORMATION EaInformation;
866 FILE_ACCESS_INFORMATION AccessInformation;
867 FILE_POSITION_INFORMATION PositionInformation;
868 FILE_MODE_INFORMATION ModeInformation;
869 FILE_ALIGNMENT_INFORMATION AlignmentInformation;
870 FILE_NAME_INFORMATION NameInformation;
871 } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
875 FILE_PIPE_DISCONNECTED_STATE = 1,
876 FILE_PIPE_LISTENING_STATE = 2,
877 FILE_PIPE_CONNECTED_STATE = 3,
878 FILE_PIPE_CLOSING_STATE = 4
881 typedef struct _FILE_PIPE_LOCAL_INFORMATION
884 ULONG NamedPipeConfiguration;
885 ULONG MaximumInstances;
886 ULONG CurrentInstances;
888 ULONG ReadDataAvailable;
890 ULONG WriteQuotaAvailable;
891 ULONG NamedPipeState;
893 } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
895 typedef struct _FILE_COMPRESSION_INFORMATION
897 LARGE_INTEGER CompressedFileSize;
898 USHORT CompressionFormat;
899 UCHAR CompressionUnitShift;
903 } FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
905 typedef struct _FILE_FS_DEVICE_INFORMATION
908 ULONG Characteristics;
909 } FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;
911 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
913 ULONG FileSystemAttributes;
914 ULONG MaximumComponentNameLength;
915 ULONG FileSystemNameLength;
916 WCHAR FileSystemName[1];
917 } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
920 typedef struct _FILE_FS_VOLUME_INFORMATION
922 LARGE_INTEGER VolumeCreationTime;
923 ULONG VolumeSerialNumber;
924 ULONG VolumeLabelLength;
925 BOOLEAN SupportsObjects;
927 WCHAR VolumeLabel[1];
928 } FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
931 typedef struct _FILE_FS_SIZE_INFORMATION
933 LARGE_INTEGER TotalAllocationUnits;
934 LARGE_INTEGER AvailableAllocationUnits;
935 ULONG SectorsPerAllocationUnit;
936 ULONG BytesPerSector;
937 } FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
939 typedef struct _FILE_FS_FULL_SIZE_INFORMATION
941 LARGE_INTEGER TotalAllocationUnits;
942 LARGE_INTEGER CallerAvailableAllocationUnits;
943 LARGE_INTEGER ActualAvailableAllocationUnits;
944 ULONG SectorsPerAllocationUnit;
945 ULONG BytesPerSector;
946 } FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
948 typedef struct _FILE_FS_OBJECTID_INFORMATION {
950 UCHAR ExtendedInfo[48];
951 } FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION;
953 typedef enum _FSINFOCLASS {
954 FileFsVolumeInformation = 1,
955 FileFsLabelInformation,
956 FileFsSizeInformation,
957 FileFsDeviceInformation,
958 FileFsAttributeInformation,
959 FileFsControlInformation,
960 FileFsFullSizeInformation,
961 FileFsObjectIdInformation,
962 FileFsDriverPathInformation,
963 FileFsMaximumInformation
964 } FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;
966 typedef enum _OBJECT_INFORMATION_CLASS
968 ObjectBasicInformation = 0,
969 ObjectNameInformation = 1,
970 ObjectHandleInformation = 4
972 } OBJECT_INFORMATION_CLASS;
974 typedef struct _OBJECT_BASIC_INFORMATION
977 ACCESS_MASK GrantedAccess;
980 ULONG PagedPoolUsage;
981 ULONG NonPagedPoolUsage;
983 ULONG NameInformationLength;
984 ULONG TypeInformationLength;
985 ULONG SecurityDescriptorLength;
986 LARGE_INTEGER CreateTime;
987 } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
989 typedef struct _OBJECT_NAME_INFORMATION
992 } OBJECT_NAME_INFORMATION;
994 typedef struct _DIRECTORY_BASIC_INFORMATION
996 UNICODE_STRING ObjectName;
997 UNICODE_STRING ObjectTypeName;
998 } DIRECTORY_BASIC_INFORMATION, *PDIRECTORY_BASIC_INFORMATION;
1000 typedef struct _FILE_GET_EA_INFORMATION
1002 ULONG NextEntryOffset;
1005 } FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
1007 typedef struct _FILE_FULL_EA_INFORMATION
1009 ULONG NextEntryOffset;
1012 USHORT EaValueLength;
1014 } FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;
1016 typedef struct _FILE_MAILSLOT_SET_INFORMATION
1018 LARGE_INTEGER ReadTimeout;
1019 } FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
1021 typedef VOID NTAPI (*PIO_APC_ROUTINE)(PVOID, PIO_STATUS_BLOCK, ULONG);
1023 typedef enum _EVENT_TYPE
1025 NotificationEvent = 0,
1026 SynchronizationEvent
1027 } EVENT_TYPE, *PEVENT_TYPE;
1029 typedef struct _EVENT_BASIC_INFORMATION
1031 EVENT_TYPE EventType;
1033 } EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;
1035 typedef enum _EVENT_INFORMATION_CLASS
1037 EventBasicInformation = 0
1038 } EVENT_INFORMATION_CLASS, *PEVENT_INFORMATION_CLASS;
1040 typedef enum _THREAD_INFORMATION_CLASS
1042 ThreadBasicInformation = 0,
1044 ThreadImpersonationToken = 5
1045 } THREAD_INFORMATION_CLASS, *PTHREAD_INFORMATION_CLASS;
1047 typedef struct _THREAD_BASIC_INFORMATION {
1048 NTSTATUS ExitStatus;
1049 PNT_TIB TebBaseAddress;
1051 KAFFINITY AffinityMask;
1053 KPRIORITY BasePriority;
1054 } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
1056 typedef enum _TIMER_INFORMATION_CLASS {
1057 TimerBasicInformation = 0
1058 } TIMER_INFORMATION_CLASS, *PTIMER_INFORMATION_CLASS;
1060 typedef struct _TIMER_BASIC_INFORMATION {
1061 LARGE_INTEGER TimeRemaining;
1062 BOOLEAN SignalState;
1063 } TIMER_BASIC_INFORMATION, *PTIMER_BASIC_INFORMATION;
1065 typedef NTSTATUS (*PRTL_QUERY_REGISTRY_ROUTINE)
1066 (PWSTR, ULONG, PVOID, ULONG, PVOID, PVOID);
1068 typedef struct _RTL_QUERY_REGISTRY_TABLE
1070 PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine;
1076 ULONG DefaultLength;
1077 } RTL_QUERY_REGISTRY_TABLE, *PRTL_QUERY_REGISTRY_TABLE;
1079 typedef enum _KEY_VALUE_INFORMATION_CLASS
1081 KeyValueBasicInformation = 0,
1082 KeyValueFullInformation,
1083 KeyValuePartialInformation
1084 } KEY_VALUE_INFORMATION_CLASS, *PKEY_VALUE_INFORMATION_CLASS;
1086 typedef struct _KEY_VALUE_PARTIAL_INFORMATION
1092 } KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;
1094 typedef enum _TIMER_TYPE
1097 SynchronisationTimer
1098 } TIMER_TYPE, *PTIMER_TYPE;
1100 typedef VOID (APIENTRY *PTIMER_APC_ROUTINE)(PVOID, ULONG, ULONG);
1102 /* Function declarations for ntdll.dll. These don't appear in any
1103 standard Win32 header. */
1106 /* This is the mapping of the KUSER_SHARED_DATA structure into the 32 bit
1107 user address space. We need it here to access the current DismountCount. */
1108 static KUSER_SHARED_DATA &SharedUserData
1109 = *(volatile PKUSER_SHARED_DATA) 0x7ffe0000;
1114 NTSTATUS NTAPI NtAccessCheck (PSECURITY_DESCRIPTOR, HANDLE, ACCESS_MASK,
1115 PGENERIC_MAPPING, PPRIVILEGE_SET, PULONG,
1116 PACCESS_MASK, PNTSTATUS);
1117 NTSTATUS NTAPI NtAdjustPrivilegesToken (HANDLE, BOOLEAN, PTOKEN_PRIVILEGES,
1118 ULONG, PTOKEN_PRIVILEGES, PULONG);
1119 NTSTATUS NTAPI NtAllocateLocallyUniqueId (PLUID);
1120 NTSTATUS NTAPI NtAllocateUuids (PLARGE_INTEGER, PULONG, PULONG, PUCHAR);
1121 NTSTATUS NTAPI NtCancelTimer (HANDLE, PBOOLEAN);
1122 NTSTATUS NTAPI NtClose (HANDLE);
1123 NTSTATUS NTAPI NtCommitTransaction (HANDLE, BOOLEAN);
1124 NTSTATUS NTAPI NtCreateDirectoryObject (PHANDLE, ACCESS_MASK,
1125 POBJECT_ATTRIBUTES);
1126 NTSTATUS NTAPI NtCreateKey (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, ULONG,
1127 PUNICODE_STRING, ULONG, PULONG);
1128 NTSTATUS NTAPI NtCreateEvent (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1129 EVENT_TYPE, BOOLEAN);
1130 NTSTATUS NTAPI NtCreateFile (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1131 PIO_STATUS_BLOCK, PLARGE_INTEGER, ULONG, ULONG,
1132 ULONG, ULONG, PVOID, ULONG);
1133 NTSTATUS NTAPI NtCreateMailslotFile(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1134 PIO_STATUS_BLOCK, ULONG, ULONG, ULONG,
1136 NTSTATUS NTAPI NtCreateMutant (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1138 NTSTATUS NTAPI NtCreateSection (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1139 PLARGE_INTEGER, ULONG, ULONG, HANDLE);
1140 NTSTATUS NTAPI NtCreateSemaphore (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1142 NTSTATUS NTAPI NtCreateTimer (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1144 NTSTATUS NTAPI NtCreateToken (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1145 TOKEN_TYPE, PLUID, PLARGE_INTEGER, PTOKEN_USER,
1146 PTOKEN_GROUPS, PTOKEN_PRIVILEGES, PTOKEN_OWNER,
1147 PTOKEN_PRIMARY_GROUP, PTOKEN_DEFAULT_DACL,
1149 NTSTATUS NTAPI NtCreateTransaction (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1150 LPGUID, HANDLE, ULONG, ULONG, ULONG,
1151 PLARGE_INTEGER, PUNICODE_STRING);
1152 NTSTATUS NTAPI NtDuplicateToken (HANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1153 BOOLEAN, TOKEN_TYPE, PHANDLE);
1154 NTSTATUS NTAPI NtFsControlFile (HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID,
1155 PIO_STATUS_BLOCK, ULONG, PVOID, ULONG,
1157 NTSTATUS NTAPI NtFlushBuffersFile (HANDLE, PIO_STATUS_BLOCK);
1158 NTSTATUS NTAPI NtLoadKey (POBJECT_ATTRIBUTES, POBJECT_ATTRIBUTES);
1159 NTSTATUS NTAPI NtLockVirtualMemory (HANDLE, PVOID *, ULONG *, ULONG);
1160 NTSTATUS NTAPI NtMapViewOfSection (HANDLE, HANDLE, PVOID *, ULONG, ULONG,
1161 PLARGE_INTEGER, PULONG, SECTION_INHERIT,
1163 NTSTATUS NTAPI NtNotifyChangeDirectoryFile (HANDLE, HANDLE, PIO_APC_ROUTINE,
1164 PVOID, PIO_STATUS_BLOCK,
1165 PFILE_NOTIFY_INFORMATION, ULONG,
1167 NTSTATUS NTAPI NtOpenDirectoryObject (PHANDLE, ACCESS_MASK,
1168 POBJECT_ATTRIBUTES);
1169 NTSTATUS NTAPI NtOpenEvent (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1170 NTSTATUS NTAPI NtOpenFile (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1171 PIO_STATUS_BLOCK, ULONG, ULONG);
1172 NTSTATUS NTAPI NtOpenKey (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1173 NTSTATUS NTAPI NtOpenMutant (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1174 NTSTATUS NTAPI NtOpenProcessToken (HANDLE, ACCESS_MASK, PHANDLE);
1175 NTSTATUS NTAPI NtOpenThreadToken (HANDLE, ACCESS_MASK, BOOLEAN, PHANDLE);
1176 NTSTATUS NTAPI NtOpenSection (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1177 NTSTATUS NTAPI NtOpenSemaphore (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1178 NTSTATUS NTAPI NtOpenSymbolicLinkObject (PHANDLE, ACCESS_MASK,
1179 POBJECT_ATTRIBUTES);
1180 /* WARNING! Don't rely on the timestamp information returned by
1181 NtQueryAttributesFile. Only the DOS file attribute info is reliable. */
1182 NTSTATUS NTAPI NtPrivilegeCheck (HANDLE, PPRIVILEGE_SET, PBOOLEAN);
1183 NTSTATUS NTAPI NtQueryAttributesFile (POBJECT_ATTRIBUTES,
1184 PFILE_BASIC_INFORMATION);
1185 NTSTATUS NTAPI NtQueryDirectoryFile(HANDLE, HANDLE, PVOID, PVOID,
1186 PIO_STATUS_BLOCK, PVOID, ULONG,
1187 FILE_INFORMATION_CLASS, BOOLEAN,
1188 PUNICODE_STRING, BOOLEAN);
1189 NTSTATUS NTAPI NtQueryDirectoryObject (HANDLE, PVOID, ULONG, BOOLEAN,
1190 BOOLEAN, PULONG, PULONG);
1191 NTSTATUS NTAPI NtQueryEaFile (HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG,
1192 BOOLEAN, PVOID, ULONG, PULONG, BOOLEAN);
1193 NTSTATUS NTAPI NtQueryEvent (HANDLE, EVENT_INFORMATION_CLASS, PVOID, ULONG,
1195 NTSTATUS NTAPI NtQueryFullAttributesFile (POBJECT_ATTRIBUTES,
1196 PFILE_NETWORK_OPEN_INFORMATION);
1197 NTSTATUS NTAPI NtQueryInformationFile (HANDLE, PIO_STATUS_BLOCK, PVOID,
1198 ULONG, FILE_INFORMATION_CLASS);
1199 NTSTATUS NTAPI NtQueryInformationProcess (HANDLE, PROCESSINFOCLASS,
1200 PVOID, ULONG, PULONG);
1201 NTSTATUS NTAPI NtQueryInformationThread (HANDLE, THREAD_INFORMATION_CLASS,
1202 PVOID, ULONG, PULONG);
1203 NTSTATUS NTAPI NtQueryInformationToken (HANDLE, TOKEN_INFORMATION_CLASS,
1204 PVOID, ULONG, PULONG);
1205 NTSTATUS NTAPI NtQueryObject (HANDLE, OBJECT_INFORMATION_CLASS, VOID *,
1207 NTSTATUS NTAPI NtQuerySystemInformation (SYSTEM_INFORMATION_CLASS,
1208 PVOID, ULONG, PULONG);
1209 NTSTATUS WINAPI NtQuerySystemTime (PLARGE_INTEGER);
1210 NTSTATUS NTAPI NtQuerySecurityObject (HANDLE, SECURITY_INFORMATION,
1211 PSECURITY_DESCRIPTOR, ULONG, PULONG);
1212 NTSTATUS NTAPI NtQuerySymbolicLinkObject (HANDLE, PUNICODE_STRING, PULONG);
1213 NTSTATUS NTAPI NtQueryTimer (HANDLE, TIMER_INFORMATION_CLASS, PVOID,
1215 NTSTATUS NTAPI NtQueryTimerResolution (PULONG, PULONG, PULONG);
1216 NTSTATUS NTAPI NtQueryValueKey (HANDLE, PUNICODE_STRING,
1217 KEY_VALUE_INFORMATION_CLASS, PVOID, ULONG,
1219 NTSTATUS NTAPI NtQueryVirtualMemory (HANDLE, PVOID, MEMORY_INFORMATION_CLASS,
1220 PVOID, ULONG, PULONG);
1221 NTSTATUS NTAPI NtQueryVolumeInformationFile (HANDLE, IO_STATUS_BLOCK *,
1223 FS_INFORMATION_CLASS);
1224 NTSTATUS NTAPI NtReadFile (HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID,
1225 PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER,
1227 NTSTATUS NTAPI NtRollbackTransaction (HANDLE, BOOLEAN);
1228 NTSTATUS NTAPI NtSetEaFile (HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG);
1229 NTSTATUS NTAPI NtSetEvent (HANDLE, PULONG);
1230 NTSTATUS NTAPI NtSetInformationFile (HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG,
1231 FILE_INFORMATION_CLASS);
1232 NTSTATUS NTAPI NtSetInformationThread (HANDLE, THREAD_INFORMATION_CLASS,
1234 NTSTATUS NTAPI NtSetInformationToken (HANDLE, TOKEN_INFORMATION_CLASS, PVOID,
1236 NTSTATUS NTAPI NtSetSecurityObject (HANDLE, SECURITY_INFORMATION,
1237 PSECURITY_DESCRIPTOR);
1238 NTSTATUS NTAPI NtSetTimer (HANDLE, PLARGE_INTEGER, PTIMER_APC_ROUTINE, PVOID,
1239 BOOLEAN, LONG, PBOOLEAN);
1240 NTSTATUS NTAPI NtSetTimerResolution (ULONG, BOOLEAN, PULONG);
1241 NTSTATUS NTAPI NtSetValueKey (HANDLE, PUNICODE_STRING, ULONG, ULONG, PVOID,
1243 NTSTATUS NTAPI NtUnlockVirtualMemory (HANDLE, PVOID *, ULONG *, ULONG);
1244 NTSTATUS NTAPI NtUnmapViewOfSection (HANDLE, PVOID);
1245 NTSTATUS NTAPI NtWriteFile (HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID,
1246 PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER,
1248 NTSTATUS NTAPI RtlAbsoluteToSelfRelativeSD (PSECURITY_DESCRIPTOR,
1249 PSECURITY_DESCRIPTOR, PULONG);
1250 VOID NTAPI RtlAcquirePebLock ();
1251 NTSTATUS NTAPI RtlAddAccessAllowedAce (PACL, ULONG, ACCESS_MASK, PSID);
1252 NTSTATUS NTAPI RtlAddAccessDeniedAce (PACL, ULONG, ACCESS_MASK, PSID);
1253 NTSTATUS NTAPI RtlAddAce (PACL, ULONG, ULONG, PVOID, ULONG);
1254 PVOID NTAPI RtlAllocateHeap (PVOID, ULONG, SIZE_T);
1255 NTSTATUS NTAPI RtlAppendUnicodeToString (PUNICODE_STRING, PCWSTR);
1256 NTSTATUS NTAPI RtlAppendUnicodeStringToString (PUNICODE_STRING,
1258 NTSTATUS NTAPI RtlAnsiStringToUnicodeString (PUNICODE_STRING, PANSI_STRING,
1260 NTSTATUS NTAPI RtlCheckRegistryKey (ULONG, PCWSTR);
1261 LONG NTAPI RtlCompareUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
1263 NTSTATUS NTAPI RtlConvertSidToUnicodeString (PUNICODE_STRING, PSID, BOOLEAN);
1264 NTSTATUS NTAPI RtlConvertToAutoInheritSecurityObject (PSECURITY_DESCRIPTOR,
1265 PSECURITY_DESCRIPTOR,
1266 PSECURITY_DESCRIPTOR *,
1269 NTSTATUS NTAPI RtlCopySid (ULONG, PSID, PSID);
1270 VOID NTAPI RtlCopyUnicodeString (PUNICODE_STRING, PUNICODE_STRING);
1271 NTSTATUS NTAPI RtlCreateAcl (PACL, ULONG, ULONG);
1272 PDEBUG_BUFFER NTAPI RtlCreateQueryDebugBuffer (ULONG, BOOLEAN);
1273 NTSTATUS NTAPI RtlCreateRegistryKey (ULONG, PCWSTR);
1274 NTSTATUS NTAPI RtlCreateSecurityDescriptor (PSECURITY_DESCRIPTOR, ULONG);
1275 BOOLEAN NTAPI RtlCreateUnicodeStringFromAsciiz (PUNICODE_STRING, PCSTR);
1276 NTSTATUS NTAPI RtlDeleteSecurityObject (PSECURITY_DESCRIPTOR *);
1277 NTSTATUS NTAPI RtlDestroyQueryDebugBuffer (PDEBUG_BUFFER);
1278 NTSTATUS NTAPI RtlDowncaseUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
1280 NTSTATUS NTAPI RtlEnterCriticalSection (PRTL_CRITICAL_SECTION);
1281 BOOLEAN NTAPI RtlEqualPrefixSid (PSID, PSID);
1282 BOOLEAN NTAPI RtlEqualSid (PSID, PSID);
1283 BOOLEAN NTAPI RtlEqualUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
1285 VOID NTAPI RtlFreeAnsiString (PANSI_STRING);
1286 BOOLEAN NTAPI RtlFreeHeap (PVOID, ULONG, PVOID);
1287 VOID NTAPI RtlFreeOemString (POEM_STRING);
1288 VOID NTAPI RtlFreeUnicodeString (PUNICODE_STRING);
1289 BOOLEAN NTAPI RtlFirstFreeAce (PACL, PVOID *);
1290 NTSTATUS NTAPI RtlGetAce (PACL, ULONG, PVOID);
1291 NTSTATUS NTAPI RtlGetControlSecurityDescriptor (PSECURITY_DESCRIPTOR,
1292 PSECURITY_DESCRIPTOR_CONTROL,
1294 HANDLE NTAPI RtlGetCurrentTransaction ();
1295 NTSTATUS NTAPI RtlGetDaclSecurityDescriptor (PSECURITY_DESCRIPTOR, PBOOLEAN,
1297 NTSTATUS NTAPI RtlGetGroupSecurityDescriptor (PSECURITY_DESCRIPTOR, PSID *,
1299 NTSTATUS NTAPI RtlGetOwnerSecurityDescriptor (PSECURITY_DESCRIPTOR, PSID *,
1301 PSID_IDENTIFIER_AUTHORITY NTAPI RtlIdentifierAuthoritySid (PSID);
1302 VOID NTAPI RtlInitEmptyUnicodeString (PUNICODE_STRING, PCWSTR, USHORT);
1303 NTSTATUS NTAPI RtlInitializeSid (PSID, PSID_IDENTIFIER_AUTHORITY, UCHAR);
1304 VOID NTAPI RtlInitUnicodeString (PUNICODE_STRING, PCWSTR);
1305 NTSTATUS NTAPI RtlIntegerToUnicodeString (ULONG, ULONG, PUNICODE_STRING);
1306 ULONG NTAPI RtlIsDosDeviceName_U (PCWSTR);
1307 NTSTATUS NTAPI RtlLeaveCriticalSection (PRTL_CRITICAL_SECTION);
1308 ULONG NTAPI RtlLengthSecurityDescriptor (PSECURITY_DESCRIPTOR);
1309 ULONG NTAPI RtlLengthSid (PSID);
1310 ULONG NTAPI RtlNtStatusToDosError (NTSTATUS);
1311 NTSTATUS NTAPI RtlOemStringToUnicodeString (PUNICODE_STRING, POEM_STRING,
1313 BOOLEAN NTAPI RtlPrefixUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
1315 NTSTATUS NTAPI RtlQueryProcessDebugInformation (ULONG, ULONG, PDEBUG_BUFFER);
1316 NTSTATUS NTAPI RtlQueryRegistryValues (ULONG, PCWSTR,
1317 PRTL_QUERY_REGISTRY_TABLE, PVOID,
1319 VOID NTAPI RtlReleasePebLock ();
1320 VOID NTAPI RtlSecondsSince1970ToTime (ULONG, PLARGE_INTEGER);
1321 NTSTATUS NTAPI RtlSetCurrentDirectory_U (PUNICODE_STRING);
1322 BOOLEAN NTAPI RtlSetCurrentTransaction (HANDLE);
1323 NTSTATUS NTAPI RtlSetControlSecurityDescriptor (PSECURITY_DESCRIPTOR,
1324 SECURITY_DESCRIPTOR_CONTROL,
1325 SECURITY_DESCRIPTOR_CONTROL);
1326 NTSTATUS NTAPI RtlSetDaclSecurityDescriptor (PSECURITY_DESCRIPTOR, BOOLEAN,
1328 NTSTATUS NTAPI RtlSetGroupSecurityDescriptor (PSECURITY_DESCRIPTOR, PSID,
1330 NTSTATUS NTAPI RtlSetOwnerSecurityDescriptor (PSECURITY_DESCRIPTOR, PSID,
1332 PUCHAR NTAPI RtlSubAuthorityCountSid (PSID);
1333 PULONG NTAPI RtlSubAuthoritySid (PSID, ULONG);
1334 NTSTATUS NTAPI RtlUnicodeStringToAnsiString (PANSI_STRING, PUNICODE_STRING,
1336 NTSTATUS NTAPI RtlUnicodeStringToOemString (PANSI_STRING, PUNICODE_STRING,
1338 WCHAR NTAPI RtlUpcaseUnicodeChar (WCHAR);
1339 NTSTATUS NTAPI RtlUpcaseUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
1341 NTSTATUS NTAPI RtlWriteRegistryValue (ULONG, PCWSTR, PCWSTR, ULONG, PVOID,
1345 /* A few Rtl functions are either actually macros, or they just don't
1346 exist even though they would be a big help. We implement them here,
1347 partly as inline functions. */
1349 /* RtlInitEmptyUnicodeString is defined as a macro in wdm.h, but that file
1350 is missing entirely in w32api. */
1352 VOID NTAPI RtlInitEmptyUnicodeString(PUNICODE_STRING dest, PCWSTR buf,
1356 dest->MaximumLength = len;
1357 dest->Buffer = (PWSTR) buf;
1359 /* Like RtlInitEmptyUnicodeString, but initialize Length to len, too.
1360 This is for instance useful when creating a UNICODE_STRING from an
1361 NtQueryInformationFile info buffer, where the length of the filename
1362 is known, but you can't rely on the string being 0-terminated.
1363 If you know it's 0-terminated, just use RtlInitUnicodeString(). */
1365 VOID NTAPI RtlInitCountedUnicodeString (PUNICODE_STRING dest, PCWSTR buf,
1368 dest->Length = dest->MaximumLength = len;
1369 dest->Buffer = (PWSTR) buf;
1371 /* Split path into dirname and basename part. This function does not
1372 copy anything! It just initializes the dirname and basename
1373 UNICODE_STRINGs so that their Buffer members point to the right spot
1374 into path's Buffer, and the Length (and MaximumLength) members are set
1375 to match the dirname part and the basename part.
1376 Note that dirname's Length is set so that it also includes the trailing
1377 backslash. If you don't need it, just subtract sizeof(WCHAR) from
1380 VOID NTAPI RtlSplitUnicodePath (PUNICODE_STRING path, PUNICODE_STRING dirname,
1381 PUNICODE_STRING basename)
1383 USHORT len = path->Length / sizeof (WCHAR);
1384 while (len > 0 && path->Buffer[--len] != L'\\')
1388 RtlInitCountedUnicodeString (dirname, path->Buffer, len * sizeof (WCHAR));
1390 RtlInitCountedUnicodeString (basename, &path->Buffer[len],
1391 path->Length - len * sizeof (WCHAR));
1393 /* Check if prefix is a prefix of path. */
1395 BOOLEAN NTAPI RtlEqualUnicodePathPrefix (PUNICODE_STRING path,
1396 PUNICODE_STRING prefix,
1397 BOOLEAN caseinsensitive)
1401 RtlInitCountedUnicodeString (&p, path->Buffer,
1402 prefix->Length < path->Length
1403 ? prefix->Length : path->Length);
1404 return RtlEqualUnicodeString (&p, prefix, caseinsensitive);
1406 /* Check if suffix is a suffix of path. */
1408 BOOL NTAPI RtlEqualUnicodePathSuffix (PUNICODE_STRING path,
1409 PUNICODE_STRING suffix,
1410 BOOLEAN caseinsensitive)
1414 if (suffix->Length < path->Length)
1415 RtlInitCountedUnicodeString (&p, (PWCHAR) ((PBYTE) path->Buffer
1416 + path->Length - suffix->Length),
1419 RtlInitCountedUnicodeString (&p, path->Buffer, path->Length);
1420 return RtlEqualUnicodeString (&p, suffix, caseinsensitive);
1422 /* Implemented in strfuncs.cc. Create a Hex UNICODE_STRING from a given
1423 64 bit integer value. If append is TRUE, append the hex string,
1424 otherwise overwrite dest. Returns either STATUS_SUCCESS, or
1425 STATUS_BUFFER_OVERFLOW, if the unicode buffer is too small (hasn't
1426 room for 16 WCHARs). */
1427 NTSTATUS NTAPI RtlInt64ToHexUnicodeString (ULONGLONG value,
1428 PUNICODE_STRING dest,
1430 /* Set file attributes. Don't change file times. */
1432 NTSTATUS NTAPI NtSetAttributesFile (HANDLE h, ULONG attr)
1435 FILE_BASIC_INFORMATION fbi;
1436 fbi.CreationTime.QuadPart = fbi.LastAccessTime.QuadPart =
1437 fbi.LastWriteTime.QuadPart = fbi.ChangeTime.QuadPart = 0LL;
1438 fbi.FileAttributes = attr ?: FILE_ATTRIBUTE_NORMAL;
1439 return NtSetInformationFile(h, &io, &fbi, sizeof fbi, FileBasicInformation);
1442 /* This test for a signalled event is twice as fast as calling
1443 WaitForSingleObject (event, 0). */
1445 BOOL NTAPI IsEventSignalled (HANDLE event)
1447 EVENT_BASIC_INFORMATION ebi;
1448 return NT_SUCCESS (NtQueryEvent (event, EventBasicInformation,
1449 &ebi, sizeof ebi, NULL))
1450 && ebi.SignalState != 0;