winsup/cygwin/ntdll.h

   1 /* ntdll.h.  Contains ntdll specific stuff not defined elsewhere.
   2
   3    Copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008,
   4    2009, 2010, 2011 Red Hat, Inc.
   5
   6    This file is part of Cygwin.
   7
   8    This software is a copyrighted work licensed under the terms of the
   9    Cygwin license.  Please consult the file "CYGWIN_LICENSE" for
  10    details. */
  11
  12 #ifndef _NTDLL_H
  13 #define _NTDLL_H 1
  14
  15 /* NTSTATUS values. */
  16 #define STATUS_NOT_ALL_ASSIGNED       ((NTSTATUS) 0x00000106)
  17 #define STATUS_OBJECT_NAME_EXISTS     ((NTSTATUS) 0x40000000)
  18 #define STATUS_BUFFER_OVERFLOW        ((NTSTATUS) 0x80000005)
  19 #define STATUS_NO_MORE_FILES          ((NTSTATUS) 0x80000006)
  20 #ifdef STATUS_INVALID_INFO_CLASS /* Defined as unsigned value in subauth.h */
  21 #undef STATUS_INVALID_INFO_CLASS
  22 #endif
  23 #define STATUS_INVALID_INFO_CLASS     ((NTSTATUS) 0xc0000003)
  24 #define STATUS_NOT_IMPLEMENTED        ((NTSTATUS) 0xc0000002)
  25 #define STATUS_INFO_LENGTH_MISMATCH   ((NTSTATUS) 0xc0000004)
  26 #ifdef STATUS_INVALID_HANDLE     /* Defined as unsigned value in winbase.h */
  27 #undef STATUS_INVALID_HANDLE
  28 #endif
  29 #define STATUS_INVALID_HANDLE         ((NTSTATUS) 0xc0000008)
  30 #define STATUS_INVALID_PARAMETER      ((NTSTATUS) 0xc000000d)
  31 #define STATUS_NO_SUCH_FILE           ((NTSTATUS) 0xc000000f)
  32 #define STATUS_INVALID_DEVICE_REQUEST ((NTSTATUS) 0xc0000010)
  33 #define STATUS_END_OF_FILE            ((NTSTATUS) 0xc0000011)
  34 #define STATUS_NO_MEDIA_IN_DEVICE     ((NTSTATUS) 0xc0000013)
  35 #define STATUS_ACCESS_DENIED          ((NTSTATUS) 0xc0000022)
  36 #define STATUS_BUFFER_TOO_SMALL       ((NTSTATUS) 0xc0000023)
  37 #define STATUS_OBJECT_TYPE_MISMATCH   ((NTSTATUS) 0xc0000024)
  38 #define STATUS_OBJECT_NAME_INVALID    ((NTSTATUS) 0xc0000033)
  39 #define STATUS_OBJECT_NAME_NOT_FOUND  ((NTSTATUS) 0xc0000034)
  40 #define STATUS_OBJECT_NAME_COLLISION  ((NTSTATUS) 0xc0000035)
  41 #define STATUS_OBJECT_PATH_NOT_FOUND  ((NTSTATUS) 0xc000003A)
  42 #define STATUS_SHARING_VIOLATION      ((NTSTATUS) 0xc0000043)
  43 #define STATUS_EAS_NOT_SUPPORTED      ((NTSTATUS) 0xc000004f)
  44 #define STATUS_EA_TOO_LARGE           ((NTSTATUS) 0xc0000050)
  45 #define STATUS_NONEXISTENT_EA_ENTRY   ((NTSTATUS) 0xc0000051)
  46 #define STATUS_NO_EAS_ON_FILE         ((NTSTATUS) 0xc0000052)
  47 #define STATUS_LOCK_NOT_GRANTED       ((NTSTATUS) 0xc0000055)
  48 #define STATUS_DELETE_PENDING         ((NTSTATUS) 0xc0000056)
  49 #define STATUS_PROCEDURE_NOT_FOUND    ((NTSTATUS) 0xc000007a)
  50 #define STATUS_DISK_FULL              ((NTSTATUS) 0xc000007f)
  51 #define STATUS_WORKING_SET_QUOTA      ((NTSTATUS) 0xc00000a1)
  52 #define STATUS_INSTANCE_NOT_AVAILABLE ((NTSTATUS) 0xc00000ab)
  53 #define STATUS_PIPE_NOT_AVAILABLE     ((NTSTATUS) 0xc00000ac)
  54 #define STATUS_INVALID_PIPE_STATE     ((NTSTATUS) 0xc00000ad)
  55 #define STATUS_PIPE_BUSY              ((NTSTATUS) 0xc00000ae)
  56 #define STATUS_NOT_SUPPORTED          ((NTSTATUS) 0xc00000bb)
  57 #define STATUS_BAD_NETWORK_PATH       ((NTSTATUS) 0xc00000be)
  58 #define STATUS_INVALID_NETWORK_RESPONSE ((NTSTATUS) 0xc00000c3)
  59 #define STATUS_BAD_NETWORK_NAME       ((NTSTATUS) 0xc00000cc)
  60 #define STATUS_DIRECTORY_NOT_EMPTY    ((NTSTATUS) 0xc0000101)
  61 #define STATUS_PROCESS_IS_TERMINATING ((NTSTATUS) 0xc000010a)
  62 #define STATUS_CANNOT_DELETE          ((NTSTATUS) 0xc0000121)
  63 #define STATUS_INVALID_LEVEL          ((NTSTATUS) 0xc0000148)
  64 #define STATUS_DLL_NOT_FOUND          ((NTSTATUS) 0xc0000135)
  65 #define STATUS_ENTRYPOINT_NOT_FOUND   ((NTSTATUS) 0xc0000139)
  66 #define STATUS_NOT_FOUND              ((NTSTATUS) 0xc0000225)
  67 #define STATUS_BAD_DLL_ENTRYPOINT     ((NTSTATUS) 0xc0000251)
  68 #define STATUS_ILLEGAL_DLL_RELOCATION ((NTSTATUS) 0xc0000269)
  69 /* custom status code: */
  70 #define STATUS_ILLEGAL_DLL_PSEUDO_RELOCATION ((NTSTATUS) 0xe0000269)
  71
  72 #define NtCurrentProcess() ((HANDLE) 0xffffffff)
  73 #define NtCurrentThread()  ((HANDLE) 0xfffffffe)
  74
  75 /* CreateDisposition in NtCreateFile call. */
  76 #define FILE_SUPERSEDED     0
  77 #define FILE_OPENED         1
  78 #define FILE_CREATED        2
  79 #define FILE_OVERWRITTEN    3
  80 #define FILE_EXISTS         4
  81 #define FILE_DOES_NOT_EXIST 5
  82
  83 /* Relative file position values in NtWriteFile call. */
  84 #define FILE_WRITE_TO_END_OF_FILE      (-1LL)
  85 #define FILE_USE_FILE_POINTER_POSITION (-2LL)
  86
  87 /* Device Characteristics. */
  88 #define FILE_REMOVABLE_MEDIA           0x00000001
  89 #define FILE_READ_ONLY_DEVICE          0x00000002
  90 #define FILE_FLOPPY_DISKETTE           0x00000004
  91 #define FILE_WRITE_ONCE_MEDIA          0x00000008
  92 #define FILE_REMOTE_DEVICE             0x00000010
  93 #define FILE_DEVICE_IS_MOUNTED         0x00000020
  94 #define FILE_VIRTUAL_VOLUME            0x00000040
  95 #define FILE_AUTOGENERATED_DEVICE_NAME 0x00000080
  96 #define FILE_DEVICE_SECURE_OPEN        0x00000100
  97
  98 /* Allocation type values in NtMapViewOfSection call. */
  99 #define AT_EXTENDABLE_FILE 0x00002000
 100 #define AT_ROUND_TO_PAGE 0x40000000
 101
 102 /* Lock type in NtLockVirtualMemory/NtUnlockVirtualMemory call. */
 103 #define MAP_PROCESS 1
 104 #define MAP_SYSTEM  2
 105
 106 /* Directory access rights (only in NT namespace). */
 107 #define DIRECTORY_QUERY 1
 108 #define DIRECTORY_TRAVERSE 2
 109 #define DIRECTORY_CREATE_OBJECT 4
 110 #define DIRECTORY_CREATE_SUBDIRECTORY 8
 111 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|0x0f)
 112
 113 /* Symbolic link access rights (only in NT namespace). */
 114 #define SYMBOLIC_LINK_QUERY 1
 115
 116 /* Transaction access rights. */
 117 #define TRANSACTION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x3F)
 118
 119 /* Event object access rights. */
 120 #define EVENT_QUERY_STATE 1
 121
 122 /* Semaphore access rights. */
 123 #define SEMAPHORE_QUERY_STATE 1
 124
 125 /* Specific ACCESS_MASKSs for objects created in Cygwin. */
 126 #define CYG_SHARED_DIR_ACCESS   (DIRECTORY_QUERY \
 127                                  | DIRECTORY_TRAVERSE \
 128                                  | DIRECTORY_CREATE_SUBDIRECTORY \
 129                                  | DIRECTORY_CREATE_OBJECT \
 130                                  | READ_CONTROL)
 131 #define CYG_MUTANT_ACCESS       (MUTANT_QUERY_STATE \
 132                                  | SYNCHRONIZE \
 133                                  | READ_CONTROL)
 134 #define CYG_EVENT_ACCESS        (EVENT_QUERY_STATE \
 135                                  | EVENT_MODIFY_STATE \
 136                                  | SYNCHRONIZE \
 137                                  | READ_CONTROL)
 138 #define CYG_SEMAPHORE_ACCESS    (SEMAPHORE_QUERY_STATE \
 139                                  | SEMAPHORE_MODIFY_STATE \
 140                                  | SYNCHRONIZE \
 141                                  | READ_CONTROL)
 142
 143 /* Definitions for first parameter of RtlQueryRegistryValues. */
 144 #define RTL_REGISTRY_ABSOLUTE 0
 145 #define RTL_REGISTRY_SERVICES 1
 146 #define RTL_REGISTRY_CONTROL 2
 147 #define RTL_REGISTRY_WINDOWS_NT 3
 148 #define RTL_REGISTRY_DEVICEMAP 4
 149 #define RTL_REGISTRY_USER 5
 150 #define RTL_REGISTRY_HANDLE 0x40000000
 151 #define RTL_REGISTRY_OPTIONAL 0x80000000
 152
 153 /* Flags values for QueryTable parameter of RtlQueryRegistryValues. */
 154 #define RTL_QUERY_REGISTRY_SUBKEY 0x01
 155 #define RTL_QUERY_REGISTRY_TOPKEY 0x02
 156 #define RTL_QUERY_REGISTRY_REQUIRED 0x04
 157 #define RTL_QUERY_REGISTRY_NOVALUE 0x08
 158 #define RTL_QUERY_REGISTRY_NOEXPAND 0x10
 159 #define RTL_QUERY_REGISTRY_DIRECT 0x20
 160 #define RTL_QUERY_REGISTRY_DELETE 0x40
 161 #define RTL_QUERY_REGISTRY_NOSTRING 0x80
 162
 163 /* What RtlQueryProcessDebugInformation shall return. */
 164 #define PDI_MODULES 0x01
 165 #define PDI_HEAPS 0x04
 166 #define PDI_HEAP_BLOCKS 0x10
 167
 168 /* VM working set list protection values.  Returned by NtQueryVirtualMemory. */
 169 #define WSLE_PAGE_READONLY 0x001
 170 #define WSLE_PAGE_EXECUTE 0x002
 171 #define WSLE_PAGE_EXECUTE_READ 0x003
 172 #define WSLE_PAGE_READWRITE 0x004
 173 #define WSLE_PAGE_WRITECOPY 0x005
 174 #define WSLE_PAGE_EXECUTE_READWRITE 0x006
 175 #define WSLE_PAGE_EXECUTE_WRITECOPY 0x007
 176 #define WSLE_PAGE_SHARE_COUNT_MASK 0x0E0
 177 #define WSLE_PAGE_SHAREABLE 0x100
 178
 179 /* Known debug heap flags */
 180 #define HEAP_FLAG_NOSERIALIZE          0x1
 181 #define HEAP_FLAG_GROWABLE             0x2
 182 #define HEAP_FLAG_EXCEPTIONS           0x4
 183 #define HEAP_FLAG_NONDEFAULT        0x1000
 184 #define HEAP_FLAG_SHAREABLE         0x8000
 185 #define HEAP_FLAG_EXECUTABLE       0x40000
 186 #define HEAP_FLAG_DEBUGGED      0x40000000
 187
 188 /* IOCTL code to impersonate client of named pipe. */
 189 #define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, \
 190                                         METHOD_BUFFERED, FILE_ANY_ACCESS)
 191
 192 typedef enum _FILE_INFORMATION_CLASS
 193 {
 194   FileDirectoryInformation = 1,
 195   FileFullDirectoryInformation, // 2
 196   FileBothDirectoryInformation, // 3
 197   FileBasicInformation, // 4 wdm
 198   FileStandardInformation, // 5 wdm
 199   FileInternalInformation, // 6
 200   FileEaInformation, // 7
 201   FileAccessInformation, // 8
 202   FileNameInformation, // 9
 203   FileRenameInformation, // 10
 204   FileLinkInformation, // 11
 205   FileNamesInformation, // 12
 206   FileDispositionInformation, // 13
 207   FilePositionInformation, // 14 wdm
 208   FileFullEaInformation, // 15
 209   FileModeInformation, // 16
 210   FileAlignmentInformation, // 17
 211   FileAllInformation, // 18
 212   FileAllocationInformation, // 19
 213   FileEndOfFileInformation, // 20 wdm
 214   FileAlternateNameInformation, // 21
 215   FileStreamInformation, // 22
 216   FilePipeInformation, // 23
 217   FilePipeLocalInformation, // 24
 218   FilePipeRemoteInformation, // 25
 219   FileMailslotQueryInformation, // 26
 220   FileMailslotSetInformation, // 27
 221   FileCompressionInformation, // 28
 222   FileObjectIdInformation, // 29
 223   FileCompletionInformation, // 30
 224   FileMoveClusterInformation, // 31
 225   FileQuotaInformation, // 32
 226   FileReparsePointInformation, // 33
 227   FileNetworkOpenInformation, // 34
 228   FileAttributeTagInformation, // 35
 229   FileTrackingInformation, // 36
 230   FileIdBothDirectoryInformation, // 37
 231   FileIdFullDirectoryInformation, // 38
 232   FileValidDataLengthInformation, // 39
 233   FileShortNameInformation, // 40
 234   FileMaximumInformation
 235 } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
 236
 237 typedef struct _FILE_NAMES_INFORMATION
 238 {
 239   ULONG  NextEntryOffset;
 240   ULONG  FileIndex;
 241   ULONG  FileNameLength;
 242   WCHAR  FileName[1];
 243 } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
 244
 245 typedef struct _FILE_DIRECTORY_INFORMATION {
 246   ULONG  NextEntryOffset;
 247   ULONG  FileIndex;
 248   LARGE_INTEGER  CreationTime;
 249   LARGE_INTEGER  LastAccessTime;
 250   LARGE_INTEGER  LastWriteTime;
 251   LARGE_INTEGER  ChangeTime;
 252   LARGE_INTEGER  EndOfFile;
 253   LARGE_INTEGER  AllocationSize;
 254   ULONG  FileAttributes;
 255   ULONG  FileNameLength;
 256   WCHAR  FileName[1];
 257 } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
 258
 259 typedef struct _FILE_BOTH_DIRECTORY_INFORMATION
 260 {
 261   ULONG  NextEntryOffset;
 262   ULONG  FileIndex;
 263   LARGE_INTEGER  CreationTime;
 264   LARGE_INTEGER  LastAccessTime;
 265   LARGE_INTEGER  LastWriteTime;
 266   LARGE_INTEGER  ChangeTime;
 267   LARGE_INTEGER  EndOfFile;
 268   LARGE_INTEGER  AllocationSize;
 269   ULONG  FileAttributes;
 270   ULONG  FileNameLength;
 271   ULONG  EaSize;
 272   CCHAR  ShortNameLength;
 273   WCHAR  ShortName[12];
 274   WCHAR  FileName[1];
 275 } FILE_BOTH_DIRECTORY_INFORMATION, *PFILE_BOTH_DIRECTORY_INFORMATION;
 276
 277 typedef struct _FILE_ID_BOTH_DIR_INFORMATION
 278 {
 279   ULONG  NextEntryOffset;
 280   ULONG  FileIndex;
 281   LARGE_INTEGER  CreationTime;
 282   LARGE_INTEGER  LastAccessTime;
 283   LARGE_INTEGER  LastWriteTime;
 284   LARGE_INTEGER  ChangeTime;
 285   LARGE_INTEGER  EndOfFile;
 286   LARGE_INTEGER  AllocationSize;
 287   ULONG  FileAttributes;
 288   ULONG  FileNameLength;
 289   ULONG  EaSize;
 290   CCHAR  ShortNameLength;
 291   WCHAR  ShortName[12];
 292   LARGE_INTEGER  FileId;
 293   WCHAR  FileName[1];
 294 } FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;
 295
 296 typedef ULONG KAFFINITY;
 297
 298 typedef enum _SYSTEM_INFORMATION_CLASS
 299 {
 300   SystemBasicInformation = 0,
 301   SystemPerformanceInformation = 2,
 302   SystemTimeOfDayInformation = 3,
 303   SystemProcessesAndThreadsInformation = 5,
 304   SystemProcessorTimes = 8,
 305   SystemHandleInformation = 16,
 306   SystemPagefileInformation = 18,
 307   /* There are a lot more of these... */
 308 } SYSTEM_INFORMATION_CLASS;
 309
 310 typedef struct _SYSTEM_BASIC_INFORMATION
 311 {
 312   ULONG Unknown;
 313   ULONG MaximumIncrement;
 314   ULONG PhysicalPageSize;
 315   ULONG NumberOfPhysicalPages;
 316   ULONG LowestPhysicalPage;
 317   ULONG HighestPhysicalPage;
 318   ULONG AllocationGranularity;
 319   ULONG LowestUserAddress;
 320   ULONG HighestUserAddress;
 321   ULONG ActiveProcessors;
 322   UCHAR NumberProcessors;
 323 } SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;
 324
 325 typedef struct _SYSTEM_PAGEFILE_INFORMATION
 326 {
 327   ULONG NextEntryOffset;
 328   ULONG CurrentSize;
 329   ULONG TotalUsed;
 330   ULONG PeakUsed;
 331   UNICODE_STRING FileName;
 332 } SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION;
 333
 334 typedef struct __attribute__ ((aligned (8))) _SYSTEM_PROCESSOR_TIMES
 335 {
 336   LARGE_INTEGER IdleTime;
 337   LARGE_INTEGER KernelTime;
 338   LARGE_INTEGER UserTime;
 339   LARGE_INTEGER DpcTime;
 340   LARGE_INTEGER InterruptTime;
 341   ULONG InterruptCount;
 342 } SYSTEM_PROCESSOR_TIMES, *PSYSTEM_PROCESSOR_TIMES;
 343
 344 typedef LONG KPRIORITY;
 345 typedef struct _VM_COUNTERS
 346 {
 347   ULONG PeakVirtualSize;
 348   ULONG VirtualSize;
 349   ULONG PageFaultCount;
 350   ULONG PeakWorkingSetSize;
 351   ULONG WorkingSetSize;
 352   ULONG QuotaPeakPagedPoolUsage;
 353   ULONG QuotaPagedPoolUsage;
 354   ULONG QuotaPeakNonPagedPoolUsage;
 355   ULONG QuotaNonPagedPoolUsage;
 356   ULONG PagefileUsage;
 357   ULONG PeakPagefileUsage;
 358 } VM_COUNTERS, *PVM_COUNTERS;
 359
 360 typedef struct _CLIENT_ID
 361 {
 362   HANDLE UniqueProcess;
 363   HANDLE UniqueThread;
 364 } CLIENT_ID, *PCLIENT_ID;
 365
 366 typedef enum
 367 {
 368   StateInitialized,
 369   StateReady,
 370   StateRunning,
 371   StateStandby,
 372   StateTerminated,
 373   StateWait,
 374   StateTransition,
 375   StateUnknown,
 376 } THREAD_STATE;
 377
 378 typedef enum
 379 {
 380   Executive,
 381   FreePage,
 382   PageIn,
 383   PoolAllocation,
 384   DelayExecution,
 385   Suspended,
 386   UserRequest,
 387   WrExecutive,
 388   WrFreePage,
 389   WrPageIn,
 390   WrPoolAllocation,
 391   WrDelayExecution,
 392   WrSuspended,
 393   WrUserRequest,
 394   WrEventPair,
 395   WrQueue,
 396   WrLpcReceive,
 397   WrLpcReply,
 398   WrVirtualMemory,
 399   WrPageOut,
 400   WrRendezvous,
 401   Spare2,
 402   Spare3,
 403   Spare4,
 404   Spare5,
 405   Spare6,
 406   WrKernel,
 407   MaximumWaitReason
 408 } KWAIT_REASON;
 409
 410 typedef struct _SYSTEM_THREADS
 411 {
 412   LARGE_INTEGER KernelTime;
 413   LARGE_INTEGER UserTime;
 414   LARGE_INTEGER CreateTime;
 415   ULONG WaitTime;
 416   PVOID StartAddress;
 417   CLIENT_ID ClientId;
 418   KPRIORITY Priority;
 419   KPRIORITY BasePriority;
 420   ULONG ContextSwitchCount;
 421   THREAD_STATE State;
 422   KWAIT_REASON WaitReason;
 423   DWORD Reserved;
 424 } SYSTEM_THREADS, *PSYSTEM_THREADS;
 425
 426 typedef struct _SYSTEM_PROCESSES
 427 {
 428   ULONG NextEntryDelta;
 429   ULONG ThreadCount;
 430   ULONG Reserved1[6];
 431   LARGE_INTEGER CreateTime;
 432   LARGE_INTEGER UserTime;
 433   LARGE_INTEGER KernelTime;
 434   UNICODE_STRING ProcessName;
 435   KPRIORITY BasePriority;
 436   ULONG ProcessId;
 437   ULONG InheritedFromProcessId;
 438   ULONG HandleCount;
 439   ULONG Reserved2[2];
 440   VM_COUNTERS VmCounters;
 441   IO_COUNTERS IoCounters;
 442   SYSTEM_THREADS Threads[1];
 443 } SYSTEM_PROCESSES, *PSYSTEM_PROCESSES;
 444
 445 typedef struct _IO_STATUS_BLOCK
 446 {
 447   NTSTATUS Status;
 448   ULONG Information;
 449 } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
 450
 451 typedef struct _SYSTEM_PERFORMANCE_INFORMATION
 452 {
 453   LARGE_INTEGER IdleTime;
 454   LARGE_INTEGER ReadTransferCount;
 455   LARGE_INTEGER WriteTransferCount;
 456   LARGE_INTEGER OtherTransferCount;
 457   ULONG ReadOperationCount;
 458   ULONG WriteOperationCount;
 459   ULONG OtherOperationCount;
 460   ULONG AvailablePages;
 461   ULONG TotalCommittedPages;
 462   ULONG TotalCommitLimit;
 463   ULONG PeakCommitment;
 464   ULONG PageFaults;
 465   ULONG WriteCopyFaults;
 466   ULONG TransitionFaults;
 467   ULONG Reserved1;
 468   ULONG DemandZeroFaults;
 469   ULONG PagesRead;
 470   ULONG PageReadIos;
 471   ULONG Reserved2[2];
 472   ULONG PagefilePagesWritten;
 473   ULONG PagefilePageWriteIos;
 474   ULONG MappedFilePagesWritten;
 475   ULONG MappedFilePageWriteIos;
 476   ULONG PagedPoolUsage;
 477   ULONG NonPagedPoolUsage;
 478   ULONG PagedPoolAllocs;
 479   ULONG PagedPoolFrees;
 480   ULONG NonPagedPoolAllocs;
 481   ULONG NonPagedPoolFrees;
 482   ULONG TotalFreeSystemPtes;
 483   ULONG SystemCodePage;
 484   ULONG TotalSystemDriverPages;
 485   ULONG TotalSystemCodePages;
 486   ULONG SmallNonPagedLookasideListAllocateHits;
 487   ULONG SmallPagedLookasideListAllocateHits;
 488   ULONG Reserved3;
 489   ULONG MmSystemCachePage;
 490   ULONG PagedPoolPage;
 491   ULONG SystemDriverPage;
 492   ULONG FastReadNoWait;
 493   ULONG FastReadWait;
 494   ULONG FastReadResourceMiss;
 495   ULONG FastReadNotPossible;
 496   ULONG FastMdlReadNoWait;
 497   ULONG FastMdlReadWait;
 498   ULONG FastMdlReadResourceMiss;
 499   ULONG FastMdlReadNotPossible;
 500   ULONG MapDataNoWait;
 501   ULONG MapDataWait;
 502   ULONG MapDataNoWaitMiss;
 503   ULONG MapDataWaitMiss;
 504   ULONG PinMappedDataCount;
 505   ULONG PinReadNoWait;
 506   ULONG PinReadWait;
 507   ULONG PinReadNoWaitMiss;
 508   ULONG PinReadWaitMiss;
 509   ULONG CopyReadNoWait;
 510   ULONG CopyReadWait;
 511   ULONG CopyReadNoWaitMiss;
 512   ULONG CopyReadWaitMiss;
 513   ULONG MdlReadNoWait;
 514   ULONG MdlReadWait;
 515   ULONG MdlReadNoWaitMiss;
 516   ULONG MdlReadWaitMiss;
 517   ULONG ReadAheadIos;
 518   ULONG LazyWriteIos;
 519   ULONG LazyWritePages;
 520   ULONG DataFlushes;
 521   ULONG DataPages;
 522   ULONG ContextSwitches;
 523   ULONG FirstLevelTbFills;
 524   ULONG SecondLevelTbFills;
 525   ULONG SystemCalls;
 526 } SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;
 527
 528 typedef struct __attribute__ ((aligned(8))) _SYSTEM_TIME_OF_DAY_INFORMATION
 529 {
 530   LARGE_INTEGER BootTime;
 531   LARGE_INTEGER CurrentTime;
 532   LARGE_INTEGER TimeZoneBias;
 533   ULONG CurrentTimeZoneId;
 534 } SYSTEM_TIME_OF_DAY_INFORMATION, *PSYSTEM_TIME_OF_DAY_INFORMATION;
 535
 536 typedef enum _PROCESSINFOCLASS
 537 {
 538   ProcessBasicInformation = 0,
 539   ProcessQuotaLimits = 1,
 540   ProcessVmCounters = 3,
 541   ProcessTimes = 4,
 542   ProcessSessionInformation = 24,
 543   ProcessWow64Information = 26
 544 } PROCESSINFOCLASS;
 545
 546 typedef struct _DEBUG_BUFFER
 547 {
 548   HANDLE SectionHandle;
 549   PVOID SectionBase;
 550   PVOID RemoteSectionBase;
 551   ULONG SectionBaseDelta;
 552   HANDLE EventPairHandle;
 553   ULONG Unknown[2];
 554   HANDLE RemoteThreadHandle;
 555   ULONG InfoClassMask;
 556   ULONG SizeOfInfo;
 557   ULONG AllocatedSize;
 558   ULONG SectionSize;
 559   PVOID ModuleInformation;
 560   PVOID BackTraceInformation;
 561   PVOID HeapInformation;
 562   PVOID LockInformation;
 563   PVOID Reserved[9];
 564 } DEBUG_BUFFER, *PDEBUG_BUFFER;
 565
 566 typedef struct _DEBUG_HEAP_INFORMATION
 567 {
 568   ULONG Base;
 569   ULONG Flags;
 570   USHORT Granularity;
 571   USHORT Unknown;
 572   ULONG Allocated;
 573   ULONG Committed;
 574   ULONG TagCount;
 575   ULONG BlockCount;
 576   ULONG Reserved[7];
 577   PVOID Tags;
 578   PVOID Blocks;
 579 } DEBUG_HEAP_INFORMATION, *PDEBUG_HEAP_INFORMATION;
 580
 581 typedef struct _DEBUG_HEAP_ARRAY
 582 {
 583   ULONG Count;
 584   DEBUG_HEAP_INFORMATION Heaps[1];
 585 } DEBUG_HEAP_ARRAY, *PDEBUG_HEAP_ARRAY;
 586
 587 typedef struct _DEBUG_HEAP_BLOCK
 588 {
 589   ULONG Size;
 590   ULONG Flags;
 591   ULONG Committed;
 592   ULONG Address;
 593 } DEBUG_HEAP_BLOCK, *PDEBUG_HEAP_BLOCK;
 594
 595 typedef struct _DEBUG_MODULE_INFORMATION
 596 {
 597   ULONG Reserved[2];
 598   ULONG Base;
 599   ULONG Size;
 600   ULONG Flags;
 601   USHORT Index;
 602   USHORT Unknown;
 603   USHORT LoadCount;
 604   USHORT ModuleNameOffset;
 605   CHAR ImageName[256];
 606 } DEBUG_MODULE_INFORMATION, *PDEBUG_MODULE_INFORMATION;
 607
 608 typedef struct _DEBUG_MODULE_ARRAY
 609 {
 610   ULONG Count;
 611   DEBUG_MODULE_INFORMATION Modules[1];
 612 } DEBUG_MODULE_ARRAY, *PDEBUG_MODULE_ARRAY;
 613
 614 typedef struct _KERNEL_USER_TIMES
 615 {
 616   LARGE_INTEGER CreateTime;
 617   LARGE_INTEGER ExitTime;
 618   LARGE_INTEGER KernelTime;
 619   LARGE_INTEGER UserTime;
 620 } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
 621
 622 typedef struct _LDR_DATA_TABLE_ENTRY
 623 {
 624   LIST_ENTRY InLoadOrderLinks;
 625   LIST_ENTRY InMemoryOrderLinks;
 626   LIST_ENTRY InInitializationOrderLinks;
 627   PVOID DllBase;
 628   PVOID EntryPoint;
 629   ULONG SizeOfImage;
 630   UNICODE_STRING FullDllName;
 631   UNICODE_STRING BaseDllName;
 632   ULONG Flags;
 633   WORD LoadCount;
 634   /* More follows.  Left out since it's just not used.  The aforementioned
 635      part of the structure is stable from at least NT4 up to Windows 7,
 636      including WOW64. */
 637 } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
 638
 639 typedef struct _PEB_LDR_DATA
 640 {
 641   ULONG Length;
 642   UCHAR Initialized;
 643   PVOID SsHandle;
 644   LIST_ENTRY InLoadOrderModuleList;
 645   LIST_ENTRY InMemoryOrderModuleList;
 646   LIST_ENTRY InInitializationOrderModuleList;
 647   PVOID EntryInProgress;
 648 } PEB_LDR_DATA, *PPEB_LDR_DATA;
 649
 650 typedef struct _RTL_USER_PROCESS_PARAMETERS
 651 {
 652   ULONG AllocationSize;
 653   ULONG Size;
 654   ULONG Flags;
 655   ULONG DebugFlags;
 656   HANDLE hConsole;
 657   ULONG ProcessGroup;
 658   HANDLE hStdInput;
 659   HANDLE hStdOutput;
 660   HANDLE hStdError;
 661   UNICODE_STRING CurrentDirectoryName;
 662   HANDLE CurrentDirectoryHandle;
 663   UNICODE_STRING DllPath;
 664   UNICODE_STRING ImagePathName;
 665   UNICODE_STRING CommandLine;
 666   PWSTR Environment;
 667   ULONG dwX;
 668   ULONG dwY;
 669   ULONG dwXSize;
 670   ULONG dwYSize;
 671   ULONG dwXCountChars;
 672   ULONG dwYCountChars;
 673   ULONG dwFillAttribute;
 674   ULONG dwFlags;
 675   ULONG wShowWindow;
 676   UNICODE_STRING WindowTitle;
 677   UNICODE_STRING DesktopInfo;
 678   UNICODE_STRING ShellInfo;
 679   UNICODE_STRING RuntimeInfo;
 680 } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
 681
 682 typedef struct _PEB
 683 {
 684   BYTE Reserved1[2];
 685   BYTE BeingDebugged;
 686   BYTE Reserved2[9];
 687   PPEB_LDR_DATA Ldr;
 688   PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
 689   BYTE Reserved3[4];
 690   PVOID ProcessHeap;
 691   PRTL_CRITICAL_SECTION FastPebLock;
 692   BYTE Reserved4[436];
 693   ULONG SessionId;
 694 } PEB, *PPEB;
 695
 696 /* Simplified definition, just to get stuff we're interested in. */
 697 typedef struct _TEB
 698 {
 699   NT_TIB Tib;
 700   PVOID EnvironmentPointer;
 701   CLIENT_ID ClientId;
 702   PVOID ActiveRpcHandle;
 703   PVOID ThreadLocalStoragePointer;
 704   PPEB Peb;
 705   ULONG LastErrorValue;
 706   ULONG CountOfOwnedCriticalSections;
 707   PVOID _reserved1[2];
 708   ULONG _reserved2[31];
 709   PVOID WOW32Reserved;
 710   ULONG CurrentLocale;
 711   ULONG FpSoftwareStatusRegister;
 712   PVOID SystemReserved1[54];
 713   LONG ExceptionCode;
 714   PVOID ActivationContextStackPointer;
 715   UCHAR SpareBytes1[36];
 716   ULONG TxFsContext;
 717   ULONG GdiTebBatch[312];
 718   CLIENT_ID RealClientId;
 719   PVOID GdiCachedProcessHandle;
 720   ULONG GdiClientPID;
 721   ULONG GdiClientTID;
 722   PVOID GdiThreadLocalInfo;
 723   ULONG Win32ClientInfo[62];
 724   PVOID glDispatchTable[233];
 725   ULONG glReserved1[29];
 726   PVOID glReserved2[6];
 727   ULONG LastStatusValue;
 728   UNICODE_STRING StaticUnicodeString;
 729   WCHAR StaticUnicodeBuffer[261];
 730   PVOID DeallocationStack;
 731   /* A lot more follows... */
 732 } TEB, *PTEB;
 733
 734 typedef struct _KSYSTEM_TIME
 735 {
 736   ULONG LowPart;
 737   LONG High1Time;
 738   LONG High2Time;
 739 } KSYSTEM_TIME, *PKSYSTEM_TIME;
 740
 741 typedef struct _KUSER_SHARED_DATA
 742 {
 743   BYTE Reserved1[0x08];
 744   KSYSTEM_TIME InterruptTime;
 745   BYTE Reserved2[0x2c8];
 746   ULONG DismountCount;
 747   /* A lot more follows... */
 748 } KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;
 749
 750 typedef struct _PROCESS_BASIC_INFORMATION
 751 {
 752   NTSTATUS ExitStatus;
 753   PPEB PebBaseAddress;
 754   KAFFINITY AffinityMask;
 755   KPRIORITY BasePriority;
 756   ULONG UniqueProcessId;
 757   ULONG InheritedFromUniqueProcessId;
 758 } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
 759
 760 typedef struct _PROCESS_SESSION_INFORMATION
 761 {
 762   ULONG  SessionId;
 763 } PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;
 764
 765 typedef enum _MEMORY_INFORMATION_CLASS
 766 {
 767   MemoryBasicInformation,
 768   MemoryWorkingSetList,
 769   MemorySectionName,
 770   MemoryBasicVlmInformation
 771 } MEMORY_INFORMATION_CLASS;
 772
 773 typedef struct _MEMORY_WORKING_SET_LIST
 774 {
 775   ULONG NumberOfPages;
 776   ULONG WorkingSetList[1];
 777 } MEMORY_WORKING_SET_LIST, *PMEMORY_WORKING_SET_LIST;
 778
 779 typedef struct _MEMORY_SECTION_NAME
 780 {
 781   UNICODE_STRING SectionFileName;
 782 } MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME;
 783
 784 typedef struct _FILE_BASIC_INFORMATION {
 785   LARGE_INTEGER CreationTime;
 786   LARGE_INTEGER LastAccessTime;
 787   LARGE_INTEGER LastWriteTime;
 788   LARGE_INTEGER ChangeTime;
 789   ULONG FileAttributes;
 790 } FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
 791
 792 typedef struct _FILE_STANDARD_INFORMATION {
 793   LARGE_INTEGER AllocationSize;
 794   LARGE_INTEGER EndOfFile;
 795   ULONG NumberOfLinks;
 796   BOOLEAN DeletePending;
 797   BOOLEAN Directory;
 798 } FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;
 799
 800 typedef struct _FILE_NETWORK_OPEN_INFORMATION {
 801   LARGE_INTEGER CreationTime;
 802   LARGE_INTEGER LastAccessTime;
 803   LARGE_INTEGER LastWriteTime;
 804   LARGE_INTEGER ChangeTime;
 805   LARGE_INTEGER AllocationSize;
 806   LARGE_INTEGER EndOfFile;
 807   ULONG FileAttributes;
 808 } FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;
 809
 810 typedef struct _FILE_INTERNAL_INFORMATION {
 811   LARGE_INTEGER FileId;
 812 } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
 813
 814 typedef struct _FILE_EA_INFORMATION {
 815   ULONG EaSize;
 816 } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
 817
 818 typedef struct _FILE_ACCESS_INFORMATION {
 819   ACCESS_MASK AccessFlags;
 820 } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
 821
 822 typedef struct _FILE_DISPOSITION_INFORMATION {
 823   BOOLEAN DeleteFile;
 824 } FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;
 825
 826 typedef struct _FILE_POSITION_INFORMATION {
 827   LARGE_INTEGER CurrentByteOffset;
 828 } FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;
 829
 830 typedef struct _FILE_END_OF_FILE_INFORMATION {
 831   LARGE_INTEGER EndOfFile;
 832 } FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;
 833
 834 typedef struct _FILE_MODE_INFORMATION {
 835   ULONG Mode;
 836 } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
 837
 838 typedef struct _FILE_ALIGNMENT_INFORMATION {
 839   ULONG AlignmentRequirement;
 840 } FILE_ALIGNMENT_INFORMATION;
 841
 842 typedef struct _FILE_NAME_INFORMATION {
 843   ULONG FileNameLength;
 844   WCHAR FileName[1];
 845 } FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;
 846
 847 typedef struct _FILE_LINK_INFORMATION {
 848   BOOLEAN ReplaceIfExists;
 849   HANDLE RootDirectory;
 850   ULONG FileNameLength;
 851   WCHAR FileName[1];
 852 } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
 853
 854 typedef struct _FILE_RENAME_INFORMATION {
 855   BOOLEAN ReplaceIfExists;
 856   HANDLE RootDirectory;
 857   ULONG FileNameLength;
 858   WCHAR FileName[1];
 859 } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
 860
 861 typedef struct _FILE_ALL_INFORMATION {
 862   FILE_BASIC_INFORMATION     BasicInformation;
 863   FILE_STANDARD_INFORMATION  StandardInformation;
 864   FILE_INTERNAL_INFORMATION  InternalInformation;
 865   FILE_EA_INFORMATION        EaInformation;
 866   FILE_ACCESS_INFORMATION    AccessInformation;
 867   FILE_POSITION_INFORMATION  PositionInformation;
 868   FILE_MODE_INFORMATION      ModeInformation;
 869   FILE_ALIGNMENT_INFORMATION AlignmentInformation;
 870   FILE_NAME_INFORMATION      NameInformation;
 871 } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
 872
 873 enum
 874 {
 875   FILE_PIPE_DISCONNECTED_STATE = 1,
 876   FILE_PIPE_LISTENING_STATE = 2,
 877   FILE_PIPE_CONNECTED_STATE = 3,
 878   FILE_PIPE_CLOSING_STATE = 4
 879 };
 880
 881 typedef struct _FILE_PIPE_LOCAL_INFORMATION
 882 {
 883   ULONG NamedPipeType;
 884   ULONG NamedPipeConfiguration;
 885   ULONG MaximumInstances;
 886   ULONG CurrentInstances;
 887   ULONG InboundQuota;
 888   ULONG ReadDataAvailable;
 889   ULONG OutboundQuota;
 890   ULONG WriteQuotaAvailable;
 891   ULONG NamedPipeState;
 892   ULONG NamedPipeEnd;
 893 } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
 894
 895 typedef struct _FILE_COMPRESSION_INFORMATION
 896 {
 897   LARGE_INTEGER CompressedFileSize;
 898   USHORT CompressionFormat;
 899   UCHAR CompressionUnitShift;
 900   UCHAR ChunkShift;
 901   UCHAR ClusterShift;
 902   UCHAR Reserved[3];
 903 } FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
 904
 905 typedef struct _FILE_FS_DEVICE_INFORMATION
 906 {
 907   ULONG DeviceType;
 908   ULONG Characteristics;
 909 } FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;
 910
 911 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
 912 {
 913   ULONG FileSystemAttributes;
 914   ULONG MaximumComponentNameLength;
 915   ULONG FileSystemNameLength;
 916   WCHAR FileSystemName[1];
 917 } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
 918
 919 #pragma pack(push,4)
 920 typedef struct _FILE_FS_VOLUME_INFORMATION
 921 {
 922   LARGE_INTEGER VolumeCreationTime;
 923   ULONG VolumeSerialNumber;
 924   ULONG VolumeLabelLength;
 925   BOOLEAN SupportsObjects;
 926   BOOLEAN __dummy;
 927   WCHAR VolumeLabel[1];
 928 } FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
 929 #pragma pack(pop)
 930
 931 typedef struct _FILE_FS_SIZE_INFORMATION
 932 {
 933   LARGE_INTEGER TotalAllocationUnits;
 934   LARGE_INTEGER AvailableAllocationUnits;
 935   ULONG SectorsPerAllocationUnit;
 936   ULONG BytesPerSector;
 937 } FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
 938
 939 typedef struct _FILE_FS_FULL_SIZE_INFORMATION
 940 {
 941   LARGE_INTEGER TotalAllocationUnits;
 942   LARGE_INTEGER CallerAvailableAllocationUnits;
 943   LARGE_INTEGER ActualAvailableAllocationUnits;
 944   ULONG SectorsPerAllocationUnit;
 945   ULONG BytesPerSector;
 946 } FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
 947
 948 typedef struct _FILE_FS_OBJECTID_INFORMATION {
 949     UCHAR ObjectId[16];
 950     UCHAR ExtendedInfo[48];
 951 } FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION;
 952
 953 typedef enum _FSINFOCLASS {
 954   FileFsVolumeInformation = 1,
 955   FileFsLabelInformation,
 956   FileFsSizeInformation,
 957   FileFsDeviceInformation,
 958   FileFsAttributeInformation,
 959   FileFsControlInformation,
 960   FileFsFullSizeInformation,
 961   FileFsObjectIdInformation,
 962   FileFsDriverPathInformation,
 963   FileFsMaximumInformation
 964 } FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;
 965
 966 typedef enum _OBJECT_INFORMATION_CLASS
 967 {
 968   ObjectBasicInformation = 0,
 969   ObjectNameInformation = 1,
 970   ObjectHandleInformation = 4
 971    // and many more
 972 } OBJECT_INFORMATION_CLASS;
 973
 974 typedef struct _OBJECT_BASIC_INFORMATION
 975 {
 976   ULONG Attributes;
 977   ACCESS_MASK GrantedAccess;
 978   ULONG HandleCount;
 979   ULONG PointerCount;
 980   ULONG PagedPoolUsage;
 981   ULONG NonPagedPoolUsage;
 982   ULONG Reserved[3];
 983   ULONG NameInformationLength;
 984   ULONG TypeInformationLength;
 985   ULONG SecurityDescriptorLength;
 986   LARGE_INTEGER CreateTime;
 987 } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
 988
 989 typedef struct _OBJECT_NAME_INFORMATION
 990 {
 991   UNICODE_STRING Name;
 992 } OBJECT_NAME_INFORMATION;
 993
 994 typedef struct _DIRECTORY_BASIC_INFORMATION
 995 {
 996   UNICODE_STRING ObjectName;
 997   UNICODE_STRING ObjectTypeName;
 998 } DIRECTORY_BASIC_INFORMATION, *PDIRECTORY_BASIC_INFORMATION;
 999
1000 typedef struct _FILE_GET_EA_INFORMATION
1001 {
1002   ULONG   NextEntryOffset;
1003   UCHAR   EaNameLength;
1004   CHAR    EaName[1];
1005 } FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
1006
1007 typedef struct _FILE_FULL_EA_INFORMATION
1008 {
1009   ULONG NextEntryOffset;
1010   UCHAR Flags;
1011   UCHAR EaNameLength;
1012   USHORT EaValueLength;
1013   CHAR EaName[1];
1014 } FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;
1015
1016 typedef struct _FILE_MAILSLOT_SET_INFORMATION
1017 {
1018   LARGE_INTEGER ReadTimeout;
1019 } FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
1020
1021 typedef VOID NTAPI (*PIO_APC_ROUTINE)(PVOID, PIO_STATUS_BLOCK, ULONG);
1022
1023 typedef enum _EVENT_TYPE
1024 {
1025   NotificationEvent = 0,
1026   SynchronizationEvent
1027 } EVENT_TYPE, *PEVENT_TYPE;
1028
1029 typedef struct _EVENT_BASIC_INFORMATION
1030 {
1031   EVENT_TYPE EventType;
1032   LONG SignalState;
1033 } EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;
1034
1035 typedef enum _EVENT_INFORMATION_CLASS
1036 {
1037   EventBasicInformation = 0
1038 } EVENT_INFORMATION_CLASS, *PEVENT_INFORMATION_CLASS;
1039
1040 typedef enum _THREAD_INFORMATION_CLASS
1041 {
1042   ThreadBasicInformation = 0,
1043   ThreadTimes = 1,
1044   ThreadImpersonationToken = 5
1045 } THREAD_INFORMATION_CLASS, *PTHREAD_INFORMATION_CLASS;
1046
1047 typedef struct _THREAD_BASIC_INFORMATION {
1048     NTSTATUS  ExitStatus;
1049     PNT_TIB  TebBaseAddress;
1050     CLIENT_ID  ClientId;
1051     KAFFINITY  AffinityMask;
1052     KPRIORITY  Priority;
1053     KPRIORITY  BasePriority;
1054 } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
1055
1056 typedef enum _TIMER_INFORMATION_CLASS {
1057   TimerBasicInformation = 0
1058 } TIMER_INFORMATION_CLASS, *PTIMER_INFORMATION_CLASS;
1059
1060 typedef struct _TIMER_BASIC_INFORMATION {
1061   LARGE_INTEGER TimeRemaining;
1062   BOOLEAN SignalState;
1063 } TIMER_BASIC_INFORMATION, *PTIMER_BASIC_INFORMATION;
1064
1065 typedef NTSTATUS (*PRTL_QUERY_REGISTRY_ROUTINE)
1066                  (PWSTR, ULONG, PVOID, ULONG, PVOID, PVOID);
1067
1068 typedef struct _RTL_QUERY_REGISTRY_TABLE
1069 {
1070   PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine;
1071   ULONG Flags;
1072   PCWSTR Name;
1073   PVOID EntryContext;
1074   ULONG DefaultType;
1075   PVOID DefaultData;
1076   ULONG DefaultLength;
1077 } RTL_QUERY_REGISTRY_TABLE, *PRTL_QUERY_REGISTRY_TABLE;
1078
1079 typedef enum _KEY_VALUE_INFORMATION_CLASS
1080 {
1081   KeyValueBasicInformation = 0,
1082   KeyValueFullInformation,
1083   KeyValuePartialInformation
1084 } KEY_VALUE_INFORMATION_CLASS, *PKEY_VALUE_INFORMATION_CLASS;
1085
1086 typedef struct _KEY_VALUE_PARTIAL_INFORMATION
1087 {
1088   ULONG TitleIndex;
1089   ULONG Type;
1090   ULONG DataLength;
1091   UCHAR Data[1];
1092 } KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;
1093
1094 typedef enum _TIMER_TYPE
1095 {
1096   NotificationTimer,
1097   SynchronisationTimer
1098 } TIMER_TYPE, *PTIMER_TYPE;
1099
1100 typedef VOID (APIENTRY *PTIMER_APC_ROUTINE)(PVOID, ULONG, ULONG);
1101
1102 /* Function declarations for ntdll.dll.  These don't appear in any
1103    standard Win32 header.  */
1104
1105 #ifdef __cplusplus
1106 /* This is the mapping of the KUSER_SHARED_DATA structure into the 32 bit
1107    user address space.  We need it here to access the current DismountCount. */
1108 static KUSER_SHARED_DATA &SharedUserData
1109                          = *(volatile PKUSER_SHARED_DATA) 0x7ffe0000;
1110
1111 extern "C"
1112 {
1113 #endif
1114   NTSTATUS NTAPI NtAccessCheck (PSECURITY_DESCRIPTOR, HANDLE, ACCESS_MASK,
1115                                 PGENERIC_MAPPING, PPRIVILEGE_SET, PULONG,
1116                                 PACCESS_MASK, PNTSTATUS);
1117   NTSTATUS NTAPI NtAdjustPrivilegesToken (HANDLE, BOOLEAN, PTOKEN_PRIVILEGES,
1118                                           ULONG, PTOKEN_PRIVILEGES, PULONG);
1119   NTSTATUS NTAPI NtAllocateLocallyUniqueId (PLUID);
1120   NTSTATUS NTAPI NtAllocateUuids (PLARGE_INTEGER, PULONG, PULONG, PUCHAR);
1121   NTSTATUS NTAPI NtCancelTimer (HANDLE, PBOOLEAN);
1122   NTSTATUS NTAPI NtClose (HANDLE);
1123   NTSTATUS NTAPI NtCommitTransaction (HANDLE, BOOLEAN);
1124   NTSTATUS NTAPI NtCreateDirectoryObject (PHANDLE, ACCESS_MASK,
1125                                           POBJECT_ATTRIBUTES);
1126   NTSTATUS NTAPI NtCreateKey (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, ULONG,
1127                               PUNICODE_STRING, ULONG, PULONG);
1128   NTSTATUS NTAPI NtCreateEvent (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1129                                 EVENT_TYPE, BOOLEAN);
1130   NTSTATUS NTAPI NtCreateFile (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1131                              PIO_STATUS_BLOCK, PLARGE_INTEGER, ULONG, ULONG,
1132                              ULONG, ULONG, PVOID, ULONG);
1133   NTSTATUS NTAPI NtCreateMailslotFile(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1134                                       PIO_STATUS_BLOCK, ULONG, ULONG, ULONG,
1135                                       PLARGE_INTEGER);
1136   NTSTATUS NTAPI NtCreateMutant (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1137                                  BOOLEAN);
1138   NTSTATUS NTAPI NtCreateSection (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1139                                   PLARGE_INTEGER, ULONG, ULONG, HANDLE);
1140   NTSTATUS NTAPI NtCreateSemaphore (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1141                                     LONG, LONG);
1142   NTSTATUS NTAPI NtCreateTimer (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1143                                 TIMER_TYPE);
1144   NTSTATUS NTAPI NtCreateToken (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1145                                 TOKEN_TYPE, PLUID, PLARGE_INTEGER, PTOKEN_USER,
1146                                 PTOKEN_GROUPS, PTOKEN_PRIVILEGES, PTOKEN_OWNER,
1147                                 PTOKEN_PRIMARY_GROUP, PTOKEN_DEFAULT_DACL,
1148                                 PTOKEN_SOURCE);
1149   NTSTATUS NTAPI NtCreateTransaction (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1150                                       LPGUID, HANDLE, ULONG, ULONG, ULONG,
1151                                       PLARGE_INTEGER, PUNICODE_STRING);
1152   NTSTATUS NTAPI NtDuplicateToken (HANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1153                                    BOOLEAN, TOKEN_TYPE, PHANDLE);
1154   NTSTATUS NTAPI NtFsControlFile (HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID,
1155                                   PIO_STATUS_BLOCK, ULONG, PVOID, ULONG,
1156                                   PVOID, ULONG);
1157   NTSTATUS NTAPI NtFlushBuffersFile (HANDLE, PIO_STATUS_BLOCK);
1158   NTSTATUS NTAPI NtLoadKey (POBJECT_ATTRIBUTES, POBJECT_ATTRIBUTES);
1159   NTSTATUS NTAPI NtLockVirtualMemory (HANDLE, PVOID *, ULONG *, ULONG);
1160   NTSTATUS NTAPI NtMapViewOfSection (HANDLE, HANDLE, PVOID *, ULONG, ULONG,
1161                                      PLARGE_INTEGER, PULONG, SECTION_INHERIT,
1162                                      ULONG, ULONG);
1163   NTSTATUS NTAPI NtNotifyChangeDirectoryFile (HANDLE, HANDLE, PIO_APC_ROUTINE,
1164                                               PVOID, PIO_STATUS_BLOCK,
1165                                               PFILE_NOTIFY_INFORMATION, ULONG,
1166                                               ULONG, BOOLEAN);
1167   NTSTATUS NTAPI NtOpenDirectoryObject (PHANDLE, ACCESS_MASK,
1168                                         POBJECT_ATTRIBUTES);
1169   NTSTATUS NTAPI NtOpenEvent (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1170   NTSTATUS NTAPI NtOpenFile (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1171                              PIO_STATUS_BLOCK, ULONG, ULONG);
1172   NTSTATUS NTAPI NtOpenKey (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1173   NTSTATUS NTAPI NtOpenMutant (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1174   NTSTATUS NTAPI NtOpenProcessToken (HANDLE, ACCESS_MASK, PHANDLE);
1175   NTSTATUS NTAPI NtOpenThreadToken (HANDLE, ACCESS_MASK, BOOLEAN, PHANDLE);
1176   NTSTATUS NTAPI NtOpenSection (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1177   NTSTATUS NTAPI NtOpenSemaphore (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1178   NTSTATUS NTAPI NtOpenSymbolicLinkObject (PHANDLE, ACCESS_MASK,
1179                                            POBJECT_ATTRIBUTES);
1180   /* WARNING!  Don't rely on the timestamp information returned by
1181      NtQueryAttributesFile.  Only the DOS file attribute info is reliable. */
1182   NTSTATUS NTAPI NtPrivilegeCheck (HANDLE, PPRIVILEGE_SET, PBOOLEAN);
1183   NTSTATUS NTAPI NtQueryAttributesFile (POBJECT_ATTRIBUTES,
1184                                         PFILE_BASIC_INFORMATION);
1185   NTSTATUS NTAPI NtQueryDirectoryFile(HANDLE, HANDLE, PVOID, PVOID,
1186                                       PIO_STATUS_BLOCK, PVOID, ULONG,
1187                                       FILE_INFORMATION_CLASS, BOOLEAN,
1188                                       PUNICODE_STRING, BOOLEAN);
1189   NTSTATUS NTAPI NtQueryDirectoryObject (HANDLE, PVOID, ULONG, BOOLEAN,
1190                                          BOOLEAN, PULONG, PULONG);
1191   NTSTATUS NTAPI NtQueryEaFile (HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG,
1192                                 BOOLEAN, PVOID, ULONG, PULONG, BOOLEAN);
1193   NTSTATUS NTAPI NtQueryEvent (HANDLE, EVENT_INFORMATION_CLASS, PVOID, ULONG,
1194                                PULONG);
1195   NTSTATUS NTAPI NtQueryFullAttributesFile (POBJECT_ATTRIBUTES,
1196                                             PFILE_NETWORK_OPEN_INFORMATION);
1197   NTSTATUS NTAPI NtQueryInformationFile (HANDLE, PIO_STATUS_BLOCK, PVOID,
1198                                          ULONG, FILE_INFORMATION_CLASS);
1199   NTSTATUS NTAPI NtQueryInformationProcess (HANDLE, PROCESSINFOCLASS,
1200                                             PVOID, ULONG, PULONG);
1201   NTSTATUS NTAPI NtQueryInformationThread (HANDLE, THREAD_INFORMATION_CLASS,
1202                                             PVOID, ULONG, PULONG);
1203   NTSTATUS NTAPI NtQueryInformationToken (HANDLE, TOKEN_INFORMATION_CLASS,
1204                                           PVOID, ULONG, PULONG);
1205   NTSTATUS NTAPI NtQueryObject (HANDLE, OBJECT_INFORMATION_CLASS, VOID *,
1206                                 ULONG, ULONG *);
1207   NTSTATUS NTAPI NtQuerySystemInformation (SYSTEM_INFORMATION_CLASS,
1208                                            PVOID, ULONG, PULONG);
1209   NTSTATUS WINAPI NtQuerySystemTime (PLARGE_INTEGER);
1210   NTSTATUS NTAPI NtQuerySecurityObject (HANDLE, SECURITY_INFORMATION,
1211                                         PSECURITY_DESCRIPTOR, ULONG, PULONG);
1212   NTSTATUS NTAPI NtQuerySymbolicLinkObject (HANDLE, PUNICODE_STRING, PULONG);
1213   NTSTATUS NTAPI NtQueryTimer (HANDLE, TIMER_INFORMATION_CLASS, PVOID,
1214                                ULONG, PULONG);
1215   NTSTATUS NTAPI NtQueryTimerResolution (PULONG, PULONG, PULONG);
1216   NTSTATUS NTAPI NtQueryValueKey (HANDLE, PUNICODE_STRING,
1217                                   KEY_VALUE_INFORMATION_CLASS, PVOID, ULONG,
1218                                   PULONG);
1219   NTSTATUS NTAPI NtQueryVirtualMemory (HANDLE, PVOID, MEMORY_INFORMATION_CLASS,
1220                                        PVOID, ULONG, PULONG);
1221   NTSTATUS NTAPI NtQueryVolumeInformationFile (HANDLE, IO_STATUS_BLOCK *,
1222                                                VOID *, ULONG,
1223                                                FS_INFORMATION_CLASS);
1224   NTSTATUS NTAPI NtReadFile (HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID,
1225                              PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER,
1226                              PULONG);
1227   NTSTATUS NTAPI NtRollbackTransaction (HANDLE, BOOLEAN);
1228   NTSTATUS NTAPI NtSetEaFile (HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG);
1229   NTSTATUS NTAPI NtSetEvent (HANDLE, PULONG);
1230   NTSTATUS NTAPI NtSetInformationFile (HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG,
1231                                        FILE_INFORMATION_CLASS);
1232   NTSTATUS NTAPI NtSetInformationThread (HANDLE, THREAD_INFORMATION_CLASS,
1233                                          PVOID, ULONG);
1234   NTSTATUS NTAPI NtSetInformationToken (HANDLE, TOKEN_INFORMATION_CLASS, PVOID,
1235                                         ULONG);
1236   NTSTATUS NTAPI NtSetSecurityObject (HANDLE, SECURITY_INFORMATION,
1237                                       PSECURITY_DESCRIPTOR);
1238   NTSTATUS NTAPI NtSetTimer (HANDLE, PLARGE_INTEGER, PTIMER_APC_ROUTINE, PVOID,
1239                              BOOLEAN, LONG, PBOOLEAN);
1240   NTSTATUS NTAPI NtSetTimerResolution (ULONG, BOOLEAN, PULONG);
1241   NTSTATUS NTAPI NtSetValueKey (HANDLE, PUNICODE_STRING, ULONG, ULONG, PVOID,
1242                                 ULONG);
1243   NTSTATUS NTAPI NtUnlockVirtualMemory (HANDLE, PVOID *, ULONG *, ULONG);
1244   NTSTATUS NTAPI NtUnmapViewOfSection (HANDLE, PVOID);
1245   NTSTATUS NTAPI NtWriteFile (HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID,
1246                               PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER,
1247                               PULONG);
1248   NTSTATUS NTAPI RtlAbsoluteToSelfRelativeSD (PSECURITY_DESCRIPTOR,
1249                                               PSECURITY_DESCRIPTOR, PULONG);
1250   VOID NTAPI RtlAcquirePebLock ();
1251   NTSTATUS NTAPI RtlAddAccessAllowedAce (PACL, ULONG, ACCESS_MASK, PSID);
1252   NTSTATUS NTAPI RtlAddAccessDeniedAce (PACL, ULONG, ACCESS_MASK, PSID);
1253   NTSTATUS NTAPI RtlAddAce (PACL, ULONG, ULONG, PVOID, ULONG);
1254   PVOID NTAPI RtlAllocateHeap (PVOID, ULONG, SIZE_T);
1255   NTSTATUS NTAPI RtlAppendUnicodeToString (PUNICODE_STRING, PCWSTR);
1256   NTSTATUS NTAPI RtlAppendUnicodeStringToString (PUNICODE_STRING,
1257                                                  PUNICODE_STRING);
1258   NTSTATUS NTAPI RtlAnsiStringToUnicodeString (PUNICODE_STRING, PANSI_STRING,
1259                                                BOOLEAN);
1260   NTSTATUS NTAPI RtlCheckRegistryKey (ULONG, PCWSTR);
1261   LONG NTAPI RtlCompareUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
1262                                       BOOLEAN);
1263   NTSTATUS NTAPI RtlConvertSidToUnicodeString (PUNICODE_STRING, PSID, BOOLEAN);
1264   NTSTATUS NTAPI RtlConvertToAutoInheritSecurityObject (PSECURITY_DESCRIPTOR,
1265                                                         PSECURITY_DESCRIPTOR,
1266                                                         PSECURITY_DESCRIPTOR *,
1267                                                         GUID *, BOOLEAN,
1268                                                         PGENERIC_MAPPING);
1269   NTSTATUS NTAPI RtlCopySid (ULONG, PSID, PSID);
1270   VOID NTAPI RtlCopyUnicodeString (PUNICODE_STRING, PUNICODE_STRING);
1271   NTSTATUS NTAPI RtlCreateAcl (PACL, ULONG, ULONG);
1272   PDEBUG_BUFFER NTAPI RtlCreateQueryDebugBuffer (ULONG, BOOLEAN);
1273   NTSTATUS NTAPI RtlCreateRegistryKey (ULONG, PCWSTR);
1274   NTSTATUS NTAPI RtlCreateSecurityDescriptor (PSECURITY_DESCRIPTOR, ULONG);
1275   BOOLEAN NTAPI RtlCreateUnicodeStringFromAsciiz (PUNICODE_STRING, PCSTR);
1276   NTSTATUS NTAPI RtlDeleteSecurityObject (PSECURITY_DESCRIPTOR *);
1277   NTSTATUS NTAPI RtlDestroyQueryDebugBuffer (PDEBUG_BUFFER);
1278   NTSTATUS NTAPI RtlDowncaseUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
1279                                            BOOLEAN);
1280   NTSTATUS NTAPI RtlEnterCriticalSection (PRTL_CRITICAL_SECTION);
1281   BOOLEAN NTAPI RtlEqualPrefixSid (PSID, PSID);
1282   BOOLEAN NTAPI RtlEqualSid (PSID, PSID);
1283   BOOLEAN NTAPI RtlEqualUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
1284                                        BOOLEAN);
1285   VOID NTAPI RtlFreeAnsiString (PANSI_STRING);
1286   BOOLEAN NTAPI RtlFreeHeap (PVOID, ULONG, PVOID);
1287   VOID NTAPI RtlFreeOemString (POEM_STRING);
1288   VOID NTAPI RtlFreeUnicodeString (PUNICODE_STRING);
1289   BOOLEAN NTAPI RtlFirstFreeAce (PACL, PVOID *);
1290   NTSTATUS NTAPI RtlGetAce (PACL, ULONG, PVOID);
1291   NTSTATUS NTAPI RtlGetControlSecurityDescriptor (PSECURITY_DESCRIPTOR,
1292                                                   PSECURITY_DESCRIPTOR_CONTROL,
1293                                                   PULONG);
1294   HANDLE NTAPI RtlGetCurrentTransaction ();
1295   NTSTATUS NTAPI RtlGetDaclSecurityDescriptor (PSECURITY_DESCRIPTOR, PBOOLEAN,
1296                                                PACL *, PBOOLEAN);
1297   NTSTATUS NTAPI RtlGetGroupSecurityDescriptor (PSECURITY_DESCRIPTOR, PSID *,
1298                                                 PBOOLEAN);
1299   NTSTATUS NTAPI RtlGetOwnerSecurityDescriptor (PSECURITY_DESCRIPTOR, PSID *,
1300                                                 PBOOLEAN);
1301   PSID_IDENTIFIER_AUTHORITY NTAPI RtlIdentifierAuthoritySid (PSID);
1302   VOID NTAPI RtlInitEmptyUnicodeString (PUNICODE_STRING, PCWSTR, USHORT);
1303   NTSTATUS NTAPI RtlInitializeSid (PSID, PSID_IDENTIFIER_AUTHORITY, UCHAR);
1304   VOID NTAPI RtlInitUnicodeString (PUNICODE_STRING, PCWSTR);
1305   NTSTATUS NTAPI RtlIntegerToUnicodeString (ULONG, ULONG, PUNICODE_STRING);
1306   ULONG NTAPI RtlIsDosDeviceName_U (PCWSTR);
1307   NTSTATUS NTAPI RtlLeaveCriticalSection (PRTL_CRITICAL_SECTION);
1308   ULONG NTAPI RtlLengthSecurityDescriptor (PSECURITY_DESCRIPTOR);
1309   ULONG NTAPI RtlLengthSid (PSID);
1310   ULONG NTAPI RtlNtStatusToDosError (NTSTATUS);
1311   NTSTATUS NTAPI RtlOemStringToUnicodeString (PUNICODE_STRING, POEM_STRING,
1312                                                BOOLEAN);
1313   BOOLEAN NTAPI RtlPrefixUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
1314                                         BOOLEAN);
1315   NTSTATUS NTAPI RtlQueryProcessDebugInformation (ULONG, ULONG, PDEBUG_BUFFER);
1316   NTSTATUS NTAPI RtlQueryRegistryValues (ULONG, PCWSTR,
1317                                          PRTL_QUERY_REGISTRY_TABLE, PVOID,
1318                                          PVOID);
1319   VOID NTAPI RtlReleasePebLock ();
1320   VOID NTAPI RtlSecondsSince1970ToTime (ULONG, PLARGE_INTEGER);
1321   NTSTATUS NTAPI RtlSetCurrentDirectory_U (PUNICODE_STRING);
1322   BOOLEAN NTAPI RtlSetCurrentTransaction (HANDLE);
1323   NTSTATUS NTAPI RtlSetControlSecurityDescriptor (PSECURITY_DESCRIPTOR,
1324                                                   SECURITY_DESCRIPTOR_CONTROL,
1325                                                   SECURITY_DESCRIPTOR_CONTROL);
1326   NTSTATUS NTAPI RtlSetDaclSecurityDescriptor (PSECURITY_DESCRIPTOR, BOOLEAN,
1327                                                PACL, BOOLEAN);
1328   NTSTATUS NTAPI RtlSetGroupSecurityDescriptor (PSECURITY_DESCRIPTOR, PSID,
1329                                                 BOOLEAN);
1330   NTSTATUS NTAPI RtlSetOwnerSecurityDescriptor (PSECURITY_DESCRIPTOR, PSID,
1331                                                 BOOLEAN);
1332   PUCHAR NTAPI RtlSubAuthorityCountSid (PSID);
1333   PULONG NTAPI RtlSubAuthoritySid (PSID, ULONG);
1334   NTSTATUS NTAPI RtlUnicodeStringToAnsiString (PANSI_STRING, PUNICODE_STRING,
1335                                                BOOLEAN);
1336   NTSTATUS NTAPI RtlUnicodeStringToOemString (PANSI_STRING, PUNICODE_STRING,
1337                                               BOOLEAN);
1338   WCHAR NTAPI RtlUpcaseUnicodeChar (WCHAR);
1339   NTSTATUS NTAPI RtlUpcaseUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
1340                                          BOOLEAN);
1341   NTSTATUS NTAPI RtlWriteRegistryValue (ULONG, PCWSTR, PCWSTR, ULONG, PVOID,
1342                                         ULONG);
1343
1344 #ifdef __cplusplus
1345   /* A few Rtl functions are either actually macros, or they just don't
1346      exist even though they would be a big help.  We implement them here,
1347      partly as inline functions. */
1348
1349   /* RtlInitEmptyUnicodeString is defined as a macro in wdm.h, but that file
1350      is missing entirely in w32api. */
1351   inline
1352   VOID NTAPI RtlInitEmptyUnicodeString(PUNICODE_STRING dest, PCWSTR buf,
1353                                        USHORT len)
1354   {
1355     dest->Length = 0;
1356     dest->MaximumLength = len;
1357     dest->Buffer = (PWSTR) buf;
1358   }
1359   /* Like RtlInitEmptyUnicodeString, but initialize Length to len, too.
1360      This is for instance useful when creating a UNICODE_STRING from an
1361      NtQueryInformationFile info buffer, where the length of the filename
1362      is known, but you can't rely on the string being 0-terminated.
1363      If you know it's 0-terminated, just use RtlInitUnicodeString(). */
1364   inline
1365   VOID NTAPI RtlInitCountedUnicodeString (PUNICODE_STRING dest, PCWSTR buf,
1366                                           USHORT len)
1367   {
1368     dest->Length = dest->MaximumLength = len;
1369     dest->Buffer = (PWSTR) buf;
1370   }
1371   /* Split path into dirname and basename part.  This function does not
1372      copy anything!  It just initializes the dirname and basename
1373      UNICODE_STRINGs so that their Buffer members point to the right spot
1374      into path's Buffer, and the Length (and MaximumLength) members are set
1375      to match the dirname part and the basename part.
1376      Note that dirname's Length is set so that it also includes the trailing
1377      backslash.  If you don't need it, just subtract sizeof(WCHAR) from
1378      dirname.Length. */
1379   inline
1380   VOID NTAPI RtlSplitUnicodePath (PUNICODE_STRING path, PUNICODE_STRING dirname,
1381                                   PUNICODE_STRING basename)
1382   {
1383     USHORT len = path->Length / sizeof (WCHAR);
1384     while (len > 0 && path->Buffer[--len] != L'\\')
1385       ;
1386     ++len;
1387     if (dirname)
1388       RtlInitCountedUnicodeString (dirname, path->Buffer, len * sizeof (WCHAR));
1389     if (basename)
1390       RtlInitCountedUnicodeString (basename, &path->Buffer[len],
1391                                    path->Length - len * sizeof (WCHAR));
1392   }
1393   /* Check if prefix is a prefix of path. */
1394   inline
1395   BOOLEAN NTAPI RtlEqualUnicodePathPrefix (PUNICODE_STRING path,
1396                                            PUNICODE_STRING prefix,
1397                                            BOOLEAN caseinsensitive)
1398   {
1399     UNICODE_STRING p;
1400
1401     RtlInitCountedUnicodeString (&p, path->Buffer,
1402                                  prefix->Length < path->Length
1403                                  ? prefix->Length : path->Length);
1404     return RtlEqualUnicodeString (&p, prefix, caseinsensitive);
1405   }
1406   /* Check if suffix is a suffix of path. */
1407   inline
1408   BOOL NTAPI RtlEqualUnicodePathSuffix (PUNICODE_STRING path,
1409                                         PUNICODE_STRING suffix,
1410                                         BOOLEAN caseinsensitive)
1411   {
1412     UNICODE_STRING p;
1413
1414     if (suffix->Length < path->Length)
1415       RtlInitCountedUnicodeString (&p, (PWCHAR) ((PBYTE) path->Buffer
1416                                        + path->Length - suffix->Length),
1417                                    suffix->Length);
1418     else
1419       RtlInitCountedUnicodeString (&p, path->Buffer, path->Length);
1420     return RtlEqualUnicodeString (&p, suffix, caseinsensitive);
1421   }
1422   /* Implemented in strfuncs.cc.  Create a Hex UNICODE_STRING from a given
1423      64 bit integer value.  If append is TRUE, append the hex string,
1424      otherwise overwrite dest.  Returns either STATUS_SUCCESS, or
1425      STATUS_BUFFER_OVERFLOW, if the unicode buffer is too small (hasn't
1426      room for 16 WCHARs). */
1427   NTSTATUS NTAPI RtlInt64ToHexUnicodeString (ULONGLONG value,
1428                                              PUNICODE_STRING dest,
1429                                              BOOLEAN append);
1430   /* Set file attributes.  Don't change file times. */
1431   inline
1432   NTSTATUS NTAPI NtSetAttributesFile (HANDLE h, ULONG attr)
1433   {
1434     IO_STATUS_BLOCK io;
1435     FILE_BASIC_INFORMATION fbi;
1436     fbi.CreationTime.QuadPart = fbi.LastAccessTime.QuadPart =
1437     fbi.LastWriteTime.QuadPart = fbi.ChangeTime.QuadPart = 0LL;
1438     fbi.FileAttributes = attr ?: FILE_ATTRIBUTE_NORMAL;
1439     return NtSetInformationFile(h, &io, &fbi, sizeof fbi, FileBasicInformation);
1440   }
1441
1442   /* This test for a signalled event is twice as fast as calling
1443      WaitForSingleObject (event, 0). */
1444   inline
1445   BOOL NTAPI IsEventSignalled (HANDLE event)
1446   {
1447     EVENT_BASIC_INFORMATION ebi;
1448     return NT_SUCCESS (NtQueryEvent (event, EventBasicInformation,
1449                                      &ebi, sizeof ebi, NULL))
1450            && ebi.SignalState != 0;
1451
1452   }
1453 }
1454 #endif
1455 #endif /*_NTDLL_H*/