--- /dev/null
+;note that the Zw... functions are alternate names for the\r
+;Nt... functions. (see www.sysinternals.com for details)\r
+;if you change a Nt.. function DON'T FORGET to change the\r
+;Zw one too.\r
+\r
+LIBRARY ntdll.dll\r
+EXPORTS\r
+\r
+DbgBreakPoint@0\r
+DbgPrint\r
+DbgUiConnectToDbg@0\r
+DbgUiContinue@8\r
+DbgUiWaitStateChange@8\r
+DbgUserBreakPoint@0\r
+LdrGetProcedureAddress@16\r
+LdrProcessRelocationBlock@16\r
+NlsAnsiCodePage\r
+NlsMbCodePageTag\r
+NlsMbOemCodePageTag\r
+NtAllocateVirtualMemory@24\r
+NtClose@4\r
+NtCreateFile@44\r
+NtCurrentTeb@0\r
+NtDisplayString@4\r
+NtFlushVirtualMemory@16\r
+NtFreeVirtualMemory@16\r
+NtLockVirtualMemory@16\r
+NtOpenFile@24\r
+NtProtectVirtualMemory@20\r
+NtQueryVirtualMemory@24\r
+NtReadFile@36\r
+NtReadVirtualMemory@20\r
+NtUnlockVirtualMemory@16\r
+NtWriteFile@36\r
+NtWriteVirtualMemory@20\r
+RtlAcquirePebLock@0\r
+RtlAllocateAndInitializeSid@44\r
+RtlAllocateHandle@8\r
+RtlAllocateHeap@12\r
+RtlAnsiCharToUnicodeChar@4\r
+RtlAnsiStringToUnicodeSize@4\r
+RtlAnsiStringToUnicodeString@12\r
+RtlAppendAsciizToString@8\r
+RtlAppendStringToString@8\r
+RtlAppendUnicodeStringToString@8\r
+RtlAppendUnicodeToString@8\r
+RtlAreBitsClear@12\r
+RtlAreBitsSet@12\r
+RtlCharToInteger@12\r
+RtlClearAllBits@4\r
+RtlClearBits@12\r
+RtlCompareMemory@12\r
+RtlCompareMemoryUlong@12\r
+RtlCompareString@12\r
+RtlCompareUnicodeString@12\r
+RtlConvertSidToUnicodeString@12\r
+RtlCopySid@12\r
+RtlCopyString@8\r
+RtlCopyUnicodeString@8\r
+RtlCreateEnvironment@8\r
+RtlCreateHeap@24\r
+RtlCreateProcessParameters@40\r
+RtlCreateUnicodeString@8\r
+RtlDeNormalizeProcessParams@4\r
+RtlDestroyEnvironment@4\r
+RtlDestroyHandleTable@4\r
+RtlDestroyHeap@4\r
+RtlDestroyProcessParameters@4\r
+RtlDetermineDosPathNameType_U@4\r
+RtlDoesFileExists_U@4\r
+RtlDosPathNameToNtPathName_U@16\r
+RtlDosSearchPath_U@24\r
+RtlDowncaseUnicodeString@12\r
+RtlEnumProcessHeaps@8\r
+RtlEqualComputerName@8\r
+RtlEqualDomainName@8\r
+RtlEqualPrefixSid@8\r
+RtlEqualSid@8\r
+RtlEqualString@12\r
+RtlEqualUnicodeString@12\r
+RtlEraseUnicodeString@4\r
+RtlExpandEnvironmentStrings_U@16\r
+RtlFillMemory@12\r
+RtlFillMemoryUlong@12\r
+RtlFindClearBits@12\r
+RtlFindClearBitsAndSet@12\r
+RtlFindLongestRunClear@8\r
+RtlFindLongestRunSet@8\r
+RtlFindSetBits@12\r
+RtlFindSetBitsAndClear@12\r
+RtlFreeAnsiString@4\r
+RtlFreeHandle@8\r
+RtlFreeHeap@12\r
+RtlFreeOemString@4\r
+RtlFreeSid@4\r
+RtlFreeUnicodeString@4\r
+RtlGetCurrentDirectory_U@8\r
+RtlGetFullPathName_U@16\r
+RtlGetLongestNtPathLength@0\r
+RtlGetNtGlobalFlags@0\r
+RtlGetProcessHeaps@8\r
+RtlIdentifierAuthoritySid@4\r
+RtlImageDirectoryEntryToData@16\r
+RtlImageNtHeader@4\r
+RtlImageRvaToSection@12\r
+RtlImageRvaToVa@16\r
+RtlInitAnsiString@8\r
+RtlInitCodePageTable@8\r
+RtlInitNlsTables@16\r
+RtlInitString@8\r
+RtlInitUnicodeString@8\r
+RtlInitializeBitMap@12\r
+RtlInitializeHandleTable@12\r
+RtlInitializeSid@12\r
+RtlIntegerToChar@16\r
+RtlIntegerToUnicodeString@12\r
+RtlIsDosDeviceName_U@4\r
+RtlIsNameLegalDOS8Dot3@12\r
+RtlIsValidHandle@8\r
+RtlIsValidIndexHandle@12\r
+RtlLengthRequiredSid@4\r
+RtlLengthSid@4\r
+RtlLockHeap@4\r
+RtlMoveMemory@12\r
+RtlNormalizeProcessParams@4\r
+RtlNtStatusToDosError@4\r
+RtlNumberOfClearBits@4\r
+RtlNumberOfSetBits@4\r
+RtlOemStringToUnicodeSize@4\r
+RtlOemStringToUnicodeString@12\r
+RtlOemToUnicodeN@12\r
+RtlPrefixString@12\r
+RtlPrefixUnicodeString@12\r
+RtlQueryEnvironmentVariable_U@12\r
+RtlReAllocateHeap@16\r
+RtlReleasePebLock@0\r
+RtlResetRtlTranslations@4\r
+RtlSetAllBits@4\r
+RtlSetBits@12\r
+RtlSetCurrentDirectory_U@4\r
+RtlSetCurrentEnvironment@8\r
+RtlSetEnvironmentVariable@12\r
+RtlSizeHeap@12\r
+RtlSubAuthorityCountSid@4\r
+RtlSubAuthoritySid@8\r
+RtlUnicodeStringToAnsiSize@4\r
+RtlUnicodeStringToAnsiString@12\r
+RtlUnicodeStringToCountedOemString@12\r
+RtlUnicodeStringToOemSize@4\r
+RtlUnicodeStringToOemString@12\r
+RtlUnicodeToMultiByteN@20\r
+RtlUnicodeToMultiByteSize@12\r
+RtlUnicodeToOemN@20\r
+RtlUnlockHeap@4\r
+RtlUpcaseUnicodeChar@4\r
+RtlUpcaseUnicodeString@12\r
+RtlUpcaseUnicodeStringToAnsiString@12\r
+RtlUpcaseUnicodeStringToCountedOemString@12\r
+RtlUpcaseUnicodeStringToOemString@12\r
+RtlUpcaseUnicodeToMultiByteN@20\r
+RtlUpcaseUnicodeToOemN@20\r
+RtlUpperChar@4\r
+RtlUpperString@12\r
+RtlValidSid@4\r
+RtlValidateHeap@12\r
+RtlValidateProcessHeaps@0\r
+RtlZeroMemory@8\r
+RtlxAnsiStringToUnicodeSize@4\r
+RtlxOemStringToUnicodeSize@4\r
+RtlxUnicodeStringToAnsiSize@4\r
+RtlxUnicodeStringToOemSize@4\r
+ZwAllocateVirtualMemory@24\r
+ZwClose@4\r
+ZwCreateFile@44\r
+ZwFlushVirtualMemory@16\r
+ZwFreeVirtualMemory@16\r
+ZwLockVirtualMemory@16\r
+ZwOpenFile@24\r
+ZwProtectVirtualMemory@20\r
+ZwQueryVirtualMemory@24\r
+ZwReadFile@36\r
+ZwReadVirtualMemory@20\r
+ZwUnlockVirtualMemory@16\r
+ZwWriteFile@36 \r
+ZwWriteVirtualMemory@20\r
+__isascii\r
+__iscsym\r
+__iscsymf\r
+__toascii\r
+_itoa\r
+_itow\r
+_ltoa\r
+_ltow\r
+_snprintf\r
+_snwprintf\r
+_strcmpi\r
+_stricmp\r
+_strlwr\r
+_strnicmp\r
+_strupr\r
+_tolower\r
+_toupper\r
+_ultoa\r
+_ultow\r
+_vsnprintf\r
+_wcsicmp\r
+_wcslwr\r
+_wcsnicmp\r
+_wcsupr\r
+_wtoi\r
+_wtol\r
+abs\r
+atan\r
+atoi\r
+atol\r
+ceil\r
+cos\r
+fabs\r
+floor\r
+isalnum\r
+isalpha\r
+iscntrl\r
+isdigit\r
+isgraph\r
+islower\r
+isprint\r
+ispunct\r
+isspace\r
+isupper\r
+iswalpha\r
+iswctype\r
+isxdigit\r
+labs\r
+log\r
+mbstowcs\r
+memchr\r
+memcmp\r
+memcpy\r
+memmove\r
+memset\r
+pow\r
+sin\r
+sprintf\r
+sqrt\r
+strcat\r
+strchr\r
+strcmp\r
+strcpy\r
+strcspn\r
+strlen\r
+strncat\r
+strncmp\r
+strncpy\r
+strpbrk\r
+strrchr\r
+strspn\r
+strstr\r
+strtol\r
+strtoul\r
+swprintf\r
+tan\r
+tolower\r
+toupper\r
+towlower\r
+towupper\r
+vsprintf\r
+wcscat\r
+wcschr\r
+wcscmp\r
+wcscpy\r
+wcscspn\r
+wcslen\r
+wcsncat\r
+wcsncmp\r
+wcsncpy\r
+wcspbrk\r
+wcsrchr\r
+wcsspn\r
+wcsstr\r
+wcstol\r
+wcstombs\r
+wcstoul\r
OSDN Git Service
