[NDK] Add SAL 2 annotations, use dummy annotations, if no SAL is available

[PSDK/DDK/XDK] Fix a number of annotations, change the order in wdm.h fix IRQL annotations

svn path=/trunk/; revision=58164
This commit is contained in:
Timo Kreuzer 2013-01-13 14:49:21 +00:00
parent c7e752270c
commit 4526c85235
45 changed files with 5313 additions and 4545 deletions

View file

@ -1900,6 +1900,45 @@ typedef struct _HAL_PLATFORM_INFORMATION {
* Kernel Types *
******************************************************************************/
typedef struct _NT_TIB {
struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList;
PVOID StackBase;
PVOID StackLimit;
PVOID SubSystemTib;
_ANONYMOUS_UNION union {
PVOID FiberData;
ULONG Version;
} DUMMYUNIONNAME;
PVOID ArbitraryUserPointer;
struct _NT_TIB *Self;
} NT_TIB, *PNT_TIB;
typedef struct _NT_TIB32 {
ULONG ExceptionList;
ULONG StackBase;
ULONG StackLimit;
ULONG SubSystemTib;
_ANONYMOUS_UNION union {
ULONG FiberData;
ULONG Version;
} DUMMYUNIONNAME;
ULONG ArbitraryUserPointer;
ULONG Self;
} NT_TIB32,*PNT_TIB32;
typedef struct _NT_TIB64 {
ULONG64 ExceptionList;
ULONG64 StackBase;
ULONG64 StackLimit;
ULONG64 SubSystemTib;
_ANONYMOUS_UNION union {
ULONG64 FiberData;
ULONG Version;
} DUMMYUNIONNAME;
ULONG64 ArbitraryUserPointer;
ULONG64 Self;
} NT_TIB64,*PNT_TIB64;
#define NX_SUPPORT_POLICY_ALWAYSOFF 0
#define NX_SUPPORT_POLICY_ALWAYSON 1
#define NX_SUPPORT_POLICY_OPTIN 2
@ -2083,6 +2122,7 @@ extern PCCHAR KeNumberProcessors;
#endif
/******************************************************************************
* Kernel Debugger Types *
******************************************************************************/
@ -2390,45 +2430,6 @@ typedef VOID
#define PROCESS_HANDLE_TRACING_MAX_STACKS 16
typedef struct _NT_TIB {
struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList;
PVOID StackBase;
PVOID StackLimit;
PVOID SubSystemTib;
_ANONYMOUS_UNION union {
PVOID FiberData;
ULONG Version;
} DUMMYUNIONNAME;
PVOID ArbitraryUserPointer;
struct _NT_TIB *Self;
} NT_TIB, *PNT_TIB;
typedef struct _NT_TIB32 {
ULONG ExceptionList;
ULONG StackBase;
ULONG StackLimit;
ULONG SubSystemTib;
_ANONYMOUS_UNION union {
ULONG FiberData;
ULONG Version;
} DUMMYUNIONNAME;
ULONG ArbitraryUserPointer;
ULONG Self;
} NT_TIB32,*PNT_TIB32;
typedef struct _NT_TIB64 {
ULONG64 ExceptionList;
ULONG64 StackBase;
ULONG64 StackLimit;
ULONG64 SubSystemTib;
_ANONYMOUS_UNION union {
ULONG64 FiberData;
ULONG Version;
} DUMMYUNIONNAME;
ULONG64 ArbitraryUserPointer;
ULONG64 Self;
} NT_TIB64,*PNT_TIB64;
typedef enum _PROCESSINFOCLASS {
ProcessBasicInformation,
ProcessQuotaLimits,
@ -2851,68 +2852,6 @@ typedef struct _RTL_DYNAMIC_HASH_TABLE {
PVOID Directory;
} RTL_DYNAMIC_HASH_TABLE, *PRTL_DYNAMIC_HASH_TABLE;
typedef struct _OSVERSIONINFOA {
ULONG dwOSVersionInfoSize;
ULONG dwMajorVersion;
ULONG dwMinorVersion;
ULONG dwBuildNumber;
ULONG dwPlatformId;
CHAR szCSDVersion[128];
} OSVERSIONINFOA, *POSVERSIONINFOA, *LPOSVERSIONINFOA;
typedef struct _OSVERSIONINFOW {
ULONG dwOSVersionInfoSize;
ULONG dwMajorVersion;
ULONG dwMinorVersion;
ULONG dwBuildNumber;
ULONG dwPlatformId;
WCHAR szCSDVersion[128];
} OSVERSIONINFOW, *POSVERSIONINFOW, *LPOSVERSIONINFOW, RTL_OSVERSIONINFOW, *PRTL_OSVERSIONINFOW;
typedef struct _OSVERSIONINFOEXA {
ULONG dwOSVersionInfoSize;
ULONG dwMajorVersion;
ULONG dwMinorVersion;
ULONG dwBuildNumber;
ULONG dwPlatformId;
CHAR szCSDVersion[128];
USHORT wServicePackMajor;
USHORT wServicePackMinor;
USHORT wSuiteMask;
UCHAR wProductType;
UCHAR wReserved;
} OSVERSIONINFOEXA, *POSVERSIONINFOEXA, *LPOSVERSIONINFOEXA;
typedef struct _OSVERSIONINFOEXW {
ULONG dwOSVersionInfoSize;
ULONG dwMajorVersion;
ULONG dwMinorVersion;
ULONG dwBuildNumber;
ULONG dwPlatformId;
WCHAR szCSDVersion[128];
USHORT wServicePackMajor;
USHORT wServicePackMinor;
USHORT wSuiteMask;
UCHAR wProductType;
UCHAR wReserved;
} OSVERSIONINFOEXW, *POSVERSIONINFOEXW, *LPOSVERSIONINFOEXW, RTL_OSVERSIONINFOEXW, *PRTL_OSVERSIONINFOEXW;
#ifdef UNICODE
typedef OSVERSIONINFOEXW OSVERSIONINFOEX;
typedef POSVERSIONINFOEXW POSVERSIONINFOEX;
typedef LPOSVERSIONINFOEXW LPOSVERSIONINFOEX;
typedef OSVERSIONINFOW OSVERSIONINFO;
typedef POSVERSIONINFOW POSVERSIONINFO;
typedef LPOSVERSIONINFOW LPOSVERSIONINFO;
#else
typedef OSVERSIONINFOEXA OSVERSIONINFOEX;
typedef POSVERSIONINFOEXA POSVERSIONINFOEX;
typedef LPOSVERSIONINFOEXA LPOSVERSIONINFOEX;
typedef OSVERSIONINFOA OSVERSIONINFO;
typedef POSVERSIONINFOA POSVERSIONINFO;
typedef LPOSVERSIONINFOA LPOSVERSIONINFO;
#endif /* UNICODE */
#define HASH_ENTRY_KEY(x) ((x)->Signature)
/******************************************************************************
@ -5043,20 +4982,6 @@ RtlVolumeDeviceToDosName(
_In_ PVOID VolumeDeviceObject,
_Out_ PUNICODE_STRING DosName);
NTSYSAPI
NTSTATUS
NTAPI
RtlGetVersion(
IN OUT PRTL_OSVERSIONINFOW lpVersionInformation);
NTSYSAPI
NTSTATUS
NTAPI
RtlVerifyVersionInfo(
IN PRTL_OSVERSIONINFOEXW VersionInfo,
IN ULONG TypeMask,
IN ULONGLONG ConditionMask);
_IRQL_requires_max_(PASSIVE_LEVEL)
_Must_inspect_result_
NTSYSAPI

View file

@ -2366,7 +2366,7 @@ NTSTATUS
NTAPI
NtAllocateVirtualMemory(
_In_ HANDLE ProcessHandle,
_Outptr_result_bytebuffer_(*RegionSize) PVOID *BaseAddress,
_Inout_ _At_(*BaseAddress, _Readable_bytes_(*RegionSize) _Writable_bytes_(*RegionSize) _Post_readable_byte_size_(*RegionSize)) PVOID *BaseAddress,
_In_ ULONG_PTR ZeroBits,
_Inout_ PSIZE_T RegionSize,
_In_ ULONG AllocationType,
@ -11303,37 +11303,37 @@ FsRtlNotifyChangeDirectory (
NTKERNELAPI
NTSTATUS
NTAPI
ObCreateObject (
IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL,
IN POBJECT_TYPE ObjectType,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN KPROCESSOR_MODE AccessMode,
IN OUT PVOID ParseContext OPTIONAL,
IN ULONG ObjectSize,
IN ULONG PagedPoolCharge OPTIONAL,
IN ULONG NonPagedPoolCharge OPTIONAL,
OUT PVOID *Object
ObCreateObject(
_In_opt_ KPROCESSOR_MODE ObjectAttributesAccessMode,
_In_ POBJECT_TYPE ObjectType,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ KPROCESSOR_MODE AccessMode,
_Inout_opt_ PVOID ParseContext,
_In_ ULONG ObjectSize,
_In_opt_ ULONG PagedPoolCharge,
_In_opt_ ULONG NonPagedPoolCharge,
_Out_ PVOID *Object
);
NTKERNELAPI
ULONG
NTAPI
ObGetObjectPointerCount (
IN PVOID Object
ObGetObjectPointerCount(
_In_ PVOID Object
);
NTKERNELAPI
NTSTATUS
NTAPI
ObReferenceObjectByName (
IN PUNICODE_STRING ObjectName,
IN ULONG Attributes,
IN PACCESS_STATE PassedAccessState OPTIONAL,
IN ACCESS_MASK DesiredAccess OPTIONAL,
IN POBJECT_TYPE ObjectType,
IN KPROCESSOR_MODE AccessMode,
IN OUT PVOID ParseContext OPTIONAL,
OUT PVOID *Object
ObReferenceObjectByName(
_In_ PUNICODE_STRING ObjectName,
_In_ ULONG Attributes,
_In_opt_ PACCESS_STATE PassedAccessState,
_In_opt_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_TYPE ObjectType,
_In_ KPROCESSOR_MODE AccessMode,
_Inout_opt_ PVOID ParseContext,
_Out_ PVOID *Object
);
#define PsDereferenceImpersonationToken(T) \
@ -11347,36 +11347,37 @@ ObReferenceObjectByName (
NTKERNELAPI
NTSTATUS
NTAPI
PsLookupProcessThreadByCid (
IN PCLIENT_ID Cid,
OUT PEPROCESS *Process OPTIONAL,
OUT PETHREAD *Thread
PsLookupProcessThreadByCid(
_In_ PCLIENT_ID Cid,
_Out_opt_ PEPROCESS *Process,
_Out_ PETHREAD *Thread
);
NTSYSAPI
NTSTATUS
NTAPI
RtlSetSaclSecurityDescriptor (
IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
IN BOOLEAN SaclPresent,
IN PACL Sacl,
IN BOOLEAN SaclDefaulted
RtlSetSaclSecurityDescriptor(
_Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ BOOLEAN SaclPresent,
_In_ PACL Sacl,
_In_ BOOLEAN SaclDefaulted
);
#define SeEnableAccessToExports() SeExports = *(PSE_EXPORTS *)SeExports;
#if (VER_PRODUCTBUILD >= 2195)
_Must_inspect_result_
NTSYSAPI
NTSTATUS
NTAPI
ZwAdjustPrivilegesToken (
IN HANDLE TokenHandle,
IN BOOLEAN DisableAllPrivileges,
IN PTOKEN_PRIVILEGES NewState,
IN ULONG BufferLength,
OUT PTOKEN_PRIVILEGES PreviousState OPTIONAL,
OUT PULONG ReturnLength
ZwAdjustPrivilegesToken(
_In_ HANDLE TokenHandle,
_In_ BOOLEAN DisableAllPrivileges,
_In_opt_ PTOKEN_PRIVILEGES NewState,
_In_ ULONG BufferLength,
_Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_PRIVILEGES PreviousState,
_Out_ _When_(PreviousState == NULL, _Out_opt_) PULONG ReturnLength
);
#endif /* (VER_PRODUCTBUILD >= 2195) */
@ -11384,8 +11385,8 @@ ZwAdjustPrivilegesToken (
NTSYSAPI
NTSTATUS
NTAPI
ZwAlertThread (
IN HANDLE ThreadHandle
ZwAlertThread(
_In_ HANDLE ThreadHandle
);
NTSYSAPI
@ -11410,9 +11411,9 @@ ZwAccessCheckAndAuditAlarm (
NTSYSAPI
NTSTATUS
NTAPI
ZwCancelIoFile (
IN HANDLE FileHandle,
OUT PIO_STATUS_BLOCK IoStatusBlock
ZwCancelIoFile(
_In_ HANDLE FileHandle,
_Out_ PIO_STATUS_BLOCK IoStatusBlock
);
#endif /* (VER_PRODUCTBUILD >= 2195) */
@ -11420,44 +11421,45 @@ ZwCancelIoFile (
NTSYSAPI
NTSTATUS
NTAPI
ZwClearEvent (
IN HANDLE EventHandle
ZwClearEvent(
_In_ HANDLE EventHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwCloseObjectAuditAlarm (
IN PUNICODE_STRING SubsystemName,
IN PVOID HandleId,
IN BOOLEAN GenerateOnClose
ZwCloseObjectAuditAlarm(
_In_ PUNICODE_STRING SubsystemName,
_In_ PVOID HandleId,
_In_ BOOLEAN GenerateOnClose
);
NTSYSAPI
NTSTATUS
NTAPI
ZwCreateSymbolicLinkObject (
OUT PHANDLE SymbolicLinkHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PUNICODE_STRING TargetName
ZwCreateSymbolicLinkObject(
_Out_ PHANDLE SymbolicLinkHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PUNICODE_STRING Name
);
NTSYSAPI
NTSTATUS
NTAPI
ZwFlushInstructionCache (
IN HANDLE ProcessHandle,
IN PVOID BaseAddress OPTIONAL,
IN ULONG FlushSize
ZwFlushInstructionCache(
_In_ HANDLE ProcessHandle,
_In_ PVOID BaseAddress,
_In_ ULONG NumberOfBytesToFlush
);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwFlushBuffersFile(
IN HANDLE FileHandle,
OUT PIO_STATUS_BLOCK IoStatusBlock
_In_ HANDLE FileHandle,
_Out_ PIO_STATUS_BLOCK IoStatusBlock
);
#if (VER_PRODUCTBUILD >= 2195)
@ -11465,11 +11467,11 @@ ZwFlushBuffersFile(
NTSYSAPI
NTSTATUS
NTAPI
ZwInitiatePowerAction (
IN POWER_ACTION SystemAction,
IN SYSTEM_POWER_STATE MinSystemState,
IN ULONG Flags,
IN BOOLEAN Asynchronous
ZwInitiatePowerAction(
_In_ POWER_ACTION SystemAction,
_In_ SYSTEM_POWER_STATE MinSystemState,
_In_ ULONG Flags,
_In_ BOOLEAN Asynchronous
);
#endif /* (VER_PRODUCTBUILD >= 2195) */
@ -11482,64 +11484,66 @@ ZwLoadKey (
IN POBJECT_ATTRIBUTES FileObjectAttributes
);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenProcessToken (
IN HANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
OUT PHANDLE TokenHandle
ZwOpenProcessToken(
_In_ HANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_Out_ PHANDLE TokenHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenThread (
OUT PHANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId
ZwOpenThread(
_Out_ PHANDLE ThreadHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PCLIENT_ID ClientId
);
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenThreadToken (
IN HANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN BOOLEAN OpenAsSelf,
OUT PHANDLE TokenHandle
ZwOpenThreadToken(
_In_ HANDLE ThreadHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ BOOLEAN OpenAsSelf,
_Out_ PHANDLE TokenHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwPulseEvent (
IN HANDLE EventHandle,
OUT PLONG PreviousState OPTIONAL
ZwPulseEvent(
_In_ HANDLE EventHandle,
_In_opt_ PLONG PulseCount
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryDefaultLocale (
IN BOOLEAN ThreadOrSystem,
OUT PLCID Locale
ZwQueryDefaultLocale(
_In_ BOOLEAN UserProfile,
_Out_ PLCID DefaultLocaleId
);
#if (VER_PRODUCTBUILD >= 2195)
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryDirectoryObject (
IN HANDLE DirectoryHandle,
OUT PVOID Buffer,
IN ULONG Length,
IN BOOLEAN ReturnSingleEntry,
IN BOOLEAN RestartScan,
IN OUT PULONG Context,
OUT PULONG ReturnLength OPTIONAL
ZwQueryDirectoryObject(
_In_ HANDLE DirectoryHandle,
_Out_ PVOID Buffer,
_In_ ULONG BufferLength,
_In_ BOOLEAN ReturnSingleEntry,
_In_ BOOLEAN RestartScan,
_Inout_ PULONG Context,
_Out_opt_ PULONG ReturnLength
);
#endif /* (VER_PRODUCTBUILD >= 2195) */
@ -11567,9 +11571,9 @@ ZwReplaceKey (
NTSYSAPI
NTSTATUS
NTAPI
ZwResetEvent (
IN HANDLE EventHandle,
OUT PLONG PreviousState OPTIONAL
ZwResetEvent(
_In_ HANDLE EventHandle,
_Out_opt_ PLONG NumberOfWaitingThreads
);
#if (VER_PRODUCTBUILD >= 2195)
@ -11596,9 +11600,9 @@ ZwSaveKey (
NTSYSAPI
NTSTATUS
NTAPI
ZwSetDefaultLocale (
IN BOOLEAN ThreadOrSystem,
IN LCID Locale
ZwSetDefaultLocale(
_In_ BOOLEAN UserProfile,
_In_ LCID DefaultLocaleId
);
#if (VER_PRODUCTBUILD >= 2195)
@ -11615,37 +11619,37 @@ ZwSetDefaultUILanguage (
NTSYSAPI
NTSTATUS
NTAPI
ZwSetInformationProcess (
IN HANDLE ProcessHandle,
IN PROCESSINFOCLASS ProcessInformationClass,
IN PVOID ProcessInformation,
IN ULONG ProcessInformationLength
ZwSetInformationProcess(
_In_ HANDLE ProcessHandle,
_In_ PROCESSINFOCLASS ProcessInformationClass,
_In_ PVOID ProcessInformation,
_In_ ULONG ProcessInformationLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSetSystemTime (
IN PLARGE_INTEGER NewTime,
OUT PLARGE_INTEGER OldTime OPTIONAL
ZwSetSystemTime(
_In_ PLARGE_INTEGER SystemTime,
_In_opt_ PLARGE_INTEGER NewSystemTime
);
NTSYSAPI
NTSTATUS
NTAPI
ZwUnloadKey (
IN POBJECT_ATTRIBUTES KeyObjectAttributes
ZwUnloadKey(
_In_ POBJECT_ATTRIBUTES KeyObjectAttributes
);
NTSYSAPI
NTSTATUS
NTAPI
ZwWaitForMultipleObjects (
IN ULONG HandleCount,
IN PHANDLE Handles,
IN WAIT_TYPE WaitType,
IN BOOLEAN Alertable,
IN PLARGE_INTEGER Timeout OPTIONAL
ZwWaitForMultipleObjects(
_In_ ULONG Count,
_In_ HANDLE Object[],
_In_ WAIT_TYPE WaitType,
_In_ BOOLEAN Alertable,
_In_ PLARGE_INTEGER Time
);
NTSYSAPI

File diff suppressed because it is too large Load diff

View file

@ -31,326 +31,326 @@ Author:
NTSTATUS
NTAPI
NtCompactKeys(
IN ULONG Count,
IN PHANDLE KeyArray
_In_ ULONG Count,
_In_reads_(Count) PHANDLE KeyArray
);
NTSTATUS
NTAPI
NtCompressKey(
IN HANDLE Key
_In_ HANDLE Key
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateKey(
OUT PHANDLE KeyHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN ULONG TitleIndex,
IN PUNICODE_STRING Class OPTIONAL,
IN ULONG CreateOptions,
IN PULONG Disposition OPTIONAL
_Out_ PHANDLE KeyHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ ULONG TitleIndex,
_In_opt_ PUNICODE_STRING Class,
_In_ ULONG CreateOptions,
_In_opt_ PULONG Disposition
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteKey(
IN HANDLE KeyHandle
_In_ HANDLE KeyHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteValueKey(
IN HANDLE KeyHandle,
IN PUNICODE_STRING ValueName
_In_ HANDLE KeyHandle,
_In_ PUNICODE_STRING ValueName
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtEnumerateKey(
IN HANDLE KeyHandle,
IN ULONG Index,
IN KEY_INFORMATION_CLASS KeyInformationClass,
OUT PVOID KeyInformation,
IN ULONG Length,
OUT PULONG ResultLength
_In_ HANDLE KeyHandle,
_In_ ULONG Index,
_In_ KEY_INFORMATION_CLASS KeyInformationClass,
_Out_bytecap_(Length) PVOID KeyInformation,
_In_ ULONG Length,
_Out_ PULONG ResultLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtEnumerateValueKey(
IN HANDLE KeyHandle,
IN ULONG Index,
IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
OUT PVOID KeyValueInformation,
IN ULONG Length,
OUT PULONG ResultLength
_In_ HANDLE KeyHandle,
_In_ ULONG Index,
_In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
_Out_bytecap_(Length) PVOID KeyValueInformation,
_In_ ULONG Length,
_Out_ PULONG ResultLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtFlushKey(
IN HANDLE KeyHandle
_In_ HANDLE KeyHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtGetPlugPlayEvent(
IN ULONG Reserved1,
IN ULONG Reserved2,
OUT PPLUGPLAY_EVENT_BLOCK Buffer,
IN ULONG BufferSize
_In_ ULONG Reserved1,
_In_ ULONG Reserved2,
_Out_ PPLUGPLAY_EVENT_BLOCK Buffer,
_In_ ULONG BufferSize
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtInitializeRegistry(
USHORT Flag
_In_ USHORT Flag
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtLoadKey(
IN POBJECT_ATTRIBUTES KeyObjectAttributes,
IN POBJECT_ATTRIBUTES FileObjectAttributes
_In_ POBJECT_ATTRIBUTES KeyObjectAttributes,
_In_ POBJECT_ATTRIBUTES FileObjectAttributes
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtLoadKey2(
IN POBJECT_ATTRIBUTES KeyObjectAttributes,
IN POBJECT_ATTRIBUTES FileObjectAttributes,
IN ULONG Flags
_In_ POBJECT_ATTRIBUTES KeyObjectAttributes,
_In_ POBJECT_ATTRIBUTES FileObjectAttributes,
_In_ ULONG Flags
);
NTSTATUS
NTAPI
NtLoadKeyEx(
IN POBJECT_ATTRIBUTES TargetKey,
IN POBJECT_ATTRIBUTES SourceFile,
IN ULONG Flags,
IN HANDLE TrustClassKey
_In_ POBJECT_ATTRIBUTES TargetKey,
_In_ POBJECT_ATTRIBUTES SourceFile,
_In_ ULONG Flags,
_In_ HANDLE TrustClassKey
);
NTSTATUS
NTAPI
NtLockProductActivationKeys(
IN PULONG pPrivateVer,
IN PULONG pSafeMode
_In_ PULONG pPrivateVer,
_In_ PULONG pSafeMode
);
NTSTATUS
NTAPI
NtLockRegistryKey(
IN HANDLE KeyHandle
_In_ HANDLE KeyHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtNotifyChangeKey(
IN HANDLE KeyHandle,
IN HANDLE Event,
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
IN PVOID ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN ULONG CompletionFilter,
IN BOOLEAN Asynchroneous,
OUT PVOID ChangeBuffer,
IN ULONG Length,
IN BOOLEAN WatchSubtree
_In_ HANDLE KeyHandle,
_In_ HANDLE Event,
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcContext,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_ ULONG CompletionFilter,
_In_ BOOLEAN Asynchroneous,
_Out_bytecap_(Length) PVOID ChangeBuffer,
_In_ ULONG Length,
_In_ BOOLEAN WatchSubtree
);
NTSTATUS
NTAPI
NtNotifyChangeMultipleKeys(
IN HANDLE MasterKeyHandle,
IN ULONG Count,
IN POBJECT_ATTRIBUTES SlaveObjects,
IN HANDLE Event,
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
IN PVOID ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN ULONG CompletionFilter,
IN BOOLEAN WatchTree,
OUT PVOID Buffer,
IN ULONG Length,
IN BOOLEAN Asynchronous
_In_ HANDLE MasterKeyHandle,
_In_ ULONG Count,
_In_ POBJECT_ATTRIBUTES SlaveObjects,
_In_ HANDLE Event,
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcContext,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_ ULONG CompletionFilter,
_In_ BOOLEAN WatchTree,
_Out_bytecap_(Length) PVOID Buffer,
_In_ ULONG Length,
_In_ BOOLEAN Asynchronous
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenKey(
OUT PHANDLE KeyHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes
_Out_ PHANDLE KeyHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtPlugPlayControl(
IN PLUGPLAY_CONTROL_CLASS PlugPlayControlClass,
IN OUT PVOID Buffer,
IN ULONG BufferSize
_In_ PLUGPLAY_CONTROL_CLASS PlugPlayControlClass,
_Inout_ PVOID Buffer,
_In_ ULONG BufferSize
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryKey(
IN HANDLE KeyHandle,
IN KEY_INFORMATION_CLASS KeyInformationClass,
OUT PVOID KeyInformation,
IN ULONG Length,
OUT PULONG ResultLength
_In_ HANDLE KeyHandle,
_In_ KEY_INFORMATION_CLASS KeyInformationClass,
_Out_bytecap_(Length) PVOID KeyInformation,
_In_ ULONG Length,
_Out_ PULONG ResultLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryMultipleValueKey(
IN HANDLE KeyHandle,
IN OUT PKEY_VALUE_ENTRY ValueList,
IN ULONG NumberOfValues,
OUT PVOID Buffer,
IN OUT PULONG Length,
OUT PULONG ReturnLength
_In_ HANDLE KeyHandle,
_Inout_ PKEY_VALUE_ENTRY ValueList,
_In_ ULONG NumberOfValues,
_Out_bytecap_(*Length) PVOID Buffer,
_Inout_ PULONG Length,
_Out_ PULONG ReturnLength
);
NTSTATUS
NTAPI
NtQueryOpenSubKeys(
IN POBJECT_ATTRIBUTES TargetKey,
OUT PULONG HandleCount
_In_ POBJECT_ATTRIBUTES TargetKey,
_Out_ PULONG HandleCount
);
NTSTATUS
NTAPI
NtQueryOpenSubKeysEx(
IN POBJECT_ATTRIBUTES TargetKey,
IN ULONG BufferLength,
IN PVOID Buffer,
IN PULONG RequiredSize
_In_ POBJECT_ATTRIBUTES TargetKey,
_In_ ULONG BufferLength,
_In_ PVOID Buffer,
_In_ PULONG RequiredSize
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryValueKey(
IN HANDLE KeyHandle,
IN PUNICODE_STRING ValueName,
IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
OUT PVOID KeyValueInformation,
IN ULONG Length,
OUT PULONG ResultLength
_In_ HANDLE KeyHandle,
_In_ PUNICODE_STRING ValueName,
_In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
_Out_bytecap_(Length) PVOID KeyValueInformation,
_In_ ULONG Length,
_Out_ PULONG ResultLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtRenameKey(
IN HANDLE KeyHandle,
IN PUNICODE_STRING ReplacementName
_In_ HANDLE KeyHandle,
_In_ PUNICODE_STRING ReplacementName
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtReplaceKey(
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN HANDLE Key,
IN POBJECT_ATTRIBUTES ReplacedObjectAttributes
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ HANDLE Key,
_In_ POBJECT_ATTRIBUTES ReplacedObjectAttributes
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtRestoreKey(
IN HANDLE KeyHandle,
IN HANDLE FileHandle,
IN ULONG RestoreFlags
_In_ HANDLE KeyHandle,
_In_ HANDLE FileHandle,
_In_ ULONG RestoreFlags
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSaveKey(
IN HANDLE KeyHandle,
IN HANDLE FileHandle
_In_ HANDLE KeyHandle,
_In_ HANDLE FileHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSaveKeyEx(
IN HANDLE KeyHandle,
IN HANDLE FileHandle,
IN ULONG Flags
_In_ HANDLE KeyHandle,
_In_ HANDLE FileHandle,
_In_ ULONG Flags
);
NTSTATUS
NTAPI
NtSaveMergedKeys(
IN HANDLE HighPrecedenceKeyHandle,
IN HANDLE LowPrecedenceKeyHandle,
IN HANDLE FileHandle
_In_ HANDLE HighPrecedenceKeyHandle,
_In_ HANDLE LowPrecedenceKeyHandle,
_In_ HANDLE FileHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationKey(
IN HANDLE KeyHandle,
IN KEY_SET_INFORMATION_CLASS KeyInformationClass,
IN PVOID KeyInformation,
IN ULONG KeyInformationLength
_In_ HANDLE KeyHandle,
_In_ KEY_SET_INFORMATION_CLASS KeyInformationClass,
_In_ PVOID KeyInformation,
_In_ ULONG KeyInformationLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetValueKey(
IN HANDLE KeyHandle,
IN PUNICODE_STRING ValueName,
IN ULONG TitleIndex OPTIONAL,
IN ULONG Type,
IN PVOID Data,
IN ULONG DataSize
_In_ HANDLE KeyHandle,
_In_ PUNICODE_STRING ValueName,
_In_opt_ ULONG TitleIndex,
_In_ ULONG Type,
_In_ PVOID Data,
_In_ ULONG DataSize
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUnloadKey(
IN POBJECT_ATTRIBUTES KeyObjectAttributes
_In_ POBJECT_ATTRIBUTES KeyObjectAttributes
);
NTSTATUS
NTAPI
NtUnloadKey2(
IN POBJECT_ATTRIBUTES TargetKey,
IN ULONG Flags
_In_ POBJECT_ATTRIBUTES TargetKey,
_In_ ULONG Flags
);
NTSTATUS
NTAPI
NtUnloadKeyEx(
IN POBJECT_ATTRIBUTES TargetKey,
IN HANDLE Event
_In_ POBJECT_ATTRIBUTES TargetKey,
_In_ HANDLE Event
);
#ifdef NTOS_MODE_USER
@ -358,212 +358,212 @@ NTSYSAPI
NTSTATUS
NTAPI
ZwCreateKey(
OUT PHANDLE KeyHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN ULONG TitleIndex,
IN PUNICODE_STRING Class OPTIONAL,
IN ULONG CreateOptions,
IN PULONG Disposition OPTIONAL
_Out_ PHANDLE KeyHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ ULONG TitleIndex,
_In_opt_ PUNICODE_STRING Class,
_In_ ULONG CreateOptions,
_In_opt_ PULONG Disposition
);
NTSYSAPI
NTSTATUS
NTAPI
ZwDeleteKey(
IN HANDLE KeyHandle
_In_ HANDLE KeyHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwDeleteValueKey(
IN HANDLE KeyHandle,
IN PUNICODE_STRING ValueName
_In_ HANDLE KeyHandle,
_In_ PUNICODE_STRING ValueName
);
NTSYSAPI
NTSTATUS
NTAPI
ZwEnumerateKey(
IN HANDLE KeyHandle,
IN ULONG Index,
IN KEY_INFORMATION_CLASS KeyInformationClass,
OUT PVOID KeyInformation,
IN ULONG Length,
OUT PULONG ResultLength
_In_ HANDLE KeyHandle,
_In_ ULONG Index,
_In_ KEY_INFORMATION_CLASS KeyInformationClass,
_Out_bytecap_(Length) PVOID KeyInformation,
_In_ ULONG Length,
_Out_ PULONG ResultLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwEnumerateValueKey(
IN HANDLE KeyHandle,
IN ULONG Index,
IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
OUT PVOID KeyValueInformation,
IN ULONG Length,
OUT PULONG ResultLength
_In_ HANDLE KeyHandle,
_In_ ULONG Index,
_In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
_Out_bytecap_(Length) PVOID KeyValueInformation,
_In_ ULONG Length,
_Out_ PULONG ResultLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwFlushKey(
IN HANDLE KeyHandle
_In_ HANDLE KeyHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwGetPlugPlayEvent(
IN ULONG Reserved1,
IN ULONG Reserved2,
OUT PPLUGPLAY_EVENT_BLOCK Buffer,
IN ULONG BufferSize
_In_ ULONG Reserved1,
_In_ ULONG Reserved2,
_Out_bytecap_(BufferSize) PPLUGPLAY_EVENT_BLOCK Buffer,
_In_ ULONG BufferSize
);
NTSYSAPI
NTSTATUS
NTAPI
ZwLoadKey(
IN POBJECT_ATTRIBUTES KeyObjectAttributes,
IN POBJECT_ATTRIBUTES FileObjectAttributes
_In_ POBJECT_ATTRIBUTES KeyObjectAttributes,
_In_ POBJECT_ATTRIBUTES FileObjectAttributes
);
NTSYSAPI
NTSTATUS
NTAPI
ZwLoadKey2(
IN POBJECT_ATTRIBUTES KeyObjectAttributes,
IN POBJECT_ATTRIBUTES FileObjectAttributes,
IN ULONG Flags
_In_ POBJECT_ATTRIBUTES KeyObjectAttributes,
_In_ POBJECT_ATTRIBUTES FileObjectAttributes,
_In_ ULONG Flags
);
NTSYSAPI
NTSTATUS
NTAPI
ZwNotifyChangeKey(
IN HANDLE KeyHandle,
IN HANDLE Event,
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
IN PVOID ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN ULONG CompletionFilter,
IN BOOLEAN Asynchroneous,
OUT PVOID ChangeBuffer,
IN ULONG Length,
IN BOOLEAN WatchSubtree
_In_ HANDLE KeyHandle,
_In_ HANDLE Event,
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcContext,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_ ULONG CompletionFilter,
_In_ BOOLEAN Asynchroneous,
_Out_bytecap_(Length) PVOID ChangeBuffer,
_In_ ULONG Length,
_In_ BOOLEAN WatchSubtree
);
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenKey(
OUT PHANDLE KeyHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes
_Out_ PHANDLE KeyHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSAPI
NTSTATUS
NTAPI
ZwPlugPlayControl(
IN PLUGPLAY_CONTROL_CLASS PlugPlayControlClass,
IN OUT PVOID Buffer,
IN ULONG BufferSize
_In_ PLUGPLAY_CONTROL_CLASS PlugPlayControlClass,
_Inout_bytecap_(BufferSize) PVOID Buffer,
_In_ ULONG BufferSize
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryKey(
IN HANDLE KeyHandle,
IN KEY_INFORMATION_CLASS KeyInformationClass,
OUT PVOID KeyInformation,
IN ULONG Length,
OUT PULONG ResultLength
_In_ HANDLE KeyHandle,
_In_ KEY_INFORMATION_CLASS KeyInformationClass,
_Out_bytecap_(Length) PVOID KeyInformation,
_In_ ULONG Length,
_Out_ PULONG ResultLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryMultipleValueKey(
IN HANDLE KeyHandle,
IN OUT PKEY_VALUE_ENTRY ValueList,
IN ULONG NumberOfValues,
OUT PVOID Buffer,
IN OUT PULONG Length,
OUT PULONG ReturnLength
_In_ HANDLE KeyHandle,
_Inout_ PKEY_VALUE_ENTRY ValueList,
_In_ ULONG NumberOfValues,
_Out_bytecap_(*Length) PVOID Buffer,
_Inout_ PULONG Length,
_Out_ PULONG ReturnLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryValueKey(
IN HANDLE KeyHandle,
IN PUNICODE_STRING ValueName,
IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
OUT PVOID KeyValueInformation,
IN ULONG Length,
OUT PULONG ResultLength
_In_ HANDLE KeyHandle,
_In_ PUNICODE_STRING ValueName,
_In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
_Out_bytecap_(Length) PVOID KeyValueInformation,
_In_ ULONG Length,
_Out_ PULONG ResultLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwReplaceKey(
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN HANDLE Key,
IN POBJECT_ATTRIBUTES ReplacedObjectAttributes
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ HANDLE Key,
_In_ POBJECT_ATTRIBUTES ReplacedObjectAttributes
);
NTSYSAPI
NTSTATUS
NTAPI
ZwRestoreKey(
IN HANDLE KeyHandle,
IN HANDLE FileHandle,
IN ULONG RestoreFlags
_In_ HANDLE KeyHandle,
_In_ HANDLE FileHandle,
_In_ ULONG RestoreFlags
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSaveKey(
IN HANDLE KeyHandle,
IN HANDLE FileHandle
_In_ HANDLE KeyHandle,
_In_ HANDLE FileHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSaveKeyEx(
IN HANDLE KeyHandle,
IN HANDLE FileHandle,
IN ULONG Flags
_In_ HANDLE KeyHandle,
_In_ HANDLE FileHandle,
_In_ ULONG Flags
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSetInformationKey(
IN HANDLE KeyHandle,
IN KEY_SET_INFORMATION_CLASS KeyInformationClass,
IN PVOID KeyInformation,
IN ULONG KeyInformationLength
_In_ HANDLE KeyHandle,
_In_ KEY_SET_INFORMATION_CLASS KeyInformationClass,
_In_bytecount_(KeyInformationLength) PVOID KeyInformation,
_In_ ULONG KeyInformationLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSetValueKey(
IN HANDLE KeyHandle,
IN PUNICODE_STRING ValueName,
IN ULONG TitleIndex OPTIONAL,
IN ULONG Type,
IN PVOID Data,
IN ULONG DataSize
_In_ HANDLE KeyHandle,
_In_ PUNICODE_STRING ValueName,
_In_opt_ ULONG TitleIndex,
_In_ ULONG Type,
_In_bytecount_(DataSize) PVOID Data,
_In_ ULONG DataSize
);
#endif
@ -571,14 +571,14 @@ NTSYSAPI
NTSTATUS
NTAPI
ZwInitializeRegistry(
USHORT Flag
_In_ USHORT Flag
);
NTSYSAPI
NTSTATUS
NTAPI
ZwUnloadKey(
IN POBJECT_ATTRIBUTES KeyObjectAttributes
_In_ POBJECT_ATTRIBUTES KeyObjectAttributes
);
#endif

View file

@ -32,111 +32,111 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtDebugActiveProcess(
IN HANDLE Process,
IN HANDLE DebugObject
_In_ HANDLE Process,
_In_ HANDLE DebugObject
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateDebugObject(
OUT PHANDLE DebugHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN ULONG Flags
_Out_ PHANDLE DebugHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ ULONG Flags
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDebugContinue(
IN HANDLE DebugObject,
IN PCLIENT_ID AppClientId,
IN NTSTATUS ContinueStatus
_In_ HANDLE DebugObject,
_In_ PCLIENT_ID AppClientId,
_In_ NTSTATUS ContinueStatus
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitForDebugEvent(
IN HANDLE DebugObject,
IN BOOLEAN Alertable,
IN PLARGE_INTEGER Timeout OPTIONAL,
OUT PDBGUI_WAIT_STATE_CHANGE StateChange
_In_ HANDLE DebugObject,
_In_ BOOLEAN Alertable,
_In_opt_ PLARGE_INTEGER Timeout,
_Out_ PDBGUI_WAIT_STATE_CHANGE StateChange
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtRemoveProcessDebug(
IN HANDLE Process,
IN HANDLE DebugObject
_In_ HANDLE Process,
_In_ HANDLE DebugObject
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationDebugObject(
IN HANDLE DebugObject,
IN DEBUGOBJECTINFOCLASS InformationClass,
IN PVOID Information,
IN ULONG InformationLength,
OUT PULONG ReturnLength OPTIONAL
_In_ HANDLE DebugObject,
_In_ DEBUGOBJECTINFOCLASS InformationClass,
_In_ PVOID Information,
_In_ ULONG InformationLength,
_Out_opt_ PULONG ReturnLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwDebugActiveProcess(
IN HANDLE Process,
IN HANDLE DebugObject
_In_ HANDLE Process,
_In_ HANDLE DebugObject
);
NTSYSAPI
NTSTATUS
NTAPI
ZwCreateDebugObject(
OUT PHANDLE DebugHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN ULONG Flags
_Out_ PHANDLE DebugHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ ULONG Flags
);
NTSYSAPI
NTSTATUS
NTAPI
ZwDebugContinue(
IN HANDLE DebugObject,
IN PCLIENT_ID AppClientId,
IN NTSTATUS ContinueStatus
_In_ HANDLE DebugObject,
_In_ PCLIENT_ID AppClientId,
_In_ NTSTATUS ContinueStatus
);
NTSYSAPI
NTSTATUS
NTAPI
ZwRemoveProcessDebug(
IN HANDLE Process,
IN HANDLE DebugObject
_In_ HANDLE Process,
_In_ HANDLE DebugObject
);
NTSYSAPI
NTSTATUS
NTAPI
ZwWaitForDebugEvent(
IN HANDLE DebugObject,
IN BOOLEAN Alertable,
IN PLARGE_INTEGER Timeout OPTIONAL,
OUT PDBGUI_WAIT_STATE_CHANGE StateChange
_In_ HANDLE DebugObject,
_In_ BOOLEAN Alertable,
_In_opt_ PLARGE_INTEGER Timeout,
_Out_ PDBGUI_WAIT_STATE_CHANGE StateChange
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSetInformationDebugObject(
IN HANDLE DebugObject,
IN DEBUGOBJECTINFOCLASS InformationClass,
IN PVOID Information,
IN ULONG InformationLength,
OUT PULONG ReturnLength OPTIONAL
_In_ HANDLE DebugObject,
_In_ DEBUGOBJECTINFOCLASS InformationClass,
_In_ PVOID Information,
_In_ ULONG InformationLength,
_Out_opt_ PULONG ReturnLength
);
#endif

File diff suppressed because it is too large Load diff

View file

@ -362,7 +362,7 @@ struct _SYSTEM_FIRMWARE_TABLE_INFORMATION;
typedef
NTSTATUS
(__cdecl *PFNFTH)(
IN struct _SYSTEM_FIRMWARE_TABLE_INFORMATION *FirmwareTableInformation
_In_ struct _SYSTEM_FIRMWARE_TABLE_INFORMATION *FirmwareTableInformation
);
#else
@ -373,9 +373,9 @@ NTSTATUS
struct _HANDLE_TABLE_ENTRY;
typedef BOOLEAN
(NTAPI *PEX_ENUM_HANDLE_CALLBACK)(
IN struct _HANDLE_TABLE_ENTRY *HandleTableEntry,
IN HANDLE Handle,
IN PVOID Context
_In_ struct _HANDLE_TABLE_ENTRY *HandleTableEntry,
_In_ HANDLE Handle,
_In_ PVOID Context
);
//

View file

@ -68,7 +68,7 @@ NTHALAPI
VOID
NTAPI
HalDisplayString(
IN PCHAR String
_In_ PCHAR String
);
//
@ -86,24 +86,24 @@ NTHALAPI
VOID
NTAPI
HalInitializeProcessor(
ULONG ProcessorNumber,
struct _LOADER_PARAMETER_BLOCK *LoaderBlock
_In_ ULONG ProcessorNumber,
_In_ struct _LOADER_PARAMETER_BLOCK *LoaderBlock
);
NTHALAPI
BOOLEAN
NTAPI
HalInitSystem(
ULONG BootPhase,
struct _LOADER_PARAMETER_BLOCK *LoaderBlock
_In_ ULONG BootPhase,
_In_ struct _LOADER_PARAMETER_BLOCK *LoaderBlock
);
NTHALAPI
BOOLEAN
NTAPI
HalStartNextProcessor(
IN struct _LOADER_PARAMETER_BLOCK *LoaderBlock,
IN PKPROCESSOR_STATE ProcessorState
_In_ struct _LOADER_PARAMETER_BLOCK *LoaderBlock,
_In_ PKPROCESSOR_STATE ProcessorState
);
#endif
@ -112,7 +112,7 @@ NTHALAPI
VOID
NTAPI
HalReturnToFirmware(
FIRMWARE_REENTRY Action
_In_ FIRMWARE_REENTRY Action
);
//
@ -132,32 +132,32 @@ NTHALAPI
BOOLEAN
NTAPI
HalBeginSystemInterrupt(
KIRQL Irql,
ULONG Vector,
PKIRQL OldIrql
_In_ KIRQL Irql,
_In_ ULONG Vector,
_Out_ PKIRQL OldIrql
);
VOID
FASTCALL
HalClearSoftwareInterrupt(
IN KIRQL Request
_In_ KIRQL Request
);
NTHALAPI
VOID
NTAPI
HalDisableSystemInterrupt(
ULONG Vector,
KIRQL Irql
_In_ ULONG Vector,
_In_ KIRQL Irql
);
NTHALAPI
BOOLEAN
NTAPI
HalEnableSystemInterrupt(
ULONG Vector,
KIRQL Irql,
KINTERRUPT_MODE InterruptMode
_In_ ULONG Vector,
_In_ KIRQL Irql,
_In_ KINTERRUPT_MODE InterruptMode
);
NTHALAPI
@ -165,7 +165,7 @@ VOID
NTAPI
HalEndSystemInterrupt(
KIRQL Irql,
IN PKTRAP_FRAME TrapFrame
_In_ PKTRAP_FRAME TrapFrame
);
#ifdef _ARM_ // FIXME: ndk/arm? armddk.h?
@ -186,14 +186,14 @@ NTHALAPI
VOID
FASTCALL
HalRequestSoftwareInterrupt(
KIRQL SoftwareInterruptRequested
_In_ KIRQL SoftwareInterruptRequested
);
NTHALAPI
VOID
NTAPI
HalRequestIpi(
KAFFINITY TargetSet
_In_ KAFFINITY TargetSet
);
NTHALAPI
@ -207,9 +207,9 @@ NTHALAPI
UCHAR
FASTCALL
HalSystemVectorDispatchEntry(
IN ULONG Vector,
OUT PKINTERRUPT_ROUTINE **FlatDispatch,
OUT PKINTERRUPT_ROUTINE *NoConnection
_In_ ULONG Vector,
_Out_ PKINTERRUPT_ROUTINE **FlatDispatch,
_Out_ PKINTERRUPT_ROUTINE *NoConnection
);
//
@ -219,7 +219,7 @@ NTHALAPI
NTSTATUS
NTAPI
HalAdjustResourceList(
IN OUT PIO_RESOURCE_REQUIREMENTS_LIST *pResourceList
_Inout_ PIO_RESOURCE_REQUIREMENTS_LIST *pResourceList
);
//
@ -230,17 +230,17 @@ NTHALAPI
ARC_STATUS
NTAPI
HalSetEnvironmentVariable(
IN PCH Name,
IN PCH Value
_In_ PCH Name,
_In_ PCH Value
);
NTHALAPI
ARC_STATUS
NTAPI
HalGetEnvironmentVariable(
IN PCH Variable,
IN USHORT Length,
OUT PCH Buffer
_In_ PCH Variable,
_In_ USHORT Length,
_Out_ PCH Buffer
);
#endif
@ -250,21 +250,21 @@ HalGetEnvironmentVariable(
VOID
NTAPI
HalStartProfileInterrupt(
IN KPROFILE_SOURCE ProfileSource
_In_ KPROFILE_SOURCE ProfileSource
);
NTHALAPI
VOID
NTAPI
HalStopProfileInterrupt(
IN KPROFILE_SOURCE ProfileSource
_In_ KPROFILE_SOURCE ProfileSource
);
NTHALAPI
ULONG_PTR
NTAPI
HalSetProfileInterval(
IN ULONG_PTR Interval
_In_ ULONG_PTR Interval
);
//
@ -274,21 +274,21 @@ NTHALAPI
BOOLEAN
NTAPI
HalQueryRealTimeClock(
IN PTIME_FIELDS RtcTime
_In_ PTIME_FIELDS RtcTime
);
NTHALAPI
BOOLEAN
NTAPI
HalSetRealTimeClock(
IN PTIME_FIELDS RtcTime
_In_ PTIME_FIELDS RtcTime
);
NTHALAPI
ULONG
NTAPI
HalSetTimeIncrement(
IN ULONG Increment
_In_ ULONG Increment
);
#endif

View file

@ -45,54 +45,54 @@ typedef enum _FIRMWARE_REENTRY
typedef
PBUS_HANDLER
(FASTCALL *pHalHandlerForConfigSpace)(
IN BUS_DATA_TYPE ConfigSpace,
IN ULONG BusNumber
_In_ BUS_DATA_TYPE ConfigSpace,
_In_ ULONG BusNumber
);
typedef
NTSTATUS
(NTAPI *PINSTALL_BUS_HANDLER)(
IN PBUS_HANDLER Bus
_In_ PBUS_HANDLER Bus
);
typedef
NTSTATUS
(NTAPI *pHalRegisterBusHandler)(
IN INTERFACE_TYPE InterfaceType,
IN BUS_DATA_TYPE ConfigSpace,
IN ULONG BusNumber,
IN INTERFACE_TYPE ParentInterfaceType,
IN ULONG ParentBusNumber,
IN ULONG ContextSize,
IN PINSTALL_BUS_HANDLER InstallCallback,
OUT PBUS_HANDLER *BusHandler
_In_ INTERFACE_TYPE InterfaceType,
_In_ BUS_DATA_TYPE ConfigSpace,
_In_ ULONG BusNumber,
_In_ INTERFACE_TYPE ParentInterfaceType,
_In_ ULONG ParentBusNumber,
_In_ ULONG ContextSize,
_In_ PINSTALL_BUS_HANDLER InstallCallback,
_Out_ PBUS_HANDLER *BusHandler
);
typedef
VOID
(NTAPI *pHalSetWakeEnable)(
IN BOOLEAN Enable
_In_ BOOLEAN Enable
);
typedef
VOID
(NTAPI *pHalSetWakeAlarm)(
IN ULONGLONG AlartTime,
IN PTIME_FIELDS TimeFields
_In_ ULONGLONG AlartTime,
_In_ PTIME_FIELDS TimeFields
);
typedef
VOID
(NTAPI *pHalLocateHiberRanges)(
IN PVOID MemoryMap
_In_ PVOID MemoryMap
);
typedef
NTSTATUS
(NTAPI *pHalAllocateMapRegisters)(
IN PADAPTER_OBJECT AdapterObject,
IN ULONG Unknown,
IN ULONG Unknown2,
_In_ PADAPTER_OBJECT AdapterObject,
_In_ ULONG Unknown,
_In_ ULONG Unknown2,
PMAP_REGISTER_ENTRY Registers
);
@ -102,54 +102,54 @@ NTSTATUS
typedef
NTSTATUS
(NTAPI *PADJUSTRESOURCELIST)(
IN PBUS_HANDLER BusHandler,
IN PBUS_HANDLER RootHandler,
IN OUT PIO_RESOURCE_REQUIREMENTS_LIST *Resources
_In_ PBUS_HANDLER BusHandler,
_In_ PBUS_HANDLER RootHandler,
_Inout_ PIO_RESOURCE_REQUIREMENTS_LIST *Resources
);
typedef
NTSTATUS
(NTAPI *PASSIGNSLOTRESOURCES)(
IN PBUS_HANDLER BusHandler,
IN PBUS_HANDLER RootHandler,
IN PUNICODE_STRING RegistryPath,
IN PUNICODE_STRING DriverClassName,
IN PDRIVER_OBJECT DriverObject,
IN PDEVICE_OBJECT DeviceObject,
IN ULONG SlotNumber,
IN OUT PCM_RESOURCE_LIST *AllocatedResources
_In_ PBUS_HANDLER BusHandler,
_In_ PBUS_HANDLER RootHandler,
_In_ PUNICODE_STRING RegistryPath,
_In_ PUNICODE_STRING DriverClassName,
_In_ PDRIVER_OBJECT DriverObject,
_In_ PDEVICE_OBJECT DeviceObject,
_In_ ULONG SlotNumber,
_Inout_ PCM_RESOURCE_LIST *AllocatedResources
);
typedef
ULONG
(NTAPI *PGETSETBUSDATA)(
IN PBUS_HANDLER BusHandler,
IN PBUS_HANDLER RootHandler,
IN ULONG SlotNumber,
OUT PVOID Buffer,
IN ULONG Offset,
IN ULONG Length
_In_ PBUS_HANDLER BusHandler,
_In_ PBUS_HANDLER RootHandler,
_In_ ULONG SlotNumber,
_Out_ PVOID Buffer,
_In_ ULONG Offset,
_In_ ULONG Length
);
typedef
ULONG
(NTAPI *PGETINTERRUPTVECTOR)(
IN PBUS_HANDLER BusHandler,
IN PBUS_HANDLER RootHandler,
IN ULONG BusInterruptLevel,
IN ULONG BusInterruptVector,
OUT PKIRQL Irql,
OUT PKAFFINITY Affinity
_In_ PBUS_HANDLER BusHandler,
_In_ PBUS_HANDLER RootHandler,
_In_ ULONG BusInterruptLevel,
_In_ ULONG BusInterruptVector,
_Out_ PKIRQL Irql,
_Out_ PKAFFINITY Affinity
);
typedef
BOOLEAN
(NTAPI *PTRANSLATEBUSADDRESS)(
IN PBUS_HANDLER BusHandler,
IN PBUS_HANDLER RootHandler,
IN PHYSICAL_ADDRESS BusAddress,
IN OUT PULONG AddressSpace,
OUT PPHYSICAL_ADDRESS TranslatedAddress
_In_ PBUS_HANDLER BusHandler,
_In_ PBUS_HANDLER RootHandler,
_In_ PHYSICAL_ADDRESS BusAddress,
_Inout_ PULONG AddressSpace,
_Out_ PPHYSICAL_ADDRESS TranslatedAddress
);
//
@ -199,7 +199,7 @@ typedef struct _SUPPORTED_RANGE
LONGLONG Limit;
} SUPPORTED_RANGE, *PSUPPORTED_RANGE;
typedef struct _SUPPORTED_RANGES
typedef struct _SUPPORTED_RANGES
{
USHORT Version;
BOOLEAN Sorted;

View file

@ -30,9 +30,9 @@ typedef enum _TOKEN_TYPE
typedef NTSTATUS
(NTAPI * PRTL_HEAP_COMMIT_ROUTINE)(
IN PVOID Base,
IN OUT PVOID *CommitAddress,
IN OUT PSIZE_T CommitSize
_In_ PVOID Base,
_Inout_ PVOID *CommitAddress,
_Inout_ PSIZE_T CommitSize
);
typedef struct _RTL_HEAP_PARAMETERS

View file

@ -44,7 +44,7 @@ InbvCheckDisplayOwnership(
VOID
NTAPI
InbvNotifyDisplayOwnershipLost(
IN INBV_RESET_DISPLAY_PARAMETERS Callback
_In_ INBV_RESET_DISPLAY_PARAMETERS Callback
);
//
@ -53,13 +53,13 @@ InbvNotifyDisplayOwnershipLost(
VOID
NTAPI
InbvEnableBootDriver(
IN BOOLEAN Enable
_In_ BOOLEAN Enable
);
VOID
NTAPI
InbvInstallDisplayStringFilter(
IN INBV_DISPLAY_STRING_FILTER DisplayFilter
_In_ INBV_DISPLAY_STRING_FILTER DisplayFilter
);
BOOLEAN
@ -74,13 +74,13 @@ InbvIsBootDriverInstalled(
BOOLEAN
NTAPI
InbvDisplayString(
IN PCHAR String
_In_ PCHAR String
);
BOOLEAN
NTAPI
InbvEnableDisplayString(
IN BOOLEAN Enable
_In_ BOOLEAN Enable
);
BOOLEAN
@ -92,33 +92,33 @@ InbvResetDisplay(
VOID
NTAPI
InbvSetScrollRegion(
IN ULONG Left,
IN ULONG Top,
IN ULONG Width,
IN ULONG Height
_In_ ULONG Left,
_In_ ULONG Top,
_In_ ULONG Width,
_In_ ULONG Height
);
VOID
NTAPI
InbvSetTextColor(
IN ULONG Color
_In_ ULONG Color
);
VOID
NTAPI
InbvSolidColorFill(
IN ULONG Left,
IN ULONG Top,
IN ULONG Width,
IN ULONG Height,
IN ULONG Color
_In_ ULONG Left,
_In_ ULONG Top,
_In_ ULONG Width,
_In_ ULONG Height,
_In_ ULONG Color
);
VOID
NTAPI
InbvSetProgressBarSubset(
IN ULONG Floor,
IN ULONG Ceiling
_In_ ULONG Floor,
_In_ ULONG Ceiling
);
#endif

File diff suppressed because it is too large Load diff

View file

@ -1208,9 +1208,9 @@ typedef struct _EFI_DRIVER_ENTRY
//
typedef VOID
(NTAPI *PIO_APC_ROUTINE)(
IN PVOID ApcContext,
IN PIO_STATUS_BLOCK IoStatusBlock,
IN ULONG Reserved);
_In_ PVOID ApcContext,
_In_ PIO_STATUS_BLOCK IoStatusBlock,
_In_ ULONG Reserved);
//
// Mailslot IOCTL Codes

View file

@ -33,31 +33,31 @@ Author:
VOID
NTAPI
KeInitializeApc(
IN PKAPC Apc,
IN PKTHREAD Thread,
IN KAPC_ENVIRONMENT TargetEnvironment,
IN PKKERNEL_ROUTINE KernelRoutine,
IN PKRUNDOWN_ROUTINE RundownRoutine OPTIONAL,
IN PKNORMAL_ROUTINE NormalRoutine,
IN KPROCESSOR_MODE Mode,
IN PVOID Context
_In_ PKAPC Apc,
_In_ PKTHREAD Thread,
_In_ KAPC_ENVIRONMENT TargetEnvironment,
_In_ PKKERNEL_ROUTINE KernelRoutine,
_In_opt_ PKRUNDOWN_ROUTINE RundownRoutine,
_In_ PKNORMAL_ROUTINE NormalRoutine,
_In_ KPROCESSOR_MODE Mode,
_In_ PVOID Context
);
BOOLEAN
NTAPI
KeInsertQueueApc(
IN PKAPC Apc,
IN PVOID SystemArgument1,
IN PVOID SystemArgument2,
IN KPRIORITY PriorityBoost
_In_ PKAPC Apc,
_In_ PVOID SystemArgument1,
_In_ PVOID SystemArgument2,
_In_ KPRIORITY PriorityBoost
);
VOID
NTAPI
KiDeliverApc(
IN KPROCESSOR_MODE PreviousMode,
IN PKEXCEPTION_FRAME ExceptionFrame,
IN PKTRAP_FRAME TrapFrame
_In_ KPROCESSOR_MODE PreviousMode,
_In_ PKEXCEPTION_FRAME ExceptionFrame,
_In_ PKTRAP_FRAME TrapFrame
);
//
@ -66,7 +66,7 @@ KiDeliverApc(
VOID
NTAPI
KeTerminateThread(
IN KPRIORITY Increment
_In_ KPRIORITY Increment
);
BOOLEAN
@ -78,15 +78,15 @@ KeIsAttachedProcess(
VOID
NTAPI
KeSetEventBoostPriority(
IN PKEVENT Event,
IN PKTHREAD *Thread OPTIONAL
_In_ PKEVENT Event,
_In_opt_ PKTHREAD *Thread
);
KAFFINITY
NTAPI
KeSetAffinityThread(
PKTHREAD Thread,
KAFFINITY Affinity
_Inout_ PKTHREAD Thread,
_In_ KAFFINITY Affinity
);
PKPROCESS
@ -98,11 +98,11 @@ KeGetCurrentProcess(
BOOLEAN
NTAPI
KeAddSystemServiceTable(
PULONG_PTR Base,
PULONG Count OPTIONAL,
ULONG Limit,
PUCHAR Number,
ULONG Index
_In_ PULONG_PTR Base,
_In_opt_ PULONG Count,
_In_ ULONG Limit,
_In_ PUCHAR Number,
_In_ ULONG Index
);
//
@ -111,33 +111,33 @@ KeAddSystemServiceTable(
VOID
FASTCALL
KiAcquireSpinLock(
PKSPIN_LOCK SpinLock
_Inout_ PKSPIN_LOCK SpinLock
);
VOID
FASTCALL
KiReleaseSpinLock(
PKSPIN_LOCK SpinLock
_Inout_ PKSPIN_LOCK SpinLock
);
KIRQL
FASTCALL
KeAcquireQueuedSpinLockRaiseToSynch(
IN KSPIN_LOCK_QUEUE_NUMBER LockNumber
_In_ KSPIN_LOCK_QUEUE_NUMBER LockNumber
);
BOOLEAN
FASTCALL
KeTryToAcquireQueuedSpinLockRaiseToSynch(
IN KSPIN_LOCK_QUEUE_NUMBER LockNumber,
IN PKIRQL OldIrql
_In_ KSPIN_LOCK_QUEUE_NUMBER LockNumber,
_In_ PKIRQL OldIrql
);
VOID
FASTCALL
KeAcquireInStackQueuedSpinLockRaiseToSynch(
IN PKSPIN_LOCK SpinLock,
IN PKLOCK_QUEUE_HANDLE LockHandle
_In_ PKSPIN_LOCK SpinLock,
_In_ PKLOCK_QUEUE_HANDLE LockHandle
);
@ -147,29 +147,29 @@ KeAcquireInStackQueuedSpinLockRaiseToSynch(
VOID
NTAPI
KeInitializeInterrupt(
PKINTERRUPT InterruptObject,
PKSERVICE_ROUTINE ServiceRoutine,
PVOID ServiceContext,
PKSPIN_LOCK SpinLock,
ULONG Vector,
KIRQL Irql,
KIRQL SynchronizeIrql,
KINTERRUPT_MODE InterruptMode,
BOOLEAN ShareVector,
CHAR ProcessorNumber,
BOOLEAN FloatingSave
_Out_ PKINTERRUPT InterruptObject,
_In_ PKSERVICE_ROUTINE ServiceRoutine,
_In_ PVOID ServiceContext,
_In_ PKSPIN_LOCK SpinLock,
_In_ ULONG Vector,
_In_ KIRQL Irql,
_In_ KIRQL SynchronizeIrql,
_In_ KINTERRUPT_MODE InterruptMode,
_In_ BOOLEAN ShareVector,
_In_ CHAR ProcessorNumber,
_In_ BOOLEAN FloatingSave
);
BOOLEAN
NTAPI
KeConnectInterrupt(
PKINTERRUPT InterruptObject
_Inout_ PKINTERRUPT InterruptObject
);
BOOLEAN
NTAPI
KeDisconnectInterrupt(
PKINTERRUPT InterruptObject
_Inout_ PKINTERRUPT InterruptObject
);
VOID
@ -204,8 +204,8 @@ KeIsExecutingDpc(
BOOLEAN
NTAPI
KiIpiServiceRoutine(
IN PKTRAP_FRAME TrapFrame,
IN PKEXCEPTION_FRAME ExceptionFrame
_In_ PKTRAP_FRAME TrapFrame,
_In_ PKEXCEPTION_FRAME ExceptionFrame
);
//
@ -214,20 +214,20 @@ KiIpiServiceRoutine(
VOID
NTAPI
KeGenericCallDpc(
IN PKDEFERRED_ROUTINE Routine,
IN PVOID Context
_In_ PKDEFERRED_ROUTINE Routine,
_In_ PVOID Context
);
VOID
NTAPI
KeSignalCallDpcDone(
IN PVOID SystemArgument1
_In_ PVOID SystemArgument1
);
BOOLEAN
NTAPI
KeSignalCallDpcSynchronize(
IN PVOID SystemArgument2
_In_ PVOID SystemArgument2
);
//
@ -237,20 +237,20 @@ KeSignalCallDpcSynchronize(
PCONFIGURATION_COMPONENT_DATA
NTAPI
KeFindConfigurationNextEntry(
IN PCONFIGURATION_COMPONENT_DATA Child,
IN CONFIGURATION_CLASS Class,
IN CONFIGURATION_TYPE Type,
IN PULONG ComponentKey OPTIONAL,
IN PCONFIGURATION_COMPONENT_DATA *NextLink
_In_ PCONFIGURATION_COMPONENT_DATA Child,
_In_ CONFIGURATION_CLASS Class,
_In_ CONFIGURATION_TYPE Type,
_In_opt_ PULONG ComponentKey,
_In_ PCONFIGURATION_COMPONENT_DATA *NextLink
);
PCONFIGURATION_COMPONENT_DATA
NTAPI
KeFindConfigurationEntry(
IN PCONFIGURATION_COMPONENT_DATA Child,
IN CONFIGURATION_CLASS Class,
IN CONFIGURATION_TYPE Type,
IN PULONG ComponentKey OPTIONAL
_In_ PCONFIGURATION_COMPONENT_DATA Child,
_In_ CONFIGURATION_CLASS Class,
_In_ CONFIGURATION_TYPE Type,
_In_opt_ PULONG ComponentKey
);
#endif
@ -260,41 +260,41 @@ KeFindConfigurationEntry(
VOID
NTAPI
KeFlushEntireTb(
IN BOOLEAN Invalid,
IN BOOLEAN AllProcessors
_In_ BOOLEAN Invalid,
_In_ BOOLEAN AllProcessors
);
VOID
NTAPI
KeSetDmaIoCoherency(
IN ULONG Coherency
_In_ ULONG Coherency
);
VOID
KeSetGdtSelector(
ULONG Entry,
ULONG Value1,
ULONG Value2
_In_ ULONG Entry,
_In_ ULONG Value1,
_In_ ULONG Value2
);
VOID
NTAPI
KeSetProfileIrql(
IN KIRQL ProfileIrql
_In_ KIRQL ProfileIrql
);
VOID
NTAPI
KeSetTimeIncrement(
IN ULONG MaxIncrement,
IN ULONG MinIncrement
_In_ ULONG MaxIncrement,
_In_ ULONG MinIncrement
);
NTSTATUS
NTAPI
Ke386CallBios(
IN ULONG BiosCommand,
IN OUT PCONTEXT BiosArguments
_In_ ULONG BiosCommand,
_Inout_ PCONTEXT BiosArguments
);
//
@ -303,17 +303,17 @@ Ke386CallBios(
NTSTATUS
NTAPI
KeUserModeCallback(
IN ULONG FunctionID,
IN PVOID InputBuffer,
IN ULONG InputLength,
OUT PVOID *OutputBuffer,
OUT PULONG OutputLength
_In_ ULONG FunctionID,
_In_ PVOID InputBuffer,
_In_ ULONG InputLength,
_Out_ PVOID *OutputBuffer,
_Out_ PULONG OutputLength
);
NTSTATUS
NTAPI
KeRaiseUserException(
IN NTSTATUS ExceptionCode
_In_ NTSTATUS ExceptionCode
);
#endif
@ -325,49 +325,49 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtContinue(
IN PCONTEXT Context,
IN BOOLEAN TestAlert
_In_ PCONTEXT Context,
_In_ BOOLEAN TestAlert
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCallbackReturn(
PVOID Result,
ULONG ResultLength,
NTSTATUS Status
_In_ PVOID Result,
_In_ ULONG ResultLength,
_In_ NTSTATUS Status
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateProfile(
OUT PHANDLE ProfileHandle,
IN HANDLE ProcessHandle,
IN PVOID ImageBase,
IN ULONG ImageSize,
IN ULONG Granularity,
OUT PVOID Buffer,
IN ULONG ProfilingSize,
IN KPROFILE_SOURCE Source,
IN KAFFINITY ProcessorMask
_Out_ PHANDLE ProfileHandle,
_In_ HANDLE ProcessHandle,
_In_ PVOID ImageBase,
_In_ ULONG ImageSize,
_In_ ULONG Granularity,
_Out_ PVOID Buffer,
_In_ ULONG ProfilingSize,
_In_ KPROFILE_SOURCE Source,
_In_ KAFFINITY ProcessorMask
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDelayExecution(
IN BOOLEAN Alertable,
IN LARGE_INTEGER *Interval
_In_ BOOLEAN Alertable,
_In_ LARGE_INTEGER *Interval
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtFlushInstructionCache(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
IN ULONG NumberOfBytesToFlush
_In_ HANDLE ProcessHandle,
_In_ PVOID BaseAddress,
_In_ ULONG NumberOfBytesToFlush
);
ULONG
@ -380,8 +380,8 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtGetContextThread(
IN HANDLE ThreadHandle,
OUT PCONTEXT Context
_In_ HANDLE ThreadHandle,
_Out_ PCONTEXT Context
);
NTSYSCALLAPI
@ -395,109 +395,109 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryIntervalProfile(
IN KPROFILE_SOURCE ProfileSource,
OUT PULONG Interval
_In_ KPROFILE_SOURCE ProfileSource,
_Out_ PULONG Interval
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryPerformanceCounter(
IN PLARGE_INTEGER Counter,
IN PLARGE_INTEGER Frequency
_In_ PLARGE_INTEGER Counter,
_In_ PLARGE_INTEGER Frequency
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySystemTime(
OUT PLARGE_INTEGER CurrentTime
_Out_ PLARGE_INTEGER CurrentTime
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryTimerResolution(
OUT PULONG MinimumResolution,
OUT PULONG MaximumResolution,
OUT PULONG ActualResolution
_Out_ PULONG MinimumResolution,
_Out_ PULONG MaximumResolution,
_Out_ PULONG ActualResolution
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueueApcThread(
HANDLE ThreadHandle,
PKNORMAL_ROUTINE ApcRoutine,
PVOID NormalContext,
PVOID SystemArgument1,
PVOID SystemArgument2
_In_ HANDLE ThreadHandle,
_In_ PKNORMAL_ROUTINE ApcRoutine,
_In_ PVOID NormalContext,
_In_ PVOID SystemArgument1,
_In_ PVOID SystemArgument2
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtRaiseException(
IN PEXCEPTION_RECORD ExceptionRecord,
IN PCONTEXT Context,
IN BOOLEAN SearchFrames
_In_ PEXCEPTION_RECORD ExceptionRecord,
_In_ PCONTEXT Context,
_In_ BOOLEAN SearchFrames
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetContextThread(
IN HANDLE ThreadHandle,
IN PCONTEXT Context
_In_ HANDLE ThreadHandle,
_In_ PCONTEXT Context
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetIntervalProfile(
IN ULONG Interval,
IN KPROFILE_SOURCE ClockSource
_In_ ULONG Interval,
_In_ KPROFILE_SOURCE ClockSource
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetLdtEntries(
IN ULONG Selector1,
IN LDT_ENTRY LdtEntry1,
IN ULONG Selector2,
IN LDT_ENTRY LdtEntry2
_In_ ULONG Selector1,
_In_ LDT_ENTRY LdtEntry1,
_In_ ULONG Selector2,
_In_ LDT_ENTRY LdtEntry2
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetSystemTime(
IN PLARGE_INTEGER SystemTime,
IN PLARGE_INTEGER NewSystemTime OPTIONAL
_In_ PLARGE_INTEGER SystemTime,
_In_opt_ PLARGE_INTEGER NewSystemTime
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetTimerResolution(
IN ULONG RequestedResolution,
IN BOOLEAN SetOrUnset,
OUT PULONG ActualResolution
_In_ ULONG RequestedResolution,
_In_ BOOLEAN SetOrUnset,
_Out_ PULONG ActualResolution
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtStartProfile(
IN HANDLE ProfileHandle
_In_ HANDLE ProfileHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtStopProfile(
IN HANDLE ProfileHandle
_In_ HANDLE ProfileHandle
);
NTSYSCALLAPI
@ -511,19 +511,19 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtVdmControl(
ULONG ControlCode,
PVOID ControlData
_In_ ULONG ControlCode,
_In_ PVOID ControlData
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtW32Call(
IN ULONG RoutineIndex,
IN PVOID Argument,
IN ULONG ArgumentLength,
OUT PVOID* Result OPTIONAL,
OUT PULONG ResultLength OPTIONAL
_In_ ULONG RoutineIndex,
_In_ PVOID Argument,
_In_ ULONG ArgumentLength,
_Out_opt_ PVOID* Result,
_Out_opt_ PULONG ResultLength
);
NTSYSCALLAPI
@ -537,57 +537,57 @@ NTSYSAPI
NTSTATUS
NTAPI
ZwContinue(
IN PCONTEXT Context,
IN BOOLEAN TestAlert
_In_ PCONTEXT Context,
_In_ BOOLEAN TestAlert
);
NTSYSAPI
NTSTATUS
NTAPI
ZwCallbackReturn(
PVOID Result,
ULONG ResultLength,
NTSTATUS Status
_In_ PVOID Result,
_In_ ULONG ResultLength,
_In_ NTSTATUS Status
);
NTSYSAPI
NTSTATUS
NTAPI
ZwCreateProfile(
OUT PHANDLE ProfileHandle,
IN HANDLE ProcessHandle,
IN PVOID ImageBase,
IN ULONG ImageSize,
IN ULONG Granularity,
OUT PVOID Buffer,
IN ULONG ProfilingSize,
IN KPROFILE_SOURCE Source,
IN KAFFINITY ProcessorMask
_Out_ PHANDLE ProfileHandle,
_In_ HANDLE ProcessHandle,
_In_ PVOID ImageBase,
_In_ ULONG ImageSize,
_In_ ULONG Granularity,
_Out_ PVOID Buffer,
_In_ ULONG ProfilingSize,
_In_ KPROFILE_SOURCE Source,
_In_ KAFFINITY ProcessorMask
);
NTSYSAPI
NTSTATUS
NTAPI
ZwDelayExecution(
IN BOOLEAN Alertable,
IN LARGE_INTEGER *Interval
_In_ BOOLEAN Alertable,
_In_ LARGE_INTEGER *Interval
);
NTSYSAPI
NTSTATUS
NTAPI
ZwFlushInstructionCache(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
IN ULONG NumberOfBytesToFlush
_In_ HANDLE ProcessHandle,
_In_ PVOID BaseAddress,
_In_ ULONG NumberOfBytesToFlush
);
NTSYSAPI
NTSTATUS
NTAPI
ZwGetContextThread(
IN HANDLE ThreadHandle,
OUT PCONTEXT Context
_In_ HANDLE ThreadHandle,
_Out_ PCONTEXT Context
);
NTSYSAPI
@ -601,109 +601,109 @@ NTSYSAPI
NTSTATUS
NTAPI
ZwQueryIntervalProfile(
IN KPROFILE_SOURCE ProfileSource,
OUT PULONG Interval
_In_ KPROFILE_SOURCE ProfileSource,
_Out_ PULONG Interval
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryPerformanceCounter(
IN PLARGE_INTEGER Counter,
IN PLARGE_INTEGER Frequency
_In_ PLARGE_INTEGER Counter,
_In_ PLARGE_INTEGER Frequency
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySystemTime(
OUT PLARGE_INTEGER CurrentTime
_Out_ PLARGE_INTEGER CurrentTime
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryTimerResolution(
OUT PULONG MinimumResolution,
OUT PULONG MaximumResolution,
OUT PULONG ActualResolution
_Out_ PULONG MinimumResolution,
_Out_ PULONG MaximumResolution,
_Out_ PULONG ActualResolution
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQueueApcThread(
HANDLE ThreadHandle,
PKNORMAL_ROUTINE ApcRoutine,
PVOID NormalContext,
PVOID SystemArgument1,
PVOID SystemArgument2
_In_ HANDLE ThreadHandle,
_In_ PKNORMAL_ROUTINE ApcRoutine,
_In_ PVOID NormalContext,
_In_ PVOID SystemArgument1,
_In_ PVOID SystemArgument2
);
NTSYSAPI
NTSTATUS
NTAPI
ZwRaiseException(
IN PEXCEPTION_RECORD ExceptionRecord,
IN PCONTEXT Context,
IN BOOLEAN SearchFrames
_In_ PEXCEPTION_RECORD ExceptionRecord,
_In_ PCONTEXT Context,
_In_ BOOLEAN SearchFrames
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSetContextThread(
IN HANDLE ThreadHandle,
IN PCONTEXT Context
_In_ HANDLE ThreadHandle,
_In_ PCONTEXT Context
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSetIntervalProfile(
IN ULONG Interval,
IN KPROFILE_SOURCE ClockSource
_In_ ULONG Interval,
_In_ KPROFILE_SOURCE ClockSource
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSetLdtEntries(
IN ULONG Selector1,
IN LDT_ENTRY LdtEntry1,
IN ULONG Selector2,
IN LDT_ENTRY LdtEntry2
_In_ ULONG Selector1,
_In_ LDT_ENTRY LdtEntry1,
_In_ ULONG Selector2,
_In_ LDT_ENTRY LdtEntry2
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSetSystemTime(
IN PLARGE_INTEGER SystemTime,
IN PLARGE_INTEGER NewSystemTime OPTIONAL
_In_ PLARGE_INTEGER SystemTime,
_In_opt_ PLARGE_INTEGER NewSystemTime
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSetTimerResolution(
IN ULONG RequestedResolution,
IN BOOLEAN SetOrUnset,
OUT PULONG ActualResolution
_In_ ULONG RequestedResolution,
_In_ BOOLEAN SetOrUnset,
_Out_ PULONG ActualResolution
);
NTSYSAPI
NTSTATUS
NTAPI
ZwStartProfile(
IN HANDLE ProfileHandle
_In_ HANDLE ProfileHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwStopProfile(
IN HANDLE ProfileHandle
_In_ HANDLE ProfileHandle
);
NTSYSAPI
@ -717,19 +717,19 @@ NTSYSAPI
NTSTATUS
NTAPI
ZwVdmControl(
ULONG ControlCode,
PVOID ControlData
_In_ ULONG ControlCode,
_In_ PVOID ControlData
);
NTSYSAPI
NTSTATUS
NTAPI
ZwW32Call(
IN ULONG RoutineIndex,
IN PVOID Argument,
IN ULONG ArgumentLength,
OUT PVOID* Result OPTIONAL,
OUT PULONG ResultLength OPTIONAL
_In_ ULONG RoutineIndex,
_In_ PVOID Argument,
_In_ ULONG ArgumentLength,
_Out_opt_ PVOID* Result,
_Out_opt_ PULONG ResultLength
);
NTSYSAPI

View file

@ -385,9 +385,9 @@ typedef enum _VDMSERVICECLASS
//
typedef VOID
(NTAPI *PKNORMAL_ROUTINE)(
IN PVOID NormalContext,
IN PVOID SystemArgument1,
IN PVOID SystemArgument2
_In_ PVOID NormalContext,
_In_ PVOID SystemArgument1,
_In_ PVOID SystemArgument2
);
//
@ -395,9 +395,9 @@ typedef VOID
//
typedef VOID
(NTAPI *PTIMER_APC_ROUTINE)(
IN PVOID TimerContext,
IN ULONG TimerLowValue,
IN LONG TimerHighValue
_In_ PVOID TimerContext,
_In_ ULONG TimerLowValue,
_In_ LONG TimerHighValue
);
//

View file

@ -34,52 +34,52 @@ Author:
NTSTATUS
NTAPI
LdrAccessResource(
IN PVOID BaseAddress,
IN PIMAGE_RESOURCE_DATA_ENTRY ResourceDataEntry,
OUT PVOID *Resource OPTIONAL,
OUT PULONG Size OPTIONAL
_In_ PVOID BaseAddress,
_In_ PIMAGE_RESOURCE_DATA_ENTRY ResourceDataEntry,
_Out_opt_ PVOID *Resource,
_Out_opt_ PULONG Size
);
NTSTATUS
NTAPI
LdrFindResource_U(
IN PVOID BaseAddress,
IN PLDR_RESOURCE_INFO ResourceInfo,
IN ULONG Level,
OUT PIMAGE_RESOURCE_DATA_ENTRY *ResourceDataEntry
_In_ PVOID BaseAddress,
_In_ PLDR_RESOURCE_INFO ResourceInfo,
_In_ ULONG Level,
_Out_ PIMAGE_RESOURCE_DATA_ENTRY *ResourceDataEntry
);
NTSTATUS
NTAPI
LdrEnumResources(
IN PVOID BaseAddress,
IN PLDR_RESOURCE_INFO ResourceInfo,
IN ULONG Level,
IN OUT ULONG *ResourceCount,
OUT PLDR_ENUM_RESOURCE_INFO Resources OPTIONAL
_In_ PVOID BaseAddress,
_In_ PLDR_RESOURCE_INFO ResourceInfo,
_In_ ULONG Level,
_Inout_ ULONG *ResourceCount,
_Out_opt_ PLDR_ENUM_RESOURCE_INFO Resources
);
NTSTATUS
NTAPI
LdrFindResourceDirectory_U(
IN PVOID BaseAddress,
IN PLDR_RESOURCE_INFO ResourceInfo,
IN ULONG Level,
OUT PIMAGE_RESOURCE_DIRECTORY *ResourceDirectory
_In_ PVOID BaseAddress,
_In_ PLDR_RESOURCE_INFO ResourceInfo,
_In_ ULONG Level,
_Out_ PIMAGE_RESOURCE_DIRECTORY *ResourceDirectory
);
NTSTATUS
NTAPI
LdrLoadAlternateResourceModule(
IN PVOID Module,
IN PWSTR Buffer
_In_ PVOID Module,
_In_ PWSTR Buffer
);
BOOLEAN
NTAPI
LdrUnloadAlternateResourceModule(
IN PVOID BaseAddress
_In_ PVOID BaseAddress
);
//
@ -88,60 +88,60 @@ LdrUnloadAlternateResourceModule(
NTSTATUS
NTAPI
LdrGetProcedureAddress(
IN PVOID BaseAddress,
IN PANSI_STRING Name,
IN ULONG Ordinal,
OUT PVOID *ProcedureAddress
_In_ PVOID BaseAddress,
_In_ PANSI_STRING Name,
_In_ ULONG Ordinal,
_Out_ PVOID *ProcedureAddress
);
ULONG
NTAPI
LdrRelocateImage(
IN PVOID NewBase,
IN PUCHAR LoaderName,
IN ULONG Success,
IN ULONG Conflict,
IN ULONG Invalid
_In_ PVOID NewBase,
_In_ PUCHAR LoaderName,
_In_ ULONG Success,
_In_ ULONG Conflict,
_In_ ULONG Invalid
);
NTSTATUS
NTAPI
LdrLockLoaderLock(
IN ULONG Flags,
OUT PULONG Disposition OPTIONAL,
OUT PULONG Cookie OPTIONAL
_In_ ULONG Flags,
_Out_opt_ PULONG Disposition,
_Out_opt_ PULONG Cookie
);
NTSTATUS
NTAPI
LdrUnlockLoaderLock(
IN ULONG Flags,
IN ULONG Cookie OPTIONAL
_In_ ULONG Flags,
_In_opt_ ULONG Cookie
);
BOOLEAN
NTAPI
LdrVerifyMappedImageMatchesChecksum(
IN PVOID BaseAddress,
IN SIZE_T NumberOfBytes,
IN ULONG FileLength
_In_ PVOID BaseAddress,
_In_ SIZE_T NumberOfBytes,
_In_ ULONG FileLength
);
PIMAGE_BASE_RELOCATION
NTAPI
LdrProcessRelocationBlockLongLong(
IN ULONG_PTR Address,
IN ULONG Count,
IN PUSHORT TypeOffset,
IN LONGLONG Delta
_In_ ULONG_PTR Address,
_In_ ULONG Count,
_In_ PUSHORT TypeOffset,
_In_ LONGLONG Delta
);
NTSTATUS
NTAPI
LdrEnumerateLoadedModules(
IN BOOLEAN ReservedFlag,
IN PLDR_ENUM_CALLBACK EnumProc,
IN PVOID Context
_In_ BOOLEAN ReservedFlag,
_In_ PLDR_ENUM_CALLBACK EnumProc,
_In_ PVOID Context
);
#endif

View file

@ -197,8 +197,8 @@ typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA
typedef VOID
(NTAPI *PLDR_DLL_LOADED_NOTIFICATION_CALLBACK)(
IN BOOLEAN Type,
IN struct _LDR_DLL_LOADED_NOTIFICATION_DATA *Data
_In_ BOOLEAN Type,
_In_ struct _LDR_DLL_LOADED_NOTIFICATION_DATA *Data
);
typedef struct _LDR_DLL_LOADED_NOTIFICATION_ENTRY
@ -228,7 +228,7 @@ typedef struct _ALT_RESOURCE_MODULE
//
// Callback function for LdrEnumerateLoadedModules
//
typedef VOID (NTAPI LDR_ENUM_CALLBACK)(IN PLDR_DATA_TABLE_ENTRY ModuleInformation, IN PVOID Parameter, OUT BOOLEAN *Stop);
typedef VOID (NTAPI LDR_ENUM_CALLBACK)(IN PLDR_DATA_TABLE_ENTRY ModuleInformation, _In_ PVOID Parameter, _Out_ BOOLEAN *Stop);
typedef LDR_ENUM_CALLBACK *PLDR_ENUM_CALLBACK;
//
@ -236,9 +236,9 @@ typedef LDR_ENUM_CALLBACK *PLDR_ENUM_CALLBACK;
//
typedef BOOLEAN
(NTAPI *PDLL_INIT_ROUTINE)(
IN PVOID DllHandle,
IN ULONG Reason,
IN PCONTEXT Context OPTIONAL
_In_ PVOID DllHandle,
_In_ ULONG Reason,
_In_opt_ PCONTEXT Context
);
#endif

View file

@ -436,7 +436,7 @@ and reuse of software generally.
15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
EXCEPT WHEN OTHERWISE STATED _In_ WRITING THE COPYRIGHT HOLDERS AND/OR
OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
@ -444,11 +444,11 @@ PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
16. _In_ NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
CONSEQUENTIAL DAMAGES ARISING _Out_ OF THE USE OR INABILITY TO USE THE
LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
@ -499,4 +499,4 @@ necessary. Here is a sample; alter the names:
<signature of Ty Coon>, 1 April 1990
Ty Coon, President of Vice
That's all there is to it!
That's all there is to it!

View file

@ -32,16 +32,16 @@ NTKERNELAPI
NTSTATUS
NTAPI
LpcRequestWaitReplyPort(
IN PVOID Port,
IN PPORT_MESSAGE LpcMessageRequest,
OUT PPORT_MESSAGE LpcMessageReply
_In_ PVOID Port,
_In_ PPORT_MESSAGE LpcMessageRequest,
_Out_ PPORT_MESSAGE LpcMessageReply
);
NTSTATUS
NTAPI
LpcRequestPort(
IN PVOID Port,
IN PPORT_MESSAGE LpcMessage
_In_ PVOID Port,
_In_ PPORT_MESSAGE LpcMessage
);
#endif
@ -52,82 +52,82 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtAcceptConnectPort(
PHANDLE PortHandle,
PVOID PortContext OPTIONAL,
PPORT_MESSAGE ConnectionRequest,
BOOLEAN AcceptConnection,
PPORT_VIEW ServerView OPTIONAL,
PREMOTE_PORT_VIEW ClientView OPTIONAL
_In_ PHANDLE PortHandle,
_In_opt_ PVOID PortContext,
_In_ PPORT_MESSAGE ConnectionRequest,
_In_ BOOLEAN AcceptConnection,
_In_opt_ PPORT_VIEW ServerView,
_In_opt_ PREMOTE_PORT_VIEW ClientView
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCompleteConnectPort(
HANDLE PortHandle
_In_ HANDLE PortHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtConnectPort(
PHANDLE PortHandle,
PUNICODE_STRING PortName,
PSECURITY_QUALITY_OF_SERVICE SecurityQos,
PPORT_VIEW ClientView OPTIONAL,
PREMOTE_PORT_VIEW ServerView OPTIONAL,
PULONG MaxMessageLength OPTIONAL,
PVOID ConnectionInformation OPTIONAL,
PULONG ConnectionInformationLength OPTIONAL
_In_ PHANDLE PortHandle,
_In_ PUNICODE_STRING PortName,
_In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,
_In_opt_ PPORT_VIEW ClientView,
_In_opt_ PREMOTE_PORT_VIEW ServerViewONAL,
_In_opt_ PULONG MaxMessageLength,
_In_opt_ PVOID ConnectionInformation,
_In_opt_ PULONG ConnectionInformationLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreatePort(
PHANDLE PortHandle,
POBJECT_ATTRIBUTES ObjectAttributes,
ULONG MaxConnectionInfoLength,
ULONG MaxMessageLength,
ULONG MaxPoolUsage
_In_ PHANDLE PortHandle,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ ULONG MaxConnectionInfoLength,
_In_ ULONG MaxMessageLength,
_In_ ULONG MaxPoolUsage
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateWaitablePort(
PHANDLE PortHandle,
POBJECT_ATTRIBUTES ObjectAttributes,
ULONG MaxConnectInfoLength,
ULONG MaxDataLength,
ULONG NPMessageQueueSize OPTIONAL
_In_ PHANDLE PortHandle,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ ULONG MaxConnectInfoLength,
_In_ ULONG MaxDataLength,
_In_opt_ ULONG NPMessageQueueSize
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtImpersonateClientOfPort(
HANDLE PortHandle,
PPORT_MESSAGE ClientMessage
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE ClientMessage
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtListenPort(
HANDLE PortHandle,
PPORT_MESSAGE ConnectionRequest
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE ConnectionRequest
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationPort(
HANDLE PortHandle,
PORT_INFORMATION_CLASS PortInformationClass,
PVOID PortInformation,
ULONG PortInformationLength,
PULONG ReturnLength
_In_ HANDLE PortHandle,
_In_ PORT_INFORMATION_CLASS PortInformationClass,
_Out_bytecap_(PortInformationLength) PVOID PortInformation,
_In_ ULONG PortInformationLength,
_Out_ PULONG ReturnLength
);
NTSTATUS
@ -140,66 +140,66 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtReadRequestData(
HANDLE PortHandle,
PPORT_MESSAGE Message,
ULONG Index,
PVOID Buffer,
ULONG BufferLength,
PULONG ReturnLength
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE Message,
_In_ ULONG Index,
_Out_bytecap_(BufferLength) PVOID Buffer,
_In_ ULONG BufferLength,
_Out_ PULONG ReturnLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtReplyPort(
IN HANDLE PortHandle,
IN PPORT_MESSAGE LpcReply
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE LpcReply
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtReplyWaitReceivePort(
IN HANDLE PortHandle,
OUT PVOID *PortContext OPTIONAL,
IN PPORT_MESSAGE ReplyMessage OPTIONAL,
OUT PPORT_MESSAGE ReceiveMessage
_In_ HANDLE PortHandle,
_Out_opt_ PVOID *PortContext,
_In_opt_ PPORT_MESSAGE ReplyMessage,
_Out_ PPORT_MESSAGE ReceiveMessage
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtReplyWaitReceivePortEx(
IN HANDLE PortHandle,
OUT PVOID *PortContext OPTIONAL,
IN PPORT_MESSAGE ReplyMessage OPTIONAL,
OUT PPORT_MESSAGE ReceiveMessage,
IN PLARGE_INTEGER Timeout OPTIONAL
_In_ HANDLE PortHandle,
_Out_opt_ PVOID *PortContext,
_In_opt_ PPORT_MESSAGE ReplyMessage,
_Out_ PPORT_MESSAGE ReceiveMessage,
_In_opt_ PLARGE_INTEGER Timeout
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtReplyWaitReplyPort(
IN HANDLE PortHandle,
OUT PPORT_MESSAGE ReplyMessage
_In_ HANDLE PortHandle,
_Out_ PPORT_MESSAGE ReplyMessage
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtRequestPort(
IN HANDLE PortHandle,
IN PPORT_MESSAGE LpcMessage
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE LpcMessage
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtRequestWaitReplyPort(
IN HANDLE PortHandle,
OUT PPORT_MESSAGE LpcReply,
IN PPORT_MESSAGE LpcRequest
_In_ HANDLE PortHandle,
_Out_ PPORT_MESSAGE LpcReply,
_In_ PPORT_MESSAGE LpcRequest
);
NTSYSCALLAPI
@ -209,199 +209,199 @@ NtSecureConnectPort(
PHANDLE PortHandle,
PUNICODE_STRING PortName,
PSECURITY_QUALITY_OF_SERVICE SecurityQos,
PPORT_VIEW ClientView OPTIONAL,
PSID Sid OPTIONAL,
PREMOTE_PORT_VIEW ServerView OPTIONAL,
PULONG MaxMessageLength OPTIONAL,
PVOID ConnectionInformation OPTIONAL,
PULONG ConnectionInformationLength OPTIONAL
_In_opt_ PPORT_VIEW ClientView,
_In_opt_ PSID Sid,
_In_opt_ PREMOTE_PORT_VIEW ServerView,
_In_opt_ PULONG MaxMessageLength,
_In_opt_ PVOID ConnectionInformation,
_Out_opt_ PULONG ConnectionInformationLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtWriteRequestData(
HANDLE PortHandle,
PPORT_MESSAGE Message,
ULONG Index,
PVOID Buffer,
ULONG BufferLength,
PULONG ReturnLength
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE Message,
_In_ ULONG Index,
_In_bytecount_(BufferLength) PVOID Buffer,
_In_ ULONG BufferLength,
_Out_ PULONG ReturnLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwAcceptConnectPort(
PHANDLE PortHandle,
PVOID PortContext OPTIONAL,
PPORT_MESSAGE ConnectionRequest,
BOOLEAN AcceptConnection,
PPORT_VIEW ServerView OPTIONAL,
PREMOTE_PORT_VIEW ClientView OPTIONAL
_Out_ PHANDLE PortHandle,
_In_opt_ PVOID PortContext,
_In_ PPORT_MESSAGE ConnectionRequest,
_In_ BOOLEAN AcceptConnection,
_In_opt_ PPORT_VIEW ServerView,
_In_opt_ PREMOTE_PORT_VIEW ClientView
);
NTSYSAPI
NTSTATUS
NTAPI
ZwCompleteConnectPort(
HANDLE PortHandle
_In_ HANDLE PortHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwConnectPort(
PHANDLE PortHandle,
PUNICODE_STRING PortName,
PSECURITY_QUALITY_OF_SERVICE SecurityQos,
PPORT_VIEW ClientView OPTIONAL,
PREMOTE_PORT_VIEW ServerView OPTIONAL,
PULONG MaxMessageLength OPTIONAL,
PVOID ConnectionInformation OPTIONAL,
PULONG ConnectionInformationLength OPTIONAL
_Out_ PHANDLE PortHandle,
_In_ PUNICODE_STRING PortName,
_In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,
_In_opt_ PPORT_VIEW ClientView,
_In_opt_ PREMOTE_PORT_VIEW ServerView,
_In_opt_ PULONG MaxMessageLength,
_In_opt_ PVOID ConnectionInformation,
_In_opt_ PULONG ConnectionInformationLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwCreatePort(
PHANDLE PortHandle,
POBJECT_ATTRIBUTES ObjectAttributes,
ULONG MaxConnectionInfoLength,
ULONG MaxMessageLength,
ULONG MaxPoolUsage
_Out_ PHANDLE PortHandle,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ ULONG MaxConnectionInfoLength,
_In_ ULONG MaxMessageLength,
_In_ ULONG MaxPoolUsage
);
NTSYSAPI
NTSTATUS
NTAPI
ZwCreateWaitablePort(
PHANDLE PortHandle,
POBJECT_ATTRIBUTES ObjectAttributes,
ULONG MaxConnectInfoLength,
ULONG MaxDataLength,
ULONG NPMessageQueueSize OPTIONAL
_Out_ PHANDLE PortHandle,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ ULONG MaxConnectInfoLength,
_In_ ULONG MaxDataLength,
_In_opt_ ULONG NPMessageQueueSize
);
NTSYSAPI
NTSTATUS
NTAPI
ZwImpersonateClientOfPort(
HANDLE PortHandle,
PPORT_MESSAGE ClientMessage
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE ClientMessage
);
NTSYSAPI
NTSTATUS
NTAPI
ZwListenPort(
HANDLE PortHandle,
PPORT_MESSAGE ConnectionRequest
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE ConnectionRequest
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryInformationPort(
HANDLE PortHandle,
PORT_INFORMATION_CLASS PortInformationClass,
PVOID PortInformation,
ULONG PortInformationLength,
PULONG ReturnLength
_In_ HANDLE PortHandle,
_In_ PORT_INFORMATION_CLASS PortInformationClass,
_Out_bytecap_(PortInformationLength) PVOID PortInformation,
_In_ ULONG PortInformationLength,
_Out_ PULONG ReturnLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwReadRequestData(
HANDLE PortHandle,
PPORT_MESSAGE Message,
ULONG Index,
PVOID Buffer,
ULONG BufferLength,
PULONG ReturnLength
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE Message,
_In_ ULONG Index,
_Out_bytecap_(BufferLength) PVOID Buffer,
_In_ ULONG BufferLength,
_Out_ PULONG ReturnLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwReplyPort(
IN HANDLE PortHandle,
IN PPORT_MESSAGE LpcReply
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE LpcReply
);
NTSYSAPI
NTSTATUS
NTAPI
ZwReplyWaitReceivePort(
IN HANDLE PortHandle,
OUT PVOID *PortContext OPTIONAL,
IN PPORT_MESSAGE ReplyMessage OPTIONAL,
OUT PPORT_MESSAGE ReceiveMessage
_In_ HANDLE PortHandle,
_Out_opt_ PVOID *PortContext,
_In_opt_ PPORT_MESSAGE ReplyMessage,
_Out_ PPORT_MESSAGE ReceiveMessage
);
NTSYSAPI
NTSTATUS
NTAPI
ZwReplyWaitReceivePortEx(
IN HANDLE PortHandle,
OUT PVOID *PortContext OPTIONAL,
IN PPORT_MESSAGE ReplyMessage OPTIONAL,
OUT PPORT_MESSAGE ReceiveMessage,
IN PLARGE_INTEGER Timeout OPTIONAL
_In_ HANDLE PortHandle,
_Out_opt_ PVOID *PortContext,
_In_opt_ PPORT_MESSAGE ReplyMessage,
_Out_ PPORT_MESSAGE ReceiveMessage,
_In_opt_ PLARGE_INTEGER Timeout
);
NTSYSAPI
NTSTATUS
NTAPI
ZwReplyWaitReplyPort(
IN HANDLE PortHandle,
OUT PPORT_MESSAGE ReplyMessage
_In_ HANDLE PortHandle,
_Out_ PPORT_MESSAGE ReplyMessage
);
NTSYSAPI
NTSTATUS
NTAPI
ZwRequestPort(
IN HANDLE PortHandle,
IN PPORT_MESSAGE LpcMessage
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE LpcMessage
);
NTSYSAPI
NTSTATUS
NTAPI
ZwRequestWaitReplyPort(
IN HANDLE PortHandle,
OUT PPORT_MESSAGE LpcReply,
IN PPORT_MESSAGE LpcRequest
_In_ HANDLE PortHandle,
_Out_ PPORT_MESSAGE LpcReply,
_In_ PPORT_MESSAGE LpcRequest
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSecureConnectPort(
PHANDLE PortHandle,
PUNICODE_STRING PortName,
PSECURITY_QUALITY_OF_SERVICE SecurityQos,
PPORT_VIEW ClientView OPTIONAL,
PSID Sid OPTIONAL,
PREMOTE_PORT_VIEW ServerView OPTIONAL,
PULONG MaxMessageLength OPTIONAL,
PVOID ConnectionInformation OPTIONAL,
PULONG ConnectionInformationLength OPTIONAL
_Out_ PHANDLE PortHandle,
_In_ PUNICODE_STRING PortName,
_In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,
_Inout_opt_ PPORT_VIEW ClientView,
_In_opt_ PSID Sid,
_Inout_opt_ PREMOTE_PORT_VIEW ServerView,
_Out_opt_ PULONG MaxMessageLength,
_Inout_opt_ PVOID ConnectionInformation,
_Inout_opt_ PULONG ConnectionInformationLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwWriteRequestData(
HANDLE PortHandle,
PPORT_MESSAGE Message,
ULONG Index,
PVOID Buffer,
ULONG BufferLength,
PULONG ReturnLength
_In_ HANDLE PortHandle,
_In_ PPORT_MESSAGE Message,
_In_ ULONG Index,
_In_bytecount_(BufferLength) PVOID Buffer,
_In_ ULONG BufferLength,
_Out_ PULONG ReturnLength
);
#endif

View file

@ -33,36 +33,36 @@ Author:
NTSTATUS
NTAPI
MmCreateSection(
OUT PVOID *SectionObject,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN PLARGE_INTEGER MaximumSize,
IN ULONG SectionPageProtection,
IN ULONG AllocationAttributes,
IN HANDLE FileHandle OPTIONAL,
IN PFILE_OBJECT File OPTIONAL
_Out_ PVOID *SectionObject,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PLARGE_INTEGER MaximumSize,
_In_ ULONG SectionPageProtection,
_In_ ULONG AllocationAttributes,
_In_opt_ HANDLE FileHandle,
_In_opt_ PFILE_OBJECT File
);
NTSTATUS
NTAPI
MmMapViewOfSection(
IN PVOID SectionObject,
IN PEPROCESS Process,
IN OUT PVOID *BaseAddress,
IN ULONG_PTR ZeroBits,
IN SIZE_T CommitSize,
IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,
IN OUT PSIZE_T ViewSize,
IN SECTION_INHERIT InheritDisposition,
IN ULONG AllocationType,
IN ULONG Protect
_In_ PVOID SectionObject,
_In_ PEPROCESS Process,
_Inout_ PVOID *BaseAddress,
_In_ ULONG_PTR ZeroBits,
_In_ SIZE_T CommitSize,
_Inout_opt_ PLARGE_INTEGER SectionOffset,
_Inout_ PSIZE_T ViewSize,
_In_ SECTION_INHERIT InheritDisposition,
_In_ ULONG AllocationType,
_In_ ULONG Protect
);
NTSTATUS
NTAPI
MmUnmapViewOfSection(
struct _EPROCESS* Process,
PVOID BaseAddress
_In_ struct _EPROCESS* Process,
_In_ PVOID BaseAddress
);
#endif
@ -74,403 +74,413 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtAreMappedFilesTheSame(
IN PVOID File1MappedAsAnImage,
IN PVOID File2MappedAsFile
_In_ PVOID File1MappedAsAnImage,
_In_ PVOID File2MappedAsFile
);
NTSTATUS
NTAPI
NtAllocateUserPhysicalPages(
IN HANDLE ProcessHandle,
IN OUT PULONG_PTR NumberOfPages,
IN OUT PULONG_PTR UserPfnArray
_In_ HANDLE ProcessHandle,
_Inout_ PULONG_PTR NumberOfPages,
_Inout_ PULONG_PTR UserPfnArray
);
_Must_inspect_result_
__drv_allocatesMem(Mem)
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAllocateVirtualMemory(
IN HANDLE ProcessHandle,
IN OUT PVOID *BaseAddress,
IN ULONG_PTR ZeroBits,
IN OUT PSIZE_T RegionSize,
IN ULONG AllocationType,
IN ULONG Protect
_In_ HANDLE ProcessHandle,
_Inout_ _At_(*BaseAddress, _Readable_bytes_(*RegionSize) _Writable_bytes_(*RegionSize) _Post_readable_byte_size_(*RegionSize)) PVOID *BaseAddress,
_In_ ULONG_PTR ZeroBits,
_Inout_ PSIZE_T RegionSize,
_In_ ULONG AllocationType,
_In_ ULONG Protect
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreatePagingFile(
IN PUNICODE_STRING FileName,
IN PLARGE_INTEGER InitialSize,
IN PLARGE_INTEGER MaxiumSize,
IN ULONG Reserved
_In_ PUNICODE_STRING FileName,
_In_ PLARGE_INTEGER InitialSize,
_In_ PLARGE_INTEGER MaxiumSize,
_In_ ULONG Reserved
);
_Must_inspect_result_
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateSection(
OUT PHANDLE SectionHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN PLARGE_INTEGER MaximumSize OPTIONAL,
IN ULONG SectionPageProtection OPTIONAL,
IN ULONG AllocationAttributes,
IN HANDLE FileHandle OPTIONAL
_Out_ PHANDLE SectionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PLARGE_INTEGER MaximumSize,
_In_ ULONG SectionPageProtection,
_In_ ULONG AllocationAttributes,
_In_opt_ HANDLE FileHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtExtendSection(
IN HANDLE SectionHandle,
IN PLARGE_INTEGER NewMaximumSize
_In_ HANDLE SectionHandle,
_In_ PLARGE_INTEGER NewMaximumSize
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtFlushVirtualMemory(
IN HANDLE ProcessHandle,
IN OUT PVOID *BaseAddress,
IN OUT PSIZE_T RegionSize,
OUT PIO_STATUS_BLOCK IoStatus
_In_ HANDLE ProcessHandle,
_Inout_ PVOID *BaseAddress,
_Inout_ PSIZE_T RegionSize,
_Out_ PIO_STATUS_BLOCK IoStatus
);
NTSTATUS
NTAPI
NtFreeUserPhysicalPages(
IN HANDLE ProcessHandle,
IN OUT PULONG_PTR NumberOfPages,
IN OUT PULONG_PTR UserPfnArray
_In_ HANDLE ProcessHandle,
_Inout_ PULONG_PTR NumberOfPages,
_Inout_ PULONG_PTR UserPfnArray
);
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtFreeVirtualMemory(
IN HANDLE ProcessHandle,
IN PVOID *BaseAddress,
IN PSIZE_T RegionSize,
IN ULONG FreeType
_In_ HANDLE ProcessHandle,
_Inout_ __drv_freesMem(Mem) PVOID *BaseAddress,
_Inout_ PSIZE_T RegionSize,
_In_ ULONG FreeType
);
NTSTATUS
NTAPI
NtGetWriteWatch(
IN HANDLE ProcessHandle,
IN ULONG Flags,
IN PVOID BaseAddress,
IN SIZE_T RegionSize,
IN PVOID *UserAddressArray,
OUT PULONG_PTR EntriesInUserAddressArray,
OUT PULONG Granularity
_In_ HANDLE ProcessHandle,
_In_ ULONG Flags,
_In_ PVOID BaseAddress,
_In_ SIZE_T RegionSize,
_In_ PVOID *UserAddressArray,
_Out_ PULONG_PTR EntriesInUserAddressArray,
_Out_ PULONG Granularity
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtLockVirtualMemory(
IN HANDLE ProcessHandle,
IN OUT PVOID *BaseAddress,
IN OUT PSIZE_T NumberOfBytesToLock,
IN ULONG MapType
_In_ HANDLE ProcessHandle,
_Inout_ PVOID *BaseAddress,
_Inout_ PSIZE_T NumberOfBytesToLock,
_In_ ULONG MapType
);
NTSTATUS
NTAPI
NtMapUserPhysicalPages(
IN PVOID VirtualAddresses,
IN ULONG_PTR NumberOfPages,
IN OUT PULONG_PTR UserPfnArray
_In_ PVOID VirtualAddresses,
_In_ ULONG_PTR NumberOfPages,
_Inout_ PULONG_PTR UserPfnArray
);
NTSTATUS
NTAPI
NtMapUserPhysicalPagesScatter(
IN PVOID *VirtualAddresses,
IN ULONG_PTR NumberOfPages,
IN OUT PULONG_PTR UserPfnArray
_In_ PVOID *VirtualAddresses,
_In_ ULONG_PTR NumberOfPages,
_Inout_ PULONG_PTR UserPfnArray
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtMapViewOfSection(
IN HANDLE SectionHandle,
IN HANDLE ProcessHandle,
IN OUT PVOID *BaseAddress,
IN ULONG_PTR ZeroBits,
IN SIZE_T CommitSize,
IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,
IN OUT PSIZE_T ViewSize,
IN SECTION_INHERIT InheritDisposition,
IN ULONG AllocationType,
IN ULONG AccessProtection
_In_ HANDLE SectionHandle,
_In_ HANDLE ProcessHandle,
_Inout_ PVOID *BaseAddress,
_In_ ULONG_PTR ZeroBits,
_In_ SIZE_T CommitSize,
_Inout_opt_ PLARGE_INTEGER SectionOffset,
_Inout_ PSIZE_T ViewSize,
_In_ SECTION_INHERIT InheritDisposition,
_In_ ULONG AllocationType,
_In_ ULONG AccessProtection
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenSection(
OUT PHANDLE SectionHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes
_Out_ PHANDLE SectionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtProtectVirtualMemory(
IN HANDLE ProcessHandle,
IN PVOID *BaseAddress,
IN SIZE_T *NumberOfBytesToProtect,
IN ULONG NewAccessProtection,
OUT PULONG OldAccessProtection
_In_ HANDLE ProcessHandle,
_In_ PVOID *BaseAddress,
_In_ SIZE_T *NumberOfBytesToProtect,
_In_ ULONG NewAccessProtection,
_Out_ PULONG OldAccessProtection
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySection(
IN HANDLE SectionHandle,
IN SECTION_INFORMATION_CLASS SectionInformationClass,
OUT PVOID SectionInformation,
IN SIZE_T Length,
OUT PSIZE_T ResultLength
_In_ HANDLE SectionHandle,
_In_ SECTION_INFORMATION_CLASS SectionInformationClass,
_Out_ PVOID SectionInformation,
_In_ SIZE_T Length,
_Out_ PSIZE_T ResultLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryVirtualMemory(
IN HANDLE ProcessHandle,
IN PVOID Address,
IN MEMORY_INFORMATION_CLASS VirtualMemoryInformationClass,
OUT PVOID VirtualMemoryInformation,
IN SIZE_T Length,
OUT PSIZE_T ResultLength
_In_ HANDLE ProcessHandle,
_In_ PVOID Address,
_In_ MEMORY_INFORMATION_CLASS VirtualMemoryInformationClass,
_Out_ PVOID VirtualMemoryInformation,
_In_ SIZE_T Length,
_Out_ PSIZE_T ResultLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtReadVirtualMemory(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
OUT PVOID Buffer,
IN SIZE_T NumberOfBytesToRead,
OUT PSIZE_T NumberOfBytesRead
_In_ HANDLE ProcessHandle,
_In_ PVOID BaseAddress,
_Out_ PVOID Buffer,
_In_ SIZE_T NumberOfBytesToRead,
_Out_ PSIZE_T NumberOfBytesRead
);
NTSTATUS
NTAPI
NtResetWriteWatch(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
IN SIZE_T RegionSize
_In_ HANDLE ProcessHandle,
_In_ PVOID BaseAddress,
_In_ SIZE_T RegionSize
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUnlockVirtualMemory(
IN HANDLE ProcessHandle,
IN OUT PVOID *BaseAddress,
IN OUT PSIZE_T NumberOfBytesToUnlock,
IN ULONG MapType
_In_ HANDLE ProcessHandle,
_Inout_ PVOID *BaseAddress,
_Inout_ PSIZE_T NumberOfBytesToUnlock,
_In_ ULONG MapType
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUnmapViewOfSection(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress
_In_ HANDLE ProcessHandle,
_In_ PVOID BaseAddress
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtWriteVirtualMemory(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
IN PVOID Buffer,
IN SIZE_T NumberOfBytesToWrite,
OUT PSIZE_T NumberOfBytesWritten
_In_ HANDLE ProcessHandle,
_In_ PVOID BaseAddress,
_In_ PVOID Buffer,
_In_ SIZE_T NumberOfBytesToWrite,
_Out_ PSIZE_T NumberOfBytesWritten
);
NTSYSAPI
NTSTATUS
NTAPI
ZwAreMappedFilesTheSame(
IN PVOID File1MappedAsAnImage,
IN PVOID File2MappedAsFile
_In_ PVOID File1MappedAsAnImage,
_In_ PVOID File2MappedAsFile
);
NTSYSAPI
NTSTATUS
NTAPI
ZwAllocateVirtualMemory(
IN HANDLE ProcessHandle,
IN OUT PVOID *BaseAddress,
IN ULONG_PTR ZeroBits,
IN OUT PSIZE_T RegionSize,
IN ULONG AllocationType,
IN ULONG Protect
_In_ HANDLE ProcessHandle,
_Inout_ PVOID *BaseAddress,
_In_ ULONG_PTR ZeroBits,
_Inout_ PSIZE_T RegionSize,
_In_ ULONG AllocationType,
_In_ ULONG Protect
);
NTSYSAPI
NTSTATUS
NTAPI
ZwCreatePagingFile(
IN PUNICODE_STRING FileName,
IN PLARGE_INTEGER InitialSize,
IN PLARGE_INTEGER MaxiumSize,
IN ULONG Reserved
_In_ PUNICODE_STRING FileName,
_In_ PLARGE_INTEGER InitialSize,
_In_ PLARGE_INTEGER MaxiumSize,
_In_ ULONG Reserved
);
_IRQL_requires_max_(APC_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwCreateSection(
OUT PHANDLE SectionHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN PLARGE_INTEGER MaximumSize OPTIONAL,
IN ULONG SectionPageProtection OPTIONAL,
IN ULONG AllocationAttributes,
IN HANDLE FileHandle OPTIONAL
_Out_ PHANDLE SectionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PLARGE_INTEGER MaximumSize,
_In_ ULONG SectionPageProtection,
_In_ ULONG AllocationAttributes,
_In_opt_ HANDLE FileHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwExtendSection(
IN HANDLE SectionHandle,
IN PLARGE_INTEGER NewMaximumSize
_In_ HANDLE SectionHandle,
_In_ PLARGE_INTEGER NewMaximumSize
);
_IRQL_requires_max_(PASSIVE_LEVEL)
_When_(return==0, __drv_freesMem(Region))
NTSYSAPI
NTSTATUS
NTAPI
ZwFreeVirtualMemory(
IN HANDLE ProcessHandle,
IN PVOID *BaseAddress,
IN PSIZE_T RegionSize,
IN ULONG FreeType
_In_ HANDLE ProcessHandle,
_Inout_ PVOID *BaseAddress,
_Inout_ PSIZE_T RegionSize,
_In_ ULONG FreeType
);
NTSYSAPI
NTSTATUS
NTAPI
ZwLockVirtualMemory(
IN HANDLE ProcessHandle,
IN OUT PVOID *BaseAddress,
IN OUT PSIZE_T NumberOfBytesToLock,
IN ULONG MapType
_In_ HANDLE ProcessHandle,
_Inout_ PVOID *BaseAddress,
_Inout_ PSIZE_T NumberOfBytesToLock,
_In_ ULONG MapType
);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwMapViewOfSection(
IN HANDLE SectionHandle,
IN HANDLE ProcessHandle,
IN OUT PVOID *BaseAddress,
IN ULONG_PTR ZeroBits,
IN SIZE_T CommitSize,
IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,
IN OUT PSIZE_T ViewSize,
IN SECTION_INHERIT InheritDisposition,
IN ULONG AllocationType,
IN ULONG AccessProtection
_In_ HANDLE SectionHandle,
_In_ HANDLE ProcessHandle,
_Outptr_result_bytebuffer_(*ViewSize) PVOID *BaseAddress,
_In_ ULONG_PTR ZeroBits,
_In_ SIZE_T CommitSize,
_Inout_opt_ PLARGE_INTEGER SectionOffset,
_Inout_ PSIZE_T ViewSize,
_In_ SECTION_INHERIT InheritDisposition,
_In_ ULONG AllocationType,
_In_ ULONG Win32Protect
);
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenSection(
OUT PHANDLE SectionHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes
_Out_ PHANDLE SectionHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSAPI
NTSTATUS
NTAPI
ZwProtectVirtualMemory(
IN HANDLE ProcessHandle,
IN PVOID *BaseAddress,
IN SIZE_T *NumberOfBytesToProtect,
IN ULONG NewAccessProtection,
OUT PULONG OldAccessProtection
_In_ HANDLE ProcessHandle,
_In_ PVOID *BaseAddress,
_In_ SIZE_T *NumberOfBytesToProtect,
_In_ ULONG NewAccessProtection,
_Out_ PULONG OldAccessProtection
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySection(
IN HANDLE SectionHandle,
IN SECTION_INFORMATION_CLASS SectionInformationClass,
OUT PVOID SectionInformation,
IN SIZE_T Length,
OUT PSIZE_T ResultLength
_In_ HANDLE SectionHandle,
_In_ SECTION_INFORMATION_CLASS SectionInformationClass,
_Out_ PVOID SectionInformation,
_In_ SIZE_T Length,
_Out_ PSIZE_T ResultLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryVirtualMemory(
IN HANDLE ProcessHandle,
IN PVOID Address,
IN MEMORY_INFORMATION_CLASS VirtualMemoryInformationClass,
OUT PVOID VirtualMemoryInformation,
IN SIZE_T Length,
OUT PSIZE_T ResultLength
_In_ HANDLE ProcessHandle,
_In_ PVOID Address,
_In_ MEMORY_INFORMATION_CLASS VirtualMemoryInformationClass,
_Out_ PVOID VirtualMemoryInformation,
_In_ SIZE_T Length,
_Out_ PSIZE_T ResultLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwReadVirtualMemory(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
OUT PVOID Buffer,
IN SIZE_T NumberOfBytesToRead,
OUT PSIZE_T NumberOfBytesRead
_In_ HANDLE ProcessHandle,
_In_ PVOID BaseAddress,
_Out_ PVOID Buffer,
_In_ SIZE_T NumberOfBytesToRead,
_Out_ PSIZE_T NumberOfBytesRead
);
NTSYSAPI
NTSTATUS
NTAPI
ZwUnlockVirtualMemory(
IN HANDLE ProcessHandle,
IN OUT PVOID *BaseAddress,
IN OUT PSIZE_T NumberOfBytesToUnlock,
IN ULONG MapType
_In_ HANDLE ProcessHandle,
_Inout_ PVOID *BaseAddress,
_Inout_ PSIZE_T NumberOfBytesToUnlock,
_In_ ULONG MapType
);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwUnmapViewOfSection(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress
_In_ HANDLE ProcessHandle,
_In_opt_ PVOID BaseAddress
);
NTSYSAPI
NTSTATUS
NTAPI
ZwWriteVirtualMemory(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
IN PVOID Buffer,
IN SIZE_T NumberOfBytesToWrite,
OUT PSIZE_T NumberOfBytesWritten
_In_ HANDLE ProcessHandle,
_In_ PVOID BaseAddress,
_In_ PVOID Buffer,
_In_ SIZE_T NumberOfBytesToWrite,
_Out_ PSIZE_T NumberOfBytesWritten
);
#endif

View file

@ -14,16 +14,16 @@ the documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY ALEX IONESCU ``AS IS'' AND ANY EXPRESS
OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL ALEX IONESCU OR THE NDK CONTRIBUTORS
ARE DISCLAIMED. _In_ NO EVENT SHALL ALEX IONESCU OR THE NDK CONTRIBUTORS
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
WHETHER _In_ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
OR OTHERWISE) ARISING _In_ ANY WAY _Out_ OF THE USE OF THIS SOFTWARE,
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
The views and conclusions contained in the software and documentation
are those of the authors and should not be interpreted as representing
official policies, either expressed or implied, of Alex Ionescu or
the NDK Project Contributors.
the NDK Project Contributors.

View file

@ -0,0 +1,525 @@
#pragma once
#define _NO_SAL_2_H_
#undef _Acquires_exclusive_lock_
#undef _Acquires_lock_
#undef _Acquires_nonreentrant_lock_
#undef _Acquires_shared_lock_
#undef _Always_
#undef _Analysis_assume_
#undef _Analysis_assume_lock_acquired_
#undef _Analysis_assume_lock_held_
#undef _Analysis_assume_lock_not_held_
#undef _Analysis_assume_lock_released_
#undef _Analysis_assume_same_lock_
#undef _Analysis_mode_
#undef _Analysis_noreturn_
#undef _Analysis_suppress_lock_checking_
#undef _At_
#undef _At_buffer_
#undef _Benign_race_begin_
#undef _Benign_race_end_
#undef _Check_return_
#undef _COM_Outptr_
#undef _COM_Outptr_opt_
#undef _COM_Outptr_opt_result_maybenull_
#undef _COM_Outptr_result_maybenull_
#undef _Const_
#undef _Create_lock_level_
#undef _Deref_
#undef _Deref_in_range_
#undef _Deref_inout_range_
#undef _Deref_out_range_
#undef _Enum_is_bitflag_
#undef _Field_range_
#undef _Field_size_
#undef _Field_size_bytes_
#undef _Field_size_bytes_full_
#undef _Field_size_bytes_full_opt_
#undef _Field_size_bytes_opt_
#undef _Field_size_bytes_part_
#undef _Field_size_bytes_part_opt_
#undef _Field_size_full_
#undef _Field_size_full_opt_
#undef _Field_size_opt_
#undef _Field_size_part_
#undef _Field_size_part_opt_
#undef _Function_class_
#undef _Function_ignore_lock_checking_
#undef _Group_
#undef _Guarded_by_
#undef _Has_lock_kind_
#undef _Has_lock_level_
#undef _In_
#undef _In_defensive_
#undef _In_opt_
#undef _In_opt_z_
#undef _In_range_
#undef _In_reads_
#undef _In_reads_bytes_
#undef _In_reads_bytes_opt_
#undef _In_reads_opt_
#undef _In_reads_opt_z_
#undef _In_reads_or_z_
#undef _In_reads_to_ptr_
#undef _In_reads_to_ptr_opt_
#undef _In_reads_to_ptr_opt_z_
#undef _In_reads_to_ptr_z_
#undef _In_reads_z_
#undef _In_z_
#undef _Inout_
#undef _Inout_defensive_
#undef _Inout_opt_
#undef _Inout_opt_z_
#undef _Inout_updates_
#undef _Inout_updates_all_
#undef _Inout_updates_all_opt_
#undef _Inout_updates_bytes_
#undef _Inout_updates_bytes_all_
#undef _Inout_updates_bytes_all_opt_
#undef _Inout_updates_bytes_opt_
#undef _Inout_updates_bytes_to_
#undef _Inout_updates_bytes_to_opt_
#undef _Inout_updates_opt_
#undef _Inout_updates_opt_z_
#undef _Inout_updates_to_
#undef _Inout_updates_to_opt_
#undef _Inout_updates_z_
#undef _Inout_z_
#undef _Interlocked_
#undef _Interlocked_operand_
#undef _IRQL_always_function_max_
#undef _IRQL_always_function_min_
#undef _IRQL_is_cancel_
#undef _IRQL_raises_
#undef _IRQL_requires_
#undef _IRQL_requires_max_
#undef _IRQL_requires_min_
#undef _IRQL_requires_same_
#undef _IRQL_restores_
#undef _IRQL_restores_global_
#undef _IRQL_saves_
#undef _IRQL_saves_global_
#undef _IRQL_uses_cancel_
#undef _Kernel_acquires_resource_
#undef _Kernel_clear_do_init_
#undef _Kernel_float_restored_
#undef _Kernel_float_saved_
#undef _Kernel_float_used_
#undef _Kernel_IoGetDmaAdapter_
#undef _Kernel_releases_resource_
#undef _Kernel_requires_resource_held_
#undef _Kernel_requires_resource_not_held_
#undef _Literal_
#undef _Lock_level_order_
#undef _Maybe_raises_SEH_exception_
#undef _Maybenull_
#undef _Must_inspect_result_
#undef _No_competing_thread_
#undef _No_competing_thread_begin_
#undef _No_competing_thread_end_
#undef _Notliteral_
#undef _Notnull_
#undef _Notvalid_
#undef _Null_
#undef _Null_terminated_
#undef _NullNull_terminated_
#undef _On_failure_
#undef _Out_
#undef _Out_defensive_
#undef _Out_opt_
#undef _Out_range_
#undef _Out_writes_
#undef _Out_writes_all_
#undef _Out_writes_all_opt_
#undef _Out_writes_bytes_
#undef _Out_writes_bytes_all_
#undef _Out_writes_bytes_all_opt_
#undef _Out_writes_bytes_opt_
#undef _Out_writes_bytes_to_
#undef _Out_writes_bytes_to_opt_
#undef _Out_writes_opt_
#undef _Out_writes_opt_z_
#undef _Out_writes_to_
#undef _Out_writes_to_opt_
#undef _Out_writes_to_ptr_
#undef _Out_writes_to_ptr_opt_
#undef _Out_writes_to_ptr_opt_z_
#undef _Out_writes_to_ptr_z_
#undef _Out_writes_z_
#undef _Outptr_
#undef _Outptr_opt_
#undef _Outptr_opt_result_buffer_
#undef _Outptr_opt_result_buffer_to_
#undef _Outptr_opt_result_bytebuffer_
#undef _Outptr_opt_result_bytebuffer_to_
#undef _Outptr_opt_result_maybenull_
#undef _Outptr_opt_result_maybenull_z_
#undef _Outptr_opt_result_nullonfailure_
#undef _Outptr_opt_result_z_
#undef _Outptr_result_buffer_
#undef _Outptr_result_buffer_to_
#undef _Outptr_result_bytebuffer_
#undef _Outptr_result_bytebuffer_to_
#undef _Outptr_result_maybenull_
#undef _Outptr_result_maybenull_z_
#undef _Outptr_result_nullonfailure_
#undef _Outptr_result_z_
#undef _Outref_
#undef _Outref_result_buffer_
#undef _Outref_result_buffer_all_
#undef _Outref_result_buffer_all_maybenull_
#undef _Outref_result_buffer_maybenull_
#undef _Outref_result_buffer_to_
#undef _Outref_result_buffer_to_maybenull_
#undef _Outref_result_bytebuffer_
#undef _Outref_result_bytebuffer_all_
#undef _Outref_result_bytebuffer_all_maybenull_
#undef _Outref_result_bytebuffer_maybenull_
#undef _Outref_result_bytebuffer_to_
#undef _Outref_result_bytebuffer_to_maybenull_
#undef _Outref_result_maybenull_
#undef _Outref_result_nullonfailure_
#undef _Points_to_data_
#undef _Post_
#undef _Post_defensive_
#undef _Post_equal_to_
#undef _Post_invalid_
#undef _Post_ptr_invalid_
#undef _Post_readable_byte_size_
#undef _Post_readable_size_
#undef _Post_same_lock_
#undef _Post_satisfies_
#undef _Post_valid_
#undef _Post_writable_byte_size_
#undef _Post_writable_size_
#undef _Post_z_
#undef _Pre_
#undef _Pre_defensive_
#undef _Pre_equal_to_
#undef _Pre_maybenull_
#undef _Pre_notnull_
#undef _Pre_null_
#undef _Pre_opt_valid_
#undef _Pre_readable_byte_size_
#undef _Pre_readable_size_
#undef _Pre_satisfies_
#undef _Pre_unknown_
#undef _Pre_valid_
#undef _Pre_writable_byte_size_
#undef _Pre_writable_size_
#undef _Pre_z_
#undef _Prepost_z_
#undef _Printf_format_string_
#undef _Printf_format_string_params_
#undef _Raises_SEH_exception_
#undef _Readable_bytes_
#undef _Readable_elements_
#undef _Releases_exclusive_lock_
#undef _Releases_lock_
#undef _Releases_nonreentrant_lock_
#undef _Releases_shared_lock_
#undef _Requires_exclusive_lock_held_
#undef _Requires_lock_held_
#undef _Requires_lock_not_held_
#undef _Requires_no_locks_held_
#undef _Requires_shared_lock_held_
#undef _Reserved_
#undef _Result_nullonfailure_
#undef _Result_zeroonfailure_
#undef _Ret_
#undef _Ret_maybenull_
#undef _Ret_maybenull_z_
#undef _Ret_notnull_
#undef _Ret_null_
#undef _Ret_range_
#undef _Ret_valid_
#undef _Ret_writes_
#undef _Ret_writes_bytes_
#undef _Ret_writes_bytes_maybenull_
#undef _Ret_writes_bytes_to_
#undef _Ret_writes_bytes_to_maybenull_
#undef _Ret_writes_maybenull_
#undef _Ret_writes_maybenull_z_
#undef _Ret_writes_to_
#undef _Ret_writes_to_maybenull_
#undef _Ret_writes_to_ptr_
#undef _Ret_writes_to_ptr_z_
#undef _Ret_writes_z_
#undef _Ret_z_
#undef _Return_type_success_
#undef _Scanf_format_string_
#undef _Scanf_format_string_params_
#undef _Scanf_s_format_string_
#undef _Scanf_s_format_string_params_
#undef _Strict_type_match_
#undef _Struct_size_bytes_
#undef _Success_
#undef _Use_decl_annotations_
#undef _Valid_
#undef _When_
#undef _Writable_bytes_
#undef _Writable_elements_
#undef _Write_guarded_by_
#define _Acquires_exclusive_lock_(e)
#define _Acquires_lock_(e)
#define _Acquires_nonreentrant_lock_(e)
#define _Acquires_shared_lock_(e)
#define _Always_(a)
#define _Analysis_assume_
#define _Analysis_assume_lock_acquired_(e)
#define _Analysis_assume_lock_held_(e)
#define _Analysis_assume_lock_not_held_(e)
#define _Analysis_assume_lock_released_(e)
#define _Analysis_assume_same_lock_(e)
#define _Analysis_mode_(m)
#define _Analysis_noreturn_
#define _Analysis_suppress_lock_checking_(e)
#define _At_(t,a)
#define _At_buffer_(t,i,c,a)
#define _Benign_race_begin_
#define _Benign_race_end_
#define _Check_return_
#define _COM_Outptr_
#define _COM_Outptr_opt_
#define _COM_Outptr_opt_result_maybenull_
#define _COM_Outptr_result_maybenull_
#define _Const_
#define _Create_lock_level_(n)
#define _Deref_
#define _Deref_in_range_(l,h)
#define _Deref_inout_range_(l,h)
#define _Deref_out_range_(l,h)
#define _Enum_is_bitflag_
#define _Field_range_(l,h)
#define _Field_size_(s)
#define _Field_size_bytes_(s)
#define _Field_size_bytes_full_(s)
#define _Field_size_bytes_full_opt_(s)
#define _Field_size_bytes_opt_(s)
#define _Field_size_bytes_part_(s,c)
#define _Field_size_bytes_part_opt_(s,c)
#define _Field_size_full_(s)
#define _Field_size_full_opt_(s)
#define _Field_size_opt_(s)
#define _Field_size_part_(s,c)
#define _Field_size_part_opt_(s,c)
#define _Function_class_(n)
#define _Function_ignore_lock_checking_(e)
#define _Group_(a)
#define _Guarded_by_(e)
#define _Has_lock_kind_(n)
#define _Has_lock_level_(n)
#define _In_
#define _In_defensive_(a)
#define _In_opt_
#define _In_opt_z_
#define _In_range_(l,h)
#define _In_reads_(s)
#define _In_reads_bytes_(s)
#define _In_reads_bytes_opt_(s)
#define _In_reads_opt_(s)
#define _In_reads_opt_z_(s)
#define _In_reads_or_z_(s)
#define _In_reads_to_ptr_(p)
#define _In_reads_to_ptr_opt_(p)
#define _In_reads_to_ptr_opt_z_(p)
#define _In_reads_to_ptr_z_(p)
#define _In_reads_z_(s)
#define _In_z_
#define _Inout_
#define _Inout_defensive_(a)
#define _Inout_opt_
#define _Inout_opt_z_
#define _Inout_updates_(s)
#define _Inout_updates_all_(s)
#define _Inout_updates_all_opt_(s)
#define _Inout_updates_bytes_(s)
#define _Inout_updates_bytes_all_(s)
#define _Inout_updates_bytes_all_opt_(s)
#define _Inout_updates_bytes_opt_(s)
#define _Inout_updates_bytes_to_(s,c)
#define _Inout_updates_bytes_to_opt_(s,c)
#define _Inout_updates_opt_(s)
#define _Inout_updates_opt_z_(s)
#define _Inout_updates_to_(s,c)
#define _Inout_updates_to_opt_(s,c)
#define _Inout_updates_z_(s)
#define _Inout_z_
#define _Interlocked_
#define _Interlocked_operand_
#define _IRQL_always_function_max_(i)
#define _IRQL_always_function_min_(i)
#define _IRQL_is_cancel_
#define _IRQL_raises_(i)
#define _IRQL_requires_(i)
#define _IRQL_requires_max_(i)
#define _IRQL_requires_min_(i)
#define _IRQL_requires_same_
#define _IRQL_restores_
#define _IRQL_restores_global_(k,s)
#define _IRQL_saves_
#define _IRQL_saves_global_(k,s)
#define _IRQL_uses_cancel_
#define _Kernel_acquires_resource_(k)
#define _Kernel_clear_do_init_(yn)
#define _Kernel_float_restored_
#define _Kernel_float_saved_
#define _Kernel_float_used_
#define _Kernel_IoGetDmaAdapter_
#define _Kernel_releases_resource_(k)
#define _Kernel_requires_resource_held_(k)
#define _Kernel_requires_resource_not_held_(k)
#define _Literal_
#define _Lock_level_order_(n1,n2)
#define _Maybe_raises_SEH_exception_
#define _Maybenull_
#define _Must_inspect_result_
#define _No_competing_thread_
#define _No_competing_thread_begin_
#define _No_competing_thread_end_
#define _Notliteral_
#define _Notnull_
#define _Notvalid_
#define _Null_
#define _Null_terminated_
#define _NullNull_terminated_
#define _On_failure_(a)
#define _Out_
#define _Out_defensive_(a)
#define _Out_opt_
#define _Out_range_(l,h)
#define _Out_writes_(s)
#define _Out_writes_all_(s)
#define _Out_writes_all_opt_(s)
#define _Out_writes_bytes_(s)
#define _Out_writes_bytes_all_(s)
#define _Out_writes_bytes_all_opt_(s)
#define _Out_writes_bytes_opt_(s)
#define _Out_writes_bytes_to_(s,c)
#define _Out_writes_bytes_to_opt_(s,c)
#define _Out_writes_opt_(s)
#define _Out_writes_opt_z_(s)
#define _Out_writes_to_(s,c)
#define _Out_writes_to_opt_(s,c)
#define _Out_writes_to_ptr_(p)
#define _Out_writes_to_ptr_opt_(p)
#define _Out_writes_to_ptr_opt_z_(p)
#define _Out_writes_to_ptr_z_(p)
#define _Out_writes_z_(s)
#define _Outptr_
#define _Outptr_opt_
#define _Outptr_opt_result_buffer_(s)
#define _Outptr_opt_result_buffer_to_(s,c)
#define _Outptr_opt_result_bytebuffer_(s)
#define _Outptr_opt_result_bytebuffer_to_(s,c)
#define _Outptr_opt_result_maybenull_
#define _Outptr_opt_result_maybenull_z_
#define _Outptr_opt_result_nullonfailure_
#define _Outptr_opt_result_z_
#define _Outptr_result_buffer_(s)
#define _Outptr_result_buffer_to_(s,c)
#define _Outptr_result_bytebuffer_(s)
#define _Outptr_result_bytebuffer_to_(s,c)
#define _Outptr_result_maybenull_
#define _Outptr_result_maybenull_z_
#define _Outptr_result_nullonfailure_
#define _Outptr_result_z_
#define _Outref_
#define _Outref_result_buffer_(s)
#define _Outref_result_buffer_all_(s)
#define _Outref_result_buffer_all_maybenull_(s)
#define _Outref_result_buffer_maybenull_(s)
#define _Outref_result_buffer_to_(s,c)
#define _Outref_result_buffer_to_maybenull_(s,c)
#define _Outref_result_bytebuffer_(s)
#define _Outref_result_bytebuffer_all_(s)
#define _Outref_result_bytebuffer_all_maybenull_(s)
#define _Outref_result_bytebuffer_maybenull_(s)
#define _Outref_result_bytebuffer_to_(s,c)
#define _Outref_result_bytebuffer_to_maybenull_(s,c)
#define _Outref_result_maybenull_
#define _Outref_result_nullonfailure_
#define _Points_to_data_
#define _Post_
#define _Post_defensive_
#define _Post_equal_to_(e)
#define _Post_invalid_ _Post_ _Deref_ _Notvalid_
#define _Post_ptr_invalid_ _Post_ _Notvalid_
#define _Post_readable_byte_size_(s) _Post_ _Readable_bytes_(s) _Post_ _Valid_
#define _Post_readable_size_(s) _Post_ _Readable_elements_(s) _Post_ _Valid_
#define _Post_same_lock_(e1,e2)
#define _Post_satisfies_(e)
#define _Post_valid_ _Post_ _Valid_
#define _Post_writable_byte_size_(s) _Post_ _Writable_bytes_(s)
#define _Post_writable_size_(s) _Post_ _Writable_elements_(s)
#define _Post_z_ _Post_ _Null_terminated_
#define _Pre_
#define _Pre_defensive_
#define _Pre_equal_to_(e)
#define _Pre_maybenull_ _Pre_ _Maybenull_
#define _Pre_notnull_ _Pre_ _Notnull_
#define _Pre_null_ _Pre_ _Null_
#define _Pre_opt_valid_ _Pre_maybenull_ _Pre_ _Valid_
#define _Pre_readable_byte_size_(s) _Pre_ _Readable_bytes_(s) _Pre_ _Valid_
#define _Pre_readable_size_(s) _Pre_ _Readable_elements_(s) _Pre_ _Valid_
#define _Pre_satisfies_(e)
#define _Pre_unknown_
#define _Pre_valid_ _Pre_notnull_ _Pre_ _Valid_
#define _Pre_writable_byte_size_(s) _Pre_ _Writable_bytes_(s)
#define _Pre_writable_size_(s) _Pre_ _Writable_elements_(s)
#define _Pre_z_ _Pre_ _Null_terminated_
#define _Prepost_z_ _Pre_z_ _Post_z_
#define _Printf_format_string_
#define _Printf_format_string_params_(x)
#define _Raises_SEH_exception_
#define _Readable_bytes_(s)
#define _Readable_elements_(s)
#define _Releases_exclusive_lock_(e)
#define _Releases_lock_(e)
#define _Releases_nonreentrant_lock_(e)
#define _Releases_shared_lock_(e)
#define _Requires_exclusive_lock_held_(e)
#define _Requires_lock_held_(e)
#define _Requires_lock_not_held_(e)
#define _Requires_no_locks_held_
#define _Requires_shared_lock_held_(e)
#define _Reserved_ _Pre_equal_to_(0) _Pre_ _Null_
#define _Result_nullonfailure_
#define _Result_zeroonfailure_
#define _Ret_
#define _Ret_maybenull_
#define _Ret_maybenull_z_
#define _Ret_notnull_
#define _Ret_null_
#define _Ret_range_(l,h)
#define _Ret_valid_
#define _Ret_writes_(s)
#define _Ret_writes_bytes_(s)
#define _Ret_writes_bytes_maybenull_(s)
#define _Ret_writes_bytes_to_(s,c)
#define _Ret_writes_bytes_to_maybenull_(s,c)
#define _Ret_writes_maybenull_(s)
#define _Ret_writes_maybenull_z_(s)
#define _Ret_writes_to_(s,c)
#define _Ret_writes_to_maybenull_(s,c)
#define _Ret_writes_to_ptr_(p)
#define _Ret_writes_to_ptr_z_(p)
#define _Ret_writes_z_(s)
#define _Ret_z_
#define _Return_type_success_(c)
#define _Scanf_format_string_
#define _Scanf_format_string_params_(x)
#define _Scanf_s_format_string_
#define _Scanf_s_format_string_params_(x)
#define _Strict_type_match_
#define _Struct_size_bytes_(s)
#define _Success_(c)
#define _Use_decl_annotations_
#define _Valid_
#define _When_(c,a)
#define _Writable_bytes_(s)
#define _Writable_elements_(s)
#define _Write_guarded_by_(e)

View file

@ -31,6 +31,14 @@ Author:
#pragma warning(disable:4214)
#endif
//
// Use dummy macros, if SAL 2 is not available
//
#include <sal.h>
#if (_SAL_VERSION < 20)
#include <no_sal2.h>
#endif
//
// Headers needed for NDK
//

View file

@ -35,129 +35,129 @@ NTKERNELAPI
NTSTATUS
NTAPI
ObAssignSecurity(
IN PACCESS_STATE AccessState,
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
IN PVOID Object,
IN POBJECT_TYPE Type
_In_ PACCESS_STATE AccessState,
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ PVOID Object,
_In_ POBJECT_TYPE Type
);
NTKERNELAPI
NTSTATUS
NTAPI
ObCloseHandle(
IN HANDLE Handle,
IN KPROCESSOR_MODE AccessMode
_In_ HANDLE Handle,
_In_ KPROCESSOR_MODE AccessMode
);
NTKERNELAPI
NTSTATUS
NTAPI
ObCreateObject(
IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL,
IN POBJECT_TYPE ObjectType,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN KPROCESSOR_MODE AccessMode,
IN OUT PVOID ParseContext OPTIONAL,
IN ULONG ObjectSize,
IN ULONG PagedPoolCharge OPTIONAL,
IN ULONG NonPagedPoolCharge OPTIONAL,
OUT PVOID *Object
_In_opt_ KPROCESSOR_MODE ObjectAttributesAccessMode,
_In_ POBJECT_TYPE ObjectType,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ KPROCESSOR_MODE AccessMode,
_Inout_opt_ PVOID ParseContext,
_In_ ULONG ObjectSize,
_In_opt_ ULONG PagedPoolCharge,
_In_opt_ ULONG NonPagedPoolCharge,
_Out_ PVOID *Object
);
NTKERNELAPI
NTSTATUS
NTAPI
ObCreateObjectType(
IN PUNICODE_STRING TypeName,
IN POBJECT_TYPE_INITIALIZER ObjectTypeInitializer,
IN PVOID Reserved,
OUT POBJECT_TYPE *ObjectType
_In_ PUNICODE_STRING TypeName,
_In_ POBJECT_TYPE_INITIALIZER ObjectTypeInitializer,
_In_ PVOID Reserved,
_Out_ POBJECT_TYPE *ObjectType
);
NTKERNELAPI
VOID
NTAPI
ObDereferenceSecurityDescriptor(
PSECURITY_DESCRIPTOR SecurityDescriptor,
ULONG Count
_Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ ULONG Count
);
NTKERNELAPI
ULONG
NTAPI
ObGetObjectPointerCount(
IN PVOID Object
_In_ PVOID Object
);
NTKERNELAPI
NTSTATUS
NTAPI
ObLogSecurityDescriptor(
IN PSECURITY_DESCRIPTOR InputSecurityDescriptor,
OUT PSECURITY_DESCRIPTOR *OutputSecurityDescriptor,
IN ULONG RefBias
_In_ PSECURITY_DESCRIPTOR InputSecurityDescriptor,
_Out_ PSECURITY_DESCRIPTOR *OutputSecurityDescriptor,
_In_ ULONG RefBias
);
NTKERNELAPI
NTSTATUS
NTAPI
ObOpenObjectByName(
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN POBJECT_TYPE ObjectType,
IN KPROCESSOR_MODE AccessMode,
IN PACCESS_STATE PassedAccessState,
IN ACCESS_MASK DesiredAccess,
IN OUT PVOID ParseContext,
OUT PHANDLE Handle
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ POBJECT_TYPE ObjectType,
_In_ KPROCESSOR_MODE AccessMode,
_In_ PACCESS_STATE PassedAccessState,
_In_ ACCESS_MASK DesiredAccess,
_Inout_ PVOID ParseContext,
_Out_ PHANDLE Handle
);
NTKERNELAPI
NTSTATUS
NTAPI
ObReferenceObjectByName(
IN PUNICODE_STRING ObjectName,
IN ULONG Attributes,
IN PACCESS_STATE PassedAccessState OPTIONAL,
IN ACCESS_MASK DesiredAccess OPTIONAL,
IN POBJECT_TYPE ObjectType,
IN KPROCESSOR_MODE AccessMode,
IN OUT PVOID ParseContext OPTIONAL,
OUT PVOID *Object
_In_ PUNICODE_STRING ObjectName,
_In_ ULONG Attributes,
_In_opt_ PACCESS_STATE PassedAccessState,
_In_opt_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_TYPE ObjectType,
_In_ KPROCESSOR_MODE AccessMode,
_Inout_opt_ PVOID ParseContext,
_Out_ PVOID *Object
);
NTKERNELAPI
VOID
NTAPI
ObReferenceSecurityDescriptor(
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
IN ULONG Count
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ ULONG Count
);
NTKERNELAPI
NTSTATUS
NTAPI
ObSetSecurityObjectByPointer(
IN PVOID Object,
IN SECURITY_INFORMATION SecurityInformation,
IN PSECURITY_DESCRIPTOR SecurityDescriptor
_In_ PVOID Object,
_In_ SECURITY_INFORMATION SecurityInformation,
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor
);
NTKERNELAPI
BOOLEAN
NTAPI
ObFindHandleForObject(
IN PEPROCESS Process,
IN PVOID Object,
IN POBJECT_TYPE ObjectType,
IN POBJECT_HANDLE_INFORMATION HandleInformation,
OUT PHANDLE Handle
_In_ PEPROCESS Process,
_In_ PVOID Object,
_In_ POBJECT_TYPE ObjectType,
_In_ POBJECT_HANDLE_INFORMATION HandleInformation,
_Out_ PHANDLE Handle
);
NTKERNELAPI
VOID
NTAPI
ObDereferenceObjectDeferDelete(
IN PVOID Object
_In_ PVOID Object
);
#endif
@ -169,392 +169,411 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtClose(
IN HANDLE Handle
_In_ HANDLE Handle
);
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCloseObjectAuditAlarm(
IN PUNICODE_STRING SubsystemName,
IN PVOID HandleId,
IN BOOLEAN GenerateOnClose
_In_ PUNICODE_STRING SubsystemName,
_In_opt_ PVOID HandleId,
_In_ BOOLEAN GenerateOnClose
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateDirectoryObject(
OUT PHANDLE DirectoryHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes
_Out_ PHANDLE DirectoryHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateSymbolicLinkObject(
OUT PHANDLE SymbolicLinkHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PUNICODE_STRING Name
_Out_ PHANDLE SymbolicLinkHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PUNICODE_STRING Name
);
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteObjectAuditAlarm(
IN PUNICODE_STRING SubsystemName,
IN PVOID HandleId,
IN BOOLEAN GenerateOnClose
_In_ PUNICODE_STRING SubsystemName,
_In_opt_ PVOID HandleId,
_In_ BOOLEAN GenerateOnClose
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDuplicateObject(
IN HANDLE SourceProcessHandle,
IN HANDLE SourceHandle,
IN HANDLE TargetProcessHandle,
OUT PHANDLE TargetHandle,
IN ACCESS_MASK DesiredAccess,
IN ULONG HandleAttributes,
IN ULONG Options
_In_ HANDLE SourceProcessHandle,
_In_ HANDLE SourceHandle,
_In_ HANDLE TargetProcessHandle,
_Out_ PHANDLE TargetHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ ULONG HandleAttributes,
_In_ ULONG Options
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtMakePermanentObject(
IN HANDLE Object
_In_ HANDLE Object
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtMakeTemporaryObject(
IN HANDLE Handle
_In_ HANDLE Handle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenDirectoryObject(
OUT PHANDLE FileHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes
_Out_ PHANDLE FileHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenJobObject(
PHANDLE JobHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes
_Out_ PHANDLE JobHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenSymbolicLinkObject(
OUT PHANDLE SymbolicLinkHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes
_Out_ PHANDLE SymbolicLinkHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryDirectoryObject(
IN HANDLE DirectoryHandle,
OUT PVOID Buffer,
IN ULONG BufferLength,
IN BOOLEAN ReturnSingleEntry,
IN BOOLEAN RestartScan,
IN OUT PULONG Context,
OUT PULONG ReturnLength OPTIONAL
_In_ HANDLE DirectoryHandle,
_Out_ PVOID Buffer,
_In_ ULONG BufferLength,
_In_ BOOLEAN ReturnSingleEntry,
_In_ BOOLEAN RestartScan,
_Inout_ PULONG Context,
_Out_opt_ PULONG ReturnLength
);
_IRQL_requires_max_(PASSIVE_LEVEL)
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryObject(
IN HANDLE ObjectHandle,
IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
OUT PVOID ObjectInformation,
IN ULONG Length,
OUT PULONG ResultLength OPTIONAL
_In_opt_ HANDLE Handle,
_In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
_Out_writes_bytes_opt_(ObjectInformationLength) PVOID ObjectInformation,
_In_ ULONG ObjectInformationLength,
_Out_opt_ PULONG ReturnLength
);
_IRQL_requires_max_(PASSIVE_LEVEL)
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySecurityObject(
IN HANDLE Handle,
IN SECURITY_INFORMATION SecurityInformation,
OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
IN ULONG Length,
OUT PULONG ResultLength
_In_ HANDLE Handle,
_In_ SECURITY_INFORMATION SecurityInformation,
_Out_writes_bytes_opt_(Length) PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ ULONG Length,
_Out_ PULONG LengthNeeded
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySymbolicLinkObject(
IN HANDLE SymLinkObjHandle,
OUT PUNICODE_STRING LinkTarget,
OUT PULONG DataWritten OPTIONAL
_In_ HANDLE SymLinkObjHandle,
_Out_ PUNICODE_STRING LinkTarget,
_Out_opt_ PULONG DataWritten
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationObject(
IN HANDLE ObjectHandle,
IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
IN PVOID ObjectInformation,
IN ULONG Length
_In_ HANDLE ObjectHandle,
_In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
_In_ PVOID ObjectInformation,
_In_ ULONG Length
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetSecurityObject(
IN HANDLE Handle,
IN SECURITY_INFORMATION SecurityInformation,
IN PSECURITY_DESCRIPTOR SecurityDescriptor
_In_ HANDLE Handle,
_In_ SECURITY_INFORMATION SecurityInformation,
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSignalAndWaitForSingleObject(
IN HANDLE SignalObject,
IN HANDLE WaitObject,
IN BOOLEAN Alertable,
IN PLARGE_INTEGER Time
_In_ HANDLE SignalObject,
_In_ HANDLE WaitObject,
_In_ BOOLEAN Alertable,
_In_ PLARGE_INTEGER Time
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitForMultipleObjects(
IN ULONG Count,
IN HANDLE Object[],
IN WAIT_TYPE WaitType,
IN BOOLEAN Alertable,
IN PLARGE_INTEGER Time
_In_ ULONG Count,
_In_ HANDLE Object[],
_In_ WAIT_TYPE WaitType,
_In_ BOOLEAN Alertable,
_In_ PLARGE_INTEGER Time
);
NTSTATUS
NTAPI
NtWaitForMultipleObjects32(
IN ULONG ObjectCount,
IN PLONG Handles,
IN WAIT_TYPE WaitType,
IN BOOLEAN Alertable,
IN PLARGE_INTEGER TimeOut OPTIONAL
_In_ ULONG ObjectCount,
_In_ PLONG Handles,
_In_ WAIT_TYPE WaitType,
_In_ BOOLEAN Alertable,
_In_opt_ PLARGE_INTEGER TimeOut
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitForSingleObject(
IN HANDLE Object,
IN BOOLEAN Alertable,
IN PLARGE_INTEGER Time
_In_ HANDLE Object,
_In_ BOOLEAN Alertable,
_In_ PLARGE_INTEGER Time
);
NTSYSAPI
NTSTATUS
NTAPI
ZwClose(
IN HANDLE Handle
_In_ HANDLE Handle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwCloseObjectAuditAlarm(
IN PUNICODE_STRING SubsystemName,
IN PVOID HandleId,
IN BOOLEAN GenerateOnClose
_In_ PUNICODE_STRING SubsystemName,
_In_ PVOID HandleId,
_In_ BOOLEAN GenerateOnClose
);
NTSYSAPI
NTSTATUS
NTAPI
ZwCreateDirectoryObject(
OUT PHANDLE DirectoryHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes
_Out_ PHANDLE DirectoryHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSAPI
NTSTATUS
NTAPI
ZwCreateSymbolicLinkObject(
OUT PHANDLE SymbolicLinkHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PUNICODE_STRING Name
_Out_ PHANDLE SymbolicLinkHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PUNICODE_STRING Name
);
NTSYSAPI
NTSTATUS
NTAPI
ZwDeleteObjectAuditAlarm(
IN PUNICODE_STRING SubsystemName,
IN PVOID HandleId,
IN BOOLEAN GenerateOnClose
_In_ PUNICODE_STRING SubsystemName,
_In_ PVOID HandleId,
_In_ BOOLEAN GenerateOnClose
);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwDuplicateObject(
IN HANDLE SourceProcessHandle,
IN HANDLE SourceHandle,
IN HANDLE TargetProcessHandle,
OUT PHANDLE TargetHandle,
IN ACCESS_MASK DesiredAccess,
IN ULONG HandleAttributes,
IN ULONG Options
_In_ HANDLE SourceProcessHandle,
_In_ HANDLE SourceHandle,
_In_opt_ HANDLE TargetProcessHandle,
_Out_opt_ PHANDLE TargetHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ ULONG HandleAttributes,
_In_ ULONG Options
);
NTSYSAPI
NTSTATUS
NTAPI
ZwMakePermanentObject(
IN HANDLE Object
_In_ HANDLE Object
);
NTSYSAPI
NTSTATUS
NTAPI
ZwMakeTemporaryObject(
IN HANDLE Handle
_In_ HANDLE Handle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenDirectoryObject(
OUT PHANDLE FileHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes
_Out_ PHANDLE FileHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenJobObject(
PHANDLE JobHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes
_Out_ PHANDLE JobHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenSymbolicLinkObject(
OUT PHANDLE SymbolicLinkHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes
_Out_ PHANDLE SymbolicLinkHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryDirectoryObject(
IN HANDLE DirectoryHandle,
OUT PVOID Buffer,
IN ULONG BufferLength,
IN BOOLEAN ReturnSingleEntry,
IN BOOLEAN RestartScan,
IN OUT PULONG Context,
OUT PULONG ReturnLength OPTIONAL
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryObject(
IN HANDLE ObjectHandle,
IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
OUT PVOID ObjectInformation,
IN ULONG Length,
OUT PULONG ResultLength OPTIONAL
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySecurityObject(
IN HANDLE Handle,
IN SECURITY_INFORMATION SecurityInformation,
OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
IN ULONG Length,
OUT PULONG ResultLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySymbolicLinkObject(
IN HANDLE SymLinkObjHandle,
OUT PUNICODE_STRING LinkTarget,
OUT PULONG DataWritten OPTIONAL
_In_ HANDLE DirectoryHandle,
_Out_ PVOID Buffer,
_In_ ULONG BufferLength,
_In_ BOOLEAN ReturnSingleEntry,
_In_ BOOLEAN RestartScan,
_Inout_ PULONG Context,
_Out_opt_ PULONG ReturnLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSetInformationObject(
IN HANDLE ObjectHandle,
IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
IN PVOID ObjectInformation,
IN ULONG Length
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSetSecurityObject(
IN HANDLE Handle,
IN SECURITY_INFORMATION SecurityInformation,
IN PSECURITY_DESCRIPTOR SecurityDescriptor
_In_ HANDLE ObjectHandle,
_In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
_In_ PVOID ObjectInformation,
_In_ ULONG Length
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSignalAndWaitForSingleObject(
IN HANDLE SignalObject,
IN HANDLE WaitObject,
IN BOOLEAN Alertable,
IN PLARGE_INTEGER Time
_In_ HANDLE SignalObject,
_In_ HANDLE WaitObject,
_In_ BOOLEAN Alertable,
_In_ PLARGE_INTEGER Time
);
NTSYSAPI
NTSTATUS
NTAPI
ZwWaitForMultipleObjects(
IN ULONG Count,
IN HANDLE Object[],
IN WAIT_TYPE WaitType,
IN BOOLEAN Alertable,
IN PLARGE_INTEGER Time
_In_ ULONG Count,
_In_ HANDLE Object[],
_In_ WAIT_TYPE WaitType,
_In_ BOOLEAN Alertable,
_In_ PLARGE_INTEGER Time
);
#ifdef NTOS_MODE_USER
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryObject(
_In_opt_ HANDLE Handle,
_In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
_Out_writes_bytes_opt_(ObjectInformationLength) PVOID ObjectInformation,
_In_ ULONG ObjectInformationLength,
_Out_opt_ PULONG ReturnLength
);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySecurityObject(
_In_ HANDLE Handle,
_In_ SECURITY_INFORMATION SecurityInformation,
_Out_writes_bytes_to_(Length,*LengthNeeded) PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ ULONG Length,
_Out_ PULONG LengthNeeded
);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySymbolicLinkObject(
_In_ HANDLE LinkHandle,
_Inout_ PUNICODE_STRING LinkTarget,
_Out_opt_ PULONG ReturnedLength
);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwSetSecurityObject(
_In_ HANDLE Handle,
_In_ SECURITY_INFORMATION SecurityInformation,
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor
);
_When_(Timeout == NULL, _IRQL_requires_max_(APC_LEVEL))
_When_(Timeout->QuadPart != 0, _IRQL_requires_max_(APC_LEVEL))
_When_(Timeout->QuadPart == 0, _IRQL_requires_max_(DISPATCH_LEVEL))
NTSYSAPI
NTSTATUS
NTAPI
ZwWaitForSingleObject(
IN HANDLE Object,
IN BOOLEAN Alertable,
IN PLARGE_INTEGER Time
_In_ HANDLE Handle,
_In_ BOOLEAN Alertable,
_In_opt_ PLARGE_INTEGER Timeout
);
#endif /* NTOS_MODE_USER */
#endif

View file

@ -173,75 +173,75 @@ typedef struct _OB_DUMP_CONTROL
//
typedef VOID
(NTAPI *OB_DUMP_METHOD)(
IN PVOID Object,
IN POB_DUMP_CONTROL Control OPTIONAL
_In_ PVOID Object,
_In_opt_ POB_DUMP_CONTROL Control
);
typedef NTSTATUS
(NTAPI *OB_OPEN_METHOD)(
IN OB_OPEN_REASON Reason,
IN PEPROCESS Process OPTIONAL,
IN PVOID ObjectBody,
IN ACCESS_MASK GrantedAccess,
IN ULONG HandleCount
_In_ OB_OPEN_REASON Reason,
_In_opt_ PEPROCESS Process,
_In_ PVOID ObjectBody,
_In_ ACCESS_MASK GrantedAccess,
_In_ ULONG HandleCount
);
typedef VOID
(NTAPI *OB_CLOSE_METHOD)(
IN PEPROCESS Process OPTIONAL,
IN PVOID Object,
IN ACCESS_MASK GrantedAccess,
IN ULONG ProcessHandleCount,
IN ULONG SystemHandleCount
_In_opt_ PEPROCESS Process,
_In_ PVOID Object,
_In_ ACCESS_MASK GrantedAccess,
_In_ ULONG ProcessHandleCount,
_In_ ULONG SystemHandleCount
);
typedef VOID
(NTAPI *OB_DELETE_METHOD)(
IN PVOID Object
_In_ PVOID Object
);
typedef NTSTATUS
(NTAPI *OB_PARSE_METHOD)(
IN PVOID ParseObject,
IN PVOID ObjectType,
IN OUT PACCESS_STATE AccessState,
IN KPROCESSOR_MODE AccessMode,
IN ULONG Attributes,
IN OUT PUNICODE_STRING CompleteName,
IN OUT PUNICODE_STRING RemainingName,
IN OUT PVOID Context OPTIONAL,
IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL,
OUT PVOID *Object
_In_ PVOID ParseObject,
_In_ PVOID ObjectType,
_Inout_ PACCESS_STATE AccessState,
_In_ KPROCESSOR_MODE AccessMode,
_In_ ULONG Attributes,
_Inout_ PUNICODE_STRING CompleteName,
_Inout_ PUNICODE_STRING RemainingName,
_Inout_opt_ PVOID Context,
_In_opt_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,
_Out_ PVOID *Object
);
typedef NTSTATUS
(NTAPI *OB_SECURITY_METHOD)(
IN PVOID Object,
IN SECURITY_OPERATION_CODE OperationType,
IN PSECURITY_INFORMATION SecurityInformation,
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
IN OUT PULONG CapturedLength,
IN OUT PSECURITY_DESCRIPTOR *ObjectSecurityDescriptor,
IN POOL_TYPE PoolType,
IN PGENERIC_MAPPING GenericMapping
_In_ PVOID Object,
_In_ SECURITY_OPERATION_CODE OperationType,
_In_ PSECURITY_INFORMATION SecurityInformation,
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_Inout_ PULONG CapturedLength,
_Inout_ PSECURITY_DESCRIPTOR *ObjectSecurityDescriptor,
_In_ POOL_TYPE PoolType,
_In_ PGENERIC_MAPPING GenericMapping
);
typedef NTSTATUS
(NTAPI *OB_QUERYNAME_METHOD)(
IN PVOID Object,
IN BOOLEAN HasObjectName,
OUT POBJECT_NAME_INFORMATION ObjectNameInfo,
IN ULONG Length,
OUT PULONG ReturnLength,
IN KPROCESSOR_MODE AccessMode
_In_ PVOID Object,
_In_ BOOLEAN HasObjectName,
_Out_ POBJECT_NAME_INFORMATION ObjectNameInfo,
_In_ ULONG Length,
_Out_ PULONG ReturnLength,
_In_ KPROCESSOR_MODE AccessMode
);
typedef BOOLEAN
(NTAPI *OB_OKAYTOCLOSE_METHOD)(
IN PEPROCESS Process OPTIONAL,
IN PVOID Object,
IN HANDLE Handle,
IN KPROCESSOR_MODE AccessMode
_In_opt_ PEPROCESS Process,
_In_ PVOID Object,
_In_ HANDLE Handle,
_In_ KPROCESSOR_MODE AccessMode
);
#else

View file

@ -32,45 +32,45 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtInitiatePowerAction(
POWER_ACTION SystemAction,
SYSTEM_POWER_STATE MinSystemState,
ULONG Flags,
BOOLEAN Asynchronous
_In_ POWER_ACTION SystemAction,
_In_ SYSTEM_POWER_STATE MinSystemState,
_In_ ULONG Flags,
_In_ BOOLEAN Asynchronous
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtPowerInformation(
POWER_INFORMATION_LEVEL PowerInformationLevel,
PVOID InputBuffer,
ULONG InputBufferLength,
PVOID OutputBuffer,
ULONG OutputBufferLength
_In_ POWER_INFORMATION_LEVEL PowerInformationLevel,
_In_bytecount_(InputBufferLength) PVOID InputBuffer,
_In_ ULONG InputBufferLength,
_Out_bytecap_(OutputBufferLength) PVOID OutputBuffer,
_In_ ULONG OutputBufferLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetSystemPowerState(
IN POWER_ACTION SystemAction,
IN SYSTEM_POWER_STATE MinSystemState,
IN ULONG Flags
_In_ POWER_ACTION SystemAction,
_In_ SYSTEM_POWER_STATE MinSystemState,
_In_ ULONG Flags
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtGetDevicePowerState(
IN HANDLE Device,
IN PDEVICE_POWER_STATE PowerState
_In_ HANDLE Device,
_In_ PDEVICE_POWER_STATE PowerState
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtRequestWakeupLatency(
IN LATENCY_TIME latency
_In_ LATENCY_TIME latency
);
NTSYSCALLAPI
@ -82,61 +82,63 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetThreadExecutionState(
IN EXECUTION_STATE esFlags,
OUT EXECUTION_STATE *PreviousFlags
_In_ EXECUTION_STATE esFlags,
_Out_ EXECUTION_STATE *PreviousFlags
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtInitiatePowerAction(
IN POWER_ACTION SystemAction,
IN SYSTEM_POWER_STATE MinSystemState,
IN ULONG Flags,
IN BOOLEAN Asynchronous
_In_ POWER_ACTION SystemAction,
_In_ SYSTEM_POWER_STATE MinSystemState,
_In_ ULONG Flags,
_In_ BOOLEAN Asynchronous
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtRequestDeviceWakeup(
IN HANDLE Device
_In_ HANDLE Device
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCancelDeviceWakeupRequest(
IN HANDLE Device
_In_ HANDLE Device
);
#endif
NTSYSCALLAPI
NTSYSAPI
NTSTATUS
NTAPI
ZwInitiatePowerAction(
IN POWER_ACTION SystemAction,
IN SYSTEM_POWER_STATE MinSystemState,
IN ULONG Flags,
IN BOOLEAN Asynchronous
_In_ POWER_ACTION SystemAction,
_In_ SYSTEM_POWER_STATE MinSystemState,
_In_ ULONG Flags,
_In_ BOOLEAN Asynchronous
);
NTSYSCALLAPI
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwPowerInformation(
IN POWER_INFORMATION_LEVEL PowerInformationLevel,
IN PVOID InputBuffer OPTIONAL,
IN ULONG InputBufferLength,
OUT PVOID OutputBuffer OPTIONAL,
IN ULONG OutputBufferLength
_In_ POWER_INFORMATION_LEVEL InformationLevel,
_In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
_In_ ULONG InputBufferLength,
_Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
_In_ ULONG OutputBufferLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwSetSystemPowerState(
IN POWER_ACTION SystemAction,
IN SYSTEM_POWER_STATE MinSystemState,
IN ULONG Flags
_In_ POWER_ACTION SystemAction,
_In_ SYSTEM_POWER_STATE MinSystemState,
_In_ ULONG Flags
);
#endif

View file

@ -52,22 +52,22 @@ NTKERNELAPI
PVOID
NTAPI
PsGetProcessWin32Process(
PEPROCESS Process
_In_ PEPROCESS Process
);
NTKERNELAPI
VOID
NTAPI
PsSetProcessWin32Process(
PEPROCESS Process,
PVOID Win32Process
_Inout_ PEPROCESS Process,
_In_ PVOID Win32Process
);
NTKERNELAPI
VOID
NTAPI
PsSetThreadWin32Thread(
PETHREAD Thread,
_Inout_ PETHREAD Thread,
PVOID Win32Thread
);
@ -75,66 +75,66 @@ NTKERNELAPI
PVOID
NTAPI
PsGetThreadWin32Thread(
PETHREAD Thread
_In_ PETHREAD Thread
);
NTKERNELAPI
PVOID
NTAPI
PsGetProcessWin32WindowStation(
PEPROCESS Process
_In_ PEPROCESS Process
);
NTKERNELAPI
VOID
NTAPI
PsSetProcessWindowStation(
PEPROCESS Process,
PVOID WindowStation
_Inout_ PEPROCESS Process,
_In_ PVOID WindowStation
);
NTKERNELAPI
PTEB
NTAPI
PsGetThreadTeb(
IN PETHREAD Thread
_In_ PETHREAD Thread
);
NTKERNELAPI
HANDLE
NTAPI
PsGetThreadId(
IN PETHREAD Thread
_In_ PETHREAD Thread
);
NTKERNELAPI
BOOLEAN
NTAPI
PsGetThreadHardErrorsAreDisabled(
PETHREAD Thread
_In_ PETHREAD Thread
);
NTKERNELAPI
VOID
NTAPI
PsSetThreadHardErrorsAreDisabled(
PETHREAD Thread,
IN BOOLEAN Disabled
_Inout_ PETHREAD Thread,
_In_ BOOLEAN Disabled
);
NTKERNELAPI
VOID
NTAPI
PsEstablishWin32Callouts(
PWIN32_CALLOUTS_FPNS CalloutData
_In_ PWIN32_CALLOUTS_FPNS CalloutData
);
NTKERNELAPI
VOID
NTAPI
PsReturnProcessNonPagedPoolQuota(
IN PEPROCESS Process,
IN SIZE_T Amount
_In_ PEPROCESS Process,
_In_ SIZE_T Amount
);
NTKERNELAPI
@ -151,7 +151,7 @@ NTKERNELAPI
VOID
NTAPI
PsRevertThreadToSelf(
IN PETHREAD Thread
_Inout_ PETHREAD Thread
);
//
@ -161,55 +161,55 @@ NTKERNELAPI
NTSTATUS
NTAPI
PsLookupProcessThreadByCid(
IN PCLIENT_ID Cid,
OUT PEPROCESS *Process OPTIONAL,
OUT PETHREAD *Thread
_In_ PCLIENT_ID Cid,
_Out_opt_ PEPROCESS *Process,
_Out_ PETHREAD *Thread
);
BOOLEAN
NTAPI
PsIsProtectedProcess(
IN PEPROCESS Process
_In_ PEPROCESS Process
);
NTKERNELAPI
BOOLEAN
NTAPI
PsIsSystemProcess(
IN PEPROCESS Process
_In_ PEPROCESS Process
);
VOID
NTAPI
PsSetProcessPriorityByClass(
IN PEPROCESS Process,
IN PSPROCESSPRIORITYMODE Type
_In_ PEPROCESS Process,
_In_ PSPROCESSPRIORITYMODE Type
);
HANDLE
NTAPI
PsGetProcessInheritedFromUniqueProcessId(
IN PEPROCESS Process
_In_ PEPROCESS Process
);
NTKERNELAPI
NTSTATUS
NTAPI
PsGetProcessExitStatus(
PEPROCESS Process
_In_ PEPROCESS Process
);
HANDLE
NTAPI
PsGetProcessSessionId(
IN PEPROCESS Process
_In_ PEPROCESS Process
);
NTKERNELAPI
BOOLEAN
NTAPI
PsGetProcessExitProcessCalled(
PEPROCESS Process
_In_ PEPROCESS Process
);
//
@ -219,59 +219,59 @@ NTKERNELAPI
VOID
NTAPI
PsChargePoolQuota(
IN PEPROCESS Process,
IN POOL_TYPE PoolType,
IN SIZE_T Amount
_In_ PEPROCESS Process,
_In_ POOL_TYPE PoolType,
_In_ SIZE_T Amount
);
NTKERNELAPI
NTSTATUS
NTAPI
PsChargeProcessNonPagedPoolQuota(
IN PEPROCESS Process,
IN SIZE_T Amount
_In_ PEPROCESS Process,
_In_ SIZE_T Amount
);
NTKERNELAPI
NTSTATUS
NTAPI
PsChargeProcessPagedPoolQuota(
IN PEPROCESS Process,
IN SIZE_T Amount
_In_ PEPROCESS Process,
_In_ SIZE_T Amount
);
NTKERNELAPI
NTSTATUS
NTAPI
PsChargeProcessPoolQuota(
IN PEPROCESS Process,
IN POOL_TYPE PoolType,
IN SIZE_T Amount
_In_ PEPROCESS Process,
_In_ POOL_TYPE PoolType,
_In_ SIZE_T Amount
);
NTKERNELAPI
VOID
NTAPI
PsReturnPoolQuota(
IN PEPROCESS Process,
IN POOL_TYPE PoolType,
IN SIZE_T Amount
_In_ PEPROCESS Process,
_In_ POOL_TYPE PoolType,
_In_ SIZE_T Amount
);
NTKERNELAPI
VOID
NTAPI
PsReturnProcessNonPagedPoolQuota(
IN PEPROCESS Process,
IN SIZE_T Amount
_In_ PEPROCESS Process,
_In_ SIZE_T Amount
);
NTKERNELAPI
VOID
NTAPI
PsReturnProcessPagedPoolQuota(
IN PEPROCESS Process,
IN SIZE_T Amount
_In_ PEPROCESS Process,
_In_ SIZE_T Amount
);
#endif
@ -283,8 +283,8 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtAlertResumeThread(
IN HANDLE ThreadHandle,
OUT PULONG SuspendCount
_In_ HANDLE ThreadHandle,
_Out_ PULONG SuspendCount
);
typedef ULONG APPHELPCACHESERVICECLASS;
@ -292,83 +292,83 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtApphelpCacheControl(
IN APPHELPCACHESERVICECLASS Service,
IN PVOID ServiceData
_In_ APPHELPCACHESERVICECLASS Service,
_In_ PVOID ServiceData
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAlertThread(
IN HANDLE ThreadHandle
_In_ HANDLE ThreadHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAssignProcessToJobObject(
HANDLE JobHandle,
HANDLE ProcessHandle
_In_ HANDLE JobHandle,
_In_ HANDLE ProcessHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateJobObject(
PHANDLE JobHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes
_Out_ PHANDLE JobHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
NTSTATUS
NTAPI
NtCreateJobSet(
IN ULONG NumJob,
IN PJOB_SET_ARRAY UserJobSet,
IN ULONG Flags
_In_ ULONG NumJob,
_In_ PJOB_SET_ARRAY UserJobSet,
_In_ ULONG Flags
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateProcess(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ParentProcess,
IN BOOLEAN InheritObjectTable,
IN HANDLE SectionHandle OPTIONAL,
IN HANDLE DebugPort OPTIONAL,
IN HANDLE ExceptionPort OPTIONAL
_Out_ PHANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ HANDLE ParentProcess,
_In_ BOOLEAN InheritObjectTable,
_In_opt_ HANDLE SectionHandle,
_In_opt_ HANDLE DebugPort,
_In_opt_ HANDLE ExceptionPort
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateProcessEx(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ParentProcess,
IN ULONG Flags,
IN HANDLE SectionHandle OPTIONAL,
IN HANDLE DebugPort OPTIONAL,
IN HANDLE ExceptionPort OPTIONAL,
IN BOOLEAN InJob
_Out_ PHANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ HANDLE ParentProcess,
_In_ ULONG Flags,
_In_opt_ HANDLE SectionHandle,
_In_opt_ HANDLE DebugPort,
_In_opt_ HANDLE ExceptionPort,
_In_ BOOLEAN InJob
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateThread(
OUT PHANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ProcessHandle,
OUT PCLIENT_ID ClientId,
IN PCONTEXT ThreadContext,
IN PINITIAL_TEB UserStack,
IN BOOLEAN CreateSuspended
_Out_ PHANDLE ThreadHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ HANDLE ProcessHandle,
_Out_ PCLIENT_ID ClientId,
_In_ PCONTEXT ThreadContext,
_In_ PINITIAL_TEB UserStack,
_In_ BOOLEAN CreateSuspended
);
#ifndef _M_ARM
@ -390,69 +390,81 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtImpersonateThread(
IN HANDLE ThreadHandle,
IN HANDLE ThreadToImpersonate,
IN PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService
_In_ HANDLE ThreadHandle,
_In_ HANDLE ThreadToImpersonate,
_In_ PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtIsProcessInJob(
IN HANDLE ProcessHandle,
IN HANDLE JobHandle OPTIONAL
_In_ HANDLE ProcessHandle,
_In_opt_ HANDLE JobHandle
);
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenProcess(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId
_Out_ PHANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PCLIENT_ID ClientId
);
_Must_inspect_result_
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenProcessToken(
_In_ HANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_Out_ PHANDLE TokenHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenThread(
OUT PHANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId
_Out_ PHANDLE ThreadHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PCLIENT_ID ClientId
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenThreadToken(
IN HANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN BOOLEAN OpenAsSelf,
OUT PHANDLE TokenHandle
_In_ HANDLE ThreadHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ BOOLEAN OpenAsSelf,
_Out_ PHANDLE TokenHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenThreadTokenEx(
IN HANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN BOOLEAN OpenAsSelf,
IN ULONG HandleAttributes,
OUT PHANDLE TokenHandle
_In_ HANDLE ThreadHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ BOOLEAN OpenAsSelf,
_In_ ULONG HandleAttributes,
_Out_ PHANDLE TokenHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationJobObject(
HANDLE JobHandle,
JOBOBJECTINFOCLASS JobInformationClass,
PVOID JobInformation,
ULONG JobInformationLength,
PULONG ReturnLength
_In_ HANDLE JobHandle,
_In_ JOBOBJECTINFOCLASS JobInformationClass,
_Out_bytecap_(JobInformationLength) PVOID JobInformation,
_In_ ULONG JobInformationLength,
_Out_ PULONG ReturnLength
);
#ifndef _NTDDK_
@ -460,11 +472,11 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationProcess(
IN HANDLE ProcessHandle,
IN PROCESSINFOCLASS ProcessInformationClass,
OUT PVOID ProcessInformation,
IN ULONG ProcessInformationLength,
OUT PULONG ReturnLength OPTIONAL
_In_ HANDLE ProcessHandle,
_In_ PROCESSINFOCLASS ProcessInformationClass,
_Out_ PVOID ProcessInformation,
_In_ ULONG ProcessInformationLength,
_Out_opt_ PULONG ReturnLength OPTIONAL
);
#endif
@ -472,231 +484,233 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationThread(
IN HANDLE ThreadHandle,
IN THREADINFOCLASS ThreadInformationClass,
OUT PVOID ThreadInformation,
IN ULONG ThreadInformationLength,
OUT PULONG ReturnLength
_In_ HANDLE ThreadHandle,
_In_ THREADINFOCLASS ThreadInformationClass,
_Out_ PVOID ThreadInformation,
_In_ ULONG ThreadInformationLength,
_Out_ PULONG ReturnLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtRegisterThreadTerminatePort(
HANDLE TerminationPort
_In_ HANDLE TerminationPort
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtResumeThread(
IN HANDLE ThreadHandle,
OUT PULONG SuspendCount
_In_ HANDLE ThreadHandle,
_Out_ PULONG SuspendCount
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtResumeProcess(
IN HANDLE ProcessHandle
_In_ HANDLE ProcessHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationJobObject(
HANDLE JobHandle,
JOBOBJECTINFOCLASS JobInformationClass,
PVOID JobInformation,
ULONG JobInformationLength
_In_ HANDLE JobHandle,
_In_ JOBOBJECTINFOCLASS JobInformationClass,
_In_bytecount_(JobInformationLength) PVOID JobInformation,
_In_ ULONG JobInformationLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationProcess(
IN HANDLE ProcessHandle,
IN PROCESSINFOCLASS ProcessInformationClass,
IN PVOID ProcessInformation,
IN ULONG ProcessInformationLength
_In_ HANDLE ProcessHandle,
_In_ PROCESSINFOCLASS ProcessInformationClass,
_In_ PVOID ProcessInformation,
_In_ ULONG ProcessInformationLength
);
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationThread(
IN HANDLE ThreadHandle,
IN THREADINFOCLASS ThreadInformationClass,
IN PVOID ThreadInformation,
IN ULONG ThreadInformationLength
_In_ HANDLE ThreadHandle,
_In_ THREADINFOCLASS ThreadInformationClass,
_In_reads_bytes_(ThreadInformationLength) PVOID ThreadInformation,
_In_ ULONG ThreadInformationLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSuspendProcess(
IN HANDLE ProcessHandle
_In_ HANDLE ProcessHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSuspendThread(
IN HANDLE ThreadHandle,
IN PULONG PreviousSuspendCount
_In_ HANDLE ThreadHandle,
_In_ PULONG PreviousSuspendCount
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtTerminateProcess(
IN HANDLE ProcessHandle,
IN NTSTATUS ExitStatus
_In_ HANDLE ProcessHandle,
_In_ NTSTATUS ExitStatus
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtTerminateThread(
IN HANDLE ThreadHandle,
IN NTSTATUS ExitStatus
_In_ HANDLE ThreadHandle,
_In_ NTSTATUS ExitStatus
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtTerminateJobObject(
HANDLE JobHandle,
NTSTATUS ExitStatus
_In_ HANDLE JobHandle,
_In_ NTSTATUS ExitStatus
);
NTSYSAPI
NTSTATUS
NTAPI
ZwAlertResumeThread(
IN HANDLE ThreadHandle,
OUT PULONG SuspendCount
_In_ HANDLE ThreadHandle,
_Out_ PULONG SuspendCount
);
NTSYSAPI
NTSTATUS
NTAPI
ZwAlertThread(
IN HANDLE ThreadHandle
_In_ HANDLE ThreadHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwAssignProcessToJobObject(
HANDLE JobHandle,
HANDLE ProcessHandle
_In_ HANDLE JobHandle,
_In_ HANDLE ProcessHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwCreateJobObject(
PHANDLE JobHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes
_Out_ PHANDLE JobHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes
);
NTSYSAPI
NTSTATUS
NTAPI
ZwCreateProcess(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ParentProcess,
IN BOOLEAN InheritObjectTable,
IN HANDLE SectionHandle OPTIONAL,
IN HANDLE DebugPort OPTIONAL,
IN HANDLE ExceptionPort OPTIONAL
_Out_ PHANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ HANDLE ParentProcess,
_In_ BOOLEAN InheritObjectTable,
_In_opt_ HANDLE SectionHandle,
_In_opt_ HANDLE DebugPort,
_In_opt_ HANDLE ExceptionPort
);
NTSYSAPI
NTSTATUS
NTAPI
ZwCreateThread(
OUT PHANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ProcessHandle,
OUT PCLIENT_ID ClientId,
IN PCONTEXT ThreadContext,
IN PINITIAL_TEB UserStack,
IN BOOLEAN CreateSuspended
_Out_ PHANDLE ThreadHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ HANDLE ProcessHandle,
_Out_ PCLIENT_ID ClientId,
_In_ PCONTEXT ThreadContext,
_In_ PINITIAL_TEB UserStack,
_In_ BOOLEAN CreateSuspended
);
NTSYSAPI
NTSTATUS
NTAPI
ZwImpersonateThread(
IN HANDLE ThreadHandle,
IN HANDLE ThreadToImpersonate,
IN PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService
_In_ HANDLE ThreadHandle,
_In_ HANDLE ThreadToImpersonate,
_In_ PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService
);
NTSYSAPI
NTSTATUS
NTAPI
ZwIsProcessInJob(
IN HANDLE ProcessHandle,
IN HANDLE JobHandle OPTIONAL
_In_ HANDLE ProcessHandle,
_In_opt_ HANDLE JobHandle
);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenProcess(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId
ZwOpenProcessTokenEx(
_In_ HANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ ULONG HandleAttributes,
_Out_ PHANDLE TokenHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenThread(
OUT PHANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId
_Out_ PHANDLE ThreadHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ PCLIENT_ID ClientId
);
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenThreadToken(
IN HANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN BOOLEAN OpenAsSelf,
OUT PHANDLE TokenHandle
_In_ HANDLE ThreadHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ BOOLEAN OpenAsSelf,
_Out_ PHANDLE TokenHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenThreadTokenEx(
IN HANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN BOOLEAN OpenAsSelf,
IN ULONG HandleAttributes,
OUT PHANDLE TokenHandle
_In_ HANDLE ThreadHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ BOOLEAN OpenAsSelf,
_In_ ULONG HandleAttributes,
_Out_ PHANDLE TokenHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryInformationJobObject(
HANDLE JobHandle,
JOBOBJECTINFOCLASS JobInformationClass,
PVOID JobInformation,
ULONG JobInformationLength,
PULONG ReturnLength
_In_ HANDLE JobHandle,
_In_ JOBOBJECTINFOCLASS JobInformationClass,
_Out_bytecap_(JobInformationLength) PVOID JobInformation,
_In_ ULONG JobInformationLength,
_Out_ PULONG ReturnLength
);
#ifndef _NTDDK_
@ -704,11 +718,11 @@ NTSYSAPI
NTSTATUS
NTAPI
ZwQueryInformationProcess(
IN HANDLE ProcessHandle,
IN PROCESSINFOCLASS ProcessInformationClass,
OUT PVOID ProcessInformation,
IN ULONG ProcessInformationLength,
OUT PULONG ReturnLength OPTIONAL
_In_ HANDLE ProcessHandle,
_In_ PROCESSINFOCLASS ProcessInformationClass,
_Out_ PVOID ProcessInformation,
_In_ ULONG ProcessInformationLength,
_Out_opt_ PULONG ReturnLength
);
#endif
@ -716,102 +730,104 @@ NTSYSAPI
NTSTATUS
NTAPI
ZwQueryInformationThread(
IN HANDLE ThreadHandle,
IN THREADINFOCLASS ThreadInformationClass,
OUT PVOID ThreadInformation,
IN ULONG ThreadInformationLength,
OUT PULONG ReturnLength
_In_ HANDLE ThreadHandle,
_In_ THREADINFOCLASS ThreadInformationClass,
_Out_ PVOID ThreadInformation,
_In_ ULONG ThreadInformationLength,
_Out_ PULONG ReturnLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwRegisterThreadTerminatePort(
HANDLE TerminationPort
_In_ HANDLE TerminationPort
);
NTSYSAPI
NTSTATUS
NTAPI
ZwResumeThread(
IN HANDLE ThreadHandle,
OUT PULONG SuspendCount
_In_ HANDLE ThreadHandle,
_Out_ PULONG SuspendCount
);
NTSYSAPI
NTSTATUS
NTAPI
ZwResumeProcess(
IN HANDLE ProcessHandle
_In_ HANDLE ProcessHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSetInformationJobObject(
HANDLE JobHandle,
JOBOBJECTINFOCLASS JobInformationClass,
PVOID JobInformation,
ULONG JobInformationLength
_In_ HANDLE JobHandle,
_In_ JOBOBJECTINFOCLASS JobInformationClass,
_In_ PVOID JobInformation,
_In_ ULONG JobInformationLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSetInformationProcess(
IN HANDLE ProcessHandle,
IN PROCESSINFOCLASS ProcessInformationClass,
IN PVOID ProcessInformation,
IN ULONG ProcessInformationLength
_In_ HANDLE ProcessHandle,
_In_ PROCESSINFOCLASS ProcessInformationClass,
_In_ PVOID ProcessInformation,
_In_ ULONG ProcessInformationLength
);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwSetInformationThread(
IN HANDLE ThreadHandle,
IN THREADINFOCLASS ThreadInformationClass,
IN PVOID ThreadInformation,
IN ULONG ThreadInformationLength
_In_ HANDLE ThreadHandle,
_In_ THREADINFOCLASS ThreadInformationClass,
_In_reads_bytes_(ThreadInformationLength) PVOID ThreadInformation,
_In_ ULONG ThreadInformationLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSuspendProcess(
IN HANDLE ProcessHandle
_In_ HANDLE ProcessHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSuspendThread(
IN HANDLE ThreadHandle,
IN PULONG PreviousSuspendCount
_In_ HANDLE ThreadHandle,
_In_ PULONG PreviousSuspendCount
);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwTerminateProcess(
IN HANDLE ProcessHandle,
IN NTSTATUS ExitStatus
);
ZwTerminateProcess (
_In_opt_ HANDLE ProcessHandle,
_In_ NTSTATUS ExitStatus
);
NTSYSAPI
NTSTATUS
NTAPI
ZwTerminateThread(
IN HANDLE ThreadHandle,
IN NTSTATUS ExitStatus
_In_ HANDLE ThreadHandle,
_In_ NTSTATUS ExitStatus
);
NTSYSAPI
NTSTATUS
NTAPI
ZwTerminateJobObject(
HANDLE JobHandle,
NTSTATUS ExitStatus
_In_ HANDLE JobHandle,
_In_ NTSTATUS ExitStatus
);
#ifdef __cplusplus

View file

@ -501,15 +501,15 @@ struct _WIN32_PARSEMETHOD_PARAMETERS;
typedef
NTSTATUS
(NTAPI *PKWIN32_PROCESS_CALLOUT)(
struct _EPROCESS *Process,
BOOLEAN Create
_In_ struct _EPROCESS *Process,
_In_ BOOLEAN Create
);
typedef
NTSTATUS
(NTAPI *PKWIN32_THREAD_CALLOUT)(
struct _ETHREAD *Thread,
PSW32THREADCALLOUTTYPE Type
_In_ struct _ETHREAD *Thread,
_In_ PSW32THREADCALLOUTTYPE Type
);
typedef
@ -521,19 +521,19 @@ NTSTATUS
typedef
NTSTATUS
(NTAPI *PKWIN32_POWEREVENT_CALLOUT)(
struct _WIN32_POWEREVENT_PARAMETERS *Parameters
_In_ struct _WIN32_POWEREVENT_PARAMETERS *Parameters
);
typedef
NTSTATUS
(NTAPI *PKWIN32_POWERSTATE_CALLOUT)(
struct _WIN32_POWERSTATE_PARAMETERS *Parameters
_In_ struct _WIN32_POWERSTATE_PARAMETERS *Parameters
);
typedef
NTSTATUS
(NTAPI *PKWIN32_JOB_CALLOUT)(
struct _WIN32_JOBCALLOUT_PARAMETERS *Parameters
_In_ struct _WIN32_JOBCALLOUT_PARAMETERS *Parameters
);
typedef
@ -545,39 +545,39 @@ NTSTATUS
typedef
NTSTATUS
(NTAPI *PKWIN32_OPENMETHOD_CALLOUT)(
struct _WIN32_OPENMETHOD_PARAMETERS *Parameters
_In_ struct _WIN32_OPENMETHOD_PARAMETERS *Parameters
);
typedef
NTSTATUS
(NTAPI *PKWIN32_OKTOCLOSEMETHOD_CALLOUT)(
struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS *Parameters
_In_ struct _WIN32_OKAYTOCLOSEMETHOD_PARAMETERS *Parameters
);
typedef
NTSTATUS
(NTAPI *PKWIN32_CLOSEMETHOD_CALLOUT)(
struct _WIN32_CLOSEMETHOD_PARAMETERS *Parameters
_In_ struct _WIN32_CLOSEMETHOD_PARAMETERS *Parameters
);
typedef
VOID
(NTAPI *PKWIN32_DELETEMETHOD_CALLOUT)(
struct _WIN32_DELETEMETHOD_PARAMETERS *Parameters
_In_ struct _WIN32_DELETEMETHOD_PARAMETERS *Parameters
);
typedef
NTSTATUS
(NTAPI *PKWIN32_PARSEMETHOD_CALLOUT)(
struct _WIN32_PARSEMETHOD_PARAMETERS *Parameters
_In_ struct _WIN32_PARSEMETHOD_PARAMETERS *Parameters
);
typedef
NTSTATUS
(NTAPI *PKWIN32_WIN32DATACOLLECTION_CALLOUT)(
struct _EPROCESS *Process,
PVOID Callback,
PVOID Context
_In_ struct _EPROCESS *Process,
_In_ PVOID Callback,
_In_ PVOID Context
);
//
@ -586,7 +586,7 @@ NTSTATUS
typedef
VOID
(NTAPI *PLEGO_NOTIFY_ROUTINE)(
IN PKTHREAD Thread
_In_ PKTHREAD Thread
);
#endif
@ -1392,7 +1392,7 @@ typedef struct _WIN32_PARSEMETHOD_PARAMETERS
PACCESS_STATE AccessState;
KPROCESSOR_MODE AccessMode;
ULONG Attributes;
OUT PUNICODE_STRING CompleteName;
_Out_ PUNICODE_STRING CompleteName;
PUNICODE_STRING RemainingName;
PVOID Context;
PSECURITY_QUALITY_OF_SERVICE SecurityQos;

View file

@ -42,7 +42,7 @@ software.
You MUST read GPL.TXT or LGPL.TXT after your decision. Violating your chosen license
voids your usage rights of the NDK and will lead to legal action on the part of the
author. Using this software with any later version of the GNU GPL or LGPL in no way
changes your obligations under the versions listed above. You MUST still release the
changes your obligations under the versions listed above. You MUST still release the
NDK and its changes under the terms of the original licenses (either GPLv2 or LGPLv2.1)
as listed above. This DOES NOT AFFECT the license of a software package released under
a later version and ONLY serves to clarify that using the NDK with a later version is
@ -152,36 +152,36 @@ remain anonymous, simply do not include this statement.
3.1 ORGANIZATION
* The NDK is organized in a main folder (include/ndk) with arch-specific subfolders (ex: include/ndk/i386).
* The NDK is structured by NT Subsystem Component (ex: ex, ps, rtl, etc).
* The NDK is organized in a main folder (include/ndk) with arch-specific subfolders (ex: include/ndk/i386).
* The NDK is structured by NT Subsystem Component (ex: ex, ps, rtl, etc).
* The NDK can either be included on-demand (#include <ndk/xxxxx.h>) or globally (#include <ndk/ntndk.h>).
The former is recommended to reduce compile time.
The former is recommended to reduce compile time.
* The NDK is structured by function and type. Every Subsystem Component has an associated "xxfuncs.h" and
"xxtypes.h" header, where "xx" is the Subsystem (ex: iofuncs.h, iotypes.h)
"xxtypes.h" header, where "xx" is the Subsystem (ex: iofuncs.h, iotypes.h)
* The NDK has a special file called "umtypes.h" which exports to User-Mode or Native-Mode Applications the
basic NT types which are present in ntdef.h. This file cannot be included since it would conflict with
winnt.h and/or windef.h. Thus, umtypes.h provides the missing types. This file is automatically included
in a User-Mode NDK project.
in a User-Mode NDK project.
* The NDK also includes a file called "umfuncs.h" which exports to User-Mode or Native-Mode Applications
undocumented functions which can only be accessed from ntdll.dll.
undocumented functions which can only be accessed from ntdll.dll.
* The NDK has another special file called "ifssupp.h", which exports to Kernel-Mode drivers a few types which
are only documented in the IFS kit, and are part of some native definitions. It will be deprecated next year
with the release of the WDK.
with the release of the WDK.
3.2 USING IN YOUR PROJECT
3.2 USING _In_ YOUR PROJECT
* User Mode Application requiring Native Types:
* User Mode Application requiring Native Types:
#define WIN32_NO_STATUS /* Tell Windows headers you'll use ntstatus.s from NDK */
#include "windows.h" /* Declare Windows Headers like you normally would */
#include "ntndk.h" /* Declare the NDK Headers */
* Native Mode Application:
* Native Mode Application:
#include "windows.h" /* Declare Windows Headers for basic types. NEEDED UNTIL NDK 1.5 */
#include "ntndk.h" /* Declare the NDK Headers */
* Kernel Mode Driver:
* Kernel Mode Driver:
#include "ntddk.h" /* Declare DDK Headers like you normally would */
#include "ntndk.h" /* Declare the NDK Headers */

File diff suppressed because it is too large Load diff

View file

@ -448,7 +448,7 @@ typedef LONG
//
typedef VOID
(NTAPI *WORKERCALLBACKFUNC)(
IN PVOID Context
_In_ PVOID Context
);
#else /* !NTOS_MODE_USER */
@ -484,7 +484,7 @@ extern const PRTL_REALLOCATE_STRING_ROUTINE RtlReallocateStringRoutine;
//
typedef ULONG
(NTAPI *RTLP_UNHANDLED_EXCEPTION_FILTER)(
IN struct _EXCEPTION_POINTERS *ExceptionInfo
_In_ struct _EXCEPTION_POINTERS *ExceptionInfo
);
typedef RTLP_UNHANDLED_EXCEPTION_FILTER *PRTLP_UNHANDLED_EXCEPTION_FILTER;
@ -493,8 +493,8 @@ typedef RTLP_UNHANDLED_EXCEPTION_FILTER *PRTLP_UNHANDLED_EXCEPTION_FILTER;
//
typedef NTSTATUS
(NTAPI *PHEAP_ENUMERATION_ROUTINE)(
IN PVOID HeapHandle,
IN PVOID UserParam
_In_ PVOID HeapHandle,
_In_ PVOID UserParam
);
//
@ -515,14 +515,14 @@ typedef VOID
//
typedef NTSTATUS
(NTAPI *PRTL_START_POOL_THREAD)(
IN PTHREAD_START_ROUTINE Function,
IN PVOID Parameter,
OUT PHANDLE ThreadHandle
_In_ PTHREAD_START_ROUTINE Function,
_In_ PVOID Parameter,
_Out_ PHANDLE ThreadHandle
);
typedef NTSTATUS
(NTAPI *PRTL_EXIT_POOL_THREAD)(
IN NTSTATUS ExitStatus
_In_ NTSTATUS ExitStatus
);
//
@ -613,12 +613,12 @@ typedef RTL_AVL_FREE_ROUTINE *PRTL_AVL_FREE_ROUTINE;
#ifdef NTOS_MODE_USER
typedef NTSTATUS
(NTAPI *PRTL_QUERY_REGISTRY_ROUTINE)(
IN PWSTR ValueName,
IN ULONG ValueType,
IN PVOID ValueData,
IN ULONG ValueLength,
IN PVOID Context,
IN PVOID EntryContext
_In_ PWSTR ValueName,
_In_ ULONG ValueType,
_In_ PVOID ValueData,
_In_ ULONG ValueLength,
_In_ PVOID Context,
_In_ PVOID EntryContext
);
#endif
@ -628,8 +628,8 @@ typedef NTSTATUS
#ifdef NTOS_MODE_USER
typedef NTSTATUS
(NTAPI *PRTL_SECURE_MEMORY_CACHE_CALLBACK)(
IN PVOID Address,
IN SIZE_T Length
_In_ PVOID Address,
_In_ SIZE_T Length
);
#endif
@ -648,9 +648,9 @@ typedef BOOLEAN
//
typedef NTSTATUS
(NTAPI * PRTL_HEAP_COMMIT_ROUTINE)(
IN PVOID Base,
IN OUT PVOID *CommitAddress,
IN OUT PSIZE_T CommitSize
_In_ PVOID Base,
_Inout_ PVOID *CommitAddress,
_Inout_ PSIZE_T CommitSize
);
//

View file

@ -33,20 +33,20 @@ NTKERNELAPI
NTSTATUS
NTAPI
SeCaptureSecurityDescriptor(
IN PSECURITY_DESCRIPTOR OriginalSecurityDescriptor,
IN KPROCESSOR_MODE CurrentMode,
IN POOL_TYPE PoolType,
IN BOOLEAN CaptureIfKernel,
OUT PSECURITY_DESCRIPTOR *CapturedSecurityDescriptor
_In_ PSECURITY_DESCRIPTOR OriginalSecurityDescriptor,
_In_ KPROCESSOR_MODE CurrentMode,
_In_ POOL_TYPE PoolType,
_In_ BOOLEAN CaptureIfKernel,
_Out_ PSECURITY_DESCRIPTOR *CapturedSecurityDescriptor
);
NTKERNELAPI
NTSTATUS
NTAPI
SeReleaseSecurityDescriptor(
IN PSECURITY_DESCRIPTOR CapturedSecurityDescriptor,
IN KPROCESSOR_MODE CurrentMode,
IN BOOLEAN CaptureIfKernelMode
_In_ PSECURITY_DESCRIPTOR CapturedSecurityDescriptor,
_In_ KPROCESSOR_MODE CurrentMode,
_In_ BOOLEAN CaptureIfKernelMode
);
//
@ -66,7 +66,7 @@ NTKERNELAPI
VOID
NTAPI
SeDeleteAccessState(
IN PACCESS_STATE AccessState
_In_ PACCESS_STATE AccessState
);
//
@ -76,7 +76,7 @@ NTKERNELAPI
SECURITY_IMPERSONATION_LEVEL
NTAPI
SeTokenImpersonationLevel(
IN PACCESS_TOKEN Token
_In_ PACCESS_TOKEN Token
);
#endif
@ -88,94 +88,99 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtAccessCheck(
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
IN HANDLE ClientToken,
IN ACCESS_MASK DesiredAccess,
IN PGENERIC_MAPPING GenericMapping,
OUT PPRIVILEGE_SET PrivilegeSet,
OUT PULONG ReturnLength,
OUT PACCESS_MASK GrantedAccess,
OUT PNTSTATUS AccessStatus
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ HANDLE ClientToken,
_In_ ACCESS_MASK DesiredAccess,
_In_ PGENERIC_MAPPING GenericMapping,
_Out_ PPRIVILEGE_SET PrivilegeSet,
_Out_ PULONG ReturnLength,
_Out_ PACCESS_MASK GrantedAccess,
_Out_ PNTSTATUS AccessStatus
);
NTSTATUS
NTAPI
NtAccessCheckByType(
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
IN PSID PrincipalSelfSid,
IN HANDLE ClientToken,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_TYPE_LIST ObjectTypeList,
IN ULONG ObjectTypeLength,
IN PGENERIC_MAPPING GenericMapping,
IN PPRIVILEGE_SET PrivilegeSet,
IN OUT PULONG PrivilegeSetLength,
OUT PACCESS_MASK GrantedAccess,
OUT PNTSTATUS AccessStatus
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ PSID PrincipalSelfSid,
_In_ HANDLE ClientToken,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_TYPE_LIST ObjectTypeList,
_In_ ULONG ObjectTypeLength,
_In_ PGENERIC_MAPPING GenericMapping,
_In_ PPRIVILEGE_SET PrivilegeSet,
_Inout_ PULONG PrivilegeSetLength,
_Out_ PACCESS_MASK GrantedAccess,
_Out_ PNTSTATUS AccessStatus
);
NTSTATUS
NTAPI
NtAccessCheckByTypeResultList(
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
IN PSID PrincipalSelfSid,
IN HANDLE ClientToken,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_TYPE_LIST ObjectTypeList,
IN ULONG ObjectTypeLength,
IN PGENERIC_MAPPING GenericMapping,
IN PPRIVILEGE_SET PrivilegeSet,
IN OUT PULONG PrivilegeSetLength,
OUT PACCESS_MASK GrantedAccess,
OUT PNTSTATUS AccessStatus
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ PSID PrincipalSelfSid,
_In_ HANDLE ClientToken,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_TYPE_LIST ObjectTypeList,
_In_ ULONG ObjectTypeLength,
_In_ PGENERIC_MAPPING GenericMapping,
_In_ PPRIVILEGE_SET PrivilegeSet,
_Inout_ PULONG PrivilegeSetLength,
_Out_ PACCESS_MASK GrantedAccess,
_Out_ PNTSTATUS AccessStatus
);
NTSYSCALLAPI
_Must_inspect_result_
__kernel_entry NTSYSCALLAPI
NTSTATUS
NTAPI
NtAccessCheckAndAuditAlarm(
IN PUNICODE_STRING SubsystemName,
IN PVOID HandleId,
IN PUNICODE_STRING ObjectTypeName,
IN PUNICODE_STRING ObjectName,
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
IN ACCESS_MASK DesiredAccess,
IN PGENERIC_MAPPING GenericMapping,
IN BOOLEAN ObjectCreation,
OUT PACCESS_MASK GrantedAccess,
OUT PNTSTATUS AccessStatus,
OUT PBOOLEAN GenerateOnClose
_In_ PUNICODE_STRING SubsystemName,
_In_opt_ PVOID HandleId,
_In_ PUNICODE_STRING ObjectTypeName,
_In_ PUNICODE_STRING ObjectName,
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ ACCESS_MASK DesiredAccess,
_In_ PGENERIC_MAPPING GenericMapping,
_In_ BOOLEAN ObjectCreation,
_Out_ PACCESS_MASK GrantedAccess,
_Out_ PNTSTATUS AccessStatus,
_Out_ PBOOLEAN GenerateOnClose
);
_Must_inspect_result_
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAdjustGroupsToken(
IN HANDLE TokenHandle,
IN BOOLEAN ResetToDefault,
IN PTOKEN_GROUPS NewState,
IN ULONG BufferLength,
OUT PTOKEN_GROUPS PreviousState OPTIONAL,
OUT PULONG ReturnLength
_In_ HANDLE TokenHandle,
_In_ BOOLEAN ResetToDefault,
_In_opt_ PTOKEN_GROUPS NewState,
_In_opt_ ULONG BufferLength,
_Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_GROUPS PreviousState,
_Out_ PULONG ReturnLength
);
_Must_inspect_result_
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAdjustPrivilegesToken(
IN HANDLE TokenHandle,
IN BOOLEAN DisableAllPrivileges,
IN PTOKEN_PRIVILEGES NewState,
IN ULONG BufferLength,
OUT PTOKEN_PRIVILEGES PreviousState,
OUT PULONG ReturnLength
_In_ HANDLE TokenHandle,
_In_ BOOLEAN DisableAllPrivileges,
_In_opt_ PTOKEN_PRIVILEGES NewState,
_In_ ULONG BufferLength,
_Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_PRIVILEGES PreviousState,
_Out_ _When_(PreviousState == NULL, _Out_opt_) PULONG ReturnLength
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAllocateLocallyUniqueId(
OUT LUID *LocallyUniqueId
_Out_ LUID *LocallyUniqueId
);
NTSYSCALLAPI
@ -192,181 +197,185 @@ NTSYSCALLAPI
NTSTATUS
NTAPI
NtCompareTokens(
IN HANDLE FirstTokenHandle,
IN HANDLE SecondTokenHandle,
OUT PBOOLEAN Equal);
_In_ HANDLE FirstTokenHandle,
_In_ HANDLE SecondTokenHandle,
_Out_ PBOOLEAN Equal);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateToken(
OUT PHANDLE TokenHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN TOKEN_TYPE TokenType,
IN PLUID AuthenticationId,
IN PLARGE_INTEGER ExpirationTime,
IN PTOKEN_USER TokenUser,
IN PTOKEN_GROUPS TokenGroups,
IN PTOKEN_PRIVILEGES TokenPrivileges,
IN PTOKEN_OWNER TokenOwner,
IN PTOKEN_PRIMARY_GROUP TokenPrimaryGroup,
IN PTOKEN_DEFAULT_DACL TokenDefaultDacl,
IN PTOKEN_SOURCE TokenSource
_Out_ PHANDLE TokenHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ TOKEN_TYPE TokenType,
_In_ PLUID AuthenticationId,
_In_ PLARGE_INTEGER ExpirationTime,
_In_ PTOKEN_USER TokenUser,
_In_ PTOKEN_GROUPS TokenGroups,
_In_ PTOKEN_PRIVILEGES TokenPrivileges,
_In_ PTOKEN_OWNER TokenOwner,
_In_ PTOKEN_PRIMARY_GROUP TokenPrimaryGroup,
_In_ PTOKEN_DEFAULT_DACL TokenDefaultDacl,
_In_ PTOKEN_SOURCE TokenSource
);
_Must_inspect_result_
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDuplicateToken(
IN HANDLE ExistingTokenHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN BOOLEAN EffectiveOnly,
IN TOKEN_TYPE TokenType,
OUT PHANDLE NewTokenHandle
_In_ HANDLE ExistingTokenHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ BOOLEAN EffectiveOnly,
_In_ TOKEN_TYPE TokenType,
_Out_ PHANDLE NewTokenHandle
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtImpersonateAnonymousToken(
IN HANDLE Thread
_In_ HANDLE Thread
);
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenObjectAuditAlarm(
IN PUNICODE_STRING SubsystemName,
IN PVOID HandleId,
IN PUNICODE_STRING ObjectTypeName,
IN PUNICODE_STRING ObjectName,
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
IN HANDLE ClientToken,
IN ULONG DesiredAccess,
IN ULONG GrantedAccess,
IN PPRIVILEGE_SET Privileges,
IN BOOLEAN ObjectCreation,
IN BOOLEAN AccessGranted,
OUT PBOOLEAN GenerateOnClose
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenProcessToken(
IN HANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
OUT PHANDLE TokenHandle
_In_ PUNICODE_STRING SubsystemName,
_In_opt_ PVOID HandleId,
_In_ PUNICODE_STRING ObjectTypeName,
_In_ PUNICODE_STRING ObjectName,
_In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ HANDLE ClientToken,
_In_ ACCESS_MASK DesiredAccess,
_In_ ACCESS_MASK GrantedAccess,
_In_opt_ PPRIVILEGE_SET Privileges,
_In_ BOOLEAN ObjectCreation,
_In_ BOOLEAN AccessGranted,
_Out_ PBOOLEAN GenerateOnClose
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenProcessTokenEx(
IN HANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN ULONG HandleAttributes,
OUT PHANDLE TokenHandle
_In_ HANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ ULONG HandleAttributes,
_Out_ PHANDLE TokenHandle
);
_Must_inspect_result_
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtPrivilegeCheck(
IN HANDLE ClientToken,
IN PPRIVILEGE_SET RequiredPrivileges,
IN PBOOLEAN Result
_In_ HANDLE ClientToken,
_Inout_ PPRIVILEGE_SET RequiredPrivileges,
_Out_ PBOOLEAN Result
);
NTSYSCALLAPI
NTSTATUS
NTAPI
NtPrivilegedServiceAuditAlarm(
IN PUNICODE_STRING SubsystemName,
IN PUNICODE_STRING ServiceName,
IN HANDLE ClientToken,
IN PPRIVILEGE_SET Privileges,
IN BOOLEAN AccessGranted
_In_ PUNICODE_STRING SubsystemName,
_In_ PUNICODE_STRING ServiceName,
_In_ HANDLE ClientToken,
_In_ PPRIVILEGE_SET Privileges,
_In_ BOOLEAN AccessGranted
);
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtPrivilegeObjectAuditAlarm(
IN PUNICODE_STRING SubsystemName,
IN PVOID HandleId,
IN HANDLE ClientToken,
IN ULONG DesiredAccess,
IN PPRIVILEGE_SET Privileges,
IN BOOLEAN AccessGranted
_In_ PUNICODE_STRING SubsystemName,
_In_opt_ PVOID HandleId,
_In_ HANDLE ClientToken,
_In_ ACCESS_MASK DesiredAccess,
_In_ PPRIVILEGE_SET Privileges,
_In_ BOOLEAN AccessGranted
);
_When_(TokenInformationClass == TokenAccessInformation,
_At_(TokenInformationLength, _In_range_(>=, sizeof(TOKEN_ACCESS_INFORMATION))))
_Must_inspect_result_
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationToken(
IN HANDLE TokenHandle,
IN TOKEN_INFORMATION_CLASS TokenInformationClass,
OUT PVOID TokenInformation,
IN ULONG TokenInformationLength,
OUT PULONG ReturnLength
_In_ HANDLE TokenHandle,
_In_ TOKEN_INFORMATION_CLASS TokenInformationClass,
_Out_writes_bytes_to_opt_(TokenInformationLength, *ReturnLength) PVOID TokenInformation,
_In_ ULONG TokenInformationLength,
_Out_ PULONG ReturnLength
);
_Must_inspect_result_
__kernel_entry
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationToken(
IN HANDLE TokenHandle,
IN TOKEN_INFORMATION_CLASS TokenInformationClass,
OUT PVOID TokenInformation,
IN ULONG TokenInformationLength
_In_ HANDLE TokenHandle,
_In_ TOKEN_INFORMATION_CLASS TokenInformationClass,
_In_reads_bytes_(TokenInformationLength) PVOID TokenInformation,
_In_ ULONG TokenInformationLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwAccessCheck(
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
IN HANDLE ClientToken,
IN ACCESS_MASK DesiredAccess,
IN PGENERIC_MAPPING GenericMapping,
OUT PPRIVILEGE_SET PrivilegeSet,
OUT PULONG ReturnLength,
OUT PACCESS_MASK GrantedAccess,
OUT PNTSTATUS AccessStatus
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ HANDLE ClientToken,
_In_ ACCESS_MASK DesiredAccess,
_In_ PGENERIC_MAPPING GenericMapping,
_Out_ PPRIVILEGE_SET PrivilegeSet,
_Out_ PULONG ReturnLength,
_Out_ PACCESS_MASK GrantedAccess,
_Out_ PNTSTATUS AccessStatus
);
NTSYSAPI
NTSTATUS
NTAPI
ZwAdjustGroupsToken(
IN HANDLE TokenHandle,
IN BOOLEAN ResetToDefault,
IN PTOKEN_GROUPS NewState,
IN ULONG BufferLength,
OUT PTOKEN_GROUPS PreviousState OPTIONAL,
OUT PULONG ReturnLength
_In_ HANDLE TokenHandle,
_In_ BOOLEAN ResetToDefault,
_In_ PTOKEN_GROUPS NewState,
_In_ ULONG BufferLength,
_Out_opt_ PTOKEN_GROUPS PreviousState,
_Out_ PULONG ReturnLength
);
_Must_inspect_result_
NTSYSAPI
NTSTATUS
NTAPI
ZwAdjustPrivilegesToken(
IN HANDLE TokenHandle,
IN BOOLEAN DisableAllPrivileges,
IN PTOKEN_PRIVILEGES NewState,
IN ULONG BufferLength,
OUT PTOKEN_PRIVILEGES PreviousState,
OUT PULONG ReturnLength
_In_ HANDLE TokenHandle,
_In_ BOOLEAN DisableAllPrivileges,
_In_opt_ PTOKEN_PRIVILEGES NewState,
_In_ ULONG BufferLength,
_Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_PRIVILEGES PreviousState,
_Out_ _When_(PreviousState == NULL, _Out_opt_) PULONG ReturnLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwAllocateLocallyUniqueId(
OUT LUID *LocallyUniqueId
_Out_ LUID *LocallyUniqueId
);
NTSYSAPI
@ -383,127 +392,130 @@ NTSYSAPI
NTSTATUS
NTAPI
ZwCreateToken(
OUT PHANDLE TokenHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN TOKEN_TYPE TokenType,
IN PLUID AuthenticationId,
IN PLARGE_INTEGER ExpirationTime,
IN PTOKEN_USER TokenUser,
IN PTOKEN_GROUPS TokenGroups,
IN PTOKEN_PRIVILEGES TokenPrivileges,
IN PTOKEN_OWNER TokenOwner,
IN PTOKEN_PRIMARY_GROUP TokenPrimaryGroup,
IN PTOKEN_DEFAULT_DACL TokenDefaultDacl,
IN PTOKEN_SOURCE TokenSource
_Out_ PHANDLE TokenHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ TOKEN_TYPE TokenType,
_In_ PLUID AuthenticationId,
_In_ PLARGE_INTEGER ExpirationTime,
_In_ PTOKEN_USER TokenUser,
_In_ PTOKEN_GROUPS TokenGroups,
_In_ PTOKEN_PRIVILEGES TokenPrivileges,
_In_ PTOKEN_OWNER TokenOwner,
_In_ PTOKEN_PRIMARY_GROUP TokenPrimaryGroup,
_In_ PTOKEN_DEFAULT_DACL TokenDefaultDacl,
_In_ PTOKEN_SOURCE TokenSource
);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwDuplicateToken(
IN HANDLE ExistingTokenHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN BOOLEAN EffectiveOnly,
IN TOKEN_TYPE TokenType,
OUT PHANDLE NewTokenHandle
_In_ HANDLE ExistingTokenHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ BOOLEAN EffectiveOnly,
_In_ TOKEN_TYPE TokenType,
_Out_ PHANDLE NewTokenHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwImpersonateAnonymousToken(
IN HANDLE Thread
_In_ HANDLE Thread
);
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenObjectAuditAlarm(
IN PUNICODE_STRING SubsystemName,
IN PVOID HandleId,
IN PUNICODE_STRING ObjectTypeName,
IN PUNICODE_STRING ObjectName,
IN PSECURITY_DESCRIPTOR SecurityDescriptor,
IN HANDLE ClientToken,
IN ULONG DesiredAccess,
IN ULONG GrantedAccess,
IN PPRIVILEGE_SET Privileges,
IN BOOLEAN ObjectCreation,
IN BOOLEAN AccessGranted,
OUT PBOOLEAN GenerateOnClose
_In_ PUNICODE_STRING SubsystemName,
_In_ PVOID HandleId,
_In_ PUNICODE_STRING ObjectTypeName,
_In_ PUNICODE_STRING ObjectName,
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
_In_ HANDLE ClientToken,
_In_ ULONG DesiredAccess,
_In_ ULONG GrantedAccess,
_In_ PPRIVILEGE_SET Privileges,
_In_ BOOLEAN ObjectCreation,
_In_ BOOLEAN AccessGranted,
_Out_ PBOOLEAN GenerateOnClose
);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenProcessToken(
IN HANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
OUT PHANDLE TokenHandle
_In_ HANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_Out_ PHANDLE TokenHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenProcessTokenEx(
IN HANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN ULONG HandleAttributes,
OUT PHANDLE TokenHandle
_In_ HANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ ULONG HandleAttributes,
_Out_ PHANDLE TokenHandle
);
NTSYSAPI
NTSTATUS
NTAPI
ZwPrivilegeCheck(
IN HANDLE ClientToken,
IN PPRIVILEGE_SET RequiredPrivileges,
IN PBOOLEAN Result
_In_ HANDLE ClientToken,
_In_ PPRIVILEGE_SET RequiredPrivileges,
_In_ PBOOLEAN Result
);
NTSYSAPI
NTSTATUS
NTAPI
ZwPrivilegedServiceAuditAlarm(
IN PUNICODE_STRING SubsystemName,
IN PUNICODE_STRING ServiceName,
IN HANDLE ClientToken,
IN PPRIVILEGE_SET Privileges,
IN BOOLEAN AccessGranted
_In_ PUNICODE_STRING SubsystemName,
_In_ PUNICODE_STRING ServiceName,
_In_ HANDLE ClientToken,
_In_ PPRIVILEGE_SET Privileges,
_In_ BOOLEAN AccessGranted
);
NTSYSAPI
NTSTATUS
NTAPI
ZwPrivilegeObjectAuditAlarm(
IN PUNICODE_STRING SubsystemName,
IN PVOID HandleId,
IN HANDLE ClientToken,
IN ULONG DesiredAccess,
IN PPRIVILEGE_SET Privileges,
IN BOOLEAN AccessGranted
_In_ PUNICODE_STRING SubsystemName,
_In_ PVOID HandleId,
_In_ HANDLE ClientToken,
_In_ ULONG DesiredAccess,
_In_ PPRIVILEGE_SET Privileges,
_In_ BOOLEAN AccessGranted
);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryInformationToken(
IN HANDLE TokenHandle,
IN TOKEN_INFORMATION_CLASS TokenInformationClass,
OUT PVOID TokenInformation,
IN ULONG TokenInformationLength,
OUT PULONG ReturnLength
_In_ HANDLE TokenHandle,
_In_ TOKEN_INFORMATION_CLASS TokenInformationClass,
_Out_writes_bytes_to_opt_(TokenInformationLength,*ReturnLength) PVOID TokenInformation,
_In_ ULONG TokenInformationLength,
_Out_ PULONG ReturnLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwSetInformationToken(
IN HANDLE TokenHandle,
IN TOKEN_INFORMATION_CLASS TokenInformationClass,
OUT PVOID TokenInformation,
IN ULONG TokenInformationLength
_In_ HANDLE TokenHandle,
_In_ TOKEN_INFORMATION_CLASS TokenInformationClass,
_Out_ PVOID TokenInformation,
_In_ ULONG TokenInformationLength
);
#endif

View file

@ -72,7 +72,7 @@ NTSTATUS
NTAPI
CsrClientCallServer(
struct _CSR_API_MESSAGE *Request,
struct _CSR_CAPTURE_BUFFER *CaptureBuffer OPTIONAL,
_In_opt_ struct _CSR_CAPTURE_BUFFER *CaptureBuffer,
ULONG ApiNumber,
ULONG RequestLength
);
@ -109,27 +109,28 @@ CsrSetPriorityClass(
VOID
NTAPI
CsrProbeForRead(
IN PVOID Address,
IN ULONG Length,
IN ULONG Alignment
_In_ PVOID Address,
_In_ ULONG Length,
_In_ ULONG Alignment
);
VOID
NTAPI
CsrProbeForWrite(
IN PVOID Address,
IN ULONG Length,
IN ULONG Alignment
_In_ PVOID Address,
_In_ ULONG Length,
_In_ ULONG Alignment
);
//
// Debug Functions
//
__analysis_noreturn
NTSYSAPI
VOID
NTAPI
DbgBreakPointWithStatus(
IN ULONG Status
_In_ ULONG Status
);
NTSTATUS
@ -141,35 +142,35 @@ DbgUiConnectToDbg(
NTSTATUS
NTAPI
DbgUiContinue(
IN PCLIENT_ID ClientId,
IN NTSTATUS ContinueStatus
_In_ PCLIENT_ID ClientId,
_In_ NTSTATUS ContinueStatus
);
NTSTATUS
NTAPI
DbgUiDebugActiveProcess(
IN HANDLE Process
_In_ HANDLE Process
);
NTSTATUS
NTAPI
DbgUiStopDebugging(
IN HANDLE Process
_In_ HANDLE Process
);
NTSYSAPI
NTSTATUS
NTAPI
DbgUiWaitStateChange(
IN PDBGUI_WAIT_STATE_CHANGE DbgUiWaitStateCange,
IN PLARGE_INTEGER TimeOut
_In_ PDBGUI_WAIT_STATE_CHANGE DbgUiWaitStateCange,
_In_ PLARGE_INTEGER TimeOut
);
NTSTATUS
NTAPI
DbgUiConvertStateChangeStructure(
IN PDBGUI_WAIT_STATE_CHANGE WaitStateChange,
IN PVOID DebugEvent
_In_ PDBGUI_WAIT_STATE_CHANGE WaitStateChange,
_In_ PVOID DebugEvent
);
VOID
@ -181,7 +182,7 @@ DbgUiRemoteBreakin(
NTSTATUS
NTAPI
DbgUiIssueRemoteBreakin(
IN HANDLE Process
_In_ HANDLE Process
);
HANDLE
@ -197,47 +198,48 @@ DbgUiGetThreadDebugObject(
NTSTATUS
NTAPI
LdrAddRefDll(
IN ULONG Flags,
IN PVOID BaseAddress
_In_ ULONG Flags,
_In_ PVOID BaseAddress
);
NTSTATUS
NTAPI
LdrDisableThreadCalloutsForDll(
IN PVOID BaseAddress
_In_ PVOID BaseAddress
);
NTSTATUS
NTAPI
LdrGetDllHandle(
IN PWSTR DllPath OPTIONAL,
IN PULONG DllCharacteristics,
IN PUNICODE_STRING DllName,
OUT PVOID *DllHandle
_In_opt_ PWSTR DllPath,
_In_ PULONG DllCharacteristics,
_In_ PUNICODE_STRING DllName,
_Out_ PVOID *DllHandle
);
NTSTATUS
NTAPI
LdrGetDllHandleEx(IN ULONG Flags,
IN PWSTR DllPath OPTIONAL,
IN PULONG DllCharacteristics OPTIONAL,
IN PUNICODE_STRING DllName,
OUT PVOID *DllHandle OPTIONAL);
LdrGetDllHandleEx(
_In_ ULONG Flags,
_In_opt_ PWSTR DllPath,
_In_opt_ PULONG DllCharacteristics,
_In_ PUNICODE_STRING DllName,
_Out_opt_ PVOID *DllHandle);
NTSTATUS
NTAPI
LdrFindEntryForAddress(
IN PVOID Address,
OUT PLDR_DATA_TABLE_ENTRY *Module
_In_ PVOID Address,
_Out_ PLDR_DATA_TABLE_ENTRY *Module
);
NTSTATUS
NTAPI
LdrGetProcedureAddress(
IN PVOID BaseAddress,
IN PANSI_STRING Name,
IN ULONG Ordinal,
OUT PVOID *ProcedureAddress
_In_ PVOID BaseAddress,
_In_ PANSI_STRING Name,
_In_ ULONG Ordinal,
_Out_ PVOID *ProcedureAddress
);
VOID
@ -252,38 +254,38 @@ LdrInitializeThunk(
NTSTATUS
NTAPI
LdrLoadDll(
IN PWSTR SearchPath OPTIONAL,
IN PULONG LoadFlags OPTIONAL,
IN PUNICODE_STRING Name,
OUT PVOID *BaseAddress OPTIONAL
_In_opt_ PWSTR SearchPath,
_In_opt_ PULONG LoadFlags,
_In_ PUNICODE_STRING Name,
_Out_opt_ PVOID *BaseAddress
);
PIMAGE_BASE_RELOCATION
NTAPI
LdrProcessRelocationBlock(
IN ULONG_PTR Address,
IN ULONG Count,
IN PUSHORT TypeOffset,
IN LONG_PTR Delta
_In_ ULONG_PTR Address,
_In_ ULONG Count,
_In_ PUSHORT TypeOffset,
_In_ LONG_PTR Delta
);
NTSTATUS
NTAPI
LdrQueryImageFileExecutionOptions(
IN PUNICODE_STRING SubKey,
IN PCWSTR ValueName,
IN ULONG ValueSize,
OUT PVOID Buffer,
IN ULONG BufferSize,
OUT PULONG RetunedLength OPTIONAL
_In_ PUNICODE_STRING SubKey,
_In_ PCWSTR ValueName,
_In_ ULONG ValueSize,
_Out_ PVOID Buffer,
_In_ ULONG BufferSize,
_Out_opt_ PULONG RetunedLength
);
NTSTATUS
NTAPI
LdrQueryProcessModuleInformation(
IN PRTL_PROCESS_MODULES ModuleInformation OPTIONAL,
IN ULONG Size OPTIONAL,
OUT PULONG ReturnedSize
_In_opt_ PRTL_PROCESS_MODULES ModuleInformation,
_In_opt_ ULONG Size,
_Out_ PULONG ReturnedSize
);
NTSTATUS
@ -301,36 +303,36 @@ LdrShutdownThread(
NTSTATUS
NTAPI
LdrUnloadDll(
IN PVOID BaseAddress
_In_ PVOID BaseAddress
);
typedef VOID (NTAPI *PLDR_CALLBACK)(PVOID CallbackContext, PCHAR Name);
NTSTATUS
NTAPI
LdrVerifyImageMatchesChecksum(
IN HANDLE FileHandle,
IN PLDR_CALLBACK Callback,
IN PVOID CallbackContext,
OUT PUSHORT ImageCharacterstics
_In_ HANDLE FileHandle,
_In_ PLDR_CALLBACK Callback,
_In_ PVOID CallbackContext,
_Out_ PUSHORT ImageCharacterstics
);
NTSTATUS
NTAPI
LdrOpenImageFileOptionsKey(
IN PUNICODE_STRING SubKey,
IN BOOLEAN Wow64,
OUT PHANDLE NewKeyHandle
_In_ PUNICODE_STRING SubKey,
_In_ BOOLEAN Wow64,
_Out_ PHANDLE NewKeyHandle
);
NTSTATUS
NTAPI
LdrQueryImageFileKeyOption(
IN HANDLE KeyHandle,
IN PCWSTR ValueName,
IN ULONG Type,
OUT PVOID Buffer,
IN ULONG BufferSize,
OUT PULONG ReturnedLength OPTIONAL
_In_ HANDLE KeyHandle,
_In_ PCWSTR ValueName,
_In_ ULONG Type,
_Out_ PVOID Buffer,
_In_ ULONG BufferSize,
_Out_opt_ PULONG ReturnedLength
);
#endif

View file

@ -33,20 +33,20 @@ Author:
BOOLEAN
NTAPI
VfIsVerificationEnabled(
IN VF_OBJECT_TYPE VfObjectType,
IN PVOID Object OPTIONAL
_In_ VF_OBJECT_TYPE VfObjectType,
_In_opt_ PVOID Object
);
VOID
NTAPI
VfFailDeviceNode(
IN PDEVICE_OBJECT PhysicalDeviceObject,
IN ULONG BugCheckMajorCode,
IN ULONG BugCheckMinorCode,
IN VF_FAILURE_CLASS FailureClass,
IN OUT PULONG AssertionControl,
IN PSTR DebuggerMessageText,
IN PSTR ParameterFormatString,
_In_ PDEVICE_OBJECT PhysicalDeviceObject,
_In_ ULONG BugCheckMajorCode,
_In_ ULONG BugCheckMinorCode,
_In_ VF_FAILURE_CLASS FailureClass,
_Inout_ PULONG AssertionControl,
_In_ PSTR DebuggerMessageText,
_In_ PSTR ParameterFormatString,
...
);
#endif

View file

@ -123,6 +123,7 @@
#define _IRQL_raises_(irql)
#define _IRQL_requires_(irql)
#define _IRQL_requires_max_(irql) _Pre_ _SA_annotes1(SAL_maxIRQL,irql)
#define _IRQL_requires_max_defined
#define _IRQL_requires_min_(irql)
#define _IRQL_requires_same_
#define _IRQL_restores_

View file

@ -416,7 +416,7 @@ enum __SAL_YesNo {_SAL_notpresent, _SAL_no, _SAL_maybe, _SAL_yes, _SAL_default};
#define __inner_typefix(ctype) [SAL_typefix(p1=#ctype)]
#define _Group_(annos) [SAL_begin] annos [SAL_end]
#define _When_(expr, annos) [SAL_when(p1=_SA_SPECSTRIZE(expr))] _Group_(annos)
#define _At_(target, annos) [SAL_at(p1=#target)] _Group_(annos)
#define _At_(target, annos) [SAL_at(p1=_SA_SPECSTRIZE(target))] _Group_(annos)
#define _At_buffer_(target, iter, bound, annos) [SAL_at_buffer(p1=#target, p2=#iter, p3=#bound)] [SAL_begin] annos [SAL_end]
#define _On_failure_(annos) [SAL_context(p1="SAL_failed")] _Group_(_Post_ _Group_(annos))
#define _Always_(annos) _Group_(annos) _On_failure_(annos)
@ -448,7 +448,7 @@ enum __SAL_YesNo {_SAL_notpresent, _SAL_no, _SAL_maybe, _SAL_yes, _SAL_default};
//#define _Deref_out_z_
//#define _Deref_out_z_bytecap_c_(size)
//#define _Deref_out_z_cap_c_(size)
//#define _Deref_post_bytecap_(size)
#define _Deref_post_bytecap_(size)
//#define _Deref_post_bytecap_c_(size)
//#define _Deref_post_bytecap_x_(size)
//#define _Deref_post_bytecount_(size)
@ -654,7 +654,7 @@ enum __SAL_YesNo {_SAL_notpresent, _SAL_no, _SAL_maybe, _SAL_yes, _SAL_default};
#define _In_z_count_(size)
//#define _In_z_count_c_(size)
#define _Inout_ _SAL2_Name(_Inout_) _Group_(_Prepost_valid_)
//#define _Inout_bytecap_(size)
#define _Inout_bytecap_(size)
//#define _Inout_bytecap_c_(size)
//#define _Inout_bytecap_x_(size)
#define _Inout_bytecount_(size)
@ -871,7 +871,7 @@ enum __SAL_YesNo {_SAL_notpresent, _SAL_no, _SAL_maybe, _SAL_yes, _SAL_default};
#define _Post_notnull_ _SAL2_Name(_Post_notnull_) _Group_([SA_Post(Null=SA_No)])
//#define _Post_null_
#define _Post_ptr_invalid_ _SAL2_Name(_Post_ptr_invalid_) _Group_([SA_Post(Valid=SA_No)])
//#define _Post_readable_byte_size_(size)
#define _Post_readable_byte_size_(size)
//#define _Post_readable_size_(size)
#define _Post_satisfies_(cond)
#define _Post_valid_ _SAL2_Name(_Post_valid_) _Group_([SA_Post(Valid=SA_Yes)])
@ -942,6 +942,7 @@ enum __SAL_YesNo {_SAL_notpresent, _SAL_no, _SAL_maybe, _SAL_yes, _SAL_default};
#define _Pre_readable_size_(size)
//#define _Pre_readonly_
#define _Pre_satisfies_(cond)
#define _Pre_unknown_
//#define _Pre_valid_
//#define _Pre_valid_bytecap_(size)
//#define _Pre_valid_bytecap_c_(size)
@ -1016,7 +1017,7 @@ enum __SAL_YesNo {_SAL_notpresent, _SAL_no, _SAL_maybe, _SAL_yes, _SAL_default};
//#define _Ret_opt_count_c_(size)
//#define _Ret_opt_count_x_(size)
//#define _Ret_opt_valid_
//#define _Ret_opt_z_
#define _Ret_opt_z_
//#define _Ret_opt_z_bytecap_(size)
//#define _Ret_opt_z_bytecount_(size)
//#define _Ret_opt_z_cap_(size)
@ -1045,7 +1046,7 @@ enum __SAL_YesNo {_SAL_notpresent, _SAL_no, _SAL_maybe, _SAL_yes, _SAL_default};
#define _Success_(expr) _SAL2_Name(_Success_) _Group_([SA_Success(Condition=_SA_SPECSTRIZE(expr))])
#define _Unchanged_(e)
//#define _Use_decl_annotations_
//#define _Valid_
#define _Valid_
#define _Writable_bytes_(size) _SAL2_Name(_Writable_bytes_) _Group_(_SA_annotes1(SAL_writableTo, byteCount(size)))
#define _Writable_elements_(size) _SAL2_Name(_Writable_elements_) _Group_(_SA_annotes1(SAL_writableTo, elementCount(size)))
@ -1622,6 +1623,7 @@ __PRIMOP(int, _In_function_class_(__In_impl_ char*);)
#define _Pre_readable_size_(size)
#define _Pre_readonly_
#define _Pre_satisfies_(cond)
#define _Pre_unknown_
#define _Pre_valid_
#define _Pre_valid_bytecap_(size)
#define _Pre_valid_bytecap_c_(size)

View file

@ -3914,7 +3914,7 @@ NTSYSAPI
VOID
NTAPI
RtlCaptureContext(
PCONTEXT ContextRecord
_Out_ PCONTEXT ContextRecord
);
NTSYSAPI
@ -3928,12 +3928,11 @@ RtlPcToFileHeader(
NTSYSAPI
VOID
NTAPI
RtlUnwind (
IN PVOID TargetFrame OPTIONAL,
IN PVOID TargetIp OPTIONAL,
IN PEXCEPTION_RECORD ExceptionRecord OPTIONAL,
IN PVOID ReturnValue
);
RtlUnwind(
_In_opt_ PVOID TargetFrame,
_In_opt_ PVOID TargetIp,
_In_opt_ PEXCEPTION_RECORD ExceptionRecord,
_In_ PVOID ReturnValue);
#define RTL_SRWLOCK_INIT {0}

View file

@ -168,7 +168,7 @@ NTSYSAPI
VOID
NTAPI
DbgBreakPointWithStatus(
IN ULONG Status);
_In_ ULONG Status);
#endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */

View file

@ -2,21 +2,6 @@
* Kernel Functions *
******************************************************************************/
$if (_WDMDDK_)
#if defined(_M_IX86)
$include(x86/ke.h)
#elif defined(_M_AMD64)
$include(amd64/ke.h)
#elif defined(_M_IA64)
$include(ia64/ke.h)
#elif defined(_M_PPC)
$include(ppc/ke.h)
#elif defined(_M_MIPS)
$include(mips/ke.h)
#elif defined(_M_ARM)
$include(arm/ke.h)
#else
#error Unknown Architecture
#endif
NTKERNELAPI
VOID

View file

@ -992,6 +992,45 @@ extern PCCHAR KeNumberProcessors;
$endif (_WDMDDK_)
$if (_NTDDK_)
typedef struct _NT_TIB {
struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList;
PVOID StackBase;
PVOID StackLimit;
PVOID SubSystemTib;
_ANONYMOUS_UNION union {
PVOID FiberData;
ULONG Version;
} DUMMYUNIONNAME;
PVOID ArbitraryUserPointer;
struct _NT_TIB *Self;
} NT_TIB, *PNT_TIB;
typedef struct _NT_TIB32 {
ULONG ExceptionList;
ULONG StackBase;
ULONG StackLimit;
ULONG SubSystemTib;
_ANONYMOUS_UNION union {
ULONG FiberData;
ULONG Version;
} DUMMYUNIONNAME;
ULONG ArbitraryUserPointer;
ULONG Self;
} NT_TIB32,*PNT_TIB32;
typedef struct _NT_TIB64 {
ULONG64 ExceptionList;
ULONG64 StackBase;
ULONG64 StackLimit;
ULONG64 SubSystemTib;
_ANONYMOUS_UNION union {
ULONG64 FiberData;
ULONG Version;
} DUMMYUNIONNAME;
ULONG64 ArbitraryUserPointer;
ULONG64 Self;
} NT_TIB64,*PNT_TIB64;
#define NX_SUPPORT_POLICY_ALWAYSOFF 0
#define NX_SUPPORT_POLICY_ALWAYSON 1
#define NX_SUPPORT_POLICY_OPTIN 2
@ -1198,3 +1237,21 @@ typedef struct _KQUEUE {
$endif (_NTIFS_)
$if (_WDMDDK_)
#if defined(_M_IX86)
$include(x86/ke.h)
#elif defined(_M_AMD64)
$include(amd64/ke.h)
#elif defined(_M_IA64)
$include(ia64/ke.h)
#elif defined(_M_PPC)
$include(ppc/ke.h)
#elif defined(_M_MIPS)
$include(mips/ke.h)
#elif defined(_M_ARM)
$include(arm/ke.h)
#else
#error Unknown Architecture
#endif
$endif (_WDMDDK_)

View file

@ -371,7 +371,7 @@ NTSTATUS
NTAPI
NtAllocateVirtualMemory(
_In_ HANDLE ProcessHandle,
_Outptr_result_bytebuffer_(*RegionSize) PVOID *BaseAddress,
_Inout_ _At_(*BaseAddress, _Readable_bytes_(*RegionSize) _Writable_bytes_(*RegionSize) _Post_readable_byte_size_(*RegionSize)) PVOID *BaseAddress,
_In_ ULONG_PTR ZeroBits,
_Inout_ PSIZE_T RegionSize,
_In_ ULONG AllocationType,
@ -1771,19 +1771,20 @@ FsRtlNotifyChangeDirectory (
IN PIRP NotifyIrp
);
#if 1
NTKERNELAPI
NTSTATUS
NTAPI
ObCreateObject (
IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL,
IN POBJECT_TYPE ObjectType,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN KPROCESSOR_MODE AccessMode,
IN OUT PVOID ParseContext OPTIONAL,
IN ULONG ObjectSize,
IN ULONG PagedPoolCharge OPTIONAL,
IN ULONG NonPagedPoolCharge OPTIONAL,
OUT PVOID *Object
ObCreateObject(
_In_opt_ KPROCESSOR_MODE ObjectAttributesAccessMode,
_In_ POBJECT_TYPE ObjectType,
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ KPROCESSOR_MODE AccessMode,
_Inout_opt_ PVOID ParseContext,
_In_ ULONG ObjectSize,
_In_opt_ ULONG PagedPoolCharge,
_In_opt_ ULONG NonPagedPoolCharge,
_Out_ PVOID *Object
);
NTKERNELAPI
@ -1852,6 +1853,8 @@ ZwAdjustPrivilegesToken (
#endif /* (VER_PRODUCTBUILD >= 2195) */
#endif
NTSYSAPI
NTSTATUS
NTAPI
@ -2000,17 +2003,18 @@ ZwQueryDefaultLocale (
#if (VER_PRODUCTBUILD >= 2195)
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryDirectoryObject (
IN HANDLE DirectoryHandle,
OUT PVOID Buffer,
IN ULONG Length,
IN BOOLEAN ReturnSingleEntry,
IN BOOLEAN RestartScan,
IN OUT PULONG Context,
OUT PULONG ReturnLength OPTIONAL
ZwQueryDirectoryObject(
_In_ HANDLE DirectoryHandle,
_Out_ PVOID Buffer,
_In_ ULONG BufferLength,
_In_ BOOLEAN ReturnSingleEntry,
_In_ BOOLEAN RestartScan,
_Inout_ PULONG Context,
_Out_opt_ PULONG ReturnLength
);
#endif /* (VER_PRODUCTBUILD >= 2195) */

View file

@ -229,45 +229,6 @@ typedef VOID
#define PROCESS_HANDLE_TRACING_MAX_STACKS 16
typedef struct _NT_TIB {
struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList;
PVOID StackBase;
PVOID StackLimit;
PVOID SubSystemTib;
_ANONYMOUS_UNION union {
PVOID FiberData;
ULONG Version;
} DUMMYUNIONNAME;
PVOID ArbitraryUserPointer;
struct _NT_TIB *Self;
} NT_TIB, *PNT_TIB;
typedef struct _NT_TIB32 {
ULONG ExceptionList;
ULONG StackBase;
ULONG StackLimit;
ULONG SubSystemTib;
_ANONYMOUS_UNION union {
ULONG FiberData;
ULONG Version;
} DUMMYUNIONNAME;
ULONG ArbitraryUserPointer;
ULONG Self;
} NT_TIB32,*PNT_TIB32;
typedef struct _NT_TIB64 {
ULONG64 ExceptionList;
ULONG64 StackBase;
ULONG64 StackLimit;
ULONG64 SubSystemTib;
_ANONYMOUS_UNION union {
ULONG64 FiberData;
ULONG Version;
} DUMMYUNIONNAME;
ULONG64 ArbitraryUserPointer;
ULONG64 Self;
} NT_TIB64,*PNT_TIB64;
typedef enum _PROCESSINFOCLASS {
ProcessBasicInformation,
ProcessQuotaLimits,

View file

@ -218,7 +218,7 @@ RtlGUIDFromString(
_IRQL_requires_max_(DISPATCH_LEVEL)
_At_(DestinationString->Buffer, _Post_equal_to_(SourceString))
_At_(DestinationString->Length, _Post_equal_to_(_String_length_(SourceString) * sizeof(WCHAR)))
_At_(DestinationString->MaximumLength, _Post_equal_to_(DestinationString->Length + sizeof(WCHAR)))
_At_(DestinationString->MaximumLength, _Post_equal_to_((_String_length_(SourceString)+1) * sizeof(WCHAR)))
NTSYSAPI
VOID
NTAPI
@ -573,13 +573,15 @@ RtlInitAnsiString(
_Out_ PANSI_STRING DestinationString,
_In_opt_z_ __drv_aliasesMem PCSZ SourceString);
_At_(BitMapHeader->SizeOfBitMap, _Post_equal_to_(SizeOfBitMap))
_At_(BitMapHeader->Buffer, _Post_equal_to_(BitMapBuffer))
NTSYSAPI
VOID
NTAPI
RtlInitializeBitMap(
_Out_ PRTL_BITMAP BitMapHeader,
_In_ __drv_aliasesMem PULONG BitMapBuffer,
_In_ ULONG SizeOfBitMap);
_In_opt_ __drv_aliasesMem PULONG BitMapBuffer,
_In_opt_ ULONG SizeOfBitMap);
_IRQL_requires_max_(DISPATCH_LEVEL)
NTSYSAPI
@ -648,12 +650,12 @@ NTSYSAPI
NTSTATUS
NTAPI
RtlQueryRegistryValues(
_In_ ULONG RelativeTo,
_In_ PCWSTR Path,
_Inout_ _At_(*(*QueryTable).EntryContext, _Post_valid_)
PRTL_QUERY_REGISTRY_TABLE QueryTable,
_In_opt_ PVOID Context,
_In_opt_ PVOID Environment);
_In_ ULONG RelativeTo,
_In_ PCWSTR Path,
_Inout_ _At_(*(*QueryTable).EntryContext, _Pre_unknown_)
PRTL_QUERY_REGISTRY_TABLE QueryTable,
_In_opt_ PVOID Context,
_In_opt_ PVOID Environment);
#define SHORT_SIZE (sizeof(USHORT))
#define SHORT_MASK (SHORT_SIZE - 1)
@ -901,6 +903,27 @@ NTAPI
RtlValidSecurityDescriptor(
_In_ PSECURITY_DESCRIPTOR SecurityDescriptor);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
NTAPI
RtlGetVersion(
_Out_
_At_(lpVersionInformation->dwOSVersionInfoSize, _Pre_ _Valid_)
_When_(lpVersionInformation->dwOSVersionInfoSize == sizeof(RTL_OSVERSIONINFOEXW),
_At_((PRTL_OSVERSIONINFOEXW)lpVersionInformation, _Out_))
PRTL_OSVERSIONINFOW lpVersionInformation);
_IRQL_requires_max_(PASSIVE_LEVEL)
_Must_inspect_result_
NTSYSAPI
NTSTATUS
NTAPI
RtlVerifyVersionInfo(
_In_ PRTL_OSVERSIONINFOEXW VersionInfo,
_In_ ULONG TypeMask,
_In_ ULONGLONG ConditionMask);
_IRQL_requires_max_(PASSIVE_LEVEL)
NTSYSAPI
NTSTATUS
@ -1106,20 +1129,6 @@ RtlVolumeDeviceToDosName(
_In_ PVOID VolumeDeviceObject,
_Out_ PUNICODE_STRING DosName);
NTSYSAPI
NTSTATUS
NTAPI
RtlGetVersion(
IN OUT PRTL_OSVERSIONINFOW lpVersionInformation);
NTSYSAPI
NTSTATUS
NTAPI
RtlVerifyVersionInfo(
IN PRTL_OSVERSIONINFOEXW VersionInfo,
IN ULONG TypeMask,
IN ULONGLONG ConditionMask);
_IRQL_requires_max_(PASSIVE_LEVEL)
_Must_inspect_result_
NTSYSAPI

View file

@ -221,6 +221,68 @@ typedef BOOLEAN
(*PFN_RTL_IS_SERVICE_PACK_VERSION_INSTALLED)(
_In_ ULONG Version);
typedef struct _OSVERSIONINFOA {
ULONG dwOSVersionInfoSize;
ULONG dwMajorVersion;
ULONG dwMinorVersion;
ULONG dwBuildNumber;
ULONG dwPlatformId;
CHAR szCSDVersion[128];
} OSVERSIONINFOA, *POSVERSIONINFOA, *LPOSVERSIONINFOA;
typedef struct _OSVERSIONINFOW {
ULONG dwOSVersionInfoSize;
ULONG dwMajorVersion;
ULONG dwMinorVersion;
ULONG dwBuildNumber;
ULONG dwPlatformId;
WCHAR szCSDVersion[128];
} OSVERSIONINFOW, *POSVERSIONINFOW, *LPOSVERSIONINFOW, RTL_OSVERSIONINFOW, *PRTL_OSVERSIONINFOW;
typedef struct _OSVERSIONINFOEXA {
ULONG dwOSVersionInfoSize;
ULONG dwMajorVersion;
ULONG dwMinorVersion;
ULONG dwBuildNumber;
ULONG dwPlatformId;
CHAR szCSDVersion[128];
USHORT wServicePackMajor;
USHORT wServicePackMinor;
USHORT wSuiteMask;
UCHAR wProductType;
UCHAR wReserved;
} OSVERSIONINFOEXA, *POSVERSIONINFOEXA, *LPOSVERSIONINFOEXA;
typedef struct _OSVERSIONINFOEXW {
ULONG dwOSVersionInfoSize;
ULONG dwMajorVersion;
ULONG dwMinorVersion;
ULONG dwBuildNumber;
ULONG dwPlatformId;
WCHAR szCSDVersion[128];
USHORT wServicePackMajor;
USHORT wServicePackMinor;
USHORT wSuiteMask;
UCHAR wProductType;
UCHAR wReserved;
} OSVERSIONINFOEXW, *POSVERSIONINFOEXW, *LPOSVERSIONINFOEXW, RTL_OSVERSIONINFOEXW, *PRTL_OSVERSIONINFOEXW;
#ifdef UNICODE
typedef OSVERSIONINFOEXW OSVERSIONINFOEX;
typedef POSVERSIONINFOEXW POSVERSIONINFOEX;
typedef LPOSVERSIONINFOEXW LPOSVERSIONINFOEX;
typedef OSVERSIONINFOW OSVERSIONINFO;
typedef POSVERSIONINFOW POSVERSIONINFO;
typedef LPOSVERSIONINFOW LPOSVERSIONINFO;
#else
typedef OSVERSIONINFOEXA OSVERSIONINFOEX;
typedef POSVERSIONINFOEXA POSVERSIONINFOEX;
typedef LPOSVERSIONINFOEXA LPOSVERSIONINFOEX;
typedef OSVERSIONINFOA OSVERSIONINFO;
typedef POSVERSIONINFOA POSVERSIONINFO;
typedef LPOSVERSIONINFOA LPOSVERSIONINFO;
#endif /* UNICODE */
$endif (_WDMDDK_)
$if (_NTDDK_)
@ -461,68 +523,6 @@ typedef struct _RTL_DYNAMIC_HASH_TABLE {
PVOID Directory;
} RTL_DYNAMIC_HASH_TABLE, *PRTL_DYNAMIC_HASH_TABLE;
typedef struct _OSVERSIONINFOA {
ULONG dwOSVersionInfoSize;
ULONG dwMajorVersion;
ULONG dwMinorVersion;
ULONG dwBuildNumber;
ULONG dwPlatformId;
CHAR szCSDVersion[128];
} OSVERSIONINFOA, *POSVERSIONINFOA, *LPOSVERSIONINFOA;
typedef struct _OSVERSIONINFOW {
ULONG dwOSVersionInfoSize;
ULONG dwMajorVersion;
ULONG dwMinorVersion;
ULONG dwBuildNumber;
ULONG dwPlatformId;
WCHAR szCSDVersion[128];
} OSVERSIONINFOW, *POSVERSIONINFOW, *LPOSVERSIONINFOW, RTL_OSVERSIONINFOW, *PRTL_OSVERSIONINFOW;
typedef struct _OSVERSIONINFOEXA {
ULONG dwOSVersionInfoSize;
ULONG dwMajorVersion;
ULONG dwMinorVersion;
ULONG dwBuildNumber;
ULONG dwPlatformId;
CHAR szCSDVersion[128];
USHORT wServicePackMajor;
USHORT wServicePackMinor;
USHORT wSuiteMask;
UCHAR wProductType;
UCHAR wReserved;
} OSVERSIONINFOEXA, *POSVERSIONINFOEXA, *LPOSVERSIONINFOEXA;
typedef struct _OSVERSIONINFOEXW {
ULONG dwOSVersionInfoSize;
ULONG dwMajorVersion;
ULONG dwMinorVersion;
ULONG dwBuildNumber;
ULONG dwPlatformId;
WCHAR szCSDVersion[128];
USHORT wServicePackMajor;
USHORT wServicePackMinor;
USHORT wSuiteMask;
UCHAR wProductType;
UCHAR wReserved;
} OSVERSIONINFOEXW, *POSVERSIONINFOEXW, *LPOSVERSIONINFOEXW, RTL_OSVERSIONINFOEXW, *PRTL_OSVERSIONINFOEXW;
#ifdef UNICODE
typedef OSVERSIONINFOEXW OSVERSIONINFOEX;
typedef POSVERSIONINFOEXW POSVERSIONINFOEX;
typedef LPOSVERSIONINFOEXW LPOSVERSIONINFOEX;
typedef OSVERSIONINFOW OSVERSIONINFO;
typedef POSVERSIONINFOW POSVERSIONINFO;
typedef LPOSVERSIONINFOW LPOSVERSIONINFO;
#else
typedef OSVERSIONINFOEXA OSVERSIONINFOEX;
typedef POSVERSIONINFOEXA POSVERSIONINFOEX;
typedef LPOSVERSIONINFOEXA LPOSVERSIONINFOEX;
typedef OSVERSIONINFOA OSVERSIONINFO;
typedef POSVERSIONINFOA POSVERSIONINFO;
typedef LPOSVERSIONINFOA LPOSVERSIONINFO;
#endif /* UNICODE */
#define HASH_ENTRY_KEY(x) ((x)->Signature)
$endif (_NTDDK_)

View file

@ -116,7 +116,7 @@ extern "C" {
#pragma warning(disable:4115) /* Named type definition in parentheses */
#pragma warning(disable:4201) /* Nameless unions and structs */
#pragma warning(disable:4214) /* Bit fields of other types than int */
#pragma warning(disable:4820) /* Padding added, due to alignemnet requirement */
#pragma warning(disable:4820) /* Padding added, due to alignment requirement */
/* Indicate if #pragma alloc_text() is supported */
#if defined(_M_IX86) || defined(_M_AMD64) || defined(_M_IA64)