diff --git a/rostests/apitests/ntdll/CMakeLists.txt b/rostests/apitests/ntdll/CMakeLists.txt index 12afccf20f6..b0a13e45b4a 100644 --- a/rostests/apitests/ntdll/CMakeLists.txt +++ b/rostests/apitests/ntdll/CMakeLists.txt @@ -7,6 +7,7 @@ list(APPEND SOURCE NtCreateThread.c NtFreeVirtualMemory.c NtMapViewOfSection.c + NtMutant.c NtProtectVirtualMemory.c NtQuerySystemEnvironmentValue.c NtQueryVolumeInformationFile.c diff --git a/rostests/apitests/ntdll/NtMapViewOfSection.c b/rostests/apitests/ntdll/NtMapViewOfSection.c index f347fa93a92..a6dfbe65b4c 100644 --- a/rostests/apitests/ntdll/NtMapViewOfSection.c +++ b/rostests/apitests/ntdll/NtMapViewOfSection.c @@ -4,6 +4,13 @@ #define WIN32_NO_STATUS #include +BOOL WINAPI SetInformationJobObject( + _In_ HANDLE hJob, + _In_ JOBOBJECTINFOCLASS JobObjectInfoClass, + _In_ LPVOID lpJobObjectInfo, + _In_ DWORD cbJobObjectInfoLength +); + NTSYSAPI NTSTATUS NTAPI @@ -25,10 +32,12 @@ Test_PageFileSection(void) NTSTATUS Status; HANDLE SectionHandle; LARGE_INTEGER MaximumSize, SectionOffset; - PVOID BaseAddress; + PVOID BaseAddress, BaseAddress2; SIZE_T ViewSize; + //ULONG OldProtect; + QUOTA_LIMITS QuotaLimits; - /* Create a page file backed section */ + /* Create a page file backed section with SEC_COMMIT */ MaximumSize.QuadPart = 0x20000; Status = NtCreateSection(&SectionHandle, SECTION_ALL_ACCESS, @@ -37,7 +46,7 @@ Test_PageFileSection(void) PAGE_READWRITE, SEC_COMMIT, NULL); - ok(NT_SUCCESS(Status), "NtCreateSection failed with Status %lx\n", Status); + ok_ntstatus(Status, STATUS_SUCCESS); if (!NT_SUCCESS(Status)) return; @@ -55,8 +64,7 @@ Test_PageFileSection(void) ViewShare, 0, PAGE_READWRITE); - ok(Status == STATUS_MAPPED_ALIGNMENT, - "NtMapViewOfSection returned wrong Status %lx\n", Status); + ok_ntstatus(Status, STATUS_MAPPED_ALIGNMENT); /* Try to map a page with execute rights */ BaseAddress = (PVOID)0x30000000; @@ -72,10 +80,25 @@ Test_PageFileSection(void) ViewShare, 0, PAGE_EXECUTE_READWRITE); - ok(Status == STATUS_SECTION_PROTECTION, - "NtMapViewOfSection returned wrong Status %lx\n", Status); + ok_ntstatus(Status, STATUS_SECTION_PROTECTION); - /* Map 2 pages, not comitting them */ + /* Try to map 2 pages with MEM_COMMIT */ + BaseAddress = (PVOID)0x30000000; + SectionOffset.QuadPart = 0; + ViewSize = 0x2000; + Status = NtMapViewOfSection(SectionHandle, + NtCurrentProcess(), + &BaseAddress, + 0, + PAGE_SIZE, + &SectionOffset, + &ViewSize, + ViewShare, + MEM_COMMIT, + PAGE_READWRITE); + ok_ntstatus(Status, STATUS_INVALID_PARAMETER_9); + + /* Map 2 pages, without MEM_COMMIT */ BaseAddress = (PVOID)0x30000000; SectionOffset.QuadPart = 0; ViewSize = 0x2000; @@ -89,9 +112,18 @@ Test_PageFileSection(void) ViewShare, 0, PAGE_READWRITE); - ok(NT_SUCCESS(Status), "NtMapViewOfSection failed with Status %lx\n", Status); - if (!NT_SUCCESS(Status)) - return; + ok_ntstatus(Status, STATUS_SUCCESS); + + /* We must be able to access the memory */ + _SEH2_TRY + { + *(PULONG)BaseAddress = 1; + } + _SEH2_EXCEPT(1) + { + ok(FALSE, "Got an exception\n"); + } + _SEH2_END; /* Commit a page in the section */ BaseAddress = (PVOID)0x30000000; @@ -102,12 +134,15 @@ Test_PageFileSection(void) &ViewSize, MEM_COMMIT, PAGE_READWRITE); - ok(NT_SUCCESS(Status), "NtAllocateVirtualMemory failed with Status %lx\n", Status); + ok_ntstatus(Status, STATUS_SUCCESS); + + /* Try to decommit a page in the section */ Status = NtFreeVirtualMemory(NtCurrentProcess(), &BaseAddress, &ViewSize, MEM_DECOMMIT); - ok(Status == STATUS_UNABLE_TO_DELETE_SECTION, "NtFreeVirtualMemory returned wrong Status %lx\n", Status); + ok_ntstatus(Status, STATUS_UNABLE_TO_DELETE_SECTION); + /* Try to commit a range larger than the section */ BaseAddress = (PVOID)0x30000000; ViewSize = 0x3000; @@ -117,8 +152,7 @@ Test_PageFileSection(void) &ViewSize, MEM_COMMIT, PAGE_READWRITE); - ok(Status == STATUS_CONFLICTING_ADDRESSES, - "NtAllocateVirtualMemory failed with wrong Status %lx\n", Status); + ok_ntstatus(Status, STATUS_CONFLICTING_ADDRESSES); /* Try to commit a page after the section */ BaseAddress = (PVOID)0x30002000; @@ -129,7 +163,7 @@ Test_PageFileSection(void) &ViewSize, MEM_COMMIT, PAGE_READWRITE); - ok(!NT_SUCCESS(Status), "NtAllocateVirtualMemory Should fail\n"); + ok_ntstatus(Status, STATUS_CONFLICTING_ADDRESSES); /* Try to allocate a page after the section */ BaseAddress = (PVOID)0x30002000; @@ -140,7 +174,7 @@ Test_PageFileSection(void) &ViewSize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); - ok(!NT_SUCCESS(Status), "NtAllocateVirtualMemory should fail\n"); + ok_ntstatus(Status, STATUS_CONFLICTING_ADDRESSES); /* Need to go to next 64k boundary */ BaseAddress = (PVOID)0x30010000; @@ -151,7 +185,7 @@ Test_PageFileSection(void) &ViewSize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); - ok(NT_SUCCESS(Status), "NtAllocateVirtualMemory failed with Status %lx\n", Status); + ok_ntstatus(Status, STATUS_SUCCESS); if (!NT_SUCCESS(Status)) return; @@ -164,15 +198,14 @@ Test_PageFileSection(void) MEM_RELEASE); ok(NT_SUCCESS(Status), "NtFreeVirtualMemory failed with Status %lx\n", Status); - /* Free the section mapping */ + /* Try to release the section mapping with NtFreeVirtualMemory */ BaseAddress = (PVOID)0x30000000; ViewSize = 0x1000; Status = NtFreeVirtualMemory(NtCurrentProcess(), &BaseAddress, &ViewSize, MEM_RELEASE); - ok(Status == STATUS_UNABLE_TO_DELETE_SECTION, - "NtFreeVirtualMemory failed with wrong Status %lx\n", Status); + ok_ntstatus(Status, STATUS_UNABLE_TO_DELETE_SECTION); /* Commit a page in the section */ BaseAddress = (PVOID)0x30001000; @@ -183,7 +216,7 @@ Test_PageFileSection(void) &ViewSize, MEM_COMMIT, PAGE_READWRITE); - ok(NT_SUCCESS(Status), "NtAllocateVirtualMemory failed with Status %lx\n", Status); + ok_ntstatus(Status, STATUS_SUCCESS); /* Try to decommit the page */ BaseAddress = (PVOID)0x30001000; @@ -192,8 +225,7 @@ Test_PageFileSection(void) &BaseAddress, &ViewSize, MEM_DECOMMIT); - ok(Status == STATUS_UNABLE_TO_DELETE_SECTION, - "NtFreeVirtualMemory failed with wrong Status %lx\n", Status); + ok_ntstatus(Status, STATUS_UNABLE_TO_DELETE_SECTION); BaseAddress = UlongToPtr(0x40000000); SectionOffset.QuadPart = 0; @@ -208,7 +240,7 @@ Test_PageFileSection(void) ViewShare, 0, PAGE_READWRITE); - ok(NT_SUCCESS(Status), "NtMapViewOfSection failed with Status %lx\n", Status); + ok_ntstatus(Status, STATUS_SUCCESS); if (!NT_SUCCESS(Status)) return; @@ -227,9 +259,7 @@ Test_PageFileSection(void) ViewShare, 0, PAGE_READWRITE); - ok(NT_SUCCESS(Status), "NtMapViewOfSection failed with Status %lx\n", Status); - if (!NT_SUCCESS(Status)) - return; + ok_ntstatus(Status, STATUS_SUCCESS); ok(BaseAddress == (PVOID)0x40080000, "Invalid BaseAddress: %p", BaseAddress); @@ -241,9 +271,273 @@ Test_PageFileSection(void) &ViewSize, MEM_COMMIT, PAGE_READWRITE); - ok(NT_SUCCESS(Status), "NtAllocateVirtualMemory failed with Status %lx\n", Status); - if (!NT_SUCCESS(Status)) - return; + ok_ntstatus(Status, STATUS_SUCCESS); + + /* Close the mapping */ + NtUnmapViewOfSection(NtCurrentProcess(), BaseAddress); + NtClose(SectionHandle); + + /* Create a page file backed section, but only reserved */ + MaximumSize.QuadPart = 0x20000; + Status = NtCreateSection(&SectionHandle, + SECTION_ALL_ACCESS, + NULL, + &MaximumSize, + PAGE_READWRITE, + SEC_RESERVE, + NULL); + ok_ntstatus(Status, STATUS_SUCCESS); + + /* Try to map 1 page, passing MEM_RESERVE */ + BaseAddress = NULL; + SectionOffset.QuadPart = 0; + ViewSize = PAGE_SIZE; + Status = NtMapViewOfSection(SectionHandle, + NtCurrentProcess(), + &BaseAddress, + 0, + PAGE_SIZE, + &SectionOffset, + &ViewSize, + ViewShare, + MEM_RESERVE, + PAGE_READWRITE); + ok_ntstatus(Status, STATUS_INVALID_PARAMETER_9); + + /* Try to map 1 page using MEM_COMMIT */ + BaseAddress = NULL; + SectionOffset.QuadPart = 0; + ViewSize = PAGE_SIZE; + Status = NtMapViewOfSection(SectionHandle, + NtCurrentProcess(), + &BaseAddress, + 0, + PAGE_SIZE, + &SectionOffset, + &ViewSize, + ViewShare, + MEM_COMMIT, + PAGE_READWRITE); + ok_ntstatus(Status, STATUS_INVALID_PARAMETER_9); + + /* Map 2 pages, but commit 1 */ + BaseAddress = NULL; + SectionOffset.QuadPart = 0; + ViewSize = 2 * PAGE_SIZE; + Status = NtMapViewOfSection(SectionHandle, + NtCurrentProcess(), + &BaseAddress, + 0, + PAGE_SIZE, + &SectionOffset, + &ViewSize, + ViewShare, + 0, + PAGE_READWRITE); + ok_ntstatus(Status, STATUS_SUCCESS); + + /* We must be able to access the 1st page */ + Status = STATUS_SUCCESS; + _SEH2_TRY + { + *(PUCHAR)BaseAddress = 1; + } + _SEH2_EXCEPT(1) + { + Status = _SEH2_GetExceptionCode(); + } + _SEH2_END; + ok_ntstatus(Status, STATUS_SUCCESS); + + /* We must not be able to access the 2nd page */ + Status = STATUS_SUCCESS; + _SEH2_TRY + { + *((PUCHAR)BaseAddress + PAGE_SIZE) = 1; + } + _SEH2_EXCEPT(1) + { + Status = _SEH2_GetExceptionCode(); + } + _SEH2_END; + ok_ntstatus(Status, STATUS_ACCESS_VIOLATION); + + /* Map the 2 pages again into a different memory location */ + BaseAddress2 = NULL; + Status = NtMapViewOfSection(SectionHandle, + NtCurrentProcess(), + &BaseAddress2, + 0, + 0, + &SectionOffset, + &ViewSize, + ViewShare, + 0, + PAGE_READWRITE); + ok_ntstatus(Status, STATUS_SUCCESS); + + /* Commit a the 2nd page in the 2nd memory location */ + BaseAddress2 = (PUCHAR)BaseAddress2 + PAGE_SIZE; + ViewSize = PAGE_SIZE; + Status = NtAllocateVirtualMemory(NtCurrentProcess(), + &BaseAddress2, + 0, + &ViewSize, + MEM_COMMIT, + PAGE_READONLY); + ok_ntstatus(Status, STATUS_SUCCESS); + + /* Try to commit again (the already committed page) */ + Status = NtAllocateVirtualMemory(NtCurrentProcess(), + &BaseAddress2, + 0, + &ViewSize, + MEM_COMMIT, + PAGE_READONLY); + ok_ntstatus(Status, STATUS_SUCCESS); + + /* We must be able to access the memory in the 2nd page of the 1st memory location */ + Status = STATUS_SUCCESS; + _SEH2_TRY + { + *((PUCHAR)BaseAddress + PAGE_SIZE) = 2; + } + _SEH2_EXCEPT(1) + { + Status = _SEH2_GetExceptionCode(); + } + _SEH2_END; + ok_ntstatus(Status, STATUS_SUCCESS); + + ok(*(PULONG)BaseAddress2 == 2, "Value in memory was wrong"); + + /* Close the mapping */ + NtUnmapViewOfSection(NtCurrentProcess(), BaseAddress); + NtUnmapViewOfSection(NtCurrentProcess(), (PUCHAR)BaseAddress2 - PAGE_SIZE); + NtClose(SectionHandle); + +#if 0 + { + HANDLE Job; + JOBOBJECT_EXTENDED_LIMIT_INFORMATION JobLimitInformation; + + Job = CreateJobObject(NULL, NULL); + ok_ntstatus(Status, STATUS_SUCCESS); + + ok(AssignProcessToJobObject(Job, NtCurrentProcess()), ""); + + RtlZeroMemory(&JobLimitInformation, sizeof(JobLimitInformation)); + JobLimitInformation.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_JOB_MEMORY; + JobLimitInformation.JobMemoryLimit = 100 * 1024; + JobLimitInformation.PeakProcessMemoryUsed = JobLimitInformation.JobMemoryLimit; + JobLimitInformation.PeakJobMemoryUsed = JobLimitInformation.JobMemoryLimit; + + ok(SetInformationJobObject(Job, + JobObjectExtendedLimitInformation, + &JobLimitInformation, + sizeof(JobLimitInformation)), ""); + } +#endif + + QuotaLimits.PagedPoolLimit = 0; + QuotaLimits.NonPagedPoolLimit = 0; + QuotaLimits.TimeLimit.QuadPart = 0; + QuotaLimits.PagefileLimit = 0; + QuotaLimits.MinimumWorkingSetSize = 90000; + QuotaLimits.MaximumWorkingSetSize = 90000; + Status = NtSetInformationProcess(NtCurrentProcess(), + ProcessQuotaLimits, + &QuotaLimits, + sizeof(QuotaLimits)); + ok_ntstatus(Status, STATUS_SUCCESS); + + QuotaLimits.MinimumWorkingSetSize = 0; + QuotaLimits.MaximumWorkingSetSize = 0; + QuotaLimits.PagefileLimit = 1; + Status = NtSetInformationProcess(NtCurrentProcess(), + ProcessQuotaLimits, + &QuotaLimits, + sizeof(QuotaLimits)); + ok_ntstatus(Status, STATUS_SUCCESS); + + /* Try to create a huge page file backed section */ + MaximumSize.QuadPart = 0x800000000; + Status = NtCreateSection(&SectionHandle, + SECTION_ALL_ACCESS, + NULL, + &MaximumSize, + PAGE_READWRITE, + SEC_COMMIT, + NULL); + ok_ntstatus(Status, STATUS_COMMITMENT_LIMIT); + + /* Try to create a huge page file backed section with PAGE_NOACCESS protection */ + MaximumSize.QuadPart = 0x8000000000; + Status = NtCreateSection(&SectionHandle, + SECTION_ALL_ACCESS, + NULL, + &MaximumSize, + PAGE_NOACCESS, + SEC_COMMIT, + NULL); + ok_ntstatus(Status, STATUS_INVALID_PAGE_PROTECTION); + + /* Create a huge page file backed section, but only reserved */ + MaximumSize.QuadPart = 0x8000000000; + Status = NtCreateSection(&SectionHandle, + SECTION_ALL_ACCESS, + NULL, + &MaximumSize, + PAGE_READWRITE, + SEC_RESERVE, + NULL); + ok_ntstatus(Status, STATUS_SUCCESS); + + /* Pass a too large region size */ + BaseAddress = NULL; + SectionOffset.QuadPart = 0; + ViewSize = 0x80000000; + Status = NtMapViewOfSection(SectionHandle, + NtCurrentProcess(), + &BaseAddress, + 0, + 0, + &SectionOffset, + &ViewSize, + ViewShare, + 0, + PAGE_READWRITE); + ok_ntstatus(Status, STATUS_INVALID_PARAMETER_4); + + /* Map with PAGE_NOACCESS */ + BaseAddress = NULL; + SectionOffset.QuadPart = 0; + ViewSize = 0x20000000; + Status = NtMapViewOfSection(SectionHandle, + NtCurrentProcess(), + &BaseAddress, + 0, + 0, + &SectionOffset, + &ViewSize, + ViewShare, + 0, + PAGE_NOACCESS); + ok_ntstatus(Status, STATUS_SUCCESS); + + /* Update protection to PAGE_READWRITE */ + ViewSize = 0x20000000; + Status = NtAllocateVirtualMemory(NtCurrentProcess(), &BaseAddress, 0, &ViewSize, MEM_COMMIT, PAGE_READWRITE); + ok_ntstatus(Status, STATUS_SUCCESS); + + //Status = NtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &ViewSize, PAGE_READWRITE, &OldProtect); + //ok_ntstatus(Status, STATUS_SUCCESS); + //ok(OldProtect == PAGE_NOACCESS, "Wrong protection returned: %u\n", OldProtect); + + /* Update protection to PAGE_READWRITE (1 page) */ + ViewSize = 0x1000; + Status = NtAllocateVirtualMemory(NtCurrentProcess(), &BaseAddress, 0, &ViewSize, MEM_COMMIT, PAGE_READWRITE); + ok_ntstatus(Status, STATUS_SUCCESS); } @@ -291,7 +585,7 @@ Test_ImageSection(void) FileHandle); ok(Status == STATUS_SUCCESS, "NtCreateSection failed, Status 0x%lx\n", Status); - /* Map the data section */ + /* Map the data section as flat mapping */ DataBase = NULL; ViewSize = 0; Status = NtMapViewOfSection(DataSectionHandle, @@ -351,12 +645,12 @@ Test_ImageSection(void) Status = NtMapViewOfSection(ImageSectionHandle, NtCurrentProcess(), &ImageBase, - 0, - 0, - NULL, + 0, // ZeroBits + 0, // CommitSize + NULL, // SectionOffset &ViewSize, ViewShare, - 0, + 0, // AllocationType PAGE_READONLY); #ifdef _M_IX86 ok(Status == STATUS_SUCCESS, "NtMapViewOfSection failed, Status 0x%lx\n", Status); @@ -459,10 +753,93 @@ Test_ImageSection(void) NtUnmapViewOfSection(NtCurrentProcess(), ImageBase); } +void +Test_ImageSection2(void) +{ + UNICODE_STRING FileName; + NTSTATUS Status; + OBJECT_ATTRIBUTES FileObjectAttributes; + IO_STATUS_BLOCK IoStatusBlock; + HANDLE FileHandle, ImageSectionHandle; + PVOID ImageBase, BaseAddress; + SIZE_T ViewSize; + LARGE_INTEGER MaximumSize, SectionOffset; + + if (!RtlDosPathNameToNtPathName_U(L"testdata\\nvoglv32.dll", + &FileName, + NULL, + NULL)) + { + ok(0, "RtlDosPathNameToNtPathName_U failed\n"); + return; + } + + InitializeObjectAttributes(&FileObjectAttributes, + &FileName, + 0, + NULL, + NULL); + + Status = NtOpenFile(&FileHandle, + GENERIC_READ|GENERIC_WRITE|SYNCHRONIZE, + &FileObjectAttributes, + &IoStatusBlock, + FILE_SHARE_READ, + FILE_SYNCHRONOUS_IO_NONALERT); + ok(Status == STATUS_SUCCESS, "NtOpenFile failed, Status 0x%lx\n", Status); + printf("Opened file with handle %p\n", FileHandle); + + /* Create a data section with write access */ + MaximumSize.QuadPart = 0x20000; + Status = NtCreateSection(&ImageSectionHandle, + SECTION_ALL_ACCESS, // DesiredAccess + NULL, // ObjectAttributes + &MaximumSize, // MaximumSize + PAGE_READWRITE, // SectionPageProtection + SEC_IMAGE, // AllocationAttributes + FileHandle); + ok(Status == STATUS_SUCCESS, "NtCreateSection failed, Status 0x%lx\n", Status); + + printf("Created image section with handle %p\n", ImageSectionHandle); + //system("PAUSE"); + + /* Map the image section */ + ImageBase = NULL; + ViewSize = 0x0000; + SectionOffset.QuadPart = 0x00000; + Status = NtMapViewOfSection(ImageSectionHandle, + NtCurrentProcess(), + &ImageBase, + 0, + 0, + &SectionOffset, + &ViewSize, + ViewShare, + 0, + PAGE_READWRITE); + ok(Status == STATUS_SUCCESS, "NtMapViewOfSection failed, Status 0x%lx\n", Status); + + printf("Mapped image section at %p, value in text section: %lx\n", + ImageBase, *((ULONG*)((PCHAR)ImageBase + 0x1196))); + system("PAUSE"); + + /* Try to allocate a page after the section */ + BaseAddress = (PUCHAR)ImageBase + 0x10000; + ViewSize = 0x1000; + Status = NtAllocateVirtualMemory(NtCurrentProcess(), + &BaseAddress, + 0, + &ViewSize, + MEM_RESERVE | MEM_COMMIT, + PAGE_READWRITE); + printf("allocation status: %lx\n", Status); + system("PAUSE"); + +} START_TEST(NtMapViewOfSection) { Test_PageFileSection(); - Test_ImageSection(); + //Test_ImageSection2(); } diff --git a/rostests/apitests/ntdll/NtMutant.c b/rostests/apitests/ntdll/NtMutant.c new file mode 100644 index 00000000000..a274bb44b79 --- /dev/null +++ b/rostests/apitests/ntdll/NtMutant.c @@ -0,0 +1,26 @@ + +#include + +#include + + +VOID +Test_Release(VOID) +{ + HANDLE MutantHandle; + NTSTATUS Status; + + Status = NtCreateMutant(&MutantHandle, 0, NULL, TRUE); + ok_ntstatus(Status, STATUS_SUCCESS); + + Status = NtReleaseMutant(MutantHandle, NULL); + ok_ntstatus(Status, STATUS_SUCCESS); + +} + + + +START_TEST(NtMutant) +{ + Test_Release(); +} diff --git a/rostests/apitests/ntdll/testlist.c b/rostests/apitests/ntdll/testlist.c index ff74480ea57..40bec87cde6 100644 --- a/rostests/apitests/ntdll/testlist.c +++ b/rostests/apitests/ntdll/testlist.c @@ -10,6 +10,7 @@ extern void func_NtCreateFile(void); extern void func_NtCreateThread(void); extern void func_NtFreeVirtualMemory(void); extern void func_NtMapViewOfSection(void); +extern void func_NtMutant(void); extern void func_NtProtectVirtualMemory(void); extern void func_NtQuerySystemEnvironmentValue(void); extern void func_NtQueryVolumeInformationFile(void); @@ -38,6 +39,7 @@ const struct test winetest_testlist[] = { "NtCreateThread", func_NtCreateThread }, { "NtFreeVirtualMemory", func_NtFreeVirtualMemory }, { "NtMapViewOfSection", func_NtMapViewOfSection }, + { "NtMutant", func_NtMutant }, { "NtProtectVirtualMemory", func_NtProtectVirtualMemory }, { "NtQuerySystemEnvironmentValue", func_NtQuerySystemEnvironmentValue }, { "NtQueryVolumeInformationFile", func_NtQueryVolumeInformationFile },