?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
winepulse: Set pulse master volume to 0 when session is muted.
[wine.git] / include / winternl.h
blob691638f359cf0365062ab463546803dff41c2dfe
1 /*
2 * Internal NT APIs and data structures
3 *
4 * Copyright (C) the Wine project
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
19 */
20
21 #ifndef __WINE_WINTERNL_H
22 #define __WINE_WINTERNL_H
23
24 #include <ntdef.h>
25 #include <windef.h>
26
27 #ifdef __cplusplus
28 extern "C" {
29 #endif /* defined(__cplusplus) */
30
31
32 /**********************************************************************
33 * Fundamental types and data structures
34 */
35
36 #ifndef WINE_NTSTATUS_DECLARED
37 #define WINE_NTSTATUS_DECLARED
38 typedef LONG NTSTATUS;
39 #endif
40
41 typedef const char *PCSZ;
42
43 typedef short CSHORT;
44 typedef CSHORT *PCSHORT;
45
46 #ifndef __STRING_DEFINED__
47 #define __STRING_DEFINED__
48 typedef struct _STRING {
49 USHORT Length;
50 USHORT MaximumLength;
51 PCHAR Buffer;
52 } STRING, *PSTRING;
53 #endif
54
55 typedef STRING ANSI_STRING;
56 typedef PSTRING PANSI_STRING;
57 typedef const STRING *PCANSI_STRING;
58
59 typedef STRING OEM_STRING;
60 typedef PSTRING POEM_STRING;
61 typedef const STRING *PCOEM_STRING;
62
63 #ifndef __UNICODE_STRING_DEFINED__
64 #define __UNICODE_STRING_DEFINED__
65 typedef struct _UNICODE_STRING {
66 USHORT Length; /* bytes */
67 USHORT MaximumLength; /* bytes */
68 PWSTR Buffer;
69 } UNICODE_STRING, *PUNICODE_STRING;
70 #endif
71
72 typedef const UNICODE_STRING *PCUNICODE_STRING;
73
74 #ifndef _FILETIME_
75 #define _FILETIME_
76 /* 64 bit number of 100 nanoseconds intervals since January 1, 1601 */
77 typedef struct _FILETIME
78 {
79 #ifdef WORDS_BIGENDIAN
80 DWORD dwHighDateTime;
81 DWORD dwLowDateTime;
82 #else
83 DWORD dwLowDateTime;
84 DWORD dwHighDateTime;
85 #endif
86 } FILETIME, *PFILETIME, *LPFILETIME;
87 #endif /* _FILETIME_ */
88
89 /*
90 * RTL_SYSTEM_TIME and RTL_TIME_ZONE_INFORMATION are the same as
91 * the SYSTEMTIME and TIME_ZONE_INFORMATION structures defined
92 * in winbase.h, however we need to define them separately so
93 * winternl.h doesn't depend on winbase.h. They are used by
94 * RtlQueryTimeZoneInformation and RtlSetTimeZoneInformation.
95 * The names are guessed; if anybody knows the real names, let me know.
96 */
97 typedef struct _RTL_SYSTEM_TIME {
98 WORD wYear;
99 WORD wMonth;
100 WORD wDayOfWeek;
101 WORD wDay;
102 WORD wHour;
103 WORD wMinute;
104 WORD wSecond;
105 WORD wMilliseconds;
106 } RTL_SYSTEM_TIME, *PRTL_SYSTEM_TIME;
107
108 typedef struct _RTL_TIME_ZONE_INFORMATION {
109 LONG Bias;
110 WCHAR StandardName[32];
111 RTL_SYSTEM_TIME StandardDate;
112 LONG StandardBias;
113 WCHAR DaylightName[32];
114 RTL_SYSTEM_TIME DaylightDate;
115 LONG DaylightBias;
116 } RTL_TIME_ZONE_INFORMATION, *PRTL_TIME_ZONE_INFORMATION;
117
118 typedef struct _RTL_TIME_DYNAMIC_ZONE_INFORMATION
119 {
120 LONG Bias;
121 WCHAR StandardName[32];
122 RTL_SYSTEM_TIME StandardDate;
123 LONG StandardBias;
124 WCHAR DaylightName[32];
125 RTL_SYSTEM_TIME DaylightDate;
126 LONG DaylightBias;
127 WCHAR TimeZoneKeyName[128];
128 BOOLEAN DynamicDaylightTimeDisabled;
129 } RTL_DYNAMIC_TIME_ZONE_INFORMATION, *PRTL_DYNAMIC_TIME_ZONE_INFORMATION;
130
131 typedef struct _CLIENT_ID
132 {
133 HANDLE UniqueProcess;
134 HANDLE UniqueThread;
135 } CLIENT_ID, *PCLIENT_ID;
136
137 typedef struct _CURDIR
138 {
139 UNICODE_STRING DosPath;
140 PVOID Handle;
141 } CURDIR, *PCURDIR;
142
143 typedef struct RTL_DRIVE_LETTER_CURDIR
144 {
145 USHORT Flags;
146 USHORT Length;
147 ULONG TimeStamp;
148 UNICODE_STRING DosPath;
149 } RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
150
151 typedef struct _RTL_RELATIVE_NAME
152 {
153 UNICODE_STRING RelativeName;
154 HANDLE ContainerDirectory;
155 void *CurDirRef;
156 } RTL_RELATIVE_NAME, *PRTL_RELATIVE_NAME;
157
158 typedef struct tagRTL_BITMAP {
159 ULONG SizeOfBitMap; /* Number of bits in the bitmap */
160 PULONG Buffer; /* Bitmap data, assumed sized to a DWORD boundary */
161 } RTL_BITMAP, *PRTL_BITMAP;
162
163 typedef const RTL_BITMAP *PCRTL_BITMAP;
164
165 typedef struct tagRTL_BITMAP_RUN {
166 ULONG StartingIndex; /* Bit position at which run starts */
167 ULONG NumberOfBits; /* Size of the run in bits */
168 } RTL_BITMAP_RUN, *PRTL_BITMAP_RUN;
169
170 typedef const RTL_BITMAP_RUN *PCRTL_BITMAP_RUN;
171
172 typedef struct _RTL_USER_PROCESS_PARAMETERS
173 {
174 ULONG AllocationSize;
175 ULONG Size;
176 ULONG Flags;
177 ULONG DebugFlags;
178 HANDLE ConsoleHandle;
179 ULONG ConsoleFlags;
180 HANDLE hStdInput;
181 HANDLE hStdOutput;
182 HANDLE hStdError;
183 CURDIR CurrentDirectory;
184 UNICODE_STRING DllPath;
185 UNICODE_STRING ImagePathName;
186 UNICODE_STRING CommandLine;
187 PWSTR Environment;
188 ULONG dwX;
189 ULONG dwY;
190 ULONG dwXSize;
191 ULONG dwYSize;
192 ULONG dwXCountChars;
193 ULONG dwYCountChars;
194 ULONG dwFillAttribute;
195 ULONG dwFlags;
196 ULONG wShowWindow;
197 UNICODE_STRING WindowTitle;
198 UNICODE_STRING Desktop;
199 UNICODE_STRING ShellInfo;
200 UNICODE_STRING RuntimeInfo;
201 RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];
202 ULONG EnvironmentSize;
203 ULONG EnvironmentVersion;
204 PVOID PackageDependencyData;
205 ULONG ProcessGroupId;
206 ULONG LoaderThreads;
207 } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
208
209 /* value for Flags field (FIXME: not the correct name) */
210 #define PROCESS_PARAMS_FLAG_NORMALIZED 1
211
212 typedef struct _PEB_LDR_DATA
213 {
214 ULONG Length;
215 BOOLEAN Initialized;
216 PVOID SsHandle;
217 LIST_ENTRY InLoadOrderModuleList;
218 LIST_ENTRY InMemoryOrderModuleList;
219 LIST_ENTRY InInitializationOrderModuleList;
220 PVOID EntryInProgress;
221 BOOLEAN ShutdownInProgress;
222 HANDLE ShutdownThreadId;
223 } PEB_LDR_DATA, *PPEB_LDR_DATA;
224
225 typedef struct _GDI_TEB_BATCH
226 {
227 ULONG Offset;
228 HANDLE HDC;
229 ULONG Buffer[0x136];
230 } GDI_TEB_BATCH;
231
232 typedef struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME
233 {
234 struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME *Previous;
235 struct _ACTIVATION_CONTEXT *ActivationContext;
236 ULONG Flags;
237 } RTL_ACTIVATION_CONTEXT_STACK_FRAME, *PRTL_ACTIVATION_CONTEXT_STACK_FRAME;
238
239 typedef struct _ACTIVATION_CONTEXT_STACK
240 {
241 RTL_ACTIVATION_CONTEXT_STACK_FRAME *ActiveFrame;
242 LIST_ENTRY FrameListCache;
243 ULONG Flags;
244 ULONG NextCookieSequenceNumber;
245 ULONG_PTR StackId;
246 } ACTIVATION_CONTEXT_STACK, *PACTIVATION_CONTEXT_STACK;
247
248 typedef struct _TEB_ACTIVE_FRAME_CONTEXT
249 {
250 ULONG Flags;
251 const char *FrameName;
252 } TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;
253
254 typedef struct _TEB_ACTIVE_FRAME_CONTEXT_EX
255 {
256 TEB_ACTIVE_FRAME_CONTEXT BasicContext;
257 const char *SourceLocation;
258 } TEB_ACTIVE_FRAME_CONTEXT_EX, *PTEB_ACTIVE_FRAME_CONTEXT_EX;
259
260 typedef struct _TEB_ACTIVE_FRAME
261 {
262 ULONG Flags;
263 struct _TEB_ACTIVE_FRAME *Previous;
264 TEB_ACTIVE_FRAME_CONTEXT *Context;
265 } TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;
266
267 typedef struct _TEB_ACTIVE_FRAME_EX
268 {
269 TEB_ACTIVE_FRAME BasicFrame;
270 void *ExtensionIdentifier;
271 } TEB_ACTIVE_FRAME_EX, *PTEB_ACTIVE_FRAME_EX;
272
273 typedef struct _FLS_CALLBACK
274 {
275 void *unknown;
276 PFLS_CALLBACK_FUNCTION callback; /* ~0 if NULL callback is set, NULL if FLS index is free. */
277 } FLS_CALLBACK, *PFLS_CALLBACK;
278
279 typedef struct _FLS_INFO_CHUNK
280 {
281 ULONG count; /* number of allocated FLS indexes in the chunk. */
282 FLS_CALLBACK callbacks[1]; /* the size is 0x10 for chunk 0 and is twice as
283 * the previous chunk size for the rest. */
284 } FLS_INFO_CHUNK, *PFLS_INFO_CHUNK;
285
286 typedef struct _GLOBAL_FLS_DATA
287 {
288 FLS_INFO_CHUNK *fls_callback_chunks[8];
289 LIST_ENTRY fls_list_head;
290 ULONG fls_high_index;
291 } GLOBAL_FLS_DATA, *PGLOBAL_FLS_DATA;
292
293 typedef struct _TEB_FLS_DATA
294 {
295 LIST_ENTRY fls_list_entry;
296 void **fls_data_chunks[8];
297 } TEB_FLS_DATA, *PTEB_FLS_DATA;
298
299 #define TEB_ACTIVE_FRAME_CONTEXT_FLAG_EXTENDED 0x00000001
300 #define TEB_ACTIVE_FRAME_FLAG_EXTENDED 0x00000001
301
302 /***********************************************************************
303 * PEB data structure
304 */
305 typedef struct _PEB
306 { /* win32/win64 */
307 BOOLEAN InheritedAddressSpace; /* 000/000 */
308 BOOLEAN ReadImageFileExecOptions; /* 001/001 */
309 BOOLEAN BeingDebugged; /* 002/002 */
310 BOOLEAN SpareBool; /* 003/003 */
311 HANDLE Mutant; /* 004/008 */
312 HMODULE ImageBaseAddress; /* 008/010 */
313 PPEB_LDR_DATA LdrData; /* 00c/018 */
314 RTL_USER_PROCESS_PARAMETERS *ProcessParameters; /* 010/020 */
315 PVOID SubSystemData; /* 014/028 */
316 HANDLE ProcessHeap; /* 018/030 */
317 PRTL_CRITICAL_SECTION FastPebLock; /* 01c/038 */
318 PVOID /*PPEBLOCKROUTINE*/ FastPebLockRoutine; /* 020/040 */
319 PVOID /*PPEBLOCKROUTINE*/ FastPebUnlockRoutine; /* 024/048 */
320 ULONG EnvironmentUpdateCount; /* 028/050 */
321 PVOID KernelCallbackTable; /* 02c/058 */
322 ULONG Reserved; /* 030/060 */
323 ULONG AtlThunkSListPtr32; /* 034/064 */
324 PVOID /*PPEB_FREE_BLOCK*/ FreeList; /* 038/068 */
325 ULONG TlsExpansionCounter; /* 03c/070 */
326 PRTL_BITMAP TlsBitmap; /* 040/078 */
327 ULONG TlsBitmapBits[2]; /* 044/080 */
328 PVOID ReadOnlySharedMemoryBase; /* 04c/088 */
329 PVOID ReadOnlySharedMemoryHeap; /* 050/090 */
330 PVOID *ReadOnlyStaticServerData; /* 054/098 */
331 PVOID AnsiCodePageData; /* 058/0a0 */
332 PVOID OemCodePageData; /* 05c/0a8 */
333 PVOID UnicodeCaseTableData; /* 060/0b0 */
334 ULONG NumberOfProcessors; /* 064/0b8 */
335 ULONG NtGlobalFlag; /* 068/0bc */
336 LARGE_INTEGER CriticalSectionTimeout; /* 070/0c0 */
337 SIZE_T HeapSegmentReserve; /* 078/0c8 */
338 SIZE_T HeapSegmentCommit; /* 07c/0d0 */
339 SIZE_T HeapDeCommitTotalFreeThreshold; /* 080/0d8 */
340 SIZE_T HeapDeCommitFreeBlockThreshold; /* 084/0e0 */
341 ULONG NumberOfHeaps; /* 088/0e8 */
342 ULONG MaximumNumberOfHeaps; /* 08c/0ec */
343 PVOID *ProcessHeaps; /* 090/0f0 */
344 PVOID GdiSharedHandleTable; /* 094/0f8 */
345 PVOID ProcessStarterHelper; /* 098/100 */
346 PVOID GdiDCAttributeList; /* 09c/108 */
347 PVOID LoaderLock; /* 0a0/110 */
348 ULONG OSMajorVersion; /* 0a4/118 */
349 ULONG OSMinorVersion; /* 0a8/11c */
350 ULONG OSBuildNumber; /* 0ac/120 */
351 ULONG OSPlatformId; /* 0b0/124 */
352 ULONG ImageSubSystem; /* 0b4/128 */
353 ULONG ImageSubSystemMajorVersion; /* 0b8/12c */
354 ULONG ImageSubSystemMinorVersion; /* 0bc/130 */
355 ULONG ImageProcessAffinityMask; /* 0c0/134 */
356 HANDLE GdiHandleBuffer[28]; /* 0c4/138 */
357 ULONG unknown[6]; /* 134/218 */
358 PVOID PostProcessInitRoutine; /* 14c/230 */
359 PRTL_BITMAP TlsExpansionBitmap; /* 150/238 */
360 ULONG TlsExpansionBitmapBits[32]; /* 154/240 */
361 ULONG SessionId; /* 1d4/2c0 */
362 ULARGE_INTEGER AppCompatFlags; /* 1d8/2c8 */
363 ULARGE_INTEGER AppCompatFlagsUser; /* 1e0/2d0 */
364 PVOID ShimData; /* 1e8/2d8 */
365 PVOID AppCompatInfo; /* 1ec/2e0 */
366 UNICODE_STRING CSDVersion; /* 1f0/2e8 */
367 PVOID ActivationContextData; /* 1f8/2f8 */
368 PVOID ProcessAssemblyStorageMap; /* 1fc/300 */
369 PVOID SystemDefaultActivationData; /* 200/308 */
370 PVOID SystemAssemblyStorageMap; /* 204/310 */
371 SIZE_T MinimumStackCommit; /* 208/318 */
372 PVOID *FlsCallback; /* 20c/320 */
373 LIST_ENTRY FlsListHead; /* 210/328 */
374 PRTL_BITMAP FlsBitmap; /* 218/338 */
375 ULONG FlsBitmapBits[4]; /* 21c/340 */
376 ULONG FlsHighIndex; /* 22c/350 */
377 PVOID WerRegistrationData; /* 230/358 */
378 PVOID WerShipAssertPtr; /* 234/360 */
379 PVOID pUnused; /* 238/368 */
380 PVOID pImageHeaderHash; /* 23c/370 */
381 ULONG TracingFlags; /* 240/378 */
382 ULONGLONG CsrServerReadOnlySharedMemoryBase; /* 248/380 */
383 ULONG TppWorkerpListLock; /* 250/388 */
384 LIST_ENTRY TppWorkerpList; /* 254/390 */
385 PVOID WaitOnAddressHashTable [0x80]; /* 25c/3a0 */
386 PVOID TelemetryCoverageHeader; /* 45c/7a0 */
387 ULONG CloudFileFlags; /* 460/7a8 */
388 ULONG CloudFileDiagFlags; /* 464/7ac */
389 CHAR PlaceholderCompatibilityMode; /* 468/7b0 */
390 CHAR PlaceholderCompatibilityModeReserved[7]; /* 469/7b1 */
391 PVOID LeapSecondData; /* 470/7b8 */
392 ULONG LeapSecondFlags; /* 474/7c0 */
393 ULONG NtGlobalFlag2; /* 478/7c4 */
394 } PEB, *PPEB;
395
396
397 /***********************************************************************
398 * TEB data structure
399 */
400 typedef struct _TEB
401 { /* win32/win64 */
402 NT_TIB Tib; /* 000/0000 */
403 PVOID EnvironmentPointer; /* 01c/0038 */
404 CLIENT_ID ClientId; /* 020/0040 */
405 PVOID ActiveRpcHandle; /* 028/0050 */
406 PVOID ThreadLocalStoragePointer; /* 02c/0058 */
407 PPEB Peb; /* 030/0060 */
408 ULONG LastErrorValue; /* 034/0068 */
409 ULONG CountOfOwnedCriticalSections; /* 038/006c */
410 PVOID CsrClientThread; /* 03c/0070 */
411 PVOID Win32ThreadInfo; /* 040/0078 */
412 ULONG User32Reserved[26]; /* 044/0080 */
413 ULONG UserReserved[5]; /* 0ac/00e8 */
414 PVOID WOW32Reserved; /* 0c0/0100 */
415 ULONG CurrentLocale; /* 0c4/0108 */
416 ULONG FpSoftwareStatusRegister; /* 0c8/010c */
417 PVOID ReservedForDebuggerInstrumentation[16]; /* 0cc/0110 */
418 #ifdef _WIN64
419 PVOID SystemReserved1[30]; /* /0190 */
420 #else
421 PVOID SystemReserved1[26]; /* 10c/ used for krnl386 private data in Wine */
422 #endif
423 char PlaceholderCompatibilityMode; /* 174/0280 */
424 char PlaceholderReserved[11]; /* 175/0281 */
425 DWORD ProxiedProcessId; /* 180/028c */
426 ACTIVATION_CONTEXT_STACK ActivationContextStack; /* 184/0290 */
427 UCHAR WorkingOnBehalfOfTicket[8]; /* 19c/02b8 */
428 LONG ExceptionCode; /* 1a4/02c0 */
429 ACTIVATION_CONTEXT_STACK *ActivationContextStackPointer; /* 1a8/02c8 */
430 ULONG_PTR InstrumentationCallbackSp; /* 1ac/02d0 */
431 ULONG_PTR InstrumentationCallbackPreviousPc; /* 1b0/02d8 */
432 ULONG_PTR InstrumentationCallbackPreviousSp; /* 1b4/02e0 */
433 #ifdef _WIN64
434 ULONG TxFsContext; /* /02e8 */
435 BOOLEAN InstrumentationCallbackDisabled; /* /02ec */
436 #else
437 BOOLEAN InstrumentationCallbackDisabled; /* 1b8/ */
438 BYTE SpareBytes1[23]; /* 1b9/ */
439 ULONG TxFsContext; /* 1d0/ */
440 #endif
441 GDI_TEB_BATCH GdiTebBatch; /* 1d4/02f0 used for ntdll private data in Wine */
442 CLIENT_ID RealClientId; /* 6b4/07d8 */
443 HANDLE GdiCachedProcessHandle; /* 6bc/07e8 */
444 ULONG GdiClientPID; /* 6c0/07f0 */
445 ULONG GdiClientTID; /* 6c4/07f4 */
446 PVOID GdiThreadLocaleInfo; /* 6c8/07f8 */
447 ULONG_PTR Win32ClientInfo[62]; /* 6cc/0800 used for user32 private data in Wine */
448 PVOID glDispatchTable[233]; /* 7c4/09f0 */
449 PVOID glReserved1[29]; /* b68/1138 */
450 PVOID glReserved2; /* bdc/1220 */
451 PVOID glSectionInfo; /* be0/1228 */
452 PVOID glSection; /* be4/1230 */
453 PVOID glTable; /* be8/1238 */
454 PVOID glCurrentRC; /* bec/1240 */
455 PVOID glContext; /* bf0/1248 */
456 ULONG LastStatusValue; /* bf4/1250 */
457 UNICODE_STRING StaticUnicodeString; /* bf8/1258 */
458 WCHAR StaticUnicodeBuffer[261]; /* c00/1268 */
459 PVOID DeallocationStack; /* e0c/1478 */
460 PVOID TlsSlots[64]; /* e10/1480 */
461 LIST_ENTRY TlsLinks; /* f10/1680 */
462 PVOID Vdm; /* f18/1690 */
463 PVOID ReservedForNtRpc; /* f1c/1698 */
464 PVOID DbgSsReserved[2]; /* f20/16a0 */
465 ULONG HardErrorDisabled; /* f28/16b0 */
466 PVOID Instrumentation[16]; /* f2c/16b8 */
467 PVOID WinSockData; /* f6c/1738 */
468 ULONG GdiBatchCount; /* f70/1740 */
469 ULONG Spare2; /* f74/1744 */
470 ULONG GuaranteedStackBytes; /* f78/1748 */
471 PVOID ReservedForPerf; /* f7c/1750 */
472 PVOID ReservedForOle; /* f80/1758 */
473 ULONG WaitingOnLoaderLock; /* f84/1760 */
474 PVOID Reserved5[3]; /* f88/1768 */
475 PVOID *TlsExpansionSlots; /* f94/1780 */
476 #ifdef _WIN64
477 PVOID DeallocationBStore; /* /1788 */
478 PVOID BStoreLimit; /* /1790 */
479 #endif
480 ULONG ImpersonationLocale; /* f98/1798 */
481 ULONG IsImpersonating; /* f9c/179c */
482 PVOID NlsCache; /* fa0/17a0 */
483 PVOID ShimData; /* fa4/17a8 */
484 ULONG HeapVirtualAffinity; /* fa8/17b0 */
485 PVOID CurrentTransactionHandle; /* fac/17b8 */
486 TEB_ACTIVE_FRAME *ActiveFrame; /* fb0/17c0 */
487 TEB_FLS_DATA *FlsSlots; /* fb4/17c8 */
488 PVOID PreferredLanguages; /* fb8/17d0 */
489 PVOID UserPrefLanguages; /* fbc/17d8 */
490 PVOID MergedPrefLanguages; /* fc0/17e0 */
491 ULONG MuiImpersonation; /* fc4/17e8 */
492 USHORT CrossTebFlags; /* fc8/17ec */
493 USHORT SameTebFlags; /* fca/17ee */
494 PVOID TxnScopeEnterCallback; /* fcc/17f0 */
495 PVOID TxnScopeExitCallback; /* fd0/17f8 */
496 PVOID TxnScopeContext; /* fd4/1800 */
497 ULONG LockCount; /* fd8/1808 */
498 LONG WowTebOffset; /* fdc/180c */
499 PVOID ResourceRetValue; /* fe0/1810 */
500 PVOID ReservedForWdf; /* fe4/1818 */
501 ULONGLONG ReservedForCrt; /* fe8/1820 */
502 GUID EffectiveContainerId; /* ff0/1828 */
503 } TEB, *PTEB;
504
505
506 /***********************************************************************
507 * The 32-bit/64-bit version of the PEB and TEB for WoW64
508 */
509 typedef struct _NT_TIB32
510 {
511 ULONG ExceptionList; /* 0000 */
512 ULONG StackBase; /* 0004 */
513 ULONG StackLimit; /* 0008 */
514 ULONG SubSystemTib; /* 000c */
515 ULONG FiberData; /* 0010 */
516 ULONG ArbitraryUserPointer; /* 0014 */
517 ULONG Self; /* 0018 */
518 } NT_TIB32;
519
520 typedef struct _NT_TIB64
521 {
522 ULONG64 ExceptionList; /* 0000 */
523 ULONG64 StackBase; /* 0008 */
524 ULONG64 StackLimit; /* 0010 */
525 ULONG64 SubSystemTib; /* 0018 */
526 ULONG64 FiberData; /* 0020 */
527 ULONG64 ArbitraryUserPointer; /* 0028 */
528 ULONG64 Self; /* 0030 */
529 } NT_TIB64;
530
531 typedef struct _CLIENT_ID32
532 {
533 ULONG UniqueProcess;
534 ULONG UniqueThread;
535 } CLIENT_ID32;
536
537 typedef struct _CLIENT_ID64
538 {
539 ULONG64 UniqueProcess;
540 ULONG64 UniqueThread;
541 } CLIENT_ID64;
542
543 typedef struct _LIST_ENTRY32
544 {
545 ULONG Flink;
546 ULONG Blink;
547 } LIST_ENTRY32;
548
549 typedef struct _LIST_ENTRY64
550 {
551 ULONG64 Flink;
552 ULONG64 Blink;
553 } LIST_ENTRY64;
554
555 typedef struct _UNICODE_STRING32
556 {
557 USHORT Length;
558 USHORT MaximumLength;
559 ULONG Buffer;
560 } UNICODE_STRING32;
561
562 typedef struct _UNICODE_STRING64
563 {
564 USHORT Length;
565 USHORT MaximumLength;
566 ULONG64 Buffer;
567 } UNICODE_STRING64;
568
569 typedef struct _ACTIVATION_CONTEXT_STACK32
570 {
571 ULONG ActiveFrame;
572 LIST_ENTRY32 FrameListCache;
573 ULONG Flags;
574 ULONG NextCookieSequenceNumber;
575 ULONG32 StackId;
576 } ACTIVATION_CONTEXT_STACK32;
577
578 typedef struct _ACTIVATION_CONTEXT_STACK64
579 {
580 ULONG64 ActiveFrame;
581 LIST_ENTRY64 FrameListCache;
582 ULONG Flags;
583 ULONG NextCookieSequenceNumber;
584 ULONG64 StackId;
585 } ACTIVATION_CONTEXT_STACK64;
586
587 typedef struct _PEB_LDR_DATA32
588 {
589 ULONG Length;
590 BOOLEAN Initialized;
591 ULONG SsHandle;
592 LIST_ENTRY32 InLoadOrderModuleList;
593 LIST_ENTRY32 InMemoryOrderModuleList;
594 LIST_ENTRY32 InInitializationOrderModuleList;
595 ULONG EntryInProgress;
596 BOOLEAN ShutdownInProgress;
597 ULONG ShutdownThreadId;
598 } PEB_LDR_DATA32, *PPEB_LDR_DATA32;
599
600 typedef struct _PEB_LDR_DATA64
601 {
602 ULONG Length;
603 BOOLEAN Initialized;
604 ULONG64 SsHandle;
605 LIST_ENTRY64 InLoadOrderModuleList;
606 LIST_ENTRY64 InMemoryOrderModuleList;
607 LIST_ENTRY64 InInitializationOrderModuleList;
608 ULONG64 EntryInProgress;
609 BOOLEAN ShutdownInProgress;
610 ULONG64 ShutdownThreadId;
611 } PEB_LDR_DATA64, *PPEB_LDR_DATA64;
612
613 typedef struct _PEB32
614 {
615 BOOLEAN InheritedAddressSpace; /* 0000 */
616 BOOLEAN ReadImageFileExecOptions; /* 0001 */
617 BOOLEAN BeingDebugged; /* 0002 */
618 BOOLEAN SpareBool; /* 0003 */
619 ULONG Mutant; /* 0004 */
620 ULONG ImageBaseAddress; /* 0008 */
621 ULONG LdrData; /* 000c */
622 ULONG ProcessParameters; /* 0010 */
623 ULONG SubSystemData; /* 0014 */
624 ULONG ProcessHeap; /* 0018 */
625 ULONG FastPebLock; /* 001c */
626 ULONG FastPebLockRoutine; /* 0020 */
627 ULONG FastPebUnlockRoutine; /* 0024 */
628 ULONG EnvironmentUpdateCount; /* 0028 */
629 ULONG KernelCallbackTable; /* 002c */
630 ULONG Reserved; /* 0030 */
631 ULONG AtlThunkSListPtr32; /* 0034 */
632 ULONG FreeList; /* 0038 */
633 ULONG TlsExpansionCounter; /* 003c */
634 ULONG TlsBitmap; /* 0040 */
635 ULONG TlsBitmapBits[2]; /* 0044 */
636 ULONG ReadOnlySharedMemoryBase; /* 004c */
637 ULONG ReadOnlySharedMemoryHeap; /* 0050 */
638 ULONG ReadOnlyStaticServerData; /* 0054 */
639 ULONG AnsiCodePageData; /* 0058 */
640 ULONG OemCodePageData; /* 005c */
641 ULONG UnicodeCaseTableData; /* 0060 */
642 ULONG NumberOfProcessors; /* 0064 */
643 ULONG NtGlobalFlag; /* 0068 */
644 LARGE_INTEGER CriticalSectionTimeout; /* 0070 */
645 ULONG HeapSegmentReserve; /* 0078 */
646 ULONG HeapSegmentCommit; /* 007c */
647 ULONG HeapDeCommitTotalFreeThreshold; /* 0080 */
648 ULONG HeapDeCommitFreeBlockThreshold; /* 0084 */
649 ULONG NumberOfHeaps; /* 0088 */
650 ULONG MaximumNumberOfHeaps; /* 008c */
651 ULONG ProcessHeaps; /* 0090 */
652 ULONG GdiSharedHandleTable; /* 0094 */
653 ULONG ProcessStarterHelper; /* 0098 */
654 ULONG GdiDCAttributeList; /* 009c */
655 ULONG LoaderLock; /* 00a0 */
656 ULONG OSMajorVersion; /* 00a4 */
657 ULONG OSMinorVersion; /* 00a8 */
658 ULONG OSBuildNumber; /* 00ac */
659 ULONG OSPlatformId; /* 00b0 */
660 ULONG ImageSubSystem; /* 00b4 */
661 ULONG ImageSubSystemMajorVersion; /* 00b8 */
662 ULONG ImageSubSystemMinorVersion; /* 00bc */
663 ULONG ImageProcessAffinityMask; /* 00c0 */
664 ULONG GdiHandleBuffer[28]; /* 00c4 */
665 ULONG unknown[6]; /* 0134 */
666 ULONG PostProcessInitRoutine; /* 014c */
667 ULONG TlsExpansionBitmap; /* 0150 */
668 ULONG TlsExpansionBitmapBits[32]; /* 0154 */
669 ULONG SessionId; /* 01d4 */
670 ULARGE_INTEGER AppCompatFlags; /* 01d8 */
671 ULARGE_INTEGER AppCompatFlagsUser; /* 01e0 */
672 ULONG ShimData; /* 01e8 */
673 ULONG AppCompatInfo; /* 01ec */
674 UNICODE_STRING CSDVersion; /* 01f0 */
675 ULONG ActivationContextData; /* 01f8 */
676 ULONG ProcessAssemblyStorageMap; /* 01fc */
677 ULONG SystemDefaultActivationData; /* 0200 */
678 ULONG SystemAssemblyStorageMap; /* 0204 */
679 ULONG MinimumStackCommit; /* 0208 */
680 ULONG FlsCallback; /* 020c */
681 LIST_ENTRY FlsListHead; /* 0210 */
682 ULONG FlsBitmap; /* 0218 */
683 ULONG FlsBitmapBits[4]; /* 021c */
684 ULONG FlsHighIndex; /* 022c */
685 ULONG WerRegistrationData; /* 0230 */
686 ULONG WerShipAssertPtr; /* 0234 */
687 ULONG pUnused; /* 0238 */
688 ULONG pImageHeaderHash; /* 023c */
689 ULONG TracingFlags; /* 0240 */
690 ULONGLONG CsrServerReadOnlySharedMemoryBase; /* 0248 */
691 ULONG TppWorkerpListLock; /* 0250 */
692 LIST_ENTRY TppWorkerpList; /* 0254 */
693 ULONG WaitOnAddressHashTable [0x80]; /* 025c */
694 ULONG TelemetryCoverageHeader; /* 045c */
695 ULONG CloudFileFlags; /* 0460 */
696 ULONG CloudFileDiagFlags; /* 0464 */
697 CHAR PlaceholderCompatibilityMode; /* 0468 */
698 CHAR PlaceholderCompatibilityModeReserved[7]; /* 0469 */
699 ULONG LeapSecondData; /* 0470 */
700 ULONG LeapSecondFlags; /* 0474 */
701 ULONG NtGlobalFlag2; /* 0478 */
702 } PEB32;
703
704 typedef struct _PEB64
705 {
706 BOOLEAN InheritedAddressSpace; /* 0000 */
707 BOOLEAN ReadImageFileExecOptions; /* 0001 */
708 BOOLEAN BeingDebugged; /* 0002 */
709 BOOLEAN SpareBool; /* 0003 */
710 ULONG64 Mutant; /* 0008 */
711 ULONG64 ImageBaseAddress; /* 0010 */
712 ULONG64 LdrData; /* 0018 */
713 ULONG64 ProcessParameters; /* 0020 */
714 ULONG64 SubSystemData; /* 0028 */
715 ULONG64 ProcessHeap; /* 0030 */
716 ULONG64 FastPebLock; /* 0038 */
717 ULONG64 FastPebLockRoutine; /* 0040 */
718 ULONG64 FastPebUnlockRoutine; /* 0048 */
719 ULONG EnvironmentUpdateCount; /* 0050 */
720 ULONG64 KernelCallbackTable; /* 0058 */
721 ULONG Reserved; /* 0060 */
722 ULONG AtlThunkSListPtr32; /* 0064 */
723 ULONG64 FreeList; /* 0068 */
724 ULONG TlsExpansionCounter; /* 0070 */
725 ULONG64 TlsBitmap; /* 0078 */
726 ULONG TlsBitmapBits[2]; /* 0080 */
727 ULONG64 ReadOnlySharedMemoryBase; /* 0088 */
728 ULONG64 ReadOnlySharedMemoryHeap; /* 0090 */
729 ULONG64 ReadOnlyStaticServerData; /* 0098 */
730 ULONG64 AnsiCodePageData; /* 00a0 */
731 ULONG64 OemCodePageData; /* 00a8 */
732 ULONG64 UnicodeCaseTableData; /* 00b0 */
733 ULONG NumberOfProcessors; /* 00b8 */
734 ULONG NtGlobalFlag; /* 00bc */
735 LARGE_INTEGER CriticalSectionTimeout; /* 00c0 */
736 ULONG64 HeapSegmentReserve; /* 00c8 */
737 ULONG64 HeapSegmentCommit; /* 00d0 */
738 ULONG64 HeapDeCommitTotalFreeThreshold; /* 00d8 */
739 ULONG64 HeapDeCommitFreeBlockThreshold; /* 00e0 */
740 ULONG NumberOfHeaps; /* 00e8 */
741 ULONG MaximumNumberOfHeaps; /* 00ec */
742 ULONG64 ProcessHeaps; /* 00f0 */
743 ULONG64 GdiSharedHandleTable; /* 00f8 */
744 ULONG64 ProcessStarterHelper; /* 0100 */
745 ULONG64 GdiDCAttributeList; /* 0108 */
746 ULONG64 LoaderLock; /* 0110 */
747 ULONG OSMajorVersion; /* 0118 */
748 ULONG OSMinorVersion; /* 011c */
749 ULONG OSBuildNumber; /* 0120 */
750 ULONG OSPlatformId; /* 0124 */
751 ULONG ImageSubSystem; /* 0128 */
752 ULONG ImageSubSystemMajorVersion; /* 012c */
753 ULONG ImageSubSystemMinorVersion; /* 0130 */
754 ULONG ImageProcessAffinityMask; /* 0134 */
755 ULONG64 GdiHandleBuffer[28]; /* 0138 */
756 ULONG unknown[6]; /* 0218 */
757 ULONG64 PostProcessInitRoutine; /* 0230 */
758 ULONG64 TlsExpansionBitmap; /* 0238 */
759 ULONG TlsExpansionBitmapBits[32]; /* 0240 */
760 ULONG SessionId; /* 02c0 */
761 ULARGE_INTEGER AppCompatFlags; /* 02c8 */
762 ULARGE_INTEGER AppCompatFlagsUser; /* 02d0 */
763 ULONG64 ShimData; /* 02d8 */
764 ULONG64 AppCompatInfo; /* 02e0 */
765 UNICODE_STRING64 CSDVersion; /* 02e8 */
766 ULONG64 ActivationContextData; /* 02f8 */
767 ULONG64 ProcessAssemblyStorageMap; /* 0300 */
768 ULONG64 SystemDefaultActivationData; /* 0308 */
769 ULONG64 SystemAssemblyStorageMap; /* 0310 */
770 ULONG64 MinimumStackCommit; /* 0318 */
771 ULONG64 FlsCallback; /* 0320 */
772 LIST_ENTRY64 FlsListHead; /* 0328 */
773 ULONG64 FlsBitmap; /* 0338 */
774 ULONG FlsBitmapBits[4]; /* 0340 */
775 ULONG FlsHighIndex; /* 0350 */
776 ULONG64 WerRegistrationData; /* 0358 */
777 ULONG64 WerShipAssertPtr; /* 0360 */
778 ULONG64 pUnused; /* 0368 */
779 ULONG64 pImageHeaderHash; /* 0370 */
780 ULONG TracingFlags; /* 0378 */
781 ULONGLONG CsrServerReadOnlySharedMemoryBase; /* 0380 */
782 ULONG TppWorkerpListLock; /* 0388 */
783 LIST_ENTRY64 TppWorkerpList; /* 0390 */
784 ULONG64 WaitOnAddressHashTable [0x80]; /* 03a0 */
785 ULONG64 TelemetryCoverageHeader; /* 07a0 */
786 ULONG CloudFileFlags; /* 07a8 */
787 ULONG CloudFileDiagFlags; /* 07ac */
788 CHAR PlaceholderCompatibilityMode; /* 07b0 */
789 CHAR PlaceholderCompatibilityModeReserved[7]; /* 07b1 */
790 ULONG64 LeapSecondData; /* 07b8 */
791 ULONG LeapSecondFlags; /* 07c0 */
792 ULONG NtGlobalFlag2; /* 07c4 */
793 } PEB64;
794
795 typedef struct _TEB32
796 {
797 NT_TIB32 Tib; /* 0000 */
798 ULONG EnvironmentPointer; /* 001c */
799 CLIENT_ID32 ClientId; /* 0020 */
800 ULONG ActiveRpcHandle; /* 0028 */
801 ULONG ThreadLocalStoragePointer; /* 002c */
802 ULONG Peb; /* 0030 */
803 ULONG LastErrorValue; /* 0034 */
804 ULONG CountOfOwnedCriticalSections; /* 0038 */
805 ULONG CsrClientThread; /* 003c */
806 ULONG Win32ThreadInfo; /* 0040 */
807 ULONG User32Reserved[26]; /* 0044 */
808 ULONG UserReserved[5]; /* 00ac */
809 ULONG WOW32Reserved; /* 00c0 */
810 ULONG CurrentLocale; /* 00c4 */
811 ULONG FpSoftwareStatusRegister; /* 00c8 */
812 ULONG ReservedForDebuggerInstrumentation[16]; /* 00cc */
813 ULONG SystemReserved1[26]; /* 010c */
814 char PlaceholderCompatibilityMode; /* 0174 */
815 char PlaceholderReserved[11]; /* 0175 */
816 DWORD ProxiedProcessId; /* 0180 */
817 ACTIVATION_CONTEXT_STACK32 ActivationContextStack; /* 0184 */
818 UCHAR WorkingOnBehalfOfTicket[8]; /* 019c */
819 LONG ExceptionCode; /* 01a4 */
820 ULONG ActivationContextStackPointer; /* 01a8 */
821 ULONG InstrumentationCallbackSp; /* 01ac */
822 ULONG InstrumentationCallbackPreviousPc; /* 01b0 */
823 ULONG InstrumentationCallbackPreviousSp; /* 01b4 */
824 BOOLEAN InstrumentationCallbackDisabled; /* 01b8 */
825 BYTE SpareBytes1[23]; /* 01b9 */
826 ULONG TxFsContext; /* 01d0 */
827 ULONG GdiTebBatch[0x138]; /* 01d4 */
828 CLIENT_ID32 RealClientId; /* 06b4 */
829 ULONG GdiCachedProcessHandle; /* 06bc */
830 ULONG GdiClientPID; /* 06c0 */
831 ULONG GdiClientTID; /* 06c4 */
832 ULONG GdiThreadLocaleInfo; /* 06c8 */
833 ULONG Win32ClientInfo[62]; /* 06cc */
834 ULONG glDispatchTable[233]; /* 07c4 */
835 ULONG glReserved1[29]; /* 0b68 */
836 ULONG glReserved2; /* 0bdc */
837 ULONG glSectionInfo; /* 0be0 */
838 ULONG glSection; /* 0be4 */
839 ULONG glTable; /* 0be8 */
840 ULONG glCurrentRC; /* 0bec */
841 ULONG glContext; /* 0bf0 */
842 ULONG LastStatusValue; /* 0bf4 */
843 UNICODE_STRING32 StaticUnicodeString; /* 0bf8 */
844 WCHAR StaticUnicodeBuffer[261]; /* 0c00 */
845 ULONG DeallocationStack; /* 0e0c */
846 ULONG TlsSlots[64]; /* 0e10 */
847 LIST_ENTRY32 TlsLinks; /* 0f10 */
848 ULONG Vdm; /* 0f18 */
849 ULONG ReservedForNtRpc; /* 0f1c */
850 ULONG DbgSsReserved[2]; /* 0f20 */
851 ULONG HardErrorDisabled; /* 0f28 */
852 ULONG Instrumentation[16]; /* 0f2c */
853 ULONG WinSockData; /* 0f6c */
854 ULONG GdiBatchCount; /* 0f70 */
855 ULONG Spare2; /* 0f74 */
856 ULONG GuaranteedStackBytes; /* 0f78 */
857 ULONG ReservedForPerf; /* 0f7c */
858 ULONG ReservedForOle; /* 0f80 */
859 ULONG WaitingOnLoaderLock; /* 0f84 */
860 ULONG Reserved5[3]; /* 0f88 */
861 ULONG TlsExpansionSlots; /* 0f94 */
862 ULONG ImpersonationLocale; /* 0f98 */
863 ULONG IsImpersonating; /* 0f9c */
864 ULONG NlsCache; /* 0fa0 */
865 ULONG ShimData; /* 0fa4 */
866 ULONG HeapVirtualAffinity; /* 0fa8 */
867 ULONG CurrentTransactionHandle; /* 0fac */
868 ULONG ActiveFrame; /* 0fb0 */
869 ULONG FlsSlots; /* 0fb4 */
870 ULONG PreferredLanguages; /* 0fb8 */
871 ULONG UserPrefLanguages; /* 0fbc */
872 ULONG MergedPrefLanguages; /* 0fc0 */
873 ULONG MuiImpersonation; /* 0fc4 */
874 USHORT CrossTebFlags; /* 0fc8 */
875 USHORT SameTebFlags; /* 0fca */
876 ULONG TxnScopeEnterCallback; /* 0fcc */
877 ULONG TxnScopeExitCallback; /* 0fd0 */
878 ULONG TxnScopeContext; /* 0fd4 */
879 ULONG LockCount; /* 0fd8 */
880 LONG WowTebOffset; /* 0fdc */
881 ULONG ResourceRetValue; /* 0fe0 */
882 ULONG ReservedForWdf; /* 0fe4 */
883 ULONGLONG ReservedForCrt; /* 0fe8 */
884 GUID EffectiveContainerId; /* 0ff0 */
885 } TEB32;
886
887 typedef struct _TEB64
888 {
889 NT_TIB64 Tib; /* 0000 */
890 ULONG64 EnvironmentPointer; /* 0038 */
891 CLIENT_ID64 ClientId; /* 0040 */
892 ULONG64 ActiveRpcHandle; /* 0050 */
893 ULONG64 ThreadLocalStoragePointer; /* 0058 */
894 ULONG64 Peb; /* 0060 */
895 ULONG LastErrorValue; /* 0068 */
896 ULONG CountOfOwnedCriticalSections; /* 006c */
897 ULONG64 CsrClientThread; /* 0070 */
898 ULONG64 Win32ThreadInfo; /* 0078 */
899 ULONG User32Reserved[26]; /* 0080 */
900 ULONG UserReserved[5]; /* 00e8 */
901 ULONG64 WOW32Reserved; /* 0100 */
902 ULONG CurrentLocale; /* 0108 */
903 ULONG FpSoftwareStatusRegister; /* 010c */
904 ULONG64 ReservedForDebuggerInstrumentation[16]; /* 0110 */
905 ULONG64 SystemReserved1[30]; /* 0190 */
906 char PlaceholderCompatibilityMode; /* 0280 */
907 char PlaceholderReserved[11]; /* 0281 */
908 DWORD ProxiedProcessId; /* 028c */
909 ACTIVATION_CONTEXT_STACK64 ActivationContextStack; /* 0290 */
910 UCHAR WorkingOnBehalfOfTicket[8]; /* 02b8 */
911 LONG ExceptionCode; /* 02c0 */
912 ULONG64 ActivationContextStackPointer; /* 02c8 */
913 ULONG64 InstrumentationCallbackSp; /* 02d0 */
914 ULONG64 InstrumentationCallbackPreviousPc; /* 02d8 */
915 ULONG64 InstrumentationCallbackPreviousSp; /* 02e0 */
916 ULONG TxFsContext; /* 02e8 */
917 BOOLEAN InstrumentationCallbackDisabled; /* 02ec */
918 ULONG64 GdiTebBatch[0x9d]; /* 02f0 */
919 CLIENT_ID64 RealClientId; /* 07d8 */
920 ULONG64 GdiCachedProcessHandle; /* 07e8 */
921 ULONG GdiClientPID; /* 07f0 */
922 ULONG GdiClientTID; /* 07f4 */
923 ULONG64 GdiThreadLocaleInfo; /* 07f8 */
924 ULONG64 Win32ClientInfo[62]; /* 0800 */
925 ULONG64 glDispatchTable[233]; /* 09f0 */
926 ULONG64 glReserved1[29]; /* 1138 */
927 ULONG64 glReserved2; /* 1220 */
928 ULONG64 glSectionInfo; /* 1228 */
929 ULONG64 glSection; /* 1230 */
930 ULONG64 glTable; /* 1238 */
931 ULONG64 glCurrentRC; /* 1240 */
932 ULONG64 glContext; /* 1248 */
933 ULONG LastStatusValue; /* 1250 */
934 UNICODE_STRING64 StaticUnicodeString; /* 1258 */
935 WCHAR StaticUnicodeBuffer[261]; /* 1268 */
936 ULONG64 DeallocationStack; /* 1478 */
937 ULONG64 TlsSlots[64]; /* 1480 */
938 LIST_ENTRY64 TlsLinks; /* 1680 */
939 ULONG64 Vdm; /* 1690 */
940 ULONG64 ReservedForNtRpc; /* 1698 */
941 ULONG64 DbgSsReserved[2]; /* 16a0 */
942 ULONG HardErrorDisabled; /* 16b0 */
943 ULONG64 Instrumentation[16]; /* 16b8 */
944 ULONG64 WinSockData; /* 1738 */
945 ULONG GdiBatchCount; /* 1740 */
946 ULONG Spare2; /* 1744 */
947 ULONG GuaranteedStackBytes; /* 1748 */
948 ULONG64 ReservedForPerf; /* 1750 */
949 ULONG64 ReservedForOle; /* 1758 */
950 ULONG WaitingOnLoaderLock; /* 1760 */
951 ULONG64 Reserved5[3]; /* 1768 */
952 ULONG64 TlsExpansionSlots; /* 1780 */
953 ULONG64 DeallocationBStore; /* 1788 */
954 ULONG64 BStoreLimit; /* 1790 */
955 ULONG ImpersonationLocale; /* 1798 */
956 ULONG IsImpersonating; /* 179c */
957 ULONG64 NlsCache; /* 17a0 */
958 ULONG64 ShimData; /* 17a8 */
959 ULONG HeapVirtualAffinity; /* 17b0 */
960 ULONG64 CurrentTransactionHandle; /* 17b8 */
961 ULONG64 ActiveFrame; /* 17c0 */
962 ULONG64 FlsSlots; /* 17c8 */
963 ULONG64 PreferredLanguages; /* 17d0 */
964 ULONG64 UserPrefLanguages; /* 17d8 */
965 ULONG64 MergedPrefLanguages; /* 17e0 */
966 ULONG MuiImpersonation; /* 17e8 */
967 USHORT CrossTebFlags; /* 17ec */
968 USHORT SameTebFlags; /* 17ee */
969 ULONG64 TxnScopeEnterCallback; /* 17f0 */
970 ULONG64 TxnScopeExitCallback; /* 17f8 */
971 ULONG64 TxnScopeContext; /* 1800 */
972 ULONG LockCount; /* 1808 */
973 LONG WowTebOffset; /* 180c */
974 ULONG64 ResourceRetValue; /* 1810 */
975 ULONG64 ReservedForWdf; /* 1818 */
976 ULONGLONG ReservedForCrt; /* 1820 */
977 GUID EffectiveContainerId; /* 1828 */
978 } TEB64;
979
980 /* reserved TEB64 TLS slots for Wow64 */
981 #define WOW64_TLS_CPURESERVED 1
982 #define WOW64_TLS_FILESYSREDIR 8
983
984
985 /***********************************************************************
986 * Enums
987 */
988
989 typedef enum _FILE_INFORMATION_CLASS {
990 FileDirectoryInformation = 1,
991 FileFullDirectoryInformation,
992 FileBothDirectoryInformation,
993 FileBasicInformation,
994 FileStandardInformation,
995 FileInternalInformation,
996 FileEaInformation,
997 FileAccessInformation,
998 FileNameInformation,
999 FileRenameInformation,
1000 FileLinkInformation,
1001 FileNamesInformation,
1002 FileDispositionInformation,
1003 FilePositionInformation,
1004 FileFullEaInformation,
1005 FileModeInformation,
1006 FileAlignmentInformation,
1007 FileAllInformation,
1008 FileAllocationInformation,
1009 FileEndOfFileInformation,
1010 FileAlternateNameInformation,
1011 FileStreamInformation,
1012 FilePipeInformation,
1013 FilePipeLocalInformation,
1014 FilePipeRemoteInformation,
1015 FileMailslotQueryInformation,
1016 FileMailslotSetInformation,
1017 FileCompressionInformation,
1018 FileObjectIdInformation,
1019 FileCompletionInformation,
1020 FileMoveClusterInformation,
1021 FileQuotaInformation,
1022 FileReparsePointInformation,
1023 FileNetworkOpenInformation,
1024 FileAttributeTagInformation,
1025 FileTrackingInformation,
1026 FileIdBothDirectoryInformation,
1027 FileIdFullDirectoryInformation,
1028 FileValidDataLengthInformation,
1029 FileShortNameInformation,
1030 FileIoCompletionNotificationInformation,
1031 FileIoStatusBlockRangeInformation,
1032 FileIoPriorityHintInformation,
1033 FileSfioReserveInformation,
1034 FileSfioVolumeInformation,
1035 FileHardLinkInformation,
1036 FileProcessIdsUsingFileInformation,
1037 FileNormalizedNameInformation,
1038 FileNetworkPhysicalNameInformation,
1039 FileIdGlobalTxDirectoryInformation,
1040 FileIsRemoteDeviceInformation,
1041 FileAttributeCacheInformation,
1042 FileNumaNodeInformation,
1043 FileStandardLinkInformation,
1044 FileRemoteProtocolInformation,
1045 FileRenameInformationBypassAccessCheck,
1046 FileLinkInformationBypassAccessCheck,
1047 FileVolumeNameInformation,
1048 FileIdInformation,
1049 FileIdExtdDirectoryInformation,
1050 FileReplaceCompletionInformation,
1051 FileHardLinkFullIdInformation,
1052 FileIdExtdBothDirectoryInformation,
1053 FileMaximumInformation
1054 } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
1055
1056 typedef struct _FILE_DIRECTORY_INFORMATION {
1057 ULONG NextEntryOffset;
1058 ULONG FileIndex;
1059 LARGE_INTEGER CreationTime;
1060 LARGE_INTEGER LastAccessTime;
1061 LARGE_INTEGER LastWriteTime;
1062 LARGE_INTEGER ChangeTime;
1063 LARGE_INTEGER EndOfFile;
1064 LARGE_INTEGER AllocationSize;
1065 ULONG FileAttributes;
1066 ULONG FileNameLength;
1067 WCHAR FileName[ANYSIZE_ARRAY];
1068 } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
1069
1070 typedef struct _FILE_FULL_DIRECTORY_INFORMATION {
1071 ULONG NextEntryOffset;
1072 ULONG FileIndex;
1073 LARGE_INTEGER CreationTime;
1074 LARGE_INTEGER LastAccessTime;
1075 LARGE_INTEGER LastWriteTime;
1076 LARGE_INTEGER ChangeTime;
1077 LARGE_INTEGER EndOfFile;
1078 LARGE_INTEGER AllocationSize;
1079 ULONG FileAttributes;
1080 ULONG FileNameLength;
1081 ULONG EaSize;
1082 WCHAR FileName[ANYSIZE_ARRAY];
1083 } FILE_FULL_DIRECTORY_INFORMATION, *PFILE_FULL_DIRECTORY_INFORMATION,
1084 FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
1085
1086 typedef struct _FILE_ID_FULL_DIRECTORY_INFORMATION {
1087 ULONG NextEntryOffset;
1088 ULONG FileIndex;
1089 LARGE_INTEGER CreationTime;
1090 LARGE_INTEGER LastAccessTime;
1091 LARGE_INTEGER LastWriteTime;
1092 LARGE_INTEGER ChangeTime;
1093 LARGE_INTEGER EndOfFile;
1094 LARGE_INTEGER AllocationSize;
1095 ULONG FileAttributes;
1096 ULONG FileNameLength;
1097 ULONG EaSize;
1098 LARGE_INTEGER FileId;
1099 WCHAR FileName[ANYSIZE_ARRAY];
1100 } FILE_ID_FULL_DIRECTORY_INFORMATION, *PFILE_ID_FULL_DIRECTORY_INFORMATION;
1101
1102 typedef struct _FILE_BOTH_DIRECTORY_INFORMATION {
1103 ULONG NextEntryOffset;
1104 ULONG FileIndex;
1105 LARGE_INTEGER CreationTime;
1106 LARGE_INTEGER LastAccessTime;
1107 LARGE_INTEGER LastWriteTime;
1108 LARGE_INTEGER ChangeTime;
1109 LARGE_INTEGER EndOfFile;
1110 LARGE_INTEGER AllocationSize;
1111 ULONG FileAttributes;
1112 ULONG FileNameLength;
1113 ULONG EaSize;
1114 CHAR ShortNameLength;
1115 WCHAR ShortName[12];
1116 WCHAR FileName[ANYSIZE_ARRAY];
1117 } FILE_BOTH_DIRECTORY_INFORMATION, *PFILE_BOTH_DIRECTORY_INFORMATION,
1118 FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
1119
1120 typedef struct _FILE_ID_BOTH_DIRECTORY_INFORMATION {
1121 ULONG NextEntryOffset;
1122 ULONG FileIndex;
1123 LARGE_INTEGER CreationTime;
1124 LARGE_INTEGER LastAccessTime;
1125 LARGE_INTEGER LastWriteTime;
1126 LARGE_INTEGER ChangeTime;
1127 LARGE_INTEGER EndOfFile;
1128 LARGE_INTEGER AllocationSize;
1129 ULONG FileAttributes;
1130 ULONG FileNameLength;
1131 ULONG EaSize;
1132 CHAR ShortNameLength;
1133 WCHAR ShortName[12];
1134 LARGE_INTEGER FileId;
1135 WCHAR FileName[ANYSIZE_ARRAY];
1136 } FILE_ID_BOTH_DIRECTORY_INFORMATION, *PFILE_ID_BOTH_DIRECTORY_INFORMATION;
1137
1138 typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION {
1139 ULONG NextEntryOffset;
1140 ULONG FileIndex;
1141 LARGE_INTEGER CreationTime;
1142 LARGE_INTEGER LastAccessTime;
1143 LARGE_INTEGER LastWriteTime;
1144 LARGE_INTEGER ChangeTime;
1145 LARGE_INTEGER EndOfFile;
1146 LARGE_INTEGER AllocationSize;
1147 ULONG FileAttributes;
1148 ULONG FileNameLength;
1149 LARGE_INTEGER FileId;
1150 GUID LockingTransactionId;
1151 ULONG TxInfoFlags;
1152 WCHAR FileName[ANYSIZE_ARRAY];
1153 } FILE_ID_GLOBAL_TX_DIR_INFORMATION, *PFILE_ID_GLOBAL_TX_DIR_INFORMATION;
1154
1155 typedef struct _FILE_BASIC_INFORMATION {
1156 LARGE_INTEGER CreationTime;
1157 LARGE_INTEGER LastAccessTime;
1158 LARGE_INTEGER LastWriteTime;
1159 LARGE_INTEGER ChangeTime;
1160 ULONG FileAttributes;
1161 } FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
1162
1163 typedef struct _FILE_STANDARD_INFORMATION {
1164 LARGE_INTEGER AllocationSize;
1165 LARGE_INTEGER EndOfFile;
1166 ULONG NumberOfLinks;
1167 BOOLEAN DeletePending;
1168 BOOLEAN Directory;
1169 } FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;
1170
1171 typedef struct _FILE_INTERNAL_INFORMATION {
1172 LARGE_INTEGER IndexNumber;
1173 } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
1174
1175 typedef struct _FILE_ID_128 {
1176 UCHAR Identifier[16];
1177 } FILE_ID_128, *PFILE_ID_128;
1178
1179 typedef struct _FILE_ID_INFORMATION {
1180 ULONGLONG VolumeSerialNumber;
1181 FILE_ID_128 FileId;
1182 } FILE_ID_INFORMATION, *PFILE_ID_INFORMATION;
1183
1184 typedef struct _FILE_EA_INFORMATION {
1185 ULONG EaSize;
1186 } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
1187
1188 typedef struct _FILE_ACCESS_INFORMATION {
1189 ACCESS_MASK AccessFlags;
1190 } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
1191
1192 typedef struct _FILE_NAME_INFORMATION {
1193 ULONG FileNameLength;
1194 WCHAR FileName[1];
1195 } FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;
1196
1197 typedef struct _FILE_RENAME_INFORMATION {
1198 BOOLEAN ReplaceIfExists;
1199 HANDLE RootDirectory;
1200 ULONG FileNameLength;
1201 WCHAR FileName[1];
1202 } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
1203
1204 typedef struct _FILE_LINK_INFORMATION {
1205 BOOLEAN ReplaceIfExists;
1206 HANDLE RootDirectory;
1207 ULONG FileNameLength;
1208 WCHAR FileName[1];
1209 } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
1210
1211 typedef struct _FILE_NAMES_INFORMATION {
1212 ULONG NextEntryOffset;
1213 ULONG FileIndex;
1214 ULONG FileNameLength;
1215 WCHAR FileName[1];
1216 } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
1217
1218 typedef struct _FILE_DISPOSITION_INFORMATION {
1219 BOOLEAN DoDeleteFile;
1220 } FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;
1221
1222 typedef struct _FILE_POSITION_INFORMATION {
1223 LARGE_INTEGER CurrentByteOffset;
1224 } FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;
1225
1226 typedef struct _FILE_ALIGNMENT_INFORMATION {
1227 ULONG AlignmentRequirement;
1228 } FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION;
1229
1230 typedef struct _FILE_ALLOCATION_INFORMATION {
1231 LARGE_INTEGER AllocationSize;
1232 } FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;
1233
1234 typedef struct _FILE_END_OF_FILE_INFORMATION {
1235 LARGE_INTEGER EndOfFile;
1236 } FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;
1237
1238 typedef struct _FILE_NETWORK_OPEN_INFORMATION {
1239 LARGE_INTEGER CreationTime;
1240 LARGE_INTEGER LastAccessTime;
1241 LARGE_INTEGER LastWriteTime;
1242 LARGE_INTEGER ChangeTime;
1243 LARGE_INTEGER AllocationSize;
1244 LARGE_INTEGER EndOfFile;
1245 ULONG FileAttributes;
1246 } FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;
1247
1248 typedef struct _FILE_FULL_EA_INFORMATION {
1249 ULONG NextEntryOffset;
1250 UCHAR Flags;
1251 UCHAR EaNameLength;
1252 USHORT EaValueLength;
1253 CHAR EaName[1];
1254 } FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;
1255
1256 typedef struct _FILE_MODE_INFORMATION {
1257 ULONG Mode;
1258 } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
1259
1260 typedef struct _FILE_STREAM_INFORMATION
1261 {
1262 ULONG NextEntryOffset;
1263 ULONG StreamNameLength;
1264 LARGE_INTEGER StreamSize;
1265 LARGE_INTEGER StreamAllocationSize;
1266 WCHAR StreamName[1];
1267 } FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;
1268
1269 typedef struct _FILE_ATTRIBUTE_TAG_INFORMATION
1270 {
1271 ULONG FileAttributes;
1272 ULONG ReparseTag;
1273 } FILE_ATTRIBUTE_TAG_INFORMATION, *PFILE_ATTRIBUTE_TAG_INFORMATION;
1274
1275 typedef struct _FILE_MAILSLOT_QUERY_INFORMATION {
1276 ULONG MaximumMessageSize;
1277 ULONG MailslotQuota;
1278 ULONG NextMessageSize;
1279 ULONG MessagesAvailable;
1280 LARGE_INTEGER ReadTimeout;
1281 } FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION;
1282
1283 typedef struct _FILE_MAILSLOT_SET_INFORMATION {
1284 LARGE_INTEGER ReadTimeout;
1285 } FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
1286
1287 typedef struct _FILE_PIPE_INFORMATION {
1288 ULONG ReadMode;
1289 ULONG CompletionMode;
1290 } FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;
1291
1292 typedef struct _FILE_PIPE_LOCAL_INFORMATION {
1293 ULONG NamedPipeType;
1294 ULONG NamedPipeConfiguration;
1295 ULONG MaximumInstances;
1296 ULONG CurrentInstances;
1297 ULONG InboundQuota;
1298 ULONG ReadDataAvailable;
1299 ULONG OutboundQuota;
1300 ULONG WriteQuotaAvailable;
1301 ULONG NamedPipeState;
1302 ULONG NamedPipeEnd;
1303 } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
1304
1305 #define FILE_PIPE_DISCONNECTED_STATE 0x00000001
1306 #define FILE_PIPE_LISTENING_STATE 0x00000002
1307 #define FILE_PIPE_CONNECTED_STATE 0x00000003
1308 #define FILE_PIPE_CLOSING_STATE 0x00000004
1309
1310 typedef struct _FILE_OBJECTID_BUFFER
1311 {
1312 BYTE ObjectId[16];
1313 union
1314 {
1315 struct
1316 {
1317 BYTE BirthVolumeId[16];
1318 BYTE BirthObjectId[16];
1319 BYTE DomainId[16];
1320 } DUMMYSTRUCTNAME;
1321 BYTE ExtendedInfo[48];
1322 } DUMMYUNIONNAME;
1323 } FILE_OBJECTID_BUFFER, *PFILE_OBJECTID_BUFFER;
1324
1325 typedef struct _FILE_OBJECTID_INFORMATION {
1326 LONGLONG FileReference;
1327 UCHAR ObjectId[16];
1328 union {
1329 struct {
1330 UCHAR BirthVolumeId[16];
1331 UCHAR BirthObjectId[16];
1332 UCHAR DomainId[16];
1333 } DUMMYSTRUCTNAME;
1334 UCHAR ExtendedInfo[48];
1335 } DUMMYUNIONNAME;
1336 } FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION;
1337
1338 typedef struct _FILE_QUOTA_INFORMATION {
1339 ULONG NextEntryOffset;
1340 ULONG SidLength;
1341 LARGE_INTEGER ChangeTime;
1342 LARGE_INTEGER QuotaUsed;
1343 LARGE_INTEGER QuotaThreshold;
1344 LARGE_INTEGER QuotaLimit;
1345 SID Sid;
1346 } FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION;
1347
1348 typedef struct _FILE_REPARSE_POINT_INFORMATION {
1349 LONGLONG FileReference;
1350 ULONG Tag;
1351 } FILE_REPARSE_POINT_INFORMATION, *PFILE_REPARSE_POINT_INFORMATION;
1352
1353 typedef struct _FILE_ALL_INFORMATION {
1354 FILE_BASIC_INFORMATION BasicInformation;
1355 FILE_STANDARD_INFORMATION StandardInformation;
1356 FILE_INTERNAL_INFORMATION InternalInformation;
1357 FILE_EA_INFORMATION EaInformation;
1358 FILE_ACCESS_INFORMATION AccessInformation;
1359 FILE_POSITION_INFORMATION PositionInformation;
1360 FILE_MODE_INFORMATION ModeInformation;
1361 FILE_ALIGNMENT_INFORMATION AlignmentInformation;
1362 FILE_NAME_INFORMATION NameInformation;
1363 } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
1364
1365 typedef struct _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION {
1366 ULONG Flags;
1367 } FILE_IO_COMPLETION_NOTIFICATION_INFORMATION, *PFILE_IO_COMPLETION_NOTIFICATION_INFORMATION;
1368
1369 #define FILE_SKIP_COMPLETION_PORT_ON_SUCCESS 0x1
1370 #define FILE_SKIP_SET_EVENT_ON_HANDLE 0x2
1371 #define FILE_SKIP_SET_USER_EVENT_ON_FAST_IO 0x4
1372
1373 typedef enum _FSINFOCLASS {
1374 FileFsVolumeInformation = 1,
1375 FileFsLabelInformation,
1376 FileFsSizeInformation,
1377 FileFsDeviceInformation,
1378 FileFsAttributeInformation,
1379 FileFsControlInformation,
1380 FileFsFullSizeInformation,
1381 FileFsObjectIdInformation,
1382 FileFsMaximumInformation
1383 } FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;
1384
1385 typedef enum _KEY_INFORMATION_CLASS {
1386 KeyBasicInformation,
1387 KeyNodeInformation,
1388 KeyFullInformation,
1389 KeyNameInformation,
1390 KeyCachedInformation,
1391 KeyFlagsInformation,
1392 KeyVirtualizationInformation,
1393 KeyHandleTagsInformation,
1394 MaxKeyInfoClass
1395 } KEY_INFORMATION_CLASS;
1396
1397 typedef enum _KEY_VALUE_INFORMATION_CLASS {
1398 KeyValueBasicInformation,
1399 KeyValueFullInformation,
1400 KeyValuePartialInformation,
1401 KeyValueFullInformationAlign64,
1402 KeyValuePartialInformationAlign64
1403 } KEY_VALUE_INFORMATION_CLASS;
1404
1405 typedef enum _OBJECT_INFORMATION_CLASS {
1406 ObjectBasicInformation,
1407 ObjectNameInformation,
1408 ObjectTypeInformation,
1409 ObjectTypesInformation,
1410 ObjectDataInformation
1411 } OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS;
1412
1413 typedef enum _PROCESSINFOCLASS {
1414 ProcessBasicInformation = 0,
1415 ProcessQuotaLimits = 1,
1416 ProcessIoCounters = 2,
1417 ProcessVmCounters = 3,
1418 ProcessTimes = 4,
1419 ProcessBasePriority = 5,
1420 ProcessRaisePriority = 6,
1421 ProcessDebugPort = 7,
1422 ProcessExceptionPort = 8,
1423 ProcessAccessToken = 9,
1424 ProcessLdtInformation = 10,
1425 ProcessLdtSize = 11,
1426 ProcessDefaultHardErrorMode = 12,
1427 ProcessIoPortHandlers = 13,
1428 ProcessPooledUsageAndLimits = 14,
1429 ProcessWorkingSetWatch = 15,
1430 ProcessUserModeIOPL = 16,
1431 ProcessEnableAlignmentFaultFixup = 17,
1432 ProcessPriorityClass = 18,
1433 ProcessWx86Information = 19,
1434 ProcessHandleCount = 20,
1435 ProcessAffinityMask = 21,
1436 ProcessPriorityBoost = 22,
1437 ProcessDeviceMap = 23,
1438 ProcessSessionInformation = 24,
1439 ProcessForegroundInformation = 25,
1440 ProcessWow64Information = 26,
1441 ProcessImageFileName = 27,
1442 ProcessLUIDDeviceMapsEnabled = 28,
1443 ProcessBreakOnTermination = 29,
1444 ProcessDebugObjectHandle = 30,
1445 ProcessDebugFlags = 31,
1446 ProcessHandleTracing = 32,
1447 ProcessIoPriority = 33,
1448 ProcessExecuteFlags = 34,
1449 ProcessTlsInformation = 35,
1450 ProcessCookie = 36,
1451 ProcessImageInformation = 37,
1452 ProcessCycleTime = 38,
1453 ProcessPagePriority = 39,
1454 ProcessInstrumentationCallback = 40,
1455 ProcessThreadStackAllocation = 41,
1456 ProcessWorkingSetWatchEx = 42,
1457 ProcessImageFileNameWin32 = 43,
1458 MaxProcessInfoClass
1459 } PROCESSINFOCLASS, PROCESS_INFORMATION_CLASS;
1460
1461 #define MEM_EXECUTE_OPTION_DISABLE 0x01
1462 #define MEM_EXECUTE_OPTION_ENABLE 0x02
1463 #define MEM_EXECUTE_OPTION_DISABLE_THUNK_EMULATION 0x04
1464 #define MEM_EXECUTE_OPTION_PERMANENT 0x08
1465
1466 typedef enum _SECTION_INHERIT {
1467 ViewShare = 1,
1468 ViewUnmap = 2
1469 } SECTION_INHERIT;
1470
1471 typedef enum _SYSTEM_INFORMATION_CLASS {
1472 SystemBasicInformation = 0,
1473 SystemCpuInformation = 1,
1474 SystemPerformanceInformation = 2,
1475 SystemTimeOfDayInformation = 3, /* was SystemTimeInformation */
1476 SystemPathInformation = 4,
1477 SystemProcessInformation = 5,
1478 SystemCallCountInformation = 6,
1479 SystemDeviceInformation = 7,
1480 SystemProcessorPerformanceInformation = 8,
1481 SystemFlagsInformation = 9,
1482 SystemCallTimeInformation = 10,
1483 SystemModuleInformation = 11,
1484 SystemLocksInformation = 12,
1485 SystemStackTraceInformation = 13,
1486 SystemPagedPoolInformation = 14,
1487 SystemNonPagedPoolInformation = 15,
1488 SystemHandleInformation = 16,
1489 SystemObjectInformation = 17,
1490 SystemPageFileInformation = 18,
1491 SystemVdmInstemulInformation = 19,
1492 SystemVdmBopInformation = 20,
1493 SystemFileCacheInformation = 21,
1494 SystemPoolTagInformation = 22,
1495 SystemInterruptInformation = 23,
1496 SystemDpcBehaviorInformation = 24,
1497 SystemFullMemoryInformation = 25,
1498 SystemNotImplemented6 = 25,
1499 SystemLoadGdiDriverInformation = 26,
1500 SystemUnloadGdiDriverInformation = 27,
1501 SystemTimeAdjustmentInformation = 28,
1502 SystemTimeAdjustment = 28,
1503 SystemSummaryMemoryInformation = 29,
1504 SystemMirrorMemoryInformation = 30,
1505 SystemPerformanceTraceInformation = 31,
1506 SystemObsolete0 = 32,
1507 SystemExceptionInformation = 33,
1508 SystemCrashDumpStateInformation = 34,
1509 SystemKernelDebuggerInformation = 35,
1510 SystemContextSwitchInformation = 36,
1511 SystemRegistryQuotaInformation = 37,
1512 SystemExtendServiceTableInformation = 38,
1513 SystemPrioritySeperation = 39,
1514 SystemVerifierAddDriverInformation = 40,
1515 SystemVerifierRemoveDriverInformation = 41,
1516 SystemProcessorIdleInformation = 42,
1517 SystemLegacyDriverInformation = 43,
1518 SystemCurrentTimeZoneInformation = 44,
1519 SystemLookasideInformation = 45,
1520 SystemTimeSlipNotification = 46,
1521 SystemSessionCreate = 47,
1522 SystemSessionDetach = 48,
1523 SystemSessionInformation = 49,
1524 SystemRangeStartInformation = 50,
1525 SystemVerifierInformation = 51,
1526 SystemVerifierThunkExtend = 52,
1527 SystemSessionProcessesInformation = 53,
1528 SystemLoadGdiDriverInSystemSpace = 54,
1529 SystemNumaProcessorMap = 55,
1530 SystemPrefetcherInformation = 56,
1531 SystemExtendedProcessInformation = 57,
1532 SystemRecommendedSharedDataAlignment = 58,
1533 SystemComPlusPackage = 59,
1534 SystemNumaAvailableMemory = 60,
1535 SystemProcessorPowerInformation = 61,
1536 SystemEmulationBasicInformation = 62,
1537 SystemEmulationProcessorInformation = 63,
1538 SystemExtendedHandleInformation = 64,
1539 SystemLostDelayedWriteInformation = 65,
1540 SystemBigPoolInformation = 66,
1541 SystemSessionPoolTagInformation = 67,
1542 SystemSessionMappedViewInformation = 68,
1543 SystemHotpatchInformation = 69,
1544 SystemObjectSecurityMode = 70,
1545 SystemWatchdogTimerHandler = 71,
1546 SystemWatchdogTimerInformation = 72,
1547 SystemLogicalProcessorInformation = 73,
1548 SystemWow64SharedInformationObsolete = 74,
1549 SystemRegisterFirmwareTableInformationHandler = 75,
1550 SystemFirmwareTableInformation = 76,
1551 SystemModuleInformationEx = 77,
1552 SystemVerifierTriageInformation = 78,
1553 SystemSuperfetchInformation = 79,
1554 SystemMemoryListInformation = 80,
1555 SystemFileCacheInformationEx = 81,
1556 SystemThreadPriorityClientIdInformation = 82,
1557 SystemProcessorIdleCycleTimeInformation = 83,
1558 SystemVerifierCancellationInformation = 84,
1559 SystemProcessorPowerInformationEx = 85,
1560 SystemRefTraceInformation = 86,
1561 SystemSpecialPoolInformation = 87,
1562 SystemProcessIdInformation = 88,
1563 SystemErrorPortInformation = 89,
1564 SystemBootEnvironmentInformation = 90,
1565 SystemHypervisorInformation = 91,
1566 SystemVerifierInformationEx = 92,
1567 SystemTimeZoneInformation = 93,
1568 SystemImageFileExecutionOptionsInformation = 94,
1569 SystemCoverageInformation = 95,
1570 SystemPrefetchPatchInformation = 96,
1571 SystemVerifierFaultsInformation = 97,
1572 SystemSystemPartitionInformation = 98,
1573 SystemSystemDiskInformation = 99,
1574 SystemProcessorPerformanceDistribution = 100,
1575 SystemNumaProximityNodeInformation = 101,
1576 SystemDynamicTimeZoneInformation = 102,
1577 SystemCodeIntegrityInformation = 103,
1578 SystemProcessorMicrocodeUpdateInformation = 104,
1579 SystemProcessorBrandString = 105,
1580 SystemVirtualAddressInformation = 106,
1581 SystemLogicalProcessorInformationEx = 107,
1582 SystemProcessorCycleTimeInformation = 108,
1583 SystemStoreInformation = 109,
1584 SystemRegistryAppendString = 110,
1585 SystemAitSamplingValue = 111,
1586 SystemVhdBootInformation = 112,
1587 SystemCpuQuotaInformation = 113,
1588 SystemNativeBasicInformation = 114,
1589 SystemErrorPortTimeouts = 115,
1590 SystemLowPriorityIoInformation = 116,
1591 SystemTpmBootEntropyInformation = 117,
1592 SystemVerifierCountersInformation = 118,
1593 SystemPagedPoolInformationEx = 119,
1594 SystemSystemPtesInformationEx = 120,
1595 SystemNodeDistanceInformation = 121,
1596 SystemAcpiAuditInformation = 122,
1597 SystemBasicPerformanceInformation = 123,
1598 SystemQueryPerformanceCounterInformation = 124,
1599 SystemSessionBigPoolInformation = 125,
1600 SystemBootGraphicsInformation = 126,
1601 SystemScrubPhysicalMemoryInformation = 127,
1602 SystemBadPageInformation = 128,
1603 SystemProcessorProfileControlArea = 129,
1604 SystemCombinePhysicalMemoryInformation = 130,
1605 SystemEntropyInterruptTimingInformation = 131,
1606 SystemConsoleInformation = 132,
1607 SystemPlatformBinaryInformation = 133,
1608 SystemPolicyInformation = 134,
1609 SystemHypervisorProcessorCountInformation = 135,
1610 SystemDeviceDataInformation = 136,
1611 SystemDeviceDataEnumerationInformation = 137,
1612 SystemMemoryTopologyInformation = 138,
1613 SystemMemoryChannelInformation = 139,
1614 SystemBootLogoInformation = 140,
1615 SystemProcessorPerformanceInformationEx = 141,
1616 SystemCriticalProcessErrorLogInformation = 142,
1617 SystemSecureBootPolicyInformation = 143,
1618 SystemPageFileInformationEx = 144,
1619 SystemSecureBootInformation = 145,
1620 SystemEntropyInterruptTimingRawInformation = 146,
1621 SystemPortableWorkspaceEfiLauncherInformation = 147,
1622 SystemFullProcessInformation = 148,
1623 SystemKernelDebuggerInformationEx = 149,
1624 SystemBootMetadataInformation = 150,
1625 SystemSoftRebootInformation = 151,
1626 SystemElamCertificateInformation = 152,
1627 SystemOfflineDumpConfigInformation = 153,
1628 SystemProcessorFeaturesInformation = 154,
1629 SystemRegistryReconciliationInformation = 155,
1630 SystemEdidInformation = 156,
1631 SystemManufacturingInformation = 157,
1632 SystemEnergyEstimationConfigInformation = 158,
1633 SystemHypervisorDetailInformation = 159,
1634 SystemProcessorCycleStatsInformation = 160,
1635 SystemVmGenerationCountInformation = 161,
1636 SystemTrustedPlatformModuleInformation = 162,
1637 SystemKernelDebuggerFlags = 163,
1638 SystemCodeIntegrityPolicyInformation = 164,
1639 SystemIsolatedUserModeInformation = 165,
1640 SystemHardwareSecurityTestInterfaceResultsInformation = 166,
1641 SystemSingleModuleInformation = 167,
1642 SystemAllowedCpuSetsInformation = 168,
1643 SystemVsmProtectionInformation = 169,
1644 SystemInterruptCpuSetsInformation = 170,
1645 SystemSecureBootPolicyFullInformation = 171,
1646 SystemCodeIntegrityPolicyFullInformation = 172,
1647 SystemAffinitizedInterruptProcessorInformation = 173,
1648 SystemRootSiloInformation = 174,
1649 SystemCpuSetInformation = 175,
1650 SystemCpuSetTagInformation = 176,
1651 SystemWin32WerStartCallout = 177,
1652 SystemSecureKernelProfileInformation = 178,
1653 SystemCodeIntegrityPlatformManifestInformation = 179,
1654 SystemInterruptSteeringInformation = 180,
1655 SystemSupportedProcessorArchitectures = 181,
1656 SystemMemoryUsageInformation = 182,
1657 SystemCodeIntegrityCertificateInformation = 183,
1658 SystemPhysicalMemoryInformation = 184,
1659 SystemControlFlowTransition = 185,
1660 SystemKernelDebuggingAllowed = 186,
1661 SystemActivityModerationExeState = 187,
1662 SystemActivityModerationUserSettings = 188,
1663 SystemCodeIntegrityPoliciesFullInformation = 189,
1664 SystemCodeIntegrityUnlockInformation = 190,
1665 SystemIntegrityQuotaInformation = 191,
1666 SystemFlushInformation = 192,
1667 SystemProcessorIdleMaskInformation = 193,
1668 SystemSecureDumpEncryptionInformation = 194,
1669 SystemWriteConstraintInformation = 195,
1670 SystemKernelVaShadowInformation = 196,
1671 SystemHypervisorSharedPageInformation = 197,
1672 SystemFirmwareBootPerformanceInformation = 198,
1673 SystemCodeIntegrityVerificationInformation = 199,
1674 SystemFirmwarePartitionInformation = 200,
1675 SystemSpeculationControlInformation = 201,
1676 SystemDmaGuardPolicyInformation = 202,
1677 SystemEnclaveLaunchControlInformation = 203,
1678 SystemWorkloadAllowedCpuSetsInformation = 204,
1679 SystemCodeIntegrityUnlockModeInformation = 205,
1680 SystemLeapSecondInformation = 206,
1681 SystemFlags2Information = 207,
1682 SystemSecurityModelInformation = 208,
1683 SystemCodeIntegritySyntheticCacheInformation = 209,
1684 SystemFeatureConfigurationInformation = 210,
1685 SystemFeatureConfigurationSectionInformation = 211,
1686 SystemFeatureUsageSubscriptionInformation = 212,
1687 SystemSecureSpeculationControlInformation = 213,
1688 SystemSpacesBootInformation = 214,
1689 SystemFwRamdiskInformation = 215,
1690 SystemWheaIpmiHardwareInformation = 216,
1691 SystemDifSetRuleClassInformation = 217,
1692 SystemDifClearRuleClassInformation = 218,
1693 SystemDifApplyPluginVerificationOnDriver = 219,
1694 SystemDifRemovePluginVerificationOnDriver = 220,
1695 SystemShadowStackInformation = 221,
1696 SystemBuildVersionInformation = 222,
1697 #ifdef __WINESRC__
1698 SystemWineVersionInformation = 1000,
1699 #endif
1700 } SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;
1701
1702 typedef struct _SYSTEM_CODEINTEGRITY_INFORMATION
1703 {
1704 ULONG Length;
1705 ULONG CodeIntegrityOptions;
1706 } SYSTEM_CODEINTEGRITY_INFORMATION, *PSYSTEM_CODEINTEGRITY_INFORMATION;
1707
1708 #define CODEINTEGRITY_OPTION_ENABLED 0x0001
1709 #define CODEINTEGRITY_OPTION_TESTSIGN 0x0002
1710 #define CODEINTEGRITY_OPTION_UMCI_ENABLED 0x0004
1711 #define CODEINTEGRITY_OPTION_UMCI_AUDITMODE_ENABLED 0x0008
1712 #define CODEINTEGRITY_OPTION_UMCI_EXCLUSIONPATHS_ENABLED 0x0010
1713 #define CODEINTEGRITY_OPTION_TEST_BUILD 0x0020
1714 #define CODEINTEGRITY_OPTION_PREPRODUCTION_BUILD 0x0040
1715 #define CODEINTEGRITY_OPTION_DEBUGMODE_ENABLED 0x0080
1716 #define CODEINTEGRITY_OPTION_FLIGHT_BUILD 0x0100
1717 #define CODEINTEGRITY_OPTION_FLIGHTING_ENABLED 0x0200
1718 #define CODEINTEGRITY_OPTION_HVCI_KMCI_ENABLED 0x0400
1719 #define CODEINTEGRITY_OPTION_HVCI_KMCI_AUDITMODE_ENABLED 0x0800
1720 #define CODEINTEGRITY_OPTION_HVCI_KMCI_STRICTMODE_ENABLED 0x1000
1721 #define CODEINTEGRITY_OPTION_HVCI_IUM_ENABLED 0x2000
1722
1723 typedef enum _THREADINFOCLASS {
1724 ThreadBasicInformation = 0,
1725 ThreadTimes,
1726 ThreadPriority,
1727 ThreadBasePriority,
1728 ThreadAffinityMask,
1729 ThreadImpersonationToken,
1730 ThreadDescriptorTableEntry,
1731 ThreadEnableAlignmentFaultFixup,
1732 ThreadEventPair_Reusable,
1733 ThreadQuerySetWin32StartAddress,
1734 ThreadZeroTlsCell,
1735 ThreadPerformanceCount,
1736 ThreadAmILastThread,
1737 ThreadIdealProcessor,
1738 ThreadPriorityBoost,
1739 ThreadSetTlsArrayAddress,
1740 ThreadIsIoPending,
1741 ThreadHideFromDebugger,
1742 ThreadBreakOnTermination,
1743 ThreadSwitchLegacyState,
1744 ThreadIsTerminated,
1745 ThreadLastSystemCall,
1746 ThreadIoPriority,
1747 ThreadCycleTime,
1748 ThreadPagePriority,
1749 ThreadActualBasePriority,
1750 ThreadTebInformation,
1751 ThreadCSwitchMon,
1752 ThreadCSwitchPmu,
1753 ThreadWow64Context,
1754 ThreadGroupInformation,
1755 ThreadUmsInformation,
1756 ThreadCounterProfiling,
1757 ThreadIdealProcessorEx,
1758 ThreadSuspendCount = 35,
1759 ThreadDescription = 38,
1760 MaxThreadInfoClass
1761 } THREADINFOCLASS;
1762
1763 typedef struct _THREAD_BASIC_INFORMATION
1764 {
1765 NTSTATUS ExitStatus;
1766 PVOID TebBaseAddress;
1767 CLIENT_ID ClientId;
1768 ULONG_PTR AffinityMask;
1769 LONG Priority;
1770 LONG BasePriority;
1771 } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
1772
1773 typedef struct _THREAD_DESCRIPTOR_INFORMATION
1774 {
1775 DWORD Selector;
1776 LDT_ENTRY Entry;
1777 } THREAD_DESCRIPTOR_INFORMATION, *PTHREAD_DESCRIPTOR_INFORMATION;
1778
1779 typedef struct _THREAD_DESCRIPTION_INFORMATION
1780 {
1781 UNICODE_STRING Description;
1782 } THREAD_DESCRIPTION_INFORMATION, *PTHREAD_DESCRIPTION_INFORMATION;
1783
1784 typedef struct _KERNEL_USER_TIMES {
1785 LARGE_INTEGER CreateTime;
1786 LARGE_INTEGER ExitTime;
1787 LARGE_INTEGER KernelTime;
1788 LARGE_INTEGER UserTime;
1789 } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
1790
1791 typedef enum _WINSTATIONINFOCLASS {
1792 WinStationInformation = 8
1793 } WINSTATIONINFOCLASS;
1794
1795 typedef enum _MEMORY_INFORMATION_CLASS {
1796 MemoryBasicInformation,
1797 MemoryWorkingSetList,
1798 MemorySectionName,
1799 MemoryBasicVlmInformation,
1800 MemoryWorkingSetExInformation
1801 } MEMORY_INFORMATION_CLASS;
1802
1803 typedef struct _MEMORY_SECTION_NAME
1804 {
1805 UNICODE_STRING SectionFileName;
1806 } MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME;
1807
1808 typedef union _MEMORY_WORKING_SET_EX_BLOCK {
1809 ULONG_PTR Flags;
1810 struct {
1811 ULONG_PTR Valid : 1;
1812 ULONG_PTR ShareCount : 3;
1813 ULONG_PTR Win32Protection : 11;
1814 ULONG_PTR Shared : 1;
1815 ULONG_PTR Node : 6;
1816 ULONG_PTR Locked : 1;
1817 ULONG_PTR LargePage : 1;
1818 } DUMMYSTRUCTNAME;
1819 } MEMORY_WORKING_SET_EX_BLOCK, *PMEMORY_WORKING_SET_EX_BLOCK;
1820
1821 typedef struct _MEMORY_WORKING_SET_EX_INFORMATION {
1822 PVOID VirtualAddress;
1823 MEMORY_WORKING_SET_EX_BLOCK VirtualAttributes;
1824 } MEMORY_WORKING_SET_EX_INFORMATION, *PMEMORY_WORKING_SET_EX_INFORMATION;
1825
1826 typedef enum _MUTANT_INFORMATION_CLASS
1827 {
1828 MutantBasicInformation
1829 } MUTANT_INFORMATION_CLASS, *PMUTANT_INFORMATION_CLASS;
1830
1831 typedef struct _MUTANT_BASIC_INFORMATION {
1832 LONG CurrentCount;
1833 BOOLEAN OwnedByCaller;
1834 BOOLEAN AbandonedState;
1835 } MUTANT_BASIC_INFORMATION, *PMUTANT_BASIC_INFORMATION;
1836
1837 typedef enum _TIMER_INFORMATION_CLASS
1838 {
1839 TimerBasicInformation = 0
1840 } TIMER_INFORMATION_CLASS;
1841
1842 typedef struct _TIMER_BASIC_INFORMATION
1843 {
1844 LARGE_INTEGER RemainingTime;
1845 BOOLEAN TimerState;
1846 } TIMER_BASIC_INFORMATION, *PTIMER_BASIC_INFORMATION;
1847
1848
1849 /* return type of RtlDetermineDosPathNameType_U (FIXME: not the correct names) */
1850 typedef enum
1851 {
1852 INVALID_PATH = 0,
1853 UNC_PATH, /* "//foo" */
1854 ABSOLUTE_DRIVE_PATH, /* "c:/foo" */
1855 RELATIVE_DRIVE_PATH, /* "c:foo" */
1856 ABSOLUTE_PATH, /* "/foo" */
1857 RELATIVE_PATH, /* "foo" */
1858 DEVICE_PATH, /* "//./foo" */
1859 UNC_DOT_PATH /* "//." */
1860 } DOS_PATHNAME_TYPE;
1861
1862
1863 /***********************************************************************
1864 * Types and data structures
1865 */
1866
1867 /* This is used by NtQuerySystemInformation */
1868 typedef struct _SYSTEM_THREAD_INFORMATION
1869 { /* win32/win64 */
1870 LARGE_INTEGER KernelTime; /* 00/00 */
1871 LARGE_INTEGER UserTime; /* 08/08 */
1872 LARGE_INTEGER CreateTime; /* 10/10 */
1873 DWORD dwTickCount; /* 18/18 */
1874 LPVOID StartAddress; /* 1c/20 */
1875 CLIENT_ID ClientId; /* 20/28 */
1876 DWORD dwCurrentPriority; /* 28/38 */
1877 DWORD dwBasePriority; /* 2c/3c */
1878 DWORD dwContextSwitches; /* 30/40 */
1879 DWORD dwThreadState; /* 34/44 */
1880 DWORD dwWaitReason; /* 38/48 */
1881 DWORD dwUnknown; /* 3c/4c */
1882 } SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
1883
1884 typedef struct _IO_STATUS_BLOCK {
1885 union {
1886 NTSTATUS Status;
1887 PVOID Pointer;
1888 } DUMMYUNIONNAME;
1889
1890 ULONG_PTR Information;
1891 } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
1892
1893 typedef void (WINAPI * PIO_APC_ROUTINE)(PVOID,PIO_STATUS_BLOCK,ULONG);
1894
1895 typedef struct _KEY_BASIC_INFORMATION {
1896 LARGE_INTEGER LastWriteTime;
1897 ULONG TitleIndex;
1898 ULONG NameLength;
1899 WCHAR Name[1];
1900 } KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;
1901
1902 typedef struct _KEY_NODE_INFORMATION
1903 {
1904 LARGE_INTEGER LastWriteTime;
1905 ULONG TitleIndex;
1906 ULONG ClassOffset;
1907 ULONG ClassLength;
1908 ULONG NameLength;
1909 WCHAR Name[1];
1910 /* Class[1]; */
1911 } KEY_NODE_INFORMATION, *PKEY_NODE_INFORMATION;
1912
1913 typedef struct _KEY_FULL_INFORMATION
1914 {
1915 LARGE_INTEGER LastWriteTime;
1916 ULONG TitleIndex;
1917 ULONG ClassOffset;
1918 ULONG ClassLength;
1919 ULONG SubKeys;
1920 ULONG MaxNameLen;
1921 ULONG MaxClassLen;
1922 ULONG Values;
1923 ULONG MaxValueNameLen;
1924 ULONG MaxValueDataLen;
1925 WCHAR Class[1];
1926 } KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION;
1927
1928 typedef struct _KEY_NAME_INFORMATION {
1929 ULONG NameLength;
1930 WCHAR Name[1];
1931 } KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION;
1932
1933 typedef struct _KEY_CACHED_INFORMATION
1934 {
1935 LARGE_INTEGER LastWriteTime;
1936 ULONG TitleIndex;
1937 ULONG SubKeys;
1938 ULONG MaxNameLen;
1939 ULONG Values;
1940 ULONG MaxValueNameLen;
1941 ULONG MaxValueDataLen;
1942 ULONG NameLength;
1943 } KEY_CACHED_INFORMATION, *PKEY_CACHED_INFORMATION;
1944
1945 typedef struct _KEY_VALUE_ENTRY
1946 {
1947 PUNICODE_STRING ValueName;
1948 ULONG DataLength;
1949 ULONG DataOffset;
1950 ULONG Type;
1951 } KEY_VALUE_ENTRY, *PKEY_VALUE_ENTRY;
1952
1953 typedef struct _KEY_VALUE_BASIC_INFORMATION {
1954 ULONG TitleIndex;
1955 ULONG Type;
1956 ULONG NameLength;
1957 WCHAR Name[1];
1958 } KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION;
1959
1960 typedef struct _KEY_VALUE_FULL_INFORMATION {
1961 ULONG TitleIndex;
1962 ULONG Type;
1963 ULONG DataOffset;
1964 ULONG DataLength;
1965 ULONG NameLength;
1966 WCHAR Name[1];
1967 } KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;
1968
1969 typedef struct _KEY_VALUE_PARTIAL_INFORMATION {
1970 ULONG TitleIndex;
1971 ULONG Type;
1972 ULONG DataLength;
1973 UCHAR Data[1];
1974 } KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;
1975
1976 #ifndef __OBJECT_ATTRIBUTES_DEFINED__
1977 #define __OBJECT_ATTRIBUTES_DEFINED__
1978 typedef struct _OBJECT_ATTRIBUTES {
1979 ULONG Length;
1980 HANDLE RootDirectory;
1981 PUNICODE_STRING ObjectName;
1982 ULONG Attributes;
1983 PVOID SecurityDescriptor; /* type SECURITY_DESCRIPTOR */
1984 PVOID SecurityQualityOfService; /* type SECURITY_QUALITY_OF_SERVICE */
1985 } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
1986 #endif
1987
1988 typedef struct _OBJECT_DATA_INFORMATION {
1989 BOOLEAN InheritHandle;
1990 BOOLEAN ProtectFromClose;
1991 } OBJECT_DATA_INFORMATION, *POBJECT_DATA_INFORMATION;
1992
1993 typedef struct _OBJECT_BASIC_INFORMATION {
1994 ULONG Attributes;
1995 ACCESS_MASK GrantedAccess;
1996 ULONG HandleCount;
1997 ULONG PointerCount;
1998 ULONG PagedPoolUsage;
1999 ULONG NonPagedPoolUsage;
2000 ULONG Reserved[3];
2001 ULONG NameInformationLength;
2002 ULONG TypeInformationLength;
2003 ULONG SecurityDescriptorLength;
2004 LARGE_INTEGER CreateTime;
2005 } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
2006
2007 typedef struct _OBJECT_NAME_INFORMATION {
2008 UNICODE_STRING Name;
2009 } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
2010
2011 typedef struct __OBJECT_TYPE_INFORMATION {
2012 UNICODE_STRING TypeName;
2013 ULONG TotalNumberOfObjects;
2014 ULONG TotalNumberOfHandles;
2015 ULONG TotalPagedPoolUsage;
2016 ULONG TotalNonPagedPoolUsage;
2017 ULONG TotalNamePoolUsage;
2018 ULONG TotalHandleTableUsage;
2019 ULONG HighWaterNumberOfObjects;
2020 ULONG HighWaterNumberOfHandles;
2021 ULONG HighWaterPagedPoolUsage;
2022 ULONG HighWaterNonPagedPoolUsage;
2023 ULONG HighWaterNamePoolUsage;
2024 ULONG HighWaterHandleTableUsage;
2025 ULONG InvalidAttributes;
2026 GENERIC_MAPPING GenericMapping;
2027 ULONG ValidAccessMask;
2028 BOOLEAN SecurityRequired;
2029 BOOLEAN MaintainHandleCount;
2030 UCHAR TypeIndex;
2031 CHAR ReservedByte;
2032 ULONG PoolType;
2033 ULONG DefaultPagedPoolCharge;
2034 ULONG DefaultNonPagedPoolCharge;
2035 } OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;
2036
2037 typedef struct _OBJECT_TYPES_INFORMATION
2038 {
2039 ULONG NumberOfTypes;
2040 } OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION;
2041
2042 typedef struct _PROCESS_BASIC_INFORMATION {
2043 #ifdef __WINESRC__
2044 NTSTATUS ExitStatus;
2045 PEB *PebBaseAddress;
2046 ULONG_PTR AffinityMask;
2047 LONG BasePriority;
2048 ULONG_PTR UniqueProcessId;
2049 ULONG_PTR InheritedFromUniqueProcessId;
2050 #else
2051 PVOID Reserved1;
2052 PPEB PebBaseAddress;
2053 PVOID Reserved2[2];
2054 ULONG_PTR UniqueProcessId;
2055 PVOID Reserved3;
2056 #endif
2057 } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
2058
2059 #define PROCESS_PRIOCLASS_IDLE 1
2060 #define PROCESS_PRIOCLASS_NORMAL 2
2061 #define PROCESS_PRIOCLASS_HIGH 3
2062 #define PROCESS_PRIOCLASS_REALTIME 4
2063 #define PROCESS_PRIOCLASS_BELOW_NORMAL 5
2064 #define PROCESS_PRIOCLASS_ABOVE_NORMAL 6
2065
2066 typedef struct _PROCESS_PRIORITY_CLASS {
2067 BOOLEAN Foreground;
2068 UCHAR PriorityClass;
2069 } PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS;
2070
2071 typedef struct _PROCESS_STACK_ALLOCATION_INFORMATION
2072 {
2073 SIZE_T ReserveSize;
2074 SIZE_T ZeroBits;
2075 PVOID StackBase;
2076 } PROCESS_STACK_ALLOCATION_INFORMATION, *PPROCESS_STACK_ALLOCATION_INFORMATION;
2077
2078 typedef struct _PROCESS_STACK_ALLOCATION_INFORMATION_EX
2079 {
2080 ULONG PreferredNode;
2081 ULONG Reserved0;
2082 ULONG Reserved1;
2083 ULONG Reserved2;
2084 PROCESS_STACK_ALLOCATION_INFORMATION AllocInfo;
2085 } PROCESS_STACK_ALLOCATION_INFORMATION_EX, *PPROCESS_STACK_ALLOCATION_INFORMATION_EX;
2086
2087 typedef struct _RTL_HEAP_DEFINITION {
2088 ULONG Length; /* = sizeof(RTL_HEAP_DEFINITION) */
2089
2090 ULONG Unknown[11];
2091 } RTL_HEAP_DEFINITION, *PRTL_HEAP_DEFINITION;
2092
2093 typedef struct _RTL_RWLOCK {
2094 RTL_CRITICAL_SECTION rtlCS;
2095
2096 HANDLE hSharedReleaseSemaphore;
2097 UINT uSharedWaiters;
2098
2099 HANDLE hExclusiveReleaseSemaphore;
2100 UINT uExclusiveWaiters;
2101
2102 INT iNumberActive;
2103 HANDLE hOwningThreadId;
2104 DWORD dwTimeoutBoost;
2105 PVOID pDebugInfo;
2106 } RTL_RWLOCK, *LPRTL_RWLOCK;
2107
2108 /* System Information Class 0x00 */
2109
2110 typedef struct _SYSTEM_BASIC_INFORMATION {
2111 #ifdef __WINESRC__
2112 DWORD unknown;
2113 ULONG KeMaximumIncrement;
2114 ULONG PageSize;
2115 ULONG MmNumberOfPhysicalPages;
2116 ULONG MmLowestPhysicalPage;
2117 ULONG MmHighestPhysicalPage;
2118 ULONG_PTR AllocationGranularity;
2119 PVOID LowestUserAddress;
2120 PVOID HighestUserAddress;
2121 ULONG_PTR ActiveProcessorsAffinityMask;
2122 BYTE NumberOfProcessors;
2123 #else
2124 BYTE Reserved1[24];
2125 PVOID Reserved2[4];
2126 CCHAR NumberOfProcessors;
2127 #endif
2128 } SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;
2129
2130 /* System Information Class 0x01 */
2131
2132 typedef struct _SYSTEM_CPU_INFORMATION {
2133 USHORT ProcessorArchitecture;
2134 USHORT ProcessorLevel;
2135 USHORT ProcessorRevision;
2136 USHORT MaximumProcessors;
2137 ULONG ProcessorFeatureBits;
2138 } SYSTEM_CPU_INFORMATION, *PSYSTEM_CPU_INFORMATION;
2139
2140 /* definitions of bits in the Feature set for the x86 processors */
2141 #define CPU_FEATURE_VME 0x00000005 /* Virtual 86 Mode Extensions */
2142 #define CPU_FEATURE_TSC 0x00000002 /* Time Stamp Counter available */
2143 #define CPU_FEATURE_CMOV 0x00000008 /* Conditional Move instruction*/
2144 #define CPU_FEATURE_PGE 0x00000014 /* Page table Entry Global bit */
2145 #define CPU_FEATURE_PSE 0x00000024 /* Page Size Extension */
2146 #define CPU_FEATURE_MTRR 0x00000040 /* Memory Type Range Registers */
2147 #define CPU_FEATURE_CX8 0x00000080 /* Compare and eXchange 8 byte instr. */
2148 #define CPU_FEATURE_MMX 0x00000100 /* Multi Media eXtensions */
2149 #define CPU_FEATURE_X86 0x00000200 /* seems to be always ON, on the '86 */
2150 #define CPU_FEATURE_PAT 0x00000400 /* Page Attribute Table */
2151 #define CPU_FEATURE_FXSR 0x00000800 /* FXSAVE and FXSTORE instructions */
2152 #define CPU_FEATURE_SEP 0x00001000 /* SYSENTER and SYSEXIT instructions */
2153 #define CPU_FEATURE_SSE 0x00002000 /* SSE extensions (ext. MMX) */
2154 #define CPU_FEATURE_3DNOW 0x00004000 /* 3DNOW instructions available */
2155 #define CPU_FEATURE_SSE2 0x00010000 /* SSE2 extensions (XMMI64) */
2156 #define CPU_FEATURE_DS 0x00020000 /* Debug Store */
2157 #define CPU_FEATURE_HTT 0x00040000 /* Hyper Threading Technology */
2158 #define CPU_FEATURE_SSE3 0x00080000 /* SSE3 extensions */
2159 #define CPU_FEATURE_CX128 0x00100000 /* cmpxchg16b instruction */
2160 #define CPU_FEATURE_XSAVE 0x00800000 /* XSAVE instructions */
2161 #define CPU_FEATURE_2NDLEV 0x04000000 /* Second-level address translation */
2162 #define CPU_FEATURE_VIRT 0x08000000 /* Virtualization support */
2163 #define CPU_FEATURE_RDFS 0x10000000 /* RDFSBASE etc. instructions */
2164 #define CPU_FEATURE_NX 0x20000000 /* Data execution prevention */
2165
2166 /* FIXME: following values are made up, actual flags are unknown */
2167 #define CPU_FEATURE_SSSE3 0x00008000 /* SSSE3 instructions */
2168 #define CPU_FEATURE_SSE41 0x01000000 /* SSE41 instructions */
2169 #define CPU_FEATURE_SSE42 0x02000000 /* SSE42 instructions */
2170 #define CPU_FEATURE_AVX 0x40000000 /* AVX instructions */
2171 #define CPU_FEATURE_AVX2 0x80000000 /* AVX2 instructions */
2172 #define CPU_FEATURE_PAE 0x00200000
2173 #define CPU_FEATURE_DAZ 0x00400000
2174
2175 #define CPU_FEATURE_ARM_VFP_32 0x00000001
2176 #define CPU_FEATURE_ARM_NEON 0x00000002
2177 #define CPU_FEATURE_ARM_V8_CRC32 0x00000004
2178 #define CPU_FEATURE_ARM_V8_CRYPTO 0x00000008
2179
2180 /* System Information Class 0x02 */
2181
2182 /* Documented in "Windows NT/2000 Native API Reference" by Gary Nebbett. */
2183 typedef struct _SYSTEM_PERFORMANCE_INFORMATION {
2184 LARGE_INTEGER IdleTime;
2185 LARGE_INTEGER ReadTransferCount;
2186 LARGE_INTEGER WriteTransferCount;
2187 LARGE_INTEGER OtherTransferCount;
2188 ULONG ReadOperationCount;
2189 ULONG WriteOperationCount;
2190 ULONG OtherOperationCount;
2191 ULONG AvailablePages;
2192 ULONG TotalCommittedPages;
2193 ULONG TotalCommitLimit;
2194 ULONG PeakCommitment;
2195 ULONG PageFaults;
2196 ULONG WriteCopyFaults;
2197 ULONG TransitionFaults;
2198 ULONG Reserved1;
2199 ULONG DemandZeroFaults;
2200 ULONG PagesRead;
2201 ULONG PageReadIos;
2202 ULONG Reserved2[2];
2203 ULONG PagefilePagesWritten;
2204 ULONG PagefilePageWriteIos;
2205 ULONG MappedFilePagesWritten;
2206 ULONG MappedFilePageWriteIos;
2207 ULONG PagedPoolUsage;
2208 ULONG NonPagedPoolUsage;
2209 ULONG PagedPoolAllocs;
2210 ULONG PagedPoolFrees;
2211 ULONG NonPagedPoolAllocs;
2212 ULONG NonPagedPoolFrees;
2213 ULONG TotalFreeSystemPtes;
2214 ULONG SystemCodePage;
2215 ULONG TotalSystemDriverPages;
2216 ULONG TotalSystemCodePages;
2217 ULONG SmallNonPagedLookasideListAllocateHits;
2218 ULONG SmallPagedLookasideListAllocateHits;
2219 ULONG Reserved3;
2220 ULONG MmSystemCachePage;
2221 ULONG PagedPoolPage;
2222 ULONG SystemDriverPage;
2223 ULONG FastReadNoWait;
2224 ULONG FastReadWait;
2225 ULONG FastReadResourceMiss;
2226 ULONG FastReadNotPossible;
2227 ULONG FastMdlReadNoWait;
2228 ULONG FastMdlReadWait;
2229 ULONG FastMdlReadResourceMiss;
2230 ULONG FastMdlReadNotPossible;
2231 ULONG MapDataNoWait;
2232 ULONG MapDataWait;
2233 ULONG MapDataNoWaitMiss;
2234 ULONG MapDataWaitMiss;
2235 ULONG PinMappedDataCount;
2236 ULONG PinReadNoWait;
2237 ULONG PinReadWait;
2238 ULONG PinReadNoWaitMiss;
2239 ULONG PinReadWaitMiss;
2240 ULONG CopyReadNoWait;
2241 ULONG CopyReadWait;
2242 ULONG CopyReadNoWaitMiss;
2243 ULONG CopyReadWaitMiss;
2244 ULONG MdlReadNoWait;
2245 ULONG MdlReadWait;
2246 ULONG MdlReadNoWaitMiss;
2247 ULONG MdlReadWaitMiss;
2248 ULONG ReadAheadIos;
2249 ULONG LazyWriteIos;
2250 ULONG LazyWritePages;
2251 ULONG DataFlushes;
2252 ULONG DataPages;
2253 ULONG ContextSwitches;
2254 ULONG FirstLevelTbFills;
2255 ULONG SecondLevelTbFills;
2256 ULONG SystemCalls;
2257 } SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;
2258
2259 /* System Information Class 0x03 */
2260
2261 typedef struct _SYSTEM_TIMEOFDAY_INFORMATION {
2262 #ifdef __WINESRC__
2263 LARGE_INTEGER BootTime;
2264 LARGE_INTEGER SystemTime;
2265 LARGE_INTEGER TimeZoneBias;
2266 ULONG TimeZoneId;
2267 ULONG Reserved;
2268 ULONGLONG BootTimeBias;
2269 ULONGLONG SleepTimeBias;
2270 #else
2271 BYTE Reserved1[48];
2272 #endif
2273 } SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION; /* was SYSTEM_TIME_INFORMATION */
2274
2275 /* System Information Class 0x08 */
2276
2277 typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION {
2278 LARGE_INTEGER IdleTime;
2279 LARGE_INTEGER KernelTime;
2280 LARGE_INTEGER UserTime;
2281 LARGE_INTEGER Reserved1[2];
2282 ULONG Reserved2;
2283 } SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;
2284
2285 /* System Information Class 0x0b */
2286
2287 typedef struct _SYSTEM_DRIVER_INFORMATION {
2288 PVOID pvAddress;
2289 DWORD dwUnknown1;
2290 DWORD dwUnknown2;
2291 DWORD dwEntryIndex;
2292 DWORD dwUnknown3;
2293 char szName[MAX_PATH + 1];
2294 } SYSTEM_DRIVER_INFORMATION, *PSYSTEM_DRIVER_INFORMATION;
2295
2296 /* System Information Class 0x10 */
2297
2298 typedef struct _SYSTEM_HANDLE_ENTRY {
2299 ULONG OwnerPid;
2300 BYTE ObjectType;
2301 BYTE HandleFlags;
2302 USHORT HandleValue;
2303 PVOID ObjectPointer;
2304 ULONG AccessMask;
2305 } SYSTEM_HANDLE_ENTRY, *PSYSTEM_HANDLE_ENTRY;
2306
2307 typedef struct _SYSTEM_HANDLE_INFORMATION {
2308 ULONG Count;
2309 SYSTEM_HANDLE_ENTRY Handle[1];
2310 } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
2311
2312 typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX
2313 {
2314 void *Object;
2315 ULONG_PTR UniqueProcessId;
2316 ULONG_PTR HandleValue;
2317 ULONG GrantedAccess;
2318 USHORT CreatorBackTraceIndex;
2319 USHORT ObjectTypeIndex;
2320 ULONG HandleAttributes;
2321 ULONG Reserved;
2322 } SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX;
2323
2324 typedef struct _SYSTEM_HANDLE_INFORMATION_EX
2325 {
2326 ULONG_PTR NumberOfHandles;
2327 ULONG_PTR Reserved;
2328 SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1];
2329 } SYSTEM_HANDLE_INFORMATION_EX;
2330
2331 /* System Information Class 0x15 */
2332
2333 typedef struct _SYSTEM_CACHE_INFORMATION {
2334 ULONG CurrentSize;
2335 ULONG PeakSize;
2336 ULONG PageFaultCount;
2337 ULONG MinimumWorkingSet;
2338 ULONG MaximumWorkingSet;
2339 ULONG unused[4];
2340 #ifdef _WIN64
2341 ULONG unknown64[7];
2342 #endif
2343 } SYSTEM_CACHE_INFORMATION, *PSYSTEM_CACHE_INFORMATION;
2344
2345 /* System Information Class 0x17 */
2346
2347 typedef struct _SYSTEM_INTERRUPT_INFORMATION {
2348 BYTE Reserved1[24];
2349 } SYSTEM_INTERRUPT_INFORMATION, *PSYSTEM_INTERRUPT_INFORMATION;
2350
2351 typedef struct _SYSTEM_CONFIGURATION_INFO {
2352 union {
2353 ULONG OemId;
2354 struct {
2355 WORD ProcessorArchitecture;
2356 WORD Reserved;
2357 } tag1;
2358 } tag2;
2359 ULONG PageSize;
2360 PVOID MinimumApplicationAddress;
2361 PVOID MaximumApplicationAddress;
2362 ULONG ActiveProcessorMask;
2363 ULONG NumberOfProcessors;
2364 ULONG ProcessorType;
2365 ULONG AllocationGranularity;
2366 WORD ProcessorLevel;
2367 WORD ProcessorRevision;
2368 } SYSTEM_CONFIGURATION_INFO, *PSYSTEM_CONFIGURATION_INFO;
2369
2370 typedef struct _SYSTEM_EXCEPTION_INFORMATION {
2371 BYTE Reserved1[16];
2372 } SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION;
2373
2374 typedef struct _SYSTEM_LOOKASIDE_INFORMATION {
2375 BYTE Reserved1[32];
2376 } SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION;
2377
2378 typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION {
2379 BOOLEAN DebuggerEnabled;
2380 BOOLEAN DebuggerNotPresent;
2381 } SYSTEM_KERNEL_DEBUGGER_INFORMATION, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION;
2382
2383 typedef struct _VM_COUNTERS
2384 {
2385 SIZE_T PeakVirtualSize;
2386 SIZE_T VirtualSize;
2387 ULONG PageFaultCount;
2388 SIZE_T PeakWorkingSetSize;
2389 SIZE_T WorkingSetSize;
2390 SIZE_T QuotaPeakPagedPoolUsage;
2391 SIZE_T QuotaPagedPoolUsage;
2392 SIZE_T QuotaPeakNonPagedPoolUsage;
2393 SIZE_T QuotaNonPagedPoolUsage;
2394 SIZE_T PagefileUsage;
2395 SIZE_T PeakPagefileUsage;
2396 } VM_COUNTERS, *PVM_COUNTERS;
2397
2398 typedef struct _VM_COUNTERS_EX
2399 {
2400 SIZE_T PeakVirtualSize;
2401 SIZE_T VirtualSize;
2402 ULONG PageFaultCount;
2403 SIZE_T PeakWorkingSetSize;
2404 SIZE_T WorkingSetSize;
2405 SIZE_T QuotaPeakPagedPoolUsage;
2406 SIZE_T QuotaPagedPoolUsage;
2407 SIZE_T QuotaPeakNonPagedPoolUsage;
2408 SIZE_T QuotaNonPagedPoolUsage;
2409 SIZE_T PagefileUsage;
2410 SIZE_T PeakPagefileUsage;
2411 SIZE_T PrivateUsage;
2412 } VM_COUNTERS_EX, *PVM_COUNTERS_EX;
2413
2414 typedef struct _SYSTEM_PROCESS_INFORMATION {
2415 #ifdef __WINESRC__ /* win32/win64 */
2416 ULONG NextEntryOffset; /* 00/00 */
2417 DWORD dwThreadCount; /* 04/04 */
2418 DWORD dwUnknown1[6]; /* 08/08 */
2419 LARGE_INTEGER CreationTime; /* 20/20 */
2420 LARGE_INTEGER UserTime; /* 28/28 */
2421 LARGE_INTEGER KernelTime; /* 30/30 */
2422 UNICODE_STRING ProcessName; /* 38/38 */
2423 DWORD dwBasePriority; /* 40/48 */
2424 HANDLE UniqueProcessId; /* 44/50 */
2425 HANDLE ParentProcessId; /* 48/58 */
2426 ULONG HandleCount; /* 4c/60 */
2427 ULONG SessionId; /* 50/64 */
2428 DWORD dwUnknown4; /* 54/68 */
2429 VM_COUNTERS_EX vmCounters; /* 58/70 */
2430 IO_COUNTERS ioCounters; /* 88/d0 */
2431 SYSTEM_THREAD_INFORMATION ti[1]; /* b8/100 */
2432 #else
2433 ULONG NextEntryOffset; /* 00/00 */
2434 BYTE Reserved1[52]; /* 04/04 */
2435 PVOID Reserved2[3]; /* 38/38 */
2436 HANDLE UniqueProcessId; /* 44/50 */
2437 PVOID Reserved3; /* 48/58 */
2438 ULONG HandleCount; /* 4c/60 */
2439 BYTE Reserved4[4]; /* 50/64 */
2440 PVOID Reserved5[11]; /* 54/68 */
2441 SIZE_T PeakPagefileUsage; /* 80/c0 */
2442 SIZE_T PrivatePageCount; /* 84/c8 */
2443 LARGE_INTEGER Reserved6[6]; /* 88/d0 */
2444 #endif
2445 } SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
2446
2447 typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION {
2448 ULONG RegistryQuotaAllowed;
2449 ULONG RegistryQuotaUsed;
2450 PVOID Reserved1;
2451 } SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION;
2452
2453 typedef struct _SYSTEM_TIME_ADJUSTMENT_QUERY {
2454 ULONG TimeAdjustment;
2455 ULONG TimeIncrement;
2456 BOOLEAN TimeAdjustmentDisabled;
2457 } SYSTEM_TIME_ADJUSTMENT_QUERY, *PSYSTEM_TIME_ADJUSTMENT_QUERY;
2458
2459 typedef struct _SYSTEM_TIME_ADJUSTMENT {
2460 ULONG TimeAdjustment;
2461 BOOLEAN TimeAdjustmentDisabled;
2462 } SYSTEM_TIME_ADJUSTMENT, *PSYSTEM_TIME_ADJUSTMENT;
2463
2464 typedef enum _SYSTEM_FIRMWARE_TABLE_ACTION
2465 {
2466 SystemFirmwareTable_Enumerate = 0,
2467 SystemFirmwareTable_Get = 1
2468 } SYSTEM_FIRMWARE_TABLE_ACTION, *PSYSTEM_FIRMWARE_TABLE_ACTION;
2469
2470 /* System Information Class 0x4C */
2471
2472 typedef struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
2473 {
2474 ULONG ProviderSignature;
2475 SYSTEM_FIRMWARE_TABLE_ACTION Action;
2476 ULONG TableID;
2477 ULONG TableBufferLength;
2478 UCHAR TableBuffer[1];
2479 } SYSTEM_FIRMWARE_TABLE_INFORMATION, *PSYSTEM_FIRMWARE_TABLE_INFORMATION;
2480
2481 typedef struct _TIME_FIELDS
2482 { CSHORT Year;
2483 CSHORT Month;
2484 CSHORT Day;
2485 CSHORT Hour;
2486 CSHORT Minute;
2487 CSHORT Second;
2488 CSHORT Milliseconds;
2489 CSHORT Weekday;
2490 } TIME_FIELDS, *PTIME_FIELDS;
2491
2492 typedef struct _WINSTATIONINFORMATIONW {
2493 BYTE Reserved2[70];
2494 ULONG LogonId;
2495 BYTE Reserved3[1140];
2496 } WINSTATIONINFORMATIONW, *PWINSTATIONINFORMATIONW;
2497
2498 typedef BOOLEAN (WINAPI * PWINSTATIONQUERYINFORMATIONW)(HANDLE,ULONG,WINSTATIONINFOCLASS,PVOID,ULONG,PULONG);
2499
2500 typedef struct _LDR_RESOURCE_INFO
2501 {
2502 ULONG_PTR Type;
2503 ULONG_PTR Name;
2504 ULONG Language;
2505 } LDR_RESOURCE_INFO, *PLDR_RESOURCE_INFO;
2506
2507
2508 /* debug buffer definitions */
2509
2510 typedef struct _DEBUG_BUFFER {
2511 HANDLE SectionHandle;
2512 PVOID SectionBase;
2513 PVOID RemoteSectionBase;
2514 ULONG SectionBaseDelta;
2515 HANDLE EventPairHandle;
2516 ULONG Unknown[2];
2517 HANDLE RemoteThreadHandle;
2518 ULONG InfoClassMask;
2519 ULONG SizeOfInfo;
2520 ULONG AllocatedSize;
2521 ULONG SectionSize;
2522 PVOID ModuleInformation;
2523 PVOID BackTraceInformation;
2524 PVOID HeapInformation;
2525 PVOID LockInformation;
2526 PVOID Reserved[8];
2527 } DEBUG_BUFFER, *PDEBUG_BUFFER;
2528
2529 #define PDI_MODULES 0x01
2530 #define PDI_BACKTRACE 0x02
2531 #define PDI_HEAPS 0x04
2532 #define PDI_HEAP_TAGS 0x08
2533 #define PDI_HEAP_BLOCKS 0x10
2534 #define PDI_LOCKS 0x20
2535
2536 typedef struct _DEBUG_MODULE_INFORMATION {
2537 ULONG Reserved[2];
2538 ULONG Base;
2539 ULONG Size;
2540 ULONG Flags;
2541 USHORT Index;
2542 USHORT Unknown;
2543 USHORT LoadCount;
2544 USHORT ModuleNameOffset;
2545 CHAR ImageName[256];
2546 } DEBUG_MODULE_INFORMATION, *PDEBUG_MODULE_INFORMATION;
2547
2548 typedef struct _DEBUG_HEAP_INFORMATION {
2549 ULONG Base;
2550 ULONG Flags;
2551 USHORT Granularity;
2552 USHORT Unknown;
2553 ULONG Allocated;
2554 ULONG Committed;
2555 ULONG TagCount;
2556 ULONG BlockCount;
2557 ULONG Reserved[7];
2558 PVOID Tags;
2559 PVOID Blocks;
2560 } DEBUG_HEAP_INFORMATION, *PDEBUG_HEAP_INFORMATION;
2561
2562 typedef struct _DEBUG_LOCK_INFORMATION {
2563 PVOID Address;
2564 USHORT Type;
2565 USHORT CreatorBackTraceIndex;
2566 ULONG OwnerThreadId;
2567 ULONG ActiveCount;
2568 ULONG ContentionCount;
2569 ULONG EntryCount;
2570 ULONG RecursionCount;
2571 ULONG NumberOfSharedWaiters;
2572 ULONG NumberOfExclusiveWaiters;
2573 } DEBUG_LOCK_INFORMATION, *PDEBUG_LOCK_INFORMATION;
2574
2575 typedef struct _PORT_MESSAGE_HEADER {
2576 USHORT DataSize;
2577 USHORT MessageSize;
2578 USHORT MessageType;
2579 USHORT VirtualRangesOffset;
2580 CLIENT_ID ClientId;
2581 ULONG MessageId;
2582 ULONG SectionSize;
2583 } PORT_MESSAGE_HEADER, *PPORT_MESSAGE_HEADER, PORT_MESSAGE, *PPORT_MESSAGE;
2584
2585 typedef unsigned short RTL_ATOM, *PRTL_ATOM;
2586
2587 typedef enum _ATOM_INFORMATION_CLASS {
2588 AtomBasicInformation = 0,
2589 AtomTableInformation = 1,
2590 } ATOM_INFORMATION_CLASS;
2591
2592 typedef struct _ATOM_BASIC_INFORMATION {
2593 USHORT ReferenceCount;
2594 USHORT Pinned;
2595 USHORT NameLength;
2596 WCHAR Name[1];
2597 } ATOM_BASIC_INFORMATION, *PATOM_BASIC_INFORMATION;
2598
2599 /* FIXME: names probably not correct */
2600 typedef struct _RTL_HANDLE
2601 {
2602 struct _RTL_HANDLE * Next;
2603 } RTL_HANDLE;
2604
2605 /* FIXME: names probably not correct */
2606 typedef struct _RTL_HANDLE_TABLE
2607 {
2608 ULONG MaxHandleCount; /* 0x00 */
2609 ULONG HandleSize; /* 0x04 */
2610 ULONG Unused[2]; /* 0x08-0x0c */
2611 PVOID NextFree; /* 0x10 */
2612 PVOID FirstHandle; /* 0x14 */
2613 PVOID ReservedMemory; /* 0x18 */
2614 PVOID MaxHandle; /* 0x1c */
2615 } RTL_HANDLE_TABLE;
2616
2617 typedef struct _RTL_ATOM_TABLE_ENTRY
2618 {
2619 struct _RTL_ATOM_TABLE_ENTRY *HashLink;
2620 WORD HandleIndex;
2621 WORD Atom;
2622 WORD ReferenceCount;
2623 UCHAR Flags;
2624 UCHAR NameLength;
2625 WCHAR Name[1];
2626 } RTL_ATOM_TABLE_ENTRY, *PRTL_ATOM_TABLE_ENTRY;
2627
2628 typedef struct _RTL_ATOM_TABLE
2629 {
2630 ULONG Signature;
2631 RTL_CRITICAL_SECTION CriticalSection;
2632 RTL_HANDLE_TABLE HandleTable;
2633 ULONG NumberOfBuckets;
2634 RTL_ATOM_TABLE_ENTRY *Buckets[1];
2635 } *RTL_ATOM_TABLE, **PRTL_ATOM_TABLE;
2636
2637 /***********************************************************************
2638 * Defines
2639 */
2640
2641 /* flags for NtCreateFile and NtOpenFile */
2642 #define FILE_DIRECTORY_FILE 0x00000001
2643 #define FILE_WRITE_THROUGH 0x00000002
2644 #define FILE_SEQUENTIAL_ONLY 0x00000004
2645 #define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008
2646 #define FILE_SYNCHRONOUS_IO_ALERT 0x00000010
2647 #define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
2648 #define FILE_NON_DIRECTORY_FILE 0x00000040
2649 #define FILE_CREATE_TREE_CONNECTION 0x00000080
2650 #define FILE_COMPLETE_IF_OPLOCKED 0x00000100
2651 #define FILE_NO_EA_KNOWLEDGE 0x00000200
2652 #define FILE_OPEN_FOR_RECOVERY 0x00000400
2653 #define FILE_RANDOM_ACCESS 0x00000800
2654 #define FILE_DELETE_ON_CLOSE 0x00001000
2655 #define FILE_OPEN_BY_FILE_ID 0x00002000
2656 #define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000
2657 #define FILE_NO_COMPRESSION 0x00008000
2658 #define FILE_RESERVE_OPFILTER 0x00100000
2659 #define FILE_OPEN_REPARSE_POINT 0x00200000
2660 #define FILE_OPEN_OFFLINE_FILE 0x00400000
2661 #define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000
2662
2663 #define FILE_ATTRIBUTE_VALID_FLAGS 0x00007fb7
2664 #define FILE_ATTRIBUTE_VALID_SET_FLAGS 0x000031a7
2665
2666 /* status for NtCreateFile or NtOpenFile */
2667 #define FILE_SUPERSEDED 0
2668 #define FILE_OPENED 1
2669 #define FILE_CREATED 2
2670 #define FILE_OVERWRITTEN 3
2671 #define FILE_EXISTS 4
2672 #define FILE_DOES_NOT_EXIST 5
2673
2674 /* disposition for NtCreateFile */
2675 #define FILE_SUPERSEDE 0
2676 #define FILE_OPEN 1
2677 #define FILE_CREATE 2
2678 #define FILE_OPEN_IF 3
2679 #define FILE_OVERWRITE 4
2680 #define FILE_OVERWRITE_IF 5
2681 #define FILE_MAXIMUM_DISPOSITION 5
2682
2683 /* Characteristics of a File System */
2684 #define FILE_REMOVABLE_MEDIA 0x00000001
2685 #define FILE_READ_ONLY_DEVICE 0x00000002
2686 #define FILE_FLOPPY_DISKETTE 0x00000004
2687 #define FILE_WRITE_ONE_MEDIA 0x00000008
2688 #define FILE_REMOTE_DEVICE 0x00000010
2689 #define FILE_DEVICE_IS_MOUNTED 0x00000020
2690 #define FILE_VIRTUAL_VOLUME 0x00000040
2691 #define FILE_AUTOGENERATED_DEVICE_NAME 0x00000080
2692 #define FILE_DEVICE_SECURE_OPEN 0x00000100
2693 #define FILE_CHARACTERISTIC_PNP_DEVICE 0x00000800
2694 #define FILE_CHARACTERISTIC_TS_DEVICE 0x00001000
2695 #define FILE_CHARACTERISTIC_WEBDAV_DEVICE 0x00002000
2696 #define FILE_CHARACTERISTIC_CSV 0x00010000
2697 #define FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL 0x00020000
2698 #define FILE_PORTABLE_DEVICE 0x00040000
2699
2700 /* options for NtCreateNamedPipeFile */
2701 #define FILE_PIPE_INBOUND 0x00000000
2702 #define FILE_PIPE_OUTBOUND 0x00000001
2703 #define FILE_PIPE_FULL_DUPLEX 0x00000002
2704
2705 /* options for pipe's type */
2706 #define FILE_PIPE_TYPE_MESSAGE 0x00000001
2707 #define FILE_PIPE_TYPE_BYTE 0x00000000
2708 /* options for pipe's message mode */
2709 #define FILE_PIPE_MESSAGE_MODE 0x00000001
2710 #define FILE_PIPE_BYTE_STREAM_MODE 0x00000000
2711 /* options for pipe's blocking mode */
2712 #define FILE_PIPE_COMPLETE_OPERATION 0x00000001
2713 #define FILE_PIPE_QUEUE_OPERATION 0x00000000
2714 /* and client / server end */
2715 #define FILE_PIPE_SERVER_END 0x00000001
2716 #define FILE_PIPE_CLIENT_END 0x00000000
2717
2718 #define INTERNAL_TS_ACTIVE_CONSOLE_ID ( *((volatile ULONG*)(0x7ffe02d8)) )
2719
2720 #define LOGONID_CURRENT ((ULONG)-1)
2721
2722 #define OBJ_PROTECT_CLOSE 0x00000001
2723 #define OBJ_INHERIT 0x00000002
2724 #define OBJ_PERMANENT 0x00000010
2725 #define OBJ_EXCLUSIVE 0x00000020
2726 #define OBJ_CASE_INSENSITIVE 0x00000040
2727 #define OBJ_OPENIF 0x00000080
2728 #define OBJ_OPENLINK 0x00000100
2729 #define OBJ_KERNEL_HANDLE 0x00000200
2730 #define OBJ_VALID_ATTRIBUTES 0x000003F2
2731
2732 #define SERVERNAME_CURRENT ((HANDLE)NULL)
2733
2734 typedef void (CALLBACK *PNTAPCFUNC)(ULONG_PTR,ULONG_PTR,ULONG_PTR); /* FIXME: not the right name */
2735 typedef void (CALLBACK *PRTL_THREAD_START_ROUTINE)(LPVOID); /* FIXME: not the right name */
2736 typedef DWORD (CALLBACK *PRTL_WORK_ITEM_ROUTINE)(LPVOID); /* FIXME: not the right name */
2737 typedef void (NTAPI *RTL_WAITORTIMERCALLBACKFUNC)(PVOID,BOOLEAN); /* FIXME: not the right name */
2738
2739
2740 /* DbgPrintEx default levels */
2741 #define DPFLTR_ERROR_LEVEL 0
2742 #define DPFLTR_WARNING_LEVEL 1
2743 #define DPFLTR_TRACE_LEVEL 2
2744 #define DPFLTR_INFO_LEVEL 3
2745 #define DPFLTR_MASK 0x8000000
2746
2747 /* Well-known LUID values */
2748 #define SE_MIN_WELL_KNOWN_PRIVILEGE 2
2749 #define SE_CREATE_TOKEN_PRIVILEGE 2
2750 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 3
2751 #define SE_LOCK_MEMORY_PRIVILEGE 4
2752 #define SE_INCREASE_QUOTA_PRIVILEGE 5
2753 #define SE_UNSOLICITED_INPUT_PRIVILEGE 6 /* obsolete */
2754 #define SE_MACHINE_ACCOUNT_PRIVILEGE 6
2755 #define SE_TCB_PRIVILEGE 7
2756 #define SE_SECURITY_PRIVILEGE 8
2757 #define SE_TAKE_OWNERSHIP_PRIVILEGE 9
2758 #define SE_LOAD_DRIVER_PRIVILEGE 10
2759 #define SE_SYSTEM_PROFILE_PRIVILEGE 11
2760 #define SE_SYSTEMTIME_PRIVILEGE 12
2761 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13
2762 #define SE_INC_BASE_PRIORITY_PRIVILEGE 14
2763 #define SE_CREATE_PAGEFILE_PRIVILEGE 15
2764 #define SE_CREATE_PERMANENT_PRIVILEGE 16
2765 #define SE_BACKUP_PRIVILEGE 17
2766 #define SE_RESTORE_PRIVILEGE 18
2767 #define SE_SHUTDOWN_PRIVILEGE 19
2768 #define SE_DEBUG_PRIVILEGE 20
2769 #define SE_AUDIT_PRIVILEGE 21
2770 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22
2771 #define SE_CHANGE_NOTIFY_PRIVILEGE 23
2772 #define SE_REMOTE_SHUTDOWN_PRIVILEGE 24
2773 #define SE_UNDOCK_PRIVILEGE 25
2774 #define SE_SYNC_AGENT_PRIVILEGE 26
2775 #define SE_ENABLE_DELEGATION_PRIVILEGE 27
2776 #define SE_MANAGE_VOLUME_PRIVILEGE 28
2777 #define SE_IMPERSONATE_PRIVILEGE 29
2778 #define SE_CREATE_GLOBAL_PRIVILEGE 30
2779 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_GLOBAL_PRIVILEGE
2780
2781 /* NtGlobalFlag bits */
2782 #define FLG_STOP_ON_EXCEPTION 0x00000001
2783 #define FLG_SHOW_LDR_SNAPS 0x00000002
2784 #define FLG_DEBUG_INITIAL_COMMAND 0x00000004
2785 #define FLG_STOP_ON_HUNG_GUI 0x00000008
2786 #define FLG_HEAP_ENABLE_TAIL_CHECK 0x00000010
2787 #define FLG_HEAP_ENABLE_FREE_CHECK 0x00000020
2788 #define FLG_HEAP_VALIDATE_PARAMETERS 0x00000040
2789 #define FLG_HEAP_VALIDATE_ALL 0x00000080
2790 #define FLG_APPLICATION_VERIFIER 0x00000100
2791 #define FLG_POOL_ENABLE_TAGGING 0x00000400
2792 #define FLG_HEAP_ENABLE_TAGGING 0x00000800
2793 #define FLG_USER_STACK_TRACE_DB 0x00001000
2794 #define FLG_KERNEL_STACK_TRACE_DB 0x00002000
2795 #define FLG_MAINTAIN_OBJECT_TYPELIST 0x00004000
2796 #define FLG_HEAP_ENABLE_TAG_BY_DLL 0x00008000
2797 #define FLG_DISABLE_STACK_EXTENSION 0x00010000
2798 #define FLG_ENABLE_CSRDEBUG 0x00020000
2799 #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD 0x00040000
2800 #define FLG_DISABLE_PAGE_KERNEL_STACKS 0x00080000
2801 #define FLG_ENABLE_SYSTEM_CRIT_BREAKS 0x00100000
2802 #define FLG_HEAP_DISABLE_COALESCING 0x00200000
2803 #define FLG_ENABLE_CLOSE_EXCEPTIONS 0x00400000
2804 #define FLG_ENABLE_EXCEPTION_LOGGING 0x00800000
2805 #define FLG_ENABLE_HANDLE_TYPE_TAGGING 0x01000000
2806 #define FLG_HEAP_PAGE_ALLOCS 0x02000000
2807 #define FLG_DEBUG_INITIAL_COMMAND_EX 0x04000000
2808 #define FLG_DISABLE_DBGPRINT 0x08000000
2809 #define FLG_CRITSEC_EVENT_CREATION 0x10000000
2810 #define FLG_LDR_TOP_DOWN 0x20000000
2811 #define FLG_ENABLE_HANDLE_EXCEPTIONS 0x40000000
2812 #define FLG_DISABLE_PROTDLLS 0x80000000
2813
2814 /* Rtl*Registry* functions structs and defines */
2815 #define RTL_REGISTRY_ABSOLUTE 0
2816 #define RTL_REGISTRY_SERVICES 1
2817 #define RTL_REGISTRY_CONTROL 2
2818 #define RTL_REGISTRY_WINDOWS_NT 3
2819 #define RTL_REGISTRY_DEVICEMAP 4
2820 #define RTL_REGISTRY_USER 5
2821
2822 #define RTL_REGISTRY_HANDLE 0x40000000
2823 #define RTL_REGISTRY_OPTIONAL 0x80000000
2824
2825 #define RTL_QUERY_REGISTRY_SUBKEY 0x00000001
2826 #define RTL_QUERY_REGISTRY_TOPKEY 0x00000002
2827 #define RTL_QUERY_REGISTRY_REQUIRED 0x00000004
2828 #define RTL_QUERY_REGISTRY_NOVALUE 0x00000008
2829 #define RTL_QUERY_REGISTRY_NOEXPAND 0x00000010
2830 #define RTL_QUERY_REGISTRY_DIRECT 0x00000020
2831 #define RTL_QUERY_REGISTRY_DELETE 0x00000040
2832 #define RTL_QUERY_REGISTRY_TYPECHECK 0x00000100
2833
2834 #define RTL_QUERY_REGISTRY_TYPECHECK_SHIFT 24
2835
2836 typedef NTSTATUS (WINAPI *PRTL_QUERY_REGISTRY_ROUTINE)( PCWSTR ValueName,
2837 ULONG ValueType,
2838 PVOID ValueData,
2839 ULONG ValueLength,
2840 PVOID Context,
2841 PVOID EntryContext);
2842
2843 typedef struct _RTL_QUERY_REGISTRY_TABLE
2844 {
2845 PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine;
2846 ULONG Flags;
2847 PWSTR Name;
2848 PVOID EntryContext;
2849 ULONG DefaultType;
2850 PVOID DefaultData;
2851 ULONG DefaultLength;
2852 } RTL_QUERY_REGISTRY_TABLE, *PRTL_QUERY_REGISTRY_TABLE;
2853
2854 typedef struct _KEY_MULTIPLE_VALUE_INFORMATION
2855 {
2856 PUNICODE_STRING ValueName;
2857 ULONG DataLength;
2858 ULONG DataOffset;
2859 ULONG Type;
2860 } KEY_MULTIPLE_VALUE_INFORMATION, *PKEY_MULTIPLE_VALUE_INFORMATION;
2861
2862 typedef VOID (CALLBACK *PRTL_OVERLAPPED_COMPLETION_ROUTINE)(DWORD,DWORD,LPVOID);
2863
2864 typedef VOID (CALLBACK *PTIMER_APC_ROUTINE) ( PVOID, ULONG, LONG );
2865
2866 typedef enum _EVENT_INFORMATION_CLASS {
2867 EventBasicInformation
2868 } EVENT_INFORMATION_CLASS, *PEVENT_INFORMATION_CLASS;
2869
2870 typedef struct _EVENT_BASIC_INFORMATION {
2871 EVENT_TYPE EventType;
2872 LONG EventState;
2873 } EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;
2874
2875 typedef enum _SEMAPHORE_INFORMATION_CLASS {
2876 SemaphoreBasicInformation
2877 } SEMAPHORE_INFORMATION_CLASS, *PSEMAPHORE_INFORMATION_CLASS;
2878
2879 typedef struct _SEMAPHORE_BASIC_INFORMATION {
2880 ULONG CurrentCount;
2881 ULONG MaximumCount;
2882 } SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;
2883
2884 typedef enum _SECTION_INFORMATION_CLASS
2885 {
2886 SectionBasicInformation,
2887 SectionImageInformation,
2888 SectionRelocationInformation,
2889 SectionOriginalBaseInformation,
2890 SectionInternalImageInformation
2891 } SECTION_INFORMATION_CLASS;
2892
2893 typedef struct _SECTION_BASIC_INFORMATION {
2894 PVOID BaseAddress;
2895 ULONG Attributes;
2896 LARGE_INTEGER Size;
2897 } SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;
2898
2899 typedef struct _SECTION_IMAGE_INFORMATION {
2900 PVOID TransferAddress;
2901 ULONG ZeroBits;
2902 SIZE_T MaximumStackSize;
2903 SIZE_T CommittedStackSize;
2904 ULONG SubSystemType;
2905 USHORT MinorSubsystemVersion;
2906 USHORT MajorSubsystemVersion;
2907 USHORT MajorOperatingSystemVersion;
2908 USHORT MinorOperatingSystemVersion;
2909 USHORT ImageCharacteristics;
2910 USHORT DllCharacteristics;
2911 USHORT Machine;
2912 BOOLEAN ImageContainsCode;
2913 union
2914 {
2915 UCHAR ImageFlags;
2916 struct
2917 {
2918 UCHAR ComPlusNativeReady : 1;
2919 UCHAR ComPlusILOnly : 1;
2920 UCHAR ImageDynamicallyRelocated : 1;
2921 UCHAR ImageMappedFlat : 1;
2922 UCHAR BaseBelow4gb : 1;
2923 UCHAR ComPlusPrefer32bit : 1;
2924 #ifdef __WINESRC__ /* Wine extensions */
2925 UCHAR WineBuiltin : 1;
2926 UCHAR WineFakeDll : 1;
2927 #else
2928 UCHAR Reserved : 2;
2929 #endif
2930 } DUMMYSTRUCTNAME;
2931 } DUMMYUNIONNAME;
2932 ULONG LoaderFlags;
2933 ULONG ImageFileSize;
2934 ULONG CheckSum;
2935 } SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;
2936
2937 typedef struct _LPC_SECTION_WRITE {
2938 ULONG Length;
2939 HANDLE SectionHandle;
2940 ULONG SectionOffset;
2941 ULONG ViewSize;
2942 PVOID ViewBase;
2943 PVOID TargetViewBase;
2944 } LPC_SECTION_WRITE, *PLPC_SECTION_WRITE;
2945
2946 typedef struct _LPC_SECTION_READ {
2947 ULONG Length;
2948 ULONG ViewSize;
2949 PVOID ViewBase;
2950 } LPC_SECTION_READ, *PLPC_SECTION_READ;
2951
2952 typedef struct _LPC_MESSAGE {
2953 USHORT DataSize;
2954 USHORT MessageSize;
2955 USHORT MessageType;
2956 USHORT VirtualRangesOffset;
2957 CLIENT_ID ClientId;
2958 ULONG_PTR MessageId;
2959 ULONG_PTR SectionSize;
2960 UCHAR Data[ANYSIZE_ARRAY];
2961 } LPC_MESSAGE, *PLPC_MESSAGE;
2962
2963 typedef struct _RTL_USER_PROCESS_INFORMATION
2964 {
2965 ULONG Length;
2966 HANDLE Process;
2967 HANDLE Thread;
2968 CLIENT_ID ClientId;
2969 SECTION_IMAGE_INFORMATION ImageInformation;
2970 } RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION;
2971
2972 typedef enum _SHUTDOWN_ACTION {
2973 ShutdownNoReboot,
2974 ShutdownReboot,
2975 ShutdownPowerOff
2976 } SHUTDOWN_ACTION, *PSHUTDOWN_ACTION;
2977
2978 typedef struct _COUNTED_REASON_CONTEXT
2979 {
2980 ULONG Version;
2981 ULONG Flags;
2982 union
2983 {
2984 struct
2985 {
2986 UNICODE_STRING ResourceFileName;
2987 USHORT ResourceReasonId;
2988 ULONG StringCount;
2989 UNICODE_STRING *ReasonStrings;
2990 } DUMMYSTRUCTNAME;
2991 UNICODE_STRING SimpleString;
2992 } DUMMYUNIONNAME;
2993 } COUNTED_REASON_CONTEXT, *PCOUNTED_REASON_CONTEXT;
2994
2995 typedef enum _KPROFILE_SOURCE {
2996 ProfileTime,
2997 ProfileAlignmentFixup,
2998 ProfileTotalIssues,
2999 ProfilePipelineDry,
3000 ProfileLoadInstructions,
3001 ProfilePipelineFrozen,
3002 ProfileBranchInstructions,
3003 ProfileTotalNonissues,
3004 ProfileDcacheMisses,
3005 ProfileIcacheMisses,
3006 ProfileCacheMisses,
3007 ProfileBranchMispredictions,
3008 ProfileStoreInstructions,
3009 ProfileFpInstructions,
3010 ProfileIntegerInstructions,
3011 Profile2Issue,
3012 Profile3Issue,
3013 Profile4Issue,
3014 ProfileSpecialInstructions,
3015 ProfileTotalCycles,
3016 ProfileIcacheIssues,
3017 ProfileDcacheAccesses,
3018 ProfileMemoryBarrierCycles,
3019 ProfileLoadLinkedIssues,
3020 ProfileMaximum
3021 } KPROFILE_SOURCE, *PKPROFILE_SOURCE;
3022
3023 typedef struct _DIRECTORY_BASIC_INFORMATION {
3024 UNICODE_STRING ObjectName;
3025 UNICODE_STRING ObjectTypeName;
3026 } DIRECTORY_BASIC_INFORMATION, *PDIRECTORY_BASIC_INFORMATION;
3027
3028 typedef struct _INITIAL_TEB {
3029 void *OldStackBase;
3030 void *OldStackLimit;
3031 void *StackBase;
3032 void *StackLimit;
3033 void *DeallocationStack;
3034 } INITIAL_TEB, *PINITIAL_TEB;
3035
3036 typedef enum _PORT_INFORMATION_CLASS {
3037 PortNoInformation
3038 } PORT_INFORMATION_CLASS, *PPORT_INFORMATION_CLASS;
3039
3040 typedef enum _IO_COMPLETION_INFORMATION_CLASS {
3041 IoCompletionBasicInformation
3042 } IO_COMPLETION_INFORMATION_CLASS, *PIO_COMPLETION_INFORMATION_CLASS;
3043
3044 typedef struct _FILE_COMPLETION_INFORMATION {
3045 HANDLE CompletionPort;
3046 ULONG_PTR CompletionKey;
3047 } FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;
3048
3049 #define IO_COMPLETION_QUERY_STATE 0x0001
3050 #define IO_COMPLETION_MODIFY_STATE 0x0002
3051 #define IO_COMPLETION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3)
3052
3053 typedef struct _FILE_IO_COMPLETION_INFORMATION {
3054 ULONG_PTR CompletionKey;
3055 ULONG_PTR CompletionValue;
3056 IO_STATUS_BLOCK IoStatusBlock;
3057 } FILE_IO_COMPLETION_INFORMATION, *PFILE_IO_COMPLETION_INFORMATION;
3058
3059 typedef enum _HARDERROR_RESPONSE_OPTION {
3060 OptionAbortRetryIgnore,
3061 OptionOk,
3062 OptionOkCancel,
3063 OptionRetryCancel,
3064 OptionYesNo,
3065 OptionYesNoCancel,
3066 OptionShutdownSystem
3067 } HARDERROR_RESPONSE_OPTION, *PHARDERROR_RESPONSE_OPTION;
3068
3069 typedef enum _HARDERROR_RESPONSE {
3070 ResponseReturnToCaller,
3071 ResponseNotHandled,
3072 ResponseAbort,
3073 ResponseCancel,
3074 ResponseIgnore,
3075 ResponseNo,
3076 ResponseOk,
3077 ResponseRetry,
3078 ResponseYes
3079 } HARDERROR_RESPONSE, *PHARDERROR_RESPONSE;
3080
3081 typedef enum _SYSDBG_COMMAND {
3082 SysDbgQueryModuleInformation,
3083 SysDbgQueryTraceInformation,
3084 SysDbgSetTracepoint,
3085 SysDbgSetSpecialCall,
3086 SysDbgClearSpecialCalls,
3087 SysDbgQuerySpecialCalls,
3088 SysDbgBreakPoint,
3089 SysDbgQueryVersion,
3090 SysDbgReadVirtual,
3091 SysDbgWriteVirtual,
3092 SysDbgReadPhysical,
3093 SysDbgWritePhysical,
3094 SysDbgReadControlSpace,
3095 SysDbgWriteControlSpace,
3096 SysDbgReadIoSpace,
3097 SysDbgWriteIoSpace,
3098 SysDbgReadMsr,
3099 SysDbgWriteMsr,
3100 SysDbgReadBusData,
3101 SysDbgWriteBusData
3102 } SYSDBG_COMMAND, *PSYSDBG_COMMAND;
3103
3104 typedef struct _CPTABLEINFO
3105 {
3106 USHORT CodePage;
3107 USHORT MaximumCharacterSize;
3108 USHORT DefaultChar;
3109 USHORT UniDefaultChar;
3110 USHORT TransDefaultChar;
3111 USHORT TransUniDefaultChar;
3112 USHORT DBCSCodePage;
3113 UCHAR LeadByte[12];
3114 USHORT *MultiByteTable;
3115 void *WideCharTable;
3116 USHORT *DBCSRanges;
3117 USHORT *DBCSOffsets;
3118 } CPTABLEINFO, *PCPTABLEINFO;
3119
3120 typedef struct _NLSTABLEINFO
3121 {
3122 CPTABLEINFO OemTableInfo;
3123 CPTABLEINFO AnsiTableInfo;
3124 USHORT *UpperCaseTable;
3125 USHORT *LowerCaseTable;
3126 } NLSTABLEINFO, *PNLSTABLEINFO;
3127
3128 /*************************************************************************
3129 * Loader structures
3130 *
3131 * Those are not part of standard Winternl.h
3132 */
3133
3134 typedef struct _LDR_SERVICE_TAG_RECORD
3135 {
3136 struct _LDR_SERVICE_TAG_RECORD *Next;
3137 ULONG ServiceTag;
3138 } LDR_SERVICE_TAG_RECORD, *PLDR_SERVICE_TAG_RECORD;
3139
3140 typedef struct _LDRP_CSLIST
3141 {
3142 SINGLE_LIST_ENTRY *Tail;
3143 } LDRP_CSLIST, *PLDRP_CSLIST;
3144
3145 typedef enum _LDR_DDAG_STATE
3146 {
3147 LdrModulesMerged = -5,
3148 LdrModulesInitError = -4,
3149 LdrModulesSnapError = -3,
3150 LdrModulesUnloaded = -2,
3151 LdrModulesUnloading = -1,
3152 LdrModulesPlaceHolder = 0,
3153 LdrModulesMapping = 1,
3154 LdrModulesMapped = 2,
3155 LdrModulesWaitingForDependencies = 3,
3156 LdrModulesSnapping = 4,
3157 LdrModulesSnapped = 5,
3158 LdrModulesCondensed = 6,
3159 LdrModulesReadyToInit = 7,
3160 LdrModulesInitializing = 8,
3161 LdrModulesReadyToRun = 9,
3162 } LDR_DDAG_STATE;
3163
3164 typedef struct _LDR_DDAG_NODE
3165 {
3166 LIST_ENTRY Modules;
3167 LDR_SERVICE_TAG_RECORD *ServiceTagList;
3168 ULONG LoadCount;
3169 ULONG ReferenceCount;
3170 ULONG DependencyCount;
3171 union
3172 {
3173 LDRP_CSLIST Dependencies;
3174 SINGLE_LIST_ENTRY RemovalLink;
3175 };
3176 LDRP_CSLIST IncomingDependencies;
3177 LDR_DDAG_STATE State;
3178 SINGLE_LIST_ENTRY CondenseLink;
3179 ULONG PreorderNumber;
3180 ULONG LowestLink;
3181 } LDR_DDAG_NODE, *PLDR_DDAG_NODE;
3182
3183 typedef enum _LDR_DLL_LOAD_REASON
3184 {
3185 LoadReasonStaticDependency,
3186 LoadReasonStaticForwarderDependency,
3187 LoadReasonDynamicForwarderDependency,
3188 LoadReasonDelayloadDependency,
3189 LoadReasonDynamicLoad,
3190 LoadReasonAsImageLoad,
3191 LoadReasonAsDataLoad,
3192 LoadReasonUnknown = -1
3193 } LDR_DLL_LOAD_REASON, *PLDR_DLL_LOAD_REASON;
3194
3195 typedef struct _LDR_DATA_TABLE_ENTRY
3196 {
3197 LIST_ENTRY InLoadOrderLinks;
3198 LIST_ENTRY InMemoryOrderLinks;
3199 LIST_ENTRY InInitializationOrderLinks;
3200 void* DllBase;
3201 void* EntryPoint;
3202 ULONG SizeOfImage;
3203 UNICODE_STRING FullDllName;
3204 UNICODE_STRING BaseDllName;
3205 ULONG Flags;
3206 SHORT LoadCount;
3207 SHORT TlsIndex;
3208 HANDLE SectionHandle;
3209 ULONG CheckSum;
3210 ULONG TimeDateStamp;
3211 HANDLE ActivationContext;
3212 void* Lock;
3213 LDR_DDAG_NODE* DdagNode;
3214 LIST_ENTRY NodeModuleLink;
3215 struct _LDRP_LOAD_CONTEXT *LoadContext;
3216 void* ParentDllBase;
3217 void* SwitchBackContext;
3218 RTL_BALANCED_NODE BaseAddressIndexNode;
3219 RTL_BALANCED_NODE MappingInfoIndexNode;
3220 ULONG_PTR OriginalBase;
3221 LARGE_INTEGER LoadTime;
3222 ULONG BaseNameHashValue;
3223 LDR_DLL_LOAD_REASON LoadReason;
3224 ULONG ImplicitPathOptions;
3225 ULONG ReferenceCount;
3226 } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
3227
3228 typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA
3229 {
3230 ULONG Flags;
3231 const UNICODE_STRING *FullDllName;
3232 const UNICODE_STRING *BaseDllName;
3233 void *DllBase;
3234 ULONG SizeOfImage;
3235 } LDR_DLL_LOADED_NOTIFICATION_DATA, *PLDR_DLL_LOADED_NOTIFICATION_DATA;
3236
3237 typedef struct _LDR_DLL_UNLOADED_NOTIFICATION_DATA
3238 {
3239 ULONG Flags;
3240 const UNICODE_STRING *FullDllName;
3241 const UNICODE_STRING *BaseDllName;
3242 void *DllBase;
3243 ULONG SizeOfImage;
3244 } LDR_DLL_UNLOADED_NOTIFICATION_DATA, *PLDR_DLL_UNLOADED_NOTIFICATION_DATA;
3245
3246 typedef union _LDR_DLL_NOTIFICATION_DATA
3247 {
3248 LDR_DLL_LOADED_NOTIFICATION_DATA Loaded;
3249 LDR_DLL_UNLOADED_NOTIFICATION_DATA Unloaded;
3250 } LDR_DLL_NOTIFICATION_DATA, *PLDR_DLL_NOTIFICATION_DATA;
3251
3252 typedef void (CALLBACK *PLDR_DLL_NOTIFICATION_FUNCTION)(ULONG, LDR_DLL_NOTIFICATION_DATA*, void*);
3253
3254 /* those defines are (some of the) regular LDR_DATA_TABLE_ENTRY.Flags values */
3255 #define LDR_IMAGE_IS_DLL 0x00000004
3256 #define LDR_LOAD_IN_PROGRESS 0x00001000
3257 #define LDR_UNLOAD_IN_PROGRESS 0x00002000
3258 #define LDR_NO_DLL_CALLS 0x00040000
3259 #define LDR_PROCESS_ATTACHED 0x00080000
3260 #define LDR_COR_IMAGE 0x00400000
3261 #define LDR_COR_ILONLY 0x01000000
3262
3263 /* these ones is Wine specific */
3264 #define LDR_DONT_RESOLVE_REFS 0x40000000
3265 #define LDR_WINE_INTERNAL 0x80000000
3266
3267 /* flag for LdrAddRefDll */
3268 #define LDR_ADDREF_DLL_PIN 0x00000001
3269
3270 #define LDR_DLL_NOTIFICATION_REASON_LOADED 1
3271 #define LDR_DLL_NOTIFICATION_REASON_UNLOADED 2
3272
3273 /* FIXME: to be checked */
3274 #define MAXIMUM_FILENAME_LENGTH 256
3275
3276 typedef struct _SYSTEM_MODULE
3277 {
3278 PVOID Section; /* 00/00 */
3279 PVOID MappedBaseAddress; /* 04/08 */
3280 PVOID ImageBaseAddress; /* 08/10 */
3281 ULONG ImageSize; /* 0c/18 */
3282 ULONG Flags; /* 10/1c */
3283 WORD LoadOrderIndex; /* 14/20 */
3284 WORD InitOrderIndex; /* 16/22 */
3285 WORD LoadCount; /* 18/24 */
3286 WORD NameOffset; /* 1a/26 */
3287 BYTE Name[MAXIMUM_FILENAME_LENGTH]; /* 1c/28 */
3288 } SYSTEM_MODULE, *PSYSTEM_MODULE;
3289
3290 typedef struct _SYSTEM_MODULE_INFORMATION
3291 {
3292 ULONG ModulesCount;
3293 SYSTEM_MODULE Modules[1]; /* FIXME: should be Modules[0] */
3294 } SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
3295
3296 #define PROCESS_CREATE_FLAGS_BREAKAWAY 0x00000001
3297 #define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT 0x00000002
3298 #define PROCESS_CREATE_FLAGS_INHERIT_HANDLES 0x00000004
3299 #define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008
3300 #define PROCESS_CREATE_FLAGS_LARGE_PAGES 0x00000010
3301 #define PROCESS_CREATE_FLAGS_LARGE_PAGE_SYSTEM_DLL 0x00000020
3302 #define PROCESS_CREATE_FLAGS_PROTECTED_PROCESS 0x00000040
3303 #define PROCESS_CREATE_FLAGS_CREATE_SESSION 0x00000080
3304 #define PROCESS_CREATE_FLAGS_INHERIT_FROM_PARENT 0x00000100
3305 #define PROCESS_CREATE_FLAGS_SUSPENDED 0x00000200
3306 #define PROCESS_CREATE_FLAGS_EXTENDED_UNKNOWN 0x00000400
3307
3308 typedef struct _RTL_PROCESS_MODULE_INFORMATION_EX
3309 {
3310 USHORT NextOffset;
3311 SYSTEM_MODULE BaseInfo;
3312 ULONG ImageCheckSum;
3313 ULONG TimeDateStamp;
3314 void *DefaultBase;
3315 } RTL_PROCESS_MODULE_INFORMATION_EX;
3316
3317 #define THREAD_CREATE_FLAGS_CREATE_SUSPENDED 0x00000001
3318 #define THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH 0x00000002
3319 #define THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER 0x00000004
3320 #define THREAD_CREATE_FLAGS_HAS_SECURITY_DESCRIPTOR 0x00000010
3321 #define THREAD_CREATE_FLAGS_ACCESS_CHECK_IN_TARGET 0x00000020
3322 #define THREAD_CREATE_FLAGS_INITIAL_THREAD 0x00000080
3323
3324 typedef LONG (CALLBACK *PRTL_EXCEPTION_FILTER)(PEXCEPTION_POINTERS);
3325
3326 typedef void (CALLBACK *PTP_IO_CALLBACK)(PTP_CALLBACK_INSTANCE,void*,void*,IO_STATUS_BLOCK*,PTP_IO);
3327
3328 #define PS_ATTRIBUTE_THREAD 0x00010000
3329 #define PS_ATTRIBUTE_INPUT 0x00020000
3330 #define PS_ATTRIBUTE_ADDITIVE 0x00040000
3331
3332 typedef enum _PS_ATTRIBUTE_NUM
3333 {
3334 PsAttributeParentProcess,
3335 PsAttributeDebugPort,
3336 PsAttributeToken,
3337 PsAttributeClientId,
3338 PsAttributeTebAddress,
3339 PsAttributeImageName,
3340 PsAttributeImageInfo,
3341 PsAttributeMemoryReserve,
3342 PsAttributePriorityClass,
3343 PsAttributeErrorMode,
3344 PsAttributeStdHandleInfo,
3345 PsAttributeHandleList,
3346 PsAttributeGroupAffinity,
3347 PsAttributePreferredNode,
3348 PsAttributeIdealProcessor,
3349 PsAttributeUmsThread,
3350 PsAttributeMitigationOptions,
3351 PsAttributeProtectionLevel,
3352 PsAttributeSecureProcess,
3353 PsAttributeJobList,
3354 PsAttributeChildProcessPolicy,
3355 PsAttributeAllApplicationPackagesPolicy,
3356 PsAttributeWin32kFilter,
3357 PsAttributeSafeOpenPromptOriginClaim,
3358 PsAttributeBnoIsolation,
3359 PsAttributeDesktopAppPolicy,
3360 PsAttributeChpe,
3361 PsAttributeMax
3362 } PS_ATTRIBUTE_NUM;
3363
3364 #define PS_ATTRIBUTE_PARENT_PROCESS (PsAttributeParentProcess | PS_ATTRIBUTE_INPUT | PS_ATTRIBUTE_ADDITIVE)
3365 #define PS_ATTRIBUTE_DEBUG_PORT (PsAttributeDebugPort | PS_ATTRIBUTE_INPUT | PS_ATTRIBUTE_ADDITIVE)
3366 #define PS_ATTRIBUTE_TOKEN (PsAttributeToken | PS_ATTRIBUTE_INPUT | PS_ATTRIBUTE_ADDITIVE)
3367 #define PS_ATTRIBUTE_CLIENT_ID (PsAttributeClientId | PS_ATTRIBUTE_THREAD)
3368 #define PS_ATTRIBUTE_TEB_ADDRESS (PsAttributeTebAddress | PS_ATTRIBUTE_THREAD)
3369 #define PS_ATTRIBUTE_IMAGE_NAME (PsAttributeImageName | PS_ATTRIBUTE_INPUT)
3370 #define PS_ATTRIBUTE_IMAGE_INFO (PsAttributeImageInfo)
3371 #define PS_ATTRIBUTE_MEMORY_RESERVE (PsAttributeMemoryReserve | PS_ATTRIBUTE_INPUT)
3372 #define PS_ATTRIBUTE_PRIORITY_CLASS (PsAttributePriorityClass | PS_ATTRIBUTE_INPUT)
3373 #define PS_ATTRIBUTE_ERROR_MODE (PsAttributeErrorMode | PS_ATTRIBUTE_INPUT)
3374 #define PS_ATTRIBUTE_STD_HANDLE_INFO (PsAttributeStdHandleInfo | PS_ATTRIBUTE_INPUT)
3375 #define PS_ATTRIBUTE_HANDLE_LIST (PsAttributeHandleList | PS_ATTRIBUTE_INPUT)
3376 #define PS_ATTRIBUTE_GROUP_AFFINITY (PsAttributeGroupAffinity | PS_ATTRIBUTE_THREAD | PS_ATTRIBUTE_INPUT)
3377 #define PS_ATTRIBUTE_PREFERRED_NODE (PsAttributePreferredNode | PS_ATTRIBUTE_INPUT)
3378 #define PS_ATTRIBUTE_IDEAL_PROCESSOR (PsAttributeIdealProcessor | PS_ATTRIBUTE_THREAD | PS_ATTRIBUTE_INPUT)
3379 #define PS_ATTRIBUTE_MITIGATION_OPTIONS (PsAttributeMitigationOptions | PS_ATTRIBUTE_INPUT | PS_ATTRIBUTE_UNKNOWN)
3380 #define PS_ATTRIBUTE_PROTECTION_LEVEL (PsAttributeProtectionLevel | PS_ATTRIBUTE_INPUT | PS_ATTRIBUTE_UNKNOWN)
3381 #define PS_ATTRIBUTE_SECURE_PROCESS (PsAttributeSecureProcess | PS_ATTRIBUTE_INPUT)
3382 #define PS_ATTRIBUTE_JOB_LIST (PsAttributeJobList | PS_ATTRIBUTE_INPUT)
3383 #define PS_ATTRIBUTE_CHILD_PROCESS_POLICY (PsAttributeChildProcessPolicy | PS_ATTRIBUTE_INPUT)
3384 #define PS_ATTRIBUTE_ALL_APPLICATION_PACKAGES_POLICY (PsAttributeAllApplicationPackagesPolicy | PS_ATTRIBUTE_INPUT)
3385 #define PS_ATTRIBUTE_WIN32K_FILTER (PsAttributeWin32kFilter | PS_ATTRIBUTE_INPUT)
3386 #define PS_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM (PsAttributeSafeOpenPromptOriginClaim | PS_ATTRIBUTE_INPUT)
3387 #define PS_ATTRIBUTE_BNO_ISOLATION (PsAttributeBnoIsolation | PS_ATTRIBUTE_INPUT)
3388 #define PS_ATTRIBUTE_DESKTOP_APP_POLICY (PsAttributeDesktopAppPolicy | PS_ATTRIBUTE_INPUT)
3389
3390 typedef struct _PS_ATTRIBUTE
3391 {
3392 ULONG_PTR Attribute;
3393 SIZE_T Size;
3394 union
3395 {
3396 ULONG_PTR Value;
3397 void *ValuePtr;
3398 };
3399 SIZE_T *ReturnLength;
3400 } PS_ATTRIBUTE;
3401
3402 typedef struct _PS_ATTRIBUTE_LIST
3403 {
3404 SIZE_T TotalLength;
3405 PS_ATTRIBUTE Attributes[1];
3406 } PS_ATTRIBUTE_LIST, *PPS_ATTRIBUTE_LIST;
3407
3408 typedef enum _PS_CREATE_STATE
3409 {
3410 PsCreateInitialState,
3411 PsCreateFailOnFileOpen,
3412 PsCreateFailOnSectionCreate,
3413 PsCreateFailExeFormat,
3414 PsCreateFailMachineMismatch,
3415 PsCreateFailExeName,
3416 PsCreateSuccess,
3417 PsCreateMaximumStates
3418 } PS_CREATE_STATE;
3419
3420 typedef struct _PS_CREATE_INFO
3421 {
3422 SIZE_T Size;
3423 PS_CREATE_STATE State;
3424 union
3425 {
3426 struct
3427 {
3428 union
3429 {
3430 ULONG InitFlags;
3431 struct
3432 {
3433 UCHAR WriteOutputOnExit : 1;
3434 UCHAR DetectManifest : 1;
3435 UCHAR IFEOSkipDebugger : 1;
3436 UCHAR IFEODoNotPropagateKeyState : 1;
3437 UCHAR SpareBits1 : 4;
3438 UCHAR SpareBits2 : 8;
3439 USHORT ProhibitedImageCharacteristics : 16;
3440 };
3441 };
3442 ACCESS_MASK AdditionalFileAccess;
3443 } InitState;
3444 struct
3445 {
3446 HANDLE FileHandle;
3447 } FailSection;
3448 struct
3449 {
3450 USHORT DllCharacteristics;
3451 } ExeFormat;
3452 struct
3453 {
3454 HANDLE IFEOKey;
3455 } ExeName;
3456 struct
3457 {
3458 union
3459 {
3460 ULONG OutputFlags;
3461 struct
3462 {
3463 UCHAR ProtectedProcess : 1;
3464 UCHAR AddressSpaceOverride : 1;
3465 UCHAR DevOverrideEnabled : 1;
3466 UCHAR ManifestDetected : 1;
3467 UCHAR ProtectedProcessLight : 1;
3468 UCHAR SpareBits1 : 3;
3469 UCHAR SpareBits2 : 8;
3470 USHORT SpareBits3 : 16;
3471 };
3472 };
3473 HANDLE FileHandle;
3474 HANDLE SectionHandle;
3475 ULONGLONG UserProcessParametersNative;
3476 ULONG UserProcessParametersWow64;
3477 ULONG CurrentParameterFlags;
3478 ULONGLONG PebAddressNative;
3479 ULONG PebAddressWow64;
3480 ULONGLONG ManifestAddress;
3481 ULONG ManifestSize;
3482 } SuccessState;
3483 };
3484 } PS_CREATE_INFO, *PPS_CREATE_INFO;
3485
3486 typedef struct _DBGKM_EXCEPTION
3487 {
3488 EXCEPTION_RECORD ExceptionRecord;
3489 ULONG FirstChance;
3490 } DBGKM_EXCEPTION, *PDBGKM_EXCEPTION;
3491
3492 typedef struct _DBGKM_CREATE_THREAD
3493 {
3494 ULONG SubSystemKey;
3495 PVOID StartAddress;
3496 } DBGKM_CREATE_THREAD, *PDBGKM_CREATE_THREAD;
3497
3498 typedef struct _DBGKM_CREATE_PROCESS
3499 {
3500 ULONG SubSystemKey;
3501 HANDLE FileHandle;
3502 PVOID BaseOfImage;
3503 ULONG DebugInfoFileOffset;
3504 ULONG DebugInfoSize;
3505 DBGKM_CREATE_THREAD InitialThread;
3506 } DBGKM_CREATE_PROCESS, *PDBGKM_CREATE_PROCESS;
3507
3508 typedef struct _DBGKM_EXIT_THREAD
3509 {
3510 NTSTATUS ExitStatus;
3511 } DBGKM_EXIT_THREAD, *PDBGKM_EXIT_THREAD;
3512
3513 typedef struct _DBGKM_EXIT_PROCESS
3514 {
3515 NTSTATUS ExitStatus;
3516 } DBGKM_EXIT_PROCESS, *PDBGKM_EXIT_PROCESS;
3517
3518 typedef struct _DBGKM_LOAD_DLL
3519 {
3520 HANDLE FileHandle;
3521 PVOID BaseOfDll;
3522 ULONG DebugInfoFileOffset;
3523 ULONG DebugInfoSize;
3524 PVOID NamePointer;
3525 } DBGKM_LOAD_DLL, *PDBGKM_LOAD_DLL;
3526
3527 typedef struct _DBGKM_UNLOAD_DLL
3528 {
3529 PVOID BaseAddress;
3530 } DBGKM_UNLOAD_DLL, *PDBGKM_UNLOAD_DLL;
3531
3532 typedef enum _DBG_STATE
3533 {
3534 DbgIdle,
3535 DbgReplyPending,
3536 DbgCreateThreadStateChange,
3537 DbgCreateProcessStateChange,
3538 DbgExitThreadStateChange,
3539 DbgExitProcessStateChange,
3540 DbgExceptionStateChange,
3541 DbgBreakpointStateChange,
3542 DbgSingleStepStateChange,
3543 DbgLoadDllStateChange,
3544 DbgUnloadDllStateChange
3545 } DBG_STATE, *PDBG_STATE;
3546
3547 typedef struct _DBGUI_CREATE_THREAD
3548 {
3549 HANDLE HandleToThread;
3550 DBGKM_CREATE_THREAD NewThread;
3551 } DBGUI_CREATE_THREAD, *PDBGUI_CREATE_THREAD;
3552
3553 typedef struct _DBGUI_CREATE_PROCESS
3554 {
3555 HANDLE HandleToProcess;
3556 HANDLE HandleToThread;
3557 DBGKM_CREATE_PROCESS NewProcess;
3558 } DBGUI_CREATE_PROCESS, *PDBGUI_CREATE_PROCESS;
3559
3560 typedef struct _DBGUI_WAIT_STATE_CHANGE
3561 {
3562 DBG_STATE NewState;
3563 CLIENT_ID AppClientId;
3564 union
3565 {
3566 DBGKM_EXCEPTION Exception;
3567 DBGUI_CREATE_THREAD CreateThread;
3568 DBGUI_CREATE_PROCESS CreateProcessInfo;
3569 DBGKM_EXIT_THREAD ExitThread;
3570 DBGKM_EXIT_PROCESS ExitProcess;
3571 DBGKM_LOAD_DLL LoadDll;
3572 DBGKM_UNLOAD_DLL UnloadDll;
3573 } StateInfo;
3574 } DBGUI_WAIT_STATE_CHANGE, *PDBGUI_WAIT_STATE_CHANGE;
3575
3576 struct _DEBUG_EVENT;
3577
3578 #define DEBUG_READ_EVENT 0x0001
3579 #define DEBUG_PROCESS_ASSIGN 0x0002
3580 #define DEBUG_SET_INFORMATION 0x0004
3581 #define DEBUG_QUERY_INFORMATION 0x0008
3582 #define DEBUG_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x0f)
3583
3584 #define DEBUG_KILL_ON_CLOSE 0x1
3585
3586 typedef enum _DEBUGOBJECTINFOCLASS
3587 {
3588 DebugObjectKillProcessOnExitInformation = 1,
3589 MaxDebugObjectInfoClass
3590 } DEBUGOBJECTINFOCLASS, *PDEBUGOBJECTINFOCLASS;
3591
3592
3593 typedef struct _WOW64_CPURESERVED
3594 {
3595 USHORT Flags;
3596 USHORT Machine;
3597 /* CONTEXT context */
3598 /* CONTEXT_EX *context_ex */
3599 } WOW64_CPURESERVED, *PWOW64_CPURESERVED;
3600
3601 typedef struct _WOW64_CPU_AREA_INFO
3602 {
3603 void *Context;
3604 void *ContextEx;
3605 void *ContextFlagsLocation;
3606 WOW64_CPURESERVED *CpuReserved;
3607 ULONG ContextFlag;
3608 USHORT Machine;
3609 } WOW64_CPU_AREA_INFO, *PWOW64_CPU_AREA_INFO;
3610
3611 /***********************************************************************
3612 * Function declarations
3613 */
3614
3615 NTSYSAPI void WINAPI DbgBreakPoint(void);
3616 NTSYSAPI NTSTATUS WINAPIV DbgPrint(LPCSTR fmt, ...);
3617 NTSYSAPI NTSTATUS WINAPIV DbgPrintEx(ULONG iComponentId, ULONG Level, LPCSTR fmt, ...);
3618 NTSYSAPI NTSTATUS WINAPI DbgUiConnectToDbg(void);
3619 NTSYSAPI NTSTATUS WINAPI DbgUiContinue(CLIENT_ID*,NTSTATUS);
3620 NTSYSAPI NTSTATUS WINAPI DbgUiConvertStateChangeStructure(DBGUI_WAIT_STATE_CHANGE*,struct _DEBUG_EVENT*);
3621 NTSYSAPI NTSTATUS WINAPI DbgUiDebugActiveProcess(HANDLE);
3622 NTSYSAPI HANDLE WINAPI DbgUiGetThreadDebugObject(void);
3623 NTSYSAPI NTSTATUS WINAPI DbgUiIssueRemoteBreakin(HANDLE);
3624 NTSYSAPI void WINAPI DbgUiRemoteBreakin(void*);
3625 NTSYSAPI void WINAPI DbgUiSetThreadDebugObject(HANDLE);
3626 NTSYSAPI NTSTATUS WINAPI DbgUiStopDebugging(HANDLE);
3627 NTSYSAPI NTSTATUS WINAPI DbgUiWaitStateChange(DBGUI_WAIT_STATE_CHANGE*,LARGE_INTEGER*);
3628 NTSYSAPI void WINAPI DbgUserBreakPoint(void);
3629 NTSYSAPI NTSTATUS WINAPI LdrAccessResource(HMODULE,const IMAGE_RESOURCE_DATA_ENTRY*,void**,PULONG);
3630 NTSYSAPI NTSTATUS WINAPI LdrAddDllDirectory(const UNICODE_STRING*,void**);
3631 NTSYSAPI NTSTATUS WINAPI LdrAddRefDll(ULONG,HMODULE);
3632 NTSYSAPI NTSTATUS WINAPI LdrDisableThreadCalloutsForDll(HMODULE);
3633 NTSYSAPI NTSTATUS WINAPI LdrFindEntryForAddress(const void*, PLDR_DATA_TABLE_ENTRY*);
3634 NTSYSAPI NTSTATUS WINAPI LdrFindResourceDirectory_U(HMODULE,const LDR_RESOURCE_INFO*,ULONG,const IMAGE_RESOURCE_DIRECTORY**);
3635 NTSYSAPI NTSTATUS WINAPI LdrFindResource_U(HMODULE,const LDR_RESOURCE_INFO*,ULONG,const IMAGE_RESOURCE_DATA_ENTRY**);
3636 NTSYSAPI NTSTATUS WINAPI LdrGetDllDirectory(UNICODE_STRING*);
3637 NTSYSAPI NTSTATUS WINAPI LdrGetDllHandle(LPCWSTR, ULONG, const UNICODE_STRING*, HMODULE*);
3638 NTSYSAPI NTSTATUS WINAPI LdrGetDllPath(PCWSTR,ULONG,PWSTR*,PWSTR*);
3639 NTSYSAPI NTSTATUS WINAPI LdrGetProcedureAddress(HMODULE, const ANSI_STRING*, ULONG, void**);
3640 NTSYSAPI NTSTATUS WINAPI LdrLoadDll(LPCWSTR, DWORD, const UNICODE_STRING*, HMODULE*);
3641 NTSYSAPI NTSTATUS WINAPI LdrLockLoaderLock(ULONG,ULONG*,ULONG_PTR*);
3642 IMAGE_BASE_RELOCATION * WINAPI LdrProcessRelocationBlock(void*,UINT,USHORT*,INT_PTR);
3643 NTSYSAPI NTSTATUS WINAPI LdrQueryImageFileExecutionOptions(const UNICODE_STRING*,LPCWSTR,ULONG,void*,ULONG,ULONG*);
3644 NTSYSAPI NTSTATUS WINAPI LdrQueryProcessModuleInformation(SYSTEM_MODULE_INFORMATION*, ULONG, ULONG*);
3645 NTSYSAPI NTSTATUS WINAPI LdrRegisterDllNotification(ULONG,PLDR_DLL_NOTIFICATION_FUNCTION,void*,void**);
3646 NTSYSAPI NTSTATUS WINAPI LdrRemoveDllDirectory(void*);
3647 NTSYSAPI NTSTATUS WINAPI LdrSetDefaultDllDirectories(ULONG);
3648 NTSYSAPI NTSTATUS WINAPI LdrSetDllDirectory(const UNICODE_STRING*);
3649 NTSYSAPI void WINAPI LdrShutdownProcess(void);
3650 NTSYSAPI void WINAPI LdrShutdownThread(void);
3651 NTSYSAPI NTSTATUS WINAPI LdrUnloadDll(HMODULE);
3652 NTSYSAPI NTSTATUS WINAPI LdrUnlockLoaderLock(ULONG,ULONG_PTR);
3653 NTSYSAPI NTSTATUS WINAPI LdrUnregisterDllNotification(void*);
3654 NTSYSAPI NTSTATUS WINAPI NtAcceptConnectPort(PHANDLE,ULONG,PLPC_MESSAGE,BOOLEAN,PLPC_SECTION_WRITE,PLPC_SECTION_READ);
3655 NTSYSAPI NTSTATUS WINAPI NtAccessCheck(PSECURITY_DESCRIPTOR,HANDLE,ACCESS_MASK,PGENERIC_MAPPING,PPRIVILEGE_SET,PULONG,PULONG,NTSTATUS*);
3656 NTSYSAPI NTSTATUS WINAPI NtAccessCheckAndAuditAlarm(PUNICODE_STRING,HANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,ACCESS_MASK,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PBOOLEAN,PBOOLEAN);
3657 NTSYSAPI NTSTATUS WINAPI NtAddAtom(const WCHAR*,ULONG,RTL_ATOM*);
3658 NTSYSAPI NTSTATUS WINAPI NtAdjustGroupsToken(HANDLE,BOOLEAN,PTOKEN_GROUPS,ULONG,PTOKEN_GROUPS,PULONG);
3659 NTSYSAPI NTSTATUS WINAPI NtAdjustPrivilegesToken(HANDLE,BOOLEAN,PTOKEN_PRIVILEGES,DWORD,PTOKEN_PRIVILEGES,PDWORD);
3660 NTSYSAPI NTSTATUS WINAPI NtAlertResumeThread(HANDLE,PULONG);
3661 NTSYSAPI NTSTATUS WINAPI NtAlertThread(HANDLE ThreadHandle);
3662 NTSYSAPI NTSTATUS WINAPI NtAllocateLocallyUniqueId(PLUID lpLuid);
3663 NTSYSAPI NTSTATUS WINAPI NtAllocateUuids(PULARGE_INTEGER,PULONG,PULONG,PUCHAR);
3664 NTSYSAPI NTSTATUS WINAPI NtAllocateVirtualMemory(HANDLE,PVOID*,ULONG_PTR,SIZE_T*,ULONG,ULONG);
3665 NTSYSAPI NTSTATUS WINAPI NtAllocateVirtualMemoryEx(HANDLE,PVOID*,SIZE_T*,ULONG,ULONG,MEM_EXTENDED_PARAMETER*,ULONG);
3666 NTSYSAPI NTSTATUS WINAPI NtAreMappedFilesTheSame(PVOID,PVOID);
3667 NTSYSAPI NTSTATUS WINAPI NtAssignProcessToJobObject(HANDLE,HANDLE);
3668 NTSYSAPI NTSTATUS WINAPI NtCallbackReturn(PVOID,ULONG,NTSTATUS);
3669 NTSYSAPI NTSTATUS WINAPI NtCancelIoFile(HANDLE,PIO_STATUS_BLOCK);
3670 NTSYSAPI NTSTATUS WINAPI NtCancelIoFileEx(HANDLE,PIO_STATUS_BLOCK,PIO_STATUS_BLOCK);
3671 NTSYSAPI NTSTATUS WINAPI NtCancelTimer(HANDLE, BOOLEAN*);
3672 NTSYSAPI NTSTATUS WINAPI NtClearEvent(HANDLE);
3673 NTSYSAPI NTSTATUS WINAPI NtClearPowerRequest(HANDLE,POWER_REQUEST_TYPE);
3674 NTSYSAPI NTSTATUS WINAPI NtClose(HANDLE);
3675 NTSYSAPI NTSTATUS WINAPI NtCloseObjectAuditAlarm(PUNICODE_STRING,HANDLE,BOOLEAN);
3676 NTSYSAPI NTSTATUS WINAPI NtCompleteConnectPort(HANDLE);
3677 NTSYSAPI NTSTATUS WINAPI NtConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
3678 NTSYSAPI NTSTATUS WINAPI NtContinue(PCONTEXT,BOOLEAN);
3679 NTSYSAPI NTSTATUS WINAPI NtCreateDebugObject(HANDLE*,ACCESS_MASK,OBJECT_ATTRIBUTES*,ULONG);
3680 NTSYSAPI NTSTATUS WINAPI NtCreateDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
3681 NTSYSAPI NTSTATUS WINAPI NtCreateEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *,EVENT_TYPE,BOOLEAN);
3682 NTSYSAPI NTSTATUS WINAPI NtCreateEventPair(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
3683 NTSYSAPI NTSTATUS WINAPI NtCreateFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG);
3684 NTSYSAPI NTSTATUS WINAPI NtCreateIoCompletion(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,ULONG);
3685 NTSYSAPI NTSTATUS WINAPI NtCreateJobObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3686 NTSYSAPI NTSTATUS WINAPI NtCreateKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,PULONG);
3687 NTSYSAPI NTSTATUS WINAPI NtCreateKeyTransacted(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,HANDLE,ULONG*);
3688 NTSYSAPI NTSTATUS WINAPI NtCreateKeyedEvent(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG);
3689 NTSYSAPI NTSTATUS WINAPI NtCreateMailslotFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG,ULONG,PLARGE_INTEGER);
3690 NTSYSAPI NTSTATUS WINAPI NtCreateMutant(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,BOOLEAN);
3691 NTSYSAPI NTSTATUS WINAPI NtCreateNamedPipeFile(PHANDLE,ULONG,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,PLARGE_INTEGER);
3692 NTSYSAPI NTSTATUS WINAPI NtCreatePagingFile(PUNICODE_STRING,PLARGE_INTEGER,PLARGE_INTEGER,PLARGE_INTEGER);
3693 NTSYSAPI NTSTATUS WINAPI NtCreatePort(PHANDLE,POBJECT_ATTRIBUTES,ULONG,ULONG,PULONG);
3694 NTSYSAPI NTSTATUS WINAPI NtCreatePowerRequest(HANDLE*,COUNTED_REASON_CONTEXT*);
3695 NTSYSAPI NTSTATUS WINAPI NtCreateProcess(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,HANDLE,BOOLEAN,HANDLE,HANDLE,HANDLE);
3696 NTSYSAPI NTSTATUS WINAPI NtCreateProfile(PHANDLE,HANDLE,PVOID,ULONG,ULONG,PVOID,ULONG,KPROFILE_SOURCE,KAFFINITY);
3697 NTSYSAPI NTSTATUS WINAPI NtCreateSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const LARGE_INTEGER*,ULONG,ULONG,HANDLE);
3698 NTSYSAPI NTSTATUS WINAPI NtCreateSemaphore(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,LONG,LONG);
3699 NTSYSAPI NTSTATUS WINAPI NtCreateSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PUNICODE_STRING);
3700 NTSYSAPI NTSTATUS WINAPI NtCreateThread(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,HANDLE,PCLIENT_ID,PCONTEXT,PINITIAL_TEB,BOOLEAN);
3701 NTSYSAPI NTSTATUS WINAPI NtCreateThreadEx(HANDLE*,ACCESS_MASK,OBJECT_ATTRIBUTES*,HANDLE,PRTL_THREAD_START_ROUTINE,void*,ULONG,ULONG_PTR,SIZE_T,SIZE_T,PS_ATTRIBUTE_LIST*);
3702 NTSYSAPI NTSTATUS WINAPI NtCreateTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*, TIMER_TYPE);
3703 NTSYSAPI NTSTATUS WINAPI NtCreateToken(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,TOKEN_TYPE,PLUID,PLARGE_INTEGER,PTOKEN_USER,PTOKEN_GROUPS,PTOKEN_PRIVILEGES,PTOKEN_OWNER,PTOKEN_PRIMARY_GROUP,PTOKEN_DEFAULT_DACL,PTOKEN_SOURCE);
3704 NTSYSAPI NTSTATUS WINAPI NtCreateUserProcess(HANDLE*,HANDLE*,ACCESS_MASK,ACCESS_MASK,OBJECT_ATTRIBUTES*,OBJECT_ATTRIBUTES*,ULONG,ULONG,RTL_USER_PROCESS_PARAMETERS*,PS_CREATE_INFO*,PS_ATTRIBUTE_LIST*);
3705 NTSYSAPI NTSTATUS WINAPI NtDebugActiveProcess(HANDLE,HANDLE);
3706 NTSYSAPI NTSTATUS WINAPI NtDebugContinue(HANDLE,CLIENT_ID*,NTSTATUS);
3707 NTSYSAPI NTSTATUS WINAPI NtDelayExecution(BOOLEAN,const LARGE_INTEGER*);
3708 NTSYSAPI NTSTATUS WINAPI NtDeleteAtom(RTL_ATOM);
3709 NTSYSAPI NTSTATUS WINAPI NtDeleteFile(POBJECT_ATTRIBUTES);
3710 NTSYSAPI NTSTATUS WINAPI NtDeleteKey(HANDLE);
3711 NTSYSAPI NTSTATUS WINAPI NtDeleteValueKey(HANDLE,const UNICODE_STRING *);
3712 NTSYSAPI NTSTATUS WINAPI NtDeviceIoControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
3713 NTSYSAPI NTSTATUS WINAPI NtDisplayString(PUNICODE_STRING);
3714 NTSYSAPI NTSTATUS WINAPI NtDuplicateObject(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,ULONG,ULONG);
3715 NTSYSAPI NTSTATUS WINAPI NtDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
3716 NTSYSAPI NTSTATUS WINAPI NtEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
3717 NTSYSAPI NTSTATUS WINAPI NtEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3718 NTSYSAPI NTSTATUS WINAPI NtExtendSection(HANDLE,PLARGE_INTEGER);
3719 NTSYSAPI NTSTATUS WINAPI NtFilterToken(HANDLE,ULONG,TOKEN_GROUPS*,TOKEN_PRIVILEGES*,TOKEN_GROUPS*,HANDLE*);
3720 NTSYSAPI NTSTATUS WINAPI NtFindAtom(const WCHAR*,ULONG,RTL_ATOM*);
3721 NTSYSAPI NTSTATUS WINAPI NtFlushBuffersFile(HANDLE,IO_STATUS_BLOCK*);
3722 NTSYSAPI NTSTATUS WINAPI NtFlushInstructionCache(HANDLE,LPCVOID,SIZE_T);
3723 NTSYSAPI NTSTATUS WINAPI NtFlushKey(HANDLE);
3724 NTSYSAPI void WINAPI NtFlushProcessWriteBuffers(void);
3725 NTSYSAPI NTSTATUS WINAPI NtFlushVirtualMemory(HANDLE,LPCVOID*,SIZE_T*,ULONG);
3726 NTSYSAPI NTSTATUS WINAPI NtFlushWriteBuffer(VOID);
3727 NTSYSAPI NTSTATUS WINAPI NtFreeVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
3728 NTSYSAPI NTSTATUS WINAPI NtFsControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
3729 NTSYSAPI NTSTATUS WINAPI NtGetContextThread(HANDLE,CONTEXT*);
3730 NTSYSAPI ULONG WINAPI NtGetCurrentProcessorNumber(void);
3731 NTSYSAPI NTSTATUS WINAPI NtGetNlsSectionPtr(ULONG,ULONG,void*,void**,SIZE_T*);
3732 NTSYSAPI NTSTATUS WINAPI NtGetPlugPlayEvent(ULONG,ULONG,PVOID,ULONG);
3733 NTSYSAPI ULONG WINAPI NtGetTickCount(VOID);
3734 NTSYSAPI NTSTATUS WINAPI NtGetWriteWatch(HANDLE,ULONG,PVOID,SIZE_T,PVOID*,ULONG_PTR*,ULONG*);
3735 NTSYSAPI NTSTATUS WINAPI NtImpersonateAnonymousToken(HANDLE);
3736 NTSYSAPI NTSTATUS WINAPI NtImpersonateClientOfPort(HANDLE,PPORT_MESSAGE);
3737 NTSYSAPI NTSTATUS WINAPI NtImpersonateThread(HANDLE,HANDLE,PSECURITY_QUALITY_OF_SERVICE);
3738 NTSYSAPI NTSTATUS WINAPI NtInitializeRegistry(BOOLEAN);
3739 NTSYSAPI NTSTATUS WINAPI NtInitiatePowerAction(POWER_ACTION,SYSTEM_POWER_STATE,ULONG,BOOLEAN);
3740 NTSYSAPI NTSTATUS WINAPI NtIsProcessInJob(HANDLE,HANDLE);
3741 NTSYSAPI NTSTATUS WINAPI NtListenPort(HANDLE,PLPC_MESSAGE);
3742 NTSYSAPI NTSTATUS WINAPI NtLoadDriver(const UNICODE_STRING *);
3743 NTSYSAPI NTSTATUS WINAPI NtLoadKey(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *);
3744 NTSYSAPI NTSTATUS WINAPI NtLockFile(HANDLE,HANDLE,PIO_APC_ROUTINE,void*,PIO_STATUS_BLOCK,PLARGE_INTEGER,PLARGE_INTEGER,ULONG*,BOOLEAN,BOOLEAN);
3745 NTSYSAPI NTSTATUS WINAPI NtLockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
3746 NTSYSAPI NTSTATUS WINAPI NtMakeTemporaryObject(HANDLE);
3747 NTSYSAPI NTSTATUS WINAPI NtMapViewOfSection(HANDLE,HANDLE,PVOID*,ULONG_PTR,SIZE_T,const LARGE_INTEGER*,SIZE_T*,SECTION_INHERIT,ULONG,ULONG);
3748 NTSYSAPI NTSTATUS WINAPI NtNotifyChangeDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,ULONG,BOOLEAN);
3749 NTSYSAPI NTSTATUS WINAPI NtNotifyChangeKey(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
3750 NTSYSAPI NTSTATUS WINAPI NtNotifyChangeMultipleKeys(HANDLE,ULONG,OBJECT_ATTRIBUTES*,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
3751 NTSYSAPI NTSTATUS WINAPI NtOpenDirectoryObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3752 NTSYSAPI NTSTATUS WINAPI NtOpenEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
3753 NTSYSAPI NTSTATUS WINAPI NtOpenEventPair(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3754 NTSYSAPI NTSTATUS WINAPI NtOpenFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG);
3755 NTSYSAPI NTSTATUS WINAPI NtOpenIoCompletion(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3756 NTSYSAPI NTSTATUS WINAPI NtOpenJobObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3757 NTSYSAPI NTSTATUS WINAPI NtOpenKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
3758 NTSYSAPI NTSTATUS WINAPI NtOpenKeyEx(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG);
3759 NTSYSAPI NTSTATUS WINAPI NtOpenKeyTransacted(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,HANDLE);
3760 NTSYSAPI NTSTATUS WINAPI NtOpenKeyTransactedEx(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,HANDLE);
3761 NTSYSAPI NTSTATUS WINAPI NtOpenKeyedEvent(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3762 NTSYSAPI NTSTATUS WINAPI NtOpenMutant(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3763 NTSYSAPI NTSTATUS WINAPI NtOpenObjectAuditAlarm(PUNICODE_STRING,PHANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,HANDLE,ACCESS_MASK,ACCESS_MASK,PPRIVILEGE_SET,BOOLEAN,BOOLEAN,PBOOLEAN);
3764 NTSYSAPI NTSTATUS WINAPI NtOpenProcess(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
3765 NTSYSAPI NTSTATUS WINAPI NtOpenProcessToken(HANDLE,DWORD,HANDLE *);
3766 NTSYSAPI NTSTATUS WINAPI NtOpenProcessTokenEx(HANDLE,DWORD,DWORD,HANDLE *);
3767 NTSYSAPI NTSTATUS WINAPI NtOpenSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3768 NTSYSAPI NTSTATUS WINAPI NtOpenSemaphore(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3769 NTSYSAPI NTSTATUS WINAPI NtOpenSymbolicLinkObject(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
3770 NTSYSAPI NTSTATUS WINAPI NtOpenThread(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
3771 NTSYSAPI NTSTATUS WINAPI NtOpenThreadToken(HANDLE,DWORD,BOOLEAN,HANDLE *);
3772 NTSYSAPI NTSTATUS WINAPI NtOpenThreadTokenEx(HANDLE,DWORD,BOOLEAN,DWORD,HANDLE *);
3773 NTSYSAPI NTSTATUS WINAPI NtOpenTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*);
3774 NTSYSAPI NTSTATUS WINAPI NtPowerInformation(POWER_INFORMATION_LEVEL,PVOID,ULONG,PVOID,ULONG);
3775 NTSYSAPI NTSTATUS WINAPI NtPrivilegeCheck(HANDLE,PPRIVILEGE_SET,PBOOLEAN);
3776 NTSYSAPI NTSTATUS WINAPI NtPrivilegeObjectAuditAlarm(PUNICODE_STRING,HANDLE,HANDLE,ULONG,PPRIVILEGE_SET,BOOLEAN);
3777 NTSYSAPI NTSTATUS WINAPI NtPrivilegedServiceAuditAlarm(PUNICODE_STRING,PUNICODE_STRING,HANDLE,PPRIVILEGE_SET,BOOLEAN);
3778 NTSYSAPI NTSTATUS WINAPI NtProtectVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG,ULONG*);
3779 NTSYSAPI NTSTATUS WINAPI NtPulseEvent(HANDLE,LONG*);
3780 NTSYSAPI NTSTATUS WINAPI NtQueueApcThread(HANDLE,PNTAPCFUNC,ULONG_PTR,ULONG_PTR,ULONG_PTR);
3781 NTSYSAPI NTSTATUS WINAPI NtQueryAttributesFile(const OBJECT_ATTRIBUTES*,FILE_BASIC_INFORMATION*);
3782 NTSYSAPI NTSTATUS WINAPI NtQueryDefaultLocale(BOOLEAN,LCID*);
3783 NTSYSAPI NTSTATUS WINAPI NtQueryDefaultUILanguage(LANGID*);
3784 NTSYSAPI NTSTATUS WINAPI NtQueryDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS,BOOLEAN,PUNICODE_STRING,BOOLEAN);
3785 NTSYSAPI NTSTATUS WINAPI NtQueryDirectoryObject(HANDLE,PDIRECTORY_BASIC_INFORMATION,ULONG,BOOLEAN,BOOLEAN,PULONG,PULONG);
3786 NTSYSAPI NTSTATUS WINAPI NtQueryEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,BOOLEAN,PVOID,ULONG,PULONG,BOOLEAN);
3787 NTSYSAPI NTSTATUS WINAPI NtQueryEvent(HANDLE,EVENT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3788 NTSYSAPI NTSTATUS WINAPI NtQueryFullAttributesFile(const OBJECT_ATTRIBUTES*,FILE_NETWORK_OPEN_INFORMATION*);
3789 NTSYSAPI NTSTATUS WINAPI NtQueryInformationAtom(RTL_ATOM,ATOM_INFORMATION_CLASS,PVOID,ULONG,ULONG*);
3790 NTSYSAPI NTSTATUS WINAPI NtQueryInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,LONG,FILE_INFORMATION_CLASS);
3791 NTSYSAPI NTSTATUS WINAPI NtQueryInformationJobObject(HANDLE,JOBOBJECTINFOCLASS,PVOID,ULONG,PULONG);
3792 NTSYSAPI NTSTATUS WINAPI NtQueryInformationPort(HANDLE,PORT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3793 NTSYSAPI NTSTATUS WINAPI NtQueryInformationProcess(HANDLE,PROCESSINFOCLASS,PVOID,ULONG,PULONG);
3794 NTSYSAPI NTSTATUS WINAPI NtQueryInformationThread(HANDLE,THREADINFOCLASS,PVOID,ULONG,PULONG);
3795 NTSYSAPI NTSTATUS WINAPI NtQueryInformationToken(HANDLE,TOKEN_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3796 NTSYSAPI NTSTATUS WINAPI NtQueryInstallUILanguage(LANGID*);
3797 NTSYSAPI NTSTATUS WINAPI NtQueryIntervalProfile(KPROFILE_SOURCE,PULONG);
3798 NTSYSAPI NTSTATUS WINAPI NtQueryIoCompletion(HANDLE,IO_COMPLETION_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3799 NTSYSAPI NTSTATUS WINAPI NtQueryKey(HANDLE,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
3800 NTSYSAPI NTSTATUS WINAPI NtQueryMultipleValueKey(HANDLE,PKEY_MULTIPLE_VALUE_INFORMATION,ULONG,PVOID,ULONG,PULONG);
3801 NTSYSAPI NTSTATUS WINAPI NtQueryMutant(HANDLE,MUTANT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3802 NTSYSAPI NTSTATUS WINAPI NtQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
3803 NTSYSAPI NTSTATUS WINAPI NtQueryOpenSubKeys(POBJECT_ATTRIBUTES,PULONG);
3804 NTSYSAPI NTSTATUS WINAPI NtQueryPerformanceCounter(PLARGE_INTEGER, PLARGE_INTEGER);
3805 NTSYSAPI NTSTATUS WINAPI NtQuerySecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR,ULONG,PULONG);
3806 NTSYSAPI NTSTATUS WINAPI NtQuerySection(HANDLE,SECTION_INFORMATION_CLASS,PVOID,SIZE_T,SIZE_T*);
3807 NTSYSAPI NTSTATUS WINAPI NtQuerySemaphore(HANDLE,SEMAPHORE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3808 NTSYSAPI NTSTATUS WINAPI NtQuerySymbolicLinkObject(HANDLE,PUNICODE_STRING,PULONG);
3809 NTSYSAPI NTSTATUS WINAPI NtQuerySystemEnvironmentValue(PUNICODE_STRING,PWCHAR,ULONG,PULONG);
3810 NTSYSAPI NTSTATUS WINAPI NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3811 NTSYSAPI NTSTATUS WINAPI NtQuerySystemInformationEx(SYSTEM_INFORMATION_CLASS,void*,ULONG,void*,ULONG,ULONG*);
3812 NTSYSAPI NTSTATUS WINAPI NtQuerySystemTime(PLARGE_INTEGER);
3813 NTSYSAPI NTSTATUS WINAPI NtQueryTimer(HANDLE,TIMER_INFORMATION_CLASS,PVOID,ULONG,PULONG);
3814 NTSYSAPI NTSTATUS WINAPI NtQueryTimerResolution(PULONG,PULONG,PULONG);
3815 NTSYSAPI NTSTATUS WINAPI NtQueryValueKey(HANDLE,const UNICODE_STRING *,KEY_VALUE_INFORMATION_CLASS,void *,DWORD,DWORD *);
3816 NTSYSAPI NTSTATUS WINAPI NtQueryLicenseValue(const UNICODE_STRING *,ULONG *,PVOID,ULONG,ULONG *);
3817 NTSYSAPI NTSTATUS WINAPI NtQueryVirtualMemory(HANDLE,LPCVOID,MEMORY_INFORMATION_CLASS,PVOID,SIZE_T,SIZE_T*);
3818 NTSYSAPI NTSTATUS WINAPI NtQueryVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
3819 NTSYSAPI NTSTATUS WINAPI NtRaiseException(PEXCEPTION_RECORD,PCONTEXT,BOOL);
3820 NTSYSAPI NTSTATUS WINAPI NtRaiseHardError(NTSTATUS,ULONG,PUNICODE_STRING,PVOID*,HARDERROR_RESPONSE_OPTION,PHARDERROR_RESPONSE);
3821 NTSYSAPI NTSTATUS WINAPI NtReadFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG);
3822 NTSYSAPI NTSTATUS WINAPI NtReadFileScatter(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,FILE_SEGMENT_ELEMENT*,ULONG,PLARGE_INTEGER,PULONG);
3823 NTSYSAPI NTSTATUS WINAPI NtReadRequestData(HANDLE,PLPC_MESSAGE,ULONG,PVOID,ULONG,PULONG);
3824 NTSYSAPI NTSTATUS WINAPI NtReadVirtualMemory(HANDLE,const void*,void*,SIZE_T,SIZE_T*);
3825 NTSYSAPI NTSTATUS WINAPI NtRegisterThreadTerminatePort(HANDLE);
3826 NTSYSAPI NTSTATUS WINAPI NtReleaseKeyedEvent(HANDLE,const void*,BOOLEAN,const LARGE_INTEGER*);
3827 NTSYSAPI NTSTATUS WINAPI NtReleaseMutant(HANDLE,PLONG);
3828 NTSYSAPI NTSTATUS WINAPI NtReleaseSemaphore(HANDLE,ULONG,PULONG);
3829 NTSYSAPI NTSTATUS WINAPI NtRemoveIoCompletion(HANDLE,PULONG_PTR,PULONG_PTR,PIO_STATUS_BLOCK,PLARGE_INTEGER);
3830 NTSYSAPI NTSTATUS WINAPI NtRemoveIoCompletionEx(HANDLE,FILE_IO_COMPLETION_INFORMATION*,ULONG,ULONG*,LARGE_INTEGER*,BOOLEAN);
3831 NTSYSAPI NTSTATUS WINAPI NtRemoveProcessDebug(HANDLE,HANDLE);
3832 NTSYSAPI NTSTATUS WINAPI NtRenameKey(HANDLE,UNICODE_STRING*);
3833 NTSYSAPI NTSTATUS WINAPI NtReplaceKey(POBJECT_ATTRIBUTES,HANDLE,POBJECT_ATTRIBUTES);
3834 NTSYSAPI NTSTATUS WINAPI NtReplyPort(HANDLE,PLPC_MESSAGE);
3835 NTSYSAPI NTSTATUS WINAPI NtReplyWaitReceivePort(HANDLE,PULONG,PLPC_MESSAGE,PLPC_MESSAGE);
3836 NTSYSAPI NTSTATUS WINAPI NtReplyWaitReceivePortEx(HANDLE,PVOID*,PPORT_MESSAGE,PPORT_MESSAGE,PLARGE_INTEGER);
3837 NTSYSAPI NTSTATUS WINAPI NtReplyWaitReplyPort(HANDLE,PLPC_MESSAGE);
3838 NTSYSAPI NTSTATUS WINAPI NtRequestPort(HANDLE,PLPC_MESSAGE);
3839 NTSYSAPI NTSTATUS WINAPI NtRequestWaitReplyPort(HANDLE,PLPC_MESSAGE,PLPC_MESSAGE);
3840 NTSYSAPI NTSTATUS WINAPI NtResetEvent(HANDLE,LONG*);
3841 NTSYSAPI NTSTATUS WINAPI NtResetWriteWatch(HANDLE,PVOID,SIZE_T);
3842 NTSYSAPI NTSTATUS WINAPI NtRestoreKey(HANDLE,HANDLE,ULONG);
3843 NTSYSAPI NTSTATUS WINAPI NtResumeProcess(HANDLE);
3844 NTSYSAPI NTSTATUS WINAPI NtResumeThread(HANDLE,PULONG);
3845 NTSYSAPI NTSTATUS WINAPI NtSaveKey(HANDLE,HANDLE);
3846 NTSYSAPI NTSTATUS WINAPI NtSecureConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PSID,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
3847 NTSYSAPI NTSTATUS WINAPI NtSetContextThread(HANDLE,const CONTEXT*);
3848 NTSYSAPI NTSTATUS WINAPI NtSetDefaultHardErrorPort(HANDLE);
3849 NTSYSAPI NTSTATUS WINAPI NtSetDefaultLocale(BOOLEAN,LCID);
3850 NTSYSAPI NTSTATUS WINAPI NtSetDefaultUILanguage(LANGID);
3851 NTSYSAPI NTSTATUS WINAPI NtSetEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG);
3852 NTSYSAPI NTSTATUS WINAPI NtSetEvent(HANDLE,LONG*);
3853 NTSYSAPI NTSTATUS WINAPI NtSetHighEventPair(HANDLE);
3854 NTSYSAPI NTSTATUS WINAPI NtSetHighWaitLowEventPair(HANDLE);
3855 NTSYSAPI NTSTATUS WINAPI NtSetHighWaitLowThread(VOID);
3856 NTSYSAPI NTSTATUS WINAPI NtSetInformationDebugObject(HANDLE,DEBUGOBJECTINFOCLASS,PVOID,ULONG,ULONG*);
3857 NTSYSAPI NTSTATUS WINAPI NtSetInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS);
3858 NTSYSAPI NTSTATUS WINAPI NtSetInformationJobObject(HANDLE,JOBOBJECTINFOCLASS,PVOID,ULONG);
3859 NTSYSAPI NTSTATUS WINAPI NtSetInformationKey(HANDLE,const int,PVOID,ULONG);
3860 NTSYSAPI NTSTATUS WINAPI NtSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG);
3861 NTSYSAPI NTSTATUS WINAPI NtSetInformationProcess(HANDLE,PROCESS_INFORMATION_CLASS,PVOID,ULONG);
3862 NTSYSAPI NTSTATUS WINAPI NtSetInformationThread(HANDLE,THREADINFOCLASS,LPCVOID,ULONG);
3863 NTSYSAPI NTSTATUS WINAPI NtSetInformationToken(HANDLE,TOKEN_INFORMATION_CLASS,PVOID,ULONG);
3864 NTSYSAPI NTSTATUS WINAPI NtSetIntervalProfile(ULONG,KPROFILE_SOURCE);
3865 NTSYSAPI NTSTATUS WINAPI NtSetIoCompletion(HANDLE,ULONG_PTR,ULONG_PTR,NTSTATUS,SIZE_T);
3866 NTSYSAPI NTSTATUS WINAPI NtSetLdtEntries(ULONG,LDT_ENTRY,ULONG,LDT_ENTRY);
3867 NTSYSAPI NTSTATUS WINAPI NtSetLowEventPair(HANDLE);
3868 NTSYSAPI NTSTATUS WINAPI NtSetLowWaitHighEventPair(HANDLE);
3869 NTSYSAPI NTSTATUS WINAPI NtSetLowWaitHighThread(VOID);
3870 NTSYSAPI NTSTATUS WINAPI NtSetPowerRequest(HANDLE,POWER_REQUEST_TYPE);
3871 NTSYSAPI NTSTATUS WINAPI NtSetSecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR);
3872 NTSYSAPI NTSTATUS WINAPI NtSetSystemEnvironmentValue(PUNICODE_STRING,PUNICODE_STRING);
3873 NTSYSAPI NTSTATUS WINAPI NtSetSystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG);
3874 NTSYSAPI NTSTATUS WINAPI NtSetSystemPowerState(POWER_ACTION,SYSTEM_POWER_STATE,ULONG);
3875 NTSYSAPI NTSTATUS WINAPI NtSetSystemTime(const LARGE_INTEGER*,LARGE_INTEGER*);
3876 NTSYSAPI NTSTATUS WINAPI NtSetThreadExecutionState(EXECUTION_STATE,EXECUTION_STATE*);
3877 NTSYSAPI NTSTATUS WINAPI NtSetTimer(HANDLE, const LARGE_INTEGER*, PTIMER_APC_ROUTINE, PVOID, BOOLEAN, ULONG, BOOLEAN*);
3878 NTSYSAPI NTSTATUS WINAPI NtSetTimerResolution(ULONG,BOOLEAN,PULONG);
3879 NTSYSAPI NTSTATUS WINAPI NtSetValueKey(HANDLE,const UNICODE_STRING *,ULONG,ULONG,const void *,ULONG);
3880 NTSYSAPI NTSTATUS WINAPI NtSetVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
3881 NTSYSAPI NTSTATUS WINAPI NtSignalAndWaitForSingleObject(HANDLE,HANDLE,BOOLEAN,const LARGE_INTEGER*);
3882 NTSYSAPI NTSTATUS WINAPI NtShutdownSystem(SHUTDOWN_ACTION);
3883 NTSYSAPI NTSTATUS WINAPI NtStartProfile(HANDLE);
3884 NTSYSAPI NTSTATUS WINAPI NtStopProfile(HANDLE);
3885 NTSYSAPI NTSTATUS WINAPI NtSuspendProcess(HANDLE);
3886 NTSYSAPI NTSTATUS WINAPI NtSuspendThread(HANDLE,PULONG);
3887 NTSYSAPI NTSTATUS WINAPI NtSystemDebugControl(SYSDBG_COMMAND,PVOID,ULONG,PVOID,ULONG,PULONG);
3888 NTSYSAPI NTSTATUS WINAPI NtTerminateJobObject(HANDLE,NTSTATUS);
3889 NTSYSAPI NTSTATUS WINAPI NtTerminateProcess(HANDLE,LONG);
3890 NTSYSAPI NTSTATUS WINAPI NtTerminateThread(HANDLE,LONG);
3891 NTSYSAPI NTSTATUS WINAPI NtTestAlert(VOID);
3892 NTSYSAPI NTSTATUS WINAPI NtUnloadDriver(const UNICODE_STRING *);
3893 NTSYSAPI NTSTATUS WINAPI NtUnloadKey(POBJECT_ATTRIBUTES);
3894 NTSYSAPI NTSTATUS WINAPI NtUnloadKeyEx(POBJECT_ATTRIBUTES,HANDLE);
3895 NTSYSAPI NTSTATUS WINAPI NtUnlockFile(HANDLE,PIO_STATUS_BLOCK,PLARGE_INTEGER,PLARGE_INTEGER,PULONG);
3896 NTSYSAPI NTSTATUS WINAPI NtUnlockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
3897 NTSYSAPI NTSTATUS WINAPI NtUnmapViewOfSection(HANDLE,PVOID);
3898 NTSYSAPI NTSTATUS WINAPI NtVdmControl(ULONG,PVOID);
3899 NTSYSAPI NTSTATUS WINAPI NtWaitForDebugEvent(HANDLE,BOOLEAN,LARGE_INTEGER*,DBGUI_WAIT_STATE_CHANGE*);
3900 NTSYSAPI NTSTATUS WINAPI NtWaitForKeyedEvent(HANDLE,const void*,BOOLEAN,const LARGE_INTEGER*);
3901 NTSYSAPI NTSTATUS WINAPI NtWaitForSingleObject(HANDLE,BOOLEAN,const LARGE_INTEGER*);
3902 NTSYSAPI NTSTATUS WINAPI NtWaitForMultipleObjects(ULONG,const HANDLE*,BOOLEAN,BOOLEAN,const LARGE_INTEGER*);
3903 NTSYSAPI NTSTATUS WINAPI NtWaitHighEventPair(HANDLE);
3904 NTSYSAPI NTSTATUS WINAPI NtWaitLowEventPair(HANDLE);
3905 NTSYSAPI NTSTATUS WINAPI NtWriteFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,const void*,ULONG,PLARGE_INTEGER,PULONG);
3906 NTSYSAPI NTSTATUS WINAPI NtWriteFileGather(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,FILE_SEGMENT_ELEMENT*,ULONG,PLARGE_INTEGER,PULONG);
3907 NTSYSAPI NTSTATUS WINAPI NtWriteRequestData(HANDLE,PLPC_MESSAGE,ULONG,PVOID,ULONG,PULONG);
3908 NTSYSAPI NTSTATUS WINAPI NtWriteVirtualMemory(HANDLE,void*,const void*,SIZE_T,SIZE_T*);
3909 NTSYSAPI NTSTATUS WINAPI NtYieldExecution(void);
3910
3911 NTSYSAPI NTSTATUS WINAPI RtlAbsoluteToSelfRelativeSD(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR,PULONG);
3912 NTSYSAPI void WINAPI RtlAcquirePebLock(void);
3913 NTSYSAPI BYTE WINAPI RtlAcquireResourceExclusive(LPRTL_RWLOCK,BYTE);
3914 NTSYSAPI BYTE WINAPI RtlAcquireResourceShared(LPRTL_RWLOCK,BYTE);
3915 NTSYSAPI void WINAPI RtlAcquireSRWLockExclusive(RTL_SRWLOCK*);
3916 NTSYSAPI void WINAPI RtlAcquireSRWLockShared(RTL_SRWLOCK*);
3917 NTSYSAPI NTSTATUS WINAPI RtlActivateActivationContext(DWORD,HANDLE,ULONG_PTR*);
3918 NTSYSAPI NTSTATUS WINAPI RtlActivateActivationContextEx(ULONG,TEB*,HANDLE,ULONG_PTR*);
3919 NTSYSAPI NTSTATUS WINAPI RtlAddAce(PACL,DWORD,DWORD,PACE_HEADER,DWORD);
3920 NTSYSAPI NTSTATUS WINAPI RtlAddAccessAllowedAce(PACL,DWORD,DWORD,PSID);
3921 NTSYSAPI NTSTATUS WINAPI RtlAddAccessAllowedAceEx(PACL,DWORD,DWORD,DWORD,PSID);
3922 NTSYSAPI NTSTATUS WINAPI RtlAddAccessAllowedObjectAce(PACL,DWORD,DWORD,DWORD,GUID*,GUID*,PSID);
3923 NTSYSAPI NTSTATUS WINAPI RtlAddAccessDeniedAce(PACL,DWORD,DWORD,PSID);
3924 NTSYSAPI NTSTATUS WINAPI RtlAddAccessDeniedAceEx(PACL,DWORD,DWORD,DWORD,PSID);
3925 NTSYSAPI NTSTATUS WINAPI RtlAddAccessDeniedObjectAce(PACL,DWORD,DWORD,DWORD,GUID*,GUID*,PSID);
3926 NTSYSAPI NTSTATUS WINAPI RtlAddAtomToAtomTable(RTL_ATOM_TABLE,const WCHAR*,RTL_ATOM*);
3927 NTSYSAPI NTSTATUS WINAPI RtlAddAuditAccessAce(PACL,DWORD,DWORD,PSID,BOOL,BOOL);
3928 NTSYSAPI NTSTATUS WINAPI RtlAddAuditAccessAceEx(PACL,DWORD,DWORD,DWORD,PSID,BOOL,BOOL);
3929 NTSYSAPI NTSTATUS WINAPI RtlAddAuditAccessObjectAce(PACL,DWORD,DWORD,DWORD,GUID*,GUID*,PSID,BOOL,BOOL);
3930 NTSYSAPI NTSTATUS WINAPI RtlAddMandatoryAce(PACL,DWORD,DWORD,DWORD,DWORD,PSID);
3931 NTSYSAPI void WINAPI RtlAddRefActivationContext(HANDLE);
3932 NTSYSAPI PVOID WINAPI RtlAddVectoredExceptionHandler(ULONG,PVECTORED_EXCEPTION_HANDLER);
3933 NTSYSAPI NTSTATUS WINAPI RtlAdjustPrivilege(ULONG,BOOLEAN,BOOLEAN,PBOOLEAN);
3934 NTSYSAPI NTSTATUS WINAPI RtlAllocateAndInitializeSid(PSID_IDENTIFIER_AUTHORITY,BYTE,DWORD,DWORD,DWORD,DWORD,DWORD,DWORD,DWORD,DWORD,PSID *);
3935 NTSYSAPI RTL_HANDLE * WINAPI RtlAllocateHandle(RTL_HANDLE_TABLE *,ULONG *);
3936 NTSYSAPI PVOID WINAPI RtlAllocateHeap(HANDLE,ULONG,SIZE_T) __WINE_ALLOC_SIZE(3);
3937 NTSYSAPI WCHAR WINAPI RtlAnsiCharToUnicodeChar(LPSTR *);
3938 NTSYSAPI DWORD WINAPI RtlAnsiStringToUnicodeSize(const STRING *);
3939 NTSYSAPI NTSTATUS WINAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING,PCANSI_STRING,BOOLEAN);
3940 NTSYSAPI NTSTATUS WINAPI RtlAppendAsciizToString(STRING *,LPCSTR);
3941 NTSYSAPI NTSTATUS WINAPI RtlAppendStringToString(STRING *,const STRING *);
3942 NTSYSAPI NTSTATUS WINAPI RtlAppendUnicodeStringToString(UNICODE_STRING *,const UNICODE_STRING *);
3943 NTSYSAPI NTSTATUS WINAPI RtlAppendUnicodeToString(UNICODE_STRING *,LPCWSTR);
3944 NTSYSAPI BOOLEAN WINAPI RtlAreAllAccessesGranted(ACCESS_MASK,ACCESS_MASK);
3945 NTSYSAPI BOOLEAN WINAPI RtlAreAnyAccessesGranted(ACCESS_MASK,ACCESS_MASK);
3946 NTSYSAPI BOOLEAN WINAPI RtlAreBitsSet(PCRTL_BITMAP,ULONG,ULONG);
3947 NTSYSAPI BOOLEAN WINAPI RtlAreBitsClear(PCRTL_BITMAP,ULONG,ULONG);
3948 NTSYSAPI NTSTATUS WINAPI RtlCharToInteger(PCSZ,ULONG,PULONG);
3949 NTSYSAPI NTSTATUS WINAPI RtlCheckRegistryKey(ULONG, PWSTR);
3950 NTSYSAPI void WINAPI RtlClearAllBits(PRTL_BITMAP);
3951 NTSYSAPI void WINAPI RtlClearBits(PRTL_BITMAP,ULONG,ULONG);
3952 NTSYSAPI NTSTATUS WINAPI RtlCreateActivationContext(HANDLE*,const void*);
3953 NTSYSAPI PDEBUG_BUFFER WINAPI RtlCreateQueryDebugBuffer(ULONG,BOOLEAN);
3954 NTSYSAPI NTSTATUS WINAPI RtlCreateRegistryKey(ULONG,PWSTR);
3955 NTSYSAPI ULONG WINAPI RtlCompactHeap(HANDLE,ULONG);
3956 NTSYSAPI LONG WINAPI RtlCompareString(const STRING*,const STRING*,BOOLEAN);
3957 NTSYSAPI LONG WINAPI RtlCompareUnicodeString(const UNICODE_STRING*,const UNICODE_STRING*,BOOLEAN);
3958 NTSYSAPI LONG WINAPI RtlCompareUnicodeStrings(const WCHAR*,SIZE_T,const WCHAR*,SIZE_T,BOOLEAN);
3959 NTSYSAPI NTSTATUS WINAPI RtlCompressBuffer(USHORT,PUCHAR,ULONG,PUCHAR,ULONG,ULONG,PULONG,PVOID);
3960 NTSYSAPI DWORD WINAPI RtlComputeCrc32(DWORD,const BYTE*,INT);
3961 NTSYSAPI NTSTATUS WINAPI RtlConvertSidToUnicodeString(PUNICODE_STRING,PSID,BOOLEAN);
3962 NTSYSAPI NTSTATUS WINAPI RtlConvertToAutoInheritSecurityObject(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR*,GUID*,BOOL,PGENERIC_MAPPING);
3963 NTSYSAPI void WINAPI RtlCopyLuid(PLUID,const LUID*);
3964 NTSYSAPI void WINAPI RtlCopyLuidAndAttributesArray(ULONG,const LUID_AND_ATTRIBUTES*,PLUID_AND_ATTRIBUTES);
3965 NTSYSAPI BOOLEAN WINAPI RtlCopySid(DWORD,PSID,PSID);
3966 NTSYSAPI NTSTATUS WINAPI RtlCopySecurityDescriptor(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR);
3967 NTSYSAPI void WINAPI RtlCopyString(STRING*,const STRING*);
3968 NTSYSAPI void WINAPI RtlCopyUnicodeString(UNICODE_STRING*,const UNICODE_STRING*);
3969 NTSYSAPI NTSTATUS WINAPI RtlCreateAcl(PACL,DWORD,DWORD);
3970 NTSYSAPI NTSTATUS WINAPI RtlCreateAtomTable(ULONG,RTL_ATOM_TABLE*);
3971 NTSYSAPI NTSTATUS WINAPI RtlCreateEnvironment(BOOLEAN, PWSTR*);
3972 NTSYSAPI HANDLE WINAPI RtlCreateHeap(ULONG,PVOID,SIZE_T,SIZE_T,PVOID,PRTL_HEAP_DEFINITION);
3973 NTSYSAPI NTSTATUS WINAPI RtlCreateProcessParameters(RTL_USER_PROCESS_PARAMETERS**,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*,PWSTR,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*);
3974 NTSYSAPI NTSTATUS WINAPI RtlCreateProcessParametersEx(RTL_USER_PROCESS_PARAMETERS**,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*,PWSTR,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*,const UNICODE_STRING*,ULONG);
3975 NTSYSAPI NTSTATUS WINAPI RtlCreateSecurityDescriptor(PSECURITY_DESCRIPTOR,DWORD);
3976 NTSYSAPI NTSTATUS WINAPI RtlCreateTimerQueue(PHANDLE);
3977 NTSYSAPI NTSTATUS WINAPI RtlCreateTimer(PHANDLE, HANDLE, RTL_WAITORTIMERCALLBACKFUNC, PVOID, DWORD, DWORD, ULONG);
3978 NTSYSAPI BOOLEAN WINAPI RtlCreateUnicodeString(PUNICODE_STRING,LPCWSTR);
3979 NTSYSAPI BOOLEAN WINAPI RtlCreateUnicodeStringFromAsciiz(PUNICODE_STRING,LPCSTR);
3980 NTSYSAPI NTSTATUS WINAPI RtlCreateUserProcess(UNICODE_STRING*,ULONG,RTL_USER_PROCESS_PARAMETERS*,SECURITY_DESCRIPTOR*,SECURITY_DESCRIPTOR*,HANDLE,BOOLEAN,HANDLE,HANDLE,RTL_USER_PROCESS_INFORMATION*);
3981 NTSYSAPI NTSTATUS WINAPI RtlCreateUserThread(HANDLE,SECURITY_DESCRIPTOR*,BOOLEAN,ULONG,SIZE_T,SIZE_T,PRTL_THREAD_START_ROUTINE,void*,HANDLE*,CLIENT_ID*);
3982 NTSYSAPI NTSTATUS WINAPI RtlCreateUserStack(SIZE_T,SIZE_T,ULONG,SIZE_T,SIZE_T,INITIAL_TEB*);
3983 NTSYSAPI NTSTATUS WINAPI RtlCustomCPToUnicodeN(CPTABLEINFO*,WCHAR*,DWORD,DWORD*,const char*,DWORD);
3984 NTSYSAPI void WINAPI RtlDeactivateActivationContext(DWORD,ULONG_PTR);
3985 NTSYSAPI PVOID WINAPI RtlDecodePointer(PVOID);
3986 NTSYSAPI NTSTATUS WINAPI RtlDecompressBuffer(USHORT,PUCHAR,ULONG,PUCHAR,ULONG,PULONG);
3987 NTSYSAPI NTSTATUS WINAPI RtlDecompressFragment(USHORT,PUCHAR,ULONG,PUCHAR,ULONG,ULONG,PULONG,PVOID);
3988 NTSYSAPI NTSTATUS WINAPI RtlDeleteAce(PACL,DWORD);
3989 NTSYSAPI NTSTATUS WINAPI RtlDeleteAtomFromAtomTable(RTL_ATOM_TABLE,RTL_ATOM);
3990 NTSYSAPI NTSTATUS WINAPI RtlDeleteCriticalSection(RTL_CRITICAL_SECTION *);
3991 NTSYSAPI NTSTATUS WINAPI RtlDeleteRegistryValue(ULONG, PCWSTR, PCWSTR);
3992 NTSYSAPI void WINAPI RtlDeleteResource(LPRTL_RWLOCK);
3993 NTSYSAPI NTSTATUS WINAPI RtlDeleteSecurityObject(PSECURITY_DESCRIPTOR*);
3994 NTSYSAPI NTSTATUS WINAPI RtlDeleteTimer(HANDLE, HANDLE, HANDLE);
3995 NTSYSAPI NTSTATUS WINAPI RtlDeleteTimerQueueEx(HANDLE, HANDLE);
3996 NTSYSAPI PRTL_USER_PROCESS_PARAMETERS WINAPI RtlDeNormalizeProcessParams(RTL_USER_PROCESS_PARAMETERS*);
3997 NTSYSAPI NTSTATUS WINAPI RtlDeregisterWait(HANDLE);
3998 NTSYSAPI NTSTATUS WINAPI RtlDeregisterWaitEx(HANDLE,HANDLE);
3999 NTSYSAPI NTSTATUS WINAPI RtlDestroyAtomTable(RTL_ATOM_TABLE);
4000 NTSYSAPI NTSTATUS WINAPI RtlDestroyEnvironment(PWSTR);
4001 NTSYSAPI NTSTATUS WINAPI RtlDestroyHandleTable(RTL_HANDLE_TABLE *);
4002 NTSYSAPI HANDLE WINAPI RtlDestroyHeap(HANDLE);
4003 NTSYSAPI void WINAPI RtlDestroyProcessParameters(RTL_USER_PROCESS_PARAMETERS*);
4004 NTSYSAPI NTSTATUS WINAPI RtlDestroyQueryDebugBuffer(PDEBUG_BUFFER);
4005 NTSYSAPI DOS_PATHNAME_TYPE WINAPI RtlDetermineDosPathNameType_U(PCWSTR);
4006 NTSYSAPI BOOLEAN WINAPI RtlDllShutdownInProgress(void);
4007 NTSYSAPI BOOLEAN WINAPI RtlDoesFileExists_U(LPCWSTR);
4008 NTSYSAPI BOOLEAN WINAPI RtlDosPathNameToNtPathName_U(PCWSTR,PUNICODE_STRING,PWSTR*,CURDIR*);
4009 NTSYSAPI NTSTATUS WINAPI RtlDosPathNameToNtPathName_U_WithStatus(PCWSTR,PUNICODE_STRING,PWSTR*,CURDIR*);
4010 NTSYSAPI ULONG WINAPI RtlDosSearchPath_U(LPCWSTR, LPCWSTR, LPCWSTR, ULONG, LPWSTR, LPWSTR*);
4011 NTSYSAPI WCHAR WINAPI RtlDowncaseUnicodeChar(WCHAR);
4012 NTSYSAPI NTSTATUS WINAPI RtlDowncaseUnicodeString(UNICODE_STRING*,const UNICODE_STRING*,BOOLEAN);
4013 NTSYSAPI void WINAPI RtlDumpResource(LPRTL_RWLOCK);
4014 NTSYSAPI NTSTATUS WINAPI RtlDuplicateUnicodeString(int,const UNICODE_STRING*,UNICODE_STRING*);
4015 NTSYSAPI NTSTATUS WINAPI RtlEmptyAtomTable(RTL_ATOM_TABLE,BOOLEAN);
4016 NTSYSAPI PVOID WINAPI RtlEncodePointer(PVOID);
4017 NTSYSAPI NTSTATUS WINAPI RtlEnterCriticalSection(RTL_CRITICAL_SECTION *);
4018 NTSYSAPI void WINAPI RtlEraseUnicodeString(UNICODE_STRING*);
4019 NTSYSAPI NTSTATUS WINAPI RtlEqualComputerName(const UNICODE_STRING*,const UNICODE_STRING*);
4020 NTSYSAPI NTSTATUS WINAPI RtlEqualDomainName(const UNICODE_STRING*,const UNICODE_STRING*);
4021 NTSYSAPI BOOLEAN WINAPI RtlEqualLuid(const LUID*,const LUID*);
4022 NTSYSAPI BOOL WINAPI RtlEqualPrefixSid(PSID,PSID);
4023 NTSYSAPI BOOL WINAPI RtlEqualSid(PSID,PSID);
4024 NTSYSAPI BOOLEAN WINAPI RtlEqualString(const STRING*,const STRING*,BOOLEAN);
4025 NTSYSAPI BOOLEAN WINAPI RtlEqualUnicodeString(const UNICODE_STRING*,const UNICODE_STRING*,BOOLEAN);
4026 NTSYSAPI void DECLSPEC_NORETURN WINAPI RtlExitUserProcess(ULONG);
4027 NTSYSAPI void DECLSPEC_NORETURN WINAPI RtlExitUserThread(ULONG);
4028 NTSYSAPI NTSTATUS WINAPI RtlExpandEnvironmentStrings(const WCHAR*,WCHAR*,SIZE_T,WCHAR*,SIZE_T,SIZE_T*);
4029 NTSYSAPI NTSTATUS WINAPI RtlExpandEnvironmentStrings_U(PCWSTR, const UNICODE_STRING*, UNICODE_STRING*, ULONG*);
4030 NTSYSAPI NTSTATUS WINAPI RtlFindActivationContextSectionString(ULONG,const GUID*,ULONG,const UNICODE_STRING*,PVOID);
4031 NTSYSAPI NTSTATUS WINAPI RtlFindActivationContextSectionGuid(ULONG,const GUID*,ULONG,const GUID*,PVOID);
4032 NTSYSAPI NTSTATUS WINAPI RtlFindCharInUnicodeString(int,const UNICODE_STRING*,const UNICODE_STRING*,USHORT*);
4033 NTSYSAPI ULONG WINAPI RtlFindClearBits(PCRTL_BITMAP,ULONG,ULONG);
4034 NTSYSAPI ULONG WINAPI RtlFindClearBitsAndSet(PRTL_BITMAP,ULONG,ULONG);
4035 NTSYSAPI ULONG WINAPI RtlFindClearRuns(PCRTL_BITMAP,PRTL_BITMAP_RUN,ULONG,BOOLEAN);
4036 NTSYSAPI void * WINAPI RtlFindExportedRoutineByName(HMODULE,const char*);
4037 NTSYSAPI ULONG WINAPI RtlFindLastBackwardRunSet(PCRTL_BITMAP,ULONG,PULONG);
4038 NTSYSAPI ULONG WINAPI RtlFindLastBackwardRunClear(PCRTL_BITMAP,ULONG,PULONG);
4039 NTSYSAPI CCHAR WINAPI RtlFindLeastSignificantBit(ULONGLONG);
4040 NTSYSAPI ULONG WINAPI RtlFindLongestRunSet(PCRTL_BITMAP,PULONG);
4041 NTSYSAPI ULONG WINAPI RtlFindLongestRunClear(PCRTL_BITMAP,PULONG);
4042 NTSYSAPI NTSTATUS WINAPI RtlFindMessage(HMODULE,ULONG,ULONG,ULONG,const MESSAGE_RESOURCE_ENTRY**);
4043 NTSYSAPI CCHAR WINAPI RtlFindMostSignificantBit(ULONGLONG);
4044 NTSYSAPI ULONG WINAPI RtlFindNextForwardRunSet(PCRTL_BITMAP,ULONG,PULONG);
4045 NTSYSAPI ULONG WINAPI RtlFindNextForwardRunClear(PCRTL_BITMAP,ULONG,PULONG);
4046 NTSYSAPI ULONG WINAPI RtlFindSetBits(PCRTL_BITMAP,ULONG,ULONG);
4047 NTSYSAPI ULONG WINAPI RtlFindSetBitsAndClear(PRTL_BITMAP,ULONG,ULONG);
4048 NTSYSAPI ULONG WINAPI RtlFindSetRuns(PCRTL_BITMAP,PRTL_BITMAP_RUN,ULONG,BOOLEAN);
4049 NTSYSAPI BOOLEAN WINAPI RtlFirstFreeAce(PACL,PACE_HEADER *);
4050 NTSYSAPI NTSTATUS WINAPI RtlFlsAlloc(PFLS_CALLBACK_FUNCTION,ULONG *);
4051 NTSYSAPI NTSTATUS WINAPI RtlFlsFree(ULONG);
4052 NTSYSAPI NTSTATUS WINAPI RtlFlsGetValue(ULONG,void **);
4053 NTSYSAPI NTSTATUS WINAPI RtlFlsSetValue(ULONG,void *);
4054 NTSYSAPI NTSTATUS WINAPI RtlFormatCurrentUserKeyPath(PUNICODE_STRING);
4055 NTSYSAPI NTSTATUS WINAPI RtlFormatMessage(LPCWSTR,ULONG,BOOLEAN,BOOLEAN,BOOLEAN,__ms_va_list *,LPWSTR,ULONG,ULONG*);
4056 NTSYSAPI NTSTATUS WINAPI RtlFormatMessageEx(LPCWSTR,ULONG,BOOLEAN,BOOLEAN,BOOLEAN,__ms_va_list *,LPWSTR,ULONG,ULONG*,ULONG);
4057 NTSYSAPI void WINAPI RtlFreeAnsiString(PANSI_STRING);
4058 NTSYSAPI BOOLEAN WINAPI RtlFreeHandle(RTL_HANDLE_TABLE *,RTL_HANDLE *);
4059 NTSYSAPI BOOLEAN WINAPI RtlFreeHeap(HANDLE,ULONG,PVOID);
4060 NTSYSAPI void WINAPI RtlFreeOemString(POEM_STRING);
4061 NTSYSAPI DWORD WINAPI RtlFreeSid(PSID);
4062 NTSYSAPI void WINAPI RtlFreeThreadActivationContextStack(void);
4063 NTSYSAPI void WINAPI RtlFreeUnicodeString(PUNICODE_STRING);
4064 NTSYSAPI void WINAPI RtlFreeUserStack(void*);
4065 NTSYSAPI NTSTATUS WINAPI RtlGetAce(PACL,DWORD,LPVOID *);
4066 NTSYSAPI NTSTATUS WINAPI RtlGetActiveActivationContext(HANDLE*);
4067 NTSYSAPI NTSTATUS WINAPI RtlGetCompressionWorkSpaceSize(USHORT,PULONG,PULONG);
4068 NTSYSAPI NTSTATUS WINAPI RtlGetControlSecurityDescriptor(PSECURITY_DESCRIPTOR, PSECURITY_DESCRIPTOR_CONTROL,LPDWORD);
4069 NTSYSAPI ULONG WINAPI RtlGetCurrentDirectory_U(ULONG, LPWSTR);
4070 NTSYSAPI PEB * WINAPI RtlGetCurrentPeb(void);
4071 NTSYSAPI NTSTATUS WINAPI RtlGetDaclSecurityDescriptor(PSECURITY_DESCRIPTOR,PBOOLEAN,PACL *,PBOOLEAN);
4072 NTSYSAPI NTSTATUS WINAPI RtlGetExePath(PCWSTR,PWSTR*);
4073 NTSYSAPI TEB_ACTIVE_FRAME * WINAPI RtlGetFrame(void);
4074 NTSYSAPI ULONG WINAPI RtlGetFullPathName_U(PCWSTR,ULONG,PWSTR,PWSTR*);
4075 NTSYSAPI NTSTATUS WINAPI RtlGetGroupSecurityDescriptor(PSECURITY_DESCRIPTOR,PSID *,PBOOLEAN);
4076 NTSYSAPI NTSTATUS WINAPI RtlGetLastNtStatus(void);
4077 NTSYSAPI DWORD WINAPI RtlGetLastWin32Error(void);
4078 NTSYSAPI DWORD WINAPI RtlGetLongestNtPathLength(void);
4079 NTSYSAPI ULONG WINAPI RtlGetNtGlobalFlags(void);
4080 NTSYSAPI BOOLEAN WINAPI RtlGetNtProductType(LPDWORD);
4081 NTSYSAPI NTSTATUS WINAPI RtlGetOwnerSecurityDescriptor(PSECURITY_DESCRIPTOR,PSID *,PBOOLEAN);
4082 NTSYSAPI ULONG WINAPI RtlGetProcessHeaps(ULONG,HANDLE*);
4083 NTSYSAPI NTSTATUS WINAPI RtlGetProcessPreferredUILanguages(DWORD,ULONG*,WCHAR*,ULONG*);
4084 NTSYSAPI NTSTATUS WINAPI RtlGetSaclSecurityDescriptor(PSECURITY_DESCRIPTOR,PBOOLEAN,PACL *,PBOOLEAN);
4085 NTSYSAPI NTSTATUS WINAPI RtlGetSearchPath(PWSTR*);
4086 NTSYSAPI NTSTATUS WINAPI RtlGetSystemPreferredUILanguages(DWORD,ULONG,ULONG*,WCHAR*,ULONG*);
4087 NTSYSAPI LONGLONG WINAPI RtlGetSystemTimePrecise(void);
4088 NTSYSAPI DWORD WINAPI RtlGetThreadErrorMode(void);
4089 NTSYSAPI NTSTATUS WINAPI RtlGetThreadPreferredUILanguages(DWORD,ULONG*,WCHAR*,ULONG*);
4090 NTSYSAPI NTSTATUS WINAPI RtlGetUserPreferredUILanguages(DWORD,ULONG,ULONG*,WCHAR*,ULONG*);
4091 NTSYSAPI NTSTATUS WINAPI RtlGetVersion(RTL_OSVERSIONINFOEXW*);
4092 NTSYSAPI NTSTATUS WINAPI RtlGUIDFromString(PUNICODE_STRING,GUID*);
4093 NTSYSAPI PSID_IDENTIFIER_AUTHORITY WINAPI RtlIdentifierAuthoritySid(PSID);
4094 NTSYSAPI NTSTATUS WINAPI RtlIdnToAscii(DWORD,const WCHAR*,INT,WCHAR*,INT*);
4095 NTSYSAPI NTSTATUS WINAPI RtlIdnToNameprepUnicode(DWORD,const WCHAR*,INT,WCHAR*,INT*);
4096 NTSYSAPI NTSTATUS WINAPI RtlIdnToUnicode(DWORD,const WCHAR*,INT,WCHAR*,INT*);
4097 NTSYSAPI PVOID WINAPI RtlImageDirectoryEntryToData(HMODULE,BOOL,WORD,ULONG *);
4098 NTSYSAPI PIMAGE_NT_HEADERS WINAPI RtlImageNtHeader(HMODULE);
4099 NTSYSAPI PIMAGE_SECTION_HEADER WINAPI RtlImageRvaToSection(const IMAGE_NT_HEADERS *,HMODULE,DWORD);
4100 NTSYSAPI PVOID WINAPI RtlImageRvaToVa(const IMAGE_NT_HEADERS *,HMODULE,DWORD,IMAGE_SECTION_HEADER **);
4101 NTSYSAPI NTSTATUS WINAPI RtlImpersonateSelf(SECURITY_IMPERSONATION_LEVEL);
4102 NTSYSAPI void WINAPI RtlInitString(PSTRING,PCSZ);
4103 NTSYSAPI void WINAPI RtlInitAnsiString(PANSI_STRING,PCSZ);
4104 NTSYSAPI NTSTATUS WINAPI RtlInitAnsiStringEx(PANSI_STRING,PCSZ);
4105 NTSYSAPI void WINAPI RtlInitCodePageTable(USHORT*,CPTABLEINFO*);
4106 NTSYSAPI void WINAPI RtlInitNlsTables(USHORT*,USHORT*,USHORT*,NLSTABLEINFO*);
4107 NTSYSAPI void WINAPI RtlInitUnicodeString(PUNICODE_STRING,PCWSTR);
4108 NTSYSAPI NTSTATUS WINAPI RtlInitUnicodeStringEx(PUNICODE_STRING,PCWSTR);
4109 NTSYSAPI void WINAPI RtlInitializeBitMap(PRTL_BITMAP,PULONG,ULONG);
4110 NTSYSAPI void WINAPI RtlInitializeConditionVariable(RTL_CONDITION_VARIABLE *);
4111 NTSYSAPI NTSTATUS WINAPI RtlInitializeCriticalSection(RTL_CRITICAL_SECTION *);
4112 NTSYSAPI NTSTATUS WINAPI RtlInitializeCriticalSectionAndSpinCount(RTL_CRITICAL_SECTION *,ULONG);
4113 NTSYSAPI NTSTATUS WINAPI RtlInitializeCriticalSectionEx(RTL_CRITICAL_SECTION *,ULONG,ULONG);
4114 NTSYSAPI void WINAPI RtlInitializeHandleTable(ULONG,ULONG,RTL_HANDLE_TABLE *);
4115 NTSYSAPI void WINAPI RtlInitializeResource(LPRTL_RWLOCK);
4116 NTSYSAPI void WINAPI RtlInitializeSRWLock(RTL_SRWLOCK*);
4117 NTSYSAPI BOOL WINAPI RtlInitializeSid(PSID,PSID_IDENTIFIER_AUTHORITY,BYTE);
4118 NTSYSAPI NTSTATUS WINAPI RtlInt64ToUnicodeString(ULONGLONG,ULONG,UNICODE_STRING *);
4119 NTSYSAPI NTSTATUS WINAPI RtlIntegerToChar(ULONG,ULONG,ULONG,PCHAR);
4120 NTSYSAPI NTSTATUS WINAPI RtlIntegerToUnicodeString(ULONG,ULONG,UNICODE_STRING *);
4121 NTSYSAPI BOOLEAN WINAPI RtlIsActivationContextActive(HANDLE);
4122 NTSYSAPI BOOL WINAPI RtlIsCriticalSectionLocked(RTL_CRITICAL_SECTION *);
4123 NTSYSAPI BOOL WINAPI RtlIsCriticalSectionLockedByThread(RTL_CRITICAL_SECTION *);
4124 NTSYSAPI ULONG WINAPI RtlIsDosDeviceName_U(PCWSTR);
4125 NTSYSAPI BOOLEAN WINAPI RtlIsNameLegalDOS8Dot3(const UNICODE_STRING*,POEM_STRING,PBOOLEAN);
4126 NTSYSAPI NTSTATUS WINAPI RtlIsNormalizedString(ULONG,const WCHAR*,INT,BOOLEAN*);
4127 NTSYSAPI BOOLEAN WINAPI RtlIsProcessorFeaturePresent(UINT);
4128 NTSYSAPI BOOLEAN WINAPI RtlIsTextUnicode(LPCVOID,INT,INT *);
4129 NTSYSAPI BOOLEAN WINAPI RtlIsValidHandle(const RTL_HANDLE_TABLE *, const RTL_HANDLE *);
4130 NTSYSAPI BOOLEAN WINAPI RtlIsValidIndexHandle(const RTL_HANDLE_TABLE *, ULONG Index, RTL_HANDLE **);
4131 NTSYSAPI NTSTATUS WINAPI RtlLeaveCriticalSection(RTL_CRITICAL_SECTION *);
4132 NTSYSAPI DWORD WINAPI RtlLengthRequiredSid(DWORD);
4133 NTSYSAPI ULONG WINAPI RtlLengthSecurityDescriptor(PSECURITY_DESCRIPTOR);
4134 NTSYSAPI DWORD WINAPI RtlLengthSid(PSID);
4135 NTSYSAPI NTSTATUS WINAPI RtlLocalTimeToSystemTime(const LARGE_INTEGER*,PLARGE_INTEGER);
4136 NTSYSAPI NTSTATUS WINAPI RtlLocaleNameToLcid(const WCHAR*,LCID*,ULONG);
4137 NTSYSAPI BOOLEAN WINAPI RtlLockHeap(HANDLE);
4138 NTSYSAPI NTSTATUS WINAPI RtlLookupAtomInAtomTable(RTL_ATOM_TABLE,const WCHAR*,RTL_ATOM*);
4139 NTSYSAPI NTSTATUS WINAPI RtlMakeSelfRelativeSD(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR,LPDWORD);
4140 NTSYSAPI void WINAPI RtlMapGenericMask(PACCESS_MASK,const GENERIC_MAPPING*);
4141 NTSYSAPI NTSTATUS WINAPI RtlMultiByteToUnicodeN(LPWSTR,DWORD,LPDWORD,LPCSTR,DWORD);
4142 NTSYSAPI NTSTATUS WINAPI RtlMultiByteToUnicodeSize(DWORD*,LPCSTR,UINT);
4143 NTSYSAPI NTSTATUS WINAPI RtlNewSecurityObject(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR*,BOOLEAN,HANDLE,PGENERIC_MAPPING);
4144 NTSYSAPI PRTL_USER_PROCESS_PARAMETERS WINAPI RtlNormalizeProcessParams(RTL_USER_PROCESS_PARAMETERS*);
4145 NTSYSAPI NTSTATUS WINAPI RtlNormalizeString(ULONG,const WCHAR*,INT,WCHAR*,INT*);
4146 NTSYSAPI ULONG WINAPI RtlNtStatusToDosError(NTSTATUS);
4147 NTSYSAPI ULONG WINAPI RtlNtStatusToDosErrorNoTeb(NTSTATUS);
4148 NTSYSAPI ULONG WINAPI RtlNumberOfSetBits(PCRTL_BITMAP);
4149 NTSYSAPI ULONG WINAPI RtlNumberOfClearBits(PCRTL_BITMAP);
4150 NTSYSAPI UINT WINAPI RtlOemStringToUnicodeSize(const STRING*);
4151 NTSYSAPI NTSTATUS WINAPI RtlOemStringToUnicodeString(UNICODE_STRING*,const STRING*,BOOLEAN);
4152 NTSYSAPI NTSTATUS WINAPI RtlOemToUnicodeN(LPWSTR,DWORD,LPDWORD,LPCSTR,DWORD);
4153 NTSYSAPI NTSTATUS WINAPI RtlOpenCurrentUser(ACCESS_MASK,PHANDLE);
4154 NTSYSAPI PVOID WINAPI RtlPcToFileHeader(PVOID,PVOID*);
4155 NTSYSAPI NTSTATUS WINAPI RtlPinAtomInAtomTable(RTL_ATOM_TABLE,RTL_ATOM);
4156 NTSYSAPI void WINAPI RtlPopFrame(TEB_ACTIVE_FRAME*);
4157 NTSYSAPI BOOLEAN WINAPI RtlPrefixString(const STRING*,const STRING*,BOOLEAN);
4158 NTSYSAPI BOOLEAN WINAPI RtlPrefixUnicodeString(const UNICODE_STRING*,const UNICODE_STRING*,BOOLEAN);
4159 NTSYSAPI void WINAPI RtlProcessFlsData(void*,ULONG);
4160 NTSYSAPI void WINAPI RtlPushFrame(TEB_ACTIVE_FRAME*);
4161 NTSYSAPI NTSTATUS WINAPI RtlQueryActivationContextApplicationSettings(DWORD,HANDLE,const WCHAR*,const WCHAR*,WCHAR*,SIZE_T,SIZE_T*);
4162 NTSYSAPI NTSTATUS WINAPI RtlQueryAtomInAtomTable(RTL_ATOM_TABLE,RTL_ATOM,ULONG*,ULONG*,WCHAR*,ULONG*);
4163 NTSYSAPI NTSTATUS WINAPI RtlQueryDynamicTimeZoneInformation(RTL_DYNAMIC_TIME_ZONE_INFORMATION*);
4164 NTSYSAPI NTSTATUS WINAPI RtlQueryEnvironmentVariable(WCHAR*,const WCHAR*,SIZE_T,WCHAR*,SIZE_T,SIZE_T*);
4165 NTSYSAPI NTSTATUS WINAPI RtlQueryEnvironmentVariable_U(PWSTR,PUNICODE_STRING,PUNICODE_STRING);
4166 NTSYSAPI NTSTATUS WINAPI RtlQueryHeapInformation(HANDLE,HEAP_INFORMATION_CLASS,PVOID,SIZE_T,PSIZE_T);
4167 NTSYSAPI NTSTATUS WINAPI RtlQueryInformationAcl(PACL,LPVOID,DWORD,ACL_INFORMATION_CLASS);
4168 NTSYSAPI NTSTATUS WINAPI RtlQueryInformationActivationContext(ULONG,HANDLE,PVOID,ULONG,PVOID,SIZE_T,SIZE_T*);
4169 NTSYSAPI BOOL WINAPI RtlQueryPerformanceCounter(LARGE_INTEGER*);
4170 NTSYSAPI BOOL WINAPI RtlQueryPerformanceFrequency(LARGE_INTEGER*);
4171 NTSYSAPI NTSTATUS WINAPI RtlQueryProcessDebugInformation(ULONG,ULONG,PDEBUG_BUFFER);
4172 NTSYSAPI NTSTATUS WINAPI RtlQueryRegistryValues(ULONG, PCWSTR, PRTL_QUERY_REGISTRY_TABLE, PVOID, PVOID);
4173 NTSYSAPI NTSTATUS WINAPI RtlQueryTimeZoneInformation(RTL_TIME_ZONE_INFORMATION*);
4174 NTSYSAPI BOOL WINAPI RtlQueryUnbiasedInterruptTime(ULONGLONG*);
4175 NTSYSAPI NTSTATUS WINAPI RtlQueueWorkItem(PRTL_WORK_ITEM_ROUTINE,PVOID,ULONG);
4176 NTSYSAPI void WINAPI RtlRaiseException(PEXCEPTION_RECORD);
4177 NTSYSAPI void WINAPI RtlRaiseStatus(NTSTATUS);
4178 NTSYSAPI ULONG WINAPI RtlRandom(PULONG);
4179 NTSYSAPI PVOID WINAPI RtlReAllocateHeap(HANDLE,ULONG,PVOID,SIZE_T);
4180 NTSYSAPI NTSTATUS WINAPI RtlRegisterWait(PHANDLE,HANDLE,RTL_WAITORTIMERCALLBACKFUNC,PVOID,ULONG,ULONG);
4181 NTSYSAPI void WINAPI RtlReleaseActivationContext(HANDLE);
4182 NTSYSAPI void WINAPI RtlReleasePath(PWSTR);
4183 NTSYSAPI void WINAPI RtlReleasePebLock(void);
4184 NTSYSAPI void WINAPI RtlReleaseResource(LPRTL_RWLOCK);
4185 NTSYSAPI void WINAPI RtlReleaseSRWLockExclusive(RTL_SRWLOCK*);
4186 NTSYSAPI void WINAPI RtlReleaseSRWLockShared(RTL_SRWLOCK*);
4187 NTSYSAPI ULONG WINAPI RtlRemoveVectoredExceptionHandler(PVOID);
4188 NTSYSAPI void WINAPI RtlResetRtlTranslations(const NLSTABLEINFO*);
4189 NTSYSAPI void WINAPI RtlRestoreLastWin32Error(DWORD);
4190 NTSYSAPI void WINAPI RtlSecondsSince1970ToTime(DWORD,LARGE_INTEGER *);
4191 NTSYSAPI void WINAPI RtlSecondsSince1980ToTime(DWORD,LARGE_INTEGER *);
4192 NTSYSAPI NTSTATUS WINAPI RtlSelfRelativeToAbsoluteSD(PSECURITY_DESCRIPTOR,PSECURITY_DESCRIPTOR,PDWORD,PACL,PDWORD,PACL,PDWORD,PSID,PDWORD,PSID,PDWORD);
4193 NTSYSAPI void WINAPI RtlSetAllBits(PRTL_BITMAP);
4194 NTSYSAPI void WINAPI RtlSetBits(PRTL_BITMAP,ULONG,ULONG);
4195 NTSYSAPI ULONG WINAPI RtlSetCriticalSectionSpinCount(RTL_CRITICAL_SECTION*,ULONG);
4196 NTSYSAPI NTSTATUS WINAPI RtlSetControlSecurityDescriptor(PSECURITY_DESCRIPTOR,SECURITY_DESCRIPTOR_CONTROL,SECURITY_DESCRIPTOR_CONTROL);
4197 NTSYSAPI NTSTATUS WINAPI RtlSetCurrentDirectory_U(const UNICODE_STRING*);
4198 NTSYSAPI void WINAPI RtlSetCurrentEnvironment(PWSTR, PWSTR*);
4199 NTSYSAPI NTSTATUS WINAPI RtlSetDaclSecurityDescriptor(PSECURITY_DESCRIPTOR,BOOLEAN,PACL,BOOLEAN);
4200 NTSYSAPI NTSTATUS WINAPI RtlSetEnvironmentVariable(PWSTR*,PUNICODE_STRING,PUNICODE_STRING);
4201 NTSYSAPI NTSTATUS WINAPI RtlSetHeapInformation(HANDLE,HEAP_INFORMATION_CLASS,PVOID,SIZE_T);
4202 NTSYSAPI NTSTATUS WINAPI RtlSetOwnerSecurityDescriptor(PSECURITY_DESCRIPTOR,PSID,BOOLEAN);
4203 NTSYSAPI NTSTATUS WINAPI RtlSetGroupSecurityDescriptor(PSECURITY_DESCRIPTOR,PSID,BOOLEAN);
4204 NTSYSAPI NTSTATUS WINAPI RtlSetIoCompletionCallback(HANDLE,PRTL_OVERLAPPED_COMPLETION_ROUTINE,ULONG);
4205 NTSYSAPI void WINAPI RtlSetLastWin32Error(DWORD);
4206 NTSYSAPI void WINAPI RtlSetLastWin32ErrorAndNtStatusFromNtStatus(NTSTATUS);
4207 NTSYSAPI NTSTATUS WINAPI RtlSetProcessPreferredUILanguages(DWORD,PCZZWSTR,ULONG*);
4208 NTSYSAPI NTSTATUS WINAPI RtlSetSaclSecurityDescriptor(PSECURITY_DESCRIPTOR,BOOLEAN,PACL,BOOLEAN);
4209 NTSYSAPI NTSTATUS WINAPI RtlSetSearchPathMode(ULONG);
4210 NTSYSAPI NTSTATUS WINAPI RtlSetThreadErrorMode(DWORD,LPDWORD);
4211 NTSYSAPI NTSTATUS WINAPI RtlSetThreadPreferredUILanguages(DWORD,PCZZWSTR,ULONG*);
4212 NTSYSAPI NTSTATUS WINAPI RtlSetTimeZoneInformation(const RTL_TIME_ZONE_INFORMATION*);
4213 NTSYSAPI void WINAPI RtlSetUnhandledExceptionFilter(PRTL_EXCEPTION_FILTER);
4214 NTSYSAPI SIZE_T WINAPI RtlSizeHeap(HANDLE,ULONG,const void*);
4215 NTSYSAPI NTSTATUS WINAPI RtlSleepConditionVariableCS(RTL_CONDITION_VARIABLE*,RTL_CRITICAL_SECTION*,const LARGE_INTEGER*);
4216 NTSYSAPI NTSTATUS WINAPI RtlSleepConditionVariableSRW(RTL_CONDITION_VARIABLE*,RTL_SRWLOCK*,const LARGE_INTEGER*,ULONG);
4217 NTSYSAPI NTSTATUS WINAPI RtlStringFromGUID(REFGUID,PUNICODE_STRING);
4218 NTSYSAPI LPDWORD WINAPI RtlSubAuthoritySid(PSID,DWORD);
4219 NTSYSAPI LPBYTE WINAPI RtlSubAuthorityCountSid(PSID);
4220 NTSYSAPI NTSTATUS WINAPI RtlSystemTimeToLocalTime(const LARGE_INTEGER*,PLARGE_INTEGER);
4221 NTSYSAPI void WINAPI RtlTimeToTimeFields(const LARGE_INTEGER*,PTIME_FIELDS);
4222 NTSYSAPI BOOLEAN WINAPI RtlTimeFieldsToTime(PTIME_FIELDS,PLARGE_INTEGER);
4223 NTSYSAPI void WINAPI RtlTimeToElapsedTimeFields(const LARGE_INTEGER *,PTIME_FIELDS);
4224 NTSYSAPI BOOLEAN WINAPI RtlTimeToSecondsSince1970(const LARGE_INTEGER *,LPDWORD);
4225 NTSYSAPI BOOLEAN WINAPI RtlTimeToSecondsSince1980(const LARGE_INTEGER *,LPDWORD);
4226 NTSYSAPI BOOLEAN WINAPI RtlTryAcquireSRWLockExclusive(RTL_SRWLOCK *);
4227 NTSYSAPI BOOLEAN WINAPI RtlTryAcquireSRWLockShared(RTL_SRWLOCK *);
4228 NTSYSAPI BOOL WINAPI RtlTryEnterCriticalSection(RTL_CRITICAL_SECTION *);
4229 NTSYSAPI NTSTATUS WINAPI RtlUTF8ToUnicodeN(WCHAR*,DWORD,DWORD*,const char*,DWORD);
4230 NTSYSAPI ULONGLONG __cdecl RtlUlonglongByteSwap(ULONGLONG);
4231 NTSYSAPI DWORD WINAPI RtlUnicodeStringToAnsiSize(const UNICODE_STRING*);
4232 NTSYSAPI NTSTATUS WINAPI RtlUnicodeStringToAnsiString(PANSI_STRING,PCUNICODE_STRING,BOOLEAN);
4233 NTSYSAPI NTSTATUS WINAPI RtlUnicodeStringToInteger(const UNICODE_STRING *,ULONG,ULONG *);
4234 NTSYSAPI DWORD WINAPI RtlUnicodeStringToOemSize(const UNICODE_STRING*);
4235 NTSYSAPI NTSTATUS WINAPI RtlUnicodeStringToOemString(POEM_STRING,PCUNICODE_STRING,BOOLEAN);
4236 NTSYSAPI NTSTATUS WINAPI RtlUnicodeToCustomCPN(CPTABLEINFO*,char*,DWORD,DWORD*,const WCHAR*,DWORD);
4237 NTSYSAPI NTSTATUS WINAPI RtlUnicodeToMultiByteN(LPSTR,DWORD,LPDWORD,LPCWSTR,DWORD);
4238 NTSYSAPI NTSTATUS WINAPI RtlUnicodeToMultiByteSize(PULONG,PCWSTR,ULONG);
4239 NTSYSAPI NTSTATUS WINAPI RtlUnicodeToOemN(LPSTR,DWORD,LPDWORD,LPCWSTR,DWORD);
4240 NTSYSAPI NTSTATUS WINAPI RtlUnicodeToUTF8N(LPSTR,DWORD,LPDWORD,LPCWSTR,DWORD);
4241 NTSYSAPI ULONG WINAPI RtlUniform(PULONG);
4242 NTSYSAPI BOOLEAN WINAPI RtlUnlockHeap(HANDLE);
4243 NTSYSAPI void WINAPI RtlUnwind(PVOID,PVOID,PEXCEPTION_RECORD,PVOID);
4244 NTSYSAPI WCHAR WINAPI RtlUpcaseUnicodeChar(WCHAR);
4245 NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeString(UNICODE_STRING*,const UNICODE_STRING *,BOOLEAN);
4246 NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeStringToAnsiString(STRING*,const UNICODE_STRING*,BOOLEAN);
4247 NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeStringToCountedOemString(STRING*,const UNICODE_STRING*,BOOLEAN);
4248 NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeStringToOemString(STRING*,const UNICODE_STRING*,BOOLEAN);
4249 NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeToCustomCPN(CPTABLEINFO*,char*,DWORD,DWORD*,const WCHAR*,DWORD);
4250 NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeToMultiByteN(LPSTR,DWORD,LPDWORD,LPCWSTR,DWORD);
4251 NTSYSAPI NTSTATUS WINAPI RtlUpcaseUnicodeToOemN(LPSTR,DWORD,LPDWORD,LPCWSTR,DWORD);
4252 NTSYSAPI NTSTATUS WINAPI RtlUpdateTimer(HANDLE, HANDLE, DWORD, DWORD);
4253 NTSYSAPI CHAR WINAPI RtlUpperChar(CHAR);
4254 NTSYSAPI void WINAPI RtlUpperString(STRING *,const STRING *);
4255 NTSYSAPI void WINAPI RtlUserThreadStart(PRTL_THREAD_START_ROUTINE,void*);
4256 NTSYSAPI NTSTATUS WINAPI RtlValidSecurityDescriptor(PSECURITY_DESCRIPTOR);
4257 NTSYSAPI BOOLEAN WINAPI RtlValidRelativeSecurityDescriptor(PSECURITY_DESCRIPTOR,ULONG,SECURITY_INFORMATION);
4258 NTSYSAPI BOOLEAN WINAPI RtlValidAcl(PACL);
4259 NTSYSAPI BOOLEAN WINAPI RtlValidSid(PSID);
4260 NTSYSAPI BOOLEAN WINAPI RtlValidateHeap(HANDLE,ULONG,LPCVOID);
4261 NTSYSAPI NTSTATUS WINAPI RtlVerifyVersionInfo(const RTL_OSVERSIONINFOEXW*,DWORD,DWORDLONG);
4262 NTSYSAPI NTSTATUS WINAPI RtlWaitOnAddress(const void *,const void *,SIZE_T,const LARGE_INTEGER *);
4263 NTSYSAPI void WINAPI RtlWakeAddressAll(const void *);
4264 NTSYSAPI void WINAPI RtlWakeAddressSingle(const void *);
4265 NTSYSAPI void WINAPI RtlWakeAllConditionVariable(RTL_CONDITION_VARIABLE *);
4266 NTSYSAPI void WINAPI RtlWakeConditionVariable(RTL_CONDITION_VARIABLE *);
4267 NTSYSAPI NTSTATUS WINAPI RtlWalkHeap(HANDLE,PVOID);
4268 NTSYSAPI NTSTATUS WINAPI RtlWow64EnableFsRedirection(BOOLEAN);
4269 NTSYSAPI NTSTATUS WINAPI RtlWow64EnableFsRedirectionEx(ULONG,ULONG*);
4270 NTSYSAPI USHORT WINAPI RtlWow64GetCurrentMachine(void);
4271 NTSYSAPI NTSTATUS WINAPI RtlWow64GetProcessMachines(HANDLE,USHORT*,USHORT*);
4272 NTSYSAPI NTSTATUS WINAPI RtlWow64IsWowGuestMachineSupported(USHORT,BOOLEAN*);
4273 NTSYSAPI NTSTATUS WINAPI RtlWriteRegistryValue(ULONG,PCWSTR,PCWSTR,ULONG,PVOID,ULONG);
4274 NTSYSAPI NTSTATUS WINAPI RtlZombifyActivationContext(HANDLE);
4275 NTSYSAPI NTSTATUS WINAPI RtlpNtCreateKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,PULONG);
4276 NTSYSAPI NTSTATUS WINAPI RtlpNtEnumerateSubKey(HANDLE,UNICODE_STRING *, ULONG);
4277 NTSYSAPI NTSTATUS WINAPI RtlpWaitForCriticalSection(RTL_CRITICAL_SECTION *);
4278 NTSYSAPI NTSTATUS WINAPI RtlpUnWaitCriticalSection(RTL_CRITICAL_SECTION *);
4279 NTSYSAPI NTSTATUS WINAPI vDbgPrintEx(ULONG,ULONG,LPCSTR,__ms_va_list);
4280 NTSYSAPI NTSTATUS WINAPI vDbgPrintExWithPrefix(LPCSTR,ULONG,ULONG,LPCSTR,__ms_va_list);
4281
4282 #ifdef _WIN64
4283 NTSYSAPI NTSTATUS WINAPI RtlWow64GetCpuAreaInfo(WOW64_CPURESERVED*,ULONG,WOW64_CPU_AREA_INFO*);
4284 NTSYSAPI NTSTATUS WINAPI RtlWow64GetThreadContext(HANDLE,WOW64_CONTEXT*);
4285 NTSYSAPI NTSTATUS WINAPI RtlWow64SetThreadContext(HANDLE,const WOW64_CONTEXT*);
4286 #endif
4287
4288 #if defined(__x86_64__) || defined(__i386__)
4289 NTSYSAPI NTSTATUS WINAPI RtlCopyExtendedContext(CONTEXT_EX*,ULONG,CONTEXT_EX*);
4290 NTSYSAPI NTSTATUS WINAPI RtlInitializeExtendedContext(void*,ULONG,CONTEXT_EX**);
4291 NTSYSAPI NTSTATUS WINAPI RtlInitializeExtendedContext2(void*,ULONG,CONTEXT_EX**,ULONG64);
4292 NTSYSAPI ULONG64 WINAPI RtlGetEnabledExtendedFeatures(ULONG64);
4293 NTSYSAPI NTSTATUS WINAPI RtlGetExtendedContextLength(ULONG,ULONG*);
4294 NTSYSAPI NTSTATUS WINAPI RtlGetExtendedContextLength2(ULONG,ULONG*,ULONG64);
4295 NTSYSAPI void * WINAPI RtlLocateLegacyContext(CONTEXT_EX*,ULONG*);
4296 NTSYSAPI void * WINAPI RtlLocateExtendedFeature(CONTEXT_EX*,ULONG,ULONG*);
4297 NTSYSAPI void * WINAPI RtlLocateExtendedFeature2(CONTEXT_EX*,ULONG,XSTATE_CONFIGURATION*,ULONG*);
4298 NTSYSAPI ULONG64 WINAPI RtlGetExtendedFeaturesMask(CONTEXT_EX*);
4299 NTSYSAPI void WINAPI RtlSetExtendedFeaturesMask(CONTEXT_EX*,ULONG64);
4300 #endif
4301
4302 #ifndef __WINE_USE_MSVCRT
4303 NTSYSAPI int __cdecl _strnicmp(LPCSTR,LPCSTR,size_t);
4304 #endif
4305
4306 /* 32-bit only functions */
4307
4308 #ifndef _WIN64
4309 NTSYSAPI LONGLONG WINAPI RtlConvertLongToLargeInteger(LONG);
4310 NTSYSAPI ULONGLONG WINAPI RtlConvertUlongToLargeInteger(ULONG);
4311 NTSYSAPI LONGLONG WINAPI RtlEnlargedIntegerMultiply(INT,INT);
4312 NTSYSAPI ULONGLONG WINAPI RtlEnlargedUnsignedMultiply(UINT,UINT);
4313 NTSYSAPI UINT WINAPI RtlEnlargedUnsignedDivide(ULONGLONG,UINT,UINT *);
4314 NTSYSAPI LONGLONG WINAPI RtlExtendedMagicDivide(LONGLONG,LONGLONG,INT);
4315 NTSYSAPI LONGLONG WINAPI RtlExtendedIntegerMultiply(LONGLONG,INT);
4316 NTSYSAPI LONGLONG WINAPI RtlExtendedLargeIntegerDivide(LONGLONG,INT,INT *);
4317 NTSYSAPI LONGLONG WINAPI RtlInterlockedCompareExchange64(LONGLONG*,LONGLONG,LONGLONG);
4318 NTSYSAPI LONGLONG WINAPI RtlLargeIntegerAdd(LONGLONG,LONGLONG);
4319 NTSYSAPI LONGLONG WINAPI RtlLargeIntegerArithmeticShift(LONGLONG,INT);
4320 NTSYSAPI ULONGLONG WINAPI RtlLargeIntegerDivide( ULONGLONG,ULONGLONG,ULONGLONG *);
4321 NTSYSAPI LONGLONG WINAPI RtlLargeIntegerNegate(LONGLONG);
4322 NTSYSAPI LONGLONG WINAPI RtlLargeIntegerShiftLeft(LONGLONG,INT);
4323 NTSYSAPI LONGLONG WINAPI RtlLargeIntegerShiftRight(LONGLONG,INT);
4324 NTSYSAPI LONGLONG WINAPI RtlLargeIntegerSubtract(LONGLONG,LONGLONG);
4325 NTSYSAPI NTSTATUS WINAPI RtlLargeIntegerToChar(const ULONGLONG *,ULONG,ULONG,PCHAR);
4326 #endif
4327
4328 /* Threadpool functions */
4329
4330 NTSYSAPI NTSTATUS WINAPI TpAllocCleanupGroup(TP_CLEANUP_GROUP **);
4331 NTSYSAPI NTSTATUS WINAPI TpAllocIoCompletion(TP_IO **,HANDLE,PTP_IO_CALLBACK,void *,TP_CALLBACK_ENVIRON *);
4332 NTSYSAPI NTSTATUS WINAPI TpAllocPool(TP_POOL **,PVOID);
4333 NTSYSAPI NTSTATUS WINAPI TpAllocTimer(TP_TIMER **,PTP_TIMER_CALLBACK,PVOID,TP_CALLBACK_ENVIRON *);
4334 NTSYSAPI NTSTATUS WINAPI TpAllocWait(TP_WAIT **,PTP_WAIT_CALLBACK,PVOID,TP_CALLBACK_ENVIRON *);
4335 NTSYSAPI NTSTATUS WINAPI TpAllocWork(TP_WORK **,PTP_WORK_CALLBACK,PVOID,TP_CALLBACK_ENVIRON *);
4336 NTSYSAPI void WINAPI TpCallbackLeaveCriticalSectionOnCompletion(TP_CALLBACK_INSTANCE *,RTL_CRITICAL_SECTION *);
4337 NTSYSAPI NTSTATUS WINAPI TpCallbackMayRunLong(TP_CALLBACK_INSTANCE *);
4338 NTSYSAPI void WINAPI TpCallbackReleaseMutexOnCompletion(TP_CALLBACK_INSTANCE *,HANDLE);
4339 NTSYSAPI void WINAPI TpCallbackReleaseSemaphoreOnCompletion(TP_CALLBACK_INSTANCE *,HANDLE,DWORD);
4340 NTSYSAPI void WINAPI TpCallbackSetEventOnCompletion(TP_CALLBACK_INSTANCE *,HANDLE);
4341 NTSYSAPI void WINAPI TpCallbackUnloadDllOnCompletion(TP_CALLBACK_INSTANCE *,HMODULE);
4342 NTSYSAPI void WINAPI TpCancelAsyncIoOperation(TP_IO *);
4343 NTSYSAPI void WINAPI TpDisassociateCallback(TP_CALLBACK_INSTANCE *);
4344 NTSYSAPI BOOL WINAPI TpIsTimerSet(TP_TIMER *);
4345 NTSYSAPI void WINAPI TpPostWork(TP_WORK *);
4346 NTSYSAPI NTSTATUS WINAPI TpQueryPoolStackInformation(TP_POOL *, TP_POOL_STACK_INFORMATION *stack_info);
4347 NTSYSAPI void WINAPI TpReleaseCleanupGroup(TP_CLEANUP_GROUP *);
4348 NTSYSAPI void WINAPI TpReleaseCleanupGroupMembers(TP_CLEANUP_GROUP *,BOOL,PVOID);
4349 NTSYSAPI void WINAPI TpReleaseIoCompletion(TP_IO *);
4350 NTSYSAPI void WINAPI TpReleasePool(TP_POOL *);
4351 NTSYSAPI void WINAPI TpReleaseTimer(TP_TIMER *);
4352 NTSYSAPI void WINAPI TpReleaseWait(TP_WAIT *);
4353 NTSYSAPI void WINAPI TpReleaseWork(TP_WORK *);
4354 NTSYSAPI void WINAPI TpSetPoolMaxThreads(TP_POOL *,DWORD);
4355 NTSYSAPI BOOL WINAPI TpSetPoolMinThreads(TP_POOL *,DWORD);
4356 NTSYSAPI NTSTATUS WINAPI TpSetPoolStackInformation(TP_POOL *, TP_POOL_STACK_INFORMATION *stack_info);
4357 NTSYSAPI void WINAPI TpSetTimer(TP_TIMER *, LARGE_INTEGER *,LONG,LONG);
4358 NTSYSAPI void WINAPI TpSetWait(TP_WAIT *,HANDLE,LARGE_INTEGER *);
4359 NTSYSAPI NTSTATUS WINAPI TpSimpleTryPost(PTP_SIMPLE_CALLBACK,PVOID,TP_CALLBACK_ENVIRON *);
4360 NTSYSAPI void WINAPI TpStartAsyncIoOperation(TP_IO *);
4361 NTSYSAPI void WINAPI TpWaitForIoCompletion(TP_IO *,BOOL);
4362 NTSYSAPI void WINAPI TpWaitForTimer(TP_TIMER *,BOOL);
4363 NTSYSAPI void WINAPI TpWaitForWait(TP_WAIT *,BOOL);
4364 NTSYSAPI void WINAPI TpWaitForWork(TP_WORK *,BOOL);
4365
4366 /* Wine internal functions */
4367
4368 NTSYSAPI NTSTATUS CDECL wine_nt_to_unix_file_name( const UNICODE_STRING *nameW, char *nameA, SIZE_T *size,
4369 UINT disposition );
4370 NTSYSAPI NTSTATUS CDECL wine_unix_to_nt_file_name( const char *name, WCHAR *buffer, SIZE_T *size );
4371
4372
4373 /***********************************************************************
4374 * Inline functions
4375 */
4376
4377 #define InitializeObjectAttributes(p,n,a,r,s) \
4378 do { \
4379 (p)->Length = sizeof(OBJECT_ATTRIBUTES); \
4380 (p)->RootDirectory = r; \
4381 (p)->Attributes = a; \
4382 (p)->ObjectName = n; \
4383 (p)->SecurityDescriptor = s; \
4384 (p)->SecurityQualityOfService = NULL; \
4385 } while (0)
4386
4387 #define NtCurrentProcess() ((HANDLE)-1)
4388
4389 #define RtlFillMemory(Destination,Length,Fill) memset((Destination),(Fill),(Length))
4390 #define RtlMoveMemory(Destination,Source,Length) memmove((Destination),(Source),(Length))
4391 #define RtlStoreUlong(p,v) do { ULONG _v = (v); memcpy((p), &_v, sizeof(_v)); } while (0)
4392 #define RtlStoreUlonglong(p,v) do { ULONGLONG _v = (v); memcpy((p), &_v, sizeof(_v)); } while (0)
4393 #define RtlRetrieveUlong(p,s) memcpy((p), (s), sizeof(ULONG))
4394 #define RtlRetrieveUlonglong(p,s) memcpy((p), (s), sizeof(ULONGLONG))
4395 #define RtlZeroMemory(Destination,Length) memset((Destination),0,(Length))
4396
4397 static inline BOOLEAN RtlCheckBit(PCRTL_BITMAP lpBits, ULONG ulBit)
4398 {
4399 if (lpBits && ulBit < lpBits->SizeOfBitMap &&
4400 lpBits->Buffer[ulBit >> 5] & (1 << (ulBit & 31)))
4401 return TRUE;
4402 return FALSE;
4403 }
4404
4405 /* These are implemented as __fastcall, so we can't let Winelib apps link with them */
4406 static inline USHORT RtlUshortByteSwap(USHORT s)
4407 {
4408 return (s >> 8) | (s << 8);
4409 }
4410 static inline ULONG RtlUlongByteSwap(ULONG i)
4411 {
4412 #if defined(__i386__) && defined(__GNUC__)
4413 ULONG ret;
4414 __asm__("bswap %0" : "=r" (ret) : "0" (i) );
4415 return ret;
4416 #else
4417 return ((ULONG)RtlUshortByteSwap((USHORT)i) << 16) | RtlUshortByteSwap((USHORT)(i >> 16));
4418 #endif
4419 }
4420
4421 /* list manipulation macros */
4422 #define InitializeListHead(le) (void)((le)->Flink = (le)->Blink = (le))
4423 #define InsertHeadList(le,e) do { PLIST_ENTRY f = (le)->Flink; (e)->Flink = f; (e)->Blink = (le); f->Blink = (e); (le)->Flink = (e); } while (0)
4424 #define InsertTailList(le,e) do { PLIST_ENTRY b = (le)->Blink; (e)->Flink = (le); (e)->Blink = b; b->Flink = (e); (le)->Blink = (e); } while (0)
4425 #define IsListEmpty(le) ((le)->Flink == (le))
4426 #define RemoveEntryList(e) do { PLIST_ENTRY f = (e)->Flink, b = (e)->Blink; f->Blink = b; b->Flink = f; (e)->Flink = (e)->Blink = NULL; } while (0)
4427 static inline PLIST_ENTRY RemoveHeadList(PLIST_ENTRY le)
4428 {
4429 PLIST_ENTRY f, b, e;
4430
4431 e = le->Flink;
4432 f = le->Flink->Flink;
4433 b = le->Flink->Blink;
4434 f->Blink = b;
4435 b->Flink = f;
4436
4437 if (e != le) e->Flink = e->Blink = NULL;
4438 return e;
4439 }
4440 static inline PLIST_ENTRY RemoveTailList(PLIST_ENTRY le)
4441 {
4442 PLIST_ENTRY f, b, e;
4443
4444 e = le->Blink;
4445 f = le->Blink->Flink;
4446 b = le->Blink->Blink;
4447 f->Blink = b;
4448 b->Flink = f;
4449
4450 if (e != le) e->Flink = e->Blink = NULL;
4451 return e;
4452 }
4453
4454
4455 #ifdef __WINESRC__
4456
4457 /* Wine internal functions */
4458 extern NTSTATUS CDECL __wine_init_unix_lib( HMODULE module, DWORD reason, const void *ptr_in, void *ptr_out );
4459
4460 /* The thread information for 16-bit threads */
4461 /* NtCurrentTeb()->SubSystemTib points to this */
4462 typedef struct
4463 {
4464 void *unknown; /* 00 unknown */
4465 UNICODE_STRING *exe_name; /* 04 exe module name */
4466
4467 /* the following fields do not exist under Windows */
4468 UNICODE_STRING exe_str; /* exe name string pointed to by exe_name */
4469 CURDIR curdir; /* current directory */
4470 WCHAR curdir_buffer[MAX_PATH];
4471 } WIN16_SUBSYSTEM_TIB;
4472
4473 #endif /* __WINESRC__ */
4474
4475 #ifdef __cplusplus
4476 } /* extern "C" */
4477 #endif /* defined(__cplusplus) */
4478
4479 #endif /* __WINE_WINTERNL_H */
Windows API implementation