include/ddk/wdm.h

   1 /*
   2  * Copyright 2004-2005 Ivan Leo Puoti
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #ifndef _WDMDDK_
  20 #define _WDMDDK_
  21 #define _NTDDK_
  22
  23 #include <ntstatus.h>
  24
  25 #ifdef _WIN64
  26 #define POINTER_ALIGNMENT DECLSPEC_ALIGN(8)
  27 #else
  28 #define POINTER_ALIGNMENT
  29 #endif
  30
  31 typedef LONG KPRIORITY;
  32
  33 typedef ULONG_PTR KSPIN_LOCK, *PKSPIN_LOCK;
  34
  35 struct _KDPC;
  36 struct _KAPC;
  37 struct _IRP;
  38 struct _DEVICE_OBJECT;
  39 struct _DRIVER_OBJECT;
  40
  41 typedef VOID (WINAPI *PKDEFERRED_ROUTINE)(struct _KDPC *, PVOID, PVOID, PVOID);
  42 typedef VOID (WINAPI *PKSTART_ROUTINE)(PVOID);
  43
  44 typedef NTSTATUS (WINAPI *PDRIVER_INITIALIZE)(struct _DRIVER_OBJECT *, PUNICODE_STRING);
  45 typedef NTSTATUS (WINAPI *PDRIVER_DISPATCH)(struct _DEVICE_OBJECT *, struct _IRP *);
  46 typedef void (WINAPI *PDRIVER_STARTIO)(struct _DEVICE_OBJECT *, struct _IRP *);
  47 typedef void (WINAPI *PDRIVER_UNLOAD)(struct _DRIVER_OBJECT *);
  48
  49 typedef struct _DISPATCHER_HEADER {
  50   UCHAR  Type;
  51   UCHAR  Absolute;
  52   UCHAR  Size;
  53   UCHAR  Inserted;
  54   LONG  SignalState;
  55   LIST_ENTRY  WaitListHead;
  56 } DISPATCHER_HEADER, *PDISPATCHER_HEADER;
  57
  58 typedef struct _KEVENT {
  59   DISPATCHER_HEADER  Header;
  60 } KEVENT, *PKEVENT, *RESTRICTED_POINTER PRKEVENT;
  61
  62 typedef struct _KDPC {
  63   CSHORT  Type;
  64   UCHAR  Number;
  65   UCHAR  Importance;
  66   LIST_ENTRY  DpcListEntry;
  67   PKDEFERRED_ROUTINE  DeferredRoutine;
  68   PVOID  DeferredContext;
  69   PVOID  SystemArgument1;
  70   PVOID  SystemArgument2;
  71   PULONG_PTR  Lock;
  72 } KDPC, *PKDPC, *RESTRICTED_POINTER PRKDPC;
  73
  74 typedef struct _KDEVICE_QUEUE_ENTRY {
  75   LIST_ENTRY  DeviceListEntry;
  76   ULONG  SortKey;
  77   BOOLEAN  Inserted;
  78 } KDEVICE_QUEUE_ENTRY, *PKDEVICE_QUEUE_ENTRY,
  79 *RESTRICTED_POINTER PRKDEVICE_QUEUE_ENTRY;
  80
  81 typedef struct _KDEVICE_QUEUE {
  82   CSHORT  Type;
  83   CSHORT  Size;
  84   LIST_ENTRY  DeviceListHead;
  85   KSPIN_LOCK  Lock;
  86   BOOLEAN  Busy;
  87 } KDEVICE_QUEUE, *PKDEVICE_QUEUE, *RESTRICTED_POINTER PRKDEVICE_QUEUE;
  88
  89 typedef struct _KMUTANT {
  90     DISPATCHER_HEADER Header;
  91     LIST_ENTRY MutantListEntry;
  92     struct _KTHREAD *RESTRICTED_POINTER OwnerThread;
  93     BOOLEAN Abandoned;
  94     UCHAR ApcDisable;
  95 } KMUTANT, *PKMUTANT, *RESTRICTED_POINTER PRKMUTANT, KMUTEX, *PKMUTEX, *RESTRICTED_POINTER PRKMUTEX;
  96
  97 typedef enum _KWAIT_REASON
  98 {
  99     Executive,
 100     FreePage,
 101     PageIn,
 102     PoolAllocation,
 103     DelayExecution,
 104     Suspended,
 105     UserRequest,
 106     WrExecutive,
 107     WrFreePage,
 108     WrPageIn,
 109     WrDelayExecution,
 110     WrSuspended,
 111     WrUserRequest,
 112     WrQueue,
 113     WrLpcReceive,
 114     WrLpcReply,
 115     WrVirtualMemory,
 116     WrPageOut,
 117     WrRendezvous,
 118     Spare2,
 119     Spare3,
 120     Spare4,
 121     Spare5,
 122     Spare6,
 123     WrKernel,
 124     MaximumWaitReason,
 125 } KWAIT_REASON;
 126
 127 typedef struct _IO_TIMER *PIO_TIMER;
 128 typedef struct _ETHREAD *PETHREAD;
 129 typedef struct _KTHREAD *PKTHREAD;
 130 typedef struct _EPROCESS *PEPROCESS;
 131 typedef struct _IO_WORKITEM *PIO_WORKITEM;
 132 typedef struct _OBJECT_TYPE *POBJECT_TYPE;
 133 typedef struct _OBJECT_HANDLE_INFORMATION *POBJECT_HANDLE_INFORMATION;
 134
 135 #define MAXIMUM_VOLUME_LABEL_LENGTH       (32 * sizeof(WCHAR))
 136
 137 typedef struct _VPB {
 138   CSHORT  Type;
 139   CSHORT  Size;
 140   USHORT  Flags;
 141   USHORT  VolumeLabelLength;
 142   struct _DEVICE_OBJECT  *DeviceObject;
 143   struct _DEVICE_OBJECT  *RealDevice;
 144   ULONG  SerialNumber;
 145   ULONG  ReferenceCount;
 146   WCHAR  VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH / sizeof(WCHAR)];
 147 } VPB, *PVPB;
 148
 149 typedef enum _POOL_TYPE {
 150   NonPagedPool,
 151   PagedPool,
 152   NonPagedPoolMustSucceed,
 153   UnkownType,
 154   NonPagedPoolCacheAligned,
 155   PagedPoolCacheAligned,
 156   NonPagedPoolCacheAlignedMustS,
 157   MaxPoolType
 158 } POOL_TYPE;
 159
 160 typedef struct _WAIT_CONTEXT_BLOCK {
 161   KDEVICE_QUEUE_ENTRY  WaitQueueEntry;
 162   struct _DRIVER_CONTROL  *DeviceRoutine;
 163   PVOID  DeviceContext;
 164   ULONG  NumberOfMapRegisters;
 165   PVOID  DeviceObject;
 166   PVOID  CurrentIrp;
 167   PKDPC  BufferChainingDpc;
 168 } WAIT_CONTEXT_BLOCK, *PWAIT_CONTEXT_BLOCK;
 169
 170 #define DO_BUFFERED_IO                  0x00000004
 171 #define DO_EXCLUSIVE                    0x00000008
 172 #define DO_DIRECT_IO                    0x00000010
 173 #define DO_MAP_IO_BUFFER                0x00000020
 174 #define DO_DEVICE_INITIALIZING          0x00000080
 175 #define DO_SHUTDOWN_REGISTERED          0x00000800
 176 #define DO_BUS_ENUMERATED_DEVICE        0x00001000
 177 #define DO_POWER_PAGABLE                0x00002000
 178 #define DO_POWER_INRUSH                 0x00004000
 179
 180 #define IO_NO_INCREMENT                     0
 181 #define IO_CD_ROM_INCREMENT                 1
 182 #define IO_DISK_INCREMENT                   1
 183 #define IO_KEYBOARD_INCREMENT               6
 184 #define IO_MAILSLOT_INCREMENT               2
 185 #define IO_MOUSE_INCREMENT                  6
 186 #define IO_NAMED_PIPE_INCREMENT             2
 187 #define IO_NETWORK_INCREMENT                2
 188 #define IO_PARALLEL_INCREMENT               1
 189 #define IO_SERIAL_INCREMENT                 2
 190 #define IO_SOUND_INCREMENT                  8
 191 #define IO_VIDEO_INCREMENT                  1
 192
 193 #ifndef DEVICE_TYPE
 194 #define DEVICE_TYPE ULONG
 195 #endif
 196 #define IRP_MJ_MAXIMUM_FUNCTION           0x1b
 197 #define IRP_MJ_CREATE                     0x00
 198 #define IRP_MJ_CREATE_NAMED_PIPE          0x01
 199 #define IRP_MJ_CLOSE                      0x02
 200 #define IRP_MJ_READ                       0x03
 201 #define IRP_MJ_WRITE                      0x04
 202 #define IRP_MJ_QUERY_INFORMATION          0x05
 203 #define IRP_MJ_SET_INFORMATION            0x06
 204 #define IRP_MJ_QUERY_EA                   0x07
 205 #define IRP_MJ_SET_EA                     0x08
 206 #define IRP_MJ_FLUSH_BUFFERS              0x09
 207 #define IRP_MJ_QUERY_VOLUME_INFORMATION   0x0a
 208 #define IRP_MJ_SET_VOLUME_INFORMATION     0x0b
 209 #define IRP_MJ_DIRECTORY_CONTROL          0x0c
 210 #define IRP_MJ_FILE_SYSTEM_CONTROL        0x0d
 211 #define IRP_MJ_DEVICE_CONTROL             0x0e
 212 #define IRP_MJ_INTERNAL_DEVICE_CONTROL    0x0f
 213 #define IRP_MJ_SHUTDOWN                   0x10
 214 #define IRP_MJ_LOCK_CONTROL               0x11
 215 #define IRP_MJ_CLEANUP                    0x12
 216 #define IRP_MJ_CREATE_MAILSLOT            0x13
 217 #define IRP_MJ_QUERY_SECURITY             0x14
 218 #define IRP_MJ_SET_SECURITY               0x15
 219 #define IRP_MJ_POWER                      0x16
 220 #define IRP_MJ_SYSTEM_CONTROL             0x17
 221 #define IRP_MJ_DEVICE_CHANGE              0x18
 222 #define IRP_MJ_QUERY_QUOTA                0x19
 223 #define IRP_MJ_SET_QUOTA                  0x1a
 224 #define IRP_MJ_PNP                        0x1b
 225
 226 #define IRP_MN_START_DEVICE                 0x00
 227 #define IRP_MN_QUERY_REMOVE_DEVICE          0x01
 228 #define IRP_MN_REMOVE_DEVICE                0x02
 229 #define IRP_MN_CANCEL_REMOVE_DEVICE         0x03
 230 #define IRP_MN_STOP_DEVICE                  0x04
 231 #define IRP_MN_QUERY_STOP_DEVICE            0x05
 232 #define IRP_MN_CANCEL_STOP_DEVICE           0x06
 233 #define IRP_MN_QUERY_DEVICE_RELATIONS       0x07
 234 #define IRP_MN_QUERY_INTERFACE              0x08
 235 #define IRP_MN_QUERY_CAPABILITIES           0x09
 236 #define IRP_MN_QUERY_RESOURCES              0x0A
 237 #define IRP_MN_QUERY_RESOURCE_REQUIREMENTS  0x0B
 238 #define IRP_MN_QUERY_DEVICE_TEXT            0x0C
 239 #define IRP_MN_FILTER_RESOURCE_REQUIREMENTS 0x0D
 240 #define IRP_MN_READ_CONFIG                  0x0F
 241 #define IRP_MN_WRITE_CONFIG                 0x10
 242 #define IRP_MN_EJECT                        0x11
 243 #define IRP_MN_SET_LOCK                     0x12
 244 #define IRP_MN_QUERY_ID                     0x13
 245 #define IRP_MN_QUERY_PNP_DEVICE_STATE       0x14
 246 #define IRP_MN_QUERY_BUS_INFORMATION        0x15
 247 #define IRP_MN_DEVICE_USAGE_NOTIFICATION    0x16
 248 #define IRP_MN_SURPRISE_REMOVAL             0x17
 249
 250 #define IRP_QUOTA_CHARGED               0x01
 251 #define IRP_ALLOCATED_MUST_SUCCEED      0x02
 252 #define IRP_ALLOCATED_FIXED_SIZE        0x04
 253 #define IRP_LOOKASIDE_ALLOCATION        0x08
 254
 255 #define IO_TYPE_ADAPTER                 0x01
 256 #define IO_TYPE_CONTROLLER              0x02
 257 #define IO_TYPE_DEVICE                  0x03
 258 #define IO_TYPE_DRIVER                  0x04
 259 #define IO_TYPE_FILE                    0x05
 260 #define IO_TYPE_IRP                     0x06
 261 #define IO_TYPE_MASTER_ADAPTER          0x07
 262 #define IO_TYPE_OPEN_PACKET             0x08
 263 #define IO_TYPE_TIMER                   0x09
 264 #define IO_TYPE_VPB                     0x0a
 265 #define IO_TYPE_ERROR_LOG               0x0b
 266 #define IO_TYPE_ERROR_MESSAGE           0x0c
 267 #define IO_TYPE_DEVICE_OBJECT_EXTENSION 0x0d
 268
 269 typedef struct _DEVICE_OBJECT {
 270   CSHORT  Type;
 271   USHORT  Size;
 272   LONG  ReferenceCount;
 273   struct _DRIVER_OBJECT  *DriverObject;
 274   struct _DEVICE_OBJECT  *NextDevice;
 275   struct _DEVICE_OBJECT  *AttachedDevice;
 276   struct _IRP  *CurrentIrp;
 277   PIO_TIMER  Timer;
 278   ULONG  Flags;
 279   ULONG  Characteristics;
 280   PVPB  Vpb;
 281   PVOID  DeviceExtension;
 282   DEVICE_TYPE  DeviceType;
 283   CCHAR  StackSize;
 284   union {
 285     LIST_ENTRY  ListEntry;
 286     WAIT_CONTEXT_BLOCK  Wcb;
 287   } Queue;
 288   ULONG  AlignmentRequirement;
 289   KDEVICE_QUEUE  DeviceQueue;
 290   KDPC  Dpc;
 291   ULONG  ActiveThreadCount;
 292   PSECURITY_DESCRIPTOR  SecurityDescriptor;
 293   KEVENT  DeviceLock;
 294   USHORT  SectorSize;
 295   USHORT  Spare1;
 296   struct _DEVOBJ_EXTENSION  *DeviceObjectExtension;
 297   PVOID  Reserved;
 298 } DEVICE_OBJECT;
 299 typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT;
 300
 301 typedef struct _DRIVER_EXTENSION {
 302   struct _DRIVER_OBJECT  *DriverObject;
 303   PVOID  AddDevice;
 304   ULONG  Count;
 305   UNICODE_STRING  ServiceKeyName;
 306 } DRIVER_EXTENSION, *PDRIVER_EXTENSION;
 307
 308 typedef struct _DRIVER_OBJECT {
 309   CSHORT  Type;
 310   CSHORT  Size;
 311   PDEVICE_OBJECT  DeviceObject;
 312   ULONG  Flags;
 313   PVOID  DriverStart;
 314   ULONG  DriverSize;
 315   PVOID  DriverSection;
 316   PDRIVER_EXTENSION  DriverExtension;
 317   UNICODE_STRING  DriverName;
 318   PUNICODE_STRING  HardwareDatabase;
 319   PVOID  FastIoDispatch;
 320   PDRIVER_INITIALIZE DriverInit;
 321   PDRIVER_STARTIO    DriverStartIo;
 322   PDRIVER_UNLOAD     DriverUnload;
 323   PDRIVER_DISPATCH   MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];
 324 } DRIVER_OBJECT;
 325 typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT;
 326
 327 /* Irp definitions */
 328 typedef UCHAR KIRQL, *PKIRQL;
 329 typedef CCHAR KPROCESSOR_MODE;
 330
 331 typedef VOID (WINAPI *PDRIVER_CANCEL)(
 332   IN struct _DEVICE_OBJECT  *DeviceObject,
 333   IN struct _IRP  *Irp);
 334
 335 typedef VOID (WINAPI *PKNORMAL_ROUTINE)(
 336   IN PVOID  NormalContext,
 337   IN PVOID  SystemArgument1,
 338   IN PVOID  SystemArgument2);
 339
 340 typedef VOID (WINAPI *PKKERNEL_ROUTINE)(
 341   IN struct _KAPC  *Apc,
 342   IN OUT PKNORMAL_ROUTINE  *NormalRoutine,
 343   IN OUT PVOID  *NormalContext,
 344   IN OUT PVOID  *SystemArgument1,
 345   IN OUT PVOID  *SystemArgument2);
 346
 347 typedef VOID (WINAPI *PKRUNDOWN_ROUTINE)(
 348   IN struct _KAPC  *Apc);
 349
 350 typedef struct _KAPC {
 351   CSHORT  Type;
 352   CSHORT  Size;
 353   ULONG  Spare0;
 354   struct _KTHREAD  *Thread;
 355   LIST_ENTRY  ApcListEntry;
 356   PKKERNEL_ROUTINE  KernelRoutine;
 357   PKRUNDOWN_ROUTINE  RundownRoutine;
 358   PKNORMAL_ROUTINE  NormalRoutine;
 359   PVOID  NormalContext;
 360   PVOID  SystemArgument1;
 361   PVOID  SystemArgument2;
 362   CCHAR  ApcStateIndex;
 363   KPROCESSOR_MODE  ApcMode;
 364   BOOLEAN  Inserted;
 365 } KAPC, *PKAPC, *RESTRICTED_POINTER PRKAPC;
 366
 367 #include <pshpack1.h>
 368 typedef struct _IRP {
 369   CSHORT  Type;
 370   USHORT  Size;
 371   struct _MDL  *MdlAddress;
 372   ULONG  Flags;
 373   union {
 374     struct _IRP  *MasterIrp;
 375     LONG  IrpCount;
 376     PVOID  SystemBuffer;
 377   } AssociatedIrp;
 378   LIST_ENTRY  ThreadListEntry;
 379   IO_STATUS_BLOCK  IoStatus;
 380   KPROCESSOR_MODE  RequestorMode;
 381   BOOLEAN  PendingReturned;
 382   CHAR  StackCount;
 383   CHAR  CurrentLocation;
 384   BOOLEAN  Cancel;
 385   KIRQL  CancelIrql;
 386   CCHAR  ApcEnvironment;
 387   UCHAR  AllocationFlags;
 388   PIO_STATUS_BLOCK  UserIosb;
 389   PKEVENT  UserEvent;
 390   union {
 391     struct {
 392       PIO_APC_ROUTINE  UserApcRoutine;
 393       PVOID  UserApcContext;
 394     } AsynchronousParameters;
 395     LARGE_INTEGER  AllocationSize;
 396   } Overlay;
 397   PDRIVER_CANCEL  CancelRoutine;
 398   PVOID  UserBuffer;
 399   union {
 400     struct {
 401        union {
 402         KDEVICE_QUEUE_ENTRY  DeviceQueueEntry;
 403         struct {
 404           PVOID  DriverContext[4];
 405         } DUMMYSTRUCTNAME;
 406       } DUMMYUNIONNAME;
 407       PETHREAD  Thread;
 408       PCHAR  AuxiliaryBuffer;
 409       struct {
 410         LIST_ENTRY  ListEntry;
 411         union {
 412           struct _IO_STACK_LOCATION  *CurrentStackLocation;
 413           ULONG  PacketType;
 414         } DUMMYUNIONNAME;
 415       } DUMMYSTRUCTNAME;
 416       struct _FILE_OBJECT  *OriginalFileObject;
 417     } Overlay;
 418     KAPC  Apc;
 419     PVOID  CompletionKey;
 420   } Tail;
 421 } IRP;
 422 typedef struct _IRP *PIRP;
 423 #include <poppack.h>
 424
 425 /* MDL definitions */
 426
 427 typedef VOID (WINAPI *PINTERFACE_REFERENCE)(
 428   PVOID  Context);
 429
 430 typedef VOID (WINAPI *PINTERFACE_DEREFERENCE)(
 431   PVOID Context);
 432
 433 typedef struct _INTERFACE {
 434   USHORT  Size;
 435   USHORT  Version;
 436   PVOID  Context;
 437   PINTERFACE_REFERENCE  InterfaceReference;
 438   PINTERFACE_DEREFERENCE  InterfaceDereference;
 439 } INTERFACE, *PINTERFACE;
 440
 441 typedef struct _SECTION_OBJECT_POINTERS {
 442   PVOID  DataSectionObject;
 443   PVOID  SharedCacheMap;
 444   PVOID  ImageSectionObject;
 445 } SECTION_OBJECT_POINTERS, *PSECTION_OBJECT_POINTERS;
 446
 447 typedef struct _IO_COMPLETION_CONTEXT {
 448   PVOID  Port;
 449   PVOID  Key;
 450 } IO_COMPLETION_CONTEXT, *PIO_COMPLETION_CONTEXT;
 451
 452 typedef enum _DEVICE_RELATION_TYPE {
 453   BusRelations,
 454   EjectionRelations,
 455   PowerRelations,
 456   RemovalRelations,
 457   TargetDeviceRelation,
 458   SingleBusRelations
 459 } DEVICE_RELATION_TYPE, *PDEVICE_RELATION_TYPE;
 460
 461 typedef struct _FILE_OBJECT {
 462   CSHORT  Type;
 463   CSHORT  Size;
 464   PDEVICE_OBJECT  DeviceObject;
 465   PVPB  Vpb;
 466   PVOID  FsContext;
 467   PVOID  FsContext2;
 468   PSECTION_OBJECT_POINTERS  SectionObjectPointer;
 469   PVOID  PrivateCacheMap;
 470   NTSTATUS  FinalStatus;
 471   struct _FILE_OBJECT  *RelatedFileObject;
 472   BOOLEAN  LockOperation;
 473   BOOLEAN  DeletePending;
 474   BOOLEAN  ReadAccess;
 475   BOOLEAN  WriteAccess;
 476   BOOLEAN  DeleteAccess;
 477   BOOLEAN  SharedRead;
 478   BOOLEAN  SharedWrite;
 479   BOOLEAN  SharedDelete;
 480   ULONG  Flags;
 481   UNICODE_STRING  FileName;
 482   LARGE_INTEGER  CurrentByteOffset;
 483   ULONG  Waiters;
 484   ULONG  Busy;
 485   PVOID  LastLock;
 486   KEVENT  Lock;
 487   KEVENT  Event;
 488   PIO_COMPLETION_CONTEXT  CompletionContext;
 489 } FILE_OBJECT;
 490 typedef struct _FILE_OBJECT *PFILE_OBJECT;
 491
 492 #define INITIAL_PRIVILEGE_COUNT           3
 493
 494 typedef struct _INITIAL_PRIVILEGE_SET {
 495   ULONG  PrivilegeCount;
 496   ULONG  Control;
 497   LUID_AND_ATTRIBUTES  Privilege[INITIAL_PRIVILEGE_COUNT];
 498 } INITIAL_PRIVILEGE_SET, * PINITIAL_PRIVILEGE_SET;
 499
 500 typedef struct _SECURITY_SUBJECT_CONTEXT {
 501   PACCESS_TOKEN  ClientToken;
 502   SECURITY_IMPERSONATION_LEVEL  ImpersonationLevel;
 503   PACCESS_TOKEN  PrimaryToken;
 504   PVOID  ProcessAuditId;
 505 } SECURITY_SUBJECT_CONTEXT, *PSECURITY_SUBJECT_CONTEXT;
 506
 507 typedef struct _ACCESS_STATE {
 508   LUID  OperationID;
 509   BOOLEAN  SecurityEvaluated;
 510   BOOLEAN  GenerateAudit;
 511   BOOLEAN  GenerateOnClose;
 512   BOOLEAN  PrivilegesAllocated;
 513   ULONG  Flags;
 514   ACCESS_MASK  RemainingDesiredAccess;
 515   ACCESS_MASK  PreviouslyGrantedAccess;
 516   ACCESS_MASK  OriginalDesiredAccess;
 517   SECURITY_SUBJECT_CONTEXT  SubjectSecurityContext;
 518   PSECURITY_DESCRIPTOR  SecurityDescriptor;
 519   PVOID  AuxData;
 520   union {
 521     INITIAL_PRIVILEGE_SET  InitialPrivilegeSet;
 522     PRIVILEGE_SET  PrivilegeSet;
 523   } Privileges;
 524
 525   BOOLEAN  AuditPrivileges;
 526   UNICODE_STRING  ObjectName;
 527   UNICODE_STRING  ObjectTypeName;
 528 } ACCESS_STATE, *PACCESS_STATE;
 529
 530 typedef struct _IO_SECURITY_CONTEXT {
 531   PSECURITY_QUALITY_OF_SERVICE  SecurityQos;
 532   PACCESS_STATE  AccessState;
 533   ACCESS_MASK  DesiredAccess;
 534   ULONG  FullCreateOptions;
 535 } IO_SECURITY_CONTEXT, *PIO_SECURITY_CONTEXT;
 536
 537 typedef struct _DEVICE_CAPABILITIES {
 538   USHORT  Size;
 539   USHORT  Version;
 540   ULONG  DeviceD1 : 1;
 541   ULONG  DeviceD2 : 1;
 542   ULONG  LockSupported : 1;
 543   ULONG  EjectSupported : 1;
 544   ULONG  Removable : 1;
 545   ULONG  DockDevice : 1;
 546   ULONG  UniqueID : 1;
 547   ULONG  SilentInstall : 1;
 548   ULONG  RawDeviceOK : 1;
 549   ULONG  SurpriseRemovalOK : 1;
 550   ULONG  WakeFromD0 : 1;
 551   ULONG  WakeFromD1 : 1;
 552   ULONG  WakeFromD2 : 1;
 553   ULONG  WakeFromD3 : 1;
 554   ULONG  HardwareDisabled : 1;
 555   ULONG  NonDynamic : 1;
 556   ULONG  WarmEjectSupported : 1;
 557   ULONG  NoDisplayInUI : 1;
 558   ULONG  Reserved : 14;
 559   ULONG  Address;
 560   ULONG  UINumber;
 561   DEVICE_POWER_STATE  DeviceState[PowerSystemMaximum];
 562   SYSTEM_POWER_STATE  SystemWake;
 563   DEVICE_POWER_STATE  DeviceWake;
 564   ULONG  D1Latency;
 565   ULONG  D2Latency;
 566   ULONG  D3Latency;
 567 } DEVICE_CAPABILITIES, *PDEVICE_CAPABILITIES;
 568
 569 typedef enum _INTERFACE_TYPE {
 570   InterfaceTypeUndefined = -1,
 571   Internal,
 572   Isa,
 573   Eisa,
 574   MicroChannel,
 575   TurboChannel,
 576   PCIBus,
 577   VMEBus,
 578   NuBus,
 579   PCMCIABus,
 580   CBus,
 581   MPIBus,
 582   MPSABus,
 583   ProcessorInternal,
 584   InternalPowerBus,
 585   PNPISABus,
 586   PNPBus,
 587   MaximumInterfaceType
 588 } INTERFACE_TYPE, *PINTERFACE_TYPE;
 589
 590 typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS;
 591
 592 #define IO_RESOURCE_PREFERRED             0x01
 593 #define IO_RESOURCE_DEFAULT               0x02
 594 #define IO_RESOURCE_ALTERNATIVE           0x08
 595
 596 typedef struct _IO_RESOURCE_DESCRIPTOR {
 597   UCHAR  Option;
 598   UCHAR  Type;
 599   UCHAR  ShareDisposition;
 600   UCHAR  Spare1;
 601   USHORT  Flags;
 602   USHORT  Spare2;
 603   union {
 604     struct {
 605       ULONG  Length;
 606       ULONG  Alignment;
 607       PHYSICAL_ADDRESS  MinimumAddress;
 608       PHYSICAL_ADDRESS  MaximumAddress;
 609     } Port;
 610     struct {
 611       ULONG  Length;
 612       ULONG  Alignment;
 613       PHYSICAL_ADDRESS  MinimumAddress;
 614       PHYSICAL_ADDRESS  MaximumAddress;
 615     } Memory;
 616     struct {
 617       ULONG  MinimumVector;
 618       ULONG  MaximumVector;
 619     } Interrupt;
 620     struct {
 621       ULONG  MinimumChannel;
 622       ULONG  MaximumChannel;
 623     } Dma;
 624     struct {
 625       ULONG  Length;
 626       ULONG  Alignment;
 627       PHYSICAL_ADDRESS  MinimumAddress;
 628       PHYSICAL_ADDRESS  MaximumAddress;
 629     } Generic;
 630     struct {
 631       ULONG  Data[3];
 632     } DevicePrivate;
 633     struct {
 634       ULONG  Length;
 635       ULONG  MinBusNumber;
 636       ULONG  MaxBusNumber;
 637       ULONG  Reserved;
 638     } BusNumber;
 639     struct {
 640       ULONG  Priority;
 641       ULONG  Reserved1;
 642       ULONG  Reserved2;
 643     } ConfigData;
 644   } u;
 645 } IO_RESOURCE_DESCRIPTOR, *PIO_RESOURCE_DESCRIPTOR;
 646
 647 typedef struct _IO_RESOURCE_LIST {
 648   USHORT  Version;
 649   USHORT  Revision;
 650   ULONG  Count;
 651   IO_RESOURCE_DESCRIPTOR  Descriptors[1];
 652 } IO_RESOURCE_LIST, *PIO_RESOURCE_LIST;
 653
 654 typedef struct _IO_RESOURCE_REQUIREMENTS_LIST {
 655   ULONG  ListSize;
 656   INTERFACE_TYPE  InterfaceType;
 657   ULONG  BusNumber;
 658   ULONG  SlotNumber;
 659   ULONG  Reserved[3];
 660   ULONG  AlternativeLists;
 661   IO_RESOURCE_LIST  List[1];
 662 } IO_RESOURCE_REQUIREMENTS_LIST, *PIO_RESOURCE_REQUIREMENTS_LIST;
 663
 664 typedef enum _BUS_QUERY_ID_TYPE {
 665   BusQueryDeviceID,
 666   BusQueryHardwareIDs,
 667   BusQueryCompatibleIDs,
 668   BusQueryInstanceID,
 669   BusQueryDeviceSerialNumber
 670 } BUS_QUERY_ID_TYPE, *PBUS_QUERY_ID_TYPE;
 671
 672 typedef enum _DEVICE_TEXT_TYPE {
 673   DeviceTextDescription,
 674   DeviceTextLocationInformation
 675 } DEVICE_TEXT_TYPE, *PDEVICE_TEXT_TYPE;
 676
 677 typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE {
 678   DeviceUsageTypeUndefined,
 679   DeviceUsageTypePaging,
 680   DeviceUsageTypeHibernation,
 681   DeviceUsageTypeDumpFile
 682 } DEVICE_USAGE_NOTIFICATION_TYPE;
 683
 684 typedef struct _POWER_SEQUENCE {
 685   ULONG  SequenceD1;
 686   ULONG  SequenceD2;
 687   ULONG  SequenceD3;
 688 } POWER_SEQUENCE, *PPOWER_SEQUENCE;
 689
 690 typedef enum _POWER_STATE_TYPE {
 691   SystemPowerState,
 692   DevicePowerState
 693 } POWER_STATE_TYPE, *PPOWER_STATE_TYPE;
 694
 695 typedef union _POWER_STATE {
 696   SYSTEM_POWER_STATE  SystemState;
 697   DEVICE_POWER_STATE  DeviceState;
 698 } POWER_STATE, *PPOWER_STATE;
 699
 700 typedef struct _CM_PARTIAL_RESOURCE_DESCRIPTOR {
 701   UCHAR Type;
 702   UCHAR ShareDisposition;
 703   USHORT Flags;
 704   union {
 705     struct {
 706       PHYSICAL_ADDRESS Start;
 707       ULONG Length;
 708     } Generic;
 709     struct {
 710       PHYSICAL_ADDRESS Start;
 711       ULONG Length;
 712     } Port;
 713     struct {
 714       ULONG Level;
 715       ULONG Vector;
 716       ULONG Affinity;
 717     } Interrupt;
 718     struct {
 719       PHYSICAL_ADDRESS Start;
 720       ULONG Length;
 721     } Memory;
 722     struct {
 723       ULONG Channel;
 724       ULONG Port;
 725       ULONG Reserved1;
 726     } Dma;
 727     struct {
 728       ULONG Data[3];
 729     } DevicePrivate;
 730     struct {
 731       ULONG Start;
 732       ULONG Length;
 733       ULONG Reserved;
 734     } BusNumber;
 735     struct {
 736       ULONG DataSize;
 737       ULONG Reserved1;
 738       ULONG Reserved2;
 739     } DeviceSpecificData;
 740   } u;
 741 } CM_PARTIAL_RESOURCE_DESCRIPTOR, *PCM_PARTIAL_RESOURCE_DESCRIPTOR;
 742
 743 typedef struct _CM_PARTIAL_RESOURCE_LIST {
 744   USHORT  Version;
 745   USHORT  Revision;
 746   ULONG  Count;
 747   CM_PARTIAL_RESOURCE_DESCRIPTOR PartialDescriptors[1];
 748 } CM_PARTIAL_RESOURCE_LIST, *PCM_PARTIAL_RESOURCE_LIST;
 749
 750 typedef struct _CM_FULL_RESOURCE_DESCRIPTOR {
 751   INTERFACE_TYPE  InterfaceType;
 752   ULONG  BusNumber;
 753   CM_PARTIAL_RESOURCE_LIST  PartialResourceList;
 754 } CM_FULL_RESOURCE_DESCRIPTOR, *PCM_FULL_RESOURCE_DESCRIPTOR;
 755
 756 typedef struct _CM_RESOURCE_LIST {
 757   ULONG  Count;
 758   CM_FULL_RESOURCE_DESCRIPTOR  List[1];
 759 } CM_RESOURCE_LIST, *PCM_RESOURCE_LIST;
 760
 761 typedef NTSTATUS (WINAPI *PIO_COMPLETION_ROUTINE)(
 762   IN struct _DEVICE_OBJECT  *DeviceObject,
 763   IN struct _IRP  *Irp,
 764   IN PVOID  Context);
 765
 766 #define SL_PENDING_RETURNED             0x01
 767 #define SL_INVOKE_ON_CANCEL             0x20
 768 #define SL_INVOKE_ON_SUCCESS            0x40
 769 #define SL_INVOKE_ON_ERROR              0x80
 770
 771 #include <pshpack1.h>
 772 typedef struct _IO_STACK_LOCATION {
 773   UCHAR  MajorFunction;
 774   UCHAR  MinorFunction;
 775   UCHAR  Flags;
 776   UCHAR  Control;
 777   union {
 778     struct {
 779       PIO_SECURITY_CONTEXT  SecurityContext;
 780       ULONG  Options;
 781       USHORT POINTER_ALIGNMENT  FileAttributes;
 782       USHORT  ShareAccess;
 783       ULONG POINTER_ALIGNMENT  EaLength;
 784     } Create;
 785     struct {
 786       ULONG  Length;
 787       ULONG POINTER_ALIGNMENT  Key;
 788       LARGE_INTEGER  ByteOffset;
 789     } Read;
 790     struct {
 791       ULONG  Length;
 792       ULONG POINTER_ALIGNMENT  Key;
 793       LARGE_INTEGER  ByteOffset;
 794     } Write;
 795     struct {
 796       ULONG  Length;
 797       FILE_INFORMATION_CLASS POINTER_ALIGNMENT  FileInformationClass;
 798     } QueryFile;
 799     struct {
 800       ULONG  Length;
 801       FILE_INFORMATION_CLASS POINTER_ALIGNMENT  FileInformationClass;
 802       PFILE_OBJECT  FileObject;
 803       union {
 804         struct {
 805           BOOLEAN  ReplaceIfExists;
 806           BOOLEAN  AdvanceOnly;
 807         } DUMMYSTRUCTNAME;
 808         ULONG  ClusterCount;
 809         HANDLE  DeleteHandle;
 810       } DUMMYUNIONNAME;
 811     } SetFile;
 812     struct {
 813       ULONG  Length;
 814       FS_INFORMATION_CLASS POINTER_ALIGNMENT  FsInformationClass;
 815     } QueryVolume;
 816     struct {
 817       ULONG  OutputBufferLength;
 818       ULONG POINTER_ALIGNMENT  InputBufferLength;
 819       ULONG POINTER_ALIGNMENT  IoControlCode;
 820       PVOID  Type3InputBuffer;
 821     } DeviceIoControl;
 822     struct {
 823       SECURITY_INFORMATION  SecurityInformation;
 824       ULONG POINTER_ALIGNMENT  Length;
 825     } QuerySecurity;
 826     struct {
 827       SECURITY_INFORMATION  SecurityInformation;
 828       PSECURITY_DESCRIPTOR  SecurityDescriptor;
 829     } SetSecurity;
 830     struct {
 831       PVPB  Vpb;
 832       PDEVICE_OBJECT  DeviceObject;
 833     } MountVolume;
 834     struct {
 835       PVPB  Vpb;
 836       PDEVICE_OBJECT  DeviceObject;
 837     } VerifyVolume;
 838     struct {
 839       struct _SCSI_REQUEST_BLOCK  *Srb;
 840     } Scsi;
 841     struct {
 842       DEVICE_RELATION_TYPE  Type;
 843     } QueryDeviceRelations;
 844     struct {
 845       CONST GUID  *InterfaceType;
 846       USHORT  Size;
 847       USHORT  Version;
 848       PINTERFACE  Interface;
 849       PVOID  InterfaceSpecificData;
 850     } QueryInterface;
 851     struct {
 852       PDEVICE_CAPABILITIES  Capabilities;
 853     } DeviceCapabilities;
 854     struct {
 855       PIO_RESOURCE_REQUIREMENTS_LIST  IoResourceRequirementList;
 856     } FilterResourceRequirements;
 857     struct {
 858       ULONG  WhichSpace;
 859       PVOID  Buffer;
 860       ULONG  Offset;
 861       ULONG POINTER_ALIGNMENT  Length;
 862     } ReadWriteConfig;
 863     struct {
 864       BOOLEAN  Lock;
 865     } SetLock;
 866     struct {
 867       BUS_QUERY_ID_TYPE  IdType;
 868     } QueryId;
 869     struct {
 870       DEVICE_TEXT_TYPE  DeviceTextType;
 871       LCID POINTER_ALIGNMENT  LocaleId;
 872     } QueryDeviceText;
 873     struct {
 874       BOOLEAN  InPath;
 875       BOOLEAN  Reserved[3];
 876       DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT  Type;
 877     } UsageNotification;
 878     struct {
 879       SYSTEM_POWER_STATE  PowerState;
 880     } WaitWake;
 881     struct {
 882       PPOWER_SEQUENCE  PowerSequence;
 883     } PowerSequence;
 884     struct {
 885       ULONG  SystemContext;
 886       POWER_STATE_TYPE POINTER_ALIGNMENT  Type;
 887       POWER_STATE POINTER_ALIGNMENT  State;
 888       POWER_ACTION POINTER_ALIGNMENT  ShutdownType;
 889     } Power;
 890     struct {
 891       PCM_RESOURCE_LIST  AllocatedResources;
 892       PCM_RESOURCE_LIST  AllocatedResourcesTranslated;
 893     } StartDevice;
 894     struct {
 895       ULONG_PTR  ProviderId;
 896       PVOID  DataPath;
 897       ULONG  BufferSize;
 898       PVOID  Buffer;
 899     } WMI;
 900     struct {
 901       PVOID  Argument1;
 902       PVOID  Argument2;
 903       PVOID  Argument3;
 904       PVOID  Argument4;
 905     } Others;
 906   } Parameters;
 907   PDEVICE_OBJECT  DeviceObject;
 908   PFILE_OBJECT  FileObject;
 909   PIO_COMPLETION_ROUTINE  CompletionRoutine;
 910   PVOID  Context;
 911 } IO_STACK_LOCATION, *PIO_STACK_LOCATION;
 912 #include <poppack.h>
 913
 914 typedef struct _MDL {
 915   struct _MDL  *Next;
 916   CSHORT  Size;
 917   CSHORT  MdlFlags;
 918   struct _EPROCESS  *Process;
 919   PVOID  MappedSystemVa;
 920   PVOID  StartVa;
 921   ULONG  ByteCount;
 922   ULONG  ByteOffset;
 923 } MDL, *PMDL;
 924
 925 typedef struct _KTIMER {
 926     DISPATCHER_HEADER Header;
 927     ULARGE_INTEGER DueTime;
 928     LIST_ENTRY TimerListEntry;
 929     struct _KDPC *Dpc;
 930     LONG Period;
 931 } KTIMER, *PKTIMER;
 932
 933 typedef struct _KSYSTEM_TIME {
 934     ULONG LowPart;
 935     LONG High1Time;
 936     LONG High2Time;
 937 } KSYSTEM_TIME, *PKSYSTEM_TIME;
 938
 939 typedef enum _NT_PRODUCT_TYPE {
 940     NtProductWinNt = 1,
 941     NtProductLanManNt,
 942     NtProductServer
 943 } NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;
 944
 945 #define PROCESSOR_FEATURE_MAX 64
 946
 947 typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
 948 {
 949    StandardDesign,
 950    NEC98x86,
 951    EndAlternatives
 952 } ALTERNATIVE_ARCHITECTURE_TYPE;
 953
 954 typedef struct _KUSER_SHARED_DATA {
 955     ULONG TickCountLowDeprecated;
 956     ULONG TickCountMultiplier;
 957     volatile KSYSTEM_TIME InterruptTime;
 958     volatile KSYSTEM_TIME SystemTime;
 959     volatile KSYSTEM_TIME TimeZoneBias;
 960     USHORT ImageNumberLow;
 961     USHORT ImageNumberHigh;
 962     WCHAR NtSystemRoot[260];
 963     ULONG MaxStckTraceDepth;
 964     ULONG CryptoExponent;
 965     ULONG TimeZoneId;
 966     ULONG LargePageMinimum;
 967     ULONG Reserverd2[7];
 968     NT_PRODUCT_TYPE NtProductType;
 969     BOOLEAN ProductTypeIsValid;
 970     ULONG MajorNtVersion;
 971     ULONG MinorNtVersion;
 972     BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];
 973     ULONG Reserved1;
 974     ULONG Reserved3;
 975     volatile ULONG TimeSlip;
 976     ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
 977     LARGE_INTEGER SystemExpirationDate;
 978     ULONG SuiteMask;
 979     BOOLEAN KdDebuggerEnabled;
 980     volatile ULONG ActiveConsoleId;
 981     volatile ULONG DismountCount;
 982     ULONG ComPlusPackage;
 983     ULONG LastSystemRITEventTickCount;
 984     ULONG NumberOfPhysicalPages;
 985     BOOLEAN SafeBootMode;
 986     ULONG TraceLogging;
 987     ULONGLONG Fill0;
 988     ULONGLONG SystemCall[4];
 989     union {
 990         volatile KSYSTEM_TIME TickCount;
 991         volatile ULONG64 TickCountQuad;
 992     } DUMMYUNIONNAME;
 993 } KSHARED_USER_DATA, *PKSHARED_USER_DATA;
 994
 995 NTSTATUS WINAPI ObCloseHandle(IN HANDLE handle);
 996
 997 #define IoGetCurrentIrpStackLocation(_Irp) ((_Irp)->Tail.Overlay.CurrentStackLocation)
 998
 999 #define KernelMode 0
1000 #define UserMode   1
1001
1002 /* directory object access rights */
1003 #define DIRECTORY_QUERY                 0x0001
1004 #define DIRECTORY_TRAVERSE              0x0002
1005 #define DIRECTORY_CREATE_OBJECT         0x0004
1006 #define DIRECTORY_CREATE_SUBDIRECTORY   0x0008
1007 #define DIRECTORY_ALL_ACCESS            (STANDARD_RIGHTS_REQUIRED | 0xF)
1008
1009 /* symbolic link access rights */
1010 #define SYMBOLIC_LINK_QUERY             0x0001
1011 #define SYMBOLIC_LINK_ALL_ACCESS        (STANDARD_RIGHTS_REQUIRED | 0x1)
1012
1013 PVOID     WINAPI ExAllocatePool(POOL_TYPE,SIZE_T);
1014 PVOID     WINAPI ExAllocatePoolWithQuota(POOL_TYPE,SIZE_T);
1015 PVOID     WINAPI ExAllocatePoolWithTag(POOL_TYPE,SIZE_T,ULONG);
1016 PVOID     WINAPI ExAllocatePoolWithQuotaTag(POOL_TYPE,SIZE_T,ULONG);
1017 void      WINAPI ExFreePool(PVOID);
1018 void      WINAPI ExFreePoolWithTag(PVOID,ULONG);
1019
1020 PIRP      WINAPI IoAllocateIrp(CCHAR,BOOLEAN);
1021 NTSTATUS  WINAPI IoCreateDevice(DRIVER_OBJECT*,ULONG,UNICODE_STRING*,DEVICE_TYPE,ULONG,BOOLEAN,DEVICE_OBJECT**);
1022 NTSTATUS  WINAPI IoCreateDriver(UNICODE_STRING*,PDRIVER_INITIALIZE);
1023 NTSTATUS  WINAPI IoCreateSymbolicLink(UNICODE_STRING*,UNICODE_STRING*);
1024 void      WINAPI IoDeleteDevice(DEVICE_OBJECT*);
1025 void      WINAPI IoDeleteDriver(DRIVER_OBJECT*);
1026 NTSTATUS  WINAPI IoDeleteSymbolicLink(UNICODE_STRING*);
1027 void      WINAPI IoFreeIrp(IRP*);
1028 PEPROCESS WINAPI IoGetCurrentProcess(void);
1029 NTSTATUS  WINAPI IoGetDeviceObjectPointer(UNICODE_STRING*,ACCESS_MASK,PFILE_OBJECT*,PDEVICE_OBJECT*);
1030 PDEVICE_OBJECT WINAPI IoGetRelatedDeviceObject(PFILE_OBJECT);
1031 void      WINAPI IoInitializeIrp(IRP*,USHORT,CCHAR);
1032
1033 PKTHREAD  WINAPI KeGetCurrentThread(void);
1034 void      WINAPI KeQuerySystemTime(LARGE_INTEGER*);
1035 void      WINAPI KeQueryTickCount(LARGE_INTEGER*);
1036 ULONG     WINAPI KeQueryTimeIncrement(void);
1037
1038 PVOID     WINAPI MmAllocateNonCachedMemory(SIZE_T);
1039 void      WINAPI MmFreeNonCachedMemory(PVOID,SIZE_T);
1040
1041 NTSTATUS  WINAPI ObReferenceObjectByHandle(HANDLE,ACCESS_MASK,POBJECT_TYPE,KPROCESSOR_MODE,PVOID*,POBJECT_HANDLE_INFORMATION);
1042
1043 NTSTATUS  WINAPI PsCreateSystemThread(PHANDLE,ULONG,POBJECT_ATTRIBUTES,HANDLE,PCLIENT_ID,PKSTART_ROUTINE,PVOID);
1044 #define          PsGetCurrentProcess() IoGetCurrentProcess()
1045 #define          PsGetCurrentThread() ((PETHREAD)KeGetCurrentThread())
1046 HANDLE    WINAPI PsGetCurrentProcessId(void);
1047 HANDLE    WINAPI PsGetCurrentThreadId(void);
1048 BOOLEAN   WINAPI PsGetVersion(ULONG*,ULONG*,ULONG*,UNICODE_STRING*);
1049 NTSTATUS  WINAPI PsTerminateSystemThread(NTSTATUS);
1050
1051 NTSTATUS  WINAPI ZwAddBootEntry(PUNICODE_STRING,PUNICODE_STRING);
1052 NTSTATUS  WINAPI ZwAccessCheckAndAuditAlarm(PUNICODE_STRING,HANDLE,PUNICODE_STRING,PUNICODE_STRING,PSECURITY_DESCRIPTOR,ACCESS_MASK,PGENERIC_MAPPING,BOOLEAN,PACCESS_MASK,PBOOLEAN,PBOOLEAN);
1053 NTSTATUS  WINAPI ZwAdjustPrivilegesToken(HANDLE,BOOLEAN,PTOKEN_PRIVILEGES,DWORD,PTOKEN_PRIVILEGES,PDWORD);
1054 NTSTATUS  WINAPI ZwAlertThread(HANDLE ThreadHandle);
1055 NTSTATUS  WINAPI ZwAllocateVirtualMemory(HANDLE,PVOID*,ULONG,SIZE_T*,ULONG,ULONG);
1056 NTSTATUS  WINAPI ZwCancelIoFile(HANDLE,PIO_STATUS_BLOCK);
1057 NTSTATUS  WINAPI ZwCancelTimer(HANDLE, BOOLEAN*);
1058 NTSTATUS  WINAPI ZwClearEvent(HANDLE);
1059 NTSTATUS  WINAPI ZwClose(HANDLE);
1060 NTSTATUS  WINAPI ZwCloseObjectAuditAlarm(PUNICODE_STRING,HANDLE,BOOLEAN);
1061 NTSTATUS  WINAPI ZwConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
1062 NTSTATUS  WINAPI ZwCreateDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
1063 NTSTATUS  WINAPI ZwCreateEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *,BOOLEAN,BOOLEAN);
1064 NTSTATUS  WINAPI ZwCreateFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,PLARGE_INTEGER,ULONG,ULONG,ULONG,ULONG,PVOID,ULONG);
1065 NTSTATUS  WINAPI ZwCreateKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,ULONG,const UNICODE_STRING*,ULONG,PULONG);
1066 NTSTATUS  WINAPI ZwCreateSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const LARGE_INTEGER*,ULONG,ULONG,HANDLE);
1067 NTSTATUS  WINAPI ZwCreateSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PUNICODE_STRING);
1068 NTSTATUS  WINAPI ZwCreateTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*, TIMER_TYPE);
1069 NTSTATUS  WINAPI ZwDeleteAtom(RTL_ATOM);
1070 NTSTATUS  WINAPI ZwDeleteFile(POBJECT_ATTRIBUTES);
1071 NTSTATUS  WINAPI ZwDeleteKey(HANDLE);
1072 NTSTATUS  WINAPI ZwDeleteValueKey(HANDLE,const UNICODE_STRING *);
1073 NTSTATUS  WINAPI ZwDeviceIoControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
1074 NTSTATUS  WINAPI ZwDisplayString(PUNICODE_STRING);
1075 NTSTATUS  WINAPI ZwDuplicateObject(HANDLE,HANDLE,HANDLE,PHANDLE,ACCESS_MASK,ULONG,ULONG);
1076 NTSTATUS  WINAPI ZwDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
1077 NTSTATUS  WINAPI ZwEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
1078 NTSTATUS  WINAPI ZwEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
1079 NTSTATUS  WINAPI ZwFlushInstructionCache(HANDLE,LPCVOID,SIZE_T);
1080 NTSTATUS  WINAPI ZwFlushKey(HANDLE);
1081 NTSTATUS  WINAPI ZwFlushVirtualMemory(HANDLE,LPCVOID*,SIZE_T*,ULONG);
1082 NTSTATUS  WINAPI ZwFreeVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
1083 NTSTATUS  WINAPI ZwFsControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,PVOID,ULONG,PVOID,ULONG);
1084 NTSTATUS  WINAPI ZwInitiatePowerAction(POWER_ACTION,SYSTEM_POWER_STATE,ULONG,BOOLEAN);
1085 NTSTATUS  WINAPI ZwLoadDriver(const UNICODE_STRING *);
1086 NTSTATUS  WINAPI ZwLoadKey(const OBJECT_ATTRIBUTES *,OBJECT_ATTRIBUTES *);
1087 NTSTATUS  WINAPI ZwLockVirtualMemory(HANDLE,PVOID*,SIZE_T*,ULONG);
1088 NTSTATUS  WINAPI ZwMakeTemporaryObject(HANDLE);
1089 NTSTATUS  WINAPI ZwMapViewOfSection(HANDLE,HANDLE,PVOID*,ULONG,SIZE_T,const LARGE_INTEGER*,SIZE_T*,SECTION_INHERIT,ULONG,ULONG);
1090 NTSTATUS  WINAPI ZwNotifyChangeKey(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,ULONG,BOOLEAN,PVOID,ULONG,BOOLEAN);
1091 NTSTATUS  WINAPI ZwOpenDirectoryObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
1092 NTSTATUS  WINAPI ZwOpenEvent(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
1093 NTSTATUS  WINAPI ZwOpenFile(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG);
1094 NTSTATUS  WINAPI ZwOpenKey(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES *);
1095 NTSTATUS  WINAPI ZwOpenProcess(PHANDLE,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
1096 NTSTATUS  WINAPI ZwOpenProcessToken(HANDLE,DWORD,HANDLE *);
1097 NTSTATUS  WINAPI ZwOpenSection(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*);
1098 NTSTATUS  WINAPI ZwOpenSymbolicLinkObject(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
1099 NTSTATUS  WINAPI ZwOpenThread(HANDLE*,ACCESS_MASK,const OBJECT_ATTRIBUTES*,const CLIENT_ID*);
1100 NTSTATUS  WINAPI ZwOpenThreadToken(HANDLE,DWORD,BOOLEAN,HANDLE *);
1101 NTSTATUS  WINAPI ZwOpenTimer(HANDLE*, ACCESS_MASK, const OBJECT_ATTRIBUTES*);
1102 NTSTATUS  WINAPI ZwPowerInformation(POWER_INFORMATION_LEVEL,PVOID,ULONG,PVOID,ULONG);
1103 NTSTATUS  WINAPI ZwPulseEvent(HANDLE,PULONG);
1104 NTSTATUS  WINAPI ZwQueryDefaultLocale(BOOLEAN,LCID*);
1105 NTSTATUS  WINAPI ZwQueryDefaultUILanguage(LANGID*);
1106 NTSTATUS  WINAPI ZwQueryDirectoryFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS,BOOLEAN,PUNICODE_STRING,BOOLEAN);
1107 NTSTATUS  WINAPI ZwQueryDirectoryObject(HANDLE,PDIRECTORY_BASIC_INFORMATION,ULONG,BOOLEAN,BOOLEAN,PULONG,PULONG);
1108 NTSTATUS  WINAPI ZwQueryEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,BOOLEAN,PVOID,ULONG,PVOID,BOOLEAN);
1109 NTSTATUS  WINAPI ZwQueryFullAttributesFile(const OBJECT_ATTRIBUTES*,FILE_NETWORK_OPEN_INFORMATION*);
1110 NTSTATUS  WINAPI ZwQueryInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,LONG,FILE_INFORMATION_CLASS);
1111 NTSTATUS  WINAPI ZwQueryInformationThread(HANDLE,THREADINFOCLASS,PVOID,ULONG,PULONG);
1112 NTSTATUS  WINAPI ZwQueryInformationToken(HANDLE,DWORD,PVOID,DWORD,LPDWORD);
1113 NTSTATUS  WINAPI ZwQueryInstallUILanguage(LANGID*);
1114 NTSTATUS  WINAPI ZwQueryKey(HANDLE,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
1115 NTSTATUS  WINAPI ZwQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
1116 NTSTATUS  WINAPI ZwQuerySecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR,ULONG,PULONG);
1117 NTSTATUS  WINAPI ZwQuerySection(HANDLE,SECTION_INFORMATION_CLASS,PVOID,ULONG,PULONG);
1118 NTSTATUS  WINAPI ZwQuerySymbolicLinkObject(HANDLE,PUNICODE_STRING,PULONG);
1119 NTSTATUS  WINAPI ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG);
1120 NTSTATUS  WINAPI ZwQueryTimerResolution(PULONG,PULONG,PULONG);
1121 NTSTATUS  WINAPI ZwQueryValueKey(HANDLE,const UNICODE_STRING *,KEY_VALUE_INFORMATION_CLASS,void *,DWORD,DWORD *);
1122 NTSTATUS  WINAPI ZwQueryVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
1123 NTSTATUS  WINAPI ZwReadFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG);
1124 NTSTATUS  WINAPI ZwReplaceKey(POBJECT_ATTRIBUTES,HANDLE,POBJECT_ATTRIBUTES);
1125 NTSTATUS  WINAPI ZwRequestWaitReplyPort(HANDLE,PLPC_MESSAGE,PLPC_MESSAGE);
1126 NTSTATUS  WINAPI ZwResetEvent(HANDLE,PULONG);
1127 NTSTATUS  WINAPI ZwRestoreKey(HANDLE,HANDLE,ULONG);
1128 NTSTATUS  WINAPI ZwSaveKey(HANDLE,HANDLE);
1129 NTSTATUS  WINAPI ZwSecureConnectPort(PHANDLE,PUNICODE_STRING,PSECURITY_QUALITY_OF_SERVICE,PLPC_SECTION_WRITE,PSID,PLPC_SECTION_READ,PULONG,PVOID,PULONG);
1130 NTSTATUS  WINAPI ZwSetDefaultLocale(BOOLEAN,LCID);
1131 NTSTATUS  WINAPI ZwSetDefaultUILanguage(LANGID);
1132 NTSTATUS  WINAPI ZwSetEaFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG);
1133 NTSTATUS  WINAPI ZwSetEvent(HANDLE,PULONG);
1134 NTSTATUS  WINAPI ZwSetInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FILE_INFORMATION_CLASS);
1135 NTSTATUS  WINAPI ZwSetInformationKey(HANDLE,const int,PVOID,ULONG);
1136 NTSTATUS  WINAPI ZwSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG);
1137 NTSTATUS  WINAPI ZwSetInformationProcess(HANDLE,PROCESS_INFORMATION_CLASS,PVOID,ULONG);
1138 NTSTATUS  WINAPI ZwSetInformationThread(HANDLE,THREADINFOCLASS,LPCVOID,ULONG);
1139 NTSTATUS  WINAPI ZwSetIoCompletion(HANDLE,ULONG,ULONG,NTSTATUS,ULONG);
1140 NTSTATUS  WINAPI ZwSetSecurityObject(HANDLE,SECURITY_INFORMATION,PSECURITY_DESCRIPTOR);
1141 NTSTATUS  WINAPI ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS,PVOID,ULONG);
1142 NTSTATUS  WINAPI ZwSetSystemTime(const LARGE_INTEGER*,LARGE_INTEGER*);
1143 NTSTATUS  WINAPI ZwSetTimer(HANDLE, const LARGE_INTEGER*, PTIMER_APC_ROUTINE, PVOID, BOOLEAN, ULONG, BOOLEAN*);
1144 NTSTATUS  WINAPI ZwSetValueKey(HANDLE,const UNICODE_STRING *,ULONG,ULONG,const void *,ULONG);
1145 NTSTATUS  WINAPI ZwSetVolumeInformationFile(HANDLE,PIO_STATUS_BLOCK,PVOID,ULONG,FS_INFORMATION_CLASS);
1146 NTSTATUS  WINAPI ZwSuspendThread(HANDLE,PULONG);
1147 NTSTATUS  WINAPI ZwTerminateProcess(HANDLE,LONG);
1148 NTSTATUS  WINAPI ZwUnloadDriver(const UNICODE_STRING *);
1149 NTSTATUS  WINAPI ZwUnloadKey(HANDLE);
1150 NTSTATUS  WINAPI ZwUnmapViewOfSection(HANDLE,PVOID);
1151 NTSTATUS  WINAPI ZwWaitForSingleObject(HANDLE,BOOLEAN,const LARGE_INTEGER*);
1152 NTSTATUS  WINAPI ZwWaitForMultipleObjects(ULONG,const HANDLE*,BOOLEAN,BOOLEAN,const LARGE_INTEGER*);
1153 NTSTATUS  WINAPI ZwWriteFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,const void*,ULONG,PLARGE_INTEGER,PULONG);
1154 NTSTATUS  WINAPI ZwYieldExecution(void);
1155
1156 #endif