Ntdll.h

为了能使用上Ntdll.lib库函数，从几份不完整的Ntdll.h中拼凑整理出了比较完整美观的Ntdll.h。
测试平台：Windows 10 Professional / Visual Studio 2015 Community Update 1
测试Lib：Visual Studio 2015 Community Update 1 (x86 / x64) Ntdll.lib
   1 /*///////////////////////////////////////////////////////////////
   2 Name:            Ntdll.h
   3 BaseLib:        <Ntdll.lib>
   4 BaseHead:        <stdarg.h> <winbase.h> <windef.h>
   5 Author:            gwsbhqt@163.com
   6 LastCode:        20160102
   7 Description:    Reference the undeclared Native API in Ntdll.lib
   8 ///////////////////////////////////////////////////////////////*/
   9 
  10 #pragma once
  11 
  12 #ifndef __NTDLL_H__
  13 #define __NTDLL_H__
  14 
  15 #pragma region HEAD
  16 
  17 #include <stdarg.h>
  18 #include <winbase.h>
  19 #include <windef.h>
  20 
  21 #ifdef __cplusplus
  22 extern "C" {
  23 #endif
  24 
  25 #ifdef _NTDDK_
  26 #error This head file can not be compiled together with Ntddk.h
  27 #endif
  28 
  29 #ifndef WIN64
  30 #pragma comment(lib, "Lib\x86\Ntdll.lib")
  31 #else
  32 #pragma comment(lib, "Lib\x64\Ntdll.lib")
  33 #endif
  34 
  35 #pragma endregion
  36 
  37 #pragma region NTDLL BASE DEFINE
  38 
  39 #ifndef NTSTATUS
  40     typedef LONG NTSTATUS;
  41 #endif
  42 
  43 #ifndef NT_SUCCESS
  44 #define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
  45 #endif // NT_SUCCESS
  46 
  47 #ifndef STATUS_SUCCESS
  48 #define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
  49 #endif // STATUS_SUCCESS
  50 
  51 #ifndef STATUS_UNSUCCESSFUL
  52 #define STATUS_UNSUCCESSFUL ((NTSTATUS)0xC0000001L)
  53 #endif // STATUS_UNSUCCESSFUL
  54 
  55 #ifndef ASSERT
  56 #ifdef _DEBUG
  57 #define ASSERT(x) assert(x)
  58 #else // _DEBUG
  59 #define ASSERT(x)
  60 #endif // _DEBUG
  61 #endif // ASSERT
  62 
  63 #pragma endregion
  64 
  65 #pragma region DEFINE
  66 
  67 #define DEVICE_TYPE DWORD
  68 
  69 #define FLG_STOP_ON_EXCEPTION            0x0000001L
  70 #define FLG_SHOW_LDR_SNAPS                0x0000002L
  71 #define FLG_DEBUG_INITIAL_COMMAND        0x0000004L
  72 #define FLG_STOP_ON_HUNG_GUI            0x0000008L
  73 #define FLG_HEAP_ENABLE_TAIL_CHECK        0x0000010L
  74 #define FLG_HEAP_ENABLE_FREE_CHECK        0x0000020L
  75 #define FLG_HEAP_VALIDATE_PARAMETERS    0x0000040L
  76 #define FLG_HEAP_VALIDATE_ALL            0x0000080L
  77 #define FLG_POOL_ENABLE_TAIL_CHECK        0x0000100L
  78 #define FLG_POOL_ENABLE_FREE_CHECK        0x0000200L
  79 #define FLG_POOL_ENABLE_TAGGING            0x0000400L
  80 #define FLG_HEAP_ENABLE_TAGGING            0x0000800L
  81 #define FLG_USER_STACK_TRACE_DB            0x0001000L
  82 #define FLG_KERNEL_STACK_TRACE_DB        0x0002000L
  83 #define FLG_MAINTAIN_OBJECT_TYPELIST    0x0004000L
  84 #define FLG_HEAP_ENABLE_TAG_BY_DLL        0x0008000L
  85 #define FLG_IGNORE_DEBUG_PRIV            0x0010000L
  86 #define FLG_ENABLE_CSRDEBUG                0x0020000L
  87 #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD    0x0040000L
  88 #define FLG_DISABLE_PAGE_KERNEL_STACKS    0x0080000L
  89 #define FLG_HEAP_ENABLE_CALL_TRACING    0x0100000L
  90 #define FLG_HEAP_DISABLE_COALESCING        0x0200000L
  91 #define FLG_ENABLE_CLOSE_EXCEPTIONS        0x0400000L
  92 #define FLG_ENABLE_EXCEPTION_LOGGING    0x0800000L
  93 #define FLG_ENABLE_DBGPRINT_BUFFERING    0x8000000L
  94 
  95 #define PROTECT_FROM_CLOSE    0x1L
  96 #define INHERIT                0x2L
  97 
  98 #define FLG_SYSOBJINFO_SINGLE_HANDLE_ENTRY        0x40L
  99 #define FLG_SYSOBJINFO_DEFAULT_SECURITY_QUOTA    0x20L
 100 #define FLG_SYSOBJINFO_PERMANENT                0x10L
 101 #define FLG_SYSOBJINFO_EXCLUSIVE                0x08L
 102 #define FLG_SYSOBJINFO_CREATOR_INFO                0x04L
 103 #define FLG_SYSOBJINFO_KERNEL_MODE                0x02L
 104 
 105 #define PERMANENT                         0x10L
 106 #define EXCLUSIVE                         0x20L
 107 
 108 #define WSLE_PAGE_READONLY                0x001L
 109 #define WSLE_PAGE_EXECUTE                 0x002L
 110 #define WSLE_PAGE_READWRITE               0x004L
 111 #define WSLE_PAGE_EXECUTE_READ            0x003L
 112 #define WSLE_PAGE_WRITECOPY               0x005L
 113 #define WSLE_PAGE_EXECUTE_READWRITE       0x006L
 114 #define WSLE_PAGE_EXECUTE_WRITECOPY       0x007L
 115 #define WSLE_PAGE_SHARE_COUNT_MASK        0x0E0L
 116 #define WSLE_PAGE_SHAREABLE               0x100L
 117 
 118 #define LOCK_VM_IN_WSL                    0x1L
 119 #define LOCK_VM_IN_RAM                    0x2L
 120 
 121 #define PC_IDLE                           0x1L
 122 #define PC_NORMAL                         0x2L
 123 #define PC_HIGH                           0x3L
 124 #define PC_REALTIME                       0x4L
 125 #define PC_BELOW_NORMAL                   0x5L
 126 #define PC_ABOVE_NORMAL                   0x6L
 127 
 128 #define PDI_MODULES                       0x01L
 129 #define PDI_BACKTRACE                     0x02L
 130 #define PDI_HEAPS                         0x04L
 131 #define PDI_HEAP_TAGS                     0x08L
 132 #define PDI_HEAP_BLOCKS                   0x10L
 133 #define PDI_LOCKS                         0x20L
 134 
 135 #define LDRP_STATIC_LINK                  0x000002L
 136 #define LDRP_IMAGE_DLL                    0x000004L
 137 #define LDRP_LOAD_IN_PROGRESS             0x001000L
 138 #define LDRP_UNLOAD_IN_PROGRESS           0x002000L
 139 #define LDRP_ENTRY_PROCESSED              0x004000L
 140 #define LDRP_ENTRY_INSERTED               0x008000L
 141 #define LDRP_CURRENT_LOAD                 0x010000L
 142 #define LDRP_FAILED_BUILTIN_LOAD          0x020000L
 143 #define LDRP_DONT_CALL_FOR_THREADS        0x040000L
 144 #define LDRP_PROCESS_ATTACH_CALLED        0x080000L
 145 #define LDRP_DEBUG_SYMBOLS_LOADED         0x100000L
 146 #define LDRP_IMAGE_NOT_AT_BASE            0x200000L
 147 #define LDRP_WX86_IGNORE_MACHINETYPE      0x400000L
 148 
 149 #define LPC_MESSAGE_BASE_SIZE    0x18L
 150 
 151 #define FILE_SUPERSEDE                  0x0L
 152 #define FILE_OPEN                       0x1L
 153 #define FILE_CREATE                     0x2L
 154 #define FILE_OPEN_IF                    0x3L
 155 #define FILE_OVERWRITE                  0x4L
 156 #define FILE_OVERWRITE_IF               0x5L
 157 #define FILE_MAXIMUM_DISPOSITION        0x5L
 158 
 159 #define FILE_SUPERSEDED                 0x0L
 160 #define FILE_OPENED                     0x1L
 161 #define FILE_CREATED                    0x2L
 162 #define FILE_OVERWRITTEN                0x3L
 163 #define FILE_EXISTS                     0x4L
 164 #define FILE_DOES_NOT_EXIST             0x5L
 165 
 166 #define REG_MONITOR_SINGLE_KEY          0x0L
 167 #define REG_MONITOR_SECOND_KEY          0x1L
 168 
 169 #define HASH_STRING_ALGORITHM_DEFAULT   0x00000000L
 170 #define HASH_STRING_ALGORITHM_X65599    0x00000001L
 171 #define HASH_STRING_ALGORITHM_INVALID   0xFFFFFFFFL
 172 
 173 #define SE_MIN_WELL_KNOWN_PRIVILEGE            0x02L
 174 #define SE_CREATE_TOKEN_PRIVILEGE            0x02L
 175 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE        0x03L
 176 #define SE_LOCK_MEMORY_PRIVILEGE            0x04L
 177 #define SE_INCREASE_QUOTA_PRIVILEGE            0x05L
 178 #define SE_UNSOLICITED_INPUT_PRIVILEGE        0x06L
 179 #define SE_MACHINE_ACCOUNT_PRIVILEGE        0x06L
 180 #define SE_TCB_PRIVILEGE                    0x07L
 181 #define SE_SECURITY_PRIVILEGE                0x08L
 182 #define SE_TAKE_OWNERSHIP_PRIVILEGE            0x09L
 183 #define SE_LOAD_DRIVER_PRIVILEGE            0x0AL
 184 #define SE_SYSTEM_PROFILE_PRIVILEGE            0x0BL
 185 #define SE_SYSTEMTIME_PRIVILEGE                0x0CL
 186 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE    0x0DL
 187 #define SE_INC_BASE_PRIORITY_PRIVILEGE        0x0EL
 188 #define SE_CREATE_PAGEFILE_PRIVILEGE        0x0FL
 189 #define SE_CREATE_PERMANENT_PRIVILEGE        0x10L
 190 #define SE_BACKUP_PRIVILEGE                    0x11L
 191 #define SE_RESTORE_PRIVILEGE                0x12L
 192 #define SE_SHUTDOWN_PRIVILEGE                0x13L
 193 #define SE_DEBUG_PRIVILEGE                    0x14L
 194 #define SE_AUDIT_PRIVILEGE                    0x15L
 195 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE        0x16L
 196 #define SE_CHANGE_NOTIFY_PRIVILEGE            0x17L
 197 #define SE_REMOTE_SHUTDOWN_PRIVILEGE        0x18L
 198 #define SE_UNDOCK_PRIVILEGE                    0x19L
 199 #define SE_SYNC_AGENT_PRIVILEGE                0x1AL
 200 #define SE_ENABLE_DELEGATION_PRIVILEGE        0x1BL
 201 #define SE_MANAGE_VOLUME_PRIVILEGE            0x1CL
 202 #define SE_IMPERSONATE_PRIVILEGE            0x1DL
 203 #define SE_CREATE_GLOBAL_PRIVILEGE            0x1EL
 204 #define SE_MAX_WELL_KNOWN_PRIVILEGE            SE_CREATE_GLOBAL_PRIVILEGE
 205 
 206 #define OBJ_INHERIT                0x002L
 207 #define OBJ_PERMANENT            0x010L
 208 #define OBJ_EXCLUSIVE            0x020L
 209 #define OBJ_CASE_INSENSITIVE    0x040L
 210 #define OBJ_OPENIF                0x080L
 211 #define OBJ_OPENLINK            0x100L
 212 #define OBJ_KERNEL_HANDLE        0x200L
 213 #define OBJ_FORCE_ACCESS_CHECK    0x400L
 214 #define OBJ_VALID_ATTRIBUTES    0x7F2L
 215 
 216 #define DIRECTORY_QUERY                    0x0001L
 217 #define DIRECTORY_TRAVERSE                0x0002L
 218 #define DIRECTORY_CREATE_OBJECT            0x0004L
 219 #define DIRECTORY_CREATE_SUBDIRECTORY    0x0008L
 220 #define DIRECTORY_ALL_ACCESS            (STANDARD_RIGHTS_REQUIRED | 0x000FL)
 221 
 222 #define LEVEL_HANDLE_ID            0x74000000L
 223 #define LEVEL_HANDLE_ID_MASK    0xFF000000L
 224 #define LEVEL_HANDLE_INDEX_MASK    0x00FFFFFFL
 225 
 226 #define RTL_QUERY_REGISTRY_SUBKEY    0x01L
 227 #define RTL_QUERY_REGISTRY_TOPKEY    0x02L
 228 #define RTL_QUERY_REGISTRY_REQUIRED    0x04L
 229 #define RTL_QUERY_REGISTRY_NOVALUE    0x08L
 230 #define RTL_QUERY_REGISTRY_NOEXPAND    0x10L
 231 #define RTL_QUERY_REGISTRY_DIRECT    0x20L
 232 #define RTL_QUERY_REGISTRY_DELETE    0x40L
 233 
 234 #define RTL_REGISTRY_ABSOLUTE    0x00000000L
 235 #define RTL_REGISTRY_SERVICES    0x00000001L
 236 #define RTL_REGISTRY_CONTROL    0x00000002L
 237 #define RTL_REGISTRY_WINDOWS_NT    0x00000003L
 238 #define RTL_REGISTRY_DEVICEMAP    0x00000004L
 239 #define RTL_REGISTRY_USER        0x00000005L
 240 #define RTL_REGISTRY_MAXIMUM    0x00000006L
 241 #define RTL_REGISTRY_HANDLE        0x40000000L
 242 #define RTL_REGISTRY_OPTIONAL    0x80000000L
 243 
 244 #define OLD_DOS_VOLID    0x8L
 245 
 246 #define FILE_DIRECTORY_FILE                     0x000001L
 247 #define FILE_WRITE_THROUGH                      0x000002L
 248 #define FILE_SEQUENTIAL_ONLY                    0x000004L
 249 #define FILE_NO_INTERMEDIATE_BUFFERING          0x000008L
 250 #define FILE_SYNCHRONOUS_IO_ALERT               0x000010L
 251 #define FILE_SYNCHRONOUS_IO_NONALERT            0x000020L
 252 #define FILE_NON_DIRECTORY_FILE                 0x000040L
 253 #define FILE_CREATE_TREE_CONNECTION             0x000080L
 254 #define FILE_COMPLETE_IF_OPLOCKED               0x000100L
 255 #define FILE_NO_EA_KNOWLEDGE                    0x000200L
 256 #define FILE_OPEN_FOR_RECOVERY                  0x000400L
 257 #define FILE_RANDOM_ACCESS                      0x000800L
 258 #define FILE_DELETE_ON_CLOSE                    0x001000L
 259 #define FILE_OPEN_BY_FILE_ID                    0x002000L
 260 #define FILE_OPEN_FOR_BACKUP_INTENT             0x004000L
 261 #define FILE_NO_COMPRESSION                     0x008000L
 262 #define FILE_OPEN_REQUIRING_OPLOCK              0x010000L
 263 #define FILE_DISALLOW_EXCLUSIVE                 0x020000L
 264 #define FILE_RESERVE_OPFILTER                   0x100000L
 265 #define FILE_OPEN_REPARSE_POINT                 0x200000L
 266 #define FILE_OPEN_NO_RECALL                     0x400000L
 267 #define FILE_OPEN_FOR_FREE_SPACE_QUERY          0x800000L
 268 
 269 #define GDI_HANDLE_BUFFER_SIZE    0x22L
 270 
 271 #define MEM_EXECUTE_OPTION_DISABLE   0x01L
 272 #define MEM_EXECUTE_OPTION_ENABLE    0x02L
 273 #define MEM_EXECUTE_OPTION_PERMANENT 0x08L
 274 
 275 #define MAX_LPC_DATA 0x130L
 276 
 277 #define ALPC_REQUEST            0x2000L | LPC_REQUEST
 278 #define ALPC_CONNECTION_REQUEST 0x2000L | LPC_CONNECTION_REQUEST
 279 
 280 #define SYMBOLIC_LINK_QUERY            0x1L
 281 #define SYMBOLIC_LINK_ALL_ACCESS    STANDARD_RIGHTS_REQUIRED | 0x1L
 282 
 283 #define EVENT_PAIR_ALL_ACCESS STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE 
 284 
 285 #pragma endregion
 286 
 287 #pragma region TYPEDEF
 288 
 289     typedef LONG KPRIORITY;
 290     typedef PVOID PLANGID;
 291     typedef DWORD ULONG_PTR;
 292     typedef ULONG_PTR KAFFINITY;
 293     typedef USHORT RTL_ATOM, *PRTL_ATOM;
 294     typedef LARGE_INTEGER PHYSICAL_ADDRESS;
 295 
 296 #pragma endregion
 297 
 298 #pragma region ENUM
 299 
 300     typedef enum _THREADINFOCLASS
 301     {
 302         ThreadBasicInformation,
 303         ThreadTimes,
 304         ThreadPriority,
 305         ThreadBasePriority,
 306         ThreadAffinityMask,
 307         ThreadImpersonationToken,
 308         ThreadDescriptorTableEntry,
 309         ThreadEnableAlignmentFaultFixup,
 310         ThreadEventPair_Reusable,
 311         ThreadQuerySetWin32StartAddress,
 312         ThreadZeroTlsCell,
 313         ThreadPerformanceCount,
 314         ThreadAmILastThread,
 315         ThreadIdealProcessor,
 316         ThreadPriorityBoost,
 317         ThreadSetTlsArrayAddress,
 318         ThreadIsIoPending,
 319         ThreadHideFromDebugger,
 320         ThreadBreakOnTermination,
 321         MaxThreadInfoClass
 322     } THREADINFOCLASS;
 323 
 324     typedef enum _KPROFILE_SOURCE
 325     {
 326         ProfileTime,
 327         ProfileAlignmentFixup,
 328         ProfileTotalIssues,
 329         ProfilePipelineDry,
 330         ProfileLoadInstructions,
 331         ProfilePipelineFrozen,
 332         ProfileBranchInstructions,
 333         ProfileTotalNonissues,
 334         ProfileDcacheMisses,
 335         ProfileIcacheMisses,
 336         ProfileCacheMisses,
 337         ProfileBranchMispredictions,
 338         ProfileStoreInstructions,
 339         ProfileFpInstructions,
 340         ProfileIntegerInstructions,
 341         Profile2Issue,
 342         Profile3Issue,
 343         Profile4Issue,
 344         ProfileSpecialInstructions,
 345         ProfileTotalCycles,
 346         ProfileIcacheIssues,
 347         ProfileDcacheAccesses,
 348         ProfileMemoryBarrierCycles,
 349         ProfileLoadLinkedIssues,
 350         ProfileMaximum
 351     } KPROFILE_SOURCE;
 352 
 353     typedef enum _KWAIT_REASON
 354     {
 355         Executive,
 356         FreePage,
 357         PageIn,
 358         PoolAllocation,
 359         DelayExecution,
 360         Suspended,
 361         UserRequest,
 362         WrExecutive,
 363         WrFreePage,
 364         WrPageIn,
 365         WrPoolAllocation,
 366         WrDelayExecution,
 367         WrSuspended,
 368         WrUserRequest,
 369         WrEventPair,
 370         WrQueue,
 371         WrLpcReceive,
 372         WrLpcReply,
 373         WrVirtualMemory,
 374         WrPageOut,
 375         WrRendezvous,
 376         Spare2,
 377         Spare3,
 378         Spare4,
 379         Spare5,
 380         Spare6,
 381         WrKernel,
 382         MaximumWaitReason
 383     } KWAIT_REASON;
 384 
 385     typedef enum _POOL_TYPE
 386     {
 387         NonPagedPool,
 388         PagedPool,
 389         NonPagedPoolMustSucceed,
 390         DontUseThisType,
 391         NonPagedPoolCacheAligned,
 392         PagedPoolCacheAligned,
 393         NonPagedPoolCacheAlignedMustS,
 394         MaxPoolType,
 395         NonPagedPoolSession = 32,
 396         PagedPoolSession,
 397         NonPagedPoolMustSucceedSession,
 398         DontUseThisTypeSession,
 399         NonPagedPoolCacheAlignedSession,
 400         PagedPoolCacheAlignedSession,
 401         NonPagedPoolCacheAlignedMustSSession
 402     } POOL_TYPE;
 403 
 404     typedef enum _THREAD_STATE
 405     {
 406         StateInitialized,
 407         StateReady,
 408         StateRunning,
 409         StateStandby,
 410         StateTerminated,
 411         StateWait,
 412         StateTransition,
 413         StateUnknown
 414     } THREAD_STATE;
 415 
 416     typedef enum _SYSTEM_HANDLE_TYPE
 417     {
 418         OB_TYPE_UNKNOWN,
 419         OB_TYPE_TYPE,
 420         OB_TYPE_DIRECTORY,
 421         OB_TYPE_SYMBOLIC_LINK,
 422         OB_TYPE_TOKEN,
 423         OB_TYPE_PROCESS,
 424         OB_TYPE_THREAD,
 425         OB_TYPE_UNKNOWN_7,
 426         OB_TYPE_EVENT,
 427         OB_TYPE_EVENT_PAIR,
 428         OB_TYPE_MUTANT,
 429         OB_TYPE_UNKNOWN_11,
 430         OB_TYPE_SEMAPHORE,
 431         OB_TYPE_TIMER,
 432         OB_TYPE_PROFILE,
 433         OB_TYPE_WINDOW_STATION,
 434         OB_TYPE_DESKTOP,
 435         OB_TYPE_SECTION,
 436         OB_TYPE_KEY,
 437         OB_TYPE_PORT,
 438         OB_TYPE_WAITABLE_PORT,
 439         OB_TYPE_UNKNOWN_21,
 440         OB_TYPE_UNKNOWN_22,
 441         OB_TYPE_UNKNOWN_23,
 442         OB_TYPE_UNKNOWN_24,
 443         OB_TYPE_IO_COMPLETION,
 444         OB_TYPE_FILE
 445     }SYSTEM_HANDLE_TYPE;
 446 
 447     typedef enum _DEBUG_CONTROL_CODE
 448     {
 449         DebugGetTraceInformation = 1,
 450         DebugSetInternalBreakpoint,
 451         DebugSetSpecialCall,
 452         DebugClearSpecialCalls,
 453         DebugQuerySpecialCalls,
 454         DebugDbgBreakPoint,
 455         DebugMaximum
 456     } DEBUG_CONTROL_CODE;
 457 
 458     typedef enum _SYSDBG_COMMAND
 459     {
 460         SysDbgQueryModuleInformation = 0,
 461         SysDbgQueryTraceInformation,
 462         SysDbgSetTracepoint,
 463         SysDbgSetSpecialCall,
 464         SysDbgClearSpecialCalls,
 465         SysDbgQuerySpecialCalls,
 466         SysDbgBreakPoint,
 467         SysDbgQueryVersion,
 468         SysDbgReadVirtual,
 469         SysDbgWriteVirtual,
 470         SysDbgReadPhysical,
 471         SysDbgWritePhysical,
 472         SysDbgReadControlSpace,
 473         SysDbgWriteControlSpace,
 474         SysDbgReadIoSpace,
 475         SysDbgWriteIoSpace,
 476         SysDbgReadMsr,
 477         SysDbgWriteMsr,
 478         SysDbgReadBusData,
 479         SysDbgWriteBusData,
 480         SysDbgCheckLowMemory,
 481         SysDbgEnableKernelDebugger,
 482         SysDbgDisableKernelDebugger,
 483         SysDbgGetAutoKdEnable,
 484         SysDbgSetAutoKdEnable,
 485         SysDbgGetPrintBufferSize,
 486         SysDbgSetPrintBufferSize,
 487         SysDbgGetKdUmExceptionEnable,
 488         SysDbgSetKdUmExceptionEnable,
 489         SysDbgGetTriageDump,
 490         SysDbgGetKdBlockEnable,
 491         SysDbgSetKdBlockEnable,
 492     } SYSDBG_COMMAND, *PSYSDBG_COMMAND;
 493 
 494     typedef enum _INTERFACE_TYPE
 495     {
 496         InterfaceTypeUndefined = -1,
 497         Internal,
 498         Isa,
 499         Eisa,
 500         MicroChannel,
 501         TurboChannel,
 502         PCIBus,
 503         VMEBus,
 504         NuBus,
 505         PCMCIABus,
 506         CBus,
 507         MPIBus,
 508         MPSABus,
 509         ProcessorInternal,
 510         InternalPowerBus,
 511         PNPISABus,
 512         PNPBus,
 513         MaximumInterfaceType
 514     }INTERFACE_TYPE, *PINTERFACE_TYPE;
 515 
 516     typedef enum _BUS_DATA_TYPE
 517     {
 518         ConfigurationSpaceUndefined = -1,
 519         Cmos,
 520         EisaConfiguration,
 521         Pos,
 522         CbusConfiguration,
 523         PCIConfiguration,
 524         VMEConfiguration,
 525         NuBusConfiguration,
 526         PCMCIAConfiguration,
 527         MPIConfiguration,
 528         MPSAConfiguration,
 529         PNPISAConfiguration,
 530         SgiInternalConfiguration,
 531         MaximumBusDataType
 532     } BUS_DATA_TYPE, *PBUS_DATA_TYPE;
 533 
 534     typedef enum _OBJECT_INFORMATION_CLASS
 535     {
 536         ObjectBasicInformation,
 537         ObjectNameInformation,
 538         ObjectTypeInformation,
 539         ObjectAllTypesInformation,
 540         ObjectHandleInformation
 541     } OBJECT_INFORMATION_CLASS;
 542 
 543     typedef enum _LPC_TYPE
 544     {
 545         LPC_NEW_MESSAGE,
 546         LPC_REQUEST,
 547         LPC_REPLY,
 548         LPC_DATAGRAM,
 549         LPC_LOST_REPLY,
 550         LPC_PORT_CLOSED,
 551         LPC_CLIENT_DIED,
 552         LPC_EXCEPTION,
 553         LPC_DEBUG_EVENT,
 554         LPC_ERROR_EVENT,
 555         LPC_CONNECTION_REQUEST,
 556         LPC_CONNECTION_REFUSED,
 557         LPC_MAXIMUM
 558     } LPC_TYPE;
 559 
 560     typedef enum _KEY_SET_INFORMATION_CLASS
 561     {
 562         KeyLastWriteTimeInformation
 563     } KEY_SET_INFORMATION_CLASS;
 564 
 565     typedef enum _HARDERROR_RESPONSE_OPTION
 566     {
 567         OptionAbortRetryIgnore,
 568         OptionOk,
 569         OptionOkCancel,
 570         OptionRetryCancel,
 571         OptionYesNo,
 572         OptionYesNoCancel,
 573         OptionShutdownSystem
 574     } HARDERROR_RESPONSE_OPTION, *PHARDERROR_RESPONSE_OPTION;
 575 
 576     typedef enum _HARDERROR_RESPONSE
 577     {
 578         ResponseReturnToCaller,
 579         ResponseNotHandled,
 580         ResponseAbort,
 581         ResponseCancel,
 582         ResponseIgnore,
 583         ResponseNo,
 584         ResponseOk,
 585         ResponseRetry,
 586         ResponseYes
 587     } HARDERROR_RESPONSE, *PHARDERROR_RESPONSE;
 588 
 589     typedef enum _ATOM_INFORMATION_CLASS
 590     {
 591         AtomBasicInformation,
 592         AtomListInformation
 593     } ATOM_INFORMATION_CLASS;
 594 
 595     typedef enum _PORT_INFORMATION_CLASS
 596     {
 597         PortBasicInformation
 598     } PORT_INFORMATION_CLASS;
 599 
 600     typedef enum _EVENT_TYPE
 601     {
 602         NotificationEvent,
 603         SynchronizationEvent
 604     } EVENT_TYPE;
 605 
 606     typedef enum _RTL_GENERIC_COMPARE_RESULTS
 607     {
 608         GenericLessThan,
 609         GenericGreaterThan,
 610         GenericEqual
 611     } RTL_GENERIC_COMPARE_RESULTS;
 612 
 613     typedef enum _SECTION_INHERIT
 614     {
 615         ViewShare = 1,
 616         ViewUnmap = 2
 617     } SECTION_INHERIT;
 618 
 619     typedef enum _KEY_VALUE_INFORMATION_CLASS
 620     {
 621         KeyValueBasicInformation,
 622         KeyValueFullInformation,
 623         KeyValuePartialInformation,
 624         KeyValueFullInformationAlign64,
 625         KeyValuePartialInformationAlign64,
 626         MaxKeyValueInfoClass
 627     } KEY_VALUE_INFORMATION_CLASS;
 628 
 629     typedef enum _KEY_INFORMATION_CLASS
 630     {
 631         KeyBasicInformation,
 632         KeyNodeInformation,
 633         KeyFullInformation,
 634         KeyNameInformation,
 635         KeyCachedInformation,
 636         KeyFlagsInformation,
 637         MaxKeyInfoClass
 638     } KEY_INFORMATION_CLASS;
 639 
 640     typedef enum _SYSTEM_INFORMATION_CLASS
 641     {
 642         SystemBasicInformation,
 643         SystemProcessorInformation,
 644         SystemPerformanceInformation,
 645         SystemTimeOfDayInformation,
 646         SystemPathInformation,
 647         SystemProcessInformation,
 648         SystemCallCountInformation,
 649         SystemDeviceInformation,
 650         SystemProcessorPerformanceInformation,
 651         SystemFlagsInformation,
 652         SystemCallTimeInformation,
 653         SystemModuleInformation,
 654         SystemLocksInformation,
 655         SystemStackTraceInformation,
 656         SystemPagedPoolInformation,
 657         SystemNonPagedPoolInformation,
 658         SystemHandleInformation,
 659         SystemObjectInformation,
 660         SystemPageFileInformation,
 661         SystemVdmInstemulInformation,
 662         SystemVdmBopInformation,
 663         SystemFileCacheInformation,
 664         SystemPoolTagInformation,
 665         SystemInterruptInformation,
 666         SystemDpcBehaviorInformation,
 667         SystemFullMemoryInformation,
 668         SystemLoadGdiDriverInformation,
 669         SystemUnloadGdiDriverInformation,
 670         SystemTimeAdjustmentInformation,
 671         SystemSummaryMemoryInformation,
 672         SystemMirrorMemoryInformation,
 673         SystemPerformanceTraceInformation,
 674         SystemObsolete0,
 675         SystemExceptionInformation,
 676         SystemCrashDumpStateInformation,
 677         SystemKernelDebuggerInformation,
 678         SystemContextSwitchInformation,
 679         SystemRegistryQuotaInformation,
 680         SystemExtendServiceTableInformation,
 681         SystemPrioritySeperation,
 682         SystemPlugPlayBusInformation,
 683         SystemDockInformation,
 684         SystemPowerInformationNative,
 685         SystemProcessorSpeedInformation,
 686         SystemCurrentTimeZoneInformation,
 687         SystemLookasideInformation,
 688         SystemTimeSlipNotification,
 689         SystemSessionCreate,
 690         SystemSessionDetach,
 691         SystemSessionInformation,
 692         SystemRangeStartInformation,
 693         SystemVerifierInformation,
 694         SystemAddVerifier,
 695         SystemSessionProcessesInformation,
 696         SystemLoadGdiDriverInSystemSpaceInformation,
 697         SystemNumaProcessorMap,
 698         SystemPrefetcherInformation,
 699         SystemExtendedProcessInformation,
 700         SystemRecommendedSharedDataAlignment,
 701         SystemComPlusPackage,
 702         SystemNumaAvailableMemory,
 703         SystemProcessorPowerInformation,
 704         SystemEmulationBasicInformation,
 705         SystemEmulationProcessorInformation,
 706         SystemExtendedHanfleInformation,
 707         SystemLostDelayedWriteInformation,
 708         SystemBigPoolInformation,
 709         SystemSessionPoolTagInformation,
 710         SystemSessionMappedViewInformation,
 711         SystemHotpatchInformation,
 712         SystemObjectSecurityMode,
 713         SystemWatchDogTimerHandler,
 714         SystemWatchDogTimerInformation,
 715         SystemLogicalProcessorInformation,
 716         SystemWo64SharedInformationObosolete,
 717         SystemRegisterFirmwareTableInformationHandler,
 718         SystemFirmwareTableInformation,
 719         SystemModuleInformationEx,
 720         SystemVerifierTriageInformation,
 721         SystemSuperfetchInformation,
 722         SystemMemoryListInformation,
 723         SystemFileCacheInformationEx,
 724         SystemThreadPriorityClientIdInformation,
 725         SystemProcessorIdleCycleTimeInformation,
 726         SystemVerifierCancellationInformation,
 727         SystemProcessorPowerInformationEx,
 728         SystemRefTraceInformation,
 729         SystemSpecialPoolInformation,
 730         SystemProcessIdInformation,
 731         SystemErrorPortInformation,
 732         SystemBootEnvironmentInformation,
 733         SystemHypervisorInformation,
 734         SystemVerifierInformationEx,
 735         SystemTimeZoneInformation,
 736         SystemImageFileExecutionOptionsInformation,
 737         SystemCoverageInformation,
 738         SystemPrefetchPathInformation,
 739         SystemVerifierFaultsInformation,
 740         MaxSystemInfoClass
 741     } SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;
 742 
 743     typedef enum _SHUTDOWN_ACTION
 744     {
 745         ShutdownNoReboot,
 746         ShutdownReboot,
 747         ShutdownPowerOff
 748     } SHUTDOWN_ACTION, *PSHUTDOWN_ACTION;
 749 
 750     typedef enum _FILE_INFORMATION_CLASS
 751     {
 752         FileDirectoryInformation = 1,
 753         FileFullDirectoryInformation,
 754         FileBothDirectoryInformation,
 755         FileBasicInformation,
 756         FileStandardInformation,
 757         FileInternalInformation,
 758         FileEaInformation,
 759         FileAccessInformation,
 760         FileNameInformation,
 761         FileRenameInformation,
 762         FileLinkInformation,
 763         FileNamesInformation,
 764         FileDispositionInformation,
 765         FilePositionInformation,
 766         FileFullEaInformation,
 767         FileModeInformation,
 768         FileAlignmentInformation,
 769         FileAllInformation,
 770         FileAllocationInformation,
 771         FileEndOfFileInformation,
 772         FileAlternateNameInformation,
 773         FileStreamInformation,
 774         FilePipeInformation,
 775         FilePipeLocalInformation,
 776         FilePipeRemoteInformation,
 777         FileMailslotQueryInformation,
 778         FileMailslotSetInformation,
 779         FileCompressionInformation,
 780         FileObjectIdInformation,
 781         FileCompletionInformation,
 782         FileMoveClusterInformation,
 783         FileQuotaInformation,
 784         FileReparsePointInformation,
 785         FileNetworkOpenInformation,
 786         FileAttributeTagInformation,
 787         FileTrackingInformation,
 788         FileIdBothDirectoryInformation,
 789         FileIdFullDirectoryInformation,
 790         FileValidDataLengthInformation,
 791         FileShortNameInformation,
 792         FileIoCompletionNotificationInformation,
 793         FileIoStatusBlockRangeInformation,
 794         FileIoPriorityHintInformation,
 795         FileSfioReserveInformation,
 796         FileSfioVolumeInformation,
 797         FileHardLinkInformation,
 798         FileProcessIdsUsingFileInformation,
 799         FileNormalizedNameInformation,
 800         FileNetworkPhysicalNameInformation,
 801         FileIdGlobalTxDirectoryInformation,
 802         FileIsRemoteDeviceInformation,
 803         FileAttributeCacheInformation,
 804         FileNumaNodeInformation,
 805         FileStandardLinkInformation,
 806         FileRemoteProtocolInformation,
 807         FileMaximumInformation
 808     } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
 809 
 810     typedef enum _IO_PRIORITY_HINT
 811     {
 812         IoPriorityVeryLow,
 813         IoPriorityLow,
 814         IoPriorityNormal,
 815         IoPriorityHigh,
 816         IoPriorityCritical,
 817         MaxIoPriorityTypes
 818     } IO_PRIORITY_HINT;
 819 
 820     typedef enum _FSINFOCLASS
 821     {
 822         FileFsVolumeInformation = 1,
 823         FileFsLabelInformation,
 824         FileFsSizeInformation,
 825         FileFsDeviceInformation,
 826         FileFsAttributeInformation,
 827         FileFsControlInformation,
 828         FileFsFullSizeInformation,
 829         FileFsObjectIdInformation,
 830         FileFsDriverPathInformation,
 831         FileFsVolumeFlagsInformation,
 832         FileFsMaximumInformation
 833     } FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;
 834 
 835     typedef enum _PROCESSINFOCLASS
 836     {
 837         ProcessBasicInformation,
 838         ProcessQuotaLimits,
 839         ProcessIoCounters,
 840         ProcessVmCounters,
 841         ProcessTimes,
 842         ProcessBasePriority,
 843         ProcessRaisePriority,
 844         ProcessDebugPort,
 845         ProcessExceptionPort,
 846         ProcessAccessToken,
 847         ProcessLdtInformation,
 848         ProcessLdtSize,
 849         ProcessDefaultHardErrorMode,
 850         ProcessIoPortHandlers,
 851         ProcessPooledUsageAndLimits,
 852         ProcessWorkingSetWatch,
 853         ProcessUserModeIOPL,
 854         ProcessEnableAlignmentFaultFixup,
 855         ProcessPriorityClass,
 856         ProcessWx86Information,
 857         ProcessHandleCount,
 858         ProcessAffinityMask,
 859         ProcessPriorityBoost,
 860         ProcessDeviceMap,
 861         ProcessSessionInformation,
 862         ProcessForegroundInformation,
 863         ProcessWow64Information,
 864         ProcessImageFileName,
 865         ProcessLUIDDeviceMapsEnabled,
 866         ProcessBreakOnTermination,
 867         ProcessDebugObjectHandle,
 868         ProcessDebugFlags,
 869         ProcessHandleTracing,
 870         ProcessIoPriority,
 871         ProcessExecuteFlags,
 872         ProcessTlsInformation,
 873         ProcessCookie,
 874         ProcessImageInformation,
 875         ProcessCycleTime,
 876         ProcessPagePriority,
 877         ProcessInstrumentationCallback,
 878         ProcessThreadStackAllocation,
 879         ProcessWorkingSetWatchEx,
 880         ProcessImageFileNameWin32,
 881         ProcessImageFileMapping,
 882         ProcessAffinityUpdateMode,
 883         ProcessMemoryAllocationMode,
 884         ProcessGroupInformation,
 885         ProcessTokenVirtualizationEnabled,
 886         ProcessConsoleHostProcess,
 887         ProcessWindowInformation,
 888         MaxProcessInfoClass
 889     } PROCESSINFOCLASS;
 890 
 891     typedef enum _MEMORY_INFORMATION_CLASS
 892     {
 893         MemoryBasicInformation,
 894         MemoryWorkingSetInformation,
 895         MemoryMappedFilenameInformation,
 896         MemoryRegionInformation,
 897         MemoryWorkingSetExInformation
 898     } MEMORY_INFORMATION_CLASS;
 899 
 900     typedef enum _WAIT_TYPE
 901     {
 902         WaitAll,
 903         WaitAny
 904     } WAIT_TYPE;
 905 
 906     typedef enum _EVENT_INFORMATION_CLASS
 907     {
 908         EventBasicInformation
 909     } EVENT_INFORMATION_CLASS;
 910 
 911     typedef enum _SECTION_INFORMATION_CLASS
 912     {
 913         SectionBasicInformation,
 914         SectionImageInformation
 915     } SECTION_INFORMATION_CLASS, *PSECTION_INFORMATION_CLASS;
 916 
 917 #pragma endregion
 918 
 919 #pragma region STRUCT
 920 
 921     typedef struct _STRING
 922     {
 923         USHORT Length;
 924         USHORT MaximumLength;
 925         PCHAR Buffer;
 926     } STRING, ANSI_STRING, OEM_STRING, *PSTRING, *PANSI_STRING, *PCANSI_STRING, *POEM_STRING;
 927     typedef const STRING *PCOEM_STRING;
 928 
 929     typedef struct _UNICODE_STRING
 930     {
 931         USHORT Length;
 932         USHORT MaximumLength;
 933         PWSTR  Buffer;
 934     } UNICODE_STRING, *PUNICODE_STRING;
 935     typedef const UNICODE_STRING *PCUNICODE_STRING;
 936 
 937     typedef struct _CLIENT_ID
 938     {
 939         HANDLE  UniqueProcess;
 940         HANDLE  UniqueThread;
 941     } CLIENT_ID, *PCLIENT_ID;
 942 
 943     typedef struct _CURDIR
 944     {
 945         UNICODE_STRING DosPath;
 946         HANDLE Handle;
 947     } CURDIR, *PCURDIR;
 948 
 949     typedef struct _OBJECT_ATTRIBUTES
 950     {
 951         ULONG Length;
 952         HANDLE RootDirectory;
 953         PUNICODE_STRING ObjectName;
 954         ULONG Attributes;
 955         PVOID SecurityDescriptor;
 956         PVOID SecurityQualityOfService;
 957     } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
 958 
 959     typedef struct _PEB_FREE_BLOCK
 960     {
 961         struct _PEB_FREE_BLOCK *Next;
 962         ULONG Size;
 963     } PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;
 964 
 965     typedef struct _PEB_LDR_DATA
 966     {
 967         ULONG Length;
 968         BOOLEAN Initialized;
 969         HANDLE SsHandle;
 970         LIST_ENTRY InLoadOrderModuleList;
 971         LIST_ENTRY InMemoryOrderModuleList;
 972         LIST_ENTRY InInitializationOrderModuleList;
 973         PVOID      EntryInProgress;
 974     } PEB_LDR_DATA, *PPEB_LDR_DATA;
 975 
 976     typedef struct _RTL_DRIVE_LETTER_CURDIR
 977     {
 978         USHORT Flags;
 979         USHORT Length;
 980         ULONG  TimeStamp;
 981         STRING DosPath;
 982     } RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
 983 
 984     typedef struct _RTL_USER_PROCESS_PARAMETERS
 985     {
 986         ULONG MaximumLength;
 987         ULONG Length;
 988         ULONG Flags;
 989         ULONG DebugFlags;
 990         PVOID ConsoleHandle;
 991         ULONG ConsoleFlags;
 992         HANDLE StandardInput;
 993         HANDLE StandardOutput;
 994         HANDLE StandardError;
 995         CURDIR CurrentDirectory;
 996         UNICODE_STRING DllPath;
 997         UNICODE_STRING ImagePathName;
 998         UNICODE_STRING CommandLine;
 999         PVOID Environment;
1000         ULONG StartingX;
1001         ULONG StartingY;
1002         ULONG CountX;
1003         ULONG CountY;
1004         ULONG CountCharsX;
1005         ULONG CountCharsY;
1006         ULONG FillAttribute;
1007         ULONG WindowFlags;
1008         ULONG ShowWindowFlags;
1009         UNICODE_STRING WindowTitle;
1010         UNICODE_STRING DesktopInfo;
1011         UNICODE_STRING ShellInfo;
1012         UNICODE_STRING RuntimeData;
1013         RTL_DRIVE_LETTER_CURDIR CurrentDirectores[0x20];
1014     } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
1015 
1016     typedef struct _PEB
1017     {
1018         BOOLEAN InheritedAddressSpace;
1019         BOOLEAN ReadImageFileExecOptions;
1020         BOOLEAN BeingDebugged;
1021         BOOLEAN SpareBool;
1022         HANDLE Mutant;
1023         PVOID ImageBaseAddress;
1024         PPEB_LDR_DATA Ldr;
1025         PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
1026         PVOID SubSystemData;
1027         PVOID ProcessHeap;
1028         PVOID FastPebLock;
1029         PVOID FastPebLockRoutine;
1030         PVOID FastPebUnlockRoutine;
1031         ULONG EnvironmentUpdateCount;
1032         PVOID KernelCallbackTable;
1033         HANDLE SystemReserved;
1034         PVOID  AtlThunkSListPtr32;
1035         PPEB_FREE_BLOCK FreeList;
1036         ULONG TlsExpansionCounter;
1037         PVOID TlsBitmap;
1038         ULONG TlsBitmapBits[2];
1039         PVOID ReadOnlySharedMemoryBase;
1040         PVOID ReadOnlySharedMemoryHeap;
1041         PVOID *ReadOnlyStaticServerData;
1042         PVOID AnsiCodePageData;
1043         PVOID OemCodePageData;
1044         PVOID UnicodeCaseTableData;
1045         ULONG NumberOfProcessors;
1046         ULONG NtGlobalFlag;
1047         LARGE_INTEGER CriticalSectionTimeout;
1048         ULONG HeapSegmentReserve;
1049         ULONG HeapSegmentCommit;
1050         ULONG HeapDeCommitTotalFreeThreshold;
1051         ULONG HeapDeCommitFreeBlockThreshold;
1052         ULONG NumberOfHeaps;
1053         ULONG MaximumNumberOfHeaps;
1054         PVOID *ProcessHeaps;
1055         PVOID GdiSharedHandleTable;
1056         PVOID ProcessStarterHelper;
1057         PVOID GdiDCAttributeList;
1058         PVOID LoaderLock;
1059         ULONG OSMajorVersion;
1060         ULONG OSMinorVersion;
1061         USHORT OSBuildNumber;
1062         USHORT OSCSDVersion;
1063         ULONG OSPlatformId;
1064         ULONG ImageSubsystem;
1065         ULONG ImageSubsystemMajorVersion;
1066         ULONG ImageSubsystemMinorVersion;
1067         ULONG ImageProcessAffinityMask;
1068         ULONG GdiHandleBuffer[GDI_HANDLE_BUFFER_SIZE];
1069     } PEB, *PPEB;
1070 
1071     typedef struct _TEB
1072     {
1073         NT_TIB NtTib;
1074         PVOID  EnvironmentPointer;
1075         CLIENT_ID ClientId;
1076         PVOID ActiveRpcHandle;
1077         PVOID ThreadLocalStoragePointer;
1078         PPEB ProcessEnvironmentBlock;
1079         ULONG LastErrorValue;
1080         ULONG CountOfOwnedCriticalSections;
1081         PVOID CsrClientThread;
1082         PVOID Win32ThreadInfo;
1083     } TEB, *PTEB;
1084 
1085     typedef struct _PROCESS_BASIC_INFORMATION
1086     {
1087         NTSTATUS  ExitStatus;
1088         PPEB  PebBaseAddress;
1089         KAFFINITY  AffinityMask;
1090         KPRIORITY  BasePriority;
1091         ULONG  UniqueProcessId;
1092         ULONG  InheritedFromUniqueProcessId;
1093     } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
1094 
1095     typedef struct _FILE_NETWORK_OPEN_INFORMATION
1096     {
1097         LARGE_INTEGER  CreationTime;
1098         LARGE_INTEGER  LastAccessTime;
1099         LARGE_INTEGER  LastWriteTime;
1100         LARGE_INTEGER  ChangeTime;
1101         LARGE_INTEGER  AllocationSize;
1102         LARGE_INTEGER  EndOfFile;
1103         ULONG  FileAttributes;
1104     } FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;
1105 
1106     typedef struct _IO_STATUS_BLOCK
1107     {
1108         union
1109         {
1110             NTSTATUS Status;
1111             PVOID Pointer;
1112         };
1113         ULONG_PTR Information;
1114     } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
1115 
1116     typedef struct _KEY_VALUE_ENTRY
1117     {
1118         PUNICODE_STRING ValueName;
1119         ULONG           DataLength;
1120         ULONG           DataOffset;
1121         ULONG           Type;
1122     } KEY_VALUE_ENTRY, *PKEY_VALUE_ENTRY;
1123 
1124     typedef struct _SYSTEM_BASIC_INFORMATION
1125     {
1126         ULONG Reserved;
1127         ULONG TimerResolution;
1128         ULONG PageSize;
1129         ULONG NumberOfPhysicalPages;
1130         ULONG LowestPhysicalPageNumber;
1131         ULONG HighestPhysicalPageNumber;
1132         ULONG AllocationGranularity;
1133         ULONG MinimumUserModeAddress;
1134         ULONG MaximumUserModeAddress;
1135         KAFFINITY ActiveProcessorsAffinityMask;
1136         CCHAR NumberOfProcessors;
1137     } SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;
1138 
1139     typedef struct _SYSTEM_PROCESSOR_INFORMATION
1140     {
1141         USHORT  ProcessorArchitecture;
1142         USHORT  ProcessorLevel;
1143         USHORT  ProcessorRevision;
1144         USHORT  Unknown;
1145         ULONG  FeatureBits;
1146     } SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION;
1147 
1148     typedef struct _SYSTEM_PERFORMANCE_INFORMATION
1149     {
1150         LARGE_INTEGER IdleProcessTime;
1151         LARGE_INTEGER IoReadTransferCount;
1152         LARGE_INTEGER IoWriteTransferCount;
1153         LARGE_INTEGER IoOtherTransferCount;
1154         ULONG IoReadOperationCount;
1155         ULONG IoWriteOperationCount;
1156         ULONG IoOtherOperationCount;
1157         ULONG AvailablePages;
1158         ULONG CommittedPages;
1159         ULONG CommitLimit;
1160         ULONG PeakCommitment;
1161         ULONG PageFaultCount;
1162         ULONG CopyOnWriteCount;
1163         ULONG TransitionCount;
1164         ULONG CacheTransitionCount;
1165         ULONG DemandZeroCount;
1166         ULONG PageReadCount;
1167         ULONG PageReadIoCount;
1168         ULONG CacheReadCount;
1169         ULONG CacheIoCount;
1170         ULONG DirtyPagesWriteCount;
1171         ULONG DirtyWriteIoCount;
1172         ULONG MappedPagesWriteCount;
1173         ULONG MappedWriteIoCount;
1174         ULONG PagedPoolPages;
1175         ULONG NonPagedPoolPages;
1176         ULONG PagedPoolAllocs;
1177         ULONG PagedPoolFrees;
1178         ULONG NonPagedPoolAllocs;
1179         ULONG NonPagedPoolFrees;
1180         ULONG FreeSystemPtes;
1181         ULONG ResidentSystemCodePage;
1182         ULONG TotalSystemDriverPages;
1183         ULONG TotalSystemCodePages;
1184         ULONG NonPagedPoolLookasideHits;
1185         ULONG PagedPoolLookasideHits;
1186         ULONG Spare3Count;
1187         ULONG ResidentSystemCachePage;
1188         ULONG ResidentPagedPoolPage;
1189         ULONG ResidentSystemDriverPage;
1190         ULONG CcFastReadNoWait;
1191         ULONG CcFastReadWait;
1192         ULONG CcFastReadResourceMiss;
1193         ULONG CcFastReadNotPossible;
1194         ULONG CcFastMdlReadNoWait;
1195         ULONG CcFastMdlReadWait;
1196         ULONG CcFastMdlReadResourceMiss;
1197         ULONG CcFastMdlReadNotPossible;
1198         ULONG CcMapDataNoWait;
1199         ULONG CcMapDataWait;
1200         ULONG CcMapDataNoWaitMiss;
1201         ULONG CcMapDataWaitMiss;
1202         ULONG CcPinMappedDataCount;
1203         ULONG CcPinReadNoWait;
1204         ULONG CcPinReadWait;
1205         ULONG CcPinReadNoWaitMiss;
1206         ULONG CcPinReadWaitMiss;
1207         ULONG CcCopyReadNoWait;
1208         ULONG CcCopyReadWait;
1209         ULONG CcCopyReadNoWaitMiss;
1210         ULONG CcCopyReadWaitMiss;
1211         ULONG CcMdlReadNoWait;
1212         ULONG CcMdlReadWait;
1213         ULONG CcMdlReadNoWaitMiss;
1214         ULONG CcMdlReadWaitMiss;
1215         ULONG CcReadAheadIos;
1216         ULONG CcLazyWriteIos;
1217         ULONG CcLazyWritePages;
1218         ULONG CcDataFlushes;
1219         ULONG CcDataPages;
1220         ULONG ContextSwitches;
1221         ULONG FirstLevelTbFills;
1222         ULONG SecondLevelTbFills;
1223         ULONG SystemCalls;
1224     } SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;
1225 
1226     typedef struct _SYSTEM_TIME_OF_DAY_INFORMATION
1227     {
1228         LARGE_INTEGER  BootTime;
1229         LARGE_INTEGER  CurrentTime;
1230         LARGE_INTEGER  TimeZoneBias;
1231         ULONG  CurrentTimeZoneId;
1232     } SYSTEM_TIME_OF_DAY_INFORMATION, *PSYSTEM_TIME_OF_DAY_INFORMATION;
1233 
1234     typedef struct _VM_COUNTERS
1235     {
1236         ULONG  PeakVirtualSize;
1237         ULONG  VirtualSize;
1238         ULONG  PageFaultCount;
1239         ULONG  PeakWorkingSetSize;
1240         ULONG  WorkingSetSize;
1241         ULONG  QuotaPeakPagedPoolUsage;
1242         ULONG  QuotaPagedPoolUsage;
1243         ULONG  QuotaPeakNonPagedPoolUsage;
1244         ULONG  QuotaNonPagedPoolUsage;
1245         ULONG  PagefileUsage;
1246         ULONG  PeakPagefileUsage;
1247         ULONG  PrivatePageCount;
1248     } VM_COUNTERS;
1249 
1250     typedef struct _SYSTEM_THREADS
1251     {
1252         LARGE_INTEGER  KernelTime;
1253         LARGE_INTEGER  UserTime;
1254         LARGE_INTEGER  CreateTime;
1255         ULONG  WaitTime;
1256         PVOID  StartAddress;
1257         CLIENT_ID  ClientId;
1258         KPRIORITY  Priority;
1259         KPRIORITY  BasePriority;
1260         ULONG  ContextSwitchCount;
1261         THREAD_STATE  State;
1262         KWAIT_REASON  WaitReason;
1263         ULONG Reversed;
1264     } SYSTEM_THREADS, *PSYSTEM_THREADS;
1265 
1266     typedef struct _SYSTEM_PROCESSES
1267     {
1268         ULONG  NextEntryDelta;
1269         ULONG  ThreadCount;
1270         LARGE_INTEGER  Reserved1[3];
1271         LARGE_INTEGER  CreateTime;
1272         LARGE_INTEGER  UserTime;
1273         LARGE_INTEGER  KernelTime;
1274         UNICODE_STRING  ProcessName;
1275         KPRIORITY  BasePriority;
1276         ULONG  ProcessId;
1277         ULONG  InheritedFromProcessId;
1278         ULONG  HandleCount;
1279         ULONG SessionId;
1280         ULONG_PTR PageDirectoryBase;
1281         VM_COUNTERS  VmCounters;
1282         ULONG  PrivatePageCount;
1283         IO_COUNTERS  IoCounters;
1284         SYSTEM_THREADS  Threads[1];
1285     } SYSTEM_PROCESSES, *PSYSTEM_PROCESSES;
1286 
1287     typedef struct _SYSTEM_CALLS_INFORMATION
1288     {
1289         ULONG  Size;
1290         ULONG  NumberOfDescriptorTables;
1291         ULONG  NumberOfRoutinesInTable[1];
1292         ULONG  CallCounts[ANYSIZE_ARRAY];
1293     } SYSTEM_CALLS_INFORMATION, *PSYSTEM_CALLS_INFORMATION;
1294 
1295     typedef struct _SYSTEM_CONFIGURATION_INFORMATION
1296     {
1297         ULONG  DiskCount;
1298         ULONG  FloppyCount;
1299         ULONG  CdRomCount;
1300         ULONG  TapeCount;
1301         ULONG  SerialCount;
1302         ULONG  ParallelCount;
1303     } SYSTEM_CONFIGURATION_INFORMATION, *PSYSTEM_CONFIGURATION_INFORMATION;
1304 
1305     typedef struct _SYSTEM_PROCESSOR_TIMES
1306     {
1307         LARGE_INTEGER  IdleTime;
1308         LARGE_INTEGER  KernelTime;
1309         LARGE_INTEGER  UserTime;
1310         LARGE_INTEGER  DpcTime;
1311         LARGE_INTEGER  InterruptTime;
1312         ULONG  InterruptCount;
1313     } SYSTEM_PROCESSOR_TIMES, *PSYSTEM_PROCESSOR_TIMES;
1314 
1315     typedef struct _SYSTEM_GLOBAL_FLAG
1316     {
1317         ULONG  GlobalFlag;
1318     } SYSTEM_GLOBAL_FLAG, *PSYSTEM_GLOBAL_FLAG;
1319 
1320     typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY
1321     {
1322         HANDLE Section;
1323         PVOID  MappedBase;
1324         PVOID  Base;
1325         ULONG  Size;
1326         ULONG  Flags;
1327         USHORT  LoadOrderIndex;
1328         USHORT    InitOrderIndex;
1329         USHORT  LoadCount;
1330         USHORT  PathLength;
1331         CHAR  ImageName[256];
1332     } SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;
1333 
1334     typedef struct _SYSTEM_MODULE
1335     {
1336         HANDLE Section;
1337         PVOID  MappedBase;
1338         PVOID  ImageBase;
1339         ULONG  ImageSize;
1340         ULONG  Flags;
1341         USHORT LoadOrderIndex;
1342         USHORT InitOrderIndex;
1343         USHORT LoadCount;
1344         USHORT OffsetToFileName;
1345         CHAR   ImageName[256];
1346     } SYSTEM_MODULE, *PSYSTEM_MODULE;
1347 
1348     typedef struct _SYSTEM_MODULE_INFORMATION
1349     {
1350         ULONG         ModulesCount;
1351         SYSTEM_MODULE Modules[1];
1352     } SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
1353 
1354     typedef struct _SYSTEM_LOCK_INFORMATION
1355     {
1356         PVOID  Address;
1357         USHORT  Type;
1358         USHORT  Reserved1;
1359         ULONG  ExclusiveOwnerThreadId;
1360         ULONG  ActiveCount;
1361         ULONG  ContentionCount;
1362         ULONG  Reserved2[2];
1363         ULONG  NumberOfSharedWaiters;
1364         ULONG  NumberOfExclusiveWaiters;
1365     } SYSTEM_LOCK_INFORMATION, *PSYSTEM_LOCK_INFORMATION;
1366 
1367     typedef struct _SYSTEM_HANDLE_INFORMATION
1368     {
1369         ULONG  ProcessId;
1370         UCHAR  ObjectTypeNumber;
1371         UCHAR  Flags;
1372         USHORT  Handle;
1373         PVOID  Object;
1374         ACCESS_MASK  GrantedAccess;
1375     } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
1376 
1377     typedef struct _SYSTEM_OBJECT_TYPE_INFORMATION
1378     {
1379         ULONG  NextEntryOffset;
1380         ULONG  ObjectCount;
1381         ULONG  HandleCount;
1382         ULONG  TypeNumber;
1383         ULONG  InvalidAttributes;
1384         GENERIC_MAPPING  GenericMapping;
1385         ACCESS_MASK  ValidAccessMask;
1386         POOL_TYPE  PoolType;
1387         UCHAR  Unknown;
1388         UNICODE_STRING  Name;
1389     } SYSTEM_OBJECT_TYPE_INFORMATION, *PSYSTEM_OBJECT_TYPE_INFORMATION;
1390 
1391     typedef struct _SYSTEM_OBJECT_INFORMATION
1392     {
1393         ULONG  NextEntryOffset;
1394         PVOID  Object;
1395         ULONG  CreatorProcessId;
1396         USHORT  Unknown;
1397         USHORT  Flags;
1398         ULONG  PointerCount;
1399         ULONG  HandleCount;
1400         ULONG  PagedPoolUsage;
1401         ULONG  NonPagedPoolUsage;
1402         ULONG  ExclusiveProcessId;
1403         PSECURITY_DESCRIPTOR  SecurityDescriptor;
1404         UNICODE_STRING  Name;
1405     } SYSTEM_OBJECT_INFORMATION, *PSYSTEM_OBJECT_INFORMATION;
1406 
1407     typedef struct _SYSTEM_PAGEFILE_INFORMATION
1408     {
1409         ULONG  NextEntryOffset;
1410         ULONG  CurrentSize;
1411         ULONG  TotalUsed;
1412         ULONG  PeakUsed;
1413         UNICODE_STRING  FileName;
1414     } SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION;
1415 
1416     typedef struct _SYSTEM_INSTRUCTION_EMULATION_INFORMATION
1417     {
1418         ULONG  SegmentNotPresent;
1419         ULONG  TwoByteOpcode;
1420         ULONG  ESprefix;
1421         ULONG  CSprefix;
1422         ULONG  SSprefix;
1423         ULONG  DSprefix;
1424         ULONG  FSPrefix;
1425         ULONG  GSprefix;
1426         ULONG  OPER32prefix;
1427         ULONG  ADDR32prefix;
1428         ULONG  INSB;
1429         ULONG  INSW;
1430         ULONG  OUTSB;
1431         ULONG  OUTSW;
1432         ULONG  PUSHFD;
1433         ULONG  POPFD;
1434         ULONG  INTnn;
1435         ULONG  INTO;
1436         ULONG  IRETD;
1437         ULONG  INBimm;
1438         ULONG  INWimm;
1439         ULONG  OUTBimm;
1440         ULONG  OUTWimm;
1441         ULONG  INB;
1442         ULONG  INW;
1443         ULONG  OUTB;
1444         ULONG  OUTW;
1445         ULONG  LOCKprefix;
1446         ULONG  REPNEprefix;
1447         ULONG  REPprefix;
1448         ULONG  HLT;
1449         ULONG  CLI;
1450         ULONG  STI;
1451         ULONG  GenericInvalidOpcode;
1452     } SYSTEM_INSTRUCTION_EMULATION_INFORMATION, *PSYSTEM_INSTRUCTION_EMULATION_INFORMATION;
1453 
1454     typedef struct _SYSTEM_POOL_TAG_INFORMATION
1455     {
1456         CHAR  Tag[4];
1457         ULONG  PagedPoolAllocs;
1458         ULONG  PagedPoolFrees;
1459         ULONG  PagedPoolUsage;
1460         ULONG  NonPagedPoolAllocs;
1461         ULONG  NonPagedPoolFrees;
1462         ULONG  NonPagedPoolUsage;
1463     } SYSTEM_POOL_TAG_INFORMATION, *PSYSTEM_POOL_TAG_INFORMATION;
1464 
1465     typedef struct _SYSTEM_PROCESSOR_STATISTICS
1466     {
1467         ULONG  ContextSwitches;
1468         ULONG  DpcCount;
1469         ULONG  DpcRequestRate;
1470         ULONG  TimeIncrement;
1471         ULONG  DpcBypassCount;
1472         ULONG  ApcBypassCount;
1473     } SYSTEM_PROCESSOR_STATISTICS, *PSYSTEM_PROCESSOR_STATISTICS;
1474 
1475     typedef struct _SYSTEM_DPC_INFORMATION
1476     {
1477         ULONG  Reserved;
1478         ULONG  MaximumDpcQueueDepth;
1479         ULONG  MinimumDpcRate;
1480         ULONG  AdjustDpcThreshold;
1481         ULONG  IdealDpcRate;
1482     } SYSTEM_DPC_INFORMATION, *PSYSTEM_DPC_INFORMATION;
1483 
1484     typedef struct _SYSTEM_LOAD_IMAGE
1485     {
1486         UNICODE_STRING  ModuleName;
1487         PVOID  ModuleBase;
1488         PVOID  SectionPointer;
1489         PVOID  EntryPoint;
1490         PVOID  ExportDirectory;
1491     } SYSTEM_LOAD_IMAGE, *PSYSTEM_LOAD_IMAGE;
1492 
1493     typedef struct _SYSTEM_UNLOAD_IMAGE
1494     {
1495         PVOID  ModuleBase;
1496     } SYSTEM_UNLOAD_IMAGE, *PSYSTEM_UNLOAD_IMAGE;
1497 
1498     typedef struct _SYSTEM_QUERY_TIME_ADJUSTMENT
1499     {
1500         ULONG  TimeAdjustment;
1501         ULONG  MaximumIncrement;
1502         BOOLEAN  TimeSynchronization;
1503     } SYSTEM_QUERY_TIME_ADJUSTMENT, *PSYSTEM_QUERY_TIME_ADJUSTMENT;
1504 
1505     typedef struct _SYSTEM_SET_TIME_ADJUSTMENT
1506     {
1507         ULONG  TimeAdjustment;
1508         BOOLEAN  TimeSynchronization;
1509     } SYSTEM_SET_TIME_ADJUSTMENT, *PSYSTEM_SET_TIME_ADJUSTMENT;
1510 
1511     typedef struct _SYSTEM_CRASH_DUMP_INFORMATION
1512     {
1513         HANDLE  CrashDumpSectionHandle;
1514         HANDLE  Unknown;
1515     } SYSTEM_CRASH_DUMP_INFORMATION, *PSYSTEM_CRASH_DUMP_INFORMATION;
1516 
1517     typedef struct _SYSTEM_EXCEPTION_INFORMATION
1518     {
1519         ULONG  AlignmentFixupCount;
1520         ULONG  ExceptionDispatchCount;
1521         ULONG  FloatingEmulationCount;
1522         ULONG  Reserved;
1523     } SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION;
1524 
1525     typedef struct _SYSTEM_CRASH_DUMP_STATE_INFORMATION
1526     {
1527         ULONG  CrashDumpSectionExists;
1528         ULONG  Unknown;
1529     } SYSTEM_CRASH_DUMP_STATE_INFORMATION, *PSYSTEM_CRASH_DUMP_STATE_INFORMATION;
1530 
1531     typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION
1532     {
1533         BOOLEAN KernelDebuggerEnabled;
1534         BOOLEAN KernelDebuggerNotPresent;
1535     } SYSTEM_KERNEL_DEBUGGER_INFORMATION, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION;
1536 
1537     typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION
1538     {
1539         ULONG  ContextSwitches;
1540         ULONG  ContextSwitchCounters[11];
1541     } SYSTEM_CONTEXT_SWITCH_INFORMATION, *PSYSTEM_CONTEXT_SWITCH_INFORMATION;
1542 
1543     typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION
1544     {
1545         ULONG RegistryQuotaAllowed;
1546         ULONG RegistryQuotaUsed;
1547         ULONG PagedPoolSize;
1548     } SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION;
1549 
1550     typedef struct _SYSTEM_LOAD_AND_CALL_IMAGE
1551     {
1552         UNICODE_STRING  ModuleName;
1553     } SYSTEM_LOAD_AND_CALL_IMAGE, *PSYSTEM_LOAD_AND_CALL_IMAGE;
1554 
1555     typedef struct _SYSTEM_PRIORITY_SEPARATION
1556     {
1557         ULONG  PrioritySeparation;
1558     } SYSTEM_PRIORITY_SEPARATION, *PSYSTEM_PRIORITY_SEPARATION;
1559 
1560     typedef struct _SYSTEM_TIME_ZONE_INFORMATION
1561     {
1562         LONG  Bias;
1563         WCHAR  StandardName[32];
1564         LARGE_INTEGER  StandardDate;
1565         LONG  StandardBias;
1566         WCHAR  DaylightName[32];
1567         LARGE_INTEGER  DaylightDate;
1568         LONG  DaylightBias;
1569     } SYSTEM_TIME_ZONE_INFORMATION, *PSYSTEM_TIME_ZONE_INFORMATION;
1570 
1571     typedef struct _SYSTEM_LOOKASIDE_INFORMATION
1572     {
1573         USHORT  Depth;
1574         USHORT  MaximumDepth;
1575         ULONG  TotalAllocates;
1576         ULONG  AllocateMisses;
1577         ULONG  TotalFrees;
1578         ULONG  FreeMisses;
1579         POOL_TYPE  Type;
1580         ULONG  Tag;
1581         ULONG  Size;
1582     } SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION;
1583 
1584     typedef struct _SYSTEM_SET_TIME_SLIP_EVENT
1585     {
1586         HANDLE  TimeSlipEvent;
1587     } SYSTEM_SET_TIME_SLIP_EVENT, *PSYSTEM_SET_TIME_SLIP_EVENT;
1588 
1589     typedef struct _SYSTEM_CREATE_SESSION
1590     {
1591         ULONG  SessionId;
1592     } SYSTEM_CREATE_SESSION, *PSYSTEM_CREATE_SESSION;
1593 
1594     typedef struct _SYSTEM_DELETE_SESSION
1595     {
1596         ULONG  SessionId;
1597     } SYSTEM_DELETE_SESSION, *PSYSTEM_DELETE_SESSION;
1598 
1599     typedef struct _SYSTEM_RANGE_START_INFORMATION
1600     {
1601         PVOID  SystemRangeStart;
1602     } SYSTEM_RANGE_START_INFORMATION, *PSYSTEM_RANGE_START_INFORMATION;
1603 
1604     typedef struct _SYSTEM_SESSION_PROCESSES_INFORMATION
1605     {
1606         ULONG  SessionId;
1607         ULONG  BufferSize;
1608         PVOID  Buffer;
1609     } SYSTEM_SESSION_PROCESSES_INFORMATION, *PSYSTEM_SESSION_PROCESSES_INFORMATION;
1610 
1611     typedef struct _SYSTEM_POOL_BLOCK
1612     {
1613         BOOLEAN  Allocated;
1614         USHORT  Unknown;
1615         ULONG  Size;
1616         CHAR  Tag[4];
1617     } SYSTEM_POOL_BLOCK, *PSYSTEM_POOL_BLOCK;
1618 
1619     typedef struct _SYSTEM_POOL_BLOCKS_INFORMATION
1620     {
1621         ULONG  PoolSize;
1622         PVOID  PoolBase;
1623         USHORT  Unknown;
1624         ULONG  NumberOfBlocks;
1625         SYSTEM_POOL_BLOCK  PoolBlocks[1];
1626     } SYSTEM_POOL_BLOCKS_INFORMATION, *PSYSTEM_POOL_BLOCKS_INFORMATION;
1627 
1628     typedef struct _SYSTEM_MEMORY_USAGE
1629     {
1630         PVOID  Name;
1631         USHORT  Valid;
1632         USHORT  Standby;
1633         USHORT  Modified;
1634         USHORT  PageTables;
1635     } SYSTEM_MEMORY_USAGE, *PSYSTEM_MEMORY_USAGE;
1636 
1637     typedef struct _SYSTEM_MEMORY_USAGE_INFORMATION
1638     {
1639         ULONG  Reserved;
1640         PVOID  EndOfData;
1641         SYSTEM_MEMORY_USAGE  MemoryUsage[1];
1642     } SYSTEM_MEMORY_USAGE_INFORMATION, *PSYSTEM_MEMORY_USAGE_INFORMATION;
1643 
1644     typedef struct _SYSDBG_PHYSICAL
1645     {
1646         PHYSICAL_ADDRESS Address;
1647         PVOID Buffer;
1648         ULONG Request;
1649     } SYSDBG_PHYSICAL, *PSYSDBG_PHYSICAL;
1650 
1651     typedef struct _SYSDBG_CONTROL_SPACE
1652     {
1653         ULONG64 Address;
1654         PVOID Buffer;
1655         ULONG Request;
1656         ULONG Processor;
1657     } SYSDBG_CONTROL_SPACE, *PSYSDBG_CONTROL_SPACE;
1658 
1659     typedef struct _SYSDBG_IO_SPACE
1660     {
1661         ULONG64 Address;
1662         PVOID Buffer;
1663         ULONG Request;
1664         INTERFACE_TYPE InterfaceType;
1665         ULONG BusNumber;
1666         ULONG AddressSpace;
1667     } SYSDBG_IO_SPACE, *PSYSDBG_IO_SPACE;
1668 
1669     typedef struct _SYSDBG_MSR
1670     {
1671         ULONG Msr;
1672         ULONG64 Data;
1673     } SYSDBG_MSR, *PSYSDBG_MSR;
1674 
1675     typedef struct _SYSDBG_BUS_DATA
1676     {
1677         ULONG Address;
1678         PVOID Buffer;
1679         ULONG Request;
1680         BUS_DATA_TYPE BusDataType;
1681         ULONG BusNumber;
1682         ULONG SlotNumber;
1683     } SYSDBG_BUS_DATA, *PSYSDBG_BUS_DATA;
1684 
1685     typedef struct _DBGKD_GET_VERSION
1686     {
1687         USHORT  MajorVersion;
1688         USHORT  MinorVersion;
1689         USHORT  ProtocolVersion;
1690         USHORT  Flags;
1691         USHORT  MachineType;
1692         UCHAR   MaxPacketType;
1693         UCHAR   MaxStateChange;
1694         UCHAR   MaxManipulate;
1695         UCHAR   Simulation;
1696         USHORT  Unused[1];
1697         ULONG64 KernBase;
1698         ULONG64 PsLoadedModuleList;
1699         ULONG64 DebuggerDataList;
1700     } DBGKD_GET_VERSION, *PDBGKD_GET_VERSION;
1701 
1702     typedef struct _SYSDBG_VIRTUAL
1703     {
1704         PVOID Address;
1705         PVOID Buffer;
1706         ULONG Request;
1707     } SYSDBG_VIRTUAL, *PSYSDBG_VIRTUAL;
1708 
1709     typedef struct _OBJECT_BASIC_INFORMATION
1710     {
1711         ULONG Attributes;
1712         ACCESS_MASK GrantedAccess;
1713         ULONG HandleCount;
1714         ULONG PointerCount;
1715         ULONG PagedPoolCharge;
1716         ULONG NonPagedPoolCharge;
1717         ULONG Reserved[3];
1718         ULONG NameInfoSize;
1719         ULONG TypeInfoSize;
1720         ULONG SecurityDescriptorSize;
1721         LARGE_INTEGER CreationTime;
1722     } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
1723 
1724     typedef struct _OBJECT_NAME_INFORMATION
1725     {
1726         UNICODE_STRING Name;
1727     } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
1728 
1729     typedef struct _OBJECT_TYPE_INFORMATION
1730     {
1731         UNICODE_STRING TypeName;
1732         ULONG TotalNumberOfObjects;
1733         ULONG TotalNumberOfHandles;
1734         ULONG TotalPagedPoolUsage;
1735         ULONG TotalNonPagedPoolUsage;
1736         ULONG TotalNamePoolUsage;
1737         ULONG TotalHandleTableUsage;
1738         ULONG HighWaterNumberOfObjects;
1739         ULONG HighWaterNumberOfHandles;
1740         ULONG HighWaterPagedPoolUsage;
1741         ULONG HighWaterNonPagedPoolUsage;
1742         ULONG HighWaterNamePoolUsage;
1743         ULONG HighWaterHandleTableUsage;
1744         ULONG InvalidAttributes;
1745         GENERIC_MAPPING GenericMapping;
1746         ULONG ValidAccessMask;
1747         BOOLEAN SecurityRequired;
1748         BOOLEAN MaintainHandleCount;
1749         POOL_TYPE PoolType;
1750         ULONG DefaultPagedPoolCharge;
1751         ULONG DefaultNonPagedPoolCharge;
1752     } OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;
1753 
1754     typedef struct _OBJECT_ALL_TYPES_INFORMATION
1755     {
1756         ULONG  NumberOfTypes;
1757         OBJECT_TYPE_INFORMATION  TypeInformation;
1758     } OBJECT_ALL_TYPES_INFORMATION, *POBJECT_ALL_TYPES_INFORMATION;
1759 
1760     typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFORMATION
1761     {
1762         BOOLEAN  Inherit;
1763         BOOLEAN  ProtectFromClose;
1764     } OBJECT_HANDLE_ATTRIBUTE_INFORMATION, *POBJECT_HANDLE_ATTRIBUTE_INFORMATION;
1765 
1766     typedef struct _OBJECT_HANDLE_FLAG_INFORMATION
1767     {
1768         BOOLEAN Inherit;
1769         BOOLEAN ProtectFromClose;
1770     } OBJECT_HANDLE_FLAG_INFORMATION, *POBJECT_HANDLE_FLAG_INFORMATION;
1771 
1772     typedef struct _OBJECT_DIRECTORY_INFORMATION
1773     {
1774         UNICODE_STRING Name;
1775         UNICODE_STRING TypeName;
1776     } OBJECT_DIRECTORY_INFORMATION, *POBJECT_DIRECTORY_INFORMATION;
1777 
1778     typedef struct _DIRECTORY_BASIC_INFORMATION
1779     {
1780         UNICODE_STRING  ObjectName;
1781         UNICODE_STRING  ObjectTypeName;
1782     } DIRECTORY_BASIC_INFORMATION, *PDIRECTORY_BASIC_INFORMATION;
1783 
1784     typedef struct _MEMORY_WORKING_SET_LIST
1785     {
1786         ULONG  NumberOfPages;
1787         ULONG  WorkingSetList[1];
1788     } MEMORY_WORKING_SET_LIST, *PMEMORY_WORKING_SET_LIST;
1789 
1790     typedef struct _MEMORY_SECTION_NAME
1791     {
1792         UNICODE_STRING  SectionFileName;
1793     } MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME;
1794 
1795     typedef struct _USER_STACK
1796     {
1797         PVOID  FixedStackBase;
1798         PVOID  FixedStackLimit;
1799         PVOID  ExpandableStackBase;
1800         PVOID  ExpandableStackLimit;
1801         PVOID  ExpandableStackBottom;
1802     } USER_STACK, *PUSER_STACK;
1803 
1804     typedef struct _THREAD_BASIC_INFORMATION
1805     {
1806         NTSTATUS  ExitStatus;
1807         PNT_TIB  TebBaseAddress;
1808         CLIENT_ID  ClientId;
1809         KAFFINITY  AffinityMask;
1810         KPRIORITY  Priority;
1811         KPRIORITY  BasePriority;
1812     } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
1813 
1814     typedef struct _KERNEL_USER_TIMES
1815     {
1816         LARGE_INTEGER  CreateTime;
1817         LARGE_INTEGER  ExitTime;
1818         LARGE_INTEGER  KernelTime;
1819         LARGE_INTEGER  UserTime;
1820     } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
1821 
1822     typedef struct _PROCESS_ACCESS_TOKEN
1823     {
1824         HANDLE  Token;
1825         HANDLE  Thread;
1826     } PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;
1827 
1828     typedef struct _POOLED_USAGE_AND_LIMITS
1829     {
1830         ULONG  PeakPagedPoolUsage;
1831         ULONG  PagedPoolUsage;
1832         ULONG  PagedPoolLimit;
1833         ULONG  PeakNonPagedPoolUsage;
1834         ULONG  NonPagedPoolUsage;
1835         ULONG  NonPagedPoolLimit;
1836         ULONG  PeakPagefileUsage;
1837         ULONG  PagefileUsage;
1838         ULONG  PagefileLimit;
1839     } POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS;
1840 
1841     typedef struct _PROCESS_WS_WATCH_INFORMATION
1842     {
1843         PVOID  FaultingPc;
1844         PVOID  FaultingVa;
1845     } PROCESS_WS_WATCH_INFORMATION, *PPROCESS_WS_WATCH_INFORMATION;
1846 
1847     typedef struct _PROCESS_PRIORITY_CLASS
1848     {
1849         BOOLEAN  Foreground;
1850         UCHAR  PriorityClass;
1851     } PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS;
1852 
1853     typedef struct _PROCESS_DEVICEMAP_INFORMATION
1854     {
1855         union
1856         {
1857             struct
1858             {
1859                 HANDLE DirectoryHandle;
1860             } Set;
1861             struct
1862             {
1863                 ULONG DriveMap;
1864                 UCHAR DriveType[32];
1865             } Query;
1866         };
1867     } PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION;
1868 
1869     typedef struct _PROCESS_SESSION_INFORMATION
1870     {
1871         ULONG  SessionId;
1872     } PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;
1873 
1874     typedef struct _DEBUG_BUFFER
1875     {
1876         HANDLE  SectionHandle;
1877         PVOID  SectionBase;
1878         PVOID  RemoteSectionBase;
1879         ULONG  SectionBaseDelta;
1880         HANDLE  EventPairHandle;
1881         ULONG  Unknown[2];
1882         HANDLE  RemoteThreadHandle;
1883         ULONG  InfoClassMask;
1884         ULONG  SizeOfInfo;
1885         ULONG  AllocatedSize;
1886         ULONG  SectionSize;
1887         PVOID  ModuleInformation;
1888         PVOID  BackTraceInformation;
1889         PVOID  HeapInformation;
1890         PVOID  LockInformation;
1891         PVOID  Reserved[8];
1892     } DEBUG_BUFFER, *PDEBUG_BUFFER;
1893 
1894     typedef struct _DEBUG_MODULE_INFORMATION
1895     {
1896         ULONG  Reserved[2];
1897         ULONG  Base;
1898         ULONG  Size;
1899         ULONG  Flags;
1900         USHORT  Index;
1901         USHORT  Unknown;
1902         USHORT  LoadCount;
1903         USHORT  ModuleNameOffset;
1904         CHAR  ImageName[256];
1905     } DEBUG_MODULE_INFORMATION, *PDEBUG_MODULE_INFORMATION;
1906 
1907     typedef struct _DEBUG_HEAP_INFORMATION
1908     {
1909         ULONG  Base;
1910         ULONG  Flags;
1911         USHORT  Granularity;
1912         USHORT  Unknown;
1913         ULONG  Allocated;
1914         ULONG  Committed;
1915         ULONG  TagCount;
1916         ULONG  BlockCount;
1917         ULONG  Reserved[7];
1918         PVOID  Tags;
1919         PVOID  Blocks;
1920     } DEBUG_HEAP_INFORMATION, *PDEBUG_HEAP_INFORMATION;
1921 
1922     typedef struct _DEBUG_LOCK_INFORMATION
1923     {
1924         PVOID  Address;
1925         USHORT  Type;
1926         USHORT  CreatorBackTraceIndex;
1927         ULONG  OwnerThreadId;
1928         ULONG  ActiveCount;
1929         ULONG  ContentionCount;
1930         ULONG  EntryCount;
1931         ULONG  RecursionCount;
1932         ULONG  NumberOfSharedWaiters;
1933         ULONG  NumberOfExclusiveWaiters;
1934     } DEBUG_LOCK_INFORMATION, *PDEBUG_LOCK_INFORMATION;
1935 
1936     typedef struct _LPC_MESSAGE
1937     {
1938         USHORT  DataSize;
1939         USHORT  MessageSize;
1940         USHORT  MessageType;
1941         USHORT  VirtualRangesOffset;
1942         CLIENT_ID  ClientId;
1943         ULONG  MessageId;
1944         ULONG  SectionSize;
1945         UCHAR  Data[ANYSIZE_ARRAY];
1946     } LPC_MESSAGE, *PLPC_MESSAGE;
1947 
1948     typedef struct _LPC_SECTION_WRITE
1949     {
1950         ULONG  Length;
1951         HANDLE  SectionHandle;
1952         ULONG  SectionOffset;
1953         ULONG  ViewSize;
1954         PVOID  ViewBase;
1955         PVOID  TargetViewBase;
1956     } LPC_SECTION_WRITE, *PLPC_SECTION_WRITE;
1957 
1958     typedef struct _LPC_SECTION_READ
1959     {
1960         ULONG  Length;
1961         ULONG  ViewSize;
1962         PVOID  ViewBase;
1963     } LPC_SECTION_READ, *PLPC_SECTION_READ;
1964 
1965     typedef struct _KEY_LAST_WRITE_TIME_INFORMATION
1966     {
1967         LARGE_INTEGER LastWriteTime;
1968     } KEY_LAST_WRITE_TIME_INFORMATION, *PKEY_LAST_WRITE_TIME_INFORMATION;
1969 
1970     typedef struct _KEY_NAME_INFORMATION
1971     {
1972         ULONG NameLength;
1973         WCHAR Name[1];
1974     } KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION;
1975 
1976     typedef struct _ATOM_BASIC_INFORMATION
1977     {
1978         USHORT  ReferenceCount;
1979         USHORT  Pinned;
1980         USHORT  NameLength;
1981         WCHAR  Name[1];
1982     } ATOM_BASIC_INFORMATION, *PATOM_BASIC_INFORMATION;
1983 
1984     typedef struct _ATOM_LIST_INFORMATION
1985     {
1986         ULONG  NumberOfAtoms;
1987         ATOM  Atoms[1];
1988     } ATOM_LIST_INFORMATION, *PATOM_LIST_INFORMATION;
1989 
1990     typedef struct _RTL_SPLAY_LINKS
1991     {
1992         struct _RTL_SPLAY_LINKS *Parent;
1993         struct _RTL_SPLAY_LINKS *LeftChild;
1994         struct _RTL_SPLAY_LINKS *RightChild;
1995     } RTL_SPLAY_LINKS, *PRTL_SPLAY_LINKS;
1996 
1997     typedef struct _RTL_HANDLE_TABLE_ENTRY
1998     {
1999         struct _RTL_HANDLE_TABLE_ENTRY *Next;
2000         PVOID  Object;
2001     } RTL_HANDLE_TABLE_ENTRY, *PRTL_HANDLE_TABLE_ENTRY;
2002 
2003     typedef struct _RTL_HANDLE_TABLE
2004     {
2005         ULONG MaximumNumberOfHandles;
2006         ULONG SizeOfHandleTableEntry;
2007         ULONG Unknown01;
2008         ULONG Unknown02;
2009         PRTL_HANDLE_TABLE_ENTRY FreeHandles;
2010         PRTL_HANDLE_TABLE_ENTRY CommittedHandles;
2011         PRTL_HANDLE_TABLE_ENTRY UnCommittedHandles;
2012         PRTL_HANDLE_TABLE_ENTRY MaxReservedHandles;
2013     } RTL_HANDLE_TABLE, *PRTL_HANDLE_TABLE;
2014 
2015     typedef struct _KEY_BASIC_INFORMATION
2016     {
2017         LARGE_INTEGER LastWriteTime;
2018         ULONG   TitleIndex;
2019         ULONG   NameLength;
2020         WCHAR   Name[1];
2021     } KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;
2022 
2023     typedef struct _KEY_NODE_INFORMATION
2024     {
2025         LARGE_INTEGER LastWriteTime;
2026         ULONG   TitleIndex;
2027         ULONG   ClassOffset;
2028         ULONG   ClassLength;
2029         ULONG   NameLength;
2030         WCHAR   Name[1];
2031     } KEY_NODE_INFORMATION, *PKEY_NODE_INFORMATION;
2032 
2033     typedef struct _KEY_FULL_INFORMATION
2034     {
2035         LARGE_INTEGER LastWriteTime;
2036         ULONG   TitleIndex;
2037         ULONG   ClassOffset;
2038         ULONG   ClassLength;
2039         ULONG   SubKeys;
2040         ULONG   MaxNameLen;
2041         ULONG   MaxClassLen;
2042         ULONG   Values;
2043         ULONG   MaxValueNameLen;
2044         ULONG   MaxValueDataLen;
2045         WCHAR   Class[1];
2046     } KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION;
2047 
2048     typedef struct _KEY_CACHED_INFORMATION
2049     {
2050         LARGE_INTEGER LastWriteTime;
2051         ULONG   TitleIndex;
2052         ULONG   SubKeys;
2053         ULONG   MaxNameLen;
2054         ULONG   Values;
2055         ULONG   MaxValueNameLen;
2056         ULONG   MaxValueDataLen;
2057         ULONG   NameLength;
2058         WCHAR   Name[1];
2059     } KEY_CACHED_INFORMATION, *PKEY_CACHED_INFORMATION;
2060 
2061     typedef struct _KEY_FLAGS_INFORMATION
2062     {
2063         ULONG   UserFlags;
2064     } KEY_FLAGS_INFORMATION, *PKEY_FLAGS_INFORMATION;
2065 
2066     typedef struct _KEY_VALUE_BASIC_INFORMATION
2067     {
2068         ULONG TitleIndex;
2069         ULONG Type;
2070         ULONG NameLength;
2071         WCHAR Name[1];
2072     } KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION;
2073 
2074     typedef struct _KEY_VALUE_FULL_INFORMATION
2075     {
2076         ULONG TitleIndex;
2077         ULONG Type;
2078         ULONG DataOffset;
2079         ULONG DataLength;
2080         ULONG NameLength;
2081         WCHAR Name[1];
2082     } KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;
2083 
2084     typedef struct _KEY_VALUE_PARTIAL_INFORMATION
2085     {
2086         ULONG   TitleIndex;
2087         ULONG   Type;
2088         ULONG   DataLength;
2089         UCHAR   Data[1];
2090     } KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;
2091 
2092     typedef struct _SYSTEM_TIMEOFDAY_INFORMATION
2093     {
2094         LARGE_INTEGER BootTime;
2095         LARGE_INTEGER CurrentTime;
2096         LARGE_INTEGER TimeZoneBias;
2097         ULONG TimeZoneId;
2098         ULONG Reserved;
2099     } SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION;
2100 
2101     typedef struct _SYSTEM_PROCESS_INFORMATION
2102     {
2103         ULONG NextEntryOffset;
2104         ULONG NumberOfThreads;
2105         LARGE_INTEGER SpareLi1;
2106         LARGE_INTEGER SpareLi2;
2107         LARGE_INTEGER SpareLi3;
2108         LARGE_INTEGER CreateTime;
2109         LARGE_INTEGER UserTime;
2110         LARGE_INTEGER KernelTime;
2111         UNICODE_STRING ImageName;
2112         KPRIORITY BasePriority;
2113         ULONG_PTR UniqueProcessId;
2114         ULONG_PTR InheritedFromUniqueProcessId;
2115         ULONG HandleCount;
2116     } SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
2117 
2118     typedef struct _SYSTEM_DEVICE_INFORMATION
2119     {
2120         ULONG NumberOfDisks;
2121         ULONG NumberOfFloppies;
2122         ULONG NumberOfCdRoms;
2123         ULONG NumberOfTapes;
2124         ULONG NumberOfSerialPorts;
2125         ULONG NumberOfParallelPorts;
2126     } SYSTEM_DEVICE_INFORMATION, *PSYSTEM_DEVICE_INFORMATION;
2127 
2128     typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
2129     {
2130         LARGE_INTEGER IdleTime;
2131         LARGE_INTEGER KernelTime;
2132         LARGE_INTEGER UserTime;
2133         LARGE_INTEGER DpcTime;
2134         LARGE_INTEGER InterruptTime;
2135         ULONG InterruptCount;
2136     } SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;
2137 
2138     typedef struct _SYSTEM_FLAGS_INFORMATION
2139     {
2140         ULONG GlobalFlag;
2141     } SYSTEM_FLAGS_INFORMATION, *PSYSTEM_FLAGS_INFORMATION;
2142 
2143     typedef struct _SYSTEM_VDM_INSTEMUL_INFO
2144     {
2145         ULONG SegmentNotPresent;
2146         ULONG VdmOpcode0F;
2147         ULONG OpcodeESPrefix;
2148         ULONG OpcodeCSPrefix;
2149         ULONG OpcodeSSPrefix;
2150         ULONG OpcodeDSPrefix;
2151         ULONG OpcodeFSPrefix;
2152         ULONG OpcodeGSPrefix;
2153         ULONG OpcodeOPER32Prefix;
2154         ULONG OpcodeADDR32Prefix;
2155         ULONG OpcodeINSB;
2156         ULONG OpcodeINSW;
2157         ULONG OpcodeOUTSB;
2158         ULONG OpcodeOUTSW;
2159         ULONG OpcodePUSHF;
2160         ULONG OpcodePOPF;
2161         ULONG OpcodeINTnn;
2162         ULONG OpcodeINTO;
2163         ULONG OpcodeIRET;
2164         ULONG OpcodeINBimm;
2165         ULONG OpcodeINWimm;
2166         ULONG OpcodeOUTBimm;
2167         ULONG OpcodeOUTWimm;
2168         ULONG OpcodeINB;
2169         ULONG OpcodeINW;
2170         ULONG OpcodeOUTB;
2171         ULONG OpcodeOUTW;
2172         ULONG OpcodeLOCKPrefix;
2173         ULONG OpcodeREPNEPrefix;
2174         ULONG OpcodeREPPrefix;
2175         ULONG OpcodeHLT;
2176         ULONG OpcodeCLI;
2177         ULONG OpcodeSTI;
2178         ULONG BopCount;
2179     } SYSTEM_VDM_INSTEMUL_INFO, *PSYSTEM_VDM_INSTEMUL_INFO;
2180 
2181     typedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION
2182     {
2183         ULONG TimeAdjustment;
2184         ULONG TimeIncrement;
2185         BOOLEAN Enable;
2186     } SYSTEM_QUERY_TIME_ADJUST_INFORMATION, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION;
2187 
2188     typedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION
2189     {
2190         ULONG TimeAdjustment;
2191         BOOLEAN Enable;
2192     } SYSTEM_SET_TIME_ADJUST_INFORMATION, *PSYSTEM_SET_TIME_ADJUST_INFORMATION;
2193 
2194     typedef struct _SYSTEM_THREAD_INFORMATION
2195     {
2196         LARGE_INTEGER KernelTime;
2197         LARGE_INTEGER UserTime;
2198         LARGE_INTEGER CreateTime;
2199         ULONG WaitTime;
2200         PVOID StartAddress;
2201         CLIENT_ID ClientId;
2202         KPRIORITY Priority;
2203         LONG BasePriority;
2204         ULONG ContextSwitches;
2205         ULONG ThreadState;
2206         ULONG WaitReason;
2207     } SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
2208 
2209     typedef struct _SYSTEM_MEMORY_INFO
2210     {
2211         PUCHAR StringOffset;
2212         USHORT ValidCount;
2213         USHORT TransitionCount;
2214         USHORT ModifiedCount;
2215         USHORT PageTableCount;
2216     } SYSTEM_MEMORY_INFO, *PSYSTEM_MEMORY_INFO;
2217 
2218     typedef struct _SYSTEM_MEMORY_INFORMATION
2219     {
2220         ULONG InfoSize;
2221         ULONG StringStart;
2222         SYSTEM_MEMORY_INFO Memory[1];
2223     } SYSTEM_MEMORY_INFORMATION, *PSYSTEM_MEMORY_INFORMATION;
2224 
2225     typedef struct _SYSTEM_CRASH_STATE_INFORMATION
2226     {
2227         ULONG ValidCrashDump;
2228     } SYSTEM_CRASH_STATE_INFORMATION, *PSYSTEM_CRASH_STATE_INFORMATION;
2229 
2230     typedef struct _SYSTEM_GDI_DRIVER_INFORMATION
2231     {
2232         UNICODE_STRING DriverName;
2233         PVOID ImageAddress;
2234         PVOID SectionPointer;
2235         PVOID EntryPoint;
2236         PIMAGE_EXPORT_DIRECTORY ExportSectionPointer;
2237         ULONG ImageLength;
2238     } SYSTEM_GDI_DRIVER_INFORMATION, *PSYSTEM_GDI_DRIVER_INFORMATION;
2239 
2240     typedef struct _SYSTEM_BOOT_ENVIRONMENT_INFORMATION
2241     {
2242         GUID  CurrentBootGuid;
2243         ULONG Unknown;
2244     } SYSTEM_BOOT_ENVIRONMENT_INFORMATION, *PSYSTEM_BOOT_ENVIRONMENT_INFORMATION;
2245 
2246     typedef struct _FILE_DIRECTORY_INFORMATION
2247     {
2248         ULONG NextEntryOffset;
2249         ULONG FileIndex;
2250         LARGE_INTEGER CreationTime;
2251         LARGE_INTEGER LastAccessTime;
2252         LARGE_INTEGER LastWriteTime;
2253         LARGE_INTEGER ChangeTime;
2254         LARGE_INTEGER EndOfFile;
2255         LARGE_INTEGER AllocationSize;
2256         ULONG FileAttributes;
2257         ULONG FileNameLength;
2258         WCHAR FileName[1];
2259     } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
2260 
2261     typedef struct _FILE_FULL_DIR_INFORMATION
2262     {
2263         ULONG NextEntryOffset;
2264         ULONG FileIndex;
2265         LARGE_INTEGER CreationTime;
2266         LARGE_INTEGER LastAccessTime;
2267         LARGE_INTEGER LastWriteTime;
2268         LARGE_INTEGER ChangeTime;
2269         LARGE_INTEGER EndOfFile;
2270         LARGE_INTEGER AllocationSize;
2271         ULONG FileAttributes;
2272         ULONG FileNameLength;
2273         ULONG EaSize;
2274         WCHAR FileName[1];
2275     } FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
2276 
2277     typedef struct _FILE_BOTH_DIR_INFORMATION
2278     {
2279         ULONG NextEntryOffset;
2280         ULONG FileIndex;
2281         LARGE_INTEGER CreationTime;
2282         LARGE_INTEGER LastAccessTime;
2283         LARGE_INTEGER LastWriteTime;
2284         LARGE_INTEGER ChangeTime;
2285         LARGE_INTEGER EndOfFile;
2286         LARGE_INTEGER AllocationSize;
2287         ULONG FileAttributes;
2288         ULONG FileNameLength;
2289         ULONG EaSize;
2290         CCHAR ShortNameLength;
2291         WCHAR ShortName[12];
2292         WCHAR FileName[1];
2293     } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
2294 
2295     typedef struct _FILE_BASIC_INFORMATION
2296     {
2297         LARGE_INTEGER CreationTime;
2298         LARGE_INTEGER LastAccessTime;
2299         LARGE_INTEGER LastWriteTime;
2300         LARGE_INTEGER ChangeTime;
2301         ULONG FileAttributes;
2302     } FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
2303 
2304     typedef struct _FILE_STANDARD_INFORMATION
2305     {
2306         LARGE_INTEGER AllocationSize;
2307         LARGE_INTEGER EndOfFile;
2308         ULONG NumberOfLinks;
2309         BOOLEAN DeletePending;
2310         BOOLEAN Directory;
2311     } FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;
2312 
2313     typedef struct _FILE_INTERNAL_INFORMATION
2314     {
2315         LARGE_INTEGER IndexNumber;
2316     } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
2317 
2318     typedef struct _FILE_EA_INFORMATION
2319     {
2320         ULONG EaSize;
2321     } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
2322 
2323     typedef struct _FILE_ACCESS_INFORMATION
2324     {
2325         ACCESS_MASK AccessFlags;
2326     } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
2327 
2328     typedef struct _FILE_NAME_INFORMATION
2329     {
2330         ULONG FileNameLength;
2331         WCHAR FileName[1];
2332     } FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;
2333 
2334     typedef struct _FILE_RENAME_INFORMATION
2335     {
2336         BOOLEAN ReplaceIfExists;
2337         HANDLE RootDirectory;
2338         ULONG FileNameLength;
2339         WCHAR FileName[1];
2340     } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
2341 
2342     typedef struct _FILE_NAMES_INFORMATION
2343     {
2344         ULONG NextEntryOffset;
2345         ULONG FileIndex;
2346         ULONG FileNameLength;
2347         WCHAR FileName[1];
2348     } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
2349 
2350     typedef struct _FILE_DISPOSITION_INFORMATION
2351     {
2352         BOOLEAN DeleteFile;
2353     } FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;
2354 
2355     typedef struct _FILE_POSITION_INFORMATION
2356     {
2357         LARGE_INTEGER CurrentByteOffset;
2358     } FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;
2359 
2360     typedef struct _FILE_FULL_EA_INFORMATION
2361     {
2362         ULONG NextEntryOffset;
2363         UCHAR Flags;
2364         UCHAR EaNameLength;
2365         USHORT EaValueLength;
2366         CHAR EaName[1];
2367     } FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;
2368 
2369     typedef struct _FILE_MODE_INFORMATION
2370     {
2371         ULONG Mode;
2372     } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
2373 
2374     typedef struct _FILE_ALIGNMENT_INFORMATION
2375     {
2376         ULONG AlignmentRequirement;
2377     } FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION;
2378 
2379     typedef struct _FILE_ALL_INFORMATION
2380     {
2381         FILE_BASIC_INFORMATION BasicInformation;
2382         FILE_STANDARD_INFORMATION StandardInformation;
2383         FILE_INTERNAL_INFORMATION InternalInformation;
2384         FILE_EA_INFORMATION EaInformation;
2385         FILE_ACCESS_INFORMATION AccessInformation;
2386         FILE_POSITION_INFORMATION PositionInformation;
2387         FILE_MODE_INFORMATION ModeInformation;
2388         FILE_ALIGNMENT_INFORMATION AlignmentInformation;
2389         FILE_NAME_INFORMATION NameInformation;
2390     } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
2391 
2392     typedef struct _FILE_ALLOCATION_INFORMATION
2393     {
2394         LARGE_INTEGER AllocationSize;
2395     } FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;
2396 
2397     typedef struct _FILE_END_OF_FILE_INFORMATION
2398     {
2399         LARGE_INTEGER EndOfFile;
2400     } FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;
2401 
2402     typedef struct _FILE_STREAM_INFORMATION
2403     {
2404         ULONG NextEntryOffset;
2405         ULONG StreamNameLength;
2406         LARGE_INTEGER StreamSize;
2407         LARGE_INTEGER StreamAllocationSize;
2408         WCHAR StreamName[1];
2409     } FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;
2410 
2411     typedef struct _FILE_PIPE_INFORMATION
2412     {
2413         ULONG ReadMode;
2414         ULONG CompletionMode;
2415     } FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;
2416 
2417     typedef struct _FILE_PIPE_LOCAL_INFORMATION
2418     {
2419         ULONG NamedPipeType;
2420         ULONG NamedPipeConfiguration;
2421         ULONG MaximumInstances;
2422         ULONG CurrentInstances;
2423         ULONG InboundQuota;
2424         ULONG ReadDataAvailable;
2425         ULONG OutboundQuota;
2426         ULONG WriteQuotaAvailable;
2427         ULONG NamedPipeState;
2428         ULONG NamedPipeEnd;
2429     } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
2430 
2431     typedef struct _FILE_PIPE_REMOTE_INFORMATION
2432     {
2433         LARGE_INTEGER CollectDataTime;
2434         ULONG MaximumCollectionCount;
2435     } FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION;
2436 
2437     typedef struct _FILE_MAILSLOT_QUERY_INFORMATION
2438     {
2439         ULONG MaximumMessageSize;
2440         ULONG MailslotQuota;
2441         ULONG NextMessageSize;
2442         ULONG MessagesAvailable;
2443         LARGE_INTEGER ReadTimeout;
2444     } FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION;
2445 
2446     typedef struct _FILE_MAILSLOT_SET_INFORMATION
2447     {
2448         PLARGE_INTEGER ReadTimeout;
2449     } FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
2450 
2451     typedef struct _FILE_COMPRESSION_INFORMATION
2452     {
2453         LARGE_INTEGER CompressedFileSize;
2454         USHORT CompressionFormat;
2455         UCHAR CompressionUnitShift;
2456         UCHAR ChunkShift;
2457         UCHAR ClusterShift;
2458         UCHAR Reserved[3];
2459     } FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
2460 
2461     typedef struct _FILE_LINK_INFORMATION
2462     {
2463         BOOLEAN ReplaceIfExists;
2464         HANDLE RootDirectory;
2465         ULONG FileNameLength;
2466         WCHAR FileName[1];
2467     } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
2468 
2469     typedef struct _FILE_OBJECTID_INFORMATION
2470     {
2471         LONGLONG FileReference;
2472         UCHAR ObjectId[16];
2473         union
2474         {
2475             struct
2476             {
2477                 UCHAR BirthVolumeId[16];
2478                 UCHAR BirthObjectId[16];
2479                 UCHAR DomainId[16];
2480             };
2481             UCHAR ExtendedInfo[48];
2482         };
2483     } FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION;
2484 
2485     typedef struct _FILE_COMPLETION_INFORMATION
2486     {
2487         HANDLE Port;
2488         PVOID Key;
2489     } FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;
2490 
2491     typedef struct _FILE_MOVE_CLUSTER_INFORMATION
2492     {
2493         ULONG ClusterCount;
2494         HANDLE RootDirectory;
2495         ULONG FileNameLength;
2496         WCHAR FileName[1];
2497     } FILE_MOVE_CLUSTER_INFORMATION, *PFILE_MOVE_CLUSTER_INFORMATION;
2498 
2499     typedef struct _FILE_ATTRIBUTE_TAG_INFORMATION
2500     {
2501         ULONG FileAttributes;
2502         ULONG ReparseTag;
2503     } FILE_ATTRIBUTE_TAG_INFORMATION, *PFILE_ATTRIBUTE_TAG_INFORMATION;
2504 
2505     typedef struct _FILE_TRACKING_INFORMATION
2506     {
2507         HANDLE DestinationFile;
2508         ULONG ObjectInformationLength;
2509         CHAR ObjectInformation[1];
2510     } FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION;
2511 
2512     typedef struct _FILE_REPARSE_POINT_INFORMATION
2513     {
2514         LONGLONG FileReference;
2515         ULONG Tag;
2516     } FILE_REPARSE_POINT_INFORMATION, *PFILE_REPARSE_POINT_INFORMATION;
2517 
2518     typedef struct _FILE_QUOTA_INFORMATION
2519     {
2520         ULONG NextEntryOffset;
2521         ULONG SidLength;
2522         LARGE_INTEGER ChangeTime;
2523         LARGE_INTEGER QuotaUsed;
2524         LARGE_INTEGER QuotaThreshold;
2525         LARGE_INTEGER QuotaLimit;
2526         SID Sid;
2527     } FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION;
2528 
2529     typedef struct _FILE_ID_BOTH_DIR_INFORMATION
2530     {
2531         ULONG NextEntryOffset;
2532         ULONG FileIndex;
2533         LARGE_INTEGER CreationTime;
2534         LARGE_INTEGER LastAccessTime;
2535         LARGE_INTEGER LastWriteTime;
2536         LARGE_INTEGER ChangeTime;
2537         LARGE_INTEGER EndOfFile;
2538         LARGE_INTEGER AllocationSize;
2539         ULONG FileAttributes;
2540         ULONG FileNameLength;
2541         ULONG EaSize;
2542         CCHAR ShortNameLength;
2543         WCHAR ShortName[12];
2544         LARGE_INTEGER FileId;
2545         WCHAR FileName[1];
2546     } FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;
2547 
2548     typedef struct _FILE_ID_FULL_DIR_INFORMATION
2549     {
2550         ULONG NextEntryOffset;
2551         ULONG FileIndex;
2552         LARGE_INTEGER CreationTime;
2553         LARGE_INTEGER LastAccessTime;
2554         LARGE_INTEGER LastWriteTime;
2555         LARGE_INTEGER ChangeTime;
2556         LARGE_INTEGER EndOfFile;
2557         LARGE_INTEGER AllocationSize;
2558         ULONG FileAttributes;
2559         ULONG FileNameLength;
2560         ULONG EaSize;
2561         LARGE_INTEGER FileId;
2562         WCHAR FileName[1];
2563     } FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION;
2564 
2565     typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION
2566     {
2567         LARGE_INTEGER ValidDataLength;
2568     } FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION;
2569 
2570     typedef  struct _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION
2571     {
2572         ULONG Flags;
2573     } FILE_IO_COMPLETION_NOTIFICATION_INFORMATION, *PFILE_IO_COMPLETION_NOTIFICATION_INFORMATION;
2574 
2575     typedef  struct _FILE_PROCESS_IDS_USING_FILE_INFORMATION
2576     {
2577         ULONG NumberOfProcessIdsInList;
2578         ULONG_PTR ProcessIdList[1];
2579     } FILE_PROCESS_IDS_USING_FILE_INFORMATION, *PFILE_PROCESS_IDS_USING_FILE_INFORMATION;
2580 
2581     typedef struct _FILE_IOSTATUSBLOCK_RANGE_INFORMATION
2582     {
2583         PUCHAR       IoStatusBlockRange;
2584         ULONG        Length;
2585     } FILE_IOSTATUSBLOCK_RANGE_INFORMATION, *PFILE_IOSTATUSBLOCK_RANGE_INFORMATION;
2586 
2587     typedef struct _FILE_IO_PRIORITY_HINT_INFORMATION
2588     {
2589         IO_PRIORITY_HINT   PriorityHint;
2590     } FILE_IO_PRIORITY_HINT_INFORMATION, *PFILE_IO_PRIORITY_HINT_INFORMATION;
2591 
2592     typedef struct _FILE_SFIO_RESERVE_INFORMATION
2593     {
2594         ULONG RequestsPerPeriod;
2595         ULONG Period;
2596         BOOLEAN RetryFailures;
2597         BOOLEAN Discardable;
2598         ULONG RequestSize;
2599         ULONG NumOutstandingRequests;
2600     } FILE_SFIO_RESERVE_INFORMATION, *PFILE_SFIO_RESERVE_INFORMATION;
2601 
2602     typedef struct _FILE_SFIO_VOLUME_INFORMATION
2603     {
2604         ULONG MaximumRequestsPerPeriod;
2605         ULONG MinimumPeriod;
2606         ULONG MinimumTransferSize;
2607     } FILE_SFIO_VOLUME_INFORMATION, *PFILE_SFIO_VOLUME_INFORMATION;
2608 
2609     typedef struct _FILE_LINK_ENTRY_INFORMATION
2610     {
2611         ULONG NextEntryOffset;
2612         LONGLONG ParentFileId;
2613         ULONG FileNameLength;
2614         WCHAR FileName[1];
2615     } FILE_LINK_ENTRY_INFORMATION, *PFILE_LINK_ENTRY_INFORMATION;
2616 
2617     typedef struct _FILE_LINKS_INFORMATION
2618     {
2619         ULONG BytesNeeded;
2620         ULONG EntriesReturned;
2621         FILE_LINK_ENTRY_INFORMATION Entry;
2622     } FILE_LINKS_INFORMATION, *PFILE_LINKS_INFORMATION;
2623 
2624     typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION
2625     {
2626         ULONG          NextEntryOffset;
2627         ULONG          FileIndex;
2628         LARGE_INTEGER  CreationTime;
2629         LARGE_INTEGER  LastAccessTime;
2630         LARGE_INTEGER  LastWriteTime;
2631         LARGE_INTEGER  ChangeTime;
2632         LARGE_INTEGER  EndOfFile;
2633         LARGE_INTEGER  AllocationSize;
2634         ULONG          FileAttributes;
2635         ULONG          FileNameLength;
2636         LARGE_INTEGER  FileId;
2637         GUID           LockingTransactionId;
2638         ULONG          TxInfoFlags;
2639         WCHAR          FileName[1];
2640     } FILE_ID_GLOBAL_TX_DIR_INFORMATION, *PFILE_ID_GLOBAL_TX_DIR_INFORMATION;
2641 
2642     typedef struct _FILE_IS_REMOTE_DEVICE_INFORMATION
2643     {
2644         BOOLEAN IsRemote;
2645     } FILE_IS_REMOTE_DEVICE_INFORMATION, *PFILE_IS_REMOTE_DEVICE_INFORMATION;
2646 
2647     typedef struct _FILE_NUMA_NODE_INFORMATION
2648     {
2649         USHORT NodeNumber;
2650     } FILE_NUMA_NODE_INFORMATION, *PFILE_NUMA_NODE_INFORMATION;
2651 
2652     typedef struct _FILE_FS_VOLUME_INFORMATION
2653     {
2654         LARGE_INTEGER VolumeCreationTime;
2655         ULONG VolumeSerialNumber;
2656         ULONG VolumeLabelLength;
2657         BOOLEAN SupportsObjects;
2658         WCHAR VolumeLabel[1];
2659     } FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
2660 
2661     typedef struct _FILE_FS_LABEL_INFORMATION
2662     {
2663         ULONG VolumeLabelLength;
2664         WCHAR VolumeLabel[1];
2665     } FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
2666 
2667     typedef struct _FILE_FS_SIZE_INFORMATION
2668     {
2669         LARGE_INTEGER TotalAllocationUnits;
2670         LARGE_INTEGER AvailableAllocationUnits;
2671         ULONG SectorsPerAllocationUnit;
2672         ULONG BytesPerSector;
2673     } FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
2674 
2675     typedef struct _FILE_FS_DEVICE_INFORMATION
2676     {
2677         DEVICE_TYPE DeviceType;
2678         ULONG Characteristics;
2679     } FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;
2680 
2681     typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
2682     {
2683         ULONG FileSystemAttributes;
2684         LONG MaximumComponentNameLength;
2685         ULONG FileSystemNameLength;
2686         WCHAR FileSystemName[1];
2687     } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
2688 
2689     typedef struct _FILE_FS_CONTROL_INFORMATION
2690     {
2691         LARGE_INTEGER FreeSpaceStartFiltering;
2692         LARGE_INTEGER FreeSpaceThreshold;
2693         LARGE_INTEGER FreeSpaceStopFiltering;
2694         LARGE_INTEGER DefaultQuotaThreshold;
2695         LARGE_INTEGER DefaultQuotaLimit;
2696         ULONG FileSystemControlFlags;
2697     } FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;
2698 
2699     typedef struct _FILE_FS_FULL_SIZE_INFORMATION
2700     {
2701         LARGE_INTEGER TotalAllocationUnits;
2702         LARGE_INTEGER CallerAvailableAllocationUnits;
2703         LARGE_INTEGER ActualAvailableAllocationUnits;
2704         ULONG SectorsPerAllocationUnit;
2705         ULONG BytesPerSector;
2706     } FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
2707 
2708     typedef struct _FILE_FS_OBJECTID_INFORMATION
2709     {
2710         UCHAR ObjectId[16];
2711         UCHAR ExtendedInfo[48];
2712     } FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION;
2713 
2714     typedef struct _FILE_FS_DRIVER_PATH_INFORMATION
2715     {
2716         BOOLEAN DriverInPath;
2717         ULONG   DriverNameLength;
2718         WCHAR   DriverName[1];
2719     } FILE_FS_DRIVER_PATH_INFORMATION, *PFILE_FS_DRIVER_PATH_INFORMATION;
2720 
2721     typedef struct _FILE_FS_VOLUME_FLAGS_INFORMATION
2722     {
2723         ULONG Flags;
2724     } FILE_FS_VOLUME_FLAGS_INFORMATION, *PFILE_FS_VOLUME_FLAGS_INFORMATION;
2725 
2726     typedef struct _SECTION_IMAGE_INFORMATION
2727     {
2728         PVOID TransferAddress;
2729         ULONG ZeroBits;
2730         ULONG_PTR MaximumStackSize;
2731         ULONG_PTR CommittedStackSize;
2732         ULONG SubSystemType;
2733         union _SECTION_IMAGE_INFORMATION_u0
2734         {
2735             struct _SECTION_IMAGE_INFORMATION_s0
2736             {
2737                 USHORT SubSystemMinorVersion;
2738                 USHORT SubSystemMajorVersion;
2739             };
2740             ULONG SubSystemVersion;
2741         };
2742         ULONG GpValue;
2743         USHORT ImageCharacteristics;
2744         USHORT DllCharacteristics;
2745         USHORT Machine;
2746         BOOLEAN ImageContainsCode;
2747         BOOLEAN Spare1;
2748         ULONG LoaderFlags;
2749         ULONG Reserved[2];
2750     } SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;
2751 
2752     typedef struct _RTL_USER_PROCESS_INFORMATION
2753     {
2754         ULONG Length;
2755         HANDLE ProcessHandle;
2756         HANDLE ThreadHandle;
2757         CLIENT_ID ClientId;
2758         SECTION_IMAGE_INFORMATION ImageInformation;
2759     } RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION;
2760 
2761     typedef struct _LDR_DATA_TABLE_ENTRY
2762     {
2763         LIST_ENTRY InLoadOrderLinks;
2764         LIST_ENTRY InMemoryOrderLinks;
2765         LIST_ENTRY InInitializationOrderLinks;
2766         PVOID DllBase;
2767         PVOID EntryPoint;
2768         ULONG SizeOfImage;
2769         UNICODE_STRING FullDllName;
2770         UNICODE_STRING BaseDllName;
2771         ULONG  Flags;
2772         USHORT LoadCount;
2773         USHORT TlsIndex;
2774         LIST_ENTRY HashLinks;
2775         PVOID SectionPointer;
2776         ULONG CheckSum;
2777         ULONG TimeDateStamp;
2778         PVOID LoadedImports;
2779         PVOID EntryPointActivationContext;
2780         PVOID PatchInformation;
2781         PVOID Unknown1;
2782         PVOID Unknown2;
2783         PVOID Unknown3;
2784     } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
2785 
2786     typedef struct _PORT_MESSAGE
2787     {
2788         union
2789         {
2790             struct
2791             {
2792                 USHORT DataLength;
2793                 USHORT TotalLength;
2794             } s1;
2795             ULONG Length;
2796         } u1;
2797         union
2798         {
2799             struct
2800             {
2801                 USHORT Type;
2802                 USHORT DataInfoOffset;
2803             } s2;
2804             ULONG ZeroInit;
2805         } u2;
2806         union
2807         {
2808             CLIENT_ID ClientId;
2809             double   DoNotUseThisField;
2810         };
2811         ULONG  MessageId;
2812         union
2813         {
2814             ULONG_PTR ClientViewSize;
2815             ULONG  CallbackId;
2816         };
2817     } PORT_MESSAGE, *PPORT_MESSAGE;
2818 
2819     typedef struct _PORT_VIEW
2820     {
2821         ULONG  Length;
2822         HANDLE SectionHandle;
2823         ULONG  SectionOffset;
2824         SIZE_T ViewSize;
2825         PVOID  ViewBase;
2826         PVOID  ViewRemoteBase;
2827     } PORT_VIEW, *PPORT_VIEW;
2828 
2829     typedef struct _REMOTE_PORT_VIEW
2830     {
2831         ULONG  Length;
2832         SIZE_T ViewSize;
2833         PVOID  ViewBase;
2834     } REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW;
2835 
2836     typedef struct RTL_HEAP_PARAMETERS
2837     {
2838         ULONG Length;
2839         ULONG SegmentReserve;
2840         ULONG SegmentCommit;
2841         ULONG DeCommitFreeBlockThreshold;
2842         ULONG DeCommitTotalFreeThreshold;
2843         ULONG MaximumAllocationSize;
2844         ULONG VirtualMemoryThreshold;
2845         ULONG InitialCommit;
2846         ULONG InitialReserve;
2847         PVOID CommitRoutine;
2848         ULONG Reserved;
2849     } RTL_HEAP_PARAMETERS, *PRTL_HEAP_PARAMETERS;
2850 
2851     typedef struct _EVENT_BASIC_INFORMATION
2852     {
2853         EVENT_TYPE EventType;
2854         LONG EventState;
2855     } EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;
2856 
2857 #pragma endregion
2858 
2859 #pragma region TYPEDEF API
2860 
2861     typedef VOID(NTAPI *PKNORMAL_ROUTINE)(
2862         IN    PVOID  NormalContext,
2863         IN    PVOID  SystemArgument1,
2864         IN    PVOID  SystemArgument2
2865         );
2866 
2867     typedef VOID(NTAPI *PIO_APC_ROUTINE)(
2868         IN    PVOID ApcContext,
2869         IN    PIO_STATUS_BLOCK IoStatusBlock,
2870         IN    ULONG Reserved
2871         );
2872 
2873     typedef VOID(NTAPI *PIO_APC_ROUTINE)(
2874         IN    PVOID ApcContext,
2875         IN    PIO_STATUS_BLOCK IoStatusBlock,
2876         IN    ULONG Reserved
2877         );
2878 
2879     typedef VOID(NTAPI *PUSER_THREAD_START_ROUTINE)(
2880         IN    PVOID ApcArgument1
2881         );
2882 
2883 #pragma endregion
2884 
2885 #pragma region DEFINE API
2886 
2887 #ifndef WIN64
2888 #define NtCurrentProcess() ((HANDLE)0xFFFFFFFF)
2889 #define NtCurrentThread() ((HANDLE)0xFFFFFFFE)
2890 #else // WIN64
2891 #define NtCurrentProcess() ((HANDLE)0xFFFFFFFFFFFFFFFF)
2892 #define NtCurrentThread() ((HANDLE)0xFFFFFFFFFFFFFFFE)
2893 #endif // WIN64
2894 
2895 #define NtCurrentPeb()     (PPEB)(NtCurrentTeb()->ProcessEnvironmentBlock)
2896 
2897 #define RtlProcessHeap() (HANDLE)(NtCurrentTeb()->ProcessEnvironmentBlock->ProcessHeap)
2898 
2899 #define DECLARE_INTERNAL_OBJECT(x) struct _##x; typedef struct _##x *P##x;
2900 
2901 #define DECLARE_INTERNAL_OBJECT2(x,y) struct _##x; typedef struct _##x *P##y;
2902 
2903 #define InitializeObjectAttributes(p, n, a, r, s)    
2904 {                                                    
2905     (p)->Length = sizeof( OBJECT_ATTRIBUTES );        
2906     (p)->RootDirectory = r;                            
2907     (p)->Attributes = a;                            
2908     (p)->ObjectName = n;                            
2909     (p)->SecurityDescriptor = s;                    
2910     (p)->SecurityQualityOfService = NULL;            
2911 }
2912 
2913 #define InitializeMessageHeader(ph, l, t)                            
2914 {                                                                    
2915     (ph)->u1.s1.TotalLength = (USHORT)(l);                            
2916     (ph)->u1.s1.DataLength = (USHORT)(l - sizeof(PORT_MESSAGE));    
2917     (ph)->u2.s2.Type = (USHORT)(t);                                    
2918     (ph)->u2.s2.DataInfoOffset = 0;                                    
2919     (ph)->ClientId.UniqueProcess = NULL;                            
2920     (ph)->ClientId.UniqueThread = NULL;                                
2921     (ph)->MessageId = 0;                                            
2922     (ph)->ClientViewSize = 0;                                        
2923 }
2924 
2925 #define RtlInitEmptyUnicodeString(ucStr, buf, bufSize)    
2926 {                                                        
2927     (ucStr)->Buffer = (buf);                            
2928     (ucStr)->Length = 0;                                
2929     (ucStr)->MaximumLength = (USHORT)(bufSize);            
2930 }
2931 
2932 #define ABSOLUTE_INTERVAL(wait) (wait)
2933 
2934 #define RELATIVE_INTERVAL(wait) (-(wait))
2935 
2936 #define NANOSECONDS(nanos) (((signed __int64)(nanos)) / 100L)
2937 
2938 #define MICROSECONDS(micros) (((signed __int64)(micros)) * NANOSECONDS(1000L))
2939 
2940 #define MILISECONDS(mili) (((signed __int64)(mili)) * MICROSECONDS(1000L))
2941 
2942 #define SECONDS(seconds) (((signed __int64)(seconds)) * MILISECONDS(1000L))
2943 
2944 #pragma endregion
2945 
2946 #pragma region REAL API
2947 
2948     BOOLEAN FORCEINLINE IsListEmpty(IN    const LIST_ENTRY *ListHead)
2949     {
2950         return (BOOLEAN)(ListHead->Flink == ListHead);
2951     }
2952 
2953     FORCEINLINE VOID InitializeListHead(IN    PLIST_ENTRY ListHead)
2954     {
2955         ListHead->Flink = ListHead->Blink = ListHead;
2956     }
2957 
2958     FORCEINLINE VOID InsertHeadList(IN OUT    PLIST_ENTRY ListHead, IN OUT    PLIST_ENTRY Entry)
2959     {
2960         PLIST_ENTRY Flink;
2961         Flink = ListHead->Flink;
2962         Entry->Flink = Flink;
2963         Entry->Blink = ListHead;
2964         Flink->Blink = Entry;
2965         ListHead->Flink = Entry;
2966     }
2967 
2968     FORCEINLINE VOID InsertTailList(IN OUT    PLIST_ENTRY ListHead, IN OUT    PLIST_ENTRY Entry)
2969     {
2970         PLIST_ENTRY Blink;
2971         Blink = ListHead->Blink;
2972         Entry->Flink = ListHead;
2973         Entry->Blink = Blink;
2974         Blink->Flink = Entry;
2975         ListHead->Blink = Entry;
2976     }
2977 
2978     FORCEINLINE BOOLEAN RemoveEntryList(IN    PLIST_ENTRY Entry)
2979     {
2980         PLIST_ENTRY Blink;
2981         PLIST_ENTRY Flink;
2982         Flink = Entry->Flink;
2983         Blink = Entry->Blink;
2984         Blink->Flink = Flink;
2985         Flink->Blink = Blink;
2986         return (BOOLEAN)(Flink == Blink);
2987     }
2988 
2989 #pragma endregion
2990 
2991 #pragma region NATIVE API
2992 
2993     NTSYSAPI NTSTATUS NTAPI NtAcceptConnectPort(
2994         OUT    PHANDLE PortHandle,
2995         IN    PVOID PortContext OPTIONAL,
2996         IN    PPORT_MESSAGE ConnectionRequest,
2997         IN    BOOLEAN AcceptConnection,
2998         IN OUT    PPORT_VIEW ServerView OPTIONAL,
2999         OUT    PREMOTE_PORT_VIEW ClientView OPTIONAL
3000         );
3001 
3002     NTSYSAPI NTSTATUS NTAPI NtAccessCheck(
3003         IN    PSECURITY_DESCRIPTOR SecurityDescriptor,
3004         IN    HANDLE TokenHandle,
3005         IN    ACCESS_MASK DesiredAccess,
3006         IN    PGENERIC_MAPPING GenericMapping,
3007         OUT    PPRIVILEGE_SET PrivilegeSet,
3008         IN    PULONG PrivilegeSetLength,
3009         OUT    PACCESS_MASK GrantedAccess,
3010         OUT    PBOOLEAN AccessStatus
3011         );
3012 
3013     NTSYSAPI NTSTATUS NTAPI NtAccessCheckAndAuditAlarm(
3014         IN    PUNICODE_STRING SubsystemName,
3015         IN    PVOID HandleId,
3016         IN    PUNICODE_STRING ObjectTypeName,
3017         IN    PUNICODE_STRING ObjectName,
3018         IN    PSECURITY_DESCRIPTOR SecurityDescriptor,
3019         IN    ACCESS_MASK DesiredAccess,
3020         IN    PGENERIC_MAPPING GenericMapping,
3021         IN    BOOLEAN ObjectCreation,
3022         OUT    PACCESS_MASK GrantedAccess,
3023         OUT    PBOOLEAN AccessStatus,
3024         OUT    PBOOLEAN GenerateOnClose
3025         );
3026 
3027     NTSYSAPI NTSTATUS NTAPI NtAccessCheckByType(
3028         IN    PSECURITY_DESCRIPTOR SecurityDescriptor,
3029         IN    PSID PrincipalSelfSid,
3030         IN    HANDLE TokenHandle,
3031         IN    ULONG DesiredAccess,
3032         IN    POBJECT_TYPE_LIST ObjectTypeList,
3033         IN    ULONG ObjectTypeListLength,
3034         IN    PGENERIC_MAPPING GenericMapping,
3035         IN    PPRIVILEGE_SET PrivilegeSet,
3036         IN    PULONG PrivilegeSetLength,
3037         OUT    PACCESS_MASK GrantedAccess,
3038         OUT    PULONG AccessStatus
3039         );
3040 
3041     NTSYSAPI NTSTATUS NTAPI NtAccessCheckByTypeAndAuditAlarm(
3042         IN    PUNICODE_STRING SubsystemName,
3043         IN    PVOID HandleId,
3044         IN    PUNICODE_STRING ObjectTypeName,
3045         IN    PUNICODE_STRING ObjectName,
3046         IN    PSECURITY_DESCRIPTOR SecurityDescriptor,
3047         IN    PSID PrincipalSelfSid,
3048         IN    ACCESS_MASK DesiredAccess,
3049         IN    AUDIT_EVENT_TYPE AuditType,
3050         IN    ULONG Flags,
3051         IN    POBJECT_TYPE_LIST ObjectTypeList,
3052         IN    ULONG ObjectTypeListLength,
3053         IN    PGENERIC_MAPPING GenericMapping,
3054         IN    BOOLEAN ObjectCreation,
3055         OUT    PACCESS_MASK GrantedAccess,
3056         OUT    PULONG AccessStatus,
3057         OUT    PBOOLEAN GenerateOnClose
3058         );
3059 
3060     NTSYSAPI NTSTATUS NTAPI NtAccessCheckByTypeResultList(
3061         IN    PSECURITY_DESCRIPTOR SecurityDescriptor,
3062         IN    PSID PrincipalSelfSid,
3063         IN    HANDLE TokenHandle,
3064         IN    ACCESS_MASK DesiredAccess,
3065         IN    POBJECT_TYPE_LIST ObjectTypeList,
3066         IN    ULONG ObjectTypeListLength,
3067         IN    PGENERIC_MAPPING GenericMapping,
3068         IN    PPRIVILEGE_SET PrivilegeSet,
3069         IN    PULONG PrivilegeSetLength,
3070         OUT    PACCESS_MASK GrantedAccessList,
3071         OUT    PULONG AccessStatusList
3072         );
3073 
3074     NTSYSAPI NTSTATUS NTAPI NtAccessCheckByTypeResultListAndAuditAlarm(
3075         IN    PUNICODE_STRING SubsystemName,
3076         IN    PVOID HandleId,
3077         IN    PUNICODE_STRING ObjectTypeName,
3078         IN    PUNICODE_STRING ObjectName,
3079         IN    PSECURITY_DESCRIPTOR SecurityDescriptor,
3080         IN    PSID PrincipalSelfSid,
3081         IN    ACCESS_MASK DesiredAccess,
3082         IN    AUDIT_EVENT_TYPE AuditType,
3083         IN    ULONG Flags,
3084         IN    POBJECT_TYPE_LIST ObjectTypeList,
3085         IN    ULONG ObjectTypeListLength,
3086         IN    PGENERIC_MAPPING GenericMapping,
3087         IN    BOOLEAN ObjectCreation,
3088         OUT    PACCESS_MASK GrantedAccessList,
3089         OUT    PULONG AccessStatusList,
3090         OUT    PULONG GenerateOnClose
3091         );
3092 
3093     NTSYSAPI NTSTATUS NTAPI NtAccessCheckByTypeResultListAndAuditAlarmByHandle(
3094         IN    PUNICODE_STRING SubsystemName,
3095         IN    PVOID HandleId,
3096         IN    HANDLE TokenHandle,
3097         IN    PUNICODE_STRING ObjectTypeName,
3098         IN    PUNICODE_STRING ObjectName,
3099         IN    PSECURITY_DESCRIPTOR SecurityDescriptor,
3100         IN    PSID PrincipalSelfSid,
3101         IN    ACCESS_MASK DesiredAccess,
3102         IN    AUDIT_EVENT_TYPE AuditType,
3103         IN    ULONG Flags,
3104         IN    POBJECT_TYPE_LIST ObjectTypeList,
3105         IN    ULONG ObjectTypeListLength,
3106         IN    PGENERIC_MAPPING GenericMapping,
3107         IN    BOOLEAN ObjectCreation,
3108         OUT    PACCESS_MASK GrantedAccessList,
3109         OUT    PULONG AccessStatusList,
3110         OUT    PULONG GenerateOnClose
3111         );
3112 
3113     NTSYSAPI NTSTATUS NTAPI NtAddAtom(
3114         IN    PWSTR String,
3115         IN    ULONG StringLength,
3116         OUT    PUSHORT Atom
3117         );
3118 
3119     NTSYSAPI NTSTATUS NTAPI NtAddBootEntry(
3120         IN    PUNICODE_STRING EntryName,
3121         IN    PUNICODE_STRING EntryValue
3122         );
3123 
3124     NTSYSAPI NTSTATUS NTAPI NtAddDriverEntry(
3125         IN    PUNICODE_STRING DriverName,
3126         IN    PUNICODE_STRING DriverPath
3127         );
3128 
3129     NTSYSAPI NTSTATUS NTAPI NtAdjustGroupsToken(
3130         IN    HANDLE TokenHandle,
3131         IN    BOOLEAN ResetToDefault,
3132         IN    PTOKEN_GROUPS NewState,
3133         IN    ULONG BufferLength,
3134         OUT    PTOKEN_GROUPS PreviousState OPTIONAL,
3135         OUT    PULONG ReturnLength
3136         );
3137 
3138     NTSYSAPI NTSTATUS NTAPI NtAdjustPrivilegesToken(
3139         IN    HANDLE TokenHandle,
3140         IN    BOOLEAN DisableAllPrivileges,
3141         IN    PTOKEN_PRIVILEGES NewState OPTIONAL,
3142         IN    ULONG BufferLength OPTIONAL,
3143         IN    PTOKEN_PRIVILEGES PreviousState OPTIONAL,
3144         OUT    PULONG ReturnLength
3145         );
3146 
3147     NTSYSAPI NTSTATUS NTAPI NtAlertResumeThread(
3148         IN    HANDLE ThreadHandle,
3149         OUT    PULONG PreviousSuspendCount OPTIONAL
3150         );
3151 
3152     NTSYSAPI NTSTATUS NTAPI NtAllocateLocallyUniqueId(
3153         OUT    PLUID Luid
3154         );
3155 
3156     NTSYSAPI NTSTATUS NTAPI NtAllocateUserPhysicalPages(
3157         IN    HANDLE ProcessHandle,
3158         IN    PULONG NumberOfPages,
3159         OUT    PULONG PageFrameNumbers
3160         );
3161 
3162     NTSYSAPI NTSTATUS NTAPI NtAllocateUuids(
3163         OUT    PLARGE_INTEGER UuidLastTimeAllocated,
3164         OUT    PULONG UuidDeltaTime,
3165         OUT    PULONG UuidSequenceNumber,
3166         OUT    PUCHAR UuidSeed
3167         );
3168     NTSYSAPI NTSTATUS NTAPI NtAllocateVirtualMemory(
3169         IN    HANDLE ProcessHandle,
3170         IN OUT    PVOID *BaseAddress,
3171         IN    ULONG ZeroBits,
3172         IN OUT    PULONG AllocationSize,
3173         IN    ULONG AllocationType,
3174         IN    ULONG Protect
3175         );
3176 
3177     NTSYSAPI NTSTATUS NTAPI NtAreMappedFilesTheSame(
3178         IN    PVOID Address1,
3179         IN    PVOID Address2
3180         );
3181 
3182     NTSYSAPI NTSTATUS NTAPI NtAssignProcessToJobObject(
3183         IN    HANDLE JobHandle,
3184         IN    HANDLE ProcessHandle
3185         );
3186 
3187     NTSYSAPI NTSTATUS NTAPI NtCallbackReturn(
3188         IN    PVOID Result OPTIONAL,
3189         IN    ULONG ResultLength,
3190         IN    NTSTATUS Status
3191         );
3192 
3193     NTSYSAPI NTSTATUS NTAPI NtCancelDeviceWakeupRequest(
3194         IN    HANDLE DeviceHandle
3195         );
3196 
3197     NTSYSAPI NTSTATUS NTAPI NtCancelIoFile(
3198         IN    HANDLE FileHandle,
3199         OUT    PIO_STATUS_BLOCK IoStatusBlock
3200         );
3201 
3202     NTSYSAPI NTSTATUS NTAPI NtCancelTimer(
3203         IN    HANDLE TimerHandle,
3204         OUT    PBOOLEAN PreviousState OPTIONAL
3205         );
3206 
3207     NTSYSAPI NTSTATUS NTAPI NtClearEvent(
3208         IN    HANDLE EventHandle
3209         );
3210 
3211     NTSYSAPI NTSTATUS NTAPI NtClose(
3212         IN    HANDLE Handle
3213         );
3214 
3215     NTSYSAPI NTSTATUS NTAPI NtCloseObjectAuditAlarm(
3216         IN    PUNICODE_STRING SubsystemName,
3217         IN    PVOID HandleId,
3218         IN    BOOLEAN GenerateOnClose
3219         );
3220 
3221     NTSYSAPI NTSTATUS NTAPI NtCompactKeys(
3222         IN    ULONG Length,
3223         IN    HANDLE Key
3224         );
3225 
3226     NTSYSAPI NTSTATUS NTAPI NtCompareTokens(
3227         IN    HANDLE FirstTokenHandle,
3228         IN    HANDLE SecondTokenHandle,
3229         OUT    PBOOLEAN IdenticalTokens
3230         );
3231 
3232     NTSYSAPI NTSTATUS NTAPI NtCompleteConnectPort(
3233         IN    HANDLE PortHandle
3234         );
3235 
3236     NTSYSAPI NTSTATUS NTAPI NtCompressKey(
3237         IN    HANDLE Key
3238         );
3239 
3240     NTSYSAPI NTSTATUS NTAPI NtConnectPort(
3241         OUT    PHANDLE PortHandle,
3242         IN    PUNICODE_STRING PortName,
3243         IN    PSECURITY_QUALITY_OF_SERVICE SecurityQos,
3244         IN OUT    PLPC_SECTION_WRITE WriteSection OPTIONAL,
3245         IN OUT    PLPC_SECTION_READ ReadSection OPTIONAL,
3246         OUT    PULONG MaxMessageSize OPTIONAL,
3247         IN OUT    PVOID ConnectData OPTIONAL,
3248         IN OUT    PULONG ConnectDataLength OPTIONAL
3249         );
3250 
3251     NTSYSAPI NTSTATUS NTAPI NtContinue(
3252         IN    PCONTEXT Context,
3253         IN    BOOLEAN TestAlert
3254         );
3255 
3256     NTSYSAPI NTSTATUS NTAPI NtCreateDebugObject(
3257         OUT    PHANDLE DebugObject,
3258         IN    ULONG AccessRequired,
3259         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3260         IN    BOOLEAN KillProcessOnExit
3261         );
3262 
3263     NTSYSAPI NTSTATUS NTAPI NtCreateDirectoryObject(
3264         OUT    PHANDLE DirectoryHandle,
3265         IN    ACCESS_MASK DesiredAccess,
3266         IN    POBJECT_ATTRIBUTES ObjectAttributes
3267         );
3268 
3269     NTSYSAPI NTSTATUS NTAPI NtCreateEvent(
3270         OUT    PHANDLE EventHandle,
3271         IN    ACCESS_MASK DesiredAccess,
3272         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3273         IN    EVENT_TYPE EventType,
3274         IN    BOOLEAN InitialState
3275         );
3276 
3277     NTSYSAPI NTSTATUS NTAPI NtCreateEventPair(
3278         OUT    PHANDLE EventPairHandle,
3279         IN    ACCESS_MASK DesiredAccess,
3280         IN    POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL
3281         );
3282 
3283     NTSYSAPI NTSTATUS NTAPI NtCreateFile(
3284         OUT    PHANDLE FileHandle,
3285         IN    ACCESS_MASK DesiredAccess,
3286         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3287         OUT    PIO_STATUS_BLOCK IoStatusBlock,
3288         IN    PLARGE_INTEGER AllocationSize OPTIONAL,
3289         IN    ULONG FileAttributes,
3290         IN    ULONG ShareAccess,
3291         IN    ULONG CreateDisposition,
3292         IN    ULONG CreateOptions,
3293         IN    PVOID EaBuffer OPTIONAL,
3294         IN    ULONG EaLength
3295         );
3296 
3297     NTSYSAPI NTSTATUS NTAPI NtCreateIoCompletion(
3298         OUT    PHANDLE IoCompletionHandle,
3299         IN    ACCESS_MASK DesiredAccess,
3300         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3301         IN    ULONG NumberOfConcurrentThreads
3302         );
3303 
3304     NTSYSAPI NTSTATUS NTAPI NtCreateJobObject(
3305         OUT    PHANDLE JobHandle,
3306         IN    ACCESS_MASK DesiredAccess,
3307         IN    POBJECT_ATTRIBUTES ObjectAttributes
3308         );
3309 
3310     NTSYSAPI NTSTATUS NTAPI NtCreateJobSet(
3311         IN    ULONG Jobs,
3312         IN    PJOB_SET_ARRAY JobSet,
3313         IN    ULONG Reserved
3314         );
3315 
3316     NTSYSAPI NTSTATUS NTAPI NtCreateKey(
3317         OUT    PHANDLE KeyHandle,
3318         IN    ACCESS_MASK DesiredAccess,
3319         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3320         IN    ULONG TitleIndex,
3321         IN    PUNICODE_STRING Class OPTIONAL,
3322         IN    ULONG CreateOptions,
3323         OUT    PULONG Disposition OPTIONAL
3324         );
3325 
3326     NTSYSAPI NTSTATUS NTAPI NtCreateKeyedEvent(
3327         OUT    PHANDLE KeyedEventHandle,
3328         IN    ACCESS_MASK DesiredAccess,
3329         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3330         IN    ULONG Reserved
3331         );
3332 
3333     NTSYSAPI NTSTATUS NTAPI NtCreateMailslotFile(
3334         OUT    PHANDLE FileHandle,
3335         IN    ACCESS_MASK DesiredAccess,
3336         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3337         OUT    PIO_STATUS_BLOCK IoStatusBlock,
3338         IN    ULONG CreateOptions,
3339         IN    ULONG InBufferSize,
3340         IN    ULONG MaxMessageSize,
3341         IN    PLARGE_INTEGER ReadTimeout OPTIONAL
3342         );
3343 
3344     NTSYSAPI NTSTATUS NTAPI NtCreateMutant(
3345         OUT    PHANDLE MutantHandle,
3346         IN    ACCESS_MASK DesiredAccess,
3347         IN    POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
3348         IN    BOOLEAN InitialOwner
3349         );
3350 
3351     NTSYSAPI NTSTATUS NTAPI NtCreateNamedPipeFile(
3352         OUT    PHANDLE FileHandle,
3353         IN    ACCESS_MASK DesiredAccess,
3354         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3355         OUT    PIO_STATUS_BLOCK IoStatusBlock,
3356         IN    ULONG ShareAccess,
3357         IN    ULONG CreateDisposition,
3358         IN    ULONG CreateOptions,
3359         IN    BOOLEAN TypeMessage,
3360         IN    BOOLEAN ReadmodeMessage,
3361         IN    BOOLEAN Nonblocking,
3362         IN    ULONG MaxInstances,
3363         IN    ULONG InBufferSize,
3364         IN    ULONG OutBufferSize,
3365         IN    PLARGE_INTEGER DefaultTimeout OPTIONAL
3366         );
3367 
3368     NTSYSAPI NTSTATUS NTAPI NtCreatePort(
3369         OUT    PHANDLE PortHandle,
3370         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3371         IN    ULONG MaxConnectionInfoLength,
3372         IN    ULONG MaxMessageLength,
3373         IN    ULONG MaxPoolUsage
3374         );
3375 
3376     NTSYSAPI NTSTATUS NTAPI NtCreateProcess(
3377         OUT    PHANDLE ProcessHandle,
3378         IN    ACCESS_MASK DesiredAccess,
3379         IN    POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
3380         IN    HANDLE ParentProcess,
3381         IN    BOOLEAN InheritObjectTable,
3382         IN    HANDLE SectionHandle OPTIONAL,
3383         IN    HANDLE DebugPort OPTIONAL,
3384         IN    HANDLE ExceptionPort OPTIONAL
3385         );
3386 
3387     NTSYSAPI NTSTATUS NTAPI NtCreateProcessEx(
3388         OUT    PHANDLE ProcessHandle,
3389         IN    ACCESS_MASK DesiredAccess,
3390         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3391         IN    HANDLE InheritFromProcessHandle,
3392         IN    ULONG CreateFlags,
3393         IN    HANDLE SectionHandle OPTIONAL,
3394         IN    HANDLE DebugObject OPTIONAL,
3395         IN    HANDLE ExceptionPort OPTIONAL,
3396         IN    ULONG JobMemberLevel
3397         );
3398 
3399     NTSYSAPI NTSTATUS NTAPI NtCreateProfile(
3400         OUT    PHANDLE ProfileHandle,
3401         IN    HANDLE ProcessHandle,
3402         IN    PVOID Base,
3403         IN    ULONG Size,
3404         IN    ULONG BucketShift,
3405         IN    PULONG Buffer,
3406         IN    ULONG BufferLength,
3407         IN    KPROFILE_SOURCE Source,
3408         IN    ULONG ProcessorMask
3409         );
3410 
3411     NTSYSAPI NTSTATUS NTAPI NtCreateSection(
3412         OUT    PHANDLE SectionHandle,
3413         IN    ACCESS_MASK DesiredAccess,
3414         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3415         IN    PLARGE_INTEGER SectionSize OPTIONAL,
3416         IN    ULONG Protect,
3417         IN    ULONG Attributes,
3418         IN    HANDLE FileHandle
3419         );
3420 
3421     NTSYSAPI NTSTATUS NTAPI NtCreateSemaphore(
3422         OUT    PHANDLE SemaphoreHandle,
3423         IN    ACCESS_MASK DesiredAccess,
3424         IN    POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
3425         IN    ULONG InitialCount,
3426         IN    ULONG MaximumCount
3427         );
3428 
3429     NTSYSAPI NTSTATUS NTAPI NtCreateSymbolicLinkObject(
3430         OUT    PHANDLE SymbolicLinkHandle,
3431         IN    ACCESS_MASK DesiredAccess,
3432         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3433         IN    PUNICODE_STRING TargetName
3434         );
3435 
3436     NTSYSAPI NTSTATUS NTAPI NtCreateThread(
3437         OUT    PHANDLE ThreadHandle,
3438         IN    ACCESS_MASK DesiredAccess,
3439         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3440         IN    HANDLE ProcessHandle,
3441         OUT    PCLIENT_ID ClientId,
3442         IN    PCONTEXT ThreadContext,
3443         IN    PUSER_STACK UserStack,
3444         IN    BOOLEAN CreateSuspended
3445         );
3446 
3447     NTSYSAPI NTSTATUS NTAPI NtCreateToken(
3448         OUT    PHANDLE TokenHandle,
3449         IN    ACCESS_MASK DesiredAccess,
3450         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3451         IN    TOKEN_TYPE Type,
3452         IN    PLUID AuthenticationId,
3453         IN    PLARGE_INTEGER ExpirationTime,
3454         IN    PTOKEN_USER User,
3455         IN    PTOKEN_GROUPS Groups,
3456         IN    PTOKEN_PRIVILEGES Privileges,
3457         IN    PTOKEN_OWNER Owner,
3458         IN    PTOKEN_PRIMARY_GROUP PrimaryGroup,
3459         IN    PTOKEN_DEFAULT_DACL DefaultDacl,
3460         IN    PTOKEN_SOURCE Source
3461         );
3462 
3463     NTSYSAPI NTSTATUS NTAPI NtCreateWaitablePort(
3464         OUT    PHANDLE PortHandle,
3465         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3466         IN    ULONG MaxConnectionInfoLength,
3467         IN    ULONG MaxMessageLength,
3468         IN    ULONG MaxPoolUsage
3469         );
3470 
3471     NTSYSAPI NTSTATUS NTAPI NtDebugActiveProcess(
3472         IN    HANDLE Process,
3473         IN    HANDLE DebugObject
3474         );
3475 
3476     NTSYSAPI NTSTATUS NTAPI NtDebugContinue(
3477         IN    HANDLE DebugObject,
3478         IN    PCLIENT_ID AppClientId,
3479         IN    NTSTATUS ContinueStatus
3480         );
3481 
3482     NTSYSAPI NTSTATUS NTAPI NtDelayExecution(
3483         IN    BOOLEAN Alertable,
3484         IN    PLARGE_INTEGER DelayInterval
3485         );
3486 
3487     NTSYSAPI NTSTATUS NTAPI NtDeleteAtom(
3488         IN    USHORT Atom
3489         );
3490 
3491     NTSYSAPI NTSTATUS NTAPI NtDeleteBootEntry(
3492         IN    PUNICODE_STRING EntryName,
3493         IN    PUNICODE_STRING EntryValue
3494         );
3495 
3496     NTSYSAPI NTSTATUS NTAPI NtDeleteDriverEntry(
3497         IN    PUNICODE_STRING DriverName,
3498         IN    PUNICODE_STRING DriverPath
3499         );
3500 
3501     NTSYSAPI NTSTATUS NTAPI NtDeleteFile(
3502         IN    POBJECT_ATTRIBUTES ObjectAttributes
3503         );
3504 
3505     NTSYSAPI NTSTATUS NTAPI NtDeleteKey(
3506         IN    HANDLE KeyHandle
3507         );
3508 
3509     NTSYSAPI NTSTATUS NTAPI NtDeleteObjectAuditAlarm(
3510         IN    PUNICODE_STRING SubsystemName,
3511         IN    PVOID HandleId,
3512         IN    BOOLEAN GenerateOnClose
3513         );
3514 
3515     NTSYSAPI NTSTATUS NTAPI NtDeleteValueKey(
3516         IN    HANDLE KeyHandle,
3517         IN    PUNICODE_STRING ValueName
3518         );
3519 
3520     NTSYSAPI NTSTATUS NTAPI NtDeviceIoControlFile(
3521         IN    HANDLE FileHandle,
3522         IN    HANDLE Event OPTIONAL,
3523         IN    PIO_APC_ROUTINE ApcRoutine OPTIONAL,
3524         IN    PVOID ApcContext OPTIONAL,
3525         OUT    PIO_STATUS_BLOCK IoStatusBlock,
3526         IN    ULONG IoControlCode,
3527         IN    PVOID InputBuffer OPTIONAL,
3528         IN    ULONG InputBufferLength,
3529         OUT    PVOID OutputBuffer OPTIONAL,
3530         IN    ULONG OutputBufferLength
3531         );
3532 
3533     NTSYSAPI NTSTATUS NTAPI NtDisplayString(
3534         IN    PUNICODE_STRING String
3535         );
3536 
3537     NTSYSAPI NTSTATUS NTAPI NtDuplicateObject(
3538         IN    HANDLE SourceProcessHandle,
3539         IN    HANDLE SourceHandle,
3540         IN    HANDLE TargetProcessHandle OPTIONAL,
3541         OUT    PHANDLE TargetHandle OPTIONAL,
3542         IN    ACCESS_MASK DesiredAccess,
3543         IN    ULONG HandleAttributes,
3544         IN    ULONG Options
3545         );
3546 
3547     NTSYSAPI NTSTATUS NTAPI NtDuplicateToken(
3548         IN    HANDLE ExistingTokenHandle,
3549         IN    ACCESS_MASK DesiredAccess,
3550         IN    POBJECT_ATTRIBUTES ObjectAttributes,
3551         IN    BOOLEAN EffectiveOnly,
3552         IN    TOKEN_TYPE TokenType,
3553         OUT    PHANDLE NewTokenHandle
3554         );
3555 
3556     NTSYSAPI NTSTATUS NTAPI NtEnumerateBootEntries(
3557         IN    ULONG Unknown1,
3558         IN    ULONG Unknown2
3559         );
3560     NTSYSAPI NTSTATUS NTAPI NtEnumerateKey(
3561         IN    HANDLE KeyHandle,
3562         IN    ULONG Index,
3563         IN    KEY_INFORMATION_CLASS KeyInformationClass,
3564         OUT    PVOID KeyInformation,
3565         IN    ULONG KeyInformationLength,
3566         OUT    PULONG ResultLength
3567         );
3568 
3569     NTSYSAPI NTSTATUS NTAPI NtEnumerateSystemEnvironmentValuesEx(
3570         IN    ULONG Unknown1,
3571         IN    ULONG Unknown2,
3572         IN    ULONG Unknown3
3573         );
3574 
3575     NTSYSAPI NTSTATUS NTAPI NtEnumerateValueKey(
3576         IN    HANDLE KeyHandle,
3577         IN    ULONG Index,
3578         IN    KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
3579         OUT    PVOID KeyValueInformation,
3580         IN    ULONG KeyValueInformationLength,
3581         OUT    PULONG ResultLength
3582         );
3583 
3584     NTSYSAPI NTSTATUS NTAPI NtExtendSection(
3585         IN    HANDLE SectionHandle,
3586         IN    PLARGE_INTEGER SectionSize
3587         );
3588 
3589     NTSYSAPI NTSTATUS NTAPI NtFilterToken(
3590         IN    HANDLE ExistingTokenHandle,
3591         IN    ULONG Flags,
3592         IN    PTOKEN_GROUPS SidsToDisable,
3593         IN    PTOKEN_PRIVILEGES PrivilegesToDelete,
3594         IN    PTOKEN_GROUPS SidsToRestricted,
3595         OUT    PHANDLE NewTokenHandle
3596         );
3597 
3598     NTSYSAPI NTSTATUS NTAPI NtFindAtom(
3599         IN    PWSTR String,
3600         IN    ULONG StringLength,
3601         OUT    PUSHORT Atom
3602         );
3603 
3604     NTSYSAPI NTSTATUS NTAPI NtFlushBuffersFile(
3605         IN    HANDLE FileHandle,
3606         OUT    PIO_STATUS_BLOCK IoStatusBlock
3607         );
3608 
3609     NTSYSAPI NTSTATUS NTAPI NtFlushInstructionCache(
3610         IN    HANDLE ProcessHandle,
3611         IN    PVOID BaseAddress OPTIONAL,
3612         IN    ULONG FlushSize
3613         );
3614 
3615     NTSYSAPI NTSTATUS NTAPI NtFlushKey(
3616         IN    HANDLE KeyHandle
3617         );
3618 
3619     NTSYSAPI NTSTATUS NTAPI NtFlushVirtualMemory(
3620         IN    HANDLE ProcessHandle,
3621         IN OUT    PVOID *BaseAddress,
3622         IN OUT    PULONG FlushSize,
3623         OUT    PIO_STATUS_BLOCK IoStatusBlock
3624         );
3625 
3626     NTSYSAPI NTSTATUS NTAPI NtFlushWriteBuffer(
3627         VOID
3628         );
3629 
3630     NTSYSAPI NTSTATUS NTAPI NtYieldExecution(
3631         VOID
3632         );
3633 
3634     NTSYSAPI NTSTATUS NTAPI NtWriteVirtualMemory(
3635         IN    HANDLE ProcessHandle,
3636         IN    PVOID BaseAddress,
3637         IN    PVOID Buffer,
3638         IN    ULONG BufferLength,
3639         OUT    PULONG ReturnLength OPTIONAL
3640         );
3641 
3642     NTSYSAPI NTSTATUS NTAPI NtWriteRequestData(
3643         IN    HANDLE PortHandle,
3644         IN    PPORT_MESSAGE Message,
3645         IN    ULONG Index,
3646         IN    PVOID Buffer,
3647         IN    ULONG BufferLength,
3648         OUT    PULONG ReturnLength OPTIONAL
3649         );
3650 
3651     NTSYSAPI NTSTATUS NTAPI NtWriteFileGather(
3652         IN    HANDLE FileHandle,
3653         IN    HANDLE Event OPTIONAL,
3654         IN    PIO_APC_ROUTINE ApcRoutine OPTIONAL,
3655         IN    PVOID ApcContext OPTIONAL,
3656         OUT    PIO_STATUS_BLOCK IoStatusBlock,
3657         IN    PFILE_SEGMENT_ELEMENT Buffer,
3658         IN    ULONG Length,
3659         IN    PLARGE_INTEGER ByteOffset OPTIONAL,
3660         IN    PULONG Key OPTIONAL
3661         );
3662 
3663     NTSYSAPI NTSTATUS NTAPI NtWriteFile(
3664         IN    HANDLE FileHandle,
3665         IN    HANDLE Event OPTIONAL,
3666         IN    PIO_APC_ROUTINE ApcRoutine OPTIONAL,
3667         IN    PVOID ApcContext OPTIONAL,
3668         OUT    PIO_STATUS_BLOCK IoStatusBlock,
3669         IN    PVOID Buffer,
3670         IN    ULONG Length,
3671         IN    PLARGE_INTEGER ByteOffset OPTIONAL,
3672         IN    PULONG Key OPTIONAL
3673         );
3674 
3675     NTSYSAPI NTSTATUS NTAPI NtWaitLowEventPair(
3676         IN    HANDLE EventPairHandle
3677         );
3678 
3679     NTSYSAPI NTSTATUS NTAPI NtWaitHighEventPair(
3680         IN    HANDLE EventPairHandle
3681         );
3682 
3683     NTSYSAPI NTSTATUS NTAPI NtWaitForSingleObject(
3684         IN    HANDLE Handle,
3685         IN    BOOLEAN Alertable,
3686         IN    PLARGE_INTEGER Timeout OPTIONAL
3687         );
3688 
3689     NTSYSAPI NTSTATUS NTAPI NtWaitForMultipleObjects32(
3690         IN    ULONG HandleCount,
3691         IN    PHANDLE Handles,
3692         IN    WAIT_TYPE WaitType,
3693         IN    BOOLEAN Alertable,
3694         IN    PLARGE_INTEGER Timeout OPTIONAL
3695         );
3696 
3697     NTSYSAPI NTSTATUS NTAPI NtWaitForMultipleObjects(
3698         IN    ULONG HandleCount,
3699         IN    PHANDLE Handles,
3700         IN    WAIT_TYPE WaitType,
3701         IN    BOOLEAN Alertable,
3702         IN    PLARGE_INTEGER Timeout OPTIONAL
3703         );
3704 
3705     NTSYSAPI NTSTATUS NTAPI NtWaitForKeyedEvent(
3706         IN    HANDLE KeyedEventHandle,
3707         IN    PVOID Key,
3708         IN    BOOLEAN Alertable,
3709         IN    PLARGE_INTEGER Timeout OPTIONAL
3710         );
3711 
3712     NTSYSAPI NTSTATUS NTAPI NtUnmapViewOfSection(
3713         IN    HANDLE ProcessHandle,
3714         IN    PVOID BaseAddress
3715         );
3716 
3717     NTSYSAPI NTSTATUS NTAPI NtUnlockVirtualMemory(
3718         IN    HANDLE ProcessHandle,
3719         IN OUT    PVOID *BaseAddress,
3720         IN OUT    PULONG LockSize,
3721         IN    ULONG LockType
3722         );
3723 
3724     NTSYSAPI NTSTATUS NTAPI NtUnlockFile(
3725         IN    HANDLE FileHandle,
3726         OUT    PIO_STATUS_BLOCK IoStatusBlock,
3727         IN    PULARGE_INTEGER LockOffset,
3728         IN    PULARGE_INTEGER LockLength,
3729         IN    ULONG Key
3730         );
3731 
3732     NTSYSAPI NTSTATUS NTAPI NtUnloadKeyEx(
3733         IN    POBJECT_ATTRIBUTES KeyObjectAttributes,
3734         IN    HANDLE EventHandle OPTIONAL
3735         );
3736 
3737     NTSYSAPI NTSTATUS NTAPI NtUnloadKey2(
3738         IN    POBJECT_ATTRIBUTES KeyObjectAttributes,
3739         IN    BOOLEAN ForceUnload
3740         );
3741 
3742     NTSYSAPI NTSTATUS NTAPI NtUnloadKey(
3743         IN    POBJECT_ATTRIBUTES KeyObjectAttributes
3744         );
3745 
3746     NTSYSAPI NTSTATUS NTAPI NtUnloadDriver(
3747         IN    PUNICODE_STRING DriverServiceName
3748         );
3749 
3750     NTSYSAPI NTSTATUS NTAPI NtTerminateThread(
3751         IN    HANDLE ThreadHandle OPTIONAL,
3752         IN    NTSTATUS ExitStatus
3753         );
3754 
3755     NTSYSAPI NTSTATUS NTAPI NtTerminateProcess(
3756         IN    HANDLE ProcessHandle OPTIONAL,
3757         IN    NTSTATUS ExitStatus
3758         );
3759 
3760     NTSYSAPI NTSTATUS NTAPI NtTerminateJobObject(
3761         IN    HANDLE JobHandle,
3762         IN    NTSTATUS ExitStatus
3763         );
3764 
3765     NTSYSAPI NTSTATUS NTAPI NtSystemDebugControl(
3766         IN    DEBUG_CONTROL_CODE ControlCode,
3767         IN    PVOID InputBuffer OPTIONAL,
3768         IN    ULONG InputBufferLength,
3769         OUT    PVOID OutputBuffer OPTIONAL,
3770         IN    ULONG OutputBufferLength,
3771         OUT    PULONG ReturnLength OPTIONAL
3772         );
3773 
3774     NTSYSAPI NTSTATUS NTAPI NtSuspendThread(
3775         IN    HANDLE ThreadHandle,
3776         OUT    PULONG PreviousSuspendCount OPTIONAL
3777         );
3778 
3779     NTSYSAPI NTSTATUS NTAPI NtSuspendProcess(
3780         IN    HANDLE Process
3781         );
3782 
3783     NTSYSAPI NTSTATUS NTAPI NtStopProfile(
3784         IN    HANDLE ProfileHandle
3785         );
3786     NTSYSAPI NTSTATUS NTAPI NtStartProfile(
3787         IN    HANDLE ProfileHandle
3788         );
3789 
3790     NTSYSAPI NTSTATUS NTAPI NtSignalAndWaitForSingleObject(
3791         IN    HANDLE HandleToSignal,
3792         IN    HANDLE HandleToWait,
3793         IN    BOOLEAN Alertable,
3794         IN    PLARGE_INTEGER Timeout OPTIONAL
3795         );
3796 
3797     NTSYSAPI NTSTATUS NTAPI NtShutdownSystem(
3798         IN    SHUTDOWN_ACTION Action
3799         );
3800 
3801     NTSYSAPI NTSTATUS NTAPI NtSetVolumeInformationFile(
3802         IN    HANDLE FileHandle,
3803         OUT    PIO_STATUS_BLOCK IoStatusBlock,
3804         IN    PVOID Buffer,
3805         IN    ULONG BufferLength,
3806         IN    FS_INFORMATION_CLASS VolumeInformationClass
3807         );
3808 
3809     NTSYSAPI NTSTATUS NTAPI NtSetValueKey(
3810         IN    HANDLE KeyHandle,
3811         IN    PUNICODE_STRING ValueName,
3812         IN    ULONG TitleIndex OPTIONAL,
3813         IN    ULONG Type,
3814         IN    PVOID Data,
3815         IN    ULONG DataSize
3816         );
3817 
3818     NTSYSAPI NTSTATUS NTAPI NtSetUuidSeed(
3819         IN    PUCHAR UuidSeed
3820         );
3821 
3822     NTSYSAPI NTSTATUS NTAPI NtSetTimerResolution(
3823         IN    ULONG RequestedResolution,
3824         IN    BOOLEAN Set,
3825         OUT    PULONG ActualResolution
3826         );
3827 
3828     NTSYSAPI NTSTATUS NTAPI NtSetThreadExecutionState(
3829         IN    EXECUTION_STATE ExecutionState,
3830         OUT    PEXECUTION_STATE PreviousExecutionState
3831         );
3832 
3833     NTSYSAPI NTSTATUS NTAPI NtSetSystemTime(
3834         IN    PLARGE_INTEGER NewTime,
3835         OUT    PLARGE_INTEGER OldTime OPTIONAL
3836         );
3837 
3838     NTSYSAPI NTSTATUS NTAPI NtSetSystemPowerState(
3839         IN    POWER_ACTION SystemAction,
3840         IN    SYSTEM_POWER_STATE MinSystemState,
3841         IN    ULONG Flags
3842         );
3843 
3844     NTSYSAPI NTSTATUS NTAPI NtSetSystemInformation(
3845         IN    SYSTEM_INFORMATION_CLASS SystemInformationClass,
3846         IN OUT    PVOID SystemInformation,
3847         IN    ULONG SystemInformationLength
3848         );
3849 
3850     NTSYSAPI NTSTATUS NTAPI NtSetSystemEnvironmentValue(
3851         IN    PUNICODE_STRING Name,
3852         IN    PUNICODE_STRING Value
3853         );
3854 
3855     NTSYSAPI NTSTATUS NTAPI NtSetSecurityObject(
3856         IN    HANDLE Handle,
3857         IN    SECURITY_INFORMATION SecurityInformation,
3858         IN    PSECURITY_DESCRIPTOR SecurityDescriptor
3859         );
3860 
3861     NTSYSAPI NTSTATUS NTAPI NtSetLowWaitHighEventPair(
3862         IN    HANDLE EventPairHandle
3863         );
3864 
3865     NTSYSAPI NTSTATUS NTAPI NtSetLowEventPair(
3866         IN    HANDLE EventPairHandle
3867         );
3868 
3869     NTSYSAPI NTSTATUS NTAPI NtSetLdtEntries(
3870         IN    ULONG Selector1,
3871         IN    LDT_ENTRY LdtEntry1,
3872         IN    ULONG Selector2,
3873         IN    LDT_ENTRY LdtEntry2
3874         );
3875 
3876     NTSYSAPI NTSTATUS NTAPI NtSetIoCompletion(
3877         IN    HANDLE IoCompletionHandle,
3878         IN    ULONG CompletionKey,
3879         IN    ULONG CompletionValue,
3880         IN    NTSTATUS Status,
3881         IN    ULONG Information
3882         );
3883 
3884     NTSYSAPI NTSTATUS NTAPI NtSetIntervalProfile(
3885         IN    ULONG Interval,
3886         IN    KPROFILE_SOURCE Source
3887         );
3888 
3889     NTSYSAPI NTSTATUS NTAPI NtSetInformationToken(
3890         IN    HANDLE TokenHandle,
3891         IN    TOKEN_INFORMATION_CLASS TokenInformationClass,
3892         IN    PVOID TokenInformation,
3893         IN    ULONG TokenInformationLength
3894         );
3895 
3896     NTSYSAPI NTSTATUS NTAPI NtSetInformationThread(
3897         IN    HANDLE ThreadHandle,
3898         IN    THREADINFOCLASS ThreadInformationClass,
3899         IN    PVOID ThreadInformation,
3900         IN    ULONG ThreadInformationLength
3901         );
3902 
3903     NTSYSAPI NTSTATUS NTAPI NtSetInformationProcess(
3904         IN    HANDLE ProcessHandle,
3905         IN    PROCESSINFOCLASS ProcessInformationClass,
3906         IN    PVOID ProcessInformation,
3907         IN    ULONG ProcessInformationLength
3908         );
3909 
3910     NTSYSAPI NTSTATUS NTAPI NtSetInformationObject(
3911         IN    HANDLE ObjectHandle,
3912         IN    OBJECT_INFORMATION_CLASS ObjectInformationClass,
3913         IN    PVOID ObjectInformation,
3914         IN    ULONG ObjectInformationLength
3915         );
3916 
3917     NTSYSAPI NTSTATUS NTAPI NtSetInformationKey(
3918         IN    HANDLE KeyHandle,
3919         IN    KEY_SET_INFORMATION_CLASS KeyInformationClass,
3920         IN    PVOID KeyInformation,
3921         IN    ULONG KeyInformationLength
3922         );
3923 
3924     NTSYSAPI NTSTATUS NTAPI NtSetInformationJobObject(
3925         IN    HANDLE JobHandle,
3926         IN    JOBOBJECTINFOCLASS JobInformationClass,
3927         IN    PVOID JobInformation,
3928         IN    ULONG JobInformationLength
3929         );
3930 
3931     NTSYSAPI NTSTATUS NTAPI NtSetInformationFile(
3932         IN    HANDLE FileHandle,
3933         OUT    PIO_STATUS_BLOCK IoStatusBlock,
3934         IN    PVOID FileInformation,
3935         IN    ULONG FileInformationLength,
3936         IN    FILE_INFORMATION_CLASS FileInformationClass
3937         );
3938 
3939     NTSYSAPI NTSTATUS NTAPI NtSetHighWaitLowEventPair(
3940         IN    HANDLE EventPairHandle
3941         );
3942 
3943     NTSYSAPI NTSTATUS NTAPI NtSetHighEventPair(
3944         IN    HANDLE EventPairHandle
3945         );
3946 
3947     NTSYSAPI NTSTATUS NTAPI NtSetEventBoostPriority(
3948         IN    HANDLE EventHandle
3949         );
3950 
3951     NTSYSAPI NTSTATUS NTAPI NtSetEvent(
3952         IN    HANDLE EventHandle,
3953         OUT    PULONG PreviousState OPTIONAL
3954         );
3955 
3956     NTSYSAPI NTSTATUS NTAPI NtSetEaFile(
3957         IN    HANDLE FileHandle,
3958         OUT    PIO_STATUS_BLOCK IoStatusBlock,
3959         IN    PFILE_FULL_EA_INFORMATION Buffer,
3960         IN    ULONG BufferLength
3961         );
3962 
3963     NTSYSAPI NTSTATUS NTAPI NtSetDefaultUILanguage(
3964         IN    LANGID LanguageId
3965         );
3966 
3967     NTSYSAPI NTSTATUS NTAPI NtSetDefaultLocale(
3968         IN    BOOLEAN ThreadOrSystem,
3969         IN    LCID Locale
3970         );
3971 
3972     NTSYSAPI NTSTATUS NTAPI NtSetDefaultHardErrorPort(
3973         IN    HANDLE PortHandle
3974         );
3975 
3976     NTSYSAPI NTSTATUS NTAPI NtSetDebugFilterState(
3977         IN    ULONG ComponentId,
3978         IN    ULONG Level,
3979         IN    BOOLEAN Enable
3980         );
3981 
3982     NTSYSAPI NTSTATUS NTAPI NtSetContextThread(
3983         IN    HANDLE ThreadHandle,
3984         IN    PCONTEXT Context
3985         );
3986 
3987     NTSYSAPI NTSTATUS NTAPI NtSetContextChannel(
3988         IN    HANDLE CHannelHandle
3989         );
3990 
3991     NTSYSAPI NTSTATUS NTAPI NtSetBootEntryOrder(
3992         IN    ULONG Unknown1,
3993         IN    ULONG Unknown2
3994         );
3995 
3996     NTSYSAPI NTSTATUS NTAPI NtSecureConnectPort(
3997         OUT    PHANDLE PortHandle,
3998         IN    PUNICODE_STRING PortName,
3999         IN    PSECURITY_QUALITY_OF_SERVICE SecurityQos,
4000         IN OUT    PPORT_VIEW ClientView OPTIONAL,
4001         IN    PSID ServerSid OPTIONAL,
4002         OUT    PREMOTE_PORT_VIEW ServerView OPTIONAL,
4003         OUT    PULONG MaxMessageLength OPTIONAL,
4004         IN OUT    PVOID ConnectInformation OPTIONAL,
4005         IN OUT    PULONG ConnectInformationLength OPTIONAL
4006         );
4007 
4008     NTSYSAPI NTSTATUS NTAPI NtSaveMergedKeys(
4009         IN    HANDLE KeyHandle1,
4010         IN    HANDLE KeyHandle2,
4011         IN    HANDLE FileHandle
4012         );
4013 
4014     NTSYSAPI NTSTATUS NTAPI NtSaveKeyEx(
4015         IN    HANDLE KeyHandle,
4016         IN    HANDLE FileHandle,
4017         IN    ULONG Flags
4018         );
4019 
4020     NTSYSAPI NTSTATUS NTAPI NtSaveKey(
4021         IN    HANDLE KeyHandle,
4022         IN    HANDLE FileHandle
4023         );
4024 
4025     NTSYSAPI NTSTATUS NTAPI NtResumeThread(
4026         IN    HANDLE ThreadHandle,
4027         OUT    PULONG PreviousSuspendCount OPTIONAL
4028         );
4029 
4030     NTSYSAPI NTSTATUS NTAPI NtResumeProcess(
4031         IN    HANDLE Process
4032         );
4033 
4034     NTSYSAPI NTSTATUS NTAPI NtRestoreKey(
4035         IN    HANDLE KeyHandle,
4036         IN    HANDLE FileHandle,
4037         IN    ULONG Flags
4038         );
4039 
4040     NTSYSAPI NTSTATUS NTAPI NtResetWriteWatch(
4041         IN    HANDLE ProcessHandle,
4042         IN    PVOID BaseAddress,
4043         IN    ULONG RegionSize
4044         );
4045 
4046     NTSYSAPI NTSTATUS NTAPI NtResetEvent(
4047         IN    HANDLE EventHandle,
4048         OUT    PULONG PreviousState OPTIONAL
4049         );
4050 
4051     NTSYSAPI NTSTATUS NTAPI NtRequestWakeupLatency(
4052         IN    LATENCY_TIME Latency
4053         );
4054 
4055     NTSYSAPI NTSTATUS NTAPI NtRequestWaitReplyPort(
4056         IN    HANDLE PortHandle,
4057         IN    PPORT_MESSAGE RequestMessage,
4058         OUT    PPORT_MESSAGE ReplyMessage
4059         );
4060 
4061     NTSYSAPI NTSTATUS NTAPI NtRequestPort(
4062         IN    HANDLE PortHandle,
4063         IN    PPORT_MESSAGE RequestMessage
4064         );
4065 
4066     NTSYSAPI NTSTATUS NTAPI NtRequestDeviceWakeup(
4067         IN    HANDLE DeviceHandle
4068         );
4069 
4070     NTSYSAPI NTSTATUS NTAPI NtReplyWaitReplyPort(
4071         IN    HANDLE PortHandle,
4072         IN OUT    PPORT_MESSAGE ReplyMessage
4073         );
4074 
4075     NTSYSAPI NTSTATUS NTAPI NtReplyWaitReceivePortEx(
4076         IN    HANDLE PortHandle,
4077         OUT    PVOID* PortIdentifier OPTIONAL,
4078         IN    PPORT_MESSAGE ReplyMessage OPTIONAL,
4079         OUT    PPORT_MESSAGE Message,
4080         IN    PLARGE_INTEGER Timeout
4081         );
4082 
4083     NTSYSAPI NTSTATUS NTAPI NtReplyWaitReceivePort(
4084         IN    HANDLE PortHandle,
4085         OUT    PULONG PortIdentifier OPTIONAL,
4086         IN    PPORT_MESSAGE ReplyMessage OPTIONAL,
4087         OUT    PPORT_MESSAGE Message
4088         );
4089 
4090     NTSYSAPI NTSTATUS NTAPI NtReplyPort(
4091         IN    HANDLE PortHandle,
4092         IN    PPORT_MESSAGE ReplyMessage
4093         );
4094 
4095     NTSYSAPI NTSTATUS NTAPI NtReplaceKey(
4096         IN    POBJECT_ATTRIBUTES NewFileObjectAttributes,
4097         IN    HANDLE KeyHandle,
4098         IN    POBJECT_ATTRIBUTES OldFileObjectAttributes
4099         );
4100 
4101     NTSYSAPI NTSTATUS NTAPI NtRenameKey(
4102         IN    HANDLE KeyHandle,
4103         IN    PUNICODE_STRING ReplacementName
4104         );
4105 
4106     NTSYSAPI NTSTATUS NTAPI NtRemoveProcessDebug(
4107         IN    HANDLE Process,
4108         IN    HANDLE DebugObject
4109         );
4110 
4111     NTSYSAPI NTSTATUS NTAPI NtRemoveIoCompletion(
4112         IN    HANDLE IoCompletionHandle,
4113         OUT    PULONG CompletionKey,
4114         OUT    PULONG CompletionValue,
4115         OUT    PIO_STATUS_BLOCK IoStatusBlock,
4116         IN    PLARGE_INTEGER Timeout OPTIONAL
4117         );
4118 
4119     NTSYSAPI NTSTATUS NTAPI NtReleaseSemaphore(
4120         IN    HANDLE SemaphoreHandle,
4121         IN    LONG ReleaseCount,
4122         OUT    PLONG PreviousCount OPTIONAL
4123         );
4124 
4125     NTSYSAPI NTSTATUS NTAPI NtReleaseMutant(
4126         IN    HANDLE MutantHandle,
4127         OUT    PULONG PreviousState
4128         );
4129 
4130     NTSYSAPI NTSTATUS NTAPI NtReleaseKeyedEvent(
4131         IN    HANDLE KeyedEventHandle,
4132         IN    PVOID Key,
4133         IN    BOOLEAN Alertable,
4134         IN    PLARGE_INTEGER Timeout OPTIONAL
4135         );
4136 
4137     NTSYSAPI NTSTATUS NTAPI NtRegisterThreadTerminatePort(
4138         IN    HANDLE PortHandle
4139         );
4140 
4141     NTSYSAPI NTSTATUS NTAPI NtReadVirtualMemory(
4142         IN    HANDLE ProcessHandle,
4143         IN    PVOID BaseAddress,
4144         OUT    PVOID Buffer,
4145         IN    ULONG BufferLength,
4146         OUT    PULONG ReturnLength OPTIONAL
4147         );
4148 
4149     NTSYSAPI NTSTATUS NTAPI NtReadRequestData(
4150         IN    HANDLE PortHandle,
4151         IN    PPORT_MESSAGE Message,
4152         IN    ULONG Index,
4153         OUT    PVOID Buffer,
4154         IN    ULONG BufferLength,
4155         OUT    PULONG ReturnLength OPTIONAL
4156         );
4157 
4158     NTSYSAPI NTSTATUS NTAPI NtReadFileScatter(
4159         IN    HANDLE FileHandle,
4160         IN    HANDLE Event OPTIONAL,
4161         IN    PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4162         IN    PVOID ApcContext OPTIONAL,
4163         OUT    PIO_STATUS_BLOCK IoStatusBlock,
4164         IN    PFILE_SEGMENT_ELEMENT Buffer,
4165         IN    ULONG Length,
4166         IN    PLARGE_INTEGER ByteOffset OPTIONAL,
4167         IN    PULONG Key OPTIONAL
4168         );
4169 
4170     NTSYSAPI NTSTATUS NTAPI NtReadFile(
4171         IN    HANDLE FileHandle,
4172         IN    HANDLE Event OPTIONAL,
4173         IN    PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4174         IN    PVOID ApcContext OPTIONAL,
4175         OUT    PIO_STATUS_BLOCK IoStatusBlock,
4176         OUT    PVOID Buffer,
4177         IN    ULONG Length,
4178         IN    PLARGE_INTEGER ByteOffset OPTIONAL,
4179         IN    PULONG Key OPTIONAL
4180         );
4181 
4182     NTSYSAPI NTSTATUS NTAPI NtRaiseHardError(
4183         IN    NTSTATUS Status,
4184         IN    ULONG NumberOfArguments,
4185         IN    ULONG StringArgumentsMask,
4186         IN    PULONG_PTR Arguments,
4187         IN    HARDERROR_RESPONSE_OPTION ResponseOption,
4188         OUT    PHARDERROR_RESPONSE Response
4189         );
4190 
4191     NTSYSAPI NTSTATUS NTAPI NtRaiseException(
4192         IN    PEXCEPTION_RECORD ExceptionRecord,
4193         IN    PCONTEXT Context,
4194         IN    BOOLEAN SearchFrames
4195         );
4196 
4197     NTSYSAPI NTSTATUS NTAPI NtQueueApcThread(
4198         IN    HANDLE ThreadHandle,
4199         IN    PKNORMAL_ROUTINE ApcRoutine,
4200         IN    PVOID ApcContext OPTIONAL,
4201         IN    PVOID Argument1 OPTIONAL,
4202         IN    PVOID Argument2 OPTIONAL
4203         );
4204 
4205     NTSYSAPI NTSTATUS NTAPI NtQueryVolumeInformationFile(
4206         IN    HANDLE FileHandle,
4207         OUT    PIO_STATUS_BLOCK IoStatusBlock,
4208         OUT    PVOID VolumeInformation,
4209         IN    ULONG VolumeInformationLength,
4210         IN    FS_INFORMATION_CLASS VolumeInformationClass
4211         );
4212 
4213     NTSYSAPI NTSTATUS NTAPI NtQueryVirtualMemory(
4214         IN    HANDLE ProcessHandle,
4215         IN    PVOID BaseAddress,
4216         IN    MEMORY_INFORMATION_CLASS MemoryInformationClass,
4217         OUT    PVOID MemoryInformation,
4218         IN    ULONG MemoryInformationLength,
4219         OUT    PULONG ReturnLength OPTIONAL
4220         );
4221 
4222     NTSYSAPI NTSTATUS NTAPI NtQueryValueKey(
4223         IN    HANDLE KeyHandle,
4224         IN    PUNICODE_STRING ValueName,
4225         IN    KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
4226         OUT    PVOID KeyValueInformation,
4227         IN    ULONG KeyValueInformationLength,
4228         OUT    PULONG ResultLength
4229         );
4230 
4231     NTSYSAPI NTSTATUS NTAPI NtQueryTimerResolution(
4232         OUT    PULONG CoarsestResolution,
4233         OUT    PULONG FinestResolution,
4234         OUT    PULONG ActualResolution
4235         );
4236 
4237     NTSYSAPI NTSTATUS NTAPI NtQuerySystemTime(
4238         OUT    PLARGE_INTEGER CurrentTime
4239         );
4240 
4241     NTSYSAPI NTSTATUS NTAPI NtQuerySystemInformation(
4242         IN    SYSTEM_INFORMATION_CLASS SystemInformationClass,
4243         IN OUT    PVOID SystemInformation,
4244         IN    ULONG SystemInformationLength,
4245         OUT    PULONG ReturnLength OPTIONAL
4246         );
4247 
4248     NTSYSAPI NTSTATUS NTAPI NtQuerySystemEnvironmentValueEx(
4249         IN    ULONG Unknown1,
4250         IN    ULONG Unknown2,
4251         IN    ULONG Unknown3,
4252         IN    ULONG Unknown4,
4253         IN    ULONG Unknown5
4254         );
4255 
4256     NTSYSAPI NTSTATUS NTAPI NtQuerySystemEnvironmentValue(
4257         IN    PUNICODE_STRING Name,
4258         OUT    PVOID Value,
4259         IN    ULONG ValueLength,
4260         OUT    PULONG ReturnLength OPTIONAL
4261         );
4262 
4263     NTSYSAPI NTSTATUS NTAPI NtQuerySymbolicLinkObject(
4264         IN    HANDLE SymbolicLinkHandle,
4265         IN OUT    PUNICODE_STRING TargetName,
4266         OUT    PULONG ReturnLength OPTIONAL
4267         );
4268 
4269     NTSYSAPI NTSTATUS NTAPI NtQuerySecurityObject(
4270         IN    HANDLE ObjectHandle,
4271         IN    SECURITY_INFORMATION SecurityInformation,
4272         OUT    PSECURITY_DESCRIPTOR SecurityDescriptor,
4273         IN    ULONG DescriptorLength,
4274         OUT    PULONG ReturnLength
4275         );
4276 
4277     NTSYSAPI NTSTATUS NTAPI NtQuerySection(
4278         IN    HANDLE SectionHandle,
4279         IN    SECTION_INFORMATION_CLASS SectionInformationClass,
4280         OUT    PVOID SectionInformation,
4281         IN    ULONG SectionInformationLength,
4282         OUT    PULONG ResultLength OPTIONAL
4283         );
4284 
4285     NTSYSAPI BOOLEAN NTAPI NtQueryPortInformationProcess(
4286         VOID
4287         );
4288 
4289     NTSYSAPI NTSTATUS NTAPI NtQueryPerformanceCounter(
4290         OUT    PLARGE_INTEGER PerformanceCount,
4291         OUT    PLARGE_INTEGER PerformanceFrequency OPTIONAL
4292         );
4293 
4294     NTSYSAPI NTSTATUS NTAPI NtQueryOpenSubKeys(
4295         IN    POBJECT_ATTRIBUTES KeyObjectAttributes,
4296         OUT    PULONG NumberOfKeys
4297         );
4298 
4299     NTSYSAPI NTSTATUS NTAPI NtQueryObject(
4300         IN    HANDLE ObjectHandle,
4301         IN    OBJECT_INFORMATION_CLASS ObjectInformationClass,
4302         OUT    PVOID ObjectInformation,
4303         IN    ULONG ObjectInformationLength,
4304         OUT    PULONG ReturnLength OPTIONAL
4305         );
4306 
4307     NTSYSAPI NTSTATUS NTAPI NtQueryMultipleValueKey(
4308         IN    HANDLE KeyHandle,
4309         IN OUT    PKEY_VALUE_ENTRY ValueList,
4310         IN    ULONG NumberOfValues,
4311         OUT    PVOID Buffer,
4312         IN OUT    PULONG Length,
4313         OUT    PULONG ReturnLength
4314         );
4315 
4316     NTSYSAPI NTSTATUS NTAPI NtQueryKey(
4317         IN    HANDLE KeyHandle,
4318         IN    KEY_INFORMATION_CLASS KeyInformationClass,
4319         OUT    PVOID KeyInformation,
4320         IN    ULONG KeyInformationLength,
4321         OUT    PULONG ResultLength
4322         );
4323 
4324     NTSYSAPI NTSTATUS NTAPI NtQueryIntervalProfile(
4325         IN    KPROFILE_SOURCE Source,
4326         OUT    PULONG Interval
4327         );
4328 
4329     NTSYSAPI NTSTATUS NTAPI NtQueryInstallUILanguage(
4330         OUT    PLANGID LanguageId
4331         );
4332 
4333     NTSYSAPI NTSTATUS NTAPI NtQueryInformationToken(
4334         IN    HANDLE TokenHandle,
4335         IN    TOKEN_INFORMATION_CLASS TokenInformationClass,
4336         OUT    PVOID TokenInformation,
4337         IN    ULONG TokenInformationLength,
4338         OUT    PULONG ReturnLength
4339         );
4340 
4341     NTSYSAPI NTSTATUS NTAPI NtQueryInformationThread(
4342         IN    HANDLE ThreadHandle,
4343         IN    THREADINFOCLASS ThreadInformationClass,
4344         OUT    PVOID ThreadInformation,
4345         IN    ULONG ThreadInformationLength,
4346         OUT    PULONG ReturnLength OPTIONAL
4347         );
4348 
4349     NTSYSAPI NTSTATUS NTAPI NtQueryInformationProcess(
4350         IN    HANDLE ProcessHandle,
4351         IN    PROCESSINFOCLASS ProcessInformationClass,
4352         OUT    PVOID ProcessInformation,
4353         IN    ULONG ProcessInformationLength,
4354         OUT    PULONG ReturnLength OPTIONAL
4355         );
4356 
4357     NTSYSAPI NTSTATUS NTAPI NtQueryInformationPort(
4358         IN    HANDLE PortHandle,
4359         IN    PORT_INFORMATION_CLASS PortInformationClass,
4360         OUT    PVOID PortInformation,
4361         IN    ULONG PortInformationLength,
4362         OUT    PULONG ReturnLength OPTIONAL
4363         );
4364 
4365     NTSYSAPI NTSTATUS NTAPI NtQueryInformationJobObject(
4366         IN    HANDLE JobHandle,
4367         IN    JOBOBJECTINFOCLASS JobInformationClass,
4368         OUT    PVOID JobInformation,
4369         IN    ULONG JobInformationLength,
4370         OUT    PULONG ReturnLength OPTIONAL
4371         );
4372 
4373     NTSYSAPI NTSTATUS NTAPI NtQueryInformationFile(
4374         IN    HANDLE FileHandle,
4375         OUT    PIO_STATUS_BLOCK IoStatusBlock,
4376         OUT    PVOID FileInformation,
4377         IN    ULONG FileInformationLength,
4378         IN    FILE_INFORMATION_CLASS FileInformationClass
4379         );
4380 
4381     NTSYSAPI NTSTATUS NTAPI NtQueryInformationAtom(
4382         IN    USHORT Atom,
4383         IN    ATOM_INFORMATION_CLASS AtomInformationClass,
4384         OUT    PVOID AtomInformation,
4385         IN    ULONG AtomInformationLength,
4386         OUT    PULONG ReturnLength OPTIONAL
4387         );
4388 
4389     NTSYSAPI NTSTATUS NTAPI NtQueryFullAttributesFile(
4390         IN    POBJECT_ATTRIBUTES ObjectAttributes,
4391         OUT    PFILE_NETWORK_OPEN_INFORMATION FileInformation
4392         );
4393 
4394     NTSYSAPI NTSTATUS NTAPI NtQueryEvent(
4395         IN    HANDLE EventHandle,
4396         IN    EVENT_INFORMATION_CLASS EventInformationClass,
4397         OUT    PVOID EventInformation,
4398         IN    ULONG EventInformationLength,
4399         OUT    PULONG ResultLength OPTIONAL
4400         );
4401 
4402     NTSYSAPI NTSTATUS NTAPI NtQueryDirectoryObject(
4403         IN    HANDLE DirectoryHandle,
4404         OUT    PVOID Buffer,
4405         IN    ULONG BufferLength,
4406         IN    BOOLEAN ReturnSingleEntry,
4407         IN    BOOLEAN RestartScan,
4408         IN OUT    PULONG Context,
4409         OUT    PULONG ReturnLength OPTIONAL
4410         );
4411 
4412     NTSYSAPI NTSTATUS NTAPI NtQueryDirectoryFile(
4413         IN    HANDLE FileHandle,
4414         IN    HANDLE Event OPTIONAL,
4415         IN    PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4416         IN    PVOID ApcContext OPTIONAL,
4417         OUT    PIO_STATUS_BLOCK IoStatusBlock,
4418         OUT    PVOID FileInformation,
4419         IN    ULONG FileInformationLength,
4420         IN    FILE_INFORMATION_CLASS FileInformationClass,
4421         IN    BOOLEAN ReturnSingleEntry,
4422         IN    PUNICODE_STRING FileName OPTIONAL,
4423         IN    BOOLEAN RestartScan
4424         );
4425 
4426     NTSYSAPI NTSTATUS NTAPI NtQueryDefaultUILanguage(
4427         OUT    PLANGID LanguageId
4428         );
4429 
4430     NTSYSAPI NTSTATUS NTAPI NtQueryDefaultLocale(
4431         IN    BOOLEAN ThreadOrSystem,
4432         OUT    PLCID Locale
4433         );
4434 
4435     NTSYSAPI NTSTATUS NTAPI NtQueryDebugFilterState(
4436         IN    ULONG ComponentId,
4437         IN    ULONG Level
4438         );
4439 
4440     NTSYSAPI NTSTATUS NTAPI NtQueryBootOptions(
4441         IN    ULONG Unknown1,
4442         IN    ULONG Unknown2
4443         );
4444 
4445     NTSYSAPI NTSTATUS NTAPI NtQueryBootEntryOrder(
4446         IN    ULONG Unknown1,
4447         IN    ULONG Unknown2
4448         );
4449 
4450     NTSYSAPI NTSTATUS NTAPI NtQueryAttributesFile(
4451         IN    POBJECT_ATTRIBUTES ObjectAttributes,
4452         OUT    PFILE_BASIC_INFORMATION FileInformation
4453         );
4454 
4455     NTSYSAPI NTSTATUS NTAPI NtPulseEvent(
4456         IN    HANDLE EventHandle,
4457         OUT    PULONG PreviousState OPTIONAL
4458         );
4459 
4460     NTSYSAPI NTSTATUS NTAPI NtProtectVirtualMemory(
4461         IN    HANDLE ProcessHandle,
4462         IN OUT    PVOID *BaseAddress,
4463         IN OUT    PULONG ProtectSize,
4464         IN    ULONG NewProtect,
4465         OUT    PULONG OldProtect
4466         );
4467 
4468     NTSYSAPI NTSTATUS NTAPI NtPrivilegedServiceAuditAlarm(
4469         IN    PUNICODE_STRING SubsystemName,
4470         IN    PUNICODE_STRING ServiceName,
4471         IN    HANDLE TokenHandle,
4472         IN    PPRIVILEGE_SET Privileges,
4473         IN    BOOLEAN AccessGranted
4474         );
4475 
4476     NTSYSAPI NTSTATUS NTAPI NtPrivilegeObjectAuditAlarm(
4477         IN    PUNICODE_STRING SubsystemName,
4478         IN    PVOID HandleId,
4479         IN    HANDLE TokenHandle,
4480         IN    ACCESS_MASK DesiredAccess,
4481         IN    PPRIVILEGE_SET Privileges,
4482         IN    BOOLEAN AccessGranted
4483         );
4484 
4485     NTSYSAPI NTSTATUS NTAPI NtPrivilegeCheck(
4486         IN    HANDLE TokenHandle,
4487         IN    PPRIVILEGE_SET RequiredPrivileges,
4488         OUT    PBOOLEAN Result
4489         );
4490 
4491     NTSYSAPI NTSTATUS NTAPI NtPowerInformation(
4492         IN    POWER_INFORMATION_LEVEL PowerInformationLevel,
4493         IN    PVOID InputBuffer OPTIONAL,
4494         IN    ULONG InputBufferLength,
4495         OUT    PVOID OutputBuffer OPTIONAL,
4496         IN    ULONG OutputBufferLength
4497         );
4498 
4499     NTSYSAPI NTSTATUS NTAPI NtPlugPlayControl(
4500         IN    ULONG ControlCode,
4501         IN OUT    PVOID Buffer,
4502         IN    ULONG BufferLength,
4503         IN    PVOID Unknown OPTIONAL
4504         );
4505 
4506     NTSYSAPI NTSTATUS NTAPI NtOpenTimer(
4507         OUT    PHANDLE TimerHandle,
4508         IN    ACCESS_MASK DesiredAccess,
4509         IN    POBJECT_ATTRIBUTES ObjectAttributes
4510         );
4511 
4512     NTSYSAPI NTSTATUS NTAPI NtOpenThreadTokenEx(
4513         IN    HANDLE ThreadHandle,
4514         IN    ACCESS_MASK DesiredAccess,
4515         IN    BOOLEAN OpenAsSelf,
4516         IN    ULONG HandleAttributes,
4517         OUT    PHANDLE TokenHandle
4518         );
4519 
4520     NTSYSAPI NTSTATUS NTAPI NtOpenThreadToken(
4521         IN    HANDLE ThreadHandle,
4522         IN    ACCESS_MASK DesiredAccess,
4523         IN    BOOLEAN OpenAsSelf,
4524         OUT    PHANDLE TokenHandle
4525         );
4526 
4527     NTSYSAPI NTSTATUS NTAPI NtOpenThread(
4528         OUT    PHANDLE ThreadHandle,
4529         IN    ACCESS_MASK DesiredAccess,
4530         IN    POBJECT_ATTRIBUTES ObjectAttributes,
4531         IN    PCLIENT_ID ClientId
4532         );
4533 
4534     NTSYSAPI NTSTATUS NTAPI NtOpenSymbolicLinkObject(
4535         OUT    PHANDLE SymbolicLinkHandle,
4536         IN    ACCESS_MASK DesiredAccess,
4537         IN    POBJECT_ATTRIBUTES ObjectAttributes
4538         );
4539 
4540     NTSYSAPI NTSTATUS NTAPI NtOpenSemaphore(
4541         OUT    PHANDLE SemaphoreHandle,
4542         IN    ACCESS_MASK DesiredAccess,
4543         IN    POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL
4544         );
4545 
4546     NTSYSAPI NTSTATUS NTAPI NtOpenSection(
4547         OUT    PHANDLE SectionHandle,
4548         IN    ACCESS_MASK DesiredAccess,
4549         IN    POBJECT_ATTRIBUTES ObjectAttributes
4550         );
4551 
4552     NTSYSAPI NTSTATUS NTAPI NtOpenProcessTokenEx(
4553         IN    HANDLE ProcessHandle,
4554         IN    ACCESS_MASK DesiredAccess,
4555         IN    ULONG HandleAttributes,
4556         OUT    PHANDLE TokenHandle
4557         );
4558 
4559     NTSYSAPI NTSTATUS NTAPI NtOpenProcessToken(
4560         IN    HANDLE ProcessHandle,
4561         IN    ACCESS_MASK DesiredAccess,
4562         OUT    PHANDLE TokenHandle
4563         );
4564 
4565     NTSYSAPI NTSTATUS NTAPI NtOpenProcess(
4566         OUT    PHANDLE ProcessHandle,
4567         IN    ACCESS_MASK DesiredAccess,
4568         IN    POBJECT_ATTRIBUTES ObjectAttributes,
4569         IN    PCLIENT_ID ClientId OPTIONAL
4570         );
4571 
4572     NTSYSAPI NTSTATUS NTAPI NtOpenObjectAuditAlarm(
4573         IN    PUNICODE_STRING SubsystemName,
4574         IN    PVOID *HandleId,
4575         IN    PUNICODE_STRING ObjectTypeName,
4576         IN    PUNICODE_STRING ObjectName,
4577         IN    PSECURITY_DESCRIPTOR SecurityDescriptor,
4578         IN    HANDLE TokenHandle,
4579         IN    ACCESS_MASK DesiredAccess,
4580         IN    ACCESS_MASK GrantedAccess,
4581         IN    PPRIVILEGE_SET Privileges OPTIONAL,
4582         IN    BOOLEAN ObjectCreation,
4583         IN    BOOLEAN AccessGranted,
4584         OUT    PBOOLEAN GenerateOnClose
4585         );
4586 
4587     NTSYSAPI NTSTATUS NTAPI NtOpenMutant(
4588         OUT    PHANDLE MutantHandle,
4589         IN    ACCESS_MASK DesiredAccess,
4590         IN    POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL
4591         );
4592 
4593     NTSYSAPI NTSTATUS NTAPI NtOpenKeyedEvent(
4594         OUT    PHANDLE KeyedEventHandle,
4595         IN    ACCESS_MASK DesiredAccess,
4596         IN    POBJECT_ATTRIBUTES ObjectAttributes
4597         );
4598 
4599     NTSYSAPI NTSTATUS NTAPI NtOpenKey(
4600         OUT    PHANDLE KeyHandle,
4601         IN    ACCESS_MASK DesiredAccess,
4602         IN    POBJECT_ATTRIBUTES ObjectAttributes
4603         );
4604 
4605     NTSYSAPI NTSTATUS NTAPI NtOpenJobObject(
4606         OUT    PHANDLE JobHandle,
4607         IN    ACCESS_MASK DesiredAccess,
4608         IN    POBJECT_ATTRIBUTES ObjectAttributes
4609         );
4610 
4611     NTSYSAPI NTSTATUS NTAPI NtOpenIoCompletion(
4612         OUT    PHANDLE IoCompletionHandle,
4613         IN    ACCESS_MASK DesiredAccess,
4614         IN    POBJECT_ATTRIBUTES ObjectAttributes
4615         );
4616 
4617     NTSYSAPI NTSTATUS NTAPI NtOpenFile(
4618         OUT    PHANDLE FileHandle,
4619         IN    ACCESS_MASK DesiredAccess,
4620         IN    POBJECT_ATTRIBUTES ObjectAttributes,
4621         OUT    PIO_STATUS_BLOCK IoStatusBlock,
4622         IN    ULONG ShareAccess,
4623         IN    ULONG OpenOptions
4624         );
4625 
4626     NTSYSAPI NTSTATUS NTAPI NtOpenEventPair(
4627         OUT    PHANDLE EventPairHandle,
4628         IN    ACCESS_MASK DesiredAccess,
4629         IN    POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL
4630         );
4631 
4632     NTSYSAPI NTSTATUS NTAPI NtOpenEvent(
4633         OUT    PHANDLE EventHandle,
4634         IN    ACCESS_MASK DesiredAccess,
4635         IN    POBJECT_ATTRIBUTES ObjectAttributes
4636         );
4637 
4638     NTSYSAPI NTSTATUS NTAPI NtOpenDirectoryObject(
4639         OUT    PHANDLE DirectoryHandle,
4640         IN    ACCESS_MASK DesiredAccess,
4641         IN    POBJECT_ATTRIBUTES ObjectAttributes
4642         );
4643 
4644     NTSYSAPI NTSTATUS NTAPI NtNotifyChangeMultipleKeys(
4645         IN    HANDLE KeyHandle,
4646         IN    ULONG Flags,
4647         IN    POBJECT_ATTRIBUTES KeyObjectAttributes,
4648         IN    HANDLE EventHandle OPTIONAL,
4649         IN    PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4650         IN    PVOID ApcContext OPTIONAL,
4651         OUT    PIO_STATUS_BLOCK IoStatusBlock,
4652         IN    ULONG NotifyFilter,
4653         IN    BOOLEAN WatchSubtree,
4654         IN    PVOID Buffer,
4655         IN    ULONG BufferLength,
4656         IN    BOOLEAN Asynchronous
4657         );
4658 
4659     NTSYSAPI NTSTATUS NTAPI NtNotifyChangeKey(
4660         IN    HANDLE KeyHandle,
4661         IN    HANDLE EventHandle OPTIONAL,
4662         IN    PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4663         IN    PVOID ApcContext OPTIONAL,
4664         OUT    PIO_STATUS_BLOCK IoStatusBlock,
4665         IN    ULONG NotifyFilter,
4666         IN    BOOLEAN WatchSubtree,
4667         IN    PVOID Buffer,
4668         IN    ULONG BufferLength,
4669         IN    BOOLEAN Asynchronous
4670         );
4671 
4672     NTSYSAPI NTSTATUS NTAPI NtNotifyChangeDirectoryFile(
4673         IN    HANDLE FileHandle,
4674         IN    HANDLE Event OPTIONAL,
4675         IN    PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4676         IN    PVOID ApcContext OPTIONAL,
4677         OUT    PIO_STATUS_BLOCK IoStatusBlock,
4678         OUT    PFILE_NOTIFY_INFORMATION Buffer,
4679         IN    ULONG BufferLength,
4680         IN    ULONG NotifyFilter,
4681         IN    BOOLEAN WatchSubtree
4682         );
4683 
4684     NTSYSAPI NTSTATUS NTAPI NtModifyDriverEntry(
4685         IN    PUNICODE_STRING DriverName,
4686         IN    PUNICODE_STRING DriverPath
4687         );
4688 
4689     NTSYSAPI NTSTATUS NTAPI NtModifyBootEntry(
4690         IN    PUNICODE_STRING EntryName,
4691         IN    PUNICODE_STRING EntryValue
4692         );
4693 
4694     NTSYSAPI NTSTATUS NTAPI NtMapViewOfSection(
4695         IN    HANDLE SectionHandle,
4696         IN    HANDLE ProcessHandle,
4697         IN OUT    PVOID *BaseAddress,
4698         IN    ULONG ZeroBits,
4699         IN    ULONG CommitSize,
4700         IN OUT    PLARGE_INTEGER SectionOffset OPTIONAL,
4701         IN OUT    PULONG ViewSize,
4702         IN    SECTION_INHERIT InheritDisposition,
4703         IN    ULONG AllocationType,
4704         IN    ULONG Protect
4705         );
4706 
4707     NTSYSAPI NTSTATUS NTAPI NtMapUserPhysicalPagesScatter(
4708         IN    PVOID *BaseAddresses,
4709         IN    PULONG NumberOfPages,
4710         IN    PULONG PageFrameNumbers
4711         );
4712 
4713     NTSYSAPI NTSTATUS NTAPI NtMapUserPhysicalPages(
4714         IN    PVOID BaseAddress,
4715         IN    PULONG NumberOfPages,
4716         IN    PULONG PageFrameNumbers
4717         );
4718 
4719     NTSYSAPI NTSTATUS NTAPI NtMakeTemporaryObject(
4720         IN    HANDLE ObjectHandle
4721         );
4722 
4723     NTSYSAPI NTSTATUS NTAPI NtMakePermanentObject(
4724         IN    HANDLE Object
4725         );
4726 
4727     NTSYSAPI NTSTATUS NTAPI NtLockVirtualMemory(
4728         IN    HANDLE ProcessHandle,
4729         IN OUT    PVOID *BaseAddress,
4730         IN OUT    PULONG LockSize,
4731         IN    ULONG LockType
4732         );
4733 
4734     NTSYSAPI NTSTATUS NTAPI NtLockRegistryKey(
4735         IN    HANDLE Key
4736         );
4737 
4738     NTSYSAPI NTSTATUS NTAPI NtLockFile(
4739         IN    HANDLE FileHandle,
4740         IN    HANDLE Event OPTIONAL,
4741         IN    PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4742         IN    PVOID ApcContext OPTIONAL,
4743         OUT    PIO_STATUS_BLOCK IoStatusBlock,
4744         IN    PULARGE_INTEGER LockOffset,
4745         IN    PULARGE_INTEGER LockLength,
4746         IN    ULONG Key,
4747         IN    BOOLEAN FailImmediately,
4748         IN    BOOLEAN ExclusiveLock
4749         );
4750 
4751     NTSYSAPI NTSTATUS NTAPI NtLoadKey(
4752         IN    POBJECT_ATTRIBUTES KeyObjectAttributes,
4753         IN    POBJECT_ATTRIBUTES FileObjectAttributes
4754         );
4755 
4756     NTSYSAPI NTSTATUS NTAPI NtLoadKey2(
4757         IN    POBJECT_ATTRIBUTES KeyObjectAttributes,
4758         IN    POBJECT_ATTRIBUTES FileObjectAttributes,
4759         IN    ULONG Flags
4760         );
4761 
4762     NTSYSAPI NTSTATUS NTAPI NtLoadDriver(
4763         IN    PUNICODE_STRING DriverServiceName
4764         );
4765 
4766     NTSYSAPI NTSTATUS NTAPI NtListenPort(
4767         IN    HANDLE PortHandle,
4768         OUT    PPORT_MESSAGE RequestMessage
4769         );
4770 
4771     NTSYSAPI NTSTATUS NTAPI NtFreeUserPhysicalPages(
4772         IN    HANDLE ProcessHandle,
4773         IN OUT    PULONG NumberOfPages,
4774         IN    PULONG PageFrameNumbers
4775         );
4776 
4777     NTSYSAPI NTSTATUS NTAPI NtFreeVirtualMemory(
4778         IN    HANDLE ProcessHandle,
4779         IN OUT    PVOID *BaseAddress,
4780         IN OUT    PULONG FreeSize,
4781         IN    ULONG FreeType
4782         );
4783 
4784     NTSYSAPI NTSTATUS NTAPI NtFsControlFile(
4785         IN    HANDLE FileHandle,
4786         IN    HANDLE Event OPTIONAL,
4787         IN    PIO_APC_ROUTINE ApcRoutine OPTIONAL,
4788         IN    PVOID ApcContext OPTIONAL,
4789         OUT    PIO_STATUS_BLOCK IoStatusBlock,
4790         IN    ULONG FsControlCode,
4791         IN    PVOID InputBuffer OPTIONAL,
4792         IN    ULONG InputBufferLength,
4793         OUT    PVOID OutputBuffer OPTIONAL,
4794         IN    ULONG OutputBufferLength
4795         );
4796 
4797     NTSYSAPI NTSTATUS NTAPI NtGetContextThread(
4798         IN    HANDLE ThreadHandle,
4799         OUT    PCONTEXT Context
4800         );
4801 
4802     NTSYSAPI NTSTATUS NTAPI NtGetDevicePowerState(
4803         IN    HANDLE DeviceHandle,
4804         OUT    PDEVICE_POWER_STATE DevicePowerState
4805         );
4806 
4807     NTSYSAPI NTSTATUS NTAPI NtGetPlugPlayEvent(
4808         IN    ULONG Reserved1,
4809         IN    ULONG Reserved2,
4810         OUT    PVOID Buffer,
4811         IN    ULONG BufferLength
4812         );
4813 
4814     NTSYSAPI NTSTATUS NTAPI NtGetWriteWatch(
4815         IN    HANDLE ProcessHandle,
4816         IN    ULONG Flags,
4817         IN    PVOID BaseAddress,
4818         IN    ULONG RegionSize,
4819         OUT    PULONG Buffer,
4820         IN OUT    PULONG BufferEntries,
4821         OUT    PULONG Granularity
4822         );
4823 
4824     NTSYSAPI NTSTATUS NTAPI NtImpersonateAnonymousToken(
4825         IN    HANDLE ThreadHandle
4826         );
4827 
4828     NTSYSAPI NTSTATUS NTAPI NtImpersonateClientOfPort(
4829         IN    HANDLE PortHandle,
4830         IN    PPORT_MESSAGE Message
4831         );
4832 
4833     NTSYSAPI NTSTATUS NTAPI NtImpersonateThread(
4834         IN    HANDLE ThreadHandle,
4835         IN    HANDLE TargetThreadHandle,
4836         IN    PSECURITY_QUALITY_OF_SERVICE SecurityQos
4837         );
4838 
4839     NTSYSAPI NTSTATUS NTAPI NtInitializeRegistry(
4840         IN    BOOLEAN Setup
4841         );
4842 
4843     NTSYSAPI NTSTATUS NTAPI NtInitiatePowerAction(
4844         IN    POWER_ACTION SystemAction,
4845         IN    SYSTEM_POWER_STATE MinSystemState,
4846         IN    ULONG Flags,
4847         IN    BOOLEAN Asynchronous
4848         );
4849 
4850     NTSYSAPI NTSTATUS NTAPI NtIsProcessInJob(
4851         IN    HANDLE ProcessHandle,
4852         IN    HANDLE JobHandle OPTIONAL
4853         );
4854 
4855     NTSYSAPI BOOLEAN NTAPI NtIsSystemResumeAutomatic(
4856         VOID
4857         );
4858 
4859     NTSYSAPI NTSTATUS NTAPI NtTestAlert(
4860         VOID
4861         );
4862 
4863     NTSYSAPI NTSTATUS NTAPI NtAlertThread(
4864         IN    HANDLE ThreadHandle
4865         );
4866 
4867     NTSYSAPI ULONG NTAPI NtGetTickCount(
4868         VOID
4869         );
4870 
4871     NTSYSAPI NTSTATUS NTAPI NtW32Call(
4872         IN    ULONG RoutineIndex,
4873         IN    PVOID Argument,
4874         IN    ULONG ArgumentLength,
4875         OUT    PVOID *Result OPTIONAL,
4876         OUT    PULONG ResultLength OPTIONAL
4877         );
4878 
4879     NTSYSAPI NTSTATUS NTAPI NtSetLowWaitHighThread(
4880         VOID
4881         );
4882 
4883     NTSYSAPI NTSTATUS NTAPI NtSetHighWaitLowThread(
4884         VOID
4885         );
4886 
4887     NTSYSAPI NTSTATUS NTAPI NtCreatePagingFile(
4888         IN    PUNICODE_STRING FileName,
4889         IN    PULARGE_INTEGER InitialSize,
4890         IN    PULARGE_INTEGER MaximumSize,
4891         IN    ULONG Priority OPTIONAL
4892         );
4893 
4894     NTSYSAPI NTSTATUS NTAPI NtVdmControl(
4895         IN    ULONG ControlCode,
4896         IN    PVOID ControlData
4897         );
4898 
4899     NTSYSAPI NTSTATUS NTAPI NtQueryEaFile(
4900         IN    HANDLE FileHandle,
4901         OUT    PIO_STATUS_BLOCK IoStatusBlock,
4902         OUT    PVOID Buffer,
4903         IN    ULONG Length,
4904         IN    BOOLEAN ReturnSingleEntry,
4905         IN    PVOID EaList OPTIONAL,
4906         IN    ULONG EaListLength,
4907         IN    PULONG EaIndex OPTIONAL,
4908         IN    BOOLEAN RestartScan
4909         );
4910 
4911     NTSTATUS NTAPI RtlCreateProcessParameters(
4912         OUT    PRTL_USER_PROCESS_PARAMETERS *ProcessParameters,
4913         IN    PUNICODE_STRING ImageFile,
4914         IN    PUNICODE_STRING DllPath OPTIONAL,
4915         IN    PUNICODE_STRING CurrentDirectory OPTIONAL,
4916         IN    PUNICODE_STRING CommandLine OPTIONAL,
4917         IN    PWSTR Environment OPTIONAL,
4918         IN    PUNICODE_STRING WindowTitle OPTIONAL,
4919         IN    PUNICODE_STRING DesktopInfo OPTIONAL,
4920         IN    PUNICODE_STRING ShellInfo OPTIONAL,
4921         IN    PUNICODE_STRING RuntimeInfo OPTIONAL
4922         );
4923 
4924     NTSTATUS NTAPI RtlDestroyProcessParameters(
4925         IN    PRTL_USER_PROCESS_PARAMETERS ProcessParameters
4926         );
4927 
4928     PDEBUG_BUFFER NTAPI RtlCreateQueryDebugBuffer(
4929         IN    ULONG Size,
4930         IN    BOOLEAN EventPair
4931         );
4932 
4933     NTSTATUS NTAPI RtlQueryProcessDebugInformation(
4934         IN    ULONG ProcessId,
4935         IN    ULONG DebugInfoClassMask,
4936         IN OUT    PDEBUG_BUFFER DebugBuffer
4937         );
4938 
4939     NTSTATUS NTAPI RtlDestroyQueryDebugBuffer(
4940         IN    PDEBUG_BUFFER DebugBuffer
4941         );
4942 
4943     NTSYSAPI VOID NTAPI RtlInitUnicodeString(
4944         OUT    PUNICODE_STRING DestinationString,
4945         IN    PCWSTR SourceString
4946         );
4947 
4948     NTSYSAPI VOID NTAPI RtlInitString(
4949         PSTRING DestinationString,
4950         PCSTR SourceString
4951         );
4952 
4953     NTSYSAPI VOID NTAPI RtlInitAnsiString(
4954         OUT    PANSI_STRING DestinationString,
4955         IN    PCSTR SourceString
4956         );
4957 
4958     NTSYSAPI NTSTATUS NTAPI RtlAnsiStringToUnicodeString(
4959         OUT    PUNICODE_STRING DestinationString,
4960         IN    PANSI_STRING SourceString,
4961         IN    BOOLEAN AllocateDestinationString
4962         );
4963 
4964     NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToAnsiString(
4965         OUT    PANSI_STRING DestinationString,
4966         IN    PCUNICODE_STRING SourceString,
4967         IN    BOOLEAN AllocateDestinationString
4968         );
4969 
4970     NTSYSAPI LONG NTAPI RtlCompareUnicodeString(
4971         IN    PUNICODE_STRING String1,
4972         IN    PUNICODE_STRING String2,
4973         IN    BOOLEAN CaseInSensitive
4974         );
4975 
4976     NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(
4977         IN    PCUNICODE_STRING String1,
4978         IN    PCUNICODE_STRING String2,
4979         IN    BOOLEAN CaseInSensitive
4980         );
4981 
4982     NTSYSAPI NTSTATUS NTAPI RtlHashUnicodeString(
4983         IN    CONST UNICODE_STRING *String,
4984         IN    BOOLEAN CaseInSensitive,
4985         IN    ULONG HashAlgorithm,
4986         OUT    PULONG HashValue
4987         );
4988 
4989     NTSYSAPI VOID NTAPI RtlCopyUnicodeString(
4990         OUT    PUNICODE_STRING DestinationString,
4991         IN    PUNICODE_STRING SourceString
4992         );
4993 
4994     NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(
4995         IN OUT    PUNICODE_STRING Destination,
4996         IN    PUNICODE_STRING Source
4997         );
4998 
4999     NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeToString(
5000         PUNICODE_STRING Destination,
5001         PCWSTR Source
5002         );
5003 
5004     NTSYSAPI VOID NTAPI RtlFreeUnicodeString(
5005         PUNICODE_STRING UnicodeString
5006         );
5007 
5008     NTSYSAPI VOID NTAPI RtlFreeAnsiString(
5009         PANSI_STRING AnsiString
5010         );
5011 
5012     NTSYSAPI ULONG NTAPI RtlxUnicodeStringToAnsiSize(
5013         PCUNICODE_STRING UnicodeString
5014         );
5015 
5016     NTSYSAPI DWORD NTAPI RtlNtStatusToDosError(
5017         IN    NTSTATUS status
5018         );
5019 
5020     NTSYSAPI NTSTATUS NTAPI RtlAdjustPrivilege(
5021         ULONG  Privilege,
5022         BOOLEAN Enable,
5023         BOOLEAN CurrentThread,
5024         PBOOLEAN Enabled
5025         );
5026 
5027     NTSYSAPI BOOLEAN NTAPI RtlCreateUnicodeString(
5028         OUT    PUNICODE_STRING DestinationString,
5029         IN    PCWSTR SourceString
5030         );
5031 
5032     NTSYSAPI BOOLEAN NTAPI RtlCreateUnicodeStringFromAsciiz(
5033         OUT    PUNICODE_STRING Destination,
5034         IN    PCSTR Source
5035         );
5036 
5037     NTSYSAPI BOOLEAN NTAPI RtlPrefixUnicodeString(
5038         IN    PUNICODE_STRING String1,
5039         IN    PUNICODE_STRING String2,
5040         IN    BOOLEAN CaseInSensitive
5041         );
5042 
5043     NTSYSAPI NTSTATUS NTAPI RtlDuplicateUnicodeString(
5044         IN    BOOLEAN AllocateNew,
5045         IN    PUNICODE_STRING SourceString,
5046         OUT    PUNICODE_STRING TargetString
5047         );
5048 
5049     NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToInteger(
5050         IN    PUNICODE_STRING String,
5051         IN    ULONG Base OPTIONAL,
5052         OUT    PULONG Value
5053         );
5054 
5055     NTSYSAPI NTSTATUS NTAPI RtlIntegerToUnicodeString(
5056         IN    ULONG Value,
5057         IN    ULONG Base OPTIONAL,
5058         IN OUT    PUNICODE_STRING String
5059         );
5060 
5061     NTSYSAPI NTSTATUS NTAPI RtlGUIDFromString(
5062         IN    PUNICODE_STRING GuidString,
5063         OUT    GUID *Guid
5064         );
5065 
5066     NTSYSAPI NTSTATUS NTAPI RtlUpcaseUnicodeString(
5067         OUT    PUNICODE_STRING DestinationString,
5068         IN    PUNICODE_STRING SourceString,
5069         IN    BOOLEAN AllocateDestinationString
5070         );
5071 
5072     NTSYSAPI NTSTATUS NTAPI RtlDowncaseUnicodeString(
5073         OUT    PUNICODE_STRING DestinationString,
5074         IN    PUNICODE_STRING SourceString,
5075         IN    BOOLEAN AllocateDestinationString
5076         );
5077 
5078     NTSYSAPI NTSTATUS NTAPI RtlFormatCurrentUserKeyPath(
5079         OUT    PUNICODE_STRING CurrentUserKeyPath
5080         );
5081 
5082     NTSYSAPI VOID NTAPI RtlRaiseStatus(
5083         IN    NTSTATUS Status
5084         );
5085 
5086     NTSYSAPI ULONG NTAPI RtlRandom(
5087         IN OUT    PULONG Seed
5088         );
5089 
5090     NTSYSAPI NTSTATUS NTAPI RtlInitializeCriticalSection(
5091         IN    PRTL_CRITICAL_SECTION CriticalSection
5092         );
5093 
5094     NTSYSAPI BOOL NTAPI RtlTryEnterCriticalSection(
5095         IN    PRTL_CRITICAL_SECTION CriticalSection
5096         );
5097 
5098     NTSYSAPI NTSTATUS NTAPI RtlEnterCriticalSection(
5099         IN    PRTL_CRITICAL_SECTION CriticalSection
5100         );
5101 
5102     NTSYSAPI NTSTATUS NTAPI RtlLeaveCriticalSection(
5103         IN    PRTL_CRITICAL_SECTION CriticalSection
5104         );
5105 
5106     NTSYSAPI NTSTATUS NTAPI RtlDeleteCriticalSection(
5107         IN    PRTL_CRITICAL_SECTION CriticalSection
5108         );
5109 
5110     NTSYSAPI NTSTATUS NTAPI RtlCompressBuffer(
5111         IN    USHORT CompressionFormatAndEngine,
5112         IN    PUCHAR UncompressedBuffer,
5113         IN    ULONG UncompressedBufferSize,
5114         OUT    PUCHAR CompressedBuffer,
5115         IN    ULONG CompressedBufferSize,
5116         IN    ULONG UncompressedChunkSize,
5117         OUT    PULONG FinalCompressedSize,
5118         IN    PVOID WorkSpace
5119         );
5120 
5121     NTSYSAPI NTSTATUS NTAPI RtlDecompressBuffer(
5122         IN    USHORT CompressionFormat,
5123         OUT    PUCHAR UncompressedBuffer,
5124         IN    ULONG UncompressedBufferSize,
5125         IN    PUCHAR CompressedBuffer,
5126         IN    ULONG CompressedBufferSize,
5127         OUT    PULONG FinalUncompressedSize
5128         );
5129 
5130     NTSYSAPI VOID NTAPI RtlInitializeHandleTable(
5131         IN    ULONG MaximumNumberOfHandles,
5132         IN    ULONG SizeOfHandleTableEntry,
5133         OUT    PRTL_HANDLE_TABLE HandleTable
5134         );
5135 
5136     NTSYSAPI PRTL_HANDLE_TABLE_ENTRY NTAPI RtlAllocateHandle(
5137         IN    PRTL_HANDLE_TABLE HandleTable,
5138         OUT    PULONG HandleIndex OPTIONAL
5139         );
5140 
5141     NTSYSAPI BOOLEAN NTAPI RtlFreeHandle(
5142         IN    PRTL_HANDLE_TABLE HandleTable,
5143         IN    PRTL_HANDLE_TABLE_ENTRY Handle
5144         );
5145 
5146     NTSYSAPI BOOLEAN NTAPI RtlIsValidIndexHandle(
5147         IN    PRTL_HANDLE_TABLE HandleTable,
5148         IN    ULONG HandleIndex,
5149         OUT    PRTL_HANDLE_TABLE_ENTRY *Handle
5150         );
5151 
5152     NTSYSAPI NTSTATUS NTAPI RtlOpenCurrentUser(
5153         IN    ULONG DesiredAccess,
5154         OUT    PHANDLE CurrentUserKey
5155         );
5156 
5157     NTSYSAPI NTSTATUS NTAPI RtlCreateEnvironment(
5158         BOOLEAN CloneCurrentEnvironment,
5159         PVOID *Environment
5160         );
5161 
5162     NTSYSAPI NTSTATUS NTAPI RtlQueryEnvironmentVariable_U(
5163         PVOID Environment,
5164         PUNICODE_STRING Name,
5165         PUNICODE_STRING Value
5166         );
5167 
5168     NTSYSAPI NTSTATUS NTAPI RtlSetEnvironmentVariable(
5169         PVOID *Environment,
5170         PUNICODE_STRING Name,
5171         PUNICODE_STRING Value
5172         );
5173 
5174     NTSYSAPI NTSTATUS NTAPI RtlDestroyEnvironment(
5175         PVOID Environment
5176         );
5177 
5178     NTSYSAPI BOOLEAN NTAPI RtlDosPathNameToNtPathName_U(
5179         IN    PWSTR DosPathName,
5180         OUT    PUNICODE_STRING NtPathName,
5181         OUT    PWSTR * NtFileNamePart OPTIONAL,
5182         OUT    PCURDIR DirectoryInfo OPTIONAL
5183         );
5184 
5185     NTSYSAPI NTSTATUS NTAPI RtlCreateUserProcess(
5186         PUNICODE_STRING NtImagePathName,
5187         ULONG Attributes,
5188         PRTL_USER_PROCESS_PARAMETERS ProcessParameters,
5189         PSECURITY_DESCRIPTOR ProcessSecurityDescriptor,
5190         PSECURITY_DESCRIPTOR ThreadSecurityDescriptor,
5191         HANDLE ParentProcess,
5192         BOOLEAN InheritHandles,
5193         HANDLE DebugPort,
5194         HANDLE ExceptionPort,
5195         PRTL_USER_PROCESS_INFORMATION ProcessInformation
5196         );
5197 
5198     NTSYSAPI NTSTATUS NTAPI RtlCreateUserThread(
5199         IN    HANDLE Process,
5200         IN    PSECURITY_DESCRIPTOR ThreadSecurityDescriptor OPTIONAL,
5201         IN    BOOLEAN CreateSuspended,
5202         IN    ULONG_PTR ZeroBits OPTIONAL,
5203         IN    SIZE_T MaximumStackSize OPTIONAL,
5204         IN    SIZE_T CommittedStackSize OPTIONAL,
5205         IN    PUSER_THREAD_START_ROUTINE StartAddress,
5206         IN    PVOID Parameter OPTIONAL,
5207         OUT    PHANDLE Thread OPTIONAL,
5208         OUT    PCLIENT_ID ClientId OPTIONAL
5209         );
5210 
5211     NTSYSAPI HANDLE NTAPI RtlCreateHeap(
5212         IN    ULONG Flags,
5213         IN    PVOID BaseAddress OPTIONAL,
5214         IN    ULONG SizeToReserve,
5215         IN    ULONG SizeToCommit,
5216         IN    BOOLEAN Lock OPTIONAL,
5217         IN    PRTL_HEAP_PARAMETERS Definition OPTIONAL
5218         );
5219 
5220     NTSYSAPI ULONG NTAPI RtlDestroyHeap(
5221         IN    HANDLE HeapHandle
5222         );
5223 
5224     NTSYSAPI PVOID NTAPI RtlAllocateHeap(
5225         IN    HANDLE HeapHandle,
5226         IN    ULONG Flags,
5227         IN    SIZE_T Size
5228         );
5229 
5230     NTSYSAPI PVOID NTAPI RtlReAllocateHeap(
5231         IN    HANDLE HeapHandle,
5232         IN    ULONG Flags,
5233         IN    LPVOID Address,
5234         IN    SIZE_T Size
5235         );
5236 
5237     NTSYSAPI BOOLEAN NTAPI RtlFreeHeap(
5238         IN    HANDLE HeapHandle,
5239         IN    ULONG Flags,
5240         IN    PVOID Address
5241         );
5242 
5243     NTSYSAPI ULONG NTAPI RtlCompactHeap(
5244         IN    HANDLE HeapHandle,
5245         IN    ULONG Flags
5246         );
5247 
5248     NTSYSAPI BOOLEAN NTAPI RtlLockHeap(
5249         IN    HANDLE HeapHandle
5250         );
5251 
5252     NTSYSAPI BOOLEAN NTAPI RtlUnlockHeap(
5253         IN    HANDLE HeapHandle
5254         );
5255 
5256     NTSYSAPI ULONG NTAPI RtlSizeHeap(
5257         IN    HANDLE HeapHandle,
5258         IN    ULONG Flags,
5259         IN    PVOID Address
5260         );
5261 
5262     NTSYSAPI BOOLEAN NTAPI RtlValidateHeap(
5263         IN    HANDLE HeapHandle,
5264         IN    ULONG Flags,
5265         IN    PVOID Address OPTIONAL
5266         );
5267 
5268     NTSYSAPI NTSTATUS NTAPI RtlCreateSecurityDescriptor(
5269         IN    PSECURITY_DESCRIPTOR SecurityDescriptor,
5270         IN    ULONG Revision
5271         );
5272 
5273     NTSYSAPI NTSTATUS NTAPI RtlGetDaclSecurityDescriptor(
5274         IN    PSECURITY_DESCRIPTOR SecurityDescriptor,
5275         OUT    PBOOLEAN DaclPresent,
5276         OUT    PACL *Dacl,
5277         OUT    PBOOLEAN DaclDefaulted
5278         );
5279 
5280     NTSYSAPI NTSTATUS NTAPI RtlSetDaclSecurityDescriptor(
5281         IN    PSECURITY_DESCRIPTOR SecurityDescriptor,
5282         IN    BOOLEAN DaclPresent,
5283         IN    PACL Dacl OPTIONAL,
5284         IN    BOOLEAN DaclDefaulted OPTIONAL
5285         );
5286 
5287     NTSYSAPI NTSTATUS NTAPI RtlSetOwnerSecurityDescriptor(
5288         IN    PSECURITY_DESCRIPTOR SecurityDescriptor,
5289         IN    PSID Owner OPTIONAL,
5290         IN    BOOLEAN OwnerDefaulted OPTIONAL
5291         );
5292 
5293     NTSYSAPI NTSTATUS NTAPI RtlAllocateAndInitializeSid(
5294         IN    PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,
5295         IN    UCHAR SubAuthorityCount,
5296         IN    ULONG SubAuthority0,
5297         IN    ULONG SubAuthority1,
5298         IN    ULONG SubAuthority2,
5299         IN    ULONG SubAuthority3,
5300         IN    ULONG SubAuthority4,
5301         IN    ULONG SubAuthority5,
5302         IN    ULONG SubAuthority6,
5303         IN    ULONG SubAuthority7,
5304         OUT    PSID *Sid
5305         );
5306 
5307     NTSYSAPI ULONG NTAPI RtlLengthSid(
5308         IN    PSID Sid
5309         );
5310 
5311     NTSYSAPI BOOLEAN NTAPI RtlEqualSid(
5312         IN    PSID Sid1,
5313         IN    PSID Sid2
5314         );
5315 
5316     NTSYSAPI PVOID NTAPI RtlFreeSid(
5317         IN    PSID Sid
5318         );
5319 
5320     NTSYSAPI NTSTATUS NTAPI RtlCreateAcl(
5321         IN    PACL Acl,
5322         IN    ULONG AclLength,
5323         IN    ULONG AclRevision
5324         );
5325 
5326     NTSYSAPI NTSTATUS NTAPI RtlGetAce(
5327         IN    PACL Acl,
5328         IN    ULONG AceIndex,
5329         OUT    PVOID *Ace
5330         );
5331 
5332     NTSYSAPI NTSTATUS NTAPI RtlAddAccessAllowedAce(
5333         IN OUT    PACL Acl,
5334         IN    ULONG AceRevision,
5335         IN    ACCESS_MASK AccessMask,
5336         IN    PSID Sid
5337         );
5338 
5339     NTSYSAPI NTSTATUS NTAPI RtlAddAccessAllowedAceEx(
5340         IN OUT    PACL Acl,
5341         IN    ULONG AceRevision,
5342         IN    ULONG AceFlags,
5343         IN    ULONG AccessMask,
5344         IN    PSID Sid
5345         );
5346 
5347     NTSYSAPI ULONG NTAPI RtlNtStatusToDosErrorNoTeb(
5348         NTSTATUS Status
5349         );
5350 
5351     NTSYSAPI NTSTATUS NTAPI RtlGetLastNtStatus(
5352         );
5353 
5354     NTSYSAPI ULONG NTAPI RtlGetLastWin32Error(
5355         );
5356 
5357     NTSYSAPI VOID NTAPI RtlSetLastWin32Error(
5358         ULONG WinError
5359         );
5360 
5361     NTSYSAPI VOID NTAPI RtlSetLastWin32ErrorAndNtStatusFromNtStatus(
5362         NTSTATUS Status
5363         );
5364 
5365     NTSYSAPI VOID NTAPI DbgBreakPoint(
5366         VOID
5367         );
5368 
5369     NTSYSAPI ULONG _cdecl DbgPrint(
5370         PCH Format,
5371         ...
5372         );
5373 
5374     NTSYSAPI NTSTATUS NTAPI LdrLoadDll(
5375         IN    PWSTR DllPath OPTIONAL,
5376         IN    PULONG DllCharacteristics OPTIONAL,
5377         IN    PUNICODE_STRING DllName,
5378         OUT    PVOID *DllHandle
5379         );
5380 
5381     NTSYSAPI NTSTATUS NTAPI LdrGetDllHandle(
5382         IN    PWSTR DllPath OPTIONAL,
5383         IN    PULONG DllCharacteristics OPTIONAL,
5384         IN    PUNICODE_STRING DllName,
5385         OUT    PVOID * DllHandle
5386         );
5387 
5388     NTSYSAPI NTSTATUS NTAPI LdrUnloadDll(
5389         IN    PVOID DllHandle
5390         );
5391 
5392     NTSYSAPI NTSTATUS NTAPI LdrGetProcedureAddress(
5393         IN    PVOID DllHandle,
5394         IN    PANSI_STRING ProcedureName OPTIONAL,
5395         IN    ULONG ProcedureNumber OPTIONAL,
5396         OUT    PVOID *ProcedureAddress
5397         );
5398 
5399 #pragma endregion
5400 
5401 #pragma region TAIL
5402 
5403 #ifdef __cplusplus
5404 } // extern "C"
5405 #endif
5406 
5407 #pragma endregion
5408 
5409 #endif // __NTDLL_H__
Ntdll.h
相关阅读:
c++vector（入门级）
端口扫描(TCP)
推荐安全程序员的书单（系统、网络、安全等）
My latest news（--2016.12.31）
HTML+JS+DOM【选项卡自动切换】
20170916考试总结
 [Usaco2014 Mar]Sabotage
[SHOI2014]概率充电器
 [Usaco2010 Dec]Exercise 奶牛健美操
 [JZOJ4687]奇袭
原文地址：https://www.cnblogs.com/gwsbhqt/p/5092390.html