| use crate::ntapi_base::{PCLIENT_ID, PRTL_ATOM, RTL_ATOM}; |
| use crate::ntdbg::DEBUGOBJECTINFOCLASS; |
| use crate::ntexapi::{ |
| ATOM_INFORMATION_CLASS, EVENT_INFORMATION_CLASS, MUTANT_INFORMATION_CLASS, PBOOT_ENTRY, |
| PBOOT_OPTIONS, PCWNF_TYPE_ID, PEFI_DRIVER_ENTRY, PFILE_PATH, PT2_CANCEL_PARAMETERS, |
| PT2_SET_PARAMETERS, PTIMER_APC_ROUTINE, PWNF_CHANGE_STAMP, PWNF_DELIVERY_DESCRIPTOR, |
| SEMAPHORE_INFORMATION_CLASS, SHUTDOWN_ACTION, SYSDBG_COMMAND, SYSTEM_INFORMATION_CLASS, |
| TIMER_INFORMATION_CLASS, TIMER_SET_INFORMATION_CLASS, WNF_CHANGE_STAMP, WNF_DATA_SCOPE, |
| WNF_STATE_NAME_INFORMATION, WNF_STATE_NAME_LIFETIME, WORKERFACTORYINFOCLASS, |
| }; |
| use crate::ntioapi::{ |
| FILE_INFORMATION_CLASS, FILE_IO_COMPLETION_INFORMATION, FS_INFORMATION_CLASS, |
| IO_COMPLETION_INFORMATION_CLASS, IO_SESSION_EVENT, IO_SESSION_STATE, PFILE_BASIC_INFORMATION, |
| PFILE_IO_COMPLETION_INFORMATION, PFILE_NETWORK_OPEN_INFORMATION, PIO_APC_ROUTINE, |
| PIO_STATUS_BLOCK, |
| }; |
| use crate::ntkeapi::KPROFILE_SOURCE; |
| use crate::ntlpcapi::{ |
| ALPC_HANDLE, ALPC_MESSAGE_INFORMATION_CLASS, ALPC_PORT_INFORMATION_CLASS, PALPC_CONTEXT_ATTR, |
| PALPC_DATA_VIEW_ATTR, PALPC_HANDLE, PALPC_MESSAGE_ATTRIBUTES, PALPC_PORT_ATTRIBUTES, |
| PALPC_SECURITY_ATTR, PORT_INFORMATION_CLASS, PPORT_MESSAGE, PPORT_VIEW, PREMOTE_PORT_VIEW, |
| }; |
| use crate::ntmisc::VDMSERVICECLASS; |
| use crate::ntmmapi::{ |
| MEMORY_INFORMATION_CLASS, MEMORY_PARTITION_INFORMATION_CLASS, PMEMORY_RANGE_ENTRY, |
| SECTION_INFORMATION_CLASS, SECTION_INHERIT, VIRTUAL_MEMORY_INFORMATION_CLASS, |
| }; |
| use crate::ntobapi::OBJECT_INFORMATION_CLASS; |
| use crate::ntpnpapi::{PLUGPLAY_CONTROL_CLASS, PPLUGPLAY_EVENT_BLOCK}; |
| use crate::ntpsapi::{ |
| MEMORY_RESERVE_TYPE, PINITIAL_TEB, PPS_APC_ROUTINE, PPS_ATTRIBUTE_LIST, PPS_CREATE_INFO, |
| PROCESSINFOCLASS, THREADINFOCLASS, |
| }; |
| use crate::ntregapi::{ |
| KEY_INFORMATION_CLASS, KEY_SET_INFORMATION_CLASS, KEY_VALUE_INFORMATION_CLASS, |
| PKEY_VALUE_ENTRY, |
| }; |
| use crate::ntseapi::PTOKEN_SECURITY_ATTRIBUTES_INFORMATION; |
| use winapi::shared::basetsd::{ |
| KAFFINITY, PSIZE_T, PULONG64, PULONG_PTR, SIZE_T, ULONG64, ULONG_PTR, |
| }; |
| use winapi::shared::guiddef::LPGUID; |
| use winapi::shared::ktmtypes::{NOTIFICATION_MASK, PCRM_PROTOCOL_ID, PTRANSACTION_NOTIFICATION}; |
| use winapi::shared::ntdef::{ |
| BOOLEAN, EVENT_TYPE, HANDLE, LANGID, LCID, LOGICAL, LONG, NTSTATUS, OBJECT_ATTRIBUTES, |
| PBOOLEAN, PCHAR, PCWNF_STATE_NAME, PGROUP_AFFINITY, PHANDLE, PLARGE_INTEGER, PLCID, PLONG, |
| PLUID, PNTSTATUS, POBJECT_ATTRIBUTES, PUCHAR, PULARGE_INTEGER, PULONG, PULONGLONG, |
| PUNICODE_STRING, PUSHORT, PVOID, PWNF_STATE_NAME, PWSTR, TIMER_TYPE, ULONG, USHORT, VOID, |
| WAIT_TYPE, |
| }; |
| use winapi::um::winnt::{ |
| ACCESS_MASK, AUDIT_EVENT_TYPE, ENLISTMENT_INFORMATION_CLASS, EXECUTION_STATE, |
| JOBOBJECTINFOCLASS, KTMOBJECT_TYPE, LATENCY_TIME, PACCESS_MASK, PCONTEXT, PDEVICE_POWER_STATE, |
| PEXCEPTION_RECORD, PFILE_SEGMENT_ELEMENT, PGENERIC_MAPPING, PJOB_SET_ARRAY, PKTMOBJECT_CURSOR, |
| POBJECT_TYPE_LIST, POWER_ACTION, POWER_INFORMATION_LEVEL, PPRIVILEGE_SET, PSECURITY_DESCRIPTOR, |
| PSECURITY_QUALITY_OF_SERVICE, PSE_SIGNING_LEVEL, PSID, PSID_AND_ATTRIBUTES, |
| PTOKEN_DEFAULT_DACL, PTOKEN_GROUPS, PTOKEN_MANDATORY_POLICY, PTOKEN_OWNER, |
| PTOKEN_PRIMARY_GROUP, PTOKEN_PRIVILEGES, PTOKEN_SOURCE, PTOKEN_USER, |
| RESOURCEMANAGER_INFORMATION_CLASS, SECURITY_INFORMATION, SE_SIGNING_LEVEL, SYSTEM_POWER_STATE, |
| TOKEN_INFORMATION_CLASS, TOKEN_TYPE, TRANSACTIONMANAGER_INFORMATION_CLASS, |
| TRANSACTION_INFORMATION_CLASS, |
| }; |
| EXTERN!{extern "system" { |
| fn ZwAcceptConnectPort( |
| PortHandle: PHANDLE, |
| PortContext: PVOID, |
| ConnectionRequest: PPORT_MESSAGE, |
| AcceptConnection: BOOLEAN, |
| ServerView: PPORT_VIEW, |
| ClientView: PREMOTE_PORT_VIEW, |
| ) -> NTSTATUS; |
| fn ZwAccessCheck( |
| SecurityDescriptor: PSECURITY_DESCRIPTOR, |
| ClientToken: HANDLE, |
| DesiredAccess: ACCESS_MASK, |
| GenericMapping: PGENERIC_MAPPING, |
| PrivilegeSet: PPRIVILEGE_SET, |
| PrivilegeSetLength: PULONG, |
| GrantedAccess: PACCESS_MASK, |
| AccessStatus: PNTSTATUS, |
| ) -> NTSTATUS; |
| fn ZwAccessCheckAndAuditAlarm( |
| SubsystemName: PUNICODE_STRING, |
| HandleId: PVOID, |
| ObjectTypeName: PUNICODE_STRING, |
| ObjectName: PUNICODE_STRING, |
| SecurityDescriptor: PSECURITY_DESCRIPTOR, |
| DesiredAccess: ACCESS_MASK, |
| GenericMapping: PGENERIC_MAPPING, |
| ObjectCreation: BOOLEAN, |
| GrantedAccess: PACCESS_MASK, |
| AccessStatus: PNTSTATUS, |
| GenerateOnClose: PBOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwAccessCheckByType( |
| SecurityDescriptor: PSECURITY_DESCRIPTOR, |
| PrincipalSelfSid: PSID, |
| ClientToken: HANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectTypeList: POBJECT_TYPE_LIST, |
| ObjectTypeListLength: ULONG, |
| GenericMapping: PGENERIC_MAPPING, |
| PrivilegeSet: PPRIVILEGE_SET, |
| PrivilegeSetLength: PULONG, |
| GrantedAccess: PACCESS_MASK, |
| AccessStatus: PNTSTATUS, |
| ) -> NTSTATUS; |
| fn ZwAccessCheckByTypeAndAuditAlarm( |
| SubsystemName: PUNICODE_STRING, |
| HandleId: PVOID, |
| ObjectTypeName: PUNICODE_STRING, |
| ObjectName: PUNICODE_STRING, |
| SecurityDescriptor: PSECURITY_DESCRIPTOR, |
| PrincipalSelfSid: PSID, |
| DesiredAccess: ACCESS_MASK, |
| AuditType: AUDIT_EVENT_TYPE, |
| Flags: ULONG, |
| ObjectTypeList: POBJECT_TYPE_LIST, |
| ObjectTypeListLength: ULONG, |
| GenericMapping: PGENERIC_MAPPING, |
| ObjectCreation: BOOLEAN, |
| GrantedAccess: PACCESS_MASK, |
| AccessStatus: PNTSTATUS, |
| GenerateOnClose: PBOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwAccessCheckByTypeResultList( |
| SecurityDescriptor: PSECURITY_DESCRIPTOR, |
| PrincipalSelfSid: PSID, |
| ClientToken: HANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectTypeList: POBJECT_TYPE_LIST, |
| ObjectTypeListLength: ULONG, |
| GenericMapping: PGENERIC_MAPPING, |
| PrivilegeSet: PPRIVILEGE_SET, |
| PrivilegeSetLength: PULONG, |
| GrantedAccess: PACCESS_MASK, |
| AccessStatus: PNTSTATUS, |
| ) -> NTSTATUS; |
| fn ZwAccessCheckByTypeResultListAndAuditAlarm( |
| SubsystemName: PUNICODE_STRING, |
| HandleId: PVOID, |
| ObjectTypeName: PUNICODE_STRING, |
| ObjectName: PUNICODE_STRING, |
| SecurityDescriptor: PSECURITY_DESCRIPTOR, |
| PrincipalSelfSid: PSID, |
| DesiredAccess: ACCESS_MASK, |
| AuditType: AUDIT_EVENT_TYPE, |
| Flags: ULONG, |
| ObjectTypeList: POBJECT_TYPE_LIST, |
| ObjectTypeListLength: ULONG, |
| GenericMapping: PGENERIC_MAPPING, |
| ObjectCreation: BOOLEAN, |
| GrantedAccess: PACCESS_MASK, |
| AccessStatus: PNTSTATUS, |
| GenerateOnClose: PBOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwAccessCheckByTypeResultListAndAuditAlarmByHandle( |
| SubsystemName: PUNICODE_STRING, |
| HandleId: PVOID, |
| ClientToken: HANDLE, |
| ObjectTypeName: PUNICODE_STRING, |
| ObjectName: PUNICODE_STRING, |
| SecurityDescriptor: PSECURITY_DESCRIPTOR, |
| PrincipalSelfSid: PSID, |
| DesiredAccess: ACCESS_MASK, |
| AuditType: AUDIT_EVENT_TYPE, |
| Flags: ULONG, |
| ObjectTypeList: POBJECT_TYPE_LIST, |
| ObjectTypeListLength: ULONG, |
| GenericMapping: PGENERIC_MAPPING, |
| ObjectCreation: BOOLEAN, |
| GrantedAccess: PACCESS_MASK, |
| AccessStatus: PNTSTATUS, |
| GenerateOnClose: PBOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwAcquireCMFViewOwnership( |
| TimeStamp: PULONGLONG, |
| tokenTaken: PBOOLEAN, |
| replaceExisting: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwAddAtom( |
| AtomName: PWSTR, |
| Length: ULONG, |
| Atom: PRTL_ATOM, |
| ) -> NTSTATUS; |
| fn ZwAddAtomEx( |
| AtomName: PWSTR, |
| Length: ULONG, |
| Atom: PRTL_ATOM, |
| Flags: ULONG, |
| ) -> NTSTATUS; |
| fn ZwAddBootEntry( |
| BootEntry: PBOOT_ENTRY, |
| Id: PULONG, |
| ) -> NTSTATUS; |
| fn ZwAddDriverEntry( |
| DriverEntry: PEFI_DRIVER_ENTRY, |
| Id: PULONG, |
| ) -> NTSTATUS; |
| fn ZwAdjustGroupsToken( |
| TokenHandle: HANDLE, |
| ResetToDefault: BOOLEAN, |
| NewState: PTOKEN_GROUPS, |
| BufferLength: ULONG, |
| PreviousState: PTOKEN_GROUPS, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwAdjustPrivilegesToken( |
| TokenHandle: HANDLE, |
| DisableAllPrivileges: BOOLEAN, |
| NewState: PTOKEN_PRIVILEGES, |
| BufferLength: ULONG, |
| PreviousState: PTOKEN_PRIVILEGES, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwAdjustTokenClaimsAndDeviceGroups( |
| TokenHandle: HANDLE, |
| UserResetToDefault: BOOLEAN, |
| DeviceResetToDefault: BOOLEAN, |
| DeviceGroupsResetToDefault: BOOLEAN, |
| NewUserState: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION, |
| NewDeviceState: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION, |
| NewDeviceGroupsState: PTOKEN_GROUPS, |
| UserBufferLength: ULONG, |
| PreviousUserState: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION, |
| DeviceBufferLength: ULONG, |
| PreviousDeviceState: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION, |
| DeviceGroupsBufferLength: ULONG, |
| PreviousDeviceGroups: PTOKEN_GROUPS, |
| UserReturnLength: PULONG, |
| DeviceReturnLength: PULONG, |
| DeviceGroupsReturnBufferLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwAlertResumeThread( |
| ThreadHandle: HANDLE, |
| PreviousSuspendCount: PULONG, |
| ) -> NTSTATUS; |
| fn ZwAlertThread( |
| ThreadHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwAlertThreadByThreadId( |
| ThreadId: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwAllocateLocallyUniqueId( |
| Luid: PLUID, |
| ) -> NTSTATUS; |
| fn ZwAllocateReserveObject( |
| MemoryReserveHandle: PHANDLE, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| Type: MEMORY_RESERVE_TYPE, |
| ) -> NTSTATUS; |
| fn ZwAllocateUserPhysicalPages( |
| ProcessHandle: HANDLE, |
| NumberOfPages: PULONG_PTR, |
| UserPfnArray: PULONG_PTR, |
| ) -> NTSTATUS; |
| fn ZwAllocateUuids( |
| Time: PULARGE_INTEGER, |
| Range: PULONG, |
| Sequence: PULONG, |
| Seed: PCHAR, |
| ) -> NTSTATUS; |
| fn ZwAllocateVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: *mut PVOID, |
| ZeroBits: ULONG_PTR, |
| RegionSize: PSIZE_T, |
| AllocationType: ULONG, |
| Protect: ULONG, |
| ) -> NTSTATUS; |
| fn ZwAlpcAcceptConnectPort( |
| PortHandle: PHANDLE, |
| ConnectionPortHandle: HANDLE, |
| Flags: ULONG, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| PortAttributes: PALPC_PORT_ATTRIBUTES, |
| PortContext: PVOID, |
| ConnectionRequest: PPORT_MESSAGE, |
| ConnectionMessageAttributes: PALPC_MESSAGE_ATTRIBUTES, |
| AcceptConnection: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwAlpcCancelMessage( |
| PortHandle: HANDLE, |
| Flags: ULONG, |
| MessageContext: PALPC_CONTEXT_ATTR, |
| ) -> NTSTATUS; |
| fn ZwAlpcConnectPort( |
| PortHandle: PHANDLE, |
| PortName: PUNICODE_STRING, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| PortAttributes: PALPC_PORT_ATTRIBUTES, |
| Flags: ULONG, |
| RequiredServerSid: PSID, |
| ConnectionMessage: PPORT_MESSAGE, |
| BufferLength: PULONG, |
| OutMessageAttributes: PALPC_MESSAGE_ATTRIBUTES, |
| InMessageAttributes: PALPC_MESSAGE_ATTRIBUTES, |
| Timeout: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwAlpcConnectPortEx( |
| PortHandle: PHANDLE, |
| ConnectionPortObjectAttributes: POBJECT_ATTRIBUTES, |
| ClientPortObjectAttributes: POBJECT_ATTRIBUTES, |
| PortAttributes: PALPC_PORT_ATTRIBUTES, |
| Flags: ULONG, |
| ServerSecurityRequirements: PSECURITY_DESCRIPTOR, |
| ConnectionMessage: PPORT_MESSAGE, |
| BufferLength: PSIZE_T, |
| OutMessageAttributes: PALPC_MESSAGE_ATTRIBUTES, |
| InMessageAttributes: PALPC_MESSAGE_ATTRIBUTES, |
| Timeout: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwAlpcCreatePort( |
| PortHandle: PHANDLE, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| PortAttributes: PALPC_PORT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwAlpcCreatePortSection( |
| PortHandle: HANDLE, |
| Flags: ULONG, |
| SectionHandle: HANDLE, |
| SectionSize: SIZE_T, |
| AlpcSectionHandle: PALPC_HANDLE, |
| ActualSectionSize: PSIZE_T, |
| ) -> NTSTATUS; |
| fn ZwAlpcCreateResourceReserve( |
| PortHandle: HANDLE, |
| Flags: ULONG, |
| MessageSize: SIZE_T, |
| ResourceId: PALPC_HANDLE, |
| ) -> NTSTATUS; |
| fn ZwAlpcCreateSectionView( |
| PortHandle: HANDLE, |
| Flags: ULONG, |
| ViewAttributes: PALPC_DATA_VIEW_ATTR, |
| ) -> NTSTATUS; |
| fn ZwAlpcCreateSecurityContext( |
| PortHandle: HANDLE, |
| Flags: ULONG, |
| SecurityAttribute: PALPC_SECURITY_ATTR, |
| ) -> NTSTATUS; |
| fn ZwAlpcDeletePortSection( |
| PortHandle: HANDLE, |
| Flags: ULONG, |
| SectionHandle: ALPC_HANDLE, |
| ) -> NTSTATUS; |
| fn ZwAlpcDeleteResourceReserve( |
| PortHandle: HANDLE, |
| Flags: ULONG, |
| ResourceId: ALPC_HANDLE, |
| ) -> NTSTATUS; |
| fn ZwAlpcDeleteSectionView( |
| PortHandle: HANDLE, |
| Flags: ULONG, |
| ViewBase: PVOID, |
| ) -> NTSTATUS; |
| fn ZwAlpcDeleteSecurityContext( |
| PortHandle: HANDLE, |
| Flags: ULONG, |
| ContextHandle: ALPC_HANDLE, |
| ) -> NTSTATUS; |
| fn ZwAlpcDisconnectPort( |
| PortHandle: HANDLE, |
| Flags: ULONG, |
| ) -> NTSTATUS; |
| fn ZwAlpcImpersonateClientContainerOfPort( |
| PortHandle: HANDLE, |
| Message: PPORT_MESSAGE, |
| Flags: ULONG, |
| ) -> NTSTATUS; |
| fn ZwAlpcImpersonateClientOfPort( |
| PortHandle: HANDLE, |
| Message: PPORT_MESSAGE, |
| Flags: PVOID, |
| ) -> NTSTATUS; |
| fn ZwAlpcOpenSenderProcess( |
| ProcessHandle: PHANDLE, |
| PortHandle: HANDLE, |
| PortMessage: PPORT_MESSAGE, |
| Flags: ULONG, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwAlpcOpenSenderThread( |
| ThreadHandle: PHANDLE, |
| PortHandle: HANDLE, |
| PortMessage: PPORT_MESSAGE, |
| Flags: ULONG, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwAlpcQueryInformation( |
| PortHandle: HANDLE, |
| PortInformationClass: ALPC_PORT_INFORMATION_CLASS, |
| PortInformation: PVOID, |
| Length: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwAlpcQueryInformationMessage( |
| PortHandle: HANDLE, |
| PortMessage: PPORT_MESSAGE, |
| MessageInformationClass: ALPC_MESSAGE_INFORMATION_CLASS, |
| MessageInformation: PVOID, |
| Length: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwAlpcRevokeSecurityContext( |
| PortHandle: HANDLE, |
| Flags: ULONG, |
| ContextHandle: ALPC_HANDLE, |
| ) -> NTSTATUS; |
| fn ZwAlpcSendWaitReceivePort( |
| PortHandle: HANDLE, |
| Flags: ULONG, |
| SendMessageA: PPORT_MESSAGE, |
| SendMessageAttributes: PALPC_MESSAGE_ATTRIBUTES, |
| ReceiveMessage: PPORT_MESSAGE, |
| BufferLength: PSIZE_T, |
| ReceiveMessageAttributes: PALPC_MESSAGE_ATTRIBUTES, |
| Timeout: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwAlpcSetInformation( |
| PortHandle: HANDLE, |
| PortInformationClass: ALPC_PORT_INFORMATION_CLASS, |
| PortInformation: PVOID, |
| Length: ULONG, |
| ) -> NTSTATUS; |
| fn ZwAreMappedFilesTheSame( |
| File1MappedAsAnImage: PVOID, |
| File2MappedAsFile: PVOID, |
| ) -> NTSTATUS; |
| fn ZwAssignProcessToJobObject( |
| JobHandle: HANDLE, |
| ProcessHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwAssociateWaitCompletionPacket( |
| WaitCompletionPacketHandle: HANDLE, |
| IoCompletionHandle: HANDLE, |
| TargetObjectHandle: HANDLE, |
| KeyContext: PVOID, |
| ApcContext: PVOID, |
| IoStatus: NTSTATUS, |
| IoStatusInformation: ULONG_PTR, |
| AlreadySignaled: PBOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwCallbackReturn( |
| OutputBuffer: PVOID, |
| OutputLength: ULONG, |
| Status: NTSTATUS, |
| ) -> NTSTATUS; |
| fn ZwCancelIoFile( |
| FileHandle: HANDLE, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| ) -> NTSTATUS; |
| fn ZwCancelIoFileEx( |
| FileHandle: HANDLE, |
| IoRequestToCancel: PIO_STATUS_BLOCK, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| ) -> NTSTATUS; |
| fn ZwCancelSynchronousIoFile( |
| ThreadHandle: HANDLE, |
| IoRequestToCancel: PIO_STATUS_BLOCK, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| ) -> NTSTATUS; |
| fn ZwCancelTimer( |
| TimerHandle: HANDLE, |
| CurrentState: PBOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwCancelTimer2( |
| TimerHandle: HANDLE, |
| Parameters: PT2_CANCEL_PARAMETERS, |
| ) -> NTSTATUS; |
| fn ZwCancelWaitCompletionPacket( |
| WaitCompletionPacketHandle: HANDLE, |
| RemoveSignaledPacket: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwClearEvent( |
| EventHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwClose( |
| Handle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwCloseObjectAuditAlarm( |
| SubsystemName: PUNICODE_STRING, |
| HandleId: PVOID, |
| GenerateOnClose: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwCommitComplete( |
| EnlistmentHandle: HANDLE, |
| TmVirtualClock: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwCommitEnlistment( |
| EnlistmentHandle: HANDLE, |
| TmVirtualClock: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwCommitTransaction( |
| TransactionHandle: HANDLE, |
| Wait: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwCompactKeys( |
| Count: ULONG, |
| KeyArray: *mut HANDLE, |
| ) -> NTSTATUS; |
| fn ZwCompareObjects( |
| FirstObjectHandle: HANDLE, |
| SecondObjectHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwCompareTokens( |
| FirstTokenHandle: HANDLE, |
| SecondTokenHandle: HANDLE, |
| Equal: PBOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwCompleteConnectPort( |
| PortHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwCompressKey( |
| Key: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwConnectPort( |
| PortHandle: PHANDLE, |
| PortName: PUNICODE_STRING, |
| SecurityQos: PSECURITY_QUALITY_OF_SERVICE, |
| ClientView: PPORT_VIEW, |
| ServerView: PREMOTE_PORT_VIEW, |
| MaxMessageLength: PULONG, |
| ConnectionInformation: PVOID, |
| ConnectionInformationLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwContinue( |
| ContextRecord: PCONTEXT, |
| TestAlert: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwCreateDebugObject( |
| DebugObjectHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| Flags: ULONG, |
| ) -> NTSTATUS; |
| fn ZwCreateDirectoryObject( |
| DirectoryHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwCreateDirectoryObjectEx( |
| DirectoryHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ShadowDirectoryHandle: HANDLE, |
| Flags: ULONG, |
| ) -> NTSTATUS; |
| fn ZwCreateEnlistment( |
| EnlistmentHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ResourceManagerHandle: HANDLE, |
| TransactionHandle: HANDLE, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| CreateOptions: ULONG, |
| NotificationMask: NOTIFICATION_MASK, |
| EnlistmentKey: PVOID, |
| ) -> NTSTATUS; |
| fn ZwCreateEvent( |
| EventHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| EventType: EVENT_TYPE, |
| InitialState: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwCreateEventPair( |
| EventPairHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwCreateFile( |
| FileHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| AllocationSize: PLARGE_INTEGER, |
| FileAttributes: ULONG, |
| ShareAccess: ULONG, |
| CreateDisposition: ULONG, |
| CreateOptions: ULONG, |
| EaBuffer: PVOID, |
| EaLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwCreateIRTimer( |
| TimerHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ) -> NTSTATUS; |
| fn ZwCreateIoCompletion( |
| IoCompletionHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| Count: ULONG, |
| ) -> NTSTATUS; |
| fn ZwCreateJobObject( |
| JobHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwCreateJobSet( |
| NumJob: ULONG, |
| UserJobSet: PJOB_SET_ARRAY, |
| Flags: ULONG, |
| ) -> NTSTATUS; |
| fn ZwCreateKey( |
| KeyHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| TitleIndex: ULONG, |
| Class: PUNICODE_STRING, |
| CreateOptions: ULONG, |
| Disposition: PULONG, |
| ) -> NTSTATUS; |
| fn ZwCreateKeyTransacted( |
| KeyHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| TitleIndex: ULONG, |
| Class: PUNICODE_STRING, |
| CreateOptions: ULONG, |
| TransactionHandle: HANDLE, |
| Disposition: PULONG, |
| ) -> NTSTATUS; |
| fn ZwCreateKeyedEvent( |
| KeyedEventHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| Flags: ULONG, |
| ) -> NTSTATUS; |
| fn ZwCreateLowBoxToken( |
| TokenHandle: PHANDLE, |
| ExistingTokenHandle: HANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| PackageSid: PSID, |
| CapabilityCount: ULONG, |
| Capabilities: PSID_AND_ATTRIBUTES, |
| HandleCount: ULONG, |
| Handles: *mut HANDLE, |
| ) -> NTSTATUS; |
| fn ZwCreateMailslotFile( |
| FileHandle: PHANDLE, |
| DesiredAccess: ULONG, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| CreateOptions: ULONG, |
| MailslotQuota: ULONG, |
| MaximumMessageSize: ULONG, |
| ReadTimeout: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwCreateMutant( |
| MutantHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| InitialOwner: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwCreateNamedPipeFile( |
| FileHandle: PHANDLE, |
| DesiredAccess: ULONG, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| ShareAccess: ULONG, |
| CreateDisposition: ULONG, |
| CreateOptions: ULONG, |
| NamedPipeType: ULONG, |
| ReadMode: ULONG, |
| CompletionMode: ULONG, |
| MaximumInstances: ULONG, |
| InboundQuota: ULONG, |
| OutboundQuota: ULONG, |
| DefaultTimeout: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwCreatePagingFile( |
| PageFileName: PUNICODE_STRING, |
| MinimumSize: PLARGE_INTEGER, |
| MaximumSize: PLARGE_INTEGER, |
| Priority: ULONG, |
| ) -> NTSTATUS; |
| fn ZwCreatePartition( |
| PartitionHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| PreferredNode: ULONG, |
| ) -> NTSTATUS; |
| fn ZwCreatePort( |
| PortHandle: PHANDLE, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| MaxConnectionInfoLength: ULONG, |
| MaxMessageLength: ULONG, |
| MaxPoolUsage: ULONG, |
| ) -> NTSTATUS; |
| fn ZwCreatePrivateNamespace( |
| NamespaceHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| BoundaryDescriptor: PVOID, |
| ) -> NTSTATUS; |
| fn ZwCreateProcess( |
| ProcessHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ParentProcess: HANDLE, |
| InheritObjectTable: BOOLEAN, |
| SectionHandle: HANDLE, |
| DebugPort: HANDLE, |
| ExceptionPort: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwCreateProcessEx( |
| ProcessHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ParentProcess: HANDLE, |
| Flags: ULONG, |
| SectionHandle: HANDLE, |
| DebugPort: HANDLE, |
| ExceptionPort: HANDLE, |
| JobMemberLevel: ULONG, |
| ) -> NTSTATUS; |
| fn ZwCreateProfile( |
| ProfileHandle: PHANDLE, |
| Process: HANDLE, |
| ProfileBase: PVOID, |
| ProfileSize: SIZE_T, |
| BucketSize: ULONG, |
| Buffer: PULONG, |
| BufferSize: ULONG, |
| ProfileSource: KPROFILE_SOURCE, |
| Affinity: KAFFINITY, |
| ) -> NTSTATUS; |
| fn ZwCreateProfileEx( |
| ProfileHandle: PHANDLE, |
| Process: HANDLE, |
| ProfileBase: PVOID, |
| ProfileSize: SIZE_T, |
| BucketSize: ULONG, |
| Buffer: PULONG, |
| BufferSize: ULONG, |
| ProfileSource: KPROFILE_SOURCE, |
| GroupCount: USHORT, |
| GroupAffinity: PGROUP_AFFINITY, |
| ) -> NTSTATUS; |
| fn ZwCreateResourceManager( |
| ResourceManagerHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| TmHandle: HANDLE, |
| ResourceManagerGuid: LPGUID, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| CreateOptions: ULONG, |
| Description: PUNICODE_STRING, |
| ) -> NTSTATUS; |
| fn ZwCreateSection( |
| SectionHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| MaximumSize: PLARGE_INTEGER, |
| SectionPageProtection: ULONG, |
| AllocationAttributes: ULONG, |
| FileHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwCreateSemaphore( |
| SemaphoreHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| InitialCount: LONG, |
| MaximumCount: LONG, |
| ) -> NTSTATUS; |
| fn ZwCreateSymbolicLinkObject( |
| LinkHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| LinkTarget: PUNICODE_STRING, |
| ) -> NTSTATUS; |
| fn ZwCreateThread( |
| ThreadHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ProcessHandle: HANDLE, |
| ClientId: PCLIENT_ID, |
| ThreadContext: PCONTEXT, |
| InitialTeb: PINITIAL_TEB, |
| CreateSuspended: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwCreateThreadEx( |
| ThreadHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ProcessHandle: HANDLE, |
| StartRoutine: PVOID, |
| Argument: PVOID, |
| CreateFlags: ULONG, |
| ZeroBits: SIZE_T, |
| StackSize: SIZE_T, |
| MaximumStackSize: SIZE_T, |
| AttributeList: PPS_ATTRIBUTE_LIST, |
| ) -> NTSTATUS; |
| fn ZwCreateTimer( |
| TimerHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| TimerType: TIMER_TYPE, |
| ) -> NTSTATUS; |
| fn ZwCreateTimer2( |
| TimerHandle: PHANDLE, |
| Reserved1: PVOID, |
| Reserved2: PVOID, |
| Attributes: ULONG, |
| DesiredAccess: ACCESS_MASK, |
| ) -> NTSTATUS; |
| fn ZwCreateToken( |
| TokenHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| TokenType: TOKEN_TYPE, |
| AuthenticationId: PLUID, |
| ExpirationTime: PLARGE_INTEGER, |
| User: PTOKEN_USER, |
| Groups: PTOKEN_GROUPS, |
| Privileges: PTOKEN_PRIVILEGES, |
| Owner: PTOKEN_OWNER, |
| PrimaryGroup: PTOKEN_PRIMARY_GROUP, |
| DefaultDacl: PTOKEN_DEFAULT_DACL, |
| TokenSource: PTOKEN_SOURCE, |
| ) -> NTSTATUS; |
| fn ZwCreateTokenEx( |
| TokenHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| TokenType: TOKEN_TYPE, |
| AuthenticationId: PLUID, |
| ExpirationTime: PLARGE_INTEGER, |
| User: PTOKEN_USER, |
| Groups: PTOKEN_GROUPS, |
| Privileges: PTOKEN_PRIVILEGES, |
| UserAttributes: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION, |
| DeviceAttributes: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION, |
| DeviceGroups: PTOKEN_GROUPS, |
| TokenMandatoryPolicy: PTOKEN_MANDATORY_POLICY, |
| Owner: PTOKEN_OWNER, |
| PrimaryGroup: PTOKEN_PRIMARY_GROUP, |
| DefaultDacl: PTOKEN_DEFAULT_DACL, |
| TokenSource: PTOKEN_SOURCE, |
| ) -> NTSTATUS; |
| fn ZwCreateTransaction( |
| TransactionHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| Uow: LPGUID, |
| TmHandle: HANDLE, |
| CreateOptions: ULONG, |
| IsolationLevel: ULONG, |
| IsolationFlags: ULONG, |
| Timeout: PLARGE_INTEGER, |
| Description: PUNICODE_STRING, |
| ) -> NTSTATUS; |
| fn ZwCreateTransactionManager( |
| TmHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| LogFileName: PUNICODE_STRING, |
| CreateOptions: ULONG, |
| CommitStrength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwCreateUserProcess( |
| ProcessHandle: PHANDLE, |
| ThreadHandle: PHANDLE, |
| ProcessDesiredAccess: ACCESS_MASK, |
| ThreadDesiredAccess: ACCESS_MASK, |
| ProcessObjectAttributes: POBJECT_ATTRIBUTES, |
| ThreadObjectAttributes: POBJECT_ATTRIBUTES, |
| ProcessFlags: ULONG, |
| ThreadFlags: ULONG, |
| ProcessParameters: PVOID, |
| CreateInfo: PPS_CREATE_INFO, |
| AttributeList: PPS_ATTRIBUTE_LIST, |
| ) -> NTSTATUS; |
| fn ZwCreateWaitCompletionPacket( |
| WaitCompletionPacketHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwCreateWaitablePort( |
| PortHandle: PHANDLE, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| MaxConnectionInfoLength: ULONG, |
| MaxMessageLength: ULONG, |
| MaxPoolUsage: ULONG, |
| ) -> NTSTATUS; |
| fn ZwCreateWnfStateName( |
| StateName: PWNF_STATE_NAME, |
| NameLifetime: WNF_STATE_NAME_LIFETIME, |
| DataScope: WNF_DATA_SCOPE, |
| PersistData: BOOLEAN, |
| TypeId: PCWNF_TYPE_ID, |
| MaximumStateSize: ULONG, |
| SecurityDescriptor: PSECURITY_DESCRIPTOR, |
| ) -> NTSTATUS; |
| fn ZwCreateWorkerFactory( |
| WorkerFactoryHandleReturn: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| CompletionPortHandle: HANDLE, |
| WorkerProcessHandle: HANDLE, |
| StartRoutine: PVOID, |
| StartParameter: PVOID, |
| MaxThreadCount: ULONG, |
| StackReserve: SIZE_T, |
| StackCommit: SIZE_T, |
| ) -> NTSTATUS; |
| fn ZwDebugActiveProcess( |
| ProcessHandle: HANDLE, |
| DebugObjectHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwDebugContinue( |
| DebugObjectHandle: HANDLE, |
| ClientId: PCLIENT_ID, |
| ContinueStatus: NTSTATUS, |
| ) -> NTSTATUS; |
| fn ZwDelayExecution( |
| Alertable: BOOLEAN, |
| DelayInterval: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwDeleteAtom( |
| Atom: RTL_ATOM, |
| ) -> NTSTATUS; |
| fn ZwDeleteBootEntry( |
| Id: ULONG, |
| ) -> NTSTATUS; |
| fn ZwDeleteDriverEntry( |
| Id: ULONG, |
| ) -> NTSTATUS; |
| fn ZwDeleteFile( |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwDeleteKey( |
| KeyHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwDeleteObjectAuditAlarm( |
| SubsystemName: PUNICODE_STRING, |
| HandleId: PVOID, |
| GenerateOnClose: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwDeletePrivateNamespace( |
| NamespaceHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwDeleteValueKey( |
| KeyHandle: HANDLE, |
| ValueName: PUNICODE_STRING, |
| ) -> NTSTATUS; |
| fn ZwDeleteWnfStateData( |
| StateName: PCWNF_STATE_NAME, |
| ExplicitScope: *const VOID, |
| ) -> NTSTATUS; |
| fn ZwDeleteWnfStateName( |
| StateName: PCWNF_STATE_NAME, |
| ) -> NTSTATUS; |
| fn ZwDeviceIoControlFile( |
| FileHandle: HANDLE, |
| Event: HANDLE, |
| ApcRoutine: PIO_APC_ROUTINE, |
| ApcContext: PVOID, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| IoControlCode: ULONG, |
| InputBuffer: PVOID, |
| InputBufferLength: ULONG, |
| OutputBuffer: PVOID, |
| OutputBufferLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwDisableLastKnownGood() -> NTSTATUS; |
| fn ZwDisplayString( |
| String: PUNICODE_STRING, |
| ) -> NTSTATUS; |
| fn ZwDrawText( |
| String: PUNICODE_STRING, |
| ) -> NTSTATUS; |
| fn ZwDuplicateObject( |
| SourceProcessHandle: HANDLE, |
| SourceHandle: HANDLE, |
| TargetProcessHandle: HANDLE, |
| TargetHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| HandleAttributes: ULONG, |
| Options: ULONG, |
| ) -> NTSTATUS; |
| fn ZwDuplicateToken( |
| ExistingTokenHandle: HANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| EffectiveOnly: BOOLEAN, |
| TokenType: TOKEN_TYPE, |
| NewTokenHandle: PHANDLE, |
| ) -> NTSTATUS; |
| fn ZwEnableLastKnownGood() -> NTSTATUS; |
| fn ZwEnumerateBootEntries( |
| Buffer: PVOID, |
| BufferLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwEnumerateDriverEntries( |
| Buffer: PVOID, |
| BufferLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwEnumerateKey( |
| KeyHandle: HANDLE, |
| Index: ULONG, |
| KeyInformationClass: KEY_INFORMATION_CLASS, |
| KeyInformation: PVOID, |
| Length: ULONG, |
| ResultLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwEnumerateSystemEnvironmentValuesEx( |
| InformationClass: ULONG, |
| Buffer: PVOID, |
| BufferLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwEnumerateTransactionObject( |
| RootObjectHandle: HANDLE, |
| QueryType: KTMOBJECT_TYPE, |
| ObjectCursor: PKTMOBJECT_CURSOR, |
| ObjectCursorLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwEnumerateValueKey( |
| KeyHandle: HANDLE, |
| Index: ULONG, |
| KeyValueInformationClass: KEY_VALUE_INFORMATION_CLASS, |
| KeyValueInformation: PVOID, |
| Length: ULONG, |
| ResultLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwExtendSection( |
| SectionHandle: HANDLE, |
| NewSectionSize: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwFilterToken( |
| ExistingTokenHandle: HANDLE, |
| Flags: ULONG, |
| SidsToDisable: PTOKEN_GROUPS, |
| PrivilegesToDelete: PTOKEN_PRIVILEGES, |
| RestrictedSids: PTOKEN_GROUPS, |
| NewTokenHandle: PHANDLE, |
| ) -> NTSTATUS; |
| fn ZwFilterTokenEx( |
| ExistingTokenHandle: HANDLE, |
| Flags: ULONG, |
| SidsToDisable: PTOKEN_GROUPS, |
| PrivilegesToDelete: PTOKEN_PRIVILEGES, |
| RestrictedSids: PTOKEN_GROUPS, |
| DisableUserClaimsCount: ULONG, |
| UserClaimsToDisable: PUNICODE_STRING, |
| DisableDeviceClaimsCount: ULONG, |
| DeviceClaimsToDisable: PUNICODE_STRING, |
| DeviceGroupsToDisable: PTOKEN_GROUPS, |
| RestrictedUserAttributes: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION, |
| RestrictedDeviceAttributes: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION, |
| RestrictedDeviceGroups: PTOKEN_GROUPS, |
| NewTokenHandle: PHANDLE, |
| ) -> NTSTATUS; |
| fn ZwFindAtom( |
| AtomName: PWSTR, |
| Length: ULONG, |
| Atom: PRTL_ATOM, |
| ) -> NTSTATUS; |
| fn ZwFlushBuffersFile( |
| FileHandle: HANDLE, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| ) -> NTSTATUS; |
| fn ZwFlushBuffersFileEx( |
| FileHandle: HANDLE, |
| Flags: ULONG, |
| Parameters: PVOID, |
| ParametersSize: ULONG, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| ) -> NTSTATUS; |
| fn ZwFlushInstallUILanguage( |
| InstallUILanguage: LANGID, |
| SetComittedFlag: ULONG, |
| ) -> NTSTATUS; |
| fn ZwFlushInstructionCache( |
| ProcessHandle: HANDLE, |
| BaseAddress: PVOID, |
| Length: SIZE_T, |
| ) -> NTSTATUS; |
| fn ZwFlushKey( |
| KeyHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwFlushProcessWriteBuffers(); |
| fn ZwFlushWriteBuffer() -> NTSTATUS; |
| fn ZwFreeUserPhysicalPages( |
| ProcessHandle: HANDLE, |
| NumberOfPages: PULONG_PTR, |
| UserPfnArray: PULONG_PTR, |
| ) -> NTSTATUS; |
| fn ZwFreeVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: *mut PVOID, |
| RegionSize: PSIZE_T, |
| FreeType: ULONG, |
| ) -> NTSTATUS; |
| fn ZwFreezeRegistry( |
| TimeOutInSeconds: ULONG, |
| ) -> NTSTATUS; |
| fn ZwFreezeTransactions( |
| FreezeTimeout: PLARGE_INTEGER, |
| ThawTimeout: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwFsControlFile( |
| FileHandle: HANDLE, |
| Event: HANDLE, |
| ApcRoutine: PIO_APC_ROUTINE, |
| ApcContext: PVOID, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| FsControlCode: ULONG, |
| InputBuffer: PVOID, |
| InputBufferLength: ULONG, |
| OutputBuffer: PVOID, |
| OutputBufferLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwGetCachedSigningLevel( |
| File: HANDLE, |
| Flags: PULONG, |
| SigningLevel: PSE_SIGNING_LEVEL, |
| Thumbprint: PUCHAR, |
| ThumbprintSize: PULONG, |
| ThumbprintAlgorithm: PULONG, |
| ) -> NTSTATUS; |
| fn ZwGetCompleteWnfStateSubscription( |
| OldDescriptorStateName: PWNF_STATE_NAME, |
| OldSubscriptionId: *mut ULONG64, |
| OldDescriptorEventMask: ULONG, |
| OldDescriptorStatus: ULONG, |
| NewDeliveryDescriptor: PWNF_DELIVERY_DESCRIPTOR, |
| DescriptorSize: ULONG, |
| ) -> NTSTATUS; |
| fn ZwGetContextThread( |
| ThreadHandle: HANDLE, |
| ThreadContext: PCONTEXT, |
| ) -> NTSTATUS; |
| fn ZwGetCurrentProcessorNumber() -> ULONG; |
| fn ZwGetDevicePowerState( |
| Device: HANDLE, |
| State: PDEVICE_POWER_STATE, |
| ) -> NTSTATUS; |
| fn ZwGetMUIRegistryInfo( |
| Flags: ULONG, |
| DataSize: PULONG, |
| Data: PVOID, |
| ) -> NTSTATUS; |
| fn ZwGetNextProcess( |
| ProcessHandle: HANDLE, |
| DesiredAccess: ACCESS_MASK, |
| HandleAttributes: ULONG, |
| Flags: ULONG, |
| NewProcessHandle: PHANDLE, |
| ) -> NTSTATUS; |
| fn ZwGetNextThread( |
| ProcessHandle: HANDLE, |
| ThreadHandle: HANDLE, |
| DesiredAccess: ACCESS_MASK, |
| HandleAttributes: ULONG, |
| Flags: ULONG, |
| NewThreadHandle: PHANDLE, |
| ) -> NTSTATUS; |
| fn ZwGetNlsSectionPtr( |
| SectionType: ULONG, |
| SectionData: ULONG, |
| ContextData: PVOID, |
| SectionPointer: *mut PVOID, |
| SectionSize: PULONG, |
| ) -> NTSTATUS; |
| fn ZwGetNotificationResourceManager( |
| ResourceManagerHandle: HANDLE, |
| TransactionNotification: PTRANSACTION_NOTIFICATION, |
| NotificationLength: ULONG, |
| Timeout: PLARGE_INTEGER, |
| ReturnLength: PULONG, |
| Asynchronous: ULONG, |
| AsynchronousContext: ULONG_PTR, |
| ) -> NTSTATUS; |
| fn ZwGetPlugPlayEvent( |
| EventHandle: HANDLE, |
| Context: PVOID, |
| EventBlock: PPLUGPLAY_EVENT_BLOCK, |
| EventBufferSize: ULONG, |
| ) -> NTSTATUS; |
| fn ZwGetWriteWatch( |
| ProcessHandle: HANDLE, |
| Flags: ULONG, |
| BaseAddress: PVOID, |
| RegionSize: SIZE_T, |
| UserAddressArray: *mut PVOID, |
| EntriesInUserAddressArray: PULONG_PTR, |
| Granularity: PULONG, |
| ) -> NTSTATUS; |
| fn ZwImpersonateAnonymousToken( |
| ThreadHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwImpersonateClientOfPort( |
| PortHandle: HANDLE, |
| Message: PPORT_MESSAGE, |
| ) -> NTSTATUS; |
| fn ZwImpersonateThread( |
| ServerThreadHandle: HANDLE, |
| ClientThreadHandle: HANDLE, |
| SecurityQos: PSECURITY_QUALITY_OF_SERVICE, |
| ) -> NTSTATUS; |
| fn ZwInitializeNlsFiles( |
| BaseAddress: *mut PVOID, |
| DefaultLocaleId: PLCID, |
| DefaultCasingTableSize: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwInitializeRegistry( |
| BootCondition: USHORT, |
| ) -> NTSTATUS; |
| fn ZwInitiatePowerAction( |
| SystemAction: POWER_ACTION, |
| LightestSystemState: SYSTEM_POWER_STATE, |
| Flags: ULONG, |
| Asynchronous: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwIsProcessInJob( |
| ProcessHandle: HANDLE, |
| JobHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwIsSystemResumeAutomatic() -> BOOLEAN; |
| fn ZwIsUILanguageComitted() -> NTSTATUS; |
| fn ZwListenPort( |
| PortHandle: HANDLE, |
| ConnectionRequest: PPORT_MESSAGE, |
| ) -> NTSTATUS; |
| fn ZwLoadDriver( |
| DriverServiceName: PUNICODE_STRING, |
| ) -> NTSTATUS; |
| fn ZwLoadKey( |
| TargetKey: POBJECT_ATTRIBUTES, |
| SourceFile: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwLoadKey2( |
| TargetKey: POBJECT_ATTRIBUTES, |
| SourceFile: POBJECT_ATTRIBUTES, |
| Flags: ULONG, |
| ) -> NTSTATUS; |
| fn ZwLoadKeyEx( |
| TargetKey: POBJECT_ATTRIBUTES, |
| SourceFile: POBJECT_ATTRIBUTES, |
| Flags: ULONG, |
| TrustClassKey: HANDLE, |
| Event: HANDLE, |
| DesiredAccess: ACCESS_MASK, |
| RootHandle: PHANDLE, |
| IoStatus: PIO_STATUS_BLOCK, |
| ) -> NTSTATUS; |
| fn ZwLockFile( |
| FileHandle: HANDLE, |
| Event: HANDLE, |
| ApcRoutine: PIO_APC_ROUTINE, |
| ApcContext: PVOID, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| ByteOffset: PLARGE_INTEGER, |
| Length: PLARGE_INTEGER, |
| Key: ULONG, |
| FailImmediately: BOOLEAN, |
| ExclusiveLock: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwLockProductActivationKeys( |
| pPrivateVer: *mut ULONG, |
| pSafeMode: *mut ULONG, |
| ) -> NTSTATUS; |
| fn ZwLockRegistryKey( |
| KeyHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwLockVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: *mut PVOID, |
| RegionSize: PSIZE_T, |
| MapType: ULONG, |
| ) -> NTSTATUS; |
| fn ZwMakePermanentObject( |
| Handle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwMakeTemporaryObject( |
| Handle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwManagePartition( |
| PartitionInformationClass: MEMORY_PARTITION_INFORMATION_CLASS, |
| PartitionInformation: PVOID, |
| PartitionInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwMapCMFModule( |
| What: ULONG, |
| Index: ULONG, |
| CacheIndexOut: PULONG, |
| CacheFlagsOut: PULONG, |
| ViewSizeOut: PULONG, |
| BaseAddress: *mut PVOID, |
| ) -> NTSTATUS; |
| fn ZwMapUserPhysicalPages( |
| VirtualAddress: PVOID, |
| NumberOfPages: ULONG_PTR, |
| UserPfnArray: PULONG_PTR, |
| ) -> NTSTATUS; |
| fn ZwMapUserPhysicalPagesScatter( |
| VirtualAddresses: *mut PVOID, |
| NumberOfPages: ULONG_PTR, |
| UserPfnArray: PULONG_PTR, |
| ) -> NTSTATUS; |
| fn ZwMapViewOfSection( |
| SectionHandle: HANDLE, |
| ProcessHandle: HANDLE, |
| BaseAddress: *mut PVOID, |
| ZeroBits: ULONG_PTR, |
| CommitSize: SIZE_T, |
| SectionOffset: PLARGE_INTEGER, |
| ViewSize: PSIZE_T, |
| InheritDisposition: SECTION_INHERIT, |
| AllocationType: ULONG, |
| Win32Protect: ULONG, |
| ) -> NTSTATUS; |
| fn ZwModifyBootEntry( |
| BootEntry: PBOOT_ENTRY, |
| ) -> NTSTATUS; |
| fn ZwModifyDriverEntry( |
| DriverEntry: PEFI_DRIVER_ENTRY, |
| ) -> NTSTATUS; |
| fn ZwNotifyChangeDirectoryFile( |
| FileHandle: HANDLE, |
| Event: HANDLE, |
| ApcRoutine: PIO_APC_ROUTINE, |
| ApcContext: PVOID, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| Buffer: PVOID, |
| Length: ULONG, |
| CompletionFilter: ULONG, |
| WatchTree: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwNotifyChangeKey( |
| KeyHandle: HANDLE, |
| Event: HANDLE, |
| ApcRoutine: PIO_APC_ROUTINE, |
| ApcContext: PVOID, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| CompletionFilter: ULONG, |
| WatchTree: BOOLEAN, |
| Buffer: PVOID, |
| BufferSize: ULONG, |
| Asynchronous: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwNotifyChangeMultipleKeys( |
| MasterKeyHandle: HANDLE, |
| Count: ULONG, |
| SubordinateObjects: *mut OBJECT_ATTRIBUTES, |
| Event: HANDLE, |
| ApcRoutine: PIO_APC_ROUTINE, |
| ApcContext: PVOID, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| CompletionFilter: ULONG, |
| WatchTree: BOOLEAN, |
| Buffer: PVOID, |
| BufferSize: ULONG, |
| Asynchronous: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwNotifyChangeSession( |
| SessionHandle: HANDLE, |
| ChangeSequenceNumber: ULONG, |
| ChangeTimeStamp: PLARGE_INTEGER, |
| Event: IO_SESSION_EVENT, |
| NewState: IO_SESSION_STATE, |
| PreviousState: IO_SESSION_STATE, |
| Payload: PVOID, |
| PayloadSize: ULONG, |
| ) -> NTSTATUS; |
| fn ZwOpenDirectoryObject( |
| DirectoryHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenEnlistment( |
| EnlistmentHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| RmHandle: HANDLE, |
| EnlistmentGuid: LPGUID, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenEvent( |
| EventHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenEventPair( |
| EventPairHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenFile( |
| FileHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| ShareAccess: ULONG, |
| OpenOptions: ULONG, |
| ) -> NTSTATUS; |
| fn ZwOpenIoCompletion( |
| IoCompletionHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenJobObject( |
| JobHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenKey( |
| KeyHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenKeyEx( |
| KeyHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| OpenOptions: ULONG, |
| ) -> NTSTATUS; |
| fn ZwOpenKeyTransacted( |
| KeyHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| TransactionHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwOpenKeyTransactedEx( |
| KeyHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| OpenOptions: ULONG, |
| TransactionHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwOpenKeyedEvent( |
| KeyedEventHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenMutant( |
| MutantHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenObjectAuditAlarm( |
| SubsystemName: PUNICODE_STRING, |
| HandleId: PVOID, |
| ObjectTypeName: PUNICODE_STRING, |
| ObjectName: PUNICODE_STRING, |
| SecurityDescriptor: PSECURITY_DESCRIPTOR, |
| ClientToken: HANDLE, |
| DesiredAccess: ACCESS_MASK, |
| GrantedAccess: ACCESS_MASK, |
| Privileges: PPRIVILEGE_SET, |
| ObjectCreation: BOOLEAN, |
| AccessGranted: BOOLEAN, |
| GenerateOnClose: PBOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwOpenPartition( |
| PartitionHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenPrivateNamespace( |
| NamespaceHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| BoundaryDescriptor: PVOID, |
| ) -> NTSTATUS; |
| fn ZwOpenProcess( |
| ProcessHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ClientId: PCLIENT_ID, |
| ) -> NTSTATUS; |
| fn ZwOpenProcessToken( |
| ProcessHandle: HANDLE, |
| DesiredAccess: ACCESS_MASK, |
| TokenHandle: PHANDLE, |
| ) -> NTSTATUS; |
| fn ZwOpenProcessTokenEx( |
| ProcessHandle: HANDLE, |
| DesiredAccess: ACCESS_MASK, |
| HandleAttributes: ULONG, |
| TokenHandle: PHANDLE, |
| ) -> NTSTATUS; |
| fn ZwOpenResourceManager( |
| ResourceManagerHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| TmHandle: HANDLE, |
| ResourceManagerGuid: LPGUID, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenSection( |
| SectionHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenSemaphore( |
| SemaphoreHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenSession( |
| SessionHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenSymbolicLinkObject( |
| LinkHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenThread( |
| ThreadHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ClientId: PCLIENT_ID, |
| ) -> NTSTATUS; |
| fn ZwOpenThreadToken( |
| ThreadHandle: HANDLE, |
| DesiredAccess: ACCESS_MASK, |
| OpenAsSelf: BOOLEAN, |
| TokenHandle: PHANDLE, |
| ) -> NTSTATUS; |
| fn ZwOpenThreadTokenEx( |
| ThreadHandle: HANDLE, |
| DesiredAccess: ACCESS_MASK, |
| OpenAsSelf: BOOLEAN, |
| HandleAttributes: ULONG, |
| TokenHandle: PHANDLE, |
| ) -> NTSTATUS; |
| fn ZwOpenTimer( |
| TimerHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwOpenTransaction( |
| TransactionHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| Uow: LPGUID, |
| TmHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwOpenTransactionManager( |
| TmHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| LogFileName: PUNICODE_STRING, |
| TmIdentity: LPGUID, |
| OpenOptions: ULONG, |
| ) -> NTSTATUS; |
| fn ZwPlugPlayControl( |
| PnPControlClass: PLUGPLAY_CONTROL_CLASS, |
| PnPControlData: PVOID, |
| PnPControlDataLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwPowerInformation( |
| InformationLevel: POWER_INFORMATION_LEVEL, |
| InputBuffer: PVOID, |
| InputBufferLength: ULONG, |
| OutputBuffer: PVOID, |
| OutputBufferLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwPrePrepareComplete( |
| EnlistmentHandle: HANDLE, |
| TmVirtualClock: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwPrePrepareEnlistment( |
| EnlistmentHandle: HANDLE, |
| TmVirtualClock: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwPrepareComplete( |
| EnlistmentHandle: HANDLE, |
| TmVirtualClock: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwPrepareEnlistment( |
| EnlistmentHandle: HANDLE, |
| TmVirtualClock: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwPrivilegeCheck( |
| ClientToken: HANDLE, |
| RequiredPrivileges: PPRIVILEGE_SET, |
| Result: PBOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwPrivilegeObjectAuditAlarm( |
| SubsystemName: PUNICODE_STRING, |
| HandleId: PVOID, |
| ClientToken: HANDLE, |
| DesiredAccess: ACCESS_MASK, |
| Privileges: PPRIVILEGE_SET, |
| AccessGranted: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwPrivilegedServiceAuditAlarm( |
| SubsystemName: PUNICODE_STRING, |
| ServiceName: PUNICODE_STRING, |
| ClientToken: HANDLE, |
| Privileges: PPRIVILEGE_SET, |
| AccessGranted: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwPropagationComplete( |
| ResourceManagerHandle: HANDLE, |
| RequestCookie: ULONG, |
| BufferLength: ULONG, |
| Buffer: PVOID, |
| ) -> NTSTATUS; |
| fn ZwPropagationFailed( |
| ResourceManagerHandle: HANDLE, |
| RequestCookie: ULONG, |
| PropStatus: NTSTATUS, |
| ) -> NTSTATUS; |
| fn ZwProtectVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: *mut PVOID, |
| RegionSize: PSIZE_T, |
| NewProtect: ULONG, |
| OldProtect: PULONG, |
| ) -> NTSTATUS; |
| fn ZwPulseEvent( |
| EventHandle: HANDLE, |
| PreviousState: PLONG, |
| ) -> NTSTATUS; |
| fn ZwQueryAttributesFile( |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| FileInformation: PFILE_BASIC_INFORMATION, |
| ) -> NTSTATUS; |
| fn ZwQueryBootEntryOrder( |
| Ids: PULONG, |
| Count: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryBootOptions( |
| BootOptions: PBOOT_OPTIONS, |
| BootOptionsLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryDebugFilterState( |
| ComponentId: ULONG, |
| Level: ULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryDefaultLocale( |
| UserProfile: BOOLEAN, |
| DefaultLocaleId: PLCID, |
| ) -> NTSTATUS; |
| fn ZwQueryDefaultUILanguage( |
| DefaultUILanguageId: *mut LANGID, |
| ) -> NTSTATUS; |
| fn ZwQueryDirectoryFile( |
| FileHandle: HANDLE, |
| Event: HANDLE, |
| ApcRoutine: PIO_APC_ROUTINE, |
| ApcContext: PVOID, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| FileInformation: PVOID, |
| Length: ULONG, |
| FileInformationClass: FILE_INFORMATION_CLASS, |
| ReturnSingleEntry: BOOLEAN, |
| FileName: PUNICODE_STRING, |
| RestartScan: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwQueryDirectoryObject( |
| DirectoryHandle: HANDLE, |
| Buffer: PVOID, |
| Length: ULONG, |
| ReturnSingleEntry: BOOLEAN, |
| RestartScan: BOOLEAN, |
| Context: PULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryDriverEntryOrder( |
| Ids: PULONG, |
| Count: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryEaFile( |
| FileHandle: HANDLE, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| Buffer: PVOID, |
| Length: ULONG, |
| ReturnSingleEntry: BOOLEAN, |
| EaList: PVOID, |
| EaListLength: ULONG, |
| EaIndex: PULONG, |
| RestartScan: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwQueryEvent( |
| EventHandle: HANDLE, |
| EventInformationClass: EVENT_INFORMATION_CLASS, |
| EventInformation: PVOID, |
| EventInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryFullAttributesFile( |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| FileInformation: PFILE_NETWORK_OPEN_INFORMATION, |
| ) -> NTSTATUS; |
| fn ZwQueryInformationAtom( |
| Atom: RTL_ATOM, |
| AtomInformationClass: ATOM_INFORMATION_CLASS, |
| AtomInformation: PVOID, |
| AtomInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryInformationEnlistment( |
| EnlistmentHandle: HANDLE, |
| EnlistmentInformationClass: ENLISTMENT_INFORMATION_CLASS, |
| EnlistmentInformation: PVOID, |
| EnlistmentInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryInformationFile( |
| FileHandle: HANDLE, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| FileInformation: PVOID, |
| Length: ULONG, |
| FileInformationClass: FILE_INFORMATION_CLASS, |
| ) -> NTSTATUS; |
| fn ZwQueryInformationJobObject( |
| JobHandle: HANDLE, |
| JobObjectInformationClass: JOBOBJECTINFOCLASS, |
| JobObjectInformation: PVOID, |
| JobObjectInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryInformationPort( |
| PortHandle: HANDLE, |
| PortInformationClass: PORT_INFORMATION_CLASS, |
| PortInformation: PVOID, |
| Length: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryInformationProcess( |
| ProcessHandle: HANDLE, |
| ProcessInformationClass: PROCESSINFOCLASS, |
| ProcessInformation: PVOID, |
| ProcessInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryInformationResourceManager( |
| ResourceManagerHandle: HANDLE, |
| ResourceManagerInformationClass: RESOURCEMANAGER_INFORMATION_CLASS, |
| ResourceManagerInformation: PVOID, |
| ResourceManagerInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryInformationThread( |
| ThreadHandle: HANDLE, |
| ThreadInformationClass: THREADINFOCLASS, |
| ThreadInformation: PVOID, |
| ThreadInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryInformationToken( |
| TokenHandle: HANDLE, |
| TokenInformationClass: TOKEN_INFORMATION_CLASS, |
| TokenInformation: PVOID, |
| TokenInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryInformationTransaction( |
| TransactionHandle: HANDLE, |
| TransactionInformationClass: TRANSACTION_INFORMATION_CLASS, |
| TransactionInformation: PVOID, |
| TransactionInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryInformationTransactionManager( |
| TransactionManagerHandle: HANDLE, |
| TransactionManagerInformationClass: TRANSACTIONMANAGER_INFORMATION_CLASS, |
| TransactionManagerInformation: PVOID, |
| TransactionManagerInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryInformationWorkerFactory( |
| WorkerFactoryHandle: HANDLE, |
| WorkerFactoryInformationClass: WORKERFACTORYINFOCLASS, |
| WorkerFactoryInformation: PVOID, |
| WorkerFactoryInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryInstallUILanguage( |
| InstallUILanguageId: *mut LANGID, |
| ) -> NTSTATUS; |
| fn ZwQueryIntervalProfile( |
| ProfileSource: KPROFILE_SOURCE, |
| Interval: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryIoCompletion( |
| IoCompletionHandle: HANDLE, |
| IoCompletionInformationClass: IO_COMPLETION_INFORMATION_CLASS, |
| IoCompletionInformation: PVOID, |
| IoCompletionInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryKey( |
| KeyHandle: HANDLE, |
| KeyInformationClass: KEY_INFORMATION_CLASS, |
| KeyInformation: PVOID, |
| Length: ULONG, |
| ResultLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryLicenseValue( |
| ValueName: PUNICODE_STRING, |
| Type: PULONG, |
| Data: PVOID, |
| DataSize: ULONG, |
| ResultDataSize: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryMultipleValueKey( |
| KeyHandle: HANDLE, |
| ValueEntries: PKEY_VALUE_ENTRY, |
| EntryCount: ULONG, |
| ValueBuffer: PVOID, |
| BufferLength: PULONG, |
| RequiredBufferLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryMutant( |
| MutantHandle: HANDLE, |
| MutantInformationClass: MUTANT_INFORMATION_CLASS, |
| MutantInformation: PVOID, |
| MutantInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryObject( |
| Handle: HANDLE, |
| ObjectInformationClass: OBJECT_INFORMATION_CLASS, |
| ObjectInformation: PVOID, |
| ObjectInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryOpenSubKeys( |
| TargetKey: POBJECT_ATTRIBUTES, |
| HandleCount: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryOpenSubKeysEx( |
| TargetKey: POBJECT_ATTRIBUTES, |
| BufferLength: ULONG, |
| Buffer: PVOID, |
| RequiredSize: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryPerformanceCounter( |
| PerformanceCounter: PLARGE_INTEGER, |
| PerformanceFrequency: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwQueryPortInformationProcess() -> NTSTATUS; |
| fn ZwQueryQuotaInformationFile( |
| FileHandle: HANDLE, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| Buffer: PVOID, |
| Length: ULONG, |
| ReturnSingleEntry: BOOLEAN, |
| SidList: PVOID, |
| SidListLength: ULONG, |
| StartSid: PSID, |
| RestartScan: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwQuerySection( |
| SectionHandle: HANDLE, |
| SectionInformationClass: SECTION_INFORMATION_CLASS, |
| SectionInformation: PVOID, |
| SectionInformationLength: SIZE_T, |
| ReturnLength: PSIZE_T, |
| ) -> NTSTATUS; |
| fn ZwQuerySecurityAttributesToken( |
| TokenHandle: HANDLE, |
| Attributes: PUNICODE_STRING, |
| NumberOfAttributes: ULONG, |
| Buffer: PVOID, |
| Length: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQuerySecurityObject( |
| Handle: HANDLE, |
| SecurityInformation: SECURITY_INFORMATION, |
| SecurityDescriptor: PSECURITY_DESCRIPTOR, |
| Length: ULONG, |
| LengthNeeded: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQuerySemaphore( |
| SemaphoreHandle: HANDLE, |
| SemaphoreInformationClass: SEMAPHORE_INFORMATION_CLASS, |
| SemaphoreInformation: PVOID, |
| SemaphoreInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQuerySymbolicLinkObject( |
| LinkHandle: HANDLE, |
| LinkTarget: PUNICODE_STRING, |
| ReturnedLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQuerySystemEnvironmentValue( |
| VariableName: PUNICODE_STRING, |
| VariableValue: PWSTR, |
| ValueLength: USHORT, |
| ReturnLength: PUSHORT, |
| ) -> NTSTATUS; |
| fn ZwQuerySystemEnvironmentValueEx( |
| VariableName: PUNICODE_STRING, |
| VendorGuid: LPGUID, |
| Value: PVOID, |
| ValueLength: PULONG, |
| Attributes: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQuerySystemInformation( |
| SystemInformationClass: SYSTEM_INFORMATION_CLASS, |
| SystemInformation: PVOID, |
| SystemInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQuerySystemInformationEx( |
| SystemInformationClass: SYSTEM_INFORMATION_CLASS, |
| InputBuffer: PVOID, |
| InputBufferLength: ULONG, |
| SystemInformation: PVOID, |
| SystemInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQuerySystemTime( |
| SystemTime: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwQueryTimer( |
| TimerHandle: HANDLE, |
| TimerInformationClass: TIMER_INFORMATION_CLASS, |
| TimerInformation: PVOID, |
| TimerInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryTimerResolution( |
| MaximumTime: PULONG, |
| MinimumTime: PULONG, |
| CurrentTime: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryValueKey( |
| KeyHandle: HANDLE, |
| ValueName: PUNICODE_STRING, |
| KeyValueInformationClass: KEY_VALUE_INFORMATION_CLASS, |
| KeyValueInformation: PVOID, |
| Length: ULONG, |
| ResultLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: PVOID, |
| MemoryInformationClass: MEMORY_INFORMATION_CLASS, |
| MemoryInformation: PVOID, |
| MemoryInformationLength: SIZE_T, |
| ReturnLength: PSIZE_T, |
| ) -> NTSTATUS; |
| fn ZwQueryVolumeInformationFile( |
| FileHandle: HANDLE, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| FsInformation: PVOID, |
| Length: ULONG, |
| FsInformationClass: FS_INFORMATION_CLASS, |
| ) -> NTSTATUS; |
| fn ZwQueryWnfStateData( |
| StateName: PCWNF_STATE_NAME, |
| TypeId: PCWNF_TYPE_ID, |
| ExplicitScope: *const VOID, |
| ChangeStamp: PWNF_CHANGE_STAMP, |
| Buffer: PVOID, |
| BufferSize: PULONG, |
| ) -> NTSTATUS; |
| fn ZwQueryWnfStateNameInformation( |
| StateName: PCWNF_STATE_NAME, |
| NameInfoClass: WNF_STATE_NAME_INFORMATION, |
| ExplicitScope: *const VOID, |
| InfoBuffer: PVOID, |
| InfoBufferSize: ULONG, |
| ) -> NTSTATUS; |
| fn ZwQueueApcThread( |
| ThreadHandle: HANDLE, |
| ApcRoutine: PPS_APC_ROUTINE, |
| ApcArgument1: PVOID, |
| ApcArgument2: PVOID, |
| ApcArgument3: PVOID, |
| ) -> NTSTATUS; |
| fn ZwQueueApcThreadEx( |
| ThreadHandle: HANDLE, |
| UserApcReserveHandle: HANDLE, |
| ApcRoutine: PPS_APC_ROUTINE, |
| ApcArgument1: PVOID, |
| ApcArgument2: PVOID, |
| ApcArgument3: PVOID, |
| ) -> NTSTATUS; |
| fn ZwRaiseException( |
| ExceptionRecord: PEXCEPTION_RECORD, |
| ContextRecord: PCONTEXT, |
| FirstChance: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwRaiseHardError( |
| ErrorStatus: NTSTATUS, |
| NumberOfParameters: ULONG, |
| UnicodeStringParameterMask: ULONG, |
| Parameters: PULONG_PTR, |
| ValidResponseOptions: ULONG, |
| Response: PULONG, |
| ) -> NTSTATUS; |
| fn ZwReadFile( |
| FileHandle: HANDLE, |
| Event: HANDLE, |
| ApcRoutine: PIO_APC_ROUTINE, |
| ApcContext: PVOID, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| Buffer: PVOID, |
| Length: ULONG, |
| ByteOffset: PLARGE_INTEGER, |
| Key: PULONG, |
| ) -> NTSTATUS; |
| fn ZwReadFileScatter( |
| FileHandle: HANDLE, |
| Event: HANDLE, |
| ApcRoutine: PIO_APC_ROUTINE, |
| ApcContext: PVOID, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| SegmentArray: PFILE_SEGMENT_ELEMENT, |
| Length: ULONG, |
| ByteOffset: PLARGE_INTEGER, |
| Key: PULONG, |
| ) -> NTSTATUS; |
| fn ZwReadOnlyEnlistment( |
| EnlistmentHandle: HANDLE, |
| TmVirtualClock: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwReadRequestData( |
| PortHandle: HANDLE, |
| Message: PPORT_MESSAGE, |
| DataEntryIndex: ULONG, |
| Buffer: PVOID, |
| BufferSize: SIZE_T, |
| NumberOfBytesRead: PSIZE_T, |
| ) -> NTSTATUS; |
| fn ZwReadVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: PVOID, |
| Buffer: PVOID, |
| BufferSize: SIZE_T, |
| NumberOfBytesRead: PSIZE_T, |
| ) -> NTSTATUS; |
| fn ZwRecoverEnlistment( |
| EnlistmentHandle: HANDLE, |
| EnlistmentKey: PVOID, |
| ) -> NTSTATUS; |
| fn ZwRecoverResourceManager( |
| ResourceManagerHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwRecoverTransactionManager( |
| TransactionManagerHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwRegisterProtocolAddressInformation( |
| ResourceManager: HANDLE, |
| ProtocolId: PCRM_PROTOCOL_ID, |
| ProtocolInformationSize: ULONG, |
| ProtocolInformation: PVOID, |
| CreateOptions: ULONG, |
| ) -> NTSTATUS; |
| fn ZwRegisterThreadTerminatePort( |
| PortHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwReleaseCMFViewOwnership() -> NTSTATUS; |
| fn ZwReleaseKeyedEvent( |
| KeyedEventHandle: HANDLE, |
| KeyValue: PVOID, |
| Alertable: BOOLEAN, |
| Timeout: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwReleaseMutant( |
| MutantHandle: HANDLE, |
| PreviousCount: PLONG, |
| ) -> NTSTATUS; |
| fn ZwReleaseSemaphore( |
| SemaphoreHandle: HANDLE, |
| ReleaseCount: LONG, |
| PreviousCount: PLONG, |
| ) -> NTSTATUS; |
| fn ZwReleaseWorkerFactoryWorker( |
| WorkerFactoryHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwRemoveIoCompletion( |
| IoCompletionHandle: HANDLE, |
| KeyContext: *mut PVOID, |
| ApcContext: *mut PVOID, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| Timeout: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwRemoveIoCompletionEx( |
| IoCompletionHandle: HANDLE, |
| IoCompletionInformation: PFILE_IO_COMPLETION_INFORMATION, |
| Count: ULONG, |
| NumEntriesRemoved: PULONG, |
| Timeout: PLARGE_INTEGER, |
| Alertable: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwRemoveProcessDebug( |
| ProcessHandle: HANDLE, |
| DebugObjectHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwRenameKey( |
| KeyHandle: HANDLE, |
| NewName: PUNICODE_STRING, |
| ) -> NTSTATUS; |
| fn ZwRenameTransactionManager( |
| LogFileName: PUNICODE_STRING, |
| ExistingTransactionManagerGuid: LPGUID, |
| ) -> NTSTATUS; |
| fn ZwReplaceKey( |
| NewFile: POBJECT_ATTRIBUTES, |
| TargetHandle: HANDLE, |
| OldFile: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwReplacePartitionUnit( |
| TargetInstancePath: PUNICODE_STRING, |
| SpareInstancePath: PUNICODE_STRING, |
| Flags: ULONG, |
| ) -> NTSTATUS; |
| fn ZwReplyPort( |
| PortHandle: HANDLE, |
| ReplyMessage: PPORT_MESSAGE, |
| ) -> NTSTATUS; |
| fn ZwReplyWaitReceivePort( |
| PortHandle: HANDLE, |
| PortContext: *mut PVOID, |
| ReplyMessage: PPORT_MESSAGE, |
| ReceiveMessage: PPORT_MESSAGE, |
| ) -> NTSTATUS; |
| fn ZwReplyWaitReceivePortEx( |
| PortHandle: HANDLE, |
| PortContext: *mut PVOID, |
| ReplyMessage: PPORT_MESSAGE, |
| ReceiveMessage: PPORT_MESSAGE, |
| Timeout: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwReplyWaitReplyPort( |
| PortHandle: HANDLE, |
| ReplyMessage: PPORT_MESSAGE, |
| ) -> NTSTATUS; |
| fn ZwRequestPort( |
| PortHandle: HANDLE, |
| RequestMessage: PPORT_MESSAGE, |
| ) -> NTSTATUS; |
| fn ZwRequestWaitReplyPort( |
| PortHandle: HANDLE, |
| RequestMessage: PPORT_MESSAGE, |
| ReplyMessage: PPORT_MESSAGE, |
| ) -> NTSTATUS; |
| fn ZwRequestWakeupLatency( |
| latency: LATENCY_TIME, |
| ) -> NTSTATUS; |
| fn ZwResetEvent( |
| EventHandle: HANDLE, |
| PreviousState: PLONG, |
| ) -> NTSTATUS; |
| fn ZwResetWriteWatch( |
| ProcessHandle: HANDLE, |
| BaseAddress: PVOID, |
| RegionSize: SIZE_T, |
| ) -> NTSTATUS; |
| fn ZwRestoreKey( |
| KeyHandle: HANDLE, |
| FileHandle: HANDLE, |
| Flags: ULONG, |
| ) -> NTSTATUS; |
| fn ZwResumeProcess( |
| ProcessHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwResumeThread( |
| ThreadHandle: HANDLE, |
| PreviousSuspendCount: PULONG, |
| ) -> NTSTATUS; |
| fn ZwRevertContainerImpersonation() -> NTSTATUS; |
| fn ZwRollbackComplete( |
| EnlistmentHandle: HANDLE, |
| TmVirtualClock: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwRollbackEnlistment( |
| EnlistmentHandle: HANDLE, |
| TmVirtualClock: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwRollbackTransaction( |
| TransactionHandle: HANDLE, |
| Wait: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwRollforwardTransactionManager( |
| TransactionManagerHandle: HANDLE, |
| TmVirtualClock: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwSaveKey( |
| KeyHandle: HANDLE, |
| FileHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwSaveKeyEx( |
| KeyHandle: HANDLE, |
| FileHandle: HANDLE, |
| Format: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSaveMergedKeys( |
| HighPrecedenceKeyHandle: HANDLE, |
| LowPrecedenceKeyHandle: HANDLE, |
| FileHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwSecureConnectPort( |
| PortHandle: PHANDLE, |
| PortName: PUNICODE_STRING, |
| SecurityQos: PSECURITY_QUALITY_OF_SERVICE, |
| ClientView: PPORT_VIEW, |
| RequiredServerSid: PSID, |
| ServerView: PREMOTE_PORT_VIEW, |
| MaxMessageLength: PULONG, |
| ConnectionInformation: PVOID, |
| ConnectionInformationLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwSerializeBoot() -> NTSTATUS; |
| fn ZwSetBootEntryOrder( |
| Ids: PULONG, |
| Count: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetBootOptions( |
| BootOptions: PBOOT_OPTIONS, |
| FieldsToChange: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetCachedSigningLevel( |
| Flags: ULONG, |
| InputSigningLevel: SE_SIGNING_LEVEL, |
| SourceFiles: PHANDLE, |
| SourceFileCount: ULONG, |
| TargetFile: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwSetContextThread( |
| ThreadHandle: HANDLE, |
| ThreadContext: PCONTEXT, |
| ) -> NTSTATUS; |
| fn ZwSetDebugFilterState( |
| ComponentId: ULONG, |
| Level: ULONG, |
| State: BOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwSetDefaultHardErrorPort( |
| DefaultHardErrorPort: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwSetDefaultLocale( |
| UserProfile: BOOLEAN, |
| DefaultLocaleId: LCID, |
| ) -> NTSTATUS; |
| fn ZwSetDefaultUILanguage( |
| DefaultUILanguageId: LANGID, |
| ) -> NTSTATUS; |
| fn ZwSetDriverEntryOrder( |
| Ids: PULONG, |
| Count: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetEaFile( |
| FileHandle: HANDLE, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| Buffer: PVOID, |
| Length: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetEvent( |
| EventHandle: HANDLE, |
| PreviousState: PLONG, |
| ) -> NTSTATUS; |
| fn ZwSetEventBoostPriority( |
| EventHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwSetHighEventPair( |
| EventPairHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwSetHighWaitLowEventPair( |
| EventPairHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwSetIRTimer( |
| TimerHandle: HANDLE, |
| DueTime: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwSetInformationDebugObject( |
| DebugObjectHandle: HANDLE, |
| DebugObjectInformationClass: DEBUGOBJECTINFOCLASS, |
| DebugInformation: PVOID, |
| DebugInformationLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwSetInformationEnlistment( |
| EnlistmentHandle: HANDLE, |
| EnlistmentInformationClass: ENLISTMENT_INFORMATION_CLASS, |
| EnlistmentInformation: PVOID, |
| EnlistmentInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetInformationFile( |
| FileHandle: HANDLE, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| FileInformation: PVOID, |
| Length: ULONG, |
| FileInformationClass: FILE_INFORMATION_CLASS, |
| ) -> NTSTATUS; |
| fn ZwSetInformationJobObject( |
| JobHandle: HANDLE, |
| JobObjectInformationClass: JOBOBJECTINFOCLASS, |
| JobObjectInformation: PVOID, |
| JobObjectInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetInformationKey( |
| KeyHandle: HANDLE, |
| KeySetInformationClass: KEY_SET_INFORMATION_CLASS, |
| KeySetInformation: PVOID, |
| KeySetInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetInformationObject( |
| Handle: HANDLE, |
| ObjectInformationClass: OBJECT_INFORMATION_CLASS, |
| ObjectInformation: PVOID, |
| ObjectInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetInformationProcess( |
| ProcessHandle: HANDLE, |
| ProcessInformationClass: PROCESSINFOCLASS, |
| ProcessInformation: PVOID, |
| ProcessInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetInformationResourceManager( |
| ResourceManagerHandle: HANDLE, |
| ResourceManagerInformationClass: RESOURCEMANAGER_INFORMATION_CLASS, |
| ResourceManagerInformation: PVOID, |
| ResourceManagerInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetInformationThread( |
| ThreadHandle: HANDLE, |
| ThreadInformationClass: THREADINFOCLASS, |
| ThreadInformation: PVOID, |
| ThreadInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetInformationToken( |
| TokenHandle: HANDLE, |
| TokenInformationClass: TOKEN_INFORMATION_CLASS, |
| TokenInformation: PVOID, |
| TokenInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetInformationTransaction( |
| TransactionHandle: HANDLE, |
| TransactionInformationClass: TRANSACTION_INFORMATION_CLASS, |
| TransactionInformation: PVOID, |
| TransactionInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetInformationTransactionManager( |
| TmHandle: HANDLE, |
| TransactionManagerInformationClass: TRANSACTIONMANAGER_INFORMATION_CLASS, |
| TransactionManagerInformation: PVOID, |
| TransactionManagerInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetInformationVirtualMemory( |
| ProcessHandle: HANDLE, |
| VmInformationClass: VIRTUAL_MEMORY_INFORMATION_CLASS, |
| NumberOfEntries: ULONG_PTR, |
| VirtualAddresses: PMEMORY_RANGE_ENTRY, |
| VmInformation: PVOID, |
| VmInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetInformationWorkerFactory( |
| WorkerFactoryHandle: HANDLE, |
| WorkerFactoryInformationClass: WORKERFACTORYINFOCLASS, |
| WorkerFactoryInformation: PVOID, |
| WorkerFactoryInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetIntervalProfile( |
| Interval: ULONG, |
| Source: KPROFILE_SOURCE, |
| ) -> NTSTATUS; |
| fn ZwSetIoCompletion( |
| IoCompletionHandle: HANDLE, |
| KeyContext: PVOID, |
| ApcContext: PVOID, |
| IoStatus: NTSTATUS, |
| IoStatusInformation: ULONG_PTR, |
| ) -> NTSTATUS; |
| fn ZwSetIoCompletionEx( |
| IoCompletionHandle: HANDLE, |
| IoCompletionPacketHandle: HANDLE, |
| KeyContext: PVOID, |
| ApcContext: PVOID, |
| IoStatus: NTSTATUS, |
| IoStatusInformation: ULONG_PTR, |
| ) -> NTSTATUS; |
| fn ZwSetLdtEntries( |
| Selector0: ULONG, |
| Entry0Low: ULONG, |
| Entry0Hi: ULONG, |
| Selector1: ULONG, |
| Entry1Low: ULONG, |
| Entry1Hi: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetLowEventPair( |
| EventPairHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwSetLowWaitHighEventPair( |
| EventPairHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwSetQuotaInformationFile( |
| FileHandle: HANDLE, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| Buffer: PVOID, |
| Length: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetSecurityObject( |
| Handle: HANDLE, |
| SecurityInformation: SECURITY_INFORMATION, |
| SecurityDescriptor: PSECURITY_DESCRIPTOR, |
| ) -> NTSTATUS; |
| fn ZwSetSystemEnvironmentValue( |
| VariableName: PUNICODE_STRING, |
| VariableValue: PUNICODE_STRING, |
| ) -> NTSTATUS; |
| fn ZwSetSystemEnvironmentValueEx( |
| VariableName: PUNICODE_STRING, |
| VendorGuid: LPGUID, |
| Value: PVOID, |
| ValueLength: ULONG, |
| Attributes: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetSystemInformation( |
| SystemInformationClass: SYSTEM_INFORMATION_CLASS, |
| SystemInformation: PVOID, |
| SystemInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetSystemPowerState( |
| SystemAction: POWER_ACTION, |
| LightestSystemState: SYSTEM_POWER_STATE, |
| Flags: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetSystemTime( |
| SystemTime: PLARGE_INTEGER, |
| PreviousTime: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwSetThreadExecutionState( |
| NewFlags: EXECUTION_STATE, |
| PreviousFlags: *mut EXECUTION_STATE, |
| ) -> NTSTATUS; |
| fn ZwSetTimer( |
| TimerHandle: HANDLE, |
| DueTime: PLARGE_INTEGER, |
| TimerApcRoutine: PTIMER_APC_ROUTINE, |
| TimerContext: PVOID, |
| ResumeTimer: BOOLEAN, |
| Period: LONG, |
| PreviousState: PBOOLEAN, |
| ) -> NTSTATUS; |
| fn ZwSetTimer2( |
| TimerHandle: HANDLE, |
| DueTime: PLARGE_INTEGER, |
| Period: PLARGE_INTEGER, |
| Parameters: PT2_SET_PARAMETERS, |
| ) -> NTSTATUS; |
| fn ZwSetTimerEx( |
| TimerHandle: HANDLE, |
| TimerSetInformationClass: TIMER_SET_INFORMATION_CLASS, |
| TimerSetInformation: PVOID, |
| TimerSetInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetTimerResolution( |
| DesiredTime: ULONG, |
| SetResolution: BOOLEAN, |
| ActualTime: PULONG, |
| ) -> NTSTATUS; |
| fn ZwSetUuidSeed( |
| Seed: PCHAR, |
| ) -> NTSTATUS; |
| fn ZwSetValueKey( |
| KeyHandle: HANDLE, |
| ValueName: PUNICODE_STRING, |
| TitleIndex: ULONG, |
| Type: ULONG, |
| Data: PVOID, |
| DataSize: ULONG, |
| ) -> NTSTATUS; |
| fn ZwSetVolumeInformationFile( |
| FileHandle: HANDLE, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| FsInformation: PVOID, |
| Length: ULONG, |
| FsInformationClass: FS_INFORMATION_CLASS, |
| ) -> NTSTATUS; |
| fn ZwSetWnfProcessNotificationEvent( |
| NotificationEvent: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwShutdownSystem( |
| Action: SHUTDOWN_ACTION, |
| ) -> NTSTATUS; |
| fn ZwShutdownWorkerFactory( |
| WorkerFactoryHandle: HANDLE, |
| PendingWorkerCount: *mut LONG, |
| ) -> NTSTATUS; |
| fn ZwSignalAndWaitForSingleObject( |
| SignalHandle: HANDLE, |
| WaitHandle: HANDLE, |
| Alertable: BOOLEAN, |
| Timeout: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwSinglePhaseReject( |
| EnlistmentHandle: HANDLE, |
| TmVirtualClock: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwStartProfile( |
| ProfileHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwStopProfile( |
| ProfileHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwSubscribeWnfStateChange( |
| StateName: PCWNF_STATE_NAME, |
| ChangeStamp: WNF_CHANGE_STAMP, |
| EventMask: ULONG, |
| SubscriptionId: PULONG64, |
| ) -> NTSTATUS; |
| fn ZwSuspendProcess( |
| ProcessHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwSuspendThread( |
| ThreadHandle: HANDLE, |
| PreviousSuspendCount: PULONG, |
| ) -> NTSTATUS; |
| fn ZwSystemDebugControl( |
| Command: SYSDBG_COMMAND, |
| InputBuffer: PVOID, |
| InputBufferLength: ULONG, |
| OutputBuffer: PVOID, |
| OutputBufferLength: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwTerminateJobObject( |
| JobHandle: HANDLE, |
| ExitStatus: NTSTATUS, |
| ) -> NTSTATUS; |
| fn ZwTerminateProcess( |
| ProcessHandle: HANDLE, |
| ExitStatus: NTSTATUS, |
| ) -> NTSTATUS; |
| fn ZwTerminateThread( |
| ThreadHandle: HANDLE, |
| ExitStatus: NTSTATUS, |
| ) -> NTSTATUS; |
| fn ZwTestAlert() -> NTSTATUS; |
| fn ZwThawRegistry() -> NTSTATUS; |
| fn ZwThawTransactions() -> NTSTATUS; |
| fn ZwTraceControl( |
| FunctionCode: ULONG, |
| InBuffer: PVOID, |
| InBufferLen: ULONG, |
| OutBuffer: PVOID, |
| OutBufferLen: ULONG, |
| ReturnLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwTraceEvent( |
| TraceHandle: HANDLE, |
| Flags: ULONG, |
| FieldSize: ULONG, |
| Fields: PVOID, |
| ) -> NTSTATUS; |
| fn ZwTranslateFilePath( |
| InputFilePath: PFILE_PATH, |
| OutputType: ULONG, |
| OutputFilePath: PFILE_PATH, |
| OutputFilePathLength: PULONG, |
| ) -> NTSTATUS; |
| fn ZwUmsThreadYield( |
| SchedulerParam: PVOID, |
| ) -> NTSTATUS; |
| fn ZwUnloadDriver( |
| DriverServiceName: PUNICODE_STRING, |
| ) -> NTSTATUS; |
| fn ZwUnloadKey( |
| TargetKey: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn ZwUnloadKey2( |
| TargetKey: POBJECT_ATTRIBUTES, |
| Flags: ULONG, |
| ) -> NTSTATUS; |
| fn ZwUnloadKeyEx( |
| TargetKey: POBJECT_ATTRIBUTES, |
| Event: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwUnlockFile( |
| FileHandle: HANDLE, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| ByteOffset: PLARGE_INTEGER, |
| Length: PLARGE_INTEGER, |
| Key: ULONG, |
| ) -> NTSTATUS; |
| fn ZwUnlockVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: *mut PVOID, |
| RegionSize: PSIZE_T, |
| MapType: ULONG, |
| ) -> NTSTATUS; |
| fn ZwUnmapViewOfSection( |
| ProcessHandle: HANDLE, |
| BaseAddress: PVOID, |
| ) -> NTSTATUS; |
| fn ZwUnmapViewOfSectionEx( |
| ProcessHandle: HANDLE, |
| BaseAddress: PVOID, |
| Flags: ULONG, |
| ) -> NTSTATUS; |
| fn ZwUnsubscribeWnfStateChange( |
| StateName: PCWNF_STATE_NAME, |
| ) -> NTSTATUS; |
| fn ZwUpdateWnfStateData( |
| StateName: PCWNF_STATE_NAME, |
| Buffer: *const VOID, |
| Length: ULONG, |
| TypeId: PCWNF_TYPE_ID, |
| ExplicitScope: *const VOID, |
| MatchingChangeStamp: WNF_CHANGE_STAMP, |
| CheckStamp: LOGICAL, |
| ) -> NTSTATUS; |
| fn ZwVdmControl( |
| Service: VDMSERVICECLASS, |
| ServiceData: PVOID, |
| ) -> NTSTATUS; |
| fn ZwWaitForAlertByThreadId( |
| Address: PVOID, |
| Timeout: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwWaitForDebugEvent( |
| DebugObjectHandle: HANDLE, |
| Alertable: BOOLEAN, |
| Timeout: PLARGE_INTEGER, |
| WaitStateChange: PVOID, |
| ) -> NTSTATUS; |
| fn ZwWaitForKeyedEvent( |
| KeyedEventHandle: HANDLE, |
| KeyValue: PVOID, |
| Alertable: BOOLEAN, |
| Timeout: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwWaitForMultipleObjects( |
| Count: ULONG, |
| Handles: *mut HANDLE, |
| WaitType: WAIT_TYPE, |
| Alertable: BOOLEAN, |
| Timeout: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwWaitForMultipleObjects32( |
| Count: ULONG, |
| Handles: *mut LONG, |
| WaitType: WAIT_TYPE, |
| Alertable: BOOLEAN, |
| Timeout: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwWaitForSingleObject( |
| Handle: HANDLE, |
| Alertable: BOOLEAN, |
| Timeout: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn ZwWaitForWorkViaWorkerFactory( |
| WorkerFactoryHandle: HANDLE, |
| MiniPacket: *mut FILE_IO_COMPLETION_INFORMATION, |
| ) -> NTSTATUS; |
| fn ZwWaitHighEventPair( |
| EventPairHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwWaitLowEventPair( |
| EventPairHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwWorkerFactoryWorkerReady( |
| WorkerFactoryHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn ZwWriteFile( |
| FileHandle: HANDLE, |
| Event: HANDLE, |
| ApcRoutine: PIO_APC_ROUTINE, |
| ApcContext: PVOID, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| Buffer: PVOID, |
| Length: ULONG, |
| ByteOffset: PLARGE_INTEGER, |
| Key: PULONG, |
| ) -> NTSTATUS; |
| fn ZwWriteFileGather( |
| FileHandle: HANDLE, |
| Event: HANDLE, |
| ApcRoutine: PIO_APC_ROUTINE, |
| ApcContext: PVOID, |
| IoStatusBlock: PIO_STATUS_BLOCK, |
| SegmentArray: PFILE_SEGMENT_ELEMENT, |
| Length: ULONG, |
| ByteOffset: PLARGE_INTEGER, |
| Key: PULONG, |
| ) -> NTSTATUS; |
| fn ZwWriteRequestData( |
| PortHandle: HANDLE, |
| Message: PPORT_MESSAGE, |
| DataEntryIndex: ULONG, |
| Buffer: PVOID, |
| BufferSize: SIZE_T, |
| NumberOfBytesWritten: PSIZE_T, |
| ) -> NTSTATUS; |
| fn ZwWriteVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: PVOID, |
| Buffer: PVOID, |
| BufferSize: SIZE_T, |
| NumberOfBytesWritten: PSIZE_T, |
| ) -> NTSTATUS; |
| fn ZwYieldExecution() -> NTSTATUS; |
| }} |
