' ########################################################################################
' Microsoft Windows
' File: ntifs.inc
' Contents: Types, constants, and functions that are exposed to file system drivers.
' Copyright (c) 2011 Jos? Roca
' Portions Copyright (c) Microsoft Corporation.
' All Rights Reserved.
' THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
' EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
' MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
' ########################################################################################
' *** NOTE: The remed constants and other items can be found in other include files,
' *** mainly WinNT.inc, WinIoCtl.inc, NTSecApi.inc.
#IF NOT %DEF(PBX_ntifs_PBI)
#DEFINE PBX_ntifs_PBI
%EQUATE `NTIFS_INC = 1
'#define _NTIFS_INCLUDED_
'#ifndef RC_INVOKED
'#if _MSC_VER < 1300
'#error Compiler version not supported by Windows DDK
'#endif
'#endif // RC_INVOKED
'#ifndef __cplusplus
'#pragma warning(disable:4116) // TYPE_ALIGNMENT generates this - move it
' // outside the warning push/pop scope.
'#endif
'#define NT_INCLUDED
'#define _NTMSV1_0_
'#define _CTYPE_DISABLE_MACROS
'#if _MSC_VER >= 1200
'#pragma warning(push)
'#endif
'#pragma warning(disable:4115) // named type definition in parentheses
'#pragma warning(disable:4201) // nameless struct/union
'#pragma warning(disable:4214) // bit field types other than int
'#include <ntddk.h>
'#include <excpt.h>
'#include <ntdef.h>
'#include <ntnls.h>
'#include <ntstatus.h>
'#include <bugcodes.h>
'#include <ntiologc.h>
#INCLUDE ONCE "Core/Windows.inc"
#INCLUDE ONCE "Legacy/Platform/ntstatus.inc"
#INCLUDE ONCE "Legacy/Platform/NTSecAPI.inc"
#INCLUDE ONCE "Legacy/Platform/NTSecPkg.inc"
#INCLUDE ONCE "Legacy/Platform/ntnls.inc"
#INCLUDE ONCE "Legacy/Platform/WinIoCtl.inc"
#INCLUDE ONCE "Legacy/System/wncc.inc"
#INCLUDE ONCE "Legacy/System/Sspi.inc"
'//
'// These macros are used to test, set and clear flags respectivly
'//
'#ifndef FlagOn
'#define FlagOn(_F,_SF) ((_F) & (_SF))
'#endif
'#ifndef BooleanFlagOn
'#define BooleanFlagOn(F,SF) ((BOOLEAN)(((F) & (SF)) != 0))
'#endif
'#ifndef SetFlag
'#define SetFlag(_F,_SF) ((_F) |= (_SF))
'#endif
'#ifndef ClearFlag
'#define ClearFlag(_F,_SF) ((_F) &= ~(_SF))
'#endif
'//
'// Define types that are not exported.
'//
'typedef struct _BUS_HANDLER *PBUS_HANDLER;
'typedef struct _CALLBACK_OBJECT *PCALLBACK_OBJECT;
'typedef struct _DEVICE_HANDLER_OBJECT *PDEVICE_HANDLER_OBJECT;
'typedef struct _IO_TIMER *PIO_TIMER;
'typedef struct _KINTERRUPT *PKINTERRUPT;
'typedef struct _KPROCESS *PKPROCESS ,*PRKPROCESS, *PEPROCESS;
'typedef struct _KTHREAD *PKTHREAD, *PRKTHREAD, *PETHREAD;
'typedef struct _OBJECT_TYPE *POBJECT_TYPE;
'typedef struct _PEB *PPEB;
'typedef struct _ACL *PACL;
'#ifdef __cplusplus
'extern "C" {
'#endif
'#define PsGetCurrentProcess IoGetCurrentProcess
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'extern NTSYSAPI volatile CCHAR KeNumberProcessors;
'#elif (NTDDI_VERSION >= NTDDI_WINXP)
'extern NTSYSAPI CCHAR KeNumberProcessors;
'#else
'extern PCCHAR KeNumberProcessors;
'#endif
'typedef UNICODE_STRING LSA_UNICODE_STRING, *PLSA_UNICODE_STRING;
'typedef STRING LSA_STRING, *PLSA_STRING;
'typedef OBJECT_ATTRIBUTES LSA_OBJECT_ATTRIBUTES, *PLSA_OBJECT_ATTRIBUTES;
MACRO OBJECT_ATTRIBUTES = LSA_OBJECT_ATTRIBUTES
'#ifndef SID_IDENTIFIER_AUTHORITY_DEFINED
'#define SID_IDENTIFIER_AUTHORITY_DEFINED
'typedef struct _SID_IDENTIFIER_AUTHORITY {
' UCHAR Value[6];
'} SID_IDENTIFIER_AUTHORITY, *PSID_IDENTIFIER_AUTHORITY;
'#endif
'#ifndef SID_DEFINED
'#define SID_DEFINED
'typedef struct _SID {
' UCHAR Revision;
' UCHAR SubAuthorityCount;
' SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
'#ifdef MIDL_PASS
' [size_is(SubAuthorityCount)] ULONG SubAuthority[*];
'#else // MIDL_PASS
' ULONG SubAuthority[ANYSIZE_ARRAY];
'#endif // MIDL_PASS
'} SID, *PISID;
'#endif
'#define SID_REVISION (1) // Current revision level
'#define SID_MAX_SUB_AUTHORITIES (15)
'#define SID_RECOMMENDED_SUB_AUTHORITIES (1) // Will change to around 6
' // in a future release.
'#ifndef MIDL_PASS
'#define SECURITY_MAX_SID_SIZE \
' (sizeof(SID) - sizeof(ULONG) + (SID_MAX_SUB_AUTHORITIES * sizeof(ULONG)))
'#endif // MIDL_PASS
'typedef enum _SID_NAME_USE {
' SidTypeUser = 1,
' SidTypeGroup,
' SidTypeDomain,
' SidTypeAlias,
' SidTypeWellKnownGroup,
' SidTypeDeletedAccount,
' SidTypeInvalid,
' SidTypeUnknown,
' SidTypeComputer,
' SidTypeLabel
'} SID_NAME_USE, *PSID_NAME_USE;
'typedef struct _SID_AND_ATTRIBUTES {
'#ifdef MIDL_PASS
' PISID Sid;
'#else // MIDL_PASS
' PSID Sid;
'#endif // MIDL_PASS
' ULONG Attributes;
' } SID_AND_ATTRIBUTES, * PSID_AND_ATTRIBUTES;
'typedef SID_AND_ATTRIBUTES SID_AND_ATTRIBUTES_ARRAY[ANYSIZE_ARRAY];
'typedef SID_AND_ATTRIBUTES_ARRAY *PSID_AND_ATTRIBUTES_ARRAY;
'#define SID_HASH_SIZE 32
'typedef ULONG_PTR SID_HASH_ENTRY, *PSID_HASH_ENTRY;
'typedef struct _SID_AND_ATTRIBUTES_HASH {
' ULONG SidCount;
' PSID_AND_ATTRIBUTES SidAttr;
' SID_HASH_ENTRY Hash[SID_HASH_SIZE];
'} SID_AND_ATTRIBUTES_HASH, *PSID_AND_ATTRIBUTES_HASH;
'/////////////////////////////////////////////////////////////////////////////
'// //
'// Universal well-known SIDs //
'// //
'// Null SID S-1-0-0 //
'// World S-1-1-0 //
'// Local S-1-2-0 //
'// Creator Owner ID S-1-3-0 //
'// Creator Group ID S-1-3-1 //
'// Creator Owner Server ID S-1-3-2 //
'// Creator Group Server ID S-1-3-3 //
'// //
'// (Non-unique IDs) S-1-4 //
'// //
'/////////////////////////////////////////////////////////////////////////////
'#define SECURITY_NULL_SID_AUTHORITY {0,0,0,0,0,0}
'#define SECURITY_WORLD_SID_AUTHORITY {0,0,0,0,0,1}
'#define SECURITY_LOCAL_SID_AUTHORITY {0,0,0,0,0,2}
'#define SECURITY_CREATOR_SID_AUTHORITY {0,0,0,0,0,3}
'#define SECURITY_NON_UNIQUE_AUTHORITY {0,0,0,0,0,4}
'#define SECURITY_RESOURCE_MANAGER_AUTHORITY {0,0,0,0,0,9}
'#define SECURITY_NULL_RID (0x00000000L)
'#define SECURITY_WORLD_RID (0x00000000L)
'#define SECURITY_LOCAL_RID (0x00000000L)
'#define SECURITY_LOCAL_LOGON_RID (0x00000001L)
'#define SECURITY_CREATOR_OWNER_RID (0x00000000L)
'#define SECURITY_CREATOR_GROUP_RID (0x00000001L)
'#define SECURITY_CREATOR_OWNER_SERVER_RID (0x00000002L)
'#define SECURITY_CREATOR_GROUP_SERVER_RID (0x00000003L)
'#define SECURITY_CREATOR_OWNER_RIGHTS_RID (0x00000004L)
'///////////////////////////////////////////////////////////////////////////////
'// //
'// NT well-known SIDs //
'// //
'// NT Authority S-1-5 //
'// Dialup S-1-5-1 //
'// //
'// Network S-1-5-2 //
'// Batch S-1-5-3 //
'// Interactive S-1-5-4 //
'// (Logon IDs) S-1-5-5-X-Y //
'// Service S-1-5-6 //
'// AnonymousLogon S-1-5-7 (aka null logon session) //
'// Proxy S-1-5-8 //
'// Enterprise DC (EDC) S-1-5-9 (aka domain controller account) //
'// Self S-1-5-10 (self RID) //
'// Authenticated User S-1-5-11 (Authenticated user somewhere) //
'// Restricted Code S-1-5-12 (Running restricted code) //
'// Terminal Server S-1-5-13 (Running on Terminal Server) //
'// Remote Logon S-1-5-14 (Remote Interactive Logon) //
'// This Organization S-1-5-15 //
'// //
'// IUser S-1-5-17
'// Local System S-1-5-18 //
'// Local Service S-1-5-19 //
'// Network Service S-1-5-20 //
'// //
'// (NT non-unique IDs) S-1-5-0x15-... (NT Domain Sids) //
'// //
'// (Built-in domain) S-1-5-0x20 //
'// //
'// (Security Package IDs) S-1-5-0x40 //
'// NTLM Authentication S-1-5-0x40-10 //
'// SChannel Authentication S-1-5-0x40-14 //
'// Digest Authentication S-1-5-0x40-21 //
'// //
'// Other Organization S-1-5-1000 (>=1000 can not be filtered) //
'// //
'// //
'// NOTE: the relative identifier values (RIDs) determine which security //
'// boundaries the SID is allowed to cross. Before adding new RIDs, //
'// a determination needs to be made regarding which range they should //
'// be added to in order to ensure proper "SID filtering" //
'// //
'///////////////////////////////////////////////////////////////////////////////
'#define SECURITY_NT_AUTHORITY {0,0,0,0,0,5} // ntifs
'#define SECURITY_DIALUP_RID (0x00000001L)
'#define SECURITY_NETWORK_RID (0x00000002L)
'#define SECURITY_BATCH_RID (0x00000003L)
'#define SECURITY_INTERACTIVE_RID (0x00000004L)
'#define SECURITY_LOGON_IDS_RID (0x00000005L)
'#define SECURITY_LOGON_IDS_RID_COUNT (3L)
'#define SECURITY_SERVICE_RID (0x00000006L)
'#define SECURITY_ANONYMOUS_LOGON_RID (0x00000007L)
'#define SECURITY_PROXY_RID (0x00000008L)
'#define SECURITY_ENTERPRISE_CONTROLLERS_RID (0x00000009L)
'#define SECURITY_SERVER_LOGON_RID SECURITY_ENTERPRISE_CONTROLLERS_RID
'#define SECURITY_PRINCIPAL_SELF_RID (0x0000000AL)
'#define SECURITY_AUTHENTICATED_USER_RID (0x0000000BL)
'#define SECURITY_RESTRICTED_CODE_RID (0x0000000CL)
'#define SECURITY_TERMINAL_SERVER_RID (0x0000000DL)
'#define SECURITY_REMOTE_LOGON_RID (0x0000000EL)
'#define SECURITY_THIS_ORGANIZATION_RID (0x0000000FL)
'#define SECURITY_IUSER_RID (0x00000011L)
'#define SECURITY_LOCAL_SYSTEM_RID (0x00000012L)
'#define SECURITY_LOCAL_SERVICE_RID (0x00000013L)
'#define SECURITY_NETWORK_SERVICE_RID (0x00000014L)
'#define SECURITY_NT_NON_UNIQUE (0x00000015L)
'#define SECURITY_NT_NON_UNIQUE_SUB_AUTH_COUNT (3L)
'#define SECURITY_ENTERPRISE_READONLY_CONTROLLERS_RID (0x00000016L)
'#define SECURITY_BUILTIN_DOMAIN_RID (0x00000020L)
'#define SECURITY_WRITE_RESTRICTED_CODE_RID (0x00000021L)
'#define SECURITY_PACKAGE_BASE_RID (0x00000040L)
'#define SECURITY_PACKAGE_RID_COUNT (2L)
'#define SECURITY_PACKAGE_NTLM_RID (0x0000000AL)
'#define SECURITY_PACKAGE_SCHANNEL_RID (0x0000000EL)
'#define SECURITY_PACKAGE_DIGEST_RID (0x00000015L)
'#define SECURITY_CRED_TYPE_BASE_RID (0x00000041L)
'#define SECURITY_CRED_TYPE_RID_COUNT (2L)
'#define SECURITY_CRED_TYPE_THIS_ORG_CERT_RID (0x00000001L)
'#define SECURITY_MIN_BASE_RID (0x00000050L)
'#define SECURITY_SERVICE_ID_BASE_RID (0x00000050L)
'#define SECURITY_SERVICE_ID_RID_COUNT (6L)
'#define SECURITY_RESERVED_ID_BASE_RID (0x00000051L)
'#define SECURITY_APPPOOL_ID_BASE_RID (0x00000052L)
'#define SECURITY_APPPOOL_ID_RID_COUNT (6L)
'#define SECURITY_VIRTUALSERVER_ID_BASE_RID (0x00000053L)
'#define SECURITY_VIRTUALSERVER_ID_RID_COUNT (6L)
'#define SECURITY_USERMODEDRIVERHOST_ID_BASE_RID (0x00000054L)
'#define SECURITY_USERMODEDRIVERHOST_ID_RID_COUNT (6L)
'#define SECURITY_CLOUD_INFRASTRUCTURE_SERVICES_ID_BASE_RID (0x00000055L)
'#define SECURITY_CLOUD_INFRASTRUCTURE_SERVICES_ID_RID_COUNT (6L)
'#define SECURITY_WMIHOST_ID_BASE_RID (0x00000056L)
'#define SECURITY_WMIHOST_ID_RID_COUNT (6L)
'#define SECURITY_TASK_ID_BASE_RID (0x00000057L)
'#define SECURITY_NFS_ID_BASE_RID (0x00000058L)
'#define SECURITY_COM_ID_BASE_RID (0x00000059L)
'#define SECURITY_VIRTUALACCOUNT_ID_RID_COUNT (6L)
'#define SECURITY_MAX_BASE_RID (0x0000006FL)
'#define SECURITY_MAX_ALWAYS_FILTERED (0x000003E7L)
'#define SECURITY_MIN_NEVER_FILTERED (0x000003E8L)
'#define SECURITY_OTHER_ORGANIZATION_RID (0x000003E8L)
'//
'//Service SID type RIDs are in the range 0x50- 0x6F. Therefore, we are giving the next available RID to Windows Mobile team.
'//
'#define SECURITY_WINDOWSMOBILE_ID_BASE_RID (0x00000070L)
'/////////////////////////////////////////////////////////////////////////////
'// //
'// well-known domain relative sub-authority values (RIDs)... //
'// //
'/////////////////////////////////////////////////////////////////////////////
'#define DOMAIN_GROUP_RID_ENTERPRISE_READONLY_DOMAIN_CONTROLLERS (0x000001F2L)
'#define FOREST_USER_RID_MAX (0x000001F3L)
'// Well-known users ...
'#define DOMAIN_USER_RID_ADMIN (0x000001F4L)
'#define DOMAIN_USER_RID_GUEST (0x000001F5L)
'#define DOMAIN_USER_RID_KRBTGT (0x000001F6L)
'#define DOMAIN_USER_RID_MAX (0x000003E7L)
'// well-known groups ...
'#define DOMAIN_GROUP_RID_ADMINS (0x00000200L)
'#define DOMAIN_GROUP_RID_USERS (0x00000201L)
'#define DOMAIN_GROUP_RID_GUESTS (0x00000202L)
'#define DOMAIN_GROUP_RID_COMPUTERS (0x00000203L)
'#define DOMAIN_GROUP_RID_CONTROLLERS (0x00000204L)
'#define DOMAIN_GROUP_RID_CERT_ADMINS (0x00000205L)
'#define DOMAIN_GROUP_RID_SCHEMA_ADMINS (0x00000206L)
'#define DOMAIN_GROUP_RID_ENTERPRISE_ADMINS (0x00000207L)
'#define DOMAIN_GROUP_RID_POLICY_ADMINS (0x00000208L)
'#define DOMAIN_GROUP_RID_READONLY_CONTROLLERS (0x00000209L)
'// well-known aliases ...
'#define DOMAIN_ALIAS_RID_ADMINS (0x00000220L)
'#define DOMAIN_ALIAS_RID_USERS (0x00000221L)
'#define DOMAIN_ALIAS_RID_GUESTS (0x00000222L)
'#define DOMAIN_ALIAS_RID_POWER_USERS (0x00000223L)
'#define DOMAIN_ALIAS_RID_ACCOUNT_OPS (0x00000224L)
'#define DOMAIN_ALIAS_RID_SYSTEM_OPS (0x00000225L)
'#define DOMAIN_ALIAS_RID_PRINT_OPS (0x00000226L)
'#define DOMAIN_ALIAS_RID_BACKUP_OPS (0x00000227L)
'#define DOMAIN_ALIAS_RID_REPLICATOR (0x00000228L)
'#define DOMAIN_ALIAS_RID_RAS_SERVERS (0x00000229L)
'#define DOMAIN_ALIAS_RID_PREW2KCOMPACCESS (0x0000022AL)
'#define DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS (0x0000022BL)
'#define DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS (0x0000022CL)
'#define DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS (0x0000022DL)
'#define DOMAIN_ALIAS_RID_MONITORING_USERS (0x0000022EL)
'#define DOMAIN_ALIAS_RID_LOGGING_USERS (0x0000022FL)
'#define DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS (0x00000230L)
'#define DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS (0x00000231L)
'#define DOMAIN_ALIAS_RID_DCOM_USERS (0x00000232L)
'#define DOMAIN_ALIAS_RID_IUSERS (0x00000238L)
'#define DOMAIN_ALIAS_RID_CRYPTO_OPERATORS (0x00000239L)
'#define DOMAIN_ALIAS_RID_CACHEABLE_PRINCIPALS_GROUP (0x0000023BL)
'#define DOMAIN_ALIAS_RID_NON_CACHEABLE_PRINCIPALS_GROUP (0x0000023CL)
'#define DOMAIN_ALIAS_RID_EVENT_LOG_READERS_GROUP (0x0000023DL)
'#define DOMAIN_ALIAS_RID_CERTSVC_DCOM_ACCESS_GROUP (0x0000023EL)
'#define SECURITY_MANDATORY_LABEL_AUTHORITY {0,0,0,0,0,16}
'#define SECURITY_MANDATORY_UNTRUSTED_RID (0x00000000L)
'#define SECURITY_MANDATORY_LOW_RID (0x00001000L)
'#define SECURITY_MANDATORY_MEDIUM_RID (0x00002000L)
'#define SECURITY_MANDATORY_MEDIUM_PLUS_RID (SECURITY_MANDATORY_MEDIUM_RID + 0x100)
'#define SECURITY_MANDATORY_HIGH_RID (0x00003000L)
'#define SECURITY_MANDATORY_SYSTEM_RID (0x00004000L)
'#define SECURITY_MANDATORY_PROTECTED_PROCESS_RID (0x00005000L)
'//
'// SECURITY_MANDATORY_MAXIMUM_USER_RID is the highest RID that
'// can be set by a usermode caller.
'//
'#define SECURITY_MANDATORY_MAXIMUM_USER_RID SECURITY_MANDATORY_SYSTEM_RID
'#define MANDATORY_LEVEL_TO_MANDATORY_RID(IL) (IL * 0x1000)
'//
'// Allocate the System Luid. The first 1000 LUIDs are reserved.
'// Use #999 here (0x3e7 = 999)
'//
'#define SYSTEM_LUID { 0x3e7, 0x0 }
'#define ANONYMOUS_LOGON_LUID { 0x3e6, 0x0 }
'#define LOCALSERVICE_LUID { 0x3e5, 0x0 }
'#define NETWORKSERVICE_LUID { 0x3e4, 0x0 }
'#define IUSER_LUID { 0x3e3, 0x0 }
'//
'// The structure of an ACE is a common ace header followed by ace type
'// specific data. Pictorally the structure of the common ace header is
'// as follows:
'//
'// 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
'// 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
'// +---------------+-------+-------+---------------+---------------+
'// | AceSize | AceFlags | AceType |
'// +---------------+-------+-------+---------------+---------------+
'//
'// AceType denotes the type of the ace, there are some predefined ace
'// types
'//
'// AceSize is the size, in bytes, of ace.
'//
'// AceFlags are the Ace flags for audit and inheritance, defined shortly.
'typedef struct _ACE_HEADER {
' UCHAR AceType;
' UCHAR AceFlags;
' USHORT AceSize;
'} ACE_HEADER;
'typedef ACE_HEADER *PACE_HEADER;
'//
'// The following are the predefined ace types that go into the AceType
'// field of an Ace header.
'//
'#define ACCESS_MIN_MS_ACE_TYPE (0x0)
'#define ACCESS_ALLOWED_ACE_TYPE (0x0)
'#define ACCESS_DENIED_ACE_TYPE (0x1)
'#define SYSTEM_AUDIT_ACE_TYPE (0x2)
'#define SYSTEM_ALARM_ACE_TYPE (0x3)
'#define ACCESS_MAX_MS_V2_ACE_TYPE (0x3)
'#define ACCESS_ALLOWED_COMPOUND_ACE_TYPE (0x4)
'#define ACCESS_MAX_MS_V3_ACE_TYPE (0x4)
'#define ACCESS_MIN_MS_OBJECT_ACE_TYPE (0x5)
'#define ACCESS_ALLOWED_OBJECT_ACE_TYPE (0x5)
'#define ACCESS_DENIED_OBJECT_ACE_TYPE (0x6)
'#define SYSTEM_AUDIT_OBJECT_ACE_TYPE (0x7)
'#define SYSTEM_ALARM_OBJECT_ACE_TYPE (0x8)
'#define ACCESS_MAX_MS_OBJECT_ACE_TYPE (0x8)
'#define ACCESS_MAX_MS_V4_ACE_TYPE (0x8)
'#define ACCESS_MAX_MS_ACE_TYPE (0x8)
'#define ACCESS_ALLOWED_CALLBACK_ACE_TYPE (0x9)
'#define ACCESS_DENIED_CALLBACK_ACE_TYPE (0xA)
'#define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE (0xB)
'#define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE (0xC)
'#define SYSTEM_AUDIT_CALLBACK_ACE_TYPE (0xD)
'#define SYSTEM_ALARM_CALLBACK_ACE_TYPE (0xE)
'#define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE (0xF)
'#define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE (0x10)
'#define SYSTEM_MANDATORY_LABEL_ACE_TYPE (0x11)
'#define ACCESS_MAX_MS_V5_ACE_TYPE (0x11)
'// end_winnt
'// begin_winnt
'//
'// The following are the inherit flags that go into the AceFlags field
'// of an Ace header.
'//
'#define OBJECT_INHERIT_ACE (0x1)
'#define CONTAINER_INHERIT_ACE (0x2)
'#define NO_PROPAGATE_INHERIT_ACE (0x4)
'#define INHERIT_ONLY_ACE (0x8)
'#define INHERITED_ACE (0x10)
'#define VALID_INHERIT_FLAGS (0x1F)
'// The following are the currently defined ACE flags that go into the
'// AceFlags field of an ACE header. Each ACE type has its own set of
'// AceFlags.
'//
'// SUCCESSFUL_ACCESS_ACE_FLAG - used only with system audit and alarm ACE
'// types to indicate that a message is generated for successful accesses.
'//
'// FAILED_ACCESS_ACE_FLAG - used only with system audit and alarm ACE types
'// to indicate that a message is generated for failed accesses.
'//
'//
'// SYSTEM_AUDIT and SYSTEM_ALARM AceFlags
'//
'// These control the signaling of audit and alarms for success or failure.
'//
'#define SUCCESSFUL_ACCESS_ACE_FLAG (0x40)
'#define FAILED_ACCESS_ACE_FLAG (0x80)
'//
'// We'll define the structure of the predefined ACE types. Pictorally
'// the structure of the predefined ACE's is as follows:
'//
'// 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
'// 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
'// +---------------+-------+-------+---------------+---------------+
'// | AceFlags | Resd |Inherit| AceSize | AceType |
'// +---------------+-------+-------+---------------+---------------+
'// | Mask |
'// +---------------------------------------------------------------+
'// | |
'// + +
'// | |
'// + Sid +
'// | |
'// + +
'// | |
'// +---------------------------------------------------------------+
'//
'// Mask is the access mask associated with the ACE. This is either the
'// access allowed, access denied, audit, or alarm mask.
'//
'// Sid is the Sid associated with the ACE.
'//
'// The following are the four predefined ACE types.
'// Examine the AceType field in the Header to determine
'// which structure is appropriate to use for casting.
'typedef struct _ACCESS_ALLOWED_ACE {
' ACE_HEADER Header;
' ACCESS_MASK Mask;
' ULONG SidStart;
'} ACCESS_ALLOWED_ACE;
'typedef ACCESS_ALLOWED_ACE *PACCESS_ALLOWED_ACE;
'typedef struct _ACCESS_DENIED_ACE {
' ACE_HEADER Header;
' ACCESS_MASK Mask;
' ULONG SidStart;
'} ACCESS_DENIED_ACE;
'typedef ACCESS_DENIED_ACE *PACCESS_DENIED_ACE;
'typedef struct _SYSTEM_AUDIT_ACE {
' ACE_HEADER Header;
' ACCESS_MASK Mask;
' ULONG SidStart;
'} SYSTEM_AUDIT_ACE;
'typedef SYSTEM_AUDIT_ACE *PSYSTEM_AUDIT_ACE;
'typedef struct _SYSTEM_ALARM_ACE {
' ACE_HEADER Header;
' ACCESS_MASK Mask;
' ULONG SidStart;
'} SYSTEM_ALARM_ACE;
'typedef SYSTEM_ALARM_ACE *PSYSTEM_ALARM_ACE;
'typedef struct _SYSTEM_MANDATORY_LABEL_ACE {
' ACE_HEADER Header;
' ACCESS_MASK Mask;
' ULONG SidStart;
'} SYSTEM_MANDATORY_LABEL_ACE, *PSYSTEM_MANDATORY_LABEL_ACE;
'#define SYSTEM_MANDATORY_LABEL_NO_WRITE_UP 0x1
'#define SYSTEM_MANDATORY_LABEL_NO_READ_UP 0x2
'#define SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP 0x4
'#define SYSTEM_MANDATORY_LABEL_VALID_MASK (SYSTEM_MANDATORY_LABEL_NO_WRITE_UP | \
' SYSTEM_MANDATORY_LABEL_NO_READ_UP | \
' SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP)
'#define SECURITY_DESCRIPTOR_MIN_LENGTH (sizeof(SECURITY_DESCRIPTOR))
'typedef USHORT SECURITY_DESCRIPTOR_CONTROL, *PSECURITY_DESCRIPTOR_CONTROL;
'#define SE_OWNER_DEFAULTED (0x0001)
'#define SE_GROUP_DEFAULTED (0x0002)
'#define SE_DACL_PRESENT (0x0004)
'#define SE_DACL_DEFAULTED (0x0008)
'#define SE_SACL_PRESENT (0x0010)
'#define SE_SACL_DEFAULTED (0x0020)
'// end_winnt
%EQUATE `SE_DACL_UNTRUSTED = &H0040
%EQUATE `SE_SERVER_SECURITY = &H0080
'// begin_winnt
'#define SE_DACL_AUTO_INHERIT_REQ (0x0100)
'#define SE_SACL_AUTO_INHERIT_REQ (0x0200)
'#define SE_DACL_AUTO_INHERITED (0x0400)
'#define SE_SACL_AUTO_INHERITED (0x0800)
'#define SE_DACL_PROTECTED (0x1000)
'#define SE_SACL_PROTECTED (0x2000)
'#define SE_RM_CONTROL_VALID (0x4000)
'#define SE_SELF_RELATIVE (0x8000)
'//
'// Where:
'//
'// SE_OWNER_DEFAULTED - This boolean flag, when set, indicates that the
'// SID pointed to by the Owner field was provided by a
'// defaulting mechanism rather than explicitly provided by the
'// original provider of the security descriptor. This may
'// affect the treatment of the SID with respect to inheritence
'// of an owner.
'//
'// SE_GROUP_DEFAULTED - This boolean flag, when set, indicates that the
'// SID in the Group field was provided by a defaulting mechanism
'// rather than explicitly provided by the original provider of
'// the security descriptor. This may affect the treatment of
'// the SID with respect to inheritence of a primary group.
'//
'// SE_DACL_PRESENT - This boolean flag, when set, indicates that the
'// security descriptor contains a discretionary ACL. If this
'// flag is set and the Dacl field of the SECURITY_DESCRIPTOR is
'// null, then a null ACL is explicitly being specified.
'//
'// SE_DACL_DEFAULTED - This boolean flag, when set, indicates that the
'// ACL pointed to by the Dacl field was provided by a defaulting
'// mechanism rather than explicitly provided by the original
'// provider of the security descriptor. This may affect the
'// treatment of the ACL with respect to inheritence of an ACL.
'// This flag is ignored if the DaclPresent flag is not set.
'//
'// SE_SACL_PRESENT - This boolean flag, when set, indicates that the
'// security descriptor contains a system ACL pointed to by the
'// Sacl field. If this flag is set and the Sacl field of the
'// SECURITY_DESCRIPTOR is null, then an empty (but present)
'// ACL is being specified.
'//
'// SE_SACL_DEFAULTED - This boolean flag, when set, indicates that the
'// ACL pointed to by the Sacl field was provided by a defaulting
'// mechanism rather than explicitly provided by the original
'// provider of the security descriptor. This may affect the
'// treatment of the ACL with respect to inheritence of an ACL.
'// This flag is ignored if the SaclPresent flag is not set.
'//
'// end_winnt
'// SE_DACL_TRUSTED - This boolean flag, when set, indicates that the
'// ACL pointed to by the Dacl field was provided by a trusted source
'// and does not require any editing of compound ACEs. If this flag
'// is not set and a compound ACE is encountered, the system will
'// substitute known valid SIDs for the server SIDs in the ACEs.
'//
'// SE_SERVER_SECURITY - This boolean flag, when set, indicates that the
'// caller wishes the system to create a Server ACL based on the
'// input ACL, regardess of its source (explicit or defaulting.
'// This is done by replacing all of the GRANT ACEs with compound
'// ACEs granting the current server. This flag is only
'// meaningful if the subject is impersonating.
'//
'// begin_winnt
'// SE_SELF_RELATIVE - This boolean flag, when set, indicates that the
'// security descriptor is in self-relative form. In this form,
'// all fields of the security descriptor are contiguous in memory
'// and all pointer fields are expressed as offsets from the
'// beginning of the security descriptor. This form is useful
'// for treating security descriptors as opaque data structures
'// for transmission in communication protocol or for storage on
'// secondary media.
'//
'//
'//
'// Pictorially the structure of a security descriptor is as follows:
'//
'// 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
'// 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
'// +---------------------------------------------------------------+
'// | Control |Reserved1 (SBZ)| Revision |
'// +---------------------------------------------------------------+
'// | Owner |
'// +---------------------------------------------------------------+
'// | Group |
'// +---------------------------------------------------------------+
'// | Sacl |
'// +---------------------------------------------------------------+
'// | Dacl |
'// +---------------------------------------------------------------+
'//
'// In general, this data structure should be treated opaquely to ensure future
'// compatibility.
'//
'//
'typedef struct _SECURITY_DESCRIPTOR_RELATIVE {
' UCHAR Revision;
' UCHAR Sbz1;
' SECURITY_DESCRIPTOR_CONTROL Control;
' ULONG Owner;
' ULONG Group;
' ULONG Sacl;
' ULONG Dacl;
' } SECURITY_DESCRIPTOR_RELATIVE, *PISECURITY_DESCRIPTOR_RELATIVE;
'typedef struct _SECURITY_DESCRIPTOR {
' UCHAR Revision;
' UCHAR Sbz1;
' SECURITY_DESCRIPTOR_CONTROL Control;
' PSID Owner;
' PSID Group;
' PACL Sacl;
' PACL Dacl;
' } SECURITY_DESCRIPTOR, *PISECURITY_DESCRIPTOR;
'////////////////////////////////////////////////////////////////////////
'// //
'// Object Type list for AccessCheckByType //
'// //
'////////////////////////////////////////////////////////////////////////
'typedef struct _OBJECT_TYPE_LIST {
' USHORT Level;
' USHORT Sbz;
' GUID *ObjectType;
'} OBJECT_TYPE_LIST, *POBJECT_TYPE_LIST;
'//
'// DS values for Level
'//
'#define ACCESS_OBJECT_GUID 0
'#define ACCESS_PROPERTY_SET_GUID 1
'#define ACCESS_PROPERTY_GUID 2
'#define ACCESS_MAX_LEVEL 4
'//
'// Parameters to NtAccessCheckByTypeAndAditAlarm
'//
'typedef enum _AUDIT_EVENT_TYPE {
' AuditEventObjectAccess,
' AuditEventDirectoryServiceAccess
'} AUDIT_EVENT_TYPE, *PAUDIT_EVENT_TYPE;
'#define AUDIT_ALLOW_NO_PRIVILEGE 0x1
'//
'// DS values for Source and ObjectTypeName
'//
'#define ACCESS_DS_SOURCE_A "DS"
'#define ACCESS_DS_SOURCE_W L"DS"
'#define ACCESS_DS_OBJECT_TYPE_NAME_A "Directory Service Object"
'#define ACCESS_DS_OBJECT_TYPE_NAME_W L"Directory Service Object"
'////////////////////////////////////////////////////////////////////////
'// //
'// Privilege Related Data Structures //
'// //
'////////////////////////////////////////////////////////////////////////
'//
'// Values for different access granted\denied reasons:
'// AccessReasonAceN = AccessReasonAce + N.
'// AccessReasonPrivilegeN = AccessReasonPrivilege + N.
'//
'#define ACCESS_REASON_TYPE_MASK 0xffff0000
'#define ACCESS_REASON_DATA_MASK 0x0000ffff
'typedef enum _ACCESS_REASON_TYPE{
' AccessReasonNone = 0x00000000, // Indicate no reason for the bit. The bit may not be checked, or just no known reason.
' //
' // The lowest 2 bytes store the index of the ACE that grant/deny this bit.
' // If the corresponding access maskt is zero, then it is deny ACE; otherwise,
' // it is allow ACE.
' //
' AccessReasonAllowedAce = 0x00010000, // Granted a permission.
' AccessReasonDeniedAce = 0x00020000, // Denied a permission.
' AccessReasonAllowedParentAce = 0x00030000, // Granted a permission from parent ACE
' AccessReasonDeniedParentAce = 0x00040000, // Denied a permission from parent ACE
' AccessReasonMissingPrivilege = 0x00100000,
' AccessReasonFromPrivilege = 0x00200000,
' AccessReasonIntegrityLevel = 0x00300000,
' AccessReasonOwnership = 0x00400000,
' AccessReasonNullDacl = 0x00500000,
' AccessReasonEmptyDacl = 0x00600000,
' AccessReasonNoSD = 0x00700000,
' AccessReasonNoGrant = 0x00800000 // this access bit is not granted by any ACE.
'} ACCESS_REASON_TYPE;
'//
'// Structure to hold access denied\granted reason for every bit of ACCESS_MASK.
'// There are 32-bits in ACCESS_MASK and only 27-bits are actually valid on
'// return from AccessCheck because MAXIMUM_ALLOWED, GENERIC_READ,
'// GENERIC_WRITE, GENERIC_EXECUTE, and GENERIC_ALL are never returned.
'//
'// The content in Data fields depends on the Access Reason, for example,
'// if the reason is AccessReasonAce, the Data will be the ACE ID.
'// If there are more than one reason (more than one bit is set), the array size
'// of the Data is equal to the number of bits set (or number of reasons).
'// The Data could be null for a particular reason.
'//
'typedef ULONG ACCESS_REASON;
'typedef struct _ACCESS_REASONS{
' ACCESS_REASON Data[32];
'} ACCESS_REASONS, *PACCESS_REASONS;
'/*
'The following data structures are defined to consolidate various falvors of
'access check functions. In particular for Windows 7, the new access check
'function will enable security attribute check, plus returning the reason
'for a access check result.
'The new access check function based on these data structures will
'form the foundation to reimplement other flavors of access check
'functions.
'*/
'//
'// Structure to hold pointer to security descriptor and its unique id, which
'// can be used for caching access check results.
'// (NOTE NOTE) The cache key can be constructed by SecurityDescriptorId, Token and
'// PrincipalSelfSid. Watch how GenericMapping affects the cache results.
'//
'#define SE_SECURITY_DESCRIPTOR_FLAG_NO_OWNER_ACE 0x00000001
'#define SE_SECURITY_DESCRIPTOR_FLAG_NO_LABEL_ACE 0x00000002
'#define SE_SECURITY_DESCRIPTOR_VALID_FLAGS 0x00000003
'typedef struct _SE_SECURITY_DESCRIPTOR
'{
' ULONG Size;
' ULONG Flags;
' PSECURITY_DESCRIPTOR SecurityDescriptor;
'} SE_SECURITY_DESCRIPTOR, *PSE_SECURITY_DESCRIPTOR;
'typedef struct _SE_ACCESS_REQUEST
'{
' ULONG Size;
' PSE_SECURITY_DESCRIPTOR SeSecurityDescriptor;
' ACCESS_MASK DesiredAccess;
' ACCESS_MASK PreviouslyGrantedAccess;
' PSID PrincipalSelfSid; // Need to watch how this field affects the cache.
' PGENERIC_MAPPING GenericMapping;
' ULONG ObjectTypeListCount;
' POBJECT_TYPE_LIST ObjectTypeList;
'} SE_ACCESS_REQUEST, *PSE_ACCESS_REQUEST;
'typedef struct _SE_ACCESS_REPLY
'{
' ULONG Size;
' ULONG ResultListCount; // Indicate the array size of GrantedAccess and AccessStatus, it only can be either 1 or ObjectTypeListCount.
' PACCESS_MASK GrantedAccess;
' PNTSTATUS AccessStatus;
' PACCESS_REASONS AccessReason;
' PPRIVILEGE_SET* Privileges;
'} SE_ACCESS_REPLY, *PSE_ACCESS_REPLY;
'// end_winnt
' enum SE_AUDIT_OPERATION
%EQUATE `AuditPrivilegeObject = 0
%EQUATE `AuditPrivilegeService = 1
%EQUATE `AuditAccessCheck = 2
%EQUATE `AuditOpenObject = 3
%EQUATE `AuditOpenObjectWithTransaction = 4
%EQUATE `AuditCloseObject = 5
%EQUATE `AuditDeleteObject = 6
%EQUATE `AuditOpenObjectForDelete = 7
%EQUATE `AuditOpenObjectForDeleteWithTransaction = 8
%EQUATE `AuditCloseNonObject = 9
%EQUATE `AuditOpenNonObject = 10
%EQUATE `AuditObjectReference = 11
%EQUATE `AuditHandleCreation = 12
' // Size = 56 bytes
TYPE SE_AUDIT_INFO BYTE
 Size AS DWORD ' ULONG
 AuditType AS LONG ' AUDIT_EVENT_TYPE
 AuditOperation AS LONG ' SE_AUDIT_OPERATION
 AuditFlags AS DWORD ' ULONG
 SubsystemName AS UNICODE_STRING
 ObjectTypeName AS UNICODE_STRING
 ObjectName AS UNICODE_STRING
 HandleId AS DWORD
 TransactionId AS GUID PTR ' GUID*
 OperationId AS QUAD PTR ' LUID*
 ObjectCreation AS BYTE ' BOOLEAN
 GenerateOnClose AS BYTE ' BOOLEAN
 alignment__ AS WORD ' // To keep DWORD alignment
END TYPE
'////////////////////////////////////////////////////////////////////
'// //
'// Token Object Definitions //
'// //
'// //
'////////////////////////////////////////////////////////////////////
'//
'// Token Specific Access Rights.
'//
'#define TOKEN_ASSIGN_PRIMARY (0x0001)
'#define TOKEN_DUPLICATE (0x0002)
'#define TOKEN_IMPERSONATE (0x0004)
'#define TOKEN_QUERY (0x0008)
'#define TOKEN_QUERY_SOURCE (0x0010)
'#define TOKEN_ADJUST_PRIVILEGES (0x0020)
'#define TOKEN_ADJUST_GROUPS (0x0040)
'#define TOKEN_ADJUST_DEFAULT (0x0080)
'#define TOKEN_ADJUST_SESSIONID (0x0100)
'#define TOKEN_ALL_ACCESS_P (STANDARD_RIGHTS_REQUIRED |\
' TOKEN_ASSIGN_PRIMARY |\
' TOKEN_DUPLICATE |\
' TOKEN_IMPERSONATE |\
' TOKEN_QUERY |\
' TOKEN_QUERY_SOURCE |\
' TOKEN_ADJUST_PRIVILEGES |\
' TOKEN_ADJUST_GROUPS |\
' TOKEN_ADJUST_DEFAULT )
'#if ((defined(_WIN32_WINNT) && (_WIN32_WINNT > 0x0400)) || (!defined(_WIN32_WINNT)))
'#define TOKEN_ALL_ACCESS (TOKEN_ALL_ACCESS_P |\
' TOKEN_ADJUST_SESSIONID )
'#else
'#define TOKEN_ALL_ACCESS (TOKEN_ALL_ACCESS_P)
'#endif
'#define TOKEN_READ (STANDARD_RIGHTS_READ |\
' TOKEN_QUERY)
'#define TOKEN_WRITE (STANDARD_RIGHTS_WRITE |\
' TOKEN_ADJUST_PRIVILEGES |\
' TOKEN_ADJUST_GROUPS |\
' TOKEN_ADJUST_DEFAULT)
'#define TOKEN_EXECUTE (STANDARD_RIGHTS_EXECUTE)
'//
'//
'// Token Types
'//
'typedef enum _TOKEN_TYPE {
' TokenPrimary = 1,
' TokenImpersonation
' } TOKEN_TYPE;
'typedef TOKEN_TYPE *PTOKEN_TYPE;
'//
'// Token elevation values describe the relative strength of a given token.
'// A full token is a token with all groups and privileges to which the principal
'// is authorized. A limited token is one with some groups or privileges removed.
'//
'typedef enum _TOKEN_ELEVATION_TYPE {
' TokenElevationTypeDefault = 1,
' TokenElevationTypeFull,
' TokenElevationTypeLimited,
'} TOKEN_ELEVATION_TYPE, *PTOKEN_ELEVATION_TYPE;
'//
'// Token Information Classes.
'//
'typedef enum _TOKEN_INFORMATION_CLASS {
' TokenUser = 1,
' TokenGroups,
' TokenPrivileges,
' TokenOwner,
' TokenPrimaryGroup,
' TokenDefaultDacl,
' TokenSource,
' TokenType,
' TokenImpersonationLevel,
' TokenStatistics,
' TokenRestrictedSids,
' TokenSessionId,
' TokenGroupsAndPrivileges,
' TokenSessionReference,
' TokenSandBoxInert,
' TokenAuditPolicy,
' TokenOrigin,
' TokenElevationType,
' TokenLinkedToken,
' TokenElevation,
' TokenHasRestrictions,
' TokenAccessInformation,
' TokenVirtualizationAllowed,
' TokenVirtualizationEnabled,
' TokenIntegrityLevel,
' TokenUIAccess,
' TokenMandatoryPolicy,
' TokenLogonSid,
' MaxTokenInfoClass // MaxTokenInfoClass should always be the last enum
'} TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS;
'//
'// Token information class structures
'//
'typedef struct _TOKEN_USER {
' SID_AND_ATTRIBUTES User;
'} TOKEN_USER, *PTOKEN_USER;
'typedef struct _TOKEN_GROUPS {
' ULONG GroupCount;
'#ifdef MIDL_PASS
' [size_is(GroupCount)] SID_AND_ATTRIBUTES Groups[*];
'#else // MIDL_PASS
' SID_AND_ATTRIBUTES Groups[ANYSIZE_ARRAY];
'#endif // MIDL_PASS
'} TOKEN_GROUPS, *PTOKEN_GROUPS;
'typedef struct _TOKEN_PRIVILEGES {
' ULONG PrivilegeCount;
' LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY];
'} TOKEN_PRIVILEGES, *PTOKEN_PRIVILEGES;
'typedef struct _TOKEN_OWNER {
' PSID Owner;
'} TOKEN_OWNER, *PTOKEN_OWNER;
'typedef struct _TOKEN_PRIMARY_GROUP {
' PSID PrimaryGroup;
'} TOKEN_PRIMARY_GROUP, *PTOKEN_PRIMARY_GROUP;
'typedef struct _TOKEN_DEFAULT_DACL {
' PACL DefaultDacl;
'} TOKEN_DEFAULT_DACL, *PTOKEN_DEFAULT_DACL;
'typedef struct _TOKEN_GROUPS_AND_PRIVILEGES {
' ULONG SidCount;
' ULONG SidLength;
' PSID_AND_ATTRIBUTES Sids;
' ULONG RestrictedSidCount;
' ULONG RestrictedSidLength;
' PSID_AND_ATTRIBUTES RestrictedSids;
' ULONG PrivilegeCount;
' ULONG PrivilegeLength;
' PLUID_AND_ATTRIBUTES Privileges;
' LUID AuthenticationId;
'} TOKEN_GROUPS_AND_PRIVILEGES, *PTOKEN_GROUPS_AND_PRIVILEGES;
'typedef struct _TOKEN_LINKED_TOKEN {
' HANDLE LinkedToken;
'} TOKEN_LINKED_TOKEN, *PTOKEN_LINKED_TOKEN;
'typedef struct _TOKEN_ELEVATION {
' ULONG TokenIsElevated;
'} TOKEN_ELEVATION, *PTOKEN_ELEVATION;
'typedef struct _TOKEN_MANDATORY_LABEL {
' SID_AND_ATTRIBUTES Label;
'} TOKEN_MANDATORY_LABEL, *PTOKEN_MANDATORY_LABEL;
'#define TOKEN_MANDATORY_POLICY_OFF 0x0
'#define TOKEN_MANDATORY_POLICY_NO_WRITE_UP 0x1
'#define TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN 0x2
'#define TOKEN_MANDATORY_POLICY_VALID_MASK (TOKEN_MANDATORY_POLICY_NO_WRITE_UP | \
' TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN)
'typedef struct _TOKEN_MANDATORY_POLICY {
' ULONG Policy;
'} TOKEN_MANDATORY_POLICY, *PTOKEN_MANDATORY_POLICY;
'typedef struct _TOKEN_ACCESS_INFORMATION {
' PSID_AND_ATTRIBUTES_HASH SidHash;
' PSID_AND_ATTRIBUTES_HASH RestrictedSidHash;
' PTOKEN_PRIVILEGES Privileges;
' LUID AuthenticationId;
' TOKEN_TYPE TokenType;
' SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
' TOKEN_MANDATORY_POLICY MandatoryPolicy;
' ULONG Flags;
'} TOKEN_ACCESS_INFORMATION, *PTOKEN_ACCESS_INFORMATION;
'//
'// Valid bits for each TOKEN_AUDIT_POLICY policy mask field.
'//
'#define POLICY_AUDIT_SUBCATEGORY_COUNT (53)
'typedef struct _TOKEN_AUDIT_POLICY {
' UCHAR PerUserPolicy[((POLICY_AUDIT_SUBCATEGORY_COUNT) >> 1) + 1];
'} TOKEN_AUDIT_POLICY, *PTOKEN_AUDIT_POLICY;
'#define TOKEN_SOURCE_LENGTH 8
'typedef struct _TOKEN_SOURCE {
' CHAR SourceName[TOKEN_SOURCE_LENGTH];
' LUID SourceIdentifier;
'} TOKEN_SOURCE, *PTOKEN_SOURCE;
'typedef struct _TOKEN_STATISTICS {
' LUID TokenId;
' LUID AuthenticationId;
' LARGE_INTEGER ExpirationTime;
' TOKEN_TYPE TokenType;
' SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
' ULONG DynamicCharged;
' ULONG DynamicAvailable;
' ULONG GroupCount;
' ULONG PrivilegeCount;
' LUID ModifiedId;
'} TOKEN_STATISTICS, *PTOKEN_STATISTICS;
'typedef struct _TOKEN_CONTROL {
' LUID TokenId;
' LUID AuthenticationId;
' LUID ModifiedId;
' TOKEN_SOURCE TokenSource;
'} TOKEN_CONTROL, *PTOKEN_CONTROL;
'typedef struct _TOKEN_ORIGIN {
' LUID OriginatingLogonSession ;
'} TOKEN_ORIGIN, * PTOKEN_ORIGIN ;
'typedef enum _MANDATORY_LEVEL {
' MandatoryLevelUntrusted = 0,
' MandatoryLevelLow,
' MandatoryLevelMedium,
' MandatoryLevelHigh,
' MandatoryLevelSystem,
' MandatoryLevelSecureProcess,
' MandatoryLevelCount
'} MANDATORY_LEVEL, *PMANDATORY_LEVEL;
'// end_winnt
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtOpenThreadToken LIB "ntdll.dll" ALIAS "NtOpenThreadToken" ( BYVAL ThreadHandle AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYVAL OpenAsSelf AS BYTE , BYREF TokenHandle AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtOpenThreadTokenEx LIB "ntdll.dll" ALIAS "NtOpenThreadTokenEx" ( BYVAL ThreadHandle AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYVAL OpenAsSelf AS BYTE , BYVAL HandleAttributes AS QUAD , BYREF TokenHandle AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtOpenProcessToken LIB "ntdll.dll" ALIAS "NtOpenProcessToken" ( BYVAL ProcessHandle AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYREF TokenHandle AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtOpenProcessTokenEx LIB "ntdll.dll" ALIAS "NtOpenProcessTokenEx" ( BYVAL ProcessHandle AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYVAL HandleAttributes AS QUAD , BYREF TokenHandle AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtOpenJobObjectToken LIB "ntdll.dll" ALIAS "NtOpenJobObjectToken" ( BYVAL JobHandle AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYREF TokenHandle AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtDuplicateToken LIB "ntdll.dll" ALIAS "NtDuplicateToken" ( BYVAL ExistingTokenHandle AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYREF ObjectAttributes AS OBJECT_ATTRIBUTES , BYVAL EffectiveOnly AS BYTE , BYVAL TokenType AS LONG , BYREF NewTokenHandle AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtFilterToken LIB "ntdll.dll" ALIAS "NtFilterToken" ( BYVAL ExistingTokenHandle AS QUAD , BYVAL Flags AS QUAD , BYREF SidsToDisable AS TOKEN_GROUPS , BYREF PrivilegesToDelete AS TOKEN_PRIVILEGES , BYREF RestrictedSids AS TOKEN_GROUPS , BYREF NewTokenHandle AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtImpersonateAnonymousToken LIB "ntdll.dll" ALIAS "NtImpersonateAnonymousToken" ( BYVAL ThreadHandle AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtQueryInformationToken LIB "ntdll.dll" ALIAS "NtQueryInformationToken" ( BYVAL TokenHandle AS QUAD , BYVAL TokenInformationClass AS LONG , BYREF TokenInformation AS ANY , BYVAL TokenInformationLength AS QUAD , BYREF ReturnLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtSetInformationToken LIB "ntdll.dll" ALIAS "NtSetInformationToken" ( BYVAL TokenHandle AS QUAD , BYVAL TokenInformationClass AS LONG , BYREF TokenInformation AS ANY , BYVAL TokenInformationLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtAdjustPrivilegesToken LIB "ntdll.dll" ALIAS "NtAdjustPrivilegesToken" ( BYVAL TokenHandle AS QUAD , BYVAL DisableAllPrivileges AS BYTE , BYREF NewState AS TOKEN_PRIVILEGES , BYVAL BufferLength AS QUAD , BYREF PreviousState AS TOKEN_PRIVILEGES , BYREF ReturnLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtAdjustGroupsToken LIB "ntdll.dll" ALIAS "NtAdjustGroupsToken" ( BYVAL TokenHandle AS QUAD , BYVAL ResetToDefault AS BYTE , BYREF NewState AS TOKEN_GROUPS , BYVAL BufferLength AS QUAD , BYREF PreviousState AS TOKEN_GROUPS , BYREF ReturnLength AS QUAD ) AS LONG ' NTSTATUS
'#endif // NTDDI_VERSION >= NTDDI_WINXP
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtPrivilegeCheck LIB "ntdll.dll" ALIAS "NtPrivilegeCheck" ( BYVAL ClientToken AS QUAD , BYREF RequiredPrivileges AS PRIVILEGE_SET , BYREF Result AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtAccessCheckAndAuditAlarm LIB "ntdll.dll" ALIAS "NtAccessCheckAndAuditAlarm" ( BYREF SubsystemName AS UNICODE_STRING , BYVAL HandleId AS QUAD , BYREF ObjectTypeName AS UNICODE_STRING , BYREF ObjectName AS UNICODE_STRING , BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR , BYVAL DesiredAccess AS ACCESS_MASK , BYREF GenericMapping AS GENERIC_MAPPING , BYVAL ObjectCreation AS BYTE , BYREF GrantedAccess AS ACCESS_MASK , BYREF AccessStatus AS LONG , BYREF GenerateOnClose AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtAccessCheckByTypeAndAuditAlarm LIB "ntdll.dll" ALIAS "NtAccessCheckByTypeAndAuditAlarm" ( BYREF SubsystemName AS UNICODE_STRING , BYVAL HandleId AS QUAD , BYREF ObjectTypeName AS UNICODE_STRING , BYREF ObjectName AS UNICODE_STRING , BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR , BYVAL PrincipalSelfSid AS SID PTR , BYVAL DesiredAccess AS ACCESS_MASK , BYVAL AuditType AS LONG , BYVAL Flags AS QUAD , BYREF ObjectTypeList AS OBJECT_TYPE_LIST , BYVAL ObjectTypeListLength AS QUAD , BYREF GenericMapping AS GENERIC_MAPPING , BYVAL ObjectCreation AS BYTE , BYREF GrantedAccess AS ACCESS_MASK , BYREF AccessStatus AS LONG , BYREF GenerateOnClose AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtAccessCheckByTypeResultListAndAuditAlarm LIB "ntdll.dll" ALIAS "NtAccessCheckByTypeResultListAndAuditAlarm" ( BYREF SubsystemName AS UNICODE_STRING , BYVAL HandleId AS QUAD , BYREF ObjectTypeName AS UNICODE_STRING , BYREF ObjectName AS UNICODE_STRING , BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR , BYVAL PrincipalSelfSid AS SID PTR , BYVAL DesiredAccess AS ACCESS_MASK , BYVAL AuditType AS LONG , BYVAL Flags AS QUAD , BYREF ObjectTypeList AS OBJECT_TYPE_LIST , BYVAL ObjectTypeListLength AS QUAD , BYVAL ObjectCreation AS BYTE , BYREF GrantedAccess AS ACCESS_MASK , BYREF AccessStatus AS LONG , BYREF GenerateOnClose AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtAccessCheckByTypeResultListAndAuditAlarmByHandle LIB "ntdll.dll" ALIAS "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" ( BYREF SubsystemName AS UNICODE_STRING , BYVAL HandleId AS QUAD , BYVAL ClientToken AS QUAD , BYREF ObjectTypeName AS UNICODE_STRING , BYREF ObjectName AS UNICODE_STRING , BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR , BYVAL PrincipalSelfSid AS SID PTR , BYVAL DesiredAccess AS ACCESS_MASK , BYVAL AuditType AS LONG , BYVAL Flags AS QUAD , BYREF ObjectTypeList AS OBJECT_TYPE_LIST , BYVAL ObjectTypeListLength AS QUAD , BYREF GenericMapping AS GENERIC_MAPPING , BYVAL ObjectCreation AS BYTE , BYREF GrantedAccess AS ACCESS_MASK , BYREF AccessStatus AS LONG , BYREF GenerateOnClose AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtOpenObjectAuditAlarm LIB "ntdll.dll" ALIAS "NtOpenObjectAuditAlarm" ( BYREF SubsystemName AS UNICODE_STRING , BYVAL HandleId AS QUAD , BYREF ObjectTypeName AS UNICODE_STRING , BYREF ObjectName AS UNICODE_STRING , BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR , BYVAL ClientToken AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYVAL GrantedAccess AS ACCESS_MASK , BYREF Privileges AS PRIVILEGE_SET , BYVAL ObjectCreation AS BYTE , BYVAL AccessGranted AS BYTE , BYREF GenerateOnClose AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtPrivilegeObjectAuditAlarm LIB "ntdll.dll" ALIAS "NtPrivilegeObjectAuditAlarm" ( BYREF SubsystemName AS UNICODE_STRING , BYVAL HandleId AS QUAD , BYVAL ClientToken AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYREF Privileges AS PRIVILEGE_SET , BYVAL AccessGranted AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtCloseObjectAuditAlarm LIB "ntdll.dll" ALIAS "NtCloseObjectAuditAlarm" ( BYREF SubsystemName AS UNICODE_STRING , BYVAL HandleId AS QUAD , BYVAL GenerateOnClose AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtDeleteObjectAuditAlarm LIB "ntdll.dll" ALIAS "NtDeleteObjectAuditAlarm" ( BYREF SubsystemName AS UNICODE_STRING , BYVAL HandleId AS QUAD , BYVAL GenerateOnClose AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtPrivilegedServiceAuditAlarm LIB "ntdll.dll" ALIAS "NtPrivilegedServiceAuditAlarm" ( BYREF SubsystemName AS UNICODE_STRING , BYREF ServiceName AS UNICODE_STRING , BYVAL ClientToken AS QUAD , BYREF Privileges AS PRIVILEGE_SET , BYVAL AccessGranted AS BYTE ) AS LONG ' NTSTATUS
'#endif
'typedef
'NTSTATUS
'NTAPI
'RTL_HEAP_COMMIT_ROUTINE(
' );
'typedef RTL_HEAP_COMMIT_ROUTINE *PRTL_HEAP_COMMIT_ROUTINE;
'FUNCTION RTL_HEAP_COMMIT_ROUTINE (
' BYVAL pBase AS DWORD
' , BYREF CommitAddress AS DWORD
' , BYREF CommitSize AS DWORD
' ) AS LONG ' NTSTATUS
DECLARE FUNCTION NtPrivilegedServiceAuditAlarm LIB "ntdll.dll" ALIAS "NtPrivilegedServiceAuditAlarm" ( BYREF SubsystemName AS UNICODE_STRING , BYREF ServiceName AS UNICODE_STRING , BYVAL ClientToken AS QUAD , BYREF Privileges AS PRIVILEGE_SET , BYVAL AccessGranted AS BYTE ) AS LONG ' NTSTATUS
' // Size = 48 bytes
TYPE RTL_HEAP_PARAMETERS DWORD
 Length AS DWORD ' ULONG
 SegmentReserve AS DWORD ' SIZE_T
 SegmentCommit AS DWORD ' SIZE_T
 DeCommitFreeBlockThreshold AS DWORD ' SIZE_T
 DeCommitTotalFreeThreshold AS DWORD ' SIZE_T
 MaximumAllocationSize AS DWORD ' SIZE_T
 VirtualMemoryThreshold AS DWORD ' SIZE_T
 InitialCommit AS DWORD ' SIZE_T
 InitialReserve AS DWORD ' SIZE_T
 CommitRoutine AS DWORD ' PRTL_HEAP_COMMIT_ROUTINE
 Reserved(1) AS DWORD ' SIZE_T 2]
END TYPE
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlCreateHeap LIB "ntdll.dll" ALIAS "RtlCreateHeap" ( BYVAL Flags AS QUAD , BYVAL HeapBase AS QUAD , BYVAL ReserveSize AS QUAD , BYVAL CommitSize AS QUAD , BYVAL Lock AS QUAD , BYREF Parameters AS RTL_HEAP_PARAMETERS ) AS QUAD
'#endif // NTDDI_VERSION >= NTDDI_WINXP
'#define HEAP_NO_SERIALIZE 0x00000001 // winnt
'#define HEAP_GROWABLE 0x00000002 // winnt
'#define HEAP_GENERATE_EXCEPTIONS 0x00000004 // winnt
'#define HEAP_ZERO_MEMORY 0x00000008 // winnt
'#define HEAP_REALLOC_IN_PLACE_ONLY 0x00000010 // winnt
'#define HEAP_TAIL_CHECKING_ENABLED 0x00000020 // winnt
'#define HEAP_FREE_CHECKING_ENABLED 0x00000040 // winnt
'#define HEAP_DISABLE_COALESCE_ON_FREE 0x00000080 // winnt
'#define HEAP_CREATE_ALIGN_16 0x00010000 // winnt Create heap with 16 byte alignment (obsolete)
'#define HEAP_CREATE_ENABLE_TRACING 0x00020000 // winnt Create heap call tracing enabled (obsolete)
%EQUATE `HEAP_CREATE_ENABLE_EXECUTE = &H00040000 ' // winnt Create heap with executable pages
%EQUATE `HEAP_SETTABLE_USER_VALUE = &H00000100
%EQUATE `HEAP_SETTABLE_USER_FLAG1 = &H00000200
%EQUATE `HEAP_SETTABLE_USER_FLAG2 = &H00000400
%EQUATE `HEAP_SETTABLE_USER_FLAG3 = &H00000800
%EQUATE `HEAP_SETTABLE_USER_FLAGS = &H00000E00
%EQUATE `HEAP_CLASS_0 = &H00000000 ' // process heap
%EQUATE `HEAP_CLASS_1 = &H00001000 ' // private heap
%EQUATE `HEAP_CLASS_2 = &H00002000 ' // Kernel Heap
%EQUATE `HEAP_CLASS_3 = &H00003000 ' // GDI heap
%EQUATE `HEAP_CLASS_4 = &H00004000 ' // User heap
%EQUATE `HEAP_CLASS_5 = &H00005000 ' // Console heap
%EQUATE `HEAP_CLASS_6 = &H00006000 ' // User Desktop heap
%EQUATE `HEAP_CLASS_7 = &H00007000 ' // Csrss Shared heap
%EQUATE `HEAP_CLASS_8 = &H00008000 ' // Csr Port heap
%EQUATE `HEAP_CLASS_MASK = &H0000F000
'#define HEAP_MAXIMUM_TAG 0x0FFF // winnt
%EQUATE `HEAP_GLOBAL_TAG = &H0800
'#define HEAP_PSEUDO_TAG_FLAG 0x8000 // winnt
'#define HEAP_TAG_SHIFT 18 // winnt
'#define HEAP_TAG_MASK (HEAP_MAXIMUM_TAG << HEAP_TAG_SHIFT)
%EQUATE `HEAP_TAG_MASK = &H3FFC000
%EQUATE `HEAP_CREATE_VALID_MASK = %HEAP_NO_SERIALIZE OR %HEAP_GROWABLE OR %HEAP_GENERATE_EXCEPTIONS OR %HEAP_ZERO_MEMORY OR %HEAP_REALLOC_IN_PLACE_ONLY OR %HEAP_TAIL_CHECKING_ENABLED OR %HEAP_FREE_CHECKING_ENABLED OR %HEAP_DISABLE_COALESCE_ON_FREE OR %HEAP_CLASS_MASK OR %HEAP_CREATE_ALIGN_16 OR %HEAP_CREATE_ENABLE_TRACING OR %HEAP_CREATE_ENABLE_EXECUTE
'// begin_winnt
'#if !defined(MIDL_PASS)
'FORCEINLINE
'ULONG
'HEAP_MAKE_TAG_FLAGS (
' )
'{
' return ((ULONG)((TagBase) + ((Tag) << HEAP_TAG_SHIFT)));
'}
'#endif
'// end_winnt
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlDestroyHeap LIB "ntdll.dll" ALIAS "RtlDestroyHeap" ( BYVAL HeapHandle AS QUAD ) AS QUAD
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlAllocateHeap LIB "ntdll.dll" ALIAS "RtlAllocateHeap" ( BYVAL HeapHandle AS QUAD , BYVAL Flags AS QUAD , BYVAL Size AS QUAD ) AS QUAD
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlFreeHeap LIB "ntdll.dll" ALIAS "RtlFreeHeap" ( BYVAL HeapHandle AS QUAD , BYVAL Flags AS QUAD , BYVAL BaseAddress AS QUAD ) AS LONG ' BOOLEAN
'#endif // NTDDI_VERSION >= NTDDI_WIN2K
'#if (NTDDI_VERSION > NTDDI_WINXP)
' // Already defined in WinNT.inc
'DECLARE FUNCTION RtlCaptureStackBackTrace LIB "ntdll.dll" ALIAS "RtlCaptureStackBackTrace" ( ' BYVAL FramesToSkip AS DWORD
' , BYVAL FramesToCapture AS DWORD
' , BYREF BackTrace AS ANY
' , OPTIONAL BYREF BackTraceHash AS DWORD
' ) AS WORD ' USHORT
'#endif
'#if (NTDDI_VERSION > NTDDI_WIN2K)
DECLARE SUB RtlCaptureContext LIB "ntdll.dll" ALIAS "RtlCaptureContext" ( BYREF ContextRecord AS CONTEXT )
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlRandom LIB "ntdll.dll" ALIAS "RtlRandom" ( BYREF Seed AS QUAD ) AS QUAD ' ULONG
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlRandomEx LIB "ntdll.dll" ALIAS "RtlRandomEx" ( BYREF Seed AS QUAD ) AS QUAD ' ULONG
'#endif // NTDDI_VERSION >= NTDDI_WINXP
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlInitUnicodeStringEx LIB "ntdll.dll" ALIAS "RtlInitUnicodeStringEx" ( BYREF DestinationString AS UNICODE_STRING , BYREF SourceString AS WSTRINGZ ) AS LONG ' NTSTATUS
'#endif // NTDDI_VERSION >= NTDDI_WINXP
'#if (NTDDI_VERSION >= NTDDI_WS03)
DECLARE FUNCTION RtlInitAnsiStringEx LIB "ntdll.dll" ALIAS "RtlInitAnsiStringEx" ( BYREF DestinationString AS ANSI_STRING , BYREF SourceString AS ASCIIZ ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlCreateUnicodeString LIB "ntdll.dll" ALIAS "RtlCreateUnicodeString" ( BYREF DestinationString AS UNICODE_STRING , BYREF SourceString AS WSTRINGZ ) AS BYTE ' BOOLEAN
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
' // Note: STRING is an alias for LSA_STRING
DECLARE FUNCTION RtlAppendStringToString LIB "ntdll.dll" ALIAS "RtlAppendStringToString" ( BYREF DestinationString AS LSA_STRING , BYREF Source AS LSA_STRING ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
' // Note: OEM_STRING is an alias for LSA_STRING
DECLARE FUNCTION RtlOemStringToUnicodeString LIB "ntdll.dll" ALIAS "RtlOemStringToUnicodeString" ( BYREF DestinationString AS UNICODE_STRING , BYREF SourceString AS LSA_STRING , BYVAL AllocateDestinationString AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
' // Note: OEM_STRING is an alias for LSA_STRING
DECLARE FUNCTION RtlUnicodeStringToOemString LIB "ntdll.dll" ALIAS "RtlUnicodeStringToOemString" ( BYREF DestinationString AS LSA_STRING , BYREF SourceString AS UNICODE_STRING , BYVAL AllocateDestinationString AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
' // Note: OEM_STRING is an alias for LSA_STRING
DECLARE FUNCTION RtlUpcaseUnicodeStringToOemString LIB "ntdll.dll" ALIAS "RtlUpcaseUnicodeStringToOemString" ( BYREF DestinationString AS LSA_STRING , BYREF SourceString AS UNICODE_STRING , BYVAL AllocateDestinationString AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
' // Note: OEM_STRING is an alias for LSA_STRING
DECLARE FUNCTION RtlOemStringToCountedUnicodeString LIB "ntdll.dll" ALIAS "RtlOemStringToCountedUnicodeString" ( BYREF DestinationString AS UNICODE_STRING , BYREF SourceString AS LSA_STRING , BYVAL AllocateDestinationString AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
' // Note: OEM_STRING is an alias for LSA_STRING
DECLARE FUNCTION RtlUnicodeStringToCountedOemString LIB "ntdll.dll" ALIAS "RtlUnicodeStringToCountedOemString" ( BYREF DestinationString AS LSA_STRING , BYREF SourceString AS UNICODE_STRING , BYVAL AllocateDestinationString AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
' // Note: OEM_STRING is an alias for LSA_STRING
DECLARE FUNCTION RtlUpcaseUnicodeStringToCountedOemString LIB "ntdll.dll" ALIAS "RtlUpcaseUnicodeStringToCountedOemString" ( BYREF DestinationString AS LSA_STRING , BYREF SourceString AS UNICODE_STRING , BYVAL AllocateDestinationString AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlValidateUnicodeString LIB "ntdll.dll" ALIAS "RtlValidateUnicodeString" ( BYVAL Flags AS QUAD , BYREF String AS UNICODE_STRING ) AS LONG ' NTSTATUS
'#endif // NTDDI_VERSION >= NTDDI_WINXP
%EQUATE `RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE = &H00000001
%EQUATE `RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING = &H00000002
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlDuplicateUnicodeString LIB "ntdll.dll" ALIAS "RtlDuplicateUnicodeString" ( BYVAL Flags AS QUAD , BYREF StringIn AS UNICODE_STRING , BYREF StringOut AS UNICODE_STRING ) AS LONG ' NTSTATUS
'#endif // NTDDI_VERSION >= NTDDI_WINXP
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlDowncaseUnicodeString LIB "ntdll.dll" ALIAS "RtlDowncaseUnicodeString" ( BYREF DestinationString AS UNICODE_STRING , BYREF SourceString AS UNICODE_STRING , BYVAL AllocateDestinationString AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
' // Note: OEM_STRING is an alias for LSA_STRING
DECLARE SUB RtlFreeOemString LIB "ntdll.dll" ALIAS "RtlFreeOemString" ( BYREF OemString AS LSA_STRING )
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlxUnicodeStringToOemSize LIB "ntdll.dll" ALIAS "RtlxUnicodeStringToOemSize" ( BYREF UnicodeString AS UNICODE_STRING ) AS QUAD ' ULONG
'#endif
'//
'// NTSYSAPI
'// ULONG
'// NTAPI
'// RtlUnicodeStringToOemSize(
'// PUNICODE_STRING UnicodeString
'// );
'//
'#define RtlUnicodeStringToOemSize(STRING) ( \
' NLS_MB_OEM_CODE_PAGE_TAG ? \
' RtlxUnicodeStringToOemSize(STRING) : \
' ((STRING)->Length + sizeof(UNICODE_NULL)) / sizeof(WCHAR) \
')
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
' // Note: OEM_STRING is an alias for LSA_STRING
DECLARE FUNCTION RtlxOemStringToUnicodeSize LIB "ntdll.dll" ALIAS "RtlxOemStringToUnicodeSize" ( BYREF OemString AS LSA_STRING ) AS QUAD ' ULONG
'#endif
'//
'// NTSYSAPI
'// ULONG
'// NTAPI
'// RtlOemStringToUnicodeSize(
'// POEM_STRING OemString
'// );
'//
'#define RtlOemStringToUnicodeSize(STRING) ( \
' NLS_MB_OEM_CODE_PAGE_TAG ? \
' RtlxOemStringToUnicodeSize(STRING) : \
' ((STRING)->Length + sizeof(ANSI_NULL)) * sizeof(WCHAR) \
')
'//
'// ULONG
'// RtlOemStringToCountedUnicodeSize(
'// POEM_STRING OemString
'// );
'//
'#define RtlOemStringToCountedUnicodeSize(STRING) ( \
' (ULONG)(RtlOemStringToUnicodeSize(STRING) - sizeof(UNICODE_NULL)) \
' )
MACRO RtlOemStringToCountedUnicodeSize(s) = RtlOemStringToUnicodeSize(s) - 2
'// Use Unicode if possible
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlMultiByteToUnicodeN LIB "ntdll.dll" ALIAS "RtlMultiByteToUnicodeN" ( BYREF UnicodeString AS WSTRINGZ , BYVAL MaxBytesInUnicodeString AS QUAD , BYREF BytesInUnicodeString AS QUAD , BYREF MultiByteString AS ASCIIZ , BYVAL BytesInMultiByteString AS QUAD ) AS LONG ' NTSTATUS
'#endif
'// Use Unicode if possible
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlMultiByteToUnicodeSize LIB "ntdll.dll" ALIAS "RtlMultiByteToUnicodeSize" ( BYREF BytesInUnicodeString AS QUAD , BYREF MultiByteString AS ASCIIZ , BYVAL BytesInMultiByteString AS QUAD ) AS LONG ' NTSTATUS
'#endif
'// Use Unicode if possible
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlUnicodeToMultiByteSize LIB "ntdll.dll" ALIAS "RtlUnicodeToMultiByteSize" ( BYREF BytesInMultiByteString AS QUAD , BYREF UnicodeString AS WSTRINGZ , BYVAL BytesInUnicodeString AS QUAD ) AS LONG ' NTSTATUS
'#endif
'// Use Unicode if possible
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlUnicodeToMultiByteN LIB "ntdll.dll" ALIAS "RtlUnicodeToMultiByteN" ( BYREF MultiByteString AS QUAD , BYVAL MaxBytesInMultiByteString AS QUAD , BYREF BytesInMultiByteString AS QUAD , BYREF UnicodeString AS WSTRINGZ , BYVAL BytesInUnicodeString AS QUAD ) AS LONG ' NTSTATUS
'#endif
'// UTF 8 conversion
'// begin_wdm
'#if (NTDDI_VERSION >= NTDDI_WIN7)
DECLARE FUNCTION RtlUnicodeToUTF8N LIB "ntdll.dll" ALIAS "RtlUnicodeToUTF8N" ( BYREF UTF8StringDestination AS ASCIIZ , BYVAL UTF8StringMaxByteCount AS QUAD , BYREF UTF8StringActualByteCount AS QUAD , BYREF UnicodeStringSource AS WSTRINGZ , BYVAL UnicodeStringByteCount AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
DECLARE FUNCTION RtlUTF8ToUnicodeN LIB "ntdll.dll" ALIAS "RtlUTF8ToUnicodeN" ( BYREF UnicodeStringDestination AS WSTRINGZ , BYVAL UnicodeStringMaxByteCount AS QUAD , BYREF UnicodeStringActualByteCount AS QUAD , BYREF UTF8StringSource AS ASCIIZ , BYVAL UTF8StringByteCount AS QUAD ) AS LONG ' NTSTATUS
'#endif
'// end_wdm
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlUpcaseUnicodeToMultiByteN LIB "ntdll.dll" ALIAS "RtlUpcaseUnicodeToMultiByteN" ( BYREF MultiByteString AS ASCIIZ , BYVAL MaxBytesInMultiByteString AS QUAD , BYREF BytesInMultiByteString AS QUAD , BYREF UnicodeString AS WSTRINGZ , BYVAL BytesInUnicodeString AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlOemToUnicodeN LIB "ntdll.dll" ALIAS "RtlOemToUnicodeN" ( BYREF UnicodeString AS WSTRINGZ , BYVAL MaxBytesInUnicodeString AS QUAD , BYREF BytesInUnicodeString AS QUAD , BYREF OemString AS ASCIIZ , BYVAL BytesInOemString AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlUnicodeToOemN LIB "ntdll.dll" ALIAS "RtlUnicodeToOemN" ( BYREF OemString AS ASCIIZ , BYVAL MaxBytesInOemString AS QUAD , BYREF BytesInOemString AS QUAD , BYREF UnicodeString AS WSTRINGZ , BYVAL BytesInUnicodeString AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlUpcaseUnicodeToOemN LIB "ntdll.dll" ALIAS "RtlUpcaseUnicodeToOemN" ( BYREF OemString AS ASCIIZ , BYVAL MaxBytesInOemString AS QUAD , BYREF BytesInOemString AS QUAD , BYREF UnicodeString AS WSTRINGZ , BYVAL BytesInUnicodeString AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
DECLARE FUNCTION RtlNormalizeString LIB "ntdll.dll" ALIAS "RtlNormalizeString" ( BYVAL NormForm AS QUAD , BYREF SourceString AS WSTRINGZ , BYVAL SourceStringLength AS LONG , BYREF DestinationString AS WSTRINGZ , BYREF DestinationStringLength AS LONG ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
DECLARE FUNCTION RtlIsNormalizedString LIB "ntdll.dll" ALIAS "RtlIsNormalizedString" ( BYVAL NormForm AS QUAD , BYREF SourceString AS WSTRINGZ , BYVAL SourceStringLength AS LONG , BYREF Normalized AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
DECLARE FUNCTION RtlIdnToAscii LIB "ntdll.dll" ALIAS "RtlIdnToAscii" ( BYVAL Flags AS QUAD , BYREF SourceString AS WSTRINGZ , BYVAL SourceStringLength AS LONG , BYREF DestinationString AS WSTRINGZ , BYREF DestinationStringLength AS LONG ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
DECLARE FUNCTION RtlIdnToUnicode LIB "ntdll.dll" ALIAS "RtlIdnToUnicode" ( BYVAL Flags AS QUAD , BYREF SourceString AS WSTRINGZ , BYVAL SourceStringLength AS LONG , BYREF DestinationString AS WSTRINGZ , BYREF DestinationStringLength AS LONG ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
DECLARE FUNCTION RtlIdnToNameprepUnicode LIB "ntdll.dll" ALIAS "RtlIdnToNameprepUnicode" ( BYVAL Flags AS QUAD , BYVAL SourceString AS QUAD , BYVAL SourceStringLength AS LONG , BYREF DestinationString AS WSTRINGZ , BYREF DestinationStringLength AS LONG ) AS LONG ' NTSTATUS
'#endif
'typedef
'NTAPI
'RTL_ALLOCATE_STRING_ROUTINE (
' );
'typedef RTL_ALLOCATE_STRING_ROUTINE *PRTL_ALLOCATE_STRING_ROUTINE;
'FUNCTION RTL_ALLOCATE_STRING_ROUTINE ( ' BYVAL NumberOfBytes AS DWORD
' ) AS DWORD
'#if _WIN32_WINNT >= 0x0600
'typedef
'NTAPI
'RTL_REALLOCATE_STRING_ROUTINE(
' );
'typedef RTL_REALLOCATE_STRING_ROUTINE *PRTL_REALLOCATE_STRING_ROUTINE;
'FUNCTION RTL_REALLOCATE_STRING_ROUTINE ( ' BYVAL NumberOfBytes AS DWORD
' , BYVAL Buffer AS DWORD
' ) AS DWORD
'#endif // _WIN32_WINNT >= 0x0600
'typedef
'NTAPI
'RTL_FREE_STRING_ROUTINE (
' );
'typedef RTL_FREE_STRING_ROUTINE *PRTL_FREE_STRING_ROUTINE;
'SUB RTL_FREE_STRING_ROUTINE ( ' BYVAL Buffer AS DWORD
' )
'extern const PRTL_ALLOCATE_STRING_ROUTINE RtlAllocateStringRoutine;
'extern const PRTL_FREE_STRING_ROUTINE RtlFreeStringRoutine;
'#if _WIN32_WINNT >= 0x0600
'extern const PRTL_REALLOCATE_STRING_ROUTINE RtlReallocateStringRoutine;
'#endif // _WIN32_WINNT >= 0x0600
'//
'// Defines and Routines for handling GUID's.
'//
'//
'// Routine for generating 8.3 names from long names.
'//
'//
'// The context structure is used when generating 8.3 names. The caller must
'// always zero out the structure before starting a new generation sequence
'//
' // Size = 36 bytes
TYPE GENERATE_NAME_CONTEXT BYTE
 ' // The structure is divided into two strings. The Name, and extension.
 ' // Each part contains the value that was last inserted in the name.
 ' // The length values are in terms of wchars and not bytes. We also
 ' // store the last index value used in the generation collision algorithm.
 Checksum AS WORD ' USHORT
 ChecksumInserted AS BYTE ' BOOLEAN
 NameLength AS BYTE
 NameBuffer AS WSTRINGZ * 8 ' WCHAR NameBuffer[8]; // e.g., "ntoskrnl"
 ExtensionLength AS DWORD
 ExtensionBuffer AS WSTRINGZ * 4 ' WCHAR ExtensionBuffer[4]; // e.g., ".exe"
 LastIndexValue AS DWORD ' ULONG
END TYPE
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'#if (NTDDI_VERSION >= NTDDI_VISTASP1)
'//
'// In Vista SP1 and beyond this routine now returns
'// STATUS_FILE_SYSTEM_LIMITATION if the system can not generate a unique
'// shortname for a given file. It returns this error after 1 million retry
'// attempts for a single given longname.
'//
'NTSYSAPI
'NTSTATUS
'NTAPI
'RtlGenerate8dot3Name (
' );
'#else // (NTDDI_VERSION < NTDDI_VISTASP1)
'NTSYSAPI
'NTAPI
'RtlGenerate8dot3Name (
' );
'#endif
'#endif // (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlGenerate8dot3Name LIB "ntdll.dll" ALIAS "RtlGenerate8dot3Name" ( BYREF Name AS UNICODE_STRING , BYVAL AllowExtendedCharacters AS BYTE , BYREF Context AS GENERATE_NAME_CONTEXT , BYREF Name8dot3 AS UNICODE_STRING ) AS LONG ' NTSTATUS
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
' Note: OEM_STRING is an alias for LSA_STRING
DECLARE FUNCTION RtlIsNameLegalDOS8Dot3 LIB "ntdll.dll" ALIAS "RtlIsNameLegalDOS8Dot3" ( BYREF Name AS UNICODE_STRING , BYREF OemName AS LSA_STRING , BYREF NameContainsSpaces AS BYTE ) AS BYTE ' BOOLEAN
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlIsValidOemCharacter LIB "ntdll.dll" ALIAS "RtlIsValidOemCharacter" ( BYREF Char AS WSTRINGZ ) AS BYTE ' BOOLEAN
'#endif
'//
'// Prefix package types and procedures.
'//
'// Note that the following two record structures should really be opaque
'// to the user of this package. The only information about the two
'// structures available for the user should be the size and alignment
'// of the structures.
'//
'typedef struct _PREFIX_TABLE_ENTRY {
' CSHORT NodeTypeCode;
' CSHORT NameLength;
' struct _PREFIX_TABLE_ENTRY *NextPrefixTree;
' RTL_SPLAY_LINKS Links;
' PSTRING Prefix;
'} PREFIX_TABLE_ENTRY, *PPREFIX_TABLE_ENTRY;
'typedef struct _PREFIX_TABLE {
' CSHORT NodeTypeCode;
' CSHORT NameLength;
' PPREFIX_TABLE_ENTRY NextPrefixTree;
'} PREFIX_TABLE;
'typedef PREFIX_TABLE *PPREFIX_TABLE;
'//
'// The procedure prototypes for the prefix package
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE SUB PfxInitialize LIB "ntdll.dll" ALIAS "PfxInitialize" ( BYREF PrefixTable AS QUAD )
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
' Note: STRING is an alias for LSA_STRING
DECLARE FUNCTION PfxInsertPrefix LIB "ntdll.dll" ALIAS "PfxInsertPrefix" ( BYVAL PrefixTable AS QUAD , BYVAL Prefix AS LSA_STRING , BYREF PrefixTableEntry AS QUAD ) AS BYTE ' BOOLEAN
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE SUB PfxRemovePrefix LIB "ntdll.dll" ALIAS "PfxRemovePrefix" ( BYVAL PrefixTable AS QUAD , BYVAL PrefixTableEntry AS QUAD )
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTSYSAPI
'PPREFIX_TABLE_ENTRY
'NTAPI
'PfxFindPrefix (
' );
' Note: STRING is an alias for LSA_STRING
DECLARE FUNCTION PfxFindPrefix LIB "ntdll.dll" ALIAS "PfxFindPrefix" ( BYVAL PrefixTable AS QUAD , BYREF FullName AS LSA_STRING ) AS QUAD ' PPREFIX_TABLE_ENTRY
'#endif
'//
'// The following definitions are for the unicode version of the prefix
'// package.
'//
'typedef struct _UNICODE_PREFIX_TABLE_ENTRY {
' CSHORT NodeTypeCode;
' CSHORT NameLength;
' struct _UNICODE_PREFIX_TABLE_ENTRY *NextPrefixTree;
' struct _UNICODE_PREFIX_TABLE_ENTRY *CaseMatch;
' RTL_SPLAY_LINKS Links;
' PUNICODE_STRING Prefix;
'} UNICODE_PREFIX_TABLE_ENTRY;
'typedef UNICODE_PREFIX_TABLE_ENTRY *PUNICODE_PREFIX_TABLE_ENTRY;
'typedef struct _UNICODE_PREFIX_TABLE {
' CSHORT NodeTypeCode;
' CSHORT NameLength;
' PUNICODE_PREFIX_TABLE_ENTRY NextPrefixTree;
' PUNICODE_PREFIX_TABLE_ENTRY LastNextEntry;
'} UNICODE_PREFIX_TABLE;
'typedef UNICODE_PREFIX_TABLE *PUNICODE_PREFIX_TABLE;
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE SUB RtlInitializeUnicodePrefix LIB "ntdll.dll" ALIAS "RtlInitializeUnicodePrefix" ( BYREF PrefixTable AS QUAD )
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlInsertUnicodePrefix LIB "ntdll.dll" ALIAS "RtlInsertUnicodePrefix" ( BYVAL PrefixTable AS QUAD , BYVAL Prefix AS UNICODE_STRING , BYREF PrefixTableEntry AS QUAD ) AS BYTE ' BOOLEAN
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE SUB RtlRemoveUnicodePrefix LIB "ntdll.dll" ALIAS "RtlRemoveUnicodePrefix" ( BYVAL PrefixTable AS QUAD , BYVAL PrefixTableEntry AS QUAD )
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlFindUnicodePrefix LIB "ntdll.dll" ALIAS "RtlFindUnicodePrefix" ( BYVAL PrefixTable AS QUAD , BYREF FullName AS UNICODE_STRING ) AS QUAD ' PUNICODE_PREFIX_TABLE_ENTRY
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlNextUnicodePrefix LIB "ntdll.dll" ALIAS "RtlNextUnicodePrefix" ( BYVAL PrefixTable AS QUAD , BYVAL Restart AS BYTE ) AS QUAD ' PUNICODE_PREFIX_TABLE_ENTRY
'#endif
'//
'//
'// Compression package types and procedures.
'//
'#define COMPRESSION_FORMAT_NONE (0x0000) // winnt
'#define COMPRESSION_FORMAT_DEFAULT (0x0001) // winnt
'#define COMPRESSION_FORMAT_LZNT1 (0x0002) // winnt
'#define COMPRESSION_ENGINE_STANDARD (0x0000) // winnt
'#define COMPRESSION_ENGINE_MAXIMUM (0x0100) // winnt
'#define COMPRESSION_ENGINE_HIBER (0x0200) // winnt
'//
'// Compressed Data Information structure. This structure is
'// used to describe the state of a compressed data buffer,
'// whose uncompressed size is known. All compressed chunks
'// described by this structure must be compressed with the
'// same format. On compressed reads, this entire structure
'// is an output, and on compressed writes the entire structure
'// is an input.
'//
' // Size = 12 bytes
TYPE COMPRESSED_DATA_INFO BYTE
 ' // Code for the compression format (and engine) as
 ' // defined in ntrtl.h. Note that COMPRESSION_FORMAT_NONE
 ' // and COMPRESSION_FORMAT_DEFAULT are invalid if
 ' // any of the described chunks are compressed.
 CompressionFormatAndEngine AS WORD ' USHORT
 ' // Since chunks and compression units are expected to be
 ' // powers of 2 in size, we express then log2. So, for
 ' // example (1 << ChunkShift) == ChunkSizeInBytes. The
 ' // ClusterShift indicates how much space must be saved
 ' // to successfully compress a compression unit - each
 ' // successfully compressed compression unit must occupy
 ' // at least one cluster less in bytes than an uncompressed
 ' // compression unit.
 CompressionUnitShift AS BYTE ' UCHAR
 ChunkShift AS BYTE ' UCHAR
 ClusterShift AS BYTE ' UCHAR
 Reserved AS BYTE ' UCHAR
 ' // This is the number of entries in the CompressedChunkSizes array.
 NumberOfChunks AS WORD ' USHORT
 ' // This is an array of the sizes of all chunks resident
 ' // in the compressed data buffer. There must be one entry
 ' // in this array for each chunk possible in the uncompressed
 ' // buffer size. A size of FSRTL_CHUNK_SIZE indicates the
 ' // corresponding chunk is uncompressed and occupies exactly
 ' // that size. A size of 0 indicates that the corresponding
 ' // chunk contains nothing but binary 0's, and occupies no
 ' // space in the compressed data. All other sizes must be
 ' // less than FSRTL_CHUNK_SIZE, and indicate the exact size
 ' // of the compressed data in bytes.
 CompressedChunkSizes(0) AS DWORD ' ULONG[ANYSIZE_ARRAY]
END TYPE
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlGetCompressionWorkSpaceSize LIB "ntdll.dll" ALIAS "RtlGetCompressionWorkSpaceSize" ( BYVAL CompressionFormatAndEngine AS WORD , BYREF CompressBufferWorkSpaceSize AS QUAD , BYREF CompressFragmentWorkSpaceSize AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlCompressBuffer LIB "ntdll.dll" ALIAS "RtlCompressBuffer" ( BYVAL CompressionFormatAndEngine AS WORD , BYVAL UncompressedBuffer AS BYTE PTR , BYVAL UncompressedBufferSize AS QUAD , BYVAL CompressedBuffer AS BYTE PTR , BYVAL CompressedBufferSize AS QUAD , BYVAL UncompressedChunkSize AS QUAD , BYREF FinalCompressedSize AS QUAD , BYVAL WorkSpace AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlDecompressBuffer LIB "ntdll.dll" ALIAS "RtlDecompressBuffer" ( BYVAL CompressionFormat AS WORD , BYVAL UncompressedBuffer AS BYTE PTR , BYVAL UncompressedBufferSize AS QUAD , BYVAL CompressedBuffer AS BYTE PTR , BYVAL CompressedBufferSize AS QUAD , BYREF FinalUncompressedSize AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlDecompressFragment LIB "ntdll.dll" ALIAS "RtlDecompressFragment" ( BYVAL CompressionFormat AS WORD , BYVAL UncompressedFragment AS BYTE PTR , BYVAL UncompressedFragmentSize AS QUAD , BYVAL CompressedBuffer AS BYTE PTR , BYVAL CompressedBufferSize AS QUAD , BYVAL FragmentOffset AS QUAD , BYREF FinalUncompressedSize AS QUAD , BYVAL WorkSpace AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlDescribeChunk LIB "ntdll.dll" ALIAS "RtlDescribeChunk" ( BYVAL CompressionFormat AS WORD , BYVAL CompressedBuffer AS BYTE PTR , BYVAL EndOfCompressedBufferPlus1 AS BYTE PTR , BYVAL ChunkBuffer AS BYTE PTR , BYREF ChunkSize AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlReserveChunk LIB "ntdll.dll" ALIAS "RtlReserveChunk" ( BYVAL CompressionFormat AS WORD , BYVAL CompressedBuffer AS BYTE PTR , BYVAL EndOfCompressedBufferPlus1 AS BYTE PTR , BYVAL ChunkBuffer AS BYTE PTR , BYVAL ChunkSize AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlDecompressChunks LIB "ntdll.dll" ALIAS "RtlDecompressChunks" ( BYVAL UncompressedBuffer AS BYTE PTR , BYVAL UncompressedBufferSize AS QUAD , BYVAL CompressedBuffer AS BYTE PTR , BYVAL CompressedBufferSize AS QUAD , BYVAL CompressedTail AS BYTE PTR , BYVAL CompressedTailSize AS QUAD , BYREF CompressedDataInfo AS COMPRESSED_DATA_INFO ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlCompressChunks LIB "ntdll.dll" ALIAS "RtlCompressChunks" ( BYVAL UncompressedBuffer AS BYTE PTR , BYVAL UncompressedBufferSize AS QUAD , BYVAL CompressedBuffer AS BYTE PTR , BYVAL CompressedBufferSize AS QUAD , BYREF CompressedDataInfo AS COMPRESSED_DATA_INFO , BYVAL CompressedDataInfoLength AS QUAD , BYVAL WorkSpace AS QUAD ) AS LONG ' NTSTATUS
'#endif // NTDDI_VERSION >= NTDDI_WINXP
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlCompareMemoryUlong LIB "ntdll.dll" ALIAS "RtlCompareMemoryUlong" ( BYVAL Source AS QUAD , BYVAL Length AS QUAD , BYVAL Pattern AS QUAD ) AS QUAD ' SIZE_T
'#endif
'#if defined(_M_AMD64)
'#if !defined(MIDL_PASS)
'FORCEINLINE
'RtlFillMemoryUlong (
' )
'{
' PULONG Address = (PULONG)Destination;
' //
' // If the number of DWORDs is not zero, then fill the specified buffer
' // with the specified pattern.
' //
' if ((Length /= 4) != 0) {
' //
' // If the destination is not quadword aligned (ignoring low bits),
' // then align the destination by storing one DWORD.
' //
' if (((ULONG64)Address & 4) != 0) {
' *Address = Pattern;
' if ((Length -= 1) == 0) {
' return;
' }
' Address += 1;
' }
' //
' // If the number of QWORDs is not zero, then fill the destination
' // buffer a QWORD at a time.
' //
' Pattern | ((ULONG64)Pattern << 32),
' Length / 2);
' if ((Length & 1) != 0) {
' Address[Length - 1] = Pattern;
' }
' }
' return;
'}
'#define RtlFillMemoryUlonglong(Destination, Length, Pattern) \
'#endif
'#else
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE SUB RtlFillMemoryUlong LIB "ntdll.dll" ALIAS "RtlFillMemoryUlong" ( BYVAL Destination AS QUAD , BYVAL Length AS QUAD , BYVAL Pattern AS QUAD )
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE SUB RtlFillMemoryUlonglong LIB "ntdll.dll" ALIAS "RtlFillMemoryUlonglong" ( BYVAL Destination AS QUAD , BYVAL Length AS QUAD , BYVAL Pattern AS QUAD )
'#endif
'#endif // defined(_M_AMD64)
'//
'// A 64 bit Time value -> Seconds since the start of 1980
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlTimeToSecondsSince1980 LIB "ntdll.dll" ALIAS "RtlTimeToSecondsSince1980" ( BYVAL Time AS QUAD , BYREF ElapsedSeconds AS QUAD ) AS BYTE ' BOOLEAN
'#endif
'//
'// Seconds since the start of 1980 -> 64 bit Time value
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE SUB RtlSecondsSince1980ToTime LIB "ntdll.dll" ALIAS "RtlSecondsSince1980ToTime" ( BYVAL ElapsedSeconds AS QUAD , BYREF Time AS QUAD )
'#endif
'//
'// A 64 bit Time value -> Seconds since the start of 1970
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlTimeToSecondsSince1970 LIB "ntdll.dll" ALIAS "RtlTimeToSecondsSince1970" ( BYVAL Time AS QUAD , BYREF ElapsedSeconds AS QUAD ) AS BYTE ' BOOLEAN
'#endif
'//
'// Seconds since the start of 1970 -> 64 bit Time value
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE SUB RtlSecondsSince1970ToTime LIB "ntdll.dll" ALIAS "RtlSecondsSince1970ToTime" ( BYVAL ElapsedSeconds AS QUAD , BYREF Time AS QUAD )
'#endif
'//++
'//
'// PCHAR
'// RtlOffsetToPointer (
'// PVOID Base,
'// ULONG Offset
'// )
'//
'// Routine Description:
'//
'// This macro generates a pointer which points to the byte that is 'Offset'
'// bytes beyond 'Base'. This is useful for referencing fields within
'// self-relative data structures.
'//
'// Arguments:
'//
'// Base - The address of the base of the structure.
'//
'// Offset - An unsigned integer offset of the byte whose address is to
'// be generated.
'//
'// Return Value:
'//
'// A PCHAR pointer to the byte that is 'Offset' bytes beyond 'Base'.
'//
'//
'//--
'#define RtlOffsetToPointer(B,O) ((PCHAR)( ((PCHAR)(B)) + ((ULONG_PTR)(O)) ))
'//++
'//
'// ULONG
'// RtlPointerToOffset (
'// PVOID Base,
'// PVOID Pointer
'// )
'//
'// Routine Description:
'//
'// This macro calculates the offset from Base to Pointer. This is useful
'// for producing self-relative offsets for structures.
'//
'// Arguments:
'//
'// Base - The address of the base of the structure.
'//
'// Pointer - A pointer to a field, presumably within the structure
'// pointed to by Base. This value must be larger than that specified
'// for Base.
'//
'// Return Value:
'//
'// A ULONG offset from Base to Pointer.
'//
'//
'//--
'#define RtlPointerToOffset(B,P) ((ULONG)( ((PCHAR)(P)) - ((PCHAR)(B)) ))
'//
'// Security ID RTL routine definitions
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlValidSid LIB "ntdll.dll" ALIAS "RtlValidSid" ( BYVAL Sid AS SID PTR ) AS BYTE ' BOOLEAN
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlEqualSid LIB "ntdll.dll" ALIAS "RtlEqualSid" ( BYVAL Sid1 AS SID PTR , BYVAL Sid2 AS SID PTR ) AS BYTE ' BOOLEAN
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlEqualPrefixSid LIB "ntdll.dll" ALIAS "RtlEqualPrefixSid" ( BYVAL Sid1 AS SID PTR , BYVAL Sid2 AS SID PTR ) AS BYTE ' BOOLEAN
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlLengthRequiredSid LIB "ntdll.dll" ALIAS "RtlLengthRequiredSid" ( BYVAL SubAuthorityCount AS QUAD ) AS QUAD ' ULONG
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE SUB RtlFreeSid LIB "ntdll.dll" ALIAS "RtlFreeSid" ( BYVAL Sid AS SID PTR )
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlAllocateAndInitializeSid LIB "ntdll.dll" ALIAS "RtlAllocateAndInitializeSid" ( BYREF IdentifierAuthority AS SID_IDENTIFIER_AUTHORITY , BYVAL SubAuthorityCount AS BYTE , BYVAL SubAuthority0 AS QUAD , BYVAL SubAuthority1 AS QUAD , BYVAL SubAuthority2 AS QUAD , BYVAL SubAuthority3 AS QUAD , BYVAL SubAuthority4 AS QUAD , BYVAL SubAuthority5 AS QUAD , BYVAL SubAuthority6 AS QUAD , BYVAL SubAuthority7 AS QUAD , BYREF Sid AS QUAD ) AS LONG ' NTSTATUS
'#endif // NTDDI_VERSION >= NTDDI_WIN2K
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlInitializeSid LIB "ntdll.dll" ALIAS "RtlInitializeSid" ( BYVAL Sid AS SID PTR , BYREF IdentifierAuthority AS SID_IDENTIFIER_AUTHORITY , BYVAL SubAuthorityCount AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlIdentifierAuthoritySid LIB "ntdll.dll" ALIAS "RtlIdentifierAuthoritySid" ( BYVAL Sid AS SID PTR ) AS QUAD ' PSID_IDENTIFIER_AUTHORITY
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlSubAuthoritySid LIB "ntdll.dll" ALIAS "RtlSubAuthoritySid" ( BYVAL Sid AS SID PTR , BYVAL SubAuthority AS QUAD ) AS QUAD
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlSubAuthorityCountSid LIB "ntdll.dll" ALIAS "RtlSubAuthorityCountSid" ( BYVAL Sid AS SID PTR ) AS QUAD
'#endif // NTDDI_VERSION >= NTDDI_WINXP
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlLengthSid LIB "ntdll.dll" ALIAS "RtlLengthSid" ( BYVAL Sid AS SID PTR ) AS QUAD ' ULONG
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlCopySid LIB "ntdll.dll" ALIAS "RtlCopySid" ( BYVAL DestinationSidLengt AS QUAD , BYVAL DestinationSid AS SID PTR , BYVAL SourceSid AS SID PTR ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
DECLARE FUNCTION RtlCreateServiceSid LIB "ntdll.dll" ALIAS "RtlCreateServiceSid" ( BYREF ServiceName AS UNICODE_STRING , BYREF ServiceSid AS QUAD , BYREF ServiceSidLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03SP1)
DECLARE FUNCTION RtlGetSaclSecurityDescriptor LIB "ntdll.dll" ALIAS "RtlGetSaclSecurityDescriptor" ( BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR , BYREF SaclPresent AS BYTE , BYVAL Sacl AS ACL PTR , BYREF SaclDefaulted AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
DECLARE FUNCTION RtlReplaceSidInSd LIB "ntdll.dll" ALIAS "RtlReplaceSidInSd" ( BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR , BYVAL OldSid AS SID PTR , BYVAL NewSid AS SID PTR , BYREF NumChanges AS QUAD ) AS LONG ' NTSTATUS
DECLARE FUNCTION RtlCreateVirtualAccountSid LIB "ntdll.dll" ALIAS "RtlCreateVirtualAccountSid" ( BYREF Name AS UNICODE_STRING , BYVAL BaseSubAuthority AS QUAD , BYVAL Sid AS SID PTR , BYREF SidLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'//
'// MAX_UNICODE_STACK_BUFFER_LENGTH is the maximum stack buffer
'// that RtlConvertSidToUnicodeString can fill if the caller
'// specifies AllocateDestinationString = FALSE.
'//
%EQUATE `MAX_UNICODE_STACK_BUFFER_LENGTH = 256
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlConvertSidToUnicodeString LIB "ntdll.dll" ALIAS "RtlConvertSidToUnicodeString" ( BYREF UnicodeString AS UNICODE_STRING , BYVAL Sid AS SID PTR , BYVAL AllocateDestinationString AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE SUB RtlCopyLuid LIB "ntdll.dll" ALIAS "RtlCopyLuid" ( BYREF DestinationLuid AS QUAD , BYREF SourceLuid AS QUAD )
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlCreateAcl LIB "ntdll.dll" ALIAS "RtlCreateAcl" ( BYREF Acl AS ANY , BYVAL AclLength AS QUAD , BYVAL AclRevision AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlAddAce LIB "ntdll.dll" ALIAS "RtlAddAce" ( BYVAL Acl AS ACL PTR , BYVAL AceRevision AS QUAD , BYVAL StartingAceIndex AS QUAD , BYVAL AceList AS QUAD , BYVAL AceListLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlDeleteAce LIB "ntdll.dll" ALIAS "RtlDeleteAce" ( BYVAL Acl AS ACL PTR , BYVAL AceIndex AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlGetAce LIB "ntdll.dll" ALIAS "RtlGetAce" ( BYVAL Acl AS ACL PTR , BYVAL AceIndex AS QUAD , BYREF Ace AS ANY ) AS LONG ' NTSTATUS
'#endif // NTDDI_VERSION >= NTDDI_WIN2K
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlAddAccessAllowedAce LIB "ntdll.dll" ALIAS "RtlAddAccessAllowedAce" ( BYVAL Acl AS ACL PTR , BYVAL AceRevision AS QUAD , BYVAL AccessMask AS ACCESS_MASK , BYVAL Sid AS SID PTR ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlAddAccessAllowedAceEx LIB "ntdll.dll" ALIAS "RtlAddAccessAllowedAceEx" ( BYVAL Acl AS ACL PTR , BYVAL AceRevision AS QUAD , BYVAL AceFlags AS QUAD , BYVAL AccessMask AS ACCESS_MASK , BYVAL Sid AS SID PTR ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlCreateSecurityDescriptorRelative LIB "ntdll.dll" ALIAS "RtlCreateSecurityDescriptorRelative" ( BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR_RELATIVE , BYVAL Revision AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlGetDaclSecurityDescriptor LIB "ntdll.dll" ALIAS "RtlGetDaclSecurityDescriptor" ( BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR , BYREF DaclPresent AS QUAD , BYVAL Dacl AS ACL PTR , BYREF DaclDefaulted AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlSetOwnerSecurityDescriptor LIB "ntdll.dll" ALIAS "RtlSetOwnerSecurityDescriptor" ( BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR , BYVAL Owner AS SID PTR , BYVAL OwnerDefaulted AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03SP1)
DECLARE FUNCTION RtlSetGroupSecurityDescriptor LIB "ntdll.dll" ALIAS "RtlSetGroupSecurityDescriptor" ( BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR , BYVAL Group AS SID PTR , BYVAL GroupDefaulted AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03SP1)
DECLARE FUNCTION RtlGetGroupSecurityDescriptor LIB "ntdll.dll" ALIAS "RtlGetGroupSecurityDescriptor" ( BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR , BYVAL Group AS SID PTR , BYVAL GroupDefaulted AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03SP1)
DECLARE FUNCTION RtlAbsoluteToSelfRelativeSD LIB "ntdll.dll" ALIAS "RtlAbsoluteToSelfRelativeSD" ( BYREF AbsoluteSecurityDescriptor AS SECURITY_DESCRIPTOR , BYREF SelfRelativeSecurityDescriptor AS SECURITY_DESCRIPTOR , BYREF BufferLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03SP1)
DECLARE FUNCTION RtlSelfRelativeToAbsoluteSD LIB "ntdll.dll" ALIAS "RtlSelfRelativeToAbsoluteSD" ( BYREF SelfRelativeSecurityDescriptor AS SECURITY_DESCRIPTOR , BYREF AbsoluteSecurityDescriptor AS SECURITY_DESCRIPTOR , BYREF AbsoluteSecurityDescriptorSize AS QUAD , BYVAL Dacl AS ACL PTR , BYREF DaclSize AS QUAD , BYVAL Sacl AS ACL PTR , BYREF SaclSize AS QUAD , BYVAL Owner AS SID PTR , BYREF OwnerSize AS QUAD , BYVAL PrimaryGroup AS SID PTR , BYREF PrimaryGroupSize AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlGetOwnerSecurityDescriptor LIB "ntdll.dll" ALIAS "RtlGetOwnerSecurityDescriptor" ( BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR , BYVAL Owner AS SID PTR , BYREF OwnerDefaulted AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlNtStatusToDosError LIB "ntdll.dll" ALIAS "RtlNtStatusToDosError" ( BYVAL Status AS LONG ) AS QUAD ' ULONG
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlNtStatusToDosErrorNoTeb LIB "ntdll.dll" ALIAS "RtlNtStatusToDosErrorNoTeb" ( BYVAL Status AS LONG ) AS QUAD ' ULONG
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlCustomCPToUnicodeN LIB "ntdll.dll" ALIAS "RtlCustomCPToUnicodeN" ( BYREF CustomCP AS CPTABLEINFO , BYREF UnicodeString AS QUAD , BYVAL MaxBytesInUnicodeString AS QUAD , BYREF BytesInUnicodeString AS QUAD , BYREF CustomCPString AS ASCIIZ , BYVAL BytesInCustomCPString AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlUnicodeToCustomCPN LIB "ntdll.dll" ALIAS "RtlUnicodeToCustomCPN" ( BYREF CustomCP AS CPTABLEINFO , BYREF CustomCPString AS ASCIIZ , BYVAL MaxBytesInCustomCPString AS QUAD , BYREF BytesInCustomCPString AS QUAD , BYREF UnicodeString AS QUAD , BYVAL BytesInUnicodeString AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION RtlUpcaseUnicodeToCustomCPN LIB "ntdll.dll" ALIAS "RtlUpcaseUnicodeToCustomCPN" ( BYREF CustomCP AS CPTABLEINFO , BYREF CustomCPString AS ASCIIZ , BYVAL MaxBytesInCustomCPString AS QUAD , BYREF BytesInCustomCPString AS QUAD , BYREF UnicodeString AS QUAD , BYVAL BytesInUnicodeString AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE SUB RtlInitCodePageTable LIB "ntdll.dll" ALIAS "RtlInitCodePageTable" ( BYREF TableBase AS WORD , BYREF CodePageTable AS CPTABLEINFO )
'#endif
'//
'// Routine for verifying or creating the "System Volume Information"
'// folder on NTFS volumes.
'//
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION RtlCreateSystemVolumeInformationFolder LIB "ntdll.dll" ALIAS "RtlCreateSystemVolumeInformationFolder" ( BYREF VolumeRootPath AS UNICODE_STRING ) AS LONG ' NTSTATUS
'#endif
'#define RTL_SYSTEM_VOLUME_INFORMATION_FOLDER L"System Volume Information"
$RTL_SYSTEM_VOLUME_INFORMATION_FOLDER = "System Volume Information"
'//
'// Altitude Routines
'//
'#if (NTDDI_VERSION >= NTDDI_VISTA)
DECLARE FUNCTION RtlCompareAltitudes LIB "ntdll.dll" ALIAS "RtlCompareAltitudes" ( BYREF Altitude1 AS UNICODE_STRING , BYREF Altitude2 AS UNICODE_STRING ) AS LONG
'#endif
'//
'// Define the various device type values. Note that values used by Microsoft
'// Corporation are in the range 0-32767, and 32768-65535 are reserved for use
'// by customers.
'//
'#define DEVICE_TYPE ULONG
'#define FILE_DEVICE_BEEP 0x00000001
'#define FILE_DEVICE_CD_ROM 0x00000002
'#define FILE_DEVICE_CD_ROM_FILE_SYSTEM 0x00000003
'#define FILE_DEVICE_CONTROLLER 0x00000004
'#define FILE_DEVICE_DATALINK 0x00000005
'#define FILE_DEVICE_DFS 0x00000006
'#define FILE_DEVICE_DISK 0x00000007
'#define FILE_DEVICE_DISK_FILE_SYSTEM 0x00000008
'#define FILE_DEVICE_FILE_SYSTEM 0x00000009
'#define FILE_DEVICE_INPORT_PORT 0x0000000a
'#define FILE_DEVICE_KEYBOARD 0x0000000b
'#define FILE_DEVICE_MAILSLOT 0x0000000c
'#define FILE_DEVICE_MIDI_IN 0x0000000d
'#define FILE_DEVICE_MIDI_OUT 0x0000000e
'#define FILE_DEVICE_MOUSE 0x0000000f
'#define FILE_DEVICE_MULTI_UNC_PROVIDER 0x00000010
'#define FILE_DEVICE_NAMED_PIPE 0x00000011
'#define FILE_DEVICE_NETWORK 0x00000012
'#define FILE_DEVICE_NETWORK_BROWSER 0x00000013
'#define FILE_DEVICE_NETWORK_FILE_SYSTEM 0x00000014
'#define FILE_DEVICE_NULL 0x00000015
'#define FILE_DEVICE_PARALLEL_PORT 0x00000016
'#define FILE_DEVICE_PHYSICAL_NETCARD 0x00000017
'#define FILE_DEVICE_PRINTER 0x00000018
'#define FILE_DEVICE_SCANNER 0x00000019
'#define FILE_DEVICE_SERIAL_MOUSE_PORT 0x0000001a
'#define FILE_DEVICE_SERIAL_PORT 0x0000001b
'#define FILE_DEVICE_SCREEN 0x0000001c
'#define FILE_DEVICE_SOUND 0x0000001d
'#define FILE_DEVICE_STREAMS 0x0000001e
'#define FILE_DEVICE_TAPE 0x0000001f
'#define FILE_DEVICE_TAPE_FILE_SYSTEM 0x00000020
'#define FILE_DEVICE_TRANSPORT 0x00000021
'#define FILE_DEVICE_UNKNOWN 0x00000022
'#define FILE_DEVICE_VIDEO 0x00000023
'#define FILE_DEVICE_VIRTUAL_DISK 0x00000024
'#define FILE_DEVICE_WAVE_IN 0x00000025
'#define FILE_DEVICE_WAVE_OUT 0x00000026
'#define FILE_DEVICE_8042_PORT 0x00000027
'#define FILE_DEVICE_NETWORK_REDIRECTOR 0x00000028
'#define FILE_DEVICE_BATTERY 0x00000029
'#define FILE_DEVICE_BUS_EXTENDER 0x0000002a
'#define FILE_DEVICE_MODEM 0x0000002b
'#define FILE_DEVICE_VDM 0x0000002c
'#define FILE_DEVICE_MASS_STORAGE 0x0000002d
'#define FILE_DEVICE_SMB 0x0000002e
'#define FILE_DEVICE_KS 0x0000002f
'#define FILE_DEVICE_CHANGER 0x00000030
'#define FILE_DEVICE_SMARTCARD 0x00000031
'#define FILE_DEVICE_ACPI 0x00000032
'#define FILE_DEVICE_DVD 0x00000033
'#define FILE_DEVICE_FULLSCREEN_VIDEO 0x00000034
'#define FILE_DEVICE_DFS_FILE_SYSTEM 0x00000035
'#define FILE_DEVICE_DFS_VOLUME 0x00000036
'#define FILE_DEVICE_SERENUM 0x00000037
'#define FILE_DEVICE_TERMSRV 0x00000038
'#define FILE_DEVICE_KSEC 0x00000039
'#define FILE_DEVICE_FIPS 0x0000003A
'#define FILE_DEVICE_INFINIBAND 0x0000003B
'#define FILE_DEVICE_VMBUS 0x0000003E
'#define FILE_DEVICE_CRYPT_PROVIDER 0x0000003F
'#define FILE_DEVICE_WPD 0x00000040
'#define FILE_DEVICE_BLUETOOTH 0x00000041
'#define FILE_DEVICE_MT_COMPOSITE 0x00000042
'#define FILE_DEVICE_MT_TRANSPORT 0x00000043
'#define FILE_DEVICE_BIOMETRIC 0x00000044
'#define FILE_DEVICE_PMI 0x00000045
'//
'// Macro definition for defining IOCTL and FSCTL function control codes. Note
'// that function codes 0-2047 are reserved for Microsoft Corporation, and
'// 2048-4095 are reserved for customers.
'//
'#define CTL_CODE( DeviceType, Function, Method, Access ) ( \
' ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
')
'//
'// Macro to extract device type out of the device io control code
'//
'#define DEVICE_TYPE_FROM_CTL_CODE(ctrlCode) (((ULONG)(ctrlCode & 0xffff0000)) >> 16)
'//
'// Macro to extract buffering method out of the device io control code
'//
'#define METHOD_FROM_CTL_CODE(ctrlCode) ((ULONG)(ctrlCode & 3))
'//
'// Define the method codes for how buffers are passed for I/O and FS controls
'//
'#define METHOD_BUFFERED 0
'#define METHOD_IN_DIRECT 1
'#define METHOD_OUT_DIRECT 2
'#define METHOD_NEITHER 3
'//
'// Define some easier to comprehend aliases:
'// METHOD_DIRECT_TO_HARDWARE (writes, aka METHOD_IN_DIRECT)
'// METHOD_DIRECT_FROM_HARDWARE (reads, aka METHOD_OUT_DIRECT)
'//
'#define METHOD_DIRECT_TO_HARDWARE METHOD_IN_DIRECT
'#define METHOD_DIRECT_FROM_HARDWARE METHOD_OUT_DIRECT
'//
'// Define the access check value for any access
'//
'//
'// The FILE_READ_ACCESS and FILE_WRITE_ACCESS constants are also defined in
'// ntioapi.h as FILE_READ_DATA and FILE_WRITE_DATA. The values for these
'// constants *MUST* always be in sync.
'//
'//
'// FILE_SPECIAL_ACCESS is checked by the NT I/O system the same as FILE_ANY_ACCESS.
'// The file systems, however, may add additional access checks for I/O and FS controls
'// that use this value.
'//
'#define FILE_ANY_ACCESS 0
'#define FILE_SPECIAL_ACCESS (FILE_ANY_ACCESS)
'#define FILE_READ_ACCESS ( 0x0001 ) // file & pipe
'#define FILE_WRITE_ACCESS ( 0x0002 ) // file & pipe
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtSetInformationThread LIB "ntdll.dll" ALIAS "NtSetInformationThread" ( BYVAL ThreadHandle AS QUAD , BYVAL ThreadInformationClass AS LONG , BYREF ThreadInformation AS ANY , BYVAL ThreadInformationLength AS QUAD ) AS LONG ' NTSTATUS
'#endif // NTDDI_VERSION >= NTDDI_WINXP
'//
'// Security operation mode of the system is held in a control
'// longword.
'//
'typedef ULONG LSA_OPERATIONAL_MODE, *PLSA_OPERATIONAL_MODE;
'//
'// Used by a logon process to indicate what type of logon is being
'// requested.
'//
'typedef enum _SECURITY_LOGON_TYPE {
' UndefinedLogonType = 0, // This is used to specify an undefied logon type
' Interactive = 2, // Interactively logged on (locally or remotely)
' Network, // Accessing system via network
' Batch, // Started via a batch queue
' Service, // Service started by service controller
' Proxy, // Proxy logon
' Unlock, // Unlock workstation
' NetworkCleartext, // Network logon with cleartext credentials
' NewCredentials, // Clone caller, new default credentials
' //The types below only exist in Windows XP and greater
'#if (_WIN32_WINNT >= 0x0501)
' RemoteInteractive, // Remote, yet interactive. Terminal server
' CachedInteractive, // Try cached credentials without hitting the net.
' // The types below only exist in Windows Server 2003 and greater
'#endif
'#if (_WIN32_WINNT >= 0x0502)
' CachedRemoteInteractive, // Same as RemoteInteractive, this is used internally for auditing purpose
' CachedUnlock // Cached Unlock workstation
'#endif
'} SECURITY_LOGON_TYPE, *PSECURITY_LOGON_TYPE;
'//
'// All of this stuff (between the Ifndef _NTLSA_AUDIT_ and its endif) were not
'// present in NTIFS prior to Windows Server 2003 SP1. All of the definitions however
'// exist down to windows 2000 (except for the few exceptions noted in the code).
'//
'#ifndef _NTLSA_AUDIT_
'#define _NTLSA_AUDIT_
'/////////////////////////////////////////////////////////////////////////
'// //
'// Data types related to Auditing //
'// //
'/////////////////////////////////////////////////////////////////////////
'//
'// The following enumerated type is used between the reference monitor and
'// LSA in the generation of audit messages. It is used to indicate the
'// type of data being passed as a parameter from the reference monitor
'// to LSA. LSA is responsible for transforming the specified data type
'// into a set of unicode strings that are added to the event record in
'// the audit log.
'//
'typedef enum _SE_ADT_PARAMETER_TYPE {
' SeAdtParmTypeNone = 0, //Produces 1 parameter
' //Received value:
' //
' // None.
' //
' //Results in:
' //
' // a unicode string containing "-".
' //
' //Note: This is typically used to
' // indicate that a parameter value
' // was not available.
' //
' SeAdtParmTypeString, //Produces 1 parameter.
' //Received Value:
' //
' // Unicode String (variable length)
' //
' //Results in:
' //
' // No transformation. The string
' // entered into the event record as
' // received.
' //
' // The Address value of the audit info
' // should be a pointer to a UNICODE_STRING
' // structure.
' SeAdtParmTypeFileSpec, //Produces 1 parameter.
' //Received value:
' //
' // Unicode string containing a file or
' // directory name.
' //
' //Results in:
' //
' // Unicode string with the prefix of the
' // file's path replaced by a drive letter
' // if possible.
' //
' SeAdtParmTypeUlong, //Produces 1 parameter
' //Received value:
' //
' // Ulong
' //
' //Results in:
' //
' // Unicode string representation of
' // unsigned integer value.
' SeAdtParmTypeSid, //Produces 1 parameter.
' //Received value:
' //
' // SID (variable length)
' //
' //Results in:
' //
' // String representation of SID
' //
' SeAdtParmTypeLogonId, //Produces 4 parameters.
' //Received Value:
' //
' // LUID (fixed length)
' //
' //Results in:
' //
' // param 1: Sid string
' // param 2: Username string
' // param 3: domain name string
' // param 4: Logon ID (Luid) string
' SeAdtParmTypeNoLogonId, //Produces 3 parameters.
' //Received value:
' //
' // None.
' //
' //Results in:
' //
' // param 1: "-"
' // param 2: "-"
' // param 3: "-"
' // param 4: "-"
' //
' //Note:
' //
' // This type is used when a logon ID
' // is needed, but one is not available
' // to pass. For example, if an
' // impersonation logon ID is expected
' // but the subject is not impersonating
' // anyone.
' //
' SeAdtParmTypeAccessMask, //Produces 1 parameter with formatting.
' //Received value:
' //
' // ACCESS_MASK followed by
' // a Unicode string. The unicode
' // string contains the name of the
' // type of object the access mask
' // applies to. The event's source
' // further qualifies the object type.
' //
' //Results in:
' //
' // formatted unicode string built to
' // take advantage of the specified
' // source's parameter message file.
' //
' //Note:
' //
' // An access mask containing three
' // access types for a Widget object
' // type (defined by the Foozle source)
' // might end up looking like:
' //
' // %%1062\n\t\t%1066\n\t\t%%601
' //
' // The %%numbers are signals to the
' // event viewer to perform parameter
' // substitution before display.
' //
' SeAdtParmTypePrivs, //Produces 1 parameter with formatting.
' //Received value:
' //
' //Results in:
' //
' // formatted unicode string similar to
' // that for access types. Each priv
' // will be formatted to be displayed
' // on its own line. E.g.,
' //
' // %%642\n\t\t%%651\n\t\t%%655
' //
' SeAdtParmTypeObjectTypes, //Produces 10 parameters with formatting.
' //Received value:
' //
' // Produces a list a stringized GUIDS along
' // with information similar to that for
' // an access mask.
' SeAdtParmTypeHexUlong, //Produces 1 parameter
' //Received value:
' //
' // Ulong
' //
' //Results in:
' //
' // Unicode string representation of
' // unsigned integer value in hexadecimal.
'// In W2k this value did not exist, it was ParmTypeLUID
' SeAdtParmTypePtr, //Produces 1 parameter
' //Received value:
' //
' // pointer
' //
' //Results in:
' //
' // Unicode string representation of
' // unsigned integer value in hexadecimal.
'//
'// Everything below exists only in Windows XP and greater
'//
' SeAdtParmTypeTime, //Produces 2 parameters
' //Received value:
' //
' // LARGE_INTEGER
' //
' //Results in:
' //
' // Unicode string representation of
' // date and time.
' //
' SeAdtParmTypeGuid, //Produces 1 parameter
' //Received value:
' //
' // GUID pointer
' //
' //Results in:
' //
' // Unicode string representation of GUID
' // {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}
' //
'//
'// Everything below exists only in Windows Server 2003 and Greater
'//
' SeAdtParmTypeLuid, //
' //Produces 1 parameter
' //Received value:
' //
' // LUID
' //
' //Results in:
' //
' // Hex LUID
' //
' SeAdtParmTypeHexInt64, //Produces 1 parameter
' //Received value:
' //
' // 64 bit integer
' //
' //Results in:
' //
' // Unicode string representation of
' // unsigned integer value in hexadecimal.
' SeAdtParmTypeStringList, //Produces 1 parameter
' //Received value:
' //
' // ptr to LSAP_ADT_STRING_LIST
' //
' //Results in:
' //
' // Unicode string representation of
' // concatenation of the strings in the list
' SeAdtParmTypeSidList, //Produces 1 parameter
' //Received value:
' //
' // ptr to LSAP_ADT_SID_LIST
' //
' //Results in:
' //
' // Unicode string representation of
' // concatenation of the SIDs in the list
' SeAdtParmTypeDuration, //Produces 1 parameters
' //Received value:
' //
' // LARGE_INTEGER
' //
' //Results in:
' //
' // Unicode string representation of
' // a duration.
' SeAdtParmTypeUserAccountControl,//Produces 3 parameters
' //Received value:
' //
' // old and new UserAccountControl values
' //
' //Results in:
' //
' // Unicode string representations of
' // the flags in UserAccountControl.
' // 1 - old value in hex
' // 2 - new value in hex
' // 3 - difference as strings
' SeAdtParmTypeNoUac, //Produces 3 parameters
' //Received value:
' //
' // none
' //
' //Results in:
' //
' // Three dashes ('-') as unicode strings.
' SeAdtParmTypeMessage, //Produces 1 Parameter
' //Received value:
' //
' // ULONG (MessageNo from msobjs.mc)
' //
' //Results in:
' //
' // Unicode string representation of
' // %%MessageNo which the event viewer
' // will replace with the message string
' // from msobjs.mc
' SeAdtParmTypeDateTime, //Produces 1 Parameter
' //Received value:
' //
' // LARGE_INTEGER
' //
' //Results in:
' //
' // Unicode string representation of
' // date and time (in _one_ string).
' SeAdtParmTypeSockAddr, // Produces 2 parameters
' //
' // Received value:
' //
' // pointer to SOCKADDR_IN/SOCKADDR_IN6
' // structure
' //
' // Results in:
' //
' // param 1: IP address string
' // param 2: Port number string
' //
'//
'// Everything below this exists only in Windows Server 2008 and greater
'//
' SeAdtParmTypeSD, // Produces 1 parameters
' //
' // Received value:
' //
' // pointer to SECURITY_DESCRIPTOR
' // structure
' //
' // Results in:
' //
' // SDDL string representation of SD
' //
' SeAdtParmTypeLogonHours, // Produces 1 parameters
' //
' // Received value:
' //
' // pointer to LOGON_HOURS
' // structure
' //
' // Results in:
' //
' // String representation of allowed logon hours
' //
' SeAdtParmTypeLogonIdNoSid, //Produces 3 parameters.
' //Received Value:
' //
' // LUID (fixed length)
' //
' //Results in:
' //
' // param 1: Username string
' // param 2: domain name string
' // param 3: Logon ID (Luid) string
' SeAdtParmTypeUlongNoConv, // Produces 1 parameter.
' // Received Value:
' // Ulong
' //
' //Results in:
' // Not converted to string
' //
' SeAdtParmTypeSockAddrNoPort, // Produces 1 parameter
' //
' // Received value:
' //
' // pointer to SOCKADDR_IN/SOCKADDR_IN6
' // structure
' //
' // Results in:
' //
' // param 1: IPv4/IPv6 address string
' //
'//
'// Everything below this exists only in Windows Server 2008 and greater
'//
' SeAdtParmTypeAccessReason // Produces 1 parameters
' //
' // Received value:
' //
' // pointer to SECURITY_DESCRIPTOR
' // structure followed by the reason code.
' // The reason code could be the index
' // of the ACE in the SD or privilege ID or
' // other reason codes.
' //
' // Results in:
' //
' // String representation of the access reason.
' //
'} SE_ADT_PARAMETER_TYPE, *PSE_ADT_PARAMETER_TYPE;
'#ifndef GUID_DEFINED
'#include <guiddef.h>
'#endif /* GUID_DEFINED */
'typedef struct _SE_ADT_OBJECT_TYPE {
' GUID ObjectType;
' USHORT Flags;
'#define SE_ADT_OBJECT_ONLY 0x1
' USHORT Level;
' ACCESS_MASK AccessMask;
'} SE_ADT_OBJECT_TYPE, *PSE_ADT_OBJECT_TYPE;
'typedef struct _SE_ADT_PARAMETER_ARRAY_ENTRY {
' SE_ADT_PARAMETER_TYPE Type;
' ULONG Length;
' ULONG_PTR Data[2];
' PVOID Address;
'} SE_ADT_PARAMETER_ARRAY_ENTRY, *PSE_ADT_PARAMETER_ARRAY_ENTRY;
'typedef struct _SE_ADT_ACCESS_REASON{
' ACCESS_MASK AccessMask;
' ULONG AccessReasons[32];
' ULONG ObjectTypeIndex;
' ULONG AccessGranted;
' PSECURITY_DESCRIPTOR SecurityDescriptor; // multple SDs may be stored here in self-relative way.
'} SE_ADT_ACCESS_REASON, *PSE_ADT_ACCESS_REASON;
'//
'// Structure that will be passed between the Reference Monitor and LSA
'// to transmit auditing information.
'//
'#define SE_MAX_AUDIT_PARAMETERS 32
'#define SE_MAX_GENERIC_AUDIT_PARAMETERS 28
'typedef struct _SE_ADT_PARAMETER_ARRAY {
' ULONG CategoryId;
' ULONG AuditId;
' ULONG ParameterCount;
' ULONG Length;
' USHORT FlatSubCategoryId;
' USHORT Type;
' ULONG Flags;
' SE_ADT_PARAMETER_ARRAY_ENTRY Parameters[ SE_MAX_AUDIT_PARAMETERS ];
'} SE_ADT_PARAMETER_ARRAY, *PSE_ADT_PARAMETER_ARRAY;
'#define SE_ADT_PARAMETERS_SELF_RELATIVE 0x00000001
'#define SE_ADT_PARAMETERS_SEND_TO_LSA 0x00000002
'#define SE_ADT_PARAMETER_EXTENSIBLE_AUDIT 0x00000004
'#define SE_ADT_PARAMETER_GENERIC_AUDIT 0x00000008
'#define SE_ADT_PARAMETER_WRITE_SYNCHRONOUS 0x00000010
'//
'// This macro only existed in Windows Server 2008 and after
'//
'#define LSAP_SE_ADT_PARAMETER_ARRAY_TRUE_SIZE(AuditParameters) \
' ( sizeof(SE_ADT_PARAMETER_ARRAY) - \
' sizeof(SE_ADT_PARAMETER_ARRAY_ENTRY) * \
' (SE_MAX_AUDIT_PARAMETERS - AuditParameters->ParameterCount) )
'#endif // _NTLSA_AUDIT_
'NTSTATUS
'NTAPI
'LsaRegisterLogonProcess (
' );
'//
'// The function below did not exist in NTIFS before windows XP
'// However, the function has always been there, so it is okay to use
'// even on w2k
'//
'NTSTATUS
'NTAPI
'LsaLogonUser (
' );
'NTSTATUS
'NTAPI
'LsaFreeReturnBuffer (
' );
'#ifndef _NTLSA_IFS_
'#define _NTLSA_IFS_
'#endif
'/////////////////////////////////////////////////////////////////////////
'// //
'// Name of the MSV1_0 authentication package //
'// //
'/////////////////////////////////////////////////////////////////////////
'#define MSV1_0_PACKAGE_NAME "MICROSOFT_AUTHENTICATION_PACKAGE_V1_0"
'#define MSV1_0_PACKAGE_NAMEW L"MICROSOFT_AUTHENTICATION_PACKAGE_V1_0"
'#define MSV1_0_PACKAGE_NAMEW_LENGTH sizeof(MSV1_0_PACKAGE_NAMEW) - sizeof(WCHAR)
'//
'// Location of MSV authentication package data
'//
'#define MSV1_0_SUBAUTHENTICATION_KEY "SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0"
'#define MSV1_0_SUBAUTHENTICATION_VALUE "Auth"
'/////////////////////////////////////////////////////////////////////////
'// //
'// Widely used MSV1_0 data types //
'// //
'/////////////////////////////////////////////////////////////////////////
'///////////////////////////////////////////////////////////////////////////////
'// //
'// LOGON Related Data Structures
'//
'// //
'///////////////////////////////////////////////////////////////////////////////
'//
'// When a LsaLogonUser() call is dispatched to the MsV1_0 authentication
'// package, the beginning of the AuthenticationInformation buffer is
'// cast to a MSV1_0_LOGON_SUBMIT_TYPE to determine the type of logon
'// being requested. Similarly, upon return, the type of profile buffer
'// can be determined by typecasting it to a MSV_1_0_PROFILE_BUFFER_TYPE.
'//
'//
'// MSV1.0 LsaLogonUser() submission message types.
'//
'typedef enum _MSV1_0_LOGON_SUBMIT_TYPE {
' MsV1_0InteractiveLogon = 2,
' MsV1_0Lm20Logon,
' MsV1_0NetworkLogon,
' MsV1_0SubAuthLogon,
' MsV1_0WorkstationUnlockLogon = 7,
' // defined in Windows Server 2008 and up
' MsV1_0S4ULogon = 12,
' MsV1_0VirtualLogon = 82
'} MSV1_0_LOGON_SUBMIT_TYPE, *PMSV1_0_LOGON_SUBMIT_TYPE;
'//
'// MSV1.0 LsaLogonUser() profile buffer types.
'//
'typedef enum _MSV1_0_PROFILE_BUFFER_TYPE {
' MsV1_0InteractiveProfile = 2,
' MsV1_0Lm20LogonProfile,
' MsV1_0SmartCardProfile
'} MSV1_0_PROFILE_BUFFER_TYPE, *PMSV1_0_PROFILE_BUFFER_TYPE;
'//
'// MsV1_0InteractiveLogon
'//
'// The AuthenticationInformation buffer of an LsaLogonUser() call to
'// perform an interactive logon contains the following data structure:
'//
'typedef struct _MSV1_0_INTERACTIVE_LOGON {
' MSV1_0_LOGON_SUBMIT_TYPE MessageType;
' UNICODE_STRING LogonDomainName;
' UNICODE_STRING UserName;
' UNICODE_STRING Password;
'} MSV1_0_INTERACTIVE_LOGON, *PMSV1_0_INTERACTIVE_LOGON;
'//
'// Where:
'//
'// MessageType - Contains the type of logon being requested. This
'// field must be set to MsV1_0InteractiveLogon.
'//
'// UserName - Is a string representing the user's account name. The
'// name may be up to 255 characters long. The name is treated case
'// insensitive.
'//
'// Password - Is a string containing the user's cleartext password.
'// The password may be up to 255 characters long and contain any
'// UNICODE value.
'//
'//
'//
'// The ProfileBuffer returned upon a successful logon of this type
'// contains the following data structure:
'//
'typedef struct _MSV1_0_INTERACTIVE_PROFILE {
' MSV1_0_PROFILE_BUFFER_TYPE MessageType;
' USHORT LogonCount;
' USHORT BadPasswordCount;
' LARGE_INTEGER LogonTime;
' LARGE_INTEGER LogoffTime;
' LARGE_INTEGER KickOffTime;
' LARGE_INTEGER PasswordLastSet;
' LARGE_INTEGER PasswordCanChange;
' LARGE_INTEGER PasswordMustChange;
' UNICODE_STRING LogonScript;
' UNICODE_STRING HomeDirectory;
' UNICODE_STRING FullName;
' UNICODE_STRING ProfilePath;
' UNICODE_STRING HomeDirectoryDrive;
' UNICODE_STRING LogonServer;
' ULONG UserFlags;
'} MSV1_0_INTERACTIVE_PROFILE, *PMSV1_0_INTERACTIVE_PROFILE;
'//
'// where:
'//
'// MessageType - Identifies the type of profile data being returned.
'// Contains the type of logon being requested. This field must
'// be set to MsV1_0InteractiveProfile.
'//
'// LogonCount - Number of times the user is currently logged on.
'//
'// BadPasswordCount - Number of times a bad password was applied to
'// the account since last successful logon.
'//
'// LogonTime - Time when user last logged on. This is an absolute
'// format NT standard time value.
'//
'// LogoffTime - Time when user should log off. This is an absolute
'// format NT standard time value.
'//
'// KickOffTime - Time when system should force user logoff. This is
'// an absolute format NT standard time value.
'//
'// PasswordLastChanged - Time and date the password was last
'// changed. This is an absolute format NT standard time
'// value.
'//
'// PasswordCanChange - Time and date when the user can change the
'// password. This is an absolute format NT time value. To
'// prevent a password from ever changing, set this field to a
'// date very far into the future.
'//
'// PasswordMustChange - Time and date when the user must change the
'// password. If the user can never change the password, this
'// field is undefined. This is an absolute format NT time
'// value.
'//
'// LogonScript - The (relative) path to the account's logon
'// script.
'//
'// HomeDirectory - The home directory for the user.
'//
'//
'// MsV1_0Lm20Logon and MsV1_0NetworkLogon
'//
'// The AuthenticationInformation buffer of an LsaLogonUser() call to
'// perform an network logon contains the following data structure:
'//
'// MsV1_0NetworkLogon logon differs from MsV1_0Lm20Logon in that the
'// ParameterControl field exists.
'//
'#define MSV1_0_CHALLENGE_LENGTH 8
'#define MSV1_0_USER_SESSION_KEY_LENGTH 16
'#define MSV1_0_LANMAN_SESSION_KEY_LENGTH 8
'//
'// Values for ParameterControl.
'//
'#define MSV1_0_CLEARTEXT_PASSWORD_ALLOWED 0x02
'#define MSV1_0_UPDATE_LOGON_STATISTICS 0x04
'#define MSV1_0_RETURN_USER_PARAMETERS 0x08
'#define MSV1_0_DONT_TRY_GUEST_ACCOUNT 0x10
'#define MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT 0x20
'#define MSV1_0_RETURN_PASSWORD_EXPIRY 0x40
'// this next flag says that CaseInsensitiveChallengeResponse
'// (aka LmResponse) contains a client challenge in the first 8 bytes
'#define MSV1_0_USE_CLIENT_CHALLENGE 0x80
'#define MSV1_0_TRY_GUEST_ACCOUNT_ONLY 0x100
'#define MSV1_0_RETURN_PROFILE_PATH 0x200
'#define MSV1_0_TRY_SPECIFIED_DOMAIN_ONLY 0x400
'#define MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT 0x800
'//#if (_WIN32_WINNT >= 0x0501) -- Disabled until IIS fixes their target version.
'#define MSV1_0_DISABLE_PERSONAL_FALLBACK 0x00001000
'#define MSV1_0_ALLOW_FORCE_GUEST 0x00002000
'//#endif
'#if (_WIN32_WINNT >= 0x0502)
'#define MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED 0x00004000
'// Start
'// Doesnt exist in Windows XP but does exist in Windows 2000 Security Rollup and up
'#define MSV1_0_USE_DOMAIN_FOR_ROUTING_ONLY 0x00008000
'#endif
'#define MSV1_0_SUBAUTHENTICATION_DLL_EX 0x00100000
'// Defined in Windows Server 2003 SP1 and above
'#define MSV1_0_ALLOW_MSVCHAPV2 0x00010000
'#if (_WIN32_WINNT >= 0x0600)
'//Defined in Windows Server 2008 and up
'#define MSV1_0_S4U2SELF 0x00020000 // no password is needed
'#define MSV1_0_CHECK_LOGONHOURS_FOR_S4U 0x00040000 // check logon hours for S4U logon
'#endif
'//
'// The high order byte is a value indicating the SubAuthentication DLL.
'// Zero indicates no SubAuthentication DLL.
'//
'#define MSV1_0_SUBAUTHENTICATION_DLL 0xFF000000
'#define MSV1_0_SUBAUTHENTICATION_DLL_SHIFT 24
'#define MSV1_0_MNS_LOGON 0x01000000
'//
'// This is the list of subauthentication dlls used in MS
'//
'#define MSV1_0_SUBAUTHENTICATION_DLL_RAS 2
'#define MSV1_0_SUBAUTHENTICATION_DLL_IIS 132
'typedef struct _MSV1_0_LM20_LOGON {
' MSV1_0_LOGON_SUBMIT_TYPE MessageType;
' UNICODE_STRING LogonDomainName;
' UNICODE_STRING UserName;
' UNICODE_STRING Workstation;
' UCHAR ChallengeToClient[MSV1_0_CHALLENGE_LENGTH];
' STRING CaseSensitiveChallengeResponse;
' STRING CaseInsensitiveChallengeResponse;
' ULONG ParameterControl;
'} MSV1_0_LM20_LOGON, * PMSV1_0_LM20_LOGON;
'//
'// NT 5.0 SubAuth dlls can use this struct
'//
'typedef struct _MSV1_0_SUBAUTH_LOGON{
' MSV1_0_LOGON_SUBMIT_TYPE MessageType;
' UNICODE_STRING LogonDomainName;
' UNICODE_STRING UserName;
' UNICODE_STRING Workstation;
' UCHAR ChallengeToClient[MSV1_0_CHALLENGE_LENGTH];
' STRING AuthenticationInfo1;
' STRING AuthenticationInfo2;
' ULONG ParameterControl;
' ULONG SubAuthPackageId;
'} MSV1_0_SUBAUTH_LOGON, * PMSV1_0_SUBAUTH_LOGON;
'#if (_WIN32_WINNT >= 0x0600)
'//
'// s4u2self logon
'//
'// Defined in Windows Server 2008 and above
'//
'// request to enforce logon hours policy
'//
'#define MSV1_0_S4U_LOGON_FLAG_CHECK_LOGONHOURS 0x2
'typedef struct _MSV1_0_S4U_LOGON {
' MSV1_0_LOGON_SUBMIT_TYPE MessageType;
' ULONG Flags;
' UNICODE_STRING UserPrincipalName; // username or username@domain
' UNICODE_STRING DomainName; // Optional: if missing, using the local machine
'} MSV1_0_S4U_LOGON, *PMSV1_0_S4U_LOGON;
'#endif
'//
'// Values for UserFlags.
'//
'#define LOGON_GUEST 0x01
'#define LOGON_NOENCRYPTION 0x02
'#define LOGON_CACHED_ACCOUNT 0x04
'#define LOGON_USED_LM_PASSWORD 0x08
'#define LOGON_EXTRA_SIDS 0x20
'#define LOGON_SUBAUTH_SESSION_KEY 0x40
'#define LOGON_SERVER_TRUST_ACCOUNT 0x80
'#define LOGON_NTLMV2_ENABLED 0x100 // says DC understands NTLMv2
'#define LOGON_RESOURCE_GROUPS 0x200
'#define LOGON_PROFILE_PATH_RETURNED 0x400
'// Defined in Windows Server 2008 and above
'#define LOGON_NT_V2 0x800 // NT response was used for validation
'#define LOGON_LM_V2 0x1000 // LM response was used for validation
'#define LOGON_NTLM_V2 0x2000 // LM response was used to authenticate but NT response was used to derive the session key
'#if (_WIN32_WINNT >= 0x0600)
%EQUATE `LOGON_OPTIMIZED = &H4000 ' // this is an optimized logon
%EQUATE `LOGON_WINLOGON = &H8000 ' // the logon session was created for winlogon
%EQUATE `LOGON_PKINIT = &H10000 ' // Kerberos PKINIT extension was used to authenticate the user
%EQUATE `LOGON_NO_OPTIMIZED = &H20000 ' // optimized logon has been disabled for this account
'#endif
'//
'// The high order byte is reserved for return by SubAuthentication DLLs.
'//
'#define MSV1_0_SUBAUTHENTICATION_FLAGS 0xFF000000
'// Values returned by the MSV1_0_MNS_LOGON SubAuthentication DLL
'#define LOGON_GRACE_LOGON 0x01000000
'typedef struct _MSV1_0_LM20_LOGON_PROFILE {
' MSV1_0_PROFILE_BUFFER_TYPE MessageType;
' LARGE_INTEGER KickOffTime;
' LARGE_INTEGER LogoffTime;
' ULONG UserFlags;
' UCHAR UserSessionKey[MSV1_0_USER_SESSION_KEY_LENGTH];
' UNICODE_STRING LogonDomainName;
' UCHAR LanmanSessionKey[MSV1_0_LANMAN_SESSION_KEY_LENGTH];
' UNICODE_STRING LogonServer;
' UNICODE_STRING UserParameters;
'} MSV1_0_LM20_LOGON_PROFILE, * PMSV1_0_LM20_LOGON_PROFILE;
'//
'// Supplemental credentials structure used for passing credentials into
'// MSV1_0 from other packages
'//
'#define MSV1_0_OWF_PASSWORD_LENGTH 16
'#define MSV1_0_CRED_LM_PRESENT 0x1
'#define MSV1_0_CRED_NT_PRESENT 0x2
'#define MSV1_0_CRED_VERSION 0
'typedef struct _MSV1_0_SUPPLEMENTAL_CREDENTIAL {
' ULONG Version;
' ULONG Flags;
' UCHAR LmPassword[MSV1_0_OWF_PASSWORD_LENGTH];
' UCHAR NtPassword[MSV1_0_OWF_PASSWORD_LENGTH];
'} MSV1_0_SUPPLEMENTAL_CREDENTIAL, *PMSV1_0_SUPPLEMENTAL_CREDENTIAL;
'//
'// NTLM3 definitions.
'//
'#define MSV1_0_NTLM3_RESPONSE_LENGTH 16
'#define MSV1_0_NTLM3_OWF_LENGTH 16
'//
'// this is the longest amount of time we'll allow challenge response
'// pairs to be used. Note that this also has to allow for worst case clock skew
'//
'#if (_WIN32_WINNT == 0x0500)
'#define MSV1_0_MAX_NTLM3_LIFE 1800 // 30 minutes (in seconds)
'#else
'#define MSV1_0_MAX_NTLM3_LIFE 129600 // 36 hours (in seconds)
'#endif
'#define MSV1_0_MAX_AVL_SIZE 64000
'#if (_WIN32_WINNT >= 0x0501)
'//
'// MsvAvFlags bit values
'//
'// Exists only after Windows 2000
'//
'#define MSV1_0_AV_FLAG_FORCE_GUEST 0x00000001
'#if (_WIN32_WINNT >= 0x0600)
'#define MSV1_0_AV_FLAG_MIC_HANDSHAKE_MESSAGES 0x00000002 // the client supports
' // hand-shake messages integrity
'#endif
'#endif
'// this is an MSV1_0 private data structure, defining the layout of an NTLM3 response, as sent by a
'// client in the NtChallengeResponse field of the NETLOGON_NETWORK_INFO structure. If can be differentiated
'// from an old style NT response by its length. This is crude, but it needs to pass through servers and
'// the servers' DCs that do not understand NTLM3 but that are willing to pass longer responses.
'typedef struct _MSV1_0_NTLM3_RESPONSE {
' UCHAR Response[MSV1_0_NTLM3_RESPONSE_LENGTH]; // hash of OWF of password with all the following fields
' UCHAR RespType; // id number of response; current is 1
' UCHAR HiRespType; // highest id number understood by client
' USHORT Flags; // reserved; must be sent as zero at this version
' ULONG MsgWord; // 32 bit message from client to server (for use by auth protocol)
' ULONGLONG TimeStamp; // time stamp when client generated response -- NT system time, quad part
' UCHAR ChallengeFromClient[MSV1_0_CHALLENGE_LENGTH];
' ULONG AvPairsOff; // offset to start of AvPairs (to allow future expansion)
' UCHAR Buffer[1]; // start of buffer with AV pairs (or future stuff -- so use the offset)
'} MSV1_0_NTLM3_RESPONSE, *PMSV1_0_NTLM3_RESPONSE;
'#define MSV1_0_NTLM3_INPUT_LENGTH (sizeof(MSV1_0_NTLM3_RESPONSE) - MSV1_0_NTLM3_RESPONSE_LENGTH)
'#if(_WIN32_WINNT >= 0x0502)
'#define MSV1_0_NTLM3_MIN_NT_RESPONSE_LENGTH RTL_SIZEOF_THROUGH_FIELD(MSV1_0_NTLM3_RESPONSE, AvPairsOff)
'#endif
'typedef enum {
' MsvAvEOL, // end of list
' MsvAvNbComputerName, // server's computer name -- NetBIOS
' MsvAvNbDomainName, // server's domain name -- NetBIOS
' MsvAvDnsComputerName, // server's computer name -- DNS
' MsvAvDnsDomainName, // server's domain name -- DNS
'#if (_WIN32_WINNT >= 0x0501)
' MsvAvDnsTreeName, // server's tree name -- DNS
' MsvAvFlags, // server's extended flags -- DWORD mask
'#if (_WIN32_WINNT >= 0x0600)
' MsvAvTimestamp, // contains the server's local time in FILETIME,
' // (64 bit 100 ns ticks since 1602
' // (UTC)) in little endian byte order
' MsvAvRestrictions, // token restrictions
' MsvAvTargetName,
' MsvAvChannelBindings,
'#endif
'#endif
'} MSV1_0_AVID;
'typedef struct _MSV1_0_AV_PAIR {
' USHORT AvId;
' USHORT AvLen;
' // Data is treated as byte array following structure
'} MSV1_0_AV_PAIR, *PMSV1_0_AV_PAIR;
'///////////////////////////////////////////////////////////////////////////////
'// //
'// CALL PACKAGE Related Data Structures //
'// //
'///////////////////////////////////////////////////////////////////////////////
'//
'// MSV1.0 LsaCallAuthenticationPackage() submission and response
'// message types.
'//
'typedef enum _MSV1_0_PROTOCOL_MESSAGE_TYPE {
' MsV1_0Lm20ChallengeRequest = 0, // Both submission and response
' MsV1_0Lm20GetChallengeResponse, // Both submission and response
' MsV1_0EnumerateUsers, // Both submission and response
' MsV1_0GetUserInfo, // Both submission and response
' MsV1_0ReLogonUsers, // Submission only
' MsV1_0ChangePassword, // Both submission and response
' MsV1_0ChangeCachedPassword, // Both submission and response
' MsV1_0GenericPassthrough, // Both submission and response
' MsV1_0CacheLogon, // Submission only, no response
' MsV1_0SubAuth, // Both submission and response
' MsV1_0DeriveCredential, // Both submission and response
' MsV1_0CacheLookup, // Both submission and response
'#if (_WIN32_WINNT >= 0x0501)
' MsV1_0SetProcessOption, // Submission only, no response
'#endif
'#if (_WIN32_WINNT >= 0x0600)
' MsV1_0ConfigLocalAliases,
' MsV1_0ClearCachedCredentials,
'#endif
'} MSV1_0_PROTOCOL_MESSAGE_TYPE, *PMSV1_0_PROTOCOL_MESSAGE_TYPE;
'// end_ntsecapi
'//
'// MsV1_0Lm20ChallengeRequest submit buffer and response
'//
TYPE MSV1_0_LM20_CHALLENGE_REQUEST DWORD
 MessageType AS LONG ' MSV1_0_PROTOCOL_MESSAGE_TYPE
END TYPE
TYPE MSV1_0_LM20_CHALLENGE_RESPONSE DWORD
 MessageType AS LONG ' MSV1_0_PROTOCOL_MESSAGE_TYPE
 ChallengeToClient AS ASCIIZ * %MSV1_0_CHALLENGE_LENGTH ' UCHAR ChallengeToClient[MSV1_0_CHALLENGE_LENGTH]
END TYPE
'//
'// MsV1_0Lm20GetChallengeResponse submit buffer and response
'//
%EQUATE `USE_PRIMARY_PASSWORD = &H01
%EQUATE `RETURN_PRIMARY_USERNAME = &H02
%EQUATE `RETURN_PRIMARY_LOGON_DOMAINNAME = &H04
%EQUATE `RETURN_NON_NT_USER_SESSION_KEY = &H08
%EQUATE `GENERATE_CLIENT_CHALLENGE = &H10
%EQUATE `GCR_NTLM3_PARMS = &H20
%EQUATE `GCR_TARGET_INFO = &H40 ' // ServerName field contains target info AV pairs
%EQUATE `RETURN_RESERVED_PARAMETER = &H80 ' // was = &H10
%EQUATE `GCR_ALLOW_NTLM = &H100 ' // allow the use of NTLM
'// Exists in Windows XPSP2 and later
%EQUATE `GCR_USE_OEM_SET = &H200 ' // response uses oem character set
%EQUATE `GCR_MACHINE_CREDENTIAL = &H400
%EQUATE `GCR_USE_OWF_PASSWORD = &H800 ' // use owf passwords
%EQUATE `GCR_ALLOW_LM = &H1000 ' // allow the use of LM
'// Defined in Windows Server 2003 and above
%EQUATE `GCR_ALLOW_NO_TARGET = &H2000 ' // allow no target server or target domain name
'//
'// version 1 of the GETCHALLENRESP structure, which was used by RAS and others.
'// compiled before the additional fields added to GETCHALLENRESP_REQUEST.
'// here to allow sizing operations for backwards compatibility.
'//
' // Size = 32 bytes
TYPE MSV1_0_GETCHALLENRESP_REQUEST_V1 DWORD
 MessageType AS LONG ' MSV1_0_PROTOCOL_MESSAGE_TYPE
 ParameterControl AS DWORD ' ULONG
 LogonId AS QUAD ' LUID
 Password AS UNICODE_STRING
 ChallengeToClient(%MSV1_0_CHALLENGE_LENGTH - 1) AS BYTE ' UCHAR[MSV1_0_CHALLENGE_LENGTH]
END TYPE
' // Size = 56 bytes
TYPE MSV1_0_GETCHALLENRESP_REQUEST DWORD
 MessageType AS LONG ' MSV1_0_PROTOCOL_MESSAGE_TYPE
 ParameterControl AS DWORD ' ULONG
 LogonId AS QUAD ' LUID
 Password AS UNICODE_STRING
 ChallengeToClient(%MSV1_0_CHALLENGE_LENGTH - 1) AS BYTE ' UCHAR[MSV1_0_CHALLENGE_LENGTH]
 ' // the following 3 fields are only present if GCR_NTLM3_PARMS is set in ParameterControl
 UserName AS UNICODE_STRING
 LogonDomainName AS UNICODE_STRING
 ServerName AS UNICODE_STRING ' // server domain or target info AV pairs
END TYPE
' // Size = 60 bytes
TYPE MSV1_0_GETCHALLENRESP_RESPONSE DWORD
 MessageType AS LONG ' MSV1_0_PROTOCOL_MESSAGE_TYPE
 CaseSensitiveChallengeResponse AS LSA_STRING ' STRING
 CaseInsensitiveChallengeResponse AS LSA_STRING ' STRING
 UserName AS UNICODE_STRING
 LogonDomainName AS UNICODE_STRING
 UserSessionKey(%MSV1_0_USER_SESSION_KEY_LENGTH - 1) AS BYTE ' UCHAR[MSV1_0_USER_SESSION_KEY_LENGTH]
 LanmanSessionKey(%MSV1_0_LANMAN_SESSION_KEY_LENGTH - 1) AS BYTE ' UCHAR[MSV1_0_LANMAN_SESSION_KEY_LENGTH]
END TYPE
'//
'// MsV1_0EnumerateUsers submit buffer and response
'//
' // Size = 4 bytes
TYPE MSV1_0_ENUMUSERS_REQUEST DWORD
 MessageType AS LONG ' MSV1_0_PROTOCOL_MESSAGE_TYPE
END TYPE
' // Size = 16 bytes
TYPE MSV1_0_ENUMUSERS_RESPONSE DWORD
 MessageType AS LONG ' MSV1_0_PROTOCOL_MESSAGE_TYPE
 NumberOfLoggedOnUsers AS DWORD ' ULONG
 LogonIds AS QUAD PTR
 EnumHandles AS DWORD PTR
END TYPE
'//
'// MsV1_0GetUserInfo submit buffer and response
'//
' // Size = 12 bytes
TYPE MSV1_0_GETUSERINFO_REQUEST DWORD
 MessageType AS LONG ' MSV1_0_PROTOCOL_MESSAGE_TYPE
 LogonId AS QUAD ' LUID
END TYPE
' // Size = 36 bytes
TYPE MSV1_0_GETUSERINFO_RESPONSE DWORD
 MessageType AS LONG ' MSV1_0_PROTOCOL_MESSAGE_TYPE
 UserSid AS SID PTR
 UserName AS UNICODE_STRING
 LogonDomainName AS UNICODE_STRING
 LogonServer AS UNICODE_STRING
 LogonType AS LONG ' SECURITY_LOGON_TYPE
END TYPE
'//
'// Define the I/O status information return values for requests for oplocks
'// via NtFsControlFile
'//
%EQUATE `FILE_OPLOCK_BROKEN_TO_LEVEL_2 = &H00000007
%EQUATE `FILE_OPLOCK_BROKEN_TO_NONE = &H00000008
'//
'// Define the I/O status information return values for NtCreateFile/NtOpenFile
'// when the sharing access fails but a batch oplock break is in progress
'//
%EQUATE `FILE_OPBATCH_BREAK_UNDERWAY = &H00000009
'//
'// Define the filter flags for NtNotifyChangeDirectoryFile
'//
'#define FILE_NOTIFY_CHANGE_FILE_NAME 0x00000001 // winnt
'#define FILE_NOTIFY_CHANGE_DIR_NAME 0x00000002 // winnt
%EQUATE `FILE_NOTIFY_CHANGE_NAME = &H00000003
'#define FILE_NOTIFY_CHANGE_ATTRIBUTES 0x00000004 // winnt
'#define FILE_NOTIFY_CHANGE_SIZE 0x00000008 // winnt
'#define FILE_NOTIFY_CHANGE_LAST_WRITE 0x00000010 // winnt
'#define FILE_NOTIFY_CHANGE_LAST_ACCESS 0x00000020 // winnt
'#define FILE_NOTIFY_CHANGE_CREATION 0x00000040 // winnt
%EQUATE `FILE_NOTIFY_CHANGE_EA = &H00000080
'#define FILE_NOTIFY_CHANGE_SECURITY 0x00000100 // winnt
%EQUATE `FILE_NOTIFY_CHANGE_STREAM_NAME = &H00000200
%EQUATE `FILE_NOTIFY_CHANGE_STREAM_SIZE = &H00000400
%EQUATE `FILE_NOTIFY_CHANGE_STREAM_WRITE = &H00000800
%EQUATE `FILE_NOTIFY_VALID_MASK = &H00000fff
'//
'// Define the file action type codes for NtNotifyChangeDirectoryFile
'//
'#define FILE_ACTION_ADDED 0x00000001 // winnt
'#define FILE_ACTION_REMOVED 0x00000002 // winnt
'#define FILE_ACTION_MODIFIED 0x00000003 // winnt
'#define FILE_ACTION_RENAMED_OLD_NAME 0x00000004 // winnt
'#define FILE_ACTION_RENAMED_NEW_NAME 0x00000005 // winnt
%EQUATE `FILE_ACTION_ADDED_STREAM = &H00000006
%EQUATE `FILE_ACTION_REMOVED_STREAM = &H00000007
%EQUATE `FILE_ACTION_MODIFIED_STREAM = &H00000008
%EQUATE `FILE_ACTION_REMOVED_BY_DELETE = &H00000009
%EQUATE `FILE_ACTION_ID_NOT_TUNNELLED = &H0000000A
%EQUATE `FILE_ACTION_TUNNELLED_ID_COLLISION = &H0000000B
'//
'// Define the NamedPipeType flags for NtCreateNamedPipeFile
'//
%EQUATE `FILE_PIPE_BYTE_STREAM_TYPE = &H00000000
%EQUATE `FILE_PIPE_MESSAGE_TYPE = &H00000001
%EQUATE `FILE_PIPE_ACCEPT_REMOTE_CLIENTS = &H00000000
%EQUATE `FILE_PIPE_REJECT_REMOTE_CLIENTS = &H00000002
%EQUATE `FILE_PIPE_TYPE_VALID_MASK = &H00000003
'//
'// Define the CompletionMode flags for NtCreateNamedPipeFile
'//
%EQUATE `FILE_PIPE_QUEUE_OPERATION = &H00000000
%EQUATE `FILE_PIPE_COMPLETE_OPERATION = &H00000001
'//
'// Define the ReadMode flags for NtCreateNamedPipeFile
'//
%EQUATE `FILE_PIPE_BYTE_STREAM_MODE = &H00000000
%EQUATE `FILE_PIPE_MESSAGE_MODE = &H00000001
'//
'// Define the NamedPipeConfiguration flags for NtQueryInformation
'//
%EQUATE `FILE_PIPE_INBOUND = &H00000000
%EQUATE `FILE_PIPE_OUTBOUND = &H00000001
%EQUATE `FILE_PIPE_FULL_DUPLEX = &H00000002
'//
'// Define the NamedPipeState flags for NtQueryInformation
'//
%EQUATE `FILE_PIPE_DISCONNECTED_STATE = &H00000001
%EQUATE `FILE_PIPE_LISTENING_STATE = &H00000002
%EQUATE `FILE_PIPE_CONNECTED_STATE = &H00000003
%EQUATE `FILE_PIPE_CLOSING_STATE = &H00000004
'//
'// Define the NamedPipeEnd flags for NtQueryInformation
'//
%EQUATE `FILE_PIPE_CLIENT_END = &H00000000
%EQUATE `FILE_PIPE_SERVER_END = &H00000001
'//
'// Define the file system attributes flags
'//
'#define FILE_CASE_SENSITIVE_SEARCH 0x00000001 // winnt
'#define FILE_CASE_PRESERVED_NAMES 0x00000002 // winnt
'#define FILE_UNICODE_ON_DISK 0x00000004 // winnt
'#define FILE_PERSISTENT_ACLS 0x00000008 // winnt
'#define FILE_FILE_COMPRESSION 0x00000010 // winnt
'#define FILE_VOLUME_QUOTAS 0x00000020 // winnt
'#define FILE_SUPPORTS_SPARSE_FILES 0x00000040 // winnt
'#define FILE_SUPPORTS_REPARSE_POINTS 0x00000080 // winnt
'#define FILE_SUPPORTS_REMOTE_STORAGE 0x00000100 // winnt
'#define FILE_VOLUME_IS_COMPRESSED 0x00008000 // winnt
'#define FILE_SUPPORTS_OBJECT_IDS 0x00010000 // winnt
'#define FILE_SUPPORTS_ENCRYPTION 0x00020000 // winnt
'#define FILE_NAMED_STREAMS 0x00040000 // winnt
'#define FILE_READ_ONLY_VOLUME 0x00080000 // winnt
'#define FILE_SEQUENTIAL_WRITE_ONCE 0x00100000 // winnt
'#define FILE_SUPPORTS_TRANSACTIONS 0x00200000 // winnt
'#define FILE_SUPPORTS_HARD_LINKS 0x00400000 // winnt
'#define FILE_SUPPORTS_EXTENDED_ATTRIBUTES 0x00800000 // winnt
'//
'// When enabled this attribute implies that the FileID's for the supported
'// file system are also durable. This means the FileID will not change due
'// to other file system operations like rename or defrag. If a file
'// is deleted and re-created the ID will change.
'//
'#define FILE_SUPPORTS_OPEN_BY_FILE_ID 0x01000000 // winnt
'#define FILE_SUPPORTS_USN_JOURNAL 0x02000000 // winnt
'//
'// Define the flags for NtSet(Query)EaFile service structure entries
'//
%EQUATE `FILE_NEED_EA = &H00000080
'//
'// Define EA type values
'//
%EQUATE `FILE_EA_TYPE_BINARY = &Hfffe
%EQUATE `FILE_EA_TYPE_ASCII = &Hfffd
%EQUATE `FILE_EA_TYPE_BITMAP = &Hfffb
%EQUATE `FILE_EA_TYPE_METAFILE = &Hfffa
%EQUATE `FILE_EA_TYPE_ICON = &Hfff9
%EQUATE `FILE_EA_TYPE_EA = &Hffee
%EQUATE `FILE_EA_TYPE_MVMT = &Hffdf
%EQUATE `FILE_EA_TYPE_MVST = &Hffde
%EQUATE `FILE_EA_TYPE_ASN1 = &Hffdd
%EQUATE `FILE_EA_TYPE_FAMILY_IDS = &Hff01
'//
'// Define the file notification information structure
'//
'typedef struct _FILE_NOTIFY_INFORMATION {
' ULONG NextEntryOffset;
' ULONG Action;
' ULONG FileNameLength;
' WCHAR FileName[1];
'} FILE_NOTIFY_INFORMATION, *PFILE_NOTIFY_INFORMATION;
'//
'// NtQueryDirectoryFile return types:
'//
'// FILE_DIRECTORY_INFORMATION
'// FILE_FULL_DIR_INFORMATION
'// FILE_ID_FULL_DIR_INFORMATION
'// FILE_BOTH_DIR_INFORMATION
'// FILE_ID_BOTH_DIR_INFORMATION
'// FILE_NAMES_INFORMATION
'// FILE_OBJECTID_INFORMATION
'//
' // Size = 72 bytes
TYPE FILE_DIRECTORY_INFORMATION ' Must be 8 byte aligned
 NextEntryOffset AS DWORD ' ULONG
 FileIndex AS DWORD ' ULONG
 CreationTime AS QUAD ' LARGE_INTEGER
 LastAccessTime AS QUAD ' LARGE_INTEGER
 LastWriteTime AS QUAD ' LARGE_INTEGER
 ChangeTime AS QUAD ' LARGE_INTEGER
 EndOfFile AS QUAD ' LARGE_INTEGER
 AllocationSize AS QUAD ' LARGE_INTEGER
 FileAttributes AS DWORD ' ULONG
 FileNameLength AS DWORD ' ULONG
 FileName AS WSTRINGZ * 4 ' WCHAR[1] -variable lenght-
 ' Note: We are using AS WSTRINGZ * 4 instead of * 1 to keep 8 byte alignment
END TYPE
' // Size = 72 bytes
TYPE FILE_FULL_DIR_INFORMATION ' Must be 8 byte aligned
 NextEntryOffset AS DWORD ' ULONG
 FileIndex AS DWORD ' ULONG
 CreationTime AS QUAD ' LARGE_INTEGER
 LastAccessTime AS QUAD ' LARGE_INTEGER
 LastWriteTime AS QUAD ' LARGE_INTEGER
 ChangeTime AS QUAD ' LARGE_INTEGER
 EndOfFile AS QUAD ' LARGE_INTEGER
 AllocationSize AS QUAD ' LARGE_INTEGER
 FileAttributes AS DWORD ' ULONG
 FileNameLength AS DWORD ' ULONG
 EaSize AS DWORD ' ULONG
 FileName AS WSTRINGZ * 2 ' WCHAR[1] -variable lenght-
 ' Note: We are using AS WSTRINGZ * 2 instead of * 1 to keep 8 byte alignment
END TYPE
' // Size = 88 bytes
TYPE FILE_ID_FULL_DIR_INFORMATION ' Must be 8 byte aligned
 NextEntryOffset AS DWORD ' ULONG
 FileIndex AS DWORD ' ULONG
 CreationTime AS QUAD ' LARGE_INTEGER
 LastAccessTime AS QUAD ' LARGE_INTEGER
 LastWriteTime AS QUAD ' LARGE_INTEGER
 ChangeTime AS QUAD ' LARGE_INTEGER
 EndOfFile AS QUAD ' LARGE_INTEGER
 AllocationSize AS QUAD ' LARGE_INTEGER
 FileAttributes AS DWORD ' ULONG
 FileNameLength AS DWORD ' ULONG
 EaSize AS DWORD ' ULONG
 alignment__ AS DWORD ' // To keep 8 byte alignment
 FileId AS QUAD ' LARGE_INTEGER
 FileName AS WSTRINGZ * 4 ' WCHAR[1] -variable lenght-
 ' Note: We are using AS WSTRINGZ * 4 instead of * 1 to keep 8 byte alignment
END TYPE
' // Size = 96 bytes
TYPE FILE_BOTH_DIR_INFORMATION QWORD FILL ' Must be 8 byte aligned
 NextEntryOffset AS DWORD ' ULONG
 FileIndex AS DWORD ' ULONG
 CreationTime AS QUAD ' LARGE_INTEGER
 LastAccessTime AS QUAD ' LARGE_INTEGER
 LastWriteTime AS QUAD ' LARGE_INTEGER
 ChangeTime AS QUAD ' LARGE_INTEGER
 EndOfFile AS QUAD ' LARGE_INTEGER
 AllocationSize AS QUAD ' LARGE_INTEGER
 FileAttributes AS DWORD ' ULONG
 FileNameLength AS DWORD ' ULONG
 EaSize AS DWORD ' ULONG
 ShortNameLength AS BYTE ' CCHAR
 alignment__(2) AS BYTE ' // To keep 8 byte alignment
 ShortName AS WSTRINGZ * 12 ' WCHAR[12]
 'FileName AS WSTRINGZ * 1 ' WCHAR[1] -variable lenght-
END TYPE
' // Size = 112 bytes
TYPE FILE_ID_BOTH_DIR_INFORMATION
 NextEntryOffset AS DWORD ' ULONG
 FileIndex AS DWORD ' ULONG
 CreationTime AS QUAD ' LARGE_INTEGER
 LastAccessTime AS QUAD ' LARGE_INTEGER
 LastWriteTime AS QUAD ' LARGE_INTEGER
 ChangeTime AS QUAD ' LARGE_INTEGER
 EndOfFile AS QUAD ' LARGE_INTEGER
 AllocationSize AS QUAD ' LARGE_INTEGER
 FileAttributes AS DWORD ' ULONG
 FileNameLength AS DWORD ' ULONG
 EaSize AS DWORD ' ULONG
 alignment__(2) AS BYTE ' // To keep 8 byte alignment
 ShortNameLength AS BYTE ' CCHAR
 ShortName AS WSTRINGZ * 12 ' WCHAR[12]
 FileId AS QUAD ' LARGE_INTEGER
 FileName AS WSTRINGZ * 4 ' WCHAR[1] -variable lenght-
 ' Note: We are using AS WSTRINGZ * 4 instead of * 1 to keep 8 byte alignment
END TYPE
' // Size = 16 bytes
TYPE FILE_NAMES_INFORMATION DWORD
 NextEntryOffset AS DWORD ' ULONG
 FileIndex AS DWORD ' ULONG
 FileNameLength AS DWORD ' ULONG
 FileName AS WSTRINGZ * 1 ' WCHAR[1]
END TYPE
' // Size = 96 bytes
TYPE FILE_ID_GLOBAL_TX_DIR_INFORMATION ' Must be 8 byte aligned
 NextEntryOffset AS DWORD ' ULONG
 FileIndex AS DWORD ' ULONG
 CreationTime AS QUAD ' LARGE_INTEGER
 LastAccessTime AS QUAD ' LARGE_INTEGER
 LastWriteTime AS QUAD ' LARGE_INTEGER
 ChangeTime AS QUAD ' LARGE_INTEGER
 EndOfFile AS QUAD ' LARGE_INTEGER
 AllocationSize AS QUAD ' LARGE_INTEGER
 FileAttributes AS DWORD ' ULONG
 FileNameLength AS DWORD ' ULONG
 FileId AS QUAD ' LARGE_INTEGER
 LockingTransactionId AS GUID ' GUID
 TxInfoFlags AS DWORD ' ULONG
 alignment__ AS DWORD ' // To keep 8 byute alignment
 'FileName AS WSTRINGZ * 1 ' WCHAR[1]
END TYPE
%EQUATE `FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_WRITELOCKED = &H00000001
%EQUATE `FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_TO_TX = &H00000002
%EQUATE `FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_OUTSIDE_TX = &H00000004
' // Size = 48 bytes ' Must be 8 byte aligned
TYPE FILE_OBJECTID_INFORMATION_DUMMYSTRUCTNAME
 BirthVolumeId(15) AS BYTE ' UCHAR[16]
 BirthObjectId(15) AS BYTE ' UCHAR[16]
 DomainId(15) AS BYTE ' UCHAR[16]
END TYPE
' // Size = 48 bytes ' Must be 8 byte aligned
UNION FILE_OBJECTID_INFORMATION_DUMMYUNIONNAME
 FILE_OBJECTID_INFORMATION_DUMMYSTRUCTNAME
 ExtendedInfo(47) AS BYTE ' UCHAR[48]
END UNION
' // Size = 72 bytes
TYPE FILE_OBJECTID_INFORMATION ' Must be 8 byte aligned
 FileReference AS QUAD ' LONGLONG
 ObjectId(15) AS BYTE ' UCHAR[16]
 FILE_OBJECTID_INFORMATION_DUMMYUNIONNAME
END TYPE
'//
'// The following constants provide addition meta characters to fully
'// support the more obscure aspects of DOS wild card processing.
'//
'#define ANSI_DOS_STAR ('<')
'#define ANSI_DOS_QM ('>')
'#define ANSI_DOS_DOT ('"')
'#define DOS_STAR (L'<')
'#define DOS_QM (L'>')
'#define DOS_DOT (L'"')
'//
'// NtQuery(Set)InformationFile return types:
'//
'// FILE_BASIC_INFORMATION
'// FILE_STANDARD_INFORMATION
'// FILE_INTERNAL_INFORMATION
'// FILE_EA_INFORMATION
'// FILE_ACCESS_INFORMATION
'// FILE_POSITION_INFORMATION
'// FILE_MODE_INFORMATION
'// FILE_ALIGNMENT_INFORMATION
'// FILE_NAME_INFORMATION
'// FILE_ALL_INFORMATION
'//
'// FILE_NETWORK_OPEN_INFORMATION
'//
'// FILE_ALLOCATION_INFORMATION
'// FILE_COMPRESSION_INFORMATION
'// FILE_DISPOSITION_INFORMATION
'// FILE_END_OF_FILE_INFORMATION
'// FILE_LINK_INFORMATION
'// FILE_MOVE_CLUSTER_INFORMATION
'// FILE_RENAME_INFORMATION
'// FILE_SHORT_NAME_INFORMATION
'// FILE_STREAM_INFORMATION
'// FILE_COMPLETION_INFORMATION
'//
'// FILE_PIPE_INFORMATION
'// FILE_PIPE_LOCAL_INFORMATION
'// FILE_PIPE_REMOTE_INFORMATION
'//
'// FILE_MAILSLOT_QUERY_INFORMATION
'// FILE_MAILSLOT_SET_INFORMATION
'// FILE_REPARSE_POINT_INFORMATION
'//
'// FILE_NETWORK_PHYSICAL_NAME_INFORMATION
'//
' // Size = 8 bytes
TYPE FILE_INTERNAL_INFORMATION ' Must be 8 byte aligned
 IndexNumber AS QUAD ' LARGE_INTEGER
END TYPE
' // Size = 4 bytes
TYPE FILE_EA_INFORMATION DWORD
 EaSize AS DWORD ' ULONG
END TYPE
' // Size = 4 bytes
TYPE FILE_ACCESS_INFORMATION DWORD
 AccessFlags AS ACCESS_MASK ' ACCESS_MASK
END TYPE
' // Size = 4 bytes
TYPE FILE_MODE_INFORMATION DWORD
 Mode AS DWORD ' ULONG
END TYPE
'typedef struct _FILE_ALL_INFORMATION {
' FILE_BASIC_INFORMATION BasicInformation;
' FILE_STANDARD_INFORMATION StandardInformation;
' FILE_INTERNAL_INFORMATION InternalInformation;
' FILE_EA_INFORMATION EaInformation;
' FILE_ACCESS_INFORMATION AccessInformation;
' FILE_POSITION_INFORMATION PositionInformation;
' FILE_MODE_INFORMATION ModeInformation;
' FILE_ALIGNMENT_INFORMATION AlignmentInformation;
' FILE_NAME_INFORMATION NameInformation;
'} FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
' From wdm.h
'//
'// Define the various structures which are returned on query operations
'//
' // Size = 40 bytes
TYPE FILE_BASIC_INFORMATION ' Must be 8 byte aligned
 CreationTime AS QUAD ' LARGE_INTEGER
 LastAccessTime AS QUAD ' LARGE_INTEGER
 LastWriteTime AS QUAD ' LARGE_INTEGER
 ChangeTime AS QUAD ' LARGE_INTEGER
 FileAttributes AS DWORD ' ULONG
 alignment__ AS DWORD ' // To keep 8 bytes alignment
END TYPE
' // Size = 24 bytes
TYPE FILE_STANDARD_INFORMATION ' Must be 8 byte aligned
 AllocationSize AS QUAD ' LARGE_INTEGER
 EndOfFile AS QUAD ' LARGE_INTEGER
 NumberOfLinks AS DWORD ' ULONG
 DeletePending AS BYTE ' BOOLEAN
 Directory AS BYTE ' BOOLEAN
 alignment__ AS WORD ' // To keep 8 byte alignment
END TYPE
' // Size = 8 bytes
TYPE FILE_POSITION_INFORMATION ' Must be 8 byte aligned
 CurrentByteOffset AS QUAD ' LARGE_INTEGER
END TYPE
' // Size = 4 bytes
TYPE FILE_ALIGNMENT_INFORMATION DWORD
 AlignmentRequirement AS DWORD ' ULONG
END TYPE
TYPE FILE_NAME_INFORMATION DWORD
 FileNameLength AS DWORD ' ULONG
 FileName AS WSTRINGZ * 1 ' WCHAR[1]
END TYPE
' // Size = 104 bytes
TYPE FILE_ALL_INFORMATION
 BasicInformation AS FILE_BASIC_INFORMATION
 StandardInformation AS FILE_STANDARD_INFORMATION
 InternalInformation AS FILE_INTERNAL_INFORMATION
 EaInformation AS FILE_EA_INFORMATION
 AccessInformation AS FILE_ACCESS_INFORMATION
 PositionInformation AS FILE_POSITION_INFORMATION
 ModeInformation AS FILE_MODE_INFORMATION
 AlignmentInformation AS FILE_ALIGNMENT_INFORMATION
 NameInformation AS FILE_NAME_INFORMATION
END TYPE
' // Size = 8 bytes
TYPE FILE_ALLOCATION_INFORMATION ' Must be 8 byte aligned
 AllocationSize AS QUAD ' LARGE_INTEGER
END TYPE
' // Size = 16 bytes
TYPE FILE_COMPRESSION_INFORMATION ' Must be 8 byte aligned
 CompressedFileSize AS QUAD ' LARGE_INTEGER
 CompressionFormat AS WORD ' USHORT
 CompressionUnitShift AS BYTE ' UCHAR
 ChunkShift AS BYTE ' UCHAR
 ClusterShift AS BYTE ' UCHAR
 Reserved(2) AS BYTE ' UCHAR[3]
END TYPE
'#ifdef _MAC
'#pragma warning( disable : 4121)
'#endif
' // Size = 16 bytes
TYPE FILE_LINK_INFORMATION DWORD
 ReplaceIfExists AS BYTE ' BOOLEAN
 RootDirectory AS DWORD
 FileNameLength AS DWORD ' ULONG
 FileName AS WSTRINGZ * 1 ' WCHAR[1]
END TYPE
'#ifdef _MAC
'#pragma warning( default : 4121 )
'#endif
' // Size = 16 bytes
TYPE FILE_MOVE_CLUSTER_INFORMATION DWORD
 ClusterCount AS DWORD ' ULONG
 RootDirectory AS DWORD
 FileNameLength AS DWORD ' ULONG
 FileName AS WSTRINGZ * 1 ' WCHAR[1]
END TYPE
'#ifdef _MAC
'#pragma warning( disable : 4121)
'#endif
' // Size = 16 bytes
TYPE FILE_RENAME_INFORMATION DWORD
 ReplaceIfExists AS BYTE ' BOOLEAN
 RootDirectory AS DWORD
 FileNameLength AS DWORD ' ULONG
 FileName AS WSTRINGZ * 1 ' WCHAR[1]
END TYPE
'#ifdef _MAC
'#pragma warning( default : 4121 )
'#endif
' // Size = 32 bytes
TYPE FILE_STREAM_INFORMATION ' Must be 8 byte aligned
 NextEntryOffset AS DWORD ' ULONG
 StreamNameLength AS DWORD ' ULONG
 StreamSize AS QUAD ' LARGE_INTEGER
 StreamAllocationSize AS QUAD ' LARGE_INTEGER
 StreamName AS WSTRINGZ * 4 ' WCHAR[1]
 ' Note: We are using AS WSTRINGZ * 4 instead of * 1 to keep 8 byte alignment
END TYPE
' // Size = 12 bytes
TYPE FILE_TRACKING_INFORMATION DWORD
 DestinationFile AS DWORD
 ObjectInformationLength AS DWORD ' ULONG
 ObjectInformation(0) AS BYTE ' CHAR[1]
END TYPE
' // Size = 8 bytes
TYPE FILE_COMPLETION_INFORMATION DWORD
 Port AS DWORD
 Key AS DWORD
END TYPE
' // Size = 8 bytes
TYPE FILE_PIPE_INFORMATION DWORD
 ReadMode AS DWORD ' ULONG
 CompletionMode AS DWORD ' ULONG
END TYPE
' // Size = 40 bytes
TYPE FILE_PIPE_LOCAL_INFORMATION DWORD
 NamedPipeType AS DWORD ' ULONG
 NamedPipeConfiguration AS DWORD ' ULONG
 MaximumInstances AS DWORD ' ULONG
 CurrentInstances AS DWORD ' ULONG
 InboundQuota AS DWORD ' ULONG
 ReadDataAvailable AS DWORD ' ULONG
 OutboundQuota AS DWORD ' ULONG
 WriteQuotaAvailable AS DWORD ' ULONG
 NamedPipeState AS DWORD ' ULONG
 NamedPipeEnd AS DWORD ' ULONG
END TYPE
' // Size = 16 bytes
TYPE FILE_PIPE_REMOTE_INFORMATION QWORD ' Must be 8 byte aligned
 CollectDataTime AS QUAD ' LARGE_INTEGER
 MaximumCollectionCount AS DWORD ' ULONG
END TYPE
' // Size = 24 bytes
TYPE FILE_MAILSLOT_QUERY_INFORMATION ' Must be 8 byte aligned
 MaximumMessageSize AS DWORD ' ULONG
 MailslotQuota AS DWORD ' ULONG
 NextMessageSize AS DWORD ' ULONG
 MessagesAvailable AS DWORD ' ULONG
 ReadTimeout AS QUAD ' LARGE_INTEGER
END TYPE
' // Size = 4 bytes
TYPE FILE_MAILSLOT_SET_INFORMATION DWORD
 ReadTimeout AS QUAD PTR ' PLARGE_INTEGER
END TYPE
' // Size = 16 bytes
TYPE FILE_REPARSE_POINT_INFORMATION QWORD ' Must be 8 byte aligned
 FileReference AS QUAD ' LONGLONG
 Tag AS DWORD ' ULONG
END TYPE
' // Size = 24 bytes
TYPE FILE_LINK_ENTRY_INFORMATION QWORD ' Must be 8 byte aligned
 NextEntryOffset AS DWORD ' ULONG
 ParentFileId AS QUAD ' LONGLONG
 FileNameLength AS DWORD ' ULONG
 ' FileName AS WSTRINGZ * 1 ' WCHAR[1]
END TYPE
' // Size = 32 bytes
TYPE FILE_LINKS_INFORMATION ' Must be 8 byte aligned
 BytesNeeded AS DWORD ' ULONG
 EntriesReturned AS DWORD ' ULONG
 Entry AS FILE_LINK_ENTRY_INFORMATION
END TYPE
' // Size = 8 bytes
TYPE FILE_NETWORK_PHYSICAL_NAME_INFORMATION DWORD
 FileNameLength AS DWORD ' ULONG
 FileName AS WSTRINGZ * 1 ' WCHAR[1]
END TYPE
' // Size = 12 bytes
TYPE FILE_STANDARD_LINK_INFORMATION ' Must be 4 byte aligned
 NumberOfAccessibleLinks AS DWORD ' ULONG
 TotalNumberOfLinks AS DWORD ' ULONG
 DeletePending AS BYTE ' BOOLEAN
 Directory AS BYTE ' BOOLEAN
 alignment__ AS WORD ' // To keep 4 byte alignment
END TYPE
'//
'// NtQuery(Set)EaFile
'//
'// The offset for the start of EaValue is EaName[EaNameLength + 1]
'//
'// begin_wdm
' // Size = 8 bytes
TYPE FILE_GET_EA_INFORMATION ' Must be 4 bute aligned
 NextEntryOffset AS DWORD ' ULONG
 EaNameLength AS BYTE ' UCHAR
 alignment__(2) AS BYTE ' // To keep 4 byte alignment
 'EaName AS ASCIIZ * 1 ' CHAR[1]
END TYPE
'//
'// File Remote protocol information (FileRemoteProtocolInformation)
'//
%EQUATE `REMOTE_PROTOCOL_FLAG_LOOPBACK = &H00000001
%EQUATE `REMOTE_PROTOCOL_FLAG_OFFLINE = &H00000002
' // Size = 32 bytes
TYPE FILE_REMOTE_PROTOCOL_INFORMATION_GenericReserved
 Reserved(7) AS DWORD ' ULONG[8]
END TYPE
' // Size = 64 bytes
TYPE FILE_REMOTE_PROTOCOL_INFORMATION_ProtocolSpecificReserved
 Reserved(15) AS DWORD ' ULONG[16]
END TYPE
' // Size = 116 bytes
TYPE FILE_REMOTE_PROTOCOL_INFORMATION
 ' // Structure Version
 StructureVersion AS WORD ' USHORT // 1
 StructureSize AS WORD ' USHORT // sizeof(FILE_REMOTE_PROTOCOL_INFORMATION)
 Protocol AS DWORD ' ULONG // Protocol (WNNC_NET_*) defined in winnetwk.h or ntifs.h.
 ' // Protocol Version & Type
 ProtocolMajorVersion AS WORD ' USHORT
 ProtocolMinorVersion AS WORD ' USHORT
 ProtocolRevision AS WORD ' USHORT
 Reserved AS WORD ' USHORT
 ' // Protocol-Generic Information
 Flags AS DWORD ' ULONG
 GenericReserved AS FILE_REMOTE_PROTOCOL_INFORMATION_GenericReserved
 ' // Protocol specific information
 ProtocolSpecificReserved AS FILE_REMOTE_PROTOCOL_INFORMATION_ProtocolSpecificReserved
END TYPE
'//
'// NtQuery(Set)QuotaInformationFile
'//
' // Size = 20 bytes
TYPE FILE_GET_QUOTA_INFORMATION DWORD
 NextEntryOffset AS DWORD ' ULONG
 SidLength AS DWORD ' ULONG
 Sid AS SID ' SID
END TYPE
' // Size = 56 bytes
TYPE FILE_QUOTA_INFORMATION ' Must be 8 byte aligned
 NextEntryOffset AS DWORD ' ULONG
 SidLength AS DWORD ' ULONG
 ChangeTime AS QUAD ' LARGE_INTEGER
 QuotaUsed AS QUAD ' LARGE_INTEGER
 QuotaThreshold AS QUAD ' LARGE_INTEGER
 QuotaLimit AS QUAD ' LARGE_INTEGER
 Sid AS SID ' SID
 alignment__ AS DWORD ' // To keep 8 byte alignment
END TYPE
' // Size = 16 bytes
TYPE FILE_FS_ATTRIBUTE_INFORMATION DWORD
 FileSystemAttributes AS DWORD ' ULONG
 MaximumComponentNameLength AS LONG
 FileSystemNameLength AS DWORD ' ULONG
 FileSystemName AS WSTRINGZ * 1 ' WCHAR[1]
END TYPE
' // Size = 12 bytes
TYPE FILE_FS_DRIVER_PATH_INFORMATION DWORD
 DriverInPath AS BYTE ' BOOLEAN
 DriverNameLength AS DWORD ' ULONG
 DriverName AS WSTRINGZ * 1 ' WCHAR[1]
END TYPE
TYPE FILE_FS_VOLUME_FLAGS_INFORMATION DWORD
 Flags AS DWORD ' ULONG
END TYPE
'//
'// File system control flags
'//
%EQUATE `FILE_VC_QUOTA_NONE = &H00000000
%EQUATE `FILE_VC_QUOTA_TRACK = &H00000001
%EQUATE `FILE_VC_QUOTA_ENFORCE = &H00000002
%EQUATE `FILE_VC_QUOTA_MASK = &H00000003
%EQUATE `FILE_VC_CONTENT_INDEX_DISABLED = &H00000008
%EQUATE `FILE_VC_LOG_QUOTA_THRESHOLD = &H00000010
%EQUATE `FILE_VC_LOG_QUOTA_LIMIT = &H00000020
%EQUATE `FILE_VC_LOG_VOLUME_THRESHOLD = &H00000040
%EQUATE `FILE_VC_LOG_VOLUME_LIMIT = &H00000080
%EQUATE `FILE_VC_QUOTAS_INCOMPLETE = &H00000100
%EQUATE `FILE_VC_QUOTAS_REBUILDING = &H00000200
%EQUATE `FILE_VC_VALID_MASK = &H000003ff
' // Size = 48 bytes
TYPE FILE_FS_CONTROL_INFORMATION QWORD ' Must be 8 byte aligned
 FreeSpaceStartFiltering AS QUAD ' LARGE_INTEGER
 FreeSpaceThreshold AS QUAD ' LARGE_INTEGER
 FreeSpaceStopFiltering AS QUAD ' LARGE_INTEGER
 DefaultQuotaThreshold AS QUAD ' LARGE_INTEGER
 DefaultQuotaLimit AS QUAD ' LARGE_INTEGER
 FileSystemControlFlags AS DWORD ' ULONG
END TYPE
#IF NOT %DEF(%IO_STATUS_BLOCK_DEFINED)
 %IO_STATUS_BLOCK_DEFINED = 1
' // Size = 4 bytes
UNION IO_STATUS_BLOCK_DUMMYUNIONNAME DWORD
 Status AS LONG ' NTSTATUS
 Pointer AS DWORD
END UNION
' // Size = 8 bytes
TYPE IO_STATUS_BLOCK DWORD
 IO_STATUS_BLOCK_DUMMYUNIONNAME
 Information AS DWORD ' ULONG_PTR
END TYPE
'#if defined(_WIN64)
'typedef struct _IO_STATUS_BLOCK32 {
' NTSTATUS Status;
' ULONG Information;
'} IO_STATUS_BLOCK32, *PIO_STATUS_BLOCK32;
'#endif
#ENDIF
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtCreateFile LIB "ntdll.dll" ALIAS "NtCreateFile" ( BYREF FileHandle AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYREF ObjectAttributes AS OBJECT_ATTRIBUTES , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYVAL AllocationSize AS QUAD , BYVAL FileAttributes AS QUAD , BYVAL ShareAccess AS QUAD , BYVAL CreateDisposition AS QUAD , BYVAL CreateOptions AS QUAD , BYVAL EaBuffer AS QUAD , BYVAL EaLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'typedef
'(NTAPI *PIO_APC_ROUTINE) (
' );
'SUB IO_APC_ROUTINE (BYVAL ApcContext AS DWORD, BYREF IoStatusBlock AS IO_STATUS_BLOCK, BYVAL Reserved AS DWORD)
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtDeviceIoControlFile LIB "ntdll.dll" ALIAS "NtDeviceIoControlFile" ( BYVAL FileHandle AS QUAD , BYVAL Event AS QUAD , BYREF ApcRoutine AS QUAD , BYVAL ApcContext AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYVAL IoControlCode AS QUAD , BYVAL InputBuffer AS QUAD , BYVAL InputBufferLength AS QUAD , BYREF OutputBuffer AS ANY , BYVAL OutputBufferLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtFsControlFile LIB "ntdll.dll" ALIAS "NtFsControlFile" ( BYVAL FileHandle AS QUAD , BYVAL Event AS QUAD , BYREF ApcRoutine AS QUAD , BYVAL ApcContext AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYVAL FsControlCode AS QUAD , BYVAL InputBuffer AS QUAD , BYVAL InputBufferLength AS QUAD , BYREF OutputBuffer AS ANY , BYVAL OutputBufferLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtLockFile LIB "ntdll.dll" ALIAS "NtLockFile" ( BYVAL FileHandle AS QUAD , BYVAL Event AS QUAD , BYREF ApcRoutine AS QUAD , BYVAL ApcContext AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYVAL ByteOffset AS QUAD , BYVAL Length AS QUAD , BYVAL Key AS QUAD , BYVAL FailImmediately AS BYTE , BYVAL ExclusiveLock AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtOpenFile LIB "ntdll.dll" ALIAS "NtOpenFile" ( BYREF FileHandle AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYREF ObjectAttributes AS OBJECT_ATTRIBUTES , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYVAL ShareAccess AS QUAD , BYVAL OpenOptions AS QUAD ) AS LONG ' NTSTATUS
'#endif
' From wdm.h
'//
'// Define the file information class values
'//
'// WARNING: The order of the following values are assumed by the I/O system.
'// Any changes made here should be reflected there as well.
'//
' enum _FILE_INFORMATION_CLASS
%EQUATE `FileDirectoryInformation = 1
%EQUATE `FileFullDirectoryInformation = 2
%EQUATE `FileBothDirectoryInformation = 3
%EQUATE `FileBasicInformation = 4
%EQUATE `FileStandardInformation = 5
%EQUATE `FileInternalInformation = 6
%EQUATE `FileEaInformation = 7
%EQUATE `FileAccessInformation = 8
%EQUATE `FileNameInformation = 9
%EQUATE `FileRenameInformation = 10
%EQUATE `FileLinkInformation = 11
%EQUATE `FileNamesInformation = 12
%EQUATE `FileDispositionInformation = 13
%EQUATE `FilePositionInformation = 14
%EQUATE `FileFullEaInformation = 15
%EQUATE `FileModeInformation = 16
%EQUATE `FileAlignmentInformation = 17
%EQUATE `FileAllInformation = 18
%EQUATE `FileAllocationInformation = 19
%EQUATE `FileEndOfFileInformation = 20
%EQUATE `FileAlternateNameInformation = 21
%EQUATE `FileStreamInformation = 22
%EQUATE `FilePipeInformation = 23
%EQUATE `FilePipeLocalInformation = 24
%EQUATE `FilePipeRemoteInformation = 25
%EQUATE `FileMailslotQueryInformation = 26
%EQUATE `FileMailslotSetInformation = 27
%EQUATE `FileCompressionInformation = 28
%EQUATE `FileObjectIdInformation = 29
%EQUATE `FileCompletionInformation = 30
%EQUATE `FileMoveClusterInformation = 31
%EQUATE `FileQuotaInformation = 32
%EQUATE `FileReparsePointInformation = 33
%EQUATE `FileNetworkOpenInformation = 34
%EQUATE `FileAttributeTagInformation = 35
%EQUATE `FileTrackingInformation = 36
%EQUATE `FileIdBothDirectoryInformation = 37
%EQUATE `FileIdFullDirectoryInformation = 38
%EQUATE `FileValidDataLengthInformation = 39
%EQUATE `FileShortNameInformation = 40
%EQUATE `FileIoCompletionNotificationInformation = 41
%EQUATE `FileIoStatusBlockRangeInformation = 42
%EQUATE `FileIoPriorityHintInformation = 43
%EQUATE `FileSfioReserveInformation = 44
%EQUATE `FileSfioVolumeInformation = 45
%EQUATE `FileHardLinkInformation = 46
%EQUATE `FileProcessIdsUsingFileInformation = 47
%EQUATE `FileNormalizedNameInformation = 48
%EQUATE `FileNetworkPhysicalNameInformation = 49
%EQUATE `FileIdGlobalTxDirectoryInformation = 50
%EQUATE `FileIsRemoteDeviceInformation = 51
%EQUATE `FileAttributeCacheInformation = 52
%EQUATE `FileNumaNodeInformation = 53
%EQUATE `FileStandardLinkInformation = 54
%EQUATE `FileRemoteProtocolInformation = 55
%EQUATE `FileMaximumInformation = 56
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtQueryDirectoryFile LIB "ntdll.dll" ALIAS "NtQueryDirectoryFile" ( BYVAL FileHandle AS QUAD , BYVAL Event AS QUAD , BYVAL ApcRoutine AS QUAD , BYVAL ApcContext AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF FileInformation AS ANY , BYVAL Length AS QUAD , BYVAL FileInformationClass AS LONG , BYVAL ReturnSingleEntry AS BYTE , BYREF FileName AS UNICODE_STRING , BYVAL RestartScan AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtQueryInformationFile LIB "ntdll.dll" ALIAS "NtQueryInformationFile" ( BYVAL FileHandle AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF FileInformation AS ANY , BYVAL Length AS QUAD , BYVAL FileInformationClass AS LONG ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtQueryQuotaInformationFile LIB "ntdll.dll" ALIAS "NtQueryQuotaInformationFile" ( BYVAL FileHandle AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF Buffer AS ANY , BYVAL Length AS QUAD , BYVAL ReturnSingleEntry AS BYTE , BYVAL SidList AS QUAD , BYVAL SidListLength AS QUAD , BYVAL StartSid AS SID PTR , BYVAL RestartScan AS BYTE ) AS LONG ' NTSTATUS
'#endif
' From wdm.h
'//
'// Define the file system information class values
'//
'// WARNING: The order of the following values are assumed by the I/O system.
'// Any changes made here should be reflected there as well.
' enum _FSINFOCLASS
%EQUATE `FileFsVolumeInformation = 1
%EQUATE `FileFsLabelInformation = 2
%EQUATE `FileFsSizeInformation = 3
%EQUATE `FileFsDeviceInformation = 4
%EQUATE `FileFsAttributeInformation = 5
%EQUATE `FileFsControlInformation = 6
%EQUATE `FileFsFullSizeInformation = 7
%EQUATE `FileFsObjectIdInformation = 8
%EQUATE `FileFsDriverPathInformation = 9
%EQUATE `FileFsVolumeFlagsInformation = 10
%EQUATE `FileFsMaximumInformation = 11
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtQueryVolumeInformationFile LIB "ntdll.dll" ALIAS "NtQueryVolumeInformationFile" ( BYVAL FileHandle AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF FsInformation AS ANY , BYVAL Length AS QUAD , BYVAL FsInformationClass AS LONG ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtReadFile LIB "ntdll.dll" ALIAS "NtReadFile" ( BYVAL FileHandle AS QUAD , BYVAL Event AS QUAD , BYVAL ApcRoutine AS QUAD , BYVAL ApcContext AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF Buffer AS ANY , BYVAL Length AS QUAD , BYVAL ByteOffset AS QUAD , BYVAL Key AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtSetInformationFile LIB "ntdll.dll" ALIAS "NtSetInformationFile" ( BYVAL FileHandle AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF FsInformation AS ANY , BYVAL Length AS QUAD , BYVAL FileInformationClass AS LONG ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtSetQuotaInformationFile LIB "ntdll.dll" ALIAS "NtSetQuotaInformationFile" ( BYVAL FileHandle AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF Buffer AS ANY , BYVAL Length AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtSetVolumeInformationFile LIB "ntdll.dll" ALIAS "NtSetVolumeInformationFile" ( BYVAL FileHandle AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF FsInformation AS ANY , BYVAL Length AS QUAD , BYVAL FsInformationClass AS LONG ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtWriteFile LIB "ntdll.dll" ALIAS "NtWriteFile" ( BYVAL FileHandle AS QUAD , BYVAL Event AS QUAD , BYVAL ApcRoutine AS QUAD , BYVAL ApcContext AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF Buffer AS ANY , BYVAL Length AS QUAD , BYVAL ByteOffset AS QUAD , BYVAL Key AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtUnlockFile LIB "ntdll.dll" ALIAS "NtUnlockFile" ( BYVAL FileHandle AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYVAL ByteOffset AS QUAD , BYVAL Length AS QUAD , BYVAL Key AS QUAD ) AS LONG ' NTSTATUS
'#endif
'//
'// Macro definition for defining IOCTL and FSCTL function control codes. Note
'// that function codes 0-2047 are reserved for Microsoft Corporation, and
'// 2048-4095 are reserved for customers.
'//
'// These macros are defined in devioctl.h which contains the portable IO
'// definitions (for use by both DOS and NT)
'//
'//
'// The IoGetFunctionCodeFromCtlCode( ControlCode ) Macro is defined in io.h
'// This macro is used to extract the function code from an IOCTL (or FSCTL).
'// The macro can only be used in kernel mode code.
'//
'//
'// General File System control codes - Note that these values are valid
'// regardless of the actual file system type
'//
'//
'// IMPORTANT: These values have been arranged in order of increasing
'// control codes. Do NOT breaks this!! Add all new codes
'// at end of list regardless of functionality type.
'//
'// Note: FSCTL_QUERY_RETRIEVAL_POINTER and FSCTL_MARK_AS_SYSTEM_HIVE only
'// work from Kernel mode on local paging files or the system hives.
'//
'// begin_winioctl
'#ifndef _FILESYSTEMFSCTL_
'#define _FILESYSTEMFSCTL_
'//
'// The following is a list of the native file system fsctls followed by
'// additional network file system fsctls. Some values have been
'// decommissioned.
'//
'#define FSCTL_REQUEST_OPLOCK_LEVEL_1 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_REQUEST_OPLOCK_LEVEL_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_REQUEST_BATCH_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 3, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_OPLOCK_BREAK_NOTIFY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 5, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_LOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_UNLOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_DISMOUNT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
'// decommissioned fsctl value 9
'#define FSCTL_IS_VOLUME_MOUNTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_IS_PATHNAME_VALID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS) // PATHNAME_BUFFER,
'#define FSCTL_MARK_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
'// decommissioned fsctl value 13
'#define FSCTL_QUERY_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER, FILE_ANY_ACCESS)
'#define FSCTL_GET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_SET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
'// decommissioned fsctl value 17
'// decommissioned fsctl value 18
'#define FSCTL_SET_BOOTLOADER_ACCESSED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS)
'#define FSCTL_OPLOCK_BREAK_ACK_NO_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_INVALIDATE_VOLUMES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_QUERY_FAT_BPB CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS) // FSCTL_QUERY_FAT_BPB_BUFFER
'#define FSCTL_REQUEST_FILTER_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILESYSTEM_STATISTICS
'#if (_WIN32_WINNT >= 0x0400)
'#define FSCTL_GET_NTFS_VOLUME_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS) // NTFS_VOLUME_DATA_BUFFER
'#define FSCTL_GET_NTFS_FILE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS) // NTFS_FILE_RECORD_INPUT_BUFFER, NTFS_FILE_RECORD_OUTPUT_BUFFER
'#define FSCTL_GET_VOLUME_BITMAP CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER, FILE_ANY_ACCESS) // STARTING_LCN_INPUT_BUFFER, VOLUME_BITMAP_BUFFER
'#define FSCTL_GET_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER, FILE_ANY_ACCESS) // STARTING_VCN_INPUT_BUFFER, RETRIEVAL_POINTERS_BUFFER
'#define FSCTL_MOVE_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // MOVE_FILE_DATA,
'#define FSCTL_IS_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
'// decomissioned fsctl value 31
'#define FSCTL_ALLOW_EXTENDED_DASD_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER, FILE_ANY_ACCESS)
'#endif /* _WIN32_WINNT >= 0x0400 */
'#if (_WIN32_WINNT >= 0x0500)
'// decommissioned fsctl value 33
'// decommissioned fsctl value 34
'#define FSCTL_FIND_FILES_BY_SID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS)
'// decommissioned fsctl value 36
'// decommissioned fsctl value 37
'#define FSCTL_SET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // FILE_OBJECTID_BUFFER
'#define FSCTL_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_OBJECTID_BUFFER
'#define FSCTL_DELETE_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
'#define FSCTL_SET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // REPARSE_DATA_BUFFER,
'#define FSCTL_GET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS) // REPARSE_DATA_BUFFER
'#define FSCTL_DELETE_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // REPARSE_DATA_BUFFER,
'#define FSCTL_ENUM_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER, FILE_ANY_ACCESS) // MFT_ENUM_DATA,
'#define FSCTL_SECURITY_ID_CHECK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45, METHOD_NEITHER, FILE_READ_DATA) // BULK_SECURITY_TEST_DATA,
'#define FSCTL_READ_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46, METHOD_NEITHER, FILE_ANY_ACCESS) // READ_USN_JOURNAL_DATA, USN
'#define FSCTL_SET_OBJECT_ID_EXTENDED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
'#define FSCTL_CREATE_OR_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_OBJECTID_BUFFER
'#define FSCTL_SET_SPARSE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
'#define FSCTL_SET_ZERO_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA) // FILE_ZERO_DATA_INFORMATION,
'#define FSCTL_QUERY_ALLOCATED_RANGES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51, METHOD_NEITHER, FILE_READ_DATA) // FILE_ALLOCATED_RANGE_BUFFER, FILE_ALLOCATED_RANGE_BUFFER
'#define FSCTL_ENABLE_UPGRADE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA)
'// decommissioned fsctl value 52
'#define FSCTL_SET_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_NEITHER, FILE_ANY_ACCESS) // ENCRYPTION_BUFFER, DECRYPTION_STATUS_BUFFER
'#define FSCTL_ENCRYPTION_FSCTL_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54, METHOD_NEITHER, FILE_ANY_ACCESS)
'#define FSCTL_WRITE_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55, METHOD_NEITHER, FILE_SPECIAL_ACCESS) // ENCRYPTED_DATA_INFO, EXTENDED_ENCRYPTED_DATA_INFO
'#define FSCTL_READ_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56, METHOD_NEITHER, FILE_SPECIAL_ACCESS) // REQUEST_RAW_ENCRYPTED_DATA, ENCRYPTED_DATA_INFO, EXTENDED_ENCRYPTED_DATA_INFO
'#define FSCTL_CREATE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57, METHOD_NEITHER, FILE_ANY_ACCESS) // CREATE_USN_JOURNAL_DATA,
'#define FSCTL_READ_FILE_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58, METHOD_NEITHER, FILE_ANY_ACCESS) // Read the Usn Record for a file
'#define FSCTL_WRITE_USN_CLOSE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59, METHOD_NEITHER, FILE_ANY_ACCESS) // Generate Close Usn Record
'#define FSCTL_EXTEND_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_QUERY_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_DELETE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_MARK_HANDLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_SIS_COPYFILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_SIS_LINK_FILES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
'// decommissional fsctl value 66
'// decommissioned fsctl value 67
'// decommissioned fsctl value 68
'#define FSCTL_RECALL_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS)
'// decommissioned fsctl value 70
'#define FSCTL_READ_FROM_PLEX CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA)
'#define FSCTL_FILE_PREFETCH CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // FILE_PREFETCH
'#endif /* _WIN32_WINNT >= 0x0500 */
'#if (_WIN32_WINNT >= 0x0600)
'#define FSCTL_MAKE_MEDIA_COMPATIBLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 76, METHOD_BUFFERED, FILE_WRITE_DATA) // UDFS R/W
'#define FSCTL_SET_DEFECT_MANAGEMENT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 77, METHOD_BUFFERED, FILE_WRITE_DATA) // UDFS R/W
'#define FSCTL_QUERY_SPARING_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 78, METHOD_BUFFERED, FILE_ANY_ACCESS) // UDFS R/W
'#define FSCTL_QUERY_ON_DISK_VOLUME_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 79, METHOD_BUFFERED, FILE_ANY_ACCESS) // C/UDFS
'#define FSCTL_SET_VOLUME_COMPRESSION_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 80, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // VOLUME_COMPRESSION_STATE
'// decommissioned fsctl value 80
'#define FSCTL_TXFS_MODIFY_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 81, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
'#define FSCTL_TXFS_QUERY_RM_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 82, METHOD_BUFFERED, FILE_READ_DATA) // TxF
'// decommissioned fsctl value 83
'#define FSCTL_TXFS_ROLLFORWARD_REDO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 84, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
'#define FSCTL_TXFS_ROLLFORWARD_UNDO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 85, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
'#define FSCTL_TXFS_START_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 86, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
'#define FSCTL_TXFS_SHUTDOWN_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 87, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
'#define FSCTL_TXFS_READ_BACKUP_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 88, METHOD_BUFFERED, FILE_READ_DATA) // TxF
'#define FSCTL_TXFS_WRITE_BACKUP_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 89, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
'#define FSCTL_TXFS_CREATE_SECONDARY_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 90, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
'#define FSCTL_TXFS_GET_METADATA_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 91, METHOD_BUFFERED, FILE_READ_DATA) // TxF
'#define FSCTL_TXFS_GET_TRANSACTED_VERSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 92, METHOD_BUFFERED, FILE_READ_DATA) // TxF
'// decommissioned fsctl value 93
'#define FSCTL_TXFS_SAVEPOINT_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 94, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
'#define FSCTL_TXFS_CREATE_MINIVERSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 95, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF
'// decommissioned fsctl value 96
'// decommissioned fsctl value 97
'// decommissioned fsctl value 98
'#define FSCTL_TXFS_TRANSACTION_ACTIVE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 99, METHOD_BUFFERED, FILE_READ_DATA) // TxF
'#define FSCTL_SET_ZERO_ON_DEALLOCATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 101, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
'#define FSCTL_SET_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 102, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_GET_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 103, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_WAIT_FOR_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 104, METHOD_BUFFERED, FILE_ANY_ACCESS)
'// decommissioned fsctl value 105
'#define FSCTL_INITIATE_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 106, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_CSC_INTERNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 107, METHOD_NEITHER, FILE_ANY_ACCESS) // CSC internal implementation
'#define FSCTL_SHRINK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 108, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // SHRINK_VOLUME_INFORMATION
'#define FSCTL_SET_SHORT_NAME_BEHAVIOR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 109, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_DFSR_SET_GHOST_HANDLE_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 110, METHOD_BUFFERED, FILE_ANY_ACCESS)
'//
'// Values 111 - 119 are reserved for FSRM.
'//
'#define FSCTL_TXFS_LIST_TRANSACTION_LOCKED_FILES \
' CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_READ_DATA) // TxF
'#define FSCTL_TXFS_LIST_TRANSACTIONS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 121, METHOD_BUFFERED, FILE_READ_DATA) // TxF
'#define FSCTL_QUERY_PAGEFILE_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 122, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#endif /* _WIN32_WINNT >= 0x0600 */
'#if (_WIN32_WINNT >= 0x0600)
'#define FSCTL_RESET_VOLUME_ALLOCATION_HINTS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 123, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#endif /* _WIN32_WINNT >= 0x0600 */
'#if (_WIN32_WINNT >= 0x0601)
'#define FSCTL_QUERY_DEPENDENT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 124, METHOD_BUFFERED, FILE_ANY_ACCESS) // Dependency File System Filter
'#define FSCTL_SD_GLOBAL_CHANGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 125, METHOD_BUFFERED, FILE_ANY_ACCESS) // Update NTFS Security Descriptors
'#endif /* _WIN32_WINNT >= 0x0601 */
'#if (_WIN32_WINNT >= 0x0600)
'#define FSCTL_TXFS_READ_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 126, METHOD_BUFFERED, FILE_ANY_ACCESS) // TxF
'#endif /* _WIN32_WINNT >= 0x0600 */
'#if (_WIN32_WINNT >= 0x0601)
'#define FSCTL_LOOKUP_STREAM_FROM_CLUSTER CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 127, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_TXFS_WRITE_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 128, METHOD_BUFFERED, FILE_ANY_ACCESS) // TxF
'#define FSCTL_FILE_TYPE_NOTIFICATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 129, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#endif
'//
'// Values 130 - 130 are available
'//
'//
'// Values 131 - 139 are reserved for FSRM.
'//
'#if (_WIN32_WINNT >= 0x0601)
'#define FSCTL_GET_BOOT_AREA_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 140, METHOD_BUFFERED, FILE_ANY_ACCESS) // BOOT_AREA_INFO
'#define FSCTL_GET_RETRIEVAL_POINTER_BASE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 141, METHOD_BUFFERED, FILE_ANY_ACCESS) // RETRIEVAL_POINTER_BASE
'#define FSCTL_SET_PERSISTENT_VOLUME_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 142, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_FS_PERSISTENT_VOLUME_INFORMATION
'#define FSCTL_QUERY_PERSISTENT_VOLUME_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 143, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_FS_PERSISTENT_VOLUME_INFORMATION
'#define FSCTL_REQUEST_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 144, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_CSV_TUNNEL_REQUEST CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 145, METHOD_BUFFERED, FILE_ANY_ACCESS) // CSV_TUNNEL_REQUEST
'#define FSCTL_IS_CSV_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 146, METHOD_BUFFERED, FILE_ANY_ACCESS) // IS_CSV_FILE
'#define FSCTL_QUERY_FILE_SYSTEM_RECOGNITION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 147, METHOD_BUFFERED, FILE_ANY_ACCESS) //
'#define FSCTL_CSV_GET_VOLUME_PATH_NAME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 148, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_CSV_GET_VOLUME_NAME_FOR_VOLUME_MOUNT_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 149, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_CSV_GET_VOLUME_PATH_NAMES_FOR_VOLUME_NAME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 150, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#define FSCTL_IS_FILE_ON_CSV_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 151, METHOD_BUFFERED, FILE_ANY_ACCESS)
'#endif /* _WIN32_WINNT >= 0x0601 */
'#define FSCTL_MARK_AS_SYSTEM_HIVE FSCTL_SET_BOOTLOADER_ACCESSED
'#if(_WIN32_WINNT >= 0x0601)
'//
'// Structure for FSCTL_IS_CSV_FILE
'//
'typedef struct _CSV_NAMESPACE_INFO {
' ULONG Version;
' ULONG DeviceNumber;
' LARGE_INTEGER StartingOffset;
' ULONG SectorSize;
'} CSV_NAMESPACE_INFO, *PCSV_NAMESPACE_INFO;
'#define CSV_NAMESPACE_INFO_V1 (sizeof(CSV_NAMESPACE_INFO))
'#define CSV_INVALID_DEVICE_NUMBER 0xFFFFFFFF
'#endif /* _WIN32_WINNT >= 0x0601 */
'//
'// The following long list of structs are associated with the preceeding
'// file system fsctls.
'//
'//
'// Structure for FSCTL_IS_PATHNAME_VALID
'//
'typedef struct _PATHNAME_BUFFER {
' ULONG PathNameLength;
' WCHAR Name[1];
'} PATHNAME_BUFFER, *PPATHNAME_BUFFER;
'//
'// Structure for FSCTL_QUERY_BPB_INFO
'//
'typedef struct _FSCTL_QUERY_FAT_BPB_BUFFER {
' UCHAR First0x24BytesOfBootSector[0x24];
'} FSCTL_QUERY_FAT_BPB_BUFFER, *PFSCTL_QUERY_FAT_BPB_BUFFER;
'#if (_WIN32_WINNT >= 0x0400)
'//
'// Structures for FSCTL_GET_NTFS_VOLUME_DATA.
'// The user must pass the basic buffer below. Ntfs
'// will return as many fields as available in the extended
'// buffer which follows immediately after the VOLUME_DATA_BUFFER.
'//
'typedef struct {
' LARGE_INTEGER VolumeSerialNumber;
' LARGE_INTEGER NumberSectors;
' LARGE_INTEGER TotalClusters;
' LARGE_INTEGER FreeClusters;
' LARGE_INTEGER TotalReserved;
' ULONG BytesPerSector;
' ULONG BytesPerCluster;
' ULONG BytesPerFileRecordSegment;
' ULONG ClustersPerFileRecordSegment;
' LARGE_INTEGER MftValidDataLength;
' LARGE_INTEGER MftStartLcn;
' LARGE_INTEGER Mft2StartLcn;
' LARGE_INTEGER MftZoneStart;
' LARGE_INTEGER MftZoneEnd;
'} NTFS_VOLUME_DATA_BUFFER, *PNTFS_VOLUME_DATA_BUFFER;
'typedef struct {
' ULONG ByteCount;
' USHORT MajorVersion;
' USHORT MinorVersion;
'} NTFS_EXTENDED_VOLUME_DATA, *PNTFS_EXTENDED_VOLUME_DATA;
'#endif /* _WIN32_WINNT >= 0x0400 */
'#if (_WIN32_WINNT >= 0x0400)
'//
'// Structure for FSCTL_GET_VOLUME_BITMAP
'//
'typedef struct {
' LARGE_INTEGER StartingLcn;
'} STARTING_LCN_INPUT_BUFFER, *PSTARTING_LCN_INPUT_BUFFER;
'typedef struct {
' LARGE_INTEGER StartingLcn;
' LARGE_INTEGER BitmapSize;
' UCHAR Buffer[1];
'} VOLUME_BITMAP_BUFFER, *PVOLUME_BITMAP_BUFFER;
'#endif /* _WIN32_WINNT >= 0x0400 */
'#if (_WIN32_WINNT >= 0x0400)
'//
'// Structure for FSCTL_GET_RETRIEVAL_POINTERS
'//
'typedef struct {
' LARGE_INTEGER StartingVcn;
'} STARTING_VCN_INPUT_BUFFER, *PSTARTING_VCN_INPUT_BUFFER;
'typedef struct RETRIEVAL_POINTERS_BUFFER {
' ULONG ExtentCount;
' LARGE_INTEGER StartingVcn;
' struct {
' LARGE_INTEGER NextVcn;
' LARGE_INTEGER Lcn;
' } Extents[1];
'} RETRIEVAL_POINTERS_BUFFER, *PRETRIEVAL_POINTERS_BUFFER;
'#endif /* _WIN32_WINNT >= 0x0400 */
'#if (_WIN32_WINNT >= 0x0400)
'//
'// Structures for FSCTL_GET_NTFS_FILE_RECORD
'//
'typedef struct {
' LARGE_INTEGER FileReferenceNumber;
'} NTFS_FILE_RECORD_INPUT_BUFFER, *PNTFS_FILE_RECORD_INPUT_BUFFER;
'typedef struct {
' LARGE_INTEGER FileReferenceNumber;
' ULONG FileRecordLength;
' UCHAR FileRecordBuffer[1];
'} NTFS_FILE_RECORD_OUTPUT_BUFFER, *PNTFS_FILE_RECORD_OUTPUT_BUFFER;
'#endif /* _WIN32_WINNT >= 0x0400 */
'#if (_WIN32_WINNT >= 0x0400)
'//
'// Structure for FSCTL_MOVE_FILE
'//
'typedef struct {
' HANDLE FileHandle;
' LARGE_INTEGER StartingVcn;
' LARGE_INTEGER StartingLcn;
' ULONG ClusterCount;
'} MOVE_FILE_DATA, *PMOVE_FILE_DATA;
'typedef struct {
' HANDLE FileHandle;
' LARGE_INTEGER SourceFileRecord;
' LARGE_INTEGER TargetFileRecord;
'} MOVE_FILE_RECORD_DATA, *PMOVE_FILE_RECORD_DATA;
'#if defined(_WIN64)
'//
'// 32/64 Bit thunking support structure
'//
'typedef struct _MOVE_FILE_DATA32 {
' UINT32 FileHandle;
' LARGE_INTEGER StartingVcn;
' LARGE_INTEGER StartingLcn;
' ULONG ClusterCount;
'} MOVE_FILE_DATA32, *PMOVE_FILE_DATA32;
'#endif
'#endif /* _WIN32_WINNT >= 0x0400 */
'#if (_WIN32_WINNT >= 0x0500)
'//
'// Structures for FSCTL_FIND_FILES_BY_SID
'//
'typedef struct {
' ULONG Restart;
' SID Sid;
'} FIND_BY_SID_DATA, *PFIND_BY_SID_DATA;
'typedef struct {
' ULONG NextEntryOffset;
' ULONG FileIndex;
' ULONG FileNameLength;
' WCHAR FileName[1];
'} FIND_BY_SID_OUTPUT, *PFIND_BY_SID_OUTPUT;
'#endif /* _WIN32_WINNT >= 0x0500 */
'#if (_WIN32_WINNT >= 0x0500)
'//
'// The following structures apply to Usn operations.
'//
'//
'// Structure for FSCTL_ENUM_USN_DATA
'//
'typedef struct {
' ULONGLONG StartFileReferenceNumber;
' USN LowUsn;
' USN HighUsn;
'} MFT_ENUM_DATA, *PMFT_ENUM_DATA;
'//
'// Structure for FSCTL_CREATE_USN_JOURNAL
'//
'typedef struct {
' ULONGLONG MaximumSize;
' ULONGLONG AllocationDelta;
'} CREATE_USN_JOURNAL_DATA, *PCREATE_USN_JOURNAL_DATA;
'//
'// Structure for FSCTL_READ_USN_JOURNAL
'//
'typedef struct {
' USN StartUsn;
' ULONG ReasonMask;
' ULONG ReturnOnlyOnClose;
' ULONGLONG Timeout;
' ULONGLONG BytesToWaitFor;
' ULONGLONG UsnJournalID;
'} READ_USN_JOURNAL_DATA, *PREAD_USN_JOURNAL_DATA;
'//
'// The initial Major.Minor version of the Usn record will be 2.0.
'// In general, the MinorVersion may be changed if fields are added
'// to this structure in such a way that the previous version of the
'// software can still correctly the fields it knows about. The
'// MajorVersion should only be changed if the previous version of
'// any software using this structure would incorrectly handle new
'// records due to structure changes.
'//
'// The first update to this will force the structure to version 2.0.
'// This will add the extended information about the source as
'// well as indicate the file name offset within the structure.
'//
'// The following structure is returned with these fsctls.
'//
'// FSCTL_READ_USN_JOURNAL
'// FSCTL_READ_FILE_USN_DATA
'// FSCTL_ENUM_USN_DATA
'//
'typedef struct {
' ULONG RecordLength;
' USHORT MajorVersion;
' USHORT MinorVersion;
' ULONGLONG FileReferenceNumber;
' ULONGLONG ParentFileReferenceNumber;
' USN Usn;
' LARGE_INTEGER TimeStamp;
' ULONG Reason;
' ULONG SourceInfo;
' ULONG SecurityId;
' ULONG FileAttributes;
' USHORT FileNameLength;
' USHORT FileNameOffset;
' WCHAR FileName[1];
'} USN_RECORD, *PUSN_RECORD;
'#define USN_PAGE_SIZE (0x1000)
'#define USN_REASON_DATA_OVERWRITE (0x00000001)
'#define USN_REASON_DATA_EXTEND (0x00000002)
'#define USN_REASON_DATA_TRUNCATION (0x00000004)
'#define USN_REASON_NAMED_DATA_OVERWRITE (0x00000010)
'#define USN_REASON_NAMED_DATA_EXTEND (0x00000020)
'#define USN_REASON_NAMED_DATA_TRUNCATION (0x00000040)
'#define USN_REASON_FILE_CREATE (0x00000100)
'#define USN_REASON_FILE_DELETE (0x00000200)
'#define USN_REASON_EA_CHANGE (0x00000400)
'#define USN_REASON_SECURITY_CHANGE (0x00000800)
'#define USN_REASON_RENAME_OLD_NAME (0x00001000)
'#define USN_REASON_RENAME_NEW_NAME (0x00002000)
'#define USN_REASON_INDEXABLE_CHANGE (0x00004000)
'#define USN_REASON_BASIC_INFO_CHANGE (0x00008000)
'#define USN_REASON_HARD_LINK_CHANGE (0x00010000)
'#define USN_REASON_COMPRESSION_CHANGE (0x00020000)
'#define USN_REASON_ENCRYPTION_CHANGE (0x00040000)
'#define USN_REASON_OBJECT_ID_CHANGE (0x00080000)
'#define USN_REASON_REPARSE_POINT_CHANGE (0x00100000)
'#define USN_REASON_STREAM_CHANGE (0x00200000)
'#define USN_REASON_TRANSACTED_CHANGE (0x00400000)
'#define USN_REASON_CLOSE (0x80000000)
'//
'// Structure for FSCTL_QUERY_USN_JOUNAL
'//
'typedef struct {
' ULONGLONG UsnJournalID;
' USN FirstUsn;
' USN NextUsn;
' USN LowestValidUsn;
' USN MaxUsn;
' ULONGLONG MaximumSize;
' ULONGLONG AllocationDelta;
'} USN_JOURNAL_DATA, *PUSN_JOURNAL_DATA;
'//
'// Structure for FSCTL_DELETE_USN_JOURNAL
'//
'typedef struct {
' ULONGLONG UsnJournalID;
' ULONG DeleteFlags;
'} DELETE_USN_JOURNAL_DATA, *PDELETE_USN_JOURNAL_DATA;
'#define USN_DELETE_FLAG_DELETE (0x00000001)
'#define USN_DELETE_FLAG_NOTIFY (0x00000002)
'#define USN_DELETE_VALID_FLAGS (0x00000003)
'//
'// Structure for FSCTL_MARK_HANDLE
'//
'typedef struct {
' ULONG UsnSourceInfo;
' HANDLE VolumeHandle;
' ULONG HandleInfo;
'} MARK_HANDLE_INFO, *PMARK_HANDLE_INFO;
'#if defined(_WIN64)
'//
'// 32/64 Bit thunking support structure
'//
'typedef struct {
' ULONG UsnSourceInfo;
' UINT32 VolumeHandle;
' ULONG HandleInfo;
'} MARK_HANDLE_INFO32, *PMARK_HANDLE_INFO32;
'#endif
'//
'// Flags for the additional source information above.
'//
'// USN_SOURCE_DATA_MANAGEMENT - Service is not modifying the external view
'// of any part of the file. Typical case is HSM moving data to
'// and from external storage.
'//
'// USN_SOURCE_AUXILIARY_DATA - Service is not modifying the external view
'// of the file with regard to the application that created this file.
'// Can be used to add private data streams to a file.
'//
'// USN_SOURCE_REPLICATION_MANAGEMENT - Service is modifying a file to match
'// the contents of the same file which exists in another member of the
'// replica set.
'//
'#define USN_SOURCE_DATA_MANAGEMENT (0x00000001)
'#define USN_SOURCE_AUXILIARY_DATA (0x00000002)
'#define USN_SOURCE_REPLICATION_MANAGEMENT (0x00000004)
'//
'// Flags for the HandleInfo field above
'//
'// MARK_HANDLE_PROTECT_CLUSTERS - disallow any defragmenting (FSCTL_MOVE_FILE) until the
'// the handle is closed
'//
'// MARK_HANDLE_TXF_SYSTEM_LOG - indicates that this stream is being used as the Txf
'// log for an RM on the volume. Must be called in the kernel using
'// IRP_MN_KERNEL_CALL.
'//
'// MARK_HANDLE_NOT_TXF_SYSTEM_LOG - indicates that this user is no longer using this
'// object as a log file.
'//
'#define MARK_HANDLE_PROTECT_CLUSTERS (0x00000001)
'#define MARK_HANDLE_TXF_SYSTEM_LOG (0x00000004)
'#define MARK_HANDLE_NOT_TXF_SYSTEM_LOG (0x00000008)
'#endif /* _WIN32_WINNT >= 0x0500 */
'#if (_WIN32_WINNT >= 0x0601)
'#define MARK_HANDLE_REALTIME (0x00000020)
'#define MARK_HANDLE_NOT_REALTIME (0x00000040)
'#define NO_8DOT3_NAME_PRESENT (0x00000001)
'#define REMOVED_8DOT3_NAME (0x00000002)
'#define PERSISTENT_VOLUME_STATE_SHORT_NAME_CREATION_DISABLED (0x00000001)
'#endif /* _WIN32_WINNT >= 0x0601 */
'#if (_WIN32_WINNT >= 0x0500)
'//
'// Structure for FSCTL_SECURITY_ID_CHECK
'//
'typedef struct {
' ACCESS_MASK DesiredAccess;
' ULONG SecurityIds[1];
'} BULK_SECURITY_TEST_DATA, *PBULK_SECURITY_TEST_DATA;
'#endif /* _WIN32_WINNT >= 0x0500 */
'#if (_WIN32_WINNT >= 0x0500)
'//
'// Output flags for the FSCTL_IS_VOLUME_DIRTY
'//
'#define VOLUME_IS_DIRTY (0x00000001)
'#define VOLUME_UPGRADE_SCHEDULED (0x00000002)
'#define VOLUME_SESSION_OPEN (0x00000004)
'#endif /* _WIN32_WINNT >= 0x0500 */
'#if (_WIN32_WINNT >= 0x0500)
'//
'// Structures for FSCTL_FILE_PREFETCH
'//
'typedef struct _FILE_PREFETCH {
' ULONG Type;
' ULONG Count;
' ULONGLONG Prefetch[1];
'} FILE_PREFETCH, *PFILE_PREFETCH;
'typedef struct _FILE_PREFETCH_EX {
' ULONG Type;
' ULONG Count;
' PVOID Context;
' ULONGLONG Prefetch[1];
'} FILE_PREFETCH_EX, *PFILE_PREFETCH_EX;
'#define FILE_PREFETCH_TYPE_FOR_CREATE 0x1
'#define FILE_PREFETCH_TYPE_FOR_DIRENUM 0x2
'#define FILE_PREFETCH_TYPE_FOR_CREATE_EX 0x3
'#define FILE_PREFETCH_TYPE_FOR_DIRENUM_EX 0x4
'#define FILE_PREFETCH_TYPE_MAX 0x4
'#endif /* _WIN32_WINNT >= 0x0500 */
'//
'// Structures for FSCTL_FILESYSTEM_GET_STATISTICS
'//
'// Filesystem performance counters
'//
'typedef struct _FILESYSTEM_STATISTICS {
' USHORT FileSystemType;
' USHORT Version; // currently version 1
' ULONG SizeOfCompleteStructure; // must by a mutiple of 64 bytes
' ULONG UserFileReads;
' ULONG UserFileReadBytes;
' ULONG UserDiskReads;
' ULONG UserFileWrites;
' ULONG UserFileWriteBytes;
' ULONG UserDiskWrites;
' ULONG MetaDataReads;
' ULONG MetaDataReadBytes;
' ULONG MetaDataDiskReads;
' ULONG MetaDataWrites;
' ULONG MetaDataWriteBytes;
' ULONG MetaDataDiskWrites;
' //
' // The file system's private structure is appended here.
' //
'} FILESYSTEM_STATISTICS, *PFILESYSTEM_STATISTICS;
'// values for FS_STATISTICS.FileSystemType
'#define FILESYSTEM_STATISTICS_TYPE_NTFS 1
'#define FILESYSTEM_STATISTICS_TYPE_FAT 2
'#define FILESYSTEM_STATISTICS_TYPE_EXFAT 3
'//
'// File System Specific Statistics Data
'//
'typedef struct _FAT_STATISTICS {
' ULONG CreateHits;
' ULONG SuccessfulCreates;
' ULONG FailedCreates;
' ULONG NonCachedReads;
' ULONG NonCachedReadBytes;
' ULONG NonCachedWrites;
' ULONG NonCachedWriteBytes;
' ULONG NonCachedDiskReads;
' ULONG NonCachedDiskWrites;
'} FAT_STATISTICS, *PFAT_STATISTICS;
'typedef struct _EXFAT_STATISTICS {
' ULONG CreateHits;
' ULONG SuccessfulCreates;
' ULONG FailedCreates;
' ULONG NonCachedReads;
' ULONG NonCachedReadBytes;
' ULONG NonCachedWrites;
' ULONG NonCachedWriteBytes;
' ULONG NonCachedDiskReads;
' ULONG NonCachedDiskWrites;
'} EXFAT_STATISTICS, *PEXFAT_STATISTICS;
'typedef struct _NTFS_STATISTICS {
' ULONG LogFileFullExceptions;
' ULONG OtherExceptions;
' //
' // Other meta data io's
' //
' ULONG MftReads;
' ULONG MftReadBytes;
' ULONG MftWrites;
' ULONG MftWriteBytes;
' struct {
' USHORT Write;
' USHORT Create;
' USHORT SetInfo;
' USHORT Flush;
' } MftWritesUserLevel;
' USHORT MftWritesFlushForLogFileFull;
' USHORT MftWritesLazyWriter;
' USHORT MftWritesUserRequest;
' ULONG Mft2Writes;
' ULONG Mft2WriteBytes;
' struct {
' USHORT Write;
' USHORT Create;
' USHORT SetInfo;
' USHORT Flush;
' } Mft2WritesUserLevel;
' USHORT Mft2WritesFlushForLogFileFull;
' USHORT Mft2WritesLazyWriter;
' USHORT Mft2WritesUserRequest;
' ULONG RootIndexReads;
' ULONG RootIndexReadBytes;
' ULONG RootIndexWrites;
' ULONG RootIndexWriteBytes;
' ULONG BitmapReads;
' ULONG BitmapReadBytes;
' ULONG BitmapWrites;
' ULONG BitmapWriteBytes;
' USHORT BitmapWritesFlushForLogFileFull;
' USHORT BitmapWritesLazyWriter;
' USHORT BitmapWritesUserRequest;
' struct {
' USHORT Write;
' USHORT Create;
' USHORT SetInfo;
' } BitmapWritesUserLevel;
' ULONG MftBitmapReads;
' ULONG MftBitmapReadBytes;
' ULONG MftBitmapWrites;
' ULONG MftBitmapWriteBytes;
' USHORT MftBitmapWritesFlushForLogFileFull;
' USHORT MftBitmapWritesLazyWriter;
' USHORT MftBitmapWritesUserRequest;
' struct {
' USHORT Write;
' USHORT Create;
' USHORT SetInfo;
' USHORT Flush;
' } MftBitmapWritesUserLevel;
' ULONG UserIndexReads;
' ULONG UserIndexReadBytes;
' ULONG UserIndexWrites;
' ULONG UserIndexWriteBytes;
' //
' // Additions for NT 5.0
' //
' ULONG LogFileReads;
' ULONG LogFileReadBytes;
' ULONG LogFileWrites;
' ULONG LogFileWriteBytes;
' struct {
' ULONG Calls; // number of individual calls to allocate clusters
' ULONG Clusters; // number of clusters allocated
' ULONG Hints; // number of times a hint was specified
' ULONG RunsReturned; // number of runs used to satisify all the requests
' ULONG HintsHonored; // number of times the hint was useful
' ULONG HintsClusters; // number of clusters allocated via the hint
' ULONG Cache; // number of times the cache was useful other than the hint
' ULONG CacheClusters; // number of clusters allocated via the cache other than the hint
' ULONG CacheMiss; // number of times the cache wasn't useful
' ULONG CacheMissClusters; // number of clusters allocated without the cache
' } Allocate;
'} NTFS_STATISTICS, *PNTFS_STATISTICS;
'#if (_WIN32_WINNT >= 0x0500)
'//
'// Structure for FSCTL_SET_OBJECT_ID, FSCTL_GET_OBJECT_ID, and FSCTL_CREATE_OR_GET_OBJECT_ID
'//
'#if _MSC_VER >= 1200
'#pragma warning(push)
'#endif
'#pragma warning(disable:4201) // unnamed struct
'typedef struct _FILE_OBJECTID_BUFFER {
' //
' // This is the portion of the object id that is indexed.
' //
' UCHAR ObjectId[16];
' //
' // This portion of the object id is not indexed, it's just
' // some metadata for the user's benefit.
' //
' union {
' struct {
' UCHAR BirthVolumeId[16];
' UCHAR BirthObjectId[16];
' UCHAR DomainId[16];
' } DUMMYSTRUCTNAME;
' UCHAR ExtendedInfo[48];
' } DUMMYUNIONNAME;
'} FILE_OBJECTID_BUFFER, *PFILE_OBJECTID_BUFFER;
'#if _MSC_VER >= 1200
'#pragma warning(pop)
'#else
'#pragma warning( default : 4201 ) /* nonstandard extension used : nameless struct/union */
'#endif
'#endif /* _WIN32_WINNT >= 0x0500 */
'#if (_WIN32_WINNT >= 0x0500)
'//
'// Structure for FSCTL_SET_SPARSE
'//
'typedef struct _FILE_SET_SPARSE_BUFFER {
' BOOLEAN SetSparse;
'} FILE_SET_SPARSE_BUFFER, *PFILE_SET_SPARSE_BUFFER;
'#endif /* _WIN32_WINNT >= 0x0500 */
'#if (_WIN32_WINNT >= 0x0500)
'//
'// Structure for FSCTL_SET_ZERO_DATA
'//
'typedef struct _FILE_ZERO_DATA_INFORMATION {
' LARGE_INTEGER FileOffset;
' LARGE_INTEGER BeyondFinalZero;
'} FILE_ZERO_DATA_INFORMATION, *PFILE_ZERO_DATA_INFORMATION;
'#endif /* _WIN32_WINNT >= 0x0500 */
'#if (_WIN32_WINNT >= 0x0500)
'//
'// Structure for FSCTL_QUERY_ALLOCATED_RANGES
'//
'//
'// Querying the allocated ranges requires an output buffer to store the
'// allocated ranges and an input buffer to specify the range to query.
'// The input buffer contains a single entry, the output buffer is an
'// array of the following structure.
'//
'typedef struct _FILE_ALLOCATED_RANGE_BUFFER {
' LARGE_INTEGER FileOffset;
' LARGE_INTEGER Length;
'} FILE_ALLOCATED_RANGE_BUFFER, *PFILE_ALLOCATED_RANGE_BUFFER;
'#endif /* _WIN32_WINNT >= 0x0500 */
'#if (_WIN32_WINNT >= 0x0500)
'//
'// Structures for FSCTL_SET_ENCRYPTION, FSCTL_WRITE_RAW_ENCRYPTED, and FSCTL_READ_RAW_ENCRYPTED
'//
'//
'// The input buffer to set encryption indicates whether we are to encrypt/decrypt a file
'// or an individual stream.
'//
'typedef struct _ENCRYPTION_BUFFER {
' ULONG EncryptionOperation;
' UCHAR Private[1];
'} ENCRYPTION_BUFFER, *PENCRYPTION_BUFFER;
'#define FILE_SET_ENCRYPTION 0x00000001
'#define FILE_CLEAR_ENCRYPTION 0x00000002
'#define STREAM_SET_ENCRYPTION 0x00000003
'#define STREAM_CLEAR_ENCRYPTION 0x00000004
'#define MAXIMUM_ENCRYPTION_VALUE 0x00000004
'//
'// The optional output buffer to set encryption indicates that the last encrypted
'// stream in a file has been marked as decrypted.
'//
'typedef struct _DECRYPTION_STATUS_BUFFER {
' BOOLEAN NoEncryptedStreams;
'} DECRYPTION_STATUS_BUFFER, *PDECRYPTION_STATUS_BUFFER;
'#define ENCRYPTION_FORMAT_DEFAULT (0x01)
'#define COMPRESSION_FORMAT_SPARSE (0x4000)
'//
'// Request Encrypted Data structure. This is used to indicate
'// the range of the file to read. It also describes the
'// output buffer used to return the data.
'//
'typedef struct _REQUEST_RAW_ENCRYPTED_DATA {
' //
' // Requested file offset and requested length to read.
' // The fsctl will round the starting offset down
' // to a file system boundary. It will also
' // round the length up to a file system boundary.
' //
' LONGLONG FileOffset;
' ULONG Length;
'} REQUEST_RAW_ENCRYPTED_DATA, *PREQUEST_RAW_ENCRYPTED_DATA;
'//
'// Encrypted Data Information structure. This structure
'// is used to return raw encrypted data from a file in
'// order to perform off-line recovery. The data will be
'// encrypted or encrypted and compressed. The off-line
'// service will need to use the encryption and compression
'// format information to recover the file data. In the
'// event that the data is both encrypted and compressed then
'// the decryption must occur before decompression. All
'// the data units below must be encrypted and compressed
'// with the same format.
'//
'// The data will be returned in units. The data unit size
'// will be fixed per request. If the data is compressed
'// then the data unit size will be the compression unit size.
'//
'// This structure is at the beginning of the buffer used to
'// return the encrypted data. The actual raw bytes from
'// the file will follow this buffer. The offset of the
'// raw bytes from the beginning of this structure is
'// specified in the REQUEST_RAW_ENCRYPTED_DATA structure
'// described above.
'//
'typedef struct _ENCRYPTED_DATA_INFO {
' //
' // This is the file offset for the first entry in the
' // data block array. The file system will round
' // the requested start offset down to a boundary
' // that is consistent with the format of the file.
' //
' ULONGLONG StartingFileOffset;
' //
' // Data offset in output buffer. The output buffer
' // begins with an ENCRYPTED_DATA_INFO structure.
' // The file system will then store the raw bytes from
' // disk beginning at the following offset within the
' // output buffer.
' //
' ULONG OutputBufferOffset;
' //
' // The number of bytes being returned that are within
' // the size of the file. If this value is less than
' // (NumberOfDataBlocks << DataUnitShift), it means the
' // end of the file occurs within this transfer. Any
' // data beyond file size is invalid and was never
' // passed to the encryption driver.
' //
' ULONG BytesWithinFileSize;
' //
' // The number of bytes being returned that are below
' // valid data length. If this value is less than
' // (NumberOfDataBlocks << DataUnitShift), it means the
' // end of the valid data occurs within this transfer.
' // After decrypting the data from this transfer, any
' // byte(s) beyond valid data length must be zeroed.
' //
' ULONG BytesWithinValidDataLength;
' //
' // Code for the compression format as defined in
' // ntrtl.h. Note that COMPRESSION_FORMAT_NONE
' // and COMPRESSION_FORMAT_DEFAULT are invalid if
' // any of the described chunks are compressed.
' //
' USHORT CompressionFormat;
' //
' // The DataUnit is the granularity used to access the
' // disk. It will be the same as the compression unit
' // size for a compressed file. For an uncompressed
' // file, it will be some cluster-aligned power of 2 that
' // the file system deems convenient. A caller should
' // not expect that successive calls will have the
' // same data unit shift value as the previous call.
' //
' // Since chunks and compression units are expected to be
' // powers of 2 in size, we express them log2. So, for
' // example (1 << ChunkShift) == ChunkSizeInBytes. The
' // ClusterShift indicates how much space must be saved
' // to successfully compress a compression unit - each
' // successfully compressed data unit must occupy
' // at least one cluster less in bytes than an uncompressed
' // data block unit.
' //
' UCHAR DataUnitShift;
' UCHAR ChunkShift;
' UCHAR ClusterShift;
' //
' // The format for the encryption.
' //
' UCHAR EncryptionFormat;
' //
' // This is the number of entries in the data block size
' // array.
' //
' USHORT NumberOfDataBlocks;
' //
' // This is an array of sizes in the data block array. There
' // must be one entry in this array for each data block
' // read from disk. The size has a different meaning
' // depending on whether the file is compressed.
' //
' // A size of zero always indicates that the final data consists entirely
' // of zeroes. There is no decryption or decompression to
' // perform.
' //
' // If the file is compressed then the data block size indicates
' // whether this block is compressed. A size equal to
' // the block size indicates that the corresponding block did
' // not compress. Any other non-zero size indicates the
' // size of the compressed data which needs to be
' // decrypted/decompressed.
' //
' // If the file is not compressed then the data block size
' // indicates the amount of data within the block that
' // needs to be decrypted. Any other non-zero size indicates
' // that the remaining bytes in the data unit within the file
' // consists of zeros. An example of this is when the
' // the read spans the valid data length of the file. There
' // is no data to decrypt past the valid data length.
' //
' ULONG DataBlockSize[ANYSIZE_ARRAY];
'} ENCRYPTED_DATA_INFO;
'typedef ENCRYPTED_DATA_INFO *PENCRYPTED_DATA_INFO;
'#endif /* _WIN32_WINNT >= 0x0500 */
'#if (_WIN32_WINNT >= 0x0500)
'//
'// FSCTL_READ_FROM_PLEX support
'// Request Plex Read Data structure. This is used to indicate
'// the range of the file to read. It also describes
'// which plex to perform the read from.
'//
'typedef struct _PLEX_READ_DATA_REQUEST {
' //
' // Requested offset and length to read.
' // The offset can be the virtual offset (vbo) in to a file,
' // or a volume. In the case of a file offset,
' // the fsd will round the starting offset down
' // to a file system boundary. It will also
' // round the length up to a file system boundary and
' // enforce any other applicable limits.
' //
' LARGE_INTEGER ByteOffset;
' ULONG ByteLength;
' ULONG PlexNumber;
'} PLEX_READ_DATA_REQUEST, *PPLEX_READ_DATA_REQUEST;
'#endif /* _WIN32_WINNT >= 0x0500 */
'#if (_WIN32_WINNT >= 0x0500)
'//
'// FSCTL_SIS_COPYFILE support
'// Source and destination file names are passed in the FileNameBuffer.
'// Both strings are null terminated, with the source name starting at
'// the beginning of FileNameBuffer, and the destination name immediately
'// following. Length fields include terminating nulls.
'//
'typedef struct _SI_COPYFILE {
' ULONG SourceFileNameLength;
' ULONG DestinationFileNameLength;
' ULONG Flags;
' WCHAR FileNameBuffer[1];
'} SI_COPYFILE, *PSI_COPYFILE;
'#define COPYFILE_SIS_LINK 0x0001 // Copy only if source is SIS
'#define COPYFILE_SIS_REPLACE 0x0002 // Replace destination if it exists, otherwise don't.
'#define COPYFILE_SIS_FLAGS 0x0003
'#endif /* _WIN32_WINNT >= 0x0500 */
'#if (_WIN32_WINNT >= 0x0600)
'//
'// Input parameter structure for FSCTL_MAKE_COMPATIBLE
'//
'typedef struct _FILE_MAKE_COMPATIBLE_BUFFER {
' BOOLEAN CloseDisc;
'} FILE_MAKE_COMPATIBLE_BUFFER, *PFILE_MAKE_COMPATIBLE_BUFFER;
'//
'// Input parameter structure for FSCTL_SET_DEFECT_MANAGEMENT
'//
'typedef struct _FILE_SET_DEFECT_MGMT_BUFFER {
' BOOLEAN Disable;
'} FILE_SET_DEFECT_MGMT_BUFFER, *PFILE_SET_DEFECT_MGMT_BUFFER;
'//
'// Output structure for FSCTL_QUERY_SPARING_INFO
'//
'typedef struct _FILE_QUERY_SPARING_BUFFER {
' ULONG SparingUnitBytes;
' BOOLEAN SoftwareSparing;
' ULONG TotalSpareBlocks;
' ULONG FreeSpareBlocks;
'} FILE_QUERY_SPARING_BUFFER, *PFILE_QUERY_SPARING_BUFFER;
'//
'// Output structure for FSCTL_QUERY_ON_DISK_VOLUME_INFO
'//
'typedef struct _FILE_QUERY_ON_DISK_VOL_INFO_BUFFER {
' LARGE_INTEGER DirectoryCount; // -1 = unknown
' LARGE_INTEGER FileCount; // -1 = unknown
' USHORT FsFormatMajVersion; // -1 = unknown or n/a
' USHORT FsFormatMinVersion; // -1 = unknown or n/a
' WCHAR FsFormatName[ 12];
' LARGE_INTEGER FormatTime;
' LARGE_INTEGER LastUpdateTime;
' WCHAR CopyrightInfo[ 34];
' WCHAR AbstractInfo[ 34];
' WCHAR FormattingImplementationInfo[ 34];
' WCHAR LastModifyingImplementationInfo[ 34];
'} FILE_QUERY_ON_DISK_VOL_INFO_BUFFER, *PFILE_QUERY_ON_DISK_VOL_INFO_BUFFER;
'//
'// Input flags for FSCTL_SET_REPAIR
'//
'#define SET_REPAIR_ENABLED (0x00000001)
'#define SET_REPAIR_VOLUME_BITMAP_SCAN (0x00000002)
'#define SET_REPAIR_DELETE_CROSSLINK (0x00000004)
'#define SET_REPAIR_WARN_ABOUT_DATA_LOSS (0x00000008)
'#define SET_REPAIR_DISABLED_AND_BUGCHECK_ON_CORRUPT (0x00000010)
'#define SET_REPAIR_VALID_MASK (0x0000001F)
'//
'// Input structures for FSCTL_SHRINK_VOLUME.
'//
'typedef enum _SHRINK_VOLUME_REQUEST_TYPES
'{
' ShrinkPrepare = 1,
' ShrinkCommit,
' ShrinkAbort
'} SHRINK_VOLUME_REQUEST_TYPES, *PSHRINK_VOLUME_REQUEST_TYPES;
'typedef struct _SHRINK_VOLUME_INFORMATION
'{
' SHRINK_VOLUME_REQUEST_TYPES ShrinkRequestType;
' ULONGLONG Flags;
' LONGLONG NewNumberOfSectors;
'} SHRINK_VOLUME_INFORMATION, *PSHRINK_VOLUME_INFORMATION;
'//
'// Structures for FSCTL_TXFS_MODIFY_RM and FSCTL_TXFS_QUERY_RM_INFORMATION
'//
'// For ModifyRM, TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS and
'// TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT are mutually exclusive.
'// You can specify the log growth amount in number of containers or as a percentage.
'//
'// For ModifyRM, TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX and
'// TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX are mutually exclusive.
'//
'// For ModifyRM, TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN and
'// TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN are mutually exclusive.
'//
'// For ModifyRM, TXFS_RM_FLAG_RESET_RM_AT_NEXT_START and
'// TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START are mutually exclusive and only
'// apply to default RMs.
'//
'// For ModifyRM, TXFS_RM_FLAG_PREFER_CONSISTENCY and
'// TXFS_RM_FLAG_PREFER_AVAILABILITY are mutually exclusive. After calling ModifyRM
'// with one of these flags set the RM must be restarted for the change to take effect.
'//
'#define TXFS_RM_FLAG_LOGGING_MODE 0x00000001
'#define TXFS_RM_FLAG_RENAME_RM 0x00000002
'#define TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX 0x00000004
'#define TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN 0x00000008
'#define TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS 0x00000010
'#define TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT 0x00000020
'#define TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE 0x00000040
'#define TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX 0x00000080
'#define TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN 0x00000100
'#define TXFS_RM_FLAG_GROW_LOG 0x00000400
'#define TXFS_RM_FLAG_SHRINK_LOG 0x00000800
'#define TXFS_RM_FLAG_ENFORCE_MINIMUM_SIZE 0x00001000
'#define TXFS_RM_FLAG_PRESERVE_CHANGES 0x00002000
'#define TXFS_RM_FLAG_RESET_RM_AT_NEXT_START 0x00004000
'#define TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START 0x00008000
'#define TXFS_RM_FLAG_PREFER_CONSISTENCY 0x00010000
'#define TXFS_RM_FLAG_PREFER_AVAILABILITY 0x00020000
'#define TXFS_LOGGING_MODE_SIMPLE (0x0001)
'#define TXFS_LOGGING_MODE_FULL (0x0002)
'#define TXFS_TRANSACTION_STATE_NONE 0x00
'#define TXFS_TRANSACTION_STATE_ACTIVE 0x01
'#define TXFS_TRANSACTION_STATE_PREPARED 0x02
'#define TXFS_TRANSACTION_STATE_NOTACTIVE 0x03
'#define TXFS_MODIFY_RM_VALID_FLAGS \
' (TXFS_RM_FLAG_LOGGING_MODE | \
' TXFS_RM_FLAG_RENAME_RM | \
' TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX | \
' TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN | \
' TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \
' TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT | \
' TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE | \
' TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX | \
' TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN | \
' TXFS_RM_FLAG_SHRINK_LOG | \
' TXFS_RM_FLAG_GROW_LOG | \
' TXFS_RM_FLAG_ENFORCE_MINIMUM_SIZE | \
' TXFS_RM_FLAG_PRESERVE_CHANGES | \
' TXFS_RM_FLAG_RESET_RM_AT_NEXT_START | \
' TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START | \
' TXFS_RM_FLAG_PREFER_CONSISTENCY | \
' TXFS_RM_FLAG_PREFER_AVAILABILITY)
'typedef struct _TXFS_MODIFY_RM {
' //
' // TXFS_RM_FLAG_* flags
' //
' ULONG Flags;
' //
' // Maximum log container count if TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX is set.
' //
' ULONG LogContainerCountMax;
' //
' // Minimum log container count if TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN is set.
' //
' ULONG LogContainerCountMin;
' //
' // Target log container count for TXFS_RM_FLAG_SHRINK_LOG or _GROW_LOG.
' //
' ULONG LogContainerCount;
' //
' // When the log is full, increase its size by this much. Indicated as either a percent of
' // the log size or absolute container count, depending on which of the TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_*
' // flags is set.
' //
' ULONG LogGrowthIncrement;
' //
' // Sets autoshrink policy if TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE is set. Autoshrink
' // makes the log shrink so that no more than this percentage of the log is free at any time.
' //
' ULONG LogAutoShrinkPercentage;
' //
' // Reserved.
' //
' ULONGLONG Reserved;
' //
' // If TXFS_RM_FLAG_LOGGING_MODE is set, this must contain one of TXFS_LOGGING_MODE_SIMPLE
' // or TXFS_LOGGING_MODE_FULL.
' //
' USHORT LoggingMode;
'} TXFS_MODIFY_RM,
' *PTXFS_MODIFY_RM;
'#define TXFS_RM_STATE_NOT_STARTED 0
'#define TXFS_RM_STATE_STARTING 1
'#define TXFS_RM_STATE_ACTIVE 2
'#define TXFS_RM_STATE_SHUTTING_DOWN 3
'//
'// The flags field for query RM information is used for the following information:
'//
'// 1) To indicate whether the LogGrowthIncrement field is reported as a percent
'// or as a number of containers. Possible flag values for this are:
'//
'// TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS xor TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT
'//
'// 2) To indicate that there is no set maximum or minimum container count. Possible
'// flag values for this are:
'//
'// TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX
'// TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN
'//
'// Note that these flags are not mutually exclusive.
'//
'// 2) To report whether the RM will be reset the next time it is started. Note that
'// only the default RM will report a meaningful value (secondary RMs will always
'// report DO_NOT_RESET) Possible flag values for this are:
'//
'// TXFS_RM_FLAG_RESET_RM_AT_NEXT_START xor TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START
'//
'// 3) To report whether the RM is in consistency mode or availability mode. Possible
'// flag values for this are:
'//
'// TXFS_RM_FLAG_PREFER_CONSISTENCY xor TXFS_RM_FLAG_PREFER_AVAILABILITY
'//
'// The RmState field can have exactly one of the above-defined TXF_RM_STATE_ values.
'//
'#define TXFS_QUERY_RM_INFORMATION_VALID_FLAGS \
' (TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \
' TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT | \
' TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX | \
' TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN | \
' TXFS_RM_FLAG_RESET_RM_AT_NEXT_START | \
' TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START | \
' TXFS_RM_FLAG_PREFER_CONSISTENCY | \
' TXFS_RM_FLAG_PREFER_AVAILABILITY)
'typedef struct _TXFS_QUERY_RM_INFORMATION {
' //
' // If the return value is STATUS_BUFFER_OVERFLOW (ERROR_MORE_DATA), this
' // will indicate how much space is required to hold everything.
' //
' ULONG BytesRequired;
' //
' // LSN of earliest available record in the RM's log.
' //
' ULONGLONG TailLsn;
' //
' // LSN of most recently-written record in the RM's log.
' //
' ULONGLONG CurrentLsn;
' //
' // LSN of the log's archive tail.
' //
' ULONGLONG ArchiveTailLsn;
' //
' // Size of a log container in bytes.
' //
' ULONGLONG LogContainerSize;
' //
' // Highest virtual clock value recorded in this RM's log.
' //
' LARGE_INTEGER HighestVirtualClock;
' //
' // Number of containers in this RM's log.
' //
' ULONG LogContainerCount;
' //
' // Maximum-allowed log container count.
' //
' ULONG LogContainerCountMax;
' //
' // Minimum-allowed log container count.
' //
' ULONG LogContainerCountMin;
' //
' // Amount by which log will grow when it gets full. Indicated as either a percent of
' // the log size or absolute container count, depending on which of the TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_*
' // flags is set.
' //
' ULONG LogGrowthIncrement;
' //
' // Reports on the autoshrink policy if. Autoshrink makes the log shrink so that no more than this
' // percentage of the log is free at any time. A value of 0 indicates that autoshrink is off (i.e.
' // the log will not automatically shrink).
' //
' ULONG LogAutoShrinkPercentage;
' //
' // TXFS_RM_FLAG_* flags. See the comment above at TXFS_QUERY_RM_INFORMATION_VALID_FLAGS to see
' // what the flags here mean.
' //
' ULONG Flags;
' //
' // Exactly one of TXFS_LOGGING_MODE_SIMPLE or TXFS_LOGGING_MODE_FULL.
' //
' USHORT LoggingMode;
' //
' // Reserved.
' //
' USHORT Reserved;
' //
' // Activity state of the RM. May be exactly one of the above-defined TXF_RM_STATE_ values.
' //
' ULONG RmState;
' //
' // Total capacity of the log in bytes.
' //
' ULONGLONG LogCapacity;
' //
' // Amount of free space in the log in bytes.
' //
' ULONGLONG LogFree;
' //
' // Size of $Tops in bytes.
' //
' ULONGLONG TopsSize;
' //
' // Amount of space in $Tops in use.
' //
' ULONGLONG TopsUsed;
' //
' // Number of transactions active in the RM at the time of the call.
' //
' ULONGLONG TransactionCount;
' //
' // Total number of single-phase commits that have happened the RM.
' //
' ULONGLONG OnePCCount;
' //
' // Total number of two-phase commits that have happened the RM.
' //
' ULONGLONG TwoPCCount;
' //
' // Number of times the log has filled up.
' //
' ULONGLONG NumberLogFileFull;
' //
' // Age of oldest active transaction in the RM, in milliseconds.
' //
' ULONGLONG OldestTransactionAge;
' //
' // Name of the RM.
' //
' GUID RMName;
' //
' // Offset in bytes from the beginning of this structure to a NULL-terminated Unicode
' // string indicating the path to the RM's transaction manager's log.
' //
' ULONG TmLogPathOffset;
'} TXFS_QUERY_RM_INFORMATION,
' *PTXFS_QUERY_RM_INFORMATION;
'//
'// Structures for FSCTL_TXFS_ROLLFORWARD_REDO
'//
'#define TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_REDO_LSN 0x01
'#define TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_VIRTUAL_CLOCK 0x02
'#define TXFS_ROLLFORWARD_REDO_VALID_FLAGS \
' (TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_REDO_LSN | \
' TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_VIRTUAL_CLOCK)
'typedef struct _TXFS_ROLLFORWARD_REDO_INFORMATION {
' LARGE_INTEGER LastVirtualClock;
' ULONGLONG LastRedoLsn;
' ULONGLONG HighestRecoveryLsn;
' ULONG Flags;
'} TXFS_ROLLFORWARD_REDO_INFORMATION,
' *PTXFS_ROLLFORWARD_REDO_INFORMATION;
'//
'// Structures for FSCTL_TXFS_START_RM
'//
'// Note that TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS and
'// TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT are mutually exclusive.
'// You can specify the log growth amount in number of containers or as a percentage.
'//
'// TXFS_START_RM_FLAG_CONTAINER_COUNT_MAX and TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX
'// are mutually exclusive.
'//
'// TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MIN and TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN
'// are mutually exclusive.
'//
'// TXFS_START_RM_FLAG_PREFER_CONSISTENCY and TXFS_START_RM_FLAG_PREFER_AVAILABILITY
'// are mutually exclusive.
'//
'// Optional parameters will have system-supplied defaults applied if omitted.
'//
'#define TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MAX 0x00000001
'#define TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MIN 0x00000002
'#define TXFS_START_RM_FLAG_LOG_CONTAINER_SIZE 0x00000004
'#define TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS 0x00000008
'#define TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT 0x00000010
'#define TXFS_START_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE 0x00000020
'#define TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX 0x00000040
'#define TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN 0x00000080
'#define TXFS_START_RM_FLAG_RECOVER_BEST_EFFORT 0x00000200
'#define TXFS_START_RM_FLAG_LOGGING_MODE 0x00000400
'#define TXFS_START_RM_FLAG_PRESERVE_CHANGES 0x00000800
'#define TXFS_START_RM_FLAG_PREFER_CONSISTENCY 0x00001000
'#define TXFS_START_RM_FLAG_PREFER_AVAILABILITY 0x00002000
'#define TXFS_START_RM_VALID_FLAGS \
' (TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MAX | \
' TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MIN | \
' TXFS_START_RM_FLAG_LOG_CONTAINER_SIZE | \
' TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \
' TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT | \
' TXFS_START_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE | \
' TXFS_START_RM_FLAG_RECOVER_BEST_EFFORT | \
' TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX | \
' TXFS_START_RM_FLAG_LOGGING_MODE | \
' TXFS_START_RM_FLAG_PRESERVE_CHANGES | \
' TXFS_START_RM_FLAG_PREFER_CONSISTENCY | \
' TXFS_START_RM_FLAG_PREFER_AVAILABILITY)
'typedef struct _TXFS_START_RM_INFORMATION {
' //
' // TXFS_START_RM_FLAG_* flags.
' //
' ULONG Flags;
' //
' // RM log container size, in bytes. This parameter is optional.
' //
' ULONGLONG LogContainerSize;
' //
' // RM minimum log container count. This parameter is optional.
' //
' ULONG LogContainerCountMin;
' //
' // RM maximum log container count. This parameter is optional.
' //
' ULONG LogContainerCountMax;
' //
' // RM log growth increment in number of containers or percent, as indicated
' // by TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_* flag. This parameter is
' // optional.
' //
' ULONG LogGrowthIncrement;
' //
' // RM log auto shrink percentage. This parameter is optional.
' //
' ULONG LogAutoShrinkPercentage;
' //
' // Offset from the beginning of this structure to the log path for the KTM
' // instance to be used by this RM. This must be a two-byte (WCHAR) aligned
' // value. This parameter is required.
' //
' ULONG TmLogPathOffset;
' //
' // Length in bytes of log path for the KTM instance to be used by this RM.
' // This parameter is required.
' //
' USHORT TmLogPathLength;
' //
' // Logging mode for this RM. One of TXFS_LOGGING_MODE_SIMPLE or
' // TXFS_LOGGING_MODE_FULL (mutually exclusive). This parameter is optional,
' // and will default to TXFS_LOGGING_MODE_SIMPLE.
' //
' USHORT LoggingMode;
' //
' // Length in bytes of the path to the log to be used by the RM. This parameter
' // is required.
' //
' USHORT LogPathLength;
' //
' // Reserved.
' //
' USHORT Reserved;
' //
' // The path to the log (in Unicode characters) to be used by the RM goes here.
' // This parameter is required.
' //
' WCHAR LogPath[1];
'} TXFS_START_RM_INFORMATION,
' *PTXFS_START_RM_INFORMATION;
'//
'// Structures for FSCTL_TXFS_GET_METADATA_INFO
'//
'typedef struct _TXFS_GET_METADATA_INFO_OUT {
' //
' // Returns the TxfId of the file referenced by the handle used to call this routine.
' //
' struct {
' LONGLONG LowPart;
' LONGLONG HighPart;
' } TxfFileId;
' //
' // The GUID of the transaction that has the file locked, if applicable.
' //
' GUID LockingTransaction;
' //
' // Returns the LSN for the most recent log record we've written for the file.
' //
' ULONGLONG LastLsn;
' //
' // Transaction state, a TXFS_TRANSACTION_STATE_* value.
' //
' ULONG TransactionState;
'} TXFS_GET_METADATA_INFO_OUT, *PTXFS_GET_METADATA_INFO_OUT;
'//
'// Structures for FSCTL_TXFS_LIST_TRANSACTION_LOCKED_FILES
'//
'// TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_CREATED means the reported name was created
'// in the locking transaction.
'//
'// TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_DELETED means the reported name was deleted
'// in the locking transaction.
'//
'// Note that both flags may appear if the name was both created and deleted in the same
'// transaction. In that case the FileName[] member will contain only "\0", as there is
'// no meaningful name to report.
'//
'#define TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_CREATED 0x00000001
'#define TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_DELETED 0x00000002
'typedef struct _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY {
' //
' // Offset in bytes from the beginning of the TXFS_LIST_TRANSACTION_LOCKED_FILES
' // structure to the next TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY.
' //
' ULONGLONG Offset;
' //
' // TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_* flags to indicate whether the
' // current name was deleted or created in the transaction.
' //
' ULONG NameFlags;
' //
' // NTFS File ID of the file.
' //
' LONGLONG FileId;
' //
' // Reserved.
' //
' ULONG Reserved1;
' ULONG Reserved2;
' LONGLONG Reserved3;
' //
' // NULL-terminated Unicode path to this file, relative to RM root.
' //
' WCHAR FileName[1];
'} TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY, *PTXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY;
'typedef struct _TXFS_LIST_TRANSACTION_LOCKED_FILES {
' //
' // GUID name of the KTM transaction that files should be enumerated from.
' //
' GUID KtmTransaction;
' //
' // On output, the number of files involved in the transaction on this RM.
' //
' ULONGLONG NumberOfFiles;
' //
' // The length of the buffer required to obtain the complete list of files.
' // This value may change from call to call as the transaction locks more files.
' //
' ULONGLONG BufferSizeRequired;
' //
' // Offset in bytes from the beginning of this structure to the first
' // TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY.
' //
' ULONGLONG Offset;
'} TXFS_LIST_TRANSACTION_LOCKED_FILES, *PTXFS_LIST_TRANSACTION_LOCKED_FILES;
'//
'// Structures for FSCTL_TXFS_LIST_TRANSACTIONS
'//
'typedef struct _TXFS_LIST_TRANSACTIONS_ENTRY {
' //
' // Transaction GUID.
' //
' GUID TransactionId;
' //
' // Transaction state, a TXFS_TRANSACTION_STATE_* value.
' //
' ULONG TransactionState;
' //
' // Reserved fields
' //
' ULONG Reserved1;
' ULONG Reserved2;
' LONGLONG Reserved3;
'} TXFS_LIST_TRANSACTIONS_ENTRY, *PTXFS_LIST_TRANSACTIONS_ENTRY;
'typedef struct _TXFS_LIST_TRANSACTIONS {
' //
' // On output, the number of transactions involved in this RM.
' //
' ULONGLONG NumberOfTransactions;
' //
' // The length of the buffer required to obtain the complete list of
' // transactions. Note that this value may change from call to call
' // as transactions enter and exit the system.
' //
' ULONGLONG BufferSizeRequired;
'} TXFS_LIST_TRANSACTIONS, *PTXFS_LIST_TRANSACTIONS;
'//
'// Structures for FSCTL_TXFS_READ_BACKUP_INFORMATION
'//
'#if _MSC_VER >= 1200
'#pragma warning(push)
'#endif
'#pragma warning(disable:4201) // unnamed struct
'typedef struct _TXFS_READ_BACKUP_INFORMATION_OUT {
' union {
' //
' // Used to return the required buffer size if return code is STATUS_BUFFER_OVERFLOW
' //
' ULONG BufferLength;
' //
' // On success the data is copied here.
' //
' UCHAR Buffer[1];
' } DUMMYUNIONNAME;
'} TXFS_READ_BACKUP_INFORMATION_OUT, *PTXFS_READ_BACKUP_INFORMATION_OUT;
'#if _MSC_VER >= 1200
'#pragma warning(pop)
'#else
'#pragma warning( default : 4201 )
'#endif
'//
'// Structures for FSCTL_TXFS_WRITE_BACKUP_INFORMATION
'//
'typedef struct _TXFS_WRITE_BACKUP_INFORMATION {
' //
' // The data returned in the Buffer member of a previous call to
' // FSCTL_TXFS_READ_BACKUP_INFORMATION goes here.
' //
' UCHAR Buffer[1];
'} TXFS_WRITE_BACKUP_INFORMATION, *PTXFS_WRITE_BACKUP_INFORMATION;
'//
'// Output structure for FSCTL_TXFS_GET_TRANSACTED_VERSION
'//
'#define TXFS_TRANSACTED_VERSION_NONTRANSACTED 0xFFFFFFFE
'#define TXFS_TRANSACTED_VERSION_UNCOMMITTED 0xFFFFFFFF
'typedef struct _TXFS_GET_TRANSACTED_VERSION {
' //
' // The version that this handle is opened to. This will be
' // TXFS_TRANSACTED_VERSION_UNCOMMITTED for nontransacted and
' // transactional writer handles.
' //
' ULONG ThisBaseVersion;
' //
' // The most recent committed version available.
' //
' ULONG LatestVersion;
' //
' // If this is a handle to a miniversion, the ID of the miniversion.
' // If it is not a handle to a minivers, this field will be 0.
' //
' USHORT ThisMiniVersion;
' //
' // The first available miniversion. Unless the miniversions are
' // visible to the transaction bound to this handle, this field will be zero.
' //
' USHORT FirstMiniVersion;
' //
' // The latest available miniversion. Unless the miniversions are
' // visible to the transaction bound to this handle, this field will be zero.
' //
' USHORT LatestMiniVersion;
'} TXFS_GET_TRANSACTED_VERSION, *PTXFS_GET_TRANSACTED_VERSION;
'//
'// Structures for FSCTL_TXFS_SAVEPOINT_INFORMATION
'//
'// Note that the TXFS_SAVEPOINT_INFORMATION structure is both and in and out structure.
'// The KtmTransaction and ActionCode members are always in-parameters, and the SavepointId
'// member is either an in-parameter, an out-parameter, or not used (see its definition below).
'//
'//
'// Create a new savepoint.
'//
'#define TXFS_SAVEPOINT_SET 0x00000001
'//
'// Roll back to a specified savepoint.
'//
'#define TXFS_SAVEPOINT_ROLLBACK 0x00000002
'//
'// Clear (make unavailable for rollback) the most recently set savepoint
'// that has not yet been cleared.
'//
'#define TXFS_SAVEPOINT_CLEAR 0x00000004
'//
'// Clear all savepoints from the transaction.
'//
'#define TXFS_SAVEPOINT_CLEAR_ALL 0x00000010
'typedef struct _TXFS_SAVEPOINT_INFORMATION {
' //
' // Handle to the transaction on which to perform the savepoint operation.
' //
' HANDLE KtmTransaction;
' //
' // Specifies the savepoint action to take. A TXFS_SAVEPOINT_* value.
' //
' ULONG ActionCode;
' //
' // In-parameter for TXFS_ROLLBACK_TO_SAVEPOINT - specifies the savepoint to which
' // to roll back.
' //
' // Out-parameter for TXFS_SET_SAVEPOINT - the newly-created savepoint ID will be
' // returned here.
' //
' // Not used for TXFS_CLEAR_SAVEPOINT or TXFS_CLEAR_ALL_SAVEPOINTS.
' //
' ULONG SavepointId;
'} TXFS_SAVEPOINT_INFORMATION, *PTXFS_SAVEPOINT_INFORMATION;
'//
'// Structures for FSCTL_TXFS_CREATE_MINIVERSION
'//
'// Only an out parameter is necessary. That returns the identifier of the new miniversion created.
'//
'typedef struct _TXFS_CREATE_MINIVERSION_INFO {
' USHORT StructureVersion;
' USHORT StructureLength;
' //
' // The base version for the newly created miniversion.
' //
' ULONG BaseVersion;
' //
' // The miniversion that was just created.
' //
' USHORT MiniVersion;
'} TXFS_CREATE_MINIVERSION_INFO, *PTXFS_CREATE_MINIVERSION_INFO;
'//
'// Structure for FSCTL_TXFS_TRANSACTION_ACTIVE
'//
'typedef struct _TXFS_TRANSACTION_ACTIVE_INFO {
' //
' // Whether or not the volume had active transactions when this snapshot was taken.
' //
' BOOLEAN TransactionsActiveAtSnapshot;
'} TXFS_TRANSACTION_ACTIVE_INFO, *PTXFS_TRANSACTION_ACTIVE_INFO;
'#endif /* _WIN32_WINNT >= 0x0600 */
'#if (_WIN32_WINNT >= 0x0601)
'//
'// Output structure for FSCTL_GET_BOOT_AREA_INFO
'//
'typedef struct _BOOT_AREA_INFO {
' ULONG BootSectorCount; // the count of boot sectors present on the file system
' struct {
' LARGE_INTEGER Offset;
' } BootSectors[2]; // variable number of boot sectors.
'} BOOT_AREA_INFO, *PBOOT_AREA_INFO;
'//
'// Output structure for FSCTL_GET_RETRIEVAL_POINTER_BASE
'//
'typedef struct _RETRIEVAL_POINTER_BASE {
' LARGE_INTEGER FileAreaOffset; // sector offset to the first allocatable unit on the filesystem
'} RETRIEVAL_POINTER_BASE, *PRETRIEVAL_POINTER_BASE;
'//
'// Structure for FSCTL_SET_PERSISTENT_VOLUME_STATE and FSCTL_GET_PERSISTENT_VOLUME_STATE
'// The initial version will be 1.0
'//
'typedef struct _FILE_FS_PERSISTENT_VOLUME_INFORMATION {
' ULONG VolumeFlags;
' ULONG FlagMask;
' ULONG Version;
' ULONG Reserved;
'} FILE_FS_PERSISTENT_VOLUME_INFORMATION, *PFILE_FS_PERSISTENT_VOLUME_INFORMATION;
'//
'// Structure for FSCTL_QUERY_FILE_SYSTEM_RECOGNITION
'//
'typedef struct _FILE_SYSTEM_RECOGNITION_INFORMATION {
' CHAR FileSystem[9];
'} FILE_SYSTEM_RECOGNITION_INFORMATION, *PFILE_SYSTEM_RECOGNITION_INFORMATION;
'//
'// Structures for FSCTL_REQUEST_OPLOCK
'//
'#define OPLOCK_LEVEL_CACHE_READ (0x00000001)
'#define OPLOCK_LEVEL_CACHE_HANDLE (0x00000002)
'#define OPLOCK_LEVEL_CACHE_WRITE (0x00000004)
'#define REQUEST_OPLOCK_INPUT_FLAG_REQUEST (0x00000001)
'#define REQUEST_OPLOCK_INPUT_FLAG_ACK (0x00000002)
'#define REQUEST_OPLOCK_INPUT_FLAG_COMPLETE_ACK_ON_CLOSE (0x00000004)
'#define REQUEST_OPLOCK_CURRENT_VERSION 1
'typedef struct _REQUEST_OPLOCK_INPUT_BUFFER {
' //
' // This should be set to REQUEST_OPLOCK_CURRENT_VERSION.
' //
' USHORT StructureVersion;
' USHORT StructureLength;
' //
' // One or more OPLOCK_LEVEL_CACHE_* values to indicate the desired level of the oplock.
' //
' ULONG RequestedOplockLevel;
' //
' // REQUEST_OPLOCK_INPUT_FLAG_* flags.
' //
' ULONG Flags;
'} REQUEST_OPLOCK_INPUT_BUFFER, *PREQUEST_OPLOCK_INPUT_BUFFER;
'#define REQUEST_OPLOCK_OUTPUT_FLAG_ACK_REQUIRED (0x00000001)
'#define REQUEST_OPLOCK_OUTPUT_FLAG_MODES_PROVIDED (0x00000002)
'typedef struct _REQUEST_OPLOCK_OUTPUT_BUFFER {
' //
' // This should be set to REQUEST_OPLOCK_CURRENT_VERSION.
' //
' USHORT StructureVersion;
' USHORT StructureLength;
' //
' // One or more OPLOCK_LEVEL_CACHE_* values indicating the level of the oplock that
' // was just broken.
' //
' ULONG OriginalOplockLevel;
' //
' // One or more OPLOCK_LEVEL_CACHE_* values indicating the level to which an oplock
' // is being broken, or an oplock level that may be available for granting, depending
' // on the operation returning this buffer.
' //
' ULONG NewOplockLevel;
' //
' // REQUEST_OPLOCK_OUTPUT_FLAG_* flags.
' //
' ULONG Flags;
' //
' // When REQUEST_OPLOCK_OUTPUT_FLAG_MODES_PROVIDED is set, and when the
' // OPLOCK_LEVEL_CACHE_HANDLE level is being lost in an oplock break, these fields
' // contain the access mode and share mode of the request that is causing the break.
' //
' ACCESS_MASK AccessMode;
' USHORT ShareMode;
'} REQUEST_OPLOCK_OUTPUT_BUFFER, *PREQUEST_OPLOCK_OUTPUT_BUFFER;
'//
'// Structures for FSCTL_SD_GLOBAL_CHANGE
'//
'//
'// list of operations supported
'//
'#define SD_GLOBAL_CHANGE_TYPE_MACHINE_SID 1
'//
'// Operation specific structures for SD_GLOBAL_CHANGE_TYPE_MACHINE_SID
'//
'// This con
'//
'typedef struct _SD_CHANGE_MACHINE_SID_INPUT {
' //
' // The current machine SID to change.
' // This define the offset from the beginning of the SD_GLOBAL_CHANGE_INPUT
' // structure of where the CurrentMachineSID to replace begins. This will
' // be a SID structure. The length defines the length of the imbedded SID
' // structure.
' //
' USHORT CurrentMachineSIDOffset;
' USHORT CurrentMachineSIDLength;
' //
' // The new machine SID value to set inplace of the current machine SID
' // This define the offset from the beginning of the SD_GLOBAL_CHANGE_INPUT
' // structure of where the NewMachineSID to set begins. This will
' // be a SID structure. The length defines the length of the imbedded SID
' // structure.
' //
' USHORT NewMachineSIDOffset;
' USHORT NewMachineSIDLength;
'} SD_CHANGE_MACHINE_SID_INPUT, *PSD_CHANGE_MACHINE_SID_INPUT;
'typedef struct _SD_CHANGE_MACHINE_SID_OUTPUT {
' //
' // How many entries were successfully changed in the $Secure stream
' //
' ULONGLONG NumSDChangedSuccess;
' //
' // How many entires failed the update in the $Secure stream
' //
' ULONGLONG NumSDChangedFail;
' //
' // How many entires are unused in the current security stream
' //
' ULONGLONG NumSDUnused;
' //
' // The total number of entries processed in the $Secure stream
' //
' ULONGLONG NumSDTotal;
' //
' // How many entries were successfully changed in the $MFT file
' //
' ULONGLONG NumMftSDChangedSuccess;
' //
' // How many entries failed the update in the $MFT file
' //
' ULONGLONG NumMftSDChangedFail;
' //
' // Total number of entriess process in the $MFT file
' //
' ULONGLONG NumMftSDTotal;
'} SD_CHANGE_MACHINE_SID_OUTPUT, *PSD_CHANGE_MACHINE_SID_OUTPUT;
'//
'// Generic INPUT & OUTPUT structures for FSCTL_SD_GLOBAL_CHANGE
'//
'#if _MSC_VER >= 1200
'#pragma warning(push)
'#endif
'#pragma warning(disable:4201) // unnamed struct
'typedef struct _SD_GLOBAL_CHANGE_INPUT
'{
' //
' // Input flags (none currently defined)
' //
' ULONG Flags;
' //
' // Specifies which type of change we are doing and pics which member
' // of the below union is in use.
' //
' ULONG ChangeType;
' union {
' SD_CHANGE_MACHINE_SID_INPUT SdChange;
' };
'} SD_GLOBAL_CHANGE_INPUT, *PSD_GLOBAL_CHANGE_INPUT;
'typedef struct _SD_GLOBAL_CHANGE_OUTPUT
'{
' //
' // Output State Flags (none currently defined)
' //
' ULONG Flags;
' //
' // Specifies which below union to use
' //
' ULONG ChangeType;
' union {
' SD_CHANGE_MACHINE_SID_OUTPUT SdChange;
' };
'} SD_GLOBAL_CHANGE_OUTPUT, *PSD_GLOBAL_CHANGE_OUTPUT;
'#if _MSC_VER >= 1200
'#pragma warning(pop)
'#else
'#pragma warning( default : 4201 ) /* nonstandard extension used : nameless struct/union */
'#endif
'//
'// Flag to indicate the encrypted file is sparse
'//
'#define ENCRYPTED_DATA_INFO_SPARSE_FILE 1
'typedef struct _EXTENDED_ENCRYPTED_DATA_INFO {
' //
' // This is really a 4 byte character array which
' // must have the value "EXTD". We use this
' // to determine if we should read the extended data
' // or not.
' //
' ULONG ExtendedCode;
' //
' // The length of the extended data structure
' //
' ULONG Length;
' //
' // Encrypted data flags (currently only sparse is defined)
' //
' ULONG Flags;
' ULONG Reserved;
'} EXTENDED_ENCRYPTED_DATA_INFO, *PEXTENDED_ENCRYPTED_DATA_INFO;
'typedef struct _LOOKUP_STREAM_FROM_CLUSTER_INPUT {
' //
' // Flags for the operation. Currently no flags are defined.
' //
' ULONG Flags;
' //
' // Number of clusters in the following array of clusters.
' // The input buffer must be large enough to contain this
' // number or the operation will fail.
' //
' ULONG NumberOfClusters;
' //
' // An array of one or more clusters to look up.
' //
' LARGE_INTEGER Cluster[1];
'} LOOKUP_STREAM_FROM_CLUSTER_INPUT, *PLOOKUP_STREAM_FROM_CLUSTER_INPUT;
'typedef struct _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT {
' //
' // Offset from the beginning of this structure to the first entry
' // returned. If no entries are returned, this value is zero.
' //
' ULONG Offset;
' //
' // Number of matches to the input criteria. Note that more matches
' // may be found than entries returned if the buffer is not large
' // enough.
' //
' ULONG NumberOfMatches;
' //
' // Minimum size of the buffer, in bytes, which would be needed to
' // contain all matching entries to the input criteria.
' //
' ULONG BufferSizeRequired;
'} LOOKUP_STREAM_FROM_CLUSTER_OUTPUT, *PLOOKUP_STREAM_FROM_CLUSTER_OUTPUT;
'#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_PAGE_FILE 0x00000001
'#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_DENY_DEFRAG_SET 0x00000002
'#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_FS_SYSTEM_FILE 0x00000004
'#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_TXF_SYSTEM_FILE 0x00000008
'#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_MASK 0xff000000
'#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_DATA 0x01000000
'#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_INDEX 0x02000000
'#define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_SYSTEM 0x03000000
'typedef struct _LOOKUP_STREAM_FROM_CLUSTER_ENTRY {
' //
' // Offset from the beginning of this structure to the next entry
' // returned. If there are no more entries, this value is zero.
' //
' ULONG OffsetToNext;
' //
' // Flags describing characteristics about this stream.
' //
' ULONG Flags;
' //
' // This value is reserved and is currently zero.
' //
' LARGE_INTEGER Reserved;
' //
' // This is the cluster that this entry refers to. It will be one
' // of the clusters passed in the input structure.
' //
' LARGE_INTEGER Cluster;
' //
' // A NULL-terminated Unicode string containing the path of the
' // object relative to the root of the volume. This string
' // will refer to the attribute or stream represented by the
' // cluster.
' //
' WCHAR FileName[1];
'} LOOKUP_STREAM_FROM_CLUSTER_ENTRY, *PLOOKUP_STREAM_FROM_CLUSTER_ENTRY;
'//
'// This is the structure for the FSCTL_FILE_TYPE_NOTIFICATION operation.
'// Its purpose is to notify the storage stack about the extents of certain
'// types of files. This is only callable from kernel mode
'//
'typedef struct _FILE_TYPE_NOTIFICATION_INPUT {
' //
' // Flags for this operation
' // FILE_TYPE_NOTIFICATION_FLAG_*
' //
' ULONG Flags;
' //
' // A count of how many FileTypeID guids are given
' //
' ULONG NumFileTypeIDs;
' //
' // This is a unique identifer for the type of file notification occuring
' //
' GUID FileTypeID[1];
'} FILE_TYPE_NOTIFICATION_INPUT, *PFILE_TYPE_NOTIFICATION_INPUT;
'//
'// Flags for the given operation
'//
'#define FILE_TYPE_NOTIFICATION_FLAG_USAGE_BEGIN 0x00000001 //Set when adding the specified usage on the given file
'#define FILE_TYPE_NOTIFICATION_FLAG_USAGE_END 0x00000002 //Set when removing the specified usage on the given file
'//
'// These are the globally defined file types
'//
'DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_PAGE_FILE, 0x0d0a64a1, 0x38fc, 0x4db8, 0x9f, 0xe7, 0x3f, 0x43, 0x52, 0xcd, 0x7c, 0x5c );
'DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_HIBERNATION_FILE, 0xb7624d64, 0xb9a3, 0x4cf8, 0x80, 0x11, 0x5b, 0x86, 0xc9, 0x40, 0xe7, 0xb7 );
'DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_CRASHDUMP_FILE, 0x9d453eb7, 0xd2a6, 0x4dbd, 0xa2, 0xe3, 0xfb, 0xd0, 0xed, 0x91, 0x09, 0xa9 );
'#endif /* _WIN32_WINNT >= 0x0601 */
'#endif // _FILESYSTEMFSCTL_
'// end_winioctl
'//
'// Structures for FSCTL_SET_REPARSE_POINT, FSCTL_GET_REPARSE_POINT, and FSCTL_DELETE_REPARSE_POINT
'//
'//
'// The reparse structure is used by layered drivers to store data in a
'// reparse point. The constraints on reparse tags are defined below.
'// This version of the reparse data buffer is only for Microsoft tags.
'//
'#if _MSC_VER >= 1200
'#pragma warning(push)
'#endif
'#pragma warning(disable:4201) // unnamed struct
%EQUATE `SYMLINK_FLAG_RELATIVE = 1
' // Size = 16 bytes
TYPE REPARSE_DATA_BUFFER_SymbolicLinkReparseBuffer BYTE
 SubstituteNameOffset AS WORD ' USHORT
 SubstituteNameLength AS WORD ' USHORT
 PrintNameOffset AS WORD ' USHORT
 PrintNameLength AS WORD ' USHORT
 Flags AS DWORD ' ULONG
 PathBuffer AS WSTRINGZ * 2 ' WCHAR[1]
 ' Note: We are using AS WSTRINGZ * 2 instead of * 1 to keep DWORD alignment
END TYPE
' // Size = 10 bytes
TYPE REPARSE_DATA_BUFFER_MountPointReparseBuffer BYTE
 SubstituteNameOffset AS WORD ' USHORT
 SubstituteNameLength AS WORD ' USHORT
 PrintNameOffset AS WORD ' USHORT
 PrintNameLength AS WORD ' USHORT
 PathBuffer AS WSTRINGZ * 1 ' WCHAR[1]
END TYPE
' // Size = 1 byte
TYPE REPARSE_DATA_BUFFER_GenericReparseBuffer BYTE
 DataBuffer(0) AS BYTE ' UCHAR DataBuffer[1];
END TYPE
' // Size = 16 bytes
UNION REPARSE_DATA_BUFFER_UNION BYTE
 SymbolicLinkReparseBuffer AS REPARSE_DATA_BUFFER_SymbolicLinkReparseBuffer
 MountPointReparseBuffer AS REPARSE_DATA_BUFFER_MountPointReparseBuffer
 GenericReparseBuffer AS REPARSE_DATA_BUFFER_GenericReparseBuffer
END UNION
' // Size = 24 bytes
TYPE REPARSE_DATA_BUFFER BYTE
 ReparseTag AS DWORD ' ULONG
 ReparseDataLength AS WORD ' USHORT
 Reserved AS WORD ' USHORT
 REPARSE_DATA_BUFFER_UNION
END TYPE
'#if _MSC_VER >= 1200
'#pragma warning(pop)
'#else
'#pragma warning( default : 4201 )
'#endif
'#define REPARSE_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(REPARSE_DATA_BUFFER, GenericReparseBuffer)
'// begin_winnt
'//
'// The reparse GUID structure is used by all 3rd party layered drivers to
'// store data in a reparse point. For non-Microsoft tags, The GUID field
'// cannot be GUID_NULL.
'// The constraints on reparse tags are defined below.
'// Microsoft tags can also be used with this format of the reparse point buffer.
'//
'typedef struct _REPARSE_GUID_DATA_BUFFER {
' ULONG ReparseTag;
' USHORT ReparseDataLength;
' USHORT Reserved;
' GUID ReparseGuid;
' struct {
' UCHAR DataBuffer[1];
' } GenericReparseBuffer;
'} REPARSE_GUID_DATA_BUFFER, *PREPARSE_GUID_DATA_BUFFER;
'#define REPARSE_GUID_DATA_BUFFER_HEADER_SIZE FIELD_OFFSET(REPARSE_GUID_DATA_BUFFER, GenericReparseBuffer)
'//
'// Maximum allowed size of the reparse data.
'//
'#define MAXIMUM_REPARSE_DATA_BUFFER_SIZE ( 16 * 1024 )
'//
'// Predefined reparse tags.
'// These tags need to avoid conflicting with IO_REMOUNT defined in ntos\inc\io.h
'//
'#define IO_REPARSE_TAG_RESERVED_ZERO (0)
'#define IO_REPARSE_TAG_RESERVED_ONE (1)
'//
'// The value of the following constant needs to satisfy the following conditions:
'// (1) Be at least as large as the largest of the reserved tags.
'// (2) Be strictly smaller than all the tags in use.
'//
'#define IO_REPARSE_TAG_RESERVED_RANGE IO_REPARSE_TAG_RESERVED_ONE
'//
'// The reparse tags are a ULONG. The 32 bits are laid out as follows:
'//
'// 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
'// 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
'// +-+-+-+-+-----------------------+-------------------------------+
'// |M|R|N|R| Reserved bits | Reparse Tag Value |
'// +-+-+-+-+-----------------------+-------------------------------+
'//
'// M is the Microsoft bit. When set to 1, it denotes a tag owned by Microsoft.
'// All ISVs must use a tag with a 0 in this position.
'// Note: If a Microsoft tag is used by non-Microsoft software, the
'// behavior is not defined.
'//
'// R is reserved. Must be zero for non-Microsoft tags.
'//
'// N is name surrogate. When set to 1, the file represents another named
'// entity in the system.
'//
'// The M and N bits are OR-able.
'// The following macros check for the M and N bit values:
'//
'//
'// Macro to determine whether a reparse point tag corresponds to a tag
'// owned by Microsoft.
'//
'#define IsReparseTagMicrosoft(_tag) ( \
' ((_tag) & 0x80000000) \
' )
'//
'// Macro to determine whether a reparse point tag is a name surrogate
'//
'#define IsReparseTagNameSurrogate(_tag) ( \
' ((_tag) & 0x20000000) \
' )
'// end_winnt
'//
'// The following constant represents the bits that are valid to use in
'// reparse tags.
'//
%EQUATE `IO_REPARSE_TAG_VALID_VALUES = &HF000FFFF
'//
'// Macro to determine whether a reparse tag is a valid tag.
'//
'#define IsReparseTagValid(_tag) ( \
' !((_tag) & ~IO_REPARSE_TAG_VALID_VALUES) && \
' ((_tag) > IO_REPARSE_TAG_RESERVED_RANGE) \
' )
'///////////////////////////////////////////////////////////////////////////////
'//
'// Microsoft tags for reparse points.
'//
'///////////////////////////////////////////////////////////////////////////////
'#define IO_REPARSE_TAG_MOUNT_POINT (0xA0000003L) // winnt
'#define IO_REPARSE_TAG_HSM (0xC0000004L) // winnt
'#define IO_REPARSE_TAG_DRIVE_EXTENDER (0x80000005L)
'#define IO_REPARSE_TAG_HSM2 (0x80000006L) // winnt
'#define IO_REPARSE_TAG_SIS (0x80000007L) // winnt
'#define IO_REPARSE_TAG_WIM (0x80000008L) // winnt
'#define IO_REPARSE_TAG_CSV (0x80000009L) // winnt
'#define IO_REPARSE_TAG_DFS (0x8000000AL) // winnt
'#define IO_REPARSE_TAG_FILTER_MANAGER (0x8000000BL)
'#define IO_REPARSE_TAG_SYMLINK (0xA000000CL) // winnt
'#define IO_REPARSE_TAG_IIS_CACHE (0xA0000010L)
'#define IO_REPARSE_TAG_DFSR (0x80000012L) // winnt
'///////////////////////////////////////////////////////////////////////////////
'//
'// Non-Microsoft tags for reparse points
'//
'///////////////////////////////////////////////////////////////////////////////
'//
'// Tag allocated to CONGRUENT, May 2000. Used by IFSTEST
'//
%EQUATE `IO_REPARSE_TAG_IFSTEST_CONGRUENT = &H00000009
'//
'// Tag allocated to Moonwalk Univeral for HSM
'// GUID: 257ABE42-5A28-4C8C-AC46-8FEA5619F18F
'//
%EQUATE `IO_REPARSE_TAG_MOONWALK_HSM = &H0000000A
'//
'// Tag allocated to Tsinghua Univeristy for Research purposes
'// No released products should use this tag
'// GUID: b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2
'//
%EQUATE `IO_REPARSE_TAG_TSINGHUA_UNIVERSITY_RESEARCH = &H0000000B
'//
'// Tag allocated to ARKIVIO for HSM
'//
%EQUATE `IO_REPARSE_TAG_ARKIVIO = &H0000000C
'//
'// Tag allocated to SOLUTIONSOFT for name surrogate
'//
%EQUATE `IO_REPARSE_TAG_SOLUTIONSOFT = &H2000000D
'//
'// Tag allocated to COMMVAULT for HSM
'//
%EQUATE `IO_REPARSE_TAG_COMMVAULT = &H0000000E
'//
'// Tag allocated to Overtone Software for HSM
'//
%EQUATE `IO_REPARSE_TAG_OVERTONE = &H0000000F
'//
'// Tag allocated to Symantec (formerly to KVS Inc) for HSM
'// GUID: A49F7BF6-77CA-493c-A0AA-18DBB28D1098
'//
%EQUATE `IO_REPARSE_TAG_SYMANTEC_HSM2 = &H00000010
'//
'// Tag allocated to Enigma Data for HSM
'//
%EQUATE `IO_REPARSE_TAG_ENIGMA_HSM = &H00000011
'//
'// Tag allocated to Symantec for HSM
'// GUID: B99F4235-CF1C-48dd-9E6C-459FA289F8C7
'//
%EQUATE `IO_REPARSE_TAG_SYMANTEC_HSM = &H00000012
'//
'// Tag allocated to INTERCOPE for HSM
'// GUID: F204BE2D-AEEB-4728-A31C-C7F4E9BEA758}
'//
%EQUATE `IO_REPARSE_TAG_INTERCOPE_HSM = &H00000013
'//
'// Tag allocated to KOM Networks for HSM
'//
%EQUATE `IO_REPARSE_TAG_KOM_NETWORKS_HSM = &H00000014
'//
'// Tag allocated to MEMORY_TECH for HSM
'// GUID: E51BA456-046C-43ea-AEC7-DC1A87E1FD49
'//
%EQUATE `IO_REPARSE_TAG_MEMORY_TECH_HSM = &H00000015
'//
'// Tag allocated to BridgeHead Software for HSM
'// GUID: EBAFF6E3-F21D-4496-8342-58144B3D2BD0
'//
%EQUATE `IO_REPARSE_TAG_BRIDGEHEAD_HSM = &H00000016
'//
'// Tag allocated to OSR for samples reparse point filter
'// GUID: 3740c860-b19b-11d9-9669-0800200c9a66
'//
%EQUATE `IO_REPARSE_TAG_OSR_SAMPLE = &H20000017
'//
'// Tag allocated to Global 360 for HSM
'// GUID: C4B51F66-7F00-4c55-9441-8A1B159F209B
'//
%EQUATE `IO_REPARSE_TAG_GLOBAL360_HSM = &H00000018
'//
'// Tag allocated to Altiris for HSM
'// GUID: fc1047eb-fb2d-45f2-a2f4-a71c1032fa2dB
'//
%EQUATE `IO_REPARSE_TAG_ALTIRIS_HSM = &H00000019
'//
'// Tag allocated to Hermes for HSM
'// GUID: 437E0FD5-FCB4-42fe-877A-C785DA662AC2
'//
%EQUATE `IO_REPARSE_TAG_HERMES_HSM = &H0000001A
'//
'// Tag allocated to PointSoft for HSM
'// GUID: 547BC7FD-9604-4deb-AE07-B6514DF5FBC6
'//
%EQUATE `IO_REPARSE_TAG_POINTSOFT_HSM = &H0000001B
'//
'// Tag allocated to GRAU Data Storage for HSM
'// GUID: 6662D310-5653-4D10-8C31-F8E166D1A1BD
'//
%EQUATE `IO_REPARSE_TAG_GRAU_DATASTORAGE_HSM = &H0000001C
'//
'// Tag allocated to CommVault for HSM
'// GUID: cc38adf3-c583-4efa-b183-72c1671941de
'//
%EQUATE `IO_REPARSE_TAG_COMMVAULT_HSM = &H0000001D
'//
'// Tag allocated to Data Storage Group for single instance storage
'// GUID: C1182673-0562-447a-8E40-4F0549FDF817
'//
%EQUATE `IO_REPARSE_TAG_DATASTOR_SIS = &H0000001E
'//
'// Tag allocated to Enterprise Data Solutions, Inc. for HSM
'// GUID: EB63DF9D-8874-41cd-999A-A197542CDAFC
'//
%EQUATE `IO_REPARSE_TAG_EDSI_HSM = &H0000001F
'//
'// Tag allocated to HP StorageWorks Reference Information Manager for Files (HSM)
'// GUID: 3B0F6B23-0C2E-4281-9C19-C6AEEBC88CD8
'//
%EQUATE `IO_REPARSE_TAG_HP_HSM = &H00000020
'//
'// Tag allocated to SER Beteiligung Solutions Deutschland GmbH (HSM)
'// GUID: 55B673F0-978E-41c5-9ADB-AF99640BE90E
'//
%EQUATE `IO_REPARSE_TAG_SER_HSM = &H00000021
'//
'// Tag allocated to Double-Take Software (formerly NSI Software, Inc.) for HSM
'// GUID: f7cb0ce8-453a-4ae1-9c56-db41b55f6ed4
'//
%EQUATE `IO_REPARSE_TAG_DOUBLE_TAKE_HSM = &H00000022
'//
'// Tag allocated to Beijing Wisdata Systems CO, LTD for HSM
'// GUID: d546500a-2aeb-45f6-9482-f4b1799c3177
'//
%EQUATE `IO_REPARSE_TAG_WISDATA_HSM = &H00000023
'//
'// Tag allocated to Mimosa Systems Inc for HSM
'// GUID: 8ddd4144-1a22-404b-8a5a-fcd91c6ee9f3
'//
%EQUATE `IO_REPARSE_TAG_MIMOSA_HSM = &H00000024
'//
'// Tag allocated to H&S Heilig und Schubert Software AG for HSM
'// GUID: 77CA30C0-E5EC-43df-9E44-A4910378E284
'//
%EQUATE `IO_REPARSE_TAG_HSAG_HSM = &H00000025
'//
'// Tag allocated to Atempo Inc. (Atempo Digital Archive) for HSM
'// GUID: 9B64518A-D6A4-495f-8D01-392F38862F0C
'//
%EQUATE `IO_REPARSE_TAG_ADA_HSM = &H00000026
'//
'// Tag allocated to Autonomy Corporation for HSM
'// GUID: EB112A57-10FC-4b42-B590-A61897FDC432
'//
%EQUATE `IO_REPARSE_TAG_AUTN_HSM = &H00000027
'//
'// Tag allocated to Nexsan for HSM
'// GUID: d35eba9a-e722-445d-865f-dde1120acf16
'//
%EQUATE `IO_REPARSE_TAG_NEXSAN_HSM = &H00000028
'//
'// Tag allocated to Double-Take for SIS
'// GUID: BDA506C2-F74D-4495-9A8D-44FD8D5B4F42
'//
%EQUATE `IO_REPARSE_TAG_DOUBLE_TAKE_SIS = &H00000029
'//
'// Tag allocated to Sony for HSM
'// GUID: E95032E4-FD81-4e15-A8E2-A1F078061C4E
'//
%EQUATE `IO_REPARSE_TAG_SONY_HSM = &H0000002A
'//
'// Tag allocated to Eltan Comm for HSM
'// GUID: E1596D9F-44D8-43f4-A2D6-E9FE8D3E28FB
'//
%EQUATE `IO_REPARSE_TAG_ELTAN_HSM = &H0000002B
'//
'// Tag allocated to Utixo LLC for HSM
'// GUID: 5401F960-2F95-46D0-BBA6-052929FE2C32
'//
%EQUATE `IO_REPARSE_TAG_UTIXO_HSM = &H0000002C
'//
'// Tag allocated to Quest Software for HSM
'// GUID: D546500A-2AEB-45F6-9482-F4B1799C3177
'//
%EQUATE `IO_REPARSE_TAG_QUEST_HSM = &H0000002D
'//
'// Tag allocated to DataGlobal GmbH for HSM
'// GUID: 7A09CA83-B7B1-4614-ADFD-0BD5F4F989C9
'//
%EQUATE `IO_REPARSE_TAG_DATAGLOBAL_HSM = &H0000002E
'//
'// Tag allocated to Qi Tech LLC for HSM
'// GUID: C8110B39-A4CE-432E-B58A-FBEAD296DF03
'//
%EQUATE `IO_REPARSE_TAG_QI_TECH_HSM = &H2000002F
'//
'// Tag allocated to DataFirst Corporation for HSM
'// GUID: E0E40591-6434-479f-94AC-DECF6DAEFB5C
'//
%EQUATE `IO_REPARSE_TAG_DATAFIRST_HSM = &H00000030
'//
'// Tag allocated to C2C Systems for HSM
'// GUID: 6F2F829C-36AE-4E88-A3B6-E2C24377EA1C
'//
%EQUATE `IO_REPARSE_TAG_C2CSYSTEMS_HSM = &H00000031
'//
'// Reparse point index keys.
'//
'// The index with all the reparse points that exist in a volume at a
'// given time contains entries with keys of the form
'// <reparse tag, file record id>.
'// The data part of these records is empty.
'//
'#pragma pack(4)
' // Size = 12 bytes
TYPE REPARSE_INDEX_KEY ' Must be 8 byte aligned
 ' // The tag of the reparse point.
 FileReparseTag AS DWORD
 ' // The file record Id where the reparse point is set.
 FileId AS QUAD
END TYPE
'#pragma pack()
'//
'// The following three FSCTLs are placed in this file to facilitate sharing
'// between the redirector and the IO subsystem
'//
'// This FSCTL is used to garner the link tracking information for a file.
'// The data structures used for retreving the information are
'// LINK_TRACKING_INFORMATION defined further down in this file.
'//
'#define FSCTL_LMR_GET_LINK_TRACKING_INFORMATION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,58,METHOD_BUFFERED,FILE_ANY_ACCESS)
%EQUATE `FSCTL_LMR_GET_LINK_TRACKING_INFORMATION = &H001400E8
'//
'// This FSCTL is used to update the link tracking information on a server for
'// an intra machine/ inter volume move on that server
'//
'#define FSCTL_LMR_SET_LINK_TRACKING_INFORMATION CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,59,METHOD_BUFFERED,FILE_ANY_ACCESS)
%EQUATE `FSCTL_LMR_SET_LINK_TRACKING_INFORMATION = &H001400EC
'//
'// The following IOCTL is used in link tracking implementation. It determines if the
'// two file objects passed in are on the same server. This IOCTL is available in
'// kernel mode only since it accepts FILE_OBJECT as parameters
'//
'#define IOCTL_LMR_ARE_FILE_OBJECTS_ON_SAME_SERVER CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,60,METHOD_BUFFERED,FILE_ANY_ACCESS)
%EQUATE `IOCTL_LMR_ARE_FILE_OBJECTS_ON_SAME_SERVER = &H001400F0
'//
'// Named Pipe file control code and structure declarations
'//
'//
'// External named pipe file control operations
'//
%EQUATE `FSCTL_PIPE_ASSIGN_EVENT = &H00110000 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
%EQUATE `FSCTL_PIPE_DISCONNECT = &H00110004 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
%EQUATE `FSCTL_PIPE_LISTEN = &H00110008 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
%EQUATE `FSCTL_PIPE_PEEK = &H0011400C ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
%EQUATE `FSCTL_PIPE_QUERY_EVENT = &H00110010 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
%EQUATE `FSCTL_PIPE_TRANSCEIVE = &H0011C017 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
%EQUATE `FSCTL_PIPE_WAIT = &H00110018 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
%EQUATE `FSCTL_PIPE_IMPERSONATE = &H0011001C ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
%EQUATE `FSCTL_PIPE_SET_CLIENT_PROCESS = &H00110020 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
%EQUATE `FSCTL_PIPE_QUERY_CLIENT_PROCESS = &H00110024 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
%EQUATE `FSCTL_PIPE_GET_PIPE_ATTRIBUTE = &H00110028 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
%EQUATE `FSCTL_PIPE_SET_PIPE_ATTRIBUTE = &H0011002C ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
%EQUATE `FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE = &H00110030 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
%EQUATE `FSCTL_PIPE_SET_CONNECTION_ATTRIBUTE = &H00110034 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 13, METHOD_BUFFERED, FILE_ANY_ACCESS)
%EQUATE `FSCTL_PIPE_GET_HANDLE_ATTRIBUTE = &H00110038 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 14, METHOD_BUFFERED, FILE_ANY_ACCESS)
%EQUATE `FSCTL_PIPE_SET_HANDLE_ATTRIBUTE = &H0011003C ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
%EQUATE `FSCTL_PIPE_FLUSH = &H00118040 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 16, METHOD_BUFFERED, FILE_WRITE_DATA)
'//
'// Internal named pipe file control operations
'//
%EQUATE `FSCTL_PIPE_INTERNAL_READ = &H00115FF4 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
%EQUATE `FSCTL_PIPE_INTERNAL_WRITE = &H00119FF8 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
%EQUATE `FSCTL_PIPE_INTERNAL_TRANSCEIVE = &H0011DFFF ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
%EQUATE `FSCTL_PIPE_INTERNAL_READ_OVFLOW = &H00116000 ' CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
'//
'// Define entry types for query event information
'//
%EQUATE `FILE_PIPE_READ_DATA = &H00000000
%EQUATE `FILE_PIPE_WRITE_SPACE = &H00000001
'//
'// Named pipe file system control structure declarations
'//
'// Control structure for FSCTL_PIPE_ASSIGN_EVENT
' // Size = 8 bytes
TYPE FILE_PIPE_ASSIGN_EVENT_BUFFER
 EventHandle AS DWORD
 KeyValue AS DWORD ' ULONG
END TYPE
'// Control structure for FSCTL_PIPE_PEEK
' // Size = 20 bytes
TYPE FILE_PIPE_PEEK_BUFFER DWORD
 NamedPipeState AS DWORD ' ULONG
 ReadDataAvailable AS DWORD ' ULONG
 NumberOfMessages AS DWORD ' ULONG
 MessageLength AS DWORD ' ULONG
 Data(0) AS BYTE ' CHAR Data[1]
END TYPE
'// Control structure for FSCTL_PIPE_QUERY_EVENT
' // Size = 20 bytes
TYPE FILE_PIPE_EVENT_BUFFER DWORD
 NamedPipeState AS DWORD ' ULONG
 EntryType AS DWORD ' ULONG
 ByteCount AS DWORD ' ULONG
 KeyValue AS DWORD ' ULONG
 NumberRequests AS DWORD ' ULONG
END TYPE
'// Control structure for FSCTL_PIPE_WAIT
' // Size = 16 bytes
TYPE FILE_PIPE_WAIT_FOR_BUFFER ' Must be 8 byte aligned
 Timeout AS QUAD ' LARGE_INTEGER
 NameLength AS DWORD ' ULONG
 TimeoutSpecified AS BYTE ' BOOLEAN
 Name AS WSTRINGZ * 1 ' WCHAR Name[1]
END TYPE
'// Control structure for FSCTL_PIPE_SET_CLIENT_PROCESS and FSCTL_PIPE_QUERY_CLIENT_PROCESS
'typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER {
'#if !defined(BUILD_WOW6432)
' PVOID ClientSession;
' PVOID ClientProcess;
'#else
' ULONGLONG ClientSession;
' ULONGLONG ClientProcess;
'#endif
'} FILE_PIPE_CLIENT_PROCESS_BUFFER, *PFILE_PIPE_CLIENT_PROCESS_BUFFER;
' // Size = 8 bytes
TYPE FILE_PIPE_CLIENT_PROCESS_BUFFER DWORD
 ClientSession AS DWORD
 ClientProcess AS DWORD
END TYPE
'// This is an extension to the client process info buffer containing the client
'// computer name
%EQUATE `FILE_PIPE_COMPUTER_NAME_LENGTH = 15
'typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX {
'#if !defined(BUILD_WOW6432)
' PVOID ClientSession;
' PVOID ClientProcess;
'#else
' ULONGLONG ClientSession;
' ULONGLONG ClientProcess;
'#endif
' USHORT ClientComputerNameLength; // in bytes
' WCHAR ClientComputerBuffer[FILE_PIPE_COMPUTER_NAME_LENGTH+1]; // terminated
'} FILE_PIPE_CLIENT_PROCESS_BUFFER_EX, *PFILE_PIPE_CLIENT_PROCESS_BUFFER_EX;
' // Size = 44 bytes
TYPE FILE_PIPE_CLIENT_PROCESS_BUFFER_EX DWORD
 ClientSession AS DWORD
 ClientProcess AS DWORD
 ClientComputerNameLength AS WORD ' USHORT // in bytes
 ClientComputerBuffer AS WSTRINGZ * %FILE_PIPE_COMPUTER_NAME_LENGTH + 1 ' WCHAR[FILE_PIPE_COMPUTER_NAME_LENGTH+1] // terminated
END TYPE
'//
'// Mailslot file control operations.
'//
'#define FSCTL_MAILSLOT_PEEK CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA) // ntifs
%EQUATE `FSCTL_MAILSLOT_PEEK = &H000C4003
'//
'// Control structure for FSCTL_LMR_GET_LINK_TRACKING_INFORMATION
'//
'//
'// For links on DFS volumes the volume id and machine id are returned for
'// link tracking
'//
' enum LINK_TRACKING_INFORMATION_TYPE
%EQUATE `NtfsLinkTrackingInformation = 0
%EQUATE `DfsLinkTrackingInformation = 1
' // Size = 20 bytes
TYPE LINK_TRACKING_INFORMATION BYTE
 Type AS LONG ' LINK_TRACKING_INFORMATION_TYPE
 VolumeId(15) AS BYTE ' UCHAR VolumeId[16];
END TYPE
'//
'// Control structure for FSCTL_LMR_SET_LINK_TRACKING_INFORMATION
'//
' // Size = 12 bytes
TYPE REMOTE_LINK_TRACKING_INFORMATION DWORD
 TargetFileObject AS DWORD
 TargetLinkTrackingInformationLength AS DWORD ' ULONG
 TargetLinkTrackingInformationBuffer(0) AS BYTE ' UCHAR[1]
END TYPE
'#if (_WIN32_WINNT >= 0x0601)
'#pragma warning(push)
'#pragma warning(disable : 4200)
'#pragma warning(disable : 4201)
#IF NOT %DEF(%VIRTUAL_STORAGE_TYPE_DEFINED)
%EQUATE `VIRTUAL_STORAGE_TYPE_DEFINED = 1
' // Size = 20 bytes
TYPE VIRTUAL_STORAGE_TYPE DWORD
 DeviceId AS DWORD ' ULONG
 VendorId AS GUID ' GUID
END TYPE
#ENDIF
'//
'// These structures are used by the FSCTL_QUERY_DEPENDENT_VOLUME
'//
' // Size = 8 bytes
TYPE STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST DWORD
 RequestLevel AS DWORD ' ULONG
 RequestFlags AS DWORD ' ULONG
END TYPE
%EQUATE `QUERY_DEPENDENT_VOLUME_REQUEST_FLAG_HOST_VOLUMES = &H1
%EQUATE `QUERY_DEPENDENT_VOLUME_REQUEST_FLAG_GUEST_VOLUMES = &H2
' // Size = 32 bytes
TYPE STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY DWORD
 EntryLength AS DWORD ' ULONG
 DependencyTypeFlags AS DWORD ' ULONG
 ProviderSpecificFlags AS DWORD ' ULONG
 VirtualStorageType AS VIRTUAL_STORAGE_TYPE
END TYPE
' // Size = 68 bytes
TYPE STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY DWORD
 EntryLength AS DWORD ' ULONG
 DependencyTypeFlags AS DWORD ' ULONG
 ProviderSpecificFlags AS DWORD ' ULONG
 VirtualStorageType AS VIRTUAL_STORAGE_TYPE
 AncestorLevel AS DWORD ' ULONG // Root parent is 0, every child level after that is incremented
 HostVolumeNameOffset AS DWORD ' ULONG
 HostVolumeNameSize AS DWORD ' ULONG
 DependentVolumeNameOffset AS DWORD ' ULONG
 DependentVolumeNameSize AS DWORD ' ULONG
 RelativePathOffset AS DWORD ' ULONG
 RelativePathSize AS DWORD ' ULONG
 DependentDeviceNameOffset AS DWORD ' ULONG
 DependentDeviceNameSize AS DWORD ' ULONG
END TYPE
' // Size = 68 bytes
UNION STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE_UNION DWORD
 Lev1Depends AS STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY ' Lev1Depends[]
 Lev2Depends AS STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY ' Lev2Depends[];
END UNION
' // Size = 76 bytes
TYPE STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE DWORD
 ResponseLevel AS DWORD ' ULONG
 NumberEntries AS DWORD ' ULONG
 STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE_UNION
END TYPE
'#pragma warning(pop)
'#endif // WinVer >= 0x0601
'//
'// Object Information Classes
'//
' enum _OBJECT_INFORMATION_CLASS
%EQUATE `ObjectBasicInformation = 0
%EQUATE `ObjectTypeInformation = 2
'//
'// Public Object Information definitions
'//
' // Size = 56 bytes
TYPE PUBLIC_OBJECT_BASIC_INFORMATION DWORD
 Attributes AS DWORD ' ULONG
 GrantedAccess AS ACCESS_MASK ' ACCESS_MASK
 HandleCount AS DWORD ' ULONG
 PointerCount AS DWORD ' ULONG
 Reserved(9) AS DWORD ' ULONG // reserved for internal use
END TYPE
' // Size = 96 bytes
TYPE PUBLIC_OBJECT_TYPE_INFORMATION DWORD
 TypeName AS UNICODE_STRING
 Reserved(21) AS DWORD ' ULONG[22] // reserved for internal use
END TYPE
'#if (NTDDI_VERSION >= NTDDI_NT4)
DECLARE FUNCTION NtQueryObject LIB "ntdll.dll" ALIAS "NtQueryObject" ( BYVAL Handle AS QUAD , BYVAL ObjectInformationClass AS LONG , BYREF ObjectInformation AS ANY , BYVAL ObjectInformationLength AS QUAD , BYREF ReturnLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtSetSecurityObject LIB "ntdll.dll" ALIAS "NtSetSecurityObject" ( BYVAL Handle AS QUAD , BYVAL SecurityInformation AS SECURITY_INFORMATION , BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtQuerySecurityObject LIB "ntdll.dll" ALIAS "NtQuerySecurityObject" ( BYVAL Handle AS QUAD , BYVAL SecurityInformation AS SECURITY_INFORMATION , BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR , BYVAL Length AS QUAD , BYREF LengthNeeded AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtClose LIB "ntdll.dll" ALIAS "NtClose" ( BYVAL Handle AS QUAD ) AS LONG ' NTSTATUS
'#endif // NTDDI_VERSION >= NTDDI_WIN2K
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION NtCreateSection LIB "ntdll.dll" ALIAS "NtCreateSection" ( BYREF SectionHandle AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYREF ObjectAttributes AS OBJECT_ATTRIBUTES , BYREF MaximumSize AS ANY , BYVAL SectionPageProtection AS QUAD , BYVAL AllocationAttributes AS QUAD __ , BYVAL FileHandle AS QUAD ) AS LONG ' NTSTATUS
'#endif // NTDDI_VERSION >= NTDDI_WINXP
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtAllocateVirtualMemory LIB "ntdll.dll" ALIAS "NtAllocateVirtualMemory" ( BYVAL ProcessHandle AS QUAD , BYREF BaseAddress AS ANY , BYVAL ZeroBits AS QUAD , BYREF RegionSize AS QUAD , BYVAL AllocationType AS QUAD , BYVAL Protect AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION NtFreeVirtualMemory LIB "ntdll.dll" ALIAS "NtFreeVirtualMemory" ( BYVAL ProcessHandle AS QUAD , BYREF BaseAddress AS ANY , BYREF RegionSize AS QUAD , BYVAL FreeType AS QUAD ) AS LONG ' NTSTATUS
'#endif // NTDDI_VERSION >= NTDDI_WIN2K
'//
'// Data structure used to represent client security context for a thread.
'// This data structure is used to support impersonation.
'//
'// THE FIELDS OF THIS DATA STRUCTURE SHOULD BE CONSIDERED OPAQUE
'// BY ALL EXCEPT THE SECURITY ROUTINES.
'//
' // Size = 60 bytes
TYPE SECURITY_CLIENT_CONTEXT DWORD FILL
 SecurityQos AS SECURITY_QUALITY_OF_SERVICE
 ClientToken AS DWORD ' PACCESS_TOKEN
 DirectlyAccessClientToken AS BYTE ' BOOLEAN
 DirectAccessEffectiveOnly AS BYTE ' BOOLEAN
 ServerIsRemote AS BYTE ' BOOLEAN
 ClientTokenControl AS TOKEN_CONTROL
END TYPE
'//
'// where
'//
'// SecurityQos - is the security quality of service information in effect
'// for this client. This information is used when directly accessing
'// the client's token. In this case, the information here over-rides
'// the information in the client's token. If a copy of the client's
'// token is requested, it must be generated using this information,
'// not the information in the client's token. In all cases, this
'// information may not provide greater access than the information
'// in the client's token. In particular, if the client's token is
'// an impersonation token with an impersonation level of
'// "SecurityDelegation", but the information in this field indicates
'// an impersonation level of "SecurityIdentification", then
'// the server may only get a copy of the token with an Identification
'// level of impersonation.
'//
'// ClientToken - If the DirectlyAccessClientToken field is FALSE,
'// then this field contains a pointer to a duplicate of the
'// client's token. Otherwise, this field points directly to
'// the client's token.
'//
'// DirectlyAccessClientToken - This boolean flag indicates whether the
'// token pointed to by ClientToken is a copy of the client's token
'// or is a direct reference to the client's token. A value of TRUE
'// indicates the client's token is directly accessed, FALSE indicates
'// a copy has been made.
'//
'// DirectAccessEffectiveOnly - This boolean flag indicates whether the
'// the disabled portions of the token that is currently directly
'// referenced may be enabled. This field is only valid if the
'// DirectlyAccessClientToken field is TRUE. In that case, this
'// value supersedes the EffectiveOnly value in the SecurityQos
'// FOR THE CURRENT TOKEN ONLY! If the client changes to impersonate
'// another client, this value may change. This value is always
'// minimized by the EffectiveOnly flag in the SecurityQos field.
'//
'// ServerIsRemote - If TRUE indicates that the server of the client's
'// request is remote. This is used for determining the legitimacy
'// of certain levels of impersonation and to determine how to
'// track context.
'//
'// ClientTokenControl - If the ServerIsRemote flag is TRUE, and the
'// tracking mode is DYNAMIC, then this field contains a copy of
'// the TOKEN_SOURCE from the client's token to assist in deciding
'// whether the information at the remote server needs to be
'// updated to match the current state of the client's security
'// context.
'//
'//
'// NOTE: At some point, we may find it worthwhile to keep an array of
'// elements in this data structure, where each element of the
'// array contains {ClientToken, ClientTokenControl} fields.
'// This would allow efficient handling of the case where a client
'// thread was constantly switching between a couple different
'// contexts - presumably impersonating client's of its own.
'//
'#define NTKERNELAPI DECLSPEC_IMPORT
'#define NTHALAPI DECLSPEC_IMPORT
'//
'// Priority increment definitions. The comment for each definition gives
'// the names of the system services that use the definition when satisfying
'// a wait.
'//
'//
'// Priority increment used when satisfying a wait on an executive event
'// (NtPulseEvent and NtSetEvent)
'//
%EQUATE `EVENT_INCREMENT = 1
'//
'// Priority increment when no I/O has been done. This is used by device
'// and file system drivers when completing an IRP (IoCompleteRequest).
'//
%EQUATE `IO_NO_INCREMENT = 0
'//
'// Priority increment for completing CD-ROM I/O. This is used by CD-ROM device
'// and file system drivers when completing an IRP (IoCompleteRequest)
'//
%EQUATE `IO_CD_ROM_INCREMENT = 1
'//
'// Priority increment for completing disk I/O. This is used by disk device
'// and file system drivers when completing an IRP (IoCompleteRequest)
'//
%EQUATE `IO_DISK_INCREMENT = 1
'//
'// Priority increment for completing mailslot I/O. This is used by the mail-
'// slot file system driver when completing an IRP (IoCompleteRequest).
'//
%EQUATE `IO_MAILSLOT_INCREMENT = 2
'//
'// Priority increment for completing named pipe I/O. This is used by the
'// named pipe file system driver when completing an IRP (IoCompleteRequest).
'//
%EQUATE `IO_NAMED_PIPE_INCREMENT = 2
'//
'// Priority increment for completing network I/O. This is used by network
'// device and network file system drivers when completing an IRP
'// (IoCompleteRequest).
'//
%EQUATE `IO_NETWORK_INCREMENT = 2
'//
'// Priority increment used when satisfying a wait on an executive semaphore
'// (NtReleaseSemaphore)
'//
%EQUATE `SEMAPHORE_INCREMENT = 1
'//
'// Memory priority definitions.
'//
%EQUATE `SYSTEM_PAGE_PRIORITY_BITS = 3
%EQUATE `SYSTEM_PAGE_PRIORITY_LEVELS = 8 ' (1 << SYSTEM_PAGE_PRIORITY_BITS)
'//
'// Miscellaneous type definitions
'//
'// APC state
'//
'// N.B. The user APC pending field must be the last member of this structure.
'//
' // Size = 24 bytes
TYPE KAPC_STATE
 ApcListHead(1) AS LIST_ENTRY ' LIST_ENTRY ApcListHead[MaximumMode]; MaximumMode = 2
 Process AS DWORD ' struct _KPROCESS *
 KernelApcInProgress AS BYTE ' BOOLEAN
 KernelApcPending AS BYTE ' BOOLEAN
 UserApcPending AS BYTE ' BOOLEAN
 alignment__ AS BYTE ' // To keep DWORD alignment
END TYPE
'#define KAPC_STATE_ACTUAL_LENGTH \
' (FIELD_OFFSET(KAPC_STATE, UserApcPending) + sizeof(BOOLEAN))
'//
'// Queue object
'//
'#define ASSERT_QUEUE(Q) NT_ASSERT(KOBJECT_TYPE(Q) == QueueObject);
'// begin_ntosp
' // Taken from wdm.h
#IF NOT %DEF(%DISPATCHER_HEADER_DEFINED)
 %DISPATCHER_HEADER_DEFINED = 1
'//
'// Common dispatcher object header
'//
'// N.B. The size field contains the number of dwords in the structure.
'//
%EQUATE `TIMER_EXPIRED_INDEX_BITS = 6
%EQUATE `TIMER_PROCESSOR_INDEX_BITS = 5
TYPE DISPATCHER_HEADER_DUMMYSTRUCT1 BYTE
 Absolute AS BIT * 1 IN BYTE ' UCHAR
 Coalescable AS BIT * 1
 KeepShifting AS BIT * 1 ' // Periodic timer
 EncodedTolerableDelay AS BIT * 5 ' // Periodic timer
END TYPE
UNION DISPATCHER_HEADER_DUMMYUNION1 BYTE ' // Timer
 TimerControlFlags AS BYTE
 DISPATCHER_HEADER_DUMMYSTRUCT1
END UNION
UNION DISPATCHER_HEADER_DUMMYUNION2 BYTE
 DISPATCHER_HEADER_DUMMYUNION1
 Abandoned AS BYTE ' UCHAR // Queue
 Signalling AS BYTE ' BOOLEAN // Gate/Events
END UNION
TYPE DISPATCHER_HEADER_DUMMYSTRUCT2 BYTE
 CpuThrottled AS BIT * 1 IN BYTE ' UCHAR
 CycleProfiling AS BIT * 1
 CounterProfiling AS BIT * 1
 Reserved AS BIT * 5
END TYPE
UNION DISPATCHER_HEADER_DUMMYUNION3 BYTE
 ThreadControlFlags AS BYTE ' UCHAR // Thread
 DISPATCHER_HEADER_DUMMYSTRUCT2
END UNION
UNION DISPATCHER_HEADER_DUMMYUNION4 BYTE
 DISPATCHER_HEADER_DUMMYUNION3
 Hand AS BYTE ' UCHAR // Timer
 Size AS BYTE ' UCHAR // All other objects
END UNION
TYPE DISPATCHER_HEADER_DUMMYSTRUCT3 BYTE
 Index AS BIT * 1 IN BYTE ' UCHAR
 Processor AS BIT * %TIMER_PROCESSOR_INDEX_BITS
 Inserted AS BIT * 1
 Expired AS BIT * 1
END TYPE
UNION DISPATCHER_HEADER_DUMMYUNION5 BYTE ' // Timer
 TimerMiscFlags AS BYTE ' UCHAR
 DISPATCHER_HEADER_DUMMYSTRUCT3
END UNION
TYPE DISPATCHER_HEADER_DUMMYSTRUCT4 BYTE
 ActiveDR7 AS BIT * 1 IN BYTE ' BOOLEAN
 Instrumented AS BIT * 1
 Reserved2 AS BIT * 4
 UmsScheduled AS BIT * 1
 UmsPrimary AS BIT * 1
END TYPE
UNION DISPATCHER_HEADER_DUMMYUNION6 BYTE ' // Thread
 DebugActive AS BYTE ' BOOLEAN
 DISPATCHER_HEADER_DUMMYSTRUCT4
END UNION
UNION DISPATCHER_HEADER_DUMMYUNION7 BYTE ' // Thread
 DISPATCHER_HEADER_DUMMYUNION5
 DISPATCHER_HEADER_DUMMYUNION6
 DpcActive AS BYTE ' BOOLEAN // Mutant
END UNION
TYPE DISPATCHER_HEADER_DUMMYSTRUCT5 BYTE
 Type AS BYTE ' UCHAR // All (accessible via KOBJECT_TYPE)
 DISPATCHER_HEADER_DUMMYUNION2
 DISPATCHER_HEADER_DUMMYUNION4
 DISPATCHER_HEADER_DUMMYUNION7
END TYPE
UNION DISPATCHER_HEADER_DUMMYUNION8 BYTE
 DISPATCHER_HEADER_DUMMYSTRUCT5
 Lock AS LONG ' volatile LONG // Interlocked
END UNION
' // Size = 16 bytes
TYPE DISPATCHER_HEADER BYTE
 DISPATCHER_HEADER_DUMMYUNION8
 SignalState AS LONG ' LONG // Object lock
 WaitListHead AS LIST_ENTRY ' LIST_ENTRY // Object lock
END TYPE
#ENDIF ' #IF NOT %DEF(%DISPATCHER_HEADER_DEFINED)
' // Size = 40 bytes
TYPE KQUEUE BYTE
 Header AS DISPATCHER_HEADER
 EntryListHead AS LIST_ENTRY ' // Object lock
 CurrentCount AS DWORD ' volatile ULONG // Interlocked
 MaximumCount AS DWORD ' ULONG
 ThreadListHead AS LIST_ENTRY ' LIST_ENTRY // Object lock
END TYPE
'// end_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'KeInitializeMutant (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'KeQueryOwnerMutant (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'KeReadStateMutant (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
' " any synchronization guarantees, only a hint"
' " to the system that the thread will immediately"
' " issue a wait operation"))
'NTKERNELAPI
'KeReleaseMutant (
' );
'#endif
'//
'// Queue Object.
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'KeInitializeQueue (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'KeReadStateQueue (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'KeInsertQueue (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'KeInsertHeadQueue (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PLIST_ENTRY
'KeRemoveQueue (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'ULONG
'KeRemoveQueueEx (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PLIST_ENTRY
'KeRundownQueue (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'KeAttachProcess (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'KeDetachProcess (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'KeStackAttachProcess (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'KeUnstackDetachProcess (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'UCHAR
'KeSetIdealProcessorThread (
' );
'#endif
'// begin_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'KeSetKernelStackSwapEnable (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'_DECL_HAL_KE_IMPORT
'KIRQL
'FASTCALL
'KeAcquireQueuedSpinLock (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'_DECL_HAL_KE_IMPORT
'FASTCALL
'KeReleaseQueuedSpinLock (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'_DECL_HAL_KE_IMPORT
'LOGICAL
'FASTCALL
'KeTryToAcquireQueuedSpinLock (
' PKIRQL OldIrql
' );
'#endif
'#if defined(_X86_)
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'_DECL_HAL_KE_IMPORT
'KIRQL
'FASTCALL
'KeAcquireSpinLockRaiseToSynch (
' );
'#endif
'#else
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'KIRQL
'KeAcquireSpinLockRaiseToSynch (
' );
'#endif
'#endif
%EQUATE `INVALID_PROCESSOR_INDEX = &Hffffffff
'NTSTATUS
'KeGetProcessorNumberFromIndex (
' );
'ULONG
'KeGetProcessorIndexFromNumber (
' );
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'SIZE_T
'ExQueryPoolBlockSize(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'PSLIST_ENTRY
'FASTCALL
'InterlockedPushListSList (
' );
'#endif // NTDDI_VERSION >= NTDDI_WINXP
'//
'// Define interlocked lookaside list structure and allocation functions.
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'ExAdjustLookasideDepth (
' );
'#endif
'#if !defined(_X86AMD64_)
'#if defined(_WIN64)
'C_ASSERT(sizeof(ERESOURCE) == 0x68);
'C_ASSERT(FIELD_OFFSET(ERESOURCE,ActiveCount) == 0x18);
'C_ASSERT(FIELD_OFFSET(ERESOURCE,Flag) == 0x1a);
'#else
'C_ASSERT(sizeof(ERESOURCE) == 0x38);
'C_ASSERT(FIELD_OFFSET(ERESOURCE,ActiveCount) == 0x0c);
'C_ASSERT(FIELD_OFFSET(ERESOURCE,Flag) == 0x0e);
'#endif
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'ExDisableResourceBoostLite (
' );
'#endif
'#define ExDisableResourceBoost ExDisableResourceBoostLite
'//
'// Push lock definitions
'//
'#define EX_PUSH_LOCK ULONG_PTR
'#define PEX_PUSH_LOCK PULONG_PTR
'ExInitializePushLock (
' );
'//
'// Token Flags
'//
'// Flags that may be defined in the TokenFlags field of the token object,
'// or in an ACCESS_STATE structure
'//
%EQUATE `TOKEN_HAS_TRAVERSE_PRIVILEGE = &H0001
%EQUATE `TOKEN_HAS_BACKUP_PRIVILEGE = &H0002
%EQUATE `TOKEN_HAS_RESTORE_PRIVILEGE = &H0004
%EQUATE `TOKEN_WRITE_RESTRICTED = &H0008
%EQUATE `TOKEN_IS_RESTRICTED = &H0010
%EQUATE `TOKEN_SESSION_NOT_REFERENCED = &H0020
%EQUATE `TOKEN_SANDBOX_INERT = &H0040
%EQUATE `TOKEN_HAS_IMPERSONATE_PRIVILEGE = &H0080
%EQUATE `SE_BACKUP_PRIVILEGES_CHECKED = &H0100
%EQUATE `TOKEN_VIRTUALIZE_ALLOWED = &H0200
%EQUATE `TOKEN_VIRTUALIZE_ENABLED = &H0400
%EQUATE `TOKEN_IS_FILTERED = &H0800
%EQUATE `TOKEN_UIACCESS = &H1000
%EQUATE `TOKEN_NOT_LOW = &H2000
' // Size = 396 bytes
TYPE SE_EXPORTS DWORD
 ' // Privilege values
 SeCreateTokenPrivilege AS QUAD ' LUID
 SeAssignPrimaryTokenPrivilege AS QUAD ' LUID
 SeLockMemoryPrivilege AS QUAD ' LUID
 SeIncreaseQuotaPrivilege AS QUAD ' LUID
 SeUnsolicitedInputPrivilege AS QUAD ' LUID
 SeTcbPrivilege AS QUAD ' LUID
 SeSecurityPrivilege AS QUAD ' LUID
 SeTakeOwnershipPrivilege AS QUAD ' LUID
 SeLoadDriverPrivilege AS QUAD ' LUID
 SeCreatePagefilePrivilege AS QUAD ' LUID
 SeIncreaseBasePriorityPrivilege AS QUAD ' LUID
 SeSystemProfilePrivilege AS QUAD ' LUID
 SeSystemtimePrivilege AS QUAD ' LUID
 SeProfileSingleProcessPrivilege AS QUAD ' LUID
 SeCreatePermanentPrivilege AS QUAD ' LUID
 SeBackupPrivilege AS QUAD ' LUID
 SeRestorePrivilege AS QUAD ' LUID
 SeShutdownPrivilege AS QUAD ' LUID
 SeDebugPrivilege AS QUAD ' LUID
 SeAuditPrivilege AS QUAD ' LUID
 SeSystemEnvironmentPrivilege AS QUAD ' LUID
 SeChangeNotifyPrivilege AS QUAD ' LUID
 SeRemoteShutdownPrivilege AS QUAD ' LUID
 ' // Universally defined Sids
 SeNullSid AS SID PTR
 SeWorldSid AS SID PTR
 SeLocalSid AS SID PTR
 SeCreatorOwnerSid AS SID PTR
 SeCreatorGroupSid AS SID PTR
 ' // Nt defined Sids
 SeNtAuthoritySid AS SID PTR
 SeDialupSid AS SID PTR
 SeNetworkSid AS SID PTR
 SeBatchSid AS SID PTR
 SeInteractiveSid AS SID PTR
 SeLocalSystemSid AS SID PTR
 SeAliasAdminsSid AS SID PTR
 SeAliasUsersSid AS SID PTR
 SeAliasGuestsSid AS SID PTR
 SeAliasPowerUsersSid AS SID PTR
 SeAliasAccountOpsSid AS SID PTR
 SeAliasSystemOpsSid AS SID PTR
 SeAliasPrintOpsSid AS SID PTR
 SeAliasBackupOpsSid AS SID PTR
 ' // New Sids defined for NT5
 SeAuthenticatedUsersSid AS SID PTR
 SeRestrictedSid AS SID PTR
 SeAnonymousLogonSid AS SID PTR
 ' // New Privileges defined for NT5
 SeUndockPrivilege AS QUAD ' LUID
 SeSyncAgentPrivilege AS QUAD ' LUID
 SeEnableDelegationPrivilege AS QUAD ' LUID
 ' // New Sids defined for post-Windows 2000
 SeLocalServiceSid AS SID PTR
 SeNetworkServiceSid AS SID PTR
 ' // New Privileges defined for post-Windows 2000
 SeManageVolumePrivilege AS QUAD ' LUID
 SeImpersonatePrivilege AS QUAD ' LUID
 SeCreateGlobalPrivilege AS QUAD ' LUID
 ' // New Privileges defined for post Windows Server 2003
 SeTrustedCredManAccessPrivilege AS QUAD ' LUID
 SeRelabelPrivilege AS QUAD ' LUID
 SeIncreaseWorkingSetPrivilege AS QUAD ' LUID
 SeTimeZonePrivilege AS QUAD ' LUID
 SeCreateSymbolicLinkPrivilege AS QUAD ' LUID
 ' // New Sids defined for post Windows Server 2003
 SeIUserSid AS SID PTR
 ' // Mandatory Sids, ordered lowest to highest.
 SeUntrustedMandatorySid AS SID PTR
 SeLowMandatorySid AS SID PTR
 SeMediumMandatorySid AS SID PTR
 SeHighMandatorySid AS SID PTR
 SeSystemMandatorySid AS SID PTR
 SeOwnerRightsSid AS SID PTR
END TYPE
'///////////////////////////////////////////////////////////////////////////////
'// //
'// Logon session notification callback routines //
'// //
'///////////////////////////////////////////////////////////////////////////////
'//
'// These callback routines are used to notify file systems that have
'// registered of logon sessions being terminated, so they can cleanup state
'// associated with this logon session
'//
'typedef NTSTATUS
'(*PSE_LOGON_SESSION_TERMINATED_ROUTINE)(
'//++
'//
'// ULONG
'// SeLengthSid(
'// __in PSID Sid
'// );
'//
'// Routine Description:
'//
'// This routine computes the length of a SID.
'//
'// Arguments:
'//
'// Sid - Points to the SID whose length is to be returned.
'//
'// Return Value:
'//
'// The length, in bytes of the SID.
'//
'//--
'#define SeLengthSid( Sid ) \
' (8 + (4 * ((SID *)Sid)->SubAuthorityCount))
'//
'//VOID
'//SeDeleteClientSecurity(
'// __in PSECURITY_CLIENT_CONTEXT ClientContext
'// )
'//
'///*++
'//
'//Routine Description:
'//
'// This service deletes a client security context block,
'// performing whatever cleanup might be necessary to do so. In
'// particular, reference to any client token is removed.
'//
'//Arguments:
'//
'// ClientContext - Points to the client security context block to be
'// deleted.
'//
'//
'//Return Value:
'//
'//
'//
'//--*/
'//--
'// begin_ntosp
'#define SeDeleteClientSecurity(C) { \
' if (SeTokenType((C)->ClientToken) == TokenPrimary) { \
' PsDereferencePrimaryToken( (C)->ClientToken ); \
' } else { \
' PsDereferenceImpersonationToken( (C)->ClientToken ); \
' } \
' }
'//++
'//VOID
'//SeStopImpersonatingClient()
'//
'///*++
'//
'//Routine Description:
'//
'// This service is used to stop impersonating a client using an
'// impersonation token. This service must be called in the context
'// of the server thread which wishes to stop impersonating its
'// client.
'//
'//
'//Arguments:
'//
'// None.
'//
'//Return Value:
'//
'// None.
'//
'//--*/
'//--
'#define SeStopImpersonatingClient() PsRevertToSelf()
'//++
'//
'// PACCESS_TOKEN
'// SeQuerySubjectContextToken(
'// __in PSECURITY_SUBJECT_CONTEXT SubjectContext
'// );
'//
'// Routine Description:
'//
'// This routine returns the effective token from the subject context,
'// either the client token, if present, or the process token.
'//
'// Arguments:
'//
'// SubjectContext - Context to query
'//
'// Return Value:
'//
'// This routine returns the PACCESS_TOKEN for the effective token.
'// The pointer may be passed to SeQueryInformationToken. This routine
'// does not affect the lock status of the token, i.e. the token is not
'// locked. If the SubjectContext has been locked, the token remains locked,
'// if not, the token remains unlocked.
'//
'//--
'#define SeQuerySubjectContextToken( SubjectContext ) \
' ( ARGUMENT_PRESENT( ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken) ? \
' ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken : \
' ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'SeCaptureSubjectContext (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'SeLockSubjectContext(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'SeUnlockSubjectContext(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'SeReleaseSubjectContext (
' );
'#endif
'NTSTATUS
'SeReportSecurityEventWithSubCategory(
' );
'BOOLEAN
'SeAccessCheckFromState (
' );
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'SePrivilegeCheck(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'SeFreePrivileges(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'SeOpenObjectAuditAlarm (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'SeOpenObjectAuditAlarmWithTransaction (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'SeOpenObjectForDeleteAuditAlarm (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'SeOpenObjectForDeleteAuditAlarmWithTransaction (
' );
'NTKERNELAPI
'SeExamineSacl(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'SeDeleteObjectAuditAlarm(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'SeDeleteObjectAuditAlarmWithTransaction(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'TOKEN_TYPE
'SeTokenType(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'SeTokenIsAdmin(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'SeTokenIsRestricted(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA || (NTDDI_VERSION >= NTDDI_WINXPSP2 && NTDDI_VERSION < NTDDI_WS03))
'NTKERNELAPI
'BOOLEAN
'SeTokenIsWriteRestricted(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'NTSTATUS
'SeFilterToken (
' );
'#endif
'// begin_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'SeQueryAuthenticationIdToken(
' );
'#endif
'// end_ntosp
'// begin_ntosp
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'SeQueryTokenIntegrity(
' );
'#endif
'// end_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'SeQuerySessionIdToken(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'SeSetSessionIdToken(
' );
'#endif
'// begin_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'SeCreateClientSecurity (
' );
'#endif
'// end_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'SeImpersonateClient(
' );
'#endif
'// begin_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'SeImpersonateClientEx(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'SeCreateClientSecurityFromSubjectContext (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'SeQuerySecurityDescriptorInfo (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'SeSetSecurityDescriptorInfo (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'SeSetSecurityDescriptorInfoEx (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'SeAppendPrivileges(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'SeAuditHardLinkCreation(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'SeAuditHardLinkCreationWithTransaction(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'SeAuditTransactionStateChange(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'SeAuditingFileEvents(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXPSP2)
'NTKERNELAPI
'BOOLEAN
'SeAuditingFileEventsWithContext(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'BOOLEAN
'SeAuditingAnyFileEventsWithContext(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2KSP3)
'NTKERNELAPI
'BOOLEAN
'SeAuditingHardLinkEvents(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXPSP2)
'NTKERNELAPI
'BOOLEAN
'SeAuditingHardLinkEventsWithContext(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'SeAuditingFileOrGlobalEvents(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'SeSetAccessStateGenericMapping (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'SeRegisterLogonSessionTerminatedRoutine(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'SeUnregisterLogonSessionTerminatedRoutine(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'SeMarkLogonSessionForTerminationNotification(
' );
'#endif
'// begin_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'SeQueryInformationToken (
' );
'#endif
'NTSTATUS
'SeLocateProcessImageName(
' );
'//
'// Grants access to SeExports structure
'//
'extern NTKERNELAPI PSE_EXPORTS SeExports;
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'SeExamineGlobalSacl(
');
'NTKERNELAPI
'SeMaximumAuditMaskFromGlobalSacl(
' );
'#endif
'#if !defined(_PSGETCURRENTTHREAD_)
'#define _PSGETCURRENTTHREAD_
'FORCEINLINE
'PsGetCurrentThread (
' )
'/*++
'Routine Description:
' This function returns a pointer to the current executive thread object.
'Arguments:
' None.
'Return Value:
' A pointer to the current executive thread object.
'--*/
'{
' return (PETHREAD)KeGetCurrentThread();
'}
'#endif
'//
'// Security Support
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'PsAssignImpersonationToken(
' );
'#endif
'// begin_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PACCESS_TOKEN
'PsReferencePrimaryToken (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'PsDereferencePrimaryToken(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'PsDereferenceImpersonationToken(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PACCESS_TOKEN
'PsReferenceImpersonationToken(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'LARGE_INTEGER
'PsGetProcessExitTime(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'PsIsThreadTerminating(
' );
'#endif
'// begin_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'PsImpersonateClient(
' );
'#endif
'// end_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'PsDisableImpersonation(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PsRestoreImpersonation(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PsRevertToSelf(
' );
'#endif
'NTKERNELAPI
'NTSTATUS
'PsLookupProcessByProcessId(
' );
'NTKERNELAPI
'NTSTATUS
'PsLookupThreadByThreadId(
' );
'//
'// Quota Operations
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PsChargePoolQuota (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'NTSTATUS
'PsChargeProcessPoolQuota (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PsReturnPoolQuota(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'BOOLEAN
'PsIsSystemThread(
' );
'#endif
%EQUATE `IO_OPEN_PAGING_FILE = &H0002
%EQUATE `IO_OPEN_TARGET_DIRECTORY = &H0004
%EQUATE `IO_STOP_ON_SYMLINK = &H0008
%EQUATE `IO_MM_PAGING_FILE = &H0010
'//
'// Define driver FS notification change routine type.
'//
'typedef
'DRIVER_FS_NOTIFICATION (
' );
'typedef DRIVER_FS_NOTIFICATION *PDRIVER_FS_NOTIFICATION;
'//
'// Valid values for FS_FILTER_PARAMETERS.AcquireForSectionSynchronization.SyncType
'//
' enum _FS_FILTER_SECTION_SYNC_TYPE
%EQUATE `SyncTypeOther = 0
%EQUATE `SyncTypeCreateSection = 1
'//
'// Valid values for FS_FILTER_PARAMETERS.NotifyStreamFileObject.NotificationType
'//
' enum _FS_FILTER_STREAM_FO_NOTIFICATION_TYPE
%EQUATE `NotifyTypeCreate = 0
%EQUATE `NotifyTypeRetired = 1
'//
'// Parameters union for the operations that
'// are exposed to the filters through the
'// FsFilterCallbacks registration mechanism.
'//
'#if _MSC_VER >= 1200
'#pragma warning(push)
'#pragma warning(disable:4324) // structure was padded due to __declspec(align())
'#endif
'typedef union _FS_FILTER_PARAMETERS {
' //
' // AcquireForModifiedPageWriter
' //
' struct {
' PLARGE_INTEGER EndingOffset;
' PERESOURCE *ResourceToRelease;
' } AcquireForModifiedPageWriter;
' //
' // ReleaseForModifiedPageWriter
' //
' struct {
' PERESOURCE ResourceToRelease;
' } ReleaseForModifiedPageWriter;
' //
' // AcquireForSectionSynchronization
' //
' struct {
' FS_FILTER_SECTION_SYNC_TYPE SyncType;
' ULONG PageProtection;
' } AcquireForSectionSynchronization;
' //
' // NotifyStreamFileObjectCreation
' //
' struct {
' FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType;
' BOOLEAN POINTER_ALIGNMENT SafeToRecurse;
' } NotifyStreamFileObject;
' //
' // Other
' //
' struct {
' PVOID Argument1;
' PVOID Argument2;
' PVOID Argument3;
' PVOID Argument4;
' PVOID Argument5;
' } Others;
'} FS_FILTER_PARAMETERS, *PFS_FILTER_PARAMETERS;
'#if _MSC_VER >= 1200
'#pragma warning(pop)
'#endif
'//
'// These are the valid values for the Operation field
'// of the FS_FILTER_CALLBACK_DATA structure.
'//
'#define FS_FILTER_ACQUIRE_FOR_SECTION_SYNCHRONIZATION (UCHAR)-1
'#define FS_FILTER_RELEASE_FOR_SECTION_SYNCHRONIZATION (UCHAR)-2
'#define FS_FILTER_ACQUIRE_FOR_MOD_WRITE (UCHAR)-3
'#define FS_FILTER_RELEASE_FOR_MOD_WRITE (UCHAR)-4
'#define FS_FILTER_ACQUIRE_FOR_CC_FLUSH (UCHAR)-5
'#define FS_FILTER_RELEASE_FOR_CC_FLUSH (UCHAR)-6
'typedef struct _FS_FILTER_CALLBACK_DATA {
' ULONG SizeOfFsFilterCallbackData;
' UCHAR Operation;
' UCHAR Reserved;
' struct _DEVICE_OBJECT *DeviceObject;
' struct _FILE_OBJECT *FileObject;
' FS_FILTER_PARAMETERS Parameters;
'} FS_FILTER_CALLBACK_DATA, *PFS_FILTER_CALLBACK_DATA;
'//
'// Prototype for the callbacks received before an operation
'// is passed to the base file system.
'//
'// A filter can fail this operation, but consistant failure
'// will halt system progress.
'//
'typedef
'NTSTATUS
'(*PFS_FILTER_CALLBACK) (
' );
'//
'// Prototype for the completion callback received after an
'// operation is completed.
'//
'typedef
'(*PFS_FILTER_COMPLETION_CALLBACK) (
' );
'//
'// This is the structure that the file system filter fills in to
'// receive notifications for these locking operations.
'//
'// A filter should set the field to NULL for any notification callback
'// it doesn't wish to receive.
'//
'typedef struct _FS_FILTER_CALLBACKS {
' ULONG SizeOfFsFilterCallbacks;
' ULONG Reserved; // For alignment
' PFS_FILTER_CALLBACK PreAcquireForSectionSynchronization;
' PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization;
' PFS_FILTER_CALLBACK PreReleaseForSectionSynchronization;
' PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization;
' PFS_FILTER_CALLBACK PreAcquireForCcFlush;
' PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush;
' PFS_FILTER_CALLBACK PreReleaseForCcFlush;
' PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush;
' PFS_FILTER_CALLBACK PreAcquireForModifiedPageWriter;
' PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter;
' PFS_FILTER_CALLBACK PreReleaseForModifiedPageWriter;
' PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter;
'} FS_FILTER_CALLBACKS, *PFS_FILTER_CALLBACKS;
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'NTSTATUS
'FsRtlRegisterFileSystemFilterCallbacks (
' );
'#endif // NTDDI_VERSION >= NTDDI_WINXP
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'FsRtlNotifyStreamFileObject (
' );
'#endif // NTDDI_VERSION >= NTDDI_VISTA
'#define DO_VERIFY_VOLUME 0x00000002
'#define DO_BUFFERED_IO 0x00000004
'#define DO_EXCLUSIVE 0x00000008
'#define DO_DIRECT_IO 0x00000010
'#define DO_MAP_IO_BUFFER 0x00000020
'#define DO_DEVICE_HAS_NAME 0x00000040
'#define DO_DEVICE_INITIALIZING 0x00000080
'#define DO_SYSTEM_BOOT_PARTITION 0x00000100
'#define DO_LONG_TERM_REQUESTS 0x00000200
'#define DO_NEVER_LAST_DEVICE 0x00000400
'#define DO_SHUTDOWN_REGISTERED 0x00000800
'#define DO_BUS_ENUMERATED_DEVICE 0x00001000
'#define DO_POWER_PAGABLE 0x00002000
'#define DO_POWER_INRUSH 0x00004000
'#define DO_LOW_PRIORITY_FILESYSTEM 0x00010000
'#define DO_SUPPORTS_TRANSACTIONS 0x00040000
'#define DO_FORCE_NEITHER_IO 0x00080000
'#define DO_VOLUME_DEVICE_OBJECT 0x00100000
'#define DO_SYSTEM_SYSTEM_PARTITION 0x00200000
'#define DO_SYSTEM_CRITICAL_PARTITION 0x00400000
'#define DO_DISALLOW_EXECUTE 0x00800000
'//
'// The following are global counters used by the I/O system to indicate the
'// amount of I/O being performed in the system. The first three counters
'// are just that, counts of operations that have been requested, while the
'// last three counters track the amount of data transferred for each type
'// of I/O request.
'//
'extern KSPIN_LOCK IoStatisticsLock;
'extern ULONG IoReadOperationCount;
'extern ULONG IoWriteOperationCount;
'extern ULONG IoOtherOperationCount;
'extern LARGE_INTEGER IoReadTransferCount;
'extern LARGE_INTEGER IoWriteTransferCount;
'extern LARGE_INTEGER IoOtherTransferCount;
'//
'// It is difficult for cached file systems to properly charge quota
'// for the storage that they allocate on behalf of user file handles,
'// so the following amount of additional quota is charged against each
'// handle as a "best guess" as to the amount of quota the file system
'// will allocate on behalf of this handle.
'//
'//
'// These numbers are totally arbitrary, and can be changed if it turns out
'// that the file systems actually allocate more (or less) on behalf of
'// their file objects. The non-paged pool charge constant is added to the
'// size of a FILE_OBJECT to get the actual charge amount.
'//
'#define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE 64
'#define IO_FILE_OBJECT_PAGED_POOL_CHARGE 1024
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoAcquireVpbSpinLock(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'IoCheckDesiredAccess(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'IoCheckEaBufferValidity(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'IoCheckFunctionAccess(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'IoCheckQuerySetFileInformation(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'IoCheckQuerySetVolumeInformation(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'IoCheckQuotaBufferValidity(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PFILE_OBJECT
'IoCreateStreamFileObject(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'PFILE_OBJECT
'IoCreateStreamFileObjectEx(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PFILE_OBJECT
'IoCreateStreamFileObjectLite(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'IoFastQueryNetworkAttributes(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'IoPageRead(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PDEVICE_OBJECT
'IoGetAttachedDevice(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K) // wdm
'NTKERNELAPI // wdm
'PDEVICE_OBJECT // wdm
'IoGetAttachedDeviceReference( // wdm
' ); // wdm
'#endif // wdm
' // wdm
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PDEVICE_OBJECT
'IoGetBaseFileSystemDeviceObject(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K) // ntddk
'NTKERNELAPI // ntddk ntosp
'PCONFIGURATION_INFORMATION // ntddk ntosp
'IoGetConfigurationInformation( VOID ); // ntddk ntosp
'#endif // ntddk
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'ULONG
'IoGetRequestorProcessId(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoGetRequestorProcess(
' );
'#endif
'// begin_wdm
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoGetTopLevelIrp(
' );
'#endif
'//++
'//
'// BOOLEAN
'// IoIsFileOpenedExclusively(
'// __in PFILE_OBJECT FileObject
'// )
'//
'// Routine Description:
'//
'// This routine is invoked to determine whether the file open represented
'// by the specified file object is opened exclusively.
'//
'// Arguments:
'//
'// FileObject - Pointer to the file object that represents the open instance
'// of the target file to be tested for exclusive access.
'//
'// Return Value:
'//
'// The function value is TRUE if the open instance of the file is exclusive;
'// otherwise FALSE is returned.
'//
'//--
'#define IoIsFileOpenedExclusively( FileObject ) (\
' (BOOLEAN) !((FileObject)->SharedRead || (FileObject)->SharedWrite || (FileObject)->SharedDelete))
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'IoIsOperationSynchronous(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'IoIsSystemThread(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'IoIsValidNameGraftingBuffer(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'NTSTATUS
'IoQueryFileDosDeviceName(
' );
'#endif
'// begin_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'IoQueryFileInformation(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'IoQueryVolumeInformation(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoQueueThreadIrp(
' );
'#endif
'// end_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoRegisterFileSystem(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'IoRegisterFsRegistrationChange(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'NTSTATUS
'IoRegisterFsRegistrationChangeMountAware(
' );
'#endif
'#if (NTDDI_VERSION == NTDDI_WIN2K)
'// This API only exists in W2K, it does not exist in any later OS
'NTKERNELAPI
'NTSTATUS
'IoRegisterFsRegistrationChangeEx(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03SP1)
'NTKERNELAPI
'NTSTATUS
'IoEnumerateRegisteredFiltersList(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'NTSTATUS
'IoReplaceFileObjectName (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoReleaseVpbSpinLock(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoSetDeviceToVerify(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'IoSetInformation(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoSetTopLevelIrp(
' );
'#endif
'//++
'//
'// USHORT
'// IoSizeOfIrp(
'// __in CCHAR StackSize
'// )
'//
'// Routine Description:
'//
'// Determines the size of an IRP given the number of stack locations
'// the IRP will have.
'//
'// Arguments:
'//
'// StackSize - Number of stack locations for the IRP.
'//
'// Return Value:
'//
'// Size in bytes of the IRP.
'//
'//--
'#define IoSizeOfIrp( StackSize ) \
' ((USHORT) (sizeof( IRP ) + ((StackSize) * (sizeof( IO_STACK_LOCATION )))))
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoStartNextPacket(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoStartNextPacketByKey(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoStartPacket(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'IoSetStartIoAttributes(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoStartTimer(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoStopTimer(
' );
'#endif
'// end_wdm end_ntosp
'// begin_ntifs
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'IoSynchronousPageWrite(
' );
'#endif
'// begin_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoThreadToProcess(
' );
'#endif
'// end_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoUnregisterFileSystem(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'IoUnregisterFsRegistrationChange(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'IoVerifyVolume(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K) // wdm
'NTKERNELAPI // wdm
'VOID // wdm
'IoWriteErrorLogEntry( // wdm
' ); // wdm
'#endif // wdm
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'IoGetRequestorSessionId(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'NTSTATUS
'IoEnumerateDeviceObjectList(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'PDEVICE_OBJECT
'IoGetLowerDeviceObject(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'PDEVICE_OBJECT
'IoGetDeviceAttachmentBaseRef(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'NTSTATUS
'IoGetDiskDeviceObject(
' );
'#endif
'//
'// IoPrioirityHint support
'//
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'typedef struct _IO_PRIORITY_INFO {
' ULONG Size;
' ULONG ThreadPriority;
' ULONG PagePriority;
' IO_PRIORITY_HINT IoPriority;
'} IO_PRIORITY_INFO, *PIO_PRIORITY_INFO;
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'FORCEINLINE
'IoInitializePriorityInfo(
' )
'{
' PriorityInfo->Size = sizeof(IO_PRIORITY_INFO);
' PriorityInfo->ThreadPriority = 0xffff;
' PriorityInfo->IoPriority = IoPriorityNormal;
' PriorityInfo->PagePriority = 0;
'}
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PoRegisterSystemState (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'NTSTATUS
'PoCreatePowerRequest (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'NTSTATUS
'PoSetPowerRequest (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'NTSTATUS
'PoClearPowerRequest (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'PoDeletePowerRequest (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PoUnregisterSystemState (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'POWER_STATE
'PoSetPowerState (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'PoCallDriver (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PoStartNextPowerIrp(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PoRegisterDeviceForIdleDetection (
' );
'#endif
'#define PoSetDeviceBusy(IdlePointer) \
' *IdlePointer = 0
'#if (NTDDI_VERSION >= NTDDI_WIN6SP1)
'NTKERNELAPI
'PoSetDeviceBusyEx (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'PoStartDeviceBusy (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'PoEndDeviceBusy (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'BOOLEAN
'PoQueryWatchdogTime (
' );
'#endif
'typedef
'NTSTATUS
'POWER_SETTING_CALLBACK (
');
'typedef POWER_SETTING_CALLBACK *PPOWER_SETTING_CALLBACK;
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'PoRegisterPowerSettingCallback (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'PoUnregisterPowerSettingCallback (
' );
'#endif
'//
'// \Callback\PowerState values
'//
'#define PO_CB_SYSTEM_POWER_POLICY 0
'#define PO_CB_AC_STATUS 1
'#define PO_CB_BUTTON_COLLISION 2 // deprecated
'#define PO_CB_SYSTEM_STATE_LOCK 3
'#define PO_CB_LID_SWITCH_STATE 4
'#define PO_CB_PROCESSOR_POWER_POLICY 5 // deprecated
'// Used for queuing work items to be performed at shutdown time. Same
'// rules apply as per Ex work queues.
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'NTSTATUS
'PoQueueShutdownWorkItem(
' );
'#endif
'#if defined(_IA64_)
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'DECLSPEC_DEPRECATED_DDK // Use GetDmaRequirement
'NTHALAPI
'ULONG
'HalGetDmaAlignmentRequirement (
' );
'#endif
'#endif
'#if defined(_M_IX86) || defined(_M_AMD64)
'#define HalGetDmaAlignmentRequirement() 1L
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'MmIsRecursiveIoFault (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'MmForceSectionClosed (
' );
'#endif
'typedef enum _MMFLUSH_TYPE {
' MmFlushForDelete,
' MmFlushForWrite
'} MMFLUSH_TYPE;
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'MmFlushImageSection (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'MmCanFileBeTruncated (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'MmSetAddressRangeModified (
' );
'#endif
'//
'// Prefetch public interface.
'//
'typedef struct _READ_LIST {
' PFILE_OBJECT FileObject;
' ULONG NumberOfEntries;
' LOGICAL IsImage;
' FILE_SEGMENT_ELEMENT List[ANYSIZE_ARRAY];
'} READ_LIST, *PREAD_LIST;
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'typedef union _MM_PREFETCH_FLAGS {
' struct {
' ULONG Priority : SYSTEM_PAGE_PRIORITY_BITS;
' ULONG RepurposePriority : SYSTEM_PAGE_PRIORITY_BITS;
' } Flags;
' ULONG AllFlags;
'} MM_PREFETCH_FLAGS, *PMM_PREFETCH_FLAGS;
'#define MM_PREFETCH_FLAGS_MASK ((1 << (2*SYSTEM_PAGE_PRIORITY_BITS)) - 1)
'NTKERNELAPI
'NTSTATUS
'MmPrefetchPages (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'//
'// This routine is used by local file systems to detect the case where the
'// user has closed the file handles and the section handles, but still has
'// open writable views to the file
'//
'NTKERNELAPI
'ULONG
'MmDoesFileHaveUserWritableReferences (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'ObInsertObject(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'ObOpenObjectByPointer(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'NTSTATUS
'ObOpenObjectByPointerWithTag(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'ObMakeTemporaryObject(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'ObQueryNameString(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'BOOLEAN
'ObIsKernelHandle (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'ObQueryObjectAuditingByHandle(
' );
'#endif
'//
'// The following are globally used definitions for an LBN and a VBN
'//
'typedef ULONG LBN;
'typedef LBN *PLBN;
'typedef ULONG VBN;
'typedef VBN *PVBN;
'//
'// Every file system that uses the cache manager must have FsContext
'// of the file object point to a common fcb header structure.
'//
'typedef enum _FAST_IO_POSSIBLE {
' FastIoIsNotPossible = 0,
' FastIoIsPossible,
' FastIoIsQuestionable
'} FAST_IO_POSSIBLE;
'typedef struct _FSRTL_COMMON_FCB_HEADER {
' CSHORT NodeTypeCode;
' CSHORT NodeByteSize;
' //
' // General flags available to FsRtl.
' //
' UCHAR Flags;
' //
' // Indicates if fast I/O is possible or if we should be calling
' // the check for fast I/O routine which is found via the driver
' // object.
' //
' UCHAR IsFastIoPossible; // really type FAST_IO_POSSIBLE
' //
' // Second Flags Field
' //
' UCHAR Flags2;
' //
' // The following reserved field should always be 0
' //
' UCHAR Reserved : 4 ;
' //
' // Indicates the version of this header
' //
' UCHAR Version : 4 ;
' PERESOURCE Resource;
' PERESOURCE PagingIoResource;
' LARGE_INTEGER AllocationSize;
' LARGE_INTEGER FileSize;
' LARGE_INTEGER ValidDataLength;
'} FSRTL_COMMON_FCB_HEADER;
'typedef FSRTL_COMMON_FCB_HEADER *PFSRTL_COMMON_FCB_HEADER;
'//
'// NodeTypeCode values used ranges
'//
'// CDFS - 0x0300 - 0x033F
'// CLFS - 0x0400 - 0x043F
'// WINFS - 0x0440 - 0x047F
'// FASTFAT - 0x0500 - 0x053F
'// RAW - 0x0600 - 0x063F
'// NTFS - 0x0700 - 0x07FF
'// UDFS - 0x0900 - 0x093F
'// EXFAT - 0x0D00 - 0x0D3F
'// - 0x8000 - 0xBFFF reserved for 3rd party file systems
'// WIMFilter - 0x1000 - 0x103F
'// NCFILTER - 0x2200 - 0x223F sample minifilter
'// RDBSS - 0xEB00 - 0xECFF
'// NULMRX - 0xFF00 - 0xFF3F sample redirector
'//
'// This Fcb header is used for files which support caching
'// of compressed data, and related new support.
'//
'// We start out by prefixing this structure with the normal
'// FsRtl header from above, which we have to do two different
'// ways for c++ or c.
'//
'#ifdef __cplusplus
'typedef struct _FSRTL_ADVANCED_FCB_HEADER:FSRTL_COMMON_FCB_HEADER {
'#else // __cplusplus
'typedef struct _FSRTL_ADVANCED_FCB_HEADER {
' //
' // Put in the standard FsRtl header fields
' //
' FSRTL_COMMON_FCB_HEADER DUMMYSTRUCTNAME;
'#endif // __cplusplus
' //
' // The following two fields are supported only if
' // Flags2 contains FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS
' //
' //
' // This is a pointer to a Fast Mutex which may be used to
' // properly synchronize access to the FsRtl header. The
' // Fast Mutex must be nonpaged.
' //
' PFAST_MUTEX FastMutex;
' //
' // This is a pointer to a list of stream context structures belonging to
' // filesystem filter drivers that are linked above the filesystem.
' // Each structure is headed by FSRTL_FILTER_CONTEXT.
' //
' LIST_ENTRY FilterContexts;
'#if (NTDDI_VERSION >= NTDDI_VISTA)
' //
' // The following fields are valid only if the Version
' // field in the FSRTL_COMMON_FCB_HEADER is greater than
' // or equal to FSRTL_FCB_HEADER_V1
' // These fields are present in VISTA and beyond
' //
' //
' // This is a pushlock which is used to properly synchronize access
' // to the list of stream contexts
' //
' EX_PUSH_LOCK PushLock;
' //
' // This is a pointer to a blob of information that is
' // associated with the opened file in the filesystem
' // corresponding to the structure containing this
' // FSRTL_ADVANCED_FCB_HEADER.
' //
' PVOID* FileContextSupportPointer;
'#endif
'} FSRTL_ADVANCED_FCB_HEADER;
'typedef FSRTL_ADVANCED_FCB_HEADER *PFSRTL_ADVANCED_FCB_HEADER;
'//
'// Define FsRtl common header versions
'//
'#define FSRTL_FCB_HEADER_V0 (0x00)
'#define FSRTL_FCB_HEADER_V1 (0x01)
'//
'// Define FsRtl common header flags
'//
'#define FSRTL_FLAG_FILE_MODIFIED (0x01)
'#define FSRTL_FLAG_FILE_LENGTH_CHANGED (0x02)
'#define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04)
'//
'// Following flags determine how the modified page writer should
'// acquire the file. These flags can't change while either resource
'// is acquired. If neither of these flags is set then the
'// modified/mapped page writer will attempt to acquire the paging io
'// resource shared.
'//
'#define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08)
'#define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10)
'//
'// This flag will be set by the Cache Manager if a view is mapped
'// to a file.
'//
'#define FSRTL_FLAG_USER_MAPPED_FILE (0x20)
'// This flag indicates that the file system is using the
'// FSRTL_ADVANCED_FCB_HEADER structure instead of the FSRTL_COMMON_FCB_HEADER
'// structure.
'//
'#define FSRTL_FLAG_ADVANCED_HEADER (0x40)
'// This flag determines whether there currently is an Eof advance
'// in progress. All such advances must be serialized.
'//
'#define FSRTL_FLAG_EOF_ADVANCE_ACTIVE (0x80)
'//
'// Flag values for Flags2
'//
'// All unused bits are reserved and should NOT be modified.
'//
'//
'// If this flag is set, the Cache Manager will allow modified writing
'// in spite of the value of FsContext2.
'//
'#define FSRTL_FLAG2_DO_MODIFIED_WRITE (0x01)
'//
'// If this flag is set, the additional fields FilterContexts and FastMutex
'// are supported in FSRTL_COMMON_HEADER, and can be used to associate
'// context for filesystem filters with streams.
'//
'#define FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS (0x02)
'//
'// If this flag is set, the cache manager will flush and purge the cache map when
'// a user first maps a file
'//
'#define FSRTL_FLAG2_PURGE_WHEN_MAPPED (0x04)
'// If set this represents a PAGING file
'//
'#define FSRTL_FLAG2_IS_PAGING_FILE (0x08)
'// begin_ntosp
'//
'//
'// The following constants are used to block top level Irp processing when
'// (in either the fast io or cc case) file system resources have been
'// acquired above the file system, or we are in an Fsp thread.
'//
'#define FSRTL_FSP_TOP_LEVEL_IRP ((LONG_PTR)0x01)
'#define FSRTL_CACHE_TOP_LEVEL_IRP ((LONG_PTR)0x02)
'#define FSRTL_MOD_WRITE_TOP_LEVEL_IRP ((LONG_PTR)0x03)
'#define FSRTL_FAST_IO_TOP_LEVEL_IRP ((LONG_PTR)0x04)
'#define FSRTL_NETWORK1_TOP_LEVEL_IRP ((LONG_PTR)0x05)
'#define FSRTL_NETWORK2_TOP_LEVEL_IRP ((LONG_PTR)0x06)
'#define FSRTL_MAX_TOP_LEVEL_IRP_FLAG ((LONG_PTR)0xFFFF)
'// end_ntosp
'//
'// The following structure is used to synchronize Eof extends.
'//
'typedef struct _EOF_WAIT_BLOCK {
' LIST_ENTRY EofWaitLinks;
' KEVENT Event;
'} EOF_WAIT_BLOCK;
'typedef EOF_WAIT_BLOCK *PEOF_WAIT_BLOCK;
'// begin_ntosp
'//
'// Normal uncompressed Copy and Mdl Apis
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlCopyRead (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlCopyWrite (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlMdlReadDev (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlMdlReadCompleteDev (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlPrepareMdlWriteDev (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlMdlWriteCompleteDev (
' );
'#endif
'//
'// In Irps, compressed reads and writes are designated by the
'// subfunction IRP_MN_COMPRESSED must be set and the Compressed
'// Data Info buffer must be described by the following structure
'// pointed to by Irp->Tail.Overlay.AuxiliaryBuffer.
'//
'typedef struct _FSRTL_AUXILIARY_BUFFER {
' //
' // Buffer description with length.
' //
' PVOID Buffer;
' ULONG Length;
' //
' // Flags
' //
' ULONG Flags;
' //
' // Pointer to optional Mdl mapping buffer for file system use
' //
' PMDL Mdl;
'} FSRTL_AUXILIARY_BUFFER;
'typedef FSRTL_AUXILIARY_BUFFER *PFSRTL_AUXILIARY_BUFFER;
'//
'// If this flag is set, the auxiliary buffer structure is
'// deallocated on Irp completion. The caller has the
'// option in this case of appending this structure to the
'// structure being described, causing it all to be
'// deallocated at once. If this flag is clear, no deallocate
'// occurs.
'//
'#define FSRTL_AUXILIARY_FLAG_DEALLOCATE 0x00000001
'//
'// The following two routines are called from NtCreateSection to avoid
'// deadlocks with the file systems.
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlAcquireFileExclusive (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlReleaseFile (
' );
'#endif
'//
'// These routines provide a simple interface for the common operations
'// of query/set file size.
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTSTATUS
'FsRtlGetFileSize(
' );
'#endif
'//
'// Determine if there is a complete device failure on an error.
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlIsTotalDeviceFailure(
' );
'#endif
'// end_ntddk end_ntosp
'//
'// Byte range file lock routines, implemented in FileLock.c
'//
'// The file lock info record is used to return enumerated information
'// about a file lock
'//
'typedef struct _FILE_LOCK_INFO {
' //
' // A description of the current locked range, and if the lock
' // is exclusive or shared
' //
' LARGE_INTEGER StartingByte;
' LARGE_INTEGER Length;
' BOOLEAN ExclusiveLock;
' //
' // The following fields describe the owner of the lock.
' //
' ULONG Key;
' PFILE_OBJECT FileObject;
' PVOID ProcessId;
' //
' // The following field is used internally by FsRtl
' //
' LARGE_INTEGER EndingByte;
'} FILE_LOCK_INFO;
'typedef FILE_LOCK_INFO *PFILE_LOCK_INFO;
'//
'// The following two procedure prototypes are used by the caller of the
'// file lock package to supply an alternate routine to call when
'// completing an IRP and when unlocking a byte range. Note that the only
'// utility to us this interface is currently the redirector, all other file
'// system will probably let the IRP complete normally with IoCompleteRequest.
'// The user supplied routine returns any value other than success then the
'// lock package will remove any lock that we just inserted.
'//
'typedef NTSTATUS (*PCOMPLETE_LOCK_IRP_ROUTINE) (
' );
'typedef VOID (*PUNLOCK_ROUTINE) (
' );
'//
'// A FILE_LOCK is an opaque structure but we need to declare the size of
'// it here so that users can allocate space for one.
'//
'typedef struct _FILE_LOCK {
' //
' // The optional procedure to call to complete a request
' //
' PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine;
' //
' // The optional procedure to call when unlocking a byte range
' //
' PUNLOCK_ROUTINE UnlockRoutine;
' //
' // FastIoIsQuestionable is set to true whenever the filesystem require
' // additional checking about whether the fast path can be taken. As an
' // example Ntfs requires checking for disk space before the writes can
' // occur.
' //
' BOOLEAN FastIoIsQuestionable;
' BOOLEAN SpareC[3];
' //
' // FsRtl lock information
' //
' PVOID LockInformation;
' //
' // Contains continuation information for FsRtlGetNextFileLock
' //
' FILE_LOCK_INFO LastReturnedLockInfo;
' PVOID LastReturnedLock;
' //
' // Number of lock requests in progress. Used for synchronization purposes
' // (so far, this only means byte range locks vs. oplocks).
' //
' LONG volatile LockRequestsInProgress;
'} FILE_LOCK;
'typedef FILE_LOCK *PFILE_LOCK;
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PFILE_LOCK
'FsRtlAllocateFileLock (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlFreeFileLock (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlInitializeFileLock (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlUninitializeFileLock (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'FsRtlProcessFileLock (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlCheckLockForReadAccess (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlCheckLockForWriteAccess (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlFastCheckLockForRead (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlFastCheckLockForWrite (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PFILE_LOCK_INFO
'FsRtlGetNextFileLock (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'BOOLEAN
'FsRtlAreThereCurrentOrInProgressFileLocks (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'FsRtlFastUnlockSingle (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'FsRtlFastUnlockAll (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'FsRtlFastUnlockAllByKey (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlPrivateLock (
' );
'#endif
'//
'// BOOLEAN
'// FsRtlFastLock (
'// __in PFILE_LOCK FileLock,
'// __in PFILE_OBJECT FileObject,
'// __in PLARGE_INTEGER FileOffset,
'// __in PLARGE_INTEGER Length,
'// __in PEPROCESS ProcessId,
'// __in ULONG Key,
'// __in BOOLEAN FailImmediately,
'// __in BOOLEAN ExclusiveLock,
'// __out PIO_STATUS_BLOCK Iosb,
'// __in PVOID Context OPTIONAL,
'// __in BOOLEAN AlreadySynchronized
'// );
'//
'#define FsRtlFastLock(A1,A2,A3,A4,A5,A6,A7,A8,A9,A10,A11) ( \
' FsRtlPrivateLock( A1, /* FileLock */ \
' A2, /* FileObject */ \
' A3, /* FileOffset */ \
' A4, /* Length */ \
' A5, /* ProcessId */ \
' A6, /* Key */ \
' A7, /* FailImmediately */ \
' A8, /* ExclusiveLock */ \
' A9, /* Iosb */ \
' NULL, /* Irp */ \
' A10, /* Context */ \
' A11 /* AlreadySynchronized */ ) \
')
'//
'// BOOLEAN
'// FsRtlAreThereCurrentFileLocks (
'// __in PFILE_LOCK FileLock
'// );
'//
'#define FsRtlAreThereCurrentFileLocks(FL) ( \
' ((FL)->FastIoIsQuestionable))
'//
'// These macros are used by file systems to increment or decrement the
'// number of lock requests in progress, in order to prevent races with
'// oplocks etc.
'//
'#define FsRtlIncrementLockRequestsInProgress(FL) { \
' ASSERT( (FL)->LockRequestsInProgress >= 0 ); \
' (void) \
' (InterlockedIncrement((LONG volatile *)&((FL)->LockRequestsInProgress)));\
'}
'#define FsRtlDecrementLockRequestsInProgress(FL) { \
' ASSERT( (FL)->LockRequestsInProgress > 0 ); \
' (void) \
' (InterlockedDecrement((LONG volatile *)&((FL)->LockRequestsInProgress)));\
'}
'//
'// Filesystem property tunneling, implemented in tunnel.c
'//
'//
'// Tunnel cache structure
'//
'typedef struct {
' //
' // Mutex for cache manipulation
' //
' FAST_MUTEX Mutex;
' //
' // Splay Tree of tunneled information keyed by
' // DirKey ## Name
' //
' PRTL_SPLAY_LINKS Cache;
' //
' // Timer queue used to age entries out of the main cache
' //
' LIST_ENTRY TimerQueue;
' //
' // Keep track of the number of entries in the cache to prevent
' // excessive use of memory
' //
' USHORT NumEntries;
'} TUNNEL, *PTUNNEL;
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlInitializeTunnelCache (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlAddToTunnelCache (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlFindInTunnelCache (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlDeleteKeyFromTunnelCache (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlDeleteTunnelCache (
' );
'#endif
'//
'// Dbcs name support routines, implemented in DbcsName.c
'//
'//
'// The following enumerated type is used to denote the result of name
'// comparisons
'//
'typedef enum _FSRTL_COMPARISON_RESULT {
' LessThan = -1,
' EqualTo = 0,
' GreaterThan = 1
'} FSRTL_COMPARISON_RESULT;
'#ifdef NLS_MB_CODE_PAGE_TAG
'#undef NLS_MB_CODE_PAGE_TAG
'#endif // NLS_MB_CODE_PAGE_TAG
'#define LEGAL_ANSI_CHARACTER_ARRAY (*FsRtlLegalAnsiCharacterArray) // ntosp
'#define NLS_MB_CODE_PAGE_TAG (*NlsMbOemCodePageTag)
'#define NLS_OEM_LEAD_BYTE_INFO (*NlsOemLeadByteInfo) // ntosp
'extern UCHAR const* const LEGAL_ANSI_CHARACTER_ARRAY;
'extern PUSHORT NLS_OEM_LEAD_BYTE_INFO; // Lead byte info. for ACP
'//
'// These following bit values are set in the FsRtlLegalDbcsCharacterArray
'//
'#define FSRTL_FAT_LEGAL 0x01
'#define FSRTL_HPFS_LEGAL 0x02
'#define FSRTL_NTFS_LEGAL 0x04
'#define FSRTL_WILD_CHARACTER 0x08
'#define FSRTL_OLE_LEGAL 0x10
'#define FSRTL_NTFS_STREAM_LEGAL (FSRTL_NTFS_LEGAL | FSRTL_OLE_LEGAL)
'//
'// The following macro is used to determine if an Ansi character is wild.
'//
'#define FsRtlIsAnsiCharacterWild(C) ( \
' FsRtlTestAnsiCharacter((C), FALSE, FALSE, FSRTL_WILD_CHARACTER) \
')
'//
'// The following macro is used to determine if an Ansi character is Fat legal.
'//
'#define FsRtlIsAnsiCharacterLegalFat(C,WILD_OK) ( \
' FsRtlTestAnsiCharacter((C), TRUE, (WILD_OK), FSRTL_FAT_LEGAL) \
')
'//
'// The following macro is used to determine if an Ansi character is Hpfs legal.
'//
'#define FsRtlIsAnsiCharacterLegalHpfs(C,WILD_OK) ( \
' FsRtlTestAnsiCharacter((C), TRUE, (WILD_OK), FSRTL_HPFS_LEGAL) \
')
'//
'// The following macro is used to determine if an Ansi character is Ntfs legal.
'//
'#define FsRtlIsAnsiCharacterLegalNtfs(C,WILD_OK) ( \
' FsRtlTestAnsiCharacter((C), TRUE, (WILD_OK), FSRTL_NTFS_LEGAL) \
')
'//
'// The following macro is used to determine if an Ansi character is
'// legal in an Ntfs stream name
'//
'#define FsRtlIsAnsiCharacterLegalNtfsStream(C,WILD_OK) ( \
' FsRtlTestAnsiCharacter((C), TRUE, (WILD_OK), FSRTL_NTFS_STREAM_LEGAL) \
')
'//
'// The following macro is used to determine if an Ansi character is legal,
'// according to the caller's specification.
'//
'#define FsRtlIsAnsiCharacterLegal(C,FLAGS) ( \
' FsRtlTestAnsiCharacter((C), TRUE, FALSE, (FLAGS)) \
')
'//
'// The following macro is used to test attributes of an Ansi character,
'// according to the caller's specified flags.
'//
'#define FsRtlTestAnsiCharacter(C, DEFAULT_RET, WILD_OK, FLAGS) ( \
' ((SCHAR)(C) < 0) ? DEFAULT_RET : \
' FlagOn( LEGAL_ANSI_CHARACTER_ARRAY[(C)], \
' (FLAGS) | \
' ((WILD_OK) ? FSRTL_WILD_CHARACTER : 0) ) \
')
'//
'// The following two macros use global data defined in ntos\rtl\nlsdata.c
'//
'// BOOLEAN
'// FsRtlIsLeadDbcsCharacter (
'// __in UCHAR DbcsCharacter
'// );
'//
'// /*++
'//
'// Routine Description:
'//
'// This routine takes the first bytes of a Dbcs character and
'// returns whether it is a lead byte in the system code page.
'//
'// Arguments:
'//
'// DbcsCharacter - Supplies the input character being examined
'//
'// Return Value:
'//
'// BOOLEAN - TRUE if the input character is a dbcs lead and
'// FALSE otherwise
'//
'// --*/
'//
'//
'#define FsRtlIsLeadDbcsCharacter(DBCS_CHAR) ( \
' (BOOLEAN)((UCHAR)(DBCS_CHAR) < 0x80 ? FALSE : \
' (NLS_MB_CODE_PAGE_TAG && \
' (NLS_OEM_LEAD_BYTE_INFO[(UCHAR)(DBCS_CHAR)] != 0))) \
')
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlDissectDbcs (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlDoesDbcsContainWildCards (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlIsDbcsInExpression (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlIsFatDbcsLegal (
' );
'#endif
'// end_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlIsHpfsDbcsLegal (
' );
'#endif
'//
'// Exception filter routines, implemented in Filter.c
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'FsRtlNormalizeNtstatus (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlIsNtstatusExpected (
' );
'#endif
'//
'// The following procedures are used to allocate executive pool and raise
'// insufficient resource status if pool isn't currently available.
'//
'#define FsRtlAllocatePoolWithTag(PoolType, NumberOfBytes, Tag) \
' ExAllocatePoolWithTag((POOL_TYPE)((PoolType) | POOL_RAISE_IF_ALLOCATION_FAILURE), \
' NumberOfBytes, \
' Tag)
'#define FsRtlAllocatePoolWithQuotaTag(PoolType, NumberOfBytes, Tag) \
' ExAllocatePoolWithQuotaTag((POOL_TYPE)((PoolType) | POOL_RAISE_IF_ALLOCATION_FAILURE), \
' NumberOfBytes, \
' Tag)
'//
'// The following function allocates a resource from the FsRtl pool.
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlAllocateResource (
' );
'#endif
'//
'// Large Integer Mapped Control Blocks routines, implemented in LargeMcb.c
'//
'// Originally this structure was truly opaque and code outside largemcb was
'// never allowed to examine or alter the structures. However, for performance
'// reasons we want to allow ntfs the ability to quickly truncate down the
'// mcb without the overhead of an actual call to largemcb.c. So to do that we
'// need to export the structure. This structure is not exact. The Mapping field
'// is declared here as a pvoid but largemcb.c it is a pointer to mapping pairs.
'//
'typedef struct _BASE_MCB {
' ULONG MaximumPairCount;
' ULONG PairCount;
' USHORT PoolType;
' USHORT Flags;
' PVOID Mapping;
'} BASE_MCB;
'typedef BASE_MCB *PBASE_MCB;
'typedef struct _LARGE_MCB {
' PKGUARDED_MUTEX GuardedMutex;
' BASE_MCB BaseMcb;
'} LARGE_MCB;
'typedef LARGE_MCB *PLARGE_MCB;
'#define MCB_FLAG_RAISE_ON_ALLOCATION_FAILURE 1
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlInitializeLargeMcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlUninitializeLargeMcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlResetLargeMcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlTruncateLargeMcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlAddLargeMcbEntry (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlRemoveLargeMcbEntry (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlLookupLargeMcbEntry (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlLookupLastLargeMcbEntry (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlLookupLastLargeMcbEntryAndIndex (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'ULONG
'FsRtlNumberOfRunsInLargeMcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlGetNextLargeMcbEntry (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlSplitLargeMcb (
' );
'#endif
'//
'// Unsynchronzied base mcb functions. There is one of these for every
'// large mcb equivalent function - they are identical other than lack of
'// synchronization
'//
'#if (NTDDI_VERSION >= NTDDI_WS03)
'NTKERNELAPI
'FsRtlInitializeBaseMcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'BOOLEAN
'FsRtlInitializeBaseMcbEx (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03)
'NTKERNELAPI
'FsRtlUninitializeBaseMcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03)
'NTKERNELAPI
'FsRtlResetBaseMcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03)
'NTKERNELAPI
'FsRtlTruncateBaseMcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03)
'NTKERNELAPI
'BOOLEAN
'FsRtlAddBaseMcbEntry (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTSTATUS
'FsRtlAddBaseMcbEntryEx (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03)
'NTKERNELAPI
'BOOLEAN
'FsRtlRemoveBaseMcbEntry (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03)
'NTKERNELAPI
'BOOLEAN
'FsRtlLookupBaseMcbEntry (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03)
'NTKERNELAPI
'BOOLEAN
'FsRtlLookupLastBaseMcbEntry (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03)
'NTKERNELAPI
'BOOLEAN
'FsRtlLookupLastBaseMcbEntryAndIndex (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03)
'NTKERNELAPI
'ULONG
'FsRtlNumberOfRunsInBaseMcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03)
'NTKERNELAPI
'BOOLEAN
'FsRtlGetNextBaseMcbEntry (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WS03)
'NTKERNELAPI
'BOOLEAN
'FsRtlSplitBaseMcb (
' );
'#endif
'//
'// Mapped Control Blocks routines, implemented in Mcb.c
'//
'// An MCB is an opaque structure but we need to declare the size of
'// it here so that users can allocate space for one. Consequently the
'// size computation here must be updated by hand if the MCB changes.
'//
'typedef struct _MCB {
' LARGE_MCB DummyFieldThatSizesThisStructureCorrectly;
'} MCB;
'typedef MCB *PMCB;
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlInitializeMcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlUninitializeMcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlTruncateMcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlAddMcbEntry (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlRemoveMcbEntry (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlLookupMcbEntry (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlLookupLastMcbEntry (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'ULONG
'FsRtlNumberOfRunsInMcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlGetNextMcbEntry (
' );
'#endif
'//
'// Fault Tolerance routines, implemented in FaultTol.c
'//
'// The routines in this package implement routines that help file
'// systems interact with the FT device drivers.
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'FsRtlBalanceReads (
' );
'#endif
'//
'// Oplock routines, implemented in Oplock.c
'//
'// An OPLOCK is an opaque structure, we declare it as a PVOID and
'// allocate the actual memory only when needed.
'//
'typedef PVOID OPLOCK, *POPLOCK;
'typedef
'(*POPLOCK_WAIT_COMPLETE_ROUTINE) (
' );
'typedef
'(*POPLOCK_FS_PREPOST_IRP) (
' );
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlInitializeOplock (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlUninitializeOplock (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'FsRtlOplockFsctrl (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'FsRtlCheckOplock (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTASP1)
'//
'// Flags for FsRtlCheckOplockEx.
'//
'#define OPLOCK_FLAG_COMPLETE_IF_OPLOCKED 0x00000001
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'#define OPLOCK_FLAG_OPLOCK_KEY_CHECK_ONLY 0x00000002
'#define OPLOCK_FLAG_BACK_OUT_ATOMIC_OPLOCK 0x00000004
'#define OPLOCK_FLAG_IGNORE_OPLOCK_KEYS 0x00000008
'//
'// Flags for FsRtlOplockFsctrlEx
'//
'#define OPLOCK_FSCTRL_FLAG_ALL_KEYS_MATCH 0x00000001
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTASP1)
'NTKERNELAPI
'NTSTATUS
'FsRtlCheckOplockEx (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlOplockIsFastIoPossible (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlCurrentBatchOplock (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'BOOLEAN
'FsRtlCurrentOplock (
' );
'NTKERNELAPI
'NTSTATUS
'FsRtlOplockBreakToNone (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'//
'// ECP context for an oplock key.
'//
'typedef struct _OPLOCK_KEY_ECP_CONTEXT {
' //
' // The caller places a GUID of their own devising here to serve as
' // the oplock key.
' //
' GUID OplockKey;
' //
' // This must be set to zero.
' //
' ULONG Reserved;
'} OPLOCK_KEY_ECP_CONTEXT, *POPLOCK_KEY_ECP_CONTEXT;
'//
'// The GUID used for the OPLOCK_KEY_ECP_CONTEXT structure.
'//
'// {48850596-3050-4be7-9863-fec350ce8d7f}
'//
'DEFINE_GUID( GUID_ECP_OPLOCK_KEY, 0x48850596, 0x3050, 0x4be7, 0x98, 0x63, 0xfe, 0xc3, 0x50, 0xce, 0x8d, 0x7f );
'NTKERNELAPI
'BOOLEAN
'FsRtlOplockIsSharedRequest(
' );
'NTKERNELAPI
'NTSTATUS
'FsRtlOplockBreakH (
' );
'NTKERNELAPI
'BOOLEAN
'FsRtlCurrentOplockH (
' );
'NTKERNELAPI
'NTSTATUS
'FsRtlOplockBreakToNoneEx (
' );
'NTKERNELAPI
'NTSTATUS
'FsRtlOplockFsctrlEx (
' );
'NTKERNELAPI
'BOOLEAN
'FsRtlOplockKeysEqual (
' );
'#endif
'//
'// Volume lock/unlock notification routines, implemented in PnP.c
'//
'// These routines provide PnP volume lock notification support
'// for all filesystems.
'//
'#define FSRTL_VOLUME_DISMOUNT 1
'#define FSRTL_VOLUME_DISMOUNT_FAILED 2
'#define FSRTL_VOLUME_LOCK 3
'#define FSRTL_VOLUME_LOCK_FAILED 4
'#define FSRTL_VOLUME_UNLOCK 5
'#define FSRTL_VOLUME_MOUNT 6
'#define FSRTL_VOLUME_NEEDS_CHKDSK 7
'#define FSRTL_VOLUME_WORM_NEAR_FULL 8
'#define FSRTL_VOLUME_WEARING_OUT 9
'#define FSRTL_VOLUME_FORCED_CLOSED 10
'#define FSRTL_VOLUME_INFO_MAKE_COMPAT 11
'#define FSRTL_VOLUME_PREPARING_EJECT 12
'#define FSRTL_VOLUME_CHANGE_SIZE 13
'#define FSRTL_VOLUME_BACKGROUND_FORMAT 14
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'FsRtlNotifyVolumeEvent (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'FsRtlNotifyVolumeEventEx (
' );
'#endif
'//
'// Notify Change routines, implemented in Notify.c
'//
'// These routines provide Notify Change support for all filesystems.
'// Any of the 'Full' notify routines will support returning the
'// change information into the user's buffer.
'//
'typedef PVOID PNOTIFY_SYNC;
'typedef
'BOOLEAN (*PCHECK_FOR_TRAVERSE_ACCESS) (
' );
'typedef
'BOOLEAN (*PFILTER_REPORT_CHANGE) (
' );
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlNotifyInitializeSync (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlNotifyUninitializeSync (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlNotifyFullChangeDirectory (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'FsRtlNotifyFilterChangeDirectory (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlNotifyFilterReportChange (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlNotifyFullReportChange (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlNotifyCleanup (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'FsRtlNotifyCleanupAll (
' );
'#endif
'//
'// Unicode Name support routines, implemented in Name.c
'//
'// The routines here are used to manipulate unicode names
'//
'//
'// The following macro is used to determine if a character is wild.
'//
'#define FsRtlIsUnicodeCharacterWild(C) ( \
' (((C) >= 0x40) ? FALSE : FlagOn( LEGAL_ANSI_CHARACTER_ARRAY[(C)], \
' FSRTL_WILD_CHARACTER ) ) \
')
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlDissectName (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlDoesNameContainWildCards (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlAreNamesEqual (
' );
'#endif
'// begin_ntosp
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'FsRtlIsNameInExpression (
' );
'#endif
'// end_ntosp
'//
'// Stack Overflow support routine, implemented in StackOvf.c
'//
'typedef
'(*PFSRTL_STACK_OVERFLOW_ROUTINE) (
' );
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlPostStackOverflow (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlPostPagingFileStackOverflow (
' );
'#endif
'//
'// UNC Provider support
'//
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'//
'// Flags passed in to FsRtlRegisterUncProviderEx
'//
'#define FSRTL_UNC_PROVIDER_FLAGS_MAILSLOTS_SUPPORTED 0x00000001
'#define FSRTL_UNC_PROVIDER_FLAGS_CSC_ENABLED 0x00000002
'#define FSRTL_UNC_PROVIDER_FLAGS_DOMAIN_SVC_AWARE 0x00000004
'NTSTATUS
'FsRtlRegisterUncProviderEx(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'FsRtlRegisterUncProvider(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlDeregisterUncProvider(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'FsRtlCancellableWaitForSingleObject(
' );
'NTKERNELAPI
'NTSTATUS
'FsRtlCancellableWaitForMultipleObjects(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'//
'// For use by filter drivers to get information on provider corresponding to a given
'// fileobject on the remote filesystem stack. Without this, filters will always end up
'// getting \Device\Mup for providers registering with FsRtlRegisterUncProviderEx().
'//
'NTKERNELAPI
'NTSTATUS
'FsRtlMupGetProviderInfoFromFileObject(
' );
'//
'// Format of output in pBuffer.
'//
'//
'// Level 1.
'//
'typedef struct _FSRTL_MUP_PROVIDER_INFO_LEVEL_1 {
' ULONG32 ProviderId; // ID for quick comparison, stable across provider load/unload.
'} FSRTL_MUP_PROVIDER_INFO_LEVEL_1, *PFSRTL_MUP_PROVIDER_INFO_LEVEL_1;
'typedef struct _FSRTL_MUP_PROVIDER_INFO_LEVEL_2 {
' ULONG32 ProviderId; // ID for quick comparison, stable across provider load/unload.
' UNICODE_STRING ProviderName; // Device name of provider.
'} FSRTL_MUP_PROVIDER_INFO_LEVEL_2, *PFSRTL_MUP_PROVIDER_INFO_LEVEL_2;
'NTKERNELAPI
'NTSTATUS
'FsRtlMupGetProviderIdFromName(
' );
'#endif
'//
'// File System Filter PerFile Context Support
'//
'//
'// Filesystem filter drivers use these APIs to associate context
'// with open files (for filesystems that support this).
'//
'//
'// OwnerId should uniquely identify a particular filter driver
'// (e.g. the address of the driver's device object).
'// InstanceId can be used to distinguish distinct contexts associated
'// by a filter driver with a single file
'//
'//
'// This structure needs to be embedded within the users context that
'// they want to associate with a given file
'//
'typedef struct _FSRTL_PER_FILE_CONTEXT {
' //
' // This is linked into the FileContext list maintained by the
' // kernel
' //
' LIST_ENTRY Links;
' //
' // A Unique ID for this filter (ex: address of Driver Object, Device
' // Object, or Device Extension)
' //
' PVOID OwnerId;
' //
' // An optional ID to differentiate different contexts for the same
' // filter.
' //
' PVOID InstanceId;
' //
' // A callback routine which is called by the underlying file system
' // when the per-file structure is being torn down. When this routine is called
' // the given context has already been removed from the context linked
' // list. The callback routine cannot recursively call down into the
' // filesystem or acquire any of their resources which they might hold
' // when calling the filesystem outside of the callback. This must
' // be defined.
' //
' PFREE_FUNCTION FreeCallback;
'} FSRTL_PER_FILE_CONTEXT, *PFSRTL_PER_FILE_CONTEXT;
'//
'// This will initialize the given FSRTL_PER_FILE_CONTEXT structure. This
'// should be used before calling "FsRtlInsertPerFileContext".
'//
'#define FsRtlInitPerFileContext( _fc, _owner, _inst, _cb) \
' ((_fc)->OwnerId = (_owner), \
' (_fc)->InstanceId = (_inst), \
' (_fc)->FreeCallback = (_cb))
'//
'// Given a FileObject this will return the FileContext pointer that
'// needs to be passed into the other FsRtl PerFile Context routines.
'// If the file system does not support filter file contexts then
'// NULL is returned
'//
'#define FsRtlGetPerFileContextPointer(_fo) \
' (FsRtlSupportsPerFileContexts(_fo) ? \
' FsRtlGetPerStreamContextPointer(_fo)->FileContextSupportPointer : \
' NULL)
'//
'// This will test to see if PerFile contexts are supported for the given
'// FileObject
'//
'#define FsRtlSupportsPerFileContexts(_fo) \
' ((FsRtlGetPerStreamContextPointer(_fo) != NULL) && \
' (FsRtlGetPerStreamContextPointer(_fo)->Version >= FSRTL_FCB_HEADER_V1) && \
' (FsRtlGetPerStreamContextPointer(_fo)->FileContextSupportPointer != NULL))
'//
'// Associate the context at Ptr with the given file. The Ptr structure
'// should be filled in by the caller before calling this routine (see
'// FsRtlInitPerFileContext). If the underlying filesystem does not support
'// filter file contexts, STATUS_INVALID_DEVICE_REQUEST will be returned.
'//
'NTKERNELAPI
'NTSTATUS
'FsRtlInsertPerFileContext (
' );
'//
'// Lookup a filter context associated with the file specified. The first
'// context matching OwnerId (and InstanceId, if present) is returned. By not
'// specifying InstanceId, a filter driver can search for any context that it
'// has previously associated with a stream. If no matching context is found,
'// NULL is returned. If the file system does not support filter contexts,
'// NULL is returned.
'//
'NTKERNELAPI
'PFSRTL_PER_FILE_CONTEXT
'FsRtlLookupPerFileContext (
' );
'//
'// Normally, contexts should be deleted when the file system notifies the
'// filter that the file is being closed. There are cases when a filter
'// may want to remove all existing contexts for a specific volume. This
'// routine should be called at those times. This routine should NOT be
'// called for the following cases:
'// - Inside your FreeCallback handler - The underlying file system has
'// already removed it from the linked list).
'// - Inside your IRP_CLOSE handler - If you do this then you will not
'// be notified when the stream is torn down.
'//
'// This functions identically to FsRtlLookupPerFileContext, except that the
'// returned context has been removed from the list.
'//
'NTKERNELAPI
'PFSRTL_PER_FILE_CONTEXT
'FsRtlRemovePerFileContext (
' );
'//
'// APIs for file systems to use for initializing and cleaning up
'// the Advaned FCB Header fields for PerStreamContext and
'// PerFileContext support
'//
'//
'// This will properly initialize the advanced header so that it can be
'// used with PerStream contexts and PerFile contexts.
'// Note: A fast mutex must be placed in an advanced header. It is the
'// caller's responsibility to properly create and initialize this
'// mutex before calling this macro. The mutex field is only set
'// if a non-NULL value is passed in.
'// If the file system supports filter file contexts then it must
'// initialize the FileContextSupportPointer field to point to a PVOID
'// embedded in its per-file structure (FCB). If a NULL is passed in,
'// then the macro assumes that the file system does not support filter
'// file contexts
'//
'#define FsRtlSetupAdvancedHeaderEx( _advhdr, _fmutx, _fctxptr ) \
'{ \
' FsRtlSetupAdvancedHeader( _advhdr, _fmutx ); \
' if ((_fctxptr) != NULL) { \
' (_advhdr)->FileContextSupportPointer = (_fctxptr); \
' } \
'}
'//
'// File systems call this API to free any filter contexts still associated
'// with a per-file structure (FCB) that they are tearing down.
'// The FreeCallback routine for each filter context will be called.
'//
'NTKERNELAPI
'FsRtlTeardownPerFileContexts (
' );
'//
'// File System Filter PerStream Context Support
'//
'//
'// Filesystem filter drivers use these APIs to associate context
'// with open streams (for filesystems that support this).
'//
'//
'// OwnerId should uniquely identify a particular filter driver
'// (e.g. the address of the driver's device object).
'// InstanceId can be used to distinguish distinct contexts associated
'// by a filter driver with a single stream (e.g. the address of the
'// PerStream Context structure).
'//
'//
'// This structure needs to be embedded within the users context that
'// they want to associate with a given stream
'//
'typedef struct _FSRTL_PER_STREAM_CONTEXT {
' //
' // This is linked into the StreamContext list inside the
' // FSRTL_ADVANCED_FCB_HEADER structure.
' //
' LIST_ENTRY Links;
' //
' // A Unique ID for this filter (ex: address of Driver Object, Device
' // Object, or Device Extension)
' //
' PVOID OwnerId;
' //
' // An optional ID to differentiate different contexts for the same
' // filter.
' //
' PVOID InstanceId;
' //
' // A callback routine which is called by the underlying file system
' // when the stream is being torn down. When this routine is called
' // the given context has already been removed from the context linked
' // list. The callback routine cannot recursively call down into the
' // filesystem or acquire any of their resources which they might hold
' // when calling the filesystem outside of the callback. This must
' // be defined.
' //
' PFREE_FUNCTION FreeCallback;
'} FSRTL_PER_STREAM_CONTEXT, *PFSRTL_PER_STREAM_CONTEXT;
'//
'// This will initialize the given FSRTL_PER_STREAM_CONTEXT structure. This
'// should be used before calling "FsRtlInsertPerStreamContext".
'//
'#define FsRtlInitPerStreamContext( _fc, _owner, _inst, _cb) \
' ((_fc)->OwnerId = (_owner), \
' (_fc)->InstanceId = (_inst), \
' (_fc)->FreeCallback = (_cb))
'//
'// Given a FileObject this will return the StreamContext pointer that
'// needs to be passed into the other FsRtl PerStream Context routines.
'//
'#define FsRtlGetPerStreamContextPointer(_fo) \
' ((PFSRTL_ADVANCED_FCB_HEADER)((_fo)->FsContext))
'//
'// This will test to see if PerStream contexts are supported for the given
'// FileObject
'//
'#define FsRtlSupportsPerStreamContexts(_fo) \
' ((NULL != FsRtlGetPerStreamContextPointer(_fo)) && \
' FlagOn(FsRtlGetPerStreamContextPointer(_fo)->Flags2, \
' FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS))
'//
'// Associate the context at Ptr with the given stream. The Ptr structure
'// should be filled in by the caller before calling this routine (see
'// FsRtlInitPerStreamContext). If the underlying filesystem does not support
'// filter contexts, STATUS_INVALID_DEVICE_REQUEST will be returned.
'//
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'NTSTATUS
'FsRtlInsertPerStreamContext (
' );
'#endif
'//
'// Lookup a filter context associated with the stream specified. The first
'// context matching OwnerId (and InstanceId, if present) is returned. By not
'// specifying InstanceId, a filter driver can search for any context that it
'// has previously associated with a stream. If no matching context is found,
'// NULL is returned. If the file system does not support filter contexts,
'// NULL is returned.
'//
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'PFSRTL_PER_STREAM_CONTEXT
'FsRtlLookupPerStreamContextInternal (
' );
'#endif
'#define FsRtlLookupPerStreamContext(_sc, _oid, _iid) \
' (((NULL != (_sc)) && \
' FlagOn((_sc)->Flags2,FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS) && \
' !IsListEmpty(&(_sc)->FilterContexts)) ? \
' FsRtlLookupPerStreamContextInternal((_sc), (_oid), (_iid)) : \
' NULL)
'//
'// Normally, contexts should be deleted when the file system notifies the
'// filter that the stream is being closed. There are cases when a filter
'// may want to remove all existing contexts for a specific volume. This
'// routine should be called at those times. This routine should NOT be
'// called for the following cases:
'// - Inside your FreeCallback handler - The underlying file system has
'// already removed it from the linked list).
'// - Inside your IRP_CLOSE handler - If you do this then you will not
'// be notified when the stream is torn down.
'//
'// This functions identically to FsRtlLookupPerStreamContext, except that the
'// returned context has been removed from the list.
'//
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'PFSRTL_PER_STREAM_CONTEXT
'FsRtlRemovePerStreamContext (
' );
'#endif
'//
'// APIs for file systems to use for initializing and cleaning up
'// the Advaned FCB Header fields for PerStreamContext support
'//
'//
'// This will properly initialize the advanced header so that it can be
'// used with PerStream contexts.
'// Note: A fast mutex must be placed in an advanced header. It is the
'// caller's responsibility to properly create and initialize this
'// mutex before calling this macro. The mutex field is only set
'// if a non-NULL value is passed in.
'//
'FORCEINLINE
'FsRtlSetupAdvancedHeader(
'/*
' The AdvHdr parameter should have a type of PFSRTL_ADVANCED_FCB_HEADER but
' I had to make it a PVOID because there are cases where this routine is
' called where a different type is passed in (where the advanced header
' is at the front of this other type). This routine used to be a macro and
' I changed it to an INLINE so we could put the NTDDI_VERSION conditional into
' it. To maintain compatiblity I made the AdvHdr parameter a PVOID and cast
' it to the correct type internally.
'*/
'{
' PFSRTL_ADVANCED_FCB_HEADER localAdvHdr = (PFSRTL_ADVANCED_FCB_HEADER)AdvHdr;
' localAdvHdr->Flags |= FSRTL_FLAG_ADVANCED_HEADER;
' localAdvHdr->Flags2 |= FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS;
'#if (NTDDI_VERSION >= NTDDI_VISTA)
' localAdvHdr->Version = FSRTL_FCB_HEADER_V1;
'#else
' localAdvHdr->Version = FSRTL_FCB_HEADER_V0;
'#endif
' InitializeListHead( &localAdvHdr->FilterContexts );
' if (FMutex != NULL) {
' localAdvHdr->FastMutex = FMutex;
' }
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'//
'// API not avaialble down level
'// We want to support a driver compiled to the last version running downlevel,
'// so continue to use use the direct init of the push lock and not call
'// ExInitializePushLock.
'//
' *((PULONG_PTR)(&localAdvHdr->PushLock)) = 0;
' /*ExInitializePushLock( &localAdvHdr->PushLock ); API not avaialble down level*/
' localAdvHdr->FileContextSupportPointer = NULL;
'#endif
'}
'//
'// File systems call this API to free any filter contexts still associated
'// with an FSRTL_COMMON_FCB_HEADER that they are tearing down.
'// The FreeCallback routine for each filter context will be called.
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'FsRtlTeardownPerStreamContexts (
' );
'//
'// Function pointer to above routine for modules that need to dynamically import
'//
'typedef VOID (*PFN_FSRTLTEARDOWNPERSTREAMCONTEXTS) (__in PFSRTL_ADVANCED_FCB_HEADER AdvancedHeader);
'#endif
'//
'// File System Filter PerFileObject Context Support
'//
'//
'// Filesystem filter drivers use these APIs to associate context
'// with individual open files. For now these are only supported on file
'// objects with a FileObject extension which are only created by using
'// IoCreateFileSpecifyDeviceObjectHint.
'//
'//
'// OwnerId should uniquely identify a particular filter driver
'// (e.g. the address of the driver's device object).
'// InstanceId can be used to distinguish distinct contexts associated
'// by a filter driver with a single stream (e.g. the address of the
'// fileobject).
'//
'//
'// This structure needs to be embedded within the users context that
'// they want to associate with a given stream
'//
'typedef struct _FSRTL_PER_FILEOBJECT_CONTEXT {
' //
' // This is linked into the File Object
' //
' LIST_ENTRY Links;
' //
' // A Unique ID for this filter (ex: address of Driver Object, Device
' // Object, or Device Extension)
' //
' PVOID OwnerId;
' //
' // An optional ID to differentiate different contexts for the same
' // filter.
' //
' PVOID InstanceId;
'} FSRTL_PER_FILEOBJECT_CONTEXT, *PFSRTL_PER_FILEOBJECT_CONTEXT;
'//
'// This will initialize the given FSRTL_PER_FILEOBJECT_CONTEXT structure. This
'// should be used before calling "FsRtlInsertPerFileObjectContext".
'//
'#define FsRtlInitPerFileObjectContext( _fc, _owner, _inst ) \
' ((_fc)->OwnerId = (_owner), \
' (_fc)->InstanceId = (_inst)) \
'//
'// Associate the context at Ptr with the given FileObject. The Ptr
'// structure should be filled in by the caller before calling this
'// routine (see FsRtlInitPerFileObjectContext). If this file object does not
'// support filter contexts, STATUS_INVALID_DEVICE_REQUEST will be returned.
'//
'NTKERNELAPI
'NTSTATUS
'FsRtlInsertPerFileObjectContext (
' );
'//
'// Lookup a filter context associated with the FileObject specified. The first
'// context matching OwnerId (and InstanceId, if present) is returned. By not
'// specifying InstanceId, a filter driver can search for any context that it
'// has previously associated with a stream. If no matching context is found,
'// NULL is returned. If the FileObject does not support contexts,
'// NULL is returned.
'//
'NTKERNELAPI
'PFSRTL_PER_FILEOBJECT_CONTEXT
'FsRtlLookupPerFileObjectContext (
' );
'//
'// Normally, contexts should be deleted when the IoManager notifies the
'// filter that the FileObject is being freed. There are cases when a filter
'// may want to remove all existing contexts for a specific volume. This
'// routine should be called at those times. This routine should NOT be
'// called for the following case:
'// - Inside your FreeCallback handler - The IoManager has already removed
'// it from the linked list.
'//
'// This functions identically to FsRtlLookupPerFileObjectContext, except that
'// the returned context has been removed from the list.
'//
'NTKERNELAPI
'PFSRTL_PER_FILEOBJECT_CONTEXT
'FsRtlRemovePerFileObjectContext (
' );
'//++
'//
'// VOID
'// FsRtlCompleteRequest (
'// __in PIRP Irp,
'// __in NTSTATUS Status
'// );
'//
'// Routine Description:
'//
'// This routine is used to complete an IRP with the indicated
'// status. It does the necessary raise and lower of IRQL.
'//
'// Arguments:
'//
'// Irp - Supplies a pointer to the Irp to complete
'//
'// Status - Supplies the completion status for the Irp
'//
'// Return Value:
'//
'// None.
'//
'//--
'#define FsRtlCompleteRequest(IRP,STATUS) { \
' (IRP)->IoStatus.Status = (STATUS); \
' IoCompleteRequest( (IRP), IO_DISK_INCREMENT ); \
'}
'//++
'//
'// VOID
'// FsRtlEnterFileSystem (
'// );
'//
'// Routine Description:
'//
'// This routine is used when entering a file system (e.g., through its
'// Fsd entry point). It ensures that the file system cannot be suspended
'// while running and thus block other file I/O requests. Upon exit
'// the file system must call FsRtlExitFileSystem.
'//
'// Arguments:
'//
'// Return Value:
'//
'// None.
'//
'//--
'#define FsRtlEnterFileSystem() { \
' KeEnterCriticalRegion(); \
'}
'//++
'//
'// VOID
'// FsRtlExitFileSystem (
'// );
'//
'// Routine Description:
'//
'// This routine is used when exiting a file system (e.g., through its
'// Fsd entry point).
'//
'// Arguments:
'//
'// Return Value:
'//
'// None.
'//
'//--
'#define FsRtlExitFileSystem() { \
' KeLeaveCriticalRegion(); \
'}
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'FsRtlIncrementCcFastReadNotPossible(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'FsRtlIncrementCcFastReadWait(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'FsRtlIncrementCcFastReadNoWait(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'FsRtlIncrementCcFastReadResourceMiss(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'FsRtlIncrementCcFastMdlReadWait(
' );
'#endif
'//
'// Returns TRUE if the given fileObject represents a paging file, returns
'// FALSE otherwise.
'//
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'LOGICAL
'FsRtlIsPagingFile (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'//
'// This routine is available on:
'// * Windows 2000 SP4 plus URP
'// * Windows XP SP2 plus QFE ?
'// * Windows Server 2003 SP1
'//
'NTKERNELAPI
'NTSTATUS
'FsRtlCreateSectionForDataScan(
' );
'#endif
'//
'// Reparse Routines
'//
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'FsRtlValidateReparsePointBuffer (
');
'NTKERNELAPI
'NTSTATUS
'FsRtlRemoveDotsFromPath(
');
'#endif
'// begin_ntosp
'//////////////////////////////////////////////////////////////////////////
'//
'// Extra Create Parameter Support routines
'//
'// These routines are used when processing a create IRP to allow passing
'// extra information up and down the file system stack. This is used by
'// file system filters, Client Side Encryption, Transactions etc.
'//
'//////////////////////////////////////////////////////////////////////////
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'typedef struct _ECP_LIST ECP_LIST;
'typedef struct _ECP_LIST *PECP_LIST;
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'typedef struct _ECP_HEADER ECP_HEADER;
'typedef struct _ECP_HEADER *PECP_HEADER;
'#endif
'//
'// Prototype for the ECP cleanup routine callback
'//
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'typedef VOID
'(*PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK) (
' );
'#endif
'//
'// Basic ECP functions
'//
'//
'// Flags used by FsRtlAllocateExtraCreateParameterList
'//
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'typedef ULONG FSRTL_ALLOCATE_ECPLIST_FLAGS;
' //
' // Charge this memory against the quota of the current process
' //
' #define FSRTL_ALLOCATE_ECPLIST_FLAG_CHARGE_QUOTA 0x00000001
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'FsRtlAllocateExtraCreateParameterList (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'FsRtlFreeExtraCreateParameterList (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'NTSTATUS
'FsRtlInitializeExtraCreateParameterList (
' );
'#endif
'//
'// Flags used by FsRtlAllocateExtraCreateParameter
'// and FsRtlAllocateExtraCreateParameterFromLookasideList
'//
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'typedef ULONG FSRTL_ALLOCATE_ECP_FLAGS;
' //
' // If set charage quota against the current process for this
' // allocation. This flag is ignored if using a lookaside list
' //
' #define FSRTL_ALLOCATE_ECP_FLAG_CHARGE_QUOTA 0x00000001
' //
' // If set allocate the ECP from non-paged pool
' // Else use paged pool
' //
' #define FSRTL_ALLOCATE_ECP_FLAG_NONPAGED_POOL 0x00000002
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'FsRtlAllocateExtraCreateParameter (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'FsRtlFreeExtraCreateParameter (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'FsRtlInitializeExtraCreateParameter(
' );
'#endif
'//
'// Flags used by FsRtlInitExtraCreateParameterLookasideList
'//
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'typedef ULONG FSRTL_ECP_LOOKASIDE_FLAGS;
' //
' // If set this is a NON-PAGED lookaside list
' // ELSE this is a PAGED lookaside list
' //
' #define FSRTL_ECP_LOOKASIDE_FLAG_NONPAGED_POOL 0x00000002
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'FsRtlInitExtraCreateParameterLookasideList (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'FsRtlDeleteExtraCreateParameterLookasideList (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'FsRtlAllocateExtraCreateParameterFromLookasideList (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'FsRtlInsertExtraCreateParameter (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'FsRtlFindExtraCreateParameter (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'FsRtlRemoveExtraCreateParameter (
' );
'#endif
'//
'// Functions to get and set Extra Create Parameters into/out of a create IRP
'//
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'FsRtlGetEcpListFromIrp (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'FsRtlSetEcpListIntoIrp (
' );
'#endif
'//
'// Additional functions used for full functionality
'//
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'FsRtlGetNextExtraCreateParameter (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'FsRtlAcknowledgeEcp (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'BOOLEAN
'FsRtlIsEcpAcknowledged (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'BOOLEAN
'FsRtlIsEcpFromUserMode (
' );
'#endif
'// end_ntosp
'//////////////////////////////////////////////////////////////////////////////
'//
'// This contains public ECP definitions
'//
'//////////////////////////////////////////////////////////////////////////////
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'//
'// Start of NETWORK_OPEN_ECP_CONTEXT structures and definitions.
'// This ECP can be used as a way to pass extra information at create time
'// to network redirectors.
'//
'typedef enum {
' NetworkOpenLocationAny, // No restrictions.
' NetworkOpenLocationRemote, // Restrict to remote only.
' NetworkOpenLocationLoopback // Restrict to local-machine only.
'} NETWORK_OPEN_LOCATION_QUALIFIER;
'typedef enum {
' NetworkOpenIntegrityAny, // No restrictions on signing/encryption etc.
' NetworkOpenIntegrityNone, // No signing/encryption.
' NetworkOpenIntegritySigned, // Signed end to end.
' NetworkOpenIntegrityEncrypted, // encrypted end-end.
' NetworkOpenIntegrityMaximum // Best available.
'} NETWORK_OPEN_INTEGRITY_QUALIFIER;
'//
'// ECP context for network create parameters.
'//
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'//
'// Below we have the structures and definitions for Win7
'//
'// in flags.
'#define NETWORK_OPEN_ECP_IN_FLAG_DISABLE_HANDLE_COLLAPSING 0x1
'#define NETWORK_OPEN_ECP_IN_FLAG_DISABLE_HANDLE_DURABILITY 0x2
'#define NETWORK_OPEN_ECP_IN_FLAG_FORCE_BUFFERED_SYNCHRONOUS_IO_HACK 0x80000000
'typedef struct _NETWORK_OPEN_ECP_CONTEXT {
' USHORT Size; // Must be set to the size of this structure.
' USHORT Reserved; // Must be set to zero.
' struct {
' //
' // Pre-create restrictions
' //
' struct {
' NETWORK_OPEN_LOCATION_QUALIFIER Location;
' NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
' ULONG Flags;
' } in;
' //
' // Post create information returned to the caller.
' //
' struct {
' NETWORK_OPEN_LOCATION_QUALIFIER Location;
' NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
' ULONG Flags;
' } out;
' } DUMMYSTRUCTNAME;
'} NETWORK_OPEN_ECP_CONTEXT, *PNETWORK_OPEN_ECP_CONTEXT;
'//
'// This version of the NETWORK_OPEN_ECP_CONTEXT was used on
'// Windows Vista. Drivers interpreting "Network ECP Contexts" on
'// Vista OSes should use this version.
'//
'typedef struct _NETWORK_OPEN_ECP_CONTEXT_V0 {
' USHORT Size; // Must be set to the size of this structure.
' USHORT Reserved; // Must be set to zero.
' struct {
' //
' // Pre-create restrictions
' //
' struct {
' NETWORK_OPEN_LOCATION_QUALIFIER Location;
' NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
' } in;
' //
' // Post create information returned to the caller.
' //
' struct {
' NETWORK_OPEN_LOCATION_QUALIFIER Location;
' NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
' } out;
' } DUMMYSTRUCTNAME;
'} NETWORK_OPEN_ECP_CONTEXT_V0, *PNETWORK_OPEN_ECP_CONTEXT_V0;
'#elif (NTDDI_VERSION >= NTDDI_VISTA)
'//
'// Here is the definition of Network Open ECP for native Vista Drivers.
'//
'typedef struct _NETWORK_OPEN_ECP_CONTEXT {
' USHORT Size; // Must be set to the size of this structure.
' USHORT Reserved; // Must be set to zero.
' struct {
' //
' // Pre-create restrictions
' //
' struct {
' NETWORK_OPEN_LOCATION_QUALIFIER Location;
' NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
' } in;
' //
' // Post create information returned to the caller.
' //
' struct {
' NETWORK_OPEN_LOCATION_QUALIFIER Location;
' NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
' } out;
' } DUMMYSTRUCTNAME;
'} NETWORK_OPEN_ECP_CONTEXT, *PNETWORK_OPEN_ECP_CONTEXT;
'#endif
'//
'// The GUID used for the NETWORK_OPEN_ECP_CONTEXT structure
'//
'DEFINE_GUID( GUID_ECP_NETWORK_OPEN_CONTEXT, 0xc584edbf, 0x00df, 0x4d28, 0xb8, 0x84, 0x35, 0xba, 0xca, 0x89, 0x11, 0xe8 );
'//
'// End NETWORK_OPEN_ECP_CONTEXT definitions
'//
'#endif //(NTDDI_VERSION >= NTDDI_VISTA)
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'//
'// Start of PREFETCH_OPEN_ECP_CONTEXT structures and definitions.
'// This ECP is used to communicate the fact that a given open request is done
'// by the prefetcher.
'//
'//
'// ECP structure for prefetcher opens.
'//
'typedef struct _PREFETCH_OPEN_ECP_CONTEXT {
' PVOID Context; // Opaque context associated with the open.
'} PREFETCH_OPEN_ECP_CONTEXT, *PPREFETCH_OPEN_ECP_CONTEXT;
'//
'// The GUID used for the PREFETCH_OPEN_ECP_CONTEXT structure
'//
'DEFINE_GUID( GUID_ECP_PREFETCH_OPEN, 0xe1777b21, 0x847e, 0x4837, 0xaa, 0x45, 0x64, 0x16, 0x1d, 0x28, 0x6, 0x55 );
'//
'// End PREFETCH_OPEN_ECP_CONTEXT definitions
'//
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'//
'// The type GUID and structure for NFS (Network File System) extra create parameters
'//
'//
'// {f326d30c-e5f8-4fe7-ab74-f5a3196d92db}
'//
'typedef struct sockaddr_storage *PSOCKADDR_STORAGE_NFS;
'DEFINE_GUID (GUID_ECP_NFS_OPEN,
' 0xf326d30c,
' 0xe5f8,
' 0x4fe7,
' 0xab, 0x74, 0xf5, 0xa3, 0x19, 0x6d, 0x92, 0xdb);
'typedef struct _NFS_OPEN_ECP_CONTEXT {
' //
' // Export alias (share name) for the create with type PUNICODE_STRING. This is a
' // hint and may be a name, NULL or zero length string
' //
' PUNICODE_STRING ExportAlias;
' //
' // Socket address of client
' //
' PSOCKADDR_STORAGE_NFS ClientSocketAddress;
'} NFS_OPEN_ECP_CONTEXT, *PNFS_OPEN_ECP_CONTEXT, **PPNFS_OPEN_ECP_CONTEXT;
'//
'// ECP context for SRV create parameters.
'//
'//
'// The GUID used for the SRV_OPEN_ECP_CONTEXT structure
'// {BEBFAEBC-AABF-489d-9D2C-E9E361102853}
'//
'//typedef struct sockaddr_storage *PSOCKADDR_STORAGE_SMB;
'DEFINE_GUID( GUID_ECP_SRV_OPEN,
' 0xbebfaebc,
' 0xaabf,
' 0x489d,
' 0x9d, 0x2c, 0xe9, 0xe3, 0x61, 0x10, 0x28, 0x53 );
'typedef struct _SRV_OPEN_ECP_CONTEXT {
' //
' // Share name for the create with type PUNICODE_STRING
' //
' PUNICODE_STRING ShareName;
' //
' // Socket address of client
' //
' PSOCKADDR_STORAGE_NFS SocketAddress;
' //
' // Oplock state of open (for SMB/SMB2 oplock breaking logic)
' //
' BOOLEAN OplockBlockState;
' BOOLEAN OplockAppState;
' BOOLEAN OplockFinalState;
'} SRV_OPEN_ECP_CONTEXT, *PSRV_OPEN_ECP_CONTEXT;
'//
'// End SRV_OPEN_ECP_CONTEXT definitions
'//
'#endif //(NTDDI_VERSION >= NTDDI_WIN7)
'//
'// This routine allows the caller to change the referenced file object that
'// is pointed to by either:
'// - One of Mm's image control areas for this stream
'// - Mm's data control area for this stream
'// - Cc's shared cache map for this stream
'//
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'typedef enum _FSRTL_CHANGE_BACKING_TYPE {
' ChangeDataControlArea,
' ChangeImageControlArea,
' ChangeSharedCacheMap
'} FSRTL_CHANGE_BACKING_TYPE, *PFSRTL_CHANGE_BACKING_TYPE;
'NTKERNELAPI
'NTSTATUS
'FsRtlChangeBackingFileObject (
' );
'#endif
'//
'// Flags for FsRtlLogCcFlushError
'//
'#define FSRTL_CC_FLUSH_ERROR_FLAG_NO_HARD_ERROR 0x1
'#define FSRTL_CC_FLUSH_ERROR_FLAG_NO_LOG_ENTRY 0x2
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'FsRtlLogCcFlushError(
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'//
'// Routine to query whether volume startup application such as autochk
'// have completed.
'//
'NTKERNELAPI
'BOOLEAN
'FsRtlAreVolumeStartupApplicationsComplete(
' );
'#endif
'// begin_ntosp
'#if (NTDDI_VERSION > NTDDI_VISTA)
'//
'// Routine to query maximum depth of virtual disk layering support.
'//
'NTKERNELAPI
'ULONG
'FsRtlQueryMaximumVirtualDiskNestingLevel (
' );
'//
'// Routine to query virtual disk info for a given disk or volume object
'//
'NTKERNELAPI
'NTSTATUS
'FsRtlGetVirtualDiskNestingLevel (
' );
'//
'// Current possible values for NestingFlags.
'//
'#define FSRTL_VIRTDISK_FULLY_ALLOCATED 0x00000001
'#define FSRTL_VIRTDISK_NO_DRIVE_LETTER 0x00000002
'#endif
'//
'// Define two constants describing the view size (and alignment)
'// that the Cache Manager uses to map files.
'//
'#define VACB_MAPPING_GRANULARITY (0x40000)
'#define VACB_OFFSET_SHIFT (18)
'//
'// Public portion of BCB
'//
'typedef struct _PUBLIC_BCB {
' //
' // Type and size of this record
' //
' // NOTE: The first four fields must be the same as the BCB in cc.h.
' //
' CSHORT NodeTypeCode;
' CSHORT NodeByteSize;
' //
' // Description of range of file which is currently mapped.
' //
' ULONG MappedLength;
' LARGE_INTEGER MappedFileOffset;
'} PUBLIC_BCB, *PPUBLIC_BCB;
'//
'// File Sizes structure.
'//
'typedef struct _CC_FILE_SIZES {
' LARGE_INTEGER AllocationSize;
' LARGE_INTEGER FileSize;
' LARGE_INTEGER ValidDataLength;
'} CC_FILE_SIZES, *PCC_FILE_SIZES;
'//
'// Define a Cache Manager callback structure. These routines are required
'// by the Lazy Writer, so that it can acquire resources in the right order
'// to avoid deadlocks. Note that otherwise you would have most FS requests
'// acquiring FS resources first and caching structures second, while the
'// Lazy Writer needs to acquire its own resources first, and then FS
'// structures later as it calls the file system.
'//
'//
'// First define the procedure pointer typedefs
'//
'//
'// This routine is called by the Lazy Writer prior to doing a write,
'// since this will require some file system resources associated with
'// this cached file. The context parameter supplied is whatever the FS
'// passed as the LazyWriteContext parameter when is called
'// CcInitializeCacheMap.
'//
'typedef
'BOOLEAN (*PACQUIRE_FOR_LAZY_WRITE) (
' );
'//
'// This routine releases the Context acquired above.
'//
'typedef
'VOID (*PRELEASE_FROM_LAZY_WRITE) (
' );
'//
'// This routine is called by the Lazy Writer prior to doing a readahead.
'//
'typedef
'BOOLEAN (*PACQUIRE_FOR_READ_AHEAD) (
' );
'//
'// This routine releases the Context acquired above.
'//
'typedef
'VOID (*PRELEASE_FROM_READ_AHEAD) (
' );
'typedef struct _CACHE_MANAGER_CALLBACKS {
' PACQUIRE_FOR_LAZY_WRITE AcquireForLazyWrite;
' PRELEASE_FROM_LAZY_WRITE ReleaseFromLazyWrite;
' PACQUIRE_FOR_READ_AHEAD AcquireForReadAhead;
' PRELEASE_FROM_READ_AHEAD ReleaseFromReadAhead;
'} CACHE_MANAGER_CALLBACKS, *PCACHE_MANAGER_CALLBACKS;
'//
'// This structure is passed into CcUninitializeCacheMap
'// if the caller wants to know when the cache map is deleted.
'//
'typedef struct _CACHE_UNINITIALIZE_EVENT {
' struct _CACHE_UNINITIALIZE_EVENT *Next;
' KEVENT Event;
'} CACHE_UNINITIALIZE_EVENT, *PCACHE_UNINITIALIZE_EVENT;
'//
'// Callback routine for retrieving dirty pages from Cache Manager.
'//
'typedef
'VOID (*PDIRTY_PAGE_ROUTINE) (
' );
'//
'// Callback routine for doing log file flushes to Lsn.
'//
'typedef
'VOID (*PFLUSH_TO_LSN) (
' );
'//
'// Macro to test whether a file is cached or not.
'//
'#define CcIsFileCached(FO) ( \
' ((FO)->SectionObjectPointer != NULL) && \
' (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
')
'extern ULONG CcFastMdlReadWait;
'//
'// The following routines are intended for use by File Systems Only.
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcInitializeCacheMap (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'CcUninitializeCacheMap (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcSetFileSizes (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'NTSTATUS
'CcSetFileSizesEx (
' );
'#endif
'#define CcGetFileSizePointer(FO) ( \
' ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
')
'//
'// Flags for CcPurgeCacheSection
'//
'//
'// UNINITIALIZE_CACHE_MAPS - All private cache maps will be uninitialized
'// before purging the data. This pattern may be specified as TRUE.
'//
'#define UNINITIALIZE_CACHE_MAPS (1)
'//
'// DO_NOT_RETRY_PURGE - CcPurgeCacheSection will not retry purging the file
'// on purge failure even if Mm says the file can be truncated. The return
'// value will specify whether or not the purge succeeded.
'//
'#define DO_NOT_RETRY_PURGE (2)
'//
'// DO_NOT_PURGE_DIRTY_PAGES - Instructs CcPurgeCacheSection to fail any
'// purge requests that would cause the caller to throw away dirty data. This
'// flag should be used when initiating a coherency flush/purge to ensure that
'// the file system does not throw away data generated in the gap between a
'// flush and purge.
'//
'#define DO_NOT_PURGE_DIRTY_PAGES (0x4)
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'BOOLEAN
'CcPurgeCacheSection (
' );
'#elif (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'CcPurgeCacheSection (
' );
'#endif
'#define CC_FLUSH_AND_PURGE_NO_PURGE (0x1)
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'CcCoherencyFlushAndPurgeCache (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcSetDirtyPageThreshold (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcFlushCache (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'LARGE_INTEGER
'CcGetFlushedValidData (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'CcZeroData (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcRemapBcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcRepinBcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcUnpinRepinnedBcb (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PFILE_OBJECT
'CcGetFileObjectFromSectionPtrs (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'PFILE_OBJECT
'CcGetFileObjectFromSectionPtrsRef (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'PFILE_OBJECT
'CcGetFileObjectFromBcb (
' );
'#endif
'//
'// These routines are implemented to support write throttling.
'//
'//
'// BOOLEAN
'// CcCopyWriteWontFlush (
'// IN PFILE_OBJECT FileObject,
'// IN PLARGE_INTEGER FileOffset,
'// IN ULONG Length
'// );
'//
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'NTKERNELAPI
'BOOLEAN
'CcCopyWriteWontFlush (
' );
'#else
'#define CcCopyWriteWontFlush(FO,FOFF,LEN) ((LEN) <= 0X1000000)
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'CcCanIWrite (
' );
'#endif
'typedef
'VOID (*PCC_POST_DEFERRED_WRITE) (
' );
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcDeferWrite (
' );
'#endif
'//
'// The following routines provide a data copy interface to the cache, and
'// are intended for use by File Servers and File Systems.
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'CcCopyRead (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcFastCopyRead (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'CcCopyWrite (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcFastCopyWrite (
' );
'#endif
'//
'// The following routines provide an Mdl interface for transfers to and
'// from the cache, and are primarily intended for File Servers.
'//
'// NOBODY SHOULD BE CALLING THESE MDL ROUTINES DIRECTLY, USE FSRTL AND
'// FASTIO INTERFACES.
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcMdlRead (
' );
'#endif
'//
'// This routine is now a wrapper for FastIo if present or CcMdlReadComplete2
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcMdlReadComplete (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcPrepareMdlWrite (
' );
'#endif
'//
'// This routine is now a wrapper for FastIo if present or CcMdlWriteComplete2
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcMdlWriteComplete (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'CcMdlWriteAbort (
' );
'#endif // NTDDI_VERSION >= NTDDI_WINXP
'//
'// Common ReadAhead call for Copy Read and Mdl Read.
'//
'// ReadAhead should always be invoked by calling the CcReadAhead macro,
'// which tests first to see if the read is large enough to warrant read
'// ahead. Measurements have shown that, calling the read ahead routine
'// actually decreases performance for small reads, such as issued by
'// many compilers and linkers. Compilers simply want all of the include
'// files to stay in memory after being read the first time.
'//
'#define CcReadAhead(FO,FOFF,LEN) { \
' if ((LEN) >= 256) { \
' CcScheduleReadAhead((FO),(FOFF),(LEN)); \
' } \
'}
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcScheduleReadAhead (
' );
'#endif
'//
'// The following routine allows a caller to wait for the next batch
'// of lazy writer work to complete. In particular, this provides a
'// mechanism for a caller to be sure that all avaliable lazy closes
'// at the time of this call have issued.
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'NTSTATUS
'CcWaitForCurrentLazyWriterActivity (
' );
'#endif
'//
'// This routine changes the read ahead granularity for a file, which is
'// PAGE_SIZE by default.
'//
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcSetReadAheadGranularity (
' );
'#endif
'//
'// The following routines provide direct access data which is pinned in the
'// cache, and is primarily intended for use by File Systems. In particular,
'// this mode of access is ideal for dealing with volume structures.
'//
'//
'// Flags for pinning
'//
'// Note: The flags for pinning and the flags for mapping cannot overlap unless
'// the flag has the same meaning.
'//
'//
'// Synchronous Wait - normally specified. This pattern may be specified as TRUE.
'//
'#define PIN_WAIT (1)
'//
'// Acquire metadata Bcb exclusive (default is shared, Lazy Writer uses exclusive).
'//
'// Must be set with PIN_WAIT.
'//
'#define PIN_EXCLUSIVE (2)
'//
'// Acquire metadata Bcb but do not fault data in. Default is to fault the data in.
'// This unusual flag is only used by Ntfs for cache coherency synchronization between
'// compressed and uncompressed streams for the same compressed file.
'//
'// Must be set with PIN_WAIT.
'//
'#define PIN_NO_READ (4)
'//
'// This option may be used to pin data only if the Bcb already exists. If the Bcb
'// does not already exist - the pin is unsuccessful and no Bcb is returned. This routine
'// provides a way to see if data is already pinned (and possibly dirty) in the cache,
'// without forcing a fault if the data is not there.
'//
'#define PIN_IF_BCB (8)
'//
'// If this option is specified, the caller is responsible for tracking the
'// dirty ranges and calling MmSetAddressRangeModified on these ranges before
'// they are flushed. Ranges should only be pinned via this manner if the
'// entire range will be written or purged (one or the other must occur).
'//
'#define PIN_CALLER_TRACKS_DIRTY_DATA (32)
'//
'// If this option is specified, Cc will used reserved views to map the data
'// requested if Mm has no views to give Cc at the time of mapping the data.
'// This flag should only be used for critical data, like file system metadata
'// or other data critical to the file system remaining consistent. This is
'// a best effort attempt to ensure that we have enough kernel VA space for
'// critical system mappings, but once they are all gone, the call will fail
'// with insufficient resources.
'//
'//
'#define PIN_HIGH_PRIORITY (64)
'//
'// Flags for mapping
'//
'//
'// Synchronous Wait - normally specified. This pattern may be specified as TRUE.
'//
'#define MAP_WAIT (1)
'//
'// Acquire metadata Bcb but do not fault data in. Default is to fault the data in.
'// This should not overlap with any of the PIN_ flags so they can be passed down to
'// CcPinFileData
'//
'#define MAP_NO_READ (16)
'//
'// If this option is specified, Cc will used reserved views to map the data
'// requested if Mm has no views to give Cc at the time of mapping the data.
'// This flag should only be used for critical data, like file system metadata
'// or other data critical to the file system remaining consistent. This is
'// a best effort attempt to ensure that we have enough kernel VA space for
'// critical system mappings, but once they are all gone, the call will fail
'// with insufficient resources.
'//
'//
'#define MAP_HIGH_PRIORITY (64)
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'CcPinRead (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'BOOLEAN
'CcMapData (
' );
'#elif (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'CcMapData (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'CcPinMappedData (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'CcPreparePinWrite (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcSetDirtyPinnedData (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcUnpinData (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcSetBcbOwnerPointer (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcUnpinDataForThread (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'CcSetAdditionalCacheAttributes (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'CcSetParallelFlushFile (
' );
'#endif // NTDDI_VERSION >= NTDDI_VISTA
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'CcSetLogHandleForFile (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
'NTKERNELAPI
'LARGE_INTEGER
'CcGetDirtyPages (
' );
'#endif // NTDDI_VERSION >= NTDDI_WINXP
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTKERNELAPI
'BOOLEAN
'CcIsThereDirtyData (
' );
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
'NTKERNELAPI
'BOOLEAN
'CcIsThereDirtyDataEx (
' );
'#endif
'#ifndef __SSPI_H__
'#define __SSPI_H__
'#define ISSP_LEVEL 32
'#define ISSP_MODE 0
'#if defined(_NO_KSECDD_IMPORT_)
'#define KSECDDDECLSPEC
'#else
'#define KSECDDDECLSPEC __declspec(dllimport)
'#endif
'typedef WCHAR SEC_WCHAR;
'typedef CHAR SEC_CHAR;
'#ifndef __SECSTATUS_DEFINED__
'typedef LONG SECURITY_STATUS;
'#define __SECSTATUS_DEFINED__
'#endif
'#define SEC_TEXT TEXT
'#define SEC_FAR
'#define SEC_ENTRY __stdcall
'#ifndef __SECHANDLE_DEFINED__
'typedef struct _SecHandle
'{
' ULONG_PTR dwLower ;
' ULONG_PTR dwUpper ;
'} SecHandle, * PSecHandle ;
'#define __SECHANDLE_DEFINED__
'#endif // __SECHANDLE_DEFINED__
'#define SecInvalidateHandle( x ) \
' ((PSecHandle) (x))->dwLower = ((PSecHandle) (x))->dwUpper = ((ULONG_PTR) ((INT_PTR)-1)) ;
'#define SecIsValidHandle( x ) \
' ( ( ((PSecHandle) (x))->dwLower != ((ULONG_PTR) ((INT_PTR) -1 ))) && \
' ( ((PSecHandle) (x))->dwUpper != ((ULONG_PTR) ((INT_PTR) -1 ))) )
'//
'// pseudo handle value: the handle has already been deleted
'//
'#define SEC_DELETED_HANDLE ((ULONG_PTR) (-2))
'typedef SecHandle CredHandle;
'typedef PSecHandle PCredHandle;
'typedef SecHandle CtxtHandle;
'typedef PSecHandle PCtxtHandle;
'typedef LARGE_INTEGER _SECURITY_INTEGER, SECURITY_INTEGER, *PSECURITY_INTEGER;
'typedef SECURITY_INTEGER TimeStamp;
'typedef SECURITY_INTEGER * PTimeStamp;
'typedef UNICODE_STRING SECURITY_STRING, *PSECURITY_STRING;
'//
'// SecPkgInfo structure
'//
'// Provides general information about a security provider
'//
'typedef struct _SecPkgInfoW
'{
' unsigned long fCapabilities; // Capability bitmask
' unsigned short wVersion; // Version of driver
' unsigned short wRPCID; // ID for RPC Runtime
' unsigned long cbMaxToken; // Size of authentication token (max)
'#ifdef MIDL_PASS
' [string]
'#endif
' SEC_WCHAR * Name; // Text name
'#ifdef MIDL_PASS
' [string]
'#endif
' SEC_WCHAR * Comment; // Comment
'} SecPkgInfoW, * PSecPkgInfoW;
'# define SecPkgInfo SecPkgInfoW
'# define PSecPkgInfo PSecPkgInfoW
'//
'// Security Package Capabilities
'//
'#define SECPKG_FLAG_INTEGRITY 0x00000001 // Supports integrity on messages
'#define SECPKG_FLAG_PRIVACY 0x00000002 // Supports privacy (confidentiality)
'#define SECPKG_FLAG_TOKEN_ONLY 0x00000004 // Only security token needed
'#define SECPKG_FLAG_DATAGRAM 0x00000008 // Datagram RPC support
'#define SECPKG_FLAG_CONNECTION 0x00000010 // Connection oriented RPC support
'#define SECPKG_FLAG_MULTI_REQUIRED 0x00000020 // Full 3-leg required for re-auth.
'#define SECPKG_FLAG_CLIENT_ONLY 0x00000040 // Server side functionality not available
'#define SECPKG_FLAG_EXTENDED_ERROR 0x00000080 // Supports extended error msgs
'#define SECPKG_FLAG_IMPERSONATION 0x00000100 // Supports impersonation
'#define SECPKG_FLAG_ACCEPT_WIN32_NAME 0x00000200 // Accepts Win32 names
'#define SECPKG_FLAG_STREAM 0x00000400 // Supports stream semantics
'#define SECPKG_FLAG_NEGOTIABLE 0x00000800 // Can be used by the negotiate package
'#define SECPKG_FLAG_GSS_COMPATIBLE 0x00001000 // GSS Compatibility Available
'#define SECPKG_FLAG_LOGON 0x00002000 // Supports common LsaLogonUser
'#define SECPKG_FLAG_ASCII_BUFFERS 0x00004000 // Token Buffers are in ASCII
'#define SECPKG_FLAG_FRAGMENT 0x00008000 // Package can fragment to fit
'#define SECPKG_FLAG_MUTUAL_AUTH 0x00010000 // Package can perform mutual authentication
'#define SECPKG_FLAG_DELEGATION 0x00020000 // Package can delegate
'#define SECPKG_FLAG_READONLY_WITH_CHECKSUM 0x00040000 // Package can delegate
'#define SECPKG_FLAG_RESTRICTED_TOKENS 0x00080000 // Package supports restricted callers
'#define SECPKG_FLAG_NEGO_EXTENDER 0x00100000 // this package extends SPNEGO, there is at most one
'#define SECPKG_FLAG_NEGOTIABLE2 0x00200000 // this package is negotiated under the NegoExtender
'#define SECPKG_ID_NONE 0xFFFF
'//
'// SecBuffer
'//
'// Generic memory descriptors for buffers passed in to the security
'// API
'//
'typedef struct _SecBuffer {
' unsigned long cbBuffer; // Size of the buffer, in bytes
' unsigned long BufferType; // Type of the buffer (below)
'#ifdef MIDL_PASS
' [size_is(cbBuffer)] char * pvBuffer; // Pointer to the buffer
'#else
'#endif
'} SecBuffer, * PSecBuffer;
'typedef struct _SecBufferDesc {
' unsigned long ulVersion; // Version number
' unsigned long cBuffers; // Number of buffers
'#ifdef MIDL_PASS
' [size_is(cBuffers)]
'#endif
'} SecBufferDesc, SEC_FAR * PSecBufferDesc;
'#define SECBUFFER_VERSION 0
'#define SECBUFFER_EMPTY 0 // Undefined, replaced by provider
'#define SECBUFFER_DATA 1 // Packet data
'#define SECBUFFER_TOKEN 2 // Security token
'#define SECBUFFER_PKG_PARAMS 3 // Package specific parameters
'#define SECBUFFER_MISSING 4 // Missing Data indicator
'#define SECBUFFER_EXTRA 5 // Extra data
'#define SECBUFFER_STREAM_TRAILER 6 // Security Trailer
'#define SECBUFFER_STREAM_HEADER 7 // Security Header
'#define SECBUFFER_NEGOTIATION_INFO 8 // Hints from the negotiation pkg
'#define SECBUFFER_PADDING 9 // non-data padding
'#define SECBUFFER_STREAM 10 // whole encrypted message
'#define SECBUFFER_MECHLIST 11
'#define SECBUFFER_MECHLIST_SIGNATURE 12
'#define SECBUFFER_TARGET 13 // obsolete
'#define SECBUFFER_CHANNEL_BINDINGS 14
'#define SECBUFFER_CHANGE_PASS_RESPONSE 15
'#define SECBUFFER_TARGET_HOST 16
'#define SECBUFFER_ALERT 17
'#define SECBUFFER_ATTRMASK 0xF0000000
'#define SECBUFFER_READONLY 0x80000000 // Buffer is read-only, no checksum
'#define SECBUFFER_READONLY_WITH_CHECKSUM 0x10000000 // Buffer is read-only, and checksummed
'#define SECBUFFER_RESERVED 0x60000000 // Flags reserved to security system
'typedef struct _SEC_NEGOTIATION_INFO {
' unsigned long Size; // Size of this structure
' unsigned long NameLength; // Length of name hint
' SEC_WCHAR * Name; // Name hint
' void * Reserved; // Reserved
'} SEC_NEGOTIATION_INFO, * PSEC_NEGOTIATION_INFO ;
'typedef struct _SEC_CHANNEL_BINDINGS {
' unsigned long dwInitiatorAddrType;
' unsigned long cbInitiatorLength;
' unsigned long dwInitiatorOffset;
' unsigned long dwAcceptorAddrType;
' unsigned long cbAcceptorLength;
' unsigned long dwAcceptorOffset;
' unsigned long cbApplicationDataLength;
' unsigned long dwApplicationDataOffset;
'} SEC_CHANNEL_BINDINGS, * PSEC_CHANNEL_BINDINGS ;
'//
'// Data Representation Constant:
'//
'#define SECURITY_NATIVE_DREP 0x00000010
'#define SECURITY_NETWORK_DREP 0x00000000
'//
'// Credential Use Flags
'//
'#define SECPKG_CRED_INBOUND 0x00000001
'#define SECPKG_CRED_OUTBOUND 0x00000002
'#define SECPKG_CRED_BOTH 0x00000003
'#define SECPKG_CRED_DEFAULT 0x00000004
'#define SECPKG_CRED_RESERVED 0xF0000000
'//
'// SSP SHOULD prompt the user for credentials/consent, independent
'// of whether credentials to be used are the 'logged on' credentials
'// or retrieved from credman.
'//
'// An SSP may choose not to prompt, however, in circumstances determined
'// by the SSP.
'//
'#define SECPKG_CRED_AUTOLOGON_RESTRICTED 0x00000010
'//
'// auth will always fail, ISC() is called to process policy data only
'//
'#define SECPKG_CRED_PROCESS_POLICY_ONLY 0x00000020
'//
'// InitializeSecurityContext Requirement and return flags:
'//
'#define ISC_REQ_DELEGATE 0x00000001
'#define ISC_REQ_MUTUAL_AUTH 0x00000002
'#define ISC_REQ_REPLAY_DETECT 0x00000004
'#define ISC_REQ_SEQUENCE_DETECT 0x00000008
'#define ISC_REQ_CONFIDENTIALITY 0x00000010
'#define ISC_REQ_USE_SESSION_KEY 0x00000020
'#define ISC_REQ_PROMPT_FOR_CREDS 0x00000040
'#define ISC_REQ_USE_SUPPLIED_CREDS 0x00000080
'#define ISC_REQ_ALLOCATE_MEMORY 0x00000100
'#define ISC_REQ_USE_DCE_STYLE 0x00000200
'#define ISC_REQ_DATAGRAM 0x00000400
'#define ISC_REQ_CONNECTION 0x00000800
'#define ISC_REQ_CALL_LEVEL 0x00001000
'#define ISC_REQ_FRAGMENT_SUPPLIED 0x00002000
'#define ISC_REQ_EXTENDED_ERROR 0x00004000
'#define ISC_REQ_STREAM 0x00008000
'#define ISC_REQ_INTEGRITY 0x00010000
'#define ISC_REQ_IDENTIFY 0x00020000
'#define ISC_REQ_NULL_SESSION 0x00040000
'#define ISC_REQ_MANUAL_CRED_VALIDATION 0x00080000
'#define ISC_REQ_RESERVED1 0x00100000
'#define ISC_REQ_FRAGMENT_TO_FIT 0x00200000
'// This exists only in Windows Vista and greater
'#define ISC_REQ_FORWARD_CREDENTIALS 0x00400000
'#define ISC_REQ_NO_INTEGRITY 0x00800000 // honored only by SPNEGO
'#define ISC_REQ_USE_HTTP_STYLE 0x01000000
'#define ISC_RET_DELEGATE 0x00000001
'#define ISC_RET_MUTUAL_AUTH 0x00000002
'#define ISC_RET_REPLAY_DETECT 0x00000004
'#define ISC_RET_SEQUENCE_DETECT 0x00000008
'#define ISC_RET_CONFIDENTIALITY 0x00000010
'#define ISC_RET_USE_SESSION_KEY 0x00000020
'#define ISC_RET_USED_COLLECTED_CREDS 0x00000040
'#define ISC_RET_USED_SUPPLIED_CREDS 0x00000080
'#define ISC_RET_ALLOCATED_MEMORY 0x00000100
'#define ISC_RET_USED_DCE_STYLE 0x00000200
'#define ISC_RET_DATAGRAM 0x00000400
'#define ISC_RET_CONNECTION 0x00000800
'#define ISC_RET_INTERMEDIATE_RETURN 0x00001000
'#define ISC_RET_CALL_LEVEL 0x00002000
'#define ISC_RET_EXTENDED_ERROR 0x00004000
'#define ISC_RET_STREAM 0x00008000
'#define ISC_RET_INTEGRITY 0x00010000
'#define ISC_RET_IDENTIFY 0x00020000
'#define ISC_RET_NULL_SESSION 0x00040000
'#define ISC_RET_MANUAL_CRED_VALIDATION 0x00080000
'#define ISC_RET_RESERVED1 0x00100000
'#define ISC_RET_FRAGMENT_ONLY 0x00200000
'// This exists only in Windows Vista and greater
'#define ISC_RET_FORWARD_CREDENTIALS 0x00400000
'#define ISC_RET_USED_HTTP_STYLE 0x01000000
'#define ISC_RET_NO_ADDITIONAL_TOKEN 0x02000000 // *INTERNAL*
'#define ISC_RET_REAUTHENTICATION 0x08000000 // *INTERNAL*
'#define ASC_REQ_DELEGATE 0x00000001
'#define ASC_REQ_MUTUAL_AUTH 0x00000002
'#define ASC_REQ_REPLAY_DETECT 0x00000004
'#define ASC_REQ_SEQUENCE_DETECT 0x00000008
'#define ASC_REQ_CONFIDENTIALITY 0x00000010
'#define ASC_REQ_USE_SESSION_KEY 0x00000020
'#define ASC_REQ_ALLOCATE_MEMORY 0x00000100
'#define ASC_REQ_USE_DCE_STYLE 0x00000200
'#define ASC_REQ_DATAGRAM 0x00000400
'#define ASC_REQ_CONNECTION 0x00000800
'#define ASC_REQ_CALL_LEVEL 0x00001000
'#define ASC_REQ_EXTENDED_ERROR 0x00008000
'#define ASC_REQ_STREAM 0x00010000
'#define ASC_REQ_INTEGRITY 0x00020000
'#define ASC_REQ_LICENSING 0x00040000
'#define ASC_REQ_IDENTIFY 0x00080000
'#define ASC_REQ_ALLOW_NULL_SESSION 0x00100000
'#define ASC_REQ_ALLOW_NON_USER_LOGONS 0x00200000
'#define ASC_REQ_ALLOW_CONTEXT_REPLAY 0x00400000
'#define ASC_REQ_FRAGMENT_TO_FIT 0x00800000
'#define ASC_REQ_FRAGMENT_SUPPLIED 0x00002000
'#define ASC_REQ_NO_TOKEN 0x01000000
'#define ASC_REQ_PROXY_BINDINGS 0x04000000
'// SSP_RET_REAUTHENTICATION 0x08000000 // *INTERNAL*
'#define ASC_REQ_ALLOW_MISSING_BINDINGS 0x10000000
'#define ASC_RET_DELEGATE 0x00000001
'#define ASC_RET_MUTUAL_AUTH 0x00000002
'#define ASC_RET_REPLAY_DETECT 0x00000004
'#define ASC_RET_SEQUENCE_DETECT 0x00000008
'#define ASC_RET_CONFIDENTIALITY 0x00000010
'#define ASC_RET_USE_SESSION_KEY 0x00000020
'#define ASC_RET_ALLOCATED_MEMORY 0x00000100
'#define ASC_RET_USED_DCE_STYLE 0x00000200
'#define ASC_RET_DATAGRAM 0x00000400
'#define ASC_RET_CONNECTION 0x00000800
'#define ASC_RET_CALL_LEVEL 0x00002000 // skipped 1000 to be like ISC_
'#define ASC_RET_THIRD_LEG_FAILED 0x00004000
'#define ASC_RET_EXTENDED_ERROR 0x00008000
'#define ASC_RET_STREAM 0x00010000
'#define ASC_RET_INTEGRITY 0x00020000
'#define ASC_RET_LICENSING 0x00040000
'#define ASC_RET_IDENTIFY 0x00080000
'#define ASC_RET_NULL_SESSION 0x00100000
'#define ASC_RET_ALLOW_NON_USER_LOGONS 0x00200000
'#define ASC_RET_ALLOW_CONTEXT_REPLAY 0x00400000 // deprecated - don't use this flag!!!
'#define ASC_RET_FRAGMENT_ONLY 0x00800000
'#define ASC_RET_NO_TOKEN 0x01000000
'#define ASC_RET_NO_ADDITIONAL_TOKEN 0x02000000 // *INTERNAL*
'#define ASC_RET_NO_PROXY_BINDINGS 0x04000000
'// SSP_RET_REAUTHENTICATION 0x08000000 // *INTERNAL*
'#define ASC_RET_MISSING_BINDINGS 0x10000000
'//
'// Security Credentials Attributes:
'//
'#define SECPKG_CRED_ATTR_NAMES 1
'#define SECPKG_CRED_ATTR_SSI_PROVIDER 2
'typedef struct _SecPkgCredentials_NamesW
'{
'#ifdef MIDL_PASS
' [string]
'#endif
' SEC_WCHAR * sUserName;
'} SecPkgCredentials_NamesW, * PSecPkgCredentials_NamesW;
'# define SecPkgCredentials_Names SecPkgCredentials_NamesW
'# define PSecPkgCredentials_Names PSecPkgCredentials_NamesW
'#if NTDDI_VERSION > NTDDI_WS03
'typedef struct _SecPkgCredentials_SSIProviderW
'{
' SEC_WCHAR * sProviderName;
' unsigned long ProviderInfoLength;
' char * ProviderInfo;
'} SecPkgCredentials_SSIProviderW, * PSecPkgCredentials_SSIProviderW;
'#endif // End W2k3SP1 and greater
'# define SecPkgCredentials_SSIProvider SecPkgCredentials_SSIProviderW
'# define PSecPkgCredentials_SSIProvider PSecPkgCredentials_SSIProviderW
'//
'// Security Context Attributes:
'//
'#define SECPKG_ATTR_SIZES 0
'#define SECPKG_ATTR_NAMES 1
'#define SECPKG_ATTR_LIFESPAN 2
'#define SECPKG_ATTR_DCE_INFO 3
'#define SECPKG_ATTR_STREAM_SIZES 4
'#define SECPKG_ATTR_KEY_INFO 5
'#define SECPKG_ATTR_AUTHORITY 6
'#define SECPKG_ATTR_PROTO_INFO 7
'#define SECPKG_ATTR_PASSWORD_EXPIRY 8
'#define SECPKG_ATTR_SESSION_KEY 9
'#define SECPKG_ATTR_PACKAGE_INFO 10
'#define SECPKG_ATTR_USER_FLAGS 11
'#define SECPKG_ATTR_NEGOTIATION_INFO 12
'#define SECPKG_ATTR_NATIVE_NAMES 13
'#define SECPKG_ATTR_FLAGS 14
'// These attributes exist only in Win XP and greater
'#define SECPKG_ATTR_USE_VALIDATED 15
'#define SECPKG_ATTR_CREDENTIAL_NAME 16
'#define SECPKG_ATTR_TARGET_INFORMATION 17
'#define SECPKG_ATTR_ACCESS_TOKEN 18
'// These attributes exist only in Win2K3 and greater
'#define SECPKG_ATTR_TARGET 19
'#define SECPKG_ATTR_AUTHENTICATION_ID 20
'// These attributes exist only in Win2K3SP1 and greater
'#define SECPKG_ATTR_LOGOFF_TIME 21
'//
'// win7 or greater
'//
'#define SECPKG_ATTR_NEGO_KEYS 22
'#define SECPKG_ATTR_PROMPTING_NEEDED 24
'#define SECPKG_ATTR_UNIQUE_BINDINGS 25
'#define SECPKG_ATTR_ENDPOINT_BINDINGS 26
'#define SECPKG_ATTR_CLIENT_SPECIFIED_TARGET 27
'#define SECPKG_ATTR_LAST_CLIENT_TOKEN_STATUS 30
'#define SECPKG_ATTR_NEGO_PKG_INFO 31 // contains nego info of packages
'#define SECPKG_ATTR_NEGO_STATUS 32 // contains the last error
'#define SECPKG_ATTR_CONTEXT_DELETED 33 // a context has been deleted
'#define SECPKG_ATTR_SUBJECT_SECURITY_ATTRIBUTES 128
'typedef struct _SecPkgContext_SubjectAttributes {
' void* AttributeInfo; // contains a PAUTHZ_SECURITY_ATTRIBUTES_INFORMATION structure
'} SecPkgContext_SubjectAttributes, *PSecPkgContext_SubjectAttributes;
'#define SECPKG_ATTR_NEGO_INFO_FLAG_NO_KERBEROS 0x1
'#define SECPKG_ATTR_NEGO_INFO_FLAG_NO_NTLM 0x2
'//
'// types of credentials, used by SECPKG_ATTR_PROMPTING_NEEDED
'//
'typedef enum _SECPKG_CRED_CLASS {
' SecPkgCredClass_None = 0, // no creds
' SecPkgCredClass_Ephemeral = 10, // logon creds
' SecPkgCredClass_PersistedGeneric = 20, // saved creds, not target specific
' SecPkgCredClass_PersistedSpecific = 30, // saved creds, target specific
' SecPkgCredClass_Explicit = 40, // explicitly supplied creds
'} SECPKG_CRED_CLASS, * PSECPKG_CRED_CLASS;
'typedef struct _SecPkgContext_CredInfo {
' SECPKG_CRED_CLASS CredClass;
' unsigned long IsPromptingNeeded;
'} SecPkgContext_CredInfo, *PSecPkgContext_CredInfo;
'typedef struct _SecPkgContext_NegoPackageInfo
'{
' unsigned long PackageMask;
'} SecPkgContext_NegoPackageInfo, * PSecPkgContext_NegoPackageInfo;
'typedef struct _SecPkgContext_NegoStatus
'{
' unsigned long LastStatus;
'} SecPkgContext_NegoStatus, * PSecPkgContext_NegoStatus;
'typedef struct _SecPkgContext_Sizes
'{
' unsigned long cbMaxToken;
' unsigned long cbMaxSignature;
' unsigned long cbBlockSize;
' unsigned long cbSecurityTrailer;
'} SecPkgContext_Sizes, * PSecPkgContext_Sizes;
'typedef struct _SecPkgContext_StreamSizes
'{
' unsigned long cbHeader;
' unsigned long cbTrailer;
' unsigned long cbMaximumMessage;
' unsigned long cBuffers;
' unsigned long cbBlockSize;
'} SecPkgContext_StreamSizes, * PSecPkgContext_StreamSizes;
'typedef struct _SecPkgContext_NamesW
'{
' SEC_WCHAR * sUserName;
'} SecPkgContext_NamesW, * PSecPkgContext_NamesW;
'# define SecPkgContext_Names SecPkgContext_NamesW
'# define PSecPkgContext_Names PSecPkgContext_NamesW
'typedef struct _SecPkgContext_Lifespan
'{
' TimeStamp tsStart;
' TimeStamp tsExpiry;
'} SecPkgContext_Lifespan, * PSecPkgContext_Lifespan;
'typedef struct _SecPkgContext_DceInfo
'{
' unsigned long AuthzSvc;
' void * pPac;
'} SecPkgContext_DceInfo, * PSecPkgContext_DceInfo;
'typedef struct _SecPkgContext_KeyInfoW
'{
' SEC_WCHAR * sSignatureAlgorithmName;
' SEC_WCHAR * sEncryptAlgorithmName;
' unsigned long KeySize;
' unsigned long SignatureAlgorithm;
' unsigned long EncryptAlgorithm;
'} SecPkgContext_KeyInfoW, * PSecPkgContext_KeyInfoW;
'#define SecPkgContext_KeyInfo SecPkgContext_KeyInfoW
'#define PSecPkgContext_KeyInfo PSecPkgContext_KeyInfoW
'typedef struct _SecPkgContext_AuthorityW
'{
' SEC_WCHAR * sAuthorityName;
'} SecPkgContext_AuthorityW, * PSecPkgContext_AuthorityW;
'#define SecPkgContext_Authority SecPkgContext_AuthorityW
'#define PSecPkgContext_Authority PSecPkgContext_AuthorityW
'typedef struct _SecPkgContext_ProtoInfoW
'{
' SEC_WCHAR * sProtocolName;
' unsigned long majorVersion;
' unsigned long minorVersion;
'} SecPkgContext_ProtoInfoW, * PSecPkgContext_ProtoInfoW;
'#define SecPkgContext_ProtoInfo SecPkgContext_ProtoInfoW
'#define PSecPkgContext_ProtoInfo PSecPkgContext_ProtoInfoW
'typedef struct _SecPkgContext_PasswordExpiry
'{
' TimeStamp tsPasswordExpires;
'} SecPkgContext_PasswordExpiry, * PSecPkgContext_PasswordExpiry;
'#if NTDDI_VERSION > NTDDI_WS03
'typedef struct _SecPkgContext_LogoffTime
'{
' TimeStamp tsLogoffTime;
'} SecPkgContext_LogoffTime, * PSecPkgContext_LogoffTime;
'#endif // Greater than Windows Server 2003 RTM (SP1 and greater contains this)
'typedef struct _SecPkgContext_SessionKey
'{
' unsigned long SessionKeyLength;
'} SecPkgContext_SessionKey, *PSecPkgContext_SessionKey;
'// used by nego2
'typedef struct _SecPkgContext_NegoKeys
'{
' unsigned long KeyType;
' unsigned short KeyLength;
' unsigned long VerifyKeyType;
' unsigned short VerifyKeyLength;
'} SecPkgContext_NegoKeys, * PSecPkgContext_NegoKeys;
'typedef struct _SecPkgContext_PackageInfoW
'{
' PSecPkgInfoW PackageInfo;
'} SecPkgContext_PackageInfoW, * PSecPkgContext_PackageInfoW;
'typedef struct _SecPkgContext_UserFlags
'{
' unsigned long UserFlags;
'} SecPkgContext_UserFlags, * PSecPkgContext_UserFlags;
'typedef struct _SecPkgContext_Flags
'{
' unsigned long Flags;
'} SecPkgContext_Flags, * PSecPkgContext_Flags;
'#define SecPkgContext_PackageInfo SecPkgContext_PackageInfoW
'#define PSecPkgContext_PackageInfo PSecPkgContext_PackageInfoW
'typedef struct _SecPkgContext_NegotiationInfoW
'{
' PSecPkgInfoW PackageInfo ;
' unsigned long NegotiationState ;
'} SecPkgContext_NegotiationInfoW, * PSecPkgContext_NegotiationInfoW ;
'# define SecPkgContext_NativeNames SecPkgContext_NativeNamesW
'# define PSecPkgContext_NativeNames PSecPkgContext_NativeNamesW
'#if OSVER(NTDDI_VERSION) > NTDDI_WIN2K
'typedef struct _SecPkgContext_CredentialNameW
'{
' unsigned long CredentialType;
' SEC_WCHAR *sCredentialName;
'} SecPkgContext_CredentialNameW, * PSecPkgContext_CredentialNameW;
'#endif // Later than win2k
'# define SecPkgContext_CredentialName SecPkgContext_CredentialNameW
'# define PSecPkgContext_CredentialName PSecPkgContext_CredentialNameW
'typedef void
'(SEC_ENTRY * SEC_GET_KEY_FN) (
' void * Arg, // Argument passed in
' void * Principal, // Principal ID
' unsigned long KeyVer, // Key Version
' void * * Key, // Returned ptr to key
' SECURITY_STATUS * Status // returned status
' );
'//
'// Flags for ExportSecurityContext
'//
'#define SECPKG_CONTEXT_EXPORT_RESET_NEW 0x00000001 // New context is reset to initial state
'#define SECPKG_CONTEXT_EXPORT_DELETE_OLD 0x00000002 // Old context is deleted during export
'// This is only valid in W2K3SP1 and greater
'#define SECPKG_CONTEXT_EXPORT_TO_KERNEL 0x00000004 // Context is to be transferred to the kernel
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'AcquireCredentialsHandleW(
'#if ISSP_MODE == 0 // For Kernel mode
'#else
'#endif
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * ACQUIRE_CREDENTIALS_HANDLE_FN_W)(
'#if ISSP_MODE == 0
' PSECURITY_STRING,
' PSECURITY_STRING,
'#else
' SEC_WCHAR *,
' SEC_WCHAR *,
'#endif
' unsigned long,
' void *,
' void *,
' SEC_GET_KEY_FN,
' void *,
' PCredHandle,
' PTimeStamp);
'# define AcquireCredentialsHandle AcquireCredentialsHandleW
'# define ACQUIRE_CREDENTIALS_HANDLE_FN ACQUIRE_CREDENTIALS_HANDLE_FN_W
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'FreeCredentialsHandle(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * FREE_CREDENTIALS_HANDLE_FN)(
' PCredHandle );
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'AddCredentialsW(
'#if ISSP_MODE == 0 // For Kernel mode
'#else
'#endif
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * ADD_CREDENTIALS_FN_W)(
' PCredHandle,
'#if ISSP_MODE == 0
' PSECURITY_STRING,
' PSECURITY_STRING,
'#else
' SEC_WCHAR *,
' SEC_WCHAR *,
'#endif
' unsigned long,
' void *,
' SEC_GET_KEY_FN,
' void *,
' PTimeStamp);
'SECURITY_STATUS SEC_ENTRY
'AddCredentialsA(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * ADD_CREDENTIALS_FN_A)(
' PCredHandle,
' SEC_CHAR *,
' SEC_CHAR *,
' unsigned long,
' void *,
' SEC_GET_KEY_FN,
' void *,
' PTimeStamp);
'#ifdef UNICODE
'#define AddCredentials AddCredentialsW
'#define ADD_CREDENTIALS_FN ADD_CREDENTIALS_FN_W
'#else
'#define AddCredentials AddCredentialsA
'#define ADD_CREDENTIALS_FN ADD_CREDENTIALS_FN_A
'#endif
'////////////////////////////////////////////////////////////////////////
'///
'/// Password Change Functions
'///
'////////////////////////////////////////////////////////////////////////
'#if ISSP_MODE != 0
'SECURITY_STATUS SEC_ENTRY
'ChangeAccountPasswordW(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * CHANGE_PASSWORD_FN_W)(
' SEC_WCHAR *,
' SEC_WCHAR *,
' SEC_WCHAR *,
' SEC_WCHAR *,
' SEC_WCHAR *,
' BOOLEAN,
' unsigned long,
' PSecBufferDesc
' );
'SECURITY_STATUS SEC_ENTRY
'ChangeAccountPasswordA(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * CHANGE_PASSWORD_FN_A)(
' SEC_CHAR *,
' SEC_CHAR *,
' SEC_CHAR *,
' SEC_CHAR *,
' SEC_CHAR *,
' BOOLEAN,
' unsigned long,
' PSecBufferDesc
' );
'#ifdef UNICODE
'# define ChangeAccountPassword ChangeAccountPasswordW
'# define CHANGE_PASSWORD_FN CHANGE_PASSWORD_FN_W
'#else
'# define ChangeAccountPassword ChangeAccountPasswordA
'# define CHANGE_PASSWORD_FN CHANGE_PASSWORD_FN_A
'#endif // !UNICODE
'#endif // ISSP_MODE
'////////////////////////////////////////////////////////////////////////
'///
'/// Context Management Functions
'///
'////////////////////////////////////////////////////////////////////////
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'InitializeSecurityContextW(
'#if ISSP_MODE == 0
'#else
'#endif
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * INITIALIZE_SECURITY_CONTEXT_FN_W)(
' PCredHandle,
' PCtxtHandle,
'#if ISSP_MODE == 0
' PSECURITY_STRING,
'#else
' SEC_WCHAR *,
'#endif
' unsigned long,
' unsigned long,
' unsigned long,
' PSecBufferDesc,
' unsigned long,
' PCtxtHandle,
' PSecBufferDesc,
' unsigned long *,
' PTimeStamp);
'# define InitializeSecurityContext InitializeSecurityContextW
'# define INITIALIZE_SECURITY_CONTEXT_FN INITIALIZE_SECURITY_CONTEXT_FN_W
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'AcceptSecurityContext(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * ACCEPT_SECURITY_CONTEXT_FN)(
' PCredHandle,
' PCtxtHandle,
' PSecBufferDesc,
' unsigned long,
' unsigned long,
' PCtxtHandle,
' PSecBufferDesc,
' unsigned long *,
' PTimeStamp);
'SECURITY_STATUS SEC_ENTRY
'CompleteAuthToken(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * COMPLETE_AUTH_TOKEN_FN)(
' PCtxtHandle,
' PSecBufferDesc);
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'ImpersonateSecurityContext(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * IMPERSONATE_SECURITY_CONTEXT_FN)(
' PCtxtHandle);
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'RevertSecurityContext(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * REVERT_SECURITY_CONTEXT_FN)(
' PCtxtHandle);
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'QuerySecurityContextToken(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * QUERY_SECURITY_CONTEXT_TOKEN_FN)(
' PCtxtHandle, void * *);
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'DeleteSecurityContext(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * DELETE_SECURITY_CONTEXT_FN)(
' PCtxtHandle);
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'ApplyControlToken(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * APPLY_CONTROL_TOKEN_FN)(
' PCtxtHandle, PSecBufferDesc);
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'QueryContextAttributesW(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * QUERY_CONTEXT_ATTRIBUTES_FN_W)(
' PCtxtHandle,
' unsigned long,
' void *);
'# define QueryContextAttributes QueryContextAttributesW
'# define QUERY_CONTEXT_ATTRIBUTES_FN QUERY_CONTEXT_ATTRIBUTES_FN_W
'#if (OSVER(NTDDI_VERSION) > NTDDI_WIN2K)
'SECURITY_STATUS SEC_ENTRY
'SetContextAttributesW(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * SET_CONTEXT_ATTRIBUTES_FN_W)(
' PCtxtHandle,
' unsigned long,
' void *,
' unsigned long );
'#endif // Greater than w2k
'# define SetContextAttributes SetContextAttributesW
'# define SET_CONTEXT_ATTRIBUTES_FN SET_CONTEXT_ATTRIBUTES_FN_W
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'QueryCredentialsAttributesW(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * QUERY_CREDENTIALS_ATTRIBUTES_FN_W)(
' PCredHandle,
' unsigned long,
' void *);
'# define QueryCredentialsAttributes QueryCredentialsAttributesW
'# define QUERY_CREDENTIALS_ATTRIBUTES_FN QUERY_CREDENTIALS_ATTRIBUTES_FN_W
'#if NTDDI_VERSION > NTDDI_WS03
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'SetCredentialsAttributesW(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * SET_CREDENTIALS_ATTRIBUTES_FN_W)(
' PCredHandle,
' unsigned long,
' void *,
' unsigned long );
'#endif // For W2k3SP1 and greater
'# define SetCredentialsAttributes SetCredentialsAttributesW
'# define SET_CREDENTIALS_ATTRIBUTES_FN SET_CREDENTIALS_ATTRIBUTES_FN_W
'SECURITY_STATUS SEC_ENTRY
'FreeContextBuffer(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * FREE_CONTEXT_BUFFER_FN)(
' );
'///////////////////////////////////////////////////////////////////
'////
'//// Message Support API
'////
'//////////////////////////////////////////////////////////////////
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'MakeSignature(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * MAKE_SIGNATURE_FN)(
' PCtxtHandle,
' unsigned long,
' PSecBufferDesc,
' unsigned long);
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'VerifySignature(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * VERIFY_SIGNATURE_FN)(
' PCtxtHandle,
' PSecBufferDesc,
' unsigned long,
' unsigned long *);
'// This only exists win Win2k3 and Greater
'#define SECQOP_WRAP_NO_ENCRYPT 0x80000001
'#define SECQOP_WRAP_OOB_DATA 0x40000000
'SECURITY_STATUS SEC_ENTRY
'EncryptMessage( __in PCtxtHandle phContext,
'typedef SECURITY_STATUS
'(SEC_ENTRY * ENCRYPT_MESSAGE_FN)(
' PCtxtHandle, unsigned long, PSecBufferDesc, unsigned long);
'SECURITY_STATUS SEC_ENTRY
'DecryptMessage( __in PCtxtHandle phContext,
'typedef SECURITY_STATUS
'(SEC_ENTRY * DECRYPT_MESSAGE_FN)(
' PCtxtHandle, PSecBufferDesc, unsigned long,
' unsigned long *);
'///////////////////////////////////////////////////////////////////////////
'////
'//// Misc.
'////
'///////////////////////////////////////////////////////////////////////////
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'EnumerateSecurityPackagesW(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * ENUMERATE_SECURITY_PACKAGES_FN_W)(
' unsigned long *,
' PSecPkgInfoW *);
'# define EnumerateSecurityPackages EnumerateSecurityPackagesW
'# define ENUMERATE_SECURITY_PACKAGES_FN ENUMERATE_SECURITY_PACKAGES_FN_W
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'QuerySecurityPackageInfoW(
'#if ISSP_MODE == 0
'#else
'#endif
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * QUERY_SECURITY_PACKAGE_INFO_FN_W)(
'#if ISSP_MODE == 0
' PSECURITY_STRING,
'#else
' SEC_WCHAR *,
'#endif
' PSecPkgInfoW *);
'# define QuerySecurityPackageInfo QuerySecurityPackageInfoW
'# define QUERY_SECURITY_PACKAGE_INFO_FN QUERY_SECURITY_PACKAGE_INFO_FN_W
'///////////////////////////////////////////////////////////////////////////
'////
'//// Context export/import
'////
'///////////////////////////////////////////////////////////////////////////
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'ExportSecurityContext(
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * EXPORT_SECURITY_CONTEXT_FN)(
' PCtxtHandle,
' ULONG,
' PSecBuffer,
' void * *
' );
'KSECDDDECLSPEC
'SECURITY_STATUS SEC_ENTRY
'ImportSecurityContextW(
'#if ISSP_MODE == 0
'#else
'#endif
' );
'typedef SECURITY_STATUS
'(SEC_ENTRY * IMPORT_SECURITY_CONTEXT_FN_W)(
'#if ISSP_MODE == 0
' PSECURITY_STRING,
'#else
' SEC_WCHAR *,
'#endif
' PSecBuffer,
' VOID *,
' PCtxtHandle
' );
'# define ImportSecurityContext ImportSecurityContextW
'# define IMPORT_SECURITY_CONTEXT_FN IMPORT_SECURITY_CONTEXT_FN_W
'#if ISSP_MODE == 0
'KSECDDDECLSPEC
'NTSTATUS
'NTAPI
'SecMakeSPN(
' IN PUNICODE_STRING ServiceClass,
' IN PUNICODE_STRING ServiceName,
' IN PUNICODE_STRING InstanceName OPTIONAL,
' IN USHORT InstancePort OPTIONAL,
' IN PUNICODE_STRING Referrer OPTIONAL,
' IN OUT PUNICODE_STRING Spn,
' OUT PULONG Length OPTIONAL,
' IN BOOLEAN Allocate
' );
'#if OSVER(NTDDI_VERSION) > NTDD_WIN2K
'KSECDDDECLSPEC
'NTSTATUS
'NTAPI
'SecMakeSPNEx(
' IN PUNICODE_STRING ServiceClass,
' IN PUNICODE_STRING ServiceName,
' IN PUNICODE_STRING InstanceName OPTIONAL,
' IN USHORT InstancePort OPTIONAL,
' IN PUNICODE_STRING Referrer OPTIONAL,
' IN PUNICODE_STRING TargetInfo OPTIONAL,
' IN OUT PUNICODE_STRING Spn,
' OUT PULONG Length OPTIONAL,
' IN BOOLEAN Allocate
' );
'#if OSVER(NTDDI_VERSION) > NTDDI_WS03
'KSECDDDECLSPEC
'NTSTATUS
'NTAPI
'SecMakeSPNEx2(
' IN PUNICODE_STRING ServiceClass,
' IN PUNICODE_STRING ServiceName,
' IN PUNICODE_STRING InstanceName OPTIONAL,
' IN USHORT InstancePort OPTIONAL,
' IN PUNICODE_STRING Referrer OPTIONAL,
' IN PUNICODE_STRING InTargetInfo OPTIONAL,
' IN OUT PUNICODE_STRING Spn,
' OUT PULONG TotalSize OPTIONAL,
' IN BOOLEAN Allocate,
' IN BOOLEAN IsTargetInfoMarshaled
' );
'#endif // Windows Vista and greater
'KSECDDDECLSPEC
'NTSTATUS
'SEC_ENTRY
'SecLookupAccountSid(
' );
'KSECDDDECLSPEC
'NTSTATUS
'SEC_ENTRY
'SecLookupAccountName(
' );
'#endif // Greater than W2k
'#if OSVER(NTDDI_VERSION) > NTDDI_WINXP
'KSECDDDECLSPEC
'NTSTATUS
'SEC_ENTRY
'SecLookupWellKnownSid(
' );
'#endif // Greater than XP
'#endif
'#define SECURITY_ENTRYPOINTW SEC_TEXT("InitSecurityInterfaceW")
'# define SECURITY_ENTRYPOINT SECURITY_ENTRYPOINTW
'#define FreeCredentialHandle FreeCredentialsHandle
'typedef struct _SECURITY_FUNCTION_TABLE_W {
' unsigned long dwVersion;
' ENUMERATE_SECURITY_PACKAGES_FN_W EnumerateSecurityPackagesW;
' QUERY_CREDENTIALS_ATTRIBUTES_FN_W QueryCredentialsAttributesW;
' ACQUIRE_CREDENTIALS_HANDLE_FN_W AcquireCredentialsHandleW;
' FREE_CREDENTIALS_HANDLE_FN FreeCredentialsHandle;
' void * Reserved2;
' INITIALIZE_SECURITY_CONTEXT_FN_W InitializeSecurityContextW;
' ACCEPT_SECURITY_CONTEXT_FN AcceptSecurityContext;
' COMPLETE_AUTH_TOKEN_FN CompleteAuthToken;
' DELETE_SECURITY_CONTEXT_FN DeleteSecurityContext;
' APPLY_CONTROL_TOKEN_FN ApplyControlToken;
' QUERY_CONTEXT_ATTRIBUTES_FN_W QueryContextAttributesW;
' IMPERSONATE_SECURITY_CONTEXT_FN ImpersonateSecurityContext;
' REVERT_SECURITY_CONTEXT_FN RevertSecurityContext;
' MAKE_SIGNATURE_FN MakeSignature;
' VERIFY_SIGNATURE_FN VerifySignature;
' FREE_CONTEXT_BUFFER_FN FreeContextBuffer;
' QUERY_SECURITY_PACKAGE_INFO_FN_W QuerySecurityPackageInfoW;
' void * Reserved3;
' void * Reserved4;
' EXPORT_SECURITY_CONTEXT_FN ExportSecurityContext;
' IMPORT_SECURITY_CONTEXT_FN_W ImportSecurityContextW;
' ADD_CREDENTIALS_FN_W AddCredentialsW ;
' void * Reserved8;
' QUERY_SECURITY_CONTEXT_TOKEN_FN QuerySecurityContextToken;
' ENCRYPT_MESSAGE_FN EncryptMessage;
' DECRYPT_MESSAGE_FN DecryptMessage;
'#if OSVER(NTDDI_VERSION) > NTDDI_WIN2K
' // Fields below this are available in OSes after w2k
' SET_CONTEXT_ATTRIBUTES_FN_W SetContextAttributesW;
'#endif // greater thean 2K
'#if NTDDI_VERSION > NTDDI_WS03SP1
' // Fields below this are available in OSes after W2k3SP1
' SET_CREDENTIALS_ATTRIBUTES_FN_W SetCredentialsAttributesW;
'#endif
'#if ISSP_MODE != 0
' CHANGE_PASSWORD_FN_W ChangeAccountPasswordW;
'#else
' void * Reserved9;
'#endif
'} SecurityFunctionTableW, * PSecurityFunctionTableW;
'# define SecurityFunctionTable SecurityFunctionTableW
'# define PSecurityFunctionTable PSecurityFunctionTableW
'#define SECURITY_SUPPORT_PROVIDER_INTERFACE_VERSION 1
'#define SECURITY_SUPPORT_PROVIDER_INTERFACE_VERSION_2 2
'#define SECURITY_SUPPORT_PROVIDER_INTERFACE_VERSION_3 3
'#define SECURITY_SUPPORT_PROVIDER_INTERFACE_VERSION_4 4
'KSECDDDECLSPEC
'PSecurityFunctionTableW SEC_ENTRY
'InitSecurityInterfaceW(
' void
' );
'typedef PSecurityFunctionTableW
'(SEC_ENTRY * INIT_SECURITY_INTERFACE_W)(void);
'# define InitSecurityInterface InitSecurityInterfaceW
'# define INIT_SECURITY_INTERFACE INIT_SECURITY_INTERFACE_W
'#ifndef _AUTH_IDENTITY_EX2_DEFINED
'#define _AUTH_IDENTITY_EX2_DEFINED
'#define SEC_WINNT_AUTH_IDENTITY_VERSION_2 0x201
'typedef struct _SEC_WINNT_AUTH_IDENTITY_EX2 {
' unsigned long Version; // contains SEC_WINNT_AUTH_IDENTITY_VERSION_2
' unsigned short cbHeaderLength;
' unsigned long cbStructureLength;
' unsigned long UserOffset; // Non-NULL terminated string, unicode only
' unsigned short UserLength; // # of bytes (NOT WCHARs), not including NULL.
' unsigned long DomainOffset; // Non-NULL terminated string, unicode only
' unsigned short DomainLength; // # of bytes (NOT WCHARs), not including NULL.
' unsigned long PackedCredentialsOffset; // Non-NULL terminated string, unicode only
' unsigned short PackedCredentialsLength; // # of bytes (NOT WCHARs), not including NULL.
' unsigned long Flags;
' unsigned long PackageListOffset; // Non-NULL terminated string, unicode only
' unsigned short PackageListLength;
'} SEC_WINNT_AUTH_IDENTITY_EX2, *PSEC_WINNT_AUTH_IDENTITY_EX2;
'#endif // _AUTH_IDENTITY_EX2_DEFINED
'#ifndef _AUTH_IDENTITY_DEFINED
'#define _AUTH_IDENTITY_DEFINED
'//
'// This was not defined in NTIFS.h for windows 2000 however
'// this struct has always been there and are safe to use
'// in windows 2000 and above.
'//
'#define SEC_WINNT_AUTH_IDENTITY_ANSI 0x1
'#define SEC_WINNT_AUTH_IDENTITY_UNICODE 0x2
'typedef struct _SEC_WINNT_AUTH_IDENTITY_W {
' unsigned short *User; // Non-NULL terminated string.
' unsigned long UserLength; // # of characters (NOT bytes), not including NULL.
' unsigned short *Domain; // Non-NULL terminated string.
' unsigned long DomainLength; // # of characters (NOT bytes), not including NULL.
' unsigned short *Password; // Non-NULL terminated string.
' unsigned long PasswordLength; // # of characters (NOT bytes), not including NULL.
' unsigned long Flags;
'} SEC_WINNT_AUTH_IDENTITY_W, *PSEC_WINNT_AUTH_IDENTITY_W;
'#define SEC_WINNT_AUTH_IDENTITY SEC_WINNT_AUTH_IDENTITY_W
'#define PSEC_WINNT_AUTH_IDENTITY PSEC_WINNT_AUTH_IDENTITY_W
'#define _SEC_WINNT_AUTH_IDENTITY _SEC_WINNT_AUTH_IDENTITY_W
'#endif //_AUTH_IDENTITY_DEFINED // ntifs
'//
'// This is the combined authentication identity structure that may be
'// used with the negotiate package, NTLM, Kerberos, or SCHANNEL
'//
'#ifndef SEC_WINNT_AUTH_IDENTITY_VERSION
'#define SEC_WINNT_AUTH_IDENTITY_VERSION 0x200
'typedef struct _SEC_WINNT_AUTH_IDENTITY_EXW {
' unsigned long Version;
' unsigned long Length;
' unsigned short *User; // Non-NULL terminated string.
' unsigned long UserLength; // # of characters (NOT bytes), not including NULL.
' unsigned short *Domain; // Non-NULL terminated string.
' unsigned long DomainLength; // # of characters (NOT bytes), not including NULL.
' unsigned short *Password; // Non-NULL terminated string.
' unsigned long PasswordLength; // # of characters (NOT bytes), not including NULL.
' unsigned long Flags;
' unsigned short *PackageList;
' unsigned long PackageListLength;
'} SEC_WINNT_AUTH_IDENTITY_EXW, *PSEC_WINNT_AUTH_IDENTITY_EXW;
'#define SEC_WINNT_AUTH_IDENTITY_EX SEC_WINNT_AUTH_IDENTITY_EXW
'#define PSEC_WINNT_AUTH_IDENTITY_EX PSEC_WINNT_AUTH_IDENTITY_EXW
'#endif // SEC_WINNT_AUTH_IDENTITY_VERSION
'typedef PVOID PSEC_WINNT_AUTH_IDENTITY_OPAQUE; // the credential structure is opaque
'#if (NTDDI_VERSION >= NTDDI_WIN7)
'//
'// Convert the _OPAQUE structure passed in to the
'// 3 tuple <username, domainname, 'password'>.
'//
'// Note: The 'strings' returned need not necessarily be
'// in user recognisable form. The purpose of this API
'// is to 'flatten' the _OPAQUE structure into the 3 tuple.
'// User recognisable <username, domainname> can always be
'// obtained by passing NULL to the pszPackedCredentialsString
'// parameter.
'//
'// zero out the pszPackedCredentialsString then
'// free the returned memory using SspiLocalFree()
'//
'SECURITY_STATUS
'SEC_ENTRY
'SspiEncodeAuthIdentityAsStrings(
' );
'SECURITY_STATUS
'SEC_ENTRY
'SspiValidateAuthIdentity(
' );
'//
'// free the returned memory using SspiFreeAuthIdentity()
'//
'SECURITY_STATUS
'SEC_ENTRY
'SspiCopyAuthIdentity(
' );
'//
'// use only for the memory returned by SspiCopyAuthIdentity().
'// Internally calls SspiZeroAuthIdentity().
'//
'SEC_ENTRY
'SspiFreeAuthIdentity(
' );
'SEC_ENTRY
'SspiZeroAuthIdentity(
' );
'SEC_ENTRY
'SspiLocalFree(
' );
'//
'// call SspiFreeAuthIdentity to free the returned AuthIdentity
'// which zeroes out the credentials blob before freeing it
'//
'SECURITY_STATUS
'SEC_ENTRY
'SspiEncodeStringsAsAuthIdentity(
' );
'SECURITY_STATUS
'SEC_ENTRY
'SspiCompareAuthIdentities(
' );
'//
'// zero out the returned AuthIdentityByteArray then
'// free the returned memory using SspiLocalFree()
'//
'SECURITY_STATUS
'SEC_ENTRY
'SspiMarshalAuthIdentity(
' );
'//
'// free the returned auth identity using SspiFreeAuthIdentity()
'//
'SECURITY_STATUS
'SEC_ENTRY
'SspiUnmarshalAuthIdentity(
' );
'BOOLEAN
'SEC_ENTRY
'SspiIsPromptingNeeded(
' );
'SECURITY_STATUS
'SEC_ENTRY
'SspiGetTargetHostName(
' );
'SECURITY_STATUS
'SEC_ENTRY
'SspiExcludePackage(
' );
'//
'// Common types used by negotiable security packages
'//
'// These are defined after W2K
'//
'#define SEC_WINNT_AUTH_IDENTITY_MARSHALLED 0x4 // all data is in one buffer
'#define SEC_WINNT_AUTH_IDENTITY_ONLY 0x8 // these credentials are for identity only - no PAC needed
'#endif // NTDDI_VERSION
'#endif // __SSPI_H__
'#ifndef SECURITY_USER_DATA_DEFINED
'#define SECURITY_USER_DATA_DEFINED
'typedef struct _SECURITY_USER_DATA {
' SECURITY_STRING UserName; // User name
' SECURITY_STRING LogonDomainName; // Domain the user logged on to
' SECURITY_STRING LogonServer; // Server that logged the user on
' PSID pSid; // SID of user
'} SECURITY_USER_DATA, *PSECURITY_USER_DATA;
'typedef SECURITY_USER_DATA SecurityUserData, * PSecurityUserData;
'#define UNDERSTANDS_LONG_NAMES 1
'#define NO_LONG_NAMES 2
'#endif // SECURITY_USER_DATA_DEFINED
DECLARE FUNCTION GetSecurityUserInfo LIB "ksecdd.dll" ALIAS "GetSecurityUserInfo" ( BYREF LogonId AS QUAD , BYVAL Flags AS QUAD , BYREF UserInformation AS SECURITY_USER_DATA ) AS LONG ' NTSTATUS
DECLARE FUNCTION MapSecurityError LIB "ksecdd.dll" ALIAS "MapSecurityError" ( BYREF SecStatus AS LONG ) AS LONG ' NTSTATUS
'#define DD_MUP_DEVICE_NAME L"\\Device\\Mup"
$DD_MUP_DEVICE_NAME = "\Device\Mup"
'//
'// The actual prefix resolution IOCTL issued by MUP to
'// redirectors to determine who is responsible for a
'// \\server\share prefix.
'//
'//
'// For use with legacy providers, which register with
'// FsRtlRegisterUncProvider().
'//
'#define IOCTL_REDIR_QUERY_PATH CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
%EQUATE `IOCTL_REDIR_QUERY_PATH = &H0014018F
'//
'// For use by redirectors conforming to the Vista redirector model.
'// These register with FsRtlRegisterUncProviderEx().
'//
'#define IOCTL_REDIR_QUERY_PATH_EX CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 100, METHOD_NEITHER, FILE_ANY_ACCESS)
%EQUATE `IOCTL_REDIR_QUERY_PATH_EX = &H00140193
' From wdm.h ----------
'typedef struct _ACCESS_STATE *PACCESS_STATE;
'typedef struct _SECURITY_QUALITY_OF_SERVICE *PSECURITY_QUALITY_OF_SERVICE;
'//
'// Define the I/O system's security context type for use by file system's
'// when checking access to volumes, files, and directories.
'//
' // Size = 16 bytes
TYPE IO_SECURITY_CONTEXT DWORD
 SecurityQos AS DWORD ' PSECURITY_QUALITY_OF_SERVICE
 AccessState AS DWORD ' PACCESS_STATE
 DesiredAccess AS ACCESS_MASK ' ACCESS_MASK
 FullCreateOptions AS DWORD ' ULONG
END TYPE
' ---------------------
'//
'// Used by MUP prefix resolution.
'// For use with legacy providers, which register with
'// FsRtlRegisterUncProvider().
'//
' // Size = 12 bytes
TYPE QUERY_PATH_REQUEST DWORD
 PathNameLength AS DWORD ' ULONG
 SecurityContext AS IO_SECURITY_CONTEXT PTR ' PIO_SECURITY_CONTEXT
 FilePathName AS WSTRINGZ * 1 ' WCHAR[1]
END TYPE
'//
'// Used by MUP prefix resolution.
'// Issued to providers which register with FsRtlRegisterUncProviderEx()
'// These are providers conforming to the Vista redirector model.
'//
' // size = 40 bytes
TYPE QUERY_PATH_REQUEST_EX DWORD
 pSecurityContext AS DWORD ' PIO_SECURITY_CONTEXT
 EaLength AS DWORD ' ULONG
 pEaBuffer AS DWORD
 ' // Pointer to filename will be passed to provider.
 ' // Providers MUST NOT modify this string.
 PathName AS UNICODE_STRING
 ' // Pointer to optional domain service name. Only providers which
 ' // register as FSRTL_UNC_PROVIDER_FLAGS_DOMAIN_SVC_AWARE will see
 ' // domain service names.
 ' //
 ' // This consumes 2 of the 5 ULONG_PTRs initially reserved in the
 ' // _EX query. New as of Windows 7.
 DomainServiceName AS UNICODE_STRING
 ' // Reserved
 Reserved(2) AS DWORD ' ULONG_PTR[ 3 ]
END TYPE
' // Size = 4 bytes
TYPE QUERY_PATH_RESPONSE DWORD
 LengthAccepted AS DWORD ' ULONG
END TYPE
'#ifndef _WNNC_
'#define _WNNC_
'//
'// Network types
'//
'#define WNNC_NET_MSNET 0x00010000
'#define WNNC_NET_SMB 0x00020000
'#define WNNC_NET_NETWARE 0x00030000
'#define WNNC_NET_VINES 0x00040000
'#define WNNC_NET_10NET 0x00050000
'#define WNNC_NET_LOCUS 0x00060000
'#define WNNC_NET_SUN_PC_NFS 0x00070000
'#define WNNC_NET_LANSTEP 0x00080000
'#define WNNC_NET_9TILES 0x00090000
'#define WNNC_NET_LANTASTIC 0x000A0000
'#define WNNC_NET_AS400 0x000B0000
'#define WNNC_NET_FTP_NFS 0x000C0000
'#define WNNC_NET_PATHWORKS 0x000D0000
'#define WNNC_NET_LIFENET 0x000E0000
'#define WNNC_NET_POWERLAN 0x000F0000
'#define WNNC_NET_BWNFS 0x00100000
'#define WNNC_NET_COGENT 0x00110000
'#define WNNC_NET_FARALLON 0x00120000
'#define WNNC_NET_APPLETALK 0x00130000
'#define WNNC_NET_INTERGRAPH 0x00140000
'#define WNNC_NET_SYMFONET 0x00150000
'#define WNNC_NET_CLEARCASE 0x00160000
'#define WNNC_NET_FRONTIER 0x00170000
'#define WNNC_NET_BMC 0x00180000
'#define WNNC_NET_DCE 0x00190000
'#define WNNC_NET_AVID 0x001A0000
'#define WNNC_NET_DOCUSPACE 0x001B0000
'#define WNNC_NET_MANGOSOFT 0x001C0000
'#define WNNC_NET_SERNET 0x001D0000
'#define WNNC_NET_RIVERFRONT1 0X001E0000
'#define WNNC_NET_RIVERFRONT2 0x001F0000
'#define WNNC_NET_DECORB 0x00200000
'#define WNNC_NET_PROTSTOR 0x00210000
'#define WNNC_NET_FJ_REDIR 0x00220000
'#define WNNC_NET_DISTINCT 0x00230000
'#define WNNC_NET_TWINS 0x00240000
'#define WNNC_NET_RDR2SAMPLE 0x00250000
'#define WNNC_NET_CSC 0x00260000
'#define WNNC_NET_3IN1 0x00270000
'#define WNNC_NET_EXTENDNET 0x00290000
'#define WNNC_NET_STAC 0x002A0000
'#define WNNC_NET_FOXBAT 0x002B0000
'#define WNNC_NET_YAHOO 0x002C0000
'#define WNNC_NET_EXIFS 0x002D0000
'#define WNNC_NET_DAV 0x002E0000
'#define WNNC_NET_KNOWARE 0x002F0000
'#define WNNC_NET_OBJECT_DIRE 0x00300000
'#define WNNC_NET_MASFAX 0x00310000
'#define WNNC_NET_HOB_NFS 0x00320000
'#define WNNC_NET_SHIVA 0x00330000
'#define WNNC_NET_IBMAL 0x00340000
'#define WNNC_NET_LOCK 0x00350000
'#define WNNC_NET_TERMSRV 0x00360000
'#define WNNC_NET_SRT 0x00370000
'#define WNNC_NET_QUINCY 0x00380000
'#define WNNC_NET_OPENAFS 0x00390000
'#define WNNC_NET_AVID1 0X003A0000
'#define WNNC_NET_DFS 0x003B0000
'#define WNNC_NET_KWNP 0x003C0000
'#define WNNC_NET_ZENWORKS 0x003D0000
'#define WNNC_NET_DRIVEONWEB 0x003E0000
'#define WNNC_NET_VMWARE 0x003F0000
'#define WNNC_NET_RSFX 0x00400000
'#define WNNC_NET_MFILES 0x00410000
'#define WNNC_NET_MS_NFS 0x00420000
'#define WNNC_NET_GOOGLE 0x00430000
'#define WNNC_CRED_MANAGER 0xFFFF0000
'//
'// Network type aliases
'//
'#define WNNC_NET_LANMAN WNNC_NET_SMB
'#endif // _WNNC_
%EQUATE `VOLSNAPCONTROLTYPE = &H00000053 ' // 'S'
'#define IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES CTL_CODE(VOLSNAPCONTROLTYPE, 0, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
%EQUATE `IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES = &H0053C000
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwQueryObject LIB "ntdll.dll" ALIAS "ZwQueryObject" ( BYVAL Handle AS QUAD , BYVAL ObjectInformationClass AS LONG , BYREF ObjectInformation AS ANY , BYVAL ObjectInformationLength AS QUAD , BYREF ReturnLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
'NTSYSAPI
'NTSTATUS
'NTAPI
'ZwNotifyChangeKey(
' );
'#endif
' From ntdef.h
' enum EVENT_TYPE
%EQUATE `NotificationEvent = 0
%EQUATE `SynchronizationEvent = 1
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwCreateEvent LIB "ntdll.dll" ALIAS "ZwCreateEvent" ( BYREF EventHandle AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYREF ObjectAttributes AS OBJECT_ATTRIBUTES , BYVAL EventType AS LONG , BYVAL InitialState AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwDeleteFile LIB "ntdll.dll" ALIAS "ZwDeleteFile" ( BYREF ObjectAttributes AS OBJECT_ATTRIBUTES ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwDeviceIoControlFile LIB "ntdll.dll" ALIAS "ZwDeviceIoControlFile" ( BYVAL FileHandle AS QUAD , BYVAL Event AS QUAD , BYREF ApcRoutine AS QUAD , BYVAL ApcContext AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYVAL IoControlCode AS QUAD , BYVAL InputBuffer AS QUAD , BYVAL InputBufferLength AS QUAD , BYREF OutputBuffer AS ANY , BYVAL OutputBufferLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwQueryDirectoryFile LIB "ntdll.dll" ALIAS "ZwQueryDirectoryFile" ( BYVAL FileHandle AS QUAD , BYVAL Event AS QUAD , BYVAL ApcRoutine AS QUAD , BYVAL ApcContext AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF FileInformation AS ANY , BYVAL Length AS QUAD , BYVAL FileInformationClass AS LONG , BYVAL ReturnSingleEntry AS BYTE , BYREF FileName AS UNICODE_STRING , BYVAL RestartScan AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwQueryVolumeInformationFile LIB "ntdll.dll" ALIAS "ZwQueryVolumeInformationFile" ( BYVAL FileHandle AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF FsInformation AS ANY , BYVAL Length AS QUAD , BYVAL FsInformationClass AS LONG ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwSetVolumeInformationFile LIB "ntdll.dll" ALIAS "ZwSetVolumeInformationFile" ( BYVAL FileHandle AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF FsInformation AS ANY , BYVAL Length AS QUAD , BYVAL FsInformationClass AS LONG ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwFsControlFile LIB "ntdll.dll" ALIAS "ZwFsControlFile" ( BYVAL FileHandle AS QUAD , BYVAL Event AS QUAD , BYREF ApcRoutine AS QUAD , BYVAL ApcContext AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYVAL FsControlCode AS QUAD , BYVAL InputBuffer AS QUAD , BYVAL InputBufferLength AS QUAD , BYREF OutputBuffer AS ANY , BYVAL OutputBufferLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwDuplicateObject LIB "ntdll.dll" ALIAS "ZwDuplicateObject" ( BYVAL SourceProcessHandle AS QUAD , BYVAL SourceHandle AS QUAD , BYVAL TargetProcessHandle AS QUAD , BYREF TargetHandle AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYVAL HandleAttributes AS QUAD , BYVAL Options AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwOpenDirectoryObject LIB "ntdll.dll" ALIAS "ZwOpenDirectoryObject" ( BYREF DirectoryHandle AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYREF ObjectAttributes AS OBJECT_ATTRIBUTES ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwAllocateVirtualMemory LIB "ntdll.dll" ALIAS "ZwAllocateVirtualMemory" ( BYVAL ProcessHandle AS QUAD , BYREF BaseAddress AS ANY , BYVAL ZeroBits AS QUAD , BYREF RegionSize AS QUAD , BYVAL AllocationType AS QUAD , BYVAL Protect AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwFreeVirtualMemory LIB "ntdll.dll" ALIAS "ZwFreeVirtualMemory" ( BYVAL ProcessHandle AS QUAD , BYREF BaseAddress AS ANY , BYREF RegionSize AS QUAD , BYVAL FreeType AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwWaitForSingleObject LIB "ntdll.dll" ALIAS "ZwWaitForSingleObject" ( BYVAL Handle AS QUAD , BYVAL Alertable AS BYTE , OPTIONAL BYVAL Timeout AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwSetEvent LIB "ntdll.dll" ALIAS "ZwSetEvent" ( BYVAL EventHandle AS QUAD , OPTIONAL BYREF PreviousState AS LONG ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwFlushVirtualMemory LIB "ntdll.dll" ALIAS "ZwFlushVirtualMemory" ( BYVAL ProcessHandle AS QUAD , BYREF BaseAddress AS ANY , BYREF RegionSize AS QUAD , BYREF IoStatus AS IO_STATUS_BLOCK ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION ZwOpenProcessTokenEx LIB "ntdll.dll" ALIAS "ZwOpenProcessTokenEx" ( BYVAL ProcessHandle AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYVAL HandleAttributes AS QUAD , BYREF TokenHandle AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WINXP)
DECLARE FUNCTION ZwOpenThreadTokenEx LIB "ntdll.dll" ALIAS "ZwOpenThreadTokenEx" ( BYVAL ThreadHandle AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYVAL OpenAsSelf AS BYTE , BYVAL HandleAttributes AS QUAD , BYREF TokenHandle AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwQueryInformationToken LIB "ntdll.dll" ALIAS "ZwQueryInformationToken" ( BYVAL TokenHandle AS QUAD , BYVAL TokenInformationClass AS LONG , BYREF TokenInformation AS ANY , BYVAL TokenInformationLength AS QUAD , BYREF ReturnLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN7)
DECLARE FUNCTION ZwSetInformationToken LIB "ntdll.dll" ALIAS "ZwSetInformationToken" ( BYVAL TokenHandle AS QUAD , BYVAL TokenInformationClass AS LONG , BYREF TokenInformation AS ANY , BYVAL TokenInformationLength AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwSetSecurityObject LIB "ntdll.dll" ALIAS "ZwSetSecurityObject" ( BYVAL Handle AS QUAD , BYVAL SecurityInformation AS SECURITY_INFORMATION , BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_WIN2K)
DECLARE FUNCTION ZwQuerySecurityObject LIB "ntdll.dll" ALIAS "ZwQuerySecurityObject" ( BYVAL Handle AS QUAD , BYVAL SecurityInformation AS SECURITY_INFORMATION , BYREF SecurityDescriptor AS SECURITY_DESCRIPTOR , BYVAL Length AS QUAD , BYREF LengthNeeded AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
DECLARE FUNCTION ZwLockFile LIB "ntdll.dll" ALIAS "ZwLockFile" ( BYVAL FileHandle AS QUAD , BYVAL Event AS QUAD , BYREF ApcRoutine AS QUAD , BYVAL ApcContext AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYVAL ByteOffset AS QUAD , BYVAL Length AS QUAD , BYVAL Key AS QUAD , BYVAL FailImmediately AS BYTE , BYVAL ExclusiveLock AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
DECLARE FUNCTION ZwUnlockFile LIB "ntdll.dll" ALIAS "ZwUnlockFile" ( BYVAL FileHandle AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYVAL ByteOffset AS QUAD , BYVAL Length AS QUAD , BYVAL Key AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
DECLARE FUNCTION ZwQueryQuotaInformationFile LIB "ntdll.dll" ALIAS "ZwQueryQuotaInformationFile" ( BYVAL FileHandle AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF Buffer AS ANY , BYVAL Length AS QUAD , BYVAL ReturnSingleEntry AS BYTE , BYVAL SidList AS QUAD , BYVAL SidListLength AS QUAD , BYVAL StartSid AS SID PTR , BYVAL RestartScan AS BYTE ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
DECLARE FUNCTION ZwSetQuotaInformationFile LIB "ntdll.dll" ALIAS "ZwSetQuotaInformationFile" ( BYVAL FileHandle AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF Buffer AS ANY , BYVAL Length AS QUAD ) AS LONG ' NTSTATUS
'#endif
'#if (NTDDI_VERSION >= NTDDI_VISTA)
DECLARE FUNCTION ZwFlushBuffersFile LIB "ntdll.dll" ALIAS "ZwFlushBuffersFile" ( BYVAL FileHandle AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK ) AS LONG ' NTSTATUS
'#endif
DECLARE FUNCTION ZwQueryEaFile LIB "ntdll.dll" ALIAS "ZwQueryEaFile" ( BYVAL FileHandle AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF Buffer AS ANY , BYVAL Length AS QUAD , BYVAL ReturnSingleEntry AS BYTE , BYREF EaList AS ANY , BYVAL EaListLength AS QUAD , BYVAL EaIndex AS QUAD , BYVAL RestartScan AS BYTE ) AS LONG ' NTSTATUS
DECLARE FUNCTION ZwSetEaFile LIB "ntdll.dll" ALIAS "ZwSetEaFile" ( BYVAL FileHandle AS QUAD , BYREF IoStatusBlock AS IO_STATUS_BLOCK , BYREF Buffer AS ANY , BYVAL Length AS QUAD ) AS LONG ' NTSTATUS
DECLARE FUNCTION ZwDuplicateToken LIB "ntdll.dll" ALIAS "ZwDuplicateToken" ( BYVAL ExistingTokenHandle AS QUAD , BYVAL DesiredAccess AS ACCESS_MASK , BYREF ObjectAttributes AS OBJECT_ATTRIBUTES , BYVAL EffectiveOnly AS BYTE , BYVAL TokenType AS LONG , BYREF NewTokenHandle AS QUAD ) AS LONG ' NTSTATUS
'#ifdef __cplusplus
'}
'#endif
'#if _MSC_VER >= 1200
'#pragma warning(pop)
'#else
'#pragma warning(default:4115)
'#pragma warning(default:4201)
'#pragma warning(default:4214)
'#endif
#ENDIF
