summaryrefslogtreecommitdiffstats
path: root/third_party/rust/ntapi
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
commit36d22d82aa202bb199967e9512281e9a53db42c9 (patch)
tree105e8c98ddea1c1e4784a60a5a6410fa416be2de /third_party/rust/ntapi
parentInitial commit. (diff)
downloadfirefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz
firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip
Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'third_party/rust/ntapi')
-rw-r--r--third_party/rust/ntapi/.cargo-checksum.json1
-rw-r--r--third_party/rust/ntapi/Cargo.toml69
-rw-r--r--third_party/rust/ntapi/LICENSE-APACHE202
-rw-r--r--third_party/rust/ntapi/LICENSE-MIT17
-rw-r--r--third_party/rust/ntapi/README.md17
-rw-r--r--third_party/rust/ntapi/build.rs15
-rw-r--r--third_party/rust/ntapi/src/lib.rs51
-rw-r--r--third_party/rust/ntapi/src/macros.rs112
-rw-r--r--third_party/rust/ntapi/src/ntapi_base.rs40
-rw-r--r--third_party/rust/ntapi/src/ntdbg.rs239
-rw-r--r--third_party/rust/ntapi/src/ntexapi.rs3000
-rw-r--r--third_party/rust/ntapi/src/ntgdi.rs123
-rw-r--r--third_party/rust/ntapi/src/ntioapi.rs1464
-rw-r--r--third_party/rust/ntapi/src/ntkeapi.rs121
-rw-r--r--third_party/rust/ntapi/src/ntldr.rs661
-rw-r--r--third_party/rust/ntapi/src/ntlpcapi.rs692
-rw-r--r--third_party/rust/ntapi/src/ntmisc.rs42
-rw-r--r--third_party/rust/ntapi/src/ntmmapi.rs630
-rw-r--r--third_party/rust/ntapi/src/ntnls.rs29
-rw-r--r--third_party/rust/ntapi/src/ntobapi.rs226
-rw-r--r--third_party/rust/ntapi/src/ntpebteb.rs431
-rw-r--r--third_party/rust/ntapi/src/ntpfapi.rs219
-rw-r--r--third_party/rust/ntapi/src/ntpnpapi.rs118
-rw-r--r--third_party/rust/ntapi/src/ntpoapi.rs134
-rw-r--r--third_party/rust/ntapi/src/ntpsapi.rs1479
-rw-r--r--third_party/rust/ntapi/src/ntregapi.rs450
-rw-r--r--third_party/rust/ntapi/src/ntrtl.rs4373
-rw-r--r--third_party/rust/ntapi/src/ntsam.rs1077
-rw-r--r--third_party/rust/ntapi/src/ntseapi.rs439
-rw-r--r--third_party/rust/ntapi/src/ntsmss.rs15
-rw-r--r--third_party/rust/ntapi/src/nttmapi.rs239
-rw-r--r--third_party/rust/ntapi/src/nttp.rs207
-rw-r--r--third_party/rust/ntapi/src/ntwow64.rs476
-rw-r--r--third_party/rust/ntapi/src/ntxcapi.rs29
-rw-r--r--third_party/rust/ntapi/src/ntzwapi.rs2699
-rw-r--r--third_party/rust/ntapi/src/string.rs58
-rw-r--r--third_party/rust/ntapi/src/subprocesstag.rs77
-rw-r--r--third_party/rust/ntapi/src/winapi_local.rs1
-rw-r--r--third_party/rust/ntapi/src/winapi_local/um.rs2
-rw-r--r--third_party/rust/ntapi/src/winapi_local/um/winioctl.rs4
-rw-r--r--third_party/rust/ntapi/src/winapi_local/um/winnt.rs71
-rw-r--r--third_party/rust/ntapi/src/winsta.rs848
42 files changed, 21197 insertions, 0 deletions
diff --git a/third_party/rust/ntapi/.cargo-checksum.json b/third_party/rust/ntapi/.cargo-checksum.json
new file mode 100644
index 0000000000..7d42314b24
--- /dev/null
+++ b/third_party/rust/ntapi/.cargo-checksum.json
@@ -0,0 +1 @@
+{"files":{"Cargo.toml":"c590838810b459f0055af8724e1ac392570a0dcf223bf403b87f728a14c6a500","LICENSE-APACHE":"cf90d659de5c1e6418267ab8043b756e65508ee5d8d50b29eb2d2fe444c2c3eb","LICENSE-MIT":"11a7964ccc0dd115d16720ab1d826c5d03e52838748ffaba3d21bae8bcacd82a","README.md":"748712a61ff52ec28ed1695b01975a379125f9c3e8a4ad5b2e9b64096c2a3df1","build.rs":"13a274ea4cb1886872626b8a98269e9bf2e1f93cb1068fc8c797e421746cac7e","src/lib.rs":"261643e01f42e3b04cc0760811da090348923d40761c863eebb4735af6294207","src/macros.rs":"b0a852ebea2e1aed3e7d70eeadc8356778b064d2eca6e796598e9ab37ac54175","src/ntapi_base.rs":"b2edefaf68709c32f7fb4377ea21457afd3c7546ba59596f9f25bbaeb220f4d4","src/ntdbg.rs":"f891d4b26ef9d6c68ca098ab70bb4b1dd4d7e1d05e0f65c32bc6cb1151528f91","src/ntexapi.rs":"9be1b1d061055b6f5276093db8346ecf148d0ad6e438d185a16b126acb514c22","src/ntgdi.rs":"9fa6610566d77e95294432957f8cb8564cef3bb09d2d8d0adcf23047fa3a5221","src/ntioapi.rs":"577f3c3d83a95a965fff62efbdaa01769e9b3cf713f0d296a948f34cdfddcedc","src/ntkeapi.rs":"1ede6613c94303e6087e30e64ee1f1623eada9d088ce50992904e1812b263923","src/ntldr.rs":"e70ac420828f47d35dade883efee4231b6455d53ff4d317ecf6d809d7bc5a2bc","src/ntlpcapi.rs":"da5070b1c1adad34091aedd01d2b888daa4dc9446fdcd69668565e6eeb2db11f","src/ntmisc.rs":"4904e383065828b86013ebd3b85d45b384b522899954ac89c561963061acc962","src/ntmmapi.rs":"3a371e9edb7df91d1242f9dae92bf6d295c9b6c3ca65846c8d1ebbba55bdf7ee","src/ntnls.rs":"ef90b985da124d2f4c4b8cb0addab766a0928843b4afa4bce40b3a9fcddaf163","src/ntobapi.rs":"3071d8bc73e40d92d769e4093744820c0a5e116ecf4a94676ca3cdc008adfd8e","src/ntpebteb.rs":"94a9fbc1b3c48fa368f1b602fa205d41d3201e4d8c638c0898402eb3ebb5b72a","src/ntpfapi.rs":"37270db61f2562cd5481302c2a5a64be186b8c7126eacfe12b6c66e9bec4bf61","src/ntpnpapi.rs":"cfcaa3dd6110f25a48c51c011bb8369e83e3817e142afb412e40d6e4b868a036","src/ntpoapi.rs":"a535206a89cd42f81e3b931e5802f8b3343fd35387e9f3fedd9b042a78853f34","src/ntpsapi.rs":"2ed2af3e90054aaf260952adcc4e46d6935db1efd57f843124f942388ecfc6ce","src/ntregapi.rs":"a6f5a830b48e88fd0a4824036fffda2d2d80d1cad07baf37607121142f2c4777","src/ntrtl.rs":"d970ae6cba47f346eef103d6bcac7260bb7fc70ebb7ec226b09acb6c5bc1f6c6","src/ntsam.rs":"dc59cfa944c27cf02b782fdbf110de4757ca6ae77806820a64a17742670242b4","src/ntseapi.rs":"c87688e028aa05513e361bb72288ef3af2f3dfe8e923745a84409d8fdeee57fd","src/ntsmss.rs":"6ac1f029b56a2a8856569c3acbedd7c560d2ccfac030aa2f2178f52d9312cdc5","src/nttmapi.rs":"7092c8b35aae642572c333b0fef1fe4a32f5a9c563249b585766317051670db5","src/nttp.rs":"47be534d36af7d6a715c87ef646824162bd3eb47f86a85ed8357c987c1a4fcdd","src/ntwow64.rs":"725baf7b32d24c0800abf730b58335e682332b821636ca699c40e80ba7148f94","src/ntxcapi.rs":"54fcadd43a0e146ade8ebdd750b09872d0e8f7a1295a9646910529048d5f6dca","src/ntzwapi.rs":"012932586fdbcac8eff57d90ce640e10d20e150dc7702100d1ea46f6f261f868","src/string.rs":"ac0e73f37384e03f14d9dc47fcfb3620a4157e122481f30c82b16fb21ab86a40","src/subprocesstag.rs":"4c85e44c91521cb20e5c6624b0cf4b27ca6ac7c3e560854ad34e0e66fb809971","src/winapi_local.rs":"2003099deec5e7039e5d2dd0aa6a43120816f67e94f4d9909c7f6689b62747e4","src/winapi_local/um.rs":"48859dfb53520bdd569c052ac26d06de2d16c57403ffbe4febbc1e1f25847f45","src/winapi_local/um/winioctl.rs":"00020fcda499ce558edfa4d684f5b4e198cbcfa5b3b8e9b62a122c0aca46514f","src/winapi_local/um/winnt.rs":"2640f7d4027632d45708fc085baaf90f55f792e9b9802625f2b7d4e7655f9da4","src/winsta.rs":"c5a28c5c55f08745b2b100a5a374af821cf173b053eb8ee54ae19a85455d3fac"},"package":"bc51db7b362b205941f71232e56c625156eb9a929f8cf74a428fd5bc094a4afc"} \ No newline at end of file
diff --git a/third_party/rust/ntapi/Cargo.toml b/third_party/rust/ntapi/Cargo.toml
new file mode 100644
index 0000000000..9106023086
--- /dev/null
+++ b/third_party/rust/ntapi/Cargo.toml
@@ -0,0 +1,69 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2018"
+name = "ntapi"
+version = "0.4.0"
+authors = ["MSxDOS <melcodos@gmail.com>"]
+include = [
+ "src/**/*",
+ "Cargo.toml",
+ "build.rs",
+ "README.md",
+ "LICENSE-APACHE",
+ "LICENSE-MIT",
+]
+description = "FFI bindings for Native API"
+documentation = "https://docs.rs/ntapi/*/x86_64-pc-windows-msvc/ntapi/"
+readme = "README.md"
+keywords = [
+ "windows",
+ "ffi",
+ "ntapi",
+ "native",
+ "win32",
+]
+categories = [
+ "external-ffi-bindings",
+ "no-std",
+ "os::windows-apis",
+]
+license = "Apache-2.0 OR MIT"
+repository = "https://github.com/MSxDOS/ntapi"
+
+[package.metadata.docs.rs]
+default-target = "x86_64-pc-windows-msvc"
+targets = [
+ "aarch64-pc-windows-msvc",
+ "i686-pc-windows-msvc",
+ "x86_64-pc-windows-msvc",
+]
+
+[dependencies.winapi]
+version = "0.3.9"
+features = [
+ "cfg",
+ "evntrace",
+ "in6addr",
+ "inaddr",
+ "minwinbase",
+ "ntsecapi",
+ "windef",
+ "winioctl",
+]
+
+[features]
+default = ["user"]
+func-types = []
+impl-default = ["winapi/impl-default"]
+kernel = []
+user = []
diff --git a/third_party/rust/ntapi/LICENSE-APACHE b/third_party/rust/ntapi/LICENSE-APACHE
new file mode 100644
index 0000000000..e72929ee99
--- /dev/null
+++ b/third_party/rust/ntapi/LICENSE-APACHE
@@ -0,0 +1,202 @@
+ Apache License
+ Version 2.0, January 2004
+ http://www.apache.org/licenses/
+
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+ 1. Definitions.
+
+ "License" shall mean the terms and conditions for use, reproduction,
+ and distribution as defined by Sections 1 through 9 of this document.
+
+ "Licensor" shall mean the copyright owner or entity authorized by
+ the copyright owner that is granting the License.
+
+ "Legal Entity" shall mean the union of the acting entity and all
+ other entities that control, are controlled by, or are under common
+ control with that entity. For the purposes of this definition,
+ "control" means (i) the power, direct or indirect, to cause the
+ direction or management of such entity, whether by contract or
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
+ outstanding shares, or (iii) beneficial ownership of such entity.
+
+ "You" (or "Your") shall mean an individual or Legal Entity
+ exercising permissions granted by this License.
+
+ "Source" form shall mean the preferred form for making modifications,
+ including but not limited to software source code, documentation
+ source, and configuration files.
+
+ "Object" form shall mean any form resulting from mechanical
+ transformation or translation of a Source form, including but
+ not limited to compiled object code, generated documentation,
+ and conversions to other media types.
+
+ "Work" shall mean the work of authorship, whether in Source or
+ Object form, made available under the License, as indicated by a
+ copyright notice that is included in or attached to the work
+ (an example is provided in the Appendix below).
+
+ "Derivative Works" shall mean any work, whether in Source or Object
+ form, that is based on (or derived from) the Work and for which the
+ editorial revisions, annotations, elaborations, or other modifications
+ represent, as a whole, an original work of authorship. For the purposes
+ of this License, Derivative Works shall not include works that remain
+ separable from, or merely link (or bind by name) to the interfaces of,
+ the Work and Derivative Works thereof.
+
+ "Contribution" shall mean any work of authorship, including
+ the original version of the Work and any modifications or additions
+ to that Work or Derivative Works thereof, that is intentionally
+ submitted to Licensor for inclusion in the Work by the copyright owner
+ or by an individual or Legal Entity authorized to submit on behalf of
+ the copyright owner. For the purposes of this definition, "submitted"
+ means any form of electronic, verbal, or written communication sent
+ to the Licensor or its representatives, including but not limited to
+ communication on electronic mailing lists, source code control systems,
+ and issue tracking systems that are managed by, or on behalf of, the
+ Licensor for the purpose of discussing and improving the Work, but
+ excluding communication that is conspicuously marked or otherwise
+ designated in writing by the copyright owner as "Not a Contribution."
+
+ "Contributor" shall mean Licensor and any individual or Legal Entity
+ on behalf of whom a Contribution has been received by Licensor and
+ subsequently incorporated within the Work.
+
+ 2. Grant of Copyright License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ copyright license to reproduce, prepare Derivative Works of,
+ publicly display, publicly perform, sublicense, and distribute the
+ Work and such Derivative Works in Source or Object form.
+
+ 3. Grant of Patent License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ (except as stated in this section) patent license to make, have made,
+ use, offer to sell, sell, import, and otherwise transfer the Work,
+ where such license applies only to those patent claims licensable
+ by such Contributor that are necessarily infringed by their
+ Contribution(s) alone or by combination of their Contribution(s)
+ with the Work to which such Contribution(s) was submitted. If You
+ institute patent litigation against any entity (including a
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
+ or a Contribution incorporated within the Work constitutes direct
+ or contributory patent infringement, then any patent licenses
+ granted to You under this License for that Work shall terminate
+ as of the date such litigation is filed.
+
+ 4. Redistribution. You may reproduce and distribute copies of the
+ Work or Derivative Works thereof in any medium, with or without
+ modifications, and in Source or Object form, provided that You
+ meet the following conditions:
+
+ (a) You must give any other recipients of the Work or
+ Derivative Works a copy of this License; and
+
+ (b) You must cause any modified files to carry prominent notices
+ stating that You changed the files; and
+
+ (c) You must retain, in the Source form of any Derivative Works
+ that You distribute, all copyright, patent, trademark, and
+ attribution notices from the Source form of the Work,
+ excluding those notices that do not pertain to any part of
+ the Derivative Works; and
+
+ (d) If the Work includes a "NOTICE" text file as part of its
+ distribution, then any Derivative Works that You distribute must
+ include a readable copy of the attribution notices contained
+ within such NOTICE file, excluding those notices that do not
+ pertain to any part of the Derivative Works, in at least one
+ of the following places: within a NOTICE text file distributed
+ as part of the Derivative Works; within the Source form or
+ documentation, if provided along with the Derivative Works; or,
+ within a display generated by the Derivative Works, if and
+ wherever such third-party notices normally appear. The contents
+ of the NOTICE file are for informational purposes only and
+ do not modify the License. You may add Your own attribution
+ notices within Derivative Works that You distribute, alongside
+ or as an addendum to the NOTICE text from the Work, provided
+ that such additional attribution notices cannot be construed
+ as modifying the License.
+
+ You may add Your own copyright statement to Your modifications and
+ may provide additional or different license terms and conditions
+ for use, reproduction, or distribution of Your modifications, or
+ for any such Derivative Works as a whole, provided Your use,
+ reproduction, and distribution of the Work otherwise complies with
+ the conditions stated in this License.
+
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
+ any Contribution intentionally submitted for inclusion in the Work
+ by You to the Licensor shall be under the terms and conditions of
+ this License, without any additional terms or conditions.
+ Notwithstanding the above, nothing herein shall supersede or modify
+ the terms of any separate license agreement you may have executed
+ with Licensor regarding such Contributions.
+
+ 6. Trademarks. This License does not grant permission to use the trade
+ names, trademarks, service marks, or product names of the Licensor,
+ except as required for reasonable and customary use in describing the
+ origin of the Work and reproducing the content of the NOTICE file.
+
+ 7. Disclaimer of Warranty. Unless required by applicable law or
+ agreed to in writing, Licensor provides the Work (and each
+ Contributor provides its Contributions) on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ implied, including, without limitation, any warranties or conditions
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+ PARTICULAR PURPOSE. You are solely responsible for determining the
+ appropriateness of using or redistributing the Work and assume any
+ risks associated with Your exercise of permissions under this License.
+
+ 8. Limitation of Liability. In no event and under no legal theory,
+ whether in tort (including negligence), contract, or otherwise,
+ unless required by applicable law (such as deliberate and grossly
+ negligent acts) or agreed to in writing, shall any Contributor be
+ liable to You for damages, including any direct, indirect, special,
+ incidental, or consequential damages of any character arising as a
+ result of this License or out of the use or inability to use the
+ Work (including but not limited to damages for loss of goodwill,
+ work stoppage, computer failure or malfunction, or any and all
+ other commercial damages or losses), even if such Contributor
+ has been advised of the possibility of such damages.
+
+ 9. Accepting Warranty or Additional Liability. While redistributing
+ the Work or Derivative Works thereof, You may choose to offer,
+ and charge a fee for, acceptance of support, warranty, indemnity,
+ or other liability obligations and/or rights consistent with this
+ License. However, in accepting such obligations, You may act only
+ on Your own behalf and on Your sole responsibility, not on behalf
+ of any other Contributor, and only if You agree to indemnify,
+ defend, and hold each Contributor harmless for any liability
+ incurred by, or claims asserted against, such Contributor by reason
+ of your accepting any such warranty or additional liability.
+
+ END OF TERMS AND CONDITIONS
+
+ APPENDIX: How to apply the Apache License to your work.
+
+ To apply the Apache License to your work, attach the following
+ boilerplate notice, with the fields enclosed by brackets "[]"
+ replaced with your own identifying information. (Don't include
+ the brackets!) The text should be enclosed in the appropriate
+ comment syntax for the file format. We also recommend that a
+ file or class name and description of purpose be included on the
+ same "printed page" as the copyright notice for easier
+ identification within third-party archives.
+
+ Copyright [yyyy] [name of copyright owner]
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ \ No newline at end of file
diff --git a/third_party/rust/ntapi/LICENSE-MIT b/third_party/rust/ntapi/LICENSE-MIT
new file mode 100644
index 0000000000..0235c6ac8f
--- /dev/null
+++ b/third_party/rust/ntapi/LICENSE-MIT
@@ -0,0 +1,17 @@
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"),to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/third_party/rust/ntapi/README.md b/third_party/rust/ntapi/README.md
new file mode 100644
index 0000000000..5011accad5
--- /dev/null
+++ b/third_party/rust/ntapi/README.md
@@ -0,0 +1,17 @@
+# ntapi [![AppVeyor][appveyor_badge]][appveyor_link] [![Crates.io][crates_badge]][crates_link] [![Documentation][docs_badge]][docs_link] [![Lines of Code][loc_badge]][loc_link] [![Unsafe][unsafe_badge]][unsafe_link]
+
+Rust FFI bindings for Native API. Mostly based on Process Hacker [phnt](https://github.com/processhacker/processhacker/tree/master/phnt) headers as the most complete source of bindings to be found. The comments there also contain useful information on how to use specific things.
+
+### Minimum supported Rust
+1.64
+
+[appveyor_link]: https://ci.appveyor.com/project/MSxDOS/ntapi
+[appveyor_badge]: https://ci.appveyor.com/api/projects/status/i1fcmm0c5b7c6b6u/branch/master?svg=true
+[crates_link]: https://crates.io/crates/ntapi
+[crates_badge]: https://img.shields.io/crates/v/ntapi.svg
+[docs_link]: https://docs.rs/ntapi/*/x86_64-pc-windows-msvc/ntapi/
+[docs_badge]: https://docs.rs/ntapi/badge.svg
+[loc_link]: https://github.com/Aaronepower/tokei
+[loc_badge]: https://tokei.rs/b1/github/MSxDOS/ntapi
+[unsafe_link]: https://doc.rust-lang.org/book/ch19-01-unsafe-rust.html
+[unsafe_badge]: https://img.shields.io/badge/unsafe-%E2%9C%94-C901DD.svg
diff --git a/third_party/rust/ntapi/build.rs b/third_party/rust/ntapi/build.rs
new file mode 100644
index 0000000000..bbd46f5950
--- /dev/null
+++ b/third_party/rust/ntapi/build.rs
@@ -0,0 +1,15 @@
+use std::env::var;
+
+fn main() {
+ #[cfg(feature = "user")] {
+ if var("TARGET").map(
+ |t| t == "x86_64-pc-windows-gnu" || t == "i686-pc-windows-gnu"
+ ).unwrap_or(false) {
+ if var("WINAPI_NO_BUNDLED_LIBRARIES").is_ok() {
+ println!("cargo:rustc-link-lib=ntdll");
+ } else {
+ println!("cargo:rustc-link-lib=winapi_ntdll");
+ }
+ }
+ }
+}
diff --git a/third_party/rust/ntapi/src/lib.rs b/third_party/rust/ntapi/src/lib.rs
new file mode 100644
index 0000000000..0f7708cbe8
--- /dev/null
+++ b/third_party/rust/ntapi/src/lib.rs
@@ -0,0 +1,51 @@
+//! # Features
+//! **`func-types`** -- Generate [types][fn_ptr] for external functions.<br/>
+//! **`impl-default`** -- Implement [`Default`] for structs and unions.<br/>
+//! **`user`** *(default)* -- Link to `ntdll`.<br/>
+//! **`kernel`** -- Link to `ntoskrnl` on MSVC targets.<br/>
+//!
+//! [fn_ptr]: https://doc.rust-lang.org/reference/types.html#function-pointer-types
+//! [`Default`]: https://doc.rust-lang.org/std/default/trait.Default.html#tymethod.default
+#![cfg(all(windows, any(target_arch = "x86", target_arch = "x86_64", target_arch = "aarch64")))]
+#![no_std]
+#![deny(unused, unused_qualifications)]
+#![warn(unused_attributes)]
+#![allow(bad_style, deprecated, overflowing_literals, unused_macros, clippy::cast_lossless, clippy::cast_ptr_alignment, clippy::len_without_is_empty, clippy::trivially_copy_pass_by_ref, clippy::unreadable_literal)]
+#[doc(hidden)]
+pub extern crate core as _core;
+#[macro_use]
+#[doc(hidden)]
+pub extern crate winapi;
+#[macro_use]
+mod macros;
+pub mod ntapi_base;
+pub mod ntdbg;
+pub mod ntexapi;
+pub mod ntgdi;
+pub mod ntioapi;
+pub mod ntkeapi;
+pub mod ntldr;
+pub mod ntlpcapi;
+pub mod ntmisc;
+pub mod ntmmapi;
+pub mod ntnls;
+pub mod ntobapi;
+pub mod ntpebteb;
+pub mod ntpfapi;
+pub mod ntpnpapi;
+pub mod ntpoapi;
+pub mod ntpsapi;
+pub mod ntregapi;
+pub mod ntrtl;
+pub mod ntsam;
+pub mod ntseapi;
+pub mod ntsmss;
+pub mod nttmapi;
+pub mod nttp;
+pub mod ntwow64;
+pub mod ntxcapi;
+pub mod ntzwapi;
+pub mod string;
+pub mod subprocesstag;
+pub mod winapi_local;
+pub mod winsta;
diff --git a/third_party/rust/ntapi/src/macros.rs b/third_party/rust/ntapi/src/macros.rs
new file mode 100644
index 0000000000..92cdd96784
--- /dev/null
+++ b/third_party/rust/ntapi/src/macros.rs
@@ -0,0 +1,112 @@
+#[macro_export]
+macro_rules! EXTERN {
+ (extern $c:tt {$(
+ fn $n:ident ($( $p:tt $(: $t:ty)?),* $(,)?) $(-> $r:ty)?;
+ )+}) => {
+ #[cfg_attr(all(target_env = "msvc", feature = "user"), link(name = "ntdll"))]
+ #[cfg_attr(all(target_env = "msvc", feature = "kernel"), link(name = "ntoskrnl"))]
+ extern $c {$(
+ pub fn $n(
+ $($p $(: $t)?),*
+ ) $(-> $r)?;
+ )+}
+ $(
+ #[cfg(feature = "func-types")]
+ pub type $n = unsafe extern $c fn($($p $(: $t)?),*) $(-> $r)?;
+ )+
+ };
+ (extern $c:tt {$(
+ static mut $n:ident : $t:ty;
+ )+}) => {
+ #[cfg_attr(all(target_env = "msvc", feature = "user"), link(name = "ntdll"))]
+ extern $c {$(
+ pub static mut $n: $t;
+ )+}
+ };
+}
+#[macro_export]
+#[doc(hidden)]
+macro_rules! FIELD_OFFSET {
+ ($_type:ty, $field:ident$(.$cfields:ident)*) => {
+ unsafe {
+ union Transmuter<T: 'static> {
+ p: *const T,
+ r: &'static T,
+ i: usize,
+ }
+ #[allow(unaligned_references)]
+ Transmuter {
+ r: &(&Transmuter {
+ p: $crate::_core::ptr::null::<$_type>()
+ }.r).$field$(.$cfields)*
+ }.i
+ }
+ };
+}
+macro_rules! BITFIELD {
+ ($base:ident $field:ident: $fieldtype:ty [
+ $($thing:ident $set_thing:ident[$r:expr],)+
+ ]) => {
+ impl $base {$(
+ #[inline]
+ pub const fn $thing(&self) -> $fieldtype {
+ const SIZE: usize = $crate::_core::mem::size_of::<$fieldtype>() * 8;
+ self.$field << (SIZE - $r.end) >> (SIZE - $r.end + $r.start)
+ }
+ #[inline]
+ pub fn $set_thing(&mut self, val: $fieldtype) {
+ const MASK: $fieldtype = ((1 << ($r.end - $r.start)) - 1) << $r.start;
+ self.$field &= !MASK;
+ self.$field |= (val << $r.start) & MASK;
+ }
+ )+}
+ };
+ (unsafe $base:ident $field:ident: $fieldtype:ty [
+ $($thing:ident $set_thing:ident[$r:expr],)+
+ ]) => {
+ impl $base {$(
+ #[inline]
+ pub unsafe fn $thing(&self) -> $fieldtype {
+ const SIZE: usize = $crate::_core::mem::size_of::<$fieldtype>() * 8;
+ self.$field << (SIZE - $r.end) >> (SIZE - $r.end + $r.start)
+ }
+ #[inline]
+ pub unsafe fn $set_thing(&mut self, val: $fieldtype) {
+ const MASK: $fieldtype = ((1 << ($r.end - $r.start)) - 1) << $r.start;
+ self.$field &= !MASK;
+ self.$field |= (val << $r.start) & MASK;
+ }
+ )+}
+ };
+}
+macro_rules! UNION {
+ ($(#[$attrs:meta])* union $name:ident {
+ $($variant:ident: $ftype:ty,)+
+ }) => (
+ #[repr(C)] $(#[$attrs])*
+ pub union $name {
+ $(pub $variant: $ftype,)+
+ }
+ impl Copy for $name {}
+ impl Clone for $name {
+ #[inline]
+ fn clone(&self) -> $name { *self }
+ }
+ #[cfg(feature = "impl-default")]
+ impl Default for $name {
+ #[inline]
+ fn default() -> $name { unsafe { $crate::_core::mem::zeroed() } }
+ }
+ );
+}
+macro_rules! FN {
+ (stdcall $func:ident($($p:ident: $t:ty,)*) -> $ret:ty) => (
+ pub type $func = Option<unsafe extern "system" fn($($p: $t,)*) -> $ret>;
+ );
+ (cdecl $func:ident($($p:ident: $t:ty,)*) -> $ret:ty) => (
+ pub type $func = Option<unsafe extern "C" fn($($p: $t,)*) -> $ret>;
+ );
+}
+macro_rules! IFDEF {
+ ($($thing:item)*) => ($($thing)*)
+}
diff --git a/third_party/rust/ntapi/src/ntapi_base.rs b/third_party/rust/ntapi/src/ntapi_base.rs
new file mode 100644
index 0000000000..aa341af0b0
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntapi_base.rs
@@ -0,0 +1,40 @@
+use winapi::shared::ntdef::{HANDLE, LONG, NTSTATUS, ULONG, ULONGLONG, USHORT};
+use winapi::shared::ntstatus::FACILITY_NTWIN32;
+pub type KPRIORITY = LONG;
+pub type RTL_ATOM = USHORT;
+pub type PRTL_ATOM = *mut RTL_ATOM;
+pub const NT_FACILITY_MASK: ULONG = 0xfff;
+pub const NT_FACILITY_SHIFT: ULONG = 16;
+#[inline]
+pub const fn NT_FACILITY(Status: NTSTATUS) -> ULONG {
+ (Status as u32) >> NT_FACILITY_SHIFT & NT_FACILITY_MASK
+}
+#[inline]
+pub const fn NT_NTWIN32(Status: NTSTATUS) -> bool {
+ NT_FACILITY(Status) == FACILITY_NTWIN32 as u32
+}
+#[inline]
+pub const fn WIN32_FROM_NTSTATUS(Status: NTSTATUS) -> ULONG {
+ (Status as u32) & 0xffff
+}
+STRUCT!{struct CLIENT_ID {
+ UniqueProcess: HANDLE,
+ UniqueThread: HANDLE,
+}}
+pub type PCLIENT_ID = *mut CLIENT_ID;
+STRUCT!{struct CLIENT_ID32 {
+ UniqueProcess: ULONG,
+ UniqueThread: ULONG,
+}}
+pub type PCLIENT_ID32 = *mut CLIENT_ID32;
+STRUCT!{struct CLIENT_ID64 {
+ UniqueProcess: ULONGLONG,
+ UniqueThread: ULONGLONG,
+}}
+pub type PCLIENT_ID64 = *mut CLIENT_ID64;
+STRUCT!{struct KSYSTEM_TIME {
+ LowPart: ULONG,
+ High1Time: LONG,
+ High2Time: LONG,
+}}
+pub type PKSYSTEM_TIME = *mut KSYSTEM_TIME;
diff --git a/third_party/rust/ntapi/src/ntdbg.rs b/third_party/rust/ntapi/src/ntdbg.rs
new file mode 100644
index 0000000000..991e8f9da0
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntdbg.rs
@@ -0,0 +1,239 @@
+use crate::ntapi_base::{CLIENT_ID, PCLIENT_ID};
+use winapi::shared::evntprov::EVENT_FILTER_DESCRIPTOR;
+use winapi::shared::guiddef::LPCGUID;
+use winapi::shared::ntdef::{
+ BOOLEAN, HANDLE, NTSTATUS, PCCH, PCH, PCSTR, PHANDLE, PLARGE_INTEGER, POBJECT_ATTRIBUTES,
+ PULONG, PVOID, UCHAR, ULONG, ULONGLONG,
+};
+use winapi::um::minwinbase::LPDEBUG_EVENT;
+use winapi::um::winnt::{ACCESS_MASK, EXCEPTION_RECORD, STANDARD_RIGHTS_REQUIRED, SYNCHRONIZE};
+use winapi::vc::vadefs::va_list;
+EXTERN!{extern "system" {
+ fn DbgUserBreakPoint();
+ fn DbgBreakPoint();
+ fn DbgBreakPointWithStatus(
+ Status: ULONG,
+ );
+}}
+pub const DBG_STATUS_CONTROL_C: u32 = 1;
+pub const DBG_STATUS_SYSRQ: u32 = 2;
+pub const DBG_STATUS_BUGCHECK_FIRST: u32 = 3;
+pub const DBG_STATUS_BUGCHECK_SECOND: u32 = 4;
+pub const DBG_STATUS_FATAL: u32 = 5;
+pub const DBG_STATUS_DEBUG_CONTROL: u32 = 6;
+pub const DBG_STATUS_WORKER: u32 = 7;
+EXTERN!{extern "C" {
+ fn DbgPrint(
+ Format: PCSTR,
+ ...
+ ) -> ULONG;
+ fn DbgPrintEx(
+ ComponentId: ULONG,
+ Level: ULONG,
+ Format: PCSTR,
+ ...
+ ) -> ULONG;
+}}
+EXTERN!{extern "system" {
+ fn vDbgPrintEx(
+ ComponentId: ULONG,
+ Level: ULONG,
+ Format: PCCH,
+ arglist: va_list,
+ ) -> ULONG;
+ fn vDbgPrintExWithPrefix(
+ Prefix: PCH,
+ ComponentId: ULONG,
+ Level: ULONG,
+ Format: PCCH,
+ arglist: va_list,
+ ) -> ULONG;
+ fn DbgQueryDebugFilterState(
+ ComponentId: ULONG,
+ Level: ULONG,
+ ) -> NTSTATUS;
+ fn DbgSetDebugFilterState(
+ ComponentId: ULONG,
+ Level: ULONG,
+ State: BOOLEAN,
+ ) -> NTSTATUS;
+ fn DbgPrompt(
+ Prompt: PCCH,
+ Response: PCH,
+ Length: ULONG,
+ ) -> ULONG;
+}}
+STRUCT!{struct DBGKM_EXCEPTION {
+ ExceptionRecord: EXCEPTION_RECORD,
+ FirstChance: ULONG,
+}}
+pub type PDBGKM_EXCEPTION = *mut DBGKM_EXCEPTION;
+STRUCT!{struct DBGKM_CREATE_THREAD {
+ SubSystemKey: ULONG,
+ StartAddress: PVOID,
+}}
+pub type PDBGKM_CREATE_THREAD = *mut DBGKM_CREATE_THREAD;
+STRUCT!{struct DBGKM_CREATE_PROCESS {
+ SubSystemKey: ULONG,
+ FileHandle: HANDLE,
+ BaseOfImage: PVOID,
+ DebugInfoFileOffset: ULONG,
+ DebugInfoSize: ULONG,
+ InitialThread: DBGKM_CREATE_THREAD,
+}}
+pub type PDBGKM_CREATE_PROCESS = *mut DBGKM_CREATE_PROCESS;
+STRUCT!{struct DBGKM_EXIT_THREAD {
+ ExitStatus: NTSTATUS,
+}}
+pub type PDBGKM_EXIT_THREAD = *mut DBGKM_EXIT_THREAD;
+STRUCT!{struct DBGKM_EXIT_PROCESS {
+ ExitStatus: NTSTATUS,
+}}
+pub type PDBGKM_EXIT_PROCESS = *mut DBGKM_EXIT_PROCESS;
+STRUCT!{struct DBGKM_LOAD_DLL {
+ FileHandle: HANDLE,
+ BaseOfDll: PVOID,
+ DebugInfoFileOffset: ULONG,
+ DebugInfoSize: ULONG,
+ NamePointer: PVOID,
+}}
+pub type PDBGKM_LOAD_DLL = *mut DBGKM_LOAD_DLL;
+STRUCT!{struct DBGKM_UNLOAD_DLL {
+ BaseAddress: PVOID,
+}}
+pub type PDBGKM_UNLOAD_DLL = *mut DBGKM_UNLOAD_DLL;
+ENUM!{enum DBG_STATE {
+ DbgIdle = 0,
+ DbgReplyPending = 1,
+ DbgCreateThreadStateChange = 2,
+ DbgCreateProcessStateChange = 3,
+ DbgExitThreadStateChange = 4,
+ DbgExitProcessStateChange = 5,
+ DbgExceptionStateChange = 6,
+ DbgBreakpointStateChange = 7,
+ DbgSingleStepStateChange = 8,
+ DbgLoadDllStateChange = 9,
+ DbgUnloadDllStateChange = 10,
+}}
+pub type PDBG_STATE = *mut DBG_STATE;
+STRUCT!{struct DBGUI_CREATE_THREAD {
+ HandleToThread: HANDLE,
+ NewThread: DBGKM_CREATE_THREAD,
+}}
+pub type PDBGUI_CREATE_THREAD = *mut DBGUI_CREATE_THREAD;
+STRUCT!{struct DBGUI_CREATE_PROCESS {
+ HandleToProcess: HANDLE,
+ HandleToThread: HANDLE,
+ NewProcess: DBGKM_CREATE_PROCESS,
+}}
+UNION!{union DBGUI_WAIT_STATE_CHANGE_StateInfo {
+ Exception: DBGKM_EXCEPTION,
+ CreateThread: DBGUI_CREATE_THREAD,
+ CreateProcessInfo: DBGUI_CREATE_PROCESS,
+ ExitThread: DBGKM_EXIT_THREAD,
+ ExitProcess: DBGKM_EXIT_PROCESS,
+ LoadDll: DBGKM_LOAD_DLL,
+ UnloadDll: DBGKM_UNLOAD_DLL,
+}}
+pub type PDBGUI_CREATE_PROCESS = *mut DBGUI_CREATE_PROCESS;
+STRUCT!{struct DBGUI_WAIT_STATE_CHANGE {
+ NewState: DBG_STATE,
+ AppClientId: CLIENT_ID,
+ StateInfo: DBGUI_WAIT_STATE_CHANGE_StateInfo,
+}}
+pub type PDBGUI_WAIT_STATE_CHANGE = *mut DBGUI_WAIT_STATE_CHANGE;
+pub const DEBUG_READ_EVENT: ULONG = 0x0001;
+pub const DEBUG_PROCESS_ASSIGN: ULONG = 0x0002;
+pub const DEBUG_SET_INFORMATION: ULONG = 0x0004;
+pub const DEBUG_QUERY_INFORMATION: ULONG = 0x0008;
+pub const DEBUG_ALL_ACCESS: ACCESS_MASK = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | DEBUG_READ_EVENT
+ | DEBUG_PROCESS_ASSIGN | DEBUG_SET_INFORMATION | DEBUG_QUERY_INFORMATION;
+pub const DEBUG_KILL_ON_CLOSE: u32 = 0x1;
+ENUM!{enum DEBUGOBJECTINFOCLASS {
+ DebugObjectUnusedInformation = 0,
+ DebugObjectKillProcessOnExitInformation = 1,
+ MaxDebugObjectInfoClass = 2,
+}}
+pub type PDEBUGOBJECTINFOCLASS = *mut DEBUGOBJECTINFOCLASS;
+EXTERN!{extern "system" {
+ fn NtCreateDebugObject(
+ DebugObjectHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn NtDebugActiveProcess(
+ ProcessHandle: HANDLE,
+ DebugObjectHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtDebugContinue(
+ DebugObjectHandle: HANDLE,
+ ClientId: PCLIENT_ID,
+ ContinueStatus: NTSTATUS,
+ ) -> NTSTATUS;
+ fn NtRemoveProcessDebug(
+ ProcessHandle: HANDLE,
+ DebugObjectHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtSetInformationDebugObject(
+ DebugObjectHandle: HANDLE,
+ DebugObjectInformationClass: DEBUGOBJECTINFOCLASS,
+ DebugInformation: PVOID,
+ DebugInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtWaitForDebugEvent(
+ DebugObjectHandle: HANDLE,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ WaitStateChange: PVOID,
+ ) -> NTSTATUS;
+ fn DbgUiConnectToDbg() -> NTSTATUS;
+ fn DbgUiGetThreadDebugObject() -> HANDLE;
+ fn DbgUiSetThreadDebugObject(
+ DebugObject: HANDLE,
+ );
+ fn DbgUiWaitStateChange(
+ StateChange: PDBGUI_WAIT_STATE_CHANGE,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn DbgUiContinue(
+ AppClientId: PCLIENT_ID,
+ ContinueStatus: NTSTATUS,
+ ) -> NTSTATUS;
+ fn DbgUiStopDebugging(
+ Process: HANDLE,
+ ) -> NTSTATUS;
+ fn DbgUiDebugActiveProcess(
+ Process: HANDLE,
+ ) -> NTSTATUS;
+ fn DbgUiRemoteBreakin(
+ Context: PVOID,
+ );
+ fn DbgUiIssueRemoteBreakin(
+ Process: HANDLE,
+ ) -> NTSTATUS;
+ fn DbgUiConvertStateChangeStructure(
+ StateChange: PDBGUI_WAIT_STATE_CHANGE,
+ DebugEvent: LPDEBUG_EVENT,
+ ) -> NTSTATUS;
+}}
+FN!{stdcall PENABLECALLBACK(
+ SourceId: LPCGUID,
+ IsEnabled: ULONG,
+ Level: UCHAR,
+ MatchAnyKeyword: ULONGLONG,
+ MatchAllKeyword: ULONGLONG,
+ FilterData: *mut EVENT_FILTER_DESCRIPTOR,
+ CallbackContext: PVOID,
+) -> ()}
+pub type REGHANDLE = ULONGLONG;
+pub type PREGHANDLE = *mut ULONGLONG;
+EXTERN!{extern "system" {
+ fn EtwEventRegister(
+ ProviderId: LPCGUID,
+ EnableCallback: PENABLECALLBACK,
+ CallbackContext: PVOID,
+ RegHandle: PREGHANDLE,
+ ) -> NTSTATUS;
+}}
diff --git a/third_party/rust/ntapi/src/ntexapi.rs b/third_party/rust/ntapi/src/ntexapi.rs
new file mode 100644
index 0000000000..08a0ddf9ef
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntexapi.rs
@@ -0,0 +1,3000 @@
+use core::mem::MaybeUninit;
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+use core::ptr::addr_of;
+use core::ptr::read_volatile;
+#[cfg(target_arch = "x86")]
+use core::hint::spin_loop;
+use crate::ntapi_base::{CLIENT_ID, KPRIORITY, KSYSTEM_TIME, PRTL_ATOM, RTL_ATOM};
+use crate::ntioapi::{BUS_DATA_TYPE, FILE_IO_COMPLETION_INFORMATION, INTERFACE_TYPE};
+use crate::ntkeapi::{KPROFILE_SOURCE, KTHREAD_STATE, KWAIT_REASON};
+use crate::ntldr::RTL_PROCESS_MODULE_INFORMATION_EX;
+use crate::ntpebteb::PTEB;
+use crate::ntpoapi::COUNTED_REASON_CONTEXT;
+use winapi::shared::basetsd::{KAFFINITY, PULONG64, PULONG_PTR, SIZE_T, ULONG64, ULONG_PTR};
+use winapi::shared::evntrace::PROFILE_SOURCE_INFO;
+use winapi::shared::guiddef::{GUID, LPGUID};
+use winapi::shared::ntdef::{
+ BOOLEAN, CCHAR, EVENT_TYPE, HANDLE, LANGID, LARGE_INTEGER, LCID, LOGICAL, LONG, LONGLONG,
+ NTSTATUS, NT_PRODUCT_TYPE, PBOOLEAN, PCHAR, PCWNF_STATE_NAME, PGROUP_AFFINITY, PHANDLE,
+ PHYSICAL_ADDRESS, PLARGE_INTEGER, PLCID, PLONG, PLUID, POBJECT_ATTRIBUTES, PUCHAR,
+ PULARGE_INTEGER, PULONG, PUNICODE_STRING, PUSHORT, PVOID, PWNF_STATE_NAME, PWSTR, TIMER_TYPE,
+ UCHAR, ULARGE_INTEGER, ULONG, ULONGLONG, UNICODE_STRING, USHORT, VOID, WCHAR, WNF_STATE_NAME,
+};
+use winapi::um::winnt::{
+ ACCESS_MASK, ANYSIZE_ARRAY, FIRMWARE_TYPE, GENERIC_MAPPING, PSECURITY_DESCRIPTOR,
+ STANDARD_RIGHTS_REQUIRED, SYNCHRONIZE, XSTATE_CONFIGURATION,
+};
+use crate::winapi_local::um::winnt::UInt32x32To64;
+EXTERN!{extern "system" {
+ fn NtDelayExecution(
+ Alertable: BOOLEAN,
+ DelayInterval: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtQuerySystemEnvironmentValue(
+ VariableName: PUNICODE_STRING,
+ VariableValue: PWSTR,
+ ValueLength: USHORT,
+ ReturnLength: PUSHORT,
+ ) -> NTSTATUS;
+ fn NtSetSystemEnvironmentValue(
+ VariableName: PUNICODE_STRING,
+ VariableValue: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn NtQuerySystemEnvironmentValueEx(
+ VariableName: PUNICODE_STRING,
+ VendorGuid: LPGUID,
+ Value: PVOID,
+ ValueLength: PULONG,
+ Attributes: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetSystemEnvironmentValueEx(
+ VariableName: PUNICODE_STRING,
+ VendorGuid: LPGUID,
+ Value: PVOID,
+ ValueLength: ULONG,
+ Attributes: ULONG,
+ ) -> NTSTATUS;
+ fn NtEnumerateSystemEnvironmentValuesEx(
+ InformationClass: ULONG,
+ Buffer: PVOID,
+ BufferLength: PULONG,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct BOOT_ENTRY {
+ Version: ULONG,
+ Length: ULONG,
+ Id: ULONG,
+ Attributes: ULONG,
+ FriendlyNameOffset: ULONG,
+ BootFilePathOffset: ULONG,
+ OsOptionsLength: ULONG,
+ OsOptions: [UCHAR; 1],
+}}
+pub type PBOOT_ENTRY = *mut BOOT_ENTRY;
+STRUCT!{struct BOOT_ENTRY_LIST {
+ NextEntryOffset: ULONG,
+ BootEntry: BOOT_ENTRY,
+}}
+pub type PBOOT_ENTRY_LIST = *mut BOOT_ENTRY_LIST;
+STRUCT!{struct BOOT_OPTIONS {
+ Version: ULONG,
+ Length: ULONG,
+ Timeout: ULONG,
+ CurrentBootEntryId: ULONG,
+ NextBootEntryId: ULONG,
+ HeadlessRedirection: [WCHAR; 1],
+}}
+pub type PBOOT_OPTIONS = *mut BOOT_OPTIONS;
+STRUCT!{struct FILE_PATH {
+ Version: ULONG,
+ Length: ULONG,
+ Type: ULONG,
+ FilePath: [UCHAR; 1],
+}}
+pub type PFILE_PATH = *mut FILE_PATH;
+STRUCT!{struct EFI_DRIVER_ENTRY {
+ Version: ULONG,
+ Length: ULONG,
+ Id: ULONG,
+ FriendlyNameOffset: ULONG,
+ DriverFilePathOffset: ULONG,
+}}
+pub type PEFI_DRIVER_ENTRY = *mut EFI_DRIVER_ENTRY;
+STRUCT!{struct EFI_DRIVER_ENTRY_LIST {
+ NextEntryOffset: ULONG,
+ DriverEntry: EFI_DRIVER_ENTRY,
+}}
+pub type PEFI_DRIVER_ENTRY_LIST = *mut EFI_DRIVER_ENTRY_LIST;
+EXTERN!{extern "system" {
+ fn NtAddBootEntry(
+ BootEntry: PBOOT_ENTRY,
+ Id: PULONG,
+ ) -> NTSTATUS;
+ fn NtDeleteBootEntry(
+ Id: ULONG,
+ ) -> NTSTATUS;
+ fn NtModifyBootEntry(
+ BootEntry: PBOOT_ENTRY,
+ ) -> NTSTATUS;
+ fn NtEnumerateBootEntries(
+ Buffer: PVOID,
+ BufferLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtQueryBootEntryOrder(
+ Ids: PULONG,
+ Count: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetBootEntryOrder(
+ Ids: PULONG,
+ Count: ULONG,
+ ) -> NTSTATUS;
+ fn NtQueryBootOptions(
+ BootOptions: PBOOT_OPTIONS,
+ BootOptionsLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetBootOptions(
+ BootOptions: PBOOT_OPTIONS,
+ FieldsToChange: ULONG,
+ ) -> NTSTATUS;
+ fn NtTranslateFilePath(
+ InputFilePath: PFILE_PATH,
+ OutputType: ULONG,
+ OutputFilePath: PFILE_PATH,
+ OutputFilePathLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtAddDriverEntry(
+ DriverEntry: PEFI_DRIVER_ENTRY,
+ Id: PULONG,
+ ) -> NTSTATUS;
+ fn NtDeleteDriverEntry(
+ Id: ULONG,
+ ) -> NTSTATUS;
+ fn NtModifyDriverEntry(
+ DriverEntry: PEFI_DRIVER_ENTRY,
+ ) -> NTSTATUS;
+ fn NtEnumerateDriverEntries(
+ Buffer: PVOID,
+ BufferLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtQueryDriverEntryOrder(
+ Ids: PULONG,
+ Count: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetDriverEntryOrder(
+ Ids: PULONG,
+ Count: ULONG,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum FILTER_BOOT_OPTION_OPERATION {
+ FilterBootOptionOperationOpenSystemStore = 0,
+ FilterBootOptionOperationSetElement = 1,
+ FilterBootOptionOperationDeleteElement = 2,
+ FilterBootOptionOperationMax = 3,
+}}
+EXTERN!{extern "system" {
+ fn NtFilterBootOption(
+ FilterOperation: FILTER_BOOT_OPTION_OPERATION,
+ ObjectType: ULONG,
+ ElementType: ULONG,
+ Data: PVOID,
+ DataSize: ULONG,
+ ) -> NTSTATUS;
+}}
+pub const EVENT_QUERY_STATE: u32 = 0x0001;
+ENUM!{enum EVENT_INFORMATION_CLASS {
+ EventBasicInformation = 0,
+}}
+STRUCT!{struct EVENT_BASIC_INFORMATION {
+ EventType: EVENT_TYPE,
+ EventState: LONG,
+}}
+pub type PEVENT_BASIC_INFORMATION = *mut EVENT_BASIC_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtCreateEvent(
+ EventHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ EventType: EVENT_TYPE,
+ InitialState: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtOpenEvent(
+ EventHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtSetEvent(
+ EventHandle: HANDLE,
+ PreviousState: PLONG,
+ ) -> NTSTATUS;
+ fn NtSetEventBoostPriority(
+ EventHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtClearEvent(
+ EventHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtResetEvent(
+ EventHandle: HANDLE,
+ PreviousState: PLONG,
+ ) -> NTSTATUS;
+ fn NtPulseEvent(
+ EventHandle: HANDLE,
+ PreviousState: PLONG,
+ ) -> NTSTATUS;
+ fn NtQueryEvent(
+ EventHandle: HANDLE,
+ EventInformationClass: EVENT_INFORMATION_CLASS,
+ EventInformation: PVOID,
+ EventInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+}}
+pub const EVENT_PAIR_ALL_ACCESS: ACCESS_MASK = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE;
+EXTERN!{extern "system" {
+ fn NtCreateEventPair(
+ EventPairHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtOpenEventPair(
+ EventPairHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtSetLowEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtSetHighEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtWaitLowEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtWaitHighEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtSetLowWaitHighEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtSetHighWaitLowEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum MUTANT_INFORMATION_CLASS {
+ MutantBasicInformation = 0,
+ MutantOwnerInformation = 1,
+}}
+STRUCT!{struct MUTANT_BASIC_INFORMATION {
+ CurrentCount: LONG,
+ OwnedByCaller: BOOLEAN,
+ AbandonedState: BOOLEAN,
+}}
+pub type PMUTANT_BASIC_INFORMATION = *mut MUTANT_BASIC_INFORMATION;
+STRUCT!{struct MUTANT_OWNER_INFORMATION {
+ ClientId: CLIENT_ID,
+}}
+pub type PMUTANT_OWNER_INFORMATION = *mut MUTANT_OWNER_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtCreateMutant(
+ MutantHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ InitialOwner: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtOpenMutant(
+ MutantHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtReleaseMutant(
+ MutantHandle: HANDLE,
+ PreviousCount: PLONG,
+ ) -> NTSTATUS;
+ fn NtQueryMutant(
+ MutantHandle: HANDLE,
+ MutantInformationClass: MUTANT_INFORMATION_CLASS,
+ MutantInformation: PVOID,
+ MutantInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+}}
+pub const SEMAPHORE_QUERY_STATE: u32 = 0x0001;
+ENUM!{enum SEMAPHORE_INFORMATION_CLASS {
+ SemaphoreBasicInformation = 0,
+}}
+STRUCT!{struct SEMAPHORE_BASIC_INFORMATION {
+ CurrentCount: LONG,
+ MaximumCount: LONG,
+}}
+pub type PSEMAPHORE_BASIC_INFORMATION = *mut SEMAPHORE_BASIC_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtCreateSemaphore(
+ SemaphoreHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ InitialCount: LONG,
+ MaximumCount: LONG,
+ ) -> NTSTATUS;
+ fn NtOpenSemaphore(
+ SemaphoreHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtReleaseSemaphore(
+ SemaphoreHandle: HANDLE,
+ ReleaseCount: LONG,
+ PreviousCount: PLONG,
+ ) -> NTSTATUS;
+ fn NtQuerySemaphore(
+ SemaphoreHandle: HANDLE,
+ SemaphoreInformationClass: SEMAPHORE_INFORMATION_CLASS,
+ SemaphoreInformation: PVOID,
+ SemaphoreInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum TIMER_INFORMATION_CLASS {
+ TimerBasicInformation = 0,
+}}
+STRUCT!{struct TIMER_BASIC_INFORMATION {
+ RemainingTime: LARGE_INTEGER,
+ TimerState: BOOLEAN,
+}}
+pub type PTIMER_BASIC_INFORMATION = *mut TIMER_BASIC_INFORMATION;
+FN!{stdcall PTIMER_APC_ROUTINE(
+ TimerContext: PVOID,
+ TimerLowValue: ULONG,
+ TimerHighValue: LONG,
+) -> ()}
+ENUM!{enum TIMER_SET_INFORMATION_CLASS {
+ TimerSetCoalescableTimer = 0,
+ MaxTimerInfoClass = 1,
+}}
+STRUCT!{struct TIMER_SET_COALESCABLE_TIMER_INFO {
+ DueTime: LARGE_INTEGER,
+ TimerApcRoutine: PTIMER_APC_ROUTINE,
+ TimerContext: PVOID,
+ WakeContext: *mut COUNTED_REASON_CONTEXT,
+ Period: ULONG,
+ TolerableDelay: ULONG,
+ PreviousState: PBOOLEAN,
+}}
+pub type PTIMER_SET_COALESCABLE_TIMER_INFO = *mut TIMER_SET_COALESCABLE_TIMER_INFO;
+EXTERN!{extern "system" {
+ fn NtCreateTimer(
+ TimerHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ TimerType: TIMER_TYPE,
+ ) -> NTSTATUS;
+ fn NtOpenTimer(
+ TimerHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtSetTimer(
+ TimerHandle: HANDLE,
+ DueTime: PLARGE_INTEGER,
+ TimerApcRoutine: PTIMER_APC_ROUTINE,
+ TimerContext: PVOID,
+ ResumeTimer: BOOLEAN,
+ Period: LONG,
+ PreviousState: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn NtSetTimerEx(
+ TimerHandle: HANDLE,
+ TimerSetInformationClass: TIMER_SET_INFORMATION_CLASS,
+ TimerSetInformation: PVOID,
+ TimerSetInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtCancelTimer(
+ TimerHandle: HANDLE,
+ CurrentState: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn NtQueryTimer(
+ TimerHandle: HANDLE,
+ TimerInformationClass: TIMER_INFORMATION_CLASS,
+ TimerInformation: PVOID,
+ TimerInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtCreateIRTimer(
+ TimerHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ) -> NTSTATUS;
+ fn NtSetIRTimer(
+ TimerHandle: HANDLE,
+ DueTime: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct T2_SET_PARAMETERS {
+ Version: ULONG,
+ Reserved: ULONG,
+ NoWakeTolerance: LONGLONG,
+}}
+pub type PT2_SET_PARAMETERS = *mut T2_SET_PARAMETERS;
+pub type PT2_CANCEL_PARAMETERS = PVOID;
+EXTERN!{extern "system" {
+ fn NtCreateTimer2(
+ TimerHandle: PHANDLE,
+ Reserved1: PVOID,
+ Reserved2: PVOID,
+ Attributes: ULONG,
+ DesiredAccess: ACCESS_MASK,
+ ) -> NTSTATUS;
+ fn NtSetTimer2(
+ TimerHandle: HANDLE,
+ DueTime: PLARGE_INTEGER,
+ Period: PLARGE_INTEGER,
+ Parameters: PT2_SET_PARAMETERS,
+ ) -> NTSTATUS;
+ fn NtCancelTimer2(
+ TimerHandle: HANDLE,
+ Parameters: PT2_CANCEL_PARAMETERS,
+ ) -> NTSTATUS;
+}}
+pub const PROFILE_CONTROL: u32 = 0x0001;
+pub const PROFILE_ALL_ACCESS: u32 = STANDARD_RIGHTS_REQUIRED | PROFILE_CONTROL;
+EXTERN!{extern "system" {
+ fn NtCreateProfile(
+ ProfileHandle: PHANDLE,
+ Process: HANDLE,
+ ProfileBase: PVOID,
+ ProfileSize: SIZE_T,
+ BucketSize: ULONG,
+ Buffer: PULONG,
+ BufferSize: ULONG,
+ ProfileSource: KPROFILE_SOURCE,
+ Affinity: KAFFINITY,
+ ) -> NTSTATUS;
+ fn NtCreateProfileEx(
+ ProfileHandle: PHANDLE,
+ Process: HANDLE,
+ ProfileBase: PVOID,
+ ProfileSize: SIZE_T,
+ BucketSize: ULONG,
+ Buffer: PULONG,
+ BufferSize: ULONG,
+ ProfileSource: KPROFILE_SOURCE,
+ GroupCount: USHORT,
+ GroupAffinity: PGROUP_AFFINITY,
+ ) -> NTSTATUS;
+ fn NtStartProfile(
+ ProfileHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtStopProfile(
+ ProfileHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtQueryIntervalProfile(
+ ProfileSource: KPROFILE_SOURCE,
+ Interval: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetIntervalProfile(
+ Interval: ULONG,
+ Source: KPROFILE_SOURCE,
+ ) -> NTSTATUS;
+}}
+pub const KEYEDEVENT_WAIT: ULONG = 0x0001;
+pub const KEYEDEVENT_WAKE: ULONG = 0x0002;
+pub const KEYEDEVENT_ALL_ACCESS: ACCESS_MASK =
+ STANDARD_RIGHTS_REQUIRED | KEYEDEVENT_WAIT | KEYEDEVENT_WAKE;
+EXTERN!{extern "system" {
+ fn NtCreateKeyedEvent(
+ KeyedEventHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn NtOpenKeyedEvent(
+ KeyedEventHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtReleaseKeyedEvent(
+ KeyedEventHandle: HANDLE,
+ KeyValue: PVOID,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtWaitForKeyedEvent(
+ KeyedEventHandle: HANDLE,
+ KeyValue: PVOID,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtUmsThreadYield(
+ SchedulerParam: PVOID,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum WNF_STATE_NAME_LIFETIME {
+ WnfWellKnownStateName = 0,
+ WnfPermanentStateName = 1,
+ WnfPersistentStateName = 2,
+ WnfTemporaryStateName = 3,
+}}
+ENUM!{enum WNF_STATE_NAME_INFORMATION {
+ WnfInfoStateNameExist = 0,
+ WnfInfoSubscribersPresent = 1,
+ WnfInfoIsQuiescent = 2,
+}}
+ENUM!{enum WNF_DATA_SCOPE {
+ WnfDataScopeSystem = 0,
+ WnfDataScopeSession = 1,
+ WnfDataScopeUser = 2,
+ WnfDataScopeProcess = 3,
+ WnfDataScopeMachine = 4,
+}}
+STRUCT!{struct WNF_TYPE_ID {
+ TypeId: GUID,
+}}
+pub type PWNF_TYPE_ID = *mut WNF_TYPE_ID;
+pub type PCWNF_TYPE_ID = *const WNF_TYPE_ID;
+pub type PWNF_CHANGE_STAMP = *mut ULONG;
+pub type WNF_CHANGE_STAMP = ULONG;
+STRUCT!{struct WNF_DELIVERY_DESCRIPTOR {
+ SubscriptionId: ULONGLONG,
+ StateName: WNF_STATE_NAME,
+ ChangeStamp: WNF_CHANGE_STAMP,
+ StateDataSize: ULONG,
+ EventMask: ULONG,
+ TypeId: WNF_TYPE_ID,
+ StateDataOffset: ULONG,
+}}
+pub type PWNF_DELIVERY_DESCRIPTOR = *mut WNF_DELIVERY_DESCRIPTOR;
+EXTERN!{extern "system" {
+ fn NtCreateWnfStateName(
+ StateName: PWNF_STATE_NAME,
+ NameLifetime: WNF_STATE_NAME_LIFETIME,
+ DataScope: WNF_DATA_SCOPE,
+ PersistData: BOOLEAN,
+ TypeId: PCWNF_TYPE_ID,
+ MaximumStateSize: ULONG,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ) -> NTSTATUS;
+ fn NtDeleteWnfStateName(
+ StateName: PCWNF_STATE_NAME,
+ ) -> NTSTATUS;
+ fn NtUpdateWnfStateData(
+ StateName: PCWNF_STATE_NAME,
+ Buffer: *const VOID,
+ Length: ULONG,
+ TypeId: PCWNF_TYPE_ID,
+ ExplicitScope: *const VOID,
+ MatchingChangeStamp: WNF_CHANGE_STAMP,
+ CheckStamp: LOGICAL,
+ ) -> NTSTATUS;
+ fn NtDeleteWnfStateData(
+ StateName: PCWNF_STATE_NAME,
+ ExplicitScope: *const VOID,
+ ) -> NTSTATUS;
+ fn NtQueryWnfStateData(
+ StateName: PCWNF_STATE_NAME,
+ TypeId: PCWNF_TYPE_ID,
+ ExplicitScope: *const VOID,
+ ChangeStamp: PWNF_CHANGE_STAMP,
+ Buffer: PVOID,
+ BufferSize: PULONG,
+ ) -> NTSTATUS;
+ fn NtQueryWnfStateNameInformation(
+ StateName: PCWNF_STATE_NAME,
+ NameInfoClass: WNF_STATE_NAME_INFORMATION,
+ ExplicitScope: *const VOID,
+ InfoBuffer: PVOID,
+ InfoBufferSize: ULONG,
+ ) -> NTSTATUS;
+ fn NtSubscribeWnfStateChange(
+ StateName: PCWNF_STATE_NAME,
+ ChangeStamp: WNF_CHANGE_STAMP,
+ EventMask: ULONG,
+ SubscriptionId: PULONG64,
+ ) -> NTSTATUS;
+ fn NtUnsubscribeWnfStateChange(
+ StateName: PCWNF_STATE_NAME,
+ ) -> NTSTATUS;
+ fn NtGetCompleteWnfStateSubscription(
+ OldDescriptorStateName: PWNF_STATE_NAME,
+ OldSubscriptionId: *mut ULONG64,
+ OldDescriptorEventMask: ULONG,
+ OldDescriptorStatus: ULONG,
+ NewDeliveryDescriptor: PWNF_DELIVERY_DESCRIPTOR,
+ DescriptorSize: ULONG,
+ ) -> NTSTATUS;
+ fn NtSetWnfProcessNotificationEvent(
+ NotificationEvent: HANDLE,
+ ) -> NTSTATUS;
+}}
+pub const WORKER_FACTORY_RELEASE_WORKER: u32 = 0x0001;
+pub const WORKER_FACTORY_WAIT: u32 = 0x0002;
+pub const WORKER_FACTORY_SET_INFORMATION: u32 = 0x0004;
+pub const WORKER_FACTORY_QUERY_INFORMATION: u32 = 0x0008;
+pub const WORKER_FACTORY_READY_WORKER: u32 = 0x0010;
+pub const WORKER_FACTORY_SHUTDOWN: u32 = 0x0020;
+pub const WORKER_FACTORY_ALL_ACCESS: ACCESS_MASK = STANDARD_RIGHTS_REQUIRED
+ | WORKER_FACTORY_RELEASE_WORKER | WORKER_FACTORY_WAIT | WORKER_FACTORY_SET_INFORMATION
+ | WORKER_FACTORY_QUERY_INFORMATION | WORKER_FACTORY_READY_WORKER | WORKER_FACTORY_SHUTDOWN;
+ENUM!{enum WORKERFACTORYINFOCLASS {
+ WorkerFactoryTimeout = 0,
+ WorkerFactoryRetryTimeout = 1,
+ WorkerFactoryIdleTimeout = 2,
+ WorkerFactoryBindingCount = 3,
+ WorkerFactoryThreadMinimum = 4,
+ WorkerFactoryThreadMaximum = 5,
+ WorkerFactoryPaused = 6,
+ WorkerFactoryBasicInformation = 7,
+ WorkerFactoryAdjustThreadGoal = 8,
+ WorkerFactoryCallbackType = 9,
+ WorkerFactoryStackInformation = 10,
+ WorkerFactoryThreadBasePriority = 11,
+ WorkerFactoryTimeoutWaiters = 12,
+ WorkerFactoryFlags = 13,
+ WorkerFactoryThreadSoftMaximum = 14,
+ MaxWorkerFactoryInfoClass = 15,
+}}
+pub type PWORKERFACTORYINFOCLASS = *mut WORKERFACTORYINFOCLASS;
+STRUCT!{struct WORKER_FACTORY_BASIC_INFORMATION {
+ Timeout: LARGE_INTEGER,
+ RetryTimeout: LARGE_INTEGER,
+ IdleTimeout: LARGE_INTEGER,
+ Paused: BOOLEAN,
+ TimerSet: BOOLEAN,
+ QueuedToExWorker: BOOLEAN,
+ MayCreate: BOOLEAN,
+ CreateInProgress: BOOLEAN,
+ InsertedIntoQueue: BOOLEAN,
+ Shutdown: BOOLEAN,
+ BindingCount: ULONG,
+ ThreadMinimum: ULONG,
+ ThreadMaximum: ULONG,
+ PendingWorkerCount: ULONG,
+ WaitingWorkerCount: ULONG,
+ TotalWorkerCount: ULONG,
+ ReleaseCount: ULONG,
+ InfiniteWaitGoal: LONGLONG,
+ StartRoutine: PVOID,
+ StartParameter: PVOID,
+ ProcessId: HANDLE,
+ StackReserve: SIZE_T,
+ StackCommit: SIZE_T,
+ LastThreadCreationStatus: NTSTATUS,
+}}
+pub type PWORKER_FACTORY_BASIC_INFORMATION = *mut WORKER_FACTORY_BASIC_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtCreateWorkerFactory(
+ WorkerFactoryHandleReturn: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ CompletionPortHandle: HANDLE,
+ WorkerProcessHandle: HANDLE,
+ StartRoutine: PVOID,
+ StartParameter: PVOID,
+ MaxThreadCount: ULONG,
+ StackReserve: SIZE_T,
+ StackCommit: SIZE_T,
+ ) -> NTSTATUS;
+ fn NtQueryInformationWorkerFactory(
+ WorkerFactoryHandle: HANDLE,
+ WorkerFactoryInformationClass: WORKERFACTORYINFOCLASS,
+ WorkerFactoryInformation: PVOID,
+ WorkerFactoryInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetInformationWorkerFactory(
+ WorkerFactoryHandle: HANDLE,
+ WorkerFactoryInformationClass: WORKERFACTORYINFOCLASS,
+ WorkerFactoryInformation: PVOID,
+ WorkerFactoryInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtShutdownWorkerFactory(
+ WorkerFactoryHandle: HANDLE,
+ PendingWorkerCount: *mut LONG,
+ ) -> NTSTATUS;
+ fn NtReleaseWorkerFactoryWorker(
+ WorkerFactoryHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtWorkerFactoryWorkerReady(
+ WorkerFactoryHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtWaitForWorkViaWorkerFactory(
+ WorkerFactoryHandle: HANDLE,
+ MiniPacket: *mut FILE_IO_COMPLETION_INFORMATION,
+ ) -> NTSTATUS;
+ fn NtQuerySystemTime(
+ SystemTime: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtSetSystemTime(
+ SystemTime: PLARGE_INTEGER,
+ PreviousTime: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtQueryTimerResolution(
+ MaximumTime: PULONG,
+ MinimumTime: PULONG,
+ CurrentTime: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetTimerResolution(
+ DesiredTime: ULONG,
+ SetResolution: BOOLEAN,
+ ActualTime: PULONG,
+ ) -> NTSTATUS;
+ fn NtQueryPerformanceCounter(
+ PerformanceCounter: PLARGE_INTEGER,
+ PerformanceFrequency: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtAllocateLocallyUniqueId(
+ Luid: PLUID,
+ ) -> NTSTATUS;
+ fn NtSetUuidSeed(
+ Seed: PCHAR,
+ ) -> NTSTATUS;
+ fn NtAllocateUuids(
+ Time: PULARGE_INTEGER,
+ Range: PULONG,
+ Sequence: PULONG,
+ Seed: PCHAR,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum SYSTEM_INFORMATION_CLASS {
+ SystemBasicInformation = 0,
+ SystemProcessorInformation = 1,
+ SystemPerformanceInformation = 2,
+ SystemTimeOfDayInformation = 3,
+ SystemPathInformation = 4,
+ SystemProcessInformation = 5,
+ SystemCallCountInformation = 6,
+ SystemDeviceInformation = 7,
+ SystemProcessorPerformanceInformation = 8,
+ SystemFlagsInformation = 9,
+ SystemCallTimeInformation = 10,
+ SystemModuleInformation = 11,
+ SystemLocksInformation = 12,
+ SystemStackTraceInformation = 13,
+ SystemPagedPoolInformation = 14,
+ SystemNonPagedPoolInformation = 15,
+ SystemHandleInformation = 16,
+ SystemObjectInformation = 17,
+ SystemPageFileInformation = 18,
+ SystemVdmInstemulInformation = 19,
+ SystemVdmBopInformation = 20,
+ SystemFileCacheInformation = 21,
+ SystemPoolTagInformation = 22,
+ SystemInterruptInformation = 23,
+ SystemDpcBehaviorInformation = 24,
+ SystemFullMemoryInformation = 25,
+ SystemLoadGdiDriverInformation = 26,
+ SystemUnloadGdiDriverInformation = 27,
+ SystemTimeAdjustmentInformation = 28,
+ SystemSummaryMemoryInformation = 29,
+ SystemMirrorMemoryInformation = 30,
+ SystemPerformanceTraceInformation = 31,
+ SystemObsolete0 = 32,
+ SystemExceptionInformation = 33,
+ SystemCrashDumpStateInformation = 34,
+ SystemKernelDebuggerInformation = 35,
+ SystemContextSwitchInformation = 36,
+ SystemRegistryQuotaInformation = 37,
+ SystemExtendServiceTableInformation = 38,
+ SystemPrioritySeperation = 39,
+ SystemVerifierAddDriverInformation = 40,
+ SystemVerifierRemoveDriverInformation = 41,
+ SystemProcessorIdleInformation = 42,
+ SystemLegacyDriverInformation = 43,
+ SystemCurrentTimeZoneInformation = 44,
+ SystemLookasideInformation = 45,
+ SystemTimeSlipNotification = 46,
+ SystemSessionCreate = 47,
+ SystemSessionDetach = 48,
+ SystemSessionInformation = 49,
+ SystemRangeStartInformation = 50,
+ SystemVerifierInformation = 51,
+ SystemVerifierThunkExtend = 52,
+ SystemSessionProcessInformation = 53,
+ SystemLoadGdiDriverInSystemSpace = 54,
+ SystemNumaProcessorMap = 55,
+ SystemPrefetcherInformation = 56,
+ SystemExtendedProcessInformation = 57,
+ SystemRecommendedSharedDataAlignment = 58,
+ SystemComPlusPackage = 59,
+ SystemNumaAvailableMemory = 60,
+ SystemProcessorPowerInformation = 61,
+ SystemEmulationBasicInformation = 62,
+ SystemEmulationProcessorInformation = 63,
+ SystemExtendedHandleInformation = 64,
+ SystemLostDelayedWriteInformation = 65,
+ SystemBigPoolInformation = 66,
+ SystemSessionPoolTagInformation = 67,
+ SystemSessionMappedViewInformation = 68,
+ SystemHotpatchInformation = 69,
+ SystemObjectSecurityMode = 70,
+ SystemWatchdogTimerHandler = 71,
+ SystemWatchdogTimerInformation = 72,
+ SystemLogicalProcessorInformation = 73,
+ SystemWow64SharedInformationObsolete = 74,
+ SystemRegisterFirmwareTableInformationHandler = 75,
+ SystemFirmwareTableInformation = 76,
+ SystemModuleInformationEx = 77,
+ SystemVerifierTriageInformation = 78,
+ SystemSuperfetchInformation = 79,
+ SystemMemoryListInformation = 80,
+ SystemFileCacheInformationEx = 81,
+ SystemThreadPriorityClientIdInformation = 82,
+ SystemProcessorIdleCycleTimeInformation = 83,
+ SystemVerifierCancellationInformation = 84,
+ SystemProcessorPowerInformationEx = 85,
+ SystemRefTraceInformation = 86,
+ SystemSpecialPoolInformation = 87,
+ SystemProcessIdInformation = 88,
+ SystemErrorPortInformation = 89,
+ SystemBootEnvironmentInformation = 90,
+ SystemHypervisorInformation = 91,
+ SystemVerifierInformationEx = 92,
+ SystemTimeZoneInformation = 93,
+ SystemImageFileExecutionOptionsInformation = 94,
+ SystemCoverageInformation = 95,
+ SystemPrefetchPatchInformation = 96,
+ SystemVerifierFaultsInformation = 97,
+ SystemSystemPartitionInformation = 98,
+ SystemSystemDiskInformation = 99,
+ SystemProcessorPerformanceDistribution = 100,
+ SystemNumaProximityNodeInformation = 101,
+ SystemDynamicTimeZoneInformation = 102,
+ SystemCodeIntegrityInformation = 103,
+ SystemProcessorMicrocodeUpdateInformation = 104,
+ SystemProcessorBrandString = 105,
+ SystemVirtualAddressInformation = 106,
+ SystemLogicalProcessorAndGroupInformation = 107,
+ SystemProcessorCycleTimeInformation = 108,
+ SystemStoreInformation = 109,
+ SystemRegistryAppendString = 110,
+ SystemAitSamplingValue = 111,
+ SystemVhdBootInformation = 112,
+ SystemCpuQuotaInformation = 113,
+ SystemNativeBasicInformation = 114,
+ SystemSpare1 = 115,
+ SystemLowPriorityIoInformation = 116,
+ SystemTpmBootEntropyInformation = 117,
+ SystemVerifierCountersInformation = 118,
+ SystemPagedPoolInformationEx = 119,
+ SystemSystemPtesInformationEx = 120,
+ SystemNodeDistanceInformation = 121,
+ SystemAcpiAuditInformation = 122,
+ SystemBasicPerformanceInformation = 123,
+ SystemQueryPerformanceCounterInformation = 124,
+ SystemSessionBigPoolInformation = 125,
+ SystemBootGraphicsInformation = 126,
+ SystemScrubPhysicalMemoryInformation = 127,
+ SystemBadPageInformation = 128,
+ SystemProcessorProfileControlArea = 129,
+ SystemCombinePhysicalMemoryInformation = 130,
+ SystemEntropyInterruptTimingCallback = 131,
+ SystemConsoleInformation = 132,
+ SystemPlatformBinaryInformation = 133,
+ SystemThrottleNotificationInformation = 134,
+ SystemHypervisorProcessorCountInformation = 135,
+ SystemDeviceDataInformation = 136,
+ SystemDeviceDataEnumerationInformation = 137,
+ SystemMemoryTopologyInformation = 138,
+ SystemMemoryChannelInformation = 139,
+ SystemBootLogoInformation = 140,
+ SystemProcessorPerformanceInformationEx = 141,
+ SystemSpare0 = 142,
+ SystemSecureBootPolicyInformation = 143,
+ SystemPageFileInformationEx = 144,
+ SystemSecureBootInformation = 145,
+ SystemEntropyInterruptTimingRawInformation = 146,
+ SystemPortableWorkspaceEfiLauncherInformation = 147,
+ SystemFullProcessInformation = 148,
+ SystemKernelDebuggerInformationEx = 149,
+ SystemBootMetadataInformation = 150,
+ SystemSoftRebootInformation = 151,
+ SystemElamCertificateInformation = 152,
+ SystemOfflineDumpConfigInformation = 153,
+ SystemProcessorFeaturesInformation = 154,
+ SystemRegistryReconciliationInformation = 155,
+ SystemEdidInformation = 156,
+ SystemManufacturingInformation = 157,
+ SystemEnergyEstimationConfigInformation = 158,
+ SystemHypervisorDetailInformation = 159,
+ SystemProcessorCycleStatsInformation = 160,
+ SystemVmGenerationCountInformation = 161,
+ SystemTrustedPlatformModuleInformation = 162,
+ SystemKernelDebuggerFlags = 163,
+ SystemCodeIntegrityPolicyInformation = 164,
+ SystemIsolatedUserModeInformation = 165,
+ SystemHardwareSecurityTestInterfaceResultsInformation = 166,
+ SystemSingleModuleInformation = 167,
+ SystemAllowedCpuSetsInformation = 168,
+ SystemVsmProtectionInformation = 169,
+ SystemInterruptCpuSetsInformation = 170,
+ SystemSecureBootPolicyFullInformation = 171,
+ SystemCodeIntegrityPolicyFullInformation = 172,
+ SystemAffinitizedInterruptProcessorInformation = 173,
+ SystemRootSiloInformation = 174,
+ SystemCpuSetInformation = 175,
+ SystemCpuSetTagInformation = 176,
+ SystemWin32WerStartCallout = 177,
+ SystemSecureKernelProfileInformation = 178,
+ SystemCodeIntegrityPlatformManifestInformation = 179,
+ SystemInterruptSteeringInformation = 180,
+ SystemSupportedProcessorArchitectures = 181,
+ SystemMemoryUsageInformation = 182,
+ SystemCodeIntegrityCertificateInformation = 183,
+ SystemPhysicalMemoryInformation = 184,
+ SystemControlFlowTransition = 185,
+ SystemKernelDebuggingAllowed = 186,
+ SystemActivityModerationExeState = 187,
+ SystemActivityModerationUserSettings = 188,
+ SystemCodeIntegrityPoliciesFullInformation = 189,
+ SystemCodeIntegrityUnlockInformation = 190,
+ SystemIntegrityQuotaInformation = 191,
+ SystemFlushInformation = 192,
+ SystemProcessorIdleMaskInformation = 193,
+ SystemSecureDumpEncryptionInformation = 194,
+ SystemWriteConstraintInformation = 195,
+ SystemKernelVaShadowInformation = 196,
+ SystemHypervisorSharedPageInformation = 197,
+ SystemFirmwareBootPerformanceInformation = 198,
+ SystemCodeIntegrityVerificationInformation = 199,
+ SystemFirmwarePartitionInformation = 200,
+ SystemSpeculationControlInformation = 201,
+ SystemDmaGuardPolicyInformation = 202,
+ SystemEnclaveLaunchControlInformation = 203,
+ SystemWorkloadAllowedCpuSetsInformation = 204,
+ SystemCodeIntegrityUnlockModeInformation = 205,
+ SystemLeapSecondInformation = 206,
+ SystemFlags2Information = 207,
+ MaxSystemInfoClass = 208,
+}}
+STRUCT!{struct SYSTEM_BASIC_INFORMATION {
+ Reserved: ULONG,
+ TimerResolution: ULONG,
+ PageSize: ULONG,
+ NumberOfPhysicalPages: ULONG,
+ LowestPhysicalPageNumber: ULONG,
+ HighestPhysicalPageNumber: ULONG,
+ AllocationGranularity: ULONG,
+ MinimumUserModeAddress: ULONG_PTR,
+ MaximumUserModeAddress: ULONG_PTR,
+ ActiveProcessorsAffinityMask: ULONG_PTR,
+ NumberOfProcessors: CCHAR,
+}}
+pub type PSYSTEM_BASIC_INFORMATION = *mut SYSTEM_BASIC_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_INFORMATION {
+ ProcessorArchitecture: USHORT,
+ ProcessorLevel: USHORT,
+ ProcessorRevision: USHORT,
+ MaximumProcessors: USHORT,
+ ProcessorFeatureBits: ULONG,
+}}
+pub type PSYSTEM_PROCESSOR_INFORMATION = *mut SYSTEM_PROCESSOR_INFORMATION;
+STRUCT!{struct SYSTEM_PERFORMANCE_INFORMATION {
+ IdleProcessTime: LARGE_INTEGER,
+ IoReadTransferCount: LARGE_INTEGER,
+ IoWriteTransferCount: LARGE_INTEGER,
+ IoOtherTransferCount: LARGE_INTEGER,
+ IoReadOperationCount: ULONG,
+ IoWriteOperationCount: ULONG,
+ IoOtherOperationCount: ULONG,
+ AvailablePages: ULONG,
+ CommittedPages: ULONG,
+ CommitLimit: ULONG,
+ PeakCommitment: ULONG,
+ PageFaultCount: ULONG,
+ CopyOnWriteCount: ULONG,
+ TransitionCount: ULONG,
+ CacheTransitionCount: ULONG,
+ DemandZeroCount: ULONG,
+ PageReadCount: ULONG,
+ PageReadIoCount: ULONG,
+ CacheReadCount: ULONG,
+ CacheIoCount: ULONG,
+ DirtyPagesWriteCount: ULONG,
+ DirtyWriteIoCount: ULONG,
+ MappedPagesWriteCount: ULONG,
+ MappedWriteIoCount: ULONG,
+ PagedPoolPages: ULONG,
+ NonPagedPoolPages: ULONG,
+ PagedPoolAllocs: ULONG,
+ PagedPoolFrees: ULONG,
+ NonPagedPoolAllocs: ULONG,
+ NonPagedPoolFrees: ULONG,
+ FreeSystemPtes: ULONG,
+ ResidentSystemCodePage: ULONG,
+ TotalSystemDriverPages: ULONG,
+ TotalSystemCodePages: ULONG,
+ NonPagedPoolLookasideHits: ULONG,
+ PagedPoolLookasideHits: ULONG,
+ AvailablePagedPoolPages: ULONG,
+ ResidentSystemCachePage: ULONG,
+ ResidentPagedPoolPage: ULONG,
+ ResidentSystemDriverPage: ULONG,
+ CcFastReadNoWait: ULONG,
+ CcFastReadWait: ULONG,
+ CcFastReadResourceMiss: ULONG,
+ CcFastReadNotPossible: ULONG,
+ CcFastMdlReadNoWait: ULONG,
+ CcFastMdlReadWait: ULONG,
+ CcFastMdlReadResourceMiss: ULONG,
+ CcFastMdlReadNotPossible: ULONG,
+ CcMapDataNoWait: ULONG,
+ CcMapDataWait: ULONG,
+ CcMapDataNoWaitMiss: ULONG,
+ CcMapDataWaitMiss: ULONG,
+ CcPinMappedDataCount: ULONG,
+ CcPinReadNoWait: ULONG,
+ CcPinReadWait: ULONG,
+ CcPinReadNoWaitMiss: ULONG,
+ CcPinReadWaitMiss: ULONG,
+ CcCopyReadNoWait: ULONG,
+ CcCopyReadWait: ULONG,
+ CcCopyReadNoWaitMiss: ULONG,
+ CcCopyReadWaitMiss: ULONG,
+ CcMdlReadNoWait: ULONG,
+ CcMdlReadWait: ULONG,
+ CcMdlReadNoWaitMiss: ULONG,
+ CcMdlReadWaitMiss: ULONG,
+ CcReadAheadIos: ULONG,
+ CcLazyWriteIos: ULONG,
+ CcLazyWritePages: ULONG,
+ CcDataFlushes: ULONG,
+ CcDataPages: ULONG,
+ ContextSwitches: ULONG,
+ FirstLevelTbFills: ULONG,
+ SecondLevelTbFills: ULONG,
+ SystemCalls: ULONG,
+ CcTotalDirtyPages: ULONGLONG,
+ CcDirtyPageThreshold: ULONGLONG,
+ ResidentAvailablePages: LONGLONG,
+ SharedCommittedPages: ULONGLONG,
+}}
+pub type PSYSTEM_PERFORMANCE_INFORMATION = *mut SYSTEM_PERFORMANCE_INFORMATION;
+STRUCT!{struct SYSTEM_TIMEOFDAY_INFORMATION {
+ BootTime: LARGE_INTEGER,
+ CurrentTime: LARGE_INTEGER,
+ TimeZoneBias: LARGE_INTEGER,
+ TimeZoneId: ULONG,
+ Reserved: ULONG,
+ BootTimeBias: ULONGLONG,
+ SleepTimeBias: ULONGLONG,
+}}
+pub type PSYSTEM_TIMEOFDAY_INFORMATION = *mut SYSTEM_TIMEOFDAY_INFORMATION;
+STRUCT!{struct SYSTEM_THREAD_INFORMATION {
+ KernelTime: LARGE_INTEGER,
+ UserTime: LARGE_INTEGER,
+ CreateTime: LARGE_INTEGER,
+ WaitTime: ULONG,
+ StartAddress: PVOID,
+ ClientId: CLIENT_ID,
+ Priority: KPRIORITY,
+ BasePriority: LONG,
+ ContextSwitches: ULONG,
+ ThreadState: KTHREAD_STATE,
+ WaitReason: KWAIT_REASON,
+}}
+pub type PSYSTEM_THREAD_INFORMATION = *mut SYSTEM_THREAD_INFORMATION;
+STRUCT!{struct SYSTEM_EXTENDED_THREAD_INFORMATION {
+ ThreadInfo: SYSTEM_THREAD_INFORMATION,
+ StackBase: PVOID,
+ StackLimit: PVOID,
+ Win32StartAddress: PVOID,
+ TebBase: PTEB,
+ Reserved2: ULONG_PTR,
+ Reserved3: ULONG_PTR,
+ Reserved4: ULONG_PTR,
+}}
+pub type PSYSTEM_EXTENDED_THREAD_INFORMATION = *mut SYSTEM_EXTENDED_THREAD_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESS_INFORMATION {
+ NextEntryOffset: ULONG,
+ NumberOfThreads: ULONG,
+ WorkingSetPrivateSize: LARGE_INTEGER,
+ HardFaultCount: ULONG,
+ NumberOfThreadsHighWatermark: ULONG,
+ CycleTime: ULONGLONG,
+ CreateTime: LARGE_INTEGER,
+ UserTime: LARGE_INTEGER,
+ KernelTime: LARGE_INTEGER,
+ ImageName: UNICODE_STRING,
+ BasePriority: KPRIORITY,
+ UniqueProcessId: HANDLE,
+ InheritedFromUniqueProcessId: HANDLE,
+ HandleCount: ULONG,
+ SessionId: ULONG,
+ UniqueProcessKey: ULONG_PTR,
+ PeakVirtualSize: SIZE_T,
+ VirtualSize: SIZE_T,
+ PageFaultCount: ULONG,
+ PeakWorkingSetSize: SIZE_T,
+ WorkingSetSize: SIZE_T,
+ QuotaPeakPagedPoolUsage: SIZE_T,
+ QuotaPagedPoolUsage: SIZE_T,
+ QuotaPeakNonPagedPoolUsage: SIZE_T,
+ QuotaNonPagedPoolUsage: SIZE_T,
+ PagefileUsage: SIZE_T,
+ PeakPagefileUsage: SIZE_T,
+ PrivatePageCount: SIZE_T,
+ ReadOperationCount: LARGE_INTEGER,
+ WriteOperationCount: LARGE_INTEGER,
+ OtherOperationCount: LARGE_INTEGER,
+ ReadTransferCount: LARGE_INTEGER,
+ WriteTransferCount: LARGE_INTEGER,
+ OtherTransferCount: LARGE_INTEGER,
+ Threads: [SYSTEM_THREAD_INFORMATION; 1],
+}}
+pub type PSYSTEM_PROCESS_INFORMATION = *mut SYSTEM_PROCESS_INFORMATION;
+STRUCT!{struct SYSTEM_CALL_COUNT_INFORMATION {
+ Length: ULONG,
+ NumberOfTables: ULONG,
+}}
+pub type PSYSTEM_CALL_COUNT_INFORMATION = *mut SYSTEM_CALL_COUNT_INFORMATION;
+STRUCT!{struct SYSTEM_DEVICE_INFORMATION {
+ NumberOfDisks: ULONG,
+ NumberOfFloppies: ULONG,
+ NumberOfCdRoms: ULONG,
+ NumberOfTapes: ULONG,
+ NumberOfSerialPorts: ULONG,
+ NumberOfParallelPorts: ULONG,
+}}
+pub type PSYSTEM_DEVICE_INFORMATION = *mut SYSTEM_DEVICE_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION {
+ IdleTime: LARGE_INTEGER,
+ KernelTime: LARGE_INTEGER,
+ UserTime: LARGE_INTEGER,
+ DpcTime: LARGE_INTEGER,
+ InterruptTime: LARGE_INTEGER,
+ InterruptCount: ULONG,
+}}
+pub type PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = *mut SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;
+STRUCT!{struct SYSTEM_FLAGS_INFORMATION {
+ Flags: ULONG,
+}}
+pub type PSYSTEM_FLAGS_INFORMATION = *mut SYSTEM_FLAGS_INFORMATION;
+STRUCT!{struct SYSTEM_CALL_TIME_INFORMATION {
+ Length: ULONG,
+ TotalCalls: ULONG,
+ TimeOfCalls: [LARGE_INTEGER; 1],
+}}
+pub type PSYSTEM_CALL_TIME_INFORMATION = *mut SYSTEM_CALL_TIME_INFORMATION;
+STRUCT!{struct RTL_PROCESS_LOCK_INFORMATION {
+ Address: PVOID,
+ Type: USHORT,
+ CreatorBackTraceIndex: USHORT,
+ OwningThread: HANDLE,
+ LockCount: LONG,
+ ContentionCount: ULONG,
+ EntryCount: ULONG,
+ RecursionCount: LONG,
+ NumberOfWaitingShared: ULONG,
+ NumberOfWaitingExclusive: ULONG,
+}}
+pub type PRTL_PROCESS_LOCK_INFORMATION = *mut RTL_PROCESS_LOCK_INFORMATION;
+STRUCT!{struct RTL_PROCESS_LOCKS {
+ NumberOfLocks: ULONG,
+ Locks: [RTL_PROCESS_LOCK_INFORMATION; 1],
+}}
+pub type PRTL_PROCESS_LOCKS = *mut RTL_PROCESS_LOCKS;
+STRUCT!{struct RTL_PROCESS_BACKTRACE_INFORMATION {
+ SymbolicBackTrace: PCHAR,
+ TraceCount: ULONG,
+ Index: USHORT,
+ Depth: USHORT,
+ BackTrace: [PVOID; 32],
+}}
+pub type PRTL_PROCESS_BACKTRACE_INFORMATION = *mut RTL_PROCESS_BACKTRACE_INFORMATION;
+STRUCT!{struct RTL_PROCESS_BACKTRACES {
+ CommittedMemory: ULONG,
+ ReservedMemory: ULONG,
+ NumberOfBackTraceLookups: ULONG,
+ NumberOfBackTraces: ULONG,
+ BackTraces: [RTL_PROCESS_BACKTRACE_INFORMATION; 1],
+}}
+pub type PRTL_PROCESS_BACKTRACES = *mut RTL_PROCESS_BACKTRACES;
+STRUCT!{struct SYSTEM_HANDLE_TABLE_ENTRY_INFO {
+ UniqueProcessId: USHORT,
+ CreatorBackTraceIndex: USHORT,
+ ObjectTypeIndex: UCHAR,
+ HandleAttributes: UCHAR,
+ HandleValue: USHORT,
+ Object: PVOID,
+ GrantedAccess: ULONG,
+}}
+pub type PSYSTEM_HANDLE_TABLE_ENTRY_INFO = *mut SYSTEM_HANDLE_TABLE_ENTRY_INFO;
+STRUCT!{struct SYSTEM_HANDLE_INFORMATION {
+ NumberOfHandles: ULONG,
+ Handles: [SYSTEM_HANDLE_TABLE_ENTRY_INFO; 1],
+}}
+pub type PSYSTEM_HANDLE_INFORMATION = *mut SYSTEM_HANDLE_INFORMATION;
+STRUCT!{struct SYSTEM_OBJECTTYPE_INFORMATION {
+ NextEntryOffset: ULONG,
+ NumberOfObjects: ULONG,
+ NumberOfHandles: ULONG,
+ TypeIndex: ULONG,
+ InvalidAttributes: ULONG,
+ GenericMapping: GENERIC_MAPPING,
+ ValidAccessMask: ULONG,
+ PoolType: ULONG,
+ SecurityRequired: BOOLEAN,
+ WaitableObject: BOOLEAN,
+ TypeName: UNICODE_STRING,
+}}
+pub type PSYSTEM_OBJECTTYPE_INFORMATION = *mut SYSTEM_OBJECTTYPE_INFORMATION;
+STRUCT!{struct SYSTEM_OBJECT_INFORMATION {
+ NextEntryOffset: ULONG,
+ Object: PVOID,
+ CreatorUniqueProcess: HANDLE,
+ CreatorBackTraceIndex: USHORT,
+ Flags: USHORT,
+ PointerCount: LONG,
+ HandleCount: LONG,
+ PagedPoolCharge: ULONG,
+ NonPagedPoolCharge: ULONG,
+ ExclusiveProcessId: HANDLE,
+ SecurityDescriptor: PVOID,
+ NameInfo: UNICODE_STRING,
+}}
+pub type PSYSTEM_OBJECT_INFORMATION = *mut SYSTEM_OBJECT_INFORMATION;
+STRUCT!{struct SYSTEM_PAGEFILE_INFORMATION {
+ NextEntryOffset: ULONG,
+ TotalSize: ULONG,
+ TotalInUse: ULONG,
+ PeakUsage: ULONG,
+ PageFileName: UNICODE_STRING,
+}}
+pub type PSYSTEM_PAGEFILE_INFORMATION = *mut SYSTEM_PAGEFILE_INFORMATION;
+pub const MM_WORKING_SET_MAX_HARD_ENABLE: ULONG = 0x1;
+pub const MM_WORKING_SET_MAX_HARD_DISABLE: ULONG = 0x2;
+pub const MM_WORKING_SET_MIN_HARD_ENABLE: ULONG = 0x4;
+pub const MM_WORKING_SET_MIN_HARD_DISABLE: ULONG = 0x8;
+STRUCT!{struct SYSTEM_FILECACHE_INFORMATION {
+ CurrentSize: SIZE_T,
+ PeakSize: SIZE_T,
+ PageFaultCount: ULONG,
+ MinimumWorkingSet: SIZE_T,
+ MaximumWorkingSet: SIZE_T,
+ CurrentSizeIncludingTransitionInPages: SIZE_T,
+ PeakSizeIncludingTransitionInPages: SIZE_T,
+ TransitionRePurposeCount: ULONG,
+ Flags: ULONG,
+}}
+pub type PSYSTEM_FILECACHE_INFORMATION = *mut SYSTEM_FILECACHE_INFORMATION;
+STRUCT!{struct SYSTEM_BASIC_WORKING_SET_INFORMATION {
+ CurrentSize: SIZE_T,
+ PeakSize: SIZE_T,
+ PageFaultCount: ULONG,
+}}
+pub type PSYSTEM_BASIC_WORKING_SET_INFORMATION = *mut SYSTEM_BASIC_WORKING_SET_INFORMATION;
+UNION!{union SYSTEM_POOLTAG_u {
+ Tag: [UCHAR; 4],
+ TagUlong: ULONG,
+}}
+STRUCT!{struct SYSTEM_POOLTAG {
+ u: SYSTEM_POOLTAG_u,
+ PagedAllocs: ULONG,
+ PagedFrees: ULONG,
+ PagedUsed: SIZE_T,
+ NonPagedAllocs: ULONG,
+ NonPagedFrees: ULONG,
+ NonPagedUsed: SIZE_T,
+}}
+pub type PSYSTEM_POOLTAG = *mut SYSTEM_POOLTAG;
+STRUCT!{struct SYSTEM_POOLTAG_INFORMATION {
+ Count: ULONG,
+ TagInfo: [SYSTEM_POOLTAG; 1],
+}}
+pub type PSYSTEM_POOLTAG_INFORMATION = *mut SYSTEM_POOLTAG_INFORMATION;
+STRUCT!{struct SYSTEM_INTERRUPT_INFORMATION {
+ ContextSwitches: ULONG,
+ DpcCount: ULONG,
+ DpcRate: ULONG,
+ TimeIncrement: ULONG,
+ DpcBypassCount: ULONG,
+ ApcBypassCount: ULONG,
+}}
+pub type PSYSTEM_INTERRUPT_INFORMATION = *mut SYSTEM_INTERRUPT_INFORMATION;
+STRUCT!{struct SYSTEM_DPC_BEHAVIOR_INFORMATION {
+ Spare: ULONG,
+ DpcQueueDepth: ULONG,
+ MinimumDpcRate: ULONG,
+ AdjustDpcThreshold: ULONG,
+ IdealDpcRate: ULONG,
+}}
+pub type PSYSTEM_DPC_BEHAVIOR_INFORMATION = *mut SYSTEM_DPC_BEHAVIOR_INFORMATION;
+STRUCT!{struct SYSTEM_QUERY_TIME_ADJUST_INFORMATION {
+ TimeAdjustment: ULONG,
+ TimeIncrement: ULONG,
+ Enable: BOOLEAN,
+}}
+pub type PSYSTEM_QUERY_TIME_ADJUST_INFORMATION = *mut SYSTEM_QUERY_TIME_ADJUST_INFORMATION;
+STRUCT!{struct SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE {
+ TimeAdjustment: ULONGLONG,
+ TimeIncrement: ULONGLONG,
+ Enable: BOOLEAN,
+}}
+pub type PSYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE =
+ *mut SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE;
+STRUCT!{struct SYSTEM_SET_TIME_ADJUST_INFORMATION {
+ TimeAdjustment: ULONG,
+ Enable: BOOLEAN,
+}}
+pub type PSYSTEM_SET_TIME_ADJUST_INFORMATION = *mut SYSTEM_SET_TIME_ADJUST_INFORMATION;
+STRUCT!{struct SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE {
+ TimeAdjustment: ULONGLONG,
+ Enable: BOOLEAN,
+}}
+pub type PSYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE =
+ *mut SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE;
+ENUM!{enum EVENT_TRACE_INFORMATION_CLASS {
+ EventTraceKernelVersionInformation = 0,
+ EventTraceGroupMaskInformation = 1,
+ EventTracePerformanceInformation = 2,
+ EventTraceTimeProfileInformation = 3,
+ EventTraceSessionSecurityInformation = 4,
+ EventTraceSpinlockInformation = 5,
+ EventTraceStackTracingInformation = 6,
+ EventTraceExecutiveResourceInformation = 7,
+ EventTraceHeapTracingInformation = 8,
+ EventTraceHeapSummaryTracingInformation = 9,
+ EventTracePoolTagFilterInformation = 10,
+ EventTracePebsTracingInformation = 11,
+ EventTraceProfileConfigInformation = 12,
+ EventTraceProfileSourceListInformation = 13,
+ EventTraceProfileEventListInformation = 14,
+ EventTraceProfileCounterListInformation = 15,
+ EventTraceStackCachingInformation = 16,
+ EventTraceObjectTypeFilterInformation = 17,
+ EventTraceSoftRestartInformation = 18,
+ EventTraceLastBranchConfigurationInformation = 19,
+ EventTraceLastBranchEventListInformation = 20,
+ EventTraceProfileSourceAddInformation = 21,
+ EventTraceProfileSourceRemoveInformation = 22,
+ EventTraceProcessorTraceConfigurationInformation = 23,
+ EventTraceProcessorTraceEventListInformation = 24,
+ EventTraceCoverageSamplerInformation = 25,
+ MaxEventTraceInfoClass = 26,
+}}
+STRUCT!{struct EVENT_TRACE_VERSION_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ EventTraceKernelVersion: ULONG,
+}}
+pub type PEVENT_TRACE_VERSION_INFORMATION = *mut EVENT_TRACE_VERSION_INFORMATION;
+STRUCT!{struct PERFINFO_GROUPMASK {
+ Masks: [ULONG; 8],
+}}
+pub type PPERFINFO_GROUPMASK = *mut PERFINFO_GROUPMASK;
+STRUCT!{struct EVENT_TRACE_GROUPMASK_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ TraceHandle: HANDLE,
+ EventTraceGroupMasks: PERFINFO_GROUPMASK,
+}}
+pub type PEVENT_TRACE_GROUPMASK_INFORMATION = *mut EVENT_TRACE_GROUPMASK_INFORMATION;
+STRUCT!{struct EVENT_TRACE_PERFORMANCE_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ LogfileBytesWritten: LARGE_INTEGER,
+}}
+pub type PEVENT_TRACE_PERFORMANCE_INFORMATION = *mut EVENT_TRACE_PERFORMANCE_INFORMATION;
+STRUCT!{struct EVENT_TRACE_TIME_PROFILE_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ ProfileInterval: ULONG,
+}}
+pub type PEVENT_TRACE_TIME_PROFILE_INFORMATION = *mut EVENT_TRACE_TIME_PROFILE_INFORMATION;
+STRUCT!{struct EVENT_TRACE_SESSION_SECURITY_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ SecurityInformation: ULONG,
+ TraceHandle: HANDLE,
+ SecurityDescriptor: [UCHAR; 1],
+}}
+pub type PEVENT_TRACE_SESSION_SECURITY_INFORMATION = *mut EVENT_TRACE_SESSION_SECURITY_INFORMATION;
+STRUCT!{struct EVENT_TRACE_SPINLOCK_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ SpinLockSpinThreshold: ULONG,
+ SpinLockAcquireSampleRate: ULONG,
+ SpinLockContentionSampleRate: ULONG,
+ SpinLockHoldThreshold: ULONG,
+}}
+pub type PEVENT_TRACE_SPINLOCK_INFORMATION = *mut EVENT_TRACE_SPINLOCK_INFORMATION;
+STRUCT!{struct EVENT_TRACE_SYSTEM_EVENT_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ TraceHandle: HANDLE,
+ HookId: [ULONG; 1],
+}}
+pub type PEVENT_TRACE_SYSTEM_EVENT_INFORMATION = *mut EVENT_TRACE_SYSTEM_EVENT_INFORMATION;
+STRUCT!{struct EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ ReleaseSamplingRate: ULONG,
+ ContentionSamplingRate: ULONG,
+ NumberOfExcessiveTimeouts: ULONG,
+}}
+pub type PEVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION =
+ *mut EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION;
+STRUCT!{struct EVENT_TRACE_HEAP_TRACING_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ ProcessId: ULONG,
+}}
+pub type PEVENT_TRACE_HEAP_TRACING_INFORMATION = *mut EVENT_TRACE_HEAP_TRACING_INFORMATION;
+STRUCT!{struct EVENT_TRACE_TAG_FILTER_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ TraceHandle: HANDLE,
+ Filter: [ULONG; 1],
+}}
+pub type PEVENT_TRACE_TAG_FILTER_INFORMATION = *mut EVENT_TRACE_TAG_FILTER_INFORMATION;
+STRUCT!{struct EVENT_TRACE_PROFILE_COUNTER_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ TraceHandle: HANDLE,
+ ProfileSource: [ULONG; 1],
+}}
+pub type PEVENT_TRACE_PROFILE_COUNTER_INFORMATION = *mut EVENT_TRACE_PROFILE_COUNTER_INFORMATION;
+STRUCT!{struct EVENT_TRACE_PROFILE_LIST_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ Spare: ULONG,
+ Profile: [*mut PROFILE_SOURCE_INFO; 1],
+}}
+pub type PEVENT_TRACE_PROFILE_LIST_INFORMATION = *mut EVENT_TRACE_PROFILE_LIST_INFORMATION;
+STRUCT!{struct EVENT_TRACE_STACK_CACHING_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ TraceHandle: HANDLE,
+ Enabled: BOOLEAN,
+ Reserved: [UCHAR; 3],
+ CacheSize: ULONG,
+ BucketCount: ULONG,
+}}
+pub type PEVENT_TRACE_STACK_CACHING_INFORMATION = *mut EVENT_TRACE_STACK_CACHING_INFORMATION;
+STRUCT!{struct EVENT_TRACE_SOFT_RESTART_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ TraceHandle: HANDLE,
+ PersistTraceBuffers: BOOLEAN,
+ FileName: [WCHAR; 1],
+}}
+pub type PEVENT_TRACE_SOFT_RESTART_INFORMATION = *mut EVENT_TRACE_SOFT_RESTART_INFORMATION;
+STRUCT!{struct EVENT_TRACE_PROFILE_ADD_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ PerfEvtEventSelect: BOOLEAN,
+ PerfEvtUnitSelect: BOOLEAN,
+ PerfEvtType: ULONG,
+ CpuInfoHierarchy: [ULONG; 3],
+ InitialInterval: ULONG,
+ AllowsHalt: BOOLEAN,
+ Persist: BOOLEAN,
+ ProfileSourceDescription: [WCHAR; 1],
+}}
+pub type PEVENT_TRACE_PROFILE_ADD_INFORMATION = *mut EVENT_TRACE_PROFILE_ADD_INFORMATION;
+STRUCT!{struct EVENT_TRACE_PROFILE_REMOVE_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ ProfileSource: KPROFILE_SOURCE,
+ CpuInfoHierarchy: [ULONG; 3],
+}}
+pub type PEVENT_TRACE_PROFILE_REMOVE_INFORMATION = *mut EVENT_TRACE_PROFILE_REMOVE_INFORMATION;
+STRUCT!{struct EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION {
+ EventTraceInformationClass: EVENT_TRACE_INFORMATION_CLASS,
+ CoverageSamplerInformationClass: BOOLEAN,
+ MajorVersion: UCHAR,
+ MinorVersion: UCHAR,
+ Reserved: UCHAR,
+ SamplerHandle: HANDLE,
+}}
+pub type PEVENT_TRACE_COVERAGE_SAMPLER_INFORMATION = *mut EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION;
+STRUCT!{struct SYSTEM_EXCEPTION_INFORMATION {
+ AlignmentFixupCount: ULONG,
+ ExceptionDispatchCount: ULONG,
+ FloatingEmulationCount: ULONG,
+ ByteWordEmulationCount: ULONG,
+}}
+pub type PSYSTEM_EXCEPTION_INFORMATION = *mut SYSTEM_EXCEPTION_INFORMATION;
+STRUCT!{struct SYSTEM_KERNEL_DEBUGGER_INFORMATION {
+ KernelDebuggerEnabled: BOOLEAN,
+ KernelDebuggerNotPresent: BOOLEAN,
+}}
+pub type PSYSTEM_KERNEL_DEBUGGER_INFORMATION = *mut SYSTEM_KERNEL_DEBUGGER_INFORMATION;
+STRUCT!{struct SYSTEM_CONTEXT_SWITCH_INFORMATION {
+ ContextSwitches: ULONG,
+ FindAny: ULONG,
+ FindLast: ULONG,
+ FindIdeal: ULONG,
+ IdleAny: ULONG,
+ IdleCurrent: ULONG,
+ IdleLast: ULONG,
+ IdleIdeal: ULONG,
+ PreemptAny: ULONG,
+ PreemptCurrent: ULONG,
+ PreemptLast: ULONG,
+ SwitchToIdle: ULONG,
+}}
+pub type PSYSTEM_CONTEXT_SWITCH_INFORMATION = *mut SYSTEM_CONTEXT_SWITCH_INFORMATION;
+STRUCT!{struct SYSTEM_REGISTRY_QUOTA_INFORMATION {
+ RegistryQuotaAllowed: ULONG,
+ RegistryQuotaUsed: ULONG,
+ PagedPoolSize: SIZE_T,
+}}
+pub type PSYSTEM_REGISTRY_QUOTA_INFORMATION = *mut SYSTEM_REGISTRY_QUOTA_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_IDLE_INFORMATION {
+ IdleTime: ULONGLONG,
+ C1Time: ULONGLONG,
+ C2Time: ULONGLONG,
+ C3Time: ULONGLONG,
+ C1Transitions: ULONG,
+ C2Transitions: ULONG,
+ C3Transitions: ULONG,
+ Padding: ULONG,
+}}
+pub type PSYSTEM_PROCESSOR_IDLE_INFORMATION = *mut SYSTEM_PROCESSOR_IDLE_INFORMATION;
+STRUCT!{struct SYSTEM_LEGACY_DRIVER_INFORMATION {
+ VetoType: ULONG,
+ VetoList: UNICODE_STRING,
+}}
+pub type PSYSTEM_LEGACY_DRIVER_INFORMATION = *mut SYSTEM_LEGACY_DRIVER_INFORMATION;
+STRUCT!{struct SYSTEM_LOOKASIDE_INFORMATION {
+ CurrentDepth: USHORT,
+ MaximumDepth: USHORT,
+ TotalAllocates: ULONG,
+ AllocateMisses: ULONG,
+ TotalFrees: ULONG,
+ FreeMisses: ULONG,
+ Type: ULONG,
+ Tag: ULONG,
+ Size: ULONG,
+}}
+pub type PSYSTEM_LOOKASIDE_INFORMATION = *mut SYSTEM_LOOKASIDE_INFORMATION;
+STRUCT!{struct SYSTEM_RANGE_START_INFORMATION {
+ SystemRangeStart: PVOID,
+}}
+pub type PSYSTEM_RANGE_START_INFORMATION = *mut SYSTEM_RANGE_START_INFORMATION;
+STRUCT!{struct SYSTEM_VERIFIER_INFORMATION {
+ NextEntryOffset: ULONG,
+ Level: ULONG,
+ DriverName: UNICODE_STRING,
+ RaiseIrqls: ULONG,
+ AcquireSpinLocks: ULONG,
+ SynchronizeExecutions: ULONG,
+ AllocationsAttempted: ULONG,
+ AllocationsSucceeded: ULONG,
+ AllocationsSucceededSpecialPool: ULONG,
+ AllocationsWithNoTag: ULONG,
+ TrimRequests: ULONG,
+ Trims: ULONG,
+ AllocationsFailed: ULONG,
+ AllocationsFailedDeliberately: ULONG,
+ Loads: ULONG,
+ Unloads: ULONG,
+ UnTrackedPool: ULONG,
+ CurrentPagedPoolAllocations: ULONG,
+ CurrentNonPagedPoolAllocations: ULONG,
+ PeakPagedPoolAllocations: ULONG,
+ PeakNonPagedPoolAllocations: ULONG,
+ PagedPoolUsageInBytes: SIZE_T,
+ NonPagedPoolUsageInBytes: SIZE_T,
+ PeakPagedPoolUsageInBytes: SIZE_T,
+ PeakNonPagedPoolUsageInBytes: SIZE_T,
+}}
+pub type PSYSTEM_VERIFIER_INFORMATION = *mut SYSTEM_VERIFIER_INFORMATION;
+STRUCT!{struct SYSTEM_SESSION_PROCESS_INFORMATION {
+ SessionId: ULONG,
+ SizeOfBuf: ULONG,
+ Buffer: PVOID,
+}}
+pub type PSYSTEM_SESSION_PROCESS_INFORMATION = *mut SYSTEM_SESSION_PROCESS_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_POWER_INFORMATION {
+ CurrentFrequency: UCHAR,
+ ThermalLimitFrequency: UCHAR,
+ ConstantThrottleFrequency: UCHAR,
+ DegradedThrottleFrequency: UCHAR,
+ LastBusyFrequency: UCHAR,
+ LastC3Frequency: UCHAR,
+ LastAdjustedBusyFrequency: UCHAR,
+ ProcessorMinThrottle: UCHAR,
+ ProcessorMaxThrottle: UCHAR,
+ NumberOfFrequencies: ULONG,
+ PromotionCount: ULONG,
+ DemotionCount: ULONG,
+ ErrorCount: ULONG,
+ RetryCount: ULONG,
+ CurrentFrequencyTime: ULONGLONG,
+ CurrentProcessorTime: ULONGLONG,
+ CurrentProcessorIdleTime: ULONGLONG,
+ LastProcessorTime: ULONGLONG,
+ LastProcessorIdleTime: ULONGLONG,
+ Energy: ULONGLONG,
+}}
+pub type PSYSTEM_PROCESSOR_POWER_INFORMATION = *mut SYSTEM_PROCESSOR_POWER_INFORMATION;
+STRUCT!{struct SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX {
+ Object: PVOID,
+ UniqueProcessId: ULONG_PTR,
+ HandleValue: ULONG_PTR,
+ GrantedAccess: ULONG,
+ CreatorBackTraceIndex: USHORT,
+ ObjectTypeIndex: USHORT,
+ HandleAttributes: ULONG,
+ Reserved: ULONG,
+}}
+pub type PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX = *mut SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX;
+STRUCT!{struct SYSTEM_HANDLE_INFORMATION_EX {
+ NumberOfHandles: ULONG_PTR,
+ Reserved: ULONG_PTR,
+ Handles: [SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX; 1],
+}}
+pub type PSYSTEM_HANDLE_INFORMATION_EX = *mut SYSTEM_HANDLE_INFORMATION_EX;
+UNION!{union SYSTEM_BIGPOOL_ENTRY_u1 {
+ VirtualAddress: PVOID,
+ Bitfields: ULONG_PTR,
+}}
+UNION!{union SYSTEM_BIGPOOL_ENTRY_u2 {
+ Tag: [UCHAR; 4],
+ TagUlong: ULONG,
+}}
+BITFIELD!{unsafe SYSTEM_BIGPOOL_ENTRY_u1 Bitfields: ULONG_PTR [
+ NonPaged set_NonPaged[0..1],
+]}
+STRUCT!{struct SYSTEM_BIGPOOL_ENTRY {
+ u1: SYSTEM_BIGPOOL_ENTRY_u1,
+ SizeInBytes: SIZE_T,
+ u2: SYSTEM_BIGPOOL_ENTRY_u2,
+}}
+pub type PSYSTEM_BIGPOOL_ENTRY = *mut SYSTEM_BIGPOOL_ENTRY;
+STRUCT!{struct SYSTEM_BIGPOOL_INFORMATION {
+ Count: ULONG,
+ AllocatedInfo: [SYSTEM_BIGPOOL_ENTRY; 1],
+}}
+pub type PSYSTEM_BIGPOOL_INFORMATION = *mut SYSTEM_BIGPOOL_INFORMATION;
+UNION!{union SYSTEM_POOL_ENTRY_u {
+ Tag: [UCHAR; 4],
+ TagUlong: ULONG,
+ ProcessChargedQuota: PVOID,
+}}
+STRUCT!{struct SYSTEM_POOL_ENTRY {
+ Allocated: BOOLEAN,
+ Spare0: BOOLEAN,
+ AllocatorBackTraceIndex: USHORT,
+ Size: ULONG,
+ u: SYSTEM_POOL_ENTRY_u,
+}}
+pub type PSYSTEM_POOL_ENTRY = *mut SYSTEM_POOL_ENTRY;
+STRUCT!{struct SYSTEM_POOL_INFORMATION {
+ TotalSize: SIZE_T,
+ FirstEntry: PVOID,
+ EntryOverhead: USHORT,
+ PoolTagPresent: BOOLEAN,
+ Spare0: BOOLEAN,
+ NumberOfEntries: ULONG,
+ Entries: [SYSTEM_POOL_ENTRY; 1],
+}}
+pub type PSYSTEM_POOL_INFORMATION = *mut SYSTEM_POOL_INFORMATION;
+STRUCT!{struct SYSTEM_SESSION_POOLTAG_INFORMATION {
+ NextEntryOffset: SIZE_T,
+ SessionId: ULONG,
+ Count: ULONG,
+ TagInfo: [SYSTEM_POOLTAG; 1],
+}}
+pub type PSYSTEM_SESSION_POOLTAG_INFORMATION = *mut SYSTEM_SESSION_POOLTAG_INFORMATION;
+STRUCT!{struct SYSTEM_SESSION_MAPPED_VIEW_INFORMATION {
+ NextEntryOffset: SIZE_T,
+ SessionId: ULONG,
+ ViewFailures: ULONG,
+ NumberOfBytesAvailable: SIZE_T,
+ NumberOfBytesAvailableContiguous: SIZE_T,
+}}
+pub type PSYSTEM_SESSION_MAPPED_VIEW_INFORMATION = *mut SYSTEM_SESSION_MAPPED_VIEW_INFORMATION;
+ENUM!{enum SYSTEM_FIRMWARE_TABLE_ACTION {
+ SystemFirmwareTableEnumerate = 0,
+ SystemFirmwareTableGet = 1,
+ SystemFirmwareTableMax = 2,
+}}
+STRUCT!{struct SYSTEM_FIRMWARE_TABLE_INFORMATION {
+ ProviderSignature: ULONG,
+ Action: SYSTEM_FIRMWARE_TABLE_ACTION,
+ TableID: ULONG,
+ TableBufferLength: ULONG,
+ TableBuffer: [UCHAR; 1],
+}}
+pub type PSYSTEM_FIRMWARE_TABLE_INFORMATION = *mut SYSTEM_FIRMWARE_TABLE_INFORMATION;
+STRUCT!{struct SYSTEM_MEMORY_LIST_INFORMATION {
+ ZeroPageCount: ULONG_PTR,
+ FreePageCount: ULONG_PTR,
+ ModifiedPageCount: ULONG_PTR,
+ ModifiedNoWritePageCount: ULONG_PTR,
+ BadPageCount: ULONG_PTR,
+ PageCountByPriority: [ULONG_PTR; 8],
+ RepurposedPagesByPriority: [ULONG_PTR; 8],
+ ModifiedPageCountPageFile: ULONG_PTR,
+}}
+pub type PSYSTEM_MEMORY_LIST_INFORMATION = *mut SYSTEM_MEMORY_LIST_INFORMATION;
+ENUM!{enum SYSTEM_MEMORY_LIST_COMMAND {
+ MemoryCaptureAccessedBits = 0,
+ MemoryCaptureAndResetAccessedBits = 1,
+ MemoryEmptyWorkingSets = 2,
+ MemoryFlushModifiedList = 3,
+ MemoryPurgeStandbyList = 4,
+ MemoryPurgeLowPriorityStandbyList = 5,
+ MemoryCommandMax = 6,
+}}
+STRUCT!{struct SYSTEM_THREAD_CID_PRIORITY_INFORMATION {
+ ClientId: CLIENT_ID,
+ Priority: KPRIORITY,
+}}
+pub type PSYSTEM_THREAD_CID_PRIORITY_INFORMATION = *mut SYSTEM_THREAD_CID_PRIORITY_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION {
+ CycleTime: ULONGLONG,
+}}
+pub type PSYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION =
+ *mut SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION;
+STRUCT!{struct SYSTEM_REF_TRACE_INFORMATION {
+ TraceEnable: BOOLEAN,
+ TracePermanent: BOOLEAN,
+ TraceProcessName: UNICODE_STRING,
+ TracePoolTags: UNICODE_STRING,
+}}
+pub type PSYSTEM_REF_TRACE_INFORMATION = *mut SYSTEM_REF_TRACE_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESS_ID_INFORMATION {
+ ProcessId: HANDLE,
+ ImageName: UNICODE_STRING,
+}}
+pub type PSYSTEM_PROCESS_ID_INFORMATION = *mut SYSTEM_PROCESS_ID_INFORMATION;
+STRUCT!{struct SYSTEM_BOOT_ENVIRONMENT_INFORMATION {
+ BootIdentifier: GUID,
+ FirmwareType: FIRMWARE_TYPE,
+ BootFlags: ULONGLONG,
+}}
+BITFIELD!{SYSTEM_BOOT_ENVIRONMENT_INFORMATION BootFlags: ULONGLONG [
+ DbgMenuOsSelection set_DbgMenuOsSelection[0..1],
+ DbgHiberBoot set_DbgHiberBoot[1..2],
+ DbgSoftBoot set_DbgSoftBoot[2..3],
+ DbgMeasuredLaunch set_DbgMeasuredLaunch[3..4],
+]}
+pub type PSYSTEM_BOOT_ENVIRONMENT_INFORMATION = *mut SYSTEM_BOOT_ENVIRONMENT_INFORMATION;
+STRUCT!{struct SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION {
+ FlagsToEnable: ULONG,
+ FlagsToDisable: ULONG,
+}}
+pub type PSYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION =
+ *mut SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION;
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+STRUCT!{struct SYSTEM_VERIFIER_INFORMATION_EX {
+ VerifyMode: ULONG,
+ OptionChanges: ULONG,
+ PreviousBucketName: UNICODE_STRING,
+ IrpCancelTimeoutMsec: ULONG,
+ VerifierExtensionEnabled: ULONG,
+ Reserved: [ULONG; 1],
+}}
+#[cfg(target_arch = "x86")]
+STRUCT!{struct SYSTEM_VERIFIER_INFORMATION_EX {
+ VerifyMode: ULONG,
+ OptionChanges: ULONG,
+ PreviousBucketName: UNICODE_STRING,
+ IrpCancelTimeoutMsec: ULONG,
+ VerifierExtensionEnabled: ULONG,
+ Reserved: [ULONG; 3],
+}}
+pub type PSYSTEM_VERIFIER_INFORMATION_EX = *mut SYSTEM_VERIFIER_INFORMATION_EX;
+STRUCT!{struct SYSTEM_SYSTEM_PARTITION_INFORMATION {
+ SystemPartition: UNICODE_STRING,
+}}
+pub type PSYSTEM_SYSTEM_PARTITION_INFORMATION = *mut SYSTEM_SYSTEM_PARTITION_INFORMATION;
+STRUCT!{struct SYSTEM_SYSTEM_DISK_INFORMATION {
+ SystemDisk: UNICODE_STRING,
+}}
+pub type PSYSTEM_SYSTEM_DISK_INFORMATION = *mut SYSTEM_SYSTEM_DISK_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT {
+ Hits: ULONGLONG,
+ PercentFrequency: UCHAR,
+}}
+pub type PSYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT = *mut SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT;
+STRUCT!{struct SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT_WIN8 {
+ Hits: ULONG,
+ PercentFrequency: UCHAR,
+}}
+pub type PSYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT_WIN8 =
+ *mut SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT_WIN8;
+STRUCT!{struct SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION {
+ ProcessorNumber: ULONG,
+ StateCount: ULONG,
+ States: [SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT; 1],
+}}
+pub type PSYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION =
+ *mut SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION;
+STRUCT!{struct SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION {
+ ProcessorCount: ULONG,
+ Offsets: [ULONG; 1],
+}}
+pub type PSYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION =
+ *mut SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION;
+STRUCT!{struct SYSTEM_CODEINTEGRITY_INFORMATION {
+ Length: ULONG,
+ CodeIntegrityOptions: ULONG,
+}}
+pub type PSYSTEM_CODEINTEGRITY_INFORMATION = *mut SYSTEM_CODEINTEGRITY_INFORMATION;
+ENUM!{enum SYSTEM_VA_TYPE {
+ SystemVaTypeAll = 0,
+ SystemVaTypeNonPagedPool = 1,
+ SystemVaTypePagedPool = 2,
+ SystemVaTypeSystemCache = 3,
+ SystemVaTypeSystemPtes = 4,
+ SystemVaTypeSessionSpace = 5,
+ SystemVaTypeMax = 6,
+}}
+pub type PSYSTEM_VA_TYPE = *mut SYSTEM_VA_TYPE;
+STRUCT!{struct SYSTEM_VA_LIST_INFORMATION {
+ VirtualSize: SIZE_T,
+ VirtualPeak: SIZE_T,
+ VirtualLimit: SIZE_T,
+ AllocationFailures: SIZE_T,
+}}
+pub type PSYSTEM_VA_LIST_INFORMATION = *mut SYSTEM_VA_LIST_INFORMATION;
+STRUCT!{struct SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS {
+ KeyHandle: HANDLE,
+ ValueNamePointer: PUNICODE_STRING,
+ RequiredLengthPointer: PULONG,
+ Buffer: PUCHAR,
+ BufferLength: ULONG,
+ Type: ULONG,
+ AppendBuffer: PUCHAR,
+ AppendBufferLength: ULONG,
+ CreateIfDoesntExist: BOOLEAN,
+ TruncateExistingValue: BOOLEAN,
+}}
+pub type PSYSTEM_REGISTRY_APPEND_STRING_PARAMETERS = *mut SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS;
+STRUCT!{struct SYSTEM_VHD_BOOT_INFORMATION {
+ OsDiskIsVhd: BOOLEAN,
+ OsVhdFilePathOffset: ULONG,
+ OsVhdParentVolume: [WCHAR; ANYSIZE_ARRAY],
+}}
+pub type PSYSTEM_VHD_BOOT_INFORMATION = *mut SYSTEM_VHD_BOOT_INFORMATION;
+STRUCT!{struct SYSTEM_LOW_PRIORITY_IO_INFORMATION {
+ LowPriReadOperations: ULONG,
+ LowPriWriteOperations: ULONG,
+ KernelBumpedToNormalOperations: ULONG,
+ LowPriPagingReadOperations: ULONG,
+ KernelPagingReadsBumpedToNormal: ULONG,
+ LowPriPagingWriteOperations: ULONG,
+ KernelPagingWritesBumpedToNormal: ULONG,
+ BoostedIrpCount: ULONG,
+ BoostedPagingIrpCount: ULONG,
+ BlanketBoostCount: ULONG,
+}}
+pub type PSYSTEM_LOW_PRIORITY_IO_INFORMATION = *mut SYSTEM_LOW_PRIORITY_IO_INFORMATION;
+ENUM!{enum TPM_BOOT_ENTROPY_RESULT_CODE {
+ TpmBootEntropyStructureUninitialized = 0,
+ TpmBootEntropyDisabledByPolicy = 1,
+ TpmBootEntropyNoTpmFound = 2,
+ TpmBootEntropyTpmError = 3,
+ TpmBootEntropySuccess = 4,
+}}
+STRUCT!{struct TPM_BOOT_ENTROPY_NT_RESULT {
+ Policy: ULONGLONG,
+ ResultCode: TPM_BOOT_ENTROPY_RESULT_CODE,
+ ResultStatus: NTSTATUS,
+ Time: ULONGLONG,
+ EntropyLength: ULONG,
+ EntropyData: [UCHAR; 40],
+}}
+pub type PTPM_BOOT_ENTROPY_NT_RESULT = *mut TPM_BOOT_ENTROPY_NT_RESULT;
+STRUCT!{struct SYSTEM_VERIFIER_COUNTERS_INFORMATION {
+ Legacy: SYSTEM_VERIFIER_INFORMATION,
+ RaiseIrqls: ULONG,
+ AcquireSpinLocks: ULONG,
+ SynchronizeExecutions: ULONG,
+ AllocationsWithNoTag: ULONG,
+ AllocationsFailed: ULONG,
+ AllocationsFailedDeliberately: ULONG,
+ LockedBytes: SIZE_T,
+ PeakLockedBytes: SIZE_T,
+ MappedLockedBytes: SIZE_T,
+ PeakMappedLockedBytes: SIZE_T,
+ MappedIoSpaceBytes: SIZE_T,
+ PeakMappedIoSpaceBytes: SIZE_T,
+ PagesForMdlBytes: SIZE_T,
+ PeakPagesForMdlBytes: SIZE_T,
+ ContiguousMemoryBytes: SIZE_T,
+ PeakContiguousMemoryBytes: SIZE_T,
+ ExecutePoolTypes: ULONG,
+ ExecutePageProtections: ULONG,
+ ExecutePageMappings: ULONG,
+ ExecuteWriteSections: ULONG,
+ SectionAlignmentFailures: ULONG,
+ UnsupportedRelocs: ULONG,
+ IATInExecutableSection: ULONG,
+}}
+pub type PSYSTEM_VERIFIER_COUNTERS_INFORMATION = *mut SYSTEM_VERIFIER_COUNTERS_INFORMATION;
+STRUCT!{struct SYSTEM_ACPI_AUDIT_INFORMATION {
+ RsdpCount: ULONG,
+ Bitfields: ULONG,
+}}
+BITFIELD!{SYSTEM_ACPI_AUDIT_INFORMATION Bitfields: ULONG [
+ SameRsdt set_SameRsdt[0..1],
+ SlicPresent set_SlicPresent[1..2],
+ SlicDifferent set_SlicDifferent[2..3],
+]}
+pub type PSYSTEM_ACPI_AUDIT_INFORMATION = *mut SYSTEM_ACPI_AUDIT_INFORMATION;
+STRUCT!{struct SYSTEM_BASIC_PERFORMANCE_INFORMATION {
+ AvailablePages: SIZE_T,
+ CommittedPages: SIZE_T,
+ CommitLimit: SIZE_T,
+ PeakCommitment: SIZE_T,
+}}
+pub type PSYSTEM_BASIC_PERFORMANCE_INFORMATION = *mut SYSTEM_BASIC_PERFORMANCE_INFORMATION;
+STRUCT!{struct QUERY_PERFORMANCE_COUNTER_FLAGS {
+ ul: ULONG,
+}}
+BITFIELD!{QUERY_PERFORMANCE_COUNTER_FLAGS ul: ULONG [
+ KernelTransition set_KernelTransition[0..1],
+ Reserved set_Reserved[1..32],
+]}
+STRUCT!{struct SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION {
+ Version: ULONG,
+ Flags: QUERY_PERFORMANCE_COUNTER_FLAGS,
+ ValidFlags: QUERY_PERFORMANCE_COUNTER_FLAGS,
+}}
+pub type PSYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION =
+ *mut SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION;
+ENUM!{enum SYSTEM_PIXEL_FORMAT {
+ SystemPixelFormatUnknown = 0,
+ SystemPixelFormatR8G8B8 = 1,
+ SystemPixelFormatR8G8B8X8 = 2,
+ SystemPixelFormatB8G8R8 = 3,
+ SystemPixelFormatB8G8R8X8 = 4,
+}}
+STRUCT!{struct SYSTEM_BOOT_GRAPHICS_INFORMATION {
+ FrameBuffer: LARGE_INTEGER,
+ Width: ULONG,
+ Height: ULONG,
+ PixelStride: ULONG,
+ Flags: ULONG,
+ Format: SYSTEM_PIXEL_FORMAT,
+ DisplayRotation: ULONG,
+}}
+pub type PSYSTEM_BOOT_GRAPHICS_INFORMATION = *mut SYSTEM_BOOT_GRAPHICS_INFORMATION;
+STRUCT!{struct MEMORY_SCRUB_INFORMATION {
+ Handle: HANDLE,
+ PagesScrubbed: ULONG,
+}}
+pub type PMEMORY_SCRUB_INFORMATION = *mut MEMORY_SCRUB_INFORMATION;
+STRUCT!{struct PEBS_DS_SAVE_AREA {
+ BtsBufferBase: ULONGLONG,
+ BtsIndex: ULONGLONG,
+ BtsAbsoluteMaximum: ULONGLONG,
+ BtsInterruptThreshold: ULONGLONG,
+ PebsBufferBase: ULONGLONG,
+ PebsIndex: ULONGLONG,
+ PebsAbsoluteMaximum: ULONGLONG,
+ PebsInterruptThreshold: ULONGLONG,
+ PebsCounterReset0: ULONGLONG,
+ PebsCounterReset1: ULONGLONG,
+ PebsCounterReset2: ULONGLONG,
+ PebsCounterReset3: ULONGLONG,
+}}
+pub type PPEBS_DS_SAVE_AREA = *mut PEBS_DS_SAVE_AREA;
+STRUCT!{struct PROCESSOR_PROFILE_CONTROL_AREA {
+ PebsDsSaveArea: PEBS_DS_SAVE_AREA,
+}}
+pub type PPROCESSOR_PROFILE_CONTROL_AREA = *mut PROCESSOR_PROFILE_CONTROL_AREA;
+STRUCT!{struct SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA {
+ ProcessorProfileControlArea: PROCESSOR_PROFILE_CONTROL_AREA,
+ Allocate: BOOLEAN,
+}}
+pub type PSYSTEM_PROCESSOR_PROFILE_CONTROL_AREA = *mut SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA;
+STRUCT!{struct MEMORY_COMBINE_INFORMATION {
+ Handle: HANDLE,
+ PagesCombined: ULONG_PTR,
+}}
+pub type PMEMORY_COMBINE_INFORMATION = *mut MEMORY_COMBINE_INFORMATION;
+pub const MEMORY_COMBINE_FLAGS_COMMON_PAGES_ONLY: ULONG = 0x4;
+STRUCT!{struct MEMORY_COMBINE_INFORMATION_EX {
+ Handle: HANDLE,
+ PagesCombined: ULONG_PTR,
+ Flags: ULONG,
+}}
+pub type PMEMORY_COMBINE_INFORMATION_EX = *mut MEMORY_COMBINE_INFORMATION_EX;
+STRUCT!{struct MEMORY_COMBINE_INFORMATION_EX2 {
+ Handle: HANDLE,
+ PagesCombined: ULONG_PTR,
+ Flags: ULONG,
+ ProcessHandle: HANDLE,
+}}
+pub type PMEMORY_COMBINE_INFORMATION_EX2 = *mut MEMORY_COMBINE_INFORMATION_EX2;
+STRUCT!{struct SYSTEM_CONSOLE_INFORMATION {
+ Bitfields: ULONG,
+}}
+BITFIELD!{SYSTEM_CONSOLE_INFORMATION Bitfields: ULONG [
+ DriverLoaded set_DriverLoaded[0..1],
+ Spare set_Spare[1..32],
+]}
+pub type PSYSTEM_CONSOLE_INFORMATION = *mut SYSTEM_CONSOLE_INFORMATION;
+STRUCT!{struct SYSTEM_PLATFORM_BINARY_INFORMATION {
+ PhysicalAddress: ULONG64,
+ HandoffBuffer: PVOID,
+ CommandLineBuffer: PVOID,
+ HandoffBufferSize: ULONG,
+ CommandLineBufferSize: ULONG,
+}}
+pub type PSYSTEM_PLATFORM_BINARY_INFORMATION = *mut SYSTEM_PLATFORM_BINARY_INFORMATION;
+STRUCT!{struct SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION {
+ NumberOfLogicalProcessors: ULONG,
+ NumberOfCores: ULONG,
+}}
+pub type PSYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION =
+ *mut SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION;
+STRUCT!{struct SYSTEM_DEVICE_DATA_INFORMATION {
+ DeviceId: UNICODE_STRING,
+ DataName: UNICODE_STRING,
+ DataType: ULONG,
+ DataBufferLength: ULONG,
+ DataBuffer: PVOID,
+}}
+pub type PSYSTEM_DEVICE_DATA_INFORMATION = *mut SYSTEM_DEVICE_DATA_INFORMATION;
+STRUCT!{struct PHYSICAL_CHANNEL_RUN {
+ NodeNumber: ULONG,
+ ChannelNumber: ULONG,
+ BasePage: ULONGLONG,
+ PageCount: ULONGLONG,
+ Flags: ULONG,
+}}
+pub type PPHYSICAL_CHANNEL_RUN = *mut PHYSICAL_CHANNEL_RUN;
+STRUCT!{struct SYSTEM_MEMORY_TOPOLOGY_INFORMATION {
+ NumberOfRuns: ULONGLONG,
+ NumberOfNodes: ULONG,
+ NumberOfChannels: ULONG,
+ Run: [PHYSICAL_CHANNEL_RUN; 1],
+}}
+pub type PSYSTEM_MEMORY_TOPOLOGY_INFORMATION = *mut SYSTEM_MEMORY_TOPOLOGY_INFORMATION;
+STRUCT!{struct SYSTEM_MEMORY_CHANNEL_INFORMATION {
+ ChannelNumber: ULONG,
+ ChannelHeatIndex: ULONG,
+ TotalPageCount: ULONGLONG,
+ ZeroPageCount: ULONGLONG,
+ FreePageCount: ULONGLONG,
+ StandbyPageCount: ULONGLONG,
+}}
+pub type PSYSTEM_MEMORY_CHANNEL_INFORMATION = *mut SYSTEM_MEMORY_CHANNEL_INFORMATION;
+STRUCT!{struct SYSTEM_BOOT_LOGO_INFORMATION {
+ Flags: ULONG,
+ BitmapOffset: ULONG,
+}}
+pub type PSYSTEM_BOOT_LOGO_INFORMATION = *mut SYSTEM_BOOT_LOGO_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX {
+ IdleTime: LARGE_INTEGER,
+ KernelTime: LARGE_INTEGER,
+ UserTime: LARGE_INTEGER,
+ DpcTime: LARGE_INTEGER,
+ InterruptTime: LARGE_INTEGER,
+ InterruptCount: ULONG,
+ Spare0: ULONG,
+ AvailableTime: LARGE_INTEGER,
+ Spare1: LARGE_INTEGER,
+ Spare2: LARGE_INTEGER,
+}}
+pub type PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX =
+ *mut SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX;
+STRUCT!{struct SYSTEM_SECUREBOOT_POLICY_INFORMATION {
+ PolicyPublisher: GUID,
+ PolicyVersion: ULONG,
+ PolicyOptions: ULONG,
+}}
+pub type PSYSTEM_SECUREBOOT_POLICY_INFORMATION = *mut SYSTEM_SECUREBOOT_POLICY_INFORMATION;
+STRUCT!{struct SYSTEM_PAGEFILE_INFORMATION_EX {
+ Info: SYSTEM_PAGEFILE_INFORMATION,
+ MinimumSize: ULONG,
+ MaximumSize: ULONG,
+}}
+pub type PSYSTEM_PAGEFILE_INFORMATION_EX = *mut SYSTEM_PAGEFILE_INFORMATION_EX;
+STRUCT!{struct SYSTEM_SECUREBOOT_INFORMATION {
+ SecureBootEnabled: BOOLEAN,
+ SecureBootCapable: BOOLEAN,
+}}
+pub type PSYSTEM_SECUREBOOT_INFORMATION = *mut SYSTEM_SECUREBOOT_INFORMATION;
+STRUCT!{struct PROCESS_DISK_COUNTERS {
+ BytesRead: ULONGLONG,
+ BytesWritten: ULONGLONG,
+ ReadOperationCount: ULONGLONG,
+ WriteOperationCount: ULONGLONG,
+ FlushOperationCount: ULONGLONG,
+}}
+pub type PPROCESS_DISK_COUNTERS = *mut PROCESS_DISK_COUNTERS;
+UNION!{union ENERGY_STATE_DURATION_u {
+ Value: ULONGLONG,
+ LastChangeTime: ULONG,
+}}
+UNION!{union ENERGY_STATE_DURATION {
+ u: ENERGY_STATE_DURATION_u,
+ BitFields: ULONG,
+}}
+pub type PENERGY_STATE_DURATION = *mut ENERGY_STATE_DURATION;
+BITFIELD!{unsafe ENERGY_STATE_DURATION BitFields: ULONG [
+ Duration set_Duration[0..31],
+ IsInState set_IsInState[31..32],
+]}
+STRUCT!{struct PROCESS_ENERGY_VALUES {
+ Cycles: [[ULONGLONG; 4]; 2],
+ DiskEnergy: ULONGLONG,
+ NetworkTailEnergy: ULONGLONG,
+ MBBTailEnergy: ULONGLONG,
+ NetworkTxRxBytes: ULONGLONG,
+ MBBTxRxBytes: ULONGLONG,
+ ForegroundDuration: ENERGY_STATE_DURATION,
+ DesktopVisibleDuration: ENERGY_STATE_DURATION,
+ PSMForegroundDuration: ENERGY_STATE_DURATION,
+ CompositionRendered: ULONG,
+ CompositionDirtyGenerated: ULONG,
+ CompositionDirtyPropagated: ULONG,
+ Reserved1: ULONG,
+ AttributedCycles: [[ULONGLONG; 2]; 4],
+ WorkOnBehalfCycles: [[ULONGLONG; 2]; 4],
+}}
+pub type PPROCESS_ENERGY_VALUES = *mut PROCESS_ENERGY_VALUES;
+STRUCT!{struct TIMELINE_BITMAP {
+ Value: ULONGLONG,
+ EndTime: ULONG,
+ Bitmap: ULONG,
+}}
+pub type PTIMELINE_BITMAP = *mut TIMELINE_BITMAP;
+STRUCT!{struct PROCESS_ENERGY_VALUES_EXTENSION_Timelines {
+ CpuTimeline: TIMELINE_BITMAP,
+ DiskTimeline: TIMELINE_BITMAP,
+ NetworkTimeline: TIMELINE_BITMAP,
+ MBBTimeline: TIMELINE_BITMAP,
+ ForegroundTimeline: TIMELINE_BITMAP,
+ DesktopVisibleTimeline: TIMELINE_BITMAP,
+ CompositionRenderedTimeline: TIMELINE_BITMAP,
+ CompositionDirtyGeneratedTimeline: TIMELINE_BITMAP,
+ CompositionDirtyPropagatedTimeline: TIMELINE_BITMAP,
+ InputTimeline: TIMELINE_BITMAP,
+ AudioInTimeline: TIMELINE_BITMAP,
+ AudioOutTimeline: TIMELINE_BITMAP,
+ DisplayRequiredTimeline: TIMELINE_BITMAP,
+ KeyboardInputTimeline: TIMELINE_BITMAP,
+}}
+STRUCT!{struct PROCESS_ENERGY_VALUES_EXTENSION_Durations {
+ InputDuration: ENERGY_STATE_DURATION,
+ AudioInDuration: ENERGY_STATE_DURATION,
+ AudioOutDuration: ENERGY_STATE_DURATION,
+ DisplayRequiredDuration: ENERGY_STATE_DURATION,
+ PSMBackgroundDuration: ENERGY_STATE_DURATION,
+}}
+STRUCT!{struct PROCESS_ENERGY_VALUES_EXTENSION {
+ Timelines: PROCESS_ENERGY_VALUES_EXTENSION_Timelines,
+ Durations: PROCESS_ENERGY_VALUES_EXTENSION_Durations,
+ KeyboardInput: ULONG,
+ MouseInput: ULONG,
+}}
+pub type PPROCESS_ENERGY_VALUES_EXTENSION = *mut PROCESS_ENERGY_VALUES_EXTENSION;
+STRUCT!{struct PROCESS_EXTENDED_ENERGY_VALUES {
+ Base: PROCESS_ENERGY_VALUES,
+ Extension: PROCESS_ENERGY_VALUES_EXTENSION,
+}}
+pub type PPROCESS_EXTENDED_ENERGY_VALUES = *mut PROCESS_EXTENDED_ENERGY_VALUES;
+ENUM!{enum SYSTEM_PROCESS_CLASSIFICATION {
+ SystemProcessClassificationNormal = 0,
+ SystemProcessClassificationSystem = 1,
+ SystemProcessClassificationSecureSystem = 2,
+ SystemProcessClassificationMemCompression = 3,
+ SystemProcessClassificationRegistry = 4,
+ SystemProcessClassificationMaximum = 5,
+}}
+STRUCT!{struct SYSTEM_PROCESS_INFORMATION_EXTENSION {
+ DiskCounters: PROCESS_DISK_COUNTERS,
+ ContextSwitches: ULONGLONG,
+ Flags: ULONG,
+ UserSidOffset: ULONG,
+ PackageFullNameOffset: ULONG,
+ EnergyValues: PROCESS_ENERGY_VALUES,
+ AppIdOffset: ULONG,
+ SharedCommitCharge: SIZE_T,
+ JobObjectId: ULONG,
+ SpareUlong: ULONG,
+ ProcessSequenceNumber: ULONGLONG,
+}}
+BITFIELD!{SYSTEM_PROCESS_INFORMATION_EXTENSION Flags: ULONG [
+ HasStrongId set_HasStrongId[0..1],
+ Classification set_Classification[1..5],
+ BackgroundActivityModerated set_BackgroundActivityModerated[5..6],
+ Spare set_Spare[6..32],
+]}
+pub type PSYSTEM_PROCESS_INFORMATION_EXTENSION = *mut SYSTEM_PROCESS_INFORMATION_EXTENSION;
+STRUCT!{struct SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION {
+ EfiLauncherEnabled: BOOLEAN,
+}}
+pub type PSYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION =
+ *mut SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION;
+STRUCT!{struct SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX {
+ DebuggerAllowed: BOOLEAN,
+ DebuggerEnabled: BOOLEAN,
+ DebuggerPresent: BOOLEAN,
+}}
+pub type PSYSTEM_KERNEL_DEBUGGER_INFORMATION_EX = *mut SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX;
+STRUCT!{struct SYSTEM_ELAM_CERTIFICATE_INFORMATION {
+ ElamDriverFile: HANDLE,
+}}
+pub type PSYSTEM_ELAM_CERTIFICATE_INFORMATION = *mut SYSTEM_ELAM_CERTIFICATE_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_FEATURES_INFORMATION {
+ ProcessorFeatureBits: ULONGLONG,
+ Reserved: [ULONGLONG; 3],
+}}
+pub type PSYSTEM_PROCESSOR_FEATURES_INFORMATION = *mut SYSTEM_PROCESSOR_FEATURES_INFORMATION;
+STRUCT!{struct SYSTEM_MANUFACTURING_INFORMATION {
+ Options: ULONG,
+ ProfileName: UNICODE_STRING,
+}}
+pub type PSYSTEM_MANUFACTURING_INFORMATION = *mut SYSTEM_MANUFACTURING_INFORMATION;
+STRUCT!{struct SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION {
+ Enabled: BOOLEAN,
+}}
+pub type PSYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION =
+ *mut SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION;
+STRUCT!{struct HV_DETAILS {
+ Data: [ULONG; 4],
+}}
+pub type PHV_DETAILS = *mut HV_DETAILS;
+STRUCT!{struct SYSTEM_HYPERVISOR_DETAIL_INFORMATION {
+ HvVendorAndMaxFunction: HV_DETAILS,
+ HypervisorInterface: HV_DETAILS,
+ HypervisorVersion: HV_DETAILS,
+ HvFeatures: HV_DETAILS,
+ HwFeatures: HV_DETAILS,
+ EnlightenmentInfo: HV_DETAILS,
+ ImplementationLimits: HV_DETAILS,
+}}
+pub type PSYSTEM_HYPERVISOR_DETAIL_INFORMATION = *mut SYSTEM_HYPERVISOR_DETAIL_INFORMATION;
+STRUCT!{struct SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION {
+ Cycles: [[ULONGLONG; 4]; 2],
+}}
+pub type PSYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION = *mut SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION;
+STRUCT!{struct SYSTEM_TPM_INFORMATION {
+ Flags: ULONG,
+}}
+pub type PSYSTEM_TPM_INFORMATION = *mut SYSTEM_TPM_INFORMATION;
+STRUCT!{struct SYSTEM_VSM_PROTECTION_INFORMATION {
+ DmaProtectionsAvailable: BOOLEAN,
+ DmaProtectionsInUse: BOOLEAN,
+ HardwareMbecAvailable: BOOLEAN,
+}}
+pub type PSYSTEM_VSM_PROTECTION_INFORMATION = *mut SYSTEM_VSM_PROTECTION_INFORMATION;
+STRUCT!{struct SYSTEM_CODEINTEGRITYPOLICY_INFORMATION {
+ Options: ULONG,
+ HVCIOptions: ULONG,
+ Version: ULONGLONG,
+ PolicyGuid: GUID,
+}}
+pub type PSYSTEM_CODEINTEGRITYPOLICY_INFORMATION = *mut SYSTEM_CODEINTEGRITYPOLICY_INFORMATION;
+STRUCT!{struct SYSTEM_ISOLATED_USER_MODE_INFORMATION {
+ Bitfields1: BOOLEAN,
+ Bitfields2: BOOLEAN,
+ Spare0: [BOOLEAN; 6],
+ Spare1: ULONGLONG,
+}}
+BITFIELD!{SYSTEM_ISOLATED_USER_MODE_INFORMATION Bitfields1: BOOLEAN [
+ SecureKernelRunning set_SecureKernelRunning[0..1],
+ HvciEnabled set_HvciEnabled[1..2],
+ HvciStrictMode set_HvciStrictMode[2..3],
+ DebugEnabled set_DebugEnabled[3..4],
+ FirmwarePageProtection set_FirmwarePageProtection[4..5],
+ EncryptionKeyAvailable set_EncryptionKeyAvailable[5..6],
+ SpareFlags set_SpareFlags[6..7],
+ TrustletRunning set_TrustletRunning[7..8],
+]}
+BITFIELD!{SYSTEM_ISOLATED_USER_MODE_INFORMATION Bitfields2: BOOLEAN [
+ SpareFlags2 set_SpareFlags2[0..1],
+]}
+pub type PSYSTEM_ISOLATED_USER_MODE_INFORMATION = *mut SYSTEM_ISOLATED_USER_MODE_INFORMATION;
+STRUCT!{struct SYSTEM_SINGLE_MODULE_INFORMATION {
+ TargetModuleAddress: PVOID,
+ ExInfo: RTL_PROCESS_MODULE_INFORMATION_EX,
+}}
+pub type PSYSTEM_SINGLE_MODULE_INFORMATION = *mut SYSTEM_SINGLE_MODULE_INFORMATION;
+STRUCT!{struct SYSTEM_INTERRUPT_CPU_SET_INFORMATION {
+ Gsiv: ULONG,
+ Group: USHORT,
+ CpuSets: ULONGLONG,
+}}
+pub type PSYSTEM_INTERRUPT_CPU_SET_INFORMATION = *mut SYSTEM_INTERRUPT_CPU_SET_INFORMATION;
+STRUCT!{struct SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION {
+ PolicyInformation: SYSTEM_SECUREBOOT_POLICY_INFORMATION,
+ PolicySize: ULONG,
+ Policy: [UCHAR; 1],
+}}
+pub type PSYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION =
+ *mut SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION;
+STRUCT!{struct SYSTEM_ROOT_SILO_INFORMATION {
+ NumberOfSilos: ULONG,
+ SiloIdList: [ULONG; 1],
+}}
+pub type PSYSTEM_ROOT_SILO_INFORMATION = *mut SYSTEM_ROOT_SILO_INFORMATION;
+STRUCT!{struct SYSTEM_CPU_SET_TAG_INFORMATION {
+ Tag: ULONGLONG,
+ CpuSets: [ULONGLONG; 1],
+}}
+pub type PSYSTEM_CPU_SET_TAG_INFORMATION = *mut SYSTEM_CPU_SET_TAG_INFORMATION;
+STRUCT!{struct SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION {
+ ExtentCount: ULONG,
+ ValidStructureSize: ULONG,
+ NextExtentIndex: ULONG,
+ ExtentRestart: ULONG,
+ CycleCount: ULONG,
+ TimeoutCount: ULONG,
+ CycleTime: ULONGLONG,
+ CycleTimeMax: ULONGLONG,
+ ExtentTime: ULONGLONG,
+ ExtentTimeIndex: ULONG,
+ ExtentTimeMaxIndex: ULONG,
+ ExtentTimeMax: ULONGLONG,
+ HyperFlushTimeMax: ULONGLONG,
+ TranslateVaTimeMax: ULONGLONG,
+ DebugExemptionCount: ULONGLONG,
+ TbHitCount: ULONGLONG,
+ TbMissCount: ULONGLONG,
+ VinaPendingYield: ULONGLONG,
+ HashCycles: ULONGLONG,
+ HistogramOffset: ULONG,
+ HistogramBuckets: ULONG,
+ HistogramShift: ULONG,
+ Reserved1: ULONG,
+ PageNotPresentCount: ULONGLONG,
+}}
+pub type PSYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION =
+ *mut SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION;
+STRUCT!{struct SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION {
+ PlatformManifestSize: ULONG,
+ PlatformManifest: [UCHAR; 1],
+}}
+pub type PSYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION =
+ *mut SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION;
+STRUCT!{struct SYSTEM_MEMORY_USAGE_INFORMATION {
+ TotalPhysicalBytes: ULONGLONG,
+ AvailableBytes: ULONGLONG,
+ ResidentAvailableBytes: LONGLONG,
+ CommittedBytes: ULONGLONG,
+ SharedCommittedBytes: ULONGLONG,
+ CommitLimitBytes: ULONGLONG,
+ PeakCommitmentBytes: ULONGLONG,
+}}
+pub type PSYSTEM_MEMORY_USAGE_INFORMATION = *mut SYSTEM_MEMORY_USAGE_INFORMATION;
+STRUCT!{struct SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION {
+ ImageFile: HANDLE,
+ Type: ULONG,
+}}
+pub type PSYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION =
+ *mut SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION;
+STRUCT!{struct SYSTEM_PHYSICAL_MEMORY_INFORMATION {
+ TotalPhysicalBytes: ULONGLONG,
+ LowestPhysicalAddress: ULONGLONG,
+ HighestPhysicalAddress: ULONGLONG,
+}}
+pub type PSYSTEM_PHYSICAL_MEMORY_INFORMATION = *mut SYSTEM_PHYSICAL_MEMORY_INFORMATION;
+ENUM!{enum SYSTEM_ACTIVITY_MODERATION_STATE {
+ SystemActivityModerationStateSystemManaged = 0,
+ SystemActivityModerationStateUserManagedAllowThrottling = 1,
+ SystemActivityModerationStateUserManagedDisableThrottling = 2,
+ MaxSystemActivityModerationState = 3,
+}}
+ENUM!{enum SYSTEM_ACTIVITY_MODERATION_APP_TYPE {
+ SystemActivityModerationAppTypeClassic = 0,
+ SystemActivityModerationAppTypePackaged = 1,
+ MaxSystemActivityModerationAppType = 2,
+}}
+STRUCT!{struct SYSTEM_ACTIVITY_MODERATION_INFO {
+ Identifier: UNICODE_STRING,
+ ModerationState: SYSTEM_ACTIVITY_MODERATION_STATE,
+ AppType: SYSTEM_ACTIVITY_MODERATION_APP_TYPE,
+}}
+pub type PSYSTEM_ACTIVITY_MODERATION_INFO = *mut SYSTEM_ACTIVITY_MODERATION_INFO;
+STRUCT!{struct SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS {
+ UserKeyHandle: HANDLE,
+}}
+pub type PSYSTEM_ACTIVITY_MODERATION_USER_SETTINGS = *mut SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS;
+STRUCT!{struct SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION {
+ Flags: ULONG,
+ UnlockId: [UCHAR; 32],
+}}
+BITFIELD!{SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION Flags: ULONG [
+ Locked set_Locked[0..1],
+ Unlockable set_Unlockable[1..2],
+ UnlockApplied set_UnlockApplied[2..3],
+ UnlockIdValid set_UnlockIdValid[3..4],
+ Reserved set_Reserved[4..32],
+]}
+pub type PSYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION = *mut SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION;
+STRUCT!{struct SYSTEM_FLUSH_INFORMATION {
+ SupportedFlushMethods: ULONG,
+ ProcessorCacheFlushSize: ULONG,
+ SystemFlushCapabilities: ULONGLONG,
+ Reserved: [ULONGLONG; 2],
+}}
+pub type PSYSTEM_FLUSH_INFORMATION = *mut SYSTEM_FLUSH_INFORMATION;
+STRUCT!{struct SYSTEM_WRITE_CONSTRAINT_INFORMATION {
+ WriteConstraintPolicy: ULONG,
+ Reserved: ULONG,
+}}
+pub type PSYSTEM_WRITE_CONSTRAINT_INFORMATION = *mut SYSTEM_WRITE_CONSTRAINT_INFORMATION;
+STRUCT!{struct SYSTEM_KERNEL_VA_SHADOW_INFORMATION {
+ Flags: ULONG,
+}}
+BITFIELD!{SYSTEM_KERNEL_VA_SHADOW_INFORMATION Flags: ULONG [
+ KvaShadowEnabled set_KvaShadowEnabled[0..1],
+ KvaShadowUserGlobal set_KvaShadowUserGlobal[1..2],
+ KvaShadowPcid set_KvaShadowPcid[2..3],
+ KvaShadowInvpcid set_KvaShadowInvpcid[3..4],
+ KvaShadowRequired set_KvaShadowRequired[4..5],
+ KvaShadowRequiredAvailable set_KvaShadowRequiredAvailable[5..6],
+ InvalidPteBit set_InvalidPteBit[6..12],
+ L1DataCacheFlushSupported set_L1DataCacheFlushSupported[12..13],
+ L1TerminalFaultMitigationPresent set_L1TerminalFaultMitigationPresent[13..14],
+ Reserved set_Reserved[14..32],
+]}
+pub type PSYSTEM_KERNEL_VA_SHADOW_INFORMATION = *mut SYSTEM_KERNEL_VA_SHADOW_INFORMATION;
+STRUCT!{struct SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION {
+ FileHandle: HANDLE,
+ ImageSize: ULONG,
+ Image: PVOID,
+}}
+pub type PSYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION =
+ *mut SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION;
+STRUCT!{struct SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION {
+ HypervisorSharedUserVa: PVOID,
+}}
+pub type PSYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION =
+ *mut SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION;
+STRUCT!{struct SYSTEM_SPECULATION_CONTROL_INFORMATION {
+ Flags: ULONG,
+}}
+BITFIELD!{SYSTEM_SPECULATION_CONTROL_INFORMATION Flags: ULONG [
+ BpbEnabled set_BpbEnabled[0..1],
+ BpbDisabledSystemPolicy set_BpbDisabledSystemPolicy[1..2],
+ BpbDisabledNoHardwareSupport set_BpbDisabledNoHardwareSupport[2..3],
+ SpecCtrlEnumerated set_SpecCtrlEnumerated[3..4],
+ SpecCmdEnumerated set_SpecCmdEnumerated[4..5],
+ IbrsPresent set_IbrsPresent[5..6],
+ StibpPresent set_StibpPresent[6..7],
+ SmepPresent set_SmepPresent[7..8],
+ SpeculativeStoreBypassDisableAvailable set_SpeculativeStoreBypassDisableAvailable[8..9],
+ SpeculativeStoreBypassDisableSupported set_SpeculativeStoreBypassDisableSupported[9..10],
+ SpeculativeStoreBypassDisabledSystemWide set_SpeculativeStoreBypassDisabledSystemWide[10..11],
+ SpeculativeStoreBypassDisabledKernel set_SpeculativeStoreBypassDisabledKernel[11..12],
+ SpeculativeStoreBypassDisableRequired set_SpeculativeStoreBypassDisableRequired[12..13],
+ BpbDisabledKernelToUser set_BpbDisabledKernelToUser[13..14],
+ SpecCtrlRetpolineEnabled set_SpecCtrlRetpolineEnabled[14..15],
+ SpecCtrlImportOptimizationEnabled set_SpecCtrlImportOptimizationEnabled[15..16],
+ Reserved set_Reserved[16..32],
+]}
+pub type PSYSTEM_SPECULATION_CONTROL_INFORMATION = *mut SYSTEM_SPECULATION_CONTROL_INFORMATION;
+STRUCT!{struct SYSTEM_DMA_GUARD_POLICY_INFORMATION {
+ DmaGuardPolicyEnabled: BOOLEAN,
+}}
+pub type PSYSTEM_DMA_GUARD_POLICY_INFORMATION = *mut SYSTEM_DMA_GUARD_POLICY_INFORMATION;
+STRUCT!{struct SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION {
+ EnclaveLaunchSigner: [UCHAR; 32],
+}}
+pub type PSYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION =
+ *mut SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION;
+STRUCT!{struct SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION {
+ WorkloadClass: ULONGLONG,
+ CpuSets: [ULONGLONG; 1],
+}}
+pub type PSYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION =
+ *mut SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtQuerySystemInformation(
+ SystemInformationClass: SYSTEM_INFORMATION_CLASS,
+ SystemInformation: PVOID,
+ SystemInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtQuerySystemInformationEx(
+ SystemInformationClass: SYSTEM_INFORMATION_CLASS,
+ InputBuffer: PVOID,
+ InputBufferLength: ULONG,
+ SystemInformation: PVOID,
+ SystemInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetSystemInformation(
+ SystemInformationClass: SYSTEM_INFORMATION_CLASS,
+ SystemInformation: PVOID,
+ SystemInformationLength: ULONG,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum SYSDBG_COMMAND {
+ SysDbgQueryModuleInformation = 0,
+ SysDbgQueryTraceInformation = 1,
+ SysDbgSetTracepoint = 2,
+ SysDbgSetSpecialCall = 3,
+ SysDbgClearSpecialCalls = 4,
+ SysDbgQuerySpecialCalls = 5,
+ SysDbgBreakPoint = 6,
+ SysDbgQueryVersion = 7,
+ SysDbgReadVirtual = 8,
+ SysDbgWriteVirtual = 9,
+ SysDbgReadPhysical = 10,
+ SysDbgWritePhysical = 11,
+ SysDbgReadControlSpace = 12,
+ SysDbgWriteControlSpace = 13,
+ SysDbgReadIoSpace = 14,
+ SysDbgWriteIoSpace = 15,
+ SysDbgReadMsr = 16,
+ SysDbgWriteMsr = 17,
+ SysDbgReadBusData = 18,
+ SysDbgWriteBusData = 19,
+ SysDbgCheckLowMemory = 20,
+ SysDbgEnableKernelDebugger = 21,
+ SysDbgDisableKernelDebugger = 22,
+ SysDbgGetAutoKdEnable = 23,
+ SysDbgSetAutoKdEnable = 24,
+ SysDbgGetPrintBufferSize = 25,
+ SysDbgSetPrintBufferSize = 26,
+ SysDbgGetKdUmExceptionEnable = 27,
+ SysDbgSetKdUmExceptionEnable = 28,
+ SysDbgGetTriageDump = 29,
+ SysDbgGetKdBlockEnable = 30,
+ SysDbgSetKdBlockEnable = 31,
+ SysDbgRegisterForUmBreakInfo = 32,
+ SysDbgGetUmBreakPid = 33,
+ SysDbgClearUmBreakPid = 34,
+ SysDbgGetUmAttachPid = 35,
+ SysDbgClearUmAttachPid = 36,
+ SysDbgGetLiveKernelDump = 37,
+}}
+pub type PSYSDBG_COMMAND = *mut SYSDBG_COMMAND;
+STRUCT!{struct SYSDBG_VIRTUAL {
+ Address: PVOID,
+ Buffer: PVOID,
+ Request: ULONG,
+}}
+pub type PSYSDBG_VIRTUAL = *mut SYSDBG_VIRTUAL;
+STRUCT!{struct SYSDBG_PHYSICAL {
+ Address: PHYSICAL_ADDRESS,
+ Buffer: PVOID,
+ Request: ULONG,
+}}
+pub type PSYSDBG_PHYSICAL = *mut SYSDBG_PHYSICAL;
+STRUCT!{struct SYSDBG_CONTROL_SPACE {
+ Address: ULONG64,
+ Buffer: PVOID,
+ Request: ULONG,
+ Processor: ULONG,
+}}
+pub type PSYSDBG_CONTROL_SPACE = *mut SYSDBG_CONTROL_SPACE;
+STRUCT!{struct SYSDBG_IO_SPACE {
+ Address: ULONG64,
+ Buffer: PVOID,
+ Request: ULONG,
+ InterfaceType: INTERFACE_TYPE,
+ BusNumber: ULONG,
+ AddressSpace: ULONG,
+}}
+pub type PSYSDBG_IO_SPACE = *mut SYSDBG_IO_SPACE;
+STRUCT!{struct SYSDBG_MSR {
+ Msr: ULONG,
+ Data: ULONG64,
+}}
+pub type PSYSDBG_MSR = *mut SYSDBG_MSR;
+STRUCT!{struct SYSDBG_BUS_DATA {
+ Address: ULONG,
+ Buffer: PVOID,
+ Request: ULONG,
+ BusDataType: BUS_DATA_TYPE,
+ BusNumber: ULONG,
+ SlotNumber: ULONG,
+}}
+pub type PSYSDBG_BUS_DATA = *mut SYSDBG_BUS_DATA;
+STRUCT!{struct SYSDBG_TRIAGE_DUMP {
+ Flags: ULONG,
+ BugCheckCode: ULONG,
+ BugCheckParam1: ULONG_PTR,
+ BugCheckParam2: ULONG_PTR,
+ BugCheckParam3: ULONG_PTR,
+ BugCheckParam4: ULONG_PTR,
+ ProcessHandles: ULONG,
+ ThreadHandles: ULONG,
+ Handles: PHANDLE,
+}}
+pub type PSYSDBG_TRIAGE_DUMP = *mut SYSDBG_TRIAGE_DUMP;
+STRUCT!{struct SYSDBG_LIVEDUMP_CONTROL_FLAGS {
+ AsUlong: ULONG,
+}}
+BITFIELD!{SYSDBG_LIVEDUMP_CONTROL_FLAGS AsUlong: ULONG [
+ UseDumpStorageStack set_UseDumpStorageStack[0..1],
+ CompressMemoryPagesData set_CompressMemoryPagesData[1..2],
+ IncludeUserSpaceMemoryPages set_IncludeUserSpaceMemoryPages[2..3],
+ AbortIfMemoryPressure set_AbortIfMemoryPressure[3..4],
+ Reserved set_Reserved[4..32],
+]}
+pub type PSYSDBG_LIVEDUMP_CONTROL_FLAGS = *mut SYSDBG_LIVEDUMP_CONTROL_FLAGS;
+STRUCT!{struct SYSDBG_LIVEDUMP_CONTROL_ADDPAGES {
+ AsUlong: ULONG,
+}}
+BITFIELD!{SYSDBG_LIVEDUMP_CONTROL_ADDPAGES AsUlong: ULONG [
+ HypervisorPages set_HypervisorPages[0..1],
+ Reserved set_Reserved[1..32],
+]}
+pub type PSYSDBG_LIVEDUMP_CONTROL_ADDPAGES = *mut SYSDBG_LIVEDUMP_CONTROL_ADDPAGES;
+pub const SYSDBG_LIVEDUMP_CONTROL_VERSION: ULONG = 1;
+STRUCT!{struct SYSDBG_LIVEDUMP_CONTROL {
+ Version: ULONG,
+ BugCheckCode: ULONG,
+ BugCheckParam1: ULONG_PTR,
+ BugCheckParam2: ULONG_PTR,
+ BugCheckParam3: ULONG_PTR,
+ BugCheckParam4: ULONG_PTR,
+ DumpFileHandle: HANDLE,
+ CancelEventHandle: HANDLE,
+ Flags: SYSDBG_LIVEDUMP_CONTROL_FLAGS,
+ AddPagesControl: SYSDBG_LIVEDUMP_CONTROL_ADDPAGES,
+}}
+pub type PSYSDBG_LIVEDUMP_CONTROL = *mut SYSDBG_LIVEDUMP_CONTROL;
+EXTERN!{extern "system" {
+ fn NtSystemDebugControl(
+ Command: SYSDBG_COMMAND,
+ InputBuffer: PVOID,
+ InputBufferLength: ULONG,
+ OutputBuffer: PVOID,
+ OutputBufferLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum HARDERROR_RESPONSE_OPTION {
+ OptionAbortRetryIgnore = 0,
+ OptionOk = 1,
+ OptionOkCancel = 2,
+ OptionRetryCancel = 3,
+ OptionYesNo = 4,
+ OptionYesNoCancel = 5,
+ OptionShutdownSystem = 6,
+ OptionOkNoWait = 7,
+ OptionCancelTryContinue = 8,
+}}
+ENUM!{enum HARDERROR_RESPONSE {
+ ResponseReturnToCaller = 0,
+ ResponseNotHandled = 1,
+ ResponseAbort = 2,
+ ResponseCancel = 3,
+ ResponseIgnore = 4,
+ ResponseNo = 5,
+ ResponseOk = 6,
+ ResponseRetry = 7,
+ ResponseYes = 8,
+ ResponseTryAgain = 9,
+ ResponseContinue = 10,
+}}
+pub const HARDERROR_OVERRIDE_ERRORMODE: ULONG = 0x10000000;
+EXTERN!{extern "system" {
+ fn NtRaiseHardError(
+ ErrorStatus: NTSTATUS,
+ NumberOfParameters: ULONG,
+ UnicodeStringParameterMask: ULONG,
+ Parameters: PULONG_PTR,
+ ValidResponseOptions: ULONG,
+ Response: PULONG,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum ALTERNATIVE_ARCHITECTURE_TYPE {
+ StandardDesign = 0,
+ NEC98x86 = 1,
+ EndAlternatives = 2,
+}}
+pub const PROCESSOR_FEATURE_MAX: usize = 64;
+pub const MAX_WOW64_SHARED_ENTRIES: u32 = 16;
+pub const NX_SUPPORT_POLICY_ALWAYSOFF: u32 = 0;
+pub const NX_SUPPORT_POLICY_ALWAYSON: u32 = 1;
+pub const NX_SUPPORT_POLICY_OPTIN: u32 = 2;
+pub const NX_SUPPORT_POLICY_OPTOUT: u32 = 3;
+UNION!{union KUSER_SHARED_DATA_u {
+ TickCount: KSYSTEM_TIME,
+ TickCountQuad: ULONG64,
+ ReservedTickCountOverlay: [ULONG; 3],
+}}
+STRUCT!{#[repr(packed(4))] struct KUSER_SHARED_DATA {
+ TickCountLowDeprecated: ULONG,
+ TickCountMultiplier: ULONG,
+ InterruptTime: KSYSTEM_TIME,
+ SystemTime: KSYSTEM_TIME,
+ TimeZoneBias: KSYSTEM_TIME,
+ ImageNumberLow: USHORT,
+ ImageNumberHigh: USHORT,
+ NtSystemRoot: [WCHAR; 260],
+ MaxStackTraceDepth: ULONG,
+ CryptoExponent: ULONG,
+ TimeZoneId: ULONG,
+ LargePageMinimum: ULONG,
+ AitSamplingValue: ULONG,
+ AppCompatFlag: ULONG,
+ RNGSeedVersion: ULONGLONG,
+ GlobalValidationRunlevel: ULONG,
+ TimeZoneBiasStamp: LONG,
+ NtBuildNumber: ULONG,
+ NtProductType: NT_PRODUCT_TYPE,
+ ProductTypeIsValid: BOOLEAN,
+ Reserved0: [UCHAR; 1],
+ NativeProcessorArchitecture: USHORT,
+ NtMajorVersion: ULONG,
+ NtMinorVersion: ULONG,
+ ProcessorFeatures: [BOOLEAN; PROCESSOR_FEATURE_MAX],
+ Reserved1: ULONG,
+ Reserved3: ULONG,
+ TimeSlip: ULONG,
+ AlternativeArchitecture: ALTERNATIVE_ARCHITECTURE_TYPE,
+ BootId: ULONG,
+ SystemExpirationDate: LARGE_INTEGER,
+ SuiteMask: ULONG,
+ KdDebuggerEnabled: BOOLEAN,
+ MitigationPolicies: UCHAR,
+ Reserved6: [UCHAR; 2],
+ ActiveConsoleId: ULONG,
+ DismountCount: ULONG,
+ ComPlusPackage: ULONG,
+ LastSystemRITEventTickCount: ULONG,
+ NumberOfPhysicalPages: ULONG,
+ SafeBootMode: BOOLEAN,
+ VirtualizationFlags: UCHAR,
+ Reserved12: [UCHAR; 2],
+ SharedDataFlags: ULONG,
+ DataFlagsPad: [ULONG; 1],
+ TestRetInstruction: ULONGLONG,
+ QpcFrequency: LONGLONG,
+ SystemCall: ULONG,
+ SystemCallPad0: ULONG,
+ SystemCallPad: [ULONGLONG; 2],
+ u: KUSER_SHARED_DATA_u,
+ //TickCountPad: [ULONG; 1],
+ Cookie: ULONG,
+ CookiePad: [ULONG; 1],
+ ConsoleSessionForegroundProcessId: LONGLONG,
+ TimeUpdateLock: ULONGLONG,
+ BaselineSystemTimeQpc: ULONGLONG,
+ BaselineInterruptTimeQpc: ULONGLONG,
+ QpcSystemTimeIncrement: ULONGLONG,
+ QpcInterruptTimeIncrement: ULONGLONG,
+ QpcSystemTimeIncrementShift: UCHAR,
+ QpcInterruptTimeIncrementShift: UCHAR,
+ UnparkedProcessorCount: USHORT,
+ EnclaveFeatureMask: [ULONG; 4],
+ TelemetryCoverageRound: ULONG,
+ UserModeGlobalLogger: [USHORT; 16],
+ ImageFileExecutionOptions: ULONG,
+ LangGenerationCount: ULONG,
+ Reserved4: ULONGLONG,
+ InterruptTimeBias: ULONG64,
+ QpcBias: ULONG64,
+ ActiveProcessorCount: ULONG,
+ ActiveGroupCount: UCHAR,
+ Reserved9: UCHAR,
+ QpcData: UCHAR,
+ TimeZoneBiasEffectiveStart: LARGE_INTEGER,
+ TimeZoneBiasEffectiveEnd: LARGE_INTEGER,
+ XState: XSTATE_CONFIGURATION,
+}}
+BITFIELD!{KUSER_SHARED_DATA MitigationPolicies: UCHAR [
+ NXSupportPolicy set_NXSupportPolicy[0..2],
+ SEHValidationPolicy set_SEHValidationPolicy[2..4],
+ CurDirDevicesSkippedForDlls set_CurDirDevicesSkippedForDlls[4..6],
+ Reserved set_Reserved[6..8],
+]}
+BITFIELD!{KUSER_SHARED_DATA SharedDataFlags: ULONG [
+ DbgErrorPortPresent set_DbgErrorPortPresent[0..1],
+ DbgElevationEnabled set_DbgElevationEnabled[1..2],
+ DbgVirtEnabled set_DbgVirtEnabled[2..3],
+ DbgInstallerDetectEnabled set_DbgInstallerDetectEnabled[3..4],
+ DbgLkgEnabled set_DbgLkgEnabled[4..5],
+ DbgDynProcessorEnabled set_DbgDynProcessorEnabled[5..6],
+ DbgConsoleBrokerEnabled set_DbgConsoleBrokerEnabled[6..7],
+ DbgSecureBootEnabled set_DbgSecureBootEnabled[7..8],
+ DbgMultiSessionSku set_DbgMultiSessionSku[8..9],
+ DbgMultiUsersInSessionSku set_DbgMultiUsersInSessionSku[9..10],
+ DbgStateSeparationEnabled set_DbgStateSeparationEnabled[10..11],
+ SpareBits set_SpareBits[11..32],
+]}
+BITFIELD!{KUSER_SHARED_DATA QpcData: UCHAR [
+ QpcBypassEnabled set_QpcBypassEnabled[0..1],
+ QpcShift set_QpcShift[1..2],
+]}
+pub type PKUSER_SHARED_DATA = *mut KUSER_SHARED_DATA;
+pub const USER_SHARED_DATA: *const KUSER_SHARED_DATA = 0x7ffe0000 as *const _;
+#[inline]
+pub unsafe fn NtGetTickCount64() -> ULONGLONG {
+ let mut tick_count: ULARGE_INTEGER = MaybeUninit::uninit().assume_init();
+ #[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))] {
+ *tick_count.QuadPart_mut() = read_volatile(addr_of!((*USER_SHARED_DATA).u.TickCountQuad));
+ }
+ #[cfg(target_arch = "x86")] {
+ loop {
+ tick_count.s_mut().HighPart =
+ read_volatile(&(*USER_SHARED_DATA).u.TickCount.High1Time) as u32;
+ tick_count.s_mut().LowPart = read_volatile(&(*USER_SHARED_DATA).u.TickCount.LowPart);
+ if tick_count.s().HighPart == read_volatile(&(*USER_SHARED_DATA).u.TickCount.High2Time)
+ as u32
+ {
+ break;
+ }
+ spin_loop();
+ }
+ }
+ (UInt32x32To64(tick_count.s().LowPart, (*USER_SHARED_DATA).TickCountMultiplier) >> 24)
+ + (UInt32x32To64(
+ tick_count.s().HighPart as u32,
+ (*USER_SHARED_DATA).TickCountMultiplier,
+ ) << 8)
+}
+#[inline]
+pub unsafe fn NtGetTickCount() -> ULONG {
+ #[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))] {
+ ((read_volatile(addr_of!((*USER_SHARED_DATA).u.TickCountQuad))
+ * (*USER_SHARED_DATA).TickCountMultiplier as u64) >> 24) as u32
+ }
+ #[cfg(target_arch = "x86")] {
+ let mut tick_count: ULARGE_INTEGER = MaybeUninit::uninit().assume_init();
+ loop {
+ tick_count.s_mut().HighPart = read_volatile(&(*USER_SHARED_DATA).u.TickCount.High1Time)
+ as u32;
+ tick_count.s_mut().LowPart = read_volatile(&(*USER_SHARED_DATA).u.TickCount.LowPart);
+ if tick_count.s().HighPart == read_volatile(&(*USER_SHARED_DATA).u.TickCount.High2Time)
+ as u32
+ {
+ break;
+ }
+ spin_loop();
+ }
+ ((UInt32x32To64(tick_count.s().LowPart, (*USER_SHARED_DATA).TickCountMultiplier) >> 24)
+ + UInt32x32To64(
+ (tick_count.s().HighPart as u32) << 8,
+ (*USER_SHARED_DATA).TickCountMultiplier,
+ )) as u32
+ }
+}
+EXTERN!{extern "system" {
+ fn NtQueryDefaultLocale(
+ UserProfile: BOOLEAN,
+ DefaultLocaleId: PLCID,
+ ) -> NTSTATUS;
+ fn NtSetDefaultLocale(
+ UserProfile: BOOLEAN,
+ DefaultLocaleId: LCID,
+ ) -> NTSTATUS;
+ fn NtQueryInstallUILanguage(
+ InstallUILanguageId: *mut LANGID,
+ ) -> NTSTATUS;
+ fn NtFlushInstallUILanguage(
+ InstallUILanguage: LANGID,
+ SetComittedFlag: ULONG,
+ ) -> NTSTATUS;
+ fn NtQueryDefaultUILanguage(
+ DefaultUILanguageId: *mut LANGID,
+ ) -> NTSTATUS;
+ fn NtSetDefaultUILanguage(
+ DefaultUILanguageId: LANGID,
+ ) -> NTSTATUS;
+ fn NtIsUILanguageComitted() -> NTSTATUS;
+ fn NtInitializeNlsFiles(
+ BaseAddress: *mut PVOID,
+ DefaultLocaleId: PLCID,
+ DefaultCasingTableSize: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtGetNlsSectionPtr(
+ SectionType: ULONG,
+ SectionData: ULONG,
+ ContextData: PVOID,
+ SectionPointer: *mut PVOID,
+ SectionSize: PULONG,
+ ) -> NTSTATUS;
+ fn NtMapCMFModule(
+ What: ULONG,
+ Index: ULONG,
+ CacheIndexOut: PULONG,
+ CacheFlagsOut: PULONG,
+ ViewSizeOut: PULONG,
+ BaseAddress: *mut PVOID,
+ ) -> NTSTATUS;
+ fn NtGetMUIRegistryInfo(
+ Flags: ULONG,
+ DataSize: PULONG,
+ Data: PVOID,
+ ) -> NTSTATUS;
+ fn NtAddAtom(
+ AtomName: PWSTR,
+ Length: ULONG,
+ Atom: PRTL_ATOM,
+ ) -> NTSTATUS;
+}}
+pub const ATOM_FLAG_GLOBAL: ULONG = 0x2;
+EXTERN!{extern "system" {
+ fn NtAddAtomEx(
+ AtomName: PWSTR,
+ Length: ULONG,
+ Atom: PRTL_ATOM,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn NtFindAtom(
+ AtomName: PWSTR,
+ Length: ULONG,
+ Atom: PRTL_ATOM,
+ ) -> NTSTATUS;
+ fn NtDeleteAtom(
+ Atom: RTL_ATOM,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum ATOM_INFORMATION_CLASS {
+ AtomBasicInformation = 0,
+ AtomTableInformation = 1,
+}}
+STRUCT!{struct ATOM_BASIC_INFORMATION {
+ UsageCount: USHORT,
+ Flags: USHORT,
+ NameLength: USHORT,
+ Name: [WCHAR; 1],
+}}
+pub type PATOM_BASIC_INFORMATION = *mut ATOM_BASIC_INFORMATION;
+STRUCT!{struct ATOM_TABLE_INFORMATION {
+ NumberOfAtoms: ULONG,
+ Atoms: [RTL_ATOM; 1],
+}}
+pub type PATOM_TABLE_INFORMATION = *mut ATOM_TABLE_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtQueryInformationAtom(
+ Atom: RTL_ATOM,
+ AtomInformationClass: ATOM_INFORMATION_CLASS,
+ AtomInformation: PVOID,
+ AtomInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+}}
+pub const FLG_STOP_ON_EXCEPTION: u32 = 0x00000001;
+pub const FLG_SHOW_LDR_SNAPS: u32 = 0x00000002;
+pub const FLG_DEBUG_INITIAL_COMMAND: u32 = 0x00000004;
+pub const FLG_STOP_ON_HUNG_GUI: u32 = 0x00000008;
+pub const FLG_HEAP_ENABLE_TAIL_CHECK: u32 = 0x00000010;
+pub const FLG_HEAP_ENABLE_FREE_CHECK: u32 = 0x00000020;
+pub const FLG_HEAP_VALIDATE_PARAMETERS: u32 = 0x00000040;
+pub const FLG_HEAP_VALIDATE_ALL: u32 = 0x00000080;
+pub const FLG_APPLICATION_VERIFIER: u32 = 0x00000100;
+pub const FLG_POOL_ENABLE_TAGGING: u32 = 0x00000400;
+pub const FLG_HEAP_ENABLE_TAGGING: u32 = 0x00000800;
+pub const FLG_USER_STACK_TRACE_DB: u32 = 0x00001000;
+pub const FLG_KERNEL_STACK_TRACE_DB: u32 = 0x00002000;
+pub const FLG_MAINTAIN_OBJECT_TYPELIST: u32 = 0x00004000;
+pub const FLG_HEAP_ENABLE_TAG_BY_DLL: u32 = 0x00008000;
+pub const FLG_DISABLE_STACK_EXTENSION: u32 = 0x00010000;
+pub const FLG_ENABLE_CSRDEBUG: u32 = 0x00020000;
+pub const FLG_ENABLE_KDEBUG_SYMBOL_LOAD: u32 = 0x00040000;
+pub const FLG_DISABLE_PAGE_KERNEL_STACKS: u32 = 0x00080000;
+pub const FLG_ENABLE_SYSTEM_CRIT_BREAKS: u32 = 0x00100000;
+pub const FLG_HEAP_DISABLE_COALESCING: u32 = 0x00200000;
+pub const FLG_ENABLE_CLOSE_EXCEPTIONS: u32 = 0x00400000;
+pub const FLG_ENABLE_EXCEPTION_LOGGING: u32 = 0x00800000;
+pub const FLG_ENABLE_HANDLE_TYPE_TAGGING: u32 = 0x01000000;
+pub const FLG_HEAP_PAGE_ALLOCS: u32 = 0x02000000;
+pub const FLG_DEBUG_INITIAL_COMMAND_EX: u32 = 0x04000000;
+pub const FLG_DISABLE_DBGPRINT: u32 = 0x08000000;
+pub const FLG_CRITSEC_EVENT_CREATION: u32 = 0x10000000;
+pub const FLG_LDR_TOP_DOWN: u32 = 0x20000000;
+pub const FLG_ENABLE_HANDLE_EXCEPTIONS: u32 = 0x40000000;
+pub const FLG_DISABLE_PROTDLLS: u32 = 0x80000000;
+pub const FLG_VALID_BITS: u32 = 0xfffffdff;
+pub const FLG_USERMODE_VALID_BITS: u32 = FLG_STOP_ON_EXCEPTION | FLG_SHOW_LDR_SNAPS
+ | FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS
+ | FLG_HEAP_VALIDATE_ALL | FLG_APPLICATION_VERIFIER | FLG_HEAP_ENABLE_TAGGING
+ | FLG_USER_STACK_TRACE_DB | FLG_HEAP_ENABLE_TAG_BY_DLL | FLG_DISABLE_STACK_EXTENSION
+ | FLG_ENABLE_SYSTEM_CRIT_BREAKS | FLG_HEAP_DISABLE_COALESCING | FLG_DISABLE_PROTDLLS
+ | FLG_HEAP_PAGE_ALLOCS | FLG_CRITSEC_EVENT_CREATION | FLG_LDR_TOP_DOWN;
+pub const FLG_BOOTONLY_VALID_BITS: u32 = FLG_KERNEL_STACK_TRACE_DB | FLG_MAINTAIN_OBJECT_TYPELIST
+ | FLG_ENABLE_CSRDEBUG | FLG_DEBUG_INITIAL_COMMAND | FLG_DEBUG_INITIAL_COMMAND_EX
+ | FLG_DISABLE_PAGE_KERNEL_STACKS;
+pub const FLG_KERNELMODE_VALID_BITS: u32 = FLG_STOP_ON_EXCEPTION | FLG_SHOW_LDR_SNAPS
+ | FLG_STOP_ON_HUNG_GUI | FLG_POOL_ENABLE_TAGGING | FLG_ENABLE_KDEBUG_SYMBOL_LOAD
+ | FLG_ENABLE_CLOSE_EXCEPTIONS | FLG_ENABLE_EXCEPTION_LOGGING | FLG_ENABLE_HANDLE_TYPE_TAGGING
+ | FLG_DISABLE_DBGPRINT | FLG_ENABLE_HANDLE_EXCEPTIONS;
+EXTERN!{extern "system" {
+ fn NtQueryLicenseValue(
+ ValueName: PUNICODE_STRING,
+ Type: PULONG,
+ Data: PVOID,
+ DataSize: ULONG,
+ ResultDataSize: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetDefaultHardErrorPort(
+ DefaultHardErrorPort: HANDLE,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum SHUTDOWN_ACTION {
+ ShutdownNoReboot = 0,
+ ShutdownReboot = 1,
+ ShutdownPowerOff = 2,
+}}
+EXTERN!{extern "system" {
+ fn NtShutdownSystem(
+ Action: SHUTDOWN_ACTION,
+ ) -> NTSTATUS;
+ fn NtDisplayString(
+ String: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn NtDrawText(
+ Text: PUNICODE_STRING,
+ ) -> NTSTATUS;
+}}
diff --git a/third_party/rust/ntapi/src/ntgdi.rs b/third_party/rust/ntapi/src/ntgdi.rs
new file mode 100644
index 0000000000..ac6e387d49
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntgdi.rs
@@ -0,0 +1,123 @@
+use winapi::shared::ntdef::{PVOID, UCHAR, ULONG, USHORT};
+pub const GDI_MAX_HANDLE_COUNT: usize = 0x4000;
+pub const GDI_HANDLE_INDEX_SHIFT: ULONG = 0;
+pub const GDI_HANDLE_INDEX_BITS: ULONG = 16;
+pub const GDI_HANDLE_INDEX_MASK: ULONG = 0xffff;
+pub const GDI_HANDLE_TYPE_SHIFT: ULONG = 16;
+pub const GDI_HANDLE_TYPE_BITS: ULONG = 5;
+pub const GDI_HANDLE_TYPE_MASK: ULONG = 0x1f;
+pub const GDI_HANDLE_ALTTYPE_SHIFT: ULONG = 21;
+pub const GDI_HANDLE_ALTTYPE_BITS: ULONG = 2;
+pub const GDI_HANDLE_ALTTYPE_MASK: ULONG = 0x3;
+pub const GDI_HANDLE_STOCK_SHIFT: ULONG = 23;
+pub const GDI_HANDLE_STOCK_BITS: ULONG = 1;
+pub const GDI_HANDLE_STOCK_MASK: ULONG = 0x1;
+pub const GDI_HANDLE_UNIQUE_SHIFT: ULONG = 24;
+pub const GDI_HANDLE_UNIQUE_BITS: ULONG = 8;
+pub const GDI_HANDLE_UNIQUE_MASK: ULONG = 0xff;
+#[inline]
+pub const fn GDI_HANDLE_INDEX(Handle: ULONG) -> ULONG {
+ Handle & GDI_HANDLE_INDEX_MASK
+}
+#[inline]
+pub const fn GDI_HANDLE_TYPE(Handle: ULONG) -> ULONG {
+ Handle >> GDI_HANDLE_TYPE_SHIFT & GDI_HANDLE_TYPE_MASK
+}
+#[inline]
+pub const fn GDI_HANDLE_ALTTYPE(Handle: ULONG) -> ULONG {
+ Handle >> GDI_HANDLE_ALTTYPE_SHIFT & GDI_HANDLE_ALTTYPE_MASK
+}
+#[inline]
+pub const fn GDI_HANDLE_STOCK(Handle: ULONG) -> ULONG {
+ Handle >> GDI_HANDLE_STOCK_SHIFT & GDI_HANDLE_STOCK_MASK
+}
+#[inline]
+pub const fn GDI_MAKE_HANDLE(Index: ULONG, Unique: ULONG) -> ULONG {
+ Unique << GDI_HANDLE_INDEX_BITS | Index
+}
+pub const GDI_DEF_TYPE: ULONG = 0;
+pub const GDI_DC_TYPE: ULONG = 1;
+pub const GDI_DD_DIRECTDRAW_TYPE: ULONG = 2;
+pub const GDI_DD_SURFACE_TYPE: ULONG = 3;
+pub const GDI_RGN_TYPE: ULONG = 4;
+pub const GDI_SURF_TYPE: ULONG = 5;
+pub const GDI_CLIENTOBJ_TYPE: ULONG = 6;
+pub const GDI_PATH_TYPE: ULONG = 7;
+pub const GDI_PAL_TYPE: ULONG = 8;
+pub const GDI_ICMLCS_TYPE: ULONG = 9;
+pub const GDI_LFONT_TYPE: ULONG = 10;
+pub const GDI_RFONT_TYPE: ULONG = 11;
+pub const GDI_PFE_TYPE: ULONG = 12;
+pub const GDI_PFT_TYPE: ULONG = 13;
+pub const GDI_ICMCXF_TYPE: ULONG = 14;
+pub const GDI_ICMDLL_TYPE: ULONG = 15;
+pub const GDI_BRUSH_TYPE: ULONG = 16;
+pub const GDI_PFF_TYPE: ULONG = 17;
+pub const GDI_CACHE_TYPE: ULONG = 18;
+pub const GDI_SPACE_TYPE: ULONG = 19;
+pub const GDI_DBRUSH_TYPE: ULONG = 20;
+pub const GDI_META_TYPE: ULONG = 21;
+pub const GDI_EFSTATE_TYPE: ULONG = 22;
+pub const GDI_BMFD_TYPE: ULONG = 23;
+pub const GDI_VTFD_TYPE: ULONG = 24;
+pub const GDI_TTFD_TYPE: ULONG = 25;
+pub const GDI_RC_TYPE: ULONG = 26;
+pub const GDI_TEMP_TYPE: ULONG = 27;
+pub const GDI_DRVOBJ_TYPE: ULONG = 28;
+pub const GDI_DCIOBJ_TYPE: ULONG = 29;
+pub const GDI_SPOOL_TYPE: ULONG = 30;
+#[inline]
+pub const fn GDI_CLIENT_TYPE_FROM_HANDLE(Handle: ULONG) -> ULONG {
+ Handle & (GDI_HANDLE_ALTTYPE_MASK << GDI_HANDLE_ALTTYPE_SHIFT | GDI_HANDLE_TYPE_MASK
+ << GDI_HANDLE_TYPE_SHIFT)
+}
+#[inline]
+pub const fn GDI_CLIENT_TYPE_FROM_UNIQUE(Unique: ULONG) -> ULONG {
+ GDI_CLIENT_TYPE_FROM_HANDLE(Unique << 16)
+}
+pub const GDI_ALTTYPE_1: ULONG = 1 << GDI_HANDLE_ALTTYPE_SHIFT;
+pub const GDI_ALTTYPE_2: ULONG = 2 << GDI_HANDLE_ALTTYPE_SHIFT;
+pub const GDI_ALTTYPE_3: ULONG = 3 << GDI_HANDLE_ALTTYPE_SHIFT;
+pub const GDI_CLIENT_BITMAP_TYPE: ULONG = GDI_SURF_TYPE << GDI_HANDLE_TYPE_SHIFT;
+pub const GDI_CLIENT_BRUSH_TYPE: ULONG = GDI_BRUSH_TYPE << GDI_HANDLE_TYPE_SHIFT;
+pub const GDI_CLIENT_CLIENTOBJ_TYPE: ULONG = GDI_CLIENTOBJ_TYPE << GDI_HANDLE_TYPE_SHIFT;
+pub const GDI_CLIENT_DC_TYPE: ULONG = GDI_DC_TYPE << GDI_HANDLE_TYPE_SHIFT;
+pub const GDI_CLIENT_FONT_TYPE: ULONG = GDI_LFONT_TYPE << GDI_HANDLE_TYPE_SHIFT;
+pub const GDI_CLIENT_PALETTE_TYPE: ULONG = GDI_PAL_TYPE << GDI_HANDLE_TYPE_SHIFT;
+pub const GDI_CLIENT_REGION_TYPE: ULONG = GDI_RGN_TYPE << GDI_HANDLE_TYPE_SHIFT;
+pub const GDI_CLIENT_ALTDC_TYPE: ULONG = GDI_CLIENT_DC_TYPE | GDI_ALTTYPE_1;
+pub const GDI_CLIENT_DIBSECTION_TYPE: ULONG = GDI_CLIENT_BITMAP_TYPE | GDI_ALTTYPE_1;
+pub const GDI_CLIENT_EXTPEN_TYPE: ULONG = GDI_CLIENT_BRUSH_TYPE | GDI_ALTTYPE_2;
+pub const GDI_CLIENT_METADC16_TYPE: ULONG = GDI_CLIENT_CLIENTOBJ_TYPE | GDI_ALTTYPE_3;
+pub const GDI_CLIENT_METAFILE_TYPE: ULONG = GDI_CLIENT_CLIENTOBJ_TYPE | GDI_ALTTYPE_2;
+pub const GDI_CLIENT_METAFILE16_TYPE: ULONG = GDI_CLIENT_CLIENTOBJ_TYPE | GDI_ALTTYPE_1;
+pub const GDI_CLIENT_PEN_TYPE: ULONG = GDI_CLIENT_BRUSH_TYPE | GDI_ALTTYPE_1;
+UNION!{union GDI_HANDLE_ENTRY_u {
+ Object: PVOID,
+ NextFree: PVOID,
+}}
+STRUCT!{struct GDI_HANDLE_ENTRY_Owner_s {
+ ProcessId: USHORT,
+ Bitfields: USHORT,
+}}
+BITFIELD!{GDI_HANDLE_ENTRY_Owner_s Bitfields: USHORT [
+ Lock set_Lock[0..1],
+ Count set_Count[1..16],
+]}
+UNION!{union GDI_HANDLE_ENTRY_Owner {
+ s: GDI_HANDLE_ENTRY_Owner_s,
+ Value: ULONG,
+}}
+STRUCT!{struct GDI_HANDLE_ENTRY {
+ u: GDI_HANDLE_ENTRY_u,
+ Owner: GDI_HANDLE_ENTRY_Owner,
+ Unique: USHORT,
+ Type: UCHAR,
+ Flags: UCHAR,
+ UserPointer: PVOID,
+}}
+pub type PGDI_HANDLE_ENTRY = *mut GDI_HANDLE_ENTRY;
+STRUCT!{struct GDI_SHARED_MEMORY {
+ Handles: [GDI_HANDLE_ENTRY; GDI_MAX_HANDLE_COUNT],
+}}
+pub type PGDI_SHARED_MEMORY = *mut GDI_SHARED_MEMORY;
diff --git a/third_party/rust/ntapi/src/ntioapi.rs b/third_party/rust/ntapi/src/ntioapi.rs
new file mode 100644
index 0000000000..48c416b218
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntioapi.rs
@@ -0,0 +1,1464 @@
+use crate::string::UTF16Const;
+use crate::winapi_local::um::winioctl::CTL_CODE;
+use winapi::shared::basetsd::ULONG_PTR;
+use winapi::shared::guiddef::GUID;
+use winapi::shared::minwindef::DWORD;
+use winapi::shared::ntdef::{
+ BOOLEAN, CCHAR, CHAR, HANDLE, LARGE_INTEGER, LONG, LONGLONG, NTSTATUS, PBOOLEAN, PHANDLE,
+ PLARGE_INTEGER, POBJECT_ATTRIBUTES, PUCHAR, PULONG, PUNICODE_STRING, PVOID, UCHAR, ULONG,
+ ULONGLONG, USHORT, WCHAR,
+};
+use winapi::um::winioctl::{
+ FILE_ANY_ACCESS, FILE_DEVICE_MAILSLOT, FILE_DEVICE_NAMED_PIPE, METHOD_BUFFERED, METHOD_NEITHER,
+};
+use winapi::um::winnt::{
+ ACCESS_MASK, FILE_ID_128, FILE_READ_DATA, FILE_WRITE_DATA, PFILE_SEGMENT_ELEMENT, PSID, SID,
+};
+pub const FILE_SUPERSEDE: ULONG = 0x00000000;
+pub const FILE_OPEN: ULONG = 0x00000001;
+pub const FILE_CREATE: ULONG = 0x00000002;
+pub const FILE_OPEN_IF: ULONG = 0x00000003;
+pub const FILE_OVERWRITE: ULONG = 0x00000004;
+pub const FILE_OVERWRITE_IF: ULONG = 0x00000005;
+pub const FILE_MAXIMUM_DISPOSITION: ULONG = 0x00000005;
+pub const FILE_DIRECTORY_FILE: ULONG = 0x00000001;
+pub const FILE_WRITE_THROUGH: ULONG = 0x00000002;
+pub const FILE_SEQUENTIAL_ONLY: ULONG = 0x00000004;
+pub const FILE_NO_INTERMEDIATE_BUFFERING: ULONG = 0x00000008;
+pub const FILE_SYNCHRONOUS_IO_ALERT: ULONG = 0x00000010;
+pub const FILE_SYNCHRONOUS_IO_NONALERT: ULONG = 0x00000020;
+pub const FILE_NON_DIRECTORY_FILE: ULONG = 0x00000040;
+pub const FILE_CREATE_TREE_CONNECTION: ULONG = 0x00000080;
+pub const FILE_COMPLETE_IF_OPLOCKED: ULONG = 0x00000100;
+pub const FILE_NO_EA_KNOWLEDGE: ULONG = 0x00000200;
+pub const FILE_OPEN_FOR_RECOVERY: ULONG = 0x00000400;
+pub const FILE_RANDOM_ACCESS: ULONG = 0x00000800;
+pub const FILE_DELETE_ON_CLOSE: ULONG = 0x00001000;
+pub const FILE_OPEN_BY_FILE_ID: ULONG = 0x00002000;
+pub const FILE_OPEN_FOR_BACKUP_INTENT: ULONG = 0x00004000;
+pub const FILE_NO_COMPRESSION: ULONG = 0x00008000;
+pub const FILE_OPEN_REQUIRING_OPLOCK: ULONG = 0x00010000;
+pub const FILE_DISALLOW_EXCLUSIVE: ULONG = 0x00020000;
+pub const FILE_SESSION_AWARE: ULONG = 0x00040000;
+pub const FILE_RESERVE_OPFILTER: ULONG = 0x00100000;
+pub const FILE_OPEN_REPARSE_POINT: ULONG = 0x00200000;
+pub const FILE_OPEN_NO_RECALL: ULONG = 0x00400000;
+pub const FILE_OPEN_FOR_FREE_SPACE_QUERY: ULONG = 0x00800000;
+pub const FILE_COPY_STRUCTURED_STORAGE: ULONG = 0x00000041;
+pub const FILE_STRUCTURED_STORAGE: ULONG = 0x00000441;
+pub const FILE_SUPERSEDED: ULONG = 0x00000000;
+pub const FILE_OPENED: ULONG = 0x00000001;
+pub const FILE_CREATED: ULONG = 0x00000002;
+pub const FILE_OVERWRITTEN: ULONG = 0x00000003;
+pub const FILE_EXISTS: ULONG = 0x00000004;
+pub const FILE_DOES_NOT_EXIST: ULONG = 0x00000005;
+pub const FILE_WRITE_TO_END_OF_FILE: ULONG = 0xffffffff;
+pub const FILE_USE_FILE_POINTER_POSITION: ULONG = 0xfffffffe;
+pub const FILE_BYTE_ALIGNMENT: ULONG = 0x00000000;
+pub const FILE_WORD_ALIGNMENT: ULONG = 0x00000001;
+pub const FILE_LONG_ALIGNMENT: ULONG = 0x00000003;
+pub const FILE_QUAD_ALIGNMENT: ULONG = 0x00000007;
+pub const FILE_OCTA_ALIGNMENT: ULONG = 0x0000000f;
+pub const FILE_32_BYTE_ALIGNMENT: ULONG = 0x0000001f;
+pub const FILE_64_BYTE_ALIGNMENT: ULONG = 0x0000003f;
+pub const FILE_128_BYTE_ALIGNMENT: ULONG = 0x0000007f;
+pub const FILE_256_BYTE_ALIGNMENT: ULONG = 0x000000ff;
+pub const FILE_512_BYTE_ALIGNMENT: ULONG = 0x000001ff;
+pub const MAXIMUM_FILENAME_LENGTH: u32 = 256;
+pub const FILE_NEED_EA: ULONG = 0x00000080;
+pub const FILE_EA_TYPE_BINARY: ULONG = 0xfffe;
+pub const FILE_EA_TYPE_ASCII: ULONG = 0xfffd;
+pub const FILE_EA_TYPE_BITMAP: ULONG = 0xfffb;
+pub const FILE_EA_TYPE_METAFILE: ULONG = 0xfffa;
+pub const FILE_EA_TYPE_ICON: ULONG = 0xfff9;
+pub const FILE_EA_TYPE_EA: ULONG = 0xffee;
+pub const FILE_EA_TYPE_MVMT: ULONG = 0xffdf;
+pub const FILE_EA_TYPE_MVST: ULONG = 0xffde;
+pub const FILE_EA_TYPE_ASN1: ULONG = 0xffdd;
+pub const FILE_EA_TYPE_FAMILY_IDS: ULONG = 0xff01;
+pub const FILE_REMOVABLE_MEDIA: ULONG = 0x00000001;
+pub const FILE_READ_ONLY_DEVICE: ULONG = 0x00000002;
+pub const FILE_FLOPPY_DISKETTE: ULONG = 0x00000004;
+pub const FILE_WRITE_ONCE_MEDIA: ULONG = 0x00000008;
+pub const FILE_REMOTE_DEVICE: ULONG = 0x00000010;
+pub const FILE_DEVICE_IS_MOUNTED: ULONG = 0x00000020;
+pub const FILE_VIRTUAL_VOLUME: ULONG = 0x00000040;
+pub const FILE_AUTOGENERATED_DEVICE_NAME: ULONG = 0x00000080;
+pub const FILE_DEVICE_SECURE_OPEN: ULONG = 0x00000100;
+pub const FILE_CHARACTERISTIC_PNP_DEVICE: ULONG = 0x00000800;
+pub const FILE_CHARACTERISTIC_TS_DEVICE: ULONG = 0x00001000;
+pub const FILE_CHARACTERISTIC_WEBDAV_DEVICE: ULONG = 0x00002000;
+pub const FILE_CHARACTERISTIC_CSV: ULONG = 0x00010000;
+pub const FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL: ULONG = 0x00020000;
+pub const FILE_PORTABLE_DEVICE: ULONG = 0x00040000;
+pub const FILE_PIPE_BYTE_STREAM_TYPE: ULONG = 0x00000000;
+pub const FILE_PIPE_MESSAGE_TYPE: ULONG = 0x00000001;
+pub const FILE_PIPE_ACCEPT_REMOTE_CLIENTS: ULONG = 0x00000000;
+pub const FILE_PIPE_REJECT_REMOTE_CLIENTS: ULONG = 0x00000002;
+pub const FILE_PIPE_TYPE_VALID_MASK: ULONG = 0x00000003;
+pub const FILE_PIPE_QUEUE_OPERATION: ULONG = 0x00000000;
+pub const FILE_PIPE_COMPLETE_OPERATION: ULONG = 0x00000001;
+pub const FILE_PIPE_BYTE_STREAM_MODE: ULONG = 0x00000000;
+pub const FILE_PIPE_MESSAGE_MODE: ULONG = 0x00000001;
+pub const FILE_PIPE_INBOUND: ULONG = 0x00000000;
+pub const FILE_PIPE_OUTBOUND: ULONG = 0x00000001;
+pub const FILE_PIPE_FULL_DUPLEX: ULONG = 0x00000002;
+pub const FILE_PIPE_DISCONNECTED_STATE: ULONG = 0x00000001;
+pub const FILE_PIPE_LISTENING_STATE: ULONG = 0x00000002;
+pub const FILE_PIPE_CONNECTED_STATE: ULONG = 0x00000003;
+pub const FILE_PIPE_CLOSING_STATE: ULONG = 0x00000004;
+pub const FILE_PIPE_CLIENT_END: ULONG = 0x00000000;
+pub const FILE_PIPE_SERVER_END: ULONG = 0x00000001;
+pub const MAILSLOT_SIZE_AUTO: u32 = 0;
+UNION!{union IO_STATUS_BLOCK_u {
+ Status: NTSTATUS,
+ Pointer: PVOID,
+}}
+STRUCT!{struct IO_STATUS_BLOCK {
+ u: IO_STATUS_BLOCK_u,
+ Information: ULONG_PTR,
+}}
+pub type PIO_STATUS_BLOCK = *mut IO_STATUS_BLOCK;
+FN!{stdcall PIO_APC_ROUTINE(
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Reserved: ULONG,
+) -> ()}
+STRUCT!{struct FILE_IO_COMPLETION_INFORMATION {
+ KeyContext: PVOID,
+ ApcContext: PVOID,
+ IoStatusBlock: IO_STATUS_BLOCK,
+}}
+pub type PFILE_IO_COMPLETION_INFORMATION = *mut FILE_IO_COMPLETION_INFORMATION;
+ENUM!{enum FILE_INFORMATION_CLASS {
+ FileDirectoryInformation = 1,
+ FileFullDirectoryInformation = 2,
+ FileBothDirectoryInformation = 3,
+ FileBasicInformation = 4,
+ FileStandardInformation = 5,
+ FileInternalInformation = 6,
+ FileEaInformation = 7,
+ FileAccessInformation = 8,
+ FileNameInformation = 9,
+ FileRenameInformation = 10,
+ FileLinkInformation = 11,
+ FileNamesInformation = 12,
+ FileDispositionInformation = 13,
+ FilePositionInformation = 14,
+ FileFullEaInformation = 15,
+ FileModeInformation = 16,
+ FileAlignmentInformation = 17,
+ FileAllInformation = 18,
+ FileAllocationInformation = 19,
+ FileEndOfFileInformation = 20,
+ FileAlternateNameInformation = 21,
+ FileStreamInformation = 22,
+ FilePipeInformation = 23,
+ FilePipeLocalInformation = 24,
+ FilePipeRemoteInformation = 25,
+ FileMailslotQueryInformation = 26,
+ FileMailslotSetInformation = 27,
+ FileCompressionInformation = 28,
+ FileObjectIdInformation = 29,
+ FileCompletionInformation = 30,
+ FileMoveClusterInformation = 31,
+ FileQuotaInformation = 32,
+ FileReparsePointInformation = 33,
+ FileNetworkOpenInformation = 34,
+ FileAttributeTagInformation = 35,
+ FileTrackingInformation = 36,
+ FileIdBothDirectoryInformation = 37,
+ FileIdFullDirectoryInformation = 38,
+ FileValidDataLengthInformation = 39,
+ FileShortNameInformation = 40,
+ FileIoCompletionNotificationInformation = 41,
+ FileIoStatusBlockRangeInformation = 42,
+ FileIoPriorityHintInformation = 43,
+ FileSfioReserveInformation = 44,
+ FileSfioVolumeInformation = 45,
+ FileHardLinkInformation = 46,
+ FileProcessIdsUsingFileInformation = 47,
+ FileNormalizedNameInformation = 48,
+ FileNetworkPhysicalNameInformation = 49,
+ FileIdGlobalTxDirectoryInformation = 50,
+ FileIsRemoteDeviceInformation = 51,
+ FileUnusedInformation = 52,
+ FileNumaNodeInformation = 53,
+ FileStandardLinkInformation = 54,
+ FileRemoteProtocolInformation = 55,
+ FileRenameInformationBypassAccessCheck = 56,
+ FileLinkInformationBypassAccessCheck = 57,
+ FileVolumeNameInformation = 58,
+ FileIdInformation = 59,
+ FileIdExtdDirectoryInformation = 60,
+ FileReplaceCompletionInformation = 61,
+ FileHardLinkFullIdInformation = 62,
+ FileIdExtdBothDirectoryInformation = 63,
+ FileDispositionInformationEx = 64,
+ FileRenameInformationEx = 65,
+ FileRenameInformationExBypassAccessCheck = 66,
+ FileDesiredStorageClassInformation = 67,
+ FileStatInformation = 68,
+ FileMemoryPartitionInformation = 69,
+ FileStatLxInformation = 70,
+ FileCaseSensitiveInformation = 71,
+ FileLinkInformationEx = 72,
+ FileLinkInformationExBypassAccessCheck = 73,
+ FileStorageReserveIdInformation = 74,
+ FileCaseSensitiveInformationForceAccessCheck = 75,
+ FileMaximumInformation = 76,
+}}
+pub type PFILE_INFORMATION_CLASS = *mut FILE_INFORMATION_CLASS;
+STRUCT!{struct FILE_BASIC_INFORMATION {
+ CreationTime: LARGE_INTEGER,
+ LastAccessTime: LARGE_INTEGER,
+ LastWriteTime: LARGE_INTEGER,
+ ChangeTime: LARGE_INTEGER,
+ FileAttributes: ULONG,
+}}
+pub type PFILE_BASIC_INFORMATION = *mut FILE_BASIC_INFORMATION;
+STRUCT!{struct FILE_STANDARD_INFORMATION {
+ AllocationSize: LARGE_INTEGER,
+ EndOfFile: LARGE_INTEGER,
+ NumberOfLinks: ULONG,
+ DeletePending: BOOLEAN,
+ Directory: BOOLEAN,
+}}
+pub type PFILE_STANDARD_INFORMATION = *mut FILE_STANDARD_INFORMATION;
+STRUCT!{struct FILE_STANDARD_INFORMATION_EX {
+ AllocationSize: LARGE_INTEGER,
+ EndOfFile: LARGE_INTEGER,
+ NumberOfLinks: ULONG,
+ DeletePending: BOOLEAN,
+ Directory: BOOLEAN,
+ AlternateStream: BOOLEAN,
+ MetadataAttribute: BOOLEAN,
+}}
+pub type PFILE_STANDARD_INFORMATION_EX = *mut FILE_STANDARD_INFORMATION_EX;
+STRUCT!{struct FILE_INTERNAL_INFORMATION {
+ IndexNumber: LARGE_INTEGER,
+}}
+pub type PFILE_INTERNAL_INFORMATION = *mut FILE_INTERNAL_INFORMATION;
+STRUCT!{struct FILE_EA_INFORMATION {
+ EaSize: ULONG,
+}}
+pub type PFILE_EA_INFORMATION = *mut FILE_EA_INFORMATION;
+STRUCT!{struct FILE_ACCESS_INFORMATION {
+ AccessFlags: ACCESS_MASK,
+}}
+pub type PFILE_ACCESS_INFORMATION = *mut FILE_ACCESS_INFORMATION;
+STRUCT!{struct FILE_POSITION_INFORMATION {
+ CurrentByteOffset: LARGE_INTEGER,
+}}
+pub type PFILE_POSITION_INFORMATION = *mut FILE_POSITION_INFORMATION;
+STRUCT!{struct FILE_MODE_INFORMATION {
+ Mode: ULONG,
+}}
+pub type PFILE_MODE_INFORMATION = *mut FILE_MODE_INFORMATION;
+STRUCT!{struct FILE_ALIGNMENT_INFORMATION {
+ AlignmentRequirement: ULONG,
+}}
+pub type PFILE_ALIGNMENT_INFORMATION = *mut FILE_ALIGNMENT_INFORMATION;
+STRUCT!{struct FILE_NAME_INFORMATION {
+ FileNameLength: ULONG,
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_NAME_INFORMATION = *mut FILE_NAME_INFORMATION;
+STRUCT!{struct FILE_ALL_INFORMATION {
+ BasicInformation: FILE_BASIC_INFORMATION,
+ StandardInformation: FILE_STANDARD_INFORMATION,
+ InternalInformation: FILE_INTERNAL_INFORMATION,
+ EaInformation: FILE_EA_INFORMATION,
+ AccessInformation: FILE_ACCESS_INFORMATION,
+ PositionInformation: FILE_POSITION_INFORMATION,
+ ModeInformation: FILE_MODE_INFORMATION,
+ AlignmentInformation: FILE_ALIGNMENT_INFORMATION,
+ NameInformation: FILE_NAME_INFORMATION,
+}}
+pub type PFILE_ALL_INFORMATION = *mut FILE_ALL_INFORMATION;
+STRUCT!{struct FILE_NETWORK_OPEN_INFORMATION {
+ CreationTime: LARGE_INTEGER,
+ LastAccessTime: LARGE_INTEGER,
+ LastWriteTime: LARGE_INTEGER,
+ ChangeTime: LARGE_INTEGER,
+ AllocationSize: LARGE_INTEGER,
+ EndOfFile: LARGE_INTEGER,
+ FileAttributes: ULONG,
+}}
+pub type PFILE_NETWORK_OPEN_INFORMATION = *mut FILE_NETWORK_OPEN_INFORMATION;
+STRUCT!{struct FILE_ATTRIBUTE_TAG_INFORMATION {
+ FileAttributes: ULONG,
+ ReparseTag: ULONG,
+}}
+pub type PFILE_ATTRIBUTE_TAG_INFORMATION = *mut FILE_ATTRIBUTE_TAG_INFORMATION;
+STRUCT!{struct FILE_ALLOCATION_INFORMATION {
+ AllocationSize: LARGE_INTEGER,
+}}
+pub type PFILE_ALLOCATION_INFORMATION = *mut FILE_ALLOCATION_INFORMATION;
+STRUCT!{struct FILE_COMPRESSION_INFORMATION {
+ CompressedFileSize: LARGE_INTEGER,
+ CompressionFormat: USHORT,
+ CompressionUnitShift: UCHAR,
+ ChunkShift: UCHAR,
+ ClusterShift: UCHAR,
+ Reserved: [UCHAR; 3],
+}}
+pub type PFILE_COMPRESSION_INFORMATION = *mut FILE_COMPRESSION_INFORMATION;
+STRUCT!{struct FILE_DISPOSITION_INFORMATION {
+ DeleteFileA: BOOLEAN,
+}}
+pub type PFILE_DISPOSITION_INFORMATION = *mut FILE_DISPOSITION_INFORMATION;
+STRUCT!{struct FILE_END_OF_FILE_INFORMATION {
+ EndOfFile: LARGE_INTEGER,
+}}
+pub type PFILE_END_OF_FILE_INFORMATION = *mut FILE_END_OF_FILE_INFORMATION;
+STRUCT!{struct FILE_VALID_DATA_LENGTH_INFORMATION {
+ ValidDataLength: LARGE_INTEGER,
+}}
+pub type PFILE_VALID_DATA_LENGTH_INFORMATION = *mut FILE_VALID_DATA_LENGTH_INFORMATION;
+STRUCT!{struct FILE_LINK_INFORMATION {
+ ReplaceIfExists: BOOLEAN,
+ RootDirectory: HANDLE,
+ FileNameLength: ULONG,
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_LINK_INFORMATION = *mut FILE_LINK_INFORMATION;
+STRUCT!{struct FILE_MOVE_CLUSTER_INFORMATION {
+ ClusterCount: ULONG,
+ RootDirectory: HANDLE,
+ FileNameLength: ULONG,
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_MOVE_CLUSTER_INFORMATION = *mut FILE_MOVE_CLUSTER_INFORMATION;
+STRUCT!{struct FILE_RENAME_INFORMATION {
+ ReplaceIfExists: BOOLEAN,
+ RootDirectory: HANDLE,
+ FileNameLength: ULONG,
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_RENAME_INFORMATION = *mut FILE_RENAME_INFORMATION;
+STRUCT!{struct FILE_STREAM_INFORMATION {
+ NextEntryOffset: ULONG,
+ StreamNameLength: ULONG,
+ StreamSize: LARGE_INTEGER,
+ StreamAllocationSize: LARGE_INTEGER,
+ StreamName: [WCHAR; 1],
+}}
+pub type PFILE_STREAM_INFORMATION = *mut FILE_STREAM_INFORMATION;
+STRUCT!{struct FILE_TRACKING_INFORMATION {
+ DestinationFile: HANDLE,
+ ObjectInformationLength: ULONG,
+ ObjectInformation: [CHAR; 1],
+}}
+pub type PFILE_TRACKING_INFORMATION = *mut FILE_TRACKING_INFORMATION;
+STRUCT!{struct FILE_COMPLETION_INFORMATION {
+ Port: HANDLE,
+ Key: PVOID,
+}}
+pub type PFILE_COMPLETION_INFORMATION = *mut FILE_COMPLETION_INFORMATION;
+STRUCT!{struct FILE_PIPE_INFORMATION {
+ ReadMode: ULONG,
+ CompletionMode: ULONG,
+}}
+pub type PFILE_PIPE_INFORMATION = *mut FILE_PIPE_INFORMATION;
+STRUCT!{struct FILE_PIPE_LOCAL_INFORMATION {
+ NamedPipeType: ULONG,
+ NamedPipeConfiguration: ULONG,
+ MaximumInstances: ULONG,
+ CurrentInstances: ULONG,
+ InboundQuota: ULONG,
+ ReadDataAvailable: ULONG,
+ OutboundQuota: ULONG,
+ WriteQuotaAvailable: ULONG,
+ NamedPipeState: ULONG,
+ NamedPipeEnd: ULONG,
+}}
+pub type PFILE_PIPE_LOCAL_INFORMATION = *mut FILE_PIPE_LOCAL_INFORMATION;
+STRUCT!{struct FILE_PIPE_REMOTE_INFORMATION {
+ CollectDataTime: LARGE_INTEGER,
+ MaximumCollectionCount: ULONG,
+}}
+pub type PFILE_PIPE_REMOTE_INFORMATION = *mut FILE_PIPE_REMOTE_INFORMATION;
+STRUCT!{struct FILE_MAILSLOT_QUERY_INFORMATION {
+ MaximumMessageSize: ULONG,
+ MailslotQuota: ULONG,
+ NextMessageSize: ULONG,
+ MessagesAvailable: ULONG,
+ ReadTimeout: LARGE_INTEGER,
+}}
+pub type PFILE_MAILSLOT_QUERY_INFORMATION = *mut FILE_MAILSLOT_QUERY_INFORMATION;
+STRUCT!{struct FILE_MAILSLOT_SET_INFORMATION {
+ ReadTimeout: PLARGE_INTEGER,
+}}
+pub type PFILE_MAILSLOT_SET_INFORMATION = *mut FILE_MAILSLOT_SET_INFORMATION;
+STRUCT!{struct FILE_REPARSE_POINT_INFORMATION {
+ FileReference: LONGLONG,
+ Tag: ULONG,
+}}
+pub type PFILE_REPARSE_POINT_INFORMATION = *mut FILE_REPARSE_POINT_INFORMATION;
+STRUCT!{struct FILE_LINK_ENTRY_INFORMATION {
+ NextEntryOffset: ULONG,
+ ParentFileId: LONGLONG,
+ FileNameLength: ULONG,
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_LINK_ENTRY_INFORMATION = *mut FILE_LINK_ENTRY_INFORMATION;
+STRUCT!{struct FILE_LINKS_INFORMATION {
+ BytesNeeded: ULONG,
+ EntriesReturned: ULONG,
+ Entry: FILE_LINK_ENTRY_INFORMATION,
+}}
+pub type PFILE_LINKS_INFORMATION = *mut FILE_LINKS_INFORMATION;
+STRUCT!{struct FILE_NETWORK_PHYSICAL_NAME_INFORMATION {
+ FileNameLength: ULONG,
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_NETWORK_PHYSICAL_NAME_INFORMATION = *mut FILE_NETWORK_PHYSICAL_NAME_INFORMATION;
+STRUCT!{struct FILE_STANDARD_LINK_INFORMATION {
+ NumberOfAccessibleLinks: ULONG,
+ TotalNumberOfLinks: ULONG,
+ DeletePending: BOOLEAN,
+ Directory: BOOLEAN,
+}}
+pub type PFILE_STANDARD_LINK_INFORMATION = *mut FILE_STANDARD_LINK_INFORMATION;
+STRUCT!{struct FILE_SFIO_RESERVE_INFORMATION {
+ RequestsPerPeriod: ULONG,
+ Period: ULONG,
+ RetryFailures: BOOLEAN,
+ Discardable: BOOLEAN,
+ RequestSize: ULONG,
+ NumOutstandingRequests: ULONG,
+}}
+pub type PFILE_SFIO_RESERVE_INFORMATION = *mut FILE_SFIO_RESERVE_INFORMATION;
+STRUCT!{struct FILE_SFIO_VOLUME_INFORMATION {
+ MaximumRequestsPerPeriod: ULONG,
+ MinimumPeriod: ULONG,
+ MinimumTransferSize: ULONG,
+}}
+pub type PFILE_SFIO_VOLUME_INFORMATION = *mut FILE_SFIO_VOLUME_INFORMATION;
+ENUM!{enum IO_PRIORITY_HINT {
+ IoPriorityVeryLow = 0,
+ IoPriorityLow = 1,
+ IoPriorityNormal = 2,
+ IoPriorityHigh = 3,
+ IoPriorityCritical = 4,
+ MaxIoPriorityTypes = 5,
+}}
+STRUCT!{struct FILE_IO_PRIORITY_HINT_INFORMATION {
+ PriorityHint: IO_PRIORITY_HINT,
+}}
+pub type PFILE_IO_PRIORITY_HINT_INFORMATION = *mut FILE_IO_PRIORITY_HINT_INFORMATION;
+STRUCT!{struct FILE_IO_PRIORITY_HINT_INFORMATION_EX {
+ PriorityHint: IO_PRIORITY_HINT,
+ BoostOutstanding: BOOLEAN,
+}}
+pub type PFILE_IO_PRIORITY_HINT_INFORMATION_EX = *mut FILE_IO_PRIORITY_HINT_INFORMATION_EX;
+pub const FILE_SKIP_COMPLETION_PORT_ON_SUCCESS: u32 = 0x1;
+pub const FILE_SKIP_SET_EVENT_ON_HANDLE: u32 = 0x2;
+pub const FILE_SKIP_SET_USER_EVENT_ON_FAST_IO: u32 = 0x4;
+STRUCT!{struct FILE_IO_COMPLETION_NOTIFICATION_INFORMATION {
+ Flags: ULONG,
+}}
+pub type PFILE_IO_COMPLETION_NOTIFICATION_INFORMATION =
+ *mut FILE_IO_COMPLETION_NOTIFICATION_INFORMATION;
+STRUCT!{struct FILE_PROCESS_IDS_USING_FILE_INFORMATION {
+ NumberOfProcessIdsInList: ULONG,
+ ProcessIdList: [ULONG_PTR; 1],
+}}
+pub type PFILE_PROCESS_IDS_USING_FILE_INFORMATION = *mut FILE_PROCESS_IDS_USING_FILE_INFORMATION;
+STRUCT!{struct FILE_IS_REMOTE_DEVICE_INFORMATION {
+ IsRemote: BOOLEAN,
+}}
+pub type PFILE_IS_REMOTE_DEVICE_INFORMATION = *mut FILE_IS_REMOTE_DEVICE_INFORMATION;
+STRUCT!{struct FILE_NUMA_NODE_INFORMATION {
+ NodeNumber: USHORT,
+}}
+pub type PFILE_NUMA_NODE_INFORMATION = *mut FILE_NUMA_NODE_INFORMATION;
+STRUCT!{struct FILE_IOSTATUSBLOCK_RANGE_INFORMATION {
+ IoStatusBlockRange: PUCHAR,
+ Length: ULONG,
+}}
+pub type PFILE_IOSTATUSBLOCK_RANGE_INFORMATION = *mut FILE_IOSTATUSBLOCK_RANGE_INFORMATION;
+STRUCT!{struct FILE_REMOTE_PROTOCOL_INFORMATION_GenericReserved {
+ Reserved: [ULONG; 8],
+}}
+STRUCT!{struct FILE_REMOTE_PROTOCOL_INFORMATION_ProtocolSpecific_Smb2_Server {
+ Capabilities: ULONG,
+}}
+STRUCT!{struct FILE_REMOTE_PROTOCOL_INFORMATION_ProtocolSpecific_Smb2_Share {
+ Capabilities: ULONG,
+ CachingFlags: ULONG,
+}}
+STRUCT!{struct FILE_REMOTE_PROTOCOL_INFORMATION_ProtocolSpecific_Smb2 {
+ Server: FILE_REMOTE_PROTOCOL_INFORMATION_ProtocolSpecific_Smb2_Server,
+ Share: FILE_REMOTE_PROTOCOL_INFORMATION_ProtocolSpecific_Smb2_Share,
+}}
+UNION!{union FILE_REMOTE_PROTOCOL_INFORMATION_ProtocolSpecific {
+ Smb2: FILE_REMOTE_PROTOCOL_INFORMATION_ProtocolSpecific_Smb2,
+ Reserved: [ULONG; 16],
+}}
+STRUCT!{struct FILE_REMOTE_PROTOCOL_INFORMATION {
+ StructureVersion: USHORT,
+ StructureSize: USHORT,
+ Protocol: ULONG,
+ ProtocolMajorVersion: USHORT,
+ ProtocolMinorVersion: USHORT,
+ ProtocolRevision: USHORT,
+ Reserved: USHORT,
+ Flags: ULONG,
+ GenericReserved: FILE_REMOTE_PROTOCOL_INFORMATION_GenericReserved,
+ ProtocolSpecific: FILE_REMOTE_PROTOCOL_INFORMATION_ProtocolSpecific,
+}}
+pub type PFILE_REMOTE_PROTOCOL_INFORMATION = *mut FILE_REMOTE_PROTOCOL_INFORMATION;
+pub const CHECKSUM_ENFORCEMENT_OFF: u32 = 0x00000001;
+STRUCT!{struct FILE_INTEGRITY_STREAM_INFORMATION {
+ ChecksumAlgorithm: USHORT,
+ ChecksumChunkShift: UCHAR,
+ ClusterShift: UCHAR,
+ Flags: ULONG,
+}}
+pub type PFILE_INTEGRITY_STREAM_INFORMATION = *mut FILE_INTEGRITY_STREAM_INFORMATION;
+STRUCT!{struct FILE_VOLUME_NAME_INFORMATION {
+ DeviceNameLength: ULONG,
+ DeviceName: [WCHAR; 1],
+}}
+pub type PFILE_VOLUME_NAME_INFORMATION = *mut FILE_VOLUME_NAME_INFORMATION;
+STRUCT!{struct FILE_ID_INFORMATION {
+ VolumeSerialNumber: ULONGLONG,
+ FileId: FILE_ID_128,
+}}
+pub type PFILE_ID_INFORMATION = *mut FILE_ID_INFORMATION;
+STRUCT!{struct FILE_ID_EXTD_DIR_INFORMATION {
+ NextEntryOffset: ULONG,
+ FileIndex: ULONG,
+ CreationTime: LARGE_INTEGER,
+ LastAccessTime: LARGE_INTEGER,
+ LastWriteTime: LARGE_INTEGER,
+ ChangeTime: LARGE_INTEGER,
+ EndOfFile: LARGE_INTEGER,
+ AllocationSize: LARGE_INTEGER,
+ FileAttributes: ULONG,
+ FileNameLength: ULONG,
+ EaSize: ULONG,
+ ReparsePointTag: ULONG,
+ FileId: FILE_ID_128,
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_ID_EXTD_DIR_INFORMATION = *mut FILE_ID_EXTD_DIR_INFORMATION;
+STRUCT!{struct FILE_LINK_ENTRY_FULL_ID_INFORMATION {
+ NextEntryOffset: ULONG,
+ ParentFileId: FILE_ID_128,
+ FileNameLength: ULONG,
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_LINK_ENTRY_FULL_ID_INFORMATION = *mut FILE_LINK_ENTRY_FULL_ID_INFORMATION;
+STRUCT!{struct FILE_ID_EXTD_BOTH_DIR_INFORMATION {
+ NextEntryOffset: ULONG,
+ FileIndex: ULONG,
+ CreationTime: LARGE_INTEGER,
+ LastAccessTime: LARGE_INTEGER,
+ LastWriteTime: LARGE_INTEGER,
+ ChangeTime: LARGE_INTEGER,
+ EndOfFile: LARGE_INTEGER,
+ AllocationSize: LARGE_INTEGER,
+ FileAttributes: ULONG,
+ FileNameLength: ULONG,
+ EaSize: ULONG,
+ ReparsePointTag: ULONG,
+ FileId: FILE_ID_128,
+ ShortNameLength: CCHAR,
+ ShortName: [WCHAR; 12],
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_ID_EXTD_BOTH_DIR_INFORMATION = *mut FILE_ID_EXTD_BOTH_DIR_INFORMATION;
+STRUCT!{struct FILE_STAT_INFORMATION {
+ FileId: LARGE_INTEGER,
+ CreationTime: LARGE_INTEGER,
+ LastAccessTime: LARGE_INTEGER,
+ LastWriteTime: LARGE_INTEGER,
+ ChangeTime: LARGE_INTEGER,
+ AllocationSize: LARGE_INTEGER,
+ EndOfFile: LARGE_INTEGER,
+ FileAttributes: ULONG,
+ ReparseTag: ULONG,
+ NumberOfLinks: ULONG,
+ EffectiveAccess: ULONG,
+}}
+pub type PFILE_STAT_INFORMATION = *mut FILE_STAT_INFORMATION;
+STRUCT!{struct FILE_MEMORY_PARTITION_INFORMATION_Flags_s {
+ NoCrossPartitionAccess: UCHAR,
+ Spare: [UCHAR; 3],
+}}
+UNION!{union FILE_MEMORY_PARTITION_INFORMATION_Flags {
+ s: FILE_MEMORY_PARTITION_INFORMATION_Flags_s,
+ AllFlags: ULONG,
+}}
+STRUCT!{struct FILE_MEMORY_PARTITION_INFORMATION {
+ OwnerPartitionHandle: HANDLE,
+ Flags: FILE_MEMORY_PARTITION_INFORMATION_Flags,
+}}
+pub type PFILE_MEMORY_PARTITION_INFORMATION = *mut FILE_MEMORY_PARTITION_INFORMATION;
+STRUCT!{struct FILE_STAT_LX_INFORMATION {
+ FileId: LARGE_INTEGER,
+ CreationTime: LARGE_INTEGER,
+ LastAccessTime: LARGE_INTEGER,
+ LastWriteTime: LARGE_INTEGER,
+ ChangeTime: LARGE_INTEGER,
+ AllocationSize: LARGE_INTEGER,
+ EndOfFile: LARGE_INTEGER,
+ FileAttributes: ULONG,
+ ReparseTag: ULONG,
+ NumberOfLinks: ULONG,
+ EffectiveAccess: ULONG,
+ LxFlags: ULONG,
+ LxUid: ULONG,
+ LxGid: ULONG,
+ LxMode: ULONG,
+ LxDeviceIdMajor: ULONG,
+ LxDeviceIdMinor: ULONG,
+}}
+pub type PFILE_STAT_LX_INFORMATION = *mut FILE_STAT_LX_INFORMATION;
+STRUCT!{struct FILE_CASE_SENSITIVE_INFORMATION {
+ Flags: ULONG,
+}}
+pub type PFILE_CASE_SENSITIVE_INFORMATION = *mut FILE_CASE_SENSITIVE_INFORMATION;
+STRUCT!{struct FILE_DIRECTORY_INFORMATION {
+ NextEntryOffset: ULONG,
+ FileIndex: ULONG,
+ CreationTime: LARGE_INTEGER,
+ LastAccessTime: LARGE_INTEGER,
+ LastWriteTime: LARGE_INTEGER,
+ ChangeTime: LARGE_INTEGER,
+ EndOfFile: LARGE_INTEGER,
+ AllocationSize: LARGE_INTEGER,
+ FileAttributes: ULONG,
+ FileNameLength: ULONG,
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_DIRECTORY_INFORMATION = *mut FILE_DIRECTORY_INFORMATION;
+STRUCT!{struct FILE_FULL_DIR_INFORMATION {
+ NextEntryOffset: ULONG,
+ FileIndex: ULONG,
+ CreationTime: LARGE_INTEGER,
+ LastAccessTime: LARGE_INTEGER,
+ LastWriteTime: LARGE_INTEGER,
+ ChangeTime: LARGE_INTEGER,
+ EndOfFile: LARGE_INTEGER,
+ AllocationSize: LARGE_INTEGER,
+ FileAttributes: ULONG,
+ FileNameLength: ULONG,
+ EaSize: ULONG,
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_FULL_DIR_INFORMATION = *mut FILE_FULL_DIR_INFORMATION;
+STRUCT!{struct FILE_ID_FULL_DIR_INFORMATION {
+ NextEntryOffset: ULONG,
+ FileIndex: ULONG,
+ CreationTime: LARGE_INTEGER,
+ LastAccessTime: LARGE_INTEGER,
+ LastWriteTime: LARGE_INTEGER,
+ ChangeTime: LARGE_INTEGER,
+ EndOfFile: LARGE_INTEGER,
+ AllocationSize: LARGE_INTEGER,
+ FileAttributes: ULONG,
+ FileNameLength: ULONG,
+ EaSize: ULONG,
+ FileId: LARGE_INTEGER,
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_ID_FULL_DIR_INFORMATION = *mut FILE_ID_FULL_DIR_INFORMATION;
+STRUCT!{struct FILE_BOTH_DIR_INFORMATION {
+ NextEntryOffset: ULONG,
+ FileIndex: ULONG,
+ CreationTime: LARGE_INTEGER,
+ LastAccessTime: LARGE_INTEGER,
+ LastWriteTime: LARGE_INTEGER,
+ ChangeTime: LARGE_INTEGER,
+ EndOfFile: LARGE_INTEGER,
+ AllocationSize: LARGE_INTEGER,
+ FileAttributes: ULONG,
+ FileNameLength: ULONG,
+ EaSize: ULONG,
+ ShortNameLength: CCHAR,
+ ShortName: [WCHAR; 12],
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_BOTH_DIR_INFORMATION = *mut FILE_BOTH_DIR_INFORMATION;
+STRUCT!{struct FILE_ID_BOTH_DIR_INFORMATION {
+ NextEntryOffset: ULONG,
+ FileIndex: ULONG,
+ CreationTime: LARGE_INTEGER,
+ LastAccessTime: LARGE_INTEGER,
+ LastWriteTime: LARGE_INTEGER,
+ ChangeTime: LARGE_INTEGER,
+ EndOfFile: LARGE_INTEGER,
+ AllocationSize: LARGE_INTEGER,
+ FileAttributes: ULONG,
+ FileNameLength: ULONG,
+ EaSize: ULONG,
+ ShortNameLength: CCHAR,
+ ShortName: [WCHAR; 12],
+ FileId: LARGE_INTEGER,
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_ID_BOTH_DIR_INFORMATION = *mut FILE_ID_BOTH_DIR_INFORMATION;
+STRUCT!{struct FILE_NAMES_INFORMATION {
+ NextEntryOffset: ULONG,
+ FileIndex: ULONG,
+ FileNameLength: ULONG,
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_NAMES_INFORMATION = *mut FILE_NAMES_INFORMATION;
+STRUCT!{struct FILE_ID_GLOBAL_TX_DIR_INFORMATION {
+ NextEntryOffset: ULONG,
+ FileIndex: ULONG,
+ CreationTime: LARGE_INTEGER,
+ LastAccessTime: LARGE_INTEGER,
+ LastWriteTime: LARGE_INTEGER,
+ ChangeTime: LARGE_INTEGER,
+ EndOfFile: LARGE_INTEGER,
+ AllocationSize: LARGE_INTEGER,
+ FileAttributes: ULONG,
+ FileNameLength: ULONG,
+ FileId: LARGE_INTEGER,
+ LockingTransactionId: GUID,
+ TxInfoFlags: ULONG,
+ FileName: [WCHAR; 1],
+}}
+pub type PFILE_ID_GLOBAL_TX_DIR_INFORMATION = *mut FILE_ID_GLOBAL_TX_DIR_INFORMATION;
+pub const FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_WRITELOCKED: u32 = 0x00000001;
+pub const FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_TO_TX: u32 = 0x00000002;
+pub const FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_OUTSIDE_TX: u32 = 0x00000004;
+STRUCT!{struct FILE_OBJECTID_INFORMATION_u_s {
+ BirthVolumeId: [UCHAR; 16],
+ BirthObjectId: [UCHAR; 16],
+ DomainId: [UCHAR; 16],
+}}
+UNION!{union FILE_OBJECTID_INFORMATION_u {
+ s: FILE_OBJECTID_INFORMATION_u_s,
+ ExtendedInfo: [UCHAR; 48],
+}}
+STRUCT!{struct FILE_OBJECTID_INFORMATION {
+ FileReference: LONGLONG,
+ ObjectId: [UCHAR; 16],
+ u: FILE_OBJECTID_INFORMATION_u,
+}}
+pub type PFILE_OBJECTID_INFORMATION = *mut FILE_OBJECTID_INFORMATION;
+STRUCT!{struct FILE_FULL_EA_INFORMATION {
+ NextEntryOffset: ULONG,
+ Flags: UCHAR,
+ EaNameLength: UCHAR,
+ EaValueLength: USHORT,
+ EaName: [CHAR; 1],
+}}
+pub type PFILE_FULL_EA_INFORMATION = *mut FILE_FULL_EA_INFORMATION;
+STRUCT!{struct FILE_GET_EA_INFORMATION {
+ NextEntryOffset: ULONG,
+ EaNameLength: UCHAR,
+ EaName: [CHAR; 1],
+}}
+pub type PFILE_GET_EA_INFORMATION = *mut FILE_GET_EA_INFORMATION;
+STRUCT!{struct FILE_GET_QUOTA_INFORMATION {
+ NextEntryOffset: ULONG,
+ SidLength: ULONG,
+ Sid: SID,
+}}
+pub type PFILE_GET_QUOTA_INFORMATION = *mut FILE_GET_QUOTA_INFORMATION;
+STRUCT!{struct FILE_QUOTA_INFORMATION {
+ NextEntryOffset: ULONG,
+ SidLength: ULONG,
+ ChangeTime: LARGE_INTEGER,
+ QuotaUsed: LARGE_INTEGER,
+ QuotaThreshold: LARGE_INTEGER,
+ QuotaLimit: LARGE_INTEGER,
+ Sid: SID,
+}}
+pub type PFILE_QUOTA_INFORMATION = *mut FILE_QUOTA_INFORMATION;
+ENUM!{enum FS_INFORMATION_CLASS {
+ FileFsVolumeInformation = 1,
+ FileFsLabelInformation = 2,
+ FileFsSizeInformation = 3,
+ FileFsDeviceInformation = 4,
+ FileFsAttributeInformation = 5,
+ FileFsControlInformation = 6,
+ FileFsFullSizeInformation = 7,
+ FileFsObjectIdInformation = 8,
+ FileFsDriverPathInformation = 9,
+ FileFsVolumeFlagsInformation = 10,
+ FileFsSectorSizeInformation = 11,
+ FileFsDataCopyInformation = 12,
+ FileFsMetadataSizeInformation = 13,
+ FileFsFullSizeInformationEx = 14,
+ FileFsMaximumInformation = 15,
+}}
+pub type PFS_INFORMATION_CLASS = *mut FS_INFORMATION_CLASS;
+STRUCT!{struct FILE_FS_LABEL_INFORMATION {
+ VolumeLabelLength: ULONG,
+ VolumeLabel: [WCHAR; 1],
+}}
+pub type PFILE_FS_LABEL_INFORMATION = *mut FILE_FS_LABEL_INFORMATION;
+STRUCT!{struct FILE_FS_VOLUME_INFORMATION {
+ VolumeCreationTime: LARGE_INTEGER,
+ VolumeSerialNumber: ULONG,
+ VolumeLabelLength: ULONG,
+ SupportsObjects: BOOLEAN,
+ VolumeLabel: [WCHAR; 1],
+}}
+pub type PFILE_FS_VOLUME_INFORMATION = *mut FILE_FS_VOLUME_INFORMATION;
+STRUCT!{struct FILE_FS_SIZE_INFORMATION {
+ TotalAllocationUnits: LARGE_INTEGER,
+ AvailableAllocationUnits: LARGE_INTEGER,
+ SectorsPerAllocationUnit: ULONG,
+ BytesPerSector: ULONG,
+}}
+pub type PFILE_FS_SIZE_INFORMATION = *mut FILE_FS_SIZE_INFORMATION;
+STRUCT!{struct FILE_FS_CONTROL_INFORMATION {
+ FreeSpaceStartFiltering: LARGE_INTEGER,
+ FreeSpaceThreshold: LARGE_INTEGER,
+ FreeSpaceStopFiltering: LARGE_INTEGER,
+ DefaultQuotaThreshold: LARGE_INTEGER,
+ DefaultQuotaLimit: LARGE_INTEGER,
+ FileSystemControlFlags: ULONG,
+}}
+pub type PFILE_FS_CONTROL_INFORMATION = *mut FILE_FS_CONTROL_INFORMATION;
+STRUCT!{struct FILE_FS_FULL_SIZE_INFORMATION {
+ TotalAllocationUnits: LARGE_INTEGER,
+ CallerAvailableAllocationUnits: LARGE_INTEGER,
+ ActualAvailableAllocationUnits: LARGE_INTEGER,
+ SectorsPerAllocationUnit: ULONG,
+ BytesPerSector: ULONG,
+}}
+pub type PFILE_FS_FULL_SIZE_INFORMATION = *mut FILE_FS_FULL_SIZE_INFORMATION;
+STRUCT!{struct FILE_FS_OBJECTID_INFORMATION {
+ ObjectId: [UCHAR; 16],
+ ExtendedInfo: [UCHAR; 48],
+}}
+pub type PFILE_FS_OBJECTID_INFORMATION = *mut FILE_FS_OBJECTID_INFORMATION;
+STRUCT!{struct FILE_FS_DEVICE_INFORMATION {
+ DeviceType: DWORD,
+ Characteristics: ULONG,
+}}
+pub type PFILE_FS_DEVICE_INFORMATION = *mut FILE_FS_DEVICE_INFORMATION;
+STRUCT!{struct FILE_FS_ATTRIBUTE_INFORMATION {
+ FileSystemAttributes: ULONG,
+ MaximumComponentNameLength: LONG,
+ FileSystemNameLength: ULONG,
+ FileSystemName: [WCHAR; 1],
+}}
+pub type PFILE_FS_ATTRIBUTE_INFORMATION = *mut FILE_FS_ATTRIBUTE_INFORMATION;
+STRUCT!{struct FILE_FS_DRIVER_PATH_INFORMATION {
+ DriverInPath: BOOLEAN,
+ DriverNameLength: ULONG,
+ DriverName: [WCHAR; 1],
+}}
+pub type PFILE_FS_DRIVER_PATH_INFORMATION = *mut FILE_FS_DRIVER_PATH_INFORMATION;
+STRUCT!{struct FILE_FS_VOLUME_FLAGS_INFORMATION {
+ Flags: ULONG,
+}}
+pub type PFILE_FS_VOLUME_FLAGS_INFORMATION = *mut FILE_FS_VOLUME_FLAGS_INFORMATION;
+pub const SSINFO_FLAGS_ALIGNED_DEVICE: u32 = 0x00000001;
+pub const SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE: u32 = 0x00000002;
+pub const SSINFO_OFFSET_UNKNOWN: u32 = 0xffffffff;
+STRUCT!{struct FILE_FS_SECTOR_SIZE_INFORMATION {
+ LogicalBytesPerSector: ULONG,
+ PhysicalBytesPerSectorForAtomicity: ULONG,
+ PhysicalBytesPerSectorForPerformance: ULONG,
+ FileSystemEffectivePhysicalBytesPerSectorForAtomicity: ULONG,
+ Flags: ULONG,
+ ByteOffsetForSectorAlignment: ULONG,
+ ByteOffsetForPartitionAlignment: ULONG,
+}}
+pub type PFILE_FS_SECTOR_SIZE_INFORMATION = *mut FILE_FS_SECTOR_SIZE_INFORMATION;
+STRUCT!{struct FILE_FS_DATA_COPY_INFORMATION {
+ NumberOfCopies: ULONG,
+}}
+pub type PFILE_FS_DATA_COPY_INFORMATION = *mut FILE_FS_DATA_COPY_INFORMATION;
+STRUCT!{struct FILE_FS_METADATA_SIZE_INFORMATION {
+ TotalMetadataAllocationUnits: LARGE_INTEGER,
+ SectorsPerAllocationUnit: ULONG,
+ BytesPerSector: ULONG,
+}}
+pub type PFILE_FS_METADATA_SIZE_INFORMATION = *mut FILE_FS_METADATA_SIZE_INFORMATION;
+STRUCT!{struct FILE_FS_FULL_SIZE_INFORMATION_EX {
+ ActualTotalAllocationUnits: ULONGLONG,
+ ActualAvailableAllocationUnits: ULONGLONG,
+ ActualPoolUnavailableAllocationUnits: ULONGLONG,
+ CallerTotalAllocationUnits: ULONGLONG,
+ CallerAvailableAllocationUnits: ULONGLONG,
+ CallerPoolUnavailableAllocationUnits: ULONGLONG,
+ UsedAllocationUnits: ULONGLONG,
+ TotalReservedAllocationUnits: ULONGLONG,
+ VolumeStorageReserveAllocationUnits: ULONGLONG,
+ AvailableCommittedAllocationUnits: ULONGLONG,
+ PoolAvailableAllocationUnits: ULONGLONG,
+ SectorsPerAllocationUnit: ULONG,
+ BytesPerSector: ULONG,
+}}
+pub type PFILE_FS_FULL_SIZE_INFORMATION_EX = *mut FILE_FS_FULL_SIZE_INFORMATION_EX;
+EXTERN!{extern "system" {
+ fn NtCreateFile(
+ FileHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ AllocationSize: PLARGE_INTEGER,
+ FileAttributes: ULONG,
+ ShareAccess: ULONG,
+ CreateDisposition: ULONG,
+ CreateOptions: ULONG,
+ EaBuffer: PVOID,
+ EaLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtCreateNamedPipeFile(
+ FileHandle: PHANDLE,
+ DesiredAccess: ULONG,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ShareAccess: ULONG,
+ CreateDisposition: ULONG,
+ CreateOptions: ULONG,
+ NamedPipeType: ULONG,
+ ReadMode: ULONG,
+ CompletionMode: ULONG,
+ MaximumInstances: ULONG,
+ InboundQuota: ULONG,
+ OutboundQuota: ULONG,
+ DefaultTimeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtCreateMailslotFile(
+ FileHandle: PHANDLE,
+ DesiredAccess: ULONG,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ CreateOptions: ULONG,
+ MailslotQuota: ULONG,
+ MaximumMessageSize: ULONG,
+ ReadTimeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtOpenFile(
+ FileHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ShareAccess: ULONG,
+ OpenOptions: ULONG,
+ ) -> NTSTATUS;
+ fn NtDeleteFile(
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtFlushBuffersFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ) -> NTSTATUS;
+ fn NtFlushBuffersFileEx(
+ FileHandle: HANDLE,
+ Flags: ULONG,
+ Parameters: PVOID,
+ ParametersSize: ULONG,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ) -> NTSTATUS;
+ fn NtQueryInformationFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ FileInformation: PVOID,
+ Length: ULONG,
+ FileInformationClass: FILE_INFORMATION_CLASS,
+ ) -> NTSTATUS;
+ fn NtQueryInformationByName(
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ FileInformation: PVOID,
+ Length: ULONG,
+ FileInformationClass: FILE_INFORMATION_CLASS,
+ ) -> NTSTATUS;
+ fn NtSetInformationFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ FileInformation: PVOID,
+ Length: ULONG,
+ FileInformationClass: FILE_INFORMATION_CLASS,
+ ) -> NTSTATUS;
+ fn NtQueryDirectoryFile(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ FileInformation: PVOID,
+ Length: ULONG,
+ FileInformationClass: FILE_INFORMATION_CLASS,
+ ReturnSingleEntry: BOOLEAN,
+ FileName: PUNICODE_STRING,
+ RestartScan: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtQueryEaFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Buffer: PVOID,
+ Length: ULONG,
+ ReturnSingleEntry: BOOLEAN,
+ EaList: PVOID,
+ EaListLength: ULONG,
+ EaIndex: PULONG,
+ RestartScan: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtSetEaFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Buffer: PVOID,
+ Length: ULONG,
+ ) -> NTSTATUS;
+ fn NtQueryQuotaInformationFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Buffer: PVOID,
+ Length: ULONG,
+ ReturnSingleEntry: BOOLEAN,
+ SidList: PVOID,
+ SidListLength: ULONG,
+ StartSid: PSID,
+ RestartScan: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtSetQuotaInformationFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Buffer: PVOID,
+ Length: ULONG,
+ ) -> NTSTATUS;
+ fn NtQueryVolumeInformationFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ FsInformation: PVOID,
+ Length: ULONG,
+ FsInformationClass: FS_INFORMATION_CLASS,
+ ) -> NTSTATUS;
+ fn NtSetVolumeInformationFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ FsInformation: PVOID,
+ Length: ULONG,
+ FsInformationClass: FS_INFORMATION_CLASS,
+ ) -> NTSTATUS;
+ fn NtCancelIoFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ) -> NTSTATUS;
+ fn NtCancelIoFileEx(
+ FileHandle: HANDLE,
+ IoRequestToCancel: PIO_STATUS_BLOCK,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ) -> NTSTATUS;
+ fn NtCancelSynchronousIoFile(
+ ThreadHandle: HANDLE,
+ IoRequestToCancel: PIO_STATUS_BLOCK,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ) -> NTSTATUS;
+ fn NtDeviceIoControlFile(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ IoControlCode: ULONG,
+ InputBuffer: PVOID,
+ InputBufferLength: ULONG,
+ OutputBuffer: PVOID,
+ OutputBufferLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtFsControlFile(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ FsControlCode: ULONG,
+ InputBuffer: PVOID,
+ InputBufferLength: ULONG,
+ OutputBuffer: PVOID,
+ OutputBufferLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtReadFile(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Buffer: PVOID,
+ Length: ULONG,
+ ByteOffset: PLARGE_INTEGER,
+ Key: PULONG,
+ ) -> NTSTATUS;
+ fn NtWriteFile(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Buffer: PVOID,
+ Length: ULONG,
+ ByteOffset: PLARGE_INTEGER,
+ Key: PULONG,
+ ) -> NTSTATUS;
+ fn NtReadFileScatter(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ SegmentArray: PFILE_SEGMENT_ELEMENT,
+ Length: ULONG,
+ ByteOffset: PLARGE_INTEGER,
+ Key: PULONG,
+ ) -> NTSTATUS;
+ fn NtWriteFileGather(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ SegmentArray: PFILE_SEGMENT_ELEMENT,
+ Length: ULONG,
+ ByteOffset: PLARGE_INTEGER,
+ Key: PULONG,
+ ) -> NTSTATUS;
+ fn NtLockFile(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ByteOffset: PLARGE_INTEGER,
+ Length: PLARGE_INTEGER,
+ Key: ULONG,
+ FailImmediately: BOOLEAN,
+ ExclusiveLock: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtUnlockFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ByteOffset: PLARGE_INTEGER,
+ Length: PLARGE_INTEGER,
+ Key: ULONG,
+ ) -> NTSTATUS;
+ fn NtQueryAttributesFile(
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ FileInformation: PFILE_BASIC_INFORMATION,
+ ) -> NTSTATUS;
+ fn NtQueryFullAttributesFile(
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ FileInformation: PFILE_NETWORK_OPEN_INFORMATION,
+ ) -> NTSTATUS;
+ fn NtNotifyChangeDirectoryFile(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Buffer: PVOID,
+ Length: ULONG,
+ CompletionFilter: ULONG,
+ WatchTree: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtLoadDriver(
+ DriverServiceName: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn NtUnloadDriver(
+ DriverServiceName: PUNICODE_STRING,
+ ) -> NTSTATUS;
+}}
+pub const IO_COMPLETION_QUERY_STATE: u32 = 0x0001;
+ENUM!{enum IO_COMPLETION_INFORMATION_CLASS {
+ IoCompletionBasicInformation = 0,
+}}
+STRUCT!{struct IO_COMPLETION_BASIC_INFORMATION {
+ Depth: LONG,
+}}
+pub type PIO_COMPLETION_BASIC_INFORMATION = *mut IO_COMPLETION_BASIC_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtCreateIoCompletion(
+ IoCompletionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ Count: ULONG,
+ ) -> NTSTATUS;
+ fn NtOpenIoCompletion(
+ IoCompletionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtQueryIoCompletion(
+ IoCompletionHandle: HANDLE,
+ IoCompletionInformationClass: IO_COMPLETION_INFORMATION_CLASS,
+ IoCompletionInformation: PVOID,
+ IoCompletionInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetIoCompletion(
+ IoCompletionHandle: HANDLE,
+ KeyContext: PVOID,
+ ApcContext: PVOID,
+ IoStatus: NTSTATUS,
+ IoStatusInformation: ULONG_PTR,
+ ) -> NTSTATUS;
+ fn NtSetIoCompletionEx(
+ IoCompletionHandle: HANDLE,
+ IoCompletionPacketHandle: HANDLE,
+ KeyContext: PVOID,
+ ApcContext: PVOID,
+ IoStatus: NTSTATUS,
+ IoStatusInformation: ULONG_PTR,
+ ) -> NTSTATUS;
+ fn NtRemoveIoCompletion(
+ IoCompletionHandle: HANDLE,
+ KeyContext: *mut PVOID,
+ ApcContext: *mut PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtRemoveIoCompletionEx(
+ IoCompletionHandle: HANDLE,
+ IoCompletionInformation: PFILE_IO_COMPLETION_INFORMATION,
+ Count: ULONG,
+ NumEntriesRemoved: PULONG,
+ Timeout: PLARGE_INTEGER,
+ Alertable: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtCreateWaitCompletionPacket(
+ WaitCompletionPacketHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtAssociateWaitCompletionPacket(
+ WaitCompletionPacketHandle: HANDLE,
+ IoCompletionHandle: HANDLE,
+ TargetObjectHandle: HANDLE,
+ KeyContext: PVOID,
+ ApcContext: PVOID,
+ IoStatus: NTSTATUS,
+ IoStatusInformation: ULONG_PTR,
+ AlreadySignaled: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn NtCancelWaitCompletionPacket(
+ WaitCompletionPacketHandle: HANDLE,
+ RemoveSignaledPacket: BOOLEAN,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum IO_SESSION_EVENT {
+ IoSessionEventIgnore = 0,
+ IoSessionEventCreated = 1,
+ IoSessionEventTerminated = 2,
+ IoSessionEventConnected = 3,
+ IoSessionEventDisconnected = 4,
+ IoSessionEventLogon = 5,
+ IoSessionEventLogoff = 6,
+ IoSessionEventMax = 7,
+}}
+ENUM!{enum IO_SESSION_STATE {
+ IoSessionStateCreated = 0,
+ IoSessionStateInitialized = 1,
+ IoSessionStateConnected = 2,
+ IoSessionStateDisconnected = 3,
+ IoSessionStateDisconnectedLoggedOn = 4,
+ IoSessionStateLoggedOn = 5,
+ IoSessionStateLoggedOff = 6,
+ IoSessionStateTerminated = 7,
+ IoSessionStateMax = 8,
+}}
+EXTERN!{extern "system" {
+ fn NtNotifyChangeSession(
+ SessionHandle: HANDLE,
+ ChangeSequenceNumber: ULONG,
+ ChangeTimeStamp: PLARGE_INTEGER,
+ Event: IO_SESSION_EVENT,
+ NewState: IO_SESSION_STATE,
+ PreviousState: IO_SESSION_STATE,
+ Payload: PVOID,
+ PayloadSize: ULONG,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum INTERFACE_TYPE {
+ InterfaceTypeUndefined = -1i32 as u32,
+ Internal = 0,
+ Isa = 1,
+ Eisa = 2,
+ MicroChannel = 3,
+ TurboChannel = 4,
+ PCIBus = 5,
+ VMEBus = 6,
+ NuBus = 7,
+ PCMCIABus = 8,
+ CBus = 9,
+ MPIBus = 10,
+ MPSABus = 11,
+ ProcessorInternal = 12,
+ InternalPowerBus = 13,
+ PNPISABus = 14,
+ PNPBus = 15,
+ Vmcs = 16,
+ MaximumInterfaceType = 17,
+}}
+pub type PINTERFACE_TYPE = *mut INTERFACE_TYPE;
+ENUM!{enum DMA_WIDTH {
+ Width8Bits = 0,
+ Width16Bits = 1,
+ Width32Bits = 2,
+ MaximumDmaWidth = 3,
+}}
+pub type PDMA_WIDTH = *mut DMA_WIDTH;
+ENUM!{enum DMA_SPEED {
+ Compatible = 0,
+ TypeA = 1,
+ TypeB = 2,
+ TypeC = 3,
+ TypeF = 4,
+ MaximumDmaSpeed = 5,
+}}
+pub type PDMA_SPEED = *mut DMA_SPEED;
+ENUM!{enum BUS_DATA_TYPE {
+ ConfigurationSpaceUndefined = -1i32 as u32,
+ Cmos = 0,
+ EisaConfiguration = 1,
+ Pos = 2,
+ CbusConfiguration = 3,
+ PCIConfiguration = 4,
+ VMEConfiguration = 5,
+ NuBusConfiguration = 6,
+ PCMCIAConfiguration = 7,
+ MPIConfiguration = 8,
+ MPSAConfiguration = 9,
+ PNPISAConfiguration = 10,
+ SgiInternalConfiguration = 11,
+ MaximumBusDataType = 12,
+}}
+pub type PBUS_DATA_TYPE = *mut BUS_DATA_TYPE;
+pub const SYMLINK_FLAG_RELATIVE: u32 = 1;
+STRUCT!{struct REPARSE_DATA_BUFFER_u_SymbolicLinkReparseBuffer {
+ SubstituteNameOffset: USHORT,
+ SubstituteNameLength: USHORT,
+ PrintNameOffset: USHORT,
+ PrintNameLength: USHORT,
+ Flags: ULONG,
+ PathBuffer: [WCHAR; 1],
+}}
+STRUCT!{struct REPARSE_DATA_BUFFER_u_MountPointReparseBuffer {
+ SubstituteNameOffset: USHORT,
+ SubstituteNameLength: USHORT,
+ PrintNameOffset: USHORT,
+ PrintNameLength: USHORT,
+ PathBuffer: [WCHAR; 1],
+}}
+STRUCT!{struct REPARSE_DATA_BUFFER_u_GenericReparseBuffer {
+ DataBuffer: [UCHAR; 1],
+}}
+UNION!{union REPARSE_DATA_BUFFER_u {
+ SymbolicLinkReparseBuffer: REPARSE_DATA_BUFFER_u_SymbolicLinkReparseBuffer,
+ MountPointReparseBuffer: REPARSE_DATA_BUFFER_u_MountPointReparseBuffer,
+ GenericReparseBuffer: REPARSE_DATA_BUFFER_u_GenericReparseBuffer,
+}}
+STRUCT!{struct REPARSE_DATA_BUFFER {
+ ReparseTag: ULONG,
+ ReparseDataLength: USHORT,
+ Reserved: USHORT,
+ u: REPARSE_DATA_BUFFER_u,
+}}
+pub type PREPARSE_DATA_BUFFER = *mut REPARSE_DATA_BUFFER;
+/// "\Device\NamedPipe\"
+pub const DEVICE_NAMED_PIPE: UTF16Const = UTF16Const(&[
+ 0x005C, 0x0044, 0x0065, 0x0076, 0x0069, 0x0063, 0x0065, 0x005C, 0x004E, 0x0061, 0x006D, 0x0065,
+ 0x0064, 0x0050, 0x0069, 0x0070, 0x0065, 0x005C, 0u16,
+]);
+pub const FSCTL_PIPE_ASSIGN_EVENT: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS);
+pub const FSTL_PIPE_DISCONNECT: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS);
+pub const FSTL_PIPE_LISTEN: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS);
+pub const FSTL_PIPE_PEEK: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA);
+pub const FSTL_PIPE_QUERY_EVENT: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS);
+pub const FSTL_PIPE_TRANSCEIVE: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA);
+pub const FSTL_PIPE_WAIT: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS);
+pub const FSTL_PIPE_IMPERSONATE: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS);
+pub const FSTL_PIPE_SET_CLIENT_PROCESS: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS);
+pub const FSTL_PIPE_QUERY_CLIENT_PROCESS: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS);
+pub const FSTL_PIPE_GET_PIPE_ATTRIBUTE: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 10, METHOD_BUFFERED, FILE_ANY_ACCESS);
+pub const FSTL_PIPE_SET_PIPE_ATTRIBUTE: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 11, METHOD_BUFFERED, FILE_ANY_ACCESS);
+pub const FSTL_PIPE_GET_CONNECTION_ATTRIBUTE: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS);
+pub const FSTL_PIPE_SET_CONNECTION_ATTRIBUTE: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 13, METHOD_BUFFERED, FILE_ANY_ACCESS);
+pub const FSTL_PIPE_GET_HANDLE_ATTRIBUTE: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 14, METHOD_BUFFERED, FILE_ANY_ACCESS);
+pub const FSTL_PIPE_SET_HANDLE_ATTRIBUTE: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 15, METHOD_BUFFERED, FILE_ANY_ACCESS);
+pub const FSTL_PIPE_FLUSH: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 16, METHOD_BUFFERED, FILE_WRITE_DATA);
+pub const FSTL_PIPE_INTERNAL_READ: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA);
+pub const FSTL_PIPE_INTERNAL_WRITE: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA);
+pub const FSTL_PIPE_INTERNAL_TRANSCEIVE: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA);
+pub const FSTL_PIPE_INTERNAL_READ_OVFLOW: u32 =
+ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA);
+pub const FILE_PIPE_READ_DATA: u32 = 0x00000000;
+pub const FILE_PIPE_WRITE_SPACE: u32 = 0x00000001;
+STRUCT!{struct FILE_PIPE_ASSIGN_EVENT_BUFFER {
+ EventHandle: HANDLE,
+ KeyValue: ULONG,
+}}
+pub type PFILE_PIPE_ASSIGN_EVENT_BUFFER = *mut FILE_PIPE_ASSIGN_EVENT_BUFFER;
+STRUCT!{struct FILE_PIPE_PEEK_BUFFER {
+ NamedPipeState: ULONG,
+ ReadDataAvailable: ULONG,
+ NumberOfMessages: ULONG,
+ MessageLength: ULONG,
+ Data: [CHAR; 1],
+}}
+pub type PFILE_PIPE_PEEK_BUFFER = *mut FILE_PIPE_PEEK_BUFFER;
+STRUCT!{struct FILE_PIPE_EVENT_BUFFER {
+ NamedPipeState: ULONG,
+ EntryType: ULONG,
+ ByteCount: ULONG,
+ KeyValue: ULONG,
+ NumberRequests: ULONG,
+}}
+pub type PFILE_PIPE_EVENT_BUFFER = *mut FILE_PIPE_EVENT_BUFFER;
+STRUCT!{struct FILE_PIPE_WAIT_FOR_BUFFER {
+ Timeout: LARGE_INTEGER,
+ NameLength: ULONG,
+ TimeoutSpecified: BOOLEAN,
+ Name: [WCHAR; 1],
+}}
+pub type PFILE_PIPE_WAIT_FOR_BUFFER = *mut FILE_PIPE_WAIT_FOR_BUFFER;
+STRUCT!{struct FILE_PIPE_CLIENT_PROCESS_BUFFER {
+ ClientSession: PVOID,
+ ClientProcess: PVOID,
+}}
+pub type PFILE_PIPE_CLIENT_PROCESS_BUFFER = *mut FILE_PIPE_CLIENT_PROCESS_BUFFER;
+pub const FILE_PIPE_COMPUTER_NAME_LENGTH: usize = 15;
+STRUCT!{struct FILE_PIPE_CLIENT_PROCESS_BUFFER_EX {
+ ClientSession: PVOID,
+ ClientProcess: PVOID,
+ ClientComputerNameLength: USHORT,
+ ClientComputerBuffer: [WCHAR; FILE_PIPE_COMPUTER_NAME_LENGTH + 1],
+}}
+pub type PFILE_PIPE_CLIENT_PROCESS_BUFFER_EX = *mut FILE_PIPE_CLIENT_PROCESS_BUFFER_EX;
+pub const MAILSLOT_CLASS_FIRSTCLASS: u32 = 1;
+pub const MAILSLOT_CLASS_SECONDCLASS: u32 = 2;
+pub const FSCTL_MAILSLOT_PEEK: u32 =
+ CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA);
+STRUCT!{struct FILE_MAILSLOT_PEEK_BUFFER {
+ ReadDataAvailable: ULONG,
+ NumberOfMessages: ULONG,
+ MessageLength: ULONG,
+}}
+pub type PFILE_MAILSLOT_PEEK_BUFFER = *mut FILE_MAILSLOT_PEEK_BUFFER;
diff --git a/third_party/rust/ntapi/src/ntkeapi.rs b/third_party/rust/ntapi/src/ntkeapi.rs
new file mode 100644
index 0000000000..a26f39b390
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntkeapi.rs
@@ -0,0 +1,121 @@
+use winapi::shared::ntdef::{BOOLEAN, NTSTATUS, PVOID, ULONG};
+pub const LOW_PRIORITY: u32 = 0;
+pub const LOW_REALTIME_PRIORITY: u32 = 16;
+pub const HIGH_PRIORITY: u32 = 31;
+pub const MAXIMUM_PRIORITY: u32 = 32;
+ENUM!{enum KTHREAD_STATE {
+ Initialized = 0,
+ Ready = 1,
+ Running = 2,
+ Standby = 3,
+ Terminated = 4,
+ Waiting = 5,
+ Transition = 6,
+ DeferredReady = 7,
+ GateWaitObsolete = 8,
+ WaitingForProcessInSwap = 9,
+ MaximumThreadState = 10,
+}}
+pub type PKTHREAD_STATE = *mut KTHREAD_STATE;
+ENUM!{enum KHETERO_CPU_POLICY {
+ KHeteroCpuPolicyAll = 0,
+ KHeteroCpuPolicyLarge = 1,
+ KHeteroCpuPolicyLargeOrIdle = 2,
+ KHeteroCpuPolicySmall = 3,
+ KHeteroCpuPolicySmallOrIdle = 4,
+ KHeteroCpuPolicyDynamic = 5,
+ KHeteroCpuPolicyStaticMax = 6,
+ KHeteroCpuPolicyBiasedSmall = 7,
+ KHeteroCpuPolicyBiasedLarge = 8,
+ KHeteroCpuPolicyDefault = 9,
+ KHeteroCpuPolicyMax = 10,
+}}
+pub type PKHETERO_CPU_POLICY = *mut KHETERO_CPU_POLICY;
+ENUM!{enum KWAIT_REASON {
+ Executive = 0,
+ FreePage = 1,
+ PageIn = 2,
+ PoolAllocation = 3,
+ DelayExecution = 4,
+ Suspended = 5,
+ UserRequest = 6,
+ WrExecutive = 7,
+ WrFreePage = 8,
+ WrPageIn = 9,
+ WrPoolAllocation = 10,
+ WrDelayExecution = 11,
+ WrSuspended = 12,
+ WrUserRequest = 13,
+ WrEventPair = 14,
+ WrQueue = 15,
+ WrLpcReceive = 16,
+ WrLpcReply = 17,
+ WrVirtualMemory = 18,
+ WrPageOut = 19,
+ WrRendezvous = 20,
+ WrKeyedEvent = 21,
+ WrTerminated = 22,
+ WrProcessInSwap = 23,
+ WrCpuRateControl = 24,
+ WrCalloutStack = 25,
+ WrKernel = 26,
+ WrResource = 27,
+ WrPushLock = 28,
+ WrMutex = 29,
+ WrQuantumEnd = 30,
+ WrDispatchInt = 31,
+ WrPreempted = 32,
+ WrYieldExecution = 33,
+ WrFastMutex = 34,
+ WrGuardedMutex = 35,
+ WrRundown = 36,
+ WrAlertByThreadId = 37,
+ WrDeferredPreempt = 38,
+ MaximumWaitReason = 39,
+}}
+pub type PKWAIT_REASON = *mut KWAIT_REASON;
+ENUM!{enum KPROFILE_SOURCE {
+ ProfileTime = 0,
+ ProfileAlignmentFixup = 1,
+ ProfileTotalIssues = 2,
+ ProfilePipelineDry = 3,
+ ProfileLoadInstructions = 4,
+ ProfilePipelineFrozen = 5,
+ ProfileBranchInstructions = 6,
+ ProfileTotalNonissues = 7,
+ ProfileDcacheMisses = 8,
+ ProfileIcacheMisses = 9,
+ ProfileCacheMisses = 10,
+ ProfileBranchMispredictions = 11,
+ ProfileStoreInstructions = 12,
+ ProfileFpInstructions = 13,
+ ProfileIntegerInstructions = 14,
+ Profile2Issue = 15,
+ Profile3Issue = 16,
+ Profile4Issue = 17,
+ ProfileSpecialInstructions = 18,
+ ProfileTotalCycles = 19,
+ ProfileIcacheIssues = 20,
+ ProfileDcacheAccesses = 21,
+ ProfileMemoryBarrierCycles = 22,
+ ProfileLoadLinkedIssues = 23,
+ ProfileMaximum = 24,
+}}
+EXTERN!{extern "system" {
+ fn NtCallbackReturn(
+ OutputBuffer: PVOID,
+ OutputLength: ULONG,
+ Status: NTSTATUS,
+ ) -> NTSTATUS;
+ fn NtFlushProcessWriteBuffers();
+ fn NtQueryDebugFilterState(
+ ComponentId: ULONG,
+ Level: ULONG,
+ ) -> NTSTATUS;
+ fn NtSetDebugFilterState(
+ ComponentId: ULONG,
+ Level: ULONG,
+ State: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtYieldExecution() -> NTSTATUS;
+}}
diff --git a/third_party/rust/ntapi/src/ntldr.rs b/third_party/rust/ntapi/src/ntldr.rs
new file mode 100644
index 0000000000..4b4bcb6292
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntldr.rs
@@ -0,0 +1,661 @@
+use winapi::shared::basetsd::{LONG_PTR, PSIZE_T, SIZE_T, ULONG_PTR};
+use winapi::shared::ntdef::{
+ BOOLEAN, HANDLE, LARGE_INTEGER, LIST_ENTRY, LONG, LONGLONG, NTSTATUS, PANSI_STRING, PCSTR,
+ PCUNICODE_STRING, PCWSTR, PHANDLE, POBJECT_ATTRIBUTES, PSINGLE_LIST_ENTRY, PSTR, PULONG,
+ PUNICODE_STRING, PUSHORT, PVOID, PWSTR, RTL_BALANCED_NODE, SINGLE_LIST_ENTRY, UCHAR, ULONG,
+ UNICODE_STRING, USHORT,
+};
+use winapi::um::winnt::{
+ ACCESS_MASK, ACTIVATION_CONTEXT, IMAGE_RESOURCE_DIRECTORY_ENTRY, PCIMAGE_DELAYLOAD_DESCRIPTOR,
+ PIMAGE_BASE_RELOCATION, PIMAGE_IMPORT_DESCRIPTOR, PIMAGE_RESOURCE_DATA_ENTRY,
+ PIMAGE_RESOURCE_DIRECTORY, PIMAGE_RESOURCE_DIRECTORY_STRING, PIMAGE_THUNK_DATA,
+};
+FN!{stdcall PLDR_INIT_ROUTINE(
+ DllHandle: PVOID,
+ Reason: ULONG,
+ Context: PVOID,
+) -> BOOLEAN}
+STRUCT!{struct LDR_SERVICE_TAG_RECORD {
+ Next: *mut LDR_SERVICE_TAG_RECORD,
+ ServiceTag: ULONG,
+}}
+pub type PLDR_SERVICE_TAG_RECORD = *mut LDR_SERVICE_TAG_RECORD;
+STRUCT!{struct LDRP_CSLIST {
+ Tail: PSINGLE_LIST_ENTRY,
+}}
+pub type PLDRP_CSLIST = *mut LDRP_CSLIST;
+ENUM!{enum LDR_DDAG_STATE {
+ LdrModulesMerged = -5i32 as u32,
+ LdrModulesInitError = -4i32 as u32,
+ LdrModulesSnapError = -3i32 as u32,
+ LdrModulesUnloaded = -2i32 as u32,
+ LdrModulesUnloading = -1i32 as u32,
+ LdrModulesPlaceHolder = 0,
+ LdrModulesMapping = 1,
+ LdrModulesMapped = 2,
+ LdrModulesWaitingForDependencies = 3,
+ LdrModulesSnapping = 4,
+ LdrModulesSnapped = 5,
+ LdrModulesCondensed = 6,
+ LdrModulesReadyToInit = 7,
+ LdrModulesInitializing = 8,
+ LdrModulesReadyToRun = 9,
+}}
+UNION!{union LDR_DDAG_NODE_u {
+ Dependencies: LDRP_CSLIST,
+ RemovalLink: SINGLE_LIST_ENTRY,
+}}
+STRUCT!{struct LDR_DDAG_NODE {
+ Modules: LIST_ENTRY,
+ ServiceTagList: PLDR_SERVICE_TAG_RECORD,
+ LoadCount: ULONG,
+ LoadWhileUnloadingCount: ULONG,
+ LowestLink: ULONG,
+ u: LDR_DDAG_NODE_u,
+ IncomingDependencies: LDRP_CSLIST,
+ State: LDR_DDAG_STATE,
+ CondenseLink: SINGLE_LIST_ENTRY,
+ PreorderNumber: ULONG,
+}}
+pub type PLDR_DDAG_NODE = *mut LDR_DDAG_NODE;
+STRUCT!{struct LDR_DEPENDENCY_RECORD {
+ DependencyLink: SINGLE_LIST_ENTRY,
+ DependencyNode: PLDR_DDAG_NODE,
+ IncomingDependencyLink: SINGLE_LIST_ENTRY,
+ IncomingDependencyNode: PLDR_DDAG_NODE,
+}}
+pub type PLDR_DEPENDENCY_RECORD = *mut LDR_DEPENDENCY_RECORD;
+ENUM!{enum LDR_DLL_LOAD_REASON {
+ LoadReasonStaticDependency = 0,
+ LoadReasonStaticForwarderDependency = 1,
+ LoadReasonDynamicForwarderDependency = 2,
+ LoadReasonDelayloadDependency = 3,
+ LoadReasonDynamicLoad = 4,
+ LoadReasonAsImageLoad = 5,
+ LoadReasonAsDataLoad = 6,
+ LoadReasonEnclavePrimary = 7,
+ LoadReasonEnclaveDependency = 8,
+ LoadReasonUnknown = -1i32 as u32,
+}}
+pub type PLDR_DLL_LOAD_REASON = *mut LDR_DLL_LOAD_REASON;
+pub const LDRP_PACKAGED_BINARY: ULONG = 0x00000001;
+pub const LDRP_STATIC_LINK: ULONG = 0x00000002;
+pub const LDRP_IMAGE_DLL: ULONG = 0x00000004;
+pub const LDRP_LOAD_IN_PROGRESS: ULONG = 0x00001000;
+pub const LDRP_UNLOAD_IN_PROGRESS: ULONG = 0x00002000;
+pub const LDRP_ENTRY_PROCESSED: ULONG = 0x00004000;
+pub const LDRP_ENTRY_INSERTED: ULONG = 0x00008000;
+pub const LDRP_CURRENT_LOAD: ULONG = 0x00010000;
+pub const LDRP_FAILED_BUILTIN_LOAD: ULONG = 0x00020000;
+pub const LDRP_DONT_CALL_FOR_THREADS: ULONG = 0x00040000;
+pub const LDRP_PROCESS_ATTACH_CALLED: ULONG = 0x00080000;
+pub const LDRP_DEBUG_SYMBOLS_LOADED: ULONG = 0x00100000;
+pub const LDRP_IMAGE_NOT_AT_BASE: ULONG = 0x00200000;
+pub const LDRP_COR_IMAGE: ULONG = 0x00400000;
+pub const LDRP_DONT_RELOCATE: ULONG = 0x00800000;
+pub const LDRP_SYSTEM_MAPPED: ULONG = 0x01000000;
+pub const LDRP_IMAGE_VERIFYING: ULONG = 0x02000000;
+pub const LDRP_DRIVER_DEPENDENT_DLL: ULONG = 0x04000000;
+pub const LDRP_ENTRY_NATIVE: ULONG = 0x08000000;
+pub const LDRP_REDIRECTED: ULONG = 0x10000000;
+pub const LDRP_NON_PAGED_DEBUG_INFO: ULONG = 0x20000000;
+pub const LDRP_MM_LOADED: ULONG = 0x40000000;
+pub const LDRP_COMPAT_DATABASE_PROCESSED: ULONG = 0x80000000;
+STRUCT!{struct LDRP_LOAD_CONTEXT {
+ BaseDllName: UNICODE_STRING,
+ somestruct: PVOID,
+ Flags: ULONG,
+ pstatus: *mut NTSTATUS,
+ ParentEntry: *mut LDR_DATA_TABLE_ENTRY,
+ Entry: *mut LDR_DATA_TABLE_ENTRY,
+ WorkQueueListEntry: LIST_ENTRY,
+ ReplacedEntry: *mut LDR_DATA_TABLE_ENTRY,
+ pvImports: *mut *mut LDR_DATA_TABLE_ENTRY,
+ ImportDllCount: ULONG,
+ TaskCount: LONG,
+ pvIAT: PVOID,
+ SizeOfIAT: ULONG,
+ CurrentDll: ULONG,
+ piid: PIMAGE_IMPORT_DESCRIPTOR,
+ OriginalIATProtect: ULONG,
+ GuardCFCheckFunctionPointer: PVOID,
+ pGuardCFCheckFunctionPointer: *mut PVOID,
+}}
+UNION!{union LDR_DATA_TABLE_ENTRY_u1 {
+ InInitializationOrderLinks: LIST_ENTRY,
+ InProgressLinks: LIST_ENTRY,
+}}
+UNION!{union LDR_DATA_TABLE_ENTRY_u2 {
+ FlagGroup: [UCHAR; 4],
+ Flags: ULONG,
+}}
+STRUCT!{struct LDR_DATA_TABLE_ENTRY {
+ InLoadOrderLinks: LIST_ENTRY,
+ InMemoryOrderLinks: LIST_ENTRY,
+ u1: LDR_DATA_TABLE_ENTRY_u1,
+ DllBase: PVOID,
+ EntryPoint: PLDR_INIT_ROUTINE,
+ SizeOfImage: ULONG,
+ FullDllName: UNICODE_STRING,
+ BaseDllName: UNICODE_STRING,
+ u2: LDR_DATA_TABLE_ENTRY_u2,
+ ObsoleteLoadCount: USHORT,
+ TlsIndex: USHORT,
+ HashLinks: LIST_ENTRY,
+ TimeDateStamp: ULONG,
+ EntryPointActivationContext: *mut ACTIVATION_CONTEXT,
+ Lock: PVOID,
+ DdagNode: PLDR_DDAG_NODE,
+ NodeModuleLink: LIST_ENTRY,
+ LoadContext: *mut LDRP_LOAD_CONTEXT,
+ ParentDllBase: PVOID,
+ SwitchBackContext: PVOID,
+ BaseAddressIndexNode: RTL_BALANCED_NODE,
+ MappingInfoIndexNode: RTL_BALANCED_NODE,
+ OriginalBase: ULONG_PTR,
+ LoadTime: LARGE_INTEGER,
+ BaseNameHashValue: ULONG,
+ LoadReason: LDR_DLL_LOAD_REASON,
+ ImplicitPathOptions: ULONG,
+ ReferenceCount: ULONG,
+ DependentLoadFlags: ULONG,
+ SigningLevel: UCHAR,
+}}
+BITFIELD!{unsafe LDR_DATA_TABLE_ENTRY_u2 Flags: ULONG [
+ PackagedBinary set_PackagedBinary[0..1],
+ MarkedForRemoval set_MarkedForRemoval[1..2],
+ ImageDll set_ImageDll[2..3],
+ LoadNotificationsSent set_LoadNotificationsSent[3..4],
+ TelemetryEntryProcessed set_TelemetryEntryProcessed[4..5],
+ ProcessStaticImport set_ProcessStaticImport[5..6],
+ InLegacyLists set_InLegacyLists[6..7],
+ InIndexes set_InIndexes[7..8],
+ ShimDll set_ShimDll[8..9],
+ InExceptionTable set_InExceptionTable[9..10],
+ ReservedFlags1 set_ReservedFlags1[10..12],
+ LoadInProgress set_LoadInProgress[12..13],
+ LoadConfigProcessed set_LoadConfigProcessed[13..14],
+ EntryProcessed set_EntryProcessed[14..15],
+ ProtectDelayLoad set_ProtectDelayLoad[15..16],
+ ReservedFlags3 set_ReservedFlags3[16..18],
+ DontCallForThreads set_DontCallForThreads[18..19],
+ ProcessAttachCalled set_ProcessAttachCalled[19..20],
+ ProcessAttachFailed set_ProcessAttachFailed[20..21],
+ CorDeferredValidate set_CorDeferredValidate[21..22],
+ CorImage set_CorImage[22..23],
+ DontRelocate set_DontRelocate[23..24],
+ CorILOnly set_CorILOnly[24..25],
+ ReservedFlags5 set_ReservedFlags5[25..28],
+ Redirected set_Redirected[28..29],
+ ReservedFlags6 set_ReservedFlags6[29..31],
+ CompatDatabaseProcessed set_CompatDatabaseProcessed[31..32],
+]}
+pub type PLDR_DATA_TABLE_ENTRY = *mut LDR_DATA_TABLE_ENTRY;
+#[inline]
+pub const fn LDR_IS_DATAFILE(DllHandle: ULONG_PTR) -> bool {
+ DllHandle & 1 != 0
+}
+#[inline]
+pub const fn LDR_IS_IMAGEMAPPING(DllHandle: ULONG_PTR) -> bool {
+ DllHandle & 2 != 0
+}
+#[inline]
+pub const fn LDR_IS_RESOURCE(DllHandle: ULONG_PTR) -> bool {
+ LDR_IS_IMAGEMAPPING(DllHandle) || LDR_IS_DATAFILE(DllHandle)
+}
+EXTERN!{extern "system" {
+ fn LdrLoadDll(
+ DllPath: PWSTR,
+ DllCharacteristics: PULONG,
+ DllName: PUNICODE_STRING,
+ DllHandle: *mut PVOID,
+ ) -> NTSTATUS;
+ fn LdrUnloadDll(
+ DllHandle: PVOID,
+ ) -> NTSTATUS;
+ fn LdrGetDllHandle(
+ DllPath: PWSTR,
+ DllCharacteristics: PULONG,
+ DllName: PUNICODE_STRING,
+ DllHandle: *mut PVOID,
+ ) -> NTSTATUS;
+}}
+pub const LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT: ULONG = 0x00000001;
+pub const LDR_GET_DLL_HANDLE_EX_PIN: ULONG = 0x00000002;
+EXTERN!{extern "system" {
+ fn LdrGetDllHandleEx(
+ Flags: ULONG,
+ DllPath: PWSTR,
+ DllCharacteristics: PULONG,
+ DllName: PUNICODE_STRING,
+ DllHandle: *mut PVOID,
+ ) -> NTSTATUS;
+ fn LdrGetDllHandleByMapping(
+ BaseAddress: PVOID,
+ DllHandle: *mut PVOID,
+ ) -> NTSTATUS;
+ fn LdrGetDllHandleByName(
+ BaseDllName: PUNICODE_STRING,
+ FullDllName: PUNICODE_STRING,
+ DllHandle: *mut PVOID,
+ ) -> NTSTATUS;
+ fn LdrGetDllFullName(
+ DllHandle: PVOID,
+ FullDllName: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn LdrGetDllDirectory(
+ DllDirectory: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn LdrSetDllDirectory(
+ DllDirectory: PUNICODE_STRING,
+ ) -> NTSTATUS;
+}}
+pub const LDR_ADDREF_DLL_PIN: ULONG = 0x00000001;
+EXTERN!{extern "system" {
+ fn LdrAddRefDll(
+ Flags: ULONG,
+ DllHandle: PVOID,
+ ) -> NTSTATUS;
+ fn LdrGetProcedureAddress(
+ DllHandle: PVOID,
+ ProcedureName: PANSI_STRING,
+ ProcedureNumber: ULONG,
+ ProcedureAddress: *mut PVOID,
+ ) -> NTSTATUS;
+}}
+pub const LDR_GET_PROCEDURE_ADDRESS_DONT_RECORD_FORWARDER: ULONG = 0x00000001;
+EXTERN!{extern "system" {
+ fn LdrGetProcedureAddressEx(
+ DllHandle: PVOID,
+ ProcedureName: PANSI_STRING,
+ ProcedureNumber: ULONG,
+ ProcedureAddress: *mut PVOID,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn LdrGetKnownDllSectionHandle(
+ DllName: PCWSTR,
+ KnownDlls32: BOOLEAN,
+ Section: PHANDLE,
+ ) -> NTSTATUS;
+ fn LdrGetProcedureAddressForCaller(
+ DllHandle: PVOID,
+ ProcedureName: PANSI_STRING,
+ ProcedureNumber: ULONG,
+ ProcedureAddress: *mut PVOID,
+ Flags: ULONG,
+ Callback: *mut PVOID,
+ ) -> NTSTATUS;
+}}
+pub const LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS: ULONG = 0x00000001;
+pub const LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY: ULONG = 0x00000002;
+pub const LDR_LOCK_LOADER_LOCK_DISPOSITION_INVALID: ULONG = 0;
+pub const LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED: ULONG = 1;
+pub const LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_NOT_ACQUIRED: ULONG = 2;
+EXTERN!{extern "system" {
+ fn LdrLockLoaderLock(
+ Flags: ULONG,
+ Disposition: *mut ULONG,
+ Cookie: *mut PVOID,
+ ) -> NTSTATUS;
+}}
+pub const LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS: ULONG = 0x00000001;
+EXTERN!{extern "system" {
+ fn LdrUnlockLoaderLock(
+ Flags: ULONG,
+ Cookie: PVOID,
+ ) -> NTSTATUS;
+ fn LdrRelocateImage(
+ NewBase: PVOID,
+ LoaderName: PSTR,
+ Success: NTSTATUS,
+ Conflict: NTSTATUS,
+ Invalid: NTSTATUS,
+ ) -> NTSTATUS;
+ fn LdrRelocateImageWithBias(
+ NewBase: PVOID,
+ Bias: LONGLONG,
+ LoaderName: PSTR,
+ Success: NTSTATUS,
+ Conflict: NTSTATUS,
+ Invalid: NTSTATUS,
+ ) -> NTSTATUS;
+ fn LdrProcessRelocationBlock(
+ VA: ULONG_PTR,
+ SizeOfBlock: ULONG,
+ NextOffset: PUSHORT,
+ Diff: LONG_PTR,
+ ) -> PIMAGE_BASE_RELOCATION;
+ fn LdrVerifyMappedImageMatchesChecksum(
+ BaseAddress: PVOID,
+ NumberOfBytes: SIZE_T,
+ FileLength: ULONG,
+ ) -> BOOLEAN;
+}}
+FN!{stdcall PLDR_IMPORT_MODULE_CALLBACK(
+ Parameter: PVOID,
+ ModuleName: PSTR,
+) -> ()}
+EXTERN!{extern "system" {
+ fn LdrVerifyImageMatchesChecksum(
+ ImageFileHandle: HANDLE,
+ ImportCallbackRoutine: PLDR_IMPORT_MODULE_CALLBACK,
+ ImportCallbackParameter: PVOID,
+ ImageCharacteristics: PUSHORT,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct LDR_IMPORT_CALLBACK_INFO {
+ ImportCallbackRoutine: PLDR_IMPORT_MODULE_CALLBACK,
+ ImportCallbackParameter: PVOID,
+}}
+pub type PLDR_IMPORT_CALLBACK_INFO = *mut LDR_IMPORT_CALLBACK_INFO;
+STRUCT!{struct LDR_SECTION_INFO {
+ SectionHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjA: POBJECT_ATTRIBUTES,
+ SectionPageProtection: ULONG,
+ AllocationAttributes: ULONG,
+}}
+pub type PLDR_SECTION_INFO = *mut LDR_SECTION_INFO;
+STRUCT!{struct LDR_VERIFY_IMAGE_INFO {
+ Size: ULONG,
+ Flags: ULONG,
+ CallbackInfo: LDR_IMPORT_CALLBACK_INFO,
+ SectionInfo: LDR_SECTION_INFO,
+ ImageCharacteristics: USHORT,
+}}
+pub type PLDR_VERIFY_IMAGE_INFO = *mut LDR_VERIFY_IMAGE_INFO;
+EXTERN!{extern "system" {
+ fn LdrVerifyImageMatchesChecksumEx(
+ ImageFileHandle: HANDLE,
+ VerifyInfo: PLDR_VERIFY_IMAGE_INFO,
+ ) -> NTSTATUS;
+ fn LdrQueryModuleServiceTags(
+ DllHandle: PVOID,
+ ServiceTagBuffer: PULONG,
+ BufferSize: PULONG,
+ ) -> NTSTATUS;
+}}
+pub const LDR_DLL_NOTIFICATION_REASON_LOADED: ULONG = 1;
+pub const LDR_DLL_NOTIFICATION_REASON_UNLOADED: ULONG = 2;
+STRUCT!{struct LDR_DLL_LOADED_NOTIFICATION_DATA {
+ Flags: ULONG,
+ FullDllName: PUNICODE_STRING,
+ BaseDllName: PUNICODE_STRING,
+ DllBase: PVOID,
+ SizeOfImage: ULONG,
+}}
+pub type PLDR_DLL_LOADED_NOTIFICATION_DATA = *mut LDR_DLL_LOADED_NOTIFICATION_DATA;
+STRUCT!{struct LDR_DLL_UNLOADED_NOTIFICATION_DATA {
+ Flags: ULONG,
+ FullDllName: PCUNICODE_STRING,
+ BaseDllName: PCUNICODE_STRING,
+ DllBase: PVOID,
+ SizeOfImage: ULONG,
+}}
+pub type PLDR_DLL_UNLOADED_NOTIFICATION_DATA = *mut LDR_DLL_UNLOADED_NOTIFICATION_DATA;
+UNION!{union LDR_DLL_NOTIFICATION_DATA {
+ Loaded: LDR_DLL_LOADED_NOTIFICATION_DATA,
+ Unloaded: LDR_DLL_UNLOADED_NOTIFICATION_DATA,
+}}
+pub type PLDR_DLL_NOTIFICATION_DATA = *mut LDR_DLL_NOTIFICATION_DATA;
+FN!{stdcall PLDR_DLL_NOTIFICATION_FUNCTION(
+ NotificationReason: ULONG,
+ NotificationData: PLDR_DLL_NOTIFICATION_DATA,
+ Context: PVOID,
+) -> ()}
+EXTERN!{extern "system" {
+ fn LdrRegisterDllNotification(
+ Flags: ULONG,
+ NotificationFunction: PLDR_DLL_NOTIFICATION_FUNCTION,
+ Context: PVOID,
+ Cookie: *mut PVOID,
+ ) -> NTSTATUS;
+ fn LdrUnregisterDllNotification(
+ Cookie: PVOID,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct PS_MITIGATION_OPTIONS_MAP {
+ Map: [ULONG_PTR; 2],
+}}
+pub type PPS_MITIGATION_OPTIONS_MAP = *mut PS_MITIGATION_OPTIONS_MAP;
+STRUCT!{struct PS_MITIGATION_AUDIT_OPTIONS_MAP {
+ Map: [ULONG_PTR; 2],
+}}
+pub type PPS_MITIGATION_AUDIT_OPTIONS_MAP = *mut PS_MITIGATION_AUDIT_OPTIONS_MAP;
+STRUCT!{struct PS_SYSTEM_DLL_INIT_BLOCK {
+ Size: ULONG,
+ SystemDllWowRelocation: ULONG_PTR,
+ SystemDllNativeRelocation: ULONG_PTR,
+ Wow64SharedInformation: [ULONG_PTR; 16],
+ RngData: ULONG,
+ Flags: ULONG,
+ MitigationOptionsMap: PS_MITIGATION_OPTIONS_MAP,
+ CfgBitMap: ULONG_PTR,
+ CfgBitMapSize: ULONG_PTR,
+ Wow64CfgBitMap: ULONG_PTR,
+ Wow64CfgBitMapSize: ULONG_PTR,
+ MitigationAuditOptionsMap: PS_MITIGATION_AUDIT_OPTIONS_MAP,
+}}
+BITFIELD!{PS_SYSTEM_DLL_INIT_BLOCK Flags: ULONG [
+ CfgOverride set_CfgOverride[0..1],
+ Reserved set_Reserved[1..32],
+]}
+pub type PPS_SYSTEM_DLL_INIT_BLOCK = *mut PS_SYSTEM_DLL_INIT_BLOCK;
+EXTERN!{extern "system" {
+ fn LdrSystemDllInitBlock() -> PPS_SYSTEM_DLL_INIT_BLOCK;
+ fn LdrAddLoadAsDataTable(
+ Module: PVOID,
+ FilePath: PWSTR,
+ Size: SIZE_T,
+ Handle: HANDLE,
+ ) -> NTSTATUS;
+ fn LdrRemoveLoadAsDataTable(
+ InitModule: PVOID,
+ BaseModule: *mut PVOID,
+ Size: PSIZE_T,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn LdrGetFileNameFromLoadAsDataTable(
+ Module: PVOID,
+ pFileNamePrt: *mut PVOID,
+ ) -> NTSTATUS;
+ fn LdrDisableThreadCalloutsForDll(
+ DllImageBase: PVOID,
+ ) -> NTSTATUS;
+ fn LdrAccessResource(
+ DllHandle: PVOID,
+ ResourceDataEntry: PIMAGE_RESOURCE_DATA_ENTRY,
+ ResourceBuffer: *mut PVOID,
+ ResourceLength: *mut ULONG,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct LDR_RESOURCE_INFO {
+ Type: ULONG_PTR,
+ Name: ULONG_PTR,
+ Language: ULONG_PTR,
+}}
+pub type PLDR_RESOURCE_INFO = *mut LDR_RESOURCE_INFO;
+pub const RESOURCE_TYPE_LEVEL: ULONG = 0;
+pub const RESOURCE_NAME_LEVEL: ULONG = 1;
+pub const RESOURCE_LANGUAGE_LEVEL: ULONG = 2;
+pub const RESOURCE_DATA_LEVEL: ULONG = 3;
+EXTERN!{extern "system" {
+ fn LdrFindResource_U(
+ DllHandle: PVOID,
+ ResourceInfo: PLDR_RESOURCE_INFO,
+ Level: ULONG,
+ ResourceDataEntry: *mut PIMAGE_RESOURCE_DATA_ENTRY,
+ ) -> NTSTATUS;
+ fn LdrFindResourceDirectory_U(
+ DllHandle: PVOID,
+ ResourceInfo: PLDR_RESOURCE_INFO,
+ Level: ULONG,
+ ResourceDirectory: *mut PIMAGE_RESOURCE_DIRECTORY,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct LDR_ENUM_RESOURCE_ENTRY_Path_s {
+ Id: USHORT,
+ NameIsPresent: USHORT,
+}}
+UNION!{union LDR_ENUM_RESOURCE_ENTRY_Path {
+ NameOrId: ULONG_PTR,
+ Name: PIMAGE_RESOURCE_DIRECTORY_STRING,
+ s: LDR_ENUM_RESOURCE_ENTRY_Path_s,
+}}
+STRUCT!{struct LDR_ENUM_RESOURCE_ENTRY {
+ Path: [LDR_ENUM_RESOURCE_ENTRY_Path; 3],
+ Data: PVOID,
+ Size: ULONG,
+ Reserved: ULONG,
+}}
+pub type PLDR_ENUM_RESOURCE_ENTRY = *mut LDR_ENUM_RESOURCE_ENTRY;
+#[inline]
+pub unsafe fn NAME_FROM_RESOURCE_ENTRY(
+ RootDirectory: PIMAGE_RESOURCE_DIRECTORY,
+ Entry: &IMAGE_RESOURCE_DIRECTORY_ENTRY,
+) -> usize {
+ if Entry.u.s().NameIsString() != 0 {
+ return RootDirectory as usize + Entry.u.s().NameOffset() as usize;
+ }
+ *Entry.u.Id() as usize
+}
+EXTERN!{extern "system" {
+ fn LdrEnumResources(
+ DllHandle: PVOID,
+ ResourceInfo: PLDR_RESOURCE_INFO,
+ Level: ULONG,
+ ResourceCount: *mut ULONG,
+ Resources: PLDR_ENUM_RESOURCE_ENTRY,
+ ) -> NTSTATUS;
+ fn LdrFindEntryForAddress(
+ DllHandle: PVOID,
+ Entry: *mut PLDR_DATA_TABLE_ENTRY,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct RTL_PROCESS_MODULE_INFORMATION {
+ Section: HANDLE,
+ MappedBase: PVOID,
+ ImageBase: PVOID,
+ ImageSize: ULONG,
+ Flags: ULONG,
+ LoadOrderIndex: USHORT,
+ InitOrderIndex: USHORT,
+ LoadCount: USHORT,
+ OffsetToFileName: USHORT,
+ FullPathName: [UCHAR; 256],
+}}
+pub type PRTL_PROCESS_MODULE_INFORMATION = *mut RTL_PROCESS_MODULE_INFORMATION;
+STRUCT!{struct RTL_PROCESS_MODULES {
+ NumberOfModules: ULONG,
+ Modules: [RTL_PROCESS_MODULE_INFORMATION; 1],
+}}
+pub type PRTL_PROCESS_MODULES = *mut RTL_PROCESS_MODULES;
+STRUCT!{struct RTL_PROCESS_MODULE_INFORMATION_EX {
+ NextOffset: USHORT,
+ BaseInfo: RTL_PROCESS_MODULE_INFORMATION,
+ ImageChecksum: ULONG,
+ TimeDateStamp: ULONG,
+ DefaultBase: PVOID,
+}}
+pub type PRTL_PROCESS_MODULE_INFORMATION_EX = *mut RTL_PROCESS_MODULE_INFORMATION_EX;
+EXTERN!{extern "system" {
+ fn LdrQueryProcessModuleInformation(
+ ModuleInformation: PRTL_PROCESS_MODULES,
+ Size: ULONG,
+ ReturnedSize: PULONG,
+ ) -> NTSTATUS;
+}}
+FN!{stdcall PLDR_ENUM_CALLBACK(
+ ModuleInformation: PLDR_DATA_TABLE_ENTRY,
+ Parameter: PVOID,
+ Stop: *mut BOOLEAN,
+) -> ()}
+EXTERN!{extern "system" {
+ fn LdrEnumerateLoadedModules(
+ ReservedFlag: BOOLEAN,
+ EnumProc: PLDR_ENUM_CALLBACK,
+ Context: PVOID,
+ ) -> NTSTATUS;
+ fn LdrOpenImageFileOptionsKey(
+ SubKey: PUNICODE_STRING,
+ Wow64: BOOLEAN,
+ NewKeyHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn LdrQueryImageFileKeyOption(
+ KeyHandle: HANDLE,
+ ValueName: PCWSTR,
+ Type: ULONG,
+ Buffer: PVOID,
+ BufferSize: ULONG,
+ ReturnedLength: PULONG,
+ ) -> NTSTATUS;
+ fn LdrQueryImageFileExecutionOptions(
+ SubKey: PUNICODE_STRING,
+ ValueName: PCWSTR,
+ ValueSize: ULONG,
+ Buffer: PVOID,
+ BufferSize: ULONG,
+ ReturnedLength: PULONG,
+ ) -> NTSTATUS;
+ fn LdrQueryImageFileExecutionOptionsEx(
+ SubKey: PUNICODE_STRING,
+ ValueName: PCWSTR,
+ Type: ULONG,
+ Buffer: PVOID,
+ BufferSize: ULONG,
+ ReturnedLength: PULONG,
+ Wow64: BOOLEAN,
+ ) -> NTSTATUS;
+}}
+UNION!{union DELAYLOAD_PROC_DESCRIPTOR_Description {
+ Name: PCSTR,
+ Ordinal: ULONG,
+}}
+STRUCT!{struct DELAYLOAD_PROC_DESCRIPTOR {
+ ImportDescribedByName: ULONG,
+ Description: DELAYLOAD_PROC_DESCRIPTOR_Description,
+}}
+pub type PDELAYLOAD_PROC_DESCRIPTOR = *mut DELAYLOAD_PROC_DESCRIPTOR;
+STRUCT!{struct DELAYLOAD_INFO {
+ Size: ULONG,
+ DelayloadDescriptor: PCIMAGE_DELAYLOAD_DESCRIPTOR,
+ ThunkAddress: PIMAGE_THUNK_DATA,
+ TargetDllName: PCSTR,
+ TargetApiDescriptor: DELAYLOAD_PROC_DESCRIPTOR,
+ TargetModuleBase: PVOID,
+ Unused: PVOID,
+ LastError: ULONG,
+}}
+pub type PDELAYLOAD_INFO = *mut DELAYLOAD_INFO;
+FN!{stdcall PDELAYLOAD_FAILURE_DLL_CALLBACK(
+ NotificationReason: ULONG,
+ DelayloadInfo: PDELAYLOAD_INFO,
+) -> PVOID}
+FN!{stdcall PDELAYLOAD_FAILURE_SYSTEM_ROUTINE(
+ DllName: PCSTR,
+ ProcName: PCSTR,
+) -> PVOID}
+EXTERN!{extern "system" {
+ fn LdrResolveDelayLoadedAPI(
+ ParentModuleBase: PVOID,
+ DelayloadDescriptor: PCIMAGE_DELAYLOAD_DESCRIPTOR,
+ FailureDllHook: PDELAYLOAD_FAILURE_DLL_CALLBACK,
+ FailureSystemHook: PDELAYLOAD_FAILURE_SYSTEM_ROUTINE,
+ ThunkAddress: PIMAGE_THUNK_DATA,
+ Flags: ULONG,
+ ) -> PVOID;
+ fn LdrResolveDelayLoadsFromDll(
+ ParentBase: PVOID,
+ TargetDllName: PCSTR,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn LdrSetDefaultDllDirectories(
+ DirectoryFlags: ULONG,
+ ) -> NTSTATUS;
+ fn LdrShutdownProcess() -> NTSTATUS;
+ fn LdrShutdownThread() -> NTSTATUS;
+ fn LdrSetImplicitPathOptions(
+ ImplicitPathOptions: ULONG,
+ ) -> NTSTATUS;
+ fn LdrControlFlowGuardEnforced() -> BOOLEAN;
+}}
diff --git a/third_party/rust/ntapi/src/ntlpcapi.rs b/third_party/rust/ntapi/src/ntlpcapi.rs
new file mode 100644
index 0000000000..012c9056f5
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntlpcapi.rs
@@ -0,0 +1,692 @@
+use core::mem::size_of;
+use crate::ntapi_base::{CLIENT_ID, CLIENT_ID64};
+use winapi::ctypes::c_double;
+use winapi::shared::basetsd::{PSIZE_T, SIZE_T, ULONG64, ULONG_PTR};
+use winapi::shared::ntdef::{
+ BOOLEAN, CSHORT, HANDLE, LARGE_INTEGER, NTSTATUS, OBJ_CASE_INSENSITIVE, PHANDLE,
+ PLARGE_INTEGER, POBJECT_ATTRIBUTES, PULONG, PUNICODE_STRING, PVOID, ULONG, ULONGLONG,
+ UNICODE_STRING,
+};
+use winapi::um::winnt::{
+ ACCESS_MASK, PSECURITY_DESCRIPTOR, PSECURITY_QUALITY_OF_SERVICE, PSID, RTL_SRWLOCK,
+ SECURITY_QUALITY_OF_SERVICE, STANDARD_RIGHTS_REQUIRED, SYNCHRONIZE,
+};
+pub const PORT_CONNECT: u32 = 0x0001;
+pub const PORT_ALL_ACCESS: u32 = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1;
+STRUCT!{struct PORT_MESSAGE_u1_s {
+ DataLength: CSHORT,
+ TotalLength: CSHORT,
+}}
+STRUCT!{struct PORT_MESSAGE_u2_s {
+ Type: CSHORT,
+ DataInfoOffset: CSHORT,
+}}
+UNION!{union PORT_MESSAGE_u1 {
+ s: PORT_MESSAGE_u1_s,
+ Length: ULONG,
+}}
+UNION!{union PORT_MESSAGE_u2 {
+ s: PORT_MESSAGE_u2_s,
+ ZeroInit: ULONG,
+}}
+UNION!{union PORT_MESSAGE_u3 {
+ ClientId: CLIENT_ID,
+ DoNotUseThisField: c_double,
+}}
+UNION!{union PORT_MESSAGE_u4 {
+ ClientViewSize: SIZE_T,
+ CallbackId: ULONG,
+}}
+STRUCT!{struct PORT_MESSAGE {
+ u1: PORT_MESSAGE_u1,
+ u2: PORT_MESSAGE_u2,
+ u3: PORT_MESSAGE_u3,
+ MessageId: ULONG,
+ u4: PORT_MESSAGE_u4,
+}}
+pub type PPORT_MESSAGE = *mut PORT_MESSAGE;
+STRUCT!{struct PORT_DATA_ENTRY {
+ Base: PVOID,
+ Size: ULONG,
+}}
+pub type PPORT_DATA_ENTRY = *mut PORT_DATA_ENTRY;
+STRUCT!{struct PORT_DATA_INFORMATION {
+ CountDataEntries: ULONG,
+ DataEntries: [PORT_DATA_ENTRY; 1],
+}}
+pub type PPORT_DATA_INFORMATION = *mut PORT_DATA_INFORMATION;
+pub const LPC_REQUEST: ULONG = 1;
+pub const LPC_REPLY: ULONG = 2;
+pub const LPC_DATAGRAM: ULONG = 3;
+pub const LPC_LOST_REPLY: ULONG = 4;
+pub const LPC_PORT_CLOSED: ULONG = 5;
+pub const LPC_CLIENT_DIED: ULONG = 6;
+pub const LPC_EXCEPTION: ULONG = 7;
+pub const LPC_DEBUG_EVENT: ULONG = 8;
+pub const LPC_ERROR_EVENT: ULONG = 9;
+pub const LPC_CONNECTION_REQUEST: ULONG = 10;
+pub const LPC_KERNELMODE_MESSAGE: CSHORT = 0x8000;
+pub const LPC_NO_IMPERSONATE: CSHORT = 0x4000;
+pub const PORT_VALID_OBJECT_ATTRIBUTES: u32 = OBJ_CASE_INSENSITIVE;
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+pub const PORT_MAXIMUM_MESSAGE_LENGTH: u32 = 512;
+#[cfg(target_arch = "x86")]
+pub const PORT_MAXIMUM_MESSAGE_LENGTH: u32 = 256;
+pub const LPC_MAX_CONNECTION_INFO_SIZE: u32 = 16 * size_of::<ULONG_PTR>() as u32;
+pub const PORT_TOTAL_MAXIMUM_MESSAGE_LENGTH: u32 = (PORT_MAXIMUM_MESSAGE_LENGTH
+ + size_of::<PORT_MESSAGE>() as u32
+ + LPC_MAX_CONNECTION_INFO_SIZE
+ + 0xf) & !0xf;
+STRUCT!{struct LPC_CLIENT_DIED_MSG {
+ PortMsg: PORT_MESSAGE,
+ CreateTime: LARGE_INTEGER,
+}}
+pub type PLPC_CLIENT_DIED_MSG = *mut LPC_CLIENT_DIED_MSG;
+STRUCT!{struct PORT_VIEW {
+ Length: ULONG,
+ SectionHandle: HANDLE,
+ SectionOffset: ULONG,
+ ViewSize: SIZE_T,
+ ViewBase: PVOID,
+ ViewRemoteBase: PVOID,
+}}
+pub type PPORT_VIEW = *mut PORT_VIEW;
+STRUCT!{struct REMOTE_PORT_VIEW {
+ Length: ULONG,
+ ViewSize: SIZE_T,
+ ViewBase: PVOID,
+}}
+pub type PREMOTE_PORT_VIEW = *mut REMOTE_PORT_VIEW;
+STRUCT!{struct PORT_MESSAGE64_u1_s {
+ DataLength: CSHORT,
+ TotalLength: CSHORT,
+}}
+STRUCT!{struct PORT_MESSAGE64_u2_s {
+ Type: CSHORT,
+ DataInfoOffset: CSHORT,
+}}
+UNION!{union PORT_MESSAGE64_u1 {
+ s: PORT_MESSAGE64_u1_s,
+ Length: ULONG,
+}}
+UNION!{union PORT_MESSAGE64_u2 {
+ s: PORT_MESSAGE64_u2_s,
+ ZeroInit: ULONG,
+}}
+UNION!{union PORT_MESSAGE64_u3 {
+ ClientId: CLIENT_ID64,
+ DoNotUseThisField: c_double,
+}}
+UNION!{union PORT_MESSAGE64_u4 {
+ ClientViewSize: ULONGLONG,
+ CallbackId: ULONG,
+}}
+STRUCT!{struct PORT_MESSAGE64 {
+ u1: PORT_MESSAGE64_u1,
+ u2: PORT_MESSAGE64_u2,
+ u3: PORT_MESSAGE64_u3,
+ MessageId: ULONG,
+ u4: PORT_MESSAGE64_u4,
+}}
+pub type PPORT_MESSAGE64 = *mut PORT_MESSAGE64;
+STRUCT!{struct LPC_CLIENT_DIED_MSG64 {
+ PortMsg: PORT_MESSAGE64,
+ CreateTime: LARGE_INTEGER,
+}}
+pub type PLPC_CLIENT_DIED_MSG64 = *mut LPC_CLIENT_DIED_MSG64;
+STRUCT!{struct PORT_VIEW64 {
+ Length: ULONG,
+ SectionHandle: ULONGLONG,
+ SectionOffset: ULONG,
+ ViewSize: ULONGLONG,
+ ViewBase: ULONGLONG,
+ ViewRemoteBase: ULONGLONG,
+}}
+pub type PPORT_VIEW64 = *mut PORT_VIEW64;
+STRUCT!{struct REMOTE_PORT_VIEW64 {
+ Length: ULONG,
+ ViewSize: ULONGLONG,
+ ViewBase: ULONGLONG,
+}}
+pub type PREMOTE_PORT_VIEW64 = *mut REMOTE_PORT_VIEW64;
+EXTERN!{extern "system" {
+ fn NtCreatePort(
+ PortHandle: PHANDLE,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ MaxConnectionInfoLength: ULONG,
+ MaxMessageLength: ULONG,
+ MaxPoolUsage: ULONG,
+ ) -> NTSTATUS;
+ fn NtCreateWaitablePort(
+ PortHandle: PHANDLE,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ MaxConnectionInfoLength: ULONG,
+ MaxMessageLength: ULONG,
+ MaxPoolUsage: ULONG,
+ ) -> NTSTATUS;
+ fn NtConnectPort(
+ PortHandle: PHANDLE,
+ PortName: PUNICODE_STRING,
+ SecurityQos: PSECURITY_QUALITY_OF_SERVICE,
+ ClientView: PPORT_VIEW,
+ ServerView: PREMOTE_PORT_VIEW,
+ MaxMessageLength: PULONG,
+ ConnectionInformation: PVOID,
+ ConnectionInformationLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSecureConnectPort(
+ PortHandle: PHANDLE,
+ PortName: PUNICODE_STRING,
+ SecurityQos: PSECURITY_QUALITY_OF_SERVICE,
+ ClientView: PPORT_VIEW,
+ RequiredServerSid: PSID,
+ ServerView: PREMOTE_PORT_VIEW,
+ MaxMessageLength: PULONG,
+ ConnectionInformation: PVOID,
+ ConnectionInformationLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtListenPort(
+ PortHandle: HANDLE,
+ ConnectionRequest: PPORT_MESSAGE,
+ ) -> NTSTATUS;
+ fn NtAcceptConnectPort(
+ PortHandle: PHANDLE,
+ PortContext: PVOID,
+ ConnectionRequest: PPORT_MESSAGE,
+ AcceptConnection: BOOLEAN,
+ ServerView: PPORT_VIEW,
+ ClientView: PREMOTE_PORT_VIEW,
+ ) -> NTSTATUS;
+ fn NtCompleteConnectPort(
+ PortHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtRequestPort(
+ PortHandle: HANDLE,
+ RequestMessage: PPORT_MESSAGE,
+ ) -> NTSTATUS;
+ fn NtRequestWaitReplyPort(
+ PortHandle: HANDLE,
+ RequestMessage: PPORT_MESSAGE,
+ ReplyMessage: PPORT_MESSAGE,
+ ) -> NTSTATUS;
+ fn NtReplyPort(
+ PortHandle: HANDLE,
+ ReplyMessage: PPORT_MESSAGE,
+ ) -> NTSTATUS;
+ fn NtReplyWaitReplyPort(
+ PortHandle: HANDLE,
+ ReplyMessage: PPORT_MESSAGE,
+ ) -> NTSTATUS;
+ fn NtReplyWaitReceivePort(
+ PortHandle: HANDLE,
+ PortContext: *mut PVOID,
+ ReplyMessage: PPORT_MESSAGE,
+ ReceiveMessage: PPORT_MESSAGE,
+ ) -> NTSTATUS;
+ fn NtReplyWaitReceivePortEx(
+ PortHandle: HANDLE,
+ PortContext: *mut PVOID,
+ ReplyMessage: PPORT_MESSAGE,
+ ReceiveMessage: PPORT_MESSAGE,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtImpersonateClientOfPort(
+ PortHandle: HANDLE,
+ Message: PPORT_MESSAGE,
+ ) -> NTSTATUS;
+ fn NtReadRequestData(
+ PortHandle: HANDLE,
+ Message: PPORT_MESSAGE,
+ DataEntryIndex: ULONG,
+ Buffer: PVOID,
+ BufferSize: SIZE_T,
+ NumberOfBytesRead: PSIZE_T,
+ ) -> NTSTATUS;
+ fn NtWriteRequestData(
+ PortHandle: HANDLE,
+ Message: PPORT_MESSAGE,
+ DataEntryIndex: ULONG,
+ Buffer: PVOID,
+ BufferSize: SIZE_T,
+ NumberOfBytesWritten: PSIZE_T,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum PORT_INFORMATION_CLASS {
+ PortBasicInformation = 0,
+ PortDumpInformation = 1,
+}}
+EXTERN!{extern "system" {
+ fn NtQueryInformationPort(
+ PortHandle: HANDLE,
+ PortInformationClass: PORT_INFORMATION_CLASS,
+ PortInformation: PVOID,
+ Length: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+}}
+pub type PALPC_HANDLE = *mut HANDLE;
+pub type ALPC_HANDLE = HANDLE;
+pub const ALPC_PORFLG_ALLOW_LPC_REQUESTS: ULONG = 0x20000;
+pub const ALPC_PORFLG_WAITABLE_PORT: ULONG = 0x40000;
+pub const ALPC_PORFLG_SYSTEM_PROCESS: ULONG = 0x100000;
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+STRUCT!{struct ALPC_PORT_ATTRIBUTES {
+ Flags: ULONG,
+ SecurityQos: SECURITY_QUALITY_OF_SERVICE,
+ MaxMessageLength: SIZE_T,
+ MemoryBandwidth: SIZE_T,
+ MaxPoolUsage: SIZE_T,
+ MaxSectionSize: SIZE_T,
+ MaxViewSize: SIZE_T,
+ MaxTotalSectionSize: SIZE_T,
+ DupObjectTypes: ULONG,
+ Reserved: ULONG,
+}}
+#[cfg(target_arch = "x86")]
+STRUCT!{struct ALPC_PORT_ATTRIBUTES {
+ Flags: ULONG,
+ SecurityQos: SECURITY_QUALITY_OF_SERVICE,
+ MaxMessageLength: SIZE_T,
+ MemoryBandwidth: SIZE_T,
+ MaxPoolUsage: SIZE_T,
+ MaxSectionSize: SIZE_T,
+ MaxViewSize: SIZE_T,
+ MaxTotalSectionSize: SIZE_T,
+ DupObjectTypes: ULONG,
+}}
+pub type PALPC_PORT_ATTRIBUTES = *mut ALPC_PORT_ATTRIBUTES;
+pub const ALPC_MESSAGE_SECURITY_ATTRIBUTE: ULONG = 0x80000000;
+pub const ALPC_MESSAGE_VIEW_ATTRIBUTE: ULONG = 0x40000000;
+pub const ALPC_MESSAGE_CONTEXT_ATTRIBUTE: ULONG = 0x20000000;
+pub const ALPC_MESSAGE_HANDLE_ATTRIBUTE: ULONG = 0x10000000;
+STRUCT!{struct ALPC_MESSAGE_ATTRIBUTES {
+ AllocatedAttributes: ULONG,
+ ValidAttributes: ULONG,
+}}
+pub type PALPC_MESSAGE_ATTRIBUTES = *mut ALPC_MESSAGE_ATTRIBUTES;
+STRUCT!{struct ALPC_COMPLETION_LIST_STATE {
+ Value: ULONG64,
+}}
+BITFIELD!{ALPC_COMPLETION_LIST_STATE Value: ULONG64 [
+ Head set_Head[0..24],
+ Tail set_Tail[24..48],
+ ActiveThreadCount set_ActiveThreadCount[48..64],
+]}
+pub type PALPC_COMPLETION_LIST_STATE = *mut ALPC_COMPLETION_LIST_STATE;
+pub const ALPC_COMPLETION_LIST_BUFFER_GRANULARITY_MASK: ULONG = 0x3f;
+STRUCT!{#[repr(align(128))] struct ALPC_COMPLETION_LIST_HEADER {
+ StartMagic: ULONG64,
+ TotalSize: ULONG,
+ ListOffset: ULONG,
+ ListSize: ULONG,
+ BitmapOffset: ULONG,
+ BitmapSize: ULONG,
+ DataOffset: ULONG,
+ DataSize: ULONG,
+ AttributeFlags: ULONG,
+ AttributeSize: ULONG,
+ __padding0: [u64; 10],
+ State: ALPC_COMPLETION_LIST_STATE,
+ LastMessageId: ULONG,
+ LastCallbackId: ULONG,
+ __padding1: [u32; 28],
+ PostCount: ULONG,
+ __padding2: [u32; 31],
+ ReturnCount: ULONG,
+ __padding3: [u32; 31],
+ LogSequenceNumber: ULONG,
+ __padding4: [u64; 15],
+ UserLock: RTL_SRWLOCK,
+ EndMagic: ULONG64,
+ __padding5: [u64; 14],
+}}
+pub type PALPC_COMPLETION_LIST_HEADER = *mut ALPC_COMPLETION_LIST_HEADER;
+STRUCT!{struct ALPC_CONTEXT_ATTR {
+ PortContext: PVOID,
+ MessageContext: PVOID,
+ Sequence: ULONG,
+ MessageId: ULONG,
+ CallbackId: ULONG,
+}}
+pub type PALPC_CONTEXT_ATTR = *mut ALPC_CONTEXT_ATTR;
+pub const ALPC_HANDLEFLG_DUPLICATE_SAME_ACCESS: ULONG = 0x10000;
+pub const ALPC_HANDLEFLG_DUPLICATE_SAME_ATTRIBUTES: ULONG = 0x20000;
+pub const ALPC_HANDLEFLG_DUPLICATE_INHERIT: ULONG = 0x80000;
+STRUCT!{struct ALPC_HANDLE_ATTR32 {
+ Flags: ULONG,
+ Reserved0: ULONG,
+ SameAccess: ULONG,
+ SameAttributes: ULONG,
+ Indirect: ULONG,
+ Inherit: ULONG,
+ Reserved1: ULONG,
+ Handle: ULONG,
+ ObjectType: ULONG,
+ DesiredAccess: ULONG,
+ GrantedAccess: ULONG,
+}}
+pub type PALPC_HANDLE_ATTR32 = *mut ALPC_HANDLE_ATTR32;
+STRUCT!{struct ALPC_HANDLE_ATTR {
+ Flags: ULONG,
+ Reserved0: ULONG,
+ SameAccess: ULONG,
+ SameAttributes: ULONG,
+ Indirect: ULONG,
+ Inherit: ULONG,
+ Reserved1: ULONG,
+ Handle: HANDLE,
+ HandleAttrArray: PALPC_HANDLE_ATTR32,
+ ObjectType: ULONG,
+ HandleCount: ULONG,
+ DesiredAccess: ACCESS_MASK,
+ GrantedAccess: ACCESS_MASK,
+}}
+pub type PALPC_HANDLE_ATTR = *mut ALPC_HANDLE_ATTR;
+pub const ALPC_SECFLG_CREATE_HANDLE: ULONG = 0x20000;
+STRUCT!{struct ALPC_SECURITY_ATTR {
+ Flags: ULONG,
+ QoS: PSECURITY_QUALITY_OF_SERVICE,
+ ContextHandle: ALPC_HANDLE,
+}}
+pub type PALPC_SECURITY_ATTR = *mut ALPC_SECURITY_ATTR;
+pub const ALPC_VIEWFLG_NOT_SECURE: ULONG = 0x40000;
+STRUCT!{struct ALPC_DATA_VIEW_ATTR {
+ Flags: ULONG,
+ SectionHandle: ALPC_HANDLE,
+ ViewBase: PVOID,
+ ViewSize: SIZE_T,
+}}
+pub type PALPC_DATA_VIEW_ATTR = *mut ALPC_DATA_VIEW_ATTR;
+ENUM!{enum ALPC_PORT_INFORMATION_CLASS {
+ AlpcBasicInformation = 0,
+ AlpcPortInformation = 1,
+ AlpcAssociateCompletionPortInformation = 2,
+ AlpcConnectedSIDInformation = 3,
+ AlpcServerInformation = 4,
+ AlpcMessageZoneInformation = 5,
+ AlpcRegisterCompletionListInformation = 6,
+ AlpcUnregisterCompletionListInformation = 7,
+ AlpcAdjustCompletionListConcurrencyCountInformation = 8,
+ AlpcRegisterCallbackInformation = 9,
+ AlpcCompletionListRundownInformation = 10,
+ AlpcWaitForPortReferences = 11,
+}}
+STRUCT!{struct ALPC_BASIC_INFORMATION {
+ Flags: ULONG,
+ SequenceNo: ULONG,
+ PortContext: PVOID,
+}}
+pub type PALPC_BASIC_INFORMATION = *mut ALPC_BASIC_INFORMATION;
+STRUCT!{struct ALPC_PORT_ASSOCIATE_COMPLETION_PORT {
+ CompletionKey: PVOID,
+ CompletionPort: HANDLE,
+}}
+pub type PALPC_PORT_ASSOCIATE_COMPLETION_PORT = *mut ALPC_PORT_ASSOCIATE_COMPLETION_PORT;
+STRUCT!{struct ALPC_SERVER_INFORMATION_Out {
+ ThreadBlocked: BOOLEAN,
+ ConnectedProcessId: HANDLE,
+ ConnectionPortName: UNICODE_STRING,
+}}
+UNION!{union ALPC_SERVER_INFORMATION {
+ ThreadHandle: HANDLE,
+ Out: ALPC_SERVER_INFORMATION_Out,
+}}
+pub type PALPC_SERVER_INFORMATION = *mut ALPC_SERVER_INFORMATION;
+STRUCT!{struct ALPC_PORT_MESSAGE_ZONE_INFORMATION {
+ Buffer: PVOID,
+ Size: ULONG,
+}}
+pub type PALPC_PORT_MESSAGE_ZONE_INFORMATION = *mut ALPC_PORT_MESSAGE_ZONE_INFORMATION;
+STRUCT!{struct ALPC_PORT_COMPLETION_LIST_INFORMATION {
+ Buffer: PVOID,
+ Size: ULONG,
+ ConcurrencyCount: ULONG,
+ AttributeFlags: ULONG,
+}}
+pub type PALPC_PORT_COMPLETION_LIST_INFORMATION = *mut ALPC_PORT_COMPLETION_LIST_INFORMATION;
+ENUM!{enum ALPC_MESSAGE_INFORMATION_CLASS {
+ AlpcMessageSidInformation = 0,
+ AlpcMessageTokenModifiedIdInformation = 1,
+ AlpcMessageDirectStatusInformation = 2,
+ AlpcMessageHandleInformation = 3,
+ MaxAlpcMessageInfoClass = 4,
+}}
+pub type PALPC_MESSAGE_INFORMATION_CLASS = *mut ALPC_MESSAGE_INFORMATION_CLASS;
+STRUCT!{struct ALPC_MESSAGE_HANDLE_INFORMATION {
+ Index: ULONG,
+ Flags: ULONG,
+ Handle: ULONG,
+ ObjectType: ULONG,
+ GrantedAccess: ACCESS_MASK,
+}}
+pub type PALPC_MESSAGE_HANDLE_INFORMATION = *mut ALPC_MESSAGE_HANDLE_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtAlpcCreatePort(
+ PortHandle: PHANDLE,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ PortAttributes: PALPC_PORT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtAlpcDisconnectPort(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn NtAlpcQueryInformation(
+ PortHandle: HANDLE,
+ PortInformationClass: ALPC_PORT_INFORMATION_CLASS,
+ PortInformation: PVOID,
+ Length: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtAlpcSetInformation(
+ PortHandle: HANDLE,
+ PortInformationClass: ALPC_PORT_INFORMATION_CLASS,
+ PortInformation: PVOID,
+ Length: ULONG,
+ ) -> NTSTATUS;
+ fn NtAlpcCreatePortSection(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ SectionHandle: HANDLE,
+ SectionSize: SIZE_T,
+ AlpcSectionHandle: PALPC_HANDLE,
+ ActualSectionSize: PSIZE_T,
+ ) -> NTSTATUS;
+ fn NtAlpcDeletePortSection(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ SectionHandle: ALPC_HANDLE,
+ ) -> NTSTATUS;
+ fn NtAlpcCreateResourceReserve(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ MessageSize: SIZE_T,
+ ResourceId: PALPC_HANDLE,
+ ) -> NTSTATUS;
+ fn NtAlpcDeleteResourceReserve(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ ResourceId: ALPC_HANDLE,
+ ) -> NTSTATUS;
+ fn NtAlpcCreateSectionView(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ ViewAttributes: PALPC_DATA_VIEW_ATTR,
+ ) -> NTSTATUS;
+ fn NtAlpcDeleteSectionView(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ ViewBase: PVOID,
+ ) -> NTSTATUS;
+ fn NtAlpcCreateSecurityContext(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ SecurityAttribute: PALPC_SECURITY_ATTR,
+ ) -> NTSTATUS;
+ fn NtAlpcDeleteSecurityContext(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ ContextHandle: ALPC_HANDLE,
+ ) -> NTSTATUS;
+ fn NtAlpcRevokeSecurityContext(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ ContextHandle: ALPC_HANDLE,
+ ) -> NTSTATUS;
+ fn NtAlpcQueryInformationMessage(
+ PortHandle: HANDLE,
+ PortMessage: PPORT_MESSAGE,
+ MessageInformationClass: ALPC_MESSAGE_INFORMATION_CLASS,
+ MessageInformation: PVOID,
+ Length: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+}}
+pub const ALPC_MSGFLG_REPLY_MESSAGE: ULONG = 0x1;
+pub const ALPC_MSGFLG_LPC_MODE: ULONG = 0x2;
+pub const ALPC_MSGFLG_RELEASE_MESSAGE: ULONG = 0x10000;
+pub const ALPC_MSGFLG_SYNC_REQUEST: ULONG = 0x20000;
+pub const ALPC_MSGFLG_WAIT_USER_MODE: ULONG = 0x100000;
+pub const ALPC_MSGFLG_WAIT_ALERTABLE: ULONG = 0x200000;
+pub const ALPC_MSGFLG_WOW64_CALL: ULONG = 0x80000000;
+EXTERN!{extern "system" {
+ fn NtAlpcConnectPort(
+ PortHandle: PHANDLE,
+ PortName: PUNICODE_STRING,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ PortAttributes: PALPC_PORT_ATTRIBUTES,
+ Flags: ULONG,
+ RequiredServerSid: PSID,
+ ConnectionMessage: PPORT_MESSAGE,
+ BufferLength: PULONG,
+ OutMessageAttributes: PALPC_MESSAGE_ATTRIBUTES,
+ InMessageAttributes: PALPC_MESSAGE_ATTRIBUTES,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtAlpcConnectPortEx(
+ PortHandle: PHANDLE,
+ ConnectionPortObjectAttributes: POBJECT_ATTRIBUTES,
+ ClientPortObjectAttributes: POBJECT_ATTRIBUTES,
+ PortAttributes: PALPC_PORT_ATTRIBUTES,
+ Flags: ULONG,
+ ServerSecurityRequirements: PSECURITY_DESCRIPTOR,
+ ConnectionMessage: PPORT_MESSAGE,
+ BufferLength: PSIZE_T,
+ OutMessageAttributes: PALPC_MESSAGE_ATTRIBUTES,
+ InMessageAttributes: PALPC_MESSAGE_ATTRIBUTES,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtAlpcAcceptConnectPort(
+ PortHandle: PHANDLE,
+ ConnectionPortHandle: HANDLE,
+ Flags: ULONG,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ PortAttributes: PALPC_PORT_ATTRIBUTES,
+ PortContext: PVOID,
+ ConnectionRequest: PPORT_MESSAGE,
+ ConnectionMessageAttributes: PALPC_MESSAGE_ATTRIBUTES,
+ AcceptConnection: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtAlpcSendWaitReceivePort(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ SendMessageA: PPORT_MESSAGE,
+ SendMessageAttributes: PALPC_MESSAGE_ATTRIBUTES,
+ ReceiveMessage: PPORT_MESSAGE,
+ BufferLength: PSIZE_T,
+ ReceiveMessageAttributes: PALPC_MESSAGE_ATTRIBUTES,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+}}
+pub const ALPC_CANCELFLG_TRY_CANCEL: ULONG = 0x1;
+pub const ALPC_CANCELFLG_NO_CONTEXT_CHECK: ULONG = 0x8;
+pub const ALPC_CANCELFLGP_FLUSH: ULONG = 0x10000;
+EXTERN!{extern "system" {
+ fn NtAlpcCancelMessage(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ MessageContext: PALPC_CONTEXT_ATTR,
+ ) -> NTSTATUS;
+ fn NtAlpcImpersonateClientOfPort(
+ PortHandle: HANDLE,
+ Message: PPORT_MESSAGE,
+ Flags: PVOID,
+ ) -> NTSTATUS;
+ fn NtAlpcImpersonateClientContainerOfPort(
+ PortHandle: HANDLE,
+ Message: PPORT_MESSAGE,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn NtAlpcOpenSenderProcess(
+ ProcessHandle: PHANDLE,
+ PortHandle: HANDLE,
+ PortMessage: PPORT_MESSAGE,
+ Flags: ULONG,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtAlpcOpenSenderThread(
+ ThreadHandle: PHANDLE,
+ PortHandle: HANDLE,
+ PortMessage: PPORT_MESSAGE,
+ Flags: ULONG,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn AlpcMaxAllowedMessageLength() -> ULONG;
+ fn AlpcGetHeaderSize(
+ Flags: ULONG,
+ ) -> ULONG;
+ fn AlpcInitializeMessageAttribute(
+ AttributeFlags: ULONG,
+ Buffer: PALPC_MESSAGE_ATTRIBUTES,
+ BufferSize: ULONG,
+ RequiredBufferSize: PULONG,
+ ) -> NTSTATUS;
+ fn AlpcGetMessageAttribute(
+ Buffer: PALPC_MESSAGE_ATTRIBUTES,
+ AttributeFlag: ULONG,
+ ) -> PVOID;
+ fn AlpcRegisterCompletionList(
+ PortHandle: HANDLE,
+ Buffer: PALPC_COMPLETION_LIST_HEADER,
+ Size: ULONG,
+ ConcurrencyCount: ULONG,
+ AttributeFlags: ULONG,
+ ) -> NTSTATUS;
+ fn AlpcUnregisterCompletionList(
+ PortHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn AlpcRundownCompletionList(
+ PortHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn AlpcAdjustCompletionListConcurrencyCount(
+ PortHandle: HANDLE,
+ ConcurrencyCount: ULONG,
+ ) -> NTSTATUS;
+ fn AlpcRegisterCompletionListWorkerThread(
+ CompletionList: PVOID,
+ ) -> BOOLEAN;
+ fn AlpcUnregisterCompletionListWorkerThread(
+ CompletionList: PVOID,
+ ) -> BOOLEAN;
+ fn AlpcGetCompletionListLastMessageInformation(
+ CompletionList: PVOID,
+ LastMessageId: PULONG,
+ LastCallbackId: PULONG,
+ );
+ fn AlpcGetOutstandingCompletionListMessageCount(
+ CompletionList: PVOID,
+ ) -> ULONG;
+ fn AlpcGetMessageFromCompletionList(
+ CompletionList: PVOID,
+ MessageAttributes: *mut PALPC_MESSAGE_ATTRIBUTES,
+ ) -> PPORT_MESSAGE;
+ fn AlpcFreeCompletionListMessage(
+ CompletionList: PVOID,
+ Message: PPORT_MESSAGE,
+ );
+ fn AlpcGetCompletionListMessageAttributes(
+ CompletionList: PVOID,
+ Message: PPORT_MESSAGE,
+ ) -> PALPC_MESSAGE_ATTRIBUTES;
+}}
diff --git a/third_party/rust/ntapi/src/ntmisc.rs b/third_party/rust/ntapi/src/ntmisc.rs
new file mode 100644
index 0000000000..7f579999e8
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntmisc.rs
@@ -0,0 +1,42 @@
+use winapi::shared::ntdef::{HANDLE, NTSTATUS, PULONG, PVOID, ULONG};
+use winapi::um::winnt::STANDARD_RIGHTS_ALL;
+pub const FLT_PORT_CONNECT: u32 = 0x0001;
+pub const FLT_PORT_ALL_ACCESS: u32 = FLT_PORT_CONNECT | STANDARD_RIGHTS_ALL;
+ENUM!{enum VDMSERVICECLASS {
+ VdmStartExecution = 0,
+ VdmQueueInterrupt = 1,
+ VdmDelayInterrupt = 2,
+ VdmInitialize = 3,
+ VdmFeatures = 4,
+ VdmSetInt21Handler = 5,
+ VdmQueryDir = 6,
+ VdmPrinterDirectIoOpen = 7,
+ VdmPrinterDirectIoClose = 8,
+ VdmPrinterInitialize = 9,
+ VdmSetLdtEntries = 10,
+ VdmSetProcessLdtInfo = 11,
+ VdmAdlibEmulation = 12,
+ VdmPMCliControl = 13,
+ VdmQueryVdmProcess = 14,
+}}
+pub type PVDMSERVICECLASS = *mut VDMSERVICECLASS;
+EXTERN!{extern "system" {
+ fn NtVdmControl(
+ Service: VDMSERVICECLASS,
+ ServiceData: PVOID,
+ ) -> NTSTATUS;
+ fn NtTraceEvent(
+ TraceHandle: HANDLE,
+ Flags: ULONG,
+ FieldSize: ULONG,
+ Fields: PVOID,
+ ) -> NTSTATUS;
+ fn NtTraceControl(
+ FunctionCode: ULONG,
+ InBuffer: PVOID,
+ InBufferLen: ULONG,
+ OutBuffer: PVOID,
+ OutBufferLen: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+}}
diff --git a/third_party/rust/ntapi/src/ntmmapi.rs b/third_party/rust/ntapi/src/ntmmapi.rs
new file mode 100644
index 0000000000..7cae677aad
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntmmapi.rs
@@ -0,0 +1,630 @@
+use crate::winapi_local::um::winnt::PMEM_EXTENDED_PARAMETER;
+use winapi::shared::basetsd::{PSIZE_T, PULONG_PTR, SIZE_T, ULONG_PTR};
+use winapi::shared::ntdef::{
+ BOOLEAN, HANDLE, LARGE_INTEGER, NTSTATUS, PHANDLE, PLARGE_INTEGER, POBJECT_ATTRIBUTES, PULONG,
+ PUNICODE_STRING, PVOID, UCHAR, ULONG, ULONGLONG, UNICODE_STRING, USHORT,
+};
+use winapi::um::winnt::{
+ ACCESS_MASK, PCFG_CALL_TARGET_INFO, STANDARD_RIGHTS_REQUIRED, SYNCHRONIZE,
+};
+ENUM!{enum MEMORY_INFORMATION_CLASS {
+ MemoryBasicInformation = 0,
+ MemoryWorkingSetInformation = 1,
+ MemoryMappedFilenameInformation = 2,
+ MemoryRegionInformation = 3,
+ MemoryWorkingSetExInformation = 4,
+ MemorySharedCommitInformation = 5,
+ MemoryImageInformation = 6,
+ MemoryRegionInformationEx = 7,
+ MemoryPrivilegedBasicInformation = 8,
+ MemoryEnclaveImageInformation = 9,
+ MemoryBasicInformationCapped = 10,
+}}
+STRUCT!{struct MEMORY_WORKING_SET_BLOCK {
+ Bitfields: ULONG_PTR,
+}}
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+BITFIELD!{MEMORY_WORKING_SET_BLOCK Bitfields: ULONG_PTR [
+ Protection set_Protection[0..5],
+ ShareCount set_ShareCount[5..8],
+ Shared set_Shared[8..9],
+ Node set_Node[9..12],
+ VirtualPage set_VirtualPage[12..64],
+]}
+#[cfg(target_arch = "x86")]
+BITFIELD!{MEMORY_WORKING_SET_BLOCK Bitfields: ULONG_PTR [
+ Protection set_Protection[0..5],
+ ShareCount set_ShareCount[5..8],
+ Shared set_Shared[8..9],
+ Node set_Node[9..12],
+ VirtualPage set_VirtualPage[12..32],
+]}
+pub type PMEMORY_WORKING_SET_BLOCK = *mut MEMORY_WORKING_SET_BLOCK;
+STRUCT!{struct MEMORY_WORKING_SET_INFORMATION {
+ NumberOfEntries: ULONG_PTR,
+ WorkingSetInfo: [MEMORY_WORKING_SET_BLOCK; 1],
+}}
+pub type PMEMORY_WORKING_SET_INFORMATION = *mut MEMORY_WORKING_SET_INFORMATION;
+STRUCT!{struct MEMORY_REGION_INFORMATION {
+ AllocationBase: PVOID,
+ AllocationProtect: ULONG,
+ RegionType: ULONG,
+ RegionSize: SIZE_T,
+ CommitSize: SIZE_T,
+}}
+BITFIELD!{MEMORY_REGION_INFORMATION RegionType: ULONG [
+ Private set_Private[0..1],
+ MappedDataFile set_MappedDataFile[1..2],
+ MappedImage set_MappedImage[2..3],
+ MappedPageFile set_MappedPageFile[3..4],
+ MappedPhysical set_MappedPhysical[4..5],
+ DirectMapped set_DirectMapped[5..6],
+ SoftwareEnclave set_SoftwareEnclave[6..7],
+ PageSize64K set_PageSize64K[7..8],
+ PlaceholderReservation set_PlaceholderReservation[8..9],
+ Reserved set_Reserved[9..32],
+]}
+pub type PMEMORY_REGION_INFORMATION = *mut MEMORY_REGION_INFORMATION;
+ENUM!{enum MEMORY_WORKING_SET_EX_LOCATION {
+ MemoryLocationInvalid = 0,
+ MemoryLocationResident = 1,
+ MemoryLocationPagefile = 2,
+ MemoryLocationReserved = 3,
+}}
+UNION!{union MEMORY_WORKING_SET_EX_BLOCK_u {
+ Bitfields: ULONG_PTR,
+ Invalid: ULONG_PTR,
+}}
+STRUCT!{struct MEMORY_WORKING_SET_EX_BLOCK {
+ u: MEMORY_WORKING_SET_EX_BLOCK_u,
+}}
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+BITFIELD!{unsafe MEMORY_WORKING_SET_EX_BLOCK_u Bitfields: ULONG_PTR [
+ Valid set_Valid[0..1],
+ ShareCount set_ShareCount[1..4],
+ Win32Protection set_Win32Protection[4..15],
+ Shared set_Shared[15..16],
+ Node set_Node[16..22],
+ Locked set_Locked[22..23],
+ LargePage set_LargePage[23..24],
+ Priority set_Priority[24..27],
+ Reserved set_Reserved[27..30],
+ SharedOriginal set_SharedOriginal[30..31],
+ Bad set_Bad[31..32],
+ ReservedUlong set_ReservedUlong[32..64],
+]}
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+BITFIELD!{unsafe MEMORY_WORKING_SET_EX_BLOCK_u Invalid: ULONG_PTR [
+ Invalid_Valid set_Invalid_Valid[0..1],
+ Invalid_Reserved0 set_Invalid_Reserved0[1..15],
+ Invalid_Shared set_Invalid_Shared[15..16],
+ Invalid_Reserved1 set_Invalid_Reserved1[16..21],
+ Invalid_PageTable set_Invalid_PageTable[21..22],
+ Invalid_Location set_Invalid_Location[22..24],
+ Invalid_Priority set_Invalid_Priority[24..27],
+ Invalid_ModifiedList set_Invalid_ModifiedList[27..28],
+ Invalid_Reserved2 set_Invalid_Reserved2[28..30],
+ Invalid_SharedOriginal set_Invalid_SharedOriginal[30..31],
+ Invalid_Bad set_Invalid_Bad[31..32],
+ Invalid_ReservedUlong set_Invalid_ReservedUlong[32..64],
+]}
+#[cfg(target_arch = "x86")]
+BITFIELD!{unsafe MEMORY_WORKING_SET_EX_BLOCK_u Bitfields: ULONG_PTR [
+ Valid set_Valid[0..1],
+ ShareCount set_ShareCount[1..4],
+ Win32Protection set_Win32Protection[4..15],
+ Shared set_Shared[15..16],
+ Node set_Node[16..22],
+ Locked set_Locked[22..23],
+ LargePage set_LargePage[23..24],
+ Priority set_Priority[24..27],
+ Reserved set_Reserved[27..30],
+ SharedOriginal set_SharedOriginal[30..31],
+ Bad set_Bad[31..32],
+]}
+#[cfg(target_arch = "x86")]
+BITFIELD!{unsafe MEMORY_WORKING_SET_EX_BLOCK_u Invalid: ULONG_PTR [
+ Invalid_Valid set_Invalid_Valid[0..1],
+ Invalid_Reserved0 set_Invalid_Reserved0[1..15],
+ Invalid_Shared set_Invalid_Shared[15..16],
+ Invalid_Reserved1 set_Invalid_Reserved1[16..21],
+ Invalid_PageTable set_Invalid_PageTable[21..22],
+ Invalid_Location set_Invalid_Location[22..24],
+ Invalid_Priority set_Invalid_Priority[24..27],
+ Invalid_ModifiedList set_Invalid_ModifiedList[27..28],
+ Invalid_Reserved2 set_Invalid_Reserved2[28..30],
+ Invalid_SharedOriginal set_Invalid_SharedOriginal[30..31],
+ Invalid_Bad set_Invalid_Bad[31..32],
+]}
+pub type PMEMORY_WORKING_SET_EX_BLOCK = *mut MEMORY_WORKING_SET_EX_BLOCK;
+STRUCT!{struct MEMORY_WORKING_SET_EX_INFORMATION {
+ VirtualAddress: PVOID,
+ VirtualAttributes: MEMORY_WORKING_SET_EX_BLOCK,
+}}
+pub type PMEMORY_WORKING_SET_EX_INFORMATION = *mut MEMORY_WORKING_SET_EX_INFORMATION;
+STRUCT!{struct MEMORY_SHARED_COMMIT_INFORMATION {
+ CommitSize: SIZE_T,
+}}
+pub type PMEMORY_SHARED_COMMIT_INFORMATION = *mut MEMORY_SHARED_COMMIT_INFORMATION;
+STRUCT!{struct MEMORY_IMAGE_INFORMATION {
+ ImageBase: PVOID,
+ SizeOfImage: SIZE_T,
+ ImageFlags: ULONG,
+}}
+BITFIELD!{MEMORY_IMAGE_INFORMATION ImageFlags: ULONG [
+ ImagePartialMap set_ImagePartialMap[0..1],
+ ImageNotExecutable set_ImageNotExecutable[1..2],
+ ImageSigningLevel set_ImageSigningLevel[2..6],
+ Reserved set_Reserved[6..32],
+]}
+pub type PMEMORY_IMAGE_INFORMATION = *mut MEMORY_IMAGE_INFORMATION;
+STRUCT!{struct MEMORY_ENCLAVE_IMAGE_INFORMATION {
+ ImageInfo: MEMORY_IMAGE_INFORMATION,
+ UniqueID: [UCHAR; 32],
+ AuthorID: [UCHAR; 32],
+}}
+pub type PMEMORY_ENCLAVE_IMAGE_INFORMATION = *mut MEMORY_ENCLAVE_IMAGE_INFORMATION;
+pub const MMPFNLIST_ZERO: u32 = 0;
+pub const MMPFNLIST_FREE: u32 = 1;
+pub const MMPFNLIST_STANDBY: u32 = 2;
+pub const MMPFNLIST_MODIFIED: u32 = 3;
+pub const MMPFNLIST_MODIFIEDNOWRITE: u32 = 4;
+pub const MMPFNLIST_BAD: u32 = 5;
+pub const MMPFNLIST_ACTIVE: u32 = 6;
+pub const MMPFNLIST_TRANSITION: u32 = 7;
+pub const MMPFNUSE_PROCESSPRIVATE: u32 = 0;
+pub const MMPFNUSE_FILE: u32 = 1;
+pub const MMPFNUSE_PAGEFILEMAPPED: u32 = 2;
+pub const MMPFNUSE_PAGETABLE: u32 = 3;
+pub const MMPFNUSE_PAGEDPOOL: u32 = 4;
+pub const MMPFNUSE_NONPAGEDPOOL: u32 = 5;
+pub const MMPFNUSE_SYSTEMPTE: u32 = 6;
+pub const MMPFNUSE_SESSIONPRIVATE: u32 = 7;
+pub const MMPFNUSE_METAFILE: u32 = 8;
+pub const MMPFNUSE_AWEPAGE: u32 = 9;
+pub const MMPFNUSE_DRIVERLOCKPAGE: u32 = 10;
+pub const MMPFNUSE_KERNELSTACK: u32 = 11;
+STRUCT!{struct MEMORY_FRAME_INFORMATION {
+ Bitfields: ULONGLONG,
+}}
+BITFIELD!{MEMORY_FRAME_INFORMATION Bitfields: ULONGLONG [
+ UseDescription set_UseDescription[0..4],
+ ListDescription set_ListDescription[4..7],
+ Reserved0 set_Reserved0[7..8],
+ Pinned set_Pinned[8..9],
+ DontUse set_DontUse[9..57],
+ Priority set_Priority[57..60],
+ Reserved set_Reserved[60..64],
+]}
+STRUCT!{struct FILEOFFSET_INFORMATION {
+ Bitfields: ULONGLONG,
+}}
+BITFIELD!{FILEOFFSET_INFORMATION Bitfields: ULONGLONG [
+ DontUse set_DontUse[0..9],
+ Offset set_Offset[9..57],
+ Reserved set_Reserved[57..64],
+]}
+STRUCT!{struct PAGEDIR_INFORMATION {
+ Bitfields: ULONGLONG,
+}}
+BITFIELD!{PAGEDIR_INFORMATION Bitfields: ULONGLONG [
+ DontUse set_DontUse[0..9],
+ PageDirectoryBase set_PageDirectoryBase[9..57],
+ Reserved set_Reserved[57..64],
+]}
+STRUCT!{struct UNIQUE_PROCESS_INFORMATION {
+ Bitfields: ULONGLONG,
+}}
+BITFIELD!{UNIQUE_PROCESS_INFORMATION Bitfields: ULONGLONG [
+ DontUse set_DontUse[0..9],
+ UniqueProcessKey set_UniqueProcessKey[9..57],
+ Reserved set_Reserved[57..64],
+]}
+pub type PUNIQUE_PROCESS_INFORMATION = *mut UNIQUE_PROCESS_INFORMATION;
+UNION!{union MMPFN_IDENTITY_u1 {
+ e1: MEMORY_FRAME_INFORMATION,
+ e2: FILEOFFSET_INFORMATION,
+ e3: PAGEDIR_INFORMATION,
+ e4: UNIQUE_PROCESS_INFORMATION,
+}}
+UNION!{union MMPFN_IDENTITY_u2 {
+ e1: ULONG_PTR,
+ e2_CombinedPage: ULONG_PTR,
+ FileObject: ULONG_PTR,
+ UniqueFileObjectKey: ULONG_PTR,
+ ProtoPteAddress: ULONG_PTR,
+ VirtualAddress: ULONG_PTR,
+}}
+STRUCT!{struct MMPFN_IDENTITY {
+ u1: MMPFN_IDENTITY_u1,
+ PageFrameIndex: ULONG_PTR,
+ u2: MMPFN_IDENTITY_u2,
+}}
+BITFIELD!{unsafe MMPFN_IDENTITY_u2 e1: ULONG_PTR [
+ Image set_Image[0..1],
+ Mismatch set_Mismatch[1..2],
+]}
+pub type PMMPFN_IDENTITY = *mut MMPFN_IDENTITY;
+STRUCT!{struct MMPFN_MEMSNAP_INFORMATION {
+ InitialPageFrameIndex: ULONG_PTR,
+ Count: ULONG_PTR,
+}}
+pub type PMMPFN_MEMSNAP_INFORMATION = *mut MMPFN_MEMSNAP_INFORMATION;
+ENUM!{enum SECTION_INFORMATION_CLASS {
+ SectionBasicInformation = 0,
+ SectionImageInformation = 1,
+ SectionRelocationInformation = 2,
+ SectionOriginalBaseInformation = 3,
+ SectionInternalImageInformation = 4,
+ MaxSectionInfoClass = 5,
+}}
+STRUCT!{struct SECTION_BASIC_INFORMATION {
+ BaseAddress: PVOID,
+ AllocationAttributes: ULONG,
+ MaximumSize: LARGE_INTEGER,
+}}
+pub type PSECTION_BASIC_INFORMATION = *mut SECTION_BASIC_INFORMATION;
+STRUCT!{struct SECTION_IMAGE_INFORMATION_u1_s {
+ SubSystemMinorVersion: USHORT,
+ SubSystemMajorVersion: USHORT,
+}}
+UNION!{union SECTION_IMAGE_INFORMATION_u1 {
+ s: SECTION_IMAGE_INFORMATION_u1_s,
+ SubSystemVersion: ULONG,
+}}
+STRUCT!{struct SECTION_IMAGE_INFORMATION_u2_s {
+ MajorOperatingSystemVersion: USHORT,
+ MinorOperatingSystemVersion: USHORT,
+}}
+UNION!{union SECTION_IMAGE_INFORMATION_u2 {
+ s: SECTION_IMAGE_INFORMATION_u2_s,
+ OperatingSystemVersion: ULONG,
+}}
+STRUCT!{struct SECTION_IMAGE_INFORMATION {
+ TransferAddress: PVOID,
+ ZeroBits: ULONG,
+ MaximumStackSize: SIZE_T,
+ CommittedStackSize: SIZE_T,
+ SubSystemType: ULONG,
+ u1: SECTION_IMAGE_INFORMATION_u1,
+ u2: SECTION_IMAGE_INFORMATION_u2,
+ ImageCharacteristics: USHORT,
+ DllCharacteristics: USHORT,
+ Machine: USHORT,
+ ImageContainsCode: BOOLEAN,
+ ImageFlags: UCHAR,
+ LoaderFlags: ULONG,
+ ImageFileSize: ULONG,
+ CheckSum: ULONG,
+}}
+BITFIELD!{SECTION_IMAGE_INFORMATION ImageFlags: UCHAR [
+ ComPlusNativeReady set_ComPlusNativeReady[0..1],
+ ComPlusILOnly set_ComPlusILOnly[1..2],
+ ImageDynamicallyRelocated set_ImageDynamicallyRelocated[2..3],
+ ImageMappedFlat set_ImageMappedFlat[3..4],
+ BaseBelow4gb set_BaseBelow4gb[4..5],
+ ComPlusPrefer32bit set_ComPlusPrefer32bit[5..6],
+ Reserved set_Reserved[6..8],
+]}
+pub type PSECTION_IMAGE_INFORMATION = *mut SECTION_IMAGE_INFORMATION;
+STRUCT!{struct SECTION_INTERNAL_IMAGE_INFORMATION {
+ SectionInformation: SECTION_IMAGE_INFORMATION,
+ ExtendedFlags: ULONG,
+}}
+BITFIELD!{SECTION_INTERNAL_IMAGE_INFORMATION ExtendedFlags: ULONG [
+ ImageExportSuppressionEnabled set_ImageExportSuppressionEnabled[0..1],
+ Reserved set_Reserved[1..32],
+]}
+pub type PSECTION_INTERNAL_IMAGE_INFORMATION = *mut SECTION_INTERNAL_IMAGE_INFORMATION;
+ENUM!{enum SECTION_INHERIT {
+ ViewShare = 1,
+ ViewUnmap = 2,
+}}
+pub const SEC_BASED: u32 = 0x200000;
+pub const SEC_NO_CHANGE: u32 = 0x400000;
+pub const SEC_GLOBAL: u32 = 0x20000000;
+pub const MEM_EXECUTE_OPTION_DISABLE: u32 = 0x1;
+pub const MEM_EXECUTE_OPTION_ENABLE: u32 = 0x2;
+pub const MEM_EXECUTE_OPTION_DISABLE_THUNK_EMULATION: u32 = 0x4;
+pub const MEM_EXECUTE_OPTION_PERMANENT: u32 = 0x8;
+pub const MEM_EXECUTE_OPTION_EXECUTE_DISPATCH_ENABLE: u32 = 0x10;
+pub const MEM_EXECUTE_OPTION_IMAGE_DISPATCH_ENABLE: u32 = 0x20;
+pub const MEM_EXECUTE_OPTION_VALID_FLAGS: u32 = 0x3f;
+EXTERN!{extern "system" {
+ fn NtAllocateVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: *mut PVOID,
+ ZeroBits: ULONG_PTR,
+ RegionSize: PSIZE_T,
+ AllocationType: ULONG,
+ Protect: ULONG,
+ ) -> NTSTATUS;
+ fn NtFreeVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: *mut PVOID,
+ RegionSize: PSIZE_T,
+ FreeType: ULONG,
+ ) -> NTSTATUS;
+ fn NtReadVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: PVOID,
+ Buffer: PVOID,
+ BufferSize: SIZE_T,
+ NumberOfBytesRead: PSIZE_T,
+ ) -> NTSTATUS;
+ fn NtWriteVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: PVOID,
+ Buffer: PVOID,
+ BufferSize: SIZE_T,
+ NumberOfBytesWritten: PSIZE_T,
+ ) -> NTSTATUS;
+ fn NtProtectVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: *mut PVOID,
+ RegionSize: PSIZE_T,
+ NewProtect: ULONG,
+ OldProtect: PULONG,
+ ) -> NTSTATUS;
+ fn NtQueryVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: PVOID,
+ MemoryInformationClass: MEMORY_INFORMATION_CLASS,
+ MemoryInformation: PVOID,
+ MemoryInformationLength: SIZE_T,
+ ReturnLength: PSIZE_T,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum VIRTUAL_MEMORY_INFORMATION_CLASS {
+ VmPrefetchInformation = 0,
+ VmPagePriorityInformation = 1,
+ VmCfgCallTargetInformation = 2,
+ VmPageDirtyStateInformation = 3,
+}}
+STRUCT!{struct MEMORY_RANGE_ENTRY {
+ VirtualAddress: PVOID,
+ NumberOfBytes: SIZE_T,
+}}
+pub type PMEMORY_RANGE_ENTRY = *mut MEMORY_RANGE_ENTRY;
+STRUCT!{struct CFG_CALL_TARGET_LIST_INFORMATION {
+ NumberOfEntries: ULONG,
+ Reserved: ULONG,
+ NumberOfEntriesProcessed: PULONG,
+ CallTargetInfo: PCFG_CALL_TARGET_INFO,
+ Section: PVOID,
+ FileOffset: ULONGLONG,
+}}
+pub type PCFG_CALL_TARGET_LIST_INFORMATION = *mut CFG_CALL_TARGET_LIST_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtSetInformationVirtualMemory(
+ ProcessHandle: HANDLE,
+ VmInformationClass: VIRTUAL_MEMORY_INFORMATION_CLASS,
+ NumberOfEntries: ULONG_PTR,
+ VirtualAddresses: PMEMORY_RANGE_ENTRY,
+ VmInformation: PVOID,
+ VmInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtLockVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: *mut PVOID,
+ RegionSize: PSIZE_T,
+ MapType: ULONG,
+ ) -> NTSTATUS;
+ fn NtUnlockVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: *mut PVOID,
+ RegionSize: PSIZE_T,
+ MapType: ULONG,
+ ) -> NTSTATUS;
+ fn NtCreateSection(
+ SectionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ MaximumSize: PLARGE_INTEGER,
+ SectionPageProtection: ULONG,
+ AllocationAttributes: ULONG,
+ FileHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtCreateSectionEx(
+ SectionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ MaximumSize: PLARGE_INTEGER,
+ SectionPageProtection: ULONG,
+ AllocationAttributes: ULONG,
+ FileHandle: HANDLE,
+ ExtendedParameters: PMEM_EXTENDED_PARAMETER,
+ ExtendedParameterCount: ULONG,
+ ) -> NTSTATUS;
+ fn NtOpenSection(
+ SectionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtMapViewOfSection(
+ SectionHandle: HANDLE,
+ ProcessHandle: HANDLE,
+ BaseAddress: *mut PVOID,
+ ZeroBits: ULONG_PTR,
+ CommitSize: SIZE_T,
+ SectionOffset: PLARGE_INTEGER,
+ ViewSize: PSIZE_T,
+ InheritDisposition: SECTION_INHERIT,
+ AllocationType: ULONG,
+ Win32Protect: ULONG,
+ ) -> NTSTATUS;
+ fn NtUnmapViewOfSection(
+ ProcessHandle: HANDLE,
+ BaseAddress: PVOID,
+ ) -> NTSTATUS;
+ fn NtUnmapViewOfSectionEx(
+ ProcessHandle: HANDLE,
+ BaseAddress: PVOID,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn NtExtendSection(
+ SectionHandle: HANDLE,
+ NewSectionSize: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtQuerySection(
+ SectionHandle: HANDLE,
+ SectionInformationClass: SECTION_INFORMATION_CLASS,
+ SectionInformation: PVOID,
+ SectionInformationLength: SIZE_T,
+ ReturnLength: PSIZE_T,
+ ) -> NTSTATUS;
+ fn NtAreMappedFilesTheSame(
+ File1MappedAsAnImage: PVOID,
+ File2MappedAsFile: PVOID,
+ ) -> NTSTATUS;
+}}
+pub const MEMORY_PARTITION_QUERY_ACCESS: u32 = 0x0001;
+pub const MEMORY_PARTITION_MODIFY_ACCESS: u32 = 0x0002;
+pub const MEMORY_PARTITION_ALL_ACCESS: u32 = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE
+ | MEMORY_PARTITION_QUERY_ACCESS | MEMORY_PARTITION_MODIFY_ACCESS;
+ENUM!{enum MEMORY_PARTITION_INFORMATION_CLASS {
+ SystemMemoryPartitionInformation = 0,
+ SystemMemoryPartitionMoveMemory = 1,
+ SystemMemoryPartitionAddPagefile = 2,
+ SystemMemoryPartitionCombineMemory = 3,
+ SystemMemoryPartitionInitialAddMemory = 4,
+ SystemMemoryPartitionGetMemoryEvents = 5,
+ SystemMemoryPartitionMax = 6,
+}}
+STRUCT!{struct MEMORY_PARTITION_CONFIGURATION_INFORMATION {
+ Flags: ULONG,
+ NumaNode: ULONG,
+ Channel: ULONG,
+ NumberOfNumaNodes: ULONG,
+ ResidentAvailablePages: ULONG_PTR,
+ CommittedPages: ULONG_PTR,
+ CommitLimit: ULONG_PTR,
+ PeakCommitment: ULONG_PTR,
+ TotalNumberOfPages: ULONG_PTR,
+ AvailablePages: ULONG_PTR,
+ ZeroPages: ULONG_PTR,
+ FreePages: ULONG_PTR,
+ StandbyPages: ULONG_PTR,
+ StandbyPageCountByPriority: [ULONG_PTR; 8],
+ RepurposedPagesByPriority: [ULONG_PTR; 8],
+ MaximumCommitLimit: ULONG_PTR,
+ DonatedPagesToPartitions: ULONG_PTR,
+ PartitionId: ULONG,
+}}
+pub type PMEMORY_PARTITION_CONFIGURATION_INFORMATION =
+ *mut MEMORY_PARTITION_CONFIGURATION_INFORMATION;
+STRUCT!{struct MEMORY_PARTITION_TRANSFER_INFORMATION {
+ NumberOfPages: ULONG_PTR,
+ NumaNode: ULONG,
+ Flags: ULONG,
+}}
+pub type PMEMORY_PARTITION_TRANSFER_INFORMATION = *mut MEMORY_PARTITION_TRANSFER_INFORMATION;
+STRUCT!{struct MEMORY_PARTITION_PAGEFILE_INFORMATION {
+ PageFileName: UNICODE_STRING,
+ MinimumSize: LARGE_INTEGER,
+ MaximumSize: LARGE_INTEGER,
+ Flags: ULONG,
+}}
+pub type PMEMORY_PARTITION_PAGEFILE_INFORMATION = *mut MEMORY_PARTITION_PAGEFILE_INFORMATION;
+STRUCT!{struct MEMORY_PARTITION_PAGE_COMBINE_INFORMATION {
+ StopHandle: HANDLE,
+ Flags: ULONG,
+ TotalNumberOfPages: ULONG_PTR,
+}}
+pub type PMEMORY_PARTITION_PAGE_COMBINE_INFORMATION =
+ *mut MEMORY_PARTITION_PAGE_COMBINE_INFORMATION;
+STRUCT!{struct MEMORY_PARTITION_PAGE_RANGE {
+ StartPage: ULONG_PTR,
+ NumberOfPages: ULONG_PTR,
+}}
+pub type PMEMORY_PARTITION_PAGE_RANGE = *mut MEMORY_PARTITION_PAGE_RANGE;
+STRUCT!{struct MEMORY_PARTITION_INITIAL_ADD_INFORMATION {
+ Flags: ULONG,
+ NumberOfRanges: ULONG,
+ NumberOfPagesAdded: ULONG_PTR,
+ PartitionRanges: [MEMORY_PARTITION_PAGE_RANGE; 1],
+}}
+pub type PMEMORY_PARTITION_INITIAL_ADD_INFORMATION = *mut MEMORY_PARTITION_INITIAL_ADD_INFORMATION;
+STRUCT!{struct MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION {
+ Flags: ULONG,
+ HandleAttributes: ULONG,
+ DesiredAccess: ULONG,
+ LowCommitCondition: HANDLE,
+ HighCommitCondition: HANDLE,
+ MaximumCommitCondition: HANDLE,
+}}
+BITFIELD!{MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION Flags: ULONG [
+ CommitEvents set_CommitEvents[0..1],
+ Spare set_Spare[1..32],
+]}
+pub type PMEMORY_PARTITION_MEMORY_EVENTS_INFORMATION =
+ *mut MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtCreatePartition(
+ PartitionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ PreferredNode: ULONG,
+ ) -> NTSTATUS;
+ fn NtOpenPartition(
+ PartitionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtManagePartition(
+ PartitionInformationClass: MEMORY_PARTITION_INFORMATION_CLASS,
+ PartitionInformation: PVOID,
+ PartitionInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtMapUserPhysicalPages(
+ VirtualAddress: PVOID,
+ NumberOfPages: ULONG_PTR,
+ UserPfnArray: PULONG_PTR,
+ ) -> NTSTATUS;
+ fn NtMapUserPhysicalPagesScatter(
+ VirtualAddresses: *mut PVOID,
+ NumberOfPages: ULONG_PTR,
+ UserPfnArray: PULONG_PTR,
+ ) -> NTSTATUS;
+ fn NtAllocateUserPhysicalPages(
+ ProcessHandle: HANDLE,
+ NumberOfPages: PULONG_PTR,
+ UserPfnArray: PULONG_PTR,
+ ) -> NTSTATUS;
+ fn NtFreeUserPhysicalPages(
+ ProcessHandle: HANDLE,
+ NumberOfPages: PULONG_PTR,
+ UserPfnArray: PULONG_PTR,
+ ) -> NTSTATUS;
+ fn NtOpenSession(
+ SessionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtGetWriteWatch(
+ ProcessHandle: HANDLE,
+ Flags: ULONG,
+ BaseAddress: PVOID,
+ RegionSize: SIZE_T,
+ UserAddressArray: *mut PVOID,
+ EntriesInUserAddressArray: PULONG_PTR,
+ Granularity: PULONG,
+ ) -> NTSTATUS;
+ fn NtResetWriteWatch(
+ ProcessHandle: HANDLE,
+ BaseAddress: PVOID,
+ RegionSize: SIZE_T,
+ ) -> NTSTATUS;
+ fn NtCreatePagingFile(
+ PageFileName: PUNICODE_STRING,
+ MinimumSize: PLARGE_INTEGER,
+ MaximumSize: PLARGE_INTEGER,
+ Priority: ULONG,
+ ) -> NTSTATUS;
+ fn NtFlushInstructionCache(
+ ProcessHandle: HANDLE,
+ BaseAddress: PVOID,
+ Length: SIZE_T,
+ ) -> NTSTATUS;
+ fn NtFlushWriteBuffer() -> NTSTATUS;
+}}
diff --git a/third_party/rust/ntapi/src/ntnls.rs b/third_party/rust/ntapi/src/ntnls.rs
new file mode 100644
index 0000000000..592a1988fe
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntnls.rs
@@ -0,0 +1,29 @@
+use winapi::shared::ntdef::{BOOLEAN, PUSHORT, PVOID, UCHAR, USHORT};
+pub const MAXIMUM_LEADBYTES: usize = 12;
+STRUCT!{struct CPTABLEINFO {
+ CodePage: USHORT,
+ MaximumCharacterSize: USHORT,
+ DefaultChar: USHORT,
+ UniDefaultChar: USHORT,
+ TransDefaultChar: USHORT,
+ TransUniDefaultChar: USHORT,
+ DBCSCodePage: USHORT,
+ LeadByte: [UCHAR; MAXIMUM_LEADBYTES],
+ MultiByteTable: PUSHORT,
+ WideCharTable: PVOID,
+ DBCSRanges: PUSHORT,
+ DBCSOffsets: PUSHORT,
+}}
+pub type PCPTABLEINFO = *mut CPTABLEINFO;
+STRUCT!{struct NLSTABLEINFO {
+ OemTableInfo: CPTABLEINFO,
+ AnsiTableInfo: CPTABLEINFO,
+ UpperCaseTable: PUSHORT,
+ LowerCaseTable: PUSHORT,
+}}
+pub type PNLSTABLEINFO = *mut NLSTABLEINFO;
+EXTERN!{extern "C" {
+ static mut NlsAnsiCodePage: USHORT;
+ static mut NlsMbCodePageTag: BOOLEAN;
+ static mut NlsMbOemCodePageTag: BOOLEAN;
+}}
diff --git a/third_party/rust/ntapi/src/ntobapi.rs b/third_party/rust/ntapi/src/ntobapi.rs
new file mode 100644
index 0000000000..388ec61997
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntobapi.rs
@@ -0,0 +1,226 @@
+use winapi::shared::ntdef::{
+ BOOLEAN, CHAR, HANDLE, LARGE_INTEGER, LONG, NTSTATUS, PHANDLE, PLARGE_INTEGER,
+ POBJECT_ATTRIBUTES, PULONG, PUNICODE_STRING, PVOID, UCHAR, ULONG, UNICODE_STRING, WAIT_TYPE,
+};
+use winapi::um::winnt::{
+ ACCESS_MASK, GENERIC_MAPPING, PSECURITY_DESCRIPTOR, SECURITY_INFORMATION,
+ STANDARD_RIGHTS_REQUIRED,
+};
+pub const OBJECT_TYPE_CREATE: u32 = 0x0001;
+pub const OBJECT_TYPE_ALL_ACCESS: ACCESS_MASK = STANDARD_RIGHTS_REQUIRED | 0x1;
+pub const DIRECTORY_QUERY: u32 = 0x0001;
+pub const DIRECTORY_TRAVERSE: u32 = 0x0002;
+pub const DIRECTORY_CREATE_OBJECT: u32 = 0x0004;
+pub const DIRECTORY_CREATE_SUBDIRECTORY: u32 = 0x0008;
+pub const DIRECTORY_ALL_ACCESS: ACCESS_MASK = STANDARD_RIGHTS_REQUIRED | 0xf;
+pub const SYMBOLIC_LINK_QUERY: u32 = 0x0001;
+pub const SYMBOLIC_LINK_ALL_ACCESS: ACCESS_MASK = STANDARD_RIGHTS_REQUIRED | 0x1;
+pub const OBJ_PROTECT_CLOSE: u32 = 0x00000001;
+pub const OBJ_INHERIT: u32 = 0x00000002;
+pub const OBJ_AUDIT_OBJECT_CLOSE: u32 = 0x00000004;
+ENUM!{enum OBJECT_INFORMATION_CLASS {
+ ObjectBasicInformation = 0,
+ ObjectNameInformation = 1,
+ ObjectTypeInformation = 2,
+ ObjectTypesInformation = 3,
+ ObjectHandleFlagInformation = 4,
+ ObjectSessionInformation = 5,
+ ObjectSessionObjectInformation = 6,
+ MaxObjectInfoClass = 7,
+}}
+STRUCT!{struct OBJECT_BASIC_INFORMATION {
+ Attributes: ULONG,
+ GrantedAccess: ACCESS_MASK,
+ HandleCount: ULONG,
+ PointerCount: ULONG,
+ PagedPoolCharge: ULONG,
+ NonPagedPoolCharge: ULONG,
+ Reserved: [ULONG; 3],
+ NameInfoSize: ULONG,
+ TypeInfoSize: ULONG,
+ SecurityDescriptorSize: ULONG,
+ CreationTime: LARGE_INTEGER,
+}}
+pub type POBJECT_BASIC_INFORMATION = *mut OBJECT_BASIC_INFORMATION;
+STRUCT!{struct OBJECT_NAME_INFORMATION {
+ Name: UNICODE_STRING,
+}}
+pub type POBJECT_NAME_INFORMATION = *mut OBJECT_NAME_INFORMATION;
+STRUCT!{struct OBJECT_TYPE_INFORMATION {
+ TypeName: UNICODE_STRING,
+ TotalNumberOfObjects: ULONG,
+ TotalNumberOfHandles: ULONG,
+ TotalPagedPoolUsage: ULONG,
+ TotalNonPagedPoolUsage: ULONG,
+ TotalNamePoolUsage: ULONG,
+ TotalHandleTableUsage: ULONG,
+ HighWaterNumberOfObjects: ULONG,
+ HighWaterNumberOfHandles: ULONG,
+ HighWaterPagedPoolUsage: ULONG,
+ HighWaterNonPagedPoolUsage: ULONG,
+ HighWaterNamePoolUsage: ULONG,
+ HighWaterHandleTableUsage: ULONG,
+ InvalidAttributes: ULONG,
+ GenericMapping: GENERIC_MAPPING,
+ ValidAccessMask: ULONG,
+ SecurityRequired: BOOLEAN,
+ MaintainHandleCount: BOOLEAN,
+ TypeIndex: UCHAR,
+ ReservedByte: CHAR,
+ PoolType: ULONG,
+ DefaultPagedPoolCharge: ULONG,
+ DefaultNonPagedPoolCharge: ULONG,
+}}
+pub type POBJECT_TYPE_INFORMATION = *mut OBJECT_TYPE_INFORMATION;
+STRUCT!{struct OBJECT_TYPES_INFORMATION {
+ NumberOfTypes: ULONG,
+}}
+pub type POBJECT_TYPES_INFORMATION = *mut OBJECT_TYPES_INFORMATION;
+STRUCT!{struct OBJECT_HANDLE_FLAG_INFORMATION {
+ Inherit: BOOLEAN,
+ ProtectFromClose: BOOLEAN,
+}}
+pub type POBJECT_HANDLE_FLAG_INFORMATION = *mut OBJECT_HANDLE_FLAG_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtQueryObject(
+ Handle: HANDLE,
+ ObjectInformationClass: OBJECT_INFORMATION_CLASS,
+ ObjectInformation: PVOID,
+ ObjectInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetInformationObject(
+ Handle: HANDLE,
+ ObjectInformationClass: OBJECT_INFORMATION_CLASS,
+ ObjectInformation: PVOID,
+ ObjectInformationLength: ULONG,
+ ) -> NTSTATUS;
+}}
+pub const DUPLICATE_CLOSE_SOURCE: u32 = 0x00000001;
+pub const DUPLICATE_SAME_ACCESS: u32 = 0x00000002;
+pub const DUPLICATE_SAME_ATTRIBUTES: u32 = 0x00000004;
+EXTERN!{extern "system" {
+ fn NtDuplicateObject(
+ SourceProcessHandle: HANDLE,
+ SourceHandle: HANDLE,
+ TargetProcessHandle: HANDLE,
+ TargetHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ HandleAttributes: ULONG,
+ Options: ULONG,
+ ) -> NTSTATUS;
+ fn NtMakeTemporaryObject(
+ Handle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtMakePermanentObject(
+ Handle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtSignalAndWaitForSingleObject(
+ SignalHandle: HANDLE,
+ WaitHandle: HANDLE,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtWaitForSingleObject(
+ Handle: HANDLE,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtWaitForMultipleObjects(
+ Count: ULONG,
+ Handles: *mut HANDLE,
+ WaitType: WAIT_TYPE,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtWaitForMultipleObjects32(
+ Count: ULONG,
+ Handles: *mut LONG,
+ WaitType: WAIT_TYPE,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtSetSecurityObject(
+ Handle: HANDLE,
+ SecurityInformation: SECURITY_INFORMATION,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ) -> NTSTATUS;
+ fn NtQuerySecurityObject(
+ Handle: HANDLE,
+ SecurityInformation: SECURITY_INFORMATION,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ Length: ULONG,
+ LengthNeeded: PULONG,
+ ) -> NTSTATUS;
+ fn NtClose(
+ Handle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtCompareObjects(
+ FirstObjectHandle: HANDLE,
+ SecondObjectHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtCreateDirectoryObject(
+ DirectoryHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtCreateDirectoryObjectEx(
+ DirectoryHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ShadowDirectoryHandle: HANDLE,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn NtOpenDirectoryObject(
+ DirectoryHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct OBJECT_DIRECTORY_INFORMATION {
+ Name: UNICODE_STRING,
+ TypeName: UNICODE_STRING,
+}}
+pub type POBJECT_DIRECTORY_INFORMATION = *mut OBJECT_DIRECTORY_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtQueryDirectoryObject(
+ DirectoryHandle: HANDLE,
+ Buffer: PVOID,
+ Length: ULONG,
+ ReturnSingleEntry: BOOLEAN,
+ RestartScan: BOOLEAN,
+ Context: PULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtCreatePrivateNamespace(
+ NamespaceHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ BoundaryDescriptor: PVOID,
+ ) -> NTSTATUS;
+ fn NtOpenPrivateNamespace(
+ NamespaceHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ BoundaryDescriptor: PVOID,
+ ) -> NTSTATUS;
+ fn NtDeletePrivateNamespace(
+ NamespaceHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtCreateSymbolicLinkObject(
+ LinkHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ LinkTarget: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn NtOpenSymbolicLinkObject(
+ LinkHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtQuerySymbolicLinkObject(
+ LinkHandle: HANDLE,
+ LinkTarget: PUNICODE_STRING,
+ ReturnedLength: PULONG,
+ ) -> NTSTATUS;
+}}
diff --git a/third_party/rust/ntapi/src/ntpebteb.rs b/third_party/rust/ntapi/src/ntpebteb.rs
new file mode 100644
index 0000000000..b517058632
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntpebteb.rs
@@ -0,0 +1,431 @@
+use core::mem::size_of;
+use crate::ntapi_base::CLIENT_ID;
+use crate::ntpsapi::{GDI_HANDLE_BUFFER, PPEB_LDR_DATA};
+use crate::ntrtl::PRTL_USER_PROCESS_PARAMETERS;
+use winapi::shared::basetsd::{SIZE_T, ULONG_PTR};
+use winapi::shared::guiddef::GUID;
+use winapi::shared::ntdef::{
+ BOOLEAN, CHAR, HANDLE, LCID, LIST_ENTRY, LONG, NTSTATUS, PROCESSOR_NUMBER, PSTR, PVOID, UCHAR,
+ ULARGE_INTEGER, ULONG, ULONGLONG, UNICODE_STRING, USHORT, WCHAR,
+};
+use winapi::um::winnt::{
+ ACTIVATION_CONTEXT, FLS_MAXIMUM_AVAILABLE, NT_TIB, PRTL_CRITICAL_SECTION, PSLIST_HEADER,
+};
+STRUCT!{struct RTL_ACTIVATION_CONTEXT_STACK_FRAME {
+ Previous: PRTL_ACTIVATION_CONTEXT_STACK_FRAME,
+ ActivationContext: *mut ACTIVATION_CONTEXT,
+ Flags: ULONG,
+}}
+pub type PRTL_ACTIVATION_CONTEXT_STACK_FRAME = *mut RTL_ACTIVATION_CONTEXT_STACK_FRAME;
+STRUCT!{struct ACTIVATION_CONTEXT_STACK {
+ ActiveFrame: *mut RTL_ACTIVATION_CONTEXT_STACK_FRAME,
+ FrameListCache: LIST_ENTRY,
+ Flags: ULONG,
+ NextCookieSequenceNumber: ULONG,
+ StackId: ULONG,
+}}
+pub type PACTIVATION_CONTEXT_STACK = *mut ACTIVATION_CONTEXT_STACK;
+STRUCT!{struct API_SET_NAMESPACE {
+ Version: ULONG,
+ Size: ULONG,
+ Flags: ULONG,
+ Count: ULONG,
+ EntryOffset: ULONG,
+ HashOffset: ULONG,
+ HashFactor: ULONG,
+}}
+pub type PAPI_SET_NAMESPACE = *mut API_SET_NAMESPACE;
+STRUCT!{struct API_SET_HASH_ENTRY {
+ Hash: ULONG,
+ Index: ULONG,
+}}
+pub type PAPI_SET_HASH_ENTRY = *mut API_SET_HASH_ENTRY;
+STRUCT!{struct API_SET_NAMESPACE_ENTRY {
+ Flags: ULONG,
+ NameOffset: ULONG,
+ NameLength: ULONG,
+ HashedLength: ULONG,
+ ValueOffset: ULONG,
+ ValueCount: ULONG,
+}}
+pub type PAPI_SET_NAMESPACE_ENTRY = *mut API_SET_NAMESPACE_ENTRY;
+STRUCT!{struct API_SET_VALUE_ENTRY {
+ Flags: ULONG,
+ NameOffset: ULONG,
+ NameLength: ULONG,
+ ValueOffset: ULONG,
+ ValueLength: ULONG,
+}}
+pub type PAPI_SET_VALUE_ENTRY = *mut API_SET_VALUE_ENTRY;
+UNION!{union PEB_u {
+ KernelCallbackTable: PVOID,
+ UserSharedInfoPtr: PVOID,
+}}
+#[repr(C)]
+pub struct LEAP_SECOND_DATA([u8; 0]); //fixme
+STRUCT!{struct PEB {
+ InheritedAddressSpace: BOOLEAN,
+ ReadImageFileExecOptions: BOOLEAN,
+ BeingDebugged: BOOLEAN,
+ BitField: BOOLEAN,
+ Mutant: HANDLE,
+ ImageBaseAddress: PVOID,
+ Ldr: PPEB_LDR_DATA,
+ ProcessParameters: PRTL_USER_PROCESS_PARAMETERS,
+ SubSystemData: PVOID,
+ ProcessHeap: PVOID,
+ FastPebLock: PRTL_CRITICAL_SECTION,
+ IFEOKey: PVOID,
+ AtlThunkSListPtr: PSLIST_HEADER,
+ CrossProcessFlags: ULONG,
+ u: PEB_u,
+ SystemReserved: [ULONG; 1],
+ AtlThunkSListPtr32: ULONG,
+ ApiSetMap: PAPI_SET_NAMESPACE,
+ TlsExpansionCounter: ULONG,
+ TlsBitmap: PVOID,
+ TlsBitmapBits: [ULONG; 2],
+ ReadOnlySharedMemoryBase: PVOID,
+ SharedData: PVOID,
+ ReadOnlyStaticServerData: *mut PVOID,
+ AnsiCodePageData: PVOID,
+ OemCodePageData: PVOID,
+ UnicodeCaseTableData: PVOID,
+ NumberOfProcessors: ULONG,
+ NtGlobalFlag: ULONG,
+ CriticalSectionTimeout: ULARGE_INTEGER,
+ HeapSegmentReserve: SIZE_T,
+ HeapSegmentCommit: SIZE_T,
+ HeapDeCommitTotalFreeThreshold: SIZE_T,
+ HeapDeCommitFreeBlockThreshold: SIZE_T,
+ NumberOfHeaps: ULONG,
+ MaximumNumberOfHeaps: ULONG,
+ ProcessHeaps: *mut PVOID,
+ GdiSharedHandleTable: PVOID,
+ ProcessStarterHelper: PVOID,
+ GdiDCAttributeList: ULONG,
+ LoaderLock: PRTL_CRITICAL_SECTION,
+ OSMajorVersion: ULONG,
+ OSMinorVersion: ULONG,
+ OSBuildNumber: USHORT,
+ OSCSDVersion: USHORT,
+ OSPlatformId: ULONG,
+ ImageSubsystem: ULONG,
+ ImageSubsystemMajorVersion: ULONG,
+ ImageSubsystemMinorVersion: ULONG,
+ ActiveProcessAffinityMask: ULONG_PTR,
+ GdiHandleBuffer: GDI_HANDLE_BUFFER,
+ PostProcessInitRoutine: PVOID,
+ TlsExpansionBitmap: PVOID,
+ TlsExpansionBitmapBits: [ULONG; 32],
+ SessionId: ULONG,
+ AppCompatFlags: ULARGE_INTEGER,
+ AppCompatFlagsUser: ULARGE_INTEGER,
+ pShimData: PVOID,
+ AppCompatInfo: PVOID,
+ CSDVersion: UNICODE_STRING,
+ ActivationContextData: PVOID,
+ ProcessAssemblyStorageMap: PVOID,
+ SystemDefaultActivationContextData: PVOID,
+ SystemAssemblyStorageMap: PVOID,
+ MinimumStackCommit: SIZE_T,
+ FlsCallback: *mut PVOID,
+ FlsListHead: LIST_ENTRY,
+ FlsBitmap: PVOID,
+ FlsBitmapBits: [ULONG; FLS_MAXIMUM_AVAILABLE as usize / (size_of::<ULONG>() * 8)],
+ FlsHighIndex: ULONG,
+ WerRegistrationData: PVOID,
+ WerShipAssertPtr: PVOID,
+ pUnused: PVOID,
+ pImageHeaderHash: PVOID,
+ TracingFlags: ULONG,
+ CsrServerReadOnlySharedMemoryBase: ULONGLONG,
+ TppWorkerpListLock: PRTL_CRITICAL_SECTION,
+ TppWorkerpList: LIST_ENTRY,
+ WaitOnAddressHashTable: [PVOID; 128],
+ TelemetryCoverageHeader: PVOID,
+ CloudFileFlags: ULONG,
+ CloudFileDiagFlags: ULONG,
+ PlaceholderCompatibilityMode: CHAR,
+ PlaceholderCompatibilityModeReserved: [CHAR; 7],
+ LeapSecondData: *mut LEAP_SECOND_DATA,
+ LeapSecondFlags: ULONG,
+ NtGlobalFlag2: ULONG,
+}}
+BITFIELD!{PEB BitField: BOOLEAN [
+ ImageUsesLargePages set_ImageUsesLargePages[0..1],
+ IsProtectedProcess set_IsProtectedProcess[1..2],
+ IsImageDynamicallyRelocated set_IsImageDynamicallyRelocated[2..3],
+ SkipPatchingUser32Forwarders set_SkipPatchingUser32Forwarders[3..4],
+ IsPackagedProcess set_IsPackagedProcess[4..5],
+ IsAppContainer set_IsAppContainer[5..6],
+ IsProtectedProcessLight set_IsProtectedProcessLight[6..7],
+ IsLongPathAwareProcess set_IsLongPathAwareProcess[7..8],
+]}
+BITFIELD!{PEB CrossProcessFlags: ULONG [
+ ProcessInJob set_ProcessInJob[0..1],
+ ProcessInitializing set_ProcessInitializing[1..2],
+ ProcessUsingVEH set_ProcessUsingVEH[2..3],
+ ProcessUsingVCH set_ProcessUsingVCH[3..4],
+ ProcessUsingFTH set_ProcessUsingFTH[4..5],
+ ProcessPreviouslyThrottled set_ProcessPreviouslyThrottled[5..6],
+ ProcessCurrentlyThrottled set_ProcessCurrentlyThrottled[6..7],
+ ProcessImagesHotPatched set_ProcessImagesHotPatched[7..8],
+ ReservedBits0 set_ReservedBits0[8..32],
+]}
+BITFIELD!{PEB TracingFlags: ULONG [
+ HeapTracingEnabled set_HeapTracingEnabled[0..1],
+ CritSecTracingEnabled set_CritSecTracingEnabled[1..2],
+ LibLoaderTracingEnabled set_LibLoaderTracingEnabled[2..3],
+ SpareTracingBits set_SpareTracingBits[3..32],
+]}
+BITFIELD!{PEB LeapSecondFlags: ULONG [
+ SixtySecondEnabled set_SixtySecondEnabled[0..1],
+ Reserved set_Reserved[1..32],
+]}
+pub type PPEB = *mut PEB;
+pub const GDI_BATCH_BUFFER_SIZE: usize = 310;
+STRUCT!{struct GDI_TEB_BATCH {
+ Offset: ULONG,
+ HDC: ULONG_PTR,
+ Buffer: [ULONG; GDI_BATCH_BUFFER_SIZE],
+}}
+pub type PGDI_TEB_BATCH = *mut GDI_TEB_BATCH;
+STRUCT!{struct TEB_ACTIVE_FRAME_CONTEXT {
+ Flags: ULONG,
+ FrameName: PSTR,
+}}
+pub type PTEB_ACTIVE_FRAME_CONTEXT = *mut TEB_ACTIVE_FRAME_CONTEXT;
+STRUCT!{struct TEB_ACTIVE_FRAME {
+ Flags: ULONG,
+ Previous: *mut TEB_ACTIVE_FRAME,
+ Context: PTEB_ACTIVE_FRAME_CONTEXT,
+}}
+pub type PTEB_ACTIVE_FRAME = *mut TEB_ACTIVE_FRAME;
+STRUCT!{struct TEB_u_s {
+ ReservedPad0: UCHAR,
+ ReservedPad1: UCHAR,
+ ReservedPad2: UCHAR,
+ IdealProcessor: UCHAR,
+}}
+UNION!{union TEB_u {
+ CurrentIdealProcessor: PROCESSOR_NUMBER,
+ IdealProcessorValue: ULONG,
+ s: TEB_u_s,
+}}
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+STRUCT!{struct TEB {
+ NtTib: NT_TIB,
+ EnvironmentPointer: PVOID,
+ ClientId: CLIENT_ID,
+ ActiveRpcHandle: PVOID,
+ ThreadLocalStoragePointer: PVOID,
+ ProcessEnvironmentBlock: PPEB,
+ LastErrorValue: ULONG,
+ CountOfOwnedCriticalSections: ULONG,
+ CsrClientThread: PVOID,
+ Win32ThreadInfo: PVOID,
+ User32Reserved: [ULONG; 26],
+ UserReserved: [ULONG; 5],
+ WOW32Reserved: PVOID,
+ CurrentLocale: LCID,
+ FpSoftwareStatusRegister: ULONG,
+ ReservedForDebuggerInstrumentation: [PVOID; 16],
+ SystemReserved1: [PVOID; 30],
+ PlaceholderCompatibilityMode: CHAR,
+ PlaceholderReserved: [CHAR; 11],
+ ProxiedProcessId: ULONG,
+ ActivationStack: ACTIVATION_CONTEXT_STACK,
+ WorkingOnBehalfTicket: [UCHAR; 8],
+ ExceptionCode: NTSTATUS,
+ ActivationContextStackPointer: PACTIVATION_CONTEXT_STACK,
+ InstrumentationCallbackSp: ULONG_PTR,
+ InstrumentationCallbackPreviousPc: ULONG_PTR,
+ InstrumentationCallbackPreviousSp: ULONG_PTR,
+ TxFsContext: ULONG,
+ InstrumentationCallbackDisabled: BOOLEAN,
+ GdiTebBatch: GDI_TEB_BATCH,
+ RealClientId: CLIENT_ID,
+ GdiCachedProcessHandle: HANDLE,
+ GdiClientPID: ULONG,
+ GdiClientTID: ULONG,
+ GdiThreadLocalInfo: PVOID,
+ Win32ClientInfo: [ULONG_PTR; 62],
+ glDispatchTable: [PVOID; 233],
+ glReserved1: [ULONG_PTR; 29],
+ glReserved2: PVOID,
+ glSectionInfo: PVOID,
+ glSection: PVOID,
+ glTable: PVOID,
+ glCurrentRC: PVOID,
+ glContext: PVOID,
+ LastStatusValue: NTSTATUS,
+ StaticUnicodeString: UNICODE_STRING,
+ StaticUnicodeBuffer: [WCHAR; 261],
+ DeallocationStack: PVOID,
+ TlsSlots: [PVOID; 64],
+ TlsLinks: LIST_ENTRY,
+ Vdm: PVOID,
+ ReservedForNtRpc: PVOID,
+ DbgSsReserved: [PVOID; 2],
+ HardErrorMode: ULONG,
+ Instrumentation: [PVOID; 11],
+ ActivityId: GUID,
+ SubProcessTag: PVOID,
+ PerflibData: PVOID,
+ EtwTraceData: PVOID,
+ WinSockData: PVOID,
+ GdiBatchCount: ULONG,
+ u: TEB_u,
+ GuaranteedStackBytes: ULONG,
+ ReservedForPerf: PVOID,
+ ReservedForOle: PVOID,
+ WaitingOnLoaderLock: ULONG,
+ SavedPriorityState: PVOID,
+ ReservedForCodeCoverage: ULONG_PTR,
+ ThreadPoolData: PVOID,
+ TlsExpansionSlots: *mut PVOID,
+ DeallocationBStore: PVOID,
+ BStoreLimit: PVOID,
+ MuiGeneration: ULONG,
+ IsImpersonating: ULONG,
+ NlsCache: PVOID,
+ pShimData: PVOID,
+ HeapVirtualAffinity: USHORT,
+ LowFragHeapDataSlot: USHORT,
+ CurrentTransactionHandle: HANDLE,
+ ActiveFrame: PTEB_ACTIVE_FRAME,
+ FlsData: PVOID,
+ PreferredLanguages: PVOID,
+ UserPrefLanguages: PVOID,
+ MergedPrefLanguages: PVOID,
+ MuiImpersonation: ULONG,
+ CrossTebFlags: USHORT,
+ SameTebFlags: USHORT,
+ TxnScopeEnterCallback: PVOID,
+ TxnScopeExitCallback: PVOID,
+ TxnScopeContext: PVOID,
+ LockCount: ULONG,
+ WowTebOffset: LONG,
+ ResourceRetValue: PVOID,
+ ReservedForWdf: PVOID,
+ ReservedForCrt: ULONGLONG,
+ EffectiveContainerId: GUID,
+}}
+#[cfg(target_arch = "x86")]
+STRUCT!{struct TEB {
+ NtTib: NT_TIB,
+ EnvironmentPointer: PVOID,
+ ClientId: CLIENT_ID,
+ ActiveRpcHandle: PVOID,
+ ThreadLocalStoragePointer: PVOID,
+ ProcessEnvironmentBlock: PPEB,
+ LastErrorValue: ULONG,
+ CountOfOwnedCriticalSections: ULONG,
+ CsrClientThread: PVOID,
+ Win32ThreadInfo: PVOID,
+ User32Reserved: [ULONG; 26],
+ UserReserved: [ULONG; 5],
+ WOW32Reserved: PVOID,
+ CurrentLocale: LCID,
+ FpSoftwareStatusRegister: ULONG,
+ ReservedForDebuggerInstrumentation: [PVOID; 16],
+ SystemReserved1: [PVOID; 26],
+ PlaceholderCompatibilityMode: CHAR,
+ PlaceholderReserved: [CHAR; 11],
+ ProxiedProcessId: ULONG,
+ ActivationStack: ACTIVATION_CONTEXT_STACK,
+ WorkingOnBehalfTicket: [UCHAR; 8],
+ ExceptionCode: NTSTATUS,
+ ActivationContextStackPointer: PACTIVATION_CONTEXT_STACK,
+ InstrumentationCallbackSp: ULONG_PTR,
+ InstrumentationCallbackPreviousPc: ULONG_PTR,
+ InstrumentationCallbackPreviousSp: ULONG_PTR,
+ InstrumentationCallbackDisabled: BOOLEAN,
+ SpareBytes: [UCHAR; 23],
+ TxFsContext: ULONG,
+ GdiTebBatch: GDI_TEB_BATCH,
+ RealClientId: CLIENT_ID,
+ GdiCachedProcessHandle: HANDLE,
+ GdiClientPID: ULONG,
+ GdiClientTID: ULONG,
+ GdiThreadLocalInfo: PVOID,
+ Win32ClientInfo: [ULONG_PTR; 62],
+ glDispatchTable: [PVOID; 233],
+ glReserved1: [ULONG_PTR; 29],
+ glReserved2: PVOID,
+ glSectionInfo: PVOID,
+ glSection: PVOID,
+ glTable: PVOID,
+ glCurrentRC: PVOID,
+ glContext: PVOID,
+ LastStatusValue: NTSTATUS,
+ StaticUnicodeString: UNICODE_STRING,
+ StaticUnicodeBuffer: [WCHAR; 261],
+ DeallocationStack: PVOID,
+ TlsSlots: [PVOID; 64],
+ TlsLinks: LIST_ENTRY,
+ Vdm: PVOID,
+ ReservedForNtRpc: PVOID,
+ DbgSsReserved: [PVOID; 2],
+ HardErrorMode: ULONG,
+ Instrumentation: [PVOID; 9],
+ ActivityId: GUID,
+ SubProcessTag: PVOID,
+ PerflibData: PVOID,
+ EtwTraceData: PVOID,
+ WinSockData: PVOID,
+ GdiBatchCount: ULONG,
+ u: TEB_u,
+ GuaranteedStackBytes: ULONG,
+ ReservedForPerf: PVOID,
+ ReservedForOle: PVOID,
+ WaitingOnLoaderLock: ULONG,
+ SavedPriorityState: PVOID,
+ ReservedForCodeCoverage: ULONG_PTR,
+ ThreadPoolData: PVOID,
+ TlsExpansionSlots: *mut PVOID,
+ MuiGeneration: ULONG,
+ IsImpersonating: ULONG,
+ NlsCache: PVOID,
+ pShimData: PVOID,
+ HeapVirtualAffinity: USHORT,
+ LowFragHeapDataSlot: USHORT,
+ CurrentTransactionHandle: HANDLE,
+ ActiveFrame: PTEB_ACTIVE_FRAME,
+ FlsData: PVOID,
+ PreferredLanguages: PVOID,
+ UserPrefLanguages: PVOID,
+ MergedPrefLanguages: PVOID,
+ MuiImpersonation: ULONG,
+ CrossTebFlags: USHORT,
+ SameTebFlags: USHORT,
+ TxnScopeEnterCallback: PVOID,
+ TxnScopeExitCallback: PVOID,
+ TxnScopeContext: PVOID,
+ LockCount: ULONG,
+ WowTebOffset: LONG,
+ ResourceRetValue: PVOID,
+ ReservedForWdf: PVOID,
+ ReservedForCrt: ULONGLONG,
+ EffectiveContainerId: GUID,
+}}
+BITFIELD!{TEB SameTebFlags: USHORT [
+ SafeThunkCall set_SafeThunkCall[0..1],
+ InDebugPrint set_InDebugPrint[1..2],
+ HasFiberData set_HasFiberData[2..3],
+ SkipThreadAttach set_SkipThreadAttach[3..4],
+ WerInShipAssertCode set_WerInShipAssertCode[4..5],
+ RanProcessInit set_RanProcessInit[5..6],
+ ClonedThread set_ClonedThread[6..7],
+ SuppressDebugMsg set_SuppressDebugMsg[7..8],
+ DisableUserStackWalk set_DisableUserStackWalk[8..9],
+ RtlExceptionAttached set_RtlExceptionAttached[9..10],
+ InitialThread set_InitialThread[10..11],
+ SessionAware set_SessionAware[11..12],
+ LoadOwner set_LoadOwner[12..13],
+ LoaderWorker set_LoaderWorker[13..14],
+ SkipLoaderInit set_SkipLoaderInit[14..15],
+ SpareSameTebBits set_SpareSameTebBits[15..16],
+]}
+pub type PTEB = *mut TEB;
diff --git a/third_party/rust/ntapi/src/ntpfapi.rs b/third_party/rust/ntapi/src/ntpfapi.rs
new file mode 100644
index 0000000000..d6323611bf
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntpfapi.rs
@@ -0,0 +1,219 @@
+use crate::ntexapi::SYSTEM_MEMORY_LIST_INFORMATION;
+use crate::ntmmapi::MMPFN_IDENTITY;
+use winapi::shared::basetsd::{SIZE_T, ULONG_PTR};
+use winapi::shared::ntdef::{CHAR, LONGLONG, PVOID, ULONG, ULONGLONG, WCHAR};
+ENUM!{enum PF_BOOT_PHASE_ID {
+ PfKernelInitPhase = 0,
+ PfBootDriverInitPhase = 90,
+ PfSystemDriverInitPhase = 120,
+ PfSessionManagerInitPhase = 150,
+ PfSMRegistryInitPhase = 180,
+ PfVideoInitPhase = 210,
+ PfPostVideoInitPhase = 240,
+ PfBootAcceptedRegistryInitPhase = 270,
+ PfUserShellReadyPhase = 300,
+ PfMaxBootPhaseId = 900,
+}}
+ENUM!{enum PF_ENABLE_STATUS {
+ PfSvNotSpecified = 0,
+ PfSvEnabled = 1,
+ PfSvDisabled = 2,
+ PfSvMaxEnableStatus = 3,
+}}
+STRUCT!{struct PF_TRACE_LIMITS {
+ MaxNumPages: ULONG,
+ MaxNumSections: ULONG,
+ TimerPeriod: LONGLONG,
+}}
+pub type PPF_TRACE_LIMITS = *mut PF_TRACE_LIMITS;
+STRUCT!{struct PF_SYSTEM_PREFETCH_PARAMETERS {
+ EnableStatus: [PF_ENABLE_STATUS; 2],
+ TraceLimits: [PF_TRACE_LIMITS; 2],
+ MaxNumActiveTraces: ULONG,
+ MaxNumSavedTraces: ULONG,
+ RootDirPath: [WCHAR; 32],
+ HostingApplicationList: [WCHAR; 128],
+}}
+pub type PPF_SYSTEM_PREFETCH_PARAMETERS = *mut PF_SYSTEM_PREFETCH_PARAMETERS;
+pub const PF_BOOT_CONTROL_VERSION: u32 = 1;
+STRUCT!{struct PF_BOOT_CONTROL {
+ Version: ULONG,
+ DisableBootPrefetching: ULONG,
+}}
+pub type PPF_BOOT_CONTROL = *mut PF_BOOT_CONTROL;
+ENUM!{enum PREFETCHER_INFORMATION_CLASS {
+ PrefetcherRetrieveTrace = 1,
+ PrefetcherSystemParameters = 2,
+ PrefetcherBootPhase = 3,
+ PrefetcherRetrieveBootLoaderTrace = 4,
+ PrefetcherBootControl = 5,
+}}
+pub const PREFETCHER_INFORMATION_VERSION: ULONG = 23;
+pub const PREFETCHER_INFORMATION_MAGIC: ULONG = 0x6b756843;
+STRUCT!{struct PREFETCHER_INFORMATION {
+ Version: ULONG,
+ Magic: ULONG,
+ PrefetcherInformationClass: PREFETCHER_INFORMATION_CLASS,
+ PrefetcherInformation: PVOID,
+ PrefetcherInformationLength: ULONG,
+}}
+pub type PPREFETCHER_INFORMATION = *mut PREFETCHER_INFORMATION;
+STRUCT!{struct PF_SYSTEM_SUPERFETCH_PARAMETERS {
+ EnabledComponents: ULONG,
+ BootID: ULONG,
+ SavedSectInfoTracesMax: ULONG,
+ SavedPageAccessTracesMax: ULONG,
+ ScenarioPrefetchTimeoutStandby: ULONG,
+ ScenarioPrefetchTimeoutHibernate: ULONG,
+}}
+pub type PPF_SYSTEM_SUPERFETCH_PARAMETERS = *mut PF_SYSTEM_SUPERFETCH_PARAMETERS;
+pub const PF_PFN_PRIO_REQUEST_VERSION: u32 = 1;
+pub const PF_PFN_PRIO_REQUEST_QUERY_MEMORY_LIST: u32 = 0x1;
+pub const PF_PFN_PRIO_REQUEST_VALID_FLAGS: u32 = 0x1;
+STRUCT!{struct PF_PFN_PRIO_REQUEST {
+ Version: ULONG,
+ RequestFlags: ULONG,
+ PfnCount: ULONG_PTR,
+ MemInfo: SYSTEM_MEMORY_LIST_INFORMATION,
+ PageData: [MMPFN_IDENTITY; 256],
+}}
+pub type PPF_PFN_PRIO_REQUEST = *mut PF_PFN_PRIO_REQUEST;
+ENUM!{enum PFS_PRIVATE_PAGE_SOURCE_TYPE {
+ PfsPrivateSourceKernel = 0,
+ PfsPrivateSourceSession = 1,
+ PfsPrivateSourceProcess = 2,
+ PfsPrivateSourceMax = 3,
+}}
+UNION!{union PFS_PRIVATE_PAGE_SOURCE_u {
+ SessionId: ULONG,
+ ProcessId: ULONG,
+}}
+STRUCT!{struct PFS_PRIVATE_PAGE_SOURCE {
+ Type: PFS_PRIVATE_PAGE_SOURCE_TYPE,
+ u: PFS_PRIVATE_PAGE_SOURCE_u,
+ ImagePathHash: ULONG,
+ UniqueProcessHash: ULONG_PTR,
+}}
+UNION!{union PF_PRIVSOURCE_INFO_u {
+ WsSwapPages: ULONG_PTR,
+ SessionPagedPoolPages: ULONG_PTR,
+ StoreSizePages: ULONG_PTR,
+}}
+pub type PPFS_PRIVATE_PAGE_SOURCE = *mut PFS_PRIVATE_PAGE_SOURCE;
+STRUCT!{struct PF_PRIVSOURCE_INFO {
+ DbInfo: PFS_PRIVATE_PAGE_SOURCE,
+ EProcess: PVOID,
+ WsPrivatePages: SIZE_T,
+ TotalPrivatePages: SIZE_T,
+ SessionID: ULONG,
+ ImageName: [CHAR; 16],
+ u: PF_PRIVSOURCE_INFO_u,
+ WsTotalPages: ULONG_PTR,
+ DeepFreezeTimeMs: ULONG,
+ BitFields: ULONG,
+}}
+BITFIELD!{PF_PRIVSOURCE_INFO BitFields: ULONG [
+ ModernApp set_ModernApp[0..1],
+ DeepFrozen set_DeepFrozen[1..2],
+ Foreground set_Foreground[2..3],
+ PerProcessStore set_PerProcessStore[3..4],
+ Spare set_Spare[4..32],
+]}
+pub type PPF_PRIVSOURCE_INFO = *mut PF_PRIVSOURCE_INFO;
+pub const PF_PRIVSOURCE_QUERY_REQUEST_VERSION: u32 = 3;
+STRUCT!{struct PF_PRIVSOURCE_QUERY_REQUEST {
+ Version: ULONG,
+ Flags: ULONG,
+ InfoCount: ULONG,
+ InfoArray: [PF_PRIVSOURCE_INFO; 1],
+}}
+pub type PPF_PRIVSOURCE_QUERY_REQUEST = *mut PF_PRIVSOURCE_QUERY_REQUEST;
+ENUM!{enum PF_PHASED_SCENARIO_TYPE {
+ PfScenarioTypeNone = 0,
+ PfScenarioTypeStandby = 1,
+ PfScenarioTypeHibernate = 2,
+ PfScenarioTypeFUS = 3,
+ PfScenarioTypeMax = 4,
+}}
+pub const PF_SCENARIO_PHASE_INFO_VERSION: u32 = 4;
+STRUCT!{struct PF_SCENARIO_PHASE_INFO {
+ Version: ULONG,
+ ScenType: PF_PHASED_SCENARIO_TYPE,
+ PhaseId: ULONG,
+ SequenceNumber: ULONG,
+ Flags: ULONG,
+ FUSUserId: ULONG,
+}}
+pub type PPF_SCENARIO_PHASE_INFO = *mut PF_SCENARIO_PHASE_INFO;
+STRUCT!{struct PF_MEMORY_LIST_NODE {
+ Bitfields: ULONGLONG,
+ StandbyLowPageCount: ULONGLONG,
+ StandbyMediumPageCount: ULONGLONG,
+ StandbyHighPageCount: ULONGLONG,
+ FreePageCount: ULONGLONG,
+ ModifiedPageCount: ULONGLONG,
+}}
+BITFIELD!{PF_MEMORY_LIST_NODE Bitfields: ULONGLONG [
+ Node set_Node[0..8],
+ Spare set_Spare[8..64],
+]}
+pub type PPF_MEMORY_LIST_NODE = *mut PF_MEMORY_LIST_NODE;
+pub const PF_MEMORY_LIST_INFO_VERSION: u32 = 1;
+STRUCT!{struct PF_MEMORY_LIST_INFO {
+ Version: ULONG,
+ Size: ULONG,
+ NodeCount: ULONG,
+ Nodes: [PF_MEMORY_LIST_NODE; 1],
+}}
+pub type PPF_MEMORY_LIST_INFO = *mut PF_MEMORY_LIST_INFO;
+STRUCT!{struct PF_PHYSICAL_MEMORY_RANGE {
+ BasePfn: ULONG_PTR,
+ PageCount: ULONG_PTR,
+}}
+pub type PPF_PHYSICAL_MEMORY_RANGE = *mut PF_PHYSICAL_MEMORY_RANGE;
+pub const PF_PHYSICAL_MEMORY_RANGE_INFO_VERSION: u32 = 1;
+STRUCT!{struct PF_PHYSICAL_MEMORY_RANGE_INFO {
+ Version: ULONG,
+ RangeCount: ULONG,
+ Ranges: [PF_PHYSICAL_MEMORY_RANGE; 1],
+}}
+pub type PPF_PHYSICAL_MEMORY_RANGE_INFO = *mut PF_PHYSICAL_MEMORY_RANGE_INFO;
+pub const PF_REPURPOSED_BY_PREFETCH_INFO_VERSION: u32 = 1;
+STRUCT!{struct PF_REPURPOSED_BY_PREFETCH_INFO {
+ Version: ULONG,
+ RepurposedByPrefetch: ULONG,
+}}
+pub type PPF_REPURPOSED_BY_PREFETCH_INFO = *mut PF_REPURPOSED_BY_PREFETCH_INFO;
+ENUM!{enum SUPERFETCH_INFORMATION_CLASS {
+ SuperfetchRetrieveTrace = 1,
+ SuperfetchSystemParameters = 2,
+ SuperfetchLogEvent = 3,
+ SuperfetchGenerateTrace = 4,
+ SuperfetchPrefetch = 5,
+ SuperfetchPfnQuery = 6,
+ SuperfetchPfnSetPriority = 7,
+ SuperfetchPrivSourceQuery = 8,
+ SuperfetchSequenceNumberQuery = 9,
+ SuperfetchScenarioPhase = 10,
+ SuperfetchWorkerPriority = 11,
+ SuperfetchScenarioQuery = 12,
+ SuperfetchScenarioPrefetch = 13,
+ SuperfetchRobustnessControl = 14,
+ SuperfetchTimeControl = 15,
+ SuperfetchMemoryListQuery = 16,
+ SuperfetchMemoryRangesQuery = 17,
+ SuperfetchTracingControl = 18,
+ SuperfetchTrimWhileAgingControl = 19,
+ SuperfetchRepurposedByPrefetch = 20,
+ SuperfetchInformationMax = 21,
+}}
+pub const SUPERFETCH_INFORMATION_VERSION: ULONG = 45;
+pub const SUPERFETCH_INFORMATION_MAGIC: ULONG = 0x6b756843;
+STRUCT!{struct SUPERFETCH_INFORMATION {
+ Version: ULONG,
+ Magic: ULONG,
+ InfoClass: SUPERFETCH_INFORMATION_CLASS,
+ Data: PVOID,
+ Length: ULONG,
+}}
+pub type PSUPERFETCH_INFORMATION = *mut SUPERFETCH_INFORMATION;
diff --git a/third_party/rust/ntapi/src/ntpnpapi.rs b/third_party/rust/ntapi/src/ntpnpapi.rs
new file mode 100644
index 0000000000..0afc698b2a
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntpnpapi.rs
@@ -0,0 +1,118 @@
+use winapi::shared::cfg::PNP_VETO_TYPE;
+use winapi::shared::guiddef::GUID;
+use winapi::shared::ntdef::{HANDLE, NTSTATUS, PULONG, PUNICODE_STRING, PVOID, ULONG, WCHAR};
+ENUM!{enum PLUGPLAY_EVENT_CATEGORY {
+ HardwareProfileChangeEvent = 0,
+ TargetDeviceChangeEvent = 1,
+ DeviceClassChangeEvent = 2,
+ CustomDeviceEvent = 3,
+ DeviceInstallEvent = 4,
+ DeviceArrivalEvent = 5,
+ PowerEvent = 6,
+ VetoEvent = 7,
+ BlockedDriverEvent = 8,
+ InvalidIDEvent = 9,
+ MaxPlugEventCategory = 10,
+}}
+pub type PPLUGPLAY_EVENT_CATEGORY = *mut PLUGPLAY_EVENT_CATEGORY;
+STRUCT!{struct PLUGPLAY_EVENT_BLOCK_u_DeviceClass {
+ ClassGuid: GUID,
+ SymbolicLinkName: [WCHAR; 1],
+}}
+STRUCT!{struct PLUGPLAY_EVENT_BLOCK_u_TargetDevice {
+ DeviceIds: [WCHAR; 1],
+}}
+STRUCT!{struct PLUGPLAY_EVENT_BLOCK_u_InstallDevice {
+ DeviceId: [WCHAR; 1],
+}}
+STRUCT!{struct PLUGPLAY_EVENT_BLOCK_u_CustomNotification {
+ NotificationStructure: PVOID,
+ DeviceIds: [WCHAR; 1],
+}}
+STRUCT!{struct PLUGPLAY_EVENT_BLOCK_u_ProfileNotification {
+ Notification: PVOID,
+}}
+STRUCT!{struct PLUGPLAY_EVENT_BLOCK_u_PowerNotification {
+ NotificationCode: ULONG,
+ NotificationData: ULONG,
+}}
+STRUCT!{struct PLUGPLAY_EVENT_BLOCK_u_VetoNotification {
+ VetoType: PNP_VETO_TYPE,
+ DeviceIdVetoNameBuffer: [WCHAR; 1],
+}}
+STRUCT!{struct PLUGPLAY_EVENT_BLOCK_u_BlockedDriverNotification {
+ BlockedDriverGuid: GUID,
+}}
+STRUCT!{struct PLUGPLAY_EVENT_BLOCK_u_InvalidIDNotification {
+ ParentId: [WCHAR; 1],
+}}
+UNION!{union PLUGPLAY_EVENT_BLOCK_u {
+ DeviceClass: PLUGPLAY_EVENT_BLOCK_u_DeviceClass,
+ TargetDevice: PLUGPLAY_EVENT_BLOCK_u_TargetDevice,
+ InstallDevice: PLUGPLAY_EVENT_BLOCK_u_InstallDevice,
+ CustomNotification: PLUGPLAY_EVENT_BLOCK_u_CustomNotification,
+ ProfileNotification: PLUGPLAY_EVENT_BLOCK_u_ProfileNotification,
+ PowerNotification: PLUGPLAY_EVENT_BLOCK_u_PowerNotification,
+ VetoNotification: PLUGPLAY_EVENT_BLOCK_u_VetoNotification,
+ BlockedDriverNotification: PLUGPLAY_EVENT_BLOCK_u_BlockedDriverNotification,
+ InvalidIDNotification: PLUGPLAY_EVENT_BLOCK_u_InvalidIDNotification,
+}}
+STRUCT!{struct PLUGPLAY_EVENT_BLOCK {
+ EventGuid: GUID,
+ EventCategory: PLUGPLAY_EVENT_CATEGORY,
+ Result: PULONG,
+ Flags: ULONG,
+ TotalSize: ULONG,
+ DeviceObject: PVOID,
+ u: PLUGPLAY_EVENT_BLOCK_u,
+}}
+pub type PPLUGPLAY_EVENT_BLOCK = *mut PLUGPLAY_EVENT_BLOCK;
+ENUM!{enum PLUGPLAY_CONTROL_CLASS {
+ PlugPlayControlEnumerateDevice = 0,
+ PlugPlayControlRegisterNewDevice = 1,
+ PlugPlayControlDeregisterDevice = 2,
+ PlugPlayControlInitializeDevice = 3,
+ PlugPlayControlStartDevice = 4,
+ PlugPlayControlUnlockDevice = 5,
+ PlugPlayControlQueryAndRemoveDevice = 6,
+ PlugPlayControlUserResponse = 7,
+ PlugPlayControlGenerateLegacyDevice = 8,
+ PlugPlayControlGetInterfaceDeviceList = 9,
+ PlugPlayControlProperty = 10,
+ PlugPlayControlDeviceClassAssociation = 11,
+ PlugPlayControlGetRelatedDevice = 12,
+ PlugPlayControlGetInterfaceDeviceAlias = 13,
+ PlugPlayControlDeviceStatus = 14,
+ PlugPlayControlGetDeviceDepth = 15,
+ PlugPlayControlQueryDeviceRelations = 16,
+ PlugPlayControlTargetDeviceRelation = 17,
+ PlugPlayControlQueryConflictList = 18,
+ PlugPlayControlRetrieveDock = 19,
+ PlugPlayControlResetDevice = 20,
+ PlugPlayControlHaltDevice = 21,
+ PlugPlayControlGetBlockedDriverList = 22,
+ PlugPlayControlGetDeviceInterfaceEnabled = 23,
+ MaxPlugPlayControl = 24,
+}}
+pub type PPLUGPLAY_CONTROL_CLASS = *mut PLUGPLAY_CONTROL_CLASS;
+EXTERN!{extern "system" {
+ fn NtGetPlugPlayEvent(
+ EventHandle: HANDLE,
+ Context: PVOID,
+ EventBlock: PPLUGPLAY_EVENT_BLOCK,
+ EventBufferSize: ULONG,
+ ) -> NTSTATUS;
+ fn NtPlugPlayControl(
+ PnPControlClass: PLUGPLAY_CONTROL_CLASS,
+ PnPControlData: PVOID,
+ PnPControlDataLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtSerializeBoot() -> NTSTATUS;
+ fn NtEnableLastKnownGood() -> NTSTATUS;
+ fn NtDisableLastKnownGood() -> NTSTATUS;
+ fn NtReplacePartitionUnit(
+ TargetInstancePath: PUNICODE_STRING,
+ SpareInstancePath: PUNICODE_STRING,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+}}
diff --git a/third_party/rust/ntapi/src/ntpoapi.rs b/third_party/rust/ntapi/src/ntpoapi.rs
new file mode 100644
index 0000000000..ecc68fc854
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntpoapi.rs
@@ -0,0 +1,134 @@
+use winapi::shared::ntdef::{
+ BOOLEAN, HANDLE, LONG, NTSTATUS, PLONG, PUNICODE_STRING, PVOID, UCHAR, ULONG, UNICODE_STRING,
+ USHORT,
+};
+use winapi::um::winnt::{
+ DEVICE_POWER_STATE, EXECUTION_STATE, LATENCY_TIME, PDEVICE_POWER_STATE, PEXECUTION_STATE,
+ POWER_ACTION, POWER_INFORMATION_LEVEL, SYSTEM_POWER_STATE,
+};
+UNION!{union POWER_STATE {
+ SystemState: SYSTEM_POWER_STATE,
+ DeviceState: DEVICE_POWER_STATE,
+}}
+pub type PPOWER_STATE = *mut POWER_STATE;
+ENUM!{enum POWER_STATE_TYPE {
+ SystemPowerState = 0,
+ DevicePowerState = 1,
+}}
+pub type PPOWER_STATE_TYPE = *mut POWER_STATE_TYPE;
+STRUCT!{struct SYSTEM_POWER_STATE_CONTEXT {
+ ContextAsUlong: ULONG,
+}}
+BITFIELD!{SYSTEM_POWER_STATE_CONTEXT ContextAsUlong: ULONG [
+ Reserved1 set_Reserved1[0..8],
+ TargetSystemState set_TargetSystemState[8..12],
+ EffectiveSystemState set_EffectiveSystemState[12..16],
+ CurrentSystemState set_CurrentSystemState[16..20],
+ IgnoreHibernationPath set_IgnoreHibernationPath[20..21],
+ PseudoTransition set_PseudoTransition[21..22],
+ Reserved2 set_Reserved2[22..32],
+]}
+pub type PSYSTEM_POWER_STATE_CONTEXT = *mut SYSTEM_POWER_STATE_CONTEXT;
+STRUCT!{struct COUNTED_REASON_CONTEXT_u_s {
+ ResourceFileName: UNICODE_STRING,
+ ResourceReasonId: USHORT,
+ StringCount: ULONG,
+ ReasonStrings: PUNICODE_STRING,
+}}
+UNION!{union COUNTED_REASON_CONTEXT_u {
+ s: COUNTED_REASON_CONTEXT_u_s,
+ SimpleString: UNICODE_STRING,
+}}
+STRUCT!{struct COUNTED_REASON_CONTEXT {
+ Version: ULONG,
+ Flags: ULONG,
+ u: COUNTED_REASON_CONTEXT_u,
+}}
+pub type PCOUNTED_REASON_CONTEXT = *mut COUNTED_REASON_CONTEXT;
+ENUM!{enum POWER_STATE_HANDLER_TYPE {
+ PowerStateSleeping1 = 0,
+ PowerStateSleeping2 = 1,
+ PowerStateSleeping3 = 2,
+ PowerStateSleeping4 = 3,
+ PowerStateShutdownOff = 4,
+ PowerStateShutdownReset = 5,
+ PowerStateSleeping4Firmware = 6,
+ PowerStateMaximum = 7,
+}}
+pub type PPOWER_STATE_HANDLER_TYPE = *mut POWER_STATE_HANDLER_TYPE;
+FN!{stdcall PENTER_STATE_SYSTEM_HANDLER(
+ SystemContext: PVOID,
+) -> NTSTATUS}
+FN!{stdcall PENTER_STATE_HANDLER(
+ Context: PVOID,
+ SystemHandler: PENTER_STATE_SYSTEM_HANDLER,
+ SystemContext: PVOID,
+ NumberProcessors: LONG,
+ Number: PLONG,
+) -> NTSTATUS}
+STRUCT!{struct POWER_STATE_HANDLER {
+ Type: POWER_STATE_HANDLER_TYPE,
+ RtcWake: BOOLEAN,
+ Spare: [UCHAR; 3],
+ Handler: PENTER_STATE_HANDLER,
+ Context: PVOID,
+}}
+pub type PPOWER_STATE_HANDLER = *mut POWER_STATE_HANDLER;
+FN!{stdcall PENTER_STATE_NOTIFY_HANDLER(
+ State: POWER_STATE_HANDLER_TYPE,
+ Context: PVOID,
+ Entering: BOOLEAN,
+) -> NTSTATUS}
+STRUCT!{struct POWER_STATE_NOTIFY_HANDLER {
+ Handler: PENTER_STATE_NOTIFY_HANDLER,
+ Context: PVOID,
+}}
+pub type PPOWER_STATE_NOTIFY_HANDLER = *mut POWER_STATE_NOTIFY_HANDLER;
+STRUCT!{struct PROCESSOR_POWER_INFORMATION {
+ Number: ULONG,
+ MaxMhz: ULONG,
+ CurrentMhz: ULONG,
+ MhzLimit: ULONG,
+ MaxIdleState: ULONG,
+ CurrentIdleState: ULONG,
+}}
+pub type PPROCESSOR_POWER_INFORMATION = *mut PROCESSOR_POWER_INFORMATION;
+STRUCT!{struct SYSTEM_POWER_INFORMATION {
+ MaxIdlenessAllowed: ULONG,
+ Idleness: ULONG,
+ TimeRemaining: ULONG,
+ CoolingMode: UCHAR,
+}}
+pub type PSYSTEM_POWER_INFORMATION = *mut SYSTEM_POWER_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtPowerInformation(
+ InformationLevel: POWER_INFORMATION_LEVEL,
+ InputBuffer: PVOID,
+ InputBufferLength: ULONG,
+ OutputBuffer: PVOID,
+ OutputBufferLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtSetThreadExecutionState(
+ NewFlags: EXECUTION_STATE,
+ PreviousFlags: PEXECUTION_STATE,
+ ) -> NTSTATUS;
+ fn NtRequestWakeupLatency(
+ latency: LATENCY_TIME,
+ ) -> NTSTATUS;
+ fn NtInitiatePowerAction(
+ SystemAction: POWER_ACTION,
+ LightestSystemState: SYSTEM_POWER_STATE,
+ Flags: ULONG,
+ Asynchronous: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtSetSystemPowerState(
+ SystemAction: POWER_ACTION,
+ LightestSystemState: SYSTEM_POWER_STATE,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn NtGetDevicePowerState(
+ Device: HANDLE,
+ State: PDEVICE_POWER_STATE,
+ ) -> NTSTATUS;
+ fn NtIsSystemResumeAutomatic() -> BOOLEAN;
+}}
diff --git a/third_party/rust/ntapi/src/ntpsapi.rs b/third_party/rust/ntapi/src/ntpsapi.rs
new file mode 100644
index 0000000000..2a0d3cde0f
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntpsapi.rs
@@ -0,0 +1,1479 @@
+use crate::ntapi_base::{CLIENT_ID, KPRIORITY, PCLIENT_ID};
+use crate::ntexapi::{PROCESS_DISK_COUNTERS, PROCESS_ENERGY_VALUES};
+use crate::ntpebteb::{PPEB, PTEB};
+use winapi::ctypes::c_void;
+use winapi::shared::basetsd::{PSIZE_T, SIZE_T, ULONG64, ULONG_PTR};
+use winapi::shared::ntdef::{
+ BOOLEAN, HANDLE, LARGE_INTEGER, LIST_ENTRY, LONG, LONGLONG, NTSTATUS, NT_PRODUCT_TYPE,
+ PHANDLE, PLARGE_INTEGER, POBJECT_ATTRIBUTES, PROCESSOR_NUMBER, PSINGLE_LIST_ENTRY, PULONG,
+ PVOID, SINGLE_LIST_ENTRY, UCHAR, ULONG, ULONGLONG, UNICODE_STRING, USHORT, WCHAR,
+};
+use winapi::um::winnt::{
+ ACCESS_MASK, CONTEXT, HARDWARE_COUNTER_TYPE, IO_COUNTERS, JOBOBJECTINFOCLASS,
+ JOBOBJECT_BASIC_ACCOUNTING_INFORMATION, LDT_ENTRY, MAX_HW_COUNTERS, PCONTEXT, PJOB_SET_ARRAY,
+ PROCESS_MITIGATION_ASLR_POLICY, PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY,
+ PROCESS_MITIGATION_CHILD_PROCESS_POLICY, PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY,
+ PROCESS_MITIGATION_DYNAMIC_CODE_POLICY, PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY,
+ PROCESS_MITIGATION_FONT_DISABLE_POLICY, PROCESS_MITIGATION_IMAGE_LOAD_POLICY,
+ PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY, PROCESS_MITIGATION_POLICY,
+ PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY, PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY,
+ PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY, PSECURITY_QUALITY_OF_SERVICE,
+};
+#[cfg(not(target_arch = "aarch64"))]
+use crate::winapi_local::um::winnt::NtCurrentTeb;
+pub const GDI_HANDLE_BUFFER_SIZE32: usize = 34;
+pub const GDI_HANDLE_BUFFER_SIZE64: usize = 60;
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+pub const GDI_HANDLE_BUFFER_SIZE: usize = GDI_HANDLE_BUFFER_SIZE64;
+#[cfg(target_arch = "x86")]
+pub const GDI_HANDLE_BUFFER_SIZE: usize = GDI_HANDLE_BUFFER_SIZE32;
+pub type GDI_HANDLE_BUFFER = [ULONG; GDI_HANDLE_BUFFER_SIZE];
+pub type GDI_HANDLE_BUFFER32 = [ULONG; GDI_HANDLE_BUFFER_SIZE32];
+pub type GDI_HANDLE_BUFFER64 = [ULONG; GDI_HANDLE_BUFFER_SIZE];
+pub const TLS_EXPANSION_SLOTS: usize = 1024;
+STRUCT!{struct PEB_LDR_DATA {
+ Length: ULONG,
+ Initialized: BOOLEAN,
+ SsHandle: HANDLE,
+ InLoadOrderModuleList: LIST_ENTRY,
+ InMemoryOrderModuleList: LIST_ENTRY,
+ InInitializationOrderModuleList: LIST_ENTRY,
+ EntryInProgress: PVOID,
+ ShutdownInProgress: BOOLEAN,
+ ShutdownThreadId: HANDLE,
+}}
+pub type PPEB_LDR_DATA = *mut PEB_LDR_DATA;
+STRUCT!{struct INITIAL_TEB_OldInitialTeb {
+ OldStackBase: PVOID,
+ OldStackLimit: PVOID,
+}}
+STRUCT!{struct INITIAL_TEB {
+ OldInitialTeb: INITIAL_TEB_OldInitialTeb,
+ StackBase: PVOID,
+ StackLimit: PVOID,
+ StackAllocationBase: PVOID,
+}}
+pub type PINITIAL_TEB = *mut INITIAL_TEB;
+STRUCT!{struct WOW64_PROCESS {
+ Wow64: PVOID,
+}}
+pub type PWOW64_PROCESS = *mut WOW64_PROCESS;
+ENUM!{enum PROCESSINFOCLASS {
+ ProcessBasicInformation = 0,
+ ProcessQuotaLimits = 1,
+ ProcessIoCounters = 2,
+ ProcessVmCounters = 3,
+ ProcessTimes = 4,
+ ProcessBasePriority = 5,
+ ProcessRaisePriority = 6,
+ ProcessDebugPort = 7,
+ ProcessExceptionPort = 8,
+ ProcessAccessToken = 9,
+ ProcessLdtInformation = 10,
+ ProcessLdtSize = 11,
+ ProcessDefaultHardErrorMode = 12,
+ ProcessIoPortHandlers = 13,
+ ProcessPooledUsageAndLimits = 14,
+ ProcessWorkingSetWatch = 15,
+ ProcessUserModeIOPL = 16,
+ ProcessEnableAlignmentFaultFixup = 17,
+ ProcessPriorityClass = 18,
+ ProcessWx86Information = 19,
+ ProcessHandleCount = 20,
+ ProcessAffinityMask = 21,
+ ProcessPriorityBoost = 22,
+ ProcessDeviceMap = 23,
+ ProcessSessionInformation = 24,
+ ProcessForegroundInformation = 25,
+ ProcessWow64Information = 26,
+ ProcessImageFileName = 27,
+ ProcessLUIDDeviceMapsEnabled = 28,
+ ProcessBreakOnTermination = 29,
+ ProcessDebugObjectHandle = 30,
+ ProcessDebugFlags = 31,
+ ProcessHandleTracing = 32,
+ ProcessIoPriority = 33,
+ ProcessExecuteFlags = 34,
+ ProcessResourceManagement = 35,
+ ProcessCookie = 36,
+ ProcessImageInformation = 37,
+ ProcessCycleTime = 38,
+ ProcessPagePriority = 39,
+ ProcessInstrumentationCallback = 40,
+ ProcessThreadStackAllocation = 41,
+ ProcessWorkingSetWatchEx = 42,
+ ProcessImageFileNameWin32 = 43,
+ ProcessImageFileMapping = 44,
+ ProcessAffinityUpdateMode = 45,
+ ProcessMemoryAllocationMode = 46,
+ ProcessGroupInformation = 47,
+ ProcessTokenVirtualizationEnabled = 48,
+ ProcessConsoleHostProcess = 49,
+ ProcessWindowInformation = 50,
+ ProcessHandleInformation = 51,
+ ProcessMitigationPolicy = 52,
+ ProcessDynamicFunctionTableInformation = 53,
+ ProcessHandleCheckingMode = 54,
+ ProcessKeepAliveCount = 55,
+ ProcessRevokeFileHandles = 56,
+ ProcessWorkingSetControl = 57,
+ ProcessHandleTable = 58,
+ ProcessCheckStackExtentsMode = 59,
+ ProcessCommandLineInformation = 60,
+ ProcessProtectionInformation = 61,
+ ProcessMemoryExhaustion = 62,
+ ProcessFaultInformation = 63,
+ ProcessTelemetryIdInformation = 64,
+ ProcessCommitReleaseInformation = 65,
+ ProcessDefaultCpuSetsInformation = 66,
+ ProcessAllowedCpuSetsInformation = 67,
+ ProcessSubsystemProcess = 68,
+ ProcessJobMemoryInformation = 69,
+ ProcessInPrivate = 70,
+ ProcessRaiseUMExceptionOnInvalidHandleClose = 71,
+ ProcessIumChallengeResponse = 72,
+ ProcessChildProcessInformation = 73,
+ ProcessHighGraphicsPriorityInformation = 74,
+ ProcessSubsystemInformation = 75,
+ ProcessEnergyValues = 76,
+ ProcessActivityThrottleState = 77,
+ ProcessActivityThrottlePolicy = 78,
+ ProcessWin32kSyscallFilterInformation = 79,
+ ProcessDisableSystemAllowedCpuSets = 80,
+ ProcessWakeInformation = 81,
+ ProcessEnergyTrackingState = 82,
+ ProcessManageWritesToExecutableMemory = 83,
+ ProcessCaptureTrustletLiveDump = 84,
+ ProcessTelemetryCoverage = 85,
+ ProcessEnclaveInformation = 86,
+ ProcessEnableReadWriteVmLogging = 87,
+ ProcessUptimeInformation = 88,
+ ProcessImageSection = 89,
+ ProcessDebugAuthInformation = 90,
+ ProcessSystemResourceManagement = 91,
+ ProcessSequenceNumber = 92,
+ ProcessLoaderDetour = 93,
+ ProcessSecurityDomainInformation = 94,
+ ProcessCombineSecurityDomainsInformation = 95,
+ ProcessEnableLogging = 96,
+ ProcessLeapSecondInformation = 97,
+ MaxProcessInfoClass = 98,
+}}
+ENUM!{enum THREADINFOCLASS {
+ ThreadBasicInformation = 0,
+ ThreadTimes = 1,
+ ThreadPriority = 2,
+ ThreadBasePriority = 3,
+ ThreadAffinityMask = 4,
+ ThreadImpersonationToken = 5,
+ ThreadDescriptorTableEntry = 6,
+ ThreadEnableAlignmentFaultFixup = 7,
+ ThreadEventPair = 8,
+ ThreadQuerySetWin32StartAddress = 9,
+ ThreadZeroTlsCell = 10,
+ ThreadPerformanceCount = 11,
+ ThreadAmILastThread = 12,
+ ThreadIdealProcessor = 13,
+ ThreadPriorityBoost = 14,
+ ThreadSetTlsArrayAddress = 15,
+ ThreadIsIoPending = 16,
+ ThreadHideFromDebugger = 17,
+ ThreadBreakOnTermination = 18,
+ ThreadSwitchLegacyState = 19,
+ ThreadIsTerminated = 20,
+ ThreadLastSystemCall = 21,
+ ThreadIoPriority = 22,
+ ThreadCycleTime = 23,
+ ThreadPagePriority = 24,
+ ThreadActualBasePriority = 25,
+ ThreadTebInformation = 26,
+ ThreadCSwitchMon = 27,
+ ThreadCSwitchPmu = 28,
+ ThreadWow64Context = 29,
+ ThreadGroupInformation = 30,
+ ThreadUmsInformation = 31,
+ ThreadCounterProfiling = 32,
+ ThreadIdealProcessorEx = 33,
+ ThreadCpuAccountingInformation = 34,
+ ThreadSuspendCount = 35,
+ ThreadHeterogeneousCpuPolicy = 36,
+ ThreadContainerId = 37,
+ ThreadNameInformation = 38,
+ ThreadSelectedCpuSets = 39,
+ ThreadSystemThreadInformation = 40,
+ ThreadActualGroupAffinity = 41,
+ ThreadDynamicCodePolicyInfo = 42,
+ ThreadExplicitCaseSensitivity = 43,
+ ThreadWorkOnBehalfTicket = 44,
+ ThreadSubsystemInformation = 45,
+ ThreadDbgkWerReportActive = 46,
+ ThreadAttachContainer = 47,
+ ThreadManageWritesToExecutableMemory = 48,
+ ThreadPowerThrottlingState = 49,
+ ThreadWorkloadClass = 50,
+ MaxThreadInfoClass = 51,
+}}
+STRUCT!{struct PAGE_PRIORITY_INFORMATION {
+ PagePriority: ULONG,
+}}
+pub type PPAGE_PRIORITY_INFORMATION = *mut PAGE_PRIORITY_INFORMATION;
+STRUCT!{struct PROCESS_BASIC_INFORMATION {
+ ExitStatus: NTSTATUS,
+ PebBaseAddress: PPEB,
+ AffinityMask: ULONG_PTR,
+ BasePriority: KPRIORITY,
+ UniqueProcessId: HANDLE,
+ InheritedFromUniqueProcessId: HANDLE,
+}}
+pub type PPROCESS_BASIC_INFORMATION = *mut PROCESS_BASIC_INFORMATION;
+STRUCT!{struct PROCESS_EXTENDED_BASIC_INFORMATION {
+ Size: SIZE_T,
+ BasicInfo: PROCESS_BASIC_INFORMATION,
+ Flags: ULONG,
+}}
+BITFIELD!{PROCESS_EXTENDED_BASIC_INFORMATION Flags: ULONG [
+ IsProtectedProcess set_IsProtectedProcess[0..1],
+ IsWow64Process set_IsWow64Process[1..2],
+ IsProcessDeleting set_IsProcessDeleting[2..3],
+ IsCrossSessionCreate set_IsCrossSessionCreate[3..4],
+ IsFrozen set_IsFrozen[4..5],
+ IsBackground set_IsBackground[5..6],
+ IsStronglyNamed set_IsStronglyNamed[6..7],
+ IsSecureProcess set_IsSecureProcess[7..8],
+ IsSubsystemProcess set_IsSubsystemProcess[8..9],
+ SpareBits set_SpareBits[9..32],
+]}
+pub type PPROCESS_EXTENDED_BASIC_INFORMATION = *mut PROCESS_EXTENDED_BASIC_INFORMATION;
+STRUCT!{struct VM_COUNTERS {
+ PeakVirtualSize: SIZE_T,
+ VirtualSize: SIZE_T,
+ PageFaultCount: ULONG,
+ PeakWorkingSetSize: SIZE_T,
+ WorkingSetSize: SIZE_T,
+ QuotaPeakPagedPoolUsage: SIZE_T,
+ QuotaPagedPoolUsage: SIZE_T,
+ QuotaPeakNonPagedPoolUsage: SIZE_T,
+ QuotaNonPagedPoolUsage: SIZE_T,
+ PagefileUsage: SIZE_T,
+ PeakPagefileUsage: SIZE_T,
+}}
+pub type PVM_COUNTERS = *mut VM_COUNTERS;
+STRUCT!{struct VM_COUNTERS_EX {
+ PeakVirtualSize: SIZE_T,
+ VirtualSize: SIZE_T,
+ PageFaultCount: ULONG,
+ PeakWorkingSetSize: SIZE_T,
+ WorkingSetSize: SIZE_T,
+ QuotaPeakPagedPoolUsage: SIZE_T,
+ QuotaPagedPoolUsage: SIZE_T,
+ QuotaPeakNonPagedPoolUsage: SIZE_T,
+ QuotaNonPagedPoolUsage: SIZE_T,
+ PagefileUsage: SIZE_T,
+ PeakPagefileUsage: SIZE_T,
+ PrivateUsage: SIZE_T,
+}}
+pub type PVM_COUNTERS_EX = *mut VM_COUNTERS_EX;
+STRUCT!{struct VM_COUNTERS_EX2 {
+ CountersEx: VM_COUNTERS_EX,
+ PrivateWorkingSetSize: SIZE_T,
+ SharedCommitUsage: SIZE_T,
+}}
+pub type PVM_COUNTERS_EX2 = *mut VM_COUNTERS_EX2;
+STRUCT!{struct KERNEL_USER_TIMES {
+ CreateTime: LARGE_INTEGER,
+ ExitTime: LARGE_INTEGER,
+ KernelTime: LARGE_INTEGER,
+ UserTime: LARGE_INTEGER,
+}}
+pub type PKERNEL_USER_TIMES = *mut KERNEL_USER_TIMES;
+STRUCT!{struct POOLED_USAGE_AND_LIMITS {
+ PeakPagedPoolUsage: SIZE_T,
+ PagedPoolUsage: SIZE_T,
+ PagedPoolLimit: SIZE_T,
+ PeakNonPagedPoolUsage: SIZE_T,
+ NonPagedPoolUsage: SIZE_T,
+ NonPagedPoolLimit: SIZE_T,
+ PeakPagefileUsage: SIZE_T,
+ PagefileUsage: SIZE_T,
+ PagefileLimit: SIZE_T,
+}}
+pub type PPOOLED_USAGE_AND_LIMITS = *mut POOLED_USAGE_AND_LIMITS;
+pub const PROCESS_EXCEPTION_PORT_ALL_STATE_BITS: ULONG_PTR = 0x00000003;
+pub const PROCESS_EXCEPTION_PORT_ALL_STATE_FLAGS: ULONG_PTR =
+ (1 << PROCESS_EXCEPTION_PORT_ALL_STATE_BITS) - 1;
+STRUCT!{struct PROCESS_EXCEPTION_PORT {
+ ExceptionPortHandle: HANDLE,
+ StateFlags: ULONG,
+}}
+pub type PPROCESS_EXCEPTION_PORT = *mut PROCESS_EXCEPTION_PORT;
+STRUCT!{struct PROCESS_ACCESS_TOKEN {
+ Token: HANDLE,
+ Thread: HANDLE,
+}}
+pub type PPROCESS_ACCESS_TOKEN = *mut PROCESS_ACCESS_TOKEN;
+STRUCT!{struct PROCESS_LDT_INFORMATION {
+ Start: ULONG,
+ Length: ULONG,
+ LdtEntries: [LDT_ENTRY; 1],
+}}
+pub type PPROCESS_LDT_INFORMATION = *mut PROCESS_LDT_INFORMATION;
+STRUCT!{struct PROCESS_LDT_SIZE {
+ Length: ULONG,
+}}
+pub type PPROCESS_LDT_SIZE = *mut PROCESS_LDT_SIZE;
+STRUCT!{struct PROCESS_WS_WATCH_INFORMATION {
+ FaultingPc: PVOID,
+ FaultingVa: PVOID,
+}}
+pub type PPROCESS_WS_WATCH_INFORMATION = *mut PROCESS_WS_WATCH_INFORMATION;
+STRUCT!{struct PROCESS_WS_WATCH_INFORMATION_EX {
+ BasicInfo: PROCESS_WS_WATCH_INFORMATION,
+ FaultingThreadId: ULONG_PTR,
+ Flags: ULONG_PTR,
+}}
+pub type PPROCESS_WS_WATCH_INFORMATION_EX = *mut PROCESS_WS_WATCH_INFORMATION_EX;
+pub const PROCESS_PRIORITY_CLASS_UNKNOWN: u32 = 0;
+pub const PROCESS_PRIORITY_CLASS_IDLE: u32 = 1;
+pub const PROCESS_PRIORITY_CLASS_NORMAL: u32 = 2;
+pub const PROCESS_PRIORITY_CLASS_HIGH: u32 = 3;
+pub const PROCESS_PRIORITY_CLASS_REALTIME: u32 = 4;
+pub const PROCESS_PRIORITY_CLASS_BELOW_NORMAL: u32 = 5;
+pub const PROCESS_PRIORITY_CLASS_ABOVE_NORMAL: u32 = 6;
+STRUCT!{struct PROCESS_PRIORITY_CLASS {
+ Foreground: BOOLEAN,
+ PriorityClass: UCHAR,
+}}
+pub type PPROCESS_PRIORITY_CLASS = *mut PROCESS_PRIORITY_CLASS;
+STRUCT!{struct PROCESS_FOREGROUND_BACKGROUND {
+ Foreground: BOOLEAN,
+}}
+pub type PPROCESS_FOREGROUND_BACKGROUND = *mut PROCESS_FOREGROUND_BACKGROUND;
+STRUCT!{struct PROCESS_DEVICEMAP_INFORMATION_Set {
+ DirectoryHandle: HANDLE,
+}}
+STRUCT!{struct PROCESS_DEVICEMAP_INFORMATION_Query {
+ DriveMap: ULONG,
+ DriveType: [UCHAR; 32],
+}}
+UNION!{union PROCESS_DEVICEMAP_INFORMATION {
+ Set: PROCESS_DEVICEMAP_INFORMATION_Set,
+ Query: PROCESS_DEVICEMAP_INFORMATION_Query,
+}}
+pub type PPROCESS_DEVICEMAP_INFORMATION = *mut PROCESS_DEVICEMAP_INFORMATION;
+pub const PROCESS_LUID_DOSDEVICES_ONLY: ULONG = 0x00000001;
+STRUCT!{struct PROCESS_DEVICEMAP_INFORMATION_EX_u_Set {
+ DirectoryHandle: HANDLE,
+}}
+STRUCT!{struct PROCESS_DEVICEMAP_INFORMATION_EX_u_Query {
+ DriveMap: ULONG,
+ DriveType: [UCHAR; 32],
+}}
+UNION!{union PROCESS_DEVICEMAP_INFORMATION_EX_u {
+ Set: PROCESS_DEVICEMAP_INFORMATION_EX_u_Set,
+ Query: PROCESS_DEVICEMAP_INFORMATION_EX_u_Query,
+}}
+STRUCT!{struct PROCESS_DEVICEMAP_INFORMATION_EX {
+ u: PROCESS_DEVICEMAP_INFORMATION_EX_u,
+ Flags: ULONG,
+}}
+pub type PPROCESS_DEVICEMAP_INFORMATION_EX = *mut PROCESS_DEVICEMAP_INFORMATION_EX;
+STRUCT!{struct PROCESS_SESSION_INFORMATION {
+ SessionId: ULONG,
+}}
+pub type PPROCESS_SESSION_INFORMATION = *mut PROCESS_SESSION_INFORMATION;
+pub const PROCESS_HANDLE_EXCEPTIONS_ENABLED: ULONG = 0x00000001;
+pub const PROCESS_HANDLE_RAISE_EXCEPTION_ON_INVALID_HANDLE_CLOSE_DISABLED: ULONG = 0x00000000;
+pub const PROCESS_HANDLE_RAISE_EXCEPTION_ON_INVALID_HANDLE_CLOSE_ENABLED: ULONG = 0x00000001;
+STRUCT!{struct PROCESS_HANDLE_TRACING_ENABLE {
+ Flags: ULONG,
+}}
+pub type PPROCESS_HANDLE_TRACING_ENABLE = *mut PROCESS_HANDLE_TRACING_ENABLE;
+pub const PROCESS_HANDLE_TRACING_MAX_SLOTS: ULONG = 0x20000;
+STRUCT!{struct PROCESS_HANDLE_TRACING_ENABLE_EX {
+ Flags: ULONG,
+ TotalSlots: ULONG,
+}}
+pub type PPROCESS_HANDLE_TRACING_ENABLE_EX = *mut PROCESS_HANDLE_TRACING_ENABLE_EX;
+pub const PROCESS_HANDLE_TRACING_MAX_STACKS: usize = 16;
+pub const PROCESS_HANDLE_TRACE_TYPE_OPEN: ULONG = 1;
+pub const PROCESS_HANDLE_TRACE_TYPE_CLOSE: ULONG = 2;
+pub const PROCESS_HANDLE_TRACE_TYPE_BADREF: ULONG = 3;
+STRUCT!{struct PROCESS_HANDLE_TRACING_ENTRY {
+ Handle: HANDLE,
+ ClientId: CLIENT_ID,
+ Type: ULONG,
+ Stacks: [PVOID; PROCESS_HANDLE_TRACING_MAX_STACKS],
+}}
+pub type PPROCESS_HANDLE_TRACING_ENTRY = *mut PROCESS_HANDLE_TRACING_ENTRY;
+STRUCT!{struct PROCESS_HANDLE_TRACING_QUERY {
+ Handle: HANDLE,
+ TotalTraces: ULONG,
+ HandleTrace: [PROCESS_HANDLE_TRACING_ENTRY; 1],
+}}
+pub type PPROCESS_HANDLE_TRACING_QUERY = *mut PROCESS_HANDLE_TRACING_QUERY;
+STRUCT!{struct THREAD_TLS_INFORMATION {
+ Flags: ULONG,
+ NewTlsData: PVOID,
+ OldTlsData: PVOID,
+ ThreadId: HANDLE,
+}}
+pub type PTHREAD_TLS_INFORMATION = *mut THREAD_TLS_INFORMATION;
+ENUM!{enum PROCESS_TLS_INFORMATION_TYPE {
+ ProcessTlsReplaceIndex = 0,
+ ProcessTlsReplaceVector = 1,
+ MaxProcessTlsOperation = 2,
+}}
+pub type PPROCESS_TLS_INFORMATION_TYPE = *mut PROCESS_TLS_INFORMATION_TYPE;
+STRUCT!{struct PROCESS_TLS_INFORMATION {
+ Flags: ULONG,
+ OperationType: ULONG,
+ ThreadDataCount: ULONG,
+ TlsIndex: ULONG,
+ PreviousCount: ULONG,
+ ThreadData: [THREAD_TLS_INFORMATION; 1],
+}}
+pub type PPROCESS_TLS_INFORMATION = *mut PROCESS_TLS_INFORMATION;
+STRUCT!{struct PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION {
+ Version: ULONG,
+ Reserved: ULONG,
+ Callback: PVOID,
+}}
+pub type PPROCESS_INSTRUMENTATION_CALLBACK_INFORMATION =
+ *mut PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION;
+STRUCT!{struct PROCESS_STACK_ALLOCATION_INFORMATION {
+ ReserveSize: SIZE_T,
+ ZeroBits: SIZE_T,
+ StackBase: PVOID,
+}}
+pub type PPROCESS_STACK_ALLOCATION_INFORMATION = *mut PROCESS_STACK_ALLOCATION_INFORMATION;
+STRUCT!{struct PROCESS_STACK_ALLOCATION_INFORMATION_EX {
+ PreferredNode: ULONG,
+ Reserved0: ULONG,
+ Reserved1: ULONG,
+ Reserved2: ULONG,
+ AllocInfo: PROCESS_STACK_ALLOCATION_INFORMATION,
+}}
+pub type PPROCESS_STACK_ALLOCATION_INFORMATION_EX = *mut PROCESS_STACK_ALLOCATION_INFORMATION_EX;
+STRUCT!{struct PROCESS_AFFINITY_UPDATE_MODE {
+ Flags: ULONG,
+}}
+BITFIELD!{PROCESS_AFFINITY_UPDATE_MODE Flags: ULONG [
+ EnableAutoUpdate set_EnableAutoUpdate[0..1],
+ Permanent set_Permanent[1..2],
+ Reserved set_Reserved[2..32],
+]}
+pub type PPROCESS_AFFINITY_UPDATE_MODE = *mut PROCESS_AFFINITY_UPDATE_MODE;
+STRUCT!{struct PROCESS_MEMORY_ALLOCATION_MODE {
+ Flags: ULONG,
+}}
+BITFIELD!{PROCESS_MEMORY_ALLOCATION_MODE Flags: ULONG [
+ TopDown set_TopDown[0..1],
+ Reserved set_Reserved[1..32],
+]}
+pub type PPROCESS_MEMORY_ALLOCATION_MODE = *mut PROCESS_MEMORY_ALLOCATION_MODE;
+STRUCT!{struct PROCESS_HANDLE_INFORMATION {
+ HandleCount: ULONG,
+ HandleCountHighWatermark: ULONG,
+}}
+pub type PPROCESS_HANDLE_INFORMATION = *mut PROCESS_HANDLE_INFORMATION;
+STRUCT!{struct PROCESS_CYCLE_TIME_INFORMATION {
+ AccumulatedCycles: ULONGLONG,
+ CurrentCycleCount: ULONGLONG,
+}}
+pub type PPROCESS_CYCLE_TIME_INFORMATION = *mut PROCESS_CYCLE_TIME_INFORMATION;
+STRUCT!{struct PROCESS_WINDOW_INFORMATION {
+ WindowFlags: ULONG,
+ WindowTitleLength: USHORT,
+ WindowTitle: [WCHAR; 1],
+}}
+pub type PPROCESS_WINDOW_INFORMATION = *mut PROCESS_WINDOW_INFORMATION;
+STRUCT!{struct PROCESS_HANDLE_TABLE_ENTRY_INFO {
+ HandleValue: HANDLE,
+ HandleCount: ULONG_PTR,
+ PointerCount: ULONG_PTR,
+ GrantedAccess: ULONG,
+ ObjectTypeIndex: ULONG,
+ HandleAttributes: ULONG,
+ Reserved: ULONG,
+}}
+pub type PPROCESS_HANDLE_TABLE_ENTRY_INFO = *mut PROCESS_HANDLE_TABLE_ENTRY_INFO;
+STRUCT!{struct PROCESS_HANDLE_SNAPSHOT_INFORMATION {
+ NumberOfHandles: ULONG_PTR,
+ Reserved: ULONG_PTR,
+ Handles: [PROCESS_HANDLE_TABLE_ENTRY_INFO; 1],
+}}
+pub type PPROCESS_HANDLE_SNAPSHOT_INFORMATION = *mut PROCESS_HANDLE_SNAPSHOT_INFORMATION;
+UNION!{union PROCESS_MITIGATION_POLICY_INFORMATION_u {
+ ASLRPolicy: PROCESS_MITIGATION_ASLR_POLICY,
+ StrictHandleCheckPolicy: PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY,
+ SystemCallDisablePolicy: PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY,
+ ExtensionPointDisablePolicy: PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY,
+ DynamicCodePolicy: PROCESS_MITIGATION_DYNAMIC_CODE_POLICY,
+ ControlFlowGuardPolicy: PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY,
+ SignaturePolicy: PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY,
+ FontDisablePolicy: PROCESS_MITIGATION_FONT_DISABLE_POLICY,
+ ImageLoadPolicy: PROCESS_MITIGATION_IMAGE_LOAD_POLICY,
+ SystemCallFilterPolicy: PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY,
+ PayloadRestrictionPolicy: PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY,
+ ChildProcessPolicy: PROCESS_MITIGATION_CHILD_PROCESS_POLICY,
+ // SideChannelIsolationPolicy: PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY, //TODO
+}}
+STRUCT!{struct PROCESS_MITIGATION_POLICY_INFORMATION {
+ Policy: PROCESS_MITIGATION_POLICY,
+ u: PROCESS_MITIGATION_POLICY_INFORMATION_u,
+}}
+pub type PPROCESS_MITIGATION_POLICY_INFORMATION = *mut PROCESS_MITIGATION_POLICY_INFORMATION;
+STRUCT!{struct PROCESS_KEEPALIVE_COUNT_INFORMATION {
+ WakeCount: ULONG,
+ NoWakeCount: ULONG,
+}}
+pub type PPROCESS_KEEPALIVE_COUNT_INFORMATION = *mut PROCESS_KEEPALIVE_COUNT_INFORMATION;
+STRUCT!{struct PROCESS_REVOKE_FILE_HANDLES_INFORMATION {
+ TargetDevicePath: UNICODE_STRING,
+}}
+pub type PPROCESS_REVOKE_FILE_HANDLES_INFORMATION = *mut PROCESS_REVOKE_FILE_HANDLES_INFORMATION;
+ENUM!{enum PROCESS_WORKING_SET_OPERATION {
+ ProcessWorkingSetSwap = 0,
+ ProcessWorkingSetEmpty = 1,
+ ProcessWorkingSetOperationMax = 2,
+}}
+STRUCT!{struct PROCESS_WORKING_SET_CONTROL {
+ Version: ULONG,
+ Operation: PROCESS_WORKING_SET_OPERATION,
+ Flags: ULONG,
+}}
+pub type PPROCESS_WORKING_SET_CONTROL = *mut PROCESS_WORKING_SET_CONTROL;
+ENUM!{enum PS_PROTECTED_TYPE {
+ PsProtectedTypeNone = 0,
+ PsProtectedTypeProtectedLight = 1,
+ PsProtectedTypeProtected = 2,
+ PsProtectedTypeMax = 3,
+}}
+ENUM!{enum PS_PROTECTED_SIGNER {
+ PsProtectedSignerNone = 0,
+ PsProtectedSignerAuthenticode = 1,
+ PsProtectedSignerCodeGen = 2,
+ PsProtectedSignerAntimalware = 3,
+ PsProtectedSignerLsa = 4,
+ PsProtectedSignerWindows = 5,
+ PsProtectedSignerWinTcb = 6,
+ PsProtectedSignerWinSystem = 7,
+ PsProtectedSignerApp = 8,
+ PsProtectedSignerMax = 9,
+}}
+pub const PS_PROTECTED_SIGNER_MASK: UCHAR = 0xFF;
+pub const PS_PROTECTED_AUDIT_MASK: UCHAR = 0x08;
+pub const PS_PROTECTED_TYPE_MASK: UCHAR = 0x07;
+#[inline]
+pub const fn PsProtectedValue(
+ aSigner: PS_PROTECTED_SIGNER,
+ aAudit: u8,
+ aType: PS_PROTECTED_TYPE,
+) -> UCHAR {
+ (aSigner as u8 & PS_PROTECTED_SIGNER_MASK) << 4 | (aAudit & PS_PROTECTED_AUDIT_MASK) << 3
+ | (aType as u8 & PS_PROTECTED_TYPE_MASK)
+}
+#[inline]
+pub fn InitializePsProtection(
+ aProtectionLevelPtr: &mut PS_PROTECTION,
+ aSigner: PS_PROTECTED_SIGNER,
+ aAudit: u8,
+ aType: PS_PROTECTED_TYPE,
+) {
+ aProtectionLevelPtr.set_Signer(aSigner as u8);
+ aProtectionLevelPtr.set_Audit(aAudit);
+ aProtectionLevelPtr.set_Type(aType as u8);
+}
+STRUCT!{struct PS_PROTECTION {
+ Level: UCHAR,
+}}
+pub type PPS_PROTECTION = *mut PS_PROTECTION;
+BITFIELD!{PS_PROTECTION Level: UCHAR [
+ Type set_Type[0..3],
+ Audit set_Audit[3..4],
+ Signer set_Signer[4..8],
+]}
+STRUCT!{struct PROCESS_FAULT_INFORMATION {
+ FaultFlags: ULONG,
+ AdditionalInfo: ULONG,
+}}
+pub type PPROCESS_FAULT_INFORMATION = *mut PROCESS_FAULT_INFORMATION;
+STRUCT!{struct PROCESS_TELEMETRY_ID_INFORMATION {
+ HeaderSize: ULONG,
+ ProcessId: ULONG,
+ ProcessStartKey: ULONGLONG,
+ CreateTime: ULONGLONG,
+ CreateInterruptTime: ULONGLONG,
+ CreateUnbiasedInterruptTime: ULONGLONG,
+ ProcessSequenceNumber: ULONGLONG,
+ SessionCreateTime: ULONGLONG,
+ SessionId: ULONG,
+ BootId: ULONG,
+ ImageChecksum: ULONG,
+ ImageTimeDateStamp: ULONG,
+ UserSidOffset: ULONG,
+ ImagePathOffset: ULONG,
+ PackageNameOffset: ULONG,
+ RelativeAppNameOffset: ULONG,
+ CommandLineOffset: ULONG,
+}}
+pub type PPROCESS_TELEMETRY_ID_INFORMATION = *mut PROCESS_TELEMETRY_ID_INFORMATION;
+STRUCT!{struct PROCESS_COMMIT_RELEASE_INFORMATION {
+ Version: ULONG,
+ s: ULONG,
+ CommitDebt: SIZE_T,
+ CommittedMemResetSize: SIZE_T,
+ RepurposedMemResetSize: SIZE_T,
+}}
+BITFIELD!{PROCESS_COMMIT_RELEASE_INFORMATION s: ULONG [
+ Eligible set_Eligible[0..1],
+ ReleaseRepurposedMemResetCommit set_ReleaseRepurposedMemResetCommit[1..2],
+ ForceReleaseMemResetCommit set_ForceReleaseMemResetCommit[2..3],
+ Spare set_Spare[3..32],
+]}
+pub type PPROCESS_COMMIT_RELEASE_INFORMATION = *mut PROCESS_COMMIT_RELEASE_INFORMATION;
+STRUCT!{struct PROCESS_JOB_MEMORY_INFO {
+ SharedCommitUsage: ULONGLONG,
+ PrivateCommitUsage: ULONGLONG,
+ PeakPrivateCommitUsage: ULONGLONG,
+ PrivateCommitLimit: ULONGLONG,
+ TotalCommitLimit: ULONGLONG,
+}}
+pub type PPROCESS_JOB_MEMORY_INFO = *mut PROCESS_JOB_MEMORY_INFO;
+STRUCT!{struct PROCESS_CHILD_PROCESS_INFORMATION {
+ ProhibitChildProcesses: BOOLEAN,
+ AlwaysAllowSecureChildProcess: BOOLEAN,
+ AuditProhibitChildProcesses: BOOLEAN,
+}}
+pub type PPROCESS_CHILD_PROCESS_INFORMATION = *mut PROCESS_CHILD_PROCESS_INFORMATION;
+STRUCT!{struct PROCESS_WAKE_INFORMATION {
+ NotificationChannel: ULONGLONG,
+ WakeCounters: [ULONG; 7],
+ WakeFilter: *mut JOBOBJECT_WAKE_FILTER,
+}}
+pub type PPROCESS_WAKE_INFORMATION = *mut PROCESS_WAKE_INFORMATION;
+STRUCT!{struct PROCESS_ENERGY_TRACKING_STATE {
+ StateUpdateMask: ULONG,
+ StateDesiredValue: ULONG,
+ StateSequence: ULONG,
+ UpdateTag: ULONG,
+ Tag: [WCHAR; 64],
+}}
+pub type PPROCESS_ENERGY_TRACKING_STATE = *mut PROCESS_ENERGY_TRACKING_STATE;
+BITFIELD!{PROCESS_ENERGY_TRACKING_STATE UpdateTag: ULONG [
+ UpdateTag set_UpdateTag[0..1],
+]}
+STRUCT!{struct MANAGE_WRITES_TO_EXECUTABLE_MEMORY {
+ BitFields: ULONG,
+}}
+BITFIELD!{MANAGE_WRITES_TO_EXECUTABLE_MEMORY BitFields: ULONG [
+ Machine set_Machine[0..16],
+ KernelMode set_KernelMode[16..17],
+ UserMode set_UserMode[17..18],
+ Native set_Native[18..19],
+ Process set_Process[19..20],
+ ReservedZero0 set_ReservedZero0[20..32],
+]}
+pub type PMANAGE_WRITES_TO_EXECUTABLE_MEMORY = *mut MANAGE_WRITES_TO_EXECUTABLE_MEMORY;
+pub const PROCESS_READWRITEVM_LOGGING_ENABLE_READVM: UCHAR = 1;
+pub const PROCESS_READWRITEVM_LOGGING_ENABLE_WRITEVM: UCHAR = 2;
+pub const PROCESS_READWRITEVM_LOGGING_ENABLE_READVM_V: UCHAR = 1;
+pub const PROCESS_READWRITEVM_LOGGING_ENABLE_WRITEVM_V: UCHAR = 2;
+STRUCT!{struct PROCESS_READWRITEVM_LOGGING_INFORMATION {
+ Flags: UCHAR,
+}}
+BITFIELD!{PROCESS_READWRITEVM_LOGGING_INFORMATION Flags: UCHAR [
+ EnableReadVmLogging set_EnableReadVmLogging[0..1],
+ EnableWriteVmLogging set_EnableWriteVmLogging[1..2],
+ Unused set_Unused[2..8],
+]}
+UNION!{union PROCESS_UPTIME_INFORMATION_u {
+ HangCount: ULONG,
+ GhostCount: ULONG,
+ Crashed: ULONG,
+ Terminated: ULONG,
+}}
+pub type PPROCESS_READWRITEVM_LOGGING_INFORMATION = *mut PROCESS_READWRITEVM_LOGGING_INFORMATION;
+STRUCT!{struct PROCESS_UPTIME_INFORMATION {
+ QueryInterruptTime: ULONGLONG,
+ QueryUnbiasedTime: ULONGLONG,
+ EndInterruptTime: ULONGLONG,
+ TimeSinceCreation: ULONGLONG,
+ Uptime: ULONGLONG,
+ SuspendedTime: ULONGLONG,
+ u: PROCESS_UPTIME_INFORMATION_u,
+}}
+pub type PPROCESS_UPTIME_INFORMATION = *mut PROCESS_UPTIME_INFORMATION;
+STRUCT!{struct PROCESS_SYSTEM_RESOURCE_MANAGEMENT {
+ Flags: ULONG,
+}}
+pub type PPROCESS_SYSTEM_RESOURCE_MANAGEMENT = *mut PROCESS_SYSTEM_RESOURCE_MANAGEMENT;
+BITFIELD!{PROCESS_SYSTEM_RESOURCE_MANAGEMENT Flags: ULONG [
+ Foreground set_Foreground[0..1],
+ Reserved set_Reserved[1..32],
+]}
+STRUCT!{struct PROCESS_SECURITY_DOMAIN_INFORMATION {
+ SecurityDomain: ULONGLONG,
+}}
+pub type PPROCESS_SECURITY_DOMAIN_INFORMATION = *mut PROCESS_SECURITY_DOMAIN_INFORMATION;
+STRUCT!{struct PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION {
+ ProcessHandle: HANDLE,
+}}
+pub type PPROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION =
+ *mut PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION;
+STRUCT!{struct PROCESS_LOGGING_INFORMATION {
+ Flags: ULONG,
+ BitFields: ULONG,
+}}
+BITFIELD!{PROCESS_LOGGING_INFORMATION BitFields: ULONG [
+ EnableReadVmLogging set_EnableReadVmLogging[0..1],
+ EnableWriteVmLogging set_EnableWriteVmLogging[1..2],
+ EnableProcessSuspendResumeLogging set_EnableProcessSuspendResumeLogging[2..3],
+ EnableThreadSuspendResumeLogging set_EnableThreadSuspendResumeLogging[3..4],
+ Reserved set_Reserved[4..32],
+]}
+pub type PPROCESS_LOGGING_INFORMATION = *mut PROCESS_LOGGING_INFORMATION;
+STRUCT!{struct PROCESS_LEAP_SECOND_INFORMATION {
+ Flags: ULONG,
+ Reserved: ULONG,
+}}
+pub type PPROCESS_LEAP_SECOND_INFORMATION = *mut PROCESS_LEAP_SECOND_INFORMATION;
+STRUCT!{struct THREAD_BASIC_INFORMATION {
+ ExitStatus: NTSTATUS,
+ TebBaseAddress: PTEB,
+ ClientId: CLIENT_ID,
+ AffinityMask: ULONG_PTR,
+ Priority: KPRIORITY,
+ BasePriority: LONG,
+}}
+pub type PTHREAD_BASIC_INFORMATION = *mut THREAD_BASIC_INFORMATION;
+STRUCT!{struct THREAD_LAST_SYSCALL_INFORMATION {
+ FirstArgument: PVOID,
+ SystemCallNumber: USHORT,
+ Pad: [USHORT; 1],
+ WaitTime: ULONG64,
+}}
+pub type PTHREAD_LAST_SYSCALL_INFORMATION = *mut THREAD_LAST_SYSCALL_INFORMATION;
+STRUCT!{struct THREAD_CYCLE_TIME_INFORMATION {
+ AccumulatedCycles: ULONGLONG,
+ CurrentCycleCount: ULONGLONG,
+}}
+pub type PTHREAD_CYCLE_TIME_INFORMATION = *mut THREAD_CYCLE_TIME_INFORMATION;
+STRUCT!{struct THREAD_TEB_INFORMATION {
+ TebInformation: PVOID,
+ TebOffset: ULONG,
+ BytesToRead: ULONG,
+}}
+pub type PTHREAD_TEB_INFORMATION = *mut THREAD_TEB_INFORMATION;
+STRUCT!{struct COUNTER_READING {
+ Type: HARDWARE_COUNTER_TYPE,
+ Index: ULONG,
+ Start: ULONG64,
+ Total: ULONG64,
+}}
+pub type PCOUNTER_READING = *mut COUNTER_READING;
+STRUCT!{struct THREAD_PERFORMANCE_DATA {
+ Size: USHORT,
+ Version: USHORT,
+ ProcessorNumber: PROCESSOR_NUMBER,
+ ContextSwitches: ULONG,
+ HwCountersCount: ULONG,
+ UpdateCount: ULONG64,
+ WaitReasonBitMap: ULONG64,
+ HardwareCounters: ULONG64,
+ CycleTime: COUNTER_READING,
+ HwCounters: [COUNTER_READING; MAX_HW_COUNTERS],
+}}
+pub type PTHREAD_PERFORMANCE_DATA = *mut THREAD_PERFORMANCE_DATA;
+STRUCT!{struct THREAD_PROFILING_INFORMATION {
+ HardwareCounters: ULONG64,
+ Flags: ULONG,
+ Enable: ULONG,
+ PerformanceData: PTHREAD_PERFORMANCE_DATA,
+}}
+pub type PTHREAD_PROFILING_INFORMATION = *mut THREAD_PROFILING_INFORMATION;
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+STRUCT!{#[repr(align(16))] struct RTL_UMS_CONTEXT {
+ Link: SINGLE_LIST_ENTRY,
+ __padding: u64,
+ Context: CONTEXT,
+ Teb: PVOID,
+ UserContext: PVOID,
+ ScheduledThread: ULONG,
+ Suspended: ULONG,
+ VolatileContext: ULONG,
+ Terminated: ULONG,
+ DebugActive: ULONG,
+ RunningOnSelfThread: ULONG,
+ DenyRunningOnSelfThread: ULONG,
+ Flags: LONG,
+ KernelUpdateLock: ULONG64,
+ PrimaryClientID: ULONG64,
+ ContextLock: ULONG64,
+ PrimaryUmsContext: *mut RTL_UMS_CONTEXT,
+ SwitchCount: ULONG,
+ KernelYieldCount: ULONG,
+ MixedYieldCount: ULONG,
+ YieldCount: ULONG,
+}}
+#[cfg(target_arch = "x86")]
+STRUCT!{struct RTL_UMS_CONTEXT {
+ Link: SINGLE_LIST_ENTRY,
+ Context: CONTEXT,
+ Teb: PVOID,
+ UserContext: PVOID,
+ ScheduledThread: ULONG,
+ Suspended: ULONG,
+ VolatileContext: ULONG,
+ Terminated: ULONG,
+ DebugActive: ULONG,
+ RunningOnSelfThread: ULONG,
+ DenyRunningOnSelfThread: ULONG,
+ Flags: LONG,
+ KernelUpdateLock: ULONG64,
+ PrimaryClientID: ULONG64,
+ ContextLock: ULONG64,
+ PrimaryUmsContext: *mut RTL_UMS_CONTEXT,
+ SwitchCount: ULONG,
+ KernelYieldCount: ULONG,
+ MixedYieldCount: ULONG,
+ YieldCount: ULONG,
+ __padding: u32,
+}}
+pub type PRTL_UMS_CONTEXT = *mut RTL_UMS_CONTEXT;
+ENUM!{enum THREAD_UMS_INFORMATION_COMMAND {
+ UmsInformationCommandInvalid = 0,
+ UmsInformationCommandAttach = 1,
+ UmsInformationCommandDetach = 2,
+ UmsInformationCommandQuery = 3,
+}}
+STRUCT!{struct RTL_UMS_COMPLETION_LIST {
+ ThreadListHead: PSINGLE_LIST_ENTRY,
+ CompletionEvent: PVOID,
+ CompletionFlags: ULONG,
+ InternalListHead: SINGLE_LIST_ENTRY,
+}}
+pub type PRTL_UMS_COMPLETION_LIST = *mut RTL_UMS_COMPLETION_LIST;
+STRUCT!{struct THREAD_UMS_INFORMATION {
+ Command: THREAD_UMS_INFORMATION_COMMAND,
+ CompletionList: PRTL_UMS_COMPLETION_LIST,
+ UmsContext: PRTL_UMS_CONTEXT,
+ Flags: ULONG,
+}}
+BITFIELD!{THREAD_UMS_INFORMATION Flags: ULONG [
+ IsUmsSchedulerThread set_IsUmsSchedulerThread[0..1],
+ IsUmsWorkerThread set_IsUmsWorkerThread[1..2],
+ SpareBits set_SpareBits[2..32],
+]}
+pub type PTHREAD_UMS_INFORMATION = *mut THREAD_UMS_INFORMATION;
+STRUCT!{struct THREAD_NAME_INFORMATION {
+ ThreadName: UNICODE_STRING,
+}}
+pub type PTHREAD_NAME_INFORMATION = *mut THREAD_NAME_INFORMATION;
+ENUM!{enum SUBSYSTEM_INFORMATION_TYPE {
+ SubsystemInformationTypeWin32 = 0,
+ SubsystemInformationTypeWSL = 1,
+ MaxSubsystemInformationType = 2,
+}}
+ENUM!{enum THREAD_WORKLOAD_CLASS {
+ ThreadWorkloadClassDefault = 0,
+ ThreadWorkloadClassGraphics = 1,
+ MaxThreadWorkloadClass = 2,
+}}
+EXTERN!{extern "system" {
+ fn NtCreateProcess(
+ ProcessHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ParentProcess: HANDLE,
+ InheritObjectTable: BOOLEAN,
+ SectionHandle: HANDLE,
+ DebugPort: HANDLE,
+ ExceptionPort: HANDLE,
+ ) -> NTSTATUS;
+}}
+pub const PROCESS_CREATE_FLAGS_BREAKAWAY: ULONG = 0x00000001;
+pub const PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT: ULONG = 0x00000002;
+pub const PROCESS_CREATE_FLAGS_INHERIT_HANDLES: ULONG = 0x00000004;
+pub const PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE: ULONG = 0x00000008;
+pub const PROCESS_CREATE_FLAGS_LARGE_PAGES: ULONG = 0x00000010;
+EXTERN!{extern "system" {
+ fn NtCreateProcessEx(
+ ProcessHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ParentProcess: HANDLE,
+ Flags: ULONG,
+ SectionHandle: HANDLE,
+ DebugPort: HANDLE,
+ ExceptionPort: HANDLE,
+ JobMemberLevel: ULONG,
+ ) -> NTSTATUS;
+ fn NtOpenProcess(
+ ProcessHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ClientId: PCLIENT_ID,
+ ) -> NTSTATUS;
+ fn NtTerminateProcess(
+ ProcessHandle: HANDLE,
+ ExitStatus: NTSTATUS,
+ ) -> NTSTATUS;
+ fn NtSuspendProcess(
+ ProcessHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtResumeProcess(
+ ProcessHandle: HANDLE,
+ ) -> NTSTATUS;
+}}
+pub const NtCurrentProcess: HANDLE = -1isize as *mut c_void;
+pub const ZwCurrentProcess: HANDLE = NtCurrentProcess;
+pub const NtCurrentThread: HANDLE = -2isize as *mut c_void;
+pub const ZwCurrentThread: HANDLE = NtCurrentThread;
+pub const NtCurrentSession: HANDLE = -3isize as *mut c_void;
+pub const ZwCurrentSession: HANDLE = NtCurrentSession;
+#[inline] #[cfg(not(target_arch = "aarch64"))]
+pub unsafe fn NtCurrentPeb() -> PPEB {
+ (*NtCurrentTeb()).ProcessEnvironmentBlock
+}
+pub const NtCurrentProcessToken: HANDLE = -4isize as *mut c_void;
+pub const NtCurrentThreadToken: HANDLE = -5isize as *mut c_void;
+pub const NtCurrentEffectiveToken: HANDLE = -6isize as *mut c_void;
+pub const NtCurrentSilo: HANDLE = -1isize as *mut c_void;
+#[inline] #[cfg(not(target_arch = "aarch64"))]
+pub unsafe fn NtCurrentProcessId() -> HANDLE {
+ (*NtCurrentTeb()).ClientId.UniqueProcess
+}
+#[inline] #[cfg(not(target_arch = "aarch64"))]
+pub unsafe fn NtCurrentThreadId() -> HANDLE {
+ (*NtCurrentTeb()).ClientId.UniqueThread
+}
+EXTERN!{extern "system" {
+ fn NtQueryInformationProcess(
+ ProcessHandle: HANDLE,
+ ProcessInformationClass: PROCESSINFOCLASS,
+ ProcessInformation: PVOID,
+ ProcessInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtGetNextProcess(
+ ProcessHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ HandleAttributes: ULONG,
+ Flags: ULONG,
+ NewProcessHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn NtGetNextThread(
+ ProcessHandle: HANDLE,
+ ThreadHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ HandleAttributes: ULONG,
+ Flags: ULONG,
+ NewThreadHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn NtSetInformationProcess(
+ ProcessHandle: HANDLE,
+ ProcessInformationClass: PROCESSINFOCLASS,
+ ProcessInformation: PVOID,
+ ProcessInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtQueryPortInformationProcess() -> NTSTATUS;
+ fn NtCreateThread(
+ ThreadHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ProcessHandle: HANDLE,
+ ClientId: PCLIENT_ID,
+ ThreadContext: PCONTEXT,
+ InitialTeb: PINITIAL_TEB,
+ CreateSuspended: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtOpenThread(
+ ThreadHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ClientId: PCLIENT_ID,
+ ) -> NTSTATUS;
+ fn NtTerminateThread(
+ ThreadHandle: HANDLE,
+ ExitStatus: NTSTATUS,
+ ) -> NTSTATUS;
+ fn NtSuspendThread(
+ ThreadHandle: HANDLE,
+ PreviousSuspendCount: PULONG,
+ ) -> NTSTATUS;
+ fn NtResumeThread(
+ ThreadHandle: HANDLE,
+ PreviousSuspendCount: PULONG,
+ ) -> NTSTATUS;
+ fn NtGetCurrentProcessorNumber() -> ULONG;
+ fn NtGetContextThread(
+ ThreadHandle: HANDLE,
+ ThreadContext: PCONTEXT,
+ ) -> NTSTATUS;
+ fn NtSetContextThread(
+ ThreadHandle: HANDLE,
+ ThreadContext: PCONTEXT,
+ ) -> NTSTATUS;
+ fn NtQueryInformationThread(
+ ThreadHandle: HANDLE,
+ ThreadInformationClass: THREADINFOCLASS,
+ ThreadInformation: PVOID,
+ ThreadInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetInformationThread(
+ ThreadHandle: HANDLE,
+ ThreadInformationClass: THREADINFOCLASS,
+ ThreadInformation: PVOID,
+ ThreadInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtAlertThread(
+ ThreadHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtAlertResumeThread(
+ ThreadHandle: HANDLE,
+ PreviousSuspendCount: PULONG,
+ ) -> NTSTATUS;
+ fn NtTestAlert() -> NTSTATUS;
+ fn NtImpersonateThread(
+ ServerThreadHandle: HANDLE,
+ ClientThreadHandle: HANDLE,
+ SecurityQos: PSECURITY_QUALITY_OF_SERVICE,
+ ) -> NTSTATUS;
+ fn NtRegisterThreadTerminatePort(
+ PortHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtSetLdtEntries(
+ Selector0: ULONG,
+ Entry0Low: ULONG,
+ Entry0Hi: ULONG,
+ Selector1: ULONG,
+ Entry1Low: ULONG,
+ Entry1Hi: ULONG,
+ ) -> NTSTATUS;
+}}
+FN!{cdecl PPS_APC_ROUTINE(
+ ApcArgument1: PVOID,
+ ApcArgument2: PVOID,
+ ApcArgument3: PVOID,
+) -> ()}
+EXTERN!{extern "system" {
+ fn NtQueueApcThread(
+ ThreadHandle: HANDLE,
+ ApcRoutine: PPS_APC_ROUTINE,
+ ApcArgument1: PVOID,
+ ApcArgument2: PVOID,
+ ApcArgument3: PVOID,
+ ) -> NTSTATUS;
+}}
+pub const APC_FORCE_THREAD_SIGNAL: HANDLE = 1 as *mut c_void;
+EXTERN!{extern "system" {
+ fn NtQueueApcThreadEx(
+ ThreadHandle: HANDLE,
+ UserApcReserveHandle: HANDLE,
+ ApcRoutine: PPS_APC_ROUTINE,
+ ApcArgument1: PVOID,
+ ApcArgument2: PVOID,
+ ApcArgument3: PVOID,
+ ) -> NTSTATUS;
+ fn NtAlertThreadByThreadId(
+ ThreadId: HANDLE,
+ ) -> NTSTATUS;
+ fn NtWaitForAlertByThreadId(
+ Address: PVOID,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+}}
+pub const PS_ATTRIBUTE_NUMBER_MASK: u32 = 0x0000ffff;
+pub const PS_ATTRIBUTE_THREAD: u32 = 0x00010000;
+pub const PS_ATTRIBUTE_INPUT: u32 = 0x00020000;
+pub const PS_ATTRIBUTE_ADDITIVE: u32 = 0x00040000;
+ENUM!{enum PS_ATTRIBUTE_NUM {
+ PsAttributeParentProcess = 0,
+ PsAttributeDebugPort = 1,
+ PsAttributeToken = 2,
+ PsAttributeClientId = 3,
+ PsAttributeTebAddress = 4,
+ PsAttributeImageName = 5,
+ PsAttributeImageInfo = 6,
+ PsAttributeMemoryReserve = 7,
+ PsAttributePriorityClass = 8,
+ PsAttributeErrorMode = 9,
+ PsAttributeStdHandleInfo = 10,
+ PsAttributeHandleList = 11,
+ PsAttributeGroupAffinity = 12,
+ PsAttributePreferredNode = 13,
+ PsAttributeIdealProcessor = 14,
+ PsAttributeUmsThread = 15,
+ PsAttributeMitigationOptions = 16,
+ PsAttributeProtectionLevel = 17,
+ PsAttributeSecureProcess = 18,
+ PsAttributeJobList = 19,
+ PsAttributeChildProcessPolicy = 20,
+ PsAttributeAllApplicationPackagesPolicy = 21,
+ PsAttributeWin32kFilter = 22,
+ PsAttributeSafeOpenPromptOriginClaim = 23,
+ PsAttributeBnoIsolation = 24,
+ PsAttributeDesktopAppPolicy = 25,
+ PsAttributeChpe = 26,
+ PsAttributeMax = 27,
+}}
+#[inline]
+pub const fn PsAttributeValue(
+ mut Number: PS_ATTRIBUTE_NUM,
+ Thread: bool,
+ Input: bool,
+ Additive: bool,
+) -> ULONG_PTR {
+ Number &= PS_ATTRIBUTE_NUMBER_MASK;
+ if Thread {
+ Number |= PS_ATTRIBUTE_THREAD;
+ }
+ if Input {
+ Number |= PS_ATTRIBUTE_INPUT;
+ }
+ if Additive {
+ Number |= PS_ATTRIBUTE_ADDITIVE;
+ }
+ Number as _
+}
+pub const PS_ATTRIBUTE_PARENT_PROCESS: ULONG_PTR = 0x00060000;
+pub const PS_ATTRIBUTE_DEBUG_PORT: ULONG_PTR = 0x00060001;
+pub const PS_ATTRIBUTE_TOKEN: ULONG_PTR = 0x00060002;
+pub const PS_ATTRIBUTE_CLIENT_ID: ULONG_PTR = 0x00010003;
+pub const PS_ATTRIBUTE_TEB_ADDRESS: ULONG_PTR = 0x00010004;
+pub const PS_ATTRIBUTE_IMAGE_NAME: ULONG_PTR = 0x00020005;
+pub const PS_ATTRIBUTE_IMAGE_INFO: ULONG_PTR = 0x00000006;
+pub const PS_ATTRIBUTE_MEMORY_RESERVE: ULONG_PTR = 0x00020007;
+pub const PS_ATTRIBUTE_PRIORITY_CLASS: ULONG_PTR = 0x00020008;
+pub const PS_ATTRIBUTE_ERROR_MODE: ULONG_PTR = 0x00020009;
+pub const PS_ATTRIBUTE_STD_HANDLE_INFO: ULONG_PTR = 0x0002000a;
+pub const PS_ATTRIBUTE_HANDLE_LIST: ULONG_PTR = 0x0002000b;
+pub const PS_ATTRIBUTE_GROUP_AFFINITY: ULONG_PTR = 0x0003000c;
+pub const PS_ATTRIBUTE_PREFERRED_NODE: ULONG_PTR = 0x0002000d;
+pub const PS_ATTRIBUTE_IDEAL_PROCESSOR: ULONG_PTR = 0x0003000e;
+pub const PS_ATTRIBUTE_UMS_THREAD: ULONG_PTR = 0x0003000f;
+pub const PS_ATTRIBUTE_MITIGATION_OPTIONS: ULONG_PTR = 0x00060010;
+pub const PS_ATTRIBUTE_PROTECTION_LEVEL: ULONG_PTR = 0x00060011;
+pub const PS_ATTRIBUTE_SECURE_PROCESS: ULONG_PTR = 0x00020012;
+pub const PS_ATTRIBUTE_JOB_LIST: ULONG_PTR = 0x00020013;
+pub const PS_ATTRIBUTE_CHILD_PROCESS_POLICY: ULONG_PTR = 0x00020014;
+pub const PS_ATTRIBUTE_ALL_APPLICATION_PACKAGES_POLICY: ULONG_PTR = 0x00020015;
+pub const PS_ATTRIBUTE_WIN32K_FILTER: ULONG_PTR = 0x00020016;
+pub const PS_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM: ULONG_PTR = 0x00020017;
+pub const PS_ATTRIBUTE_BNO_ISOLATION: ULONG_PTR = 0x00020018;
+pub const PS_ATTRIBUTE_DESKTOP_APP_POLICY: ULONG_PTR = 0x00020019;
+UNION!{union PS_ATTRIBUTE_u {
+ Value: ULONG_PTR,
+ ValuePtr: PVOID,
+}}
+STRUCT!{struct PS_ATTRIBUTE {
+ Attribute: ULONG_PTR,
+ Size: SIZE_T,
+ u: PS_ATTRIBUTE_u,
+ ReturnLength: PSIZE_T,
+}}
+pub type PPS_ATTRIBUTE = *mut PS_ATTRIBUTE;
+STRUCT!{struct PS_ATTRIBUTE_LIST {
+ TotalLength: SIZE_T,
+ Attributes: [PS_ATTRIBUTE; 1],
+}}
+pub type PPS_ATTRIBUTE_LIST = *mut PS_ATTRIBUTE_LIST;
+STRUCT!{struct PS_MEMORY_RESERVE {
+ ReserveAddress: PVOID,
+ ReserveSize: SIZE_T,
+}}
+pub type PPS_MEMORY_RESERVE = *mut PS_MEMORY_RESERVE;
+ENUM!{enum PS_STD_HANDLE_STATE {
+ PsNeverDuplicate = 0,
+ PsRequestDuplicate = 1,
+ PsAlwaysDuplicate = 2,
+ PsMaxStdHandleStates = 3,
+}}
+pub const PS_STD_INPUT_HANDLE: u32 = 0x1;
+pub const PS_STD_OUTPUT_HANDLE: u32 = 0x2;
+pub const PS_STD_ERROR_HANDLE: u32 = 0x4;
+STRUCT!{struct PS_STD_HANDLE_INFO {
+ Flags: ULONG,
+ StdHandleSubsystemType: ULONG,
+}}
+pub type PPS_STD_HANDLE_INFO = *mut PS_STD_HANDLE_INFO;
+BITFIELD!{PS_STD_HANDLE_INFO Flags: ULONG [
+ StdHandleState set_StdHandleState[0..2],
+ PseudoHandleMask set_PseudoHandleMask[2..5],
+]}
+STRUCT!{struct PS_BNO_ISOLATION_PARAMETERS {
+ IsolationPrefix: UNICODE_STRING,
+ HandleCount: ULONG,
+ Handles: *mut PVOID,
+ IsolationEnabled: BOOLEAN,
+}}
+pub type PPS_BNO_ISOLATION_PARAMETERS = *mut PS_BNO_ISOLATION_PARAMETERS;
+ENUM!{enum PS_MITIGATION_OPTION {
+ PS_MITIGATION_OPTION_NX = 0,
+ PS_MITIGATION_OPTION_SEHOP = 1,
+ PS_MITIGATION_OPTION_FORCE_RELOCATE_IMAGES = 2,
+ PS_MITIGATION_OPTION_HEAP_TERMINATE = 3,
+ PS_MITIGATION_OPTION_BOTTOM_UP_ASLR = 4,
+ PS_MITIGATION_OPTION_HIGH_ENTROPY_ASLR = 5,
+ PS_MITIGATION_OPTION_STRICT_HANDLE_CHECKS = 6,
+ PS_MITIGATION_OPTION_WIN32K_SYSTEM_CALL_DISABLE = 7,
+ PS_MITIGATION_OPTION_EXTENSION_POINT_DISABLE = 8,
+ PS_MITIGATION_OPTION_PROHIBIT_DYNAMIC_CODE = 9,
+ PS_MITIGATION_OPTION_CONTROL_FLOW_GUARD = 10,
+ PS_MITIGATION_OPTION_BLOCK_NON_MICROSOFT_BINARIES = 11,
+ PS_MITIGATION_OPTION_FONT_DISABLE = 12,
+ PS_MITIGATION_OPTION_IMAGE_LOAD_NO_REMOTE = 13,
+ PS_MITIGATION_OPTION_IMAGE_LOAD_NO_LOW_LABEL = 14,
+ PS_MITIGATION_OPTION_IMAGE_LOAD_PREFER_SYSTEM32 = 15,
+ PS_MITIGATION_OPTION_RETURN_FLOW_GUARD = 16,
+ PS_MITIGATION_OPTION_LOADER_INTEGRITY_CONTINUITY = 17,
+ PS_MITIGATION_OPTION_STRICT_CONTROL_FLOW_GUARD = 18,
+ PS_MITIGATION_OPTION_RESTRICT_SET_THREAD_CONTEXT = 19,
+ PS_MITIGATION_OPTION_ROP_STACKPIVOT = 20,
+ PS_MITIGATION_OPTION_ROP_CALLER_CHECK = 21,
+ PS_MITIGATION_OPTION_ROP_SIMEXEC = 22,
+ PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER = 23,
+ PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER_PLUS = 24,
+ PS_MITIGATION_OPTION_RESTRICT_CHILD_PROCESS_CREATION = 25,
+ PS_MITIGATION_OPTION_IMPORT_ADDRESS_FILTER = 26,
+ PS_MITIGATION_OPTION_MODULE_TAMPERING_PROTECTION = 27,
+ PS_MITIGATION_OPTION_RESTRICT_INDIRECT_BRANCH_PREDICTION = 28,
+ PS_MITIGATION_OPTION_SPECULATIVE_STORE_BYPASS_DISABLE = 29,
+ PS_MITIGATION_OPTION_ALLOW_DOWNGRADE_DYNAMIC_CODE_POLICY = 30,
+ PS_MITIGATION_OPTION_CET_SHADOW_STACKS = 31,
+}}
+ENUM!{enum PS_CREATE_STATE {
+ PsCreateInitialState = 0,
+ PsCreateFailOnFileOpen = 1,
+ PsCreateFailOnSectionCreate = 2,
+ PsCreateFailExeFormat = 3,
+ PsCreateFailMachineMismatch = 4,
+ PsCreateFailExeName = 5,
+ PsCreateSuccess = 6,
+ PsCreateMaximumStates = 7,
+}}
+STRUCT!{struct PS_CREATE_INFO_u_InitState {
+ InitFlags: ULONG,
+ AdditionalFileAccess: ACCESS_MASK,
+}}
+BITFIELD!{PS_CREATE_INFO_u_InitState InitFlags: ULONG [
+ WriteOutputOnExit set_WriteOutputOnExit[0..1],
+ DetectManifest set_DetectManifest[1..2],
+ IFEOSkipDebugger set_IFEOSkipDebugger[2..3],
+ IFEODoNotPropagateKeyState set_IFEODoNotPropagateKeyState[3..4],
+ SpareBits1 set_SpareBits1[4..8],
+ SpareBits2 set_SpareBits2[8..16],
+ ProhibitedImageCharacteristics set_ProhibitedImageCharacteristics[16..32],
+]}
+STRUCT!{struct PS_CREATE_INFO_u_SuccessState {
+ OutputFlags: ULONG,
+ FileHandle: HANDLE,
+ SectionHandle: HANDLE,
+ UserProcessParametersNative: ULONGLONG,
+ UserProcessParametersWow64: ULONG,
+ CurrentParameterFlags: ULONG,
+ PebAddressNative: ULONGLONG,
+ PebAddressWow64: ULONG,
+ ManifestAddress: ULONGLONG,
+ ManifestSize: ULONG,
+}}
+BITFIELD!{PS_CREATE_INFO_u_SuccessState OutputFlags: ULONG [
+ ProtectedProcess set_ProtectedProcess[0..1],
+ AddressSpaceOverride set_AddressSpaceOverride[1..2],
+ DevOverrideEnabled set_DevOverrideEnabled[2..3],
+ ManifestDetected set_ManifestDetected[3..4],
+ ProtectedProcessLight set_ProtectedProcessLight[4..5],
+ SpareBits1 set_SpareBits1[5..8],
+ SpareBits2 set_SpareBits2[8..16],
+ SpareBits3 set_SpareBits3[16..32],
+]}
+UNION!{union PS_CREATE_INFO_u {
+ InitState: PS_CREATE_INFO_u_InitState,
+ FileHandle: HANDLE,
+ DllCharacteristics: USHORT,
+ IFEOKey: HANDLE,
+ SuccessState: PS_CREATE_INFO_u_SuccessState,
+}}
+STRUCT!{struct PS_CREATE_INFO {
+ Size: SIZE_T,
+ State: PS_CREATE_STATE,
+ u: PS_CREATE_INFO_u,
+}}
+pub type PPS_CREATE_INFO = *mut PS_CREATE_INFO;
+pub const PROCESS_CREATE_FLAGS_LARGE_PAGE_SYSTEM_DLL: ULONG = 0x00000020;
+pub const PROCESS_CREATE_FLAGS_PROTECTED_PROCESS: ULONG = 0x00000040;
+pub const PROCESS_CREATE_FLAGS_CREATE_SESSION: ULONG = 0x00000080;
+pub const PROCESS_CREATE_FLAGS_INHERIT_FROM_PARENT: ULONG = 0x00000100;
+pub const PROCESS_CREATE_FLAGS_SUSPENDED: ULONG = 0x00000200;
+pub const PROCESS_CREATE_FLAGS_EXTENDED_UNKNOWN: ULONG = 0x00000400;
+EXTERN!{extern "system" {
+ fn NtCreateUserProcess(
+ ProcessHandle: PHANDLE,
+ ThreadHandle: PHANDLE,
+ ProcessDesiredAccess: ACCESS_MASK,
+ ThreadDesiredAccess: ACCESS_MASK,
+ ProcessObjectAttributes: POBJECT_ATTRIBUTES,
+ ThreadObjectAttributes: POBJECT_ATTRIBUTES,
+ ProcessFlags: ULONG,
+ ThreadFlags: ULONG,
+ ProcessParameters: PVOID,
+ CreateInfo: PPS_CREATE_INFO,
+ AttributeList: PPS_ATTRIBUTE_LIST,
+ ) -> NTSTATUS;
+}}
+pub const THREAD_CREATE_FLAGS_CREATE_SUSPENDED: ULONG = 0x00000001;
+pub const THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH: ULONG = 0x00000002;
+pub const THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER: ULONG = 0x00000004;
+pub const THREAD_CREATE_FLAGS_HAS_SECURITY_DESCRIPTOR: ULONG = 0x00000010;
+pub const THREAD_CREATE_FLAGS_ACCESS_CHECK_IN_TARGET: ULONG = 0x00000020;
+pub const THREAD_CREATE_FLAGS_INITIAL_THREAD: ULONG = 0x00000080;
+EXTERN!{extern "system" {
+ fn NtCreateThreadEx(
+ ThreadHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ProcessHandle: HANDLE,
+ StartRoutine: PVOID,
+ Argument: PVOID,
+ CreateFlags: ULONG,
+ ZeroBits: SIZE_T,
+ StackSize: SIZE_T,
+ MaximumStackSize: SIZE_T,
+ AttributeList: PPS_ATTRIBUTE_LIST,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION {
+ BasicInfo: JOBOBJECT_BASIC_ACCOUNTING_INFORMATION,
+ IoInfo: IO_COUNTERS,
+ DiskIoInfo: PROCESS_DISK_COUNTERS,
+ ContextSwitches: ULONG64,
+ TotalCycleTime: LARGE_INTEGER,
+ ReadyTime: ULONG64,
+ EnergyValues: PROCESS_ENERGY_VALUES,
+}}
+pub type PJOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION =
+ *mut JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION;
+STRUCT!{struct JOBOBJECT_WAKE_INFORMATION {
+ NotificationChannel: HANDLE,
+ WakeCounters: [ULONG64; 7],
+}}
+pub type PJOBOBJECT_WAKE_INFORMATION = *mut JOBOBJECT_WAKE_INFORMATION;
+STRUCT!{struct JOBOBJECT_WAKE_INFORMATION_V1 {
+ NotificationChannel: HANDLE,
+ WakeCounters: [ULONG64; 4],
+}}
+pub type PJOBOBJECT_WAKE_INFORMATION_V1 = *mut JOBOBJECT_WAKE_INFORMATION_V1;
+STRUCT!{struct JOBOBJECT_INTERFERENCE_INFORMATION {
+ Count: ULONG64,
+}}
+pub type PJOBOBJECT_INTERFERENCE_INFORMATION = *mut JOBOBJECT_INTERFERENCE_INFORMATION;
+STRUCT!{struct JOBOBJECT_WAKE_FILTER {
+ HighEdgeFilter: ULONG,
+ LowEdgeFilter: ULONG,
+}}
+pub type PJOBOBJECT_WAKE_FILTER = *mut JOBOBJECT_WAKE_FILTER;
+STRUCT!{struct JOBOBJECT_FREEZE_INFORMATION {
+ Flags: ULONG,
+ Freeze: BOOLEAN,
+ Swap: BOOLEAN,
+ Reserved0: [UCHAR; 2],
+ WakeFilter: JOBOBJECT_WAKE_FILTER,
+}}
+pub type PJOBOBJECT_FREEZE_INFORMATION = *mut JOBOBJECT_FREEZE_INFORMATION;
+BITFIELD!{JOBOBJECT_FREEZE_INFORMATION Flags: ULONG [
+ FreezeOperation set_FreezeOperation[0..1],
+ FilterOperation set_FilterOperation[1..2],
+ SwapOperation set_SwapOperation[2..3],
+ Reserved set_Reserved[3..32],
+]}
+STRUCT!{struct JOBOBJECT_MEMORY_USAGE_INFORMATION {
+ JobMemory: ULONG64,
+ PeakJobMemoryUsed: ULONG64,
+}}
+pub type PJOBOBJECT_MEMORY_USAGE_INFORMATION = *mut JOBOBJECT_MEMORY_USAGE_INFORMATION;
+STRUCT!{struct JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 {
+ BasicInfo: JOBOBJECT_MEMORY_USAGE_INFORMATION,
+ JobSharedMemory: ULONG64,
+ Reserved: [ULONG64; 2],
+}}
+pub type PJOBOBJECT_MEMORY_USAGE_INFORMATION_V2 = *mut JOBOBJECT_MEMORY_USAGE_INFORMATION_V2;
+STRUCT!{struct SILO_USER_SHARED_DATA {
+ ServiceSessionId: ULONG64,
+ ActiveConsoleId: ULONG,
+ ConsoleSessionForegroundProcessId: LONGLONG,
+ NtProductType: NT_PRODUCT_TYPE,
+ SuiteMask: ULONG,
+ SharedUserSessionId: ULONG,
+ IsMultiSessionSku: BOOLEAN,
+ NtSystemRoot: [WCHAR; 260],
+ UserModeGlobalLogger: [USHORT; 16],
+}}
+pub type PSILO_USER_SHARED_DATA = *mut SILO_USER_SHARED_DATA;
+STRUCT!{struct SILOOBJECT_ROOT_DIRECTORY {
+ ControlFlags: ULONG,
+ Path: UNICODE_STRING,
+}}
+pub type PSILOOBJECT_ROOT_DIRECTORY = *mut SILOOBJECT_ROOT_DIRECTORY;
+STRUCT!{struct JOBOBJECT_ENERGY_TRACKING_STATE {
+ Value: ULONG64,
+ UpdateMask: ULONG,
+ DesiredState: ULONG,
+}}
+pub type PJOBOBJECT_ENERGY_TRACKING_STATE = *mut JOBOBJECT_ENERGY_TRACKING_STATE;
+EXTERN!{extern "system" {
+ fn NtCreateJobObject(
+ JobHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtOpenJobObject(
+ JobHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtAssignProcessToJobObject(
+ JobHandle: HANDLE,
+ ProcessHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtTerminateJobObject(
+ JobHandle: HANDLE,
+ ExitStatus: NTSTATUS,
+ ) -> NTSTATUS;
+ fn NtIsProcessInJob(
+ ProcessHandle: HANDLE,
+ JobHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtQueryInformationJobObject(
+ JobHandle: HANDLE,
+ JobObjectInformationClass: JOBOBJECTINFOCLASS,
+ JobObjectInformation: PVOID,
+ JobObjectInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetInformationJobObject(
+ JobHandle: HANDLE,
+ JobObjectInformationClass: JOBOBJECTINFOCLASS,
+ JobObjectInformation: PVOID,
+ JobObjectInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtCreateJobSet(
+ NumJob: ULONG,
+ UserJobSet: PJOB_SET_ARRAY,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn NtRevertContainerImpersonation() -> NTSTATUS;
+}}
+ENUM!{enum MEMORY_RESERVE_TYPE {
+ MemoryReserveUserApc = 0,
+ MemoryReserveIoCompletion = 1,
+ MemoryReserveTypeMax = 2,
+}}
+EXTERN!{extern "system" {
+ fn NtAllocateReserveObject(
+ MemoryReserveHandle: PHANDLE,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ Type: MEMORY_RESERVE_TYPE,
+ ) -> NTSTATUS;
+}}
diff --git a/third_party/rust/ntapi/src/ntregapi.rs b/third_party/rust/ntapi/src/ntregapi.rs
new file mode 100644
index 0000000000..ccd79b2bfa
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntregapi.rs
@@ -0,0 +1,450 @@
+use crate::ntioapi::{PIO_APC_ROUTINE, PIO_STATUS_BLOCK};
+use winapi::shared::ntdef::{
+ BOOLEAN, HANDLE, LARGE_INTEGER, NTSTATUS, OBJECT_ATTRIBUTES, PHANDLE, POBJECT_ATTRIBUTES,
+ PULONG, PUNICODE_STRING, PVOID, UCHAR, ULONG, UNICODE_STRING, USHORT, WCHAR,
+};
+use winapi::um::winnt::ACCESS_MASK;
+pub const REG_INIT_BOOT_SM: USHORT = 0x0000;
+pub const REG_INIT_BOOT_SETUP: USHORT = 0x0001;
+pub const REG_INIT_BOOT_ACCEPTED_BASE: USHORT = 0x0002;
+pub const REG_INIT_BOOT_ACCEPTED_MAX: USHORT = REG_INIT_BOOT_ACCEPTED_BASE;
+pub const REG_MAX_KEY_VALUE_NAME_LENGTH: u32 = 32767;
+pub const REG_MAX_KEY_NAME_LENGTH: u32 = 512;
+ENUM!{enum KEY_INFORMATION_CLASS {
+ KeyBasicInformation = 0,
+ KeyNodeInformation = 1,
+ KeyFullInformation = 2,
+ KeyNameInformation = 3,
+ KeyCachedInformation = 4,
+ KeyFlagsInformation = 5,
+ KeyVirtualizationInformation = 6,
+ KeyHandleTagsInformation = 7,
+ KeyTrustInformation = 8,
+ KeyLayerInformation = 9,
+ MaxKeyInfoClass = 10,
+}}
+STRUCT!{struct KEY_BASIC_INFORMATION {
+ LastWriteTime: LARGE_INTEGER,
+ TitleIndex: ULONG,
+ NameLength: ULONG,
+ Name: [WCHAR; 1],
+}}
+pub type PKEY_BASIC_INFORMATION = *mut KEY_BASIC_INFORMATION;
+STRUCT!{struct KEY_NODE_INFORMATION {
+ LastWriteTime: LARGE_INTEGER,
+ TitleIndex: ULONG,
+ ClassOffset: ULONG,
+ ClassLength: ULONG,
+ NameLength: ULONG,
+ Name: [WCHAR; 1],
+}}
+pub type PKEY_NODE_INFORMATION = *mut KEY_NODE_INFORMATION;
+STRUCT!{struct KEY_FULL_INFORMATION {
+ LastWriteTime: LARGE_INTEGER,
+ TitleIndex: ULONG,
+ ClassOffset: ULONG,
+ ClassLength: ULONG,
+ SubKeys: ULONG,
+ MaxNameLen: ULONG,
+ MaxClassLen: ULONG,
+ Values: ULONG,
+ MaxValueNameLen: ULONG,
+ MaxValueDataLen: ULONG,
+ Class: [WCHAR; 1],
+}}
+pub type PKEY_FULL_INFORMATION = *mut KEY_FULL_INFORMATION;
+STRUCT!{struct KEY_NAME_INFORMATION {
+ NameLength: ULONG,
+ Name: [WCHAR; 1],
+}}
+pub type PKEY_NAME_INFORMATION = *mut KEY_NAME_INFORMATION;
+STRUCT!{struct KEY_CACHED_INFORMATION {
+ LastWriteTime: LARGE_INTEGER,
+ TitleIndex: ULONG,
+ SubKeys: ULONG,
+ MaxNameLen: ULONG,
+ Values: ULONG,
+ MaxValueNameLen: ULONG,
+ MaxValueDataLen: ULONG,
+ NameLength: ULONG,
+ Name: [WCHAR; 1],
+}}
+pub type PKEY_CACHED_INFORMATION = *mut KEY_CACHED_INFORMATION;
+STRUCT!{struct KEY_FLAGS_INFORMATION {
+ UserFlags: ULONG,
+}}
+pub type PKEY_FLAGS_INFORMATION = *mut KEY_FLAGS_INFORMATION;
+STRUCT!{struct KEY_VIRTUALIZATION_INFORMATION {
+ Bitfields: ULONG,
+}}
+BITFIELD!{KEY_VIRTUALIZATION_INFORMATION Bitfields: ULONG [
+ VirtualizationCandidate set_VirtualizationCandidate[0..1],
+ VirtualizationEnabled set_VirtualizationEnabled[1..2],
+ VirtualTarget set_VirtualTarget[2..3],
+ VirtualStore set_VirtualStore[3..4],
+ VirtualSource set_VirtualSource[4..5],
+ Reserved set_Reserved[5..32],
+]}
+pub type PKEY_VIRTUALIZATION_INFORMATION = *mut KEY_VIRTUALIZATION_INFORMATION;
+STRUCT!{struct KEY_TRUST_INFORMATION {
+ Bitfields: ULONG,
+}}
+BITFIELD!{KEY_TRUST_INFORMATION Bitfields: ULONG [
+ TrustedKey set_TrustedKey[0..1],
+ Reserved set_Reserved[1..32],
+]}
+pub type PKEY_TRUST_INFORMATION = *mut KEY_TRUST_INFORMATION;
+STRUCT!{struct KEY_LAYER_INFORMATION {
+ IsTombstone: ULONG,
+ IsSupersedeLocal: ULONG,
+ IsSupersedeTree: ULONG,
+ ClassIsInherited: ULONG,
+ Reserved: ULONG,
+}}
+pub type PKEY_LAYER_INFORMATION = *mut KEY_LAYER_INFORMATION;
+ENUM!{enum KEY_SET_INFORMATION_CLASS {
+ KeyWriteTimeInformation = 0,
+ KeyWow64FlagsInformation = 1,
+ KeyControlFlagsInformation = 2,
+ KeySetVirtualizationInformation = 3,
+ KeySetDebugInformation = 4,
+ KeySetHandleTagsInformation = 5,
+ KeySetLayerInformation = 6,
+ MaxKeySetInfoClass = 7,
+}}
+STRUCT!{struct KEY_WRITE_TIME_INFORMATION {
+ LastWriteTime: LARGE_INTEGER,
+}}
+pub type PKEY_WRITE_TIME_INFORMATION = *mut KEY_WRITE_TIME_INFORMATION;
+STRUCT!{struct KEY_WOW64_FLAGS_INFORMATION {
+ UserFlags: ULONG,
+}}
+pub type PKEY_WOW64_FLAGS_INFORMATION = *mut KEY_WOW64_FLAGS_INFORMATION;
+STRUCT!{struct KEY_HANDLE_TAGS_INFORMATION {
+ HandleTags: ULONG,
+}}
+pub type PKEY_HANDLE_TAGS_INFORMATION = *mut KEY_HANDLE_TAGS_INFORMATION;
+STRUCT!{struct KEY_SET_LAYER_INFORMATION {
+ Bitfields: ULONG,
+}}
+BITFIELD!{KEY_SET_LAYER_INFORMATION Bitfields: ULONG [
+ IsTombstone set_IsTombstone[0..1],
+ IsSupersedeLocal set_IsSupersedeLocal[1..2],
+ IsSupersedeTree set_IsSupersedeTree[2..3],
+ ClassIsInherited set_ClassIsInherited[3..4],
+ Reserved set_Reserved[4..32],
+]}
+pub type PKEY_SET_LAYER_INFORMATION = *mut KEY_SET_LAYER_INFORMATION;
+STRUCT!{struct KEY_CONTROL_FLAGS_INFORMATION {
+ ControlFlags: ULONG,
+}}
+pub type PKEY_CONTROL_FLAGS_INFORMATION = *mut KEY_CONTROL_FLAGS_INFORMATION;
+STRUCT!{struct KEY_SET_VIRTUALIZATION_INFORMATION {
+ HandleTags: ULONG,
+}}
+BITFIELD!{KEY_SET_VIRTUALIZATION_INFORMATION HandleTags: ULONG [
+ VirtualTarget set_VirtualTarget[0..1],
+ VirtualStore set_VirtualStore[1..2],
+ VirtualSource set_VirtualSource[2..3],
+ Reserved set_Reserved[3..32],
+]}
+pub type PKEY_SET_VIRTUALIZATION_INFORMATION = *mut KEY_SET_VIRTUALIZATION_INFORMATION;
+ENUM!{enum KEY_VALUE_INFORMATION_CLASS {
+ KeyValueBasicInformation = 0,
+ KeyValueFullInformation = 1,
+ KeyValuePartialInformation = 2,
+ KeyValueFullInformationAlign64 = 3,
+ KeyValuePartialInformationAlign64 = 4,
+ KeyValueLayerInformation = 5,
+ MaxKeyValueInfoClass = 6,
+}}
+STRUCT!{struct KEY_VALUE_BASIC_INFORMATION {
+ TitleIndex: ULONG,
+ Type: ULONG,
+ NameLength: ULONG,
+ Name: [WCHAR; 1],
+}}
+pub type PKEY_VALUE_BASIC_INFORMATION = *mut KEY_VALUE_BASIC_INFORMATION;
+STRUCT!{struct KEY_VALUE_FULL_INFORMATION {
+ TitleIndex: ULONG,
+ Type: ULONG,
+ DataOffset: ULONG,
+ DataLength: ULONG,
+ NameLength: ULONG,
+ Name: [WCHAR; 1],
+}}
+pub type PKEY_VALUE_FULL_INFORMATION = *mut KEY_VALUE_FULL_INFORMATION;
+STRUCT!{struct KEY_VALUE_PARTIAL_INFORMATION {
+ TitleIndex: ULONG,
+ Type: ULONG,
+ DataLength: ULONG,
+ Data: [UCHAR; 1],
+}}
+pub type PKEY_VALUE_PARTIAL_INFORMATION = *mut KEY_VALUE_PARTIAL_INFORMATION;
+STRUCT!{struct KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 {
+ Type: ULONG,
+ DataLength: ULONG,
+ Data: [UCHAR; 1],
+}}
+pub type PKEY_VALUE_PARTIAL_INFORMATION_ALIGN64 = *mut KEY_VALUE_PARTIAL_INFORMATION_ALIGN64;
+STRUCT!{struct KEY_VALUE_LAYER_INFORMATION {
+ IsTombstone: ULONG,
+ Reserved: ULONG,
+}}
+pub type PKEY_VALUE_LAYER_INFORMATION = *mut KEY_VALUE_LAYER_INFORMATION;
+STRUCT!{struct KEY_VALUE_ENTRY {
+ ValueName: PUNICODE_STRING,
+ DataLength: ULONG,
+ DataOffset: ULONG,
+ Type: ULONG,
+}}
+pub type PKEY_VALUE_ENTRY = *mut KEY_VALUE_ENTRY;
+ENUM!{enum REG_ACTION {
+ KeyAdded = 0,
+ KeyRemoved = 1,
+ KeyModified = 2,
+}}
+STRUCT!{struct REG_NOTIFY_INFORMATION {
+ NextEntryOffset: ULONG,
+ Action: REG_ACTION,
+ KeyLength: ULONG,
+ Key: [WCHAR; 1],
+}}
+pub type PREG_NOTIFY_INFORMATION = *mut REG_NOTIFY_INFORMATION;
+STRUCT!{struct KEY_PID_ARRAY {
+ PID: HANDLE,
+ KeyName: UNICODE_STRING,
+}}
+pub type PKEY_PID_ARRAY = *mut KEY_PID_ARRAY;
+STRUCT!{struct KEY_OPEN_SUBKEYS_INFORMATION {
+ Count: ULONG,
+ KeyArray: [KEY_PID_ARRAY; 1],
+}}
+pub type PKEY_OPEN_SUBKEYS_INFORMATION = *mut KEY_OPEN_SUBKEYS_INFORMATION;
+EXTERN!{extern "system" {
+ fn NtCreateKey(
+ KeyHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ TitleIndex: ULONG,
+ Class: PUNICODE_STRING,
+ CreateOptions: ULONG,
+ Disposition: PULONG,
+ ) -> NTSTATUS;
+ fn NtCreateKeyTransacted(
+ KeyHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ TitleIndex: ULONG,
+ Class: PUNICODE_STRING,
+ CreateOptions: ULONG,
+ TransactionHandle: HANDLE,
+ Disposition: PULONG,
+ ) -> NTSTATUS;
+ fn NtOpenKey(
+ KeyHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtOpenKeyTransacted(
+ KeyHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ TransactionHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtOpenKeyEx(
+ KeyHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ OpenOptions: ULONG,
+ ) -> NTSTATUS;
+ fn NtOpenKeyTransactedEx(
+ KeyHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ OpenOptions: ULONG,
+ TransactionHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtDeleteKey(
+ KeyHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtRenameKey(
+ KeyHandle: HANDLE,
+ NewName: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn NtDeleteValueKey(
+ KeyHandle: HANDLE,
+ ValueName: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn NtQueryKey(
+ KeyHandle: HANDLE,
+ KeyInformationClass: KEY_INFORMATION_CLASS,
+ KeyInformation: PVOID,
+ Length: ULONG,
+ ResultLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetInformationKey(
+ KeyHandle: HANDLE,
+ KeySetInformationClass: KEY_SET_INFORMATION_CLASS,
+ KeySetInformation: PVOID,
+ KeySetInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtQueryValueKey(
+ KeyHandle: HANDLE,
+ ValueName: PUNICODE_STRING,
+ KeyValueInformationClass: KEY_VALUE_INFORMATION_CLASS,
+ KeyValueInformation: PVOID,
+ Length: ULONG,
+ ResultLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetValueKey(
+ KeyHandle: HANDLE,
+ ValueName: PUNICODE_STRING,
+ TitleIndex: ULONG,
+ Type: ULONG,
+ Data: PVOID,
+ DataSize: ULONG,
+ ) -> NTSTATUS;
+ fn NtQueryMultipleValueKey(
+ KeyHandle: HANDLE,
+ ValueEntries: PKEY_VALUE_ENTRY,
+ EntryCount: ULONG,
+ ValueBuffer: PVOID,
+ BufferLength: PULONG,
+ RequiredBufferLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtEnumerateKey(
+ KeyHandle: HANDLE,
+ Index: ULONG,
+ KeyInformationClass: KEY_INFORMATION_CLASS,
+ KeyInformation: PVOID,
+ Length: ULONG,
+ ResultLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtEnumerateValueKey(
+ KeyHandle: HANDLE,
+ Index: ULONG,
+ KeyValueInformationClass: KEY_VALUE_INFORMATION_CLASS,
+ KeyValueInformation: PVOID,
+ Length: ULONG,
+ ResultLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtFlushKey(
+ KeyHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtCompactKeys(
+ Count: ULONG,
+ KeyArray: *mut HANDLE,
+ ) -> NTSTATUS;
+ fn NtCompressKey(
+ Key: HANDLE,
+ ) -> NTSTATUS;
+ fn NtLoadKey(
+ TargetKey: POBJECT_ATTRIBUTES,
+ SourceFile: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtLoadKey2(
+ TargetKey: POBJECT_ATTRIBUTES,
+ SourceFile: POBJECT_ATTRIBUTES,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn NtLoadKeyEx(
+ TargetKey: POBJECT_ATTRIBUTES,
+ SourceFile: POBJECT_ATTRIBUTES,
+ Flags: ULONG,
+ TrustClassKey: HANDLE,
+ Event: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ RootHandle: PHANDLE,
+ IoStatus: PIO_STATUS_BLOCK,
+ ) -> NTSTATUS;
+ fn NtReplaceKey(
+ NewFile: POBJECT_ATTRIBUTES,
+ TargetHandle: HANDLE,
+ OldFile: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtSaveKey(
+ KeyHandle: HANDLE,
+ FileHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtSaveKeyEx(
+ KeyHandle: HANDLE,
+ FileHandle: HANDLE,
+ Format: ULONG,
+ ) -> NTSTATUS;
+ fn NtSaveMergedKeys(
+ HighPrecedenceKeyHandle: HANDLE,
+ LowPrecedenceKeyHandle: HANDLE,
+ FileHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtRestoreKey(
+ KeyHandle: HANDLE,
+ FileHandle: HANDLE,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn NtUnloadKey(
+ TargetKey: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+}}
+pub const REG_FORCE_UNLOAD: ULONG = 1;
+pub const REG_UNLOAD_LEGAL_FLAGS: ULONG = REG_FORCE_UNLOAD;
+EXTERN!{extern "system" {
+ fn NtUnloadKey2(
+ TargetKey: POBJECT_ATTRIBUTES,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn NtUnloadKeyEx(
+ TargetKey: POBJECT_ATTRIBUTES,
+ Event: HANDLE,
+ ) -> NTSTATUS;
+ fn NtNotifyChangeKey(
+ KeyHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ CompletionFilter: ULONG,
+ WatchTree: BOOLEAN,
+ Buffer: PVOID,
+ BufferSize: ULONG,
+ Asynchronous: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtNotifyChangeMultipleKeys(
+ MasterKeyHandle: HANDLE,
+ Count: ULONG,
+ SubordinateObjects: *mut OBJECT_ATTRIBUTES,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ CompletionFilter: ULONG,
+ WatchTree: BOOLEAN,
+ Buffer: PVOID,
+ BufferSize: ULONG,
+ Asynchronous: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtQueryOpenSubKeys(
+ TargetKey: POBJECT_ATTRIBUTES,
+ HandleCount: PULONG,
+ ) -> NTSTATUS;
+ fn NtQueryOpenSubKeysEx(
+ TargetKey: POBJECT_ATTRIBUTES,
+ BufferLength: ULONG,
+ Buffer: PVOID,
+ RequiredSize: PULONG,
+ ) -> NTSTATUS;
+ fn NtInitializeRegistry(
+ BootCondition: USHORT,
+ ) -> NTSTATUS;
+ fn NtLockRegistryKey(
+ KeyHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtLockProductActivationKeys(
+ pPrivateVer: *mut ULONG,
+ pSafeMode: *mut ULONG,
+ ) -> NTSTATUS;
+ fn NtFreezeRegistry(
+ TimeOutInSeconds: ULONG,
+ ) -> NTSTATUS;
+ fn NtThawRegistry() -> NTSTATUS;
+}}
diff --git a/third_party/rust/ntapi/src/ntrtl.rs b/third_party/rust/ntapi/src/ntrtl.rs
new file mode 100644
index 0000000000..abbc3862a6
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntrtl.rs
@@ -0,0 +1,4373 @@
+use core::ptr::null_mut;
+use crate::ntapi_base::{CLIENT_ID, PCLIENT_ID};
+use crate::ntexapi::{RTL_PROCESS_BACKTRACES, RTL_PROCESS_LOCKS};
+use crate::ntioapi::FILE_INFORMATION_CLASS;
+use crate::ntldr::{RTL_PROCESS_MODULES, RTL_PROCESS_MODULE_INFORMATION_EX};
+use crate::ntmmapi::SECTION_IMAGE_INFORMATION;
+use crate::ntnls::{PCPTABLEINFO, PNLSTABLEINFO};
+use crate::ntpebteb::{PPEB, PTEB_ACTIVE_FRAME};
+use crate::ntpsapi::{PINITIAL_TEB, PPS_APC_ROUTINE, PS_PROTECTION};
+use crate::ntapi_base::{PRTL_ATOM, RTL_ATOM};
+use crate::string::UTF16Const;
+use winapi::ctypes::c_void;
+use winapi::shared::basetsd::{PULONG64, ULONG32, ULONG64, PSIZE_T, PULONG_PTR, SIZE_T, ULONG_PTR};
+use winapi::shared::guiddef::GUID;
+use winapi::shared::in6addr::in6_addr;
+use winapi::shared::inaddr::in_addr;
+use winapi::shared::minwindef::{BOOL, DWORD, PBOOL};
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+use winapi::shared::ntdef::{LARGE_INTEGER, RTL_BALANCED_NODE};
+use winapi::shared::ntdef::{
+ BOOLEAN, CCHAR, CHAR, CLONG, CSHORT, HANDLE, LCID, LIST_ENTRY, LOGICAL, LONG, LUID, NTSTATUS,
+ PANSI_STRING, PBOOLEAN, PCANSI_STRING, PCCH, PCH, PCHAR, PCOEM_STRING, PCSZ, PCUNICODE_STRING,
+ PCWCH, PCWSTR, PHANDLE, PLARGE_INTEGER, PLCID, PLIST_ENTRY, PLONG, PLUID, PNT_PRODUCT_TYPE,
+ POEM_STRING, PPROCESSOR_NUMBER, PRTL_BALANCED_NODE, PSINGLE_LIST_ENTRY, PSTR, PSTRING, PUCHAR,
+ PULONG, PULONGLONG, PUNICODE_STRING, PUSHORT, PVOID, PWCH, PWCHAR, PWSTR, SINGLE_LIST_ENTRY,
+ STRING, UCHAR, ULONG, ULONGLONG, UNICODE_STRING, USHORT, VOID, WCHAR,
+};
+use winapi::um::minwinbase::PTHREAD_START_ROUTINE;
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+use winapi::um::winnt::{PGET_RUNTIME_FUNCTION_CALLBACK, PRUNTIME_FUNCTION, PWOW64_CONTEXT};
+use winapi::um::winnt::{
+ ACCESS_MASK, ACL_INFORMATION_CLASS, APC_CALLBACK_FUNCTION, HEAP_INFORMATION_CLASS,
+ HEAP_REALLOC_IN_PLACE_ONLY, HEAP_ZERO_MEMORY, OS_DEPLOYEMENT_STATE_VALUES, PACCESS_MASK, PACL,
+ PCONTEXT, PEXCEPTION_POINTERS, PEXCEPTION_RECORD, PFLS_CALLBACK_FUNCTION, PGENERIC_MAPPING,
+ PIMAGE_NT_HEADERS, PIMAGE_SECTION_HEADER, PLUID_AND_ATTRIBUTES, PMESSAGE_RESOURCE_ENTRY,
+ PPERFORMANCE_DATA, PRTL_BARRIER, PRTL_CONDITION_VARIABLE, PRTL_CRITICAL_SECTION,
+ PRTL_OSVERSIONINFOEXW, PRTL_OSVERSIONINFOW, PRTL_RESOURCE_DEBUG, PRTL_SRWLOCK,
+ PSECURITY_DESCRIPTOR, PSECURITY_DESCRIPTOR_CONTROL, PSID, PSID_AND_ATTRIBUTES,
+ PSID_AND_ATTRIBUTES_HASH, PSID_IDENTIFIER_AUTHORITY, PVECTORED_EXCEPTION_HANDLER,
+ PXSAVE_AREA_HEADER, RTL_CRITICAL_SECTION, RTL_SRWLOCK, SECURITY_DESCRIPTOR_CONTROL,
+ SECURITY_IMPERSONATION_LEVEL, SECURITY_INFORMATION, WAITORTIMERCALLBACKFUNC,
+ WORKERCALLBACKFUNC,
+};
+use winapi::vc::vadefs::va_list;
+#[inline]
+pub fn InitializeListHead(ListHead: &mut LIST_ENTRY) {
+ ListHead.Flink = ListHead;
+ ListHead.Blink = ListHead;
+}
+#[inline]
+pub fn IsListEmpty(ListHead: &LIST_ENTRY) -> bool {
+ ListHead.Flink as *const _ == ListHead as *const _
+}
+#[inline]
+pub unsafe fn RemoveEntryList(Entry: &mut LIST_ENTRY) -> bool {
+ let (Blink, Flink) = (Entry.Blink, Entry.Flink);
+ (*Blink).Flink = Flink;
+ (*Flink).Blink = Blink;
+ Flink == Blink
+}
+#[inline]
+pub unsafe fn RemoveHeadList(ListHead: &mut LIST_ENTRY) -> PLIST_ENTRY {
+ let Entry = ListHead.Flink;
+ let Flink = (*Entry).Flink;
+ ListHead.Flink = Flink;
+ (*Flink).Blink = ListHead;
+ Entry
+}
+#[inline]
+pub unsafe fn RemoveTailList(ListHead: &mut LIST_ENTRY) -> PLIST_ENTRY {
+ let Entry = ListHead.Blink;
+ let Blink = (*Entry).Blink;
+ ListHead.Blink = Blink;
+ (*Blink).Flink = ListHead;
+ Entry
+}
+#[inline]
+pub unsafe fn InsertTailList(ListHead: &mut LIST_ENTRY, Entry: &mut LIST_ENTRY) {
+ let Blink = ListHead.Blink;
+ Entry.Flink = ListHead;
+ Entry.Blink = Blink;
+ (*Blink).Flink = Entry;
+ ListHead.Blink = Entry;
+}
+#[inline]
+pub unsafe fn InsertHeadList(ListHead: &mut LIST_ENTRY, Entry: &mut LIST_ENTRY) {
+ let Flink = ListHead.Flink;
+ Entry.Flink = Flink;
+ Entry.Blink = ListHead;
+ (*Flink).Blink = Entry;
+ ListHead.Flink = Entry;
+}
+#[inline]
+pub unsafe fn AppendTailList(ListHead: &mut LIST_ENTRY, ListToAppend: &mut LIST_ENTRY) {
+ let ListEnd = ListHead.Blink;
+ (*ListHead.Blink).Flink = ListToAppend;
+ ListHead.Blink = ListToAppend.Blink;
+ (*ListToAppend.Blink).Flink = ListHead;
+ ListToAppend.Blink = ListEnd;
+}
+#[inline]
+pub unsafe fn PopEntryList(ListHead: &mut SINGLE_LIST_ENTRY) -> PSINGLE_LIST_ENTRY {
+ let FirstEntry = ListHead.Next;
+ if !FirstEntry.is_null() {
+ ListHead.Next = (*FirstEntry).Next;
+ }
+ FirstEntry
+}
+#[inline]
+pub fn PushEntryList(ListHead: &mut SINGLE_LIST_ENTRY, Entry: &mut SINGLE_LIST_ENTRY) {
+ Entry.Next = ListHead.Next;
+ ListHead.Next = Entry;
+}
+ENUM!{enum TABLE_SEARCH_RESULT {
+ TableEmptyTree = 0,
+ TableFoundNode = 1,
+ TableInsertAsLeft = 2,
+ TableInsertAsRight = 3,
+}}
+ENUM!{enum RTL_GENERIC_COMPARE_RESULTS {
+ GenericLessThan = 0,
+ GenericGreaterThan = 1,
+ GenericEqual = 2,
+}}
+FN!{stdcall PRTL_AVL_COMPARE_ROUTINE(
+ Table: *mut RTL_AVL_TABLE,
+ FirstStruct: PVOID,
+ SecondStruct: PVOID,
+) -> RTL_GENERIC_COMPARE_RESULTS}
+FN!{stdcall PRTL_AVL_ALLOCATE_ROUTINE(
+ Table: *mut RTL_AVL_TABLE,
+ ByteSize: CLONG,
+) -> PVOID}
+FN!{stdcall PRTL_AVL_FREE_ROUTINE(
+ Table: *mut RTL_AVL_TABLE,
+ Buffer: PVOID,
+) -> ()}
+FN!{stdcall PRTL_AVL_MATCH_FUNCTION(
+ Table: *mut RTL_AVL_TABLE,
+ UserData: PVOID,
+ MatchData: PVOID,
+) -> NTSTATUS}
+STRUCT!{struct RTL_BALANCED_LINKS {
+ Parent: *mut RTL_BALANCED_LINKS,
+ LeftChild: *mut RTL_BALANCED_LINKS,
+ RightChild: *mut RTL_BALANCED_LINKS,
+ Balance: CHAR,
+ Reserved: [UCHAR; 3],
+}}
+pub type PRTL_BALANCED_LINKS = *mut RTL_BALANCED_LINKS;
+STRUCT!{struct RTL_AVL_TABLE {
+ BalancedRoot: RTL_BALANCED_LINKS,
+ OrderedPointer: PVOID,
+ WhichOrderedElement: ULONG,
+ NumberGenericTableElements: ULONG,
+ DepthOfTree: ULONG,
+ RestartKey: PRTL_BALANCED_LINKS,
+ DeleteCount: ULONG,
+ CompareRoutine: PRTL_AVL_COMPARE_ROUTINE,
+ AllocateRoutine: PRTL_AVL_ALLOCATE_ROUTINE,
+ FreeRoutine: PRTL_AVL_FREE_ROUTINE,
+ TableContext: PVOID,
+}}
+pub type PRTL_AVL_TABLE = *mut RTL_AVL_TABLE;
+EXTERN!{extern "system" {
+ fn RtlInitializeGenericTableAvl(
+ Table: PRTL_AVL_TABLE,
+ CompareRoutine: PRTL_AVL_COMPARE_ROUTINE,
+ AllocateRoutine: PRTL_AVL_ALLOCATE_ROUTINE,
+ FreeRoutine: PRTL_AVL_FREE_ROUTINE,
+ TableContext: PVOID,
+ );
+ fn RtlInsertElementGenericTableAvl(
+ Table: PRTL_AVL_TABLE,
+ Buffer: PVOID,
+ BufferSize: CLONG,
+ NewElement: PBOOLEAN,
+ ) -> PVOID;
+ fn RtlInsertElementGenericTableFullAvl(
+ Table: PRTL_AVL_TABLE,
+ Buffer: PVOID,
+ BufferSize: CLONG,
+ NewElement: PBOOLEAN,
+ NodeOrParent: PVOID,
+ SearchResult: TABLE_SEARCH_RESULT,
+ ) -> PVOID;
+ fn RtlDeleteElementGenericTableAvl(
+ Table: PRTL_AVL_TABLE,
+ Buffer: PVOID,
+ ) -> BOOLEAN;
+ fn RtlLookupElementGenericTableAvl(
+ Table: PRTL_AVL_TABLE,
+ Buffer: PVOID,
+ ) -> PVOID;
+ fn RtlLookupElementGenericTableFullAvl(
+ Table: PRTL_AVL_TABLE,
+ Buffer: PVOID,
+ NodeOrParent: *mut PVOID,
+ SearchResult: *mut TABLE_SEARCH_RESULT,
+ ) -> PVOID;
+ fn RtlEnumerateGenericTableAvl(
+ Table: PRTL_AVL_TABLE,
+ Restart: BOOLEAN,
+ ) -> PVOID;
+ fn RtlEnumerateGenericTableWithoutSplayingAvl(
+ Table: PRTL_AVL_TABLE,
+ RestartKey: *mut PVOID,
+ ) -> PVOID;
+ fn RtlLookupFirstMatchingElementGenericTableAvl(
+ Table: PRTL_AVL_TABLE,
+ Buffer: PVOID,
+ RestartKey: *mut PVOID,
+ ) -> PVOID;
+ fn RtlEnumerateGenericTableLikeADirectory(
+ Table: PRTL_AVL_TABLE,
+ MatchFunction: PRTL_AVL_MATCH_FUNCTION,
+ MatchData: PVOID,
+ NextFlag: ULONG,
+ RestartKey: *mut PVOID,
+ DeleteCount: PULONG,
+ Buffer: PVOID,
+ ) -> PVOID;
+ fn RtlGetElementGenericTableAvl(
+ Table: PRTL_AVL_TABLE,
+ I: ULONG,
+ ) -> PVOID;
+ fn RtlNumberGenericTableElementsAvl(
+ Table: PRTL_AVL_TABLE,
+ ) -> ULONG;
+ fn RtlIsGenericTableEmptyAvl(
+ Table: PRTL_AVL_TABLE,
+ ) -> BOOLEAN;
+}}
+STRUCT!{struct RTL_SPLAY_LINKS {
+ Parent: *mut RTL_SPLAY_LINKS,
+ LeftChild: *mut RTL_SPLAY_LINKS,
+ RightChild: *mut RTL_SPLAY_LINKS,
+}}
+pub type PRTL_SPLAY_LINKS = *mut RTL_SPLAY_LINKS;
+#[inline]
+pub fn RtlInitializeSplayLinks(Links: &mut RTL_SPLAY_LINKS) {
+ Links.Parent = Links;
+ Links.LeftChild = null_mut();
+ Links.RightChild = null_mut();
+}
+#[inline]
+pub const fn RtlParent(Links: &RTL_SPLAY_LINKS) -> PRTL_SPLAY_LINKS {
+ Links.Parent
+}
+#[inline]
+pub const fn RtlLeftChild(Links: &RTL_SPLAY_LINKS) -> PRTL_SPLAY_LINKS {
+ Links.LeftChild
+}
+#[inline]
+pub const fn RtlRightChild(Links: &RTL_SPLAY_LINKS) -> PRTL_SPLAY_LINKS {
+ Links.RightChild
+}
+#[inline]
+pub unsafe fn RtlIsRoot(Links: *const RTL_SPLAY_LINKS) -> bool {
+ (*Links).Parent as *const _ == Links
+}
+#[inline]
+pub unsafe fn RtlIsLeftChild(Links: *const RTL_SPLAY_LINKS) -> bool {
+ RtlLeftChild(&*RtlParent(&*Links)) as *const _ == Links
+}
+#[inline]
+pub unsafe fn RtlIsRightChild(Links: *const RTL_SPLAY_LINKS) -> bool {
+ RtlRightChild(&*RtlParent(&*Links)) as *const _ == Links
+}
+#[inline]
+pub fn RtlInsertAsLeftChild(
+ ParentLinks: &mut RTL_SPLAY_LINKS,
+ ChildLinks: &mut RTL_SPLAY_LINKS,
+) {
+ ParentLinks.LeftChild = ChildLinks;
+ ChildLinks.Parent = ParentLinks;
+}
+#[inline]
+pub fn RtlInsertAsRightChild(
+ ParentLinks: &mut RTL_SPLAY_LINKS,
+ ChildLinks: &mut RTL_SPLAY_LINKS,
+) {
+ ParentLinks.RightChild = ChildLinks;
+ ChildLinks.Parent = ParentLinks;
+}
+EXTERN!{extern "system" {
+ fn RtlSplay(
+ Links: PRTL_SPLAY_LINKS,
+ ) -> PRTL_SPLAY_LINKS;
+ fn RtlDelete(
+ Links: PRTL_SPLAY_LINKS,
+ ) -> PRTL_SPLAY_LINKS;
+ fn RtlDeleteNoSplay(
+ Links: PRTL_SPLAY_LINKS,
+ Root: *mut PRTL_SPLAY_LINKS,
+ );
+ fn RtlSubtreeSuccessor(
+ Links: PRTL_SPLAY_LINKS,
+ ) -> PRTL_SPLAY_LINKS;
+ fn RtlSubtreePredecessor(
+ Links: PRTL_SPLAY_LINKS,
+ ) -> PRTL_SPLAY_LINKS;
+ fn RtlRealSuccessor(
+ Links: PRTL_SPLAY_LINKS,
+ ) -> PRTL_SPLAY_LINKS;
+ fn RtlRealPredecessor(
+ Links: PRTL_SPLAY_LINKS,
+ ) -> PRTL_SPLAY_LINKS;
+}}
+FN!{stdcall PRTL_GENERIC_COMPARE_ROUTINE(
+ Table: *mut RTL_GENERIC_TABLE,
+ FirstStruct: PVOID,
+ SecondStruct: PVOID,
+) -> RTL_GENERIC_COMPARE_RESULTS}
+FN!{stdcall PRTL_GENERIC_ALLOCATE_ROUTINE(
+ Table: *mut RTL_GENERIC_TABLE,
+ ByteSize: CLONG,
+) -> PVOID}
+FN!{stdcall PRTL_GENERIC_FREE_ROUTINE(
+ Table: *mut RTL_GENERIC_TABLE,
+ Buffer: PVOID,
+) -> ()}
+STRUCT!{struct RTL_GENERIC_TABLE {
+ TableRoot: PRTL_SPLAY_LINKS,
+ InsertOrderList: LIST_ENTRY,
+ OrderedPointer: PLIST_ENTRY,
+ WhichOrderedElement: ULONG,
+ NumberGenericTableElements: ULONG,
+ CompareRoutine: PRTL_GENERIC_COMPARE_ROUTINE,
+ AllocateRoutine: PRTL_GENERIC_ALLOCATE_ROUTINE,
+ FreeRoutine: PRTL_GENERIC_FREE_ROUTINE,
+ TableContext: PVOID,
+}}
+pub type PRTL_GENERIC_TABLE = *mut RTL_GENERIC_TABLE;
+EXTERN!{extern "system" {
+ fn RtlInitializeGenericTable(
+ Table: PRTL_GENERIC_TABLE,
+ CompareRoutine: PRTL_GENERIC_COMPARE_ROUTINE,
+ AllocateRoutine: PRTL_GENERIC_ALLOCATE_ROUTINE,
+ FreeRoutine: PRTL_GENERIC_FREE_ROUTINE,
+ TableContext: PVOID,
+ );
+ fn RtlInsertElementGenericTable(
+ Table: PRTL_GENERIC_TABLE,
+ Buffer: PVOID,
+ BufferSize: CLONG,
+ NewElement: PBOOLEAN,
+ ) -> PVOID;
+ fn RtlInsertElementGenericTableFull(
+ Table: PRTL_GENERIC_TABLE,
+ Buffer: PVOID,
+ BufferSize: CLONG,
+ NewElement: PBOOLEAN,
+ NodeOrParent: PVOID,
+ SearchResult: TABLE_SEARCH_RESULT,
+ ) -> PVOID;
+ fn RtlDeleteElementGenericTable(
+ Table: PRTL_GENERIC_TABLE,
+ Buffer: PVOID,
+ ) -> BOOLEAN;
+ fn RtlLookupElementGenericTable(
+ Table: PRTL_GENERIC_TABLE,
+ Buffer: PVOID,
+ ) -> PVOID;
+ fn RtlLookupElementGenericTableFull(
+ Table: PRTL_GENERIC_TABLE,
+ Buffer: PVOID,
+ NodeOrParent: *mut PVOID,
+ SearchResult: *mut TABLE_SEARCH_RESULT,
+ ) -> PVOID;
+ fn RtlEnumerateGenericTable(
+ Table: PRTL_GENERIC_TABLE,
+ Restart: BOOLEAN,
+ ) -> PVOID;
+ fn RtlEnumerateGenericTableWithoutSplaying(
+ Table: PRTL_GENERIC_TABLE,
+ RestartKey: *mut PVOID,
+ ) -> PVOID;
+ fn RtlGetElementGenericTable(
+ Table: PRTL_GENERIC_TABLE,
+ I: ULONG,
+ ) -> PVOID;
+ fn RtlNumberGenericTableElements(
+ Table: PRTL_GENERIC_TABLE,
+ ) -> ULONG;
+ fn RtlIsGenericTableEmpty(
+ Table: PRTL_GENERIC_TABLE,
+ ) -> BOOLEAN;
+}}
+STRUCT!{struct RTL_RB_TREE {
+ Root: PRTL_BALANCED_NODE,
+ Min: PRTL_BALANCED_NODE,
+}}
+pub type PRTL_RB_TREE = *mut RTL_RB_TREE;
+EXTERN!{extern "system" {
+ fn RtlRbInsertNodeEx(
+ Tree: PRTL_RB_TREE,
+ Parent: PRTL_BALANCED_NODE,
+ Right: BOOLEAN,
+ Node: PRTL_BALANCED_NODE,
+ );
+ fn RtlRbRemoveNode(
+ Tree: PRTL_RB_TREE,
+ Node: PRTL_BALANCED_NODE,
+ );
+}}
+pub const RTL_HASH_ALLOCATED_HEADER: u32 = 0x00000001;
+pub const RTL_HASH_RESERVED_SIGNATURE: u32 = 0;
+STRUCT!{struct RTL_DYNAMIC_HASH_TABLE_ENTRY {
+ Linkage: LIST_ENTRY,
+ Signature: ULONG_PTR,
+}}
+pub type PRTL_DYNAMIC_HASH_TABLE_ENTRY = *mut RTL_DYNAMIC_HASH_TABLE_ENTRY;
+#[inline]
+pub const fn HASH_ENTRY_KEY(x: &RTL_DYNAMIC_HASH_TABLE_ENTRY) -> ULONG_PTR {
+ x.Signature
+}
+STRUCT!{struct RTL_DYNAMIC_HASH_TABLE_CONTEXT {
+ ChainHead: PLIST_ENTRY,
+ PrevLinkage: PLIST_ENTRY,
+ Signature: ULONG_PTR,
+}}
+pub type PRTL_DYNAMIC_HASH_TABLE_CONTEXT = *mut RTL_DYNAMIC_HASH_TABLE_CONTEXT;
+STRUCT!{struct RTL_DYNAMIC_HASH_TABLE_ENUMERATOR {
+ HashEntry: RTL_DYNAMIC_HASH_TABLE_ENTRY,
+ ChainHead: PLIST_ENTRY,
+ BucketIndex: ULONG,
+}}
+pub type PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR = *mut RTL_DYNAMIC_HASH_TABLE_ENUMERATOR;
+STRUCT!{struct RTL_DYNAMIC_HASH_TABLE {
+ Flags: ULONG,
+ Shift: ULONG,
+ TableSize: ULONG,
+ Pivot: ULONG,
+ DivisorMask: ULONG,
+ NumEntries: ULONG,
+ NonEmptyBuckets: ULONG,
+ NumEnumerators: ULONG,
+ Directory: PVOID,
+}}
+pub type PRTL_DYNAMIC_HASH_TABLE = *mut RTL_DYNAMIC_HASH_TABLE;
+#[inline]
+pub fn RtlInitHashTableContext(Context: &mut RTL_DYNAMIC_HASH_TABLE_CONTEXT) {
+ Context.ChainHead = null_mut();
+ Context.PrevLinkage = null_mut();
+}
+#[inline]
+pub fn RtlInitHashTableContextFromEnumerator(
+ Context: &mut RTL_DYNAMIC_HASH_TABLE_CONTEXT,
+ Enumerator: &RTL_DYNAMIC_HASH_TABLE_ENUMERATOR,
+) {
+ Context.ChainHead = Enumerator.ChainHead;
+ Context.PrevLinkage = Enumerator.HashEntry.Linkage.Blink;
+}
+// RtlReleaseHashTableContext
+#[inline]
+pub const fn RtlTotalBucketsHashTable(HashTable: &RTL_DYNAMIC_HASH_TABLE) -> ULONG {
+ HashTable.TableSize
+}
+#[inline]
+pub const fn RtlNonEmptyBucketsHashTable(HashTable: &RTL_DYNAMIC_HASH_TABLE) -> ULONG {
+ HashTable.NonEmptyBuckets
+}
+#[inline]
+pub const fn RtlEmptyBucketsHashTable(HashTable: &RTL_DYNAMIC_HASH_TABLE) -> ULONG {
+ HashTable.TableSize - HashTable.NonEmptyBuckets
+}
+#[inline]
+pub const fn RtlTotalEntriesHashTable(HashTable: &RTL_DYNAMIC_HASH_TABLE) -> ULONG {
+ HashTable.NumEntries
+}
+#[inline]
+pub const fn RtlActiveEnumeratorsHashTable(HashTable: &RTL_DYNAMIC_HASH_TABLE) -> ULONG {
+ HashTable.NumEnumerators
+}
+EXTERN!{extern "system" {
+ fn RtlCreateHashTable(
+ HashTable: *mut PRTL_DYNAMIC_HASH_TABLE,
+ Shift: ULONG,
+ Flags: ULONG,
+ ) -> BOOLEAN;
+ fn RtlDeleteHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ );
+ fn RtlInsertEntryHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ Entry: PRTL_DYNAMIC_HASH_TABLE_ENTRY,
+ Signature: ULONG_PTR,
+ Context: PRTL_DYNAMIC_HASH_TABLE_CONTEXT,
+ ) -> BOOLEAN;
+ fn RtlRemoveEntryHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ Entry: PRTL_DYNAMIC_HASH_TABLE_ENTRY,
+ Context: PRTL_DYNAMIC_HASH_TABLE_CONTEXT,
+ ) -> BOOLEAN;
+ fn RtlLookupEntryHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ Signature: ULONG_PTR,
+ Context: PRTL_DYNAMIC_HASH_TABLE_CONTEXT,
+ ) -> PRTL_DYNAMIC_HASH_TABLE_ENTRY;
+ fn RtlGetNextEntryHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ Context: PRTL_DYNAMIC_HASH_TABLE_CONTEXT,
+ ) -> PRTL_DYNAMIC_HASH_TABLE_ENTRY;
+ fn RtlInitEnumerationHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR,
+ ) -> BOOLEAN;
+ fn RtlEnumerateEntryHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR,
+ ) -> PRTL_DYNAMIC_HASH_TABLE_ENTRY;
+ fn RtlEndEnumerationHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR,
+ );
+ fn RtlInitWeakEnumerationHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR,
+ ) -> BOOLEAN;
+ fn RtlWeaklyEnumerateEntryHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR,
+ ) -> PRTL_DYNAMIC_HASH_TABLE_ENTRY;
+ fn RtlEndWeakEnumerationHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR,
+ );
+ fn RtlExpandHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ ) -> BOOLEAN;
+ fn RtlContractHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ ) -> BOOLEAN;
+ fn RtlInitStrongEnumerationHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR,
+ ) -> BOOLEAN;
+ fn RtlStronglyEnumerateEntryHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR,
+ ) -> PRTL_DYNAMIC_HASH_TABLE_ENTRY;
+ fn RtlEndStrongEnumerationHashTable(
+ HashTable: PRTL_DYNAMIC_HASH_TABLE,
+ Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR,
+ );
+ fn RtlInitializeCriticalSection(
+ CriticalSection: PRTL_CRITICAL_SECTION,
+ ) -> NTSTATUS;
+ fn RtlInitializeCriticalSectionAndSpinCount(
+ CriticalSection: PRTL_CRITICAL_SECTION,
+ SpinCount: ULONG,
+ ) -> NTSTATUS;
+ fn RtlDeleteCriticalSection(
+ CriticalSection: PRTL_CRITICAL_SECTION,
+ ) -> NTSTATUS;
+ fn RtlEnterCriticalSection(
+ CriticalSection: PRTL_CRITICAL_SECTION,
+ ) -> NTSTATUS;
+ fn RtlLeaveCriticalSection(
+ CriticalSection: PRTL_CRITICAL_SECTION,
+ ) -> NTSTATUS;
+ fn RtlTryEnterCriticalSection(
+ CriticalSection: PRTL_CRITICAL_SECTION,
+ ) -> LOGICAL;
+ fn RtlIsCriticalSectionLocked(
+ CriticalSection: PRTL_CRITICAL_SECTION,
+ ) -> LOGICAL;
+ fn RtlIsCriticalSectionLockedByThread(
+ CriticalSection: PRTL_CRITICAL_SECTION,
+ ) -> LOGICAL;
+ fn RtlGetCriticalSectionRecursionCount(
+ CriticalSection: PRTL_CRITICAL_SECTION,
+ ) -> ULONG;
+ fn RtlSetCriticalSectionSpinCount(
+ CriticalSection: PRTL_CRITICAL_SECTION,
+ SpinCount: ULONG,
+ ) -> ULONG;
+ fn RtlQueryCriticalSectionOwner(
+ EventHandle: HANDLE,
+ ) -> HANDLE;
+ fn RtlCheckForOrphanedCriticalSections(
+ ThreadHandle: HANDLE,
+ );
+}}
+STRUCT!{struct RTL_RESOURCE {
+ CriticalSection: RTL_CRITICAL_SECTION,
+ SharedSemaphore: HANDLE,
+ NumberOfWaitingShared: ULONG,
+ ExclusiveSemaphore: HANDLE,
+ NumberOfWaitingExclusive: ULONG,
+ NumberOfActive: LONG,
+ ExclusiveOwnerThread: HANDLE,
+ Flags: ULONG,
+ DebugInfo: PRTL_RESOURCE_DEBUG,
+}}
+pub type PRTL_RESOURCE = *mut RTL_RESOURCE;
+pub const RTL_RESOURCE_FLAG_LONG_TERM: ULONG = 0x00000001;
+EXTERN!{extern "system" {
+ fn RtlInitializeResource(
+ Resource: PRTL_RESOURCE,
+ );
+ fn RtlDeleteResource(
+ Resource: PRTL_RESOURCE,
+ );
+ fn RtlAcquireResourceShared(
+ Resource: PRTL_RESOURCE,
+ Wait: BOOLEAN,
+ ) -> BOOLEAN;
+ fn RtlAcquireResourceExclusive(
+ Resource: PRTL_RESOURCE,
+ Wait: BOOLEAN,
+ ) -> BOOLEAN;
+ fn RtlReleaseResource(
+ Resource: PRTL_RESOURCE,
+ );
+ fn RtlConvertSharedToExclusive(
+ Resource: PRTL_RESOURCE,
+ );
+ fn RtlConvertExclusiveToShared(
+ Resource: PRTL_RESOURCE,
+ );
+ fn RtlInitializeSRWLock(
+ SRWLock: PRTL_SRWLOCK,
+ );
+ fn RtlAcquireSRWLockExclusive(
+ SRWLock: PRTL_SRWLOCK,
+ );
+ fn RtlAcquireSRWLockShared(
+ SRWLock: PRTL_SRWLOCK,
+ );
+ fn RtlReleaseSRWLockExclusive(
+ SRWLock: PRTL_SRWLOCK,
+ );
+ fn RtlReleaseSRWLockShared(
+ SRWLock: PRTL_SRWLOCK,
+ );
+ fn RtlTryAcquireSRWLockExclusive(
+ SRWLock: PRTL_SRWLOCK,
+ ) -> BOOLEAN;
+ fn RtlTryAcquireSRWLockShared(
+ SRWLock: PRTL_SRWLOCK,
+ ) -> BOOLEAN;
+ fn RtlAcquireReleaseSRWLockExclusive(
+ SRWLock: PRTL_SRWLOCK,
+ );
+ fn RtlInitializeConditionVariable(
+ ConditionVariable: PRTL_CONDITION_VARIABLE,
+ );
+ fn RtlSleepConditionVariableCS(
+ ConditionVariable: PRTL_CONDITION_VARIABLE,
+ CriticalSection: PRTL_CRITICAL_SECTION,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn RtlSleepConditionVariableSRW(
+ ConditionVariable: PRTL_CONDITION_VARIABLE,
+ SRWLock: PRTL_SRWLOCK,
+ Timeout: PLARGE_INTEGER,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn RtlWakeConditionVariable(
+ ConditionVariable: PRTL_CONDITION_VARIABLE,
+ );
+ fn RtlWakeAllConditionVariable(
+ ConditionVariable: PRTL_CONDITION_VARIABLE,
+ );
+}}
+pub const RTL_BARRIER_FLAGS_SPIN_ONLY: ULONG = 0x00000001;
+pub const RTL_BARRIER_FLAGS_BLOCK_ONLY: ULONG = 0x00000002;
+pub const RTL_BARRIER_FLAGS_NO_DELETE: ULONG = 0x00000004;
+EXTERN!{extern "system" {
+ fn RtlInitBarrier(
+ Barrier: PRTL_BARRIER,
+ TotalThreads: ULONG,
+ SpinCount: ULONG,
+ ) -> NTSTATUS;
+ fn RtlDeleteBarrier(
+ Barrier: PRTL_BARRIER,
+ ) -> NTSTATUS;
+ fn RtlBarrier(
+ Barrier: PRTL_BARRIER,
+ Flags: ULONG,
+ ) -> BOOLEAN;
+ fn RtlBarrierForDelete(
+ Barrier: PRTL_BARRIER,
+ Flags: ULONG,
+ ) -> BOOLEAN;
+ fn RtlWaitOnAddress(
+ Address: *mut VOID,
+ CompareAddress: PVOID,
+ AddressSize: SIZE_T,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn RtlWakeAddressAll(
+ Address: PVOID,
+ );
+ fn RtlWakeAddressSingle(
+ Address: PVOID,
+ );
+ fn RtlInitString(
+ DestinationString: PSTRING,
+ SourceString: PCSZ,
+ );
+ fn RtlInitStringEx(
+ DestinationString: PSTRING,
+ SourceString: PCSZ,
+ ) -> NTSTATUS;
+ fn RtlInitAnsiString(
+ DestinationString: PANSI_STRING,
+ SourceString: PCSZ,
+ );
+ fn RtlInitAnsiStringEx(
+ DestinationString: PANSI_STRING,
+ SourceString: PCSZ,
+ ) -> NTSTATUS;
+ fn RtlFreeAnsiString(
+ AnsiString: PANSI_STRING,
+ );
+ fn RtlFreeOemString(
+ OemString: POEM_STRING,
+ );
+ fn RtlCopyString(
+ DestinationString: PSTRING,
+ SourceString: *const STRING,
+ );
+ fn RtlUpperChar(
+ Character: CHAR,
+ ) -> CHAR;
+ fn RtlCompareString(
+ String1: *const STRING,
+ String2: *const STRING,
+ CaseInSensitive: BOOLEAN,
+ ) -> LONG;
+ fn RtlEqualString(
+ String1: *const STRING,
+ String2: *const STRING,
+ CaseInSensitive: BOOLEAN,
+ ) -> BOOLEAN;
+ fn RtlPrefixString(
+ String1: *const STRING,
+ String2: *const STRING,
+ CaseInSensitive: BOOLEAN,
+ ) -> BOOLEAN;
+ fn RtlAppendStringToString(
+ Destination: PSTRING,
+ Source: *const STRING,
+ ) -> NTSTATUS;
+ fn RtlAppendAsciizToString(
+ Destination: PSTRING,
+ Source: PSTR,
+ ) -> NTSTATUS;
+ fn RtlUpperString(
+ DestinationString: PSTRING,
+ SourceString: *const STRING,
+ );
+}}
+#[inline]
+pub unsafe fn RtlIsNullOrEmptyUnicodeString(String: PUNICODE_STRING) -> bool {
+ String.is_null() || (*String).Length == 0
+}
+#[inline]
+pub fn RtlInitEmptyUnicodeString(
+ UnicodeString: &mut UNICODE_STRING,
+ Buffer: PWCHAR,
+ MaximumLength: USHORT,
+) {
+ UnicodeString.Buffer = Buffer;
+ UnicodeString.MaximumLength = MaximumLength;
+ UnicodeString.Length = 0;
+}
+EXTERN!{extern "system" {
+ fn RtlInitUnicodeString(
+ DestinationString: PUNICODE_STRING,
+ SourceString: PCWSTR,
+ );
+ fn RtlInitUnicodeStringEx(
+ DestinationString: PUNICODE_STRING,
+ SourceString: PCWSTR,
+ ) -> NTSTATUS;
+ fn RtlCreateUnicodeString(
+ DestinationString: PUNICODE_STRING,
+ SourceString: PCWSTR,
+ ) -> BOOLEAN;
+ fn RtlCreateUnicodeStringFromAsciiz(
+ DestinationString: PUNICODE_STRING,
+ SourceString: PSTR,
+ ) -> BOOLEAN;
+ fn RtlFreeUnicodeString(
+ UnicodeString: PUNICODE_STRING,
+ );
+}}
+pub const RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE: ULONG = 0x00000001;
+pub const RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING: ULONG = 0x00000002;
+EXTERN!{extern "system" {
+ fn RtlDuplicateUnicodeString(
+ Flags: ULONG,
+ StringIn: PCUNICODE_STRING,
+ StringOut: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn RtlCopyUnicodeString(
+ DestinationString: PUNICODE_STRING,
+ SourceString: PCUNICODE_STRING,
+ );
+ fn RtlUpcaseUnicodeChar(
+ SourceCharacter: WCHAR,
+ ) -> WCHAR;
+ fn RtlDowncaseUnicodeChar(
+ SourceCharacter: WCHAR,
+ ) -> WCHAR;
+ fn RtlCompareUnicodeString(
+ String1: PCUNICODE_STRING,
+ String2: PCUNICODE_STRING,
+ CaseInSensitive: BOOLEAN,
+ ) -> LONG;
+ fn RtlCompareUnicodeStrings(
+ String1: PCWCH,
+ String1Length: SIZE_T,
+ String2: PCWCH,
+ String2Length: SIZE_T,
+ CaseInSensitive: BOOLEAN,
+ ) -> LONG;
+ fn RtlEqualUnicodeString(
+ String1: PCUNICODE_STRING,
+ String2: PCUNICODE_STRING,
+ CaseInSensitive: BOOLEAN,
+ ) -> BOOLEAN;
+}}
+pub const HASH_STRING_ALGORITHM_DEFAULT: ULONG = 0;
+pub const HASH_STRING_ALGORITHM_X65599: ULONG = 1;
+pub const HASH_STRING_ALGORITHM_INVALID: ULONG = 0xffffffff;
+EXTERN!{extern "system" {
+ fn RtlHashUnicodeString(
+ String: PCUNICODE_STRING,
+ CaseInSensitive: BOOLEAN,
+ HashAlgorithm: ULONG,
+ HashValue: PULONG,
+ ) -> NTSTATUS;
+ fn RtlValidateUnicodeString(
+ Flags: ULONG,
+ String: PCUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn RtlPrefixUnicodeString(
+ String1: PCUNICODE_STRING,
+ String2: PCUNICODE_STRING,
+ CaseInSensitive: BOOLEAN,
+ ) -> BOOLEAN;
+ fn RtlSuffixUnicodeString(
+ String1: PUNICODE_STRING,
+ String2: PUNICODE_STRING,
+ CaseInSensitive: BOOLEAN,
+ ) -> BOOLEAN;
+ fn RtlFindUnicodeSubstring(
+ FullString: PUNICODE_STRING,
+ SearchString: PUNICODE_STRING,
+ CaseInSensitive: BOOLEAN,
+ ) -> PWCHAR;
+}}
+pub const RTL_FIND_CHAR_IN_UNICODE_STRING_START_AT_END: ULONG = 0x00000001;
+pub const RTL_FIND_CHAR_IN_UNICODE_STRING_COMPLEMENT_CHAR_SET: ULONG = 0x00000002;
+pub const RTL_FIND_CHAR_IN_UNICODE_STRING_CASE_INSENSITIVE: ULONG = 0x00000004;
+EXTERN!{extern "system" {
+ fn RtlFindCharInUnicodeString(
+ Flags: ULONG,
+ StringToSearch: PUNICODE_STRING,
+ CharSet: PUNICODE_STRING,
+ NonInclusivePrefixLength: PUSHORT,
+ ) -> NTSTATUS;
+ fn RtlAppendUnicodeStringToString(
+ Destination: PUNICODE_STRING,
+ Source: PCUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn RtlAppendUnicodeToString(
+ Destination: PUNICODE_STRING,
+ Source: PCWSTR,
+ ) -> NTSTATUS;
+ fn RtlUpcaseUnicodeString(
+ DestinationString: PUNICODE_STRING,
+ SourceString: PCUNICODE_STRING,
+ AllocateDestinationString: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlDowncaseUnicodeString(
+ DestinationString: PUNICODE_STRING,
+ SourceString: PCUNICODE_STRING,
+ AllocateDestinationString: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlEraseUnicodeString(
+ String: PUNICODE_STRING,
+ );
+ fn RtlAnsiStringToUnicodeString(
+ DestinationString: PUNICODE_STRING,
+ SourceString: PCANSI_STRING,
+ AllocateDestinationString: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlUnicodeStringToAnsiString(
+ DestinationString: PANSI_STRING,
+ SourceString: PCUNICODE_STRING,
+ AllocateDestinationString: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlAnsiCharToUnicodeChar(
+ SourceCharacter: *mut PUCHAR,
+ ) -> WCHAR;
+ fn RtlUpcaseUnicodeStringToAnsiString(
+ DestinationString: PANSI_STRING,
+ SourceString: PUNICODE_STRING,
+ AllocateDestinationString: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlOemStringToUnicodeString(
+ DestinationString: PUNICODE_STRING,
+ SourceString: PCOEM_STRING,
+ AllocateDestinationString: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlUnicodeStringToOemString(
+ DestinationString: POEM_STRING,
+ SourceString: PCUNICODE_STRING,
+ AllocateDestinationString: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlUpcaseUnicodeStringToOemString(
+ DestinationString: POEM_STRING,
+ SourceString: PUNICODE_STRING,
+ AllocateDestinationString: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlUnicodeStringToCountedOemString(
+ DestinationString: POEM_STRING,
+ SourceString: PCUNICODE_STRING,
+ AllocateDestinationString: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlUpcaseUnicodeStringToCountedOemString(
+ DestinationString: POEM_STRING,
+ SourceString: PCUNICODE_STRING,
+ AllocateDestinationString: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlMultiByteToUnicodeN(
+ UnicodeString: PWCH,
+ MaxBytesInUnicodeString: ULONG,
+ BytesInUnicodeString: PULONG,
+ MultiByteString: *const CHAR,
+ BytesInMultiByteString: ULONG,
+ ) -> NTSTATUS;
+ fn RtlMultiByteToUnicodeSize(
+ BytesInUnicodeString: PULONG,
+ MultiByteString: *const CHAR,
+ BytesInMultiByteString: ULONG,
+ ) -> NTSTATUS;
+ fn RtlUnicodeToMultiByteN(
+ MultiByteString: PCHAR,
+ MaxBytesInMultiByteString: ULONG,
+ BytesInMultiByteString: PULONG,
+ UnicodeString: PCWCH,
+ BytesInUnicodeString: ULONG,
+ ) -> NTSTATUS;
+ fn RtlUnicodeToMultiByteSize(
+ BytesInMultiByteString: PULONG,
+ UnicodeString: PCWCH,
+ BytesInUnicodeString: ULONG,
+ ) -> NTSTATUS;
+ fn RtlUpcaseUnicodeToMultiByteN(
+ MultiByteString: PCHAR,
+ MaxBytesInMultiByteString: ULONG,
+ BytesInMultiByteString: PULONG,
+ UnicodeString: PCWCH,
+ BytesInUnicodeString: ULONG,
+ ) -> NTSTATUS;
+ fn RtlOemToUnicodeN(
+ UnicodeString: PWCH,
+ MaxBytesInUnicodeString: ULONG,
+ BytesInUnicodeString: PULONG,
+ OemString: PCCH,
+ BytesInOemString: ULONG,
+ ) -> NTSTATUS;
+ fn RtlUnicodeToOemN(
+ OemString: PCHAR,
+ MaxBytesInOemString: ULONG,
+ BytesInOemString: PULONG,
+ UnicodeString: PCWCH,
+ BytesInUnicodeString: ULONG,
+ ) -> NTSTATUS;
+ fn RtlUpcaseUnicodeToOemN(
+ OemString: PCHAR,
+ MaxBytesInOemString: ULONG,
+ BytesInOemString: PULONG,
+ UnicodeString: PCWCH,
+ BytesInUnicodeString: ULONG,
+ ) -> NTSTATUS;
+ fn RtlConsoleMultiByteToUnicodeN(
+ UnicodeString: PWCH,
+ MaxBytesInUnicodeString: ULONG,
+ BytesInUnicodeString: PULONG,
+ MultiByteString: PCH,
+ BytesInMultiByteString: ULONG,
+ pdwSpecialChar: PULONG,
+ ) -> NTSTATUS;
+ fn RtlUTF8ToUnicodeN(
+ UnicodeStringDestination: PWSTR,
+ UnicodeStringMaxByteCount: ULONG,
+ UnicodeStringActualByteCount: PULONG,
+ UTF8StringSource: PCCH,
+ UTF8StringByteCount: ULONG,
+ ) -> NTSTATUS;
+ fn RtlUnicodeToUTF8N(
+ UTF8StringDestination: PCHAR,
+ UTF8StringMaxByteCount: ULONG,
+ UTF8StringActualByteCount: PULONG,
+ UnicodeStringSource: PCWCH,
+ UnicodeStringByteCount: ULONG,
+ ) -> NTSTATUS;
+ fn RtlCustomCPToUnicodeN(
+ CustomCP: PCPTABLEINFO,
+ UnicodeString: PWCH,
+ MaxBytesInUnicodeString: ULONG,
+ BytesInUnicodeString: PULONG,
+ CustomCPString: PCH,
+ BytesInCustomCPString: ULONG,
+ ) -> NTSTATUS;
+ fn RtlUnicodeToCustomCPN(
+ CustomCP: PCPTABLEINFO,
+ CustomCPString: PCH,
+ MaxBytesInCustomCPString: ULONG,
+ BytesInCustomCPString: PULONG,
+ UnicodeString: PWCH,
+ BytesInUnicodeString: ULONG,
+ ) -> NTSTATUS;
+ fn RtlUpcaseUnicodeToCustomCPN(
+ CustomCP: PCPTABLEINFO,
+ CustomCPString: PCH,
+ MaxBytesInCustomCPString: ULONG,
+ BytesInCustomCPString: PULONG,
+ UnicodeString: PWCH,
+ BytesInUnicodeString: ULONG,
+ ) -> NTSTATUS;
+ fn RtlInitCodePageTable(
+ TableBase: PUSHORT,
+ CodePageTable: PCPTABLEINFO,
+ );
+ fn RtlInitNlsTables(
+ AnsiNlsBase: PUSHORT,
+ OemNlsBase: PUSHORT,
+ LanguageNlsBase: PUSHORT,
+ TableInfo: PNLSTABLEINFO,
+ );
+ fn RtlResetRtlTranslations(
+ TableInfo: PNLSTABLEINFO,
+ );
+ fn RtlIsTextUnicode(
+ Buffer: PVOID,
+ Size: ULONG,
+ Result: PULONG,
+ ) -> BOOLEAN;
+}}
+ENUM!{enum RTL_NORM_FORM {
+ NormOther = 0x0,
+ NormC = 0x1,
+ NormD = 0x2,
+ NormKC = 0x5,
+ NormKD = 0x6,
+ NormIdna = 0xd,
+ DisallowUnassigned = 0x100,
+ NormCDisallowUnassigned = 0x101,
+ NormDDisallowUnassigned = 0x102,
+ NormKCDisallowUnassigned = 0x105,
+ NormKDDisallowUnassigned = 0x106,
+ NormIdnaDisallowUnassigned = 0x10d,
+}}
+EXTERN!{extern "system" {
+ fn RtlNormalizeString(
+ NormForm: ULONG,
+ SourceString: PCWSTR,
+ SourceStringLength: LONG,
+ DestinationString: PWSTR,
+ DestinationStringLength: PLONG,
+ ) -> NTSTATUS;
+ fn RtlIsNormalizedString(
+ NormForm: ULONG,
+ SourceString: PCWSTR,
+ SourceStringLength: LONG,
+ Normalized: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlIsNameInExpression(
+ Expression: PUNICODE_STRING,
+ Name: PUNICODE_STRING,
+ IgnoreCase: BOOLEAN,
+ UpcaseTable: PWCH,
+ ) -> BOOLEAN;
+ fn RtlIsNameInUnUpcasedExpression(
+ Expression: PUNICODE_STRING,
+ Name: PUNICODE_STRING,
+ IgnoreCase: BOOLEAN,
+ UpcaseTable: PWCH,
+ ) -> BOOLEAN;
+ fn RtlEqualDomainName(
+ String1: PUNICODE_STRING,
+ String2: PUNICODE_STRING,
+ ) -> BOOLEAN;
+ fn RtlEqualComputerName(
+ String1: PUNICODE_STRING,
+ String2: PUNICODE_STRING,
+ ) -> BOOLEAN;
+ fn RtlDnsHostNameToComputerName(
+ ComputerNameString: PUNICODE_STRING,
+ DnsHostNameString: PUNICODE_STRING,
+ AllocateComputerNameString: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlStringFromGUID(
+ Guid: *const GUID,
+ GuidString: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn RtlStringFromGUIDEx(
+ Guid: *mut GUID,
+ GuidString: PUNICODE_STRING,
+ AllocateGuidString: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlGUIDFromString(
+ GuidString: PCUNICODE_STRING,
+ Guid: *mut GUID,
+ ) -> NTSTATUS;
+ fn RtlCompareAltitudes(
+ Altitude1: PCUNICODE_STRING,
+ Altitude2: PCUNICODE_STRING,
+ ) -> LONG;
+ fn RtlIdnToAscii(
+ Flags: ULONG,
+ SourceString: PCWSTR,
+ SourceStringLength: LONG,
+ DestinationString: PWSTR,
+ DestinationStringLength: PLONG,
+ ) -> NTSTATUS;
+ fn RtlIdnToUnicode(
+ Flags: ULONG,
+ SourceString: PCWSTR,
+ SourceStringLength: LONG,
+ DestinationString: PWSTR,
+ DestinationStringLength: PLONG,
+ ) -> NTSTATUS;
+ fn RtlIdnToNameprepUnicode(
+ Flags: ULONG,
+ SourceString: PCWSTR,
+ SourceStringLength: LONG,
+ DestinationString: PWSTR,
+ DestinationStringLength: PLONG,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct PREFIX_TABLE_ENTRY {
+ NodeTypeCode: CSHORT,
+ NameLength: CSHORT,
+ NextPrefixTree: *mut PREFIX_TABLE_ENTRY,
+ Links: RTL_SPLAY_LINKS,
+ Prefix: PSTRING,
+}}
+pub type PPREFIX_TABLE_ENTRY = *mut PREFIX_TABLE_ENTRY;
+STRUCT!{struct PREFIX_TABLE {
+ NodeTypeCode: CSHORT,
+ NameLength: CSHORT,
+ NextPrefixTree: PPREFIX_TABLE_ENTRY,
+}}
+pub type PPREFIX_TABLE = *mut PREFIX_TABLE;
+EXTERN!{extern "system" {
+ fn PfxInitialize(
+ PrefixTable: PPREFIX_TABLE,
+ );
+ fn PfxInsertPrefix(
+ PrefixTable: PPREFIX_TABLE,
+ Prefix: PSTRING,
+ PrefixTableEntry: PPREFIX_TABLE_ENTRY,
+ ) -> BOOLEAN;
+ fn PfxRemovePrefix(
+ PrefixTable: PPREFIX_TABLE,
+ PrefixTableEntry: PPREFIX_TABLE_ENTRY,
+ );
+ fn PfxFindPrefix(
+ PrefixTable: PPREFIX_TABLE,
+ FullName: PSTRING,
+ ) -> PPREFIX_TABLE_ENTRY;
+}}
+STRUCT!{struct UNICODE_PREFIX_TABLE_ENTRY {
+ NodeTypeCode: CSHORT,
+ NameLength: CSHORT,
+ NextPrefixTree: *mut UNICODE_PREFIX_TABLE_ENTRY,
+ CaseMatch: *mut UNICODE_PREFIX_TABLE_ENTRY,
+ Links: RTL_SPLAY_LINKS,
+ Prefix: PUNICODE_STRING,
+}}
+pub type PUNICODE_PREFIX_TABLE_ENTRY = *mut UNICODE_PREFIX_TABLE_ENTRY;
+STRUCT!{struct UNICODE_PREFIX_TABLE {
+ NodeTypeCode: CSHORT,
+ NameLength: CSHORT,
+ NextPrefixTree: PUNICODE_PREFIX_TABLE_ENTRY,
+ LastNextEntry: PUNICODE_PREFIX_TABLE_ENTRY,
+}}
+pub type PUNICODE_PREFIX_TABLE = *mut UNICODE_PREFIX_TABLE;
+EXTERN!{extern "system" {
+ fn RtlInitializeUnicodePrefix(
+ PrefixTable: PUNICODE_PREFIX_TABLE,
+ );
+ fn RtlInsertUnicodePrefix(
+ PrefixTable: PUNICODE_PREFIX_TABLE,
+ Prefix: PUNICODE_STRING,
+ PrefixTableEntry: PUNICODE_PREFIX_TABLE_ENTRY,
+ ) -> BOOLEAN;
+ fn RtlRemoveUnicodePrefix(
+ PrefixTable: PUNICODE_PREFIX_TABLE,
+ PrefixTableEntry: PUNICODE_PREFIX_TABLE_ENTRY,
+ );
+ fn RtlFindUnicodePrefix(
+ PrefixTable: PUNICODE_PREFIX_TABLE,
+ FullName: PCUNICODE_STRING,
+ CaseInsensitiveIndex: ULONG,
+ ) -> PUNICODE_PREFIX_TABLE_ENTRY;
+ fn RtlNextUnicodePrefix(
+ PrefixTable: PUNICODE_PREFIX_TABLE,
+ Restart: BOOLEAN,
+ ) -> PUNICODE_PREFIX_TABLE_ENTRY;
+}}
+STRUCT!{struct COMPRESSED_DATA_INFO {
+ CompressionFormatAndEngine: USHORT,
+ CompressionUnitShift: UCHAR,
+ ChunkShift: UCHAR,
+ ClusterShift: UCHAR,
+ Reserved: UCHAR,
+ NumberOfChunks: USHORT,
+ CompressedChunkSizes: [ULONG; 1],
+}}
+pub type PCOMPRESSED_DATA_INFO = *mut COMPRESSED_DATA_INFO;
+EXTERN!{extern "system" {
+ fn RtlGetCompressionWorkSpaceSize(
+ CompressionFormatAndEngine: USHORT,
+ CompressBufferWorkSpaceSize: PULONG,
+ CompressFragmentWorkSpaceSize: PULONG,
+ ) -> NTSTATUS;
+ fn RtlCompressBuffer(
+ CompressionFormatAndEngine: USHORT,
+ UncompressedBuffer: PUCHAR,
+ UncompressedBufferSize: ULONG,
+ CompressedBuffer: PUCHAR,
+ CompressedBufferSize: ULONG,
+ UncompressedChunkSize: ULONG,
+ FinalCompressedSize: PULONG,
+ WorkSpace: PVOID,
+ ) -> NTSTATUS;
+ fn RtlDecompressBuffer(
+ CompressionFormat: USHORT,
+ UncompressedBuffer: PUCHAR,
+ UncompressedBufferSize: ULONG,
+ CompressedBuffer: PUCHAR,
+ CompressedBufferSize: ULONG,
+ FinalUncompressedSize: PULONG,
+ ) -> NTSTATUS;
+ fn RtlDecompressBufferEx(
+ CompressionFormat: USHORT,
+ UncompressedBuffer: PUCHAR,
+ UncompressedBufferSize: ULONG,
+ CompressedBuffer: PUCHAR,
+ CompressedBufferSize: ULONG,
+ FinalUncompressedSize: PULONG,
+ WorkSpace: PVOID,
+ ) -> NTSTATUS;
+ fn RtlDecompressFragment(
+ CompressionFormat: USHORT,
+ UncompressedFragment: PUCHAR,
+ UncompressedFragmentSize: ULONG,
+ CompressedBuffer: PUCHAR,
+ CompressedBufferSize: ULONG,
+ FragmentOffset: ULONG,
+ FinalUncompressedSize: PULONG,
+ WorkSpace: PVOID,
+ ) -> NTSTATUS;
+ fn RtlDescribeChunk(
+ CompressionFormat: USHORT,
+ CompressedBuffer: *mut PUCHAR,
+ EndOfCompressedBufferPlus1: PUCHAR,
+ ChunkBuffer: *mut PUCHAR,
+ ChunkSize: PULONG,
+ ) -> NTSTATUS;
+ fn RtlReserveChunk(
+ CompressionFormat: USHORT,
+ CompressedBuffer: *mut PUCHAR,
+ EndOfCompressedBufferPlus1: PUCHAR,
+ ChunkBuffer: *mut PUCHAR,
+ ChunkSize: ULONG,
+ ) -> NTSTATUS;
+ fn RtlDecompressChunks(
+ UncompressedBuffer: PUCHAR,
+ UncompressedBufferSize: ULONG,
+ CompressedBuffer: PUCHAR,
+ CompressedBufferSize: ULONG,
+ CompressedTail: PUCHAR,
+ CompressedTailSize: ULONG,
+ CompressedDataInfo: PCOMPRESSED_DATA_INFO,
+ ) -> NTSTATUS;
+ fn RtlCompressChunks(
+ UncompressedBuffer: PUCHAR,
+ UncompressedBufferSize: ULONG,
+ CompressedBuffer: PUCHAR,
+ CompressedBufferSize: ULONG,
+ CompressedDataInfo: PCOMPRESSED_DATA_INFO,
+ CompressedDataInfoLength: ULONG,
+ WorkSpace: PVOID,
+ ) -> NTSTATUS;
+ fn RtlConvertLCIDToString(
+ LcidValue: LCID,
+ Base: ULONG,
+ Padding: ULONG,
+ pResultBuf: PWSTR,
+ Size: ULONG,
+ ) -> NTSTATUS;
+ fn RtlIsValidLocaleName(
+ LocaleName: PWSTR,
+ Flags: ULONG,
+ ) -> BOOLEAN;
+ fn RtlGetParentLocaleName(
+ LocaleName: PWSTR,
+ ParentLocaleName: PUNICODE_STRING,
+ Flags: ULONG,
+ AllocateDestinationString: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlLcidToLocaleName(
+ lcid: LCID,
+ LocaleName: PUNICODE_STRING,
+ Flags: ULONG,
+ AllocateDestinationString: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlLocaleNameToLcid(
+ LocaleName: PWSTR,
+ lcid: PLCID,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn RtlLCIDToCultureName(
+ Lcid: LCID,
+ String: PUNICODE_STRING,
+ ) -> BOOLEAN;
+ fn RtlCultureNameToLCID(
+ String: PUNICODE_STRING,
+ Lcid: PLCID,
+ ) -> BOOLEAN;
+ fn RtlCleanUpTEBLangLists();
+ fn RtlGetLocaleFileMappingAddress(
+ BaseAddress: *mut PVOID,
+ DefaultLocaleId: PLCID,
+ DefaultCasingTableSize: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn RtlGetCurrentPeb() -> PPEB;
+ fn RtlAcquirePebLock();
+ fn RtlReleasePebLock();
+ fn RtlTryAcquirePebLock() -> LOGICAL;
+ fn RtlAllocateFromPeb(
+ Size: ULONG,
+ Block: *mut PVOID,
+ ) -> NTSTATUS;
+ fn RtlFreeToPeb(
+ Block: PVOID,
+ Size: ULONG,
+ ) -> NTSTATUS;
+}}
+pub const DOS_MAX_COMPONENT_LENGTH: u32 = 255;
+pub const DOS_MAX_PATH_LENGTH: u32 = DOS_MAX_COMPONENT_LENGTH + 5;
+STRUCT!{struct CURDIR {
+ DosPath: UNICODE_STRING,
+ Handle: HANDLE,
+}}
+pub type PCURDIR = *mut CURDIR;
+pub const RTL_USER_PROC_CURDIR_CLOSE: u32 = 0x00000002;
+pub const RTL_USER_PROC_CURDIR_INHERIT: u32 = 0x00000003;
+STRUCT!{struct RTL_DRIVE_LETTER_CURDIR {
+ Flags: USHORT,
+ Length: USHORT,
+ TimeStamp: ULONG,
+ DosPath: STRING,
+}}
+pub type PRTL_DRIVE_LETTER_CURDIR = *mut RTL_DRIVE_LETTER_CURDIR;
+pub const RTL_MAX_DRIVE_LETTERS: usize = 32;
+pub const RTL_DRIVE_LETTER_VALID: USHORT = 0x0001;
+STRUCT!{struct RTL_USER_PROCESS_PARAMETERS {
+ MaximumLength: ULONG,
+ Length: ULONG,
+ Flags: ULONG,
+ DebugFlags: ULONG,
+ ConsoleHandle: HANDLE,
+ ConsoleFlags: ULONG,
+ StandardInput: HANDLE,
+ StandardOutput: HANDLE,
+ StandardError: HANDLE,
+ CurrentDirectory: CURDIR,
+ DllPath: UNICODE_STRING,
+ ImagePathName: UNICODE_STRING,
+ CommandLine: UNICODE_STRING,
+ Environment: PVOID,
+ StartingX: ULONG,
+ StartingY: ULONG,
+ CountX: ULONG,
+ CountY: ULONG,
+ CountCharsX: ULONG,
+ CountCharsY: ULONG,
+ FillAttribute: ULONG,
+ WindowFlags: ULONG,
+ ShowWindowFlags: ULONG,
+ WindowTitle: UNICODE_STRING,
+ DesktopInfo: UNICODE_STRING,
+ ShellInfo: UNICODE_STRING,
+ RuntimeData: UNICODE_STRING,
+ CurrentDirectories: [RTL_DRIVE_LETTER_CURDIR; RTL_MAX_DRIVE_LETTERS],
+ EnvironmentSize: ULONG_PTR,
+ EnvironmentVersion: ULONG_PTR,
+ PackageDependencyData: PVOID,
+ ProcessGroupId: ULONG,
+ LoaderThreads: ULONG,
+}}
+pub type PRTL_USER_PROCESS_PARAMETERS = *mut RTL_USER_PROCESS_PARAMETERS;
+pub const RTL_USER_PROC_PARAMS_NORMALIZED: ULONG = 0x00000001;
+pub const RTL_USER_PROC_PROFILE_USER: ULONG = 0x00000002;
+pub const RTL_USER_PROC_PROFILE_KERNEL: ULONG = 0x00000004;
+pub const RTL_USER_PROC_PROFILE_SERVER: ULONG = 0x00000008;
+pub const RTL_USER_PROC_RESERVE_1MB: ULONG = 0x00000020;
+pub const RTL_USER_PROC_RESERVE_16MB: ULONG = 0x00000040;
+pub const RTL_USER_PROC_CASE_SENSITIVE: ULONG = 0x00000080;
+pub const RTL_USER_PROC_DISABLE_HEAP_DECOMMIT: ULONG = 0x00000100;
+pub const RTL_USER_PROC_DLL_REDIRECTION_LOCAL: ULONG = 0x00001000;
+pub const RTL_USER_PROC_APP_MANIFEST_PRESENT: ULONG = 0x00002000;
+pub const RTL_USER_PROC_IMAGE_KEY_MISSING: ULONG = 0x00004000;
+pub const RTL_USER_PROC_OPTIN_PROCESS: ULONG = 0x00020000;
+EXTERN!{extern "system" {
+ fn RtlCreateProcessParameters(
+ pProcessParameters: *mut PRTL_USER_PROCESS_PARAMETERS,
+ ImagePathName: PUNICODE_STRING,
+ DllPath: PUNICODE_STRING,
+ CurrentDirectory: PUNICODE_STRING,
+ CommandLine: PUNICODE_STRING,
+ Environment: PVOID,
+ WindowTitle: PUNICODE_STRING,
+ DesktopInfo: PUNICODE_STRING,
+ ShellInfo: PUNICODE_STRING,
+ RuntimeData: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn RtlCreateProcessParametersEx(
+ pProcessParameters: *mut PRTL_USER_PROCESS_PARAMETERS,
+ ImagePathName: PUNICODE_STRING,
+ DllPath: PUNICODE_STRING,
+ CurrentDirectory: PUNICODE_STRING,
+ CommandLine: PUNICODE_STRING,
+ Environment: PVOID,
+ WindowTitle: PUNICODE_STRING,
+ DesktopInfo: PUNICODE_STRING,
+ ShellInfo: PUNICODE_STRING,
+ RuntimeData: PUNICODE_STRING,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn RtlDestroyProcessParameters(
+ ProcessParameters: PRTL_USER_PROCESS_PARAMETERS,
+ ) -> NTSTATUS;
+ fn RtlNormalizeProcessParams(
+ ProcessParameters: PRTL_USER_PROCESS_PARAMETERS,
+ ) -> PRTL_USER_PROCESS_PARAMETERS;
+ fn RtlDeNormalizeProcessParams(
+ ProcessParameters: PRTL_USER_PROCESS_PARAMETERS,
+ ) -> PRTL_USER_PROCESS_PARAMETERS;
+}}
+STRUCT!{struct RTL_USER_PROCESS_INFORMATION {
+ Length: ULONG,
+ Process: HANDLE,
+ Thread: HANDLE,
+ ClientId: CLIENT_ID,
+ ImageInformation: SECTION_IMAGE_INFORMATION,
+}}
+pub type PRTL_USER_PROCESS_INFORMATION = *mut RTL_USER_PROCESS_INFORMATION;
+EXTERN!{extern "system" {
+ fn RtlCreateUserProcess(
+ NtImagePathName: PUNICODE_STRING,
+ AttributesDeprecated: ULONG,
+ ProcessParameters: PRTL_USER_PROCESS_PARAMETERS,
+ ProcessSecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ThreadSecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ParentProcess: HANDLE,
+ InheritHandles: BOOLEAN,
+ DebugPort: HANDLE,
+ TokenHandle: HANDLE,
+ ProcessInformation: PRTL_USER_PROCESS_INFORMATION,
+ ) -> NTSTATUS;
+ fn RtlCreateUserProcessEx(
+ NtImagePathName: PUNICODE_STRING,
+ ProcessParameters: PRTL_USER_PROCESS_PARAMETERS,
+ InheritHandles: BOOLEAN,
+ Flags: ULONG,
+ ProcessInformation: PRTL_USER_PROCESS_INFORMATION,
+ ) -> NTSTATUS;
+ fn RtlExitUserProcess(
+ ExitStatus: NTSTATUS,
+ );
+}}
+pub const RTL_CLONE_PROCESS_FLAGS_CREATE_SUSPENDED: ULONG = 0x00000001;
+pub const RTL_CLONE_PROCESS_FLAGS_INHERIT_HANDLES: ULONG = 0x00000002;
+pub const RTL_CLONE_PROCESS_FLAGS_NO_SYNCHRONIZE: ULONG = 0x00000004;
+EXTERN!{extern "system" {
+ fn RtlCloneUserProcess(
+ ProcessFlags: ULONG,
+ ProcessSecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ThreadSecurityDescriptor: PSECURITY_DESCRIPTOR,
+ DebugPort: HANDLE,
+ ProcessInformation: PRTL_USER_PROCESS_INFORMATION,
+ ) -> NTSTATUS;
+ fn RtlUpdateClonedCriticalSection(
+ CriticalSection: PRTL_CRITICAL_SECTION,
+ );
+ fn RtlUpdateClonedSRWLock(
+ SRWLock: PRTL_SRWLOCK,
+ Shared: LOGICAL,
+ );
+}}
+STRUCT!{struct RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION {
+ ReflectionProcessHandle: HANDLE,
+ ReflectionThreadHandle: HANDLE,
+ ReflectionClientId: CLIENT_ID,
+}}
+pub type PRTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION =
+ *mut RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION;
+EXTERN!{extern "system" {
+ fn RtlCreateProcessReflection(
+ ProcessHandle: HANDLE,
+ Flags: ULONG,
+ StartRoutine: PVOID,
+ StartContext: PVOID,
+ EventHandle: HANDLE,
+ ReflectionInformation: PRTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION,
+ ) -> NTSTATUS;
+}}
+EXTERN!{extern "C" {
+ fn RtlSetProcessIsCritical(
+ NewValue: BOOLEAN,
+ OldValue: PBOOLEAN,
+ CheckFlag: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlSetThreadIsCritical(
+ NewValue: BOOLEAN,
+ OldValue: PBOOLEAN,
+ CheckFlag: BOOLEAN,
+ ) -> NTSTATUS;
+}}
+EXTERN!{extern "system" {
+ fn RtlValidProcessProtection(
+ ProcessProtection: PS_PROTECTION,
+ ) -> BOOLEAN;
+ fn RtlTestProtectedAccess(
+ Source: PS_PROTECTION,
+ Target: PS_PROTECTION,
+ ) -> BOOLEAN;
+ fn RtlIsCurrentProcess(
+ ProcessHandle: HANDLE,
+ ) -> BOOLEAN;
+ fn RtlIsCurrentThread(
+ ThreadHandle: HANDLE,
+ ) -> BOOLEAN;
+}}
+FN!{stdcall PUSER_THREAD_START_ROUTINE(
+ ThreadParameter: PVOID,
+) -> NTSTATUS}
+EXTERN!{extern "system" {
+ fn RtlCreateUserThread(
+ Process: HANDLE,
+ ThreadSecurityDescriptor: PSECURITY_DESCRIPTOR,
+ CreateSuspended: BOOLEAN,
+ ZeroBits: ULONG,
+ MaximumStackSize: SIZE_T,
+ CommittedStackSize: SIZE_T,
+ StartAddress: PUSER_THREAD_START_ROUTINE,
+ Parameter: PVOID,
+ Thread: PHANDLE,
+ ClientId: PCLIENT_ID,
+ ) -> NTSTATUS;
+ fn RtlExitUserThread(
+ ExitStatus: NTSTATUS,
+ );
+ fn RtlIsCurrentThreadAttachExempt() -> BOOLEAN;
+ fn RtlCreateUserStack(
+ CommittedStackSize: SIZE_T,
+ MaximumStackSize: SIZE_T,
+ ZeroBits: ULONG_PTR,
+ PageSize: SIZE_T,
+ ReserveAlignment: ULONG_PTR,
+ InitialTeb: PINITIAL_TEB,
+ ) -> NTSTATUS;
+ fn RtlFreeUserStack(
+ AllocationBase: PVOID,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct CONTEXT_CHUNK {
+ Offset: LONG,
+ Length: ULONG,
+}}
+pub type PCONTEXT_CHUNK = *mut CONTEXT_CHUNK;
+STRUCT!{struct CONTEXT_EX {
+ All: CONTEXT_CHUNK,
+ Legacy: CONTEXT_CHUNK,
+ XState: CONTEXT_CHUNK,
+}}
+pub type PCONTEXT_EX = *mut CONTEXT_EX;
+pub const CONTEXT_EX_LENGTH: usize = 4096;
+#[macro_export]
+macro_rules! RTL_CONTEXT_EX_OFFSET {
+ ($ContextEx:expr, $Chunk:ident) => {
+ (*$ContextEx).$Chunk.Offset
+ };
+}
+#[macro_export]
+macro_rules! RTL_CONTEXT_EX_LENGTH {
+ ($ContextEx:expr, $Chunk:ident) => {
+ (*$ContextEx).$Chunk.Length
+ };
+}
+#[macro_export]
+macro_rules! RTL_CONTEXT_EX_CHUNK {
+ ($Base:expr, $Layout:expr, $Chunk:ident) => {
+ ($Base as usize + RTL_CONTEXT_EX_OFFSET!($Layout, $Chunk) as usize) as *mut c_void
+ };
+}
+#[macro_export]
+macro_rules! RTL_CONTEXT_OFFSET {
+ ($Context:expr, $Chunk:ident) => {
+ RTL_CONTEXT_EX_OFFSET!(($Context as *const $crate::winapi::um::winnt::CONTEXT).offset(1)
+ as *const $crate::ntrtl::CONTEXT_EX, $Chunk)
+ };
+}
+#[macro_export]
+macro_rules! RTL_CONTEXT_LENGTH {
+ ($Context:expr, $Chunk:ident) => {
+ RTL_CONTEXT_EX_LENGTH!(($Context as *const $crate::winapi::um::winnt::CONTEXT).offset(1)
+ as *const $crate::ntrtl::CONTEXT_EX, $Chunk)
+ };
+}
+#[macro_export]
+macro_rules! RTL_CONTEXT_CHUNK {
+ ($Context:expr, $Chunk:ident) => {
+ RTL_CONTEXT_EX_CHUNK!(
+ ($Context as *const $crate::winapi::um::winnt::CONTEXT).offset(1)
+ as *const $crate::ntrtl::CONTEXT_EX,
+ ($Context as *const $crate::winapi::um::winnt::CONTEXT).offset(1)
+ as *const $crate::ntrtl::CONTEXT_EX,
+ $Chunk
+ )
+ };
+}
+EXTERN!{extern "system" {
+ fn RtlInitializeContext(
+ Process: HANDLE,
+ Context: PCONTEXT,
+ Parameter: PVOID,
+ InitialPc: PVOID,
+ InitialSp: PVOID,
+ );
+ fn RtlInitializeExtendedContext(
+ Context: PCONTEXT,
+ ContextFlags: ULONG,
+ ContextEx: *mut PCONTEXT_EX,
+ ) -> ULONG;
+ fn RtlCopyExtendedContext(
+ Destination: PCONTEXT_EX,
+ ContextFlags: ULONG,
+ Source: PCONTEXT_EX,
+ ) -> ULONG;
+ fn RtlGetExtendedContextLength(
+ ContextFlags: ULONG,
+ ContextLength: PULONG,
+ ) -> ULONG;
+ fn RtlGetExtendedFeaturesMask(
+ ContextEx: PCONTEXT_EX,
+ ) -> ULONG64;
+ fn RtlLocateExtendedFeature(
+ ContextEx: PCONTEXT_EX,
+ FeatureId: ULONG,
+ Length: PULONG,
+ ) -> PVOID;
+ fn RtlLocateLegacyContext(
+ ContextEx: PCONTEXT_EX,
+ Length: PULONG,
+ ) -> PCONTEXT;
+ fn RtlSetExtendedFeaturesMask(
+ ContextEx: PCONTEXT_EX,
+ FeatureMask: ULONG64,
+ );
+}}
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+EXTERN!{extern "system" {
+ fn RtlWow64GetThreadContext(
+ ThreadHandle: HANDLE,
+ ThreadContext: PWOW64_CONTEXT,
+ ) -> NTSTATUS;
+ fn RtlWow64SetThreadContext(
+ ThreadHandle: HANDLE,
+ ThreadContext: PWOW64_CONTEXT,
+ ) -> NTSTATUS;
+}}
+EXTERN!{extern "system" {
+ fn RtlRemoteCall(
+ Process: HANDLE,
+ Thread: HANDLE,
+ CallSite: PVOID,
+ ArgumentCount: ULONG,
+ Arguments: PULONG_PTR,
+ PassContext: BOOLEAN,
+ AlreadySuspended: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlAddVectoredExceptionHandler(
+ First: ULONG,
+ Handler: PVECTORED_EXCEPTION_HANDLER,
+ ) -> PVOID;
+ fn RtlRemoveVectoredExceptionHandler(
+ Handle: PVOID,
+ ) -> ULONG;
+ fn RtlAddVectoredContinueHandler(
+ First: ULONG,
+ Handler: PVECTORED_EXCEPTION_HANDLER,
+ ) -> PVOID;
+ fn RtlRemoveVectoredContinueHandler(
+ Handle: PVOID,
+ ) -> ULONG;
+}}
+FN!{stdcall PRTLP_UNHANDLED_EXCEPTION_FILTER(
+ ExceptionInfo: PEXCEPTION_POINTERS,
+) -> ULONG}
+EXTERN!{extern "system" {
+ fn RtlSetUnhandledExceptionFilter(
+ UnhandledExceptionFilter: PRTLP_UNHANDLED_EXCEPTION_FILTER,
+ );
+ fn RtlUnhandledExceptionFilter(
+ ExceptionPointers: PEXCEPTION_POINTERS,
+ ) -> LONG;
+ fn RtlUnhandledExceptionFilter2(
+ ExceptionPointers: PEXCEPTION_POINTERS,
+ Flags: ULONG,
+ ) -> LONG;
+ fn RtlKnownExceptionFilter(
+ ExceptionPointers: PEXCEPTION_POINTERS,
+ ) -> LONG;
+}}
+#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
+IFDEF!{
+ENUM!{enum FUNCTION_TABLE_TYPE {
+ RF_SORTED = 0,
+ RF_UNSORTED = 1,
+ RF_CALLBACK = 2,
+ RF_KERNEL_DYNAMIC = 3,
+}}
+STRUCT!{struct DYNAMIC_FUNCTION_TABLE {
+ ListEntry: LIST_ENTRY,
+ FunctionTable: PRUNTIME_FUNCTION,
+ TimeStamp: LARGE_INTEGER,
+ MinimumAddress: ULONG64,
+ MaximumAddress: ULONG64,
+ BaseAddress: ULONG64,
+ Callback: PGET_RUNTIME_FUNCTION_CALLBACK,
+ Context: PVOID,
+ OutOfProcessCallbackDll: PWSTR,
+ Type: FUNCTION_TABLE_TYPE,
+ EntryCount: ULONG,
+ TreeNode: RTL_BALANCED_NODE,
+}}
+pub type PDYNAMIC_FUNCTION_TABLE = *mut DYNAMIC_FUNCTION_TABLE;
+EXTERN!{extern "system" {
+ fn RtlGetFunctionTableListHead() -> PLIST_ENTRY;
+}}
+}
+EXTERN!{extern "system" {
+ fn RtlImageNtHeader(
+ BaseOfImage: PVOID,
+ ) -> PIMAGE_NT_HEADERS;
+}}
+pub const RTL_IMAGE_NT_HEADER_EX_FLAG_NO_RANGE_CHECK: ULONG = 0x00000001;
+EXTERN!{extern "system" {
+ fn RtlImageNtHeaderEx(
+ Flags: ULONG,
+ BaseOfImage: PVOID,
+ Size: ULONG64,
+ OutHeaders: *mut PIMAGE_NT_HEADERS,
+ ) -> NTSTATUS;
+ fn RtlAddressInSectionTable(
+ NtHeaders: PIMAGE_NT_HEADERS,
+ BaseOfImage: PVOID,
+ VirtualAddress: ULONG,
+ ) -> PVOID;
+ fn RtlSectionTableFromVirtualAddress(
+ NtHeaders: PIMAGE_NT_HEADERS,
+ BaseOfImage: PVOID,
+ VirtualAddress: ULONG,
+ ) -> PIMAGE_SECTION_HEADER;
+ fn RtlImageDirectoryEntryToData(
+ BaseOfImage: PVOID,
+ MappedAsImage: BOOLEAN,
+ DirectoryEntry: USHORT,
+ Size: PULONG,
+ ) -> PVOID;
+ fn RtlImageRvaToSection(
+ NtHeaders: PIMAGE_NT_HEADERS,
+ BaseOfImage: PVOID,
+ Rva: ULONG,
+ ) -> PIMAGE_SECTION_HEADER;
+ fn RtlImageRvaToVa(
+ NtHeaders: PIMAGE_NT_HEADERS,
+ BaseOfImage: PVOID,
+ Rva: ULONG,
+ LastRvaSection: *mut PIMAGE_SECTION_HEADER,
+ ) -> PVOID;
+ fn RtlFindExportedRoutineByName(
+ BaseOfImage: PVOID,
+ RoutineName: PSTR,
+ ) -> PVOID;
+ fn RtlGuardCheckLongJumpTarget(
+ PcValue: PVOID,
+ IsFastFail: BOOL,
+ IsLongJumpTarget: PBOOL,
+ ) -> NTSTATUS;
+ fn RtlCompareMemoryUlong(
+ Source: PVOID,
+ Length: SIZE_T,
+ Pattern: ULONG,
+ ) -> SIZE_T;
+ fn RtlFillMemoryUlong(
+ Destination: PVOID,
+ Length: SIZE_T,
+ Pattern: ULONG,
+ );
+ fn RtlFillMemoryUlonglong(
+ Destination: PVOID,
+ Length: SIZE_T,
+ Pattern: ULONGLONG,
+ );
+ fn RtlCreateEnvironment(
+ CloneCurrentEnvironment: BOOLEAN,
+ Environment: *mut PVOID,
+ ) -> NTSTATUS;
+}}
+pub const RTL_CREATE_ENVIRONMENT_TRANSLATE: ULONG = 0x1;
+pub const RTL_CREATE_ENVIRONMENT_TRANSLATE_FROM_OEM: ULONG = 0x2;
+pub const RTL_CREATE_ENVIRONMENT_EMPTY: ULONG = 0x4;
+EXTERN!{extern "system" {
+ fn RtlCreateEnvironmentEx(
+ SourceEnv: PVOID,
+ Environment: *mut PVOID,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn RtlDestroyEnvironment(
+ Environment: PVOID,
+ ) -> NTSTATUS;
+ fn RtlSetCurrentEnvironment(
+ Environment: PVOID,
+ PreviousEnvironment: *mut PVOID,
+ ) -> NTSTATUS;
+ fn RtlSetEnvironmentVar(
+ Environment: *mut PWSTR,
+ Name: PWSTR,
+ NameLength: SIZE_T,
+ Value: PWSTR,
+ ValueLength: SIZE_T,
+ ) -> NTSTATUS;
+ fn RtlSetEnvironmentVariable(
+ Environment: *mut PVOID,
+ Name: PUNICODE_STRING,
+ Value: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn RtlQueryEnvironmentVariable(
+ Environment: PVOID,
+ Name: PWSTR,
+ NameLength: SIZE_T,
+ Value: PWSTR,
+ ValueLength: SIZE_T,
+ ReturnLength: PSIZE_T,
+ ) -> NTSTATUS;
+ fn RtlQueryEnvironmentVariable_U(
+ Environment: PVOID,
+ Name: PUNICODE_STRING,
+ Value: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn RtlExpandEnvironmentStrings(
+ Environment: PVOID,
+ Src: PWSTR,
+ SrcLength: SIZE_T,
+ Dst: PWSTR,
+ DstLength: SIZE_T,
+ ReturnLength: PSIZE_T,
+ ) -> NTSTATUS;
+ fn RtlExpandEnvironmentStrings_U(
+ Environment: PVOID,
+ Source: PUNICODE_STRING,
+ Destination: PUNICODE_STRING,
+ ReturnedLength: PULONG,
+ ) -> NTSTATUS;
+ fn RtlSetEnvironmentStrings(
+ NewEnvironment: PWCHAR,
+ NewEnvironmentSize: SIZE_T,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct RTLP_CURDIR_REF {
+ ReferenceCount: LONG,
+ DirectoryHandle: HANDLE,
+}}
+pub type PRTLP_CURDIR_REF = *mut RTLP_CURDIR_REF;
+STRUCT!{struct RTL_RELATIVE_NAME_U {
+ RelativeName: UNICODE_STRING,
+ ContainingDirectory: HANDLE,
+ CurDirRef: PRTLP_CURDIR_REF,
+}}
+pub type PRTL_RELATIVE_NAME_U = *mut RTL_RELATIVE_NAME_U;
+ENUM!{enum RTL_PATH_TYPE {
+ RtlPathTypeUnknown = 0,
+ RtlPathTypeUncAbsolute = 1,
+ RtlPathTypeDriveAbsolute = 2,
+ RtlPathTypeDriveRelative = 3,
+ RtlPathTypeRooted = 4,
+ RtlPathTypeRelative = 5,
+ RtlPathTypeLocalDevice = 6,
+ RtlPathTypeRootLocalDevice = 7,
+}}
+EXTERN!{extern "C" {
+ static mut RtlDosPathSeperatorsString: UNICODE_STRING;
+ static mut RtlAlternateDosPathSeperatorString: UNICODE_STRING;
+ static mut RtlNtPathSeperatorString: UNICODE_STRING;
+}}
+/// "ntdll.dll"
+pub const RtlNtdllName: UTF16Const = UTF16Const(&[
+ 0x006E, 0x0074, 0x0064, 0x006C, 0x006C, 0x002E, 0x0064, 0x006C, 0x006C, 0u16,
+]);
+EXTERN!{extern "system" {
+ fn RtlDetermineDosPathNameType_U(
+ DosFileName: PWSTR,
+ ) -> RTL_PATH_TYPE;
+ fn RtlDetermineDosPathNameType_Ustr(
+ DosFileName: PCUNICODE_STRING,
+ ) -> RTL_PATH_TYPE;
+ fn RtlIsDosDeviceName_U(
+ DosFileName: PWSTR,
+ ) -> ULONG;
+ fn RtlIsDosDeviceName_Ustr(
+ DosFileName: PUNICODE_STRING,
+ ) -> ULONG;
+ fn RtlGetFullPathName_U(
+ FileName: PWSTR,
+ BufferLength: ULONG,
+ Buffer: PWSTR,
+ FilePart: *mut PWSTR,
+ ) -> ULONG;
+ fn RtlGetFullPathName_UEx(
+ FileName: PWSTR,
+ BufferLength: ULONG,
+ Buffer: PWSTR,
+ FilePart: *mut PWSTR,
+ BytesRequired: *mut ULONG,
+ ) -> NTSTATUS;
+ fn RtlGetFullPathName_UstrEx(
+ FileName: PUNICODE_STRING,
+ StaticString: PUNICODE_STRING,
+ DynamicString: PUNICODE_STRING,
+ StringUsed: *mut PUNICODE_STRING,
+ FilePartPrefixCch: *mut SIZE_T,
+ NameInvalid: PBOOLEAN,
+ InputPathType: *mut RTL_PATH_TYPE,
+ BytesRequired: *mut SIZE_T,
+ ) -> NTSTATUS;
+ fn RtlGetCurrentDirectory_U(
+ BufferLength: ULONG,
+ Buffer: PWSTR,
+ ) -> ULONG;
+ fn RtlSetCurrentDirectory_U(
+ PathName: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn RtlGetLongestNtPathLength() -> ULONG;
+ fn RtlDosPathNameToNtPathName_U(
+ DosFileName: PWSTR,
+ NtFileName: PUNICODE_STRING,
+ FilePart: *mut PWSTR,
+ RelativeName: PRTL_RELATIVE_NAME_U,
+ ) -> BOOLEAN;
+ fn RtlDosPathNameToNtPathName_U_WithStatus(
+ DosFileName: PWSTR,
+ NtFileName: PUNICODE_STRING,
+ FilePart: *mut PWSTR,
+ RelativeName: PRTL_RELATIVE_NAME_U,
+ ) -> NTSTATUS;
+ fn RtlDosLongPathNameToNtPathName_U_WithStatus(
+ DosFileName: PWSTR,
+ NtFileName: PUNICODE_STRING,
+ FilePart: *mut PWSTR,
+ RelativeName: PRTL_RELATIVE_NAME_U,
+ ) -> NTSTATUS;
+ fn RtlDosPathNameToRelativeNtPathName_U(
+ DosFileName: PWSTR,
+ NtFileName: PUNICODE_STRING,
+ FilePart: *mut PWSTR,
+ RelativeName: PRTL_RELATIVE_NAME_U,
+ ) -> BOOLEAN;
+ fn RtlDosPathNameToRelativeNtPathName_U_WithStatus(
+ DosFileName: PWSTR,
+ NtFileName: PUNICODE_STRING,
+ FilePart: *mut PWSTR,
+ RelativeName: PRTL_RELATIVE_NAME_U,
+ ) -> NTSTATUS;
+ fn RtlDosLongPathNameToRelativeNtPathName_U_WithStatus(
+ DosFileName: PWSTR,
+ NtFileName: PUNICODE_STRING,
+ FilePart: *mut PWSTR,
+ RelativeName: PRTL_RELATIVE_NAME_U,
+ ) -> NTSTATUS;
+ fn RtlReleaseRelativeName(
+ RelativeName: PRTL_RELATIVE_NAME_U,
+ );
+ fn RtlDosSearchPath_U(
+ Path: PWSTR,
+ FileName: PWSTR,
+ Extension: PWSTR,
+ BufferLength: ULONG,
+ Buffer: PWSTR,
+ FilePart: *mut PWSTR,
+ ) -> ULONG;
+}}
+pub const RTL_DOS_SEARCH_PATH_FLAG_APPLY_ISOLATION_REDIRECTION: ULONG = 0x00000001;
+pub const RTL_DOS_SEARCH_PATH_FLAG_DISALLOW_DOT_RELATIVE_PATH_SEARCH: ULONG = 0x00000002;
+pub const RTL_DOS_SEARCH_PATH_FLAG_APPLY_DEFAULT_EXTENSION_WHEN_NOT_RELATIVE_PATH_EVEN_IF_FILE_HAS_EXTENSION: ULONG = 0x00000004;
+EXTERN!{extern "system" {
+ fn RtlDosSearchPath_Ustr(
+ Flags: ULONG,
+ Path: PUNICODE_STRING,
+ FileName: PUNICODE_STRING,
+ DefaultExtension: PUNICODE_STRING,
+ StaticString: PUNICODE_STRING,
+ DynamicString: PUNICODE_STRING,
+ FullFileNameOut: *mut PCUNICODE_STRING,
+ FilePartPrefixCch: *mut SIZE_T,
+ BytesRequired: *mut SIZE_T,
+ ) -> NTSTATUS;
+ fn RtlDoesFileExists_U(
+ FileName: PWSTR,
+ ) -> BOOLEAN;
+ fn RtlGetLengthWithoutLastFullDosOrNtPathElement(
+ Flags: ULONG,
+ PathString: PUNICODE_STRING,
+ Length: PULONG,
+ ) -> NTSTATUS;
+ fn RtlGetLengthWithoutTrailingPathSeperators(
+ Flags: ULONG,
+ PathString: PUNICODE_STRING,
+ Length: PULONG,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct GENERATE_NAME_CONTEXT {
+ Checksum: USHORT,
+ CheckSumInserted: BOOLEAN,
+ NameLength: UCHAR,
+ NameBuffer: [WCHAR; 8],
+ ExtensionLength: ULONG,
+ ExtensionBuffer: [WCHAR; 4],
+ LastIndexValue: ULONG,
+}}
+pub type PGENERATE_NAME_CONTEXT = *mut GENERATE_NAME_CONTEXT;
+EXTERN!{extern "system" {
+ fn RtlGenerate8dot3Name(
+ Name: PCUNICODE_STRING,
+ AllowExtendedCharacters: BOOLEAN,
+ Context: PGENERATE_NAME_CONTEXT,
+ Name8dot3: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn RtlComputePrivatizedDllName_U(
+ DllName: PUNICODE_STRING,
+ RealName: PUNICODE_STRING,
+ LocalName: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn RtlGetSearchPath(
+ SearchPathA: *mut PWSTR,
+ ) -> BOOLEAN;
+ fn RtlSetSearchPathMode(
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn RtlGetExePath() -> PWSTR;
+ fn RtlGetNtSystemRoot() -> PWSTR;
+ fn RtlAreLongPathsEnabled() -> BOOLEAN;
+ fn RtlIsThreadWithinLoaderCallout() -> BOOLEAN;
+ fn RtlDllShutdownInProgress() -> BOOLEAN;
+}}
+STRUCT!{struct RTL_HEAP_ENTRY_u_s1 {
+ Settable: SIZE_T,
+ Tag: ULONG,
+}}
+STRUCT!{struct RTL_HEAP_ENTRY_u_s2 {
+ CommittedSize: SIZE_T,
+ FirstBlock: PVOID,
+}}
+UNION!{union RTL_HEAP_ENTRY_u {
+ s1: RTL_HEAP_ENTRY_u_s1,
+ s2: RTL_HEAP_ENTRY_u_s2,
+}}
+STRUCT!{struct RTL_HEAP_ENTRY {
+ Size: SIZE_T,
+ Flags: USHORT,
+ AllocatorBackTraceIndex: USHORT,
+ u: RTL_HEAP_ENTRY_u,
+}}
+pub type PRTL_HEAP_ENTRY = *mut RTL_HEAP_ENTRY;
+pub const RTL_HEAP_BUSY: USHORT = 0x0001;
+pub const RTL_HEAP_SEGMENT: USHORT = 0x0002;
+pub const RTL_HEAP_SETTABLE_VALUE: USHORT = 0x0010;
+pub const RTL_HEAP_SETTABLE_FLAG1: USHORT = 0x0020;
+pub const RTL_HEAP_SETTABLE_FLAG2: USHORT = 0x0040;
+pub const RTL_HEAP_SETTABLE_FLAG3: USHORT = 0x0080;
+pub const RTL_HEAP_SETTABLE_FLAGS: USHORT = 0x00e0;
+pub const RTL_HEAP_UNCOMMITTED_RANGE: USHORT = 0x0100;
+pub const RTL_HEAP_PROTECTED_ENTRY: USHORT = 0x0200;
+STRUCT!{struct RTL_HEAP_TAG {
+ NumberOfAllocations: ULONG,
+ NumberOfFrees: ULONG,
+ BytesAllocated: SIZE_T,
+ TagIndex: USHORT,
+ CreatorBackTraceIndex: USHORT,
+ TagName: [WCHAR; 24],
+}}
+pub type PRTL_HEAP_TAG = *mut RTL_HEAP_TAG;
+STRUCT!{struct RTL_HEAP_INFORMATION {
+ BaseAddress: PVOID,
+ Flags: ULONG,
+ EntryOverhead: USHORT,
+ CreatorBackTraceIndex: USHORT,
+ BytesAllocated: SIZE_T,
+ BytesCommitted: SIZE_T,
+ NumberOfTags: ULONG,
+ NumberOfEntries: ULONG,
+ NumberOfPseudoTags: ULONG,
+ PseudoTagGranularity: ULONG,
+ Reserved: [ULONG; 5],
+ Tags: PRTL_HEAP_TAG,
+ Entries: PRTL_HEAP_ENTRY,
+}}
+pub type PRTL_HEAP_INFORMATION = *mut RTL_HEAP_INFORMATION;
+STRUCT!{struct RTL_PROCESS_HEAPS {
+ NumberOfHeaps: ULONG,
+ Heaps: [RTL_HEAP_INFORMATION; 1],
+}}
+pub type PRTL_PROCESS_HEAPS = *mut RTL_PROCESS_HEAPS;
+FN!{stdcall PRTL_HEAP_COMMIT_ROUTINE(
+ Base: PVOID,
+ CommitAddress: *mut PVOID,
+ CommitSize: PSIZE_T,
+) -> NTSTATUS}
+STRUCT!{struct RTL_HEAP_PARAMETERS {
+ Length: ULONG,
+ SegmentReserve: SIZE_T,
+ SegmentCommit: SIZE_T,
+ DeCommitFreeBlockThreshold: SIZE_T,
+ DeCommitTotalFreeThreshold: SIZE_T,
+ MaximumAllocationSize: SIZE_T,
+ VirtualMemoryThreshold: SIZE_T,
+ InitialCommit: SIZE_T,
+ InitialReserve: SIZE_T,
+ CommitRoutine: PRTL_HEAP_COMMIT_ROUTINE,
+ Reserved: [SIZE_T; 2],
+}}
+pub type PRTL_HEAP_PARAMETERS = *mut RTL_HEAP_PARAMETERS;
+pub const HEAP_SETTABLE_USER_VALUE: ULONG = 0x00000100;
+pub const HEAP_SETTABLE_USER_FLAG1: ULONG = 0x00000200;
+pub const HEAP_SETTABLE_USER_FLAG2: ULONG = 0x00000400;
+pub const HEAP_SETTABLE_USER_FLAG3: ULONG = 0x00000800;
+pub const HEAP_SETTABLE_USER_FLAGS: ULONG = 0x00000e00;
+pub const HEAP_CLASS_0: ULONG = 0x00000000;
+pub const HEAP_CLASS_1: ULONG = 0x00001000;
+pub const HEAP_CLASS_2: ULONG = 0x00002000;
+pub const HEAP_CLASS_3: ULONG = 0x00003000;
+pub const HEAP_CLASS_4: ULONG = 0x00004000;
+pub const HEAP_CLASS_5: ULONG = 0x00005000;
+pub const HEAP_CLASS_6: ULONG = 0x00006000;
+pub const HEAP_CLASS_7: ULONG = 0x00007000;
+pub const HEAP_CLASS_8: ULONG = 0x00008000;
+pub const HEAP_CLASS_MASK: ULONG = 0x0000f000;
+EXTERN!{extern "system" {
+ fn RtlCreateHeap(
+ Flags: ULONG,
+ HeapBase: PVOID,
+ ReserveSize: SIZE_T,
+ CommitSize: SIZE_T,
+ Lock: PVOID,
+ Parameters: PRTL_HEAP_PARAMETERS,
+ ) -> PVOID;
+ fn RtlDestroyHeap(
+ HeapHandle: PVOID,
+ ) -> PVOID;
+ fn RtlAllocateHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ Size: SIZE_T,
+ ) -> PVOID;
+ fn RtlFreeHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ BaseAddress: PVOID,
+ ) -> BOOLEAN;
+ fn RtlSizeHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ BaseAddress: PVOID,
+ ) -> SIZE_T;
+ fn RtlZeroHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn RtlProtectHeap(
+ HeapHandle: PVOID,
+ MakeReadOnly: BOOLEAN,
+ );
+}}
+#[inline] #[cfg(not(target_arch = "aarch64"))]
+pub unsafe fn RtlProcessHeap() -> PVOID {
+ use crate::ntpsapi::NtCurrentPeb;
+ (*NtCurrentPeb()).ProcessHeap
+}
+EXTERN!{extern "system" {
+ fn RtlLockHeap(
+ HeapHandle: PVOID,
+ ) -> BOOLEAN;
+ fn RtlUnlockHeap(
+ HeapHandle: PVOID,
+ ) -> BOOLEAN;
+ fn RtlReAllocateHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ BaseAddress: PVOID,
+ Size: SIZE_T,
+ ) -> PVOID;
+ fn RtlGetUserInfoHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ BaseAddress: PVOID,
+ UserValue: *mut PVOID,
+ UserFlags: PULONG,
+ ) -> BOOLEAN;
+ fn RtlSetUserValueHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ BaseAddress: PVOID,
+ UserValue: PVOID,
+ ) -> BOOLEAN;
+ fn RtlSetUserFlagsHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ BaseAddress: PVOID,
+ UserFlagsReset: ULONG,
+ UserFlagsSet: ULONG,
+ ) -> BOOLEAN;
+}}
+STRUCT!{struct RTL_HEAP_TAG_INFO {
+ NumberOfAllocations: ULONG,
+ NumberOfFrees: ULONG,
+ BytesAllocated: SIZE_T,
+}}
+pub type PRTL_HEAP_TAG_INFO = *mut RTL_HEAP_TAG_INFO;
+EXTERN!{extern "system" {
+ fn RtlCreateTagHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ TagPrefix: PWSTR,
+ TagNames: PWSTR,
+ ) -> ULONG;
+ fn RtlQueryTagHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ TagIndex: USHORT,
+ ResetCounters: BOOLEAN,
+ TagInfo: PRTL_HEAP_TAG_INFO,
+ ) -> PWSTR;
+ fn RtlExtendHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ Base: PVOID,
+ Size: SIZE_T,
+ ) -> NTSTATUS;
+ fn RtlCompactHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ ) -> SIZE_T;
+ fn RtlValidateHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ BaseAddress: PVOID,
+ ) -> BOOLEAN;
+ fn RtlValidateProcessHeaps() -> BOOLEAN;
+ fn RtlGetProcessHeaps(
+ NumberOfHeaps: ULONG,
+ ProcessHeaps: *mut PVOID,
+ ) -> ULONG;
+}}
+FN!{stdcall PRTL_ENUM_HEAPS_ROUTINE(
+ HeapHandle: PVOID,
+ Parameter: PVOID,
+) -> NTSTATUS}
+EXTERN!{extern "system" {
+ fn RtlEnumProcessHeaps(
+ EnumRoutine: PRTL_ENUM_HEAPS_ROUTINE,
+ Parameter: PVOID,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct RTL_HEAP_USAGE_ENTRY {
+ Next: *mut RTL_HEAP_USAGE_ENTRY,
+ Address: PVOID,
+ Size: SIZE_T,
+ AllocatorBackTraceIndex: USHORT,
+ TagIndex: USHORT,
+}}
+pub type PRTL_HEAP_USAGE_ENTRY = *mut RTL_HEAP_USAGE_ENTRY;
+STRUCT!{struct RTL_HEAP_USAGE {
+ Length: ULONG,
+ BytesAllocated: SIZE_T,
+ BytesCommitted: SIZE_T,
+ BytesReserved: SIZE_T,
+ BytesReservedMaximum: SIZE_T,
+ Entries: PRTL_HEAP_USAGE_ENTRY,
+ AddedEntries: PRTL_HEAP_USAGE_ENTRY,
+ RemovedEntries: PRTL_HEAP_USAGE_ENTRY,
+ Reserved: [ULONG_PTR; 8],
+}}
+pub type PRTL_HEAP_USAGE = *mut RTL_HEAP_USAGE;
+pub const HEAP_USAGE_ALLOCATED_BLOCKS: ULONG = HEAP_REALLOC_IN_PLACE_ONLY;
+pub const HEAP_USAGE_FREE_BUFFER: ULONG = HEAP_ZERO_MEMORY;
+EXTERN!{extern "system" {
+ fn RtlUsageHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ Usage: PRTL_HEAP_USAGE,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct RTL_HEAP_WALK_ENTRY_u_Block {
+ Settable: SIZE_T,
+ TagIndex: USHORT,
+ AllocatorBackTraceIndex: USHORT,
+ Reserved: [ULONG; 2],
+}}
+STRUCT!{struct RTL_HEAP_WALK_ENTRY_u_Segment {
+ CommittedSize: ULONG,
+ UnCommittedSize: ULONG,
+ FirstEntry: PVOID,
+ LastEntry: PVOID,
+}}
+UNION!{union RTL_HEAP_WALK_ENTRY_u {
+ Block: RTL_HEAP_WALK_ENTRY_u_Block,
+ Segment: RTL_HEAP_WALK_ENTRY_u_Segment,
+}}
+STRUCT!{struct RTL_HEAP_WALK_ENTRY {
+ DataAddress: PVOID,
+ DataSize: SIZE_T,
+ OverheadBytes: UCHAR,
+ SegmentIndex: UCHAR,
+ Flags: USHORT,
+ u: RTL_HEAP_WALK_ENTRY_u,
+}}
+pub type PRTL_HEAP_WALK_ENTRY = *mut RTL_HEAP_WALK_ENTRY;
+EXTERN!{extern "system" {
+ fn RtlWalkHeap(
+ HeapHandle: PVOID,
+ Entry: PRTL_HEAP_WALK_ENTRY,
+ ) -> NTSTATUS;
+}}
+pub const HeapDetailedFailureInformation: u32 = 0x80000001;
+pub const HeapSetDebuggingInformation: u32 = 0x80000002;
+ENUM!{enum HEAP_COMPATIBILITY_MODE {
+ HEAP_COMPATIBILITY_STANDARD = 0,
+ HEAP_COMPATIBILITY_LAL = 1,
+ HEAP_COMPATIBILITY_LFH = 2,
+}}
+STRUCT!{struct PROCESS_HEAP_INFORMATION {
+ ReserveSize: ULONG_PTR,
+ CommitSize: ULONG_PTR,
+ NumberOfHeaps: ULONG,
+ FirstHeapInformationOffset: ULONG_PTR,
+}}
+pub type PPROCESS_HEAP_INFORMATION = *mut PROCESS_HEAP_INFORMATION;
+STRUCT!{struct HEAP_INFORMATION {
+ Address: ULONG_PTR,
+ Mode: ULONG,
+ ReserveSize: ULONG_PTR,
+ CommitSize: ULONG_PTR,
+ FirstRegionInformationOffset: ULONG_PTR,
+ NextHeapInformationOffset: ULONG_PTR,
+}}
+pub type PHEAP_INFORMATION = *mut HEAP_INFORMATION;
+UNION!{union HEAP_EXTENDED_INFORMATION_u {
+ ProcessHeapInformation: PROCESS_HEAP_INFORMATION,
+ HeapInformation: HEAP_INFORMATION,
+}}
+STRUCT!{struct HEAP_EXTENDED_INFORMATION {
+ Process: HANDLE,
+ Heap: ULONG_PTR,
+ Level: ULONG,
+ CallbackRoutine: PVOID,
+ CallbackContext: PVOID,
+ u: HEAP_EXTENDED_INFORMATION_u,
+}}
+pub type PHEAP_EXTENDED_INFORMATION = *mut HEAP_EXTENDED_INFORMATION;
+FN!{stdcall PRTL_HEAP_LEAK_ENUMERATION_ROUTINE(
+ Reserved: LONG,
+ HeapHandle: PVOID,
+ BaseAddress: PVOID,
+ BlockSize: SIZE_T,
+ StackTraceDepth: ULONG,
+ StackTrace: *mut PVOID,
+) -> NTSTATUS}
+STRUCT!{struct HEAP_DEBUGGING_INFORMATION {
+ InterceptorFunction: PVOID,
+ InterceptorValue: USHORT,
+ ExtendedOptions: ULONG,
+ StackTraceDepth: ULONG,
+ MinTotalBlockSize: SIZE_T,
+ MaxTotalBlockSize: SIZE_T,
+ HeapLeakEnumerationRoutine: PRTL_HEAP_LEAK_ENUMERATION_ROUTINE,
+}}
+pub type PHEAP_DEBUGGING_INFORMATION = *mut HEAP_DEBUGGING_INFORMATION;
+EXTERN!{extern "system" {
+ fn RtlQueryHeapInformation(
+ HeapHandle: PVOID,
+ HeapInformationClass: HEAP_INFORMATION_CLASS,
+ HeapInformation: PVOID,
+ HeapInformationLength: SIZE_T,
+ ReturnLength: PSIZE_T,
+ ) -> NTSTATUS;
+ fn RtlSetHeapInformation(
+ HeapHandle: PVOID,
+ HeapInformationClass: HEAP_INFORMATION_CLASS,
+ HeapInformation: PVOID,
+ HeapInformationLength: SIZE_T,
+ ) -> NTSTATUS;
+ fn RtlMultipleAllocateHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ Size: SIZE_T,
+ Count: ULONG,
+ Array: *mut PVOID,
+ ) -> ULONG;
+ fn RtlMultipleFreeHeap(
+ HeapHandle: PVOID,
+ Flags: ULONG,
+ Count: ULONG,
+ Array: *mut PVOID,
+ ) -> ULONG;
+ fn RtlDetectHeapLeaks();
+ fn RtlFlushHeaps();
+}}
+STRUCT!{struct RTL_MEMORY_ZONE_SEGMENT {
+ NextSegment: *mut RTL_MEMORY_ZONE_SEGMENT,
+ Size: SIZE_T,
+ Next: PVOID,
+ Limit: PVOID,
+}}
+pub type PRTL_MEMORY_ZONE_SEGMENT = *mut RTL_MEMORY_ZONE_SEGMENT;
+STRUCT!{struct RTL_MEMORY_ZONE {
+ Segment: RTL_MEMORY_ZONE_SEGMENT,
+ Lock: RTL_SRWLOCK,
+ LockCount: ULONG,
+ FirstSegment: PRTL_MEMORY_ZONE_SEGMENT,
+}}
+pub type PRTL_MEMORY_ZONE = *mut RTL_MEMORY_ZONE;
+EXTERN!{extern "system" {
+ fn RtlCreateMemoryZone(
+ MemoryZone: *mut PVOID,
+ InitialSize: SIZE_T,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn RtlDestroyMemoryZone(
+ MemoryZone: PVOID,
+ ) -> NTSTATUS;
+ fn RtlAllocateMemoryZone(
+ MemoryZone: PVOID,
+ BlockSize: SIZE_T,
+ Block: *mut PVOID,
+ ) -> NTSTATUS;
+ fn RtlResetMemoryZone(
+ MemoryZone: PVOID,
+ ) -> NTSTATUS;
+ fn RtlLockMemoryZone(
+ MemoryZone: PVOID,
+ ) -> NTSTATUS;
+ fn RtlUnlockMemoryZone(
+ MemoryZone: PVOID,
+ ) -> NTSTATUS;
+ fn RtlCreateMemoryBlockLookaside(
+ MemoryBlockLookaside: *mut PVOID,
+ Flags: ULONG,
+ InitialSize: ULONG,
+ MinimumBlockSize: ULONG,
+ MaximumBlockSize: ULONG,
+ ) -> NTSTATUS;
+ fn RtlDestroyMemoryBlockLookaside(
+ MemoryBlockLookaside: PVOID,
+ ) -> NTSTATUS;
+ fn RtlAllocateMemoryBlockLookaside(
+ MemoryBlockLookaside: PVOID,
+ BlockSize: ULONG,
+ Block: *mut PVOID,
+ ) -> NTSTATUS;
+ fn RtlFreeMemoryBlockLookaside(
+ MemoryBlockLookaside: PVOID,
+ Block: PVOID,
+ ) -> NTSTATUS;
+ fn RtlExtendMemoryBlockLookaside(
+ MemoryBlockLookaside: PVOID,
+ Increment: ULONG,
+ ) -> NTSTATUS;
+ fn RtlResetMemoryBlockLookaside(
+ MemoryBlockLookaside: PVOID,
+ ) -> NTSTATUS;
+ fn RtlLockMemoryBlockLookaside(
+ MemoryBlockLookaside: PVOID,
+ ) -> NTSTATUS;
+ fn RtlUnlockMemoryBlockLookaside(
+ MemoryBlockLookaside: PVOID,
+ ) -> NTSTATUS;
+ fn RtlGetCurrentTransaction() -> HANDLE;
+ fn RtlSetCurrentTransaction(
+ TransactionHandle: HANDLE,
+ ) -> LOGICAL;
+}}
+#[inline]
+pub const fn RtlIsEqualLuid(L1: &LUID, L2: &LUID) -> bool {
+ (L1.LowPart == L2.LowPart) && (L1.HighPart == L2.HighPart)
+}
+#[inline]
+pub const fn RtlIsZeroLuid(L1: &LUID) -> bool {
+ (L1.LowPart | L1.HighPart as u32) == 0
+}
+#[inline]
+pub const fn RtlConvertLongToLuid(Long: LONG) -> LUID {
+ LUID { LowPart: Long as u32, HighPart: ((Long as i64) >> 32) as i32 }
+}
+#[inline]
+pub const fn RtlConvertUlongToLuid(Ulong: ULONG) -> LUID {
+ LUID { LowPart: Ulong, HighPart: 0 }
+}
+EXTERN!{extern "system" {
+ fn RtlCopyLuid(
+ DestinationLuid: PLUID,
+ SourceLuid: PLUID,
+ );
+ fn RtlCopyLuidAndAttributesArray(
+ Count: ULONG,
+ Src: PLUID_AND_ATTRIBUTES,
+ Dest: PLUID_AND_ATTRIBUTES,
+ );
+}}
+STRUCT!{struct RTL_PROCESS_VERIFIER_OPTIONS {
+ SizeStruct: ULONG,
+ Option: ULONG,
+ OptionData: [UCHAR; 1],
+}}
+pub type PRTL_PROCESS_VERIFIER_OPTIONS = *mut RTL_PROCESS_VERIFIER_OPTIONS;
+UNION!{union RTL_DEBUG_INFORMATION_u {
+ Modules: *mut RTL_PROCESS_MODULES,
+ ModulesEx: *mut RTL_PROCESS_MODULE_INFORMATION_EX,
+}}
+STRUCT!{struct RTL_DEBUG_INFORMATION {
+ SectionHandleClient: HANDLE,
+ ViewBaseClient: PVOID,
+ ViewBaseTarget: PVOID,
+ ViewBaseDelta: ULONG_PTR,
+ EventPairClient: HANDLE,
+ EventPairTarget: HANDLE,
+ TargetProcessId: HANDLE,
+ TargetThreadHandle: HANDLE,
+ Flags: ULONG,
+ OffsetFree: SIZE_T,
+ CommitSize: SIZE_T,
+ ViewSize: SIZE_T,
+ u: RTL_DEBUG_INFORMATION_u,
+ BackTraces: *mut RTL_PROCESS_BACKTRACES,
+ Heaps: *mut RTL_PROCESS_HEAPS,
+ Locks: *mut RTL_PROCESS_LOCKS,
+ SpecificHeap: PVOID,
+ TargetProcessHandle: HANDLE,
+ VerifierOptions: PRTL_PROCESS_VERIFIER_OPTIONS,
+ ProcessHeap: PVOID,
+ CriticalSectionHandle: HANDLE,
+ CriticalSectionOwnerThread: HANDLE,
+ Reserved: [PVOID; 4],
+}}
+pub type PRTL_DEBUG_INFORMATION = *mut RTL_DEBUG_INFORMATION;
+EXTERN!{extern "system" {
+ fn RtlCreateQueryDebugBuffer(
+ MaximumCommit: ULONG,
+ UseEventPair: BOOLEAN,
+ ) -> PRTL_DEBUG_INFORMATION;
+ fn RtlDestroyQueryDebugBuffer(
+ Buffer: PRTL_DEBUG_INFORMATION,
+ ) -> NTSTATUS;
+ fn RtlCommitDebugInfo(
+ Buffer: PRTL_DEBUG_INFORMATION,
+ Size: SIZE_T,
+ ) -> PVOID;
+ fn RtlDeCommitDebugInfo(
+ Buffer: PRTL_DEBUG_INFORMATION,
+ p: PVOID,
+ Size: SIZE_T,
+ );
+}}
+pub const RTL_QUERY_PROCESS_MODULES: ULONG = 0x00000001;
+pub const RTL_QUERY_PROCESS_BACKTRACES: ULONG = 0x00000002;
+pub const RTL_QUERY_PROCESS_HEAP_SUMMARY: ULONG = 0x00000004;
+pub const RTL_QUERY_PROCESS_HEAP_TAGS: ULONG = 0x00000008;
+pub const RTL_QUERY_PROCESS_HEAP_ENTRIES: ULONG = 0x00000010;
+pub const RTL_QUERY_PROCESS_LOCKS: ULONG = 0x00000020;
+pub const RTL_QUERY_PROCESS_MODULES32: ULONG = 0x00000040;
+pub const RTL_QUERY_PROCESS_VERIFIER_OPTIONS: ULONG = 0x00000080;
+pub const RTL_QUERY_PROCESS_MODULESEX: ULONG = 0x00000100;
+pub const RTL_QUERY_PROCESS_HEAP_ENTRIES_EX: ULONG = 0x00000200;
+pub const RTL_QUERY_PROCESS_CS_OWNER: ULONG = 0x00000400;
+pub const RTL_QUERY_PROCESS_NONINVASIVE: ULONG = 0x80000000;
+EXTERN!{extern "system" {
+ fn RtlQueryProcessDebugInformation(
+ UniqueProcessId: HANDLE,
+ Flags: ULONG,
+ Buffer: PRTL_DEBUG_INFORMATION,
+ ) -> NTSTATUS;
+ fn RtlFindMessage(
+ DllHandle: PVOID,
+ MessageTableId: ULONG,
+ MessageLanguageId: ULONG,
+ MessageId: ULONG,
+ MessageEntry: *mut PMESSAGE_RESOURCE_ENTRY,
+ ) -> NTSTATUS;
+ fn RtlFormatMessage(
+ MessageFormat: PWSTR,
+ MaximumWidth: ULONG,
+ IgnoreInserts: BOOLEAN,
+ ArgumentsAreAnsi: BOOLEAN,
+ ArgumentsAreAnArray: BOOLEAN,
+ Arguments: *mut va_list,
+ Buffer: PWSTR,
+ Length: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct PARSE_MESSAGE_CONTEXT {
+ fFlags: ULONG,
+ cwSavColumn: ULONG,
+ iwSrc: SIZE_T,
+ iwDst: SIZE_T,
+ iwDstSpace: SIZE_T,
+ lpvArgStart: va_list,
+}}
+pub type PPARSE_MESSAGE_CONTEXT = *mut PARSE_MESSAGE_CONTEXT;
+#[inline]
+pub fn INIT_PARSE_MESSAGE_CONTEXT(ctx: &mut PARSE_MESSAGE_CONTEXT) {
+ ctx.fFlags = 0;
+}
+#[inline]
+pub fn TEST_PARSE_MESSAGE_CONTEXT_FLAG(ctx: &mut PARSE_MESSAGE_CONTEXT, flag: ULONG) -> ULONG {
+ ctx.fFlags & flag
+}
+#[inline]
+pub fn SET_PARSE_MESSAGE_CONTEXT_FLAG(ctx: &mut PARSE_MESSAGE_CONTEXT, flag: ULONG) -> ULONG {
+ ctx.fFlags |= flag;
+ ctx.fFlags
+}
+#[inline]
+pub fn CLEAR_PARSE_MESSAGE_CONTEXT_FLAG(ctx: &mut PARSE_MESSAGE_CONTEXT, flag: ULONG) -> ULONG {
+ ctx.fFlags &= !flag;
+ ctx.fFlags
+}
+EXTERN!{extern "system" {
+ fn RtlFormatMessageEx(
+ MessageFormat: PWSTR,
+ MaximumWidth: ULONG,
+ IgnoreInserts: BOOLEAN,
+ ArgumentsAreAnsi: BOOLEAN,
+ ArgumentsAreAnArray: BOOLEAN,
+ Arguments: *mut va_list,
+ Buffer: PWSTR,
+ Length: ULONG,
+ ReturnLength: PULONG,
+ ParseContext: PPARSE_MESSAGE_CONTEXT,
+ ) -> NTSTATUS;
+ fn RtlNtStatusToDosError(
+ Status: NTSTATUS,
+ ) -> ULONG;
+ fn RtlNtStatusToDosErrorNoTeb(
+ Status: NTSTATUS,
+ ) -> ULONG;
+ fn RtlGetLastNtStatus() -> NTSTATUS;
+ fn RtlGetLastWin32Error() -> LONG;
+ fn RtlSetLastWin32ErrorAndNtStatusFromNtStatus(
+ Status: NTSTATUS,
+ );
+ fn RtlSetLastWin32Error(
+ Win32Error: LONG,
+ );
+ fn RtlRestoreLastWin32Error(
+ Win32Error: LONG,
+ );
+}}
+pub const RTL_ERRORMODE_FAILCRITICALERRORS: ULONG = 0x0010;
+pub const RTL_ERRORMODE_NOGPFAULTERRORBOX: ULONG = 0x0020;
+pub const RTL_ERRORMODE_NOOPENFILEERRORBOX: ULONG = 0x0040;
+EXTERN!{extern "system" {
+ fn RtlGetThreadErrorMode() -> ULONG;
+ fn RtlSetThreadErrorMode(
+ NewMode: ULONG,
+ OldMode: PULONG,
+ ) -> NTSTATUS;
+ fn RtlReportException(
+ ExceptionRecord: PEXCEPTION_RECORD,
+ ContextRecord: PCONTEXT,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn RtlReportExceptionEx(
+ ExceptionRecord: PEXCEPTION_RECORD,
+ ContextRecord: PCONTEXT,
+ Flags: ULONG,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn RtlWerpReportException(
+ ProcessId: ULONG,
+ CrashReportSharedMem: HANDLE,
+ Flags: ULONG,
+ CrashVerticalProcessHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn RtlReportSilentProcessExit(
+ ProcessHandle: HANDLE,
+ ExitStatus: NTSTATUS,
+ ) -> NTSTATUS;
+ fn RtlUniform(
+ Seed: PULONG,
+ ) -> ULONG;
+ fn RtlRandom(
+ Seed: PULONG,
+ ) -> ULONG;
+ fn RtlRandomEx(
+ Seed: PULONG,
+ ) -> ULONG;
+ fn RtlComputeImportTableHash(
+ FileHandle: HANDLE,
+ Hash: PCHAR,
+ ImportTableHashRevision: ULONG,
+ ) -> NTSTATUS;
+ fn RtlIntegerToChar(
+ Value: ULONG,
+ Base: ULONG,
+ OutputLength: LONG,
+ String: PSTR,
+ ) -> NTSTATUS;
+ fn RtlCharToInteger(
+ String: PCSZ,
+ Base: ULONG,
+ Value: PULONG,
+ ) -> NTSTATUS;
+ fn RtlLargeIntegerToChar(
+ Value: PLARGE_INTEGER,
+ Base: ULONG,
+ OutputLength: LONG,
+ String: PSTR,
+ ) -> NTSTATUS;
+ fn RtlIntegerToUnicodeString(
+ Value: ULONG,
+ Base: ULONG,
+ String: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn RtlInt64ToUnicodeString(
+ Value: ULONGLONG,
+ Base: ULONG,
+ String: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn RtlUnicodeStringToInteger(
+ String: PCUNICODE_STRING,
+ Base: ULONG,
+ Value: PULONG,
+ ) -> NTSTATUS;
+ fn RtlIpv4AddressToStringExW(
+ Address: *const in_addr,
+ Port: USHORT,
+ AddressString: PWSTR,
+ AddressStringLength: PULONG,
+ ) -> NTSTATUS;
+ fn RtlIpv6AddressToStringExW(
+ Address: *const in6_addr,
+ ScopeId: ULONG,
+ Port: USHORT,
+ AddressString: PWSTR,
+ AddressStringLength: PULONG,
+ ) -> NTSTATUS;
+ fn RtlIpv4StringToAddressExW(
+ AddressString: PCWSTR,
+ Strict: BOOLEAN,
+ Address: *mut in_addr,
+ Port: PUSHORT,
+ ) -> NTSTATUS;
+ fn RtlIpv6StringToAddressExW(
+ AddressString: PCWSTR,
+ Address: *mut in6_addr,
+ ScopeId: PULONG,
+ Port: PUSHORT,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct TIME_FIELDS {
+ Year: CSHORT,
+ Month: CSHORT,
+ Day: CSHORT,
+ Hour: CSHORT,
+ Minute: CSHORT,
+ Second: CSHORT,
+ Milliseconds: CSHORT,
+ Weekday: CSHORT,
+}}
+pub type PTIME_FIELDS = *mut TIME_FIELDS;
+EXTERN!{extern "system" {
+ fn RtlCutoverTimeToSystemTime(
+ CutoverTime: PTIME_FIELDS,
+ SystemTime: PLARGE_INTEGER,
+ CurrentSystemTime: PLARGE_INTEGER,
+ ThisYear: BOOLEAN,
+ ) -> BOOLEAN;
+ fn RtlSystemTimeToLocalTime(
+ SystemTime: PLARGE_INTEGER,
+ LocalTime: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn RtlLocalTimeToSystemTime(
+ LocalTime: PLARGE_INTEGER,
+ SystemTime: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn RtlTimeToElapsedTimeFields(
+ Time: PLARGE_INTEGER,
+ TimeFields: PTIME_FIELDS,
+ );
+ fn RtlTimeToTimeFields(
+ Time: PLARGE_INTEGER,
+ TimeFields: PTIME_FIELDS,
+ );
+ fn RtlTimeFieldsToTime(
+ TimeFields: PTIME_FIELDS,
+ Time: PLARGE_INTEGER,
+ ) -> BOOLEAN;
+ fn RtlTimeToSecondsSince1980(
+ Time: PLARGE_INTEGER,
+ ElapsedSeconds: PULONG,
+ ) -> BOOLEAN;
+ fn RtlSecondsSince1980ToTime(
+ ElapsedSeconds: ULONG,
+ Time: PLARGE_INTEGER,
+ );
+ fn RtlTimeToSecondsSince1970(
+ Time: PLARGE_INTEGER,
+ ElapsedSeconds: PULONG,
+ ) -> BOOLEAN;
+ fn RtlSecondsSince1970ToTime(
+ ElapsedSeconds: ULONG,
+ Time: PLARGE_INTEGER,
+ );
+}}
+STRUCT!{struct RTL_TIME_ZONE_INFORMATION {
+ Bias: LONG,
+ StandardName: [WCHAR; 32],
+ StandardStart: TIME_FIELDS,
+ StandardBias: LONG,
+ DaylightName: [WCHAR; 32],
+ DaylightStart: TIME_FIELDS,
+ DaylightBias: LONG,
+}}
+pub type PRTL_TIME_ZONE_INFORMATION = *mut RTL_TIME_ZONE_INFORMATION;
+EXTERN!{extern "system" {
+ fn RtlQueryTimeZoneInformation(
+ TimeZoneInformation: PRTL_TIME_ZONE_INFORMATION,
+ ) -> NTSTATUS;
+ fn RtlSetTimeZoneInformation(
+ TimeZoneInformation: PRTL_TIME_ZONE_INFORMATION,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct RTL_BITMAP {
+ SizeOfBitMap: ULONG,
+ Buffer: PULONG,
+}}
+pub type PRTL_BITMAP = *mut RTL_BITMAP;
+EXTERN!{extern "system" {
+ fn RtlInitializeBitMap(
+ BitMapHeader: PRTL_BITMAP,
+ BitMapBuffer: PULONG,
+ SizeOfBitMap: ULONG,
+ );
+ fn RtlClearBit(
+ BitMapHeader: PRTL_BITMAP,
+ BitNumber: ULONG,
+ );
+ fn RtlSetBit(
+ BitMapHeader: PRTL_BITMAP,
+ BitNumber: ULONG,
+ );
+ fn RtlTestBit(
+ BitMapHeader: PRTL_BITMAP,
+ BitNumber: ULONG,
+ ) -> BOOLEAN;
+ fn RtlClearAllBits(
+ BitMapHeader: PRTL_BITMAP,
+ );
+ fn RtlSetAllBits(
+ BitMapHeader: PRTL_BITMAP,
+ );
+ fn RtlFindClearBits(
+ BitMapHeader: PRTL_BITMAP,
+ NumberToFind: ULONG,
+ HintIndex: ULONG,
+ ) -> ULONG;
+ fn RtlFindSetBits(
+ BitMapHeader: PRTL_BITMAP,
+ NumberToFind: ULONG,
+ HintIndex: ULONG,
+ ) -> ULONG;
+ fn RtlFindClearBitsAndSet(
+ BitMapHeader: PRTL_BITMAP,
+ NumberToFind: ULONG,
+ HintIndex: ULONG,
+ ) -> ULONG;
+ fn RtlFindSetBitsAndClear(
+ BitMapHeader: PRTL_BITMAP,
+ NumberToFind: ULONG,
+ HintIndex: ULONG,
+ ) -> ULONG;
+ fn RtlClearBits(
+ BitMapHeader: PRTL_BITMAP,
+ StartingIndex: ULONG,
+ NumberToClear: ULONG,
+ );
+ fn RtlSetBits(
+ BitMapHeader: PRTL_BITMAP,
+ StartingIndex: ULONG,
+ NumberToSet: ULONG,
+ );
+ fn RtlFindMostSignificantBit(
+ Set: ULONGLONG,
+ ) -> CCHAR;
+ fn RtlFindLeastSignificantBit(
+ Set: ULONGLONG,
+ ) -> CCHAR;
+}}
+STRUCT!{struct RTL_BITMAP_RUN {
+ StartingIndex: ULONG,
+ NumberOfBits: ULONG,
+}}
+pub type PRTL_BITMAP_RUN = *mut RTL_BITMAP_RUN;
+EXTERN!{extern "system" {
+ fn RtlFindClearRuns(
+ BitMapHeader: PRTL_BITMAP,
+ RunArray: PRTL_BITMAP_RUN,
+ SizeOfRunArray: ULONG,
+ LocateLongestRuns: BOOLEAN,
+ ) -> ULONG;
+ fn RtlFindLongestRunClear(
+ BitMapHeader: PRTL_BITMAP,
+ StartingIndex: PULONG,
+ ) -> ULONG;
+ fn RtlFindFirstRunClear(
+ BitMapHeader: PRTL_BITMAP,
+ StartingIndex: PULONG,
+ ) -> ULONG;
+}}
+#[inline]
+pub unsafe fn RtlCheckBit(BitMapHeader: &RTL_BITMAP, BitPosition: ULONG) -> u8 {
+ #[cfg(target_arch = "x86_64")] {
+ core::arch::x86_64::_bittest64(BitMapHeader.Buffer as *const i64, BitPosition as i64)
+ }
+ #[cfg(any(target_arch = "x86", target_arch = "aarch64"))] {
+ (*BitMapHeader.Buffer.offset(BitPosition as isize / 32) >> (BitPosition % 32) & 1) as u8
+ }
+}
+EXTERN!{extern "system" {
+ fn RtlNumberOfClearBits(
+ BitMapHeader: PRTL_BITMAP,
+ ) -> ULONG;
+ fn RtlNumberOfSetBits(
+ BitMapHeader: PRTL_BITMAP,
+ ) -> ULONG;
+ fn RtlAreBitsClear(
+ BitMapHeader: PRTL_BITMAP,
+ StartingIndex: ULONG,
+ Length: ULONG,
+ ) -> BOOLEAN;
+ fn RtlAreBitsSet(
+ BitMapHeader: PRTL_BITMAP,
+ StartingIndex: ULONG,
+ Length: ULONG,
+ ) -> BOOLEAN;
+ fn RtlFindNextForwardRunClear(
+ BitMapHeader: PRTL_BITMAP,
+ FromIndex: ULONG,
+ StartingRunIndex: PULONG,
+ ) -> ULONG;
+ fn RtlFindLastBackwardRunClear(
+ BitMapHeader: PRTL_BITMAP,
+ FromIndex: ULONG,
+ StartingRunIndex: PULONG,
+ ) -> ULONG;
+ fn RtlNumberOfSetBitsUlongPtr(
+ Target: ULONG_PTR,
+ ) -> ULONG;
+ fn RtlInterlockedClearBitRun(
+ BitMapHeader: PRTL_BITMAP,
+ StartingIndex: ULONG,
+ NumberToClear: ULONG,
+ );
+ fn RtlInterlockedSetBitRun(
+ BitMapHeader: PRTL_BITMAP,
+ StartingIndex: ULONG,
+ NumberToSet: ULONG,
+ );
+ fn RtlCopyBitMap(
+ Source: PRTL_BITMAP,
+ Destination: PRTL_BITMAP,
+ TargetBit: ULONG,
+ );
+ fn RtlExtractBitMap(
+ Source: PRTL_BITMAP,
+ Destination: PRTL_BITMAP,
+ TargetBit: ULONG,
+ NumberOfBits: ULONG,
+ );
+ fn RtlNumberOfClearBitsInRange(
+ BitMapHeader: PRTL_BITMAP,
+ StartingIndex: ULONG,
+ Length: ULONG,
+ ) -> ULONG;
+ fn RtlNumberOfSetBitsInRange(
+ BitMapHeader: PRTL_BITMAP,
+ StartingIndex: ULONG,
+ Length: ULONG,
+ ) -> ULONG;
+}}
+STRUCT!{struct RTL_BITMAP_EX {
+ SizeOfBitMap: ULONG64,
+ Buffer: PULONG64,
+}}
+pub type PRTL_BITMAP_EX = *mut RTL_BITMAP_EX;
+EXTERN!{extern "system" {
+ fn RtlInitializeBitMapEx(
+ BitMapHeader: PRTL_BITMAP_EX,
+ BitMapBuffer: PULONG64,
+ SizeOfBitMap: ULONG64,
+ );
+ fn RtlTestBitEx(
+ BitMapHeader: PRTL_BITMAP_EX,
+ BitNumber: ULONG64,
+ ) -> BOOLEAN;
+ fn RtlClearAllBitsEx(
+ BitMapHeader: PRTL_BITMAP_EX,
+ );
+ fn RtlClearBitEx(
+ BitMapHeader: PRTL_BITMAP_EX,
+ BitNumber: ULONG64,
+ );
+ fn RtlSetBitEx(
+ BitMapHeader: PRTL_BITMAP_EX,
+ BitNumber: ULONG64,
+ );
+ fn RtlFindSetBitsEx(
+ BitMapHeader: PRTL_BITMAP_EX,
+ NumberToFind: ULONG64,
+ HintIndex: ULONG64,
+ ) -> ULONG64;
+ fn RtlFindSetBitsAndClearEx(
+ BitMapHeader: PRTL_BITMAP_EX,
+ NumberToFind: ULONG64,
+ HintIndex: ULONG64,
+ ) -> ULONG64;
+}}
+UNION!{union RTL_HANDLE_TABLE_ENTRY {
+ Flags: ULONG,
+ NextFree: *mut RTL_HANDLE_TABLE_ENTRY,
+}}
+pub type PRTL_HANDLE_TABLE_ENTRY = *mut RTL_HANDLE_TABLE_ENTRY;
+pub const RTL_HANDLE_ALLOCATED: USHORT = 0x0001;
+STRUCT!{struct RTL_HANDLE_TABLE {
+ MaximumNumberOfHandles: ULONG,
+ SizeOfHandleTableEntry: ULONG,
+ Reserved: [ULONG; 2],
+ FreeHandles: PRTL_HANDLE_TABLE_ENTRY,
+ CommittedHandles: PRTL_HANDLE_TABLE_ENTRY,
+ UnCommittedHandles: PRTL_HANDLE_TABLE_ENTRY,
+ MaxReservedHandles: PRTL_HANDLE_TABLE_ENTRY,
+}}
+pub type PRTL_HANDLE_TABLE = *mut RTL_HANDLE_TABLE;
+EXTERN!{extern "system" {
+ fn RtlInitializeHandleTable(
+ MaximumNumberOfHandles: ULONG,
+ SizeOfHandleTableEntry: ULONG,
+ HandleTable: PRTL_HANDLE_TABLE,
+ );
+ fn RtlDestroyHandleTable(
+ HandleTable: PRTL_HANDLE_TABLE,
+ ) -> NTSTATUS;
+ fn RtlAllocateHandle(
+ HandleTable: PRTL_HANDLE_TABLE,
+ HandleIndex: PULONG,
+ ) -> PRTL_HANDLE_TABLE_ENTRY;
+ fn RtlFreeHandle(
+ HandleTable: PRTL_HANDLE_TABLE,
+ Handle: PRTL_HANDLE_TABLE_ENTRY,
+ ) -> BOOLEAN;
+ fn RtlIsValidHandle(
+ HandleTable: PRTL_HANDLE_TABLE,
+ Handle: PRTL_HANDLE_TABLE_ENTRY,
+ ) -> BOOLEAN;
+ fn RtlIsValidIndexHandle(
+ HandleTable: PRTL_HANDLE_TABLE,
+ HandleIndex: ULONG,
+ Handle: *mut PRTL_HANDLE_TABLE_ENTRY,
+ ) -> BOOLEAN;
+}}
+pub const RTL_ATOM_MAXIMUM_INTEGER_ATOM: RTL_ATOM = 0xc000;
+pub const RTL_ATOM_INVALID_ATOM: RTL_ATOM = 0x0000;
+pub const RTL_ATOM_TABLE_DEFAULT_NUMBER_OF_BUCKETS: u32 = 37;
+pub const RTL_ATOM_MAXIMUM_NAME_LENGTH: u32 = 255;
+pub const RTL_ATOM_PINNED: u32 = 0x01;
+EXTERN!{extern "system" {
+ fn RtlCreateAtomTable(
+ NumberOfBuckets: ULONG,
+ AtomTableHandle: *mut PVOID,
+ ) -> NTSTATUS;
+ fn RtlDestroyAtomTable(
+ AtomTableHandle: PVOID,
+ ) -> NTSTATUS;
+ fn RtlEmptyAtomTable(
+ AtomTableHandle: PVOID,
+ IncludePinnedAtoms: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlAddAtomToAtomTable(
+ AtomTableHandle: PVOID,
+ AtomName: PWSTR,
+ Atom: PRTL_ATOM,
+ ) -> NTSTATUS;
+ fn RtlLookupAtomInAtomTable(
+ AtomTableHandle: PVOID,
+ AtomName: PWSTR,
+ Atom: PRTL_ATOM,
+ ) -> NTSTATUS;
+ fn RtlDeleteAtomFromAtomTable(
+ AtomTableHandle: PVOID,
+ Atom: RTL_ATOM,
+ ) -> NTSTATUS;
+ fn RtlPinAtomInAtomTable(
+ AtomTableHandle: PVOID,
+ Atom: RTL_ATOM,
+ ) -> NTSTATUS;
+ fn RtlQueryAtomInAtomTable(
+ AtomTableHandle: PVOID,
+ Atom: RTL_ATOM,
+ AtomUsage: PULONG,
+ AtomFlags: PULONG,
+ AtomName: PWSTR,
+ AtomNameLength: PULONG,
+ ) -> NTSTATUS;
+ fn RtlGetIntegerAtom(
+ AtomName: PWSTR,
+ IntegerAtom: PUSHORT,
+ ) -> BOOLEAN;
+ fn RtlValidSid(
+ Sid: PSID,
+ ) -> BOOLEAN;
+ fn RtlEqualSid(
+ Sid1: PSID,
+ Sid2: PSID,
+ ) -> BOOLEAN;
+ fn RtlEqualPrefixSid(
+ Sid1: PSID,
+ Sid2: PSID,
+ ) -> BOOLEAN;
+ fn RtlLengthRequiredSid(
+ SubAuthorityCount: ULONG,
+ ) -> ULONG;
+ fn RtlFreeSid(
+ Sid: PSID,
+ ) -> PVOID;
+ fn RtlAllocateAndInitializeSid(
+ IdentifierAuthority: PSID_IDENTIFIER_AUTHORITY,
+ SubAuthorityCount: UCHAR,
+ SubAuthority0: ULONG,
+ SubAuthority1: ULONG,
+ SubAuthority2: ULONG,
+ SubAuthority3: ULONG,
+ SubAuthority4: ULONG,
+ SubAuthority5: ULONG,
+ SubAuthority6: ULONG,
+ SubAuthority7: ULONG,
+ Sid: *mut PSID,
+ ) -> NTSTATUS;
+ fn RtlInitializeSid(
+ Sid: PSID,
+ IdentifierAuthority: PSID_IDENTIFIER_AUTHORITY,
+ SubAuthorityCount: UCHAR,
+ ) -> NTSTATUS;
+}}
+EXTERN!{extern "C" {
+ fn RtlInitializeSidEx(
+ Sid: PSID,
+ IdentifierAuthority: PSID_IDENTIFIER_AUTHORITY,
+ SubAuthorityCount: UCHAR,
+ ...
+ ) -> NTSTATUS;
+}}
+EXTERN!{extern "system" {
+ fn RtlIdentifierAuthoritySid(
+ Sid: PSID,
+ ) -> PSID_IDENTIFIER_AUTHORITY;
+ fn RtlSubAuthoritySid(
+ Sid: PSID,
+ SubAuthority: ULONG,
+ ) -> PULONG;
+ fn RtlSubAuthorityCountSid(
+ Sid: PSID,
+ ) -> PUCHAR;
+ fn RtlLengthSid(
+ Sid: PSID,
+ ) -> ULONG;
+ fn RtlCopySid(
+ DestinationSidLength: ULONG,
+ DestinationSid: PSID,
+ SourceSid: PSID,
+ ) -> NTSTATUS;
+ fn RtlCopySidAndAttributesArray(
+ Count: ULONG,
+ Src: PSID_AND_ATTRIBUTES,
+ SidAreaSize: ULONG,
+ Dest: PSID_AND_ATTRIBUTES,
+ SidArea: PSID,
+ RemainingSidArea: *mut PSID,
+ RemainingSidAreaSize: PULONG,
+ ) -> NTSTATUS;
+ fn RtlCreateServiceSid(
+ ServiceName: PUNICODE_STRING,
+ ServiceSid: PSID,
+ ServiceSidLength: PULONG,
+ ) -> NTSTATUS;
+ fn RtlSidDominates(
+ Sid1: PSID,
+ Sid2: PSID,
+ Dominates: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlSidDominatesForTrust(
+ Sid1: PSID,
+ Sid2: PSID,
+ DominatesTrust: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlSidEqualLevel(
+ Sid1: PSID,
+ Sid2: PSID,
+ EqualLevel: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlSidIsHigherLevel(
+ Sid1: PSID,
+ Sid2: PSID,
+ HigherLevel: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlCreateVirtualAccountSid(
+ Name: PCUNICODE_STRING,
+ BaseSubAuthority: ULONG,
+ Sid: PSID,
+ SidLength: PULONG,
+ ) -> NTSTATUS;
+ fn RtlReplaceSidInSd(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ OldSid: PSID,
+ NewSid: PSID,
+ NumChanges: *mut ULONG,
+ ) -> NTSTATUS;
+}}
+pub const MAX_UNICODE_STACK_BUFFER_LENGTH: usize = 256;
+EXTERN!{extern "system" {
+ fn RtlConvertSidToUnicodeString(
+ UnicodeString: PUNICODE_STRING,
+ Sid: PSID,
+ AllocateDestinationString: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlSidHashInitialize(
+ SidAttr: PSID_AND_ATTRIBUTES,
+ SidCount: ULONG,
+ SidAttrHash: PSID_AND_ATTRIBUTES_HASH,
+ ) -> NTSTATUS;
+ fn RtlSidHashLookup(
+ SidAttrHash: PSID_AND_ATTRIBUTES_HASH,
+ Sid: PSID,
+ ) -> PSID_AND_ATTRIBUTES;
+ fn RtlIsElevatedRid(
+ SidAttr: PSID_AND_ATTRIBUTES,
+ ) -> BOOLEAN;
+ fn RtlDeriveCapabilitySidsFromName(
+ UnicodeString: PUNICODE_STRING,
+ CapabilityGroupSid: PSID,
+ CapabilitySid: PSID,
+ ) -> NTSTATUS;
+ fn RtlCreateSecurityDescriptor(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ Revision: ULONG,
+ ) -> NTSTATUS;
+ fn RtlValidSecurityDescriptor(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ) -> BOOLEAN;
+ fn RtlLengthSecurityDescriptor(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ) -> ULONG;
+ fn RtlValidRelativeSecurityDescriptor(
+ SecurityDescriptorInput: PSECURITY_DESCRIPTOR,
+ SecurityDescriptorLength: ULONG,
+ RequiredInformation: SECURITY_INFORMATION,
+ ) -> BOOLEAN;
+ fn RtlGetControlSecurityDescriptor(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ Control: PSECURITY_DESCRIPTOR_CONTROL,
+ Revision: PULONG,
+ ) -> NTSTATUS;
+ fn RtlSetControlSecurityDescriptor(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ControlBitsOfInterest: SECURITY_DESCRIPTOR_CONTROL,
+ ControlBitsToSet: SECURITY_DESCRIPTOR_CONTROL,
+ ) -> NTSTATUS;
+ fn RtlSetAttributesSecurityDescriptor(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ Control: SECURITY_DESCRIPTOR_CONTROL,
+ Revision: PULONG,
+ ) -> NTSTATUS;
+ fn RtlGetSecurityDescriptorRMControl(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ RMControl: PUCHAR,
+ ) -> BOOLEAN;
+ fn RtlSetSecurityDescriptorRMControl(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ RMControl: PUCHAR,
+ );
+ fn RtlSetDaclSecurityDescriptor(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ DaclPresent: BOOLEAN,
+ Dacl: PACL,
+ DaclDefaulted: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlGetDaclSecurityDescriptor(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ DaclPresent: PBOOLEAN,
+ Dacl: *mut PACL,
+ DaclDefaulted: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlSetSaclSecurityDescriptor(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ SaclPresent: BOOLEAN,
+ Sacl: PACL,
+ SaclDefaulted: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlGetSaclSecurityDescriptor(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ SaclPresent: PBOOLEAN,
+ Sacl: *mut PACL,
+ SaclDefaulted: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlSetOwnerSecurityDescriptor(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ Owner: PSID,
+ OwnerDefaulted: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlGetOwnerSecurityDescriptor(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ Owner: *mut PSID,
+ OwnerDefaulted: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlSetGroupSecurityDescriptor(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ Group: PSID,
+ GroupDefaulted: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlGetGroupSecurityDescriptor(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ Group: *mut PSID,
+ GroupDefaulted: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlMakeSelfRelativeSD(
+ AbsoluteSecurityDescriptor: PSECURITY_DESCRIPTOR,
+ SelfRelativeSecurityDescriptor: PSECURITY_DESCRIPTOR,
+ BufferLength: PULONG,
+ ) -> NTSTATUS;
+ fn RtlAbsoluteToSelfRelativeSD(
+ AbsoluteSecurityDescriptor: PSECURITY_DESCRIPTOR,
+ SelfRelativeSecurityDescriptor: PSECURITY_DESCRIPTOR,
+ BufferLength: PULONG,
+ ) -> NTSTATUS;
+ fn RtlSelfRelativeToAbsoluteSD(
+ SelfRelativeSecurityDescriptor: PSECURITY_DESCRIPTOR,
+ AbsoluteSecurityDescriptor: PSECURITY_DESCRIPTOR,
+ AbsoluteSecurityDescriptorSize: PULONG,
+ Dacl: PACL,
+ DaclSize: PULONG,
+ Sacl: PACL,
+ SaclSize: PULONG,
+ Owner: PSID,
+ OwnerSize: PULONG,
+ PrimaryGroup: PSID,
+ PrimaryGroupSize: PULONG,
+ ) -> NTSTATUS;
+ fn RtlSelfRelativeToAbsoluteSD2(
+ pSelfRelativeSecurityDescriptor: PSECURITY_DESCRIPTOR,
+ pBufferSize: PULONG,
+ ) -> NTSTATUS;
+ fn RtlAreAllAccessesGranted(
+ GrantedAccess: ACCESS_MASK,
+ DesiredAccess: ACCESS_MASK,
+ ) -> BOOLEAN;
+ fn RtlAreAnyAccessesGranted(
+ GrantedAccess: ACCESS_MASK,
+ DesiredAccess: ACCESS_MASK,
+ ) -> BOOLEAN;
+ fn RtlMapGenericMask(
+ AccessMask: PACCESS_MASK,
+ GenericMapping: PGENERIC_MAPPING,
+ );
+ fn RtlCreateAcl(
+ Acl: PACL,
+ AclLength: ULONG,
+ AclRevision: ULONG,
+ ) -> NTSTATUS;
+ fn RtlValidAcl(
+ Acl: PACL,
+ ) -> BOOLEAN;
+ fn RtlQueryInformationAcl(
+ Acl: PACL,
+ AclInformation: PVOID,
+ AclInformationLength: ULONG,
+ AclInformationClass: ACL_INFORMATION_CLASS,
+ ) -> NTSTATUS;
+ fn RtlSetInformationAcl(
+ Acl: PACL,
+ AclInformation: PVOID,
+ AclInformationLength: ULONG,
+ AclInformationClass: ACL_INFORMATION_CLASS,
+ ) -> NTSTATUS;
+ fn RtlAddAce(
+ Acl: PACL,
+ AceRevision: ULONG,
+ StartingAceIndex: ULONG,
+ AceList: PVOID,
+ AceListLength: ULONG,
+ ) -> NTSTATUS;
+ fn RtlDeleteAce(
+ Acl: PACL,
+ AceIndex: ULONG,
+ ) -> NTSTATUS;
+ fn RtlGetAce(
+ Acl: PACL,
+ AceIndex: ULONG,
+ Ace: *mut PVOID,
+ ) -> NTSTATUS;
+ fn RtlFirstFreeAce(
+ Acl: PACL,
+ FirstFree: *mut PVOID,
+ ) -> BOOLEAN;
+ fn RtlFindAceByType(
+ pAcl: PACL,
+ AceType: UCHAR,
+ pIndex: PULONG,
+ ) -> PVOID;
+ fn RtlOwnerAcesPresent(
+ pAcl: PACL,
+ ) -> BOOLEAN;
+ fn RtlAddAccessAllowedAce(
+ Acl: PACL,
+ AceRevision: ULONG,
+ AccessMask: ACCESS_MASK,
+ Sid: PSID,
+ ) -> NTSTATUS;
+ fn RtlAddAccessAllowedAceEx(
+ Acl: PACL,
+ AceRevision: ULONG,
+ AceFlags: ULONG,
+ AccessMask: ACCESS_MASK,
+ Sid: PSID,
+ ) -> NTSTATUS;
+ fn RtlAddAccessDeniedAce(
+ Acl: PACL,
+ AceRevision: ULONG,
+ AccessMask: ACCESS_MASK,
+ Sid: PSID,
+ ) -> NTSTATUS;
+ fn RtlAddAccessDeniedAceEx(
+ Acl: PACL,
+ AceRevision: ULONG,
+ AceFlags: ULONG,
+ AccessMask: ACCESS_MASK,
+ Sid: PSID,
+ ) -> NTSTATUS;
+ fn RtlAddAuditAccessAce(
+ Acl: PACL,
+ AceRevision: ULONG,
+ AccessMask: ACCESS_MASK,
+ Sid: PSID,
+ AuditSuccess: BOOLEAN,
+ AuditFailure: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlAddAuditAccessAceEx(
+ Acl: PACL,
+ AceRevision: ULONG,
+ AceFlags: ULONG,
+ AccessMask: ACCESS_MASK,
+ Sid: PSID,
+ AuditSuccess: BOOLEAN,
+ AuditFailure: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlAddAccessAllowedObjectAce(
+ Acl: PACL,
+ AceRevision: ULONG,
+ AceFlags: ULONG,
+ AccessMask: ACCESS_MASK,
+ ObjectTypeGuid: *mut GUID,
+ InheritedObjectTypeGuid: *mut GUID,
+ Sid: PSID,
+ ) -> NTSTATUS;
+ fn RtlAddAccessDeniedObjectAce(
+ Acl: PACL,
+ AceRevision: ULONG,
+ AceFlags: ULONG,
+ AccessMask: ACCESS_MASK,
+ ObjectTypeGuid: *mut GUID,
+ InheritedObjectTypeGuid: *mut GUID,
+ Sid: PSID,
+ ) -> NTSTATUS;
+ fn RtlAddAuditAccessObjectAce(
+ Acl: PACL,
+ AceRevision: ULONG,
+ AceFlags: ULONG,
+ AccessMask: ACCESS_MASK,
+ ObjectTypeGuid: *mut GUID,
+ InheritedObjectTypeGuid: *mut GUID,
+ Sid: PSID,
+ AuditSuccess: BOOLEAN,
+ AuditFailure: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlAddCompoundAce(
+ Acl: PACL,
+ AceRevision: ULONG,
+ AceType: UCHAR,
+ AccessMask: ACCESS_MASK,
+ ServerSid: PSID,
+ ClientSid: PSID,
+ ) -> NTSTATUS;
+ fn RtlAddMandatoryAce(
+ Acl: PACL,
+ AceRevision: ULONG,
+ AceFlags: ULONG,
+ Sid: PSID,
+ AceType: UCHAR,
+ AccessMask: ACCESS_MASK,
+ ) -> NTSTATUS;
+ fn RtlDefaultNpAcl(
+ Acl: *mut PACL,
+ ) -> NTSTATUS;
+ fn RtlNewSecurityObject(
+ ParentDescriptor: PSECURITY_DESCRIPTOR,
+ CreatorDescriptor: PSECURITY_DESCRIPTOR,
+ NewDescriptor: *mut PSECURITY_DESCRIPTOR,
+ IsDirectoryObject: BOOLEAN,
+ Token: HANDLE,
+ GenericMapping: PGENERIC_MAPPING,
+ ) -> NTSTATUS;
+ fn RtlNewSecurityObjectEx(
+ ParentDescriptor: PSECURITY_DESCRIPTOR,
+ CreatorDescriptor: PSECURITY_DESCRIPTOR,
+ NewDescriptor: *mut PSECURITY_DESCRIPTOR,
+ ObjectType: *mut GUID,
+ IsDirectoryObject: BOOLEAN,
+ AutoInheritFlags: ULONG,
+ Token: HANDLE,
+ GenericMapping: PGENERIC_MAPPING,
+ ) -> NTSTATUS;
+ fn RtlNewSecurityObjectWithMultipleInheritance(
+ ParentDescriptor: PSECURITY_DESCRIPTOR,
+ CreatorDescriptor: PSECURITY_DESCRIPTOR,
+ NewDescriptor: *mut PSECURITY_DESCRIPTOR,
+ ObjectType: *mut *mut GUID,
+ GuidCount: ULONG,
+ IsDirectoryObject: BOOLEAN,
+ AutoInheritFlags: ULONG,
+ Token: HANDLE,
+ GenericMapping: PGENERIC_MAPPING,
+ ) -> NTSTATUS;
+ fn RtlDeleteSecurityObject(
+ ObjectDescriptor: *mut PSECURITY_DESCRIPTOR,
+ ) -> NTSTATUS;
+ fn RtlQuerySecurityObject(
+ ObjectDescriptor: PSECURITY_DESCRIPTOR,
+ SecurityInformation: SECURITY_INFORMATION,
+ ResultantDescriptor: PSECURITY_DESCRIPTOR,
+ DescriptorLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn RtlSetSecurityObject(
+ SecurityInformation: SECURITY_INFORMATION,
+ ModificationDescriptor: PSECURITY_DESCRIPTOR,
+ ObjectsSecurityDescriptor: *mut PSECURITY_DESCRIPTOR,
+ GenericMapping: PGENERIC_MAPPING,
+ Token: HANDLE,
+ ) -> NTSTATUS;
+ fn RtlSetSecurityObjectEx(
+ SecurityInformation: SECURITY_INFORMATION,
+ ModificationDescriptor: PSECURITY_DESCRIPTOR,
+ ObjectsSecurityDescriptor: *mut PSECURITY_DESCRIPTOR,
+ AutoInheritFlags: ULONG,
+ GenericMapping: PGENERIC_MAPPING,
+ Token: HANDLE,
+ ) -> NTSTATUS;
+ fn RtlConvertToAutoInheritSecurityObject(
+ ParentDescriptor: PSECURITY_DESCRIPTOR,
+ CurrentSecurityDescriptor: PSECURITY_DESCRIPTOR,
+ NewSecurityDescriptor: *mut PSECURITY_DESCRIPTOR,
+ ObjectType: *mut GUID,
+ IsDirectoryObject: BOOLEAN,
+ GenericMapping: PGENERIC_MAPPING,
+ ) -> NTSTATUS;
+ fn RtlNewInstanceSecurityObject(
+ ParentDescriptorChanged: BOOLEAN,
+ CreatorDescriptorChanged: BOOLEAN,
+ OldClientTokenModifiedId: PLUID,
+ NewClientTokenModifiedId: PLUID,
+ ParentDescriptor: PSECURITY_DESCRIPTOR,
+ CreatorDescriptor: PSECURITY_DESCRIPTOR,
+ NewDescriptor: *mut PSECURITY_DESCRIPTOR,
+ IsDirectoryObject: BOOLEAN,
+ Token: HANDLE,
+ GenericMapping: PGENERIC_MAPPING,
+ ) -> NTSTATUS;
+ fn RtlCopySecurityDescriptor(
+ InputSecurityDescriptor: PSECURITY_DESCRIPTOR,
+ OutputSecurityDescriptor: *mut PSECURITY_DESCRIPTOR,
+ ) -> NTSTATUS;
+ fn RtlRunEncodeUnicodeString(
+ Seed: PUCHAR,
+ String: PUNICODE_STRING,
+ );
+ fn RtlRunDecodeUnicodeString(
+ Seed: UCHAR,
+ String: PUNICODE_STRING,
+ );
+ fn RtlImpersonateSelf(
+ ImpersonationLevel: SECURITY_IMPERSONATION_LEVEL,
+ ) -> NTSTATUS;
+ fn RtlImpersonateSelfEx(
+ ImpersonationLevel: SECURITY_IMPERSONATION_LEVEL,
+ AdditionalAccess: ACCESS_MASK,
+ ThreadToken: PHANDLE,
+ ) -> NTSTATUS;
+ fn RtlAdjustPrivilege(
+ Privilege: ULONG,
+ Enable: BOOLEAN,
+ Client: BOOLEAN,
+ WasEnabled: PBOOLEAN,
+ ) -> NTSTATUS;
+}}
+pub const RTL_ACQUIRE_PRIVILEGE_REVERT: ULONG = 0x00000001;
+pub const RTL_ACQUIRE_PRIVILEGE_PROCESS: ULONG = 0x00000002;
+EXTERN!{extern "system" {
+ fn RtlAcquirePrivilege(
+ Privilege: PULONG,
+ NumPriv: ULONG,
+ Flags: ULONG,
+ ReturnedState: *mut PVOID,
+ ) -> NTSTATUS;
+ fn RtlReleasePrivilege(
+ StatePointer: PVOID,
+ );
+ fn RtlRemovePrivileges(
+ TokenHandle: HANDLE,
+ PrivilegesToKeep: PULONG,
+ PrivilegeCount: ULONG,
+ ) -> NTSTATUS;
+ fn RtlIsUntrustedObject(
+ Handle: HANDLE,
+ Object: PVOID,
+ IsUntrustedObject: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlQueryValidationRunlevel(
+ ComponentName: PUNICODE_STRING,
+ ) -> ULONG;
+ fn RtlCreateBoundaryDescriptor(
+ Name: PUNICODE_STRING,
+ Flags: ULONG,
+ ) -> PVOID;
+ fn RtlDeleteBoundaryDescriptor(
+ BoundaryDescriptor: PVOID,
+ );
+ fn RtlAddSIDToBoundaryDescriptor(
+ BoundaryDescriptor: *mut PVOID,
+ RequiredSid: PSID,
+ ) -> NTSTATUS;
+ fn RtlAddIntegrityLabelToBoundaryDescriptor(
+ BoundaryDescriptor: *mut PVOID,
+ IntegrityLabel: PSID,
+ ) -> NTSTATUS;
+ fn RtlGetVersion(
+ lpVersionInformation: PRTL_OSVERSIONINFOW,
+ ) -> NTSTATUS;
+ fn RtlVerifyVersionInfo(
+ VersionInfo: PRTL_OSVERSIONINFOEXW,
+ TypeMask: ULONG,
+ ConditionMask: ULONGLONG,
+ ) -> NTSTATUS;
+ fn RtlGetNtVersionNumbers(
+ NtMajorVersion: PULONG,
+ NtMinorVersion: PULONG,
+ NtBuildNumber: PULONG,
+ );
+ fn RtlGetNtGlobalFlags() -> ULONG;
+ fn RtlGetNtProductType(
+ NtProductType: PNT_PRODUCT_TYPE,
+ ) -> BOOLEAN;
+ fn RtlGetSuiteMask() -> ULONG;
+ fn RtlRegisterWait(
+ WaitHandle: PHANDLE,
+ Handle: HANDLE,
+ Function: WAITORTIMERCALLBACKFUNC,
+ Context: PVOID,
+ Milliseconds: ULONG,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn RtlDeregisterWait(
+ WaitHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn RtlDeregisterWaitEx(
+ WaitHandle: HANDLE,
+ Event: HANDLE,
+ ) -> NTSTATUS;
+ fn RtlQueueWorkItem(
+ Function: WORKERCALLBACKFUNC,
+ Context: PVOID,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn RtlSetIoCompletionCallback(
+ FileHandle: HANDLE,
+ CompletionProc: APC_CALLBACK_FUNCTION,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+}}
+FN!{stdcall PRTL_START_POOL_THREAD(
+ Function: PTHREAD_START_ROUTINE,
+ Parameter: PVOID,
+ ThreadHandle: PHANDLE,
+) -> NTSTATUS}
+FN!{stdcall PRTL_EXIT_POOL_THREAD(
+ ExitStatus: NTSTATUS,
+) -> NTSTATUS}
+EXTERN!{extern "system" {
+ fn RtlSetThreadPoolStartFunc(
+ StartPoolThread: PRTL_START_POOL_THREAD,
+ ExitPoolThread: PRTL_EXIT_POOL_THREAD,
+ ) -> NTSTATUS;
+ fn RtlUserThreadStart(
+ Function: PTHREAD_START_ROUTINE,
+ Parameter: PVOID,
+ );
+ fn LdrInitializeThunk(
+ ContextRecord: PCONTEXT,
+ Parameter: PVOID,
+ );
+ fn RtlCreateTimerQueue(
+ TimerQueueHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn RtlCreateTimer(
+ TimerQueueHandle: HANDLE,
+ Handle: PHANDLE,
+ Function: WAITORTIMERCALLBACKFUNC,
+ Context: PVOID,
+ DueTime: ULONG,
+ Period: ULONG,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn RtlUpdateTimer(
+ TimerQueueHandle: HANDLE,
+ TimerHandle: HANDLE,
+ DueTime: ULONG,
+ Period: ULONG,
+ ) -> NTSTATUS;
+ fn RtlDeleteTimer(
+ TimerQueueHandle: HANDLE,
+ TimerToCancel: HANDLE,
+ Event: HANDLE,
+ ) -> NTSTATUS;
+ fn RtlDeleteTimerQueue(
+ TimerQueueHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn RtlDeleteTimerQueueEx(
+ TimerQueueHandle: HANDLE,
+ Event: HANDLE,
+ ) -> NTSTATUS;
+ fn RtlFormatCurrentUserKeyPath(
+ CurrentUserKeyPath: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn RtlOpenCurrentUser(
+ DesiredAccess: ACCESS_MASK,
+ CurrentUserKey: PHANDLE,
+ ) -> NTSTATUS;
+}}
+pub const RTL_REGISTRY_ABSOLUTE: ULONG = 0;
+pub const RTL_REGISTRY_SERVICES: ULONG = 1;
+pub const RTL_REGISTRY_CONTROL: ULONG = 2;
+pub const RTL_REGISTRY_WINDOWS_NT: ULONG = 3;
+pub const RTL_REGISTRY_DEVICEMAP: ULONG = 4;
+pub const RTL_REGISTRY_USER: ULONG = 5;
+pub const RTL_REGISTRY_MAXIMUM: ULONG = 6;
+pub const RTL_REGISTRY_HANDLE: ULONG = 0x40000000;
+pub const RTL_REGISTRY_OPTIONAL: ULONG = 0x80000000;
+EXTERN!{extern "system" {
+ fn RtlCreateRegistryKey(
+ RelativeTo: ULONG,
+ Path: PWSTR,
+ ) -> NTSTATUS;
+ fn RtlCheckRegistryKey(
+ RelativeTo: ULONG,
+ Path: PWSTR,
+ ) -> NTSTATUS;
+}}
+FN!{stdcall PRTL_QUERY_REGISTRY_ROUTINE(
+ ValueName: PWSTR,
+ ValueType: ULONG,
+ ValueData: PVOID,
+ ValueLength: ULONG,
+ Context: PVOID,
+ EntryContext: PVOID,
+) -> NTSTATUS}
+STRUCT!{struct RTL_QUERY_REGISTRY_TABLE {
+ QueryRoutine: PRTL_QUERY_REGISTRY_ROUTINE,
+ Flags: ULONG,
+ Name: PWSTR,
+ EntryContext: PVOID,
+ DefaultType: ULONG,
+ DefaultData: PVOID,
+ DefaultLength: ULONG,
+}}
+pub type PRTL_QUERY_REGISTRY_TABLE = *mut RTL_QUERY_REGISTRY_TABLE;
+pub const RTL_QUERY_REGISTRY_SUBKEY: ULONG = 0x00000001;
+pub const RTL_QUERY_REGISTRY_TOPKEY: ULONG = 0x00000002;
+pub const RTL_QUERY_REGISTRY_REQUIRED: ULONG = 0x00000004;
+pub const RTL_QUERY_REGISTRY_NOVALUE: ULONG = 0x00000008;
+pub const RTL_QUERY_REGISTRY_NOEXPAND: ULONG = 0x00000010;
+pub const RTL_QUERY_REGISTRY_DIRECT: ULONG = 0x00000020;
+pub const RTL_QUERY_REGISTRY_DELETE: ULONG = 0x00000040;
+EXTERN!{extern "system" {
+ fn RtlQueryRegistryValues(
+ RelativeTo: ULONG,
+ Path: PCWSTR,
+ QueryTable: PRTL_QUERY_REGISTRY_TABLE,
+ Context: PVOID,
+ Environment: PVOID,
+ ) -> NTSTATUS;
+ fn RtlQueryRegistryValuesEx(
+ RelativeTo: ULONG,
+ Path: PWSTR,
+ QueryTable: PRTL_QUERY_REGISTRY_TABLE,
+ Context: PVOID,
+ Environment: PVOID,
+ ) -> NTSTATUS;
+ fn RtlWriteRegistryValue(
+ RelativeTo: ULONG,
+ Path: PCWSTR,
+ ValueName: PCWSTR,
+ ValueType: ULONG,
+ ValueData: PVOID,
+ ValueLength: ULONG,
+ ) -> NTSTATUS;
+ fn RtlDeleteRegistryValue(
+ RelativeTo: ULONG,
+ Path: PCWSTR,
+ ValueName: PCWSTR,
+ ) -> NTSTATUS;
+ fn RtlEnableThreadProfiling(
+ ThreadHandle: HANDLE,
+ Flags: ULONG,
+ HardwareCounters: ULONG64,
+ PerformanceDataHandle: *mut PVOID,
+ ) -> NTSTATUS;
+ fn RtlDisableThreadProfiling(
+ PerformanceDataHandle: PVOID,
+ ) -> NTSTATUS;
+ fn RtlQueryThreadProfiling(
+ ThreadHandle: HANDLE,
+ Enabled: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlReadThreadProfilingData(
+ PerformanceDataHandle: HANDLE,
+ Flags: ULONG,
+ PerformanceData: PPERFORMANCE_DATA,
+ ) -> NTSTATUS;
+ fn RtlGetNativeSystemInformation(
+ SystemInformationClass: ULONG,
+ NativeSystemInformation: PVOID,
+ InformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn RtlQueueApcWow64Thread(
+ ThreadHandle: HANDLE,
+ ApcRoutine: PPS_APC_ROUTINE,
+ ApcArgument1: PVOID,
+ ApcArgument2: PVOID,
+ ApcArgument3: PVOID,
+ ) -> NTSTATUS;
+ fn RtlWow64EnableFsRedirection(
+ Wow64FsEnableRedirection: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlWow64EnableFsRedirectionEx(
+ Wow64FsEnableRedirection: PVOID,
+ OldFsRedirectionLevel: *mut PVOID,
+ ) -> NTSTATUS;
+ fn RtlComputeCrc32(
+ PartialCrc: ULONG32,
+ Buffer: PVOID,
+ Length: ULONG,
+ ) -> ULONG32;
+ fn RtlEncodePointer(
+ Ptr: PVOID,
+ ) -> PVOID;
+ fn RtlDecodePointer(
+ Ptr: PVOID,
+ ) -> PVOID;
+ fn RtlEncodeSystemPointer(
+ Ptr: PVOID,
+ ) -> PVOID;
+ fn RtlDecodeSystemPointer(
+ Ptr: PVOID,
+ ) -> PVOID;
+ fn RtlEncodeRemotePointer(
+ ProcessHandle: HANDLE,
+ Pointer: PVOID,
+ EncodedPointer: *mut PVOID,
+ ) -> NTSTATUS;
+ fn RtlDecodeRemotePointer(
+ ProcessHandle: HANDLE,
+ Pointer: PVOID,
+ DecodedPointer: *mut PVOID,
+ ) -> NTSTATUS;
+ fn RtlIsProcessorFeaturePresent(
+ ProcessorFeature: ULONG,
+ ) -> BOOLEAN;
+ fn RtlGetCurrentProcessorNumber() -> ULONG;
+ fn RtlGetCurrentProcessorNumberEx(
+ ProcessorNumber: PPROCESSOR_NUMBER,
+ );
+ fn RtlPushFrame(
+ Frame: PTEB_ACTIVE_FRAME,
+ );
+ fn RtlPopFrame(
+ Frame: PTEB_ACTIVE_FRAME,
+ );
+ fn RtlGetFrame() -> PTEB_ACTIVE_FRAME;
+}}
+pub const RTL_WALK_USER_MODE_STACK: ULONG = 0x00000001;
+pub const RTL_WALK_VALID_FLAGS: ULONG = 0x00000001;
+pub const RTL_STACK_WALKING_MODE_FRAMES_TO_SKIP_SHIFT: ULONG = 0x00000008;
+EXTERN!{extern "system" {
+ fn RtlWalkFrameChain(
+ Callers: *mut PVOID,
+ Count: ULONG,
+ Flags: ULONG,
+ ) -> ULONG;
+ fn RtlGetCallersAddress(
+ CallersAddress: *mut PVOID,
+ CallersCaller: *mut PVOID,
+ );
+ fn RtlGetEnabledExtendedFeatures(
+ FeatureMask: ULONG64,
+ ) -> ULONG64;
+ fn RtlGetEnabledExtendedAndSupervisorFeatures(
+ FeatureMask: ULONG64,
+ ) -> ULONG64;
+ fn RtlLocateSupervisorFeature(
+ XStateHeader: PXSAVE_AREA_HEADER,
+ FeatureId: ULONG,
+ Length: PULONG,
+ ) -> PVOID;
+}}
+STRUCT!{struct RTL_ELEVATION_FLAGS {
+ Flags: ULONG,
+}}
+BITFIELD!{RTL_ELEVATION_FLAGS Flags: ULONG [
+ ElevationEnabled set_ElevationEnabled[0..1],
+ VirtualizationEnabled set_VirtualizationEnabled[1..2],
+ InstallerDetectEnabled set_InstallerDetectEnabled[2..3],
+ ReservedBits set_ReservedBits[3..32],
+]}
+pub type PRTL_ELEVATION_FLAGS = *mut RTL_ELEVATION_FLAGS;
+EXTERN!{extern "system" {
+ fn RtlQueryElevationFlags(
+ Flags: PRTL_ELEVATION_FLAGS,
+ ) -> NTSTATUS;
+ fn RtlRegisterThreadWithCsrss() -> NTSTATUS;
+ fn RtlLockCurrentThread() -> NTSTATUS;
+ fn RtlUnlockCurrentThread() -> NTSTATUS;
+ fn RtlLockModuleSection(
+ Address: PVOID,
+ ) -> NTSTATUS;
+ fn RtlUnlockModuleSection(
+ Address: PVOID,
+ ) -> NTSTATUS;
+}}
+pub const RTL_UNLOAD_EVENT_TRACE_NUMBER: u32 = 64;
+STRUCT!{struct RTL_UNLOAD_EVENT_TRACE {
+ BaseAddress: PVOID,
+ SizeOfImage: SIZE_T,
+ Sequence: ULONG,
+ TimeDateStamp: ULONG,
+ CheckSum: ULONG,
+ ImageName: [WCHAR; 32],
+ Version: [ULONG; 2],
+}}
+pub type PRTL_UNLOAD_EVENT_TRACE = *mut RTL_UNLOAD_EVENT_TRACE;
+STRUCT!{struct RTL_UNLOAD_EVENT_TRACE32 {
+ BaseAddress: ULONG,
+ SizeOfImage: ULONG,
+ Sequence: ULONG,
+ TimeDateStamp: ULONG,
+ CheckSum: ULONG,
+ ImageName: [WCHAR; 32],
+ Version: [ULONG; 2],
+}}
+pub type PRTL_UNLOAD_EVENT_TRACE32 = *mut RTL_UNLOAD_EVENT_TRACE32;
+EXTERN!{extern "system" {
+ fn RtlGetUnloadEventTrace() -> PRTL_UNLOAD_EVENT_TRACE;
+ fn RtlGetUnloadEventTraceEx(
+ ElementSize: *mut PULONG,
+ ElementCount: *mut PULONG,
+ EventTrace: *mut PVOID,
+ );
+ fn RtlQueryPerformanceCounter(
+ PerformanceCounter: PLARGE_INTEGER,
+ ) -> LOGICAL;
+ fn RtlQueryPerformanceFrequency(
+ PerformanceFrequency: PLARGE_INTEGER,
+ ) -> LOGICAL;
+}}
+ENUM!{enum IMAGE_MITIGATION_POLICY {
+ ImageDepPolicy = 0,
+ ImageAslrPolicy = 1,
+ ImageDynamicCodePolicy = 2,
+ ImageStrictHandleCheckPolicy = 3,
+ ImageSystemCallDisablePolicy = 4,
+ ImageMitigationOptionsMask = 5,
+ ImageExtensionPointDisablePolicy = 6,
+ ImageControlFlowGuardPolicy = 7,
+ ImageSignaturePolicy = 8,
+ ImageFontDisablePolicy = 9,
+ ImageImageLoadPolicy = 10,
+ ImagePayloadRestrictionPolicy = 11,
+ ImageChildProcessPolicy = 12,
+ ImageSehopPolicy = 13,
+ ImageHeapPolicy = 14,
+ MaxImageMitigationPolicy = 15,
+}}
+UNION!{union RTL_IMAGE_MITIGATION_POLICY {
+ Bitfields1: ULONG64,
+ Bitfields2: ULONG64,
+}}
+BITFIELD!{unsafe RTL_IMAGE_MITIGATION_POLICY Bitfields1: ULONG64 [
+ AuditState set_AuditState[0..2],
+ AuditFlag set_AuditFlag[2..3],
+ EnableAdditionalAuditingOption set_EnableAdditionalAuditingOption[3..4],
+ Reserved set_Reserved[4..64],
+]}
+BITFIELD!{unsafe RTL_IMAGE_MITIGATION_POLICY Bitfields2: ULONG64 [
+ PolicyState set_PolicyState[0..2],
+ AlwaysInherit set_AlwaysInherit[2..3],
+ EnableAdditionalPolicyOption set_EnableAdditionalPolicyOption[3..4],
+ AuditReserved set_AuditReserved[4..64],
+]}
+pub type PRTL_IMAGE_MITIGATION_POLICY = *mut RTL_IMAGE_MITIGATION_POLICY;
+STRUCT!{struct RTL_IMAGE_MITIGATION_DEP_POLICY {
+ Dep: RTL_IMAGE_MITIGATION_POLICY,
+}}
+pub type PRTL_IMAGE_MITIGATION_DEP_POLICY = *mut RTL_IMAGE_MITIGATION_DEP_POLICY;
+STRUCT!{struct RTL_IMAGE_MITIGATION_ASLR_POLICY {
+ ForceRelocateImages: RTL_IMAGE_MITIGATION_POLICY,
+ BottomUpRandomization: RTL_IMAGE_MITIGATION_POLICY,
+ HighEntropyRandomization: RTL_IMAGE_MITIGATION_POLICY,
+}}
+pub type PRTL_IMAGE_MITIGATION_ASLR_POLICY = *mut RTL_IMAGE_MITIGATION_ASLR_POLICY;
+STRUCT!{struct RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY {
+ BlockDynamicCode: RTL_IMAGE_MITIGATION_POLICY,
+}}
+pub type PRTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY = *mut RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY;
+STRUCT!{struct RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY {
+ StrictHandleChecks: RTL_IMAGE_MITIGATION_POLICY,
+}}
+pub type PRTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY =
+ *mut RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY;
+STRUCT!{struct RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY {
+ BlockWin32kSystemCalls: RTL_IMAGE_MITIGATION_POLICY,
+}}
+pub type PRTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY =
+ *mut RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY;
+STRUCT!{struct RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY {
+ DisableExtensionPoints: RTL_IMAGE_MITIGATION_POLICY,
+}}
+pub type PRTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY =
+ *mut RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY;
+STRUCT!{struct RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY {
+ ControlFlowGuard: RTL_IMAGE_MITIGATION_POLICY,
+ StrictControlFlowGuard: RTL_IMAGE_MITIGATION_POLICY,
+}}
+pub type PRTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY =
+ *mut RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY;
+STRUCT!{struct RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY {
+ BlockNonMicrosoftSignedBinaries: RTL_IMAGE_MITIGATION_POLICY,
+ EnforceSigningOnModuleDependencies: RTL_IMAGE_MITIGATION_POLICY,
+}}
+pub type PRTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY =
+ *mut RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY;
+STRUCT!{struct RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY {
+ DisableNonSystemFonts: RTL_IMAGE_MITIGATION_POLICY,
+}}
+pub type PRTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY = *mut RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY;
+STRUCT!{struct RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY {
+ BlockRemoteImageLoads: RTL_IMAGE_MITIGATION_POLICY,
+ BlockLowLabelImageLoads: RTL_IMAGE_MITIGATION_POLICY,
+ PreferSystem32: RTL_IMAGE_MITIGATION_POLICY,
+}}
+pub type PRTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY = *mut RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY;
+STRUCT!{struct RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY {
+ EnableExportAddressFilter: RTL_IMAGE_MITIGATION_POLICY,
+ EnableExportAddressFilterPlus: RTL_IMAGE_MITIGATION_POLICY,
+ EnableImportAddressFilter: RTL_IMAGE_MITIGATION_POLICY,
+ EnableRopStackPivot: RTL_IMAGE_MITIGATION_POLICY,
+ EnableRopCallerCheck: RTL_IMAGE_MITIGATION_POLICY,
+ EnableRopSimExec: RTL_IMAGE_MITIGATION_POLICY,
+}}
+pub type PRTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY =
+ *mut RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY;
+STRUCT!{struct RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY {
+ DisallowChildProcessCreation: RTL_IMAGE_MITIGATION_POLICY,
+}}
+pub type PRTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY =
+ *mut RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY;
+STRUCT!{struct RTL_IMAGE_MITIGATION_SEHOP_POLICY {
+ Sehop: RTL_IMAGE_MITIGATION_POLICY,
+}}
+pub type PRTL_IMAGE_MITIGATION_SEHOP_POLICY = *mut RTL_IMAGE_MITIGATION_SEHOP_POLICY;
+STRUCT!{struct RTL_IMAGE_MITIGATION_HEAP_POLICY {
+ TerminateOnHeapErrors: RTL_IMAGE_MITIGATION_POLICY,
+}}
+pub type PRTL_IMAGE_MITIGATION_HEAP_POLICY = *mut RTL_IMAGE_MITIGATION_HEAP_POLICY;
+ENUM!{enum RTL_IMAGE_MITIGATION_OPTION_STATE {
+ RtlMitigationOptionStateNotConfigured = 0,
+ RtlMitigationOptionStateOn = 1,
+ RtlMitigationOptionStateOff = 2,
+}}
+pub const RTL_IMAGE_MITIGATION_FLAG_RESET: ULONG = 0x1;
+pub const RTL_IMAGE_MITIGATION_FLAG_REMOVE: ULONG = 0x2;
+pub const RTL_IMAGE_MITIGATION_FLAG_OSDEFAULT: ULONG = 0x4;
+pub const RTL_IMAGE_MITIGATION_FLAG_AUDIT: ULONG = 0x8;
+EXTERN!{extern "system" {
+ fn RtlQueryImageMitigationPolicy(
+ ImagePath: PWSTR,
+ Policy: IMAGE_MITIGATION_POLICY,
+ Flags: ULONG,
+ Buffer: PVOID,
+ BufferSize: ULONG,
+ ) -> NTSTATUS;
+ fn RtlSetImageMitigationPolicy(
+ ImagePath: PWSTR,
+ Policy: IMAGE_MITIGATION_POLICY,
+ Flags: ULONG,
+ Buffer: PVOID,
+ BufferSize: ULONG,
+ ) -> NTSTATUS;
+ fn RtlGetCurrentServiceSessionId() -> ULONG;
+ fn RtlGetActiveConsoleId() -> ULONG;
+ fn RtlGetConsoleSessionForegroundProcessId() -> ULONGLONG;
+ fn RtlGetTokenNamedObjectPath(
+ Token: HANDLE,
+ Sid: PSID,
+ ObjectPath: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn RtlGetAppContainerNamedObjectPath(
+ Token: HANDLE,
+ AppContainerSid: PSID,
+ RelativePath: BOOLEAN,
+ ObjectPath: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn RtlGetAppContainerParent(
+ AppContainerSid: PSID,
+ AppContainerSidParent: *mut PSID,
+ ) -> NTSTATUS;
+ fn RtlCheckSandboxedToken(
+ TokenHandle: HANDLE,
+ IsSandboxed: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlCheckTokenCapability(
+ TokenHandle: HANDLE,
+ CapabilitySidToCheck: PSID,
+ HasCapability: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlCapabilityCheck(
+ TokenHandle: HANDLE,
+ CapabilityName: PUNICODE_STRING,
+ HasCapability: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlCheckTokenMembership(
+ TokenHandle: HANDLE,
+ SidToCheck: PSID,
+ IsMember: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlCheckTokenMembershipEx(
+ TokenHandle: HANDLE,
+ SidToCheck: PSID,
+ Flags: ULONG,
+ IsMember: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlIsParentOfChildAppContainer(
+ ParentAppContainerSid: PSID,
+ ChildAppContainerSid: PSID,
+ ) -> NTSTATUS;
+ fn RtlIsCapabilitySid(
+ Sid: PSID,
+ ) -> BOOLEAN;
+ fn RtlIsPackageSid(
+ Sid: PSID,
+ ) -> BOOLEAN;
+ fn RtlIsValidProcessTrustLabelSid(
+ Sid: PSID,
+ ) -> BOOLEAN;
+ fn RtlIsStateSeparationEnabled() -> BOOLEAN;
+}}
+ENUM!{enum APPCONTAINER_SID_TYPE {
+ NotAppContainerSidType = 0,
+ ChildAppContainerSidType = 1,
+ ParentAppContainerSidType = 2,
+ InvalidAppContainerSidType = 3,
+ MaxAppContainerSidType = 4,
+}}
+pub type PAPPCONTAINER_SID_TYPE = *mut APPCONTAINER_SID_TYPE;
+EXTERN!{extern "system" {
+ fn RtlGetAppContainerSidType(
+ AppContainerSid: PSID,
+ AppContainerSidType: PAPPCONTAINER_SID_TYPE,
+ ) -> NTSTATUS;
+ fn RtlFlsAlloc(
+ Callback: PFLS_CALLBACK_FUNCTION,
+ FlsIndex: PULONG,
+ ) -> NTSTATUS;
+ fn RtlFlsFree(
+ FlsIndex: ULONG,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum STATE_LOCATION_TYPE {
+ LocationTypeRegistry = 0,
+ LocationTypeFileSystem = 1,
+ LocationTypeMaximum = 2,
+}}
+EXTERN!{extern "system" {
+ fn RtlGetPersistedStateLocation(
+ SourceID: PCWSTR,
+ CustomValue: PCWSTR,
+ DefaultPath: PCWSTR,
+ StateLocationType: STATE_LOCATION_TYPE,
+ TargetPath: PWCHAR,
+ BufferLengthIn: ULONG,
+ BufferLengthOut: PULONG,
+ ) -> NTSTATUS;
+ fn RtlIsCloudFilesPlaceholder(
+ FileAttributes: ULONG,
+ ReparseTag: ULONG,
+ ) -> BOOLEAN;
+ fn RtlIsPartialPlaceholder(
+ FileAttributes: ULONG,
+ ReparseTag: ULONG,
+ ) -> BOOLEAN;
+ fn RtlIsPartialPlaceholderFileHandle(
+ FileHandle: HANDLE,
+ IsPartialPlaceholder: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlIsPartialPlaceholderFileInfo(
+ InfoBuffer: *const c_void,
+ InfoClass: FILE_INFORMATION_CLASS,
+ IsPartialPlaceholder: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlIsNonEmptyDirectoryReparsePointAllowed(
+ ReparseTag: ULONG,
+ ) -> BOOLEAN;
+ fn RtlAppxIsFileOwnedByTrustedInstaller(
+ FileHandle: HANDLE,
+ IsFileOwnedByTrustedInstaller: PBOOLEAN,
+ ) -> NTSTATUS;
+}}
+STRUCT!{struct PS_PKG_CLAIM {
+ Flags: ULONGLONG,
+ Origin: ULONGLONG,
+}}
+pub type PPS_PKG_CLAIM = *mut PS_PKG_CLAIM;
+EXTERN!{extern "system" {
+ fn RtlQueryPackageClaims(
+ TokenHandle: HANDLE,
+ PackageFullName: PWSTR,
+ PackageSize: PSIZE_T,
+ AppId: PWSTR,
+ AppIdSize: PSIZE_T,
+ DynamicId: *mut GUID,
+ PkgClaim: PPS_PKG_CLAIM,
+ AttributesPresent: PULONG64,
+ ) -> NTSTATUS;
+ fn RtlQueryProtectedPolicy(
+ PolicyGuid: *mut GUID,
+ PolicyValue: PULONG_PTR,
+ ) -> NTSTATUS;
+ fn RtlSetProtectedPolicy(
+ PolicyGuid: *mut GUID,
+ PolicyValue: ULONG_PTR,
+ OldPolicyValue: PULONG_PTR,
+ ) -> NTSTATUS;
+ fn RtlIsMultiSessionSku() -> BOOLEAN;
+ fn RtlIsMultiUsersInSessionSku() -> BOOLEAN;
+}}
+ENUM!{enum RTL_BSD_ITEM_TYPE {
+ RtlBsdItemVersionNumber = 0,
+ RtlBsdItemProductType = 1,
+ RtlBsdItemAabEnabled = 2,
+ RtlBsdItemAabTimeout = 3,
+ RtlBsdItemBootGood = 4,
+ RtlBsdItemBootShutdown = 5,
+ RtlBsdSleepInProgress = 6,
+ RtlBsdPowerTransition = 7,
+ RtlBsdItemBootAttemptCount = 8,
+ RtlBsdItemBootCheckpoint = 9,
+ RtlBsdItemBootId = 10,
+ RtlBsdItemShutdownBootId = 11,
+ RtlBsdItemReportedAbnormalShutdownBootId = 12,
+ RtlBsdItemErrorInfo = 13,
+ RtlBsdItemPowerButtonPressInfo = 14,
+ RtlBsdItemChecksum = 15,
+ RtlBsdItemMax = 16,
+}}
+STRUCT!{struct RTL_BSD_ITEM {
+ Type: RTL_BSD_ITEM_TYPE,
+ DataBuffer: PVOID,
+ DataLength: ULONG,
+}}
+pub type PRTL_BSD_ITEM = *mut RTL_BSD_ITEM;
+EXTERN!{extern "system" {
+ fn RtlCreateBootStatusDataFile() -> NTSTATUS;
+ fn RtlLockBootStatusData(
+ FileHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn RtlUnlockBootStatusData(
+ FileHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn RtlGetSetBootStatusData(
+ FileHandle: HANDLE,
+ Read: BOOLEAN,
+ DataClass: RTL_BSD_ITEM_TYPE,
+ Buffer: PVOID,
+ BufferSize: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn RtlCheckBootStatusIntegrity(
+ FileHandle: HANDLE,
+ Verified: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlCheckPortableOperatingSystem(
+ IsPortable: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlSetPortableOperatingSystem(
+ IsPortable: BOOLEAN,
+ ) -> NTSTATUS;
+}}
+EXTERN!{extern "system" {
+ fn RtlOsDeploymentState(
+ Flags: DWORD,
+ ) -> OS_DEPLOYEMENT_STATE_VALUES;
+ fn RtlFindClosestEncodableLength(
+ SourceLength: ULONGLONG,
+ TargetLength: PULONGLONG,
+ ) -> NTSTATUS;
+}}
+FN!{stdcall PRTL_SECURE_MEMORY_CACHE_CALLBACK(
+ Address: PVOID,
+ Length: SIZE_T,
+) -> NTSTATUS}
+EXTERN!{extern "system" {
+ fn RtlRegisterSecureMemoryCacheCallback(
+ Callback: PRTL_SECURE_MEMORY_CACHE_CALLBACK,
+ ) -> NTSTATUS;
+ fn RtlDeregisterSecureMemoryCacheCallback(
+ Callback: PRTL_SECURE_MEMORY_CACHE_CALLBACK,
+ ) -> NTSTATUS;
+ fn RtlFlushSecureMemoryCache(
+ MemoryCache: PVOID,
+ MemoryLength: SIZE_T,
+ ) -> BOOLEAN;
+}}
diff --git a/third_party/rust/ntapi/src/ntsam.rs b/third_party/rust/ntapi/src/ntsam.rs
new file mode 100644
index 0000000000..a591f0bd8a
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntsam.rs
@@ -0,0 +1,1077 @@
+use crate::string::UTF8Const;
+use winapi::shared::basetsd::ULONG64;
+use winapi::shared::minwindef::DWORD;
+use winapi::shared::ntdef::{
+ BOOLEAN, HANDLE, LARGE_INTEGER, NTSTATUS, OEM_STRING, PLARGE_INTEGER, POBJECT_ATTRIBUTES,
+ PUCHAR, PULONG, PUNICODE_STRING, PVOID, PWSTR, ULONG, UNICODE_STRING, USHORT,
+};
+use winapi::um::ntsecapi::PDOMAIN_PASSWORD_INFORMATION;
+use winapi::um::subauth::LOGON_HOURS;
+use winapi::um::winnt::{
+ ACCESS_MASK, PSECURITY_DESCRIPTOR, PSID, PSID_NAME_USE, SECURITY_INFORMATION, SID_NAME_USE,
+ STANDARD_RIGHTS_EXECUTE, STANDARD_RIGHTS_READ, STANDARD_RIGHTS_REQUIRED, STANDARD_RIGHTS_WRITE,
+};
+pub const SAM_MAXIMUM_LOOKUP_COUNT: u32 = 1000;
+pub const SAM_MAXIMUM_LOOKUP_LENGTH: u32 = 32000;
+pub const SAM_MAX_PASSWORD_LENGTH: u32 = 256;
+pub const SAM_PASSWORD_ENCRYPTION_SALT_LEN: u32 = 16;
+pub type PSAM_HANDLE = *mut PVOID;
+pub type SAM_HANDLE = PVOID;
+pub type SAM_ENUMERATE_HANDLE = ULONG;
+pub type PSAM_ENUMERATE_HANDLE = *mut ULONG;
+STRUCT!{struct SAM_RID_ENUMERATION {
+ RelativeId: ULONG,
+ Name: UNICODE_STRING,
+}}
+pub type PSAM_RID_ENUMERATION = *mut SAM_RID_ENUMERATION;
+STRUCT!{struct SAM_SID_ENUMERATION {
+ Sid: PSID,
+ Name: UNICODE_STRING,
+}}
+pub type PSAM_SID_ENUMERATION = *mut SAM_SID_ENUMERATION;
+STRUCT!{struct SAM_BYTE_ARRAY {
+ Size: ULONG,
+ Data: PUCHAR,
+}}
+pub type PSAM_BYTE_ARRAY = *mut SAM_BYTE_ARRAY;
+STRUCT!{struct SAM_BYTE_ARRAY_32K {
+ Size: ULONG,
+ Data: PUCHAR,
+}}
+pub type PSAM_BYTE_ARRAY_32K = *mut SAM_BYTE_ARRAY_32K;
+pub type PSAM_SHELL_OBJECT_PROPERTIES = *mut SAM_BYTE_ARRAY_32K;
+pub type SAM_SHELL_OBJECT_PROPERTIES = SAM_BYTE_ARRAY_32K;
+EXTERN!{extern "system" {
+ fn SamFreeMemory(
+ Buffer: PVOID,
+ ) -> NTSTATUS;
+ fn SamCloseHandle(
+ SamHandle: SAM_HANDLE,
+ ) -> NTSTATUS;
+ fn SamSetSecurityObject(
+ ObjectHandle: SAM_HANDLE,
+ SecurityInformation: SECURITY_INFORMATION,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ) -> NTSTATUS;
+ fn SamQuerySecurityObject(
+ ObjectHandle: SAM_HANDLE,
+ SecurityInformation: SECURITY_INFORMATION,
+ SecurityDescriptor: *mut PSECURITY_DESCRIPTOR,
+ ) -> NTSTATUS;
+ fn SamRidToSid(
+ ObjectHandle: SAM_HANDLE,
+ Rid: ULONG,
+ Sid: *mut PSID,
+ ) -> NTSTATUS;
+}}
+pub const SAM_SERVER_CONNECT: ACCESS_MASK = 0x0001;
+pub const SAM_SERVER_SHUTDOWN: ACCESS_MASK = 0x0002;
+pub const SAM_SERVER_INITIALIZE: ACCESS_MASK = 0x0004;
+pub const SAM_SERVER_CREATE_DOMAIN: ACCESS_MASK = 0x0008;
+pub const SAM_SERVER_ENUMERATE_DOMAINS: ACCESS_MASK = 0x0010;
+pub const SAM_SERVER_LOOKUP_DOMAIN: ACCESS_MASK = 0x0020;
+pub const SAM_SERVER_ALL_ACCESS: ACCESS_MASK = STANDARD_RIGHTS_REQUIRED | SAM_SERVER_CONNECT
+ | SAM_SERVER_INITIALIZE | SAM_SERVER_CREATE_DOMAIN | SAM_SERVER_SHUTDOWN
+ | SAM_SERVER_ENUMERATE_DOMAINS | SAM_SERVER_LOOKUP_DOMAIN;
+pub const SAM_SERVER_READ: ACCESS_MASK = STANDARD_RIGHTS_READ | SAM_SERVER_ENUMERATE_DOMAINS;
+pub const SAM_SERVER_WRITE: ACCESS_MASK =
+ STANDARD_RIGHTS_WRITE | SAM_SERVER_INITIALIZE | SAM_SERVER_CREATE_DOMAIN | SAM_SERVER_SHUTDOWN;
+pub const SAM_SERVER_EXECUTE: ACCESS_MASK =
+ STANDARD_RIGHTS_EXECUTE | SAM_SERVER_CONNECT | SAM_SERVER_LOOKUP_DOMAIN;
+EXTERN!{extern "system" {
+ fn SamConnect(
+ ServerName: PUNICODE_STRING,
+ ServerHandle: PSAM_HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn SamShutdownSamServer(
+ ServerHandle: SAM_HANDLE,
+ ) -> NTSTATUS;
+}}
+pub const DOMAIN_READ_PASSWORD_PARAMETERS: u32 = 0x0001;
+pub const DOMAIN_WRITE_PASSWORD_PARAMS: u32 = 0x0002;
+pub const DOMAIN_READ_OTHER_PARAMETERS: u32 = 0x0004;
+pub const DOMAIN_WRITE_OTHER_PARAMETERS: u32 = 0x0008;
+pub const DOMAIN_CREATE_USER: u32 = 0x0010;
+pub const DOMAIN_CREATE_GROUP: u32 = 0x0020;
+pub const DOMAIN_CREATE_ALIAS: u32 = 0x0040;
+pub const DOMAIN_GET_ALIAS_MEMBERSHIP: u32 = 0x0080;
+pub const DOMAIN_LIST_ACCOUNTS: u32 = 0x0100;
+pub const DOMAIN_LOOKUP: u32 = 0x0200;
+pub const DOMAIN_ADMINISTER_SERVER: u32 = 0x0400;
+pub const DOMAIN_ALL_ACCESS: u32 = STANDARD_RIGHTS_REQUIRED | DOMAIN_READ_OTHER_PARAMETERS
+ | DOMAIN_WRITE_OTHER_PARAMETERS | DOMAIN_WRITE_PASSWORD_PARAMS | DOMAIN_CREATE_USER
+ | DOMAIN_CREATE_GROUP | DOMAIN_CREATE_ALIAS | DOMAIN_GET_ALIAS_MEMBERSHIP
+ | DOMAIN_LIST_ACCOUNTS | DOMAIN_READ_PASSWORD_PARAMETERS | DOMAIN_LOOKUP
+ | DOMAIN_ADMINISTER_SERVER;
+pub const DOMAIN_READ: u32 =
+ STANDARD_RIGHTS_READ | DOMAIN_GET_ALIAS_MEMBERSHIP | DOMAIN_READ_OTHER_PARAMETERS;
+pub const DOMAIN_WRITE: u32 = STANDARD_RIGHTS_WRITE | DOMAIN_WRITE_OTHER_PARAMETERS
+ | DOMAIN_WRITE_PASSWORD_PARAMS | DOMAIN_CREATE_USER | DOMAIN_CREATE_GROUP | DOMAIN_CREATE_ALIAS
+ | DOMAIN_ADMINISTER_SERVER;
+pub const DOMAIN_EXECUTE: u32 = STANDARD_RIGHTS_EXECUTE | DOMAIN_READ_PASSWORD_PARAMETERS
+ | DOMAIN_LIST_ACCOUNTS | DOMAIN_LOOKUP;
+ENUM!{enum DOMAIN_INFORMATION_CLASS {
+ DomainPasswordInformation = 1,
+ DomainGeneralInformation = 2,
+ DomainLogoffInformation = 3,
+ DomainOemInformation = 4,
+ DomainNameInformation = 5,
+ DomainReplicationInformation = 6,
+ DomainServerRoleInformation = 7,
+ DomainModifiedInformation = 8,
+ DomainStateInformation = 9,
+ DomainUasInformation = 10,
+ DomainGeneralInformation2 = 11,
+ DomainLockoutInformation = 12,
+ DomainModifiedInformation2 = 13,
+}}
+ENUM!{enum DOMAIN_SERVER_ENABLE_STATE {
+ DomainServerEnabled = 1,
+ DomainServerDisabled = 2,
+}}
+pub type PDOMAIN_SERVER_ENABLE_STATE = *mut DOMAIN_SERVER_ENABLE_STATE;
+ENUM!{enum DOMAIN_SERVER_ROLE {
+ DomainServerRoleBackup = 2,
+ DomainServerRolePrimary = 3,
+}}
+pub type PDOMAIN_SERVER_ROLE = *mut DOMAIN_SERVER_ROLE;
+STRUCT!{#[repr(packed(4))] struct DOMAIN_GENERAL_INFORMATION {
+ ForceLogoff: LARGE_INTEGER,
+ OemInformation: UNICODE_STRING,
+ DomainName: UNICODE_STRING,
+ ReplicaSourceNodeName: UNICODE_STRING,
+ DomainModifiedCount: LARGE_INTEGER,
+ DomainServerState: DOMAIN_SERVER_ENABLE_STATE,
+ DomainServerRole: DOMAIN_SERVER_ROLE,
+ UasCompatibilityRequired: BOOLEAN,
+ UserCount: ULONG,
+ GroupCount: ULONG,
+ AliasCount: ULONG,
+}}
+pub type PDOMAIN_GENERAL_INFORMATION = *mut DOMAIN_GENERAL_INFORMATION;
+STRUCT!{#[repr(packed(4))] struct DOMAIN_GENERAL_INFORMATION2 {
+ I1: DOMAIN_GENERAL_INFORMATION,
+ LockoutDuration: LARGE_INTEGER,
+ LockoutObservationWindow: LARGE_INTEGER,
+ LockoutThreshold: USHORT,
+}}
+pub type PDOMAIN_GENERAL_INFORMATION2 = *mut DOMAIN_GENERAL_INFORMATION2;
+STRUCT!{struct DOMAIN_UAS_INFORMATION {
+ UasCompatibilityRequired: BOOLEAN,
+}}
+ENUM!{enum DOMAIN_PASSWORD_CONSTRUCTION {
+ DomainPasswordSimple = 1,
+ DomainPasswordComplex = 2,
+}}
+STRUCT!{struct DOMAIN_LOGOFF_INFORMATION {
+ ForceLogoff: LARGE_INTEGER,
+}}
+pub type PDOMAIN_LOGOFF_INFORMATION = *mut DOMAIN_LOGOFF_INFORMATION;
+STRUCT!{struct DOMAIN_OEM_INFORMATION {
+ OemInformation: UNICODE_STRING,
+}}
+pub type PDOMAIN_OEM_INFORMATION = *mut DOMAIN_OEM_INFORMATION;
+STRUCT!{struct DOMAIN_NAME_INFORMATION {
+ DomainName: UNICODE_STRING,
+}}
+pub type PDOMAIN_NAME_INFORMATION = *mut DOMAIN_NAME_INFORMATION;
+STRUCT!{struct DOMAIN_SERVER_ROLE_INFORMATION {
+ DomainServerRole: DOMAIN_SERVER_ROLE,
+}}
+pub type PDOMAIN_SERVER_ROLE_INFORMATION = *mut DOMAIN_SERVER_ROLE_INFORMATION;
+STRUCT!{struct DOMAIN_REPLICATION_INFORMATION {
+ ReplicaSourceNodeName: UNICODE_STRING,
+}}
+pub type PDOMAIN_REPLICATION_INFORMATION = *mut DOMAIN_REPLICATION_INFORMATION;
+STRUCT!{struct DOMAIN_MODIFIED_INFORMATION {
+ DomainModifiedCount: LARGE_INTEGER,
+ CreationTime: LARGE_INTEGER,
+}}
+pub type PDOMAIN_MODIFIED_INFORMATION = *mut DOMAIN_MODIFIED_INFORMATION;
+STRUCT!{struct DOMAIN_MODIFIED_INFORMATION2 {
+ DomainModifiedCount: LARGE_INTEGER,
+ CreationTime: LARGE_INTEGER,
+ ModifiedCountAtLastPromotion: LARGE_INTEGER,
+}}
+pub type PDOMAIN_MODIFIED_INFORMATION2 = *mut DOMAIN_MODIFIED_INFORMATION2;
+STRUCT!{struct DOMAIN_STATE_INFORMATION {
+ DomainServerState: DOMAIN_SERVER_ENABLE_STATE,
+}}
+pub type PDOMAIN_STATE_INFORMATION = *mut DOMAIN_STATE_INFORMATION;
+STRUCT!{struct DOMAIN_LOCKOUT_INFORMATION {
+ LockoutDuration: LARGE_INTEGER,
+ LockoutObservationWindow: LARGE_INTEGER,
+ LockoutThreshold: USHORT,
+}}
+pub type PDOMAIN_LOCKOUT_INFORMATION = *mut DOMAIN_LOCKOUT_INFORMATION;
+ENUM!{enum DOMAIN_DISPLAY_INFORMATION {
+ DomainDisplayUser = 1,
+ DomainDisplayMachine = 2,
+ DomainDisplayGroup = 3,
+ DomainDisplayOemUser = 4,
+ DomainDisplayOemGroup = 5,
+ DomainDisplayServer = 6,
+}}
+pub type PDOMAIN_DISPLAY_INFORMATION = *mut DOMAIN_DISPLAY_INFORMATION;
+STRUCT!{struct DOMAIN_DISPLAY_USER {
+ Index: ULONG,
+ Rid: ULONG,
+ AccountControl: ULONG,
+ LogonName: UNICODE_STRING,
+ AdminComment: UNICODE_STRING,
+ FullName: UNICODE_STRING,
+}}
+pub type PDOMAIN_DISPLAY_USER = *mut DOMAIN_DISPLAY_USER;
+STRUCT!{struct DOMAIN_DISPLAY_MACHINE {
+ Index: ULONG,
+ Rid: ULONG,
+ AccountControl: ULONG,
+ Machine: UNICODE_STRING,
+ Comment: UNICODE_STRING,
+}}
+pub type PDOMAIN_DISPLAY_MACHINE = *mut DOMAIN_DISPLAY_MACHINE;
+STRUCT!{struct DOMAIN_DISPLAY_GROUP {
+ Index: ULONG,
+ Rid: ULONG,
+ Attributes: ULONG,
+ Group: UNICODE_STRING,
+ Comment: UNICODE_STRING,
+}}
+pub type PDOMAIN_DISPLAY_GROUP = *mut DOMAIN_DISPLAY_GROUP;
+STRUCT!{struct DOMAIN_DISPLAY_OEM_USER {
+ Index: ULONG,
+ User: OEM_STRING,
+}}
+pub type PDOMAIN_DISPLAY_OEM_USER = *mut DOMAIN_DISPLAY_OEM_USER;
+STRUCT!{struct DOMAIN_DISPLAY_OEM_GROUP {
+ Index: ULONG,
+ Group: OEM_STRING,
+}}
+pub type PDOMAIN_DISPLAY_OEM_GROUP = *mut DOMAIN_DISPLAY_OEM_GROUP;
+ENUM!{enum DOMAIN_LOCALIZABLE_ACCOUNTS_INFORMATION {
+ DomainLocalizableAccountsBasic = 1,
+}}
+pub type PDOMAIN_LOCALIZABLE_ACCOUNTS_INFORMATION = *mut DOMAIN_LOCALIZABLE_ACCOUNTS_INFORMATION;
+STRUCT!{struct DOMAIN_LOCALIZABLE_ACCOUNT_ENTRY {
+ Rid: ULONG,
+ Use: SID_NAME_USE,
+ Name: UNICODE_STRING,
+ AdminComment: UNICODE_STRING,
+}}
+pub type PDOMAIN_LOCALIZABLE_ACCOUNT_ENTRY = *mut DOMAIN_LOCALIZABLE_ACCOUNT_ENTRY;
+STRUCT!{struct DOMAIN_LOCALIZABLE_ACCOUNTS_BASIC {
+ Count: ULONG,
+ Entries: *mut DOMAIN_LOCALIZABLE_ACCOUNT_ENTRY,
+}}
+pub type PDOMAIN_LOCALIZABLE_ACCOUNTS_BASIC = *mut DOMAIN_LOCALIZABLE_ACCOUNTS_BASIC;
+UNION!{union DOMAIN_LOCALIZABLE_ACCOUNTS_INFO_BUFFER {
+ Basic: DOMAIN_LOCALIZABLE_ACCOUNTS_BASIC,
+}}
+pub type PDOMAIN_LOCALIZABLE_ACCOUNTS_INFO_BUFFER = *mut DOMAIN_LOCALIZABLE_ACCOUNTS_INFO_BUFFER;
+EXTERN!{extern "system" {
+ fn SamLookupDomainInSamServer(
+ ServerHandle: SAM_HANDLE,
+ Name: PUNICODE_STRING,
+ DomainId: *mut PSID,
+ ) -> NTSTATUS;
+ fn SamEnumerateDomainsInSamServer(
+ ServerHandle: SAM_HANDLE,
+ EnumerationContext: PSAM_ENUMERATE_HANDLE,
+ Buffer: *mut PVOID,
+ PreferedMaximumLength: ULONG,
+ CountReturned: PULONG,
+ ) -> NTSTATUS;
+ fn SamOpenDomain(
+ ServerHandle: SAM_HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ DomainId: PSID,
+ DomainHandle: PSAM_HANDLE,
+ ) -> NTSTATUS;
+ fn SamQueryInformationDomain(
+ DomainHandle: SAM_HANDLE,
+ DomainInformationClass: DOMAIN_INFORMATION_CLASS,
+ Buffer: *mut PVOID,
+ ) -> NTSTATUS;
+ fn SamSetInformationDomain(
+ DomainHandle: SAM_HANDLE,
+ DomainInformationClass: DOMAIN_INFORMATION_CLASS,
+ DomainInformation: PVOID,
+ ) -> NTSTATUS;
+ fn SamLookupNamesInDomain(
+ DomainHandle: SAM_HANDLE,
+ Count: ULONG,
+ Names: PUNICODE_STRING,
+ RelativeIds: *mut PULONG,
+ Use: *mut PSID_NAME_USE,
+ ) -> NTSTATUS;
+ fn SamLookupIdsInDomain(
+ DomainHandle: SAM_HANDLE,
+ Count: ULONG,
+ RelativeIds: PULONG,
+ Names: *mut PUNICODE_STRING,
+ Use: *mut PSID_NAME_USE,
+ ) -> NTSTATUS;
+ fn SamRemoveMemberFromForeignDomain(
+ DomainHandle: SAM_HANDLE,
+ MemberId: PSID,
+ ) -> NTSTATUS;
+ fn SamQueryLocalizableAccountsInDomain(
+ Domain: SAM_HANDLE,
+ Flags: ULONG,
+ LanguageId: ULONG,
+ Class: DOMAIN_LOCALIZABLE_ACCOUNTS_INFORMATION,
+ Buffer: *mut PVOID,
+ ) -> NTSTATUS;
+}}
+pub const GROUP_READ_INFORMATION: ACCESS_MASK = 0x0001;
+pub const GROUP_WRITE_ACCOUNT: ACCESS_MASK = 0x0002;
+pub const GROUP_ADD_MEMBER: ACCESS_MASK = 0x0004;
+pub const GROUP_REMOVE_MEMBER: ACCESS_MASK = 0x0008;
+pub const GROUP_LIST_MEMBERS: ACCESS_MASK = 0x0010;
+pub const GROUP_ALL_ACCESS: ACCESS_MASK = STANDARD_RIGHTS_REQUIRED | GROUP_LIST_MEMBERS
+ | GROUP_WRITE_ACCOUNT | GROUP_ADD_MEMBER | GROUP_REMOVE_MEMBER | GROUP_READ_INFORMATION;
+pub const GROUP_READ: ACCESS_MASK = STANDARD_RIGHTS_READ | GROUP_LIST_MEMBERS;
+pub const GROUP_WRITE: ACCESS_MASK =
+ STANDARD_RIGHTS_WRITE | GROUP_WRITE_ACCOUNT | GROUP_ADD_MEMBER | GROUP_REMOVE_MEMBER;
+pub const GROUP_EXECUTE: ACCESS_MASK = STANDARD_RIGHTS_EXECUTE | GROUP_READ_INFORMATION;
+STRUCT!{struct GROUP_MEMBERSHIP {
+ RelativeId: ULONG,
+ Attributes: ULONG,
+}}
+pub type PGROUP_MEMBERSHIP = *mut GROUP_MEMBERSHIP;
+ENUM!{enum GROUP_INFORMATION_CLASS {
+ GroupGeneralInformation = 1,
+ GroupNameInformation = 2,
+ GroupAttributeInformation = 3,
+ GroupAdminCommentInformation = 4,
+ GroupReplicationInformation = 5,
+}}
+STRUCT!{struct GROUP_GENERAL_INFORMATION {
+ Name: UNICODE_STRING,
+ Attributes: ULONG,
+ MemberCount: ULONG,
+ AdminComment: UNICODE_STRING,
+}}
+pub type PGROUP_GENERAL_INFORMATION = *mut GROUP_GENERAL_INFORMATION;
+STRUCT!{struct GROUP_NAME_INFORMATION {
+ Name: UNICODE_STRING,
+}}
+pub type PGROUP_NAME_INFORMATION = *mut GROUP_NAME_INFORMATION;
+STRUCT!{struct GROUP_ATTRIBUTE_INFORMATION {
+ Attributes: ULONG,
+}}
+pub type PGROUP_ATTRIBUTE_INFORMATION = *mut GROUP_ATTRIBUTE_INFORMATION;
+STRUCT!{struct GROUP_ADM_COMMENT_INFORMATION {
+ AdminComment: UNICODE_STRING,
+}}
+pub type PGROUP_ADM_COMMENT_INFORMATION = *mut GROUP_ADM_COMMENT_INFORMATION;
+EXTERN!{extern "system" {
+ fn SamEnumerateGroupsInDomain(
+ DomainHandle: SAM_HANDLE,
+ EnumerationContext: PSAM_ENUMERATE_HANDLE,
+ Buffer: *mut PVOID,
+ PreferedMaximumLength: ULONG,
+ CountReturned: PULONG,
+ ) -> NTSTATUS;
+ fn SamCreateGroupInDomain(
+ DomainHandle: SAM_HANDLE,
+ AccountName: PUNICODE_STRING,
+ DesiredAccess: ACCESS_MASK,
+ GroupHandle: PSAM_HANDLE,
+ RelativeId: PULONG,
+ ) -> NTSTATUS;
+ fn SamOpenGroup(
+ DomainHandle: SAM_HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ GroupId: ULONG,
+ GroupHandle: PSAM_HANDLE,
+ ) -> NTSTATUS;
+ fn SamDeleteGroup(
+ GroupHandle: SAM_HANDLE,
+ ) -> NTSTATUS;
+ fn SamQueryInformationGroup(
+ GroupHandle: SAM_HANDLE,
+ GroupInformationClass: GROUP_INFORMATION_CLASS,
+ Buffer: *mut PVOID,
+ ) -> NTSTATUS;
+ fn SamSetInformationGroup(
+ GroupHandle: SAM_HANDLE,
+ GroupInformationClass: GROUP_INFORMATION_CLASS,
+ Buffer: PVOID,
+ ) -> NTSTATUS;
+ fn SamAddMemberToGroup(
+ GroupHandle: SAM_HANDLE,
+ MemberId: ULONG,
+ Attributes: ULONG,
+ ) -> NTSTATUS;
+ fn SamRemoveMemberFromGroup(
+ GroupHandle: SAM_HANDLE,
+ MemberId: ULONG,
+ ) -> NTSTATUS;
+ fn SamGetMembersInGroup(
+ GroupHandle: SAM_HANDLE,
+ MemberIds: *mut PULONG,
+ Attributes: *mut PULONG,
+ MemberCount: PULONG,
+ ) -> NTSTATUS;
+ fn SamSetMemberAttributesOfGroup(
+ GroupHandle: SAM_HANDLE,
+ MemberId: ULONG,
+ Attributes: ULONG,
+ ) -> NTSTATUS;
+}}
+pub const ALIAS_ADD_MEMBER: ACCESS_MASK = 0x0001;
+pub const ALIAS_REMOVE_MEMBER: ACCESS_MASK = 0x0002;
+pub const ALIAS_LIST_MEMBERS: ACCESS_MASK = 0x0004;
+pub const ALIAS_READ_INFORMATION: ACCESS_MASK = 0x0008;
+pub const ALIAS_WRITE_ACCOUNT: ACCESS_MASK = 0x0010;
+pub const ALIAS_ALL_ACCESS: ACCESS_MASK = STANDARD_RIGHTS_REQUIRED | ALIAS_READ_INFORMATION
+ | ALIAS_WRITE_ACCOUNT | ALIAS_LIST_MEMBERS | ALIAS_ADD_MEMBER | ALIAS_REMOVE_MEMBER;
+pub const ALIAS_READ: ACCESS_MASK = STANDARD_RIGHTS_READ | ALIAS_LIST_MEMBERS;
+pub const ALIAS_WRITE: ACCESS_MASK =
+ STANDARD_RIGHTS_WRITE | ALIAS_WRITE_ACCOUNT | ALIAS_ADD_MEMBER | ALIAS_REMOVE_MEMBER;
+pub const ALIAS_EXECUTE: ACCESS_MASK = STANDARD_RIGHTS_EXECUTE | ALIAS_READ_INFORMATION;
+ENUM!{enum ALIAS_INFORMATION_CLASS {
+ AliasGeneralInformation = 1,
+ AliasNameInformation = 2,
+ AliasAdminCommentInformation = 3,
+ AliasReplicationInformation = 4,
+ AliasExtendedInformation = 5,
+}}
+STRUCT!{struct ALIAS_GENERAL_INFORMATION {
+ Name: UNICODE_STRING,
+ MemberCount: ULONG,
+ AdminComment: UNICODE_STRING,
+}}
+pub type PALIAS_GENERAL_INFORMATION = *mut ALIAS_GENERAL_INFORMATION;
+STRUCT!{struct ALIAS_NAME_INFORMATION {
+ Name: UNICODE_STRING,
+}}
+pub type PALIAS_NAME_INFORMATION = *mut ALIAS_NAME_INFORMATION;
+STRUCT!{struct ALIAS_ADM_COMMENT_INFORMATION {
+ AdminComment: UNICODE_STRING,
+}}
+pub type PALIAS_ADM_COMMENT_INFORMATION = *mut ALIAS_ADM_COMMENT_INFORMATION;
+pub const ALIAS_ALL_NAME: ULONG = 0x00000001;
+pub const ALIAS_ALL_MEMBER_COUNT: ULONG = 0x00000002;
+pub const ALIAS_ALL_ADMIN_COMMENT: ULONG = 0x00000004;
+pub const ALIAS_ALL_SHELL_ADMIN_OBJECT_PROPERTIES: ULONG = 0x00000008;
+STRUCT!{struct ALIAS_EXTENDED_INFORMATION {
+ WhichFields: ULONG,
+ ShellAdminObjectProperties: SAM_SHELL_OBJECT_PROPERTIES,
+}}
+pub type PALIAS_EXTENDED_INFORMATION = *mut ALIAS_EXTENDED_INFORMATION;
+EXTERN!{extern "system" {
+ fn SamEnumerateAliasesInDomain(
+ DomainHandle: SAM_HANDLE,
+ EnumerationContext: PSAM_ENUMERATE_HANDLE,
+ Buffer: *mut PVOID,
+ PreferedMaximumLength: ULONG,
+ CountReturned: PULONG,
+ ) -> NTSTATUS;
+ fn SamCreateAliasInDomain(
+ DomainHandle: SAM_HANDLE,
+ AccountName: PUNICODE_STRING,
+ DesiredAccess: ACCESS_MASK,
+ AliasHandle: PSAM_HANDLE,
+ RelativeId: PULONG,
+ ) -> NTSTATUS;
+ fn SamOpenAlias(
+ DomainHandle: SAM_HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ AliasId: ULONG,
+ AliasHandle: PSAM_HANDLE,
+ ) -> NTSTATUS;
+ fn SamDeleteAlias(
+ AliasHandle: SAM_HANDLE,
+ ) -> NTSTATUS;
+ fn SamQueryInformationAlias(
+ AliasHandle: SAM_HANDLE,
+ AliasInformationClass: ALIAS_INFORMATION_CLASS,
+ Buffer: *mut PVOID,
+ ) -> NTSTATUS;
+ fn SamSetInformationAlias(
+ AliasHandle: SAM_HANDLE,
+ AliasInformationClass: ALIAS_INFORMATION_CLASS,
+ Buffer: PVOID,
+ ) -> NTSTATUS;
+ fn SamAddMemberToAlias(
+ AliasHandle: SAM_HANDLE,
+ MemberId: PSID,
+ ) -> NTSTATUS;
+ fn SamAddMultipleMembersToAlias(
+ AliasHandle: SAM_HANDLE,
+ MemberIds: *mut PSID,
+ MemberCount: ULONG,
+ ) -> NTSTATUS;
+ fn SamRemoveMemberFromAlias(
+ AliasHandle: SAM_HANDLE,
+ MemberId: PSID,
+ ) -> NTSTATUS;
+ fn SamRemoveMultipleMembersFromAlias(
+ AliasHandle: SAM_HANDLE,
+ MemberIds: *mut PSID,
+ MemberCount: ULONG,
+ ) -> NTSTATUS;
+ fn SamGetMembersInAlias(
+ AliasHandle: SAM_HANDLE,
+ MemberIds: *mut *mut PSID,
+ MemberCount: PULONG,
+ ) -> NTSTATUS;
+ fn SamGetAliasMembership(
+ DomainHandle: SAM_HANDLE,
+ PassedCount: ULONG,
+ Sids: *mut PSID,
+ MembershipCount: PULONG,
+ Aliases: *mut PULONG,
+ ) -> NTSTATUS;
+}}
+pub const GROUP_TYPE_BUILTIN_LOCAL_GROUP: u32 = 0x00000001;
+pub const GROUP_TYPE_ACCOUNT_GROUP: u32 = 0x00000002;
+pub const GROUP_TYPE_RESOURCE_GROUP: u32 = 0x00000004;
+pub const GROUP_TYPE_UNIVERSAL_GROUP: u32 = 0x00000008;
+pub const GROUP_TYPE_APP_BASIC_GROUP: u32 = 0x00000010;
+pub const GROUP_TYPE_APP_QUERY_GROUP: u32 = 0x00000020;
+pub const GROUP_TYPE_SECURITY_ENABLED: u32 = 0x80000000;
+pub const GROUP_TYPE_RESOURCE_BEHAVOIR: u32 =
+ GROUP_TYPE_RESOURCE_GROUP | GROUP_TYPE_APP_BASIC_GROUP | GROUP_TYPE_APP_QUERY_GROUP;
+pub const USER_READ_GENERAL: DWORD = 0x0001;
+pub const USER_READ_PREFERENCES: DWORD = 0x0002;
+pub const USER_WRITE_PREFERENCES: DWORD = 0x0004;
+pub const USER_READ_LOGON: DWORD = 0x0008;
+pub const USER_READ_ACCOUNT: DWORD = 0x0010;
+pub const USER_WRITE_ACCOUNT: DWORD = 0x0020;
+pub const USER_CHANGE_PASSWORD: DWORD = 0x0040;
+pub const USER_FORCE_PASSWORD_CHANGE: DWORD = 0x0080;
+pub const USER_LIST_GROUPS: DWORD = 0x0100;
+pub const USER_READ_GROUP_INFORMATION: DWORD = 0x0200;
+pub const USER_WRITE_GROUP_INFORMATION: DWORD = 0x0400;
+pub const USER_ALL_ACCESS: DWORD = STANDARD_RIGHTS_REQUIRED | USER_READ_PREFERENCES
+ | USER_READ_LOGON | USER_LIST_GROUPS | USER_READ_GROUP_INFORMATION | USER_WRITE_PREFERENCES
+ | USER_CHANGE_PASSWORD | USER_FORCE_PASSWORD_CHANGE | USER_READ_GENERAL | USER_READ_ACCOUNT
+ | USER_WRITE_ACCOUNT | USER_WRITE_GROUP_INFORMATION;
+pub const USER_READ: DWORD = STANDARD_RIGHTS_READ | USER_READ_PREFERENCES | USER_READ_LOGON
+ | USER_READ_ACCOUNT | USER_LIST_GROUPS | USER_READ_GROUP_INFORMATION;
+pub const USER_WRITE: DWORD =
+ STANDARD_RIGHTS_WRITE | USER_WRITE_PREFERENCES | USER_CHANGE_PASSWORD;
+pub const USER_EXECUTE: DWORD = STANDARD_RIGHTS_EXECUTE | USER_READ_GENERAL | USER_CHANGE_PASSWORD;
+ENUM!{enum USER_INFORMATION_CLASS {
+ UserGeneralInformation = 1,
+ UserPreferencesInformation = 2,
+ UserLogonInformation = 3,
+ UserLogonHoursInformation = 4,
+ UserAccountInformation = 5,
+ UserNameInformation = 6,
+ UserAccountNameInformation = 7,
+ UserFullNameInformation = 8,
+ UserPrimaryGroupInformation = 9,
+ UserHomeInformation = 10,
+ UserScriptInformation = 11,
+ UserProfileInformation = 12,
+ UserAdminCommentInformation = 13,
+ UserWorkStationsInformation = 14,
+ UserSetPasswordInformation = 15,
+ UserControlInformation = 16,
+ UserExpiresInformation = 17,
+ UserInternal1Information = 18,
+ UserInternal2Information = 19,
+ UserParametersInformation = 20,
+ UserAllInformation = 21,
+ UserInternal3Information = 22,
+ UserInternal4Information = 23,
+ UserInternal5Information = 24,
+ UserInternal4InformationNew = 25,
+ UserInternal5InformationNew = 26,
+ UserInternal6Information = 27,
+ UserExtendedInformation = 28,
+ UserLogonUIInformation = 29,
+}}
+pub type PUSER_INFORMATION_CLASS = *mut USER_INFORMATION_CLASS;
+pub const USER_ALL_USERNAME: ULONG = 0x00000001;
+pub const USER_ALL_FULLNAME: ULONG = 0x00000002;
+pub const USER_ALL_USERID: ULONG = 0x00000004;
+pub const USER_ALL_PRIMARYGROUPID: ULONG = 0x00000008;
+pub const USER_ALL_ADMINCOMMENT: ULONG = 0x00000010;
+pub const USER_ALL_USERCOMMENT: ULONG = 0x00000020;
+pub const USER_ALL_HOMEDIRECTORY: ULONG = 0x00000040;
+pub const USER_ALL_HOMEDIRECTORYDRIVE: ULONG = 0x00000080;
+pub const USER_ALL_SCRIPTPATH: ULONG = 0x00000100;
+pub const USER_ALL_PROFILEPATH: ULONG = 0x00000200;
+pub const USER_ALL_WORKSTATIONS: ULONG = 0x00000400;
+pub const USER_ALL_LASTLOGON: ULONG = 0x00000800;
+pub const USER_ALL_LASTLOGOFF: ULONG = 0x00001000;
+pub const USER_ALL_LOGONHOURS: ULONG = 0x00002000;
+pub const USER_ALL_BADPASSWORDCOUNT: ULONG = 0x00004000;
+pub const USER_ALL_LOGONCOUNT: ULONG = 0x00008000;
+pub const USER_ALL_PASSWORDCANCHANGE: ULONG = 0x00010000;
+pub const USER_ALL_PASSWORDMUSTCHANGE: ULONG = 0x00020000;
+pub const USER_ALL_PASSWORDLASTSET: ULONG = 0x00040000;
+pub const USER_ALL_ACCOUNTEXPIRES: ULONG = 0x00080000;
+pub const USER_ALL_USERACCOUNTCONTROL: ULONG = 0x00100000;
+pub const USER_ALL_PARAMETERS: ULONG = 0x00200000;
+pub const USER_ALL_COUNTRYCODE: ULONG = 0x00400000;
+pub const USER_ALL_CODEPAGE: ULONG = 0x00800000;
+pub const USER_ALL_NTPASSWORDPRESENT: ULONG = 0x01000000;
+pub const USER_ALL_LMPASSWORDPRESENT: ULONG = 0x02000000;
+pub const USER_ALL_PRIVATEDATA: ULONG = 0x04000000;
+pub const USER_ALL_PASSWORDEXPIRED: ULONG = 0x08000000;
+pub const USER_ALL_SECURITYDESCRIPTOR: ULONG = 0x10000000;
+pub const USER_ALL_OWFPASSWORD: ULONG = 0x20000000;
+pub const USER_ALL_UNDEFINED_MASK: ULONG = 0xc0000000;
+pub const USER_ALL_READ_GENERAL_MASK: ULONG = USER_ALL_USERNAME | USER_ALL_FULLNAME
+ | USER_ALL_USERID | USER_ALL_PRIMARYGROUPID | USER_ALL_ADMINCOMMENT | USER_ALL_USERCOMMENT;
+pub const USER_ALL_READ_LOGON_MASK: ULONG = USER_ALL_HOMEDIRECTORY | USER_ALL_HOMEDIRECTORYDRIVE
+ | USER_ALL_SCRIPTPATH | USER_ALL_PROFILEPATH | USER_ALL_WORKSTATIONS | USER_ALL_LASTLOGON
+ | USER_ALL_LASTLOGOFF | USER_ALL_LOGONHOURS | USER_ALL_BADPASSWORDCOUNT | USER_ALL_LOGONCOUNT
+ | USER_ALL_PASSWORDCANCHANGE | USER_ALL_PASSWORDMUSTCHANGE;
+pub const USER_ALL_READ_ACCOUNT_MASK: ULONG = USER_ALL_PASSWORDLASTSET | USER_ALL_ACCOUNTEXPIRES
+ | USER_ALL_USERACCOUNTCONTROL | USER_ALL_PARAMETERS;
+pub const USER_ALL_READ_PREFERENCES_MASK: ULONG = USER_ALL_COUNTRYCODE | USER_ALL_CODEPAGE;
+pub const USER_ALL_READ_TRUSTED_MASK: ULONG = USER_ALL_NTPASSWORDPRESENT
+ | USER_ALL_LMPASSWORDPRESENT | USER_ALL_PASSWORDEXPIRED | USER_ALL_SECURITYDESCRIPTOR
+ | USER_ALL_PRIVATEDATA;
+pub const USER_ALL_READ_CANT_MASK: ULONG = USER_ALL_UNDEFINED_MASK;
+pub const USER_ALL_WRITE_ACCOUNT_MASK: ULONG = USER_ALL_USERNAME | USER_ALL_FULLNAME
+ | USER_ALL_PRIMARYGROUPID | USER_ALL_HOMEDIRECTORY | USER_ALL_HOMEDIRECTORYDRIVE
+ | USER_ALL_SCRIPTPATH | USER_ALL_PROFILEPATH | USER_ALL_ADMINCOMMENT | USER_ALL_WORKSTATIONS
+ | USER_ALL_LOGONHOURS | USER_ALL_ACCOUNTEXPIRES | USER_ALL_USERACCOUNTCONTROL
+ | USER_ALL_PARAMETERS;
+pub const USER_ALL_WRITE_PREFERENCES_MASK: ULONG =
+ USER_ALL_USERCOMMENT | USER_ALL_COUNTRYCODE | USER_ALL_CODEPAGE;
+pub const USER_ALL_WRITE_FORCE_PASSWORD_CHANGE_MASK: ULONG =
+ USER_ALL_NTPASSWORDPRESENT | USER_ALL_LMPASSWORDPRESENT | USER_ALL_PASSWORDEXPIRED;
+pub const USER_ALL_WRITE_TRUSTED_MASK: ULONG = USER_ALL_LASTLOGON | USER_ALL_LASTLOGOFF
+ | USER_ALL_BADPASSWORDCOUNT | USER_ALL_LOGONCOUNT | USER_ALL_PASSWORDLASTSET
+ | USER_ALL_SECURITYDESCRIPTOR | USER_ALL_PRIVATEDATA;
+pub const USER_ALL_WRITE_CANT_MASK: ULONG = USER_ALL_USERID | USER_ALL_PASSWORDCANCHANGE
+ | USER_ALL_PASSWORDMUSTCHANGE | USER_ALL_UNDEFINED_MASK;
+STRUCT!{struct USER_GENERAL_INFORMATION {
+ UserName: UNICODE_STRING,
+ FullName: UNICODE_STRING,
+ PrimaryGroupId: ULONG,
+ AdminComment: UNICODE_STRING,
+ UserComment: UNICODE_STRING,
+}}
+pub type PUSER_GENERAL_INFORMATION = *mut USER_GENERAL_INFORMATION;
+STRUCT!{struct USER_PREFERENCES_INFORMATION {
+ UserComment: UNICODE_STRING,
+ Reserved1: UNICODE_STRING,
+ CountryCode: USHORT,
+ CodePage: USHORT,
+}}
+pub type PUSER_PREFERENCES_INFORMATION = *mut USER_PREFERENCES_INFORMATION;
+STRUCT!{struct USER_PARAMETERS_INFORMATION {
+ Parameters: UNICODE_STRING,
+}}
+pub type PUSER_PARAMETERS_INFORMATION = *mut USER_PARAMETERS_INFORMATION;
+STRUCT!{#[repr(packed(4))] struct USER_LOGON_INFORMATION {
+ UserName: UNICODE_STRING,
+ FullName: UNICODE_STRING,
+ UserId: ULONG,
+ PrimaryGroupId: ULONG,
+ HomeDirectory: UNICODE_STRING,
+ HomeDirectoryDrive: UNICODE_STRING,
+ ScriptPath: UNICODE_STRING,
+ ProfilePath: UNICODE_STRING,
+ WorkStations: UNICODE_STRING,
+ LastLogon: LARGE_INTEGER,
+ LastLogoff: LARGE_INTEGER,
+ PasswordLastSet: LARGE_INTEGER,
+ PasswordCanChange: LARGE_INTEGER,
+ PasswordMustChange: LARGE_INTEGER,
+ LogonHours: LOGON_HOURS,
+ BadPasswordCount: USHORT,
+ LogonCount: USHORT,
+ UserAccountControl: ULONG,
+}}
+pub type PUSER_LOGON_INFORMATION = *mut USER_LOGON_INFORMATION;
+STRUCT!{#[repr(packed(4))] struct USER_ACCOUNT_INFORMATION {
+ UserName: UNICODE_STRING,
+ FullName: UNICODE_STRING,
+ UserId: ULONG,
+ PrimaryGroupId: ULONG,
+ HomeDirectory: UNICODE_STRING,
+ HomeDirectoryDrive: UNICODE_STRING,
+ ScriptPath: UNICODE_STRING,
+ ProfilePath: UNICODE_STRING,
+ AdminComment: UNICODE_STRING,
+ WorkStations: UNICODE_STRING,
+ LastLogon: LARGE_INTEGER,
+ LastLogoff: LARGE_INTEGER,
+ LogonHours: LOGON_HOURS,
+ BadPasswordCount: USHORT,
+ LogonCount: USHORT,
+ PasswordLastSet: LARGE_INTEGER,
+ AccountExpires: LARGE_INTEGER,
+ UserAccountControl: ULONG,
+}}
+pub type PUSER_ACCOUNT_INFORMATION = *mut USER_ACCOUNT_INFORMATION;
+STRUCT!{struct USER_ACCOUNT_NAME_INFORMATION {
+ UserName: UNICODE_STRING,
+}}
+pub type PUSER_ACCOUNT_NAME_INFORMATION = *mut USER_ACCOUNT_NAME_INFORMATION;
+STRUCT!{struct USER_FULL_NAME_INFORMATION {
+ FullName: UNICODE_STRING,
+}}
+pub type PUSER_FULL_NAME_INFORMATION = *mut USER_FULL_NAME_INFORMATION;
+STRUCT!{struct USER_NAME_INFORMATION {
+ UserName: UNICODE_STRING,
+ FullName: UNICODE_STRING,
+}}
+pub type PUSER_NAME_INFORMATION = *mut USER_NAME_INFORMATION;
+STRUCT!{struct USER_PRIMARY_GROUP_INFORMATION {
+ PrimaryGroupId: ULONG,
+}}
+pub type PUSER_PRIMARY_GROUP_INFORMATION = *mut USER_PRIMARY_GROUP_INFORMATION;
+STRUCT!{struct USER_HOME_INFORMATION {
+ HomeDirectory: UNICODE_STRING,
+ HomeDirectoryDrive: UNICODE_STRING,
+}}
+pub type PUSER_HOME_INFORMATION = *mut USER_HOME_INFORMATION;
+STRUCT!{struct USER_SCRIPT_INFORMATION {
+ ScriptPath: UNICODE_STRING,
+}}
+pub type PUSER_SCRIPT_INFORMATION = *mut USER_SCRIPT_INFORMATION;
+STRUCT!{struct USER_PROFILE_INFORMATION {
+ ProfilePath: UNICODE_STRING,
+}}
+pub type PUSER_PROFILE_INFORMATION = *mut USER_PROFILE_INFORMATION;
+STRUCT!{struct USER_ADMIN_COMMENT_INFORMATION {
+ AdminComment: UNICODE_STRING,
+}}
+pub type PUSER_ADMIN_COMMENT_INFORMATION = *mut USER_ADMIN_COMMENT_INFORMATION;
+STRUCT!{struct USER_WORKSTATIONS_INFORMATION {
+ WorkStations: UNICODE_STRING,
+}}
+pub type PUSER_WORKSTATIONS_INFORMATION = *mut USER_WORKSTATIONS_INFORMATION;
+STRUCT!{struct USER_SET_PASSWORD_INFORMATION {
+ Password: UNICODE_STRING,
+ PasswordExpired: BOOLEAN,
+}}
+pub type PUSER_SET_PASSWORD_INFORMATION = *mut USER_SET_PASSWORD_INFORMATION;
+STRUCT!{struct USER_CONTROL_INFORMATION {
+ UserAccountControl: ULONG,
+}}
+pub type PUSER_CONTROL_INFORMATION = *mut USER_CONTROL_INFORMATION;
+STRUCT!{struct USER_EXPIRES_INFORMATION {
+ AccountExpires: LARGE_INTEGER,
+}}
+pub type PUSER_EXPIRES_INFORMATION = *mut USER_EXPIRES_INFORMATION;
+STRUCT!{struct USER_LOGON_HOURS_INFORMATION {
+ LogonHours: LOGON_HOURS,
+}}
+pub type PUSER_LOGON_HOURS_INFORMATION = *mut USER_LOGON_HOURS_INFORMATION;
+pub type SAM_USER_TILE = SAM_BYTE_ARRAY_32K;
+pub type PSAM_USER_TILE = *mut SAM_BYTE_ARRAY_32K;
+pub const USER_EXTENDED_FIELD_USER_TILE: ULONG = 0x00001000;
+pub const USER_EXTENDED_FIELD_PASSWORD_HINT: ULONG = 0x00002000;
+pub const USER_EXTENDED_FIELD_DONT_SHOW_IN_LOGON_UI: ULONG = 0x00004000;
+pub const USER_EXTENDED_FIELD_SHELL_ADMIN_OBJECT_PROPERTIES: ULONG = 0x00008000;
+STRUCT!{struct USER_EXTENDED_INFORMATION {
+ ExtendedWhichFields: ULONG,
+ UserTile: SAM_USER_TILE,
+ PasswordHint: UNICODE_STRING,
+ DontShowInLogonUI: BOOLEAN,
+ ShellAdminObjectProperties: SAM_SHELL_OBJECT_PROPERTIES,
+}}
+pub type PUSER_EXTENDED_INFORMATION = *mut USER_EXTENDED_INFORMATION;
+STRUCT!{struct USER_LOGON_UI_INFORMATION {
+ PasswordIsBlank: BOOLEAN,
+ AccountIsDisabled: BOOLEAN,
+}}
+pub type PUSER_LOGON_UI_INFORMATION = *mut USER_LOGON_UI_INFORMATION;
+STRUCT!{struct USER_PWD_CHANGE_FAILURE_INFORMATION {
+ ExtendedFailureReason: ULONG,
+ FilterModuleName: UNICODE_STRING,
+}}
+pub type PUSER_PWD_CHANGE_FAILURE_INFORMATION = *mut USER_PWD_CHANGE_FAILURE_INFORMATION;
+pub const SAM_PWD_CHANGE_NO_ERROR: u32 = 0;
+pub const SAM_PWD_CHANGE_PASSWORD_TOO_SHORT: u32 = 1;
+pub const SAM_PWD_CHANGE_PWD_IN_HISTORY: u32 = 2;
+pub const SAM_PWD_CHANGE_USERNAME_IN_PASSWORD: u32 = 3;
+pub const SAM_PWD_CHANGE_FULLNAME_IN_PASSWORD: u32 = 4;
+pub const SAM_PWD_CHANGE_NOT_COMPLEX: u32 = 5;
+pub const SAM_PWD_CHANGE_MACHINE_PASSWORD_NOT_DEFAULT: u32 = 6;
+pub const SAM_PWD_CHANGE_FAILED_BY_FILTER: u32 = 7;
+pub const SAM_PWD_CHANGE_PASSWORD_TOO_LONG: u32 = 8;
+pub const SAM_PWD_CHANGE_FAILURE_REASON_MAX: u32 = 8;
+EXTERN!{extern "system" {
+ fn SamEnumerateUsersInDomain(
+ DomainHandle: SAM_HANDLE,
+ EnumerationContext: PSAM_ENUMERATE_HANDLE,
+ UserAccountControl: ULONG,
+ Buffer: *mut PVOID,
+ PreferedMaximumLength: ULONG,
+ CountReturned: PULONG,
+ ) -> NTSTATUS;
+ fn SamCreateUserInDomain(
+ DomainHandle: SAM_HANDLE,
+ AccountName: PUNICODE_STRING,
+ DesiredAccess: ACCESS_MASK,
+ UserHandle: PSAM_HANDLE,
+ RelativeId: PULONG,
+ ) -> NTSTATUS;
+ fn SamCreateUser2InDomain(
+ DomainHandle: SAM_HANDLE,
+ AccountName: PUNICODE_STRING,
+ AccountType: ULONG,
+ DesiredAccess: ACCESS_MASK,
+ UserHandle: PSAM_HANDLE,
+ GrantedAccess: PULONG,
+ RelativeId: PULONG,
+ ) -> NTSTATUS;
+ fn SamOpenUser(
+ DomainHandle: SAM_HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ UserId: ULONG,
+ UserHandle: PSAM_HANDLE,
+ ) -> NTSTATUS;
+ fn SamDeleteUser(
+ UserHandle: SAM_HANDLE,
+ ) -> NTSTATUS;
+ fn SamQueryInformationUser(
+ UserHandle: SAM_HANDLE,
+ UserInformationClass: USER_INFORMATION_CLASS,
+ Buffer: *mut PVOID,
+ ) -> NTSTATUS;
+ fn SamSetInformationUser(
+ UserHandle: SAM_HANDLE,
+ UserInformationClass: USER_INFORMATION_CLASS,
+ Buffer: PVOID,
+ ) -> NTSTATUS;
+ fn SamGetGroupsForUser(
+ UserHandle: SAM_HANDLE,
+ Groups: *mut PGROUP_MEMBERSHIP,
+ MembershipCount: PULONG,
+ ) -> NTSTATUS;
+ fn SamChangePasswordUser(
+ UserHandle: SAM_HANDLE,
+ OldPassword: PUNICODE_STRING,
+ NewPassword: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn SamChangePasswordUser2(
+ ServerName: PUNICODE_STRING,
+ UserName: PUNICODE_STRING,
+ OldPassword: PUNICODE_STRING,
+ NewPassword: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn SamChangePasswordUser3(
+ ServerName: PUNICODE_STRING,
+ UserName: PUNICODE_STRING,
+ OldPassword: PUNICODE_STRING,
+ NewPassword: PUNICODE_STRING,
+ EffectivePasswordPolicy: *mut PDOMAIN_PASSWORD_INFORMATION,
+ PasswordChangeFailureInfo: *mut PUSER_PWD_CHANGE_FAILURE_INFORMATION,
+ ) -> NTSTATUS;
+ fn SamQueryDisplayInformation(
+ DomainHandle: SAM_HANDLE,
+ DisplayInformation: DOMAIN_DISPLAY_INFORMATION,
+ Index: ULONG,
+ EntryCount: ULONG,
+ PreferredMaximumLength: ULONG,
+ TotalAvailable: PULONG,
+ TotalReturned: PULONG,
+ ReturnedEntryCount: PULONG,
+ SortedBuffer: *mut PVOID,
+ ) -> NTSTATUS;
+ fn SamGetDisplayEnumerationIndex(
+ DomainHandle: SAM_HANDLE,
+ DisplayInformation: DOMAIN_DISPLAY_INFORMATION,
+ Prefix: PUNICODE_STRING,
+ Index: PULONG,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum SECURITY_DB_DELTA_TYPE {
+ SecurityDbNew = 1,
+ SecurityDbRename = 2,
+ SecurityDbDelete = 3,
+ SecurityDbChangeMemberAdd = 4,
+ SecurityDbChangeMemberSet = 5,
+ SecurityDbChangeMemberDel = 6,
+ SecurityDbChange = 7,
+ SecurityDbChangePassword = 8,
+}}
+pub type PSECURITY_DB_DELTA_TYPE = *mut SECURITY_DB_DELTA_TYPE;
+ENUM!{enum SECURITY_DB_OBJECT_TYPE {
+ SecurityDbObjectSamDomain = 1,
+ SecurityDbObjectSamUser = 2,
+ SecurityDbObjectSamGroup = 3,
+ SecurityDbObjectSamAlias = 4,
+ SecurityDbObjectLsaPolicy = 5,
+ SecurityDbObjectLsaTDomain = 6,
+ SecurityDbObjectLsaAccount = 7,
+ SecurityDbObjectLsaSecret = 8,
+}}
+pub type PSECURITY_DB_OBJECT_TYPE = *mut SECURITY_DB_OBJECT_TYPE;
+ENUM!{enum SAM_ACCOUNT_TYPE {
+ SamObjectUser = 1,
+ SamObjectGroup = 2,
+ SamObjectAlias = 3,
+}}
+pub type PSAM_ACCOUNT_TYPE = *mut SAM_ACCOUNT_TYPE;
+pub const SAM_USER_ACCOUNT: u32 = 0x00000001;
+pub const SAM_GLOBAL_GROUP_ACCOUNT: u32 = 0x00000002;
+pub const SAM_LOCAL_GROUP_ACCOUNT: u32 = 0x00000004;
+STRUCT!{struct SAM_GROUP_MEMBER_ID {
+ MemberRid: ULONG,
+}}
+pub type PSAM_GROUP_MEMBER_ID = *mut SAM_GROUP_MEMBER_ID;
+STRUCT!{struct SAM_ALIAS_MEMBER_ID {
+ MemberSid: PSID,
+}}
+pub type PSAM_ALIAS_MEMBER_ID = *mut SAM_ALIAS_MEMBER_ID;
+UNION!{union SAM_DELTA_DATA {
+ GroupMemberId: SAM_GROUP_MEMBER_ID,
+ AliasMemberId: SAM_ALIAS_MEMBER_ID,
+ AccountControl: ULONG,
+}}
+pub type PSAM_DELTA_DATA = *mut SAM_DELTA_DATA;
+FN!{stdcall PSAM_DELTA_NOTIFICATION_ROUTINE(
+ DomainSid: PSID,
+ DeltaType: SECURITY_DB_DELTA_TYPE,
+ ObjectType: SECURITY_DB_OBJECT_TYPE,
+ ObjectRid: ULONG,
+ ObjectName: PUNICODE_STRING,
+ ModifiedCount: PLARGE_INTEGER,
+ DeltaData: PSAM_DELTA_DATA,
+) -> NTSTATUS}
+pub const SAM_DELTA_NOTIFY_ROUTINE: UTF8Const = UTF8Const("DeltaNotify\0");
+EXTERN!{extern "system" {
+ fn SamRegisterObjectChangeNotification(
+ ObjectType: SECURITY_DB_OBJECT_TYPE,
+ NotificationEventHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn SamUnregisterObjectChangeNotification(
+ ObjectType: SECURITY_DB_OBJECT_TYPE,
+ NotificationEventHandle: HANDLE,
+ ) -> NTSTATUS;
+}}
+pub const SAM_SID_COMPATIBILITY_ALL: u32 = 0;
+pub const SAM_SID_COMPATIBILITY_LAX: u32 = 1;
+pub const SAM_SID_COMPATIBILITY_STRICT: u32 = 2;
+EXTERN!{extern "system" {
+ fn SamGetCompatibilityMode(
+ ObjectHandle: SAM_HANDLE,
+ Mode: *mut ULONG,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum PASSWORD_POLICY_VALIDATION_TYPE {
+ SamValidateAuthentication = 1,
+ SamValidatePasswordChange = 2,
+ SamValidatePasswordReset = 3,
+}}
+STRUCT!{struct SAM_VALIDATE_PASSWORD_HASH {
+ Length: ULONG,
+ Hash: PUCHAR,
+}}
+pub type PSAM_VALIDATE_PASSWORD_HASH = *mut SAM_VALIDATE_PASSWORD_HASH;
+pub const SAM_VALIDATE_PASSWORD_LAST_SET: u32 = 0x00000001;
+pub const SAM_VALIDATE_BAD_PASSWORD_TIME: u32 = 0x00000002;
+pub const SAM_VALIDATE_LOCKOUT_TIME: u32 = 0x00000004;
+pub const SAM_VALIDATE_BAD_PASSWORD_COUNT: u32 = 0x00000008;
+pub const SAM_VALIDATE_PASSWORD_HISTORY_LENGTH: u32 = 0x00000010;
+pub const SAM_VALIDATE_PASSWORD_HISTORY: u32 = 0x00000020;
+STRUCT!{struct SAM_VALIDATE_PERSISTED_FIELDS {
+ PresentFields: ULONG,
+ PasswordLastSet: LARGE_INTEGER,
+ BadPasswordTime: LARGE_INTEGER,
+ LockoutTime: LARGE_INTEGER,
+ BadPasswordCount: ULONG,
+ PasswordHistoryLength: ULONG,
+ PasswordHistory: PSAM_VALIDATE_PASSWORD_HASH,
+}}
+pub type PSAM_VALIDATE_PERSISTED_FIELDS = *mut SAM_VALIDATE_PERSISTED_FIELDS;
+ENUM!{enum SAM_VALIDATE_VALIDATION_STATUS {
+ SamValidateSuccess = 0,
+ SamValidatePasswordMustChange = 1,
+ SamValidateAccountLockedOut = 2,
+ SamValidatePasswordExpired = 3,
+ SamValidatePasswordIncorrect = 4,
+ SamValidatePasswordIsInHistory = 5,
+ SamValidatePasswordTooShort = 6,
+ SamValidatePasswordTooLong = 7,
+ SamValidatePasswordNotComplexEnough = 8,
+ SamValidatePasswordTooRecent = 9,
+ SamValidatePasswordFilterError = 10,
+}}
+pub type PSAM_VALIDATE_VALIDATION_STATUS = *mut SAM_VALIDATE_VALIDATION_STATUS;
+STRUCT!{struct SAM_VALIDATE_STANDARD_OUTPUT_ARG {
+ ChangedPersistedFields: SAM_VALIDATE_PERSISTED_FIELDS,
+ ValidationStatus: SAM_VALIDATE_VALIDATION_STATUS,
+}}
+pub type PSAM_VALIDATE_STANDARD_OUTPUT_ARG = *mut SAM_VALIDATE_STANDARD_OUTPUT_ARG;
+STRUCT!{struct SAM_VALIDATE_AUTHENTICATION_INPUT_ARG {
+ InputPersistedFields: SAM_VALIDATE_PERSISTED_FIELDS,
+ PasswordMatched: BOOLEAN,
+}}
+pub type PSAM_VALIDATE_AUTHENTICATION_INPUT_ARG = *mut SAM_VALIDATE_AUTHENTICATION_INPUT_ARG;
+STRUCT!{struct SAM_VALIDATE_PASSWORD_CHANGE_INPUT_ARG {
+ InputPersistedFields: SAM_VALIDATE_PERSISTED_FIELDS,
+ ClearPassword: UNICODE_STRING,
+ UserAccountName: UNICODE_STRING,
+ HashedPassword: SAM_VALIDATE_PASSWORD_HASH,
+ PasswordMatch: BOOLEAN,
+}}
+pub type PSAM_VALIDATE_PASSWORD_CHANGE_INPUT_ARG = *mut SAM_VALIDATE_PASSWORD_CHANGE_INPUT_ARG;
+STRUCT!{struct SAM_VALIDATE_PASSWORD_RESET_INPUT_ARG {
+ InputPersistedFields: SAM_VALIDATE_PERSISTED_FIELDS,
+ ClearPassword: UNICODE_STRING,
+ UserAccountName: UNICODE_STRING,
+ HashedPassword: SAM_VALIDATE_PASSWORD_HASH,
+ PasswordMustChangeAtNextLogon: BOOLEAN,
+ ClearLockout: BOOLEAN,
+}}
+pub type PSAM_VALIDATE_PASSWORD_RESET_INPUT_ARG = *mut SAM_VALIDATE_PASSWORD_RESET_INPUT_ARG;
+UNION!{union SAM_VALIDATE_INPUT_ARG {
+ ValidateAuthenticationInput: SAM_VALIDATE_AUTHENTICATION_INPUT_ARG,
+ ValidatePasswordChangeInput: SAM_VALIDATE_PASSWORD_CHANGE_INPUT_ARG,
+ ValidatePasswordResetInput: SAM_VALIDATE_PASSWORD_RESET_INPUT_ARG,
+}}
+pub type PSAM_VALIDATE_INPUT_ARG = *mut SAM_VALIDATE_INPUT_ARG;
+UNION!{union SAM_VALIDATE_OUTPUT_ARG {
+ ValidateAuthenticationOutput: SAM_VALIDATE_STANDARD_OUTPUT_ARG,
+ ValidatePasswordChangeOutput: SAM_VALIDATE_STANDARD_OUTPUT_ARG,
+ ValidatePasswordResetOutput: SAM_VALIDATE_STANDARD_OUTPUT_ARG,
+}}
+pub type PSAM_VALIDATE_OUTPUT_ARG = *mut SAM_VALIDATE_OUTPUT_ARG;
+EXTERN!{extern "system" {
+ fn SamValidatePassword(
+ ServerName: PUNICODE_STRING,
+ ValidationType: PASSWORD_POLICY_VALIDATION_TYPE,
+ InputArg: PSAM_VALIDATE_INPUT_ARG,
+ OutputArg: *mut PSAM_VALIDATE_OUTPUT_ARG,
+ ) -> NTSTATUS;
+}}
+ENUM!{enum SAM_GENERIC_OPERATION_TYPE {
+ SamObjectChangeNotificationOperation = 0,
+}}
+pub type PSAM_GENERIC_OPERATION_TYPE = *mut SAM_GENERIC_OPERATION_TYPE;
+STRUCT!{struct SAM_OPERATION_OBJCHG_INPUT {
+ Register: BOOLEAN,
+ EventHandle: ULONG64,
+ ObjectType: SECURITY_DB_OBJECT_TYPE,
+ ProcessID: ULONG,
+}}
+pub type PSAM_OPERATION_OBJCHG_INPUT = *mut SAM_OPERATION_OBJCHG_INPUT;
+STRUCT!{struct SAM_OPERATION_OBJCHG_OUTPUT {
+ Reserved: ULONG,
+}}
+pub type PSAM_OPERATION_OBJCHG_OUTPUT = *mut SAM_OPERATION_OBJCHG_OUTPUT;
+UNION!{union SAM_GENERIC_OPERATION_INPUT {
+ ObjChangeIn: SAM_OPERATION_OBJCHG_INPUT,
+}}
+pub type PSAM_GENERIC_OPERATION_INPUT = *mut SAM_GENERIC_OPERATION_INPUT;
+UNION!{union SAM_GENERIC_OPERATION_OUTPUT {
+ ObjChangeOut: SAM_OPERATION_OBJCHG_OUTPUT,
+}}
+pub type PSAM_GENERIC_OPERATION_OUTPUT = *mut SAM_GENERIC_OPERATION_OUTPUT;
+EXTERN!{extern "system" {
+ fn SamPerformGenericOperation(
+ ServerName: PWSTR,
+ OperationType: SAM_GENERIC_OPERATION_TYPE,
+ OperationIn: PSAM_GENERIC_OPERATION_INPUT,
+ OperationOut: *mut PSAM_GENERIC_OPERATION_OUTPUT,
+ ) -> NTSTATUS;
+}}
diff --git a/third_party/rust/ntapi/src/ntseapi.rs b/third_party/rust/ntapi/src/ntseapi.rs
new file mode 100644
index 0000000000..4cac9f4f81
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntseapi.rs
@@ -0,0 +1,439 @@
+use winapi::shared::basetsd::{PLONG64, PULONG64, ULONG64};
+use winapi::shared::ntdef::{
+ BOOLEAN, HANDLE, LONG, NTSTATUS, PBOOLEAN, PHANDLE, PLARGE_INTEGER, PLUID, PNTSTATUS,
+ POBJECT_ATTRIBUTES, PUCHAR, PULONG, PUNICODE_STRING, PVOID, ULONG, UNICODE_STRING, USHORT,
+};
+use winapi::um::winnt::{
+ ACCESS_MASK, AUDIT_EVENT_TYPE, PACCESS_MASK, PGENERIC_MAPPING, POBJECT_TYPE_LIST,
+ PPRIVILEGE_SET, PSECURITY_DESCRIPTOR, PSE_SIGNING_LEVEL, PSID, PSID_AND_ATTRIBUTES,
+ PTOKEN_DEFAULT_DACL, PTOKEN_GROUPS, PTOKEN_MANDATORY_POLICY, PTOKEN_OWNER,
+ PTOKEN_PRIMARY_GROUP, PTOKEN_PRIVILEGES, PTOKEN_SOURCE, PTOKEN_USER, SE_SIGNING_LEVEL,
+ TOKEN_INFORMATION_CLASS, TOKEN_TYPE,
+};
+pub const SE_MIN_WELL_KNOWN_PRIVILEGE: LONG = 2;
+pub const SE_CREATE_TOKEN_PRIVILEGE: LONG = 2;
+pub const SE_ASSIGNPRIMARYTOKEN_PRIVILEGE: LONG = 3;
+pub const SE_LOCK_MEMORY_PRIVILEGE: LONG = 4;
+pub const SE_INCREASE_QUOTA_PRIVILEGE: LONG = 5;
+pub const SE_MACHINE_ACCOUNT_PRIVILEGE: LONG = 6;
+pub const SE_TCB_PRIVILEGE: LONG = 7;
+pub const SE_SECURITY_PRIVILEGE: LONG = 8;
+pub const SE_TAKE_OWNERSHIP_PRIVILEGE: LONG = 9;
+pub const SE_LOAD_DRIVER_PRIVILEGE: LONG = 10;
+pub const SE_SYSTEM_PROFILE_PRIVILEGE: LONG = 11;
+pub const SE_SYSTEMTIME_PRIVILEGE: LONG = 12;
+pub const SE_PROF_SINGLE_PROCESS_PRIVILEGE: LONG = 13;
+pub const SE_INC_BASE_PRIORITY_PRIVILEGE: LONG = 14;
+pub const SE_CREATE_PAGEFILE_PRIVILEGE: LONG = 15;
+pub const SE_CREATE_PERMANENT_PRIVILEGE: LONG = 16;
+pub const SE_BACKUP_PRIVILEGE: LONG = 17;
+pub const SE_RESTORE_PRIVILEGE: LONG = 18;
+pub const SE_SHUTDOWN_PRIVILEGE: LONG = 19;
+pub const SE_DEBUG_PRIVILEGE: LONG = 20;
+pub const SE_AUDIT_PRIVILEGE: LONG = 21;
+pub const SE_SYSTEM_ENVIRONMENT_PRIVILEGE: LONG = 22;
+pub const SE_CHANGE_NOTIFY_PRIVILEGE: LONG = 23;
+pub const SE_REMOTE_SHUTDOWN_PRIVILEGE: LONG = 24;
+pub const SE_UNDOCK_PRIVILEGE: LONG = 25;
+pub const SE_SYNC_AGENT_PRIVILEGE: LONG = 26;
+pub const SE_ENABLE_DELEGATION_PRIVILEGE: LONG = 27;
+pub const SE_MANAGE_VOLUME_PRIVILEGE: LONG = 28;
+pub const SE_IMPERSONATE_PRIVILEGE: LONG = 29;
+pub const SE_CREATE_GLOBAL_PRIVILEGE: LONG = 30;
+pub const SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE: LONG = 31;
+pub const SE_RELABEL_PRIVILEGE: LONG = 32;
+pub const SE_INC_WORKING_SET_PRIVILEGE: LONG = 33;
+pub const SE_TIME_ZONE_PRIVILEGE: LONG = 34;
+pub const SE_CREATE_SYMBOLIC_LINK_PRIVILEGE: LONG = 35;
+pub const SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE: LONG = 36;
+pub const SE_MAX_WELL_KNOWN_PRIVILEGE: LONG = SE_DELEGATE_SESSION_USER_IMPERSONATE_PRIVILEGE;
+pub const TOKEN_SECURITY_ATTRIBUTE_TYPE_INVALID: USHORT = 0x00;
+pub const TOKEN_SECURITY_ATTRIBUTE_TYPE_INT64: USHORT = 0x01;
+pub const TOKEN_SECURITY_ATTRIBUTE_TYPE_UINT64: USHORT = 0x02;
+pub const TOKEN_SECURITY_ATTRIBUTE_TYPE_STRING: USHORT = 0x03;
+pub const TOKEN_SECURITY_ATTRIBUTE_TYPE_FQBN: USHORT = 0x04;
+pub const TOKEN_SECURITY_ATTRIBUTE_TYPE_SID: USHORT = 0x05;
+pub const TOKEN_SECURITY_ATTRIBUTE_TYPE_BOOLEAN: USHORT = 0x06;
+pub const TOKEN_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING: USHORT = 0x10;
+pub const TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE: USHORT = 0x0001;
+pub const TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE: USHORT = 0x0002;
+pub const TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY: USHORT = 0x0004;
+pub const TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT: USHORT = 0x0008;
+pub const TOKEN_SECURITY_ATTRIBUTE_DISABLED: USHORT = 0x0010;
+pub const TOKEN_SECURITY_ATTRIBUTE_MANDATORY: USHORT = 0x0020;
+pub const TOKEN_SECURITY_ATTRIBUTE_COMPARE_IGNORE: USHORT = 0x0040;
+pub const TOKEN_SECURITY_ATTRIBUTE_VALID_FLAGS: USHORT = TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE
+ | TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE | TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY
+ | TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT | TOKEN_SECURITY_ATTRIBUTE_DISABLED
+ | TOKEN_SECURITY_ATTRIBUTE_MANDATORY;
+pub const TOKEN_SECURITY_ATTRIBUTE_CUSTOM_FLAGS: u32 = 0xffff0000;
+STRUCT!{struct TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE {
+ Version: ULONG64,
+ Name: UNICODE_STRING,
+}}
+pub type PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE = *mut TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE;
+STRUCT!{struct TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE {
+ pValue: PVOID,
+ ValueLength: ULONG,
+}}
+pub type PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE =
+ *mut TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE;
+UNION!{union TOKEN_SECURITY_ATTRIBUTE_V1_Values {
+ pInt64: PLONG64,
+ pUint64: PULONG64,
+ pString: PUNICODE_STRING,
+ pFqbn: PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE,
+ pOctetString: PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE,
+}}
+STRUCT!{struct TOKEN_SECURITY_ATTRIBUTE_V1 {
+ Name: UNICODE_STRING,
+ ValueType: USHORT,
+ Reserved: USHORT,
+ Flags: ULONG,
+ ValueCount: ULONG,
+ Values: TOKEN_SECURITY_ATTRIBUTE_V1_Values,
+}}
+pub type PTOKEN_SECURITY_ATTRIBUTE_V1 = *mut TOKEN_SECURITY_ATTRIBUTE_V1;
+pub const TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1: USHORT = 1;
+pub const TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION: USHORT =
+ TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1;
+STRUCT!{struct TOKEN_SECURITY_ATTRIBUTES_INFORMATION {
+ Version: USHORT,
+ Reserved: USHORT,
+ AttributeCount: ULONG,
+ pAttributeV1: PTOKEN_SECURITY_ATTRIBUTE_V1,
+}}
+pub type PTOKEN_SECURITY_ATTRIBUTES_INFORMATION = *mut TOKEN_SECURITY_ATTRIBUTES_INFORMATION;
+STRUCT!{struct TOKEN_PROCESS_TRUST_LEVEL {
+ TrustLevelSid: PSID,
+}}
+pub type PTOKEN_PROCESS_TRUST_LEVEL = *mut TOKEN_PROCESS_TRUST_LEVEL;
+EXTERN!{extern "system" {
+ fn NtCreateToken(
+ TokenHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ TokenType: TOKEN_TYPE,
+ AuthenticationId: PLUID,
+ ExpirationTime: PLARGE_INTEGER,
+ User: PTOKEN_USER,
+ Groups: PTOKEN_GROUPS,
+ Privileges: PTOKEN_PRIVILEGES,
+ Owner: PTOKEN_OWNER,
+ PrimaryGroup: PTOKEN_PRIMARY_GROUP,
+ DefaultDacl: PTOKEN_DEFAULT_DACL,
+ TokenSource: PTOKEN_SOURCE,
+ ) -> NTSTATUS;
+ fn NtCreateLowBoxToken(
+ TokenHandle: PHANDLE,
+ ExistingTokenHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ PackageSid: PSID,
+ CapabilityCount: ULONG,
+ Capabilities: PSID_AND_ATTRIBUTES,
+ HandleCount: ULONG,
+ Handles: *mut HANDLE,
+ ) -> NTSTATUS;
+ fn NtCreateTokenEx(
+ TokenHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ TokenType: TOKEN_TYPE,
+ AuthenticationId: PLUID,
+ ExpirationTime: PLARGE_INTEGER,
+ User: PTOKEN_USER,
+ Groups: PTOKEN_GROUPS,
+ Privileges: PTOKEN_PRIVILEGES,
+ UserAttributes: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ DeviceAttributes: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ DeviceGroups: PTOKEN_GROUPS,
+ TokenMandatoryPolicy: PTOKEN_MANDATORY_POLICY,
+ Owner: PTOKEN_OWNER,
+ PrimaryGroup: PTOKEN_PRIMARY_GROUP,
+ DefaultDacl: PTOKEN_DEFAULT_DACL,
+ TokenSource: PTOKEN_SOURCE,
+ ) -> NTSTATUS;
+ fn NtOpenProcessToken(
+ ProcessHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ TokenHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn NtOpenProcessTokenEx(
+ ProcessHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ HandleAttributes: ULONG,
+ TokenHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn NtOpenThreadToken(
+ ThreadHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ OpenAsSelf: BOOLEAN,
+ TokenHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn NtOpenThreadTokenEx(
+ ThreadHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ OpenAsSelf: BOOLEAN,
+ HandleAttributes: ULONG,
+ TokenHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn NtDuplicateToken(
+ ExistingTokenHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ EffectiveOnly: BOOLEAN,
+ TokenType: TOKEN_TYPE,
+ NewTokenHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn NtQueryInformationToken(
+ TokenHandle: HANDLE,
+ TokenInformationClass: TOKEN_INFORMATION_CLASS,
+ TokenInformation: PVOID,
+ TokenInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetInformationToken(
+ TokenHandle: HANDLE,
+ TokenInformationClass: TOKEN_INFORMATION_CLASS,
+ TokenInformation: PVOID,
+ TokenInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtAdjustPrivilegesToken(
+ TokenHandle: HANDLE,
+ DisableAllPrivileges: BOOLEAN,
+ NewState: PTOKEN_PRIVILEGES,
+ BufferLength: ULONG,
+ PreviousState: PTOKEN_PRIVILEGES,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtAdjustGroupsToken(
+ TokenHandle: HANDLE,
+ ResetToDefault: BOOLEAN,
+ NewState: PTOKEN_GROUPS,
+ BufferLength: ULONG,
+ PreviousState: PTOKEN_GROUPS,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtAdjustTokenClaimsAndDeviceGroups(
+ TokenHandle: HANDLE,
+ UserResetToDefault: BOOLEAN,
+ DeviceResetToDefault: BOOLEAN,
+ DeviceGroupsResetToDefault: BOOLEAN,
+ NewUserState: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ NewDeviceState: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ NewDeviceGroupsState: PTOKEN_GROUPS,
+ UserBufferLength: ULONG,
+ PreviousUserState: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ DeviceBufferLength: ULONG,
+ PreviousDeviceState: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ DeviceGroupsBufferLength: ULONG,
+ PreviousDeviceGroups: PTOKEN_GROUPS,
+ UserReturnLength: PULONG,
+ DeviceReturnLength: PULONG,
+ DeviceGroupsReturnBufferLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtFilterToken(
+ ExistingTokenHandle: HANDLE,
+ Flags: ULONG,
+ SidsToDisable: PTOKEN_GROUPS,
+ PrivilegesToDelete: PTOKEN_PRIVILEGES,
+ RestrictedSids: PTOKEN_GROUPS,
+ NewTokenHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn NtFilterTokenEx(
+ ExistingTokenHandle: HANDLE,
+ Flags: ULONG,
+ SidsToDisable: PTOKEN_GROUPS,
+ PrivilegesToDelete: PTOKEN_PRIVILEGES,
+ RestrictedSids: PTOKEN_GROUPS,
+ DisableUserClaimsCount: ULONG,
+ UserClaimsToDisable: PUNICODE_STRING,
+ DisableDeviceClaimsCount: ULONG,
+ DeviceClaimsToDisable: PUNICODE_STRING,
+ DeviceGroupsToDisable: PTOKEN_GROUPS,
+ RestrictedUserAttributes: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ RestrictedDeviceAttributes: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ RestrictedDeviceGroups: PTOKEN_GROUPS,
+ NewTokenHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn NtCompareTokens(
+ FirstTokenHandle: HANDLE,
+ SecondTokenHandle: HANDLE,
+ Equal: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn NtPrivilegeCheck(
+ ClientToken: HANDLE,
+ RequiredPrivileges: PPRIVILEGE_SET,
+ Result: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn NtImpersonateAnonymousToken(
+ ThreadHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtQuerySecurityAttributesToken(
+ TokenHandle: HANDLE,
+ Attributes: PUNICODE_STRING,
+ NumberOfAttributes: ULONG,
+ Buffer: PVOID,
+ Length: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtAccessCheck(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ClientToken: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ GenericMapping: PGENERIC_MAPPING,
+ PrivilegeSet: PPRIVILEGE_SET,
+ PrivilegeSetLength: PULONG,
+ GrantedAccess: PACCESS_MASK,
+ AccessStatus: PNTSTATUS,
+ ) -> NTSTATUS;
+ fn NtAccessCheckByType(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ PrincipalSelfSid: PSID,
+ ClientToken: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectTypeList: POBJECT_TYPE_LIST,
+ ObjectTypeListLength: ULONG,
+ GenericMapping: PGENERIC_MAPPING,
+ PrivilegeSet: PPRIVILEGE_SET,
+ PrivilegeSetLength: PULONG,
+ GrantedAccess: PACCESS_MASK,
+ AccessStatus: PNTSTATUS,
+ ) -> NTSTATUS;
+ fn NtAccessCheckByTypeResultList(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ PrincipalSelfSid: PSID,
+ ClientToken: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectTypeList: POBJECT_TYPE_LIST,
+ ObjectTypeListLength: ULONG,
+ GenericMapping: PGENERIC_MAPPING,
+ PrivilegeSet: PPRIVILEGE_SET,
+ PrivilegeSetLength: PULONG,
+ GrantedAccess: PACCESS_MASK,
+ AccessStatus: PNTSTATUS,
+ ) -> NTSTATUS;
+ fn NtSetCachedSigningLevel(
+ Flags: ULONG,
+ InputSigningLevel: SE_SIGNING_LEVEL,
+ SourceFiles: PHANDLE,
+ SourceFileCount: ULONG,
+ TargetFile: HANDLE,
+ ) -> NTSTATUS;
+ fn NtGetCachedSigningLevel(
+ File: HANDLE,
+ Flags: PULONG,
+ SigningLevel: PSE_SIGNING_LEVEL,
+ Thumbprint: PUCHAR,
+ ThumbprintSize: PULONG,
+ ThumbprintAlgorithm: PULONG,
+ ) -> NTSTATUS;
+ fn NtAccessCheckAndAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ ObjectTypeName: PUNICODE_STRING,
+ ObjectName: PUNICODE_STRING,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ DesiredAccess: ACCESS_MASK,
+ GenericMapping: PGENERIC_MAPPING,
+ ObjectCreation: BOOLEAN,
+ GrantedAccess: PACCESS_MASK,
+ AccessStatus: PNTSTATUS,
+ GenerateOnClose: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn NtAccessCheckByTypeAndAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ ObjectTypeName: PUNICODE_STRING,
+ ObjectName: PUNICODE_STRING,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ PrincipalSelfSid: PSID,
+ DesiredAccess: ACCESS_MASK,
+ AuditType: AUDIT_EVENT_TYPE,
+ Flags: ULONG,
+ ObjectTypeList: POBJECT_TYPE_LIST,
+ ObjectTypeListLength: ULONG,
+ GenericMapping: PGENERIC_MAPPING,
+ ObjectCreation: BOOLEAN,
+ GrantedAccess: PACCESS_MASK,
+ AccessStatus: PNTSTATUS,
+ GenerateOnClose: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn NtAccessCheckByTypeResultListAndAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ ObjectTypeName: PUNICODE_STRING,
+ ObjectName: PUNICODE_STRING,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ PrincipalSelfSid: PSID,
+ DesiredAccess: ACCESS_MASK,
+ AuditType: AUDIT_EVENT_TYPE,
+ Flags: ULONG,
+ ObjectTypeList: POBJECT_TYPE_LIST,
+ ObjectTypeListLength: ULONG,
+ GenericMapping: PGENERIC_MAPPING,
+ ObjectCreation: BOOLEAN,
+ GrantedAccess: PACCESS_MASK,
+ AccessStatus: PNTSTATUS,
+ GenerateOnClose: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn NtAccessCheckByTypeResultListAndAuditAlarmByHandle(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ ClientToken: HANDLE,
+ ObjectTypeName: PUNICODE_STRING,
+ ObjectName: PUNICODE_STRING,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ PrincipalSelfSid: PSID,
+ DesiredAccess: ACCESS_MASK,
+ AuditType: AUDIT_EVENT_TYPE,
+ Flags: ULONG,
+ ObjectTypeList: POBJECT_TYPE_LIST,
+ ObjectTypeListLength: ULONG,
+ GenericMapping: PGENERIC_MAPPING,
+ ObjectCreation: BOOLEAN,
+ GrantedAccess: PACCESS_MASK,
+ AccessStatus: PNTSTATUS,
+ GenerateOnClose: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn NtOpenObjectAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ ObjectTypeName: PUNICODE_STRING,
+ ObjectName: PUNICODE_STRING,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ClientToken: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ GrantedAccess: ACCESS_MASK,
+ Privileges: PPRIVILEGE_SET,
+ ObjectCreation: BOOLEAN,
+ AccessGranted: BOOLEAN,
+ GenerateOnClose: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn NtPrivilegeObjectAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ ClientToken: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ Privileges: PPRIVILEGE_SET,
+ AccessGranted: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtCloseObjectAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ GenerateOnClose: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtDeleteObjectAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ GenerateOnClose: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtPrivilegedServiceAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ ServiceName: PUNICODE_STRING,
+ ClientToken: HANDLE,
+ Privileges: PPRIVILEGE_SET,
+ AccessGranted: BOOLEAN,
+ ) -> NTSTATUS;
+}}
diff --git a/third_party/rust/ntapi/src/ntsmss.rs b/third_party/rust/ntapi/src/ntsmss.rs
new file mode 100644
index 0000000000..b22991fb71
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntsmss.rs
@@ -0,0 +1,15 @@
+use crate::ntlpcapi::PPORT_MESSAGE;
+use winapi::shared::minwindef::DWORD;
+use winapi::shared::ntdef::{HANDLE, NTSTATUS, PHANDLE, PUNICODE_STRING};
+EXTERN!{extern "system" {
+ fn RtlConnectToSm(
+ ApiPortName: PUNICODE_STRING,
+ ApiPortHandle: HANDLE,
+ ProcessImageType: DWORD,
+ SmssConnection: PHANDLE,
+ ) -> NTSTATUS;
+ fn RtlSendMsgToSm(
+ ApiPortHandle: HANDLE,
+ MessageData: PPORT_MESSAGE,
+ ) -> NTSTATUS;
+}}
diff --git a/third_party/rust/ntapi/src/nttmapi.rs b/third_party/rust/ntapi/src/nttmapi.rs
new file mode 100644
index 0000000000..3ed499a927
--- /dev/null
+++ b/third_party/rust/ntapi/src/nttmapi.rs
@@ -0,0 +1,239 @@
+use winapi::shared::basetsd::ULONG_PTR;
+use winapi::shared::guiddef::LPGUID;
+use winapi::shared::ktmtypes::{NOTIFICATION_MASK, PCRM_PROTOCOL_ID, PTRANSACTION_NOTIFICATION};
+use winapi::shared::ntdef::{
+ BOOLEAN, HANDLE, NTSTATUS, PHANDLE, PLARGE_INTEGER, POBJECT_ATTRIBUTES, PULONG,
+ PUNICODE_STRING, PVOID, ULONG,
+};
+use winapi::um::winnt::{
+ ACCESS_MASK, ENLISTMENT_INFORMATION_CLASS, KTMOBJECT_TYPE, PKTMOBJECT_CURSOR,
+ RESOURCEMANAGER_INFORMATION_CLASS, TRANSACTIONMANAGER_INFORMATION_CLASS,
+ TRANSACTION_INFORMATION_CLASS,
+};
+EXTERN!{extern "system" {
+ fn NtCreateTransactionManager(
+ TmHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ LogFileName: PUNICODE_STRING,
+ CreateOptions: ULONG,
+ CommitStrength: ULONG,
+ ) -> NTSTATUS;
+ fn NtOpenTransactionManager(
+ TmHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ LogFileName: PUNICODE_STRING,
+ TmIdentity: LPGUID,
+ OpenOptions: ULONG,
+ ) -> NTSTATUS;
+ fn NtRenameTransactionManager(
+ LogFileName: PUNICODE_STRING,
+ ExistingTransactionManagerGuid: LPGUID,
+ ) -> NTSTATUS;
+ fn NtRollforwardTransactionManager(
+ TransactionManagerHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtRecoverTransactionManager(
+ TransactionManagerHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtQueryInformationTransactionManager(
+ TransactionManagerHandle: HANDLE,
+ TransactionManagerInformationClass: TRANSACTIONMANAGER_INFORMATION_CLASS,
+ TransactionManagerInformation: PVOID,
+ TransactionManagerInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetInformationTransactionManager(
+ TmHandle: HANDLE,
+ TransactionManagerInformationClass: TRANSACTIONMANAGER_INFORMATION_CLASS,
+ TransactionManagerInformation: PVOID,
+ TransactionManagerInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtEnumerateTransactionObject(
+ RootObjectHandle: HANDLE,
+ QueryType: KTMOBJECT_TYPE,
+ ObjectCursor: PKTMOBJECT_CURSOR,
+ ObjectCursorLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtCreateTransaction(
+ TransactionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ Uow: LPGUID,
+ TmHandle: HANDLE,
+ CreateOptions: ULONG,
+ IsolationLevel: ULONG,
+ IsolationFlags: ULONG,
+ Timeout: PLARGE_INTEGER,
+ Description: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn NtOpenTransaction(
+ TransactionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ Uow: LPGUID,
+ TmHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtQueryInformationTransaction(
+ TransactionHandle: HANDLE,
+ TransactionInformationClass: TRANSACTION_INFORMATION_CLASS,
+ TransactionInformation: PVOID,
+ TransactionInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetInformationTransaction(
+ TransactionHandle: HANDLE,
+ TransactionInformationClass: TRANSACTION_INFORMATION_CLASS,
+ TransactionInformation: PVOID,
+ TransactionInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtCommitTransaction(
+ TransactionHandle: HANDLE,
+ Wait: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtRollbackTransaction(
+ TransactionHandle: HANDLE,
+ Wait: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtCreateEnlistment(
+ EnlistmentHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ResourceManagerHandle: HANDLE,
+ TransactionHandle: HANDLE,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ CreateOptions: ULONG,
+ NotificationMask: NOTIFICATION_MASK,
+ EnlistmentKey: PVOID,
+ ) -> NTSTATUS;
+ fn NtOpenEnlistment(
+ EnlistmentHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ResourceManagerHandle: HANDLE,
+ EnlistmentGuid: LPGUID,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtQueryInformationEnlistment(
+ EnlistmentHandle: HANDLE,
+ EnlistmentInformationClass: ENLISTMENT_INFORMATION_CLASS,
+ EnlistmentInformation: PVOID,
+ EnlistmentInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetInformationEnlistment(
+ EnlistmentHandle: HANDLE,
+ EnlistmentInformationClass: ENLISTMENT_INFORMATION_CLASS,
+ EnlistmentInformation: PVOID,
+ EnlistmentInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtRecoverEnlistment(
+ EnlistmentHandle: HANDLE,
+ EnlistmentKey: PVOID,
+ ) -> NTSTATUS;
+ fn NtPrePrepareEnlistment(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtPrepareEnlistment(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtCommitEnlistment(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtRollbackEnlistment(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtPrePrepareComplete(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtPrepareComplete(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtCommitComplete(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtReadOnlyEnlistment(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtRollbackComplete(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtSinglePhaseReject(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtCreateResourceManager(
+ ResourceManagerHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ TmHandle: HANDLE,
+ RmGuid: LPGUID,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ CreateOptions: ULONG,
+ Description: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn NtOpenResourceManager(
+ ResourceManagerHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ TmHandle: HANDLE,
+ ResourceManagerGuid: LPGUID,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn NtRecoverResourceManager(
+ ResourceManagerHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn NtGetNotificationResourceManager(
+ ResourceManagerHandle: HANDLE,
+ TransactionNotification: PTRANSACTION_NOTIFICATION,
+ NotificationLength: ULONG,
+ Timeout: PLARGE_INTEGER,
+ ReturnLength: PULONG,
+ Asynchronous: ULONG,
+ AsynchronousContext: ULONG_PTR,
+ ) -> NTSTATUS;
+ fn NtQueryInformationResourceManager(
+ ResourceManagerHandle: HANDLE,
+ ResourceManagerInformationClass: RESOURCEMANAGER_INFORMATION_CLASS,
+ ResourceManagerInformation: PVOID,
+ ResourceManagerInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn NtSetInformationResourceManager(
+ ResourceManagerHandle: HANDLE,
+ ResourceManagerInformationClass: RESOURCEMANAGER_INFORMATION_CLASS,
+ ResourceManagerInformation: PVOID,
+ ResourceManagerInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn NtRegisterProtocolAddressInformation(
+ ResourceManager: HANDLE,
+ ProtocolId: PCRM_PROTOCOL_ID,
+ ProtocolInformationSize: ULONG,
+ ProtocolInformation: PVOID,
+ CreateOptions: ULONG,
+ ) -> NTSTATUS;
+ fn NtPropagationComplete(
+ ResourceManagerHandle: HANDLE,
+ RequestCookie: ULONG,
+ BufferLength: ULONG,
+ Buffer: PVOID,
+ ) -> NTSTATUS;
+ fn NtPropagationFailed(
+ ResourceManagerHandle: HANDLE,
+ RequestCookie: ULONG,
+ PropStatus: NTSTATUS,
+ ) -> NTSTATUS;
+ fn NtFreezeTransactions(
+ FreezeTimeout: PLARGE_INTEGER,
+ ThawTimeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn NtThawTransactions() -> NTSTATUS;
+}}
diff --git a/third_party/rust/ntapi/src/nttp.rs b/third_party/rust/ntapi/src/nttp.rs
new file mode 100644
index 0000000000..a41eb344ac
--- /dev/null
+++ b/third_party/rust/ntapi/src/nttp.rs
@@ -0,0 +1,207 @@
+use crate::ntioapi::PIO_STATUS_BLOCK;
+use winapi::shared::ntdef::{HANDLE, LOGICAL, LONG, NTSTATUS, PLARGE_INTEGER, PVOID};
+use winapi::um::winnt::{
+ PRTL_CRITICAL_SECTION, PTP_CALLBACK_ENVIRON, PTP_CALLBACK_INSTANCE, PTP_CLEANUP_GROUP, PTP_IO,
+ PTP_POOL, PTP_POOL_STACK_INFORMATION, PTP_SIMPLE_CALLBACK, PTP_TIMER, PTP_TIMER_CALLBACK,
+ PTP_WAIT, PTP_WAIT_CALLBACK, PTP_WORK, PTP_WORK_CALLBACK,
+};
+#[repr(C)]
+pub struct TP_ALPC([u8; 0]);
+pub type PTP_ALPC = *mut TP_ALPC;
+FN!{stdcall PTP_ALPC_CALLBACK(
+ Instance: PTP_CALLBACK_INSTANCE,
+ Context: PVOID,
+ Alpc: PTP_ALPC,
+) -> ()}
+FN!{stdcall PTP_ALPC_CALLBACK_EX(
+ Instanc: PTP_CALLBACK_INSTANCE,
+ Contex: PVOID,
+ Alp: PTP_ALPC,
+ ApcContext: PVOID,
+) -> ()}
+EXTERN!{extern "system" {
+ fn TpAllocPool(
+ PoolReturn: *mut PTP_POOL,
+ Reserved: PVOID,
+ ) -> NTSTATUS;
+ fn TpReleasePool(
+ Pool: PTP_POOL,
+ );
+ fn TpSetPoolMaxThreads(
+ Pool: PTP_POOL,
+ MaxThreads: LONG,
+ );
+ fn TpSetPoolMinThreads(
+ Pool: PTP_POOL,
+ MinThreads: LONG,
+ ) -> NTSTATUS;
+ fn TpQueryPoolStackInformation(
+ Pool: PTP_POOL,
+ PoolStackInformation: PTP_POOL_STACK_INFORMATION,
+ ) -> NTSTATUS;
+ fn TpSetPoolStackInformation(
+ Pool: PTP_POOL,
+ PoolStackInformation: PTP_POOL_STACK_INFORMATION,
+ ) -> NTSTATUS;
+ fn TpAllocCleanupGroup(
+ CleanupGroupReturn: *mut PTP_CLEANUP_GROUP,
+ ) -> NTSTATUS;
+ fn TpReleaseCleanupGroup(
+ CleanupGroup: PTP_CLEANUP_GROUP,
+ );
+ fn TpReleaseCleanupGroupMembers(
+ CleanupGroup: PTP_CLEANUP_GROUP,
+ CancelPendingCallbacks: LOGICAL,
+ CleanupParameter: PVOID,
+ );
+ fn TpCallbackSetEventOnCompletion(
+ Instance: PTP_CALLBACK_INSTANCE,
+ Event: HANDLE,
+ );
+ fn TpCallbackReleaseSemaphoreOnCompletion(
+ Instance: PTP_CALLBACK_INSTANCE,
+ Semaphore: HANDLE,
+ ReleaseCount: LONG,
+ );
+ fn TpCallbackReleaseMutexOnCompletion(
+ Instance: PTP_CALLBACK_INSTANCE,
+ Mutex: HANDLE,
+ );
+ fn TpCallbackLeaveCriticalSectionOnCompletion(
+ Instance: PTP_CALLBACK_INSTANCE,
+ CriticalSection: PRTL_CRITICAL_SECTION,
+ );
+ fn TpCallbackUnloadDllOnCompletion(
+ Instance: PTP_CALLBACK_INSTANCE,
+ DllHandle: PVOID,
+ );
+ fn TpCallbackMayRunLong(
+ Instance: PTP_CALLBACK_INSTANCE,
+ ) -> NTSTATUS;
+ fn TpDisassociateCallback(
+ Instance: PTP_CALLBACK_INSTANCE,
+ );
+ fn TpSimpleTryPost(
+ Callback: PTP_SIMPLE_CALLBACK,
+ Context: PVOID,
+ CallbackEnviron: PTP_CALLBACK_ENVIRON,
+ ) -> NTSTATUS;
+ fn TpAllocWork(
+ WorkReturn: *mut PTP_WORK,
+ Callback: PTP_WORK_CALLBACK,
+ Context: PVOID,
+ CallbackEnviron: PTP_CALLBACK_ENVIRON,
+ ) -> NTSTATUS;
+ fn TpReleaseWork(
+ Work: PTP_WORK,
+ );
+ fn TpPostWork(
+ Work: PTP_WORK,
+ );
+ fn TpWaitForWork(
+ Work: PTP_WORK,
+ CancelPendingCallbacks: LOGICAL,
+ );
+ fn TpAllocTimer(
+ Timer: *mut PTP_TIMER,
+ Callback: PTP_TIMER_CALLBACK,
+ Context: PVOID,
+ CallbackEnviron: PTP_CALLBACK_ENVIRON,
+ ) -> NTSTATUS;
+ fn TpReleaseTimer(
+ Timer: PTP_TIMER,
+ );
+ fn TpSetTimer(
+ Timer: PTP_TIMER,
+ DueTime: PLARGE_INTEGER,
+ Period: LONG,
+ WindowLength: LONG,
+ );
+ fn TpIsTimerSet(
+ Timer: PTP_TIMER,
+ ) -> LOGICAL;
+ fn TpWaitForTimer(
+ Timer: PTP_TIMER,
+ CancelPendingCallbacks: LOGICAL,
+ );
+ fn TpAllocWait(
+ WaitReturn: *mut PTP_WAIT,
+ Callback: PTP_WAIT_CALLBACK,
+ Context: PVOID,
+ CallbackEnviron: PTP_CALLBACK_ENVIRON,
+ ) -> NTSTATUS;
+ fn TpReleaseWait(
+ Wait: PTP_WAIT,
+ );
+ fn TpSetWait(
+ Wait: PTP_WAIT,
+ Handle: HANDLE,
+ Timeout: PLARGE_INTEGER,
+ );
+ fn TpWaitForWait(
+ Wait: PTP_WAIT,
+ CancelPendingCallbacks: LOGICAL,
+ );
+}}
+FN!{stdcall PTP_IO_CALLBACK(
+ Instance: PTP_CALLBACK_INSTANCE,
+ Context: PVOID,
+ ApcContext: PVOID,
+ IoSB: PIO_STATUS_BLOCK,
+ Io: PTP_IO,
+) -> ()}
+EXTERN!{extern "system" {
+ fn TpAllocIoCompletion(
+ IoReturn: *mut PTP_IO,
+ File: HANDLE,
+ Callback: PTP_IO_CALLBACK,
+ Context: PVOID,
+ CallbackEnviron: PTP_CALLBACK_ENVIRON,
+ ) -> NTSTATUS;
+ fn TpReleaseIoCompletion(
+ Io: PTP_IO,
+ );
+ fn TpStartAsyncIoOperation(
+ Io: PTP_IO,
+ );
+ fn TpCancelAsyncIoOperation(
+ Io: PTP_IO,
+ );
+ fn TpWaitForIoCompletion(
+ Io: PTP_IO,
+ CancelPendingCallbacks: LOGICAL,
+ );
+ fn TpAllocAlpcCompletion(
+ AlpcReturn: *mut PTP_ALPC,
+ AlpcPort: HANDLE,
+ Callback: PTP_ALPC_CALLBACK,
+ Context: PVOID,
+ CallbackEnviron: PTP_CALLBACK_ENVIRON,
+ ) -> NTSTATUS;
+ fn TpAllocAlpcCompletionEx(
+ AlpcReturn: *mut PTP_ALPC,
+ AlpcPort: HANDLE,
+ Callback: PTP_ALPC_CALLBACK_EX,
+ Context: PVOID,
+ CallbackEnviron: PTP_CALLBACK_ENVIRON,
+ ) -> NTSTATUS;
+ fn TpReleaseAlpcCompletion(
+ Alpc: PTP_ALPC,
+ );
+ fn TpWaitForAlpcCompletion(
+ Alpc: PTP_ALPC,
+ );
+}}
+ENUM!{enum TP_TRACE_TYPE {
+ TpTraceThreadPriority = 1,
+ TpTraceThreadAffinity = 2,
+ MaxTpTraceType = 3,
+}}
+EXTERN!{extern "system" {
+ fn TpCaptureCaller(
+ Type: TP_TRACE_TYPE,
+ );
+ fn TpCheckTerminateWorker(
+ Thread: HANDLE,
+ );
+}}
diff --git a/third_party/rust/ntapi/src/ntwow64.rs b/third_party/rust/ntapi/src/ntwow64.rs
new file mode 100644
index 0000000000..9a95ae2aea
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntwow64.rs
@@ -0,0 +1,476 @@
+use core::mem::size_of;
+use crate::ntapi_base::CLIENT_ID32;
+use crate::ntldr::{LDR_DDAG_STATE, LDR_DLL_LOAD_REASON};
+use crate::ntpsapi::GDI_HANDLE_BUFFER32;
+use crate::ntrtl::RTL_MAX_DRIVE_LETTERS;
+use crate::string::{UTF16Const, UTF8Const};
+use winapi::shared::guiddef::GUID;
+use winapi::shared::ntdef::{
+ BOOLEAN, CHAR, LARGE_INTEGER, LCID, LIST_ENTRY32, LONG, NTSTATUS, PROCESSOR_NUMBER,
+ SINGLE_LIST_ENTRY32, STRING32, UCHAR, ULARGE_INTEGER, ULONG, ULONGLONG, UNICODE_STRING,
+ UNICODE_STRING32, USHORT, WCHAR,
+};
+use winapi::um::winnt::{FLS_MAXIMUM_AVAILABLE, NT_TIB32};
+pub const WOW64_SYSTEM_DIRECTORY: UTF8Const = UTF8Const("SysWOW64\0");
+/// "SysWOW64"
+pub const WOW64_SYSTEM_DIRECTORY_U: UTF16Const = UTF16Const(&[
+ 0x0053, 0x0079, 0x0073, 0x0057, 0x004F, 0x0057, 0x0036, 0x0034, 0u16,
+]);
+pub const WOW64_X86_TAG: UTF8Const = UTF8Const(" (x86)\0");
+/// " (x86)"
+pub const WOW64_X86_TAG_U: UTF16Const = UTF16Const(&[
+ 0x0020, 0x0028, 0x0078, 0x0038, 0x0036, 0x0029, 0u16,
+]);
+ENUM!{enum WOW64_SHARED_INFORMATION {
+ SharedNtdll32LdrInitializeThunk = 0,
+ SharedNtdll32KiUserExceptionDispatcher = 1,
+ SharedNtdll32KiUserApcDispatcher = 2,
+ SharedNtdll32KiUserCallbackDispatcher = 3,
+ SharedNtdll32ExpInterlockedPopEntrySListFault = 4,
+ SharedNtdll32ExpInterlockedPopEntrySListResume = 5,
+ SharedNtdll32ExpInterlockedPopEntrySListEnd = 6,
+ SharedNtdll32RtlUserThreadStart = 7,
+ SharedNtdll32pQueryProcessDebugInformationRemote = 8,
+ SharedNtdll32BaseAddress = 9,
+ SharedNtdll32LdrSystemDllInitBlock = 10,
+ Wow64SharedPageEntriesCount = 11,
+}}
+STRUCT!{struct RTL_BALANCED_NODE32_u_s {
+ Left: ULONG, // WOW64_POINTER
+ Right: ULONG, // WOW64_POINTER
+}}
+UNION!{union RTL_BALANCED_NODE32_u {
+ Children: [ULONG; 2], // WOW64_POINTER
+ s: RTL_BALANCED_NODE32_u_s,
+}}
+STRUCT!{struct RTL_BALANCED_NODE32 {
+ u: RTL_BALANCED_NODE32_u,
+ ParentValue: ULONG,
+}}
+pub type PRTL_BALANCED_NODE32 = *mut RTL_BALANCED_NODE32;
+STRUCT!{struct RTL_RB_TREE32 {
+ Root: ULONG, // WOW64_POINTER
+ Min: ULONG, // WOW64_POINTER
+}}
+pub type PRTL_RB_TREE32 = *mut RTL_RB_TREE32;
+STRUCT!{struct PEB_LDR_DATA32 {
+ Length: ULONG,
+ Initialized: BOOLEAN,
+ SsHandle: ULONG,
+ InLoadOrderModuleList: LIST_ENTRY32,
+ InMemoryOrderModuleList: LIST_ENTRY32,
+ InInitializationOrderModuleList: LIST_ENTRY32,
+ EntryInProgress: ULONG,
+ ShutdownInProgress: BOOLEAN,
+ ShutdownThreadId: ULONG,
+}}
+pub type PPEB_LDR_DATA32 = *mut PEB_LDR_DATA32;
+STRUCT!{struct LDR_SERVICE_TAG_RECORD32 {
+ Next: ULONG,
+ ServiceTag: ULONG,
+}}
+pub type PLDR_SERVICE_TAG_RECORD32 = *mut LDR_SERVICE_TAG_RECORD32;
+STRUCT!{struct LDRP_CSLIST32 {
+ Tail: ULONG, // WOW64_POINTER
+}}
+pub type PLDRP_CSLIST32 = *mut LDRP_CSLIST32;
+UNION!{union LDR_DDAG_NODE32_u {
+ Dependencies: LDRP_CSLIST32,
+ RemovalLink: SINGLE_LIST_ENTRY32,
+}}
+STRUCT!{struct LDR_DDAG_NODE32 {
+ Modules: LIST_ENTRY32,
+ ServiceTagList: ULONG, // WOW64_POINTER
+ LoadCount: ULONG,
+ LoadWhileUnloadingCount: ULONG,
+ LowestLink: ULONG,
+ u: LDR_DDAG_NODE32_u,
+ IncomingDependencies: LDRP_CSLIST32,
+ State: LDR_DDAG_STATE,
+ CondenseLink: SINGLE_LIST_ENTRY32,
+ PreorderNumber: ULONG,
+}}
+pub type PLDR_DDAG_NODE32 = *mut LDR_DDAG_NODE32;
+pub const LDR_DATA_TABLE_ENTRY_SIZE_WINXP_32: usize = 80;
+pub const LDR_DATA_TABLE_ENTRY_SIZE_WIN7_32: usize = 144;
+pub const LDR_DATA_TABLE_ENTRY_SIZE_WIN8_32: usize = 152;
+UNION!{union LDR_DATA_TABLE_ENTRY32_u1 {
+ InInitializationOrderLinks: LIST_ENTRY32,
+ InProgressLinks: LIST_ENTRY32,
+}}
+UNION!{union LDR_DATA_TABLE_ENTRY32_u2 {
+ FlagGroup: [UCHAR; 4],
+ Flags: ULONG,
+}}
+STRUCT!{struct LDR_DATA_TABLE_ENTRY32 {
+ InLoadOrderLinks: LIST_ENTRY32,
+ InMemoryOrderLinks: LIST_ENTRY32,
+ u1: LDR_DATA_TABLE_ENTRY32_u1,
+ DllBase: ULONG, // WOW64_POINTER
+ EntryPoint: ULONG, // WOW64_POINTER
+ SizeOfImage: ULONG,
+ FullDllName: UNICODE_STRING32,
+ BaseDllName: UNICODE_STRING32,
+ u2: LDR_DATA_TABLE_ENTRY32_u2,
+ ObsoleteLoadCount: USHORT,
+ TlsIndex: USHORT,
+ HashLinks: LIST_ENTRY32,
+ TimeDateStamp: ULONG,
+ EntryPointActivationContext: ULONG, // WOW64_POINTER
+ Lock: ULONG, // WOW64_POINTER
+ DdagNode: ULONG, // WOW64_POINTER
+ NodeModuleLink: LIST_ENTRY32,
+ LoadContext: ULONG, // WOW64_POINTER
+ ParentDllBase: ULONG, // WOW64_POINTER
+ SwitchBackContext: ULONG, // WOW64_POINTER
+ BaseAddressIndexNode: RTL_BALANCED_NODE32,
+ MappingInfoIndexNode: RTL_BALANCED_NODE32,
+ OriginalBase: ULONG,
+ LoadTime: LARGE_INTEGER,
+ BaseNameHashValue: ULONG,
+ LoadReason: LDR_DLL_LOAD_REASON,
+ ImplicitPathOptions: ULONG,
+ ReferenceCount: ULONG,
+ DependentLoadFlags: ULONG,
+ SigningLevel: UCHAR,
+}}
+BITFIELD!{unsafe LDR_DATA_TABLE_ENTRY32_u2 Flags: ULONG [
+ PackagedBinary set_PackagedBinary[0..1],
+ MarkedForRemoval set_MarkedForRemoval[1..2],
+ ImageDll set_ImageDll[2..3],
+ LoadNotificationsSent set_LoadNotificationsSent[3..4],
+ TelemetryEntryProcessed set_TelemetryEntryProcessed[4..5],
+ ProcessStaticImport set_ProcessStaticImport[5..6],
+ InLegacyLists set_InLegacyLists[6..7],
+ InIndexes set_InIndexes[7..8],
+ ShimDll set_ShimDll[8..9],
+ InExceptionTable set_InExceptionTable[9..10],
+ ReservedFlags1 set_ReservedFlags1[10..12],
+ LoadInProgress set_LoadInProgress[12..13],
+ LoadConfigProcessed set_LoadConfigProcessed[13..14],
+ EntryProcessed set_EntryProcessed[14..15],
+ ProtectDelayLoad set_ProtectDelayLoad[15..16],
+ ReservedFlags3 set_ReservedFlags3[16..18],
+ DontCallForThreads set_DontCallForThreads[18..19],
+ ProcessAttachCalled set_ProcessAttachCalled[19..20],
+ ProcessAttachFailed set_ProcessAttachFailed[20..21],
+ CorDeferredValidate set_CorDeferredValidate[21..22],
+ CorImage set_CorImage[22..23],
+ DontRelocate set_DontRelocate[23..24],
+ CorILOnly set_CorILOnly[24..25],
+ ReservedFlags5 set_ReservedFlags5[25..28],
+ Redirected set_Redirected[28..29],
+ ReservedFlags6 set_ReservedFlags6[29..31],
+ CompatDatabaseProcessed set_CompatDatabaseProcessed[31..32],
+]}
+pub type PLDR_DATA_TABLE_ENTRY32 = *mut LDR_DATA_TABLE_ENTRY32;
+STRUCT!{struct CURDIR32 {
+ DosPath: UNICODE_STRING32,
+ Handle: ULONG, // WOW64_POINTER
+}}
+pub type PCURDIR32 = *mut CURDIR32;
+STRUCT!{struct RTL_DRIVE_LETTER_CURDIR32 {
+ Flags: USHORT,
+ Length: USHORT,
+ TimeStamp: ULONG,
+ DosPath: STRING32,
+}}
+pub type PRTL_DRIVE_LETTER_CURDIR32 = *mut RTL_DRIVE_LETTER_CURDIR32;
+STRUCT!{struct RTL_USER_PROCESS_PARAMETERS32 {
+ MaximumLength: ULONG,
+ Length: ULONG,
+ Flags: ULONG,
+ DebugFlags: ULONG,
+ ConsoleHandle: ULONG, // WOW64_POINTER
+ ConsoleFlags: ULONG,
+ StandardInput: ULONG, // WOW64_POINTER
+ StandardOutput: ULONG, // WOW64_POINTER
+ StandardError: ULONG, // WOW64_POINTER
+ CurrentDirectory: CURDIR32,
+ DllPath: UNICODE_STRING32,
+ ImagePathName: UNICODE_STRING32,
+ CommandLine: UNICODE_STRING32,
+ Environment: ULONG, // WOW64_POINTER
+ StartingX: ULONG,
+ StartingY: ULONG,
+ CountX: ULONG,
+ CountY: ULONG,
+ CountCharsX: ULONG,
+ CountCharsY: ULONG,
+ FillAttribute: ULONG,
+ WindowFlags: ULONG,
+ ShowWindowFlags: ULONG,
+ WindowTitle: UNICODE_STRING32,
+ DesktopInfo: UNICODE_STRING32,
+ ShellInfo: UNICODE_STRING32,
+ RuntimeData: UNICODE_STRING32,
+ CurrentDirectories: [RTL_DRIVE_LETTER_CURDIR32; RTL_MAX_DRIVE_LETTERS],
+ EnvironmentSize: ULONG,
+ EnvironmentVersion: ULONG,
+ PackageDependencyData: ULONG, // WOW64_POINTER
+ ProcessGroupId: ULONG,
+ LoaderThreads: ULONG,
+}}
+pub type PRTL_USER_PROCESS_PARAMETERS32 = *mut RTL_USER_PROCESS_PARAMETERS32;
+UNION!{union PEB32_u {
+ KernelCallbackTable: ULONG, // WOW64_POINTER
+ UserSharedInfoPtr: ULONG, // WOW64_POINTER
+}}
+STRUCT!{struct PEB32 {
+ InheritedAddressSpace: BOOLEAN,
+ ReadImageFileExecOptions: BOOLEAN,
+ BeingDebugged: BOOLEAN,
+ BitField: BOOLEAN,
+ Mutant: ULONG, // WOW64_POINTER
+ ImageBaseAddress: ULONG, // WOW64_POINTER
+ Ldr: ULONG, // WOW64_POINTER
+ ProcessParameters: ULONG, // WOW64_POINTER
+ SubSystemData: ULONG, // WOW64_POINTER
+ ProcessHeap: ULONG, // WOW64_POINTER
+ FastPebLock: ULONG, // WOW64_POINTER
+ AtlThunkSListPtr: ULONG, // WOW64_POINTER
+ IFEOKey: ULONG, // WOW64_POINTER
+ CrossProcessFlags: ULONG,
+ u: PEB32_u,
+ SystemReserved: [ULONG; 1],
+ AtlThunkSListPtr32: ULONG,
+ ApiSetMap: ULONG, // WOW64_POINTER
+ TlsExpansionCounter: ULONG,
+ TlsBitmap: ULONG, // WOW64_POINTER
+ TlsBitmapBits: [ULONG; 2],
+ ReadOnlySharedMemoryBase: ULONG, // WOW64_POINTER
+ HotpatchInformation: ULONG, // WOW64_POINTER
+ ReadOnlyStaticServerData: ULONG, // WOW64_POINTER
+ AnsiCodePageData: ULONG, // WOW64_POINTER
+ OemCodePageData: ULONG, // WOW64_POINTER
+ UnicodeCaseTableData: ULONG, // WOW64_POINTER
+ NumberOfProcessors: ULONG,
+ NtGlobalFlag: ULONG,
+ CriticalSectionTimeout: LARGE_INTEGER,
+ HeapSegmentReserve: ULONG,
+ HeapSegmentCommit: ULONG,
+ HeapDeCommitTotalFreeThreshold: ULONG,
+ HeapDeCommitFreeBlockThreshold: ULONG,
+ NumberOfHeaps: ULONG,
+ MaximumNumberOfHeaps: ULONG,
+ ProcessHeaps: ULONG, // WOW64_POINTER
+ GdiSharedHandleTable: ULONG, // WOW64_POINTER
+ ProcessStarterHelper: ULONG, // WOW64_POINTER
+ GdiDCAttributeList: ULONG,
+ LoaderLock: ULONG, // WOW64_POINTER
+ OSMajorVersion: ULONG,
+ OSMinorVersion: ULONG,
+ OSBuildNumber: USHORT,
+ OSCSDVersion: USHORT,
+ OSPlatformId: ULONG,
+ ImageSubsystem: ULONG,
+ ImageSubsystemMajorVersion: ULONG,
+ ImageSubsystemMinorVersion: ULONG,
+ ActiveProcessAffinityMask: ULONG,
+ GdiHandleBuffer: GDI_HANDLE_BUFFER32,
+ PostProcessInitRoutine: ULONG, // WOW64_POINTER
+ TlsExpansionBitmap: ULONG, // WOW64_POINTER
+ TlsExpansionBitmapBits: [ULONG; 32],
+ SessionId: ULONG,
+ AppCompatFlags: ULARGE_INTEGER,
+ AppCompatFlagsUser: ULARGE_INTEGER,
+ pShimData: ULONG, // WOW64_POINTER
+ AppCompatInfo: ULONG, // WOW64_POINTER
+ CSDVersion: UNICODE_STRING32,
+ ActivationContextData: ULONG, // WOW64_POINTER
+ ProcessAssemblyStorageMap: ULONG, // WOW64_POINTER
+ SystemDefaultActivationContextData: ULONG, // WOW64_POINTER
+ SystemAssemblyStorageMap: ULONG, // WOW64_POINTER
+ MinimumStackCommit: ULONG,
+ FlsCallback: ULONG, // WOW64_POINTER
+ FlsListHead: LIST_ENTRY32,
+ FlsBitmap: ULONG, // WOW64_POINTER
+ FlsBitmapBits: [ULONG; FLS_MAXIMUM_AVAILABLE as usize / (size_of::<ULONG>() * 8)],
+ FlsHighIndex: ULONG,
+ WerRegistrationData: ULONG, // WOW64_POINTER
+ WerShipAssertPtr: ULONG, // WOW64_POINTER
+ pContextData: ULONG, // WOW64_POINTER
+ pImageHeaderHash: ULONG, // WOW64_POINTER
+ TracingFlags: ULONG,
+ CsrServerReadOnlySharedMemoryBase: ULONGLONG,
+ TppWorkerpListLock: ULONG, // WOW64_POINTER
+ TppWorkerpList: LIST_ENTRY32,
+ WaitOnAddressHashTable: [ULONG; 128], // WOW64_POINTER
+ TelemetryCoverageHeader: ULONG, // WOW64_POINTER
+ CloudFileFlags: ULONG,
+ CloudFileDiagFlags: ULONG,
+ PlaceholderCompatibilityMode: CHAR,
+ PlaceholderCompatibilityModeReserved: [CHAR; 7],
+}}
+BITFIELD!{PEB32 BitField: BOOLEAN [
+ ImageUsesLargePages set_ImageUsesLargePages[0..1],
+ IsProtectedProcess set_IsProtectedProcess[1..2],
+ IsImageDynamicallyRelocated set_IsImageDynamicallyRelocated[2..3],
+ SkipPatchingUser32Forwarders set_SkipPatchingUser32Forwarders[3..4],
+ IsPackagedProcess set_IsPackagedProcess[4..5],
+ IsAppContainer set_IsAppContainer[5..6],
+ IsProtectedProcessLight set_IsProtectedProcessLight[6..7],
+ IsLongPathAwareProcess set_IsLongPathAwareProcess[7..8],
+]}
+BITFIELD!{PEB32 CrossProcessFlags: ULONG [
+ ProcessInJob set_ProcessInJob[0..1],
+ ProcessInitializing set_ProcessInitializing[1..2],
+ ProcessUsingVEH set_ProcessUsingVEH[2..3],
+ ProcessUsingVCH set_ProcessUsingVCH[3..4],
+ ProcessUsingFTH set_ProcessUsingFTH[4..5],
+ ReservedBits0 set_ReservedBits0[5..32],
+]}
+BITFIELD!{PEB32 TracingFlags: ULONG [
+ HeapTracingEnabled set_HeapTracingEnabled[0..1],
+ CritSecTracingEnabled set_CritSecTracingEnabled[1..2],
+ LibLoaderTracingEnabled set_LibLoaderTracingEnabled[2..3],
+ SpareTracingBits set_SpareTracingBits[3..32],
+]}
+pub type PPEB32 = *mut PEB32;
+pub const GDI_BATCH_BUFFER_SIZE: usize = 310;
+STRUCT!{struct GDI_TEB_BATCH32 {
+ Offset: ULONG,
+ HDC: ULONG,
+ Buffer: [ULONG; GDI_BATCH_BUFFER_SIZE],
+}}
+pub type PGDI_TEB_BATCH32 = *mut GDI_TEB_BATCH32;
+STRUCT!{struct TEB32_u_s {
+ ReservedPad0: UCHAR,
+ ReservedPad1: UCHAR,
+ ReservedPad2: UCHAR,
+ IdealProcessor: UCHAR,
+}}
+UNION!{union TEB32_u {
+ CurrentIdealProcessor: PROCESSOR_NUMBER,
+ IdealProcessorValue: ULONG,
+ s: TEB32_u_s,
+}}
+STRUCT!{struct TEB32 {
+ NtTib: NT_TIB32,
+ EnvironmentPointer: ULONG, // WOW64_POINTER
+ ClientId: CLIENT_ID32,
+ ActiveRpcHandle: ULONG, // WOW64_POINTER
+ ThreadLocalStoragePointer: ULONG, // WOW64_POINTER
+ ProcessEnvironmentBlock: ULONG, // WOW64_POINTER
+ LastErrorValue: ULONG,
+ CountOfOwnedCriticalSections: ULONG,
+ CsrClientThread: ULONG, // WOW64_POINTER
+ Win32ThreadInfo: ULONG, // WOW64_POINTER
+ User32Reserved: [ULONG; 26],
+ UserReserved: [ULONG; 5],
+ WOW32Reserved: ULONG, // WOW64_POINTER
+ CurrentLocale: LCID,
+ FpSoftwareStatusRegister: ULONG,
+ ReservedForDebuggerInstrumentation: [ULONG; 16], // WOW64_POINTER
+ SystemReserved1: [ULONG; 36], // WOW64_POINTER
+ WorkingOnBehalfTicket: [UCHAR; 8],
+ ExceptionCode: NTSTATUS,
+ ActivationContextStackPointer: ULONG, // WOW64_POINTER
+ InstrumentationCallbackSp: ULONG,
+ InstrumentationCallbackPreviousPc: ULONG,
+ InstrumentationCallbackPreviousSp: ULONG,
+ InstrumentationCallbackDisabled: BOOLEAN,
+ SpareBytes: [UCHAR; 23],
+ TxFsContext: ULONG,
+ GdiTebBatch: GDI_TEB_BATCH32,
+ RealClientId: CLIENT_ID32,
+ GdiCachedProcessHandle: ULONG, // WOW64_POINTER
+ GdiClientPID: ULONG,
+ GdiClientTID: ULONG,
+ GdiThreadLocalInfo: ULONG, // WOW64_POINTER
+ Win32ClientInfo: [ULONG; 62],
+ glDispatchTable: [ULONG; 233], // WOW64_POINTER
+ glReserved1: [ULONG; 29], // WOW64_POINTER
+ glReserved2: ULONG, // WOW64_POINTER
+ glSectionInfo: ULONG, // WOW64_POINTER
+ glSection: ULONG, // WOW64_POINTER
+ glTable: ULONG, // WOW64_POINTER
+ glCurrentRC: ULONG, // WOW64_POINTER
+ glContext: ULONG, // WOW64_POINTER
+ LastStatusValue: NTSTATUS,
+ StaticUnicodeString: UNICODE_STRING32,
+ StaticUnicodeBuffer: [WCHAR; 261],
+ DeallocationStack: ULONG, // WOW64_POINTER
+ TlsSlots: [ULONG; 64], // WOW64_POINTER
+ TlsLinks: LIST_ENTRY32,
+ Vdm: ULONG, // WOW64_POINTER
+ ReservedForNtRpc: ULONG, // WOW64_POINTER
+ DbgSsReserved: [ULONG; 2], // WOW64_POINTER
+ HardErrorMode: ULONG,
+ Instrumentation: [ULONG; 9], // WOW64_POINTER
+ ActivityId: GUID,
+ SubProcessTag: ULONG, // WOW64_POINTER
+ PerflibData: ULONG, // WOW64_POINTER
+ EtwTraceData: ULONG, // WOW64_POINTER
+ WinSockData: ULONG, // WOW64_POINTER
+ GdiBatchCount: ULONG,
+ u: TEB32_u,
+ GuaranteedStackBytes: ULONG,
+ ReservedForPerf: ULONG, // WOW64_POINTER
+ ReservedForOle: ULONG, // WOW64_POINTER
+ WaitingOnLoaderLock: ULONG,
+ SavedPriorityState: ULONG, // WOW64_POINTER
+ ReservedForCodeCoverage: ULONG,
+ ThreadPoolData: ULONG, // WOW64_POINTER
+ TlsExpansionSlots: ULONG, // WOW64_POINTER
+ MuiGeneration: ULONG,
+ IsImpersonating: ULONG,
+ NlsCache: ULONG, // WOW64_POINTER
+ pShimData: ULONG, // WOW64_POINTER
+ HeapVirtualAffinity: USHORT,
+ LowFragHeapDataSlot: USHORT,
+ CurrentTransactionHandle: ULONG, // WOW64_POINTER
+ ActiveFrame: ULONG, // WOW64_POINTER
+ FlsData: ULONG, // WOW64_POINTER
+ PreferredLanguages: ULONG, // WOW64_POINTER
+ UserPrefLanguages: ULONG, // WOW64_POINTER
+ MergedPrefLanguages: ULONG, // WOW64_POINTER
+ MuiImpersonation: ULONG,
+ CrossTebFlags: USHORT,
+ SameTebFlags: USHORT,
+ TxnScopeEnterCallback: ULONG, // WOW64_POINTER
+ TxnScopeExitCallback: ULONG, // WOW64_POINTER
+ TxnScopeContext: ULONG, // WOW64_POINTER
+ LockCount: ULONG,
+ WowTebOffset: LONG,
+ ResourceRetValue: ULONG, // WOW64_POINTER
+ ReservedForWdf: ULONG, // WOW64_POINTER
+ ReservedForCrt: ULONGLONG,
+ EffectiveContainerId: GUID,
+}}
+BITFIELD!{TEB32 SameTebFlags: USHORT [
+ SafeThunkCall set_SafeThunkCall[0..1],
+ InDebugPrint set_InDebugPrint[1..2],
+ HasFiberData set_HasFiberData[2..3],
+ SkipThreadAttach set_SkipThreadAttach[3..4],
+ WerInShipAssertCode set_WerInShipAssertCode[4..5],
+ RanProcessInit set_RanProcessInit[5..6],
+ ClonedThread set_ClonedThread[6..7],
+ SuppressDebugMsg set_SuppressDebugMsg[7..8],
+ DisableUserStackWalk set_DisableUserStackWalk[8..9],
+ RtlExceptionAttached set_RtlExceptionAttached[9..10],
+ InitialThread set_InitialThread[10..11],
+ SessionAware set_SessionAware[11..12],
+ LoadOwner set_LoadOwner[12..13],
+ LoaderWorker set_LoaderWorker[13..14],
+ SpareSameTebBits set_SpareSameTebBits[14..16],
+]}
+pub type PTEB32 = *mut TEB32;
+#[inline]
+pub fn UStr32ToUStr(
+ Destination: &mut UNICODE_STRING,
+ Source: &UNICODE_STRING32,
+) {
+ Destination.Length = Source.Length;
+ Destination.MaximumLength = Source.MaximumLength;
+ Destination.Buffer = Source.Buffer as *mut u16;
+}
+#[inline]
+pub fn UStrToUStr32(
+ Destination: &mut UNICODE_STRING32,
+ Source: &UNICODE_STRING,
+) {
+ Destination.Length = Source.Length;
+ Destination.MaximumLength = Source.MaximumLength;
+ Destination.Buffer = Source.Buffer as u32;
+}
diff --git a/third_party/rust/ntapi/src/ntxcapi.rs b/third_party/rust/ntapi/src/ntxcapi.rs
new file mode 100644
index 0000000000..56644dd512
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntxcapi.rs
@@ -0,0 +1,29 @@
+use winapi::shared::ntdef::{BOOLEAN, NTSTATUS, PSTR, PVOID, ULONG};
+use winapi::um::winnt::{PCONTEXT, PEXCEPTION_RECORD};
+EXTERN!{extern "system" {
+ fn RtlDispatchException(
+ ExceptionRecord: PEXCEPTION_RECORD,
+ ContextRecord: PCONTEXT,
+ ) -> BOOLEAN;
+ fn RtlRaiseStatus(
+ Status: NTSTATUS,
+ );
+ fn RtlRaiseException(
+ ExceptionRecord: PEXCEPTION_RECORD,
+ );
+ fn NtContinue(
+ ContextRecord: PCONTEXT,
+ TestAlert: BOOLEAN,
+ ) -> NTSTATUS;
+ fn NtRaiseException(
+ ExceptionRecord: PEXCEPTION_RECORD,
+ ContextRecord: PCONTEXT,
+ FirstChance: BOOLEAN,
+ ) -> NTSTATUS;
+ fn RtlAssert(
+ VoidFailedAssertion: PVOID,
+ VoidFileName: PVOID,
+ LineNumber: ULONG,
+ MutableMessage: PSTR,
+ );
+}}
diff --git a/third_party/rust/ntapi/src/ntzwapi.rs b/third_party/rust/ntapi/src/ntzwapi.rs
new file mode 100644
index 0000000000..9638bf836a
--- /dev/null
+++ b/third_party/rust/ntapi/src/ntzwapi.rs
@@ -0,0 +1,2699 @@
+use crate::ntapi_base::{PCLIENT_ID, PRTL_ATOM, RTL_ATOM};
+use crate::ntdbg::DEBUGOBJECTINFOCLASS;
+use crate::ntexapi::{
+ ATOM_INFORMATION_CLASS, EVENT_INFORMATION_CLASS, MUTANT_INFORMATION_CLASS, PBOOT_ENTRY,
+ PBOOT_OPTIONS, PCWNF_TYPE_ID, PEFI_DRIVER_ENTRY, PFILE_PATH, PT2_CANCEL_PARAMETERS,
+ PT2_SET_PARAMETERS, PTIMER_APC_ROUTINE, PWNF_CHANGE_STAMP, PWNF_DELIVERY_DESCRIPTOR,
+ SEMAPHORE_INFORMATION_CLASS, SHUTDOWN_ACTION, SYSDBG_COMMAND, SYSTEM_INFORMATION_CLASS,
+ TIMER_INFORMATION_CLASS, TIMER_SET_INFORMATION_CLASS, WNF_CHANGE_STAMP, WNF_DATA_SCOPE,
+ WNF_STATE_NAME_INFORMATION, WNF_STATE_NAME_LIFETIME, WORKERFACTORYINFOCLASS,
+};
+use crate::ntioapi::{
+ FILE_INFORMATION_CLASS, FILE_IO_COMPLETION_INFORMATION, FS_INFORMATION_CLASS,
+ IO_COMPLETION_INFORMATION_CLASS, IO_SESSION_EVENT, IO_SESSION_STATE, PFILE_BASIC_INFORMATION,
+ PFILE_IO_COMPLETION_INFORMATION, PFILE_NETWORK_OPEN_INFORMATION, PIO_APC_ROUTINE,
+ PIO_STATUS_BLOCK,
+};
+use crate::ntkeapi::KPROFILE_SOURCE;
+use crate::ntlpcapi::{
+ ALPC_HANDLE, ALPC_MESSAGE_INFORMATION_CLASS, ALPC_PORT_INFORMATION_CLASS, PALPC_CONTEXT_ATTR,
+ PALPC_DATA_VIEW_ATTR, PALPC_HANDLE, PALPC_MESSAGE_ATTRIBUTES, PALPC_PORT_ATTRIBUTES,
+ PALPC_SECURITY_ATTR, PORT_INFORMATION_CLASS, PPORT_MESSAGE, PPORT_VIEW, PREMOTE_PORT_VIEW,
+};
+use crate::ntmisc::VDMSERVICECLASS;
+use crate::ntmmapi::{
+ MEMORY_INFORMATION_CLASS, MEMORY_PARTITION_INFORMATION_CLASS, PMEMORY_RANGE_ENTRY,
+ SECTION_INFORMATION_CLASS, SECTION_INHERIT, VIRTUAL_MEMORY_INFORMATION_CLASS,
+};
+use crate::ntobapi::OBJECT_INFORMATION_CLASS;
+use crate::ntpnpapi::{PLUGPLAY_CONTROL_CLASS, PPLUGPLAY_EVENT_BLOCK};
+use crate::ntpsapi::{
+ MEMORY_RESERVE_TYPE, PINITIAL_TEB, PPS_APC_ROUTINE, PPS_ATTRIBUTE_LIST, PPS_CREATE_INFO,
+ PROCESSINFOCLASS, THREADINFOCLASS,
+};
+use crate::ntregapi::{
+ KEY_INFORMATION_CLASS, KEY_SET_INFORMATION_CLASS, KEY_VALUE_INFORMATION_CLASS,
+ PKEY_VALUE_ENTRY,
+};
+use crate::ntseapi::PTOKEN_SECURITY_ATTRIBUTES_INFORMATION;
+use winapi::shared::basetsd::{
+ KAFFINITY, PSIZE_T, PULONG64, PULONG_PTR, SIZE_T, ULONG64, ULONG_PTR,
+};
+use winapi::shared::guiddef::LPGUID;
+use winapi::shared::ktmtypes::{NOTIFICATION_MASK, PCRM_PROTOCOL_ID, PTRANSACTION_NOTIFICATION};
+use winapi::shared::ntdef::{
+ BOOLEAN, EVENT_TYPE, HANDLE, LANGID, LCID, LOGICAL, LONG, NTSTATUS, OBJECT_ATTRIBUTES,
+ PBOOLEAN, PCHAR, PCWNF_STATE_NAME, PGROUP_AFFINITY, PHANDLE, PLARGE_INTEGER, PLCID, PLONG,
+ PLUID, PNTSTATUS, POBJECT_ATTRIBUTES, PUCHAR, PULARGE_INTEGER, PULONG, PULONGLONG,
+ PUNICODE_STRING, PUSHORT, PVOID, PWNF_STATE_NAME, PWSTR, TIMER_TYPE, ULONG, USHORT, VOID,
+ WAIT_TYPE,
+};
+use winapi::um::winnt::{
+ ACCESS_MASK, AUDIT_EVENT_TYPE, ENLISTMENT_INFORMATION_CLASS, EXECUTION_STATE,
+ JOBOBJECTINFOCLASS, KTMOBJECT_TYPE, LATENCY_TIME, PACCESS_MASK, PCONTEXT, PDEVICE_POWER_STATE,
+ PEXCEPTION_RECORD, PFILE_SEGMENT_ELEMENT, PGENERIC_MAPPING, PJOB_SET_ARRAY, PKTMOBJECT_CURSOR,
+ POBJECT_TYPE_LIST, POWER_ACTION, POWER_INFORMATION_LEVEL, PPRIVILEGE_SET, PSECURITY_DESCRIPTOR,
+ PSECURITY_QUALITY_OF_SERVICE, PSE_SIGNING_LEVEL, PSID, PSID_AND_ATTRIBUTES,
+ PTOKEN_DEFAULT_DACL, PTOKEN_GROUPS, PTOKEN_MANDATORY_POLICY, PTOKEN_OWNER,
+ PTOKEN_PRIMARY_GROUP, PTOKEN_PRIVILEGES, PTOKEN_SOURCE, PTOKEN_USER,
+ RESOURCEMANAGER_INFORMATION_CLASS, SECURITY_INFORMATION, SE_SIGNING_LEVEL, SYSTEM_POWER_STATE,
+ TOKEN_INFORMATION_CLASS, TOKEN_TYPE, TRANSACTIONMANAGER_INFORMATION_CLASS,
+ TRANSACTION_INFORMATION_CLASS,
+};
+EXTERN!{extern "system" {
+ fn ZwAcceptConnectPort(
+ PortHandle: PHANDLE,
+ PortContext: PVOID,
+ ConnectionRequest: PPORT_MESSAGE,
+ AcceptConnection: BOOLEAN,
+ ServerView: PPORT_VIEW,
+ ClientView: PREMOTE_PORT_VIEW,
+ ) -> NTSTATUS;
+ fn ZwAccessCheck(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ClientToken: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ GenericMapping: PGENERIC_MAPPING,
+ PrivilegeSet: PPRIVILEGE_SET,
+ PrivilegeSetLength: PULONG,
+ GrantedAccess: PACCESS_MASK,
+ AccessStatus: PNTSTATUS,
+ ) -> NTSTATUS;
+ fn ZwAccessCheckAndAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ ObjectTypeName: PUNICODE_STRING,
+ ObjectName: PUNICODE_STRING,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ DesiredAccess: ACCESS_MASK,
+ GenericMapping: PGENERIC_MAPPING,
+ ObjectCreation: BOOLEAN,
+ GrantedAccess: PACCESS_MASK,
+ AccessStatus: PNTSTATUS,
+ GenerateOnClose: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwAccessCheckByType(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ PrincipalSelfSid: PSID,
+ ClientToken: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectTypeList: POBJECT_TYPE_LIST,
+ ObjectTypeListLength: ULONG,
+ GenericMapping: PGENERIC_MAPPING,
+ PrivilegeSet: PPRIVILEGE_SET,
+ PrivilegeSetLength: PULONG,
+ GrantedAccess: PACCESS_MASK,
+ AccessStatus: PNTSTATUS,
+ ) -> NTSTATUS;
+ fn ZwAccessCheckByTypeAndAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ ObjectTypeName: PUNICODE_STRING,
+ ObjectName: PUNICODE_STRING,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ PrincipalSelfSid: PSID,
+ DesiredAccess: ACCESS_MASK,
+ AuditType: AUDIT_EVENT_TYPE,
+ Flags: ULONG,
+ ObjectTypeList: POBJECT_TYPE_LIST,
+ ObjectTypeListLength: ULONG,
+ GenericMapping: PGENERIC_MAPPING,
+ ObjectCreation: BOOLEAN,
+ GrantedAccess: PACCESS_MASK,
+ AccessStatus: PNTSTATUS,
+ GenerateOnClose: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwAccessCheckByTypeResultList(
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ PrincipalSelfSid: PSID,
+ ClientToken: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectTypeList: POBJECT_TYPE_LIST,
+ ObjectTypeListLength: ULONG,
+ GenericMapping: PGENERIC_MAPPING,
+ PrivilegeSet: PPRIVILEGE_SET,
+ PrivilegeSetLength: PULONG,
+ GrantedAccess: PACCESS_MASK,
+ AccessStatus: PNTSTATUS,
+ ) -> NTSTATUS;
+ fn ZwAccessCheckByTypeResultListAndAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ ObjectTypeName: PUNICODE_STRING,
+ ObjectName: PUNICODE_STRING,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ PrincipalSelfSid: PSID,
+ DesiredAccess: ACCESS_MASK,
+ AuditType: AUDIT_EVENT_TYPE,
+ Flags: ULONG,
+ ObjectTypeList: POBJECT_TYPE_LIST,
+ ObjectTypeListLength: ULONG,
+ GenericMapping: PGENERIC_MAPPING,
+ ObjectCreation: BOOLEAN,
+ GrantedAccess: PACCESS_MASK,
+ AccessStatus: PNTSTATUS,
+ GenerateOnClose: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwAccessCheckByTypeResultListAndAuditAlarmByHandle(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ ClientToken: HANDLE,
+ ObjectTypeName: PUNICODE_STRING,
+ ObjectName: PUNICODE_STRING,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ PrincipalSelfSid: PSID,
+ DesiredAccess: ACCESS_MASK,
+ AuditType: AUDIT_EVENT_TYPE,
+ Flags: ULONG,
+ ObjectTypeList: POBJECT_TYPE_LIST,
+ ObjectTypeListLength: ULONG,
+ GenericMapping: PGENERIC_MAPPING,
+ ObjectCreation: BOOLEAN,
+ GrantedAccess: PACCESS_MASK,
+ AccessStatus: PNTSTATUS,
+ GenerateOnClose: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwAcquireCMFViewOwnership(
+ TimeStamp: PULONGLONG,
+ tokenTaken: PBOOLEAN,
+ replaceExisting: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwAddAtom(
+ AtomName: PWSTR,
+ Length: ULONG,
+ Atom: PRTL_ATOM,
+ ) -> NTSTATUS;
+ fn ZwAddAtomEx(
+ AtomName: PWSTR,
+ Length: ULONG,
+ Atom: PRTL_ATOM,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn ZwAddBootEntry(
+ BootEntry: PBOOT_ENTRY,
+ Id: PULONG,
+ ) -> NTSTATUS;
+ fn ZwAddDriverEntry(
+ DriverEntry: PEFI_DRIVER_ENTRY,
+ Id: PULONG,
+ ) -> NTSTATUS;
+ fn ZwAdjustGroupsToken(
+ TokenHandle: HANDLE,
+ ResetToDefault: BOOLEAN,
+ NewState: PTOKEN_GROUPS,
+ BufferLength: ULONG,
+ PreviousState: PTOKEN_GROUPS,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwAdjustPrivilegesToken(
+ TokenHandle: HANDLE,
+ DisableAllPrivileges: BOOLEAN,
+ NewState: PTOKEN_PRIVILEGES,
+ BufferLength: ULONG,
+ PreviousState: PTOKEN_PRIVILEGES,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwAdjustTokenClaimsAndDeviceGroups(
+ TokenHandle: HANDLE,
+ UserResetToDefault: BOOLEAN,
+ DeviceResetToDefault: BOOLEAN,
+ DeviceGroupsResetToDefault: BOOLEAN,
+ NewUserState: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ NewDeviceState: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ NewDeviceGroupsState: PTOKEN_GROUPS,
+ UserBufferLength: ULONG,
+ PreviousUserState: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ DeviceBufferLength: ULONG,
+ PreviousDeviceState: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ DeviceGroupsBufferLength: ULONG,
+ PreviousDeviceGroups: PTOKEN_GROUPS,
+ UserReturnLength: PULONG,
+ DeviceReturnLength: PULONG,
+ DeviceGroupsReturnBufferLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwAlertResumeThread(
+ ThreadHandle: HANDLE,
+ PreviousSuspendCount: PULONG,
+ ) -> NTSTATUS;
+ fn ZwAlertThread(
+ ThreadHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwAlertThreadByThreadId(
+ ThreadId: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwAllocateLocallyUniqueId(
+ Luid: PLUID,
+ ) -> NTSTATUS;
+ fn ZwAllocateReserveObject(
+ MemoryReserveHandle: PHANDLE,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ Type: MEMORY_RESERVE_TYPE,
+ ) -> NTSTATUS;
+ fn ZwAllocateUserPhysicalPages(
+ ProcessHandle: HANDLE,
+ NumberOfPages: PULONG_PTR,
+ UserPfnArray: PULONG_PTR,
+ ) -> NTSTATUS;
+ fn ZwAllocateUuids(
+ Time: PULARGE_INTEGER,
+ Range: PULONG,
+ Sequence: PULONG,
+ Seed: PCHAR,
+ ) -> NTSTATUS;
+ fn ZwAllocateVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: *mut PVOID,
+ ZeroBits: ULONG_PTR,
+ RegionSize: PSIZE_T,
+ AllocationType: ULONG,
+ Protect: ULONG,
+ ) -> NTSTATUS;
+ fn ZwAlpcAcceptConnectPort(
+ PortHandle: PHANDLE,
+ ConnectionPortHandle: HANDLE,
+ Flags: ULONG,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ PortAttributes: PALPC_PORT_ATTRIBUTES,
+ PortContext: PVOID,
+ ConnectionRequest: PPORT_MESSAGE,
+ ConnectionMessageAttributes: PALPC_MESSAGE_ATTRIBUTES,
+ AcceptConnection: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwAlpcCancelMessage(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ MessageContext: PALPC_CONTEXT_ATTR,
+ ) -> NTSTATUS;
+ fn ZwAlpcConnectPort(
+ PortHandle: PHANDLE,
+ PortName: PUNICODE_STRING,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ PortAttributes: PALPC_PORT_ATTRIBUTES,
+ Flags: ULONG,
+ RequiredServerSid: PSID,
+ ConnectionMessage: PPORT_MESSAGE,
+ BufferLength: PULONG,
+ OutMessageAttributes: PALPC_MESSAGE_ATTRIBUTES,
+ InMessageAttributes: PALPC_MESSAGE_ATTRIBUTES,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwAlpcConnectPortEx(
+ PortHandle: PHANDLE,
+ ConnectionPortObjectAttributes: POBJECT_ATTRIBUTES,
+ ClientPortObjectAttributes: POBJECT_ATTRIBUTES,
+ PortAttributes: PALPC_PORT_ATTRIBUTES,
+ Flags: ULONG,
+ ServerSecurityRequirements: PSECURITY_DESCRIPTOR,
+ ConnectionMessage: PPORT_MESSAGE,
+ BufferLength: PSIZE_T,
+ OutMessageAttributes: PALPC_MESSAGE_ATTRIBUTES,
+ InMessageAttributes: PALPC_MESSAGE_ATTRIBUTES,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwAlpcCreatePort(
+ PortHandle: PHANDLE,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ PortAttributes: PALPC_PORT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwAlpcCreatePortSection(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ SectionHandle: HANDLE,
+ SectionSize: SIZE_T,
+ AlpcSectionHandle: PALPC_HANDLE,
+ ActualSectionSize: PSIZE_T,
+ ) -> NTSTATUS;
+ fn ZwAlpcCreateResourceReserve(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ MessageSize: SIZE_T,
+ ResourceId: PALPC_HANDLE,
+ ) -> NTSTATUS;
+ fn ZwAlpcCreateSectionView(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ ViewAttributes: PALPC_DATA_VIEW_ATTR,
+ ) -> NTSTATUS;
+ fn ZwAlpcCreateSecurityContext(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ SecurityAttribute: PALPC_SECURITY_ATTR,
+ ) -> NTSTATUS;
+ fn ZwAlpcDeletePortSection(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ SectionHandle: ALPC_HANDLE,
+ ) -> NTSTATUS;
+ fn ZwAlpcDeleteResourceReserve(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ ResourceId: ALPC_HANDLE,
+ ) -> NTSTATUS;
+ fn ZwAlpcDeleteSectionView(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ ViewBase: PVOID,
+ ) -> NTSTATUS;
+ fn ZwAlpcDeleteSecurityContext(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ ContextHandle: ALPC_HANDLE,
+ ) -> NTSTATUS;
+ fn ZwAlpcDisconnectPort(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn ZwAlpcImpersonateClientContainerOfPort(
+ PortHandle: HANDLE,
+ Message: PPORT_MESSAGE,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn ZwAlpcImpersonateClientOfPort(
+ PortHandle: HANDLE,
+ Message: PPORT_MESSAGE,
+ Flags: PVOID,
+ ) -> NTSTATUS;
+ fn ZwAlpcOpenSenderProcess(
+ ProcessHandle: PHANDLE,
+ PortHandle: HANDLE,
+ PortMessage: PPORT_MESSAGE,
+ Flags: ULONG,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwAlpcOpenSenderThread(
+ ThreadHandle: PHANDLE,
+ PortHandle: HANDLE,
+ PortMessage: PPORT_MESSAGE,
+ Flags: ULONG,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwAlpcQueryInformation(
+ PortHandle: HANDLE,
+ PortInformationClass: ALPC_PORT_INFORMATION_CLASS,
+ PortInformation: PVOID,
+ Length: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwAlpcQueryInformationMessage(
+ PortHandle: HANDLE,
+ PortMessage: PPORT_MESSAGE,
+ MessageInformationClass: ALPC_MESSAGE_INFORMATION_CLASS,
+ MessageInformation: PVOID,
+ Length: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwAlpcRevokeSecurityContext(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ ContextHandle: ALPC_HANDLE,
+ ) -> NTSTATUS;
+ fn ZwAlpcSendWaitReceivePort(
+ PortHandle: HANDLE,
+ Flags: ULONG,
+ SendMessageA: PPORT_MESSAGE,
+ SendMessageAttributes: PALPC_MESSAGE_ATTRIBUTES,
+ ReceiveMessage: PPORT_MESSAGE,
+ BufferLength: PSIZE_T,
+ ReceiveMessageAttributes: PALPC_MESSAGE_ATTRIBUTES,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwAlpcSetInformation(
+ PortHandle: HANDLE,
+ PortInformationClass: ALPC_PORT_INFORMATION_CLASS,
+ PortInformation: PVOID,
+ Length: ULONG,
+ ) -> NTSTATUS;
+ fn ZwAreMappedFilesTheSame(
+ File1MappedAsAnImage: PVOID,
+ File2MappedAsFile: PVOID,
+ ) -> NTSTATUS;
+ fn ZwAssignProcessToJobObject(
+ JobHandle: HANDLE,
+ ProcessHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwAssociateWaitCompletionPacket(
+ WaitCompletionPacketHandle: HANDLE,
+ IoCompletionHandle: HANDLE,
+ TargetObjectHandle: HANDLE,
+ KeyContext: PVOID,
+ ApcContext: PVOID,
+ IoStatus: NTSTATUS,
+ IoStatusInformation: ULONG_PTR,
+ AlreadySignaled: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwCallbackReturn(
+ OutputBuffer: PVOID,
+ OutputLength: ULONG,
+ Status: NTSTATUS,
+ ) -> NTSTATUS;
+ fn ZwCancelIoFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ) -> NTSTATUS;
+ fn ZwCancelIoFileEx(
+ FileHandle: HANDLE,
+ IoRequestToCancel: PIO_STATUS_BLOCK,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ) -> NTSTATUS;
+ fn ZwCancelSynchronousIoFile(
+ ThreadHandle: HANDLE,
+ IoRequestToCancel: PIO_STATUS_BLOCK,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ) -> NTSTATUS;
+ fn ZwCancelTimer(
+ TimerHandle: HANDLE,
+ CurrentState: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwCancelTimer2(
+ TimerHandle: HANDLE,
+ Parameters: PT2_CANCEL_PARAMETERS,
+ ) -> NTSTATUS;
+ fn ZwCancelWaitCompletionPacket(
+ WaitCompletionPacketHandle: HANDLE,
+ RemoveSignaledPacket: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwClearEvent(
+ EventHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwClose(
+ Handle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwCloseObjectAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ GenerateOnClose: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwCommitComplete(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwCommitEnlistment(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwCommitTransaction(
+ TransactionHandle: HANDLE,
+ Wait: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwCompactKeys(
+ Count: ULONG,
+ KeyArray: *mut HANDLE,
+ ) -> NTSTATUS;
+ fn ZwCompareObjects(
+ FirstObjectHandle: HANDLE,
+ SecondObjectHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwCompareTokens(
+ FirstTokenHandle: HANDLE,
+ SecondTokenHandle: HANDLE,
+ Equal: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwCompleteConnectPort(
+ PortHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwCompressKey(
+ Key: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwConnectPort(
+ PortHandle: PHANDLE,
+ PortName: PUNICODE_STRING,
+ SecurityQos: PSECURITY_QUALITY_OF_SERVICE,
+ ClientView: PPORT_VIEW,
+ ServerView: PREMOTE_PORT_VIEW,
+ MaxMessageLength: PULONG,
+ ConnectionInformation: PVOID,
+ ConnectionInformationLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwContinue(
+ ContextRecord: PCONTEXT,
+ TestAlert: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwCreateDebugObject(
+ DebugObjectHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn ZwCreateDirectoryObject(
+ DirectoryHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwCreateDirectoryObjectEx(
+ DirectoryHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ShadowDirectoryHandle: HANDLE,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn ZwCreateEnlistment(
+ EnlistmentHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ResourceManagerHandle: HANDLE,
+ TransactionHandle: HANDLE,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ CreateOptions: ULONG,
+ NotificationMask: NOTIFICATION_MASK,
+ EnlistmentKey: PVOID,
+ ) -> NTSTATUS;
+ fn ZwCreateEvent(
+ EventHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ EventType: EVENT_TYPE,
+ InitialState: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwCreateEventPair(
+ EventPairHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwCreateFile(
+ FileHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ AllocationSize: PLARGE_INTEGER,
+ FileAttributes: ULONG,
+ ShareAccess: ULONG,
+ CreateDisposition: ULONG,
+ CreateOptions: ULONG,
+ EaBuffer: PVOID,
+ EaLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwCreateIRTimer(
+ TimerHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ) -> NTSTATUS;
+ fn ZwCreateIoCompletion(
+ IoCompletionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ Count: ULONG,
+ ) -> NTSTATUS;
+ fn ZwCreateJobObject(
+ JobHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwCreateJobSet(
+ NumJob: ULONG,
+ UserJobSet: PJOB_SET_ARRAY,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn ZwCreateKey(
+ KeyHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ TitleIndex: ULONG,
+ Class: PUNICODE_STRING,
+ CreateOptions: ULONG,
+ Disposition: PULONG,
+ ) -> NTSTATUS;
+ fn ZwCreateKeyTransacted(
+ KeyHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ TitleIndex: ULONG,
+ Class: PUNICODE_STRING,
+ CreateOptions: ULONG,
+ TransactionHandle: HANDLE,
+ Disposition: PULONG,
+ ) -> NTSTATUS;
+ fn ZwCreateKeyedEvent(
+ KeyedEventHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn ZwCreateLowBoxToken(
+ TokenHandle: PHANDLE,
+ ExistingTokenHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ PackageSid: PSID,
+ CapabilityCount: ULONG,
+ Capabilities: PSID_AND_ATTRIBUTES,
+ HandleCount: ULONG,
+ Handles: *mut HANDLE,
+ ) -> NTSTATUS;
+ fn ZwCreateMailslotFile(
+ FileHandle: PHANDLE,
+ DesiredAccess: ULONG,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ CreateOptions: ULONG,
+ MailslotQuota: ULONG,
+ MaximumMessageSize: ULONG,
+ ReadTimeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwCreateMutant(
+ MutantHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ InitialOwner: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwCreateNamedPipeFile(
+ FileHandle: PHANDLE,
+ DesiredAccess: ULONG,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ShareAccess: ULONG,
+ CreateDisposition: ULONG,
+ CreateOptions: ULONG,
+ NamedPipeType: ULONG,
+ ReadMode: ULONG,
+ CompletionMode: ULONG,
+ MaximumInstances: ULONG,
+ InboundQuota: ULONG,
+ OutboundQuota: ULONG,
+ DefaultTimeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwCreatePagingFile(
+ PageFileName: PUNICODE_STRING,
+ MinimumSize: PLARGE_INTEGER,
+ MaximumSize: PLARGE_INTEGER,
+ Priority: ULONG,
+ ) -> NTSTATUS;
+ fn ZwCreatePartition(
+ PartitionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ PreferredNode: ULONG,
+ ) -> NTSTATUS;
+ fn ZwCreatePort(
+ PortHandle: PHANDLE,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ MaxConnectionInfoLength: ULONG,
+ MaxMessageLength: ULONG,
+ MaxPoolUsage: ULONG,
+ ) -> NTSTATUS;
+ fn ZwCreatePrivateNamespace(
+ NamespaceHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ BoundaryDescriptor: PVOID,
+ ) -> NTSTATUS;
+ fn ZwCreateProcess(
+ ProcessHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ParentProcess: HANDLE,
+ InheritObjectTable: BOOLEAN,
+ SectionHandle: HANDLE,
+ DebugPort: HANDLE,
+ ExceptionPort: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwCreateProcessEx(
+ ProcessHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ParentProcess: HANDLE,
+ Flags: ULONG,
+ SectionHandle: HANDLE,
+ DebugPort: HANDLE,
+ ExceptionPort: HANDLE,
+ JobMemberLevel: ULONG,
+ ) -> NTSTATUS;
+ fn ZwCreateProfile(
+ ProfileHandle: PHANDLE,
+ Process: HANDLE,
+ ProfileBase: PVOID,
+ ProfileSize: SIZE_T,
+ BucketSize: ULONG,
+ Buffer: PULONG,
+ BufferSize: ULONG,
+ ProfileSource: KPROFILE_SOURCE,
+ Affinity: KAFFINITY,
+ ) -> NTSTATUS;
+ fn ZwCreateProfileEx(
+ ProfileHandle: PHANDLE,
+ Process: HANDLE,
+ ProfileBase: PVOID,
+ ProfileSize: SIZE_T,
+ BucketSize: ULONG,
+ Buffer: PULONG,
+ BufferSize: ULONG,
+ ProfileSource: KPROFILE_SOURCE,
+ GroupCount: USHORT,
+ GroupAffinity: PGROUP_AFFINITY,
+ ) -> NTSTATUS;
+ fn ZwCreateResourceManager(
+ ResourceManagerHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ TmHandle: HANDLE,
+ ResourceManagerGuid: LPGUID,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ CreateOptions: ULONG,
+ Description: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn ZwCreateSection(
+ SectionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ MaximumSize: PLARGE_INTEGER,
+ SectionPageProtection: ULONG,
+ AllocationAttributes: ULONG,
+ FileHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwCreateSemaphore(
+ SemaphoreHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ InitialCount: LONG,
+ MaximumCount: LONG,
+ ) -> NTSTATUS;
+ fn ZwCreateSymbolicLinkObject(
+ LinkHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ LinkTarget: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn ZwCreateThread(
+ ThreadHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ProcessHandle: HANDLE,
+ ClientId: PCLIENT_ID,
+ ThreadContext: PCONTEXT,
+ InitialTeb: PINITIAL_TEB,
+ CreateSuspended: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwCreateThreadEx(
+ ThreadHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ProcessHandle: HANDLE,
+ StartRoutine: PVOID,
+ Argument: PVOID,
+ CreateFlags: ULONG,
+ ZeroBits: SIZE_T,
+ StackSize: SIZE_T,
+ MaximumStackSize: SIZE_T,
+ AttributeList: PPS_ATTRIBUTE_LIST,
+ ) -> NTSTATUS;
+ fn ZwCreateTimer(
+ TimerHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ TimerType: TIMER_TYPE,
+ ) -> NTSTATUS;
+ fn ZwCreateTimer2(
+ TimerHandle: PHANDLE,
+ Reserved1: PVOID,
+ Reserved2: PVOID,
+ Attributes: ULONG,
+ DesiredAccess: ACCESS_MASK,
+ ) -> NTSTATUS;
+ fn ZwCreateToken(
+ TokenHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ TokenType: TOKEN_TYPE,
+ AuthenticationId: PLUID,
+ ExpirationTime: PLARGE_INTEGER,
+ User: PTOKEN_USER,
+ Groups: PTOKEN_GROUPS,
+ Privileges: PTOKEN_PRIVILEGES,
+ Owner: PTOKEN_OWNER,
+ PrimaryGroup: PTOKEN_PRIMARY_GROUP,
+ DefaultDacl: PTOKEN_DEFAULT_DACL,
+ TokenSource: PTOKEN_SOURCE,
+ ) -> NTSTATUS;
+ fn ZwCreateTokenEx(
+ TokenHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ TokenType: TOKEN_TYPE,
+ AuthenticationId: PLUID,
+ ExpirationTime: PLARGE_INTEGER,
+ User: PTOKEN_USER,
+ Groups: PTOKEN_GROUPS,
+ Privileges: PTOKEN_PRIVILEGES,
+ UserAttributes: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ DeviceAttributes: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ DeviceGroups: PTOKEN_GROUPS,
+ TokenMandatoryPolicy: PTOKEN_MANDATORY_POLICY,
+ Owner: PTOKEN_OWNER,
+ PrimaryGroup: PTOKEN_PRIMARY_GROUP,
+ DefaultDacl: PTOKEN_DEFAULT_DACL,
+ TokenSource: PTOKEN_SOURCE,
+ ) -> NTSTATUS;
+ fn ZwCreateTransaction(
+ TransactionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ Uow: LPGUID,
+ TmHandle: HANDLE,
+ CreateOptions: ULONG,
+ IsolationLevel: ULONG,
+ IsolationFlags: ULONG,
+ Timeout: PLARGE_INTEGER,
+ Description: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn ZwCreateTransactionManager(
+ TmHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ LogFileName: PUNICODE_STRING,
+ CreateOptions: ULONG,
+ CommitStrength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwCreateUserProcess(
+ ProcessHandle: PHANDLE,
+ ThreadHandle: PHANDLE,
+ ProcessDesiredAccess: ACCESS_MASK,
+ ThreadDesiredAccess: ACCESS_MASK,
+ ProcessObjectAttributes: POBJECT_ATTRIBUTES,
+ ThreadObjectAttributes: POBJECT_ATTRIBUTES,
+ ProcessFlags: ULONG,
+ ThreadFlags: ULONG,
+ ProcessParameters: PVOID,
+ CreateInfo: PPS_CREATE_INFO,
+ AttributeList: PPS_ATTRIBUTE_LIST,
+ ) -> NTSTATUS;
+ fn ZwCreateWaitCompletionPacket(
+ WaitCompletionPacketHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwCreateWaitablePort(
+ PortHandle: PHANDLE,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ MaxConnectionInfoLength: ULONG,
+ MaxMessageLength: ULONG,
+ MaxPoolUsage: ULONG,
+ ) -> NTSTATUS;
+ fn ZwCreateWnfStateName(
+ StateName: PWNF_STATE_NAME,
+ NameLifetime: WNF_STATE_NAME_LIFETIME,
+ DataScope: WNF_DATA_SCOPE,
+ PersistData: BOOLEAN,
+ TypeId: PCWNF_TYPE_ID,
+ MaximumStateSize: ULONG,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ) -> NTSTATUS;
+ fn ZwCreateWorkerFactory(
+ WorkerFactoryHandleReturn: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ CompletionPortHandle: HANDLE,
+ WorkerProcessHandle: HANDLE,
+ StartRoutine: PVOID,
+ StartParameter: PVOID,
+ MaxThreadCount: ULONG,
+ StackReserve: SIZE_T,
+ StackCommit: SIZE_T,
+ ) -> NTSTATUS;
+ fn ZwDebugActiveProcess(
+ ProcessHandle: HANDLE,
+ DebugObjectHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwDebugContinue(
+ DebugObjectHandle: HANDLE,
+ ClientId: PCLIENT_ID,
+ ContinueStatus: NTSTATUS,
+ ) -> NTSTATUS;
+ fn ZwDelayExecution(
+ Alertable: BOOLEAN,
+ DelayInterval: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwDeleteAtom(
+ Atom: RTL_ATOM,
+ ) -> NTSTATUS;
+ fn ZwDeleteBootEntry(
+ Id: ULONG,
+ ) -> NTSTATUS;
+ fn ZwDeleteDriverEntry(
+ Id: ULONG,
+ ) -> NTSTATUS;
+ fn ZwDeleteFile(
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwDeleteKey(
+ KeyHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwDeleteObjectAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ GenerateOnClose: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwDeletePrivateNamespace(
+ NamespaceHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwDeleteValueKey(
+ KeyHandle: HANDLE,
+ ValueName: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn ZwDeleteWnfStateData(
+ StateName: PCWNF_STATE_NAME,
+ ExplicitScope: *const VOID,
+ ) -> NTSTATUS;
+ fn ZwDeleteWnfStateName(
+ StateName: PCWNF_STATE_NAME,
+ ) -> NTSTATUS;
+ fn ZwDeviceIoControlFile(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ IoControlCode: ULONG,
+ InputBuffer: PVOID,
+ InputBufferLength: ULONG,
+ OutputBuffer: PVOID,
+ OutputBufferLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwDisableLastKnownGood() -> NTSTATUS;
+ fn ZwDisplayString(
+ String: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn ZwDrawText(
+ String: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn ZwDuplicateObject(
+ SourceProcessHandle: HANDLE,
+ SourceHandle: HANDLE,
+ TargetProcessHandle: HANDLE,
+ TargetHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ HandleAttributes: ULONG,
+ Options: ULONG,
+ ) -> NTSTATUS;
+ fn ZwDuplicateToken(
+ ExistingTokenHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ EffectiveOnly: BOOLEAN,
+ TokenType: TOKEN_TYPE,
+ NewTokenHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn ZwEnableLastKnownGood() -> NTSTATUS;
+ fn ZwEnumerateBootEntries(
+ Buffer: PVOID,
+ BufferLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwEnumerateDriverEntries(
+ Buffer: PVOID,
+ BufferLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwEnumerateKey(
+ KeyHandle: HANDLE,
+ Index: ULONG,
+ KeyInformationClass: KEY_INFORMATION_CLASS,
+ KeyInformation: PVOID,
+ Length: ULONG,
+ ResultLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwEnumerateSystemEnvironmentValuesEx(
+ InformationClass: ULONG,
+ Buffer: PVOID,
+ BufferLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwEnumerateTransactionObject(
+ RootObjectHandle: HANDLE,
+ QueryType: KTMOBJECT_TYPE,
+ ObjectCursor: PKTMOBJECT_CURSOR,
+ ObjectCursorLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwEnumerateValueKey(
+ KeyHandle: HANDLE,
+ Index: ULONG,
+ KeyValueInformationClass: KEY_VALUE_INFORMATION_CLASS,
+ KeyValueInformation: PVOID,
+ Length: ULONG,
+ ResultLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwExtendSection(
+ SectionHandle: HANDLE,
+ NewSectionSize: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwFilterToken(
+ ExistingTokenHandle: HANDLE,
+ Flags: ULONG,
+ SidsToDisable: PTOKEN_GROUPS,
+ PrivilegesToDelete: PTOKEN_PRIVILEGES,
+ RestrictedSids: PTOKEN_GROUPS,
+ NewTokenHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn ZwFilterTokenEx(
+ ExistingTokenHandle: HANDLE,
+ Flags: ULONG,
+ SidsToDisable: PTOKEN_GROUPS,
+ PrivilegesToDelete: PTOKEN_PRIVILEGES,
+ RestrictedSids: PTOKEN_GROUPS,
+ DisableUserClaimsCount: ULONG,
+ UserClaimsToDisable: PUNICODE_STRING,
+ DisableDeviceClaimsCount: ULONG,
+ DeviceClaimsToDisable: PUNICODE_STRING,
+ DeviceGroupsToDisable: PTOKEN_GROUPS,
+ RestrictedUserAttributes: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ RestrictedDeviceAttributes: PTOKEN_SECURITY_ATTRIBUTES_INFORMATION,
+ RestrictedDeviceGroups: PTOKEN_GROUPS,
+ NewTokenHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn ZwFindAtom(
+ AtomName: PWSTR,
+ Length: ULONG,
+ Atom: PRTL_ATOM,
+ ) -> NTSTATUS;
+ fn ZwFlushBuffersFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ) -> NTSTATUS;
+ fn ZwFlushBuffersFileEx(
+ FileHandle: HANDLE,
+ Flags: ULONG,
+ Parameters: PVOID,
+ ParametersSize: ULONG,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ) -> NTSTATUS;
+ fn ZwFlushInstallUILanguage(
+ InstallUILanguage: LANGID,
+ SetComittedFlag: ULONG,
+ ) -> NTSTATUS;
+ fn ZwFlushInstructionCache(
+ ProcessHandle: HANDLE,
+ BaseAddress: PVOID,
+ Length: SIZE_T,
+ ) -> NTSTATUS;
+ fn ZwFlushKey(
+ KeyHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwFlushProcessWriteBuffers();
+ fn ZwFlushWriteBuffer() -> NTSTATUS;
+ fn ZwFreeUserPhysicalPages(
+ ProcessHandle: HANDLE,
+ NumberOfPages: PULONG_PTR,
+ UserPfnArray: PULONG_PTR,
+ ) -> NTSTATUS;
+ fn ZwFreeVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: *mut PVOID,
+ RegionSize: PSIZE_T,
+ FreeType: ULONG,
+ ) -> NTSTATUS;
+ fn ZwFreezeRegistry(
+ TimeOutInSeconds: ULONG,
+ ) -> NTSTATUS;
+ fn ZwFreezeTransactions(
+ FreezeTimeout: PLARGE_INTEGER,
+ ThawTimeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwFsControlFile(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ FsControlCode: ULONG,
+ InputBuffer: PVOID,
+ InputBufferLength: ULONG,
+ OutputBuffer: PVOID,
+ OutputBufferLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwGetCachedSigningLevel(
+ File: HANDLE,
+ Flags: PULONG,
+ SigningLevel: PSE_SIGNING_LEVEL,
+ Thumbprint: PUCHAR,
+ ThumbprintSize: PULONG,
+ ThumbprintAlgorithm: PULONG,
+ ) -> NTSTATUS;
+ fn ZwGetCompleteWnfStateSubscription(
+ OldDescriptorStateName: PWNF_STATE_NAME,
+ OldSubscriptionId: *mut ULONG64,
+ OldDescriptorEventMask: ULONG,
+ OldDescriptorStatus: ULONG,
+ NewDeliveryDescriptor: PWNF_DELIVERY_DESCRIPTOR,
+ DescriptorSize: ULONG,
+ ) -> NTSTATUS;
+ fn ZwGetContextThread(
+ ThreadHandle: HANDLE,
+ ThreadContext: PCONTEXT,
+ ) -> NTSTATUS;
+ fn ZwGetCurrentProcessorNumber() -> ULONG;
+ fn ZwGetDevicePowerState(
+ Device: HANDLE,
+ State: PDEVICE_POWER_STATE,
+ ) -> NTSTATUS;
+ fn ZwGetMUIRegistryInfo(
+ Flags: ULONG,
+ DataSize: PULONG,
+ Data: PVOID,
+ ) -> NTSTATUS;
+ fn ZwGetNextProcess(
+ ProcessHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ HandleAttributes: ULONG,
+ Flags: ULONG,
+ NewProcessHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn ZwGetNextThread(
+ ProcessHandle: HANDLE,
+ ThreadHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ HandleAttributes: ULONG,
+ Flags: ULONG,
+ NewThreadHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn ZwGetNlsSectionPtr(
+ SectionType: ULONG,
+ SectionData: ULONG,
+ ContextData: PVOID,
+ SectionPointer: *mut PVOID,
+ SectionSize: PULONG,
+ ) -> NTSTATUS;
+ fn ZwGetNotificationResourceManager(
+ ResourceManagerHandle: HANDLE,
+ TransactionNotification: PTRANSACTION_NOTIFICATION,
+ NotificationLength: ULONG,
+ Timeout: PLARGE_INTEGER,
+ ReturnLength: PULONG,
+ Asynchronous: ULONG,
+ AsynchronousContext: ULONG_PTR,
+ ) -> NTSTATUS;
+ fn ZwGetPlugPlayEvent(
+ EventHandle: HANDLE,
+ Context: PVOID,
+ EventBlock: PPLUGPLAY_EVENT_BLOCK,
+ EventBufferSize: ULONG,
+ ) -> NTSTATUS;
+ fn ZwGetWriteWatch(
+ ProcessHandle: HANDLE,
+ Flags: ULONG,
+ BaseAddress: PVOID,
+ RegionSize: SIZE_T,
+ UserAddressArray: *mut PVOID,
+ EntriesInUserAddressArray: PULONG_PTR,
+ Granularity: PULONG,
+ ) -> NTSTATUS;
+ fn ZwImpersonateAnonymousToken(
+ ThreadHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwImpersonateClientOfPort(
+ PortHandle: HANDLE,
+ Message: PPORT_MESSAGE,
+ ) -> NTSTATUS;
+ fn ZwImpersonateThread(
+ ServerThreadHandle: HANDLE,
+ ClientThreadHandle: HANDLE,
+ SecurityQos: PSECURITY_QUALITY_OF_SERVICE,
+ ) -> NTSTATUS;
+ fn ZwInitializeNlsFiles(
+ BaseAddress: *mut PVOID,
+ DefaultLocaleId: PLCID,
+ DefaultCasingTableSize: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwInitializeRegistry(
+ BootCondition: USHORT,
+ ) -> NTSTATUS;
+ fn ZwInitiatePowerAction(
+ SystemAction: POWER_ACTION,
+ LightestSystemState: SYSTEM_POWER_STATE,
+ Flags: ULONG,
+ Asynchronous: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwIsProcessInJob(
+ ProcessHandle: HANDLE,
+ JobHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwIsSystemResumeAutomatic() -> BOOLEAN;
+ fn ZwIsUILanguageComitted() -> NTSTATUS;
+ fn ZwListenPort(
+ PortHandle: HANDLE,
+ ConnectionRequest: PPORT_MESSAGE,
+ ) -> NTSTATUS;
+ fn ZwLoadDriver(
+ DriverServiceName: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn ZwLoadKey(
+ TargetKey: POBJECT_ATTRIBUTES,
+ SourceFile: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwLoadKey2(
+ TargetKey: POBJECT_ATTRIBUTES,
+ SourceFile: POBJECT_ATTRIBUTES,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn ZwLoadKeyEx(
+ TargetKey: POBJECT_ATTRIBUTES,
+ SourceFile: POBJECT_ATTRIBUTES,
+ Flags: ULONG,
+ TrustClassKey: HANDLE,
+ Event: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ RootHandle: PHANDLE,
+ IoStatus: PIO_STATUS_BLOCK,
+ ) -> NTSTATUS;
+ fn ZwLockFile(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ByteOffset: PLARGE_INTEGER,
+ Length: PLARGE_INTEGER,
+ Key: ULONG,
+ FailImmediately: BOOLEAN,
+ ExclusiveLock: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwLockProductActivationKeys(
+ pPrivateVer: *mut ULONG,
+ pSafeMode: *mut ULONG,
+ ) -> NTSTATUS;
+ fn ZwLockRegistryKey(
+ KeyHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwLockVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: *mut PVOID,
+ RegionSize: PSIZE_T,
+ MapType: ULONG,
+ ) -> NTSTATUS;
+ fn ZwMakePermanentObject(
+ Handle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwMakeTemporaryObject(
+ Handle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwManagePartition(
+ PartitionInformationClass: MEMORY_PARTITION_INFORMATION_CLASS,
+ PartitionInformation: PVOID,
+ PartitionInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwMapCMFModule(
+ What: ULONG,
+ Index: ULONG,
+ CacheIndexOut: PULONG,
+ CacheFlagsOut: PULONG,
+ ViewSizeOut: PULONG,
+ BaseAddress: *mut PVOID,
+ ) -> NTSTATUS;
+ fn ZwMapUserPhysicalPages(
+ VirtualAddress: PVOID,
+ NumberOfPages: ULONG_PTR,
+ UserPfnArray: PULONG_PTR,
+ ) -> NTSTATUS;
+ fn ZwMapUserPhysicalPagesScatter(
+ VirtualAddresses: *mut PVOID,
+ NumberOfPages: ULONG_PTR,
+ UserPfnArray: PULONG_PTR,
+ ) -> NTSTATUS;
+ fn ZwMapViewOfSection(
+ SectionHandle: HANDLE,
+ ProcessHandle: HANDLE,
+ BaseAddress: *mut PVOID,
+ ZeroBits: ULONG_PTR,
+ CommitSize: SIZE_T,
+ SectionOffset: PLARGE_INTEGER,
+ ViewSize: PSIZE_T,
+ InheritDisposition: SECTION_INHERIT,
+ AllocationType: ULONG,
+ Win32Protect: ULONG,
+ ) -> NTSTATUS;
+ fn ZwModifyBootEntry(
+ BootEntry: PBOOT_ENTRY,
+ ) -> NTSTATUS;
+ fn ZwModifyDriverEntry(
+ DriverEntry: PEFI_DRIVER_ENTRY,
+ ) -> NTSTATUS;
+ fn ZwNotifyChangeDirectoryFile(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Buffer: PVOID,
+ Length: ULONG,
+ CompletionFilter: ULONG,
+ WatchTree: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwNotifyChangeKey(
+ KeyHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ CompletionFilter: ULONG,
+ WatchTree: BOOLEAN,
+ Buffer: PVOID,
+ BufferSize: ULONG,
+ Asynchronous: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwNotifyChangeMultipleKeys(
+ MasterKeyHandle: HANDLE,
+ Count: ULONG,
+ SubordinateObjects: *mut OBJECT_ATTRIBUTES,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ CompletionFilter: ULONG,
+ WatchTree: BOOLEAN,
+ Buffer: PVOID,
+ BufferSize: ULONG,
+ Asynchronous: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwNotifyChangeSession(
+ SessionHandle: HANDLE,
+ ChangeSequenceNumber: ULONG,
+ ChangeTimeStamp: PLARGE_INTEGER,
+ Event: IO_SESSION_EVENT,
+ NewState: IO_SESSION_STATE,
+ PreviousState: IO_SESSION_STATE,
+ Payload: PVOID,
+ PayloadSize: ULONG,
+ ) -> NTSTATUS;
+ fn ZwOpenDirectoryObject(
+ DirectoryHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenEnlistment(
+ EnlistmentHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ RmHandle: HANDLE,
+ EnlistmentGuid: LPGUID,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenEvent(
+ EventHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenEventPair(
+ EventPairHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenFile(
+ FileHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ShareAccess: ULONG,
+ OpenOptions: ULONG,
+ ) -> NTSTATUS;
+ fn ZwOpenIoCompletion(
+ IoCompletionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenJobObject(
+ JobHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenKey(
+ KeyHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenKeyEx(
+ KeyHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ OpenOptions: ULONG,
+ ) -> NTSTATUS;
+ fn ZwOpenKeyTransacted(
+ KeyHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ TransactionHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwOpenKeyTransactedEx(
+ KeyHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ OpenOptions: ULONG,
+ TransactionHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwOpenKeyedEvent(
+ KeyedEventHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenMutant(
+ MutantHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenObjectAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ ObjectTypeName: PUNICODE_STRING,
+ ObjectName: PUNICODE_STRING,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ClientToken: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ GrantedAccess: ACCESS_MASK,
+ Privileges: PPRIVILEGE_SET,
+ ObjectCreation: BOOLEAN,
+ AccessGranted: BOOLEAN,
+ GenerateOnClose: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwOpenPartition(
+ PartitionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenPrivateNamespace(
+ NamespaceHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ BoundaryDescriptor: PVOID,
+ ) -> NTSTATUS;
+ fn ZwOpenProcess(
+ ProcessHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ClientId: PCLIENT_ID,
+ ) -> NTSTATUS;
+ fn ZwOpenProcessToken(
+ ProcessHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ TokenHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn ZwOpenProcessTokenEx(
+ ProcessHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ HandleAttributes: ULONG,
+ TokenHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn ZwOpenResourceManager(
+ ResourceManagerHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ TmHandle: HANDLE,
+ ResourceManagerGuid: LPGUID,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenSection(
+ SectionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenSemaphore(
+ SemaphoreHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenSession(
+ SessionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenSymbolicLinkObject(
+ LinkHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenThread(
+ ThreadHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ClientId: PCLIENT_ID,
+ ) -> NTSTATUS;
+ fn ZwOpenThreadToken(
+ ThreadHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ OpenAsSelf: BOOLEAN,
+ TokenHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn ZwOpenThreadTokenEx(
+ ThreadHandle: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ OpenAsSelf: BOOLEAN,
+ HandleAttributes: ULONG,
+ TokenHandle: PHANDLE,
+ ) -> NTSTATUS;
+ fn ZwOpenTimer(
+ TimerHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwOpenTransaction(
+ TransactionHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ Uow: LPGUID,
+ TmHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwOpenTransactionManager(
+ TmHandle: PHANDLE,
+ DesiredAccess: ACCESS_MASK,
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ LogFileName: PUNICODE_STRING,
+ TmIdentity: LPGUID,
+ OpenOptions: ULONG,
+ ) -> NTSTATUS;
+ fn ZwPlugPlayControl(
+ PnPControlClass: PLUGPLAY_CONTROL_CLASS,
+ PnPControlData: PVOID,
+ PnPControlDataLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwPowerInformation(
+ InformationLevel: POWER_INFORMATION_LEVEL,
+ InputBuffer: PVOID,
+ InputBufferLength: ULONG,
+ OutputBuffer: PVOID,
+ OutputBufferLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwPrePrepareComplete(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwPrePrepareEnlistment(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwPrepareComplete(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwPrepareEnlistment(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwPrivilegeCheck(
+ ClientToken: HANDLE,
+ RequiredPrivileges: PPRIVILEGE_SET,
+ Result: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwPrivilegeObjectAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ HandleId: PVOID,
+ ClientToken: HANDLE,
+ DesiredAccess: ACCESS_MASK,
+ Privileges: PPRIVILEGE_SET,
+ AccessGranted: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwPrivilegedServiceAuditAlarm(
+ SubsystemName: PUNICODE_STRING,
+ ServiceName: PUNICODE_STRING,
+ ClientToken: HANDLE,
+ Privileges: PPRIVILEGE_SET,
+ AccessGranted: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwPropagationComplete(
+ ResourceManagerHandle: HANDLE,
+ RequestCookie: ULONG,
+ BufferLength: ULONG,
+ Buffer: PVOID,
+ ) -> NTSTATUS;
+ fn ZwPropagationFailed(
+ ResourceManagerHandle: HANDLE,
+ RequestCookie: ULONG,
+ PropStatus: NTSTATUS,
+ ) -> NTSTATUS;
+ fn ZwProtectVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: *mut PVOID,
+ RegionSize: PSIZE_T,
+ NewProtect: ULONG,
+ OldProtect: PULONG,
+ ) -> NTSTATUS;
+ fn ZwPulseEvent(
+ EventHandle: HANDLE,
+ PreviousState: PLONG,
+ ) -> NTSTATUS;
+ fn ZwQueryAttributesFile(
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ FileInformation: PFILE_BASIC_INFORMATION,
+ ) -> NTSTATUS;
+ fn ZwQueryBootEntryOrder(
+ Ids: PULONG,
+ Count: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryBootOptions(
+ BootOptions: PBOOT_OPTIONS,
+ BootOptionsLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryDebugFilterState(
+ ComponentId: ULONG,
+ Level: ULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryDefaultLocale(
+ UserProfile: BOOLEAN,
+ DefaultLocaleId: PLCID,
+ ) -> NTSTATUS;
+ fn ZwQueryDefaultUILanguage(
+ DefaultUILanguageId: *mut LANGID,
+ ) -> NTSTATUS;
+ fn ZwQueryDirectoryFile(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ FileInformation: PVOID,
+ Length: ULONG,
+ FileInformationClass: FILE_INFORMATION_CLASS,
+ ReturnSingleEntry: BOOLEAN,
+ FileName: PUNICODE_STRING,
+ RestartScan: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwQueryDirectoryObject(
+ DirectoryHandle: HANDLE,
+ Buffer: PVOID,
+ Length: ULONG,
+ ReturnSingleEntry: BOOLEAN,
+ RestartScan: BOOLEAN,
+ Context: PULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryDriverEntryOrder(
+ Ids: PULONG,
+ Count: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryEaFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Buffer: PVOID,
+ Length: ULONG,
+ ReturnSingleEntry: BOOLEAN,
+ EaList: PVOID,
+ EaListLength: ULONG,
+ EaIndex: PULONG,
+ RestartScan: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwQueryEvent(
+ EventHandle: HANDLE,
+ EventInformationClass: EVENT_INFORMATION_CLASS,
+ EventInformation: PVOID,
+ EventInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryFullAttributesFile(
+ ObjectAttributes: POBJECT_ATTRIBUTES,
+ FileInformation: PFILE_NETWORK_OPEN_INFORMATION,
+ ) -> NTSTATUS;
+ fn ZwQueryInformationAtom(
+ Atom: RTL_ATOM,
+ AtomInformationClass: ATOM_INFORMATION_CLASS,
+ AtomInformation: PVOID,
+ AtomInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryInformationEnlistment(
+ EnlistmentHandle: HANDLE,
+ EnlistmentInformationClass: ENLISTMENT_INFORMATION_CLASS,
+ EnlistmentInformation: PVOID,
+ EnlistmentInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryInformationFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ FileInformation: PVOID,
+ Length: ULONG,
+ FileInformationClass: FILE_INFORMATION_CLASS,
+ ) -> NTSTATUS;
+ fn ZwQueryInformationJobObject(
+ JobHandle: HANDLE,
+ JobObjectInformationClass: JOBOBJECTINFOCLASS,
+ JobObjectInformation: PVOID,
+ JobObjectInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryInformationPort(
+ PortHandle: HANDLE,
+ PortInformationClass: PORT_INFORMATION_CLASS,
+ PortInformation: PVOID,
+ Length: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryInformationProcess(
+ ProcessHandle: HANDLE,
+ ProcessInformationClass: PROCESSINFOCLASS,
+ ProcessInformation: PVOID,
+ ProcessInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryInformationResourceManager(
+ ResourceManagerHandle: HANDLE,
+ ResourceManagerInformationClass: RESOURCEMANAGER_INFORMATION_CLASS,
+ ResourceManagerInformation: PVOID,
+ ResourceManagerInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryInformationThread(
+ ThreadHandle: HANDLE,
+ ThreadInformationClass: THREADINFOCLASS,
+ ThreadInformation: PVOID,
+ ThreadInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryInformationToken(
+ TokenHandle: HANDLE,
+ TokenInformationClass: TOKEN_INFORMATION_CLASS,
+ TokenInformation: PVOID,
+ TokenInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryInformationTransaction(
+ TransactionHandle: HANDLE,
+ TransactionInformationClass: TRANSACTION_INFORMATION_CLASS,
+ TransactionInformation: PVOID,
+ TransactionInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryInformationTransactionManager(
+ TransactionManagerHandle: HANDLE,
+ TransactionManagerInformationClass: TRANSACTIONMANAGER_INFORMATION_CLASS,
+ TransactionManagerInformation: PVOID,
+ TransactionManagerInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryInformationWorkerFactory(
+ WorkerFactoryHandle: HANDLE,
+ WorkerFactoryInformationClass: WORKERFACTORYINFOCLASS,
+ WorkerFactoryInformation: PVOID,
+ WorkerFactoryInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryInstallUILanguage(
+ InstallUILanguageId: *mut LANGID,
+ ) -> NTSTATUS;
+ fn ZwQueryIntervalProfile(
+ ProfileSource: KPROFILE_SOURCE,
+ Interval: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryIoCompletion(
+ IoCompletionHandle: HANDLE,
+ IoCompletionInformationClass: IO_COMPLETION_INFORMATION_CLASS,
+ IoCompletionInformation: PVOID,
+ IoCompletionInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryKey(
+ KeyHandle: HANDLE,
+ KeyInformationClass: KEY_INFORMATION_CLASS,
+ KeyInformation: PVOID,
+ Length: ULONG,
+ ResultLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryLicenseValue(
+ ValueName: PUNICODE_STRING,
+ Type: PULONG,
+ Data: PVOID,
+ DataSize: ULONG,
+ ResultDataSize: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryMultipleValueKey(
+ KeyHandle: HANDLE,
+ ValueEntries: PKEY_VALUE_ENTRY,
+ EntryCount: ULONG,
+ ValueBuffer: PVOID,
+ BufferLength: PULONG,
+ RequiredBufferLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryMutant(
+ MutantHandle: HANDLE,
+ MutantInformationClass: MUTANT_INFORMATION_CLASS,
+ MutantInformation: PVOID,
+ MutantInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryObject(
+ Handle: HANDLE,
+ ObjectInformationClass: OBJECT_INFORMATION_CLASS,
+ ObjectInformation: PVOID,
+ ObjectInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryOpenSubKeys(
+ TargetKey: POBJECT_ATTRIBUTES,
+ HandleCount: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryOpenSubKeysEx(
+ TargetKey: POBJECT_ATTRIBUTES,
+ BufferLength: ULONG,
+ Buffer: PVOID,
+ RequiredSize: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryPerformanceCounter(
+ PerformanceCounter: PLARGE_INTEGER,
+ PerformanceFrequency: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwQueryPortInformationProcess() -> NTSTATUS;
+ fn ZwQueryQuotaInformationFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Buffer: PVOID,
+ Length: ULONG,
+ ReturnSingleEntry: BOOLEAN,
+ SidList: PVOID,
+ SidListLength: ULONG,
+ StartSid: PSID,
+ RestartScan: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwQuerySection(
+ SectionHandle: HANDLE,
+ SectionInformationClass: SECTION_INFORMATION_CLASS,
+ SectionInformation: PVOID,
+ SectionInformationLength: SIZE_T,
+ ReturnLength: PSIZE_T,
+ ) -> NTSTATUS;
+ fn ZwQuerySecurityAttributesToken(
+ TokenHandle: HANDLE,
+ Attributes: PUNICODE_STRING,
+ NumberOfAttributes: ULONG,
+ Buffer: PVOID,
+ Length: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQuerySecurityObject(
+ Handle: HANDLE,
+ SecurityInformation: SECURITY_INFORMATION,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ Length: ULONG,
+ LengthNeeded: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQuerySemaphore(
+ SemaphoreHandle: HANDLE,
+ SemaphoreInformationClass: SEMAPHORE_INFORMATION_CLASS,
+ SemaphoreInformation: PVOID,
+ SemaphoreInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQuerySymbolicLinkObject(
+ LinkHandle: HANDLE,
+ LinkTarget: PUNICODE_STRING,
+ ReturnedLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQuerySystemEnvironmentValue(
+ VariableName: PUNICODE_STRING,
+ VariableValue: PWSTR,
+ ValueLength: USHORT,
+ ReturnLength: PUSHORT,
+ ) -> NTSTATUS;
+ fn ZwQuerySystemEnvironmentValueEx(
+ VariableName: PUNICODE_STRING,
+ VendorGuid: LPGUID,
+ Value: PVOID,
+ ValueLength: PULONG,
+ Attributes: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQuerySystemInformation(
+ SystemInformationClass: SYSTEM_INFORMATION_CLASS,
+ SystemInformation: PVOID,
+ SystemInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQuerySystemInformationEx(
+ SystemInformationClass: SYSTEM_INFORMATION_CLASS,
+ InputBuffer: PVOID,
+ InputBufferLength: ULONG,
+ SystemInformation: PVOID,
+ SystemInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQuerySystemTime(
+ SystemTime: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwQueryTimer(
+ TimerHandle: HANDLE,
+ TimerInformationClass: TIMER_INFORMATION_CLASS,
+ TimerInformation: PVOID,
+ TimerInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryTimerResolution(
+ MaximumTime: PULONG,
+ MinimumTime: PULONG,
+ CurrentTime: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryValueKey(
+ KeyHandle: HANDLE,
+ ValueName: PUNICODE_STRING,
+ KeyValueInformationClass: KEY_VALUE_INFORMATION_CLASS,
+ KeyValueInformation: PVOID,
+ Length: ULONG,
+ ResultLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: PVOID,
+ MemoryInformationClass: MEMORY_INFORMATION_CLASS,
+ MemoryInformation: PVOID,
+ MemoryInformationLength: SIZE_T,
+ ReturnLength: PSIZE_T,
+ ) -> NTSTATUS;
+ fn ZwQueryVolumeInformationFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ FsInformation: PVOID,
+ Length: ULONG,
+ FsInformationClass: FS_INFORMATION_CLASS,
+ ) -> NTSTATUS;
+ fn ZwQueryWnfStateData(
+ StateName: PCWNF_STATE_NAME,
+ TypeId: PCWNF_TYPE_ID,
+ ExplicitScope: *const VOID,
+ ChangeStamp: PWNF_CHANGE_STAMP,
+ Buffer: PVOID,
+ BufferSize: PULONG,
+ ) -> NTSTATUS;
+ fn ZwQueryWnfStateNameInformation(
+ StateName: PCWNF_STATE_NAME,
+ NameInfoClass: WNF_STATE_NAME_INFORMATION,
+ ExplicitScope: *const VOID,
+ InfoBuffer: PVOID,
+ InfoBufferSize: ULONG,
+ ) -> NTSTATUS;
+ fn ZwQueueApcThread(
+ ThreadHandle: HANDLE,
+ ApcRoutine: PPS_APC_ROUTINE,
+ ApcArgument1: PVOID,
+ ApcArgument2: PVOID,
+ ApcArgument3: PVOID,
+ ) -> NTSTATUS;
+ fn ZwQueueApcThreadEx(
+ ThreadHandle: HANDLE,
+ UserApcReserveHandle: HANDLE,
+ ApcRoutine: PPS_APC_ROUTINE,
+ ApcArgument1: PVOID,
+ ApcArgument2: PVOID,
+ ApcArgument3: PVOID,
+ ) -> NTSTATUS;
+ fn ZwRaiseException(
+ ExceptionRecord: PEXCEPTION_RECORD,
+ ContextRecord: PCONTEXT,
+ FirstChance: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwRaiseHardError(
+ ErrorStatus: NTSTATUS,
+ NumberOfParameters: ULONG,
+ UnicodeStringParameterMask: ULONG,
+ Parameters: PULONG_PTR,
+ ValidResponseOptions: ULONG,
+ Response: PULONG,
+ ) -> NTSTATUS;
+ fn ZwReadFile(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Buffer: PVOID,
+ Length: ULONG,
+ ByteOffset: PLARGE_INTEGER,
+ Key: PULONG,
+ ) -> NTSTATUS;
+ fn ZwReadFileScatter(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ SegmentArray: PFILE_SEGMENT_ELEMENT,
+ Length: ULONG,
+ ByteOffset: PLARGE_INTEGER,
+ Key: PULONG,
+ ) -> NTSTATUS;
+ fn ZwReadOnlyEnlistment(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwReadRequestData(
+ PortHandle: HANDLE,
+ Message: PPORT_MESSAGE,
+ DataEntryIndex: ULONG,
+ Buffer: PVOID,
+ BufferSize: SIZE_T,
+ NumberOfBytesRead: PSIZE_T,
+ ) -> NTSTATUS;
+ fn ZwReadVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: PVOID,
+ Buffer: PVOID,
+ BufferSize: SIZE_T,
+ NumberOfBytesRead: PSIZE_T,
+ ) -> NTSTATUS;
+ fn ZwRecoverEnlistment(
+ EnlistmentHandle: HANDLE,
+ EnlistmentKey: PVOID,
+ ) -> NTSTATUS;
+ fn ZwRecoverResourceManager(
+ ResourceManagerHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwRecoverTransactionManager(
+ TransactionManagerHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwRegisterProtocolAddressInformation(
+ ResourceManager: HANDLE,
+ ProtocolId: PCRM_PROTOCOL_ID,
+ ProtocolInformationSize: ULONG,
+ ProtocolInformation: PVOID,
+ CreateOptions: ULONG,
+ ) -> NTSTATUS;
+ fn ZwRegisterThreadTerminatePort(
+ PortHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwReleaseCMFViewOwnership() -> NTSTATUS;
+ fn ZwReleaseKeyedEvent(
+ KeyedEventHandle: HANDLE,
+ KeyValue: PVOID,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwReleaseMutant(
+ MutantHandle: HANDLE,
+ PreviousCount: PLONG,
+ ) -> NTSTATUS;
+ fn ZwReleaseSemaphore(
+ SemaphoreHandle: HANDLE,
+ ReleaseCount: LONG,
+ PreviousCount: PLONG,
+ ) -> NTSTATUS;
+ fn ZwReleaseWorkerFactoryWorker(
+ WorkerFactoryHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwRemoveIoCompletion(
+ IoCompletionHandle: HANDLE,
+ KeyContext: *mut PVOID,
+ ApcContext: *mut PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwRemoveIoCompletionEx(
+ IoCompletionHandle: HANDLE,
+ IoCompletionInformation: PFILE_IO_COMPLETION_INFORMATION,
+ Count: ULONG,
+ NumEntriesRemoved: PULONG,
+ Timeout: PLARGE_INTEGER,
+ Alertable: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwRemoveProcessDebug(
+ ProcessHandle: HANDLE,
+ DebugObjectHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwRenameKey(
+ KeyHandle: HANDLE,
+ NewName: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn ZwRenameTransactionManager(
+ LogFileName: PUNICODE_STRING,
+ ExistingTransactionManagerGuid: LPGUID,
+ ) -> NTSTATUS;
+ fn ZwReplaceKey(
+ NewFile: POBJECT_ATTRIBUTES,
+ TargetHandle: HANDLE,
+ OldFile: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwReplacePartitionUnit(
+ TargetInstancePath: PUNICODE_STRING,
+ SpareInstancePath: PUNICODE_STRING,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn ZwReplyPort(
+ PortHandle: HANDLE,
+ ReplyMessage: PPORT_MESSAGE,
+ ) -> NTSTATUS;
+ fn ZwReplyWaitReceivePort(
+ PortHandle: HANDLE,
+ PortContext: *mut PVOID,
+ ReplyMessage: PPORT_MESSAGE,
+ ReceiveMessage: PPORT_MESSAGE,
+ ) -> NTSTATUS;
+ fn ZwReplyWaitReceivePortEx(
+ PortHandle: HANDLE,
+ PortContext: *mut PVOID,
+ ReplyMessage: PPORT_MESSAGE,
+ ReceiveMessage: PPORT_MESSAGE,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwReplyWaitReplyPort(
+ PortHandle: HANDLE,
+ ReplyMessage: PPORT_MESSAGE,
+ ) -> NTSTATUS;
+ fn ZwRequestPort(
+ PortHandle: HANDLE,
+ RequestMessage: PPORT_MESSAGE,
+ ) -> NTSTATUS;
+ fn ZwRequestWaitReplyPort(
+ PortHandle: HANDLE,
+ RequestMessage: PPORT_MESSAGE,
+ ReplyMessage: PPORT_MESSAGE,
+ ) -> NTSTATUS;
+ fn ZwRequestWakeupLatency(
+ latency: LATENCY_TIME,
+ ) -> NTSTATUS;
+ fn ZwResetEvent(
+ EventHandle: HANDLE,
+ PreviousState: PLONG,
+ ) -> NTSTATUS;
+ fn ZwResetWriteWatch(
+ ProcessHandle: HANDLE,
+ BaseAddress: PVOID,
+ RegionSize: SIZE_T,
+ ) -> NTSTATUS;
+ fn ZwRestoreKey(
+ KeyHandle: HANDLE,
+ FileHandle: HANDLE,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn ZwResumeProcess(
+ ProcessHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwResumeThread(
+ ThreadHandle: HANDLE,
+ PreviousSuspendCount: PULONG,
+ ) -> NTSTATUS;
+ fn ZwRevertContainerImpersonation() -> NTSTATUS;
+ fn ZwRollbackComplete(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwRollbackEnlistment(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwRollbackTransaction(
+ TransactionHandle: HANDLE,
+ Wait: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwRollforwardTransactionManager(
+ TransactionManagerHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwSaveKey(
+ KeyHandle: HANDLE,
+ FileHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwSaveKeyEx(
+ KeyHandle: HANDLE,
+ FileHandle: HANDLE,
+ Format: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSaveMergedKeys(
+ HighPrecedenceKeyHandle: HANDLE,
+ LowPrecedenceKeyHandle: HANDLE,
+ FileHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwSecureConnectPort(
+ PortHandle: PHANDLE,
+ PortName: PUNICODE_STRING,
+ SecurityQos: PSECURITY_QUALITY_OF_SERVICE,
+ ClientView: PPORT_VIEW,
+ RequiredServerSid: PSID,
+ ServerView: PREMOTE_PORT_VIEW,
+ MaxMessageLength: PULONG,
+ ConnectionInformation: PVOID,
+ ConnectionInformationLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwSerializeBoot() -> NTSTATUS;
+ fn ZwSetBootEntryOrder(
+ Ids: PULONG,
+ Count: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetBootOptions(
+ BootOptions: PBOOT_OPTIONS,
+ FieldsToChange: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetCachedSigningLevel(
+ Flags: ULONG,
+ InputSigningLevel: SE_SIGNING_LEVEL,
+ SourceFiles: PHANDLE,
+ SourceFileCount: ULONG,
+ TargetFile: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwSetContextThread(
+ ThreadHandle: HANDLE,
+ ThreadContext: PCONTEXT,
+ ) -> NTSTATUS;
+ fn ZwSetDebugFilterState(
+ ComponentId: ULONG,
+ Level: ULONG,
+ State: BOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwSetDefaultHardErrorPort(
+ DefaultHardErrorPort: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwSetDefaultLocale(
+ UserProfile: BOOLEAN,
+ DefaultLocaleId: LCID,
+ ) -> NTSTATUS;
+ fn ZwSetDefaultUILanguage(
+ DefaultUILanguageId: LANGID,
+ ) -> NTSTATUS;
+ fn ZwSetDriverEntryOrder(
+ Ids: PULONG,
+ Count: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetEaFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Buffer: PVOID,
+ Length: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetEvent(
+ EventHandle: HANDLE,
+ PreviousState: PLONG,
+ ) -> NTSTATUS;
+ fn ZwSetEventBoostPriority(
+ EventHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwSetHighEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwSetHighWaitLowEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwSetIRTimer(
+ TimerHandle: HANDLE,
+ DueTime: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwSetInformationDebugObject(
+ DebugObjectHandle: HANDLE,
+ DebugObjectInformationClass: DEBUGOBJECTINFOCLASS,
+ DebugInformation: PVOID,
+ DebugInformationLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwSetInformationEnlistment(
+ EnlistmentHandle: HANDLE,
+ EnlistmentInformationClass: ENLISTMENT_INFORMATION_CLASS,
+ EnlistmentInformation: PVOID,
+ EnlistmentInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetInformationFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ FileInformation: PVOID,
+ Length: ULONG,
+ FileInformationClass: FILE_INFORMATION_CLASS,
+ ) -> NTSTATUS;
+ fn ZwSetInformationJobObject(
+ JobHandle: HANDLE,
+ JobObjectInformationClass: JOBOBJECTINFOCLASS,
+ JobObjectInformation: PVOID,
+ JobObjectInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetInformationKey(
+ KeyHandle: HANDLE,
+ KeySetInformationClass: KEY_SET_INFORMATION_CLASS,
+ KeySetInformation: PVOID,
+ KeySetInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetInformationObject(
+ Handle: HANDLE,
+ ObjectInformationClass: OBJECT_INFORMATION_CLASS,
+ ObjectInformation: PVOID,
+ ObjectInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetInformationProcess(
+ ProcessHandle: HANDLE,
+ ProcessInformationClass: PROCESSINFOCLASS,
+ ProcessInformation: PVOID,
+ ProcessInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetInformationResourceManager(
+ ResourceManagerHandle: HANDLE,
+ ResourceManagerInformationClass: RESOURCEMANAGER_INFORMATION_CLASS,
+ ResourceManagerInformation: PVOID,
+ ResourceManagerInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetInformationThread(
+ ThreadHandle: HANDLE,
+ ThreadInformationClass: THREADINFOCLASS,
+ ThreadInformation: PVOID,
+ ThreadInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetInformationToken(
+ TokenHandle: HANDLE,
+ TokenInformationClass: TOKEN_INFORMATION_CLASS,
+ TokenInformation: PVOID,
+ TokenInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetInformationTransaction(
+ TransactionHandle: HANDLE,
+ TransactionInformationClass: TRANSACTION_INFORMATION_CLASS,
+ TransactionInformation: PVOID,
+ TransactionInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetInformationTransactionManager(
+ TmHandle: HANDLE,
+ TransactionManagerInformationClass: TRANSACTIONMANAGER_INFORMATION_CLASS,
+ TransactionManagerInformation: PVOID,
+ TransactionManagerInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetInformationVirtualMemory(
+ ProcessHandle: HANDLE,
+ VmInformationClass: VIRTUAL_MEMORY_INFORMATION_CLASS,
+ NumberOfEntries: ULONG_PTR,
+ VirtualAddresses: PMEMORY_RANGE_ENTRY,
+ VmInformation: PVOID,
+ VmInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetInformationWorkerFactory(
+ WorkerFactoryHandle: HANDLE,
+ WorkerFactoryInformationClass: WORKERFACTORYINFOCLASS,
+ WorkerFactoryInformation: PVOID,
+ WorkerFactoryInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetIntervalProfile(
+ Interval: ULONG,
+ Source: KPROFILE_SOURCE,
+ ) -> NTSTATUS;
+ fn ZwSetIoCompletion(
+ IoCompletionHandle: HANDLE,
+ KeyContext: PVOID,
+ ApcContext: PVOID,
+ IoStatus: NTSTATUS,
+ IoStatusInformation: ULONG_PTR,
+ ) -> NTSTATUS;
+ fn ZwSetIoCompletionEx(
+ IoCompletionHandle: HANDLE,
+ IoCompletionPacketHandle: HANDLE,
+ KeyContext: PVOID,
+ ApcContext: PVOID,
+ IoStatus: NTSTATUS,
+ IoStatusInformation: ULONG_PTR,
+ ) -> NTSTATUS;
+ fn ZwSetLdtEntries(
+ Selector0: ULONG,
+ Entry0Low: ULONG,
+ Entry0Hi: ULONG,
+ Selector1: ULONG,
+ Entry1Low: ULONG,
+ Entry1Hi: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetLowEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwSetLowWaitHighEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwSetQuotaInformationFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Buffer: PVOID,
+ Length: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetSecurityObject(
+ Handle: HANDLE,
+ SecurityInformation: SECURITY_INFORMATION,
+ SecurityDescriptor: PSECURITY_DESCRIPTOR,
+ ) -> NTSTATUS;
+ fn ZwSetSystemEnvironmentValue(
+ VariableName: PUNICODE_STRING,
+ VariableValue: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn ZwSetSystemEnvironmentValueEx(
+ VariableName: PUNICODE_STRING,
+ VendorGuid: LPGUID,
+ Value: PVOID,
+ ValueLength: ULONG,
+ Attributes: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetSystemInformation(
+ SystemInformationClass: SYSTEM_INFORMATION_CLASS,
+ SystemInformation: PVOID,
+ SystemInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetSystemPowerState(
+ SystemAction: POWER_ACTION,
+ LightestSystemState: SYSTEM_POWER_STATE,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetSystemTime(
+ SystemTime: PLARGE_INTEGER,
+ PreviousTime: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwSetThreadExecutionState(
+ NewFlags: EXECUTION_STATE,
+ PreviousFlags: *mut EXECUTION_STATE,
+ ) -> NTSTATUS;
+ fn ZwSetTimer(
+ TimerHandle: HANDLE,
+ DueTime: PLARGE_INTEGER,
+ TimerApcRoutine: PTIMER_APC_ROUTINE,
+ TimerContext: PVOID,
+ ResumeTimer: BOOLEAN,
+ Period: LONG,
+ PreviousState: PBOOLEAN,
+ ) -> NTSTATUS;
+ fn ZwSetTimer2(
+ TimerHandle: HANDLE,
+ DueTime: PLARGE_INTEGER,
+ Period: PLARGE_INTEGER,
+ Parameters: PT2_SET_PARAMETERS,
+ ) -> NTSTATUS;
+ fn ZwSetTimerEx(
+ TimerHandle: HANDLE,
+ TimerSetInformationClass: TIMER_SET_INFORMATION_CLASS,
+ TimerSetInformation: PVOID,
+ TimerSetInformationLength: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetTimerResolution(
+ DesiredTime: ULONG,
+ SetResolution: BOOLEAN,
+ ActualTime: PULONG,
+ ) -> NTSTATUS;
+ fn ZwSetUuidSeed(
+ Seed: PCHAR,
+ ) -> NTSTATUS;
+ fn ZwSetValueKey(
+ KeyHandle: HANDLE,
+ ValueName: PUNICODE_STRING,
+ TitleIndex: ULONG,
+ Type: ULONG,
+ Data: PVOID,
+ DataSize: ULONG,
+ ) -> NTSTATUS;
+ fn ZwSetVolumeInformationFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ FsInformation: PVOID,
+ Length: ULONG,
+ FsInformationClass: FS_INFORMATION_CLASS,
+ ) -> NTSTATUS;
+ fn ZwSetWnfProcessNotificationEvent(
+ NotificationEvent: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwShutdownSystem(
+ Action: SHUTDOWN_ACTION,
+ ) -> NTSTATUS;
+ fn ZwShutdownWorkerFactory(
+ WorkerFactoryHandle: HANDLE,
+ PendingWorkerCount: *mut LONG,
+ ) -> NTSTATUS;
+ fn ZwSignalAndWaitForSingleObject(
+ SignalHandle: HANDLE,
+ WaitHandle: HANDLE,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwSinglePhaseReject(
+ EnlistmentHandle: HANDLE,
+ TmVirtualClock: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwStartProfile(
+ ProfileHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwStopProfile(
+ ProfileHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwSubscribeWnfStateChange(
+ StateName: PCWNF_STATE_NAME,
+ ChangeStamp: WNF_CHANGE_STAMP,
+ EventMask: ULONG,
+ SubscriptionId: PULONG64,
+ ) -> NTSTATUS;
+ fn ZwSuspendProcess(
+ ProcessHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwSuspendThread(
+ ThreadHandle: HANDLE,
+ PreviousSuspendCount: PULONG,
+ ) -> NTSTATUS;
+ fn ZwSystemDebugControl(
+ Command: SYSDBG_COMMAND,
+ InputBuffer: PVOID,
+ InputBufferLength: ULONG,
+ OutputBuffer: PVOID,
+ OutputBufferLength: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwTerminateJobObject(
+ JobHandle: HANDLE,
+ ExitStatus: NTSTATUS,
+ ) -> NTSTATUS;
+ fn ZwTerminateProcess(
+ ProcessHandle: HANDLE,
+ ExitStatus: NTSTATUS,
+ ) -> NTSTATUS;
+ fn ZwTerminateThread(
+ ThreadHandle: HANDLE,
+ ExitStatus: NTSTATUS,
+ ) -> NTSTATUS;
+ fn ZwTestAlert() -> NTSTATUS;
+ fn ZwThawRegistry() -> NTSTATUS;
+ fn ZwThawTransactions() -> NTSTATUS;
+ fn ZwTraceControl(
+ FunctionCode: ULONG,
+ InBuffer: PVOID,
+ InBufferLen: ULONG,
+ OutBuffer: PVOID,
+ OutBufferLen: ULONG,
+ ReturnLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwTraceEvent(
+ TraceHandle: HANDLE,
+ Flags: ULONG,
+ FieldSize: ULONG,
+ Fields: PVOID,
+ ) -> NTSTATUS;
+ fn ZwTranslateFilePath(
+ InputFilePath: PFILE_PATH,
+ OutputType: ULONG,
+ OutputFilePath: PFILE_PATH,
+ OutputFilePathLength: PULONG,
+ ) -> NTSTATUS;
+ fn ZwUmsThreadYield(
+ SchedulerParam: PVOID,
+ ) -> NTSTATUS;
+ fn ZwUnloadDriver(
+ DriverServiceName: PUNICODE_STRING,
+ ) -> NTSTATUS;
+ fn ZwUnloadKey(
+ TargetKey: POBJECT_ATTRIBUTES,
+ ) -> NTSTATUS;
+ fn ZwUnloadKey2(
+ TargetKey: POBJECT_ATTRIBUTES,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn ZwUnloadKeyEx(
+ TargetKey: POBJECT_ATTRIBUTES,
+ Event: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwUnlockFile(
+ FileHandle: HANDLE,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ ByteOffset: PLARGE_INTEGER,
+ Length: PLARGE_INTEGER,
+ Key: ULONG,
+ ) -> NTSTATUS;
+ fn ZwUnlockVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: *mut PVOID,
+ RegionSize: PSIZE_T,
+ MapType: ULONG,
+ ) -> NTSTATUS;
+ fn ZwUnmapViewOfSection(
+ ProcessHandle: HANDLE,
+ BaseAddress: PVOID,
+ ) -> NTSTATUS;
+ fn ZwUnmapViewOfSectionEx(
+ ProcessHandle: HANDLE,
+ BaseAddress: PVOID,
+ Flags: ULONG,
+ ) -> NTSTATUS;
+ fn ZwUnsubscribeWnfStateChange(
+ StateName: PCWNF_STATE_NAME,
+ ) -> NTSTATUS;
+ fn ZwUpdateWnfStateData(
+ StateName: PCWNF_STATE_NAME,
+ Buffer: *const VOID,
+ Length: ULONG,
+ TypeId: PCWNF_TYPE_ID,
+ ExplicitScope: *const VOID,
+ MatchingChangeStamp: WNF_CHANGE_STAMP,
+ CheckStamp: LOGICAL,
+ ) -> NTSTATUS;
+ fn ZwVdmControl(
+ Service: VDMSERVICECLASS,
+ ServiceData: PVOID,
+ ) -> NTSTATUS;
+ fn ZwWaitForAlertByThreadId(
+ Address: PVOID,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwWaitForDebugEvent(
+ DebugObjectHandle: HANDLE,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ WaitStateChange: PVOID,
+ ) -> NTSTATUS;
+ fn ZwWaitForKeyedEvent(
+ KeyedEventHandle: HANDLE,
+ KeyValue: PVOID,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwWaitForMultipleObjects(
+ Count: ULONG,
+ Handles: *mut HANDLE,
+ WaitType: WAIT_TYPE,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwWaitForMultipleObjects32(
+ Count: ULONG,
+ Handles: *mut LONG,
+ WaitType: WAIT_TYPE,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwWaitForSingleObject(
+ Handle: HANDLE,
+ Alertable: BOOLEAN,
+ Timeout: PLARGE_INTEGER,
+ ) -> NTSTATUS;
+ fn ZwWaitForWorkViaWorkerFactory(
+ WorkerFactoryHandle: HANDLE,
+ MiniPacket: *mut FILE_IO_COMPLETION_INFORMATION,
+ ) -> NTSTATUS;
+ fn ZwWaitHighEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwWaitLowEventPair(
+ EventPairHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwWorkerFactoryWorkerReady(
+ WorkerFactoryHandle: HANDLE,
+ ) -> NTSTATUS;
+ fn ZwWriteFile(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ Buffer: PVOID,
+ Length: ULONG,
+ ByteOffset: PLARGE_INTEGER,
+ Key: PULONG,
+ ) -> NTSTATUS;
+ fn ZwWriteFileGather(
+ FileHandle: HANDLE,
+ Event: HANDLE,
+ ApcRoutine: PIO_APC_ROUTINE,
+ ApcContext: PVOID,
+ IoStatusBlock: PIO_STATUS_BLOCK,
+ SegmentArray: PFILE_SEGMENT_ELEMENT,
+ Length: ULONG,
+ ByteOffset: PLARGE_INTEGER,
+ Key: PULONG,
+ ) -> NTSTATUS;
+ fn ZwWriteRequestData(
+ PortHandle: HANDLE,
+ Message: PPORT_MESSAGE,
+ DataEntryIndex: ULONG,
+ Buffer: PVOID,
+ BufferSize: SIZE_T,
+ NumberOfBytesWritten: PSIZE_T,
+ ) -> NTSTATUS;
+ fn ZwWriteVirtualMemory(
+ ProcessHandle: HANDLE,
+ BaseAddress: PVOID,
+ Buffer: PVOID,
+ BufferSize: SIZE_T,
+ NumberOfBytesWritten: PSIZE_T,
+ ) -> NTSTATUS;
+ fn ZwYieldExecution() -> NTSTATUS;
+}}
diff --git a/third_party/rust/ntapi/src/string.rs b/third_party/rust/ntapi/src/string.rs
new file mode 100644
index 0000000000..32bfa50246
--- /dev/null
+++ b/third_party/rust/ntapi/src/string.rs
@@ -0,0 +1,58 @@
+/// A wrapper over UTF16 string constants.
+pub struct UTF16Const(pub &'static [u16]);
+impl UTF16Const {
+ #[inline]
+ pub fn as_ptr(&self) -> *const u16 {
+ self.0.as_ptr()
+ }
+ #[inline]
+ pub fn as_mut_ptr(&self) -> *mut u16 {
+ self.0.as_ptr() as *mut u16
+ }
+ #[inline]
+ pub fn len(&self) -> usize {
+ self.0.len() - 1
+ }
+}
+impl AsRef<[u16]> for UTF16Const {
+ #[inline]
+ fn as_ref(&self) -> &[u16] {
+ &self.0[..self.len()]
+ }
+}
+impl Copy for UTF16Const {}
+impl Clone for UTF16Const {
+ #[inline]
+ fn clone(&self) -> UTF16Const { *self }
+}
+/// A wrapper over UTF8 string constants.
+pub struct UTF8Const(pub &'static str);
+impl UTF8Const {
+ #[inline]
+ pub fn as_ptr(&self) -> *const i8 {
+ self.0.as_ptr() as *const i8
+ }
+ #[inline]
+ pub fn as_mut_ptr(&self) -> *mut i8 {
+ self.0.as_ptr() as *mut i8
+ }
+ #[inline]
+ pub fn len(&self) -> usize {
+ self.0.len() - 1
+ }
+ #[inline]
+ pub fn as_str(&self) -> &str {
+ &self.0[..self.len()]
+ }
+}
+impl AsRef<str> for UTF8Const {
+ #[inline]
+ fn as_ref(&self) -> &str {
+ &self.0[..self.len()]
+ }
+}
+impl Copy for UTF8Const {}
+impl Clone for UTF8Const {
+ #[inline]
+ fn clone(&self) -> UTF8Const { *self }
+}
diff --git a/third_party/rust/ntapi/src/subprocesstag.rs b/third_party/rust/ntapi/src/subprocesstag.rs
new file mode 100644
index 0000000000..7c8d17ce4f
--- /dev/null
+++ b/third_party/rust/ntapi/src/subprocesstag.rs
@@ -0,0 +1,77 @@
+use winapi::shared::minwindef::DWORD;
+use winapi::shared::ntdef::{LPCWSTR, LPWSTR, PVOID};
+ENUM!{enum TAG_INFO_LEVEL {
+ eTagInfoLevelNameFromTag = 1,
+ eTagInfoLevelNamesReferencingModule = 2,
+ eTagInfoLevelNameTagMapping = 3,
+ eTagInfoLevelMax = 4,
+}}
+ENUM!{enum TAG_TYPE {
+ eTagTypeService = 1,
+ eTagTypeMax = 2,
+}}
+STRUCT!{struct TAG_INFO_NAME_FROM_TAG_IN_PARAMS {
+ dwPid: DWORD,
+ dwTag: DWORD,
+}}
+pub type PTAG_INFO_NAME_FROM_TAG_IN_PARAMS = *mut TAG_INFO_NAME_FROM_TAG_IN_PARAMS;
+STRUCT!{struct TAG_INFO_NAME_FROM_TAG_OUT_PARAMS {
+ eTagType: DWORD,
+ pszName: LPWSTR,
+}}
+pub type PTAG_INFO_NAME_FROM_TAG_OUT_PARAMS = *mut TAG_INFO_NAME_FROM_TAG_OUT_PARAMS;
+STRUCT!{struct TAG_INFO_NAME_FROM_TAG {
+ InParams: TAG_INFO_NAME_FROM_TAG_IN_PARAMS,
+ OutParams: TAG_INFO_NAME_FROM_TAG_OUT_PARAMS,
+}}
+pub type PTAG_INFO_NAME_FROM_TAG = *mut TAG_INFO_NAME_FROM_TAG;
+STRUCT!{struct TAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS {
+ dwPid: DWORD,
+ pszModule: LPWSTR,
+}}
+pub type PTAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS =
+ *mut TAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS;
+STRUCT!{struct TAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS {
+ eTagType: DWORD,
+ pmszNames: LPWSTR,
+}}
+pub type PTAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS =
+ *mut TAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS;
+STRUCT!{struct TAG_INFO_NAMES_REFERENCING_MODULE {
+ InParams: TAG_INFO_NAMES_REFERENCING_MODULE_IN_PARAMS,
+ OutParams: TAG_INFO_NAMES_REFERENCING_MODULE_OUT_PARAMS,
+}}
+pub type PTAG_INFO_NAMES_REFERENCING_MODULE = *mut TAG_INFO_NAMES_REFERENCING_MODULE;
+STRUCT!{struct TAG_INFO_NAME_TAG_MAPPING_IN_PARAMS {
+ dwPid: DWORD,
+}}
+pub type PTAG_INFO_NAME_TAG_MAPPING_IN_PARAMS = *mut TAG_INFO_NAME_TAG_MAPPING_IN_PARAMS;
+STRUCT!{struct TAG_INFO_NAME_TAG_MAPPING_ELEMENT {
+ eTagType: DWORD,
+ dwTag: DWORD,
+ pszName: LPWSTR,
+ pszGroupName: LPWSTR,
+}}
+pub type PTAG_INFO_NAME_TAG_MAPPING_ELEMENT = *mut TAG_INFO_NAME_TAG_MAPPING_ELEMENT;
+STRUCT!{struct TAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS {
+ cElements: DWORD,
+ pNameTagMappingElements: PTAG_INFO_NAME_TAG_MAPPING_ELEMENT,
+}}
+pub type PTAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS = *mut TAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS;
+STRUCT!{struct TAG_INFO_NAME_TAG_MAPPING {
+ InParams: TAG_INFO_NAME_TAG_MAPPING_IN_PARAMS,
+ pOutParams: PTAG_INFO_NAME_TAG_MAPPING_OUT_PARAMS,
+}}
+pub type PTAG_INFO_NAME_TAG_MAPPING = *mut TAG_INFO_NAME_TAG_MAPPING;
+EXTERN!{extern "system" {
+ fn I_QueryTagInformation(
+ pszMachineName: LPCWSTR,
+ eInfoLevel: TAG_INFO_LEVEL,
+ pTagInfo: PVOID,
+ ) -> DWORD;
+}}
+FN!{stdcall PQUERY_TAG_INFORMATION(
+ pszMachineName: LPCWSTR,
+ eInfoLevel: TAG_INFO_LEVEL,
+ pTagInfo: PVOID,
+) -> DWORD}
diff --git a/third_party/rust/ntapi/src/winapi_local.rs b/third_party/rust/ntapi/src/winapi_local.rs
new file mode 100644
index 0000000000..2aa6fdd1e2
--- /dev/null
+++ b/third_party/rust/ntapi/src/winapi_local.rs
@@ -0,0 +1 @@
+pub mod um;
diff --git a/third_party/rust/ntapi/src/winapi_local/um.rs b/third_party/rust/ntapi/src/winapi_local/um.rs
new file mode 100644
index 0000000000..5f862d511a
--- /dev/null
+++ b/third_party/rust/ntapi/src/winapi_local/um.rs
@@ -0,0 +1,2 @@
+pub(crate) mod winioctl;
+pub mod winnt;
diff --git a/third_party/rust/ntapi/src/winapi_local/um/winioctl.rs b/third_party/rust/ntapi/src/winapi_local/um/winioctl.rs
new file mode 100644
index 0000000000..da490269a0
--- /dev/null
+++ b/third_party/rust/ntapi/src/winapi_local/um/winioctl.rs
@@ -0,0 +1,4 @@
+#[inline]
+pub(crate) const fn CTL_CODE(DeviceType: u32, Function: u32, Method: u32, Access: u32) -> u32 {
+ (DeviceType << 16) | (Access << 14) | (Function << 2) | Method
+}
diff --git a/third_party/rust/ntapi/src/winapi_local/um/winnt.rs b/third_party/rust/ntapi/src/winapi_local/um/winnt.rs
new file mode 100644
index 0000000000..0c8efb2625
--- /dev/null
+++ b/third_party/rust/ntapi/src/winapi_local/um/winnt.rs
@@ -0,0 +1,71 @@
+use winapi::shared::basetsd::{DWORD64, SIZE_T, ULONG64};
+use winapi::shared::minwindef::DWORD;
+use winapi::um::winnt::{HANDLE, PVOID};
+#[doc(hidden)]
+#[inline]
+pub const fn UInt32x32To64(a: u32, b: u32) -> u64 {
+ a as u64 * b as u64
+}
+#[cfg(not(target_arch = "aarch64"))]
+IFDEF!{
+use core::arch::asm;
+use crate::ntpebteb::TEB;
+#[inline]
+pub unsafe fn __readfsdword(Offset: DWORD) -> DWORD {
+ let out: u32;
+ asm!(
+ "mov {:e}, fs:[{:e}]",
+ lateout(reg) out,
+ in(reg) Offset,
+ options(nostack, pure, readonly),
+ );
+ out
+}
+#[inline]
+#[cfg(target_pointer_width = "64")]
+pub unsafe fn __readgsqword(Offset: DWORD) -> DWORD64 {
+ let out: u64;
+ asm!(
+ "mov {}, gs:[{:e}]",
+ lateout(reg) out,
+ in(reg) Offset,
+ options(nostack, pure, readonly),
+ );
+ out
+}
+#[inline] #[allow(unused_unsafe)]
+pub unsafe fn NtCurrentTeb() -> *mut TEB {
+ use winapi::um::winnt::NT_TIB;
+ let teb_offset = FIELD_OFFSET!(NT_TIB, _Self) as u32;
+ #[cfg(target_arch = "x86_64")] {
+ __readgsqword(teb_offset) as *mut TEB
+ }
+ #[cfg(target_arch = "x86")] {
+ __readfsdword(teb_offset) as *mut TEB
+ }
+}
+}
+ENUM!{enum MEM_EXTENDED_PARAMETER_TYPE {
+ MemExtendedParameterInvalidType = 0,
+ MemExtendedParameterAddressRequirements = 1,
+ MemExtendedParameterNumaNode = 2,
+ MemExtendedParameterPartitionHandle = 3,
+ MemExtendedParameterMax = 4,
+}}
+pub type PMEM_EXTENDED_PARAMETER_TYPE = *mut MEM_EXTENDED_PARAMETER_TYPE;
+UNION!{union MEM_EXTENDED_PARAMETER_u {
+ ULong64: DWORD64,
+ Pointer: PVOID,
+ Size: SIZE_T,
+ Handle: HANDLE,
+ ULong: DWORD,
+}}
+STRUCT!{struct MEM_EXTENDED_PARAMETER {
+ BitFields: ULONG64,
+ u: MEM_EXTENDED_PARAMETER_u,
+}}
+BITFIELD!{MEM_EXTENDED_PARAMETER BitFields: ULONG64 [
+ Type set_Type[0..8],
+ Reserved set_Reserved[8..64],
+]}
+pub type PMEM_EXTENDED_PARAMETER = *mut MEM_EXTENDED_PARAMETER;
diff --git a/third_party/rust/ntapi/src/winsta.rs b/third_party/rust/ntapi/src/winsta.rs
new file mode 100644
index 0000000000..162316d060
--- /dev/null
+++ b/third_party/rust/ntapi/src/winsta.rs
@@ -0,0 +1,848 @@
+use core::ptr::null_mut;
+use crate::ntrtl::RTL_TIME_ZONE_INFORMATION;
+use winapi::shared::basetsd::SIZE_T;
+use winapi::shared::minwindef::{BYTE, DWORD, FILETIME};
+use winapi::shared::ntdef::{
+ BOOLEAN, CHAR, HANDLE, LARGE_INTEGER, LONG, PULONG, PVOID, PWSTR, UCHAR, ULONG, UNICODE_STRING,
+ USHORT, WCHAR,
+};
+use winapi::shared::windef::HWND;
+use winapi::um::winnt::{PSID, STANDARD_RIGHTS_REQUIRED};
+pub const WINSTATION_QUERY: u32 = 0x00000001;
+pub const WINSTATION_SET: u32 = 0x00000002;
+pub const WINSTATION_RESET: u32 = 0x00000004;
+pub const WINSTATION_VIRTUAL: u32 = 0x00000008;
+pub const WINSTATION_SHADOW: u32 = 0x00000010;
+pub const WINSTATION_LOGON: u32 = 0x00000020;
+pub const WINSTATION_LOGOFF: u32 = 0x00000040;
+pub const WINSTATION_MSG: u32 = 0x00000080;
+pub const WINSTATION_CONNECT: u32 = 0x00000100;
+pub const WINSTATION_DISCONNECT: u32 = 0x00000200;
+pub const WINSTATION_GUEST_ACCESS: u32 = WINSTATION_LOGON;
+pub const WINSTATION_CURRENT_GUEST_ACCESS: u32 = WINSTATION_VIRTUAL | WINSTATION_LOGOFF;
+pub const WINSTATION_USER_ACCESS: u32 =
+ WINSTATION_GUEST_ACCESS | WINSTATION_QUERY | WINSTATION_CONNECT;
+pub const WINSTATION_CURRENT_USER_ACCESS: u32 = WINSTATION_SET | WINSTATION_RESET
+ | WINSTATION_VIRTUAL | WINSTATION_LOGOFF | WINSTATION_DISCONNECT;
+pub const WINSTATION_ALL_ACCESS: u32 = STANDARD_RIGHTS_REQUIRED | WINSTATION_QUERY | WINSTATION_SET
+ | WINSTATION_RESET | WINSTATION_VIRTUAL | WINSTATION_SHADOW | WINSTATION_LOGON | WINSTATION_MSG
+ | WINSTATION_CONNECT | WINSTATION_DISCONNECT;
+pub const WDPREFIX_LENGTH: usize = 12;
+pub const CALLBACK_LENGTH: usize = 50;
+pub const DLLNAME_LENGTH: usize = 32;
+pub const CDNAME_LENGTH: usize = 32;
+pub const WDNAME_LENGTH: usize = 32;
+pub const PDNAME_LENGTH: usize = 32;
+pub const DEVICENAME_LENGTH: usize = 128;
+pub const MODEMNAME_LENGTH: usize = DEVICENAME_LENGTH;
+pub const STACK_ADDRESS_LENGTH: usize = 128;
+pub const MAX_BR_NAME: usize = 65;
+pub const DIRECTORY_LENGTH: usize = 256;
+pub const INITIALPROGRAM_LENGTH: usize = 256;
+pub const USERNAME_LENGTH: usize = 20;
+pub const DOMAIN_LENGTH: usize = 17;
+pub const PASSWORD_LENGTH: usize = 14;
+pub const NASISPECIFICNAME_LENGTH: usize = 14;
+pub const NASIUSERNAME_LENGTH: usize = 47;
+pub const NASIPASSWORD_LENGTH: usize = 24;
+pub const NASISESSIONNAME_LENGTH: usize = 16;
+pub const NASIFILESERVER_LENGTH: usize = 47;
+pub const CLIENTDATANAME_LENGTH: usize = 7;
+pub const CLIENTNAME_LENGTH: usize = 20;
+pub const CLIENTADDRESS_LENGTH: usize = 30;
+pub const IMEFILENAME_LENGTH: usize = 32;
+pub const CLIENTLICENSE_LENGTH: usize = 32;
+pub const CLIENTMODEM_LENGTH: usize = 40;
+pub const CLIENT_PRODUCT_ID_LENGTH: usize = 32;
+pub const MAX_COUNTER_EXTENSIONS: u32 = 2;
+pub const WINSTATIONNAME_LENGTH: usize = 32;
+pub const TERMSRV_TOTAL_SESSIONS: u32 = 1;
+pub const TERMSRV_DISC_SESSIONS: u32 = 2;
+pub const TERMSRV_RECON_SESSIONS: u32 = 3;
+pub const TERMSRV_CURRENT_ACTIVE_SESSIONS: u32 = 4;
+pub const TERMSRV_CURRENT_DISC_SESSIONS: u32 = 5;
+pub const TERMSRV_PENDING_SESSIONS: u32 = 6;
+pub const TERMSRV_SUCC_TOTAL_LOGONS: u32 = 7;
+pub const TERMSRV_SUCC_LOCAL_LOGONS: u32 = 8;
+pub const TERMSRV_SUCC_REMOTE_LOGONS: u32 = 9;
+pub const TERMSRV_SUCC_SESSION0_LOGONS: u32 = 10;
+pub const TERMSRV_CURRENT_TERMINATING_SESSIONS: u32 = 11;
+pub const TERMSRV_CURRENT_LOGGEDON_SESSIONS: u32 = 12;
+pub type PTS_TIME_ZONE_INFORMATION = *mut RTL_TIME_ZONE_INFORMATION;
+pub type TS_TIME_ZONE_INFORMATION = RTL_TIME_ZONE_INFORMATION;
+pub type WINSTATIONNAME = [WCHAR; WINSTATIONNAME_LENGTH + 1];
+STRUCT!{struct VARDATA_WIRE {
+ Size: USHORT,
+ Offset: USHORT,
+}}
+pub type PVARDATA_WIRE = *mut VARDATA_WIRE;
+ENUM!{enum WINSTATIONSTATECLASS {
+ State_Active = 0,
+ State_Connected = 1,
+ State_ConnectQuery = 2,
+ State_Shadow = 3,
+ State_Disconnected = 4,
+ State_Idle = 5,
+ State_Listen = 6,
+ State_Reset = 7,
+ State_Down = 8,
+ State_Init = 9,
+}}
+UNION!{union SESSIONIDW_u {
+ SessionId: ULONG,
+ LogonId: ULONG,
+}}
+STRUCT!{struct SESSIONIDW {
+ u: SESSIONIDW_u,
+ WinStationName: WINSTATIONNAME,
+ State: WINSTATIONSTATECLASS,
+}}
+pub type PSESSIONIDW = *mut SESSIONIDW;
+ENUM!{enum WINSTATIONINFOCLASS {
+ WinStationCreateData = 0,
+ WinStationConfiguration = 1,
+ WinStationPdParams = 2,
+ WinStationWd = 3,
+ WinStationPd = 4,
+ WinStationPrinter = 5,
+ WinStationClient = 6,
+ WinStationModules = 7,
+ WinStationInformation = 8,
+ WinStationTrace = 9,
+ WinStationBeep = 10,
+ WinStationEncryptionOff = 11,
+ WinStationEncryptionPerm = 12,
+ WinStationNtSecurity = 13,
+ WinStationUserToken = 14,
+ WinStationUnused1 = 15,
+ WinStationVideoData = 16,
+ WinStationInitialProgram = 17,
+ WinStationCd = 18,
+ WinStationSystemTrace = 19,
+ WinStationVirtualData = 20,
+ WinStationClientData = 21,
+ WinStationSecureDesktopEnter = 22,
+ WinStationSecureDesktopExit = 23,
+ WinStationLoadBalanceSessionTarget = 24,
+ WinStationLoadIndicator = 25,
+ WinStationShadowInfo = 26,
+ WinStationDigProductId = 27,
+ WinStationLockedState = 28,
+ WinStationRemoteAddress = 29,
+ WinStationIdleTime = 30,
+ WinStationLastReconnectType = 31,
+ WinStationDisallowAutoReconnect = 32,
+ WinStationMprNotifyInfo = 33,
+ WinStationExecSrvSystemPipe = 34,
+ WinStationSmartCardAutoLogon = 35,
+ WinStationIsAdminLoggedOn = 36,
+ WinStationReconnectedFromId = 37,
+ WinStationEffectsPolicy = 38,
+ WinStationType = 39,
+ WinStationInformationEx = 40,
+ WinStationValidationInfo = 41,
+}}
+STRUCT!{struct WINSTATIONCREATE {
+ Bitfields: ULONG,
+ MaxInstanceCount: ULONG,
+}}
+BITFIELD!{WINSTATIONCREATE Bitfields: ULONG [
+ fEnableWinStation set_fEnableWinStation[0..1],
+]}
+pub type PWINSTATIONCREATE = *mut WINSTATIONCREATE;
+STRUCT!{struct WINSTACONFIGWIRE {
+ Comment: [WCHAR; 61],
+ OEMId: [CHAR; 4],
+ UserConfig: VARDATA_WIRE,
+ NewFields: VARDATA_WIRE,
+}}
+pub type PWINSTACONFIGWIRE = *mut WINSTACONFIGWIRE;
+ENUM!{enum CALLBACKCLASS {
+ Callback_Disable = 0,
+ Callback_Roving = 1,
+ Callback_Fixed = 2,
+}}
+ENUM!{enum SHADOWCLASS {
+ Shadow_Disable = 0,
+ Shadow_EnableInputNotify = 1,
+ Shadow_EnableInputNoNotify = 2,
+ Shadow_EnableNoInputNotify = 3,
+ Shadow_EnableNoInputNoNotify = 4,
+}}
+STRUCT!{struct USERCONFIG {
+ Bitfields: ULONG,
+ Bitfields2: ULONG,
+ UserName: [WCHAR; USERNAME_LENGTH + 1],
+ Domain: [WCHAR; DOMAIN_LENGTH + 1],
+ Password: [WCHAR; PASSWORD_LENGTH + 1],
+ WorkDirectory: [WCHAR; DIRECTORY_LENGTH + 1],
+ InitialProgram: [WCHAR; INITIALPROGRAM_LENGTH + 1],
+ CallbackNumber: [WCHAR; CALLBACK_LENGTH + 1],
+ Callback: CALLBACKCLASS,
+ Shadow: SHADOWCLASS,
+ MaxConnectionTime: ULONG,
+ MaxDisconnectionTime: ULONG,
+ MaxIdleTime: ULONG,
+ KeyboardLayout: ULONG,
+ MinEncryptionLevel: BYTE,
+ NWLogonServer: [WCHAR; NASIFILESERVER_LENGTH + 1],
+ PublishedName: [WCHAR; MAX_BR_NAME],
+ WFProfilePath: [WCHAR; DIRECTORY_LENGTH + 1],
+ WFHomeDir: [WCHAR; DIRECTORY_LENGTH + 1],
+ WFHomeDirDrive: [WCHAR; 4],
+}}
+BITFIELD!{USERCONFIG Bitfields: ULONG [
+ fInheritAutoLogon set_fInheritAutoLogon[0..1],
+ fInheritResetBroken set_fInheritResetBroken[1..2],
+ fInheritReconnectSame set_fInheritReconnectSame[2..3],
+ fInheritInitialProgram set_fInheritInitialProgram[3..4],
+ fInheritCallback set_fInheritCallback[4..5],
+ fInheritCallbackNumber set_fInheritCallbackNumber[5..6],
+ fInheritShadow set_fInheritShadow[6..7],
+ fInheritMaxSessionTime set_fInheritMaxSessionTime[7..8],
+ fInheritMaxDisconnectionTime set_fInheritMaxDisconnectionTime[8..9],
+ fInheritMaxIdleTime set_fInheritMaxIdleTime[9..10],
+ fInheritAutoClient set_fInheritAutoClient[10..11],
+ fInheritSecurity set_fInheritSecurity[11..12],
+ fPromptForPassword set_fPromptForPassword[12..13],
+ fResetBroken set_fResetBroken[13..14],
+ fReconnectSame set_fReconnectSame[14..15],
+ fLogonDisabled set_fLogonDisabled[15..16],
+ fWallPaperDisabled set_fWallPaperDisabled[16..17],
+ fAutoClientDrives set_fAutoClientDrives[17..18],
+ fAutoClientLpts set_fAutoClientLpts[18..19],
+ fForceClientLptDef set_fForceClientLptDef[19..20],
+ fRequireEncryption set_fRequireEncryption[20..21],
+ fDisableEncryption set_fDisableEncryption[21..22],
+ fUnused1 set_fUnused1[22..23],
+ fHomeDirectoryMapRoot set_fHomeDirectoryMapRoot[23..24],
+ fUseDefaultGina set_fUseDefaultGina[24..25],
+ fCursorBlinkDisabled set_fCursorBlinkDisabled[25..26],
+ fPublishedApp set_fPublishedApp[26..27],
+ fHideTitleBar set_fHideTitleBar[27..28],
+ fMaximize set_fMaximize[28..29],
+ fDisableCpm set_fDisableCpm[29..30],
+ fDisableCdm set_fDisableCdm[30..31],
+ fDisableCcm set_fDisableCcm[31..32],
+]}
+BITFIELD!{USERCONFIG Bitfields2: ULONG [
+ fDisableLPT set_fDisableLPT[0..1],
+ fDisableClip set_fDisableClip[1..2],
+ fDisableExe set_fDisableExe[2..3],
+ fDisableCam set_fDisableCam[3..4],
+ fDisableAutoReconnect set_fDisableAutoReconnect[4..5],
+ ColorDepth set_ColorDepth[5..6],
+ fInheritColorDepth set_fInheritColorDepth[6..7],
+ fErrorInvalidProfile set_fErrorInvalidProfile[7..8],
+ fPasswordIsScPin set_fPasswordIsScPin[8..9],
+ fDisablePNPRedir set_fDisablePNPRedir[9..10],
+]}
+pub type PUSERCONFIG = *mut USERCONFIG;
+ENUM!{enum SDCLASS {
+ SdNone = 0,
+ SdConsole = 1,
+ SdNetwork = 2,
+ SdAsync = 3,
+ SdOemTransport = 4,
+}}
+pub type DEVICENAME = [WCHAR; DEVICENAME_LENGTH + 1];
+pub type MODEMNAME = [WCHAR; MODEMNAME_LENGTH + 1];
+pub type NASISPECIFICNAME = [WCHAR; NASISPECIFICNAME_LENGTH + 1];
+pub type NASIUSERNAME = [WCHAR; NASIUSERNAME_LENGTH + 1];
+pub type NASIPASSWORD = [WCHAR; NASIPASSWORD_LENGTH + 1];
+pub type NASISESIONNAME = [WCHAR; NASISESSIONNAME_LENGTH + 1];
+pub type NASIFILESERVER = [WCHAR; NASIFILESERVER_LENGTH + 1];
+pub type WDNAME = [WCHAR; WDNAME_LENGTH + 1];
+pub type WDPREFIX = [WCHAR; WDPREFIX_LENGTH + 1];
+pub type CDNAME = [WCHAR; CDNAME_LENGTH + 1];
+pub type DLLNAME = [WCHAR; DLLNAME_LENGTH + 1];
+pub type PDNAME = [WCHAR; PDNAME_LENGTH + 1];
+STRUCT!{struct NETWORKCONFIG {
+ LanAdapter: LONG,
+ NetworkName: DEVICENAME,
+ Flags: ULONG,
+}}
+pub type PNETWORKCONFIG = *mut NETWORKCONFIG;
+ENUM!{enum FLOWCONTROLCLASS {
+ FlowControl_None = 0,
+ FlowControl_Hardware = 1,
+ FlowControl_Software = 2,
+}}
+ENUM!{enum RECEIVEFLOWCONTROLCLASS {
+ ReceiveFlowControl_None = 0,
+ ReceiveFlowControl_RTS = 1,
+ ReceiveFlowControl_DTR = 2,
+}}
+ENUM!{enum TRANSMITFLOWCONTROLCLASS {
+ TransmitFlowControl_None = 0,
+ TransmitFlowControl_CTS = 1,
+ TransmitFlowControl_DSR = 2,
+}}
+ENUM!{enum ASYNCCONNECTCLASS {
+ Connect_CTS = 0,
+ Connect_DSR = 1,
+ Connect_RI = 2,
+ Connect_DCD = 3,
+ Connect_FirstChar = 4,
+ Connect_Perm = 5,
+}}
+STRUCT!{struct FLOWCONTROLCONFIG {
+ Bitfields: ULONG,
+ XonChar: CHAR,
+ XoffChar: CHAR,
+ Type: FLOWCONTROLCLASS,
+ HardwareReceive: RECEIVEFLOWCONTROLCLASS,
+ HardwareTransmit: TRANSMITFLOWCONTROLCLASS,
+}}
+BITFIELD!{FLOWCONTROLCONFIG Bitfields: ULONG [
+ fEnableSoftwareTx set_fEnableSoftwareTx[0..1],
+ fEnableSoftwareRx set_fEnableSoftwareRx[1..2],
+ fEnableDTR set_fEnableDTR[2..3],
+ fEnableRTS set_fEnableRTS[3..4],
+]}
+pub type PFLOWCONTROLCONFIG = *mut FLOWCONTROLCONFIG;
+STRUCT!{struct CONNECTCONFIG {
+ Type: ASYNCCONNECTCLASS,
+ Bitfields: ULONG,
+}}
+BITFIELD!{CONNECTCONFIG Bitfields: ULONG [
+ fEnableBreakDisconnect set_fEnableBreakDisconnect[0..1],
+]}
+pub type PCONNECTCONFIG = *mut CONNECTCONFIG;
+STRUCT!{struct ASYNCCONFIG {
+ DeviceName: DEVICENAME,
+ ModemName: MODEMNAME,
+ BaudRate: ULONG,
+ Parity: ULONG,
+ StopBits: ULONG,
+ ByteSize: ULONG,
+ Bitfields: ULONG,
+ FlowControl: FLOWCONTROLCONFIG,
+ Connect: CONNECTCONFIG,
+}}
+BITFIELD!{ASYNCCONFIG Bitfields: ULONG [
+ fEnableDsrSensitivity set_fEnableDsrSensitivity[0..1],
+ fConnectionDriver set_fConnectionDriver[1..2],
+]}
+pub type PASYNCCONFIG = *mut ASYNCCONFIG;
+STRUCT!{struct NASICONFIG {
+ SpecificName: NASISPECIFICNAME,
+ UserName: NASIUSERNAME,
+ PassWord: NASIPASSWORD,
+ SessionName: NASISESIONNAME,
+ FileServer: NASIFILESERVER,
+ GlobalSession: BOOLEAN,
+}}
+pub type PNASICONFIG = *mut NASICONFIG;
+STRUCT!{struct OEMTDCONFIG {
+ Adapter: LONG,
+ DeviceName: DEVICENAME,
+ Flags: ULONG,
+}}
+pub type POEMTDCONFIG = *mut OEMTDCONFIG;
+UNION!{union PDPARAMS_u {
+ Network: NETWORKCONFIG,
+ Async: ASYNCCONFIG,
+ Nasi: NASICONFIG,
+ OemTd: OEMTDCONFIG,
+}}
+STRUCT!{struct PDPARAMS {
+ SdClass: SDCLASS,
+ u: PDPARAMS_u,
+}}
+pub type PPDPARAMS = *mut PDPARAMS;
+STRUCT!{struct WDCONFIG {
+ WdName: WDNAME,
+ WdDLL: DLLNAME,
+ WsxDLL: DLLNAME,
+ WdFlag: ULONG,
+ WdInputBufferLength: ULONG,
+ CfgDLL: DLLNAME,
+ WdPrefix: WDPREFIX,
+}}
+pub type PWDCONFIG = *mut WDCONFIG;
+STRUCT!{struct PDCONFIG2 {
+ PdName: PDNAME,
+ SdClass: SDCLASS,
+ PdDLL: DLLNAME,
+ PdFlag: ULONG,
+ OutBufLength: ULONG,
+ OutBufCount: ULONG,
+ OutBufDelay: ULONG,
+ InteractiveDelay: ULONG,
+ PortNumber: ULONG,
+ KeepAliveTimeout: ULONG,
+}}
+pub type PPDCONFIG2 = *mut PDCONFIG2;
+STRUCT!{struct WINSTATIONCLIENT {
+ Bitfields: ULONG,
+ ClientName: [WCHAR; CLIENTNAME_LENGTH + 1],
+ Domain: [WCHAR; DOMAIN_LENGTH + 1],
+ UserName: [WCHAR; USERNAME_LENGTH + 1],
+ Password: [WCHAR; PASSWORD_LENGTH + 1],
+ WorkDirectory: [WCHAR; DIRECTORY_LENGTH + 1],
+ InitialProgram: [WCHAR; INITIALPROGRAM_LENGTH + 1],
+ SerialNumber: ULONG,
+ EncryptionLevel: BYTE,
+ ClientAddressFamily: ULONG,
+ ClientAddress: [WCHAR; CLIENTADDRESS_LENGTH + 1],
+ HRes: USHORT,
+ VRes: USHORT,
+ ColorDepth: USHORT,
+ ProtocolType: USHORT,
+ KeyboardLayout: ULONG,
+ KeyboardType: ULONG,
+ KeyboardSubType: ULONG,
+ KeyboardFunctionKey: ULONG,
+ ImeFileName: [WCHAR; IMEFILENAME_LENGTH + 1],
+ ClientDirectory: [WCHAR; DIRECTORY_LENGTH + 1],
+ ClientLicense: [WCHAR; CLIENTLICENSE_LENGTH + 1],
+ ClientModem: [WCHAR; CLIENTMODEM_LENGTH + 1],
+ ClientBuildNumber: ULONG,
+ ClientHardwareId: ULONG,
+ ClientProductId: USHORT,
+ OutBufCountHost: USHORT,
+ OutBufCountClient: USHORT,
+ OutBufLength: USHORT,
+ AudioDriverName: [WCHAR; 9],
+ ClientTimeZone: TS_TIME_ZONE_INFORMATION,
+ ClientSessionId: ULONG,
+ ClientDigProductId: [WCHAR; CLIENT_PRODUCT_ID_LENGTH],
+ PerformanceFlags: ULONG,
+ ActiveInputLocale: ULONG,
+}}
+BITFIELD!{WINSTATIONCLIENT Bitfields: ULONG [
+ fTextOnly set_fTextOnly[0..1],
+ fDisableCtrlAltDel set_fDisableCtrlAltDel[1..2],
+ fMouse set_fMouse[2..3],
+ fDoubleClickDetect set_fDoubleClickDetect[3..4],
+ fINetClient set_fINetClient[4..5],
+ fPromptForPassword set_fPromptForPassword[5..6],
+ fMaximizeShell set_fMaximizeShell[6..7],
+ fEnableWindowsKey set_fEnableWindowsKey[7..8],
+ fRemoteConsoleAudio set_fRemoteConsoleAudio[8..9],
+ fPasswordIsScPin set_fPasswordIsScPin[9..10],
+ fNoAudioPlayback set_fNoAudioPlayback[10..11],
+ fUsingSavedCreds set_fUsingSavedCreds[11..12],
+]}
+pub type PWINSTATIONCLIENT = *mut WINSTATIONCLIENT;
+STRUCT!{struct TSHARE_COUNTERS {
+ Reserved: ULONG,
+}}
+pub type PTSHARE_COUNTERS = *mut TSHARE_COUNTERS;
+UNION!{union PROTOCOLCOUNTERS_Specific {
+ TShareCounters: TSHARE_COUNTERS,
+ Reserved: [ULONG; 100],
+}}
+STRUCT!{struct PROTOCOLCOUNTERS {
+ WdBytes: ULONG,
+ WdFrames: ULONG,
+ WaitForOutBuf: ULONG,
+ Frames: ULONG,
+ Bytes: ULONG,
+ CompressedBytes: ULONG,
+ CompressFlushes: ULONG,
+ Errors: ULONG,
+ Timeouts: ULONG,
+ AsyncFramingError: ULONG,
+ AsyncOverrunError: ULONG,
+ AsyncOverflowError: ULONG,
+ AsyncParityError: ULONG,
+ TdErrors: ULONG,
+ ProtocolType: USHORT,
+ Length: USHORT,
+ Specific: PROTOCOLCOUNTERS_Specific,
+}}
+pub type PPROTOCOLCOUNTERS = *mut PROTOCOLCOUNTERS;
+STRUCT!{struct THINWIRECACHE {
+ CacheReads: ULONG,
+ CacheHits: ULONG,
+}}
+pub type PTHINWIRECACHE = *mut THINWIRECACHE;
+pub const MAX_THINWIRECACHE: usize = 4;
+STRUCT!{struct RESERVED_CACHE {
+ ThinWireCache: [THINWIRECACHE; MAX_THINWIRECACHE],
+}}
+pub type PRESERVED_CACHE = *mut RESERVED_CACHE;
+STRUCT!{struct TSHARE_CACHE {
+ Reserved: ULONG,
+}}
+pub type PTSHARE_CACHE = *mut TSHARE_CACHE;
+UNION!{union CACHE_STATISTICS_Specific {
+ ReservedCacheStats: RESERVED_CACHE,
+ TShareCacheStats: TSHARE_CACHE,
+ Reserved: [ULONG; 20],
+}}
+STRUCT!{struct CACHE_STATISTICS {
+ ProtocolType: USHORT,
+ Length: USHORT,
+ Specific: CACHE_STATISTICS_Specific,
+}}
+pub type PCACHE_STATISTICS = *mut CACHE_STATISTICS;
+STRUCT!{struct PROTOCOLSTATUS {
+ Output: PROTOCOLCOUNTERS,
+ Input: PROTOCOLCOUNTERS,
+ Cache: CACHE_STATISTICS,
+ AsyncSignal: ULONG,
+ AsyncSignalMask: ULONG,
+}}
+pub type PPROTOCOLSTATUS = *mut PROTOCOLSTATUS;
+STRUCT!{struct WINSTATIONINFORMATION {
+ ConnectState: WINSTATIONSTATECLASS,
+ WinStationName: WINSTATIONNAME,
+ LogonId: ULONG,
+ ConnectTime: LARGE_INTEGER,
+ DisconnectTime: LARGE_INTEGER,
+ LastInputTime: LARGE_INTEGER,
+ LogonTime: LARGE_INTEGER,
+ Status: PROTOCOLSTATUS,
+ Domain: [WCHAR; DOMAIN_LENGTH + 1],
+ UserName: [WCHAR; USERNAME_LENGTH + 1],
+ CurrentTime: LARGE_INTEGER,
+}}
+pub type PWINSTATIONINFORMATION = *mut WINSTATIONINFORMATION;
+STRUCT!{struct WINSTATIONUSERTOKEN {
+ ProcessId: HANDLE,
+ ThreadId: HANDLE,
+ UserToken: HANDLE,
+}}
+pub type PWINSTATIONUSERTOKEN = *mut WINSTATIONUSERTOKEN;
+STRUCT!{struct WINSTATIONVIDEODATA {
+ HResolution: USHORT,
+ VResolution: USHORT,
+ fColorDepth: USHORT,
+}}
+pub type PWINSTATIONVIDEODATA = *mut WINSTATIONVIDEODATA;
+ENUM!{enum CDCLASS {
+ CdNone = 0,
+ CdModem = 1,
+ CdClass_Maximum = 2,
+}}
+STRUCT!{struct CDCONFIG {
+ CdClass: CDCLASS,
+ CdName: CDNAME,
+ CdDLL: DLLNAME,
+ CdFlag: ULONG,
+}}
+pub type PCDCONFIG = *mut CDCONFIG;
+pub type CLIENTDATANAME = [CHAR; CLIENTDATANAME_LENGTH + 1];
+pub type PCLIENTDATANAME = *mut CHAR;
+STRUCT!{struct WINSTATIONCLIENTDATA {
+ DataName: CLIENTDATANAME,
+ fUnicodeData: BOOLEAN,
+}}
+pub type PWINSTATIONCLIENTDATA = *mut WINSTATIONCLIENTDATA;
+ENUM!{enum LOADFACTORTYPE {
+ ErrorConstraint = 0,
+ PagedPoolConstraint = 1,
+ NonPagedPoolConstraint = 2,
+ AvailablePagesConstraint = 3,
+ SystemPtesConstraint = 4,
+ CPUConstraint = 5,
+}}
+STRUCT!{struct WINSTATIONLOADINDICATORDATA {
+ RemainingSessionCapacity: ULONG,
+ LoadFactor: LOADFACTORTYPE,
+ TotalSessions: ULONG,
+ DisconnectedSessions: ULONG,
+ IdleCPU: LARGE_INTEGER,
+ TotalCPU: LARGE_INTEGER,
+ RawSessionCapacity: ULONG,
+ reserved: [ULONG; 9],
+}}
+pub type PWINSTATIONLOADINDICATORDATA = *mut WINSTATIONLOADINDICATORDATA;
+ENUM!{enum SHADOWSTATECLASS {
+ State_NoShadow = 0,
+ State_Shadowing = 1,
+ State_Shadowed = 2,
+}}
+STRUCT!{struct WINSTATIONSHADOW {
+ ShadowState: SHADOWSTATECLASS,
+ ShadowClass: SHADOWCLASS,
+ SessionId: ULONG,
+ ProtocolType: ULONG,
+}}
+pub type PWINSTATIONSHADOW = *mut WINSTATIONSHADOW;
+STRUCT!{struct WINSTATIONPRODID {
+ DigProductId: [WCHAR; CLIENT_PRODUCT_ID_LENGTH],
+ ClientDigProductId: [WCHAR; CLIENT_PRODUCT_ID_LENGTH],
+ OuterMostDigProductId: [WCHAR; CLIENT_PRODUCT_ID_LENGTH],
+ CurrentSessionId: ULONG,
+ ClientSessionId: ULONG,
+ OuterMostSessionId: ULONG,
+}}
+pub type PWINSTATIONPRODID = *mut WINSTATIONPRODID;
+STRUCT!{struct WINSTATIONREMOTEADDRESS_u_ipv4 {
+ sin_port: USHORT,
+ sin_addr: ULONG,
+ sin_zero: [UCHAR; 8],
+}}
+STRUCT!{struct WINSTATIONREMOTEADDRESS_u_ipv6 {
+ sin6_port: USHORT,
+ sin6_flowinfo: ULONG,
+ sin6_addr: [USHORT; 8],
+ sin6_scope_id: ULONG,
+}}
+UNION!{union WINSTATIONREMOTEADDRESS_u {
+ ipv4: WINSTATIONREMOTEADDRESS_u_ipv4,
+ ipv6: WINSTATIONREMOTEADDRESS_u_ipv6,
+}}
+STRUCT!{struct WINSTATIONREMOTEADDRESS {
+ sin_family: USHORT,
+ u: WINSTATIONREMOTEADDRESS_u,
+}}
+pub type PWINSTATIONREMOTEADDRESS = *mut WINSTATIONREMOTEADDRESS;
+STRUCT!{struct WINSTATIONINFORMATIONEX_LEVEL1 {
+ SessionId: ULONG,
+ SessionState: WINSTATIONSTATECLASS,
+ SessionFlags: LONG,
+ WinStationName: WINSTATIONNAME,
+ UserName: [WCHAR; USERNAME_LENGTH + 1],
+ DomainName: [WCHAR; DOMAIN_LENGTH + 1],
+ LogonTime: LARGE_INTEGER,
+ ConnectTime: LARGE_INTEGER,
+ DisconnectTime: LARGE_INTEGER,
+ LastInputTime: LARGE_INTEGER,
+ CurrentTime: LARGE_INTEGER,
+ ProtocolStatus: PROTOCOLSTATUS,
+}}
+pub type PWINSTATIONINFORMATIONEX_LEVEL1 = *mut WINSTATIONINFORMATIONEX_LEVEL1;
+STRUCT!{struct WINSTATIONINFORMATIONEX_LEVEL2 {
+ SessionId: ULONG,
+ SessionState: WINSTATIONSTATECLASS,
+ SessionFlags: LONG,
+ WinStationName: WINSTATIONNAME,
+ SamCompatibleUserName: [WCHAR; USERNAME_LENGTH + 1],
+ SamCompatibleDomainName: [WCHAR; DOMAIN_LENGTH + 1],
+ LogonTime: LARGE_INTEGER,
+ ConnectTime: LARGE_INTEGER,
+ DisconnectTime: LARGE_INTEGER,
+ LastInputTime: LARGE_INTEGER,
+ CurrentTime: LARGE_INTEGER,
+ ProtocolStatus: PROTOCOLSTATUS,
+ UserName: [WCHAR; 257],
+ DomainName: [WCHAR; 256],
+}}
+pub type PWINSTATIONINFORMATIONEX_LEVEL2 = *mut WINSTATIONINFORMATIONEX_LEVEL2;
+UNION!{union WINSTATIONINFORMATIONEX_LEVEL {
+ WinStationInfoExLevel1: WINSTATIONINFORMATIONEX_LEVEL1,
+ WinStationInfoExLevel2: WINSTATIONINFORMATIONEX_LEVEL2,
+}}
+pub type PWINSTATIONINFORMATIONEX_LEVEL = *mut WINSTATIONINFORMATIONEX_LEVEL;
+STRUCT!{struct WINSTATIONINFORMATIONEX {
+ Level: ULONG,
+ Data: WINSTATIONINFORMATIONEX_LEVEL,
+}}
+pub type PWINSTATIONINFORMATIONEX = *mut WINSTATIONINFORMATIONEX;
+pub const TS_PROCESS_INFO_MAGIC_NT4: u32 = 0x23495452;
+STRUCT!{struct TS_PROCESS_INFORMATION_NT4 {
+ MagicNumber: ULONG,
+ LogonId: ULONG,
+ ProcessSid: PVOID,
+ Pad: ULONG,
+}}
+pub type PTS_PROCESS_INFORMATION_NT4 = *mut TS_PROCESS_INFORMATION_NT4;
+pub const SIZEOF_TS4_SYSTEM_THREAD_INFORMATION: u32 = 64;
+pub const SIZEOF_TS4_SYSTEM_PROCESS_INFORMATION: u32 = 136;
+STRUCT!{struct TS_SYS_PROCESS_INFORMATION {
+ NextEntryOffset: ULONG,
+ NumberOfThreads: ULONG,
+ SpareLi1: LARGE_INTEGER,
+ SpareLi2: LARGE_INTEGER,
+ SpareLi3: LARGE_INTEGER,
+ CreateTime: LARGE_INTEGER,
+ UserTime: LARGE_INTEGER,
+ KernelTime: LARGE_INTEGER,
+ ImageName: UNICODE_STRING,
+ BasePriority: LONG,
+ UniqueProcessId: ULONG,
+ InheritedFromUniqueProcessId: ULONG,
+ HandleCount: ULONG,
+ SessionId: ULONG,
+ SpareUl3: ULONG,
+ PeakVirtualSize: SIZE_T,
+ VirtualSize: SIZE_T,
+ PageFaultCount: ULONG,
+ PeakWorkingSetSize: ULONG,
+ WorkingSetSize: ULONG,
+ QuotaPeakPagedPoolUsage: SIZE_T,
+ QuotaPagedPoolUsage: SIZE_T,
+ QuotaPeakNonPagedPoolUsage: SIZE_T,
+ QuotaNonPagedPoolUsage: SIZE_T,
+ PagefileUsage: SIZE_T,
+ PeakPagefileUsage: SIZE_T,
+ PrivatePageCount: SIZE_T,
+}}
+pub type PTS_SYS_PROCESS_INFORMATION = *mut TS_SYS_PROCESS_INFORMATION;
+STRUCT!{struct TS_ALL_PROCESSES_INFO {
+ pTsProcessInfo: PTS_SYS_PROCESS_INFORMATION,
+ SizeOfSid: ULONG,
+ pSid: PSID,
+}}
+pub type PTS_ALL_PROCESSES_INFO = *mut TS_ALL_PROCESSES_INFO;
+STRUCT!{struct TS_COUNTER_HEADER {
+ dwCounterID: DWORD,
+ bResult: BOOLEAN,
+}}
+pub type PTS_COUNTER_HEADER = *mut TS_COUNTER_HEADER;
+STRUCT!{struct TS_COUNTER {
+ CounterHead: TS_COUNTER_HEADER,
+ dwValue: DWORD,
+ StartTime: LARGE_INTEGER,
+}}
+pub type PTS_COUNTER = *mut TS_COUNTER;
+pub const WSD_LOGOFF: ULONG = 0x1;
+pub const WSD_SHUTDOWN: ULONG = 0x2;
+pub const WSD_REBOOT: ULONG = 0x4;
+pub const WSD_POWEROFF: ULONG = 0x8;
+pub const WEVENT_NONE: ULONG = 0x0;
+pub const WEVENT_CREATE: ULONG = 0x1;
+pub const WEVENT_DELETE: ULONG = 0x2;
+pub const WEVENT_RENAME: ULONG = 0x4;
+pub const WEVENT_CONNECT: ULONG = 0x8;
+pub const WEVENT_DISCONNECT: ULONG = 0x10;
+pub const WEVENT_LOGON: ULONG = 0x20;
+pub const WEVENT_LOGOFF: ULONG = 0x40;
+pub const WEVENT_STATECHANGE: ULONG = 0x80;
+pub const WEVENT_LICENSE: ULONG = 0x100;
+pub const WEVENT_ALL: ULONG = 0x7fffffff;
+pub const WEVENT_FLUSH: ULONG = 0x80000000;
+pub const KBDSHIFT: USHORT = 0x1;
+pub const KBDCTRL: USHORT = 0x2;
+pub const KBDALT: USHORT = 0x4;
+pub const WNOTIFY_ALL_SESSIONS: ULONG = 0x1;
+pub const LOGONID_CURRENT: i32 = -1;
+pub const SERVERNAME_CURRENT: PWSTR = null_mut();
+EXTERN!{extern "system" {
+ fn WinStationFreeMemory(
+ Buffer: PVOID,
+ ) -> BOOLEAN;
+ fn WinStationOpenServerW(
+ ServerName: PWSTR,
+ ) -> HANDLE;
+ fn WinStationCloseServer(
+ ServerHandle: HANDLE,
+ ) -> BOOLEAN;
+ fn WinStationServerPing(
+ ServerHandle: HANDLE,
+ ) -> BOOLEAN;
+ fn WinStationGetTermSrvCountersValue(
+ ServerHandle: HANDLE,
+ Count: ULONG,
+ Counters: PTS_COUNTER,
+ ) -> BOOLEAN;
+ fn WinStationShutdownSystem(
+ ServerHandle: HANDLE,
+ ShutdownFlags: ULONG,
+ ) -> BOOLEAN;
+ fn WinStationWaitSystemEvent(
+ ServerHandle: HANDLE,
+ EventMask: ULONG,
+ EventFlags: PULONG,
+ ) -> BOOLEAN;
+ fn WinStationRegisterConsoleNotification(
+ ServerHandle: HANDLE,
+ WindowHandle: HWND,
+ Flags: ULONG,
+ ) -> BOOLEAN;
+ fn WinStationUnRegisterConsoleNotification(
+ ServerHandle: HANDLE,
+ WindowHandle: HWND,
+ ) -> BOOLEAN;
+ fn WinStationEnumerateW(
+ ServerHandle: HANDLE,
+ SessionIds: *mut PSESSIONIDW,
+ Count: PULONG,
+ ) -> BOOLEAN;
+ fn WinStationQueryInformationW(
+ ServerHandle: HANDLE,
+ SessionId: ULONG,
+ WinStationInformationClass: WINSTATIONINFOCLASS,
+ pWinStationInformation: PVOID,
+ WinStationInformationLength: ULONG,
+ pReturnLength: PULONG,
+ ) -> BOOLEAN;
+ fn WinStationSetInformationW(
+ ServerHandle: HANDLE,
+ SessionId: ULONG,
+ WinStationInformationClass: WINSTATIONINFOCLASS,
+ pWinStationInformation: PVOID,
+ WinStationInformationLength: ULONG,
+ ) -> BOOLEAN;
+ fn WinStationNameFromLogonIdW(
+ ServerHandle: HANDLE,
+ SessionId: ULONG,
+ pWinStationName: PWSTR,
+ ) -> BOOLEAN;
+ fn WinStationSendMessageW(
+ ServerHandle: HANDLE,
+ SessionId: ULONG,
+ Title: PWSTR,
+ TitleLength: ULONG,
+ Message: PWSTR,
+ MessageLength: ULONG,
+ Style: ULONG,
+ Timeout: ULONG,
+ Response: PULONG,
+ DoNotWait: BOOLEAN,
+ ) -> BOOLEAN;
+ fn WinStationConnectW(
+ ServerHandle: HANDLE,
+ SessionId: ULONG,
+ TargetSessionId: ULONG,
+ pPassword: PWSTR,
+ bWait: BOOLEAN,
+ ) -> BOOLEAN;
+ fn WinStationDisconnect(
+ ServerHandle: HANDLE,
+ SessionId: ULONG,
+ bWait: BOOLEAN,
+ ) -> BOOLEAN;
+ fn WinStationReset(
+ ServerHandle: HANDLE,
+ SessionId: ULONG,
+ bWait: BOOLEAN,
+ ) -> BOOLEAN;
+ fn WinStationShadow(
+ ServerHandle: HANDLE,
+ TargetServerName: PWSTR,
+ TargetSessionId: ULONG,
+ HotKeyVk: UCHAR,
+ HotkeyModifiers: USHORT,
+ ) -> BOOLEAN;
+ fn WinStationShadowStop(
+ ServerHandle: HANDLE,
+ SessionId: ULONG,
+ bWait: BOOLEAN,
+ ) -> BOOLEAN;
+ fn WinStationEnumerateProcesses(
+ ServerHandle: HANDLE,
+ Processes: *mut PVOID,
+ ) -> BOOLEAN;
+ fn WinStationGetAllProcesses(
+ ServerHandle: HANDLE,
+ Level: ULONG,
+ NumberOfProcesses: PULONG,
+ Processes: *mut PTS_ALL_PROCESSES_INFO,
+ ) -> BOOLEAN;
+ fn WinStationFreeGAPMemory(
+ Level: ULONG,
+ Processes: PTS_ALL_PROCESSES_INFO,
+ NumberOfProcesses: ULONG,
+ ) -> BOOLEAN;
+ fn WinStationTerminateProcess(
+ ServerHandle: HANDLE,
+ ProcessId: ULONG,
+ ExitCode: ULONG,
+ ) -> BOOLEAN;
+ fn WinStationGetProcessSid(
+ ServerHandle: HANDLE,
+ ProcessId: ULONG,
+ ProcessStartTime: FILETIME,
+ pProcessUserSid: PVOID,
+ dwSidSize: PULONG,
+ ) -> BOOLEAN;
+ fn WinStationSwitchToServicesSession() -> BOOLEAN;
+ fn WinStationRevertFromServicesSession() -> BOOLEAN;
+ fn _WinStationWaitForConnect() -> BOOLEAN;
+}}