diff options
Diffstat (limited to 'third_party/rust/ntapi/src/ntrtl.rs')
| -rw-r--r-- | third_party/rust/ntapi/src/ntrtl.rs | 4373 |
1 files changed, 4373 insertions, 0 deletions
diff --git a/third_party/rust/ntapi/src/ntrtl.rs b/third_party/rust/ntapi/src/ntrtl.rs new file mode 100644 index 0000000000..abbc3862a6 --- /dev/null +++ b/third_party/rust/ntapi/src/ntrtl.rs @@ -0,0 +1,4373 @@ +use core::ptr::null_mut; +use crate::ntapi_base::{CLIENT_ID, PCLIENT_ID}; +use crate::ntexapi::{RTL_PROCESS_BACKTRACES, RTL_PROCESS_LOCKS}; +use crate::ntioapi::FILE_INFORMATION_CLASS; +use crate::ntldr::{RTL_PROCESS_MODULES, RTL_PROCESS_MODULE_INFORMATION_EX}; +use crate::ntmmapi::SECTION_IMAGE_INFORMATION; +use crate::ntnls::{PCPTABLEINFO, PNLSTABLEINFO}; +use crate::ntpebteb::{PPEB, PTEB_ACTIVE_FRAME}; +use crate::ntpsapi::{PINITIAL_TEB, PPS_APC_ROUTINE, PS_PROTECTION}; +use crate::ntapi_base::{PRTL_ATOM, RTL_ATOM}; +use crate::string::UTF16Const; +use winapi::ctypes::c_void; +use winapi::shared::basetsd::{PULONG64, ULONG32, ULONG64, PSIZE_T, PULONG_PTR, SIZE_T, ULONG_PTR}; +use winapi::shared::guiddef::GUID; +use winapi::shared::in6addr::in6_addr; +use winapi::shared::inaddr::in_addr; +use winapi::shared::minwindef::{BOOL, DWORD, PBOOL}; +#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))] +use winapi::shared::ntdef::{LARGE_INTEGER, RTL_BALANCED_NODE}; +use winapi::shared::ntdef::{ + BOOLEAN, CCHAR, CHAR, CLONG, CSHORT, HANDLE, LCID, LIST_ENTRY, LOGICAL, LONG, LUID, NTSTATUS, + PANSI_STRING, PBOOLEAN, PCANSI_STRING, PCCH, PCH, PCHAR, PCOEM_STRING, PCSZ, PCUNICODE_STRING, + PCWCH, PCWSTR, PHANDLE, PLARGE_INTEGER, PLCID, PLIST_ENTRY, PLONG, PLUID, PNT_PRODUCT_TYPE, + POEM_STRING, PPROCESSOR_NUMBER, PRTL_BALANCED_NODE, PSINGLE_LIST_ENTRY, PSTR, PSTRING, PUCHAR, + PULONG, PULONGLONG, PUNICODE_STRING, PUSHORT, PVOID, PWCH, PWCHAR, PWSTR, SINGLE_LIST_ENTRY, + STRING, UCHAR, ULONG, ULONGLONG, UNICODE_STRING, USHORT, VOID, WCHAR, +}; +use winapi::um::minwinbase::PTHREAD_START_ROUTINE; +#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))] +use winapi::um::winnt::{PGET_RUNTIME_FUNCTION_CALLBACK, PRUNTIME_FUNCTION, PWOW64_CONTEXT}; +use winapi::um::winnt::{ + ACCESS_MASK, ACL_INFORMATION_CLASS, APC_CALLBACK_FUNCTION, HEAP_INFORMATION_CLASS, + HEAP_REALLOC_IN_PLACE_ONLY, HEAP_ZERO_MEMORY, OS_DEPLOYEMENT_STATE_VALUES, PACCESS_MASK, PACL, + PCONTEXT, PEXCEPTION_POINTERS, PEXCEPTION_RECORD, PFLS_CALLBACK_FUNCTION, PGENERIC_MAPPING, + PIMAGE_NT_HEADERS, PIMAGE_SECTION_HEADER, PLUID_AND_ATTRIBUTES, PMESSAGE_RESOURCE_ENTRY, + PPERFORMANCE_DATA, PRTL_BARRIER, PRTL_CONDITION_VARIABLE, PRTL_CRITICAL_SECTION, + PRTL_OSVERSIONINFOEXW, PRTL_OSVERSIONINFOW, PRTL_RESOURCE_DEBUG, PRTL_SRWLOCK, + PSECURITY_DESCRIPTOR, PSECURITY_DESCRIPTOR_CONTROL, PSID, PSID_AND_ATTRIBUTES, + PSID_AND_ATTRIBUTES_HASH, PSID_IDENTIFIER_AUTHORITY, PVECTORED_EXCEPTION_HANDLER, + PXSAVE_AREA_HEADER, RTL_CRITICAL_SECTION, RTL_SRWLOCK, SECURITY_DESCRIPTOR_CONTROL, + SECURITY_IMPERSONATION_LEVEL, SECURITY_INFORMATION, WAITORTIMERCALLBACKFUNC, + WORKERCALLBACKFUNC, +}; +use winapi::vc::vadefs::va_list; +#[inline] +pub fn InitializeListHead(ListHead: &mut LIST_ENTRY) { + ListHead.Flink = ListHead; + ListHead.Blink = ListHead; +} +#[inline] +pub fn IsListEmpty(ListHead: &LIST_ENTRY) -> bool { + ListHead.Flink as *const _ == ListHead as *const _ +} +#[inline] +pub unsafe fn RemoveEntryList(Entry: &mut LIST_ENTRY) -> bool { + let (Blink, Flink) = (Entry.Blink, Entry.Flink); + (*Blink).Flink = Flink; + (*Flink).Blink = Blink; + Flink == Blink +} +#[inline] +pub unsafe fn RemoveHeadList(ListHead: &mut LIST_ENTRY) -> PLIST_ENTRY { + let Entry = ListHead.Flink; + let Flink = (*Entry).Flink; + ListHead.Flink = Flink; + (*Flink).Blink = ListHead; + Entry +} +#[inline] +pub unsafe fn RemoveTailList(ListHead: &mut LIST_ENTRY) -> PLIST_ENTRY { + let Entry = ListHead.Blink; + let Blink = (*Entry).Blink; + ListHead.Blink = Blink; + (*Blink).Flink = ListHead; + Entry +} +#[inline] +pub unsafe fn InsertTailList(ListHead: &mut LIST_ENTRY, Entry: &mut LIST_ENTRY) { + let Blink = ListHead.Blink; + Entry.Flink = ListHead; + Entry.Blink = Blink; + (*Blink).Flink = Entry; + ListHead.Blink = Entry; +} +#[inline] +pub unsafe fn InsertHeadList(ListHead: &mut LIST_ENTRY, Entry: &mut LIST_ENTRY) { + let Flink = ListHead.Flink; + Entry.Flink = Flink; + Entry.Blink = ListHead; + (*Flink).Blink = Entry; + ListHead.Flink = Entry; +} +#[inline] +pub unsafe fn AppendTailList(ListHead: &mut LIST_ENTRY, ListToAppend: &mut LIST_ENTRY) { + let ListEnd = ListHead.Blink; + (*ListHead.Blink).Flink = ListToAppend; + ListHead.Blink = ListToAppend.Blink; + (*ListToAppend.Blink).Flink = ListHead; + ListToAppend.Blink = ListEnd; +} +#[inline] +pub unsafe fn PopEntryList(ListHead: &mut SINGLE_LIST_ENTRY) -> PSINGLE_LIST_ENTRY { + let FirstEntry = ListHead.Next; + if !FirstEntry.is_null() { + ListHead.Next = (*FirstEntry).Next; + } + FirstEntry +} +#[inline] +pub fn PushEntryList(ListHead: &mut SINGLE_LIST_ENTRY, Entry: &mut SINGLE_LIST_ENTRY) { + Entry.Next = ListHead.Next; + ListHead.Next = Entry; +} +ENUM!{enum TABLE_SEARCH_RESULT { + TableEmptyTree = 0, + TableFoundNode = 1, + TableInsertAsLeft = 2, + TableInsertAsRight = 3, +}} +ENUM!{enum RTL_GENERIC_COMPARE_RESULTS { + GenericLessThan = 0, + GenericGreaterThan = 1, + GenericEqual = 2, +}} +FN!{stdcall PRTL_AVL_COMPARE_ROUTINE( + Table: *mut RTL_AVL_TABLE, + FirstStruct: PVOID, + SecondStruct: PVOID, +) -> RTL_GENERIC_COMPARE_RESULTS} +FN!{stdcall PRTL_AVL_ALLOCATE_ROUTINE( + Table: *mut RTL_AVL_TABLE, + ByteSize: CLONG, +) -> PVOID} +FN!{stdcall PRTL_AVL_FREE_ROUTINE( + Table: *mut RTL_AVL_TABLE, + Buffer: PVOID, +) -> ()} +FN!{stdcall PRTL_AVL_MATCH_FUNCTION( + Table: *mut RTL_AVL_TABLE, + UserData: PVOID, + MatchData: PVOID, +) -> NTSTATUS} +STRUCT!{struct RTL_BALANCED_LINKS { + Parent: *mut RTL_BALANCED_LINKS, + LeftChild: *mut RTL_BALANCED_LINKS, + RightChild: *mut RTL_BALANCED_LINKS, + Balance: CHAR, + Reserved: [UCHAR; 3], +}} +pub type PRTL_BALANCED_LINKS = *mut RTL_BALANCED_LINKS; +STRUCT!{struct RTL_AVL_TABLE { + BalancedRoot: RTL_BALANCED_LINKS, + OrderedPointer: PVOID, + WhichOrderedElement: ULONG, + NumberGenericTableElements: ULONG, + DepthOfTree: ULONG, + RestartKey: PRTL_BALANCED_LINKS, + DeleteCount: ULONG, + CompareRoutine: PRTL_AVL_COMPARE_ROUTINE, + AllocateRoutine: PRTL_AVL_ALLOCATE_ROUTINE, + FreeRoutine: PRTL_AVL_FREE_ROUTINE, + TableContext: PVOID, +}} +pub type PRTL_AVL_TABLE = *mut RTL_AVL_TABLE; +EXTERN!{extern "system" { + fn RtlInitializeGenericTableAvl( + Table: PRTL_AVL_TABLE, + CompareRoutine: PRTL_AVL_COMPARE_ROUTINE, + AllocateRoutine: PRTL_AVL_ALLOCATE_ROUTINE, + FreeRoutine: PRTL_AVL_FREE_ROUTINE, + TableContext: PVOID, + ); + fn RtlInsertElementGenericTableAvl( + Table: PRTL_AVL_TABLE, + Buffer: PVOID, + BufferSize: CLONG, + NewElement: PBOOLEAN, + ) -> PVOID; + fn RtlInsertElementGenericTableFullAvl( + Table: PRTL_AVL_TABLE, + Buffer: PVOID, + BufferSize: CLONG, + NewElement: PBOOLEAN, + NodeOrParent: PVOID, + SearchResult: TABLE_SEARCH_RESULT, + ) -> PVOID; + fn RtlDeleteElementGenericTableAvl( + Table: PRTL_AVL_TABLE, + Buffer: PVOID, + ) -> BOOLEAN; + fn RtlLookupElementGenericTableAvl( + Table: PRTL_AVL_TABLE, + Buffer: PVOID, + ) -> PVOID; + fn RtlLookupElementGenericTableFullAvl( + Table: PRTL_AVL_TABLE, + Buffer: PVOID, + NodeOrParent: *mut PVOID, + SearchResult: *mut TABLE_SEARCH_RESULT, + ) -> PVOID; + fn RtlEnumerateGenericTableAvl( + Table: PRTL_AVL_TABLE, + Restart: BOOLEAN, + ) -> PVOID; + fn RtlEnumerateGenericTableWithoutSplayingAvl( + Table: PRTL_AVL_TABLE, + RestartKey: *mut PVOID, + ) -> PVOID; + fn RtlLookupFirstMatchingElementGenericTableAvl( + Table: PRTL_AVL_TABLE, + Buffer: PVOID, + RestartKey: *mut PVOID, + ) -> PVOID; + fn RtlEnumerateGenericTableLikeADirectory( + Table: PRTL_AVL_TABLE, + MatchFunction: PRTL_AVL_MATCH_FUNCTION, + MatchData: PVOID, + NextFlag: ULONG, + RestartKey: *mut PVOID, + DeleteCount: PULONG, + Buffer: PVOID, + ) -> PVOID; + fn RtlGetElementGenericTableAvl( + Table: PRTL_AVL_TABLE, + I: ULONG, + ) -> PVOID; + fn RtlNumberGenericTableElementsAvl( + Table: PRTL_AVL_TABLE, + ) -> ULONG; + fn RtlIsGenericTableEmptyAvl( + Table: PRTL_AVL_TABLE, + ) -> BOOLEAN; +}} +STRUCT!{struct RTL_SPLAY_LINKS { + Parent: *mut RTL_SPLAY_LINKS, + LeftChild: *mut RTL_SPLAY_LINKS, + RightChild: *mut RTL_SPLAY_LINKS, +}} +pub type PRTL_SPLAY_LINKS = *mut RTL_SPLAY_LINKS; +#[inline] +pub fn RtlInitializeSplayLinks(Links: &mut RTL_SPLAY_LINKS) { + Links.Parent = Links; + Links.LeftChild = null_mut(); + Links.RightChild = null_mut(); +} +#[inline] +pub const fn RtlParent(Links: &RTL_SPLAY_LINKS) -> PRTL_SPLAY_LINKS { + Links.Parent +} +#[inline] +pub const fn RtlLeftChild(Links: &RTL_SPLAY_LINKS) -> PRTL_SPLAY_LINKS { + Links.LeftChild +} +#[inline] +pub const fn RtlRightChild(Links: &RTL_SPLAY_LINKS) -> PRTL_SPLAY_LINKS { + Links.RightChild +} +#[inline] +pub unsafe fn RtlIsRoot(Links: *const RTL_SPLAY_LINKS) -> bool { + (*Links).Parent as *const _ == Links +} +#[inline] +pub unsafe fn RtlIsLeftChild(Links: *const RTL_SPLAY_LINKS) -> bool { + RtlLeftChild(&*RtlParent(&*Links)) as *const _ == Links +} +#[inline] +pub unsafe fn RtlIsRightChild(Links: *const RTL_SPLAY_LINKS) -> bool { + RtlRightChild(&*RtlParent(&*Links)) as *const _ == Links +} +#[inline] +pub fn RtlInsertAsLeftChild( + ParentLinks: &mut RTL_SPLAY_LINKS, + ChildLinks: &mut RTL_SPLAY_LINKS, +) { + ParentLinks.LeftChild = ChildLinks; + ChildLinks.Parent = ParentLinks; +} +#[inline] +pub fn RtlInsertAsRightChild( + ParentLinks: &mut RTL_SPLAY_LINKS, + ChildLinks: &mut RTL_SPLAY_LINKS, +) { + ParentLinks.RightChild = ChildLinks; + ChildLinks.Parent = ParentLinks; +} +EXTERN!{extern "system" { + fn RtlSplay( + Links: PRTL_SPLAY_LINKS, + ) -> PRTL_SPLAY_LINKS; + fn RtlDelete( + Links: PRTL_SPLAY_LINKS, + ) -> PRTL_SPLAY_LINKS; + fn RtlDeleteNoSplay( + Links: PRTL_SPLAY_LINKS, + Root: *mut PRTL_SPLAY_LINKS, + ); + fn RtlSubtreeSuccessor( + Links: PRTL_SPLAY_LINKS, + ) -> PRTL_SPLAY_LINKS; + fn RtlSubtreePredecessor( + Links: PRTL_SPLAY_LINKS, + ) -> PRTL_SPLAY_LINKS; + fn RtlRealSuccessor( + Links: PRTL_SPLAY_LINKS, + ) -> PRTL_SPLAY_LINKS; + fn RtlRealPredecessor( + Links: PRTL_SPLAY_LINKS, + ) -> PRTL_SPLAY_LINKS; +}} +FN!{stdcall PRTL_GENERIC_COMPARE_ROUTINE( + Table: *mut RTL_GENERIC_TABLE, + FirstStruct: PVOID, + SecondStruct: PVOID, +) -> RTL_GENERIC_COMPARE_RESULTS} +FN!{stdcall PRTL_GENERIC_ALLOCATE_ROUTINE( + Table: *mut RTL_GENERIC_TABLE, + ByteSize: CLONG, +) -> PVOID} +FN!{stdcall PRTL_GENERIC_FREE_ROUTINE( + Table: *mut RTL_GENERIC_TABLE, + Buffer: PVOID, +) -> ()} +STRUCT!{struct RTL_GENERIC_TABLE { + TableRoot: PRTL_SPLAY_LINKS, + InsertOrderList: LIST_ENTRY, + OrderedPointer: PLIST_ENTRY, + WhichOrderedElement: ULONG, + NumberGenericTableElements: ULONG, + CompareRoutine: PRTL_GENERIC_COMPARE_ROUTINE, + AllocateRoutine: PRTL_GENERIC_ALLOCATE_ROUTINE, + FreeRoutine: PRTL_GENERIC_FREE_ROUTINE, + TableContext: PVOID, +}} +pub type PRTL_GENERIC_TABLE = *mut RTL_GENERIC_TABLE; +EXTERN!{extern "system" { + fn RtlInitializeGenericTable( + Table: PRTL_GENERIC_TABLE, + CompareRoutine: PRTL_GENERIC_COMPARE_ROUTINE, + AllocateRoutine: PRTL_GENERIC_ALLOCATE_ROUTINE, + FreeRoutine: PRTL_GENERIC_FREE_ROUTINE, + TableContext: PVOID, + ); + fn RtlInsertElementGenericTable( + Table: PRTL_GENERIC_TABLE, + Buffer: PVOID, + BufferSize: CLONG, + NewElement: PBOOLEAN, + ) -> PVOID; + fn RtlInsertElementGenericTableFull( + Table: PRTL_GENERIC_TABLE, + Buffer: PVOID, + BufferSize: CLONG, + NewElement: PBOOLEAN, + NodeOrParent: PVOID, + SearchResult: TABLE_SEARCH_RESULT, + ) -> PVOID; + fn RtlDeleteElementGenericTable( + Table: PRTL_GENERIC_TABLE, + Buffer: PVOID, + ) -> BOOLEAN; + fn RtlLookupElementGenericTable( + Table: PRTL_GENERIC_TABLE, + Buffer: PVOID, + ) -> PVOID; + fn RtlLookupElementGenericTableFull( + Table: PRTL_GENERIC_TABLE, + Buffer: PVOID, + NodeOrParent: *mut PVOID, + SearchResult: *mut TABLE_SEARCH_RESULT, + ) -> PVOID; + fn RtlEnumerateGenericTable( + Table: PRTL_GENERIC_TABLE, + Restart: BOOLEAN, + ) -> PVOID; + fn RtlEnumerateGenericTableWithoutSplaying( + Table: PRTL_GENERIC_TABLE, + RestartKey: *mut PVOID, + ) -> PVOID; + fn RtlGetElementGenericTable( + Table: PRTL_GENERIC_TABLE, + I: ULONG, + ) -> PVOID; + fn RtlNumberGenericTableElements( + Table: PRTL_GENERIC_TABLE, + ) -> ULONG; + fn RtlIsGenericTableEmpty( + Table: PRTL_GENERIC_TABLE, + ) -> BOOLEAN; +}} +STRUCT!{struct RTL_RB_TREE { + Root: PRTL_BALANCED_NODE, + Min: PRTL_BALANCED_NODE, +}} +pub type PRTL_RB_TREE = *mut RTL_RB_TREE; +EXTERN!{extern "system" { + fn RtlRbInsertNodeEx( + Tree: PRTL_RB_TREE, + Parent: PRTL_BALANCED_NODE, + Right: BOOLEAN, + Node: PRTL_BALANCED_NODE, + ); + fn RtlRbRemoveNode( + Tree: PRTL_RB_TREE, + Node: PRTL_BALANCED_NODE, + ); +}} +pub const RTL_HASH_ALLOCATED_HEADER: u32 = 0x00000001; +pub const RTL_HASH_RESERVED_SIGNATURE: u32 = 0; +STRUCT!{struct RTL_DYNAMIC_HASH_TABLE_ENTRY { + Linkage: LIST_ENTRY, + Signature: ULONG_PTR, +}} +pub type PRTL_DYNAMIC_HASH_TABLE_ENTRY = *mut RTL_DYNAMIC_HASH_TABLE_ENTRY; +#[inline] +pub const fn HASH_ENTRY_KEY(x: &RTL_DYNAMIC_HASH_TABLE_ENTRY) -> ULONG_PTR { + x.Signature +} +STRUCT!{struct RTL_DYNAMIC_HASH_TABLE_CONTEXT { + ChainHead: PLIST_ENTRY, + PrevLinkage: PLIST_ENTRY, + Signature: ULONG_PTR, +}} +pub type PRTL_DYNAMIC_HASH_TABLE_CONTEXT = *mut RTL_DYNAMIC_HASH_TABLE_CONTEXT; +STRUCT!{struct RTL_DYNAMIC_HASH_TABLE_ENUMERATOR { + HashEntry: RTL_DYNAMIC_HASH_TABLE_ENTRY, + ChainHead: PLIST_ENTRY, + BucketIndex: ULONG, +}} +pub type PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR = *mut RTL_DYNAMIC_HASH_TABLE_ENUMERATOR; +STRUCT!{struct RTL_DYNAMIC_HASH_TABLE { + Flags: ULONG, + Shift: ULONG, + TableSize: ULONG, + Pivot: ULONG, + DivisorMask: ULONG, + NumEntries: ULONG, + NonEmptyBuckets: ULONG, + NumEnumerators: ULONG, + Directory: PVOID, +}} +pub type PRTL_DYNAMIC_HASH_TABLE = *mut RTL_DYNAMIC_HASH_TABLE; +#[inline] +pub fn RtlInitHashTableContext(Context: &mut RTL_DYNAMIC_HASH_TABLE_CONTEXT) { + Context.ChainHead = null_mut(); + Context.PrevLinkage = null_mut(); +} +#[inline] +pub fn RtlInitHashTableContextFromEnumerator( + Context: &mut RTL_DYNAMIC_HASH_TABLE_CONTEXT, + Enumerator: &RTL_DYNAMIC_HASH_TABLE_ENUMERATOR, +) { + Context.ChainHead = Enumerator.ChainHead; + Context.PrevLinkage = Enumerator.HashEntry.Linkage.Blink; +} +// RtlReleaseHashTableContext +#[inline] +pub const fn RtlTotalBucketsHashTable(HashTable: &RTL_DYNAMIC_HASH_TABLE) -> ULONG { + HashTable.TableSize +} +#[inline] +pub const fn RtlNonEmptyBucketsHashTable(HashTable: &RTL_DYNAMIC_HASH_TABLE) -> ULONG { + HashTable.NonEmptyBuckets +} +#[inline] +pub const fn RtlEmptyBucketsHashTable(HashTable: &RTL_DYNAMIC_HASH_TABLE) -> ULONG { + HashTable.TableSize - HashTable.NonEmptyBuckets +} +#[inline] +pub const fn RtlTotalEntriesHashTable(HashTable: &RTL_DYNAMIC_HASH_TABLE) -> ULONG { + HashTable.NumEntries +} +#[inline] +pub const fn RtlActiveEnumeratorsHashTable(HashTable: &RTL_DYNAMIC_HASH_TABLE) -> ULONG { + HashTable.NumEnumerators +} +EXTERN!{extern "system" { + fn RtlCreateHashTable( + HashTable: *mut PRTL_DYNAMIC_HASH_TABLE, + Shift: ULONG, + Flags: ULONG, + ) -> BOOLEAN; + fn RtlDeleteHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + ); + fn RtlInsertEntryHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + Entry: PRTL_DYNAMIC_HASH_TABLE_ENTRY, + Signature: ULONG_PTR, + Context: PRTL_DYNAMIC_HASH_TABLE_CONTEXT, + ) -> BOOLEAN; + fn RtlRemoveEntryHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + Entry: PRTL_DYNAMIC_HASH_TABLE_ENTRY, + Context: PRTL_DYNAMIC_HASH_TABLE_CONTEXT, + ) -> BOOLEAN; + fn RtlLookupEntryHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + Signature: ULONG_PTR, + Context: PRTL_DYNAMIC_HASH_TABLE_CONTEXT, + ) -> PRTL_DYNAMIC_HASH_TABLE_ENTRY; + fn RtlGetNextEntryHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + Context: PRTL_DYNAMIC_HASH_TABLE_CONTEXT, + ) -> PRTL_DYNAMIC_HASH_TABLE_ENTRY; + fn RtlInitEnumerationHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR, + ) -> BOOLEAN; + fn RtlEnumerateEntryHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR, + ) -> PRTL_DYNAMIC_HASH_TABLE_ENTRY; + fn RtlEndEnumerationHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR, + ); + fn RtlInitWeakEnumerationHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR, + ) -> BOOLEAN; + fn RtlWeaklyEnumerateEntryHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR, + ) -> PRTL_DYNAMIC_HASH_TABLE_ENTRY; + fn RtlEndWeakEnumerationHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR, + ); + fn RtlExpandHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + ) -> BOOLEAN; + fn RtlContractHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + ) -> BOOLEAN; + fn RtlInitStrongEnumerationHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR, + ) -> BOOLEAN; + fn RtlStronglyEnumerateEntryHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR, + ) -> PRTL_DYNAMIC_HASH_TABLE_ENTRY; + fn RtlEndStrongEnumerationHashTable( + HashTable: PRTL_DYNAMIC_HASH_TABLE, + Enumerator: PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR, + ); + fn RtlInitializeCriticalSection( + CriticalSection: PRTL_CRITICAL_SECTION, + ) -> NTSTATUS; + fn RtlInitializeCriticalSectionAndSpinCount( + CriticalSection: PRTL_CRITICAL_SECTION, + SpinCount: ULONG, + ) -> NTSTATUS; + fn RtlDeleteCriticalSection( + CriticalSection: PRTL_CRITICAL_SECTION, + ) -> NTSTATUS; + fn RtlEnterCriticalSection( + CriticalSection: PRTL_CRITICAL_SECTION, + ) -> NTSTATUS; + fn RtlLeaveCriticalSection( + CriticalSection: PRTL_CRITICAL_SECTION, + ) -> NTSTATUS; + fn RtlTryEnterCriticalSection( + CriticalSection: PRTL_CRITICAL_SECTION, + ) -> LOGICAL; + fn RtlIsCriticalSectionLocked( + CriticalSection: PRTL_CRITICAL_SECTION, + ) -> LOGICAL; + fn RtlIsCriticalSectionLockedByThread( + CriticalSection: PRTL_CRITICAL_SECTION, + ) -> LOGICAL; + fn RtlGetCriticalSectionRecursionCount( + CriticalSection: PRTL_CRITICAL_SECTION, + ) -> ULONG; + fn RtlSetCriticalSectionSpinCount( + CriticalSection: PRTL_CRITICAL_SECTION, + SpinCount: ULONG, + ) -> ULONG; + fn RtlQueryCriticalSectionOwner( + EventHandle: HANDLE, + ) -> HANDLE; + fn RtlCheckForOrphanedCriticalSections( + ThreadHandle: HANDLE, + ); +}} +STRUCT!{struct RTL_RESOURCE { + CriticalSection: RTL_CRITICAL_SECTION, + SharedSemaphore: HANDLE, + NumberOfWaitingShared: ULONG, + ExclusiveSemaphore: HANDLE, + NumberOfWaitingExclusive: ULONG, + NumberOfActive: LONG, + ExclusiveOwnerThread: HANDLE, + Flags: ULONG, + DebugInfo: PRTL_RESOURCE_DEBUG, +}} +pub type PRTL_RESOURCE = *mut RTL_RESOURCE; +pub const RTL_RESOURCE_FLAG_LONG_TERM: ULONG = 0x00000001; +EXTERN!{extern "system" { + fn RtlInitializeResource( + Resource: PRTL_RESOURCE, + ); + fn RtlDeleteResource( + Resource: PRTL_RESOURCE, + ); + fn RtlAcquireResourceShared( + Resource: PRTL_RESOURCE, + Wait: BOOLEAN, + ) -> BOOLEAN; + fn RtlAcquireResourceExclusive( + Resource: PRTL_RESOURCE, + Wait: BOOLEAN, + ) -> BOOLEAN; + fn RtlReleaseResource( + Resource: PRTL_RESOURCE, + ); + fn RtlConvertSharedToExclusive( + Resource: PRTL_RESOURCE, + ); + fn RtlConvertExclusiveToShared( + Resource: PRTL_RESOURCE, + ); + fn RtlInitializeSRWLock( + SRWLock: PRTL_SRWLOCK, + ); + fn RtlAcquireSRWLockExclusive( + SRWLock: PRTL_SRWLOCK, + ); + fn RtlAcquireSRWLockShared( + SRWLock: PRTL_SRWLOCK, + ); + fn RtlReleaseSRWLockExclusive( + SRWLock: PRTL_SRWLOCK, + ); + fn RtlReleaseSRWLockShared( + SRWLock: PRTL_SRWLOCK, + ); + fn RtlTryAcquireSRWLockExclusive( + SRWLock: PRTL_SRWLOCK, + ) -> BOOLEAN; + fn RtlTryAcquireSRWLockShared( + SRWLock: PRTL_SRWLOCK, + ) -> BOOLEAN; + fn RtlAcquireReleaseSRWLockExclusive( + SRWLock: PRTL_SRWLOCK, + ); + fn RtlInitializeConditionVariable( + ConditionVariable: PRTL_CONDITION_VARIABLE, + ); + fn RtlSleepConditionVariableCS( + ConditionVariable: PRTL_CONDITION_VARIABLE, + CriticalSection: PRTL_CRITICAL_SECTION, + Timeout: PLARGE_INTEGER, + ) -> NTSTATUS; + fn RtlSleepConditionVariableSRW( + ConditionVariable: PRTL_CONDITION_VARIABLE, + SRWLock: PRTL_SRWLOCK, + Timeout: PLARGE_INTEGER, + Flags: ULONG, + ) -> NTSTATUS; + fn RtlWakeConditionVariable( + ConditionVariable: PRTL_CONDITION_VARIABLE, + ); + fn RtlWakeAllConditionVariable( + ConditionVariable: PRTL_CONDITION_VARIABLE, + ); +}} +pub const RTL_BARRIER_FLAGS_SPIN_ONLY: ULONG = 0x00000001; +pub const RTL_BARRIER_FLAGS_BLOCK_ONLY: ULONG = 0x00000002; +pub const RTL_BARRIER_FLAGS_NO_DELETE: ULONG = 0x00000004; +EXTERN!{extern "system" { + fn RtlInitBarrier( + Barrier: PRTL_BARRIER, + TotalThreads: ULONG, + SpinCount: ULONG, + ) -> NTSTATUS; + fn RtlDeleteBarrier( + Barrier: PRTL_BARRIER, + ) -> NTSTATUS; + fn RtlBarrier( + Barrier: PRTL_BARRIER, + Flags: ULONG, + ) -> BOOLEAN; + fn RtlBarrierForDelete( + Barrier: PRTL_BARRIER, + Flags: ULONG, + ) -> BOOLEAN; + fn RtlWaitOnAddress( + Address: *mut VOID, + CompareAddress: PVOID, + AddressSize: SIZE_T, + Timeout: PLARGE_INTEGER, + ) -> NTSTATUS; + fn RtlWakeAddressAll( + Address: PVOID, + ); + fn RtlWakeAddressSingle( + Address: PVOID, + ); + fn RtlInitString( + DestinationString: PSTRING, + SourceString: PCSZ, + ); + fn RtlInitStringEx( + DestinationString: PSTRING, + SourceString: PCSZ, + ) -> NTSTATUS; + fn RtlInitAnsiString( + DestinationString: PANSI_STRING, + SourceString: PCSZ, + ); + fn RtlInitAnsiStringEx( + DestinationString: PANSI_STRING, + SourceString: PCSZ, + ) -> NTSTATUS; + fn RtlFreeAnsiString( + AnsiString: PANSI_STRING, + ); + fn RtlFreeOemString( + OemString: POEM_STRING, + ); + fn RtlCopyString( + DestinationString: PSTRING, + SourceString: *const STRING, + ); + fn RtlUpperChar( + Character: CHAR, + ) -> CHAR; + fn RtlCompareString( + String1: *const STRING, + String2: *const STRING, + CaseInSensitive: BOOLEAN, + ) -> LONG; + fn RtlEqualString( + String1: *const STRING, + String2: *const STRING, + CaseInSensitive: BOOLEAN, + ) -> BOOLEAN; + fn RtlPrefixString( + String1: *const STRING, + String2: *const STRING, + CaseInSensitive: BOOLEAN, + ) -> BOOLEAN; + fn RtlAppendStringToString( + Destination: PSTRING, + Source: *const STRING, + ) -> NTSTATUS; + fn RtlAppendAsciizToString( + Destination: PSTRING, + Source: PSTR, + ) -> NTSTATUS; + fn RtlUpperString( + DestinationString: PSTRING, + SourceString: *const STRING, + ); +}} +#[inline] +pub unsafe fn RtlIsNullOrEmptyUnicodeString(String: PUNICODE_STRING) -> bool { + String.is_null() || (*String).Length == 0 +} +#[inline] +pub fn RtlInitEmptyUnicodeString( + UnicodeString: &mut UNICODE_STRING, + Buffer: PWCHAR, + MaximumLength: USHORT, +) { + UnicodeString.Buffer = Buffer; + UnicodeString.MaximumLength = MaximumLength; + UnicodeString.Length = 0; +} +EXTERN!{extern "system" { + fn RtlInitUnicodeString( + DestinationString: PUNICODE_STRING, + SourceString: PCWSTR, + ); + fn RtlInitUnicodeStringEx( + DestinationString: PUNICODE_STRING, + SourceString: PCWSTR, + ) -> NTSTATUS; + fn RtlCreateUnicodeString( + DestinationString: PUNICODE_STRING, + SourceString: PCWSTR, + ) -> BOOLEAN; + fn RtlCreateUnicodeStringFromAsciiz( + DestinationString: PUNICODE_STRING, + SourceString: PSTR, + ) -> BOOLEAN; + fn RtlFreeUnicodeString( + UnicodeString: PUNICODE_STRING, + ); +}} +pub const RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE: ULONG = 0x00000001; +pub const RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING: ULONG = 0x00000002; +EXTERN!{extern "system" { + fn RtlDuplicateUnicodeString( + Flags: ULONG, + StringIn: PCUNICODE_STRING, + StringOut: PUNICODE_STRING, + ) -> NTSTATUS; + fn RtlCopyUnicodeString( + DestinationString: PUNICODE_STRING, + SourceString: PCUNICODE_STRING, + ); + fn RtlUpcaseUnicodeChar( + SourceCharacter: WCHAR, + ) -> WCHAR; + fn RtlDowncaseUnicodeChar( + SourceCharacter: WCHAR, + ) -> WCHAR; + fn RtlCompareUnicodeString( + String1: PCUNICODE_STRING, + String2: PCUNICODE_STRING, + CaseInSensitive: BOOLEAN, + ) -> LONG; + fn RtlCompareUnicodeStrings( + String1: PCWCH, + String1Length: SIZE_T, + String2: PCWCH, + String2Length: SIZE_T, + CaseInSensitive: BOOLEAN, + ) -> LONG; + fn RtlEqualUnicodeString( + String1: PCUNICODE_STRING, + String2: PCUNICODE_STRING, + CaseInSensitive: BOOLEAN, + ) -> BOOLEAN; +}} +pub const HASH_STRING_ALGORITHM_DEFAULT: ULONG = 0; +pub const HASH_STRING_ALGORITHM_X65599: ULONG = 1; +pub const HASH_STRING_ALGORITHM_INVALID: ULONG = 0xffffffff; +EXTERN!{extern "system" { + fn RtlHashUnicodeString( + String: PCUNICODE_STRING, + CaseInSensitive: BOOLEAN, + HashAlgorithm: ULONG, + HashValue: PULONG, + ) -> NTSTATUS; + fn RtlValidateUnicodeString( + Flags: ULONG, + String: PCUNICODE_STRING, + ) -> NTSTATUS; + fn RtlPrefixUnicodeString( + String1: PCUNICODE_STRING, + String2: PCUNICODE_STRING, + CaseInSensitive: BOOLEAN, + ) -> BOOLEAN; + fn RtlSuffixUnicodeString( + String1: PUNICODE_STRING, + String2: PUNICODE_STRING, + CaseInSensitive: BOOLEAN, + ) -> BOOLEAN; + fn RtlFindUnicodeSubstring( + FullString: PUNICODE_STRING, + SearchString: PUNICODE_STRING, + CaseInSensitive: BOOLEAN, + ) -> PWCHAR; +}} +pub const RTL_FIND_CHAR_IN_UNICODE_STRING_START_AT_END: ULONG = 0x00000001; +pub const RTL_FIND_CHAR_IN_UNICODE_STRING_COMPLEMENT_CHAR_SET: ULONG = 0x00000002; +pub const RTL_FIND_CHAR_IN_UNICODE_STRING_CASE_INSENSITIVE: ULONG = 0x00000004; +EXTERN!{extern "system" { + fn RtlFindCharInUnicodeString( + Flags: ULONG, + StringToSearch: PUNICODE_STRING, + CharSet: PUNICODE_STRING, + NonInclusivePrefixLength: PUSHORT, + ) -> NTSTATUS; + fn RtlAppendUnicodeStringToString( + Destination: PUNICODE_STRING, + Source: PCUNICODE_STRING, + ) -> NTSTATUS; + fn RtlAppendUnicodeToString( + Destination: PUNICODE_STRING, + Source: PCWSTR, + ) -> NTSTATUS; + fn RtlUpcaseUnicodeString( + DestinationString: PUNICODE_STRING, + SourceString: PCUNICODE_STRING, + AllocateDestinationString: BOOLEAN, + ) -> NTSTATUS; + fn RtlDowncaseUnicodeString( + DestinationString: PUNICODE_STRING, + SourceString: PCUNICODE_STRING, + AllocateDestinationString: BOOLEAN, + ) -> NTSTATUS; + fn RtlEraseUnicodeString( + String: PUNICODE_STRING, + ); + fn RtlAnsiStringToUnicodeString( + DestinationString: PUNICODE_STRING, + SourceString: PCANSI_STRING, + AllocateDestinationString: BOOLEAN, + ) -> NTSTATUS; + fn RtlUnicodeStringToAnsiString( + DestinationString: PANSI_STRING, + SourceString: PCUNICODE_STRING, + AllocateDestinationString: BOOLEAN, + ) -> NTSTATUS; + fn RtlAnsiCharToUnicodeChar( + SourceCharacter: *mut PUCHAR, + ) -> WCHAR; + fn RtlUpcaseUnicodeStringToAnsiString( + DestinationString: PANSI_STRING, + SourceString: PUNICODE_STRING, + AllocateDestinationString: BOOLEAN, + ) -> NTSTATUS; + fn RtlOemStringToUnicodeString( + DestinationString: PUNICODE_STRING, + SourceString: PCOEM_STRING, + AllocateDestinationString: BOOLEAN, + ) -> NTSTATUS; + fn RtlUnicodeStringToOemString( + DestinationString: POEM_STRING, + SourceString: PCUNICODE_STRING, + AllocateDestinationString: BOOLEAN, + ) -> NTSTATUS; + fn RtlUpcaseUnicodeStringToOemString( + DestinationString: POEM_STRING, + SourceString: PUNICODE_STRING, + AllocateDestinationString: BOOLEAN, + ) -> NTSTATUS; + fn RtlUnicodeStringToCountedOemString( + DestinationString: POEM_STRING, + SourceString: PCUNICODE_STRING, + AllocateDestinationString: BOOLEAN, + ) -> NTSTATUS; + fn RtlUpcaseUnicodeStringToCountedOemString( + DestinationString: POEM_STRING, + SourceString: PCUNICODE_STRING, + AllocateDestinationString: BOOLEAN, + ) -> NTSTATUS; + fn RtlMultiByteToUnicodeN( + UnicodeString: PWCH, + MaxBytesInUnicodeString: ULONG, + BytesInUnicodeString: PULONG, + MultiByteString: *const CHAR, + BytesInMultiByteString: ULONG, + ) -> NTSTATUS; + fn RtlMultiByteToUnicodeSize( + BytesInUnicodeString: PULONG, + MultiByteString: *const CHAR, + BytesInMultiByteString: ULONG, + ) -> NTSTATUS; + fn RtlUnicodeToMultiByteN( + MultiByteString: PCHAR, + MaxBytesInMultiByteString: ULONG, + BytesInMultiByteString: PULONG, + UnicodeString: PCWCH, + BytesInUnicodeString: ULONG, + ) -> NTSTATUS; + fn RtlUnicodeToMultiByteSize( + BytesInMultiByteString: PULONG, + UnicodeString: PCWCH, + BytesInUnicodeString: ULONG, + ) -> NTSTATUS; + fn RtlUpcaseUnicodeToMultiByteN( + MultiByteString: PCHAR, + MaxBytesInMultiByteString: ULONG, + BytesInMultiByteString: PULONG, + UnicodeString: PCWCH, + BytesInUnicodeString: ULONG, + ) -> NTSTATUS; + fn RtlOemToUnicodeN( + UnicodeString: PWCH, + MaxBytesInUnicodeString: ULONG, + BytesInUnicodeString: PULONG, + OemString: PCCH, + BytesInOemString: ULONG, + ) -> NTSTATUS; + fn RtlUnicodeToOemN( + OemString: PCHAR, + MaxBytesInOemString: ULONG, + BytesInOemString: PULONG, + UnicodeString: PCWCH, + BytesInUnicodeString: ULONG, + ) -> NTSTATUS; + fn RtlUpcaseUnicodeToOemN( + OemString: PCHAR, + MaxBytesInOemString: ULONG, + BytesInOemString: PULONG, + UnicodeString: PCWCH, + BytesInUnicodeString: ULONG, + ) -> NTSTATUS; + fn RtlConsoleMultiByteToUnicodeN( + UnicodeString: PWCH, + MaxBytesInUnicodeString: ULONG, + BytesInUnicodeString: PULONG, + MultiByteString: PCH, + BytesInMultiByteString: ULONG, + pdwSpecialChar: PULONG, + ) -> NTSTATUS; + fn RtlUTF8ToUnicodeN( + UnicodeStringDestination: PWSTR, + UnicodeStringMaxByteCount: ULONG, + UnicodeStringActualByteCount: PULONG, + UTF8StringSource: PCCH, + UTF8StringByteCount: ULONG, + ) -> NTSTATUS; + fn RtlUnicodeToUTF8N( + UTF8StringDestination: PCHAR, + UTF8StringMaxByteCount: ULONG, + UTF8StringActualByteCount: PULONG, + UnicodeStringSource: PCWCH, + UnicodeStringByteCount: ULONG, + ) -> NTSTATUS; + fn RtlCustomCPToUnicodeN( + CustomCP: PCPTABLEINFO, + UnicodeString: PWCH, + MaxBytesInUnicodeString: ULONG, + BytesInUnicodeString: PULONG, + CustomCPString: PCH, + BytesInCustomCPString: ULONG, + ) -> NTSTATUS; + fn RtlUnicodeToCustomCPN( + CustomCP: PCPTABLEINFO, + CustomCPString: PCH, + MaxBytesInCustomCPString: ULONG, + BytesInCustomCPString: PULONG, + UnicodeString: PWCH, + BytesInUnicodeString: ULONG, + ) -> NTSTATUS; + fn RtlUpcaseUnicodeToCustomCPN( + CustomCP: PCPTABLEINFO, + CustomCPString: PCH, + MaxBytesInCustomCPString: ULONG, + BytesInCustomCPString: PULONG, + UnicodeString: PWCH, + BytesInUnicodeString: ULONG, + ) -> NTSTATUS; + fn RtlInitCodePageTable( + TableBase: PUSHORT, + CodePageTable: PCPTABLEINFO, + ); + fn RtlInitNlsTables( + AnsiNlsBase: PUSHORT, + OemNlsBase: PUSHORT, + LanguageNlsBase: PUSHORT, + TableInfo: PNLSTABLEINFO, + ); + fn RtlResetRtlTranslations( + TableInfo: PNLSTABLEINFO, + ); + fn RtlIsTextUnicode( + Buffer: PVOID, + Size: ULONG, + Result: PULONG, + ) -> BOOLEAN; +}} +ENUM!{enum RTL_NORM_FORM { + NormOther = 0x0, + NormC = 0x1, + NormD = 0x2, + NormKC = 0x5, + NormKD = 0x6, + NormIdna = 0xd, + DisallowUnassigned = 0x100, + NormCDisallowUnassigned = 0x101, + NormDDisallowUnassigned = 0x102, + NormKCDisallowUnassigned = 0x105, + NormKDDisallowUnassigned = 0x106, + NormIdnaDisallowUnassigned = 0x10d, +}} +EXTERN!{extern "system" { + fn RtlNormalizeString( + NormForm: ULONG, + SourceString: PCWSTR, + SourceStringLength: LONG, + DestinationString: PWSTR, + DestinationStringLength: PLONG, + ) -> NTSTATUS; + fn RtlIsNormalizedString( + NormForm: ULONG, + SourceString: PCWSTR, + SourceStringLength: LONG, + Normalized: PBOOLEAN, + ) -> NTSTATUS; + fn RtlIsNameInExpression( + Expression: PUNICODE_STRING, + Name: PUNICODE_STRING, + IgnoreCase: BOOLEAN, + UpcaseTable: PWCH, + ) -> BOOLEAN; + fn RtlIsNameInUnUpcasedExpression( + Expression: PUNICODE_STRING, + Name: PUNICODE_STRING, + IgnoreCase: BOOLEAN, + UpcaseTable: PWCH, + ) -> BOOLEAN; + fn RtlEqualDomainName( + String1: PUNICODE_STRING, + String2: PUNICODE_STRING, + ) -> BOOLEAN; + fn RtlEqualComputerName( + String1: PUNICODE_STRING, + String2: PUNICODE_STRING, + ) -> BOOLEAN; + fn RtlDnsHostNameToComputerName( + ComputerNameString: PUNICODE_STRING, + DnsHostNameString: PUNICODE_STRING, + AllocateComputerNameString: BOOLEAN, + ) -> NTSTATUS; + fn RtlStringFromGUID( + Guid: *const GUID, + GuidString: PUNICODE_STRING, + ) -> NTSTATUS; + fn RtlStringFromGUIDEx( + Guid: *mut GUID, + GuidString: PUNICODE_STRING, + AllocateGuidString: BOOLEAN, + ) -> NTSTATUS; + fn RtlGUIDFromString( + GuidString: PCUNICODE_STRING, + Guid: *mut GUID, + ) -> NTSTATUS; + fn RtlCompareAltitudes( + Altitude1: PCUNICODE_STRING, + Altitude2: PCUNICODE_STRING, + ) -> LONG; + fn RtlIdnToAscii( + Flags: ULONG, + SourceString: PCWSTR, + SourceStringLength: LONG, + DestinationString: PWSTR, + DestinationStringLength: PLONG, + ) -> NTSTATUS; + fn RtlIdnToUnicode( + Flags: ULONG, + SourceString: PCWSTR, + SourceStringLength: LONG, + DestinationString: PWSTR, + DestinationStringLength: PLONG, + ) -> NTSTATUS; + fn RtlIdnToNameprepUnicode( + Flags: ULONG, + SourceString: PCWSTR, + SourceStringLength: LONG, + DestinationString: PWSTR, + DestinationStringLength: PLONG, + ) -> NTSTATUS; +}} +STRUCT!{struct PREFIX_TABLE_ENTRY { + NodeTypeCode: CSHORT, + NameLength: CSHORT, + NextPrefixTree: *mut PREFIX_TABLE_ENTRY, + Links: RTL_SPLAY_LINKS, + Prefix: PSTRING, +}} +pub type PPREFIX_TABLE_ENTRY = *mut PREFIX_TABLE_ENTRY; +STRUCT!{struct PREFIX_TABLE { + NodeTypeCode: CSHORT, + NameLength: CSHORT, + NextPrefixTree: PPREFIX_TABLE_ENTRY, +}} +pub type PPREFIX_TABLE = *mut PREFIX_TABLE; +EXTERN!{extern "system" { + fn PfxInitialize( + PrefixTable: PPREFIX_TABLE, + ); + fn PfxInsertPrefix( + PrefixTable: PPREFIX_TABLE, + Prefix: PSTRING, + PrefixTableEntry: PPREFIX_TABLE_ENTRY, + ) -> BOOLEAN; + fn PfxRemovePrefix( + PrefixTable: PPREFIX_TABLE, + PrefixTableEntry: PPREFIX_TABLE_ENTRY, + ); + fn PfxFindPrefix( + PrefixTable: PPREFIX_TABLE, + FullName: PSTRING, + ) -> PPREFIX_TABLE_ENTRY; +}} +STRUCT!{struct UNICODE_PREFIX_TABLE_ENTRY { + NodeTypeCode: CSHORT, + NameLength: CSHORT, + NextPrefixTree: *mut UNICODE_PREFIX_TABLE_ENTRY, + CaseMatch: *mut UNICODE_PREFIX_TABLE_ENTRY, + Links: RTL_SPLAY_LINKS, + Prefix: PUNICODE_STRING, +}} +pub type PUNICODE_PREFIX_TABLE_ENTRY = *mut UNICODE_PREFIX_TABLE_ENTRY; +STRUCT!{struct UNICODE_PREFIX_TABLE { + NodeTypeCode: CSHORT, + NameLength: CSHORT, + NextPrefixTree: PUNICODE_PREFIX_TABLE_ENTRY, + LastNextEntry: PUNICODE_PREFIX_TABLE_ENTRY, +}} +pub type PUNICODE_PREFIX_TABLE = *mut UNICODE_PREFIX_TABLE; +EXTERN!{extern "system" { + fn RtlInitializeUnicodePrefix( + PrefixTable: PUNICODE_PREFIX_TABLE, + ); + fn RtlInsertUnicodePrefix( + PrefixTable: PUNICODE_PREFIX_TABLE, + Prefix: PUNICODE_STRING, + PrefixTableEntry: PUNICODE_PREFIX_TABLE_ENTRY, + ) -> BOOLEAN; + fn RtlRemoveUnicodePrefix( + PrefixTable: PUNICODE_PREFIX_TABLE, + PrefixTableEntry: PUNICODE_PREFIX_TABLE_ENTRY, + ); + fn RtlFindUnicodePrefix( + PrefixTable: PUNICODE_PREFIX_TABLE, + FullName: PCUNICODE_STRING, + CaseInsensitiveIndex: ULONG, + ) -> PUNICODE_PREFIX_TABLE_ENTRY; + fn RtlNextUnicodePrefix( + PrefixTable: PUNICODE_PREFIX_TABLE, + Restart: BOOLEAN, + ) -> PUNICODE_PREFIX_TABLE_ENTRY; +}} +STRUCT!{struct COMPRESSED_DATA_INFO { + CompressionFormatAndEngine: USHORT, + CompressionUnitShift: UCHAR, + ChunkShift: UCHAR, + ClusterShift: UCHAR, + Reserved: UCHAR, + NumberOfChunks: USHORT, + CompressedChunkSizes: [ULONG; 1], +}} +pub type PCOMPRESSED_DATA_INFO = *mut COMPRESSED_DATA_INFO; +EXTERN!{extern "system" { + fn RtlGetCompressionWorkSpaceSize( + CompressionFormatAndEngine: USHORT, + CompressBufferWorkSpaceSize: PULONG, + CompressFragmentWorkSpaceSize: PULONG, + ) -> NTSTATUS; + fn RtlCompressBuffer( + CompressionFormatAndEngine: USHORT, + UncompressedBuffer: PUCHAR, + UncompressedBufferSize: ULONG, + CompressedBuffer: PUCHAR, + CompressedBufferSize: ULONG, + UncompressedChunkSize: ULONG, + FinalCompressedSize: PULONG, + WorkSpace: PVOID, + ) -> NTSTATUS; + fn RtlDecompressBuffer( + CompressionFormat: USHORT, + UncompressedBuffer: PUCHAR, + UncompressedBufferSize: ULONG, + CompressedBuffer: PUCHAR, + CompressedBufferSize: ULONG, + FinalUncompressedSize: PULONG, + ) -> NTSTATUS; + fn RtlDecompressBufferEx( + CompressionFormat: USHORT, + UncompressedBuffer: PUCHAR, + UncompressedBufferSize: ULONG, + CompressedBuffer: PUCHAR, + CompressedBufferSize: ULONG, + FinalUncompressedSize: PULONG, + WorkSpace: PVOID, + ) -> NTSTATUS; + fn RtlDecompressFragment( + CompressionFormat: USHORT, + UncompressedFragment: PUCHAR, + UncompressedFragmentSize: ULONG, + CompressedBuffer: PUCHAR, + CompressedBufferSize: ULONG, + FragmentOffset: ULONG, + FinalUncompressedSize: PULONG, + WorkSpace: PVOID, + ) -> NTSTATUS; + fn RtlDescribeChunk( + CompressionFormat: USHORT, + CompressedBuffer: *mut PUCHAR, + EndOfCompressedBufferPlus1: PUCHAR, + ChunkBuffer: *mut PUCHAR, + ChunkSize: PULONG, + ) -> NTSTATUS; + fn RtlReserveChunk( + CompressionFormat: USHORT, + CompressedBuffer: *mut PUCHAR, + EndOfCompressedBufferPlus1: PUCHAR, + ChunkBuffer: *mut PUCHAR, + ChunkSize: ULONG, + ) -> NTSTATUS; + fn RtlDecompressChunks( + UncompressedBuffer: PUCHAR, + UncompressedBufferSize: ULONG, + CompressedBuffer: PUCHAR, + CompressedBufferSize: ULONG, + CompressedTail: PUCHAR, + CompressedTailSize: ULONG, + CompressedDataInfo: PCOMPRESSED_DATA_INFO, + ) -> NTSTATUS; + fn RtlCompressChunks( + UncompressedBuffer: PUCHAR, + UncompressedBufferSize: ULONG, + CompressedBuffer: PUCHAR, + CompressedBufferSize: ULONG, + CompressedDataInfo: PCOMPRESSED_DATA_INFO, + CompressedDataInfoLength: ULONG, + WorkSpace: PVOID, + ) -> NTSTATUS; + fn RtlConvertLCIDToString( + LcidValue: LCID, + Base: ULONG, + Padding: ULONG, + pResultBuf: PWSTR, + Size: ULONG, + ) -> NTSTATUS; + fn RtlIsValidLocaleName( + LocaleName: PWSTR, + Flags: ULONG, + ) -> BOOLEAN; + fn RtlGetParentLocaleName( + LocaleName: PWSTR, + ParentLocaleName: PUNICODE_STRING, + Flags: ULONG, + AllocateDestinationString: BOOLEAN, + ) -> NTSTATUS; + fn RtlLcidToLocaleName( + lcid: LCID, + LocaleName: PUNICODE_STRING, + Flags: ULONG, + AllocateDestinationString: BOOLEAN, + ) -> NTSTATUS; + fn RtlLocaleNameToLcid( + LocaleName: PWSTR, + lcid: PLCID, + Flags: ULONG, + ) -> NTSTATUS; + fn RtlLCIDToCultureName( + Lcid: LCID, + String: PUNICODE_STRING, + ) -> BOOLEAN; + fn RtlCultureNameToLCID( + String: PUNICODE_STRING, + Lcid: PLCID, + ) -> BOOLEAN; + fn RtlCleanUpTEBLangLists(); + fn RtlGetLocaleFileMappingAddress( + BaseAddress: *mut PVOID, + DefaultLocaleId: PLCID, + DefaultCasingTableSize: PLARGE_INTEGER, + ) -> NTSTATUS; + fn RtlGetCurrentPeb() -> PPEB; + fn RtlAcquirePebLock(); + fn RtlReleasePebLock(); + fn RtlTryAcquirePebLock() -> LOGICAL; + fn RtlAllocateFromPeb( + Size: ULONG, + Block: *mut PVOID, + ) -> NTSTATUS; + fn RtlFreeToPeb( + Block: PVOID, + Size: ULONG, + ) -> NTSTATUS; +}} +pub const DOS_MAX_COMPONENT_LENGTH: u32 = 255; +pub const DOS_MAX_PATH_LENGTH: u32 = DOS_MAX_COMPONENT_LENGTH + 5; +STRUCT!{struct CURDIR { + DosPath: UNICODE_STRING, + Handle: HANDLE, +}} +pub type PCURDIR = *mut CURDIR; +pub const RTL_USER_PROC_CURDIR_CLOSE: u32 = 0x00000002; +pub const RTL_USER_PROC_CURDIR_INHERIT: u32 = 0x00000003; +STRUCT!{struct RTL_DRIVE_LETTER_CURDIR { + Flags: USHORT, + Length: USHORT, + TimeStamp: ULONG, + DosPath: STRING, +}} +pub type PRTL_DRIVE_LETTER_CURDIR = *mut RTL_DRIVE_LETTER_CURDIR; +pub const RTL_MAX_DRIVE_LETTERS: usize = 32; +pub const RTL_DRIVE_LETTER_VALID: USHORT = 0x0001; +STRUCT!{struct RTL_USER_PROCESS_PARAMETERS { + MaximumLength: ULONG, + Length: ULONG, + Flags: ULONG, + DebugFlags: ULONG, + ConsoleHandle: HANDLE, + ConsoleFlags: ULONG, + StandardInput: HANDLE, + StandardOutput: HANDLE, + StandardError: HANDLE, + CurrentDirectory: CURDIR, + DllPath: UNICODE_STRING, + ImagePathName: UNICODE_STRING, + CommandLine: UNICODE_STRING, + Environment: PVOID, + StartingX: ULONG, + StartingY: ULONG, + CountX: ULONG, + CountY: ULONG, + CountCharsX: ULONG, + CountCharsY: ULONG, + FillAttribute: ULONG, + WindowFlags: ULONG, + ShowWindowFlags: ULONG, + WindowTitle: UNICODE_STRING, + DesktopInfo: UNICODE_STRING, + ShellInfo: UNICODE_STRING, + RuntimeData: UNICODE_STRING, + CurrentDirectories: [RTL_DRIVE_LETTER_CURDIR; RTL_MAX_DRIVE_LETTERS], + EnvironmentSize: ULONG_PTR, + EnvironmentVersion: ULONG_PTR, + PackageDependencyData: PVOID, + ProcessGroupId: ULONG, + LoaderThreads: ULONG, +}} +pub type PRTL_USER_PROCESS_PARAMETERS = *mut RTL_USER_PROCESS_PARAMETERS; +pub const RTL_USER_PROC_PARAMS_NORMALIZED: ULONG = 0x00000001; +pub const RTL_USER_PROC_PROFILE_USER: ULONG = 0x00000002; +pub const RTL_USER_PROC_PROFILE_KERNEL: ULONG = 0x00000004; +pub const RTL_USER_PROC_PROFILE_SERVER: ULONG = 0x00000008; +pub const RTL_USER_PROC_RESERVE_1MB: ULONG = 0x00000020; +pub const RTL_USER_PROC_RESERVE_16MB: ULONG = 0x00000040; +pub const RTL_USER_PROC_CASE_SENSITIVE: ULONG = 0x00000080; +pub const RTL_USER_PROC_DISABLE_HEAP_DECOMMIT: ULONG = 0x00000100; +pub const RTL_USER_PROC_DLL_REDIRECTION_LOCAL: ULONG = 0x00001000; +pub const RTL_USER_PROC_APP_MANIFEST_PRESENT: ULONG = 0x00002000; +pub const RTL_USER_PROC_IMAGE_KEY_MISSING: ULONG = 0x00004000; +pub const RTL_USER_PROC_OPTIN_PROCESS: ULONG = 0x00020000; +EXTERN!{extern "system" { + fn RtlCreateProcessParameters( + pProcessParameters: *mut PRTL_USER_PROCESS_PARAMETERS, + ImagePathName: PUNICODE_STRING, + DllPath: PUNICODE_STRING, + CurrentDirectory: PUNICODE_STRING, + CommandLine: PUNICODE_STRING, + Environment: PVOID, + WindowTitle: PUNICODE_STRING, + DesktopInfo: PUNICODE_STRING, + ShellInfo: PUNICODE_STRING, + RuntimeData: PUNICODE_STRING, + ) -> NTSTATUS; + fn RtlCreateProcessParametersEx( + pProcessParameters: *mut PRTL_USER_PROCESS_PARAMETERS, + ImagePathName: PUNICODE_STRING, + DllPath: PUNICODE_STRING, + CurrentDirectory: PUNICODE_STRING, + CommandLine: PUNICODE_STRING, + Environment: PVOID, + WindowTitle: PUNICODE_STRING, + DesktopInfo: PUNICODE_STRING, + ShellInfo: PUNICODE_STRING, + RuntimeData: PUNICODE_STRING, + Flags: ULONG, + ) -> NTSTATUS; + fn RtlDestroyProcessParameters( + ProcessParameters: PRTL_USER_PROCESS_PARAMETERS, + ) -> NTSTATUS; + fn RtlNormalizeProcessParams( + ProcessParameters: PRTL_USER_PROCESS_PARAMETERS, + ) -> PRTL_USER_PROCESS_PARAMETERS; + fn RtlDeNormalizeProcessParams( + ProcessParameters: PRTL_USER_PROCESS_PARAMETERS, + ) -> PRTL_USER_PROCESS_PARAMETERS; +}} +STRUCT!{struct RTL_USER_PROCESS_INFORMATION { + Length: ULONG, + Process: HANDLE, + Thread: HANDLE, + ClientId: CLIENT_ID, + ImageInformation: SECTION_IMAGE_INFORMATION, +}} +pub type PRTL_USER_PROCESS_INFORMATION = *mut RTL_USER_PROCESS_INFORMATION; +EXTERN!{extern "system" { + fn RtlCreateUserProcess( + NtImagePathName: PUNICODE_STRING, + AttributesDeprecated: ULONG, + ProcessParameters: PRTL_USER_PROCESS_PARAMETERS, + ProcessSecurityDescriptor: PSECURITY_DESCRIPTOR, + ThreadSecurityDescriptor: PSECURITY_DESCRIPTOR, + ParentProcess: HANDLE, + InheritHandles: BOOLEAN, + DebugPort: HANDLE, + TokenHandle: HANDLE, + ProcessInformation: PRTL_USER_PROCESS_INFORMATION, + ) -> NTSTATUS; + fn RtlCreateUserProcessEx( + NtImagePathName: PUNICODE_STRING, + ProcessParameters: PRTL_USER_PROCESS_PARAMETERS, + InheritHandles: BOOLEAN, + Flags: ULONG, + ProcessInformation: PRTL_USER_PROCESS_INFORMATION, + ) -> NTSTATUS; + fn RtlExitUserProcess( + ExitStatus: NTSTATUS, + ); +}} +pub const RTL_CLONE_PROCESS_FLAGS_CREATE_SUSPENDED: ULONG = 0x00000001; +pub const RTL_CLONE_PROCESS_FLAGS_INHERIT_HANDLES: ULONG = 0x00000002; +pub const RTL_CLONE_PROCESS_FLAGS_NO_SYNCHRONIZE: ULONG = 0x00000004; +EXTERN!{extern "system" { + fn RtlCloneUserProcess( + ProcessFlags: ULONG, + ProcessSecurityDescriptor: PSECURITY_DESCRIPTOR, + ThreadSecurityDescriptor: PSECURITY_DESCRIPTOR, + DebugPort: HANDLE, + ProcessInformation: PRTL_USER_PROCESS_INFORMATION, + ) -> NTSTATUS; + fn RtlUpdateClonedCriticalSection( + CriticalSection: PRTL_CRITICAL_SECTION, + ); + fn RtlUpdateClonedSRWLock( + SRWLock: PRTL_SRWLOCK, + Shared: LOGICAL, + ); +}} +STRUCT!{struct RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION { + ReflectionProcessHandle: HANDLE, + ReflectionThreadHandle: HANDLE, + ReflectionClientId: CLIENT_ID, +}} +pub type PRTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION = + *mut RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION; +EXTERN!{extern "system" { + fn RtlCreateProcessReflection( + ProcessHandle: HANDLE, + Flags: ULONG, + StartRoutine: PVOID, + StartContext: PVOID, + EventHandle: HANDLE, + ReflectionInformation: PRTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION, + ) -> NTSTATUS; +}} +EXTERN!{extern "C" { + fn RtlSetProcessIsCritical( + NewValue: BOOLEAN, + OldValue: PBOOLEAN, + CheckFlag: BOOLEAN, + ) -> NTSTATUS; + fn RtlSetThreadIsCritical( + NewValue: BOOLEAN, + OldValue: PBOOLEAN, + CheckFlag: BOOLEAN, + ) -> NTSTATUS; +}} +EXTERN!{extern "system" { + fn RtlValidProcessProtection( + ProcessProtection: PS_PROTECTION, + ) -> BOOLEAN; + fn RtlTestProtectedAccess( + Source: PS_PROTECTION, + Target: PS_PROTECTION, + ) -> BOOLEAN; + fn RtlIsCurrentProcess( + ProcessHandle: HANDLE, + ) -> BOOLEAN; + fn RtlIsCurrentThread( + ThreadHandle: HANDLE, + ) -> BOOLEAN; +}} +FN!{stdcall PUSER_THREAD_START_ROUTINE( + ThreadParameter: PVOID, +) -> NTSTATUS} +EXTERN!{extern "system" { + fn RtlCreateUserThread( + Process: HANDLE, + ThreadSecurityDescriptor: PSECURITY_DESCRIPTOR, + CreateSuspended: BOOLEAN, + ZeroBits: ULONG, + MaximumStackSize: SIZE_T, + CommittedStackSize: SIZE_T, + StartAddress: PUSER_THREAD_START_ROUTINE, + Parameter: PVOID, + Thread: PHANDLE, + ClientId: PCLIENT_ID, + ) -> NTSTATUS; + fn RtlExitUserThread( + ExitStatus: NTSTATUS, + ); + fn RtlIsCurrentThreadAttachExempt() -> BOOLEAN; + fn RtlCreateUserStack( + CommittedStackSize: SIZE_T, + MaximumStackSize: SIZE_T, + ZeroBits: ULONG_PTR, + PageSize: SIZE_T, + ReserveAlignment: ULONG_PTR, + InitialTeb: PINITIAL_TEB, + ) -> NTSTATUS; + fn RtlFreeUserStack( + AllocationBase: PVOID, + ) -> NTSTATUS; +}} +STRUCT!{struct CONTEXT_CHUNK { + Offset: LONG, + Length: ULONG, +}} +pub type PCONTEXT_CHUNK = *mut CONTEXT_CHUNK; +STRUCT!{struct CONTEXT_EX { + All: CONTEXT_CHUNK, + Legacy: CONTEXT_CHUNK, + XState: CONTEXT_CHUNK, +}} +pub type PCONTEXT_EX = *mut CONTEXT_EX; +pub const CONTEXT_EX_LENGTH: usize = 4096; +#[macro_export] +macro_rules! RTL_CONTEXT_EX_OFFSET { + ($ContextEx:expr, $Chunk:ident) => { + (*$ContextEx).$Chunk.Offset + }; +} +#[macro_export] +macro_rules! RTL_CONTEXT_EX_LENGTH { + ($ContextEx:expr, $Chunk:ident) => { + (*$ContextEx).$Chunk.Length + }; +} +#[macro_export] +macro_rules! RTL_CONTEXT_EX_CHUNK { + ($Base:expr, $Layout:expr, $Chunk:ident) => { + ($Base as usize + RTL_CONTEXT_EX_OFFSET!($Layout, $Chunk) as usize) as *mut c_void + }; +} +#[macro_export] +macro_rules! RTL_CONTEXT_OFFSET { + ($Context:expr, $Chunk:ident) => { + RTL_CONTEXT_EX_OFFSET!(($Context as *const $crate::winapi::um::winnt::CONTEXT).offset(1) + as *const $crate::ntrtl::CONTEXT_EX, $Chunk) + }; +} +#[macro_export] +macro_rules! RTL_CONTEXT_LENGTH { + ($Context:expr, $Chunk:ident) => { + RTL_CONTEXT_EX_LENGTH!(($Context as *const $crate::winapi::um::winnt::CONTEXT).offset(1) + as *const $crate::ntrtl::CONTEXT_EX, $Chunk) + }; +} +#[macro_export] +macro_rules! RTL_CONTEXT_CHUNK { + ($Context:expr, $Chunk:ident) => { + RTL_CONTEXT_EX_CHUNK!( + ($Context as *const $crate::winapi::um::winnt::CONTEXT).offset(1) + as *const $crate::ntrtl::CONTEXT_EX, + ($Context as *const $crate::winapi::um::winnt::CONTEXT).offset(1) + as *const $crate::ntrtl::CONTEXT_EX, + $Chunk + ) + }; +} +EXTERN!{extern "system" { + fn RtlInitializeContext( + Process: HANDLE, + Context: PCONTEXT, + Parameter: PVOID, + InitialPc: PVOID, + InitialSp: PVOID, + ); + fn RtlInitializeExtendedContext( + Context: PCONTEXT, + ContextFlags: ULONG, + ContextEx: *mut PCONTEXT_EX, + ) -> ULONG; + fn RtlCopyExtendedContext( + Destination: PCONTEXT_EX, + ContextFlags: ULONG, + Source: PCONTEXT_EX, + ) -> ULONG; + fn RtlGetExtendedContextLength( + ContextFlags: ULONG, + ContextLength: PULONG, + ) -> ULONG; + fn RtlGetExtendedFeaturesMask( + ContextEx: PCONTEXT_EX, + ) -> ULONG64; + fn RtlLocateExtendedFeature( + ContextEx: PCONTEXT_EX, + FeatureId: ULONG, + Length: PULONG, + ) -> PVOID; + fn RtlLocateLegacyContext( + ContextEx: PCONTEXT_EX, + Length: PULONG, + ) -> PCONTEXT; + fn RtlSetExtendedFeaturesMask( + ContextEx: PCONTEXT_EX, + FeatureMask: ULONG64, + ); +}} +#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))] +EXTERN!{extern "system" { + fn RtlWow64GetThreadContext( + ThreadHandle: HANDLE, + ThreadContext: PWOW64_CONTEXT, + ) -> NTSTATUS; + fn RtlWow64SetThreadContext( + ThreadHandle: HANDLE, + ThreadContext: PWOW64_CONTEXT, + ) -> NTSTATUS; +}} +EXTERN!{extern "system" { + fn RtlRemoteCall( + Process: HANDLE, + Thread: HANDLE, + CallSite: PVOID, + ArgumentCount: ULONG, + Arguments: PULONG_PTR, + PassContext: BOOLEAN, + AlreadySuspended: BOOLEAN, + ) -> NTSTATUS; + fn RtlAddVectoredExceptionHandler( + First: ULONG, + Handler: PVECTORED_EXCEPTION_HANDLER, + ) -> PVOID; + fn RtlRemoveVectoredExceptionHandler( + Handle: PVOID, + ) -> ULONG; + fn RtlAddVectoredContinueHandler( + First: ULONG, + Handler: PVECTORED_EXCEPTION_HANDLER, + ) -> PVOID; + fn RtlRemoveVectoredContinueHandler( + Handle: PVOID, + ) -> ULONG; +}} +FN!{stdcall PRTLP_UNHANDLED_EXCEPTION_FILTER( + ExceptionInfo: PEXCEPTION_POINTERS, +) -> ULONG} +EXTERN!{extern "system" { + fn RtlSetUnhandledExceptionFilter( + UnhandledExceptionFilter: PRTLP_UNHANDLED_EXCEPTION_FILTER, + ); + fn RtlUnhandledExceptionFilter( + ExceptionPointers: PEXCEPTION_POINTERS, + ) -> LONG; + fn RtlUnhandledExceptionFilter2( + ExceptionPointers: PEXCEPTION_POINTERS, + Flags: ULONG, + ) -> LONG; + fn RtlKnownExceptionFilter( + ExceptionPointers: PEXCEPTION_POINTERS, + ) -> LONG; +}} +#[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))] +IFDEF!{ +ENUM!{enum FUNCTION_TABLE_TYPE { + RF_SORTED = 0, + RF_UNSORTED = 1, + RF_CALLBACK = 2, + RF_KERNEL_DYNAMIC = 3, +}} +STRUCT!{struct DYNAMIC_FUNCTION_TABLE { + ListEntry: LIST_ENTRY, + FunctionTable: PRUNTIME_FUNCTION, + TimeStamp: LARGE_INTEGER, + MinimumAddress: ULONG64, + MaximumAddress: ULONG64, + BaseAddress: ULONG64, + Callback: PGET_RUNTIME_FUNCTION_CALLBACK, + Context: PVOID, + OutOfProcessCallbackDll: PWSTR, + Type: FUNCTION_TABLE_TYPE, + EntryCount: ULONG, + TreeNode: RTL_BALANCED_NODE, +}} +pub type PDYNAMIC_FUNCTION_TABLE = *mut DYNAMIC_FUNCTION_TABLE; +EXTERN!{extern "system" { + fn RtlGetFunctionTableListHead() -> PLIST_ENTRY; +}} +} +EXTERN!{extern "system" { + fn RtlImageNtHeader( + BaseOfImage: PVOID, + ) -> PIMAGE_NT_HEADERS; +}} +pub const RTL_IMAGE_NT_HEADER_EX_FLAG_NO_RANGE_CHECK: ULONG = 0x00000001; +EXTERN!{extern "system" { + fn RtlImageNtHeaderEx( + Flags: ULONG, + BaseOfImage: PVOID, + Size: ULONG64, + OutHeaders: *mut PIMAGE_NT_HEADERS, + ) -> NTSTATUS; + fn RtlAddressInSectionTable( + NtHeaders: PIMAGE_NT_HEADERS, + BaseOfImage: PVOID, + VirtualAddress: ULONG, + ) -> PVOID; + fn RtlSectionTableFromVirtualAddress( + NtHeaders: PIMAGE_NT_HEADERS, + BaseOfImage: PVOID, + VirtualAddress: ULONG, + ) -> PIMAGE_SECTION_HEADER; + fn RtlImageDirectoryEntryToData( + BaseOfImage: PVOID, + MappedAsImage: BOOLEAN, + DirectoryEntry: USHORT, + Size: PULONG, + ) -> PVOID; + fn RtlImageRvaToSection( + NtHeaders: PIMAGE_NT_HEADERS, + BaseOfImage: PVOID, + Rva: ULONG, + ) -> PIMAGE_SECTION_HEADER; + fn RtlImageRvaToVa( + NtHeaders: PIMAGE_NT_HEADERS, + BaseOfImage: PVOID, + Rva: ULONG, + LastRvaSection: *mut PIMAGE_SECTION_HEADER, + ) -> PVOID; + fn RtlFindExportedRoutineByName( + BaseOfImage: PVOID, + RoutineName: PSTR, + ) -> PVOID; + fn RtlGuardCheckLongJumpTarget( + PcValue: PVOID, + IsFastFail: BOOL, + IsLongJumpTarget: PBOOL, + ) -> NTSTATUS; + fn RtlCompareMemoryUlong( + Source: PVOID, + Length: SIZE_T, + Pattern: ULONG, + ) -> SIZE_T; + fn RtlFillMemoryUlong( + Destination: PVOID, + Length: SIZE_T, + Pattern: ULONG, + ); + fn RtlFillMemoryUlonglong( + Destination: PVOID, + Length: SIZE_T, + Pattern: ULONGLONG, + ); + fn RtlCreateEnvironment( + CloneCurrentEnvironment: BOOLEAN, + Environment: *mut PVOID, + ) -> NTSTATUS; +}} +pub const RTL_CREATE_ENVIRONMENT_TRANSLATE: ULONG = 0x1; +pub const RTL_CREATE_ENVIRONMENT_TRANSLATE_FROM_OEM: ULONG = 0x2; +pub const RTL_CREATE_ENVIRONMENT_EMPTY: ULONG = 0x4; +EXTERN!{extern "system" { + fn RtlCreateEnvironmentEx( + SourceEnv: PVOID, + Environment: *mut PVOID, + Flags: ULONG, + ) -> NTSTATUS; + fn RtlDestroyEnvironment( + Environment: PVOID, + ) -> NTSTATUS; + fn RtlSetCurrentEnvironment( + Environment: PVOID, + PreviousEnvironment: *mut PVOID, + ) -> NTSTATUS; + fn RtlSetEnvironmentVar( + Environment: *mut PWSTR, + Name: PWSTR, + NameLength: SIZE_T, + Value: PWSTR, + ValueLength: SIZE_T, + ) -> NTSTATUS; + fn RtlSetEnvironmentVariable( + Environment: *mut PVOID, + Name: PUNICODE_STRING, + Value: PUNICODE_STRING, + ) -> NTSTATUS; + fn RtlQueryEnvironmentVariable( + Environment: PVOID, + Name: PWSTR, + NameLength: SIZE_T, + Value: PWSTR, + ValueLength: SIZE_T, + ReturnLength: PSIZE_T, + ) -> NTSTATUS; + fn RtlQueryEnvironmentVariable_U( + Environment: PVOID, + Name: PUNICODE_STRING, + Value: PUNICODE_STRING, + ) -> NTSTATUS; + fn RtlExpandEnvironmentStrings( + Environment: PVOID, + Src: PWSTR, + SrcLength: SIZE_T, + Dst: PWSTR, + DstLength: SIZE_T, + ReturnLength: PSIZE_T, + ) -> NTSTATUS; + fn RtlExpandEnvironmentStrings_U( + Environment: PVOID, + Source: PUNICODE_STRING, + Destination: PUNICODE_STRING, + ReturnedLength: PULONG, + ) -> NTSTATUS; + fn RtlSetEnvironmentStrings( + NewEnvironment: PWCHAR, + NewEnvironmentSize: SIZE_T, + ) -> NTSTATUS; +}} +STRUCT!{struct RTLP_CURDIR_REF { + ReferenceCount: LONG, + DirectoryHandle: HANDLE, +}} +pub type PRTLP_CURDIR_REF = *mut RTLP_CURDIR_REF; +STRUCT!{struct RTL_RELATIVE_NAME_U { + RelativeName: UNICODE_STRING, + ContainingDirectory: HANDLE, + CurDirRef: PRTLP_CURDIR_REF, +}} +pub type PRTL_RELATIVE_NAME_U = *mut RTL_RELATIVE_NAME_U; +ENUM!{enum RTL_PATH_TYPE { + RtlPathTypeUnknown = 0, + RtlPathTypeUncAbsolute = 1, + RtlPathTypeDriveAbsolute = 2, + RtlPathTypeDriveRelative = 3, + RtlPathTypeRooted = 4, + RtlPathTypeRelative = 5, + RtlPathTypeLocalDevice = 6, + RtlPathTypeRootLocalDevice = 7, +}} +EXTERN!{extern "C" { + static mut RtlDosPathSeperatorsString: UNICODE_STRING; + static mut RtlAlternateDosPathSeperatorString: UNICODE_STRING; + static mut RtlNtPathSeperatorString: UNICODE_STRING; +}} +/// "ntdll.dll" +pub const RtlNtdllName: UTF16Const = UTF16Const(&[ + 0x006E, 0x0074, 0x0064, 0x006C, 0x006C, 0x002E, 0x0064, 0x006C, 0x006C, 0u16, +]); +EXTERN!{extern "system" { + fn RtlDetermineDosPathNameType_U( + DosFileName: PWSTR, + ) -> RTL_PATH_TYPE; + fn RtlDetermineDosPathNameType_Ustr( + DosFileName: PCUNICODE_STRING, + ) -> RTL_PATH_TYPE; + fn RtlIsDosDeviceName_U( + DosFileName: PWSTR, + ) -> ULONG; + fn RtlIsDosDeviceName_Ustr( + DosFileName: PUNICODE_STRING, + ) -> ULONG; + fn RtlGetFullPathName_U( + FileName: PWSTR, + BufferLength: ULONG, + Buffer: PWSTR, + FilePart: *mut PWSTR, + ) -> ULONG; + fn RtlGetFullPathName_UEx( + FileName: PWSTR, + BufferLength: ULONG, + Buffer: PWSTR, + FilePart: *mut PWSTR, + BytesRequired: *mut ULONG, + ) -> NTSTATUS; + fn RtlGetFullPathName_UstrEx( + FileName: PUNICODE_STRING, + StaticString: PUNICODE_STRING, + DynamicString: PUNICODE_STRING, + StringUsed: *mut PUNICODE_STRING, + FilePartPrefixCch: *mut SIZE_T, + NameInvalid: PBOOLEAN, + InputPathType: *mut RTL_PATH_TYPE, + BytesRequired: *mut SIZE_T, + ) -> NTSTATUS; + fn RtlGetCurrentDirectory_U( + BufferLength: ULONG, + Buffer: PWSTR, + ) -> ULONG; + fn RtlSetCurrentDirectory_U( + PathName: PUNICODE_STRING, + ) -> NTSTATUS; + fn RtlGetLongestNtPathLength() -> ULONG; + fn RtlDosPathNameToNtPathName_U( + DosFileName: PWSTR, + NtFileName: PUNICODE_STRING, + FilePart: *mut PWSTR, + RelativeName: PRTL_RELATIVE_NAME_U, + ) -> BOOLEAN; + fn RtlDosPathNameToNtPathName_U_WithStatus( + DosFileName: PWSTR, + NtFileName: PUNICODE_STRING, + FilePart: *mut PWSTR, + RelativeName: PRTL_RELATIVE_NAME_U, + ) -> NTSTATUS; + fn RtlDosLongPathNameToNtPathName_U_WithStatus( + DosFileName: PWSTR, + NtFileName: PUNICODE_STRING, + FilePart: *mut PWSTR, + RelativeName: PRTL_RELATIVE_NAME_U, + ) -> NTSTATUS; + fn RtlDosPathNameToRelativeNtPathName_U( + DosFileName: PWSTR, + NtFileName: PUNICODE_STRING, + FilePart: *mut PWSTR, + RelativeName: PRTL_RELATIVE_NAME_U, + ) -> BOOLEAN; + fn RtlDosPathNameToRelativeNtPathName_U_WithStatus( + DosFileName: PWSTR, + NtFileName: PUNICODE_STRING, + FilePart: *mut PWSTR, + RelativeName: PRTL_RELATIVE_NAME_U, + ) -> NTSTATUS; + fn RtlDosLongPathNameToRelativeNtPathName_U_WithStatus( + DosFileName: PWSTR, + NtFileName: PUNICODE_STRING, + FilePart: *mut PWSTR, + RelativeName: PRTL_RELATIVE_NAME_U, + ) -> NTSTATUS; + fn RtlReleaseRelativeName( + RelativeName: PRTL_RELATIVE_NAME_U, + ); + fn RtlDosSearchPath_U( + Path: PWSTR, + FileName: PWSTR, + Extension: PWSTR, + BufferLength: ULONG, + Buffer: PWSTR, + FilePart: *mut PWSTR, + ) -> ULONG; +}} +pub const RTL_DOS_SEARCH_PATH_FLAG_APPLY_ISOLATION_REDIRECTION: ULONG = 0x00000001; +pub const RTL_DOS_SEARCH_PATH_FLAG_DISALLOW_DOT_RELATIVE_PATH_SEARCH: ULONG = 0x00000002; +pub const RTL_DOS_SEARCH_PATH_FLAG_APPLY_DEFAULT_EXTENSION_WHEN_NOT_RELATIVE_PATH_EVEN_IF_FILE_HAS_EXTENSION: ULONG = 0x00000004; +EXTERN!{extern "system" { + fn RtlDosSearchPath_Ustr( + Flags: ULONG, + Path: PUNICODE_STRING, + FileName: PUNICODE_STRING, + DefaultExtension: PUNICODE_STRING, + StaticString: PUNICODE_STRING, + DynamicString: PUNICODE_STRING, + FullFileNameOut: *mut PCUNICODE_STRING, + FilePartPrefixCch: *mut SIZE_T, + BytesRequired: *mut SIZE_T, + ) -> NTSTATUS; + fn RtlDoesFileExists_U( + FileName: PWSTR, + ) -> BOOLEAN; + fn RtlGetLengthWithoutLastFullDosOrNtPathElement( + Flags: ULONG, + PathString: PUNICODE_STRING, + Length: PULONG, + ) -> NTSTATUS; + fn RtlGetLengthWithoutTrailingPathSeperators( + Flags: ULONG, + PathString: PUNICODE_STRING, + Length: PULONG, + ) -> NTSTATUS; +}} +STRUCT!{struct GENERATE_NAME_CONTEXT { + Checksum: USHORT, + CheckSumInserted: BOOLEAN, + NameLength: UCHAR, + NameBuffer: [WCHAR; 8], + ExtensionLength: ULONG, + ExtensionBuffer: [WCHAR; 4], + LastIndexValue: ULONG, +}} +pub type PGENERATE_NAME_CONTEXT = *mut GENERATE_NAME_CONTEXT; +EXTERN!{extern "system" { + fn RtlGenerate8dot3Name( + Name: PCUNICODE_STRING, + AllowExtendedCharacters: BOOLEAN, + Context: PGENERATE_NAME_CONTEXT, + Name8dot3: PUNICODE_STRING, + ) -> NTSTATUS; + fn RtlComputePrivatizedDllName_U( + DllName: PUNICODE_STRING, + RealName: PUNICODE_STRING, + LocalName: PUNICODE_STRING, + ) -> NTSTATUS; + fn RtlGetSearchPath( + SearchPathA: *mut PWSTR, + ) -> BOOLEAN; + fn RtlSetSearchPathMode( + Flags: ULONG, + ) -> NTSTATUS; + fn RtlGetExePath() -> PWSTR; + fn RtlGetNtSystemRoot() -> PWSTR; + fn RtlAreLongPathsEnabled() -> BOOLEAN; + fn RtlIsThreadWithinLoaderCallout() -> BOOLEAN; + fn RtlDllShutdownInProgress() -> BOOLEAN; +}} +STRUCT!{struct RTL_HEAP_ENTRY_u_s1 { + Settable: SIZE_T, + Tag: ULONG, +}} +STRUCT!{struct RTL_HEAP_ENTRY_u_s2 { + CommittedSize: SIZE_T, + FirstBlock: PVOID, +}} +UNION!{union RTL_HEAP_ENTRY_u { + s1: RTL_HEAP_ENTRY_u_s1, + s2: RTL_HEAP_ENTRY_u_s2, +}} +STRUCT!{struct RTL_HEAP_ENTRY { + Size: SIZE_T, + Flags: USHORT, + AllocatorBackTraceIndex: USHORT, + u: RTL_HEAP_ENTRY_u, +}} +pub type PRTL_HEAP_ENTRY = *mut RTL_HEAP_ENTRY; +pub const RTL_HEAP_BUSY: USHORT = 0x0001; +pub const RTL_HEAP_SEGMENT: USHORT = 0x0002; +pub const RTL_HEAP_SETTABLE_VALUE: USHORT = 0x0010; +pub const RTL_HEAP_SETTABLE_FLAG1: USHORT = 0x0020; +pub const RTL_HEAP_SETTABLE_FLAG2: USHORT = 0x0040; +pub const RTL_HEAP_SETTABLE_FLAG3: USHORT = 0x0080; +pub const RTL_HEAP_SETTABLE_FLAGS: USHORT = 0x00e0; +pub const RTL_HEAP_UNCOMMITTED_RANGE: USHORT = 0x0100; +pub const RTL_HEAP_PROTECTED_ENTRY: USHORT = 0x0200; +STRUCT!{struct RTL_HEAP_TAG { + NumberOfAllocations: ULONG, + NumberOfFrees: ULONG, + BytesAllocated: SIZE_T, + TagIndex: USHORT, + CreatorBackTraceIndex: USHORT, + TagName: [WCHAR; 24], +}} +pub type PRTL_HEAP_TAG = *mut RTL_HEAP_TAG; +STRUCT!{struct RTL_HEAP_INFORMATION { + BaseAddress: PVOID, + Flags: ULONG, + EntryOverhead: USHORT, + CreatorBackTraceIndex: USHORT, + BytesAllocated: SIZE_T, + BytesCommitted: SIZE_T, + NumberOfTags: ULONG, + NumberOfEntries: ULONG, + NumberOfPseudoTags: ULONG, + PseudoTagGranularity: ULONG, + Reserved: [ULONG; 5], + Tags: PRTL_HEAP_TAG, + Entries: PRTL_HEAP_ENTRY, +}} +pub type PRTL_HEAP_INFORMATION = *mut RTL_HEAP_INFORMATION; +STRUCT!{struct RTL_PROCESS_HEAPS { + NumberOfHeaps: ULONG, + Heaps: [RTL_HEAP_INFORMATION; 1], +}} +pub type PRTL_PROCESS_HEAPS = *mut RTL_PROCESS_HEAPS; +FN!{stdcall PRTL_HEAP_COMMIT_ROUTINE( + Base: PVOID, + CommitAddress: *mut PVOID, + CommitSize: PSIZE_T, +) -> NTSTATUS} +STRUCT!{struct RTL_HEAP_PARAMETERS { + Length: ULONG, + SegmentReserve: SIZE_T, + SegmentCommit: SIZE_T, + DeCommitFreeBlockThreshold: SIZE_T, + DeCommitTotalFreeThreshold: SIZE_T, + MaximumAllocationSize: SIZE_T, + VirtualMemoryThreshold: SIZE_T, + InitialCommit: SIZE_T, + InitialReserve: SIZE_T, + CommitRoutine: PRTL_HEAP_COMMIT_ROUTINE, + Reserved: [SIZE_T; 2], +}} +pub type PRTL_HEAP_PARAMETERS = *mut RTL_HEAP_PARAMETERS; +pub const HEAP_SETTABLE_USER_VALUE: ULONG = 0x00000100; +pub const HEAP_SETTABLE_USER_FLAG1: ULONG = 0x00000200; +pub const HEAP_SETTABLE_USER_FLAG2: ULONG = 0x00000400; +pub const HEAP_SETTABLE_USER_FLAG3: ULONG = 0x00000800; +pub const HEAP_SETTABLE_USER_FLAGS: ULONG = 0x00000e00; +pub const HEAP_CLASS_0: ULONG = 0x00000000; +pub const HEAP_CLASS_1: ULONG = 0x00001000; +pub const HEAP_CLASS_2: ULONG = 0x00002000; +pub const HEAP_CLASS_3: ULONG = 0x00003000; +pub const HEAP_CLASS_4: ULONG = 0x00004000; +pub const HEAP_CLASS_5: ULONG = 0x00005000; +pub const HEAP_CLASS_6: ULONG = 0x00006000; +pub const HEAP_CLASS_7: ULONG = 0x00007000; +pub const HEAP_CLASS_8: ULONG = 0x00008000; +pub const HEAP_CLASS_MASK: ULONG = 0x0000f000; +EXTERN!{extern "system" { + fn RtlCreateHeap( + Flags: ULONG, + HeapBase: PVOID, + ReserveSize: SIZE_T, + CommitSize: SIZE_T, + Lock: PVOID, + Parameters: PRTL_HEAP_PARAMETERS, + ) -> PVOID; + fn RtlDestroyHeap( + HeapHandle: PVOID, + ) -> PVOID; + fn RtlAllocateHeap( + HeapHandle: PVOID, + Flags: ULONG, + Size: SIZE_T, + ) -> PVOID; + fn RtlFreeHeap( + HeapHandle: PVOID, + Flags: ULONG, + BaseAddress: PVOID, + ) -> BOOLEAN; + fn RtlSizeHeap( + HeapHandle: PVOID, + Flags: ULONG, + BaseAddress: PVOID, + ) -> SIZE_T; + fn RtlZeroHeap( + HeapHandle: PVOID, + Flags: ULONG, + ) -> NTSTATUS; + fn RtlProtectHeap( + HeapHandle: PVOID, + MakeReadOnly: BOOLEAN, + ); +}} +#[inline] #[cfg(not(target_arch = "aarch64"))] +pub unsafe fn RtlProcessHeap() -> PVOID { + use crate::ntpsapi::NtCurrentPeb; + (*NtCurrentPeb()).ProcessHeap +} +EXTERN!{extern "system" { + fn RtlLockHeap( + HeapHandle: PVOID, + ) -> BOOLEAN; + fn RtlUnlockHeap( + HeapHandle: PVOID, + ) -> BOOLEAN; + fn RtlReAllocateHeap( + HeapHandle: PVOID, + Flags: ULONG, + BaseAddress: PVOID, + Size: SIZE_T, + ) -> PVOID; + fn RtlGetUserInfoHeap( + HeapHandle: PVOID, + Flags: ULONG, + BaseAddress: PVOID, + UserValue: *mut PVOID, + UserFlags: PULONG, + ) -> BOOLEAN; + fn RtlSetUserValueHeap( + HeapHandle: PVOID, + Flags: ULONG, + BaseAddress: PVOID, + UserValue: PVOID, + ) -> BOOLEAN; + fn RtlSetUserFlagsHeap( + HeapHandle: PVOID, + Flags: ULONG, + BaseAddress: PVOID, + UserFlagsReset: ULONG, + UserFlagsSet: ULONG, + ) -> BOOLEAN; +}} +STRUCT!{struct RTL_HEAP_TAG_INFO { + NumberOfAllocations: ULONG, + NumberOfFrees: ULONG, + BytesAllocated: SIZE_T, +}} +pub type PRTL_HEAP_TAG_INFO = *mut RTL_HEAP_TAG_INFO; +EXTERN!{extern "system" { + fn RtlCreateTagHeap( + HeapHandle: PVOID, + Flags: ULONG, + TagPrefix: PWSTR, + TagNames: PWSTR, + ) -> ULONG; + fn RtlQueryTagHeap( + HeapHandle: PVOID, + Flags: ULONG, + TagIndex: USHORT, + ResetCounters: BOOLEAN, + TagInfo: PRTL_HEAP_TAG_INFO, + ) -> PWSTR; + fn RtlExtendHeap( + HeapHandle: PVOID, + Flags: ULONG, + Base: PVOID, + Size: SIZE_T, + ) -> NTSTATUS; + fn RtlCompactHeap( + HeapHandle: PVOID, + Flags: ULONG, + ) -> SIZE_T; + fn RtlValidateHeap( + HeapHandle: PVOID, + Flags: ULONG, + BaseAddress: PVOID, + ) -> BOOLEAN; + fn RtlValidateProcessHeaps() -> BOOLEAN; + fn RtlGetProcessHeaps( + NumberOfHeaps: ULONG, + ProcessHeaps: *mut PVOID, + ) -> ULONG; +}} +FN!{stdcall PRTL_ENUM_HEAPS_ROUTINE( + HeapHandle: PVOID, + Parameter: PVOID, +) -> NTSTATUS} +EXTERN!{extern "system" { + fn RtlEnumProcessHeaps( + EnumRoutine: PRTL_ENUM_HEAPS_ROUTINE, + Parameter: PVOID, + ) -> NTSTATUS; +}} +STRUCT!{struct RTL_HEAP_USAGE_ENTRY { + Next: *mut RTL_HEAP_USAGE_ENTRY, + Address: PVOID, + Size: SIZE_T, + AllocatorBackTraceIndex: USHORT, + TagIndex: USHORT, +}} +pub type PRTL_HEAP_USAGE_ENTRY = *mut RTL_HEAP_USAGE_ENTRY; +STRUCT!{struct RTL_HEAP_USAGE { + Length: ULONG, + BytesAllocated: SIZE_T, + BytesCommitted: SIZE_T, + BytesReserved: SIZE_T, + BytesReservedMaximum: SIZE_T, + Entries: PRTL_HEAP_USAGE_ENTRY, + AddedEntries: PRTL_HEAP_USAGE_ENTRY, + RemovedEntries: PRTL_HEAP_USAGE_ENTRY, + Reserved: [ULONG_PTR; 8], +}} +pub type PRTL_HEAP_USAGE = *mut RTL_HEAP_USAGE; +pub const HEAP_USAGE_ALLOCATED_BLOCKS: ULONG = HEAP_REALLOC_IN_PLACE_ONLY; +pub const HEAP_USAGE_FREE_BUFFER: ULONG = HEAP_ZERO_MEMORY; +EXTERN!{extern "system" { + fn RtlUsageHeap( + HeapHandle: PVOID, + Flags: ULONG, + Usage: PRTL_HEAP_USAGE, + ) -> NTSTATUS; +}} +STRUCT!{struct RTL_HEAP_WALK_ENTRY_u_Block { + Settable: SIZE_T, + TagIndex: USHORT, + AllocatorBackTraceIndex: USHORT, + Reserved: [ULONG; 2], +}} +STRUCT!{struct RTL_HEAP_WALK_ENTRY_u_Segment { + CommittedSize: ULONG, + UnCommittedSize: ULONG, + FirstEntry: PVOID, + LastEntry: PVOID, +}} +UNION!{union RTL_HEAP_WALK_ENTRY_u { + Block: RTL_HEAP_WALK_ENTRY_u_Block, + Segment: RTL_HEAP_WALK_ENTRY_u_Segment, +}} +STRUCT!{struct RTL_HEAP_WALK_ENTRY { + DataAddress: PVOID, + DataSize: SIZE_T, + OverheadBytes: UCHAR, + SegmentIndex: UCHAR, + Flags: USHORT, + u: RTL_HEAP_WALK_ENTRY_u, +}} +pub type PRTL_HEAP_WALK_ENTRY = *mut RTL_HEAP_WALK_ENTRY; +EXTERN!{extern "system" { + fn RtlWalkHeap( + HeapHandle: PVOID, + Entry: PRTL_HEAP_WALK_ENTRY, + ) -> NTSTATUS; +}} +pub const HeapDetailedFailureInformation: u32 = 0x80000001; +pub const HeapSetDebuggingInformation: u32 = 0x80000002; +ENUM!{enum HEAP_COMPATIBILITY_MODE { + HEAP_COMPATIBILITY_STANDARD = 0, + HEAP_COMPATIBILITY_LAL = 1, + HEAP_COMPATIBILITY_LFH = 2, +}} +STRUCT!{struct PROCESS_HEAP_INFORMATION { + ReserveSize: ULONG_PTR, + CommitSize: ULONG_PTR, + NumberOfHeaps: ULONG, + FirstHeapInformationOffset: ULONG_PTR, +}} +pub type PPROCESS_HEAP_INFORMATION = *mut PROCESS_HEAP_INFORMATION; +STRUCT!{struct HEAP_INFORMATION { + Address: ULONG_PTR, + Mode: ULONG, + ReserveSize: ULONG_PTR, + CommitSize: ULONG_PTR, + FirstRegionInformationOffset: ULONG_PTR, + NextHeapInformationOffset: ULONG_PTR, +}} +pub type PHEAP_INFORMATION = *mut HEAP_INFORMATION; +UNION!{union HEAP_EXTENDED_INFORMATION_u { + ProcessHeapInformation: PROCESS_HEAP_INFORMATION, + HeapInformation: HEAP_INFORMATION, +}} +STRUCT!{struct HEAP_EXTENDED_INFORMATION { + Process: HANDLE, + Heap: ULONG_PTR, + Level: ULONG, + CallbackRoutine: PVOID, + CallbackContext: PVOID, + u: HEAP_EXTENDED_INFORMATION_u, +}} +pub type PHEAP_EXTENDED_INFORMATION = *mut HEAP_EXTENDED_INFORMATION; +FN!{stdcall PRTL_HEAP_LEAK_ENUMERATION_ROUTINE( + Reserved: LONG, + HeapHandle: PVOID, + BaseAddress: PVOID, + BlockSize: SIZE_T, + StackTraceDepth: ULONG, + StackTrace: *mut PVOID, +) -> NTSTATUS} +STRUCT!{struct HEAP_DEBUGGING_INFORMATION { + InterceptorFunction: PVOID, + InterceptorValue: USHORT, + ExtendedOptions: ULONG, + StackTraceDepth: ULONG, + MinTotalBlockSize: SIZE_T, + MaxTotalBlockSize: SIZE_T, + HeapLeakEnumerationRoutine: PRTL_HEAP_LEAK_ENUMERATION_ROUTINE, +}} +pub type PHEAP_DEBUGGING_INFORMATION = *mut HEAP_DEBUGGING_INFORMATION; +EXTERN!{extern "system" { + fn RtlQueryHeapInformation( + HeapHandle: PVOID, + HeapInformationClass: HEAP_INFORMATION_CLASS, + HeapInformation: PVOID, + HeapInformationLength: SIZE_T, + ReturnLength: PSIZE_T, + ) -> NTSTATUS; + fn RtlSetHeapInformation( + HeapHandle: PVOID, + HeapInformationClass: HEAP_INFORMATION_CLASS, + HeapInformation: PVOID, + HeapInformationLength: SIZE_T, + ) -> NTSTATUS; + fn RtlMultipleAllocateHeap( + HeapHandle: PVOID, + Flags: ULONG, + Size: SIZE_T, + Count: ULONG, + Array: *mut PVOID, + ) -> ULONG; + fn RtlMultipleFreeHeap( + HeapHandle: PVOID, + Flags: ULONG, + Count: ULONG, + Array: *mut PVOID, + ) -> ULONG; + fn RtlDetectHeapLeaks(); + fn RtlFlushHeaps(); +}} +STRUCT!{struct RTL_MEMORY_ZONE_SEGMENT { + NextSegment: *mut RTL_MEMORY_ZONE_SEGMENT, + Size: SIZE_T, + Next: PVOID, + Limit: PVOID, +}} +pub type PRTL_MEMORY_ZONE_SEGMENT = *mut RTL_MEMORY_ZONE_SEGMENT; +STRUCT!{struct RTL_MEMORY_ZONE { + Segment: RTL_MEMORY_ZONE_SEGMENT, + Lock: RTL_SRWLOCK, + LockCount: ULONG, + FirstSegment: PRTL_MEMORY_ZONE_SEGMENT, +}} +pub type PRTL_MEMORY_ZONE = *mut RTL_MEMORY_ZONE; +EXTERN!{extern "system" { + fn RtlCreateMemoryZone( + MemoryZone: *mut PVOID, + InitialSize: SIZE_T, + Flags: ULONG, + ) -> NTSTATUS; + fn RtlDestroyMemoryZone( + MemoryZone: PVOID, + ) -> NTSTATUS; + fn RtlAllocateMemoryZone( + MemoryZone: PVOID, + BlockSize: SIZE_T, + Block: *mut PVOID, + ) -> NTSTATUS; + fn RtlResetMemoryZone( + MemoryZone: PVOID, + ) -> NTSTATUS; + fn RtlLockMemoryZone( + MemoryZone: PVOID, + ) -> NTSTATUS; + fn RtlUnlockMemoryZone( + MemoryZone: PVOID, + ) -> NTSTATUS; + fn RtlCreateMemoryBlockLookaside( + MemoryBlockLookaside: *mut PVOID, + Flags: ULONG, + InitialSize: ULONG, + MinimumBlockSize: ULONG, + MaximumBlockSize: ULONG, + ) -> NTSTATUS; + fn RtlDestroyMemoryBlockLookaside( + MemoryBlockLookaside: PVOID, + ) -> NTSTATUS; + fn RtlAllocateMemoryBlockLookaside( + MemoryBlockLookaside: PVOID, + BlockSize: ULONG, + Block: *mut PVOID, + ) -> NTSTATUS; + fn RtlFreeMemoryBlockLookaside( + MemoryBlockLookaside: PVOID, + Block: PVOID, + ) -> NTSTATUS; + fn RtlExtendMemoryBlockLookaside( + MemoryBlockLookaside: PVOID, + Increment: ULONG, + ) -> NTSTATUS; + fn RtlResetMemoryBlockLookaside( + MemoryBlockLookaside: PVOID, + ) -> NTSTATUS; + fn RtlLockMemoryBlockLookaside( + MemoryBlockLookaside: PVOID, + ) -> NTSTATUS; + fn RtlUnlockMemoryBlockLookaside( + MemoryBlockLookaside: PVOID, + ) -> NTSTATUS; + fn RtlGetCurrentTransaction() -> HANDLE; + fn RtlSetCurrentTransaction( + TransactionHandle: HANDLE, + ) -> LOGICAL; +}} +#[inline] +pub const fn RtlIsEqualLuid(L1: &LUID, L2: &LUID) -> bool { + (L1.LowPart == L2.LowPart) && (L1.HighPart == L2.HighPart) +} +#[inline] +pub const fn RtlIsZeroLuid(L1: &LUID) -> bool { + (L1.LowPart | L1.HighPart as u32) == 0 +} +#[inline] +pub const fn RtlConvertLongToLuid(Long: LONG) -> LUID { + LUID { LowPart: Long as u32, HighPart: ((Long as i64) >> 32) as i32 } +} +#[inline] +pub const fn RtlConvertUlongToLuid(Ulong: ULONG) -> LUID { + LUID { LowPart: Ulong, HighPart: 0 } +} +EXTERN!{extern "system" { + fn RtlCopyLuid( + DestinationLuid: PLUID, + SourceLuid: PLUID, + ); + fn RtlCopyLuidAndAttributesArray( + Count: ULONG, + Src: PLUID_AND_ATTRIBUTES, + Dest: PLUID_AND_ATTRIBUTES, + ); +}} +STRUCT!{struct RTL_PROCESS_VERIFIER_OPTIONS { + SizeStruct: ULONG, + Option: ULONG, + OptionData: [UCHAR; 1], +}} +pub type PRTL_PROCESS_VERIFIER_OPTIONS = *mut RTL_PROCESS_VERIFIER_OPTIONS; +UNION!{union RTL_DEBUG_INFORMATION_u { + Modules: *mut RTL_PROCESS_MODULES, + ModulesEx: *mut RTL_PROCESS_MODULE_INFORMATION_EX, +}} +STRUCT!{struct RTL_DEBUG_INFORMATION { + SectionHandleClient: HANDLE, + ViewBaseClient: PVOID, + ViewBaseTarget: PVOID, + ViewBaseDelta: ULONG_PTR, + EventPairClient: HANDLE, + EventPairTarget: HANDLE, + TargetProcessId: HANDLE, + TargetThreadHandle: HANDLE, + Flags: ULONG, + OffsetFree: SIZE_T, + CommitSize: SIZE_T, + ViewSize: SIZE_T, + u: RTL_DEBUG_INFORMATION_u, + BackTraces: *mut RTL_PROCESS_BACKTRACES, + Heaps: *mut RTL_PROCESS_HEAPS, + Locks: *mut RTL_PROCESS_LOCKS, + SpecificHeap: PVOID, + TargetProcessHandle: HANDLE, + VerifierOptions: PRTL_PROCESS_VERIFIER_OPTIONS, + ProcessHeap: PVOID, + CriticalSectionHandle: HANDLE, + CriticalSectionOwnerThread: HANDLE, + Reserved: [PVOID; 4], +}} +pub type PRTL_DEBUG_INFORMATION = *mut RTL_DEBUG_INFORMATION; +EXTERN!{extern "system" { + fn RtlCreateQueryDebugBuffer( + MaximumCommit: ULONG, + UseEventPair: BOOLEAN, + ) -> PRTL_DEBUG_INFORMATION; + fn RtlDestroyQueryDebugBuffer( + Buffer: PRTL_DEBUG_INFORMATION, + ) -> NTSTATUS; + fn RtlCommitDebugInfo( + Buffer: PRTL_DEBUG_INFORMATION, + Size: SIZE_T, + ) -> PVOID; + fn RtlDeCommitDebugInfo( + Buffer: PRTL_DEBUG_INFORMATION, + p: PVOID, + Size: SIZE_T, + ); +}} +pub const RTL_QUERY_PROCESS_MODULES: ULONG = 0x00000001; +pub const RTL_QUERY_PROCESS_BACKTRACES: ULONG = 0x00000002; +pub const RTL_QUERY_PROCESS_HEAP_SUMMARY: ULONG = 0x00000004; +pub const RTL_QUERY_PROCESS_HEAP_TAGS: ULONG = 0x00000008; +pub const RTL_QUERY_PROCESS_HEAP_ENTRIES: ULONG = 0x00000010; +pub const RTL_QUERY_PROCESS_LOCKS: ULONG = 0x00000020; +pub const RTL_QUERY_PROCESS_MODULES32: ULONG = 0x00000040; +pub const RTL_QUERY_PROCESS_VERIFIER_OPTIONS: ULONG = 0x00000080; +pub const RTL_QUERY_PROCESS_MODULESEX: ULONG = 0x00000100; +pub const RTL_QUERY_PROCESS_HEAP_ENTRIES_EX: ULONG = 0x00000200; +pub const RTL_QUERY_PROCESS_CS_OWNER: ULONG = 0x00000400; +pub const RTL_QUERY_PROCESS_NONINVASIVE: ULONG = 0x80000000; +EXTERN!{extern "system" { + fn RtlQueryProcessDebugInformation( + UniqueProcessId: HANDLE, + Flags: ULONG, + Buffer: PRTL_DEBUG_INFORMATION, + ) -> NTSTATUS; + fn RtlFindMessage( + DllHandle: PVOID, + MessageTableId: ULONG, + MessageLanguageId: ULONG, + MessageId: ULONG, + MessageEntry: *mut PMESSAGE_RESOURCE_ENTRY, + ) -> NTSTATUS; + fn RtlFormatMessage( + MessageFormat: PWSTR, + MaximumWidth: ULONG, + IgnoreInserts: BOOLEAN, + ArgumentsAreAnsi: BOOLEAN, + ArgumentsAreAnArray: BOOLEAN, + Arguments: *mut va_list, + Buffer: PWSTR, + Length: ULONG, + ReturnLength: PULONG, + ) -> NTSTATUS; +}} +STRUCT!{struct PARSE_MESSAGE_CONTEXT { + fFlags: ULONG, + cwSavColumn: ULONG, + iwSrc: SIZE_T, + iwDst: SIZE_T, + iwDstSpace: SIZE_T, + lpvArgStart: va_list, +}} +pub type PPARSE_MESSAGE_CONTEXT = *mut PARSE_MESSAGE_CONTEXT; +#[inline] +pub fn INIT_PARSE_MESSAGE_CONTEXT(ctx: &mut PARSE_MESSAGE_CONTEXT) { + ctx.fFlags = 0; +} +#[inline] +pub fn TEST_PARSE_MESSAGE_CONTEXT_FLAG(ctx: &mut PARSE_MESSAGE_CONTEXT, flag: ULONG) -> ULONG { + ctx.fFlags & flag +} +#[inline] +pub fn SET_PARSE_MESSAGE_CONTEXT_FLAG(ctx: &mut PARSE_MESSAGE_CONTEXT, flag: ULONG) -> ULONG { + ctx.fFlags |= flag; + ctx.fFlags +} +#[inline] +pub fn CLEAR_PARSE_MESSAGE_CONTEXT_FLAG(ctx: &mut PARSE_MESSAGE_CONTEXT, flag: ULONG) -> ULONG { + ctx.fFlags &= !flag; + ctx.fFlags +} +EXTERN!{extern "system" { + fn RtlFormatMessageEx( + MessageFormat: PWSTR, + MaximumWidth: ULONG, + IgnoreInserts: BOOLEAN, + ArgumentsAreAnsi: BOOLEAN, + ArgumentsAreAnArray: BOOLEAN, + Arguments: *mut va_list, + Buffer: PWSTR, + Length: ULONG, + ReturnLength: PULONG, + ParseContext: PPARSE_MESSAGE_CONTEXT, + ) -> NTSTATUS; + fn RtlNtStatusToDosError( + Status: NTSTATUS, + ) -> ULONG; + fn RtlNtStatusToDosErrorNoTeb( + Status: NTSTATUS, + ) -> ULONG; + fn RtlGetLastNtStatus() -> NTSTATUS; + fn RtlGetLastWin32Error() -> LONG; + fn RtlSetLastWin32ErrorAndNtStatusFromNtStatus( + Status: NTSTATUS, + ); + fn RtlSetLastWin32Error( + Win32Error: LONG, + ); + fn RtlRestoreLastWin32Error( + Win32Error: LONG, + ); +}} +pub const RTL_ERRORMODE_FAILCRITICALERRORS: ULONG = 0x0010; +pub const RTL_ERRORMODE_NOGPFAULTERRORBOX: ULONG = 0x0020; +pub const RTL_ERRORMODE_NOOPENFILEERRORBOX: ULONG = 0x0040; +EXTERN!{extern "system" { + fn RtlGetThreadErrorMode() -> ULONG; + fn RtlSetThreadErrorMode( + NewMode: ULONG, + OldMode: PULONG, + ) -> NTSTATUS; + fn RtlReportException( + ExceptionRecord: PEXCEPTION_RECORD, + ContextRecord: PCONTEXT, + Flags: ULONG, + ) -> NTSTATUS; + fn RtlReportExceptionEx( + ExceptionRecord: PEXCEPTION_RECORD, + ContextRecord: PCONTEXT, + Flags: ULONG, + Timeout: PLARGE_INTEGER, + ) -> NTSTATUS; + fn RtlWerpReportException( + ProcessId: ULONG, + CrashReportSharedMem: HANDLE, + Flags: ULONG, + CrashVerticalProcessHandle: PHANDLE, + ) -> NTSTATUS; + fn RtlReportSilentProcessExit( + ProcessHandle: HANDLE, + ExitStatus: NTSTATUS, + ) -> NTSTATUS; + fn RtlUniform( + Seed: PULONG, + ) -> ULONG; + fn RtlRandom( + Seed: PULONG, + ) -> ULONG; + fn RtlRandomEx( + Seed: PULONG, + ) -> ULONG; + fn RtlComputeImportTableHash( + FileHandle: HANDLE, + Hash: PCHAR, + ImportTableHashRevision: ULONG, + ) -> NTSTATUS; + fn RtlIntegerToChar( + Value: ULONG, + Base: ULONG, + OutputLength: LONG, + String: PSTR, + ) -> NTSTATUS; + fn RtlCharToInteger( + String: PCSZ, + Base: ULONG, + Value: PULONG, + ) -> NTSTATUS; + fn RtlLargeIntegerToChar( + Value: PLARGE_INTEGER, + Base: ULONG, + OutputLength: LONG, + String: PSTR, + ) -> NTSTATUS; + fn RtlIntegerToUnicodeString( + Value: ULONG, + Base: ULONG, + String: PUNICODE_STRING, + ) -> NTSTATUS; + fn RtlInt64ToUnicodeString( + Value: ULONGLONG, + Base: ULONG, + String: PUNICODE_STRING, + ) -> NTSTATUS; + fn RtlUnicodeStringToInteger( + String: PCUNICODE_STRING, + Base: ULONG, + Value: PULONG, + ) -> NTSTATUS; + fn RtlIpv4AddressToStringExW( + Address: *const in_addr, + Port: USHORT, + AddressString: PWSTR, + AddressStringLength: PULONG, + ) -> NTSTATUS; + fn RtlIpv6AddressToStringExW( + Address: *const in6_addr, + ScopeId: ULONG, + Port: USHORT, + AddressString: PWSTR, + AddressStringLength: PULONG, + ) -> NTSTATUS; + fn RtlIpv4StringToAddressExW( + AddressString: PCWSTR, + Strict: BOOLEAN, + Address: *mut in_addr, + Port: PUSHORT, + ) -> NTSTATUS; + fn RtlIpv6StringToAddressExW( + AddressString: PCWSTR, + Address: *mut in6_addr, + ScopeId: PULONG, + Port: PUSHORT, + ) -> NTSTATUS; +}} +STRUCT!{struct TIME_FIELDS { + Year: CSHORT, + Month: CSHORT, + Day: CSHORT, + Hour: CSHORT, + Minute: CSHORT, + Second: CSHORT, + Milliseconds: CSHORT, + Weekday: CSHORT, +}} +pub type PTIME_FIELDS = *mut TIME_FIELDS; +EXTERN!{extern "system" { + fn RtlCutoverTimeToSystemTime( + CutoverTime: PTIME_FIELDS, + SystemTime: PLARGE_INTEGER, + CurrentSystemTime: PLARGE_INTEGER, + ThisYear: BOOLEAN, + ) -> BOOLEAN; + fn RtlSystemTimeToLocalTime( + SystemTime: PLARGE_INTEGER, + LocalTime: PLARGE_INTEGER, + ) -> NTSTATUS; + fn RtlLocalTimeToSystemTime( + LocalTime: PLARGE_INTEGER, + SystemTime: PLARGE_INTEGER, + ) -> NTSTATUS; + fn RtlTimeToElapsedTimeFields( + Time: PLARGE_INTEGER, + TimeFields: PTIME_FIELDS, + ); + fn RtlTimeToTimeFields( + Time: PLARGE_INTEGER, + TimeFields: PTIME_FIELDS, + ); + fn RtlTimeFieldsToTime( + TimeFields: PTIME_FIELDS, + Time: PLARGE_INTEGER, + ) -> BOOLEAN; + fn RtlTimeToSecondsSince1980( + Time: PLARGE_INTEGER, + ElapsedSeconds: PULONG, + ) -> BOOLEAN; + fn RtlSecondsSince1980ToTime( + ElapsedSeconds: ULONG, + Time: PLARGE_INTEGER, + ); + fn RtlTimeToSecondsSince1970( + Time: PLARGE_INTEGER, + ElapsedSeconds: PULONG, + ) -> BOOLEAN; + fn RtlSecondsSince1970ToTime( + ElapsedSeconds: ULONG, + Time: PLARGE_INTEGER, + ); +}} +STRUCT!{struct RTL_TIME_ZONE_INFORMATION { + Bias: LONG, + StandardName: [WCHAR; 32], + StandardStart: TIME_FIELDS, + StandardBias: LONG, + DaylightName: [WCHAR; 32], + DaylightStart: TIME_FIELDS, + DaylightBias: LONG, +}} +pub type PRTL_TIME_ZONE_INFORMATION = *mut RTL_TIME_ZONE_INFORMATION; +EXTERN!{extern "system" { + fn RtlQueryTimeZoneInformation( + TimeZoneInformation: PRTL_TIME_ZONE_INFORMATION, + ) -> NTSTATUS; + fn RtlSetTimeZoneInformation( + TimeZoneInformation: PRTL_TIME_ZONE_INFORMATION, + ) -> NTSTATUS; +}} +STRUCT!{struct RTL_BITMAP { + SizeOfBitMap: ULONG, + Buffer: PULONG, +}} +pub type PRTL_BITMAP = *mut RTL_BITMAP; +EXTERN!{extern "system" { + fn RtlInitializeBitMap( + BitMapHeader: PRTL_BITMAP, + BitMapBuffer: PULONG, + SizeOfBitMap: ULONG, + ); + fn RtlClearBit( + BitMapHeader: PRTL_BITMAP, + BitNumber: ULONG, + ); + fn RtlSetBit( + BitMapHeader: PRTL_BITMAP, + BitNumber: ULONG, + ); + fn RtlTestBit( + BitMapHeader: PRTL_BITMAP, + BitNumber: ULONG, + ) -> BOOLEAN; + fn RtlClearAllBits( + BitMapHeader: PRTL_BITMAP, + ); + fn RtlSetAllBits( + BitMapHeader: PRTL_BITMAP, + ); + fn RtlFindClearBits( + BitMapHeader: PRTL_BITMAP, + NumberToFind: ULONG, + HintIndex: ULONG, + ) -> ULONG; + fn RtlFindSetBits( + BitMapHeader: PRTL_BITMAP, + NumberToFind: ULONG, + HintIndex: ULONG, + ) -> ULONG; + fn RtlFindClearBitsAndSet( + BitMapHeader: PRTL_BITMAP, + NumberToFind: ULONG, + HintIndex: ULONG, + ) -> ULONG; + fn RtlFindSetBitsAndClear( + BitMapHeader: PRTL_BITMAP, + NumberToFind: ULONG, + HintIndex: ULONG, + ) -> ULONG; + fn RtlClearBits( + BitMapHeader: PRTL_BITMAP, + StartingIndex: ULONG, + NumberToClear: ULONG, + ); + fn RtlSetBits( + BitMapHeader: PRTL_BITMAP, + StartingIndex: ULONG, + NumberToSet: ULONG, + ); + fn RtlFindMostSignificantBit( + Set: ULONGLONG, + ) -> CCHAR; + fn RtlFindLeastSignificantBit( + Set: ULONGLONG, + ) -> CCHAR; +}} +STRUCT!{struct RTL_BITMAP_RUN { + StartingIndex: ULONG, + NumberOfBits: ULONG, +}} +pub type PRTL_BITMAP_RUN = *mut RTL_BITMAP_RUN; +EXTERN!{extern "system" { + fn RtlFindClearRuns( + BitMapHeader: PRTL_BITMAP, + RunArray: PRTL_BITMAP_RUN, + SizeOfRunArray: ULONG, + LocateLongestRuns: BOOLEAN, + ) -> ULONG; + fn RtlFindLongestRunClear( + BitMapHeader: PRTL_BITMAP, + StartingIndex: PULONG, + ) -> ULONG; + fn RtlFindFirstRunClear( + BitMapHeader: PRTL_BITMAP, + StartingIndex: PULONG, + ) -> ULONG; +}} +#[inline] +pub unsafe fn RtlCheckBit(BitMapHeader: &RTL_BITMAP, BitPosition: ULONG) -> u8 { + #[cfg(target_arch = "x86_64")] { + core::arch::x86_64::_bittest64(BitMapHeader.Buffer as *const i64, BitPosition as i64) + } + #[cfg(any(target_arch = "x86", target_arch = "aarch64"))] { + (*BitMapHeader.Buffer.offset(BitPosition as isize / 32) >> (BitPosition % 32) & 1) as u8 + } +} +EXTERN!{extern "system" { + fn RtlNumberOfClearBits( + BitMapHeader: PRTL_BITMAP, + ) -> ULONG; + fn RtlNumberOfSetBits( + BitMapHeader: PRTL_BITMAP, + ) -> ULONG; + fn RtlAreBitsClear( + BitMapHeader: PRTL_BITMAP, + StartingIndex: ULONG, + Length: ULONG, + ) -> BOOLEAN; + fn RtlAreBitsSet( + BitMapHeader: PRTL_BITMAP, + StartingIndex: ULONG, + Length: ULONG, + ) -> BOOLEAN; + fn RtlFindNextForwardRunClear( + BitMapHeader: PRTL_BITMAP, + FromIndex: ULONG, + StartingRunIndex: PULONG, + ) -> ULONG; + fn RtlFindLastBackwardRunClear( + BitMapHeader: PRTL_BITMAP, + FromIndex: ULONG, + StartingRunIndex: PULONG, + ) -> ULONG; + fn RtlNumberOfSetBitsUlongPtr( + Target: ULONG_PTR, + ) -> ULONG; + fn RtlInterlockedClearBitRun( + BitMapHeader: PRTL_BITMAP, + StartingIndex: ULONG, + NumberToClear: ULONG, + ); + fn RtlInterlockedSetBitRun( + BitMapHeader: PRTL_BITMAP, + StartingIndex: ULONG, + NumberToSet: ULONG, + ); + fn RtlCopyBitMap( + Source: PRTL_BITMAP, + Destination: PRTL_BITMAP, + TargetBit: ULONG, + ); + fn RtlExtractBitMap( + Source: PRTL_BITMAP, + Destination: PRTL_BITMAP, + TargetBit: ULONG, + NumberOfBits: ULONG, + ); + fn RtlNumberOfClearBitsInRange( + BitMapHeader: PRTL_BITMAP, + StartingIndex: ULONG, + Length: ULONG, + ) -> ULONG; + fn RtlNumberOfSetBitsInRange( + BitMapHeader: PRTL_BITMAP, + StartingIndex: ULONG, + Length: ULONG, + ) -> ULONG; +}} +STRUCT!{struct RTL_BITMAP_EX { + SizeOfBitMap: ULONG64, + Buffer: PULONG64, +}} +pub type PRTL_BITMAP_EX = *mut RTL_BITMAP_EX; +EXTERN!{extern "system" { + fn RtlInitializeBitMapEx( + BitMapHeader: PRTL_BITMAP_EX, + BitMapBuffer: PULONG64, + SizeOfBitMap: ULONG64, + ); + fn RtlTestBitEx( + BitMapHeader: PRTL_BITMAP_EX, + BitNumber: ULONG64, + ) -> BOOLEAN; + fn RtlClearAllBitsEx( + BitMapHeader: PRTL_BITMAP_EX, + ); + fn RtlClearBitEx( + BitMapHeader: PRTL_BITMAP_EX, + BitNumber: ULONG64, + ); + fn RtlSetBitEx( + BitMapHeader: PRTL_BITMAP_EX, + BitNumber: ULONG64, + ); + fn RtlFindSetBitsEx( + BitMapHeader: PRTL_BITMAP_EX, + NumberToFind: ULONG64, + HintIndex: ULONG64, + ) -> ULONG64; + fn RtlFindSetBitsAndClearEx( + BitMapHeader: PRTL_BITMAP_EX, + NumberToFind: ULONG64, + HintIndex: ULONG64, + ) -> ULONG64; +}} +UNION!{union RTL_HANDLE_TABLE_ENTRY { + Flags: ULONG, + NextFree: *mut RTL_HANDLE_TABLE_ENTRY, +}} +pub type PRTL_HANDLE_TABLE_ENTRY = *mut RTL_HANDLE_TABLE_ENTRY; +pub const RTL_HANDLE_ALLOCATED: USHORT = 0x0001; +STRUCT!{struct RTL_HANDLE_TABLE { + MaximumNumberOfHandles: ULONG, + SizeOfHandleTableEntry: ULONG, + Reserved: [ULONG; 2], + FreeHandles: PRTL_HANDLE_TABLE_ENTRY, + CommittedHandles: PRTL_HANDLE_TABLE_ENTRY, + UnCommittedHandles: PRTL_HANDLE_TABLE_ENTRY, + MaxReservedHandles: PRTL_HANDLE_TABLE_ENTRY, +}} +pub type PRTL_HANDLE_TABLE = *mut RTL_HANDLE_TABLE; +EXTERN!{extern "system" { + fn RtlInitializeHandleTable( + MaximumNumberOfHandles: ULONG, + SizeOfHandleTableEntry: ULONG, + HandleTable: PRTL_HANDLE_TABLE, + ); + fn RtlDestroyHandleTable( + HandleTable: PRTL_HANDLE_TABLE, + ) -> NTSTATUS; + fn RtlAllocateHandle( + HandleTable: PRTL_HANDLE_TABLE, + HandleIndex: PULONG, + ) -> PRTL_HANDLE_TABLE_ENTRY; + fn RtlFreeHandle( + HandleTable: PRTL_HANDLE_TABLE, + Handle: PRTL_HANDLE_TABLE_ENTRY, + ) -> BOOLEAN; + fn RtlIsValidHandle( + HandleTable: PRTL_HANDLE_TABLE, + Handle: PRTL_HANDLE_TABLE_ENTRY, + ) -> BOOLEAN; + fn RtlIsValidIndexHandle( + HandleTable: PRTL_HANDLE_TABLE, + HandleIndex: ULONG, + Handle: *mut PRTL_HANDLE_TABLE_ENTRY, + ) -> BOOLEAN; +}} +pub const RTL_ATOM_MAXIMUM_INTEGER_ATOM: RTL_ATOM = 0xc000; +pub const RTL_ATOM_INVALID_ATOM: RTL_ATOM = 0x0000; +pub const RTL_ATOM_TABLE_DEFAULT_NUMBER_OF_BUCKETS: u32 = 37; +pub const RTL_ATOM_MAXIMUM_NAME_LENGTH: u32 = 255; +pub const RTL_ATOM_PINNED: u32 = 0x01; +EXTERN!{extern "system" { + fn RtlCreateAtomTable( + NumberOfBuckets: ULONG, + AtomTableHandle: *mut PVOID, + ) -> NTSTATUS; + fn RtlDestroyAtomTable( + AtomTableHandle: PVOID, + ) -> NTSTATUS; + fn RtlEmptyAtomTable( + AtomTableHandle: PVOID, + IncludePinnedAtoms: BOOLEAN, + ) -> NTSTATUS; + fn RtlAddAtomToAtomTable( + AtomTableHandle: PVOID, + AtomName: PWSTR, + Atom: PRTL_ATOM, + ) -> NTSTATUS; + fn RtlLookupAtomInAtomTable( + AtomTableHandle: PVOID, + AtomName: PWSTR, + Atom: PRTL_ATOM, + ) -> NTSTATUS; + fn RtlDeleteAtomFromAtomTable( + AtomTableHandle: PVOID, + Atom: RTL_ATOM, + ) -> NTSTATUS; + fn RtlPinAtomInAtomTable( + AtomTableHandle: PVOID, + Atom: RTL_ATOM, + ) -> NTSTATUS; + fn RtlQueryAtomInAtomTable( + AtomTableHandle: PVOID, + Atom: RTL_ATOM, + AtomUsage: PULONG, + AtomFlags: PULONG, + AtomName: PWSTR, + AtomNameLength: PULONG, + ) -> NTSTATUS; + fn RtlGetIntegerAtom( + AtomName: PWSTR, + IntegerAtom: PUSHORT, + ) -> BOOLEAN; + fn RtlValidSid( + Sid: PSID, + ) -> BOOLEAN; + fn RtlEqualSid( + Sid1: PSID, + Sid2: PSID, + ) -> BOOLEAN; + fn RtlEqualPrefixSid( + Sid1: PSID, + Sid2: PSID, + ) -> BOOLEAN; + fn RtlLengthRequiredSid( + SubAuthorityCount: ULONG, + ) -> ULONG; + fn RtlFreeSid( + Sid: PSID, + ) -> PVOID; + fn RtlAllocateAndInitializeSid( + IdentifierAuthority: PSID_IDENTIFIER_AUTHORITY, + SubAuthorityCount: UCHAR, + SubAuthority0: ULONG, + SubAuthority1: ULONG, + SubAuthority2: ULONG, + SubAuthority3: ULONG, + SubAuthority4: ULONG, + SubAuthority5: ULONG, + SubAuthority6: ULONG, + SubAuthority7: ULONG, + Sid: *mut PSID, + ) -> NTSTATUS; + fn RtlInitializeSid( + Sid: PSID, + IdentifierAuthority: PSID_IDENTIFIER_AUTHORITY, + SubAuthorityCount: UCHAR, + ) -> NTSTATUS; +}} +EXTERN!{extern "C" { + fn RtlInitializeSidEx( + Sid: PSID, + IdentifierAuthority: PSID_IDENTIFIER_AUTHORITY, + SubAuthorityCount: UCHAR, + ... + ) -> NTSTATUS; +}} +EXTERN!{extern "system" { + fn RtlIdentifierAuthoritySid( + Sid: PSID, + ) -> PSID_IDENTIFIER_AUTHORITY; + fn RtlSubAuthoritySid( + Sid: PSID, + SubAuthority: ULONG, + ) -> PULONG; + fn RtlSubAuthorityCountSid( + Sid: PSID, + ) -> PUCHAR; + fn RtlLengthSid( + Sid: PSID, + ) -> ULONG; + fn RtlCopySid( + DestinationSidLength: ULONG, + DestinationSid: PSID, + SourceSid: PSID, + ) -> NTSTATUS; + fn RtlCopySidAndAttributesArray( + Count: ULONG, + Src: PSID_AND_ATTRIBUTES, + SidAreaSize: ULONG, + Dest: PSID_AND_ATTRIBUTES, + SidArea: PSID, + RemainingSidArea: *mut PSID, + RemainingSidAreaSize: PULONG, + ) -> NTSTATUS; + fn RtlCreateServiceSid( + ServiceName: PUNICODE_STRING, + ServiceSid: PSID, + ServiceSidLength: PULONG, + ) -> NTSTATUS; + fn RtlSidDominates( + Sid1: PSID, + Sid2: PSID, + Dominates: PBOOLEAN, + ) -> NTSTATUS; + fn RtlSidDominatesForTrust( + Sid1: PSID, + Sid2: PSID, + DominatesTrust: PBOOLEAN, + ) -> NTSTATUS; + fn RtlSidEqualLevel( + Sid1: PSID, + Sid2: PSID, + EqualLevel: PBOOLEAN, + ) -> NTSTATUS; + fn RtlSidIsHigherLevel( + Sid1: PSID, + Sid2: PSID, + HigherLevel: PBOOLEAN, + ) -> NTSTATUS; + fn RtlCreateVirtualAccountSid( + Name: PCUNICODE_STRING, + BaseSubAuthority: ULONG, + Sid: PSID, + SidLength: PULONG, + ) -> NTSTATUS; + fn RtlReplaceSidInSd( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + OldSid: PSID, + NewSid: PSID, + NumChanges: *mut ULONG, + ) -> NTSTATUS; +}} +pub const MAX_UNICODE_STACK_BUFFER_LENGTH: usize = 256; +EXTERN!{extern "system" { + fn RtlConvertSidToUnicodeString( + UnicodeString: PUNICODE_STRING, + Sid: PSID, + AllocateDestinationString: BOOLEAN, + ) -> NTSTATUS; + fn RtlSidHashInitialize( + SidAttr: PSID_AND_ATTRIBUTES, + SidCount: ULONG, + SidAttrHash: PSID_AND_ATTRIBUTES_HASH, + ) -> NTSTATUS; + fn RtlSidHashLookup( + SidAttrHash: PSID_AND_ATTRIBUTES_HASH, + Sid: PSID, + ) -> PSID_AND_ATTRIBUTES; + fn RtlIsElevatedRid( + SidAttr: PSID_AND_ATTRIBUTES, + ) -> BOOLEAN; + fn RtlDeriveCapabilitySidsFromName( + UnicodeString: PUNICODE_STRING, + CapabilityGroupSid: PSID, + CapabilitySid: PSID, + ) -> NTSTATUS; + fn RtlCreateSecurityDescriptor( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + Revision: ULONG, + ) -> NTSTATUS; + fn RtlValidSecurityDescriptor( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + ) -> BOOLEAN; + fn RtlLengthSecurityDescriptor( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + ) -> ULONG; + fn RtlValidRelativeSecurityDescriptor( + SecurityDescriptorInput: PSECURITY_DESCRIPTOR, + SecurityDescriptorLength: ULONG, + RequiredInformation: SECURITY_INFORMATION, + ) -> BOOLEAN; + fn RtlGetControlSecurityDescriptor( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + Control: PSECURITY_DESCRIPTOR_CONTROL, + Revision: PULONG, + ) -> NTSTATUS; + fn RtlSetControlSecurityDescriptor( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + ControlBitsOfInterest: SECURITY_DESCRIPTOR_CONTROL, + ControlBitsToSet: SECURITY_DESCRIPTOR_CONTROL, + ) -> NTSTATUS; + fn RtlSetAttributesSecurityDescriptor( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + Control: SECURITY_DESCRIPTOR_CONTROL, + Revision: PULONG, + ) -> NTSTATUS; + fn RtlGetSecurityDescriptorRMControl( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + RMControl: PUCHAR, + ) -> BOOLEAN; + fn RtlSetSecurityDescriptorRMControl( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + RMControl: PUCHAR, + ); + fn RtlSetDaclSecurityDescriptor( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + DaclPresent: BOOLEAN, + Dacl: PACL, + DaclDefaulted: BOOLEAN, + ) -> NTSTATUS; + fn RtlGetDaclSecurityDescriptor( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + DaclPresent: PBOOLEAN, + Dacl: *mut PACL, + DaclDefaulted: PBOOLEAN, + ) -> NTSTATUS; + fn RtlSetSaclSecurityDescriptor( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + SaclPresent: BOOLEAN, + Sacl: PACL, + SaclDefaulted: BOOLEAN, + ) -> NTSTATUS; + fn RtlGetSaclSecurityDescriptor( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + SaclPresent: PBOOLEAN, + Sacl: *mut PACL, + SaclDefaulted: PBOOLEAN, + ) -> NTSTATUS; + fn RtlSetOwnerSecurityDescriptor( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + Owner: PSID, + OwnerDefaulted: BOOLEAN, + ) -> NTSTATUS; + fn RtlGetOwnerSecurityDescriptor( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + Owner: *mut PSID, + OwnerDefaulted: PBOOLEAN, + ) -> NTSTATUS; + fn RtlSetGroupSecurityDescriptor( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + Group: PSID, + GroupDefaulted: BOOLEAN, + ) -> NTSTATUS; + fn RtlGetGroupSecurityDescriptor( + SecurityDescriptor: PSECURITY_DESCRIPTOR, + Group: *mut PSID, + GroupDefaulted: PBOOLEAN, + ) -> NTSTATUS; + fn RtlMakeSelfRelativeSD( + AbsoluteSecurityDescriptor: PSECURITY_DESCRIPTOR, + SelfRelativeSecurityDescriptor: PSECURITY_DESCRIPTOR, + BufferLength: PULONG, + ) -> NTSTATUS; + fn RtlAbsoluteToSelfRelativeSD( + AbsoluteSecurityDescriptor: PSECURITY_DESCRIPTOR, + SelfRelativeSecurityDescriptor: PSECURITY_DESCRIPTOR, + BufferLength: PULONG, + ) -> NTSTATUS; + fn RtlSelfRelativeToAbsoluteSD( + SelfRelativeSecurityDescriptor: PSECURITY_DESCRIPTOR, + AbsoluteSecurityDescriptor: PSECURITY_DESCRIPTOR, + AbsoluteSecurityDescriptorSize: PULONG, + Dacl: PACL, + DaclSize: PULONG, + Sacl: PACL, + SaclSize: PULONG, + Owner: PSID, + OwnerSize: PULONG, + PrimaryGroup: PSID, + PrimaryGroupSize: PULONG, + ) -> NTSTATUS; + fn RtlSelfRelativeToAbsoluteSD2( + pSelfRelativeSecurityDescriptor: PSECURITY_DESCRIPTOR, + pBufferSize: PULONG, + ) -> NTSTATUS; + fn RtlAreAllAccessesGranted( + GrantedAccess: ACCESS_MASK, + DesiredAccess: ACCESS_MASK, + ) -> BOOLEAN; + fn RtlAreAnyAccessesGranted( + GrantedAccess: ACCESS_MASK, + DesiredAccess: ACCESS_MASK, + ) -> BOOLEAN; + fn RtlMapGenericMask( + AccessMask: PACCESS_MASK, + GenericMapping: PGENERIC_MAPPING, + ); + fn RtlCreateAcl( + Acl: PACL, + AclLength: ULONG, + AclRevision: ULONG, + ) -> NTSTATUS; + fn RtlValidAcl( + Acl: PACL, + ) -> BOOLEAN; + fn RtlQueryInformationAcl( + Acl: PACL, + AclInformation: PVOID, + AclInformationLength: ULONG, + AclInformationClass: ACL_INFORMATION_CLASS, + ) -> NTSTATUS; + fn RtlSetInformationAcl( + Acl: PACL, + AclInformation: PVOID, + AclInformationLength: ULONG, + AclInformationClass: ACL_INFORMATION_CLASS, + ) -> NTSTATUS; + fn RtlAddAce( + Acl: PACL, + AceRevision: ULONG, + StartingAceIndex: ULONG, + AceList: PVOID, + AceListLength: ULONG, + ) -> NTSTATUS; + fn RtlDeleteAce( + Acl: PACL, + AceIndex: ULONG, + ) -> NTSTATUS; + fn RtlGetAce( + Acl: PACL, + AceIndex: ULONG, + Ace: *mut PVOID, + ) -> NTSTATUS; + fn RtlFirstFreeAce( + Acl: PACL, + FirstFree: *mut PVOID, + ) -> BOOLEAN; + fn RtlFindAceByType( + pAcl: PACL, + AceType: UCHAR, + pIndex: PULONG, + ) -> PVOID; + fn RtlOwnerAcesPresent( + pAcl: PACL, + ) -> BOOLEAN; + fn RtlAddAccessAllowedAce( + Acl: PACL, + AceRevision: ULONG, + AccessMask: ACCESS_MASK, + Sid: PSID, + ) -> NTSTATUS; + fn RtlAddAccessAllowedAceEx( + Acl: PACL, + AceRevision: ULONG, + AceFlags: ULONG, + AccessMask: ACCESS_MASK, + Sid: PSID, + ) -> NTSTATUS; + fn RtlAddAccessDeniedAce( + Acl: PACL, + AceRevision: ULONG, + AccessMask: ACCESS_MASK, + Sid: PSID, + ) -> NTSTATUS; + fn RtlAddAccessDeniedAceEx( + Acl: PACL, + AceRevision: ULONG, + AceFlags: ULONG, + AccessMask: ACCESS_MASK, + Sid: PSID, + ) -> NTSTATUS; + fn RtlAddAuditAccessAce( + Acl: PACL, + AceRevision: ULONG, + AccessMask: ACCESS_MASK, + Sid: PSID, + AuditSuccess: BOOLEAN, + AuditFailure: BOOLEAN, + ) -> NTSTATUS; + fn RtlAddAuditAccessAceEx( + Acl: PACL, + AceRevision: ULONG, + AceFlags: ULONG, + AccessMask: ACCESS_MASK, + Sid: PSID, + AuditSuccess: BOOLEAN, + AuditFailure: BOOLEAN, + ) -> NTSTATUS; + fn RtlAddAccessAllowedObjectAce( + Acl: PACL, + AceRevision: ULONG, + AceFlags: ULONG, + AccessMask: ACCESS_MASK, + ObjectTypeGuid: *mut GUID, + InheritedObjectTypeGuid: *mut GUID, + Sid: PSID, + ) -> NTSTATUS; + fn RtlAddAccessDeniedObjectAce( + Acl: PACL, + AceRevision: ULONG, + AceFlags: ULONG, + AccessMask: ACCESS_MASK, + ObjectTypeGuid: *mut GUID, + InheritedObjectTypeGuid: *mut GUID, + Sid: PSID, + ) -> NTSTATUS; + fn RtlAddAuditAccessObjectAce( + Acl: PACL, + AceRevision: ULONG, + AceFlags: ULONG, + AccessMask: ACCESS_MASK, + ObjectTypeGuid: *mut GUID, + InheritedObjectTypeGuid: *mut GUID, + Sid: PSID, + AuditSuccess: BOOLEAN, + AuditFailure: BOOLEAN, + ) -> NTSTATUS; + fn RtlAddCompoundAce( + Acl: PACL, + AceRevision: ULONG, + AceType: UCHAR, + AccessMask: ACCESS_MASK, + ServerSid: PSID, + ClientSid: PSID, + ) -> NTSTATUS; + fn RtlAddMandatoryAce( + Acl: PACL, + AceRevision: ULONG, + AceFlags: ULONG, + Sid: PSID, + AceType: UCHAR, + AccessMask: ACCESS_MASK, + ) -> NTSTATUS; + fn RtlDefaultNpAcl( + Acl: *mut PACL, + ) -> NTSTATUS; + fn RtlNewSecurityObject( + ParentDescriptor: PSECURITY_DESCRIPTOR, + CreatorDescriptor: PSECURITY_DESCRIPTOR, + NewDescriptor: *mut PSECURITY_DESCRIPTOR, + IsDirectoryObject: BOOLEAN, + Token: HANDLE, + GenericMapping: PGENERIC_MAPPING, + ) -> NTSTATUS; + fn RtlNewSecurityObjectEx( + ParentDescriptor: PSECURITY_DESCRIPTOR, + CreatorDescriptor: PSECURITY_DESCRIPTOR, + NewDescriptor: *mut PSECURITY_DESCRIPTOR, + ObjectType: *mut GUID, + IsDirectoryObject: BOOLEAN, + AutoInheritFlags: ULONG, + Token: HANDLE, + GenericMapping: PGENERIC_MAPPING, + ) -> NTSTATUS; + fn RtlNewSecurityObjectWithMultipleInheritance( + ParentDescriptor: PSECURITY_DESCRIPTOR, + CreatorDescriptor: PSECURITY_DESCRIPTOR, + NewDescriptor: *mut PSECURITY_DESCRIPTOR, + ObjectType: *mut *mut GUID, + GuidCount: ULONG, + IsDirectoryObject: BOOLEAN, + AutoInheritFlags: ULONG, + Token: HANDLE, + GenericMapping: PGENERIC_MAPPING, + ) -> NTSTATUS; + fn RtlDeleteSecurityObject( + ObjectDescriptor: *mut PSECURITY_DESCRIPTOR, + ) -> NTSTATUS; + fn RtlQuerySecurityObject( + ObjectDescriptor: PSECURITY_DESCRIPTOR, + SecurityInformation: SECURITY_INFORMATION, + ResultantDescriptor: PSECURITY_DESCRIPTOR, + DescriptorLength: ULONG, + ReturnLength: PULONG, + ) -> NTSTATUS; + fn RtlSetSecurityObject( + SecurityInformation: SECURITY_INFORMATION, + ModificationDescriptor: PSECURITY_DESCRIPTOR, + ObjectsSecurityDescriptor: *mut PSECURITY_DESCRIPTOR, + GenericMapping: PGENERIC_MAPPING, + Token: HANDLE, + ) -> NTSTATUS; + fn RtlSetSecurityObjectEx( + SecurityInformation: SECURITY_INFORMATION, + ModificationDescriptor: PSECURITY_DESCRIPTOR, + ObjectsSecurityDescriptor: *mut PSECURITY_DESCRIPTOR, + AutoInheritFlags: ULONG, + GenericMapping: PGENERIC_MAPPING, + Token: HANDLE, + ) -> NTSTATUS; + fn RtlConvertToAutoInheritSecurityObject( + ParentDescriptor: PSECURITY_DESCRIPTOR, + CurrentSecurityDescriptor: PSECURITY_DESCRIPTOR, + NewSecurityDescriptor: *mut PSECURITY_DESCRIPTOR, + ObjectType: *mut GUID, + IsDirectoryObject: BOOLEAN, + GenericMapping: PGENERIC_MAPPING, + ) -> NTSTATUS; + fn RtlNewInstanceSecurityObject( + ParentDescriptorChanged: BOOLEAN, + CreatorDescriptorChanged: BOOLEAN, + OldClientTokenModifiedId: PLUID, + NewClientTokenModifiedId: PLUID, + ParentDescriptor: PSECURITY_DESCRIPTOR, + CreatorDescriptor: PSECURITY_DESCRIPTOR, + NewDescriptor: *mut PSECURITY_DESCRIPTOR, + IsDirectoryObject: BOOLEAN, + Token: HANDLE, + GenericMapping: PGENERIC_MAPPING, + ) -> NTSTATUS; + fn RtlCopySecurityDescriptor( + InputSecurityDescriptor: PSECURITY_DESCRIPTOR, + OutputSecurityDescriptor: *mut PSECURITY_DESCRIPTOR, + ) -> NTSTATUS; + fn RtlRunEncodeUnicodeString( + Seed: PUCHAR, + String: PUNICODE_STRING, + ); + fn RtlRunDecodeUnicodeString( + Seed: UCHAR, + String: PUNICODE_STRING, + ); + fn RtlImpersonateSelf( + ImpersonationLevel: SECURITY_IMPERSONATION_LEVEL, + ) -> NTSTATUS; + fn RtlImpersonateSelfEx( + ImpersonationLevel: SECURITY_IMPERSONATION_LEVEL, + AdditionalAccess: ACCESS_MASK, + ThreadToken: PHANDLE, + ) -> NTSTATUS; + fn RtlAdjustPrivilege( + Privilege: ULONG, + Enable: BOOLEAN, + Client: BOOLEAN, + WasEnabled: PBOOLEAN, + ) -> NTSTATUS; +}} +pub const RTL_ACQUIRE_PRIVILEGE_REVERT: ULONG = 0x00000001; +pub const RTL_ACQUIRE_PRIVILEGE_PROCESS: ULONG = 0x00000002; +EXTERN!{extern "system" { + fn RtlAcquirePrivilege( + Privilege: PULONG, + NumPriv: ULONG, + Flags: ULONG, + ReturnedState: *mut PVOID, + ) -> NTSTATUS; + fn RtlReleasePrivilege( + StatePointer: PVOID, + ); + fn RtlRemovePrivileges( + TokenHandle: HANDLE, + PrivilegesToKeep: PULONG, + PrivilegeCount: ULONG, + ) -> NTSTATUS; + fn RtlIsUntrustedObject( + Handle: HANDLE, + Object: PVOID, + IsUntrustedObject: PBOOLEAN, + ) -> NTSTATUS; + fn RtlQueryValidationRunlevel( + ComponentName: PUNICODE_STRING, + ) -> ULONG; + fn RtlCreateBoundaryDescriptor( + Name: PUNICODE_STRING, + Flags: ULONG, + ) -> PVOID; + fn RtlDeleteBoundaryDescriptor( + BoundaryDescriptor: PVOID, + ); + fn RtlAddSIDToBoundaryDescriptor( + BoundaryDescriptor: *mut PVOID, + RequiredSid: PSID, + ) -> NTSTATUS; + fn RtlAddIntegrityLabelToBoundaryDescriptor( + BoundaryDescriptor: *mut PVOID, + IntegrityLabel: PSID, + ) -> NTSTATUS; + fn RtlGetVersion( + lpVersionInformation: PRTL_OSVERSIONINFOW, + ) -> NTSTATUS; + fn RtlVerifyVersionInfo( + VersionInfo: PRTL_OSVERSIONINFOEXW, + TypeMask: ULONG, + ConditionMask: ULONGLONG, + ) -> NTSTATUS; + fn RtlGetNtVersionNumbers( + NtMajorVersion: PULONG, + NtMinorVersion: PULONG, + NtBuildNumber: PULONG, + ); + fn RtlGetNtGlobalFlags() -> ULONG; + fn RtlGetNtProductType( + NtProductType: PNT_PRODUCT_TYPE, + ) -> BOOLEAN; + fn RtlGetSuiteMask() -> ULONG; + fn RtlRegisterWait( + WaitHandle: PHANDLE, + Handle: HANDLE, + Function: WAITORTIMERCALLBACKFUNC, + Context: PVOID, + Milliseconds: ULONG, + Flags: ULONG, + ) -> NTSTATUS; + fn RtlDeregisterWait( + WaitHandle: HANDLE, + ) -> NTSTATUS; + fn RtlDeregisterWaitEx( + WaitHandle: HANDLE, + Event: HANDLE, + ) -> NTSTATUS; + fn RtlQueueWorkItem( + Function: WORKERCALLBACKFUNC, + Context: PVOID, + Flags: ULONG, + ) -> NTSTATUS; + fn RtlSetIoCompletionCallback( + FileHandle: HANDLE, + CompletionProc: APC_CALLBACK_FUNCTION, + Flags: ULONG, + ) -> NTSTATUS; +}} +FN!{stdcall PRTL_START_POOL_THREAD( + Function: PTHREAD_START_ROUTINE, + Parameter: PVOID, + ThreadHandle: PHANDLE, +) -> NTSTATUS} +FN!{stdcall PRTL_EXIT_POOL_THREAD( + ExitStatus: NTSTATUS, +) -> NTSTATUS} +EXTERN!{extern "system" { + fn RtlSetThreadPoolStartFunc( + StartPoolThread: PRTL_START_POOL_THREAD, + ExitPoolThread: PRTL_EXIT_POOL_THREAD, + ) -> NTSTATUS; + fn RtlUserThreadStart( + Function: PTHREAD_START_ROUTINE, + Parameter: PVOID, + ); + fn LdrInitializeThunk( + ContextRecord: PCONTEXT, + Parameter: PVOID, + ); + fn RtlCreateTimerQueue( + TimerQueueHandle: PHANDLE, + ) -> NTSTATUS; + fn RtlCreateTimer( + TimerQueueHandle: HANDLE, + Handle: PHANDLE, + Function: WAITORTIMERCALLBACKFUNC, + Context: PVOID, + DueTime: ULONG, + Period: ULONG, + Flags: ULONG, + ) -> NTSTATUS; + fn RtlUpdateTimer( + TimerQueueHandle: HANDLE, + TimerHandle: HANDLE, + DueTime: ULONG, + Period: ULONG, + ) -> NTSTATUS; + fn RtlDeleteTimer( + TimerQueueHandle: HANDLE, + TimerToCancel: HANDLE, + Event: HANDLE, + ) -> NTSTATUS; + fn RtlDeleteTimerQueue( + TimerQueueHandle: HANDLE, + ) -> NTSTATUS; + fn RtlDeleteTimerQueueEx( + TimerQueueHandle: HANDLE, + Event: HANDLE, + ) -> NTSTATUS; + fn RtlFormatCurrentUserKeyPath( + CurrentUserKeyPath: PUNICODE_STRING, + ) -> NTSTATUS; + fn RtlOpenCurrentUser( + DesiredAccess: ACCESS_MASK, + CurrentUserKey: PHANDLE, + ) -> NTSTATUS; +}} +pub const RTL_REGISTRY_ABSOLUTE: ULONG = 0; +pub const RTL_REGISTRY_SERVICES: ULONG = 1; +pub const RTL_REGISTRY_CONTROL: ULONG = 2; +pub const RTL_REGISTRY_WINDOWS_NT: ULONG = 3; +pub const RTL_REGISTRY_DEVICEMAP: ULONG = 4; +pub const RTL_REGISTRY_USER: ULONG = 5; +pub const RTL_REGISTRY_MAXIMUM: ULONG = 6; +pub const RTL_REGISTRY_HANDLE: ULONG = 0x40000000; +pub const RTL_REGISTRY_OPTIONAL: ULONG = 0x80000000; +EXTERN!{extern "system" { + fn RtlCreateRegistryKey( + RelativeTo: ULONG, + Path: PWSTR, + ) -> NTSTATUS; + fn RtlCheckRegistryKey( + RelativeTo: ULONG, + Path: PWSTR, + ) -> NTSTATUS; +}} +FN!{stdcall PRTL_QUERY_REGISTRY_ROUTINE( + ValueName: PWSTR, + ValueType: ULONG, + ValueData: PVOID, + ValueLength: ULONG, + Context: PVOID, + EntryContext: PVOID, +) -> NTSTATUS} +STRUCT!{struct RTL_QUERY_REGISTRY_TABLE { + QueryRoutine: PRTL_QUERY_REGISTRY_ROUTINE, + Flags: ULONG, + Name: PWSTR, + EntryContext: PVOID, + DefaultType: ULONG, + DefaultData: PVOID, + DefaultLength: ULONG, +}} +pub type PRTL_QUERY_REGISTRY_TABLE = *mut RTL_QUERY_REGISTRY_TABLE; +pub const RTL_QUERY_REGISTRY_SUBKEY: ULONG = 0x00000001; +pub const RTL_QUERY_REGISTRY_TOPKEY: ULONG = 0x00000002; +pub const RTL_QUERY_REGISTRY_REQUIRED: ULONG = 0x00000004; +pub const RTL_QUERY_REGISTRY_NOVALUE: ULONG = 0x00000008; +pub const RTL_QUERY_REGISTRY_NOEXPAND: ULONG = 0x00000010; +pub const RTL_QUERY_REGISTRY_DIRECT: ULONG = 0x00000020; +pub const RTL_QUERY_REGISTRY_DELETE: ULONG = 0x00000040; +EXTERN!{extern "system" { + fn RtlQueryRegistryValues( + RelativeTo: ULONG, + Path: PCWSTR, + QueryTable: PRTL_QUERY_REGISTRY_TABLE, + Context: PVOID, + Environment: PVOID, + ) -> NTSTATUS; + fn RtlQueryRegistryValuesEx( + RelativeTo: ULONG, + Path: PWSTR, + QueryTable: PRTL_QUERY_REGISTRY_TABLE, + Context: PVOID, + Environment: PVOID, + ) -> NTSTATUS; + fn RtlWriteRegistryValue( + RelativeTo: ULONG, + Path: PCWSTR, + ValueName: PCWSTR, + ValueType: ULONG, + ValueData: PVOID, + ValueLength: ULONG, + ) -> NTSTATUS; + fn RtlDeleteRegistryValue( + RelativeTo: ULONG, + Path: PCWSTR, + ValueName: PCWSTR, + ) -> NTSTATUS; + fn RtlEnableThreadProfiling( + ThreadHandle: HANDLE, + Flags: ULONG, + HardwareCounters: ULONG64, + PerformanceDataHandle: *mut PVOID, + ) -> NTSTATUS; + fn RtlDisableThreadProfiling( + PerformanceDataHandle: PVOID, + ) -> NTSTATUS; + fn RtlQueryThreadProfiling( + ThreadHandle: HANDLE, + Enabled: PBOOLEAN, + ) -> NTSTATUS; + fn RtlReadThreadProfilingData( + PerformanceDataHandle: HANDLE, + Flags: ULONG, + PerformanceData: PPERFORMANCE_DATA, + ) -> NTSTATUS; + fn RtlGetNativeSystemInformation( + SystemInformationClass: ULONG, + NativeSystemInformation: PVOID, + InformationLength: ULONG, + ReturnLength: PULONG, + ) -> NTSTATUS; + fn RtlQueueApcWow64Thread( + ThreadHandle: HANDLE, + ApcRoutine: PPS_APC_ROUTINE, + ApcArgument1: PVOID, + ApcArgument2: PVOID, + ApcArgument3: PVOID, + ) -> NTSTATUS; + fn RtlWow64EnableFsRedirection( + Wow64FsEnableRedirection: BOOLEAN, + ) -> NTSTATUS; + fn RtlWow64EnableFsRedirectionEx( + Wow64FsEnableRedirection: PVOID, + OldFsRedirectionLevel: *mut PVOID, + ) -> NTSTATUS; + fn RtlComputeCrc32( + PartialCrc: ULONG32, + Buffer: PVOID, + Length: ULONG, + ) -> ULONG32; + fn RtlEncodePointer( + Ptr: PVOID, + ) -> PVOID; + fn RtlDecodePointer( + Ptr: PVOID, + ) -> PVOID; + fn RtlEncodeSystemPointer( + Ptr: PVOID, + ) -> PVOID; + fn RtlDecodeSystemPointer( + Ptr: PVOID, + ) -> PVOID; + fn RtlEncodeRemotePointer( + ProcessHandle: HANDLE, + Pointer: PVOID, + EncodedPointer: *mut PVOID, + ) -> NTSTATUS; + fn RtlDecodeRemotePointer( + ProcessHandle: HANDLE, + Pointer: PVOID, + DecodedPointer: *mut PVOID, + ) -> NTSTATUS; + fn RtlIsProcessorFeaturePresent( + ProcessorFeature: ULONG, + ) -> BOOLEAN; + fn RtlGetCurrentProcessorNumber() -> ULONG; + fn RtlGetCurrentProcessorNumberEx( + ProcessorNumber: PPROCESSOR_NUMBER, + ); + fn RtlPushFrame( + Frame: PTEB_ACTIVE_FRAME, + ); + fn RtlPopFrame( + Frame: PTEB_ACTIVE_FRAME, + ); + fn RtlGetFrame() -> PTEB_ACTIVE_FRAME; +}} +pub const RTL_WALK_USER_MODE_STACK: ULONG = 0x00000001; +pub const RTL_WALK_VALID_FLAGS: ULONG = 0x00000001; +pub const RTL_STACK_WALKING_MODE_FRAMES_TO_SKIP_SHIFT: ULONG = 0x00000008; +EXTERN!{extern "system" { + fn RtlWalkFrameChain( + Callers: *mut PVOID, + Count: ULONG, + Flags: ULONG, + ) -> ULONG; + fn RtlGetCallersAddress( + CallersAddress: *mut PVOID, + CallersCaller: *mut PVOID, + ); + fn RtlGetEnabledExtendedFeatures( + FeatureMask: ULONG64, + ) -> ULONG64; + fn RtlGetEnabledExtendedAndSupervisorFeatures( + FeatureMask: ULONG64, + ) -> ULONG64; + fn RtlLocateSupervisorFeature( + XStateHeader: PXSAVE_AREA_HEADER, + FeatureId: ULONG, + Length: PULONG, + ) -> PVOID; +}} +STRUCT!{struct RTL_ELEVATION_FLAGS { + Flags: ULONG, +}} +BITFIELD!{RTL_ELEVATION_FLAGS Flags: ULONG [ + ElevationEnabled set_ElevationEnabled[0..1], + VirtualizationEnabled set_VirtualizationEnabled[1..2], + InstallerDetectEnabled set_InstallerDetectEnabled[2..3], + ReservedBits set_ReservedBits[3..32], +]} +pub type PRTL_ELEVATION_FLAGS = *mut RTL_ELEVATION_FLAGS; +EXTERN!{extern "system" { + fn RtlQueryElevationFlags( + Flags: PRTL_ELEVATION_FLAGS, + ) -> NTSTATUS; + fn RtlRegisterThreadWithCsrss() -> NTSTATUS; + fn RtlLockCurrentThread() -> NTSTATUS; + fn RtlUnlockCurrentThread() -> NTSTATUS; + fn RtlLockModuleSection( + Address: PVOID, + ) -> NTSTATUS; + fn RtlUnlockModuleSection( + Address: PVOID, + ) -> NTSTATUS; +}} +pub const RTL_UNLOAD_EVENT_TRACE_NUMBER: u32 = 64; +STRUCT!{struct RTL_UNLOAD_EVENT_TRACE { + BaseAddress: PVOID, + SizeOfImage: SIZE_T, + Sequence: ULONG, + TimeDateStamp: ULONG, + CheckSum: ULONG, + ImageName: [WCHAR; 32], + Version: [ULONG; 2], +}} +pub type PRTL_UNLOAD_EVENT_TRACE = *mut RTL_UNLOAD_EVENT_TRACE; +STRUCT!{struct RTL_UNLOAD_EVENT_TRACE32 { + BaseAddress: ULONG, + SizeOfImage: ULONG, + Sequence: ULONG, + TimeDateStamp: ULONG, + CheckSum: ULONG, + ImageName: [WCHAR; 32], + Version: [ULONG; 2], +}} +pub type PRTL_UNLOAD_EVENT_TRACE32 = *mut RTL_UNLOAD_EVENT_TRACE32; +EXTERN!{extern "system" { + fn RtlGetUnloadEventTrace() -> PRTL_UNLOAD_EVENT_TRACE; + fn RtlGetUnloadEventTraceEx( + ElementSize: *mut PULONG, + ElementCount: *mut PULONG, + EventTrace: *mut PVOID, + ); + fn RtlQueryPerformanceCounter( + PerformanceCounter: PLARGE_INTEGER, + ) -> LOGICAL; + fn RtlQueryPerformanceFrequency( + PerformanceFrequency: PLARGE_INTEGER, + ) -> LOGICAL; +}} +ENUM!{enum IMAGE_MITIGATION_POLICY { + ImageDepPolicy = 0, + ImageAslrPolicy = 1, + ImageDynamicCodePolicy = 2, + ImageStrictHandleCheckPolicy = 3, + ImageSystemCallDisablePolicy = 4, + ImageMitigationOptionsMask = 5, + ImageExtensionPointDisablePolicy = 6, + ImageControlFlowGuardPolicy = 7, + ImageSignaturePolicy = 8, + ImageFontDisablePolicy = 9, + ImageImageLoadPolicy = 10, + ImagePayloadRestrictionPolicy = 11, + ImageChildProcessPolicy = 12, + ImageSehopPolicy = 13, + ImageHeapPolicy = 14, + MaxImageMitigationPolicy = 15, +}} +UNION!{union RTL_IMAGE_MITIGATION_POLICY { + Bitfields1: ULONG64, + Bitfields2: ULONG64, +}} +BITFIELD!{unsafe RTL_IMAGE_MITIGATION_POLICY Bitfields1: ULONG64 [ + AuditState set_AuditState[0..2], + AuditFlag set_AuditFlag[2..3], + EnableAdditionalAuditingOption set_EnableAdditionalAuditingOption[3..4], + Reserved set_Reserved[4..64], +]} +BITFIELD!{unsafe RTL_IMAGE_MITIGATION_POLICY Bitfields2: ULONG64 [ + PolicyState set_PolicyState[0..2], + AlwaysInherit set_AlwaysInherit[2..3], + EnableAdditionalPolicyOption set_EnableAdditionalPolicyOption[3..4], + AuditReserved set_AuditReserved[4..64], +]} +pub type PRTL_IMAGE_MITIGATION_POLICY = *mut RTL_IMAGE_MITIGATION_POLICY; +STRUCT!{struct RTL_IMAGE_MITIGATION_DEP_POLICY { + Dep: RTL_IMAGE_MITIGATION_POLICY, +}} +pub type PRTL_IMAGE_MITIGATION_DEP_POLICY = *mut RTL_IMAGE_MITIGATION_DEP_POLICY; +STRUCT!{struct RTL_IMAGE_MITIGATION_ASLR_POLICY { + ForceRelocateImages: RTL_IMAGE_MITIGATION_POLICY, + BottomUpRandomization: RTL_IMAGE_MITIGATION_POLICY, + HighEntropyRandomization: RTL_IMAGE_MITIGATION_POLICY, +}} +pub type PRTL_IMAGE_MITIGATION_ASLR_POLICY = *mut RTL_IMAGE_MITIGATION_ASLR_POLICY; +STRUCT!{struct RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY { + BlockDynamicCode: RTL_IMAGE_MITIGATION_POLICY, +}} +pub type PRTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY = *mut RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY; +STRUCT!{struct RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY { + StrictHandleChecks: RTL_IMAGE_MITIGATION_POLICY, +}} +pub type PRTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY = + *mut RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY; +STRUCT!{struct RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY { + BlockWin32kSystemCalls: RTL_IMAGE_MITIGATION_POLICY, +}} +pub type PRTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY = + *mut RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY; +STRUCT!{struct RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY { + DisableExtensionPoints: RTL_IMAGE_MITIGATION_POLICY, +}} +pub type PRTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY = + *mut RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY; +STRUCT!{struct RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY { + ControlFlowGuard: RTL_IMAGE_MITIGATION_POLICY, + StrictControlFlowGuard: RTL_IMAGE_MITIGATION_POLICY, +}} +pub type PRTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY = + *mut RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY; +STRUCT!{struct RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY { + BlockNonMicrosoftSignedBinaries: RTL_IMAGE_MITIGATION_POLICY, + EnforceSigningOnModuleDependencies: RTL_IMAGE_MITIGATION_POLICY, +}} +pub type PRTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY = + *mut RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY; +STRUCT!{struct RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY { + DisableNonSystemFonts: RTL_IMAGE_MITIGATION_POLICY, +}} +pub type PRTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY = *mut RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY; +STRUCT!{struct RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY { + BlockRemoteImageLoads: RTL_IMAGE_MITIGATION_POLICY, + BlockLowLabelImageLoads: RTL_IMAGE_MITIGATION_POLICY, + PreferSystem32: RTL_IMAGE_MITIGATION_POLICY, +}} +pub type PRTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY = *mut RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY; +STRUCT!{struct RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY { + EnableExportAddressFilter: RTL_IMAGE_MITIGATION_POLICY, + EnableExportAddressFilterPlus: RTL_IMAGE_MITIGATION_POLICY, + EnableImportAddressFilter: RTL_IMAGE_MITIGATION_POLICY, + EnableRopStackPivot: RTL_IMAGE_MITIGATION_POLICY, + EnableRopCallerCheck: RTL_IMAGE_MITIGATION_POLICY, + EnableRopSimExec: RTL_IMAGE_MITIGATION_POLICY, +}} +pub type PRTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY = + *mut RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY; +STRUCT!{struct RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY { + DisallowChildProcessCreation: RTL_IMAGE_MITIGATION_POLICY, +}} +pub type PRTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY = + *mut RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY; +STRUCT!{struct RTL_IMAGE_MITIGATION_SEHOP_POLICY { + Sehop: RTL_IMAGE_MITIGATION_POLICY, +}} +pub type PRTL_IMAGE_MITIGATION_SEHOP_POLICY = *mut RTL_IMAGE_MITIGATION_SEHOP_POLICY; +STRUCT!{struct RTL_IMAGE_MITIGATION_HEAP_POLICY { + TerminateOnHeapErrors: RTL_IMAGE_MITIGATION_POLICY, +}} +pub type PRTL_IMAGE_MITIGATION_HEAP_POLICY = *mut RTL_IMAGE_MITIGATION_HEAP_POLICY; +ENUM!{enum RTL_IMAGE_MITIGATION_OPTION_STATE { + RtlMitigationOptionStateNotConfigured = 0, + RtlMitigationOptionStateOn = 1, + RtlMitigationOptionStateOff = 2, +}} +pub const RTL_IMAGE_MITIGATION_FLAG_RESET: ULONG = 0x1; +pub const RTL_IMAGE_MITIGATION_FLAG_REMOVE: ULONG = 0x2; +pub const RTL_IMAGE_MITIGATION_FLAG_OSDEFAULT: ULONG = 0x4; +pub const RTL_IMAGE_MITIGATION_FLAG_AUDIT: ULONG = 0x8; +EXTERN!{extern "system" { + fn RtlQueryImageMitigationPolicy( + ImagePath: PWSTR, + Policy: IMAGE_MITIGATION_POLICY, + Flags: ULONG, + Buffer: PVOID, + BufferSize: ULONG, + ) -> NTSTATUS; + fn RtlSetImageMitigationPolicy( + ImagePath: PWSTR, + Policy: IMAGE_MITIGATION_POLICY, + Flags: ULONG, + Buffer: PVOID, + BufferSize: ULONG, + ) -> NTSTATUS; + fn RtlGetCurrentServiceSessionId() -> ULONG; + fn RtlGetActiveConsoleId() -> ULONG; + fn RtlGetConsoleSessionForegroundProcessId() -> ULONGLONG; + fn RtlGetTokenNamedObjectPath( + Token: HANDLE, + Sid: PSID, + ObjectPath: PUNICODE_STRING, + ) -> NTSTATUS; + fn RtlGetAppContainerNamedObjectPath( + Token: HANDLE, + AppContainerSid: PSID, + RelativePath: BOOLEAN, + ObjectPath: PUNICODE_STRING, + ) -> NTSTATUS; + fn RtlGetAppContainerParent( + AppContainerSid: PSID, + AppContainerSidParent: *mut PSID, + ) -> NTSTATUS; + fn RtlCheckSandboxedToken( + TokenHandle: HANDLE, + IsSandboxed: PBOOLEAN, + ) -> NTSTATUS; + fn RtlCheckTokenCapability( + TokenHandle: HANDLE, + CapabilitySidToCheck: PSID, + HasCapability: PBOOLEAN, + ) -> NTSTATUS; + fn RtlCapabilityCheck( + TokenHandle: HANDLE, + CapabilityName: PUNICODE_STRING, + HasCapability: PBOOLEAN, + ) -> NTSTATUS; + fn RtlCheckTokenMembership( + TokenHandle: HANDLE, + SidToCheck: PSID, + IsMember: PBOOLEAN, + ) -> NTSTATUS; + fn RtlCheckTokenMembershipEx( + TokenHandle: HANDLE, + SidToCheck: PSID, + Flags: ULONG, + IsMember: PBOOLEAN, + ) -> NTSTATUS; + fn RtlIsParentOfChildAppContainer( + ParentAppContainerSid: PSID, + ChildAppContainerSid: PSID, + ) -> NTSTATUS; + fn RtlIsCapabilitySid( + Sid: PSID, + ) -> BOOLEAN; + fn RtlIsPackageSid( + Sid: PSID, + ) -> BOOLEAN; + fn RtlIsValidProcessTrustLabelSid( + Sid: PSID, + ) -> BOOLEAN; + fn RtlIsStateSeparationEnabled() -> BOOLEAN; +}} +ENUM!{enum APPCONTAINER_SID_TYPE { + NotAppContainerSidType = 0, + ChildAppContainerSidType = 1, + ParentAppContainerSidType = 2, + InvalidAppContainerSidType = 3, + MaxAppContainerSidType = 4, +}} +pub type PAPPCONTAINER_SID_TYPE = *mut APPCONTAINER_SID_TYPE; +EXTERN!{extern "system" { + fn RtlGetAppContainerSidType( + AppContainerSid: PSID, + AppContainerSidType: PAPPCONTAINER_SID_TYPE, + ) -> NTSTATUS; + fn RtlFlsAlloc( + Callback: PFLS_CALLBACK_FUNCTION, + FlsIndex: PULONG, + ) -> NTSTATUS; + fn RtlFlsFree( + FlsIndex: ULONG, + ) -> NTSTATUS; +}} +ENUM!{enum STATE_LOCATION_TYPE { + LocationTypeRegistry = 0, + LocationTypeFileSystem = 1, + LocationTypeMaximum = 2, +}} +EXTERN!{extern "system" { + fn RtlGetPersistedStateLocation( + SourceID: PCWSTR, + CustomValue: PCWSTR, + DefaultPath: PCWSTR, + StateLocationType: STATE_LOCATION_TYPE, + TargetPath: PWCHAR, + BufferLengthIn: ULONG, + BufferLengthOut: PULONG, + ) -> NTSTATUS; + fn RtlIsCloudFilesPlaceholder( + FileAttributes: ULONG, + ReparseTag: ULONG, + ) -> BOOLEAN; + fn RtlIsPartialPlaceholder( + FileAttributes: ULONG, + ReparseTag: ULONG, + ) -> BOOLEAN; + fn RtlIsPartialPlaceholderFileHandle( + FileHandle: HANDLE, + IsPartialPlaceholder: PBOOLEAN, + ) -> NTSTATUS; + fn RtlIsPartialPlaceholderFileInfo( + InfoBuffer: *const c_void, + InfoClass: FILE_INFORMATION_CLASS, + IsPartialPlaceholder: PBOOLEAN, + ) -> NTSTATUS; + fn RtlIsNonEmptyDirectoryReparsePointAllowed( + ReparseTag: ULONG, + ) -> BOOLEAN; + fn RtlAppxIsFileOwnedByTrustedInstaller( + FileHandle: HANDLE, + IsFileOwnedByTrustedInstaller: PBOOLEAN, + ) -> NTSTATUS; +}} +STRUCT!{struct PS_PKG_CLAIM { + Flags: ULONGLONG, + Origin: ULONGLONG, +}} +pub type PPS_PKG_CLAIM = *mut PS_PKG_CLAIM; +EXTERN!{extern "system" { + fn RtlQueryPackageClaims( + TokenHandle: HANDLE, + PackageFullName: PWSTR, + PackageSize: PSIZE_T, + AppId: PWSTR, + AppIdSize: PSIZE_T, + DynamicId: *mut GUID, + PkgClaim: PPS_PKG_CLAIM, + AttributesPresent: PULONG64, + ) -> NTSTATUS; + fn RtlQueryProtectedPolicy( + PolicyGuid: *mut GUID, + PolicyValue: PULONG_PTR, + ) -> NTSTATUS; + fn RtlSetProtectedPolicy( + PolicyGuid: *mut GUID, + PolicyValue: ULONG_PTR, + OldPolicyValue: PULONG_PTR, + ) -> NTSTATUS; + fn RtlIsMultiSessionSku() -> BOOLEAN; + fn RtlIsMultiUsersInSessionSku() -> BOOLEAN; +}} +ENUM!{enum RTL_BSD_ITEM_TYPE { + RtlBsdItemVersionNumber = 0, + RtlBsdItemProductType = 1, + RtlBsdItemAabEnabled = 2, + RtlBsdItemAabTimeout = 3, + RtlBsdItemBootGood = 4, + RtlBsdItemBootShutdown = 5, + RtlBsdSleepInProgress = 6, + RtlBsdPowerTransition = 7, + RtlBsdItemBootAttemptCount = 8, + RtlBsdItemBootCheckpoint = 9, + RtlBsdItemBootId = 10, + RtlBsdItemShutdownBootId = 11, + RtlBsdItemReportedAbnormalShutdownBootId = 12, + RtlBsdItemErrorInfo = 13, + RtlBsdItemPowerButtonPressInfo = 14, + RtlBsdItemChecksum = 15, + RtlBsdItemMax = 16, +}} +STRUCT!{struct RTL_BSD_ITEM { + Type: RTL_BSD_ITEM_TYPE, + DataBuffer: PVOID, + DataLength: ULONG, +}} +pub type PRTL_BSD_ITEM = *mut RTL_BSD_ITEM; +EXTERN!{extern "system" { + fn RtlCreateBootStatusDataFile() -> NTSTATUS; + fn RtlLockBootStatusData( + FileHandle: PHANDLE, + ) -> NTSTATUS; + fn RtlUnlockBootStatusData( + FileHandle: HANDLE, + ) -> NTSTATUS; + fn RtlGetSetBootStatusData( + FileHandle: HANDLE, + Read: BOOLEAN, + DataClass: RTL_BSD_ITEM_TYPE, + Buffer: PVOID, + BufferSize: ULONG, + ReturnLength: PULONG, + ) -> NTSTATUS; + fn RtlCheckBootStatusIntegrity( + FileHandle: HANDLE, + Verified: PBOOLEAN, + ) -> NTSTATUS; + fn RtlCheckPortableOperatingSystem( + IsPortable: PBOOLEAN, + ) -> NTSTATUS; + fn RtlSetPortableOperatingSystem( + IsPortable: BOOLEAN, + ) -> NTSTATUS; +}} +EXTERN!{extern "system" { + fn RtlOsDeploymentState( + Flags: DWORD, + ) -> OS_DEPLOYEMENT_STATE_VALUES; + fn RtlFindClosestEncodableLength( + SourceLength: ULONGLONG, + TargetLength: PULONGLONG, + ) -> NTSTATUS; +}} +FN!{stdcall PRTL_SECURE_MEMORY_CACHE_CALLBACK( + Address: PVOID, + Length: SIZE_T, +) -> NTSTATUS} +EXTERN!{extern "system" { + fn RtlRegisterSecureMemoryCacheCallback( + Callback: PRTL_SECURE_MEMORY_CACHE_CALLBACK, + ) -> NTSTATUS; + fn RtlDeregisterSecureMemoryCacheCallback( + Callback: PRTL_SECURE_MEMORY_CACHE_CALLBACK, + ) -> NTSTATUS; + fn RtlFlushSecureMemoryCache( + MemoryCache: PVOID, + MemoryLength: SIZE_T, + ) -> BOOLEAN; +}} |