forked from cheat-engine/cheat-engine
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathntifs.h
7894 lines (6980 loc) · 229 KB
/
ntifs.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*
This is a free version of the file ntifs.h, release 46.
The purpose of this include file is to build file system and
file system filter drivers for Windows NT®, Windows® 2000 and
Windows® XP.
Copyright (C) 1999, 2000, 2001, 2002, 2003, 2004 Bo Brantén.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
The GNU General Public License is also available from:
http://www.gnu.org/copyleft/gpl.html
Windows and Windows NT are either registered trademarks or trademarks of
Microsoft Corporation in the United States and/or other countries.
DISCLAIMER: I do not encourage anyone to use this include file to build
drivers used in production. The information in this include file is
incomplete and intended only as an studying companion. The information
has been found in books, magazines, on the Internet and received from
contributors. Some of the information in this file may not be available
in other publications intended for similar use, these should be used with
extra care. Some of the information in this file may have different names
than in other publications even though they describe the same thing.
Please send comments, corrections and contributions to [email protected]
The most recent version of this file is available from:
http://www.acc.umu.se/~bosse/ntifs.h
Thanks to:
Andrey Shedel, Luigi Mori, Louis Joubert, Itai Shaham, David Welch,
Emanuele Aliberti, Anton Altaparmakov, Dan Partelly, Mamaich,
Yossi Yaffe, Gunnar André Dalsnes, Vadim V Vorobev, Ashot Oganesyan K,
Oleg Nikityenko, Matt Wu, Tomas Olsson, Raaf, Anthony Choi,
Alexey Logachyov, Marc-Antoine Ruel, Vyacheslav I. Levtchenko
and Darja Isaksson.
Revision history:
46. 2004-06-08
Added:
Data types:
TOKEN_OBJECT
45. 2004-06-06
Corrected:
SERVICE_DESCRIPTOR_TABLE
Added:
Defines:
TOKEN_SESSION_NOT_REFERENCED
TOKEN_SANDBOX_INERT
TOKEN_HAS_IMPERSONATE_PRIVILEGE
Function prototypes:
FsRtlDissectName
RtlOemStringToCountedUnicodeSize
RtlOemStringToUnicodeSize
RtlOemStringToUnicodeString
RtlUnicodeStringToOemSize
RtlUnicodeStringToOemString
RtlxOemStringToUnicodeSize
RtlxUnicodeStringToOemSize
44. 2003-05-06
Added:
Function prototypes:
InbvAcquireDisplayOwnership
InbvCheckDisplayOwnership
InbvDisplayString
InbvEnableBootDriver
InbvEnableDisplayString
InbvInstallDisplayStringFilter
InbvIsBootDriverInstalled
InbvNotifyDisplayOwnershipLost
InbvResetDisplay
InbvSetScrollRegion
InbvSetTextColor
InbvSolidColorFill
43. 2003-04-07
Added:
Data types:
MCB
Function prototypes:
FsRtlAddMcbEntry
FsRtlInitializeMcb
FsRtlLookupLastMcbEntry
FsRtlLookupMcbEntry
FsRtlNotifyFilterChangeDirectory
FsRtlNotifyFilterReportChange
FsRtlNumberOfRunsInMcb
FsRtlRemoveMcbEntry
FsRtlTruncateMcb
FsRtlUninitializeMcb
42. 2003-03-30
Corrected:
SYSTEM_CACHE_INFORMATION
SYSTEM_INFORMATION_CLASS
Added:
Data types:
SYSTEM_XXX_INFORMATION
THREAD_STATE
41. 2003-01-03
Corrected:
CcMapData
PsDereferenceImpersonationToken
PsDereferencePrimaryToken
PsGetProcessExitTime
PsReferencePrimaryToken
Added:
Defines:
MAP_XXX
Function prototypes:
CcMdlWriteAbort
PsAssignImpersonationToken
PsChargeProcessNonPagedPoolQuota
PsChargeProcessPagedPoolQuota
PsChargeProcessPoolQuota
PsDisableImpersonation
PsImpersonateClient
PsIsSystemThread
PsRestoreImpersonation
SeDeleteAccessState
ZwOpenProcessTokenEx
ZwOpenThreadTokenEx
40. 2002-10-02
Corrected:
HANDLE_TABLE_ENTRY
Added:
Defines:
FSRTL_FLAG_ADVANCED_HEADER
FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS
FSRTL_FLAG2_PURGE_WHEN_MAPPED
Data types:
FILE_ID_BOTH_DIR_INFORMATION
FILE_ID_FULL_DIR_INFORMATION
39. 2002-08-04
Added:
Data types:
LARGE_MCB
Function prototypes:
FsRtlAddLargeMcbEntry
FsRtlGetNextLargeMcbEntry
FsRtlInitializeLargeMcb
FsRtlLookupLargeMcbEntry
FsRtlLookupLastLargeMcbEntry
FsRtlLookupLastLargeMcbEntryAndIndex
FsRtlNumberOfRunsInLargeMcb
FsRtlRemoveLargeMcbEntry
FsRtlResetLargeMcb
FsRtlSplitLargeMcb
FsRtlTruncateLargeMcb
FsRtlUninitializeLargeMcb
38. 2002-06-30
Added:
Defines:
FILE_READ_ONLY_VOLUME
Function prototypes:
FsRtlAllocateResource
FsRtlIncrementCcFastReadNotPossible
FsRtlIncrementCcFastReadNoWait
FsRtlIncrementCcFastReadResourceMiss
FsRtlIncrementCcFastReadWait
KeIsAttachedProcess
KeIsExecutingDpc
KeRevertToUserAffinityThread
KeUpdateSystemTime
PsGetCurrentProcessSessionId
PsGetCurrentThreadPreviousMode
PsGetCurrentThreadStackBase
PsGetCurrentThreadStackLimit
RtlGetNtGlobalFlags
37. 2002-05-18
Uppdated for Windows XP:
EPROCESS
ETHREAD
KPROCESS
KTHREAD
MMSUPPORT_FLAGS
MMSUPPORT
PRIVATE_CACHE_MAP_FLAGS
PRIVATE_CACHE_MAP
SHARED_CACHE_MAP
Corrected:
VACB
Added:
Data types:
EPROCESS_QUOTA_ENTRY
EPROCESS_QUOTA_BLOCK
EX_FAST_REF
EX_PUSH_LOCK
EX_RUNDOWN_REF
PAGEFAULT_HISTORY
SE_AUDIT_PROCESS_CREATION_INFO
SECTION_OBJECT
TERMINATION_PORT
36. 2002-05-14
Corrected:
FILE_FS_FULL_SIZE_INFORMATION
35. 2002-03-23
Added:
Defines:
COMPRESSION_XXX
Data types:
COMPRESSED_DATA_INFO
OBJECT_HEADER
VAD_HEADER
Function prototypes:
CcWaitForCurrentLazyWriterActivity
FsRtlCheckOplock
FsRtlCurrentBatchOplock
FsRtlDeregisterUncProvider
FsRtlInitializeOplock
FsRtlOplockFsctrl
FsRtlOplockIsFastIoPossible
FsRtlRegisterUncProvider
FsRtlUninitializeOplock
RtlCompressBuffer
RtlCompressChunks
RtlDecompressBuffer
RtlDecompressChunks
RtlDecompressFragment
RtlDescribeChunk
RtlGetCompressionWorkSpaceSize
RtlReserveChunk
34. 2002-02-14
Corrected:
HARDWARE_PTE
Changed the use of _WIN32_WINNT to VER_PRODUCTBUILD since _WIN32_WINNT
is incorrectly defined in the Windows 2000 build environment included
in the Windows XP DDK.
33. 2002-01-20
Added:
Function prototypes:
PsDereferenceImpersonationToken
PsDereferencePrimaryToken
32. 2002-01-18
Corrected:
ObReferenceObjectByName
FILE_FS_OBJECT_ID_INFORMATION
FILE_OBJECTID_INFORMATION
Added:
Externals:
IoDriverObjectType
SeExports
Defines:
FILE_ACTION_XXX
FSCTL_XXX
IO_FILE_OBJECT_XXX
IRP_BEING_VERIFIED
TOKEN_XXX
Data types:
DEVICE_MAP
FILE_TRACKING_INFORMATION
SE_EXPORTS
Function prototypes:
SeEnableAccessToExports
31. 2001-12-23
Corrected:
QueryQuota in EXTENDED_IO_STACK_LOCATION
FILE_LOCK
CcPinMappedData
CcPinRead
CcPreparePinWrite
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlFastUnlockSingle
FsRtlInitializeFileLock
FsRtlPrivateLock
FsRtlProcessFileLock
MmForceSectionClosed
MmIsRecursiveIoFault
SeImpersonateClient
SeImpersonateClientEx
Added:
Defines:
More FSRTL_FLAG_XXX
PIN_XXX
VACB_XXX
Data types:
REPARSE_DATA_BUFFER
Function prototypes:
CcCopyWriteWontFlush
CcGetFileSizePointer
CcGetFlushedValidData
CcIsFileCached
CcRemapBcb
ExDisableResourceBoostLite
ExQueryPoolBlockSize
FsRtlAllocateFileLock
FsRtlAreThereCurrentFileLocks
FsRtlFastLock
FsRtlFreeFileLock
IoCheckDesiredAccess
IoCheckEaBufferValidity
IoCheckFunctionAccess
IoCheckQuotaBufferValidity
IoCreateStreamFileObjectLite
IoFastQueryNetworkAttributes
IoGetRequestorProcessId
IoIsFileOpenedExclusively
IoIsSystemThread
IoIsValidNameGraftingBuffer
IoSynchronousPageWrite
IoThreadToProcess
KeInitializeQueue
KeInsertHeadQueue
KeInsertQueue
KeReadStateQueue
KeRemoveQueue
KeRundownQueue
MmSetAddressRangeModified
ObGetObjectPointerCount
ObMakeTemporaryObject
ObQueryObjectAuditingByHandle
PsChargePoolQuota
PsReturnPoolQuota
SeAppendPrivileges
SeAuditingFileEvents
SeAuditingFileOrGlobalEvents
SeCreateClientSecurity
SeCreateClientSecurityFromSubjectContext
SeDeleteClientSecurity
SeDeleteObjectAuditAlarm
SeFreePrivileges
SeLockSubjectContext
SeOpenObjectAuditAlarm
SeOpenObjectForDeleteAuditAlarm
SePrivilegeCheck
SeQueryAuthenticationIdToken
SeQuerySecurityDescriptorInfo
SeQuerySessionIdToken
SeSetAccessStateGenericMapping
SeSetSecurityDescriptorInfo
SeSetSecurityDescriptorInfoEx
SeTokenIsAdmin
SeTokenIsRestricted
SeTokenType
SeUnlockSubjectContext
30. 2001-10-24
Corrected:
KINTERRUPT
OBJECT_TYPE
Added:
Defines:
More FSCTL_XXX
Data types:
BITMAP_RANGE
CreateMailslot in EXTENDED_IO_STACK_LOCATION
CreatePipe in EXTENDED_IO_STACK_LOCATION
QueryQuota in EXTENDED_IO_STACK_LOCATION
MAILSLOT_CREATE_PARAMETERS
MBCB
NAMED_PIPE_CREATE_PARAMETERS
PRIVATE_CACHE_MAP_FLAGS
PRIVATE_CACHE_MAP
SECURITY_CLIENT_CONTEXT
SHARED_CACHE_MAP
VACB
Function prototypes:
HalQueryRealTimeClock
HalSetRealTimeClock
PsGetProcessExitTime
PsIsThreadTerminating
PsLookupProcessThreadByCid
PsLookupThreadByThreadId
SeQueryAuthenticationIdToken
Externals:
KeServiceDescriptorTable
SePublicDefaultDacl
SeSystemDefaultDacl
29. 2001-10-06
Added:
Defines:
FSRTL_VOLUME_XXX
Function prototypes:
FsRtlNotifyChangeDirectory
FsRtlNotifyReportChange
FsRtlNotifyVolumeEvent
28. 2001-09-16
Added:
Function prototypes:
FsRtlNotifyInitializeSync
FsRtlNotifyUninitializeSync
SeImpersonateClientEx
SeReleaseSubjectContext
27. 2001-08-25
Corrected:
KPROCESS
FILE_LOCK_ANCHOR
FsRtlNormalizeNtstatus
RtlSecondsSince1970ToTime
RtlTimeToSecondsSince1970
SeQueryInformationToken
Added:
Defines:
FS_LFN_APIS
Data types:
FILE_LOCK_ENTRY
FILE_SHARED_LOCK_ENTRY
FILE_EXCLUSIVE_LOCK_ENTRY
Function prototypes:
FsRtlCheckLockForReadAccess
FsRtlCheckLockForWriteAccess
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlFastUnlockSingle
FsRtlGetFileSize
FsRtlGetNextFileLock
FsRtlInitializeFileLock
FsRtlPrivateLock
FsRtlProcessFileLock
FsRtlUninitializeFileLock
IoUnregisterFsRegistrationChange
PsLookupProcessByProcessId
SeQuerySubjectContextToken
26. 2001-04-28
Added:
Defines:
FSCTL_XXX
Data types:
RTL_SPLAY_LINKS
TUNNEL
Function prototypes:
FsRtlAddToTunnelCache
FsRtlDeleteKeyFromTunnelCache
FsRtlDeleteTunnelCache
FsRtlFindInTunnelCache
FsRtlInitializeTunnelCache
IoSetDeviceToVerify
KeInitializeApc
KeInsertQueueApc
SeQueryInformationToken
25. 2001-04-05
Corrected:
RtlImageNtHeader
LPC_XXX
OBJECT_BASIC_INFO
Added:
Defines:
SID_REVISION
Data types:
DIRECTORY_BASIC_INFORMATION
KINTERRUPT
OBJECT_HANDLE_ATTRIBUTE_INFO
PROCESS_PRIORITY_CLASS
SECTION_BASIC_INFORMATION
SECTION_IMAGE_INFORMATION
SECTION_INFORMATION_CLASS
Function prototypes:
RtlSecondsSince1970ToTime
RtlTimeToSecondsSince1970
ZwAdjustPrivilegesToken
ZwAlertThread
ZwAccessCheckAndAuditAlarm
ZwClearEvent
ZwCloseObjectAuditAlarm
ZwCreateSection
ZwCreateSymbolicLinkObject
ZwDuplicateToken
ZwFlushInstructionCache
ZwFlushVirtualMemory
ZwInitiatePowerAction
ZwLoadKey
ZwNotifyChangeKey
ZwOpenThread
ZwPowerInformation
ZwPulseEvent
ZwQueryDefaultLocale
ZwQueryDefaultUILanguage
ZwQueryInformationProcess
ZwQueryInstallUILanguage
ZwQuerySection
ZwReplaceKey
ZwResetEvent
ZwRestoreKey
ZwSaveKey
ZwSetDefaultLocale
ZwSetDefaultUILanguage
ZwSetEvent
ZwSetInformationObject
ZwSetInformationProcess
ZwSetSecurityObject
ZwSetSystemTime
ZwTerminateProcess
ZwUnloadKey
ZwWaitForSingleObject
ZwWaitForMultipleObjects
ZwYieldExecution
Removed functions that is not exported in kernel mode:
CcZeroEndOfLastPage
RtlAllocateAndInitializeSid
ZwAcceptConnectPort
ZwCompleteConnectPort
ZwCreatePort
ZwCreateProcess
ZwCreateThread
ZwFlushBuffersFile
ZwGetContextThread
ZwImpersonateClientOfPort
ZwListenPort
ZwLockFile
ZwNotifyChangeDirectoryFile
ZwQueryInformationPort
ZwReadRequestData
ZwReplyPort
ZwReplyWaitReceivePort
ZwReplyWaitReplyPort
ZwRequestPort
ZwUnlockFile
ZwWriteRequestData
24. 2001-03-08
Corrected:
EPROCESS
ETHREAD
FAST_IO_POSSIBLE
QueryEa in EXTENDED_IO_STACK_LOCATION
Added:
Defines:
Some more flags for FileSystemAttributes
Data types:
EXCEPTION_REGISTRATION_RECORD
FILE_FS_FULL_SIZE_INFORMATION
FILE_FS_OBJECT_ID_INFORMATION
HANDLE_TABLE_ENTRY
IO_CLIENT_EXTENSION
PS_IMPERSONATION_INFORMATION
SetEa and SetQuota in EXTENDED_IO_STACK_LOCATION
Function prototypes:
IoPageRead
KeStackAttachProcess
KeUnstackDetachProcess
MmMapViewOfSection
RtlSelfRelativeToAbsoluteSD
SeCreateAccessState
23. 2001-01-29
Corrected:
FSCTL_GET_VOLUME_INFORMATION
FSCTL_READ_MFT_RECORD
HARDWARE_PTE
EPROCESS
ETHREAD
KAPC_STATE
KPROCESS
KTHREAD
MMSUPPORT
Added:
Data types:
KGDTENTRY
KIDTENTRY
MMSUPPORT_FLAGS
22. 2000-12-23
Corrected:
EPROCESS
KPROCESS
Added:
Data types:
HARDWARE_PTE
MMSUPPORT
21. 2000-12-12
Added:
Defines:
IO_TYPE_XXX
OB_TYPE_XXX
THREAD_STATE_XXX
Data types:
EPROCESS
ETHREAD
KAPC_STATE
KEVENT_PAIR
KPROCESS
KTHREAD
KQUEUE
SERVICE_DESCRIPTOR_TABLE
TEB
20. 2000-12-03
Added:
Data types:
OBJECT_TYPE
Function prototypes:
ObCreateObject
ObInsertObject
ObReferenceObjectByName
19. 2000-11-25
Removed a name from credits since the person want to be anonymous.
18. 2000-10-13
Corrected:
PsReferenceImpersonationToken
Added:
Defines:
FILE_PIPE_XXX
LPC_XXX
MAILSLOT_XXX
PORT_XXX
FSCTL_GET_VOLUME_INFORMATION
FSCTL_READ_MFT_RECORD
FSCTL_MAILSLOT_PEEK
FSCTL_PIPE_XXX
Data types:
PORT_INFORMATION_CLASS
BITMAP_DESCRIPTOR
FILE_MAILSLOT_XXX
FILE_PIPE_XXX
MAPPING_PAIR
GET_RETRIEVAL_DESCRIPTOR
LPC_XXX
MOVEFILE_DESCRIPTOR
Function prototypes:
InitializeMessageHeader
MmForceSectionClosed
ZwAcceptConnectPort
ZwCompleteConnectPort
ZwConnectPort
ZwCreateEvent
ZwCreatePort
ZwImpersonateClientOfPort
ZwListenPort
ZwQueryInformationPort
ZwReadRequestData
ZwReplyPort
ZwReplyWaitReceivePort
ZwReplyWaitReplyPort
ZwRequestPort
ZwRequestWaitReplyPort
ZwWriteRequestData
17. 2000-05-21
Added:
Function prototypes:
PsRevertToSelf
SeCreateClientSecurity
SeImpersonateClient
ZwDuplicateObject
16. 2000-03-28
Added:
Defines:
FILE_STORAGE_TYPE_XXX
FILE_VC_XXX
IO_CHECK_CREATE_PARAMETERS
IO_ATTACH_DEVICE
IO_ATTACH_DEVICE_API
IO_COMPLETION_XXX
Data types:
IO_COMPLETION_INFORMATION_CLASS
OBJECT_INFO_CLASS
SYSTEM_INFORMATION_CLASS
FILE_LOCK_ANCHOR
IO_COMPLETION_BASIC_INFORMATION
OBJECT_BASIC_INFO
OBJECT_NAME_INFO
OBJECT_PROTECTION_INFO
OBJECT_TYPE_INFO
OBJECT_ALL_TYPES_INFO
SYSTEM_CACHE_INFORMATION
Function prototypes:
FsRtlAllocatePool
FsRtlAllocatePoolWithQuota
FsRtlAllocatePoolWithQuotaTag
FsRtlAllocatePoolWithTag
FsRtlAreNamesEqual
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
FsRtlMdlReadComplete
FsRtlMdlWriteComplete
FsRtlNormalizeNtstatus
RtlAllocateHeap
RtlCreateHeap
RtlDestroyHeap
RtlFreeHeap
RtlImageNtHeader
ZwQueryObject
ZwQuerySystemInformation
ZwSetSystemInformation
15. 2000-03-15
Corrected:
Renamed IoQueryFileVolumeInformation to IoQueryVolumeInformation
Comment on:
CcZeroEndOfLastPage
14. 2000-03-12
Corrected:
IoCreateFile
Added:
#if (_WIN32_WINNT < 0x0500)/#endif around stuff that is included in
the Windows 2000 DDK but is missing in the Windows NT 4.0 DDK.
ZwOpenEvent
13. 2000-02-08
Corrected:
PsReferenceImpersonationToken
Comment on:
RtlAllocateAndInitializeSid
12. 1999-10-18
Corrected:
FILE_COMPRESSION_INFORMATION
Added:
Defines:
ACCESS_ALLOWED_ACE_TYPE
ACCESS_DENIED_ACE_TYPE
SYSTEM_AUDIT_ACE_TYPE
SYSTEM_ALARM_ACE_TYPE
ANSI_DOS_STAR/QM/DOT
DOS_STAR/QM/DOT
FILE_EA_TYPE_XXX
FILE_NEED_EA
FILE_OPBATCH_BREAK_UNDERWAY
SECURITY_WORLD_SID_AUTHORITY
SECURITY_WORLD_RID
Data types:
POBJECT
FILE_STORAGE_TYPE
FILE_COMPLETION_INFORMATION
FILE_COPY_ON_WRITE_INFORMATION
FILE_FS_CONTROL_INFORMATION
FILE_GET_EA_INFORMATION
FILE_GET_QUOTA_INFORMATION
FILE_OBJECTID_INFORMATION
FILE_OLE_CLASSID_INFORMATION
FILE_OLE_ALL_INFORMATION
FILE_OLE_DIR_INFORMATION
FILE_OLE_INFORMATION
FILE_OLE_STATE_BITS_INFORMATION
FILE_QUOTA_INFORMATION
Function prototypes:
HalDisplayString
HalMakeBeep
IoGetRequestorProcess
ObQueryNameString
ProbeForWrite
RtlAbsoluteToSelfRelativeSD
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlInitializeSid
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetSaclSecurityDescriptor
ZwDeleteValueKey
ZwDisplayString
ZwQueryDirectoryObject
11. 1999-10-13
Corrected:
ZwOpenProcessToken
ZwOpenThreadToken
Added:
Function prototypes:
RtlAllocateAndInitializeSid
RtlCopySid
RtlEqualSid
RtlFillMemoryUlong
RtlIsNameLegalDOS8Dot3
RtlLengthRequiredSid
RtlLengthSid
RtlNtStatusToDosError
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlValidSid
10. 1999-07-15
Corrected:
RtlConvertSidToUnicodeString
Added:
Externals:
FsRtlLegalAnsiCharacterArray
NtBuildNumber
Defines:
FSRTL_WILD_CHARACTER
FlagOn
FsRtlIsUnicodeCharacterWild
Structures:
FILE_ACCESS_INFORMATION
FILE_MODE_INFORMATION
GENERATE_NAME_CONTEXT
Function prototypes:
FsRtlDoesNameContainWildCards
FsRtlIsNameInExpression
IoSetInformation
RtlGenerate8dot3Name
ZwQuerySecurityObject
9. 1999-07-12
Corrected:
EXTENDED_IO_STACK_LOCATION
QueryDirectory in EXTENDED_IO_STACK_LOCATION
ZwCreateThread
Added:
Structures:
INITIAL_TEB
Function prototypes:
ZwQuerySymbolicLinkObject
8. 1999-06-07
Corrected:
ZwOpenProcessToken
ZwOpenThreadToken
Added:
Defines:
FILE_OPLOCK_BROKEN_TO_LEVEL_2
FILE_OPLOCK_BROKEN_TO_NONE
FILE_CASE_SENSITIVE_SEARCH
FILE_CASE_PRESERVED_NAMES
FILE_UNICODE_ON_DISK
FILE_PERSISTENT_ACLS
FILE_FILE_COMPRESSION
FILE_VOLUME_IS_COMPRESSED
FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX
FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH
IOCTL_REDIR_QUERY_PATH
Structures:
FILE_FS_LABEL_INFORMATION
PATHNAME_BUFFER
In IO_STACK_LOCATION:
FileSystemControl
LockControl
SetVolume
Function prototypes:
FsRtlCopyRead
FsRtlCopyWrite
IoVerifyVolume
7. 1999-06-05
Added:
defines for TOKEN_XXX
SID_NAME_USE
TOKEN_INFORMATION_CLASS
TOKEN_TYPE
FILE_FS_ATTRIBUTE_INFORMATION
FILE_FS_SIZE_INFORMATION
SID_IDENTIFIER_AUTHORITY
SID
SID_AND_ATTRIBUTES
TOKEN_CONTROL
TOKEN_DEFAULT_DACL
TOKEN_GROUPS
TOKEN_OWNER
TOKEN_PRIMARY_GROUP
TOKEN_PRIVILEGES
TOKEN_SOURCE
TOKEN_STATISTICS
TOKEN_USER
IoCreateFile
IoGetAttachedDevice
IoGetBaseFileSystemDeviceObject
PsReferenceImpersonationToken
PsReferencePrimaryToken
RtlConvertSidToUnicodeString
SeCaptureSubjectContext
SeMarkLogonSessionForTerminationNotification
SeRegisterLogonSessionTerminatedRoutine
SeUnregisterLogonSessionTerminatedRoutine
ZwOpenProcessToken
ZwOpenThreadToken
ZwQueryInformationToken
6. 1999-05-10
Corrected declarations of Zw functions.
Added:
ZwCancelIoFile
ZwDeleteFile
ZwFlushBuffersFile
ZwFsControlFile
ZwLockFile
ZwNotifyChangeDirectoryFile
ZwOpenFile
ZwQueryEaFile
ZwSetEaFile
ZwSetVolumeInformationFile
ZwUnlockFile
5. 1999-05-09
Added:
defines for FILE_ACTION_XXX and FILE_NOTIFY_XXX
FILE_FS_VOLUME_INFORMATION
RETRIEVAL_POINTERS_BUFFER
STARTING_VCN_INPUT_BUFFER
FsRtlNotifyFullReportChange
4. 1999-04-11
Corrected:
ZwCreateThread
Added:
define _GNU_NTIFS_
3. 1999-03-30
Added:
defines for MAP_XXX, MEM_XXX and SEC_XXX
FILE_BOTH_DIR_INFORMATION
FILE_DIRECTORY_INFORMATION
FILE_FULL_DIR_INFORMATION
FILE_NAMES_INFORMATION
FILE_NOTIFY_INFORMATION
FsRtlNotifyCleanup
KeAttachProcess
KeDetachProcess
MmCreateSection
ZwCreateProcess
ZwCreateThread
ZwDeviceIoControlFile
ZwGetContextThread
ZwLoadDriver
ZwOpenDirectoryObject
ZwOpenProcess
ZwOpenSymbolicLinkObject
ZwQueryDirectoryFile
ZwUnloadDriver
2. 1999-03-15
Added:
FILE_COMPRESSION_INFORMATION
FILE_STREAM_INFORMATION
FILE_LINK_INFORMATION
FILE_RENAME_INFORMATION
EXTENDED_IO_STACK_LOCATION
IoQueryFileInformation
IoQueryFileVolumeInformation
ZwQueryVolumeInformationFile
Moved include of ntddk.h to inside extern "C" block.
1. 1999-03-11
Initial release.
*/
#ifndef _NTIFS_
#define _NTIFS_
#define _GNU_NTIFS_
#ifdef __cplusplus
extern "C" {
#endif
#include <ntddk.h>
#include <ntverp.h>
typedef struct _SERVICE_DESCRIPTOR_TABLE *PSERVICE_DESCRIPTOR_TABLE;
typedef struct _SE_EXPORTS *PSE_EXPORTS;
extern PUCHAR *FsRtlLegalAnsiCharacterArray;
extern POBJECT_TYPE *IoDriverObjectType;
extern PSERVICE_DESCRIPTOR_TABLE KeServiceDescriptorTable;
extern PSHORT NtBuildNumber;
extern PSE_EXPORTS SeExports;
extern PACL SePublicDefaultDacl;
extern PACL SeSystemDefaultDacl;
#define ACCESS_ALLOWED_ACE_TYPE (0x0)
#define ACCESS_DENIED_ACE_TYPE (0x1)
#define SYSTEM_AUDIT_ACE_TYPE (0x2)
#define SYSTEM_ALARM_ACE_TYPE (0x3)
#define ANSI_DOS_STAR ('<')
#define ANSI_DOS_QM ('>')
#define ANSI_DOS_DOT ('"')
#define DOS_STAR (L'<')
#define DOS_QM (L'>')
#define DOS_DOT (L'"')
#define COMPRESSION_FORMAT_NONE (0x0000)
#define COMPRESSION_FORMAT_DEFAULT (0x0001)
#define COMPRESSION_FORMAT_LZNT1 (0x0002)
#define COMPRESSION_ENGINE_STANDARD (0x0000)
#define COMPRESSION_ENGINE_MAXIMUM (0x0100)
#define COMPRESSION_ENGINE_HIBER (0x0200)