1 /*
2  * ntifs.h
3  *
4  * Windows NT Filesystem Driver Developer Kit
5  *
6  * This file is part of the ReactOS DDK package.
7  *
8  * Contributors:
9  *   Amine Khaldi
10  *   Timo Kreuzer ([email protected])
11  *
12  * THIS SOFTWARE IS NOT COPYRIGHTED
13  *
14  * This source code is offered for use in the public domain. You may
15  * use, modify or distribute it freely.
16  *
17  * This code is distributed in the hope that it will be useful but
18  * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
19  * DISCLAIMED. This includes but is not limited to warranties of
20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
21  *
22  */
23 
24 #pragma once
25 
26 #define _NTIFS_INCLUDED_
27 #define _GNU_NTIFS_
28 
29 #ifdef __cplusplus
30 extern "C" {
31 #endif
32 
33 /* Dependencies */
34 #include <ntddk.h>
35 #include <excpt.h>
36 #include <ntdef.h>
37 #include <ntnls.h>
38 #include <ntstatus.h>
39 #include <bugcodes.h>
40 #include <ntiologc.h>
41 
42 
43 #ifndef FlagOn
44 #define FlagOn(_F,_SF)        ((_F) & (_SF))
45 #endif
46 
47 #ifndef BooleanFlagOn
48 #define BooleanFlagOn(F,SF)   ((BOOLEAN)(((F) & (SF)) != 0))
49 #endif
50 
51 #ifndef SetFlag
52 #define SetFlag(_F,_SF)       ((_F) |= (_SF))
53 #endif
54 
55 #ifndef ClearFlag
56 #define ClearFlag(_F,_SF)     ((_F) &= ~(_SF))
57 #endif
58 
59 typedef UNICODE_STRING LSA_UNICODE_STRING, *PLSA_UNICODE_STRING;
60 typedef STRING LSA_STRING, *PLSA_STRING;
61 typedef OBJECT_ATTRIBUTES LSA_OBJECT_ATTRIBUTES, *PLSA_OBJECT_ATTRIBUTES;
62 
63 /******************************************************************************
64  *                            Security Manager Types                          *
65  ******************************************************************************/
66 #ifndef SID_IDENTIFIER_AUTHORITY_DEFINED
67 #define SID_IDENTIFIER_AUTHORITY_DEFINED
68 typedef struct _SID_IDENTIFIER_AUTHORITY {
69   UCHAR Value[6];
70 } SID_IDENTIFIER_AUTHORITY,*PSID_IDENTIFIER_AUTHORITY,*LPSID_IDENTIFIER_AUTHORITY;
71 #endif
72 
73 #ifndef SID_DEFINED
74 #define SID_DEFINED
75 typedef struct _SID {
76   UCHAR Revision;
77   UCHAR SubAuthorityCount;
78   SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
79   ULONG SubAuthority[ANYSIZE_ARRAY];
80 } SID, *PISID;
81 #endif
82 
83 #define SID_REVISION                    1
84 #define SID_MAX_SUB_AUTHORITIES         15
85 #define SID_RECOMMENDED_SUB_AUTHORITIES 1
86 
87 typedef enum _SID_NAME_USE {
88   SidTypeUser = 1,
89   SidTypeGroup,
90   SidTypeDomain,
91   SidTypeAlias,
92   SidTypeWellKnownGroup,
93   SidTypeDeletedAccount,
94   SidTypeInvalid,
95   SidTypeUnknown,
96   SidTypeComputer,
97   SidTypeLabel,
98   SidTypeLogonSession
99 } SID_NAME_USE, *PSID_NAME_USE;
100 
101 typedef struct _SID_AND_ATTRIBUTES {
102   PSID Sid;
103   ULONG Attributes;
104 } SID_AND_ATTRIBUTES, *PSID_AND_ATTRIBUTES;
105 typedef SID_AND_ATTRIBUTES SID_AND_ATTRIBUTES_ARRAY[ANYSIZE_ARRAY];
106 typedef SID_AND_ATTRIBUTES_ARRAY *PSID_AND_ATTRIBUTES_ARRAY;
107 
108 #define SID_HASH_SIZE 32
109 typedef ULONG_PTR SID_HASH_ENTRY, *PSID_HASH_ENTRY;
110 
111 typedef struct _SID_AND_ATTRIBUTES_HASH {
112   ULONG SidCount;
113   PSID_AND_ATTRIBUTES SidAttr;
114   SID_HASH_ENTRY Hash[SID_HASH_SIZE];
115 } SID_AND_ATTRIBUTES_HASH, *PSID_AND_ATTRIBUTES_HASH;
116 
117 /* Universal well-known SIDs */
118 
119 #define SECURITY_NULL_SID_AUTHORITY         {0,0,0,0,0,0}
120 #define SECURITY_WORLD_SID_AUTHORITY        {0,0,0,0,0,1}
121 #define SECURITY_LOCAL_SID_AUTHORITY        {0,0,0,0,0,2}
122 #define SECURITY_CREATOR_SID_AUTHORITY      {0,0,0,0,0,3}
123 #define SECURITY_NON_UNIQUE_AUTHORITY       {0,0,0,0,0,4}
124 #define SECURITY_RESOURCE_MANAGER_AUTHORITY {0,0,0,0,0,9}
125 
126 #define SECURITY_NULL_RID                 (0x00000000L)
127 #define SECURITY_WORLD_RID                (0x00000000L)
128 #define SECURITY_LOCAL_RID                (0x00000000L)
129 #define SECURITY_LOCAL_LOGON_RID          (0x00000001L)
130 
131 #define SECURITY_CREATOR_OWNER_RID        (0x00000000L)
132 #define SECURITY_CREATOR_GROUP_RID        (0x00000001L)
133 #define SECURITY_CREATOR_OWNER_SERVER_RID (0x00000002L)
134 #define SECURITY_CREATOR_GROUP_SERVER_RID (0x00000003L)
135 #define SECURITY_CREATOR_OWNER_RIGHTS_RID (0x00000004L)
136 
137 /* NT well-known SIDs */
138 
139 #define SECURITY_NT_AUTHORITY           {0,0,0,0,0,5}
140 
141 #define SECURITY_DIALUP_RID             (0x00000001L)
142 #define SECURITY_NETWORK_RID            (0x00000002L)
143 #define SECURITY_BATCH_RID              (0x00000003L)
144 #define SECURITY_INTERACTIVE_RID        (0x00000004L)
145 #define SECURITY_LOGON_IDS_RID          (0x00000005L)
146 #define SECURITY_LOGON_IDS_RID_COUNT    (3L)
147 #define SECURITY_SERVICE_RID            (0x00000006L)
148 #define SECURITY_ANONYMOUS_LOGON_RID    (0x00000007L)
149 #define SECURITY_PROXY_RID              (0x00000008L)
150 #define SECURITY_ENTERPRISE_CONTROLLERS_RID (0x00000009L)
151 #define SECURITY_SERVER_LOGON_RID       SECURITY_ENTERPRISE_CONTROLLERS_RID
152 #define SECURITY_PRINCIPAL_SELF_RID     (0x0000000AL)
153 #define SECURITY_AUTHENTICATED_USER_RID (0x0000000BL)
154 #define SECURITY_RESTRICTED_CODE_RID    (0x0000000CL)
155 #define SECURITY_TERMINAL_SERVER_RID    (0x0000000DL)
156 #define SECURITY_REMOTE_LOGON_RID       (0x0000000EL)
157 #define SECURITY_THIS_ORGANIZATION_RID  (0x0000000FL)
158 #define SECURITY_IUSER_RID              (0x00000011L)
159 #define SECURITY_LOCAL_SYSTEM_RID       (0x00000012L)
160 #define SECURITY_LOCAL_SERVICE_RID      (0x00000013L)
161 #define SECURITY_NETWORK_SERVICE_RID    (0x00000014L)
162 #define SECURITY_NT_NON_UNIQUE          (0x00000015L)
163 #define SECURITY_NT_NON_UNIQUE_SUB_AUTH_COUNT  (3L)
164 #define SECURITY_ENTERPRISE_READONLY_CONTROLLERS_RID (0x00000016L)
165 
166 #define SECURITY_BUILTIN_DOMAIN_RID     (0x00000020L)
167 #define SECURITY_WRITE_RESTRICTED_CODE_RID (0x00000021L)
168 
169 
170 #define SECURITY_PACKAGE_BASE_RID       (0x00000040L)
171 #define SECURITY_PACKAGE_RID_COUNT      (2L)
172 #define SECURITY_PACKAGE_NTLM_RID       (0x0000000AL)
173 #define SECURITY_PACKAGE_SCHANNEL_RID   (0x0000000EL)
174 #define SECURITY_PACKAGE_DIGEST_RID     (0x00000015L)
175 
176 #define SECURITY_CRED_TYPE_BASE_RID             (0x00000041L)
177 #define SECURITY_CRED_TYPE_RID_COUNT            (2L)
178 #define SECURITY_CRED_TYPE_THIS_ORG_CERT_RID    (0x00000001L)
179 
180 #define SECURITY_MIN_BASE_RID		(0x00000050L)
181 #define SECURITY_SERVICE_ID_BASE_RID    (0x00000050L)
182 #define SECURITY_SERVICE_ID_RID_COUNT   (6L)
183 #define SECURITY_RESERVED_ID_BASE_RID   (0x00000051L)
184 #define SECURITY_APPPOOL_ID_BASE_RID    (0x00000052L)
185 #define SECURITY_APPPOOL_ID_RID_COUNT   (6L)
186 #define SECURITY_VIRTUALSERVER_ID_BASE_RID    (0x00000053L)
187 #define SECURITY_VIRTUALSERVER_ID_RID_COUNT   (6L)
188 #define SECURITY_USERMODEDRIVERHOST_ID_BASE_RID  (0x00000054L)
189 #define SECURITY_USERMODEDRIVERHOST_ID_RID_COUNT (6L)
190 #define SECURITY_CLOUD_INFRASTRUCTURE_SERVICES_ID_BASE_RID  (0x00000055L)
191 #define SECURITY_CLOUD_INFRASTRUCTURE_SERVICES_ID_RID_COUNT (6L)
192 #define SECURITY_WMIHOST_ID_BASE_RID  (0x00000056L)
193 #define SECURITY_WMIHOST_ID_RID_COUNT (6L)
194 #define SECURITY_TASK_ID_BASE_RID                 (0x00000057L)
195 #define SECURITY_NFS_ID_BASE_RID        (0x00000058L)
196 #define SECURITY_COM_ID_BASE_RID        (0x00000059L)
197 #define SECURITY_VIRTUALACCOUNT_ID_RID_COUNT   (6L)
198 
199 #define SECURITY_MAX_BASE_RID		(0x0000006FL)
200 
201 #define SECURITY_MAX_ALWAYS_FILTERED    (0x000003E7L)
202 #define SECURITY_MIN_NEVER_FILTERED     (0x000003E8L)
203 
204 #define SECURITY_OTHER_ORGANIZATION_RID (0x000003E8L)
205 
206 #define SECURITY_WINDOWSMOBILE_ID_BASE_RID (0x00000070L)
207 
208 /* Well-known domain relative sub-authority values (RIDs) */
209 
210 #define DOMAIN_GROUP_RID_ENTERPRISE_READONLY_DOMAIN_CONTROLLERS (0x000001F2L)
211 
212 #define FOREST_USER_RID_MAX            (0x000001F3L)
213 
214 /* Well-known users */
215 
216 #define DOMAIN_USER_RID_ADMIN          (0x000001F4L)
217 #define DOMAIN_USER_RID_GUEST          (0x000001F5L)
218 #define DOMAIN_USER_RID_KRBTGT         (0x000001F6L)
219 
220 #define DOMAIN_USER_RID_MAX            (0x000003E7L)
221 
222 /* Well-known groups */
223 
224 #define DOMAIN_GROUP_RID_ADMINS               (0x00000200L)
225 #define DOMAIN_GROUP_RID_USERS                (0x00000201L)
226 #define DOMAIN_GROUP_RID_GUESTS               (0x00000202L)
227 #define DOMAIN_GROUP_RID_COMPUTERS            (0x00000203L)
228 #define DOMAIN_GROUP_RID_CONTROLLERS          (0x00000204L)
229 #define DOMAIN_GROUP_RID_CERT_ADMINS          (0x00000205L)
230 #define DOMAIN_GROUP_RID_SCHEMA_ADMINS        (0x00000206L)
231 #define DOMAIN_GROUP_RID_ENTERPRISE_ADMINS    (0x00000207L)
232 #define DOMAIN_GROUP_RID_POLICY_ADMINS        (0x00000208L)
233 #define DOMAIN_GROUP_RID_READONLY_CONTROLLERS (0x00000209L)
234 
235 /* Well-known aliases */
236 
237 #define DOMAIN_ALIAS_RID_ADMINS                         (0x00000220L)
238 #define DOMAIN_ALIAS_RID_USERS                          (0x00000221L)
239 #define DOMAIN_ALIAS_RID_GUESTS                         (0x00000222L)
240 #define DOMAIN_ALIAS_RID_POWER_USERS                    (0x00000223L)
241 
242 #define DOMAIN_ALIAS_RID_ACCOUNT_OPS                    (0x00000224L)
243 #define DOMAIN_ALIAS_RID_SYSTEM_OPS                     (0x00000225L)
244 #define DOMAIN_ALIAS_RID_PRINT_OPS                      (0x00000226L)
245 #define DOMAIN_ALIAS_RID_BACKUP_OPS                     (0x00000227L)
246 
247 #define DOMAIN_ALIAS_RID_REPLICATOR                     (0x00000228L)
248 #define DOMAIN_ALIAS_RID_RAS_SERVERS                    (0x00000229L)
249 #define DOMAIN_ALIAS_RID_PREW2KCOMPACCESS               (0x0000022AL)
250 #define DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS           (0x0000022BL)
251 #define DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS      (0x0000022CL)
252 #define DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS (0x0000022DL)
253 
254 #define DOMAIN_ALIAS_RID_MONITORING_USERS               (0x0000022EL)
255 #define DOMAIN_ALIAS_RID_LOGGING_USERS                  (0x0000022FL)
256 #define DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS            (0x00000230L)
257 #define DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS             (0x00000231L)
258 #define DOMAIN_ALIAS_RID_DCOM_USERS                     (0x00000232L)
259 #define DOMAIN_ALIAS_RID_IUSERS                         (0x00000238L)
260 #define DOMAIN_ALIAS_RID_CRYPTO_OPERATORS               (0x00000239L)
261 #define DOMAIN_ALIAS_RID_CACHEABLE_PRINCIPALS_GROUP     (0x0000023BL)
262 #define DOMAIN_ALIAS_RID_NON_CACHEABLE_PRINCIPALS_GROUP (0x0000023CL)
263 #define DOMAIN_ALIAS_RID_EVENT_LOG_READERS_GROUP        (0x0000023DL)
264 #define DOMAIN_ALIAS_RID_CERTSVC_DCOM_ACCESS_GROUP      (0x0000023EL)
265 
266 #define SECURITY_MANDATORY_LABEL_AUTHORITY          {0,0,0,0,0,16}
267 #define SECURITY_MANDATORY_UNTRUSTED_RID            (0x00000000L)
268 #define SECURITY_MANDATORY_LOW_RID                  (0x00001000L)
269 #define SECURITY_MANDATORY_MEDIUM_RID               (0x00002000L)
270 #define SECURITY_MANDATORY_HIGH_RID                 (0x00003000L)
271 #define SECURITY_MANDATORY_SYSTEM_RID               (0x00004000L)
272 #define SECURITY_MANDATORY_PROTECTED_PROCESS_RID    (0x00005000L)
273 
274 /* SECURITY_MANDATORY_MAXIMUM_USER_RID is the highest RID that
275    can be set by a usermode caller.*/
276 
277 #define SECURITY_MANDATORY_MAXIMUM_USER_RID   SECURITY_MANDATORY_SYSTEM_RID
278 
279 #define MANDATORY_LEVEL_TO_MANDATORY_RID(IL) (IL * 0x1000)
280 
281 /* Allocate the System Luid.  The first 1000 LUIDs are reserved.
282    Use #999 here (0x3e7 = 999) */
283 
284 #define SYSTEM_LUID                     {0x3e7, 0x0}
285 #define ANONYMOUS_LOGON_LUID            {0x3e6, 0x0}
286 #define LOCALSERVICE_LUID               {0x3e5, 0x0}
287 #define NETWORKSERVICE_LUID             {0x3e4, 0x0}
288 #define IUSER_LUID                      {0x3e3, 0x0}
289 
290 typedef struct _ACE_HEADER {
291   UCHAR AceType;
292   UCHAR AceFlags;
293   USHORT AceSize;
294 } ACE_HEADER, *PACE_HEADER;
295 
296 /* also in winnt.h */
297 #define ACCESS_MIN_MS_ACE_TYPE                  (0x0)
298 #define ACCESS_ALLOWED_ACE_TYPE                 (0x0)
299 #define ACCESS_DENIED_ACE_TYPE                  (0x1)
300 #define SYSTEM_AUDIT_ACE_TYPE                   (0x2)
301 #define SYSTEM_ALARM_ACE_TYPE                   (0x3)
302 #define ACCESS_MAX_MS_V2_ACE_TYPE               (0x3)
303 #define ACCESS_ALLOWED_COMPOUND_ACE_TYPE        (0x4)
304 #define ACCESS_MAX_MS_V3_ACE_TYPE               (0x4)
305 #define ACCESS_MIN_MS_OBJECT_ACE_TYPE           (0x5)
306 #define ACCESS_ALLOWED_OBJECT_ACE_TYPE          (0x5)
307 #define ACCESS_DENIED_OBJECT_ACE_TYPE           (0x6)
308 #define SYSTEM_AUDIT_OBJECT_ACE_TYPE            (0x7)
309 #define SYSTEM_ALARM_OBJECT_ACE_TYPE            (0x8)
310 #define ACCESS_MAX_MS_OBJECT_ACE_TYPE           (0x8)
311 #define ACCESS_MAX_MS_V4_ACE_TYPE               (0x8)
312 #define ACCESS_MAX_MS_ACE_TYPE                  (0x8)
313 #define ACCESS_ALLOWED_CALLBACK_ACE_TYPE        (0x9)
314 #define ACCESS_DENIED_CALLBACK_ACE_TYPE         (0xA)
315 #define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE (0xB)
316 #define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE  (0xC)
317 #define SYSTEM_AUDIT_CALLBACK_ACE_TYPE          (0xD)
318 #define SYSTEM_ALARM_CALLBACK_ACE_TYPE          (0xE)
319 #define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE   (0xF)
320 #define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE   (0x10)
321 #define ACCESS_MAX_MS_V5_ACE_TYPE               (0x11)
322 #define SYSTEM_MANDATORY_LABEL_ACE_TYPE         (0x11)
323 
324 /* The following are the inherit flags that go into the AceFlags field
325    of an Ace header. */
326 
327 #define OBJECT_INHERIT_ACE                (0x1)
328 #define CONTAINER_INHERIT_ACE             (0x2)
329 #define NO_PROPAGATE_INHERIT_ACE          (0x4)
330 #define INHERIT_ONLY_ACE                  (0x8)
331 #define INHERITED_ACE                     (0x10)
332 #define VALID_INHERIT_FLAGS               (0x1F)
333 
334 #define SUCCESSFUL_ACCESS_ACE_FLAG        (0x40)
335 #define FAILED_ACCESS_ACE_FLAG            (0x80)
336 
337 typedef struct _ACCESS_ALLOWED_ACE {
338   ACE_HEADER Header;
339   ACCESS_MASK Mask;
340   ULONG SidStart;
341 } ACCESS_ALLOWED_ACE, *PACCESS_ALLOWED_ACE;
342 
343 typedef struct _ACCESS_DENIED_ACE {
344   ACE_HEADER Header;
345   ACCESS_MASK Mask;
346   ULONG SidStart;
347 } ACCESS_DENIED_ACE, *PACCESS_DENIED_ACE;
348 
349 typedef struct _SYSTEM_AUDIT_ACE {
350   ACE_HEADER Header;
351   ACCESS_MASK Mask;
352   ULONG SidStart;
353 } SYSTEM_AUDIT_ACE, *PSYSTEM_AUDIT_ACE;
354 
355 typedef struct _SYSTEM_ALARM_ACE {
356   ACE_HEADER Header;
357   ACCESS_MASK Mask;
358   ULONG SidStart;
359 } SYSTEM_ALARM_ACE, *PSYSTEM_ALARM_ACE;
360 
361 typedef struct _SYSTEM_MANDATORY_LABEL_ACE {
362   ACE_HEADER Header;
363   ACCESS_MASK Mask;
364   ULONG SidStart;
365 } SYSTEM_MANDATORY_LABEL_ACE, *PSYSTEM_MANDATORY_LABEL_ACE;
366 
367 #define SYSTEM_MANDATORY_LABEL_NO_WRITE_UP         0x1
368 #define SYSTEM_MANDATORY_LABEL_NO_READ_UP          0x2
369 #define SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP       0x4
370 #define SYSTEM_MANDATORY_LABEL_VALID_MASK (SYSTEM_MANDATORY_LABEL_NO_WRITE_UP   | \
371                                            SYSTEM_MANDATORY_LABEL_NO_READ_UP    | \
372                                            SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP)
373 
374 #define SECURITY_DESCRIPTOR_MIN_LENGTH   (sizeof(SECURITY_DESCRIPTOR))
375 
376 typedef USHORT SECURITY_DESCRIPTOR_CONTROL,*PSECURITY_DESCRIPTOR_CONTROL;
377 
378 #define SE_OWNER_DEFAULTED              0x0001
379 #define SE_GROUP_DEFAULTED              0x0002
380 #define SE_DACL_PRESENT                 0x0004
381 #define SE_DACL_DEFAULTED               0x0008
382 #define SE_SACL_PRESENT                 0x0010
383 #define SE_SACL_DEFAULTED               0x0020
384 #define SE_DACL_UNTRUSTED               0x0040
385 #define SE_SERVER_SECURITY              0x0080
386 #define SE_DACL_AUTO_INHERIT_REQ        0x0100
387 #define SE_SACL_AUTO_INHERIT_REQ        0x0200
388 #define SE_DACL_AUTO_INHERITED          0x0400
389 #define SE_SACL_AUTO_INHERITED          0x0800
390 #define SE_DACL_PROTECTED               0x1000
391 #define SE_SACL_PROTECTED               0x2000
392 #define SE_RM_CONTROL_VALID             0x4000
393 #define SE_SELF_RELATIVE                0x8000
394 
395 typedef struct _SECURITY_DESCRIPTOR_RELATIVE {
396   UCHAR Revision;
397   UCHAR Sbz1;
398   SECURITY_DESCRIPTOR_CONTROL Control;
399   ULONG Owner;
400   ULONG Group;
401   ULONG Sacl;
402   ULONG Dacl;
403 } SECURITY_DESCRIPTOR_RELATIVE, *PISECURITY_DESCRIPTOR_RELATIVE;
404 
405 typedef struct _SECURITY_DESCRIPTOR {
406   UCHAR Revision;
407   UCHAR Sbz1;
408   SECURITY_DESCRIPTOR_CONTROL Control;
409   PSID Owner;
410   PSID Group;
411   PACL Sacl;
412   PACL Dacl;
413 } SECURITY_DESCRIPTOR, *PISECURITY_DESCRIPTOR;
414 
415 typedef struct _OBJECT_TYPE_LIST {
416   USHORT Level;
417   USHORT Sbz;
418   GUID *ObjectType;
419 } OBJECT_TYPE_LIST, *POBJECT_TYPE_LIST;
420 
421 #define ACCESS_OBJECT_GUID       0
422 #define ACCESS_PROPERTY_SET_GUID 1
423 #define ACCESS_PROPERTY_GUID     2
424 #define ACCESS_MAX_LEVEL         4
425 
426 typedef enum _AUDIT_EVENT_TYPE {
427   AuditEventObjectAccess,
428   AuditEventDirectoryServiceAccess
429 } AUDIT_EVENT_TYPE, *PAUDIT_EVENT_TYPE;
430 
431 #define AUDIT_ALLOW_NO_PRIVILEGE 0x1
432 
433 #define ACCESS_DS_SOURCE_A "DS"
434 #define ACCESS_DS_SOURCE_W L"DS"
435 #define ACCESS_DS_OBJECT_TYPE_NAME_A "Directory Service Object"
436 #define ACCESS_DS_OBJECT_TYPE_NAME_W L"Directory Service Object"
437 
438 #define ACCESS_REASON_TYPE_MASK 0xffff0000
439 #define ACCESS_REASON_DATA_MASK 0x0000ffff
440 
441 typedef enum _ACCESS_REASON_TYPE {
442   AccessReasonNone = 0x00000000,
443   AccessReasonAllowedAce = 0x00010000,
444   AccessReasonDeniedAce = 0x00020000,
445   AccessReasonAllowedParentAce = 0x00030000,
446   AccessReasonDeniedParentAce = 0x00040000,
447   AccessReasonMissingPrivilege = 0x00100000,
448   AccessReasonFromPrivilege = 0x00200000,
449   AccessReasonIntegrityLevel = 0x00300000,
450   AccessReasonOwnership = 0x00400000,
451   AccessReasonNullDacl = 0x00500000,
452   AccessReasonEmptyDacl = 0x00600000,
453   AccessReasonNoSD = 0x00700000,
454   AccessReasonNoGrant = 0x00800000
455 } ACCESS_REASON_TYPE;
456 
457 typedef ULONG ACCESS_REASON;
458 
459 typedef struct _ACCESS_REASONS {
460   ACCESS_REASON Data[32];
461 } ACCESS_REASONS, *PACCESS_REASONS;
462 
463 #define SE_SECURITY_DESCRIPTOR_FLAG_NO_OWNER_ACE    0x00000001
464 #define SE_SECURITY_DESCRIPTOR_FLAG_NO_LABEL_ACE    0x00000002
465 #define SE_SECURITY_DESCRIPTOR_VALID_FLAGS          0x00000003
466 
467 typedef struct _SE_SECURITY_DESCRIPTOR {
468   ULONG Size;
469   ULONG Flags;
470   PSECURITY_DESCRIPTOR SecurityDescriptor;
471 } SE_SECURITY_DESCRIPTOR, *PSE_SECURITY_DESCRIPTOR;
472 
473 typedef struct _SE_ACCESS_REQUEST {
474   ULONG Size;
475   PSE_SECURITY_DESCRIPTOR SeSecurityDescriptor;
476   ACCESS_MASK DesiredAccess;
477   ACCESS_MASK PreviouslyGrantedAccess;
478   PSID PrincipalSelfSid;
479   PGENERIC_MAPPING GenericMapping;
480   ULONG ObjectTypeListCount;
481   POBJECT_TYPE_LIST ObjectTypeList;
482 } SE_ACCESS_REQUEST, *PSE_ACCESS_REQUEST;
483 
484 typedef struct _SE_ACCESS_REPLY {
485   ULONG Size;
486   ULONG ResultListCount;
487   PACCESS_MASK GrantedAccess;
488   PNTSTATUS AccessStatus;
489   PACCESS_REASONS AccessReason;
490   PPRIVILEGE_SET* Privileges;
491 } SE_ACCESS_REPLY, *PSE_ACCESS_REPLY;
492 
493 typedef enum _SE_AUDIT_OPERATION {
494   AuditPrivilegeObject,
495   AuditPrivilegeService,
496   AuditAccessCheck,
497   AuditOpenObject,
498   AuditOpenObjectWithTransaction,
499   AuditCloseObject,
500   AuditDeleteObject,
501   AuditOpenObjectForDelete,
502   AuditOpenObjectForDeleteWithTransaction,
503   AuditCloseNonObject,
504   AuditOpenNonObject,
505   AuditObjectReference,
506   AuditHandleCreation,
507 } SE_AUDIT_OPERATION, *PSE_AUDIT_OPERATION;
508 
509 typedef struct _SE_AUDIT_INFO {
510   ULONG Size;
511   AUDIT_EVENT_TYPE AuditType;
512   SE_AUDIT_OPERATION AuditOperation;
513   ULONG AuditFlags;
514   UNICODE_STRING SubsystemName;
515   UNICODE_STRING ObjectTypeName;
516   UNICODE_STRING ObjectName;
517   PVOID HandleId;
518   GUID* TransactionId;
519   LUID* OperationId;
520   BOOLEAN ObjectCreation;
521   BOOLEAN GenerateOnClose;
522 } SE_AUDIT_INFO, *PSE_AUDIT_INFO;
523 
524 #define TOKEN_ASSIGN_PRIMARY            (0x0001)
525 #define TOKEN_DUPLICATE                 (0x0002)
526 #define TOKEN_IMPERSONATE               (0x0004)
527 #define TOKEN_QUERY                     (0x0008)
528 #define TOKEN_QUERY_SOURCE              (0x0010)
529 #define TOKEN_ADJUST_PRIVILEGES         (0x0020)
530 #define TOKEN_ADJUST_GROUPS             (0x0040)
531 #define TOKEN_ADJUST_DEFAULT            (0x0080)
532 #define TOKEN_ADJUST_SESSIONID          (0x0100)
533 
534 #define TOKEN_ALL_ACCESS_P (STANDARD_RIGHTS_REQUIRED  |\
535                             TOKEN_ASSIGN_PRIMARY      |\
536                             TOKEN_DUPLICATE           |\
537                             TOKEN_IMPERSONATE         |\
538                             TOKEN_QUERY               |\
539                             TOKEN_QUERY_SOURCE        |\
540                             TOKEN_ADJUST_PRIVILEGES   |\
541                             TOKEN_ADJUST_GROUPS       |\
542                             TOKEN_ADJUST_DEFAULT )
543 
544 #if ((defined(_WIN32_WINNT) && (_WIN32_WINNT > 0x0400)) || (!defined(_WIN32_WINNT)))
545 #define TOKEN_ALL_ACCESS  (TOKEN_ALL_ACCESS_P |\
546                            TOKEN_ADJUST_SESSIONID )
547 #else
548 #define TOKEN_ALL_ACCESS  (TOKEN_ALL_ACCESS_P)
549 #endif
550 
551 #define TOKEN_READ       (STANDARD_RIGHTS_READ     |\
552                           TOKEN_QUERY)
553 
554 #define TOKEN_WRITE      (STANDARD_RIGHTS_WRITE    |\
555                           TOKEN_ADJUST_PRIVILEGES  |\
556                           TOKEN_ADJUST_GROUPS      |\
557                           TOKEN_ADJUST_DEFAULT)
558 
559 #define TOKEN_EXECUTE    (STANDARD_RIGHTS_EXECUTE)
560 
561 typedef enum _TOKEN_TYPE {
562   TokenPrimary = 1,
563   TokenImpersonation
564 } TOKEN_TYPE,*PTOKEN_TYPE;
565 
566 typedef enum _TOKEN_INFORMATION_CLASS {
567   TokenUser = 1,
568   TokenGroups,
569   TokenPrivileges,
570   TokenOwner,
571   TokenPrimaryGroup,
572   TokenDefaultDacl,
573   TokenSource,
574   TokenType,
575   TokenImpersonationLevel,
576   TokenStatistics,
577   TokenRestrictedSids,
578   TokenSessionId,
579   TokenGroupsAndPrivileges,
580   TokenSessionReference,
581   TokenSandBoxInert,
582   TokenAuditPolicy,
583   TokenOrigin,
584   TokenElevationType,
585   TokenLinkedToken,
586   TokenElevation,
587   TokenHasRestrictions,
588   TokenAccessInformation,
589   TokenVirtualizationAllowed,
590   TokenVirtualizationEnabled,
591   TokenIntegrityLevel,
592   TokenUIAccess,
593   TokenMandatoryPolicy,
594   TokenLogonSid,
595   MaxTokenInfoClass
596 } TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS;
597 
598 typedef struct _TOKEN_USER {
599   SID_AND_ATTRIBUTES User;
600 } TOKEN_USER, *PTOKEN_USER;
601 
602 typedef struct _TOKEN_GROUPS {
603   ULONG GroupCount;
604   SID_AND_ATTRIBUTES Groups[ANYSIZE_ARRAY];
605 } TOKEN_GROUPS,*PTOKEN_GROUPS,*LPTOKEN_GROUPS;
606 
607 typedef struct _TOKEN_PRIVILEGES {
608   ULONG PrivilegeCount;
609   LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY];
610 } TOKEN_PRIVILEGES,*PTOKEN_PRIVILEGES,*LPTOKEN_PRIVILEGES;
611 
612 typedef struct _TOKEN_OWNER {
613   PSID Owner;
614 } TOKEN_OWNER,*PTOKEN_OWNER;
615 
616 typedef struct _TOKEN_PRIMARY_GROUP {
617   PSID PrimaryGroup;
618 } TOKEN_PRIMARY_GROUP,*PTOKEN_PRIMARY_GROUP;
619 
620 typedef struct _TOKEN_DEFAULT_DACL {
621   PACL DefaultDacl;
622 } TOKEN_DEFAULT_DACL,*PTOKEN_DEFAULT_DACL;
623 
624 typedef struct _TOKEN_GROUPS_AND_PRIVILEGES {
625   ULONG SidCount;
626   ULONG SidLength;
627   PSID_AND_ATTRIBUTES Sids;
628   ULONG RestrictedSidCount;
629   ULONG RestrictedSidLength;
630   PSID_AND_ATTRIBUTES RestrictedSids;
631   ULONG PrivilegeCount;
632   ULONG PrivilegeLength;
633   PLUID_AND_ATTRIBUTES Privileges;
634   LUID AuthenticationId;
635 } TOKEN_GROUPS_AND_PRIVILEGES, *PTOKEN_GROUPS_AND_PRIVILEGES;
636 
637 typedef struct _TOKEN_LINKED_TOKEN {
638   HANDLE LinkedToken;
639 } TOKEN_LINKED_TOKEN, *PTOKEN_LINKED_TOKEN;
640 
641 typedef struct _TOKEN_ELEVATION {
642   ULONG TokenIsElevated;
643 } TOKEN_ELEVATION, *PTOKEN_ELEVATION;
644 
645 typedef struct _TOKEN_MANDATORY_LABEL {
646   SID_AND_ATTRIBUTES Label;
647 } TOKEN_MANDATORY_LABEL, *PTOKEN_MANDATORY_LABEL;
648 
649 #define TOKEN_MANDATORY_POLICY_OFF             0x0
650 #define TOKEN_MANDATORY_POLICY_NO_WRITE_UP     0x1
651 #define TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN 0x2
652 
653 #define TOKEN_MANDATORY_POLICY_VALID_MASK    (TOKEN_MANDATORY_POLICY_NO_WRITE_UP | \
654                                               TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN)
655 
656 typedef struct _TOKEN_MANDATORY_POLICY {
657   ULONG Policy;
658 } TOKEN_MANDATORY_POLICY, *PTOKEN_MANDATORY_POLICY;
659 
660 typedef struct _TOKEN_ACCESS_INFORMATION {
661   PSID_AND_ATTRIBUTES_HASH SidHash;
662   PSID_AND_ATTRIBUTES_HASH RestrictedSidHash;
663   PTOKEN_PRIVILEGES Privileges;
664   LUID AuthenticationId;
665   TOKEN_TYPE TokenType;
666   SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
667   TOKEN_MANDATORY_POLICY MandatoryPolicy;
668   ULONG Flags;
669 } TOKEN_ACCESS_INFORMATION, *PTOKEN_ACCESS_INFORMATION;
670 
671 #define POLICY_AUDIT_SUBCATEGORY_COUNT (53)
672 
673 typedef struct _TOKEN_AUDIT_POLICY {
674   UCHAR PerUserPolicy[((POLICY_AUDIT_SUBCATEGORY_COUNT) >> 1) + 1];
675 } TOKEN_AUDIT_POLICY, *PTOKEN_AUDIT_POLICY;
676 
677 #define TOKEN_SOURCE_LENGTH 8
678 
679 typedef struct _TOKEN_SOURCE {
680   CHAR SourceName[TOKEN_SOURCE_LENGTH];
681   LUID SourceIdentifier;
682 } TOKEN_SOURCE,*PTOKEN_SOURCE;
683 
684 typedef struct _TOKEN_STATISTICS {
685   LUID TokenId;
686   LUID AuthenticationId;
687   LARGE_INTEGER ExpirationTime;
688   TOKEN_TYPE TokenType;
689   SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
690   ULONG DynamicCharged;
691   ULONG DynamicAvailable;
692   ULONG GroupCount;
693   ULONG PrivilegeCount;
694   LUID ModifiedId;
695 } TOKEN_STATISTICS, *PTOKEN_STATISTICS;
696 
697 typedef struct _TOKEN_CONTROL {
698   LUID TokenId;
699   LUID AuthenticationId;
700   LUID ModifiedId;
701   TOKEN_SOURCE TokenSource;
702 } TOKEN_CONTROL,*PTOKEN_CONTROL;
703 
704 typedef struct _TOKEN_ORIGIN {
705   LUID OriginatingLogonSession;
706 } TOKEN_ORIGIN, *PTOKEN_ORIGIN;
707 
708 typedef enum _MANDATORY_LEVEL {
709   MandatoryLevelUntrusted = 0,
710   MandatoryLevelLow,
711   MandatoryLevelMedium,
712   MandatoryLevelHigh,
713   MandatoryLevelSystem,
714   MandatoryLevelSecureProcess,
715   MandatoryLevelCount
716 } MANDATORY_LEVEL, *PMANDATORY_LEVEL;
717 
718 #define TOKEN_HAS_TRAVERSE_PRIVILEGE    0x0001
719 #define TOKEN_HAS_BACKUP_PRIVILEGE      0x0002
720 #define TOKEN_HAS_RESTORE_PRIVILEGE     0x0004
721 #define TOKEN_WRITE_RESTRICTED          0x0008
722 #define TOKEN_IS_RESTRICTED             0x0010
723 #define TOKEN_SESSION_NOT_REFERENCED    0x0020
724 #define TOKEN_SANDBOX_INERT             0x0040
725 #define TOKEN_HAS_IMPERSONATE_PRIVILEGE 0x0080
726 #define SE_BACKUP_PRIVILEGES_CHECKED    0x0100
727 #define TOKEN_VIRTUALIZE_ALLOWED        0x0200
728 #define TOKEN_VIRTUALIZE_ENABLED        0x0400
729 #define TOKEN_IS_FILTERED               0x0800
730 #define TOKEN_UIACCESS                  0x1000
731 #define TOKEN_NOT_LOW                   0x2000
732 
733 typedef struct _SE_EXPORTS {
734   LUID SeCreateTokenPrivilege;
735   LUID SeAssignPrimaryTokenPrivilege;
736   LUID SeLockMemoryPrivilege;
737   LUID SeIncreaseQuotaPrivilege;
738   LUID SeUnsolicitedInputPrivilege;
739   LUID SeTcbPrivilege;
740   LUID SeSecurityPrivilege;
741   LUID SeTakeOwnershipPrivilege;
742   LUID SeLoadDriverPrivilege;
743   LUID SeCreatePagefilePrivilege;
744   LUID SeIncreaseBasePriorityPrivilege;
745   LUID SeSystemProfilePrivilege;
746   LUID SeSystemtimePrivilege;
747   LUID SeProfileSingleProcessPrivilege;
748   LUID SeCreatePermanentPrivilege;
749   LUID SeBackupPrivilege;
750   LUID SeRestorePrivilege;
751   LUID SeShutdownPrivilege;
752   LUID SeDebugPrivilege;
753   LUID SeAuditPrivilege;
754   LUID SeSystemEnvironmentPrivilege;
755   LUID SeChangeNotifyPrivilege;
756   LUID SeRemoteShutdownPrivilege;
757   PSID SeNullSid;
758   PSID SeWorldSid;
759   PSID SeLocalSid;
760   PSID SeCreatorOwnerSid;
761   PSID SeCreatorGroupSid;
762   PSID SeNtAuthoritySid;
763   PSID SeDialupSid;
764   PSID SeNetworkSid;
765   PSID SeBatchSid;
766   PSID SeInteractiveSid;
767   PSID SeLocalSystemSid;
768   PSID SeAliasAdminsSid;
769   PSID SeAliasUsersSid;
770   PSID SeAliasGuestsSid;
771   PSID SeAliasPowerUsersSid;
772   PSID SeAliasAccountOpsSid;
773   PSID SeAliasSystemOpsSid;
774   PSID SeAliasPrintOpsSid;
775   PSID SeAliasBackupOpsSid;
776   PSID SeAuthenticatedUsersSid;
777   PSID SeRestrictedSid;
778   PSID SeAnonymousLogonSid;
779   LUID SeUndockPrivilege;
780   LUID SeSyncAgentPrivilege;
781   LUID SeEnableDelegationPrivilege;
782   PSID SeLocalServiceSid;
783   PSID SeNetworkServiceSid;
784   LUID SeManageVolumePrivilege;
785   LUID SeImpersonatePrivilege;
786   LUID SeCreateGlobalPrivilege;
787   LUID SeTrustedCredManAccessPrivilege;
788   LUID SeRelabelPrivilege;
789   LUID SeIncreaseWorkingSetPrivilege;
790   LUID SeTimeZonePrivilege;
791   LUID SeCreateSymbolicLinkPrivilege;
792   PSID SeIUserSid;
793   PSID SeUntrustedMandatorySid;
794   PSID SeLowMandatorySid;
795   PSID SeMediumMandatorySid;
796   PSID SeHighMandatorySid;
797   PSID SeSystemMandatorySid;
798   PSID SeOwnerRightsSid;
799 } SE_EXPORTS, *PSE_EXPORTS;
800 
801 typedef NTSTATUS
802 (NTAPI *PSE_LOGON_SESSION_TERMINATED_ROUTINE)(
803   IN PLUID LogonId);
804 /******************************************************************************
805  *                           Runtime Library Types                            *
806  ******************************************************************************/
807 
808 
809 #define RTL_SYSTEM_VOLUME_INFORMATION_FOLDER    L"System Volume Information"
810 
811 typedef PVOID
812 (NTAPI *PRTL_ALLOCATE_STRING_ROUTINE)(
813   IN SIZE_T NumberOfBytes);
814 
815 #if _WIN32_WINNT >= 0x0600
816 typedef PVOID
817 (NTAPI *PRTL_REALLOCATE_STRING_ROUTINE)(
818   IN SIZE_T NumberOfBytes,
819   IN PVOID Buffer);
820 #endif
821 
822 typedef VOID
823 (NTAPI *PRTL_FREE_STRING_ROUTINE)(
824   IN PVOID Buffer);
825 
826 extern const PRTL_ALLOCATE_STRING_ROUTINE RtlAllocateStringRoutine;
827 extern const PRTL_FREE_STRING_ROUTINE RtlFreeStringRoutine;
828 
829 #if _WIN32_WINNT >= 0x0600
830 extern const PRTL_REALLOCATE_STRING_ROUTINE RtlReallocateStringRoutine;
831 #endif
832 
833 typedef NTSTATUS
834 (NTAPI * PRTL_HEAP_COMMIT_ROUTINE) (
835   IN PVOID Base,
836   IN OUT PVOID *CommitAddress,
837   IN OUT PSIZE_T CommitSize);
838 
839 typedef struct _RTL_HEAP_PARAMETERS {
840   ULONG Length;
841   SIZE_T SegmentReserve;
842   SIZE_T SegmentCommit;
843   SIZE_T DeCommitFreeBlockThreshold;
844   SIZE_T DeCommitTotalFreeThreshold;
845   SIZE_T MaximumAllocationSize;
846   SIZE_T VirtualMemoryThreshold;
847   SIZE_T InitialCommit;
848   SIZE_T InitialReserve;
849   PRTL_HEAP_COMMIT_ROUTINE CommitRoutine;
850   SIZE_T Reserved[2];
851 } RTL_HEAP_PARAMETERS, *PRTL_HEAP_PARAMETERS;
852 
853 #if (NTDDI_VERSION >= NTDDI_WIN2K)
854 
855 typedef struct _GENERATE_NAME_CONTEXT {
856   USHORT Checksum;
857   BOOLEAN CheckSumInserted;
858   UCHAR NameLength;
859   WCHAR NameBuffer[8];
860   ULONG ExtensionLength;
861   WCHAR ExtensionBuffer[4];
862   ULONG LastIndexValue;
863 } GENERATE_NAME_CONTEXT, *PGENERATE_NAME_CONTEXT;
864 
865 typedef struct _PREFIX_TABLE_ENTRY {
866   CSHORT NodeTypeCode;
867   CSHORT NameLength;
868   struct _PREFIX_TABLE_ENTRY *NextPrefixTree;
869   RTL_SPLAY_LINKS Links;
870   PSTRING Prefix;
871 } PREFIX_TABLE_ENTRY, *PPREFIX_TABLE_ENTRY;
872 
873 typedef struct _PREFIX_TABLE {
874   CSHORT NodeTypeCode;
875   CSHORT NameLength;
876   PPREFIX_TABLE_ENTRY NextPrefixTree;
877 } PREFIX_TABLE, *PPREFIX_TABLE;
878 
879 typedef struct _UNICODE_PREFIX_TABLE_ENTRY {
880   CSHORT NodeTypeCode;
881   CSHORT NameLength;
882   struct _UNICODE_PREFIX_TABLE_ENTRY *NextPrefixTree;
883   struct _UNICODE_PREFIX_TABLE_ENTRY *CaseMatch;
884   RTL_SPLAY_LINKS Links;
885   PUNICODE_STRING Prefix;
886 } UNICODE_PREFIX_TABLE_ENTRY, *PUNICODE_PREFIX_TABLE_ENTRY;
887 
888 typedef struct _UNICODE_PREFIX_TABLE {
889   CSHORT NodeTypeCode;
890   CSHORT NameLength;
891   PUNICODE_PREFIX_TABLE_ENTRY NextPrefixTree;
892   PUNICODE_PREFIX_TABLE_ENTRY LastNextEntry;
893 } UNICODE_PREFIX_TABLE, *PUNICODE_PREFIX_TABLE;
894 
895 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
896 
897 #if (NTDDI_VERSION >= NTDDI_WINXP)
898 typedef struct _COMPRESSED_DATA_INFO {
899   USHORT CompressionFormatAndEngine;
900   UCHAR CompressionUnitShift;
901   UCHAR ChunkShift;
902   UCHAR ClusterShift;
903   UCHAR Reserved;
904   USHORT NumberOfChunks;
905   ULONG CompressedChunkSizes[ANYSIZE_ARRAY];
906 } COMPRESSED_DATA_INFO, *PCOMPRESSED_DATA_INFO;
907 #endif
908 
909 /******************************************************************************
910  *                         Runtime Library Functions                          *
911  ******************************************************************************/
912 
913 #if (NTDDI_VERSION >= NTDDI_WIN2K)
914 
915 NTSYSAPI
916 PVOID
917 NTAPI
918 RtlAllocateHeap(
919   IN HANDLE HeapHandle,
920   IN ULONG Flags OPTIONAL,
921   IN SIZE_T Size);
922 
923 NTSYSAPI
924 BOOLEAN
925 NTAPI
926 RtlFreeHeap(
927   IN PVOID HeapHandle,
928   IN ULONG Flags OPTIONAL,
929   IN PVOID BaseAddress);
930 
931 NTSYSAPI
932 VOID
933 NTAPI
934 RtlCaptureContext(
935   OUT PCONTEXT ContextRecord);
936 
937 NTSYSAPI
938 ULONG
939 NTAPI
940 RtlRandom(
941   IN OUT PULONG Seed);
942 
943 NTSYSAPI
944 BOOLEAN
945 NTAPI
946 RtlCreateUnicodeString(
947   OUT PUNICODE_STRING DestinationString,
948   IN PCWSTR SourceString);
949 
950 NTSYSAPI
951 NTSTATUS
952 NTAPI
953 RtlAppendStringToString(
954   IN OUT PSTRING Destination,
955   IN const STRING *Source);
956 
957 NTSYSAPI
958 NTSTATUS
959 NTAPI
960 RtlOemStringToUnicodeString(
961   IN OUT PUNICODE_STRING DestinationString,
962   IN PCOEM_STRING SourceString,
963   IN BOOLEAN AllocateDestinationString);
964 
965 NTSYSAPI
966 NTSTATUS
967 NTAPI
968 RtlUnicodeStringToOemString(
969   IN OUT POEM_STRING DestinationString,
970   IN PCUNICODE_STRING SourceString,
971   IN BOOLEAN AllocateDestinationString);
972 
973 NTSYSAPI
974 NTSTATUS
975 NTAPI
976 RtlUpcaseUnicodeStringToOemString(
977   IN OUT POEM_STRING DestinationString,
978   IN PCUNICODE_STRING SourceString,
979   IN BOOLEAN AllocateDestinationString);
980 
981 NTSYSAPI
982 NTSTATUS
983 NTAPI
984 RtlOemStringToCountedUnicodeString(
985   IN OUT PUNICODE_STRING DestinationString,
986   IN PCOEM_STRING SourceString,
987   IN BOOLEAN AllocateDestinationString);
988 
989 NTSYSAPI
990 NTSTATUS
991 NTAPI
992 RtlUnicodeStringToCountedOemString(
993   IN OUT POEM_STRING DestinationString,
994   IN PCUNICODE_STRING SourceString,
995   IN BOOLEAN AllocateDestinationString);
996 
997 NTSYSAPI
998 NTSTATUS
999 NTAPI
1000 RtlUpcaseUnicodeStringToCountedOemString(
1001   IN OUT POEM_STRING DestinationString,
1002   IN PCUNICODE_STRING SourceString,
1003   IN BOOLEAN AllocateDestinationString);
1004 
1005 NTSYSAPI
1006 NTSTATUS
1007 NTAPI
1008 RtlDowncaseUnicodeString(
1009   IN OUT PUNICODE_STRING UniDest,
1010   IN PCUNICODE_STRING UniSource,
1011   IN BOOLEAN AllocateDestinationString);
1012 
1013 NTSYSAPI
1014 VOID
1015 NTAPI
1016 RtlFreeOemString (
1017   IN OUT POEM_STRING OemString);
1018 
1019 NTSYSAPI
1020 ULONG
1021 NTAPI
1022 RtlxUnicodeStringToOemSize(
1023   IN PCUNICODE_STRING UnicodeString);
1024 
1025 NTSYSAPI
1026 ULONG
1027 NTAPI
1028 RtlxOemStringToUnicodeSize(
1029   IN PCOEM_STRING OemString);
1030 
1031 NTSYSAPI
1032 NTSTATUS
1033 NTAPI
1034 RtlMultiByteToUnicodeN(
1035   OUT PWCH UnicodeString,
1036   IN ULONG MaxBytesInUnicodeString,
1037   OUT PULONG BytesInUnicodeString OPTIONAL,
1038   IN const CHAR *MultiByteString,
1039   IN ULONG BytesInMultiByteString);
1040 
1041 NTSYSAPI
1042 NTSTATUS
1043 NTAPI
1044 RtlMultiByteToUnicodeSize(
1045   OUT PULONG BytesInUnicodeString,
1046   IN const CHAR *MultiByteString,
1047   IN ULONG BytesInMultiByteString);
1048 
1049 NTSYSAPI
1050 NTSTATUS
1051 NTAPI
1052 RtlUnicodeToMultiByteSize(
1053   OUT PULONG BytesInMultiByteString,
1054   IN PCWCH UnicodeString,
1055   IN ULONG BytesInUnicodeString);
1056 
1057 NTSYSAPI
1058 NTSTATUS
1059 NTAPI
1060 RtlUnicodeToMultiByteN(
1061   OUT PCHAR MultiByteString,
1062   IN ULONG MaxBytesInMultiByteString,
1063   OUT PULONG BytesInMultiByteString OPTIONAL,
1064   IN PCWCH UnicodeString,
1065   IN ULONG BytesInUnicodeString);
1066 
1067 NTSYSAPI
1068 NTSTATUS
1069 NTAPI
1070 RtlUpcaseUnicodeToMultiByteN(
1071   OUT PCHAR MultiByteString,
1072   IN ULONG MaxBytesInMultiByteString,
1073   OUT PULONG BytesInMultiByteString OPTIONAL,
1074   IN PCWCH UnicodeString,
1075   IN ULONG BytesInUnicodeString);
1076 
1077 NTSYSAPI
1078 NTSTATUS
1079 NTAPI
1080 RtlOemToUnicodeN(
1081   OUT PWSTR UnicodeString,
1082   IN ULONG MaxBytesInUnicodeString,
1083   OUT PULONG BytesInUnicodeString OPTIONAL,
1084   IN PCCH OemString,
1085   IN ULONG BytesInOemString);
1086 
1087 NTSYSAPI
1088 NTSTATUS
1089 NTAPI
1090 RtlUnicodeToOemN(
1091   OUT PCHAR OemString,
1092   IN ULONG MaxBytesInOemString,
1093   OUT PULONG BytesInOemString OPTIONAL,
1094   IN PCWCH UnicodeString,
1095   IN ULONG BytesInUnicodeString);
1096 
1097 NTSYSAPI
1098 NTSTATUS
1099 NTAPI
1100 RtlUpcaseUnicodeToOemN(
1101   OUT PCHAR OemString,
1102   IN ULONG MaxBytesInOemString,
1103   OUT PULONG BytesInOemString OPTIONAL,
1104   IN PCWCH UnicodeString,
1105   IN ULONG BytesInUnicodeString);
1106 
1107 #if (NTDDI_VERSION >= NTDDI_VISTASP1)
1108 NTSYSAPI
1109 NTSTATUS
1110 NTAPI
1111 RtlGenerate8dot3Name(
1112   IN PCUNICODE_STRING Name,
1113   IN BOOLEAN AllowExtendedCharacters,
1114   IN OUT PGENERATE_NAME_CONTEXT Context,
1115   IN OUT PUNICODE_STRING Name8dot3);
1116 #else
1117 NTSYSAPI
1118 VOID
1119 NTAPI
1120 RtlGenerate8dot3Name(
1121   IN PCUNICODE_STRING Name,
1122   IN BOOLEAN AllowExtendedCharacters,
1123   IN OUT PGENERATE_NAME_CONTEXT Context,
1124   IN OUT PUNICODE_STRING Name8dot3);
1125 #endif
1126 
1127 NTSYSAPI
1128 BOOLEAN
1129 NTAPI
1130 RtlIsNameLegalDOS8Dot3(
1131   IN PCUNICODE_STRING Name,
1132   IN OUT POEM_STRING OemName OPTIONAL,
1133   IN OUT PBOOLEAN NameContainsSpaces OPTIONAL);
1134 
1135 NTSYSAPI
1136 BOOLEAN
1137 NTAPI
1138 RtlIsValidOemCharacter(
1139   IN OUT PWCHAR Char);
1140 
1141 NTSYSAPI
1142 VOID
1143 NTAPI
1144 PfxInitialize(
1145   OUT PPREFIX_TABLE PrefixTable);
1146 
1147 NTSYSAPI
1148 BOOLEAN
1149 NTAPI
1150 PfxInsertPrefix(
1151   IN PPREFIX_TABLE PrefixTable,
1152   IN PSTRING Prefix,
1153   OUT PPREFIX_TABLE_ENTRY PrefixTableEntry);
1154 
1155 NTSYSAPI
1156 VOID
1157 NTAPI
1158 PfxRemovePrefix(
1159   IN PPREFIX_TABLE PrefixTable,
1160   IN PPREFIX_TABLE_ENTRY PrefixTableEntry);
1161 
1162 NTSYSAPI
1163 PPREFIX_TABLE_ENTRY
1164 NTAPI
1165 PfxFindPrefix(
1166   IN PPREFIX_TABLE PrefixTable,
1167   IN PSTRING FullName);
1168 
1169 NTSYSAPI
1170 VOID
1171 NTAPI
1172 RtlInitializeUnicodePrefix(
1173   OUT PUNICODE_PREFIX_TABLE PrefixTable);
1174 
1175 NTSYSAPI
1176 BOOLEAN
1177 NTAPI
1178 RtlInsertUnicodePrefix(
1179   IN PUNICODE_PREFIX_TABLE PrefixTable,
1180   IN PUNICODE_STRING Prefix,
1181   OUT PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry);
1182 
1183 NTSYSAPI
1184 VOID
1185 NTAPI
1186 RtlRemoveUnicodePrefix(
1187   IN PUNICODE_PREFIX_TABLE PrefixTable,
1188   IN PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry);
1189 
1190 NTSYSAPI
1191 PUNICODE_PREFIX_TABLE_ENTRY
1192 NTAPI
1193 RtlFindUnicodePrefix(
1194   IN PUNICODE_PREFIX_TABLE PrefixTable,
1195   IN PUNICODE_STRING FullName,
1196   IN ULONG CaseInsensitiveIndex);
1197 
1198 NTSYSAPI
1199 PUNICODE_PREFIX_TABLE_ENTRY
1200 NTAPI
1201 RtlNextUnicodePrefix(
1202   IN PUNICODE_PREFIX_TABLE PrefixTable,
1203   IN BOOLEAN Restart);
1204 
1205 NTSYSAPI
1206 SIZE_T
1207 NTAPI
1208 RtlCompareMemoryUlong(
1209   IN PVOID Source,
1210   IN SIZE_T Length,
1211   IN ULONG Pattern);
1212 
1213 NTSYSAPI
1214 BOOLEAN
1215 NTAPI
1216 RtlTimeToSecondsSince1980(
1217   IN PLARGE_INTEGER Time,
1218   OUT PULONG ElapsedSeconds);
1219 
1220 NTSYSAPI
1221 VOID
1222 NTAPI
1223 RtlSecondsSince1980ToTime(
1224   IN ULONG ElapsedSeconds,
1225   OUT PLARGE_INTEGER Time);
1226 
1227 NTSYSAPI
1228 BOOLEAN
1229 NTAPI
1230 RtlTimeToSecondsSince1970(
1231   IN PLARGE_INTEGER Time,
1232   OUT PULONG ElapsedSeconds);
1233 
1234 NTSYSAPI
1235 VOID
1236 NTAPI
1237 RtlSecondsSince1970ToTime(
1238   IN ULONG ElapsedSeconds,
1239   OUT PLARGE_INTEGER Time);
1240 
1241 NTSYSAPI
1242 BOOLEAN
1243 NTAPI
1244 RtlValidSid(
1245   IN PSID Sid);
1246 
1247 NTSYSAPI
1248 BOOLEAN
1249 NTAPI
1250 RtlEqualSid(
1251   IN PSID Sid1,
1252   IN PSID Sid2);
1253 
1254 NTSYSAPI
1255 BOOLEAN
1256 NTAPI
1257 RtlEqualPrefixSid(
1258   IN PSID Sid1,
1259   IN PSID Sid2);
1260 
1261 NTSYSAPI
1262 ULONG
1263 NTAPI
1264 RtlLengthRequiredSid(
1265   IN ULONG SubAuthorityCount);
1266 
1267 NTSYSAPI
1268 PVOID
1269 NTAPI
1270 RtlFreeSid(
1271   IN PSID Sid);
1272 
1273 NTSYSAPI
1274 NTSTATUS
1275 NTAPI
1276 RtlAllocateAndInitializeSid(
1277   IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,
1278   IN UCHAR SubAuthorityCount,
1279   IN ULONG SubAuthority0,
1280   IN ULONG SubAuthority1,
1281   IN ULONG SubAuthority2,
1282   IN ULONG SubAuthority3,
1283   IN ULONG SubAuthority4,
1284   IN ULONG SubAuthority5,
1285   IN ULONG SubAuthority6,
1286   IN ULONG SubAuthority7,
1287   OUT PSID *Sid);
1288 
1289 NTSYSAPI
1290 NTSTATUS
1291 NTAPI
1292 RtlInitializeSid(
1293   OUT PSID Sid,
1294   IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,
1295   IN UCHAR SubAuthorityCount);
1296 
1297 NTSYSAPI
1298 PULONG
1299 NTAPI
1300 RtlSubAuthoritySid(
1301   IN PSID Sid,
1302   IN ULONG SubAuthority);
1303 
1304 NTSYSAPI
1305 ULONG
1306 NTAPI
1307 RtlLengthSid(
1308   IN PSID Sid);
1309 
1310 NTSYSAPI
1311 NTSTATUS
1312 NTAPI
1313 RtlCopySid(
1314   IN ULONG Length,
1315   IN PSID Destination,
1316   IN PSID Source);
1317 
1318 NTSYSAPI
1319 NTSTATUS
1320 NTAPI
1321 RtlConvertSidToUnicodeString(
1322   IN OUT PUNICODE_STRING UnicodeString,
1323   IN PSID Sid,
1324   IN BOOLEAN AllocateDestinationString);
1325 
1326 NTSYSAPI
1327 VOID
1328 NTAPI
1329 RtlCopyLuid(
1330   OUT PLUID DestinationLuid,
1331   IN PLUID SourceLuid);
1332 
1333 NTSYSAPI
1334 NTSTATUS
1335 NTAPI
1336 RtlCreateAcl(
1337   OUT PACL Acl,
1338   IN ULONG AclLength,
1339   IN ULONG AclRevision);
1340 
1341 NTSYSAPI
1342 NTSTATUS
1343 NTAPI
1344 RtlAddAce(
1345   IN OUT PACL Acl,
1346   IN ULONG AceRevision,
1347   IN ULONG StartingAceIndex,
1348   IN PVOID AceList,
1349   IN ULONG AceListLength);
1350 
1351 NTSYSAPI
1352 NTSTATUS
1353 NTAPI
1354 RtlDeleteAce(
1355   IN OUT PACL Acl,
1356   IN ULONG AceIndex);
1357 
1358 NTSYSAPI
1359 NTSTATUS
1360 NTAPI
1361 RtlGetAce(
1362   IN PACL Acl,
1363   IN ULONG AceIndex,
1364   OUT PVOID *Ace);
1365 
1366 NTSYSAPI
1367 NTSTATUS
1368 NTAPI
1369 RtlAddAccessAllowedAce(
1370   IN OUT PACL Acl,
1371   IN ULONG AceRevision,
1372   IN ACCESS_MASK AccessMask,
1373   IN PSID Sid);
1374 
1375 NTSYSAPI
1376 NTSTATUS
1377 NTAPI
1378 RtlAddAccessAllowedAceEx(
1379   IN OUT PACL Acl,
1380   IN ULONG AceRevision,
1381   IN ULONG AceFlags,
1382   IN ACCESS_MASK AccessMask,
1383   IN PSID Sid);
1384 
1385 NTSYSAPI
1386 NTSTATUS
1387 NTAPI
1388 RtlCreateSecurityDescriptorRelative(
1389   OUT PISECURITY_DESCRIPTOR_RELATIVE SecurityDescriptor,
1390   IN ULONG Revision);
1391 
1392 NTSYSAPI
1393 NTSTATUS
1394 NTAPI
1395 RtlGetDaclSecurityDescriptor(
1396   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
1397   OUT PBOOLEAN DaclPresent,
1398   OUT PACL *Dacl,
1399   OUT PBOOLEAN DaclDefaulted);
1400 
1401 NTSYSAPI
1402 NTSTATUS
1403 NTAPI
1404 RtlSetOwnerSecurityDescriptor(
1405   IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
1406   IN PSID Owner OPTIONAL,
1407   IN BOOLEAN OwnerDefaulted);
1408 
1409 NTSYSAPI
1410 NTSTATUS
1411 NTAPI
1412 RtlGetOwnerSecurityDescriptor(
1413   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
1414   OUT PSID *Owner,
1415   OUT PBOOLEAN OwnerDefaulted);
1416 
1417 NTSYSAPI
1418 ULONG
1419 NTAPI
1420 RtlNtStatusToDosError(
1421   IN NTSTATUS Status);
1422 
1423 NTSYSAPI
1424 NTSTATUS
1425 NTAPI
1426 RtlCustomCPToUnicodeN(
1427   IN PCPTABLEINFO CustomCP,
1428   OUT PWCH UnicodeString,
1429   IN ULONG MaxBytesInUnicodeString,
1430   OUT PULONG BytesInUnicodeString OPTIONAL,
1431   IN PCH CustomCPString,
1432   IN ULONG BytesInCustomCPString);
1433 
1434 NTSYSAPI
1435 NTSTATUS
1436 NTAPI
1437 RtlUnicodeToCustomCPN(
1438   IN PCPTABLEINFO CustomCP,
1439   OUT PCH CustomCPString,
1440   IN ULONG MaxBytesInCustomCPString,
1441   OUT PULONG BytesInCustomCPString OPTIONAL,
1442   IN PWCH UnicodeString,
1443   IN ULONG BytesInUnicodeString);
1444 
1445 NTSYSAPI
1446 NTSTATUS
1447 NTAPI
1448 RtlUpcaseUnicodeToCustomCPN(
1449   IN PCPTABLEINFO CustomCP,
1450   OUT PCH CustomCPString,
1451   IN ULONG MaxBytesInCustomCPString,
1452   OUT PULONG BytesInCustomCPString OPTIONAL,
1453   IN PWCH UnicodeString,
1454   IN ULONG BytesInUnicodeString);
1455 
1456 NTSYSAPI
1457 VOID
1458 NTAPI
1459 RtlInitCodePageTable(
1460   IN PUSHORT TableBase,
1461   IN OUT PCPTABLEINFO CodePageTable);
1462 
1463 
1464 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
1465 
1466 
1467 #if (NTDDI_VERSION >= NTDDI_WINXP)
1468 
1469 NTSYSAPI
1470 PVOID
1471 NTAPI
1472 RtlCreateHeap(
1473   IN ULONG Flags,
1474   IN PVOID HeapBase OPTIONAL,
1475   IN SIZE_T ReserveSize OPTIONAL,
1476   IN SIZE_T CommitSize OPTIONAL,
1477   IN PVOID Lock OPTIONAL,
1478   IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL);
1479 
1480 NTSYSAPI
1481 PVOID
1482 NTAPI
1483 RtlDestroyHeap(
1484   IN PVOID HeapHandle);
1485 
1486 NTSYSAPI
1487 USHORT
1488 NTAPI
1489 RtlCaptureStackBackTrace(
1490   IN ULONG FramesToSkip,
1491   IN ULONG FramesToCapture,
1492   OUT PVOID *BackTrace,
1493   OUT PULONG BackTraceHash OPTIONAL);
1494 
1495 NTSYSAPI
1496 ULONG
1497 NTAPI
1498 RtlRandomEx(
1499   IN OUT PULONG Seed);
1500 
1501 NTSYSAPI
1502 NTSTATUS
1503 NTAPI
1504 RtlInitUnicodeStringEx(
1505   OUT PUNICODE_STRING DestinationString,
1506   IN PCWSTR SourceString OPTIONAL);
1507 
1508 NTSYSAPI
1509 NTSTATUS
1510 NTAPI
1511 RtlValidateUnicodeString(
1512   IN ULONG Flags,
1513   IN PCUNICODE_STRING String);
1514 
1515 NTSYSAPI
1516 NTSTATUS
1517 NTAPI
1518 RtlDuplicateUnicodeString(
1519   IN ULONG Flags,
1520   IN PCUNICODE_STRING SourceString,
1521   OUT PUNICODE_STRING DestinationString);
1522 
1523 NTSYSAPI
1524 NTSTATUS
1525 NTAPI
1526 RtlGetCompressionWorkSpaceSize(
1527   IN USHORT CompressionFormatAndEngine,
1528   OUT PULONG CompressBufferWorkSpaceSize,
1529   OUT PULONG CompressFragmentWorkSpaceSize);
1530 
1531 NTSYSAPI
1532 NTSTATUS
1533 NTAPI
1534 RtlCompressBuffer(
1535   IN USHORT CompressionFormatAndEngine,
1536   IN PUCHAR UncompressedBuffer,
1537   IN ULONG UncompressedBufferSize,
1538   OUT PUCHAR CompressedBuffer,
1539   IN ULONG CompressedBufferSize,
1540   IN ULONG UncompressedChunkSize,
1541   OUT PULONG FinalCompressedSize,
1542   IN PVOID WorkSpace);
1543 
1544 NTSYSAPI
1545 NTSTATUS
1546 NTAPI
1547 RtlDecompressBuffer(
1548   IN USHORT CompressionFormat,
1549   OUT PUCHAR UncompressedBuffer,
1550   IN ULONG UncompressedBufferSize,
1551   IN PUCHAR CompressedBuffer,
1552   IN ULONG CompressedBufferSize,
1553   OUT PULONG FinalUncompressedSize);
1554 
1555 NTSYSAPI
1556 NTSTATUS
1557 NTAPI
1558 RtlDecompressFragment(
1559   IN USHORT CompressionFormat,
1560   OUT PUCHAR UncompressedFragment,
1561   IN ULONG UncompressedFragmentSize,
1562   IN PUCHAR CompressedBuffer,
1563   IN ULONG CompressedBufferSize,
1564   IN ULONG FragmentOffset,
1565   OUT PULONG FinalUncompressedSize,
1566   IN PVOID WorkSpace);
1567 
1568 NTSYSAPI
1569 NTSTATUS
1570 NTAPI
1571 RtlDescribeChunk(
1572   IN USHORT CompressionFormat,
1573   IN OUT PUCHAR *CompressedBuffer,
1574   IN PUCHAR EndOfCompressedBufferPlus1,
1575   OUT PUCHAR *ChunkBuffer,
1576   OUT PULONG ChunkSize);
1577 
1578 NTSYSAPI
1579 NTSTATUS
1580 NTAPI
1581 RtlReserveChunk(
1582   IN USHORT CompressionFormat,
1583   IN OUT PUCHAR *CompressedBuffer,
1584   IN PUCHAR EndOfCompressedBufferPlus1,
1585   OUT PUCHAR *ChunkBuffer,
1586   IN ULONG ChunkSize);
1587 
1588 NTSYSAPI
1589 NTSTATUS
1590 NTAPI
1591 RtlDecompressChunks(
1592   OUT PUCHAR UncompressedBuffer,
1593   IN ULONG UncompressedBufferSize,
1594   IN PUCHAR CompressedBuffer,
1595   IN ULONG CompressedBufferSize,
1596   IN PUCHAR CompressedTail,
1597   IN ULONG CompressedTailSize,
1598   IN PCOMPRESSED_DATA_INFO CompressedDataInfo);
1599 
1600 NTSYSAPI
1601 NTSTATUS
1602 NTAPI
1603 RtlCompressChunks(
1604   IN PUCHAR UncompressedBuffer,
1605   IN ULONG UncompressedBufferSize,
1606   OUT PUCHAR CompressedBuffer,
1607   IN ULONG CompressedBufferSize,
1608   IN OUT PCOMPRESSED_DATA_INFO CompressedDataInfo,
1609   IN ULONG CompressedDataInfoLength,
1610   IN PVOID WorkSpace);
1611 
1612 NTSYSAPI
1613 PSID_IDENTIFIER_AUTHORITY
1614 NTAPI
1615 RtlIdentifierAuthoritySid(
1616   IN PSID Sid);
1617 
1618 NTSYSAPI
1619 PUCHAR
1620 NTAPI
1621 RtlSubAuthorityCountSid(
1622   IN PSID Sid);
1623 
1624 NTSYSAPI
1625 ULONG
1626 NTAPI
1627 RtlNtStatusToDosErrorNoTeb(
1628   IN NTSTATUS Status);
1629 
1630 NTSYSAPI
1631 NTSTATUS
1632 NTAPI
1633 RtlCreateSystemVolumeInformationFolder(
1634   IN PCUNICODE_STRING VolumeRootPath);
1635 
1636 #if defined(_M_AMD64)
1637 
1638 FORCEINLINE
1639 VOID
RtlFillMemoryUlong(OUT PVOID Destination,IN SIZE_T Length,IN ULONG Pattern)1640 RtlFillMemoryUlong (
1641   OUT PVOID Destination,
1642   IN SIZE_T Length,
1643   IN ULONG Pattern)
1644 {
1645   PULONG Address = (PULONG)Destination;
1646   if ((Length /= 4) != 0) {
1647     if (((ULONG64)Address & 4) != 0) {
1648       *Address = Pattern;
1649       if ((Length -= 1) == 0) {
1650         return;
1651       }
1652       Address += 1;
1653     }
1654     __stosq((PULONG64)(Address), Pattern | ((ULONG64)Pattern << 32), Length / 2);
1655     if ((Length & 1) != 0) Address[Length - 1] = Pattern;
1656   }
1657   return;
1658 }
1659 
1660 #define RtlFillMemoryUlonglong(Destination, Length, Pattern)                \
1661     __stosq((PULONG64)(Destination), Pattern, (Length) / 8)
1662 
1663 #else
1664 
1665 NTSYSAPI
1666 VOID
1667 NTAPI
1668 RtlFillMemoryUlong(
1669   OUT PVOID Destination,
1670   IN SIZE_T Length,
1671   IN ULONG Pattern);
1672 
1673 NTSYSAPI
1674 VOID
1675 NTAPI
1676 RtlFillMemoryUlonglong(
1677   OUT PVOID Destination,
1678   IN SIZE_T Length,
1679   IN ULONGLONG Pattern);
1680 
1681 #endif /* defined(_M_AMD64) */
1682 
1683 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
1684 
1685 #if (NTDDI_VERSION >= NTDDI_WS03)
1686 NTSYSAPI
1687 NTSTATUS
1688 NTAPI
1689 RtlInitAnsiStringEx(
1690   OUT PANSI_STRING DestinationString,
1691   IN PCSZ SourceString OPTIONAL);
1692 #endif
1693 
1694 #if (NTDDI_VERSION >= NTDDI_WS03SP1)
1695 
1696 NTSYSAPI
1697 NTSTATUS
1698 NTAPI
1699 RtlGetSaclSecurityDescriptor(
1700   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
1701   OUT PBOOLEAN SaclPresent,
1702   OUT PACL *Sacl,
1703   OUT PBOOLEAN SaclDefaulted);
1704 
1705 NTSYSAPI
1706 NTSTATUS
1707 NTAPI
1708 RtlSetGroupSecurityDescriptor(
1709   IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
1710   IN PSID Group OPTIONAL,
1711   IN BOOLEAN GroupDefaulted OPTIONAL);
1712 
1713 NTSYSAPI
1714 NTSTATUS
1715 NTAPI
1716 RtlGetGroupSecurityDescriptor(
1717   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
1718   OUT PSID *Group,
1719   OUT PBOOLEAN GroupDefaulted);
1720 
1721 NTSYSAPI
1722 NTSTATUS
1723 NTAPI
1724 RtlAbsoluteToSelfRelativeSD(
1725   IN PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor,
1726   OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor OPTIONAL,
1727   IN OUT PULONG BufferLength);
1728 
1729 NTSYSAPI
1730 NTSTATUS
1731 NTAPI
1732 RtlSelfRelativeToAbsoluteSD(
1733   IN PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor,
1734   OUT PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor OPTIONAL,
1735   IN OUT PULONG AbsoluteSecurityDescriptorSize,
1736   OUT PACL Dacl OPTIONAL,
1737   IN OUT PULONG DaclSize,
1738   OUT PACL Sacl OPTIONAL,
1739   IN OUT PULONG SaclSize,
1740   OUT PSID Owner OPTIONAL,
1741   IN OUT PULONG OwnerSize,
1742   OUT PSID PrimaryGroup OPTIONAL,
1743   IN OUT PULONG PrimaryGroupSize);
1744 
1745 #endif /* (NTDDI_VERSION >= NTDDI_WS03SP1) */
1746 
1747 #if (NTDDI_VERSION >= NTDDI_VISTA)
1748 
1749 NTSYSAPI
1750 NTSTATUS
1751 NTAPI
1752 RtlNormalizeString(
1753   IN ULONG NormForm,
1754   IN PCWSTR SourceString,
1755   IN LONG SourceStringLength,
1756   OUT PWSTR DestinationString,
1757   IN OUT PLONG DestinationStringLength);
1758 
1759 NTSYSAPI
1760 NTSTATUS
1761 NTAPI
1762 RtlIsNormalizedString(
1763   IN ULONG NormForm,
1764   IN PCWSTR SourceString,
1765   IN LONG SourceStringLength,
1766   OUT PBOOLEAN Normalized);
1767 
1768 NTSYSAPI
1769 NTSTATUS
1770 NTAPI
1771 RtlIdnToAscii(
1772   IN ULONG Flags,
1773   IN PCWSTR SourceString,
1774   IN LONG SourceStringLength,
1775   OUT PWSTR DestinationString,
1776   IN OUT PLONG DestinationStringLength);
1777 
1778 NTSYSAPI
1779 NTSTATUS
1780 NTAPI
1781 RtlIdnToUnicode(
1782   IN ULONG Flags,
1783   IN PCWSTR SourceString,
1784   IN LONG SourceStringLength,
1785   OUT PWSTR DestinationString,
1786   IN OUT PLONG DestinationStringLength);
1787 
1788 NTSYSAPI
1789 NTSTATUS
1790 NTAPI
1791 RtlIdnToNameprepUnicode(
1792   IN ULONG Flags,
1793   IN PCWSTR SourceString,
1794   IN LONG SourceStringLength,
1795   OUT PWSTR DestinationString,
1796   IN OUT PLONG DestinationStringLength);
1797 
1798 NTSYSAPI
1799 NTSTATUS
1800 NTAPI
1801 RtlCreateServiceSid(
1802   IN PUNICODE_STRING ServiceName,
1803   OUT PSID ServiceSid,
1804   IN OUT PULONG ServiceSidLength);
1805 
1806 NTSYSAPI
1807 LONG
1808 NTAPI
1809 RtlCompareAltitudes(
1810   IN PCUNICODE_STRING Altitude1,
1811   IN PCUNICODE_STRING Altitude2);
1812 
1813 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
1814 
1815 #if (NTDDI_VERSION >= NTDDI_WIN7)
1816 
1817 NTSYSAPI
1818 NTSTATUS
1819 NTAPI
1820 RtlUnicodeToUTF8N(
1821   OUT PCHAR UTF8StringDestination,
1822   IN ULONG UTF8StringMaxByteCount,
1823   OUT PULONG UTF8StringActualByteCount,
1824   IN PCWCH UnicodeStringSource,
1825   IN ULONG UnicodeStringByteCount);
1826 
1827 NTSYSAPI
1828 NTSTATUS
1829 NTAPI
1830 RtlUTF8ToUnicodeN(
1831   OUT PWSTR UnicodeStringDestination,
1832   IN ULONG UnicodeStringMaxByteCount,
1833   OUT PULONG UnicodeStringActualByteCount,
1834   IN PCCH UTF8StringSource,
1835   IN ULONG UTF8StringByteCount);
1836 
1837 NTSYSAPI
1838 NTSTATUS
1839 NTAPI
1840 RtlReplaceSidInSd(
1841   IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
1842   IN PSID OldSid,
1843   IN PSID NewSid,
1844   OUT ULONG *NumChanges);
1845 
1846 NTSYSAPI
1847 NTSTATUS
1848 NTAPI
1849 RtlCreateVirtualAccountSid(
1850   IN PCUNICODE_STRING Name,
1851   IN ULONG BaseSubAuthority,
1852   OUT PSID Sid,
1853   IN OUT PULONG SidLength);
1854 
1855 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
1856 
1857 
1858 #if defined(_AMD64_) || defined(_IA64_)
1859 
1860 
1861 #endif /* defined(_AMD64_) || defined(_IA64_) */
1862 
1863 
1864 
1865 #define RTL_DUPLICATE_UNICODE_STRING_NULL_TERMINATE 1
1866 #define RTL_DUPLICATE_UNICODE_STRING_ALLOCATE_NULL_STRING 2
1867 
1868 #define RtlUnicodeStringToOemSize(STRING) (NLS_MB_OEM_CODE_PAGE_TAG ?                                \
1869                                            RtlxUnicodeStringToOemSize(STRING) :                      \
1870                                            ((STRING)->Length + sizeof(UNICODE_NULL)) / sizeof(WCHAR) \
1871 )
1872 
1873 #define RtlOemStringToUnicodeSize(STRING) (                 \
1874     NLS_MB_OEM_CODE_PAGE_TAG ?                              \
1875     RtlxOemStringToUnicodeSize(STRING) :                    \
1876     ((STRING)->Length + sizeof(ANSI_NULL)) * sizeof(WCHAR)  \
1877 )
1878 
1879 #define RtlOemStringToCountedUnicodeSize(STRING) (                    \
1880     (ULONG)(RtlOemStringToUnicodeSize(STRING) - sizeof(UNICODE_NULL)) \
1881 )
1882 
1883 #define RtlOffsetToPointer(B,O) ((PCHAR)(((PCHAR)(B)) + ((ULONG_PTR)(O))))
1884 #define RtlPointerToOffset(B,P) ((ULONG)(((PCHAR)(P)) - ((PCHAR)(B))))
1885 
1886 typedef enum _OBJECT_INFORMATION_CLASS {
1887   ObjectBasicInformation = 0,
1888   ObjectNameInformation = 1, /* FIXME, not in WDK */
1889   ObjectTypeInformation = 2,
1890   ObjectTypesInformation = 3, /* FIXME, not in WDK */
1891   ObjectHandleFlagInformation = 4, /* FIXME, not in WDK */
1892   ObjectSessionInformation = 5, /* FIXME, not in WDK */
1893   MaxObjectInfoClass /* FIXME, not in WDK */
1894 } OBJECT_INFORMATION_CLASS;
1895 
1896 NTSYSCALLAPI
1897 NTSTATUS
1898 NTAPI
1899 NtQueryObject(
1900   IN HANDLE Handle OPTIONAL,
1901   IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
1902   OUT PVOID ObjectInformation OPTIONAL,
1903   IN ULONG ObjectInformationLength,
1904   OUT PULONG ReturnLength OPTIONAL);
1905 
1906 #if (NTDDI_VERSION >= NTDDI_WIN2K)
1907 
1908 NTSYSCALLAPI
1909 NTSTATUS
1910 NTAPI
1911 NtOpenThreadToken(
1912   IN HANDLE ThreadHandle,
1913   IN ACCESS_MASK DesiredAccess,
1914   IN BOOLEAN OpenAsSelf,
1915   OUT PHANDLE TokenHandle);
1916 
1917 NTSYSCALLAPI
1918 NTSTATUS
1919 NTAPI
1920 NtOpenProcessToken(
1921   IN HANDLE ProcessHandle,
1922   IN ACCESS_MASK DesiredAccess,
1923   OUT PHANDLE TokenHandle);
1924 
1925 NTSYSCALLAPI
1926 NTSTATUS
1927 NTAPI
1928 NtQueryInformationToken(
1929   IN HANDLE TokenHandle,
1930   IN TOKEN_INFORMATION_CLASS TokenInformationClass,
1931   OUT PVOID TokenInformation OPTIONAL,
1932   IN ULONG TokenInformationLength,
1933   OUT PULONG ReturnLength);
1934 
1935 NTSYSCALLAPI
1936 NTSTATUS
1937 NTAPI
1938 NtAdjustPrivilegesToken(
1939   IN HANDLE TokenHandle,
1940   IN BOOLEAN DisableAllPrivileges,
1941   IN PTOKEN_PRIVILEGES NewState OPTIONAL,
1942   IN ULONG BufferLength,
1943   OUT PTOKEN_PRIVILEGES PreviousState,
1944   OUT PULONG ReturnLength OPTIONAL);
1945 
1946 NTSYSCALLAPI
1947 NTSTATUS
1948 NTAPI
1949 NtCreateFile(
1950   OUT PHANDLE FileHandle,
1951   IN ACCESS_MASK DesiredAccess,
1952   IN POBJECT_ATTRIBUTES ObjectAttributes,
1953   OUT PIO_STATUS_BLOCK IoStatusBlock,
1954   IN PLARGE_INTEGER AllocationSize OPTIONAL,
1955   IN ULONG FileAttributes,
1956   IN ULONG ShareAccess,
1957   IN ULONG CreateDisposition,
1958   IN ULONG CreateOptions,
1959   IN PVOID EaBuffer,
1960   IN ULONG EaLength);
1961 
1962 NTSYSCALLAPI
1963 NTSTATUS
1964 NTAPI
1965 NtDeviceIoControlFile(
1966   IN HANDLE FileHandle,
1967   IN HANDLE Event OPTIONAL,
1968   IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
1969   IN PVOID ApcContext OPTIONAL,
1970   OUT PIO_STATUS_BLOCK IoStatusBlock,
1971   IN ULONG IoControlCode,
1972   IN PVOID InputBuffer OPTIONAL,
1973   IN ULONG InputBufferLength,
1974   OUT PVOID OutputBuffer OPTIONAL,
1975   IN ULONG OutputBufferLength);
1976 
1977 NTSYSCALLAPI
1978 NTSTATUS
1979 NTAPI
1980 NtFsControlFile(
1981   IN HANDLE FileHandle,
1982   IN HANDLE Event OPTIONAL,
1983   IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
1984   IN PVOID ApcContext OPTIONAL,
1985   OUT PIO_STATUS_BLOCK IoStatusBlock,
1986   IN ULONG FsControlCode,
1987   IN PVOID InputBuffer OPTIONAL,
1988   IN ULONG InputBufferLength,
1989   OUT PVOID OutputBuffer OPTIONAL,
1990   IN ULONG OutputBufferLength);
1991 
1992 NTSYSCALLAPI
1993 NTSTATUS
1994 NTAPI
1995 NtLockFile(
1996   IN HANDLE FileHandle,
1997   IN HANDLE Event OPTIONAL,
1998   IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
1999   IN PVOID ApcContext OPTIONAL,
2000   OUT PIO_STATUS_BLOCK IoStatusBlock,
2001   IN PLARGE_INTEGER ByteOffset,
2002   IN PLARGE_INTEGER Length,
2003   IN ULONG Key,
2004   IN BOOLEAN FailImmediately,
2005   IN BOOLEAN ExclusiveLock);
2006 
2007 NTSYSCALLAPI
2008 NTSTATUS
2009 NTAPI
2010 NtOpenFile(
2011   OUT PHANDLE FileHandle,
2012   IN ACCESS_MASK DesiredAccess,
2013   IN POBJECT_ATTRIBUTES ObjectAttributes,
2014   OUT PIO_STATUS_BLOCK IoStatusBlock,
2015   IN ULONG ShareAccess,
2016   IN ULONG OpenOptions);
2017 
2018 NTSYSCALLAPI
2019 NTSTATUS
2020 NTAPI
2021 NtQueryDirectoryFile(
2022   IN HANDLE FileHandle,
2023   IN HANDLE Event OPTIONAL,
2024   IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
2025   IN PVOID ApcContext OPTIONAL,
2026   OUT PIO_STATUS_BLOCK IoStatusBlock,
2027   OUT PVOID FileInformation,
2028   IN ULONG Length,
2029   IN FILE_INFORMATION_CLASS FileInformationClass,
2030   IN BOOLEAN ReturnSingleEntry,
2031   IN PUNICODE_STRING FileName OPTIONAL,
2032   IN BOOLEAN RestartScan);
2033 
2034 NTSYSCALLAPI
2035 NTSTATUS
2036 NTAPI
2037 NtQueryInformationFile(
2038   IN HANDLE FileHandle,
2039   OUT PIO_STATUS_BLOCK IoStatusBlock,
2040   OUT PVOID FileInformation,
2041   IN ULONG Length,
2042   IN FILE_INFORMATION_CLASS FileInformationClass);
2043 
2044 NTSYSCALLAPI
2045 NTSTATUS
2046 NTAPI
2047 NtQueryQuotaInformationFile(
2048   IN HANDLE FileHandle,
2049   OUT PIO_STATUS_BLOCK IoStatusBlock,
2050   OUT PVOID Buffer,
2051   IN ULONG Length,
2052   IN BOOLEAN ReturnSingleEntry,
2053   IN PVOID SidList,
2054   IN ULONG SidListLength,
2055   IN PSID StartSid OPTIONAL,
2056   IN BOOLEAN RestartScan);
2057 
2058 NTSYSCALLAPI
2059 NTSTATUS
2060 NTAPI
2061 NtQueryVolumeInformationFile(
2062   IN HANDLE FileHandle,
2063   OUT PIO_STATUS_BLOCK IoStatusBlock,
2064   OUT PVOID FsInformation,
2065   IN ULONG Length,
2066   IN FS_INFORMATION_CLASS FsInformationClass);
2067 
2068 NTSYSCALLAPI
2069 NTSTATUS
2070 NTAPI
2071 NtReadFile(
2072   IN HANDLE FileHandle,
2073   IN HANDLE Event OPTIONAL,
2074   IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
2075   IN PVOID ApcContext OPTIONAL,
2076   OUT PIO_STATUS_BLOCK IoStatusBlock,
2077   OUT PVOID Buffer,
2078   IN ULONG Length,
2079   IN PLARGE_INTEGER ByteOffset OPTIONAL,
2080   IN PULONG Key OPTIONAL);
2081 
2082 NTSYSCALLAPI
2083 NTSTATUS
2084 NTAPI
2085 NtSetInformationFile(
2086   IN HANDLE FileHandle,
2087   OUT PIO_STATUS_BLOCK IoStatusBlock,
2088   IN PVOID FileInformation,
2089   IN ULONG Length,
2090   IN FILE_INFORMATION_CLASS FileInformationClass);
2091 
2092 NTSYSCALLAPI
2093 NTSTATUS
2094 NTAPI
2095 NtSetQuotaInformationFile(
2096   IN HANDLE FileHandle,
2097   OUT PIO_STATUS_BLOCK IoStatusBlock,
2098   IN PVOID Buffer,
2099   IN ULONG Length);
2100 
2101 NTSYSCALLAPI
2102 NTSTATUS
2103 NTAPI
2104 NtSetVolumeInformationFile(
2105   IN HANDLE FileHandle,
2106   OUT PIO_STATUS_BLOCK IoStatusBlock,
2107   IN PVOID FsInformation,
2108   IN ULONG Length,
2109   IN FS_INFORMATION_CLASS FsInformationClass);
2110 
2111 NTSYSCALLAPI
2112 NTSTATUS
2113 NTAPI
2114 NtWriteFile(
2115   IN HANDLE FileHandle,
2116   IN HANDLE Event OPTIONAL,
2117   IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
2118   IN PVOID ApcContext OPTIONAL,
2119   OUT PIO_STATUS_BLOCK IoStatusBlock,
2120   IN PVOID Buffer,
2121   IN ULONG Length,
2122   IN PLARGE_INTEGER ByteOffset OPTIONAL,
2123   IN PULONG Key OPTIONAL);
2124 
2125 NTSYSCALLAPI
2126 NTSTATUS
2127 NTAPI
2128 NtUnlockFile(
2129   IN HANDLE FileHandle,
2130   OUT PIO_STATUS_BLOCK IoStatusBlock,
2131   IN PLARGE_INTEGER ByteOffset,
2132   IN PLARGE_INTEGER Length,
2133   IN ULONG Key);
2134 
2135 NTSYSCALLAPI
2136 NTSTATUS
2137 NTAPI
2138 NtSetSecurityObject(
2139   IN HANDLE Handle,
2140   IN SECURITY_INFORMATION SecurityInformation,
2141   IN PSECURITY_DESCRIPTOR SecurityDescriptor);
2142 
2143 NTSYSCALLAPI
2144 NTSTATUS
2145 NTAPI
2146 NtQuerySecurityObject(
2147   IN HANDLE Handle,
2148   IN SECURITY_INFORMATION SecurityInformation,
2149   OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
2150   IN ULONG Length,
2151   OUT PULONG LengthNeeded);
2152 
2153 NTSYSCALLAPI
2154 NTSTATUS
2155 NTAPI
2156 NtClose(
2157   IN HANDLE Handle);
2158 
2159 NTSYSCALLAPI
2160 NTSTATUS
2161 NTAPI
2162 NtAllocateVirtualMemory(
2163   IN HANDLE ProcessHandle,
2164   IN OUT PVOID *BaseAddress,
2165   IN ULONG_PTR ZeroBits,
2166   IN OUT PSIZE_T RegionSize,
2167   IN ULONG AllocationType,
2168   IN ULONG Protect);
2169 
2170 NTSYSCALLAPI
2171 NTSTATUS
2172 NTAPI
2173 NtFreeVirtualMemory(
2174   IN HANDLE ProcessHandle,
2175   IN OUT PVOID *BaseAddress,
2176   IN OUT PSIZE_T RegionSize,
2177   IN ULONG FreeType);
2178 
2179 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
2180 
2181 #if (NTDDI_VERSION >= NTDDI_WINXP)
2182 
2183 NTSYSCALLAPI
2184 NTSTATUS
2185 NTAPI
2186 NtOpenThreadTokenEx(
2187   IN HANDLE ThreadHandle,
2188   IN ACCESS_MASK DesiredAccess,
2189   IN BOOLEAN OpenAsSelf,
2190   IN ULONG HandleAttributes,
2191   OUT PHANDLE TokenHandle);
2192 
2193 NTSYSCALLAPI
2194 NTSTATUS
2195 NTAPI
2196 NtOpenProcessTokenEx(
2197   IN HANDLE ProcessHandle,
2198   IN ACCESS_MASK DesiredAccess,
2199   IN ULONG HandleAttributes,
2200   OUT PHANDLE TokenHandle);
2201 
2202 NTSYSAPI
2203 NTSTATUS
2204 NTAPI
2205 NtOpenJobObjectToken(
2206   IN HANDLE JobHandle,
2207   IN ACCESS_MASK DesiredAccess,
2208   OUT PHANDLE TokenHandle);
2209 
2210 NTSYSCALLAPI
2211 NTSTATUS
2212 NTAPI
2213 NtDuplicateToken(
2214   IN HANDLE ExistingTokenHandle,
2215   IN ACCESS_MASK DesiredAccess,
2216   IN POBJECT_ATTRIBUTES ObjectAttributes,
2217   IN BOOLEAN EffectiveOnly,
2218   IN TOKEN_TYPE TokenType,
2219   OUT PHANDLE NewTokenHandle);
2220 
2221 NTSYSCALLAPI
2222 NTSTATUS
2223 NTAPI
2224 NtFilterToken(
2225   IN HANDLE ExistingTokenHandle,
2226   IN ULONG Flags,
2227   IN PTOKEN_GROUPS SidsToDisable OPTIONAL,
2228   IN PTOKEN_PRIVILEGES PrivilegesToDelete OPTIONAL,
2229   IN PTOKEN_GROUPS RestrictedSids OPTIONAL,
2230   OUT PHANDLE NewTokenHandle);
2231 
2232 NTSYSCALLAPI
2233 NTSTATUS
2234 NTAPI
2235 NtImpersonateAnonymousToken(
2236   IN HANDLE ThreadHandle);
2237 
2238 NTSYSCALLAPI
2239 NTSTATUS
2240 NTAPI
2241 NtSetInformationToken(
2242   IN HANDLE TokenHandle,
2243   IN TOKEN_INFORMATION_CLASS TokenInformationClass,
2244   IN PVOID TokenInformation,
2245   IN ULONG TokenInformationLength);
2246 
2247 NTSYSCALLAPI
2248 NTSTATUS
2249 NTAPI
2250 NtAdjustGroupsToken(
2251   IN HANDLE TokenHandle,
2252   IN BOOLEAN ResetToDefault,
2253   IN PTOKEN_GROUPS NewState OPTIONAL,
2254   IN ULONG BufferLength OPTIONAL,
2255   OUT PTOKEN_GROUPS PreviousState,
2256   OUT PULONG ReturnLength);
2257 
2258 NTSYSCALLAPI
2259 NTSTATUS
2260 NTAPI
2261 NtPrivilegeCheck(
2262   IN HANDLE ClientToken,
2263   IN OUT PPRIVILEGE_SET RequiredPrivileges,
2264   OUT PBOOLEAN Result);
2265 
2266 NTSYSCALLAPI
2267 NTSTATUS
2268 NTAPI
2269 NtAccessCheckAndAuditAlarm(
2270   IN PUNICODE_STRING SubsystemName,
2271   IN PVOID HandleId OPTIONAL,
2272   IN PUNICODE_STRING ObjectTypeName,
2273   IN PUNICODE_STRING ObjectName,
2274   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
2275   IN ACCESS_MASK DesiredAccess,
2276   IN PGENERIC_MAPPING GenericMapping,
2277   IN BOOLEAN ObjectCreation,
2278   OUT PACCESS_MASK GrantedAccess,
2279   OUT PNTSTATUS AccessStatus,
2280   OUT PBOOLEAN GenerateOnClose);
2281 
2282 NTSYSCALLAPI
2283 NTSTATUS
2284 NTAPI
2285 NtAccessCheckByTypeAndAuditAlarm(
2286   IN PUNICODE_STRING SubsystemName,
2287   IN PVOID HandleId,
2288   IN PUNICODE_STRING ObjectTypeName,
2289   IN PUNICODE_STRING ObjectName,
2290   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
2291   IN PSID PrincipalSelfSid OPTIONAL,
2292   IN ACCESS_MASK DesiredAccess,
2293   IN AUDIT_EVENT_TYPE AuditType,
2294   IN ULONG Flags,
2295   IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
2296   IN ULONG ObjectTypeLength,
2297   IN PGENERIC_MAPPING GenericMapping,
2298   IN BOOLEAN ObjectCreation,
2299   OUT PACCESS_MASK GrantedAccess,
2300   OUT PNTSTATUS AccessStatus,
2301   OUT PBOOLEAN GenerateOnClose);
2302 
2303 NTSYSCALLAPI
2304 NTSTATUS
2305 NTAPI
2306 NtAccessCheckByTypeResultListAndAuditAlarm(
2307   IN PUNICODE_STRING SubsystemName,
2308   IN PVOID HandleId OPTIONAL,
2309   IN PUNICODE_STRING ObjectTypeName,
2310   IN PUNICODE_STRING ObjectName,
2311   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
2312   IN PSID PrincipalSelfSid OPTIONAL,
2313   IN ACCESS_MASK DesiredAccess,
2314   IN AUDIT_EVENT_TYPE AuditType,
2315   IN ULONG Flags,
2316   IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
2317   IN ULONG ObjectTypeLength,
2318   IN PGENERIC_MAPPING GenericMapping,
2319   IN BOOLEAN ObjectCreation,
2320   OUT PACCESS_MASK GrantedAccess,
2321   OUT PNTSTATUS AccessStatus,
2322   OUT PBOOLEAN GenerateOnClose);
2323 
2324 NTSTATUS
2325 NTAPI
2326 NtAccessCheckByTypeResultListAndAuditAlarmByHandle(
2327   IN PUNICODE_STRING SubsystemName,
2328   IN PVOID HandleId OPTIONAL,
2329   IN HANDLE ClientToken,
2330   IN PUNICODE_STRING ObjectTypeName,
2331   IN PUNICODE_STRING ObjectName,
2332   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
2333   IN PSID PrincipalSelfSid OPTIONAL,
2334   IN ACCESS_MASK DesiredAccess,
2335   IN AUDIT_EVENT_TYPE AuditType,
2336   IN ULONG Flags,
2337   IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
2338   IN ULONG ObjectTypeLength,
2339   IN PGENERIC_MAPPING GenericMapping,
2340   IN BOOLEAN ObjectCreation,
2341   OUT PACCESS_MASK GrantedAccess,
2342   OUT PNTSTATUS AccessStatus,
2343   OUT PBOOLEAN GenerateOnClose);
2344 
2345 NTSYSCALLAPI
2346 NTSTATUS
2347 NTAPI
2348 NtOpenObjectAuditAlarm(
2349   IN PUNICODE_STRING SubsystemName,
2350   IN PVOID HandleId OPTIONAL,
2351   IN PUNICODE_STRING ObjectTypeName,
2352   IN PUNICODE_STRING ObjectName,
2353   IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL,
2354   IN HANDLE ClientToken,
2355   IN ACCESS_MASK DesiredAccess,
2356   IN ACCESS_MASK GrantedAccess,
2357   IN PPRIVILEGE_SET Privileges OPTIONAL,
2358   IN BOOLEAN ObjectCreation,
2359   IN BOOLEAN AccessGranted,
2360   OUT PBOOLEAN GenerateOnClose);
2361 
2362 NTSYSCALLAPI
2363 NTSTATUS
2364 NTAPI
2365 NtPrivilegeObjectAuditAlarm(
2366   IN PUNICODE_STRING SubsystemName,
2367   IN PVOID HandleId OPTIONAL,
2368   IN HANDLE ClientToken,
2369   IN ACCESS_MASK DesiredAccess,
2370   IN PPRIVILEGE_SET Privileges,
2371   IN BOOLEAN AccessGranted);
2372 
2373 NTSYSCALLAPI
2374 NTSTATUS
2375 NTAPI
2376 NtCloseObjectAuditAlarm(
2377   IN PUNICODE_STRING SubsystemName,
2378   IN PVOID HandleId OPTIONAL,
2379   IN BOOLEAN GenerateOnClose);
2380 
2381 NTSYSCALLAPI
2382 NTSTATUS
2383 NTAPI
2384 NtDeleteObjectAuditAlarm(
2385   IN PUNICODE_STRING SubsystemName,
2386   IN PVOID HandleId OPTIONAL,
2387   IN BOOLEAN GenerateOnClose);
2388 
2389 NTSYSCALLAPI
2390 NTSTATUS
2391 NTAPI
2392 NtPrivilegedServiceAuditAlarm(
2393   IN PUNICODE_STRING SubsystemName,
2394   IN PUNICODE_STRING ServiceName,
2395   IN HANDLE ClientToken,
2396   IN PPRIVILEGE_SET Privileges,
2397   IN BOOLEAN AccessGranted);
2398 
2399 NTSYSCALLAPI
2400 NTSTATUS
2401 NTAPI
2402 NtSetInformationThread(
2403   IN HANDLE ThreadHandle,
2404   IN THREADINFOCLASS ThreadInformationClass,
2405   IN PVOID ThreadInformation,
2406   IN ULONG ThreadInformationLength);
2407 
2408 NTSYSCALLAPI
2409 NTSTATUS
2410 NTAPI
2411 NtCreateSection(
2412   OUT PHANDLE SectionHandle,
2413   IN ACCESS_MASK DesiredAccess,
2414   IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
2415   IN PLARGE_INTEGER MaximumSize OPTIONAL,
2416   IN ULONG SectionPageProtection,
2417   IN ULONG AllocationAttributes,
2418   IN HANDLE FileHandle OPTIONAL);
2419 
2420 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
2421 
2422 #define COMPRESSION_FORMAT_NONE         (0x0000)
2423 #define COMPRESSION_FORMAT_DEFAULT      (0x0001)
2424 #define COMPRESSION_FORMAT_LZNT1        (0x0002)
2425 #define COMPRESSION_ENGINE_STANDARD     (0x0000)
2426 #define COMPRESSION_ENGINE_MAXIMUM      (0x0100)
2427 #define COMPRESSION_ENGINE_HIBER        (0x0200)
2428 
2429 #define MAX_UNICODE_STACK_BUFFER_LENGTH 256
2430 
2431 #define METHOD_FROM_CTL_CODE(ctrlCode)  ((ULONG)(ctrlCode & 3))
2432 
2433 #define METHOD_DIRECT_TO_HARDWARE       METHOD_IN_DIRECT
2434 #define METHOD_DIRECT_FROM_HARDWARE     METHOD_OUT_DIRECT
2435 
2436 typedef ULONG LSA_OPERATIONAL_MODE, *PLSA_OPERATIONAL_MODE;
2437 
2438 typedef enum _SECURITY_LOGON_TYPE {
2439   UndefinedLogonType = 0,
2440   Interactive = 2,
2441   Network,
2442   Batch,
2443   Service,
2444   Proxy,
2445   Unlock,
2446   NetworkCleartext,
2447   NewCredentials,
2448 #if (_WIN32_WINNT >= 0x0501)
2449   RemoteInteractive,
2450   CachedInteractive,
2451 #endif
2452 #if (_WIN32_WINNT >= 0x0502)
2453   CachedRemoteInteractive,
2454   CachedUnlock
2455 #endif
2456 } SECURITY_LOGON_TYPE, *PSECURITY_LOGON_TYPE;
2457 
2458 #ifndef _NTLSA_AUDIT_
2459 #define _NTLSA_AUDIT_
2460 
2461 #ifndef GUID_DEFINED
2462 #include <guiddef.h>
2463 #endif
2464 
2465 #endif /* _NTLSA_AUDIT_ */
2466 
2467 NTSTATUS
2468 NTAPI
2469 LsaRegisterLogonProcess(
2470   IN PLSA_STRING LogonProcessName,
2471   OUT PHANDLE LsaHandle,
2472   OUT PLSA_OPERATIONAL_MODE SecurityMode);
2473 
2474 NTSTATUS
2475 NTAPI
2476 LsaLogonUser(
2477   IN HANDLE LsaHandle,
2478   IN PLSA_STRING OriginName,
2479   IN SECURITY_LOGON_TYPE LogonType,
2480   IN ULONG AuthenticationPackage,
2481   IN PVOID AuthenticationInformation,
2482   IN ULONG AuthenticationInformationLength,
2483   IN PTOKEN_GROUPS LocalGroups OPTIONAL,
2484   IN PTOKEN_SOURCE SourceContext,
2485   OUT PVOID *ProfileBuffer,
2486   OUT PULONG ProfileBufferLength,
2487   OUT PLUID LogonId,
2488   OUT PHANDLE Token,
2489   OUT PQUOTA_LIMITS Quotas,
2490   OUT PNTSTATUS SubStatus);
2491 
2492 NTSTATUS
2493 NTAPI
2494 LsaFreeReturnBuffer(
2495   IN PVOID Buffer);
2496 
2497 #ifndef _NTLSA_IFS_
2498 #define _NTLSA_IFS_
2499 #endif
2500 
2501 #define MSV1_0_PACKAGE_NAME     "MICROSOFT_AUTHENTICATION_PACKAGE_V1_0"
2502 #define MSV1_0_PACKAGE_NAMEW    L"MICROSOFT_AUTHENTICATION_PACKAGE_V1_0"
2503 #define MSV1_0_PACKAGE_NAMEW_LENGTH sizeof(MSV1_0_PACKAGE_NAMEW) - sizeof(WCHAR)
2504 
2505 #define MSV1_0_SUBAUTHENTICATION_KEY "SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0"
2506 #define MSV1_0_SUBAUTHENTICATION_VALUE "Auth"
2507 
2508 #define MSV1_0_CHALLENGE_LENGTH                8
2509 #define MSV1_0_USER_SESSION_KEY_LENGTH         16
2510 #define MSV1_0_LANMAN_SESSION_KEY_LENGTH       8
2511 
2512 #define MSV1_0_CLEARTEXT_PASSWORD_ALLOWED      0x02
2513 #define MSV1_0_UPDATE_LOGON_STATISTICS         0x04
2514 #define MSV1_0_RETURN_USER_PARAMETERS          0x08
2515 #define MSV1_0_DONT_TRY_GUEST_ACCOUNT          0x10
2516 #define MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT      0x20
2517 #define MSV1_0_RETURN_PASSWORD_EXPIRY          0x40
2518 #define MSV1_0_USE_CLIENT_CHALLENGE            0x80
2519 #define MSV1_0_TRY_GUEST_ACCOUNT_ONLY          0x100
2520 #define MSV1_0_RETURN_PROFILE_PATH             0x200
2521 #define MSV1_0_TRY_SPECIFIED_DOMAIN_ONLY       0x400
2522 #define MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT 0x800
2523 
2524 #define MSV1_0_DISABLE_PERSONAL_FALLBACK     0x00001000
2525 #define MSV1_0_ALLOW_FORCE_GUEST             0x00002000
2526 
2527 #if (_WIN32_WINNT >= 0x0502)
2528 #define MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED   0x00004000
2529 #define MSV1_0_USE_DOMAIN_FOR_ROUTING_ONLY   0x00008000
2530 #endif
2531 
2532 #define MSV1_0_SUBAUTHENTICATION_DLL_EX      0x00100000
2533 #define MSV1_0_ALLOW_MSVCHAPV2               0x00010000
2534 
2535 #if (_WIN32_WINNT >= 0x0600)
2536 #define MSV1_0_S4U2SELF                      0x00020000
2537 #define MSV1_0_CHECK_LOGONHOURS_FOR_S4U      0x00040000
2538 #endif
2539 
2540 #define MSV1_0_SUBAUTHENTICATION_DLL         0xFF000000
2541 #define MSV1_0_SUBAUTHENTICATION_DLL_SHIFT   24
2542 #define MSV1_0_MNS_LOGON                     0x01000000
2543 
2544 #define MSV1_0_SUBAUTHENTICATION_DLL_RAS     2
2545 #define MSV1_0_SUBAUTHENTICATION_DLL_IIS     132
2546 
2547 #define LOGON_GUEST                 0x01
2548 #define LOGON_NOENCRYPTION          0x02
2549 #define LOGON_CACHED_ACCOUNT        0x04
2550 #define LOGON_USED_LM_PASSWORD      0x08
2551 #define LOGON_EXTRA_SIDS            0x20
2552 #define LOGON_SUBAUTH_SESSION_KEY   0x40
2553 #define LOGON_SERVER_TRUST_ACCOUNT  0x80
2554 #define LOGON_NTLMV2_ENABLED        0x100
2555 #define LOGON_RESOURCE_GROUPS       0x200
2556 #define LOGON_PROFILE_PATH_RETURNED 0x400
2557 #define LOGON_NT_V2                 0x800
2558 #define LOGON_LM_V2                 0x1000
2559 #define LOGON_NTLM_V2               0x2000
2560 
2561 #if (_WIN32_WINNT >= 0x0600)
2562 
2563 #define LOGON_OPTIMIZED             0x4000
2564 #define LOGON_WINLOGON              0x8000
2565 #define LOGON_PKINIT               0x10000
2566 #define LOGON_NO_OPTIMIZED         0x20000
2567 
2568 #endif
2569 
2570 #define MSV1_0_SUBAUTHENTICATION_FLAGS 0xFF000000
2571 
2572 #define LOGON_GRACE_LOGON              0x01000000
2573 
2574 #define MSV1_0_OWF_PASSWORD_LENGTH 16
2575 #define MSV1_0_CRED_LM_PRESENT 0x1
2576 #define MSV1_0_CRED_NT_PRESENT 0x2
2577 #define MSV1_0_CRED_VERSION 0
2578 
2579 #define MSV1_0_NTLM3_RESPONSE_LENGTH 16
2580 #define MSV1_0_NTLM3_OWF_LENGTH 16
2581 
2582 #if (_WIN32_WINNT == 0x0500)
2583 #define MSV1_0_MAX_NTLM3_LIFE 1800
2584 #else
2585 #define MSV1_0_MAX_NTLM3_LIFE 129600
2586 #endif
2587 #define MSV1_0_MAX_AVL_SIZE 64000
2588 
2589 #if (_WIN32_WINNT >= 0x0501)
2590 
2591 #define MSV1_0_AV_FLAG_FORCE_GUEST                  0x00000001
2592 
2593 #if (_WIN32_WINNT >= 0x0600)
2594 #define MSV1_0_AV_FLAG_MIC_HANDSHAKE_MESSAGES       0x00000002
2595 #endif
2596 
2597 #endif
2598 
2599 #define MSV1_0_NTLM3_INPUT_LENGTH (sizeof(MSV1_0_NTLM3_RESPONSE) - MSV1_0_NTLM3_RESPONSE_LENGTH)
2600 
2601 #if(_WIN32_WINNT >= 0x0502)
2602 #define MSV1_0_NTLM3_MIN_NT_RESPONSE_LENGTH RTL_SIZEOF_THROUGH_FIELD(MSV1_0_NTLM3_RESPONSE, AvPairsOff)
2603 #endif
2604 
2605 #define USE_PRIMARY_PASSWORD            0x01
2606 #define RETURN_PRIMARY_USERNAME         0x02
2607 #define RETURN_PRIMARY_LOGON_DOMAINNAME 0x04
2608 #define RETURN_NON_NT_USER_SESSION_KEY  0x08
2609 #define GENERATE_CLIENT_CHALLENGE       0x10
2610 #define GCR_NTLM3_PARMS                 0x20
2611 #define GCR_TARGET_INFO                 0x40
2612 #define RETURN_RESERVED_PARAMETER       0x80
2613 #define GCR_ALLOW_NTLM                 0x100
2614 #define GCR_USE_OEM_SET                0x200
2615 #define GCR_MACHINE_CREDENTIAL         0x400
2616 #define GCR_USE_OWF_PASSWORD           0x800
2617 #define GCR_ALLOW_LM                  0x1000
2618 #define GCR_ALLOW_NO_TARGET           0x2000
2619 
2620 typedef enum _MSV1_0_LOGON_SUBMIT_TYPE {
2621   MsV1_0InteractiveLogon = 2,
2622   MsV1_0Lm20Logon,
2623   MsV1_0NetworkLogon,
2624   MsV1_0SubAuthLogon,
2625   MsV1_0WorkstationUnlockLogon = 7,
2626   MsV1_0S4ULogon = 12,
2627   MsV1_0VirtualLogon = 82
2628 } MSV1_0_LOGON_SUBMIT_TYPE, *PMSV1_0_LOGON_SUBMIT_TYPE;
2629 
2630 typedef enum _MSV1_0_PROFILE_BUFFER_TYPE {
2631   MsV1_0InteractiveProfile = 2,
2632   MsV1_0Lm20LogonProfile,
2633   MsV1_0SmartCardProfile
2634 } MSV1_0_PROFILE_BUFFER_TYPE, *PMSV1_0_PROFILE_BUFFER_TYPE;
2635 
2636 typedef struct _MSV1_0_INTERACTIVE_LOGON {
2637   MSV1_0_LOGON_SUBMIT_TYPE MessageType;
2638   UNICODE_STRING LogonDomainName;
2639   UNICODE_STRING UserName;
2640   UNICODE_STRING Password;
2641 } MSV1_0_INTERACTIVE_LOGON, *PMSV1_0_INTERACTIVE_LOGON;
2642 
2643 typedef struct _MSV1_0_INTERACTIVE_PROFILE {
2644   MSV1_0_PROFILE_BUFFER_TYPE MessageType;
2645   USHORT LogonCount;
2646   USHORT BadPasswordCount;
2647   LARGE_INTEGER LogonTime;
2648   LARGE_INTEGER LogoffTime;
2649   LARGE_INTEGER KickOffTime;
2650   LARGE_INTEGER PasswordLastSet;
2651   LARGE_INTEGER PasswordCanChange;
2652   LARGE_INTEGER PasswordMustChange;
2653   UNICODE_STRING LogonScript;
2654   UNICODE_STRING HomeDirectory;
2655   UNICODE_STRING FullName;
2656   UNICODE_STRING ProfilePath;
2657   UNICODE_STRING HomeDirectoryDrive;
2658   UNICODE_STRING LogonServer;
2659   ULONG UserFlags;
2660 } MSV1_0_INTERACTIVE_PROFILE, *PMSV1_0_INTERACTIVE_PROFILE;
2661 
2662 typedef struct _MSV1_0_LM20_LOGON {
2663   MSV1_0_LOGON_SUBMIT_TYPE MessageType;
2664   UNICODE_STRING LogonDomainName;
2665   UNICODE_STRING UserName;
2666   UNICODE_STRING Workstation;
2667   UCHAR ChallengeToClient[MSV1_0_CHALLENGE_LENGTH];
2668   STRING CaseSensitiveChallengeResponse;
2669   STRING CaseInsensitiveChallengeResponse;
2670   ULONG ParameterControl;
2671 } MSV1_0_LM20_LOGON, * PMSV1_0_LM20_LOGON;
2672 
2673 typedef struct _MSV1_0_SUBAUTH_LOGON {
2674   MSV1_0_LOGON_SUBMIT_TYPE MessageType;
2675   UNICODE_STRING LogonDomainName;
2676   UNICODE_STRING UserName;
2677   UNICODE_STRING Workstation;
2678   UCHAR ChallengeToClient[MSV1_0_CHALLENGE_LENGTH];
2679   STRING AuthenticationInfo1;
2680   STRING AuthenticationInfo2;
2681   ULONG ParameterControl;
2682   ULONG SubAuthPackageId;
2683 } MSV1_0_SUBAUTH_LOGON, * PMSV1_0_SUBAUTH_LOGON;
2684 
2685 #if (_WIN32_WINNT >= 0x0600)
2686 
2687 #define MSV1_0_S4U_LOGON_FLAG_CHECK_LOGONHOURS 0x2
2688 
2689 typedef struct _MSV1_0_S4U_LOGON {
2690   MSV1_0_LOGON_SUBMIT_TYPE MessageType;
2691   ULONG Flags;
2692   UNICODE_STRING UserPrincipalName;
2693   UNICODE_STRING DomainName;
2694 } MSV1_0_S4U_LOGON, *PMSV1_0_S4U_LOGON;
2695 
2696 #endif
2697 
2698 typedef struct _MSV1_0_LM20_LOGON_PROFILE {
2699   MSV1_0_PROFILE_BUFFER_TYPE MessageType;
2700   LARGE_INTEGER KickOffTime;
2701   LARGE_INTEGER LogoffTime;
2702   ULONG UserFlags;
2703   UCHAR UserSessionKey[MSV1_0_USER_SESSION_KEY_LENGTH];
2704   UNICODE_STRING LogonDomainName;
2705   UCHAR LanmanSessionKey[MSV1_0_LANMAN_SESSION_KEY_LENGTH];
2706   UNICODE_STRING LogonServer;
2707   UNICODE_STRING UserParameters;
2708 } MSV1_0_LM20_LOGON_PROFILE, * PMSV1_0_LM20_LOGON_PROFILE;
2709 
2710 typedef struct _MSV1_0_SUPPLEMENTAL_CREDENTIAL {
2711   ULONG Version;
2712   ULONG Flags;
2713   UCHAR LmPassword[MSV1_0_OWF_PASSWORD_LENGTH];
2714   UCHAR NtPassword[MSV1_0_OWF_PASSWORD_LENGTH];
2715 } MSV1_0_SUPPLEMENTAL_CREDENTIAL, *PMSV1_0_SUPPLEMENTAL_CREDENTIAL;
2716 
2717 typedef struct _MSV1_0_NTLM3_RESPONSE {
2718   UCHAR Response[MSV1_0_NTLM3_RESPONSE_LENGTH];
2719   UCHAR RespType;
2720   UCHAR HiRespType;
2721   USHORT Flags;
2722   ULONG MsgWord;
2723   ULONGLONG TimeStamp;
2724   UCHAR ChallengeFromClient[MSV1_0_CHALLENGE_LENGTH];
2725   ULONG AvPairsOff;
2726   UCHAR Buffer[1];
2727 } MSV1_0_NTLM3_RESPONSE, *PMSV1_0_NTLM3_RESPONSE;
2728 
2729 typedef enum _MSV1_0_AVID {
2730   MsvAvEOL,
2731   MsvAvNbComputerName,
2732   MsvAvNbDomainName,
2733   MsvAvDnsComputerName,
2734   MsvAvDnsDomainName,
2735 #if (_WIN32_WINNT >= 0x0501)
2736   MsvAvDnsTreeName,
2737   MsvAvFlags,
2738 #if (_WIN32_WINNT >= 0x0600)
2739   MsvAvTimestamp,
2740   MsvAvRestrictions,
2741   MsvAvTargetName,
2742   MsvAvChannelBindings,
2743 #endif
2744 #endif
2745 } MSV1_0_AVID;
2746 
2747 typedef struct _MSV1_0_AV_PAIR {
2748   USHORT AvId;
2749   USHORT AvLen;
2750 } MSV1_0_AV_PAIR, *PMSV1_0_AV_PAIR;
2751 
2752 typedef enum _MSV1_0_PROTOCOL_MESSAGE_TYPE {
2753   MsV1_0Lm20ChallengeRequest = 0,
2754   MsV1_0Lm20GetChallengeResponse,
2755   MsV1_0EnumerateUsers,
2756   MsV1_0GetUserInfo,
2757   MsV1_0ReLogonUsers,
2758   MsV1_0ChangePassword,
2759   MsV1_0ChangeCachedPassword,
2760   MsV1_0GenericPassthrough,
2761   MsV1_0CacheLogon,
2762   MsV1_0SubAuth,
2763   MsV1_0DeriveCredential,
2764   MsV1_0CacheLookup,
2765 #if (_WIN32_WINNT >= 0x0501)
2766   MsV1_0SetProcessOption,
2767 #endif
2768 #if (_WIN32_WINNT >= 0x0600)
2769   MsV1_0ConfigLocalAliases,
2770   MsV1_0ClearCachedCredentials,
2771 #endif
2772 } MSV1_0_PROTOCOL_MESSAGE_TYPE, *PMSV1_0_PROTOCOL_MESSAGE_TYPE;
2773 
2774 typedef struct _MSV1_0_LM20_CHALLENGE_REQUEST {
2775   MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType;
2776 } MSV1_0_LM20_CHALLENGE_REQUEST, *PMSV1_0_LM20_CHALLENGE_REQUEST;
2777 
2778 typedef struct _MSV1_0_LM20_CHALLENGE_RESPONSE {
2779   MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType;
2780   UCHAR ChallengeToClient[MSV1_0_CHALLENGE_LENGTH];
2781 } MSV1_0_LM20_CHALLENGE_RESPONSE, *PMSV1_0_LM20_CHALLENGE_RESPONSE;
2782 
2783 typedef struct _MSV1_0_GETCHALLENRESP_REQUEST_V1 {
2784   MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType;
2785   ULONG ParameterControl;
2786   LUID LogonId;
2787   UNICODE_STRING Password;
2788   UCHAR ChallengeToClient[MSV1_0_CHALLENGE_LENGTH];
2789 } MSV1_0_GETCHALLENRESP_REQUEST_V1, *PMSV1_0_GETCHALLENRESP_REQUEST_V1;
2790 
2791 typedef struct _MSV1_0_GETCHALLENRESP_REQUEST {
2792   MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType;
2793   ULONG ParameterControl;
2794   LUID LogonId;
2795   UNICODE_STRING Password;
2796   UCHAR ChallengeToClient[MSV1_0_CHALLENGE_LENGTH];
2797   UNICODE_STRING UserName;
2798   UNICODE_STRING LogonDomainName;
2799   UNICODE_STRING ServerName;
2800 } MSV1_0_GETCHALLENRESP_REQUEST, *PMSV1_0_GETCHALLENRESP_REQUEST;
2801 
2802 typedef struct _MSV1_0_GETCHALLENRESP_RESPONSE {
2803   MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType;
2804   STRING CaseSensitiveChallengeResponse;
2805   STRING CaseInsensitiveChallengeResponse;
2806   UNICODE_STRING UserName;
2807   UNICODE_STRING LogonDomainName;
2808   UCHAR UserSessionKey[MSV1_0_USER_SESSION_KEY_LENGTH];
2809   UCHAR LanmanSessionKey[MSV1_0_LANMAN_SESSION_KEY_LENGTH];
2810 } MSV1_0_GETCHALLENRESP_RESPONSE, *PMSV1_0_GETCHALLENRESP_RESPONSE;
2811 
2812 typedef struct _MSV1_0_ENUMUSERS_REQUEST {
2813   MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType;
2814 } MSV1_0_ENUMUSERS_REQUEST, *PMSV1_0_ENUMUSERS_REQUEST;
2815 
2816 typedef struct _MSV1_0_ENUMUSERS_RESPONSE {
2817   MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType;
2818   ULONG NumberOfLoggedOnUsers;
2819   PLUID LogonIds;
2820   PULONG EnumHandles;
2821 } MSV1_0_ENUMUSERS_RESPONSE, *PMSV1_0_ENUMUSERS_RESPONSE;
2822 
2823 typedef struct _MSV1_0_GETUSERINFO_REQUEST {
2824   MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType;
2825   LUID LogonId;
2826 } MSV1_0_GETUSERINFO_REQUEST, *PMSV1_0_GETUSERINFO_REQUEST;
2827 
2828 typedef struct _MSV1_0_GETUSERINFO_RESPONSE {
2829   MSV1_0_PROTOCOL_MESSAGE_TYPE MessageType;
2830   PSID UserSid;
2831   UNICODE_STRING UserName;
2832   UNICODE_STRING LogonDomainName;
2833   UNICODE_STRING LogonServer;
2834   SECURITY_LOGON_TYPE LogonType;
2835 } MSV1_0_GETUSERINFO_RESPONSE, *PMSV1_0_GETUSERINFO_RESPONSE;
2836 
2837 
2838 
2839 #define FILE_OPLOCK_BROKEN_TO_LEVEL_2   0x00000007
2840 #define FILE_OPLOCK_BROKEN_TO_NONE      0x00000008
2841 #define FILE_OPBATCH_BREAK_UNDERWAY     0x00000009
2842 
2843 /* also in winnt.h */
2844 #define FILE_NOTIFY_CHANGE_FILE_NAME    0x00000001
2845 #define FILE_NOTIFY_CHANGE_DIR_NAME     0x00000002
2846 #define FILE_NOTIFY_CHANGE_NAME         0x00000003
2847 #define FILE_NOTIFY_CHANGE_ATTRIBUTES   0x00000004
2848 #define FILE_NOTIFY_CHANGE_SIZE         0x00000008
2849 #define FILE_NOTIFY_CHANGE_LAST_WRITE   0x00000010
2850 #define FILE_NOTIFY_CHANGE_LAST_ACCESS  0x00000020
2851 #define FILE_NOTIFY_CHANGE_CREATION     0x00000040
2852 #define FILE_NOTIFY_CHANGE_EA           0x00000080
2853 #define FILE_NOTIFY_CHANGE_SECURITY     0x00000100
2854 #define FILE_NOTIFY_CHANGE_STREAM_NAME  0x00000200
2855 #define FILE_NOTIFY_CHANGE_STREAM_SIZE  0x00000400
2856 #define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
2857 #define FILE_NOTIFY_VALID_MASK          0x00000fff
2858 
2859 #define FILE_ACTION_ADDED                   0x00000001
2860 #define FILE_ACTION_REMOVED                 0x00000002
2861 #define FILE_ACTION_MODIFIED                0x00000003
2862 #define FILE_ACTION_RENAMED_OLD_NAME        0x00000004
2863 #define FILE_ACTION_RENAMED_NEW_NAME        0x00000005
2864 #define FILE_ACTION_ADDED_STREAM            0x00000006
2865 #define FILE_ACTION_REMOVED_STREAM          0x00000007
2866 #define FILE_ACTION_MODIFIED_STREAM         0x00000008
2867 #define FILE_ACTION_REMOVED_BY_DELETE       0x00000009
2868 #define FILE_ACTION_ID_NOT_TUNNELLED        0x0000000A
2869 #define FILE_ACTION_TUNNELLED_ID_COLLISION  0x0000000B
2870 /* end  winnt.h */
2871 
2872 #define FILE_PIPE_BYTE_STREAM_TYPE          0x00000000
2873 #define FILE_PIPE_MESSAGE_TYPE              0x00000001
2874 
2875 #define FILE_PIPE_ACCEPT_REMOTE_CLIENTS     0x00000000
2876 #define FILE_PIPE_REJECT_REMOTE_CLIENTS     0x00000002
2877 
2878 #define FILE_PIPE_TYPE_VALID_MASK           0x00000003
2879 
2880 #define FILE_PIPE_BYTE_STREAM_MODE          0x00000000
2881 #define FILE_PIPE_MESSAGE_MODE              0x00000001
2882 
2883 #define FILE_PIPE_QUEUE_OPERATION           0x00000000
2884 #define FILE_PIPE_COMPLETE_OPERATION        0x00000001
2885 
2886 #define FILE_PIPE_INBOUND                   0x00000000
2887 #define FILE_PIPE_OUTBOUND                  0x00000001
2888 #define FILE_PIPE_FULL_DUPLEX               0x00000002
2889 
2890 #define FILE_PIPE_DISCONNECTED_STATE        0x00000001
2891 #define FILE_PIPE_LISTENING_STATE           0x00000002
2892 #define FILE_PIPE_CONNECTED_STATE           0x00000003
2893 #define FILE_PIPE_CLOSING_STATE             0x00000004
2894 
2895 #define FILE_PIPE_CLIENT_END                0x00000000
2896 #define FILE_PIPE_SERVER_END                0x00000001
2897 
2898 #define FILE_CASE_SENSITIVE_SEARCH          0x00000001
2899 #define FILE_CASE_PRESERVED_NAMES           0x00000002
2900 #define FILE_UNICODE_ON_DISK                0x00000004
2901 #define FILE_PERSISTENT_ACLS                0x00000008
2902 #define FILE_FILE_COMPRESSION               0x00000010
2903 #define FILE_VOLUME_QUOTAS                  0x00000020
2904 #define FILE_SUPPORTS_SPARSE_FILES          0x00000040
2905 #define FILE_SUPPORTS_REPARSE_POINTS        0x00000080
2906 #define FILE_SUPPORTS_REMOTE_STORAGE        0x00000100
2907 #define FILE_VOLUME_IS_COMPRESSED           0x00008000
2908 #define FILE_SUPPORTS_OBJECT_IDS            0x00010000
2909 #define FILE_SUPPORTS_ENCRYPTION            0x00020000
2910 #define FILE_NAMED_STREAMS                  0x00040000
2911 #define FILE_READ_ONLY_VOLUME               0x00080000
2912 #define FILE_SEQUENTIAL_WRITE_ONCE          0x00100000
2913 #define FILE_SUPPORTS_TRANSACTIONS          0x00200000
2914 #define FILE_SUPPORTS_HARD_LINKS            0x00400000
2915 #define FILE_SUPPORTS_EXTENDED_ATTRIBUTES   0x00800000
2916 #define FILE_SUPPORTS_OPEN_BY_FILE_ID       0x01000000
2917 #define FILE_SUPPORTS_USN_JOURNAL           0x02000000
2918 
2919 #define FILE_NEED_EA                    0x00000080
2920 
2921 #define FILE_EA_TYPE_BINARY             0xfffe
2922 #define FILE_EA_TYPE_ASCII              0xfffd
2923 #define FILE_EA_TYPE_BITMAP             0xfffb
2924 #define FILE_EA_TYPE_METAFILE           0xfffa
2925 #define FILE_EA_TYPE_ICON               0xfff9
2926 #define FILE_EA_TYPE_EA                 0xffee
2927 #define FILE_EA_TYPE_MVMT               0xffdf
2928 #define FILE_EA_TYPE_MVST               0xffde
2929 #define FILE_EA_TYPE_ASN1               0xffdd
2930 #define FILE_EA_TYPE_FAMILY_IDS         0xff01
2931 
2932 typedef struct _FILE_NOTIFY_INFORMATION {
2933   ULONG NextEntryOffset;
2934   ULONG Action;
2935   ULONG FileNameLength;
2936   WCHAR FileName[1];
2937 } FILE_NOTIFY_INFORMATION, *PFILE_NOTIFY_INFORMATION;
2938 
2939 typedef struct _FILE_DIRECTORY_INFORMATION {
2940   ULONG NextEntryOffset;
2941   ULONG FileIndex;
2942   LARGE_INTEGER CreationTime;
2943   LARGE_INTEGER LastAccessTime;
2944   LARGE_INTEGER LastWriteTime;
2945   LARGE_INTEGER ChangeTime;
2946   LARGE_INTEGER EndOfFile;
2947   LARGE_INTEGER AllocationSize;
2948   ULONG FileAttributes;
2949   ULONG FileNameLength;
2950   WCHAR FileName[1];
2951 } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
2952 
2953 typedef struct _FILE_FULL_DIR_INFORMATION {
2954   ULONG NextEntryOffset;
2955   ULONG FileIndex;
2956   LARGE_INTEGER CreationTime;
2957   LARGE_INTEGER LastAccessTime;
2958   LARGE_INTEGER LastWriteTime;
2959   LARGE_INTEGER ChangeTime;
2960   LARGE_INTEGER EndOfFile;
2961   LARGE_INTEGER AllocationSize;
2962   ULONG FileAttributes;
2963   ULONG FileNameLength;
2964   ULONG EaSize;
2965   WCHAR FileName[1];
2966 } FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
2967 
2968 typedef struct _FILE_ID_FULL_DIR_INFORMATION {
2969   ULONG NextEntryOffset;
2970   ULONG FileIndex;
2971   LARGE_INTEGER CreationTime;
2972   LARGE_INTEGER LastAccessTime;
2973   LARGE_INTEGER LastWriteTime;
2974   LARGE_INTEGER ChangeTime;
2975   LARGE_INTEGER EndOfFile;
2976   LARGE_INTEGER AllocationSize;
2977   ULONG FileAttributes;
2978   ULONG FileNameLength;
2979   ULONG EaSize;
2980   LARGE_INTEGER FileId;
2981   WCHAR FileName[1];
2982 } FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION;
2983 
2984 typedef struct _FILE_BOTH_DIR_INFORMATION {
2985   ULONG NextEntryOffset;
2986   ULONG FileIndex;
2987   LARGE_INTEGER CreationTime;
2988   LARGE_INTEGER LastAccessTime;
2989   LARGE_INTEGER LastWriteTime;
2990   LARGE_INTEGER ChangeTime;
2991   LARGE_INTEGER EndOfFile;
2992   LARGE_INTEGER AllocationSize;
2993   ULONG FileAttributes;
2994   ULONG FileNameLength;
2995   ULONG EaSize;
2996   CCHAR ShortNameLength;
2997   WCHAR ShortName[12];
2998   WCHAR FileName[1];
2999 } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
3000 
3001 typedef struct _FILE_ID_BOTH_DIR_INFORMATION {
3002   ULONG NextEntryOffset;
3003   ULONG FileIndex;
3004   LARGE_INTEGER CreationTime;
3005   LARGE_INTEGER LastAccessTime;
3006   LARGE_INTEGER LastWriteTime;
3007   LARGE_INTEGER ChangeTime;
3008   LARGE_INTEGER EndOfFile;
3009   LARGE_INTEGER AllocationSize;
3010   ULONG FileAttributes;
3011   ULONG FileNameLength;
3012   ULONG EaSize;
3013   CCHAR ShortNameLength;
3014   WCHAR ShortName[12];
3015   LARGE_INTEGER FileId;
3016   WCHAR FileName[1];
3017 } FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;
3018 
3019 typedef struct _FILE_NAMES_INFORMATION {
3020   ULONG NextEntryOffset;
3021   ULONG FileIndex;
3022   ULONG FileNameLength;
3023   WCHAR FileName[1];
3024 } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
3025 
3026 typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION {
3027   ULONG NextEntryOffset;
3028   ULONG FileIndex;
3029   LARGE_INTEGER CreationTime;
3030   LARGE_INTEGER LastAccessTime;
3031   LARGE_INTEGER LastWriteTime;
3032   LARGE_INTEGER ChangeTime;
3033   LARGE_INTEGER EndOfFile;
3034   LARGE_INTEGER AllocationSize;
3035   ULONG FileAttributes;
3036   ULONG FileNameLength;
3037   LARGE_INTEGER FileId;
3038   GUID LockingTransactionId;
3039   ULONG TxInfoFlags;
3040   WCHAR FileName[1];
3041 } FILE_ID_GLOBAL_TX_DIR_INFORMATION, *PFILE_ID_GLOBAL_TX_DIR_INFORMATION;
3042 
3043 #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_WRITELOCKED         0x00000001
3044 #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_TO_TX       0x00000002
3045 #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_OUTSIDE_TX  0x00000004
3046 
3047 typedef struct _FILE_OBJECTID_INFORMATION {
3048   LONGLONG FileReference;
3049   UCHAR ObjectId[16];
3050   _ANONYMOUS_UNION union {
3051     _ANONYMOUS_STRUCT struct {
3052       UCHAR BirthVolumeId[16];
3053       UCHAR BirthObjectId[16];
3054       UCHAR DomainId[16];
3055     } DUMMYSTRUCTNAME;
3056     UCHAR ExtendedInfo[48];
3057   } DUMMYUNIONNAME;
3058 } FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION;
3059 
3060 #define ANSI_DOS_STAR                   ('<')
3061 #define ANSI_DOS_QM                     ('>')
3062 #define ANSI_DOS_DOT                    ('"')
3063 
3064 #define DOS_STAR                        (L'<')
3065 #define DOS_QM                          (L'>')
3066 #define DOS_DOT                         (L'"')
3067 
3068 typedef struct _FILE_INTERNAL_INFORMATION {
3069   LARGE_INTEGER IndexNumber;
3070 } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
3071 
3072 typedef struct _FILE_EA_INFORMATION {
3073   ULONG EaSize;
3074 } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
3075 
3076 typedef struct _FILE_ACCESS_INFORMATION {
3077   ACCESS_MASK AccessFlags;
3078 } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
3079 
3080 typedef struct _FILE_MODE_INFORMATION {
3081   ULONG Mode;
3082 } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
3083 
3084 typedef struct _FILE_ALL_INFORMATION {
3085   FILE_BASIC_INFORMATION BasicInformation;
3086   FILE_STANDARD_INFORMATION StandardInformation;
3087   FILE_INTERNAL_INFORMATION InternalInformation;
3088   FILE_EA_INFORMATION EaInformation;
3089   FILE_ACCESS_INFORMATION AccessInformation;
3090   FILE_POSITION_INFORMATION PositionInformation;
3091   FILE_MODE_INFORMATION ModeInformation;
3092   FILE_ALIGNMENT_INFORMATION AlignmentInformation;
3093   FILE_NAME_INFORMATION NameInformation;
3094 } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
3095 
3096 typedef struct _FILE_ALLOCATION_INFORMATION {
3097   LARGE_INTEGER AllocationSize;
3098 } FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;
3099 
3100 typedef struct _FILE_COMPRESSION_INFORMATION {
3101   LARGE_INTEGER CompressedFileSize;
3102   USHORT CompressionFormat;
3103   UCHAR CompressionUnitShift;
3104   UCHAR ChunkShift;
3105   UCHAR ClusterShift;
3106   UCHAR Reserved[3];
3107 } FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
3108 
3109 typedef struct _FILE_LINK_INFORMATION {
3110   BOOLEAN ReplaceIfExists;
3111   HANDLE RootDirectory;
3112   ULONG FileNameLength;
3113   WCHAR FileName[1];
3114 } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
3115 
3116 typedef struct _FILE_MOVE_CLUSTER_INFORMATION {
3117   ULONG ClusterCount;
3118   HANDLE RootDirectory;
3119   ULONG FileNameLength;
3120   WCHAR FileName[1];
3121 } FILE_MOVE_CLUSTER_INFORMATION, *PFILE_MOVE_CLUSTER_INFORMATION;
3122 
3123 typedef struct _FILE_RENAME_INFORMATION {
3124   BOOLEAN ReplaceIfExists;
3125   HANDLE RootDirectory;
3126   ULONG FileNameLength;
3127   WCHAR FileName[1];
3128 } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
3129 
3130 typedef struct _FILE_STREAM_INFORMATION {
3131   ULONG NextEntryOffset;
3132   ULONG StreamNameLength;
3133   LARGE_INTEGER StreamSize;
3134   LARGE_INTEGER StreamAllocationSize;
3135   WCHAR StreamName[1];
3136 } FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;
3137 
3138 typedef struct _FILE_TRACKING_INFORMATION {
3139   HANDLE DestinationFile;
3140   ULONG ObjectInformationLength;
3141   CHAR ObjectInformation[1];
3142 } FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION;
3143 
3144 typedef struct _FILE_COMPLETION_INFORMATION {
3145   HANDLE Port;
3146   PVOID Key;
3147 } FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;
3148 
3149 typedef struct _FILE_PIPE_INFORMATION {
3150   ULONG ReadMode;
3151   ULONG CompletionMode;
3152 } FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;
3153 
3154 typedef struct _FILE_PIPE_LOCAL_INFORMATION {
3155   ULONG NamedPipeType;
3156   ULONG NamedPipeConfiguration;
3157   ULONG MaximumInstances;
3158   ULONG CurrentInstances;
3159   ULONG InboundQuota;
3160   ULONG ReadDataAvailable;
3161   ULONG OutboundQuota;
3162   ULONG WriteQuotaAvailable;
3163   ULONG NamedPipeState;
3164   ULONG NamedPipeEnd;
3165 } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
3166 
3167 typedef struct _FILE_PIPE_REMOTE_INFORMATION {
3168   LARGE_INTEGER CollectDataTime;
3169   ULONG MaximumCollectionCount;
3170 } FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION;
3171 
3172 typedef struct _FILE_MAILSLOT_QUERY_INFORMATION {
3173   ULONG MaximumMessageSize;
3174   ULONG MailslotQuota;
3175   ULONG NextMessageSize;
3176   ULONG MessagesAvailable;
3177   LARGE_INTEGER ReadTimeout;
3178 } FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION;
3179 
3180 typedef struct _FILE_MAILSLOT_SET_INFORMATION {
3181   PLARGE_INTEGER ReadTimeout;
3182 } FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
3183 
3184 typedef struct _FILE_REPARSE_POINT_INFORMATION {
3185   LONGLONG FileReference;
3186   ULONG Tag;
3187 } FILE_REPARSE_POINT_INFORMATION, *PFILE_REPARSE_POINT_INFORMATION;
3188 
3189 typedef struct _FILE_LINK_ENTRY_INFORMATION {
3190   ULONG NextEntryOffset;
3191   LONGLONG ParentFileId;
3192   ULONG FileNameLength;
3193   WCHAR FileName[1];
3194 } FILE_LINK_ENTRY_INFORMATION, *PFILE_LINK_ENTRY_INFORMATION;
3195 
3196 typedef struct _FILE_LINKS_INFORMATION {
3197   ULONG BytesNeeded;
3198   ULONG EntriesReturned;
3199   FILE_LINK_ENTRY_INFORMATION Entry;
3200 } FILE_LINKS_INFORMATION, *PFILE_LINKS_INFORMATION;
3201 
3202 typedef struct _FILE_NETWORK_PHYSICAL_NAME_INFORMATION {
3203   ULONG FileNameLength;
3204   WCHAR FileName[1];
3205 } FILE_NETWORK_PHYSICAL_NAME_INFORMATION, *PFILE_NETWORK_PHYSICAL_NAME_INFORMATION;
3206 
3207 typedef struct _FILE_STANDARD_LINK_INFORMATION {
3208   ULONG NumberOfAccessibleLinks;
3209   ULONG TotalNumberOfLinks;
3210   BOOLEAN DeletePending;
3211   BOOLEAN Directory;
3212 } FILE_STANDARD_LINK_INFORMATION, *PFILE_STANDARD_LINK_INFORMATION;
3213 
3214 typedef struct _FILE_GET_EA_INFORMATION {
3215   ULONG NextEntryOffset;
3216   UCHAR EaNameLength;
3217   CHAR  EaName[1];
3218 } FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
3219 
3220 #define REMOTE_PROTOCOL_FLAG_LOOPBACK       0x00000001
3221 #define REMOTE_PROTOCOL_FLAG_OFFLINE        0x00000002
3222 
3223 typedef struct _FILE_REMOTE_PROTOCOL_INFORMATION {
3224   USHORT StructureVersion;
3225   USHORT StructureSize;
3226   ULONG  Protocol;
3227   USHORT ProtocolMajorVersion;
3228   USHORT ProtocolMinorVersion;
3229   USHORT ProtocolRevision;
3230   USHORT Reserved;
3231   ULONG  Flags;
3232   struct {
3233     ULONG Reserved[8];
3234   } GenericReserved;
3235   struct {
3236     ULONG Reserved[16];
3237   } ProtocolSpecificReserved;
3238 } FILE_REMOTE_PROTOCOL_INFORMATION, *PFILE_REMOTE_PROTOCOL_INFORMATION;
3239 
3240 typedef struct _FILE_GET_QUOTA_INFORMATION {
3241   ULONG NextEntryOffset;
3242   ULONG SidLength;
3243   SID Sid;
3244 } FILE_GET_QUOTA_INFORMATION, *PFILE_GET_QUOTA_INFORMATION;
3245 
3246 typedef struct _FILE_QUOTA_INFORMATION {
3247   ULONG NextEntryOffset;
3248   ULONG SidLength;
3249   LARGE_INTEGER ChangeTime;
3250   LARGE_INTEGER QuotaUsed;
3251   LARGE_INTEGER QuotaThreshold;
3252   LARGE_INTEGER QuotaLimit;
3253   SID Sid;
3254 } FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION;
3255 
3256 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {
3257   ULONG FileSystemAttributes;
3258   ULONG MaximumComponentNameLength;
3259   ULONG FileSystemNameLength;
3260   WCHAR FileSystemName[1];
3261 } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
3262 
3263 typedef struct _FILE_FS_DRIVER_PATH_INFORMATION {
3264   BOOLEAN DriverInPath;
3265   ULONG DriverNameLength;
3266   WCHAR DriverName[1];
3267 } FILE_FS_DRIVER_PATH_INFORMATION, *PFILE_FS_DRIVER_PATH_INFORMATION;
3268 
3269 typedef struct _FILE_FS_VOLUME_FLAGS_INFORMATION {
3270   ULONG Flags;
3271 } FILE_FS_VOLUME_FLAGS_INFORMATION, *PFILE_FS_VOLUME_FLAGS_INFORMATION;
3272 
3273 #define FILE_VC_QUOTA_NONE              0x00000000
3274 #define FILE_VC_QUOTA_TRACK             0x00000001
3275 #define FILE_VC_QUOTA_ENFORCE           0x00000002
3276 #define FILE_VC_QUOTA_MASK              0x00000003
3277 #define FILE_VC_CONTENT_INDEX_DISABLED  0x00000008
3278 #define FILE_VC_LOG_QUOTA_THRESHOLD     0x00000010
3279 #define FILE_VC_LOG_QUOTA_LIMIT         0x00000020
3280 #define FILE_VC_LOG_VOLUME_THRESHOLD    0x00000040
3281 #define FILE_VC_LOG_VOLUME_LIMIT        0x00000080
3282 #define FILE_VC_QUOTAS_INCOMPLETE       0x00000100
3283 #define FILE_VC_QUOTAS_REBUILDING       0x00000200
3284 #define FILE_VC_VALID_MASK              0x000003ff
3285 
3286 typedef struct _FILE_FS_CONTROL_INFORMATION {
3287   LARGE_INTEGER FreeSpaceStartFiltering;
3288   LARGE_INTEGER FreeSpaceThreshold;
3289   LARGE_INTEGER FreeSpaceStopFiltering;
3290   LARGE_INTEGER DefaultQuotaThreshold;
3291   LARGE_INTEGER DefaultQuotaLimit;
3292   ULONG FileSystemControlFlags;
3293 } FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;
3294 
3295 #ifndef _FILESYSTEMFSCTL_
3296 #define _FILESYSTEMFSCTL_
3297 
3298 #define FSCTL_REQUEST_OPLOCK_LEVEL_1    CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  0, METHOD_BUFFERED, FILE_ANY_ACCESS)
3299 #define FSCTL_REQUEST_OPLOCK_LEVEL_2    CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  1, METHOD_BUFFERED, FILE_ANY_ACCESS)
3300 #define FSCTL_REQUEST_BATCH_OPLOCK      CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  2, METHOD_BUFFERED, FILE_ANY_ACCESS)
3301 #define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE  CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  3, METHOD_BUFFERED, FILE_ANY_ACCESS)
3302 #define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  4, METHOD_BUFFERED, FILE_ANY_ACCESS)
3303 #define FSCTL_OPLOCK_BREAK_NOTIFY       CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  5, METHOD_BUFFERED, FILE_ANY_ACCESS)
3304 #define FSCTL_LOCK_VOLUME               CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  6, METHOD_BUFFERED, FILE_ANY_ACCESS)
3305 #define FSCTL_UNLOCK_VOLUME             CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  7, METHOD_BUFFERED, FILE_ANY_ACCESS)
3306 #define FSCTL_DISMOUNT_VOLUME           CTL_CODE(FILE_DEVICE_FILE_SYSTEM,  8, METHOD_BUFFERED, FILE_ANY_ACCESS)
3307 #define FSCTL_IS_VOLUME_MOUNTED         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
3308 #define FSCTL_IS_PATHNAME_VALID         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
3309 #define FSCTL_MARK_VOLUME_DIRTY         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
3310 #define FSCTL_QUERY_RETRIEVAL_POINTERS  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER,  FILE_ANY_ACCESS)
3311 #define FSCTL_GET_COMPRESSION           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
3312 #define FSCTL_SET_COMPRESSION           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
3313 #define FSCTL_SET_BOOTLOADER_ACCESSED   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER,  FILE_ANY_ACCESS)
3314 
3315 #define FSCTL_OPLOCK_BREAK_ACK_NO_2     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS)
3316 #define FSCTL_INVALIDATE_VOLUMES        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
3317 #define FSCTL_QUERY_FAT_BPB             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS)
3318 #define FSCTL_REQUEST_FILTER_OPLOCK     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS)
3319 #define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS)
3320 
3321 #if (_WIN32_WINNT >= 0x0400)
3322 
3323 #define FSCTL_GET_NTFS_VOLUME_DATA      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS)
3324 #define FSCTL_GET_NTFS_FILE_RECORD      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS)
3325 #define FSCTL_GET_VOLUME_BITMAP         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER,  FILE_ANY_ACCESS)
3326 #define FSCTL_GET_RETRIEVAL_POINTERS    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER,  FILE_ANY_ACCESS)
3327 #define FSCTL_MOVE_FILE                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3328 #define FSCTL_IS_VOLUME_DIRTY           CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS)
3329 #define FSCTL_ALLOW_EXTENDED_DASD_IO    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER,  FILE_ANY_ACCESS)
3330 
3331 #endif
3332 
3333 #if (_WIN32_WINNT >= 0x0500)
3334 
3335 #define FSCTL_FIND_FILES_BY_SID         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER,  FILE_ANY_ACCESS)
3336 #define FSCTL_SET_OBJECT_ID             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3337 #define FSCTL_GET_OBJECT_ID             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS)
3338 #define FSCTL_DELETE_OBJECT_ID          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3339 #define FSCTL_SET_REPARSE_POINT         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3340 #define FSCTL_GET_REPARSE_POINT         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS)
3341 #define FSCTL_DELETE_REPARSE_POINT      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3342 #define FSCTL_ENUM_USN_DATA             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER,  FILE_ANY_ACCESS)
3343 #define FSCTL_SECURITY_ID_CHECK         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45, METHOD_NEITHER,  FILE_READ_DATA)
3344 #define FSCTL_READ_USN_JOURNAL          CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46, METHOD_NEITHER,  FILE_ANY_ACCESS)
3345 #define FSCTL_SET_OBJECT_ID_EXTENDED    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3346 #define FSCTL_CREATE_OR_GET_OBJECT_ID   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS)
3347 #define FSCTL_SET_SPARSE                CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3348 #define FSCTL_SET_ZERO_DATA             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA)
3349 #define FSCTL_QUERY_ALLOCATED_RANGES    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51, METHOD_NEITHER,  FILE_READ_DATA)
3350 #define FSCTL_ENABLE_UPGRADE            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA)
3351 #define FSCTL_SET_ENCRYPTION            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_NEITHER,  FILE_ANY_ACCESS)
3352 #define FSCTL_ENCRYPTION_FSCTL_IO       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54, METHOD_NEITHER,  FILE_ANY_ACCESS)
3353 #define FSCTL_WRITE_RAW_ENCRYPTED       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55, METHOD_NEITHER,  FILE_SPECIAL_ACCESS)
3354 #define FSCTL_READ_RAW_ENCRYPTED        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56, METHOD_NEITHER,  FILE_SPECIAL_ACCESS)
3355 #define FSCTL_CREATE_USN_JOURNAL        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57, METHOD_NEITHER,  FILE_ANY_ACCESS)
3356 #define FSCTL_READ_FILE_USN_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58, METHOD_NEITHER,  FILE_ANY_ACCESS)
3357 #define FSCTL_WRITE_USN_CLOSE_RECORD    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59, METHOD_NEITHER,  FILE_ANY_ACCESS)
3358 #define FSCTL_EXTEND_VOLUME             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS)
3359 #define FSCTL_QUERY_USN_JOURNAL         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS)
3360 #define FSCTL_DELETE_USN_JOURNAL        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS)
3361 #define FSCTL_MARK_HANDLE               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS)
3362 #define FSCTL_SIS_COPYFILE              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS)
3363 #define FSCTL_SIS_LINK_FILES            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
3364 #define FSCTL_RECALL_FILE               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS)
3365 #define FSCTL_READ_FROM_PLEX            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA)
3366 #define FSCTL_FILE_PREFETCH             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3367 
3368 #endif
3369 
3370 #if (_WIN32_WINNT >= 0x0600)
3371 
3372 #define FSCTL_MAKE_MEDIA_COMPATIBLE         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 76, METHOD_BUFFERED, FILE_WRITE_DATA)
3373 #define FSCTL_SET_DEFECT_MANAGEMENT         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 77, METHOD_BUFFERED, FILE_WRITE_DATA)
3374 #define FSCTL_QUERY_SPARING_INFO            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 78, METHOD_BUFFERED, FILE_ANY_ACCESS)
3375 #define FSCTL_QUERY_ON_DISK_VOLUME_INFO     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 79, METHOD_BUFFERED, FILE_ANY_ACCESS)
3376 #define FSCTL_SET_VOLUME_COMPRESSION_STATE  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 80, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3377 #define FSCTL_TXFS_MODIFY_RM                CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 81, METHOD_BUFFERED, FILE_WRITE_DATA)
3378 #define FSCTL_TXFS_QUERY_RM_INFORMATION     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 82, METHOD_BUFFERED, FILE_READ_DATA)
3379 #define FSCTL_TXFS_ROLLFORWARD_REDO         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 84, METHOD_BUFFERED, FILE_WRITE_DATA)
3380 #define FSCTL_TXFS_ROLLFORWARD_UNDO         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 85, METHOD_BUFFERED, FILE_WRITE_DATA)
3381 #define FSCTL_TXFS_START_RM                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 86, METHOD_BUFFERED, FILE_WRITE_DATA)
3382 #define FSCTL_TXFS_SHUTDOWN_RM              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 87, METHOD_BUFFERED, FILE_WRITE_DATA)
3383 #define FSCTL_TXFS_READ_BACKUP_INFORMATION  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 88, METHOD_BUFFERED, FILE_READ_DATA)
3384 #define FSCTL_TXFS_WRITE_BACKUP_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 89, METHOD_BUFFERED, FILE_WRITE_DATA)
3385 #define FSCTL_TXFS_CREATE_SECONDARY_RM      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 90, METHOD_BUFFERED, FILE_WRITE_DATA)
3386 #define FSCTL_TXFS_GET_METADATA_INFO        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 91, METHOD_BUFFERED, FILE_READ_DATA)
3387 #define FSCTL_TXFS_GET_TRANSACTED_VERSION   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 92, METHOD_BUFFERED, FILE_READ_DATA)
3388 #define FSCTL_TXFS_SAVEPOINT_INFORMATION    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 94, METHOD_BUFFERED, FILE_WRITE_DATA)
3389 #define FSCTL_TXFS_CREATE_MINIVERSION       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 95, METHOD_BUFFERED, FILE_WRITE_DATA)
3390 #define FSCTL_TXFS_TRANSACTION_ACTIVE       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 99, METHOD_BUFFERED, FILE_READ_DATA)
3391 #define FSCTL_SET_ZERO_ON_DEALLOCATION      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 101, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3392 #define FSCTL_SET_REPAIR                    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 102, METHOD_BUFFERED, FILE_ANY_ACCESS)
3393 #define FSCTL_GET_REPAIR                    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 103, METHOD_BUFFERED, FILE_ANY_ACCESS)
3394 #define FSCTL_WAIT_FOR_REPAIR               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 104, METHOD_BUFFERED, FILE_ANY_ACCESS)
3395 #define FSCTL_INITIATE_REPAIR               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 106, METHOD_BUFFERED, FILE_ANY_ACCESS)
3396 #define FSCTL_CSC_INTERNAL                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 107, METHOD_NEITHER,  FILE_ANY_ACCESS)
3397 #define FSCTL_SHRINK_VOLUME                 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 108, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
3398 #define FSCTL_SET_SHORT_NAME_BEHAVIOR       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 109, METHOD_BUFFERED, FILE_ANY_ACCESS)
3399 #define FSCTL_DFSR_SET_GHOST_HANDLE_STATE   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 110, METHOD_BUFFERED, FILE_ANY_ACCESS)
3400 
3401 #define FSCTL_TXFS_LIST_TRANSACTION_LOCKED_FILES \
3402                                             CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_READ_DATA)
3403 #define FSCTL_TXFS_LIST_TRANSACTIONS        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 121, METHOD_BUFFERED, FILE_READ_DATA)
3404 #define FSCTL_QUERY_PAGEFILE_ENCRYPTION     CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 122, METHOD_BUFFERED, FILE_ANY_ACCESS)
3405 #define FSCTL_RESET_VOLUME_ALLOCATION_HINTS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 123, METHOD_BUFFERED, FILE_ANY_ACCESS)
3406 #define FSCTL_TXFS_READ_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 126, METHOD_BUFFERED, FILE_ANY_ACCESS)
3407 
3408 #endif
3409 
3410 #if (_WIN32_WINNT >= 0x0601)
3411 
3412 #define FSCTL_QUERY_DEPENDENT_VOLUME        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 124, METHOD_BUFFERED, FILE_ANY_ACCESS)
3413 #define FSCTL_SD_GLOBAL_CHANGE              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 125, METHOD_BUFFERED, FILE_ANY_ACCESS)
3414 #define FSCTL_LOOKUP_STREAM_FROM_CLUSTER    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 127, METHOD_BUFFERED, FILE_ANY_ACCESS)
3415 #define FSCTL_TXFS_WRITE_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 128, METHOD_BUFFERED, FILE_ANY_ACCESS)
3416 #define FSCTL_FILE_TYPE_NOTIFICATION        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 129, METHOD_BUFFERED, FILE_ANY_ACCESS)
3417 #define FSCTL_GET_BOOT_AREA_INFO            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 140, METHOD_BUFFERED, FILE_ANY_ACCESS)
3418 #define FSCTL_GET_RETRIEVAL_POINTER_BASE    CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 141, METHOD_BUFFERED, FILE_ANY_ACCESS)
3419 #define FSCTL_SET_PERSISTENT_VOLUME_STATE   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 142, METHOD_BUFFERED, FILE_ANY_ACCESS)
3420 #define FSCTL_QUERY_PERSISTENT_VOLUME_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 143, METHOD_BUFFERED, FILE_ANY_ACCESS)
3421 
3422 #define FSCTL_REQUEST_OPLOCK                CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 144, METHOD_BUFFERED, FILE_ANY_ACCESS)
3423 
3424 #define FSCTL_CSV_TUNNEL_REQUEST            CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 145, METHOD_BUFFERED, FILE_ANY_ACCESS)
3425 #define FSCTL_IS_CSV_FILE                   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 146, METHOD_BUFFERED, FILE_ANY_ACCESS)
3426 
3427 #define FSCTL_QUERY_FILE_SYSTEM_RECOGNITION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 147, METHOD_BUFFERED, FILE_ANY_ACCESS)
3428 #define FSCTL_CSV_GET_VOLUME_PATH_NAME      CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 148, METHOD_BUFFERED, FILE_ANY_ACCESS)
3429 #define FSCTL_CSV_GET_VOLUME_NAME_FOR_VOLUME_MOUNT_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 149, METHOD_BUFFERED, FILE_ANY_ACCESS)
3430 #define FSCTL_CSV_GET_VOLUME_PATH_NAMES_FOR_VOLUME_NAME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 150,  METHOD_BUFFERED, FILE_ANY_ACCESS)
3431 #define FSCTL_IS_FILE_ON_CSV_VOLUME         CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 151,  METHOD_BUFFERED, FILE_ANY_ACCESS)
3432 
3433 typedef struct _CSV_NAMESPACE_INFO {
3434   ULONG Version;
3435   ULONG DeviceNumber;
3436   LARGE_INTEGER StartingOffset;
3437   ULONG SectorSize;
3438 } CSV_NAMESPACE_INFO, *PCSV_NAMESPACE_INFO;
3439 
3440 #define CSV_NAMESPACE_INFO_V1 (sizeof(CSV_NAMESPACE_INFO))
3441 #define CSV_INVALID_DEVICE_NUMBER 0xFFFFFFFF
3442 
3443 #endif
3444 
3445 #define FSCTL_MARK_AS_SYSTEM_HIVE           FSCTL_SET_BOOTLOADER_ACCESSED
3446 
3447 typedef struct _PATHNAME_BUFFER {
3448   ULONG PathNameLength;
3449   WCHAR Name[1];
3450 } PATHNAME_BUFFER, *PPATHNAME_BUFFER;
3451 
3452 typedef struct _FSCTL_QUERY_FAT_BPB_BUFFER {
3453   UCHAR First0x24BytesOfBootSector[0x24];
3454 } FSCTL_QUERY_FAT_BPB_BUFFER, *PFSCTL_QUERY_FAT_BPB_BUFFER;
3455 
3456 #if (_WIN32_WINNT >= 0x0400)
3457 
3458 typedef struct _NTFS_VOLUME_DATA_BUFFER {
3459   LARGE_INTEGER VolumeSerialNumber;
3460   LARGE_INTEGER NumberSectors;
3461   LARGE_INTEGER TotalClusters;
3462   LARGE_INTEGER FreeClusters;
3463   LARGE_INTEGER TotalReserved;
3464   ULONG BytesPerSector;
3465   ULONG BytesPerCluster;
3466   ULONG BytesPerFileRecordSegment;
3467   ULONG ClustersPerFileRecordSegment;
3468   LARGE_INTEGER MftValidDataLength;
3469   LARGE_INTEGER MftStartLcn;
3470   LARGE_INTEGER Mft2StartLcn;
3471   LARGE_INTEGER MftZoneStart;
3472   LARGE_INTEGER MftZoneEnd;
3473 } NTFS_VOLUME_DATA_BUFFER, *PNTFS_VOLUME_DATA_BUFFER;
3474 
3475 typedef struct _NTFS_EXTENDED_VOLUME_DATA {
3476   ULONG ByteCount;
3477   USHORT MajorVersion;
3478   USHORT MinorVersion;
3479 } NTFS_EXTENDED_VOLUME_DATA, *PNTFS_EXTENDED_VOLUME_DATA;
3480 
3481 typedef struct _STARTING_LCN_INPUT_BUFFER {
3482   LARGE_INTEGER StartingLcn;
3483 } STARTING_LCN_INPUT_BUFFER, *PSTARTING_LCN_INPUT_BUFFER;
3484 
3485 typedef struct _VOLUME_BITMAP_BUFFER {
3486   LARGE_INTEGER StartingLcn;
3487   LARGE_INTEGER BitmapSize;
3488   UCHAR Buffer[1];
3489 } VOLUME_BITMAP_BUFFER, *PVOLUME_BITMAP_BUFFER;
3490 
3491 typedef struct _STARTING_VCN_INPUT_BUFFER {
3492   LARGE_INTEGER StartingVcn;
3493 } STARTING_VCN_INPUT_BUFFER, *PSTARTING_VCN_INPUT_BUFFER;
3494 
3495 typedef struct _RETRIEVAL_POINTERS_BUFFER {
3496   ULONG ExtentCount;
3497   LARGE_INTEGER StartingVcn;
3498   struct {
3499     LARGE_INTEGER NextVcn;
3500     LARGE_INTEGER Lcn;
3501   } Extents[1];
3502 } RETRIEVAL_POINTERS_BUFFER, *PRETRIEVAL_POINTERS_BUFFER;
3503 
3504 typedef struct _NTFS_FILE_RECORD_INPUT_BUFFER {
3505   LARGE_INTEGER FileReferenceNumber;
3506 } NTFS_FILE_RECORD_INPUT_BUFFER, *PNTFS_FILE_RECORD_INPUT_BUFFER;
3507 
3508 typedef struct _NTFS_FILE_RECORD_OUTPUT_BUFFER {
3509   LARGE_INTEGER FileReferenceNumber;
3510   ULONG FileRecordLength;
3511   UCHAR FileRecordBuffer[1];
3512 } NTFS_FILE_RECORD_OUTPUT_BUFFER, *PNTFS_FILE_RECORD_OUTPUT_BUFFER;
3513 
3514 typedef struct _MOVE_FILE_DATA {
3515   HANDLE FileHandle;
3516   LARGE_INTEGER StartingVcn;
3517   LARGE_INTEGER StartingLcn;
3518   ULONG ClusterCount;
3519 } MOVE_FILE_DATA, *PMOVE_FILE_DATA;
3520 
3521 typedef struct _MOVE_FILE_RECORD_DATA {
3522   HANDLE FileHandle;
3523   LARGE_INTEGER SourceFileRecord;
3524   LARGE_INTEGER TargetFileRecord;
3525 } MOVE_FILE_RECORD_DATA, *PMOVE_FILE_RECORD_DATA;
3526 
3527 #if defined(_WIN64)
3528 typedef struct _MOVE_FILE_DATA32 {
3529   UINT32 FileHandle;
3530   LARGE_INTEGER StartingVcn;
3531   LARGE_INTEGER StartingLcn;
3532   ULONG ClusterCount;
3533 } MOVE_FILE_DATA32, *PMOVE_FILE_DATA32;
3534 #endif
3535 
3536 #endif /* (_WIN32_WINNT >= 0x0400) */
3537 
3538 #if (_WIN32_WINNT >= 0x0500)
3539 
3540 typedef struct _FIND_BY_SID_DATA {
3541   ULONG Restart;
3542   SID Sid;
3543 } FIND_BY_SID_DATA, *PFIND_BY_SID_DATA;
3544 
3545 typedef struct _FIND_BY_SID_OUTPUT {
3546   ULONG NextEntryOffset;
3547   ULONG FileIndex;
3548   ULONG FileNameLength;
3549   WCHAR FileName[1];
3550 } FIND_BY_SID_OUTPUT, *PFIND_BY_SID_OUTPUT;
3551 
3552 typedef struct _MFT_ENUM_DATA {
3553   ULONGLONG StartFileReferenceNumber;
3554   USN LowUsn;
3555   USN HighUsn;
3556 } MFT_ENUM_DATA, *PMFT_ENUM_DATA;
3557 
3558 typedef struct _CREATE_USN_JOURNAL_DATA {
3559   ULONGLONG MaximumSize;
3560   ULONGLONG AllocationDelta;
3561 } CREATE_USN_JOURNAL_DATA, *PCREATE_USN_JOURNAL_DATA;
3562 
3563 typedef struct _READ_USN_JOURNAL_DATA {
3564   USN StartUsn;
3565   ULONG ReasonMask;
3566   ULONG ReturnOnlyOnClose;
3567   ULONGLONG Timeout;
3568   ULONGLONG BytesToWaitFor;
3569   ULONGLONG UsnJournalID;
3570 } READ_USN_JOURNAL_DATA, *PREAD_USN_JOURNAL_DATA;
3571 
3572 typedef struct _USN_RECORD {
3573   ULONG RecordLength;
3574   USHORT MajorVersion;
3575   USHORT MinorVersion;
3576   ULONGLONG FileReferenceNumber;
3577   ULONGLONG ParentFileReferenceNumber;
3578   USN Usn;
3579   LARGE_INTEGER TimeStamp;
3580   ULONG Reason;
3581   ULONG SourceInfo;
3582   ULONG SecurityId;
3583   ULONG FileAttributes;
3584   USHORT FileNameLength;
3585   USHORT FileNameOffset;
3586   WCHAR FileName[1];
3587 } USN_RECORD, *PUSN_RECORD;
3588 
3589 #define USN_PAGE_SIZE                    (0x1000)
3590 
3591 #define USN_REASON_DATA_OVERWRITE        (0x00000001)
3592 #define USN_REASON_DATA_EXTEND           (0x00000002)
3593 #define USN_REASON_DATA_TRUNCATION       (0x00000004)
3594 #define USN_REASON_NAMED_DATA_OVERWRITE  (0x00000010)
3595 #define USN_REASON_NAMED_DATA_EXTEND     (0x00000020)
3596 #define USN_REASON_NAMED_DATA_TRUNCATION (0x00000040)
3597 #define USN_REASON_FILE_CREATE           (0x00000100)
3598 #define USN_REASON_FILE_DELETE           (0x00000200)
3599 #define USN_REASON_EA_CHANGE             (0x00000400)
3600 #define USN_REASON_SECURITY_CHANGE       (0x00000800)
3601 #define USN_REASON_RENAME_OLD_NAME       (0x00001000)
3602 #define USN_REASON_RENAME_NEW_NAME       (0x00002000)
3603 #define USN_REASON_INDEXABLE_CHANGE      (0x00004000)
3604 #define USN_REASON_BASIC_INFO_CHANGE     (0x00008000)
3605 #define USN_REASON_HARD_LINK_CHANGE      (0x00010000)
3606 #define USN_REASON_COMPRESSION_CHANGE    (0x00020000)
3607 #define USN_REASON_ENCRYPTION_CHANGE     (0x00040000)
3608 #define USN_REASON_OBJECT_ID_CHANGE      (0x00080000)
3609 #define USN_REASON_REPARSE_POINT_CHANGE  (0x00100000)
3610 #define USN_REASON_STREAM_CHANGE         (0x00200000)
3611 #define USN_REASON_TRANSACTED_CHANGE     (0x00400000)
3612 #define USN_REASON_CLOSE                 (0x80000000)
3613 
3614 typedef struct _USN_JOURNAL_DATA {
3615   ULONGLONG UsnJournalID;
3616   USN FirstUsn;
3617   USN NextUsn;
3618   USN LowestValidUsn;
3619   USN MaxUsn;
3620   ULONGLONG MaximumSize;
3621   ULONGLONG AllocationDelta;
3622 } USN_JOURNAL_DATA, *PUSN_JOURNAL_DATA;
3623 
3624 typedef struct _DELETE_USN_JOURNAL_DATA {
3625   ULONGLONG UsnJournalID;
3626   ULONG DeleteFlags;
3627 } DELETE_USN_JOURNAL_DATA, *PDELETE_USN_JOURNAL_DATA;
3628 
3629 #define USN_DELETE_FLAG_DELETE              (0x00000001)
3630 #define USN_DELETE_FLAG_NOTIFY              (0x00000002)
3631 #define USN_DELETE_VALID_FLAGS              (0x00000003)
3632 
3633 typedef struct _MARK_HANDLE_INFO {
3634   ULONG UsnSourceInfo;
3635   HANDLE VolumeHandle;
3636   ULONG HandleInfo;
3637 } MARK_HANDLE_INFO, *PMARK_HANDLE_INFO;
3638 
3639 #if defined(_WIN64)
3640 typedef struct _MARK_HANDLE_INFO32 {
3641   ULONG UsnSourceInfo;
3642   UINT32 VolumeHandle;
3643   ULONG HandleInfo;
3644 } MARK_HANDLE_INFO32, *PMARK_HANDLE_INFO32;
3645 #endif
3646 
3647 #define USN_SOURCE_DATA_MANAGEMENT          (0x00000001)
3648 #define USN_SOURCE_AUXILIARY_DATA           (0x00000002)
3649 #define USN_SOURCE_REPLICATION_MANAGEMENT   (0x00000004)
3650 
3651 #define MARK_HANDLE_PROTECT_CLUSTERS        (0x00000001)
3652 #define MARK_HANDLE_TXF_SYSTEM_LOG          (0x00000004)
3653 #define MARK_HANDLE_NOT_TXF_SYSTEM_LOG      (0x00000008)
3654 
3655 typedef struct _BULK_SECURITY_TEST_DATA {
3656   ACCESS_MASK DesiredAccess;
3657   ULONG SecurityIds[1];
3658 } BULK_SECURITY_TEST_DATA, *PBULK_SECURITY_TEST_DATA;
3659 
3660 #define VOLUME_IS_DIRTY                  (0x00000001)
3661 #define VOLUME_UPGRADE_SCHEDULED         (0x00000002)
3662 #define VOLUME_SESSION_OPEN              (0x00000004)
3663 
3664 typedef struct _FILE_PREFETCH {
3665   ULONG Type;
3666   ULONG Count;
3667   ULONGLONG Prefetch[1];
3668 } FILE_PREFETCH, *PFILE_PREFETCH;
3669 
3670 typedef struct _FILE_PREFETCH_EX {
3671   ULONG Type;
3672   ULONG Count;
3673   PVOID Context;
3674   ULONGLONG Prefetch[1];
3675 } FILE_PREFETCH_EX, *PFILE_PREFETCH_EX;
3676 
3677 #define FILE_PREFETCH_TYPE_FOR_CREATE       0x1
3678 #define FILE_PREFETCH_TYPE_FOR_DIRENUM      0x2
3679 #define FILE_PREFETCH_TYPE_FOR_CREATE_EX    0x3
3680 #define FILE_PREFETCH_TYPE_FOR_DIRENUM_EX   0x4
3681 
3682 #define FILE_PREFETCH_TYPE_MAX              0x4
3683 
3684 typedef struct _FILE_OBJECTID_BUFFER {
3685   UCHAR ObjectId[16];
3686   _ANONYMOUS_UNION union {
3687     _ANONYMOUS_STRUCT struct {
3688       UCHAR BirthVolumeId[16];
3689       UCHAR BirthObjectId[16];
3690       UCHAR DomainId[16];
3691     } DUMMYSTRUCTNAME;
3692     UCHAR ExtendedInfo[48];
3693   } DUMMYUNIONNAME;
3694 } FILE_OBJECTID_BUFFER, *PFILE_OBJECTID_BUFFER;
3695 
3696 typedef struct _FILE_SET_SPARSE_BUFFER {
3697   BOOLEAN SetSparse;
3698 } FILE_SET_SPARSE_BUFFER, *PFILE_SET_SPARSE_BUFFER;
3699 
3700 typedef struct _FILE_ZERO_DATA_INFORMATION {
3701   LARGE_INTEGER FileOffset;
3702   LARGE_INTEGER BeyondFinalZero;
3703 } FILE_ZERO_DATA_INFORMATION, *PFILE_ZERO_DATA_INFORMATION;
3704 
3705 typedef struct _FILE_ALLOCATED_RANGE_BUFFER {
3706   LARGE_INTEGER FileOffset;
3707   LARGE_INTEGER Length;
3708 } FILE_ALLOCATED_RANGE_BUFFER, *PFILE_ALLOCATED_RANGE_BUFFER;
3709 
3710 typedef struct _ENCRYPTION_BUFFER {
3711   ULONG EncryptionOperation;
3712   UCHAR Private[1];
3713 } ENCRYPTION_BUFFER, *PENCRYPTION_BUFFER;
3714 
3715 #define FILE_SET_ENCRYPTION         0x00000001
3716 #define FILE_CLEAR_ENCRYPTION       0x00000002
3717 #define STREAM_SET_ENCRYPTION       0x00000003
3718 #define STREAM_CLEAR_ENCRYPTION     0x00000004
3719 
3720 #define MAXIMUM_ENCRYPTION_VALUE    0x00000004
3721 
3722 typedef struct _DECRYPTION_STATUS_BUFFER {
3723   BOOLEAN NoEncryptedStreams;
3724 } DECRYPTION_STATUS_BUFFER, *PDECRYPTION_STATUS_BUFFER;
3725 
3726 #define ENCRYPTION_FORMAT_DEFAULT        (0x01)
3727 
3728 #define COMPRESSION_FORMAT_SPARSE        (0x4000)
3729 
3730 typedef struct _REQUEST_RAW_ENCRYPTED_DATA {
3731   LONGLONG FileOffset;
3732   ULONG Length;
3733 } REQUEST_RAW_ENCRYPTED_DATA, *PREQUEST_RAW_ENCRYPTED_DATA;
3734 
3735 typedef struct _ENCRYPTED_DATA_INFO {
3736   ULONGLONG StartingFileOffset;
3737   ULONG OutputBufferOffset;
3738   ULONG BytesWithinFileSize;
3739   ULONG BytesWithinValidDataLength;
3740   USHORT CompressionFormat;
3741   UCHAR DataUnitShift;
3742   UCHAR ChunkShift;
3743   UCHAR ClusterShift;
3744   UCHAR EncryptionFormat;
3745   USHORT NumberOfDataBlocks;
3746   ULONG DataBlockSize[ANYSIZE_ARRAY];
3747 } ENCRYPTED_DATA_INFO, *PENCRYPTED_DATA_INFO;
3748 
3749 typedef struct _PLEX_READ_DATA_REQUEST {
3750   LARGE_INTEGER ByteOffset;
3751   ULONG ByteLength;
3752   ULONG PlexNumber;
3753 } PLEX_READ_DATA_REQUEST, *PPLEX_READ_DATA_REQUEST;
3754 
3755 typedef struct _SI_COPYFILE {
3756   ULONG SourceFileNameLength;
3757   ULONG DestinationFileNameLength;
3758   ULONG Flags;
3759   WCHAR FileNameBuffer[1];
3760 } SI_COPYFILE, *PSI_COPYFILE;
3761 
3762 #define COPYFILE_SIS_LINK       0x0001
3763 #define COPYFILE_SIS_REPLACE    0x0002
3764 #define COPYFILE_SIS_FLAGS      0x0003
3765 
3766 #endif /* (_WIN32_WINNT >= 0x0500) */
3767 
3768 #if (_WIN32_WINNT >= 0x0600)
3769 
3770 typedef struct _FILE_MAKE_COMPATIBLE_BUFFER {
3771   BOOLEAN CloseDisc;
3772 } FILE_MAKE_COMPATIBLE_BUFFER, *PFILE_MAKE_COMPATIBLE_BUFFER;
3773 
3774 typedef struct _FILE_SET_DEFECT_MGMT_BUFFER {
3775   BOOLEAN Disable;
3776 } FILE_SET_DEFECT_MGMT_BUFFER, *PFILE_SET_DEFECT_MGMT_BUFFER;
3777 
3778 typedef struct _FILE_QUERY_SPARING_BUFFER {
3779   ULONG SparingUnitBytes;
3780   BOOLEAN SoftwareSparing;
3781   ULONG TotalSpareBlocks;
3782   ULONG FreeSpareBlocks;
3783 } FILE_QUERY_SPARING_BUFFER, *PFILE_QUERY_SPARING_BUFFER;
3784 
3785 typedef struct _FILE_QUERY_ON_DISK_VOL_INFO_BUFFER {
3786   LARGE_INTEGER DirectoryCount;
3787   LARGE_INTEGER FileCount;
3788   USHORT FsFormatMajVersion;
3789   USHORT FsFormatMinVersion;
3790   WCHAR FsFormatName[12];
3791   LARGE_INTEGER FormatTime;
3792   LARGE_INTEGER LastUpdateTime;
3793   WCHAR CopyrightInfo[34];
3794   WCHAR AbstractInfo[34];
3795   WCHAR FormattingImplementationInfo[34];
3796   WCHAR LastModifyingImplementationInfo[34];
3797 } FILE_QUERY_ON_DISK_VOL_INFO_BUFFER, *PFILE_QUERY_ON_DISK_VOL_INFO_BUFFER;
3798 
3799 #define SET_REPAIR_ENABLED                                      (0x00000001)
3800 #define SET_REPAIR_VOLUME_BITMAP_SCAN                           (0x00000002)
3801 #define SET_REPAIR_DELETE_CROSSLINK                             (0x00000004)
3802 #define SET_REPAIR_WARN_ABOUT_DATA_LOSS                         (0x00000008)
3803 #define SET_REPAIR_DISABLED_AND_BUGCHECK_ON_CORRUPT             (0x00000010)
3804 #define SET_REPAIR_VALID_MASK                                   (0x0000001F)
3805 
3806 typedef enum _SHRINK_VOLUME_REQUEST_TYPES {
3807   ShrinkPrepare = 1,
3808   ShrinkCommit,
3809   ShrinkAbort
3810 } SHRINK_VOLUME_REQUEST_TYPES, *PSHRINK_VOLUME_REQUEST_TYPES;
3811 
3812 typedef struct _SHRINK_VOLUME_INFORMATION {
3813   SHRINK_VOLUME_REQUEST_TYPES ShrinkRequestType;
3814   ULONGLONG Flags;
3815   LONGLONG NewNumberOfSectors;
3816 } SHRINK_VOLUME_INFORMATION, *PSHRINK_VOLUME_INFORMATION;
3817 
3818 #define TXFS_RM_FLAG_LOGGING_MODE                           0x00000001
3819 #define TXFS_RM_FLAG_RENAME_RM                              0x00000002
3820 #define TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX                0x00000004
3821 #define TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN                0x00000008
3822 #define TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS    0x00000010
3823 #define TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT           0x00000020
3824 #define TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE             0x00000040
3825 #define TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX             0x00000080
3826 #define TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN             0x00000100
3827 #define TXFS_RM_FLAG_GROW_LOG                               0x00000400
3828 #define TXFS_RM_FLAG_SHRINK_LOG                             0x00000800
3829 #define TXFS_RM_FLAG_ENFORCE_MINIMUM_SIZE                   0x00001000
3830 #define TXFS_RM_FLAG_PRESERVE_CHANGES                       0x00002000
3831 #define TXFS_RM_FLAG_RESET_RM_AT_NEXT_START                 0x00004000
3832 #define TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START          0x00008000
3833 #define TXFS_RM_FLAG_PREFER_CONSISTENCY                     0x00010000
3834 #define TXFS_RM_FLAG_PREFER_AVAILABILITY                    0x00020000
3835 
3836 #define TXFS_LOGGING_MODE_SIMPLE        (0x0001)
3837 #define TXFS_LOGGING_MODE_FULL          (0x0002)
3838 
3839 #define TXFS_TRANSACTION_STATE_NONE         0x00
3840 #define TXFS_TRANSACTION_STATE_ACTIVE       0x01
3841 #define TXFS_TRANSACTION_STATE_PREPARED     0x02
3842 #define TXFS_TRANSACTION_STATE_NOTACTIVE    0x03
3843 
3844 #define TXFS_MODIFY_RM_VALID_FLAGS (TXFS_RM_FLAG_LOGGING_MODE                        | \
3845                                     TXFS_RM_FLAG_RENAME_RM                           | \
3846                                     TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX             | \
3847                                     TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN             | \
3848                                     TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \
3849                                     TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT        | \
3850                                     TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE          | \
3851                                     TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX          | \
3852                                     TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN          | \
3853                                     TXFS_RM_FLAG_SHRINK_LOG                          | \
3854                                     TXFS_RM_FLAG_GROW_LOG                            | \
3855                                     TXFS_RM_FLAG_ENFORCE_MINIMUM_SIZE                | \
3856                                     TXFS_RM_FLAG_PRESERVE_CHANGES                    | \
3857                                     TXFS_RM_FLAG_RESET_RM_AT_NEXT_START              | \
3858                                     TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START       | \
3859                                     TXFS_RM_FLAG_PREFER_CONSISTENCY                  | \
3860                                     TXFS_RM_FLAG_PREFER_AVAILABILITY)
3861 
3862 typedef struct _TXFS_MODIFY_RM {
3863   ULONG Flags;
3864   ULONG LogContainerCountMax;
3865   ULONG LogContainerCountMin;
3866   ULONG LogContainerCount;
3867   ULONG LogGrowthIncrement;
3868   ULONG LogAutoShrinkPercentage;
3869   ULONGLONG Reserved;
3870   USHORT LoggingMode;
3871 } TXFS_MODIFY_RM, *PTXFS_MODIFY_RM;
3872 
3873 #define TXFS_RM_STATE_NOT_STARTED       0
3874 #define TXFS_RM_STATE_STARTING          1
3875 #define TXFS_RM_STATE_ACTIVE            2
3876 #define TXFS_RM_STATE_SHUTTING_DOWN     3
3877 
3878 #define TXFS_QUERY_RM_INFORMATION_VALID_FLAGS                           \
3879                 (TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS   |   \
3880                  TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT          |   \
3881                  TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX            |   \
3882                  TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN            |   \
3883                  TXFS_RM_FLAG_RESET_RM_AT_NEXT_START                |   \
3884                  TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START         |   \
3885                  TXFS_RM_FLAG_PREFER_CONSISTENCY                    |   \
3886                  TXFS_RM_FLAG_PREFER_AVAILABILITY)
3887 
3888 typedef struct _TXFS_QUERY_RM_INFORMATION {
3889   ULONG BytesRequired;
3890   ULONGLONG TailLsn;
3891   ULONGLONG CurrentLsn;
3892   ULONGLONG ArchiveTailLsn;
3893   ULONGLONG LogContainerSize;
3894   LARGE_INTEGER HighestVirtualClock;
3895   ULONG LogContainerCount;
3896   ULONG LogContainerCountMax;
3897   ULONG LogContainerCountMin;
3898   ULONG LogGrowthIncrement;
3899   ULONG LogAutoShrinkPercentage;
3900   ULONG Flags;
3901   USHORT LoggingMode;
3902   USHORT Reserved;
3903   ULONG RmState;
3904   ULONGLONG LogCapacity;
3905   ULONGLONG LogFree;
3906   ULONGLONG TopsSize;
3907   ULONGLONG TopsUsed;
3908   ULONGLONG TransactionCount;
3909   ULONGLONG OnePCCount;
3910   ULONGLONG TwoPCCount;
3911   ULONGLONG NumberLogFileFull;
3912   ULONGLONG OldestTransactionAge;
3913   GUID RMName;
3914   ULONG TmLogPathOffset;
3915 } TXFS_QUERY_RM_INFORMATION, *PTXFS_QUERY_RM_INFORMATION;
3916 
3917 #define TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_REDO_LSN        0x01
3918 #define TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_VIRTUAL_CLOCK   0x02
3919 
3920 #define TXFS_ROLLFORWARD_REDO_VALID_FLAGS                               \
3921                 (TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_REDO_LSN |         \
3922                  TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_VIRTUAL_CLOCK)
3923 
3924 typedef struct _TXFS_ROLLFORWARD_REDO_INFORMATION {
3925   LARGE_INTEGER LastVirtualClock;
3926   ULONGLONG LastRedoLsn;
3927   ULONGLONG HighestRecoveryLsn;
3928   ULONG Flags;
3929 } TXFS_ROLLFORWARD_REDO_INFORMATION, *PTXFS_ROLLFORWARD_REDO_INFORMATION;
3930 
3931 #define TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MAX              0x00000001
3932 #define TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MIN              0x00000002
3933 #define TXFS_START_RM_FLAG_LOG_CONTAINER_SIZE                   0x00000004
3934 #define TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS  0x00000008
3935 #define TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT         0x00000010
3936 #define TXFS_START_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE           0x00000020
3937 #define TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX           0x00000040
3938 #define TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN           0x00000080
3939 
3940 #define TXFS_START_RM_FLAG_RECOVER_BEST_EFFORT                  0x00000200
3941 #define TXFS_START_RM_FLAG_LOGGING_MODE                         0x00000400
3942 #define TXFS_START_RM_FLAG_PRESERVE_CHANGES                     0x00000800
3943 
3944 #define TXFS_START_RM_FLAG_PREFER_CONSISTENCY                   0x00001000
3945 #define TXFS_START_RM_FLAG_PREFER_AVAILABILITY                  0x00002000
3946 
3947 #define TXFS_START_RM_VALID_FLAGS                                           \
3948                 (TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MAX             |   \
3949                  TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MIN             |   \
3950                  TXFS_START_RM_FLAG_LOG_CONTAINER_SIZE                  |   \
3951                  TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS |   \
3952                  TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT        |   \
3953                  TXFS_START_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE          |   \
3954                  TXFS_START_RM_FLAG_RECOVER_BEST_EFFORT                 |   \
3955                  TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX          |   \
3956                  TXFS_START_RM_FLAG_LOGGING_MODE                        |   \
3957                  TXFS_START_RM_FLAG_PRESERVE_CHANGES                    |   \
3958                  TXFS_START_RM_FLAG_PREFER_CONSISTENCY                  |   \
3959                  TXFS_START_RM_FLAG_PREFER_AVAILABILITY)
3960 
3961 typedef struct _TXFS_START_RM_INFORMATION {
3962   ULONG Flags;
3963   ULONGLONG LogContainerSize;
3964   ULONG LogContainerCountMin;
3965   ULONG LogContainerCountMax;
3966   ULONG LogGrowthIncrement;
3967   ULONG LogAutoShrinkPercentage;
3968   ULONG TmLogPathOffset;
3969   USHORT TmLogPathLength;
3970   USHORT LoggingMode;
3971   USHORT LogPathLength;
3972   USHORT Reserved;
3973   WCHAR LogPath[1];
3974 } TXFS_START_RM_INFORMATION, *PTXFS_START_RM_INFORMATION;
3975 
3976 typedef struct _TXFS_GET_METADATA_INFO_OUT {
3977   struct {
3978     LONGLONG LowPart;
3979     LONGLONG HighPart;
3980   } TxfFileId;
3981   GUID LockingTransaction;
3982   ULONGLONG LastLsn;
3983   ULONG TransactionState;
3984 } TXFS_GET_METADATA_INFO_OUT, *PTXFS_GET_METADATA_INFO_OUT;
3985 
3986 #define TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_CREATED   0x00000001
3987 #define TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_DELETED   0x00000002
3988 
3989 typedef struct _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY {
3990   ULONGLONG Offset;
3991   ULONG NameFlags;
3992   LONGLONG FileId;
3993   ULONG Reserved1;
3994   ULONG Reserved2;
3995   LONGLONG Reserved3;
3996   WCHAR FileName[1];
3997 } TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY, *PTXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY;
3998 
3999 typedef struct _TXFS_LIST_TRANSACTION_LOCKED_FILES {
4000   GUID KtmTransaction;
4001   ULONGLONG NumberOfFiles;
4002   ULONGLONG BufferSizeRequired;
4003   ULONGLONG Offset;
4004 } TXFS_LIST_TRANSACTION_LOCKED_FILES, *PTXFS_LIST_TRANSACTION_LOCKED_FILES;
4005 
4006 typedef struct _TXFS_LIST_TRANSACTIONS_ENTRY {
4007   GUID TransactionId;
4008   ULONG TransactionState;
4009   ULONG Reserved1;
4010   ULONG Reserved2;
4011   LONGLONG Reserved3;
4012 } TXFS_LIST_TRANSACTIONS_ENTRY, *PTXFS_LIST_TRANSACTIONS_ENTRY;
4013 
4014 typedef struct _TXFS_LIST_TRANSACTIONS {
4015   ULONGLONG NumberOfTransactions;
4016   ULONGLONG BufferSizeRequired;
4017 } TXFS_LIST_TRANSACTIONS, *PTXFS_LIST_TRANSACTIONS;
4018 
4019 typedef struct _TXFS_READ_BACKUP_INFORMATION_OUT {
4020   _ANONYMOUS_UNION union {
4021     ULONG BufferLength;
4022     UCHAR Buffer[1];
4023   } DUMMYUNIONNAME;
4024 } TXFS_READ_BACKUP_INFORMATION_OUT, *PTXFS_READ_BACKUP_INFORMATION_OUT;
4025 
4026 typedef struct _TXFS_WRITE_BACKUP_INFORMATION {
4027   UCHAR Buffer[1];
4028 } TXFS_WRITE_BACKUP_INFORMATION, *PTXFS_WRITE_BACKUP_INFORMATION;
4029 
4030 #define TXFS_TRANSACTED_VERSION_NONTRANSACTED   0xFFFFFFFE
4031 #define TXFS_TRANSACTED_VERSION_UNCOMMITTED     0xFFFFFFFF
4032 
4033 typedef struct _TXFS_GET_TRANSACTED_VERSION {
4034   ULONG ThisBaseVersion;
4035   ULONG LatestVersion;
4036   USHORT ThisMiniVersion;
4037   USHORT FirstMiniVersion;
4038   USHORT LatestMiniVersion;
4039 } TXFS_GET_TRANSACTED_VERSION, *PTXFS_GET_TRANSACTED_VERSION;
4040 
4041 #define TXFS_SAVEPOINT_SET                      0x00000001
4042 #define TXFS_SAVEPOINT_ROLLBACK                 0x00000002
4043 #define TXFS_SAVEPOINT_CLEAR                    0x00000004
4044 #define TXFS_SAVEPOINT_CLEAR_ALL                0x00000010
4045 
4046 typedef struct _TXFS_SAVEPOINT_INFORMATION {
4047   HANDLE KtmTransaction;
4048   ULONG ActionCode;
4049   ULONG SavepointId;
4050 } TXFS_SAVEPOINT_INFORMATION, *PTXFS_SAVEPOINT_INFORMATION;
4051 
4052 typedef struct _TXFS_CREATE_MINIVERSION_INFO {
4053   USHORT StructureVersion;
4054   USHORT StructureLength;
4055   ULONG BaseVersion;
4056   USHORT MiniVersion;
4057 } TXFS_CREATE_MINIVERSION_INFO, *PTXFS_CREATE_MINIVERSION_INFO;
4058 
4059 typedef struct _TXFS_TRANSACTION_ACTIVE_INFO {
4060   BOOLEAN TransactionsActiveAtSnapshot;
4061 } TXFS_TRANSACTION_ACTIVE_INFO, *PTXFS_TRANSACTION_ACTIVE_INFO;
4062 
4063 #endif /* (_WIN32_WINNT >= 0x0600) */
4064 
4065 #if (_WIN32_WINNT >= 0x0601)
4066 
4067 #define MARK_HANDLE_REALTIME                (0x00000020)
4068 #define MARK_HANDLE_NOT_REALTIME            (0x00000040)
4069 
4070 #define NO_8DOT3_NAME_PRESENT               (0x00000001)
4071 #define REMOVED_8DOT3_NAME                  (0x00000002)
4072 
4073 #define PERSISTENT_VOLUME_STATE_SHORT_NAME_CREATION_DISABLED        (0x00000001)
4074 
4075 typedef struct _BOOT_AREA_INFO {
4076   ULONG BootSectorCount;
4077   struct {
4078     LARGE_INTEGER Offset;
4079   } BootSectors[2];
4080 } BOOT_AREA_INFO, *PBOOT_AREA_INFO;
4081 
4082 typedef struct _RETRIEVAL_POINTER_BASE {
4083   LARGE_INTEGER FileAreaOffset;
4084 } RETRIEVAL_POINTER_BASE, *PRETRIEVAL_POINTER_BASE;
4085 
4086 typedef struct _FILE_FS_PERSISTENT_VOLUME_INFORMATION {
4087   ULONG VolumeFlags;
4088   ULONG FlagMask;
4089   ULONG Version;
4090   ULONG Reserved;
4091 } FILE_FS_PERSISTENT_VOLUME_INFORMATION, *PFILE_FS_PERSISTENT_VOLUME_INFORMATION;
4092 
4093 typedef struct _FILE_SYSTEM_RECOGNITION_INFORMATION {
4094   CHAR FileSystem[9];
4095 } FILE_SYSTEM_RECOGNITION_INFORMATION, *PFILE_SYSTEM_RECOGNITION_INFORMATION;
4096 
4097 #define OPLOCK_LEVEL_CACHE_READ         (0x00000001)
4098 #define OPLOCK_LEVEL_CACHE_HANDLE       (0x00000002)
4099 #define OPLOCK_LEVEL_CACHE_WRITE        (0x00000004)
4100 
4101 #define REQUEST_OPLOCK_INPUT_FLAG_REQUEST               (0x00000001)
4102 #define REQUEST_OPLOCK_INPUT_FLAG_ACK                   (0x00000002)
4103 #define REQUEST_OPLOCK_INPUT_FLAG_COMPLETE_ACK_ON_CLOSE (0x00000004)
4104 
4105 #define REQUEST_OPLOCK_CURRENT_VERSION          1
4106 
4107 typedef struct _REQUEST_OPLOCK_INPUT_BUFFER {
4108   USHORT StructureVersion;
4109   USHORT StructureLength;
4110   ULONG RequestedOplockLevel;
4111   ULONG Flags;
4112 } REQUEST_OPLOCK_INPUT_BUFFER, *PREQUEST_OPLOCK_INPUT_BUFFER;
4113 
4114 #define REQUEST_OPLOCK_OUTPUT_FLAG_ACK_REQUIRED     (0x00000001)
4115 #define REQUEST_OPLOCK_OUTPUT_FLAG_MODES_PROVIDED   (0x00000002)
4116 
4117 typedef struct _REQUEST_OPLOCK_OUTPUT_BUFFER {
4118   USHORT StructureVersion;
4119   USHORT StructureLength;
4120   ULONG OriginalOplockLevel;
4121   ULONG NewOplockLevel;
4122   ULONG Flags;
4123   ACCESS_MASK AccessMode;
4124   USHORT ShareMode;
4125 } REQUEST_OPLOCK_OUTPUT_BUFFER, *PREQUEST_OPLOCK_OUTPUT_BUFFER;
4126 
4127 #define SD_GLOBAL_CHANGE_TYPE_MACHINE_SID   1
4128 
4129 typedef struct _SD_CHANGE_MACHINE_SID_INPUT {
4130   USHORT CurrentMachineSIDOffset;
4131   USHORT CurrentMachineSIDLength;
4132   USHORT NewMachineSIDOffset;
4133   USHORT NewMachineSIDLength;
4134 } SD_CHANGE_MACHINE_SID_INPUT, *PSD_CHANGE_MACHINE_SID_INPUT;
4135 
4136 typedef struct _SD_CHANGE_MACHINE_SID_OUTPUT {
4137   ULONGLONG NumSDChangedSuccess;
4138   ULONGLONG NumSDChangedFail;
4139   ULONGLONG NumSDUnused;
4140   ULONGLONG NumSDTotal;
4141   ULONGLONG NumMftSDChangedSuccess;
4142   ULONGLONG NumMftSDChangedFail;
4143   ULONGLONG NumMftSDTotal;
4144 } SD_CHANGE_MACHINE_SID_OUTPUT, *PSD_CHANGE_MACHINE_SID_OUTPUT;
4145 
4146 typedef struct _SD_GLOBAL_CHANGE_INPUT {
4147   ULONG Flags;
4148   ULONG ChangeType;
4149   _ANONYMOUS_UNION union {
4150     SD_CHANGE_MACHINE_SID_INPUT SdChange;
4151   } DUMMYUNIONNAME;
4152 } SD_GLOBAL_CHANGE_INPUT, *PSD_GLOBAL_CHANGE_INPUT;
4153 
4154 typedef struct _SD_GLOBAL_CHANGE_OUTPUT {
4155   ULONG Flags;
4156   ULONG ChangeType;
4157   _ANONYMOUS_UNION union {
4158     SD_CHANGE_MACHINE_SID_OUTPUT SdChange;
4159   } DUMMYUNIONNAME;
4160 } SD_GLOBAL_CHANGE_OUTPUT, *PSD_GLOBAL_CHANGE_OUTPUT;
4161 
4162 #define ENCRYPTED_DATA_INFO_SPARSE_FILE    1
4163 
4164 typedef struct _EXTENDED_ENCRYPTED_DATA_INFO {
4165   ULONG ExtendedCode;
4166   ULONG Length;
4167   ULONG Flags;
4168   ULONG Reserved;
4169 } EXTENDED_ENCRYPTED_DATA_INFO, *PEXTENDED_ENCRYPTED_DATA_INFO;
4170 
4171 typedef struct _LOOKUP_STREAM_FROM_CLUSTER_INPUT {
4172   ULONG Flags;
4173   ULONG NumberOfClusters;
4174   LARGE_INTEGER Cluster[1];
4175 } LOOKUP_STREAM_FROM_CLUSTER_INPUT, *PLOOKUP_STREAM_FROM_CLUSTER_INPUT;
4176 
4177 typedef struct _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT {
4178   ULONG Offset;
4179   ULONG NumberOfMatches;
4180   ULONG BufferSizeRequired;
4181 } LOOKUP_STREAM_FROM_CLUSTER_OUTPUT, *PLOOKUP_STREAM_FROM_CLUSTER_OUTPUT;
4182 
4183 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_PAGE_FILE          0x00000001
4184 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_DENY_DEFRAG_SET    0x00000002
4185 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_FS_SYSTEM_FILE     0x00000004
4186 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_TXF_SYSTEM_FILE    0x00000008
4187 
4188 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_MASK          0xff000000
4189 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_DATA          0x01000000
4190 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_INDEX         0x02000000
4191 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_SYSTEM        0x03000000
4192 
4193 typedef struct _LOOKUP_STREAM_FROM_CLUSTER_ENTRY {
4194   ULONG OffsetToNext;
4195   ULONG Flags;
4196   LARGE_INTEGER Reserved;
4197   LARGE_INTEGER Cluster;
4198   WCHAR FileName[1];
4199 } LOOKUP_STREAM_FROM_CLUSTER_ENTRY, *PLOOKUP_STREAM_FROM_CLUSTER_ENTRY;
4200 
4201 typedef struct _FILE_TYPE_NOTIFICATION_INPUT {
4202   ULONG Flags;
4203   ULONG NumFileTypeIDs;
4204   GUID FileTypeID[1];
4205 } FILE_TYPE_NOTIFICATION_INPUT, *PFILE_TYPE_NOTIFICATION_INPUT;
4206 
4207 #define FILE_TYPE_NOTIFICATION_FLAG_USAGE_BEGIN     0x00000001
4208 #define FILE_TYPE_NOTIFICATION_FLAG_USAGE_END       0x00000002
4209 
4210 DEFINE_GUID(FILE_TYPE_NOTIFICATION_GUID_PAGE_FILE,         0x0d0a64a1, 0x38fc, 0x4db8, 0x9f, 0xe7, 0x3f, 0x43, 0x52, 0xcd, 0x7c, 0x5c);
4211 DEFINE_GUID(FILE_TYPE_NOTIFICATION_GUID_HIBERNATION_FILE,  0xb7624d64, 0xb9a3, 0x4cf8, 0x80, 0x11, 0x5b, 0x86, 0xc9, 0x40, 0xe7, 0xb7);
4212 DEFINE_GUID(FILE_TYPE_NOTIFICATION_GUID_CRASHDUMP_FILE,    0x9d453eb7, 0xd2a6, 0x4dbd, 0xa2, 0xe3, 0xfb, 0xd0, 0xed, 0x91, 0x09, 0xa9);
4213 
4214 #ifndef _VIRTUAL_STORAGE_TYPE_DEFINED
4215 #define _VIRTUAL_STORAGE_TYPE_DEFINED
4216 typedef struct _VIRTUAL_STORAGE_TYPE {
4217   ULONG DeviceId;
4218   GUID VendorId;
4219 } VIRTUAL_STORAGE_TYPE, *PVIRTUAL_STORAGE_TYPE;
4220 #endif
4221 
4222 typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST {
4223   ULONG RequestLevel;
4224   ULONG RequestFlags;
4225 } STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST, *PSTORAGE_QUERY_DEPENDENT_VOLUME_REQUEST;
4226 
4227 #define QUERY_DEPENDENT_VOLUME_REQUEST_FLAG_HOST_VOLUMES    0x1
4228 #define QUERY_DEPENDENT_VOLUME_REQUEST_FLAG_GUEST_VOLUMES   0x2
4229 
4230 typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY {
4231   ULONG EntryLength;
4232   ULONG DependencyTypeFlags;
4233   ULONG ProviderSpecificFlags;
4234   VIRTUAL_STORAGE_TYPE VirtualStorageType;
4235 } STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY, *PSTORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY;
4236 
4237 typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY {
4238   ULONG EntryLength;
4239   ULONG DependencyTypeFlags;
4240   ULONG ProviderSpecificFlags;
4241   VIRTUAL_STORAGE_TYPE VirtualStorageType;
4242   ULONG AncestorLevel;
4243   ULONG HostVolumeNameOffset;
4244   ULONG HostVolumeNameSize;
4245   ULONG DependentVolumeNameOffset;
4246   ULONG DependentVolumeNameSize;
4247   ULONG RelativePathOffset;
4248   ULONG RelativePathSize;
4249   ULONG DependentDeviceNameOffset;
4250   ULONG DependentDeviceNameSize;
4251 } STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY, *PSTORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY;
4252 
4253 typedef struct _STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE {
4254   ULONG ResponseLevel;
4255   ULONG NumberEntries;
4256   _ANONYMOUS_UNION union {
4257     STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY Lev1Depends[];
4258     STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY Lev2Depends[];
4259   } DUMMYUNIONNAME;
4260 } STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE, *PSTORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE;
4261 
4262 #endif /* (_WIN32_WINNT >= 0x0601) */
4263 
4264 typedef struct _FILESYSTEM_STATISTICS {
4265   USHORT FileSystemType;
4266   USHORT Version;
4267   ULONG SizeOfCompleteStructure;
4268   ULONG UserFileReads;
4269   ULONG UserFileReadBytes;
4270   ULONG UserDiskReads;
4271   ULONG UserFileWrites;
4272   ULONG UserFileWriteBytes;
4273   ULONG UserDiskWrites;
4274   ULONG MetaDataReads;
4275   ULONG MetaDataReadBytes;
4276   ULONG MetaDataDiskReads;
4277   ULONG MetaDataWrites;
4278   ULONG MetaDataWriteBytes;
4279   ULONG MetaDataDiskWrites;
4280 } FILESYSTEM_STATISTICS, *PFILESYSTEM_STATISTICS;
4281 
4282 #define FILESYSTEM_STATISTICS_TYPE_NTFS     1
4283 #define FILESYSTEM_STATISTICS_TYPE_FAT      2
4284 #define FILESYSTEM_STATISTICS_TYPE_EXFAT    3
4285 
4286 typedef struct _FAT_STATISTICS {
4287   ULONG CreateHits;
4288   ULONG SuccessfulCreates;
4289   ULONG FailedCreates;
4290   ULONG NonCachedReads;
4291   ULONG NonCachedReadBytes;
4292   ULONG NonCachedWrites;
4293   ULONG NonCachedWriteBytes;
4294   ULONG NonCachedDiskReads;
4295   ULONG NonCachedDiskWrites;
4296 } FAT_STATISTICS, *PFAT_STATISTICS;
4297 
4298 typedef struct _EXFAT_STATISTICS {
4299   ULONG CreateHits;
4300   ULONG SuccessfulCreates;
4301   ULONG FailedCreates;
4302   ULONG NonCachedReads;
4303   ULONG NonCachedReadBytes;
4304   ULONG NonCachedWrites;
4305   ULONG NonCachedWriteBytes;
4306   ULONG NonCachedDiskReads;
4307   ULONG NonCachedDiskWrites;
4308 } EXFAT_STATISTICS, *PEXFAT_STATISTICS;
4309 
4310 typedef struct _NTFS_STATISTICS {
4311   ULONG LogFileFullExceptions;
4312   ULONG OtherExceptions;
4313   ULONG MftReads;
4314   ULONG MftReadBytes;
4315   ULONG MftWrites;
4316   ULONG MftWriteBytes;
4317   struct {
4318     USHORT Write;
4319     USHORT Create;
4320     USHORT SetInfo;
4321     USHORT Flush;
4322   } MftWritesUserLevel;
4323   USHORT MftWritesFlushForLogFileFull;
4324   USHORT MftWritesLazyWriter;
4325   USHORT MftWritesUserRequest;
4326   ULONG Mft2Writes;
4327   ULONG Mft2WriteBytes;
4328   struct {
4329     USHORT Write;
4330     USHORT Create;
4331     USHORT SetInfo;
4332     USHORT Flush;
4333   } Mft2WritesUserLevel;
4334   USHORT Mft2WritesFlushForLogFileFull;
4335   USHORT Mft2WritesLazyWriter;
4336   USHORT Mft2WritesUserRequest;
4337   ULONG RootIndexReads;
4338   ULONG RootIndexReadBytes;
4339   ULONG RootIndexWrites;
4340   ULONG RootIndexWriteBytes;
4341   ULONG BitmapReads;
4342   ULONG BitmapReadBytes;
4343   ULONG BitmapWrites;
4344   ULONG BitmapWriteBytes;
4345   USHORT BitmapWritesFlushForLogFileFull;
4346   USHORT BitmapWritesLazyWriter;
4347   USHORT BitmapWritesUserRequest;
4348   struct {
4349     USHORT Write;
4350     USHORT Create;
4351     USHORT SetInfo;
4352   } BitmapWritesUserLevel;
4353   ULONG MftBitmapReads;
4354   ULONG MftBitmapReadBytes;
4355   ULONG MftBitmapWrites;
4356   ULONG MftBitmapWriteBytes;
4357   USHORT MftBitmapWritesFlushForLogFileFull;
4358   USHORT MftBitmapWritesLazyWriter;
4359   USHORT MftBitmapWritesUserRequest;
4360   struct {
4361     USHORT Write;
4362     USHORT Create;
4363     USHORT SetInfo;
4364     USHORT Flush;
4365   } MftBitmapWritesUserLevel;
4366   ULONG UserIndexReads;
4367   ULONG UserIndexReadBytes;
4368   ULONG UserIndexWrites;
4369   ULONG UserIndexWriteBytes;
4370   ULONG LogFileReads;
4371   ULONG LogFileReadBytes;
4372   ULONG LogFileWrites;
4373   ULONG LogFileWriteBytes;
4374   struct {
4375     ULONG Calls;
4376     ULONG Clusters;
4377     ULONG Hints;
4378     ULONG RunsReturned;
4379     ULONG HintsHonored;
4380     ULONG HintsClusters;
4381     ULONG Cache;
4382     ULONG CacheClusters;
4383     ULONG CacheMiss;
4384     ULONG CacheMissClusters;
4385   } Allocate;
4386 } NTFS_STATISTICS, *PNTFS_STATISTICS;
4387 
4388 #endif /* _FILESYSTEMFSCTL_ */
4389 
4390 #define SYMLINK_FLAG_RELATIVE   1
4391 
4392 typedef struct _REPARSE_DATA_BUFFER {
4393   ULONG ReparseTag;
4394   USHORT ReparseDataLength;
4395   USHORT Reserved;
4396   _ANONYMOUS_UNION union {
4397     struct {
4398       USHORT SubstituteNameOffset;
4399       USHORT SubstituteNameLength;
4400       USHORT PrintNameOffset;
4401       USHORT PrintNameLength;
4402       ULONG Flags;
4403       WCHAR PathBuffer[1];
4404     } SymbolicLinkReparseBuffer;
4405     struct {
4406       USHORT SubstituteNameOffset;
4407       USHORT SubstituteNameLength;
4408       USHORT PrintNameOffset;
4409       USHORT PrintNameLength;
4410       WCHAR PathBuffer[1];
4411     } MountPointReparseBuffer;
4412     struct {
4413       UCHAR DataBuffer[1];
4414     } GenericReparseBuffer;
4415   } DUMMYUNIONNAME;
4416 } REPARSE_DATA_BUFFER, *PREPARSE_DATA_BUFFER;
4417 
4418 #define REPARSE_DATA_BUFFER_HEADER_SIZE   FIELD_OFFSET(REPARSE_DATA_BUFFER, GenericReparseBuffer)
4419 
4420 typedef struct _REPARSE_GUID_DATA_BUFFER {
4421   ULONG ReparseTag;
4422   USHORT ReparseDataLength;
4423   USHORT Reserved;
4424   GUID ReparseGuid;
4425   struct {
4426     UCHAR DataBuffer[1];
4427   } GenericReparseBuffer;
4428 } REPARSE_GUID_DATA_BUFFER, *PREPARSE_GUID_DATA_BUFFER;
4429 
4430 #define REPARSE_GUID_DATA_BUFFER_HEADER_SIZE   FIELD_OFFSET(REPARSE_GUID_DATA_BUFFER, GenericReparseBuffer)
4431 
4432 #define MAXIMUM_REPARSE_DATA_BUFFER_SIZE      ( 16 * 1024 )
4433 
4434 /* Reserved reparse tags */
4435 #define IO_REPARSE_TAG_RESERVED_ZERO            (0)
4436 #define IO_REPARSE_TAG_RESERVED_ONE             (1)
4437 #define IO_REPARSE_TAG_RESERVED_RANGE           IO_REPARSE_TAG_RESERVED_ONE
4438 
4439 #define IsReparseTagMicrosoft(_tag)             (((_tag) & 0x80000000))
4440 #define IsReparseTagNameSurrogate(_tag)         (((_tag) & 0x20000000))
4441 
4442 #define IO_REPARSE_TAG_VALID_VALUES             (0xF000FFFF)
4443 
4444 #define IsReparseTagValid(tag) (                               \
4445                   !((tag) & ~IO_REPARSE_TAG_VALID_VALUES) &&   \
4446                   ((tag) > IO_REPARSE_TAG_RESERVED_RANGE)      \
4447                 )
4448 
4449 /* MicroSoft reparse point tags */
4450 #define IO_REPARSE_TAG_MOUNT_POINT              (0xA0000003L)
4451 #define IO_REPARSE_TAG_HSM                      (0xC0000004L)
4452 #define IO_REPARSE_TAG_DRIVE_EXTENDER           (0x80000005L)
4453 #define IO_REPARSE_TAG_HSM2                     (0x80000006L)
4454 #define IO_REPARSE_TAG_SIS                      (0x80000007L)
4455 #define IO_REPARSE_TAG_WIM                      (0x80000008L)
4456 #define IO_REPARSE_TAG_CSV                      (0x80000009L)
4457 #define IO_REPARSE_TAG_DFS                      (0x8000000AL)
4458 #define IO_REPARSE_TAG_FILTER_MANAGER           (0x8000000BL)
4459 #define IO_REPARSE_TAG_SYMLINK                  (0xA000000CL)
4460 #define IO_REPARSE_TAG_IIS_CACHE                (0xA0000010L)
4461 #define IO_REPARSE_TAG_DFSR                     (0x80000012L)
4462 
4463 #pragma pack(4)
4464 typedef struct _REPARSE_INDEX_KEY {
4465   ULONG FileReparseTag;
4466   LARGE_INTEGER FileId;
4467 } REPARSE_INDEX_KEY, *PREPARSE_INDEX_KEY;
4468 #pragma pack()
4469 
4470 #define FSCTL_LMR_GET_LINK_TRACKING_INFORMATION   CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,58,METHOD_BUFFERED,FILE_ANY_ACCESS)
4471 #define FSCTL_LMR_SET_LINK_TRACKING_INFORMATION   CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,59,METHOD_BUFFERED,FILE_ANY_ACCESS)
4472 #define IOCTL_LMR_ARE_FILE_OBJECTS_ON_SAME_SERVER CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM,60,METHOD_BUFFERED,FILE_ANY_ACCESS)
4473 
4474 #define FSCTL_PIPE_ASSIGN_EVENT             CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
4475 #define FSCTL_PIPE_DISCONNECT               CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
4476 #define FSCTL_PIPE_LISTEN                   CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
4477 #define FSCTL_PIPE_PEEK                     CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
4478 #define FSCTL_PIPE_QUERY_EVENT              CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
4479 #define FSCTL_PIPE_TRANSCEIVE               CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER,  FILE_READ_DATA | FILE_WRITE_DATA)
4480 #define FSCTL_PIPE_WAIT                     CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
4481 #define FSCTL_PIPE_IMPERSONATE              CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
4482 #define FSCTL_PIPE_SET_CLIENT_PROCESS       CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
4483 #define FSCTL_PIPE_QUERY_CLIENT_PROCESS     CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
4484 #define FSCTL_PIPE_GET_PIPE_ATTRIBUTE       CTL_CODE(FILE_DEVICE_NAMED_PIPE, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
4485 #define FSCTL_PIPE_SET_PIPE_ATTRIBUTE       CTL_CODE(FILE_DEVICE_NAMED_PIPE, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
4486 #define FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
4487 #define FSCTL_PIPE_SET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 13, METHOD_BUFFERED, FILE_ANY_ACCESS)
4488 #define FSCTL_PIPE_GET_HANDLE_ATTRIBUTE     CTL_CODE(FILE_DEVICE_NAMED_PIPE, 14, METHOD_BUFFERED, FILE_ANY_ACCESS)
4489 #define FSCTL_PIPE_SET_HANDLE_ATTRIBUTE     CTL_CODE(FILE_DEVICE_NAMED_PIPE, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
4490 #define FSCTL_PIPE_FLUSH                    CTL_CODE(FILE_DEVICE_NAMED_PIPE, 16, METHOD_BUFFERED, FILE_WRITE_DATA)
4491 
4492 #define FSCTL_PIPE_INTERNAL_READ            CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
4493 #define FSCTL_PIPE_INTERNAL_WRITE           CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
4494 #define FSCTL_PIPE_INTERNAL_TRANSCEIVE      CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
4495 #define FSCTL_PIPE_INTERNAL_READ_OVFLOW     CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
4496 
4497 #define FILE_PIPE_READ_DATA                 0x00000000
4498 #define FILE_PIPE_WRITE_SPACE               0x00000001
4499 
4500 typedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER {
4501   HANDLE EventHandle;
4502   ULONG KeyValue;
4503 } FILE_PIPE_ASSIGN_EVENT_BUFFER, *PFILE_PIPE_ASSIGN_EVENT_BUFFER;
4504 
4505 typedef struct _FILE_PIPE_EVENT_BUFFER {
4506   ULONG NamedPipeState;
4507   ULONG EntryType;
4508   ULONG ByteCount;
4509   ULONG KeyValue;
4510   ULONG NumberRequests;
4511 } FILE_PIPE_EVENT_BUFFER, *PFILE_PIPE_EVENT_BUFFER;
4512 
4513 typedef struct _FILE_PIPE_PEEK_BUFFER {
4514   ULONG NamedPipeState;
4515   ULONG ReadDataAvailable;
4516   ULONG NumberOfMessages;
4517   ULONG MessageLength;
4518   CHAR Data[1];
4519 } FILE_PIPE_PEEK_BUFFER, *PFILE_PIPE_PEEK_BUFFER;
4520 
4521 typedef struct _FILE_PIPE_WAIT_FOR_BUFFER {
4522   LARGE_INTEGER Timeout;
4523   ULONG NameLength;
4524   BOOLEAN TimeoutSpecified;
4525   WCHAR Name[1];
4526 } FILE_PIPE_WAIT_FOR_BUFFER, *PFILE_PIPE_WAIT_FOR_BUFFER;
4527 
4528 typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER {
4529 #if !defined(BUILD_WOW6432)
4530   PVOID ClientSession;
4531   PVOID ClientProcess;
4532 #else
4533   ULONGLONG ClientSession;
4534   ULONGLONG ClientProcess;
4535 #endif
4536 } FILE_PIPE_CLIENT_PROCESS_BUFFER, *PFILE_PIPE_CLIENT_PROCESS_BUFFER;
4537 
4538 #define FILE_PIPE_COMPUTER_NAME_LENGTH 15
4539 
4540 typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX {
4541 #if !defined(BUILD_WOW6432)
4542   PVOID ClientSession;
4543   PVOID ClientProcess;
4544 #else
4545   ULONGLONG ClientSession;
4546   ULONGLONG ClientProcess;
4547 #endif
4548   USHORT ClientComputerNameLength;
4549   WCHAR ClientComputerBuffer[FILE_PIPE_COMPUTER_NAME_LENGTH+1];
4550 } FILE_PIPE_CLIENT_PROCESS_BUFFER_EX, *PFILE_PIPE_CLIENT_PROCESS_BUFFER_EX;
4551 
4552 #define FSCTL_MAILSLOT_PEEK             CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)
4553 
4554 typedef enum _LINK_TRACKING_INFORMATION_TYPE {
4555   NtfsLinkTrackingInformation,
4556   DfsLinkTrackingInformation
4557 } LINK_TRACKING_INFORMATION_TYPE, *PLINK_TRACKING_INFORMATION_TYPE;
4558 
4559 typedef struct _LINK_TRACKING_INFORMATION {
4560   LINK_TRACKING_INFORMATION_TYPE Type;
4561   UCHAR VolumeId[16];
4562 } LINK_TRACKING_INFORMATION, *PLINK_TRACKING_INFORMATION;
4563 
4564 typedef struct _REMOTE_LINK_TRACKING_INFORMATION {
4565   PVOID TargetFileObject;
4566   ULONG TargetLinkTrackingInformationLength;
4567   UCHAR TargetLinkTrackingInformationBuffer[1];
4568 } REMOTE_LINK_TRACKING_INFORMATION, *PREMOTE_LINK_TRACKING_INFORMATION;
4569 
4570 #define IO_OPEN_PAGING_FILE                 0x0002
4571 #define IO_OPEN_TARGET_DIRECTORY            0x0004
4572 #define IO_STOP_ON_SYMLINK                  0x0008
4573 #define IO_MM_PAGING_FILE                   0x0010
4574 
4575 typedef VOID
4576 (NTAPI *PDRIVER_FS_NOTIFICATION) (
4577   IN PDEVICE_OBJECT DeviceObject,
4578   IN BOOLEAN FsActive);
4579 
4580 typedef enum _FS_FILTER_SECTION_SYNC_TYPE {
4581   SyncTypeOther = 0,
4582   SyncTypeCreateSection
4583 } FS_FILTER_SECTION_SYNC_TYPE, *PFS_FILTER_SECTION_SYNC_TYPE;
4584 
4585 typedef enum _FS_FILTER_STREAM_FO_NOTIFICATION_TYPE {
4586   NotifyTypeCreate = 0,
4587   NotifyTypeRetired
4588 } FS_FILTER_STREAM_FO_NOTIFICATION_TYPE, *PFS_FILTER_STREAM_FO_NOTIFICATION_TYPE;
4589 
4590 typedef union _FS_FILTER_PARAMETERS {
4591   struct {
4592     PLARGE_INTEGER EndingOffset;
4593     PERESOURCE *ResourceToRelease;
4594   } AcquireForModifiedPageWriter;
4595   struct {
4596     PERESOURCE ResourceToRelease;
4597   } ReleaseForModifiedPageWriter;
4598   struct {
4599     FS_FILTER_SECTION_SYNC_TYPE SyncType;
4600     ULONG PageProtection;
4601   } AcquireForSectionSynchronization;
4602   struct {
4603     FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType;
4604     BOOLEAN POINTER_ALIGNMENT SafeToRecurse;
4605   } NotifyStreamFileObject;
4606   struct {
4607     PVOID Argument1;
4608     PVOID Argument2;
4609     PVOID Argument3;
4610     PVOID Argument4;
4611     PVOID Argument5;
4612   } Others;
4613 } FS_FILTER_PARAMETERS, *PFS_FILTER_PARAMETERS;
4614 
4615 #define FS_FILTER_ACQUIRE_FOR_SECTION_SYNCHRONIZATION      (UCHAR)-1
4616 #define FS_FILTER_RELEASE_FOR_SECTION_SYNCHRONIZATION      (UCHAR)-2
4617 #define FS_FILTER_ACQUIRE_FOR_MOD_WRITE                    (UCHAR)-3
4618 #define FS_FILTER_RELEASE_FOR_MOD_WRITE                    (UCHAR)-4
4619 #define FS_FILTER_ACQUIRE_FOR_CC_FLUSH                     (UCHAR)-5
4620 #define FS_FILTER_RELEASE_FOR_CC_FLUSH                     (UCHAR)-6
4621 
4622 typedef struct _FS_FILTER_CALLBACK_DATA {
4623   ULONG SizeOfFsFilterCallbackData;
4624   UCHAR Operation;
4625   UCHAR Reserved;
4626   struct _DEVICE_OBJECT *DeviceObject;
4627   struct _FILE_OBJECT *FileObject;
4628   FS_FILTER_PARAMETERS Parameters;
4629 } FS_FILTER_CALLBACK_DATA, *PFS_FILTER_CALLBACK_DATA;
4630 
4631 typedef NTSTATUS
4632 (NTAPI *PFS_FILTER_CALLBACK) (
4633   IN PFS_FILTER_CALLBACK_DATA Data,
4634   OUT PVOID *CompletionContext);
4635 
4636 typedef VOID
4637 (NTAPI *PFS_FILTER_COMPLETION_CALLBACK) (
4638   IN PFS_FILTER_CALLBACK_DATA Data,
4639   IN NTSTATUS OperationStatus,
4640   IN PVOID CompletionContext);
4641 
4642 typedef struct _FS_FILTER_CALLBACKS {
4643   ULONG SizeOfFsFilterCallbacks;
4644   ULONG Reserved;
4645   PFS_FILTER_CALLBACK PreAcquireForSectionSynchronization;
4646   PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization;
4647   PFS_FILTER_CALLBACK PreReleaseForSectionSynchronization;
4648   PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization;
4649   PFS_FILTER_CALLBACK PreAcquireForCcFlush;
4650   PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush;
4651   PFS_FILTER_CALLBACK PreReleaseForCcFlush;
4652   PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush;
4653   PFS_FILTER_CALLBACK PreAcquireForModifiedPageWriter;
4654   PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter;
4655   PFS_FILTER_CALLBACK PreReleaseForModifiedPageWriter;
4656   PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter;
4657 } FS_FILTER_CALLBACKS, *PFS_FILTER_CALLBACKS;
4658 
4659 #if (NTDDI_VERSION >= NTDDI_WINXP)
4660 NTKERNELAPI
4661 NTSTATUS
4662 NTAPI
4663 FsRtlRegisterFileSystemFilterCallbacks(
4664   IN struct _DRIVER_OBJECT *FilterDriverObject,
4665   IN PFS_FILTER_CALLBACKS Callbacks);
4666 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
4667 
4668 #if (NTDDI_VERSION >= NTDDI_VISTA)
4669 NTKERNELAPI
4670 NTSTATUS
4671 NTAPI
4672 FsRtlNotifyStreamFileObject(
4673   IN struct _FILE_OBJECT * StreamFileObject,
4674   IN struct _DEVICE_OBJECT *DeviceObjectHint OPTIONAL,
4675   IN FS_FILTER_STREAM_FO_NOTIFICATION_TYPE NotificationType,
4676   IN BOOLEAN SafeToRecurse);
4677 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
4678 
4679 #define DO_VERIFY_VOLUME                    0x00000002
4680 #define DO_BUFFERED_IO                      0x00000004
4681 #define DO_EXCLUSIVE                        0x00000008
4682 #define DO_DIRECT_IO                        0x00000010
4683 #define DO_MAP_IO_BUFFER                    0x00000020
4684 #define DO_DEVICE_HAS_NAME                  0x00000040
4685 #define DO_DEVICE_INITIALIZING              0x00000080
4686 #define DO_SYSTEM_BOOT_PARTITION            0x00000100
4687 #define DO_LONG_TERM_REQUESTS               0x00000200
4688 #define DO_NEVER_LAST_DEVICE                0x00000400
4689 #define DO_SHUTDOWN_REGISTERED              0x00000800
4690 #define DO_BUS_ENUMERATED_DEVICE            0x00001000
4691 #define DO_POWER_PAGABLE                    0x00002000
4692 #define DO_POWER_INRUSH                     0x00004000
4693 #define DO_LOW_PRIORITY_FILESYSTEM          0x00010000
4694 #define DO_SUPPORTS_TRANSACTIONS            0x00040000
4695 #define DO_FORCE_NEITHER_IO                 0x00080000
4696 #define DO_VOLUME_DEVICE_OBJECT             0x00100000
4697 #define DO_SYSTEM_SYSTEM_PARTITION          0x00200000
4698 #define DO_SYSTEM_CRITICAL_PARTITION        0x00400000
4699 #define DO_DISALLOW_EXECUTE                 0x00800000
4700 
4701 extern KSPIN_LOCK                   IoStatisticsLock;
4702 extern ULONG                        IoReadOperationCount;
4703 extern ULONG                        IoWriteOperationCount;
4704 extern ULONG                        IoOtherOperationCount;
4705 extern LARGE_INTEGER                IoReadTransferCount;
4706 extern LARGE_INTEGER                IoWriteTransferCount;
4707 extern LARGE_INTEGER                IoOtherTransferCount;
4708 
4709 #define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE    64
4710 #define IO_FILE_OBJECT_PAGED_POOL_CHARGE        1024
4711 
4712 #if (NTDDI_VERSION >= NTDDI_VISTA)
4713 typedef struct _IO_PRIORITY_INFO {
4714   ULONG Size;
4715   ULONG ThreadPriority;
4716   ULONG PagePriority;
4717   IO_PRIORITY_HINT IoPriority;
4718 } IO_PRIORITY_INFO, *PIO_PRIORITY_INFO;
4719 #endif
4720 
4721 typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION {
4722   ULONG Attributes;
4723   ACCESS_MASK GrantedAccess;
4724   ULONG HandleCount;
4725   ULONG PointerCount;
4726   ULONG Reserved[10];
4727 } PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION;
4728 
4729 typedef struct _PUBLIC_OBJECT_TYPE_INFORMATION {
4730   UNICODE_STRING TypeName;
4731   ULONG Reserved [22];
4732 } PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION;
4733 
4734 typedef struct _SECURITY_CLIENT_CONTEXT {
4735   SECURITY_QUALITY_OF_SERVICE SecurityQos;
4736   PACCESS_TOKEN ClientToken;
4737   BOOLEAN DirectlyAccessClientToken;
4738   BOOLEAN DirectAccessEffectiveOnly;
4739   BOOLEAN ServerIsRemote;
4740   TOKEN_CONTROL ClientTokenControl;
4741 } SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;
4742 
4743 #define SYSTEM_PAGE_PRIORITY_BITS       3
4744 #define SYSTEM_PAGE_PRIORITY_LEVELS     (1 << SYSTEM_PAGE_PRIORITY_BITS)
4745 
4746 typedef struct _KAPC_STATE {
4747   LIST_ENTRY ApcListHead[MaximumMode];
4748   PKPROCESS Process;
4749   BOOLEAN KernelApcInProgress;
4750   BOOLEAN KernelApcPending;
4751   BOOLEAN UserApcPending;
4752 } KAPC_STATE, *PKAPC_STATE, *RESTRICTED_POINTER PRKAPC_STATE;
4753 
4754 #define KAPC_STATE_ACTUAL_LENGTH (FIELD_OFFSET(KAPC_STATE, UserApcPending) + sizeof(BOOLEAN))
4755 
4756 #define ASSERT_QUEUE(Q) ASSERT(((Q)->Header.Type & KOBJECT_TYPE_MASK) == QueueObject);
4757 
4758 typedef struct _KQUEUE {
4759   DISPATCHER_HEADER Header;
4760   LIST_ENTRY EntryListHead;
4761   volatile ULONG CurrentCount;
4762   ULONG MaximumCount;
4763   LIST_ENTRY ThreadListHead;
4764 } KQUEUE, *PKQUEUE, *RESTRICTED_POINTER PRKQUEUE;
4765 
4766 /******************************************************************************
4767  *                              Kernel Functions                              *
4768  ******************************************************************************/
4769 
4770 NTSTATUS
4771 NTAPI
4772 KeGetProcessorNumberFromIndex(
4773   IN ULONG ProcIndex,
4774   OUT PPROCESSOR_NUMBER ProcNumber);
4775 
4776 ULONG
4777 NTAPI
4778 KeGetProcessorIndexFromNumber(
4779   IN PPROCESSOR_NUMBER ProcNumber);
4780 
4781 #if (NTDDI_VERSION >= NTDDI_WIN2K)
4782 
4783 
4784 
4785 
4786 NTKERNELAPI
4787 VOID
4788 NTAPI
4789 KeInitializeMutant(
4790   OUT PRKMUTANT Mutant,
4791   IN BOOLEAN InitialOwner);
4792 
4793 NTKERNELAPI
4794 LONG
4795 NTAPI
4796 KeReadStateMutant(
4797   IN PRKMUTANT Mutant);
4798 
4799 NTKERNELAPI
4800 LONG
4801 NTAPI
4802 KeReleaseMutant(
4803   IN OUT PRKMUTANT Mutant,
4804   IN KPRIORITY Increment,
4805   IN BOOLEAN Abandoned,
4806   IN BOOLEAN Wait);
4807 
4808 NTKERNELAPI
4809 VOID
4810 NTAPI
4811 KeInitializeQueue(
4812   OUT PRKQUEUE Queue,
4813   IN ULONG Count);
4814 
4815 NTKERNELAPI
4816 LONG
4817 NTAPI
4818 KeReadStateQueue(
4819   IN PRKQUEUE Queue);
4820 
4821 NTKERNELAPI
4822 LONG
4823 NTAPI
4824 KeInsertQueue(
4825   IN OUT PRKQUEUE Queue,
4826   IN OUT PLIST_ENTRY Entry);
4827 
4828 NTKERNELAPI
4829 LONG
4830 NTAPI
4831 KeInsertHeadQueue(
4832   IN OUT PRKQUEUE Queue,
4833   IN OUT PLIST_ENTRY Entry);
4834 
4835 NTKERNELAPI
4836 PLIST_ENTRY
4837 NTAPI
4838 KeRemoveQueue(
4839   IN OUT PRKQUEUE Queue,
4840   IN KPROCESSOR_MODE WaitMode,
4841   IN PLARGE_INTEGER Timeout OPTIONAL);
4842 
4843 NTKERNELAPI
4844 VOID
4845 NTAPI
4846 KeAttachProcess(
4847   IN OUT PKPROCESS Process);
4848 
4849 NTKERNELAPI
4850 VOID
4851 NTAPI
4852 KeDetachProcess(
4853   VOID);
4854 
4855 NTKERNELAPI
4856 PLIST_ENTRY
4857 NTAPI
4858 KeRundownQueue(
4859   IN OUT PRKQUEUE Queue);
4860 
4861 NTKERNELAPI
4862 VOID
4863 NTAPI
4864 KeStackAttachProcess(
4865   IN OUT PKPROCESS Process,
4866   OUT PKAPC_STATE ApcState);
4867 
4868 NTKERNELAPI
4869 VOID
4870 NTAPI
4871 KeUnstackDetachProcess(
4872   IN PKAPC_STATE ApcState);
4873 
4874 NTKERNELAPI
4875 UCHAR
4876 NTAPI
4877 KeSetIdealProcessorThread(
4878   IN OUT PKTHREAD Thread,
4879   IN UCHAR Processor);
4880 
4881 NTKERNELAPI
4882 BOOLEAN
4883 NTAPI
4884 KeSetKernelStackSwapEnable(
4885   IN BOOLEAN Enable);
4886 
4887 #if defined(_X86_)
4888 NTHALAPI
4889 KIRQL
4890 FASTCALL
4891 KeAcquireSpinLockRaiseToSynch(
4892   IN OUT PKSPIN_LOCK SpinLock);
4893 #else
4894 NTKERNELAPI
4895 KIRQL
4896 KeAcquireSpinLockRaiseToSynch(
4897   IN OUT PKSPIN_LOCK SpinLock);
4898 #endif
4899 
4900 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
4901 
4902 #if (NTDDI_VERSION >= NTDDI_WINXP)
4903 
4904 _DECL_HAL_KE_IMPORT
4905 KIRQL
4906 FASTCALL
4907 KeAcquireQueuedSpinLock(
4908   IN OUT KSPIN_LOCK_QUEUE_NUMBER Number);
4909 
4910 _DECL_HAL_KE_IMPORT
4911 VOID
4912 FASTCALL
4913 KeReleaseQueuedSpinLock(
4914   IN OUT KSPIN_LOCK_QUEUE_NUMBER Number,
4915   IN KIRQL OldIrql);
4916 
4917 _DECL_HAL_KE_IMPORT
4918 LOGICAL
4919 FASTCALL
4920 KeTryToAcquireQueuedSpinLock(
4921   IN KSPIN_LOCK_QUEUE_NUMBER Number,
4922   OUT PKIRQL OldIrql);
4923 
4924 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
4925 
4926 
4927 
4928 #if (NTDDI_VERSION >= NTDDI_VISTA)
4929 
4930 NTKERNELAPI
4931 VOID
4932 KeQueryOwnerMutant(
4933   IN PKMUTANT Mutant,
4934   OUT PCLIENT_ID ClientId);
4935 
4936 NTKERNELAPI
4937 ULONG
4938 KeRemoveQueueEx (
4939   IN OUT PKQUEUE Queue,
4940   IN KPROCESSOR_MODE WaitMode,
4941   IN BOOLEAN Alertable,
4942   IN PLARGE_INTEGER Timeout OPTIONAL,
4943   OUT PLIST_ENTRY *EntryArray,
4944   IN ULONG Count);
4945 
4946 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
4947 
4948 
4949 
4950 #define INVALID_PROCESSOR_INDEX     0xffffffff
4951 
4952 #define EX_PUSH_LOCK ULONG_PTR
4953 #define PEX_PUSH_LOCK PULONG_PTR
4954 
4955 /******************************************************************************
4956  *                          Executive Functions                               *
4957  ******************************************************************************/
4958 
4959 #define ExDisableResourceBoost ExDisableResourceBoostLite
4960 
4961 VOID
4962 ExInitializePushLock (
4963   OUT PEX_PUSH_LOCK PushLock);
4964 
4965 #if (NTDDI_VERSION >= NTDDI_WIN2K)
4966 
4967 NTKERNELAPI
4968 SIZE_T
4969 NTAPI
4970 ExQueryPoolBlockSize(
4971   IN PVOID PoolBlock,
4972   OUT PBOOLEAN QuotaCharged);
4973 
4974 VOID
4975 ExAdjustLookasideDepth(
4976   VOID);
4977 
4978 NTKERNELAPI
4979 VOID
4980 NTAPI
4981 ExDisableResourceBoostLite(
4982   IN PERESOURCE Resource);
4983 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
4984 
4985 #if (NTDDI_VERSION >= NTDDI_WINXP)
4986 
4987 PSLIST_ENTRY
4988 FASTCALL
4989 InterlockedPushListSList(
4990   IN OUT PSLIST_HEADER ListHead,
4991   IN OUT PSLIST_ENTRY List,
4992   IN OUT PSLIST_ENTRY ListEnd,
4993   IN ULONG Count);
4994 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
4995 
4996 /******************************************************************************
4997  *                            Security Manager Functions                      *
4998  ******************************************************************************/
4999 
5000 #if (NTDDI_VERSION >= NTDDI_WIN2K)
5001 
5002 NTKERNELAPI
5003 VOID
5004 NTAPI
5005 SeReleaseSubjectContext(
5006   IN PSECURITY_SUBJECT_CONTEXT SubjectContext);
5007 
5008 NTKERNELAPI
5009 BOOLEAN
5010 NTAPI
5011 SePrivilegeCheck(
5012   IN OUT PPRIVILEGE_SET RequiredPrivileges,
5013   IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
5014   IN KPROCESSOR_MODE AccessMode);
5015 
5016 NTKERNELAPI
5017 VOID
5018 NTAPI
5019 SeOpenObjectAuditAlarm(
5020   IN PUNICODE_STRING ObjectTypeName,
5021   IN PVOID Object OPTIONAL,
5022   IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
5023   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5024   IN PACCESS_STATE AccessState,
5025   IN BOOLEAN ObjectCreated,
5026   IN BOOLEAN AccessGranted,
5027   IN KPROCESSOR_MODE AccessMode,
5028   OUT PBOOLEAN GenerateOnClose);
5029 
5030 NTKERNELAPI
5031 VOID
5032 NTAPI
5033 SeOpenObjectForDeleteAuditAlarm(
5034   IN PUNICODE_STRING ObjectTypeName,
5035   IN PVOID Object OPTIONAL,
5036   IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
5037   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5038   IN PACCESS_STATE AccessState,
5039   IN BOOLEAN ObjectCreated,
5040   IN BOOLEAN AccessGranted,
5041   IN KPROCESSOR_MODE AccessMode,
5042   OUT PBOOLEAN GenerateOnClose);
5043 
5044 NTKERNELAPI
5045 VOID
5046 NTAPI
5047 SeDeleteObjectAuditAlarm(
5048   IN PVOID Object,
5049   IN HANDLE Handle);
5050 
5051 NTKERNELAPI
5052 TOKEN_TYPE
5053 NTAPI
5054 SeTokenType(
5055   IN PACCESS_TOKEN Token);
5056 
5057 NTKERNELAPI
5058 BOOLEAN
5059 NTAPI
5060 SeTokenIsAdmin(
5061   IN PACCESS_TOKEN Token);
5062 
5063 NTKERNELAPI
5064 BOOLEAN
5065 NTAPI
5066 SeTokenIsRestricted(
5067   IN PACCESS_TOKEN Token);
5068 
5069 NTKERNELAPI
5070 NTSTATUS
5071 NTAPI
5072 SeQueryAuthenticationIdToken(
5073   IN PACCESS_TOKEN Token,
5074   OUT PLUID AuthenticationId);
5075 
5076 NTKERNELAPI
5077 NTSTATUS
5078 NTAPI
5079 SeQuerySessionIdToken(
5080   IN PACCESS_TOKEN Token,
5081   OUT PULONG SessionId);
5082 
5083 NTKERNELAPI
5084 NTSTATUS
5085 NTAPI
5086 SeCreateClientSecurity(
5087   IN PETHREAD ClientThread,
5088   IN PSECURITY_QUALITY_OF_SERVICE ClientSecurityQos,
5089   IN BOOLEAN RemoteSession,
5090   OUT PSECURITY_CLIENT_CONTEXT ClientContext);
5091 
5092 NTKERNELAPI
5093 VOID
5094 NTAPI
5095 SeImpersonateClient(
5096   IN PSECURITY_CLIENT_CONTEXT ClientContext,
5097   IN PETHREAD ServerThread OPTIONAL);
5098 
5099 NTKERNELAPI
5100 NTSTATUS
5101 NTAPI
5102 SeImpersonateClientEx(
5103   IN PSECURITY_CLIENT_CONTEXT ClientContext,
5104   IN PETHREAD ServerThread OPTIONAL);
5105 
5106 NTKERNELAPI
5107 NTSTATUS
5108 NTAPI
5109 SeCreateClientSecurityFromSubjectContext(
5110   IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
5111   IN PSECURITY_QUALITY_OF_SERVICE ClientSecurityQos,
5112   IN BOOLEAN ServerIsRemote,
5113   OUT PSECURITY_CLIENT_CONTEXT ClientContext);
5114 
5115 NTKERNELAPI
5116 NTSTATUS
5117 NTAPI
5118 SeQuerySecurityDescriptorInfo(
5119   IN PSECURITY_INFORMATION SecurityInformation,
5120   OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
5121   IN OUT PULONG Length,
5122   IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor);
5123 
5124 NTKERNELAPI
5125 NTSTATUS
5126 NTAPI
5127 SeSetSecurityDescriptorInfo(
5128   IN PVOID Object OPTIONAL,
5129   IN PSECURITY_INFORMATION SecurityInformation,
5130   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5131   IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
5132   IN POOL_TYPE PoolType,
5133   IN PGENERIC_MAPPING GenericMapping);
5134 
5135 NTKERNELAPI
5136 NTSTATUS
5137 NTAPI
5138 SeSetSecurityDescriptorInfoEx(
5139   IN PVOID Object OPTIONAL,
5140   IN PSECURITY_INFORMATION SecurityInformation,
5141   IN PSECURITY_DESCRIPTOR ModificationDescriptor,
5142   IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
5143   IN ULONG AutoInheritFlags,
5144   IN POOL_TYPE PoolType,
5145   IN PGENERIC_MAPPING GenericMapping);
5146 
5147 NTKERNELAPI
5148 NTSTATUS
5149 NTAPI
5150 SeAppendPrivileges(
5151   IN OUT PACCESS_STATE AccessState,
5152   IN PPRIVILEGE_SET Privileges);
5153 
5154 NTKERNELAPI
5155 BOOLEAN
5156 NTAPI
5157 SeAuditingFileEvents(
5158   IN BOOLEAN AccessGranted,
5159   IN PSECURITY_DESCRIPTOR SecurityDescriptor);
5160 
5161 NTKERNELAPI
5162 BOOLEAN
5163 NTAPI
5164 SeAuditingFileOrGlobalEvents(
5165   IN BOOLEAN AccessGranted,
5166   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5167   IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext);
5168 
5169 VOID
5170 NTAPI
5171 SeSetAccessStateGenericMapping(
5172   IN OUT PACCESS_STATE AccessState,
5173   IN PGENERIC_MAPPING GenericMapping);
5174 
5175 NTKERNELAPI
5176 NTSTATUS
5177 NTAPI
5178 SeRegisterLogonSessionTerminatedRoutine(
5179   IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine);
5180 
5181 NTKERNELAPI
5182 NTSTATUS
5183 NTAPI
5184 SeUnregisterLogonSessionTerminatedRoutine(
5185   IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine);
5186 
5187 NTKERNELAPI
5188 NTSTATUS
5189 NTAPI
5190 SeMarkLogonSessionForTerminationNotification(
5191   IN PLUID LogonId);
5192 
5193 NTKERNELAPI
5194 NTSTATUS
5195 NTAPI
5196 SeQueryInformationToken(
5197   IN PACCESS_TOKEN Token,
5198   IN TOKEN_INFORMATION_CLASS TokenInformationClass,
5199   OUT PVOID *TokenInformation);
5200 
5201 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
5202 #if (NTDDI_VERSION >= NTDDI_WIN2KSP3)
5203 NTKERNELAPI
5204 BOOLEAN
5205 NTAPI
5206 SeAuditingHardLinkEvents(
5207   IN BOOLEAN AccessGranted,
5208   IN PSECURITY_DESCRIPTOR SecurityDescriptor);
5209 #endif
5210 
5211 #if (NTDDI_VERSION >= NTDDI_WINXP)
5212 
5213 NTKERNELAPI
5214 NTSTATUS
5215 NTAPI
5216 SeFilterToken(
5217   IN PACCESS_TOKEN ExistingToken,
5218   IN ULONG Flags,
5219   IN PTOKEN_GROUPS SidsToDisable OPTIONAL,
5220   IN PTOKEN_PRIVILEGES PrivilegesToDelete OPTIONAL,
5221   IN PTOKEN_GROUPS RestrictedSids OPTIONAL,
5222   OUT PACCESS_TOKEN *FilteredToken);
5223 
5224 NTKERNELAPI
5225 VOID
5226 NTAPI
5227 SeAuditHardLinkCreation(
5228   IN PUNICODE_STRING FileName,
5229   IN PUNICODE_STRING LinkName,
5230   IN BOOLEAN bSuccess);
5231 
5232 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
5233 
5234 #if (NTDDI_VERSION >= NTDDI_WINXPSP2)
5235 
5236 NTKERNELAPI
5237 BOOLEAN
5238 NTAPI
5239 SeAuditingFileEventsWithContext(
5240   IN BOOLEAN AccessGranted,
5241   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5242   IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext OPTIONAL);
5243 
5244 NTKERNELAPI
5245 BOOLEAN
5246 NTAPI
5247 SeAuditingHardLinkEventsWithContext(
5248   IN BOOLEAN AccessGranted,
5249   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5250   IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext OPTIONAL);
5251 
5252 #endif
5253 
5254 
5255 #if (NTDDI_VERSION >= NTDDI_VISTA)
5256 
5257 NTKERNELAPI
5258 VOID
5259 NTAPI
5260 SeOpenObjectAuditAlarmWithTransaction(
5261   IN PUNICODE_STRING ObjectTypeName,
5262   IN PVOID Object OPTIONAL,
5263   IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
5264   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5265   IN PACCESS_STATE AccessState,
5266   IN BOOLEAN ObjectCreated,
5267   IN BOOLEAN AccessGranted,
5268   IN KPROCESSOR_MODE AccessMode,
5269   IN GUID *TransactionId OPTIONAL,
5270   OUT PBOOLEAN GenerateOnClose);
5271 
5272 NTKERNELAPI
5273 VOID
5274 NTAPI
5275 SeOpenObjectForDeleteAuditAlarmWithTransaction(
5276   IN PUNICODE_STRING ObjectTypeName,
5277   IN PVOID Object OPTIONAL,
5278   IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
5279   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5280   IN PACCESS_STATE AccessState,
5281   IN BOOLEAN ObjectCreated,
5282   IN BOOLEAN AccessGranted,
5283   IN KPROCESSOR_MODE AccessMode,
5284   IN GUID *TransactionId OPTIONAL,
5285   OUT PBOOLEAN GenerateOnClose);
5286 
5287 NTKERNELAPI
5288 VOID
5289 NTAPI
5290 SeExamineSacl(
5291   IN PACL Sacl,
5292   IN PACCESS_TOKEN Token,
5293   IN ACCESS_MASK DesiredAccess,
5294   IN BOOLEAN AccessGranted,
5295   OUT PBOOLEAN GenerateAudit,
5296   OUT PBOOLEAN GenerateAlarm);
5297 
5298 NTKERNELAPI
5299 VOID
5300 NTAPI
5301 SeDeleteObjectAuditAlarmWithTransaction(
5302   IN PVOID Object,
5303   IN HANDLE Handle,
5304   IN GUID *TransactionId OPTIONAL);
5305 
5306 NTKERNELAPI
5307 VOID
5308 NTAPI
5309 SeQueryTokenIntegrity(
5310   IN PACCESS_TOKEN Token,
5311   IN OUT PSID_AND_ATTRIBUTES IntegritySA);
5312 
5313 NTKERNELAPI
5314 NTSTATUS
5315 NTAPI
5316 SeSetSessionIdToken(
5317   IN PACCESS_TOKEN Token,
5318   IN ULONG SessionId);
5319 
5320 NTKERNELAPI
5321 VOID
5322 NTAPI
5323 SeAuditHardLinkCreationWithTransaction(
5324   IN PUNICODE_STRING FileName,
5325   IN PUNICODE_STRING LinkName,
5326   IN BOOLEAN bSuccess,
5327   IN GUID *TransactionId OPTIONAL);
5328 
5329 NTKERNELAPI
5330 VOID
5331 NTAPI
5332 SeAuditTransactionStateChange(
5333   IN GUID *TransactionId,
5334   IN GUID *ResourceManagerId,
5335   IN ULONG NewTransactionState);
5336 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
5337 
5338 #if (NTDDI_VERSION >= NTDDI_VISTA || (NTDDI_VERSION >= NTDDI_WINXPSP2 && NTDDI_VERSION < NTDDI_WS03))
5339 NTKERNELAPI
5340 BOOLEAN
5341 NTAPI
5342 SeTokenIsWriteRestricted(
5343   IN PACCESS_TOKEN Token);
5344 #endif
5345 
5346 #if (NTDDI_VERSION >= NTDDI_WIN7)
5347 
5348 NTKERNELAPI
5349 BOOLEAN
5350 NTAPI
5351 SeAuditingAnyFileEventsWithContext(
5352   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5353   IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext OPTIONAL);
5354 
5355 NTKERNELAPI
5356 VOID
5357 NTAPI
5358 SeExamineGlobalSacl(
5359   IN PUNICODE_STRING ObjectType,
5360   IN PACCESS_TOKEN Token,
5361   IN ACCESS_MASK DesiredAccess,
5362   IN BOOLEAN AccessGranted,
5363   IN OUT PBOOLEAN GenerateAudit,
5364   IN OUT PBOOLEAN GenerateAlarm OPTIONAL);
5365 
5366 NTKERNELAPI
5367 VOID
5368 NTAPI
5369 SeMaximumAuditMaskFromGlobalSacl(
5370   IN PUNICODE_STRING ObjectTypeName OPTIONAL,
5371   IN ACCESS_MASK GrantedAccess,
5372   IN PACCESS_TOKEN Token,
5373   IN OUT PACCESS_MASK AuditMask);
5374 
5375 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
5376 
5377 NTSTATUS
5378 NTAPI
5379 SeReportSecurityEventWithSubCategory(
5380   IN ULONG Flags,
5381   IN PUNICODE_STRING SourceName,
5382   IN PSID UserSid OPTIONAL,
5383   IN PSE_ADT_PARAMETER_ARRAY AuditParameters,
5384   IN ULONG AuditSubcategoryId);
5385 
5386 BOOLEAN
5387 NTAPI
5388 SeAccessCheckFromState(
5389   IN PSECURITY_DESCRIPTOR SecurityDescriptor,
5390   IN PTOKEN_ACCESS_INFORMATION PrimaryTokenInformation,
5391   IN PTOKEN_ACCESS_INFORMATION ClientTokenInformation OPTIONAL,
5392   IN ACCESS_MASK DesiredAccess,
5393   IN ACCESS_MASK PreviouslyGrantedAccess,
5394   OUT PPRIVILEGE_SET *Privileges OPTIONAL,
5395   IN PGENERIC_MAPPING GenericMapping,
5396   IN KPROCESSOR_MODE AccessMode,
5397   OUT PACCESS_MASK GrantedAccess,
5398   OUT PNTSTATUS AccessStatus);
5399 
5400 NTKERNELAPI
5401 VOID
5402 NTAPI
5403 SeFreePrivileges(
5404   IN PPRIVILEGE_SET Privileges);
5405 
5406 NTSTATUS
5407 NTAPI
5408 SeLocateProcessImageName(
5409   IN OUT PEPROCESS Process,
5410   OUT PUNICODE_STRING *pImageFileName);
5411 
5412 #define SeLengthSid( Sid ) \
5413     (8 + (4 * ((SID *)Sid)->SubAuthorityCount))
5414 
5415 #define SeDeleteClientSecurity(C)  {                                           \
5416             if (SeTokenType((C)->ClientToken) == TokenPrimary) {               \
5417                 PsDereferencePrimaryToken( (C)->ClientToken );                 \
5418             } else {                                                           \
5419                 PsDereferenceImpersonationToken( (C)->ClientToken );           \
5420             }                                                                  \
5421 }
5422 
5423 #define SeStopImpersonatingClient() PsRevertToSelf()
5424 
5425 #define SeQuerySubjectContextToken( SubjectContext )                \
5426     ( ARGUMENT_PRESENT(                                             \
5427         ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken   \
5428         ) ?                                                         \
5429     ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->ClientToken :     \
5430     ((PSECURITY_SUBJECT_CONTEXT) SubjectContext)->PrimaryToken )
5431 
5432 extern NTKERNELAPI PSE_EXPORTS SeExports;
5433 /******************************************************************************
5434  *                          Process Manager Functions                         *
5435  ******************************************************************************/
5436 
5437 NTKERNELAPI
5438 NTSTATUS
5439 NTAPI
5440 PsLookupProcessByProcessId(
5441   IN HANDLE ProcessId,
5442   OUT PEPROCESS *Process);
5443 
5444 NTKERNELAPI
5445 NTSTATUS
5446 NTAPI
5447 PsLookupThreadByThreadId(
5448   IN HANDLE UniqueThreadId,
5449   OUT PETHREAD *Thread);
5450 
5451 #if (NTDDI_VERSION >= NTDDI_WIN2K)
5452 
5453 
5454 NTKERNELAPI
5455 PACCESS_TOKEN
5456 NTAPI
5457 PsReferenceImpersonationToken(
5458   IN OUT PETHREAD Thread,
5459   OUT PBOOLEAN CopyOnOpen,
5460   OUT PBOOLEAN EffectiveOnly,
5461   OUT PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel);
5462 
5463 NTKERNELAPI
5464 LARGE_INTEGER
5465 NTAPI
5466 PsGetProcessExitTime(VOID);
5467 
5468 NTKERNELAPI
5469 BOOLEAN
5470 NTAPI
5471 PsIsThreadTerminating(
5472   IN PETHREAD Thread);
5473 
5474 NTKERNELAPI
5475 NTSTATUS
5476 NTAPI
5477 PsImpersonateClient(
5478   IN OUT PETHREAD Thread,
5479   IN PACCESS_TOKEN Token,
5480   IN BOOLEAN CopyOnOpen,
5481   IN BOOLEAN EffectiveOnly,
5482   IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel);
5483 
5484 NTKERNELAPI
5485 BOOLEAN
5486 NTAPI
5487 PsDisableImpersonation(
5488   IN OUT PETHREAD Thread,
5489   IN OUT PSE_IMPERSONATION_STATE ImpersonationState);
5490 
5491 NTKERNELAPI
5492 VOID
5493 NTAPI
5494 PsRestoreImpersonation(
5495   IN PETHREAD Thread,
5496   IN PSE_IMPERSONATION_STATE ImpersonationState);
5497 
5498 NTKERNELAPI
5499 VOID
5500 NTAPI
5501 PsRevertToSelf(VOID);
5502 
5503 NTKERNELAPI
5504 VOID
5505 NTAPI
5506 PsChargePoolQuota(
5507   IN PEPROCESS Process,
5508   IN POOL_TYPE PoolType,
5509   IN ULONG_PTR Amount);
5510 
5511 NTKERNELAPI
5512 VOID
5513 NTAPI
5514 PsReturnPoolQuota(
5515   IN PEPROCESS Process,
5516   IN POOL_TYPE PoolType,
5517   IN ULONG_PTR Amount);
5518 
5519 NTKERNELAPI
5520 NTSTATUS
5521 NTAPI
5522 PsAssignImpersonationToken(
5523   IN PETHREAD Thread,
5524   IN HANDLE Token OPTIONAL);
5525 
5526 NTKERNELAPI
5527 HANDLE
5528 NTAPI
5529 PsReferencePrimaryToken(
5530   IN OUT PEPROCESS Process);
5531 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
5532 #if (NTDDI_VERSION >= NTDDI_WINXP)
5533 
5534 
5535 NTKERNELAPI
5536 VOID
5537 NTAPI
5538 PsDereferencePrimaryToken(
5539   IN PACCESS_TOKEN PrimaryToken);
5540 
5541 NTKERNELAPI
5542 VOID
5543 NTAPI
5544 PsDereferenceImpersonationToken(
5545   IN PACCESS_TOKEN ImpersonationToken);
5546 
5547 NTKERNELAPI
5548 NTSTATUS
5549 NTAPI
5550 PsChargeProcessPoolQuota(
5551   IN PEPROCESS Process,
5552   IN POOL_TYPE PoolType,
5553   IN ULONG_PTR Amount);
5554 
5555 NTKERNELAPI
5556 BOOLEAN
5557 NTAPI
5558 PsIsSystemThread(
5559   IN PETHREAD Thread);
5560 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
5561 
5562 /******************************************************************************
5563  *                         I/O Manager Functions                              *
5564  ******************************************************************************/
5565 
5566 #define IoIsFileOpenedExclusively(FileObject) ( \
5567     (BOOLEAN) !(                                \
5568     (FileObject)->SharedRead ||                 \
5569     (FileObject)->SharedWrite ||                \
5570     (FileObject)->SharedDelete                  \
5571     )                                           \
5572 )
5573 
5574 #if (NTDDI_VERSION == NTDDI_WIN2K)
5575 NTKERNELAPI
5576 NTSTATUS
5577 NTAPI
5578 IoRegisterFsRegistrationChangeEx(
5579   IN PDRIVER_OBJECT DriverObject,
5580   IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine);
5581 #endif
5582 #if (NTDDI_VERSION >= NTDDI_WIN2K)
5583 
5584 
5585 NTKERNELAPI
5586 VOID
5587 NTAPI
5588 IoAcquireVpbSpinLock(
5589   OUT PKIRQL Irql);
5590 
5591 NTKERNELAPI
5592 NTSTATUS
5593 NTAPI
5594 IoCheckDesiredAccess(
5595   IN OUT PACCESS_MASK DesiredAccess,
5596   IN ACCESS_MASK GrantedAccess);
5597 
5598 NTKERNELAPI
5599 NTSTATUS
5600 NTAPI
5601 IoCheckEaBufferValidity(
5602   IN PFILE_FULL_EA_INFORMATION EaBuffer,
5603   IN ULONG EaLength,
5604   OUT PULONG ErrorOffset);
5605 
5606 NTKERNELAPI
5607 NTSTATUS
5608 NTAPI
5609 IoCheckFunctionAccess(
5610   IN ACCESS_MASK GrantedAccess,
5611   IN UCHAR MajorFunction,
5612   IN UCHAR MinorFunction,
5613   IN ULONG IoControlCode,
5614   IN PVOID Argument1 OPTIONAL,
5615   IN PVOID Argument2 OPTIONAL);
5616 
5617 NTKERNELAPI
5618 NTSTATUS
5619 NTAPI
5620 IoCheckQuerySetFileInformation(
5621   IN FILE_INFORMATION_CLASS FileInformationClass,
5622   IN ULONG Length,
5623   IN BOOLEAN SetOperation);
5624 
5625 NTKERNELAPI
5626 NTSTATUS
5627 NTAPI
5628 IoCheckQuerySetVolumeInformation(
5629   IN FS_INFORMATION_CLASS FsInformationClass,
5630   IN ULONG Length,
5631   IN BOOLEAN SetOperation);
5632 
5633 NTKERNELAPI
5634 NTSTATUS
5635 NTAPI
5636 IoCheckQuotaBufferValidity(
5637   IN PFILE_QUOTA_INFORMATION QuotaBuffer,
5638   IN ULONG QuotaLength,
5639   OUT PULONG ErrorOffset);
5640 
5641 NTKERNELAPI
5642 PFILE_OBJECT
5643 NTAPI
5644 IoCreateStreamFileObject(
5645   IN PFILE_OBJECT FileObject OPTIONAL,
5646   IN PDEVICE_OBJECT DeviceObject OPTIONAL);
5647 
5648 NTKERNELAPI
5649 PFILE_OBJECT
5650 NTAPI
5651 IoCreateStreamFileObjectLite(
5652   IN PFILE_OBJECT FileObject OPTIONAL,
5653   IN PDEVICE_OBJECT DeviceObject OPTIONAL);
5654 
5655 NTKERNELAPI
5656 BOOLEAN
5657 NTAPI
5658 IoFastQueryNetworkAttributes(
5659   IN POBJECT_ATTRIBUTES ObjectAttributes,
5660   IN ACCESS_MASK DesiredAccess,
5661   IN ULONG OpenOptions,
5662   OUT PIO_STATUS_BLOCK IoStatus,
5663   OUT PFILE_NETWORK_OPEN_INFORMATION Buffer);
5664 
5665 NTKERNELAPI
5666 NTSTATUS
5667 NTAPI
5668 IoPageRead(
5669   IN PFILE_OBJECT FileObject,
5670   IN PMDL Mdl,
5671   IN PLARGE_INTEGER Offset,
5672   IN PKEVENT Event,
5673   OUT PIO_STATUS_BLOCK IoStatusBlock);
5674 
5675 NTKERNELAPI
5676 PDEVICE_OBJECT
5677 NTAPI
5678 IoGetBaseFileSystemDeviceObject(
5679   IN PFILE_OBJECT FileObject);
5680 
5681 NTKERNELAPI
5682 PCONFIGURATION_INFORMATION
5683 NTAPI
5684 IoGetConfigurationInformation(VOID);
5685 
5686 NTKERNELAPI
5687 ULONG
5688 NTAPI
5689 IoGetRequestorProcessId(
5690   IN PIRP Irp);
5691 
5692 NTKERNELAPI
5693 PEPROCESS
5694 NTAPI
5695 IoGetRequestorProcess(
5696   IN PIRP Irp);
5697 
5698 NTKERNELAPI
5699 PIRP
5700 NTAPI
5701 IoGetTopLevelIrp(VOID);
5702 
5703 NTKERNELAPI
5704 BOOLEAN
5705 NTAPI
5706 IoIsOperationSynchronous(
5707   IN PIRP Irp);
5708 
5709 NTKERNELAPI
5710 BOOLEAN
5711 NTAPI
5712 IoIsSystemThread(
5713   IN PETHREAD Thread);
5714 
5715 NTKERNELAPI
5716 BOOLEAN
5717 NTAPI
5718 IoIsValidNameGraftingBuffer(
5719   IN PIRP Irp,
5720   IN PREPARSE_DATA_BUFFER ReparseBuffer);
5721 
5722 NTKERNELAPI
5723 NTSTATUS
5724 NTAPI
5725 IoQueryFileInformation(
5726   IN PFILE_OBJECT FileObject,
5727   IN FILE_INFORMATION_CLASS FileInformationClass,
5728   IN ULONG Length,
5729   OUT PVOID FileInformation,
5730   OUT PULONG ReturnedLength);
5731 
5732 NTKERNELAPI
5733 NTSTATUS
5734 NTAPI
5735 IoQueryVolumeInformation(
5736   IN PFILE_OBJECT FileObject,
5737   IN FS_INFORMATION_CLASS FsInformationClass,
5738   IN ULONG Length,
5739   OUT PVOID FsInformation,
5740   OUT PULONG ReturnedLength);
5741 
5742 NTKERNELAPI
5743 VOID
5744 NTAPI
5745 IoQueueThreadIrp(
5746   IN PIRP Irp);
5747 
5748 NTKERNELAPI
5749 VOID
5750 NTAPI
5751 IoRegisterFileSystem(
5752   IN PDEVICE_OBJECT DeviceObject);
5753 
5754 NTKERNELAPI
5755 NTSTATUS
5756 NTAPI
5757 IoRegisterFsRegistrationChange(
5758   IN PDRIVER_OBJECT DriverObject,
5759   IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine);
5760 
5761 NTKERNELAPI
5762 VOID
5763 NTAPI
5764 IoReleaseVpbSpinLock(
5765   IN KIRQL Irql);
5766 
5767 NTKERNELAPI
5768 VOID
5769 NTAPI
5770 IoSetDeviceToVerify(
5771   IN PETHREAD Thread,
5772   IN PDEVICE_OBJECT DeviceObject OPTIONAL);
5773 
5774 NTKERNELAPI
5775 NTSTATUS
5776 NTAPI
5777 IoSetInformation(
5778   IN PFILE_OBJECT FileObject,
5779   IN FILE_INFORMATION_CLASS FileInformationClass,
5780   IN ULONG Length,
5781   IN PVOID FileInformation);
5782 
5783 NTKERNELAPI
5784 VOID
5785 NTAPI
5786 IoSetTopLevelIrp(
5787   IN PIRP Irp OPTIONAL);
5788 
5789 NTKERNELAPI
5790 NTSTATUS
5791 NTAPI
5792 IoSynchronousPageWrite(
5793   IN PFILE_OBJECT FileObject,
5794   IN PMDL Mdl,
5795   IN PLARGE_INTEGER FileOffset,
5796   IN PKEVENT Event,
5797   OUT PIO_STATUS_BLOCK IoStatusBlock);
5798 
5799 NTKERNELAPI
5800 PEPROCESS
5801 NTAPI
5802 IoThreadToProcess(
5803   IN PETHREAD Thread);
5804 
5805 NTKERNELAPI
5806 VOID
5807 NTAPI
5808 IoUnregisterFileSystem(
5809   IN PDEVICE_OBJECT DeviceObject);
5810 
5811 NTKERNELAPI
5812 VOID
5813 NTAPI
5814 IoUnregisterFsRegistrationChange(
5815   IN PDRIVER_OBJECT DriverObject,
5816   IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine);
5817 
5818 NTKERNELAPI
5819 NTSTATUS
5820 NTAPI
5821 IoVerifyVolume(
5822   IN PDEVICE_OBJECT DeviceObject,
5823   IN BOOLEAN AllowRawMount);
5824 
5825 NTKERNELAPI
5826 NTSTATUS
5827 NTAPI
5828 IoGetRequestorSessionId(
5829   IN PIRP Irp,
5830   OUT PULONG pSessionId);
5831 
5832 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
5833 
5834 
5835 #if (NTDDI_VERSION >= NTDDI_WINXP)
5836 
5837 NTKERNELAPI
5838 PFILE_OBJECT
5839 NTAPI
5840 IoCreateStreamFileObjectEx(
5841   IN PFILE_OBJECT FileObject OPTIONAL,
5842   IN PDEVICE_OBJECT DeviceObject OPTIONAL,
5843   OUT PHANDLE FileObjectHandle OPTIONAL);
5844 
5845 NTKERNELAPI
5846 NTSTATUS
5847 NTAPI
5848 IoQueryFileDosDeviceName(
5849   IN PFILE_OBJECT FileObject,
5850   OUT POBJECT_NAME_INFORMATION *ObjectNameInformation);
5851 
5852 NTKERNELAPI
5853 NTSTATUS
5854 NTAPI
5855 IoEnumerateDeviceObjectList(
5856   IN PDRIVER_OBJECT DriverObject,
5857   OUT PDEVICE_OBJECT *DeviceObjectList,
5858   IN ULONG DeviceObjectListSize,
5859   OUT PULONG ActualNumberDeviceObjects);
5860 
5861 NTKERNELAPI
5862 PDEVICE_OBJECT
5863 NTAPI
5864 IoGetLowerDeviceObject(
5865   IN PDEVICE_OBJECT DeviceObject);
5866 
5867 NTKERNELAPI
5868 PDEVICE_OBJECT
5869 NTAPI
5870 IoGetDeviceAttachmentBaseRef(
5871   IN PDEVICE_OBJECT DeviceObject);
5872 
5873 NTKERNELAPI
5874 NTSTATUS
5875 NTAPI
5876 IoGetDiskDeviceObject(
5877   IN PDEVICE_OBJECT FileSystemDeviceObject,
5878   OUT PDEVICE_OBJECT *DiskDeviceObject);
5879 
5880 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
5881 
5882 #if (NTDDI_VERSION >= NTDDI_WS03SP1)
5883 
5884 NTKERNELAPI
5885 NTSTATUS
5886 NTAPI
5887 IoEnumerateRegisteredFiltersList(
5888   OUT PDRIVER_OBJECT *DriverObjectList,
5889   IN ULONG DriverObjectListSize,
5890   OUT PULONG ActualNumberDriverObjects);
5891 #endif /* (NTDDI_VERSION >= NTDDI_WS03SP1) */
5892 
5893 #if (NTDDI_VERSION >= NTDDI_VISTA)
5894 
5895 FORCEINLINE
5896 VOID
5897 NTAPI
IoInitializePriorityInfo(IN PIO_PRIORITY_INFO PriorityInfo)5898 IoInitializePriorityInfo(
5899   IN PIO_PRIORITY_INFO PriorityInfo)
5900 {
5901   PriorityInfo->Size = sizeof(IO_PRIORITY_INFO);
5902   PriorityInfo->ThreadPriority = 0xffff;
5903   PriorityInfo->IoPriority = IoPriorityNormal;
5904   PriorityInfo->PagePriority = 0;
5905 }
5906 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
5907 
5908 #if (NTDDI_VERSION >= NTDDI_WIN7)
5909 
5910 NTKERNELAPI
5911 NTSTATUS
5912 NTAPI
5913 IoRegisterFsRegistrationChangeMountAware(
5914   IN PDRIVER_OBJECT DriverObject,
5915   IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine,
5916   IN BOOLEAN SynchronizeWithMounts);
5917 
5918 NTKERNELAPI
5919 NTSTATUS
5920 NTAPI
5921 IoReplaceFileObjectName(
5922   IN PFILE_OBJECT FileObject,
5923   IN PWSTR NewFileName,
5924   IN USHORT FileNameLength);
5925 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
5926 
5927 
5928 #define PO_CB_SYSTEM_POWER_POLICY       0
5929 #define PO_CB_AC_STATUS                 1
5930 #define PO_CB_BUTTON_COLLISION          2
5931 #define PO_CB_SYSTEM_STATE_LOCK         3
5932 #define PO_CB_LID_SWITCH_STATE          4
5933 #define PO_CB_PROCESSOR_POWER_POLICY    5
5934 
5935 
5936 #if (NTDDI_VERSION >= NTDDI_WINXP)
5937 NTKERNELAPI
5938 NTSTATUS
5939 NTAPI
5940 PoQueueShutdownWorkItem(
5941   IN OUT PWORK_QUEUE_ITEM WorkItem);
5942 #endif
5943 
5944 /******************************************************************************
5945  *                         Memory manager Types                               *
5946  ******************************************************************************/
5947 
5948 typedef enum _MMFLUSH_TYPE {
5949   MmFlushForDelete,
5950   MmFlushForWrite
5951 } MMFLUSH_TYPE;
5952 
5953 typedef struct _READ_LIST {
5954   PFILE_OBJECT FileObject;
5955   ULONG NumberOfEntries;
5956   LOGICAL IsImage;
5957   FILE_SEGMENT_ELEMENT List[ANYSIZE_ARRAY];
5958 } READ_LIST, *PREAD_LIST;
5959 
5960 #if (NTDDI_VERSION >= NTDDI_WINXP)
5961 
5962 typedef union _MM_PREFETCH_FLAGS {
5963   struct {
5964     ULONG Priority : SYSTEM_PAGE_PRIORITY_BITS;
5965     ULONG RepurposePriority : SYSTEM_PAGE_PRIORITY_BITS;
5966   } Flags;
5967   ULONG AllFlags;
5968 } MM_PREFETCH_FLAGS, *PMM_PREFETCH_FLAGS;
5969 
5970 #define MM_PREFETCH_FLAGS_MASK ((1 << (2*SYSTEM_PAGE_PRIORITY_BITS)) - 1)
5971 
5972 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
5973 
5974 #define HEAP_NO_SERIALIZE               0x00000001
5975 #define HEAP_GROWABLE                   0x00000002
5976 #define HEAP_GENERATE_EXCEPTIONS        0x00000004
5977 #define HEAP_ZERO_MEMORY                0x00000008
5978 #define HEAP_REALLOC_IN_PLACE_ONLY      0x00000010
5979 #define HEAP_TAIL_CHECKING_ENABLED      0x00000020
5980 #define HEAP_FREE_CHECKING_ENABLED      0x00000040
5981 #define HEAP_DISABLE_COALESCE_ON_FREE   0x00000080
5982 
5983 #define HEAP_CREATE_ALIGN_16            0x00010000
5984 #define HEAP_CREATE_ENABLE_TRACING      0x00020000
5985 #define HEAP_CREATE_ENABLE_EXECUTE      0x00040000
5986 
5987 #define HEAP_SETTABLE_USER_VALUE        0x00000100
5988 #define HEAP_SETTABLE_USER_FLAG1        0x00000200
5989 #define HEAP_SETTABLE_USER_FLAG2        0x00000400
5990 #define HEAP_SETTABLE_USER_FLAG3        0x00000800
5991 #define HEAP_SETTABLE_USER_FLAGS        0x00000E00
5992 
5993 #define HEAP_CLASS_0                    0x00000000
5994 #define HEAP_CLASS_1                    0x00001000
5995 #define HEAP_CLASS_2                    0x00002000
5996 #define HEAP_CLASS_3                    0x00003000
5997 #define HEAP_CLASS_4                    0x00004000
5998 #define HEAP_CLASS_5                    0x00005000
5999 #define HEAP_CLASS_6                    0x00006000
6000 #define HEAP_CLASS_7                    0x00007000
6001 #define HEAP_CLASS_8                    0x00008000
6002 #define HEAP_CLASS_MASK                 0x0000F000
6003 
6004 #define HEAP_MAXIMUM_TAG                0x0FFF
6005 #define HEAP_GLOBAL_TAG                 0x0800
6006 #define HEAP_PSEUDO_TAG_FLAG            0x8000
6007 #define HEAP_TAG_SHIFT                  18
6008 #define HEAP_TAG_MASK                  (HEAP_MAXIMUM_TAG << HEAP_TAG_SHIFT)
6009 
6010 #define HEAP_CREATE_VALID_MASK         (HEAP_NO_SERIALIZE             |   \
6011                                         HEAP_GROWABLE                 |   \
6012                                         HEAP_GENERATE_EXCEPTIONS      |   \
6013                                         HEAP_ZERO_MEMORY              |   \
6014                                         HEAP_REALLOC_IN_PLACE_ONLY    |   \
6015                                         HEAP_TAIL_CHECKING_ENABLED    |   \
6016                                         HEAP_FREE_CHECKING_ENABLED    |   \
6017                                         HEAP_DISABLE_COALESCE_ON_FREE |   \
6018                                         HEAP_CLASS_MASK               |   \
6019                                         HEAP_CREATE_ALIGN_16          |   \
6020                                         HEAP_CREATE_ENABLE_TRACING    |   \
6021                                         HEAP_CREATE_ENABLE_EXECUTE)
6022 
6023 /******************************************************************************
6024  *                       Memory manager Functions                             *
6025  ******************************************************************************/
6026 
6027 FORCEINLINE
6028 ULONG
HEAP_MAKE_TAG_FLAGS(IN ULONG TagBase,IN ULONG Tag)6029 HEAP_MAKE_TAG_FLAGS(
6030   IN ULONG TagBase,
6031   IN ULONG Tag)
6032 {
6033   //__assume_bound(TagBase); // FIXME
6034   return ((ULONG)((TagBase) + ((Tag) << HEAP_TAG_SHIFT)));
6035 }
6036 
6037 #if (NTDDI_VERSION >= NTDDI_WIN2K)
6038 
6039 NTKERNELAPI
6040 BOOLEAN
6041 NTAPI
6042 MmIsRecursiveIoFault(
6043   VOID);
6044 
6045 NTKERNELAPI
6046 BOOLEAN
6047 NTAPI
6048 MmForceSectionClosed(
6049   IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
6050   IN BOOLEAN DelayClose);
6051 
6052 NTKERNELAPI
6053 BOOLEAN
6054 NTAPI
6055 MmFlushImageSection(
6056   IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
6057   IN MMFLUSH_TYPE FlushType);
6058 
6059 NTKERNELAPI
6060 BOOLEAN
6061 NTAPI
6062 MmCanFileBeTruncated(
6063   IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
6064   IN PLARGE_INTEGER NewFileSize OPTIONAL);
6065 
6066 NTKERNELAPI
6067 BOOLEAN
6068 NTAPI
6069 MmSetAddressRangeModified(
6070   IN PVOID Address,
6071   IN SIZE_T Length);
6072 
6073 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
6074 
6075 #if (NTDDI_VERSION >= NTDDI_WINXP)
6076 
6077 NTKERNELAPI
6078 NTSTATUS
6079 NTAPI
6080 MmPrefetchPages(
6081   IN ULONG NumberOfLists,
6082   IN PREAD_LIST *ReadLists);
6083 
6084 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
6085 
6086 
6087 #if (NTDDI_VERSION >= NTDDI_VISTA)
6088 
6089 NTKERNELAPI
6090 ULONG
6091 NTAPI
6092 MmDoesFileHaveUserWritableReferences(
6093   IN PSECTION_OBJECT_POINTERS SectionPointer);
6094 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
6095 
6096 
6097 #if (NTDDI_VERSION >= NTDDI_WIN2K)
6098 
6099 NTKERNELAPI
6100 NTSTATUS
6101 NTAPI
6102 ObInsertObject(
6103   IN PVOID Object,
6104   IN OUT PACCESS_STATE PassedAccessState OPTIONAL,
6105   IN ACCESS_MASK DesiredAccess OPTIONAL,
6106   IN ULONG ObjectPointerBias,
6107   OUT PVOID *NewObject OPTIONAL,
6108   OUT PHANDLE Handle OPTIONAL);
6109 
6110 NTKERNELAPI
6111 NTSTATUS
6112 NTAPI
6113 ObOpenObjectByPointer(
6114   IN PVOID Object,
6115   IN ULONG HandleAttributes,
6116   IN PACCESS_STATE PassedAccessState OPTIONAL,
6117   IN ACCESS_MASK DesiredAccess OPTIONAL,
6118   IN POBJECT_TYPE ObjectType OPTIONAL,
6119   IN KPROCESSOR_MODE AccessMode,
6120   OUT PHANDLE Handle);
6121 
6122 NTKERNELAPI
6123 VOID
6124 NTAPI
6125 ObMakeTemporaryObject(
6126   IN PVOID Object);
6127 
6128 NTKERNELAPI
6129 NTSTATUS
6130 NTAPI
6131 ObQueryNameString(
6132   IN PVOID Object,
6133   OUT POBJECT_NAME_INFORMATION ObjectNameInfo OPTIONAL,
6134   IN ULONG Length,
6135   OUT PULONG ReturnLength);
6136 
6137 NTKERNELAPI
6138 NTSTATUS
6139 NTAPI
6140 ObQueryObjectAuditingByHandle(
6141   IN HANDLE Handle,
6142   OUT PBOOLEAN GenerateOnClose);
6143 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
6144 
6145 #if (NTDDI_VERSION >= NTDDI_VISTA)
6146 
6147 NTKERNELAPI
6148 BOOLEAN
6149 NTAPI
6150 ObIsKernelHandle(
6151   IN HANDLE Handle);
6152 #endif
6153 
6154 
6155 #if (NTDDI_VERSION >= NTDDI_WIN7)
6156 
6157 NTKERNELAPI
6158 NTSTATUS
6159 NTAPI
6160 ObOpenObjectByPointerWithTag(
6161   IN PVOID Object,
6162   IN ULONG HandleAttributes,
6163   IN PACCESS_STATE PassedAccessState OPTIONAL,
6164   IN ACCESS_MASK DesiredAccess,
6165   IN POBJECT_TYPE ObjectType OPTIONAL,
6166   IN KPROCESSOR_MODE AccessMode,
6167   IN ULONG Tag,
6168   OUT PHANDLE Handle);
6169 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
6170 
6171 /* FSRTL Types */
6172 
6173 typedef ULONG LBN;
6174 typedef LBN *PLBN;
6175 
6176 typedef ULONG VBN;
6177 typedef VBN *PVBN;
6178 
6179 #define FSRTL_COMMON_FCB_HEADER_LAYOUT \
6180   CSHORT NodeTypeCode; \
6181   CSHORT NodeByteSize; \
6182   UCHAR Flags; \
6183   UCHAR IsFastIoPossible; \
6184   UCHAR Flags2; \
6185   UCHAR Reserved:4; \
6186   UCHAR Version:4; \
6187   PERESOURCE Resource; \
6188   PERESOURCE PagingIoResource; \
6189   LARGE_INTEGER AllocationSize; \
6190   LARGE_INTEGER FileSize; \
6191   LARGE_INTEGER ValidDataLength;
6192 
6193 typedef struct _FSRTL_COMMON_FCB_HEADER {
6194   FSRTL_COMMON_FCB_HEADER_LAYOUT
6195 } FSRTL_COMMON_FCB_HEADER, *PFSRTL_COMMON_FCB_HEADER;
6196 
6197 #ifdef __cplusplus
6198 typedef struct _FSRTL_ADVANCED_FCB_HEADER:FSRTL_COMMON_FCB_HEADER {
6199 #else /* __cplusplus */
6200 typedef struct _FSRTL_ADVANCED_FCB_HEADER {
6201   FSRTL_COMMON_FCB_HEADER_LAYOUT
6202 #endif  /* __cplusplus */
6203   PFAST_MUTEX FastMutex;
6204   LIST_ENTRY FilterContexts;
6205 #if (NTDDI_VERSION >= NTDDI_VISTA)
6206   EX_PUSH_LOCK PushLock;
6207   PVOID *FileContextSupportPointer;
6208 #endif
6209 } FSRTL_ADVANCED_FCB_HEADER, *PFSRTL_ADVANCED_FCB_HEADER;
6210 
6211 #define FSRTL_FCB_HEADER_V0             (0x00)
6212 #define FSRTL_FCB_HEADER_V1             (0x01)
6213 
6214 #define FSRTL_FLAG_FILE_MODIFIED        (0x01)
6215 #define FSRTL_FLAG_FILE_LENGTH_CHANGED  (0x02)
6216 #define FSRTL_FLAG_LIMIT_MODIFIED_PAGES (0x04)
6217 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_EX (0x08)
6218 #define FSRTL_FLAG_ACQUIRE_MAIN_RSRC_SH (0x10)
6219 #define FSRTL_FLAG_USER_MAPPED_FILE     (0x20)
6220 #define FSRTL_FLAG_ADVANCED_HEADER      (0x40)
6221 #define FSRTL_FLAG_EOF_ADVANCE_ACTIVE   (0x80)
6222 
6223 #define FSRTL_FLAG2_DO_MODIFIED_WRITE        (0x01)
6224 #define FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS (0x02)
6225 #define FSRTL_FLAG2_PURGE_WHEN_MAPPED        (0x04)
6226 #define FSRTL_FLAG2_IS_PAGING_FILE           (0x08)
6227 
6228 #define FSRTL_FSP_TOP_LEVEL_IRP         (0x01)
6229 #define FSRTL_CACHE_TOP_LEVEL_IRP       (0x02)
6230 #define FSRTL_MOD_WRITE_TOP_LEVEL_IRP   (0x03)
6231 #define FSRTL_FAST_IO_TOP_LEVEL_IRP     (0x04)
6232 #define FSRTL_NETWORK1_TOP_LEVEL_IRP    ((LONG_PTR)0x05)
6233 #define FSRTL_NETWORK2_TOP_LEVEL_IRP    ((LONG_PTR)0x06)
6234 #define FSRTL_MAX_TOP_LEVEL_IRP_FLAG    ((LONG_PTR)0xFFFF)
6235 
6236 typedef struct _FSRTL_AUXILIARY_BUFFER {
6237   PVOID Buffer;
6238   ULONG Length;
6239   ULONG Flags;
6240   PMDL Mdl;
6241 } FSRTL_AUXILIARY_BUFFER, *PFSRTL_AUXILIARY_BUFFER;
6242 
6243 #define FSRTL_AUXILIARY_FLAG_DEALLOCATE 0x00000001
6244 
6245 typedef enum _FSRTL_COMPARISON_RESULT {
6246   LessThan = -1,
6247   EqualTo = 0,
6248   GreaterThan = 1
6249 } FSRTL_COMPARISON_RESULT;
6250 
6251 #define FSRTL_FAT_LEGAL                 0x01
6252 #define FSRTL_HPFS_LEGAL                0x02
6253 #define FSRTL_NTFS_LEGAL                0x04
6254 #define FSRTL_WILD_CHARACTER            0x08
6255 #define FSRTL_OLE_LEGAL                 0x10
6256 #define FSRTL_NTFS_STREAM_LEGAL         (FSRTL_NTFS_LEGAL | FSRTL_OLE_LEGAL)
6257 
6258 #define FSRTL_VOLUME_DISMOUNT           1
6259 #define FSRTL_VOLUME_DISMOUNT_FAILED    2
6260 #define FSRTL_VOLUME_LOCK               3
6261 #define FSRTL_VOLUME_LOCK_FAILED        4
6262 #define FSRTL_VOLUME_UNLOCK             5
6263 #define FSRTL_VOLUME_MOUNT              6
6264 #define FSRTL_VOLUME_NEEDS_CHKDSK       7
6265 #define FSRTL_VOLUME_WORM_NEAR_FULL     8
6266 #define FSRTL_VOLUME_WEARING_OUT        9
6267 #define FSRTL_VOLUME_FORCED_CLOSED      10
6268 #define FSRTL_VOLUME_INFO_MAKE_COMPAT   11
6269 #define FSRTL_VOLUME_PREPARING_EJECT    12
6270 #define FSRTL_VOLUME_CHANGE_SIZE        13
6271 #define FSRTL_VOLUME_BACKGROUND_FORMAT  14
6272 
6273 typedef VOID
6274 (NTAPI *PFSRTL_STACK_OVERFLOW_ROUTINE) (
6275   IN PVOID Context,
6276   IN PKEVENT Event);
6277 
6278 #if (NTDDI_VERSION >= NTDDI_VISTA)
6279 
6280 #define FSRTL_UNC_PROVIDER_FLAGS_MAILSLOTS_SUPPORTED    0x00000001
6281 #define FSRTL_UNC_PROVIDER_FLAGS_CSC_ENABLED            0x00000002
6282 #define FSRTL_UNC_PROVIDER_FLAGS_DOMAIN_SVC_AWARE       0x00000004
6283 
6284 #define FSRTL_ALLOCATE_ECPLIST_FLAG_CHARGE_QUOTA           0x00000001
6285 
6286 #define FSRTL_ALLOCATE_ECP_FLAG_CHARGE_QUOTA               0x00000001
6287 #define FSRTL_ALLOCATE_ECP_FLAG_NONPAGED_POOL              0x00000002
6288 
6289 #define FSRTL_ECP_LOOKASIDE_FLAG_NONPAGED_POOL             0x00000002
6290 
6291 #define FSRTL_VIRTDISK_FULLY_ALLOCATED  0x00000001
6292 #define FSRTL_VIRTDISK_NO_DRIVE_LETTER  0x00000002
6293 
6294 typedef struct _FSRTL_MUP_PROVIDER_INFO_LEVEL_1 {
6295   ULONG32 ProviderId;
6296 } FSRTL_MUP_PROVIDER_INFO_LEVEL_1, *PFSRTL_MUP_PROVIDER_INFO_LEVEL_1;
6297 
6298 typedef struct _FSRTL_MUP_PROVIDER_INFO_LEVEL_2 {
6299   ULONG32 ProviderId;
6300   UNICODE_STRING ProviderName;
6301 } FSRTL_MUP_PROVIDER_INFO_LEVEL_2, *PFSRTL_MUP_PROVIDER_INFO_LEVEL_2;
6302 
6303 typedef VOID
6304 (*PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK) (
6305   IN OUT PVOID EcpContext,
6306   IN LPCGUID EcpType);
6307 
6308 typedef struct _ECP_LIST ECP_LIST, *PECP_LIST;
6309 
6310 typedef ULONG FSRTL_ALLOCATE_ECPLIST_FLAGS;
6311 typedef ULONG FSRTL_ALLOCATE_ECP_FLAGS;
6312 typedef ULONG FSRTL_ECP_LOOKASIDE_FLAGS;
6313 
6314 typedef enum _FSRTL_CHANGE_BACKING_TYPE {
6315   ChangeDataControlArea,
6316   ChangeImageControlArea,
6317   ChangeSharedCacheMap
6318 } FSRTL_CHANGE_BACKING_TYPE, *PFSRTL_CHANGE_BACKING_TYPE;
6319 
6320 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
6321 
6322 typedef struct _FSRTL_PER_FILE_CONTEXT {
6323   LIST_ENTRY Links;
6324   PVOID OwnerId;
6325   PVOID InstanceId;
6326   PFREE_FUNCTION FreeCallback;
6327 } FSRTL_PER_FILE_CONTEXT, *PFSRTL_PER_FILE_CONTEXT;
6328 
6329 typedef struct _FSRTL_PER_STREAM_CONTEXT {
6330   LIST_ENTRY Links;
6331   PVOID OwnerId;
6332   PVOID InstanceId;
6333   PFREE_FUNCTION FreeCallback;
6334 } FSRTL_PER_STREAM_CONTEXT, *PFSRTL_PER_STREAM_CONTEXT;
6335 
6336 #if (NTDDI_VERSION >= NTDDI_WIN2K)
6337 typedef VOID
6338 (*PFN_FSRTLTEARDOWNPERSTREAMCONTEXTS) (
6339   IN PFSRTL_ADVANCED_FCB_HEADER AdvancedHeader);
6340 #endif
6341 
6342 typedef struct _FSRTL_PER_FILEOBJECT_CONTEXT {
6343   LIST_ENTRY Links;
6344   PVOID OwnerId;
6345   PVOID InstanceId;
6346 } FSRTL_PER_FILEOBJECT_CONTEXT, *PFSRTL_PER_FILEOBJECT_CONTEXT;
6347 
6348 #define FSRTL_CC_FLUSH_ERROR_FLAG_NO_HARD_ERROR  0x1
6349 #define FSRTL_CC_FLUSH_ERROR_FLAG_NO_LOG_ENTRY   0x2
6350 
6351 typedef NTSTATUS
6352 (NTAPI *PCOMPLETE_LOCK_IRP_ROUTINE) (
6353   IN PVOID Context,
6354   IN PIRP Irp);
6355 
6356 typedef struct _FILE_LOCK_INFO {
6357   LARGE_INTEGER StartingByte;
6358   LARGE_INTEGER Length;
6359   BOOLEAN ExclusiveLock;
6360   ULONG Key;
6361   PFILE_OBJECT FileObject;
6362   PVOID ProcessId;
6363   LARGE_INTEGER EndingByte;
6364 } FILE_LOCK_INFO, *PFILE_LOCK_INFO;
6365 
6366 typedef VOID
6367 (NTAPI *PUNLOCK_ROUTINE) (
6368   IN PVOID Context,
6369   IN PFILE_LOCK_INFO FileLockInfo);
6370 
6371 typedef struct _FILE_LOCK {
6372   PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine;
6373   PUNLOCK_ROUTINE UnlockRoutine;
6374   BOOLEAN FastIoIsQuestionable;
6375   BOOLEAN SpareC[3];
6376   PVOID LockInformation;
6377   FILE_LOCK_INFO LastReturnedLockInfo;
6378   PVOID LastReturnedLock;
6379   LONG volatile LockRequestsInProgress;
6380 } FILE_LOCK, *PFILE_LOCK;
6381 
6382 typedef struct _TUNNEL {
6383   FAST_MUTEX Mutex;
6384   PRTL_SPLAY_LINKS Cache;
6385   LIST_ENTRY TimerQueue;
6386   USHORT NumEntries;
6387 } TUNNEL, *PTUNNEL;
6388 
6389 typedef struct _BASE_MCB {
6390   ULONG MaximumPairCount;
6391   ULONG PairCount;
6392   USHORT PoolType;
6393   USHORT Flags;
6394   PVOID Mapping;
6395 } BASE_MCB, *PBASE_MCB;
6396 
6397 typedef struct _LARGE_MCB {
6398   PKGUARDED_MUTEX GuardedMutex;
6399   BASE_MCB BaseMcb;
6400 } LARGE_MCB, *PLARGE_MCB;
6401 
6402 #define MCB_FLAG_RAISE_ON_ALLOCATION_FAILURE 1
6403 
6404 typedef struct _MCB {
6405   LARGE_MCB DummyFieldThatSizesThisStructureCorrectly;
6406 } MCB, *PMCB;
6407 
6408 typedef enum _FAST_IO_POSSIBLE {
6409   FastIoIsNotPossible = 0,
6410   FastIoIsPossible,
6411   FastIoIsQuestionable
6412 } FAST_IO_POSSIBLE;
6413 
6414 typedef struct _EOF_WAIT_BLOCK {
6415   LIST_ENTRY EofWaitLinks;
6416   KEVENT Event;
6417 } EOF_WAIT_BLOCK, *PEOF_WAIT_BLOCK;
6418 
6419 typedef PVOID OPLOCK, *POPLOCK;
6420 
6421 typedef VOID
6422 (NTAPI *POPLOCK_WAIT_COMPLETE_ROUTINE) (
6423   IN PVOID Context,
6424   IN PIRP Irp);
6425 
6426 typedef VOID
6427 (NTAPI *POPLOCK_FS_PREPOST_IRP) (
6428   IN PVOID Context,
6429   IN PIRP Irp);
6430 
6431 #if (NTDDI_VERSION >= NTDDI_VISTASP1)
6432 #define OPLOCK_FLAG_COMPLETE_IF_OPLOCKED    0x00000001
6433 #endif
6434 
6435 #if (NTDDI_VERSION >= NTDDI_WIN7)
6436 #define OPLOCK_FLAG_OPLOCK_KEY_CHECK_ONLY   0x00000002
6437 #define OPLOCK_FLAG_BACK_OUT_ATOMIC_OPLOCK  0x00000004
6438 #define OPLOCK_FLAG_IGNORE_OPLOCK_KEYS      0x00000008
6439 #define OPLOCK_FSCTRL_FLAG_ALL_KEYS_MATCH   0x00000001
6440 #endif
6441 
6442 #if (NTDDI_VERSION >= NTDDI_WIN7)
6443 
6444 typedef struct _OPLOCK_KEY_ECP_CONTEXT {
6445   GUID OplockKey;
6446   ULONG Reserved;
6447 } OPLOCK_KEY_ECP_CONTEXT, *POPLOCK_KEY_ECP_CONTEXT;
6448 
6449 DEFINE_GUID(GUID_ECP_OPLOCK_KEY, 0x48850596, 0x3050, 0x4be7, 0x98, 0x63, 0xfe, 0xc3, 0x50, 0xce, 0x8d, 0x7f);
6450 
6451 #endif
6452 
6453 typedef PVOID PNOTIFY_SYNC;
6454 
6455 #if (NTDDI_VERSION >= NTDDI_WIN7)
6456 typedef struct _ECP_HEADER ECP_HEADER, *PECP_HEADER;
6457 #endif
6458 
6459 typedef BOOLEAN
6460 (NTAPI *PCHECK_FOR_TRAVERSE_ACCESS) (
6461   IN PVOID NotifyContext,
6462   IN PVOID TargetContext OPTIONAL,
6463   IN PSECURITY_SUBJECT_CONTEXT SubjectContext);
6464 
6465 typedef BOOLEAN
6466 (NTAPI *PFILTER_REPORT_CHANGE) (
6467   IN PVOID NotifyContext,
6468   IN PVOID FilterContext);
6469 /* FSRTL Functions */
6470 
6471 #define FsRtlEnterFileSystem    KeEnterCriticalRegion
6472 #define FsRtlExitFileSystem     KeLeaveCriticalRegion
6473 
6474 #if (NTDDI_VERSION >= NTDDI_WIN2K)
6475 
6476 NTKERNELAPI
6477 BOOLEAN
6478 NTAPI
6479 FsRtlCopyRead(
6480   IN PFILE_OBJECT FileObject,
6481   IN PLARGE_INTEGER FileOffset,
6482   IN ULONG Length,
6483   IN BOOLEAN Wait,
6484   IN ULONG LockKey,
6485   OUT PVOID Buffer,
6486   OUT PIO_STATUS_BLOCK IoStatus,
6487   IN PDEVICE_OBJECT DeviceObject);
6488 
6489 NTKERNELAPI
6490 BOOLEAN
6491 NTAPI
6492 FsRtlCopyWrite(
6493   IN PFILE_OBJECT FileObject,
6494   IN PLARGE_INTEGER FileOffset,
6495   IN ULONG Length,
6496   IN BOOLEAN Wait,
6497   IN ULONG LockKey,
6498   IN PVOID Buffer,
6499   OUT PIO_STATUS_BLOCK IoStatus,
6500   IN PDEVICE_OBJECT DeviceObject);
6501 
6502 NTKERNELAPI
6503 BOOLEAN
6504 NTAPI
6505 FsRtlMdlReadDev(
6506   IN PFILE_OBJECT FileObject,
6507   IN PLARGE_INTEGER FileOffset,
6508   IN ULONG Length,
6509   IN ULONG LockKey,
6510   OUT PMDL *MdlChain,
6511   OUT PIO_STATUS_BLOCK IoStatus,
6512   IN PDEVICE_OBJECT DeviceObject OPTIONAL);
6513 
6514 NTKERNELAPI
6515 BOOLEAN
6516 NTAPI
6517 FsRtlMdlReadCompleteDev(
6518   IN PFILE_OBJECT FileObject,
6519   IN PMDL MdlChain,
6520   IN PDEVICE_OBJECT DeviceObject OPTIONAL);
6521 
6522 NTKERNELAPI
6523 BOOLEAN
6524 NTAPI
6525 FsRtlPrepareMdlWriteDev(
6526   IN PFILE_OBJECT FileObject,
6527   IN PLARGE_INTEGER FileOffset,
6528   IN ULONG Length,
6529   IN ULONG LockKey,
6530   OUT PMDL *MdlChain,
6531   OUT PIO_STATUS_BLOCK IoStatus,
6532   IN PDEVICE_OBJECT DeviceObject);
6533 
6534 NTKERNELAPI
6535 BOOLEAN
6536 NTAPI
6537 FsRtlMdlWriteCompleteDev(
6538   IN PFILE_OBJECT FileObject,
6539   IN PLARGE_INTEGER FileOffset,
6540   IN PMDL MdlChain,
6541   IN PDEVICE_OBJECT DeviceObject);
6542 
6543 NTKERNELAPI
6544 VOID
6545 NTAPI
6546 FsRtlAcquireFileExclusive(
6547   IN PFILE_OBJECT FileObject);
6548 
6549 NTKERNELAPI
6550 VOID
6551 NTAPI
6552 FsRtlReleaseFile(
6553   IN PFILE_OBJECT FileObject);
6554 
6555 NTKERNELAPI
6556 NTSTATUS
6557 NTAPI
6558 FsRtlGetFileSize(
6559   IN PFILE_OBJECT FileObject,
6560   OUT PLARGE_INTEGER FileSize);
6561 
6562 NTKERNELAPI
6563 BOOLEAN
6564 NTAPI
6565 FsRtlIsTotalDeviceFailure(
6566   IN NTSTATUS Status);
6567 
6568 NTKERNELAPI
6569 PFILE_LOCK
6570 NTAPI
6571 FsRtlAllocateFileLock(
6572   IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL,
6573   IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL);
6574 
6575 NTKERNELAPI
6576 VOID
6577 NTAPI
6578 FsRtlFreeFileLock(
6579   IN PFILE_LOCK FileLock);
6580 
6581 NTKERNELAPI
6582 VOID
6583 NTAPI
6584 FsRtlInitializeFileLock(
6585   IN PFILE_LOCK FileLock,
6586   IN PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine OPTIONAL,
6587   IN PUNLOCK_ROUTINE UnlockRoutine OPTIONAL);
6588 
6589 NTKERNELAPI
6590 VOID
6591 NTAPI
6592 FsRtlUninitializeFileLock(
6593   IN PFILE_LOCK FileLock);
6594 
6595 /*
6596   FsRtlProcessFileLock:
6597 
6598   ret:
6599     -STATUS_INVALID_DEVICE_REQUEST
6600     -STATUS_RANGE_NOT_LOCKED from unlock routines.
6601     -STATUS_PENDING, STATUS_LOCK_NOT_GRANTED from FsRtlPrivateLock
6602     (redirected IoStatus->Status).
6603 
6604   Internals:
6605     -switch ( Irp->CurrentStackLocation->MinorFunction )
6606         lock: return FsRtlPrivateLock;
6607         unlocksingle: return FsRtlFastUnlockSingle;
6608         unlockall: return FsRtlFastUnlockAll;
6609         unlockallbykey: return FsRtlFastUnlockAllByKey;
6610         default: IofCompleteRequest with STATUS_INVALID_DEVICE_REQUEST;
6611                  return STATUS_INVALID_DEVICE_REQUEST;
6612 
6613     -'AllwaysZero' is passed thru as 'AllwaysZero' to lock / unlock routines.
6614     -'Irp' is passet thru as 'Irp' to FsRtlPrivateLock.
6615 */
6616 NTKERNELAPI
6617 NTSTATUS
6618 NTAPI
6619 FsRtlProcessFileLock(
6620   IN PFILE_LOCK FileLock,
6621   IN PIRP Irp,
6622   IN PVOID Context OPTIONAL);
6623 
6624 /*
6625   FsRtlCheckLockForReadAccess:
6626 
6627   All this really does is pick out the lock parameters from the irp (io stack
6628   location?), get IoGetRequestorProcess, and pass values on to
6629   FsRtlFastCheckLockForRead.
6630 */
6631 NTKERNELAPI
6632 BOOLEAN
6633 NTAPI
6634 FsRtlCheckLockForReadAccess(
6635   IN PFILE_LOCK FileLock,
6636   IN PIRP Irp);
6637 
6638 /*
6639   FsRtlCheckLockForWriteAccess:
6640 
6641   All this really does is pick out the lock parameters from the irp (io stack
6642   location?), get IoGetRequestorProcess, and pass values on to
6643   FsRtlFastCheckLockForWrite.
6644 */
6645 NTKERNELAPI
6646 BOOLEAN
6647 NTAPI
6648 FsRtlCheckLockForWriteAccess(
6649   IN PFILE_LOCK FileLock,
6650   IN PIRP Irp);
6651 
6652 NTKERNELAPI
6653 BOOLEAN
6654 NTAPI
6655 FsRtlFastCheckLockForRead(
6656   IN PFILE_LOCK FileLock,
6657   IN PLARGE_INTEGER FileOffset,
6658   IN PLARGE_INTEGER Length,
6659   IN ULONG Key,
6660   IN PFILE_OBJECT FileObject,
6661   IN PVOID Process);
6662 
6663 NTKERNELAPI
6664 BOOLEAN
6665 NTAPI
6666 FsRtlFastCheckLockForWrite(
6667   IN PFILE_LOCK FileLock,
6668   IN PLARGE_INTEGER FileOffset,
6669   IN PLARGE_INTEGER Length,
6670   IN ULONG Key,
6671   IN PFILE_OBJECT FileObject,
6672   IN PVOID Process);
6673 
6674 /*
6675   FsRtlGetNextFileLock:
6676 
6677   ret: NULL if no more locks
6678 
6679   Internals:
6680     FsRtlGetNextFileLock uses FileLock->LastReturnedLockInfo and
6681     FileLock->LastReturnedLock as storage.
6682     LastReturnedLock is a pointer to the 'raw' lock inkl. double linked
6683     list, and FsRtlGetNextFileLock needs this to get next lock on subsequent
6684     calls with Restart = FALSE.
6685 */
6686 NTKERNELAPI
6687 PFILE_LOCK_INFO
6688 NTAPI
6689 FsRtlGetNextFileLock(
6690   IN PFILE_LOCK FileLock,
6691   IN BOOLEAN Restart);
6692 
6693 NTKERNELAPI
6694 NTSTATUS
6695 NTAPI
6696 FsRtlFastUnlockSingle(
6697   IN PFILE_LOCK FileLock,
6698   IN PFILE_OBJECT FileObject,
6699   IN PLARGE_INTEGER FileOffset,
6700   IN PLARGE_INTEGER Length,
6701   IN PEPROCESS Process,
6702   IN ULONG Key,
6703   IN PVOID Context OPTIONAL,
6704   IN BOOLEAN AlreadySynchronized);
6705 
6706 NTKERNELAPI
6707 NTSTATUS
6708 NTAPI
6709 FsRtlFastUnlockAll(
6710   IN PFILE_LOCK FileLock,
6711   IN PFILE_OBJECT FileObject,
6712   IN PEPROCESS Process,
6713   IN PVOID Context OPTIONAL);
6714 
6715 NTKERNELAPI
6716 NTSTATUS
6717 NTAPI
6718 FsRtlFastUnlockAllByKey(
6719   IN PFILE_LOCK FileLock,
6720   IN PFILE_OBJECT FileObject,
6721   IN PEPROCESS Process,
6722   IN ULONG Key,
6723   IN PVOID Context OPTIONAL);
6724 
6725 /*
6726   FsRtlPrivateLock:
6727 
6728   ret: IoStatus->Status: STATUS_PENDING, STATUS_LOCK_NOT_GRANTED
6729 
6730   Internals:
6731     -Calls IoCompleteRequest if Irp
6732     -Uses exception handling / ExRaiseStatus with STATUS_INSUFFICIENT_RESOURCES
6733 */
6734 NTKERNELAPI
6735 BOOLEAN
6736 NTAPI
6737 FsRtlPrivateLock(
6738   IN PFILE_LOCK FileLock,
6739   IN PFILE_OBJECT FileObject,
6740   IN PLARGE_INTEGER FileOffset,
6741   IN PLARGE_INTEGER Length,
6742   IN PEPROCESS Process,
6743   IN ULONG Key,
6744   IN BOOLEAN FailImmediately,
6745   IN BOOLEAN ExclusiveLock,
6746   OUT PIO_STATUS_BLOCK IoStatus,
6747   IN PIRP Irp OPTIONAL,
6748   IN PVOID Context,
6749   IN BOOLEAN AlreadySynchronized);
6750 
6751 NTKERNELAPI
6752 VOID
6753 NTAPI
6754 FsRtlInitializeTunnelCache(
6755   IN PTUNNEL Cache);
6756 
6757 NTKERNELAPI
6758 VOID
6759 NTAPI
6760 FsRtlAddToTunnelCache(
6761   IN PTUNNEL Cache,
6762   IN ULONGLONG DirectoryKey,
6763   IN PUNICODE_STRING ShortName,
6764   IN PUNICODE_STRING LongName,
6765   IN BOOLEAN KeyByShortName,
6766   IN ULONG DataLength,
6767   IN PVOID Data);
6768 
6769 NTKERNELAPI
6770 BOOLEAN
6771 NTAPI
6772 FsRtlFindInTunnelCache(
6773   IN PTUNNEL Cache,
6774   IN ULONGLONG DirectoryKey,
6775   IN PUNICODE_STRING Name,
6776   OUT PUNICODE_STRING ShortName,
6777   OUT PUNICODE_STRING LongName,
6778   IN OUT PULONG DataLength,
6779   OUT PVOID Data);
6780 
6781 NTKERNELAPI
6782 VOID
6783 NTAPI
6784 FsRtlDeleteKeyFromTunnelCache(
6785   IN PTUNNEL Cache,
6786   IN ULONGLONG DirectoryKey);
6787 
6788 NTKERNELAPI
6789 VOID
6790 NTAPI
6791 FsRtlDeleteTunnelCache(
6792   IN PTUNNEL Cache);
6793 
6794 NTKERNELAPI
6795 VOID
6796 NTAPI
6797 FsRtlDissectDbcs(
6798   IN ANSI_STRING Name,
6799   OUT PANSI_STRING FirstPart,
6800   OUT PANSI_STRING RemainingPart);
6801 
6802 NTKERNELAPI
6803 BOOLEAN
6804 NTAPI
6805 FsRtlDoesDbcsContainWildCards(
6806   IN PANSI_STRING Name);
6807 
6808 NTKERNELAPI
6809 BOOLEAN
6810 NTAPI
6811 FsRtlIsDbcsInExpression(
6812   IN PANSI_STRING Expression,
6813   IN PANSI_STRING Name);
6814 
6815 NTKERNELAPI
6816 BOOLEAN
6817 NTAPI
6818 FsRtlIsFatDbcsLegal(
6819   IN ANSI_STRING DbcsName,
6820   IN BOOLEAN WildCardsPermissible,
6821   IN BOOLEAN PathNamePermissible,
6822   IN BOOLEAN LeadingBackslashPermissible);
6823 
6824 NTKERNELAPI
6825 BOOLEAN
6826 NTAPI
6827 FsRtlIsHpfsDbcsLegal(
6828   IN ANSI_STRING DbcsName,
6829   IN BOOLEAN WildCardsPermissible,
6830   IN BOOLEAN PathNamePermissible,
6831   IN BOOLEAN LeadingBackslashPermissible);
6832 
6833 NTKERNELAPI
6834 NTSTATUS
6835 NTAPI
6836 FsRtlNormalizeNtstatus(
6837   IN NTSTATUS Exception,
6838   IN NTSTATUS GenericException);
6839 
6840 NTKERNELAPI
6841 BOOLEAN
6842 NTAPI
6843 FsRtlIsNtstatusExpected(
6844   IN NTSTATUS Ntstatus);
6845 
6846 NTKERNELAPI
6847 PERESOURCE
6848 NTAPI
6849 FsRtlAllocateResource(
6850   VOID);
6851 
6852 NTKERNELAPI
6853 VOID
6854 NTAPI
6855 FsRtlInitializeLargeMcb(
6856   IN PLARGE_MCB Mcb,
6857   IN POOL_TYPE PoolType);
6858 
6859 NTKERNELAPI
6860 VOID
6861 NTAPI
6862 FsRtlUninitializeLargeMcb(
6863   IN PLARGE_MCB Mcb);
6864 
6865 NTKERNELAPI
6866 VOID
6867 NTAPI
6868 FsRtlResetLargeMcb(
6869   IN PLARGE_MCB Mcb,
6870   IN BOOLEAN SelfSynchronized);
6871 
6872 NTKERNELAPI
6873 VOID
6874 NTAPI
6875 FsRtlTruncateLargeMcb(
6876   IN PLARGE_MCB Mcb,
6877   IN LONGLONG Vbn);
6878 
6879 NTKERNELAPI
6880 BOOLEAN
6881 NTAPI
6882 FsRtlAddLargeMcbEntry(
6883   IN PLARGE_MCB Mcb,
6884   IN LONGLONG Vbn,
6885   IN LONGLONG Lbn,
6886   IN LONGLONG SectorCount);
6887 
6888 NTKERNELAPI
6889 VOID
6890 NTAPI
6891 FsRtlRemoveLargeMcbEntry(
6892   IN PLARGE_MCB Mcb,
6893   IN LONGLONG Vbn,
6894   IN LONGLONG SectorCount);
6895 
6896 NTKERNELAPI
6897 BOOLEAN
6898 NTAPI
6899 FsRtlLookupLargeMcbEntry(
6900   IN PLARGE_MCB Mcb,
6901   IN LONGLONG Vbn,
6902   OUT PLONGLONG Lbn OPTIONAL,
6903   OUT PLONGLONG SectorCountFromLbn OPTIONAL,
6904   OUT PLONGLONG StartingLbn OPTIONAL,
6905   OUT PLONGLONG SectorCountFromStartingLbn OPTIONAL,
6906   OUT PULONG Index OPTIONAL);
6907 
6908 NTKERNELAPI
6909 BOOLEAN
6910 NTAPI
6911 FsRtlLookupLastLargeMcbEntry(
6912   IN PLARGE_MCB Mcb,
6913   OUT PLONGLONG Vbn,
6914   OUT PLONGLONG Lbn);
6915 
6916 NTKERNELAPI
6917 BOOLEAN
6918 NTAPI
6919 FsRtlLookupLastLargeMcbEntryAndIndex(
6920   IN PLARGE_MCB OpaqueMcb,
6921   OUT PLONGLONG LargeVbn,
6922   OUT PLONGLONG LargeLbn,
6923   OUT PULONG Index);
6924 
6925 NTKERNELAPI
6926 ULONG
6927 NTAPI
6928 FsRtlNumberOfRunsInLargeMcb(
6929   IN PLARGE_MCB Mcb);
6930 
6931 NTKERNELAPI
6932 BOOLEAN
6933 NTAPI
6934 FsRtlGetNextLargeMcbEntry(
6935   IN PLARGE_MCB Mcb,
6936   IN ULONG RunIndex,
6937   OUT PLONGLONG Vbn,
6938   OUT PLONGLONG Lbn,
6939   OUT PLONGLONG SectorCount);
6940 
6941 NTKERNELAPI
6942 BOOLEAN
6943 NTAPI
6944 FsRtlSplitLargeMcb(
6945   IN PLARGE_MCB Mcb,
6946   IN LONGLONG Vbn,
6947   IN LONGLONG Amount);
6948 
6949 NTKERNELAPI
6950 VOID
6951 NTAPI
6952 FsRtlInitializeMcb(
6953   IN PMCB Mcb,
6954   IN POOL_TYPE PoolType);
6955 
6956 NTKERNELAPI
6957 VOID
6958 NTAPI
6959 FsRtlUninitializeMcb(
6960   IN PMCB Mcb);
6961 
6962 NTKERNELAPI
6963 VOID
6964 NTAPI
6965 FsRtlTruncateMcb(
6966   IN PMCB Mcb,
6967   IN VBN Vbn);
6968 
6969 NTKERNELAPI
6970 BOOLEAN
6971 NTAPI
6972 FsRtlAddMcbEntry(
6973   IN PMCB Mcb,
6974   IN VBN Vbn,
6975   IN LBN Lbn,
6976   IN ULONG SectorCount);
6977 
6978 NTKERNELAPI
6979 VOID
6980 NTAPI
6981 FsRtlRemoveMcbEntry(
6982   IN PMCB Mcb,
6983   IN VBN Vbn,
6984   IN ULONG SectorCount);
6985 
6986 NTKERNELAPI
6987 BOOLEAN
6988 NTAPI
6989 FsRtlLookupMcbEntry(
6990   IN PMCB Mcb,
6991   IN VBN Vbn,
6992   OUT PLBN Lbn,
6993   OUT PULONG SectorCount OPTIONAL,
6994   OUT PULONG Index);
6995 
6996 NTKERNELAPI
6997 BOOLEAN
6998 NTAPI
6999 FsRtlLookupLastMcbEntry(
7000   IN PMCB Mcb,
7001   OUT PVBN Vbn,
7002   OUT PLBN Lbn);
7003 
7004 NTKERNELAPI
7005 ULONG
7006 NTAPI
7007 FsRtlNumberOfRunsInMcb(
7008   IN PMCB Mcb);
7009 
7010 NTKERNELAPI
7011 BOOLEAN
7012 NTAPI
7013 FsRtlGetNextMcbEntry(
7014   IN PMCB Mcb,
7015   IN ULONG RunIndex,
7016   OUT PVBN Vbn,
7017   OUT PLBN Lbn,
7018   OUT PULONG SectorCount);
7019 
7020 NTKERNELAPI
7021 NTSTATUS
7022 NTAPI
7023 FsRtlBalanceReads(
7024   IN PDEVICE_OBJECT TargetDevice);
7025 
7026 NTKERNELAPI
7027 VOID
7028 NTAPI
7029 FsRtlInitializeOplock(
7030   IN OUT POPLOCK Oplock);
7031 
7032 NTKERNELAPI
7033 VOID
7034 NTAPI
7035 FsRtlUninitializeOplock(
7036   IN OUT POPLOCK Oplock);
7037 
7038 NTKERNELAPI
7039 NTSTATUS
7040 NTAPI
7041 FsRtlOplockFsctrl(
7042   IN POPLOCK Oplock,
7043   IN PIRP Irp,
7044   IN ULONG OpenCount);
7045 
7046 NTKERNELAPI
7047 NTSTATUS
7048 NTAPI
7049 FsRtlCheckOplock(
7050   IN POPLOCK Oplock,
7051   IN PIRP Irp,
7052   IN PVOID Context,
7053   IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
7054   IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
7055 
7056 NTKERNELAPI
7057 BOOLEAN
7058 NTAPI
7059 FsRtlOplockIsFastIoPossible(
7060   IN POPLOCK Oplock);
7061 
7062 NTKERNELAPI
7063 BOOLEAN
7064 NTAPI
7065 FsRtlCurrentBatchOplock(
7066   IN POPLOCK Oplock);
7067 
7068 NTKERNELAPI
7069 NTSTATUS
7070 NTAPI
7071 FsRtlNotifyVolumeEvent(
7072   IN PFILE_OBJECT FileObject,
7073   IN ULONG EventCode);
7074 
7075 NTKERNELAPI
7076 VOID
7077 NTAPI
7078 FsRtlNotifyInitializeSync(
7079   IN PNOTIFY_SYNC *NotifySync);
7080 
7081 NTKERNELAPI
7082 VOID
7083 NTAPI
7084 FsRtlNotifyUninitializeSync(
7085   IN PNOTIFY_SYNC *NotifySync);
7086 
7087 NTKERNELAPI
7088 VOID
7089 NTAPI
7090 FsRtlNotifyFullChangeDirectory(
7091   IN PNOTIFY_SYNC NotifySync,
7092   IN PLIST_ENTRY NotifyList,
7093   IN PVOID FsContext,
7094   IN PSTRING FullDirectoryName,
7095   IN BOOLEAN WatchTree,
7096   IN BOOLEAN IgnoreBuffer,
7097   IN ULONG CompletionFilter,
7098   IN PIRP NotifyIrp OPTIONAL,
7099   IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL,
7100   IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL);
7101 
7102 NTKERNELAPI
7103 VOID
7104 NTAPI
7105 FsRtlNotifyFilterReportChange(
7106   IN PNOTIFY_SYNC NotifySync,
7107   IN PLIST_ENTRY NotifyList,
7108   IN PSTRING FullTargetName,
7109   IN USHORT TargetNameOffset,
7110   IN PSTRING StreamName OPTIONAL,
7111   IN PSTRING NormalizedParentName OPTIONAL,
7112   IN ULONG FilterMatch,
7113   IN ULONG Action,
7114   IN PVOID TargetContext OPTIONAL,
7115   IN PVOID FilterContext OPTIONAL);
7116 
7117 NTKERNELAPI
7118 VOID
7119 NTAPI
7120 FsRtlNotifyFullReportChange(
7121   IN PNOTIFY_SYNC NotifySync,
7122   IN PLIST_ENTRY NotifyList,
7123   IN PSTRING FullTargetName,
7124   IN USHORT TargetNameOffset,
7125   IN PSTRING StreamName OPTIONAL,
7126   IN PSTRING NormalizedParentName OPTIONAL,
7127   IN ULONG FilterMatch,
7128   IN ULONG Action,
7129   IN PVOID TargetContext OPTIONAL);
7130 
7131 NTKERNELAPI
7132 VOID
7133 NTAPI
7134 FsRtlNotifyCleanup(
7135   IN PNOTIFY_SYNC NotifySync,
7136   IN PLIST_ENTRY NotifyList,
7137   IN PVOID FsContext);
7138 
7139 NTKERNELAPI
7140 VOID
7141 NTAPI
7142 FsRtlDissectName(
7143   IN UNICODE_STRING Name,
7144   OUT PUNICODE_STRING FirstPart,
7145   OUT PUNICODE_STRING RemainingPart);
7146 
7147 NTKERNELAPI
7148 BOOLEAN
7149 NTAPI
7150 FsRtlDoesNameContainWildCards(
7151   IN PUNICODE_STRING Name);
7152 
7153 NTKERNELAPI
7154 BOOLEAN
7155 NTAPI
7156 FsRtlAreNamesEqual(
7157   IN PCUNICODE_STRING Name1,
7158   IN PCUNICODE_STRING Name2,
7159   IN BOOLEAN IgnoreCase,
7160   IN PCWCH UpcaseTable OPTIONAL);
7161 
7162 NTKERNELAPI
7163 BOOLEAN
7164 NTAPI
7165 FsRtlIsNameInExpression(
7166   IN PUNICODE_STRING Expression,
7167   IN PUNICODE_STRING Name,
7168   IN BOOLEAN IgnoreCase,
7169   IN PWCHAR UpcaseTable OPTIONAL);
7170 
7171 NTKERNELAPI
7172 VOID
7173 NTAPI
7174 FsRtlPostPagingFileStackOverflow(
7175   IN PVOID Context,
7176   IN PKEVENT Event,
7177   IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine);
7178 
7179 NTKERNELAPI
7180 VOID
7181 NTAPI
7182 FsRtlPostStackOverflow (
7183   IN PVOID Context,
7184   IN PKEVENT Event,
7185   IN PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine);
7186 
7187 NTKERNELAPI
7188 NTSTATUS
7189 NTAPI
7190 FsRtlRegisterUncProvider(
7191   OUT PHANDLE MupHandle,
7192   IN PUNICODE_STRING RedirectorDeviceName,
7193   IN BOOLEAN MailslotsSupported);
7194 
7195 NTKERNELAPI
7196 VOID
7197 NTAPI
7198 FsRtlDeregisterUncProvider(
7199   IN HANDLE Handle);
7200 
7201 NTKERNELAPI
7202 VOID
7203 NTAPI
7204 FsRtlTeardownPerStreamContexts(
7205   IN PFSRTL_ADVANCED_FCB_HEADER AdvancedHeader);
7206 
7207 NTKERNELAPI
7208 NTSTATUS
7209 NTAPI
7210 FsRtlCreateSectionForDataScan(
7211   OUT PHANDLE SectionHandle,
7212   OUT PVOID *SectionObject,
7213   OUT PLARGE_INTEGER SectionFileSize OPTIONAL,
7214   IN PFILE_OBJECT FileObject,
7215   IN ACCESS_MASK DesiredAccess,
7216   IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
7217   IN PLARGE_INTEGER MaximumSize OPTIONAL,
7218   IN ULONG SectionPageProtection,
7219   IN ULONG AllocationAttributes,
7220   IN ULONG Flags);
7221 
7222 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
7223 
7224 #if (NTDDI_VERSION >= NTDDI_WINXP)
7225 
7226 NTKERNELAPI
7227 VOID
7228 NTAPI
7229 FsRtlNotifyFilterChangeDirectory(
7230   IN PNOTIFY_SYNC NotifySync,
7231   IN PLIST_ENTRY NotifyList,
7232   IN PVOID FsContext,
7233   IN PSTRING FullDirectoryName,
7234   IN BOOLEAN WatchTree,
7235   IN BOOLEAN IgnoreBuffer,
7236   IN ULONG CompletionFilter,
7237   IN PIRP NotifyIrp OPTIONAL,
7238   IN PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback OPTIONAL,
7239   IN PSECURITY_SUBJECT_CONTEXT SubjectContext OPTIONAL,
7240   IN PFILTER_REPORT_CHANGE FilterCallback OPTIONAL);
7241 
7242 NTKERNELAPI
7243 NTSTATUS
7244 NTAPI
7245 FsRtlInsertPerStreamContext(
7246   IN PFSRTL_ADVANCED_FCB_HEADER PerStreamContext,
7247   IN PFSRTL_PER_STREAM_CONTEXT Ptr);
7248 
7249 NTKERNELAPI
7250 PFSRTL_PER_STREAM_CONTEXT
7251 NTAPI
7252 FsRtlLookupPerStreamContextInternal(
7253   IN PFSRTL_ADVANCED_FCB_HEADER StreamContext,
7254   IN PVOID OwnerId OPTIONAL,
7255   IN PVOID InstanceId OPTIONAL);
7256 
7257 NTKERNELAPI
7258 PFSRTL_PER_STREAM_CONTEXT
7259 NTAPI
7260 FsRtlRemovePerStreamContext(
7261   IN PFSRTL_ADVANCED_FCB_HEADER StreamContext,
7262   IN PVOID OwnerId OPTIONAL,
7263   IN PVOID InstanceId OPTIONAL);
7264 
7265 NTKERNELAPI
7266 VOID
7267 NTAPI
7268 FsRtlIncrementCcFastReadNotPossible(
7269   VOID);
7270 
7271 NTKERNELAPI
7272 VOID
7273 NTAPI
7274 FsRtlIncrementCcFastReadWait(
7275   VOID);
7276 
7277 NTKERNELAPI
7278 VOID
7279 NTAPI
7280 FsRtlIncrementCcFastReadNoWait(
7281   VOID);
7282 
7283 NTKERNELAPI
7284 VOID
7285 NTAPI
7286 FsRtlIncrementCcFastReadResourceMiss(
7287   VOID);
7288 
7289 NTKERNELAPI
7290 LOGICAL
7291 NTAPI
7292 FsRtlIsPagingFile(
7293   IN PFILE_OBJECT FileObject);
7294 
7295 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
7296 
7297 #if (NTDDI_VERSION >= NTDDI_WS03)
7298 
7299 NTKERNELAPI
7300 VOID
7301 NTAPI
7302 FsRtlInitializeBaseMcb(
7303   IN PBASE_MCB Mcb,
7304   IN POOL_TYPE PoolType);
7305 
7306 NTKERNELAPI
7307 VOID
7308 NTAPI
7309 FsRtlUninitializeBaseMcb(
7310   IN PBASE_MCB Mcb);
7311 
7312 NTKERNELAPI
7313 VOID
7314 NTAPI
7315 FsRtlResetBaseMcb(
7316   IN PBASE_MCB Mcb);
7317 
7318 NTKERNELAPI
7319 VOID
7320 NTAPI
7321 FsRtlTruncateBaseMcb(
7322   IN PBASE_MCB Mcb,
7323   IN LONGLONG Vbn);
7324 
7325 NTKERNELAPI
7326 BOOLEAN
7327 NTAPI
7328 FsRtlAddBaseMcbEntry(
7329   IN PBASE_MCB Mcb,
7330   IN LONGLONG Vbn,
7331   IN LONGLONG Lbn,
7332   IN LONGLONG SectorCount);
7333 
7334 NTKERNELAPI
7335 BOOLEAN
7336 NTAPI
7337 FsRtlRemoveBaseMcbEntry(
7338   IN PBASE_MCB Mcb,
7339   IN LONGLONG Vbn,
7340   IN LONGLONG SectorCount);
7341 
7342 NTKERNELAPI
7343 BOOLEAN
7344 NTAPI
7345 FsRtlLookupBaseMcbEntry(
7346   IN PBASE_MCB Mcb,
7347   IN LONGLONG Vbn,
7348   OUT PLONGLONG Lbn OPTIONAL,
7349   OUT PLONGLONG SectorCountFromLbn OPTIONAL,
7350   OUT PLONGLONG StartingLbn OPTIONAL,
7351   OUT PLONGLONG SectorCountFromStartingLbn OPTIONAL,
7352   OUT PULONG Index OPTIONAL);
7353 
7354 NTKERNELAPI
7355 BOOLEAN
7356 NTAPI
7357 FsRtlLookupLastBaseMcbEntry(
7358   IN PBASE_MCB Mcb,
7359   OUT PLONGLONG Vbn,
7360   OUT PLONGLONG Lbn);
7361 
7362 NTKERNELAPI
7363 BOOLEAN
7364 NTAPI
7365 FsRtlLookupLastBaseMcbEntryAndIndex(
7366   IN PBASE_MCB OpaqueMcb,
7367   IN OUT PLONGLONG LargeVbn,
7368   IN OUT PLONGLONG LargeLbn,
7369   IN OUT PULONG Index);
7370 
7371 NTKERNELAPI
7372 ULONG
7373 NTAPI
7374 FsRtlNumberOfRunsInBaseMcb(
7375   IN PBASE_MCB Mcb);
7376 
7377 NTKERNELAPI
7378 BOOLEAN
7379 NTAPI
7380 FsRtlGetNextBaseMcbEntry(
7381   IN PBASE_MCB Mcb,
7382   IN ULONG RunIndex,
7383   OUT PLONGLONG Vbn,
7384   OUT PLONGLONG Lbn,
7385   OUT PLONGLONG SectorCount);
7386 
7387 NTKERNELAPI
7388 BOOLEAN
7389 NTAPI
7390 FsRtlSplitBaseMcb(
7391   IN PBASE_MCB Mcb,
7392   IN LONGLONG Vbn,
7393   IN LONGLONG Amount);
7394 
7395 #endif /* (NTDDI_VERSION >= NTDDI_WS03) */
7396 
7397 #if (NTDDI_VERSION >= NTDDI_VISTA)
7398 
7399 BOOLEAN
7400 NTAPI
7401 FsRtlInitializeBaseMcbEx(
7402   IN PBASE_MCB Mcb,
7403   IN POOL_TYPE PoolType,
7404   IN USHORT Flags);
7405 
7406 NTSTATUS
7407 NTAPI
7408 FsRtlAddBaseMcbEntryEx(
7409   IN PBASE_MCB Mcb,
7410   IN LONGLONG Vbn,
7411   IN LONGLONG Lbn,
7412   IN LONGLONG SectorCount);
7413 
7414 NTKERNELAPI
7415 BOOLEAN
7416 NTAPI
7417 FsRtlCurrentOplock(
7418   IN POPLOCK Oplock);
7419 
7420 NTKERNELAPI
7421 NTSTATUS
7422 NTAPI
7423 FsRtlOplockBreakToNone(
7424   IN OUT POPLOCK Oplock,
7425   IN PIO_STACK_LOCATION IrpSp OPTIONAL,
7426   IN PIRP Irp,
7427   IN PVOID Context OPTIONAL,
7428   IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
7429   IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
7430 
7431 NTKERNELAPI
7432 NTSTATUS
7433 NTAPI
7434 FsRtlNotifyVolumeEventEx(
7435   IN PFILE_OBJECT FileObject,
7436   IN ULONG EventCode,
7437   IN PTARGET_DEVICE_CUSTOM_NOTIFICATION Event);
7438 
7439 NTKERNELAPI
7440 VOID
7441 NTAPI
7442 FsRtlNotifyCleanupAll(
7443   IN PNOTIFY_SYNC NotifySync,
7444   IN PLIST_ENTRY NotifyList);
7445 
7446 NTSTATUS
7447 NTAPI
7448 FsRtlRegisterUncProviderEx(
7449   OUT PHANDLE MupHandle,
7450   IN PUNICODE_STRING RedirDevName,
7451   IN PDEVICE_OBJECT DeviceObject,
7452   IN ULONG Flags);
7453 
7454 NTKERNELAPI
7455 NTSTATUS
7456 NTAPI
7457 FsRtlCancellableWaitForSingleObject(
7458   IN PVOID Object,
7459   IN PLARGE_INTEGER Timeout OPTIONAL,
7460   IN PIRP Irp OPTIONAL);
7461 
7462 NTKERNELAPI
7463 NTSTATUS
7464 NTAPI
7465 FsRtlCancellableWaitForMultipleObjects(
7466   IN ULONG Count,
7467   IN PVOID ObjectArray[],
7468   IN WAIT_TYPE WaitType,
7469   IN PLARGE_INTEGER Timeout OPTIONAL,
7470   IN PKWAIT_BLOCK WaitBlockArray OPTIONAL,
7471   IN PIRP Irp OPTIONAL);
7472 
7473 NTKERNELAPI
7474 NTSTATUS
7475 NTAPI
7476 FsRtlMupGetProviderInfoFromFileObject(
7477   IN PFILE_OBJECT pFileObject,
7478   IN ULONG Level,
7479   OUT PVOID pBuffer,
7480   IN OUT PULONG pBufferSize);
7481 
7482 NTKERNELAPI
7483 NTSTATUS
7484 NTAPI
7485 FsRtlMupGetProviderIdFromName(
7486   IN PUNICODE_STRING pProviderName,
7487   OUT PULONG32 pProviderId);
7488 
7489 NTKERNELAPI
7490 VOID
7491 NTAPI
7492 FsRtlIncrementCcFastMdlReadWait(
7493   VOID);
7494 
7495 NTKERNELAPI
7496 NTSTATUS
7497 NTAPI
7498 FsRtlValidateReparsePointBuffer(
7499   IN ULONG BufferLength,
7500   IN PREPARSE_DATA_BUFFER ReparseBuffer);
7501 
7502 NTKERNELAPI
7503 NTSTATUS
7504 NTAPI
7505 FsRtlRemoveDotsFromPath(
7506   IN OUT PWSTR OriginalString,
7507   IN USHORT PathLength,
7508   OUT USHORT *NewLength);
7509 
7510 NTKERNELAPI
7511 NTSTATUS
7512 NTAPI
7513 FsRtlAllocateExtraCreateParameterList(
7514   IN FSRTL_ALLOCATE_ECPLIST_FLAGS Flags,
7515   OUT PECP_LIST *EcpList);
7516 
7517 NTKERNELAPI
7518 VOID
7519 NTAPI
7520 FsRtlFreeExtraCreateParameterList(
7521   IN PECP_LIST EcpList);
7522 
7523 NTKERNELAPI
7524 NTSTATUS
7525 NTAPI
7526 FsRtlAllocateExtraCreateParameter(
7527   IN LPCGUID EcpType,
7528   IN ULONG SizeOfContext,
7529   IN FSRTL_ALLOCATE_ECP_FLAGS Flags,
7530   IN PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback OPTIONAL,
7531   IN ULONG PoolTag,
7532   OUT PVOID *EcpContext);
7533 
7534 NTKERNELAPI
7535 VOID
7536 NTAPI
7537 FsRtlFreeExtraCreateParameter(
7538   IN PVOID EcpContext);
7539 
7540 NTKERNELAPI
7541 VOID
7542 NTAPI
7543 FsRtlInitExtraCreateParameterLookasideList(
7544   IN OUT PVOID Lookaside,
7545   IN FSRTL_ECP_LOOKASIDE_FLAGS Flags,
7546   IN SIZE_T Size,
7547   IN ULONG Tag);
7548 
7549 VOID
7550 NTAPI
7551 FsRtlDeleteExtraCreateParameterLookasideList(
7552   IN OUT PVOID Lookaside,
7553   IN FSRTL_ECP_LOOKASIDE_FLAGS Flags);
7554 
7555 NTKERNELAPI
7556 NTSTATUS
7557 NTAPI
7558 FsRtlAllocateExtraCreateParameterFromLookasideList(
7559   IN LPCGUID EcpType,
7560   IN ULONG SizeOfContext,
7561   IN FSRTL_ALLOCATE_ECP_FLAGS Flags,
7562   IN PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback OPTIONAL,
7563   IN OUT PVOID LookasideList,
7564   OUT PVOID *EcpContext);
7565 
7566 NTKERNELAPI
7567 NTSTATUS
7568 NTAPI
7569 FsRtlInsertExtraCreateParameter(
7570   IN OUT PECP_LIST EcpList,
7571   IN OUT PVOID EcpContext);
7572 
7573 NTKERNELAPI
7574 NTSTATUS
7575 NTAPI
7576 FsRtlFindExtraCreateParameter(
7577   IN PECP_LIST EcpList,
7578   IN LPCGUID EcpType,
7579   OUT PVOID *EcpContext OPTIONAL,
7580   OUT ULONG *EcpContextSize OPTIONAL);
7581 
7582 NTKERNELAPI
7583 NTSTATUS
7584 NTAPI
7585 FsRtlRemoveExtraCreateParameter(
7586   IN OUT PECP_LIST EcpList,
7587   IN LPCGUID EcpType,
7588   OUT PVOID *EcpContext,
7589   OUT ULONG *EcpContextSize OPTIONAL);
7590 
7591 NTKERNELAPI
7592 NTSTATUS
7593 NTAPI
7594 FsRtlGetEcpListFromIrp(
7595   IN PIRP Irp,
7596   OUT PECP_LIST *EcpList OPTIONAL);
7597 
7598 NTKERNELAPI
7599 NTSTATUS
7600 NTAPI
7601 FsRtlSetEcpListIntoIrp(
7602   IN OUT PIRP Irp,
7603   IN PECP_LIST EcpList);
7604 
7605 NTKERNELAPI
7606 NTSTATUS
7607 NTAPI
7608 FsRtlGetNextExtraCreateParameter(
7609   IN PECP_LIST EcpList,
7610   IN PVOID CurrentEcpContext OPTIONAL,
7611   OUT LPGUID NextEcpType OPTIONAL,
7612   OUT PVOID *NextEcpContext OPTIONAL,
7613   OUT ULONG *NextEcpContextSize OPTIONAL);
7614 
7615 NTKERNELAPI
7616 VOID
7617 NTAPI
7618 FsRtlAcknowledgeEcp(
7619   IN PVOID EcpContext);
7620 
7621 NTKERNELAPI
7622 BOOLEAN
7623 NTAPI
7624 FsRtlIsEcpAcknowledged(
7625   IN PVOID EcpContext);
7626 
7627 NTKERNELAPI
7628 BOOLEAN
7629 NTAPI
7630 FsRtlIsEcpFromUserMode(
7631   IN PVOID EcpContext);
7632 
7633 NTKERNELAPI
7634 NTSTATUS
7635 NTAPI
7636 FsRtlChangeBackingFileObject(
7637   IN PFILE_OBJECT CurrentFileObject OPTIONAL,
7638   IN PFILE_OBJECT NewFileObject,
7639   IN FSRTL_CHANGE_BACKING_TYPE ChangeBackingType,
7640   IN ULONG Flags);
7641 
7642 NTKERNELAPI
7643 NTSTATUS
7644 NTAPI
7645 FsRtlLogCcFlushError(
7646   IN PUNICODE_STRING FileName,
7647   IN PDEVICE_OBJECT DeviceObject,
7648   IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
7649   IN NTSTATUS FlushError,
7650   IN ULONG Flags);
7651 
7652 NTKERNELAPI
7653 BOOLEAN
7654 NTAPI
7655 FsRtlAreVolumeStartupApplicationsComplete(
7656   VOID);
7657 
7658 NTKERNELAPI
7659 ULONG
7660 NTAPI
7661 FsRtlQueryMaximumVirtualDiskNestingLevel(
7662   VOID);
7663 
7664 NTKERNELAPI
7665 NTSTATUS
7666 NTAPI
7667 FsRtlGetVirtualDiskNestingLevel(
7668   IN PDEVICE_OBJECT DeviceObject,
7669   OUT PULONG NestingLevel,
7670   OUT PULONG NestingFlags OPTIONAL);
7671 
7672 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
7673 
7674 #if (NTDDI_VERSION >= NTDDI_VISTASP1)
7675 NTKERNELAPI
7676 NTSTATUS
7677 NTAPI
7678 FsRtlCheckOplockEx(
7679   IN POPLOCK Oplock,
7680   IN PIRP Irp,
7681   IN ULONG Flags,
7682   IN PVOID Context OPTIONAL,
7683   IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
7684   IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
7685 
7686 #endif
7687 
7688 #if (NTDDI_VERSION >= NTDDI_WIN7)
7689 
7690 NTKERNELAPI
7691 BOOLEAN
7692 NTAPI
7693 FsRtlAreThereCurrentOrInProgressFileLocks(
7694   IN PFILE_LOCK FileLock);
7695 
7696 NTKERNELAPI
7697 BOOLEAN
7698 NTAPI
7699 FsRtlOplockIsSharedRequest(
7700   IN PIRP Irp);
7701 
7702 NTKERNELAPI
7703 NTSTATUS
7704 NTAPI
7705 FsRtlOplockBreakH(
7706   IN POPLOCK Oplock,
7707   IN PIRP Irp,
7708   IN ULONG Flags,
7709   IN PVOID Context OPTIONAL,
7710   IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
7711   IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
7712 
7713 NTKERNELAPI
7714 BOOLEAN
7715 NTAPI
7716 FsRtlCurrentOplockH(
7717   IN POPLOCK Oplock);
7718 
7719 NTKERNELAPI
7720 NTSTATUS
7721 NTAPI
7722 FsRtlOplockBreakToNoneEx(
7723   IN OUT POPLOCK Oplock,
7724   IN PIRP Irp,
7725   IN ULONG Flags,
7726   IN PVOID Context OPTIONAL,
7727   IN POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine OPTIONAL,
7728   IN POPLOCK_FS_PREPOST_IRP PostIrpRoutine OPTIONAL);
7729 
7730 NTKERNELAPI
7731 NTSTATUS
7732 NTAPI
7733 FsRtlOplockFsctrlEx(
7734   IN POPLOCK Oplock,
7735   IN PIRP Irp,
7736   IN ULONG OpenCount,
7737   IN ULONG Flags);
7738 
7739 NTKERNELAPI
7740 BOOLEAN
7741 NTAPI
7742 FsRtlOplockKeysEqual(
7743   IN PFILE_OBJECT Fo1 OPTIONAL,
7744   IN PFILE_OBJECT Fo2 OPTIONAL);
7745 
7746 NTKERNELAPI
7747 NTSTATUS
7748 NTAPI
7749 FsRtlInitializeExtraCreateParameterList(
7750   IN OUT PECP_LIST EcpList);
7751 
7752 NTKERNELAPI
7753 VOID
7754 NTAPI
7755 FsRtlInitializeExtraCreateParameter(
7756   IN PECP_HEADER Ecp,
7757   IN ULONG EcpFlags,
7758   IN PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback OPTIONAL,
7759   IN ULONG TotalSize,
7760   IN LPCGUID EcpType,
7761   IN PVOID ListAllocatedFrom OPTIONAL);
7762 
7763 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
7764 
7765 NTKERNELAPI
7766 NTSTATUS
7767 NTAPI
7768 FsRtlInsertPerFileContext(
7769   IN PVOID* PerFileContextPointer,
7770   IN PFSRTL_PER_FILE_CONTEXT Ptr);
7771 
7772 NTKERNELAPI
7773 PFSRTL_PER_FILE_CONTEXT
7774 NTAPI
7775 FsRtlLookupPerFileContext(
7776   IN PVOID* PerFileContextPointer,
7777   IN PVOID OwnerId OPTIONAL,
7778   IN PVOID InstanceId OPTIONAL);
7779 
7780 NTKERNELAPI
7781 PFSRTL_PER_FILE_CONTEXT
7782 NTAPI
7783 FsRtlRemovePerFileContext(
7784   IN PVOID* PerFileContextPointer,
7785   IN PVOID OwnerId OPTIONAL,
7786   IN PVOID InstanceId OPTIONAL);
7787 
7788 NTKERNELAPI
7789 VOID
7790 NTAPI
7791 FsRtlTeardownPerFileContexts(
7792   IN PVOID* PerFileContextPointer);
7793 
7794 NTKERNELAPI
7795 NTSTATUS
7796 NTAPI
7797 FsRtlInsertPerFileObjectContext(
7798   IN PFILE_OBJECT FileObject,
7799   IN PFSRTL_PER_FILEOBJECT_CONTEXT Ptr);
7800 
7801 NTKERNELAPI
7802 PFSRTL_PER_FILEOBJECT_CONTEXT
7803 NTAPI
7804 FsRtlLookupPerFileObjectContext(
7805   IN PFILE_OBJECT FileObject,
7806   IN PVOID OwnerId OPTIONAL,
7807   IN PVOID InstanceId OPTIONAL);
7808 
7809 NTKERNELAPI
7810 PFSRTL_PER_FILEOBJECT_CONTEXT
7811 NTAPI
7812 FsRtlRemovePerFileObjectContext(
7813   IN PFILE_OBJECT FileObject,
7814   IN PVOID OwnerId OPTIONAL,
7815   IN PVOID InstanceId OPTIONAL);
7816 
7817 #define FsRtlFastLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11) (       \
7818      FsRtlPrivateLock(A1, A2, A3, A4, A5, A6, A7, A8, A9, NULL, A10, A11)   \
7819 )
7820 
7821 #define FsRtlAreThereCurrentFileLocks(FL) ( \
7822     ((FL)->FastIoIsQuestionable)            \
7823 )
7824 
7825 #define FsRtlIncrementLockRequestsInProgress(FL) {                           \
7826     ASSERT( (FL)->LockRequestsInProgress >= 0 );                             \
7827     (void)                                                                   \
7828     (InterlockedIncrement((LONG volatile *)&((FL)->LockRequestsInProgress)));\
7829 }
7830 
7831 #define FsRtlDecrementLockRequestsInProgress(FL) {                           \
7832     ASSERT( (FL)->LockRequestsInProgress > 0 );                              \
7833     (void)                                                                   \
7834     (InterlockedDecrement((LONG volatile *)&((FL)->LockRequestsInProgress)));\
7835 }
7836 
7837 /* GCC compatible definition, MS one is retarded */
7838 extern NTKERNELAPI const UCHAR * const FsRtlLegalAnsiCharacterArray;
7839 #define LEGAL_ANSI_CHARACTER_ARRAY        FsRtlLegalAnsiCharacterArray
7840 
7841 #define FsRtlIsAnsiCharacterWild(C) (                                       \
7842     FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], FSRTL_WILD_CHARACTER ) \
7843 )
7844 
7845 #define FsRtlIsAnsiCharacterLegalFat(C, WILD) (                                \
7846     FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_FAT_LEGAL) |       \
7847                                         ((WILD) ? FSRTL_WILD_CHARACTER : 0 ))  \
7848 )
7849 
7850 #define FsRtlIsAnsiCharacterLegalHpfs(C, WILD) (                               \
7851     FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_HPFS_LEGAL) |      \
7852                                         ((WILD) ? FSRTL_WILD_CHARACTER : 0 ))  \
7853 )
7854 
7855 #define FsRtlIsAnsiCharacterLegalNtfs(C, WILD) (                               \
7856     FlagOn(FsRtlLegalAnsiCharacterArray[(UCHAR)(C)], (FSRTL_NTFS_LEGAL) |      \
7857                                         ((WILD) ? FSRTL_WILD_CHARACTER : 0 ))  \
7858 )
7859 
7860 #define FsRtlIsAnsiCharacterLegalNtfsStream(C,WILD_OK) (                    \
7861     FsRtlTestAnsiCharacter((C), TRUE, (WILD_OK), FSRTL_NTFS_STREAM_LEGAL)   \
7862 )
7863 
7864 #define FsRtlIsAnsiCharacterLegal(C,FLAGS) (          \
7865     FsRtlTestAnsiCharacter((C), TRUE, FALSE, (FLAGS)) \
7866 )
7867 
7868 #define FsRtlTestAnsiCharacter(C, DEFAULT_RET, WILD_OK, FLAGS) (            \
7869         ((SCHAR)(C) < 0) ? DEFAULT_RET :                                    \
7870                            FlagOn( LEGAL_ANSI_CHARACTER_ARRAY[(C)],         \
7871                                    (FLAGS) |                                \
7872                                    ((WILD_OK) ? FSRTL_WILD_CHARACTER : 0) ) \
7873 )
7874 
7875 #define FsRtlIsLeadDbcsCharacter(DBCS_CHAR) (                               \
7876     (BOOLEAN)((UCHAR)(DBCS_CHAR) < 0x80 ? FALSE :                           \
7877               (NLS_MB_CODE_PAGE_TAG &&                                      \
7878                (NLS_OEM_LEAD_BYTE_INFO[(UCHAR)(DBCS_CHAR)] != 0)))          \
7879 )
7880 
7881 #define FsRtlIsUnicodeCharacterWild(C) (                                    \
7882     (((C) >= 0x40) ?                                                        \
7883     FALSE :                                                                 \
7884     FlagOn(FsRtlLegalAnsiCharacterArray[(C)], FSRTL_WILD_CHARACTER ))       \
7885 )
7886 
7887 #define FsRtlInitPerFileContext( _fc, _owner, _inst, _cb)   \
7888     ((_fc)->OwnerId = (_owner),                               \
7889      (_fc)->InstanceId = (_inst),                             \
7890      (_fc)->FreeCallback = (_cb))
7891 
7892 #define FsRtlGetPerFileContextPointer(_fo) \
7893     (FsRtlSupportsPerFileContexts(_fo) ? \
7894         FsRtlGetPerStreamContextPointer(_fo)->FileContextSupportPointer : \
7895         NULL)
7896 
7897 #define FsRtlSupportsPerFileContexts(_fo)                     \
7898     ((FsRtlGetPerStreamContextPointer(_fo) != NULL) &&        \
7899      (FsRtlGetPerStreamContextPointer(_fo)->Version >= FSRTL_FCB_HEADER_V1) &&  \
7900      (FsRtlGetPerStreamContextPointer(_fo)->FileContextSupportPointer != NULL))
7901 
7902 #define FsRtlSetupAdvancedHeaderEx( _advhdr, _fmutx, _fctxptr )                     \
7903 {                                                                                   \
7904     FsRtlSetupAdvancedHeader( _advhdr, _fmutx );                                    \
7905     if ((_fctxptr) != NULL) {                                                       \
7906         (_advhdr)->FileContextSupportPointer = (_fctxptr);                          \
7907     }                                                                               \
7908 }
7909 
7910 #define FsRtlGetPerStreamContextPointer(FO) (   \
7911     (PFSRTL_ADVANCED_FCB_HEADER)(FO)->FsContext \
7912 )
7913 
7914 #define FsRtlInitPerStreamContext(PSC, O, I, FC) ( \
7915     (PSC)->OwnerId = (O),                          \
7916     (PSC)->InstanceId = (I),                       \
7917     (PSC)->FreeCallback = (FC)                     \
7918 )
7919 
7920 #define FsRtlSupportsPerStreamContexts(FO) (                       \
7921     (BOOLEAN)((NULL != FsRtlGetPerStreamContextPointer(FO) &&     \
7922               FlagOn(FsRtlGetPerStreamContextPointer(FO)->Flags2, \
7923               FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS))               \
7924 )
7925 
7926 #define FsRtlLookupPerStreamContext(_sc, _oid, _iid)                          \
7927  (((NULL != (_sc)) &&                                                         \
7928    FlagOn((_sc)->Flags2,FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS) &&              \
7929    !IsListEmpty(&(_sc)->FilterContexts)) ?                                    \
7930         FsRtlLookupPerStreamContextInternal((_sc), (_oid), (_iid)) :          \
7931         NULL)
7932 
7933 FORCEINLINE
7934 VOID
7935 NTAPI
FsRtlSetupAdvancedHeader(IN PVOID AdvHdr,IN PFAST_MUTEX FMutex)7936 FsRtlSetupAdvancedHeader(
7937   IN PVOID AdvHdr,
7938   IN PFAST_MUTEX FMutex )
7939 {
7940   PFSRTL_ADVANCED_FCB_HEADER localAdvHdr = (PFSRTL_ADVANCED_FCB_HEADER)AdvHdr;
7941 
7942   localAdvHdr->Flags |= FSRTL_FLAG_ADVANCED_HEADER;
7943   localAdvHdr->Flags2 |= FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS;
7944 #if (NTDDI_VERSION >= NTDDI_VISTA)
7945   localAdvHdr->Version = FSRTL_FCB_HEADER_V1;
7946 #else
7947   localAdvHdr->Version = FSRTL_FCB_HEADER_V0;
7948 #endif
7949   InitializeListHead( &localAdvHdr->FilterContexts );
7950   if (FMutex != NULL) {
7951     localAdvHdr->FastMutex = FMutex;
7952   }
7953 #if (NTDDI_VERSION >= NTDDI_VISTA)
7954   *((PULONG_PTR)(&localAdvHdr->PushLock)) = 0;
7955   localAdvHdr->FileContextSupportPointer = NULL;
7956 #endif
7957 }
7958 
7959 #define FsRtlInitPerFileObjectContext(_fc, _owner, _inst)         \
7960            ((_fc)->OwnerId = (_owner), (_fc)->InstanceId = (_inst))
7961 
7962 #define FsRtlCompleteRequest(IRP,STATUS) {         \
7963     (IRP)->IoStatus.Status = (STATUS);             \
7964     IoCompleteRequest( (IRP), IO_DISK_INCREMENT ); \
7965 }
7966 /* Common Cache Types */
7967 
7968 #define VACB_MAPPING_GRANULARITY        (0x40000)
7969 #define VACB_OFFSET_SHIFT               (18)
7970 
7971 typedef struct _PUBLIC_BCB {
7972   CSHORT NodeTypeCode;
7973   CSHORT NodeByteSize;
7974   ULONG MappedLength;
7975   LARGE_INTEGER MappedFileOffset;
7976 } PUBLIC_BCB, *PPUBLIC_BCB;
7977 
7978 typedef struct _CC_FILE_SIZES {
7979   LARGE_INTEGER AllocationSize;
7980   LARGE_INTEGER FileSize;
7981   LARGE_INTEGER ValidDataLength;
7982 } CC_FILE_SIZES, *PCC_FILE_SIZES;
7983 
7984 typedef BOOLEAN
7985 (NTAPI *PACQUIRE_FOR_LAZY_WRITE) (
7986   IN PVOID Context,
7987   IN BOOLEAN Wait);
7988 
7989 typedef VOID
7990 (NTAPI *PRELEASE_FROM_LAZY_WRITE) (
7991   IN PVOID Context);
7992 
7993 typedef BOOLEAN
7994 (NTAPI *PACQUIRE_FOR_READ_AHEAD) (
7995   IN PVOID Context,
7996   IN BOOLEAN Wait);
7997 
7998 typedef VOID
7999 (NTAPI *PRELEASE_FROM_READ_AHEAD) (
8000   IN PVOID Context);
8001 
8002 typedef struct _CACHE_MANAGER_CALLBACKS {
8003   PACQUIRE_FOR_LAZY_WRITE AcquireForLazyWrite;
8004   PRELEASE_FROM_LAZY_WRITE ReleaseFromLazyWrite;
8005   PACQUIRE_FOR_READ_AHEAD AcquireForReadAhead;
8006   PRELEASE_FROM_READ_AHEAD ReleaseFromReadAhead;
8007 } CACHE_MANAGER_CALLBACKS, *PCACHE_MANAGER_CALLBACKS;
8008 
8009 typedef struct _CACHE_UNINITIALIZE_EVENT {
8010   struct _CACHE_UNINITIALIZE_EVENT *Next;
8011   KEVENT Event;
8012 } CACHE_UNINITIALIZE_EVENT, *PCACHE_UNINITIALIZE_EVENT;
8013 
8014 typedef VOID
8015 (NTAPI *PDIRTY_PAGE_ROUTINE) (
8016   IN PFILE_OBJECT FileObject,
8017   IN PLARGE_INTEGER FileOffset,
8018   IN ULONG Length,
8019   IN PLARGE_INTEGER OldestLsn,
8020   IN PLARGE_INTEGER NewestLsn,
8021   IN PVOID Context1,
8022   IN PVOID Context2);
8023 
8024 typedef VOID
8025 (NTAPI *PFLUSH_TO_LSN) (
8026   IN PVOID LogHandle,
8027   IN LARGE_INTEGER Lsn);
8028 
8029 typedef VOID
8030 (NTAPI *PCC_POST_DEFERRED_WRITE) (
8031   IN PVOID Context1,
8032   IN PVOID Context2);
8033 
8034 #define UNINITIALIZE_CACHE_MAPS          (1)
8035 #define DO_NOT_RETRY_PURGE               (2)
8036 #define DO_NOT_PURGE_DIRTY_PAGES         (0x4)
8037 
8038 #define CC_FLUSH_AND_PURGE_NO_PURGE     (0x1)
8039 /* Common Cache Functions */
8040 
8041 #define CcIsFileCached(FO) (                                                         \
8042     ((FO)->SectionObjectPointer != NULL) &&                                          \
8043     (((PSECTION_OBJECT_POINTERS)(FO)->SectionObjectPointer)->SharedCacheMap != NULL) \
8044 )
8045 
8046 extern ULONG CcFastMdlReadWait;
8047 
8048 #if (NTDDI_VERSION >= NTDDI_WIN2K)
8049 
8050 NTKERNELAPI
8051 VOID
8052 NTAPI
8053 CcInitializeCacheMap(
8054   IN PFILE_OBJECT FileObject,
8055   IN PCC_FILE_SIZES FileSizes,
8056   IN BOOLEAN PinAccess,
8057   IN PCACHE_MANAGER_CALLBACKS Callbacks,
8058   IN PVOID LazyWriteContext);
8059 
8060 NTKERNELAPI
8061 BOOLEAN
8062 NTAPI
8063 CcUninitializeCacheMap(
8064   IN PFILE_OBJECT FileObject,
8065   IN PLARGE_INTEGER TruncateSize OPTIONAL,
8066   IN PCACHE_UNINITIALIZE_EVENT UninitializeCompleteEvent OPTIONAL);
8067 
8068 NTKERNELAPI
8069 VOID
8070 NTAPI
8071 CcSetFileSizes(
8072   IN PFILE_OBJECT FileObject,
8073   IN PCC_FILE_SIZES FileSizes);
8074 
8075 NTKERNELAPI
8076 VOID
8077 NTAPI
8078 CcSetDirtyPageThreshold(
8079   IN PFILE_OBJECT FileObject,
8080   IN ULONG DirtyPageThreshold);
8081 
8082 NTKERNELAPI
8083 VOID
8084 NTAPI
8085 CcFlushCache(
8086   IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
8087   IN PLARGE_INTEGER FileOffset OPTIONAL,
8088   IN ULONG Length,
8089   OUT PIO_STATUS_BLOCK IoStatus OPTIONAL);
8090 
8091 NTKERNELAPI
8092 LARGE_INTEGER
8093 NTAPI
8094 CcGetFlushedValidData(
8095   IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
8096   IN BOOLEAN BcbListHeld);
8097 
8098 NTKERNELAPI
8099 BOOLEAN
8100 NTAPI
8101 CcZeroData(
8102   IN PFILE_OBJECT FileObject,
8103   IN PLARGE_INTEGER StartOffset,
8104   IN PLARGE_INTEGER EndOffset,
8105   IN BOOLEAN Wait);
8106 
8107 NTKERNELAPI
8108 PVOID
8109 NTAPI
8110 CcRemapBcb(
8111   IN PVOID Bcb);
8112 
8113 NTKERNELAPI
8114 VOID
8115 NTAPI
8116 CcRepinBcb(
8117   IN PVOID Bcb);
8118 
8119 NTKERNELAPI
8120 VOID
8121 NTAPI
8122 CcUnpinRepinnedBcb(
8123   IN PVOID Bcb,
8124   IN BOOLEAN WriteThrough,
8125   OUT PIO_STATUS_BLOCK IoStatus);
8126 
8127 NTKERNELAPI
8128 PFILE_OBJECT
8129 NTAPI
8130 CcGetFileObjectFromSectionPtrs(
8131   IN PSECTION_OBJECT_POINTERS SectionObjectPointer);
8132 
8133 NTKERNELAPI
8134 PFILE_OBJECT
8135 NTAPI
8136 CcGetFileObjectFromBcb(
8137   IN PVOID Bcb);
8138 
8139 NTKERNELAPI
8140 BOOLEAN
8141 NTAPI
8142 CcCanIWrite(
8143   IN PFILE_OBJECT FileObject,
8144   IN ULONG BytesToWrite,
8145   IN BOOLEAN Wait,
8146   IN BOOLEAN Retrying);
8147 
8148 NTKERNELAPI
8149 VOID
8150 NTAPI
8151 CcDeferWrite(
8152   IN PFILE_OBJECT FileObject,
8153   IN PCC_POST_DEFERRED_WRITE PostRoutine,
8154   IN PVOID Context1,
8155   IN PVOID Context2,
8156   IN ULONG BytesToWrite,
8157   IN BOOLEAN Retrying);
8158 
8159 NTKERNELAPI
8160 BOOLEAN
8161 NTAPI
8162 CcCopyRead(
8163   IN PFILE_OBJECT FileObject,
8164   IN PLARGE_INTEGER FileOffset,
8165   IN ULONG Length,
8166   IN BOOLEAN Wait,
8167   OUT PVOID Buffer,
8168   OUT PIO_STATUS_BLOCK IoStatus);
8169 
8170 NTKERNELAPI
8171 VOID
8172 NTAPI
8173 CcFastCopyRead(
8174   IN PFILE_OBJECT FileObject,
8175   IN ULONG FileOffset,
8176   IN ULONG Length,
8177   IN ULONG PageCount,
8178   OUT PVOID Buffer,
8179   OUT PIO_STATUS_BLOCK IoStatus);
8180 
8181 NTKERNELAPI
8182 BOOLEAN
8183 NTAPI
8184 CcCopyWrite(
8185   IN PFILE_OBJECT FileObject,
8186   IN PLARGE_INTEGER FileOffset,
8187   IN ULONG Length,
8188   IN BOOLEAN Wait,
8189   IN PVOID Buffer);
8190 
8191 NTKERNELAPI
8192 VOID
8193 NTAPI
8194 CcFastCopyWrite(
8195   IN PFILE_OBJECT FileObject,
8196   IN ULONG FileOffset,
8197   IN ULONG Length,
8198   IN PVOID Buffer);
8199 
8200 NTKERNELAPI
8201 VOID
8202 NTAPI
8203 CcMdlRead(
8204   IN PFILE_OBJECT FileObject,
8205   IN PLARGE_INTEGER FileOffset,
8206   IN ULONG Length,
8207   OUT PMDL *MdlChain,
8208   OUT PIO_STATUS_BLOCK IoStatus);
8209 
8210 NTKERNELAPI
8211 VOID
8212 NTAPI
8213 CcMdlReadComplete(
8214   IN PFILE_OBJECT FileObject,
8215   IN PMDL MdlChain);
8216 
8217 NTKERNELAPI
8218 VOID
8219 NTAPI
8220 CcPrepareMdlWrite(
8221   IN PFILE_OBJECT FileObject,
8222   IN PLARGE_INTEGER FileOffset,
8223   IN ULONG Length,
8224   OUT PMDL *MdlChain,
8225   OUT PIO_STATUS_BLOCK IoStatus);
8226 
8227 NTKERNELAPI
8228 VOID
8229 NTAPI
8230 CcMdlWriteComplete(
8231   IN PFILE_OBJECT FileObject,
8232   IN PLARGE_INTEGER FileOffset,
8233   IN PMDL MdlChain);
8234 
8235 NTKERNELAPI
8236 VOID
8237 NTAPI
8238 CcScheduleReadAhead(
8239   IN PFILE_OBJECT FileObject,
8240   IN PLARGE_INTEGER FileOffset,
8241   IN ULONG Length);
8242 
8243 NTKERNELAPI
8244 NTSTATUS
8245 NTAPI
8246 CcWaitForCurrentLazyWriterActivity(
8247   VOID);
8248 
8249 NTKERNELAPI
8250 VOID
8251 NTAPI
8252 CcSetReadAheadGranularity(
8253   IN PFILE_OBJECT FileObject,
8254   IN ULONG Granularity);
8255 
8256 NTKERNELAPI
8257 BOOLEAN
8258 NTAPI
8259 CcPinRead(
8260   IN PFILE_OBJECT FileObject,
8261   IN PLARGE_INTEGER FileOffset,
8262   IN ULONG Length,
8263   IN ULONG Flags,
8264   OUT PVOID *Bcb,
8265   OUT PVOID *Buffer);
8266 
8267 NTKERNELAPI
8268 BOOLEAN
8269 NTAPI
8270 CcPinMappedData(
8271   IN PFILE_OBJECT FileObject,
8272   IN PLARGE_INTEGER FileOffset,
8273   IN ULONG Length,
8274   IN ULONG Flags,
8275   IN OUT PVOID *Bcb);
8276 
8277 NTKERNELAPI
8278 BOOLEAN
8279 NTAPI
8280 CcPreparePinWrite(
8281   IN PFILE_OBJECT FileObject,
8282   IN PLARGE_INTEGER FileOffset,
8283   IN ULONG Length,
8284   IN BOOLEAN Zero,
8285   IN ULONG Flags,
8286   OUT PVOID *Bcb,
8287   OUT PVOID *Buffer);
8288 
8289 NTKERNELAPI
8290 VOID
8291 NTAPI
8292 CcSetDirtyPinnedData(
8293   IN PVOID BcbVoid,
8294   IN PLARGE_INTEGER Lsn OPTIONAL);
8295 
8296 NTKERNELAPI
8297 VOID
8298 NTAPI
8299 CcUnpinData(
8300   IN PVOID Bcb);
8301 
8302 NTKERNELAPI
8303 VOID
8304 NTAPI
8305 CcSetBcbOwnerPointer(
8306   IN PVOID Bcb,
8307   IN PVOID OwnerPointer);
8308 
8309 NTKERNELAPI
8310 VOID
8311 NTAPI
8312 CcUnpinDataForThread(
8313   IN PVOID Bcb,
8314   IN ERESOURCE_THREAD ResourceThreadId);
8315 
8316 NTKERNELAPI
8317 VOID
8318 NTAPI
8319 CcSetAdditionalCacheAttributes(
8320   IN PFILE_OBJECT FileObject,
8321   IN BOOLEAN DisableReadAhead,
8322   IN BOOLEAN DisableWriteBehind);
8323 
8324 NTKERNELAPI
8325 BOOLEAN
8326 NTAPI
8327 CcIsThereDirtyData(
8328   IN PVPB Vpb);
8329 
8330 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
8331 
8332 #if (NTDDI_VERSION >= NTDDI_WINXP)
8333 
8334 NTKERNELAPI
8335 VOID
8336 NTAPI
8337 CcMdlWriteAbort(
8338   IN PFILE_OBJECT FileObject,
8339   IN PMDL MdlChain);
8340 
8341 NTKERNELAPI
8342 VOID
8343 NTAPI
8344 CcSetLogHandleForFile(
8345   IN PFILE_OBJECT FileObject,
8346   IN PVOID LogHandle,
8347   IN PFLUSH_TO_LSN FlushToLsnRoutine);
8348 
8349 NTKERNELAPI
8350 LARGE_INTEGER
8351 NTAPI
8352 CcGetDirtyPages(
8353   IN PVOID LogHandle,
8354   IN PDIRTY_PAGE_ROUTINE DirtyPageRoutine,
8355   IN PVOID Context1,
8356   IN PVOID Context2);
8357 
8358 #endif
8359 
8360 #if (NTDDI_VERSION >= NTDDI_WINXP)
8361 NTKERNELAPI
8362 BOOLEAN
8363 NTAPI
8364 CcMapData(
8365   IN PFILE_OBJECT FileObject,
8366   IN PLARGE_INTEGER FileOffset,
8367   IN ULONG Length,
8368   IN ULONG Flags,
8369   OUT PVOID *Bcb,
8370   OUT PVOID *Buffer);
8371 #elif (NTDDI_VERSION >= NTDDI_WIN2K)
8372 NTKERNELAPI
8373 BOOLEAN
8374 NTAPI
8375 CcMapData(
8376   IN PFILE_OBJECT FileObject,
8377   IN PLARGE_INTEGER FileOffset,
8378   IN ULONG Length,
8379   IN BOOLEAN Wait,
8380   OUT PVOID *Bcb,
8381   OUT PVOID *Buffer);
8382 #endif
8383 
8384 #if (NTDDI_VERSION >= NTDDI_VISTA)
8385 
8386 NTKERNELAPI
8387 NTSTATUS
8388 NTAPI
8389 CcSetFileSizesEx(
8390   IN PFILE_OBJECT FileObject,
8391   IN PCC_FILE_SIZES FileSizes);
8392 
8393 NTKERNELAPI
8394 PFILE_OBJECT
8395 NTAPI
8396 CcGetFileObjectFromSectionPtrsRef(
8397   IN PSECTION_OBJECT_POINTERS SectionObjectPointer);
8398 
8399 NTKERNELAPI
8400 VOID
8401 NTAPI
8402 CcSetParallelFlushFile(
8403   IN PFILE_OBJECT FileObject,
8404   IN BOOLEAN EnableParallelFlush);
8405 
8406 NTKERNELAPI
8407 BOOLEAN
8408 CcIsThereDirtyDataEx(
8409   IN PVPB Vpb,
8410   IN PULONG NumberOfDirtyPages OPTIONAL);
8411 
8412 #endif
8413 
8414 #if (NTDDI_VERSION >= NTDDI_WIN7)
8415 NTKERNELAPI
8416 VOID
8417 NTAPI
8418 CcCoherencyFlushAndPurgeCache(
8419   IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
8420   IN PLARGE_INTEGER FileOffset OPTIONAL,
8421   IN ULONG Length,
8422   OUT PIO_STATUS_BLOCK IoStatus,
8423   IN ULONG Flags OPTIONAL);
8424 #endif
8425 
8426 #define CcGetFileSizePointer(FO) (                                     \
8427     ((PLARGE_INTEGER)((FO)->SectionObjectPointer->SharedCacheMap) + 1) \
8428 )
8429 
8430 #if (NTDDI_VERSION >= NTDDI_VISTA)
8431 NTKERNELAPI
8432 BOOLEAN
8433 NTAPI
8434 CcPurgeCacheSection(
8435   IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
8436   IN PLARGE_INTEGER FileOffset OPTIONAL,
8437   IN ULONG Length,
8438   IN ULONG Flags);
8439 #elif (NTDDI_VERSION >= NTDDI_WIN2K)
8440 NTKERNELAPI
8441 BOOLEAN
8442 NTAPI
8443 CcPurgeCacheSection(
8444   IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
8445   IN PLARGE_INTEGER FileOffset OPTIONAL,
8446   IN ULONG Length,
8447   IN BOOLEAN UninitializeCacheMaps);
8448 #endif
8449 
8450 #if (NTDDI_VERSION >= NTDDI_WIN7)
8451 NTKERNELAPI
8452 BOOLEAN
8453 NTAPI
8454 CcCopyWriteWontFlush(
8455   IN PFILE_OBJECT FileObject,
8456   IN PLARGE_INTEGER FileOffset,
8457   IN ULONG Length);
8458 #else
8459 #define CcCopyWriteWontFlush(FO, FOFF, LEN) ((LEN) <= 0x10000)
8460 #endif
8461 
8462 #define CcReadAhead(FO, FOFF, LEN) (                \
8463     if ((LEN) >= 256) {                             \
8464         CcScheduleReadAhead((FO), (FOFF), (LEN));   \
8465     }                                               \
8466 )
8467 
8468 
8469 /******************************************************************************
8470  *                            ZwXxx Functions                                 *
8471  ******************************************************************************/
8472 
8473 NTSYSAPI
8474 NTSTATUS
8475 NTAPI
8476 ZwQueryEaFile(
8477   IN HANDLE FileHandle,
8478   OUT PIO_STATUS_BLOCK IoStatusBlock,
8479   OUT PVOID Buffer,
8480   IN ULONG Length,
8481   IN BOOLEAN ReturnSingleEntry,
8482   IN PVOID EaList OPTIONAL,
8483   IN ULONG EaListLength,
8484   IN PULONG EaIndex OPTIONAL,
8485   IN BOOLEAN RestartScan);
8486 
8487 NTSYSAPI
8488 NTSTATUS
8489 NTAPI
8490 ZwSetEaFile(
8491   IN HANDLE FileHandle,
8492   OUT PIO_STATUS_BLOCK IoStatusBlock,
8493   OUT PVOID Buffer,
8494   IN ULONG Length);
8495 
8496 NTSYSAPI
8497 NTSTATUS
8498 NTAPI
8499 ZwDuplicateToken(
8500   IN HANDLE ExistingTokenHandle,
8501   IN ACCESS_MASK DesiredAccess,
8502   IN POBJECT_ATTRIBUTES ObjectAttributes,
8503   IN BOOLEAN EffectiveOnly,
8504   IN TOKEN_TYPE TokenType,
8505   OUT PHANDLE NewTokenHandle);
8506 
8507 #if (NTDDI_VERSION >= NTDDI_WIN2K)
8508 
8509 NTSYSAPI
8510 NTSTATUS
8511 NTAPI
8512 ZwQueryObject(
8513   IN HANDLE Handle OPTIONAL,
8514   IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
8515   OUT PVOID ObjectInformation OPTIONAL,
8516   IN ULONG ObjectInformationLength,
8517   OUT PULONG ReturnLength OPTIONAL);
8518 
8519 NTSYSAPI
8520 NTSTATUS
8521 NTAPI
8522 ZwNotifyChangeKey(
8523   IN HANDLE KeyHandle,
8524   IN HANDLE EventHandle OPTIONAL,
8525   IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
8526   IN PVOID ApcContext OPTIONAL,
8527   OUT PIO_STATUS_BLOCK IoStatusBlock,
8528   IN ULONG NotifyFilter,
8529   IN BOOLEAN WatchSubtree,
8530   OUT PVOID Buffer,
8531   IN ULONG BufferLength,
8532   IN BOOLEAN Asynchronous);
8533 
8534 NTSYSAPI
8535 NTSTATUS
8536 NTAPI
8537 ZwCreateEvent(
8538   OUT PHANDLE EventHandle,
8539   IN ACCESS_MASK DesiredAccess,
8540   IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
8541   IN EVENT_TYPE EventType,
8542   IN BOOLEAN InitialState);
8543 
8544 NTSYSAPI
8545 NTSTATUS
8546 NTAPI
8547 ZwDeleteFile(
8548   IN POBJECT_ATTRIBUTES ObjectAttributes);
8549 
8550 NTSYSAPI
8551 NTSTATUS
8552 NTAPI
8553 ZwQueryDirectoryFile(
8554   IN HANDLE FileHandle,
8555   IN HANDLE Event OPTIONAL,
8556   IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
8557   IN PVOID ApcContext OPTIONAL,
8558   OUT PIO_STATUS_BLOCK IoStatusBlock,
8559   OUT PVOID FileInformation,
8560   IN ULONG Length,
8561   IN FILE_INFORMATION_CLASS FileInformationClass,
8562   IN BOOLEAN ReturnSingleEntry,
8563   IN PUNICODE_STRING FileName OPTIONAL,
8564   IN BOOLEAN RestartScan);
8565 
8566 NTSYSAPI
8567 NTSTATUS
8568 NTAPI
8569 ZwSetVolumeInformationFile(
8570   IN HANDLE FileHandle,
8571   OUT PIO_STATUS_BLOCK IoStatusBlock,
8572   IN PVOID FsInformation,
8573   IN ULONG Length,
8574   IN FS_INFORMATION_CLASS FsInformationClass);
8575 
8576 NTSYSAPI
8577 NTSTATUS
8578 NTAPI
8579 ZwFsControlFile(
8580   IN HANDLE FileHandle,
8581   IN HANDLE Event OPTIONAL,
8582   IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
8583   IN PVOID ApcContext OPTIONAL,
8584   OUT PIO_STATUS_BLOCK IoStatusBlock,
8585   IN ULONG FsControlCode,
8586   IN PVOID InputBuffer OPTIONAL,
8587   IN ULONG InputBufferLength,
8588   OUT PVOID OutputBuffer OPTIONAL,
8589   IN ULONG OutputBufferLength);
8590 
8591 NTSYSAPI
8592 NTSTATUS
8593 NTAPI
8594 ZwDuplicateObject(
8595   IN HANDLE SourceProcessHandle,
8596   IN HANDLE SourceHandle,
8597   IN HANDLE TargetProcessHandle OPTIONAL,
8598   OUT PHANDLE TargetHandle OPTIONAL,
8599   IN ACCESS_MASK DesiredAccess,
8600   IN ULONG HandleAttributes,
8601   IN ULONG Options);
8602 
8603 NTSYSAPI
8604 NTSTATUS
8605 NTAPI
8606 ZwOpenDirectoryObject(
8607   OUT PHANDLE DirectoryHandle,
8608   IN ACCESS_MASK DesiredAccess,
8609   IN POBJECT_ATTRIBUTES ObjectAttributes);
8610 
8611 NTSYSAPI
8612 NTSTATUS
8613 NTAPI
8614 ZwAllocateVirtualMemory(
8615   IN HANDLE ProcessHandle,
8616   IN OUT PVOID *BaseAddress,
8617   IN ULONG_PTR ZeroBits,
8618   IN OUT PSIZE_T RegionSize,
8619   IN ULONG AllocationType,
8620   IN ULONG Protect);
8621 
8622 NTSYSAPI
8623 NTSTATUS
8624 NTAPI
8625 ZwFreeVirtualMemory(
8626   IN HANDLE ProcessHandle,
8627   IN OUT PVOID *BaseAddress,
8628   IN OUT PSIZE_T RegionSize,
8629   IN ULONG FreeType);
8630 
8631 NTSYSAPI
8632 NTSTATUS
8633 NTAPI
8634 ZwWaitForSingleObject(
8635   IN HANDLE Handle,
8636   IN BOOLEAN Alertable,
8637   IN PLARGE_INTEGER Timeout OPTIONAL);
8638 
8639 NTSYSAPI
8640 NTSTATUS
8641 NTAPI
8642 ZwSetEvent(
8643   IN HANDLE EventHandle,
8644   OUT PLONG PreviousState OPTIONAL);
8645 
8646 NTSYSAPI
8647 NTSTATUS
8648 NTAPI
8649 ZwFlushVirtualMemory(
8650   IN HANDLE ProcessHandle,
8651   IN OUT PVOID *BaseAddress,
8652   IN OUT PSIZE_T RegionSize,
8653   OUT PIO_STATUS_BLOCK IoStatusBlock);
8654 
8655 NTSYSAPI
8656 NTSTATUS
8657 NTAPI
8658 ZwQueryInformationToken(
8659   IN HANDLE TokenHandle,
8660   IN TOKEN_INFORMATION_CLASS TokenInformationClass,
8661   OUT PVOID TokenInformation,
8662   IN ULONG Length,
8663   OUT PULONG ResultLength);
8664 
8665 NTSYSAPI
8666 NTSTATUS
8667 NTAPI
8668 ZwSetSecurityObject(
8669   IN HANDLE Handle,
8670   IN SECURITY_INFORMATION SecurityInformation,
8671   IN PSECURITY_DESCRIPTOR SecurityDescriptor);
8672 
8673 NTSYSAPI
8674 NTSTATUS
8675 NTAPI
8676 ZwQuerySecurityObject(
8677   IN HANDLE FileHandle,
8678   IN SECURITY_INFORMATION SecurityInformation,
8679   OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
8680   IN ULONG Length,
8681   OUT PULONG ResultLength);
8682 #endif /* (NTDDI_VERSION >= NTDDI_WIN2K) */
8683 
8684 #if (NTDDI_VERSION >= NTDDI_WINXP)
8685 
8686 NTSYSAPI
8687 NTSTATUS
8688 NTAPI
8689 ZwOpenProcessTokenEx(
8690   IN HANDLE ProcessHandle,
8691   IN ACCESS_MASK DesiredAccess,
8692   IN ULONG HandleAttributes,
8693   OUT PHANDLE TokenHandle);
8694 
8695 NTSYSAPI
8696 NTSTATUS
8697 NTAPI
8698 ZwOpenThreadTokenEx(
8699   IN HANDLE ThreadHandle,
8700   IN ACCESS_MASK DesiredAccess,
8701   IN BOOLEAN OpenAsSelf,
8702   IN ULONG HandleAttributes,
8703   OUT PHANDLE TokenHandle);
8704 
8705 #endif /* (NTDDI_VERSION >= NTDDI_WINXP) */
8706 
8707 #if (NTDDI_VERSION >= NTDDI_VISTA)
8708 
8709 NTSYSAPI
8710 NTSTATUS
8711 NTAPI
8712 ZwLockFile(
8713   IN HANDLE FileHandle,
8714   IN HANDLE Event OPTIONAL,
8715   IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
8716   IN PVOID ApcContext OPTIONAL,
8717   OUT PIO_STATUS_BLOCK IoStatusBlock,
8718   IN PLARGE_INTEGER ByteOffset,
8719   IN PLARGE_INTEGER Length,
8720   IN ULONG Key,
8721   IN BOOLEAN FailImmediately,
8722   IN BOOLEAN ExclusiveLock);
8723 
8724 NTSYSAPI
8725 NTSTATUS
8726 NTAPI
8727 ZwUnlockFile(
8728   IN HANDLE FileHandle,
8729   OUT PIO_STATUS_BLOCK IoStatusBlock,
8730   IN PLARGE_INTEGER ByteOffset,
8731   IN PLARGE_INTEGER Length,
8732   IN ULONG Key);
8733 
8734 NTSYSAPI
8735 NTSTATUS
8736 NTAPI
8737 ZwQueryQuotaInformationFile(
8738   IN HANDLE FileHandle,
8739   OUT PIO_STATUS_BLOCK IoStatusBlock,
8740   OUT PVOID Buffer,
8741   IN ULONG Length,
8742   IN BOOLEAN ReturnSingleEntry,
8743   IN PVOID SidList,
8744   IN ULONG SidListLength,
8745   IN PSID StartSid OPTIONAL,
8746   IN BOOLEAN RestartScan);
8747 
8748 NTSYSAPI
8749 NTSTATUS
8750 NTAPI
8751 ZwSetQuotaInformationFile(
8752   IN HANDLE FileHandle,
8753   OUT PIO_STATUS_BLOCK IoStatusBlock,
8754   IN PVOID Buffer,
8755   IN ULONG Length);
8756 
8757 NTSYSAPI
8758 NTSTATUS
8759 NTAPI
8760 ZwFlushBuffersFile(
8761   IN HANDLE FileHandle,
8762   OUT PIO_STATUS_BLOCK IoStatusBlock);
8763 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
8764 
8765 #if (NTDDI_VERSION >= NTDDI_WIN7)
8766 
8767 NTSYSAPI
8768 NTSTATUS
8769 NTAPI
8770 ZwSetInformationToken(
8771   IN HANDLE TokenHandle,
8772   IN TOKEN_INFORMATION_CLASS TokenInformationClass,
8773   IN PVOID TokenInformation,
8774   IN ULONG TokenInformationLength);
8775 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
8776 
8777 
8778 /* #if !defined(_X86AMD64_)  FIXME : WHAT ?! */
8779 #if defined(_WIN64)
8780 
8781 C_ASSERT(sizeof(ERESOURCE) == 0x68);
8782 C_ASSERT(FIELD_OFFSET(ERESOURCE,ActiveCount) == 0x18);
8783 C_ASSERT(FIELD_OFFSET(ERESOURCE,Flag) == 0x1a);
8784 
8785 #else
8786 
8787 C_ASSERT(sizeof(ERESOURCE) == 0x38);
8788 C_ASSERT(FIELD_OFFSET(ERESOURCE,ActiveCount) == 0x0c);
8789 C_ASSERT(FIELD_OFFSET(ERESOURCE,Flag) == 0x0e);
8790 
8791 #endif
8792 /* #endif */
8793 
8794 #if defined(_IA64_)
8795 #if (NTDDI_VERSION >= NTDDI_WIN2K)
8796 //DECLSPEC_DEPRECATED_DDK
8797 NTHALAPI
8798 ULONG
8799 NTAPI
8800 HalGetDmaAlignmentRequirement(
8801   VOID);
8802 #endif
8803 #endif
8804 
8805 #if defined(_M_IX86) || defined(_M_AMD64)
8806 #define HalGetDmaAlignmentRequirement() 1L
8807 #endif
8808 
8809 extern NTKERNELAPI PUSHORT NlsOemLeadByteInfo;
8810 #define NLS_OEM_LEAD_BYTE_INFO            NlsOemLeadByteInfo
8811 
8812 #ifdef NLS_MB_CODE_PAGE_TAG
8813 #undef NLS_MB_CODE_PAGE_TAG
8814 #endif
8815 #define NLS_MB_CODE_PAGE_TAG              NlsMbOemCodePageTag
8816 
8817 #if (NTDDI_VERSION >= NTDDI_VISTA)
8818 
8819 typedef enum _NETWORK_OPEN_LOCATION_QUALIFIER {
8820   NetworkOpenLocationAny,
8821   NetworkOpenLocationRemote,
8822   NetworkOpenLocationLoopback
8823 } NETWORK_OPEN_LOCATION_QUALIFIER;
8824 
8825 typedef enum _NETWORK_OPEN_INTEGRITY_QUALIFIER {
8826   NetworkOpenIntegrityAny,
8827   NetworkOpenIntegrityNone,
8828   NetworkOpenIntegritySigned,
8829   NetworkOpenIntegrityEncrypted,
8830   NetworkOpenIntegrityMaximum
8831 } NETWORK_OPEN_INTEGRITY_QUALIFIER;
8832 
8833 #if (NTDDI_VERSION >= NTDDI_WIN7)
8834 
8835 #define NETWORK_OPEN_ECP_IN_FLAG_DISABLE_HANDLE_COLLAPSING 0x1
8836 #define NETWORK_OPEN_ECP_IN_FLAG_DISABLE_HANDLE_DURABILITY 0x2
8837 #define NETWORK_OPEN_ECP_IN_FLAG_FORCE_BUFFERED_SYNCHRONOUS_IO_HACK 0x80000000
8838 
8839 typedef struct _NETWORK_OPEN_ECP_CONTEXT {
8840   USHORT Size;
8841   USHORT Reserved;
8842   _ANONYMOUS_STRUCT struct {
8843     struct {
8844       NETWORK_OPEN_LOCATION_QUALIFIER Location;
8845       NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
8846       ULONG Flags;
8847     } in;
8848     struct {
8849       NETWORK_OPEN_LOCATION_QUALIFIER Location;
8850       NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
8851       ULONG Flags;
8852     } out;
8853   } DUMMYSTRUCTNAME;
8854 } NETWORK_OPEN_ECP_CONTEXT, *PNETWORK_OPEN_ECP_CONTEXT;
8855 
8856 typedef struct _NETWORK_OPEN_ECP_CONTEXT_V0 {
8857   USHORT Size;
8858   USHORT Reserved;
8859   _ANONYMOUS_STRUCT struct {
8860     struct {
8861     NETWORK_OPEN_LOCATION_QUALIFIER Location;
8862     NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
8863     } in;
8864     struct {
8865       NETWORK_OPEN_LOCATION_QUALIFIER Location;
8866       NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
8867     } out;
8868   } DUMMYSTRUCTNAME;
8869 } NETWORK_OPEN_ECP_CONTEXT_V0, *PNETWORK_OPEN_ECP_CONTEXT_V0;
8870 
8871 #elif (NTDDI_VERSION >= NTDDI_VISTA)
8872 typedef struct _NETWORK_OPEN_ECP_CONTEXT {
8873   USHORT Size;
8874   USHORT Reserved;
8875   _ANONYMOUS_STRUCT struct {
8876     struct {
8877       NETWORK_OPEN_LOCATION_QUALIFIER Location;
8878       NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
8879     } in;
8880     struct {
8881       NETWORK_OPEN_LOCATION_QUALIFIER Location;
8882       NETWORK_OPEN_INTEGRITY_QUALIFIER Integrity;
8883     } out;
8884   } DUMMYSTRUCTNAME;
8885 } NETWORK_OPEN_ECP_CONTEXT, *PNETWORK_OPEN_ECP_CONTEXT;
8886 #endif
8887 
8888 DEFINE_GUID(GUID_ECP_NETWORK_OPEN_CONTEXT, 0xc584edbf, 0x00df, 0x4d28, 0xb8, 0x84, 0x35, 0xba, 0xca, 0x89, 0x11, 0xe8);
8889 
8890 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
8891 
8892 
8893 #if (NTDDI_VERSION >= NTDDI_VISTA)
8894 
8895 typedef struct _PREFETCH_OPEN_ECP_CONTEXT {
8896   PVOID Context;
8897 } PREFETCH_OPEN_ECP_CONTEXT, *PPREFETCH_OPEN_ECP_CONTEXT;
8898 
8899 DEFINE_GUID(GUID_ECP_PREFETCH_OPEN, 0xe1777b21, 0x847e, 0x4837, 0xaa, 0x45, 0x64, 0x16, 0x1d, 0x28, 0x6, 0x55);
8900 
8901 #endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
8902 
8903 #if (NTDDI_VERSION >= NTDDI_WIN7)
8904 
8905 DEFINE_GUID (GUID_ECP_NFS_OPEN, 0xf326d30c, 0xe5f8, 0x4fe7, 0xab, 0x74, 0xf5, 0xa3, 0x19, 0x6d, 0x92, 0xdb);
8906 DEFINE_GUID (GUID_ECP_SRV_OPEN, 0xbebfaebc, 0xaabf, 0x489d, 0x9d, 0x2c, 0xe9, 0xe3, 0x61, 0x10, 0x28, 0x53);
8907 
8908 typedef struct sockaddr_storage *PSOCKADDR_STORAGE_NFS;
8909 
8910 typedef struct _NFS_OPEN_ECP_CONTEXT {
8911   PUNICODE_STRING ExportAlias;
8912   PSOCKADDR_STORAGE_NFS ClientSocketAddress;
8913 } NFS_OPEN_ECP_CONTEXT, *PNFS_OPEN_ECP_CONTEXT, **PPNFS_OPEN_ECP_CONTEXT;
8914 
8915 typedef struct _SRV_OPEN_ECP_CONTEXT {
8916   PUNICODE_STRING ShareName;
8917   PSOCKADDR_STORAGE_NFS SocketAddress;
8918   BOOLEAN OplockBlockState;
8919   BOOLEAN OplockAppState;
8920   BOOLEAN OplockFinalState;
8921 } SRV_OPEN_ECP_CONTEXT, *PSRV_OPEN_ECP_CONTEXT;
8922 
8923 #endif /* (NTDDI_VERSION >= NTDDI_WIN7) */
8924 
8925 #define PIN_WAIT                        (1)
8926 #define PIN_EXCLUSIVE                   (2)
8927 #define PIN_NO_READ                     (4)
8928 #define PIN_IF_BCB                      (8)
8929 #define PIN_CALLER_TRACKS_DIRTY_DATA    (32)
8930 #define PIN_HIGH_PRIORITY               (64)
8931 
8932 #define MAP_WAIT                        1
8933 #define MAP_NO_READ                     (16)
8934 #define MAP_HIGH_PRIORITY               (64)
8935 
8936 #define IOCTL_REDIR_QUERY_PATH          CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 99, METHOD_NEITHER, FILE_ANY_ACCESS)
8937 #define IOCTL_REDIR_QUERY_PATH_EX       CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 100, METHOD_NEITHER, FILE_ANY_ACCESS)
8938 
8939 typedef struct _QUERY_PATH_REQUEST {
8940   ULONG PathNameLength;
8941   PIO_SECURITY_CONTEXT SecurityContext;
8942   WCHAR FilePathName[1];
8943 } QUERY_PATH_REQUEST, *PQUERY_PATH_REQUEST;
8944 
8945 typedef struct _QUERY_PATH_REQUEST_EX {
8946   PIO_SECURITY_CONTEXT pSecurityContext;
8947   ULONG EaLength;
8948   PVOID pEaBuffer;
8949   UNICODE_STRING PathName;
8950   UNICODE_STRING DomainServiceName;
8951   ULONG_PTR Reserved[ 3 ];
8952 } QUERY_PATH_REQUEST_EX, *PQUERY_PATH_REQUEST_EX;
8953 
8954 typedef struct _QUERY_PATH_RESPONSE {
8955   ULONG LengthAccepted;
8956 } QUERY_PATH_RESPONSE, *PQUERY_PATH_RESPONSE;
8957 
8958 #define VOLSNAPCONTROLTYPE                              0x00000053
8959 #define IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES             CTL_CODE(VOLSNAPCONTROLTYPE, 0, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
8960 
8961 /* FIXME : These definitions below don't belong here (or anywhere in ddk really) */
8962 #pragma pack(push,4)
8963 
8964 #ifndef VER_PRODUCTBUILD
8965 #define VER_PRODUCTBUILD 10000
8966 #endif
8967 
8968 #include "csq.h"
8969 
8970 extern PACL                         SePublicDefaultDacl;
8971 extern PACL                         SeSystemDefaultDacl;
8972 
8973 #define FS_LFN_APIS                             0x00004000
8974 
8975 #define FILE_STORAGE_TYPE_SPECIFIED             0x00000041  /* FILE_DIRECTORY_FILE | FILE_NON_DIRECTORY_FILE */
8976 #define FILE_STORAGE_TYPE_DEFAULT               (StorageTypeDefault << FILE_STORAGE_TYPE_SHIFT)
8977 #define FILE_STORAGE_TYPE_DIRECTORY             (StorageTypeDirectory << FILE_STORAGE_TYPE_SHIFT)
8978 #define FILE_STORAGE_TYPE_FILE                  (StorageTypeFile << FILE_STORAGE_TYPE_SHIFT)
8979 #define FILE_STORAGE_TYPE_DOCFILE               (StorageTypeDocfile << FILE_STORAGE_TYPE_SHIFT)
8980 #define FILE_STORAGE_TYPE_JUNCTION_POINT        (StorageTypeJunctionPoint << FILE_STORAGE_TYPE_SHIFT)
8981 #define FILE_STORAGE_TYPE_CATALOG               (StorageTypeCatalog << FILE_STORAGE_TYPE_SHIFT)
8982 #define FILE_STORAGE_TYPE_STRUCTURED_STORAGE    (StorageTypeStructuredStorage << FILE_STORAGE_TYPE_SHIFT)
8983 #define FILE_STORAGE_TYPE_EMBEDDING             (StorageTypeEmbedding << FILE_STORAGE_TYPE_SHIFT)
8984 #define FILE_STORAGE_TYPE_STREAM                (StorageTypeStream << FILE_STORAGE_TYPE_SHIFT)
8985 #define FILE_MINIMUM_STORAGE_TYPE               FILE_STORAGE_TYPE_DEFAULT
8986 #define FILE_MAXIMUM_STORAGE_TYPE               FILE_STORAGE_TYPE_STREAM
8987 #define FILE_STORAGE_TYPE_MASK                  0x000f0000
8988 #define FILE_STORAGE_TYPE_SHIFT                 16
8989 
8990 #define FILE_VC_QUOTAS_LOG_VIOLATIONS           0x00000004
8991 
8992 #ifdef _X86_
8993 #define HARDWARE_PTE    HARDWARE_PTE_X86
8994 #define PHARDWARE_PTE   PHARDWARE_PTE_X86
8995 #endif
8996 
8997 #define IO_ATTACH_DEVICE_API            0x80000000
8998 
8999 #define IO_TYPE_APC                     18
9000 #define IO_TYPE_DPC                     19
9001 #define IO_TYPE_DEVICE_QUEUE            20
9002 #define IO_TYPE_EVENT_PAIR              21
9003 #define IO_TYPE_INTERRUPT               22
9004 #define IO_TYPE_PROFILE                 23
9005 
9006 #define IRP_BEING_VERIFIED              0x10
9007 
9008 #define MAILSLOT_CLASS_FIRSTCLASS       1
9009 #define MAILSLOT_CLASS_SECONDCLASS      2
9010 
9011 #define MAILSLOT_SIZE_AUTO              0
9012 
9013 #define MEM_DOS_LIM                     0x40000000
9014 
9015 #define OB_TYPE_TYPE                    1
9016 #define OB_TYPE_DIRECTORY               2
9017 #define OB_TYPE_SYMBOLIC_LINK           3
9018 #define OB_TYPE_TOKEN                   4
9019 #define OB_TYPE_PROCESS                 5
9020 #define OB_TYPE_THREAD                  6
9021 #define OB_TYPE_EVENT                   7
9022 #define OB_TYPE_EVENT_PAIR              8
9023 #define OB_TYPE_MUTANT                  9
9024 #define OB_TYPE_SEMAPHORE               10
9025 #define OB_TYPE_TIMER                   11
9026 #define OB_TYPE_PROFILE                 12
9027 #define OB_TYPE_WINDOW_STATION          13
9028 #define OB_TYPE_DESKTOP                 14
9029 #define OB_TYPE_SECTION                 15
9030 #define OB_TYPE_KEY                     16
9031 #define OB_TYPE_PORT                    17
9032 #define OB_TYPE_ADAPTER                 18
9033 #define OB_TYPE_CONTROLLER              19
9034 #define OB_TYPE_DEVICE                  20
9035 #define OB_TYPE_DRIVER                  21
9036 #define OB_TYPE_IO_COMPLETION           22
9037 #define OB_TYPE_FILE                    23
9038 
9039 #define SEC_BASED 0x00200000
9040 
9041 /* end winnt.h */
9042 
9043 #define TOKEN_HAS_ADMIN_GROUP           0x08
9044 
9045 #if (VER_PRODUCTBUILD >= 1381)
9046 #define FSCTL_GET_HFS_INFORMATION       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 31, METHOD_BUFFERED, FILE_ANY_ACCESS)
9047 #endif /* (VER_PRODUCTBUILD >= 1381) */
9048 
9049 #if (VER_PRODUCTBUILD >= 2195)
9050 
9051 #define FSCTL_READ_PROPERTY_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 33, METHOD_NEITHER, FILE_ANY_ACCESS)
9052 #define FSCTL_WRITE_PROPERTY_DATA       CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 34, METHOD_NEITHER, FILE_ANY_ACCESS)
9053 
9054 #define FSCTL_DUMP_PROPERTY_DATA        CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 37,  METHOD_NEITHER, FILE_ANY_ACCESS)
9055 
9056 #define FSCTL_HSM_MSG                   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 66, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA)
9057 #define FSCTL_NSS_CONTROL               CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 67, METHOD_BUFFERED, FILE_WRITE_DATA)
9058 #define FSCTL_HSM_DATA                  CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 68, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
9059 #define FSCTL_NSS_RCONTROL              CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 70, METHOD_BUFFERED, FILE_READ_DATA)
9060 #endif /* (VER_PRODUCTBUILD >= 2195) */
9061 
9062 #define FSCTL_NETWORK_SET_CONFIGURATION_INFO    CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 102, METHOD_IN_DIRECT, FILE_ANY_ACCESS)
9063 #define FSCTL_NETWORK_GET_CONFIGURATION_INFO    CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 103, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
9064 #define FSCTL_NETWORK_GET_CONNECTION_INFO       CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 104, METHOD_NEITHER, FILE_ANY_ACCESS)
9065 #define FSCTL_NETWORK_ENUMERATE_CONNECTIONS     CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 105, METHOD_NEITHER, FILE_ANY_ACCESS)
9066 #define FSCTL_NETWORK_DELETE_CONNECTION         CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 107, METHOD_BUFFERED, FILE_ANY_ACCESS)
9067 #define FSCTL_NETWORK_GET_STATISTICS            CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 116, METHOD_BUFFERED, FILE_ANY_ACCESS)
9068 #define FSCTL_NETWORK_SET_DOMAIN_NAME           CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_ANY_ACCESS)
9069 #define FSCTL_NETWORK_REMOTE_BOOT_INIT_SCRT     CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 250, METHOD_BUFFERED, FILE_ANY_ACCESS)
9070 
9071 typedef enum _FILE_STORAGE_TYPE {
9072     StorageTypeDefault = 1,
9073     StorageTypeDirectory,
9074     StorageTypeFile,
9075     StorageTypeJunctionPoint,
9076     StorageTypeCatalog,
9077     StorageTypeStructuredStorage,
9078     StorageTypeEmbedding,
9079     StorageTypeStream
9080 } FILE_STORAGE_TYPE;
9081 
9082 typedef struct _OBJECT_BASIC_INFORMATION
9083 {
9084     ULONG Attributes;
9085     ACCESS_MASK GrantedAccess;
9086     ULONG HandleCount;
9087     ULONG PointerCount;
9088     ULONG PagedPoolCharge;
9089     ULONG NonPagedPoolCharge;
9090     ULONG Reserved[ 3 ];
9091     ULONG NameInfoSize;
9092     ULONG TypeInfoSize;
9093     ULONG SecurityDescriptorSize;
9094     LARGE_INTEGER CreationTime;
9095 } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
9096 
9097 typedef struct _BITMAP_RANGE {
9098     LIST_ENTRY      Links;
9099     LONGLONG        BasePage;
9100     ULONG           FirstDirtyPage;
9101     ULONG           LastDirtyPage;
9102     ULONG           DirtyPages;
9103     PULONG          Bitmap;
9104 } BITMAP_RANGE, *PBITMAP_RANGE;
9105 
9106 typedef struct _FILE_COPY_ON_WRITE_INFORMATION {
9107     BOOLEAN ReplaceIfExists;
9108     HANDLE  RootDirectory;
9109     ULONG   FileNameLength;
9110     WCHAR   FileName[1];
9111 } FILE_COPY_ON_WRITE_INFORMATION, *PFILE_COPY_ON_WRITE_INFORMATION;
9112 
9113 typedef struct _FILE_FULL_DIRECTORY_INFORMATION {
9114     ULONG           NextEntryOffset;
9115     ULONG           FileIndex;
9116     LARGE_INTEGER   CreationTime;
9117     LARGE_INTEGER   LastAccessTime;
9118     LARGE_INTEGER   LastWriteTime;
9119     LARGE_INTEGER   ChangeTime;
9120     LARGE_INTEGER   EndOfFile;
9121     LARGE_INTEGER   AllocationSize;
9122     ULONG           FileAttributes;
9123     ULONG           FileNameLength;
9124     ULONG           EaSize;
9125     WCHAR           FileName[ANYSIZE_ARRAY];
9126 } FILE_FULL_DIRECTORY_INFORMATION, *PFILE_FULL_DIRECTORY_INFORMATION;
9127 
9128 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
9129 typedef struct _FILE_SHARED_LOCK_ENTRY {
9130     PVOID           Unknown1;
9131     PVOID           Unknown2;
9132     FILE_LOCK_INFO  FileLock;
9133 } FILE_SHARED_LOCK_ENTRY, *PFILE_SHARED_LOCK_ENTRY;
9134 
9135 /* raw internal file lock struct returned from FsRtlGetNextFileLock */
9136 typedef struct _FILE_EXCLUSIVE_LOCK_ENTRY {
9137     LIST_ENTRY      ListEntry;
9138     PVOID           Unknown1;
9139     PVOID           Unknown2;
9140     FILE_LOCK_INFO  FileLock;
9141 } FILE_EXCLUSIVE_LOCK_ENTRY, *PFILE_EXCLUSIVE_LOCK_ENTRY;
9142 
9143 typedef struct _FILE_MAILSLOT_PEEK_BUFFER {
9144     ULONG ReadDataAvailable;
9145     ULONG NumberOfMessages;
9146     ULONG MessageLength;
9147 } FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER;
9148 
9149 typedef struct _FILE_OLE_CLASSID_INFORMATION {
9150     GUID ClassId;
9151 } FILE_OLE_CLASSID_INFORMATION, *PFILE_OLE_CLASSID_INFORMATION;
9152 
9153 typedef struct _FILE_OLE_ALL_INFORMATION {
9154     FILE_BASIC_INFORMATION          BasicInformation;
9155     FILE_STANDARD_INFORMATION       StandardInformation;
9156     FILE_INTERNAL_INFORMATION       InternalInformation;
9157     FILE_EA_INFORMATION             EaInformation;
9158     FILE_ACCESS_INFORMATION         AccessInformation;
9159     FILE_POSITION_INFORMATION       PositionInformation;
9160     FILE_MODE_INFORMATION           ModeInformation;
9161     FILE_ALIGNMENT_INFORMATION      AlignmentInformation;
9162     USN                             LastChangeUsn;
9163     USN                             ReplicationUsn;
9164     LARGE_INTEGER                   SecurityChangeTime;
9165     FILE_OLE_CLASSID_INFORMATION    OleClassIdInformation;
9166     FILE_OBJECTID_INFORMATION       ObjectIdInformation;
9167     FILE_STORAGE_TYPE               StorageType;
9168     ULONG                           OleStateBits;
9169     ULONG                           OleId;
9170     ULONG                           NumberOfStreamReferences;
9171     ULONG                           StreamIndex;
9172     ULONG                           SecurityId;
9173     BOOLEAN                         ContentIndexDisable;
9174     BOOLEAN                         InheritContentIndexDisable;
9175     FILE_NAME_INFORMATION           NameInformation;
9176 } FILE_OLE_ALL_INFORMATION, *PFILE_OLE_ALL_INFORMATION;
9177 
9178 typedef struct _FILE_OLE_DIR_INFORMATION {
9179     ULONG               NextEntryOffset;
9180     ULONG               FileIndex;
9181     LARGE_INTEGER       CreationTime;
9182     LARGE_INTEGER       LastAccessTime;
9183     LARGE_INTEGER       LastWriteTime;
9184     LARGE_INTEGER       ChangeTime;
9185     LARGE_INTEGER       EndOfFile;
9186     LARGE_INTEGER       AllocationSize;
9187     ULONG               FileAttributes;
9188     ULONG               FileNameLength;
9189     FILE_STORAGE_TYPE   StorageType;
9190     GUID                OleClassId;
9191     ULONG               OleStateBits;
9192     BOOLEAN             ContentIndexDisable;
9193     BOOLEAN             InheritContentIndexDisable;
9194     WCHAR               FileName[1];
9195 } FILE_OLE_DIR_INFORMATION, *PFILE_OLE_DIR_INFORMATION;
9196 
9197 typedef struct _FILE_OLE_INFORMATION {
9198     LARGE_INTEGER                   SecurityChangeTime;
9199     FILE_OLE_CLASSID_INFORMATION    OleClassIdInformation;
9200     FILE_OBJECTID_INFORMATION       ObjectIdInformation;
9201     FILE_STORAGE_TYPE               StorageType;
9202     ULONG                           OleStateBits;
9203     BOOLEAN                         ContentIndexDisable;
9204     BOOLEAN                         InheritContentIndexDisable;
9205 } FILE_OLE_INFORMATION, *PFILE_OLE_INFORMATION;
9206 
9207 typedef struct _FILE_OLE_STATE_BITS_INFORMATION {
9208     ULONG StateBits;
9209     ULONG StateBitsMask;
9210 } FILE_OLE_STATE_BITS_INFORMATION, *PFILE_OLE_STATE_BITS_INFORMATION;
9211 
9212 typedef struct _MAPPING_PAIR {
9213     ULONGLONG Vcn;
9214     ULONGLONG Lcn;
9215 } MAPPING_PAIR, *PMAPPING_PAIR;
9216 
9217 typedef struct _GET_RETRIEVAL_DESCRIPTOR {
9218     ULONG           NumberOfPairs;
9219     ULONGLONG       StartVcn;
9220     MAPPING_PAIR    Pair[1];
9221 } GET_RETRIEVAL_DESCRIPTOR, *PGET_RETRIEVAL_DESCRIPTOR;
9222 
9223 typedef struct _MBCB {
9224     CSHORT          NodeTypeCode;
9225     CSHORT          NodeIsInZone;
9226     ULONG           PagesToWrite;
9227     ULONG           DirtyPages;
9228     ULONG           Reserved;
9229     LIST_ENTRY      BitmapRanges;
9230     LONGLONG        ResumeWritePage;
9231     BITMAP_RANGE    BitmapRange1;
9232     BITMAP_RANGE    BitmapRange2;
9233     BITMAP_RANGE    BitmapRange3;
9234 } MBCB, *PMBCB;
9235 
9236 typedef struct _MOVEFILE_DESCRIPTOR {
9237      HANDLE         FileHandle;
9238      ULONG          Reserved;
9239      LARGE_INTEGER  StartVcn;
9240      LARGE_INTEGER  TargetLcn;
9241      ULONG          NumVcns;
9242      ULONG          Reserved1;
9243 } MOVEFILE_DESCRIPTOR, *PMOVEFILE_DESCRIPTOR;
9244 
9245 typedef struct _OBJECT_BASIC_INFO {
9246     ULONG           Attributes;
9247     ACCESS_MASK     GrantedAccess;
9248     ULONG           HandleCount;
9249     ULONG           ReferenceCount;
9250     ULONG           PagedPoolUsage;
9251     ULONG           NonPagedPoolUsage;
9252     ULONG           Reserved[3];
9253     ULONG           NameInformationLength;
9254     ULONG           TypeInformationLength;
9255     ULONG           SecurityDescriptorLength;
9256     LARGE_INTEGER   CreateTime;
9257 } OBJECT_BASIC_INFO, *POBJECT_BASIC_INFO;
9258 
9259 typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFO {
9260     BOOLEAN Inherit;
9261     BOOLEAN ProtectFromClose;
9262 } OBJECT_HANDLE_ATTRIBUTE_INFO, *POBJECT_HANDLE_ATTRIBUTE_INFO;
9263 
9264 typedef struct _OBJECT_NAME_INFO {
9265     UNICODE_STRING  ObjectName;
9266     WCHAR           ObjectNameBuffer[1];
9267 } OBJECT_NAME_INFO, *POBJECT_NAME_INFO;
9268 
9269 typedef struct _OBJECT_PROTECTION_INFO {
9270     BOOLEAN Inherit;
9271     BOOLEAN ProtectHandle;
9272 } OBJECT_PROTECTION_INFO, *POBJECT_PROTECTION_INFO;
9273 
9274 typedef struct _OBJECT_TYPE_INFO {
9275     UNICODE_STRING  ObjectTypeName;
9276     UCHAR           Unknown[0x58];
9277     WCHAR           ObjectTypeNameBuffer[1];
9278 } OBJECT_TYPE_INFO, *POBJECT_TYPE_INFO;
9279 
9280 typedef struct _OBJECT_ALL_TYPES_INFO {
9281     ULONG               NumberOfObjectTypes;
9282     OBJECT_TYPE_INFO    ObjectsTypeInfo[1];
9283 } OBJECT_ALL_TYPES_INFO, *POBJECT_ALL_TYPES_INFO;
9284 
9285 #if defined(USE_LPC6432)
9286 #define LPC_CLIENT_ID CLIENT_ID64
9287 #define LPC_SIZE_T ULONGLONG
9288 #define LPC_PVOID ULONGLONG
9289 #define LPC_HANDLE ULONGLONG
9290 #else
9291 #define LPC_CLIENT_ID CLIENT_ID
9292 #define LPC_SIZE_T SIZE_T
9293 #define LPC_PVOID PVOID
9294 #define LPC_HANDLE HANDLE
9295 #endif
9296 
9297 typedef struct _PORT_MESSAGE
9298 {
9299     union
9300     {
9301         struct
9302         {
9303             CSHORT DataLength;
9304             CSHORT TotalLength;
9305         } s1;
9306         ULONG Length;
9307     } u1;
9308     union
9309     {
9310         struct
9311         {
9312             CSHORT Type;
9313             CSHORT DataInfoOffset;
9314         } s2;
9315         ULONG ZeroInit;
9316     } u2;
9317     __GNU_EXTENSION union
9318     {
9319         LPC_CLIENT_ID ClientId;
9320         double DoNotUseThisField;
9321     };
9322     ULONG MessageId;
9323     __GNU_EXTENSION union
9324     {
9325         LPC_SIZE_T ClientViewSize;
9326         ULONG CallbackId;
9327     };
9328 } PORT_MESSAGE, *PPORT_MESSAGE;
9329 
9330 #define LPC_KERNELMODE_MESSAGE      (CSHORT)((USHORT)0x8000)
9331 
9332 typedef struct _PORT_VIEW
9333 {
9334     ULONG Length;
9335     LPC_HANDLE SectionHandle;
9336     ULONG SectionOffset;
9337     LPC_SIZE_T ViewSize;
9338     LPC_PVOID ViewBase;
9339     LPC_PVOID ViewRemoteBase;
9340 } PORT_VIEW, *PPORT_VIEW;
9341 
9342 typedef struct _REMOTE_PORT_VIEW
9343 {
9344     ULONG Length;
9345     LPC_SIZE_T ViewSize;
9346     LPC_PVOID ViewBase;
9347 } REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW;
9348 
9349 typedef struct _VAD_HEADER {
9350     PVOID       StartVPN;
9351     PVOID       EndVPN;
9352     struct _VAD_HEADER* ParentLink;
9353     struct _VAD_HEADER* LeftLink;
9354     struct _VAD_HEADER* RightLink;
9355     ULONG       Flags;          /* LSB = CommitCharge */
9356     PVOID       ControlArea;
9357     PVOID       FirstProtoPte;
9358     PVOID       LastPTE;
9359     ULONG       Unknown;
9360     LIST_ENTRY  Secured;
9361 } VAD_HEADER, *PVAD_HEADER;
9362 
9363 NTKERNELAPI
9364 LARGE_INTEGER
9365 NTAPI
9366 CcGetLsnForFileObject (
9367     IN PFILE_OBJECT     FileObject,
9368     OUT PLARGE_INTEGER  OldestLsn OPTIONAL
9369 );
9370 
9371 NTKERNELAPI
9372 PVOID
9373 NTAPI
9374 FsRtlAllocatePool (
9375     IN POOL_TYPE    PoolType,
9376     IN ULONG        NumberOfBytes
9377 );
9378 
9379 NTKERNELAPI
9380 PVOID
9381 NTAPI
9382 FsRtlAllocatePoolWithQuota (
9383     IN POOL_TYPE    PoolType,
9384     IN ULONG        NumberOfBytes
9385 );
9386 
9387 NTKERNELAPI
9388 PVOID
9389 NTAPI
9390 FsRtlAllocatePoolWithQuotaTag (
9391     IN POOL_TYPE    PoolType,
9392     IN ULONG        NumberOfBytes,
9393     IN ULONG        Tag
9394 );
9395 
9396 NTKERNELAPI
9397 PVOID
9398 NTAPI
9399 FsRtlAllocatePoolWithTag (
9400     IN POOL_TYPE    PoolType,
9401     IN ULONG        NumberOfBytes,
9402     IN ULONG        Tag
9403 );
9404 
9405 NTKERNELAPI
9406 BOOLEAN
9407 NTAPI
9408 FsRtlIsFatDbcsLegal (
9409     IN ANSI_STRING  DbcsName,
9410     IN BOOLEAN      WildCardsPermissible,
9411     IN BOOLEAN      PathNamePermissible,
9412     IN BOOLEAN      LeadingBackslashPermissible
9413 );
9414 
9415 NTKERNELAPI
9416 BOOLEAN
9417 NTAPI
9418 FsRtlMdlReadComplete (
9419     IN PFILE_OBJECT     FileObject,
9420     IN PMDL             MdlChain
9421 );
9422 
9423 NTKERNELAPI
9424 BOOLEAN
9425 NTAPI
9426 FsRtlMdlWriteComplete (
9427     IN PFILE_OBJECT     FileObject,
9428     IN PLARGE_INTEGER   FileOffset,
9429     IN PMDL             MdlChain
9430 );
9431 
9432 NTKERNELAPI
9433 VOID
9434 NTAPI
9435 FsRtlNotifyChangeDirectory (
9436     IN PNOTIFY_SYNC NotifySync,
9437     IN PVOID        FsContext,
9438     IN PSTRING      FullDirectoryName,
9439     IN PLIST_ENTRY  NotifyList,
9440     IN BOOLEAN      WatchTree,
9441     IN ULONG        CompletionFilter,
9442     IN PIRP         NotifyIrp
9443 );
9444 
9445 NTKERNELAPI
9446 NTSTATUS
9447 NTAPI
9448 ObCreateObject (
9449     IN KPROCESSOR_MODE      ObjectAttributesAccessMode OPTIONAL,
9450     IN POBJECT_TYPE         ObjectType,
9451     IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
9452     IN KPROCESSOR_MODE      AccessMode,
9453     IN OUT PVOID            ParseContext OPTIONAL,
9454     IN ULONG                ObjectSize,
9455     IN ULONG                PagedPoolCharge OPTIONAL,
9456     IN ULONG                NonPagedPoolCharge OPTIONAL,
9457     OUT PVOID               *Object
9458 );
9459 
9460 NTKERNELAPI
9461 ULONG
9462 NTAPI
9463 ObGetObjectPointerCount (
9464     IN PVOID Object
9465 );
9466 
9467 NTKERNELAPI
9468 NTSTATUS
9469 NTAPI
9470 ObReferenceObjectByName (
9471     IN PUNICODE_STRING  ObjectName,
9472     IN ULONG            Attributes,
9473     IN PACCESS_STATE    PassedAccessState OPTIONAL,
9474     IN ACCESS_MASK      DesiredAccess OPTIONAL,
9475     IN POBJECT_TYPE     ObjectType,
9476     IN KPROCESSOR_MODE  AccessMode,
9477     IN OUT PVOID        ParseContext OPTIONAL,
9478     OUT PVOID           *Object
9479 );
9480 
9481 #define PsDereferenceImpersonationToken(T)  \
9482             {if (ARGUMENT_PRESENT(T)) {     \
9483                 (ObDereferenceObject((T))); \
9484             } else {                        \
9485                 ;                           \
9486             }                               \
9487 }
9488 
9489 NTKERNELAPI
9490 NTSTATUS
9491 NTAPI
9492 PsLookupProcessThreadByCid (
9493     IN PCLIENT_ID   Cid,
9494     OUT PEPROCESS   *Process OPTIONAL,
9495     OUT PETHREAD    *Thread
9496 );
9497 
9498 NTSYSAPI
9499 NTSTATUS
9500 NTAPI
9501 RtlSetSaclSecurityDescriptor (
9502     IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
9503     IN BOOLEAN                  SaclPresent,
9504     IN PACL                     Sacl,
9505     IN BOOLEAN                  SaclDefaulted
9506 );
9507 
9508 #define SeEnableAccessToExports() SeExports = *(PSE_EXPORTS *)SeExports;
9509 
9510 #if (VER_PRODUCTBUILD >= 2195)
9511 
9512 NTSYSAPI
9513 NTSTATUS
9514 NTAPI
9515 ZwAdjustPrivilegesToken (
9516     IN HANDLE               TokenHandle,
9517     IN BOOLEAN              DisableAllPrivileges,
9518     IN PTOKEN_PRIVILEGES    NewState,
9519     IN ULONG                BufferLength,
9520     OUT PTOKEN_PRIVILEGES   PreviousState OPTIONAL,
9521     OUT PULONG              ReturnLength
9522 );
9523 
9524 #endif /* (VER_PRODUCTBUILD >= 2195) */
9525 
9526 NTSYSAPI
9527 NTSTATUS
9528 NTAPI
9529 ZwAlertThread (
9530     IN HANDLE ThreadHandle
9531 );
9532 
9533 NTSYSAPI
9534 NTSTATUS
9535 NTAPI
9536 ZwAccessCheckAndAuditAlarm (
9537     IN PUNICODE_STRING      SubsystemName,
9538     IN PVOID                HandleId,
9539     IN PUNICODE_STRING      ObjectTypeName,
9540     IN PUNICODE_STRING      ObjectName,
9541     IN PSECURITY_DESCRIPTOR SecurityDescriptor,
9542     IN ACCESS_MASK          DesiredAccess,
9543     IN PGENERIC_MAPPING     GenericMapping,
9544     IN BOOLEAN              ObjectCreation,
9545     OUT PACCESS_MASK        GrantedAccess,
9546     OUT PBOOLEAN            AccessStatus,
9547     OUT PBOOLEAN            GenerateOnClose
9548 );
9549 
9550 #if (VER_PRODUCTBUILD >= 2195)
9551 
9552 NTSYSAPI
9553 NTSTATUS
9554 NTAPI
9555 ZwCancelIoFile (
9556     IN HANDLE               FileHandle,
9557     OUT PIO_STATUS_BLOCK    IoStatusBlock
9558 );
9559 
9560 #endif /* (VER_PRODUCTBUILD >= 2195) */
9561 
9562 NTSYSAPI
9563 NTSTATUS
9564 NTAPI
9565 ZwClearEvent (
9566     IN HANDLE EventHandle
9567 );
9568 
9569 NTSYSAPI
9570 NTSTATUS
9571 NTAPI
9572 ZwCloseObjectAuditAlarm (
9573     IN PUNICODE_STRING  SubsystemName,
9574     IN PVOID            HandleId,
9575     IN BOOLEAN          GenerateOnClose
9576 );
9577 
9578 NTSYSAPI
9579 NTSTATUS
9580 NTAPI
9581 ZwCreateSymbolicLinkObject (
9582     OUT PHANDLE             SymbolicLinkHandle,
9583     IN ACCESS_MASK          DesiredAccess,
9584     IN POBJECT_ATTRIBUTES   ObjectAttributes,
9585     IN PUNICODE_STRING      TargetName
9586 );
9587 
9588 NTSYSAPI
9589 NTSTATUS
9590 NTAPI
9591 ZwFlushInstructionCache (
9592     IN HANDLE   ProcessHandle,
9593     IN PVOID    BaseAddress OPTIONAL,
9594     IN ULONG    FlushSize
9595 );
9596 
9597 NTSYSAPI
9598 NTSTATUS
9599 NTAPI
9600 ZwFlushBuffersFile(
9601     IN HANDLE FileHandle,
9602     OUT PIO_STATUS_BLOCK IoStatusBlock
9603 );
9604 
9605 #if (VER_PRODUCTBUILD >= 2195)
9606 
9607 NTSYSAPI
9608 NTSTATUS
9609 NTAPI
9610 ZwInitiatePowerAction (
9611     IN POWER_ACTION         SystemAction,
9612     IN SYSTEM_POWER_STATE   MinSystemState,
9613     IN ULONG                Flags,
9614     IN BOOLEAN              Asynchronous
9615 );
9616 
9617 #endif /* (VER_PRODUCTBUILD >= 2195) */
9618 
9619 NTSYSAPI
9620 NTSTATUS
9621 NTAPI
9622 ZwLoadKey (
9623     IN POBJECT_ATTRIBUTES KeyObjectAttributes,
9624     IN POBJECT_ATTRIBUTES FileObjectAttributes
9625 );
9626 
9627 NTSYSAPI
9628 NTSTATUS
9629 NTAPI
9630 ZwOpenProcessToken (
9631     IN HANDLE       ProcessHandle,
9632     IN ACCESS_MASK  DesiredAccess,
9633     OUT PHANDLE     TokenHandle
9634 );
9635 
9636 NTSYSAPI
9637 NTSTATUS
9638 NTAPI
9639 ZwOpenThread (
9640     OUT PHANDLE             ThreadHandle,
9641     IN ACCESS_MASK          DesiredAccess,
9642     IN POBJECT_ATTRIBUTES   ObjectAttributes,
9643     IN PCLIENT_ID           ClientId
9644 );
9645 
9646 NTSYSAPI
9647 NTSTATUS
9648 NTAPI
9649 ZwOpenThreadToken (
9650     IN HANDLE       ThreadHandle,
9651     IN ACCESS_MASK  DesiredAccess,
9652     IN BOOLEAN      OpenAsSelf,
9653     OUT PHANDLE     TokenHandle
9654 );
9655 
9656 NTSYSAPI
9657 NTSTATUS
9658 NTAPI
9659 ZwPulseEvent (
9660     IN HANDLE   EventHandle,
9661     OUT PLONG   PreviousState OPTIONAL
9662 );
9663 
9664 NTSYSAPI
9665 NTSTATUS
9666 NTAPI
9667 ZwQueryDefaultLocale (
9668     IN BOOLEAN  ThreadOrSystem,
9669     OUT PLCID   Locale
9670 );
9671 
9672 #if (VER_PRODUCTBUILD >= 2195)
9673 
9674 NTSYSAPI
9675 NTSTATUS
9676 NTAPI
9677 ZwQueryDirectoryObject (
9678     IN HANDLE       DirectoryHandle,
9679     OUT PVOID       Buffer,
9680     IN ULONG        Length,
9681     IN BOOLEAN      ReturnSingleEntry,
9682     IN BOOLEAN      RestartScan,
9683     IN OUT PULONG   Context,
9684     OUT PULONG      ReturnLength OPTIONAL
9685 );
9686 
9687 #endif /* (VER_PRODUCTBUILD >= 2195) */
9688 
9689 NTSYSAPI
9690 NTSTATUS
9691 NTAPI
9692 ZwQueryInformationProcess (
9693     IN HANDLE           ProcessHandle,
9694     IN PROCESSINFOCLASS ProcessInformationClass,
9695     OUT PVOID           ProcessInformation,
9696     IN ULONG            ProcessInformationLength,
9697     OUT PULONG          ReturnLength OPTIONAL
9698 );
9699 
9700 NTSYSAPI
9701 NTSTATUS
9702 NTAPI
9703 ZwReplaceKey (
9704     IN POBJECT_ATTRIBUTES   NewFileObjectAttributes,
9705     IN HANDLE               KeyHandle,
9706     IN POBJECT_ATTRIBUTES   OldFileObjectAttributes
9707 );
9708 
9709 NTSYSAPI
9710 NTSTATUS
9711 NTAPI
9712 ZwResetEvent (
9713     IN HANDLE   EventHandle,
9714     OUT PLONG   PreviousState OPTIONAL
9715 );
9716 
9717 #if (VER_PRODUCTBUILD >= 2195)
9718 
9719 NTSYSAPI
9720 NTSTATUS
9721 NTAPI
9722 ZwRestoreKey (
9723     IN HANDLE   KeyHandle,
9724     IN HANDLE   FileHandle,
9725     IN ULONG    Flags
9726 );
9727 
9728 #endif /* (VER_PRODUCTBUILD >= 2195) */
9729 
9730 NTSYSAPI
9731 NTSTATUS
9732 NTAPI
9733 ZwSaveKey (
9734     IN HANDLE KeyHandle,
9735     IN HANDLE FileHandle
9736 );
9737 
9738 NTSYSAPI
9739 NTSTATUS
9740 NTAPI
9741 ZwSetDefaultLocale (
9742     IN BOOLEAN  ThreadOrSystem,
9743     IN LCID     Locale
9744 );
9745 
9746 #if (VER_PRODUCTBUILD >= 2195)
9747 
9748 NTSYSAPI
9749 NTSTATUS
9750 NTAPI
9751 ZwSetDefaultUILanguage (
9752     IN LANGID LanguageId
9753 );
9754 
9755 #endif /* (VER_PRODUCTBUILD >= 2195) */
9756 
9757 NTSYSAPI
9758 NTSTATUS
9759 NTAPI
9760 ZwSetInformationProcess (
9761     IN HANDLE           ProcessHandle,
9762     IN PROCESSINFOCLASS ProcessInformationClass,
9763     IN PVOID            ProcessInformation,
9764     IN ULONG            ProcessInformationLength
9765 );
9766 
9767 NTSYSAPI
9768 NTSTATUS
9769 NTAPI
9770 ZwSetSystemTime (
9771     IN PLARGE_INTEGER   NewTime,
9772     OUT PLARGE_INTEGER  OldTime OPTIONAL
9773 );
9774 
9775 NTSYSAPI
9776 NTSTATUS
9777 NTAPI
9778 ZwUnloadKey (
9779     IN POBJECT_ATTRIBUTES KeyObjectAttributes
9780 );
9781 
9782 NTSYSAPI
9783 NTSTATUS
9784 NTAPI
9785 ZwWaitForMultipleObjects (
9786     IN ULONG            HandleCount,
9787     IN PHANDLE          Handles,
9788     IN WAIT_TYPE        WaitType,
9789     IN BOOLEAN          Alertable,
9790     IN PLARGE_INTEGER   Timeout OPTIONAL
9791 );
9792 
9793 NTSYSAPI
9794 NTSTATUS
9795 NTAPI
9796 ZwYieldExecution (
9797     VOID
9798 );
9799 
9800 #pragma pack(pop)
9801 
9802 #ifdef __cplusplus
9803 }
9804 #endif
9805