nt.h@ 100339

Last change on this file since 100339 was 98103, checked in by vboxsync, 2 years ago
Copyright year updates by scm.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 171.5 KB

Line
1	/* $Id: nt.h 98103 2023-01-17 14:15:46Z vboxsync $ */
2	/** @file
3	* IPRT - Header for code using the Native NT API.
4	*/
5
6	/*
7	* Copyright (C) 2010-2023 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* The contents of this file may alternatively be used under the terms
26	* of the Common Development and Distribution License Version 1.0
27	* (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
28	* in the VirtualBox distribution, in which case the provisions of the
29	* CDDL are applicable instead of those of the GPL.
30	*
31	* You may elect to license modified versions of this file under the
32	* terms and conditions of either the GPL or the CDDL or both.
33	*
34	* SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
35	*/
36
37	#ifndef IPRT_INCLUDED_nt_nt_h
38	#define IPRT_INCLUDED_nt_nt_h
39	#ifndef RT_WITHOUT_PRAGMA_ONCE
40	# pragma once
41	#endif
42
43	/** @def IPRT_NT_MAP_TO_ZW
44	* Map Nt calls to Zw calls. In ring-0 the Zw calls let you pass kernel memory
45	* to the APIs (takes care of the previous context checks).
46	*/
47	#ifdef DOXYGEN_RUNNING
48	# define IPRT_NT_MAP_TO_ZW
49	#endif
50
51	#ifdef IPRT_NT_MAP_TO_ZW
52	# define NtQueryDirectoryFile ZwQueryDirectoryFile
53	# define NtQueryInformationFile ZwQueryInformationFile
54	# define NtQueryInformationProcess ZwQueryInformationProcess
55	# define NtQueryInformationThread ZwQueryInformationThread
56	# define NtQueryFullAttributesFile ZwQueryFullAttributesFile
57	# define NtQuerySystemInformation ZwQuerySystemInformation
58	# define NtQuerySecurityObject ZwQuerySecurityObject
59	# define NtSetInformationFile ZwSetInformationFile
60	# define NtClose ZwClose
61	# define NtCreateFile ZwCreateFile
62	# define NtReadFile ZwReadFile
63	# define NtWriteFile ZwWriteFile
64	# define NtFlushBuffersFile ZwFlushBuffersFile
65	/** @todo this is very incomplete! */
66	#endif
67
68	#include <ntstatus.h>
69
70	/*
71	* Hacks common to both base header sets.
72	*/
73	#define RtlFreeUnicodeString WrongLinkage_RtlFreeUnicodeString
74	#define NtQueryObject Incomplete_NtQueryObject
75	#define ZwQueryObject Incomplete_ZwQueryObject
76	#define NtSetInformationObject Incomplete_NtSetInformationObject
77	#define _OBJECT_INFORMATION_CLASS Incomplete_OBJECT_INFORMATION_CLASS
78	#define OBJECT_INFORMATION_CLASS Incomplete_OBJECT_INFORMATION_CLASS
79	#define ObjectBasicInformation Incomplete_ObjectBasicInformation
80	#define ObjectTypeInformation Incomplete_ObjectTypeInformation
81	#define _PEB Incomplete__PEB
82	#define PEB Incomplete_PEB
83	#define PPEB Incomplete_PPEB
84	#define _TEB Incomplete__TEB
85	#define TEB Incomplete_TEB
86	#define PTEB Incomplete_PTEB
87	#define _PEB_LDR_DATA Incomplete__PEB_LDR_DATA
88	#define PEB_LDR_DATA Incomplete_PEB_LDR_DATA
89	#define PPEB_LDR_DATA Incomplete_PPEB_LDR_DATA
90	#define _KUSER_SHARED_DATA Incomplete__KUSER_SHARED_DATA
91	#define KUSER_SHARED_DATA Incomplete_KUSER_SHARED_DATA
92	#define PKUSER_SHARED_DATA Incomplete_PKUSER_SHARED_DATA
93
94
95
96	#ifdef IPRT_NT_USE_WINTERNL
97	/*
98	* Use Winternl.h.
99	*/
100	# define _FILE_INFORMATION_CLASS IncompleteWinternl_FILE_INFORMATION_CLASS
101	# define FILE_INFORMATION_CLASS IncompleteWinternl_FILE_INFORMATION_CLASS
102	# define FileDirectoryInformation IncompleteWinternl_FileDirectoryInformation
103
104	# define NtQueryInformationProcess IncompleteWinternl_NtQueryInformationProcess
105	# define NtSetInformationProcess IncompleteWinternl_NtSetInformationProcess
106	# define PROCESSINFOCLASS IncompleteWinternl_PROCESSINFOCLASS
107	# define _PROCESSINFOCLASS IncompleteWinternl_PROCESSINFOCLASS
108	# define PROCESS_BASIC_INFORMATION IncompleteWinternl_PROCESS_BASIC_INFORMATION
109	# define PPROCESS_BASIC_INFORMATION IncompleteWinternl_PPROCESS_BASIC_INFORMATION
110	# define _PROCESS_BASIC_INFORMATION IncompleteWinternl_PROCESS_BASIC_INFORMATION
111	# define ProcessBasicInformation IncompleteWinternl_ProcessBasicInformation
112	# define ProcessDebugPort IncompleteWinternl_ProcessDebugPort
113	# define ProcessWow64Information IncompleteWinternl_ProcessWow64Information
114	# define ProcessImageFileName IncompleteWinternl_ProcessImageFileName
115	# define ProcessBreakOnTermination IncompleteWinternl_ProcessBreakOnTermination
116
117	# define RTL_USER_PROCESS_PARAMETERS IncompleteWinternl_RTL_USER_PROCESS_PARAMETERS
118	# define PRTL_USER_PROCESS_PARAMETERS IncompleteWinternl_PRTL_USER_PROCESS_PARAMETERS
119	# define _RTL_USER_PROCESS_PARAMETERS IncompleteWinternl__RTL_USER_PROCESS_PARAMETERS
120
121	# define NtQueryInformationThread IncompleteWinternl_NtQueryInformationThread
122	# define NtSetInformationThread IncompleteWinternl_NtSetInformationThread
123	# define THREADINFOCLASS IncompleteWinternl_THREADINFOCLASS
124	# define _THREADINFOCLASS IncompleteWinternl_THREADINFOCLASS
125	# define ThreadIsIoPending IncompleteWinternl_ThreadIsIoPending
126
127	# define NtQuerySystemInformation IncompleteWinternl_NtQuerySystemInformation
128	# define NtSetSystemInformation IncompleteWinternl_NtSetSystemInformation
129	# define NtQueryTimerResolution AddedRecentlyUseOwnPrototype_NtQueryTimerResolution
130	# define SYSTEM_INFORMATION_CLASS IncompleteWinternl_SYSTEM_INFORMATION_CLASS
131	# define _SYSTEM_INFORMATION_CLASS IncompleteWinternl_SYSTEM_INFORMATION_CLASS
132	# define SystemBasicInformation IncompleteWinternl_SystemBasicInformation
133	# define SystemPerformanceInformation IncompleteWinternl_SystemPerformanceInformation
134	# define SystemTimeOfDayInformation IncompleteWinternl_SystemTimeOfDayInformation
135	# define SystemProcessInformation IncompleteWinternl_SystemProcessInformation
136	# define SystemProcessorPerformanceInformation IncompleteWinternl_SystemProcessorPerformanceInformation
137	# define SystemInterruptInformation IncompleteWinternl_SystemInterruptInformation
138	# define SystemExceptionInformation IncompleteWinternl_SystemExceptionInformation
139	# define SystemRegistryQuotaInformation IncompleteWinternl_SystemRegistryQuotaInformation
140	# define SystemLookasideInformation IncompleteWinternl_SystemLookasideInformation
141	# define SystemPolicyInformation IncompleteWinternl_SystemPolicyInformation
142
143
144	# pragma warning(push)
145	# pragma warning(disable: 4668)
146	# define WIN32_NO_STATUS
147	# include <windef.h>
148	# include <winnt.h>
149	# include <winternl.h>
150	# undef WIN32_NO_STATUS
151	# include <ntstatus.h>
152	# pragma warning(pop)
153
154	# ifndef OBJ_DONT_REPARSE
155	# define RTNT_NEED_CLIENT_ID
156	# endif
157
158	# undef _FILE_INFORMATION_CLASS
159	# undef FILE_INFORMATION_CLASS
160	# undef FileDirectoryInformation
161
162	# undef NtQueryInformationProcess
163	# undef NtSetInformationProcess
164	# undef PROCESSINFOCLASS
165	# undef _PROCESSINFOCLASS
166	# undef PROCESS_BASIC_INFORMATION
167	# undef PPROCESS_BASIC_INFORMATION
168	# undef _PROCESS_BASIC_INFORMATION
169	# undef ProcessBasicInformation
170	# undef ProcessDebugPort
171	# undef ProcessWow64Information
172	# undef ProcessImageFileName
173	# undef ProcessBreakOnTermination
174
175	# undef RTL_USER_PROCESS_PARAMETERS
176	# undef PRTL_USER_PROCESS_PARAMETERS
177	# undef _RTL_USER_PROCESS_PARAMETERS
178
179	# undef NtQueryInformationThread
180	# undef NtSetInformationThread
181	# undef THREADINFOCLASS
182	# undef _THREADINFOCLASS
183	# undef ThreadIsIoPending
184
185	# undef NtQuerySystemInformation
186	# undef NtSetSystemInformation
187	# undef NtQueryTimerResolution
188	# undef SYSTEM_INFORMATION_CLASS
189	# undef _SYSTEM_INFORMATION_CLASS
190	# undef SystemBasicInformation
191	# undef SystemPerformanceInformation
192	# undef SystemTimeOfDayInformation
193	# undef SystemProcessInformation
194	# undef SystemProcessorPerformanceInformation
195	# undef SystemInterruptInformation
196	# undef SystemExceptionInformation
197	# undef SystemRegistryQuotaInformation
198	# undef SystemLookasideInformation
199	# undef SystemPolicyInformation
200
201	# define RTNT_NEED_NT_GET_PRODUCT_TYPE
202
203	#else
204	/*
205	* Use ntifs.h and wdm.h.
206	*/
207	# if _MSC_VER >= 1200 /* Fix/workaround for KeInitializeSpinLock visibility issue on AMD64. */
208	# define FORCEINLINE static __forceinline
209	# else
210	# define FORCEINLINE static __inline
211	# endif
212
213	# define _FSINFOCLASS OutdatedWdm_FSINFOCLASS
214	# define FS_INFORMATION_CLASS OutdatedWdm_FS_INFORMATION_CLASS
215	# define PFS_INFORMATION_CLASS OutdatedWdm_PFS_INFORMATION_CLASS
216	# define FileFsVolumeInformation OutdatedWdm_FileFsVolumeInformation
217	# define FileFsLabelInformation OutdatedWdm_FileFsLabelInformation
218	# define FileFsSizeInformation OutdatedWdm_FileFsSizeInformation
219	# define FileFsDeviceInformation OutdatedWdm_FileFsDeviceInformation
220	# define FileFsAttributeInformation OutdatedWdm_FileFsAttributeInformation
221	# define FileFsControlInformation OutdatedWdm_FileFsControlInformation
222	# define FileFsFullSizeInformation OutdatedWdm_FileFsFullSizeInformation
223	# define FileFsObjectIdInformation OutdatedWdm_FileFsObjectIdInformation
224	# define FileFsDriverPathInformation OutdatedWdm_FileFsDriverPathInformation
225	# define FileFsVolumeFlagsInformation OutdatedWdm_FileFsVolumeFlagsInformation
226	# define FileFsSectorSizeInformation OutdatedWdm_FileFsSectorSizeInformation
227	# define FileFsDataCopyInformation OutdatedWdm_FileFsDataCopyInformation
228	# define FileFsMetadataSizeInformation OutdatedWdm_FileFsMetadataSizeInformation
229	# define FileFsFullSizeInformationEx OutdatedWdm_FileFsFullSizeInformationEx
230	# define FileFsMaximumInformation OutdatedWdm_FileFsMaximumInformation
231	# define NtQueryVolumeInformationFile OutdatedWdm_NtQueryVolumeInformationFile
232	# define NtSetVolumeInformationFile OutdatedWdm_NtSetVolumeInformationFile
233	# define _MEMORY_INFORMATION_CLASS OutdatedWdm__MEMORY_INFORMATION_CLASS
234	# define MEMORY_INFORMATION_CLASS OutdatedWdm_MEMORY_INFORMATION_CLASS
235	# define MemoryBasicInformation OutdatedWdm_MemoryBasicInformation
236	# define NtQueryVirtualMemory OutdatedWdm_NtQueryVirtualMemory
237
238	# pragma warning(push)
239	# ifdef RT_ARCH_X86
240	# define _InterlockedAddLargeStatistic _InterlockedAddLargeStatistic_StupidDDKVsCompilerCrap
241	# pragma warning(disable: 4163)
242	# endif
243	# pragma warning(disable: 4668)
244	# pragma warning(disable: 4255) /* warning C4255: 'ObGetFilterVersion' : no function prototype given: converting '()' to '(void)' */
245	# if _MSC_VER >= 1800 /RT_MSC_VER_VC120/
246	# pragma warning(disable:4005) /* sdk/v7.1/include/sal_supp.h(57) : warning C4005: '__useHeader' : macro redefinition */
247	# pragma warning(disable:4471) /* wdm.h(11057) : warning C4471: '_POOL_TYPE' : a forward declaration of an unscoped enumeration must have an underlying type (int assumed) */
248	# endif
249	# if _MSC_VER >= 1900 /RT_MSC_VER_VC140/
250	# ifdef __cplusplus
251	# pragma warning(disable:5039) /* warning C5039: 'KeInitializeDpc': pointer or reference to potentially throwing function passed to 'extern "C"' function under -EHc. Undefined behavior may occur if this function throws an exception. */
252	# endif
253	# endif
254
255	# include <ntifs.h>
256	# include <wdm.h>
257
258	# ifdef RT_ARCH_X86
259	# undef _InterlockedAddLargeStatistic
260	# endif
261	# pragma warning(pop)
262
263	# undef _FSINFOCLASS
264	# undef FS_INFORMATION_CLASS
265	# undef PFS_INFORMATION_CLASS
266	# undef FileFsVolumeInformation
267	# undef FileFsLabelInformation
268	# undef FileFsSizeInformation
269	# undef FileFsDeviceInformation
270	# undef FileFsAttributeInformation
271	# undef FileFsControlInformation
272	# undef FileFsFullSizeInformation
273	# undef FileFsObjectIdInformation
274	# undef FileFsDriverPathInformation
275	# undef FileFsVolumeFlagsInformation
276	# undef FileFsSectorSizeInformation
277	# undef FileFsDataCopyInformation
278	# undef FileFsMetadataSizeInformation
279	# undef FileFsFullSizeInformationEx
280	# undef FileFsMaximumInformation
281	# undef NtQueryVolumeInformationFile
282	# undef NtSetVolumeInformationFile
283	# undef _MEMORY_INFORMATION_CLASS
284	# undef MEMORY_INFORMATION_CLASS
285	# undef MemoryBasicInformation
286	# undef NtQueryVirtualMemory
287
288	# define IPRT_NT_NEED_API_GROUP_NTIFS
289	# ifndef NTDDI_WIN10_RS1
290	# define RTNT_NEED_NT_GET_PRODUCT_TYPE
291	# elif NTDDI_VERSION < NTDDI_WIN10_RS1
292	# define RTNT_NEED_NT_GET_PRODUCT_TYPE
293	# endif
294
295	#endif
296
297	#undef RtlFreeUnicodeString
298	#undef NtQueryObject
299	#undef ZwQueryObject
300	#undef NtSetInformationObject
301	#undef _OBJECT_INFORMATION_CLASS
302	#undef OBJECT_INFORMATION_CLASS
303	#undef ObjectBasicInformation
304	#undef ObjectTypeInformation
305	#undef _PEB
306	#undef PEB
307	#undef PPEB
308	#undef _TEB
309	#undef TEB
310	#undef PTEB
311	#undef _PEB_LDR_DATA
312	#undef PEB_LDR_DATA
313	#undef PPEB_LDR_DATA
314	#undef _KUSER_SHARED_DATA
315	#undef KUSER_SHARED_DATA
316	#undef PKUSER_SHARED_DATA
317
318
319	#include <iprt/types.h>
320	#include <iprt/assert.h>
321
322
323	/** @name Useful macros
324	* @{ */
325	/** Indicates that we're targeting native NT in the current source. */
326	#define RTNT_USE_NATIVE_NT 1
327	/** Initializes a IO_STATUS_BLOCK. */
328	#define RTNT_IO_STATUS_BLOCK_INITIALIZER { STATUS_FAILED_DRIVER_ENTRY, ~(uintptr_t)42 }
329	/** Reinitializes a IO_STATUS_BLOCK. */
330	#define RTNT_IO_STATUS_BLOCK_REINIT(a_pIos) \
331	do { (a_pIos)->Status = STATUS_FAILED_DRIVER_ENTRY; (a_pIos)->Information = ~(uintptr_t)42; } while (0)
332	/** Similar to INVALID_HANDLE_VALUE in the Windows environment. */
333	#define RTNT_INVALID_HANDLE_VALUE ( (HANDLE)~(uintptr_t)0 )
334	/** Constant UNICODE_STRING initializer. */
335	#define RTNT_CONSTANT_UNISTR(a_String) { sizeof(a_String) - sizeof(WCHAR), sizeof(a_String), (WCHAR *)a_String }
336	/** Null UNICODE_STRING initializer. */
337	#define RTNT_NULL_UNISTR() { 0, 0, NULL }
338
339	/** Declaration wrapper for NT apis.
340	* Adds nothrow. Don't use with callbacks. */
341	#define RT_DECL_NTAPI(type) DECL_NOTHROW(NTSYSAPI type NTAPI)
342	/** @} */
343
344
345	/** @name IPRT helper functions for NT
346	* @{ */
347	RT_C_DECLS_BEGIN
348
349	RTDECL(int) RTNtPathOpen(const char *pszPath, ACCESS_MASK fDesiredAccess, ULONG fFileAttribs, ULONG fShareAccess,
350	ULONG fCreateDisposition, ULONG fCreateOptions, ULONG fObjAttribs,
351	PHANDLE phHandle, PULONG_PTR puDisposition);
352	RTDECL(int) RTNtPathOpenDir(const char *pszPath, ACCESS_MASK fDesiredAccess, ULONG fShareAccess, ULONG fCreateOptions,
353	ULONG fObjAttribs, PHANDLE phHandle, bool *pfObjDir);
354	RTDECL(int) RTNtPathOpenDirEx(HANDLE hRootDir, struct _UNICODE_STRING *pNtName, ACCESS_MASK fDesiredAccess,
355	ULONG fShareAccess, ULONG fCreateOptions, ULONG fObjAttribs, PHANDLE phHandle, bool *pfObjDir);
356	RTDECL(int) RTNtPathClose(HANDLE hHandle);
357
358	/**
359	* Converts a windows-style path to NT format and encoding.
360	*
361	* @returns IPRT status code.
362	* @param pNtName Where to return the NT name. Free using
363	* RTNtPathFree.
364	* @param phRootDir Where to return the root handle, if applicable.
365	* @param pszPath The UTF-8 path.
366	*/
367	RTDECL(int) RTNtPathFromWinUtf8(struct _UNICODE_STRING pNtName, PHANDLE phRootDir, const char pszPath);
368
369	/**
370	* Converts a UTF-16 windows-style path to NT format.
371	*
372	* @returns IPRT status code.
373	* @param pNtName Where to return the NT name. Free using
374	* RTNtPathFree.
375	* @param phRootDir Where to return the root handle, if applicable.
376	* @param pwszPath The UTF-16 windows-style path.
377	* @param cwcPath The max length of the windows-style path in
378	* RTUTF16 units. Use RTSTR_MAX if unknown and @a
379	* pwszPath is correctly terminated.
380	*/
381	RTDECL(int) RTNtPathFromWinUtf16Ex(struct _UNICODE_STRING pNtName, HANDLE phRootDir, PCRTUTF16 pwszPath, size_t cwcPath);
382
383	/**
384	* How to handle ascent ('..' relative to a root handle).
385	*/
386	typedef enum RTNTPATHRELATIVEASCENT
387	{
388	kRTNtPathRelativeAscent_Invalid = 0,
389	kRTNtPathRelativeAscent_Allow,
390	kRTNtPathRelativeAscent_Fail,
391	kRTNtPathRelativeAscent_Ignore,
392	kRTNtPathRelativeAscent_End,
393	kRTNtPathRelativeAscent_32BitHack = 0x7fffffff
394	} RTNTPATHRELATIVEASCENT;
395
396	/**
397	* Converts a relative windows-style path to relative NT format and encoding.
398	*
399	* @returns IPRT status code.
400	* @param pNtName Where to return the NT name. Free using
401	* rtTNtPathToNative with phRootDir set to NULL.
402	* @param phRootDir On input, the handle to the directory the path
403	* is relative to. On output, the handle to
404	* specify as root directory in the object
405	* attributes when accessing the path. If
406	* enmAscent is kRTNtPathRelativeAscent_Allow, it
407	* may have been set to NULL.
408	* @param pszPath The relative UTF-8 path.
409	* @param enmAscent How to handle ascent.
410	* @param fMustReturnAbsolute Must convert to an absolute path. This
411	* is necessary if the root dir is a NT directory
412	* object (e.g. /Devices) since they cannot parse
413	* relative paths it seems.
414	*/
415	RTDECL(int) RTNtPathRelativeFromUtf8(struct _UNICODE_STRING pNtName, PHANDLE phRootDir, const char pszPath,
416	RTNTPATHRELATIVEASCENT enmAscent, bool fMustReturnAbsolute);
417
418	/**
419	* Ensures that the NT string has sufficient storage to hold @a cwcMin RTUTF16
420	* chars plus a terminator.
421	*
422	* The NT string must have been returned by RTNtPathFromWinUtf8 or
423	* RTNtPathFromWinUtf16Ex.
424	*
425	* @returns IPRT status code.
426	* @param pNtName The NT path string.
427	* @param cwcMin The minimum number of RTUTF16 chars. Max 32767.
428	* @sa RTNtPathFree
429	*/
430	RTDECL(int) RTNtPathEnsureSpace(struct _UNICODE_STRING *pNtName, size_t cwcMin);
431
432	/**
433	* Gets the NT path to the object represented by the given handle.
434	*
435	* @returns IPRT status code.
436	* @param pNtName Where to return the NT path. Free using
437	* RTNtPathFree.
438	* @param hHandle The handle.
439	* @param cwcExtra How much extra space is needed.
440	*/
441	RTDECL(int) RTNtPathFromHandle(struct _UNICODE_STRING *pNtName, HANDLE hHandle, size_t cwcExtra);
442
443	/**
444	* Frees the native path and root handle.
445	*
446	* @param pNtName The NT path after a successful rtNtPathToNative
447	* call or RTNtPathRelativeFromUtf8.
448	* @param phRootDir The root handle variable from rtNtPathToNative,
449	*/
450	RTDECL(void) RTNtPathFree(struct _UNICODE_STRING pNtName, HANDLE phRootDir);
451
452
453	/**
454	* Checks whether the path could be containing alternative 8.3 names generated
455	* by NTFS, FAT, or other similar file systems.
456	*
457	* @returns Pointer to the first component that might be an 8.3 name, NULL if
458	* not 8.3 path.
459	* @param pwszPath The path to check.
460	*
461	* @remarks This is making bad ASSUMPTION wrt to the naming scheme of 8.3 names,
462	* however, non-tilde 8.3 aliases are probably rare enough to not be
463	* worth all the extra code necessary to open each path component and
464	* check if we've got the short name or not.
465	*/
466	RTDECL(PRTUTF16) RTNtPathFindPossible8dot3Name(PCRTUTF16 pwszPath);
467
468	/**
469	* Fixes up a path possibly containing one or more alternative 8-dot-3 style
470	* components.
471	*
472	* The path is fixed up in place. Errors are ignored.
473	*
474	* @returns VINF_SUCCESS if it all went smoothly, informational status codes
475	* indicating the nature of last problem we ran into.
476	*
477	* @param pUniStr The path to fix up. MaximumLength is the max buffer
478	* length.
479	* @param fPathOnly Whether to only process the path and leave the filename
480	* as passed in.
481	*/
482	RTDECL(int) RTNtPathExpand8dot3Path(struct _UNICODE_STRING *pUniStr, bool fPathOnly);
483
484	/**
485	* Wrapper around RTNtPathExpand8dot3Path that allocates a buffer instead of
486	* working on the input buffer.
487	*
488	* @returns IPRT status code, see RTNtPathExpand8dot3Path().
489	* @param pUniStrSrc The path to fix up. MaximumLength is the max buffer
490	* length.
491	* @param fPathOnly Whether to only process the path and leave the filename
492	* as passed in.
493	* @param pUniStrDst Output string. On success, the caller must use
494	* RTUtf16Free to free what the Buffer member points to.
495	* This is all zeros and NULL on failure.
496	*/
497	RTDECL(int) RTNtPathExpand8dot3PathA(struct _UNICODE_STRING const pUniStrSrc, bool fPathOnly, struct _UNICODE_STRING pUniStrDst);
498
499
500	RT_C_DECLS_END
501	/** @} */
502
503
504	/** @name NT API delcarations.
505	* @{ */
506	RT_C_DECLS_BEGIN
507
508	/** @name Process access rights missing in ntddk headers
509	* @{ */
510	#ifndef PROCESS_TERMINATE
511	# define PROCESS_TERMINATE UINT32_C(0x00000001)
512	#endif
513	#ifndef PROCESS_CREATE_THREAD
514	# define PROCESS_CREATE_THREAD UINT32_C(0x00000002)
515	#endif
516	#ifndef PROCESS_SET_SESSIONID
517	# define PROCESS_SET_SESSIONID UINT32_C(0x00000004)
518	#endif
519	#ifndef PROCESS_VM_OPERATION
520	# define PROCESS_VM_OPERATION UINT32_C(0x00000008)
521	#endif
522	#ifndef PROCESS_VM_READ
523	# define PROCESS_VM_READ UINT32_C(0x00000010)
524	#endif
525	#ifndef PROCESS_VM_WRITE
526	# define PROCESS_VM_WRITE UINT32_C(0x00000020)
527	#endif
528	#ifndef PROCESS_DUP_HANDLE
529	# define PROCESS_DUP_HANDLE UINT32_C(0x00000040)
530	#endif
531	#ifndef PROCESS_CREATE_PROCESS
532	# define PROCESS_CREATE_PROCESS UINT32_C(0x00000080)
533	#endif
534	#ifndef PROCESS_SET_QUOTA
535	# define PROCESS_SET_QUOTA UINT32_C(0x00000100)
536	#endif
537	#ifndef PROCESS_SET_INFORMATION
538	# define PROCESS_SET_INFORMATION UINT32_C(0x00000200)
539	#endif
540	#ifndef PROCESS_QUERY_INFORMATION
541	# define PROCESS_QUERY_INFORMATION UINT32_C(0x00000400)
542	#endif
543	#ifndef PROCESS_SUSPEND_RESUME
544	# define PROCESS_SUSPEND_RESUME UINT32_C(0x00000800)
545	#endif
546	#ifndef PROCESS_QUERY_LIMITED_INFORMATION
547	# define PROCESS_QUERY_LIMITED_INFORMATION UINT32_C(0x00001000)
548	#endif
549	#ifndef PROCESS_SET_LIMITED_INFORMATION
550	# define PROCESS_SET_LIMITED_INFORMATION UINT32_C(0x00002000)
551	#endif
552	#define PROCESS_UNKNOWN_4000 UINT32_C(0x00004000)
553	#define PROCESS_UNKNOWN_6000 UINT32_C(0x00008000)
554	#ifndef PROCESS_ALL_ACCESS
555	# define PROCESS_ALL_ACCESS ( STANDARD_RIGHTS_REQUIRED \| SYNCHRONIZE \| UINT32_C(0x0000ffff) )
556	#endif
557	/** @} */
558
559	/** @name Thread access rights missing in ntddk headers
560	* @{ */
561	#ifndef THREAD_QUERY_INFORMATION
562	# define THREAD_QUERY_INFORMATION UINT32_C(0x00000040)
563	#endif
564	#ifndef THREAD_SET_THREAD_TOKEN
565	# define THREAD_SET_THREAD_TOKEN UINT32_C(0x00000080)
566	#endif
567	#ifndef THREAD_IMPERSONATE
568	# define THREAD_IMPERSONATE UINT32_C(0x00000100)
569	#endif
570	#ifndef THREAD_DIRECT_IMPERSONATION
571	# define THREAD_DIRECT_IMPERSONATION UINT32_C(0x00000200)
572	#endif
573	#ifndef THREAD_RESUME
574	# define THREAD_RESUME UINT32_C(0x00001000)
575	#endif
576	#define THREAD_UNKNOWN_2000 UINT32_C(0x00002000)
577	#define THREAD_UNKNOWN_4000 UINT32_C(0x00004000)
578	#define THREAD_UNKNOWN_8000 UINT32_C(0x00008000)
579	/** @} */
580
581	/** @name Special handle values.
582	* @{ */
583	#ifndef NtCurrentProcess
584	# define NtCurrentProcess() ( (HANDLE)-(intptr_t)1 )
585	#endif
586	#ifndef NtCurrentThread
587	# define NtCurrentThread() ( (HANDLE)-(intptr_t)2 )
588	#endif
589	#ifndef ZwCurrentProcess
590	# define ZwCurrentProcess() NtCurrentProcess()
591	#endif
592	#ifndef ZwCurrentThread
593	# define ZwCurrentThread() NtCurrentThread()
594	#endif
595	/** @} */
596
597
598	/** @name Directory object access rights.
599	* @{ */
600	#ifndef DIRECTORY_QUERY
601	# define DIRECTORY_QUERY UINT32_C(0x00000001)
602	#endif
603	#ifndef DIRECTORY_TRAVERSE
604	# define DIRECTORY_TRAVERSE UINT32_C(0x00000002)
605	#endif
606	#ifndef DIRECTORY_CREATE_OBJECT
607	# define DIRECTORY_CREATE_OBJECT UINT32_C(0x00000004)
608	#endif
609	#ifndef DIRECTORY_CREATE_SUBDIRECTORY
610	# define DIRECTORY_CREATE_SUBDIRECTORY UINT32_C(0x00000008)
611	#endif
612	#ifndef DIRECTORY_ALL_ACCESS
613	# define DIRECTORY_ALL_ACCESS ( STANDARD_RIGHTS_REQUIRED \| UINT32_C(0x0000000f) )
614	#endif
615	/** @} */
616
617
618
619	#ifdef RTNT_NEED_CLIENT_ID
620	typedef struct _CLIENT_ID
621	{
622	HANDLE UniqueProcess;
623	HANDLE UniqueThread;
624	} CLIENT_ID;
625	#endif
626	#ifdef IPRT_NT_USE_WINTERNL
627	typedef CLIENT_ID *PCLIENT_ID;
628	#endif
629
630	/** Extended affinity type, introduced in Windows 7 (?). */
631	typedef struct _KAFFINITY_EX
632	{
633	/** Count of valid bitmap entries. */
634	uint16_t Count;
635	/** Count of allocated bitmap entries. */
636	uint16_t Size;
637	/** Reserved / aligmment padding. */
638	uint32_t Reserved;
639	/** Bitmap where one bit corresponds to a CPU.
640	* @note Started at 20 entries. W10 20H2 increased it to 32. Must be
641	* probed by passing a big buffer to KeInitializeAffinityEx and check
642	* the Size afterwards. */
643	uintptr_t Bitmap[RT_FLEXIBLE_ARRAY_IN_NESTED_UNION];
644	} KAFFINITY_EX;
645	typedef KAFFINITY_EX *PKAFFINITY_EX;
646	typedef KAFFINITY_EX const *PCKAFFINITY_EX;
647
648	/** @name User Shared Data
649	* @{ */
650
651	#ifdef IPRT_NT_USE_WINTERNL
652	typedef struct _KSYSTEM_TIME
653	{
654	ULONG LowPart;
655	LONG High1Time;
656	LONG High2Time;
657	} KSYSTEM_TIME;
658	typedef KSYSTEM_TIME *PKSYSTEM_TIME;
659
660	typedef enum _NT_PRODUCT_TYPE
661	{
662	NtProductWinNt = 1,
663	NtProductLanManNt,
664	NtProductServer
665	} NT_PRODUCT_TYPE;
666
667	#define PROCESSOR_FEATURE_MAX 64
668
669	typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
670	{
671	StandardDesign = 0,
672	NEC98x86,
673	EndAlternatives
674	} ALTERNATIVE_ARCHITECTURE_TYPE;
675
676	# if 0
677	typedef struct _XSTATE_FEATURE
678	{
679	ULONG Offset;
680	ULONG Size;
681	} XSTATE_FEATURE;
682	typedef XSTATE_FEATURE *PXSTATE_FEATURE;
683
684	#define MAXIMUM_XSTATE_FEATURES 64
685
686	typedef struct _XSTATE_CONFIGURATION
687	{
688	ULONG64 EnabledFeatures;
689	ULONG Size;
690	ULONG OptimizedSave : 1;
691	XSTATE_FEATURE Features[MAXIMUM_XSTATE_FEATURES];
692	} XSTATE_CONFIGURATION;
693	typedef XSTATE_CONFIGURATION *PXSTATE_CONFIGURATION;
694	# endif
695	#endif /* IPRT_NT_USE_WINTERNL */
696
697	typedef struct _KUSER_SHARED_DATA
698	{
699	ULONG TickCountLowDeprecated; /*< 0x000 /
700	ULONG TickCountMultiplier; /*< 0x004 /
701	KSYSTEM_TIME volatile InterruptTime; /*< 0x008 /
702	KSYSTEM_TIME volatile SystemTime; /*< 0x014 /
703	KSYSTEM_TIME volatile TimeZoneBias; /*< 0x020 /
704	USHORT ImageNumberLow; /*< 0x02c /
705	USHORT ImageNumberHigh; /*< 0x02e /
706	WCHAR NtSystemRoot[260]; /*< 0x030 - Seems to be last member in NT 3.51. /
707	ULONG MaxStackTraceDepth; /*< 0x238 /
708	ULONG CryptoExponent; /*< 0x23c /
709	ULONG TimeZoneId; /*< 0x240 /
710	ULONG LargePageMinimum; /*< 0x244 /
711	ULONG AitSamplingValue; /*< 0x248 /
712	ULONG AppCompatFlag; /*< 0x24c /
713	ULONGLONG RNGSeedVersion; /*< 0x250 /
714	ULONG GlobalValidationRunlevel; /*< 0x258 /
715	LONG volatile TimeZoneBiasStamp; /*< 0x25c/
716	ULONG Reserved2; /*< 0x260 /
717	NT_PRODUCT_TYPE NtProductType; /*< 0x264 /
718	BOOLEAN ProductTypeIsValid; /*< 0x268 /
719	BOOLEAN Reserved0[1]; /*< 0x269 /
720	USHORT NativeProcessorArchitecture; /*< 0x26a /
721	ULONG NtMajorVersion; /*< 0x26c /
722	ULONG NtMinorVersion; /*< 0x270 /
723	BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX]; /*< 0x274 /
724	ULONG Reserved1; /*< 0x2b4 /
725	ULONG Reserved3; /*< 0x2b8 /
726	ULONG volatile TimeSlip; /*< 0x2bc /
727	ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture; /*< 0x2c0 /
728	ULONG AltArchitecturePad[1]; /*< 0x2c4 /
729	LARGE_INTEGER SystemExpirationDate; /*< 0x2c8 /
730	ULONG SuiteMask; /*< 0x2d0 /
731	BOOLEAN KdDebuggerEnabled; /*< 0x2d4 /
732	union /*< 0x2d5 /
733	{
734	UCHAR MitigationPolicies; /*< 0x2d5 /
735	struct
736	{
737	UCHAR NXSupportPolicy : 2;
738	UCHAR SEHValidationPolicy : 2;
739	UCHAR CurDirDevicesSkippedForDlls : 2;
740	UCHAR Reserved : 2;
741	};
742	};
743	UCHAR Reserved6[2]; /*< 0x2d6 /
744	ULONG volatile ActiveConsoleId; /*< 0x2d8 /
745	ULONG volatile DismountCount; /*< 0x2dc /
746	ULONG ComPlusPackage; /*< 0x2e0 /
747	ULONG LastSystemRITEventTickCount; /*< 0x2e4 /
748	ULONG NumberOfPhysicalPages; /*< 0x2e8 /
749	BOOLEAN SafeBootMode; /*< 0x2ec /
750	UCHAR Reserved12[3]; /*< 0x2ed /
751	union /*< 0x2f0 /
752	{
753	ULONG SharedDataFlags; /*< 0x2f0 /
754	struct
755	{
756	ULONG DbgErrorPortPresent : 1;
757	ULONG DbgElevationEnabled : 1;
758	ULONG DbgVirtEnabled : 1;
759	ULONG DbgInstallerDetectEnabled : 1;
760	ULONG DbgLkgEnabled : 1;
761	ULONG DbgDynProcessorEnabled : 1;
762	ULONG DbgConsoleBrokerEnabled : 1;
763	ULONG DbgSecureBootEnabled : 1;
764	ULONG SpareBits : 24;
765	};
766	};
767	ULONG DataFlagsPad[1]; /*< 0x2f4 /
768	ULONGLONG TestRetInstruction; /*< 0x2f8 /
769	LONGLONG QpcFrequency; /*< 0x300 /
770	ULONGLONG SystemCallPad[3]; /*< 0x308 /
771	union /*< 0x320 /
772	{
773	ULONG64 volatile TickCountQuad; /*< 0x320 /
774	KSYSTEM_TIME volatile TickCount; /*< 0x320 /
775	struct /*< 0x320 /
776	{
777	ULONG ReservedTickCountOverlay[3]; /*< 0x320 /
778	ULONG TickCountPad[1]; /*< 0x32c /
779	};
780	};
781	ULONG Cookie; /*< 0x330 /
782	ULONG CookiePad[1]; /*< 0x334 /
783	LONGLONG ConsoleSessionForegroundProcessId; /*< 0x338 /
784	ULONGLONG TimeUpdateLock; /*< 0x340 /
785	ULONGLONG BaselineSystemTimeQpc; /*< 0x348 /
786	ULONGLONG BaselineInterruptTimeQpc; /*< 0x350 /
787	ULONGLONG QpcSystemTimeIncrement; /*< 0x358 /
788	ULONGLONG QpcInterruptTimeIncrement; /*< 0x360 /
789	ULONG QpcSystemTimeIncrement32; /*< 0x368 /
790	ULONG QpcInterruptTimeIncrement32; /*< 0x36c /
791	UCHAR QpcSystemTimeIncrementShift; /*< 0x370 /
792	UCHAR QpcInterruptTimeIncrementShift; /*< 0x371 /
793	UCHAR Reserved8[14]; /*< 0x372 /
794	USHORT UserModeGlobalLogger[16]; /*< 0x380 /
795	ULONG ImageFileExecutionOptions; /*< 0x3a0 /
796	ULONG LangGenerationCount; /*< 0x3a4 /
797	ULONGLONG Reserved4; /*< 0x3a8 /
798	ULONGLONG volatile InterruptTimeBias; /**< 0x3b0 - What QueryUnbiasedInterruptTimePrecise
799	* subtracts from interrupt time. */
800	ULONGLONG volatile QpcBias; /*< 0x3b8 /
801	ULONG volatile ActiveProcessorCount; /*< 0x3c0 /
802	UCHAR volatile ActiveGroupCount; /*< 0x3c4 /
803	UCHAR Reserved9; /*< 0x3c5 /
804	union /*< 0x3c6 /
805	{
806	USHORT QpcData; /*< 0x3c6 /
807	struct /*< 0x3c6 /
808	{
809	BOOLEAN volatile QpcBypassEnabled; /*< 0x3c6 /
810	UCHAR QpcShift; /*< 0x3c7 /
811	};
812	};
813	LARGE_INTEGER TimeZoneBiasEffectiveStart; /*< 0x3c8 /
814	LARGE_INTEGER TimeZoneBiasEffectiveEnd; /*< 0x3d0 /
815	XSTATE_CONFIGURATION XState; /*< 0x3d8 /
816	} KUSER_SHARED_DATA;
817	typedef KUSER_SHARED_DATA *PKUSER_SHARED_DATA;
818	AssertCompileMemberOffset(KUSER_SHARED_DATA, InterruptTime, 0x008);
819	AssertCompileMemberOffset(KUSER_SHARED_DATA, SystemTime, 0x014);
820	AssertCompileMemberOffset(KUSER_SHARED_DATA, NtSystemRoot, 0x030);
821	AssertCompileMemberOffset(KUSER_SHARED_DATA, LargePageMinimum, 0x244);
822	AssertCompileMemberOffset(KUSER_SHARED_DATA, Reserved1, 0x2b4);
823	AssertCompileMemberOffset(KUSER_SHARED_DATA, TestRetInstruction, 0x2f8);
824	AssertCompileMemberOffset(KUSER_SHARED_DATA, Cookie, 0x330);
825	AssertCompileMemberOffset(KUSER_SHARED_DATA, ImageFileExecutionOptions, 0x3a0);
826	AssertCompileMemberOffset(KUSER_SHARED_DATA, XState, 0x3d8);
827	/** @def MM_SHARED_USER_DATA_VA
828	* Read only userland mapping of KUSER_SHARED_DATA. */
829	#ifndef MM_SHARED_USER_DATA_VA
830	# if ARCH_BITS == 32
831	# define MM_SHARED_USER_DATA_VA UINT32_C(0x7ffe0000)
832	# elif ARCH_BITS == 64
833	# define MM_SHARED_USER_DATA_VA UINT64_C(0x7ffe0000)
834	# else
835	# error "Unsupported/undefined ARCH_BITS value."
836	# endif
837	#endif
838	/** @def KI_USER_SHARED_DATA
839	* Read write kernel mapping of KUSER_SHARED_DATA. */
840	#ifndef KI_USER_SHARED_DATA
841	# ifdef RT_ARCH_X86
842	# define KI_USER_SHARED_DATA UINT32_C(0xffdf0000)
843	# elif defined(RT_ARCH_AMD64)
844	# define KI_USER_SHARED_DATA UINT64_C(0xfffff78000000000)
845	# else
846	# error "PORT ME - KI_USER_SHARED_DATA"
847	# endif
848	#endif
849	/** @} */
850
851
852	/** @name Process And Thread Environment Blocks
853	* @{ */
854
855	typedef struct _PEB_LDR_DATA
856	{
857	uint32_t Length;
858	BOOLEAN Initialized;
859	BOOLEAN Padding[3];
860	HANDLE SsHandle;
861	LIST_ENTRY InLoadOrderModuleList;
862	LIST_ENTRY InMemoryOrderModuleList;
863	LIST_ENTRY InInitializationOrderModuleList;
864	/* End NT4 */
865	LIST_ENTRY *EntryInProgress;
866	BOOLEAN ShutdownInProgress;
867	HANDLE ShutdownThreadId;
868	} PEB_LDR_DATA;
869	typedef PEB_LDR_DATA *PPEB_LDR_DATA;
870
871	typedef struct _PEB_COMMON
872	{
873	BOOLEAN InheritedAddressSpace; /*< 0x000 / 0x000 /
874	BOOLEAN ReadImageFileExecOptions; /*< 0x001 / 0x001 /
875	BOOLEAN BeingDebugged; /*< 0x002 / 0x002 /
876	union
877	{
878	uint8_t BitField; /*< 0x003 / 0x003 /
879	struct
880	{
881	uint8_t ImageUsesLargePages : 1; /*< 0x003 / 0x003 : Pos 0, 1 Bit /
882	} Common;
883	struct
884	{
885	uint8_t ImageUsesLargePages : 1; /*< 0x003 / 0x003 : Pos 0, 1 Bit /
886	uint8_t IsProtectedProcess : 1; /*< 0x003 / 0x003 : Pos 1, 1 Bit /
887	uint8_t IsImageDynamicallyRelocated : 1; /*< 0x003 / 0x003 : Pos 2, 1 Bit - Differs from W80 /
888	uint8_t SkipPatchingUser32Forwarders : 1; /*< 0x003 / 0x003 : Pos 3, 1 Bit - Differs from W80 /
889	uint8_t IsPackagedProcess : 1; /*< 0x003 / 0x003 : Pos 4, 1 Bit - Differs from W80 /
890	uint8_t IsAppContainer : 1; /*< 0x003 / 0x003 : Pos 5, 1 Bit - Differs from W80 /
891	uint8_t IsProtectedProcessLight : 1; /*< 0x003 / 0x003 : Pos 6, 1 Bit - Differs from W80 /
892	uint8_t SpareBits : 1; /*< 0x003 / 0x003 : Pos 7, 1 Bit /
893	} W81;
894	struct
895	{
896	uint8_t ImageUsesLargePages : 1; /*< 0x003 / 0x003 : Pos 0, 1 Bit /
897	uint8_t IsProtectedProcess : 1; /*< 0x003 / 0x003 : Pos 1, 1 Bit /
898	uint8_t IsLegacyProcess : 1; /*< 0x003 / 0x003 : Pos 2, 1 Bit - Differs from W81 /
899	uint8_t IsImageDynamicallyRelocated : 1; /*< 0x003 / 0x003 : Pos 3, 1 Bit - Differs from W81 /
900	uint8_t SkipPatchingUser32Forwarders : 1; /*< 0x003 / 0x003 : Pos 4, 1 Bit - Differs from W81 /
901	uint8_t IsPackagedProcess : 1; /*< 0x003 / 0x003 : Pos 5, 1 Bit - Differs from W81 /
902	uint8_t IsAppContainer : 1; /*< 0x003 / 0x003 : Pos 6, 1 Bit - Differs from W81 /
903	uint8_t SpareBits : 1; /*< 0x003 / 0x003 : Pos 7, 1 Bit /
904	} W80;
905	struct
906	{
907	uint8_t ImageUsesLargePages : 1; /*< 0x003 / 0x003 : Pos 0, 1 Bit /
908	uint8_t IsProtectedProcess : 1; /*< 0x003 / 0x003 : Pos 1, 1 Bit /
909	uint8_t IsLegacyProcess : 1; /*< 0x003 / 0x003 : Pos 2, 1 Bit - Differs from W81, same as W80 & W6. /
910	uint8_t IsImageDynamicallyRelocated : 1; /*< 0x003 / 0x003 : Pos 3, 1 Bit - Differs from W81, same as W80 & W6. /
911	uint8_t SkipPatchingUser32Forwarders : 1; /*< 0x003 / 0x003 : Pos 4, 1 Bit - Added in W7; Differs from W81, same as W80. /
912	uint8_t SpareBits : 3; /*< 0x003 / 0x003 : Pos 5, 3 Bit - Differs from W81 & W80, more spare bits. /
913	} W7;
914	struct
915	{
916	uint8_t ImageUsesLargePages : 1; /*< 0x003 / 0x003 : Pos 0, 1 Bit /
917	uint8_t IsProtectedProcess : 1; /*< 0x003 / 0x003 : Pos 1, 1 Bit /
918	uint8_t IsLegacyProcess : 1; /*< 0x003 / 0x003 : Pos 2, 1 Bit - Differs from W81, same as W80 & W7. /
919	uint8_t IsImageDynamicallyRelocated : 1; /*< 0x003 / 0x003 : Pos 3, 1 Bit - Differs from W81, same as W80 & W7. /
920	uint8_t SpareBits : 4; /*< 0x003 / 0x003 : Pos 4, 4 Bit - Differs from W81, W80, & W7, more spare bits. /
921	} W6;
922	struct
923	{
924	uint8_t ImageUsesLargePages : 1; /*< 0x003 / 0x003 : Pos 0, 1 Bit /
925	uint8_t SpareBits : 7; /*< 0x003 / 0x003 : Pos 1, 7 Bit - Differs from W81, W80, & W7, more spare bits. /
926	} W52;
927	struct
928	{
929	BOOLEAN SpareBool;
930	} W51;
931	} Diff0;
932	#if ARCH_BITS == 64
933	uint32_t Padding0; /*< 0x004 / NA /
934	#endif
935	HANDLE Mutant; /*< 0x008 / 0x004 /
936	PVOID ImageBaseAddress; /*< 0x010 / 0x008 /
937	PPEB_LDR_DATA Ldr; /*< 0x018 / 0x00c /
938	struct _RTL_USER_PROCESS_PARAMETERS ProcessParameters; /< 0x020 / 0x010 /
939	PVOID SubSystemData; /*< 0x028 / 0x014 /
940	HANDLE ProcessHeap; /*< 0x030 / 0x018 /
941	struct _RTL_CRITICAL_SECTION FastPebLock; /< 0x038 / 0x01c /
942	union
943	{
944	struct
945	{
946	PVOID AtlThunkSListPtr; /*< 0x040 / 0x020 /
947	PVOID IFEOKey; /*< 0x048 / 0x024 /
948	union
949	{
950	ULONG CrossProcessFlags; /*< 0x050 / 0x028 /
951	struct
952	{
953	uint32_t ProcessInJob : 1; /*< 0x050 / 0x028: Pos 0, 1 Bit /
954	uint32_t ProcessInitializing : 1; /*< 0x050 / 0x028: Pos 1, 1 Bit /
955	uint32_t ProcessUsingVEH : 1; /*< 0x050 / 0x028: Pos 2, 1 Bit /
956	uint32_t ProcessUsingVCH : 1; /*< 0x050 / 0x028: Pos 3, 1 Bit /
957	uint32_t ProcessUsingFTH : 1; /*< 0x050 / 0x028: Pos 4, 1 Bit /
958	uint32_t ReservedBits0 : 1; /*< 0x050 / 0x028: Pos 5, 27 Bits /
959	} W7, W8, W80, W81;
960	struct
961	{
962	uint32_t ProcessInJob : 1; /*< 0x050 / 0x028: Pos 0, 1 Bit /
963	uint32_t ProcessInitializing : 1; /*< 0x050 / 0x028: Pos 1, 1 Bit /
964	uint32_t ReservedBits0 : 30; /*< 0x050 / 0x028: Pos 2, 30 Bits /
965	} W6;
966	};
967	#if ARCH_BITS == 64
968	uint32_t Padding1; /*< 0x054 / /
969	#endif
970	} W6, W7, W8, W80, W81;
971	struct
972	{
973	PVOID AtlThunkSListPtr; /*< 0x040 / 0x020 /
974	PVOID SparePtr2; /*< 0x048 / 0x024 /
975	uint32_t EnvironmentUpdateCount; /*< 0x050 / 0x028 /
976	#if ARCH_BITS == 64
977	uint32_t Padding1; /*< 0x054 / /
978	#endif
979	} W52;
980	struct
981	{
982	PVOID FastPebLockRoutine; /*< NA / 0x020 /
983	PVOID FastPebUnlockRoutine; /*< NA / 0x024 /
984	uint32_t EnvironmentUpdateCount; /*< NA / 0x028 /
985	} W51;
986	} Diff1;
987	union
988	{
989	PVOID KernelCallbackTable; /*< 0x058 / 0x02c /
990	PVOID UserSharedInfoPtr; /*< 0x058 / 0x02c - Alternative use in W6./
991	};
992	uint32_t SystemReserved; /*< 0x060 / 0x030 /
993	union
994	{
995	struct
996	{
997	uint32_t AtlThunkSListPtr32; /*< 0x064 / 0x034 /
998	} W7, W8, W80, W81;
999	struct
1000	{
1001	uint32_t SpareUlong; /*< 0x064 / 0x034 /
1002	} W52, W6;
1003	struct
1004	{
1005	uint32_t ExecuteOptions : 2; /*< NA / 0x034: Pos 0, 2 Bits /
1006	uint32_t SpareBits : 30; /*< NA / 0x034: Pos 2, 30 Bits /
1007	} W51;
1008	} Diff2;
1009	union
1010	{
1011	struct
1012	{
1013	PVOID ApiSetMap; /*< 0x068 / 0x038 /
1014	} W7, W8, W80, W81;
1015	struct
1016	{
1017	struct _PEB_FREE_BLOCK FreeList; /< 0x068 / 0x038 /
1018	} W52, W6;
1019	struct
1020	{
1021	struct _PEB_FREE_BLOCK FreeList; /< NA / 0x038 /
1022	} W51;
1023	} Diff3;
1024	uint32_t TlsExpansionCounter; /*< 0x070 / 0x03c /
1025	#if ARCH_BITS == 64
1026	uint32_t Padding2; /*< 0x074 / NA /
1027	#endif
1028	struct _RTL_BITMAP TlsBitmap; /< 0x078 / 0x040 /
1029	uint32_t TlsBitmapBits[2]; /*< 0x080 / 0x044 /
1030	PVOID ReadOnlySharedMemoryBase; /*< 0x088 / 0x04c /
1031	union
1032	{
1033	struct
1034	{
1035	PVOID SparePvoid0; /*< 0x090 / 0x050 - HotpatchInformation before W81. /
1036	} W81;
1037	struct
1038	{
1039	PVOID HotpatchInformation; /*< 0x090 / 0x050 - Retired in W81. /
1040	} W6, W7, W80;
1041	struct
1042	{
1043	PVOID ReadOnlySharedMemoryHeap;
1044	} W52;
1045	} Diff4;
1046	PVOID ReadOnlyStaticServerData; /< 0x098 / 0x054 /
1047	PVOID AnsiCodePageData; /*< 0x0a0 / 0x058 /
1048	PVOID OemCodePageData; /*< 0x0a8 / 0x05c /
1049	PVOID UnicodeCaseTableData; /*< 0x0b0 / 0x060 /
1050	uint32_t NumberOfProcessors; /*< 0x0b8 / 0x064 /
1051	uint32_t NtGlobalFlag; /*< 0x0bc / 0x068 /
1052	#if ARCH_BITS == 32
1053	uint32_t Padding2b;
1054	#endif
1055	LARGE_INTEGER CriticalSectionTimeout; /*< 0x0c0 / 0x070 /
1056	SIZE_T HeapSegmentReserve; /*< 0x0c8 / 0x078 /
1057	SIZE_T HeapSegmentCommit; /*< 0x0d0 / 0x07c /
1058	SIZE_T HeapDeCommitTotalFreeThreshold; /*< 0x0d8 / 0x080 /
1059	SIZE_T HeapDeCommitFreeBlockThreshold; /*< 0x0e0 / 0x084 /
1060	uint32_t NumberOfHeaps; /*< 0x0e8 / 0x088 /
1061	uint32_t MaximumNumberOfHeaps; /*< 0x0ec / 0x08c /
1062	PVOID ProcessHeaps; /< 0x0f0 / 0x090 - Last NT 3.51 member. /
1063	PVOID GdiSharedHandleTable; /*< 0x0f8 / 0x094 /
1064	PVOID ProcessStarterHelper; /*< 0x100 / 0x098 /
1065	uint32_t GdiDCAttributeList; /*< 0x108 / 0x09c /
1066	#if ARCH_BITS == 64
1067	uint32_t Padding3; /*< 0x10c / NA /
1068	#endif
1069	struct _RTL_CRITICAL_SECTION LoaderLock; /< 0x110 / 0x0a0 /
1070	uint32_t OSMajorVersion; /*< 0x118 / 0x0a4 /
1071	uint32_t OSMinorVersion; /*< 0x11c / 0x0a8 /
1072	uint16_t OSBuildNumber; /*< 0x120 / 0x0ac /
1073	uint16_t OSCSDVersion; /*< 0x122 / 0x0ae /
1074	uint32_t OSPlatformId; /*< 0x124 / 0x0b0 /
1075	uint32_t ImageSubsystem; /*< 0x128 / 0x0b4 /
1076	uint32_t ImageSubsystemMajorVersion; /*< 0x12c / 0x0b8 /
1077	uint32_t ImageSubsystemMinorVersion; /*< 0x130 / 0x0bc /
1078	#if ARCH_BITS == 64
1079	uint32_t Padding4; /*< 0x134 / NA /
1080	#endif
1081	union
1082	{
1083	struct
1084	{
1085	SIZE_T ActiveProcessAffinityMask; /*< 0x138 / 0x0c0 /
1086	} W7, W8, W80, W81;
1087	struct
1088	{
1089	SIZE_T ImageProcessAffinityMask; /*< 0x138 / 0x0c0 /
1090	} W52, W6;
1091	} Diff5;
1092	uint32_t GdiHandleBuffer[ARCH_BITS == 64 ? 60 : 34]; /*< 0x140 / 0x0c4 /
1093	PVOID PostProcessInitRoutine; /*< 0x230 / 0x14c /
1094	PVOID TlsExpansionBitmap; /*< 0x238 / 0x150 /
1095	uint32_t TlsExpansionBitmapBits[32]; /*< 0x240 / 0x154 /
1096	uint32_t SessionId; /*< 0x2c0 / 0x1d4 /
1097	#if ARCH_BITS == 64
1098	uint32_t Padding5; /*< 0x2c4 / NA /
1099	#endif
1100	ULARGE_INTEGER AppCompatFlags; /*< 0x2c8 / 0x1d8 /
1101	ULARGE_INTEGER AppCompatFlagsUser; /*< 0x2d0 / 0x1e0 /
1102	PVOID pShimData; /*< 0x2d8 / 0x1e8 /
1103	PVOID AppCompatInfo; /*< 0x2e0 / 0x1ec /
1104	UNICODE_STRING CSDVersion; /*< 0x2e8 / 0x1f0 /
1105	struct _ACTIVATION_CONTEXT_DATA ActivationContextData; /< 0x2f8 / 0x1f8 /
1106	struct _ASSEMBLY_STORAGE_MAP ProcessAssemblyStorageMap; /< 0x300 / 0x1fc /
1107	struct _ACTIVATION_CONTEXT_DATA SystemDefaultActivationContextData; /< 0x308 / 0x200 /
1108	struct _ASSEMBLY_STORAGE_MAP SystemAssemblyStorageMap; /< 0x310 / 0x204 /
1109	SIZE_T MinimumStackCommit; /*< 0x318 / 0x208 /
1110	/* End of PEB in W52 (Windows XP (RTM))! */
1111	struct _FLS_CALLBACK_INFO FlsCallback; /< 0x320 / 0x20c /
1112	LIST_ENTRY FlsListHead; /*< 0x328 / 0x210 /
1113	PVOID FlsBitmap; /*< 0x338 / 0x218 /
1114	uint32_t FlsBitmapBits[4]; /*< 0x340 / 0x21c /
1115	uint32_t FlsHighIndex; /*< 0x350 / 0x22c /
1116	/* End of PEB in W52 (Windows Server 2003)! */
1117	PVOID WerRegistrationData; /*< 0x358 / 0x230 /
1118	PVOID WerShipAssertPtr; /*< 0x360 / 0x234 /
1119	/* End of PEB in W6 (windows Vista)! */
1120	union
1121	{
1122	struct
1123	{
1124	PVOID pUnused; /*< 0x368 / 0x238 - Was pContextData in W7. /
1125	} W8, W80, W81;
1126	struct
1127	{
1128	PVOID pContextData; /*< 0x368 / 0x238 - Retired in W80. /
1129	} W7;
1130	} Diff6;
1131	PVOID pImageHeaderHash; /*< 0x370 / 0x23c /
1132	union
1133	{
1134	uint32_t TracingFlags; /*< 0x378 / 0x240 /
1135	struct
1136	{
1137	uint32_t HeapTracingEnabled : 1; /*< 0x378 / 0x240 : Pos 0, 1 Bit /
1138	uint32_t CritSecTracingEnabled : 1; /*< 0x378 / 0x240 : Pos 1, 1 Bit /
1139	uint32_t LibLoaderTracingEnabled : 1; /*< 0x378 / 0x240 : Pos 2, 1 Bit /
1140	uint32_t SpareTracingBits : 29; /*< 0x378 / 0x240 : Pos 3, 29 Bits /
1141	} W8, W80, W81;
1142	struct
1143	{
1144	uint32_t HeapTracingEnabled : 1; /*< 0x378 / 0x240 : Pos 0, 1 Bit /
1145	uint32_t CritSecTracingEnabled : 1; /*< 0x378 / 0x240 : Pos 1, 1 Bit /
1146	uint32_t SpareTracingBits : 30; /*< 0x378 / 0x240 : Pos 3, 30 Bits - One bit more than W80 /
1147	} W7;
1148	} Diff7;
1149	#if ARCH_BITS == 64
1150	uint32_t Padding6; /*< 0x37c / NA /
1151	#endif
1152	uint64_t CsrServerReadOnlySharedMemoryBase; /*< 0x380 / 0x248 /
1153	/* End of PEB in W8, W81. */
1154	uintptr_t TppWorkerpListLock; /*< 0x388 / 0x250 /
1155	LIST_ENTRY TppWorkerpList; /*< 0x390 / 0x254 /
1156	PVOID WaitOnAddressHashTable[128]; /*< 0x3a0 / 0x25c /
1157	#if ARCH_BITS == 32
1158	uint32_t ExplicitPadding7; /*< NA NA / 0x45c /
1159	#endif
1160	} PEB_COMMON;
1161	typedef PEB_COMMON *PPEB_COMMON;
1162
1163	AssertCompileMemberOffset(PEB_COMMON, ProcessHeap, ARCH_BITS == 64 ? 0x30 : 0x18);
1164	AssertCompileMemberOffset(PEB_COMMON, SystemReserved, ARCH_BITS == 64 ? 0x60 : 0x30);
1165	AssertCompileMemberOffset(PEB_COMMON, TlsExpansionCounter, ARCH_BITS == 64 ? 0x70 : 0x3c);
1166	AssertCompileMemberOffset(PEB_COMMON, NtGlobalFlag, ARCH_BITS == 64 ? 0xbc : 0x68);
1167	AssertCompileMemberOffset(PEB_COMMON, LoaderLock, ARCH_BITS == 64 ? 0x110 : 0xa0);
1168	AssertCompileMemberOffset(PEB_COMMON, Diff5.W52.ImageProcessAffinityMask, ARCH_BITS == 64 ? 0x138 : 0xc0);
1169	AssertCompileMemberOffset(PEB_COMMON, PostProcessInitRoutine, ARCH_BITS == 64 ? 0x230 : 0x14c);
1170	AssertCompileMemberOffset(PEB_COMMON, AppCompatFlags, ARCH_BITS == 64 ? 0x2c8 : 0x1d8);
1171	AssertCompileSize(PEB_COMMON, ARCH_BITS == 64 ? 0x7a0 : 0x460);
1172
1173	/** The size of the windows 10 (build 14393) PEB structure. */
1174	#define PEB_SIZE_W10 sizeof(PEB_COMMON)
1175	/** The size of the windows 8.1 PEB structure. */
1176	#define PEB_SIZE_W81 RT_UOFFSETOF(PEB_COMMON, TppWorkerpListLock)
1177	/** The size of the windows 8.0 PEB structure. */
1178	#define PEB_SIZE_W80 RT_UOFFSETOF(PEB_COMMON, TppWorkerpListLock)
1179	/** The size of the windows 7 PEB structure. */
1180	#define PEB_SIZE_W7 RT_UOFFSETOF(PEB_COMMON, CsrServerReadOnlySharedMemoryBase)
1181	/** The size of the windows vista PEB structure. */
1182	#define PEB_SIZE_W6 RT_UOFFSETOF(PEB_COMMON, Diff3)
1183	/** The size of the windows server 2003 PEB structure. */
1184	#define PEB_SIZE_W52 RT_UOFFSETOF(PEB_COMMON, WerRegistrationData)
1185	/** The size of the windows XP PEB structure. */
1186	#define PEB_SIZE_W51 RT_UOFFSETOF(PEB_COMMON, FlsCallback)
1187
1188	#if 0
1189	typedef struct _NT_TIB
1190	{
1191	struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList;
1192	PVOID StackBase;
1193	PVOID StackLimit;
1194	PVOID SubSystemTib;
1195	union
1196	{
1197	PVOID FiberData;
1198	ULONG Version;
1199	};
1200	PVOID ArbitraryUserPointer;
1201	struct _NT_TIB *Self;
1202	} NT_TIB;
1203	typedef NT_TIB *PNT_TIB;
1204	#endif
1205
1206	typedef struct _ACTIVATION_CONTEXT_STACK
1207	{
1208	uint32_t Flags;
1209	uint32_t NextCookieSequenceNumber;
1210	PVOID ActiveFrame;
1211	LIST_ENTRY FrameListCache;
1212	} ACTIVATION_CONTEXT_STACK;
1213
1214	/* Common TEB. */
1215	typedef struct _TEB_COMMON
1216	{
1217	NT_TIB NtTib; /*< 0x000 / 0x000 /
1218	PVOID EnvironmentPointer; /*< 0x038 / 0x01c /
1219	CLIENT_ID ClientId; /*< 0x040 / 0x020 /
1220	PVOID ActiveRpcHandle; /*< 0x050 / 0x028 /
1221	PVOID ThreadLocalStoragePointer; /*< 0x058 / 0x02c /
1222	PPEB_COMMON ProcessEnvironmentBlock; /*< 0x060 / 0x030 /
1223	uint32_t LastErrorValue; /*< 0x068 / 0x034 /
1224	uint32_t CountOfOwnedCriticalSections; /*< 0x06c / 0x038 /
1225	PVOID CsrClientThread; /*< 0x070 / 0x03c /
1226	PVOID Win32ThreadInfo; /*< 0x078 / 0x040 /
1227	uint32_t User32Reserved[26]; /*< 0x080 / 0x044 /
1228	uint32_t UserReserved[5]; /*< 0x0e8 / 0x0ac /
1229	PVOID WOW32Reserved; /*< 0x100 / 0x0c0 /
1230	uint32_t CurrentLocale; /*< 0x108 / 0x0c4 /
1231	uint32_t FpSoftwareStatusRegister; /*< 0x10c / 0x0c8 /
1232	PVOID SystemReserved1[54]; /*< 0x110 / 0x0cc /
1233	uint32_t ExceptionCode; /*< 0x2c0 / 0x1a4 /
1234	#if ARCH_BITS == 64
1235	uint32_t Padding0; /*< 0x2c4 / NA /
1236	#endif
1237	union
1238	{
1239	struct
1240	{
1241	struct _ACTIVATION_CONTEXT_STACK ActivationContextStackPointer;/< 0x2c8 / 0x1a8 /
1242	uint8_t SpareBytes[ARCH_BITS == 64 ? 24 : 36]; /*< 0x2d0 / 0x1ac /
1243	} W52, W6, W7, W8, W80, W81;
1244	#if ARCH_BITS == 32
1245	struct
1246	{
1247	ACTIVATION_CONTEXT_STACK ActivationContextStack; /*< NA / 0x1a8 /
1248	uint8_t SpareBytes[20]; /*< NA / 0x1bc /
1249	} W51;
1250	#endif
1251	} Diff0;
1252	union
1253	{
1254	struct
1255	{
1256	uint32_t TxFsContext; /*< 0x2e8 / 0x1d0 /
1257	} W6, W7, W8, W80, W81;
1258	struct
1259	{
1260	uint32_t SpareBytesContinues; /*< 0x2e8 / 0x1d0 /
1261	} W52;
1262	} Diff1;
1263	#if ARCH_BITS == 64
1264	uint32_t Padding1; /*< 0x2ec / NA /
1265	#endif
1266	/_GDI_TEB_BATCH/ uint8_t GdiTebBatch[ARCH_BITS == 64 ? 0x4e8 :0x4e0]; /*< 0x2f0 / 0x1d4 /
1267	CLIENT_ID RealClientId; /*< 0x7d8 / 0x6b4 /
1268	HANDLE GdiCachedProcessHandle; /*< 0x7e8 / 0x6bc /
1269	uint32_t GdiClientPID; /*< 0x7f0 / 0x6c0 /
1270	uint32_t GdiClientTID; /*< 0x7f4 / 0x6c4 /
1271	PVOID GdiThreadLocalInfo; /*< 0x7f8 / 0x6c8 /
1272	SIZE_T Win32ClientInfo[62]; /*< 0x800 / 0x6cc /
1273	PVOID glDispatchTable[233]; /*< 0x9f0 / 0x7c4 /
1274	SIZE_T glReserved1[29]; /*< 0x1138 / 0xb68 /
1275	PVOID glReserved2; /*< 0x1220 / 0xbdc /
1276	PVOID glSectionInfo; /*< 0x1228 / 0xbe0 /
1277	PVOID glSection; /*< 0x1230 / 0xbe4 /
1278	PVOID glTable; /*< 0x1238 / 0xbe8 /
1279	PVOID glCurrentRC; /*< 0x1240 / 0xbec /
1280	PVOID glContext; /*< 0x1248 / 0xbf0 /
1281	NTSTATUS LastStatusValue; /*< 0x1250 / 0xbf4 /
1282	#if ARCH_BITS == 64
1283	uint32_t Padding2; /*< 0x1254 / NA /
1284	#endif
1285	UNICODE_STRING StaticUnicodeString; /*< 0x1258 / 0xbf8 /
1286	WCHAR StaticUnicodeBuffer[261]; /*< 0x1268 / 0xc00 /
1287	#if ARCH_BITS == 64
1288	WCHAR Padding3[3]; /*< 0x1472 / NA /
1289	#endif
1290	PVOID DeallocationStack; /*< 0x1478 / 0xe0c /
1291	PVOID TlsSlots[64]; /*< 0x1480 / 0xe10 /
1292	LIST_ENTRY TlsLinks; /*< 0x1680 / 0xf10 /
1293	PVOID Vdm; /*< 0x1690 / 0xf18 /
1294	PVOID ReservedForNtRpc; /*< 0x1698 / 0xf1c /
1295	PVOID DbgSsReserved[2]; /*< 0x16a0 / 0xf20 /
1296	uint32_t HardErrorMode; /*< 0x16b0 / 0xf28 - Called HardErrorsAreDisabled in W51. /
1297	#if ARCH_BITS == 64
1298	uint32_t Padding4; /*< 0x16b4 / NA /
1299	#endif
1300	PVOID Instrumentation[ARCH_BITS == 64 ? 11 : 9]; /*< 0x16b8 / 0xf2c /
1301	union
1302	{
1303	struct
1304	{
1305	GUID ActivityId; /*< 0x1710 / 0xf50 /
1306	PVOID SubProcessTag; /*< 0x1720 / 0xf60 /
1307	} W6, W7, W8, W80, W81;
1308	struct
1309	{
1310	PVOID InstrumentationContinues[ARCH_BITS == 64 ? 3 : 5]; /*< 0x1710 / 0xf50 /
1311	} W52;
1312	} Diff2;
1313	union /*< 0x1728 / 0xf64 /
1314	{
1315	struct
1316	{
1317	PVOID PerflibData; /*< 0x1728 / 0xf64 /
1318	} W8, W80, W81;
1319	struct
1320	{
1321	PVOID EtwLocalData; /*< 0x1728 / 0xf64 /
1322	} W7, W6;
1323	struct
1324	{
1325	PVOID SubProcessTag; /*< 0x1728 / 0xf64 /
1326	} W52;
1327	struct
1328	{
1329	PVOID InstrumentationContinues[1]; /*< 0x1728 / 0xf64 /
1330	} W51;
1331	} Diff3;
1332	union
1333	{
1334	struct
1335	{
1336	PVOID EtwTraceData; /*< 0x1730 / 0xf68 /
1337	} W52, W6, W7, W8, W80, W81;
1338	struct
1339	{
1340	PVOID InstrumentationContinues[1]; /*< 0x1730 / 0xf68 /
1341	} W51;
1342	} Diff4;
1343	PVOID WinSockData; /*< 0x1738 / 0xf6c /
1344	uint32_t GdiBatchCount; /*< 0x1740 / 0xf70 /
1345	union
1346	{
1347	union
1348	{
1349	PROCESSOR_NUMBER CurrentIdealProcessor; /*< 0x1744 / 0xf74 - W7+ /
1350	uint32_t IdealProcessorValue; /*< 0x1744 / 0xf74 - W7+ /
1351	struct
1352	{
1353	uint8_t ReservedPad1; /*< 0x1744 / 0xf74 - Called SpareBool0 in W6 /
1354	uint8_t ReservedPad2; /*< 0x1745 / 0xf75 - Called SpareBool0 in W6 /
1355	uint8_t ReservedPad3; /*< 0x1746 / 0xf76 - Called SpareBool0 in W6 /
1356	uint8_t IdealProcessor; /*< 0x1747 / 0xf77 /
1357	};
1358	} W6, W7, W8, W80, W81;
1359	struct
1360	{
1361	BOOLEAN InDbgPrint; /*< 0x1744 / 0xf74 /
1362	BOOLEAN FreeStackOnTermination; /*< 0x1745 / 0xf75 /
1363	BOOLEAN HasFiberData; /*< 0x1746 / 0xf76 /
1364	uint8_t IdealProcessor; /*< 0x1747 / 0xf77 /
1365	} W51, W52;
1366	} Diff5;
1367	uint32_t GuaranteedStackBytes; /*< 0x1748 / 0xf78 /
1368	#if ARCH_BITS == 64
1369	uint32_t Padding5; /*< 0x174c / NA /
1370	#endif
1371	PVOID ReservedForPerf; /*< 0x1750 / 0xf7c /
1372	PVOID ReservedForOle; /*< 0x1758 / 0xf80 /
1373	uint32_t WaitingOnLoaderLock; /*< 0x1760 / 0xf84 /
1374	#if ARCH_BITS == 64
1375	uint32_t Padding6; /*< 0x1764 / NA /
1376	#endif
1377	union /*< 0x1770 / 0xf8c /
1378	{
1379	struct
1380	{
1381	PVOID SavedPriorityState; /*< 0x1768 / 0xf88 /
1382	SIZE_T ReservedForCodeCoverage; /*< 0x1770 / 0xf8c /
1383	PVOID ThreadPoolData; /*< 0x1778 / 0xf90 /
1384	} W8, W80, W81;
1385	struct
1386	{
1387	PVOID SavedPriorityState; /*< 0x1768 / 0xf88 /
1388	SIZE_T SoftPatchPtr1; /*< 0x1770 / 0xf8c /
1389	PVOID ThreadPoolData; /*< 0x1778 / 0xf90 /
1390	} W6, W7;
1391	struct
1392	{
1393	PVOID SparePointer1; /*< 0x1768 / 0xf88 /
1394	SIZE_T SoftPatchPtr1; /*< 0x1770 / 0xf8c /
1395	PVOID SoftPatchPtr2; /*< 0x1778 / 0xf90 /
1396	} W52;
1397	#if ARCH_BITS == 32
1398	struct _Wx86ThreadState
1399	{
1400	PVOID CallBx86Eip; /*< NA / 0xf88 /
1401	PVOID DeallocationCpu; /*< NA / 0xf8c /
1402	BOOLEAN UseKnownWx86Dll; /*< NA / 0xf90 /
1403	int8_t OleStubInvoked; /*< NA / 0xf91 /
1404	} W51;
1405	#endif
1406	} Diff6;
1407	PVOID TlsExpansionSlots; /*< 0x1780 / 0xf94 /
1408	#if ARCH_BITS == 64
1409	PVOID DallocationBStore; /*< 0x1788 / NA /
1410	PVOID BStoreLimit; /*< 0x1790 / NA /
1411	#endif
1412	union
1413	{
1414	struct
1415	{
1416	uint32_t MuiGeneration; /*< 0x1798 / 0xf98 /
1417	} W7, W8, W80, W81;
1418	struct
1419	{
1420	uint32_t ImpersonationLocale;
1421	} W6;
1422	} Diff7;
1423	uint32_t IsImpersonating; /*< 0x179c / 0xf9c /
1424	PVOID NlsCache; /*< 0x17a0 / 0xfa0 /
1425	PVOID pShimData; /*< 0x17a8 / 0xfa4 /
1426	union /*< 0x17b0 / 0xfa8 /
1427	{
1428	struct
1429	{
1430	uint16_t HeapVirtualAffinity; /*< 0x17b0 / 0xfa8 /
1431	uint16_t LowFragHeapDataSlot; /*< 0x17b2 / 0xfaa /
1432	} W8, W80, W81;
1433	struct
1434	{
1435	uint32_t HeapVirtualAffinity; /*< 0x17b0 / 0xfa8 /
1436	} W7;
1437	} Diff8;
1438	#if ARCH_BITS == 64
1439	uint32_t Padding7; /*< 0x17b4 / NA /
1440	#endif
1441	HANDLE CurrentTransactionHandle; /*< 0x17b8 / 0xfac /
1442	struct _TEB_ACTIVE_FRAME ActiveFrame; /< 0x17c0 / 0xfb0 /
1443	/* End of TEB in W51 (Windows XP)! */
1444	PVOID FlsData; /*< 0x17c8 / 0xfb4 /
1445	union
1446	{
1447	struct
1448	{
1449	PVOID PreferredLanguages; /*< 0x17d0 / 0xfb8 /
1450	} W6, W7, W8, W80, W81;
1451	struct
1452	{
1453	BOOLEAN SafeThunkCall; /*< 0x17d0 / 0xfb8 /
1454	uint8_t BooleanSpare[3]; /*< 0x17d1 / 0xfb9 /
1455	/* End of TEB in W52 (Windows server 2003)! */
1456	} W52;
1457	} Diff9;
1458	PVOID UserPrefLanguages; /*< 0x17d8 / 0xfbc /
1459	PVOID MergedPrefLanguages; /*< 0x17e0 / 0xfc0 /
1460	uint32_t MuiImpersonation; /*< 0x17e8 / 0xfc4 /
1461	union
1462	{
1463	uint16_t CrossTebFlags; /*< 0x17ec / 0xfc8 /
1464	struct
1465	{
1466	uint16_t SpareCrossTebBits : 16; /*< 0x17ec / 0xfc8 : Pos 0, 16 Bits /
1467	};
1468	};
1469	union
1470	{
1471	uint16_t SameTebFlags; /*< 0x17ee / 0xfca /
1472	struct
1473	{
1474	uint16_t SafeThunkCall : 1; /*< 0x17ee / 0xfca : Pos 0, 1 Bit /
1475	uint16_t InDebugPrint : 1; /*< 0x17ee / 0xfca : Pos 1, 1 Bit /
1476	uint16_t HasFiberData : 1; /*< 0x17ee / 0xfca : Pos 2, 1 Bit /
1477	uint16_t SkipThreadAttach : 1; /*< 0x17ee / 0xfca : Pos 3, 1 Bit /
1478	uint16_t WerInShipAssertCode : 1; /*< 0x17ee / 0xfca : Pos 4, 1 Bit /
1479	uint16_t RanProcessInit : 1; /*< 0x17ee / 0xfca : Pos 5, 1 Bit /
1480	uint16_t ClonedThread : 1; /*< 0x17ee / 0xfca : Pos 6, 1 Bit /
1481	uint16_t SuppressDebugMsg : 1; /*< 0x17ee / 0xfca : Pos 7, 1 Bit /
1482	} Common;
1483	struct
1484	{
1485	uint16_t SafeThunkCall : 1; /*< 0x17ee / 0xfca : Pos 0, 1 Bit /
1486	uint16_t InDebugPrint : 1; /*< 0x17ee / 0xfca : Pos 1, 1 Bit /
1487	uint16_t HasFiberData : 1; /*< 0x17ee / 0xfca : Pos 2, 1 Bit /
1488	uint16_t SkipThreadAttach : 1; /*< 0x17ee / 0xfca : Pos 3, 1 Bit /
1489	uint16_t WerInShipAssertCode : 1; /*< 0x17ee / 0xfca : Pos 4, 1 Bit /
1490	uint16_t RanProcessInit : 1; /*< 0x17ee / 0xfca : Pos 5, 1 Bit /
1491	uint16_t ClonedThread : 1; /*< 0x17ee / 0xfca : Pos 6, 1 Bit /
1492	uint16_t SuppressDebugMsg : 1; /*< 0x17ee / 0xfca : Pos 7, 1 Bit /
1493	uint16_t DisableUserStackWalk : 1; /*< 0x17ee / 0xfca : Pos 8, 1 Bit /
1494	uint16_t RtlExceptionAttached : 1; /*< 0x17ee / 0xfca : Pos 9, 1 Bit /
1495	uint16_t InitialThread : 1; /*< 0x17ee / 0xfca : Pos 10, 1 Bit /
1496	uint16_t SessionAware : 1; /*< 0x17ee / 0xfca : Pos 11, 1 Bit - New Since W7. /
1497	uint16_t SpareSameTebBits : 4; /*< 0x17ee / 0xfca : Pos 12, 4 Bits /
1498	} W8, W80, W81;
1499	struct
1500	{
1501	uint16_t SafeThunkCall : 1; /*< 0x17ee / 0xfca : Pos 0, 1 Bit /
1502	uint16_t InDebugPrint : 1; /*< 0x17ee / 0xfca : Pos 1, 1 Bit /
1503	uint16_t HasFiberData : 1; /*< 0x17ee / 0xfca : Pos 2, 1 Bit /
1504	uint16_t SkipThreadAttach : 1; /*< 0x17ee / 0xfca : Pos 3, 1 Bit /
1505	uint16_t WerInShipAssertCode : 1; /*< 0x17ee / 0xfca : Pos 4, 1 Bit /
1506	uint16_t RanProcessInit : 1; /*< 0x17ee / 0xfca : Pos 5, 1 Bit /
1507	uint16_t ClonedThread : 1; /*< 0x17ee / 0xfca : Pos 6, 1 Bit /
1508	uint16_t SuppressDebugMsg : 1; /*< 0x17ee / 0xfca : Pos 7, 1 Bit /
1509	uint16_t DisableUserStackWalk : 1; /*< 0x17ee / 0xfca : Pos 8, 1 Bit /
1510	uint16_t RtlExceptionAttached : 1; /*< 0x17ee / 0xfca : Pos 9, 1 Bit /
1511	uint16_t InitialThread : 1; /*< 0x17ee / 0xfca : Pos 10, 1 Bit /
1512	uint16_t SpareSameTebBits : 5; /*< 0x17ee / 0xfca : Pos 12, 4 Bits /
1513	} W7;
1514	struct
1515	{
1516	uint16_t DbgSafeThunkCall : 1; /*< 0x17ee / 0xfca : Pos 0, 1 Bit /
1517	uint16_t DbgInDebugPrint : 1; /*< 0x17ee / 0xfca : Pos 1, 1 Bit /
1518	uint16_t DbgHasFiberData : 1; /*< 0x17ee / 0xfca : Pos 2, 1 Bit /
1519	uint16_t DbgSkipThreadAttach : 1; /*< 0x17ee / 0xfca : Pos 3, 1 Bit /
1520	uint16_t DbgWerInShipAssertCode : 1; /*< 0x17ee / 0xfca : Pos 4, 1 Bit /
1521	uint16_t DbgRanProcessInit : 1; /*< 0x17ee / 0xfca : Pos 5, 1 Bit /
1522	uint16_t DbgClonedThread : 1; /*< 0x17ee / 0xfca : Pos 6, 1 Bit /
1523	uint16_t DbgSuppressDebugMsg : 1; /*< 0x17ee / 0xfca : Pos 7, 1 Bit /
1524	uint16_t SpareSameTebBits : 8; /*< 0x17ee / 0xfca : Pos 8, 8 Bits /
1525	} W6;
1526	} Diff10;
1527	PVOID TxnScopeEnterCallback; /*< 0x17f0 / 0xfcc /
1528	PVOID TxnScopeExitCallback; /*< 0x17f8 / 0xfd0 /
1529	PVOID TxnScopeContext; /*< 0x1800 / 0xfd4 /
1530	uint32_t LockCount; /*< 0x1808 / 0xfd8 /
1531	union
1532	{
1533	struct
1534	{
1535	uint32_t SpareUlong0; /*< 0x180c / 0xfdc /
1536	} W7, W8, W80, W81;
1537	struct
1538	{
1539	uint32_t ProcessRundown;
1540	} W6;
1541	} Diff11;
1542	union
1543	{
1544	struct
1545	{
1546	PVOID ResourceRetValue; /*< 0x1810 / 0xfe0 /
1547	/* End of TEB in W7 (windows 7)! */
1548	PVOID ReservedForWdf; /*< 0x1818 / 0xfe4 - New Since W7. /
1549	/* End of TEB in W8 (windows 8.0 & 8.1)! */
1550	PVOID ReservedForCrt; /*< 0x1820 / 0xfe8 - New Since W10. /
1551	RTUUID EffectiveContainerId; /*< 0x1828 / 0xfec - New Since W10. /
1552	/* End of TEB in W10 14393! */
1553	} W8, W80, W81, W10;
1554	struct
1555	{
1556	PVOID ResourceRetValue; /*< 0x1810 / 0xfe0 /
1557	} W7;
1558	struct
1559	{
1560	uint64_t LastSwitchTime; /*< 0x1810 / 0xfe0 /
1561	uint64_t TotalSwitchOutTime; /*< 0x1818 / 0xfe8 /
1562	LARGE_INTEGER WaitReasonBitMap; /*< 0x1820 / 0xff0 /
1563	/* End of TEB in W6 (windows Vista)! */
1564	} W6;
1565	} Diff12;
1566	} TEB_COMMON;
1567	typedef TEB_COMMON *PTEB_COMMON;
1568	AssertCompileMemberOffset(TEB_COMMON, ExceptionCode, ARCH_BITS == 64 ? 0x2c0 : 0x1a4);
1569	AssertCompileMemberOffset(TEB_COMMON, LastStatusValue, ARCH_BITS == 64 ? 0x1250 : 0xbf4);
1570	AssertCompileMemberOffset(TEB_COMMON, DeallocationStack, ARCH_BITS == 64 ? 0x1478 : 0xe0c);
1571	AssertCompileMemberOffset(TEB_COMMON, ReservedForNtRpc, ARCH_BITS == 64 ? 0x1698 : 0xf1c);
1572	AssertCompileMemberOffset(TEB_COMMON, Instrumentation, ARCH_BITS == 64 ? 0x16b8 : 0xf2c);
1573	AssertCompileMemberOffset(TEB_COMMON, Diff2, ARCH_BITS == 64 ? 0x1710 : 0xf50);
1574	AssertCompileMemberOffset(TEB_COMMON, Diff3, ARCH_BITS == 64 ? 0x1728 : 0xf64);
1575	AssertCompileMemberOffset(TEB_COMMON, Diff4, ARCH_BITS == 64 ? 0x1730 : 0xf68);
1576	AssertCompileMemberOffset(TEB_COMMON, WinSockData, ARCH_BITS == 64 ? 0x1738 : 0xf6c);
1577	AssertCompileMemberOffset(TEB_COMMON, GuaranteedStackBytes, ARCH_BITS == 64 ? 0x1748 : 0xf78);
1578	AssertCompileMemberOffset(TEB_COMMON, MuiImpersonation, ARCH_BITS == 64 ? 0x17e8 : 0xfc4);
1579	AssertCompileMemberOffset(TEB_COMMON, LockCount, ARCH_BITS == 64 ? 0x1808 : 0xfd8);
1580	AssertCompileSize(TEB_COMMON, ARCH_BITS == 64 ? 0x1838 : 0x1000);
1581
1582
1583	/** The size of the windows 8.1 PEB structure. */
1584	#define TEB_SIZE_W10 ( RT_UOFFSETOF(TEB_COMMON, Diff12.W10.EffectiveContainerId) + sizeof(RTUUID) )
1585	/** The size of the windows 8.1 PEB structure. */
1586	#define TEB_SIZE_W81 ( RT_UOFFSETOF(TEB_COMMON, Diff12.W8.ReservedForWdf) + sizeof(PVOID) )
1587	/** The size of the windows 8.0 PEB structure. */
1588	#define TEB_SIZE_W80 ( RT_UOFFSETOF(TEB_COMMON, Diff12.W8.ReservedForWdf) + sizeof(PVOID) )
1589	/** The size of the windows 7 PEB structure. */
1590	#define TEB_SIZE_W7 RT_UOFFSETOF(TEB_COMMON, Diff12.W8.ReservedForWdf)
1591	/** The size of the windows vista PEB structure. */
1592	#define TEB_SIZE_W6 ( RT_UOFFSETOF(TEB_COMMON, Diff12.W6.WaitReasonBitMap) + sizeof(LARGE_INTEGER) )
1593	/** The size of the windows server 2003 PEB structure. */
1594	#define TEB_SIZE_W52 RT_ALIGN_Z(RT_UOFFSETOF(TEB_COMMON, Diff9.W52.BooleanSpare), sizeof(PVOID))
1595	/** The size of the windows XP PEB structure. */
1596	#define TEB_SIZE_W51 RT_UOFFSETOF(TEB_COMMON, FlsData)
1597
1598
1599
1600	#define _PEB _PEB_COMMON
1601	typedef PEB_COMMON PEB;
1602	typedef PPEB_COMMON PPEB;
1603
1604	#define _TEB _TEB_COMMON
1605	typedef TEB_COMMON TEB;
1606	typedef PTEB_COMMON PTEB;
1607
1608	#if !defined(NtCurrentTeb) && !defined(IPRT_NT_HAVE_CURRENT_TEB_MACRO)
1609	# ifdef RT_ARCH_X86
1610	DECL_FORCE_INLINE(PTEB) RTNtCurrentTeb(void) { return (PTEB)__readfsdword(RT_UOFFSETOF(TEB_COMMON, NtTib.Self)); }
1611	DECL_FORCE_INLINE(PPEB) RTNtCurrentPeb(void) { return (PPEB)__readfsdword(RT_UOFFSETOF(TEB_COMMON, ProcessEnvironmentBlock)); }
1612	DECL_FORCE_INLINE(uint32_t) RTNtCurrentThreadId(void) { return __readfsdword(RT_UOFFSETOF(TEB_COMMON, ClientId.UniqueThread)); }
1613	DECL_FORCE_INLINE(NTSTATUS) RTNtLastStatusValue(void) { return (NTSTATUS)__readfsdword(RT_UOFFSETOF(TEB_COMMON, LastStatusValue)); }
1614	DECL_FORCE_INLINE(uint32_t) RTNtLastErrorValue(void) { return __readfsdword(RT_UOFFSETOF(TEB_COMMON, LastErrorValue)); }
1615	# elif defined(RT_ARCH_AMD64)
1616	DECL_FORCE_INLINE(PTEB) RTNtCurrentTeb(void) { return (PTEB)__readgsqword(RT_UOFFSETOF(TEB_COMMON, NtTib.Self)); }
1617	DECL_FORCE_INLINE(PPEB) RTNtCurrentPeb(void) { return (PPEB)__readgsqword(RT_UOFFSETOF(TEB_COMMON, ProcessEnvironmentBlock)); }
1618	DECL_FORCE_INLINE(uint32_t) RTNtCurrentThreadId(void) { return __readgsdword(RT_UOFFSETOF(TEB_COMMON, ClientId.UniqueThread)); }
1619	DECL_FORCE_INLINE(NTSTATUS) RTNtLastStatusValue(void) { return (NTSTATUS)__readgsdword(RT_UOFFSETOF(TEB_COMMON, LastStatusValue)); }
1620	DECL_FORCE_INLINE(uint32_t) RTNtLastErrorValue(void) { return __readgsdword(RT_UOFFSETOF(TEB_COMMON, LastErrorValue)); }
1621	# else
1622	# error "Port me"
1623	# endif
1624	#else
1625	# define RTNtCurrentTeb() ((PTEB)NtCurrentTeb())
1626	# define RTNtCurrentPeb() (RTNtCurrentTeb()->ProcessEnvironmentBlock)
1627	# define RTNtCurrentThreadId() ((uint32_t)(uintptr_t)RTNtCurrentTeb()->ClientId.UniqueThread)
1628	# define RTNtLastStatusValue() (RTNtCurrentTeb()->LastStatusValue)
1629	# define RTNtLastErrorValue() (RTNtCurrentTeb()->LastErrorValue)
1630	#endif
1631	#define NtCurrentPeb() RTNtCurrentPeb()
1632
1633	#ifdef IN_RING3
1634	RT_DECL_NTAPI(void) RtlAcquirePebLock(void);
1635	RT_DECL_NTAPI(void) RtlReleasePebLock(void);
1636	#endif
1637
1638	/** @} */
1639
1640
1641	#ifdef IPRT_NT_USE_WINTERNL
1642	RT_DECL_NTAPI(NTSTATUS) NtCreateSection(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PLARGE_INTEGER, ULONG, ULONG, HANDLE);
1643	typedef enum _SECTION_INHERIT
1644	{
1645	ViewShare = 1,
1646	ViewUnmap
1647	} SECTION_INHERIT;
1648	#endif
1649	RT_DECL_NTAPI(NTSTATUS) NtMapViewOfSection(HANDLE, HANDLE, PVOID *, ULONG, SIZE_T, PLARGE_INTEGER, PSIZE_T, SECTION_INHERIT,
1650	ULONG, ULONG);
1651	RT_DECL_NTAPI(NTSTATUS) NtFlushVirtualMemory(HANDLE, PVOID *, PSIZE_T, PIO_STATUS_BLOCK);
1652	RT_DECL_NTAPI(NTSTATUS) NtUnmapViewOfSection(HANDLE, PVOID);
1653
1654	#ifdef IPRT_NT_USE_WINTERNL
1655	RT_DECL_NTAPI(NTSTATUS) NtOpenProcess(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID);
1656	RT_DECL_NTAPI(NTSTATUS) ZwOpenProcess(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID);
1657	#endif
1658	RT_DECL_NTAPI(NTSTATUS) NtOpenThread(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID);
1659	RT_DECL_NTAPI(NTSTATUS) ZwOpenThread(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID);
1660	RT_DECL_NTAPI(NTSTATUS) NtAlertThread(HANDLE hThread);
1661	#ifdef IPRT_NT_USE_WINTERNL
1662	RT_DECL_NTAPI(NTSTATUS) ZwAlertThread(HANDLE hThread);
1663	#endif
1664	RT_DECL_NTAPI(NTSTATUS) NtTestAlert(void);
1665
1666	#ifdef IPRT_NT_USE_WINTERNL
1667	RT_DECL_NTAPI(NTSTATUS) NtOpenProcessToken(HANDLE, ACCESS_MASK, PHANDLE);
1668	RT_DECL_NTAPI(NTSTATUS) NtOpenThreadToken(HANDLE, ACCESS_MASK, BOOLEAN, PHANDLE);
1669	#endif
1670	RT_DECL_NTAPI(NTSTATUS) ZwOpenProcessToken(HANDLE, ACCESS_MASK, PHANDLE);
1671	RT_DECL_NTAPI(NTSTATUS) ZwOpenThreadToken(HANDLE, ACCESS_MASK, BOOLEAN, PHANDLE);
1672
1673	#ifdef IPRT_NT_USE_WINTERNL
1674	typedef struct _FILE_FS_VOLUME_INFORMATION
1675	{
1676	LARGE_INTEGER VolumeCreationTime;
1677	ULONG VolumeSerialNumber;
1678	ULONG VolumeLabelLength;
1679	BOOLEAN SupportsObjects;
1680	WCHAR VolumeLabel[1];
1681	} FILE_FS_VOLUME_INFORMATION;
1682	typedef FILE_FS_VOLUME_INFORMATION *PFILE_FS_VOLUME_INFORMATION;
1683	typedef struct _FILE_FS_LABEL_INFORMATION
1684	{
1685	ULONG VolumeLabelLength;
1686	WCHAR VolumeLabel[1];
1687	} FILE_FS_LABEL_INFORMATION;
1688	typedef FILE_FS_LABEL_INFORMATION *PFILE_FS_LABEL_INFORMATION;
1689	typedef struct _FILE_FS_SIZE_INFORMATION
1690	{
1691	LARGE_INTEGER TotalAllocationUnits;
1692	LARGE_INTEGER AvailableAllocationUnits;
1693	ULONG SectorsPerAllocationUnit;
1694	ULONG BytesPerSector;
1695	} FILE_FS_SIZE_INFORMATION;
1696	typedef FILE_FS_SIZE_INFORMATION *PFILE_FS_SIZE_INFORMATION;
1697	typedef struct _FILE_FS_DEVICE_INFORMATION
1698	{
1699	DEVICE_TYPE DeviceType;
1700	ULONG Characteristics;
1701	} FILE_FS_DEVICE_INFORMATION;
1702	typedef FILE_FS_DEVICE_INFORMATION *PFILE_FS_DEVICE_INFORMATION;
1703	typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
1704	{
1705	ULONG FileSystemAttributes;
1706	LONG MaximumComponentNameLength;
1707	ULONG FileSystemNameLength;
1708	WCHAR FileSystemName[1];
1709	} FILE_FS_ATTRIBUTE_INFORMATION;
1710	typedef FILE_FS_ATTRIBUTE_INFORMATION *PFILE_FS_ATTRIBUTE_INFORMATION;
1711	typedef struct _FILE_FS_CONTROL_INFORMATION
1712	{
1713	LARGE_INTEGER FreeSpaceStartFiltering;
1714	LARGE_INTEGER FreeSpaceThreshold;
1715	LARGE_INTEGER FreeSpaceStopFiltering;
1716	LARGE_INTEGER DefaultQuotaThreshold;
1717	LARGE_INTEGER DefaultQuotaLimit;
1718	ULONG FileSystemControlFlags;
1719	} FILE_FS_CONTROL_INFORMATION;
1720	typedef FILE_FS_CONTROL_INFORMATION *PFILE_FS_CONTROL_INFORMATION;
1721	typedef struct _FILE_FS_FULL_SIZE_INFORMATION
1722	{
1723	LARGE_INTEGER TotalAllocationUnits;
1724	LARGE_INTEGER CallerAvailableAllocationUnits;
1725	LARGE_INTEGER ActualAvailableAllocationUnits;
1726	ULONG SectorsPerAllocationUnit;
1727	ULONG BytesPerSector;
1728	} FILE_FS_FULL_SIZE_INFORMATION;
1729	typedef FILE_FS_FULL_SIZE_INFORMATION *PFILE_FS_FULL_SIZE_INFORMATION;
1730	typedef struct _FILE_FS_OBJECTID_INFORMATION
1731	{
1732	UCHAR ObjectId[16];
1733	UCHAR ExtendedInfo[48];
1734	} FILE_FS_OBJECTID_INFORMATION;
1735	typedef FILE_FS_OBJECTID_INFORMATION *PFILE_FS_OBJECTID_INFORMATION;
1736	typedef struct _FILE_FS_DRIVER_PATH_INFORMATION
1737	{
1738	BOOLEAN DriverInPath;
1739	ULONG DriverNameLength;
1740	WCHAR DriverName[1];
1741	} FILE_FS_DRIVER_PATH_INFORMATION;
1742	typedef FILE_FS_DRIVER_PATH_INFORMATION *PFILE_FS_DRIVER_PATH_INFORMATION;
1743	typedef struct _FILE_FS_VOLUME_FLAGS_INFORMATION
1744	{
1745	ULONG Flags;
1746	} FILE_FS_VOLUME_FLAGS_INFORMATION;
1747	typedef FILE_FS_VOLUME_FLAGS_INFORMATION *PFILE_FS_VOLUME_FLAGS_INFORMATION;
1748	#endif
1749	#if !defined(SSINFO_OFFSET_UNKNOWN) \|\| defined(IPRT_NT_USE_WINTERNL)
1750	typedef struct _FILE_FS_SECTOR_SIZE_INFORMATION
1751	{
1752	ULONG LogicalBytesPerSector;
1753	ULONG PhysicalBytesPerSectorForAtomicity;
1754	ULONG PhysicalBytesPerSectorForPerformance;
1755	ULONG FileSystemEffectivePhysicalBytesPerSectorForAtomicity;
1756	ULONG Flags;
1757	ULONG ByteOffsetForSectorAlignment;
1758	ULONG ByteOffsetForPartitionAlignment;
1759	} FILE_FS_SECTOR_SIZE_INFORMATION;
1760	typedef FILE_FS_SECTOR_SIZE_INFORMATION *PFILE_FS_SECTOR_SIZE_INFORMATION;
1761	# ifndef SSINFO_OFFSET_UNKNOWN
1762	# define SSINFO_OFFSET_UNKNOWN 0xffffffffUL
1763	# define SSINFO_FLAGS_ALIGNED_DEVICE 1UL
1764	# define SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE 2UL
1765	# define SSINFO_FLAGS_NO_SEEK_PENALTY 4UL
1766	# define SSINFO_FLAGS_TRIM_ENABLED 8UL
1767	# define SSINFO_FLAGS_BYTE_ADDRESSABLE 16UL
1768	# endif
1769	#endif
1770	#ifdef IPRT_NT_USE_WINTERNL
1771	typedef struct _FILE_FS_DATA_COPY_INFORMATION
1772	{
1773	ULONG NumberOfCopies;
1774	} FILE_FS_DATA_COPY_INFORMATION;
1775	typedef FILE_FS_DATA_COPY_INFORMATION *PFILE_FS_DATA_COPY_INFORMATION;
1776	typedef struct _FILE_FS_METADATA_SIZE_INFORMATION
1777	{
1778	LARGE_INTEGER TotalMetadataAllocationUnits;
1779	ULONG SectorsPerAllocationUnit;
1780	ULONG BytesPerSector;
1781	} FILE_FS_METADATA_SIZE_INFORMATION;
1782	typedef FILE_FS_METADATA_SIZE_INFORMATION *PFILE_FS_METADATA_SIZE_INFORMATION;
1783	typedef struct _FILE_FS_FULL_SIZE_INFORMATION_EX
1784	{
1785	ULONGLONG ActualTotalAllocationUnits;
1786	ULONGLONG ActualAvailableAllocationUnits;
1787	ULONGLONG ActualPoolUnavailableAllocationUnits;
1788	ULONGLONG CallerTotalAllocationUnits;
1789	ULONGLONG CallerAvailableAllocationUnits;
1790	ULONGLONG CallerPoolUnavailableAllocationUnits;
1791	ULONGLONG UsedAllocationUnits;
1792	ULONGLONG TotalReservedAllocationUnits;
1793	ULONGLONG VolumeStorageReserveAllocationUnits;
1794	ULONGLONG AvailableCommittedAllocationUnits;
1795	ULONGLONG PoolAvailableAllocationUnits;
1796	ULONG SectorsPerAllocationUnit;
1797	ULONG BytesPerSector;
1798	} FILE_FS_FULL_SIZE_INFORMATION_EX;
1799	typedef FILE_FS_FULL_SIZE_INFORMATION_EX *PFILE_FS_FULL_SIZE_INFORMATION_EX;
1800	#endif /* IPRT_NT_USE_WINTERNL */
1801
1802	typedef enum _FSINFOCLASS
1803	{
1804	FileFsVolumeInformation = 1,
1805	FileFsLabelInformation,
1806	FileFsSizeInformation, /*< FILE_FS_SIZE_INFORMATION /
1807	FileFsDeviceInformation,
1808	FileFsAttributeInformation,
1809	FileFsControlInformation,
1810	FileFsFullSizeInformation,
1811	FileFsObjectIdInformation,
1812	FileFsDriverPathInformation,
1813	FileFsVolumeFlagsInformation,
1814	FileFsSectorSizeInformation,
1815	FileFsDataCopyInformation,
1816	FileFsMetadataSizeInformation,
1817	FileFsFullSizeInformationEx,
1818	FileFsMaximumInformation
1819	} FS_INFORMATION_CLASS;
1820	typedef FS_INFORMATION_CLASS *PFS_INFORMATION_CLASS;
1821	RT_DECL_NTAPI(NTSTATUS) NtQueryVolumeInformationFile(HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG, FS_INFORMATION_CLASS);
1822	RT_DECL_NTAPI(NTSTATUS) NtSetVolumeInformationFile(HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG, FS_INFORMATION_CLASS);
1823
1824	#ifdef IPRT_NT_USE_WINTERNL
1825	typedef struct _FILE_DIRECTORY_INFORMATION
1826	{
1827	ULONG NextEntryOffset;
1828	ULONG FileIndex;
1829	LARGE_INTEGER CreationTime;
1830	LARGE_INTEGER LastAccessTime;
1831	LARGE_INTEGER LastWriteTime;
1832	LARGE_INTEGER ChangeTime;
1833	LARGE_INTEGER EndOfFile;
1834	LARGE_INTEGER AllocationSize;
1835	ULONG FileAttributes;
1836	ULONG FileNameLength;
1837	WCHAR FileName[1];
1838	} FILE_DIRECTORY_INFORMATION;
1839	typedef FILE_DIRECTORY_INFORMATION *PFILE_DIRECTORY_INFORMATION;
1840	typedef struct _FILE_FULL_DIR_INFORMATION
1841	{
1842	ULONG NextEntryOffset;
1843	ULONG FileIndex;
1844	LARGE_INTEGER CreationTime;
1845	LARGE_INTEGER LastAccessTime;
1846	LARGE_INTEGER LastWriteTime;
1847	LARGE_INTEGER ChangeTime;
1848	LARGE_INTEGER EndOfFile;
1849	LARGE_INTEGER AllocationSize;
1850	ULONG FileAttributes;
1851	ULONG FileNameLength;
1852	ULONG EaSize;
1853	WCHAR FileName[1];
1854	} FILE_FULL_DIR_INFORMATION;
1855	typedef FILE_FULL_DIR_INFORMATION *PFILE_FULL_DIR_INFORMATION;
1856	typedef struct _FILE_BOTH_DIR_INFORMATION
1857	{
1858	ULONG NextEntryOffset; /*< 0x00: /
1859	ULONG FileIndex; /*< 0x04: /
1860	LARGE_INTEGER CreationTime; /*< 0x08: /
1861	LARGE_INTEGER LastAccessTime; /*< 0x10: /
1862	LARGE_INTEGER LastWriteTime; /*< 0x18: /
1863	LARGE_INTEGER ChangeTime; /*< 0x20: /
1864	LARGE_INTEGER EndOfFile; /*< 0x28: /
1865	LARGE_INTEGER AllocationSize; /*< 0x30: /
1866	ULONG FileAttributes; /*< 0x38: /
1867	ULONG FileNameLength; /*< 0x3c: /
1868	ULONG EaSize; /*< 0x40: /
1869	CCHAR ShortNameLength; /*< 0x44: /
1870	WCHAR ShortName[12]; /*< 0x46: /
1871	WCHAR FileName[1]; /*< 0x5e: /
1872	} FILE_BOTH_DIR_INFORMATION;
1873	typedef FILE_BOTH_DIR_INFORMATION *PFILE_BOTH_DIR_INFORMATION;
1874	typedef struct _FILE_BASIC_INFORMATION
1875	{
1876	LARGE_INTEGER CreationTime;
1877	LARGE_INTEGER LastAccessTime;
1878	LARGE_INTEGER LastWriteTime;
1879	LARGE_INTEGER ChangeTime;
1880	ULONG FileAttributes;
1881	} FILE_BASIC_INFORMATION;
1882	typedef FILE_BASIC_INFORMATION *PFILE_BASIC_INFORMATION;
1883	typedef struct _FILE_STANDARD_INFORMATION
1884	{
1885	LARGE_INTEGER AllocationSize;
1886	LARGE_INTEGER EndOfFile;
1887	ULONG NumberOfLinks;
1888	BOOLEAN DeletePending;
1889	BOOLEAN Directory;
1890	} FILE_STANDARD_INFORMATION;
1891	typedef FILE_STANDARD_INFORMATION *PFILE_STANDARD_INFORMATION;
1892	typedef struct _FILE_NAME_INFORMATION
1893	{
1894	ULONG FileNameLength;
1895	WCHAR FileName[1];
1896	} FILE_NAME_INFORMATION;
1897	typedef FILE_NAME_INFORMATION *PFILE_NAME_INFORMATION;
1898	typedef FILE_NAME_INFORMATION FILE_NETWORK_PHYSICAL_NAME_INFORMATION;
1899	typedef FILE_NETWORK_PHYSICAL_NAME_INFORMATION *PFILE_NETWORK_PHYSICAL_NAME_INFORMATION;
1900	typedef struct _FILE_INTERNAL_INFORMATION
1901	{
1902	LARGE_INTEGER IndexNumber;
1903	} FILE_INTERNAL_INFORMATION;
1904	typedef FILE_INTERNAL_INFORMATION *PFILE_INTERNAL_INFORMATION;
1905	typedef struct _FILE_EA_INFORMATION
1906	{
1907	ULONG EaSize;
1908	} FILE_EA_INFORMATION;
1909	typedef FILE_EA_INFORMATION *PFILE_EA_INFORMATION;
1910	typedef struct _FILE_ACCESS_INFORMATION
1911	{
1912	ACCESS_MASK AccessFlags;
1913	} FILE_ACCESS_INFORMATION;
1914	typedef FILE_ACCESS_INFORMATION *PFILE_ACCESS_INFORMATION;
1915	typedef struct _FILE_RENAME_INFORMATION
1916	{
1917	union
1918	{
1919	BOOLEAN ReplaceIfExists;
1920	ULONG Flags;
1921	};
1922	HANDLE RootDirectory;
1923	ULONG FileNameLength;
1924	WCHAR FileName[1];
1925	} FILE_RENAME_INFORMATION;
1926	typedef FILE_RENAME_INFORMATION *PFILE_RENAME_INFORMATION;
1927	typedef struct _FILE_LINK_INFORMATION
1928	{
1929	union
1930	{
1931	BOOLEAN ReplaceIfExists;
1932	ULONG Flags;
1933	};
1934	HANDLE RootDirectory;
1935	ULONG FileNameLength;
1936	WCHAR FileName[1];
1937	} FILE_LINK_INFORMATION;
1938	typedef FILE_LINK_INFORMATION *PFILE_LINK_INFORMATION;
1939	typedef struct _FILE_NAMES_INFORMATION
1940	{
1941	ULONG NextEntryOffset;
1942	ULONG FileIndex;
1943	ULONG FileNameLength;
1944	WCHAR FileName[1];
1945	} FILE_NAMES_INFORMATION;
1946	typedef FILE_NAMES_INFORMATION *PFILE_NAMES_INFORMATION;
1947	typedef struct _FILE_DISPOSITION_INFORMATION
1948	{
1949	BOOLEAN DeleteFile;
1950	} FILE_DISPOSITION_INFORMATION;
1951	typedef FILE_DISPOSITION_INFORMATION *PFILE_DISPOSITION_INFORMATION;
1952	typedef struct _FILE_POSITION_INFORMATION
1953	{
1954	LARGE_INTEGER CurrentByteOffset;
1955	} FILE_POSITION_INFORMATION;
1956	typedef FILE_POSITION_INFORMATION *PFILE_POSITION_INFORMATION;
1957	typedef struct _FILE_FULL_EA_INFORMATION
1958	{
1959	ULONG NextEntryOffset;
1960	UCHAR Flags;
1961	UCHAR EaNameLength;
1962	USHORT EaValueLength;
1963	CHAR EaName[1];
1964	} FILE_FULL_EA_INFORMATION;
1965	typedef FILE_FULL_EA_INFORMATION *PFILE_FULL_EA_INFORMATION;
1966	typedef struct _FILE_MODE_INFORMATION
1967	{
1968	ULONG Mode;
1969	} FILE_MODE_INFORMATION;
1970	typedef FILE_MODE_INFORMATION *PFILE_MODE_INFORMATION;
1971	typedef struct _FILE_ALIGNMENT_INFORMATION
1972	{
1973	ULONG AlignmentRequirement;
1974	} FILE_ALIGNMENT_INFORMATION;
1975	typedef FILE_ALIGNMENT_INFORMATION *PFILE_ALIGNMENT_INFORMATION;
1976	typedef struct _FILE_ALL_INFORMATION
1977	{
1978	FILE_BASIC_INFORMATION BasicInformation;
1979	FILE_STANDARD_INFORMATION StandardInformation;
1980	FILE_INTERNAL_INFORMATION InternalInformation;
1981	FILE_EA_INFORMATION EaInformation;
1982	FILE_ACCESS_INFORMATION AccessInformation;
1983	FILE_POSITION_INFORMATION PositionInformation;
1984	FILE_MODE_INFORMATION ModeInformation;
1985	FILE_ALIGNMENT_INFORMATION AlignmentInformation;
1986	FILE_NAME_INFORMATION NameInformation;
1987	} FILE_ALL_INFORMATION;
1988	typedef FILE_ALL_INFORMATION *PFILE_ALL_INFORMATION;
1989	typedef struct _FILE_ALLOCATION_INFORMATION
1990	{
1991	LARGE_INTEGER AllocationSize;
1992	} FILE_ALLOCATION_INFORMATION;
1993	typedef FILE_ALLOCATION_INFORMATION *PFILE_ALLOCATION_INFORMATION;
1994	typedef struct _FILE_END_OF_FILE_INFORMATION
1995	{
1996	LARGE_INTEGER EndOfFile;
1997	} FILE_END_OF_FILE_INFORMATION;
1998	typedef FILE_END_OF_FILE_INFORMATION *PFILE_END_OF_FILE_INFORMATION;
1999	typedef struct _FILE_STREAM_INFORMATION
2000	{
2001	ULONG NextEntryOffset;
2002	ULONG StreamNameLength;
2003	LARGE_INTEGER StreamSize;
2004	LARGE_INTEGER StreamAllocationSize;
2005	WCHAR StreamName[1];
2006	} FILE_STREAM_INFORMATION;
2007	typedef FILE_STREAM_INFORMATION *PFILE_STREAM_INFORMATION;
2008
2009	typedef struct _FILE_PIPE_INFORMATION
2010	{
2011	ULONG ReadMode;
2012	ULONG CompletionMode;
2013	} FILE_PIPE_INFORMATION;
2014	typedef FILE_PIPE_INFORMATION *PFILE_PIPE_INFORMATION;
2015
2016	typedef struct _FILE_PIPE_LOCAL_INFORMATION
2017	{
2018	ULONG NamedPipeType;
2019	ULONG NamedPipeConfiguration;
2020	ULONG MaximumInstances;
2021	ULONG CurrentInstances;
2022	ULONG InboundQuota;
2023	ULONG ReadDataAvailable;
2024	ULONG OutboundQuota;
2025	ULONG WriteQuotaAvailable;
2026	ULONG NamedPipeState;
2027	ULONG NamedPipeEnd;
2028	} FILE_PIPE_LOCAL_INFORMATION;
2029	typedef FILE_PIPE_LOCAL_INFORMATION *PFILE_PIPE_LOCAL_INFORMATION;
2030
2031	/** @name Pipe state (FILE_PIPE_LOCAL_INFORMATION::NamedPipeState)
2032	* @{ */
2033	#if !defined(FILE_PIPE_DISCONNECTED_STATE) \|\| defined(DOXYGEN_RUNNING)
2034	# define FILE_PIPE_DISCONNECTED_STATE 0x00000001U
2035	# define FILE_PIPE_LISTENING_STATE 0x00000002U
2036	# define FILE_PIPE_CONNECTED_STATE 0x00000003U
2037	# define FILE_PIPE_CLOSING_STATE 0x00000004U
2038	#endif
2039	/** @} */
2040
2041	/** @name Pipe config (FILE_PIPE_LOCAL_INFORMATION::NamedPipeConfiguration)
2042	* @{ */
2043	#if !defined(FILE_PIPE_INBOUND) \|\| defined(DOXYGEN_RUNNING)
2044	# define FILE_PIPE_INBOUND 0x00000000U
2045	# define FILE_PIPE_OUTBOUND 0x00000001U
2046	# define FILE_PIPE_FULL_DUPLEX 0x00000002U
2047	#endif
2048	/** @} */
2049
2050	/** @name Pipe end (FILE_PIPE_LOCAL_INFORMATION::NamedPipeEnd)
2051	* @{ */
2052	#if !defined(FILE_PIPE_CLIENT_END) \|\| defined(DOXYGEN_RUNNING)
2053	# define FILE_PIPE_CLIENT_END 0x00000000U
2054	# define FILE_PIPE_SERVER_END 0x00000001U
2055	#endif
2056	/** @} */
2057
2058	typedef struct _FILE_PIPE_REMOTE_INFORMATION
2059	{
2060	LARGE_INTEGER CollectDataTime;
2061	ULONG MaximumCollectionCount;
2062	} FILE_PIPE_REMOTE_INFORMATION;
2063	typedef FILE_PIPE_REMOTE_INFORMATION *PFILE_PIPE_REMOTE_INFORMATION;
2064	typedef struct _FILE_MAILSLOT_QUERY_INFORMATION
2065	{
2066	ULONG MaximumMessageSize;
2067	ULONG MailslotQuota;
2068	ULONG NextMessageSize;
2069	ULONG MessagesAvailable;
2070	LARGE_INTEGER ReadTimeout;
2071	} FILE_MAILSLOT_QUERY_INFORMATION;
2072	typedef FILE_MAILSLOT_QUERY_INFORMATION *PFILE_MAILSLOT_QUERY_INFORMATION;
2073	typedef struct _FILE_MAILSLOT_SET_INFORMATION
2074	{
2075	PLARGE_INTEGER ReadTimeout;
2076	} FILE_MAILSLOT_SET_INFORMATION;
2077	typedef FILE_MAILSLOT_SET_INFORMATION *PFILE_MAILSLOT_SET_INFORMATION;
2078	typedef struct _FILE_COMPRESSION_INFORMATION
2079	{
2080	LARGE_INTEGER CompressedFileSize;
2081	USHORT CompressionFormat;
2082	UCHAR CompressionUnitShift;
2083	UCHAR ChunkShift;
2084	UCHAR ClusterShift;
2085	UCHAR Reserved[3];
2086	} FILE_COMPRESSION_INFORMATION;
2087	typedef FILE_COMPRESSION_INFORMATION *PFILE_COMPRESSION_INFORMATION;
2088	typedef struct _FILE_OBJECTID_INFORMATION
2089	{
2090	LONGLONG FileReference;
2091	UCHAR ObjectId[16];
2092	union
2093	{
2094	struct
2095	{
2096	UCHAR BirthVolumeId[16];
2097	UCHAR BirthObjectId[16];
2098	UCHAR DomainId[16];
2099	};
2100	UCHAR ExtendedInfo[48];
2101	};
2102	} FILE_OBJECTID_INFORMATION;
2103	typedef FILE_OBJECTID_INFORMATION *PFILE_OBJECTID_INFORMATION;
2104	typedef struct _FILE_COMPLETION_INFORMATION
2105	{
2106	HANDLE Port;
2107	PVOID Key;
2108	} FILE_COMPLETION_INFORMATION;
2109	typedef FILE_COMPLETION_INFORMATION *PFILE_COMPLETION_INFORMATION;
2110	typedef struct _FILE_MOVE_CLUSTER_INFORMATION
2111	{
2112	ULONG ClusterCount;
2113	HANDLE RootDirectory;
2114	ULONG FileNameLength;
2115	WCHAR FileName[1];
2116	} FILE_MOVE_CLUSTER_INFORMATION;
2117	typedef FILE_MOVE_CLUSTER_INFORMATION *PFILE_MOVE_CLUSTER_INFORMATION;
2118	typedef struct _FILE_QUOTA_INFORMATION
2119	{
2120	ULONG NextEntryOffset;
2121	ULONG SidLength;
2122	LARGE_INTEGER ChangeTime;
2123	LARGE_INTEGER QuotaUsed;
2124	LARGE_INTEGER QuotaThreshold;
2125	LARGE_INTEGER QuotaLimit;
2126	SID Sid;
2127	} FILE_QUOTA_INFORMATION;
2128	typedef FILE_QUOTA_INFORMATION *PFILE_QUOTA_INFORMATION;
2129	typedef struct _FILE_REPARSE_POINT_INFORMATION
2130	{
2131	LONGLONG FileReference;
2132	ULONG Tag;
2133	} FILE_REPARSE_POINT_INFORMATION;
2134	typedef FILE_REPARSE_POINT_INFORMATION *PFILE_REPARSE_POINT_INFORMATION;
2135	typedef struct _FILE_NETWORK_OPEN_INFORMATION
2136	{
2137	LARGE_INTEGER CreationTime;
2138	LARGE_INTEGER LastAccessTime;
2139	LARGE_INTEGER LastWriteTime;
2140	LARGE_INTEGER ChangeTime;
2141	LARGE_INTEGER AllocationSize;
2142	LARGE_INTEGER EndOfFile;
2143	ULONG FileAttributes;
2144	} FILE_NETWORK_OPEN_INFORMATION;
2145	typedef FILE_NETWORK_OPEN_INFORMATION *PFILE_NETWORK_OPEN_INFORMATION;
2146	typedef struct _FILE_ATTRIBUTE_TAG_INFORMATION
2147	{
2148	ULONG FileAttributes;
2149	ULONG ReparseTag;
2150	} FILE_ATTRIBUTE_TAG_INFORMATION;
2151	typedef FILE_ATTRIBUTE_TAG_INFORMATION *PFILE_ATTRIBUTE_TAG_INFORMATION;
2152	typedef struct _FILE_TRACKING_INFORMATION
2153	{
2154	HANDLE DestinationFile;
2155	ULONG ObjectInformationLength;
2156	CHAR ObjectInformation[1];
2157	} FILE_TRACKING_INFORMATION;
2158	typedef FILE_TRACKING_INFORMATION *PFILE_TRACKING_INFORMATION;
2159	typedef struct _FILE_ID_BOTH_DIR_INFORMATION
2160	{
2161	ULONG NextEntryOffset;
2162	ULONG FileIndex;
2163	LARGE_INTEGER CreationTime;
2164	LARGE_INTEGER LastAccessTime;
2165	LARGE_INTEGER LastWriteTime;
2166	LARGE_INTEGER ChangeTime;
2167	LARGE_INTEGER EndOfFile;
2168	LARGE_INTEGER AllocationSize;
2169	ULONG FileAttributes;
2170	ULONG FileNameLength;
2171	ULONG EaSize;
2172	CCHAR ShortNameLength;
2173	WCHAR ShortName[12];
2174	LARGE_INTEGER FileId;
2175	WCHAR FileName[1];
2176	} FILE_ID_BOTH_DIR_INFORMATION;
2177	typedef FILE_ID_BOTH_DIR_INFORMATION *PFILE_ID_BOTH_DIR_INFORMATION;
2178	typedef struct _FILE_ID_FULL_DIR_INFORMATION
2179	{
2180	ULONG NextEntryOffset;
2181	ULONG FileIndex;
2182	LARGE_INTEGER CreationTime;
2183	LARGE_INTEGER LastAccessTime;
2184	LARGE_INTEGER LastWriteTime;
2185	LARGE_INTEGER ChangeTime;
2186	LARGE_INTEGER EndOfFile;
2187	LARGE_INTEGER AllocationSize;
2188	ULONG FileAttributes;
2189	ULONG FileNameLength;
2190	ULONG EaSize;
2191	LARGE_INTEGER FileId;
2192	WCHAR FileName[1];
2193	} FILE_ID_FULL_DIR_INFORMATION;
2194	typedef FILE_ID_FULL_DIR_INFORMATION *PFILE_ID_FULL_DIR_INFORMATION;
2195	typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION
2196	{
2197	LARGE_INTEGER ValidDataLength;
2198	} FILE_VALID_DATA_LENGTH_INFORMATION;
2199	typedef FILE_VALID_DATA_LENGTH_INFORMATION *PFILE_VALID_DATA_LENGTH_INFORMATION;
2200	typedef struct _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION
2201	{
2202	ULONG Flags;
2203	} FILE_IO_COMPLETION_NOTIFICATION_INFORMATION;
2204	typedef FILE_IO_COMPLETION_NOTIFICATION_INFORMATION *PFILE_IO_COMPLETION_NOTIFICATION_INFORMATION;
2205	typedef enum _IO_PRIORITY_HINT
2206	{
2207	IoPriorityVeryLow = 0,
2208	IoPriorityLow,
2209	IoPriorityNormal,
2210	IoPriorityHigh,
2211	IoPriorityCritical,
2212	MaxIoPriorityTypes
2213	} IO_PRIORITY_HINT;
2214	AssertCompileSize(IO_PRIORITY_HINT, sizeof(int));
2215	typedef struct _FILE_IO_PRIORITY_HINT_INFORMATION
2216	{
2217	IO_PRIORITY_HINT PriorityHint;
2218	} FILE_IO_PRIORITY_HINT_INFORMATION;
2219	typedef FILE_IO_PRIORITY_HINT_INFORMATION *PFILE_IO_PRIORITY_HINT_INFORMATION;
2220	typedef struct _FILE_SFIO_RESERVE_INFORMATION
2221	{
2222	ULONG RequestsPerPeriod;
2223	ULONG Period;
2224	BOOLEAN RetryFailures;
2225	BOOLEAN Discardable;
2226	ULONG RequestSize;
2227	ULONG NumOutstandingRequests;
2228	} FILE_SFIO_RESERVE_INFORMATION;
2229	typedef FILE_SFIO_RESERVE_INFORMATION *PFILE_SFIO_RESERVE_INFORMATION;
2230	typedef struct _FILE_SFIO_VOLUME_INFORMATION
2231	{
2232	ULONG MaximumRequestsPerPeriod;
2233	ULONG MinimumPeriod;
2234	ULONG MinimumTransferSize;
2235	} FILE_SFIO_VOLUME_INFORMATION;
2236	typedef FILE_SFIO_VOLUME_INFORMATION *PFILE_SFIO_VOLUME_INFORMATION;
2237	typedef struct _FILE_LINK_ENTRY_INFORMATION
2238	{
2239	ULONG NextEntryOffset;
2240	LONGLONG ParentFileId;
2241	ULONG FileNameLength;
2242	WCHAR FileName[1];
2243	} FILE_LINK_ENTRY_INFORMATION;
2244	typedef FILE_LINK_ENTRY_INFORMATION *PFILE_LINK_ENTRY_INFORMATION;
2245	typedef struct _FILE_LINKS_INFORMATION
2246	{
2247	ULONG BytesNeeded;
2248	ULONG EntriesReturned;
2249	FILE_LINK_ENTRY_INFORMATION Entry;
2250	} FILE_LINKS_INFORMATION;
2251	typedef FILE_LINKS_INFORMATION *PFILE_LINKS_INFORMATION;
2252	typedef struct _FILE_PROCESS_IDS_USING_FILE_INFORMATION
2253	{
2254	ULONG NumberOfProcessIdsInList;
2255	ULONG_PTR ProcessIdList[1];
2256	} FILE_PROCESS_IDS_USING_FILE_INFORMATION;
2257	typedef FILE_PROCESS_IDS_USING_FILE_INFORMATION *PFILE_PROCESS_IDS_USING_FILE_INFORMATION;
2258	typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION
2259	{
2260	ULONG NextEntryOffset;
2261	ULONG FileIndex;
2262	LARGE_INTEGER CreationTime;
2263	LARGE_INTEGER LastAccessTime;
2264	LARGE_INTEGER LastWriteTime;
2265	LARGE_INTEGER ChangeTime;
2266	LARGE_INTEGER EndOfFile;
2267	LARGE_INTEGER AllocationSize;
2268	ULONG FileAttributes;
2269	ULONG FileNameLength;
2270	LARGE_INTEGER FileId;
2271	GUID LockingTransactionId;
2272	ULONG TxInfoFlags;
2273	WCHAR FileName[1];
2274	} FILE_ID_GLOBAL_TX_DIR_INFORMATION;
2275	typedef FILE_ID_GLOBAL_TX_DIR_INFORMATION *PFILE_ID_GLOBAL_TX_DIR_INFORMATION;
2276	typedef struct _FILE_IS_REMOTE_DEVICE_INFORMATION
2277	{
2278	BOOLEAN IsRemote;
2279	} FILE_IS_REMOTE_DEVICE_INFORMATION;
2280	typedef FILE_IS_REMOTE_DEVICE_INFORMATION *PFILE_IS_REMOTE_DEVICE_INFORMATION;
2281	typedef struct _FILE_NUMA_NODE_INFORMATION
2282	{
2283	USHORT NodeNumber;
2284	} FILE_NUMA_NODE_INFORMATION;
2285	typedef FILE_NUMA_NODE_INFORMATION *PFILE_NUMA_NODE_INFORMATION;
2286	typedef struct _FILE_STANDARD_LINK_INFORMATION
2287	{
2288	ULONG NumberOfAccessibleLinks;
2289	ULONG TotalNumberOfLinks;
2290	BOOLEAN DeletePending;
2291	BOOLEAN Directory;
2292	} FILE_STANDARD_LINK_INFORMATION;
2293	typedef FILE_STANDARD_LINK_INFORMATION *PFILE_STANDARD_LINK_INFORMATION;
2294	typedef struct _FILE_REMOTE_PROTOCOL_INFORMATION
2295	{
2296	USHORT StructureVersion;
2297	USHORT StructureSize;
2298	ULONG Protocol;
2299	USHORT ProtocolMajorVersion;
2300	USHORT ProtocolMinorVersion;
2301	USHORT ProtocolRevision;
2302	USHORT Reserved;
2303	ULONG Flags;
2304	struct
2305	{
2306	ULONG Reserved[8];
2307	} GenericReserved;
2308	struct
2309	{
2310	ULONG Reserved[16];
2311	} ProtocolSpecificReserved;
2312	} FILE_REMOTE_PROTOCOL_INFORMATION;
2313	typedef FILE_REMOTE_PROTOCOL_INFORMATION *PFILE_REMOTE_PROTOCOL_INFORMATION;
2314	typedef struct _FILE_VOLUME_NAME_INFORMATION
2315	{
2316	ULONG DeviceNameLength;
2317	WCHAR DeviceName[1];
2318	} FILE_VOLUME_NAME_INFORMATION;
2319	typedef FILE_VOLUME_NAME_INFORMATION *PFILE_VOLUME_NAME_INFORMATION;
2320	# ifndef FILE_INVALID_FILE_ID
2321	typedef struct _FILE_ID_128
2322	{
2323	BYTE Identifier[16];
2324	} FILE_ID_128;
2325	typedef FILE_ID_128 *PFILE_ID_128;
2326	# endif
2327	typedef struct _FILE_ID_EXTD_DIR_INFORMATION
2328	{
2329	ULONG NextEntryOffset;
2330	ULONG FileIndex;
2331	LARGE_INTEGER CreationTime;
2332	LARGE_INTEGER LastAccessTime;
2333	LARGE_INTEGER LastWriteTime;
2334	LARGE_INTEGER ChangeTime;
2335	LARGE_INTEGER EndOfFile;
2336	LARGE_INTEGER AllocationSize;
2337	ULONG FileAttributes;
2338	ULONG FileNameLength;
2339	ULONG EaSize;
2340	ULONG ReparsePointTag;
2341	FILE_ID_128 FileId;
2342	WCHAR FileName[1];
2343	} FILE_ID_EXTD_DIR_INFORMATION;
2344	typedef FILE_ID_EXTD_DIR_INFORMATION *PFILE_ID_EXTD_DIR_INFORMATION;
2345	typedef struct _FILE_ID_EXTD_BOTH_DIR_INFORMATION
2346	{
2347	ULONG NextEntryOffset;
2348	ULONG FileIndex;
2349	LARGE_INTEGER CreationTime;
2350	LARGE_INTEGER LastAccessTime;
2351	LARGE_INTEGER LastWriteTime;
2352	LARGE_INTEGER ChangeTime;
2353	LARGE_INTEGER EndOfFile;
2354	LARGE_INTEGER AllocationSize;
2355	ULONG FileAttributes;
2356	ULONG FileNameLength;
2357	ULONG EaSize;
2358	ULONG ReparsePointTag;
2359	FILE_ID_128 FileId;
2360	CCHAR ShortNameLength;
2361	WCHAR ShortName[12];
2362	WCHAR FileName[1];
2363	} FILE_ID_EXTD_BOTH_DIR_INFORMATION;
2364	typedef FILE_ID_EXTD_BOTH_DIR_INFORMATION *PFILE_ID_EXTD_BOTH_DIR_INFORMATION;
2365	typedef struct _FILE_ID_INFORMATION
2366	{
2367	ULONGLONG VolumeSerialNumber;
2368	FILE_ID_128 FileId;
2369	} FILE_ID_INFORMATION;
2370	typedef FILE_ID_INFORMATION *PFILE_ID_INFORMATION;
2371	typedef struct _FILE_LINK_ENTRY_FULL_ID_INFORMATION
2372	{
2373	ULONG NextEntryOffset;
2374	FILE_ID_128 ParentFileId;
2375	ULONG FileNameLength;
2376	WCHAR FileName[1];
2377	} FILE_LINK_ENTRY_FULL_ID_INFORMATION;
2378	typedef FILE_LINK_ENTRY_FULL_ID_INFORMATION *PFILE_LINK_ENTRY_FULL_ID_INFORMATION;
2379	typedef struct _FILE_LINKS_FULL_ID_INFORMATION {
2380	ULONG BytesNeeded;
2381	ULONG EntriesReturned;
2382	FILE_LINK_ENTRY_FULL_ID_INFORMATION Entry;
2383	} FILE_LINKS_FULL_ID_INFORMATION;
2384	typedef FILE_LINKS_FULL_ID_INFORMATION *PFILE_LINKS_FULL_ID_INFORMATION;
2385	typedef struct _FILE_DISPOSITION_INFORMATION_EX
2386	{
2387	ULONG Flags;
2388	} FILE_DISPOSITION_INFORMATION_EX;
2389	typedef FILE_DISPOSITION_INFORMATION_EX *PFILE_DISPOSITION_INFORMATION_EX;
2390	# ifndef QUERY_STORAGE_CLASSES_FLAGS_MEASURE_WRITE
2391	typedef struct _FILE_DESIRED_STORAGE_CLASS_INFORMATION
2392	{
2393	/FILE_STORAGE_TIER_CLASS/ ULONG Class;
2394	ULONG Flags;
2395	} FILE_DESIRED_STORAGE_CLASS_INFORMATION;
2396	typedef FILE_DESIRED_STORAGE_CLASS_INFORMATION *PFILE_DESIRED_STORAGE_CLASS_INFORMATION;
2397	# endif
2398	typedef struct _FILE_STAT_INFORMATION
2399	{
2400	LARGE_INTEGER FileId;
2401	LARGE_INTEGER CreationTime;
2402	LARGE_INTEGER LastAccessTime;
2403	LARGE_INTEGER LastWriteTime;
2404	LARGE_INTEGER ChangeTime;
2405	LARGE_INTEGER AllocationSize;
2406	LARGE_INTEGER EndOfFile;
2407	ULONG FileAttributes;
2408	ULONG ReparseTag;
2409	ULONG NumberOfLinks;
2410	ACCESS_MASK EffectiveAccess;
2411	} FILE_STAT_INFORMATION;
2412	typedef FILE_STAT_INFORMATION *PFILE_STAT_INFORMATION;
2413	typedef struct _FILE_STAT_LX_INFORMATION
2414	{
2415	LARGE_INTEGER FileId;
2416	LARGE_INTEGER CreationTime;
2417	LARGE_INTEGER LastAccessTime;
2418	LARGE_INTEGER LastWriteTime;
2419	LARGE_INTEGER ChangeTime;
2420	LARGE_INTEGER AllocationSize;
2421	LARGE_INTEGER EndOfFile;
2422	ULONG FileAttributes;
2423	ULONG ReparseTag;
2424	ULONG NumberOfLinks;
2425	ACCESS_MASK EffectiveAccess;
2426	ULONG LxFlags;
2427	ULONG LxUid;
2428	ULONG LxGid;
2429	ULONG LxMode;
2430	ULONG LxDeviceIdMajor;
2431	ULONG LxDeviceIdMinor;
2432	} FILE_STAT_LX_INFORMATION;
2433	typedef FILE_STAT_LX_INFORMATION *PFILE_STAT_LX_INFORMATION;
2434	typedef struct _FILE_CASE_SENSITIVE_INFORMATION
2435	{
2436	ULONG Flags;
2437	} FILE_CASE_SENSITIVE_INFORMATION;
2438	typedef FILE_CASE_SENSITIVE_INFORMATION *PFILE_CASE_SENSITIVE_INFORMATION;
2439
2440	typedef enum _FILE_INFORMATION_CLASS
2441	{
2442	FileDirectoryInformation = 1,
2443	FileFullDirectoryInformation,
2444	FileBothDirectoryInformation,
2445	FileBasicInformation,
2446	FileStandardInformation,
2447	FileInternalInformation,
2448	FileEaInformation,
2449	FileAccessInformation,
2450	FileNameInformation,
2451	FileRenameInformation,
2452	FileLinkInformation,
2453	FileNamesInformation,
2454	FileDispositionInformation,
2455	FilePositionInformation,
2456	FileFullEaInformation,
2457	FileModeInformation,
2458	FileAlignmentInformation,
2459	FileAllInformation,
2460	FileAllocationInformation,
2461	FileEndOfFileInformation,
2462	FileAlternateNameInformation,
2463	FileStreamInformation,
2464	FilePipeInformation,
2465	FilePipeLocalInformation,
2466	FilePipeRemoteInformation,
2467	FileMailslotQueryInformation,
2468	FileMailslotSetInformation,
2469	FileCompressionInformation,
2470	FileObjectIdInformation,
2471	FileCompletionInformation,
2472	FileMoveClusterInformation,
2473	FileQuotaInformation,
2474	FileReparsePointInformation,
2475	FileNetworkOpenInformation,
2476	FileAttributeTagInformation,
2477	FileTrackingInformation,
2478	FileIdBothDirectoryInformation,
2479	FileIdFullDirectoryInformation,
2480	FileValidDataLengthInformation,
2481	FileShortNameInformation,
2482	FileIoCompletionNotificationInformation,
2483	FileIoStatusBlockRangeInformation,
2484	FileIoPriorityHintInformation,
2485	FileSfioReserveInformation,
2486	FileSfioVolumeInformation,
2487	FileHardLinkInformation,
2488	FileProcessIdsUsingFileInformation,
2489	FileNormalizedNameInformation,
2490	FileNetworkPhysicalNameInformation,
2491	FileIdGlobalTxDirectoryInformation,
2492	FileIsRemoteDeviceInformation,
2493	FileUnusedInformation,
2494	FileNumaNodeInformation,
2495	FileStandardLinkInformation,
2496	FileRemoteProtocolInformation,
2497	/* Defined with Windows 10: */
2498	FileRenameInformationBypassAccessCheck,
2499	FileLinkInformationBypassAccessCheck,
2500	FileVolumeNameInformation,
2501	FileIdInformation,
2502	FileIdExtdDirectoryInformation,
2503	FileReplaceCompletionInformation,
2504	FileHardLinkFullIdInformation,
2505	FileIdExtdBothDirectoryInformation,
2506	FileDispositionInformationEx,
2507	FileRenameInformationEx,
2508	FileRenameInformationExBypassAccessCheck,
2509	FileDesiredStorageClassInformation,
2510	FileStatInformation,
2511	FileMemoryPartitionInformation,
2512	FileStatLxInformation,
2513	FileCaseSensitiveInformation,
2514	FileLinkInformationEx,
2515	FileLinkInformationExBypassAccessCheck,
2516	FileStorageReserveIdInformation,
2517	FileCaseSensitiveInformationForceAccessCheck,
2518	FileMaximumInformation
2519	} FILE_INFORMATION_CLASS;
2520	typedef FILE_INFORMATION_CLASS *PFILE_INFORMATION_CLASS;
2521	RT_DECL_NTAPI(NTSTATUS) NtQueryInformationFile(HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG, FILE_INFORMATION_CLASS);
2522	RT_DECL_NTAPI(NTSTATUS) NtQueryDirectoryFile(HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID, PIO_STATUS_BLOCK, PVOID, ULONG,
2523	FILE_INFORMATION_CLASS, BOOLEAN, PUNICODE_STRING, BOOLEAN);
2524	RT_DECL_NTAPI(NTSTATUS) NtSetInformationFile(HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG, FILE_INFORMATION_CLASS);
2525	#endif /* IPRT_NT_USE_WINTERNL */
2526	RT_DECL_NTAPI(NTSTATUS) NtQueryAttributesFile(POBJECT_ATTRIBUTES, PFILE_BASIC_INFORMATION);
2527	RT_DECL_NTAPI(NTSTATUS) NtQueryFullAttributesFile(POBJECT_ATTRIBUTES, PFILE_NETWORK_OPEN_INFORMATION);
2528
2529
2530	/** @name SE_GROUP_XXX - Attributes returned with TokenGroup and others.
2531	* @{ */
2532	#ifndef SE_GROUP_MANDATORY
2533	# define SE_GROUP_MANDATORY UINT32_C(0x01)
2534	#endif
2535	#ifndef SE_GROUP_ENABLED_BY_DEFAULT
2536	# define SE_GROUP_ENABLED_BY_DEFAULT UINT32_C(0x02)
2537	#endif
2538	#ifndef SE_GROUP_ENABLED
2539	# define SE_GROUP_ENABLED UINT32_C(0x04)
2540	#endif
2541	#ifndef SE_GROUP_OWNER
2542	# define SE_GROUP_OWNER UINT32_C(0x08)
2543	#endif
2544	#ifndef SE_GROUP_USE_FOR_DENY_ONLY
2545	# define SE_GROUP_USE_FOR_DENY_ONLY UINT32_C(0x10)
2546	#endif
2547	#ifndef SE_GROUP_INTEGRITY
2548	# define SE_GROUP_INTEGRITY UINT32_C(0x20)
2549	#endif
2550	#ifndef SE_GROUP_INTEGRITY_ENABLED
2551	# define SE_GROUP_INTEGRITY_ENABLED UINT32_C(0x40)
2552	#endif
2553	#ifndef SE_GROUP_RESOURCE
2554	# define SE_GROUP_RESOURCE UINT32_C(0x20000000)
2555	#endif
2556	#ifndef SE_GROUP_LOGON_ID
2557	# define SE_GROUP_LOGON_ID UINT32_C(0xc0000000)
2558	#endif
2559	/** @} */
2560
2561
2562	#ifdef IPRT_NT_USE_WINTERNL
2563
2564	/** For use with KeyBasicInformation. */
2565	typedef struct _KEY_BASIC_INFORMATION
2566	{
2567	LARGE_INTEGER LastWriteTime;
2568	ULONG TitleIndex;
2569	ULONG NameLength;
2570	WCHAR Name[1];
2571	} KEY_BASIC_INFORMATION;
2572	typedef KEY_BASIC_INFORMATION *PKEY_BASIC_INFORMATION;
2573
2574	/** For use with KeyNodeInformation. */
2575	typedef struct _KEY_NODE_INFORMATION
2576	{
2577	LARGE_INTEGER LastWriteTime;
2578	ULONG TitleIndex;
2579	ULONG ClassOffset; /*< Offset from the start of the structure. /
2580	ULONG ClassLength;
2581	ULONG NameLength;
2582	WCHAR Name[1];
2583	} KEY_NODE_INFORMATION;
2584	typedef KEY_NODE_INFORMATION *PKEY_NODE_INFORMATION;
2585
2586	/** For use with KeyFullInformation. */
2587	typedef struct _KEY_FULL_INFORMATION
2588	{
2589	LARGE_INTEGER LastWriteTime;
2590	ULONG TitleIndex;
2591	ULONG ClassOffset; /*< Offset of the Class member. /
2592	ULONG ClassLength;
2593	ULONG SubKeys;
2594	ULONG MaxNameLen;
2595	ULONG MaxClassLen;
2596	ULONG Values;
2597	ULONG MaxValueNameLen;
2598	ULONG MaxValueDataLen;
2599	WCHAR Class[1];
2600	} KEY_FULL_INFORMATION;
2601	typedef KEY_FULL_INFORMATION *PKEY_FULL_INFORMATION;
2602
2603	/** For use with KeyNameInformation. */
2604	typedef struct _KEY_NAME_INFORMATION
2605	{
2606	ULONG NameLength;
2607	WCHAR Name[1];
2608	} KEY_NAME_INFORMATION;
2609	typedef KEY_NAME_INFORMATION *PKEY_NAME_INFORMATION;
2610
2611	/** For use with KeyCachedInformation. */
2612	typedef struct _KEY_CACHED_INFORMATION
2613	{
2614	LARGE_INTEGER LastWriteTime;
2615	ULONG TitleIndex;
2616	ULONG SubKeys;
2617	ULONG MaxNameLen;
2618	ULONG Values;
2619	ULONG MaxValueNameLen;
2620	ULONG MaxValueDataLen;
2621	ULONG NameLength;
2622	} KEY_CACHED_INFORMATION;
2623	typedef KEY_CACHED_INFORMATION *PKEY_CACHED_INFORMATION;
2624
2625	/** For use with KeyVirtualizationInformation. */
2626	typedef struct _KEY_VIRTUALIZATION_INFORMATION
2627	{
2628	ULONG VirtualizationCandidate : 1;
2629	ULONG VirtualizationEnabled : 1;
2630	ULONG VirtualTarget : 1;
2631	ULONG VirtualStore : 1;
2632	ULONG VirtualSource : 1;
2633	ULONG Reserved : 27;
2634	} KEY_VIRTUALIZATION_INFORMATION;
2635	typedef KEY_VIRTUALIZATION_INFORMATION *PKEY_VIRTUALIZATION_INFORMATION;
2636
2637	typedef enum _KEY_INFORMATION_CLASS
2638	{
2639	KeyBasicInformation = 0,
2640	KeyNodeInformation,
2641	KeyFullInformation,
2642	KeyNameInformation,
2643	KeyCachedInformation,
2644	KeyFlagsInformation,
2645	KeyVirtualizationInformation,
2646	KeyHandleTagsInformation,
2647	MaxKeyInfoClass
2648	} KEY_INFORMATION_CLASS;
2649	RT_DECL_NTAPI(NTSTATUS) NtQueryKey(HANDLE, KEY_INFORMATION_CLASS, PVOID, ULONG, PULONG);
2650	RT_DECL_NTAPI(NTSTATUS) NtEnumerateKey(HANDLE, ULONG, KEY_INFORMATION_CLASS, PVOID, ULONG, PULONG);
2651
2652	typedef struct _MEMORY_SECTION_NAME
2653	{
2654	UNICODE_STRING SectionFileName;
2655	WCHAR NameBuffer[1];
2656	} MEMORY_SECTION_NAME;
2657
2658	#ifdef IPRT_NT_USE_WINTERNL
2659	typedef struct _PROCESS_BASIC_INFORMATION
2660	{
2661	NTSTATUS ExitStatus;
2662	PPEB PebBaseAddress;
2663	ULONG_PTR AffinityMask;
2664	int32_t BasePriority;
2665	ULONG_PTR UniqueProcessId;
2666	ULONG_PTR InheritedFromUniqueProcessId;
2667	} PROCESS_BASIC_INFORMATION;
2668	typedef PROCESS_BASIC_INFORMATION *PPROCESS_BASIC_INFORMATION;
2669	#endif
2670
2671	typedef enum _PROCESSINFOCLASS
2672	{
2673	ProcessBasicInformation = 0, /*< 0 / 0x00 /
2674	ProcessQuotaLimits, /*< 1 / 0x01 /
2675	ProcessIoCounters, /*< 2 / 0x02 /
2676	ProcessVmCounters, /*< 3 / 0x03 /
2677	ProcessTimes, /*< 4 / 0x04 /
2678	ProcessBasePriority, /*< 5 / 0x05 /
2679	ProcessRaisePriority, /*< 6 / 0x06 /
2680	ProcessDebugPort, /*< 7 / 0x07 /
2681	ProcessExceptionPort, /*< 8 / 0x08 /
2682	ProcessAccessToken, /*< 9 / 0x09 /
2683	ProcessLdtInformation, /*< 10 / 0x0a /
2684	ProcessLdtSize, /*< 11 / 0x0b /
2685	ProcessDefaultHardErrorMode, /*< 12 / 0x0c /
2686	ProcessIoPortHandlers, /*< 13 / 0x0d /
2687	ProcessPooledUsageAndLimits, /*< 14 / 0x0e /
2688	ProcessWorkingSetWatch, /*< 15 / 0x0f /
2689	ProcessUserModeIOPL, /*< 16 / 0x10 /
2690	ProcessEnableAlignmentFaultFixup, /*< 17 / 0x11 /
2691	ProcessPriorityClass, /*< 18 / 0x12 /
2692	ProcessWx86Information, /*< 19 / 0x13 /
2693	ProcessHandleCount, /*< 20 / 0x14 /
2694	ProcessAffinityMask, /*< 21 / 0x15 /
2695	ProcessPriorityBoost, /*< 22 / 0x16 /
2696	ProcessDeviceMap, /*< 23 / 0x17 /
2697	ProcessSessionInformation, /*< 24 / 0x18 /
2698	ProcessForegroundInformation, /*< 25 / 0x19 /
2699	ProcessWow64Information, /*< 26 / 0x1a /
2700	ProcessImageFileName, /*< 27 / 0x1b /
2701	ProcessLUIDDeviceMapsEnabled, /*< 28 / 0x1c /
2702	ProcessBreakOnTermination, /*< 29 / 0x1d /
2703	ProcessDebugObjectHandle, /*< 30 / 0x1e /
2704	ProcessDebugFlags, /*< 31 / 0x1f /
2705	ProcessHandleTracing, /*< 32 / 0x20 /
2706	ProcessIoPriority, /*< 33 / 0x21 /
2707	ProcessExecuteFlags, /*< 34 / 0x22 /
2708	ProcessTlsInformation, /*< 35 / 0x23 /
2709	ProcessCookie, /*< 36 / 0x24 /
2710	ProcessImageInformation, /*< 37 / 0x25 /
2711	ProcessCycleTime, /*< 38 / 0x26 /
2712	ProcessPagePriority, /*< 39 / 0x27 /
2713	ProcessInstrumentationCallbak, /*< 40 / 0x28 /
2714	ProcessThreadStackAllocation, /*< 41 / 0x29 /
2715	ProcessWorkingSetWatchEx, /*< 42 / 0x2a /
2716	ProcessImageFileNameWin32, /*< 43 / 0x2b /
2717	ProcessImageFileMapping, /*< 44 / 0x2c /
2718	ProcessAffinityUpdateMode, /*< 45 / 0x2d /
2719	ProcessMemoryAllocationMode, /*< 46 / 0x2e /
2720	ProcessGroupInformation, /*< 47 / 0x2f /
2721	ProcessTokenVirtualizationEnabled, /*< 48 / 0x30 /
2722	ProcessOwnerInformation, /*< 49 / 0x31 /
2723	ProcessWindowInformation, /*< 50 / 0x32 /
2724	ProcessHandleInformation, /*< 51 / 0x33 /
2725	ProcessMitigationPolicy, /*< 52 / 0x34 /
2726	ProcessDynamicFunctionTableInformation, /*< 53 / 0x35 /
2727	ProcessHandleCheckingMode, /*< 54 / 0x36 /
2728	ProcessKeepAliveCount, /*< 55 / 0x37 /
2729	ProcessRevokeFileHandles, /*< 56 / 0x38 /
2730	ProcessWorkingSetControl, /*< 57 / 0x39 /
2731	ProcessHandleTable, /*< 58 / 0x3a /
2732	ProcessCheckStackExtentsMode, /*< 59 / 0x3b /
2733	ProcessCommandLineInformation, /*< 60 / 0x3c /
2734	ProcessProtectionInformation, /*< 61 / 0x3d /
2735	ProcessMemoryExhaustion, /*< 62 / 0x3e /
2736	ProcessFaultInformation, /*< 63 / 0x3f /
2737	ProcessTelemetryIdInformation, /*< 64 / 0x40 /
2738	ProcessCommitReleaseInformation, /*< 65 / 0x41 /
2739	ProcessDefaultCpuSetsInformation, /*< 66 / 0x42 - aka ProcessReserved1Information /
2740	ProcessAllowedCpuSetsInformation, /*< 67 / 0x43 - aka ProcessReserved2Information; PROCESS_SET_LIMITED_INFORMATION & audiog.exe; W10 /
2741	ProcessSubsystemProcess, /*< 68 / 0x44 /
2742	ProcessJobMemoryInformation, /*< 69 / 0x45 /
2743	ProcessInPrivate, /*< 70 / 0x46 /
2744	ProcessRaiseUMExceptionOnInvalidHandleClose,/*< 71 / 0x47 /
2745	ProcessIumChallengeResponse, /*< 72 / 0x48 /
2746	ProcessChildProcessInformation, /*< 73 / 0x49 /
2747	ProcessHighGraphicsPriorityInformation, /*< 74 / 0x4a /
2748	ProcessSubsystemInformation, /*< 75 / 0x4b /
2749	ProcessEnergyValues, /*< 76 / 0x4c /
2750	ProcessPowerThrottlingState, /*< 77 / 0x4d /
2751	ProcessReserved3Information, /*< 78 / 0x4e /
2752	ProcessWin32kSyscallFilterInformation, /*< 79 / 0x4f /
2753	ProcessDisableSystemAllowedCpuSets, /*< 80 / 0x50 /
2754	ProcessWakeInformation, /*< 81 / 0x51 /
2755	ProcessEnergyTrackingState, /*< 82 / 0x52 /
2756	ProcessManageWritesToExecutableMemory, /*< 83 / 0x53 /
2757	ProcessCaptureTrustletLiveDump, /*< 84 / 0x54 /
2758	ProcessTelemetryCoverage, /*< 85 / 0x55 /
2759	ProcessEnclaveInformation, /*< 86 / 0x56 /
2760	ProcessEnableReadWriteVmLogging, /*< 87 / 0x57 /
2761	ProcessUptimeInformation, /*< 88 / 0x58 /
2762	ProcessImageSection, /*< 89 / 0x59 /
2763	ProcessDebugAuthInformation, /*< 90 / 0x5a /
2764	ProcessSystemResourceManagement, /*< 92 / 0x5b /
2765	ProcessSequenceNumber, /*< 93 / 0x5c /
2766	MaxProcessInfoClass
2767	} PROCESSINFOCLASS;
2768	AssertCompile(ProcessSequenceNumber == 0x5c);
2769	#endif
2770	#if defined(IPRT_NT_USE_WINTERNL) \|\| defined(WDK_NTDDI_VERSION) /* Present in ntddk.h from 7600.16385.1, but not in W10. */
2771	RT_DECL_NTAPI(NTSTATUS) NtQueryInformationProcess(HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG);
2772	#endif
2773	#ifdef IPRT_NT_USE_WINTERNL
2774	#if ARCH_BITS == 32
2775	/** 64-bit API pass thru to WOW64 processes. */
2776	RT_DECL_NTAPI(NTSTATUS) NtWow64QueryInformationProcess64(HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG);
2777	#endif
2778
2779	typedef enum _THREADINFOCLASS
2780	{
2781	ThreadBasicInformation = 0,
2782	ThreadTimes,
2783	ThreadPriority,
2784	ThreadBasePriority,
2785	ThreadAffinityMask,
2786	ThreadImpersonationToken,
2787	ThreadDescriptorTableEntry,
2788	ThreadEnableAlignmentFaultFixup,
2789	ThreadEventPair_Reusable,
2790	ThreadQuerySetWin32StartAddress,
2791	ThreadZeroTlsCell,
2792	ThreadPerformanceCount,
2793	ThreadAmILastThread,
2794	ThreadIdealProcessor,
2795	ThreadPriorityBoost,
2796	ThreadSetTlsArrayAddress,
2797	ThreadIsIoPending,
2798	ThreadHideFromDebugger,
2799	ThreadBreakOnTermination,
2800	ThreadSwitchLegacyState,
2801	ThreadIsTerminated,
2802	ThreadLastSystemCall,
2803	ThreadIoPriority,
2804	ThreadCycleTime,
2805	ThreadPagePriority,
2806	ThreadActualBasePriority,
2807	ThreadTebInformation,
2808	ThreadCSwitchMon,
2809	ThreadCSwitchPmu,
2810	ThreadWow64Context,
2811	ThreadGroupInformation,
2812	ThreadUmsInformation,
2813	ThreadCounterProfiling,
2814	ThreadIdealProcessorEx,
2815	ThreadCpuAccountingInformation,
2816	MaxThreadInfoClass
2817	} THREADINFOCLASS;
2818	RT_DECL_NTAPI(NTSTATUS) NtSetInformationThread(HANDLE, THREADINFOCLASS, LPCVOID, ULONG);
2819
2820	RT_DECL_NTAPI(NTSTATUS) NtQueryInformationToken(HANDLE, TOKEN_INFORMATION_CLASS, PVOID, ULONG, PULONG);
2821	RT_DECL_NTAPI(NTSTATUS) ZwQueryInformationToken(HANDLE, TOKEN_INFORMATION_CLASS, PVOID, ULONG, PULONG);
2822
2823	RT_DECL_NTAPI(NTSTATUS) NtReadFile(HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID, PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER, PULONG);
2824	RT_DECL_NTAPI(NTSTATUS) NtWriteFile(HANDLE, HANDLE, PIO_APC_ROUTINE, void const *, PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER, PULONG);
2825	RT_DECL_NTAPI(NTSTATUS) NtFlushBuffersFile(HANDLE, PIO_STATUS_BLOCK);
2826	RT_DECL_NTAPI(NTSTATUS) NtCancelIoFile(HANDLE, PIO_STATUS_BLOCK);
2827
2828	RT_DECL_NTAPI(NTSTATUS) NtReadVirtualMemory(HANDLE, PVOID, PVOID, SIZE_T, PSIZE_T);
2829	RT_DECL_NTAPI(NTSTATUS) NtWriteVirtualMemory(HANDLE, PVOID, void const *, SIZE_T, PSIZE_T);
2830
2831	RT_DECL_NTAPI(NTSTATUS) RtlAddAccessAllowedAce(PACL, ULONG, ULONG, PSID);
2832	RT_DECL_NTAPI(NTSTATUS) RtlCopySid(ULONG, PSID, PSID);
2833	RT_DECL_NTAPI(NTSTATUS) RtlCreateAcl(PACL, ULONG, ULONG);
2834	RT_DECL_NTAPI(NTSTATUS) RtlCreateSecurityDescriptor(PSECURITY_DESCRIPTOR, ULONG);
2835	RT_DECL_NTAPI(BOOLEAN) RtlEqualSid(PSID, PSID);
2836	RT_DECL_NTAPI(NTSTATUS) RtlGetVersion(PRTL_OSVERSIONINFOW);
2837	RT_DECL_NTAPI(NTSTATUS) RtlInitializeSid(PSID, PSID_IDENTIFIER_AUTHORITY, UCHAR);
2838	RT_DECL_NTAPI(NTSTATUS) RtlSetDaclSecurityDescriptor(PSECURITY_DESCRIPTOR, BOOLEAN, PACL, BOOLEAN);
2839	RT_DECL_NTAPI(PULONG) RtlSubAuthoritySid(PSID, ULONG);
2840
2841	#endif /* IPRT_NT_USE_WINTERNL */
2842
2843	#ifdef RTNT_NEED_NT_GET_PRODUCT_TYPE
2844	RT_DECL_NTAPI(BOOLEAN) RtlGetNtProductType(enum _NT_PRODUCT_TYPE ); /< @since NT 3.1 /
2845	#endif
2846
2847	/** For use with ObjectBasicInformation.
2848	* A watered down version of this struct appears under the name
2849	* PUBLIC_OBJECT_BASIC_INFORMATION in ntifs.h. It only defines
2850	* the first four members, so don't trust the rest. */
2851	typedef struct _OBJECT_BASIC_INFORMATION
2852	{
2853	ULONG Attributes;
2854	ACCESS_MASK GrantedAccess;
2855	ULONG HandleCount;
2856	ULONG PointerCount;
2857	/* Not in ntifs.h: */
2858	ULONG PagedPoolCharge;
2859	ULONG NonPagedPoolCharge;
2860	ULONG Reserved[3];
2861	ULONG NameInfoSize;
2862	ULONG TypeInfoSize;
2863	ULONG SecurityDescriptorSize;
2864	LARGE_INTEGER CreationTime;
2865	} OBJECT_BASIC_INFORMATION;
2866	typedef OBJECT_BASIC_INFORMATION *POBJECT_BASIC_INFORMATION;
2867
2868	/** For use with ObjectHandleFlagInformation. */
2869	typedef struct _OBJECT_HANDLE_FLAG_INFORMATION
2870	{
2871	BOOLEAN Inherit;
2872	BOOLEAN ProtectFromClose;
2873	} OBJECT_HANDLE_FLAG_INFORMATION;
2874	typedef OBJECT_HANDLE_FLAG_INFORMATION *POBJECT_HANDLE_FLAG_INFORMATION;
2875
2876	/**
2877	* Returned via ObjectTypesInformation, see also OBJECT_TYPES_INFORMATION.
2878	* The next structure address is calculate:
2879	* (uintptr_t)Name.Buffer + RT_ALIGN_32(Name.MaximumLength, sizeof(uintptr_t))
2880	*/
2881	typedef struct _OBJECT_TYPE_INFORMATION
2882	{ /* 64-bit offset */
2883	UNICODE_STRING TypeName; /*< 0x00 /
2884	ULONG TotalNumberOfObjects; /*< 0x10 /
2885	ULONG TotalNumberOfHandles; /*< 0x14 /
2886	ULONG TotalPagedPoolUsage; /*< 0x18 - not set by W10 19044 /
2887	ULONG TotalNonPagedPoolUsage; /*< 0x1c - not set by W10 19044 /
2888	ULONG TotalNamePoolUsage; /*< 0x20 - not set by W10 19044 /
2889	ULONG TotalHandleTableUsage; /*< 0x24 - not set by W10 19044 /
2890	ULONG HighWaterNumberOfObjects; /*< 0x28 /
2891	ULONG HighWaterNumberOfHandles; /*< 0x2c /
2892	ULONG HighWaterPagedPoolUsage; /*< 0x30 - not set by W10 19044 /
2893	ULONG HighWaterNonPagedPoolUsage; /*< 0x34 - not set by W10 19044 /
2894	ULONG HighWaterNamePoolUsage; /*< 0x38 - not set by W10 19044 /
2895	ULONG HighWaterHandleTableUsage; /*< 0x3c - not set by W10 19044 /
2896	ULONG InvalidAttributes; /*< 0x40 /
2897	GENERIC_MAPPING GenericMapping; /*< 0x44 /
2898	ULONG ValidAccessMask; /*< 0x54 /
2899	BOOLEAN SecurityRequired; /*< 0x58 /
2900	BOOLEAN MaintainHandleCount; /*< 0x59 /
2901	UCHAR TypeIndex; /*< 0x5a /
2902	UCHAR ReservedZero; /*< 0x5b /
2903	ULONG PoolType; /*< 0x5c /
2904	ULONG DefaultPagedPoolCharge; /*< 0x60 - not set by W10 19044 /
2905	ULONG DefaultNonPagedPoolCharge; /*< 0x64 - not set by W10 19044 /
2906	/* The name string follows after the structure. */
2907	} OBJECT_TYPE_INFORMATION;
2908	AssertCompileSize(OBJECT_TYPE_INFORMATION, sizeof(UNICODE_STRING) + 0x58);
2909	typedef OBJECT_TYPE_INFORMATION *POBJECT_TYPE_INFORMATION;
2910
2911	/** Returned via ObjectTypesInformation. */
2912	typedef struct _OBJECT_TYPES_INFORMATION
2913	{
2914	ULONG NumberOfTypes;
2915	OBJECT_TYPE_INFORMATION FirstType;
2916	} OBJECT_TYPES_INFORMATION;
2917	typedef OBJECT_TYPES_INFORMATION *POBJECT_TYPES_INFORMATION;
2918
2919	typedef enum _OBJECT_INFORMATION_CLASS
2920	{
2921	ObjectBasicInformation = 0,
2922	ObjectNameInformation,
2923	ObjectTypeInformation,
2924	ObjectTypesInformation,
2925	ObjectHandleFlagInformation,
2926	ObjectSessionInformation,
2927	MaxObjectInfoClass
2928	} OBJECT_INFORMATION_CLASS;
2929	typedef OBJECT_INFORMATION_CLASS *POBJECT_INFORMATION_CLASS;
2930	#ifdef IN_RING0
2931	# define NtQueryObject ZwQueryObject
2932	#endif
2933	RT_DECL_NTAPI(NTSTATUS) NtQueryObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
2934	RT_DECL_NTAPI(NTSTATUS) NtSetInformationObject(HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG);
2935	RT_DECL_NTAPI(NTSTATUS) NtDuplicateObject(HANDLE, HANDLE, HANDLE, PHANDLE, ACCESS_MASK, ULONG, ULONG);
2936
2937	RT_DECL_NTAPI(NTSTATUS) NtOpenDirectoryObject(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
2938
2939	typedef struct _OBJECT_DIRECTORY_INFORMATION
2940	{
2941	UNICODE_STRING Name;
2942	UNICODE_STRING TypeName;
2943	} OBJECT_DIRECTORY_INFORMATION;
2944	typedef OBJECT_DIRECTORY_INFORMATION *POBJECT_DIRECTORY_INFORMATION;
2945	RT_DECL_NTAPI(NTSTATUS) NtQueryDirectoryObject(HANDLE, PVOID, ULONG, BOOLEAN, BOOLEAN, PULONG, PULONG);
2946
2947	RT_DECL_NTAPI(NTSTATUS) NtSuspendProcess(HANDLE);
2948	RT_DECL_NTAPI(NTSTATUS) NtResumeProcess(HANDLE);
2949	/** @name ProcessDefaultHardErrorMode bit definitions.
2950	* @{ */
2951	#define PROCESS_HARDERR_CRITICAL_ERROR UINT32_C(0x00000001) /*< Inverted from the win32 define. /
2952	#define PROCESS_HARDERR_NO_GP_FAULT_ERROR UINT32_C(0x00000002)
2953	#define PROCESS_HARDERR_NO_ALIGNMENT_FAULT_ERROR UINT32_C(0x00000004)
2954	#define PROCESS_HARDERR_NO_OPEN_FILE_ERROR UINT32_C(0x00008000)
2955	/** @} */
2956	RT_DECL_NTAPI(NTSTATUS) NtSetInformationProcess(HANDLE, PROCESSINFOCLASS, PVOID, ULONG);
2957	RT_DECL_NTAPI(NTSTATUS) NtTerminateProcess(HANDLE, LONG);
2958
2959	/** Returned by NtQUerySection with SectionBasicInformation. */
2960	typedef struct _SECTION_BASIC_INFORMATION
2961	{
2962	PVOID BaseAddress;
2963	ULONG AllocationAttributes;
2964	LARGE_INTEGER MaximumSize;
2965	} SECTION_BASIC_INFORMATION;
2966	typedef SECTION_BASIC_INFORMATION *PSECTION_BASIC_INFORMATION;
2967
2968	/** Retured by ProcessImageInformation as well as NtQuerySection. */
2969	typedef struct _SECTION_IMAGE_INFORMATION
2970	{
2971	PVOID TransferAddress;
2972	ULONG ZeroBits;
2973	SIZE_T MaximumStackSize;
2974	SIZE_T CommittedStackSize;
2975	ULONG SubSystemType;
2976	union
2977	{
2978	struct
2979	{
2980	USHORT SubSystemMinorVersion;
2981	USHORT SubSystemMajorVersion;
2982	};
2983	ULONG SubSystemVersion;
2984	};
2985	ULONG GpValue;
2986	USHORT ImageCharacteristics;
2987	USHORT DllCharacteristics;
2988	USHORT Machine;
2989	BOOLEAN ImageContainsCode;
2990	union /*< Since Vista, used to be a spare BOOLEAN. /
2991	{
2992	struct
2993	{
2994	UCHAR ComPlusNativeRead : 1;
2995	UCHAR ComPlusILOnly : 1;
2996	UCHAR ImageDynamicallyRelocated : 1;
2997	UCHAR ImageMAppedFlat : 1;
2998	UCHAR Reserved : 4;
2999	};
3000	UCHAR ImageFlags;
3001	};
3002	ULONG LoaderFlags;
3003	ULONG ImageFileSize; /*< Since XP? /
3004	ULONG CheckSum; /*< Since Vista, Used to be a reserved/spare ULONG. /
3005	} SECTION_IMAGE_INFORMATION;
3006	typedef SECTION_IMAGE_INFORMATION *PSECTION_IMAGE_INFORMATION;
3007
3008	typedef enum _SECTION_INFORMATION_CLASS
3009	{
3010	SectionBasicInformation = 0,
3011	SectionImageInformation,
3012	MaxSectionInfoClass
3013	} SECTION_INFORMATION_CLASS;
3014	RT_DECL_NTAPI(NTSTATUS) NtQuerySection(HANDLE, SECTION_INFORMATION_CLASS, PVOID, SIZE_T, PSIZE_T);
3015
3016	RT_DECL_NTAPI(NTSTATUS) NtCreateSymbolicLinkObject(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PUNICODE_STRING pTarget);
3017	RT_DECL_NTAPI(NTSTATUS) NtOpenSymbolicLinkObject(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
3018	RT_DECL_NTAPI(NTSTATUS) NtQuerySymbolicLinkObject(HANDLE, PUNICODE_STRING, PULONG);
3019	#ifndef SYMBOLIC_LINK_QUERY
3020	# define SYMBOLIC_LINK_QUERY UINT32_C(0x00000001)
3021	#endif
3022	#ifndef SYMBOLIC_LINK_ALL_ACCESS
3023	# define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED \| SYMBOLIC_LINK_QUERY)
3024	#endif
3025
3026	RT_DECL_NTAPI(NTSTATUS) NtQueryInformationThread(HANDLE, THREADINFOCLASS, PVOID, ULONG, PULONG);
3027	RT_DECL_NTAPI(NTSTATUS) NtResumeThread(HANDLE, PULONG);
3028	RT_DECL_NTAPI(NTSTATUS) NtSuspendThread(HANDLE, PULONG);
3029	RT_DECL_NTAPI(NTSTATUS) NtTerminateThread(HANDLE, LONG);
3030	RT_DECL_NTAPI(NTSTATUS) NtGetContextThread(HANDLE, PCONTEXT);
3031	RT_DECL_NTAPI(NTSTATUS) NtSetContextThread(HANDLE, PCONTEXT);
3032	RT_DECL_NTAPI(NTSTATUS) ZwYieldExecution(void);
3033
3034
3035	#ifndef SEC_FILE
3036	# define SEC_FILE UINT32_C(0x00800000)
3037	#endif
3038	#ifndef SEC_IMAGE
3039	# define SEC_IMAGE UINT32_C(0x01000000)
3040	#endif
3041	#ifndef SEC_PROTECTED_IMAGE
3042	# define SEC_PROTECTED_IMAGE UINT32_C(0x02000000)
3043	#endif
3044	#ifndef SEC_NOCACHE
3045	# define SEC_NOCACHE UINT32_C(0x10000000)
3046	#endif
3047	#ifndef MEM_ROTATE
3048	# define MEM_ROTATE UINT32_C(0x00800000)
3049	#endif
3050	typedef enum _MEMORY_INFORMATION_CLASS
3051	{
3052	MemoryBasicInformation = 0,
3053	MemoryWorkingSetList,
3054	MemorySectionName,
3055	MemoryBasicVlmInformation
3056	} MEMORY_INFORMATION_CLASS;
3057	#ifndef IPRT_NT_USE_WINTERNL
3058	# ifndef WDK_NTDDI_VERSION /* W10 ntifs.h has it, 7600.16385.1 didn't. */
3059	typedef struct _MEMORY_BASIC_INFORMATION
3060	{
3061	PVOID BaseAddress;
3062	PVOID AllocationBase;
3063	ULONG AllocationProtect;
3064	# if ARCH_BITS == 64
3065	USHORT PartitionId;
3066	# endif
3067	SIZE_T RegionSize;
3068	ULONG State;
3069	ULONG Protect;
3070	ULONG Type;
3071	} MEMORY_BASIC_INFORMATION;
3072	typedef MEMORY_BASIC_INFORMATION *PMEMORY_BASIC_INFORMATION;
3073	# endif
3074	# define NtQueryVirtualMemory ZwQueryVirtualMemory
3075	#endif
3076	#if defined(IPRT_NT_USE_WINTERNL) \|\| !defined(WDK_NTDDI_VERSION) /* W10 ntifs.h has it, 7600.16385.1 didn't. */
3077	RT_DECL_NTAPI(NTSTATUS) NtQueryVirtualMemory(HANDLE, void const *, MEMORY_INFORMATION_CLASS, PVOID, SIZE_T, PSIZE_T);
3078	#endif
3079	#ifdef IPRT_NT_USE_WINTERNL
3080	RT_DECL_NTAPI(NTSTATUS) NtAllocateVirtualMemory(HANDLE, PVOID *, ULONG, PSIZE_T, ULONG, ULONG);
3081	RT_DECL_NTAPI(NTSTATUS) NtFreeVirtualMemory(HANDLE, PVOID *, PSIZE_T, ULONG);
3082	#endif
3083	RT_DECL_NTAPI(NTSTATUS) NtProtectVirtualMemory(HANDLE, PVOID *, PSIZE_T, ULONG, PULONG);
3084
3085	typedef enum _SYSTEM_INFORMATION_CLASS
3086	{
3087	SystemBasicInformation = 0,
3088	SystemCpuInformation,
3089	SystemPerformanceInformation,
3090	SystemTimeOfDayInformation,
3091	SystemInformation_Unknown_4,
3092	SystemProcessInformation,
3093	SystemInformation_Unknown_6,
3094	SystemInformation_Unknown_7,
3095	SystemProcessorPerformanceInformation,
3096	SystemInformation_Unknown_9,
3097	SystemInformation_Unknown_10,
3098	SystemModuleInformation,
3099	SystemInformation_Unknown_12,
3100	SystemInformation_Unknown_13,
3101	SystemInformation_Unknown_14,
3102	SystemInformation_Unknown_15,
3103	SystemHandleInformation,
3104	SystemInformation_Unknown_17,
3105	SystemPageFileInformation,
3106	SystemInformation_Unknown_19,
3107	SystemInformation_Unknown_20,
3108	SystemCacheInformation,
3109	SystemInformation_Unknown_22,
3110	SystemInterruptInformation,
3111	SystemDpcBehaviourInformation,
3112	SystemFullMemoryInformation,
3113	SystemLoadGdiDriverInformation, /* 26 */
3114	SystemUnloadGdiDriverInformation, /* 27 */
3115	SystemTimeAdjustmentInformation,
3116	SystemSummaryMemoryInformation,
3117	SystemInformation_Unknown_30,
3118	SystemInformation_Unknown_31,
3119	SystemInformation_Unknown_32,
3120	SystemExceptionInformation,
3121	SystemCrashDumpStateInformation,
3122	SystemKernelDebuggerInformation,
3123	SystemContextSwitchInformation,
3124	SystemRegistryQuotaInformation,
3125	SystemInformation_Unknown_38,
3126	SystemInformation_Unknown_39,
3127	SystemInformation_Unknown_40,
3128	SystemInformation_Unknown_41,
3129	SystemInformation_Unknown_42,
3130	SystemInformation_Unknown_43,
3131	SystemCurrentTimeZoneInformation,
3132	SystemLookasideInformation,
3133	SystemSetTimeSlipEvent,
3134	SystemCreateSession,
3135	SystemDeleteSession,
3136	SystemInformation_Unknown_49,
3137	SystemRangeStartInformation,
3138	SystemVerifierInformation,
3139	SystemInformation_Unknown_52,
3140	SystemSessionProcessInformation,
3141	SystemLoadGdiDriverInSystemSpaceInformation, /* 54 */
3142	SystemInformation_Unknown_55,
3143	SystemInformation_Unknown_56,
3144	SystemExtendedProcessInformation,
3145	SystemInformation_Unknown_58,
3146	SystemInformation_Unknown_59,
3147	SystemInformation_Unknown_60,
3148	SystemInformation_Unknown_61,
3149	SystemInformation_Unknown_62,
3150	SystemInformation_Unknown_63,
3151	SystemExtendedHandleInformation, /* 64 */
3152	SystemInformation_Unknown_65,
3153	SystemInformation_Unknown_66,
3154	SystemInformation_Unknown_67, /*< See https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/codeintegrity.htm /
3155	SystemInformation_Unknown_68,
3156	SystemInformation_HotPatchInfo, /* 69 */
3157	SystemInformation_Unknown_70,
3158	SystemInformation_Unknown_71,
3159	SystemInformation_Unknown_72,
3160	SystemInformation_Unknown_73,
3161	SystemInformation_Unknown_74,
3162	SystemInformation_Unknown_75,
3163	SystemInformation_Unknown_76,
3164	SystemInformation_Unknown_77,
3165	SystemInformation_Unknown_78,
3166	SystemInformation_Unknown_79,
3167	SystemInformation_Unknown_80,
3168	SystemInformation_Unknown_81,
3169	SystemInformation_Unknown_82,
3170	SystemInformation_Unknown_83,
3171	SystemInformation_Unknown_84,
3172	SystemInformation_Unknown_85,
3173	SystemInformation_Unknown_86,
3174	SystemInformation_Unknown_87,
3175	SystemInformation_Unknown_88,
3176	SystemInformation_Unknown_89,
3177	SystemInformation_Unknown_90,
3178	SystemInformation_Unknown_91,
3179	SystemInformation_Unknown_92,
3180	SystemInformation_Unknown_93,
3181	SystemInformation_Unknown_94,
3182	SystemInformation_Unknown_95,
3183	SystemInformation_KiOpPrefetchPatchCount, /* 96 */
3184	SystemInformation_Unknown_97,
3185	SystemInformation_Unknown_98,
3186	SystemInformation_Unknown_99,
3187	SystemInformation_Unknown_100,
3188	SystemInformation_Unknown_101,
3189	SystemInformation_Unknown_102,
3190	SystemInformation_Unknown_103,
3191	SystemInformation_Unknown_104,
3192	SystemInformation_Unknown_105,
3193	SystemInformation_Unknown_107,
3194	SystemInformation_GetLogicalProcessorInformationEx, /* 107 */
3195
3196	/** @todo fill gap. they've added a whole bunch of things */
3197	SystemPolicyInformation = 134,
3198	SystemInformationClassMax
3199	} SYSTEM_INFORMATION_CLASS;
3200
3201	#ifdef IPRT_NT_USE_WINTERNL
3202	typedef struct _VM_COUNTERS
3203	{
3204	SIZE_T PeakVirtualSize;
3205	SIZE_T VirtualSize;
3206	ULONG PageFaultCount;
3207	SIZE_T PeakWorkingSetSize;
3208	SIZE_T WorkingSetSize;
3209	SIZE_T QuotaPeakPagedPoolUsage;
3210	SIZE_T QuotaPagedPoolUsage;
3211	SIZE_T QuotaPeakNonPagedPoolUsage;
3212	SIZE_T QuotaNonPagedPoolUsage;
3213	SIZE_T PagefileUsage;
3214	SIZE_T PeakPagefileUsage;
3215	} VM_COUNTERS;
3216	typedef VM_COUNTERS *PVM_COUNTERS;
3217	#endif
3218
3219	#if 0
3220	typedef struct _IO_COUNTERS
3221	{
3222	ULONGLONG ReadOperationCount;
3223	ULONGLONG WriteOperationCount;
3224	ULONGLONG OtherOperationCount;
3225	ULONGLONG ReadTransferCount;
3226	ULONGLONG WriteTransferCount;
3227	ULONGLONG OtherTransferCount;
3228	} IO_COUNTERS;
3229	typedef IO_COUNTERS *PIO_COUNTERS;
3230	#endif
3231
3232	typedef struct _RTNT_SYSTEM_PROCESS_INFORMATION
3233	{
3234	ULONG NextEntryOffset; /*< 0x00 / 0x00 /
3235	ULONG NumberOfThreads; /*< 0x04 / 0x04 /
3236	LARGE_INTEGER Reserved1[3]; /*< 0x08 / 0x08 /
3237	LARGE_INTEGER CreationTime; /*< 0x20 / 0x20 /
3238	LARGE_INTEGER UserTime; /*< 0x28 / 0x28 /
3239	LARGE_INTEGER KernelTime; /*< 0x30 / 0x30 /
3240	UNICODE_STRING ProcessName; /*< 0x38 / 0x38 Clean unicode encoding? /
3241	int32_t BasePriority; /*< 0x40 / 0x48 /
3242	HANDLE UniqueProcessId; /*< 0x44 / 0x50 /
3243	HANDLE ParentProcessId; /*< 0x48 / 0x58 /
3244	ULONG HandleCount; /*< 0x4c / 0x60 /
3245	ULONG Reserved2; /*< 0x50 / 0x64 Session ID? /
3246	ULONG_PTR Reserved3; /*< 0x54 / 0x68 /
3247	VM_COUNTERS VmCounters; /*< 0x58 / 0x70 /
3248	IO_COUNTERS IoCounters; /*< 0x88 / 0xd0 Might not be present in earlier windows versions. /
3249	/* After this follows the threads, then the ProcessName.Buffer. */
3250	} RTNT_SYSTEM_PROCESS_INFORMATION;
3251	typedef RTNT_SYSTEM_PROCESS_INFORMATION *PRTNT_SYSTEM_PROCESS_INFORMATION;
3252	#ifndef IPRT_NT_USE_WINTERNL
3253	typedef RTNT_SYSTEM_PROCESS_INFORMATION SYSTEM_PROCESS_INFORMATION;
3254	typedef SYSTEM_PROCESS_INFORMATION *PSYSTEM_PROCESS_INFORMATION;
3255	#endif
3256
3257	typedef struct _SYSTEM_HANDLE_ENTRY_INFO
3258	{
3259	USHORT UniqueProcessId;
3260	USHORT CreatorBackTraceIndex;
3261	UCHAR ObjectTypeIndex;
3262	UCHAR HandleAttributes;
3263	USHORT HandleValue;
3264	PVOID Object;
3265	ULONG GrantedAccess;
3266	} SYSTEM_HANDLE_ENTRY_INFO;
3267	typedef SYSTEM_HANDLE_ENTRY_INFO *PSYSTEM_HANDLE_ENTRY_INFO;
3268
3269	/** Returned by SystemHandleInformation */
3270	typedef struct _SYSTEM_HANDLE_INFORMATION
3271	{
3272	ULONG NumberOfHandles;
3273	SYSTEM_HANDLE_ENTRY_INFO Handles[1];
3274	} SYSTEM_HANDLE_INFORMATION;
3275	typedef SYSTEM_HANDLE_INFORMATION *PSYSTEM_HANDLE_INFORMATION;
3276
3277	/** Extended handle information entry.
3278	* @remarks 3 x PVOID + 4 x ULONG = 28 bytes on 32-bit / 40 bytes on 64-bit */
3279	typedef struct _SYSTEM_HANDLE_ENTRY_INFO_EX
3280	{
3281	PVOID Object;
3282	HANDLE UniqueProcessId;
3283	HANDLE HandleValue;
3284	ACCESS_MASK GrantedAccess;
3285	USHORT CreatorBackTraceIndex;
3286	USHORT ObjectTypeIndex;
3287	ULONG HandleAttributes;
3288	ULONG Reserved;
3289	} SYSTEM_HANDLE_ENTRY_INFO_EX;
3290	typedef SYSTEM_HANDLE_ENTRY_INFO_EX *PSYSTEM_HANDLE_ENTRY_INFO_EX;
3291
3292	/** Returned by SystemExtendedHandleInformation. */
3293	typedef struct _SYSTEM_HANDLE_INFORMATION_EX
3294	{
3295	ULONG_PTR NumberOfHandles;
3296	ULONG_PTR Reserved;
3297	SYSTEM_HANDLE_ENTRY_INFO_EX Handles[1];
3298	} SYSTEM_HANDLE_INFORMATION_EX;
3299	typedef SYSTEM_HANDLE_INFORMATION_EX *PSYSTEM_HANDLE_INFORMATION_EX;
3300
3301	/** Returned by SystemSessionProcessInformation. */
3302	typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
3303	{
3304	ULONG SessionId;
3305	ULONG BufferLength;
3306	/** Return buffer, SYSTEM_PROCESS_INFORMATION entries. */
3307	PVOID Buffer;
3308	} SYSTEM_SESSION_PROCESS_INFORMATION;
3309	typedef SYSTEM_SESSION_PROCESS_INFORMATION *PSYSTEM_SESSION_PROCESS_INFORMATION;
3310
3311	typedef struct _RTL_PROCESS_MODULE_INFORMATION
3312	{
3313	HANDLE Section; /*< 0x00 / 0x00 /
3314	PVOID MappedBase; /*< 0x04 / 0x08 /
3315	PVOID ImageBase; /*< 0x08 / 0x10 /
3316	ULONG ImageSize; /*< 0x0c / 0x18 /
3317	ULONG Flags; /*< 0x10 / 0x1c /
3318	USHORT LoadOrderIndex; /*< 0x14 / 0x20 /
3319	USHORT InitOrderIndex; /*< 0x16 / 0x22 /
3320	USHORT LoadCount; /*< 0x18 / 0x24 /
3321	USHORT OffsetToFileName; /*< 0x1a / 0x26 /
3322	UCHAR FullPathName[256]; /*< 0x1c / 0x28 /
3323	} RTL_PROCESS_MODULE_INFORMATION;
3324	typedef RTL_PROCESS_MODULE_INFORMATION *PRTL_PROCESS_MODULE_INFORMATION;
3325
3326	/** Returned by SystemModuleInformation. */
3327	typedef struct _RTL_PROCESS_MODULES
3328	{
3329	ULONG NumberOfModules;
3330	RTL_PROCESS_MODULE_INFORMATION Modules[1]; /*< 0x04 / 0x08 /
3331	} RTL_PROCESS_MODULES;
3332	typedef RTL_PROCESS_MODULES *PRTL_PROCESS_MODULES;
3333
3334	RT_DECL_NTAPI(NTSTATUS) NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS, PVOID, ULONG, PULONG);
3335	#ifndef IPRT_NT_MAP_TO_ZW
3336	RT_DECL_NTAPI(NTSTATUS) ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS, PVOID, ULONG, PULONG);
3337	#endif
3338
3339	RT_DECL_NTAPI(NTSTATUS) NtSetTimerResolution(ULONG cNtTicksWanted, BOOLEAN fSetResolution, PULONG pcNtTicksCur);
3340	RT_DECL_NTAPI(NTSTATUS) NtQueryTimerResolution(PULONG pcNtTicksMin, PULONG pcNtTicksMax, PULONG pcNtTicksCur);
3341
3342	RT_DECL_NTAPI(NTSTATUS) NtDelayExecution(BOOLEAN, PLARGE_INTEGER);
3343	RT_DECL_NTAPI(NTSTATUS) NtYieldExecution(void);
3344	#ifndef IPRT_NT_USE_WINTERNL
3345	RT_DECL_NTAPI(NTSTATUS) NtWaitForSingleObject(HANDLE, BOOLEAN, PLARGE_INTEGER);
3346	#endif
3347	typedef NTSYSAPI NTSTATUS (NTAPI *PFNNTWAITFORSINGLEOBJECT)(HANDLE, BOOLEAN, PLARGE_INTEGER);
3348	typedef enum _OBJECT_WAIT_TYPE { WaitAllObjects = 0, WaitAnyObject = 1, ObjectWaitTypeHack = 0x7fffffff } OBJECT_WAIT_TYPE;
3349	RT_DECL_NTAPI(NTSTATUS) NtWaitForMultipleObjects(ULONG, PHANDLE, OBJECT_WAIT_TYPE, BOOLEAN, PLARGE_INTEGER);
3350
3351	#ifdef IPRT_NT_USE_WINTERNL
3352	RT_DECL_NTAPI(NTSTATUS) NtQuerySecurityObject(HANDLE, ULONG, PSECURITY_DESCRIPTOR, ULONG, PULONG);
3353	#endif
3354
3355	#ifdef IPRT_NT_USE_WINTERNL
3356	typedef enum _EVENT_TYPE
3357	{
3358	/* Manual reset event. */
3359	NotificationEvent = 0,
3360	/* Automaitc reset event. */
3361	SynchronizationEvent
3362	} EVENT_TYPE;
3363	#endif
3364	RT_DECL_NTAPI(NTSTATUS) NtCreateEvent(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, EVENT_TYPE, BOOLEAN);
3365	RT_DECL_NTAPI(NTSTATUS) NtOpenEvent(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
3366	typedef NTSYSAPI NTSTATUS (NTAPI *PFNNTCLEAREVENT)(HANDLE);
3367	RT_DECL_NTAPI(NTSTATUS) NtClearEvent(HANDLE);
3368	RT_DECL_NTAPI(NTSTATUS) NtResetEvent(HANDLE, PULONG);
3369	RT_DECL_NTAPI(NTSTATUS) NtSetEvent(HANDLE, PULONG);
3370	typedef NTSYSAPI NTSTATUS (NTAPI *PFNNTSETEVENT)(HANDLE, PULONG);
3371	typedef enum _EVENT_INFORMATION_CLASS
3372	{
3373	EventBasicInformation = 0
3374	} EVENT_INFORMATION_CLASS;
3375	/** Data returned by NtQueryEvent + EventBasicInformation. */
3376	typedef struct EVENT_BASIC_INFORMATION
3377	{
3378	EVENT_TYPE EventType;
3379	ULONG EventState;
3380	} EVENT_BASIC_INFORMATION;
3381	typedef EVENT_BASIC_INFORMATION *PEVENT_BASIC_INFORMATION;
3382	RT_DECL_NTAPI(NTSTATUS) NtQueryEvent(HANDLE, EVENT_INFORMATION_CLASS, PVOID, ULONG, PULONG);
3383
3384	#ifdef IPRT_NT_USE_WINTERNL
3385	/** For NtQueryValueKey. */
3386	typedef enum _KEY_VALUE_INFORMATION_CLASS
3387	{
3388	KeyValueBasicInformation = 0,
3389	KeyValueFullInformation,
3390	KeyValuePartialInformation,
3391	KeyValueFullInformationAlign64,
3392	KeyValuePartialInformationAlign64
3393	} KEY_VALUE_INFORMATION_CLASS;
3394
3395	/** KeyValuePartialInformation and KeyValuePartialInformationAlign64 struct. */
3396	typedef struct _KEY_VALUE_PARTIAL_INFORMATION
3397	{
3398	ULONG TitleIndex;
3399	ULONG Type;
3400	ULONG DataLength;
3401	UCHAR Data[1];
3402	} KEY_VALUE_PARTIAL_INFORMATION;
3403	typedef KEY_VALUE_PARTIAL_INFORMATION *PKEY_VALUE_PARTIAL_INFORMATION;
3404	#endif
3405	RT_DECL_NTAPI(NTSTATUS) NtOpenKey(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
3406	RT_DECL_NTAPI(NTSTATUS) NtQueryValueKey(HANDLE, PUNICODE_STRING, KEY_VALUE_INFORMATION_CLASS, PVOID, ULONG, PULONG);
3407
3408
3409	RT_DECL_NTAPI(NTSTATUS) RtlAddAccessDeniedAce(PACL, ULONG, ULONG, PSID);
3410
3411
3412	typedef struct _CURDIR
3413	{
3414	UNICODE_STRING DosPath;
3415	HANDLE Handle; /*< 0x10 / 0x08 /
3416	} CURDIR;
3417	AssertCompileSize(CURDIR, ARCH_BITS == 32 ? 0x0c : 0x18);
3418	typedef CURDIR *PCURDIR;
3419
3420	typedef struct _RTL_DRIVE_LETTER_CURDIR
3421	{
3422	USHORT Flags;
3423	USHORT Length;
3424	ULONG TimeStamp;
3425	STRING DosPath; /*< Yeah, it's STRING according to dt ntdll!_RTL_DRIVE_LETTER_CURDIR. /
3426	} RTL_DRIVE_LETTER_CURDIR;
3427	typedef RTL_DRIVE_LETTER_CURDIR *PRTL_DRIVE_LETTER_CURDIR;
3428
3429	typedef struct _RTL_USER_PROCESS_PARAMETERS
3430	{
3431	ULONG MaximumLength; /*< 0x000 / 0x000 /
3432	ULONG Length; /*< 0x004 / 0x004 /
3433	ULONG Flags; /*< 0x008 / 0x008 /
3434	ULONG DebugFlags; /*< 0x00c / 0x00c /
3435	HANDLE ConsoleHandle; /*< 0x010 / 0x010 /
3436	ULONG ConsoleFlags; /*< 0x018 / 0x014 /
3437	HANDLE StandardInput; /*< 0x020 / 0x018 /
3438	HANDLE StandardOutput; /*< 0x028 / 0x01c /
3439	HANDLE StandardError; /*< 0x030 / 0x020 /
3440	CURDIR CurrentDirectory; /*< 0x038 / 0x024 /
3441	UNICODE_STRING DllPath; /*< 0x050 / 0x030 /
3442	UNICODE_STRING ImagePathName; /*< 0x060 / 0x038 /
3443	UNICODE_STRING CommandLine; /*< 0x070 / 0x040 /
3444	PWSTR Environment; /*< 0x080 / 0x048 /
3445	ULONG StartingX; /*< 0x088 / 0x04c /
3446	ULONG StartingY; /*< 0x090 / 0x050 /
3447	ULONG CountX; /*< 0x094 / 0x054 /
3448	ULONG CountY; /*< 0x098 / 0x058 /
3449	ULONG CountCharsX; /*< 0x09c / 0x05c /
3450	ULONG CountCharsY; /*< 0x0a0 / 0x060 /
3451	ULONG FillAttribute; /*< 0x0a4 / 0x064 /
3452	ULONG WindowFlags; /*< 0x0a8 / 0x068 /
3453	ULONG ShowWindowFlags; /*< 0x0ac / 0x06c /
3454	UNICODE_STRING WindowTitle; /*< 0x0b0 / 0x070 /
3455	UNICODE_STRING DesktopInfo; /*< 0x0c0 / 0x078 /
3456	UNICODE_STRING ShellInfo; /*< 0x0d0 / 0x080 /
3457	UNICODE_STRING RuntimeInfo; /*< 0x0e0 / 0x088 /
3458	RTL_DRIVE_LETTER_CURDIR CurrentDirectories[0x20]; /*< 0x0f0 / 0x090 /
3459	SIZE_T EnvironmentSize; /*< 0x3f0 / 0x - Added in Vista /
3460	SIZE_T EnvironmentVersion; /*< 0x3f8 / 0x - Added in Windows 7. /
3461	PVOID PackageDependencyData; /*< 0x400 / 0x - Added Windows 8? /
3462	ULONG ProcessGroupId; /*< 0x408 / 0x - Added Windows 8? /
3463	ULONG LoaderThreads; /*< 0x40c / 0x - Added Windows 10? /
3464	} RTL_USER_PROCESS_PARAMETERS;
3465	typedef RTL_USER_PROCESS_PARAMETERS *PRTL_USER_PROCESS_PARAMETERS;
3466	#define RTL_USER_PROCESS_PARAMS_FLAG_NORMALIZED 1
3467
3468	typedef struct _RTL_USER_PROCESS_INFORMATION
3469	{
3470	ULONG Size;
3471	HANDLE ProcessHandle;
3472	HANDLE ThreadHandle;
3473	CLIENT_ID ClientId;
3474	SECTION_IMAGE_INFORMATION ImageInformation;
3475	} RTL_USER_PROCESS_INFORMATION;
3476	typedef RTL_USER_PROCESS_INFORMATION *PRTL_USER_PROCESS_INFORMATION;
3477
3478
3479	RT_DECL_NTAPI(NTSTATUS) RtlCreateUserProcess(PUNICODE_STRING, ULONG, PRTL_USER_PROCESS_PARAMETERS, PSECURITY_DESCRIPTOR,
3480	PSECURITY_DESCRIPTOR, HANDLE, BOOLEAN, HANDLE, HANDLE, PRTL_USER_PROCESS_INFORMATION);
3481	RT_DECL_NTAPI(NTSTATUS) RtlCreateProcessParameters(PRTL_USER_PROCESS_PARAMETERS *, PUNICODE_STRING ImagePathName,
3482	PUNICODE_STRING DllPath, PUNICODE_STRING CurrentDirectory,
3483	PUNICODE_STRING CommandLine, PUNICODE_STRING Environment,
3484	PUNICODE_STRING WindowTitle, PUNICODE_STRING DesktopInfo,
3485	PUNICODE_STRING ShellInfo, PUNICODE_STRING RuntimeInfo);
3486	RT_DECL_NTAPI(VOID) RtlDestroyProcessParameters(PRTL_USER_PROCESS_PARAMETERS);
3487	RT_DECL_NTAPI(NTSTATUS) RtlCreateUserThread(HANDLE, PSECURITY_DESCRIPTOR, BOOLEAN, ULONG, SIZE_T, SIZE_T,
3488	PFNRT, PVOID, PHANDLE, PCLIENT_ID);
3489
3490	#ifndef RTL_CRITICAL_SECTION_FLAG_NO_DEBUG_INFO
3491	typedef struct _RTL_CRITICAL_SECTION
3492	{
3493	struct _RTL_CRITICAL_SECTION_DEBUG *DebugInfo;
3494	LONG LockCount;
3495	LONG Recursioncount;
3496	HANDLE OwningThread;
3497	HANDLE LockSemaphore;
3498	ULONG_PTR SpinCount;
3499	} RTL_CRITICAL_SECTION;
3500	typedef RTL_CRITICAL_SECTION *PRTL_CRITICAL_SECTION;
3501	#endif
3502
3503	/RT_DECL_NTAPI(ULONG) RtlNtStatusToDosError(NTSTATUS rcNt);/
3504
3505	/** @def RTL_QUERY_REGISTRY_TYPECHECK
3506	* WDK 8.1+, backported in updates, ignored in older. */
3507	#if !defined(RTL_QUERY_REGISTRY_TYPECHECK) \|\| defined(DOXYGEN_RUNNING)
3508	# define RTL_QUERY_REGISTRY_TYPECHECK UINT32_C(0x00000100)
3509	#endif
3510	/** @def RTL_QUERY_REGISTRY_TYPECHECK_SHIFT
3511	* WDK 8.1+, backported in updates, ignored in older. */
3512	#if !defined(RTL_QUERY_REGISTRY_TYPECHECK_SHIFT) \|\| defined(DOXYGEN_RUNNING)
3513	# define RTL_QUERY_REGISTRY_TYPECHECK_SHIFT 24
3514	#endif
3515
3516	RT_DECL_NTAPI(VOID) RtlFreeUnicodeString(PUNICODE_STRING);
3517
3518	RT_C_DECLS_END
3519	/** @} */
3520
3521
3522	#if defined(IN_RING0) \|\| defined(DOXYGEN_RUNNING)
3523	/** @name NT Kernel APIs
3524	* @{ */
3525	RT_C_DECLS_BEGIN
3526
3527	typedef ULONG KEPROCESSORINDEX; /*< Bitmap indexes != process numbers, apparently. /
3528
3529	RT_DECL_NTAPI(VOID) KeInitializeAffinityEx(PKAFFINITY_EX pAffinity);
3530	typedef VOID (NTAPI *PFNKEINITIALIZEAFFINITYEX)(PKAFFINITY_EX pAffinity);
3531	RT_DECL_NTAPI(VOID) KeAddProcessorAffinityEx(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
3532	typedef VOID (NTAPI *PFNKEADDPROCESSORAFFINITYEX)(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
3533	RT_DECL_NTAPI(VOID) KeRemoveProcessorAffinityEx(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
3534	typedef VOID (NTAPI *PFNKEREMOVEPROCESSORAFFINITYEX)(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
3535	RT_DECL_NTAPI(BOOLEAN) KeInterlockedSetProcessorAffinityEx(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
3536	typedef BOOLEAN (NTAPI *PFNKEINTERLOCKEDSETPROCESSORAFFINITYEX)(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
3537	RT_DECL_NTAPI(BOOLEAN) KeInterlockedClearProcessorAffinityEx(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
3538	typedef BOOLEAN (NTAPI *PFNKEINTERLOCKEDCLEARPROCESSORAFFINITYEX)(PKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
3539	RT_DECL_NTAPI(BOOLEAN) KeCheckProcessorAffinityEx(PCKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
3540	typedef BOOLEAN (NTAPI *PFNKECHECKPROCESSORAFFINITYEX)(PCKAFFINITY_EX pAffinity, KEPROCESSORINDEX idxProcessor);
3541	RT_DECL_NTAPI(VOID) KeCopyAffinityEx(PKAFFINITY_EX pDst, PCKAFFINITY_EX pSrc);
3542	typedef VOID (NTAPI *PFNKECOPYAFFINITYEX)(PKAFFINITY_EX pDst, PCKAFFINITY_EX pSrc);
3543	RT_DECL_NTAPI(VOID) KeComplementAffinityEx(PKAFFINITY_EX pResult, PCKAFFINITY_EX pIn);
3544	typedef VOID (NTAPI *PFNKECOMPLEMENTAFFINITYEX)(PKAFFINITY_EX pResult, PCKAFFINITY_EX pIn);
3545	RT_DECL_NTAPI(BOOLEAN) KeAndAffinityEx(PCKAFFINITY_EX pIn1, PCKAFFINITY_EX pIn2, PKAFFINITY_EX pResult OPTIONAL);
3546	typedef BOOLEAN (NTAPI *PFNKEANDAFFINITYEX)(PCKAFFINITY_EX pIn1, PCKAFFINITY_EX pIn2, PKAFFINITY_EX pResult OPTIONAL);
3547	RT_DECL_NTAPI(BOOLEAN) KeOrAffinityEx(PCKAFFINITY_EX pIn1, PCKAFFINITY_EX pIn2, PKAFFINITY_EX pResult OPTIONAL);
3548	typedef BOOLEAN (NTAPI *PFNKEORAFFINITYEX)(PCKAFFINITY_EX pIn1, PCKAFFINITY_EX pIn2, PKAFFINITY_EX pResult OPTIONAL);
3549	/** Works like anding the complemented subtrahend with the minuend. */
3550	RT_DECL_NTAPI(BOOLEAN) KeSubtractAffinityEx(PCKAFFINITY_EX pMinuend, PCKAFFINITY_EX pSubtrahend, PKAFFINITY_EX pResult OPTIONAL);
3551	typedef BOOLEAN (NTAPI *PFNKESUBTRACTAFFINITYEX)(PCKAFFINITY_EX pMinuend, PCKAFFINITY_EX pSubtrahend, PKAFFINITY_EX pResult OPTIONAL);
3552	RT_DECL_NTAPI(BOOLEAN) KeIsEqualAffinityEx(PCKAFFINITY_EX pLeft, PCKAFFINITY_EX pRight);
3553	typedef BOOLEAN (NTAPI *PFNKEISEQUALAFFINITYEX)(PCKAFFINITY_EX pLeft, PCKAFFINITY_EX pRight);
3554	RT_DECL_NTAPI(BOOLEAN) KeIsEmptyAffinityEx(PCKAFFINITY_EX pAffinity);
3555	typedef BOOLEAN (NTAPI *PFNKEISEMPTYAFFINITYEX)(PCKAFFINITY_EX pAffinity);
3556	RT_DECL_NTAPI(BOOLEAN) KeIsSubsetAffinityEx(PCKAFFINITY_EX pSubset, PCKAFFINITY_EX pSuperSet);
3557	typedef BOOLEAN (NTAPI *PFNKEISSUBSETAFFINITYEX)(PCKAFFINITY_EX pSubset, PCKAFFINITY_EX pSuperSet);
3558	RT_DECL_NTAPI(ULONG) KeCountSetBitsAffinityEx(PCKAFFINITY_EX pAffinity);
3559	typedef ULONG (NTAPI *PFNKECOUNTSETAFFINITYEX)(PCKAFFINITY_EX pAffinity);
3560	RT_DECL_NTAPI(KEPROCESSORINDEX) KeFindFirstSetLeftAffinityEx(PCKAFFINITY_EX pAffinity);
3561	typedef KEPROCESSORINDEX (NTAPI *PFNKEFINDFIRSTSETLEFTAFFINITYEX)(PCKAFFINITY_EX pAffinity);
3562	typedef NTSTATUS (NTAPI *PFNKEGETPROCESSORNUMBERFROMINDEX)(KEPROCESSORINDEX idxProcessor, PPROCESSOR_NUMBER pProcNumber);
3563	typedef KEPROCESSORINDEX (NTAPI PFNKEGETPROCESSORINDEXFROMNUMBER)(const PROCESSOR_NUMBER pProcNumber);
3564	typedef NTSTATUS (NTAPI PFNKEGETPROCESSORNUMBERFROMINDEX)(KEPROCESSORINDEX ProcIndex, PROCESSOR_NUMBER pProcNumber);
3565	typedef KEPROCESSORINDEX (NTAPI PFNKEGETCURRENTPROCESSORNUMBEREX)(const PROCESSOR_NUMBER pProcNumber);
3566	typedef KAFFINITY (NTAPI *PFNKEQUERYACTIVEPROCESSORS)(VOID);
3567	typedef ULONG (NTAPI *PFNKEQUERYMAXIMUMPROCESSORCOUNT)(VOID);
3568	typedef ULONG (NTAPI *PFNKEQUERYMAXIMUMPROCESSORCOUNTEX)(USHORT GroupNumber);
3569	typedef USHORT (NTAPI *PFNKEQUERYMAXIMUMGROUPCOUNT)(VOID);
3570	typedef ULONG (NTAPI PFNKEQUERYACTIVEPROCESSORCOUNT)(KAFFINITY pfActiveProcessors);
3571	typedef ULONG (NTAPI *PFNKEQUERYACTIVEPROCESSORCOUNTEX)(USHORT GroupNumber);
3572	typedef NTSTATUS (NTAPI PFNKEQUERYLOGICALPROCESSORRELATIONSHIP)(PROCESSOR_NUMBER pProcNumber,
3573	LOGICAL_PROCESSOR_RELATIONSHIP RelationShipType,
3574	SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX *pInfo, PULONG pcbInfo);
3575	typedef PVOID (NTAPI PFNKEREGISTERPROCESSORCHANGECALLBACK)(PPROCESSOR_CALLBACK_FUNCTION pfnCallback, void pvUser, ULONG fFlags);
3576	typedef VOID (NTAPI *PFNKEDEREGISTERPROCESSORCHANGECALLBACK)(PVOID pvCallback);
3577	typedef NTSTATUS (NTAPI PFNKESETTARGETPROCESSORDPCEX)(KDPC pDpc, PROCESSOR_NUMBER *pProcNumber);
3578	typedef LOGICAL (NTAPI *PFNKESHOULDYIELDPROCESSOR)(void);
3579
3580	RT_DECL_NTAPI(BOOLEAN) ObFindHandleForObject(PEPROCESS pProcess, PVOID pvObject, POBJECT_TYPE pObjectType,
3581	PVOID pvOptionalConditions, PHANDLE phFound);
3582	RT_DECL_NTAPI(NTSTATUS) ObReferenceObjectByName(PUNICODE_STRING pObjectPath, ULONG fAttributes, PACCESS_STATE pAccessState,
3583	ACCESS_MASK fDesiredAccess, POBJECT_TYPE pObjectType,
3584	KPROCESSOR_MODE enmAccessMode, PVOID pvParseContext, PVOID *ppvObject);
3585	RT_DECL_NTAPI(HANDLE) PsGetProcessInheritedFromUniqueProcessId(PEPROCESS);
3586	RT_DECL_NTAPI(UCHAR *) PsGetProcessImageFileName(PEPROCESS);
3587	RT_DECL_NTAPI(BOOLEAN) PsIsProcessBeingDebugged(PEPROCESS);
3588	RT_DECL_NTAPI(ULONG) PsGetProcessSessionId(PEPROCESS);
3589	extern DECLIMPORT(POBJECT_TYPE ) LpcPortObjectType; /< In vista+ this is the ALPC port object type. /
3590	extern DECLIMPORT(POBJECT_TYPE ) LpcWaitablePortObjectType; /< In vista+ this is the ALPC port object type. /
3591
3592	typedef VOID (NTAPI *PFNHALREQUESTIPI_PRE_W7)(KAFFINITY TargetSet);
3593	typedef VOID (NTAPI *PFNHALREQUESTIPI_W7PLUS)(ULONG uUsuallyZero, PCKAFFINITY_EX pTargetSet);
3594
3595	RT_C_DECLS_END
3596	/** @ */
3597	#endif /* IN_RING0 */
3598
3599
3600	#if defined(IN_RING3) \|\| defined(DOXYGEN_RUNNING)
3601	/** @name NT Userland APIs
3602	* @{ */
3603	RT_C_DECLS_BEGIN
3604
3605	#if 0 /** @todo figure this out some time... */
3606	typedef struct CSR_MSG_DATA_CREATED_PROCESS
3607	{
3608	HANDLE hProcess;
3609	HANDLE hThread;
3610	CLIENT_ID
3611	DWORD idProcess;
3612	DWORD idThread;
3613	DWORD fCreate;
3614
3615	} CSR_MSG_DATA_CREATED_PROCESS;
3616
3617	#define CSR_MSG_NO_CREATED_PROCESS UINT32_C(0x10000)
3618	#define CSR_MSG_NO_CREATED_THREAD UINT32_C(0x10001)
3619	RT_DECL_NTAPI(NTSTATUS) CsrClientCallServer(PVOID, PVOID, ULONG, SIZE_T);
3620	#endif
3621
3622	RT_DECL_NTAPI(VOID) LdrInitializeThunk(PVOID, PVOID, PVOID);
3623
3624	typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA
3625	{
3626	ULONG Flags;
3627	PCUNICODE_STRING FullDllName;
3628	PCUNICODE_STRING BaseDllName;
3629	PVOID DllBase;
3630	ULONG SizeOfImage;
3631	} LDR_DLL_LOADED_NOTIFICATION_DATA, LDR_DLL_UNLOADED_NOTIFICATION_DATA;
3632	typedef LDR_DLL_LOADED_NOTIFICATION_DATA PLDR_DLL_LOADED_NOTIFICATION_DATA, PLDR_DLL_UNLOADED_NOTIFICATION_DATA;
3633	typedef LDR_DLL_LOADED_NOTIFICATION_DATA const PCLDR_DLL_LOADED_NOTIFICATION_DATA, PCLDR_DLL_UNLOADED_NOTIFICATION_DATA;
3634
3635	typedef union _LDR_DLL_NOTIFICATION_DATA
3636	{
3637	LDR_DLL_LOADED_NOTIFICATION_DATA Loaded;
3638	LDR_DLL_UNLOADED_NOTIFICATION_DATA Unloaded;
3639	} LDR_DLL_NOTIFICATION_DATA;
3640	typedef LDR_DLL_NOTIFICATION_DATA *PLDR_DLL_NOTIFICATION_DATA;
3641	typedef LDR_DLL_NOTIFICATION_DATA const *PCLDR_DLL_NOTIFICATION_DATA;
3642
3643	typedef VOID (NTAPI *PLDR_DLL_NOTIFICATION_FUNCTION)(ULONG ulReason, PCLDR_DLL_NOTIFICATION_DATA pData, PVOID pvUser);
3644
3645	#define LDR_DLL_NOTIFICATION_REASON_LOADED UINT32_C(1)
3646	#define LDR_DLL_NOTIFICATION_REASON_UNLOADED UINT32_C(2)
3647	RT_DECL_NTAPI(NTSTATUS) LdrRegisterDllNotification(ULONG fFlags, PLDR_DLL_NOTIFICATION_FUNCTION pfnCallback, PVOID pvUser,
3648	PVOID *pvCookie);
3649	typedef NTSTATUS (NTAPI PFNLDRREGISTERDLLNOTIFICATION)(ULONG, PLDR_DLL_NOTIFICATION_FUNCTION, PVOID, PVOID );
3650	RT_DECL_NTAPI(NTSTATUS) LdrUnregisterDllNotification(PVOID pvCookie);
3651	typedef NTSTATUS (NTAPI *PFNLDRUNREGISTERDLLNOTIFICATION)(PVOID);
3652
3653	RT_DECL_NTAPI(NTSTATUS) LdrLoadDll(IN PWSTR pwszSearchPathOrFlags OPTIONAL, IN PULONG pfFlags OPTIONAL,
3654	IN PCUNICODE_STRING pName, OUT PHANDLE phMod);
3655	typedef NTSTATUS (NTAPI *PFNLDRLOADDLL)(IN PWSTR pwszSearchPathOrFlags OPTIONAL, IN PULONG pfFlags OPTIONAL,
3656	IN PCUNICODE_STRING pName, OUT PHANDLE phMod);
3657	RT_DECL_NTAPI(NTSTATUS) LdrUnloadDll(IN HANDLE hMod);
3658	typedef NTSTATUS (NTAPI *PFNLDRUNLOADDLL)(IN HANDLE hMod);
3659	RT_DECL_NTAPI(NTSTATUS) LdrGetDllHandle(IN PCWSTR pwszDllPath OPTIONAL, IN PULONG pfFlags OPTIONAL,
3660	IN PCUNICODE_STRING pName, OUT PHANDLE phDll);
3661	typedef NTSTATUS (NTAPI *PFNLDRGETDLLHANDLE)(IN PCWSTR pwszDllPath OPTIONAL, IN PULONG pfFlags OPTIONAL,
3662	IN PCUNICODE_STRING pName, OUT PHANDLE phDll);
3663	#define LDRGETDLLHANDLEEX_F_UNCHANGED_REFCOUNT RT_BIT_32(0)
3664	#define LDRGETDLLHANDLEEX_F_PIN RT_BIT_32(1)
3665	/** @since Windows XP. */
3666	RT_DECL_NTAPI(NTSTATUS) LdrGetDllHandleEx(IN ULONG fFlags, IN PCWSTR pwszDllPath OPTIONAL, IN PULONG pfFlags OPTIONAL,
3667	IN PCUNICODE_STRING pName, OUT PHANDLE phDll);
3668	/** @since Windows XP. */
3669	typedef NTSTATUS (NTAPI *PFNLDRGETDLLHANDLEEX)(IN ULONG fFlags, IN PCWSTR pwszDllPath OPTIONAL, IN PULONG pfFlags OPTIONAL,
3670	IN PCUNICODE_STRING pName, OUT PHANDLE phDll);
3671	/** @since Windows 7. */
3672	RT_DECL_NTAPI(NTSTATUS) LdrGetDllHandleByMapping(IN PVOID pvBase, OUT PHANDLE phDll);
3673	/** @since Windows 7. */
3674	typedef NTSTATUS (NTAPI *PFNLDRGETDLLHANDLEBYMAPPING)(IN PVOID pvBase, OUT PHANDLE phDll);
3675	/** @since Windows 7. */
3676	RT_DECL_NTAPI(NTSTATUS) LdrGetDllHandleByName(IN PCUNICODE_STRING pName OPTIONAL, IN PCUNICODE_STRING pFullName OPTIONAL,
3677	OUT PHANDLE phDll);
3678	/** @since Windows 7. */
3679	typedef NTSTATUS (NTAPI *PFNLDRGETDLLHANDLEBYNAME)(IN PCUNICODE_STRING pName OPTIONAL, IN PCUNICODE_STRING pFullName OPTIONAL,
3680	OUT PHANDLE phDll);
3681	#define LDRADDREFDLL_F_PIN RT_BIT_32(0)
3682	RT_DECL_NTAPI(NTSTATUS) LdrAddRefDll(IN ULONG fFlags, IN HANDLE hDll);
3683	typedef NTSTATUS (NTAPI *PFNLDRADDREFDLL)(IN ULONG fFlags, IN HANDLE hDll);
3684	RT_DECL_NTAPI(NTSTATUS) LdrGetProcedureAddress(IN HANDLE hDll, IN ANSI_STRING const *pSymbol OPTIONAL,
3685	IN ULONG uOrdinal OPTIONAL, OUT PVOID *ppvSymbol);
3686	typedef NTSTATUS (NTAPI *PFNLDRGETPROCEDUREADDRESS)(IN HANDLE hDll, IN PCANSI_STRING pSymbol OPTIONAL,
3687	IN ULONG uOrdinal OPTIONAL, OUT PVOID *ppvSymbol);
3688	#define LDRGETPROCEDUREADDRESSEX_F_DONT_RECORD_FORWARDER RT_BIT_32(0)
3689	/** @since Windows Vista. */
3690	RT_DECL_NTAPI(NTSTATUS) LdrGetProcedureAddressEx(IN HANDLE hDll, IN ANSI_STRING const *pSymbol OPTIONAL,
3691	IN ULONG uOrdinal OPTIONAL, OUT PVOID *ppvSymbol, ULONG fFlags);
3692	/** @since Windows Vista. */
3693	typedef NTSTATUS (NTAPI PFNLDRGETPROCEDUREADDRESSEX)(IN HANDLE hDll, IN ANSI_STRING const pSymbol OPTIONAL,
3694	IN ULONG uOrdinal OPTIONAL, OUT PVOID *ppvSymbol, ULONG fFlags);
3695	#define LDRLOCKLOADERLOCK_F_RAISE_ERRORS RT_BIT_32(0)
3696	#define LDRLOCKLOADERLOCK_F_NO_WAIT RT_BIT_32(1)
3697	#define LDRLOCKLOADERLOCK_DISP_INVALID UINT32_C(0)
3698	#define LDRLOCKLOADERLOCK_DISP_ACQUIRED UINT32_C(1)
3699	#define LDRLOCKLOADERLOCK_DISP_NOT_ACQUIRED UINT32_C(2)
3700	/** @since Windows XP. */
3701	RT_DECL_NTAPI(NTSTATUS) LdrLockLoaderLock(IN ULONG fFlags, OUT PULONG puDisposition OPTIONAL, OUT PVOID *ppvCookie);
3702	/** @since Windows XP. */
3703	typedef NTSTATUS (NTAPI PFNLDRLOCKLOADERLOCK)(IN ULONG fFlags, OUT PULONG puDisposition OPTIONAL, OUT PVOID ppvCookie);
3704	#define LDRUNLOCKLOADERLOCK_F_RAISE_ERRORS RT_BIT_32(0)
3705	/** @since Windows XP. */
3706	RT_DECL_NTAPI(NTSTATUS) LdrUnlockLoaderLock(IN ULONG fFlags, OUT PVOID pvCookie);
3707	/** @since Windows XP. */
3708	typedef NTSTATUS (NTAPI *PFNLDRUNLOCKLOADERLOCK)(IN ULONG fFlags, OUT PVOID pvCookie);
3709
3710	RT_DECL_NTAPI(NTSTATUS) RtlExpandEnvironmentStrings_U(PVOID, PUNICODE_STRING, PUNICODE_STRING, PULONG);
3711	RT_DECL_NTAPI(VOID) RtlExitUserProcess(NTSTATUS rcExitCode); /*< Vista and later. /
3712	RT_DECL_NTAPI(VOID) RtlExitUserThread(NTSTATUS rcExitCode);
3713	RT_DECL_NTAPI(NTSTATUS) RtlDosApplyFileIsolationRedirection_Ustr(IN ULONG fFlags,
3714	IN PCUNICODE_STRING pOrgName,
3715	IN PUNICODE_STRING pDefaultSuffix,
3716	IN OUT PUNICODE_STRING pStaticString,
3717	IN OUT PUNICODE_STRING pDynamicString,
3718	IN OUT PUNICODE_STRING *ppResultString,
3719	IN PULONG pfNewFlags OPTIONAL,
3720	IN PSIZE_T pcbFilename OPTIONAL,
3721	IN PSIZE_T pcbNeeded OPTIONAL);
3722	/** @since Windows 8.
3723	* @note Status code is always zero in windows 10 build 14393. */
3724	RT_DECL_NTAPI(NTSTATUS) ApiSetQueryApiSetPresence(IN PCUNICODE_STRING pAllegedApiSetDll, OUT PBOOLEAN pfPresent);
3725	/** @copydoc ApiSetQueryApiSetPresence */
3726	typedef NTSTATUS (NTAPI *PFNAPISETQUERYAPISETPRESENCE)(IN PCUNICODE_STRING pAllegedApiSetDll, OUT PBOOLEAN pfPresent);
3727
3728
3729	# ifdef IPRT_NT_USE_WINTERNL
3730	typedef NTSTATUS NTAPI RTL_HEAP_COMMIT_ROUTINE(PVOID, PVOID *, PSIZE_T);
3731	typedef RTL_HEAP_COMMIT_ROUTINE *PRTL_HEAP_COMMIT_ROUTINE;
3732	typedef struct _RTL_HEAP_PARAMETERS
3733	{
3734	ULONG Length;
3735	SIZE_T SegmentReserve;
3736	SIZE_T SegmentCommit;
3737	SIZE_T DeCommitFreeBlockThreshold;
3738	SIZE_T DeCommitTotalFreeThreshold;
3739	SIZE_T MaximumAllocationSize;
3740	SIZE_T VirtualMemoryThreshold;
3741	SIZE_T InitialCommit;
3742	SIZE_T InitialReserve;
3743	PRTL_HEAP_COMMIT_ROUTINE CommitRoutine;
3744	SIZE_T Reserved[2];
3745	} RTL_HEAP_PARAMETERS;
3746	typedef RTL_HEAP_PARAMETERS *PRTL_HEAP_PARAMETERS;
3747	RT_DECL_NTAPI(PVOID) RtlCreateHeap(ULONG fFlags, PVOID pvHeapBase, SIZE_T cbReserve, SIZE_T cbCommit, PVOID pvLock,
3748	PRTL_HEAP_PARAMETERS pParameters);
3749	/** @name Heap flags (for RtlCreateHeap).
3750	* @{ */
3751	/*# define HEAP_NO_SERIALIZE UINT32_C(0x00000001)
3752	# define HEAP_GROWABLE UINT32_C(0x00000002)
3753	# define HEAP_GENERATE_EXCEPTIONS UINT32_C(0x00000004)
3754	# define HEAP_ZERO_MEMORY UINT32_C(0x00000008)
3755	# define HEAP_REALLOC_IN_PLACE_ONLY UINT32_C(0x00000010)
3756	# define HEAP_TAIL_CHECKING_ENABLED UINT32_C(0x00000020)
3757	# define HEAP_FREE_CHECKING_ENABLED UINT32_C(0x00000040)
3758	# define HEAP_DISABLE_COALESCE_ON_FREE UINT32_C(0x00000080)*/
3759	# define HEAP_SETTABLE_USER_VALUE UINT32_C(0x00000100)
3760	# define HEAP_SETTABLE_USER_FLAG1 UINT32_C(0x00000200)
3761	# define HEAP_SETTABLE_USER_FLAG2 UINT32_C(0x00000400)
3762	# define HEAP_SETTABLE_USER_FLAG3 UINT32_C(0x00000800)
3763	# define HEAP_SETTABLE_USER_FLAGS UINT32_C(0x00000e00)
3764	# define HEAP_CLASS_0 UINT32_C(0x00000000)
3765	# define HEAP_CLASS_1 UINT32_C(0x00001000)
3766	# define HEAP_CLASS_2 UINT32_C(0x00002000)
3767	# define HEAP_CLASS_3 UINT32_C(0x00003000)
3768	# define HEAP_CLASS_4 UINT32_C(0x00004000)
3769	# define HEAP_CLASS_5 UINT32_C(0x00005000)
3770	# define HEAP_CLASS_6 UINT32_C(0x00006000)
3771	# define HEAP_CLASS_7 UINT32_C(0x00007000)
3772	# define HEAP_CLASS_8 UINT32_C(0x00008000)
3773	# define HEAP_CLASS_MASK UINT32_C(0x0000f000)
3774	# endif
3775	# define HEAP_CLASS_PROCESS HEAP_CLASS_0
3776	# define HEAP_CLASS_PRIVATE HEAP_CLASS_1
3777	# define HEAP_CLASS_KERNEL HEAP_CLASS_2
3778	# define HEAP_CLASS_GDI HEAP_CLASS_3
3779	# define HEAP_CLASS_USER HEAP_CLASS_4
3780	# define HEAP_CLASS_CONSOLE HEAP_CLASS_5
3781	# define HEAP_CLASS_USER_DESKTOP HEAP_CLASS_6
3782	# define HEAP_CLASS_CSRSS_SHARED HEAP_CLASS_7
3783	# define HEAP_CLASS_CSRSS_PORT HEAP_CLASS_8
3784	# ifdef IPRT_NT_USE_WINTERNL
3785	/*# define HEAP_CREATE_ALIGN_16 UINT32_C(0x00010000)
3786	# define HEAP_CREATE_ENABLE_TRACING UINT32_C(0x00020000)
3787	# define HEAP_CREATE_ENABLE_EXECUTE UINT32_C(0x00040000)*/
3788	# define HEAP_CREATE_VALID_MASK UINT32_C(0x0007f0ff)
3789	# endif /* IPRT_NT_USE_WINTERNL */
3790	/** @} */
3791	# ifdef IPRT_NT_USE_WINTERNL
3792	/** @name Heap tagging constants
3793	* @{ */
3794	# define HEAP_GLOBAL_TAG UINT32_C(0x00000800)
3795	/*# define HEAP_MAXIMUM_TAG UINT32_C(0x00000fff)
3796	# define HEAP_PSEUDO_TAG_FLAG UINT32_C(0x00008000)
3797	# define HEAP_TAG_SHIFT 18 */
3798	# define HEAP_TAG_MASK (HEAP_MAXIMUM_TAG << HEAP_TAG_SHIFT)
3799	/** @} */
3800	RT_DECL_NTAPI(PVOID) RtlAllocateHeap(HANDLE hHeap, ULONG fFlags, SIZE_T cb);
3801	RT_DECL_NTAPI(PVOID) RtlReAllocateHeap(HANDLE hHeap, ULONG fFlags, PVOID pvOld, SIZE_T cbNew);
3802	RT_DECL_NTAPI(BOOLEAN) RtlFreeHeap(HANDLE hHeap, ULONG fFlags, PVOID pvMem);
3803	# endif /* IPRT_NT_USE_WINTERNL */
3804	RT_DECL_NTAPI(SIZE_T) RtlCompactHeap(HANDLE hHeap, ULONG fFlags);
3805	RT_DECL_NTAPI(SIZE_T) RtlSizeHeap(HANDLE hHeap, ULONG fFlags, PVOID pvMem);
3806	RT_DECL_NTAPI(NTSTATUS) RtlGetLastNtStatus(VOID);
3807	RT_DECL_NTAPI(ULONG) RtlGetLastWin32Error(VOID);
3808	RT_DECL_NTAPI(VOID) RtlSetLastWin32Error(ULONG uError);
3809	RT_DECL_NTAPI(VOID) RtlSetLastWin32ErrorAndNtStatusFromNtStatus(NTSTATUS rcNt);
3810	RT_DECL_NTAPI(VOID) RtlRestoreLastWin32Error(ULONG uError);
3811	RT_DECL_NTAPI(BOOLEAN) RtlQueryPerformanceCounter(PLARGE_INTEGER);
3812	RT_DECL_NTAPI(uint64_t) RtlGetSystemTimePrecise(VOID);
3813	typedef uint64_t (NTAPI * PFNRTLGETSYSTEMTIMEPRECISE)(VOID);
3814	RT_DECL_NTAPI(uint64_t) RtlGetInterruptTimePrecise(uint64_t *puPerfTime);
3815	typedef uint64_t (NTAPI * PFNRTLGETINTERRUPTTIMEPRECISE)(uint64_t *);
3816	RT_DECL_NTAPI(BOOLEAN) RtlQueryUnbiasedInterruptTime(uint64_t *puInterruptTime);
3817	typedef BOOLEAN (NTAPI * PFNRTLQUERYUNBIASEDINTERRUPTTIME)(uint64_t *);
3818
3819	RT_C_DECLS_END
3820	/** @} */
3821	#endif /* IN_RING3 */
3822
3823	#endif /* !IPRT_INCLUDED_nt_nt_h */
3824

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/include/iprt/nt/nt.h@ 100339

Download in other formats: