winsup/cygwin/ntdll.h

   1 /* ntdll.h.  Contains ntdll specific stuff not defined elsewhere.
   2
   3    Copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008,
   4    2009, 2010, 2011 Red Hat, Inc.
   5
   6    This file is part of Cygwin.
   7
   8    This software is a copyrighted work licensed under the terms of the
   9    Cygwin license.  Please consult the file "CYGWIN_LICENSE" for
  10    details. */
  11
  12 #ifndef _NTDLL_H
  13 #define _NTDLL_H 1
  14 #define STATUS_NOT_ALL_ASSIGNED       ((NTSTATUS) 0x00000106)
  15 #define STATUS_OBJECT_NAME_EXISTS     ((NTSTATUS) 0x40000000)
  16 #define STATUS_BUFFER_OVERFLOW        ((NTSTATUS) 0x80000005)
  17 #define STATUS_NO_MORE_FILES          ((NTSTATUS) 0x80000006)
  18 #ifndef STATUS_INVALID_INFO_CLASS
  19 /* Some w32api header file defines this so we need to conditionalize this
  20    define to avoid warnings. */
  21 #define STATUS_INVALID_INFO_CLASS     ((NTSTATUS) 0xc0000003)
  22 #endif
  23 #define STATUS_NOT_IMPLEMENTED        ((NTSTATUS) 0xc0000002)
  24 #define STATUS_INFO_LENGTH_MISMATCH   ((NTSTATUS) 0xc0000004)
  25 #define STATUS_INVALID_PARAMETER      ((NTSTATUS) 0xc000000d)
  26 #define STATUS_NO_SUCH_FILE           ((NTSTATUS) 0xc000000f)
  27 #define STATUS_INVALID_DEVICE_REQUEST ((NTSTATUS) 0xc0000010)
  28 #define STATUS_END_OF_FILE            ((NTSTATUS) 0xc0000011)
  29 #define STATUS_NO_MEDIA_IN_DEVICE     ((NTSTATUS) 0xc0000013)
  30 #define STATUS_ACCESS_DENIED          ((NTSTATUS) 0xc0000022)
  31 #define STATUS_BUFFER_TOO_SMALL       ((NTSTATUS) 0xc0000023)
  32 #define STATUS_OBJECT_TYPE_MISMATCH   ((NTSTATUS) 0xc0000024)
  33 #define STATUS_OBJECT_NAME_INVALID    ((NTSTATUS) 0xc0000033)
  34 #define STATUS_OBJECT_NAME_NOT_FOUND  ((NTSTATUS) 0xc0000034)
  35 #define STATUS_OBJECT_PATH_NOT_FOUND  ((NTSTATUS) 0xc000003A)
  36 #define STATUS_SHARING_VIOLATION      ((NTSTATUS) 0xc0000043)
  37 #define STATUS_EAS_NOT_SUPPORTED      ((NTSTATUS) 0xc000004f)
  38 #define STATUS_EA_TOO_LARGE           ((NTSTATUS) 0xc0000050)
  39 #define STATUS_NONEXISTENT_EA_ENTRY   ((NTSTATUS) 0xc0000051)
  40 #define STATUS_NO_EAS_ON_FILE         ((NTSTATUS) 0xc0000052)
  41 #define STATUS_LOCK_NOT_GRANTED       ((NTSTATUS) 0xc0000055)
  42 #define STATUS_DELETE_PENDING         ((NTSTATUS) 0xc0000056)
  43 #define STATUS_PROCEDURE_NOT_FOUND    ((NTSTATUS) 0xc000007a)
  44 #define STATUS_DISK_FULL              ((NTSTATUS) 0xc000007f)
  45 #define STATUS_WORKING_SET_QUOTA      ((NTSTATUS) 0xc00000a1)
  46 #define STATUS_INSTANCE_NOT_AVAILABLE ((NTSTATUS) 0xc00000ab)
  47 #define STATUS_PIPE_NOT_AVAILABLE     ((NTSTATUS) 0xc00000ac)
  48 #define STATUS_INVALID_PIPE_STATE     ((NTSTATUS) 0xc00000ad)
  49 #define STATUS_PIPE_BUSY              ((NTSTATUS) 0xc00000ae)
  50 #define STATUS_NOT_SUPPORTED          ((NTSTATUS) 0xc00000bb)
  51 #define STATUS_BAD_NETWORK_PATH       ((NTSTATUS) 0xc00000be)
  52 #define STATUS_INVALID_NETWORK_RESPONSE ((NTSTATUS) 0xc00000c3)
  53 #define STATUS_BAD_NETWORK_NAME       ((NTSTATUS) 0xc00000cc)
  54 #define STATUS_DIRECTORY_NOT_EMPTY    ((NTSTATUS) 0xc0000101)
  55 #define STATUS_CANNOT_DELETE          ((NTSTATUS) 0xc0000121)
  56 #define STATUS_INVALID_LEVEL          ((NTSTATUS) 0xc0000148)
  57 #define STATUS_DLL_NOT_FOUND          ((NTSTATUS) 0xc0000135)
  58 #define STATUS_ENTRYPOINT_NOT_FOUND   ((NTSTATUS) 0xc0000139)
  59 #define STATUS_BAD_DLL_ENTRYPOINT     ((NTSTATUS) 0xc0000251)
  60 #define STATUS_ILLEGAL_DLL_RELOCATION ((NTSTATUS) 0xc0000269)
  61 /* custom status code: */
  62 #define STATUS_ILLEGAL_DLL_PSEUDO_RELOCATION ((NTSTATUS) 0xe0000269)
  63
  64 #define PDI_MODULES 0x01
  65 #define PDI_HEAPS 0x04
  66 #define PDI_HEAP_BLOCKS 0x10
  67 #define LDRP_IMAGE_DLL 0x00000004
  68 #define WSLE_PAGE_READONLY 0x001
  69 #define WSLE_PAGE_EXECUTE 0x002
  70 #define WSLE_PAGE_EXECUTE_READ 0x003
  71 #define WSLE_PAGE_READWRITE 0x004
  72 #define WSLE_PAGE_WRITECOPY 0x005
  73 #define WSLE_PAGE_EXECUTE_READWRITE 0x006
  74 #define WSLE_PAGE_EXECUTE_WRITECOPY 0x007
  75 #define WSLE_PAGE_SHARE_COUNT_MASK 0x0E0
  76 #define WSLE_PAGE_SHAREABLE 0x100
  77
  78 #define FILE_SUPERSEDED     0
  79 #define FILE_OPENED         1
  80 #define FILE_CREATED        2
  81 #define FILE_OVERWRITTEN    3
  82 #define FILE_EXISTS         4
  83 #define FILE_DOES_NOT_EXIST 5
  84
  85 #define FILE_WRITE_TO_END_OF_FILE      (-1LL)
  86 #define FILE_USE_FILE_POINTER_POSITION (-2LL)
  87
  88 /* Device Characteristics. */
  89 #define FILE_REMOVABLE_MEDIA           0x00000001
  90 #define FILE_READ_ONLY_DEVICE          0x00000002
  91 #define FILE_FLOPPY_DISKETTE           0x00000004
  92 #define FILE_WRITE_ONCE_MEDIA          0x00000008
  93 #define FILE_REMOTE_DEVICE             0x00000010
  94 #define FILE_DEVICE_IS_MOUNTED         0x00000020
  95 #define FILE_VIRTUAL_VOLUME            0x00000040
  96 #define FILE_AUTOGENERATED_DEVICE_NAME 0x00000080
  97 #define FILE_DEVICE_SECURE_OPEN        0x00000100
  98
  99 /* Transaction access rights. */
 100 #define TRANSACTION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x3F)
 101
 102 typedef enum _FILE_INFORMATION_CLASS
 103 {
 104   FileDirectoryInformation = 1,
 105   FileFullDirectoryInformation, // 2
 106   FileBothDirectoryInformation, // 3
 107   FileBasicInformation, // 4 wdm
 108   FileStandardInformation, // 5 wdm
 109   FileInternalInformation, // 6
 110   FileEaInformation, // 7
 111   FileAccessInformation, // 8
 112   FileNameInformation, // 9
 113   FileRenameInformation, // 10
 114   FileLinkInformation, // 11
 115   FileNamesInformation, // 12
 116   FileDispositionInformation, // 13
 117   FilePositionInformation, // 14 wdm
 118   FileFullEaInformation, // 15
 119   FileModeInformation, // 16
 120   FileAlignmentInformation, // 17
 121   FileAllInformation, // 18
 122   FileAllocationInformation, // 19
 123   FileEndOfFileInformation, // 20 wdm
 124   FileAlternateNameInformation, // 21
 125   FileStreamInformation, // 22
 126   FilePipeInformation, // 23
 127   FilePipeLocalInformation, // 24
 128   FilePipeRemoteInformation, // 25
 129   FileMailslotQueryInformation, // 26
 130   FileMailslotSetInformation, // 27
 131   FileCompressionInformation, // 28
 132   FileObjectIdInformation, // 29
 133   FileCompletionInformation, // 30
 134   FileMoveClusterInformation, // 31
 135   FileQuotaInformation, // 32
 136   FileReparsePointInformation, // 33
 137   FileNetworkOpenInformation, // 34
 138   FileAttributeTagInformation, // 35
 139   FileTrackingInformation, // 36
 140   FileIdBothDirectoryInformation, // 37
 141   FileIdFullDirectoryInformation, // 38
 142   FileValidDataLengthInformation, // 39
 143   FileShortNameInformation, // 40
 144   FileMaximumInformation
 145 } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
 146
 147 typedef struct _FILE_NAMES_INFORMATION
 148 {
 149   ULONG  NextEntryOffset;
 150   ULONG  FileIndex;
 151   ULONG  FileNameLength;
 152   WCHAR  FileName[1];
 153 } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
 154
 155 typedef struct _FILE_DIRECTORY_INFORMATION {
 156   ULONG  NextEntryOffset;
 157   ULONG  FileIndex;
 158   LARGE_INTEGER  CreationTime;
 159   LARGE_INTEGER  LastAccessTime;
 160   LARGE_INTEGER  LastWriteTime;
 161   LARGE_INTEGER  ChangeTime;
 162   LARGE_INTEGER  EndOfFile;
 163   LARGE_INTEGER  AllocationSize;
 164   ULONG  FileAttributes;
 165   ULONG  FileNameLength;
 166   WCHAR  FileName[1];
 167 } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
 168
 169 typedef struct _FILE_BOTH_DIRECTORY_INFORMATION
 170 {
 171   ULONG  NextEntryOffset;
 172   ULONG  FileIndex;
 173   LARGE_INTEGER  CreationTime;
 174   LARGE_INTEGER  LastAccessTime;
 175   LARGE_INTEGER  LastWriteTime;
 176   LARGE_INTEGER  ChangeTime;
 177   LARGE_INTEGER  EndOfFile;
 178   LARGE_INTEGER  AllocationSize;
 179   ULONG  FileAttributes;
 180   ULONG  FileNameLength;
 181   ULONG  EaSize;
 182   CCHAR  ShortNameLength;
 183   WCHAR  ShortName[12];
 184   WCHAR  FileName[1];
 185 } FILE_BOTH_DIRECTORY_INFORMATION, *PFILE_BOTH_DIRECTORY_INFORMATION;
 186
 187 typedef struct _FILE_ID_BOTH_DIR_INFORMATION
 188 {
 189   ULONG  NextEntryOffset;
 190   ULONG  FileIndex;
 191   LARGE_INTEGER  CreationTime;
 192   LARGE_INTEGER  LastAccessTime;
 193   LARGE_INTEGER  LastWriteTime;
 194   LARGE_INTEGER  ChangeTime;
 195   LARGE_INTEGER  EndOfFile;
 196   LARGE_INTEGER  AllocationSize;
 197   ULONG  FileAttributes;
 198   ULONG  FileNameLength;
 199   ULONG  EaSize;
 200   CCHAR  ShortNameLength;
 201   WCHAR  ShortName[12];
 202   LARGE_INTEGER  FileId;
 203   WCHAR  FileName[1];
 204 } FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;
 205
 206
 207 #define AT_EXTENDABLE_FILE 0x00002000
 208 #define AT_ROUND_TO_PAGE 0x40000000
 209
 210 #define LOCK_VM_IN_WSL 1
 211 #define LOCK_VM_IN_RAM 2
 212
 213 #define DIRECTORY_QUERY 1
 214 #define DIRECTORY_TRAVERSE 2
 215 #define DIRECTORY_CREATE_OBJECT 4
 216 #define DIRECTORY_CREATE_SUBDIRECTORY 8
 217 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|0x0f)
 218
 219 #define SYMBOLIC_LINK_QUERY 1
 220
 221 #define EVENT_QUERY_STATE 1
 222 #define SEMAPHORE_QUERY_STATE 1
 223
 224 /* Specific ACCESS_MASKSs for objects created in Cygwin. */
 225 #define CYG_SHARED_DIR_ACCESS   (DIRECTORY_QUERY \
 226                                  | DIRECTORY_TRAVERSE \
 227                                  | DIRECTORY_CREATE_SUBDIRECTORY \
 228                                  | DIRECTORY_CREATE_OBJECT \
 229                                  | READ_CONTROL)
 230
 231 #define CYG_MUTANT_ACCESS       (MUTANT_QUERY_STATE \
 232                                  | SYNCHRONIZE \
 233                                  | READ_CONTROL)
 234
 235 #define CYG_EVENT_ACCESS        (EVENT_QUERY_STATE \
 236                                  | EVENT_MODIFY_STATE \
 237                                  | SYNCHRONIZE \
 238                                  | READ_CONTROL)
 239
 240 #define CYG_SEMAPHORE_ACCESS    (SEMAPHORE_QUERY_STATE \
 241                                  | SEMAPHORE_MODIFY_STATE \
 242                                  | SYNCHRONIZE \
 243                                  | READ_CONTROL)
 244
 245 typedef ULONG KAFFINITY;
 246
 247 typedef enum _SYSTEM_INFORMATION_CLASS
 248 {
 249   SystemBasicInformation = 0,
 250   SystemPerformanceInformation = 2,
 251   SystemTimeOfDayInformation = 3,
 252   SystemProcessesAndThreadsInformation = 5,
 253   SystemProcessorTimes = 8,
 254   SystemPagefileInformation = 18,
 255   /* There are a lot more of these... */
 256 } SYSTEM_INFORMATION_CLASS;
 257
 258 typedef struct _SYSTEM_BASIC_INFORMATION
 259 {
 260   ULONG Unknown;
 261   ULONG MaximumIncrement;
 262   ULONG PhysicalPageSize;
 263   ULONG NumberOfPhysicalPages;
 264   ULONG LowestPhysicalPage;
 265   ULONG HighestPhysicalPage;
 266   ULONG AllocationGranularity;
 267   ULONG LowestUserAddress;
 268   ULONG HighestUserAddress;
 269   ULONG ActiveProcessors;
 270   UCHAR NumberProcessors;
 271 } SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;
 272
 273 typedef struct _SYSTEM_PAGEFILE_INFORMATION
 274 {
 275   ULONG NextEntryOffset;
 276   ULONG CurrentSize;
 277   ULONG TotalUsed;
 278   ULONG PeakUsed;
 279   UNICODE_STRING FileName;
 280 } SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION;
 281
 282 typedef struct __attribute__ ((aligned (8))) _SYSTEM_PROCESSOR_TIMES
 283 {
 284   LARGE_INTEGER IdleTime;
 285   LARGE_INTEGER KernelTime;
 286   LARGE_INTEGER UserTime;
 287   LARGE_INTEGER DpcTime;
 288   LARGE_INTEGER InterruptTime;
 289   ULONG InterruptCount;
 290 } SYSTEM_PROCESSOR_TIMES, *PSYSTEM_PROCESSOR_TIMES;
 291
 292 typedef LONG KPRIORITY;
 293 typedef struct _VM_COUNTERS
 294 {
 295   ULONG PeakVirtualSize;
 296   ULONG VirtualSize;
 297   ULONG PageFaultCount;
 298   ULONG PeakWorkingSetSize;
 299   ULONG WorkingSetSize;
 300   ULONG QuotaPeakPagedPoolUsage;
 301   ULONG QuotaPagedPoolUsage;
 302   ULONG QuotaPeakNonPagedPoolUsage;
 303   ULONG QuotaNonPagedPoolUsage;
 304   ULONG PagefileUsage;
 305   ULONG PeakPagefileUsage;
 306 } VM_COUNTERS, *PVM_COUNTERS;
 307
 308 typedef struct _CLIENT_ID
 309 {
 310   HANDLE UniqueProcess;
 311   HANDLE UniqueThread;
 312 } CLIENT_ID, *PCLIENT_ID;
 313
 314 typedef enum
 315 {
 316   StateInitialized,
 317   StateReady,
 318   StateRunning,
 319   StateStandby,
 320   StateTerminated,
 321   StateWait,
 322   StateTransition,
 323   StateUnknown,
 324 } THREAD_STATE;
 325
 326 typedef enum
 327 {
 328   Executive,
 329   FreePage,
 330   PageIn,
 331   PoolAllocation,
 332   DelayExecution,
 333   Suspended,
 334   UserRequest,
 335   WrExecutive,
 336   WrFreePage,
 337   WrPageIn,
 338   WrPoolAllocation,
 339   WrDelayExecution,
 340   WrSuspended,
 341   WrUserRequest,
 342   WrEventPair,
 343   WrQueue,
 344   WrLpcReceive,
 345   WrLpcReply,
 346   WrVirtualMemory,
 347   WrPageOut,
 348   WrRendezvous,
 349   Spare2,
 350   Spare3,
 351   Spare4,
 352   Spare5,
 353   Spare6,
 354   WrKernel,
 355   MaximumWaitReason
 356 } KWAIT_REASON;
 357
 358 typedef struct _SYSTEM_THREADS
 359 {
 360   LARGE_INTEGER KernelTime;
 361   LARGE_INTEGER UserTime;
 362   LARGE_INTEGER CreateTime;
 363   ULONG WaitTime;
 364   PVOID StartAddress;
 365   CLIENT_ID ClientId;
 366   KPRIORITY Priority;
 367   KPRIORITY BasePriority;
 368   ULONG ContextSwitchCount;
 369   THREAD_STATE State;
 370   KWAIT_REASON WaitReason;
 371   DWORD Reserved;
 372 } SYSTEM_THREADS, *PSYSTEM_THREADS;
 373
 374 typedef struct _SYSTEM_PROCESSES
 375 {
 376   ULONG NextEntryDelta;
 377   ULONG ThreadCount;
 378   ULONG Reserved1[6];
 379   LARGE_INTEGER CreateTime;
 380   LARGE_INTEGER UserTime;
 381   LARGE_INTEGER KernelTime;
 382   UNICODE_STRING ProcessName;
 383   KPRIORITY BasePriority;
 384   ULONG ProcessId;
 385   ULONG InheritedFromProcessId;
 386   ULONG HandleCount;
 387   ULONG Reserved2[2];
 388   VM_COUNTERS VmCounters;
 389   IO_COUNTERS IoCounters;
 390   SYSTEM_THREADS Threads[1];
 391 } SYSTEM_PROCESSES, *PSYSTEM_PROCESSES;
 392
 393 typedef struct _IO_STATUS_BLOCK
 394 {
 395   NTSTATUS Status;
 396   ULONG Information;
 397 } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
 398
 399 typedef struct _SYSTEM_PERFORMANCE_INFORMATION
 400 {
 401   LARGE_INTEGER IdleTime;
 402   LARGE_INTEGER ReadTransferCount;
 403   LARGE_INTEGER WriteTransferCount;
 404   LARGE_INTEGER OtherTransferCount;
 405   ULONG ReadOperationCount;
 406   ULONG WriteOperationCount;
 407   ULONG OtherOperationCount;
 408   ULONG AvailablePages;
 409   ULONG TotalCommittedPages;
 410   ULONG TotalCommitLimit;
 411   ULONG PeakCommitment;
 412   ULONG PageFaults;
 413   ULONG WriteCopyFaults;
 414   ULONG TransitionFaults;
 415   ULONG Reserved1;
 416   ULONG DemandZeroFaults;
 417   ULONG PagesRead;
 418   ULONG PageReadIos;
 419   ULONG Reserved2[2];
 420   ULONG PagefilePagesWritten;
 421   ULONG PagefilePageWriteIos;
 422   ULONG MappedFilePagesWritten;
 423   ULONG MappedFilePageWriteIos;
 424   ULONG PagedPoolUsage;
 425   ULONG NonPagedPoolUsage;
 426   ULONG PagedPoolAllocs;
 427   ULONG PagedPoolFrees;
 428   ULONG NonPagedPoolAllocs;
 429   ULONG NonPagedPoolFrees;
 430   ULONG TotalFreeSystemPtes;
 431   ULONG SystemCodePage;
 432   ULONG TotalSystemDriverPages;
 433   ULONG TotalSystemCodePages;
 434   ULONG SmallNonPagedLookasideListAllocateHits;
 435   ULONG SmallPagedLookasideListAllocateHits;
 436   ULONG Reserved3;
 437   ULONG MmSystemCachePage;
 438   ULONG PagedPoolPage;
 439   ULONG SystemDriverPage;
 440   ULONG FastReadNoWait;
 441   ULONG FastReadWait;
 442   ULONG FastReadResourceMiss;
 443   ULONG FastReadNotPossible;
 444   ULONG FastMdlReadNoWait;
 445   ULONG FastMdlReadWait;
 446   ULONG FastMdlReadResourceMiss;
 447   ULONG FastMdlReadNotPossible;
 448   ULONG MapDataNoWait;
 449   ULONG MapDataWait;
 450   ULONG MapDataNoWaitMiss;
 451   ULONG MapDataWaitMiss;
 452   ULONG PinMappedDataCount;
 453   ULONG PinReadNoWait;
 454   ULONG PinReadWait;
 455   ULONG PinReadNoWaitMiss;
 456   ULONG PinReadWaitMiss;
 457   ULONG CopyReadNoWait;
 458   ULONG CopyReadWait;
 459   ULONG CopyReadNoWaitMiss;
 460   ULONG CopyReadWaitMiss;
 461   ULONG MdlReadNoWait;
 462   ULONG MdlReadWait;
 463   ULONG MdlReadNoWaitMiss;
 464   ULONG MdlReadWaitMiss;
 465   ULONG ReadAheadIos;
 466   ULONG LazyWriteIos;
 467   ULONG LazyWritePages;
 468   ULONG DataFlushes;
 469   ULONG DataPages;
 470   ULONG ContextSwitches;
 471   ULONG FirstLevelTbFills;
 472   ULONG SecondLevelTbFills;
 473   ULONG SystemCalls;
 474 } SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;
 475
 476 typedef struct __attribute__ ((aligned(8))) _SYSTEM_TIME_OF_DAY_INFORMATION
 477 {
 478   LARGE_INTEGER BootTime;
 479   LARGE_INTEGER CurrentTime;
 480   LARGE_INTEGER TimeZoneBias;
 481   ULONG CurrentTimeZoneId;
 482 } SYSTEM_TIME_OF_DAY_INFORMATION, *PSYSTEM_TIME_OF_DAY_INFORMATION;
 483
 484 typedef enum _PROCESSINFOCLASS
 485 {
 486   ProcessBasicInformation = 0,
 487   ProcessQuotaLimits = 1,
 488   ProcessVmCounters = 3,
 489   ProcessTimes = 4,
 490   ProcessSessionInformation = 24,
 491   ProcessWow64Information = 26
 492 } PROCESSINFOCLASS;
 493
 494 typedef struct _DEBUG_BUFFER
 495 {
 496   HANDLE SectionHandle;
 497   PVOID SectionBase;
 498   PVOID RemoteSectionBase;
 499   ULONG SectionBaseDelta;
 500   HANDLE EventPairHandle;
 501   ULONG Unknown[2];
 502   HANDLE RemoteThreadHandle;
 503   ULONG InfoClassMask;
 504   ULONG SizeOfInfo;
 505   ULONG AllocatedSize;
 506   ULONG SectionSize;
 507   PVOID ModuleInformation;
 508   PVOID BackTraceInformation;
 509   PVOID HeapInformation;
 510   PVOID LockInformation;
 511   PVOID Reserved[9];
 512 } DEBUG_BUFFER, *PDEBUG_BUFFER;
 513
 514 /* Known debug heap flags */
 515 #define HEAP_FLAG_NOSERIALIZE          0x1
 516 #define HEAP_FLAG_GROWABLE             0x2
 517 #define HEAP_FLAG_EXCEPTIONS           0x4
 518 #define HEAP_FLAG_NONDEFAULT        0x1000
 519 #define HEAP_FLAG_SHAREABLE         0x8000
 520 #define HEAP_FLAG_EXECUTABLE       0x40000
 521 #define HEAP_FLAG_DEBUGGED      0x40000000
 522
 523 typedef struct _DEBUG_HEAP_INFORMATION
 524 {
 525   ULONG Base;
 526   ULONG Flags;
 527   USHORT Granularity;
 528   USHORT Unknown;
 529   ULONG Allocated;
 530   ULONG Committed;
 531   ULONG TagCount;
 532   ULONG BlockCount;
 533   ULONG Reserved[7];
 534   PVOID Tags;
 535   PVOID Blocks;
 536 } DEBUG_HEAP_INFORMATION, *PDEBUG_HEAP_INFORMATION;
 537
 538 typedef struct _DEBUG_HEAP_ARRAY
 539 {
 540   ULONG Count;
 541   DEBUG_HEAP_INFORMATION Heaps[1];
 542 } DEBUG_HEAP_ARRAY, *PDEBUG_HEAP_ARRAY;
 543
 544 typedef struct _DEBUG_HEAP_BLOCK
 545 {
 546   ULONG Size;
 547   ULONG Flags;
 548   ULONG Committed;
 549   ULONG Address;
 550 } DEBUG_HEAP_BLOCK, *PDEBUG_HEAP_BLOCK;
 551
 552 typedef struct _DEBUG_MODULE_INFORMATION
 553 {
 554   ULONG Reserved[2];
 555   ULONG Base;
 556   ULONG Size;
 557   ULONG Flags;
 558   USHORT Index;
 559   USHORT Unknown;
 560   USHORT LoadCount;
 561   USHORT ModuleNameOffset;
 562   CHAR ImageName[256];
 563 } DEBUG_MODULE_INFORMATION, *PDEBUG_MODULE_INFORMATION;
 564
 565 typedef struct _DEBUG_MODULE_ARRAY
 566 {
 567   ULONG Count;
 568   DEBUG_MODULE_INFORMATION Modules[1];
 569 } DEBUG_MODULE_ARRAY, *PDEBUG_MODULE_ARRAY;
 570
 571 typedef struct _KERNEL_USER_TIMES
 572 {
 573   LARGE_INTEGER CreateTime;
 574   LARGE_INTEGER ExitTime;
 575   LARGE_INTEGER KernelTime;
 576   LARGE_INTEGER UserTime;
 577 } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
 578
 579 typedef struct _RTL_USER_PROCESS_PARAMETERS
 580 {
 581   ULONG AllocationSize;
 582   ULONG Size;
 583   ULONG Flags;
 584   ULONG DebugFlags;
 585   HANDLE hConsole;
 586   ULONG ProcessGroup;
 587   HANDLE hStdInput;
 588   HANDLE hStdOutput;
 589   HANDLE hStdError;
 590   UNICODE_STRING CurrentDirectoryName;
 591   HANDLE CurrentDirectoryHandle;
 592   UNICODE_STRING DllPath;
 593   UNICODE_STRING ImagePathName;
 594   UNICODE_STRING CommandLine;
 595   PWSTR Environment;
 596   ULONG dwX;
 597   ULONG dwY;
 598   ULONG dwXSize;
 599   ULONG dwYSize;
 600   ULONG dwXCountChars;
 601   ULONG dwYCountChars;
 602   ULONG dwFillAttribute;
 603   ULONG dwFlags;
 604   ULONG wShowWindow;
 605   UNICODE_STRING WindowTitle;
 606   UNICODE_STRING DesktopInfo;
 607   UNICODE_STRING ShellInfo;
 608   UNICODE_STRING RuntimeInfo;
 609 } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
 610
 611 typedef struct _PEB
 612 {
 613   BYTE Reserved1[2];
 614   BYTE BeingDebugged;
 615   BYTE Reserved2[9];
 616   PVOID LoaderData;
 617   PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
 618   BYTE Reserved3[4];
 619   PVOID ProcessHeap;
 620   PRTL_CRITICAL_SECTION FastPebLock;
 621   BYTE Reserved4[436];
 622   ULONG SessionId;
 623 } PEB, *PPEB;
 624
 625 /* Simplified definition, just to get the TIB and the PEB pointer. */
 626 typedef struct _TEB
 627 {
 628   NT_TIB Tib;
 629   PVOID EnvironmentPointer;
 630   CLIENT_ID ClientId;
 631   PVOID ActiveRpcHandle;
 632   PVOID ThreadLocalStoragePointer;
 633   PPEB Peb;
 634   /* A lot more follows... */
 635 } TEB, *PTEB;
 636
 637 typedef struct _KSYSTEM_TIME
 638 {
 639   ULONG LowPart;
 640   LONG High1Time;
 641   LONG High2Time;
 642 } KSYSTEM_TIME, *PKSYSTEM_TIME;
 643
 644 typedef struct _KUSER_SHARED_DATA
 645 {
 646   BYTE Reserved1[0x08];
 647   KSYSTEM_TIME InterruptTime;
 648   BYTE Reserved2[0x2c8];
 649   ULONG DismountCount;
 650   /* A lot more follows... */
 651 } KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;
 652
 653 typedef struct _PROCESS_BASIC_INFORMATION
 654 {
 655   NTSTATUS ExitStatus;
 656   PPEB PebBaseAddress;
 657   KAFFINITY AffinityMask;
 658   KPRIORITY BasePriority;
 659   ULONG UniqueProcessId;
 660   ULONG InheritedFromUniqueProcessId;
 661 } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
 662
 663 typedef struct _PROCESS_SESSION_INFORMATION
 664 {
 665   ULONG  SessionId;
 666 } PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;
 667
 668 typedef enum _MEMORY_INFORMATION_CLASS
 669 {
 670   MemoryBasicInformation,
 671   MemoryWorkingSetList,
 672   MemorySectionName,
 673   MemoryBasicVlmInformation
 674 } MEMORY_INFORMATION_CLASS;
 675
 676 typedef struct _MEMORY_WORKING_SET_LIST
 677 {
 678   ULONG NumberOfPages;
 679   ULONG WorkingSetList[1];
 680 } MEMORY_WORKING_SET_LIST, *PMEMORY_WORKING_SET_LIST;
 681
 682 typedef struct _MEMORY_SECTION_NAME
 683 {
 684   UNICODE_STRING SectionFileName;
 685 } MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME;
 686
 687 typedef struct _FILE_BASIC_INFORMATION {
 688   LARGE_INTEGER CreationTime;
 689   LARGE_INTEGER LastAccessTime;
 690   LARGE_INTEGER LastWriteTime;
 691   LARGE_INTEGER ChangeTime;
 692   ULONG FileAttributes;
 693 } FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
 694
 695 typedef struct _FILE_STANDARD_INFORMATION {
 696   LARGE_INTEGER AllocationSize;
 697   LARGE_INTEGER EndOfFile;
 698   ULONG NumberOfLinks;
 699   BOOLEAN DeletePending;
 700   BOOLEAN Directory;
 701 } FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;
 702
 703 typedef struct _FILE_NETWORK_OPEN_INFORMATION {
 704   LARGE_INTEGER CreationTime;
 705   LARGE_INTEGER LastAccessTime;
 706   LARGE_INTEGER LastWriteTime;
 707   LARGE_INTEGER ChangeTime;
 708   LARGE_INTEGER AllocationSize;
 709   LARGE_INTEGER EndOfFile;
 710   ULONG FileAttributes;
 711 } FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;
 712
 713 typedef struct _FILE_INTERNAL_INFORMATION {
 714   LARGE_INTEGER FileId;
 715 } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
 716
 717 typedef struct _FILE_EA_INFORMATION {
 718   ULONG EaSize;
 719 } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
 720
 721 typedef struct _FILE_ACCESS_INFORMATION {
 722   ACCESS_MASK AccessFlags;
 723 } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
 724
 725 typedef struct _FILE_DISPOSITION_INFORMATION {
 726   BOOLEAN DeleteFile;
 727 } FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;
 728
 729 typedef struct _FILE_POSITION_INFORMATION {
 730   LARGE_INTEGER CurrentByteOffset;
 731 } FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;
 732
 733 typedef struct _FILE_END_OF_FILE_INFORMATION {
 734   LARGE_INTEGER EndOfFile;
 735 } FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;
 736
 737 typedef struct _FILE_MODE_INFORMATION {
 738   ULONG Mode;
 739 } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
 740
 741 typedef struct _FILE_ALIGNMENT_INFORMATION {
 742   ULONG AlignmentRequirement;
 743 } FILE_ALIGNMENT_INFORMATION;
 744
 745 typedef struct _FILE_NAME_INFORMATION {
 746   ULONG FileNameLength;
 747   WCHAR FileName[1];
 748 } FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;
 749
 750 typedef struct _FILE_LINK_INFORMATION {
 751   BOOLEAN ReplaceIfExists;
 752   HANDLE RootDirectory;
 753   ULONG FileNameLength;
 754   WCHAR FileName[1];
 755 } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
 756
 757 typedef struct _FILE_RENAME_INFORMATION {
 758   BOOLEAN ReplaceIfExists;
 759   HANDLE RootDirectory;
 760   ULONG FileNameLength;
 761   WCHAR FileName[1];
 762 } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
 763
 764 typedef struct _FILE_ALL_INFORMATION {
 765   FILE_BASIC_INFORMATION     BasicInformation;
 766   FILE_STANDARD_INFORMATION  StandardInformation;
 767   FILE_INTERNAL_INFORMATION  InternalInformation;
 768   FILE_EA_INFORMATION        EaInformation;
 769   FILE_ACCESS_INFORMATION    AccessInformation;
 770   FILE_POSITION_INFORMATION  PositionInformation;
 771   FILE_MODE_INFORMATION      ModeInformation;
 772   FILE_ALIGNMENT_INFORMATION AlignmentInformation;
 773   FILE_NAME_INFORMATION      NameInformation;
 774 } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
 775
 776 typedef struct _FILE_PIPE_LOCAL_INFORMATION
 777 {
 778   ULONG NamedPipeType;
 779   ULONG NamedPipeConfiguration;
 780   ULONG MaximumInstances;
 781   ULONG CurrentInstances;
 782   ULONG InboundQuota;
 783   ULONG ReadDataAvailable;
 784   ULONG OutboundQuota;
 785   ULONG WriteQuotaAvailable;
 786   ULONG NamedPipeState;
 787   ULONG NamedPipeEnd;
 788 } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
 789
 790 typedef struct _FILE_COMPRESSION_INFORMATION
 791 {
 792   LARGE_INTEGER CompressedFileSize;
 793   USHORT CompressionFormat;
 794   UCHAR CompressionUnitShift;
 795   UCHAR ChunkShift;
 796   UCHAR ClusterShift;
 797   UCHAR Reserved[3];
 798 } FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
 799
 800 typedef struct _FILE_FS_DEVICE_INFORMATION
 801 {
 802   ULONG DeviceType;
 803   ULONG Characteristics;
 804 } FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;
 805
 806 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
 807 {
 808   ULONG FileSystemAttributes;
 809   ULONG MaximumComponentNameLength;
 810   ULONG FileSystemNameLength;
 811   WCHAR FileSystemName[1];
 812 } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
 813
 814 #pragma pack(push,4)
 815 typedef struct _FILE_FS_VOLUME_INFORMATION
 816 {
 817   LARGE_INTEGER VolumeCreationTime;
 818   ULONG VolumeSerialNumber;
 819   ULONG VolumeLabelLength;
 820   BOOLEAN SupportsObjects;
 821   BOOLEAN __dummy;
 822   WCHAR VolumeLabel[1];
 823 } FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
 824 #pragma pack(pop)
 825
 826 typedef struct _FILE_FS_SIZE_INFORMATION
 827 {
 828   LARGE_INTEGER TotalAllocationUnits;
 829   LARGE_INTEGER AvailableAllocationUnits;
 830   ULONG SectorsPerAllocationUnit;
 831   ULONG BytesPerSector;
 832 } FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
 833
 834 typedef struct _FILE_FS_FULL_SIZE_INFORMATION
 835 {
 836   LARGE_INTEGER TotalAllocationUnits;
 837   LARGE_INTEGER CallerAvailableAllocationUnits;
 838   LARGE_INTEGER ActualAvailableAllocationUnits;
 839   ULONG SectorsPerAllocationUnit;
 840   ULONG BytesPerSector;
 841 } FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
 842
 843 typedef struct _FILE_FS_OBJECTID_INFORMATION {
 844     UCHAR ObjectId[16];
 845     UCHAR ExtendedInfo[48];
 846 } FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION;
 847
 848 typedef enum _FSINFOCLASS {
 849   FileFsVolumeInformation = 1,
 850   FileFsLabelInformation,
 851   FileFsSizeInformation,
 852   FileFsDeviceInformation,
 853   FileFsAttributeInformation,
 854   FileFsControlInformation,
 855   FileFsFullSizeInformation,
 856   FileFsObjectIdInformation,
 857   FileFsDriverPathInformation,
 858   FileFsMaximumInformation
 859 } FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;
 860
 861 typedef enum _OBJECT_INFORMATION_CLASS
 862 {
 863   ObjectBasicInformation = 0,
 864   ObjectNameInformation = 1,
 865   ObjectHandleInformation = 4
 866    // and many more
 867 } OBJECT_INFORMATION_CLASS;
 868
 869 typedef struct _OBJECT_BASIC_INFORMATION
 870 {
 871   ULONG Attributes;
 872   ACCESS_MASK GrantedAccess;
 873   ULONG HandleCount;
 874   ULONG PointerCount;
 875   ULONG PagedPoolUsage;
 876   ULONG NonPagedPoolUsage;
 877   ULONG Reserved[3];
 878   ULONG NameInformationLength;
 879   ULONG TypeInformationLength;
 880   ULONG SecurityDescriptorLength;
 881   LARGE_INTEGER CreateTime;
 882 } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
 883
 884 typedef struct _OBJECT_NAME_INFORMATION
 885 {
 886   UNICODE_STRING Name;
 887 } OBJECT_NAME_INFORMATION;
 888
 889 typedef struct _DIRECTORY_BASIC_INFORMATION
 890 {
 891   UNICODE_STRING ObjectName;
 892   UNICODE_STRING ObjectTypeName;
 893 } DIRECTORY_BASIC_INFORMATION, *PDIRECTORY_BASIC_INFORMATION;
 894
 895 typedef struct _FILE_GET_EA_INFORMATION
 896 {
 897   ULONG   NextEntryOffset;
 898   UCHAR   EaNameLength;
 899   CHAR    EaName[1];
 900 } FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
 901
 902 typedef struct _FILE_FULL_EA_INFORMATION
 903 {
 904   ULONG NextEntryOffset;
 905   UCHAR Flags;
 906   UCHAR EaNameLength;
 907   USHORT EaValueLength;
 908   CHAR EaName[1];
 909 } FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;
 910
 911 typedef struct _FILE_MAILSLOT_SET_INFORMATION
 912 {
 913   LARGE_INTEGER ReadTimeout;
 914 } FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
 915
 916 #define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, \
 917                                         METHOD_BUFFERED, FILE_ANY_ACCESS)
 918
 919 typedef VOID NTAPI (*PIO_APC_ROUTINE)(PVOID, PIO_STATUS_BLOCK, ULONG);
 920
 921 typedef enum _EVENT_TYPE
 922 {
 923   NotificationEvent = 0,
 924   SynchronizationEvent
 925 } EVENT_TYPE, *PEVENT_TYPE;
 926
 927 typedef struct _EVENT_BASIC_INFORMATION
 928 {
 929   EVENT_TYPE EventType;
 930   LONG SignalState;
 931 } EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;
 932
 933 typedef enum _EVENT_INFORMATION_CLASS
 934 {
 935   EventBasicInformation = 0
 936 } EVENT_INFORMATION_CLASS, *PEVENT_INFORMATION_CLASS;
 937
 938 typedef enum _THREAD_INFORMATION_CLASS
 939 {
 940   ThreadBasicInformation = 0,
 941   ThreadImpersonationToken = 5
 942 } THREAD_INFORMATION_CLASS, *PTHREAD_INFORMATION_CLASS;
 943
 944 typedef struct _THREAD_BASIC_INFORMATION {
 945     NTSTATUS  ExitStatus;
 946     PNT_TIB  TebBaseAddress;
 947     CLIENT_ID  ClientId;
 948     KAFFINITY  AffinityMask;
 949     KPRIORITY  Priority;
 950     KPRIORITY  BasePriority;
 951 } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
 952
 953 #define RTL_QUERY_REGISTRY_SUBKEY 0x01
 954 #define RTL_QUERY_REGISTRY_TOPKEY 0x02
 955 #define RTL_QUERY_REGISTRY_REQUIRED 0x04
 956 #define RTL_QUERY_REGISTRY_NOVALUE 0x08
 957 #define RTL_QUERY_REGISTRY_NOEXPAND 0x10
 958 #define RTL_QUERY_REGISTRY_DIRECT 0x20
 959 #define RTL_QUERY_REGISTRY_DELETE 0x40
 960 #define RTL_QUERY_REGISTRY_NOSTRING 0x80
 961
 962 #define RTL_REGISTRY_ABSOLUTE 0
 963 #define RTL_REGISTRY_SERVICES 1
 964 #define RTL_REGISTRY_CONTROL 2
 965 #define RTL_REGISTRY_WINDOWS_NT 3
 966 #define RTL_REGISTRY_DEVICEMAP 4
 967 #define RTL_REGISTRY_USER 5
 968 #define RTL_REGISTRY_HANDLE 0x40000000
 969 #define RTL_REGISTRY_OPTIONAL 0x80000000
 970
 971 typedef NTSTATUS (*PRTL_QUERY_REGISTRY_ROUTINE)
 972                  (PWSTR, ULONG, PVOID, ULONG, PVOID, PVOID);
 973
 974 typedef struct _RTL_QUERY_REGISTRY_TABLE
 975 {
 976   PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine;
 977   ULONG Flags;
 978   PCWSTR Name;
 979   PVOID EntryContext;
 980   ULONG DefaultType;
 981   PVOID DefaultData;
 982   ULONG DefaultLength;
 983 } RTL_QUERY_REGISTRY_TABLE, *PRTL_QUERY_REGISTRY_TABLE;
 984
 985 typedef enum _KEY_VALUE_INFORMATION_CLASS
 986 {
 987   KeyValueBasicInformation = 0,
 988   KeyValueFullInformation,
 989   KeyValuePartialInformation
 990 } KEY_VALUE_INFORMATION_CLASS, *PKEY_VALUE_INFORMATION_CLASS;
 991
 992 typedef struct _KEY_VALUE_PARTIAL_INFORMATION
 993 {
 994   ULONG TitleIndex;
 995   ULONG Type;
 996   ULONG DataLength;
 997   UCHAR Data[1];
 998 } KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;
 999
1000 typedef enum _TIMER_TYPE
1001 {
1002   NotificationTimer,
1003   SynchronisationTimer
1004 } TIMER_TYPE, *PTIMER_TYPE;
1005
1006 typedef VOID (APIENTRY *PTIMER_APC_ROUTINE)(PVOID, ULONG, ULONG);
1007
1008 /* Function declarations for ntdll.dll.  These don't appear in any
1009    standard Win32 header.  */
1010
1011 #define NtCurrentProcess() ((HANDLE) 0xffffffff)
1012 #define NtCurrentThread()  ((HANDLE) 0xfffffffe)
1013
1014 #ifdef __cplusplus
1015 /* This is the mapping of the KUSER_SHARED_DATA structure into the 32 bit
1016    user address space.  We need it here to access the current DismountCount. */
1017 static KUSER_SHARED_DATA &SharedUserData
1018                          = *(volatile PKUSER_SHARED_DATA) 0x7ffe0000;
1019
1020 extern "C"
1021 {
1022 #endif
1023   NTSTATUS NTAPI NtAccessCheck (PSECURITY_DESCRIPTOR, HANDLE, ACCESS_MASK,
1024                                 PGENERIC_MAPPING, PPRIVILEGE_SET, PULONG,
1025                                 PACCESS_MASK, PNTSTATUS);
1026   NTSTATUS NTAPI NtAdjustPrivilegesToken (HANDLE, BOOLEAN, PTOKEN_PRIVILEGES,
1027                                           ULONG, PTOKEN_PRIVILEGES, PULONG);
1028   NTSTATUS NTAPI NtAllocateLocallyUniqueId (PLUID);
1029   NTSTATUS NTAPI NtAllocateUuids (PLARGE_INTEGER, PULONG, PULONG, PUCHAR);
1030   NTSTATUS NTAPI NtCancelTimer (HANDLE, PBOOLEAN);
1031   NTSTATUS NTAPI NtClose (HANDLE);
1032   NTSTATUS NTAPI NtCommitTransaction (HANDLE, BOOLEAN);
1033   NTSTATUS NTAPI NtCreateDirectoryObject (PHANDLE, ACCESS_MASK,
1034                                           POBJECT_ATTRIBUTES);
1035   NTSTATUS NTAPI NtCreateKey (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, ULONG,
1036                               PUNICODE_STRING, ULONG, PULONG);
1037   NTSTATUS NTAPI NtCreateEvent (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1038                                 EVENT_TYPE, BOOLEAN);
1039   NTSTATUS NTAPI NtCreateFile (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1040                              PIO_STATUS_BLOCK, PLARGE_INTEGER, ULONG, ULONG,
1041                              ULONG, ULONG, PVOID, ULONG);
1042   NTSTATUS NTAPI NtCreateMailslotFile(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1043                                       PIO_STATUS_BLOCK, ULONG, ULONG, ULONG,
1044                                       PLARGE_INTEGER);
1045   NTSTATUS NTAPI NtCreateMutant (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1046                                  BOOLEAN);
1047   NTSTATUS NTAPI NtCreateSection (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1048                                   PLARGE_INTEGER, ULONG, ULONG, HANDLE);
1049   NTSTATUS NTAPI NtCreateSemaphore (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1050                                     LONG, LONG);
1051   NTSTATUS NTAPI NtCreateTimer (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1052                                 TIMER_TYPE);
1053   NTSTATUS NTAPI NtCreateToken (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1054                                 TOKEN_TYPE, PLUID, PLARGE_INTEGER, PTOKEN_USER,
1055                                 PTOKEN_GROUPS, PTOKEN_PRIVILEGES, PTOKEN_OWNER,
1056                                 PTOKEN_PRIMARY_GROUP, PTOKEN_DEFAULT_DACL,
1057                                 PTOKEN_SOURCE);
1058   NTSTATUS NTAPI NtCreateTransaction (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1059                                       LPGUID, HANDLE, ULONG, ULONG, ULONG,
1060                                       PLARGE_INTEGER, PUNICODE_STRING);
1061   NTSTATUS NTAPI NtDuplicateToken (HANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1062                                    BOOLEAN, TOKEN_TYPE, PHANDLE);
1063   NTSTATUS NTAPI NtFsControlFile (HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID,
1064                                   PIO_STATUS_BLOCK, ULONG, PVOID, ULONG,
1065                                   PVOID, ULONG);
1066   NTSTATUS NTAPI NtFlushBuffersFile (HANDLE, PIO_STATUS_BLOCK);
1067   NTSTATUS NTAPI NtLoadKey (POBJECT_ATTRIBUTES, POBJECT_ATTRIBUTES);
1068   NTSTATUS NTAPI NtLockVirtualMemory (HANDLE, PVOID *, ULONG *, ULONG);
1069   NTSTATUS NTAPI NtMapViewOfSection (HANDLE, HANDLE, PVOID *, ULONG, ULONG,
1070                                      PLARGE_INTEGER, PULONG, SECTION_INHERIT,
1071                                      ULONG, ULONG);
1072   NTSTATUS NTAPI NtNotifyChangeDirectoryFile (HANDLE, HANDLE, PIO_APC_ROUTINE,
1073                                               PVOID, PIO_STATUS_BLOCK,
1074                                               PFILE_NOTIFY_INFORMATION, ULONG,
1075                                               ULONG, BOOLEAN);
1076   NTSTATUS NTAPI NtOpenDirectoryObject (PHANDLE, ACCESS_MASK,
1077                                         POBJECT_ATTRIBUTES);
1078   NTSTATUS NTAPI NtOpenEvent (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1079   NTSTATUS NTAPI NtOpenFile (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
1080                              PIO_STATUS_BLOCK, ULONG, ULONG);
1081   NTSTATUS NTAPI NtOpenKey (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1082   NTSTATUS NTAPI NtOpenMutant (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1083   NTSTATUS NTAPI NtOpenProcessToken (HANDLE, ACCESS_MASK, PHANDLE);
1084   NTSTATUS NTAPI NtOpenThreadToken (HANDLE, ACCESS_MASK, BOOLEAN, PHANDLE);
1085   NTSTATUS NTAPI NtOpenSection (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1086   NTSTATUS NTAPI NtOpenSemaphore (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
1087   NTSTATUS NTAPI NtOpenSymbolicLinkObject (PHANDLE, ACCESS_MASK,
1088                                            POBJECT_ATTRIBUTES);
1089   /* WARNING!  Don't rely on the timestamp information returned by
1090      NtQueryAttributesFile.  Only the DOS file attribute info is reliable. */
1091   NTSTATUS NTAPI NtPrivilegeCheck (HANDLE, PPRIVILEGE_SET, PBOOLEAN);
1092   NTSTATUS NTAPI NtQueryAttributesFile (POBJECT_ATTRIBUTES,
1093                                         PFILE_BASIC_INFORMATION);
1094   NTSTATUS NTAPI NtQueryDirectoryFile(HANDLE, HANDLE, PVOID, PVOID,
1095                                       PIO_STATUS_BLOCK, PVOID, ULONG,
1096                                       FILE_INFORMATION_CLASS, BOOLEAN,
1097                                       PUNICODE_STRING, BOOLEAN);
1098   NTSTATUS NTAPI NtQueryDirectoryObject (HANDLE, PVOID, ULONG, BOOLEAN,
1099                                          BOOLEAN, PULONG, PULONG);
1100   NTSTATUS NTAPI NtQueryEaFile (HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG,
1101                                 BOOLEAN, PVOID, ULONG, PULONG, BOOLEAN);
1102   NTSTATUS NTAPI NtQueryEvent (HANDLE, EVENT_INFORMATION_CLASS, PVOID, ULONG,
1103                                PULONG);
1104   NTSTATUS NTAPI NtQueryFullAttributesFile (POBJECT_ATTRIBUTES,
1105                                             PFILE_NETWORK_OPEN_INFORMATION);
1106   NTSTATUS NTAPI NtQueryInformationFile (HANDLE, PIO_STATUS_BLOCK, PVOID,
1107                                          ULONG, FILE_INFORMATION_CLASS);
1108   NTSTATUS NTAPI NtQueryInformationProcess (HANDLE, PROCESSINFOCLASS,
1109                                             PVOID, ULONG, PULONG);
1110   NTSTATUS NTAPI NtQueryInformationThread (HANDLE, THREAD_INFORMATION_CLASS,
1111                                             PVOID, ULONG, PULONG);
1112   NTSTATUS NTAPI NtQueryInformationToken (HANDLE, TOKEN_INFORMATION_CLASS,
1113                                           PVOID, ULONG, PULONG);
1114   NTSTATUS NTAPI NtQueryObject (HANDLE, OBJECT_INFORMATION_CLASS, VOID *,
1115                                 ULONG, ULONG *);
1116   NTSTATUS NTAPI NtQuerySystemInformation (SYSTEM_INFORMATION_CLASS,
1117                                            PVOID, ULONG, PULONG);
1118   NTSTATUS WINAPI NtQuerySystemTime (PLARGE_INTEGER);
1119   NTSTATUS NTAPI NtQuerySecurityObject (HANDLE, SECURITY_INFORMATION,
1120                                         PSECURITY_DESCRIPTOR, ULONG, PULONG);
1121   NTSTATUS NTAPI NtQuerySymbolicLinkObject (HANDLE, PUNICODE_STRING, PULONG);
1122   NTSTATUS NTAPI NtQueryTimerResolution (PULONG, PULONG, PULONG);
1123   NTSTATUS NTAPI NtQueryValueKey (HANDLE, PUNICODE_STRING,
1124                                   KEY_VALUE_INFORMATION_CLASS, PVOID, ULONG,
1125                                   PULONG);
1126   NTSTATUS NTAPI NtQueryVirtualMemory (HANDLE, PVOID, MEMORY_INFORMATION_CLASS,
1127                                        PVOID, ULONG, PULONG);
1128   NTSTATUS NTAPI NtQueryVolumeInformationFile (HANDLE, IO_STATUS_BLOCK *,
1129                                                VOID *, ULONG,
1130                                                FS_INFORMATION_CLASS);
1131   NTSTATUS NTAPI NtReadFile (HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID,
1132                              PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER,
1133                              PULONG);
1134   NTSTATUS NTAPI NtRollbackTransaction (HANDLE, BOOLEAN);
1135   NTSTATUS NTAPI NtSetEaFile (HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG);
1136   NTSTATUS NTAPI NtSetInformationFile (HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG,
1137                                        FILE_INFORMATION_CLASS);
1138   NTSTATUS NTAPI NtSetInformationThread (HANDLE, THREAD_INFORMATION_CLASS,
1139                                          PVOID, ULONG);
1140   NTSTATUS NTAPI NtSetInformationToken (HANDLE, TOKEN_INFORMATION_CLASS, PVOID,
1141                                         ULONG);
1142   NTSTATUS NTAPI NtSetSecurityObject (HANDLE, SECURITY_INFORMATION,
1143                                       PSECURITY_DESCRIPTOR);
1144   NTSTATUS NTAPI NtSetTimer (HANDLE, PLARGE_INTEGER, PTIMER_APC_ROUTINE, PVOID,
1145                              BOOLEAN, LONG, PBOOLEAN);
1146   NTSTATUS NTAPI NtSetTimerResolution (ULONG, BOOLEAN, PULONG);
1147   NTSTATUS NTAPI NtSetValueKey (HANDLE, PUNICODE_STRING, ULONG, ULONG, PVOID,
1148                                 ULONG);
1149   NTSTATUS NTAPI NtUnlockVirtualMemory (HANDLE, PVOID *, ULONG *, ULONG);
1150   NTSTATUS NTAPI NtUnmapViewOfSection (HANDLE, PVOID);
1151   NTSTATUS NTAPI NtWriteFile (HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID,
1152                               PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER,
1153                               PULONG);
1154   NTSTATUS NTAPI RtlAbsoluteToSelfRelativeSD (PSECURITY_DESCRIPTOR,
1155                                               PSECURITY_DESCRIPTOR, PULONG);
1156   VOID NTAPI RtlAcquirePebLock ();
1157   NTSTATUS NTAPI RtlAddAccessAllowedAce (PACL, ULONG, ACCESS_MASK, PSID);
1158   NTSTATUS NTAPI RtlAddAccessDeniedAce (PACL, ULONG, ACCESS_MASK, PSID);
1159   NTSTATUS NTAPI RtlAddAce (PACL, ULONG, ULONG, PVOID, ULONG);
1160   PVOID NTAPI RtlAllocateHeap (PVOID, ULONG, SIZE_T);
1161   NTSTATUS NTAPI RtlAppendUnicodeToString (PUNICODE_STRING, PCWSTR);
1162   NTSTATUS NTAPI RtlAppendUnicodeStringToString (PUNICODE_STRING,
1163                                                  PUNICODE_STRING);
1164   NTSTATUS NTAPI RtlAnsiStringToUnicodeString (PUNICODE_STRING, PANSI_STRING,
1165                                                BOOLEAN);
1166   NTSTATUS NTAPI RtlCheckRegistryKey (ULONG, PCWSTR);
1167   LONG NTAPI RtlCompareUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
1168                                       BOOLEAN);
1169   NTSTATUS NTAPI RtlConvertSidToUnicodeString (PUNICODE_STRING, PSID, BOOLEAN);
1170   NTSTATUS NTAPI RtlConvertToAutoInheritSecurityObject (PSECURITY_DESCRIPTOR,
1171                                                         PSECURITY_DESCRIPTOR,
1172                                                         PSECURITY_DESCRIPTOR *,
1173                                                         GUID *, BOOLEAN,
1174                                                         PGENERIC_MAPPING);
1175   NTSTATUS NTAPI RtlCopySid (ULONG, PSID, PSID);
1176   VOID NTAPI RtlCopyUnicodeString (PUNICODE_STRING, PUNICODE_STRING);
1177   NTSTATUS NTAPI RtlCreateAcl (PACL, ULONG, ULONG);
1178   PDEBUG_BUFFER NTAPI RtlCreateQueryDebugBuffer (ULONG, BOOLEAN);
1179   NTSTATUS NTAPI RtlCreateRegistryKey (ULONG, PCWSTR);
1180   NTSTATUS NTAPI RtlCreateSecurityDescriptor (PSECURITY_DESCRIPTOR, ULONG);
1181   BOOLEAN NTAPI RtlCreateUnicodeStringFromAsciiz (PUNICODE_STRING, PCSTR);
1182   NTSTATUS NTAPI RtlDeleteSecurityObject (PSECURITY_DESCRIPTOR *);
1183   NTSTATUS NTAPI RtlDestroyQueryDebugBuffer (PDEBUG_BUFFER);
1184   NTSTATUS NTAPI RtlDowncaseUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
1185                                            BOOLEAN);
1186   NTSTATUS NTAPI RtlEnterCriticalSection (PRTL_CRITICAL_SECTION);
1187   BOOLEAN NTAPI RtlEqualPrefixSid (PSID, PSID);
1188   BOOLEAN NTAPI RtlEqualSid (PSID, PSID);
1189   BOOLEAN NTAPI RtlEqualUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
1190                                        BOOLEAN);
1191   VOID NTAPI RtlFreeAnsiString (PANSI_STRING);
1192   BOOLEAN NTAPI RtlFreeHeap (PVOID, ULONG, PVOID);
1193   VOID NTAPI RtlFreeOemString (POEM_STRING);
1194   VOID NTAPI RtlFreeUnicodeString (PUNICODE_STRING);
1195   BOOLEAN NTAPI RtlFirstFreeAce (PACL, PVOID *);
1196   NTSTATUS NTAPI RtlGetAce (PACL, ULONG, PVOID);
1197   NTSTATUS NTAPI RtlGetControlSecurityDescriptor (PSECURITY_DESCRIPTOR,
1198                                                   PSECURITY_DESCRIPTOR_CONTROL,
1199                                                   PULONG);
1200   HANDLE NTAPI RtlGetCurrentTransaction ();
1201   NTSTATUS NTAPI RtlGetDaclSecurityDescriptor (PSECURITY_DESCRIPTOR, PBOOLEAN,
1202                                                PACL *, PBOOLEAN);
1203   NTSTATUS NTAPI RtlGetGroupSecurityDescriptor (PSECURITY_DESCRIPTOR, PSID *,
1204                                                 PBOOLEAN);
1205   NTSTATUS NTAPI RtlGetOwnerSecurityDescriptor (PSECURITY_DESCRIPTOR, PSID *,
1206                                                 PBOOLEAN);
1207   PSID_IDENTIFIER_AUTHORITY NTAPI RtlIdentifierAuthoritySid (PSID);
1208   VOID NTAPI RtlInitEmptyUnicodeString (PUNICODE_STRING, PCWSTR, USHORT);
1209   NTSTATUS NTAPI RtlInitializeSid (PSID, PSID_IDENTIFIER_AUTHORITY, UCHAR);
1210   VOID NTAPI RtlInitUnicodeString (PUNICODE_STRING, PCWSTR);
1211   NTSTATUS NTAPI RtlIntegerToUnicodeString (ULONG, ULONG, PUNICODE_STRING);
1212   ULONG NTAPI RtlIsDosDeviceName_U (PCWSTR);
1213   NTSTATUS NTAPI RtlLeaveCriticalSection (PRTL_CRITICAL_SECTION);
1214   ULONG NTAPI RtlLengthSecurityDescriptor (PSECURITY_DESCRIPTOR);
1215   ULONG NTAPI RtlLengthSid (PSID);
1216   ULONG NTAPI RtlNtStatusToDosError (NTSTATUS);
1217   NTSTATUS NTAPI RtlOemStringToUnicodeString (PUNICODE_STRING, POEM_STRING,
1218                                                BOOLEAN);
1219   BOOLEAN NTAPI RtlPrefixUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
1220                                         BOOLEAN);
1221   NTSTATUS NTAPI RtlQueryProcessDebugInformation (ULONG, ULONG, PDEBUG_BUFFER);
1222   NTSTATUS NTAPI RtlQueryRegistryValues (ULONG, PCWSTR,
1223                                          PRTL_QUERY_REGISTRY_TABLE, PVOID,
1224                                          PVOID);
1225   VOID NTAPI RtlReleasePebLock ();
1226   VOID NTAPI RtlSecondsSince1970ToTime (ULONG, PLARGE_INTEGER);
1227   NTSTATUS NTAPI RtlSetCurrentDirectory_U (PUNICODE_STRING);
1228   BOOLEAN NTAPI RtlSetCurrentTransaction (HANDLE);
1229   NTSTATUS NTAPI RtlSetControlSecurityDescriptor (PSECURITY_DESCRIPTOR,
1230                                                   SECURITY_DESCRIPTOR_CONTROL,
1231                                                   SECURITY_DESCRIPTOR_CONTROL);
1232   NTSTATUS NTAPI RtlSetDaclSecurityDescriptor (PSECURITY_DESCRIPTOR, BOOLEAN,
1233                                                PACL, BOOLEAN);
1234   NTSTATUS NTAPI RtlSetGroupSecurityDescriptor (PSECURITY_DESCRIPTOR, PSID,
1235                                                 BOOLEAN);
1236   NTSTATUS NTAPI RtlSetOwnerSecurityDescriptor (PSECURITY_DESCRIPTOR, PSID,
1237                                                 BOOLEAN);
1238   PUCHAR NTAPI RtlSubAuthorityCountSid (PSID);
1239   PULONG NTAPI RtlSubAuthoritySid (PSID, ULONG);
1240   NTSTATUS NTAPI RtlUnicodeStringToAnsiString (PANSI_STRING, PUNICODE_STRING,
1241                                                BOOLEAN);
1242   NTSTATUS NTAPI RtlUnicodeStringToOemString (PANSI_STRING, PUNICODE_STRING,
1243                                               BOOLEAN);
1244   WCHAR NTAPI RtlUpcaseUnicodeChar (WCHAR);
1245   NTSTATUS NTAPI RtlUpcaseUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
1246                                          BOOLEAN);
1247   NTSTATUS NTAPI RtlWriteRegistryValue (ULONG, PCWSTR, PCWSTR, ULONG, PVOID,
1248                                         ULONG);
1249
1250 #ifdef __cplusplus
1251   /* A few Rtl functions are either actually macros, or they just don't
1252      exist even though they would be a big help.  We implement them here,
1253      partly as inline functions. */
1254
1255   /* RtlInitEmptyUnicodeString is defined as a macro in wdm.h, but that file
1256      is missing entirely in w32api. */
1257   inline
1258   VOID NTAPI RtlInitEmptyUnicodeString(PUNICODE_STRING dest, PCWSTR buf,
1259                                        USHORT len)
1260   {
1261     dest->Length = 0;
1262     dest->MaximumLength = len;
1263     dest->Buffer = (PWSTR) buf;
1264   }
1265   /* Like RtlInitEmptyUnicodeString, but initialize Length to len, too.
1266      This is for instance useful when creating a UNICODE_STRING from an
1267      NtQueryInformationFile info buffer, where the length of the filename
1268      is known, but you can't rely on the string being 0-terminated.
1269      If you know it's 0-terminated, just use RtlInitUnicodeString(). */
1270   inline
1271   VOID NTAPI RtlInitCountedUnicodeString (PUNICODE_STRING dest, PCWSTR buf,
1272                                           USHORT len)
1273   {
1274     dest->Length = dest->MaximumLength = len;
1275     dest->Buffer = (PWSTR) buf;
1276   }
1277   /* Split path into dirname and basename part.  This function does not
1278      copy anything!  It just initializes the dirname and basename
1279      UNICODE_STRINGs so that their Buffer members point to the right spot
1280      into path's Buffer, and the Length (and MaximumLength) members are set
1281      to match the dirname part and the basename part.
1282      Note that dirname's Length is set so that it also includes the trailing
1283      backslash.  If you don't need it, just subtract sizeof(WCHAR) from
1284      dirname.Length. */
1285   inline
1286   VOID NTAPI RtlSplitUnicodePath (PUNICODE_STRING path, PUNICODE_STRING dirname,
1287                                   PUNICODE_STRING basename)
1288   {
1289     USHORT len = path->Length / sizeof (WCHAR);
1290     while (len > 0 && path->Buffer[--len] != L'\\')
1291       ;
1292     ++len;
1293     if (dirname)
1294       RtlInitCountedUnicodeString (dirname, path->Buffer, len * sizeof (WCHAR));
1295     if (basename)
1296       RtlInitCountedUnicodeString (basename, &path->Buffer[len],
1297                                    path->Length - len * sizeof (WCHAR));
1298   }
1299   /* Check if prefix is a prefix of path. */
1300   inline
1301   BOOLEAN NTAPI RtlEqualUnicodePathPrefix (PUNICODE_STRING path,
1302                                            PUNICODE_STRING prefix,
1303                                            BOOLEAN caseinsensitive)
1304   {
1305     UNICODE_STRING p;
1306
1307     RtlInitCountedUnicodeString (&p, path->Buffer,
1308                                  prefix->Length < path->Length
1309                                  ? prefix->Length : path->Length);
1310     return RtlEqualUnicodeString (&p, prefix, caseinsensitive);
1311   }
1312   /* Check if sufffix is a sufffix of path. */
1313   inline
1314   BOOL NTAPI RtlEqualUnicodePathSuffix (PUNICODE_STRING path,
1315                                         PUNICODE_STRING suffix,
1316                                         BOOLEAN caseinsensitive)
1317   {
1318     UNICODE_STRING p;
1319
1320     if (suffix->Length < path->Length)
1321       RtlInitCountedUnicodeString (&p, (PWCHAR) ((PBYTE) path->Buffer
1322                                        + path->Length - suffix->Length),
1323                                    suffix->Length);
1324     else
1325       RtlInitCountedUnicodeString (&p, path->Buffer, path->Length);
1326     return RtlEqualUnicodeString (&p, suffix, caseinsensitive);
1327   }
1328   /* Implemented in strfuncs.cc.  Create a Hex UNICODE_STRING from a given
1329      64 bit integer value.  If append is TRUE, append the hex string,
1330      otherwise overwrite dest.  Returns either STATUS_SUCCESS, or
1331      STATUS_BUFFER_OVERFLOW, if the unicode buffer is too small (hasn't
1332      room for 16 WCHARs). */
1333   NTSTATUS NTAPI RtlInt64ToHexUnicodeString (ULONGLONG value,
1334                                              PUNICODE_STRING dest,
1335                                              BOOLEAN append);
1336   /* Set file attributes.  Don't change file times. */
1337   inline
1338   NTSTATUS NTAPI NtSetAttributesFile (HANDLE h, ULONG attr)
1339   {
1340     IO_STATUS_BLOCK io;
1341     FILE_BASIC_INFORMATION fbi;
1342     fbi.CreationTime.QuadPart = fbi.LastAccessTime.QuadPart =
1343     fbi.LastWriteTime.QuadPart = fbi.ChangeTime.QuadPart = 0LL;
1344     fbi.FileAttributes = attr ?: FILE_ATTRIBUTE_NORMAL;
1345     return NtSetInformationFile(h, &io, &fbi, sizeof fbi, FileBasicInformation);
1346   }
1347
1348   /* This test for a signalled event is twice as fast as calling
1349      WaitForSingleObject (event, 0). */
1350   inline
1351   BOOL NTAPI IsEventSignalled (HANDLE event)
1352   {
1353     EVENT_BASIC_INFORMATION ebi;
1354     return NT_SUCCESS (NtQueryEvent (event, EventBasicInformation,
1355                                      &ebi, sizeof ebi, NULL))
1356            && ebi.SignalState != 0;
1357
1358   }
1359 }
1360 #endif
1361 #endif /*_NTDLL_H*/