winsup/cygwin/ntdll.h

   1 /* ntdll.h.  Contains ntdll specific stuff not defined elsewhere.
   2
   3    Copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 Red Hat, Inc.
   4
   5    This file is part of Cygwin.
   6
   7    This software is a copyrighted work licensed under the terms of the
   8    Cygwin license.  Please consult the file "CYGWIN_LICENSE" for
   9    details. */
  10
  11 #define STATUS_OBJECT_NAME_EXISTS     ((NTSTATUS) 0x40000000)
  12 #define STATUS_BUFFER_OVERFLOW        ((NTSTATUS) 0x80000005)
  13 #define STATUS_NO_MORE_FILES          ((NTSTATUS) 0x80000006)
  14 #ifndef STATUS_INVALID_INFO_CLASS
  15 /* Some w32api header file defines this so we need to conditionalize this
  16    define to avoid warnings. */
  17 #define STATUS_INVALID_INFO_CLASS     ((NTSTATUS) 0xc0000003)
  18 #endif
  19 #define STATUS_INFO_LENGTH_MISMATCH   ((NTSTATUS) 0xc0000004)
  20 #define STATUS_INVALID_PARAMETER      ((NTSTATUS) 0xc000000d)
  21 #define STATUS_NO_SUCH_FILE           ((NTSTATUS) 0xc000000f)
  22 #define STATUS_INVALID_DEVICE_REQUEST ((NTSTATUS) 0xc0000010)
  23 #define STATUS_END_OF_FILE            ((NTSTATUS) 0xc0000011)
  24 #define STATUS_NO_MEDIA_IN_DEVICE     ((NTSTATUS) 0xc0000013)
  25 #define STATUS_ACCESS_DENIED          ((NTSTATUS) 0xc0000022)
  26 #define STATUS_BUFFER_TOO_SMALL       ((NTSTATUS) 0xc0000023)
  27 #define STATUS_OBJECT_NAME_INVALID    ((NTSTATUS) 0xc0000033)
  28 #define STATUS_OBJECT_NAME_NOT_FOUND  ((NTSTATUS) 0xc0000034)
  29 #define STATUS_OBJECT_PATH_NOT_FOUND  ((NTSTATUS) 0xc000003A)
  30 #define STATUS_SHARING_VIOLATION      ((NTSTATUS) 0xc0000043)
  31 #define STATUS_EAS_NOT_SUPPORTED      ((NTSTATUS) 0xC000004f)
  32 #define STATUS_EA_TOO_LARGE           ((NTSTATUS) 0xc0000050)
  33 #define STATUS_NONEXISTENT_EA_ENTRY   ((NTSTATUS) 0xc0000051)
  34 #define STATUS_NO_EAS_ON_FILE         ((NTSTATUS) 0xc0000052)
  35 #define STATUS_DELETE_PENDING         ((NTSTATUS) 0xc0000056)
  36 #define STATUS_DISK_FULL              ((NTSTATUS) 0xc000007f)
  37 #define STATUS_WORKING_SET_QUOTA      ((NTSTATUS) 0xc00000a1)
  38 #define STATUS_NOT_SUPPORTED          ((NTSTATUS) 0xc00000bb)
  39 #define STATUS_DIRECTORY_NOT_EMPTY    ((NTSTATUS) 0xc0000101)
  40 #define STATUS_NOT_ALL_ASSIGNED       ((NTSTATUS) 0x00000106)
  41 #define STATUS_INVALID_LEVEL          ((NTSTATUS) 0xc0000148)
  42 #define STATUS_DLL_NOT_FOUND          ((NTSTATUS) 0xc0000135)
  43 #define STATUS_ENTRYPOINT_NOT_FOUND   ((NTSTATUS) 0xc0000139)
  44 #define STATUS_BAD_DLL_ENTRYPOINT     ((NTSTATUS) 0xc0000251)
  45 #define STATUS_ILLEGAL_DLL_RELOCATION ((NTSTATUS) 0xc0000269)
  46
  47 #define PDI_MODULES 0x01
  48 #define PDI_HEAPS 0x04
  49 #define LDRP_IMAGE_DLL 0x00000004
  50 #define WSLE_PAGE_READONLY 0x001
  51 #define WSLE_PAGE_EXECUTE 0x002
  52 #define WSLE_PAGE_EXECUTE_READ 0x003
  53 #define WSLE_PAGE_READWRITE 0x004
  54 #define WSLE_PAGE_WRITECOPY 0x005
  55 #define WSLE_PAGE_EXECUTE_READWRITE 0x006
  56 #define WSLE_PAGE_EXECUTE_WRITECOPY 0x007
  57 #define WSLE_PAGE_SHARE_COUNT_MASK 0x0E0
  58 #define WSLE_PAGE_SHAREABLE 0x100
  59
  60 #define FILE_SUPERSEDED     0
  61 #define FILE_OPENED         1
  62 #define FILE_CREATED        2
  63 #define FILE_OVERWRITTEN    3
  64 #define FILE_EXISTS         4
  65 #define FILE_DOES_NOT_EXIST 5
  66
  67 #define FILE_WRITE_TO_END_OF_FILE      (-1LL)
  68 #define FILE_USE_FILE_POINTER_POSITION (-2LL)
  69
  70 /* Device Characteristics. */
  71 #define FILE_REMOVABLE_MEDIA           0x00000001
  72 #define FILE_READ_ONLY_DEVICE          0x00000002
  73 #define FILE_FLOPPY_DISKETTE           0x00000004
  74 #define FILE_WRITE_ONCE_MEDIA          0x00000008
  75 #define FILE_REMOTE_DEVICE             0x00000010
  76 #define FILE_DEVICE_IS_MOUNTED         0x00000020
  77 #define FILE_VIRTUAL_VOLUME            0x00000040
  78 #define FILE_AUTOGENERATED_DEVICE_NAME 0x00000080
  79 #define FILE_DEVICE_SECURE_OPEN        0x00000100
  80
  81 /* Transaction access rights. */
  82 #define TRANSACTION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x3F)
  83
  84 typedef enum _FILE_INFORMATION_CLASS
  85 {
  86   FileDirectoryInformation = 1,
  87   FileFullDirectoryInformation, // 2
  88   FileBothDirectoryInformation, // 3
  89   FileBasicInformation, // 4 wdm
  90   FileStandardInformation, // 5 wdm
  91   FileInternalInformation, // 6
  92   FileEaInformation, // 7
  93   FileAccessInformation, // 8
  94   FileNameInformation, // 9
  95   FileRenameInformation, // 10
  96   FileLinkInformation, // 11
  97   FileNamesInformation, // 12
  98   FileDispositionInformation, // 13
  99   FilePositionInformation, // 14 wdm
 100   FileFullEaInformation, // 15
 101   FileModeInformation, // 16
 102   FileAlignmentInformation, // 17
 103   FileAllInformation, // 18
 104   FileAllocationInformation, // 19
 105   FileEndOfFileInformation, // 20 wdm
 106   FileAlternateNameInformation, // 21
 107   FileStreamInformation, // 22
 108   FilePipeInformation, // 23
 109   FilePipeLocalInformation, // 24
 110   FilePipeRemoteInformation, // 25
 111   FileMailslotQueryInformation, // 26
 112   FileMailslotSetInformation, // 27
 113   FileCompressionInformation, // 28
 114   FileObjectIdInformation, // 29
 115   FileCompletionInformation, // 30
 116   FileMoveClusterInformation, // 31
 117   FileQuotaInformation, // 32
 118   FileReparsePointInformation, // 33
 119   FileNetworkOpenInformation, // 34
 120   FileAttributeTagInformation, // 35
 121   FileTrackingInformation, // 36
 122   FileIdBothDirectoryInformation, // 37
 123   FileIdFullDirectoryInformation, // 38
 124   FileValidDataLengthInformation, // 39
 125   FileShortNameInformation, // 40
 126   FileMaximumInformation
 127 } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
 128
 129 typedef struct _FILE_NAMES_INFORMATION
 130 {
 131   ULONG  NextEntryOffset;
 132   ULONG  FileIndex;
 133   ULONG  FileNameLength;
 134   WCHAR  FileName[1];
 135 } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
 136
 137 typedef struct _FILE_DIRECTORY_INFORMATION {
 138   ULONG  NextEntryOffset;
 139   ULONG  FileIndex;
 140   LARGE_INTEGER  CreationTime;
 141   LARGE_INTEGER  LastAccessTime;
 142   LARGE_INTEGER  LastWriteTime;
 143   LARGE_INTEGER  ChangeTime;
 144   LARGE_INTEGER  EndOfFile;
 145   LARGE_INTEGER  AllocationSize;
 146   ULONG  FileAttributes;
 147   ULONG  FileNameLength;
 148   WCHAR  FileName[1];
 149 } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
 150
 151 typedef struct _FILE_BOTH_DIR_INFORMATION
 152 {
 153   ULONG  NextEntryOffset;
 154   ULONG  FileIndex;
 155   LARGE_INTEGER  CreationTime;
 156   LARGE_INTEGER  LastAccessTime;
 157   LARGE_INTEGER  LastWriteTime;
 158   LARGE_INTEGER  ChangeTime;
 159   LARGE_INTEGER  EndOfFile;
 160   LARGE_INTEGER  AllocationSize;
 161   ULONG  FileAttributes;
 162   ULONG  FileNameLength;
 163   ULONG  EaSize;
 164   CCHAR  ShortNameLength;
 165   WCHAR  ShortName[12];
 166   WCHAR  FileName[1];
 167 } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
 168
 169 typedef struct _FILE_ID_BOTH_DIR_INFORMATION
 170 {
 171   ULONG  NextEntryOffset;
 172   ULONG  FileIndex;
 173   LARGE_INTEGER  CreationTime;
 174   LARGE_INTEGER  LastAccessTime;
 175   LARGE_INTEGER  LastWriteTime;
 176   LARGE_INTEGER  ChangeTime;
 177   LARGE_INTEGER  EndOfFile;
 178   LARGE_INTEGER  AllocationSize;
 179   ULONG  FileAttributes;
 180   ULONG  FileNameLength;
 181   ULONG  EaSize;
 182   CCHAR  ShortNameLength;
 183   WCHAR  ShortName[12];
 184   LARGE_INTEGER  FileId;
 185   WCHAR  FileName[1];
 186 } FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;
 187
 188
 189 #define AT_EXTENDABLE_FILE 0x00002000
 190 #define AT_ROUND_TO_PAGE 0x40000000
 191
 192 #define LOCK_VM_IN_WSL 1
 193 #define LOCK_VM_IN_RAM 2
 194
 195 #define DIRECTORY_QUERY 1
 196 #define DIRECTORY_TRAVERSE 2
 197 #define DIRECTORY_CREATE_OBJECT 4
 198 #define DIRECTORY_CREATE_SUBDIRECTORY 8
 199 #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|0x0f)
 200
 201 #define EVENT_QUERY_STATE 1
 202 #define SEMAPHORE_QUERY_STATE 1
 203
 204 /* Specific ACCESS_MASKSs for objects created in Cygwin. */
 205 #define CYG_SHARED_DIR_ACCESS   (DIRECTORY_QUERY \
 206                                  | DIRECTORY_TRAVERSE \
 207                                  | DIRECTORY_CREATE_SUBDIRECTORY \
 208                                  | DIRECTORY_CREATE_OBJECT \
 209                                  | READ_CONTROL)
 210
 211 #define CYG_MUTANT_ACCESS       (MUTANT_QUERY_STATE \
 212                                  | SYNCHRONIZE \
 213                                  | READ_CONTROL)
 214
 215 #define CYG_EVENT_ACCESS        (EVENT_QUERY_STATE \
 216                                  | EVENT_MODIFY_STATE \
 217                                  | SYNCHRONIZE \
 218                                  | READ_CONTROL)
 219
 220 #define CYG_SEMAPHORE_ACCESS    (SEMAPHORE_QUERY_STATE \
 221                                  | SEMAPHORE_MODIFY_STATE \
 222                                  | SYNCHRONIZE \
 223                                  | READ_CONTROL)
 224
 225 typedef ULONG KAFFINITY;
 226
 227 typedef enum _SYSTEM_INFORMATION_CLASS
 228 {
 229   SystemBasicInformation = 0,
 230   SystemPerformanceInformation = 2,
 231   SystemTimeOfDayInformation = 3,
 232   SystemProcessesAndThreadsInformation = 5,
 233   SystemProcessorTimes = 8,
 234   SystemPagefileInformation = 18,
 235   /* There are a lot more of these... */
 236 } SYSTEM_INFORMATION_CLASS;
 237
 238 typedef struct _SYSTEM_BASIC_INFORMATION
 239 {
 240   ULONG Unknown;
 241   ULONG MaximumIncrement;
 242   ULONG PhysicalPageSize;
 243   ULONG NumberOfPhysicalPages;
 244   ULONG LowestPhysicalPage;
 245   ULONG HighestPhysicalPage;
 246   ULONG AllocationGranularity;
 247   ULONG LowestUserAddress;
 248   ULONG HighestUserAddress;
 249   ULONG ActiveProcessors;
 250   UCHAR NumberProcessors;
 251 } SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;
 252
 253 typedef struct _SYSTEM_PAGEFILE_INFORMATION
 254 {
 255   ULONG NextEntryOffset;
 256   ULONG CurrentSize;
 257   ULONG TotalUsed;
 258   ULONG PeakUsed;
 259   UNICODE_STRING FileName;
 260 } SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION;
 261
 262 typedef struct __attribute__ ((aligned (8))) _SYSTEM_PROCESSOR_TIMES
 263 {
 264   LARGE_INTEGER IdleTime;
 265   LARGE_INTEGER KernelTime;
 266   LARGE_INTEGER UserTime;
 267   LARGE_INTEGER DpcTime;
 268   LARGE_INTEGER InterruptTime;
 269   ULONG InterruptCount;
 270 } SYSTEM_PROCESSOR_TIMES, *PSYSTEM_PROCESSOR_TIMES;
 271
 272 typedef LONG KPRIORITY;
 273 typedef struct _VM_COUNTERS
 274 {
 275   ULONG PeakVirtualSize;
 276   ULONG VirtualSize;
 277   ULONG PageFaultCount;
 278   ULONG PeakWorkingSetSize;
 279   ULONG WorkingSetSize;
 280   ULONG QuotaPeakPagedPoolUsage;
 281   ULONG QuotaPagedPoolUsage;
 282   ULONG QuotaPeakNonPagedPoolUsage;
 283   ULONG QuotaNonPagedPoolUsage;
 284   ULONG PagefileUsage;
 285   ULONG PeakPagefileUsage;
 286 } VM_COUNTERS, *PVM_COUNTERS;
 287
 288 typedef struct _CLIENT_ID
 289 {
 290   HANDLE UniqueProcess;
 291   HANDLE UniqueThread;
 292 } CLIENT_ID, *PCLIENT_ID;
 293
 294 typedef enum
 295 {
 296   StateInitialized,
 297   StateReady,
 298   StateRunning,
 299   StateStandby,
 300   StateTerminated,
 301   StateWait,
 302   StateTransition,
 303   StateUnknown,
 304 } THREAD_STATE;
 305
 306 typedef enum
 307 {
 308   Executive,
 309   FreePage,
 310   PageIn,
 311   PoolAllocation,
 312   DelayExecution,
 313   Suspended,
 314   UserRequest,
 315   WrExecutive,
 316   WrFreePage,
 317   WrPageIn,
 318   WrPoolAllocation,
 319   WrDelayExecution,
 320   WrSuspended,
 321   WrUserRequest,
 322   WrEventPair,
 323   WrQueue,
 324   WrLpcReceive,
 325   WrLpcReply,
 326   WrVirtualMemory,
 327   WrPageOut,
 328   WrRendezvous,
 329   Spare2,
 330   Spare3,
 331   Spare4,
 332   Spare5,
 333   Spare6,
 334   WrKernel,
 335   MaximumWaitReason
 336 } KWAIT_REASON;
 337
 338 typedef struct _SYSTEM_THREADS
 339 {
 340   LARGE_INTEGER KernelTime;
 341   LARGE_INTEGER UserTime;
 342   LARGE_INTEGER CreateTime;
 343   ULONG WaitTime;
 344   PVOID StartAddress;
 345   CLIENT_ID ClientId;
 346   KPRIORITY Priority;
 347   KPRIORITY BasePriority;
 348   ULONG ContextSwitchCount;
 349   THREAD_STATE State;
 350   KWAIT_REASON WaitReason;
 351   DWORD Reserved;
 352 } SYSTEM_THREADS, *PSYSTEM_THREADS;
 353
 354 typedef struct _SYSTEM_PROCESSES
 355 {
 356   ULONG NextEntryDelta;
 357   ULONG ThreadCount;
 358   ULONG Reserved1[6];
 359   LARGE_INTEGER CreateTime;
 360   LARGE_INTEGER UserTime;
 361   LARGE_INTEGER KernelTime;
 362   UNICODE_STRING ProcessName;
 363   KPRIORITY BasePriority;
 364   ULONG ProcessId;
 365   ULONG InheritedFromProcessId;
 366   ULONG HandleCount;
 367   ULONG Reserved2[2];
 368   VM_COUNTERS VmCounters;
 369   IO_COUNTERS IoCounters;
 370   SYSTEM_THREADS Threads[1];
 371 } SYSTEM_PROCESSES, *PSYSTEM_PROCESSES;
 372
 373 typedef struct _IO_STATUS_BLOCK
 374 {
 375   NTSTATUS Status;
 376   ULONG Information;
 377 } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
 378
 379 typedef struct _SYSTEM_PERFORMANCE_INFORMATION
 380 {
 381   LARGE_INTEGER IdleTime;
 382   LARGE_INTEGER ReadTransferCount;
 383   LARGE_INTEGER WriteTransferCount;
 384   LARGE_INTEGER OtherTransferCount;
 385   ULONG ReadOperationCount;
 386   ULONG WriteOperationCount;
 387   ULONG OtherOperationCount;
 388   ULONG AvailablePages;
 389   ULONG TotalCommittedPages;
 390   ULONG TotalCommitLimit;
 391   ULONG PeakCommitment;
 392   ULONG PageFaults;
 393   ULONG WriteCopyFaults;
 394   ULONG TransitionFaults;
 395   ULONG Reserved1;
 396   ULONG DemandZeroFaults;
 397   ULONG PagesRead;
 398   ULONG PageReadIos;
 399   ULONG Reserved2[2];
 400   ULONG PagefilePagesWritten;
 401   ULONG PagefilePageWriteIos;
 402   ULONG MappedFilePagesWritten;
 403   ULONG MappedFilePageWriteIos;
 404   ULONG PagedPoolUsage;
 405   ULONG NonPagedPoolUsage;
 406   ULONG PagedPoolAllocs;
 407   ULONG PagedPoolFrees;
 408   ULONG NonPagedPoolAllocs;
 409   ULONG NonPagedPoolFrees;
 410   ULONG TotalFreeSystemPtes;
 411   ULONG SystemCodePage;
 412   ULONG TotalSystemDriverPages;
 413   ULONG TotalSystemCodePages;
 414   ULONG SmallNonPagedLookasideListAllocateHits;
 415   ULONG SmallPagedLookasideListAllocateHits;
 416   ULONG Reserved3;
 417   ULONG MmSystemCachePage;
 418   ULONG PagedPoolPage;
 419   ULONG SystemDriverPage;
 420   ULONG FastReadNoWait;
 421   ULONG FastReadWait;
 422   ULONG FastReadResourceMiss;
 423   ULONG FastReadNotPossible;
 424   ULONG FastMdlReadNoWait;
 425   ULONG FastMdlReadWait;
 426   ULONG FastMdlReadResourceMiss;
 427   ULONG FastMdlReadNotPossible;
 428   ULONG MapDataNoWait;
 429   ULONG MapDataWait;
 430   ULONG MapDataNoWaitMiss;
 431   ULONG MapDataWaitMiss;
 432   ULONG PinMappedDataCount;
 433   ULONG PinReadNoWait;
 434   ULONG PinReadWait;
 435   ULONG PinReadNoWaitMiss;
 436   ULONG PinReadWaitMiss;
 437   ULONG CopyReadNoWait;
 438   ULONG CopyReadWait;
 439   ULONG CopyReadNoWaitMiss;
 440   ULONG CopyReadWaitMiss;
 441   ULONG MdlReadNoWait;
 442   ULONG MdlReadWait;
 443   ULONG MdlReadNoWaitMiss;
 444   ULONG MdlReadWaitMiss;
 445   ULONG ReadAheadIos;
 446   ULONG LazyWriteIos;
 447   ULONG LazyWritePages;
 448   ULONG DataFlushes;
 449   ULONG DataPages;
 450   ULONG ContextSwitches;
 451   ULONG FirstLevelTbFills;
 452   ULONG SecondLevelTbFills;
 453   ULONG SystemCalls;
 454 } SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;
 455
 456 typedef struct __attribute__ ((aligned(8))) _SYSTEM_TIME_OF_DAY_INFORMATION
 457 {
 458   LARGE_INTEGER BootTime;
 459   LARGE_INTEGER CurrentTime;
 460   LARGE_INTEGER TimeZoneBias;
 461   ULONG CurrentTimeZoneId;
 462 } SYSTEM_TIME_OF_DAY_INFORMATION, *PSYSTEM_TIME_OF_DAY_INFORMATION;
 463
 464 typedef enum _PROCESSINFOCLASS
 465 {
 466   ProcessBasicInformation = 0,
 467   ProcessQuotaLimits = 1,
 468   ProcessVmCounters = 3,
 469   ProcessTimes = 4,
 470   ProcessSessionInformation = 24,
 471   ProcessWow64Information = 26,
 472 } PROCESSINFOCLASS;
 473
 474 typedef struct _DEBUG_BUFFER
 475 {
 476   HANDLE SectionHandle;
 477   PVOID SectionBase;
 478   PVOID RemoteSectionBase;
 479   ULONG SectionBaseDelta;
 480   HANDLE EventPairHandle;
 481   ULONG Unknown[2];
 482   HANDLE RemoteThreadHandle;
 483   ULONG InfoClassMask;
 484   ULONG SizeOfInfo;
 485   ULONG AllocatedSize;
 486   ULONG SectionSize;
 487   PVOID ModuleInformation;
 488   PVOID BackTraceInformation;
 489   PVOID HeapInformation;
 490   PVOID LockInformation;
 491   PVOID Reserved[9];
 492 } DEBUG_BUFFER, *PDEBUG_BUFFER;
 493
 494 typedef struct _DEBUG_HEAP_INFORMATION
 495 {
 496   ULONG Base;
 497   ULONG Flags;
 498   USHORT Granularity;
 499   USHORT Unknown;
 500   ULONG Allocated;
 501   ULONG Committed;
 502   ULONG TagCount;
 503   ULONG BlockCount;
 504   ULONG Reserved[7];
 505   PVOID Tags;
 506   PVOID Blocks;
 507 } DEBUG_HEAP_INFORMATION, *PDEBUG_HEAP_INFORMATION;
 508
 509 typedef struct _DEBUG_MODULE_INFORMATION
 510 {
 511   ULONG Reserved[2];
 512   ULONG Base;
 513   ULONG Size;
 514   ULONG Flags;
 515   USHORT Index;
 516   USHORT Unknown;
 517   USHORT LoadCount;
 518   USHORT ModuleNameOffset;
 519   CHAR ImageName[256];
 520 } DEBUG_MODULE_INFORMATION, *PDEBUG_MODULE_INFORMATION;
 521
 522 typedef struct _KERNEL_USER_TIMES
 523 {
 524   LARGE_INTEGER CreateTime;
 525   LARGE_INTEGER ExitTime;
 526   LARGE_INTEGER KernelTime;
 527   LARGE_INTEGER UserTime;
 528 } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;
 529
 530 typedef struct _RTL_USER_PROCESS_PARAMETERS
 531 {
 532   ULONG AllocationSize;
 533   ULONG Size;
 534   ULONG Flags;
 535   ULONG DebugFlags;
 536   HANDLE hConsole;
 537   ULONG ProcessGroup;
 538   HANDLE hStdInput;
 539   HANDLE hStdOutput;
 540   HANDLE hStdError;
 541   UNICODE_STRING CurrentDirectoryName;
 542   HANDLE CurrentDirectoryHandle;
 543   UNICODE_STRING DllPath;
 544   UNICODE_STRING ImagePathName;
 545   UNICODE_STRING CommandLine;
 546   PWSTR Environment;
 547   ULONG dwX;
 548   ULONG dwY;
 549   ULONG dwXSize;
 550   ULONG dwYSize;
 551   ULONG dwXCountChars;
 552   ULONG dwYCountChars;
 553   ULONG dwFillAttribute;
 554   ULONG dwFlags;
 555   ULONG wShowWindow;
 556   UNICODE_STRING WindowTitle;
 557   UNICODE_STRING DesktopInfo;
 558   UNICODE_STRING ShellInfo;
 559   UNICODE_STRING RuntimeInfo;
 560 } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
 561
 562 typedef struct _PEB
 563 {
 564   BYTE Reserved1[2];
 565   BYTE BeingDebugged;
 566   BYTE Reserved2[9];
 567   PVOID LoaderData;
 568   PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
 569   BYTE Reserved3[448];
 570   ULONG SessionId;
 571 } PEB, *PPEB;
 572
 573 /* Simplifed definition, just to get the PEB pointer. */
 574 typedef struct _TEB
 575 {
 576   PVOID dummy[12];
 577   PPEB                    Peb;
 578   /* A lot more follows... */
 579 } TEB, *PTEB;
 580
 581 typedef struct _PROCESS_BASIC_INFORMATION
 582 {
 583   NTSTATUS ExitStatus;
 584   PPEB PebBaseAddress;
 585   KAFFINITY AffinityMask;
 586   KPRIORITY BasePriority;
 587   ULONG UniqueProcessId;
 588   ULONG InheritedFromUniqueProcessId;
 589 } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
 590
 591 typedef struct _PROCESS_SESSION_INFORMATION
 592 {
 593   ULONG  SessionId;
 594 } PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;
 595
 596 typedef enum _MEMORY_INFORMATION_CLASS
 597 {
 598   MemoryBasicInformation,
 599   MemoryWorkingSetList,
 600   MemorySectionName,
 601   MemoryBasicVlmInformation
 602 } MEMORY_INFORMATION_CLASS;
 603
 604 typedef struct _MEMORY_WORKING_SET_LIST
 605 {
 606   ULONG NumberOfPages;
 607   ULONG WorkingSetList[1];
 608 } MEMORY_WORKING_SET_LIST, *PMEMORY_WORKING_SET_LIST;
 609
 610 typedef struct _FILE_BASIC_INFORMATION {
 611   LARGE_INTEGER CreationTime;
 612   LARGE_INTEGER LastAccessTime;
 613   LARGE_INTEGER LastWriteTime;
 614   LARGE_INTEGER ChangeTime;
 615   ULONG FileAttributes;
 616 } FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
 617
 618 typedef struct _FILE_STANDARD_INFORMATION {
 619   LARGE_INTEGER AllocationSize;
 620   LARGE_INTEGER EndOfFile;
 621   ULONG NumberOfLinks;
 622   BOOLEAN DeletePending;
 623   BOOLEAN Directory;
 624 } FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;
 625
 626 typedef struct _FILE_NETWORK_OPEN_INFORMATION {
 627   LARGE_INTEGER CreationTime;
 628   LARGE_INTEGER LastAccessTime;
 629   LARGE_INTEGER LastWriteTime;
 630   LARGE_INTEGER ChangeTime;
 631   LARGE_INTEGER AllocationSize;
 632   LARGE_INTEGER EndOfFile;
 633   ULONG FileAttributes;
 634 } FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;
 635
 636 typedef struct _FILE_INTERNAL_INFORMATION {
 637   LARGE_INTEGER FileId;
 638 } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
 639
 640 typedef struct _FILE_EA_INFORMATION {
 641   ULONG EaSize;
 642 } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
 643
 644 typedef struct _FILE_ACCESS_INFORMATION {
 645   ACCESS_MASK AccessFlags;
 646 } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
 647
 648 typedef struct _FILE_DISPOSITION_INFORMATION {
 649   BOOLEAN DeleteFile;
 650 } FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;
 651
 652 typedef struct _FILE_POSITION_INFORMATION {
 653   LARGE_INTEGER CurrentByteOffset;
 654 } FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;
 655
 656 typedef struct _FILE_END_OF_FILE_INFORMATION {
 657   LARGE_INTEGER EndOfFile;
 658 } FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;
 659
 660 typedef struct _FILE_MODE_INFORMATION {
 661   ULONG Mode;
 662 } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
 663
 664 typedef struct _FILE_ALIGNMENT_INFORMATION {
 665   ULONG AlignmentRequirement;
 666 } FILE_ALIGNMENT_INFORMATION;
 667
 668 typedef struct _FILE_NAME_INFORMATION {
 669   ULONG FileNameLength;
 670   WCHAR FileName[1];
 671 } FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;
 672
 673 typedef struct _FILE_LINK_INFORMATION {
 674   BOOLEAN ReplaceIfExists;
 675   HANDLE RootDirectory;
 676   ULONG FileNameLength;
 677   WCHAR FileName[1];
 678 } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
 679
 680 typedef struct _FILE_RENAME_INFORMATION {
 681   BOOLEAN ReplaceIfExists;
 682   HANDLE RootDirectory;
 683   ULONG FileNameLength;
 684   WCHAR FileName[1];
 685 } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
 686
 687 typedef struct _FILE_ALL_INFORMATION {
 688   FILE_BASIC_INFORMATION     BasicInformation;
 689   FILE_STANDARD_INFORMATION  StandardInformation;
 690   FILE_INTERNAL_INFORMATION  InternalInformation;
 691   FILE_EA_INFORMATION        EaInformation;
 692   FILE_ACCESS_INFORMATION    AccessInformation;
 693   FILE_POSITION_INFORMATION  PositionInformation;
 694   FILE_MODE_INFORMATION      ModeInformation;
 695   FILE_ALIGNMENT_INFORMATION AlignmentInformation;
 696   FILE_NAME_INFORMATION      NameInformation;
 697 } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
 698
 699 typedef struct _FILE_PIPE_LOCAL_INFORMATION
 700 {
 701   ULONG NamedPipeType;
 702   ULONG NamedPipeConfiguration;
 703   ULONG MaximumInstances;
 704   ULONG CurrentInstances;
 705   ULONG InboundQuota;
 706   ULONG ReadDataAvailable;
 707   ULONG OutboundQuota;
 708   ULONG WriteQuotaAvailable;
 709   ULONG NamedPipeState;
 710   ULONG NamedPipeEnd;
 711 } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
 712
 713 typedef struct _FILE_COMPRESSION_INFORMATION
 714 {
 715   LARGE_INTEGER CompressedFileSize;
 716   USHORT CompressionFormat;
 717   UCHAR CompressionUnitShift;
 718   UCHAR ChunkShift;
 719   UCHAR ClusterShift;
 720   UCHAR Reserved[3];
 721 } FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
 722
 723 typedef struct _FILE_FS_DEVICE_INFORMATION
 724 {
 725   ULONG DeviceType;
 726   ULONG Characteristics;
 727 } FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;
 728
 729 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
 730 {
 731   ULONG FileSystemAttributes;
 732   ULONG MaximumComponentNameLength;
 733   ULONG FileSystemNameLength;
 734   WCHAR FileSystemName[1];
 735 } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
 736
 737 typedef struct _FILE_FS_VOLUME_INFORMATION
 738 {
 739   LARGE_INTEGER VolumeCreationTime;
 740   ULONG VolumeSerialNumber;
 741   ULONG VolumeLabelLength;
 742   BOOLEAN SupportsObjects;
 743   WCHAR VolumeLabel[1];
 744 } FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
 745
 746 typedef struct _FILE_FS_SIZE_INFORMATION
 747 {
 748   LARGE_INTEGER TotalAllocationUnits;
 749   LARGE_INTEGER AvailableAllocationUnits;
 750   ULONG SectorsPerAllocationUnit;
 751   ULONG BytesPerSector;
 752 } FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
 753
 754 typedef struct _FILE_FS_FULL_SIZE_INFORMATION
 755 {
 756   LARGE_INTEGER TotalAllocationUnits;
 757   LARGE_INTEGER CallerAvailableAllocationUnits;
 758   LARGE_INTEGER ActualAvailableAllocationUnits;
 759   ULONG SectorsPerAllocationUnit;
 760   ULONG BytesPerSector;
 761 } FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
 762
 763 typedef struct _FILE_FS_OBJECTID_INFORMATION {
 764     UCHAR ObjectId[16];
 765     UCHAR ExtendedInfo[48];
 766 } FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION;
 767
 768 typedef enum _FSINFOCLASS {
 769   FileFsVolumeInformation = 1,
 770   FileFsLabelInformation,
 771   FileFsSizeInformation,
 772   FileFsDeviceInformation,
 773   FileFsAttributeInformation,
 774   FileFsControlInformation,
 775   FileFsFullSizeInformation,
 776   FileFsObjectIdInformation,
 777   FileFsDriverPathInformation,
 778   FileFsMaximumInformation
 779 } FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;
 780
 781 typedef enum _OBJECT_INFORMATION_CLASS
 782 {
 783   ObjectBasicInformation = 0,
 784   ObjectNameInformation = 1,
 785   ObjectHandleInformation = 4
 786    // and many more
 787 } OBJECT_INFORMATION_CLASS;
 788
 789 typedef struct _OBJECT_BASIC_INFORMATION
 790 {
 791   ULONG Attributes;
 792   ACCESS_MASK GrantedAccess;
 793   ULONG HandleCount;
 794   ULONG PointerCount;
 795   ULONG PagedPoolUsage;
 796   ULONG NonPagedPoolUsage;
 797   ULONG Reserved[3];
 798   ULONG NameInformationLength;
 799   ULONG TypeInformationLength;
 800   ULONG SecurityDescriptorLength;
 801   LARGE_INTEGER CreateTime;
 802 } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
 803
 804 typedef struct _OBJECT_NAME_INFORMATION
 805 {
 806   UNICODE_STRING Name;
 807 } OBJECT_NAME_INFORMATION;
 808
 809 typedef struct _DIRECTORY_BASIC_INFORMATION
 810 {
 811   UNICODE_STRING ObjectName;
 812   UNICODE_STRING ObjectTypeName;
 813 } DIRECTORY_BASIC_INFORMATION, *PDIRECTORY_BASIC_INFORMATION;
 814
 815 typedef struct _FILE_GET_EA_INFORMATION
 816 {
 817   ULONG   NextEntryOffset;
 818   UCHAR   EaNameLength;
 819   CHAR    EaName[1];
 820 } FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
 821
 822 typedef struct _FILE_FULL_EA_INFORMATION
 823 {
 824   ULONG NextEntryOffset;
 825   UCHAR Flags;
 826   UCHAR EaNameLength;
 827   USHORT EaValueLength;
 828   CHAR EaName[1];
 829 } FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;
 830
 831 typedef struct _FILE_MAILSLOT_SET_INFORMATION
 832 {
 833   LARGE_INTEGER ReadTimeout;
 834 } FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
 835
 836 typedef VOID NTAPI (*PIO_APC_ROUTINE)(PVOID, PIO_STATUS_BLOCK, ULONG);
 837
 838 typedef enum _EVENT_TYPE
 839 {
 840   NotificationEvent = 0,
 841   SynchronizationEvent
 842 } EVENT_TYPE, *PEVENT_TYPE;
 843
 844 typedef struct _EVENT_BASIC_INFORMATION
 845 {
 846   EVENT_TYPE EventType;
 847   LONG SignalState;
 848 } EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;
 849
 850 typedef enum _EVENT_INFORMATION_CLASS
 851 {
 852   EventBasicInformation = 0
 853 } EVENT_INFORMATION_CLASS, *PEVENT_INFORMATION_CLASS;
 854
 855 /* Function declarations for ntdll.dll.  These don't appear in any
 856    standard Win32 header.  */
 857 extern "C"
 858 {
 859   NTSTATUS NTAPI NtAdjustPrivilegesToken (HANDLE, BOOLEAN, PTOKEN_PRIVILEGES,
 860                                           ULONG, PTOKEN_PRIVILEGES, PULONG);
 861   NTSTATUS NTAPI NtClose (HANDLE);
 862   NTSTATUS NTAPI NtCommitTransaction (HANDLE, BOOLEAN);
 863   NTSTATUS NTAPI NtCreateDirectoryObject (PHANDLE, ACCESS_MASK,
 864                                           POBJECT_ATTRIBUTES);
 865   NTSTATUS NTAPI NtCreateEvent (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
 866                                 EVENT_TYPE, BOOLEAN);
 867   NTSTATUS NTAPI NtCreateFile (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
 868                              PIO_STATUS_BLOCK, PLARGE_INTEGER, ULONG, ULONG,
 869                              ULONG, ULONG, PVOID, ULONG);
 870   NTSTATUS NTAPI NtCreateMailslotFile(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
 871                                       PIO_STATUS_BLOCK, ULONG, ULONG, ULONG,
 872                                       PLARGE_INTEGER);
 873   NTSTATUS NTAPI NtCreateMutant (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
 874                                  BOOLEAN);
 875   NTSTATUS NTAPI NtCreateSection (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
 876                                   PLARGE_INTEGER, ULONG, ULONG, HANDLE);
 877   NTSTATUS NTAPI NtCreateSemaphore (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
 878                                     LONG, LONG);
 879   NTSTATUS NTAPI NtCreateToken (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
 880                                 TOKEN_TYPE, PLUID, PLARGE_INTEGER, PTOKEN_USER,
 881                                 PTOKEN_GROUPS, PTOKEN_PRIVILEGES, PTOKEN_OWNER,
 882                                 PTOKEN_PRIMARY_GROUP, PTOKEN_DEFAULT_DACL,
 883                                 PTOKEN_SOURCE);
 884   NTSTATUS NTAPI NtCreateTransaction (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
 885                                       LPGUID, HANDLE, ULONG, ULONG, ULONG,
 886                                       PLARGE_INTEGER, PUNICODE_STRING);
 887   NTSTATUS NTAPI NtFsControlFile (HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID,
 888                                   PIO_STATUS_BLOCK, ULONG, PVOID, ULONG,
 889                                   PVOID, ULONG);
 890   NTSTATUS NTAPI NtLockVirtualMemory (HANDLE, PVOID *, ULONG *, ULONG);
 891   NTSTATUS NTAPI NtMapViewOfSection (HANDLE, HANDLE, PVOID *, ULONG, ULONG,
 892                                      PLARGE_INTEGER, PULONG, SECTION_INHERIT,
 893                                      ULONG, ULONG);
 894   NTSTATUS NTAPI NtNotifyChangeDirectoryFile (HANDLE, HANDLE, PIO_APC_ROUTINE,
 895                                               PVOID, PIO_STATUS_BLOCK,
 896                                               PFILE_NOTIFY_INFORMATION, ULONG,
 897                                               ULONG, BOOLEAN);
 898   NTSTATUS NTAPI NtOpenDirectoryObject (PHANDLE, ACCESS_MASK,
 899                                         POBJECT_ATTRIBUTES);
 900   NTSTATUS NTAPI NtOpenEvent (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
 901   NTSTATUS NTAPI NtOpenFile (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES,
 902                              PIO_STATUS_BLOCK, ULONG, ULONG);
 903   NTSTATUS NTAPI NtOpenMutant (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
 904   NTSTATUS NTAPI NtOpenSection (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
 905   NTSTATUS NTAPI NtOpenSemaphore (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
 906   /* WARNING!  Don't rely on the timestamp information returned by
 907      NtQueryAttributesFile.  Only the DOS file attribute info is reliable. */
 908   NTSTATUS NTAPI NtQueryAttributesFile (POBJECT_ATTRIBUTES,
 909                                         PFILE_BASIC_INFORMATION);
 910   NTSTATUS NTAPI NtQueryDirectoryFile(HANDLE, HANDLE, PVOID, PVOID,
 911                                       PIO_STATUS_BLOCK, PVOID, ULONG,
 912                                       FILE_INFORMATION_CLASS, BOOLEAN,
 913                                       PUNICODE_STRING, BOOLEAN);
 914   NTSTATUS NTAPI NtQueryDirectoryObject (HANDLE, PVOID, ULONG, BOOLEAN,
 915                                          BOOLEAN, PULONG, PULONG);
 916   NTSTATUS NTAPI NtQueryEaFile (HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG,
 917                                 BOOLEAN, PVOID, ULONG, PULONG, BOOLEAN);
 918   NTSTATUS NTAPI NtQueryEvent (HANDLE, EVENT_INFORMATION_CLASS, PVOID, ULONG,
 919                                PULONG);
 920   NTSTATUS NTAPI NtQueryFullAttributesFile (POBJECT_ATTRIBUTES,
 921                                             PFILE_NETWORK_OPEN_INFORMATION);
 922   NTSTATUS NTAPI NtQueryInformationFile (HANDLE, PIO_STATUS_BLOCK, PVOID,
 923                                          ULONG, FILE_INFORMATION_CLASS);
 924   NTSTATUS NTAPI NtQueryInformationProcess (HANDLE, PROCESSINFOCLASS,
 925                                             PVOID, ULONG, PULONG);
 926   NTSTATUS NTAPI NtQueryObject (HANDLE, OBJECT_INFORMATION_CLASS, VOID *,
 927                                 ULONG, ULONG *);
 928   NTSTATUS NTAPI NtQuerySystemInformation (SYSTEM_INFORMATION_CLASS,
 929                                            PVOID, ULONG, PULONG);
 930   NTSTATUS NTAPI NtQuerySecurityObject (HANDLE, SECURITY_INFORMATION,
 931                                         PSECURITY_DESCRIPTOR, ULONG, PULONG);
 932   NTSTATUS NTAPI NtQueryVirtualMemory (HANDLE, PVOID, MEMORY_INFORMATION_CLASS,
 933                                        PVOID, ULONG, PULONG);
 934   NTSTATUS NTAPI NtQueryVolumeInformationFile (HANDLE, IO_STATUS_BLOCK *,
 935                                                VOID *, ULONG,
 936                                                FS_INFORMATION_CLASS);
 937   NTSTATUS NTAPI NtReadFile (HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID,
 938                              PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER,
 939                              PULONG);
 940   NTSTATUS NTAPI NtRollbackTransaction (HANDLE, BOOLEAN);
 941   NTSTATUS NTAPI NtSetEaFile (HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG);
 942   NTSTATUS NTAPI NtSetInformationFile (HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG,
 943                                        FILE_INFORMATION_CLASS);
 944   NTSTATUS NTAPI NtSetSecurityObject (HANDLE, SECURITY_INFORMATION,
 945                                       PSECURITY_DESCRIPTOR);
 946   NTSTATUS NTAPI NtUnlockVirtualMemory (HANDLE, PVOID *, ULONG *, ULONG);
 947   NTSTATUS NTAPI NtUnmapViewOfSection (HANDLE, PVOID);
 948   NTSTATUS NTAPI NtWriteFile (HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID,
 949                               PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER,
 950                               PULONG);
 951   NTSTATUS NTAPI RtlAppendUnicodeToString (PUNICODE_STRING, PCWSTR);
 952   NTSTATUS NTAPI RtlAppendUnicodeStringToString (PUNICODE_STRING,
 953                                                  PUNICODE_STRING);
 954   VOID NTAPI RtlAcquirePebLock ();
 955   NTSTATUS NTAPI RtlAnsiStringToUnicodeString (PUNICODE_STRING, PANSI_STRING,
 956                                                BOOLEAN);
 957   LONG NTAPI RtlCompareUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
 958                                       BOOLEAN);
 959   NTSTATUS NTAPI RtlConvertSidToUnicodeString (PUNICODE_STRING, PSID, BOOLEAN);
 960   VOID NTAPI RtlCopyUnicodeString (PUNICODE_STRING, PUNICODE_STRING);
 961   BOOLEAN NTAPI RtlCreateUnicodeStringFromAsciiz (PUNICODE_STRING, PCSTR);
 962   NTSTATUS NTAPI RtlDowncaseUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
 963                                            BOOLEAN);
 964   BOOLEAN NTAPI RtlEqualUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
 965                                        BOOLEAN);
 966   VOID NTAPI RtlFreeAnsiString (PANSI_STRING);
 967   VOID NTAPI RtlFreeOemString (POEM_STRING);
 968   VOID NTAPI RtlFreeUnicodeString (PUNICODE_STRING);
 969   HANDLE NTAPI RtlGetCurrentTransaction ();
 970   VOID NTAPI RtlInitEmptyUnicodeString (PUNICODE_STRING, PCWSTR, USHORT);
 971   VOID NTAPI RtlInitUnicodeString (PUNICODE_STRING, PCWSTR);
 972   NTSTATUS NTAPI RtlIntegerToUnicodeString (ULONG, ULONG, PUNICODE_STRING);
 973   ULONG NTAPI RtlIsDosDeviceName_U (PCWSTR);
 974   ULONG NTAPI RtlNtStatusToDosError (NTSTATUS);
 975   NTSTATUS NTAPI RtlOemStringToUnicodeString (PUNICODE_STRING, POEM_STRING,
 976                                                BOOLEAN);
 977   BOOLEAN NTAPI RtlPrefixUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
 978                                         BOOLEAN);
 979   VOID NTAPI RtlReleasePebLock ();
 980   VOID NTAPI RtlSecondsSince1970ToTime (ULONG, PLARGE_INTEGER);
 981   BOOLEAN NTAPI RtlSetCurrentTransaction (HANDLE);
 982   NTSTATUS NTAPI RtlUnicodeStringToAnsiString (PANSI_STRING, PUNICODE_STRING,
 983                                                BOOLEAN);
 984   NTSTATUS NTAPI RtlUnicodeStringToOemString (PANSI_STRING, PUNICODE_STRING,
 985                                               BOOLEAN);
 986   WCHAR NTAPI RtlUpcaseUnicodeChar (WCHAR);
 987   NTSTATUS NTAPI RtlUpcaseUnicodeString (PUNICODE_STRING, PUNICODE_STRING,
 988                                          BOOLEAN);
 989
 990   /* A few Rtl functions are either actually macros, or they just don't
 991      exist even though they would be a big help.  We implement them here,
 992      partly as inline functions. */
 993
 994   /* RtlInitEmptyUnicodeString is defined as a macro in wdm.h, but that file
 995      is missing entirely in w32api. */
 996   inline
 997   VOID NTAPI RtlInitEmptyUnicodeString(PUNICODE_STRING dest, PCWSTR buf,
 998                                        USHORT len)
 999   {
1000     dest->Length = 0;
1001     dest->MaximumLength = len;
1002     dest->Buffer = (PWSTR) buf;
1003   }
1004   /* Like RtlInitEmptyUnicodeString, but initialize Length to len, too.
1005      This is for instance useful when creating a UNICODE_STRING from an
1006      NtQueryInformationFile info buffer, where the length of the filename
1007      is known, but you can't rely on the string being 0-terminated.
1008      If you know it's 0-terminated, just use RtlInitUnicodeString(). */
1009   inline
1010   VOID NTAPI RtlInitCountedUnicodeString (PUNICODE_STRING dest, PCWSTR buf,
1011                                           USHORT len)
1012   {
1013     dest->Length = dest->MaximumLength = len;
1014     dest->Buffer = (PWSTR) buf;
1015   }
1016   /* Split path into dirname and basename part.  This function does not
1017      copy anything!  It just initializes the dirname and basename
1018      UNICODE_STRINGs so that their Buffer members point to the right spot
1019      into path's Buffer, and the Length (and MaximumLength) members are set
1020      to match the dirname part and the basename part.
1021      Note that dirname's Length is set so that it also includes the trailing
1022      backslash.  If you don't need it, just subtract sizeof(WCHAR) from
1023      dirname.Length. */
1024   inline
1025   VOID NTAPI RtlSplitUnicodePath (PUNICODE_STRING path, PUNICODE_STRING dirname,
1026                                   PUNICODE_STRING basename)
1027   {
1028     USHORT len = path->Length / sizeof (WCHAR);
1029     while (len > 0 && path->Buffer[--len] != L'\\')
1030       ;
1031     ++len;
1032     if (dirname)
1033       RtlInitCountedUnicodeString (dirname, path->Buffer, len * sizeof (WCHAR));
1034     if (basename)
1035       RtlInitCountedUnicodeString (basename, &path->Buffer[len],
1036                                    path->Length - len * sizeof (WCHAR));
1037   }
1038   /* Check if prefix is a prefix of path. */
1039   inline
1040   BOOLEAN NTAPI RtlEqualUnicodePathPrefix (PUNICODE_STRING path, PCWSTR prefix,
1041                                            BOOLEAN caseinsensitive)
1042   {
1043     UNICODE_STRING p, pref;
1044
1045     RtlInitUnicodeString (&pref, prefix);
1046     RtlInitCountedUnicodeString (&p, path->Buffer,
1047                                  pref.Length < path->Length
1048                                  ? pref.Length : path->Length);
1049     return RtlEqualUnicodeString (&p, &pref, caseinsensitive);
1050   }
1051   /* Check if sufffix is a sufffix of path. */
1052   inline
1053   BOOL NTAPI RtlEqualUnicodePathSuffix (PUNICODE_STRING path, PCWSTR suffix,
1054                                         BOOLEAN caseinsensitive)
1055   {
1056     UNICODE_STRING p, suf;
1057
1058     RtlInitUnicodeString (&suf, suffix);
1059     if (suf.Length < path->Length)
1060       RtlInitCountedUnicodeString (&p, (PWCHAR) ((PBYTE) path->Buffer
1061                                        + path->Length - suf.Length),
1062                                    suf.Length);
1063     else
1064       RtlInitCountedUnicodeString (&p, path->Buffer, path->Length);
1065     return RtlEqualUnicodeString (&p, &suf, caseinsensitive);
1066   }
1067   /* Implemented in strfuncs.cc.  Create a Hex UNICODE_STRING from a given
1068      64 bit integer value.  If append is TRUE, append the hex string,
1069      otherwise overwrite dest.  Returns either STATUS_SUCCESS, or
1070      STATUS_BUFFER_OVERFLOW, if the unicode buffer is too small (hasn't
1071      room for 16 WCHARs). */
1072   NTSTATUS NTAPI RtlInt64ToHexUnicodeString (ULONGLONG value,
1073                                              PUNICODE_STRING dest,
1074                                              BOOLEAN append);
1075   /* Set file attributes.  Don't change file times. */
1076   inline
1077   NTSTATUS NTAPI NtSetAttributesFile (HANDLE h, ULONG attr)
1078   {
1079     IO_STATUS_BLOCK io;
1080     FILE_BASIC_INFORMATION fbi;
1081     fbi.CreationTime.QuadPart = fbi.LastAccessTime.QuadPart =
1082     fbi.LastWriteTime.QuadPart = fbi.ChangeTime.QuadPart = 0LL;
1083     fbi.FileAttributes = attr ?: FILE_ATTRIBUTE_NORMAL;
1084     return NtSetInformationFile(h, &io, &fbi, sizeof fbi, FileBasicInformation);
1085   }
1086 }