winternl.h File Reference

#include <windef.h>

Include dependency graph for winternl.h:

Go to the source code of this file.

Classes
struct	_STRING
struct	_UNICODE_STRING
struct	_RTL_USER_PROCESS_PARAMETERS
struct	_PEB_LDR_DATA
struct	_LDR_DATA_TABLE_ENTRY
struct	_PEB
struct	_TEB
struct	_OBJECT_ATTRIBUTES
struct	_IO_STATUS_BLOCK
struct	_KEY_VALUE_ENTRY
struct	_PROCESS_BASIC_INFORMATION
struct	_PUBLIC_OBJECT_BASIC_INFORMATION
struct	__PUBLIC_OBJECT_TYPE_INFORMATION
struct	_SYSTEM_BASIC_INFORMATION
struct	_SYSTEM_PERFORMANCE_INFORMATION
struct	_SYSTEM_TIMEOFDAY_INFORMATION
struct	_SYSTEM_PROCESS_INFORMATION
struct	_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
struct	_SYSTEM_INTERRUPT_INFORMATION
struct	_SYSTEM_EXCEPTION_INFORMATION
struct	_SYSTEM_REGISTRY_QUOTA_INFORMATION
struct	_SYSTEM_LOOKASIDE_INFORMATION
struct	_SYSTEM_POLICY_INFORMATION
struct	_WINSTATIONINFORMATIONW

Macros
#define	_WINTERNL_
#define	NT_SUCCESS(Status)   (((NTSTATUS)(Status)) >= 0)
#define	NT_INFORMATION(Status)   ((((ULONG)(Status)) >> 30) == 1)
#define	NT_WARNING(Status)   ((((ULONG)(Status)) >> 30) == 2)
#define	NT_ERROR(Status)   ((((ULONG)(Status)) >> 30) == 3)
#define	INTERNAL_TS_ACTIVE_CONSOLE_ID   (*((volatile ULONG*)0x7ffe02d8))
#define	LOGONID_CURRENT   ((ULONG)-1)
#define	SERVERNAME_CURRENT   ((HANDLE)NULL)
#define	FILE_DIRECTORY_FILE   0x00000001
#define	FILE_WRITE_THROUGH   0x00000002
#define	FILE_SEQUENTIAL_ONLY   0x00000004
#define	FILE_NO_INTERMEDIATE_BUFFERING   0x00000008
#define	FILE_SYNCHRONOUS_IO_ALERT   0x00000010
#define	FILE_SYNCHRONOUS_IO_NONALERT   0x00000020
#define	FILE_NON_DIRECTORY_FILE   0x00000040
#define	FILE_CREATE_TREE_CONNECTION   0x00000080
#define	FILE_COMPLETE_IF_OPLOCKED   0x00000100
#define	FILE_NO_EA_KNOWLEDGE   0x00000200
#define	FILE_OPEN_REMOTE_INSTANCE   0x00000400
#define	FILE_RANDOM_ACCESS   0x00000800
#define	FILE_DELETE_ON_CLOSE   0x00001000
#define	FILE_OPEN_BY_FILE_ID   0x00002000
#define	FILE_OPEN_FOR_BACKUP_INTENT   0x00004000
#define	FILE_NO_COMPRESSION   0x00008000
#define	FILE_OPEN_REQUIRING_OPLOCK   0x00010000
#define	FILE_RESERVE_OPFILTER   0x00100000
#define	FILE_OPEN_REPARSE_POINT   0x00200000
#define	FILE_OPEN_NO_RECALL   0x00400000
#define	FILE_OPEN_FOR_FREE_SPACE_QUERY   0x00800000
#define	FILE_SUPERSEDED   0x00000000
#define	FILE_OPENED   0x00000001
#define	FILE_CREATED   0x00000002
#define	FILE_OVERWRITTEN   0x00000003
#define	FILE_EXISTS   0x00000004
#define	FILE_DOES_NOT_EXIST   0x00000005
#define	FILE_VALID_OPTION_FLAGS   0x00ffffff
#define	FILE_VALID_PIPE_OPTION_FLAGS   0x00000032
#define	FILE_VALID_MAILSLOT_OPTION_FLAGS   0x00000032
#define	FILE_VALID_SET_FLAGS   0x00000036
#define	FILE_SUPERSEDE   0x00000000
#define	FILE_OPEN   0x00000001
#define	FILE_CREATE   0x00000002
#define	FILE_OPEN_IF   0x00000003
#define	FILE_OVERWRITE   0x00000004
#define	FILE_OVERWRITE_IF   0x00000005
#define	FILE_MAXIMUM_DISPOSITION   0x00000005
#define	OBJ_INHERIT   0x00000002L
#define	OBJ_PERMANENT   0x00000010L
#define	OBJ_EXCLUSIVE   0x00000020L
#define	OBJ_CASE_INSENSITIVE   0x00000040L
#define	OBJ_OPENIF   0x00000080L
#define	OBJ_OPENLINK   0x00000100L
#define	OBJ_KERNEL_HANDLE   0x00000200L
#define	OBJ_FORCE_ACCESS_CHECK   0x00000400L
#define	OBJ_VALID_ATTRIBUTES   0x000007F2L
#define	InitializeObjectAttributes(p, n, a, r, s)
#define	PIO_APC_ROUTINE_DEFINED
#define	RtlMoveMemory(Dest, Source, Length)   memmove((Dest),(Source),(Length))
#define	RtlFillMemory(Dest, Length, Fill)   memset((Dest),(Fill),(Length))
#define	RtlZeroMemory(Dest, Length)   RtlFillMemory((Dest),(Length),0)

Typedefs
typedef CONST char *	PCSZ
typedef struct _STRING	STRING
typedef struct _STRING *	PSTRING
typedef STRING	ANSI_STRING
typedef PSTRING	PANSI_STRING
typedef PSTRING	PCANSI_STRING
typedef STRING	OEM_STRING
typedef PSTRING	POEM_STRING
typedef const STRING *	PCOEM_STRING
typedef struct _UNICODE_STRING	UNICODE_STRING
typedef struct _UNICODE_STRING *	PUNICODE_STRING
typedef const UNICODE_STRING *	PCUNICODE_STRING
typedef struct _RTL_USER_PROCESS_PARAMETERS	RTL_USER_PROCESS_PARAMETERS
typedef struct _RTL_USER_PROCESS_PARAMETERS *	PRTL_USER_PROCESS_PARAMETERS
typedef struct _PEB_LDR_DATA	PEB_LDR_DATA
typedef struct _PEB_LDR_DATA *	PPEB_LDR_DATA
typedef struct _LDR_DATA_TABLE_ENTRY	LDR_DATA_TABLE_ENTRY
typedef struct _LDR_DATA_TABLE_ENTRY *	PLDR_DATA_TABLE_ENTRY
typedef VOID(NTAPI *	PPS_POST_PROCESS_INIT_ROUTINE) (VOID)
typedef struct _PEB	PEB
typedef struct _PEB *	PPEB
typedef struct _TEB	TEB
typedef struct _TEB *	PTEB
typedef enum _FILE_INFORMATION_CLASS	FILE_INFORMATION_CLASS
typedef struct _OBJECT_ATTRIBUTES	OBJECT_ATTRIBUTES
typedef struct _OBJECT_ATTRIBUTES *	POBJECT_ATTRIBUTES
typedef struct _IO_STATUS_BLOCK	IO_STATUS_BLOCK
typedef struct _IO_STATUS_BLOCK *	PIO_STATUS_BLOCK
typedef VOID(NTAPI *	PIO_APC_ROUTINE) (_In_ PVOID ApcContext, _In_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG Reserved)
typedef struct _KEY_VALUE_ENTRY	KEY_VALUE_ENTRY
typedef struct _KEY_VALUE_ENTRY *	PKEY_VALUE_ENTRY
typedef enum _KEY_SET_INFORMATION_CLASS	KEY_SET_INFORMATION_CLASS
typedef enum _PROCESSINFOCLASS	PROCESSINFOCLASS
typedef struct _PROCESS_BASIC_INFORMATION	PROCESS_BASIC_INFORMATION
typedef struct _PROCESS_BASIC_INFORMATION *	PPROCESS_BASIC_INFORMATION
typedef enum _THREADINFOCLASS	THREADINFOCLASS
typedef enum _OBJECT_INFORMATION_CLASS	OBJECT_INFORMATION_CLASS
typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION	PUBLIC_OBJECT_BASIC_INFORMATION
typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION *	PPUBLIC_OBJECT_BASIC_INFORMATION
typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION	PUBLIC_OBJECT_TYPE_INFORMATION
typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION *	PPUBLIC_OBJECT_TYPE_INFORMATION
typedef enum _SYSTEM_INFORMATION_CLASS	SYSTEM_INFORMATION_CLASS
typedef struct _SYSTEM_BASIC_INFORMATION	SYSTEM_BASIC_INFORMATION
typedef struct _SYSTEM_BASIC_INFORMATION *	PSYSTEM_BASIC_INFORMATION
typedef struct _SYSTEM_PERFORMANCE_INFORMATION	SYSTEM_PERFORMANCE_INFORMATION
typedef struct _SYSTEM_PERFORMANCE_INFORMATION *	PSYSTEM_PERFORMANCE_INFORMATION
typedef struct _SYSTEM_TIMEOFDAY_INFORMATION	SYSTEM_TIMEOFDAY_INFORMATION
typedef struct _SYSTEM_TIMEOFDAY_INFORMATION *	PSYSTEM_TIMEOFDAY_INFORMATION
typedef struct _SYSTEM_PROCESS_INFORMATION	SYSTEM_PROCESS_INFORMATION
typedef struct _SYSTEM_PROCESS_INFORMATION *	PSYSTEM_PROCESS_INFORMATION
typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION	SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION *	PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
typedef struct _SYSTEM_INTERRUPT_INFORMATION	SYSTEM_INTERRUPT_INFORMATION
typedef struct _SYSTEM_INTERRUPT_INFORMATION *	PSYSTEM_INTERRUPT_INFORMATION
typedef struct _SYSTEM_EXCEPTION_INFORMATION	SYSTEM_EXCEPTION_INFORMATION
typedef struct _SYSTEM_EXCEPTION_INFORMATION *	PSYSTEM_EXCEPTION_INFORMATION
typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION	SYSTEM_REGISTRY_QUOTA_INFORMATION
typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION *	PSYSTEM_REGISTRY_QUOTA_INFORMATION
typedef struct _SYSTEM_LOOKASIDE_INFORMATION	SYSTEM_LOOKASIDE_INFORMATION
typedef struct _SYSTEM_LOOKASIDE_INFORMATION *	PSYSTEM_LOOKASIDE_INFORMATION
typedef struct _SYSTEM_POLICY_INFORMATION	SYSTEM_POLICY_INFORMATION
typedef struct _SYSTEM_POLICY_INFORMATION *	PSYSTEM_POLICY_INFORMATION
typedef enum _WINSTATIONINFOCLASS	WINSTATIONINFOCLASS
typedef struct _WINSTATIONINFORMATIONW	WINSTATIONINFORMATIONW
typedef struct _WINSTATIONINFORMATIONW *	PWINSTATIONINFORMATIONW
typedef BOOLEAN(WINAPI *	PWINSTATIONQUERYINFORMATIONW) (HANDLE, ULONG, WINSTATIONINFOCLASS, PVOID, ULONG, PULONG)

Enumerations
enum	_FILE_INFORMATION_CLASS {   FileDirectoryInformation = 1 , FileFullDirectoryInformation , FileBothDirectoryInformation , FileBasicInformation ,   FileStandardInformation , FileInternalInformation , FileEaInformation , FileAccessInformation ,   FileNameInformation , FileRenameInformation , FileLinkInformation , FileNamesInformation ,   FileDispositionInformation , FilePositionInformation , FileFullEaInformation , FileModeInformation ,   FileAlignmentInformation , FileAllInformation , FileAllocationInformation , FileEndOfFileInformation ,   FileAlternateNameInformation , FileStreamInformation , FilePipeInformation , FilePipeLocalInformation ,   FilePipeRemoteInformation , FileMailslotQueryInformation , FileMailslotSetInformation , FileCompressionInformation ,   FileObjectIdInformation , FileCompletionInformation , FileMoveClusterInformation , FileQuotaInformation ,   FileReparsePointInformation , FileNetworkOpenInformation , FileAttributeTagInformation , FileTrackingInformation ,   FileIdBothDirectoryInformation , FileIdFullDirectoryInformation , FileValidDataLengthInformation , FileShortNameInformation ,   FileIoCompletionNotificationInformation , FileIoStatusBlockRangeInformation , FileIoPriorityHintInformation , FileSfioReserveInformation ,   FileSfioVolumeInformation , FileHardLinkInformation , FileProcessIdsUsingFileInformation , FileNormalizedNameInformation ,   FileNetworkPhysicalNameInformation , FileIdGlobalTxDirectoryInformation , FileMaximumInformation , FileDirectoryInformation = 1 ,   FileFullDirectoryInformation , FileBothDirectoryInformation , FileBasicInformation , FileStandardInformation ,   FileInternalInformation , FileEaInformation , FileAccessInformation , FileNameInformation ,   FileRenameInformation , FileLinkInformation , FileNamesInformation , FileDispositionInformation ,   FilePositionInformation , FileFullEaInformation , FileModeInformation , FileAlignmentInformation ,   FileAllInformation , FileAllocationInformation , FileEndOfFileInformation , FileAlternateNameInformation ,   FileStreamInformation , FilePipeInformation , FilePipeLocalInformation , FilePipeRemoteInformation ,   FileMailslotQueryInformation , FileMailslotSetInformation , FileCompressionInformation , FileCopyOnWriteInformation ,   FileCompletionInformation , FileMoveClusterInformation , FileOleClassIdInformation , FileOleStateBitsInformation ,   FileNetworkOpenInformation , FileObjectIdInformation , FileOleAllInformation , FileOleDirectoryInformation ,   FileContentIndexInformation , FileInheritContentIndexInformation , FileOleInformation , FileMaximumInformation ,   FileDirectoryInformation = 1 , FileFullDirectoryInformation , FileBothDirectoryInformation , FileBasicInformation ,   FileStandardInformation , FileInternalInformation , FileEaInformation , FileAccessInformation ,   FileNameInformation , FileRenameInformation , FileLinkInformation , FileNamesInformation ,   FileDispositionInformation , FilePositionInformation , FileFullEaInformation , FileModeInformation ,   FileAlignmentInformation , FileAllInformation , FileAllocationInformation , FileEndOfFileInformation ,   FileAlternateNameInformation , FileStreamInformation , FilePipeInformation , FilePipeLocalInformation ,   FilePipeRemoteInformation , FileMailslotQueryInformation , FileMailslotSetInformation , FileCompressionInformation ,   FileCopyOnWriteInformation , FileCompletionInformation , FileMoveClusterInformation , FileOleClassIdInformation ,   FileOleStateBitsInformation , FileNetworkOpenInformation , FileObjectIdInformation , FileOleAllInformation ,   FileOleDirectoryInformation , FileContentIndexInformation , FileInheritContentIndexInformation , FileOleInformation ,   FileMaximumInformation , FileDirectoryInformation = 1 , FileDirectoryInformation = 1 , FileFullDirectoryInformation ,   FileBothDirectoryInformation , FileBasicInformation , FileStandardInformation , FileInternalInformation ,   FileEaInformation , FileAccessInformation , FileNameInformation , FileRenameInformation ,   FileLinkInformation , FileNamesInformation , FileDispositionInformation , FilePositionInformation ,   FileFullEaInformation , FileModeInformation , FileAlignmentInformation , FileAllInformation ,   FileAllocationInformation , FileEndOfFileInformation , FileAlternateNameInformation , FileStreamInformation ,   FilePipeInformation , FilePipeLocalInformation , FilePipeRemoteInformation , FileMailslotQueryInformation ,   FileMailslotSetInformation , FileCompressionInformation , FileObjectIdInformation , FileCompletionInformation ,   FileMoveClusterInformation , FileQuotaInformation , FileReparsePointInformation , FileNetworkOpenInformation ,   FileAttributeTagInformation , FileTrackingInformation , FileIdBothDirectoryInformation , FileIdFullDirectoryInformation ,   FileValidDataLengthInformation , FileShortNameInformation , FileIoCompletionNotificationInformation , FileIoStatusBlockRangeInformation ,   FileIoPriorityHintInformation , FileSfioReserveInformation , FileSfioVolumeInformation , FileHardLinkInformation ,   FileProcessIdsUsingFileInformation , FileNormalizedNameInformation , FileNetworkPhysicalNameInformation , FileIdGlobalTxDirectoryInformation ,   FileIsRemoteDeviceInformation , FileAttributeCacheInformation , FileNumaNodeInformation , FileStandardLinkInformation ,   FileRemoteProtocolInformation , FileRenameInformationBypassAccessCheck , FileLinkInformationBypassAccessCheck , FileVolumeNameInformation ,   FileIdInformation , FileIdExtdDirectoryInformation , FileReplaceCompletionInformation , FileHardLinkFullIdInformation ,   FileIdExtdBothDirectoryInformation , FileDispositionInformationEx , FileRenameInformationEx , FileRenameInformationExBypassAccessCheck ,   FileDesiredStorageClassInformation , FileStatInformation , FileMemoryPartitionInformation , FileStatLxInformation ,   FileCaseSensitiveInformation , FileLinkInformationEx , FileLinkInformationExBypassAccessCheck , FileStorageReserveIdInformation ,   FileCaseSensitiveInformationForceAccessCheck , FileKnownFolderInformation , FileMaximumInformation , FileDirectoryInformation = 1 ,   FileFullDirectoryInformation , FileBothDirectoryInformation , FileBasicInformation , FileStandardInformation ,   FileInternalInformation , FileEaInformation , FileAccessInformation , FileNameInformation ,   FileRenameInformation , FileLinkInformation , FileNamesInformation , FileDispositionInformation ,   FilePositionInformation , FileFullEaInformation , FileModeInformation , FileAlignmentInformation ,   FileAllInformation , FileAllocationInformation , FileEndOfFileInformation , FileAlternateNameInformation ,   FileStreamInformation , FilePipeInformation , FilePipeLocalInformation , FilePipeRemoteInformation ,   FileMailslotQueryInformation , FileMailslotSetInformation , FileCompressionInformation , FileObjectIdInformation ,   FileCompletionInformation , FileMoveClusterInformation , FileQuotaInformation , FileReparsePointInformation ,   FileNetworkOpenInformation , FileAttributeTagInformation , FileTrackingInformation , FileIdBothDirectoryInformation ,   FileIdFullDirectoryInformation , FileValidDataLengthInformation , FileShortNameInformation , FileIoCompletionNotificationInformation ,   FileIoStatusBlockRangeInformation , FileIoPriorityHintInformation , FileSfioReserveInformation , FileSfioVolumeInformation ,   FileHardLinkInformation , FileProcessIdsUsingFileInformation , FileNormalizedNameInformation , FileNetworkPhysicalNameInformation ,   FileIdGlobalTxDirectoryInformation , FileIsRemoteDeviceInformation , FileAttributeCacheInformation , FileNumaNodeInformation ,   FileStandardLinkInformation , FileRemoteProtocolInformation , FileMaximumInformation }
enum	_KEY_SET_INFORMATION_CLASS {   KeyWriteTimeInformation , KeyWriteTimeInformation , KeyWow64FlagsInformation , KeyControlFlagsInformation ,   KeySetVirtualizationInformation , KeySetDebugInformation , KeySetHandleTagsInformation , MaxKeySetInfoClass ,   KeyWriteTimeInformation , KeyWow64FlagsInformation , KeyControlFlagsInformation , KeySetVirtualizationInformation ,   KeySetDebugInformation , KeySetHandleTagsInformation , MaxKeySetInfoClass }
enum	_PROCESSINFOCLASS {   ProcessBasicInformation = 0 , ProcessDebugPort = 7 , ProcessWow64Information = 26 , ProcessImageFileName = 27 ,   ProcessBreakOnTermination = 29 , ProcessBasicInformation = 0 , ProcessDebugPort = 7 , ProcessWow64Information = 26 ,   ProcessImageFileName = 27 , ProcessBreakOnTermination = 29 , ProcessBasicInformation = 0 , ProcessQuotaLimits = 1 ,   ProcessIoCounters = 2 , ProcessVmCounters = 3 , ProcessTimes = 4 , ProcessBasePriority = 5 ,   ProcessRaisePriority = 6 , ProcessDebugPort = 7 , ProcessExceptionPort = 8 , ProcessAccessToken = 9 ,   ProcessLdtInformation = 10 , ProcessLdtSize = 11 , ProcessDefaultHardErrorMode = 12 , ProcessIoPortHandlers = 13 ,   ProcessPooledUsageAndLimits = 14 , ProcessWorkingSetWatch = 15 , ProcessUserModeIOPL = 16 , ProcessEnableAlignmentFaultFixup = 17 ,   ProcessPriorityClass = 18 , ProcessWx86Information = 19 , ProcessHandleCount = 20 , ProcessAffinityMask = 21 ,   ProcessPriorityBoost = 22 , ProcessDeviceMap = 23 , ProcessSessionInformation = 24 , ProcessForegroundInformation = 25 ,   ProcessWow64Information = 26 , ProcessImageFileName = 27 , ProcessLUIDDeviceMapsEnabled = 28 , ProcessBreakOnTermination = 29 ,   ProcessDebugObjectHandle = 30 , ProcessDebugFlags = 31 , ProcessHandleTracing = 32 , ProcessIoPriority = 33 ,   ProcessExecuteFlags = 34 , ProcessTlsInformation = 35 , ProcessCookie = 36 , ProcessImageInformation = 37 ,   ProcessCycleTime = 38 , ProcessPagePriority = 39 , ProcessInstrumentationCallback = 40 , ProcessThreadStackAllocation = 41 ,   ProcessWorkingSetWatchEx = 42 , ProcessImageFileNameWin32 = 43 , ProcessImageFileMapping = 44 , ProcessAffinityUpdateMode = 45 ,   ProcessMemoryAllocationMode = 46 , ProcessGroupInformation = 47 , ProcessTokenVirtualizationEnabled = 48 , ProcessConsoleHostProcess = 49 ,   ProcessWindowInformation = 50 , ProcessHandleInformation = 51 , ProcessMitigationPolicy = 52 , ProcessDynamicFunctionTableInformation = 53 ,   ProcessHandleCheckingMode = 54 , ProcessKeepAliveCount = 55 , ProcessRevokeFileHandles = 56 , ProcessWorkingSetControl = 57 ,   ProcessHandleTable = 58 , ProcessCheckStackExtentsMode = 59 , ProcessCommandLineInformation = 60 , ProcessProtectionInformation = 61 ,   ProcessMemoryExhaustion = 62 , ProcessFaultInformation = 63 , ProcessTelemetryIdInformation = 64 , ProcessCommitReleaseInformation = 65 ,   ProcessDefaultCpuSetsInformation = 66 , ProcessAllowedCpuSetsInformation = 67 , ProcessSubsystemProcess = 68 , ProcessJobMemoryInformation = 69 ,   ProcessInPrivate = 70 , ProcessRaiseUMExceptionOnInvalidHandleClose = 71 , ProcessIumChallengeResponse = 72 , ProcessChildProcessInformation = 73 ,   ProcessHighGraphicsPriorityInformation = 74 , ProcessSubsystemInformation = 75 , ProcessEnergyValues = 76 , ProcessPowerThrottlingState = 77 ,   ProcessReserved3Information = 78 , ProcessWin32kSyscallFilterInformation = 79 , ProcessDisableSystemAllowedCpuSets = 80 , ProcessWakeInformation = 81 ,   ProcessEnergyTrackingState = 82 , ProcessManageWritesToExecutableMemory = 83 , ProcessCaptureTrustletLiveDump = 84 , ProcessTelemetryCoverage = 85 ,   ProcessEnclaveInformation = 86 , ProcessEnableReadWriteVmLogging = 87 , ProcessUptimeInformation = 88 , ProcessImageSection = 89 ,   ProcessDebugAuthInformation = 90 , ProcessSystemResourceManagement = 91 , ProcessSequenceNumber = 92 , ProcessLoaderDetour = 93 ,   ProcessSecurityDomainInformation = 94 , ProcessCombineSecurityDomainsInformation = 95 , ProcessEnableLogging = 96 , ProcessLeapSecondInformation = 97 ,   ProcessFiberShadowStackAllocation = 98 , ProcessFreeFiberShadowStackAllocation = 99 , ProcessAltSystemCallInformation = 100 , ProcessDynamicEHContinuationTargets = 101 ,   ProcessDynamicEnforcedCetCompatibleRanges = 102 , ProcessCreateStateChange = 103 , ProcessApplyStateChange = 104 , ProcessEnableOptionalXStateFeatures = 105 ,   ProcessAltPrefetchParam = 106 , ProcessAssignCpuPartitions = 107 , ProcessPriorityClassEx = 108 , ProcessMembershipInformation = 109 ,   ProcessEffectiveIoPriority = 110 , ProcessEffectivePagePriority = 111 , MaxProcessInfoClass , ProcessBasicInformation ,   ProcessQuotaLimits , ProcessIoCounters , ProcessVmCounters , ProcessTimes ,   ProcessBasePriority , ProcessRaisePriority , ProcessDebugPort , ProcessExceptionPort ,   ProcessAccessToken , ProcessLdtInformation , ProcessLdtSize , ProcessDefaultHardErrorMode ,   ProcessIoPortHandlers , ProcessPooledUsageAndLimits , ProcessWorkingSetWatch , ProcessUserModeIOPL ,   ProcessEnableAlignmentFaultFixup , ProcessPriorityClass , ProcessWx86Information , ProcessHandleCount ,   ProcessAffinityMask , ProcessPriorityBoost , ProcessDeviceMap , ProcessSessionInformation ,   ProcessForegroundInformation , ProcessWow64Information , ProcessImageFileName , ProcessLUIDDeviceMapsEnabled ,   ProcessBreakOnTermination , ProcessDebugObjectHandle , ProcessDebugFlags , ProcessHandleTracing ,   ProcessIoPriority , ProcessExecuteFlags , ProcessTlsInformation , ProcessCookie ,   ProcessImageInformation , ProcessCycleTime , ProcessPagePriority , ProcessInstrumentationCallback ,   ProcessThreadStackAllocation , ProcessWorkingSetWatchEx , ProcessImageFileNameWin32 , ProcessImageFileMapping ,   ProcessAffinityUpdateMode , ProcessMemoryAllocationMode , ProcessGroupInformation , ProcessTokenVirtualizationEnabled ,   ProcessConsoleHostProcess , ProcessWindowInformation , MaxProcessInfoClass }
enum	_THREADINFOCLASS {   ThreadBasicInformation , ThreadTimes , ThreadPriority , ThreadBasePriority ,   ThreadAffinityMask , ThreadImpersonationToken , ThreadDescriptorTableEntry , ThreadEnableAlignmentFaultFixup ,   ThreadEventPair_Reusable , ThreadQuerySetWin32StartAddress , ThreadZeroTlsCell , ThreadPerformanceCount ,   ThreadAmILastThread , ThreadIdealProcessor , ThreadPriorityBoost , ThreadSetTlsArrayAddress ,   ThreadIsIoPending , ThreadHideFromDebugger , ThreadBreakOnTermination , ThreadSwitchLegacyState ,   ThreadIsTerminated , ThreadLastSystemCall , ThreadIoPriority , ThreadCycleTime ,   ThreadPagePriority , ThreadActualBasePriority , ThreadTebInformation , ThreadCSwitchMon ,   ThreadCSwitchPmu , ThreadWow64Context , ThreadGroupInformation , ThreadUmsInformation ,   ThreadCounterProfiling , ThreadIdealProcessorEx , MaxThreadInfoClass , ThreadIsIoPending = 16 ,   ThreadBasicInformation = 0 , ThreadTimes , ThreadPriority , ThreadBasePriority ,   ThreadAffinityMask , ThreadImpersonationToken , ThreadDescriptorTableEntry , ThreadEnableAlignmentFaultFixup ,   ThreadEventPair_Reusable , ThreadQuerySetWin32StartAddress , ThreadZeroTlsCell , ThreadPerformanceCount ,   ThreadAmILastThread , ThreadIdealProcessor , ThreadPriorityBoost , ThreadSetTlsArrayAddress ,   ThreadIsIoPending , ThreadHideFromDebugger , ThreadBreakOnTermination , ThreadSwitchLegacyState ,   ThreadIsTerminated , ThreadLastSystemCall , ThreadIoPriority , ThreadCycleTime ,   ThreadPagePriority , ThreadActualBasePriority , ThreadTebInformation , ThreadCSwitchMon ,   ThreadCSwitchPmu , ThreadWow64Context , ThreadGroupInformation , ThreadUmsInformation ,   ThreadCounterProfiling , ThreadIdealProcessorEx , ThreadCpuAccountingInformation , ThreadSuspendCount ,   ThreadHeterogeneousCpuPolicy , ThreadContainerId , ThreadNameInformation , ThreadSelectedCpuSets ,   ThreadSystemThreadInformation , ThreadActualGroupAffinity , ThreadDynamicCodePolicyInfo , ThreadExplicitCaseSensitivity ,   ThreadWorkOnBehalfTicket , ThreadSubsystemInformation , ThreadDbgkWerReportActive , ThreadAttachContainer ,   ThreadManageWritesToExecutableMemory , ThreadPowerThrottlingState , ThreadWorkloadClass , ThreadCreateStateChange ,   ThreadApplyStateChange , ThreadStrongerBadHandleChecks , ThreadEffectiveIoPriority , ThreadEffectivePagePriority ,   MaxThreadInfoClass , ThreadBasicInformation , ThreadTimes , ThreadPriority ,   ThreadBasePriority , ThreadAffinityMask , ThreadImpersonationToken , ThreadDescriptorTableEntry ,   ThreadEnableAlignmentFaultFixup , ThreadEventPair_Reusable , ThreadQuerySetWin32StartAddress , ThreadZeroTlsCell ,   ThreadPerformanceCount , ThreadAmILastThread , ThreadIdealProcessor , ThreadPriorityBoost ,   ThreadSetTlsArrayAddress , ThreadIsIoPending , ThreadHideFromDebugger , ThreadBreakOnTermination ,   ThreadSwitchLegacyState , ThreadIsTerminated , ThreadLastSystemCall , ThreadIoPriority ,   ThreadCycleTime , ThreadPagePriority , ThreadActualBasePriority , ThreadTebInformation ,   ThreadCSwitchMon , ThreadCSwitchPmu , ThreadWow64Context , ThreadGroupInformation ,   ThreadUmsInformation , ThreadCounterProfiling , ThreadIdealProcessorEx , ThreadCpuAccountingInformation ,   ThreadSuspendCount , ThreadHeterogeneousCpuPolicy , ThreadContainerId , ThreadNameInformation ,   ThreadSelectedCpuSets , ThreadSystemThreadInformation , ThreadActualGroupAffinity , ThreadDynamicCodePolicyInfo ,   ThreadExplicitCaseSensitivity , ThreadWorkOnBehalfTicket , ThreadSubsystemInformation , ThreadDbgkWerReportActive ,   ThreadAttachContainer , ThreadManageWritesToExecutableMemory , ThreadPowerThrottlingState , ThreadWorkloadClass ,   ThreadCreateStateChange , ThreadApplyStateChange , ThreadStrongerBadHandleChecks , ThreadEffectiveIoPriority ,   ThreadEffectivePagePriority , MaxThreadInfoClass }
enum	_OBJECT_INFORMATION_CLASS {   ObjectBasicInformation , ObjectNameInformation , ObjectTypeInformation , ObjectAllTypesInformation ,   ObjectHandleInformation , ObjectBasicInformation = 0 , ObjectNameInformation , ObjectTypeInformation ,   ObjectTypesInformation , ObjectHandleFlagInformation , ObjectSessionInformation , ObjectSessionObjectInformation ,   ObjectSetRefTraceInformation , MaxObjectInfoClass , ObjectBasicInformation = 0 , ObjectTypeInformation = 2 ,   ObjectBasicInformation , ObjectNameInformation , ObjectTypeInformation , ObjectTypesInformation ,   ObjectHandleFlagInformation , ObjectSessionInformation , ObjectSessionObjectInformation }
enum	_SYSTEM_INFORMATION_CLASS {   SystemBasicInformation , SystemProcessorInformation , SystemPerformanceInformation , SystemTimeOfDayInformation ,   SystemPathInformation , SystemProcessInformation , SystemCallCountInformation , SystemDeviceInformation ,   SystemProcessorPerformanceInformation , SystemFlagsInformation , SystemCallTimeInformation , SystemModuleInformation ,   SystemLocksInformation , SystemStackTraceInformation , SystemPagedPoolInformation , SystemNonPagedPoolInformation ,   SystemHandleInformation , SystemObjectInformation , SystemPageFileInformation , SystemVdmInstemulInformation ,   SystemVdmBopInformation , SystemFileCacheInformation , SystemPoolTagInformation , SystemInterruptInformation ,   SystemDpcBehaviorInformation , SystemFullMemoryInformation , SystemLoadGdiDriverInformation , SystemUnloadGdiDriverInformation ,   SystemTimeAdjustmentInformation , SystemSummaryMemoryInformation , SystemNextEventIdInformation , SystemEventIdsInformation ,   SystemCrashDumpInformation , SystemExceptionInformation , SystemCrashDumpStateInformation , SystemKernelDebuggerInformation ,   SystemContextSwitchInformation , SystemRegistryQuotaInformation , SystemExtendServiceTableInformation , SystemPrioritySeperation ,   SystemPlugPlayBusInformation , SystemDockInformation , SystemPowerInformation , SystemProcessorSpeedInformation ,   SystemCurrentTimeZoneInformation , SystemLookasideInformation , SystemBasicInformation , SystemProcessorInformation ,   SystemPerformanceInformation , SystemTimeOfDayInformation , SystemPathInformation , SystemProcessInformation ,   SystemCallCountInformation , SystemDeviceInformation , SystemProcessorPerformanceInformation , SystemFlagsInformation ,   SystemCallTimeInformation , SystemModuleInformation , SystemLocksInformation , SystemStackTraceInformation ,   SystemPagedPoolInformation , SystemNonPagedPoolInformation , SystemHandleInformation , SystemObjectInformation ,   SystemPageFileInformation , SystemVdmInstemulInformation , SystemVdmBopInformation , SystemFileCacheInformation ,   SystemPoolTagInformation , SystemInterruptInformation , SystemDpcBehaviorInformation , SystemFullMemoryInformation ,   SystemLoadGdiDriverInformation , SystemUnloadGdiDriverInformation , SystemTimeAdjustmentInformation , SystemSummaryMemoryInformation ,   SystemNextEventIdInformation , SystemEventIdsInformation , SystemCrashDumpInformation , SystemExceptionInformation ,   SystemCrashDumpStateInformation , SystemKernelDebuggerInformation , SystemContextSwitchInformation , SystemRegistryQuotaInformation ,   SystemExtendServiceTableInformation , SystemPrioritySeperation , SystemPlugPlayBusInformation , SystemDockInformation ,   SystemPowerInformation , SystemProcessorSpeedInformation , SystemCurrentTimeZoneInformation , SystemLookasideInformation ,   SystemBasicInformation = 0 , SystemProcessorInformation = 1 , SystemPerformanceInformation = 2 , SystemTimeOfDayInformation = 3 ,   SystemPathInformation = 4 , SystemProcessInformation = 5 , SystemCallCountInformation = 6 , SystemDeviceInformation = 7 ,   SystemProcessorPerformanceInformation = 8 , SystemFlagsInformation = 9 , SystemCallTimeInformation = 10 , SystemModuleInformation = 11 ,   SystemLocksInformation = 12 , SystemStackTraceInformation = 13 , SystemPagedPoolInformation = 14 , SystemNonPagedPoolInformation = 15 ,   SystemHandleInformation = 16 , SystemObjectInformation = 17 , SystemPageFileInformation = 18 , SystemVdmInstemulInformation = 19 ,   SystemVdmBopInformation = 20 , SystemFileCacheInformation = 21 , SystemPoolTagInformation = 22 , SystemInterruptInformation = 23 ,   SystemDpcBehaviorInformation = 24 , SystemFullMemoryInformation = 25 , SystemLoadGdiDriverInformation = 26 , SystemUnloadGdiDriverInformation = 27 ,   SystemTimeAdjustmentInformation = 28 , SystemSummaryMemoryInformation = 29 , SystemMirrorMemoryInformation = 30 , SystemPerformanceTraceInformation = 31 ,   SystemObsolete0 = 32 , SystemExceptionInformation = 33 , SystemCrashDumpStateInformation = 34 , SystemKernelDebuggerInformation = 35 ,   SystemContextSwitchInformation = 36 , SystemRegistryQuotaInformation = 37 , SystemExtendServiceTableInformation = 38 , SystemPrioritySeperation = 39 ,   SystemVerifierAddDriverInformation = 40 , SystemVerifierRemoveDriverInformation = 41 , SystemProcessorIdleInformation = 42 , SystemLegacyDriverInformation = 43 ,   SystemCurrentTimeZoneInformation = 44 , SystemLookasideInformation = 45 , SystemTimeSlipNotification = 46 , SystemSessionCreate = 47 ,   SystemSessionDetach = 48 , SystemSessionInformation = 49 , SystemRangeStartInformation = 50 , SystemVerifierInformation = 51 ,   SystemVerifierThunkExtend = 52 , SystemSessionProcessInformation = 53 , SystemLoadGdiDriverInSystemSpace = 54 , SystemNumaProcessorMap = 55 ,   SystemPrefetcherInformation = 56 , SystemExtendedProcessInformation = 57 , SystemRecommendedSharedDataAlignment = 58 , SystemComPlusPackage = 59 ,   SystemNumaAvailableMemory = 60 , SystemProcessorPowerInformation = 61 , SystemEmulationBasicInformation = 62 , SystemEmulationProcessorInformation = 63 ,   SystemExtendedHandleInformation = 64 , SystemLostDelayedWriteInformation = 65 , SystemBigPoolInformation = 66 , SystemSessionPoolTagInformation = 67 ,   SystemSessionMappedViewInformation = 68 , SystemHotpatchInformation = 69 , SystemObjectSecurityMode = 70 , SystemWatchdogTimerHandler = 71 ,   SystemWatchdogTimerInformation = 72 , SystemLogicalProcessorInformation = 73 , SystemWow64SharedInformationObsolete = 74 , SystemRegisterFirmwareTableInformationHandler = 75 ,   SystemFirmwareTableInformation = 76 , SystemModuleInformationEx = 77 , SystemVerifierTriageInformation = 78 , SystemSuperfetchInformation = 79 ,   SystemMemoryListInformation = 80 , SystemFileCacheInformationEx = 81 , SystemThreadPriorityClientIdInformation = 82 , SystemProcessorIdleCycleTimeInformation = 83 ,   SystemVerifierCancellationInformation = 84 , SystemProcessorPowerInformationEx = 85 , SystemRefTraceInformation = 86 , SystemSpecialPoolInformation = 87 ,   SystemProcessIdInformation = 88 , SystemErrorPortInformation = 89 , SystemBootEnvironmentInformation = 90 , SystemHypervisorInformation = 91 ,   SystemVerifierInformationEx = 92 , SystemTimeZoneInformation = 93 , SystemImageFileExecutionOptionsInformation = 94 , SystemCoverageInformation = 95 ,   SystemPrefetchPatchInformation = 96 , SystemVerifierFaultsInformation = 97 , SystemSystemPartitionInformation = 98 , SystemSystemDiskInformation = 99 ,   SystemProcessorPerformanceDistribution = 100 , SystemNumaProximityNodeInformation = 101 , SystemDynamicTimeZoneInformation = 102 , SystemCodeIntegrityInformation = 103 ,   SystemProcessorMicrocodeUpdateInformation = 104 , SystemProcessorBrandString = 105 , SystemVirtualAddressInformation = 106 , SystemLogicalProcessorAndGroupInformation = 107 ,   SystemProcessorCycleTimeInformation = 108 , SystemStoreInformation = 109 , SystemRegistryAppendString = 110 , SystemAitSamplingValue = 111 ,   SystemVhdBootInformation = 112 , SystemCpuQuotaInformation = 113 , SystemNativeBasicInformation = 114 , SystemErrorPortTimeouts = 115 ,   SystemLowPriorityIoInformation = 116 , SystemBootEntropyInformation = 117 , SystemVerifierCountersInformation = 118 , SystemPagedPoolInformationEx = 119 ,   SystemSystemPtesInformationEx = 120 , SystemNodeDistanceInformation = 121 , SystemAcpiAuditInformation = 122 , SystemBasicPerformanceInformation = 123 ,   SystemQueryPerformanceCounterInformation = 124 , SystemSessionBigPoolInformation = 125 , SystemBootGraphicsInformation = 126 , SystemScrubPhysicalMemoryInformation = 127 ,   SystemBadPageInformation = 128 , SystemProcessorProfileControlArea = 129 , SystemCombinePhysicalMemoryInformation = 130 , SystemEntropyInterruptTimingInformation = 131 ,   SystemConsoleInformation = 132 , SystemPlatformBinaryInformation = 133 , SystemThrottleNotificationInformation = 134 , SystemPolicyInformation = 134 ,   SystemHypervisorProcessorCountInformation = 135 , SystemDeviceDataInformation = 136 , SystemDeviceDataEnumerationInformation = 137 , SystemMemoryTopologyInformation = 138 ,   SystemMemoryChannelInformation = 139 , SystemBootLogoInformation = 140 , SystemProcessorPerformanceInformationEx = 141 , SystemSpare0 = 142 ,   SystemCriticalProcessErrorLogInformation = 142 , SystemSecureBootPolicyInformation = 143 , SystemPageFileInformationEx = 144 , SystemSecureBootInformation = 145 ,   SystemEntropyInterruptTimingRawInformation = 146 , SystemPortableWorkspaceEfiLauncherInformation = 147 , SystemFullProcessInformation = 148 , SystemKernelDebuggerInformationEx = 149 ,   SystemBootMetadataInformation = 150 , SystemSoftRebootInformation = 151 , SystemElamCertificateInformation = 152 , SystemOfflineDumpConfigInformation = 153 ,   SystemProcessorFeaturesInformation = 154 , SystemRegistryReconciliationInformation = 155 , SystemEdidInformation = 156 , SystemManufacturingInformation = 157 ,   SystemEnergyEstimationConfigInformation = 158 , SystemHypervisorDetailInformation = 159 , SystemProcessorCycleStatsInformation = 160 , SystemVmGenerationCountInformation = 161 ,   SystemTrustedPlatformModuleInformation = 162 , SystemKernelDebuggerFlags = 163 , SystemCodeIntegrityPolicyInformation = 164 , SystemIsolatedUserModeInformation = 165 ,   SystemHardwareSecurityTestInterfaceResultsInformation = 166 , SystemSingleModuleInformation = 167 , SystemAllowedCpuSetsInformation = 168 , SystemVsmProtectionInformation = 169 ,   SystemInterruptCpuSetsInformation = 170 , SystemSecureBootPolicyFullInformation = 171 , SystemCodeIntegrityPolicyFullInformation = 172 , SystemAffinitizedInterruptProcessorInformation = 173 ,   SystemRootSiloInformation = 174 , SystemCpuSetInformation = 175 , SystemCpuSetTagInformation = 176 , SystemWin32WerStartCallout = 177 ,   SystemSecureKernelProfileInformation = 178 , SystemCodeIntegrityPlatformManifestInformation = 179 , SystemInterruptSteeringInformation = 180 , SystemSupportedProcessorArchitectures = 181 ,   SystemMemoryUsageInformation = 182 , SystemCodeIntegrityCertificateInformation = 183 , SystemPhysicalMemoryInformation = 184 , SystemControlFlowTransition = 185 ,   SystemKernelDebuggingAllowed = 186 , SystemActivityModerationExeState = 187 , SystemActivityModerationUserSettings = 188 , SystemCodeIntegrityPoliciesFullInformation = 189 ,   SystemCodeIntegrityUnlockInformation = 190 , SystemIntegrityQuotaInformation = 191 , SystemFlushInformation = 192 , SystemProcessorIdleMaskInformation = 193 ,   SystemSecureDumpEncryptionInformation = 194 , SystemWriteConstraintInformation = 195 , SystemKernelVaShadowInformation = 196 , SystemHypervisorSharedPageInformation = 197 ,   SystemFirmwareBootPerformanceInformation = 198 , SystemCodeIntegrityVerificationInformation = 199 , SystemFirmwarePartitionInformation = 200 , SystemSpeculationControlInformation = 201 ,   SystemDmaGuardPolicyInformation = 202 , SystemEnclaveLaunchControlInformation = 203 , SystemWorkloadAllowedCpuSetsInformation = 204 , SystemCodeIntegrityUnlockModeInformation = 205 ,   SystemLeapSecondInformation = 206 , SystemFlags2Information = 207 , SystemSecurityModelInformation = 208 , SystemCodeIntegritySyntheticCacheInformation = 209 ,   SystemFeatureConfigurationInformation = 210 , SystemFeatureConfigurationSectionInformation = 211 , SystemFeatureUsageSubscriptionInformation = 212 , SystemSecureSpeculationControlInformation = 213 ,   SystemSpacesBootInformation = 214 , SystemFwRamdiskInformation = 215 , SystemWheaIpmiHardwareInformation = 216 , SystemDifSetRuleClassInformation = 217 ,   SystemDifClearRuleClassInformation = 218 , SystemDifApplyPluginVerificationOnDriver = 219 , SystemDifRemovePluginVerificationOnDriver = 220 , SystemShadowStackInformation = 221 ,   SystemBuildVersionInformation = 222 , SystemPoolLimitInformation = 223 , SystemCodeIntegrityAddDynamicStore = 224 , SystemCodeIntegrityClearDynamicStores = 225 ,   SystemDifPoolTrackingInformation = 226 , SystemPoolZeroingInformation = 227 , SystemDpcWatchdogInformation = 228 , SystemDpcWatchdogInformation2 = 229 ,   SystemSupportedProcessorArchitectures2 = 230 , SystemSingleProcessorRelationshipInformation = 231 , SystemXfgCheckFailureInformation = 232 , SystemIommuStateInformation = 233 ,   SystemHypervisorMinrootInformation = 234 , SystemHypervisorBootPagesInformation = 235 , SystemPointerAuthInformation = 236 , SystemSecureKernelDebuggerInformation = 237 ,   SystemOriginalImageFeatureInformation = 238 , SystemMemoryNumaInformation = 239 , SystemMemoryNumaPerformanceInformation = 240 , SystemCodeIntegritySignedPoliciesFullInformation = 241 ,   SystemSecureSecretsInformation = 242 , SystemTrustedAppsRuntimeInformation = 243 , SystemBadPageInformationEx = 244 , SystemResourceDeadlockTimeout = 245 ,   SystemBreakOnContextUnwindFailureInformation = 246 , SystemOslRamdiskInformation = 247 , MaxSystemInfoClass , SystemBasicInformation = 0 ,   SystemPerformanceInformation = 2 , SystemTimeOfDayInformation = 3 , SystemProcessInformation = 5 , SystemProcessorPerformanceInformation = 8 ,   SystemInterruptInformation = 23 , SystemExceptionInformation = 33 , SystemRegistryQuotaInformation = 37 , SystemLookasideInformation = 45 ,   SystemPolicyInformation = 134 , SystemBasicInformation = 0 , SystemCpuInformation = 1 , SystemPerformanceInformation = 2 ,   SystemTimeOfDayInformation = 3 , SystemPathInformation = 4 , SystemProcessInformation = 5 , SystemCallCountInformation = 6 ,   SystemDeviceInformation = 7 , SystemProcessorPerformanceInformation = 8 , SystemFlagsInformation = 9 , SystemCallTimeInformation = 10 ,   SystemModuleInformation = 11 , SystemLocksInformation = 12 , SystemStackTraceInformation = 13 , SystemPagedPoolInformation = 14 ,   SystemNonPagedPoolInformation = 15 , SystemHandleInformation = 16 , SystemObjectInformation = 17 , SystemPageFileInformation = 18 ,   SystemVdmInstemulInformation = 19 , SystemVdmBopInformation = 20 , SystemFileCacheInformation = 21 , SystemPoolTagInformation = 22 ,   SystemInterruptInformation = 23 , SystemDpcBehaviorInformation = 24 , SystemFullMemoryInformation = 25 , SystemNotImplemented6 = 25 ,   SystemLoadGdiDriverInformation = 26 , SystemUnloadGdiDriverInformation = 27 , SystemTimeAdjustmentInformation = 28 , SystemTimeAdjustment = 28 ,   SystemSummaryMemoryInformation = 29 , SystemMirrorMemoryInformation = 30 , SystemPerformanceTraceInformation = 31 , SystemObsolete0 = 32 ,   SystemExceptionInformation = 33 , SystemCrashDumpStateInformation = 34 , SystemKernelDebuggerInformation = 35 , SystemContextSwitchInformation = 36 ,   SystemRegistryQuotaInformation = 37 , SystemExtendServiceTableInformation = 38 , SystemPrioritySeparation = 39 , SystemVerifierAddDriverInformation = 40 ,   SystemVerifierRemoveDriverInformation = 41 , SystemProcessorIdleInformation = 42 , SystemLegacyDriverInformation = 43 , SystemCurrentTimeZoneInformation = 44 ,   SystemLookasideInformation = 45 , SystemTimeSlipNotification = 46 , SystemSessionCreate = 47 , SystemSessionDetach = 48 ,   SystemSessionInformation = 49 , SystemRangeStartInformation = 50 , SystemVerifierInformation = 51 , SystemVerifierThunkExtend = 52 ,   SystemSessionProcessesInformation = 53 , SystemLoadGdiDriverInSystemSpace = 54 , SystemNumaProcessorMap = 55 , SystemPrefetcherInformation = 56 ,   SystemExtendedProcessInformation = 57 , SystemRecommendedSharedDataAlignment = 58 , SystemComPlusPackage = 59 , SystemNumaAvailableMemory = 60 ,   SystemProcessorPowerInformation = 61 , SystemEmulationBasicInformation = 62 , SystemEmulationProcessorInformation = 63 , SystemExtendedHandleInformation = 64 ,   SystemLostDelayedWriteInformation = 65 , SystemBigPoolInformation = 66 , SystemSessionPoolTagInformation = 67 , SystemSessionMappedViewInformation = 68 ,   SystemHotpatchInformation = 69 , SystemObjectSecurityMode = 70 , SystemWatchdogTimerHandler = 71 , SystemWatchdogTimerInformation = 72 ,   SystemLogicalProcessorInformation = 73 , SystemWow64SharedInformationObsolete = 74 , SystemRegisterFirmwareTableInformationHandler = 75 , SystemFirmwareTableInformation = 76 ,   SystemModuleInformationEx = 77 , SystemVerifierTriageInformation = 78 , SystemSuperfetchInformation = 79 , SystemMemoryListInformation = 80 ,   SystemFileCacheInformationEx = 81 , SystemThreadPriorityClientIdInformation = 82 , SystemProcessorIdleCycleTimeInformation = 83 , SystemVerifierCancellationInformation = 84 ,   SystemProcessorPowerInformationEx = 85 , SystemRefTraceInformation = 86 , SystemSpecialPoolInformation = 87 , SystemProcessIdInformation = 88 ,   SystemErrorPortInformation = 89 , SystemBootEnvironmentInformation = 90 , SystemHypervisorInformation = 91 , SystemVerifierInformationEx = 92 ,   SystemTimeZoneInformation = 93 , SystemImageFileExecutionOptionsInformation = 94 , SystemCoverageInformation = 95 , SystemPrefetchPatchInformation = 96 ,   SystemVerifierFaultsInformation = 97 , SystemSystemPartitionInformation = 98 , SystemSystemDiskInformation = 99 , SystemProcessorPerformanceDistribution = 100 ,   SystemNumaProximityNodeInformation = 101 , SystemDynamicTimeZoneInformation = 102 , SystemCodeIntegrityInformation = 103 , SystemProcessorMicrocodeUpdateInformation = 104 ,   SystemProcessorBrandString = 105 , SystemVirtualAddressInformation = 106 , SystemLogicalProcessorInformationEx = 107 , SystemProcessorCycleTimeInformation = 108 ,   SystemStoreInformation = 109 , SystemRegistryAppendString = 110 , SystemAitSamplingValue = 111 , SystemVhdBootInformation = 112 ,   SystemCpuQuotaInformation = 113 , SystemNativeBasicInformation = 114 , SystemErrorPortTimeouts = 115 , SystemLowPriorityIoInformation = 116 ,   SystemTpmBootEntropyInformation = 117 , SystemVerifierCountersInformation = 118 , SystemPagedPoolInformationEx = 119 , SystemSystemPtesInformationEx = 120 ,   SystemNodeDistanceInformation = 121 , SystemAcpiAuditInformation = 122 , SystemBasicPerformanceInformation = 123 , SystemQueryPerformanceCounterInformation = 124 ,   SystemSessionBigPoolInformation = 125 , SystemBootGraphicsInformation = 126 , SystemScrubPhysicalMemoryInformation = 127 , SystemBadPageInformation = 128 ,   SystemProcessorProfileControlArea = 129 , SystemCombinePhysicalMemoryInformation = 130 , SystemEntropyInterruptTimingInformation = 131 , SystemConsoleInformation = 132 ,   SystemPlatformBinaryInformation = 133 , SystemPolicyInformation = 134 , SystemHypervisorProcessorCountInformation = 135 , SystemDeviceDataInformation = 136 ,   SystemDeviceDataEnumerationInformation = 137 , SystemMemoryTopologyInformation = 138 , SystemMemoryChannelInformation = 139 , SystemBootLogoInformation = 140 ,   SystemProcessorPerformanceInformationEx = 141 , SystemCriticalProcessErrorLogInformation = 142 , SystemSecureBootPolicyInformation = 143 , SystemPageFileInformationEx = 144 ,   SystemSecureBootInformation = 145 , SystemEntropyInterruptTimingRawInformation = 146 , SystemPortableWorkspaceEfiLauncherInformation = 147 , SystemFullProcessInformation = 148 ,   SystemKernelDebuggerInformationEx = 149 , SystemBootMetadataInformation = 150 , SystemSoftRebootInformation = 151 , SystemElamCertificateInformation = 152 ,   SystemOfflineDumpConfigInformation = 153 , SystemProcessorFeaturesInformation = 154 , SystemRegistryReconciliationInformation = 155 , SystemEdidInformation = 156 ,   SystemManufacturingInformation = 157 , SystemEnergyEstimationConfigInformation = 158 , SystemHypervisorDetailInformation = 159 , SystemProcessorCycleStatsInformation = 160 ,   SystemVmGenerationCountInformation = 161 , SystemTrustedPlatformModuleInformation = 162 , SystemKernelDebuggerFlags = 163 , SystemCodeIntegrityPolicyInformation = 164 ,   SystemIsolatedUserModeInformation = 165 , SystemHardwareSecurityTestInterfaceResultsInformation = 166 , SystemSingleModuleInformation = 167 , SystemAllowedCpuSetsInformation = 168 ,   SystemVsmProtectionInformation = 169 , SystemInterruptCpuSetsInformation = 170 , SystemSecureBootPolicyFullInformation = 171 , SystemCodeIntegrityPolicyFullInformation = 172 ,   SystemAffinitizedInterruptProcessorInformation = 173 , SystemRootSiloInformation = 174 , SystemCpuSetInformation = 175 , SystemCpuSetTagInformation = 176 ,   SystemWin32WerStartCallout = 177 , SystemSecureKernelProfileInformation = 178 , SystemCodeIntegrityPlatformManifestInformation = 179 , SystemInterruptSteeringInformation = 180 ,   SystemSupportedProcessorArchitectures = 181 , SystemMemoryUsageInformation = 182 , SystemCodeIntegrityCertificateInformation = 183 , SystemPhysicalMemoryInformation = 184 ,   SystemControlFlowTransition = 185 , SystemKernelDebuggingAllowed = 186 , SystemActivityModerationExeState = 187 , SystemActivityModerationUserSettings = 188 ,   SystemCodeIntegrityPoliciesFullInformation = 189 , SystemCodeIntegrityUnlockInformation = 190 , SystemIntegrityQuotaInformation = 191 , SystemFlushInformation = 192 ,   SystemProcessorIdleMaskInformation = 193 , SystemSecureDumpEncryptionInformation = 194 , SystemWriteConstraintInformation = 195 , SystemKernelVaShadowInformation = 196 ,   SystemHypervisorSharedPageInformation = 197 , SystemFirmwareBootPerformanceInformation = 198 , SystemCodeIntegrityVerificationInformation = 199 , SystemFirmwarePartitionInformation = 200 ,   SystemSpeculationControlInformation = 201 , SystemDmaGuardPolicyInformation = 202 , SystemEnclaveLaunchControlInformation = 203 , SystemWorkloadAllowedCpuSetsInformation = 204 ,   SystemCodeIntegrityUnlockModeInformation = 205 , SystemLeapSecondInformation = 206 , SystemFlags2Information = 207 , SystemSecurityModelInformation = 208 ,   SystemCodeIntegritySyntheticCacheInformation = 209 , SystemFeatureConfigurationInformation = 210 , SystemFeatureConfigurationSectionInformation = 211 , SystemFeatureUsageSubscriptionInformation = 212 ,   SystemSecureSpeculationControlInformation = 213 , SystemSpacesBootInformation = 214 , SystemFwRamdiskInformation = 215 , SystemWheaIpmiHardwareInformation = 216 ,   SystemDifSetRuleClassInformation = 217 , SystemDifClearRuleClassInformation = 218 , SystemDifApplyPluginVerificationOnDriver = 219 , SystemDifRemovePluginVerificationOnDriver = 220 ,   SystemShadowStackInformation = 221 , SystemBuildVersionInformation = 222 , SystemPoolLimitInformation = 223 , SystemCodeIntegrityAddDynamicStore = 224 ,   SystemCodeIntegrityClearDynamicStores = 225 , SystemDifPoolTrackingInformation = 226 , SystemPoolZeroingInformation = 227 , SystemDpcWatchdogInformation = 228 ,   SystemDpcWatchdogInformation2 = 229 , SystemSupportedProcessorArchitectures2 = 230 , SystemSingleProcessorRelationshipInformation = 231 , SystemXfgCheckFailureInformation = 232 ,   SystemIommuStateInformation = 233 , SystemHypervisorMinrootInformation = 234 , SystemHypervisorBootPagesInformation = 235 , SystemPointerAuthInformation = 236 ,   SystemSecureKernelDebuggerInformation = 237 , SystemOriginalImageFeatureInformation = 238 }
enum	_WINSTATIONINFOCLASS { WinStationInformation = 8 , WinStationInformation = 8 }

Functions
typedef	_Return_type_success_ (return >=0) LONG NTSTATUS
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtCreateFile (_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_opt_ PLARGE_INTEGER AllocationSize, _In_ ULONG FileAttributes, _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition, _In_ ULONG CreateOptions, _In_reads_bytes_opt_(EaLength) PVOID EaBuffer, _In_ ULONG EaLength)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtOpenFile (_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG ShareAccess, _In_ ULONG OpenOptions)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtClose (_In_ HANDLE Handle)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtDeviceIoControlFile (_In_ HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG IoControlCode, _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtWaitForSingleObject (_In_ HANDLE Object, _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtRenameKey (_In_ HANDLE KeyHandle, _In_ PUNICODE_STRING NewName)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtNotifyChangeMultipleKeys (_In_ HANDLE MasterKeyHandle, _In_opt_ ULONG Count, _In_reads_opt_(Count) OBJECT_ATTRIBUTES SubordinateObjects[], _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG CompletionFilter, _In_ BOOLEAN WatchTree, _Out_writes_bytes_opt_(BufferSize) PVOID Buffer, _In_ ULONG BufferSize, _In_ BOOLEAN Asynchronous)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtQueryMultipleValueKey (_In_ HANDLE KeyHandle, _Inout_updates_(EntryCount) PKEY_VALUE_ENTRY ValueEntries, _In_ ULONG EntryCount, _Out_writes_bytes_(*BufferLength) PVOID ValueBuffer, _Inout_ PULONG BufferLength, _Out_opt_ PULONG RequiredBufferLength)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtSetInformationKey (_In_ HANDLE KeyHandle, _In_ _Strict_type_match_ KEY_SET_INFORMATION_CLASS KeySetInformationClass, _In_reads_bytes_(KeySetInformationLength) PVOID KeySetInformation, _In_ ULONG KeySetInformationLength)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtQueryInformationProcess (_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_writes_bytes_to_opt_(ProcessInformationLength, *ReturnLength) PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtQueryInformationThread (_In_ HANDLE ThreadHandle, _In_ THREADINFOCLASS ThreadInformationClass, _Out_writes_bytes_to_opt_(ThreadInformationLength, *ReturnLength) PVOID ThreadInformation, _In_ ULONG ThreadInformationLength, _Out_opt_ PULONG ReturnLength)
	_IRQL_requires_max_ (PASSIVE_LEVEL) __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQueryObject(_In_opt_ HANDLE Handle
	Queries information details about a security descriptor.
_In_ OBJECT_INFORMATION_CLASS	_Out_writes_bytes_opt_ (ObjectInformationLength) PVOID ObjectInformation
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtQuerySystemInformation (_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass, _Out_ PVOID SystemInformation, _In_ ULONG InformationLength, _Out_opt_ PULONG ResultLength)
__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtQuerySystemTime (_Out_ PLARGE_INTEGER SystemTime)
VOID NTAPI	RtlInitString (PSTRING DestinationString, PCSZ SourceString)
VOID NTAPI	RtlInitAnsiString (PANSI_STRING DestinationString, PCSZ SourceString)
VOID NTAPI	RtlInitUnicodeString (PUNICODE_STRING DestinationString, PCWSTR SourceString)
VOID NTAPI	RtlFreeAnsiString (PANSI_STRING AnsiString)
VOID NTAPI	RtlFreeOemString (POEM_STRING OemString)
VOID NTAPI	RtlFreeUnicodeString (PUNICODE_STRING UnicodeString)
NTSTATUS NTAPI	RtlAnsiStringToUnicodeString (PUNICODE_STRING DestinationString, PCANSI_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSTATUS NTAPI	RtlUnicodeStringToAnsiString (PANSI_STRING DestinationString, PCUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSTATUS NTAPI	RtlUnicodeStringToOemString (POEM_STRING DestinationString, PCUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSTATUS NTAPI	RtlUnicodeToMultiByteSize (_Out_ PULONG BytesInMultiByteString, _In_reads_bytes_(BytesInUnicodeString) PWCH UnicodeString, _In_ ULONG BytesInUnicodeString)
NTSTATUS NTAPI	RtlCharToInteger (PCSZ String, ULONG Base, PULONG Value)
BOOLEAN NTAPI	RtlIsNameLegalDOS8Dot3 (_In_ PUNICODE_STRING Name, _Inout_opt_ POEM_STRING OemName, _Inout_opt_ PBOOLEAN NameContainsSpaces)
NTSTATUS NTAPI	RtlLocalTimeToSystemTime (IN PLARGE_INTEGER LocalTime, _Out_ PLARGE_INTEGER SystemTime)
BOOLEAN NTAPI	RtlTimeToSecondsSince1970 (PLARGE_INTEGER Time, PULONG ElapsedSeconds)
	_When_ (Status< 0, _Out_range_(>, 0)) _When_(Status >=0
	_Out_range_ (==, 0)) ULONG NTAPI RtlNtStatusToDosError(_In_ NTSTATUS Status)
NTSTATUS NTAPI	RtlConvertSidToUnicodeString (PUNICODE_STRING UnicodeString, PSID Sid, BOOLEAN AllocateDestinationString)
ULONG NTAPI	RtlUniform (PULONG Seed)

Variables
_In_ OBJECT_INFORMATION_CLASS	ObjectInformationClass
_In_ OBJECT_INFORMATION_CLASS _In_ ULONG	ObjectInformationLength
_In_ OBJECT_INFORMATION_CLASS _In_ ULONG _Out_opt_ PULONG	ReturnLength

Macro Definition Documentation

_WINTERNL_

#define _WINTERNL_

Definition at line 35 of file winternl.h.

FILE_COMPLETE_IF_OPLOCKED

#define FILE_COMPLETE_IF_OPLOCKED   0x00000100

Definition at line 177 of file winternl.h.

FILE_CREATE

#define FILE_CREATE   0x00000002

Definition at line 209 of file winternl.h.

FILE_CREATE_TREE_CONNECTION

#define FILE_CREATE_TREE_CONNECTION   0x00000080

Definition at line 176 of file winternl.h.

FILE_CREATED

#define FILE_CREATED   0x00000002

Definition at line 196 of file winternl.h.

FILE_DELETE_ON_CLOSE

#define FILE_DELETE_ON_CLOSE   0x00001000

Definition at line 181 of file winternl.h.

FILE_DIRECTORY_FILE

#define FILE_DIRECTORY_FILE   0x00000001

Definition at line 169 of file winternl.h.

FILE_DOES_NOT_EXIST

#define FILE_DOES_NOT_EXIST   0x00000005

Definition at line 199 of file winternl.h.

FILE_EXISTS

#define FILE_EXISTS   0x00000004

Definition at line 198 of file winternl.h.

FILE_MAXIMUM_DISPOSITION

#define FILE_MAXIMUM_DISPOSITION   0x00000005

Definition at line 213 of file winternl.h.

FILE_NO_COMPRESSION

#define FILE_NO_COMPRESSION   0x00008000

Definition at line 184 of file winternl.h.

FILE_NO_EA_KNOWLEDGE

#define FILE_NO_EA_KNOWLEDGE   0x00000200

Definition at line 178 of file winternl.h.

FILE_NO_INTERMEDIATE_BUFFERING

#define FILE_NO_INTERMEDIATE_BUFFERING   0x00000008

Definition at line 172 of file winternl.h.

FILE_NON_DIRECTORY_FILE

#define FILE_NON_DIRECTORY_FILE   0x00000040

Definition at line 175 of file winternl.h.

FILE_OPEN

#define FILE_OPEN   0x00000001

Definition at line 208 of file winternl.h.

FILE_OPEN_BY_FILE_ID

#define FILE_OPEN_BY_FILE_ID   0x00002000

Definition at line 182 of file winternl.h.

FILE_OPEN_FOR_BACKUP_INTENT

#define FILE_OPEN_FOR_BACKUP_INTENT   0x00004000

Definition at line 183 of file winternl.h.

FILE_OPEN_FOR_FREE_SPACE_QUERY

#define FILE_OPEN_FOR_FREE_SPACE_QUERY   0x00800000

Definition at line 191 of file winternl.h.

FILE_OPEN_IF

#define FILE_OPEN_IF   0x00000003

Definition at line 210 of file winternl.h.

FILE_OPEN_NO_RECALL

#define FILE_OPEN_NO_RECALL   0x00400000

Definition at line 190 of file winternl.h.

FILE_OPEN_REMOTE_INSTANCE

#define FILE_OPEN_REMOTE_INSTANCE   0x00000400

Definition at line 179 of file winternl.h.

FILE_OPEN_REPARSE_POINT

#define FILE_OPEN_REPARSE_POINT   0x00200000

Definition at line 189 of file winternl.h.

FILE_OPEN_REQUIRING_OPLOCK

#define FILE_OPEN_REQUIRING_OPLOCK   0x00010000

Definition at line 186 of file winternl.h.

FILE_OPENED

#define FILE_OPENED   0x00000001

Definition at line 195 of file winternl.h.

FILE_OVERWRITE

#define FILE_OVERWRITE   0x00000004

Definition at line 211 of file winternl.h.

FILE_OVERWRITE_IF

#define FILE_OVERWRITE_IF   0x00000005

Definition at line 212 of file winternl.h.

FILE_OVERWRITTEN

#define FILE_OVERWRITTEN   0x00000003

Definition at line 197 of file winternl.h.

FILE_RANDOM_ACCESS

#define FILE_RANDOM_ACCESS   0x00000800

Definition at line 180 of file winternl.h.

FILE_RESERVE_OPFILTER

#define FILE_RESERVE_OPFILTER   0x00100000

Definition at line 188 of file winternl.h.

FILE_SEQUENTIAL_ONLY

#define FILE_SEQUENTIAL_ONLY   0x00000004

Definition at line 171 of file winternl.h.

FILE_SUPERSEDE

#define FILE_SUPERSEDE   0x00000000

Definition at line 207 of file winternl.h.

FILE_SUPERSEDED

#define FILE_SUPERSEDED   0x00000000

Definition at line 194 of file winternl.h.

FILE_SYNCHRONOUS_IO_ALERT

#define FILE_SYNCHRONOUS_IO_ALERT   0x00000010

Definition at line 173 of file winternl.h.

FILE_SYNCHRONOUS_IO_NONALERT

#define FILE_SYNCHRONOUS_IO_NONALERT   0x00000020

Definition at line 174 of file winternl.h.

FILE_VALID_MAILSLOT_OPTION_FLAGS

#define FILE_VALID_MAILSLOT_OPTION_FLAGS   0x00000032

Definition at line 203 of file winternl.h.

FILE_VALID_OPTION_FLAGS

#define FILE_VALID_OPTION_FLAGS   0x00ffffff

Definition at line 201 of file winternl.h.

FILE_VALID_PIPE_OPTION_FLAGS

#define FILE_VALID_PIPE_OPTION_FLAGS   0x00000032

Definition at line 202 of file winternl.h.

FILE_VALID_SET_FLAGS

#define FILE_VALID_SET_FLAGS   0x00000036

Definition at line 204 of file winternl.h.

FILE_WRITE_THROUGH

#define FILE_WRITE_THROUGH   0x00000002

Definition at line 170 of file winternl.h.

InitializeObjectAttributes

#define InitializeObjectAttributes	(		p,
			n,
			a,
			r,
			s
	)

Value:

{                                                 \
    (p)->Length = sizeof(OBJECT_ATTRIBUTES);      \
    (p)->RootDirectory = r;                       \
    (p)->Attributes = a;                          \
    (p)->ObjectName = n;                          \
    (p)->SecurityDescriptor = s;                  \
    (p)->SecurityQualityOfService = NULL;         \
}

Definition at line 236 of file winternl.h.

INTERNAL_TS_ACTIVE_CONSOLE_ID

#define INTERNAL_TS_ACTIVE_CONSOLE_ID   (*((volatile ULONG*)0x7ffe02d8))

Definition at line 164 of file winternl.h.

LOGONID_CURRENT

#define LOGONID_CURRENT   ((ULONG)-1)

Definition at line 165 of file winternl.h.

NT_ERROR

#define NT_ERROR

(

Status

)

((((ULONG)(Status)) >> 30) == 3)

Definition at line 59 of file winternl.h.

NT_INFORMATION

#define NT_INFORMATION

(

Status

)

((((ULONG)(Status)) >> 30) == 1)

Definition at line 51 of file winternl.h.

NT_SUCCESS

#define NT_SUCCESS

(

Status

)

(((NTSTATUS)(Status)) >= 0)

Definition at line 47 of file winternl.h.

NT_WARNING

#define NT_WARNING

(

Status

)

((((ULONG)(Status)) >> 30) == 2)

Definition at line 55 of file winternl.h.

OBJ_CASE_INSENSITIVE

#define OBJ_CASE_INSENSITIVE   0x00000040L

Definition at line 228 of file winternl.h.

OBJ_EXCLUSIVE

#define OBJ_EXCLUSIVE   0x00000020L

Definition at line 227 of file winternl.h.

OBJ_FORCE_ACCESS_CHECK

#define OBJ_FORCE_ACCESS_CHECK   0x00000400L

Definition at line 232 of file winternl.h.

OBJ_INHERIT

#define OBJ_INHERIT   0x00000002L

Definition at line 225 of file winternl.h.

OBJ_KERNEL_HANDLE

#define OBJ_KERNEL_HANDLE   0x00000200L

Definition at line 231 of file winternl.h.

OBJ_OPENIF

#define OBJ_OPENIF   0x00000080L

Definition at line 229 of file winternl.h.

OBJ_OPENLINK

#define OBJ_OPENLINK   0x00000100L

Definition at line 230 of file winternl.h.

OBJ_PERMANENT

#define OBJ_PERMANENT   0x00000010L

Definition at line 226 of file winternl.h.

OBJ_VALID_ATTRIBUTES

#define OBJ_VALID_ATTRIBUTES   0x000007F2L

Definition at line 233 of file winternl.h.

PIO_APC_ROUTINE_DEFINED

#define PIO_APC_ROUTINE_DEFINED

Definition at line 299 of file winternl.h.

RtlFillMemory

#define RtlFillMemory	(		Dest,
			Length,
			Fill
	)		memset((Dest),(Fill),(Length))

Definition at line 603 of file winternl.h.

RtlMoveMemory

#define RtlMoveMemory	(		Dest,
			Source,
			Length
	)		memmove((Dest),(Source),(Length))

Definition at line 602 of file winternl.h.

RtlZeroMemory

#define RtlZeroMemory	(		Dest,
			Length
	)		RtlFillMemory((Dest),(Length),0)

Definition at line 604 of file winternl.h.

SERVERNAME_CURRENT

#define SERVERNAME_CURRENT   ((HANDLE)NULL)

Definition at line 166 of file winternl.h.

Typedef Documentation

ANSI_STRING

typedef STRING ANSI_STRING

Definition at line 70 of file winternl.h.

FILE_INFORMATION_CLASS

typedef enum _FILE_INFORMATION_CLASS FILE_INFORMATION_CLASS

IO_STATUS_BLOCK

typedef struct _IO_STATUS_BLOCK IO_STATUS_BLOCK

KEY_SET_INFORMATION_CLASS

typedef enum _KEY_SET_INFORMATION_CLASS KEY_SET_INFORMATION_CLASS

KEY_VALUE_ENTRY

typedef struct _KEY_VALUE_ENTRY KEY_VALUE_ENTRY

LDR_DATA_TABLE_ENTRY

typedef struct _LDR_DATA_TABLE_ENTRY LDR_DATA_TABLE_ENTRY

OBJECT_ATTRIBUTES

typedef struct _OBJECT_ATTRIBUTES OBJECT_ATTRIBUTES

OBJECT_INFORMATION_CLASS

typedef enum _OBJECT_INFORMATION_CLASS OBJECT_INFORMATION_CLASS

OEM_STRING

typedef STRING OEM_STRING

Definition at line 73 of file winternl.h.

PANSI_STRING

typedef PSTRING PANSI_STRING

Definition at line 71 of file winternl.h.

PCANSI_STRING

typedef PSTRING PCANSI_STRING

Definition at line 72 of file winternl.h.

PCOEM_STRING

typedef const STRING* PCOEM_STRING

Definition at line 75 of file winternl.h.

PCSZ

typedef CONST char* PCSZ

Definition at line 62 of file winternl.h.

PCUNICODE_STRING

typedef const UNICODE_STRING* PCUNICODE_STRING

Definition at line 83 of file winternl.h.

PEB

typedef struct _PEB PEB

PEB_LDR_DATA

typedef struct _PEB_LDR_DATA PEB_LDR_DATA

PIO_APC_ROUTINE

typedef VOID(NTAPI * PIO_APC_ROUTINE) (_In_ PVOID ApcContext, _In_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG Reserved)

Definition at line 293 of file winternl.h.

PIO_STATUS_BLOCK

typedef struct _IO_STATUS_BLOCK * PIO_STATUS_BLOCK

PKEY_VALUE_ENTRY

typedef struct _KEY_VALUE_ENTRY * PKEY_VALUE_ENTRY

PLDR_DATA_TABLE_ENTRY

typedef struct _LDR_DATA_TABLE_ENTRY * PLDR_DATA_TABLE_ENTRY

POBJECT_ATTRIBUTES

typedef struct _OBJECT_ATTRIBUTES * POBJECT_ATTRIBUTES

POEM_STRING

typedef PSTRING POEM_STRING

Definition at line 74 of file winternl.h.

PPEB

typedef struct _PEB * PPEB

PPEB_LDR_DATA

typedef struct _PEB_LDR_DATA * PPEB_LDR_DATA

PPROCESS_BASIC_INFORMATION

typedef struct _PROCESS_BASIC_INFORMATION * PPROCESS_BASIC_INFORMATION

PPS_POST_PROCESS_INIT_ROUTINE

typedef VOID(NTAPI * PPS_POST_PROCESS_INIT_ROUTINE) (VOID)

Definition at line 118 of file winternl.h.

PPUBLIC_OBJECT_BASIC_INFORMATION

typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION * PPUBLIC_OBJECT_BASIC_INFORMATION

PPUBLIC_OBJECT_TYPE_INFORMATION

typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION * PPUBLIC_OBJECT_TYPE_INFORMATION

PROCESS_BASIC_INFORMATION

typedef struct _PROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION

PROCESSINFOCLASS

typedef enum _PROCESSINFOCLASS PROCESSINFOCLASS

PRTL_USER_PROCESS_PARAMETERS

typedef struct _RTL_USER_PROCESS_PARAMETERS * PRTL_USER_PROCESS_PARAMETERS

PSTRING

typedef struct _STRING * PSTRING

PSYSTEM_BASIC_INFORMATION

typedef struct _SYSTEM_BASIC_INFORMATION * PSYSTEM_BASIC_INFORMATION

PSYSTEM_EXCEPTION_INFORMATION

typedef struct _SYSTEM_EXCEPTION_INFORMATION * PSYSTEM_EXCEPTION_INFORMATION

PSYSTEM_INTERRUPT_INFORMATION

typedef struct _SYSTEM_INTERRUPT_INFORMATION * PSYSTEM_INTERRUPT_INFORMATION

PSYSTEM_LOOKASIDE_INFORMATION

typedef struct _SYSTEM_LOOKASIDE_INFORMATION * PSYSTEM_LOOKASIDE_INFORMATION

PSYSTEM_PERFORMANCE_INFORMATION

typedef struct _SYSTEM_PERFORMANCE_INFORMATION * PSYSTEM_PERFORMANCE_INFORMATION

PSYSTEM_POLICY_INFORMATION

typedef struct _SYSTEM_POLICY_INFORMATION * PSYSTEM_POLICY_INFORMATION

PSYSTEM_PROCESS_INFORMATION

typedef struct _SYSTEM_PROCESS_INFORMATION * PSYSTEM_PROCESS_INFORMATION

PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION

typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION * PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION

PSYSTEM_REGISTRY_QUOTA_INFORMATION

typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION * PSYSTEM_REGISTRY_QUOTA_INFORMATION

PSYSTEM_TIMEOFDAY_INFORMATION

typedef struct _SYSTEM_TIMEOFDAY_INFORMATION * PSYSTEM_TIMEOFDAY_INFORMATION

PTEB

typedef struct _TEB * PTEB

PUBLIC_OBJECT_BASIC_INFORMATION

typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION PUBLIC_OBJECT_BASIC_INFORMATION

PUBLIC_OBJECT_TYPE_INFORMATION

typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION PUBLIC_OBJECT_TYPE_INFORMATION

PUNICODE_STRING

typedef struct _UNICODE_STRING * PUNICODE_STRING

PWINSTATIONINFORMATIONW

typedef struct _WINSTATIONINFORMATIONW * PWINSTATIONINFORMATIONW

PWINSTATIONQUERYINFORMATIONW

typedef BOOLEAN(WINAPI * PWINSTATIONQUERYINFORMATIONW) (HANDLE, ULONG, WINSTATIONINFOCLASS, PVOID, ULONG, PULONG)

Definition at line 586 of file winternl.h.

RTL_USER_PROCESS_PARAMETERS

typedef struct _RTL_USER_PROCESS_PARAMETERS RTL_USER_PROCESS_PARAMETERS

STRING

typedef struct _STRING STRING

SYSTEM_BASIC_INFORMATION

typedef struct _SYSTEM_BASIC_INFORMATION SYSTEM_BASIC_INFORMATION

SYSTEM_EXCEPTION_INFORMATION

typedef struct _SYSTEM_EXCEPTION_INFORMATION SYSTEM_EXCEPTION_INFORMATION

SYSTEM_INFORMATION_CLASS

typedef enum _SYSTEM_INFORMATION_CLASS SYSTEM_INFORMATION_CLASS

SYSTEM_INTERRUPT_INFORMATION

typedef struct _SYSTEM_INTERRUPT_INFORMATION SYSTEM_INTERRUPT_INFORMATION

SYSTEM_LOOKASIDE_INFORMATION

typedef struct _SYSTEM_LOOKASIDE_INFORMATION SYSTEM_LOOKASIDE_INFORMATION

SYSTEM_PERFORMANCE_INFORMATION

typedef struct _SYSTEM_PERFORMANCE_INFORMATION SYSTEM_PERFORMANCE_INFORMATION

SYSTEM_POLICY_INFORMATION

typedef struct _SYSTEM_POLICY_INFORMATION SYSTEM_POLICY_INFORMATION

SYSTEM_PROCESS_INFORMATION

typedef struct _SYSTEM_PROCESS_INFORMATION SYSTEM_PROCESS_INFORMATION

SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION

typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION

SYSTEM_REGISTRY_QUOTA_INFORMATION

typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION SYSTEM_REGISTRY_QUOTA_INFORMATION

SYSTEM_TIMEOFDAY_INFORMATION

typedef struct _SYSTEM_TIMEOFDAY_INFORMATION SYSTEM_TIMEOFDAY_INFORMATION

TEB

typedef struct _TEB TEB

THREADINFOCLASS

typedef enum _THREADINFOCLASS THREADINFOCLASS

UNICODE_STRING

typedef struct _UNICODE_STRING UNICODE_STRING

WINSTATIONINFOCLASS

typedef enum _WINSTATIONINFOCLASS WINSTATIONINFOCLASS

WINSTATIONINFORMATIONW

typedef struct _WINSTATIONINFORMATIONW WINSTATIONINFORMATIONW

Enumeration Type Documentation

_FILE_INFORMATION_CLASS

enum _FILE_INFORMATION_CLASS

Enumerator
FileDirectoryInformation
FileFullDirectoryInformation
FileBothDirectoryInformation
FileBasicInformation
FileStandardInformation
FileInternalInformation
FileEaInformation
FileAccessInformation
FileNameInformation
FileRenameInformation
FileLinkInformation
FileNamesInformation
FileDispositionInformation
FilePositionInformation
FileFullEaInformation
FileModeInformation
FileAlignmentInformation
FileAllInformation
FileAllocationInformation
FileEndOfFileInformation
FileAlternateNameInformation
FileStreamInformation
FilePipeInformation
FilePipeLocalInformation
FilePipeRemoteInformation
FileMailslotQueryInformation
FileMailslotSetInformation
FileCompressionInformation
FileObjectIdInformation
FileCompletionInformation
FileMoveClusterInformation
FileQuotaInformation
FileReparsePointInformation
FileNetworkOpenInformation
FileAttributeTagInformation
FileTrackingInformation
FileIdBothDirectoryInformation
FileIdFullDirectoryInformation
FileValidDataLengthInformation
FileShortNameInformation
FileIoCompletionNotificationInformation
FileIoStatusBlockRangeInformation
FileIoPriorityHintInformation
FileSfioReserveInformation
FileSfioVolumeInformation
FileHardLinkInformation
FileProcessIdsUsingFileInformation
FileNormalizedNameInformation
FileNetworkPhysicalNameInformation
FileIdGlobalTxDirectoryInformation
FileMaximumInformation
FileDirectoryInformation
FileFullDirectoryInformation
FileBothDirectoryInformation
FileBasicInformation
FileStandardInformation
FileInternalInformation
FileEaInformation
FileAccessInformation
FileNameInformation
FileRenameInformation
FileLinkInformation
FileNamesInformation
FileDispositionInformation
FilePositionInformation
FileFullEaInformation
FileModeInformation
FileAlignmentInformation
FileAllInformation
FileAllocationInformation
FileEndOfFileInformation
FileAlternateNameInformation
FileStreamInformation
FilePipeInformation
FilePipeLocalInformation
FilePipeRemoteInformation
FileMailslotQueryInformation
FileMailslotSetInformation
FileCompressionInformation
FileCopyOnWriteInformation
FileCompletionInformation
FileMoveClusterInformation
FileOleClassIdInformation
FileOleStateBitsInformation
FileNetworkOpenInformation
FileObjectIdInformation
FileOleAllInformation
FileOleDirectoryInformation
FileContentIndexInformation
FileInheritContentIndexInformation
FileOleInformation
FileMaximumInformation
FileDirectoryInformation
FileFullDirectoryInformation
FileBothDirectoryInformation
FileBasicInformation
FileStandardInformation
FileInternalInformation
FileEaInformation
FileAccessInformation
FileNameInformation
FileRenameInformation
FileLinkInformation
FileNamesInformation
FileDispositionInformation
FilePositionInformation
FileFullEaInformation
FileModeInformation
FileAlignmentInformation
FileAllInformation
FileAllocationInformation
FileEndOfFileInformation
FileAlternateNameInformation
FileStreamInformation
FilePipeInformation
FilePipeLocalInformation
FilePipeRemoteInformation
FileMailslotQueryInformation
FileMailslotSetInformation
FileCompressionInformation
FileCopyOnWriteInformation
FileCompletionInformation
FileMoveClusterInformation
FileOleClassIdInformation
FileOleStateBitsInformation
FileNetworkOpenInformation
FileObjectIdInformation
FileOleAllInformation
FileOleDirectoryInformation
FileContentIndexInformation
FileInheritContentIndexInformation
FileOleInformation
FileMaximumInformation
FileDirectoryInformation
FileDirectoryInformation
FileFullDirectoryInformation
FileBothDirectoryInformation
FileBasicInformation
FileStandardInformation
FileInternalInformation
FileEaInformation
FileAccessInformation
FileNameInformation
FileRenameInformation
FileLinkInformation
FileNamesInformation
FileDispositionInformation
FilePositionInformation
FileFullEaInformation
FileModeInformation
FileAlignmentInformation
FileAllInformation
FileAllocationInformation
FileEndOfFileInformation
FileAlternateNameInformation
FileStreamInformation
FilePipeInformation
FilePipeLocalInformation
FilePipeRemoteInformation
FileMailslotQueryInformation
FileMailslotSetInformation
FileCompressionInformation
FileObjectIdInformation
FileCompletionInformation
FileMoveClusterInformation
FileQuotaInformation
FileReparsePointInformation
FileNetworkOpenInformation
FileAttributeTagInformation
FileTrackingInformation
FileIdBothDirectoryInformation
FileIdFullDirectoryInformation
FileValidDataLengthInformation
FileShortNameInformation
FileIoCompletionNotificationInformation
FileIoStatusBlockRangeInformation
FileIoPriorityHintInformation
FileSfioReserveInformation
FileSfioVolumeInformation
FileHardLinkInformation
FileProcessIdsUsingFileInformation
FileNormalizedNameInformation
FileNetworkPhysicalNameInformation
FileIdGlobalTxDirectoryInformation
FileIsRemoteDeviceInformation
FileAttributeCacheInformation
FileNumaNodeInformation
FileStandardLinkInformation
FileRemoteProtocolInformation
FileRenameInformationBypassAccessCheck
FileLinkInformationBypassAccessCheck
FileVolumeNameInformation
FileIdInformation
FileIdExtdDirectoryInformation
FileReplaceCompletionInformation
FileHardLinkFullIdInformation
FileIdExtdBothDirectoryInformation
FileDispositionInformationEx
FileRenameInformationEx
FileRenameInformationExBypassAccessCheck
FileDesiredStorageClassInformation
FileStatInformation
FileMemoryPartitionInformation
FileStatLxInformation
FileCaseSensitiveInformation
FileLinkInformationEx
FileLinkInformationExBypassAccessCheck
FileStorageReserveIdInformation
FileCaseSensitiveInformationForceAccessCheck
FileKnownFolderInformation
FileMaximumInformation
FileDirectoryInformation
FileFullDirectoryInformation
FileBothDirectoryInformation
FileBasicInformation
FileStandardInformation
FileInternalInformation
FileEaInformation
FileAccessInformation
FileNameInformation
FileRenameInformation
FileLinkInformation
FileNamesInformation
FileDispositionInformation
FilePositionInformation
FileFullEaInformation
FileModeInformation
FileAlignmentInformation
FileAllInformation
FileAllocationInformation
FileEndOfFileInformation
FileAlternateNameInformation
FileStreamInformation
FilePipeInformation
FilePipeLocalInformation
FilePipeRemoteInformation
FileMailslotQueryInformation
FileMailslotSetInformation
FileCompressionInformation
FileObjectIdInformation
FileCompletionInformation
FileMoveClusterInformation
FileQuotaInformation
FileReparsePointInformation
FileNetworkOpenInformation
FileAttributeTagInformation
FileTrackingInformation
FileIdBothDirectoryInformation
FileIdFullDirectoryInformation
FileValidDataLengthInformation
FileShortNameInformation
FileIoCompletionNotificationInformation
FileIoStatusBlockRangeInformation
FileIoPriorityHintInformation
FileSfioReserveInformation
FileSfioVolumeInformation
FileHardLinkInformation
FileProcessIdsUsingFileInformation
FileNormalizedNameInformation
FileNetworkPhysicalNameInformation
FileIdGlobalTxDirectoryInformation
FileIsRemoteDeviceInformation
FileAttributeCacheInformation
FileNumaNodeInformation
FileStandardLinkInformation
FileRemoteProtocolInformation
FileMaximumInformation

Definition at line 159 of file winternl.h.

{
    FileDirectoryInformation = 1
} FILE_INFORMATION_CLASS;

_KEY_SET_INFORMATION_CLASS

enum _KEY_SET_INFORMATION_CLASS

Enumerator
KeyWriteTimeInformation
KeyWriteTimeInformation
KeyWow64FlagsInformation
KeyControlFlagsInformation
KeySetVirtualizationInformation
KeySetDebugInformation
KeySetHandleTagsInformation
MaxKeySetInfoClass
KeyWriteTimeInformation
KeyWow64FlagsInformation
KeyControlFlagsInformation
KeySetVirtualizationInformation
KeySetDebugInformation
KeySetHandleTagsInformation
MaxKeySetInfoClass

Definition at line 372 of file winternl.h.

{
    KeyWriteTimeInformation,
    KeyWow64FlagsInformation,
    KeyControlFlagsInformation,
    KeySetVirtualizationInformation,
    KeySetDebugInformation,
    KeySetHandleTagsInformation,
    MaxKeySetInfoClass
} KEY_SET_INFORMATION_CLASS;

_OBJECT_INFORMATION_CLASS

enum _OBJECT_INFORMATION_CLASS

Enumerator
ObjectBasicInformation
ObjectNameInformation
ObjectTypeInformation
ObjectAllTypesInformation
ObjectHandleInformation
ObjectBasicInformation
ObjectNameInformation
ObjectTypeInformation
ObjectTypesInformation
ObjectHandleFlagInformation
ObjectSessionInformation
ObjectSessionObjectInformation
ObjectSetRefTraceInformation
MaxObjectInfoClass
ObjectBasicInformation
ObjectTypeInformation
ObjectBasicInformation
ObjectNameInformation
ObjectTypeInformation
ObjectTypesInformation
ObjectHandleFlagInformation
ObjectSessionInformation
ObjectSessionObjectInformation

Definition at line 441 of file winternl.h.

{
    ObjectBasicInformation = 0,
    ObjectTypeInformation = 2
} OBJECT_INFORMATION_CLASS;

_PROCESSINFOCLASS

enum _PROCESSINFOCLASS

Enumerator
ProcessBasicInformation
ProcessDebugPort
ProcessWow64Information
ProcessImageFileName
ProcessBreakOnTermination
ProcessBasicInformation
ProcessDebugPort
ProcessWow64Information
ProcessImageFileName
ProcessBreakOnTermination
ProcessBasicInformation
ProcessQuotaLimits
ProcessIoCounters
ProcessVmCounters
ProcessTimes
ProcessBasePriority
ProcessRaisePriority
ProcessDebugPort
ProcessExceptionPort
ProcessAccessToken
ProcessLdtInformation
ProcessLdtSize
ProcessDefaultHardErrorMode
ProcessIoPortHandlers
ProcessPooledUsageAndLimits
ProcessWorkingSetWatch
ProcessUserModeIOPL
ProcessEnableAlignmentFaultFixup
ProcessPriorityClass
ProcessWx86Information
ProcessHandleCount
ProcessAffinityMask
ProcessPriorityBoost
ProcessDeviceMap
ProcessSessionInformation
ProcessForegroundInformation
ProcessWow64Information
ProcessImageFileName
ProcessLUIDDeviceMapsEnabled
ProcessBreakOnTermination
ProcessDebugObjectHandle
ProcessDebugFlags
ProcessHandleTracing
ProcessIoPriority
ProcessExecuteFlags
ProcessTlsInformation
ProcessCookie
ProcessImageInformation
ProcessCycleTime
ProcessPagePriority
ProcessInstrumentationCallback
ProcessThreadStackAllocation
ProcessWorkingSetWatchEx
ProcessImageFileNameWin32
ProcessImageFileMapping
ProcessAffinityUpdateMode
ProcessMemoryAllocationMode
ProcessGroupInformation
ProcessTokenVirtualizationEnabled
ProcessConsoleHostProcess
ProcessWindowInformation
ProcessHandleInformation
ProcessMitigationPolicy
ProcessDynamicFunctionTableInformation
ProcessHandleCheckingMode
ProcessKeepAliveCount
ProcessRevokeFileHandles
ProcessWorkingSetControl
ProcessHandleTable
ProcessCheckStackExtentsMode
ProcessCommandLineInformation
ProcessProtectionInformation
ProcessMemoryExhaustion
ProcessFaultInformation
ProcessTelemetryIdInformation
ProcessCommitReleaseInformation
ProcessDefaultCpuSetsInformation
ProcessAllowedCpuSetsInformation
ProcessSubsystemProcess
ProcessJobMemoryInformation
ProcessInPrivate
ProcessRaiseUMExceptionOnInvalidHandleClose
ProcessIumChallengeResponse
ProcessChildProcessInformation
ProcessHighGraphicsPriorityInformation
ProcessSubsystemInformation
ProcessEnergyValues
ProcessPowerThrottlingState
ProcessReserved3Information
ProcessWin32kSyscallFilterInformation
ProcessDisableSystemAllowedCpuSets
ProcessWakeInformation
ProcessEnergyTrackingState
ProcessManageWritesToExecutableMemory
ProcessCaptureTrustletLiveDump
ProcessTelemetryCoverage
ProcessEnclaveInformation
ProcessEnableReadWriteVmLogging
ProcessUptimeInformation
ProcessImageSection
ProcessDebugAuthInformation
ProcessSystemResourceManagement
ProcessSequenceNumber
ProcessLoaderDetour
ProcessSecurityDomainInformation
ProcessCombineSecurityDomainsInformation
ProcessEnableLogging
ProcessLeapSecondInformation
ProcessFiberShadowStackAllocation
ProcessFreeFiberShadowStackAllocation
ProcessAltSystemCallInformation
ProcessDynamicEHContinuationTargets
ProcessDynamicEnforcedCetCompatibleRanges
ProcessCreateStateChange
ProcessApplyStateChange
ProcessEnableOptionalXStateFeatures
ProcessAltPrefetchParam
ProcessAssignCpuPartitions
ProcessPriorityClassEx
ProcessMembershipInformation
ProcessEffectiveIoPriority
ProcessEffectivePagePriority
MaxProcessInfoClass
ProcessBasicInformation
ProcessQuotaLimits
ProcessIoCounters
ProcessVmCounters
ProcessTimes
ProcessBasePriority
ProcessRaisePriority
ProcessDebugPort
ProcessExceptionPort
ProcessAccessToken
ProcessLdtInformation
ProcessLdtSize
ProcessDefaultHardErrorMode
ProcessIoPortHandlers
ProcessPooledUsageAndLimits
ProcessWorkingSetWatch
ProcessUserModeIOPL
ProcessEnableAlignmentFaultFixup
ProcessPriorityClass
ProcessWx86Information
ProcessHandleCount
ProcessAffinityMask
ProcessPriorityBoost
ProcessDeviceMap
ProcessSessionInformation
ProcessForegroundInformation
ProcessWow64Information
ProcessImageFileName
ProcessLUIDDeviceMapsEnabled
ProcessBreakOnTermination
ProcessDebugObjectHandle
ProcessDebugFlags
ProcessHandleTracing
ProcessIoPriority
ProcessExecuteFlags
ProcessTlsInformation
ProcessCookie
ProcessImageInformation
ProcessCycleTime
ProcessPagePriority
ProcessInstrumentationCallback
ProcessThreadStackAllocation
ProcessWorkingSetWatchEx
ProcessImageFileNameWin32
ProcessImageFileMapping
ProcessAffinityUpdateMode
ProcessMemoryAllocationMode
ProcessGroupInformation
ProcessTokenVirtualizationEnabled
ProcessConsoleHostProcess
ProcessWindowInformation
MaxProcessInfoClass

Definition at line 394 of file winternl.h.

{
    ProcessBasicInformation = 0,
    ProcessDebugPort = 7,
    ProcessWow64Information = 26,
    ProcessImageFileName = 27,
    ProcessBreakOnTermination = 29
} PROCESSINFOCLASS;

_SYSTEM_INFORMATION_CLASS

enum _SYSTEM_INFORMATION_CLASS

Enumerator
SystemBasicInformation
SystemProcessorInformation
SystemPerformanceInformation
SystemTimeOfDayInformation
SystemPathInformation
SystemProcessInformation
SystemCallCountInformation
SystemDeviceInformation
SystemProcessorPerformanceInformation
SystemFlagsInformation
SystemCallTimeInformation
SystemModuleInformation
SystemLocksInformation
SystemStackTraceInformation
SystemPagedPoolInformation
SystemNonPagedPoolInformation
SystemHandleInformation
SystemObjectInformation
SystemPageFileInformation
SystemVdmInstemulInformation
SystemVdmBopInformation
SystemFileCacheInformation
SystemPoolTagInformation
SystemInterruptInformation
SystemDpcBehaviorInformation
SystemFullMemoryInformation
SystemLoadGdiDriverInformation
SystemUnloadGdiDriverInformation
SystemTimeAdjustmentInformation
SystemSummaryMemoryInformation
SystemNextEventIdInformation
SystemEventIdsInformation
SystemCrashDumpInformation
SystemExceptionInformation
SystemCrashDumpStateInformation
SystemKernelDebuggerInformation
SystemContextSwitchInformation
SystemRegistryQuotaInformation
SystemExtendServiceTableInformation
SystemPrioritySeperation
SystemPlugPlayBusInformation
SystemDockInformation
SystemPowerInformation
SystemProcessorSpeedInformation
SystemCurrentTimeZoneInformation
SystemLookasideInformation
SystemBasicInformation
SystemProcessorInformation
SystemPerformanceInformation
SystemTimeOfDayInformation
SystemPathInformation
SystemProcessInformation
SystemCallCountInformation
SystemDeviceInformation
SystemProcessorPerformanceInformation
SystemFlagsInformation
SystemCallTimeInformation
SystemModuleInformation
SystemLocksInformation
SystemStackTraceInformation
SystemPagedPoolInformation
SystemNonPagedPoolInformation
SystemHandleInformation
SystemObjectInformation
SystemPageFileInformation
SystemVdmInstemulInformation
SystemVdmBopInformation
SystemFileCacheInformation
SystemPoolTagInformation
SystemInterruptInformation
SystemDpcBehaviorInformation
SystemFullMemoryInformation
SystemLoadGdiDriverInformation
SystemUnloadGdiDriverInformation
SystemTimeAdjustmentInformation
SystemSummaryMemoryInformation
SystemNextEventIdInformation
SystemEventIdsInformation
SystemCrashDumpInformation
SystemExceptionInformation
SystemCrashDumpStateInformation
SystemKernelDebuggerInformation
SystemContextSwitchInformation
SystemRegistryQuotaInformation
SystemExtendServiceTableInformation
SystemPrioritySeperation
SystemPlugPlayBusInformation
SystemDockInformation
SystemPowerInformation
SystemProcessorSpeedInformation
SystemCurrentTimeZoneInformation
SystemLookasideInformation
SystemBasicInformation
SystemProcessorInformation
SystemPerformanceInformation
SystemTimeOfDayInformation
SystemPathInformation
SystemProcessInformation
SystemCallCountInformation
SystemDeviceInformation
SystemProcessorPerformanceInformation
SystemFlagsInformation
SystemCallTimeInformation
SystemModuleInformation
SystemLocksInformation
SystemStackTraceInformation
SystemPagedPoolInformation
SystemNonPagedPoolInformation
SystemHandleInformation
SystemObjectInformation
SystemPageFileInformation
SystemVdmInstemulInformation
SystemVdmBopInformation
SystemFileCacheInformation
SystemPoolTagInformation
SystemInterruptInformation
SystemDpcBehaviorInformation
SystemFullMemoryInformation
SystemLoadGdiDriverInformation
SystemUnloadGdiDriverInformation
SystemTimeAdjustmentInformation
SystemSummaryMemoryInformation
SystemMirrorMemoryInformation
SystemPerformanceTraceInformation
SystemObsolete0
SystemExceptionInformation
SystemCrashDumpStateInformation
SystemKernelDebuggerInformation
SystemContextSwitchInformation
SystemRegistryQuotaInformation
SystemExtendServiceTableInformation
SystemPrioritySeperation
SystemVerifierAddDriverInformation
SystemVerifierRemoveDriverInformation
SystemProcessorIdleInformation
SystemLegacyDriverInformation
SystemCurrentTimeZoneInformation
SystemLookasideInformation
SystemTimeSlipNotification
SystemSessionCreate
SystemSessionDetach
SystemSessionInformation
SystemRangeStartInformation
SystemVerifierInformation
SystemVerifierThunkExtend
SystemSessionProcessInformation
SystemLoadGdiDriverInSystemSpace
SystemNumaProcessorMap
SystemPrefetcherInformation
SystemExtendedProcessInformation
SystemRecommendedSharedDataAlignment
SystemComPlusPackage
SystemNumaAvailableMemory
SystemProcessorPowerInformation
SystemEmulationBasicInformation
SystemEmulationProcessorInformation
SystemExtendedHandleInformation
SystemLostDelayedWriteInformation
SystemBigPoolInformation
SystemSessionPoolTagInformation
SystemSessionMappedViewInformation
SystemHotpatchInformation
SystemObjectSecurityMode
SystemWatchdogTimerHandler
SystemWatchdogTimerInformation
SystemLogicalProcessorInformation
SystemWow64SharedInformationObsolete
SystemRegisterFirmwareTableInformationHandler
SystemFirmwareTableInformation
SystemModuleInformationEx
SystemVerifierTriageInformation
SystemSuperfetchInformation
SystemMemoryListInformation
SystemFileCacheInformationEx
SystemThreadPriorityClientIdInformation
SystemProcessorIdleCycleTimeInformation
SystemVerifierCancellationInformation
SystemProcessorPowerInformationEx
SystemRefTraceInformation
SystemSpecialPoolInformation
SystemProcessIdInformation
SystemErrorPortInformation
SystemBootEnvironmentInformation
SystemHypervisorInformation
SystemVerifierInformationEx
SystemTimeZoneInformation
SystemImageFileExecutionOptionsInformation
SystemCoverageInformation
SystemPrefetchPatchInformation
SystemVerifierFaultsInformation
SystemSystemPartitionInformation
SystemSystemDiskInformation
SystemProcessorPerformanceDistribution
SystemNumaProximityNodeInformation
SystemDynamicTimeZoneInformation
SystemCodeIntegrityInformation
SystemProcessorMicrocodeUpdateInformation
SystemProcessorBrandString
SystemVirtualAddressInformation
SystemLogicalProcessorAndGroupInformation
SystemProcessorCycleTimeInformation
SystemStoreInformation
SystemRegistryAppendString
SystemAitSamplingValue
SystemVhdBootInformation
SystemCpuQuotaInformation
SystemNativeBasicInformation
SystemErrorPortTimeouts
SystemLowPriorityIoInformation
SystemBootEntropyInformation
SystemVerifierCountersInformation
SystemPagedPoolInformationEx
SystemSystemPtesInformationEx
SystemNodeDistanceInformation
SystemAcpiAuditInformation
SystemBasicPerformanceInformation
SystemQueryPerformanceCounterInformation
SystemSessionBigPoolInformation
SystemBootGraphicsInformation
SystemScrubPhysicalMemoryInformation
SystemBadPageInformation
SystemProcessorProfileControlArea
SystemCombinePhysicalMemoryInformation
SystemEntropyInterruptTimingInformation
SystemConsoleInformation
SystemPlatformBinaryInformation
SystemThrottleNotificationInformation
SystemPolicyInformation
SystemHypervisorProcessorCountInformation
SystemDeviceDataInformation
SystemDeviceDataEnumerationInformation
SystemMemoryTopologyInformation
SystemMemoryChannelInformation
SystemBootLogoInformation
SystemProcessorPerformanceInformationEx
SystemSpare0
SystemCriticalProcessErrorLogInformation
SystemSecureBootPolicyInformation
SystemPageFileInformationEx
SystemSecureBootInformation
SystemEntropyInterruptTimingRawInformation
SystemPortableWorkspaceEfiLauncherInformation
SystemFullProcessInformation
SystemKernelDebuggerInformationEx
SystemBootMetadataInformation
SystemSoftRebootInformation
SystemElamCertificateInformation
SystemOfflineDumpConfigInformation
SystemProcessorFeaturesInformation
SystemRegistryReconciliationInformation
SystemEdidInformation
SystemManufacturingInformation
SystemEnergyEstimationConfigInformation
SystemHypervisorDetailInformation
SystemProcessorCycleStatsInformation
SystemVmGenerationCountInformation
SystemTrustedPlatformModuleInformation
SystemKernelDebuggerFlags
SystemCodeIntegrityPolicyInformation
SystemIsolatedUserModeInformation
SystemHardwareSecurityTestInterfaceResultsInformation
SystemSingleModuleInformation
SystemAllowedCpuSetsInformation
SystemVsmProtectionInformation
SystemInterruptCpuSetsInformation
SystemSecureBootPolicyFullInformation
SystemCodeIntegrityPolicyFullInformation
SystemAffinitizedInterruptProcessorInformation
SystemRootSiloInformation
SystemCpuSetInformation
SystemCpuSetTagInformation
SystemWin32WerStartCallout
SystemSecureKernelProfileInformation
SystemCodeIntegrityPlatformManifestInformation
SystemInterruptSteeringInformation
SystemSupportedProcessorArchitectures
SystemMemoryUsageInformation
SystemCodeIntegrityCertificateInformation
SystemPhysicalMemoryInformation
SystemControlFlowTransition
SystemKernelDebuggingAllowed
SystemActivityModerationExeState
SystemActivityModerationUserSettings
SystemCodeIntegrityPoliciesFullInformation
SystemCodeIntegrityUnlockInformation
SystemIntegrityQuotaInformation
SystemFlushInformation
SystemProcessorIdleMaskInformation
SystemSecureDumpEncryptionInformation
SystemWriteConstraintInformation
SystemKernelVaShadowInformation
SystemHypervisorSharedPageInformation
SystemFirmwareBootPerformanceInformation
SystemCodeIntegrityVerificationInformation
SystemFirmwarePartitionInformation
SystemSpeculationControlInformation
SystemDmaGuardPolicyInformation
SystemEnclaveLaunchControlInformation
SystemWorkloadAllowedCpuSetsInformation
SystemCodeIntegrityUnlockModeInformation
SystemLeapSecondInformation
SystemFlags2Information
SystemSecurityModelInformation
SystemCodeIntegritySyntheticCacheInformation
SystemFeatureConfigurationInformation
SystemFeatureConfigurationSectionInformation
SystemFeatureUsageSubscriptionInformation
SystemSecureSpeculationControlInformation
SystemSpacesBootInformation
SystemFwRamdiskInformation
SystemWheaIpmiHardwareInformation
SystemDifSetRuleClassInformation
SystemDifClearRuleClassInformation
SystemDifApplyPluginVerificationOnDriver
SystemDifRemovePluginVerificationOnDriver
SystemShadowStackInformation
SystemBuildVersionInformation
SystemPoolLimitInformation
SystemCodeIntegrityAddDynamicStore
SystemCodeIntegrityClearDynamicStores
SystemDifPoolTrackingInformation
SystemPoolZeroingInformation
SystemDpcWatchdogInformation
SystemDpcWatchdogInformation2
SystemSupportedProcessorArchitectures2
SystemSingleProcessorRelationshipInformation
SystemXfgCheckFailureInformation
SystemIommuStateInformation
SystemHypervisorMinrootInformation
SystemHypervisorBootPagesInformation
SystemPointerAuthInformation
SystemSecureKernelDebuggerInformation
SystemOriginalImageFeatureInformation
SystemMemoryNumaInformation
SystemMemoryNumaPerformanceInformation
SystemCodeIntegritySignedPoliciesFullInformation
SystemSecureSecretsInformation
SystemTrustedAppsRuntimeInformation
SystemBadPageInformationEx
SystemResourceDeadlockTimeout
SystemBreakOnContextUnwindFailureInformation
SystemOslRamdiskInformation
MaxSystemInfoClass
SystemBasicInformation
SystemPerformanceInformation
SystemTimeOfDayInformation
SystemProcessInformation
SystemProcessorPerformanceInformation
SystemInterruptInformation
SystemExceptionInformation
SystemRegistryQuotaInformation
SystemLookasideInformation
SystemPolicyInformation
SystemBasicInformation
SystemCpuInformation
SystemPerformanceInformation
SystemTimeOfDayInformation
SystemPathInformation
SystemProcessInformation
SystemCallCountInformation
SystemDeviceInformation
SystemProcessorPerformanceInformation
SystemFlagsInformation
SystemCallTimeInformation
SystemModuleInformation
SystemLocksInformation
SystemStackTraceInformation
SystemPagedPoolInformation
SystemNonPagedPoolInformation
SystemHandleInformation
SystemObjectInformation
SystemPageFileInformation
SystemVdmInstemulInformation
SystemVdmBopInformation
SystemFileCacheInformation
SystemPoolTagInformation
SystemInterruptInformation
SystemDpcBehaviorInformation
SystemFullMemoryInformation
SystemNotImplemented6
SystemLoadGdiDriverInformation
SystemUnloadGdiDriverInformation
SystemTimeAdjustmentInformation
SystemTimeAdjustment
SystemSummaryMemoryInformation
SystemMirrorMemoryInformation
SystemPerformanceTraceInformation
SystemObsolete0
SystemExceptionInformation
SystemCrashDumpStateInformation
SystemKernelDebuggerInformation
SystemContextSwitchInformation
SystemRegistryQuotaInformation
SystemExtendServiceTableInformation
SystemPrioritySeparation
SystemVerifierAddDriverInformation
SystemVerifierRemoveDriverInformation
SystemProcessorIdleInformation
SystemLegacyDriverInformation
SystemCurrentTimeZoneInformation
SystemLookasideInformation
SystemTimeSlipNotification
SystemSessionCreate
SystemSessionDetach
SystemSessionInformation
SystemRangeStartInformation
SystemVerifierInformation
SystemVerifierThunkExtend
SystemSessionProcessesInformation
SystemLoadGdiDriverInSystemSpace
SystemNumaProcessorMap
SystemPrefetcherInformation
SystemExtendedProcessInformation
SystemRecommendedSharedDataAlignment
SystemComPlusPackage
SystemNumaAvailableMemory
SystemProcessorPowerInformation
SystemEmulationBasicInformation
SystemEmulationProcessorInformation
SystemExtendedHandleInformation
SystemLostDelayedWriteInformation
SystemBigPoolInformation
SystemSessionPoolTagInformation
SystemSessionMappedViewInformation
SystemHotpatchInformation
SystemObjectSecurityMode
SystemWatchdogTimerHandler
SystemWatchdogTimerInformation
SystemLogicalProcessorInformation
SystemWow64SharedInformationObsolete
SystemRegisterFirmwareTableInformationHandler
SystemFirmwareTableInformation
SystemModuleInformationEx
SystemVerifierTriageInformation
SystemSuperfetchInformation
SystemMemoryListInformation
SystemFileCacheInformationEx
SystemThreadPriorityClientIdInformation
SystemProcessorIdleCycleTimeInformation
SystemVerifierCancellationInformation
SystemProcessorPowerInformationEx
SystemRefTraceInformation
SystemSpecialPoolInformation
SystemProcessIdInformation
SystemErrorPortInformation
SystemBootEnvironmentInformation
SystemHypervisorInformation
SystemVerifierInformationEx
SystemTimeZoneInformation
SystemImageFileExecutionOptionsInformation
SystemCoverageInformation
SystemPrefetchPatchInformation
SystemVerifierFaultsInformation
SystemSystemPartitionInformation
SystemSystemDiskInformation
SystemProcessorPerformanceDistribution
SystemNumaProximityNodeInformation
SystemDynamicTimeZoneInformation
SystemCodeIntegrityInformation
SystemProcessorMicrocodeUpdateInformation
SystemProcessorBrandString
SystemVirtualAddressInformation
SystemLogicalProcessorInformationEx
SystemProcessorCycleTimeInformation
SystemStoreInformation
SystemRegistryAppendString
SystemAitSamplingValue
SystemVhdBootInformation
SystemCpuQuotaInformation
SystemNativeBasicInformation
SystemErrorPortTimeouts
SystemLowPriorityIoInformation
SystemTpmBootEntropyInformation
SystemVerifierCountersInformation
SystemPagedPoolInformationEx
SystemSystemPtesInformationEx
SystemNodeDistanceInformation
SystemAcpiAuditInformation
SystemBasicPerformanceInformation
SystemQueryPerformanceCounterInformation
SystemSessionBigPoolInformation
SystemBootGraphicsInformation
SystemScrubPhysicalMemoryInformation
SystemBadPageInformation
SystemProcessorProfileControlArea
SystemCombinePhysicalMemoryInformation
SystemEntropyInterruptTimingInformation
SystemConsoleInformation
SystemPlatformBinaryInformation
SystemPolicyInformation
SystemHypervisorProcessorCountInformation
SystemDeviceDataInformation
SystemDeviceDataEnumerationInformation
SystemMemoryTopologyInformation
SystemMemoryChannelInformation
SystemBootLogoInformation
SystemProcessorPerformanceInformationEx
SystemCriticalProcessErrorLogInformation
SystemSecureBootPolicyInformation
SystemPageFileInformationEx
SystemSecureBootInformation
SystemEntropyInterruptTimingRawInformation
SystemPortableWorkspaceEfiLauncherInformation
SystemFullProcessInformation
SystemKernelDebuggerInformationEx
SystemBootMetadataInformation
SystemSoftRebootInformation
SystemElamCertificateInformation
SystemOfflineDumpConfigInformation
SystemProcessorFeaturesInformation
SystemRegistryReconciliationInformation
SystemEdidInformation
SystemManufacturingInformation
SystemEnergyEstimationConfigInformation
SystemHypervisorDetailInformation
SystemProcessorCycleStatsInformation
SystemVmGenerationCountInformation
SystemTrustedPlatformModuleInformation
SystemKernelDebuggerFlags
SystemCodeIntegrityPolicyInformation
SystemIsolatedUserModeInformation
SystemHardwareSecurityTestInterfaceResultsInformation
SystemSingleModuleInformation
SystemAllowedCpuSetsInformation
SystemVsmProtectionInformation
SystemInterruptCpuSetsInformation
SystemSecureBootPolicyFullInformation
SystemCodeIntegrityPolicyFullInformation
SystemAffinitizedInterruptProcessorInformation
SystemRootSiloInformation
SystemCpuSetInformation
SystemCpuSetTagInformation
SystemWin32WerStartCallout
SystemSecureKernelProfileInformation
SystemCodeIntegrityPlatformManifestInformation
SystemInterruptSteeringInformation
SystemSupportedProcessorArchitectures
SystemMemoryUsageInformation
SystemCodeIntegrityCertificateInformation
SystemPhysicalMemoryInformation
SystemControlFlowTransition
SystemKernelDebuggingAllowed
SystemActivityModerationExeState
SystemActivityModerationUserSettings
SystemCodeIntegrityPoliciesFullInformation
SystemCodeIntegrityUnlockInformation
SystemIntegrityQuotaInformation
SystemFlushInformation
SystemProcessorIdleMaskInformation
SystemSecureDumpEncryptionInformation
SystemWriteConstraintInformation
SystemKernelVaShadowInformation
SystemHypervisorSharedPageInformation
SystemFirmwareBootPerformanceInformation
SystemCodeIntegrityVerificationInformation
SystemFirmwarePartitionInformation
SystemSpeculationControlInformation
SystemDmaGuardPolicyInformation
SystemEnclaveLaunchControlInformation
SystemWorkloadAllowedCpuSetsInformation
SystemCodeIntegrityUnlockModeInformation
SystemLeapSecondInformation
SystemFlags2Information
SystemSecurityModelInformation
SystemCodeIntegritySyntheticCacheInformation
SystemFeatureConfigurationInformation
SystemFeatureConfigurationSectionInformation
SystemFeatureUsageSubscriptionInformation
SystemSecureSpeculationControlInformation
SystemSpacesBootInformation
SystemFwRamdiskInformation
SystemWheaIpmiHardwareInformation
SystemDifSetRuleClassInformation
SystemDifClearRuleClassInformation
SystemDifApplyPluginVerificationOnDriver
SystemDifRemovePluginVerificationOnDriver
SystemShadowStackInformation
SystemBuildVersionInformation
SystemPoolLimitInformation
SystemCodeIntegrityAddDynamicStore
SystemCodeIntegrityClearDynamicStores
SystemDifPoolTrackingInformation
SystemPoolZeroingInformation
SystemDpcWatchdogInformation
SystemDpcWatchdogInformation2
SystemSupportedProcessorArchitectures2
SystemSingleProcessorRelationshipInformation
SystemXfgCheckFailureInformation
SystemIommuStateInformation
SystemHypervisorMinrootInformation
SystemHypervisorBootPagesInformation
SystemPointerAuthInformation
SystemSecureKernelDebuggerInformation
SystemOriginalImageFeatureInformation

Definition at line 474 of file winternl.h.

{
    SystemBasicInformation = 0,
    SystemPerformanceInformation = 2,
    SystemTimeOfDayInformation = 3,
    SystemProcessInformation = 5,
    SystemProcessorPerformanceInformation = 8,
    SystemInterruptInformation = 23,
    SystemExceptionInformation = 33,
    SystemRegistryQuotaInformation = 37,
    SystemLookasideInformation = 45,
    SystemPolicyInformation = 134,
} SYSTEM_INFORMATION_CLASS;

_THREADINFOCLASS

enum _THREADINFOCLASS

Enumerator
ThreadBasicInformation
ThreadTimes
ThreadPriority
ThreadBasePriority
ThreadAffinityMask
ThreadImpersonationToken
ThreadDescriptorTableEntry
ThreadEnableAlignmentFaultFixup
ThreadEventPair_Reusable
ThreadQuerySetWin32StartAddress
ThreadZeroTlsCell
ThreadPerformanceCount
ThreadAmILastThread
ThreadIdealProcessor
ThreadPriorityBoost
ThreadSetTlsArrayAddress
ThreadIsIoPending
ThreadHideFromDebugger
ThreadBreakOnTermination
ThreadSwitchLegacyState
ThreadIsTerminated
ThreadLastSystemCall
ThreadIoPriority
ThreadCycleTime
ThreadPagePriority
ThreadActualBasePriority
ThreadTebInformation
ThreadCSwitchMon
ThreadCSwitchPmu
ThreadWow64Context
ThreadGroupInformation
ThreadUmsInformation
ThreadCounterProfiling
ThreadIdealProcessorEx
MaxThreadInfoClass
ThreadIsIoPending
ThreadBasicInformation
ThreadTimes
ThreadPriority
ThreadBasePriority
ThreadAffinityMask
ThreadImpersonationToken
ThreadDescriptorTableEntry
ThreadEnableAlignmentFaultFixup
ThreadEventPair_Reusable
ThreadQuerySetWin32StartAddress
ThreadZeroTlsCell
ThreadPerformanceCount
ThreadAmILastThread
ThreadIdealProcessor
ThreadPriorityBoost
ThreadSetTlsArrayAddress
ThreadIsIoPending
ThreadHideFromDebugger
ThreadBreakOnTermination
ThreadSwitchLegacyState
ThreadIsTerminated
ThreadLastSystemCall
ThreadIoPriority
ThreadCycleTime
ThreadPagePriority
ThreadActualBasePriority
ThreadTebInformation
ThreadCSwitchMon
ThreadCSwitchPmu
ThreadWow64Context
ThreadGroupInformation
ThreadUmsInformation
ThreadCounterProfiling
ThreadIdealProcessorEx
ThreadCpuAccountingInformation
ThreadSuspendCount
ThreadHeterogeneousCpuPolicy
ThreadContainerId
ThreadNameInformation
ThreadSelectedCpuSets
ThreadSystemThreadInformation
ThreadActualGroupAffinity
ThreadDynamicCodePolicyInfo
ThreadExplicitCaseSensitivity
ThreadWorkOnBehalfTicket
ThreadSubsystemInformation
ThreadDbgkWerReportActive
ThreadAttachContainer
ThreadManageWritesToExecutableMemory
ThreadPowerThrottlingState
ThreadWorkloadClass
ThreadCreateStateChange
ThreadApplyStateChange
ThreadStrongerBadHandleChecks
ThreadEffectiveIoPriority
ThreadEffectivePagePriority
MaxThreadInfoClass
ThreadBasicInformation
ThreadTimes
ThreadPriority
ThreadBasePriority
ThreadAffinityMask
ThreadImpersonationToken
ThreadDescriptorTableEntry
ThreadEnableAlignmentFaultFixup
ThreadEventPair_Reusable
ThreadQuerySetWin32StartAddress
ThreadZeroTlsCell
ThreadPerformanceCount
ThreadAmILastThread
ThreadIdealProcessor
ThreadPriorityBoost
ThreadSetTlsArrayAddress
ThreadIsIoPending
ThreadHideFromDebugger
ThreadBreakOnTermination
ThreadSwitchLegacyState
ThreadIsTerminated
ThreadLastSystemCall
ThreadIoPriority
ThreadCycleTime
ThreadPagePriority
ThreadActualBasePriority
ThreadTebInformation
ThreadCSwitchMon
ThreadCSwitchPmu
ThreadWow64Context
ThreadGroupInformation
ThreadUmsInformation
ThreadCounterProfiling
ThreadIdealProcessorEx
ThreadCpuAccountingInformation
ThreadSuspendCount
ThreadHeterogeneousCpuPolicy
ThreadContainerId
ThreadNameInformation
ThreadSelectedCpuSets
ThreadSystemThreadInformation
ThreadActualGroupAffinity
ThreadDynamicCodePolicyInfo
ThreadExplicitCaseSensitivity
ThreadWorkOnBehalfTicket
ThreadSubsystemInformation
ThreadDbgkWerReportActive
ThreadAttachContainer
ThreadManageWritesToExecutableMemory
ThreadPowerThrottlingState
ThreadWorkloadClass
ThreadCreateStateChange
ThreadApplyStateChange
ThreadStrongerBadHandleChecks
ThreadEffectiveIoPriority
ThreadEffectivePagePriority
MaxThreadInfoClass

Definition at line 424 of file winternl.h.

{
    ThreadIsIoPending = 16
} THREADINFOCLASS;

_WINSTATIONINFOCLASS

enum _WINSTATIONINFOCLASS

Enumerator
WinStationInformation
WinStationInformation

Definition at line 573 of file winternl.h.

{
    WinStationInformation = 8
} WINSTATIONINFOCLASS;

Function Documentation

_IRQL_requires_max_()

_IRQL_requires_max_

(

PASSIVE_LEVEL

)

Queries information details about a security descriptor.

Computes the quota size of a security descriptor.

Assigns a security descriptor for a new object.

An extended function that assigns a security descriptor for a new object.

Frees a security descriptor.

An extended function that sets new information data to a security descriptor.

Modifies some information data about a security descriptor.

Parameters

[in]	SecurityInformation	Security information details to be queried from a security descriptor.
[out]	SecurityDescriptor	The returned security descriptor with security information data.
[in,out]	Length	The returned length of a security descriptor.
[in,out]	ObjectsSecurityDescriptor	The returned object security descriptor.

Returns

Returns STATUS_SUCCESS if the operations have been completed successfully and that the specific information about the security descriptor has been queried. STATUS_BUFFER_TOO_SMALL is returned if the buffer size is too small to contain the queried info about the security descriptor.

Parameters

[in]	Object	If specified, the function will use this arbitrary object that points to an object security descriptor.
[in]	SecurityInformation	Security information details to be set.
[in]	SecurityDescriptor	A security descriptor where its info is to be changed.
[in,out]	ObjectsSecurityDescriptor	The returned pointer to security descriptor objects.
[in]	PoolType	Pool type for the new security descriptor to allocate.
[in]	GenericMapping	The generic mapping of access rights masks.

Returns

See SeSetSecurityDescriptorInfoEx.

Parameters

[in]	Object	If specified, the function will use this arbitrary object that points to an object security descriptor.
[in]	SecurityInformation	Security information details to be set.
[in]	SecurityDescriptor	A security descriptor where its info is to be changed.
[in,out]	ObjectsSecurityDescriptor	The returned pointer to security descriptor objects.
[in]	AutoInheritFlags	Flags bitmask inheritation, influencing how the security descriptor can be inherited and if it can be in the first place.
[in]	PoolType	Pool type for the new security descriptor to allocate.
[in]	GenericMapping	The generic mapping of access rights masks.

Returns

Returns STATUS_SUCCESS if the operations have been completed without problems and that new info has been set to the security descriptor. STATUS_NO_SECURITY_ON_OBJECT is returned if the object does not have a security descriptor. STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the new security descriptor with new info set has failed.

Parameters

[in]

SecurityDescriptor

A security descriptor to be freed from memory.

Returns

Returns STATUS_SUCCESS.

Parameters

[in]	_ParentDescriptor	A security descriptor of the parent object that is being created.
[in]	_ExplicitDescriptor	An explicit security descriptor that is applied to a new object.
[out]	NewDescriptor	The new allocated security descriptor.
[in]	ObjectType	The type of the new object.
[in]	IsDirectoryObject	Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE.
[in]	AutoInheritFlags	Automatic inheritance flags that influence how access control entries within ACLs from security descriptors are inherited.
[in]	SubjectContext	Security subject context of the new object.
[in]	GenericMapping	Generic mapping of access mask rights.
[in]	PoolType	This parameter is unused.

Returns

Returns STATUS_SUCCESS if the operations have been completed successfully and that the security descriptor has been assigned to the new object. STATUS_NO_TOKEN is returned if the caller hasn't supplied a valid argument to a security subject context. STATUS_INVALID_OWNER is returned if the caller hasn't supplied a parent descriptor that belongs to the main user (owner). STATUS_INVALID_PRIMARY_GROUP is returned by the same reason as with the previous NTSTATUS code. The two NTSTATUS codes are returned if the calling thread stated that the owner and/or group is defaulted to the parent descriptor (SEF_DEFAULT_OWNER_FROM_PARENT and/or SEF_DEFAULT_GROUP_FROM_PARENT respectively). STATUS_INSUFFICIENT_RESOURCES is returned if memory pool allocation for the descriptor buffer has failed. A failure NTSTATUS is returned otherwise.

Parameters

[in]	ParentDescriptor	A security descriptor of the parent object that is being created.
[in]	ExplicitDescriptor	An explicit security descriptor that is applied to a new object.
[out]	NewDescriptor	The new allocated security descriptor.
[in]	IsDirectoryObject	Set this to TRUE if the newly created object is a directory object, otherwise set this to FALSE.
[in]	SubjectContext	Security subject context of the new object.
[in]	GenericMapping	Generic mapping of access mask rights.
[in]	PoolType	This parameter is unused.

Returns

See SeAssignSecurityEx.

Parameters

[in]	SecurityDescriptor	A security descriptor.
[out]	QuotaInfoSize	The returned quota size of the given security descriptor to the caller. The function may return 0 to this parameter if the descriptor doesn't have a group or a discretionary access control list (DACL) even.

Returns

Returns STATUS_SUCCESS if the quota size of a security descriptor has been computed successfully. STATUS_UNKNOWN_REVISION is returned if the security descriptor has an invalid revision.

Definition at line 923 of file Messaging.c.

{
    PFLT_SERVER_PORT_OBJECT PortObject;
    NTSTATUS Status;
 
    /* The caller must allow at least one connection */
    if (MaxConnections == 0)
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    /* The request must be for a kernel handle */
    if (!(ObjectAttributes->Attributes & OBJ_KERNEL_HANDLE))
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    /*
     * Get rundown protection on the target to stop the owner
     * from unloading whilst this port object is open. It gets
     * removed in the FltpServerPortClose callback
     */
    Status = FltObjectReference(Filter);
    if (!NT_SUCCESS(Status))
    {
        return Status;
    }
 
    /* Create the server port object for this filter */
    Status = ObCreateObject(KernelMode,
                            ServerPortObjectType,
                            ObjectAttributes,
                            KernelMode,
                            NULL,
                            sizeof(FLT_SERVER_PORT_OBJECT),
                            0,
                            0,
                            (PVOID *)&PortObject);
    if (NT_SUCCESS(Status))
    {
        /* Zero out the struct */
        RtlZeroMemory(PortObject, sizeof(FLT_SERVER_PORT_OBJECT));
 
        /* Increment the ref count on the target filter */
        FltpObjectPointerReference((PFLT_OBJECT)Filter);
 
        /* Setup the filter port object */
        PortObject->Filter = Filter;
        PortObject->ConnectNotify = ConnectNotifyCallback;
        PortObject->DisconnectNotify = DisconnectNotifyCallback;
        PortObject->MessageNotify = MessageNotifyCallback;
        PortObject->Cookie = ServerPortCookie;
        PortObject->MaxConnections = MaxConnections;
 
        /* Insert the object */
        Status = ObInsertObject(PortObject,
                                NULL,
                                STANDARD_RIGHTS_ALL | FILE_READ_DATA,
                                0,
                                NULL,
                                (PHANDLE)ServerPort);
        if (NT_SUCCESS(Status))
        {
            /* Lock the connection list */
            ExAcquireFastMutex(&Filter->ConnectionList.mLock);
 
            /* Add the new port object to the connection list and increment the count */
            InsertTailList(&Filter->ConnectionList.mList, &PortObject->FilterLink);
            Filter->ConnectionList.mCount++;
 
            /* Unlock the connection list*/
            ExReleaseFastMutex(&Filter->ConnectionList.mLock);
        }
    }
 
    if (!NT_SUCCESS(Status))
    {
        /* Allow the filter to be cleaned up */
        FltObjectDereference(Filter);
    }
 
    return Status;
}

_Out_range_()

_Out_range_

(

0

)

_Out_writes_bytes_opt_()

_In_ OBJECT_INFORMATION_CLASS _Out_writes_bytes_opt_

(

ObjectInformationLength

)

_Return_type_success_()

typedef _Return_type_success_

(

return >=

0

)

_When_()

_When_ ( )

pure virtual

NtClose()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtClose

(

_In_ HANDLE

Handle

)

NtCreateFile()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtCreateFile	(	_Out_ PHANDLE	FileHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_Out_ PIO_STATUS_BLOCK	IoStatusBlock,
		_In_opt_ PLARGE_INTEGER	AllocationSize,
		_In_ ULONG	FileAttributes,
		_In_ ULONG	ShareAccess,
		_In_ ULONG	CreateDisposition,
		_In_ ULONG	CreateOptions,
		_In_reads_bytes_opt_(EaLength) PVOID	EaBuffer,
		_In_ ULONG	EaLength
	)

NtDeviceIoControlFile()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtDeviceIoControlFile	(	_In_ HANDLE	FileHandle,
		_In_opt_ HANDLE	Event,
		_In_opt_ PIO_APC_ROUTINE	ApcRoutine,
		_In_opt_ PVOID	ApcContext,
		_Out_ PIO_STATUS_BLOCK	IoStatusBlock,
		_In_ ULONG	IoControlCode,
		_In_reads_bytes_opt_(InputBufferLength) PVOID	InputBuffer,
		_In_ ULONG	InputBufferLength,
		_Out_writes_bytes_opt_(OutputBufferLength) PVOID	OutputBuffer,
		_In_ ULONG	OutputBufferLength
	)

NtNotifyChangeMultipleKeys()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtNotifyChangeMultipleKeys	(	_In_ HANDLE	MasterKeyHandle,
		_In_opt_ ULONG	Count,
		_In_reads_opt_(Count) OBJECT_ATTRIBUTES	SubordinateObjects[],
		_In_opt_ HANDLE	Event,
		_In_opt_ PIO_APC_ROUTINE	ApcRoutine,
		_In_opt_ PVOID	ApcContext,
		_Out_ PIO_STATUS_BLOCK	IoStatusBlock,
		_In_ ULONG	CompletionFilter,
		_In_ BOOLEAN	WatchTree,
		_Out_writes_bytes_opt_(BufferSize) PVOID	Buffer,
		_In_ ULONG	BufferSize,
		_In_ BOOLEAN	Asynchronous
	)

NtOpenFile()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtOpenFile	(	_Out_ PHANDLE	FileHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_Out_ PIO_STATUS_BLOCK	IoStatusBlock,
		_In_ ULONG	ShareAccess,
		_In_ ULONG	OpenOptions
	)

NtQueryInformationProcess()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationProcess	(	_In_ HANDLE	ProcessHandle,
		_In_ PROCESSINFOCLASS	ProcessInformationClass,
		_Out_writes_bytes_to_opt_(ProcessInformationLength, *ReturnLength) PVOID	ProcessInformation,
		_In_ ULONG	ProcessInformationLength,
		_Out_opt_ PULONG	ReturnLength
	)

Definition at line 211 of file query.c.

{
    PEPROCESS Process;
    KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
    NTSTATUS Status;
    ULONG Length = 0;
 
    PAGED_CODE();
 
    /* Validate the information class */
    Status = DefaultQueryInfoBufferCheck(ProcessInformationClass,
                                         PsProcessInfoClass,
                                         RTL_NUMBER_OF(PsProcessInfoClass),
                                         ICIF_PROBE_READ,
                                         ProcessInformation,
                                         ProcessInformationLength,
                                         ReturnLength,
                                         NULL,
                                         PreviousMode);
    if (!NT_SUCCESS(Status))
    {
#if DBG
        DPRINT1("NtQueryInformationProcess(ProcessInformationClass: %s): Class validation failed! (Status: 0x%lx)\n",
                PspDumpProcessInfoClassName(ProcessInformationClass), Status);
#endif
        return Status;
    }
 
    if (((ProcessInformationClass == ProcessCookie) ||
         (ProcessInformationClass == ProcessImageInformation)) &&
        (ProcessHandle != NtCurrentProcess()))
    {
        /*
         * Retrieving the process cookie is only allowed for the calling process
         * itself! XP only allows NtCurrentProcess() as process handles even if
         * a real handle actually represents the current process.
         */
        return STATUS_INVALID_PARAMETER;
    }
 
    /* Check the information class */
    switch (ProcessInformationClass)
    {
        /* Basic process information */
        case ProcessBasicInformation:
        {
            PPROCESS_BASIC_INFORMATION ProcessBasicInfo = (PPROCESS_BASIC_INFORMATION)ProcessInformation;
 
            if (ProcessInformationLength != sizeof(PROCESS_BASIC_INFORMATION))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the return length */
            Length = sizeof(PROCESS_BASIC_INFORMATION);
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Protect writes with SEH */
            _SEH2_TRY
            {
                /* Write all the information from the EPROCESS/KPROCESS */
                ProcessBasicInfo->ExitStatus = Process->ExitStatus;
                ProcessBasicInfo->PebBaseAddress = Process->Peb;
                ProcessBasicInfo->AffinityMask = Process->Pcb.Affinity;
                ProcessBasicInfo->UniqueProcessId = (ULONG_PTR)Process->
                                                    UniqueProcessId;
                ProcessBasicInfo->InheritedFromUniqueProcessId =
                    (ULONG_PTR)Process->InheritedFromUniqueProcessId;
                ProcessBasicInfo->BasePriority = Process->Pcb.BasePriority;
 
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
        }
 
        /* Process quota limits */
        case ProcessQuotaLimits:
        {
            QUOTA_LIMITS_EX QuotaLimits;
            BOOLEAN Extended;
 
            if (ProcessInformationLength != sizeof(QUOTA_LIMITS) &&
                ProcessInformationLength != sizeof(QUOTA_LIMITS_EX))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the return length */
            Length = ProcessInformationLength;
            Extended = (Length == sizeof(QUOTA_LIMITS_EX));
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Indicate success */
            Status = STATUS_SUCCESS;
 
            RtlZeroMemory(&QuotaLimits, sizeof(QuotaLimits));
 
            /* Get max/min working set sizes */
            QuotaLimits.MaximumWorkingSetSize =
                Process->Vm.MaximumWorkingSetSize << PAGE_SHIFT;
            QuotaLimits.MinimumWorkingSetSize =
                Process->Vm.MinimumWorkingSetSize << PAGE_SHIFT;
 
            /* Get default time limits */
            QuotaLimits.TimeLimit.QuadPart = -1LL;
 
            /* Is quota block a default one? */
            if (Process->QuotaBlock == &PspDefaultQuotaBlock)
            {
                /* Get default pools and pagefile limits */
                QuotaLimits.PagedPoolLimit = (SIZE_T)-1;
                QuotaLimits.NonPagedPoolLimit = (SIZE_T)-1;
                QuotaLimits.PagefileLimit = (SIZE_T)-1;
            }
            else
            {
                /* Get limits from non-default quota block */
                QuotaLimits.PagedPoolLimit =
                    Process->QuotaBlock->QuotaEntry[PsPagedPool].Limit;
                QuotaLimits.NonPagedPoolLimit =
                    Process->QuotaBlock->QuotaEntry[PsNonPagedPool].Limit;
                QuotaLimits.PagefileLimit =
                    Process->QuotaBlock->QuotaEntry[PsPageFile].Limit;
            }
 
            /* Get additional information, if needed */
            if (Extended)
            {
                QuotaLimits.Flags |= (Process->Vm.Flags.MaximumWorkingSetHard ?
                    QUOTA_LIMITS_HARDWS_MAX_ENABLE : QUOTA_LIMITS_HARDWS_MAX_DISABLE);
                QuotaLimits.Flags |= (Process->Vm.Flags.MinimumWorkingSetHard ?
                    QUOTA_LIMITS_HARDWS_MIN_ENABLE : QUOTA_LIMITS_HARDWS_MIN_DISABLE);
 
                /* FIXME: Get the correct information */
                //QuotaLimits.WorkingSetLimit = (SIZE_T)-1; // Not used on Win2k3, it is set to 0
                QuotaLimits.CpuRateLimit.RateData = 0;
            }
 
            /* Protect writes with SEH */
            _SEH2_TRY
            {
                RtlCopyMemory(ProcessInformation, &QuotaLimits, Length);
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
        }
 
        case ProcessIoCounters:
        {
            PIO_COUNTERS IoCounters = (PIO_COUNTERS)ProcessInformation;
            PROCESS_VALUES ProcessValues;
 
            if (ProcessInformationLength != sizeof(IO_COUNTERS))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            Length = sizeof(IO_COUNTERS);
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Query IO counters from the process */
            KeQueryValuesProcess(&Process->Pcb, &ProcessValues);
 
            _SEH2_TRY
            {
                RtlCopyMemory(IoCounters, &ProcessValues.IoInfo, sizeof(IO_COUNTERS));
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Ignore exception */
            }
            _SEH2_END;
 
            /* Set status to success in any case */
            Status = STATUS_SUCCESS;
 
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
        }
 
        /* Timing */
        case ProcessTimes:
        {
            PKERNEL_USER_TIMES ProcessTime = (PKERNEL_USER_TIMES)ProcessInformation;
            ULONG UserTime, KernelTime;
 
            /* Set the return length */
            if (ProcessInformationLength != sizeof(KERNEL_USER_TIMES))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            Length = sizeof(KERNEL_USER_TIMES);
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Protect writes with SEH */
            _SEH2_TRY
            {
                /* Copy time information from EPROCESS/KPROCESS */
                KernelTime = KeQueryRuntimeProcess(&Process->Pcb, &UserTime);
                ProcessTime->CreateTime = Process->CreateTime;
                ProcessTime->UserTime.QuadPart = (LONGLONG)UserTime * KeMaximumIncrement;
                ProcessTime->KernelTime.QuadPart = (LONGLONG)KernelTime * KeMaximumIncrement;
                ProcessTime->ExitTime = Process->ExitTime;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
        }
 
        /* Process Debug Port */
        case ProcessDebugPort:
 
            if (ProcessInformationLength != sizeof(HANDLE))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the return length */
            Length = sizeof(HANDLE);
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Protect write with SEH */
            _SEH2_TRY
            {
                /* Return whether or not we have a debug port */
                *(PHANDLE)ProcessInformation = (Process->DebugPort ?
                                                (HANDLE)-1 : NULL);
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
 
        case ProcessHandleCount:
        {
            ULONG HandleCount;
 
            if (ProcessInformationLength != sizeof(ULONG))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the return length*/
            Length = sizeof(ULONG);
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Count the number of handles this process has */
            HandleCount = ObGetProcessHandleCount(Process);
 
            /* Protect write in SEH */
            _SEH2_TRY
            {
                /* Return the count of handles */
                *(PULONG)ProcessInformation = HandleCount;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get the exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
        }
 
        /* Session ID for the process */
        case ProcessSessionInformation:
        {
            PPROCESS_SESSION_INFORMATION SessionInfo = (PPROCESS_SESSION_INFORMATION)ProcessInformation;
 
            if (ProcessInformationLength != sizeof(PROCESS_SESSION_INFORMATION))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the return length*/
            Length = sizeof(PROCESS_SESSION_INFORMATION);
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Enter SEH for write safety */
            _SEH2_TRY
            {
                /* Write back the Session ID */
                SessionInfo->SessionId = PsGetProcessSessionId(Process);
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get the exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
        }
 
        /* Virtual Memory Statistics */
        case ProcessVmCounters:
        {
            PVM_COUNTERS VmCounters = (PVM_COUNTERS)ProcessInformation;
 
            /* Validate the input length */
            if ((ProcessInformationLength != sizeof(VM_COUNTERS)) &&
                (ProcessInformationLength != sizeof(VM_COUNTERS_EX)))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Enter SEH for write safety */
            _SEH2_TRY
            {
                /* Return data from EPROCESS */
                VmCounters->PeakVirtualSize = Process->PeakVirtualSize;
                VmCounters->VirtualSize = Process->VirtualSize;
                VmCounters->PageFaultCount = Process->Vm.PageFaultCount;
                VmCounters->PeakWorkingSetSize = Process->Vm.PeakWorkingSetSize;
                VmCounters->WorkingSetSize = Process->Vm.WorkingSetSize;
                VmCounters->QuotaPeakPagedPoolUsage = Process->QuotaPeak[PsPagedPool];
                VmCounters->QuotaPagedPoolUsage = Process->QuotaUsage[PsPagedPool];
                VmCounters->QuotaPeakNonPagedPoolUsage = Process->QuotaPeak[PsNonPagedPool];
                VmCounters->QuotaNonPagedPoolUsage = Process->QuotaUsage[PsNonPagedPool];
                VmCounters->PagefileUsage = Process->QuotaUsage[PsPageFile] << PAGE_SHIFT;
                VmCounters->PeakPagefileUsage = Process->QuotaPeak[PsPageFile] << PAGE_SHIFT;
                //VmCounters->PrivateUsage = Process->CommitCharge << PAGE_SHIFT;
                //
 
                /* Set the return length */
                Length = ProcessInformationLength;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get the exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
        }
 
        /* Hard Error Processing Mode */
        case ProcessDefaultHardErrorMode:
 
            if (ProcessInformationLength != sizeof(ULONG))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the return length*/
            Length = sizeof(ULONG);
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Enter SEH for writing back data */
            _SEH2_TRY
            {
                /* Write the current processing mode */
                *(PULONG)ProcessInformation = Process->
                                              DefaultHardErrorProcessing;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get the exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
 
        /* Priority Boosting status */
        case ProcessPriorityBoost:
 
            if (ProcessInformationLength != sizeof(ULONG))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the return length */
            Length = sizeof(ULONG);
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Enter SEH for writing back data */
            _SEH2_TRY
            {
                /* Return boost status */
                *(PULONG)ProcessInformation = Process->Pcb.DisableBoost ?
                                              TRUE : FALSE;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get the exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
 
        /* DOS Device Map */
        case ProcessDeviceMap:
        {
            ULONG Flags;
 
            if (ProcessInformationLength == sizeof(PROCESS_DEVICEMAP_INFORMATION_EX))
            {
                /* Protect read in SEH */
                _SEH2_TRY
                {
                    PPROCESS_DEVICEMAP_INFORMATION_EX DeviceMapEx = ProcessInformation;
 
                    Flags = DeviceMapEx->Flags;
                }
                _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
                {
                    /* Get the exception code */
                    Status = _SEH2_GetExceptionCode();
                    _SEH2_YIELD(break);
                }
                _SEH2_END;
 
                /* Only one flag is supported and it needs LUID mappings */
                if ((Flags & ~PROCESS_LUID_DOSDEVICES_ONLY) != 0 ||
                    !ObIsLUIDDeviceMapsEnabled())
                {
                    Status = STATUS_INVALID_PARAMETER;
                    break;
                }
            }
            else
            {
                /* This has to be the size of the Query union field for x64 compatibility! */
                if (ProcessInformationLength != RTL_FIELD_SIZE(PROCESS_DEVICEMAP_INFORMATION, Query))
                {
                    Status = STATUS_INFO_LENGTH_MISMATCH;
                    break;
                }
 
                /* No flags for standard call */
                Flags = 0;
            }
 
            /* Set the return length */
            Length = ProcessInformationLength;
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Query the device map information */
            Status = ObQueryDeviceMapInformation(Process,
                                                 ProcessInformation,
                                                 Flags);
 
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
        }
 
        /* Priority class */
        case ProcessPriorityClass:
        {
            PPROCESS_PRIORITY_CLASS PsPriorityClass = (PPROCESS_PRIORITY_CLASS)ProcessInformation;
 
            if (ProcessInformationLength != sizeof(PROCESS_PRIORITY_CLASS))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the return length*/
            Length = sizeof(PROCESS_PRIORITY_CLASS);
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Enter SEH for writing back data */
            _SEH2_TRY
            {
                /* Return current priority class */
                PsPriorityClass->PriorityClass = Process->PriorityClass;
                PsPriorityClass->Foreground = FALSE;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get the exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
        }
 
        case ProcessImageFileName:
        {
            PUNICODE_STRING ImageName;
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Get the image path */
            Status = SeLocateProcessImageName(Process, &ImageName);
            if (NT_SUCCESS(Status))
            {
                /* Set the return length */
                Length = ImageName->MaximumLength +
                         sizeof(OBJECT_NAME_INFORMATION);
 
                /* Make sure it's large enough */
                if (Length <= ProcessInformationLength)
                {
                    /* Enter SEH to protect write */
                    _SEH2_TRY
                    {
                        /* Copy it */
                        RtlCopyMemory(ProcessInformation,
                                      ImageName,
                                      Length);
 
                        /* Update pointer */
                        ((PUNICODE_STRING)ProcessInformation)->Buffer =
                            (PWSTR)((PUNICODE_STRING)ProcessInformation + 1);
                    }
                    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
                    {
                        /* Get the exception code */
                        Status = _SEH2_GetExceptionCode();
                    }
                    _SEH2_END;
                }
                else
                {
                    /* Buffer too small */
                    Status = STATUS_INFO_LENGTH_MISMATCH;
                }
 
                /* Free the image path */
                ExFreePoolWithTag(ImageName, TAG_SEPA);
            }
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
        }
 
#if (NTDDI_VERSION >= NTDDI_VISTA) || (DLL_EXPORT_VERSION >= _WIN32_WINNT_VISTA)
        case ProcessImageFileNameWin32:
        {
            PFILE_OBJECT FileObject;
            POBJECT_NAME_INFORMATION ObjectNameInformation;
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
            // FIXME: Use PROCESS_QUERY_LIMITED_INFORMATION when implemented
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status))
            {
                break;
            }
 
            /* Get the image path */
            Status = PsReferenceProcessFilePointer(Process, &FileObject);
            ObDereferenceObject(Process);
            if (!NT_SUCCESS(Status))
            {
                break;
            }
            Status = IoQueryFileDosDeviceName(FileObject, &ObjectNameInformation);
            ObDereferenceObject(FileObject);
            if (!NT_SUCCESS(Status))
            {
                break;
            }
 
            /* Determine return length and output */
            Length = sizeof(UNICODE_STRING) + ObjectNameInformation->Name.MaximumLength;
            if (Length <= ProcessInformationLength)
            {
                _SEH2_TRY
                {
                    PUNICODE_STRING ImageName = (PUNICODE_STRING)ProcessInformation;
                    ImageName->Length = ObjectNameInformation->Name.Length;
                    ImageName->MaximumLength = ObjectNameInformation->Name.MaximumLength;
                    if (ObjectNameInformation->Name.MaximumLength)
                    {
                        ImageName->Buffer = (PWSTR)(ImageName + 1);
                        RtlCopyMemory(ImageName->Buffer,
                                      ObjectNameInformation->Name.Buffer,
                                      ObjectNameInformation->Name.MaximumLength);
                    }
                    else
                    {
                        ASSERT(ImageName->Length == 0);
                        ImageName->Buffer = NULL;
                    }
                }
                _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
                {
                    Status = _SEH2_GetExceptionCode();
                }
                _SEH2_END;
            }
            else
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
            }
            ExFreePool(ObjectNameInformation);
 
            break;
        }
#endif /* (NTDDI_VERSION >= NTDDI_VISTA) || (DLL_EXPORT_VERSION >= _WIN32_WINNT_VISTA) */
 
        case ProcessDebugFlags:
 
            if (ProcessInformationLength != sizeof(ULONG))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the return length*/
            Length = sizeof(ULONG);
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Enter SEH for writing back data */
            _SEH2_TRY
            {
                /* Return the debug flag state */
                *(PULONG)ProcessInformation = Process->NoDebugInherit ? 0 : 1;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get the exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
 
        case ProcessBreakOnTermination:
 
            if (ProcessInformationLength != sizeof(ULONG))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the return length */
            Length = sizeof(ULONG);
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Enter SEH for writing back data */
            _SEH2_TRY
            {
                /* Return the BreakOnTermination state */
                *(PULONG)ProcessInformation = Process->BreakOnTermination;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get the exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
 
        /* Per-process security cookie */
        case ProcessCookie:
        {
            ULONG Cookie;
 
            if (ProcessInformationLength != sizeof(ULONG))
            {
                /* Length size wrong, bail out */
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Get the current process and cookie */
            Process = PsGetCurrentProcess();
            Cookie = Process->Cookie;
            if (!Cookie)
            {
                LARGE_INTEGER SystemTime;
                ULONG NewCookie;
                PKPRCB Prcb;
 
                /* Generate a new cookie */
                KeQuerySystemTime(&SystemTime);
                Prcb = KeGetCurrentPrcb();
                NewCookie = Prcb->KeSystemCalls ^ Prcb->InterruptTime ^
                            SystemTime.u.LowPart ^ SystemTime.u.HighPart;
 
                /* Set the new cookie or return the current one */
                Cookie = InterlockedCompareExchange((LONG*)&Process->Cookie,
                                                    NewCookie,
                                                    Cookie);
                if (!Cookie) Cookie = NewCookie;
 
                /* Set the return length */
                Length = sizeof(ULONG);
            }
 
            /* Indicate success */
            Status = STATUS_SUCCESS;
 
            /* Enter SEH to protect write */
            _SEH2_TRY
            {
                /* Write back the cookie */
                *(PULONG)ProcessInformation = Cookie;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get the exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
            break;
        }
 
        case ProcessImageInformation:
 
            if (ProcessInformationLength != sizeof(SECTION_IMAGE_INFORMATION))
            {
                /* Break out */
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the length required and validate it */
            Length = sizeof(SECTION_IMAGE_INFORMATION);
 
            /* Indicate success */
            Status = STATUS_SUCCESS;
 
            /* Enter SEH to protect write */
            _SEH2_TRY
            {
                MmGetImageInformation((PSECTION_IMAGE_INFORMATION)ProcessInformation);
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get the exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
            break;
 
        case ProcessDebugObjectHandle:
        {
            HANDLE DebugPort = NULL;
 
            if (ProcessInformationLength != sizeof(HANDLE))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the return length */
            Length = sizeof(HANDLE);
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Get the debug port. Continue even if this fails. */
            Status = DbgkOpenProcessDebugPort(Process, PreviousMode, &DebugPort);
 
            /* Let go of the process */
            ObDereferenceObject(Process);
 
            /* Protect write in SEH */
            _SEH2_TRY
            {
                /* Return debug port's handle */
                *(PHANDLE)ProcessInformation = DebugPort;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                if (DebugPort)
                    ObCloseHandle(DebugPort, PreviousMode);
 
                /* Get the exception code.
                 * Note: This overwrites any previous failure status. */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
            break;
        }
 
        case ProcessHandleTracing:
            DPRINT1("Handle tracing not implemented: %lu\n", ProcessInformationClass);
            Status = STATUS_NOT_IMPLEMENTED;
            break;
 
        case ProcessLUIDDeviceMapsEnabled:
 
            if (ProcessInformationLength != sizeof(ULONG))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the return length */
            Length = sizeof(ULONG);
 
            /* Indicate success */
            Status = STATUS_SUCCESS;
 
            /* Protect write in SEH */
            _SEH2_TRY
            {
                /* Query Ob */
                *(PULONG)ProcessInformation = ObIsLUIDDeviceMapsEnabled();
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get the exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
            break;
 
        case ProcessWx86Information:
 
            if (ProcessInformationLength != sizeof(ULONG))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the return length */
            Length = sizeof(ULONG);
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
            /* Protect write in SEH */
            _SEH2_TRY
            {
                /* Return if the flag is set */
                *(PULONG)ProcessInformation = (ULONG)Process->VdmAllowed;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get the exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the process */
            ObDereferenceObject(Process);
            break;
 
        case ProcessWow64Information:
        {
            ULONG_PTR Wow64 = 0;
 
            if (ProcessInformationLength != sizeof(ULONG_PTR))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the return length */
            Length = sizeof(ULONG_PTR);
 
            /* Reference the process */
            Status = ObReferenceObjectByHandle(ProcessHandle,
                                               PROCESS_QUERY_INFORMATION,
                                               PsProcessType,
                                               PreviousMode,
                                               (PVOID*)&Process,
                                               NULL);
            if (!NT_SUCCESS(Status)) break;
 
#if defined(_WIN64) && defined(BUILD_WOW64_ENABLED)
            /* Make sure the process isn't dying */
            if (ExAcquireRundownProtection(&Process->RundownProtect))
            {
                /* FIXME: A two-part hack: delay setting Process->Wow64Process,
                   so 64-bit NTDLL can use IO to init stuff. */
                if (IS_WOW64_PROCESS_INITIALIZING(Process))
                {
                    PsChargeProcessNonPagedPoolQuota(Process, sizeof(WOW64_PROCESS));
                    Process->Wow64Process = ExAllocatePoolWithTag(NonPagedPool, sizeof(WOW64_PROCESS), TAG_PS_WOW64);
                    if (!Process->Wow64Process)
                    {
                        PsReturnProcessNonPagedPoolQuota(Process, sizeof(WOW64_PROCESS));
 
                        Status = STATUS_NO_MEMORY;
                        Process->Wow64Process = UlongToPtr(1);
                    }
                    else
                    {
                        Process->Wow64Process->Wow64 = (PVOID)((ULONG_PTR)(Process->Peb) + ROUND_TO_PAGES(sizeof(PEB)));
                    }
                }
 
                /* Get the WOW64 process structure */
                if (Process->Wow64Process == NULL)
                {
                    Wow64 = 0;
                }
                /* FIXME */
                else if (IS_WOW64_PROCESS_INITIALIZING(Process))
                {
                    Wow64 = TRUE;
                }
                else
                {
                    Wow64 = (ULONG_PTR)Process->Wow64Process->Wow64;
                }
 
                /* Release the lock */
                ExReleaseRundownProtection(&Process->RundownProtect);
            }
#endif
 
            /* Dereference the process */
            ObDereferenceObject(Process);
 
            /* Protect write with SEH */
            _SEH2_TRY
            {
                /* Return the Wow64 process information */
                *(PULONG_PTR)ProcessInformation = Wow64;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
            break;
        }
 
        case ProcessExecuteFlags:
        {
            ULONG ExecuteOptions = 0;
 
            if (ProcessInformationLength != sizeof(ULONG))
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Set the return length */
            Length = sizeof(ULONG);
 
            if (ProcessHandle != NtCurrentProcess())
            {
                Status = STATUS_INVALID_PARAMETER;
                break;
            }
 
            /* Get the options */
            Status = MmGetExecuteOptions(&ExecuteOptions);
            if (NT_SUCCESS(Status))
            {
                /* Protect write with SEH */
                _SEH2_TRY
                {
                    /* Return them */
                    *(PULONG)ProcessInformation = ExecuteOptions;
                }
                _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
                {
                    /* Get exception code */
                    Status = _SEH2_GetExceptionCode();
                }
                _SEH2_END;
            }
            break;
        }
 
        case ProcessLdtInformation:
            DPRINT1("VDM/16-bit not implemented: %lu\n", ProcessInformationClass);
            Status = STATUS_NOT_IMPLEMENTED;
            break;
 
        case ProcessWorkingSetWatch:
            DPRINT1("WS Watch not implemented: %lu\n", ProcessInformationClass);
            Status = STATUS_NOT_IMPLEMENTED;
            break;
 
        case ProcessPooledUsageAndLimits:
            DPRINT1("Pool limits not implemented: %lu\n", ProcessInformationClass);
            Status = STATUS_NOT_IMPLEMENTED;
            break;
 
        /* Not supported by Server 2003 */
        default:
#if DBG
            DPRINT1("Unsupported info class: %s\n", PspDumpProcessInfoClassName(ProcessInformationClass));
#endif
            Status = STATUS_INVALID_INFO_CLASS;
    }
 
    /* Check if caller wants the return length and if there is one */
    if (ReturnLength != NULL && Length != 0)
    {
        /* Protect write with SEH */
        _SEH2_TRY
        {
            *ReturnLength = Length;
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            /* Get exception code.
             * Note: This overwrites any previous failure status. */
            Status = _SEH2_GetExceptionCode();
        }
        _SEH2_END;
    }
 
    return Status;
}

NtQueryInformationThread()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQueryInformationThread	(	_In_ HANDLE	ThreadHandle,
		_In_ THREADINFOCLASS	ThreadInformationClass,
		_Out_writes_bytes_to_opt_(ThreadInformationLength, *ReturnLength) PVOID	ThreadInformation,
		_In_ ULONG	ThreadInformationLength,
		_Out_opt_ PULONG	ReturnLength
	)

Definition at line 3017 of file query.c.

{
    PETHREAD Thread;
    PEPROCESS Process;
    KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
    NTSTATUS Status;
    ULONG Length = 0;
 
    PAGED_CODE();
 
    /* Validate the information class */
    Status = DefaultQueryInfoBufferCheck(ThreadInformationClass,
                                         PsThreadInfoClass,
                                         RTL_NUMBER_OF(PsThreadInfoClass),
                                         ICIF_PROBE_READ,
                                         ThreadInformation,
                                         ThreadInformationLength,
                                         ReturnLength,
                                         NULL,
                                         PreviousMode);
    if (!NT_SUCCESS(Status))
    {
#if DBG
        DPRINT1("NtQueryInformationThread(ThreadInformationClass: %s): Class validation failed! (Status: 0x%lx)\n",
                PspDumpThreadInfoClassName(ThreadInformationClass), Status);
#endif
        return Status;
    }
 
    /* Check what kind of information class this is */
    switch (ThreadInformationClass)
    {
        /* Basic thread information */
        case ThreadBasicInformation:
        {
            PTHREAD_BASIC_INFORMATION ThreadBasicInfo =
                (PTHREAD_BASIC_INFORMATION)ThreadInformation;
 
            /* Set the return length */
            Length = sizeof(THREAD_BASIC_INFORMATION);
 
            if (ThreadInformationLength != Length)
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Reference the thread */
            Status = ObReferenceObjectByHandle(ThreadHandle,
                                               THREAD_QUERY_LIMITED_INFORMATION,
                                               PsThreadType,
                                               PreviousMode,
                                               (PVOID*)&Thread,
                                               NULL);
            if (!NT_SUCCESS(Status))
                break;
 
            /* Protect writes with SEH */
            _SEH2_TRY
            {
                /* Write all the information from the ETHREAD/KTHREAD */
                ThreadBasicInfo->ExitStatus = Thread->ExitStatus;
                ThreadBasicInfo->TebBaseAddress = (PVOID)Thread->Tcb.Teb;
                ThreadBasicInfo->ClientId = Thread->Cid;
                ThreadBasicInfo->AffinityMask = Thread->Tcb.Affinity;
                ThreadBasicInfo->Priority = Thread->Tcb.Priority;
                ThreadBasicInfo->BasePriority = KeQueryBasePriorityThread(&Thread->Tcb);
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the thread */
            ObDereferenceObject(Thread);
            break;
        }
 
        /* Thread time information */
        case ThreadTimes:
        {
            PKERNEL_USER_TIMES ThreadTime = (PKERNEL_USER_TIMES)ThreadInformation;
 
            /* Set the return length */
            Length = sizeof(KERNEL_USER_TIMES);
 
            if (ThreadInformationLength != Length)
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Reference the thread */
            Status = ObReferenceObjectByHandle(ThreadHandle,
                                               THREAD_QUERY_LIMITED_INFORMATION,
                                               PsThreadType,
                                               PreviousMode,
                                               (PVOID*)&Thread,
                                               NULL);
            if (!NT_SUCCESS(Status))
                break;
 
            /* Protect writes with SEH */
            _SEH2_TRY
            {
                /* Copy time information from ETHREAD/KTHREAD */
                ThreadTime->KernelTime.QuadPart = Thread->Tcb.KernelTime * KeMaximumIncrement;
                ThreadTime->UserTime.QuadPart = Thread->Tcb.UserTime * KeMaximumIncrement;
                ThreadTime->CreateTime = Thread->CreateTime;
 
                /* Exit time is in a union and only valid on actual exit! */
                if (KeReadStateThread(&Thread->Tcb))
                {
                    ThreadTime->ExitTime = Thread->ExitTime;
                }
                else
                {
                    ThreadTime->ExitTime.QuadPart = 0;
                }
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the thread */
            ObDereferenceObject(Thread);
            break;
        }
 
        case ThreadQuerySetWin32StartAddress:
        {
            /* Set the return length*/
            Length = sizeof(PVOID);
 
            if (ThreadInformationLength != Length)
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Reference the thread */
            Status = ObReferenceObjectByHandle(ThreadHandle,
                                               THREAD_QUERY_INFORMATION,
                                               PsThreadType,
                                               PreviousMode,
                                               (PVOID*)&Thread,
                                               NULL);
            if (!NT_SUCCESS(Status))
                break;
 
            /* Protect write with SEH */
            _SEH2_TRY
            {
                /* Return the Win32 Start Address */
                *(PVOID*)ThreadInformation = Thread->Win32StartAddress;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the thread */
            ObDereferenceObject(Thread);
            break;
        }
 
        case ThreadPerformanceCount:
        {
            /* Set the return length*/
            Length = sizeof(LARGE_INTEGER);
 
            if (ThreadInformationLength != Length)
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Reference the thread */
            Status = ObReferenceObjectByHandle(ThreadHandle,
                                               THREAD_QUERY_INFORMATION,
                                               PsThreadType,
                                               PreviousMode,
                                               (PVOID*)&Thread,
                                               NULL);
            if (!NT_SUCCESS(Status))
                break;
 
            /* Protect write with SEH */
            _SEH2_TRY
            {
                /* FIXME */
                (*(PLARGE_INTEGER)ThreadInformation).QuadPart = 0;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the thread */
            ObDereferenceObject(Thread);
            break;
        }
 
        case ThreadAmILastThread:
        {
            /* Set the return length*/
            Length = sizeof(ULONG);
 
            if (ThreadInformationLength != Length)
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* This info class always refers to the current thread! */
            Thread = PsGetCurrentThread();
            Process = PsGetThreadProcess(Thread);
 
            /* Protect write with SEH */
            _SEH2_TRY
            {
                /* Return whether or not we are the last thread */
                *(PULONG)ThreadInformation = Process->ActiveThreads == 1;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            break;
        }
 
        case ThreadIsIoPending:
        {
            KIRQL OldIrql;
 
            /* Set the return length*/
            Length = sizeof(ULONG);
 
            if (ThreadInformationLength != Length)
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Reference the thread */
            Status = ObReferenceObjectByHandle(ThreadHandle,
                                               THREAD_QUERY_INFORMATION,
                                               PsThreadType,
                                               PreviousMode,
                                               (PVOID*)&Thread,
                                               NULL);
            if (!NT_SUCCESS(Status))
                break;
 
            /* Raise the IRQL to protect the IRP list */
            KeRaiseIrql(APC_LEVEL, &OldIrql);
 
            /* Protect write with SEH */
            _SEH2_TRY
            {
                /* Check if the IRP list is empty or not */
                *(PULONG)ThreadInformation = !IsListEmpty(&Thread->IrpList);
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Lower IRQL back */
            KeLowerIrql(OldIrql);
 
            /* Dereference the thread */
            ObDereferenceObject(Thread);
            break;
        }
 
        /* LDT and GDT information */
        case ThreadDescriptorTableEntry:
        {
#if defined(_X86_)
            /* Reference the thread */
            Status = ObReferenceObjectByHandle(ThreadHandle,
                                               THREAD_QUERY_INFORMATION,
                                               PsThreadType,
                                               PreviousMode,
                                               (PVOID*)&Thread,
                                               NULL);
            if (!NT_SUCCESS(Status))
                break;
 
            /* Call the worker routine */
            Status = PspQueryDescriptorThread(Thread,
                                              ThreadInformation,
                                              ThreadInformationLength,
                                              ReturnLength);
 
            /* Dereference the thread */
            ObDereferenceObject(Thread);
#else
            /* Only implemented on x86 */
            Status = STATUS_NOT_IMPLEMENTED;
#endif
            break;
        }
 
        case ThreadPriorityBoost:
        {
            /* Set the return length*/
            Length = sizeof(ULONG);
 
            if (ThreadInformationLength != Length)
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Reference the thread */
            Status = ObReferenceObjectByHandle(ThreadHandle,
                                               THREAD_QUERY_LIMITED_INFORMATION,
                                               PsThreadType,
                                               PreviousMode,
                                               (PVOID*)&Thread,
                                               NULL);
            if (!NT_SUCCESS(Status))
                break;
 
            _SEH2_TRY
            {
                *(PULONG)ThreadInformation = Thread->Tcb.DisableBoost ? 1 : 0;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the thread */
            ObDereferenceObject(Thread);
            break;
        }
 
#if (NTDDI_VERSION >= NTDDI_VISTA) || defined(__REACTOS__)
        case ThreadHideFromDebugger:
        {
            /* Set the return length */
            Length = sizeof(BOOLEAN);
 
            if (ThreadInformationLength != Length)
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Reference the thread */
            Status = ObReferenceObjectByHandle(ThreadHandle,
                                               THREAD_QUERY_INFORMATION,
                                               PsThreadType,
                                               PreviousMode,
                                               (PVOID*)&Thread,
                                               NULL);
            if (!NT_SUCCESS(Status))
                break;
 
            /* Protect write with SEH */
            _SEH2_TRY
            {
                *(PBOOLEAN)ThreadInformation = Thread->HideFromDebugger;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the thread */
            ObDereferenceObject(Thread);
            break;
        }
#endif /* (NTDDI_VERSION >= NTDDI_VISTA) */
 
        case ThreadBreakOnTermination:
        {
            /* Set the return length */
            Length = sizeof(ULONG);
 
            if (ThreadInformationLength != Length)
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Reference the thread */
            Status = ObReferenceObjectByHandle(ThreadHandle,
                                               THREAD_QUERY_INFORMATION,
                                               PsThreadType,
                                               PreviousMode,
                                               (PVOID*)&Thread,
                                               NULL);
            if (!NT_SUCCESS(Status))
                break;
 
            _SEH2_TRY
            {
                *(PULONG)ThreadInformation = Thread->BreakOnTermination;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the thread */
            ObDereferenceObject(Thread);
            break;
        }
 
        case ThreadIsTerminated:
        {
            ULONG ThreadTerminated;
 
            /* Set the return length*/
            Length = sizeof(ThreadTerminated);
 
            if (ThreadInformationLength != Length)
            {
                Status = STATUS_INFO_LENGTH_MISMATCH;
                break;
            }
 
            /* Reference the thread */
            Status = ObReferenceObjectByHandle(ThreadHandle,
                                               THREAD_QUERY_LIMITED_INFORMATION,
                                               PsThreadType,
                                               PreviousMode,
                                               (PVOID*)&Thread,
                                               NULL);
            if (!NT_SUCCESS(Status))
                break;
 
            ThreadTerminated = PsIsThreadTerminating(Thread);
 
            _SEH2_TRY
            {
                *(PULONG)ThreadInformation = ThreadTerminated ? 1 : 0;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            /* Dereference the thread */
            ObDereferenceObject(Thread);
            break;
        }
 
#if (NTDDI_VERSION >= NTDDI_WIN10_RS1) || defined(__REACTOS__)
        case ThreadNameInformation:
        {
            PUNICODE_STRING ThreadName;
 
            /* Reference the thread */
            Status = ObReferenceObjectByHandle(ThreadHandle,
                                               THREAD_QUERY_LIMITED_INFORMATION,
                                               PsThreadType,
                                               PreviousMode,
                                               (PVOID*)&Thread,
                                               NULL);
            if (!NT_SUCCESS(Status))
                break;
 
            PspLockThreadSecurityShared(Thread);
 
            ThreadName = Thread->ThreadName;
 
            /* Set the return length (REMARK: We only
             * consider Length instead of MaximumLength) */
            Length = sizeof(UNICODE_STRING);
            Length += (ThreadName ? ThreadName->Length : 0);
            if (ThreadInformationLength < Length)
            {
                PspUnlockThreadSecurityShared(Thread);
                ObDereferenceObject(Thread);
                Status = STATUS_BUFFER_TOO_SMALL;
                /* As on Windows, and *not* STATUS_INFO_LENGTH_MISMATCH */
                break;
            }
 
            /* Protect writes with SEH */
            _SEH2_TRY
            {
                PTHREAD_NAME_INFORMATION NameInfo =
                    (PTHREAD_NAME_INFORMATION)ThreadInformation;
                if (ThreadName && (ThreadName->Length > 0))
                {
                    NameInfo->ThreadName.Length =
                    NameInfo->ThreadName.MaximumLength = ThreadName->Length;
                    NameInfo->ThreadName.Buffer = (PWCH)(&NameInfo->ThreadName + 1);
                    RtlCopyMemory(NameInfo->ThreadName.Buffer,
                                  ThreadName->Buffer,
                                  ThreadName->Length);
                }
                else
                {
                    RtlInitEmptyUnicodeString(&NameInfo->ThreadName, NULL, 0);
                }
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                /* Get exception code */
                Status = _SEH2_GetExceptionCode();
            }
            _SEH2_END;
 
            PspUnlockThreadSecurityShared(Thread);
 
            /* Dereference the thread */
            ObDereferenceObject(Thread);
            break;
        }
#endif /* (NTDDI_VERSION >= NTDDI_WIN10_RS1) || defined(__REACTOS__) */
 
        /* Anything else */
        default:
            /* Not yet implemented */
#if DBG
            DPRINT1("Not implemented: %s\n", PspDumpThreadInfoClassName(ThreadInformationClass));
#endif
            Status = STATUS_NOT_IMPLEMENTED;
    }
 
    /* Protect write with SEH */
    _SEH2_TRY
    {
        /* Check if caller wanted return length */
        if (ReturnLength) *ReturnLength = Length;
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        /* Get exception code */
        Status = _SEH2_GetExceptionCode();
    }
    _SEH2_END;
 
    return Status;
}

Referenced by CreateRemoteThread(), CsrCreateProcess(), CsrCreateRemoteThread(), CsrCreateThread(), CsrInsertThread(), CsrSbCreateSession(), DbgUiConvertStateChangeStructure(), DoThreadNameTest(), ExitThread(), fetch_thread_info(), GetExitCodeThread(), GetProcessIdOfThread(), GetThreadDescription(), GetThreadGroupAffinity(), GetThreadId(), GetThreadIdealProcessorEx(), GetThreadIOPendingFlag(), GetThreadPriority(), GetThreadPriorityBoost(), GetThreadSelectorEntry(), GetThreadTimes(), i386_stack_walk(), init_funcs(), InitFunctionPtrs(), ntGetThreadName(), PrintThreads(), QuerySetThreadValidator(), RtlCheckForOrphanedCriticalSections(), RtlFreeUserThreadStack(), RtlpIsIoPending(), SetThreadAffinityMask(), TerminateThread(), test_dbg_hidden_thread_creation(), test_HideFromDebugger(), Test_InfoClass_Access(), test_peb_teb(), test_process_machine(), Test_ThreadAmILastThread(), Test_ThreadBasicInformationClass(), test_ThreadEnableAlignmentFaultFixup(), Test_ThreadHideFromDebuggerClass(), and test_tls_links().

NtQueryMultipleValueKey()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQueryMultipleValueKey	(	_In_ HANDLE	KeyHandle,
		_Inout_updates_(EntryCount) PKEY_VALUE_ENTRY	ValueEntries,
		_In_ ULONG	EntryCount,
		_Out_writes_bytes_ *BufferLength PVOID	ValueBuffer,
		_Inout_ PULONG	BufferLength,
		_Out_opt_ PULONG	RequiredBufferLength
	)

NtQuerySystemInformation()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQuerySystemInformation	(	_In_ SYSTEM_INFORMATION_CLASS	SystemInformationClass,
		_Out_ PVOID	SystemInformation,
		_In_ ULONG	InformationLength,
		_Out_opt_ PULONG	ResultLength
	)

NtQuerySystemTime()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtQuerySystemTime

(

_Out_ PLARGE_INTEGER

SystemTime

)

NtRenameKey()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtRenameKey	(	_In_ HANDLE	KeyHandle,
		_In_ PUNICODE_STRING	NewName
	)

NtSetInformationKey()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationKey	(	_In_ HANDLE	KeyHandle,
		_In_ _Strict_type_match_ KEY_SET_INFORMATION_CLASS	KeySetInformationClass,
		_In_reads_bytes_(KeySetInformationLength) PVOID	KeySetInformation,
		_In_ ULONG	KeySetInformationLength
	)

NtWaitForSingleObject()

__kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtWaitForSingleObject	(	_In_ HANDLE	Object,
		_In_ BOOLEAN	Alertable,
		_In_opt_ PLARGE_INTEGER	Timeout
	)

RtlAnsiStringToUnicodeString()

NTSTATUS NTAPI RtlAnsiStringToUnicodeString	(	PUNICODE_STRING	DestinationString,
		PCANSI_STRING	SourceString,
		BOOLEAN	AllocateDestinationString
	)

RtlCharToInteger()

NTSTATUS NTAPI RtlCharToInteger	(	PCSZ	String,
		ULONG	Base,
		PULONG	Value
	)

Definition at line 261 of file unicode.c.

{
    CHAR chCurrent;
    int digit;
    ULONG RunningTotal = 0;
    char bMinus = 0;
 
    /* skip leading whitespaces */
    while (*str != '\0' && *str <= ' ') str++;
 
    /* Check for +/- */
    if (*str == '+')
    {
        str++;
    }
    else if (*str == '-')
    {
        bMinus = 1;
        str++;
    }
 
    /* base = 0 means autobase */
    if (base == 0)
    {
        base = 10;
 
        if (str[0] == '0')
        {
            if (str[1] == 'b')
            {
                str += 2;
                base = 2;
            }
            else if (str[1] == 'o')
            {
                str += 2;
                base = 8;
            }
            else if (str[1] == 'x')
            {
                str += 2;
                base = 16;
            }
        }
    }
    else if (base != 2 && base != 8 && base != 10 && base != 16)
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    if (value == NULL) return STATUS_ACCESS_VIOLATION;
 
    while (*str != '\0')
    {
        chCurrent = *str;
 
        if (chCurrent >= '0' && chCurrent <= '9')
        {
            digit = chCurrent - '0';
        }
        else if (chCurrent >= 'A' && chCurrent <= 'Z')
        {
            digit = chCurrent - 'A' + 10;
        }
        else if (chCurrent >= 'a' && chCurrent <= 'z')
        {
            digit = chCurrent - 'a' + 10;
        }
        else
        {
            digit = -1;
        }
 
        if (digit < 0 || digit >= (int)base) break;
 
        RunningTotal = RunningTotal * base + digit;
        str++;
    }
 
    *value = bMinus ? (0 - RunningTotal) : RunningTotal;
    return STATUS_SUCCESS;
}

RtlConvertSidToUnicodeString()

NTSTATUS NTAPI RtlConvertSidToUnicodeString	(	PUNICODE_STRING	UnicodeString,
		PSID	Sid,
		BOOLEAN	AllocateDestinationString
	)

RtlFreeAnsiString()

VOID NTAPI RtlFreeAnsiString

(

PANSI_STRING

AnsiString

)

RtlFreeOemString()

VOID NTAPI RtlFreeOemString

(

POEM_STRING

OemString

)

Referenced by CdGenerate8dot3Name(), Fat12Format(), Fat16Format(), Fat32Format(), FatConstructNamesInFcb(), FatDeallocateCcbStrings(), and FatRemoveNames().

RtlFreeUnicodeString()

VOID NTAPI RtlFreeUnicodeString

(

PUNICODE_STRING

UnicodeString

)

RtlInitAnsiString()

VOID NTAPI RtlInitAnsiString	(	PANSI_STRING	DestinationString,
		PCSZ	SourceString
	)

RtlInitString()

VOID NTAPI RtlInitString	(	PSTRING	DestinationString,
		PCSZ	SourceString
	)

RtlInitUnicodeString()

VOID NTAPI RtlInitUnicodeString	(	PUNICODE_STRING	DestinationString,
		PCWSTR	SourceString
	)

RtlIsNameLegalDOS8Dot3()

BOOLEAN NTAPI RtlIsNameLegalDOS8Dot3	(	_In_ PUNICODE_STRING	Name,
		_Inout_opt_ POEM_STRING	OemName,
		_Inout_opt_ PBOOLEAN	NameContainsSpaces
	)

Referenced by AddFileName(), CheckNameLegalDOS8Dot3A(), CheckNameLegalDOS8Dot3W(), dempIsFileMatch(), FATAddEntry(), GetLongPathNameW(), IsValidInstallDirectory(), NtfsBuildRenamedFileName(), and START_TEST().

RtlLocalTimeToSystemTime()

NTSTATUS NTAPI RtlLocalTimeToSystemTime	(	IN PLARGE_INTEGER	LocalTime,
		_Out_ PLARGE_INTEGER	SystemTime
	)

Referenced by LocalFileTimeToFileTime(), and SetLocalTime().

RtlTimeToSecondsSince1970()

BOOLEAN NTAPI RtlTimeToSecondsSince1970	(	PLARGE_INTEGER	Time,
		PULONG	ElapsedSeconds
	)

Referenced by _fstat64(), _wstat64(), BuildUserInfoBuffer(), create_bad_block_inode(), ElfReportEventA(), ElfReportEventW(), ext2_flush(), ext2_initialize_sb(), ext2_mkdir(), Ext2LinuxTime(), GetPasswordAge(), GetTimeInSeconds(), LogfReportEvent(), LogfWriteRecord(), msvcrt_fttofd(), msvcrt_fttofdi64(), msvcrt_wfttofd(), msvcrt_wfttofd32(), msvcrt_wfttofd64(), msvcrt_wfttofd64i32(), msvcrt_wfttofdi64(), NetrRemoteTOD(), NetrServerStatisticsGet(), NetrWorkstationStatisticsGet(), ParseDate(), and ProcessPortMessage().

RtlUnicodeStringToAnsiString()

NTSTATUS NTAPI RtlUnicodeStringToAnsiString	(	PANSI_STRING	DestinationString,
		PCUNICODE_STRING	SourceString,
		BOOLEAN	AllocateDestinationString
	)

RtlUnicodeStringToOemString()

NTSTATUS NTAPI RtlUnicodeStringToOemString	(	POEM_STRING	DestinationString,
		PCUNICODE_STRING	SourceString,
		BOOLEAN	AllocateDestinationString
	)

RtlUnicodeToMultiByteSize()

NTSTATUS NTAPI RtlUnicodeToMultiByteSize	(	_Out_ PULONG	BytesInMultiByteString,
		_In_reads_bytes_(BytesInUnicodeString) PWCH	UnicodeString,
		_In_ ULONG	BytesInUnicodeString
	)

RtlUniform()

ULONG NTAPI RtlUniform

(

PULONG

Seed

)

Variable Documentation

ObjectInformationClass

_In_ OBJECT_INFORMATION_CLASS ObjectInformationClass

Definition at line 469 of file winternl.h.

ObjectInformationLength

_In_ OBJECT_INFORMATION_CLASS _In_ ULONG ObjectInformationLength

Definition at line 471 of file winternl.h.

ReturnLength

_In_ OBJECT_INFORMATION_CLASS _In_ ULONG _Out_opt_ PULONG ReturnLength

Definition at line 472 of file winternl.h.