15#define _CMLIB_DEBUG_ 1
23 #define NTDDI_WS03SP4 0x05020400
24 #define NTDDI_WIN6 0x06000000
25 #define NTDDI_LONGHORN NTDDI_WIN6
26 #define NTDDI_VISTA NTDDI_WIN6
27 #define NTDDI_WIN7 0x06010000
29 #define NTDDI_VERSION NTDDI_WS03SP4
32 #define C_ASSERT(expr) extern char (*c_assert(void)) [(expr) ? 1 : -1]
35 #define strncasecmp _strnicmp
36 #define strcasecmp _stricmp
39 #if (!defined(_MSC_VER) || (_MSC_VER < 1500))
44 #define _In_range_(x, y)
47 #define __drv_aliasesMem
50 #define min(a, b) (((a) < (b)) ? (a) : (b))
59 #define STATUS_SUCCESS ((NTSTATUS)0x00000000)
60 #define STATUS_NOT_IMPLEMENTED ((NTSTATUS)0xC0000002)
61 #define STATUS_NO_MEMORY ((NTSTATUS)0xC0000017)
62 #define STATUS_INSUFFICIENT_RESOURCES ((NTSTATUS)0xC000009A)
63 #define STATUS_INVALID_PARAMETER ((NTSTATUS)0xC000000D)
64 #define STATUS_REGISTRY_CORRUPT ((NTSTATUS)0xC000014C)
65 #define STATUS_REGISTRY_IO_FAILED ((NTSTATUS)0xC000014D)
66 #define STATUS_NOT_REGISTRY_FILE ((NTSTATUS)0xC000015C)
67 #define STATUS_REGISTRY_RECOVERED ((NTSTATUS)0x40000009)
69 #define REG_OPTION_VOLATILE 1
70 #define OBJ_CASE_INSENSITIVE 0x00000040L
71 #define USHORT_MAX USHRT_MAX
73 #define OBJ_NAME_PATH_SEPARATOR ((WCHAR)L'\\')
74 #define UNICODE_NULL ((WCHAR)0)
131 #define RtlCheckBit(BMH,BP) (((((PLONG)(BMH)->Buffer)[(BP) / 32]) >> ((BP) % 32)) & 0x1)
132 #define UNREFERENCED_PARAMETER(P) ((void)(P))
134 #define PKTHREAD PVOID
135 #define PKGUARDED_MUTEX PVOID
136 #define PERESOURCE PVOID
137 #define PFILE_OBJECT PVOID
138 #define PKEVENT PVOID
139 #define PWORK_QUEUE_ITEM PVOID
140 #define EX_PUSH_LOCK PULONG_PTR
158 #define CMLTRACE(x, ...)
161 #define REGISTRY_ERROR ((ULONG)0x00000051L)
169 #ifdef NEW_DEBUG_SYSTEM_IMPLEMENTED
170 #define CMLTRACE DbgPrintEx
172 #define CMLTRACE(x, ...) \
173 if (x & CmlibTraceLevel) DbgPrint(__VA_ARGS__)
176 #define CMLTRACE(x, ...) DPRINT(__VA_ARGS__)
181 #include <bugcodes.h>
193#define CMLIB_HCELL_DEBUG 0x01
196#define ROUND_UP(a,b) ((((a)+(b)-1)/(b))*(b))
197#define ROUND_DOWN(a,b) (((a)/(b))*(b))
204#if defined(TARGET_i386) || defined(TARGET_amd64) || \
205 defined(TARGET_arm) || defined(TARGET_arm64)
206#define PAGE_SIZE 0x1000
208#error Local PAGE_SIZE definition required when built as host
213#define TAG_KCB 'bkMC'
214#define TAG_CMHIVE 'vHMC'
215#define TAG_CMSD 'DSMC'
216#define TAG_REGISTRY_STACK 'sRMC'
228#define CM_CHECK_REGISTRY_DONT_PURGE_VOLATILES 0x0
229#define CM_CHECK_REGISTRY_PURGE_VOLATILES 0x2
230#define CM_CHECK_REGISTRY_BOOTLOADER_PURGE_VOLATILES 0x4
231#define CM_CHECK_REGISTRY_VALIDATE_HIVE 0x8
232#define CM_CHECK_REGISTRY_FIX_HIVE 0x10
237#define CM_CHECK_REGISTRY_GOOD 0
238#define CM_CHECK_REGISTRY_INVALID_PARAMETER 1
239#define CM_CHECK_REGISTRY_SD_INVALID 2
240#define CM_CHECK_REGISTRY_HIVE_CORRUPT_SIGNATURE 3
241#define CM_CHECK_REGISTRY_BIN_SIZE_OR_OFFSET_CORRUPT 4
242#define CM_CHECK_REGISTRY_BIN_SIGNATURE_HEADER_CORRUPT 5
243#define CM_CHECK_REGISTRY_BAD_FREE_CELL 6
244#define CM_CHECK_REGISTRY_BAD_ALLOC_CELL 7
245#define CM_CHECK_REGISTRY_ALLOCATE_MEM_STACK_FAIL 8
246#define CM_CHECK_REGISTRY_ROOT_CELL_NOT_FOUND 9
247#define CM_CHECK_REGISTRY_BAD_LEXICOGRAPHICAL_ORDER 10
248#define CM_CHECK_REGISTRY_NODE_NOT_FOUND 11
249#define CM_CHECK_REGISTRY_SUBKEY_NOT_FOUND 12
250#define CM_CHECK_REGISTRY_TREE_TOO_MANY_LEVELS 13
251#define CM_CHECK_REGISTRY_KEY_CELL_NOT_ALLOCATED 14
252#define CM_CHECK_REGISTRY_CELL_DATA_NOT_FOUND 15
253#define CM_CHECK_REGISTRY_CELL_SIZE_NOT_SANE 16
254#define CM_CHECK_REGISTRY_KEY_NAME_LENGTH_ZERO 17
255#define CM_CHECK_REGISTRY_KEY_TOO_BIG_THAN_CELL 18
256#define CM_CHECK_REGISTRY_BAD_KEY_NODE_PARENT 19
257#define CM_CHECK_REGISTRY_BAD_KEY_NODE_SIGNATURE 20
258#define CM_CHECK_REGISTRY_KEY_CLASS_UNALLOCATED 21
259#define CM_CHECK_REGISTRY_VALUE_LIST_UNALLOCATED 22
260#define CM_CHECK_REGISTRY_VALUE_LIST_DATA_NOT_FOUND 23
261#define CM_CHECK_REGISTRY_VALUE_LIST_SIZE_NOT_SANE 24
262#define CM_CHECK_REGISTRY_VALUE_CELL_NIL 25
263#define CM_CHECK_REGISTRY_VALUE_CELL_UNALLOCATED 26
264#define CM_CHECK_REGISTRY_VALUE_CELL_DATA_NOT_FOUND 27
265#define CM_CHECK_REGISTRY_VALUE_CELL_SIZE_NOT_SANE 28
266#define CM_CHECK_REGISTRY_CORRUPT_VALUE_DATA 29
267#define CM_CHECK_REGISTRY_DATA_CELL_NOT_ALLOCATED 30
268#define CM_CHECK_REGISTRY_BAD_KEY_VALUE_SIGNATURE 31
269#define CM_CHECK_REGISTRY_STABLE_KEYS_ON_VOLATILE 32
270#define CM_CHECK_REGISTRY_SUBKEYS_LIST_UNALLOCATED 33
271#define CM_CHECK_REGISTRY_CORRUPT_SUBKEYS_INDEX 34
272#define CM_CHECK_REGISTRY_BAD_SUBKEY_COUNT 35
273#define CM_CHECK_REGISTRY_KEY_INDEX_CELL_UNALLOCATED 36
274#define CM_CHECK_REGISTRY_CORRUPT_LEAF_ON_ROOT 37
275#define CM_CHECK_REGISTRY_CORRUPT_LEAF_SIGNATURE 38
276#define CM_CHECK_REGISTRY_CORRUPT_KEY_INDEX_SIGNATURE 39
281#define CM_CHECK_REGISTRY_SUCCESS(StatusCode) ((ULONG)(StatusCode) == CM_CHECK_REGISTRY_GOOD)
283#include <wine/unicode.h>
294#define CMP_SECURITY_HASH_LISTS 64
367#define STATIC_CELL_PAIR_COUNT 4
383#define ASSERT_VALUE_BIG(h, s) \
384 do { if (CmpIsKeyValueBig(h,s)) DbgPrint("Big keys aren't supported!\n"); } while (0)
386#define ASSERT_VALUE_BIG(h, s) \
387 ASSERTMSG("Big keys not supported!\n", !CmpIsKeyValueBig(h, s));
457#define HvGetCell(Hive, Cell) \
458 (Hive)->GetCellRoutine(Hive, Cell)
460#define HvReleaseCell(Hive, Cell) \
462 if ((Hive)->ReleaseCellRoutine) \
463 (Hive)->ReleaseCellRoutine(Hive, Cell); \
ACPI_PHYSICAL_ADDRESS ACPI_SIZE BOOLEAN Warn UINT32 *TableIdx UINT32 ACPI_TABLE_HEADER *OutTableHeader ACPI_TABLE_HEADER **OutTable ACPI_HANDLE UINT32 ACPI_WALK_CALLBACK ACPI_WALK_CALLBACK void void **ReturnValue UINT32 ACPI_BUFFER *RetPathPtr ACPI_OBJECT_HANDLER void *Data ACPI_OBJECT_HANDLER void **Data ACPI_STRING ACPI_OBJECT_LIST ACPI_BUFFER *ReturnObjectBuffer ACPI_DEVICE_INFO **ReturnBuffer ACPI_HANDLE Parent
_In_ ULONG _In_opt_ WDFREQUEST _In_opt_ PVOID _In_ size_t _In_ PVOID _In_ size_t _Out_ size_t * DataLength
#define CM_KEY_VALUE_SPECIAL_SIZE
BOOLEAN CMAPI HvTrackCellRef(IN OUT PHV_TRACK_CELL_REF CellRef, IN PHHIVE Hive, IN HCELL_INDEX Cell)
CM_CHECK_REGISTRY_STATUS NTAPI HvValidateBin(_In_ PHHIVE Hive, _In_ PHBIN Bin)
Validates a bin from a hive. It performs checks against the cells from this bin, ensuring the bin is ...
struct _HV_TRACK_CELL_REF * PHV_TRACK_CELL_REF
#define CMP_SECURITY_HASH_LISTS
#define STATIC_CELL_PAIR_COUNT
BOOLEAN CMAPI HvpVerifyHiveHeader(_In_ PHBASE_BLOCK BaseBlock, _In_ ULONG FileType)
Validates the base block header of a registry file (hive or log).
struct _HV_HIVE_CELL_PAIR HV_HIVE_CELL_PAIR
struct _CM_KEY_SECURITY_CACHE_ENTRY * PCM_KEY_SECURITY_CACHE_ENTRY
BOOLEAN CMAPI CmCreateRootNode(PHHIVE Hive, PCWSTR Name)
BOOLEAN CMAPI CmpRepairParentNode(_Inout_ PHHIVE Hive, _In_ HCELL_INDEX DirtyCell, _In_ HCELL_INDEX ParentCell, _Inout_ PCELL_DATA CellData, _In_ BOOLEAN FixHive)
Repairs the parent of the node from damage due to parent cell and parent node incosistency.
USHORT NTAPI CmpCopyName(IN PHHIVE Hive, OUT PWCHAR Destination, IN PCUNICODE_STRING Source)
CM_CHECK_REGISTRY_STATUS NTAPI HvValidateHive(_In_ PHHIVE Hive)
Validates a registry hive. This function ensures that the storage of this hive has valid bins.
BOOLEAN NTAPI CmpMarkValueDataDirty(IN PHHIVE Hive, IN PCM_KEY_VALUE Value)
static BOOLEAN CmpIsKeyValueBig(IN PHHIVE Hive, IN ULONG Length)
BOOLEAN NTAPI CmpAddSubKey(IN PHHIVE Hive, IN HCELL_INDEX Parent, IN HCELL_INDEX Child)
BOOLEAN CMAPI HvHiveWillShrink(IN PHHIVE RegistryHive)
BOOLEAN NTAPI CmpFreeValue(IN PHHIVE Hive, IN HCELL_INDEX Cell)
BOOLEAN NTAPI CmpFreeValueData(IN PHHIVE Hive, IN HCELL_INDEX DataCell, IN ULONG DataLength)
BOOLEAN CMAPI CmpRepairClassOfNodeKey(_Inout_ PHHIVE Hive, _In_ HCELL_INDEX DirtyCell, _Inout_ PCELL_DATA CellData, _In_ BOOLEAN FixHive)
Repairs the class from damage due to class corruption within the node key.
struct _CM_USE_COUNT_LOG_ENTRY * PCM_USE_COUNT_LOG_ENTRY
HCELL_INDEX NTAPI CmpFindSubKeyByNumber(IN PHHIVE Hive, IN PCM_KEY_NODE Node, IN ULONG Number)
CM_CHECK_REGISTRY_STATUS NTAPI CmCheckRegistry(_In_ PCMHIVE RegistryHive, _In_ ULONG Flags)
Checks the registry that is consistent and its contents valid and not corrupted. More specifically th...
VOID NTAPI CmpFree(IN PVOID Ptr, IN ULONG Quota)
BOOLEAN CMAPI HvSyncHiveFromRecover(_In_ PHHIVE RegistryHive)
Synchronizes a hive with recovered data during a healing/resuscitation operation of the registry.
ULONG CMAPI HvpHiveHeaderChecksum(PHBASE_BLOCK HiveHeader)
NTSTATUS NTAPI CmpRemoveValueFromList(IN PHHIVE Hive, IN ULONG Index, IN OUT PCHILD_LIST ChildList)
BOOLEAN CMAPI CmpRepairValueList(_Inout_ PHHIVE Hive, _In_ HCELL_INDEX CurrentCell, _In_ BOOLEAN FixHive)
Repairs the value list due to corruption. The process involes by purging the whole damaged list.
USHORT NTAPI CmpNameSize(IN PHHIVE Hive, IN PCUNICODE_STRING Name)
BOOLEAN CMAPI HvSyncHive(PHHIVE RegistryHive)
NTSTATUS NTAPI CmpSetValueDataNew(IN PHHIVE Hive, IN PVOID Data, IN ULONG DataSize, IN HSTORAGE_TYPE StorageType, IN HCELL_INDEX ValueCell, OUT PHCELL_INDEX DataCell)
BOOLEAN CMAPI CmIsSelfHealEnabled(_In_ BOOLEAN FixHive)
Checks if self healing is permitted by the kernel and/or bootloader. Self healing is also triggered i...
BOOLEAN NTAPI CmpGetValueData(IN PHHIVE Hive, IN PCM_KEY_VALUE Value, OUT PULONG Length, OUT PVOID *Buffer, OUT PBOOLEAN BufferAllocated, OUT PHCELL_INDEX CellToRelease)
BOOLEAN NTAPI CmpRemoveSubKey(IN PHHIVE Hive, IN HCELL_INDEX ParentKey, IN HCELL_INDEX TargetKey)
VOID NTAPI CmpCopyCompressedName(OUT PWCHAR Destination, IN ULONG DestinationLength, IN PWCHAR Source, IN ULONG SourceLength)
NTSTATUS NTAPI CmpCopyKeyValueList(IN PHHIVE SourceHive, IN PCHILD_LIST SrcValueList, IN PHHIVE DestinationHive, IN OUT PCHILD_LIST DestValueList, IN HSTORAGE_TYPE StorageType)
NTSTATUS CMAPI HvInitialize(PHHIVE RegistryHive, ULONG OperationType, ULONG HiveFlags, ULONG FileType, PVOID HiveData OPTIONAL, PALLOCATE_ROUTINE Allocate, PFREE_ROUTINE Free, PFILE_SET_SIZE_ROUTINE FileSetSize, PFILE_WRITE_ROUTINE FileWrite, PFILE_READ_ROUTINE FileRead, PFILE_FLUSH_ROUTINE FileFlush, ULONG Cluster OPTIONAL, PCUNICODE_STRING FileName OPTIONAL)
BOOLEAN CMAPI CmpRepairKeyNodeSignature(_Inout_ PHHIVE Hive, _In_ HCELL_INDEX DirtyCell, _Inout_ PCELL_DATA CellData, _In_ BOOLEAN FixHive)
Repairs the key node signature from damage due to signature corruption.
BOOLEAN CMAPI HvIsCellDirty(IN PHHIVE Hive, IN HCELL_INDEX Cell)
VOID CMAPI HvReleaseFreeCellRefArray(IN OUT PHV_TRACK_CELL_REF CellRef)
VOID NTAPI CmpFreeSecurityDescriptor(IN PHHIVE Hive, IN HCELL_INDEX Cell)
PCELL_DATA CMAPI HvpGetCellData(_In_ PHHIVE Hive, _In_ HCELL_INDEX CellIndex)
struct _CM_KEY_CONTROL_BLOCK * PCM_KEY_CONTROL_BLOCK
BOOLEAN NTAPI CmpMarkIndexDirty(IN PHHIVE Hive, HCELL_INDEX ParentKey, HCELL_INDEX TargetKey)
BOOLEAN CMAPI CmpRepairValueListCount(_Inout_ PHHIVE Hive, _In_ HCELL_INDEX CurrentCell, _In_ ULONG ListCountIndex, _Inout_ PCELL_DATA ValueListData, _In_ BOOLEAN FixHive)
Repairs the value list count of key due to corruption. The process involves by removing one damaged v...
HCELL_INDEX NTAPI CmpFindValueByName(IN PHHIVE Hive, IN PCM_KEY_NODE KeyNode, IN PCUNICODE_STRING Name)
BOOLEAN CMAPI HvWriteAlternateHive(_In_ PHHIVE RegistryHive)
Writes data to an alternate registry hive. An alternate hive is usually backed up by a primary hive....
BOOLEAN CMAPI CmpRepairSubKeyCounts(_Inout_ PHHIVE Hive, _In_ HCELL_INDEX CurrentCell, _In_ ULONG Count, _Inout_ PCELL_DATA CellData, _In_ BOOLEAN FixHive)
Repairs the subkey list count due to corruption. The process involves by fixing the count itself with...
struct _HV_HIVE_CELL_PAIR * PHV_HIVE_CELL_PAIR
BOOLEAN CMAPI CmpRepairSubKeyList(_Inout_ PHHIVE Hive, _In_ HCELL_INDEX CurrentCell, _Inout_ PCELL_DATA CellData, _In_ BOOLEAN FixHive)
Repairs the subkey list due to corruption. The process involves by purging the whole damaged subkeys ...
BOOLEAN CMAPI CmpRepairParentKey(_Inout_ PHHIVE Hive, _In_ HCELL_INDEX TargetKey, _In_ HCELL_INDEX ParentKey, _In_ BOOLEAN FixHive)
Repairs the parent key from damage by removing the offending subkey cell.
static BOOLEAN CmpIsKeyValueSmall(OUT PULONG RealLength, IN ULONG Length)
BOOLEAN CMAPI HvIsCellAllocated(IN PHHIVE RegistryHive, IN HCELL_INDEX CellIndex)
PCELL_DATA NTAPI CmpValueToData(IN PHHIVE Hive, IN PCM_KEY_VALUE Value, OUT PULONG Length)
VOID CMAPI HvFreeCell(PHHIVE RegistryHive, HCELL_INDEX CellOffset)
struct _CM_CELL_REMAP_BLOCK * PCM_CELL_REMAP_BLOCK
NTSTATUS CMAPI HvpCreateHiveFreeCellList(PHHIVE Hive)
LONG CMAPI HvGetCellSize(PHHIVE RegistryHive, PVOID Cell)
LONG NTAPI CmpCompareCompressedName(IN PCUNICODE_STRING SearchName, IN PWCHAR CompressedName, IN ULONG NameLength)
struct _CM_USE_COUNT_LOG * PCM_USE_COUNT_LOG
ULONG CM_CHECK_REGISTRY_STATUS
USHORT NTAPI CmpCompressedNameSize(IN PWCHAR Name, IN ULONG Length)
BOOLEAN CMAPI HvMarkCellDirty(PHHIVE RegistryHive, HCELL_INDEX CellOffset, BOOLEAN HoldingLock)
HCELL_INDEX CMAPI HvReallocateCell(PHHIVE RegistryHive, HCELL_INDEX CellOffset, ULONG Size)
HCELL_INDEX CMAPI HvAllocateCell(PHHIVE RegistryHive, ULONG Size, HSTORAGE_TYPE Storage, IN HCELL_INDEX Vicinity)
HCELL_INDEX NTAPI CmpFindSubKeyByName(IN PHHIVE Hive, IN PCM_KEY_NODE Parent, IN PCUNICODE_STRING SearchName)
ULONG NTAPI CmpComputeHashKey(IN ULONG Hash, IN PCUNICODE_STRING Name, IN BOOLEAN AllowSeparators)
PVOID NTAPI CmpAllocate(IN SIZE_T Size, IN BOOLEAN Paged, IN ULONG Tag)
struct _HV_TRACK_CELL_REF HV_TRACK_CELL_REF
VOID CMAPI HvFree(PHHIVE RegistryHive)
BOOLEAN CMAPI HvWriteHive(PHHIVE RegistryHive)
VOID NTAPI CmpRemoveSecurityCellList(IN PHHIVE Hive, IN HCELL_INDEX SecurityCell)
BOOLEAN NTAPI CmpFindNameInList(IN PHHIVE Hive, IN PCHILD_LIST ChildList, IN PCUNICODE_STRING Name, OUT PULONG ChildIndex OPTIONAL, OUT PHCELL_INDEX CellIndex)
NTSTATUS NTAPI CmpFreeKeyByCell(IN PHHIVE Hive, IN HCELL_INDEX Cell, IN BOOLEAN Unlink)
struct _CM_USE_COUNT_LOG_ENTRY CM_USE_COUNT_LOG_ENTRY
PHBIN CMAPI HvpAddBin(PHHIVE RegistryHive, ULONG Size, HSTORAGE_TYPE Storage)
struct _CM_USE_COUNT_LOG CM_USE_COUNT_LOG
NTSTATUS NTAPI CmpAddValueToList(IN PHHIVE Hive, IN HCELL_INDEX ValueCell, IN ULONG Index, IN HSTORAGE_TYPE StorageType, IN OUT PCHILD_LIST ChildList)
#define RtlInitializeBitMap
static int Hash(const char *)
ULONG RtlCompareUnicodeString(PUNICODE_STRING s1, PUNICODE_STRING s2, BOOLEAN UpCase)
#define KeQuerySystemTime(t)
_Must_inspect_result_ _In_ PFSRTL_PER_STREAM_CONTEXT Ptr
BOOLEAN(CMAPI * PFILE_READ_ROUTINE)(struct _HHIVE *RegistryHive, ULONG FileType, PULONG FileOffset, PVOID Buffer, SIZE_T BufferLength)
BOOLEAN(CMAPI * PFILE_WRITE_ROUTINE)(struct _HHIVE *RegistryHive, ULONG FileType, PULONG FileOffset, PVOID Buffer, SIZE_T BufferLength)
VOID(CMAPI * PFREE_ROUTINE)(PVOID Ptr, ULONG Quota)
BOOLEAN(CMAPI * PFILE_FLUSH_ROUTINE)(struct _HHIVE *RegistryHive, ULONG FileType, PLARGE_INTEGER FileOffset, ULONG Length)
PVOID(CMAPI * PALLOCATE_ROUTINE)(SIZE_T Size, BOOLEAN Paged, ULONG Tag)
BOOLEAN(CMAPI * PFILE_SET_SIZE_ROUTINE)(struct _HHIVE *RegistryHive, ULONG FileType, ULONG FileSize, ULONG OldfileSize)
#define HSYS_WHISTLER_BETA1
WORD SECURITY_DESCRIPTOR_CONTROL
WORD * PSECURITY_DESCRIPTOR_CONTROL
_In_ NDIS_STATUS _In_ ULONG _In_ USHORT _In_opt_ PVOID _In_ ULONG DataSize
_In_ UINT _In_ UINT _In_ PNDIS_PACKET Source
_In_ const STRING * String2
_Out_ _Inout_ POEM_STRING _In_ PCUNICODE_STRING SourceString
_In_ const STRING _In_ BOOLEAN CaseInSensitive
_In_ PUNICODE_STRING _Inout_ PUNICODE_STRING Destination
_Out_ _Inout_ POEM_STRING DestinationString
WCHAR NTAPI RtlUpcaseUnicodeChar(_In_ WCHAR Source)
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
_In_ ULONG _In_ ULONG _In_ ULONG Length
_In_opt_ PENTER_STATE_SYSTEM_HANDLER _In_opt_ PVOID _In_ LONG _In_opt_ LONG volatile * Number
VOID NTAPI KeBugCheckEx(_In_ ULONG BugCheckCode, _In_ ULONG_PTR BugCheckParameter1, _In_ ULONG_PTR BugCheckParameter2, _In_ ULONG_PTR BugCheckParameter3, _In_ ULONG_PTR BugCheckParameter4)
PULONG MinorVersion OPTIONAL
PKTHREAD HiveSecurityLockOwner
LIST_ENTRY KnodeConvertListHead
EX_PUSH_LOCK SecurityLock
LIST_ENTRY SecurityHash[CMP_SECURITY_HASH_LISTS]
PWORK_QUEUE_ITEM UnloadWorkItem
LIST_ENTRY TrustClassEntry
CM_USE_COUNT_LOG UseCountLog
HANDLE FileHandles[HFILE_TYPE_MAX]
LIST_ENTRY PinViewListHead
LIST_ENTRY KcbConvertListHead
UNICODE_STRING FileUserName
PCM_KEY_SECURITY_CACHE_ENTRY SecurityCache
PCM_KEY_CONTROL_BLOCK RootKcb
LIST_ENTRY LRUViewListHead
PCM_CELL_REMAP_BLOCK CellRemapArray
CM_USE_COUNT_LOG LockHiveLog
UNICODE_STRING FileFullPath
CM_USE_COUNT_LOG_ENTRY Log[32]
PHV_HIVE_CELL_PAIR CellArray
HV_HIVE_CELL_PAIR StaticArray[STATIC_CELL_PAIR_COUNT]
SECURITY_DESCRIPTOR_CONTROL Control
static int Unlink(const char **args)
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_CHILD_LIST_CONFIG _In_opt_ PWDF_OBJECT_ATTRIBUTES _Out_ WDFCHILDLIST * ChildList
_In_ WDFCOLLECTION _In_ ULONG Index
_Must_inspect_result_ _In_ WDFDEVICE _In_ BOOLEAN _In_opt_ PVOID Tag
_In_ WDFDEVICE _In_ WDF_SPECIAL_FILE_TYPE FileType
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
_Must_inspect_result_ _In_ WDFDEVICE _In_ WDFDEVICE Child
_Must_inspect_result_ _In_opt_ WDFKEY ParentKey
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _Out_opt_ PUSHORT _Inout_opt_ PUNICODE_STRING Value
_In_ WDFREQUEST _In_ PIO_STACK_LOCATION Stack
_Must_inspect_result_ _In_ ULONG Flags
_In_opt_ PALLOCATE_FUNCTION Allocate
_In_opt_ PALLOCATE_FUNCTION _In_opt_ PFREE_FUNCTION Free
_In_ ULONG _In_ ULONG HintIndex
struct _SECURITY_DESCRIPTOR_RELATIVE * PISECURITY_DESCRIPTOR_RELATIVE
struct _SECURITY_DESCRIPTOR_RELATIVE SECURITY_DESCRIPTOR_RELATIVE