28 #ifndef NTOS_MODE_USER 335 ZwAllocateVirtualMemory(
482 ZwUnmapViewOfSection(
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT InheritDisposition
_Must_inspect_result_ _Outptr_ PVOID * SectionObject
enum _SECTION_INFORMATION_CLASS SECTION_INFORMATION_CLASS
NTSTATUS NTAPI NtFreeUserPhysicalPages(_In_ HANDLE ProcessHandle, _Inout_ PULONG_PTR NumberOfPages, _Inout_ PULONG_PTR UserPfnArray)
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR ZeroBits
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
#define _Must_inspect_result_
_In_ ULONG _In_ ULONG _In_ ULONG Length
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG AllocationAttributes
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT _In_ ULONG _In_ ULONG Protect
NTSYSCALLAPI NTSTATUS NTAPI NtFlushInstructionCache(_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ SIZE_T NumberOfBytesToFlush)
NTSYSCALLAPI NTSTATUS NTAPI NtProtectVirtualMemory(_In_ HANDLE ProcessHandle, _In_ PVOID *BaseAddress, _In_ SIZE_T *NumberOfBytesToProtect, _In_ ULONG NewAccessProtection, _Out_ PULONG OldAccessProtection)
NTSYSAPI NTSTATUS NTAPI ZwLockVirtualMemory(_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T NumberOfBytesToLock, _In_ ULONG MapType)
NTSYSCALLAPI NTSTATUS NTAPI NtUnmapViewOfSection(_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress)
NTSYSCALLAPI NTSTATUS NTAPI NtReadVirtualMemory(_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _Out_ PVOID Buffer, _In_ SIZE_T NumberOfBytesToRead, _Out_opt_ PSIZE_T NumberOfBytesRead)
NTSYSCALLAPI NTSTATUS NTAPI NtLockVirtualMemory(_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T NumberOfBytesToLock, _In_ ULONG MapType)
NTSYSCALLAPI NTSTATUS NTAPI NtOpenSection(_Out_ PHANDLE SectionHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_opt_ HANDLE FileHandle
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER _In_ ULONG SectionPageProtection
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
__kernel_entry _IRQL_requires_max_(PASSIVE_LEVEL) NTSYSCALLAPI NTSTATUS NTAPI NtFreeVirtualMemory(_In_ HANDLE ProcessHandle
NTSTATUS NTAPI MmCreateSection(_Out_ PVOID *SectionObject, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ PLARGE_INTEGER MaximumSize, _In_ ULONG SectionPageProtection, _In_ ULONG AllocationAttributes, _In_opt_ HANDLE FileHandle, _In_opt_ PFILE_OBJECT File)
NTSYSAPI NTSTATUS NTAPI ZwExtendSection(_In_ HANDLE SectionHandle, _In_ PLARGE_INTEGER NewMaximumSize)
NTSYSCALLAPI NTSTATUS NTAPI NtFlushVirtualMemory(_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, _Out_ PIO_STATUS_BLOCK IoStatus)
NTSYSCALLAPI NTSTATUS NTAPI NtQueryVirtualMemory(_In_ HANDLE ProcessHandle, _In_ PVOID Address, _In_ MEMORY_INFORMATION_CLASS VirtualMemoryInformationClass, _Out_ PVOID VirtualMemoryInformation, _In_ SIZE_T Length, _Out_opt_ PSIZE_T ResultLength)
_Must_inspect_result_ __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtCreateSection(_Out_ PHANDLE SectionHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ PLARGE_INTEGER MaximumSize, _In_ ULONG SectionPageProtection, _In_ ULONG AllocationAttributes, _In_opt_ HANDLE FileHandle)
NTSYSCALLAPI NTSTATUS NTAPI NtUnlockVirtualMemory(_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T NumberOfBytesToUnlock, _In_ ULONG MapType)
_Reserved_ PVOID Reserved
NTSTATUS NTAPI NtMapUserPhysicalPagesScatter(_In_ PVOID *VirtualAddresses, _In_ ULONG_PTR NumberOfPages, _Inout_ PULONG_PTR UserPfnArray)
NTSYSAPI NTSTATUS NTAPI ZwWriteVirtualMemory(_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ PVOID Buffer, _In_ SIZE_T NumberOfBytesToWrite, _Out_opt_ PSIZE_T NumberOfBytesWritten)
enum _MEMORY_INFORMATION_CLASS MEMORY_INFORMATION_CLASS
NTSYSCALLAPI NTSTATUS NTAPI NtWriteVirtualMemory(_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ PVOID Buffer, _In_ SIZE_T NumberOfBytesToWrite, _Out_opt_ PSIZE_T NumberOfBytesWritten)
__kernel_entry _Inout_ __drv_freesMem(Mem) PVOID *BaseAddress
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER SectionOffset
NTSYSAPI NTSTATUS NTAPI ZwQueryVirtualMemory(_In_ HANDLE ProcessHandle, _In_ PVOID Address, _In_ MEMORY_INFORMATION_CLASS VirtualMemoryInformationClass, _Out_ PVOID VirtualMemoryInformation, _In_ SIZE_T Length, _Out_opt_ PSIZE_T ResultLength)
NTSYSCALLAPI NTSTATUS NTAPI NtMapViewOfSection(_In_ HANDLE SectionHandle, _In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _In_ ULONG_PTR ZeroBits, _In_ SIZE_T CommitSize, _Inout_opt_ PLARGE_INTEGER SectionOffset, _Inout_ PSIZE_T ViewSize, _In_ SECTION_INHERIT InheritDisposition, _In_ ULONG AllocationType, _In_ ULONG AccessProtection)
NTSTATUS NTAPI NtAllocateUserPhysicalPages(_In_ HANDLE ProcessHandle, _Inout_ PULONG_PTR NumberOfPages, _Inout_ PULONG_PTR UserPfnArray)
NTSTATUS NTAPI NtGetWriteWatch(_In_ HANDLE ProcessHandle, _In_ ULONG Flags, _In_ PVOID BaseAddress, _In_ SIZE_T RegionSize, _In_ PVOID *UserAddressArray, _Out_ PULONG_PTR EntriesInUserAddressArray, _Out_ PULONG Granularity)
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
#define __drv_allocatesMem(kind)
_Must_inspect_result_ _In_ ULONG Flags
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T CommitSize
#define _Outptr_result_bytebuffer_(s)
NTSYSCALLAPI NTSTATUS NTAPI NtCreatePagingFile(_In_ PUNICODE_STRING FileName, _In_ PLARGE_INTEGER InitialSize, _In_ PLARGE_INTEGER MaxiumSize, _In_ ULONG Reserved)
NTSYSAPI NTSTATUS NTAPI ZwUnlockVirtualMemory(_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T NumberOfBytesToUnlock, _In_ ULONG MapType)
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT _In_ ULONG _In_ ULONG Win32Protect
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT _In_ ULONG AllocationType
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
NTSTATUS NTAPI NtAllocateVirtualMemory(IN HANDLE ProcessHandle, IN OUT PVOID *UBaseAddress, IN ULONG_PTR ZeroBits, IN OUT PSIZE_T URegionSize, IN ULONG AllocationType, IN ULONG Protect)
__kernel_entry _Inout_ _Inout_ PSIZE_T _In_ ULONG FreeType
__kernel_entry _Inout_ _Inout_ PSIZE_T RegionSize
#define _Outptr_result_buffer_(s)
NTSYSAPI NTSTATUS NTAPI ZwAreMappedFilesTheSame(_In_ PVOID File1MappedAsAnImage, _In_ PVOID File2MappedAsFile)
NTSTATUS NTAPI NtResetWriteWatch(_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ SIZE_T RegionSize)
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER MaximumSize
NTSYSAPI NTSTATUS NTAPI ZwQuerySection(_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_ PVOID SectionInformation, _In_ SIZE_T Length, _Out_opt_ PSIZE_T ResultLength)
NTSTATUS NTAPI MmMapViewOfSection(_In_ PVOID SectionObject, _In_ PEPROCESS Process, _Inout_ PVOID *BaseAddress, _In_ ULONG_PTR ZeroBits, _In_ SIZE_T CommitSize, _Inout_opt_ PLARGE_INTEGER SectionOffset, _Inout_ PSIZE_T ViewSize, _In_ SECTION_INHERIT InheritDisposition, _In_ ULONG AllocationType, _In_ ULONG Protect)
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T ViewSize
NTSYSCALLAPI NTSTATUS NTAPI NtExtendSection(_In_ HANDLE SectionHandle, _In_ PLARGE_INTEGER NewMaximumSize)
NTSYSAPI NTSTATUS NTAPI ZwCreatePagingFile(_In_ PUNICODE_STRING FileName, _In_ PLARGE_INTEGER InitialSize, _In_ PLARGE_INTEGER MaxiumSize, _In_ ULONG Reserved)
__in UCHAR __in POWER_STATE __in_opt PVOID __in PIO_STATUS_BLOCK IoStatus
_Must_inspect_result_ _In_ WDFDEVICE _In_ DEVICE_REGISTRY_PROPERTY _In_ ULONG _Out_ PULONG ResultLength
NTSTATUS NTAPI MmUnmapViewOfSection(_In_ struct _EPROCESS *Process, _In_ PVOID BaseAddress)
NTSYSAPI NTSTATUS NTAPI ZwOpenSection(_Out_ PHANDLE SectionHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSCALLAPI NTSTATUS NTAPI NtAreMappedFilesTheSame(_In_ PVOID File1MappedAsAnImage, _In_ PVOID File2MappedAsFile)
_In_ HANDLE ProcessHandle
enum _SECTION_INHERIT SECTION_INHERIT
NTSYSAPI NTSTATUS NTAPI ZwProtectVirtualMemory(_In_ HANDLE ProcessHandle, _In_ PVOID *BaseAddress, _In_ SIZE_T *NumberOfBytesToProtect, _In_ ULONG NewAccessProtection, _Out_ PULONG OldAccessProtection)
NTSYSCALLAPI NTSTATUS NTAPI NtQuerySection(_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_ PVOID SectionInformation, _In_ SIZE_T Length, _Out_ PSIZE_T ResultLength)
NTSYSAPI NTSTATUS NTAPI ZwReadVirtualMemory(_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _Out_ PVOID Buffer, _In_ SIZE_T NumberOfBytesToRead, _Out_opt_ PSIZE_T NumberOfBytesRead)
NTSTATUS NTAPI NtMapUserPhysicalPages(_In_ PVOID VirtualAddresses, _In_ ULONG_PTR NumberOfPages, _Inout_ PULONG_PTR UserPfnArray)
NTSTATUS NTAPI NtFreeVirtualMemory(IN HANDLE ProcessHandle, IN PVOID *UBaseAddress, IN PSIZE_T URegionSize, IN ULONG FreeType)