├── DirectNtApi.h ├── LICENSE ├── README.md ├── amd64 ├── DirectNtApi.asm ├── DirectNtApi.lib └── DirectNtApi.obj ├── i386 ├── DirectNtApi.asm └── DirectNtApi.lib └── usage.txt /DirectNtApi.h: -------------------------------------------------------------------------------- 1 | /* 2 | 3 | DirectNtApi ( version - final ) 4 | (C) 2011 - Fyyre 5 | 6 | last update: 27.05.2011 7 | 8 | */ 9 | 10 | #include 11 | 12 | #pragma once 13 | 14 | extern DWORD dwNtAcceptConnectPort; 15 | extern DWORD dwNtAccessCheck; 16 | extern DWORD dwNtAccessCheckAndAuditAlarm; 17 | extern DWORD dwNtAccessCheckByType; 18 | extern DWORD dwNtAccessCheckByTypeAndAuditAlarm; 19 | extern DWORD dwNtAccessCheckByTypeResultList; 20 | extern DWORD dwNtAccessCheckByTypeResultListAndAuditAlarm; 21 | extern DWORD dwNtAccessCheckByTypeResultListAndAuditAlarmByHandle; 22 | extern DWORD dwNtAddAtom; 23 | extern DWORD dwNtAddBootEntry; 24 | extern DWORD dwNtAddDriverEntry; 25 | extern DWORD dwNtAdjustGroupsToken; 26 | extern DWORD dwNtAdjustPrivilegesToken; 27 | extern DWORD dwNtAlertResumeThread; 28 | extern DWORD dwNtAlertThread; 29 | extern DWORD dwNtAllocateLocallyUniqueId; 30 | extern DWORD dwNtAllocateReserveObject; 31 | extern DWORD dwNtAllocateUserPhysicalPages; 32 | extern DWORD dwNtAllocateUuids; 33 | extern DWORD dwNtAllocateVirtualMemory; 34 | extern DWORD dwNtAlpcAcceptConnectPort; 35 | extern DWORD dwNtAlpcCancelMessage; 36 | extern DWORD dwNtAlpcConnectPort; 37 | extern DWORD dwNtAlpcCreatePort; 38 | extern DWORD dwNtAlpcCreatePortSection; 39 | extern DWORD dwNtAlpcCreateResourceReserve; 40 | extern DWORD dwNtAlpcCreateSectionView; 41 | extern DWORD dwNtAlpcCreateSecurityContext; 42 | extern DWORD dwNtAlpcDeletePortSection; 43 | extern DWORD dwNtAlpcDeleteResourceReserve; 44 | extern DWORD dwNtAlpcDeleteSectionView; 45 | extern DWORD dwNtAlpcDeleteSecurityContext; 46 | extern DWORD dwNtAlpcDisconnectPort; 47 | extern DWORD dwNtAlpcImpersonateClientOfPort; 48 | extern DWORD dwNtAlpcOpenSenderProcess; 49 | extern DWORD dwNtAlpcOpenSenderThread; 50 | extern DWORD dwNtAlpcQueryInformation; 51 | extern DWORD dwNtAlpcQueryInformationMessage; 52 | extern DWORD dwNtAlpcRevokeSecurityContext; 53 | extern DWORD dwNtAlpcSendWaitReceivePort; 54 | extern DWORD dwNtAlpcSetInformation; 55 | extern DWORD dwNtApphelpCacheControl; 56 | extern DWORD dwNtAreMappedFilesTheSame; 57 | extern DWORD dwNtAssignProcessToJobObject; 58 | extern DWORD dwNtCallbackReturn; 59 | extern DWORD dwNtCancelIoFile; 60 | extern DWORD dwNtCancelIoFileEx; 61 | extern DWORD dwNtCancelSynchronousIoFile; 62 | extern DWORD dwNtCancelTimer; 63 | extern DWORD dwNtClearEvent; 64 | extern DWORD dwNtClose; 65 | extern DWORD dwNtCloseObjectAuditAlarm; 66 | extern DWORD dwNtCommitComplete; 67 | extern DWORD dwNtCommitEnlistment; 68 | extern DWORD dwNtCommitTransaction; 69 | extern DWORD dwNtCompactKeys; 70 | extern DWORD dwNtCompareTokens; 71 | extern DWORD dwNtCompleteConnectPort; 72 | extern DWORD dwNtCompressKey; 73 | extern DWORD dwNtConnectPort; 74 | extern DWORD dwNtContinue; 75 | extern DWORD dwNtCreateDebugObject; 76 | extern DWORD dwNtCreateDirectoryObject; 77 | extern DWORD dwNtCreateEnlistment; 78 | extern DWORD dwNtCreateEvent; 79 | extern DWORD dwNtCreateEventPair; 80 | extern DWORD dwNtCreateFile; 81 | extern DWORD dwNtCreateIoCompletion; 82 | extern DWORD dwNtCreateJobObject; 83 | extern DWORD dwNtCreateJobSet; 84 | extern DWORD dwNtCreateKey; 85 | extern DWORD dwNtCreateKeyTransacted; 86 | extern DWORD dwNtCreateKeyedEvent; 87 | extern DWORD dwNtCreateMailslotFile; 88 | extern DWORD dwNtCreateMutant; 89 | extern DWORD dwNtCreateNamedPipeFile; 90 | extern DWORD dwNtCreatePagingFile; 91 | extern DWORD dwNtCreatePort; 92 | extern DWORD dwNtCreatePrivateNamespace; 93 | extern DWORD dwNtCreateProcess; 94 | extern DWORD dwNtCreateProcessEx; 95 | extern DWORD dwNtCreateProfile; 96 | extern DWORD dwNtCreateProfileEx; 97 | extern DWORD dwNtCreateResourceManager; 98 | extern DWORD dwNtCreateSection; 99 | extern DWORD dwNtCreateSemaphore; 100 | extern DWORD dwNtCreateSymbolicLinkObject; 101 | extern DWORD dwNtCreateThread; 102 | extern DWORD dwNtCreateThreadEx; 103 | extern DWORD dwNtCreateTimer; 104 | extern DWORD dwNtCreateToken; 105 | extern DWORD dwNtCreateTransaction; 106 | extern DWORD dwNtCreateTransactionManager; 107 | extern DWORD dwNtCreateUserProcess; 108 | extern DWORD dwNtCreateWaitablePort; 109 | extern DWORD dwNtCreateWorkerFactory; 110 | extern DWORD dwNtCurrentTeb; 111 | extern DWORD dwNtDebugActiveProcess; 112 | extern DWORD dwNtDebugContinue; 113 | extern DWORD dwNtDelayExecution; 114 | extern DWORD dwNtDeleteAtom; 115 | extern DWORD dwNtDeleteBootEntry; 116 | extern DWORD dwNtDeleteDriverEntry; 117 | extern DWORD dwNtDeleteFile; 118 | extern DWORD dwNtDeleteKey; 119 | extern DWORD dwNtDeleteObjectAuditAlarm; 120 | extern DWORD dwNtDeletePrivateNamespace; 121 | extern DWORD dwNtDeleteValueKey; 122 | extern DWORD dwNtDeviceIoControlFile; 123 | extern DWORD dwNtDisableLastKnownGood; 124 | extern DWORD dwNtDisplayString; 125 | extern DWORD dwNtDrawText; 126 | extern DWORD dwNtDuplicateObject; 127 | extern DWORD dwNtDuplicateToken; 128 | extern DWORD dwNtEnableLastKnownGood; 129 | extern DWORD dwNtEnumerateBootEntries; 130 | extern DWORD dwNtEnumerateDriverEntries; 131 | extern DWORD dwNtEnumerateKey; 132 | extern DWORD dwNtEnumerateSystemEnvironmentValuesEx; 133 | extern DWORD dwNtEnumerateTransactionObject; 134 | extern DWORD dwNtEnumerateValueKey; 135 | extern DWORD dwNtExtendSection; 136 | extern DWORD dwNtFilterToken; 137 | extern DWORD dwNtFindAtom; 138 | extern DWORD dwNtFlushBuffersFile; 139 | extern DWORD dwNtFlushInstallUILanguage; 140 | extern DWORD dwNtFlushInstructionCache; 141 | extern DWORD dwNtFlushKey; 142 | extern DWORD dwNtFlushProcessWriteBuffers; 143 | extern DWORD dwNtFlushVirtualMemory; 144 | extern DWORD dwNtFlushWriteBuffer; 145 | extern DWORD dwNtFreeUserPhysicalPages; 146 | extern DWORD dwNtFreeVirtualMemory; 147 | extern DWORD dwNtFreezeRegistry; 148 | extern DWORD dwNtFreezeTransactions; 149 | extern DWORD dwNtFsControlFile; 150 | extern DWORD dwNtGetContextThread; 151 | extern DWORD dwNtGetCurrentProcessorNumber; 152 | extern DWORD dwNtGetDevicePowerState; 153 | extern DWORD dwNtGetMUIRegistryInfo; 154 | extern DWORD dwNtGetNextProcess; 155 | extern DWORD dwNtGetNextThread; 156 | extern DWORD dwNtGetNlsSectionPtr; 157 | extern DWORD dwNtGetNotificationResourceManager; 158 | extern DWORD dwNtGetPlugPlayEvent; 159 | extern DWORD dwNtGetTickCount; 160 | extern DWORD dwNtGetWriteWatch; 161 | extern DWORD dwNtImpersonateAnonymousToken; 162 | extern DWORD dwNtImpersonateClientOfPort; 163 | extern DWORD dwNtImpersonateThread; 164 | extern DWORD dwNtInitializeNlsFiles; 165 | extern DWORD dwNtInitializeRegistry; 166 | extern DWORD dwNtInitiatePowerAction; 167 | extern DWORD dwNtIsProcessInJob; 168 | extern DWORD dwNtIsSystemResumeAutomatic; 169 | extern DWORD dwNtIsUILanguageComitted; 170 | extern DWORD dwNtListenPort; 171 | extern DWORD dwNtLoadDriver; 172 | extern DWORD dwNtLoadKey2; 173 | extern DWORD dwNtLoadKey; 174 | extern DWORD dwNtLoadKeyEx; 175 | extern DWORD dwNtLockFile; 176 | extern DWORD dwNtLockProductActivationKeys; 177 | extern DWORD dwNtLockRegistryKey; 178 | extern DWORD dwNtLockVirtualMemory; 179 | extern DWORD dwNtMakePermanentObject; 180 | extern DWORD dwNtMakeTemporaryObject; 181 | extern DWORD dwNtMapCMFModule; 182 | extern DWORD dwNtMapUserPhysicalPages; 183 | extern DWORD dwNtMapUserPhysicalPagesScatter; 184 | extern DWORD dwNtMapViewOfSection; 185 | extern DWORD dwNtModifyBootEntry; 186 | extern DWORD dwNtModifyDriverEntry; 187 | extern DWORD dwNtNotifyChangeDirectoryFile; 188 | extern DWORD dwNtNotifyChangeKey; 189 | extern DWORD dwNtNotifyChangeMultipleKeys; 190 | extern DWORD dwNtNotifyChangeSession; 191 | extern DWORD dwNtOpenDirectoryObject; 192 | extern DWORD dwNtOpenEnlistment; 193 | extern DWORD dwNtOpenEvent; 194 | extern DWORD dwNtOpenEventPair; 195 | extern DWORD dwNtOpenFile; 196 | extern DWORD dwNtOpenIoCompletion; 197 | extern DWORD dwNtOpenJobObject; 198 | extern DWORD dwNtOpenKey; 199 | extern DWORD dwNtOpenKeyEx; 200 | extern DWORD dwNtOpenKeyTransacted; 201 | extern DWORD dwNtOpenKeyTransactedEx; 202 | extern DWORD dwNtOpenKeyedEvent; 203 | extern DWORD dwNtOpenMutant; 204 | extern DWORD dwNtOpenObjectAuditAlarm; 205 | extern DWORD dwNtOpenPrivateNamespace; 206 | extern DWORD dwNtOpenProcess; 207 | extern DWORD dwNtOpenProcessToken; 208 | extern DWORD dwNtOpenProcessTokenEx; 209 | extern DWORD dwNtOpenResourceManager; 210 | extern DWORD dwNtOpenSection; 211 | extern DWORD dwNtOpenSemaphore; 212 | extern DWORD dwNtOpenSession; 213 | extern DWORD dwNtOpenSymbolicLinkObject; 214 | extern DWORD dwNtOpenThread; 215 | extern DWORD dwNtOpenThreadToken; 216 | extern DWORD dwNtOpenThreadTokenEx; 217 | extern DWORD dwNtOpenTimer; 218 | extern DWORD dwNtOpenTransaction; 219 | extern DWORD dwNtOpenTransactionManager; 220 | extern DWORD dwNtPlugPlayControl; 221 | extern DWORD dwNtPowerInformation; 222 | extern DWORD dwNtPrePrepareComplete; 223 | extern DWORD dwNtPrePrepareEnlistment; 224 | extern DWORD dwNtPrepareComplete; 225 | extern DWORD dwNtPrepareEnlistment; 226 | extern DWORD dwNtPrivilegeCheck; 227 | extern DWORD dwNtPrivilegeObjectAuditAlarm; 228 | extern DWORD dwNtPrivilegedServiceAuditAlarm; 229 | extern DWORD dwNtPropagationComplete; 230 | extern DWORD dwNtPropagationFailed; 231 | extern DWORD dwNtProtectVirtualMemory; 232 | extern DWORD dwNtPulseEvent; 233 | extern DWORD dwNtQueryAttributesFile; 234 | extern DWORD dwNtQueryBootEntryOrder; 235 | extern DWORD dwNtQueryBootOptions; 236 | extern DWORD dwNtQueryDebugFilterState; 237 | extern DWORD dwNtQueryDefaultLocale; 238 | extern DWORD dwNtQueryDefaultUILanguage; 239 | extern DWORD dwNtQueryDirectoryFile; 240 | extern DWORD dwNtQueryDirectoryObject; 241 | extern DWORD dwNtQueryDriverEntryOrder; 242 | extern DWORD dwNtQueryEaFile; 243 | extern DWORD dwNtQueryEvent; 244 | extern DWORD dwNtQueryFullAttributesFile; 245 | extern DWORD dwNtQueryInformationAtom; 246 | extern DWORD dwNtQueryInformationEnlistment; 247 | extern DWORD dwNtQueryInformationFile; 248 | extern DWORD dwNtQueryInformationJobObject; 249 | extern DWORD dwNtQueryInformationPort; 250 | extern DWORD dwNtQueryInformationProcess; 251 | extern DWORD dwNtQueryInformationResourceManager; 252 | extern DWORD dwNtQueryInformationThread; 253 | extern DWORD dwNtQueryInformationToken; 254 | extern DWORD dwNtQueryInformationTransaction; 255 | extern DWORD dwNtQueryInformationTransactionManager; 256 | extern DWORD dwNtQueryInformationWorkerFactory; 257 | extern DWORD dwNtQueryInstallUILanguage; 258 | extern DWORD dwNtQueryIntervalProfile; 259 | extern DWORD dwNtQueryIoCompletion; 260 | extern DWORD dwNtQueryKey; 261 | extern DWORD dwNtQueryLicenseValue; 262 | extern DWORD dwNtQueryMultipleValueKey; 263 | extern DWORD dwNtQueryMutant; 264 | extern DWORD dwNtQueryObject; 265 | extern DWORD dwNtQueryOpenSubKeys; 266 | extern DWORD dwNtQueryOpenSubKeysEx; 267 | extern DWORD dwNtQueryPerformanceCounter; 268 | extern DWORD dwNtQueryPortInformationProcess; 269 | extern DWORD dwNtQueryQuotaInformationFile; 270 | extern DWORD dwNtQuerySection; 271 | extern DWORD dwNtQuerySecurityAttributesToken; 272 | extern DWORD dwNtQuerySecurityObject; 273 | extern DWORD dwNtQuerySemaphore; 274 | extern DWORD dwNtQuerySymbolicLinkObject; 275 | extern DWORD dwNtQuerySystemEnvironmentValue; 276 | extern DWORD dwNtQuerySystemEnvironmentValueEx; 277 | extern DWORD dwNtQuerySystemInformation; 278 | extern DWORD dwNtQuerySystemInformationEx; 279 | extern DWORD dwNtQuerySystemTime; 280 | extern DWORD dwNtQueryTimer; 281 | extern DWORD dwNtQueryTimerResolution; 282 | extern DWORD dwNtQueryValueKey; 283 | extern DWORD dwNtQueryVirtualMemory; 284 | extern DWORD dwNtQueryVolumeInformationFile; 285 | extern DWORD dwNtQueueApcThread; 286 | extern DWORD dwNtQueueApcThreadEx; 287 | extern DWORD dwNtRaiseException; 288 | extern DWORD dwNtRaiseHardError; 289 | extern DWORD dwNtReadFile; 290 | extern DWORD dwNtReadFileScatter; 291 | extern DWORD dwNtReadOnlyEnlistment; 292 | extern DWORD dwNtReadRequestData; 293 | extern DWORD dwNtReadVirtualMemory; 294 | extern DWORD dwNtRecoverEnlistment; 295 | extern DWORD dwNtRecoverResourceManager; 296 | extern DWORD dwNtRecoverTransactionManager; 297 | extern DWORD dwNtRegisterProtocolAddressInformation; 298 | extern DWORD dwNtRegisterThreadTerminatePort; 299 | extern DWORD dwNtReleaseKeyedEvent; 300 | extern DWORD dwNtReleaseMutant; 301 | extern DWORD dwNtReleaseSemaphore; 302 | extern DWORD dwNtReleaseWorkerFactoryWorker; 303 | extern DWORD dwNtRemoveIoCompletion; 304 | extern DWORD dwNtRemoveIoCompletionEx; 305 | extern DWORD dwNtRemoveProcessDebug; 306 | extern DWORD dwNtRenameKey; 307 | extern DWORD dwNtRenameTransactionManager; 308 | extern DWORD dwNtReplaceKey; 309 | extern DWORD dwNtReplacePartitionUnit; 310 | extern DWORD dwNtReplyPort; 311 | extern DWORD dwNtReplyWaitReceivePort; 312 | extern DWORD dwNtReplyWaitReceivePortEx; 313 | extern DWORD dwNtReplyWaitReplyPort; 314 | extern DWORD dwNtRequestPort; 315 | extern DWORD dwNtRequestWaitReplyPort; 316 | extern DWORD dwNtResetEvent; 317 | extern DWORD dwNtResetWriteWatch; 318 | extern DWORD dwNtRestoreKey; 319 | extern DWORD dwNtResumeProcess; 320 | extern DWORD dwNtResumeThread; 321 | extern DWORD dwNtRollbackComplete; 322 | extern DWORD dwNtRollbackEnlistment; 323 | extern DWORD dwNtRollbackTransaction; 324 | extern DWORD dwNtRollforwardTransactionManager; 325 | extern DWORD dwNtSaveKey; 326 | extern DWORD dwNtSaveKeyEx; 327 | extern DWORD dwNtSaveMergedKeys; 328 | extern DWORD dwNtSecureConnectPort; 329 | extern DWORD dwNtSerializeBoot; 330 | extern DWORD dwNtSetBootEntryOrder; 331 | extern DWORD dwNtSetBootOptions; 332 | extern DWORD dwNtSetContextThread; 333 | extern DWORD dwNtSetDebugFilterState; 334 | extern DWORD dwNtSetDefaultHardErrorPort; 335 | extern DWORD dwNtSetDefaultLocale; 336 | extern DWORD dwNtSetDefaultUILanguage; 337 | extern DWORD dwNtSetDriverEntryOrder; 338 | extern DWORD dwNtSetEaFile; 339 | extern DWORD dwNtSetEvent; 340 | extern DWORD dwNtSetEventBoostPriority; 341 | extern DWORD dwNtSetHighEventPair; 342 | extern DWORD dwNtSetHighWaitLowEventPair; 343 | extern DWORD dwNtSetInformationDebugObject; 344 | extern DWORD dwNtSetInformationEnlistment; 345 | extern DWORD dwNtSetInformationFile; 346 | extern DWORD dwNtSetInformationJobObject; 347 | extern DWORD dwNtSetInformationKey; 348 | extern DWORD dwNtSetInformationObject; 349 | extern DWORD dwNtSetInformationProcess; 350 | extern DWORD dwNtSetInformationResourceManager; 351 | extern DWORD dwNtSetInformationThread; 352 | extern DWORD dwNtSetInformationToken; 353 | extern DWORD dwNtSetInformationTransaction; 354 | extern DWORD dwNtSetInformationTransactionManager; 355 | extern DWORD dwNtSetInformationWorkerFactory; 356 | extern DWORD dwNtSetIntervalProfile; 357 | extern DWORD dwNtSetIoCompletion; 358 | extern DWORD dwNtSetIoCompletionEx; 359 | extern DWORD dwNtSetLdtEntries; 360 | extern DWORD dwNtSetLowEventPair; 361 | extern DWORD dwNtSetLowWaitHighEventPair; 362 | extern DWORD dwNtSetQuotaInformationFile; 363 | extern DWORD dwNtSetSecurityObject; 364 | extern DWORD dwNtSetSystemEnvironmentValue; 365 | extern DWORD dwNtSetSystemEnvironmentValueEx; 366 | extern DWORD dwNtSetSystemInformation; 367 | extern DWORD dwNtSetSystemPowerState; 368 | extern DWORD dwNtSetSystemTime; 369 | extern DWORD dwNtSetThreadExecutionState; 370 | extern DWORD dwNtSetTimer; 371 | extern DWORD dwNtSetTimerEx; 372 | extern DWORD dwNtSetTimerResolution; 373 | extern DWORD dwNtSetUuidSeed; 374 | extern DWORD dwNtSetValueKey; 375 | extern DWORD dwNtSetVolumeInformationFile; 376 | extern DWORD dwNtShutdownSystem; 377 | extern DWORD dwNtShutdownWorkerFactory; 378 | extern DWORD dwNtSignalAndWaitForSingleObject; 379 | extern DWORD dwNtSinglePhaseReject; 380 | extern DWORD dwNtStartProfile; 381 | extern DWORD dwNtStopProfile; 382 | extern DWORD dwNtSuspendProcess; 383 | extern DWORD dwNtSuspendThread; 384 | extern DWORD dwNtSystemDebugControl; 385 | extern DWORD dwNtTerminateJobObject; 386 | extern DWORD dwNtTerminateProcess; 387 | extern DWORD dwNtTerminateThread; 388 | extern DWORD dwNtTestAlert; 389 | extern DWORD dwNtThawRegistry; 390 | extern DWORD dwNtThawTransactions; 391 | extern DWORD dwNtTraceControl; 392 | extern DWORD dwNtTraceEvent; 393 | extern DWORD dwNtTranslateFilePath; 394 | extern DWORD dwNtUmsThreadYield; 395 | extern DWORD dwNtUnloadDriver; 396 | extern DWORD dwNtUnloadKey2; 397 | extern DWORD dwNtUnloadKey; 398 | extern DWORD dwNtUnloadKeyEx; 399 | extern DWORD dwNtUnlockFile; 400 | extern DWORD dwNtUnlockVirtualMemory; 401 | extern DWORD dwNtUnmapViewOfSection; 402 | extern DWORD dwNtVdmControl; 403 | extern DWORD dwNtWaitForDebugEvent; 404 | extern DWORD dwNtWaitForKeyedEvent; 405 | extern DWORD dwNtWaitForMultipleObjects32; 406 | extern DWORD dwNtWaitForMultipleObjects; 407 | extern DWORD dwNtWaitForSingleObject; 408 | extern DWORD dwNtWaitForWorkViaWorkerFactory; 409 | extern DWORD dwNtWaitHighEventPair; 410 | extern DWORD dwNtWaitLowEventPair; 411 | extern DWORD dwNtWorkerFactoryWorkerReady; 412 | extern DWORD dwNtWow64CallFunction64; 413 | extern DWORD dwNtWow64CsrAllocateCaptureBuffer; 414 | extern DWORD dwNtWow64CsrAllocateMessagePointer; 415 | extern DWORD dwNtWow64CsrCaptureMessageBuffer; 416 | extern DWORD dwNtWow64CsrCaptureMessageString; 417 | extern DWORD dwNtWow64CsrClientCallServer; 418 | extern DWORD dwNtWow64CsrClientConnectToServer; 419 | extern DWORD dwNtWow64CsrFreeCaptureBuffer; 420 | extern DWORD dwNtWow64CsrGetProcessId; 421 | extern DWORD dwNtWow64CsrIdentifyAlertableThread; 422 | extern DWORD dwNtWow64CsrVerifyRegion; 423 | extern DWORD dwNtWow64DebuggerCall; 424 | extern DWORD dwNtWow64GetCurrentProcessorNumberEx; 425 | extern DWORD dwNtWow64GetNativeSystemInformation; 426 | extern DWORD dwNtWow64InterlockedPopEntrySList; 427 | extern DWORD dwNtWow64QueryInformationProcess64; 428 | extern DWORD dwNtWow64QueryVirtualMemory64; 429 | extern DWORD dwNtWow64ReadVirtualMemory64; 430 | extern DWORD dwNtWow64WriteVirtualMemory64; 431 | extern DWORD dwNtWriteFile; 432 | extern DWORD dwNtWriteFileGather; 433 | extern DWORD dwNtWriteRequestData; 434 | extern DWORD dwNtWriteVirtualMemory; 435 | extern DWORD dwNtYieldExecution; 436 | 437 | 438 | 439 | NTSTATUS 440 | NTAPI 441 | DirectNtDelayExecution( 442 | IN BOOLEAN Alertable, 443 | IN PLARGE_INTEGER DelayInterval 444 | ); 445 | 446 | 447 | NTSTATUS 448 | NTAPI 449 | DirectNtQuerySystemEnvironmentValue( 450 | IN PUNICODE_STRING VariableName, 451 | OUT PWSTR VariableValue, 452 | IN USHORT ValueLength, 453 | OUT PUSHORT ReturnLength OPTIONAL 454 | ); 455 | 456 | 457 | NTSTATUS 458 | NTAPI 459 | DirectNtSetSystemEnvironmentValue( 460 | IN PUNICODE_STRING VariableName, 461 | IN PUNICODE_STRING VariableValue 462 | ); 463 | 464 | 465 | NTSTATUS 466 | NTAPI 467 | DirectNtQuerySystemEnvironmentValueEx( 468 | IN PUNICODE_STRING VariableName, 469 | IN LPGUID VendorGuid, 470 | OUT OPTIONAL PVOID Value, 471 | IN OUT PULONG ValueLength, 472 | OUT OPTIONAL PULONG Attributes 473 | ); 474 | 475 | 476 | NTSTATUS 477 | NTAPI 478 | DirectNtSetSystemEnvironmentValueEx( 479 | IN PUNICODE_STRING VariableName, 480 | IN LPGUID VendorGuid, 481 | IN OPTIONAL PVOID Value, 482 | IN ULONG ValueLength, 483 | IN ULONG Attributes 484 | ); 485 | 486 | 487 | NTSTATUS 488 | NTAPI 489 | DirectNtEnumerateSystemEnvironmentValuesEx( 490 | IN ULONG InformationClass, 491 | OUT PVOID Buffer, 492 | IN OUT PULONG BufferLength 493 | ); 494 | 495 | 496 | NTSTATUS 497 | NTAPI 498 | DirectNtAddBootEntry( 499 | IN PBOOT_ENTRY BootEntry, 500 | OUT OPTIONAL PULONG Id 501 | ); 502 | 503 | 504 | NTSTATUS 505 | NTAPI 506 | DirectNtDeleteBootEntry( 507 | IN ULONG Id 508 | ); 509 | 510 | 511 | NTSTATUS 512 | NTAPI 513 | DirectNtModifyBootEntry( 514 | IN PBOOT_ENTRY BootEntry 515 | ); 516 | 517 | 518 | NTSTATUS 519 | NTAPI 520 | DirectNtEnumerateBootEntries( 521 | OUT OPTIONAL PVOID Buffer, 522 | IN OUT PULONG BufferLength 523 | ); 524 | 525 | 526 | NTSTATUS 527 | NTAPI 528 | DirectNtQueryBootEntryOrder( 529 | OUT OPTIONAL PULONG Ids, 530 | IN OUT PULONG Count 531 | ); 532 | 533 | 534 | NTSTATUS 535 | NTAPI 536 | DirectNtSetBootEntryOrder( 537 | IN PULONG Ids, 538 | IN ULONG Count 539 | ); 540 | 541 | 542 | NTSTATUS 543 | NTAPI 544 | DirectNtQueryBootOptions( 545 | OUT OPTIONAL PBOOT_OPTIONS BootOptions, 546 | IN OUT PULONG BootOptionsLength 547 | ); 548 | 549 | 550 | NTSTATUS 551 | NTAPI 552 | DirectNtSetBootOptions( 553 | IN PBOOT_OPTIONS BootOptions, 554 | IN ULONG FieldsToChange 555 | ); 556 | 557 | 558 | NTSTATUS 559 | NTAPI 560 | DirectNtTranslateFilePath( 561 | IN PFILE_PATH InputFilePath, 562 | IN ULONG OutputType, 563 | OUT OPTIONAL PFILE_PATH OutputFilePath, 564 | IN OUT OPTIONAL PULONG OutputFilePathLength 565 | ); 566 | 567 | 568 | NTSTATUS 569 | NTAPI 570 | DirectNtAddDriverEntry( 571 | IN PEFI_DRIVER_ENTRY DriverEntry, 572 | OUT OPTIONAL PULONG Id 573 | ); 574 | 575 | 576 | NTSTATUS 577 | NTAPI 578 | DirectNtDeleteDriverEntry( 579 | IN ULONG Id 580 | ); 581 | 582 | 583 | NTSTATUS 584 | NTAPI 585 | DirectNtModifyDriverEntry( 586 | IN PEFI_DRIVER_ENTRY DriverEntry 587 | ); 588 | 589 | 590 | NTSTATUS 591 | NTAPI 592 | DirectNtEnumerateDriverEntries( 593 | OUT PVOID Buffer, 594 | IN OUT PULONG BufferLength 595 | ); 596 | 597 | 598 | NTSTATUS 599 | NTAPI 600 | DirectNtQueryDriverEntryOrder( 601 | OUT PULONG Ids, 602 | IN OUT PULONG Count 603 | ); 604 | 605 | 606 | NTSTATUS 607 | NTAPI 608 | DirectNtSetDriverEntryOrder( 609 | IN PULONG Ids, 610 | IN ULONG Count 611 | ); 612 | 613 | 614 | NTSTATUS 615 | NTAPI 616 | DirectNtClearEvent( 617 | IN HANDLE EventHandle 618 | ); 619 | 620 | 621 | NTSTATUS 622 | NTAPI 623 | DirectNtCreateEvent( 624 | OUT PHANDLE EventHandle, 625 | IN ACCESS_MASK DesiredAccess, 626 | IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, 627 | IN EVENT_TYPE EventType, 628 | IN BOOLEAN InitialState 629 | ); 630 | 631 | 632 | NTSTATUS 633 | NTAPI 634 | DirectNtOpenEvent( 635 | OUT PHANDLE EventHandle, 636 | IN ACCESS_MASK DesiredAccess, 637 | IN POBJECT_ATTRIBUTES ObjectAttributes 638 | ); 639 | 640 | 641 | NTSTATUS 642 | NTAPI 643 | DirectNtPulseEvent( 644 | IN HANDLE EventHandle, 645 | OUT PLONG PreviousState OPTIONAL 646 | ); 647 | 648 | 649 | NTSTATUS 650 | NTAPI 651 | DirectNtQueryEvent( 652 | IN HANDLE EventHandle, 653 | IN EVENT_INFORMATION_CLASS EventInformationClass, 654 | OUT PVOID EventInformation, 655 | IN ULONG EventInformationLength, 656 | OUT PULONG ReturnLength OPTIONAL 657 | ); 658 | 659 | 660 | NTSTATUS 661 | NTAPI 662 | DirectNtResetEvent( 663 | IN HANDLE EventHandle, 664 | OUT PLONG PreviousState OPTIONAL 665 | ); 666 | 667 | 668 | NTSTATUS 669 | NTAPI 670 | DirectNtSetEvent( 671 | IN HANDLE EventHandle, 672 | OUT OPTIONAL PLONG PreviousState 673 | ); 674 | 675 | 676 | NTSTATUS 677 | NTAPI 678 | DirectNtSetEventBoostPriority( 679 | IN HANDLE EventHandle 680 | ); 681 | 682 | 683 | NTSTATUS 684 | NTAPI 685 | DirectNtCreateEventPair( 686 | OUT PHANDLE EventPairHandle, 687 | IN ACCESS_MASK DesiredAccess, 688 | IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes 689 | ); 690 | 691 | 692 | NTSTATUS 693 | NTAPI 694 | DirectNtOpenEventPair( 695 | OUT PHANDLE EventPairHandle, 696 | IN ACCESS_MASK DesiredAccess, 697 | IN POBJECT_ATTRIBUTES ObjectAttributes 698 | ); 699 | 700 | 701 | NTSTATUS 702 | NTAPI 703 | DirectNtWaitLowEventPair( 704 | IN HANDLE EventPairHandle 705 | ); 706 | 707 | 708 | NTSTATUS 709 | NTAPI 710 | DirectNtWaitHighEventPair( 711 | IN HANDLE EventPairHandle 712 | ); 713 | 714 | 715 | NTSTATUS 716 | NTAPI 717 | DirectNtSetLowWaitHighEventPair( 718 | IN HANDLE EventPairHandle 719 | ); 720 | 721 | 722 | NTSTATUS 723 | NTAPI 724 | DirectNtSetHighWaitLowEventPair( 725 | IN HANDLE EventPairHandle 726 | ); 727 | 728 | 729 | NTSTATUS 730 | NTAPI 731 | DirectNtSetLowEventPair( 732 | IN HANDLE EventPairHandle 733 | ); 734 | 735 | 736 | NTSTATUS 737 | NTAPI 738 | DirectNtSetHighEventPair( 739 | IN HANDLE EventPairHandle 740 | ); 741 | 742 | 743 | NTSTATUS 744 | NTAPI 745 | DirectNtCreateMutant( 746 | OUT PHANDLE MutantHandle, 747 | IN ACCESS_MASK DesiredAccess, 748 | IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, 749 | IN BOOLEAN InitialOwner 750 | ); 751 | 752 | 753 | NTSTATUS 754 | NTAPI 755 | DirectNtOpenMutant( 756 | OUT PHANDLE MutantHandle, 757 | IN ACCESS_MASK DesiredAccess, 758 | IN POBJECT_ATTRIBUTES ObjectAttributes 759 | ); 760 | 761 | 762 | NTSTATUS 763 | NTAPI 764 | DirectNtQueryMutant( 765 | IN HANDLE MutantHandle, 766 | IN MUTANT_INFORMATION_CLASS MutantInformationClass, 767 | OUT PVOID MutantInformation, 768 | IN ULONG MutantInformationLength, 769 | OUT OPTIONAL PULONG ReturnLength 770 | ); 771 | 772 | 773 | NTSTATUS 774 | NTAPI 775 | DirectNtReleaseMutant( 776 | IN HANDLE MutantHandle, 777 | OUT OPTIONAL PLONG PreviousCount 778 | ); 779 | 780 | 781 | NTSTATUS 782 | NTAPI 783 | DirectNtCreateSemaphore( 784 | OUT PHANDLE SemaphoreHandle, 785 | IN ACCESS_MASK DesiredAccess, 786 | IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, 787 | IN LONG InitialCount, 788 | IN LONG MaximumCount 789 | ); 790 | 791 | 792 | NTSTATUS 793 | NTAPI 794 | DirectNtOpenSemaphore( 795 | OUT PHANDLE SemaphoreHandle, 796 | IN ACCESS_MASK DesiredAccess, 797 | IN POBJECT_ATTRIBUTES ObjectAttributes 798 | ); 799 | 800 | 801 | NTSTATUS 802 | NTAPI 803 | DirectNtQuerySemaphore( 804 | IN HANDLE SemaphoreHandle, 805 | IN SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass, 806 | OUT PVOID SemaphoreInformation, 807 | IN ULONG SemaphoreInformationLength, 808 | OUT PULONG ReturnLength OPTIONAL 809 | ); 810 | 811 | 812 | NTSTATUS 813 | NTAPI 814 | DirectNtReleaseSemaphore( 815 | IN HANDLE SemaphoreHandle, 816 | IN LONG ReleaseCount, 817 | OUT OPTIONAL PLONG PreviousCount 818 | ); 819 | 820 | 821 | NTSTATUS 822 | NTAPI 823 | DirectNtCreateTimer( 824 | OUT PHANDLE TimerHandle, 825 | IN ACCESS_MASK DesiredAccess, 826 | IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, 827 | IN TIMER_TYPE TimerType 828 | ); 829 | 830 | 831 | NTSTATUS 832 | NTAPI 833 | DirectNtOpenTimer( 834 | OUT PHANDLE TimerHandle, 835 | IN ACCESS_MASK DesiredAccess, 836 | IN POBJECT_ATTRIBUTES ObjectAttributes 837 | ); 838 | 839 | 840 | NTSTATUS 841 | NTAPI 842 | DirectNtCancelTimer( 843 | IN HANDLE TimerHandle, 844 | OUT OPTIONAL PBOOLEAN CurrentState 845 | ); 846 | 847 | 848 | NTSTATUS 849 | NTAPI 850 | DirectNtQueryTimer( 851 | IN HANDLE TimerHandle, 852 | IN TIMER_INFORMATION_CLASS TimerInformationClass, 853 | OUT PVOID TimerInformation, 854 | IN ULONG TimerInformationLength, 855 | OUT OPTIONAL PULONG ReturnLength 856 | ); 857 | 858 | 859 | NTSTATUS 860 | NTAPI 861 | DirectNtSetTimer( 862 | IN HANDLE TimerHandle, 863 | IN PLARGE_INTEGER DueTime, 864 | IN OPTIONAL PTIMER_APC_ROUTINE TimerApcRoutine, 865 | IN OPTIONAL PVOID TimerContext, 866 | IN BOOLEAN ResumeTimer, 867 | IN OPTIONAL LONG Period, 868 | OUT OPTIONAL PBOOLEAN PreviousState 869 | ); 870 | 871 | 872 | NTSTATUS 873 | NTAPI 874 | DirectNtQuerySystemTime( 875 | OUT PLARGE_INTEGER SystemTime 876 | ); 877 | 878 | 879 | NTSTATUS 880 | NTAPI 881 | DirectNtSetSystemTime( 882 | IN OPTIONAL PLARGE_INTEGER SystemTime, 883 | OUT OPTIONAL PLARGE_INTEGER PreviousTime 884 | ); 885 | 886 | 887 | NTSTATUS 888 | NTAPI 889 | DirectNtQueryTimerResolution( 890 | OUT PULONG MaximumTime, 891 | OUT PULONG MinimumTime, 892 | OUT PULONG CurrentTime 893 | ); 894 | 895 | 896 | NTSTATUS 897 | NTAPI 898 | DirectNtSetTimerResolution( 899 | IN ULONG DesiredTime, 900 | IN BOOLEAN SetResolution, 901 | OUT PULONG ActualTime 902 | ); 903 | 904 | 905 | NTSTATUS 906 | NTAPI 907 | DirectNtAllocateLocallyUniqueId( 908 | OUT PLUID Luid 909 | ); 910 | 911 | 912 | NTSTATUS 913 | NTAPI 914 | DirectNtSetUuidSeed( 915 | IN PCHAR Seed 916 | ); 917 | 918 | 919 | NTSTATUS 920 | NTAPI 921 | DirectNtAllocateUuids( 922 | OUT PULARGE_INTEGER Time, 923 | OUT PULONG Range, 924 | OUT PULONG Sequence, 925 | OUT PCHAR Seed 926 | ); 927 | 928 | 929 | NTSTATUS 930 | NTAPI 931 | DirectNtCreateProfile( 932 | OUT PHANDLE ProfileHandle, 933 | IN HANDLE Process OPTIONAL, 934 | IN PVOID ProfileBase, 935 | IN SIZE_T ProfileSize, 936 | IN ULONG BucketSize, 937 | IN PULONG Buffer, 938 | IN ULONG BufferSize, 939 | IN KPROFILE_SOURCE ProfileSource, 940 | IN KAFFINITY Affinity 941 | ); 942 | 943 | 944 | NTSTATUS 945 | NTAPI 946 | DirectNtStartProfile( 947 | IN HANDLE ProfileHandle 948 | ); 949 | 950 | 951 | NTSTATUS 952 | NTAPI 953 | DirectNtStopProfile( 954 | IN HANDLE ProfileHandle 955 | ); 956 | 957 | 958 | NTSTATUS 959 | NTAPI 960 | DirectNtSetIntervalProfile( 961 | IN ULONG Interval, 962 | IN KPROFILE_SOURCE Source 963 | ); 964 | 965 | 966 | NTSTATUS 967 | NTAPI 968 | DirectNtQueryIntervalProfile( 969 | IN KPROFILE_SOURCE ProfileSource, 970 | OUT PULONG Interval 971 | ); 972 | 973 | 974 | NTSTATUS 975 | NTAPI 976 | DirectNtQueryPerformanceCounter( 977 | OUT PLARGE_INTEGER PerformanceCounter, 978 | OUT OPTIONAL PLARGE_INTEGER PerformanceFrequency 979 | ); 980 | 981 | 982 | NTSTATUS 983 | NTAPI 984 | DirectNtCreateKeyedEvent( 985 | OUT PHANDLE KeyedEventHandle, 986 | IN ACCESS_MASK DesiredAccess, 987 | IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, 988 | IN ULONG Flags 989 | ); 990 | 991 | 992 | NTSTATUS 993 | NTAPI 994 | DirectNtOpenKeyedEvent( 995 | OUT PHANDLE KeyedEventHandle, 996 | IN ACCESS_MASK DesiredAccess, 997 | IN POBJECT_ATTRIBUTES ObjectAttributes 998 | ); 999 | 1000 | 1001 | NTSTATUS 1002 | NTAPI 1003 | DirectNtReleaseKeyedEvent( 1004 | IN HANDLE KeyedEventHandle, 1005 | IN PVOID KeyValue, 1006 | IN BOOLEAN Alertable, 1007 | IN OPTIONAL PLARGE_INTEGER Timeout 1008 | ); 1009 | 1010 | 1011 | NTSTATUS 1012 | NTAPI 1013 | DirectNtWaitForKeyedEvent( 1014 | IN HANDLE KeyedEventHandle, 1015 | IN PVOID KeyValue, 1016 | IN BOOLEAN Alertable, 1017 | IN OPTIONAL PLARGE_INTEGER Timeout 1018 | ); 1019 | 1020 | 1021 | NTSTATUS 1022 | NTAPI 1023 | DirectNtQuerySystemInformation( 1024 | IN SYSTEM_INFORMATION_CLASS SystemInformationClass, 1025 | OUT OPTIONAL PVOID SystemInformation, 1026 | IN ULONG SystemInformationLength, 1027 | OUT OPTIONAL PULONG ReturnLength 1028 | ); 1029 | 1030 | 1031 | NTSTATUS 1032 | NTAPI 1033 | DirectNtSetSystemInformation( 1034 | IN SYSTEM_INFORMATION_CLASS SystemInformationClass, 1035 | IN PVOID SystemInformation, 1036 | IN ULONG SystemInformationLength 1037 | ); 1038 | 1039 | 1040 | NTSTATUS 1041 | NTAPI 1042 | DirectNtSystemDebugControl( 1043 | IN SYSDBG_COMMAND Command, 1044 | IN PVOID InputBuffer, 1045 | IN ULONG InputBufferLength, 1046 | OUT PVOID OutputBuffer, 1047 | IN ULONG OutputBufferLength, 1048 | OUT OPTIONAL PULONG ReturnLength 1049 | ); 1050 | 1051 | 1052 | NTSTATUS 1053 | NTAPI 1054 | DirectNtRaiseHardError( 1055 | IN NTSTATUS ErrorStatus, 1056 | IN ULONG NumberOfParameters, 1057 | IN ULONG UnicodeStringParameterMask, 1058 | IN PULONG Parameters, 1059 | IN ULONG ValidResponseOptions, 1060 | OUT PULONG Response 1061 | ); 1062 | 1063 | 1064 | NTSTATUS 1065 | NTAPI 1066 | DirectNtQueryDefaultLocale( 1067 | IN BOOLEAN UserProfile, 1068 | OUT PLCID DefaultLocaleId 1069 | ); 1070 | 1071 | 1072 | NTSTATUS 1073 | NTAPI 1074 | DirectNtSetDefaultLocale( 1075 | IN BOOLEAN UserProfile, 1076 | IN LCID DefaultLocaleId 1077 | ); 1078 | 1079 | 1080 | NTSTATUS 1081 | NTAPI 1082 | DirectNtQueryInstallUILanguage( 1083 | OUT LANGID *InstallUILanguageId 1084 | ); 1085 | 1086 | 1087 | NTSTATUS 1088 | NTAPI 1089 | DirectNtQueryDefaultUILanguage( 1090 | OUT LANGID *DefaultUILanguageId 1091 | ); 1092 | 1093 | 1094 | NTSTATUS 1095 | NTAPI 1096 | DirectNtSetDefaultUILanguage( 1097 | IN LANGID DefaultUILanguageId 1098 | ); 1099 | 1100 | 1101 | NTSTATUS 1102 | NTAPI 1103 | DirectNtSetDefaultHardErrorPort( 1104 | IN HANDLE DefaultHardErrorPort 1105 | ); 1106 | 1107 | 1108 | NTSTATUS 1109 | NTAPI 1110 | DirectNtShutdownSystem( 1111 | IN SHUTDOWN_ACTION Action 1112 | ); 1113 | 1114 | 1115 | NTSTATUS 1116 | NTAPI 1117 | DirectNtDisplayString( 1118 | IN PUNICODE_STRING String 1119 | ); 1120 | 1121 | 1122 | NTSTATUS 1123 | NTAPI 1124 | DirectNtAddAtom( 1125 | IN PWSTR AtomName OPTIONAL, 1126 | IN OUT PRTL_ATOM Atom OPTIONAL 1127 | ); 1128 | 1129 | 1130 | NTSTATUS 1131 | NTAPI 1132 | DirectNtFindAtom( 1133 | IN PWSTR AtomName, 1134 | OUT PRTL_ATOM Atom OPTIONAL 1135 | ); 1136 | 1137 | 1138 | NTSTATUS 1139 | NTAPI 1140 | DirectNtDeleteAtom( 1141 | IN RTL_ATOM Atom 1142 | ); 1143 | 1144 | 1145 | NTSTATUS 1146 | NTAPI 1147 | DirectNtQueryInformationAtom( 1148 | IN RTL_ATOM Atom, 1149 | IN ATOM_INFORMATION_CLASS AtomInformationClass, 1150 | OUT PVOID AtomInformation, 1151 | IN ULONG AtomInformationLength, 1152 | OUT OPTIONAL PULONG ReturnLength 1153 | ); 1154 | 1155 | 1156 | NTSTATUS 1157 | NTAPI 1158 | DirectNtCancelIoFile( 1159 | IN HANDLE FileHandle, 1160 | OUT PIO_STATUS_BLOCK IoStatusBlock 1161 | ); 1162 | 1163 | 1164 | NTSTATUS 1165 | NTAPI 1166 | DirectNtCreateNamedPipeFile( 1167 | OUT PHANDLE FileHandle, 1168 | IN ULONG DesiredAccess, 1169 | IN POBJECT_ATTRIBUTES ObjectAttributes, 1170 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1171 | IN ULONG ShareAccess, 1172 | IN ULONG CreateDisposition, 1173 | IN ULONG CreateOptions, 1174 | IN ULONG NamedPipeType, 1175 | IN ULONG ReadMode, 1176 | IN ULONG CompletionMode, 1177 | IN ULONG MaximumInstances, 1178 | IN ULONG InboundQuota, 1179 | IN ULONG OutboundQuota, 1180 | IN OPTIONAL PLARGE_INTEGER DefaultTimeout 1181 | ); 1182 | 1183 | 1184 | NTSTATUS 1185 | NTAPI 1186 | DirectNtCreateMailslotFile( 1187 | OUT PHANDLE FileHandle, 1188 | IN ULONG DesiredAccess, 1189 | IN POBJECT_ATTRIBUTES ObjectAttributes, 1190 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1191 | IN ULONG CreateOptions, 1192 | IN ULONG MailslotQuota, 1193 | IN ULONG MaximumMessageSize, 1194 | IN PLARGE_INTEGER ReadTimeout 1195 | ); 1196 | 1197 | 1198 | NTSTATUS 1199 | NTAPI 1200 | DirectNtDeleteFile( 1201 | IN POBJECT_ATTRIBUTES ObjectAttributes 1202 | ); 1203 | 1204 | 1205 | NTSTATUS 1206 | NTAPI 1207 | DirectNtFlushBuffersFile( 1208 | IN HANDLE FileHandle, 1209 | OUT PIO_STATUS_BLOCK IoStatusBlock 1210 | ); 1211 | 1212 | 1213 | NTSTATUS 1214 | NTAPI 1215 | DirectNtNotifyChangeDirectoryFile( 1216 | IN HANDLE FileHandle, 1217 | IN OPTIONAL HANDLE Event, 1218 | IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, 1219 | IN OPTIONAL PVOID ApcContext, 1220 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1221 | OUT PVOID Buffer, 1222 | IN ULONG Length, 1223 | IN ULONG CompletionFilter, 1224 | IN BOOLEAN WatchTree 1225 | ); 1226 | 1227 | 1228 | NTSTATUS 1229 | NTAPI 1230 | DirectNtQueryAttributesFile( 1231 | IN POBJECT_ATTRIBUTES ObjectAttributes, 1232 | OUT PFILE_BASIC_INFORMATION FileInformation 1233 | ); 1234 | 1235 | 1236 | NTSTATUS 1237 | NTAPI 1238 | DirectNtQueryFullAttributesFile( 1239 | IN POBJECT_ATTRIBUTES ObjectAttributes, 1240 | OUT PFILE_NETWORK_OPEN_INFORMATION FileInformation 1241 | ); 1242 | 1243 | 1244 | NTSTATUS 1245 | NTAPI 1246 | DirectNtQueryEaFile( 1247 | IN HANDLE FileHandle, 1248 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1249 | OUT PVOID Buffer, 1250 | IN ULONG Length, 1251 | IN BOOLEAN ReturnSingleEntry, 1252 | IN OPTIONAL PVOID EaList, 1253 | IN ULONG EaListLength, 1254 | IN OPTIONAL PULONG EaIndex OPTIONAL, 1255 | IN BOOLEAN RestartScan 1256 | ); 1257 | 1258 | 1259 | NTSTATUS 1260 | NTAPI 1261 | DirectNtCreateFile( 1262 | OUT PHANDLE FileHandle, 1263 | IN ACCESS_MASK DesiredAccess, 1264 | IN POBJECT_ATTRIBUTES ObjectAttributes, 1265 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1266 | IN OPTIONAL PLARGE_INTEGER AllocationSize, 1267 | IN ULONG FileAttributes, 1268 | IN ULONG ShareAccess, 1269 | IN ULONG CreateDisposition, 1270 | IN ULONG CreateOptions, 1271 | IN OPTIONAL PVOID EaBuffer, 1272 | IN ULONG EaLength 1273 | ); 1274 | 1275 | 1276 | NTSTATUS 1277 | NTAPI 1278 | DirectNtDeviceIoControlFile( 1279 | IN HANDLE FileHandle, 1280 | IN OPTIONAL HANDLE Event, 1281 | IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, 1282 | IN OPTIONAL PVOID ApcContext, 1283 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1284 | IN ULONG IoControlCode, 1285 | IN OPTIONAL PVOID InputBuffer, 1286 | IN ULONG InputBufferLength, 1287 | OUT OPTIONAL PVOID OutputBuffer, 1288 | IN ULONG OutputBufferLength 1289 | ); 1290 | 1291 | 1292 | NTSTATUS 1293 | NTAPI 1294 | DirectNtFsControlFile( 1295 | IN HANDLE FileHandle, 1296 | IN OPTIONAL HANDLE Event, 1297 | IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, 1298 | IN OPTIONAL PVOID ApcContext, 1299 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1300 | IN ULONG FsControlCode, 1301 | IN PVOID InputBuffer OPTIONAL, 1302 | IN ULONG InputBufferLength, 1303 | OUT PVOID OutputBuffer OPTIONAL, 1304 | IN ULONG OutputBufferLength 1305 | ); 1306 | 1307 | 1308 | NTSTATUS 1309 | NTAPI 1310 | DirectNtLockFile( 1311 | IN HANDLE FileHandle, 1312 | IN OPTIONAL HANDLE Event, 1313 | IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, 1314 | IN OPTIONAL PVOID ApcContext, 1315 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1316 | IN PLARGE_INTEGER ByteOffset, 1317 | IN PLARGE_INTEGER Length, 1318 | IN ULONG Key, 1319 | IN BOOLEAN FailImmediately, 1320 | IN BOOLEAN ExclusiveLock 1321 | ); 1322 | 1323 | 1324 | NTSTATUS 1325 | NTAPI 1326 | DirectNtOpenFile( 1327 | OUT PHANDLE FileHandle, 1328 | IN ACCESS_MASK DesiredAccess, 1329 | IN POBJECT_ATTRIBUTES ObjectAttributes, 1330 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1331 | IN ULONG ShareAccess, 1332 | IN ULONG OpenOptions 1333 | ); 1334 | 1335 | 1336 | NTSTATUS 1337 | NTAPI 1338 | DirectNtQueryDirectoryFile( 1339 | IN HANDLE FileHandle, 1340 | IN OPTIONAL HANDLE Event, 1341 | IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, 1342 | IN OPTIONAL PVOID ApcContext, 1343 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1344 | OUT PVOID FileInformation, 1345 | IN ULONG Length, 1346 | IN FILE_INFORMATION_CLASS FileInformationClass, 1347 | IN BOOLEAN ReturnSingleEntry, 1348 | IN OPTIONAL PUNICODE_STRING FileName, 1349 | IN BOOLEAN RestartScan 1350 | ); 1351 | 1352 | 1353 | NTSTATUS 1354 | NTAPI 1355 | DirectNtQueryInformationFile( 1356 | IN HANDLE FileHandle, 1357 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1358 | OUT PVOID FileInformation, 1359 | IN ULONG Length, 1360 | IN FILE_INFORMATION_CLASS FileInformationClass 1361 | ); 1362 | 1363 | 1364 | NTSTATUS 1365 | NTAPI 1366 | DirectNtQueryQuotaInformationFile( 1367 | IN HANDLE FileHandle, 1368 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1369 | OUT PVOID Buffer, 1370 | IN ULONG Length, 1371 | IN BOOLEAN ReturnSingleEntry, 1372 | IN PVOID SidList OPTIONAL, 1373 | IN ULONG SidListLength, 1374 | IN OPTIONAL PSID StartSid, 1375 | IN BOOLEAN RestartScan 1376 | ); 1377 | 1378 | 1379 | NTSTATUS 1380 | NTAPI 1381 | DirectNtQueryVolumeInformationFile( 1382 | IN HANDLE FileHandle, 1383 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1384 | OUT PVOID FsInformation, 1385 | IN ULONG Length, 1386 | IN FS_INFORMATION_CLASS FsInformationClass 1387 | ); 1388 | 1389 | 1390 | NTSTATUS 1391 | NTAPI 1392 | DirectNtReadFile( 1393 | IN HANDLE FileHandle, 1394 | IN OPTIONAL HANDLE Event, 1395 | IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, 1396 | IN OPTIONAL PVOID ApcContext, 1397 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1398 | OUT PVOID Buffer, 1399 | IN ULONG Length, 1400 | IN OPTIONAL PLARGE_INTEGER ByteOffset, 1401 | IN OPTIONAL PULONG Key 1402 | ); 1403 | 1404 | 1405 | NTSTATUS 1406 | NTAPI 1407 | DirectNtSetInformationFile( 1408 | IN HANDLE FileHandle, 1409 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1410 | IN PVOID FileInformation, 1411 | IN ULONG Length, 1412 | IN FILE_INFORMATION_CLASS FileInformationClass 1413 | ); 1414 | 1415 | 1416 | NTSTATUS 1417 | NTAPI 1418 | DirectNtSetQuotaInformationFile( 1419 | IN HANDLE FileHandle, 1420 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1421 | IN PVOID Buffer, 1422 | IN ULONG Length 1423 | ); 1424 | 1425 | 1426 | NTSTATUS 1427 | NTAPI 1428 | DirectNtSetVolumeInformationFile( 1429 | IN HANDLE FileHandle, 1430 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1431 | IN PVOID FsInformation, 1432 | IN ULONG Length, 1433 | IN FS_INFORMATION_CLASS FsInformationClass 1434 | ); 1435 | 1436 | 1437 | NTSTATUS 1438 | NTAPI 1439 | DirectNtWriteFile( 1440 | IN HANDLE FileHandle, 1441 | IN OPTIONAL HANDLE Event, 1442 | IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, 1443 | IN OPTIONAL PVOID ApcContext, 1444 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1445 | IN PVOID Buffer, 1446 | IN ULONG Length, 1447 | IN OPTIONAL PLARGE_INTEGER ByteOffset, 1448 | IN OPTIONAL PULONG Key 1449 | ); 1450 | 1451 | 1452 | NTSTATUS 1453 | NTAPI 1454 | DirectNtUnlockFile( 1455 | IN HANDLE FileHandle, 1456 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1457 | IN PLARGE_INTEGER ByteOffset, 1458 | IN PLARGE_INTEGER Length, 1459 | IN ULONG Key 1460 | ); 1461 | 1462 | 1463 | NTSTATUS 1464 | NTAPI 1465 | DirectNtReadFileScatter( 1466 | IN HANDLE FileHandle, 1467 | IN OPTIONAL HANDLE Event, 1468 | IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, 1469 | IN OPTIONAL PVOID ApcContext, 1470 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1471 | IN PFILE_SEGMENT_ELEMENT SegmentArray, 1472 | IN ULONG Length, 1473 | IN OPTIONAL PLARGE_INTEGER ByteOffset, 1474 | IN OPTIONAL PULONG Key 1475 | ); 1476 | 1477 | 1478 | NTSTATUS 1479 | NTAPI 1480 | DirectNtSetEaFile( 1481 | IN HANDLE FileHandle, 1482 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1483 | IN PVOID Buffer, 1484 | IN ULONG Length 1485 | ); 1486 | 1487 | 1488 | NTSTATUS 1489 | NTAPI 1490 | DirectNtWriteFileGather( 1491 | IN HANDLE FileHandle, 1492 | IN OPTIONAL HANDLE Event, 1493 | IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, 1494 | IN OPTIONAL PVOID ApcContext, 1495 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1496 | IN PFILE_SEGMENT_ELEMENT SegmentArray, 1497 | IN ULONG Length, 1498 | IN OPTIONAL PLARGE_INTEGER ByteOffset, 1499 | IN OPTIONAL PULONG Key 1500 | ); 1501 | 1502 | 1503 | NTSTATUS 1504 | NTAPI 1505 | DirectNtLoadDriver( 1506 | IN PUNICODE_STRING DriverServiceName 1507 | ); 1508 | 1509 | 1510 | NTSTATUS 1511 | NTAPI 1512 | DirectNtUnloadDriver( 1513 | IN PUNICODE_STRING DriverServiceName 1514 | ); 1515 | 1516 | 1517 | NTSTATUS 1518 | NTAPI 1519 | DirectNtCreateIoCompletion( 1520 | OUT PHANDLE IoCompletionHandle, 1521 | IN ACCESS_MASK DesiredAccess, 1522 | IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, 1523 | IN ULONG Count OPTIONAL 1524 | ); 1525 | 1526 | 1527 | NTSTATUS 1528 | NTAPI 1529 | DirectNtOpenIoCompletion( 1530 | OUT PHANDLE IoCompletionHandle, 1531 | IN ACCESS_MASK DesiredAccess, 1532 | IN POBJECT_ATTRIBUTES ObjectAttributes 1533 | ); 1534 | 1535 | 1536 | NTSTATUS 1537 | NTAPI 1538 | DirectNtQueryIoCompletion( 1539 | IN HANDLE IoCompletionHandle, 1540 | IN IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass, 1541 | OUT PVOID IoCompletionInformation, 1542 | IN ULONG IoCompletionInformationLength, 1543 | OUT OPTIONAL PULONG ReturnLength 1544 | ); 1545 | 1546 | 1547 | NTSTATUS 1548 | NTAPI 1549 | DirectNtSetIoCompletion( 1550 | IN HANDLE IoCompletionHandle, 1551 | IN PVOID KeyContext, 1552 | IN OPTIONAL PVOID ApcContext, 1553 | IN NTSTATUS IoStatus, 1554 | IN ULONG_PTR IoStatusInformation 1555 | ); 1556 | 1557 | 1558 | NTSTATUS 1559 | NTAPI 1560 | DirectNtRemoveIoCompletion( 1561 | IN HANDLE IoCompletionHandle, 1562 | OUT PVOID *KeyContext, 1563 | OUT PVOID *ApcContext, 1564 | OUT PIO_STATUS_BLOCK IoStatusBlock, 1565 | IN OPTIONAL PLARGE_INTEGER Timeout 1566 | ); 1567 | 1568 | 1569 | NTSTATUS 1570 | NTAPI 1571 | DirectNtCallbackReturn( 1572 | IN PVOID OutputBuffer OPTIONAL, 1573 | IN ULONG OutputLength, 1574 | IN NTSTATUS Status 1575 | ); 1576 | 1577 | 1578 | NTSTATUS 1579 | NTAPI 1580 | DirectNtQueryDebugFilterState( 1581 | IN ULONG ComponentId, 1582 | IN ULONG Level 1583 | ); 1584 | 1585 | 1586 | NTSTATUS 1587 | NTAPI 1588 | DirectNtSetDebugFilterState( 1589 | IN ULONG ComponentId, 1590 | IN ULONG Level, 1591 | IN BOOLEAN State 1592 | ); 1593 | 1594 | 1595 | NTSTATUS 1596 | NTAPI 1597 | DirectNtYieldExecution( 1598 | VOID 1599 | ); 1600 | 1601 | 1602 | NTSTATUS 1603 | NTAPI 1604 | DirectNtCreatePort( 1605 | OUT PHANDLE PortHandle, 1606 | IN POBJECT_ATTRIBUTES ObjectAttributes, 1607 | IN ULONG MaxConnectionInfoLength, 1608 | IN ULONG MaxMessageLength, 1609 | IN OPTIONAL ULONG MaxPoolUsage 1610 | ); 1611 | 1612 | 1613 | NTSTATUS 1614 | NTAPI 1615 | DirectNtCreateWaitablePort( 1616 | OUT PHANDLE PortHandle, 1617 | IN POBJECT_ATTRIBUTES ObjectAttributes, 1618 | IN ULONG MaxConnectionInfoLength, 1619 | IN ULONG MaxMessageLength, 1620 | IN OPTIONAL ULONG MaxPoolUsage 1621 | ); 1622 | 1623 | 1624 | NTSTATUS 1625 | NTAPI 1626 | DirectNtConnectPort( 1627 | OUT PHANDLE PortHandle, 1628 | IN PUNICODE_STRING PortName, 1629 | IN PSECURITY_QUALITY_OF_SERVICE SecurityQos, 1630 | IN OUT PPORT_VIEW ClientView OPTIONAL, 1631 | OUT PREMOTE_PORT_VIEW ServerView OPTIONAL, 1632 | OUT PULONG MaxMessageLength OPTIONAL, 1633 | IN OUT PVOID ConnectionInformation OPTIONAL, 1634 | IN OUT PULONG ConnectionInformationLength OPTIONAL 1635 | ); 1636 | 1637 | 1638 | NTSTATUS 1639 | NTAPI 1640 | DirectNtListenPort( 1641 | IN HANDLE PortHandle, 1642 | OUT PPORT_MESSAGE ConnectionRequest 1643 | ); 1644 | 1645 | 1646 | NTSTATUS 1647 | NTAPI 1648 | DirectNtAcceptConnectPort( 1649 | OUT PHANDLE PortHandle, 1650 | IN OPTIONAL PVOID PortContext, 1651 | IN PPORT_MESSAGE ConnectionRequest, 1652 | IN BOOLEAN AcceptConnection, 1653 | IN OUT PPORT_VIEW ServerView OPTIONAL, 1654 | OUT PREMOTE_PORT_VIEW ClientView OPTIONAL 1655 | ); 1656 | 1657 | 1658 | NTSTATUS 1659 | NTAPI 1660 | DirectNtCompleteConnectPort( 1661 | IN HANDLE PortHandle 1662 | ); 1663 | 1664 | 1665 | NTSTATUS 1666 | NTAPI 1667 | DirectNtRequestPort( 1668 | IN HANDLE PortHandle, 1669 | IN PPORT_MESSAGE RequestMessage 1670 | ); 1671 | 1672 | 1673 | NTSTATUS 1674 | NTAPI 1675 | DirectNtRequestWaitReplyPort( 1676 | IN HANDLE PortHandle, 1677 | IN PPORT_MESSAGE RequestMessage, 1678 | OUT PPORT_MESSAGE ReplyMessage 1679 | ); 1680 | 1681 | 1682 | NTSTATUS 1683 | NTAPI 1684 | DirectNtReplyPort( 1685 | IN HANDLE PortHandle, 1686 | IN PPORT_MESSAGE ReplyMessage 1687 | ); 1688 | 1689 | 1690 | NTSTATUS 1691 | NTAPI 1692 | DirectNtReplyWaitReplyPort( 1693 | IN HANDLE PortHandle, 1694 | IN OUT PPORT_MESSAGE ReplyMessage 1695 | ); 1696 | 1697 | 1698 | NTSTATUS 1699 | NTAPI 1700 | DirectNtReplyWaitReceivePort( 1701 | IN HANDLE PortHandle, 1702 | OUT OPTIONAL PVOID *PortContext , 1703 | IN OPTIONAL PPORT_MESSAGE ReplyMessage, 1704 | OUT PPORT_MESSAGE ReceiveMessage 1705 | ); 1706 | 1707 | 1708 | NTSTATUS 1709 | NTAPI 1710 | DirectNtReplyWaitReceivePortEx( 1711 | IN HANDLE PortHandle, 1712 | OUT OPTIONAL PVOID *PortContext, 1713 | IN OPTIONAL PPORT_MESSAGE ReplyMessage, 1714 | OUT PPORT_MESSAGE ReceiveMessage, 1715 | IN OPTIONAL PLARGE_INTEGER Timeout 1716 | ); 1717 | 1718 | 1719 | NTSTATUS 1720 | NTAPI 1721 | DirectNtImpersonateClientOfPort( 1722 | IN HANDLE PortHandle, 1723 | IN PPORT_MESSAGE Message 1724 | ); 1725 | 1726 | 1727 | NTSTATUS 1728 | NTAPI 1729 | DirectNtReadRequestData( 1730 | IN HANDLE PortHandle, 1731 | IN PPORT_MESSAGE Message, 1732 | IN ULONG DataEntryIndex, 1733 | OUT PVOID Buffer, 1734 | IN ULONG BufferSize, 1735 | OUT PULONG NumberOfBytesRead OPTIONAL 1736 | ); 1737 | 1738 | 1739 | NTSTATUS 1740 | NTAPI 1741 | DirectNtWriteRequestData( 1742 | IN HANDLE PortHandle, 1743 | IN PPORT_MESSAGE Message, 1744 | IN ULONG DataEntryIndex, 1745 | IN PVOID Buffer, 1746 | IN ULONG BufferSize, 1747 | OUT PULONG NumberOfBytesWritten OPTIONAL 1748 | ); 1749 | 1750 | 1751 | NTSTATUS 1752 | NTAPI 1753 | DirectNtQueryInformationPort( 1754 | IN HANDLE PortHandle, 1755 | IN PORT_INFORMATION_CLASS PortInformationClass, 1756 | OUT PVOID PortInformation, 1757 | IN ULONG Length, 1758 | OUT OPTIONAL PULONG ReturnLength 1759 | ); 1760 | 1761 | 1762 | NTSTATUS 1763 | NTAPI 1764 | DirectNtCreateSection( 1765 | OUT PHANDLE SectionHandle, 1766 | IN ACCESS_MASK DesiredAccess, 1767 | IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, 1768 | IN OPTIONAL PLARGE_INTEGER MaximumSize, 1769 | IN ULONG SectionPageProtection, 1770 | IN ULONG AllocationAttributes, 1771 | IN OPTIONAL HANDLE FileHandle 1772 | ); 1773 | 1774 | 1775 | NTSTATUS 1776 | NTAPI 1777 | DirectNtOpenSection( 1778 | OUT PHANDLE SectionHandle, 1779 | IN ACCESS_MASK DesiredAccess, 1780 | IN POBJECT_ATTRIBUTES ObjectAttributes 1781 | ); 1782 | 1783 | 1784 | NTSTATUS 1785 | NTAPI 1786 | DirectNtMapViewOfSection( 1787 | IN HANDLE SectionHandle, 1788 | IN HANDLE ProcessHandle, 1789 | IN OUT PVOID *BaseAddress, 1790 | IN ULONG ZeroBits, 1791 | IN ULONG CommitSize, 1792 | IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, 1793 | IN OUT PULONG ViewSize, 1794 | IN SECTION_INHERIT InheritDisposition, 1795 | IN ULONG AllocationType, 1796 | IN ULONG Win32Protect 1797 | ); 1798 | 1799 | 1800 | NTSTATUS 1801 | NTAPI 1802 | DirectNtUnmapViewOfSection( 1803 | IN HANDLE ProcessHandle, 1804 | IN PVOID BaseAddress 1805 | ); 1806 | 1807 | 1808 | NTSTATUS 1809 | NTAPI 1810 | DirectNtExtendSection( 1811 | IN HANDLE SectionHandle, 1812 | IN OUT PLARGE_INTEGER NewSectionSize 1813 | ); 1814 | 1815 | 1816 | NTSTATUS 1817 | NTAPI 1818 | DirectNtAreMappedFilesTheSame( 1819 | IN PVOID File1MappedAsAnImage, 1820 | IN PVOID File2MappedAsFile 1821 | ); 1822 | 1823 | 1824 | NTSTATUS 1825 | NTAPI 1826 | DirectNtAllocateVirtualMemory( 1827 | IN HANDLE ProcessHandle, 1828 | IN OUT PVOID *BaseAddress, 1829 | IN ULONG_PTR ZeroBits, 1830 | IN OUT PSIZE_T RegionSize, 1831 | IN ULONG AllocationType, 1832 | IN ULONG Protect 1833 | ); 1834 | 1835 | 1836 | NTSTATUS 1837 | NTAPI 1838 | DirectNtFreeVirtualMemory( 1839 | IN HANDLE ProcessHandle, 1840 | IN OUT PVOID *BaseAddress, 1841 | IN OUT PSIZE_T RegionSize, 1842 | IN ULONG FreeType 1843 | ); 1844 | 1845 | 1846 | NTSTATUS 1847 | NTAPI 1848 | DirectNtReadVirtualMemory( 1849 | IN HANDLE ProcessHandle, 1850 | IN OPTIONAL PVOID BaseAddress, 1851 | OUT PVOID Buffer, 1852 | IN SIZE_T BufferSize, 1853 | OUT OPTIONAL PSIZE_T NumberOfBytesRead 1854 | ); 1855 | 1856 | 1857 | NTSTATUS 1858 | NTAPI 1859 | DirectNtWriteVirtualMemory( 1860 | IN HANDLE ProcessHandle, 1861 | IN OPTIONAL PVOID BaseAddress, 1862 | IN PVOID Buffer, 1863 | IN SIZE_T BufferSize, 1864 | OUT OPTIONAL PSIZE_T NumberOfBytesWritten 1865 | ); 1866 | 1867 | 1868 | NTSTATUS 1869 | NTAPI 1870 | DirectNtFlushVirtualMemory( 1871 | IN HANDLE ProcessHandle, 1872 | IN OUT PVOID *BaseAddress, 1873 | IN OUT PSIZE_T RegionSize, 1874 | OUT PIO_STATUS_BLOCK IoStatus 1875 | ); 1876 | 1877 | 1878 | NTSTATUS 1879 | NTAPI 1880 | DirectNtLockVirtualMemory( 1881 | IN HANDLE ProcessHandle, 1882 | IN OUT PVOID *BaseAddress, 1883 | IN OUT PSIZE_T RegionSize, 1884 | IN ULONG MapType 1885 | ); 1886 | 1887 | 1888 | NTSTATUS 1889 | NTAPI 1890 | DirectNtUnlockVirtualMemory( 1891 | IN HANDLE ProcessHandle, 1892 | IN OUT PVOID *BaseAddress, 1893 | IN OUT PSIZE_T RegionSize, 1894 | IN ULONG MapType 1895 | ); 1896 | 1897 | 1898 | NTSTATUS 1899 | NTAPI 1900 | DirectNtProtectVirtualMemory( 1901 | IN HANDLE ProcessHandle, 1902 | IN OUT PVOID *BaseAddress, 1903 | IN OUT PSIZE_T RegionSize, 1904 | IN ULONG NewProtect, 1905 | OUT PULONG OldProtect 1906 | ); 1907 | 1908 | 1909 | NTSTATUS 1910 | NTAPI 1911 | DirectNtQueryVirtualMemory( 1912 | IN HANDLE ProcessHandle, 1913 | IN PVOID BaseAddress, 1914 | IN MEMORY_INFORMATION_CLASS MemoryInformationClass, 1915 | OUT PVOID MemoryInformation, 1916 | IN SIZE_T MemoryInformationLength, 1917 | OUT OPTIONAL PSIZE_T ReturnLength 1918 | ); 1919 | 1920 | 1921 | NTSTATUS 1922 | NTAPI 1923 | DirectNtQuerySection( 1924 | IN HANDLE SectionHandle, 1925 | IN SECTION_INFORMATION_CLASS SectionInformationClass, 1926 | OUT PVOID SectionInformation, 1927 | IN SIZE_T SectionInformationLength, 1928 | OUT OPTIONAL PSIZE_T ReturnLength 1929 | ); 1930 | 1931 | 1932 | NTSTATUS 1933 | NTAPI 1934 | DirectNtMapUserPhysicalPages( 1935 | IN PVOID VirtualAddress, 1936 | IN ULONG_PTR NumberOfPages, 1937 | IN OPTIONAL PULONG_PTR UserPfnArray 1938 | ); 1939 | 1940 | 1941 | NTSTATUS 1942 | NTAPI 1943 | DirectNtMapUserPhysicalPagesScatter( 1944 | IN PVOID *VirtualAddresses, 1945 | IN ULONG_PTR NumberOfPages, 1946 | IN OPTIONAL PULONG_PTR UserPfnArray 1947 | ); 1948 | 1949 | 1950 | NTSTATUS 1951 | NTAPI 1952 | DirectNtAllocateUserPhysicalPages( 1953 | IN HANDLE ProcessHandle, 1954 | IN OUT PULONG_PTR NumberOfPages, 1955 | OUT PULONG_PTR UserPfnArray 1956 | ); 1957 | 1958 | 1959 | NTSTATUS 1960 | NTAPI 1961 | DirectNtFreeUserPhysicalPages( 1962 | IN HANDLE ProcessHandle, 1963 | IN OUT PULONG_PTR NumberOfPages, 1964 | OUT PULONG_PTR UserPfnArray 1965 | ); 1966 | 1967 | 1968 | NTSTATUS 1969 | NTAPI 1970 | DirectNtGetWriteWatch( 1971 | IN HANDLE ProcessHandle, 1972 | IN ULONG Flags, 1973 | IN PVOID BaseAddress, 1974 | IN SIZE_T RegionSize, 1975 | OUT PVOID *UserAddressArray, 1976 | IN OUT PULONG_PTR EntriesInUserAddressArray, 1977 | OUT PULONG Granularity 1978 | ); 1979 | 1980 | 1981 | NTSTATUS 1982 | NTAPI 1983 | DirectNtResetWriteWatch( 1984 | IN HANDLE ProcessHandle, 1985 | IN PVOID BaseAddress, 1986 | IN SIZE_T RegionSize 1987 | ); 1988 | 1989 | 1990 | NTSTATUS 1991 | NTAPI 1992 | DirectNtCreatePagingFile( 1993 | IN PUNICODE_STRING PageFileName, 1994 | IN PLARGE_INTEGER MinimumSize, 1995 | IN PLARGE_INTEGER MaximumSize, 1996 | IN ULONG Priority 1997 | ); 1998 | 1999 | 2000 | NTSTATUS 2001 | NTAPI 2002 | DirectNtFlushInstructionCache( 2003 | IN HANDLE ProcessHandle, 2004 | IN OPTIONAL PVOID BaseAddress, 2005 | IN SIZE_T Length 2006 | ); 2007 | 2008 | 2009 | NTSTATUS 2010 | NTAPI 2011 | DirectNtFlushWriteBuffer( 2012 | VOID 2013 | ); 2014 | 2015 | 2016 | NTSTATUS 2017 | NTAPI 2018 | DirectNtQueryObject( 2019 | IN HANDLE Handle, 2020 | IN OBJECT_INFORMATION_CLASS ObjectInformationClass, 2021 | OUT PVOID ObjectInformation, 2022 | IN ULONG ObjectInformationLength, 2023 | OUT OPTIONAL PULONG ReturnLength 2024 | ); 2025 | 2026 | 2027 | NTSTATUS 2028 | NTAPI 2029 | DirectNtSetInformationObject( 2030 | IN HANDLE Handle, 2031 | IN OBJECT_INFORMATION_CLASS ObjectInformationClass, 2032 | IN PVOID ObjectInformation, 2033 | IN ULONG ObjectInformationLength 2034 | ); 2035 | 2036 | 2037 | NTSTATUS 2038 | NTAPI 2039 | DirectNtDuplicateObject( 2040 | IN HANDLE SourceProcessHandle, 2041 | IN HANDLE SourceHandle, 2042 | IN OPTIONAL HANDLE TargetProcessHandle, 2043 | OUT OPTIONAL PHANDLE TargetHandle, 2044 | IN ACCESS_MASK DesiredAccess, 2045 | IN ULONG HandleAttributes, 2046 | IN ULONG Options 2047 | ); 2048 | 2049 | 2050 | NTSTATUS 2051 | NTAPI 2052 | DirectNtMakeTemporaryObject( 2053 | IN HANDLE Handle 2054 | ); 2055 | 2056 | 2057 | NTSTATUS 2058 | NTAPI 2059 | DirectNtMakePermanentObject( 2060 | IN HANDLE Handle 2061 | ); 2062 | 2063 | 2064 | NTSTATUS 2065 | NTAPI 2066 | DirectNtSignalAndWaitForSingleObject( 2067 | IN HANDLE SignalHandle, 2068 | IN HANDLE WaitHandle, 2069 | IN BOOLEAN Alertable, 2070 | IN OPTIONAL PLARGE_INTEGER Timeout 2071 | ); 2072 | 2073 | 2074 | NTSTATUS 2075 | NTAPI 2076 | DirectNtWaitForSingleObject( 2077 | IN HANDLE Handle, 2078 | IN BOOLEAN Alertable, 2079 | IN OPTIONAL PLARGE_INTEGER Timeout 2080 | ); 2081 | 2082 | 2083 | NTSTATUS 2084 | NTAPI 2085 | DirectNtWaitForMultipleObjects( 2086 | IN ULONG Count, 2087 | IN HANDLE Handles[], 2088 | IN WAIT_TYPE WaitType, 2089 | IN BOOLEAN Alertable, 2090 | IN OPTIONAL PLARGE_INTEGER Timeout 2091 | ); 2092 | 2093 | 2094 | NTSTATUS 2095 | NTAPI 2096 | DirectNtWaitForMultipleObjects32( 2097 | IN ULONG Count, 2098 | IN LONG Handles[], 2099 | IN WAIT_TYPE WaitType, 2100 | IN BOOLEAN Alertable, 2101 | IN OPTIONAL PLARGE_INTEGER Timeout 2102 | ); 2103 | 2104 | 2105 | NTSTATUS 2106 | NTAPI 2107 | DirectNtSetSecurityObject( 2108 | IN HANDLE Handle, 2109 | IN SECURITY_INFORMATION SecurityInformation, 2110 | IN PSECURITY_DESCRIPTOR SecurityDescriptor 2111 | ); 2112 | 2113 | 2114 | NTSTATUS 2115 | NTAPI 2116 | DirectNtQuerySecurityObject( 2117 | IN HANDLE Handle, 2118 | IN SECURITY_INFORMATION SecurityInformation, 2119 | OUT PSECURITY_DESCRIPTOR SecurityDescriptor, 2120 | IN ULONG Length, 2121 | OUT PULONG LengthNeeded 2122 | ); 2123 | 2124 | 2125 | NTSTATUS 2126 | NTAPI 2127 | DirectNtClose( 2128 | IN HANDLE Handle 2129 | ); 2130 | 2131 | 2132 | NTSTATUS 2133 | NTAPI 2134 | DirectNtCreateDirectoryObject( 2135 | OUT PHANDLE DirectoryHandle, 2136 | IN ACCESS_MASK DesiredAccess, 2137 | IN POBJECT_ATTRIBUTES ObjectAttributes 2138 | ); 2139 | 2140 | 2141 | NTSTATUS 2142 | NTAPI 2143 | DirectNtOpenDirectoryObject( 2144 | OUT PHANDLE DirectoryHandle, 2145 | IN ACCESS_MASK DesiredAccess, 2146 | IN POBJECT_ATTRIBUTES ObjectAttributes 2147 | ); 2148 | 2149 | 2150 | NTSTATUS 2151 | NTAPI 2152 | DirectNtQueryDirectoryObject( 2153 | IN HANDLE DirectoryHandle, 2154 | OUT PVOID Buffer, 2155 | IN ULONG Length, 2156 | IN BOOLEAN ReturnSingleEntry, 2157 | IN BOOLEAN RestartScan, 2158 | IN OUT PULONG Context, 2159 | OUT OPTIONAL PULONG ReturnLength 2160 | ); 2161 | 2162 | 2163 | NTSTATUS 2164 | NTAPI 2165 | DirectNtCreateSymbolicLinkObject( 2166 | OUT PHANDLE LinkHandle, 2167 | IN ACCESS_MASK DesiredAccess, 2168 | IN POBJECT_ATTRIBUTES ObjectAttributes, 2169 | IN PUNICODE_STRING LinkTarget 2170 | ); 2171 | 2172 | 2173 | NTSTATUS 2174 | NTAPI 2175 | DirectNtOpenSymbolicLinkObject( 2176 | OUT PHANDLE LinkHandle, 2177 | IN ACCESS_MASK DesiredAccess, 2178 | IN POBJECT_ATTRIBUTES ObjectAttributes 2179 | ); 2180 | 2181 | 2182 | NTSTATUS 2183 | NTAPI 2184 | DirectNtQuerySymbolicLinkObject( 2185 | IN HANDLE LinkHandle, 2186 | IN OUT PUNICODE_STRING LinkTarget, 2187 | OUT OPTIONAL PULONG ReturnedLength 2188 | ); 2189 | 2190 | 2191 | NTSTATUS 2192 | NTAPI 2193 | DirectNtGetPlugPlayEvent( 2194 | IN HANDLE EventHandle, 2195 | IN OPTIONAL PVOID Context, 2196 | OUT PPLUGPLAY_EVENT_BLOCK EventBlock, 2197 | IN ULONG EventBufferSize 2198 | ); 2199 | 2200 | 2201 | NTSTATUS 2202 | NTAPI 2203 | DirectNtPlugPlayControl( 2204 | IN PLUGPLAY_CONTROL_CLASS PnPControlClass, 2205 | IN OUT PVOID PnPControlData, 2206 | IN ULONG PnPControlDataLength 2207 | ); 2208 | 2209 | 2210 | NTSTATUS 2211 | NTAPI 2212 | DirectNtPowerInformation( 2213 | IN POWER_INFORMATION_LEVEL InformationLevel, 2214 | IN OPTIONAL PVOID InputBuffer, 2215 | IN ULONG InputBufferLength, 2216 | OUT OPTIONAL PVOID OutputBuffer, 2217 | IN ULONG OutputBufferLength 2218 | ); 2219 | 2220 | 2221 | NTSTATUS 2222 | NTAPI 2223 | DirectNtSetThreadExecutionState( 2224 | IN EXECUTION_STATE esFlags, // ES_xxx flags 2225 | OUT EXECUTION_STATE *PreviousFlags 2226 | ); 2227 | 2228 | 2229 | NTSTATUS 2230 | NTAPI 2231 | DirectNtRequestWakeupLatency( 2232 | IN LATENCY_TIME latency 2233 | ); 2234 | 2235 | 2236 | NTSTATUS 2237 | NTAPI 2238 | DirectNtInitiatePowerAction( 2239 | IN POWER_ACTION SystemAction, 2240 | IN SYSTEM_POWER_STATE MinSystemState, 2241 | IN ULONG Flags, // POWER_ACTION_xxx flags 2242 | IN BOOLEAN Asynchronous 2243 | ); 2244 | 2245 | 2246 | NTSTATUS 2247 | NTAPI 2248 | DirectNtSetSystemPowerState( 2249 | IN POWER_ACTION SystemAction, 2250 | IN SYSTEM_POWER_STATE MinSystemState, 2251 | IN ULONG Flags // POWER_ACTION_xxx flags 2252 | ); 2253 | 2254 | 2255 | NTSTATUS 2256 | NTAPI 2257 | DirectNtGetDevicePowerState( 2258 | IN HANDLE Device, 2259 | OUT DEVICE_POWER_STATE *State 2260 | ); 2261 | 2262 | 2263 | NTSTATUS 2264 | NTAPI 2265 | DirectNtCancelDeviceWakeupRequest( 2266 | IN HANDLE Device 2267 | ); 2268 | 2269 | 2270 | NTSTATUS 2271 | NTAPI 2272 | DirectNtRequestDeviceWakeup( 2273 | IN HANDLE Device 2274 | ); 2275 | 2276 | 2277 | NTSTATUS 2278 | NTAPI 2279 | DirectNtCreateProcess( 2280 | OUT PHANDLE ProcessHandle, 2281 | IN ACCESS_MASK DesiredAccess, 2282 | IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, 2283 | IN HANDLE ParentProcess, 2284 | IN BOOLEAN InheritObjectTable, 2285 | IN OPTIONAL HANDLE SectionHandle, 2286 | IN OPTIONAL HANDLE DebugPort, 2287 | IN OPTIONAL HANDLE ExceptionPort 2288 | ); 2289 | 2290 | 2291 | NTSTATUS 2292 | NTAPI 2293 | DirectNtCreateProcessEx( 2294 | OUT PHANDLE ProcessHandle, 2295 | IN ACCESS_MASK DesiredAccess, 2296 | IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, 2297 | IN HANDLE ParentProcess, 2298 | IN ULONG Flags, 2299 | IN OPTIONAL HANDLE SectionHandle, 2300 | IN OPTIONAL HANDLE DebugPort, 2301 | IN OPTIONAL HANDLE ExceptionPort, 2302 | IN ULONG JobMemberLevel 2303 | ); 2304 | 2305 | 2306 | NTSTATUS 2307 | NTAPI 2308 | DirectNtOpenProcess( 2309 | OUT PHANDLE ProcessHandle, 2310 | IN ACCESS_MASK DesiredAccess, 2311 | IN POBJECT_ATTRIBUTES ObjectAttributes, 2312 | IN OPTIONAL PCLIENT_ID ClientId 2313 | ); 2314 | 2315 | 2316 | NTSTATUS 2317 | NTAPI 2318 | DirectNtTerminateProcess( 2319 | IN OPTIONAL HANDLE ProcessHandle, 2320 | IN NTSTATUS ExitStatus 2321 | ); 2322 | 2323 | 2324 | NTSTATUS 2325 | NTAPI 2326 | DirectNtQueryInformationProcess( 2327 | IN HANDLE ProcessHandle, 2328 | IN PROCESSINFOCLASS ProcessInformationClass, 2329 | OUT PVOID ProcessInformation, 2330 | IN ULONG ProcessInformationLength, 2331 | OUT OPTIONAL PULONG ReturnLength 2332 | ); 2333 | 2334 | 2335 | NTSTATUS 2336 | NTAPI 2337 | DirectNtGetNextProcess( 2338 | IN HANDLE ProcessHandle, 2339 | IN ACCESS_MASK DesiredAccess, 2340 | IN ULONG HandleAttributes, 2341 | IN ULONG Flags, 2342 | OUT PHANDLE NewProcessHandle 2343 | ); 2344 | 2345 | 2346 | NTSTATUS 2347 | NTAPI 2348 | DirectNtGetNextThread( 2349 | IN HANDLE ProcessHandle, 2350 | IN HANDLE ThreadHandle, 2351 | IN ACCESS_MASK DesiredAccess, 2352 | IN ULONG HandleAttributes, 2353 | IN ULONG Flags, 2354 | OUT PHANDLE NewThreadHandle 2355 | ); 2356 | 2357 | 2358 | NTSTATUS 2359 | NTAPI 2360 | DirectNtQueryPortInformationProcess( 2361 | VOID 2362 | ); 2363 | 2364 | 2365 | NTSTATUS 2366 | NTAPI 2367 | DirectNtSetInformationProcess( 2368 | IN HANDLE ProcessHandle, 2369 | IN PROCESSINFOCLASS ProcessInformationClass, 2370 | IN PVOID ProcessInformation, 2371 | IN ULONG ProcessInformationLength 2372 | ); 2373 | 2374 | 2375 | NTSTATUS 2376 | NTAPI 2377 | DirectNtCreateThread( 2378 | OUT PHANDLE ThreadHandle, 2379 | IN ACCESS_MASK DesiredAccess, 2380 | IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, 2381 | IN HANDLE ProcessHandle, 2382 | OUT PCLIENT_ID ClientId, 2383 | IN PCONTEXT ThreadContext, 2384 | IN PINITIAL_TEB InitialTeb, 2385 | IN BOOLEAN CreateSuspended 2386 | ); 2387 | 2388 | 2389 | NTSTATUS 2390 | NTAPI 2391 | DirectNtOpenThread( 2392 | OUT PHANDLE ThreadHandle, 2393 | IN ACCESS_MASK DesiredAccess, 2394 | IN POBJECT_ATTRIBUTES ObjectAttributes, 2395 | IN OPTIONAL PCLIENT_ID ClientId 2396 | ); 2397 | 2398 | 2399 | NTSTATUS 2400 | NTAPI 2401 | DirectNtTerminateThread( 2402 | IN OPTIONAL HANDLE ThreadHandle, 2403 | IN NTSTATUS ExitStatus 2404 | ); 2405 | 2406 | 2407 | NTSTATUS 2408 | NTAPI 2409 | DirectNtSuspendThread( 2410 | IN HANDLE ThreadHandle, 2411 | OUT OPTIONAL PULONG PreviousSuspendCount 2412 | ); 2413 | 2414 | 2415 | NTSTATUS 2416 | NTAPI 2417 | DirectNtResumeThread( 2418 | IN HANDLE ThreadHandle, 2419 | OUT OPTIONAL PULONG PreviousSuspendCount 2420 | ); 2421 | 2422 | 2423 | NTSTATUS 2424 | NTAPI 2425 | DirectNtSuspendProcess( 2426 | IN HANDLE ProcessHandle 2427 | ); 2428 | 2429 | 2430 | NTSTATUS 2431 | NTAPI 2432 | DirectNtResumeProcess( 2433 | IN HANDLE ProcessHandle 2434 | ); 2435 | 2436 | 2437 | NTSTATUS 2438 | NTAPI 2439 | DirectNtGetContextThread( 2440 | IN HANDLE ThreadHandle, 2441 | IN OUT PCONTEXT ThreadContext 2442 | ); 2443 | 2444 | 2445 | NTSTATUS 2446 | NTAPI 2447 | DirectNtSetContextThread( 2448 | IN HANDLE ThreadHandle, 2449 | IN PCONTEXT ThreadContext 2450 | ); 2451 | 2452 | 2453 | NTSTATUS 2454 | NTAPI 2455 | DirectNtQueryInformationThread( 2456 | IN HANDLE ThreadHandle, 2457 | IN THREADINFOCLASS ThreadInformationClass, 2458 | OUT PVOID ThreadInformation, 2459 | IN ULONG ThreadInformationLength, 2460 | OUT OPTIONAL PULONG ReturnLength 2461 | ); 2462 | 2463 | 2464 | NTSTATUS 2465 | NTAPI 2466 | DirectNtSetInformationThread( 2467 | IN HANDLE ThreadHandle, 2468 | IN THREADINFOCLASS ThreadInformationClass, 2469 | IN PVOID ThreadInformation, 2470 | IN ULONG ThreadInformationLength 2471 | ); 2472 | 2473 | 2474 | NTSTATUS 2475 | NTAPI 2476 | DirectNtAlertThread( 2477 | IN HANDLE ThreadHandle 2478 | ); 2479 | 2480 | 2481 | NTSTATUS 2482 | NTAPI 2483 | DirectNtAlertResumeThread( 2484 | IN HANDLE ThreadHandle, 2485 | OUT OPTIONAL PULONG PreviousSuspendCount 2486 | ); 2487 | 2488 | 2489 | NTSTATUS 2490 | NTAPI 2491 | DirectNtImpersonateThread( 2492 | IN HANDLE ServerThreadHandle, 2493 | IN HANDLE ClientThreadHandle, 2494 | IN PSECURITY_QUALITY_OF_SERVICE SecurityQos 2495 | ); 2496 | 2497 | 2498 | NTSTATUS 2499 | NTAPI 2500 | DirectNtTestAlert( 2501 | VOID 2502 | ); 2503 | 2504 | 2505 | NTSTATUS 2506 | NTAPI 2507 | DirectNtRegisterThreadTerminatePort( 2508 | IN HANDLE PortHandle 2509 | ); 2510 | 2511 | 2512 | NTSTATUS 2513 | NTAPI 2514 | DirectNtSetLdtEntries( 2515 | IN ULONG Selector0, 2516 | IN ULONG Entry0Low, 2517 | IN ULONG Entry0Hi, 2518 | IN ULONG Selector1, 2519 | IN ULONG Entry1Low, 2520 | IN ULONG Entry1Hi 2521 | ); 2522 | 2523 | 2524 | NTSTATUS 2525 | NTAPI 2526 | DirectNtQueueApcThread( 2527 | IN HANDLE ThreadHandle, 2528 | IN PPS_APC_ROUTINE ApcRoutine, 2529 | IN OPTIONAL PVOID ApcArgument1, 2530 | IN OPTIONAL PVOID ApcArgument2, 2531 | IN OPTIONAL PVOID ApcArgument3 2532 | ); 2533 | 2534 | 2535 | NTSTATUS 2536 | NTAPI 2537 | DirectNtCreateJobObject( 2538 | OUT PHANDLE JobHandle, 2539 | IN ACCESS_MASK DesiredAccess, 2540 | IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes 2541 | ); 2542 | 2543 | 2544 | NTSTATUS 2545 | NTAPI 2546 | DirectNtOpenJobObject( 2547 | OUT PHANDLE JobHandle, 2548 | IN ACCESS_MASK DesiredAccess, 2549 | IN POBJECT_ATTRIBUTES ObjectAttributes 2550 | ); 2551 | 2552 | 2553 | NTSTATUS 2554 | NTAPI 2555 | DirectNtAssignProcessToJobObject( 2556 | IN HANDLE JobHandle, 2557 | IN HANDLE ProcessHandle 2558 | ); 2559 | 2560 | 2561 | NTSTATUS 2562 | NTAPI 2563 | DirectNtTerminateJobObject( 2564 | IN HANDLE JobHandle, 2565 | IN NTSTATUS ExitStatus 2566 | ); 2567 | 2568 | 2569 | NTSTATUS 2570 | NTAPI 2571 | DirectNtIsProcessInJob( 2572 | IN HANDLE ProcessHandle, 2573 | IN OPTIONAL HANDLE JobHandle 2574 | ); 2575 | 2576 | 2577 | NTSTATUS 2578 | NTAPI 2579 | DirectNtCreateJobSet( 2580 | IN ULONG NumJob, 2581 | IN PJOB_SET_ARRAY UserJobSet, 2582 | IN ULONG Flags 2583 | ); 2584 | 2585 | 2586 | NTSTATUS 2587 | NTAPI 2588 | DirectNtQueryInformationJobObject( 2589 | IN OPTIONAL HANDLE JobHandle, 2590 | IN JOBOBJECTINFOCLASS JobObjectInformationClass, 2591 | IN PVOID JobObjectInformation, 2592 | IN ULONG JobObjectInformationLength, 2593 | OUT OPTIONAL PULONG ReturnLength 2594 | ); 2595 | 2596 | 2597 | NTSTATUS 2598 | NTAPI 2599 | DirectNtSetInformationJobObject( 2600 | IN HANDLE JobHandle, 2601 | IN JOBOBJECTINFOCLASS JobObjectInformationClass, 2602 | IN PVOID JobObjectInformation, 2603 | IN ULONG JobObjectInformationLength 2604 | ); 2605 | 2606 | 2607 | NTSTATUS 2608 | NTAPI 2609 | DirectNtCreateKey( 2610 | OUT PHANDLE KeyHandle, 2611 | IN ACCESS_MASK DesiredAccess, 2612 | IN POBJECT_ATTRIBUTES ObjectAttributes, 2613 | IN ULONG TitleIndex, 2614 | IN PUNICODE_STRING Class OPTIONAL, 2615 | IN ULONG CreateOptions, 2616 | OUT PULONG Disposition OPTIONAL 2617 | ); 2618 | 2619 | 2620 | NTSTATUS 2621 | NTAPI 2622 | DirectNtDeleteKey( 2623 | IN HANDLE KeyHandle 2624 | ); 2625 | 2626 | 2627 | NTSTATUS 2628 | NTAPI 2629 | DirectNtDeleteValueKey( 2630 | IN HANDLE KeyHandle, 2631 | IN PUNICODE_STRING ValueName 2632 | ); 2633 | 2634 | 2635 | NTSTATUS 2636 | NTAPI 2637 | DirectNtEnumerateKey( 2638 | IN HANDLE KeyHandle, 2639 | IN ULONG Index, 2640 | IN KEY_INFORMATION_CLASS KeyInformationClass, 2641 | OUT PVOID KeyInformation, 2642 | IN ULONG Length, 2643 | OUT PULONG ResultLength 2644 | ); 2645 | 2646 | 2647 | NTSTATUS 2648 | NTAPI 2649 | DirectNtEnumerateValueKey( 2650 | IN HANDLE KeyHandle, 2651 | IN ULONG Index, 2652 | IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, 2653 | OUT PVOID KeyValueInformation, 2654 | IN ULONG Length, 2655 | OUT PULONG ResultLength 2656 | ); 2657 | 2658 | 2659 | NTSTATUS 2660 | NTAPI 2661 | DirectNtFlushKey( 2662 | IN HANDLE KeyHandle 2663 | ); 2664 | 2665 | 2666 | NTSTATUS 2667 | NTAPI 2668 | DirectNtInitializeRegistry( 2669 | IN USHORT BootCondition 2670 | ); 2671 | 2672 | 2673 | NTSTATUS 2674 | NTAPI 2675 | DirectNtNotifyChangeKey( 2676 | IN HANDLE KeyHandle, 2677 | IN OPTIONAL HANDLE Event, 2678 | IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, 2679 | IN OPTIONAL PVOID ApcContext, 2680 | OUT PIO_STATUS_BLOCK IoStatusBlock, 2681 | IN ULONG CompletionFilter, 2682 | IN BOOLEAN WatchTree, 2683 | OUT PVOID Buffer, 2684 | IN ULONG BufferSize, 2685 | IN BOOLEAN Asynchronous 2686 | ); 2687 | 2688 | 2689 | NTSTATUS 2690 | NTAPI 2691 | DirectNtNotifyChangeMultipleKeys( 2692 | IN HANDLE MasterKeyHandle, 2693 | IN OPTIONAL ULONG Count, 2694 | IN OPTIONAL OBJECT_ATTRIBUTES SlaveObjects[], 2695 | IN OPTIONAL HANDLE Event, 2696 | IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, 2697 | IN OPTIONAL PVOID ApcContext, 2698 | OUT PIO_STATUS_BLOCK IoStatusBlock, 2699 | IN ULONG CompletionFilter, 2700 | IN BOOLEAN WatchTree, 2701 | OUT OPTIONAL PVOID Buffer, 2702 | IN ULONG BufferSize, 2703 | IN BOOLEAN Asynchronous 2704 | ); 2705 | 2706 | 2707 | NTSTATUS 2708 | NTAPI 2709 | DirectNtLoadKey( 2710 | IN POBJECT_ATTRIBUTES TargetKey, 2711 | IN POBJECT_ATTRIBUTES SourceFile 2712 | ); 2713 | 2714 | 2715 | NTSTATUS 2716 | NTAPI 2717 | DirectNtLoadKey2( 2718 | IN POBJECT_ATTRIBUTES TargetKey, 2719 | IN POBJECT_ATTRIBUTES SourceFile, 2720 | IN ULONG Flags 2721 | ); 2722 | 2723 | 2724 | NTSTATUS 2725 | NTAPI 2726 | DirectNtLoadKeyEx( 2727 | IN POBJECT_ATTRIBUTES TargetKey, 2728 | IN POBJECT_ATTRIBUTES SourceFile, 2729 | IN ULONG Flags, 2730 | IN OPTIONAL HANDLE TrustClassKey 2731 | ); 2732 | 2733 | 2734 | NTSTATUS 2735 | NTAPI 2736 | DirectNtOpenKey( 2737 | OUT PHANDLE KeyHandle, 2738 | IN ACCESS_MASK DesiredAccess, 2739 | IN POBJECT_ATTRIBUTES ObjectAttributes 2740 | ); 2741 | 2742 | 2743 | NTSTATUS 2744 | NTAPI 2745 | DirectNtQueryKey( 2746 | IN HANDLE KeyHandle, 2747 | IN KEY_INFORMATION_CLASS KeyInformationClass, 2748 | OUT PVOID KeyInformation, 2749 | IN ULONG Length, 2750 | OUT PULONG ResultLength 2751 | ); 2752 | 2753 | 2754 | NTSTATUS 2755 | NTAPI 2756 | DirectNtQueryValueKey( 2757 | IN HANDLE KeyHandle, 2758 | IN PUNICODE_STRING ValueName, 2759 | IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, 2760 | OUT PVOID KeyValueInformation, 2761 | IN ULONG Length, 2762 | OUT PULONG ResultLength 2763 | ); 2764 | 2765 | 2766 | NTSTATUS 2767 | NTAPI 2768 | DirectNtQueryMultipleValueKey( 2769 | IN HANDLE KeyHandle, 2770 | IN PKEY_VALUE_ENTRY ValueEntries, 2771 | IN ULONG EntryCount, 2772 | OUT PVOID ValueBuffer, 2773 | IN OUT PULONG BufferLength, 2774 | OUT OPTIONAL PULONG RequiredBufferLength 2775 | ); 2776 | 2777 | 2778 | NTSTATUS 2779 | NTAPI 2780 | DirectNtReplaceKey( 2781 | IN POBJECT_ATTRIBUTES NewFile, 2782 | IN HANDLE TargetHandle, 2783 | IN POBJECT_ATTRIBUTES OldFile 2784 | ); 2785 | 2786 | 2787 | NTSTATUS 2788 | NTAPI 2789 | DirectNtRenameKey( 2790 | IN HANDLE KeyHandle, 2791 | IN PUNICODE_STRING NewName 2792 | ); 2793 | 2794 | 2795 | NTSTATUS 2796 | NTAPI 2797 | DirectNtCompactKeys( 2798 | IN ULONG Count, 2799 | IN HANDLE KeyArray[] 2800 | ); 2801 | 2802 | 2803 | NTSTATUS 2804 | NTAPI 2805 | DirectNtCompressKey( 2806 | IN HANDLE Key 2807 | ); 2808 | 2809 | 2810 | NTSTATUS 2811 | NTAPI 2812 | DirectNtRestoreKey( 2813 | IN HANDLE KeyHandle, 2814 | IN HANDLE FileHandle, 2815 | IN ULONG Flags 2816 | ); 2817 | 2818 | 2819 | NTSTATUS 2820 | NTAPI 2821 | DirectNtSaveKey( 2822 | IN HANDLE KeyHandle, 2823 | IN HANDLE FileHandle 2824 | ); 2825 | 2826 | 2827 | NTSTATUS 2828 | NTAPI 2829 | DirectNtSaveKeyEx( 2830 | IN HANDLE KeyHandle, 2831 | IN HANDLE FileHandle, 2832 | IN ULONG Format 2833 | ); 2834 | 2835 | 2836 | NTSTATUS 2837 | NTAPI 2838 | DirectNtSaveMergedKeys( 2839 | IN HANDLE HighPrecedenceKeyHandle, 2840 | IN HANDLE LowPrecedenceKeyHandle, 2841 | IN HANDLE FileHandle 2842 | ); 2843 | 2844 | 2845 | NTSTATUS 2846 | NTAPI 2847 | DirectNtSetValueKey( 2848 | IN HANDLE KeyHandle, 2849 | IN PUNICODE_STRING ValueName, 2850 | IN OPTIONAL ULONG TitleIndex, 2851 | IN ULONG Type, 2852 | IN PVOID Data, 2853 | IN ULONG DataSize 2854 | ); 2855 | 2856 | 2857 | NTSTATUS 2858 | NTAPI 2859 | DirectNtUnloadKey( 2860 | IN POBJECT_ATTRIBUTES TargetKey 2861 | ); 2862 | 2863 | 2864 | NTSTATUS 2865 | NTAPI 2866 | DirectNtUnloadKey2( 2867 | IN POBJECT_ATTRIBUTES TargetKey, 2868 | IN ULONG Flags 2869 | ); 2870 | 2871 | 2872 | NTSTATUS 2873 | NTAPI 2874 | DirectNtUnloadKeyEx( 2875 | IN POBJECT_ATTRIBUTES TargetKey, 2876 | IN OPTIONAL HANDLE Event 2877 | ); 2878 | 2879 | 2880 | NTSTATUS 2881 | NTAPI 2882 | DirectNtSetInformationKey( 2883 | IN HANDLE KeyHandle, 2884 | IN KEY_SET_INFORMATION_CLASS KeySetInformationClass, 2885 | IN PVOID KeySetInformation, 2886 | IN ULONG KeySetInformationLength 2887 | ); 2888 | 2889 | 2890 | NTSTATUS 2891 | NTAPI 2892 | DirectNtQueryOpenSubKeys( 2893 | IN POBJECT_ATTRIBUTES TargetKey, 2894 | OUT PULONG HandleCount 2895 | ); 2896 | 2897 | 2898 | NTSTATUS 2899 | NTAPI 2900 | DirectNtQueryOpenSubKeysEx( 2901 | IN POBJECT_ATTRIBUTES TargetKey, 2902 | IN ULONG BufferLength, 2903 | OUT PVOID Buffer, 2904 | OUT PULONG RequiredSize 2905 | ); 2906 | 2907 | 2908 | NTSTATUS 2909 | NTAPI 2910 | DirectNtLockRegistryKey( 2911 | IN HANDLE KeyHandle 2912 | ); 2913 | 2914 | 2915 | NTSTATUS 2916 | NTAPI 2917 | DirectNtLockProductActivationKeys( 2918 | IN OUT OPTIONAL ULONG *pPrivateVer, 2919 | OUT OPTIONAL ULONG *pSafeMode 2920 | ); 2921 | 2922 | 2923 | NTSTATUS 2924 | NTAPI 2925 | DirectNtAccessCheck( 2926 | IN PSECURITY_DESCRIPTOR SecurityDescriptor, 2927 | IN HANDLE ClientToken, 2928 | IN ACCESS_MASK DesiredAccess, 2929 | IN PGENERIC_MAPPING GenericMapping, 2930 | OUT PPRIVILEGE_SET PrivilegeSet, 2931 | IN OUT PULONG PrivilegeSetLength, 2932 | OUT PACCESS_MASK GrantedAccess, 2933 | OUT PNTSTATUS AccessStatus 2934 | ); 2935 | 2936 | 2937 | NTSTATUS 2938 | NTAPI 2939 | DirectNtAccessCheckByType( 2940 | IN PSECURITY_DESCRIPTOR SecurityDescriptor, 2941 | IN OPTIONAL PSID PrincipalSelfSid, 2942 | IN HANDLE ClientToken, 2943 | IN ACCESS_MASK DesiredAccess, 2944 | IN POBJECT_TYPE_LIST ObjectTypeList, 2945 | IN ULONG ObjectTypeListLength, 2946 | IN PGENERIC_MAPPING GenericMapping, 2947 | OUT PPRIVILEGE_SET PrivilegeSet, 2948 | IN OUT PULONG PrivilegeSetLength, 2949 | OUT PACCESS_MASK GrantedAccess, 2950 | OUT PNTSTATUS AccessStatus 2951 | ); 2952 | 2953 | 2954 | NTSTATUS 2955 | NTAPI 2956 | DirectNtAccessCheckByTypeResultList( 2957 | IN PSECURITY_DESCRIPTOR SecurityDescriptor, 2958 | IN OPTIONAL PSID PrincipalSelfSid, 2959 | IN HANDLE ClientToken, 2960 | IN ACCESS_MASK DesiredAccess, 2961 | IN POBJECT_TYPE_LIST ObjectTypeList, 2962 | IN ULONG ObjectTypeListLength, 2963 | IN PGENERIC_MAPPING GenericMapping, 2964 | OUT PPRIVILEGE_SET PrivilegeSet, 2965 | IN OUT PULONG PrivilegeSetLength, 2966 | OUT PACCESS_MASK GrantedAccess, 2967 | OUT PNTSTATUS AccessStatus 2968 | ); 2969 | 2970 | 2971 | NTSTATUS 2972 | NTAPI 2973 | DirectNtCreateToken( 2974 | OUT PHANDLE TokenHandle, 2975 | IN ACCESS_MASK DesiredAccess, 2976 | IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, 2977 | IN TOKEN_TYPE TokenType, 2978 | IN PLUID AuthenticationId, 2979 | IN PLARGE_INTEGER ExpirationTime, 2980 | IN PTOKEN_USER User, 2981 | IN PTOKEN_GROUPS Groups, 2982 | IN PTOKEN_PRIVILEGES Privileges, 2983 | IN OPTIONAL PTOKEN_OWNER Owner, 2984 | IN PTOKEN_PRIMARY_GROUP PrimaryGroup, 2985 | IN OPTIONAL PTOKEN_DEFAULT_DACL DefaultDacl, 2986 | IN PTOKEN_SOURCE TokenSource 2987 | ); 2988 | 2989 | 2990 | NTSTATUS 2991 | NTAPI 2992 | DirectNtCompareTokens( 2993 | IN HANDLE FirstTokenHandle, 2994 | IN HANDLE SecondTokenHandle, 2995 | OUT PBOOLEAN Equal 2996 | ); 2997 | 2998 | 2999 | NTSTATUS 3000 | NTAPI 3001 | DirectNtOpenThreadToken( 3002 | IN HANDLE ThreadHandle, 3003 | IN ACCESS_MASK DesiredAccess, 3004 | IN BOOLEAN OpenAsSelf, 3005 | OUT PHANDLE TokenHandle 3006 | ); 3007 | 3008 | 3009 | NTSTATUS 3010 | NTAPI 3011 | DirectNtOpenThreadTokenEx( 3012 | IN HANDLE ThreadHandle, 3013 | IN ACCESS_MASK DesiredAccess, 3014 | IN BOOLEAN OpenAsSelf, 3015 | IN ULONG HandleAttributes, 3016 | OUT PHANDLE TokenHandle 3017 | ); 3018 | 3019 | 3020 | NTSTATUS 3021 | NTAPI 3022 | DirectNtOpenProcessToken( 3023 | IN HANDLE ProcessHandle, 3024 | IN ACCESS_MASK DesiredAccess, 3025 | OUT PHANDLE TokenHandle 3026 | ); 3027 | 3028 | 3029 | NTSTATUS 3030 | NTAPI 3031 | DirectNtOpenProcessTokenEx( 3032 | IN HANDLE ProcessHandle, 3033 | IN ACCESS_MASK DesiredAccess, 3034 | IN ULONG HandleAttributes, 3035 | OUT PHANDLE TokenHandle 3036 | ); 3037 | 3038 | 3039 | NTSTATUS 3040 | NTAPI 3041 | DirectNtDuplicateToken( 3042 | IN HANDLE ExistingTokenHandle, 3043 | IN ACCESS_MASK DesiredAccess, 3044 | IN POBJECT_ATTRIBUTES ObjectAttributes, 3045 | IN BOOLEAN EffectiveOnly, 3046 | IN TOKEN_TYPE TokenType, 3047 | OUT PHANDLE NewTokenHandle 3048 | ); 3049 | 3050 | 3051 | NTSTATUS 3052 | NTAPI 3053 | DirectNtFilterToken( 3054 | IN HANDLE ExistingTokenHandle, 3055 | IN ULONG Flags, 3056 | IN OPTIONAL PTOKEN_GROUPS SidsToDisable, 3057 | IN OPTIONAL PTOKEN_PRIVILEGES PrivilegesToDelete, 3058 | IN OPTIONAL PTOKEN_GROUPS RestrictedSids, 3059 | OUT PHANDLE NewTokenHandle 3060 | ); 3061 | 3062 | 3063 | NTSTATUS 3064 | NTAPI 3065 | DirectNtImpersonateAnonymousToken( 3066 | IN HANDLE ThreadHandle 3067 | ); 3068 | 3069 | 3070 | NTSTATUS 3071 | NTAPI 3072 | DirectNtQueryInformationToken( 3073 | IN HANDLE TokenHandle, 3074 | IN TOKEN_INFORMATION_CLASS TokenInformationClass, 3075 | OUT PVOID TokenInformation, 3076 | IN ULONG TokenInformationLength, 3077 | OUT PULONG ReturnLength 3078 | ); 3079 | 3080 | 3081 | NTSTATUS 3082 | NTAPI 3083 | DirectNtSetInformationToken( 3084 | IN HANDLE TokenHandle, 3085 | IN TOKEN_INFORMATION_CLASS TokenInformationClass, 3086 | IN PVOID TokenInformation, 3087 | IN ULONG TokenInformationLength 3088 | ); 3089 | 3090 | 3091 | NTSTATUS 3092 | NTAPI 3093 | DirectNtAdjustPrivilegesToken( 3094 | IN HANDLE TokenHandle, 3095 | IN BOOLEAN DisableAllPrivileges, 3096 | IN OPTIONAL PTOKEN_PRIVILEGES NewState, 3097 | IN OPTIONAL ULONG BufferLength, 3098 | OUT OPTIONAL PTOKEN_PRIVILEGES PreviousState, 3099 | OUT OPTIONAL PULONG ReturnLength 3100 | ); 3101 | 3102 | 3103 | NTSTATUS 3104 | NTAPI 3105 | DirectNtAdjustGroupsToken( 3106 | IN HANDLE TokenHandle, 3107 | IN BOOLEAN ResetToDefault, 3108 | IN PTOKEN_GROUPS NewState, 3109 | IN OPTIONAL ULONG BufferLength, 3110 | OUT OPTIONAL PTOKEN_GROUPS PreviousState, 3111 | OUT PULONG ReturnLength 3112 | ); 3113 | 3114 | 3115 | NTSTATUS 3116 | NTAPI 3117 | DirectNtPrivilegeCheck( 3118 | IN HANDLE ClientToken, 3119 | IN OUT PPRIVILEGE_SET RequiredPrivileges, 3120 | OUT PBOOLEAN Result 3121 | ); 3122 | 3123 | 3124 | NTSTATUS 3125 | NTAPI 3126 | DirectNtAccessCheckAndAuditAlarm( 3127 | IN PUNICODE_STRING SubsystemName, 3128 | IN OPTIONAL PVOID HandleId, 3129 | IN PUNICODE_STRING ObjectTypeName, 3130 | IN PUNICODE_STRING ObjectName, 3131 | IN PSECURITY_DESCRIPTOR SecurityDescriptor, 3132 | IN ACCESS_MASK DesiredAccess, 3133 | IN PGENERIC_MAPPING GenericMapping, 3134 | IN BOOLEAN ObjectCreation, 3135 | OUT PACCESS_MASK GrantedAccess, 3136 | OUT PNTSTATUS AccessStatus, 3137 | OUT PBOOLEAN GenerateOnClose 3138 | ); 3139 | 3140 | 3141 | NTSTATUS 3142 | NTAPI 3143 | DirectNtAccessCheckByTypeAndAuditAlarm( 3144 | IN PUNICODE_STRING SubsystemName, 3145 | IN OPTIONAL PVOID HandleId, 3146 | IN PUNICODE_STRING ObjectTypeName, 3147 | IN PUNICODE_STRING ObjectName, 3148 | IN PSECURITY_DESCRIPTOR SecurityDescriptor, 3149 | IN OPTIONAL PSID PrincipalSelfSid, 3150 | IN ACCESS_MASK DesiredAccess, 3151 | IN AUDIT_EVENT_TYPE AuditType, 3152 | IN ULONG Flags, 3153 | IN OPTIONAL POBJECT_TYPE_LIST ObjectTypeList, 3154 | IN ULONG ObjectTypeListLength, 3155 | IN PGENERIC_MAPPING GenericMapping, 3156 | IN BOOLEAN ObjectCreation, 3157 | OUT PACCESS_MASK GrantedAccess, 3158 | OUT PNTSTATUS AccessStatus, 3159 | OUT PBOOLEAN GenerateOnClose 3160 | ); 3161 | 3162 | 3163 | NTSTATUS 3164 | NTAPI 3165 | DirectNtAccessCheckByTypeResultListAndAuditAlarm( 3166 | IN PUNICODE_STRING SubsystemName, 3167 | IN OPTIONAL PVOID HandleId, 3168 | IN PUNICODE_STRING ObjectTypeName, 3169 | IN PUNICODE_STRING ObjectName, 3170 | IN PSECURITY_DESCRIPTOR SecurityDescriptor, 3171 | IN OPTIONAL PSID PrincipalSelfSid, 3172 | IN ACCESS_MASK DesiredAccess, 3173 | IN AUDIT_EVENT_TYPE AuditType, 3174 | IN ULONG Flags, 3175 | IN OPTIONAL POBJECT_TYPE_LIST ObjectTypeList, 3176 | IN ULONG ObjectTypeListLength, 3177 | IN PGENERIC_MAPPING GenericMapping, 3178 | IN BOOLEAN ObjectCreation, 3179 | OUT PACCESS_MASK GrantedAccess, 3180 | OUT PNTSTATUS AccessStatus, 3181 | OUT PBOOLEAN GenerateOnClose 3182 | ); 3183 | 3184 | 3185 | NTSTATUS 3186 | NTAPI 3187 | DirectNtAccessCheckByTypeResultListAndAuditAlarmByHandle( 3188 | IN PUNICODE_STRING SubsystemName, 3189 | IN OPTIONAL PVOID HandleId, 3190 | IN HANDLE ClientToken, 3191 | IN PUNICODE_STRING ObjectTypeName, 3192 | IN PUNICODE_STRING ObjectName, 3193 | IN PSECURITY_DESCRIPTOR SecurityDescriptor, 3194 | IN OPTIONAL PSID PrincipalSelfSid, 3195 | IN ACCESS_MASK DesiredAccess, 3196 | IN AUDIT_EVENT_TYPE AuditType, 3197 | IN ULONG Flags, 3198 | IN OPTIONAL POBJECT_TYPE_LIST ObjectTypeList, 3199 | IN ULONG ObjectTypeListLength, 3200 | IN PGENERIC_MAPPING GenericMapping, 3201 | IN BOOLEAN ObjectCreation, 3202 | OUT PACCESS_MASK GrantedAccess, 3203 | OUT PNTSTATUS AccessStatus, 3204 | OUT PBOOLEAN GenerateOnClose 3205 | ); 3206 | 3207 | 3208 | NTSTATUS 3209 | NTAPI 3210 | DirectNtOpenObjectAuditAlarm( 3211 | IN PUNICODE_STRING SubsystemName, 3212 | IN OPTIONAL PVOID HandleId, 3213 | IN PUNICODE_STRING ObjectTypeName, 3214 | IN PUNICODE_STRING ObjectName, 3215 | IN OPTIONAL PSECURITY_DESCRIPTOR SecurityDescriptor, 3216 | IN HANDLE ClientToken, 3217 | IN ACCESS_MASK DesiredAccess, 3218 | IN ACCESS_MASK GrantedAccess, 3219 | IN OPTIONAL PPRIVILEGE_SET Privileges, 3220 | IN BOOLEAN ObjectCreation, 3221 | IN BOOLEAN AccessGranted, 3222 | OUT PBOOLEAN GenerateOnClose 3223 | ); 3224 | 3225 | 3226 | NTSTATUS 3227 | NTAPI 3228 | DirectNtPrivilegeObjectAuditAlarm( 3229 | IN PUNICODE_STRING SubsystemName, 3230 | IN OPTIONAL PVOID HandleId, 3231 | IN HANDLE ClientToken, 3232 | IN ACCESS_MASK DesiredAccess, 3233 | IN PPRIVILEGE_SET Privileges, 3234 | IN BOOLEAN AccessGranted 3235 | ); 3236 | 3237 | 3238 | NTSTATUS 3239 | NTAPI 3240 | DirectNtCloseObjectAuditAlarm( 3241 | IN PUNICODE_STRING SubsystemName, 3242 | IN OPTIONAL PVOID HandleId, 3243 | IN BOOLEAN GenerateOnClose 3244 | ); 3245 | 3246 | 3247 | NTSTATUS 3248 | NTAPI 3249 | DirectNtDeleteObjectAuditAlarm( 3250 | IN PUNICODE_STRING SubsystemName, 3251 | IN OPTIONAL PVOID HandleId, 3252 | IN BOOLEAN GenerateOnClose 3253 | ); 3254 | 3255 | 3256 | NTSTATUS 3257 | NTAPI 3258 | DirectNtPrivilegedServiceAuditAlarm( 3259 | IN PUNICODE_STRING SubsystemName, 3260 | IN PUNICODE_STRING ServiceName, 3261 | IN HANDLE ClientToken, 3262 | IN PPRIVILEGE_SET Privileges, 3263 | IN BOOLEAN AccessGranted 3264 | ); 3265 | 3266 | 3267 | NTSTATUS 3268 | NTAPI 3269 | DirectNtTraceEvent( 3270 | IN HANDLE TraceHandle, 3271 | IN ULONG Flags, 3272 | IN ULONG FieldSize, 3273 | IN PVOID Fields 3274 | ); 3275 | 3276 | 3277 | NTSTATUS 3278 | NTAPI 3279 | DirectNtContinue( 3280 | IN PCONTEXT ContextRecord, 3281 | IN BOOLEAN TestAlert 3282 | ); 3283 | 3284 | 3285 | NTSTATUS 3286 | NTAPI 3287 | DirectNtRaiseException( 3288 | IN PEXCEPTION_RECORD ExceptionRecord, 3289 | IN PCONTEXT ContextRecord, 3290 | IN BOOLEAN FirstChance 3291 | ); 3292 | 3293 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2018 Fyyre 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # DirectNtApi 2 | A Simple method to make ntapi function calls *without* importing or walking the export table.\ 3 | Works under Windows 7, 8 and 10. 4 | 5 | # This method is OLD 6 | And is therefore **not recommended** to be used! (It serves as a **POC**(**P**roof **O**f **C**oncept)) 7 | 8 | 9 | DirectNtApi is a project I created in 2011. I was looking for a method to call the ntdll api but without importing or typedef. 10 | My primary motivation was simply "because it interested me" - not to mention hooking ntdll.dll is not creative, and not as interesting. 11 | 12 | See usage.txt for details. 13 | 14 | May someone find a value in this nine year old project => 15 | 16 | Be well, 17 | 18 | -Fyyre 19 | -------------------------------------------------------------------------------- /amd64/DirectNtApi.lib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Fyyre/directntapi/659cbbc7974171726d14deab7cfb1e205e7d76bf/amd64/DirectNtApi.lib -------------------------------------------------------------------------------- /amd64/DirectNtApi.obj: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Fyyre/directntapi/659cbbc7974171726d14deab7cfb1e205e7d76bf/amd64/DirectNtApi.obj -------------------------------------------------------------------------------- /i386/DirectNtApi.lib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Fyyre/directntapi/659cbbc7974171726d14deab7cfb1e205e7d76bf/i386/DirectNtApi.lib -------------------------------------------------------------------------------- /usage.txt: -------------------------------------------------------------------------------- 1 | DirectNtApi 2 | A Simple method to make ntapi function calls *without* importing or walking the export table.\ 3 | Works under Windows 7, 8 and 10. 4 | 5 | DirectNtApi is a project I created in 2011. I was looking for a method to call the ntdll api but without importing or typedef. 6 | My primary motivation was simply "because it interested me" - not to mention hooking ntdll.dll is not creative, and not as interesting. 7 | 8 | 9 | DirectNtApi (no phase out) used in projects that hFireFox (EP_X0FF) and I work on together in the past. 10 | 11 | The solution was simple. Make some asm code -> DirectNtApi.lib 12 | For this I use masm (ml/ml64) as it comes with Visual Studio (only reason) 13 | 14 | Store the sys index inside variable - and make the call this way. 15 | 16 | To fetch index from any Windows version, we use a simple method. We load ntdll.dll from disk, 17 | and parse it this way: 18 | 19 | BOOLEAN IsProcess32bit( 20 | HANDLE hProcess 21 | ) 22 | { 23 | ULONG_PTR pbi = 0; 24 | NTSTATUS Status; 25 | 26 | Status = NtQueryInformationProcess(hProcess, ProcessWow64Information, &pbi, sizeof(pbi), NULL); 27 | if (!NT_SUCCESS(Status)) { 28 | 29 | SetLastError(RtlNtStatusToDosError(Status)); 30 | return FALSE; 31 | 32 | } 33 | return (BOOLEAN)(pbi != 0); 34 | } 35 | 36 | ULONG GetNativeProcIndex( 37 | PCHAR hModule, 38 | PCHAR ProcedureName 39 | ) 40 | { 41 | PVOID pfn; 42 | int c = 0; 43 | BYTE v = 0; 44 | 45 | pfn = (void*) PELdr::PELoaderGetProcAddress( hModule, ProcedureName ); 46 | if (pfn) { 47 | #ifdef _WIN64 48 | c = 4; 49 | #else 50 | c = 1; 51 | #endif 52 | 53 | return *(ULONG *)((BYTE *)pfn + c); 54 | } 55 | return (ULONG)-1; 56 | } 57 | 58 | DWORD NtApi( PSTR ApiName ) 59 | { 60 | ULONG_PTR ImageSize = 0; 61 | TCHAR buf[MAX_PATH] = {0}; 62 | 63 | BOOLEAN g_IsWow64 = IsProcess32bit( NtCurrentProcess() ); 64 | 65 | GetSystemDirectory(buf, MAX_PATH); 66 | lstrcat(buf, TEXT("\\ntdll.dll")); 67 | 68 | void* hNtDll = PELdr::PELoaderLoadImage(buf, NULL, FALSE, (PULONG)&ImageSize); 69 | 70 | bool NtDllLoadFail = (hNtDll == NULL); 71 | 72 | if (NtDllLoadFail) 73 | { 74 | hNtDll = GetModuleHandle( _T("ntdll.dll") ); 75 | if (!hNtDll) 76 | return -1; 77 | } 78 | 79 | DWORD sysIdx = GetNativeProcIndex( (PCHAR)hNtDll, ApiName ); 80 | 81 | return sysIdx; 82 | } 83 | 84 | PELoader perhaps in one of fox's repos. No certain if he publish (will ask), until I do so--no include. 85 | 86 | Given our prototypes and storage of sys index as dword in the lib .. to resolve the index at runtime, giving us freedom 87 | to call ntapi as we wish .. should be obvious. 88 | 89 | Perhaps reader is asking question. What is point of this? At the time, this was obvious. As it depend on the use for each project. 90 | Most project I do in past, out of curious nature, for fun, enjoy learning. 91 | 92 | You will need add ntdll.lib (SDK/WDK, or make own) and use winnt.h or ntos.h (see Fox's repo). I omit my own massive ntdll.h due it containing many Microsoft 93 | header elements. 94 | 95 | 96 | May someone find a value in this nine year old project => 97 | 98 | Be well, 99 | 100 | -Fyyre 101 | --------------------------------------------------------------------------------