mingw32-runtime 3.15.2-0ubuntu1 / usr / i586-mingw32msvc / include / ddk / ntapi.h

/*
 * ntapi.h
 *
 * Windows NT Native API
 *
 * Most structures in this file is obtained from Windows NT/2000 Native API
 * Reference by Gary Nebbett, ISBN 1578701996.
 *
 * This file is part of the w32api package.
 *
 * Contributors:
 *   Created by Casper S. Hornstrup <chorns@users.sourceforge.net>
 *
 * THIS SOFTWARE IS NOT COPYRIGHTED
 *
 * This source code is offered for use in the public domain. You may
 * use, modify or distribute it freely.
 *
 * This code is distributed in the hope that it will be useful but
 * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
 * DISCLAIMED. This includes but is not limited to warranties of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 *
 */

#ifndef __NTAPI_H
#define __NTAPI_H

#if __GNUC__ >= 3
#pragma GCC system_header
#endif

#ifdef __cplusplus
extern "C" {
#endif

#include <stdarg.h>
#include <winbase.h>
#include "ntddk.h"
#include "ntpoapi.h"

#pragma pack(push,4)

typedef struct _PEB *PPEB;

/* FIXME: Unknown definitions */
typedef PVOID POBJECT_TYPE_LIST;
typedef PVOID PEXECUTION_STATE;
typedef PVOID PLANGID;

#ifndef NtCurrentProcess
#define NtCurrentProcess() ((HANDLE)0xFFFFFFFF)
#endif /* NtCurrentProcess */
#ifndef NtCurrentThread
#define NtCurrentThread() ((HANDLE)0xFFFFFFFE)
#endif /* NtCurrentThread */

/* System information and control */

typedef enum _SYSTEM_INFORMATION_CLASS {
	SystemInformationClassMin = 0,
	SystemBasicInformation = 0,
	SystemProcessorInformation = 1,
	SystemPerformanceInformation = 2,
	SystemTimeOfDayInformation = 3,
	SystemPathInformation = 4,
	SystemNotImplemented1 = 4,
	SystemProcessInformation = 5,
	SystemProcessesAndThreadsInformation = 5,
	SystemCallCountInfoInformation = 6,
	SystemCallCounts = 6,
	SystemDeviceInformation = 7,
	SystemConfigurationInformation = 7,
	SystemProcessorPerformanceInformation = 8,
	SystemProcessorTimes = 8,
	SystemFlagsInformation = 9,
	SystemGlobalFlag = 9,
	SystemCallTimeInformation = 10,
	SystemNotImplemented2 = 10,
	SystemModuleInformation = 11,
	SystemLocksInformation = 12,
	SystemLockInformation = 12,
	SystemStackTraceInformation = 13,
	SystemNotImplemented3 = 13,
	SystemPagedPoolInformation = 14,
	SystemNotImplemented4 = 14,
	SystemNonPagedPoolInformation = 15,
	SystemNotImplemented5 = 15,
	SystemHandleInformation = 16,
	SystemObjectInformation = 17,
	SystemPageFileInformation = 18,
	SystemPagefileInformation = 18,
	SystemVdmInstemulInformation = 19,
	SystemInstructionEmulationCounts = 19,
	SystemVdmBopInformation = 20,
	SystemInvalidInfoClass1 = 20,	
	SystemFileCacheInformation = 21,
	SystemCacheInformation = 21,
	SystemPoolTagInformation = 22,
	SystemInterruptInformation = 23,
	SystemProcessorStatistics = 23,
	SystemDpcBehaviourInformation = 24,
	SystemDpcInformation = 24,
	SystemFullMemoryInformation = 25,
	SystemNotImplemented6 = 25,
	SystemLoadImage = 26,
	SystemUnloadImage = 27,
	SystemTimeAdjustmentInformation = 28,
	SystemTimeAdjustment = 28,
	SystemSummaryMemoryInformation = 29,
	SystemNotImplemented7 = 29,
	SystemNextEventIdInformation = 30,
	SystemNotImplemented8 = 30,
	SystemEventIdsInformation = 31,
	SystemNotImplemented9 = 31,
	SystemCrashDumpInformation = 32,
	SystemExceptionInformation = 33,
	SystemCrashDumpStateInformation = 34,
	SystemKernelDebuggerInformation = 35,
	SystemContextSwitchInformation = 36,
	SystemRegistryQuotaInformation = 37,
	SystemLoadAndCallImage = 38,
	SystemPrioritySeparation = 39,
	SystemPlugPlayBusInformation = 40,
	SystemNotImplemented10 = 40,
	SystemDockInformation = 41,
	SystemNotImplemented11 = 41,
	/* SystemPowerInformation = 42, Conflicts with POWER_INFORMATION_LEVEL 1 */
	SystemInvalidInfoClass2 = 42,
	SystemProcessorSpeedInformation = 43,
	SystemInvalidInfoClass3 = 43,
	SystemCurrentTimeZoneInformation = 44,
	SystemTimeZoneInformation = 44,
	SystemLookasideInformation = 45,
	SystemSetTimeSlipEvent = 46,
	SystemCreateSession = 47,
	SystemDeleteSession = 48,
	SystemInvalidInfoClass4 = 49,
	SystemRangeStartInformation = 50,
	SystemVerifierInformation = 51,
	SystemAddVerifier = 52,
	SystemSessionProcessesInformation	= 53,
	SystemInformationClassMax
} SYSTEM_INFORMATION_CLASS;

typedef struct _SYSTEM_BASIC_INFORMATION {
	ULONG  Unknown;
	ULONG  MaximumIncrement;
	ULONG  PhysicalPageSize;
	ULONG  NumberOfPhysicalPages;
	ULONG  LowestPhysicalPage;
	ULONG  HighestPhysicalPage;
	ULONG  AllocationGranularity;
	ULONG  LowestUserAddress;
	ULONG  HighestUserAddress;
	ULONG  ActiveProcessors;
	UCHAR  NumberProcessors;
} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;

typedef struct _SYSTEM_PROCESSOR_INFORMATION {
	USHORT  ProcessorArchitecture;
	USHORT  ProcessorLevel;
	USHORT  ProcessorRevision;
	USHORT  Unknown;
	ULONG  FeatureBits;
} SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION;

typedef struct _SYSTEM_PERFORMANCE_INFORMATION {
	LARGE_INTEGER  IdleTime;
	LARGE_INTEGER  ReadTransferCount;
	LARGE_INTEGER  WriteTransferCount;
	LARGE_INTEGER  OtherTransferCount;
	ULONG  ReadOperationCount;
	ULONG  WriteOperationCount;
	ULONG  OtherOperationCount;
	ULONG  AvailablePages;
	ULONG  TotalCommittedPages;
	ULONG  TotalCommitLimit;
	ULONG  PeakCommitment;
	ULONG  PageFaults;
	ULONG  WriteCopyFaults;
	ULONG  TransitionFaults;
	ULONG  CacheTransitionFaults;
	ULONG  DemandZeroFaults;
	ULONG  PagesRead;
	ULONG  PageReadIos;
	ULONG	 CacheReads;
	ULONG	 CacheIos;
	ULONG  PagefilePagesWritten;
	ULONG  PagefilePageWriteIos;
	ULONG  MappedFilePagesWritten;
	ULONG  MappedFilePageWriteIos;
	ULONG  PagedPoolUsage;
	ULONG  NonPagedPoolUsage;
	ULONG  PagedPoolAllocs;
	ULONG  PagedPoolFrees;
	ULONG  NonPagedPoolAllocs;
	ULONG  NonPagedPoolFrees;
	ULONG  TotalFreeSystemPtes;
	ULONG  SystemCodePage;
	ULONG  TotalSystemDriverPages;
	ULONG  TotalSystemCodePages;
	ULONG  SmallNonPagedLookasideListAllocateHits;
	ULONG  SmallPagedLookasideListAllocateHits;
	ULONG  Reserved3;
	ULONG  MmSystemCachePage;
	ULONG  PagedPoolPage;
	ULONG  SystemDriverPage;
	ULONG  FastReadNoWait;
	ULONG  FastReadWait;
	ULONG  FastReadResourceMiss;
	ULONG  FastReadNotPossible;
	ULONG  FastMdlReadNoWait;
	ULONG  FastMdlReadWait;
	ULONG  FastMdlReadResourceMiss;
	ULONG  FastMdlReadNotPossible;
	ULONG  MapDataNoWait;
	ULONG  MapDataWait;
	ULONG  MapDataNoWaitMiss;
	ULONG  MapDataWaitMiss;
	ULONG  PinMappedDataCount;
	ULONG  PinReadNoWait;
	ULONG  PinReadWait;
	ULONG  PinReadNoWaitMiss;
	ULONG  PinReadWaitMiss;
	ULONG  CopyReadNoWait;
	ULONG  CopyReadWait;
	ULONG  CopyReadNoWaitMiss;
	ULONG  CopyReadWaitMiss;
	ULONG  MdlReadNoWait;
	ULONG  MdlReadWait;
	ULONG  MdlReadNoWaitMiss;
	ULONG  MdlReadWaitMiss;
	ULONG  ReadAheadIos;
	ULONG  LazyWriteIos;
	ULONG  LazyWritePages;
	ULONG  DataFlushes;
	ULONG  DataPages;
	ULONG  ContextSwitches;
	ULONG  FirstLevelTbFills;
	ULONG  SecondLevelTbFills;
	ULONG  SystemCalls;
} SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;

typedef struct _SYSTEM_TIME_OF_DAY_INFORMATION {
	LARGE_INTEGER  BootTime;
	LARGE_INTEGER  CurrentTime;
	LARGE_INTEGER  TimeZoneBias;
	ULONG  CurrentTimeZoneId;
} SYSTEM_TIME_OF_DAY_INFORMATION, *PSYSTEM_TIME_OF_DAY_INFORMATION;

typedef struct _VM_COUNTERS {
	ULONG  PeakVirtualSize;
	ULONG  VirtualSize;
	ULONG  PageFaultCount;
	ULONG  PeakWorkingSetSize;
	ULONG  WorkingSetSize;
	ULONG  QuotaPeakPagedPoolUsage;
	ULONG  QuotaPagedPoolUsage;
	ULONG  QuotaPeakNonPagedPoolUsage;
	ULONG  QuotaNonPagedPoolUsage;
	ULONG  PagefileUsage;
	ULONG  PeakPagefileUsage;
} VM_COUNTERS;

typedef enum _THREAD_STATE {
	StateInitialized,
	StateReady,
	StateRunning,
	StateStandby,
	StateTerminated,
	StateWait,
	StateTransition,
	StateUnknown
} THREAD_STATE;

typedef struct _SYSTEM_THREADS {
	LARGE_INTEGER  KernelTime;
	LARGE_INTEGER  UserTime;
	LARGE_INTEGER  CreateTime;
	ULONG  WaitTime;
	PVOID  StartAddress;
	CLIENT_ID  ClientId;
	KPRIORITY  Priority;
	KPRIORITY  BasePriority;
	ULONG  ContextSwitchCount;
	THREAD_STATE  State;
	KWAIT_REASON  WaitReason;
} SYSTEM_THREADS, *PSYSTEM_THREADS;

typedef struct _SYSTEM_PROCESSES {
	ULONG  NextEntryDelta;
	ULONG  ThreadCount;
	ULONG  Reserved1[6];
	LARGE_INTEGER  CreateTime;
	LARGE_INTEGER  UserTime;
	LARGE_INTEGER  KernelTime;
	UNICODE_STRING  ProcessName;
	KPRIORITY  BasePriority;
	ULONG  ProcessId;
	ULONG  InheritedFromProcessId;
	ULONG  HandleCount;
	ULONG  Reserved2[2];
	VM_COUNTERS  VmCounters;
	IO_COUNTERS  IoCounters;
	SYSTEM_THREADS  Threads[1];
} SYSTEM_PROCESSES, *PSYSTEM_PROCESSES;

typedef struct _SYSTEM_CALLS_INFORMATION {
	ULONG  Size;
	ULONG  NumberOfDescriptorTables;
	ULONG  NumberOfRoutinesInTable[1];
	ULONG  CallCounts[ANYSIZE_ARRAY];
} SYSTEM_CALLS_INFORMATION, *PSYSTEM_CALLS_INFORMATION;

typedef struct _SYSTEM_CONFIGURATION_INFORMATION {
	ULONG  DiskCount;
	ULONG  FloppyCount;
	ULONG  CdRomCount;
	ULONG  TapeCount;
	ULONG  SerialCount;
	ULONG  ParallelCount;
} SYSTEM_CONFIGURATION_INFORMATION, *PSYSTEM_CONFIGURATION_INFORMATION;

typedef struct _SYSTEM_PROCESSOR_TIMES {
	LARGE_INTEGER  IdleTime;
	LARGE_INTEGER  KernelTime;
	LARGE_INTEGER  UserTime;
	LARGE_INTEGER  DpcTime;
	LARGE_INTEGER  InterruptTime;
	ULONG  InterruptCount;
} SYSTEM_PROCESSOR_TIMES, *PSYSTEM_PROCESSOR_TIMES;

/* SYSTEM_GLOBAL_FLAG.GlobalFlag constants */
#define FLG_STOP_ON_EXCEPTION             0x00000001
#define FLG_SHOW_LDR_SNAPS                0x00000002
#define FLG_DEBUG_INITIAL_COMMAND         0x00000004
#define FLG_STOP_ON_HUNG_GUI              0x00000008
#define FLG_HEAP_ENABLE_TAIL_CHECK        0x00000010
#define FLG_HEAP_ENABLE_FREE_CHECK        0x00000020
#define FLG_HEAP_VALIDATE_PARAMETERS      0x00000040
#define FLG_HEAP_VALIDATE_ALL             0x00000080
#define FLG_POOL_ENABLE_TAIL_CHECK        0x00000100
#define FLG_POOL_ENABLE_FREE_CHECK        0x00000200
#define FLG_POOL_ENABLE_TAGGING           0x00000400
#define FLG_HEAP_ENABLE_TAGGING           0x00000800
#define FLG_USER_STACK_TRACE_DB           0x00001000
#define FLG_KERNEL_STACK_TRACE_DB         0x00002000
#define FLG_MAINTAIN_OBJECT_TYPELIST      0x00004000
#define FLG_HEAP_ENABLE_TAG_BY_DLL        0x00008000
#define FLG_IGNORE_DEBUG_PRIV             0x00010000
#define FLG_ENABLE_CSRDEBUG               0x00020000
#define FLG_ENABLE_KDEBUG_SYMBOL_LOAD     0x00040000
#define FLG_DISABLE_PAGE_KERNEL_STACKS    0x00080000
#define FLG_HEAP_ENABLE_CALL_TRACING      0x00100000
#define FLG_HEAP_DISABLE_COALESCING       0x00200000
#define FLG_ENABLE_CLOSE_EXCEPTIONS       0x00400000
#define FLG_ENABLE_EXCEPTION_LOGGING      0x00800000
#define FLG_ENABLE_DBGPRINT_BUFFERING     0x08000000

typedef struct _SYSTEM_GLOBAL_FLAG {
  ULONG  GlobalFlag;
} SYSTEM_GLOBAL_FLAG, *PSYSTEM_GLOBAL_FLAG;

typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY {
	ULONG	 Unknown1;
	ULONG	 Unknown2;
	PVOID  Base;
	ULONG  Size;
	ULONG  Flags;
	USHORT  Index;
  /* Length of module name not including the path, this
     field contains valid value only for NTOSKRNL module */
	USHORT	NameLength;
	USHORT  LoadCount;
	USHORT  PathLength;
	CHAR  ImageName[256];
} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;

typedef struct _SYSTEM_MODULE_INFORMATION {
	ULONG  Count;
  SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

typedef struct _SYSTEM_LOCK_INFORMATION {
	PVOID  Address;
	USHORT  Type;
	USHORT  Reserved1;
	ULONG  ExclusiveOwnerThreadId;
	ULONG  ActiveCount;
	ULONG  ContentionCount;
	ULONG  Reserved2[2];
	ULONG  NumberOfSharedWaiters;
	ULONG  NumberOfExclusiveWaiters;
} SYSTEM_LOCK_INFORMATION, *PSYSTEM_LOCK_INFORMATION;

/*SYSTEM_HANDLE_INFORMATION.Flags cosntants */
#define PROTECT_FROM_CLOSE                0x01
#define INHERIT                           0x02

typedef struct _SYSTEM_HANDLE_INFORMATION {
	ULONG  ProcessId;
	UCHAR  ObjectTypeNumber;
	UCHAR  Flags;
	USHORT  Handle;
	PVOID  Object;
	ACCESS_MASK  GrantedAccess;
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

typedef struct _SYSTEM_OBJECT_TYPE_INFORMATION {
	ULONG  NextEntryOffset;
	ULONG  ObjectCount;
	ULONG  HandleCount;
	ULONG  TypeNumber;
	ULONG  InvalidAttributes;
	GENERIC_MAPPING  GenericMapping;
	ACCESS_MASK  ValidAccessMask;
	POOL_TYPE  PoolType;
	UCHAR  Unknown;
	UNICODE_STRING  Name;
} SYSTEM_OBJECT_TYPE_INFORMATION, *PSYSTEM_OBJECT_TYPE_INFORMATION;

/* SYSTEM_OBJECT_INFORMATION.Flags constants */
#define FLG_SYSOBJINFO_SINGLE_HANDLE_ENTRY    0x40
#define FLG_SYSOBJINFO_DEFAULT_SECURITY_QUOTA 0x20
#define FLG_SYSOBJINFO_PERMANENT              0x10
#define FLG_SYSOBJINFO_EXCLUSIVE              0x08
#define FLG_SYSOBJINFO_CREATOR_INFO           0x04
#define FLG_SYSOBJINFO_KERNEL_MODE            0x02

typedef struct _SYSTEM_OBJECT_INFORMATION {
	ULONG  NextEntryOffset;
	PVOID  Object;
	ULONG  CreatorProcessId;
	USHORT  Unknown;
	USHORT  Flags;
	ULONG  PointerCount;
	ULONG  HandleCount;
	ULONG  PagedPoolUsage;
	ULONG  NonPagedPoolUsage;
	ULONG  ExclusiveProcessId;
	PSECURITY_DESCRIPTOR  SecurityDescriptor;
	UNICODE_STRING  Name;
} SYSTEM_OBJECT_INFORMATION, *PSYSTEM_OBJECT_INFORMATION;

typedef struct _SYSTEM_PAGEFILE_INFORMATION {
	ULONG  NextEntryOffset;
	ULONG  CurrentSize;
	ULONG  TotalUsed;
	ULONG  PeakUsed;
	UNICODE_STRING  FileName;
} SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION;

typedef struct _SYSTEM_INSTRUCTION_EMULATION_INFORMATION {
	ULONG  SegmentNotPresent;
	ULONG  TwoByteOpcode;
	ULONG  ESprefix;
	ULONG  CSprefix;
	ULONG  SSprefix;
	ULONG  DSprefix;
	ULONG  FSPrefix;
	ULONG  GSprefix;
	ULONG  OPER32prefix;
	ULONG  ADDR32prefix;
	ULONG  INSB;
	ULONG  INSW;
	ULONG  OUTSB;
	ULONG  OUTSW;
	ULONG  PUSHFD;
	ULONG  POPFD;
	ULONG  INTnn;
	ULONG  INTO;
	ULONG  IRETD;
	ULONG  INBimm;
	ULONG  INWimm;
	ULONG  OUTBimm;
	ULONG  OUTWimm;
	ULONG  INB;
	ULONG  INW;
	ULONG  OUTB;
	ULONG  OUTW;
	ULONG  LOCKprefix;
	ULONG  REPNEprefix;
	ULONG  REPprefix;
	ULONG  HLT;
	ULONG  CLI;
	ULONG  STI;
	ULONG  GenericInvalidOpcode;
} SYSTEM_INSTRUCTION_EMULATION_INFORMATION, *PSYSTEM_INSTRUCTION_EMULATION_INFORMATION;

typedef struct _SYSTEM_POOL_TAG_INFORMATION {
	CHAR  Tag[4];
	ULONG  PagedPoolAllocs;
	ULONG  PagedPoolFrees;
	ULONG  PagedPoolUsage;
	ULONG  NonPagedPoolAllocs;
	ULONG  NonPagedPoolFrees;
	ULONG  NonPagedPoolUsage;
} SYSTEM_POOL_TAG_INFORMATION, *PSYSTEM_POOL_TAG_INFORMATION;

typedef struct _SYSTEM_PROCESSOR_STATISTICS {
	ULONG  ContextSwitches;
	ULONG  DpcCount;
	ULONG  DpcRequestRate;
	ULONG  TimeIncrement;
	ULONG  DpcBypassCount;
	ULONG  ApcBypassCount;
} SYSTEM_PROCESSOR_STATISTICS, *PSYSTEM_PROCESSOR_STATISTICS;

typedef struct _SYSTEM_DPC_INFORMATION {
	ULONG  Reserved;
	ULONG  MaximumDpcQueueDepth;
	ULONG  MinimumDpcRate;
	ULONG  AdjustDpcThreshold;
	ULONG  IdealDpcRate;
} SYSTEM_DPC_INFORMATION, *PSYSTEM_DPC_INFORMATION;

typedef struct _SYSTEM_LOAD_IMAGE {
	UNICODE_STRING  ModuleName;
	PVOID  ModuleBase;
	PVOID  SectionPointer;
	PVOID  EntryPoint;
	PVOID  ExportDirectory;
} SYSTEM_LOAD_IMAGE, *PSYSTEM_LOAD_IMAGE;

typedef struct _SYSTEM_UNLOAD_IMAGE {
  PVOID  ModuleBase;
} SYSTEM_UNLOAD_IMAGE, *PSYSTEM_UNLOAD_IMAGE;

typedef struct _SYSTEM_QUERY_TIME_ADJUSTMENT {
	ULONG  TimeAdjustment;
	ULONG  MaximumIncrement;
	BOOLEAN  TimeSynchronization;
} SYSTEM_QUERY_TIME_ADJUSTMENT, *PSYSTEM_QUERY_TIME_ADJUSTMENT;

typedef struct _SYSTEM_SET_TIME_ADJUSTMENT {
	ULONG  TimeAdjustment;
	BOOLEAN  TimeSynchronization;
} SYSTEM_SET_TIME_ADJUSTMENT, *PSYSTEM_SET_TIME_ADJUSTMENT;

typedef struct _SYSTEM_CRASH_DUMP_INFORMATION {
	HANDLE  CrashDumpSectionHandle;
	HANDLE  Unknown;
} SYSTEM_CRASH_DUMP_INFORMATION, *PSYSTEM_CRASH_DUMP_INFORMATION;

typedef struct _SYSTEM_EXCEPTION_INFORMATION {
	ULONG  AlignmentFixupCount;
	ULONG  ExceptionDispatchCount;
	ULONG  FloatingEmulationCount;
	ULONG  Reserved;
} SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION;

typedef struct _SYSTEM_CRASH_DUMP_STATE_INFORMATION {
	ULONG  CrashDumpSectionExists;
	ULONG  Unknown;
} SYSTEM_CRASH_DUMP_STATE_INFORMATION, *PSYSTEM_CRASH_DUMP_STATE_INFORMATION;

typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION {
	BOOLEAN  DebuggerEnabled;
	BOOLEAN  DebuggerNotPresent;
} SYSTEM_KERNEL_DEBUGGER_INFORMATION, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION;

typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION {
	ULONG  ContextSwitches;
	ULONG  ContextSwitchCounters[11];
} SYSTEM_CONTEXT_SWITCH_INFORMATION, *PSYSTEM_CONTEXT_SWITCH_INFORMATION;

typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION {
	ULONG  RegistryQuota;
	ULONG  RegistryQuotaInUse;
	ULONG  PagedPoolSize;
} SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION;

typedef struct _SYSTEM_LOAD_AND_CALL_IMAGE {
  UNICODE_STRING  ModuleName;
} SYSTEM_LOAD_AND_CALL_IMAGE, *PSYSTEM_LOAD_AND_CALL_IMAGE;

typedef struct _SYSTEM_PRIORITY_SEPARATION {
  ULONG  PrioritySeparation;
} SYSTEM_PRIORITY_SEPARATION, *PSYSTEM_PRIORITY_SEPARATION;

typedef struct _SYSTEM_TIME_ZONE_INFORMATION {
	LONG  Bias;
	WCHAR  StandardName[32];
	LARGE_INTEGER  StandardDate;
	LONG  StandardBias;
	WCHAR  DaylightName[32];
	LARGE_INTEGER  DaylightDate;
	LONG  DaylightBias;
} SYSTEM_TIME_ZONE_INFORMATION, *PSYSTEM_TIME_ZONE_INFORMATION;

typedef struct _SYSTEM_LOOKASIDE_INFORMATION {
	USHORT  Depth;
	USHORT  MaximumDepth;
	ULONG  TotalAllocates;
	ULONG  AllocateMisses;
	ULONG  TotalFrees;
	ULONG  FreeMisses;
	POOL_TYPE  Type;
	ULONG  Tag;
	ULONG  Size;
} SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION;

typedef struct _SYSTEM_SET_TIME_SLIP_EVENT {
  HANDLE  TimeSlipEvent;
} SYSTEM_SET_TIME_SLIP_EVENT, *PSYSTEM_SET_TIME_SLIP_EVENT;

typedef struct _SYSTEM_CREATE_SESSION {
  ULONG  SessionId;
} SYSTEM_CREATE_SESSION, *PSYSTEM_CREATE_SESSION;

typedef struct _SYSTEM_DELETE_SESSION {
  ULONG  SessionId;
} SYSTEM_DELETE_SESSION, *PSYSTEM_DELETE_SESSION;

typedef struct _SYSTEM_RANGE_START_INFORMATION {
  PVOID  SystemRangeStart;
} SYSTEM_RANGE_START_INFORMATION, *PSYSTEM_RANGE_START_INFORMATION;

typedef struct _SYSTEM_SESSION_PROCESSES_INFORMATION {
	ULONG  SessionId;
	ULONG  BufferSize;
	PVOID  Buffer;
} SYSTEM_SESSION_PROCESSES_INFORMATION, *PSYSTEM_SESSION_PROCESSES_INFORMATION;

typedef struct _SYSTEM_POOL_BLOCK {
	BOOLEAN  Allocated;
	USHORT  Unknown;
	ULONG  Size;
	CHAR  Tag[4];
} SYSTEM_POOL_BLOCK, *PSYSTEM_POOL_BLOCK;

typedef struct _SYSTEM_POOL_BLOCKS_INFORMATION {
	ULONG  PoolSize;
	PVOID  PoolBase;
	USHORT  Unknown;
	ULONG  NumberOfBlocks;
	SYSTEM_POOL_BLOCK  PoolBlocks[1];
} SYSTEM_POOL_BLOCKS_INFORMATION, *PSYSTEM_POOL_BLOCKS_INFORMATION;

typedef struct _SYSTEM_MEMORY_USAGE {
	PVOID  Name;
	USHORT  Valid;
	USHORT  Standby;
	USHORT  Modified;
	USHORT  PageTables;
} SYSTEM_MEMORY_USAGE, *PSYSTEM_MEMORY_USAGE;

typedef struct _SYSTEM_MEMORY_USAGE_INFORMATION {
  	ULONG  Reserved;
	PVOID  EndOfData;
	SYSTEM_MEMORY_USAGE  MemoryUsage[1];
} SYSTEM_MEMORY_USAGE_INFORMATION, *PSYSTEM_MEMORY_USAGE_INFORMATION;

NTOSAPI
NTSTATUS
NTAPI
NtQuerySystemInformation(
  /*IN*/ SYSTEM_INFORMATION_CLASS  SystemInformationClass,
  /*IN OUT*/ PVOID  SystemInformation,
  /*IN*/ ULONG  SystemInformationLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwQuerySystemInformation(
  /*IN*/ SYSTEM_INFORMATION_CLASS  SystemInformationClass,
  /*IN OUT*/ PVOID  SystemInformation,
  /*IN*/ ULONG  SystemInformationLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

NTOSAPI
NTAPI
NTSTATUS
NtQueryFullAttributesFile(
  /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes,
  /*OUT*/ PFILE_NETWORK_OPEN_INFORMATION FileInformation);

NTOSAPI
NTAPI
NTSTATUS
ZwQueryFullAttributesFile(
  /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes,
  /*OUT*/ PFILE_NETWORK_OPEN_INFORMATION FileInformation);

NTOSAPI
NTSTATUS
NTAPI
ZwSetSystemInformation(
  /*IN*/ SYSTEM_INFORMATION_CLASS  SystemInformationClass,
  /*IN OUT*/ PVOID  SystemInformation,
  /*IN*/ ULONG  SystemInformationLength);

NTOSAPI
NTSTATUS
NTAPI
ZwQuerySystemEnvironmentValue(
  /*IN*/ PUNICODE_STRING  Name,
  /*OUT*/ PVOID  Value,
  /*IN*/ ULONG  ValueLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwSetSystemEnvironmentValue(
  /*IN*/ PUNICODE_STRING  Name,
  /*IN*/ PUNICODE_STRING  Value);

typedef enum _SHUTDOWN_ACTION {
	ShutdownNoReboot,
	ShutdownReboot,
	ShutdownPowerOff
} SHUTDOWN_ACTION;

NTOSAPI
NTSTATUS
NTAPI
NtShutdownSystem(
  /*IN*/ SHUTDOWN_ACTION  Action);

typedef enum _DEBUG_CONTROL_CODE {
  DebugGetTraceInformation = 1,
	DebugSetInternalBreakpoint,
	DebugSetSpecialCall,
	DebugClearSpecialCalls,
	DebugQuerySpecialCalls,
	DebugDbgBreakPoint,
	DebugMaximum
} DEBUG_CONTROL_CODE;


NTOSAPI
NTSTATUS
NTAPI
ZwSystemDebugControl(
  /*IN*/ DEBUG_CONTROL_CODE  ControlCode,
  /*IN*/ PVOID  InputBuffer  /*OPTIONAL*/,
  /*IN*/ ULONG  InputBufferLength,
  /*OUT*/ PVOID  OutputBuffer  /*OPTIONAL*/,
  /*IN*/ ULONG  OutputBufferLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);



/* Objects, Object directories, and symbolic links */

typedef enum _OBJECT_INFORMATION_CLASS {
	ObjectBasicInformation,
	ObjectNameInformation,
	ObjectTypeInformation,
	ObjectAllTypesInformation,
	ObjectHandleInformation
} OBJECT_INFORMATION_CLASS;

NTOSAPI
NTSTATUS
NTAPI
ZwQueryObject(
  /*IN*/ HANDLE  ObjectHandle,
  /*IN*/ OBJECT_INFORMATION_CLASS  ObjectInformationClass,
  /*OUT*/ PVOID  ObjectInformation,
  /*IN*/ ULONG  ObjectInformationLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwSetInformationObject(
  /*IN*/ HANDLE  ObjectHandle,
  /*IN*/ OBJECT_INFORMATION_CLASS  ObjectInformationClass,
  /*IN*/ PVOID  ObjectInformation,
  /*IN*/ ULONG  ObjectInformationLength);

/* OBJECT_BASIC_INFORMATION.Attributes constants */
/* also in winbase.h */
#define HANDLE_FLAG_INHERIT               0x01
#define HANDLE_FLAG_PROTECT_FROM_CLOSE    0x02
/* end winbase.h */
#define PERMANENT                         0x10
#define EXCLUSIVE                         0x20

typedef struct _OBJECT_BASIC_INFORMATION {
	ULONG  Attributes;
	ACCESS_MASK  GrantedAccess;
	ULONG  HandleCount;
	ULONG  PointerCount;
	ULONG  PagedPoolUsage;
	ULONG  NonPagedPoolUsage;
	ULONG  Reserved[3];
	ULONG  NameInformationLength;
	ULONG  TypeInformationLength;
	ULONG  SecurityDescriptorLength;
	LARGE_INTEGER  CreateTime;
} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
#if 0
/* FIXME: Enable later */
typedef struct _OBJECT_TYPE_INFORMATION {
	UNICODE_STRING  Name;
	ULONG  ObjectCount;
	ULONG  HandleCount;
	ULONG  Reserved1[4];
	ULONG  PeakObjectCount;
	ULONG  PeakHandleCount;
	ULONG  Reserved2[4];
	ULONG  InvalidAttributes;
	GENERIC_MAPPING  GenericMapping;
	ULONG  ValidAccess;
	UCHAR  Unknown;
	BOOLEAN  MaintainHandleDatabase;
	POOL_TYPE  PoolType;
	ULONG  PagedPoolUsage;
	ULONG  NonPagedPoolUsage;
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;

typedef struct _OBJECT_ALL_TYPES_INFORMATION {
  ULONG  NumberOfTypes;
  OBJECT_TYPE_INFORMATION  TypeInformation;
} OBJECT_ALL_TYPES_INFORMATION, *POBJECT_ALL_TYPES_INFORMATION;
#endif
typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFORMATION {
  BOOLEAN  Inherit;
  BOOLEAN  ProtectFromClose;
} OBJECT_HANDLE_ATTRIBUTE_INFORMATION, *POBJECT_HANDLE_ATTRIBUTE_INFORMATION;

NTOSAPI
NTSTATUS
NTAPI
NtDuplicateObject(
  /*IN*/ HANDLE  SourceProcessHandle,
  /*IN*/ HANDLE  SourceHandle,
  /*IN*/ HANDLE  TargetProcessHandle,
  /*OUT*/ PHANDLE  TargetHandle  /*OPTIONAL*/,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ ULONG  Attributes,
  /*IN*/ ULONG  Options);

NTOSAPI
NTSTATUS
NTAPI
ZwDuplicateObject(
  /*IN*/ HANDLE  SourceProcessHandle,
  /*IN*/ HANDLE  SourceHandle,
  /*IN*/ HANDLE  TargetProcessHandle,
  /*OUT*/ PHANDLE  TargetHandle  /*OPTIONAL*/,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ ULONG  Attributes,
  /*IN*/ ULONG  Options);

NTOSAPI
NTSTATUS
NTAPI
NtQuerySecurityObject(
  /*IN*/ HANDLE Handle,
  /*IN*/ SECURITY_INFORMATION  SecurityInformation,
  /*OUT*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ ULONG  SecurityDescriptorLength,
  /*OUT*/ PULONG  ReturnLength);

NTOSAPI
NTSTATUS
NTAPI
ZwQuerySecurityObject(
  /*IN*/ HANDLE Handle,
  /*IN*/ SECURITY_INFORMATION  SecurityInformation,
  /*OUT*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ ULONG  SecurityDescriptorLength,
  /*OUT*/ PULONG  ReturnLength);

NTOSAPI
NTSTATUS
NTAPI
NtSetSecurityObject(
  /*IN*/ HANDLE  Handle,
  /*IN*/ SECURITY_INFORMATION  SecurityInformation,
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor);

NTOSAPI
NTSTATUS
NTAPI
ZwSetSecurityObject(
  /*IN*/ HANDLE  Handle,
  /*IN*/ SECURITY_INFORMATION  SecurityInformation,
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor);

NTOSAPI
NTSTATUS
NTAPI
ZwOpenDirectoryObject(
  /*OUT*/ PHANDLE  DirectoryHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryDirectoryObject(
  /*IN*/ HANDLE  DirectoryHandle,
  /*OUT*/ PVOID  Buffer,
  /*IN*/ ULONG  BufferLength,
  /*IN*/ BOOLEAN  ReturnSingleEntry,
  /*IN*/ BOOLEAN  RestartScan,
  /*IN OUT*/ PULONG  Context,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

typedef struct _DIRECTORY_BASIC_INFORMATION {
  UNICODE_STRING  ObjectName;
  UNICODE_STRING  ObjectTypeName;
} DIRECTORY_BASIC_INFORMATION, *PDIRECTORY_BASIC_INFORMATION;

NTOSAPI
NTSTATUS
NTAPI
ZwCreateSymbolicLinkObject(
  /*OUT*/ PHANDLE  SymbolicLinkHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes,
  /*IN*/ PUNICODE_STRING  TargetName);




/* Virtual memory */

typedef enum _MEMORY_INFORMATION_CLASS {
MemoryBasicInformation,
MemoryWorkingSetList,
MemorySectionName,
MemoryBasicVlmInformation
} MEMORY_INFORMATION_CLASS;

NTOSAPI
NTSTATUS
NTAPI
NtAllocateVirtualMemory(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN OUT*/ PVOID  *BaseAddress,
  /*IN*/ ULONG  ZeroBits,
  /*IN OUT*/ PULONG  AllocationSize,
  /*IN*/ ULONG  AllocationType,
  /*IN*/ ULONG  Protect);

NTOSAPI
NTSTATUS
NTAPI
ZwAllocateVirtualMemory(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN OUT*/ PVOID  *BaseAddress,
  /*IN*/ ULONG  ZeroBits,
  /*IN OUT*/ PULONG  AllocationSize,
  /*IN*/ ULONG  AllocationType,
  /*IN*/ ULONG  Protect);

NTOSAPI
NTSTATUS
NTAPI
NtFreeVirtualMemory(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN OUT*/ PVOID  *BaseAddress,
  /*IN OUT*/ PULONG  FreeSize,
  /*IN*/ ULONG  FreeType);

NTOSAPI
NTSTATUS
NTAPI
ZwFreeVirtualMemory(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN OUT*/ PVOID  *BaseAddress,
  /*IN OUT*/ PULONG  FreeSize,
  /*IN*/ ULONG  FreeType);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryVirtualMemory(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN*/ PVOID  BaseAddress,
  /*IN*/ MEMORY_INFORMATION_CLASS  MemoryInformationClass,
  /*OUT*/ PVOID  MemoryInformation,
  /*IN*/ ULONG  MemoryInformationLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

/* MEMORY_WORKING_SET_LIST.WorkingSetList constants */
#define WSLE_PAGE_READONLY                0x001
#define WSLE_PAGE_EXECUTE                 0x002
#define WSLE_PAGE_READWRITE               0x004
#define WSLE_PAGE_EXECUTE_READ            0x003
#define WSLE_PAGE_WRITECOPY               0x005
#define WSLE_PAGE_EXECUTE_READWRITE       0x006
#define WSLE_PAGE_EXECUTE_WRITECOPY       0x007
#define WSLE_PAGE_SHARE_COUNT_MASK        0x0E0
#define WSLE_PAGE_SHAREABLE               0x100

typedef struct _MEMORY_WORKING_SET_LIST {
  ULONG  NumberOfPages;
  ULONG  WorkingSetList[1];
} MEMORY_WORKING_SET_LIST, *PMEMORY_WORKING_SET_LIST;

typedef struct _MEMORY_SECTION_NAME {
  UNICODE_STRING  SectionFileName;
} MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME;

/* Zw[Lock|Unlock]VirtualMemory.LockType constants */
#define LOCK_VM_IN_WSL                    0x01
#define LOCK_VM_IN_RAM                    0x02

NTOSAPI
NTSTATUS
NTAPI
ZwLockVirtualMemory(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN OUT*/ PVOID  *BaseAddress,
  /*IN OUT*/ PULONG  LockSize,
  /*IN*/ ULONG  LockType);

NTOSAPI
NTSTATUS
NTAPI
ZwUnlockVirtualMemory(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN OUT*/ PVOID  *BaseAddress,
  /*IN OUT*/ PULONG  LockSize,
  /*IN*/ ULONG  LockType);

NTOSAPI
NTSTATUS
NTAPI
ZwReadVirtualMemory(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN*/ PVOID  BaseAddress,
  /*OUT*/ PVOID  Buffer,
  /*IN*/ ULONG  BufferLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwWriteVirtualMemory(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN*/ PVOID  BaseAddress,
  /*IN*/ PVOID  Buffer,
  /*IN*/ ULONG  BufferLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwProtectVirtualMemory(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN OUT*/ PVOID  *BaseAddress,
  /*IN OUT*/ PULONG  ProtectSize,
  /*IN*/ ULONG  NewProtect,
  /*OUT*/ PULONG  OldProtect);

NTOSAPI
NTSTATUS
NTAPI
ZwFlushVirtualMemory(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN OUT*/ PVOID  *BaseAddress,
  /*IN OUT*/ PULONG  FlushSize,
  /*OUT*/ PIO_STATUS_BLOCK  IoStatusBlock);

NTOSAPI
NTSTATUS
NTAPI
ZwAllocateUserPhysicalPages(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN*/ PULONG  NumberOfPages,
  /*OUT*/ PULONG  PageFrameNumbers);

NTOSAPI
NTSTATUS
NTAPI
ZwFreeUserPhysicalPages(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN OUT*/ PULONG  NumberOfPages,
  /*IN*/ PULONG  PageFrameNumbers);

NTOSAPI
NTSTATUS
NTAPI
ZwMapUserPhysicalPages(
  /*IN*/ PVOID  BaseAddress,
  /*IN*/ PULONG  NumberOfPages,
  /*IN*/ PULONG  PageFrameNumbers);

NTOSAPI
NTSTATUS
NTAPI
ZwMapUserPhysicalPagesScatter(
  /*IN*/ PVOID  *BaseAddresses,
  /*IN*/ PULONG  NumberOfPages,
  /*IN*/ PULONG  PageFrameNumbers);

NTOSAPI
NTSTATUS
NTAPI
ZwGetWriteWatch(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN*/ ULONG  Flags,
  /*IN*/ PVOID  BaseAddress,
  /*IN*/ ULONG  RegionSize,
  /*OUT*/ PULONG  Buffer,
  /*IN OUT*/ PULONG  BufferEntries,
  /*OUT*/ PULONG  Granularity);

NTOSAPI
NTSTATUS
NTAPI
ZwResetWriteWatch(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN*/ PVOID  BaseAddress,
  /*IN*/ ULONG  RegionSize);




/* Sections */

typedef enum _SECTION_INFORMATION_CLASS {
  SectionBasicInformation,
  SectionImageInformation
} SECTION_INFORMATION_CLASS;

NTOSAPI
NTSTATUS
NTAPI
NtCreateSection(
  /*OUT*/ PHANDLE  SectionHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes,
  /*IN*/ PLARGE_INTEGER  SectionSize  /*OPTIONAL*/,
  /*IN*/ ULONG  Protect,
  /*IN*/ ULONG  Attributes,
  /*IN*/ HANDLE  FileHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwCreateSection(
  /*OUT*/ PHANDLE  SectionHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes,
  /*IN*/ PLARGE_INTEGER  SectionSize  /*OPTIONAL*/,
  /*IN*/ ULONG  Protect,
  /*IN*/ ULONG  Attributes,
  /*IN*/ HANDLE  FileHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwQuerySection(
  /*IN*/ HANDLE  SectionHandle,
  /*IN*/ SECTION_INFORMATION_CLASS  SectionInformationClass,
  /*OUT*/ PVOID  SectionInformation,
  /*IN*/ ULONG  SectionInformationLength,
  /*OUT*/ PULONG  ResultLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwExtendSection(
  /*IN*/ HANDLE  SectionHandle,
  /*IN*/ PLARGE_INTEGER  SectionSize);

NTOSAPI
NTSTATUS
NTAPI
ZwAreMappedFilesTheSame(
  /*IN*/ PVOID  Address1,
  /*IN*/ PVOID  Address2);




/* Threads */

typedef struct _USER_STACK {
	PVOID  FixedStackBase;
	PVOID  FixedStackLimit;
	PVOID  ExpandableStackBase;
	PVOID  ExpandableStackLimit;
	PVOID  ExpandableStackBottom;
} USER_STACK, *PUSER_STACK;

NTOSAPI
NTSTATUS
NTAPI
ZwCreateThread(
  /*OUT*/ PHANDLE  ThreadHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes,
  /*IN*/ HANDLE  ProcessHandle,
  /*OUT*/ PCLIENT_ID  ClientId,
  /*IN*/ PCONTEXT  ThreadContext,
  /*IN*/ PUSER_STACK  UserStack,
  /*IN*/ BOOLEAN  CreateSuspended);

NTOSAPI
NTSTATUS
NTAPI
NtOpenThread(
  /*OUT*/ PHANDLE  ThreadHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes,
  /*IN*/ PCLIENT_ID  ClientId);

NTOSAPI
NTSTATUS
NTAPI
ZwOpenThread(
  /*OUT*/ PHANDLE  ThreadHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes,
  /*IN*/ PCLIENT_ID  ClientId);

NTOSAPI
NTSTATUS
NTAPI
ZwTerminateThread(
  /*IN*/ HANDLE  ThreadHandle  /*OPTIONAL*/,
  /*IN*/ NTSTATUS  ExitStatus);

NTOSAPI
NTSTATUS
NTAPI
NtQueryInformationThread(
  /*IN*/ HANDLE  ThreadHandle,
  /*IN*/ THREADINFOCLASS  ThreadInformationClass,
  /*OUT*/ PVOID  ThreadInformation,
  /*IN*/ ULONG  ThreadInformationLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryInformationThread(
  /*IN*/ HANDLE  ThreadHandle,
  /*IN*/ THREADINFOCLASS  ThreadInformationClass,
  /*OUT*/ PVOID  ThreadInformation,
  /*IN*/ ULONG  ThreadInformationLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
NtSetInformationThread(
  /*IN*/ HANDLE  ThreadHandle,
  /*IN*/ THREADINFOCLASS  ThreadInformationClass,
  /*IN*/ PVOID  ThreadInformation,
  /*IN*/ ULONG  ThreadInformationLength);

typedef struct _THREAD_BASIC_INFORMATION {
	NTSTATUS  ExitStatus;
	PNT_TIB  TebBaseAddress;
	CLIENT_ID  ClientId;
	KAFFINITY  AffinityMask;
	KPRIORITY  Priority;
	KPRIORITY  BasePriority;
} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;

typedef struct _KERNEL_USER_TIMES {
	LARGE_INTEGER  CreateTime;
	LARGE_INTEGER  ExitTime;
	LARGE_INTEGER  KernelTime;
	LARGE_INTEGER  UserTime;
} KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;

NTOSAPI
NTSTATUS
NTAPI
ZwSuspendThread(
  /*IN*/ HANDLE  ThreadHandle,
  /*OUT*/ PULONG  PreviousSuspendCount  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwResumeThread(
  /*IN*/ HANDLE  ThreadHandle,
  /*OUT*/ PULONG  PreviousSuspendCount  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwGetContextThread(
  /*IN*/ HANDLE  ThreadHandle,
  /*OUT*/ PCONTEXT  Context);

NTOSAPI
NTSTATUS
NTAPI
ZwSetContextThread(
  /*IN*/ HANDLE  ThreadHandle,
  /*IN*/ PCONTEXT  Context);

NTOSAPI
NTSTATUS
NTAPI
ZwQueueApcThread(
  /*IN*/ HANDLE  ThreadHandle,
  /*IN*/ PKNORMAL_ROUTINE  ApcRoutine,
  /*IN*/ PVOID  ApcContext  /*OPTIONAL*/,
  /*IN*/ PVOID  Argument1  /*OPTIONAL*/,
  /*IN*/ PVOID  Argument2  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwTestAlert(
  VOID);

NTOSAPI
NTSTATUS
NTAPI
ZwAlertThread(
  /*IN*/ HANDLE  ThreadHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwAlertResumeThread(
  /*IN*/ HANDLE  ThreadHandle,
  /*OUT*/ PULONG  PreviousSuspendCount  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwRegisterThreadTerminatePort(
  /*IN*/ HANDLE  PortHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwImpersonateThread(
  /*IN*/ HANDLE  ThreadHandle,
  /*IN*/ HANDLE  TargetThreadHandle,
  /*IN*/ PSECURITY_QUALITY_OF_SERVICE  SecurityQos);

NTOSAPI
NTSTATUS
NTAPI
ZwImpersonateAnonymousToken(
  /*IN*/ HANDLE  ThreadHandle);




/* Processes */

NTOSAPI
NTSTATUS
NTAPI
ZwCreateProcess(
  /*OUT*/ PHANDLE  ProcessHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes,
  /*IN*/ HANDLE  InheritFromProcessHandle,
  /*IN*/ BOOLEAN  InheritHandles,
  /*IN*/ HANDLE  SectionHandle  /*OPTIONAL*/,
  /*IN*/ HANDLE  DebugPort  /*OPTIONAL*/,
  /*IN*/ HANDLE  ExceptionPort  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwCreateProcess(
  /*OUT*/ PHANDLE  ProcessHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes,
  /*IN*/ HANDLE  InheritFromProcessHandle,
  /*IN*/ BOOLEAN  InheritHandles,
  /*IN*/ HANDLE  SectionHandle  /*OPTIONAL*/,
  /*IN*/ HANDLE  DebugPort  /*OPTIONAL*/,
  /*IN*/ HANDLE  ExceptionPort  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwTerminateProcess(
  /*IN*/ HANDLE  ProcessHandle  /*OPTIONAL*/,
  /*IN*/ NTSTATUS  ExitStatus);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryInformationProcess(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN*/ PROCESSINFOCLASS  ProcessInformationClass,
  /*OUT*/ PVOID  ProcessInformation,
  /*IN*/ ULONG  ProcessInformationLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
NtSetInformationProcess(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN*/ PROCESSINFOCLASS  ProcessInformationClass,
  /*IN*/ PVOID  ProcessInformation,
  /*IN*/ ULONG  ProcessInformationLength);

NTOSAPI
NTSTATUS
NTAPI
ZwSetInformationProcess(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN*/ PROCESSINFOCLASS  ProcessInformationClass,
  /*IN*/ PVOID  ProcessInformation,
  /*IN*/ ULONG  ProcessInformationLength);

typedef struct _PROCESS_BASIC_INFORMATION {
	NTSTATUS  ExitStatus;
	PPEB  PebBaseAddress;
	KAFFINITY  AffinityMask;
	KPRIORITY  BasePriority;
	ULONG  UniqueProcessId;
	ULONG  InheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;

typedef struct _PROCESS_ACCESS_TOKEN {
  HANDLE  Token;
  HANDLE  Thread;
} PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;

/* DefaultHardErrorMode constants */
/* also in winbase.h */
#define SEM_FAILCRITICALERRORS            0x0001
#define SEM_NOGPFAULTERRORBOX             0x0002
#define SEM_NOALIGNMENTFAULTEXCEPT        0x0004
#define SEM_NOOPENFILEERRORBOX            0x8000
/* end winbase.h */
typedef struct _POOLED_USAGE_AND_LIMITS {
	ULONG  PeakPagedPoolUsage;
	ULONG  PagedPoolUsage;
	ULONG  PagedPoolLimit;
	ULONG  PeakNonPagedPoolUsage;
	ULONG  NonPagedPoolUsage;
	ULONG  NonPagedPoolLimit;
	ULONG  PeakPagefileUsage;
	ULONG  PagefileUsage;
	ULONG  PagefileLimit;
} POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS;

typedef struct _PROCESS_WS_WATCH_INFORMATION {
  PVOID  FaultingPc;
  PVOID  FaultingVa;
} PROCESS_WS_WATCH_INFORMATION, *PPROCESS_WS_WATCH_INFORMATION;

/* PROCESS_PRIORITY_CLASS.PriorityClass constants */
#define PC_IDLE                           1
#define PC_NORMAL                         2
#define PC_HIGH                           3
#define PC_REALTIME                       4
#define PC_BELOW_NORMAL                   5
#define PC_ABOVE_NORMAL                   6

typedef struct _PROCESS_PRIORITY_CLASS {
  BOOLEAN  Foreground;
  UCHAR  PriorityClass;
} PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS;

/* PROCESS_DEVICEMAP_INFORMATION.DriveType constants */
#define DRIVE_UNKNOWN                     0
#define DRIVE_NO_ROOT_DIR                 1
#define DRIVE_REMOVABLE                   2
#define DRIVE_FIXED                       3
#define DRIVE_REMOTE                      4
#define DRIVE_CDROM                       5
#define DRIVE_RAMDISK                     6

typedef struct _PROCESS_DEVICEMAP_INFORMATION {
	_ANONYMOUS_UNION union {
		struct {
		  HANDLE  DirectoryHandle;
		} Set;
		struct {
		  ULONG  DriveMap;
		  UCHAR  DriveType[32];
		} Query;
	} DUMMYUNIONNAME;
} PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION;

typedef struct _PROCESS_SESSION_INFORMATION {
  ULONG  SessionId;
} PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;

typedef struct _RTL_USER_PROCESS_PARAMETERS {
	ULONG  AllocationSize;
	ULONG  Size;
	ULONG  Flags;
	ULONG  DebugFlags;
	HANDLE  hConsole;
	ULONG  ProcessGroup;
	HANDLE  hStdInput;
	HANDLE  hStdOutput;
	HANDLE  hStdError;
	UNICODE_STRING  CurrentDirectoryName;
	HANDLE  CurrentDirectoryHandle;
	UNICODE_STRING  DllPath;
	UNICODE_STRING  ImagePathName;
	UNICODE_STRING  CommandLine;
	PWSTR  Environment;
	ULONG  dwX;
	ULONG  dwY;
	ULONG  dwXSize;
	ULONG  dwYSize;
	ULONG  dwXCountChars;
	ULONG  dwYCountChars;
	ULONG  dwFillAttribute;
	ULONG  dwFlags;
	ULONG  wShowWindow;
	UNICODE_STRING  WindowTitle;
	UNICODE_STRING  DesktopInfo;
	UNICODE_STRING  ShellInfo;
	UNICODE_STRING  RuntimeInfo;
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;

NTSTATUS
NTAPI
RtlCreateProcessParameters(
  /*OUT*/ PRTL_USER_PROCESS_PARAMETERS  *ProcessParameters,
  /*IN*/ PUNICODE_STRING  ImageFile,
  /*IN*/ PUNICODE_STRING  DllPath  /*OPTIONAL*/,
  /*IN*/ PUNICODE_STRING  CurrentDirectory  /*OPTIONAL*/,
  /*IN*/ PUNICODE_STRING  CommandLine  /*OPTIONAL*/,
  /*IN*/ PWSTR  Environment /*OPTIONAL*/,
  /*IN*/ PUNICODE_STRING  WindowTitle  /*OPTIONAL*/,
  /*IN*/ PUNICODE_STRING  DesktopInfo  /*OPTIONAL*/,
  /*IN*/ PUNICODE_STRING  ShellInfo  /*OPTIONAL*/,
  /*IN*/ PUNICODE_STRING  RuntimeInfo  /*OPTIONAL*/);

NTSTATUS
NTAPI
RtlDestroyProcessParameters(
  /*IN*/ PRTL_USER_PROCESS_PARAMETERS  ProcessParameters);

typedef struct _DEBUG_BUFFER {
	HANDLE  SectionHandle;
	PVOID  SectionBase;
	PVOID  RemoteSectionBase;
	ULONG  SectionBaseDelta;
	HANDLE  EventPairHandle;
	ULONG  Unknown[2];
	HANDLE  RemoteThreadHandle;
	ULONG  InfoClassMask;
	ULONG  SizeOfInfo;
	ULONG  AllocatedSize;
	ULONG  SectionSize;
	PVOID  ModuleInformation;
	PVOID  BackTraceInformation;
	PVOID  HeapInformation;
	PVOID  LockInformation;
	PVOID  Reserved[8];
} DEBUG_BUFFER, *PDEBUG_BUFFER;

PDEBUG_BUFFER
NTAPI
RtlCreateQueryDebugBuffer(
  /*IN*/ ULONG  Size,
  /*IN*/ BOOLEAN  EventPair);

/* RtlQueryProcessDebugInformation.DebugInfoClassMask constants */
#define PDI_MODULES                       0x01
#define PDI_BACKTRACE                     0x02
#define PDI_HEAPS                         0x04
#define PDI_HEAP_TAGS                     0x08
#define PDI_HEAP_BLOCKS                   0x10
#define PDI_LOCKS                         0x20

NTSTATUS
NTAPI
RtlQueryProcessDebugInformation(
  /*IN*/ ULONG  ProcessId,
  /*IN*/ ULONG  DebugInfoClassMask,
  /*IN OUT*/ PDEBUG_BUFFER  DebugBuffer);

NTSTATUS
NTAPI
RtlDestroyQueryDebugBuffer(
  /*IN*/ PDEBUG_BUFFER  DebugBuffer);

/* DEBUG_MODULE_INFORMATION.Flags constants */
#define LDRP_STATIC_LINK                  0x00000002
#define LDRP_IMAGE_DLL                    0x00000004
#define LDRP_LOAD_IN_PROGRESS             0x00001000
#define LDRP_UNLOAD_IN_PROGRESS           0x00002000
#define LDRP_ENTRY_PROCESSED              0x00004000
#define LDRP_ENTRY_INSERTED               0x00008000
#define LDRP_CURRENT_LOAD                 0x00010000
#define LDRP_FAILED_BUILTIN_LOAD          0x00020000
#define LDRP_DONT_CALL_FOR_THREADS        0x00040000
#define LDRP_PROCESS_ATTACH_CALLED        0x00080000
#define LDRP_DEBUG_SYMBOLS_LOADED         0x00100000
#define LDRP_IMAGE_NOT_AT_BASE            0x00200000
#define LDRP_WX86_IGNORE_MACHINETYPE      0x00400000

typedef struct _DEBUG_MODULE_INFORMATION {
	ULONG  Reserved[2];
	ULONG  Base;
	ULONG  Size;
	ULONG  Flags;
	USHORT  Index;
	USHORT  Unknown;
	USHORT  LoadCount;
	USHORT  ModuleNameOffset;
	CHAR  ImageName[256];
} DEBUG_MODULE_INFORMATION, *PDEBUG_MODULE_INFORMATION;

typedef struct _DEBUG_HEAP_INFORMATION {
	ULONG  Base;
	ULONG  Flags;
	USHORT  Granularity;
	USHORT  Unknown;
	ULONG  Allocated;
	ULONG  Committed;
	ULONG  TagCount;
	ULONG  BlockCount;
	ULONG  Reserved[7];
	PVOID  Tags;
	PVOID  Blocks;
} DEBUG_HEAP_INFORMATION, *PDEBUG_HEAP_INFORMATION;

typedef struct _DEBUG_LOCK_INFORMATION {
	PVOID  Address;
	USHORT  Type;
	USHORT  CreatorBackTraceIndex;
	ULONG  OwnerThreadId;
	ULONG  ActiveCount;
	ULONG  ContentionCount;
	ULONG  EntryCount;
	ULONG  RecursionCount;
	ULONG  NumberOfSharedWaiters;
	ULONG  NumberOfExclusiveWaiters;
} DEBUG_LOCK_INFORMATION, *PDEBUG_LOCK_INFORMATION;



/* Jobs */

NTOSAPI
NTSTATUS
NTAPI
ZwCreateJobObject(
  /*OUT*/ PHANDLE  JobHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes);

NTOSAPI
NTSTATUS
NTAPI
ZwOpenJobObject(
  /*OUT*/ PHANDLE  JobHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes);

NTOSAPI
NTSTATUS
NTAPI
ZwTerminateJobObject(
  /*IN*/ HANDLE  JobHandle,
  /*IN*/ NTSTATUS  ExitStatus);

NTOSAPI
NTSTATUS
NTAPI
ZwAssignProcessToJobObject(
  /*IN*/ HANDLE  JobHandle,
  /*IN*/ HANDLE  ProcessHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryInformationJobObject(
  /*IN*/ HANDLE  JobHandle,
  /*IN*/ JOBOBJECTINFOCLASS  JobInformationClass,
  /*OUT*/ PVOID  JobInformation,
  /*IN*/ ULONG  JobInformationLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwSetInformationJobObject(
  /*IN*/ HANDLE  JobHandle,
  /*IN*/ JOBOBJECTINFOCLASS  JobInformationClass,
  /*IN*/ PVOID  JobInformation,
  /*IN*/ ULONG  JobInformationLength);


/* Tokens */

NTOSAPI
NTSTATUS
NTAPI
ZwCreateToken(
  /*OUT*/ PHANDLE TokenHandle,
  /*IN*/ ACCESS_MASK DesiredAccess,
  /*IN*/ POBJECT_ATTRIBUTES ObjectAttributes,
  /*IN*/ TOKEN_TYPE Type,
  /*IN*/ PLUID AuthenticationId,
  /*IN*/ PLARGE_INTEGER ExpirationTime,
  /*IN*/ PTOKEN_USER User,
  /*IN*/ PTOKEN_GROUPS Groups,
  /*IN*/ PTOKEN_PRIVILEGES Privileges,
  /*IN*/ PTOKEN_OWNER Owner,
  /*IN*/ PTOKEN_PRIMARY_GROUP PrimaryGroup,
  /*IN*/ PTOKEN_DEFAULT_DACL DefaultDacl,
  /*IN*/ PTOKEN_SOURCE Source
);

NTOSAPI
NTSTATUS
NTAPI
NtOpenProcessToken(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*OUT*/ PHANDLE  TokenHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwOpenProcessToken(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*OUT*/ PHANDLE  TokenHandle);

NTOSAPI
NTSTATUS
NTAPI
NtOpenThreadToken(
  /*IN*/ HANDLE  ThreadHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ BOOLEAN  OpenAsSelf,
  /*OUT*/ PHANDLE  TokenHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwOpenThreadToken(
  /*IN*/ HANDLE  ThreadHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ BOOLEAN  OpenAsSelf,
  /*OUT*/ PHANDLE  TokenHandle);

NTOSAPI
NTSTATUS
NTAPI
NtDuplicateToken(
  /*IN*/ HANDLE  ExistingTokenHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes,
  /*IN*/ BOOLEAN  EffectiveOnly,
  /*IN*/ TOKEN_TYPE  TokenType,
  /*OUT*/ PHANDLE  NewTokenHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwDuplicateToken(
  /*IN*/ HANDLE  ExistingTokenHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes,
  /*IN*/ BOOLEAN  EffectiveOnly,
  /*IN*/ TOKEN_TYPE  TokenType,
  /*OUT*/ PHANDLE  NewTokenHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwFilterToken(
  /*IN*/ HANDLE  ExistingTokenHandle,
  /*IN*/ ULONG  Flags,
  /*IN*/ PTOKEN_GROUPS  SidsToDisable,
  /*IN*/ PTOKEN_PRIVILEGES  PrivilegesToDelete,
  /*IN*/ PTOKEN_GROUPS  SidsToRestricted,
  /*OUT*/ PHANDLE  NewTokenHandle);

NTOSAPI
NTSTATUS
NTAPI
NtAdjustPrivilegesToken(
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ BOOLEAN  DisableAllPrivileges,
  /*IN*/ PTOKEN_PRIVILEGES  NewState,
  /*IN*/ ULONG  BufferLength,
  /*OUT*/ PTOKEN_PRIVILEGES  PreviousState  /*OPTIONAL*/,
  /*OUT*/ PULONG  ReturnLength);

NTOSAPI
NTSTATUS
NTAPI
ZwAdjustPrivilegesToken(
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ BOOLEAN  DisableAllPrivileges,
  /*IN*/ PTOKEN_PRIVILEGES  NewState,
  /*IN*/ ULONG  BufferLength,
  /*OUT*/ PTOKEN_PRIVILEGES  PreviousState  /*OPTIONAL*/,
  /*OUT*/ PULONG  ReturnLength);

NTOSAPI
NTSTATUS
NTAPI
ZwAdjustGroupsToken(
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ BOOLEAN  ResetToDefault,
  /*IN*/ PTOKEN_GROUPS  NewState,
  /*IN*/ ULONG  BufferLength,
  /*OUT*/ PTOKEN_GROUPS  PreviousState  /*OPTIONAL*/,
  /*OUT*/ PULONG  ReturnLength);

NTOSAPI
NTSTATUS
NTAPI
NtQueryInformationToken(
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ TOKEN_INFORMATION_CLASS  TokenInformationClass,
  /*OUT*/ PVOID  TokenInformation,
  /*IN*/ ULONG  TokenInformationLength,
  /*OUT*/ PULONG  ReturnLength);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryInformationToken(
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ TOKEN_INFORMATION_CLASS  TokenInformationClass,
  /*OUT*/ PVOID  TokenInformation,
  /*IN*/ ULONG  TokenInformationLength,
  /*OUT*/ PULONG  ReturnLength);

NTOSAPI
NTSTATUS
NTAPI
ZwSetInformationToken(
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ TOKEN_INFORMATION_CLASS  TokenInformationClass,
  /*IN*/ PVOID  TokenInformation,
  /*IN*/ ULONG  TokenInformationLength);




/* Time */

NTOSAPI
NTSTATUS
NTAPI
ZwQuerySystemTime(
  /*OUT*/ PLARGE_INTEGER  CurrentTime);

NTOSAPI
NTSTATUS
NTAPI
ZwSetSystemTime(
  /*IN*/ PLARGE_INTEGER  NewTime,
  /*OUT*/ PLARGE_INTEGER  OldTime  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryPerformanceCounter(
  /*OUT*/ PLARGE_INTEGER  PerformanceCount,
  /*OUT*/ PLARGE_INTEGER  PerformanceFrequency  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryPerformanceCounter(
  /*OUT*/ PLARGE_INTEGER  PerformanceCount,
  /*OUT*/ PLARGE_INTEGER  PerformanceFrequency  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryTimerResolution(
  /*OUT*/ PULONG  CoarsestResolution,
  /*OUT*/ PULONG  FinestResolution,
  /*OUT*/ PULONG  ActualResolution);

NTOSAPI
NTSTATUS
NTAPI
ZwDelayExecution(
  /*IN*/ BOOLEAN  Alertable,
  /*IN*/ PLARGE_INTEGER  Interval);

NTOSAPI
NTSTATUS
NTAPI
ZwYieldExecution(
  VOID);

NTOSAPI
ULONG
NTAPI
ZwGetTickCount(
  VOID);




/* Execution profiling */

NTOSAPI
NTSTATUS
NTAPI
ZwCreateProfile(
  /*OUT*/ PHANDLE  ProfileHandle,
  /*IN*/ HANDLE  ProcessHandle,
  /*IN*/ PVOID  Base,
  /*IN*/ ULONG  Size,
  /*IN*/ ULONG  BucketShift,
  /*IN*/ PULONG  Buffer,
  /*IN*/ ULONG  BufferLength,
  /*IN*/ KPROFILE_SOURCE  Source,
  /*IN*/ ULONG  ProcessorMask);

NTOSAPI
NTSTATUS
NTAPI
ZwSetIntervalProfile(
  /*IN*/ ULONG  Interval,
  /*IN*/ KPROFILE_SOURCE  Source);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryIntervalProfile(
  /*IN*/ KPROFILE_SOURCE  Source,
  /*OUT*/ PULONG  Interval);

NTOSAPI
NTSTATUS
NTAPI
ZwStartProfile(
  /*IN*/ HANDLE  ProfileHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwStopProfile(
  /*IN*/ HANDLE  ProfileHandle);

/* Local Procedure Call (LPC) */

typedef struct _LPC_MESSAGE {
	USHORT  DataSize;
	USHORT  MessageSize;
	USHORT  MessageType;
	USHORT  VirtualRangesOffset;
	CLIENT_ID  ClientId;
	ULONG  MessageId;
	ULONG  SectionSize;
	UCHAR  Data[ANYSIZE_ARRAY];
} LPC_MESSAGE, *PLPC_MESSAGE;

#define LPC_MESSAGE_BASE_SIZE	24

typedef enum _LPC_TYPE {
	LPC_NEW_MESSAGE,
	LPC_REQUEST,
	LPC_REPLY,
	LPC_DATAGRAM,
	LPC_LOST_REPLY,
	LPC_PORT_CLOSED,
	LPC_CLIENT_DIED,
	LPC_EXCEPTION,
	LPC_DEBUG_EVENT,
	LPC_ERROR_EVENT,
	LPC_CONNECTION_REQUEST,
	LPC_CONNECTION_REFUSED,
  LPC_MAXIMUM
} LPC_TYPE;

typedef struct _LPC_SECTION_WRITE {
	ULONG  Length;
	HANDLE  SectionHandle;
	ULONG  SectionOffset;
	ULONG  ViewSize;
	PVOID  ViewBase;
	PVOID  TargetViewBase;
} LPC_SECTION_WRITE, *PLPC_SECTION_WRITE;

typedef struct _LPC_SECTION_READ {
	ULONG  Length;
	ULONG  ViewSize;
	PVOID  ViewBase;
} LPC_SECTION_READ, *PLPC_SECTION_READ;

NTOSAPI
NTSTATUS
NTAPI
ZwCreatePort(
  /*OUT*/ PHANDLE  PortHandle,
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes,
  /*IN*/ ULONG  MaxDataSize,
  /*IN*/ ULONG  MaxMessageSize,
  /*IN*/ ULONG  Reserved);

NTOSAPI
NTSTATUS
NTAPI
ZwCreateWaitablePort(
  /*OUT*/ PHANDLE  PortHandle,
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes,
  /*IN*/ ULONG  MaxDataSize,
  /*IN*/ ULONG  MaxMessageSize,
  /*IN*/ ULONG  Reserved);

NTOSAPI
NTSTATUS
NTAPI
NtConnectPort(
  /*OUT*/ PHANDLE  PortHandle,
  /*IN*/ PUNICODE_STRING  PortName,
  /*IN*/ PSECURITY_QUALITY_OF_SERVICE  SecurityQos,
  /*IN OUT*/ PLPC_SECTION_WRITE  WriteSection  /*OPTIONAL*/,
  /*IN OUT*/ PLPC_SECTION_READ  ReadSection  /*OPTIONAL*/,
  /*OUT*/ PULONG  MaxMessageSize  /*OPTIONAL*/,
  /*IN OUT*/ PVOID  ConnectData  /*OPTIONAL*/,
  /*IN OUT*/ PULONG  ConnectDataLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwConnectPort(
  /*OUT*/ PHANDLE  PortHandle,
  /*IN*/ PUNICODE_STRING  PortName,
  /*IN*/ PSECURITY_QUALITY_OF_SERVICE  SecurityQos,
  /*IN OUT*/ PLPC_SECTION_WRITE  WriteSection  /*OPTIONAL*/,
  /*IN OUT*/ PLPC_SECTION_READ  ReadSection  /*OPTIONAL*/,
  /*OUT*/ PULONG  MaxMessageSize  /*OPTIONAL*/,
  /*IN OUT*/ PVOID  ConnectData  /*OPTIONAL*/,
  /*IN OUT*/ PULONG  ConnectDataLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwConnectPort(
  /*OUT*/ PHANDLE  PortHandle,
  /*IN*/ PUNICODE_STRING  PortName,
  /*IN*/ PSECURITY_QUALITY_OF_SERVICE  SecurityQos,
  /*IN OUT*/ PLPC_SECTION_WRITE  WriteSection  /*OPTIONAL*/,
  /*IN OUT*/ PLPC_SECTION_READ  ReadSection  /*OPTIONAL*/,
  /*OUT*/ PULONG  MaxMessageSize  /*OPTIONAL*/,
  /*IN OUT*/ PVOID  ConnectData  /*OPTIONAL*/,
  /*IN OUT*/ PULONG  ConnectDataLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwListenPort(
  /*IN*/ HANDLE  PortHandle,
  /*OUT*/ PLPC_MESSAGE  Message);

NTOSAPI
NTSTATUS
NTAPI
ZwAcceptConnectPort(
  /*OUT*/ PHANDLE  PortHandle,
  /*IN*/ ULONG  PortIdentifier,
  /*IN*/ PLPC_MESSAGE  Message,
  /*IN*/ BOOLEAN  Accept,
  /*IN OUT*/ PLPC_SECTION_WRITE  WriteSection  /*OPTIONAL*/,
  /*IN OUT*/ PLPC_SECTION_READ  ReadSection  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwCompleteConnectPort(
  /*IN*/ HANDLE  PortHandle);

NTOSAPI
NTSTATUS
NTAPI
NtRequestPort(
  /*IN*/ HANDLE  PortHandle,
  /*IN*/ PLPC_MESSAGE  RequestMessage);

NTOSAPI
NTSTATUS
NTAPI
NtRequestWaitReplyPort(
  /*IN*/ HANDLE  PortHandle,
  /*IN*/ PLPC_MESSAGE  RequestMessage,
  /*OUT*/ PLPC_MESSAGE  ReplyMessage);

NTOSAPI
NTSTATUS
NTAPI
ZwRequestWaitReplyPort(
  /*IN*/ HANDLE  PortHandle,
  /*IN*/ PLPC_MESSAGE  RequestMessage,
  /*OUT*/ PLPC_MESSAGE  ReplyMessage);

NTOSAPI
NTSTATUS
NTAPI
ZwReplyPort(
  /*IN*/ HANDLE  PortHandle,
  /*IN*/ PLPC_MESSAGE  ReplyMessage);

NTOSAPI
NTSTATUS
NTAPI
ZwReplyWaitReplyPort(
  /*IN*/ HANDLE  PortHandle,
  /*IN OUT*/ PLPC_MESSAGE  ReplyMessage);

NTOSAPI
NTSTATUS
NTAPI
ZwReplyWaitReceivePort(
  /*IN*/ HANDLE  PortHandle,
  /*OUT*/ PULONG  PortIdentifier  /*OPTIONAL*/,
  /*IN*/ PLPC_MESSAGE  ReplyMessage  /*OPTIONAL*/,
  /*OUT*/ PLPC_MESSAGE  Message);

NTOSAPI
NTSTATUS
NTAPI
ZwReplyWaitReceivePortEx(
  /*IN*/ HANDLE  PortHandle,
  /*OUT*/ PULONG  PortIdentifier  /*OPTIONAL*/,
  /*IN*/ PLPC_MESSAGE  ReplyMessage  /*OPTIONAL*/,
  /*OUT*/ PLPC_MESSAGE  Message,
  /*IN*/ PLARGE_INTEGER  Timeout);

NTOSAPI
NTSTATUS
NTAPI
ZwReadRequestData(
  /*IN*/ HANDLE  PortHandle,
  /*IN*/ PLPC_MESSAGE  Message,
  /*IN*/ ULONG  Index,
  /*OUT*/ PVOID  Buffer,
  /*IN*/ ULONG  BufferLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwWriteRequestData(
  /*IN*/ HANDLE  PortHandle,
  /*IN*/ PLPC_MESSAGE  Message,
  /*IN*/ ULONG  Index,
  /*IN*/ PVOID  Buffer,
  /*IN*/ ULONG  BufferLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

typedef enum _PORT_INFORMATION_CLASS {
  PortBasicInformation
} PORT_INFORMATION_CLASS;

NTOSAPI
NTSTATUS
NTAPI
ZwQueryInformationPort(
  /*IN*/ HANDLE  PortHandle,
  /*IN*/ PORT_INFORMATION_CLASS  PortInformationClass,
  /*OUT*/ PVOID  PortInformation,
  /*IN*/ ULONG  PortInformationLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwImpersonateClientOfPort(
  /*IN*/ HANDLE  PortHandle,
  /*IN*/ PLPC_MESSAGE  Message);




/* Files */

NTOSAPI
NTSTATUS
NTAPI
NtDeleteFile(
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes);

NTOSAPI
NTSTATUS
NTAPI
ZwDeleteFile(
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes);

NTOSAPI
NTSTATUS
NTAPI
ZwFlushBuffersFile(
  /*IN*/ HANDLE  FileHandle,
  /*OUT*/ PIO_STATUS_BLOCK  IoStatusBlock);

NTOSAPI
NTSTATUS
NTAPI
ZwCancelIoFile(
  /*IN*/ HANDLE  FileHandle,
  /*OUT*/ PIO_STATUS_BLOCK  IoStatusBlock);

NTOSAPI
NTSTATUS
NTAPI
ZwReadFileScatter(
  /*IN*/ HANDLE  FileHandle,
  /*IN*/ HANDLE  Event /*OPTIONAL*/,
  /*IN*/ PIO_APC_ROUTINE  ApcRoutine  /*OPTIONAL*/,
  /*IN*/ PVOID  ApcContext  /*OPTIONAL*/,
  /*OUT*/ PIO_STATUS_BLOCK  IoStatusBlock,
  /*IN*/ PFILE_SEGMENT_ELEMENT  Buffer,
  /*IN*/ ULONG  Length,
  /*IN*/ PLARGE_INTEGER  ByteOffset  /*OPTIONAL*/,
  /*IN*/ PULONG  Key  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwWriteFileGather(
  /*IN*/ HANDLE  FileHandle,
  /*IN*/ HANDLE  Event  /*OPTIONAL*/,
  /*IN*/ PIO_APC_ROUTINE  ApcRoutine  /*OPTIONAL*/,
  /*IN*/ PVOID  ApcContext  /*OPTIONAL*/,
  /*OUT*/ PIO_STATUS_BLOCK  IoStatusBlock,
  /*IN*/ PFILE_SEGMENT_ELEMENT  Buffer,
  /*IN*/ ULONG  Length,
  /*IN*/ PLARGE_INTEGER  ByteOffset  /*OPTIONAL*/,
  /*IN*/ PULONG  Key  /*OPTIONAL*/);




/* Registry keys */

NTOSAPI
NTSTATUS
NTAPI
ZwSaveKey(
  /*IN*/ HANDLE  KeyHandle,
  /*IN*/ HANDLE  FileHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwSaveMergedKeys(
  /*IN*/ HANDLE  KeyHandle1,
  /*IN*/ HANDLE  KeyHandle2,
  /*IN*/ HANDLE  FileHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwRestoreKey(
  /*IN*/ HANDLE  KeyHandle,
  /*IN*/ HANDLE  FileHandle,
  /*IN*/ ULONG  Flags);

NTOSAPI
NTSTATUS
NTAPI
ZwLoadKey(
  /*IN*/ POBJECT_ATTRIBUTES  KeyObjectAttributes,
  /*IN*/ POBJECT_ATTRIBUTES  FileObjectAttributes);

NTOSAPI
NTSTATUS
NTAPI
ZwLoadKey2(
  /*IN*/ POBJECT_ATTRIBUTES  KeyObjectAttributes,
  /*IN*/ POBJECT_ATTRIBUTES  FileObjectAttributes,
  /*IN*/ ULONG  Flags);

NTOSAPI
NTSTATUS
NTAPI
ZwUnloadKey(
  /*IN*/ POBJECT_ATTRIBUTES  KeyObjectAttributes);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryOpenSubKeys(
  /*IN*/ POBJECT_ATTRIBUTES  KeyObjectAttributes,
  /*OUT*/ PULONG  NumberOfKeys);

NTOSAPI
NTSTATUS
NTAPI
ZwReplaceKey(
  /*IN*/ POBJECT_ATTRIBUTES  NewFileObjectAttributes,
  /*IN*/ HANDLE  KeyHandle,
  /*IN*/ POBJECT_ATTRIBUTES  OldFileObjectAttributes);

typedef enum _KEY_SET_INFORMATION_CLASS {
  KeyLastWriteTimeInformation
} KEY_SET_INFORMATION_CLASS;

NTOSAPI
NTSTATUS
NTAPI
ZwSetInformationKey(
  /*IN*/ HANDLE  KeyHandle,
  /*IN*/ KEY_SET_INFORMATION_CLASS  KeyInformationClass,
  /*IN*/ PVOID  KeyInformation,
  /*IN*/ ULONG  KeyInformationLength);

typedef struct _KEY_LAST_WRITE_TIME_INFORMATION {
  LARGE_INTEGER LastWriteTime;
} KEY_LAST_WRITE_TIME_INFORMATION, *PKEY_LAST_WRITE_TIME_INFORMATION;

typedef struct _KEY_NAME_INFORMATION {
	ULONG NameLength;
	WCHAR Name[1];
} KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION;

NTOSAPI
NTSTATUS
NTAPI
ZwNotifyChangeKey(
  /*IN*/ HANDLE  KeyHandle,
  /*IN*/ HANDLE  EventHandle  /*OPTIONAL*/,
  /*IN*/ PIO_APC_ROUTINE  ApcRoutine  /*OPTIONAL*/,
  /*IN*/ PVOID  ApcContext  /*OPTIONAL*/,
  /*OUT*/ PIO_STATUS_BLOCK  IoStatusBlock,
  /*IN*/ ULONG  NotifyFilter,
  /*IN*/ BOOLEAN  WatchSubtree,
  /*IN*/ PVOID  Buffer,
  /*IN*/ ULONG  BufferLength,
  /*IN*/ BOOLEAN  Asynchronous);

/* ZwNotifyChangeMultipleKeys.Flags constants */
#define REG_MONITOR_SINGLE_KEY            0x00
#define REG_MONITOR_SECOND_KEY            0x01

NTOSAPI
NTSTATUS
NTAPI
ZwNotifyChangeMultipleKeys(
  /*IN*/ HANDLE  KeyHandle,
  /*IN*/ ULONG  Flags,
  /*IN*/ POBJECT_ATTRIBUTES  KeyObjectAttributes,
  /*IN*/ HANDLE  EventHandle  /*OPTIONAL*/,
  /*IN*/ PIO_APC_ROUTINE  ApcRoutine  /*OPTIONAL*/,
  /*IN*/ PVOID  ApcContext  /*OPTIONAL*/,
  /*OUT*/ PIO_STATUS_BLOCK  IoStatusBlock,
  /*IN*/ ULONG  NotifyFilter,
  /*IN*/ BOOLEAN  WatchSubtree,
  /*IN*/ PVOID  Buffer,
  /*IN*/ ULONG  BufferLength,
  /*IN*/ BOOLEAN  Asynchronous);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryMultipleValueKey(
  /*IN*/ HANDLE  KeyHandle,
  /*IN OUT*/  PKEY_VALUE_ENTRY  ValueList,
  /*IN*/ ULONG  NumberOfValues,
  /*OUT*/ PVOID  Buffer,
  /*IN OUT*/ PULONG  Length,
  /*OUT*/ PULONG  ReturnLength);

NTOSAPI
NTSTATUS
NTAPI
ZwInitializeRegistry(
  /*IN*/ BOOLEAN  Setup);




/* Security and auditing */

NTOSAPI
NTSTATUS
NTAPI
ZwPrivilegeCheck(
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ PPRIVILEGE_SET  RequiredPrivileges,
  /*OUT*/ PBOOLEAN  Result);

NTOSAPI
NTSTATUS
NTAPI
ZwPrivilegeObjectAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ PPRIVILEGE_SET  Privileges,
  /*IN*/ BOOLEAN  AccessGranted);

NTOSAPI
NTSTATUS
NTAPI
ZwPrivilegeObjectAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ PPRIVILEGE_SET  Privileges,
  /*IN*/ BOOLEAN  AccessGranted);

NTOSAPI
NTSTATUS
NTAPI
ZwAccessCheck(
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ PGENERIC_MAPPING  GenericMapping,
  /*IN*/ PPRIVILEGE_SET  PrivilegeSet,
  /*IN*/ PULONG  PrivilegeSetLength,
  /*OUT*/ PACCESS_MASK  GrantedAccess,
  /*OUT*/ PBOOLEAN  AccessStatus);

NTOSAPI
NTSTATUS
NTAPI
ZwAccessCheckAndAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ PUNICODE_STRING  ObjectTypeName,
  /*IN*/ PUNICODE_STRING  ObjectName,
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ PGENERIC_MAPPING  GenericMapping,
  /*IN*/ BOOLEAN  ObjectCreation,
  /*OUT*/ PACCESS_MASK  GrantedAccess,
  /*OUT*/ PBOOLEAN  AccessStatus,
  /*OUT*/ PBOOLEAN  GenerateOnClose);

NTOSAPI
NTSTATUS
NTAPI
ZwAccessCheckByType(
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ PSID  PrincipalSelfSid,
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ ULONG  DesiredAccess,
  /*IN*/ POBJECT_TYPE_LIST  ObjectTypeList,
  /*IN*/ ULONG  ObjectTypeListLength,
  /*IN*/ PGENERIC_MAPPING  GenericMapping,
  /*IN*/ PPRIVILEGE_SET  PrivilegeSet,
  /*IN*/ PULONG  PrivilegeSetLength,
  /*OUT*/ PACCESS_MASK  GrantedAccess,
  /*OUT*/ PULONG  AccessStatus);

typedef enum _AUDIT_EVENT_TYPE {
	AuditEventObjectAccess,
	AuditEventDirectoryServiceAccess
} AUDIT_EVENT_TYPE, *PAUDIT_EVENT_TYPE;

NTOSAPI
NTSTATUS
NTAPI
ZwAccessCheckByTypeAndAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ PUNICODE_STRING  ObjectTypeName,
  /*IN*/ PUNICODE_STRING  ObjectName,
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ PSID  PrincipalSelfSid,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ AUDIT_EVENT_TYPE  AuditType,
  /*IN*/ ULONG  Flags,
  /*IN*/ POBJECT_TYPE_LIST  ObjectTypeList,
  /*IN*/ ULONG  ObjectTypeListLength,
  /*IN*/ PGENERIC_MAPPING  GenericMapping,
  /*IN*/ BOOLEAN  ObjectCreation,
  /*OUT*/ PACCESS_MASK  GrantedAccess,
  /*OUT*/ PULONG  AccessStatus,
  /*OUT*/ PBOOLEAN  GenerateOnClose);

NTOSAPI
NTSTATUS
NTAPI
ZwAccessCheckByTypeResultList(
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ PSID  PrincipalSelfSid,
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ POBJECT_TYPE_LIST  ObjectTypeList,
  /*IN*/ ULONG  ObjectTypeListLength,
  /*IN*/ PGENERIC_MAPPING  GenericMapping,
  /*IN*/ PPRIVILEGE_SET  PrivilegeSet,
  /*IN*/ PULONG  PrivilegeSetLength,
  /*OUT*/ PACCESS_MASK  GrantedAccessList,
  /*OUT*/ PULONG  AccessStatusList);

NTOSAPI
NTSTATUS
NTAPI
ZwAccessCheckByTypeResultListAndAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ PUNICODE_STRING  ObjectTypeName,
  /*IN*/ PUNICODE_STRING  ObjectName,
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ PSID  PrincipalSelfSid,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ AUDIT_EVENT_TYPE  AuditType,
  /*IN*/ ULONG  Flags,
  /*IN*/ POBJECT_TYPE_LIST  ObjectTypeList,
  /*IN*/ ULONG  ObjectTypeListLength,
  /*IN*/ PGENERIC_MAPPING  GenericMapping,
  /*IN*/ BOOLEAN  ObjectCreation,
  /*OUT*/ PACCESS_MASK  GrantedAccessList,
  /*OUT*/ PULONG  AccessStatusList,
  /*OUT*/ PULONG  GenerateOnClose);

NTOSAPI
NTSTATUS
NTAPI
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ PUNICODE_STRING  ObjectTypeName,
  /*IN*/ PUNICODE_STRING  ObjectName,
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ PSID  PrincipalSelfSid,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ AUDIT_EVENT_TYPE  AuditType,
  /*IN*/ ULONG  Flags,
  /*IN*/ POBJECT_TYPE_LIST  ObjectTypeList,
  /*IN*/ ULONG  ObjectTypeListLength,
  /*IN*/ PGENERIC_MAPPING  GenericMapping,
  /*IN*/ BOOLEAN  ObjectCreation,
  /*OUT*/ PACCESS_MASK  GrantedAccessList,
  /*OUT*/ PULONG  AccessStatusList,
  /*OUT*/ PULONG  GenerateOnClose);

NTOSAPI
NTSTATUS
NTAPI
ZwOpenObjectAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  *HandleId,
  /*IN*/ PUNICODE_STRING  ObjectTypeName,
  /*IN*/ PUNICODE_STRING  ObjectName,
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ ACCESS_MASK  GrantedAccess,
  /*IN*/ PPRIVILEGE_SET  Privileges  /*OPTIONAL*/,
  /*IN*/ BOOLEAN  ObjectCreation,
  /*IN*/ BOOLEAN  AccessGranted,
  /*OUT*/ PBOOLEAN  GenerateOnClose);

NTOSAPI
NTSTATUS
NTAPI
ZwCloseObjectAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ BOOLEAN  GenerateOnClose);

NTOSAPI
NTSTATUS
NTAPI
ZwDeleteObjectAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ BOOLEAN  GenerateOnClose);




/* Plug and play and power management */

NTOSAPI
NTSTATUS
NTAPI
ZwRequestWakeupLatency(
  /*IN*/ LATENCY_TIME  Latency);

NTOSAPI
NTSTATUS
NTAPI
ZwRequestDeviceWakeup(
  /*IN*/ HANDLE  DeviceHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwCancelDeviceWakeupRequest(
  /*IN*/ HANDLE  DeviceHandle);

NTOSAPI
BOOLEAN
NTAPI
ZwIsSystemResumeAutomatic(
  VOID);

NTOSAPI
NTSTATUS
NTAPI
ZwSetThreadExecutionState(
  /*IN*/ EXECUTION_STATE  ExecutionState,
  /*OUT*/ PEXECUTION_STATE  PreviousExecutionState);

NTOSAPI
NTSTATUS
NTAPI
ZwGetDevicePowerState(
  /*IN*/ HANDLE  DeviceHandle,
  /*OUT*/ PDEVICE_POWER_STATE  DevicePowerState);

NTOSAPI
NTSTATUS
NTAPI
ZwSetSystemPowerState(
  /*IN*/ POWER_ACTION  SystemAction,
  /*IN*/ SYSTEM_POWER_STATE  MinSystemState,
  /*IN*/ ULONG  Flags);

NTOSAPI
NTSTATUS
NTAPI
ZwInitiatePowerAction(
  /*IN*/ POWER_ACTION  SystemAction,
  /*IN*/ SYSTEM_POWER_STATE  MinSystemState,
  /*IN*/ ULONG  Flags,
  /*IN*/ BOOLEAN  Asynchronous);

NTOSAPI
NTSTATUS
NTAPI
ZwPowerInformation(
  /*IN*/ POWER_INFORMATION_LEVEL  PowerInformationLevel,
  /*IN*/ PVOID  InputBuffer  /*OPTIONAL*/,
  /*IN*/ ULONG  InputBufferLength,
  /*OUT*/ PVOID  OutputBuffer  /*OPTIONAL*/,
  /*IN*/ ULONG  OutputBufferLength);

NTOSAPI
NTSTATUS
NTAPI
ZwPlugPlayControl(
  /*IN*/ ULONG  ControlCode,
  /*IN OUT*/ PVOID  Buffer,
  /*IN*/ ULONG  BufferLength);

NTOSAPI
NTSTATUS
NTAPI
ZwGetPlugPlayEvent(
  /*IN*/ ULONG  Reserved1,
  /*IN*/ ULONG  Reserved2,
  /*OUT*/ PVOID  Buffer,
  /*IN*/ ULONG  BufferLength);




/* Miscellany */

NTOSAPI
NTSTATUS
NTAPI
ZwRaiseException(
  /*IN*/ PEXCEPTION_RECORD  ExceptionRecord,
  /*IN*/ PCONTEXT  Context,
  /*IN*/ BOOLEAN  SearchFrames);

NTOSAPI
NTSTATUS
NTAPI
ZwContinue(
  /*IN*/ PCONTEXT  Context,
  /*IN*/ BOOLEAN  TestAlert);

NTOSAPI
NTSTATUS
NTAPI
ZwW32Call(
  /*IN*/ ULONG  RoutineIndex,
  /*IN*/ PVOID  Argument,
  /*IN*/ ULONG  ArgumentLength,
  /*OUT*/ PVOID  *Result  /*OPTIONAL*/,
  /*OUT*/ PULONG  ResultLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwSetLowWaitHighThread(
  VOID);

NTOSAPI
NTSTATUS
NTAPI
ZwSetHighWaitLowThread(
  VOID);

NTOSAPI
NTSTATUS
NTAPI
ZwLoadDriver(
  /*IN*/ PUNICODE_STRING  DriverServiceName);

NTOSAPI
NTSTATUS
NTAPI
ZwUnloadDriver(
  /*IN*/ PUNICODE_STRING  DriverServiceName);

NTOSAPI
NTSTATUS
NTAPI
ZwFlushInstructionCache(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN*/ PVOID  BaseAddress  /*OPTIONAL*/,
  /*IN*/ ULONG  FlushSize);

NTOSAPI
NTSTATUS
NTAPI
ZwFlushWriteBuffer(
  VOID);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryDefaultLocale(
  /*IN*/ BOOLEAN  ThreadOrSystem,
  /*OUT*/ PLCID  Locale);

NTOSAPI
NTSTATUS
NTAPI
ZwSetDefaultLocale(
  /*IN*/ BOOLEAN  ThreadOrSystem,
  /*IN*/ LCID  Locale);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryDefaultUILanguage(
  /*OUT*/ PLANGID  LanguageId);

NTOSAPI
NTSTATUS
NTAPI
ZwSetDefaultUILanguage(
  /*IN*/ LANGID  LanguageId);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryInstallUILanguage(
  /*OUT*/ PLANGID  LanguageId);

NTOSAPI
NTSTATUS
NTAPI
NtAllocateLocallyUniqueId(
  /*OUT*/ PLUID  Luid);

NTOSAPI
NTSTATUS
NTAPI
NtAllocateUuids(
  /*OUT*/ PLARGE_INTEGER  UuidLastTimeAllocated,
  /*OUT*/ PULONG  UuidDeltaTime,
  /*OUT*/ PULONG  UuidSequenceNumber,
  /*OUT*/ PUCHAR  UuidSeed);

NTOSAPI
NTSTATUS
NTAPI
ZwSetUuidSeed(
  /*IN*/ PUCHAR  UuidSeed);

typedef enum _HARDERROR_RESPONSE_OPTION {
	OptionAbortRetryIgnore,
	OptionOk,
	OptionOkCancel,
	OptionRetryCancel,
	OptionYesNo,
	OptionYesNoCancel,
	OptionShutdownSystem
} HARDERROR_RESPONSE_OPTION, *PHARDERROR_RESPONSE_OPTION;

typedef enum _HARDERROR_RESPONSE {
	ResponseReturnToCaller,
	ResponseNotHandled,
	ResponseAbort,
	ResponseCancel,
	ResponseIgnore,
	ResponseNo,
	ResponseOk,
	ResponseRetry,
	ResponseYes
} HARDERROR_RESPONSE, *PHARDERROR_RESPONSE;

NTOSAPI
NTSTATUS
NTAPI
ZwRaiseHardError(
  /*IN*/ NTSTATUS  Status,
  /*IN*/ ULONG  NumberOfArguments,
  /*IN*/ ULONG  StringArgumentsMask,
  /*IN*/ PULONG  Arguments,
  /*IN*/ HARDERROR_RESPONSE_OPTION  ResponseOption,
  /*OUT*/ PHARDERROR_RESPONSE  Response);

NTOSAPI
NTSTATUS
NTAPI
ZwSetDefaultHardErrorPort(
  /*IN*/ HANDLE  PortHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwDisplayString(
  /*IN*/ PUNICODE_STRING  String);

NTOSAPI
NTSTATUS
NTAPI
ZwCreatePagingFile(
  /*IN*/ PUNICODE_STRING  FileName,
  /*IN*/ PULARGE_INTEGER  InitialSize,
  /*IN*/ PULARGE_INTEGER  MaximumSize,
  /*IN*/ ULONG  Reserved);

typedef USHORT RTL_ATOM, *PRTL_ATOM;

NTOSAPI
NTSTATUS
NTAPI
NtAddAtom(
  /*IN*/ PWSTR  AtomName,
  /*IN*/ ULONG  AtomNameLength,
  /*OUT*/ PRTL_ATOM  Atom);

NTOSAPI
NTSTATUS
NTAPI
NtFindAtom(
  /*IN*/ PWSTR  AtomName,
  /*IN*/ ULONG  AtomNameLength,
  /*OUT*/ PRTL_ATOM  Atom);

NTOSAPI
NTSTATUS
NTAPI
NtDeleteAtom(
  /*IN*/ RTL_ATOM  Atom);

typedef enum _ATOM_INFORMATION_CLASS {
	AtomBasicInformation,
	AtomListInformation
} ATOM_INFORMATION_CLASS;

NTOSAPI
NTSTATUS
NTAPI
NtQueryInformationAtom(
  /*IN*/ RTL_ATOM  Atom,
  /*IN*/ ATOM_INFORMATION_CLASS  AtomInformationClass,
  /*OUT*/ PVOID  AtomInformation,
  /*IN*/ ULONG  AtomInformationLength,
  /*OUT*/ PULONG  ReturnLength  /*OPTIONAL*/);

typedef struct _ATOM_BASIC_INFORMATION {
	USHORT  ReferenceCount;
	USHORT  Pinned;
	USHORT  NameLength;
	WCHAR  Name[1];
} ATOM_BASIC_INFORMATION, *PATOM_BASIC_INFORMATION;

typedef struct _ATOM_LIST_INFORMATION {
  ULONG  NumberOfAtoms;
  ATOM  Atoms[1];
} ATOM_LIST_INFORMATION, *PATOM_LIST_INFORMATION;

NTOSAPI
NTSTATUS
NTAPI
ZwSetLdtEntries(
  /*IN*/ ULONG  Selector1,
  /*IN*/ LDT_ENTRY  LdtEntry1,
  /*IN*/ ULONG  Selector2,
  /*IN*/ LDT_ENTRY  LdtEntry2);

NTOSAPI
NTSTATUS
NTAPI
NtVdmControl(
  /*IN*/ ULONG  ControlCode,
  /*IN*/ PVOID  ControlData);

#pragma pack(pop)

#ifdef __cplusplus
}
#endif

#endif /* __NTAPI_H */