ntdll.inc

用汇编语言编写Windows驱动程序的工具

; made with protoize by f0dder
; with many hand-made fixes (__cdecl)
; Four-F, [e-mail]
; last update 10-Dec-2002

ZwYieldExecution PROTO STDCALL
ZwWriteVirtualMemory PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwWriteRequestData PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwWriteFileGather PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwWriteFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwWaitLowEventPair PROTO STDCALL :DWORD
ZwWaitHighEventPair PROTO STDCALL :DWORD
ZwWaitForSingleObject PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwWaitForMultipleObjects PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwVdmControl PROTO STDCALL :DWORD, :DWORD
ZwUnmapViewOfSection PROTO STDCALL :DWORD, :DWORD
ZwUnlockVirtualMemory PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwUnlockFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwUnloadKey PROTO STDCALL :DWORD
ZwUnloadDriver PROTO STDCALL :DWORD
ZwTestAlert PROTO STDCALL
ZwTerminateThread PROTO STDCALL :DWORD, :DWORD
ZwTerminateProcess PROTO STDCALL :DWORD, :DWORD
ZwTerminateJobObject PROTO STDCALL :DWORD, :DWORD
ZwSystemDebugControl PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwSuspendThread PROTO STDCALL :DWORD, :DWORD
ZwStopProfile PROTO STDCALL :DWORD
ZwStartProfile PROTO STDCALL :DWORD
ZwSignalAndWaitForSingleObject PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwShutdownSystem PROTO STDCALL :DWORD
ZwSetVolumeInformationFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwSetValueKey PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwSetUuidSeed PROTO STDCALL :DWORD
ZwSetTimerResolution PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwSetTimer PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwSetThreadExecutionState PROTO STDCALL :DWORD, :DWORD
ZwSetSystemTime PROTO STDCALL :DWORD, :DWORD
ZwSetSystemPowerState PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwSetSystemInformation PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwSetSystemEnvironmentValue PROTO STDCALL :DWORD, :DWORD
ZwSetSecurityObject PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwSetQuotaInformationFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwSetLowWaitHighEventPair PROTO STDCALL :DWORD
ZwSetLowEventPair PROTO STDCALL :DWORD
ZwSetLdtEntries PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwSetIoCompletion PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwSetIntervalProfile PROTO STDCALL :DWORD, :DWORD
ZwSetInformationToken PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwSetInformationThread PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwSetInformationProcess PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwSetInformationObject PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwSetInformationKey PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwSetInformationJobObject PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwSetInformationFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwSetHighWaitLowEventPair PROTO STDCALL :DWORD
ZwSetHighEventPair PROTO STDCALL :DWORD
ZwSetEvent PROTO STDCALL :DWORD, :DWORD
ZwSetEaFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwSetDefaultUILanguage PROTO STDCALL :DWORD
ZwSetDefaultLocale PROTO STDCALL :DWORD, :DWORD
ZwSetDefaultHardErrorPort PROTO STDCALL :DWORD
ZwSetContextThread PROTO STDCALL :DWORD, :DWORD
ZwSetContextChannel PROTO STDCALL :DWORD
ZwSendWaitReplyChannel PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwSecureConnectPort PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwSaveMergedKeys PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwSaveKey PROTO STDCALL :DWORD, :DWORD
ZwResumeThread PROTO STDCALL :DWORD, :DWORD
ZwRestoreKey PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwResetWriteWatch PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwResetEvent PROTO STDCALL :DWORD, :DWORD
ZwRequestWakeupLatency PROTO STDCALL :DWORD
ZwRequestWaitReplyPort PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwRequestPort PROTO STDCALL :DWORD, :DWORD
ZwRequestDeviceWakeup PROTO STDCALL :DWORD
ZwReplyWaitSendChannel PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwReplyWaitReplyPort PROTO STDCALL :DWORD, :DWORD
ZwReplyWaitReceivePortEx PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwReplyWaitReceivePort PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwReplyPort PROTO STDCALL :DWORD, :DWORD
ZwReplaceKey PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwRemoveIoCompletion PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwReleaseSemaphore PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwReleaseMutant PROTO STDCALL :DWORD, :DWORD
ZwRegisterThreadTerminatePort PROTO STDCALL :DWORD
ZwReadVirtualMemory PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwReadRequestData PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwReadFileScatter PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwReadFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwRaiseHardError PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwRaiseException PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwQueueApcThread PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryVolumeInformationFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryVirtualMemory PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryValueKey PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryTimerResolution PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwQueryTimer PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQuerySystemTime PROTO STDCALL :DWORD
ZwQuerySystemInformation PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwQuerySystemEnvironmentValue PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwQuerySymbolicLinkObject PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwQuerySemaphore PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQuerySecurityObject PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQuerySection PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryQuotaInformationFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryPerformanceCounter PROTO STDCALL :DWORD, :DWORD
ZwQueryOpenSubKeys PROTO STDCALL :DWORD, :DWORD
ZwQueryObject PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryMutant PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryMultipleValueKey PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryKey PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryIoCompletion PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryIntervalProfile PROTO STDCALL :DWORD, :DWORD
ZwQueryInstallUILanguage PROTO STDCALL :DWORD
ZwQueryInformationToken PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryInformationThread PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryInformationProcess PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryInformationPort PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryInformationJobObject PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryInformationFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryInformationAtom PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryFullAttributesFile PROTO STDCALL :DWORD, :DWORD
ZwQueryEvent PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryEaFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryDirectoryObject PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryDirectoryFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwQueryDefaultUILanguage PROTO STDCALL :DWORD
ZwQueryDefaultLocale PROTO STDCALL :DWORD, :DWORD
ZwQueryAttributesFile PROTO STDCALL :DWORD, :DWORD
ZwPulseEvent PROTO STDCALL :DWORD, :DWORD
ZwProtectVirtualMemory PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwPrivilegedServiceAuditAlarm PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwPrivilegeObjectAuditAlarm PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwPrivilegeCheck PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwPowerInformation PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwPlugPlayControl PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwOpenTimer PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwOpenThreadToken PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwOpenThread PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwOpenSymbolicLinkObject PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwOpenSemaphore PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwOpenSection PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwOpenProcessToken PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwOpenProcess PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwOpenObjectAuditAlarm PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwOpenMutant PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwOpenKey PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwOpenJobObject PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwOpenIoCompletion PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwOpenFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwOpenEventPair PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwOpenEvent PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwOpenDirectoryObject PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwOpenChannel PROTO STDCALL :DWORD, :DWORD
ZwNotifyChangeMultipleKeys PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwNotifyChangeKey PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwNotifyChangeDirectoryFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwMapViewOfSection PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwMapUserPhysicalPagesScatter PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwMapUserPhysicalPages PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwMakeTemporaryObject PROTO STDCALL :DWORD
ZwLockVirtualMemory PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwLockFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwLoadKey PROTO STDCALL :DWORD, :DWORD
ZwLoadKey2 PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwLoadDriver PROTO STDCALL :DWORD
ZwListenPort PROTO STDCALL :DWORD, :DWORD
ZwListenChannel PROTO STDCALL :DWORD, :DWORD
ZwIsSystemResumeAutomatic PROTO STDCALL
ZwInitiatePowerAction PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwInitializeRegistry PROTO STDCALL :DWORD
ZwImpersonateThread PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwImpersonateClientOfPort PROTO STDCALL :DWORD, :DWORD
ZwImpersonateAnonymousToken PROTO STDCALL :DWORD
ZwGetWriteWatch PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwGetTickCount PROTO STDCALL
ZwGetPlugPlayEvent PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwGetDevicePowerState PROTO STDCALL :DWORD, :DWORD
ZwGetContextThread PROTO STDCALL :DWORD, :DWORD
ZwFsControlFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwFreeVirtualMemory PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwFreeUserPhysicalPages PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwFlushWriteBuffer PROTO STDCALL
ZwFlushVirtualMemory PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwFlushKey PROTO STDCALL :DWORD
ZwFlushInstructionCache PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwFlushBuffersFile PROTO STDCALL :DWORD, :DWORD
ZwFindAtom PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwFilterToken PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwExtendSection PROTO STDCALL :DWORD, :DWORD
ZwEnumerateValueKey PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwEnumerateKey PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwDuplicateToken PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwDuplicateObject PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwDisplayString PROTO STDCALL :DWORD
ZwDeviceIoControlFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwDeleteValueKey PROTO STDCALL :DWORD, :DWORD
ZwDeleteObjectAuditAlarm PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwDeleteKey PROTO STDCALL :DWORD
ZwDeleteFile PROTO STDCALL :DWORD
ZwDeleteAtom PROTO STDCALL :DWORD
ZwDelayExecution PROTO STDCALL :DWORD, :DWORD
ZwCreateWaitablePort PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateToken PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateTimer PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateThread PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateSymbolicLinkObject PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateSemaphore PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateSection PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateProfile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateProcess PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwCreatePort PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwCreatePagingFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateNamedPipeFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateMutant PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateMailslotFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateKey PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateJobObject PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwCreateIoCompletion PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateFile PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateEventPair PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwCreateEvent PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwCreateDirectoryObject PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwCreateChannel PROTO STDCALL :DWORD, :DWORD
ZwContinue PROTO STDCALL :DWORD, :DWORD
ZwConnectPort PROTO STDCALL :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwCompleteConnectPort PROTO STDCALL :DWORD
ZwCloseObjectAuditAlarm PROTO STDCALL :DWORD, :DWORD, :DWORD
ZwClose PROTO STDCALL :DWORD
ZwClearEvent PROTO STDCALL :DWORD
ZwCancelTimer PROTO STDCALL :DWORD, :DWORD
ZwCancelIoFile PROTO STDCALL :DWORD, :DWORD
ZwCancelDeviceWakeupRequest PROTO STDCALL :DWORD