ntapi.h

MinGW+MSYS开发必用的api参考

/* Files */

NTOSAPI
NTSTATUS
NTAPI
NtDeleteFile(
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes);

NTOSAPI
NTSTATUS
NTAPI
ZwDeleteFile(
  /*IN*/ POBJECT_ATTRIBUTES  ObjectAttributes);

NTOSAPI
NTSTATUS
NTAPI
ZwFlushBuffersFile(
  /*IN*/ HANDLE  FileHandle,
  /*OUT*/ PIO_STATUS_BLOCK  IoStatusBlock);

NTOSAPI
NTSTATUS
NTAPI
ZwCancelIoFile(
  /*IN*/ HANDLE  FileHandle,
  /*OUT*/ PIO_STATUS_BLOCK  IoStatusBlock);

NTOSAPI
NTSTATUS
NTAPI
ZwReadFileScatter(
  /*IN*/ HANDLE  FileHandle,
  /*IN*/ HANDLE  Event /*OPTIONAL*/,
  /*IN*/ PIO_APC_ROUTINE  ApcRoutine  /*OPTIONAL*/,
  /*IN*/ PVOID  ApcContext  /*OPTIONAL*/,
  /*OUT*/ PIO_STATUS_BLOCK  IoStatusBlock,
  /*IN*/ PFILE_SEGMENT_ELEMENT  Buffer,
  /*IN*/ ULONG  Length,
  /*IN*/ PLARGE_INTEGER  ByteOffset  /*OPTIONAL*/,
  /*IN*/ PULONG  Key  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwWriteFileGather(
  /*IN*/ HANDLE  FileHandle,
  /*IN*/ HANDLE  Event  /*OPTIONAL*/,
  /*IN*/ PIO_APC_ROUTINE  ApcRoutine  /*OPTIONAL*/,
  /*IN*/ PVOID  ApcContext  /*OPTIONAL*/,
  /*OUT*/ PIO_STATUS_BLOCK  IoStatusBlock,
  /*IN*/ PFILE_SEGMENT_ELEMENT  Buffer,
  /*IN*/ ULONG  Length,
  /*IN*/ PLARGE_INTEGER  ByteOffset  /*OPTIONAL*/,
  /*IN*/ PULONG  Key  /*OPTIONAL*/);




/* Registry keys */

NTOSAPI
NTSTATUS
NTAPI
ZwSaveKey(
  /*IN*/ HANDLE  KeyHandle,
  /*IN*/ HANDLE  FileHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwSaveMergedKeys(
  /*IN*/ HANDLE  KeyHandle1,
  /*IN*/ HANDLE  KeyHandle2,
  /*IN*/ HANDLE  FileHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwRestoreKey(
  /*IN*/ HANDLE  KeyHandle,
  /*IN*/ HANDLE  FileHandle,
  /*IN*/ ULONG  Flags);

NTOSAPI
NTSTATUS
NTAPI
ZwLoadKey(
  /*IN*/ POBJECT_ATTRIBUTES  KeyObjectAttributes,
  /*IN*/ POBJECT_ATTRIBUTES  FileObjectAttributes);

NTOSAPI
NTSTATUS
NTAPI
ZwLoadKey2(
  /*IN*/ POBJECT_ATTRIBUTES  KeyObjectAttributes,
  /*IN*/ POBJECT_ATTRIBUTES  FileObjectAttributes,
  /*IN*/ ULONG  Flags);

NTOSAPI
NTSTATUS
NTAPI
ZwUnloadKey(
  /*IN*/ POBJECT_ATTRIBUTES  KeyObjectAttributes);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryOpenSubKeys(
  /*IN*/ POBJECT_ATTRIBUTES  KeyObjectAttributes,
  /*OUT*/ PULONG  NumberOfKeys);

NTOSAPI
NTSTATUS
NTAPI
ZwReplaceKey(
  /*IN*/ POBJECT_ATTRIBUTES  NewFileObjectAttributes,
  /*IN*/ HANDLE  KeyHandle,
  /*IN*/ POBJECT_ATTRIBUTES  OldFileObjectAttributes);

typedef enum _KEY_SET_INFORMATION_CLASS {
  KeyLastWriteTimeInformation
} KEY_SET_INFORMATION_CLASS;

NTOSAPI
NTSTATUS
NTAPI
ZwSetInformationKey(
  /*IN*/ HANDLE  KeyHandle,
  /*IN*/ KEY_SET_INFORMATION_CLASS  KeyInformationClass,
  /*IN*/ PVOID  KeyInformation,
  /*IN*/ ULONG  KeyInformationLength);

typedef struct _KEY_LAST_WRITE_TIME_INFORMATION {
  LARGE_INTEGER LastWriteTime;
} KEY_LAST_WRITE_TIME_INFORMATION, *PKEY_LAST_WRITE_TIME_INFORMATION;

typedef struct _KEY_NAME_INFORMATION {
	ULONG NameLength;
	WCHAR Name[1];
} KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION;

NTOSAPI
NTSTATUS
NTAPI
ZwNotifyChangeKey(
  /*IN*/ HANDLE  KeyHandle,
  /*IN*/ HANDLE  EventHandle  /*OPTIONAL*/,
  /*IN*/ PIO_APC_ROUTINE  ApcRoutine  /*OPTIONAL*/,
  /*IN*/ PVOID  ApcContext  /*OPTIONAL*/,
  /*OUT*/ PIO_STATUS_BLOCK  IoStatusBlock,
  /*IN*/ ULONG  NotifyFilter,
  /*IN*/ BOOLEAN  WatchSubtree,
  /*IN*/ PVOID  Buffer,
  /*IN*/ ULONG  BufferLength,
  /*IN*/ BOOLEAN  Asynchronous);

/* ZwNotifyChangeMultipleKeys.Flags constants */
#define REG_MONITOR_SINGLE_KEY            0x00
#define REG_MONITOR_SECOND_KEY            0x01

NTOSAPI
NTSTATUS
NTAPI
ZwNotifyChangeMultipleKeys(
  /*IN*/ HANDLE  KeyHandle,
  /*IN*/ ULONG  Flags,
  /*IN*/ POBJECT_ATTRIBUTES  KeyObjectAttributes,
  /*IN*/ HANDLE  EventHandle  /*OPTIONAL*/,
  /*IN*/ PIO_APC_ROUTINE  ApcRoutine  /*OPTIONAL*/,
  /*IN*/ PVOID  ApcContext  /*OPTIONAL*/,
  /*OUT*/ PIO_STATUS_BLOCK  IoStatusBlock,
  /*IN*/ ULONG  NotifyFilter,
  /*IN*/ BOOLEAN  WatchSubtree,
  /*IN*/ PVOID  Buffer,
  /*IN*/ ULONG  BufferLength,
  /*IN*/ BOOLEAN  Asynchronous);

NTOSAPI
NTSTATUS
NTAPI
ZwQueryMultipleValueKey(
  /*IN*/ HANDLE  KeyHandle,
  /*IN OUT*/  PKEY_VALUE_ENTRY  ValueList,
  /*IN*/ ULONG  NumberOfValues,
  /*OUT*/ PVOID  Buffer,
  /*IN OUT*/ PULONG  Length,
  /*OUT*/ PULONG  ReturnLength);

NTOSAPI
NTSTATUS
NTAPI
ZwInitializeRegistry(
  /*IN*/ BOOLEAN  Setup);




/* Security and auditing */

NTOSAPI
NTSTATUS
NTAPI
ZwPrivilegeCheck(
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ PPRIVILEGE_SET  RequiredPrivileges,
  /*OUT*/ PBOOLEAN  Result);

NTOSAPI
NTSTATUS
NTAPI
ZwPrivilegeObjectAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ PPRIVILEGE_SET  Privileges,
  /*IN*/ BOOLEAN  AccessGranted);

NTOSAPI
NTSTATUS
NTAPI
ZwPrivilegeObjectAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ PPRIVILEGE_SET  Privileges,
  /*IN*/ BOOLEAN  AccessGranted);

NTOSAPI
NTSTATUS
NTAPI
ZwAccessCheck(
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ PGENERIC_MAPPING  GenericMapping,
  /*IN*/ PPRIVILEGE_SET  PrivilegeSet,
  /*IN*/ PULONG  PrivilegeSetLength,
  /*OUT*/ PACCESS_MASK  GrantedAccess,
  /*OUT*/ PBOOLEAN  AccessStatus);

NTOSAPI
NTSTATUS
NTAPI
ZwAccessCheckAndAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ PUNICODE_STRING  ObjectTypeName,
  /*IN*/ PUNICODE_STRING  ObjectName,
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ PGENERIC_MAPPING  GenericMapping,
  /*IN*/ BOOLEAN  ObjectCreation,
  /*OUT*/ PACCESS_MASK  GrantedAccess,
  /*OUT*/ PBOOLEAN  AccessStatus,
  /*OUT*/ PBOOLEAN  GenerateOnClose);

NTOSAPI
NTSTATUS
NTAPI
ZwAccessCheckByType(
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ PSID  PrincipalSelfSid,
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ ULONG  DesiredAccess,
  /*IN*/ POBJECT_TYPE_LIST  ObjectTypeList,
  /*IN*/ ULONG  ObjectTypeListLength,
  /*IN*/ PGENERIC_MAPPING  GenericMapping,
  /*IN*/ PPRIVILEGE_SET  PrivilegeSet,
  /*IN*/ PULONG  PrivilegeSetLength,
  /*OUT*/ PACCESS_MASK  GrantedAccess,
  /*OUT*/ PULONG  AccessStatus);

typedef enum _AUDIT_EVENT_TYPE {
	AuditEventObjectAccess,
	AuditEventDirectoryServiceAccess
} AUDIT_EVENT_TYPE, *PAUDIT_EVENT_TYPE;

NTOSAPI
NTSTATUS
NTAPI
ZwAccessCheckByTypeAndAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ PUNICODE_STRING  ObjectTypeName,
  /*IN*/ PUNICODE_STRING  ObjectName,
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ PSID  PrincipalSelfSid,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ AUDIT_EVENT_TYPE  AuditType,
  /*IN*/ ULONG  Flags,
  /*IN*/ POBJECT_TYPE_LIST  ObjectTypeList,
  /*IN*/ ULONG  ObjectTypeListLength,
  /*IN*/ PGENERIC_MAPPING  GenericMapping,
  /*IN*/ BOOLEAN  ObjectCreation,
  /*OUT*/ PACCESS_MASK  GrantedAccess,
  /*OUT*/ PULONG  AccessStatus,
  /*OUT*/ PBOOLEAN  GenerateOnClose);

NTOSAPI
NTSTATUS
NTAPI
ZwAccessCheckByTypeResultList(
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ PSID  PrincipalSelfSid,
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ POBJECT_TYPE_LIST  ObjectTypeList,
  /*IN*/ ULONG  ObjectTypeListLength,
  /*IN*/ PGENERIC_MAPPING  GenericMapping,
  /*IN*/ PPRIVILEGE_SET  PrivilegeSet,
  /*IN*/ PULONG  PrivilegeSetLength,
  /*OUT*/ PACCESS_MASK  GrantedAccessList,
  /*OUT*/ PULONG  AccessStatusList);

NTOSAPI
NTSTATUS
NTAPI
ZwAccessCheckByTypeResultListAndAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ PUNICODE_STRING  ObjectTypeName,
  /*IN*/ PUNICODE_STRING  ObjectName,
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ PSID  PrincipalSelfSid,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ AUDIT_EVENT_TYPE  AuditType,
  /*IN*/ ULONG  Flags,
  /*IN*/ POBJECT_TYPE_LIST  ObjectTypeList,
  /*IN*/ ULONG  ObjectTypeListLength,
  /*IN*/ PGENERIC_MAPPING  GenericMapping,
  /*IN*/ BOOLEAN  ObjectCreation,
  /*OUT*/ PACCESS_MASK  GrantedAccessList,
  /*OUT*/ PULONG  AccessStatusList,
  /*OUT*/ PULONG  GenerateOnClose);

NTOSAPI
NTSTATUS
NTAPI
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ PUNICODE_STRING  ObjectTypeName,
  /*IN*/ PUNICODE_STRING  ObjectName,
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ PSID  PrincipalSelfSid,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ AUDIT_EVENT_TYPE  AuditType,
  /*IN*/ ULONG  Flags,
  /*IN*/ POBJECT_TYPE_LIST  ObjectTypeList,
  /*IN*/ ULONG  ObjectTypeListLength,
  /*IN*/ PGENERIC_MAPPING  GenericMapping,
  /*IN*/ BOOLEAN  ObjectCreation,
  /*OUT*/ PACCESS_MASK  GrantedAccessList,
  /*OUT*/ PULONG  AccessStatusList,
  /*OUT*/ PULONG  GenerateOnClose);

NTOSAPI
NTSTATUS
NTAPI
ZwOpenObjectAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  *HandleId,
  /*IN*/ PUNICODE_STRING  ObjectTypeName,
  /*IN*/ PUNICODE_STRING  ObjectName,
  /*IN*/ PSECURITY_DESCRIPTOR  SecurityDescriptor,
  /*IN*/ HANDLE  TokenHandle,
  /*IN*/ ACCESS_MASK  DesiredAccess,
  /*IN*/ ACCESS_MASK  GrantedAccess,
  /*IN*/ PPRIVILEGE_SET  Privileges  /*OPTIONAL*/,
  /*IN*/ BOOLEAN  ObjectCreation,
  /*IN*/ BOOLEAN  AccessGranted,
  /*OUT*/ PBOOLEAN  GenerateOnClose);

NTOSAPI
NTSTATUS
NTAPI
ZwCloseObjectAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ BOOLEAN  GenerateOnClose);

NTOSAPI
NTSTATUS
NTAPI
ZwDeleteObjectAuditAlarm(
  /*IN*/ PUNICODE_STRING  SubsystemName,
  /*IN*/ PVOID  HandleId,
  /*IN*/ BOOLEAN  GenerateOnClose);




/* Plug and play and power management */

NTOSAPI
NTSTATUS
NTAPI
ZwRequestWakeupLatency(
  /*IN*/ LATENCY_TIME  Latency);

NTOSAPI
NTSTATUS
NTAPI
ZwRequestDeviceWakeup(
  /*IN*/ HANDLE  DeviceHandle);

NTOSAPI
NTSTATUS
NTAPI
ZwCancelDeviceWakeupRequest(
  /*IN*/ HANDLE  DeviceHandle);

NTOSAPI
BOOLEAN
NTAPI
ZwIsSystemResumeAutomatic(
  VOID);

NTOSAPI
NTSTATUS
NTAPI
ZwSetThreadExecutionState(
  /*IN*/ EXECUTION_STATE  ExecutionState,
  /*OUT*/ PEXECUTION_STATE  PreviousExecutionState);

NTOSAPI
NTSTATUS
NTAPI
ZwGetDevicePowerState(
  /*IN*/ HANDLE  DeviceHandle,
  /*OUT*/ PDEVICE_POWER_STATE  DevicePowerState);

NTOSAPI
NTSTATUS
NTAPI
ZwSetSystemPowerState(
  /*IN*/ POWER_ACTION  SystemAction,
  /*IN*/ SYSTEM_POWER_STATE  MinSystemState,
  /*IN*/ ULONG  Flags);

NTOSAPI
NTSTATUS
NTAPI
ZwInitiatePowerAction(
  /*IN*/ POWER_ACTION  SystemAction,
  /*IN*/ SYSTEM_POWER_STATE  MinSystemState,
  /*IN*/ ULONG  Flags,
  /*IN*/ BOOLEAN  Asynchronous);

NTOSAPI
NTSTATUS
NTAPI
ZwPowerInformation(
  /*IN*/ POWER_INFORMATION_LEVEL  PowerInformationLevel,
  /*IN*/ PVOID  InputBuffer  /*OPTIONAL*/,
  /*IN*/ ULONG  InputBufferLength,
  /*OUT*/ PVOID  OutputBuffer  /*OPTIONAL*/,
  /*IN*/ ULONG  OutputBufferLength);

NTOSAPI
NTSTATUS
NTAPI
ZwPlugPlayControl(
  /*IN*/ ULONG  ControlCode,
  /*IN OUT*/ PVOID  Buffer,
  /*IN*/ ULONG  BufferLength);

NTOSAPI
NTSTATUS
NTAPI
ZwGetPlugPlayEvent(
  /*IN*/ ULONG  Reserved1,
  /*IN*/ ULONG  Reserved2,
  /*OUT*/ PVOID  Buffer,
  /*IN*/ ULONG  BufferLength);




/* Miscellany */

NTOSAPI
NTSTATUS
NTAPI
ZwRaiseException(
  /*IN*/ PEXCEPTION_RECORD  ExceptionRecord,
  /*IN*/ PCONTEXT  Context,
  /*IN*/ BOOLEAN  SearchFrames);

NTOSAPI
NTSTATUS
NTAPI
ZwContinue(
  /*IN*/ PCONTEXT  Context,
  /*IN*/ BOOLEAN  TestAlert);

NTOSAPI
NTSTATUS
NTAPI
ZwW32Call(
  /*IN*/ ULONG  RoutineIndex,
  /*IN*/ PVOID  Argument,
  /*IN*/ ULONG  ArgumentLength,
  /*OUT*/ PVOID  *Result  /*OPTIONAL*/,
  /*OUT*/ PULONG  ResultLength  /*OPTIONAL*/);

NTOSAPI
NTSTATUS
NTAPI
ZwSetLowWaitHighThread(
  VOID);

NTOSAPI
NTSTATUS
NTAPI
ZwSetHighWaitLowThread(
  VOID);

NTOSAPI
NTSTATUS
NTAPI
ZwLoadDriver(
  /*IN*/ PUNICODE_STRING  DriverServiceName);

NTOSAPI
NTSTATUS
NTAPI
ZwUnloadDriver(
  /*IN*/ PUNICODE_STRING  DriverServiceName);

NTOSAPI
NTSTATUS
NTAPI
ZwFlushInstructionCache(
  /*IN*/ HANDLE  ProcessHandle,
  /*IN*/ PVOID  BaseAddress  /*OPTIONAL*/,
  /*IN*/ ULONG  FlushSize);

NTOSAP