ntdll.inc

这是asm驱动的开发包

;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;:           This file was created on 16 Jan 2005 with Protogen v1.0 by Four-F.                   ::
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

; __cdecls was fixed by hand !!!

;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;:                                            STDCALL                                             ::
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

CsrAllocateCaptureBuffer                           proto stdcall :DWORD, :DWORD
CsrAllocateMessagePointer                          proto stdcall :DWORD, :DWORD, :DWORD
CsrCaptureMessageBuffer                            proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
CsrCaptureMessageString                            proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
CsrCaptureTimeout                                  proto stdcall :DWORD, :DWORD
CsrClientCallServer                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
CsrClientConnectToServer                           proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
CsrFreeCaptureBuffer                               proto stdcall :DWORD
CsrIdentifyAlertableThread                         proto stdcall
CsrNewThread                                       proto stdcall
CsrProbeForRead                                    proto stdcall :DWORD, :DWORD, :DWORD
CsrProbeForWrite                                   proto stdcall :DWORD, :DWORD, :DWORD
CsrSetPriorityClass                                proto stdcall :DWORD, :DWORD
DbgBreakPoint                                      proto stdcall
DbgPrompt                                          proto stdcall :DWORD, :DWORD, :DWORD
DbgSsHandleKmApiMsg                                proto stdcall :DWORD, :DWORD
DbgSsInitialize                                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
DbgUiConnectToDbg                                  proto stdcall
DbgUiContinue                                      proto stdcall :DWORD, :DWORD
DbgUiWaitStateChange                               proto stdcall :DWORD, :DWORD
DbgUserBreakPoint                                  proto stdcall
KiRaiseUserExceptionDispatcher                     proto stdcall
KiUserApcDispatcher                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
KiUserCallbackDispatcher                           proto stdcall :DWORD, :DWORD, :DWORD
KiUserExceptionDispatcher                          proto stdcall :DWORD, :DWORD
LdrAccessResource                                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
LdrAlternateResourcesEnabled                       proto stdcall
LdrDisableThreadCalloutsForDll                     proto stdcall :DWORD
LdrEnumResources                                   proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
LdrFindEntryForAddress                             proto stdcall :DWORD, :DWORD
LdrFindResourceDirectory_U                         proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
LdrFindResource_U                                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
LdrFlushAlternateResourceModules                   proto stdcall
LdrGetDllHandle                                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
LdrGetProcedureAddress                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
LdrInitializeThunk                                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
LdrLoadAlternateResourceModule                     proto stdcall :DWORD, :DWORD
LdrLoadDll                                         proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
LdrProcessRelocationBlock                          proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
LdrQueryImageFileExecutionOptions                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
LdrQueryProcessModuleInformation                   proto stdcall :DWORD, :DWORD, :DWORD
LdrShutdownProcess                                 proto stdcall
LdrShutdownThread                                  proto stdcall
LdrUnloadAlternateResourceModule                   proto stdcall :DWORD
LdrUnloadDll                                       proto stdcall :DWORD
LdrVerifyImageMatchesChecksum                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtAcceptConnectPort                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtAccessCheck                                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtAccessCheckAndAuditAlarm                         proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtAccessCheckByType                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtAccessCheckByTypeAndAuditAlarm                   proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtAccessCheckByTypeResultList                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtAccessCheckByTypeResultListAndAuditAlarm         proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtAccessCheckByTypeResultListAndAuditAlarmByHandle proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtAddAtom                                          proto stdcall :DWORD, :DWORD, :DWORD
NtAdjustGroupsToken                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtAdjustPrivilegesToken                            proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtAlertResumeThread                                proto stdcall :DWORD, :DWORD
NtAlertThread                                      proto stdcall :DWORD
NtAllocateLocallyUniqueId                          proto stdcall :DWORD
NtAllocateUserPhysicalPages                        proto stdcall :DWORD, :DWORD, :DWORD
NtAllocateUuids                                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtAllocateVirtualMemory                            proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtAreMappedFilesTheSame                            proto stdcall :DWORD, :DWORD
NtAssignProcessToJobObject                         proto stdcall :DWORD, :DWORD
NtCallbackReturn                                   proto stdcall :DWORD, :DWORD, :DWORD
NtCancelDeviceWakeupRequest                        proto stdcall :DWORD
NtCancelIoFile                                     proto stdcall :DWORD, :DWORD
NtCancelTimer                                      proto stdcall :DWORD, :DWORD
NtClearEvent                                       proto stdcall :DWORD
NtClose                                            proto stdcall :DWORD
NtCloseObjectAuditAlarm                            proto stdcall :DWORD, :DWORD, :DWORD
NtCompleteConnectPort                              proto stdcall :DWORD
NtConnectPort                                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtContinue                                         proto stdcall :DWORD, :DWORD
NtCreateChannel                                    proto stdcall :DWORD, :DWORD
NtCreateDirectoryObject                            proto stdcall :DWORD, :DWORD, :DWORD
NtCreateEvent                                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCreateEventPair                                  proto stdcall :DWORD, :DWORD, :DWORD
NtCreateFile                                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCreateIoCompletion                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtCreateJobObject                                  proto stdcall :DWORD, :DWORD, :DWORD
NtCreateKey                                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCreateMailslotFile                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCreateMutant                                     proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtCreateNamedPipeFile                              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCreatePagingFile                                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtCreatePort                                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCreateProcess                                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCreateProfile                                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCreateSection                                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCreateSemaphore                                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCreateSymbolicLinkObject                         proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtCreateThread                                     proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCreateTimer                                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtCreateToken                                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCreateWaitablePort                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCurrentTeb                                       proto stdcall
NtDelayExecution                                   proto stdcall :DWORD, :DWORD
NtDeleteAtom                                       proto stdcall :DWORD
NtDeleteFile                                       proto stdcall :DWORD
NtDeleteKey                                        proto stdcall :DWORD
NtDeleteObjectAuditAlarm                           proto stdcall :DWORD, :DWORD, :DWORD
NtDeleteValueKey                                   proto stdcall :DWORD, :DWORD
NtDeviceIoControlFile                              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtDisplayString                                    proto stdcall :DWORD
NtDuplicateObject                                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtDuplicateToken                                   proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtEnumerateKey                                     proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtEnumerateValueKey                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtExtendSection                                    proto stdcall :DWORD, :DWORD
NtFilterToken                                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtFindAtom                                         proto stdcall :DWORD, :DWORD, :DWORD
NtFlushBuffersFile                                 proto stdcall :DWORD, :DWORD
NtFlushInstructionCache                            proto stdcall :DWORD, :DWORD, :DWORD
NtFlushKey                                         proto stdcall :DWORD
NtFlushVirtualMemory                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtFlushWriteBuffer                                 proto stdcall
NtFreeUserPhysicalPages                            proto stdcall :DWORD, :DWORD, :DWORD
NtFreeVirtualMemory                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtFsControlFile                                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtGetContextThread                                 proto stdcall :DWORD, :DWORD
NtGetDevicePowerState                              proto stdcall :DWORD, :DWORD
NtGetPlugPlayEvent                                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtGetTickCount                                     proto stdcall
NtGetWriteWatch                                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtImpersonateAnonymousToken                        proto stdcall :DWORD
NtImpersonateClientOfPort                          proto stdcall :DWORD, :DWORD
NtImpersonateThread                                proto stdcall :DWORD, :DWORD, :DWORD
NtInitializeRegistry                               proto stdcall :DWORD
NtInitiatePowerAction                              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtIsSystemResumeAutomatic                          proto stdcall