ntdll.inc

这是asm驱动的开发包

NtSystemDebugControl                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtTerminateJobObject                               proto stdcall :DWORD, :DWORD
NtTerminateProcess                                 proto stdcall :DWORD, :DWORD
NtTerminateThread                                  proto stdcall :DWORD, :DWORD
NtTestAlert                                        proto stdcall
NtUnloadDriver                                     proto stdcall :DWORD
NtUnloadKey                                        proto stdcall :DWORD
NtUnlockFile                                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtUnlockVirtualMemory                              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtUnmapViewOfSection                               proto stdcall :DWORD, :DWORD
NtVdmControl                                       proto stdcall :DWORD, :DWORD
NtWaitForMultipleObjects                           proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtWaitForSingleObject                              proto stdcall :DWORD, :DWORD, :DWORD
NtWaitHighEventPair                                proto stdcall :DWORD
NtWaitLowEventPair                                 proto stdcall :DWORD
NtWriteFile                                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtWriteFileGather                                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtWriteRequestData                                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtWriteVirtualMemory                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtYieldExecution                                   proto stdcall
PfxFindPrefix                                      proto stdcall :DWORD, :DWORD
PfxInitialize                                      proto stdcall :DWORD
PfxInsertPrefix                                    proto stdcall :DWORD, :DWORD, :DWORD
PfxRemovePrefix                                    proto stdcall :DWORD, :DWORD
RtlAbortRXact                                      proto stdcall :DWORD
RtlAbsoluteToSelfRelativeSD                        proto stdcall :DWORD, :DWORD, :DWORD
RtlAcquirePebLock                                  proto stdcall
RtlAcquireResourceExclusive                        proto stdcall :DWORD, :DWORD
RtlAcquireResourceShared                           proto stdcall :DWORD, :DWORD
RtlAddAccessAllowedAce                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlAddAccessAllowedAceEx                           proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlAddAccessAllowedObjectAce                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlAddAccessDeniedAce                              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlAddAccessDeniedAceEx                            proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlAddAccessDeniedObjectAce                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlAddAce                                          proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlAddActionToRXact                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlAddAtomToAtomTable                              proto stdcall :DWORD, :DWORD, :DWORD
RtlAddAttributeActionToRXact                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlAddAuditAccessAce                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlAddAuditAccessAceEx                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlAddAuditAccessObjectAce                         proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlAddCompoundAce                                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlAddRange                                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlAdjustPrivilege                                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlAllocateAndInitializeSid                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlAllocateHandle                                  proto stdcall :DWORD, :DWORD
RtlAllocateHeap                                    proto stdcall :DWORD, :DWORD, :DWORD
RtlAnsiCharToUnicodeChar                           proto stdcall :DWORD
RtlAnsiStringToUnicodeSize                         proto stdcall :DWORD
RtlAnsiStringToUnicodeString                       proto stdcall :DWORD, :DWORD, :DWORD
RtlAppendAsciizToString                            proto stdcall :DWORD, :DWORD
RtlAppendStringToString                            proto stdcall :DWORD, :DWORD
RtlAppendUnicodeStringToString                     proto stdcall :DWORD, :DWORD
RtlAppendUnicodeToString                           proto stdcall :DWORD, :DWORD
RtlApplyRXact                                      proto stdcall :DWORD
RtlApplyRXactNoFlush                               proto stdcall :DWORD
RtlAreAllAccessesGranted                           proto stdcall :DWORD, :DWORD
RtlAreAnyAccessesGranted                           proto stdcall :DWORD, :DWORD
RtlAreBitsClear                                    proto stdcall :DWORD, :DWORD, :DWORD
RtlAreBitsSet                                      proto stdcall :DWORD, :DWORD, :DWORD
RtlAssert                                          proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlCallbackLpcClient                               proto stdcall :DWORD, :DWORD, :DWORD
RtlCancelTimer                                     proto stdcall :DWORD, :DWORD
RtlCaptureStackBackTrace                           proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlCharToInteger                                   proto stdcall :DWORD, :DWORD, :DWORD
RtlCheckForOrphanedCriticalSections                proto stdcall :DWORD
RtlCheckRegistryKey                                proto stdcall :DWORD, :DWORD
RtlClearAllBits                                    proto stdcall :DWORD
RtlClearBits                                       proto stdcall :DWORD, :DWORD, :DWORD
RtlCompactHeap                                     proto stdcall :DWORD, :DWORD
RtlCompareMemory                                   proto stdcall :DWORD, :DWORD, :DWORD
RtlCompareMemoryUlong                              proto stdcall :DWORD, :DWORD, :DWORD
RtlCompareString                                   proto stdcall :DWORD, :DWORD, :DWORD
RtlCompareUnicodeString                            proto stdcall :DWORD, :DWORD, :DWORD
RtlCompressBuffer                                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlConsoleMultiByteToUnicodeN                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlConvertExclusiveToShared                        proto stdcall :DWORD
RtlConvertLongToLargeInteger                       proto stdcall :DWORD
RtlConvertSharedToExclusive                        proto stdcall :DWORD
RtlConvertSidToUnicodeString                       proto stdcall :DWORD, :DWORD, :DWORD
RtlConvertToAutoInheritSecurityObject              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlConvertUiListToApiList                          proto stdcall :DWORD, :DWORD, :DWORD
RtlConvertUlongToLargeInteger                      proto stdcall :DWORD
RtlCopyLuid                                        proto stdcall :DWORD, :DWORD
RtlCopyLuidAndAttributesArray                      proto stdcall :DWORD, :DWORD, :DWORD
RtlCopyRangeList                                   proto stdcall :DWORD, :DWORD
RtlCopySecurityDescriptor                          proto stdcall :DWORD, :DWORD
RtlCopySid                                         proto stdcall :DWORD, :DWORD, :DWORD
RtlCopySidAndAttributesArray                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlCopyString                                      proto stdcall :DWORD, :DWORD
RtlCopyUnicodeString                               proto stdcall :DWORD, :DWORD
RtlCreateAcl                                       proto stdcall :DWORD, :DWORD, :DWORD
RtlCreateAndSetSD                                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlCreateAtomTable                                 proto stdcall :DWORD, :DWORD
RtlCreateEnvironment                               proto stdcall :DWORD, :DWORD
RtlCreateHeap                                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlCreateLpcServer                                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlCreateProcessParameters                         proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlCreateQueryDebugBuffer                          proto stdcall :DWORD, :DWORD
RtlCreateRegistryKey                               proto stdcall :DWORD, :DWORD
RtlCreateSecurityDescriptor                        proto stdcall :DWORD, :DWORD
RtlCreateTagHeap                                   proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlCreateTimer                                     proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlCreateTimerQueue                                proto stdcall :DWORD
RtlCreateUnicodeString                             proto stdcall :DWORD, :DWORD
RtlCreateUnicodeStringFromAsciiz                   proto stdcall :DWORD, :DWORD
RtlCreateUserProcess                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlCreateUserSecurityObject                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlCreateUserThread                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlCustomCPToUnicodeN                              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlCutoverTimeToSystemTime                         proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlDeNormalizeProcessParams                        proto stdcall :DWORD
RtlDebugPrintTimes                                 proto stdcall
RtlDecompressBuffer                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlDecompressFragment                              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlDefaultNpAcl                                    proto stdcall :DWORD
RtlDelete                                          proto stdcall :DWORD
RtlDeleteAce                                       proto stdcall :DWORD, :DWORD
RtlDeleteAtomFromAtomTable                         proto stdcall :DWORD, :DWORD
RtlDeleteCriticalSection                           proto stdcall :DWORD
RtlDeleteElementGenericTable                       proto stdcall :DWORD, :DWORD
RtlDeleteNoSplay                                   proto stdcall :DWORD, :DWORD
RtlDeleteOwnersRanges                              proto stdcall :DWORD, :DWORD
RtlDeleteRange                                     proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlDeleteRegistryValue                             proto stdcall :DWORD, :DWORD, :DWORD
RtlDeleteResource                                  proto stdcall :DWORD
RtlDeleteSecurityObject                            proto stdcall :DWORD
RtlDeleteTimer                                     proto stdcall :DWORD, :DWORD, :DWORD
RtlDeleteTimerQueue                                proto stdcall :DWORD
RtlDeleteTimerQueueEx                              proto stdcall :DWORD, :DWORD
RtlDeregisterWait                                  proto stdcall :DWORD
RtlDeregisterWaitEx                                proto stdcall :DWORD, :DWORD
RtlDestroyAtomTable                                proto stdcall :DWORD
RtlDestroyEnvironment                              proto stdcall :DWORD
RtlDestroyHandleTable                              proto stdcall :DWORD
RtlDestroyHeap                                     proto stdcall :DWORD
RtlDestroyProcessParameters                        proto stdcall :DWORD
RtlDestroyQueryDebugBuffer                         proto stdcall :DWORD
RtlDetermineDosPathNameType_U                      proto stdcall :DWORD
RtlDnsHostNameToComputerName                       proto stdcall :DWORD, :DWORD, :DWORD
RtlDoesFileExists_U                                proto stdcall :DWORD
RtlDosPathNameToNtPathName_U                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD