ntoskrnl.inc

这是asm驱动的开发包

KiIpiServiceRoutine                          proto stdcall :DWORD, :DWORD
LdrAccessResource                            proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
LdrEnumResources                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
LdrFindResourceDirectory_U                   proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
LdrFindResource_U                            proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
LpcRequestPort                               proto stdcall :DWORD, :DWORD
LpcRequestWaitReplyPort                      proto stdcall :DWORD, :DWORD, :DWORD
LsaCallAuthenticationPackage                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
LsaDeregisterLogonProcess                    proto stdcall :DWORD
LsaFreeReturnBuffer                          proto stdcall :DWORD
LsaLogonUser                                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
LsaLookupAuthenticationPackage               proto stdcall :DWORD, :DWORD, :DWORD
LsaRegisterLogonProcess                      proto stdcall :DWORD, :DWORD, :DWORD
MmAddPhysicalMemory                          proto stdcall :DWORD, :DWORD
MmAdjustWorkingSetSize                       proto stdcall :DWORD, :DWORD, :DWORD
MmAllocateContiguousMemory                   proto stdcall :DWORD, :DWORD, :DWORD
MmAllocateContiguousMemorySpecifyCache       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
MmAllocateNonCachedMemory                    proto stdcall :DWORD
MmAllocatePagesForMdl                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
MmBuildMdlForNonPagedPool                    proto stdcall :DWORD
MmCanFileBeTruncated                         proto stdcall :DWORD, :DWORD
MmCreateMdl                                  proto stdcall :DWORD, :DWORD, :DWORD
MmCreateSection                              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
MmDisableModifiedWriteOfSection              proto stdcall :DWORD
MmFlushImageSection                          proto stdcall :DWORD, :DWORD
MmForceSectionClosed                         proto stdcall :DWORD, :DWORD
MmFreeContiguousMemory                       proto stdcall :DWORD
MmFreeContiguousMemorySpecifyCache           proto stdcall :DWORD, :DWORD, :DWORD
MmFreeNonCachedMemory                        proto stdcall :DWORD, :DWORD
MmFreePagesFromMdl                           proto stdcall :DWORD
MmGetPhysicalAddress                         proto stdcall :DWORD
MmGetPhysicalMemoryRanges                    proto stdcall
MmGetSystemRoutineAddress                    proto stdcall :DWORD
MmGetVirtualForPhysical                      proto stdcall :DWORD, :DWORD
MmGrowKernelStack                            proto stdcall :DWORD
MmIsAddressValid                             proto stdcall :DWORD
MmIsDriverVerifying                          proto stdcall :DWORD
MmIsNonPagedSystemAddressValid               proto stdcall :DWORD
MmIsRecursiveIoFault                         proto stdcall
MmIsThisAnNtAsSystem                         proto stdcall
MmLockPagableDataSection                     proto stdcall :DWORD
MmLockPagableImageSection                    proto stdcall :DWORD
MmLockPagableSectionByHandle                 proto stdcall :DWORD
MmMapIoSpace                                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
MmMapLockedPages                             proto stdcall :DWORD, :DWORD
MmMapLockedPagesSpecifyCache                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
MmMapMemoryDumpMdl                           proto stdcall :DWORD
MmMapUserAddressesToPage                     proto stdcall :DWORD, :DWORD, :DWORD
MmMapVideoDisplay                            proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
MmMapViewInSessionSpace                      proto stdcall :DWORD, :DWORD, :DWORD
MmMapViewInSystemSpace                       proto stdcall :DWORD, :DWORD, :DWORD
MmMapViewOfSection                           proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
MmPageEntireDriver                           proto stdcall :DWORD
MmProbeAndLockPages                          proto stdcall :DWORD, :DWORD, :DWORD
MmProbeAndLockProcessPages                   proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
MmProbeAndLockSelectedPages                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
MmQuerySystemSize                            proto stdcall
MmRemovePhysicalMemory                       proto stdcall :DWORD, :DWORD
MmResetDriverPaging                          proto stdcall :DWORD
MmSecureVirtualMemory                        proto stdcall :DWORD, :DWORD, :DWORD
MmSetAddressRangeModified                    proto stdcall :DWORD, :DWORD
MmSetBankedSection                           proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
MmSizeOfMdl                                  proto stdcall :DWORD, :DWORD
MmTrimAllSystemPagableMemory                 proto stdcall :DWORD
MmUnlockPagableImageSection                  proto stdcall :DWORD
MmUnlockPages                                proto stdcall :DWORD
MmUnmapIoSpace                               proto stdcall :DWORD, :DWORD
MmUnmapLockedPages                           proto stdcall :DWORD, :DWORD
MmUnmapVideoDisplay                          proto stdcall :DWORD, :DWORD
MmUnmapViewInSessionSpace                    proto stdcall :DWORD
MmUnmapViewInSystemSpace                     proto stdcall :DWORD
MmUnmapViewOfSection                         proto stdcall :DWORD, :DWORD
MmUnsecureVirtualMemory                      proto stdcall :DWORD
NtAddAtom                                    proto stdcall :DWORD, :DWORD, :DWORD
NtAdjustPrivilegesToken                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtAllocateLocallyUniqueId                    proto stdcall :DWORD
NtAllocateUuids                              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtAllocateVirtualMemory                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtClose                                      proto stdcall :DWORD
NtConnectPort                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCreateEvent                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCreateFile                                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtCreateSection                              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtDeleteAtom                                 proto stdcall :DWORD
NtDeleteFile                                 proto stdcall :DWORD
NtDeviceIoControlFile                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtDuplicateObject                            proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtDuplicateToken                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtFindAtom                                   proto stdcall :DWORD, :DWORD, :DWORD
NtFreeVirtualMemory                          proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtFsControlFile                              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtLockFile                                   proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtMapViewOfSection                           proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtNotifyChangeDirectoryFile                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtOpenFile                                   proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtOpenProcess                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtOpenProcessToken                           proto stdcall :DWORD, :DWORD, :DWORD
NtQueryDirectoryFile                         proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtQueryEaFile                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtQueryInformationAtom                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtQueryInformationFile                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtQueryInformationProcess                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtQueryInformationToken                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtQueryQuotaInformationFile                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtQuerySecurityObject                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtQuerySystemInformation                     proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtQueryVolumeInformationFile                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtReadFile                                   proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtRequestPort                                proto stdcall :DWORD, :DWORD
NtRequestWaitReplyPort                       proto stdcall :DWORD, :DWORD, :DWORD
NtSetEaFile                                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtSetEvent                                   proto stdcall :DWORD, :DWORD
NtSetInformationFile                         proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtSetInformationProcess                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtSetInformationThread                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtSetQuotaInformationFile                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
NtSetSecurityObject                          proto stdcall :DWORD, :DWORD, :DWORD
NtSetVolumeInformationFile                   proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtUnlockFile                                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
NtVdmControl                                 proto stdcall :DWORD, :DWORD
NtWaitForSingleObject                        proto stdcall :DWORD, :DWORD, :DWORD
NtWriteFile                                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ObAssignSecurity                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
ObCheckCreateObjectAccess                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ObCheckObjectAccess                          proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ObCreateObject                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ObDereferenceObject                          proto stdcall :DWORD
ObFindHandleForObject                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ObGetObjectPointerCount                      proto stdcall :DWORD
ObGetObjectSecurity                          proto stdcall :DWORD, :DWORD, :DWORD
ObInsertObject                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ObMakeTemporaryObject                        proto stdcall :DWORD
ObOpenObjectByName                           proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ObOpenObjectByPointer                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ObQueryNameString                            proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
ObQueryObjectAuditingByHandle                proto stdcall :DWORD, :DWORD
ObReferenceObjectByHandle                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ObReferenceObjectByName                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ObReferenceObjectByPointer                   proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
ObReleaseObjectSecurity                      proto stdcall :DWORD, :DWORD
ObSetSecurityDescriptorInfo                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
PfxFindPrefix                                proto stdcall :DWORD, :DWORD
PfxInitialize                                proto stdcall :DWORD
PfxInsertPrefix                              proto stdcall :DWORD, :DWORD, :DWORD
PfxRemovePrefix                              proto stdcall :DWORD, :DWORD
PoCallDriver                                 proto stdcall :DWORD, :DWORD
PoCancelDeviceNotify                         proto stdcall :DWORD
PoRegisterDeviceForIdleDetection             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
PoRegisterDeviceNotify                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
PoRegisterSystemState                        proto stdcall :DWORD, :DWORD
PoRequestPowerIrp                            proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
PoSetHiberRange                              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
PoSetPowerState                              proto stdcall :DWORD, :DWORD, :DWORD
PoSetSystemState                             proto stdcall :DWORD
PoShutdownBugCheck                           proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
PoStartNextPowerIrp                          proto stdcall :DWORD
PoUnregisterSystemState                      proto stdcall :DWORD
ProbeForRead                                 proto stdcall :DWORD, :DWORD, :DWORD
ProbeForWrite                                proto stdcall :DWORD, :DWORD, :DWORD
PsAssignImpersonationToken                   proto stdcall :DWORD, :DWORD
PsChargePoolQuota                            proto stdcall :DWORD, :DWORD, :DWORD