ntoskrnl.inc

这是asm驱动的开发包

PsCreateSystemProcess                        proto stdcall :DWORD, :DWORD, :DWORD
PsCreateSystemThread                         proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
PsDisableImpersonation                       proto stdcall :DWORD, :DWORD
PsEstablishWin32Callouts                     proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
PsGetCurrentProcessId                        proto stdcall
PsGetCurrentThreadId                         proto stdcall
PsGetProcessExitTime                         proto stdcall
PsGetVersion                                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
PsImpersonateClient                          proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
PsIsThreadTerminating                        proto stdcall :DWORD
PsLookupProcessByProcessId                   proto stdcall :DWORD, :DWORD
PsLookupProcessThreadByCid                   proto stdcall :DWORD, :DWORD, :DWORD
PsLookupThreadByThreadId                     proto stdcall :DWORD, :DWORD
PsReferenceImpersonationToken                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
PsReferencePrimaryToken                      proto stdcall :DWORD
PsRestoreImpersonation                       proto stdcall :DWORD, :DWORD
PsReturnPoolQuota                            proto stdcall :DWORD, :DWORD, :DWORD
PsRevertToSelf                               proto stdcall
PsSetCreateProcessNotifyRoutine              proto stdcall :DWORD, :DWORD
PsSetCreateThreadNotifyRoutine               proto stdcall :DWORD
PsSetLegoNotifyRoutine                       proto stdcall :DWORD
PsSetLoadImageNotifyRoutine                  proto stdcall :DWORD
PsSetProcessPriorityByClass                  proto stdcall :DWORD, :DWORD
PsTerminateSystemThread                      proto stdcall :DWORD
READ_REGISTER_BUFFER_UCHAR                   proto stdcall :DWORD, :DWORD, :DWORD
READ_REGISTER_BUFFER_ULONG                   proto stdcall :DWORD, :DWORD, :DWORD
READ_REGISTER_BUFFER_USHORT                  proto stdcall :DWORD, :DWORD, :DWORD
READ_REGISTER_UCHAR                          proto stdcall :DWORD
READ_REGISTER_ULONG                          proto stdcall :DWORD
READ_REGISTER_USHORT                         proto stdcall :DWORD
RtlAbsoluteToSelfRelativeSD                  proto stdcall :DWORD, :DWORD, :DWORD
RtlAddAccessAllowedAce                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlAddAce                                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlAddAtomToAtomTable                        proto stdcall :DWORD, :DWORD, :DWORD
RtlAddRange                                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlAllocateHeap                              proto stdcall :DWORD, :DWORD, :DWORD
RtlAnsiCharToUnicodeChar                     proto stdcall :DWORD
RtlAnsiStringToUnicodeSize                   proto stdcall :DWORD
RtlAnsiStringToUnicodeString                 proto stdcall :DWORD, :DWORD, :DWORD
RtlAppendAsciizToString                      proto stdcall :DWORD, :DWORD
RtlAppendStringToString                      proto stdcall :DWORD, :DWORD
RtlAppendUnicodeStringToString               proto stdcall :DWORD, :DWORD
RtlAppendUnicodeToString                     proto stdcall :DWORD, :DWORD
RtlAreAllAccessesGranted                     proto stdcall :DWORD, :DWORD
RtlAreAnyAccessesGranted                     proto stdcall :DWORD, :DWORD
RtlAreBitsClear                              proto stdcall :DWORD, :DWORD, :DWORD
RtlAreBitsSet                                proto stdcall :DWORD, :DWORD, :DWORD
RtlAssert                                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlCaptureContext                            proto stdcall :DWORD
RtlCaptureStackBackTrace                     proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlCharToInteger                             proto stdcall :DWORD, :DWORD, :DWORD
RtlCheckRegistryKey                          proto stdcall :DWORD, :DWORD
RtlClearAllBits                              proto stdcall :DWORD
RtlClearBits                                 proto stdcall :DWORD, :DWORD, :DWORD
RtlCompareMemory                             proto stdcall :DWORD, :DWORD, :DWORD
RtlCompareMemoryUlong                        proto stdcall :DWORD, :DWORD, :DWORD
RtlCompareString                             proto stdcall :DWORD, :DWORD, :DWORD
RtlCompareUnicodeString                      proto stdcall :DWORD, :DWORD, :DWORD
RtlCompressBuffer                            proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlCompressChunks                            proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlConvertLongToLargeInteger                 proto stdcall :DWORD
RtlConvertSidToUnicodeString                 proto stdcall :DWORD, :DWORD, :DWORD
RtlConvertUlongToLargeInteger                proto stdcall :DWORD
RtlCopyLuid                                  proto stdcall :DWORD, :DWORD
RtlCopyRangeList                             proto stdcall :DWORD, :DWORD
RtlCopySid                                   proto stdcall :DWORD, :DWORD, :DWORD
RtlCopyString                                proto stdcall :DWORD, :DWORD
RtlCopyUnicodeString                         proto stdcall :DWORD, :DWORD
RtlCreateAcl                                 proto stdcall :DWORD, :DWORD, :DWORD
RtlCreateAtomTable                           proto stdcall :DWORD, :DWORD
RtlCreateHeap                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlCreateRegistryKey                         proto stdcall :DWORD, :DWORD
RtlCreateSecurityDescriptor                  proto stdcall :DWORD, :DWORD
RtlCreateUnicodeString                       proto stdcall :DWORD, :DWORD
RtlCustomCPToUnicodeN                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlDecompressBuffer                          proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlDecompressChunks                          proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlDecompressFragment                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlDelete                                    proto stdcall :DWORD
RtlDeleteAce                                 proto stdcall :DWORD, :DWORD
RtlDeleteAtomFromAtomTable                   proto stdcall :DWORD, :DWORD
RtlDeleteElementGenericTable                 proto stdcall :DWORD, :DWORD
RtlDeleteNoSplay                             proto stdcall :DWORD, :DWORD
RtlDeleteOwnersRanges                        proto stdcall :DWORD, :DWORD
RtlDeleteRange                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlDeleteRegistryValue                       proto stdcall :DWORD, :DWORD, :DWORD
RtlDescribeChunk                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlDestroyAtomTable                          proto stdcall :DWORD
RtlDestroyHeap                               proto stdcall :DWORD
RtlDowncaseUnicodeString                     proto stdcall :DWORD, :DWORD, :DWORD
RtlEmptyAtomTable                            proto stdcall :DWORD, :DWORD
RtlEnlargedIntegerMultiply                   proto stdcall :DWORD, :DWORD
RtlEnlargedUnsignedDivide                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlEnlargedUnsignedMultiply                  proto stdcall :DWORD, :DWORD
RtlEnumerateGenericTable                     proto stdcall :DWORD, :DWORD
RtlEnumerateGenericTableWithoutSplaying      proto stdcall :DWORD, :DWORD
RtlEqualLuid                                 proto stdcall :DWORD, :DWORD
RtlEqualSid                                  proto stdcall :DWORD, :DWORD
RtlEqualString                               proto stdcall :DWORD, :DWORD, :DWORD
RtlEqualUnicodeString                        proto stdcall :DWORD, :DWORD, :DWORD
RtlExtendedIntegerMultiply                   proto stdcall :DWORD, :DWORD, :DWORD
RtlExtendedLargeIntegerDivide                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlExtendedMagicDivide                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlFillMemory                                proto stdcall :DWORD, :DWORD, :DWORD
RtlFillMemoryUlong                           proto stdcall :DWORD, :DWORD, :DWORD
RtlFindClearBits                             proto stdcall :DWORD, :DWORD, :DWORD
RtlFindClearBitsAndSet                       proto stdcall :DWORD, :DWORD, :DWORD
RtlFindClearRuns                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlFindFirstRunClear                         proto stdcall :DWORD, :DWORD
RtlFindLastBackwardRunClear                  proto stdcall :DWORD, :DWORD, :DWORD
RtlFindLeastSignificantBit                   proto stdcall :DWORD, :DWORD
RtlFindLongestRunClear                       proto stdcall :DWORD, :DWORD
RtlFindMessage                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlFindMostSignificantBit                    proto stdcall :DWORD, :DWORD
RtlFindNextForwardRunClear                   proto stdcall :DWORD, :DWORD, :DWORD
RtlFindRange                                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlFindSetBits                               proto stdcall :DWORD, :DWORD, :DWORD
RtlFindSetBitsAndClear                       proto stdcall :DWORD, :DWORD, :DWORD
RtlFindUnicodePrefix                         proto stdcall :DWORD, :DWORD, :DWORD
RtlFormatCurrentUserKeyPath                  proto stdcall :DWORD
RtlFreeAnsiString                            proto stdcall :DWORD
RtlFreeHeap                                  proto stdcall :DWORD, :DWORD, :DWORD
RtlFreeOemString                             proto stdcall :DWORD
RtlFreeRangeList                             proto stdcall :DWORD
RtlFreeUnicodeString                         proto stdcall :DWORD
RtlGUIDFromString                            proto stdcall :DWORD, :DWORD
RtlGenerate8dot3Name                         proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlGetAce                                    proto stdcall :DWORD, :DWORD, :DWORD
RtlGetCallersAddress                         proto stdcall :DWORD, :DWORD
RtlGetCompressionWorkSpaceSize               proto stdcall :DWORD, :DWORD, :DWORD
RtlGetDaclSecurityDescriptor                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlGetDefaultCodePage                        proto stdcall :DWORD, :DWORD
RtlGetElementGenericTable                    proto stdcall :DWORD, :DWORD
RtlGetFirstRange                             proto stdcall :DWORD, :DWORD, :DWORD
RtlGetGroupSecurityDescriptor                proto stdcall :DWORD, :DWORD, :DWORD
RtlGetNextRange                              proto stdcall :DWORD, :DWORD, :DWORD
RtlGetNtGlobalFlags                          proto stdcall
RtlGetOwnerSecurityDescriptor                proto stdcall :DWORD, :DWORD, :DWORD
RtlGetSaclSecurityDescriptor                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlImageDirectoryEntryToData                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlImageNtHeader                             proto stdcall :DWORD
RtlInitAnsiString                            proto stdcall :DWORD, :DWORD
RtlInitCodePageTable                         proto stdcall :DWORD, :DWORD
RtlInitString                                proto stdcall :DWORD, :DWORD
RtlInitUnicodeString                         proto stdcall :DWORD, :DWORD
RtlInitializeBitMap                          proto stdcall :DWORD, :DWORD, :DWORD
RtlInitializeGenericTable                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlInitializeRangeList                       proto stdcall :DWORD
RtlInitializeSid                             proto stdcall :DWORD, :DWORD, :DWORD
RtlInitializeUnicodePrefix                   proto stdcall :DWORD
RtlInsertElementGenericTable                 proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlInsertElementGenericTableFull             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlInsertUnicodePrefix                       proto stdcall :DWORD, :DWORD, :DWORD
RtlIntegerToChar                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlIntegerToUnicodeString                    proto stdcall :DWORD, :DWORD, :DWORD
RtlInvertRangeList                           proto stdcall :DWORD, :DWORD
RtlIsGenericTableEmpty                       proto stdcall :DWORD
RtlIsNameLega