NTSOKRNL & NTDLL Undocumented

The NTinterlnals.net team presents:

The Undocumented Functions
The Undocumented Functions

Microsoft Windows NT/2000/XP/Win7

Microsoft Windows NT/2000/XP/Win7

Currently includes: UserMode (Kernel Mode soon)

This is an advanced, low-level programer's guide to Windows NT Kernel, Native API and drivers.
All remarks, fixes and comments are very welcome. There's also avaiable on http://undocumented.ntinternals.net.

This software and/or documentation is provided as free and it's freely avaiable and redisributable, in a entirety or in a parts as long as a Copyright and author's name are included. You are hereby permited to use, view, read, copy, print, publish, redistribute and modify this software and/or documentation.

The software/documentation is provided to you "as is" without warranty of any kind. The entire risk of usage and all it's consequences including data loss and hardware damage are with you.

If you do not agree to this license conditions please do not use our software and/or documentation.

Written entirely by Tomasz Nowak <tn@gridstore.com>
Sources of a informations and materials noticed inside
Web release by Antek Sawicki <tenox@tenox.tc>
Copyright © 2000-2015 Tomasz Nowak


KiUserApcDispatcher

Undocumented functions of NTDLL

2OO1, 10 December

KiUserApcDispatcher
KiUserApcDispatcher

NTSYSAPI
VOID
NTAPI

KiUserApcDispatcher(

  IN PVOID                Unused1,
  IN PVOID                Unused2,
  IN PVOID                Unused3,
  IN PVOID                ContextStart,
  IN PVOID                ContextBody );

  • Unused1
    • Unused parameters. Sometimes one of them have ntdll.dll module address.
  • Unused2
    • See Unused1.
  • Unused3
    • See Unused1.
  • ContextStart
    • Begining of ContextStart CONTEXT structure is stored.
  • ContextBody
    • Four bytes from CONTEXT structure at offset 0x04.

    KiUserApcDispatcher isn't standard ntdll function. It's used by kernel to process APC queue for calling thread. Five paraters I defined only for compatibility with ntdll.lib export (_KiUserApcDispatcher@20). Function first execute code placed after call, and next calls NtContinue with CONTEXT specified at 4 parameter position (Warning: Not pointer to CONTEXT, but CONTEXT body must be stored on stack).

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtAlertThread
    NtContinue
    NtQueueApcThread
    NtTestAlert


NtAlertThread

2OOO, 18 December

NtAlertThread
NtAlertThread

NTSYSAPI
NTSTATUS
NTAPI

NtAlertThread(

  IN HANDLE               ThreadHandle );

ThreadHandle
Handle to opened Thread Object.

NtAlertThread puts specified thread in alerted state.

Documented by:
Reactos
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtAlertResumeThread
NtTestAlert


NtCallbackReturn

2OO1, 3 March

NtCallbackReturn
NtCallbackReturn

NTSYSAPI
NTSTATUS
NTAPI

NtCallbackReturn(

  IN PVOID                Result OPTIONAL,
  IN ULONG                ResultLength,
  IN NTSTATUS             Status );

Function NtCallbackReturn finish execution of User-Mode callback.

  • Result
    • Pointer to user's allocated buffer with custom data.
  • ResultLength
    • Length of Result buffer, in bytes.
  • Status
    • Callback execution status code.

    Documented by:
    Reactos
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    KiUserCallbackDispatcher


NtQueueApcThread

2OOO, 1O December

NtQueueApcThread
NtQueueApcThread

NTSYSAPI
NTSTATUS
NTAPI

NtQueueApcThread(

  IN HANDLE               ThreadHandle,
  IN PIO_APC_ROUTINE      ApcRoutine,
  IN PVOID                ApcRoutineContext OPTIONAL,
  IN PIO_STATUS_BLOCK     ApcStatusBlock OPTIONAL,
  IN ULONG                ApcReserved OPTIONAL );

ThreadHandle
Open handle to any Thread Object, including caller's thread.

ApcRoutine
Entry point to user APC routine.

ApcRoutineContext
User defined parameter for ApcRoutine.

ApcStatusBlock
- ???

ApcReserved
- ???

Function adds user defined routine to thread's APC queue. This routine will be executed when thread will be signaled. You can manually empty APC queue by calling NtTestAlert.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
KiUserApcDispatcher
NtTestAlert


NtTestAlert

2OOO, 1O December

NtTestAlert
NtTestAlert

NTSYSAPI
NTSTATUS
NTAPI

NtTestAlert(

 );

You can use NtTestAlert to empty APC queue for current thread. If APC queue was empty before call, NtTestAlert has no efect.

NtTestAlert is typical ntcall kernel routine, accessable via int 2Eh. It check thread APC queue, and call KiUserApcDispatcher.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
KiUserApcDispatcher
NtQueueApcThread


NtAddAtom

2OO1, 1O February

NtAddAtom
NtAddAtom

NTSYSAPI
NTSTATUS
NTAPI

NtAddAtom(

  IN PWCHAR               AtomName,
  OUT PRTL_ATOM           Atom );

Function NtAddAtom creates new Atom in Global Atom Table. If Atom with the same name already exist, internal Atom counter is incremented.

  • AtomName
    • UNICODE Atom name.
  • Atom
    • Result of call - pointer to RTL_ATOM.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    ATOM_BASIC_INFORMATION
    NtDeleteAtom
    NtFindAtom
    NtQueryInformationAtom


NtDeleteAtom

2OO1, 1O February

NtDeleteAtom
NtDeleteAtom

NTSYSAPI
NTSTATUS
NTAPI

NtDeleteAtom(

  IN RTL_ATOM             Atom );

Function NtDeleteAtom remove Atom from Global Atom Table. If Atom's reference counter is greater then 1, function decrements this counter, but Atom stayed in Global Atom Table.

  • Atom
    • Atom identifier.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    ATOM_BASIC_INFORMATION
    NtAddAtom
    NtFindAtom
    NtQueryInformationAtom


NtFindAtom

2OO1, 1O February

NtFindAtom
NtFindAtom

NTSYSAPI
NTSTATUS
NTAPI

NtFindAtom(

  IN PWCHAR               AtomName,
  OUT PRTL_ATOM           Atom OPTIONAL );

Function NtFindAtom retrieve existing Atom's identifier without incrementing Atom's internal counter.

  • AtomName
    • Atom's name, in UNICODE format.
  • Atom
    • Result of call - Pointer to Atom's identifier.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    ATOM_BASIC_INFORMATION
    ATOM_TABLE_INFORMATION
    NtAddAtom
    NtDeleteAtom
    NtQueryInformationAtom


NtQueryInformationAtom

2OO1, 1O February

NtQueryInformationAtom
NtQueryInformationAtom

NTSYSAPI
NTSTATUS
NTAPI

NtQueryInformationAtom(

  IN RTL_ATOM             Atom,
  IN ATOM_INFORMATION_CLASS AtomInformationClass,
  OUT PVOID               AtomInformation,
  IN ULONG                AtomInformationLength,
  OUT PULONG              ReturnLength OPTIONAL );

NtQueryInformationAtom is used to get single Atom properties or to read Global Atom Table.

  • Atom
    • Atom to query. If AtomInformationClass parameter is AtomTableInformation, Atom parameter is not used.
  • AtomInformationClass
    • See ATOM_INFORMATION_CLASS enumeration type for details.
  • AtomInformation
    • Result of call - pointer to user's allocated buffer for data.
  • AtomInformationLength
    • Size of AtomInformation buffer, in bytes.
  • ReturnLength
    • Pointer to ULONG value contains required AtomInformation buffer size.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    ATOM_INFORMATION_CLASS
    ATOM_TABLE_INFORMATION
    NtAddAtom
    NtFindAtom


ATOM_INFORMATION_CLASS

2OO1, 1O February

ATOM_INFORMATION_CLASS
ATOM_INFORMATION_CLASS

typedef enum _ATOM_INFORMATION_CLASS {

    AtomBasicInformation,
    AtomTableInformation

} ATOM_INFORMATION_CLASS, *PATOM_INFORMATION_CLASS;

Enumeration type ATOM_INFORMATION_CLASS is used in a call to function NtQueryInformationAtom.

  • AtomBasicInformation
    • Result of call contains     ATOM_BASIC_INFORMATION structure.
  • AtomTableInformation
    • Result of call contains     ATOM_TABLE_INFORMATION structure.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    ATOM_BASIC_INFORMATION
    ATOM_TABLE_INFORMATION
    NtQueryInformationAtom


ATOM_BASIC_INFORMATION

2OO1, 1O February

ATOM_BASIC_INFORMATION
ATOM_BASIC_INFORMATION

typedef struct _ATOM_BASIC_INFORMATION {

  USHORT                  UsageCount;
  USHORT                  Flags;
  USHORT                  NameLength;
  WCHAR                   Name[1];

} ATOM_BASIC_INFORMATION, *PATOM_BASIC_INFORMATION;

ATOM_BASIC_INFORMATION structure is returned as a result of call NtQueryInformationAtom with AtomBasicInformation information class.

  • UsageCount
    • Internal Atom counter state. This value increments at every NtAddAtom call for current Atom, and it's decremented on every NtDeleteAtom function call.
  • Flags
    • (?), Only lowest bit is used.
  • NameLength
    • Size of Name array, in bytes.
  • Name[1]
    • Atom name.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    ATOM_INFORMATION_CLASS
    NtAddAtom
    NtDeleteAtom
    NtQueryInformationAtom


ATOM_TABLE_INFORMATION

2OO1, 1O February

ATOM_TABLE_INFORMATION
ATOM_TABLE_INFORMATION

typedef struct _ATOM_TABLE_INFORMATION {

  ULONG                   NumberOfAtoms;
  RTL_ATOM                Atoms[1];

} ATOM_TABLE_INFORMATION, *PATOM_TABLE_INFORMATION;

ATOM_TABLE_INFORMATION descriptes Global Atom Table. Is returned as a result of call NtQueryInformationAtom with AtomTableInformation information class.

  • NumberOfAtoms
    • Number of members in Atoms array.
  • Atoms[1]
    • Array of Global Atoms.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    ATOM_BASIC_INFORMATION
    ATOM_INFORMATION_CLASS
    NtQueryInformationAtom


RtlCompressBuffer

RtlCompressBuffer
RtlCompressBuffer

NTSYSAPI
NTSTATUS
NTAPI

RtlCompressBuffer(

  IN ULONG                CompressionFormat,
  IN PVOID                SourceBuffer,
  IN ULONG                SourceBufferLength,
  OUT PVOID               DestinationBuffer,
  IN ULONG                DestinationBufferLength,
  IN ULONG                Unknown,
  OUT PULONG              pDestinationSize,
  IN PVOID                WorkspaceBuffer );

CompressionFormat

Only lower 2 bytes are supported. Higher byte means Compression Engine. Lower byte means Compressing Format.

  • Compression format (0-15). Bits 4-7 are unused.
In NT 4.0 sp6 only LZNT1 is supported.

#define COMPRESSION_FORMAT_NONE		(0x0000)		// [result:STATUS_INVALID_PARAMETER]
#define COMPRESSION_FORMAT_DEFAULT	(0x0001)		// [result:STATUS_INVALID_PARAMETER]
#define COMPRESSION_FORMAT_LZNT1	(0x0002)
#define COMPRESSION_FORMAT_NS3		(0x0003)		// STATUS_NOT_SUPPORTED
#define ...							// STATUS_NOT_SUPPORTED
#define COMPRESSION_FORMAT_NS15		(0x000F)		// STATUS_NOT_SUPPORTED

#define COMPRESSION_FORMAT_SPARSE	(0x4000)		// ??? [result:STATUS_INVALID_PARAMETER]

  • Compression engine.
It's level of compression. Higher level means better results, but longer time used for compression process.
In NT 4.0 sp6 engines works only with compression (specified in RtlDecompressBuffer are ignored)

#define COMPRESSION_ENGINE_STANDARD	(0x0000)		// Standart compression
#define COMPRESSION_ENGINE_MAXIMUM	(0x0100)		// Maximum (slowest but better)
#define COMPRESSION_ENGINE_HIBER	(0x0200)		// STATUS_NOT_SUPPORTED

    •

    Unknown

    Put 0x1000 here. Propably means page size.

    pDestinationSize

    Size of data after compression.

    WorkspaceBuffer

    See RtlGetCompressionWorkSpaceSize for more information.

    Requirements:
    Library: ntdll.lib

    See also:
    RtlDecompressBuffer
    RtlGetCompressionWorkSpaceSize


RtlDecompressBuffer

RtlDecompressBuffer
RtlDecompressBuffer

NTSYSAPI
NTSTATUS
NTAPI

RtlDecompressBuffer(

  IN ULONG                CompressionFormat,
  OUT PVOID               DestinationBuffer,
  IN ULONG                DestinationBufferLength,
  IN PVOID                SourceBuffer,
  IN ULONG                SourceBufferLength,
  OUT PULONG              pDestinationSize );

CompressionFormat

See RtlCompressBuffer for possible compression formats. Compression engine is not used
in RtlDecompressBuffer.

Requirements:
Library: ntdll.lib

See also:
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize


RtlGetCompressionWorkSpaceSize

RtlGetCompressionWorkSpaceSize
RtlGetCompressionWorkSpaceSize

NTSYSAPI
NTSTATUS
NTAPI

RtlGetCompressionWorkSpaceSize(

  IN ULONG                CompressionFormat,
  OUT PULONG              pNeededBufferSize,
  OUT PULONG              pUnknown );

CompressionFormat

See RtlCompressBuffer for valid CompressionFormat flags.

pNeededBufferSize

You must allocate temporary compression buffer for system internal use in compression process.
Buffer must have pNeededBufferSize bytes length.

pUnknown

-?, propably PageSize (0x4000).

Requirements:
Library: ntdll.lib

See also:
RtlCompressBuffer
RtlDecompressBuffer


DbgPrint

2OOO, 14 November

DbgPrint
DbgPrint

NTSYSAPI
NTSTATUS
NTAPI

DbgPrint(

  IN LPCSTR               Format,
  ... );

Function works like a normal C printf routine, but result is streamed to debug output.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:


NtSystemDebugControl

2OO1, 4 March

NtSystemDebugControl
NtSystemDebugControl

NTSYSAPI
NTSTATUS
NTAPI

NtSystemDebugControl(

  IN SYSDBG_COMMAND       Command,
  IN PVOID                InputBuffer OPTIONAL,
  IN ULONG                InputBufferLength,
  OUT PVOID               OutputBuffer OPTIONAL,
  IN ULONG                OutputBufferLength,
  OUT PULONG              ReturnLength OPTIONAL );

Function NtSystemDebugControl is used by some low-level debuggers written by Microsoft and avaiable typically in DDK.

  • Command
    • Command request for system. Command's codes are avaiable in enumeration type SYSDBG_COMMAND.
  • InputBuffer
    • User's allocated buffer with input data.
  • InputBufferLength
    • Length of InputBuffer, in bytes.
  • OutputBuffer
    • User's allocated buffer for output data.
  • OutputBufferLength
    • Length of OutputBuffer, in bytes.
  • ReturnLength
    • Pointer to ULONG value receiving required size of OutputBuffer.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    SYSDBG_COMMAND


RtlCaptureStackBackTrace

2OO5, 2 February

RtlCaptureStackBackTrace
RtlCaptureStackBackTrace

NTSYSAPI
USHORT
NTAPI

RtlCaptureStackBackTrace(

  IN ULONG                FramesToSkip,
  IN ULONG                FramesToCapture,
  OUT PVOID               *BackTrace,
  OUT PULONG              BackTraceHash );

Function RtlCaptureStackBackTrace is usefull for debugging and analysing problems by making complete trace of calling functions by processing stack.
  • FramesToSkip
    • How many stack entries should be skiped.
  • FramesToCapture
    • Length of BackTrace buffer array.
  • BackTrace
    • Array of caller's addresses.
  • BackTraceHash
    • Unknown...

    As result function returns number of entries filled in BackTrace buffer, or zero in case of error.

    Supported on system versions:
    NT 4.0,Win 2000,Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    RtlGetCallersAddress


RtlGetCallersAddress

2OO5, 2 February

RtlGetCallersAddress
RtlGetCallersAddress

NTSYSAPI
PVOID
NTAPI

RtlGetCallersAddress(

  OUT PVOID               *CallersAddress,
  OUT PVOID               *CallersCaller );

Routine RtlGetCallersAddress is usefull in program debugging or exceptions control. It returns address of calling instruction.
  • CallersAddress
    • Returns address in body of function that call RtlGetCallersAddress.
  • CallersCaller
    • Returns address in function's calling function that call RtlGetCallersAddress body.

    Supported on system versions:
    NT 4.0,Win 2000,Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    RtlCaptureStackBackTrace


SYSDBG_COMMAND

2OO1, 4 March

SYSDBG_COMMAND
SYSDBG_COMMAND

typedef enum _SYSDBG_COMMAND {

    SysDbgQueryModuleInformation=1,
    SysDbgQueryTraceInformation,
    SysDbgSetTracepoint,
    SysDbgSetSpecialCall,
    SysDbgClearSpecialCalls,
    SysDbgQuerySpecialCalls

} SYSDBG_COMMAND, *PSYSDBG_COMMAND;

Enumeration type SYSDBG_COMMAND is used as a command number in a call to NtSystemDebugControl function.

  • SysDbgQueryModuleInformation
    • (?)
  • SysDbgQueryTraceInformation
    • (?)
  • SysDbgSetTracepoint
    • (?)
  • SysDbgSetSpecialCall
    • (?)
  • SysDbgClearSpecialCalls
    • (?)
  • SysDbgQuerySpecialCalls
    • (?)

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtSystemDebugControl


NtDisplayString

2OO1, 19 February

NtDisplayString
NtDisplayString

NTSYSAPI
NTSTATUS
NTAPI

NtDisplayString(

  IN PUNICODE_STRING      String );

Function NtDisplayString display specified string in text-mode (typically: blue screen).
Warning: Trying to display string without previously switch to text-mode results as system hang.

  • String
    • Pointer to UNICODE_STRING contains string to display. Some basic control characters are implemented (like CR, LF).

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib
    Privilege: SE_TCB_PRIVILEGE


NtRaiseException

2OO1, 2 March

NtRaiseException
NtRaiseException

NTSYSAPI
NTSTATUS
NTAPI

NtRaiseException(

  IN PEXCEPTION_RECORD    ExceptionRecord,
  IN PCONTEXT             ThreadContext,
  IN BOOLEAN              HandleException );

Function NtRaiseException is typically used inside KiUserExceptionDispatcher function for inform system about exception in current process.

  • ExceptionRecord
    • Pointer to EXCEPTION_RECORD structure containing typical information about error.
  • ThreadContext
    • Pointer to CONTEXT structure.
  • HandleException
    • If not set, calling process is killed. If set, system tries to execute actually enabled Exception Handler procedure with parameters specified aa ExceptionRecord and ThreadContext.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    KiUserExceptionDispatcher
    NtGetContextThread
    NtRaiseHardError


NtRaiseHardError

2OO1, 4 February

NtRaiseHardError
NtRaiseHardError

NTSYSAPI
NTSTATUS
NTAPI

NtRaiseHardError(

  IN NTSTATUS             ErrorStatus,
  IN ULONG                NumberOfParameters,
  IN PUNICODE_STRING      UnicodeStringParameterMask OPTIONAL,
  IN PVOID                *Parameters,
  IN HARDERROR_RESPONSE_OPTION ResponseOption,
  OUT PHARDERROR_RESPONSE Response );

This function sends HARDERROR_MSG LPC message to listener (typically CSRSS.EXE). See NtSetDefaultHardErrorPort for more information.
  • ErrorStatus
    • Error code.
  • NumberOfParameters
    • Number of optional parameters in Parameters array.
  • UnicodeStringParameterMask
    • Optional string parameter (can be only one per error code).
  • *Parameters
    • Array of DWORD parameters for use in error message string.
  • ResponseOption
    • See HARDERROR_RESPONSE_OPTION for possible values description.
  • Response
    • Pointer to HARDERROR_RESPONSE enumeration.

    NtRaiseHardError is easy way to display message in GUI without loading Win32 API libraries.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    HARDERROR_MSG
    HARDERROR_RESPONSE
    HARDERROR_RESPONSE_OPTION
    NtSetDefaultHardErrorPort


NtSetDefaultHardErrorPort

2OO1, 4 February

NtSetDefaultHardErrorPort
NtSetDefaultHardErrorPort

NTSYSAPI
NTSTATUS
NTAPI

NtSetDefaultHardErrorPort(

  IN HANDLE               PortHandle );

NtSetDefaultHardErrorPort is typically called only once. After call, kernel set BOOLEAN flag named _ExReadyForErrors to TRUE, and all other tries to change default port are broken with STATUS_UNSUCCESSFUL error code.

  • PortHandle
    • HANDLE to named Port Object.

    Listener of default HardError port receive HARDERROR_MSG LPC messages when any process call NtRaiseHardError function.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib
    Privileges: SE_TCB_PRIVILEGE

    See also:
    HARDERROR_MSG
    NtRaiseHardError


HARDERROR_RESPONSE

2OO1, 4 February

HARDERROR_RESPONSE
HARDERROR_RESPONSE

typedef enum _HARDERROR_RESPONSE {

    ResponseReturnToCaller,
    ResponseNotHandled,
    ResponseAbort,
    ResponseCancel,
    ResponseIgnore,
    ResponseNo,
    ResponseOk,
    ResponseRetry,
    ResponseYes

} HARDERROR_RESPONSE, *PHARDERROR_RESPONSE;

This enumeration type is used as a result of call NtRaiseHardError and specify user's response for error message.
  • ResponseReturnToCaller
    • - ???
  • ResponseNotHandled
    • - ???
  • ResponseAbort
    • ABORT button was pressed.
  • ResponseCancel
    • CANCEL button was pressed.
  • ResponseIgnore
    • IGNORE button was pressed.
  • ResponseNo
    • NO button was pressed.
  • ResponseOk
    • OK button was pressed.
  • ResponseRetry
    • RETRY button was pressed.
  • ResponseYes
    • YES button was pressed.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtRaiseHardError


HARDERROR_RESPONSE_OPTION

2OO1, 4 February

HARDERROR_RESPONSE_OPTION
HARDERROR_RESPONSE_OPTION

typedef enum _HARDERROR_RESPONSE_OPTION {

    OptionAbortRetryIgnore,
    OptionOk,
    OptionOkCancel,
    OptionRetryCancel,
    OptionYesNo,
    OptionYesNoCancel,
    OptionShutdownSystem

} HARDERROR_RESPONSE_OPTION, *PHARDERROR_RESPONSE_OPTION;

This enumerated type is used for specify type of MessageBox with error description in a call to NtRaiseHardError.
  • OptionAbortRetryIgnore
    • Visible buttons: ABORT, RETRY, IGNORE
  • OptionOk
    • Visible buttons: OK
  • OptionOkCancel
    • Visible buttons: OK, CANCEL
  • OptionRetryCancel
    • Visible buttons: RETRY, CANCEL
  • OptionYesNo
    • Visible buttons: YES, NO
  • OptionYesNoCancel
    • Visible buttons: YES, NO, CANCEL
  • OptionShutdownSystem
    • - ???

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtRaiseHardError


HARDERROR_MSG

2OO1, 4 February

HARDERROR_MSG
HARDERROR_MSG

typedef struct _HARDERROR_MSG {

  LPC_MESSAGE             LpcMessageHeader;
  NTSTATUS                ErrorStatus;
  LARGE_INTEGER           ErrorTime;
  HARDERROR_RESPONSE_OPTION ResponseOption;
  HARDERROR_RESPONSE      Response;
  ULONG                   NumberOfParameters;
  PVOID                   UnicodeStringParameterMask;
  ULONG                   Parameters[MAXIMUM_HARDERROR_PARAMETERS];

} HARDERROR_MSG, *PHARDERROR_MSG;

Structure HARDERROR_MSG is send to LPC server in a result of call NtRaiseHardError. Most of stucture's members are the same as parameters specified in this call.
  • LpcMessageHeader
    • Message header - see LPC_MESSAGE description.
  • ErrorStatus
    • Error code.
  • ErrorTime
    • Time when error was signaled.
  • ResponseOption
    • See HARDERROR_RESPONSE_OPTION for possible values.
  • Response
    • See HARDERROR_RESPONSE for possible values.
  • NumberOfParameters
    • Number of parameters in Parameters array. Maximum parameters number is defined as:
    #define MAXIMUM_HARDERROR_PARAMETERS 4
  • UnicodeStringParameterMask
    • Pointer to UNICODE_STRING in port's client address space
  • Parameters[MAXIMUM_HARDERROR_PARAMETERS]
    • Array of DWORD parameters.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    HARDERROR_RESPONSE
    HARDERROR_RESPONSE_OPTION
    NtRaiseHardError
    NtSetDefaultHardErrorPort


NtQuerySystemEnvironmentValue

2OOO, 3 December

NtQuerySystemEnvironmentValue
NtQuerySystemEnvironmentValue

NTSYSAPI
NTSTATUS
NTAPI

NtQuerySystemEnvironmentValue(

  IN PUNICODE_STRING      VariableName,
  OUT PWCHAR              Value,
  IN ULONG                ValueBufferLength,
  OUT PULONG              RequiredLength OPTIONAL );

Seems not works on NT 4.0 SP6. Control Panel applet query and set System Environment values by Rtl...Environment functions or directly by registry.

Documented by:
Reactos
Tomasz Nowak

Requirements:
Library: ntdll.lib
Privilege: SE_SYSTEM_ENVIRONMENT_NAME

See also:
RtlQueryEnvironmentVariable_U
RtlSetEnvironmentVariable


NtSetSystemEnvironmentValue

2OOO, 3 December

NtSetSystemEnvironmentValue
NtSetSystemEnvironmentValue

NTSYSAPI
NTSTATUS
NTAPI

NtSetSystemEnvironmentValue(

  IN PUNICODE_STRING      VariableName,
  IN PUNICODE_STRING      Value );

Seems not works on NT 4.0 SP6...

Documented by:
Reactos
Tomasz Nowak

Requirements:
Library: ntdll.lib
Privilege: SE_SYSTEM_ENVIRONMENT_NAME

See also:
NtQuerySystemEnvironmentValue
RtlSetEnvironmentVariable


RtlCreateEnvironment

2OOO, 26 November

RtlCreateEnvironment
RtlCreateEnvironment

NTSYSAPI
NTSTATUS
NTAPI

RtlCreateEnvironment(

  IN BOOLEAN              Inherit,
  OUT PVOID               *Environment );

Inherit
If set, newly created environment are similar to caller's environment.

*Environment
RtlCreateEnvironment allocate memory in caller's address space, and fills it with new environment block. Environment is pointer to this block.

Documented by:
Reactos
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
RtlCreateProcessParameters
RtlInitializeContext


RtlDestroyEnvironment

2OOO, 3 December

RtlDestroyEnvironment
RtlDestroyEnvironment

NTSYSAPI
VOID
NTAPI

RtlDestroyEnvironment(

  IN PVOID                Environment );

Environment
Pointer to allocated environment block.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
RtlCreateEnvironment


RtlExpandEnvironmentStrings_U

2OOO, 3 December

RtlExpandEnvironmentStrings_U
RtlExpandEnvironmentStrings_U

NTSYSAPI
NTSTATUS
NTAPI

RtlExpandEnvironmentStrings_U(

  IN PVOID                Environment OPTIONAL,
  IN PUNICODE_STRING      SourceString,
  OUT PUNICODE_STRING     DestinationString,
  OUT PULONG              DestinationBufferLength OPTIONAL );

Environment
Pointer to environment block.

SourceString
Pointer to UNICODE_STRING structure with text. If text contains any environment variable name separated with '%' character, variable name is replaced by value of this variable.

DestinationString
Result of above operation. At input only MaximumLength of UNICODE_STRING structure must be valid.

DestinationBufferLength
If you don't know, how long should be result buffer, use value at DestinationBufferLength pointer.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
RtlQueryEnvironmentVariable_U
RtlSetEnvironmentVariable


RtlQueryEnvironmentVariable_U

2OOO, 3 December

RtlQueryEnvironmentVariable_U
RtlQueryEnvironmentVariable_U

NTSYSAPI
NTSTATUS
NTAPI

RtlQueryEnvironmentVariable_U(

  IN PVOID                Environment OPTIONAL,
  IN PUNICODE_STRING      VariableName,
  OUT PUNICODE_STRING     VariableValue );

Environment
Pointer to environment block. If NULL, current environment is used.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
RtlSetEnvironmentVariable


RtlSetCurrentEnvironment

2OOO, 3 December

RtlSetCurrentEnvironment
RtlSetCurrentEnvironment

NTSYSAPI
VOID
NTAPI

RtlSetCurrentEnvironment(

  IN PVOID                NewEnvironment,
  OUT PVOID               *OldEnvironment OPTIONAL );

NewEnvironment
Pointer to newly created environment block.

OldEnvironment
Return pointer to previous environment block. You should release it by call RtlDestroyEnvironment.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
RtlCreateEnvironment
RtlDestroyEnvironment


RtlSetEnvironmentVariable

2OOO, 3 December

RtlSetEnvironmentVariable
RtlSetEnvironmentVariable

NTSYSAPI
NTSTATUS
NTAPI

RtlSetEnvironmentVariable(

  IN OUT PVOID            *Environment OPTIONAL,
  IN PUNICODE_STRING      VariableName,
  IN PUNICODE_STRING      VariableValue );

*Environment
If Environment is NULL, current environment block is used.
If Environment point to NULL value, new environment block is allocated and variable is set in new block.
If you can set variable in not currently set env. block, set as Environment pointer to that block.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
RtlCreateEnvironment
RtlQueryEnvironmentVariable_U
RtlSetCurrentEnvironment


LdrGetDllHandle

LdrGetDllHandle
LdrGetDllHandle

NTSYSAPI
NTSTATUS
NTAPI

LdrGetDllHandle(

  IN PWORD                pwPath OPTIONAL,
  IN PVOID                Unused OPTIONAL,
  IN PUNICODE_STRING      ModuleFileName,
  OUT PHANDLE             pHModule );

pwPath

- ???

Unused

- ???

ModuleFileName

Path to file + Dll name, in NT directory format.

pHModule

Pointer to received HMODULE. See LdrLoadDll for more info.

Requirements:
Library: ntdll.lib

See also:
LdrGetProcedureAddress
LdrLoadDll
LdrUnloadDll


LdrGetProcedureAddress

LdrGetProcedureAddress
LdrGetProcedureAddress

NTSYSAPI
NTSTATUS
NTAPI

LdrGetProcedureAddress(

  IN HMODULE              ModuleHandle,
  IN PANSI_STRING         FunctionName OPTIONAL,
  IN WORD                 Oridinal OPTIONAL,
  OUT PVOID               *FunctionAddress );

FunctionName

Is optional, but you must declare one of FunctionName or Oridinal. In Microsoft concept, you should use both parameters,
for faster function implementation. But there's a bug in link.exe, and all oridinals in PE executables are wrong...

Requirements:
Library: ntdll.lib

See also:
LdrLoadDll


LdrLoadDll

2OOO, 12 October

LdrLoadDll
LdrLoadDll

NTSYSAPI
NTSTATUS
NTAPI

LdrLoadDll(

  IN PWCHAR               PathToFile OPTIONAL,
  IN ULONG                Flags OPTIONAL,
  IN PUNICODE_STRING      ModuleFileName,
  OUT PHANDLE             ModuleHandle );

Flags

See WINAPI LoadLibraryEx for possibbilitied flags.

ModuleHandle

Address of MZ header in virtual memory of caller's process.

Requirements:
Library: ntdll.lib

See also:
NtLoadDriver
NtUnloadDriver


LdrQueryProcessModuleInformation

2OOO, 22 October

LdrQueryProcessModuleInformation
LdrQueryProcessModuleInformation

NTSYSAPI
NTSTATUS
NTAPI

LdrQueryProcessModuleInformation(

  OUT PSYSTEM_MODULE_INFORMATION SystemModuleInformationBuffer,
  IN ULONG                BufferSize,
  OUT PULONG              RequiredSize OPTIONAL );

Use for enumerate modules loaded with current process.

BufferSize

Required minimum size is sizeof(SYSTEM_MODULE_INFORMATION) (4 bytes).
Example results:

Name | Path | Res01 | Res02 | Address | Size | Flags | ID | Rank | w18
EnumModules.exe | D:\Program Files\Microsoft Visual Studio\MyProject... | BAADF00D | 00000000 | 00400000 | 00016000 | 00005000 | 000 | 0006 | 65535
ntdll.dll | C:\WINNT\System32\ntdll.dll | BAADF00D | 00000000 | 77F60000 | 0005F000 | 00004004 | 001 | 0001 | 65535
KERNEL32.dll | C:\WINNT\system32\KERNEL32.dll | BAADF00D | 00000000 | 77F00000 | 00060000 | 000C4006 | 002 | 0002 | 65535
USER32.dll | C:\WINNT\system32\USER32.dll | BAADF00D | 00000000 | 77E70000 | 00055000 | 00084006 | 003 | 0006 | 65535
GDI32.dll | C:\WINNT\system32\GDI32.dll | BAADF00D | 00000000 | 77ED0000 | 0002C000 | 00004006 | 004 | 0005 | 65535
ADVAPI32.dll | C:\WINNT\system32\ADVAPI32.dll | BAADF00D | 00000000 | 77DC0000 | 0003F000 | 000C4006 | 005 | 0004 | 65535
RPCRT4.dll | C:\WINNT\system32\RPCRT4.dll | BAADF00D | 00000000 | 77E10000 | 00057000 | 000C4006 | 006 | 0003 | 65535

Requirements:
Library: ntdll.lib

See also:
SYSTEM_MODULE
SYSTEM_MODULE_INFORMATION


LdrShutdownProcess

2OOO, 4 November

LdrShutdownProcess
LdrShutdownProcess

NTSYSAPI
VOID
NTAPI

LdrShutdownProcess();

Kernel32.dll use this after call to NtTerminateProcess.

Requirements:
Library: ntdll.lib

See also:
NtTerminateProcess
LdrShutdownThread


LdrShutdownThread

2OOO, 4 November

LdrShutdownThread
LdrShutdownThread

NTSYSAPI
VOID
NTAPI

LdrShutdownThread();

Requirements:

Library: ntdll.lib

See also:

LdrShutdownProcess


LdrUnloadDll

2OOO, 12 October

LdrUnloadDll
LdrUnloadDll

NTSYSAPI
NTSTATUS
NTAPI

LdrUnloadDll(

  IN HANDLE               ModuleHandle );

ModuleHandle

In fact, ModuleHandle is virtual address of loaded module, not a typical HANDLE to object.

Requirements:
Library: ntdll.lib

See also:
LdrLoadDll
NtLoadDriver
NtUnloadDriver


NtLoadDriver

NtLoadDriver
NtLoadDriver

NTSYSAPI
NTSTATUS
NTAPI

NtLoadDriver(

  IN PUNICODE_STRING DriverServiceName );

DriverServiceName
Registry path in system format. Path must begin with "\\registry\\machine\\SYSTEM\\CurrentControlSet\\Services\\..." where "..." is driver symbolic name.
Key must have at least 2 values:
  • "ImagePath" System path to file, in UNICODE format
  • "Type" Set to 1.

    • Requirements:
    Library: ntdll.lib
    Privilege: SeLoadDriverPrivilege

    See also:
    NtUnloadDriver


NtUnloadDriver

NtUnloadDriver
NtUnloadDriver

NTSYSAPI
NTSTATUS
NTAPI

NtUnloadDriver(

  IN PUNICODE_STRING DriverServiceName );

DriverServiceName
Registry path in system format.

Requirements:
Library: ntdll.lib
Privilege: SeLoadDriverPrivilege

See also:
NtLoadDriver


RtlImageNtHeader

2OOO, 18 October

RtlImageNtHeader
RtlImageNtHeader

NTSYSAPI
PIMAGE_NT_HEADERS
NTAPI

RtlImageNtHeader(

  IN PVOID                ModuleAddress );

ModuleAddress

Is module base address in process virtual memory, known as HMODULE.

Return value

Is pointer to IMAGE_NT_HEADERS structure.

Requirements:
Library: ntdll.lib

See also:
LdrGetDllHandle
LdrLoadDll
RtlImageRvaToVa


RtlImageRvaToVa

2OOO, 18 October

RtlImageRvaToVa
RtlImageRvaToVa

NTSYSAPI
PVOID
NTAPI

RtlImageRvaToVa(

  IN PIMAGE_NT_HEADERS    NtHeaders,
  IN PVOID                ModuleBase,
  IN ULONG                Rva,
  IN OUT PIMAGE_SECTION_HEADER pLastSection OPTIONAL );

Return value

It's pointer to vitrual memory in caller's address space.

See ImageRvaToVa in <Dbghelp.h> for detailed description of use.

Requirements:
Library: ntdll.lib

See also:
LdrGetDllHandle
LdrLoadDll
RtlImageNtHeader


NtFlushWriteBuffer

2OO1, 3 March

NtFlushWriteBuffer
NtFlushWriteBuffer

NTSYSAPI
NTSTATUS
NTAPI

NtFlushWriteBuffer(

 );

Function NtFlushWriteBuffer does nothing...

It test IRQ Level, and call HAL export named KeFlushWriteBuffer.

KeFlushWriteBuffer as first asm code has ret, so it returns immediatelly.

Next NtFlushWriteBuffer clear eax (set result of call to STATUS_SUCCESS) and returns to User-Mode.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib


NtShutdownSystem

2OO1, 25 February

NtShutdownSystem
NtShutdownSystem

NTSYSAPI
NTSTATUS
NTAPI

NtShutdownSystem(

  IN SHUTDOWN_ACTION      Action );

Function NtShutdownSystem closes system. Caller should manually inform running processes about pending shutdown action.

  • Action
    • Type of shudown defined in SHUTDOWN_ACTION enumeration type.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib
    Privilege: SE_SHUTDOWN_PRIVILEGE

    See also:
    SHUTDOWN_ACTION


SHUTDOWN_ACTION

2OO1, 25 February

SHUTDOWN_ACTION
SHUTDOWN_ACTION

typedef enum _SHUTDOWN_ACTION {

    ShutdownNoReboot,
    ShutdownReboot,
    ShutdownPowerOff

} SHUTDOWN_ACTION, *PSHUTDOWN_ACTION;

Enumeration type SHUTDOWN_ACTION is used in a call to NtShutdownSystem function.

  • ShutdownNoReboot
    • Normal shutdown, after system closes, processor jump into infinite loop.
  • ShutdownReboot
    • BIOS Reset function is called, after system closes.
  • ShutdownPowerOff
    • BIOS Shutdown function is called after system closes. If hardware does not support this functionality, ShutdownReboot is automatically called.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtShutdownSystem


NtQueryDefaultLocale

2OO1, 19 February

NtQueryDefaultLocale
NtQueryDefaultLocale

NTSYSAPI
NTSTATUS
NTAPI

NtQueryDefaultLocale(

  IN BOOLEAN              UserProfile,
  OUT PLCID               DefaultLocaleId );

Function NtQueryDefaultLocale returns current Locale Identifier. Locale Identifier if defined as DWORD value, and contains locale code, sublocale etc. For more information about LCID see Microsoft SDK.

  • UserProfile
    • If set, function returns UserMode default locale. If not, result is system locale.
  • DefaultLocaleId
    • Pointer to LCID value receiving current locale.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtSetDefaultLocale


NtSetDefaultLocale

2OO1, 19 February

NtSetDefaultLocale
NtSetDefaultLocale

NTSYSAPI
NTSTATUS
NTAPI

NtSetDefaultLocale(

  IN BOOLEAN              UserProfile,
  IN LCID                 DefaultLocaleId );

Function NtSetDefaultLocale sets default Kernel or User Mode locale. See Microsoft SDK for detailed description about locale codes.

  • UserProfile
    • If set, function sets UserMode locale. If not, KernelMode locale is modified.
  • DefaultLocaleId
    • Locale to set.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtQueryDefaultLocale


RtlAllocateHeap

2OOO, 14 December

RtlAllocateHeap
RtlAllocateHeap

NTSYSAPI
PVOID
NTAPI

RtlAllocateHeap(

  IN PVOID                HeapHandle,
  IN ULONG                Flags,
  IN ULONG                Size );

Function maps Win32 API HeapCreate, see Ms SDK.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtAllocateVirtualMemory
RtlCreateHeap


RtlCompactHeap

2OOO, 14 December

RtlCompactHeap
RtlCompactHeap

NTSYSAPI
ULONG
NTAPI

RtlCompactHeap(

  IN HANDLE               HeapHandle,
  IN ULONG                Flags );

HeapHandle
Heap address.

Flags
See RtlCreateHeap for more information.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
RtlAllocateHeap
RtlCreateHeap
RtlDestroyHeap


RtlCreateHeap

2OOO, 14 December

RtlCreateHeap
RtlCreateHeap

NTSYSAPI
PVOID
NTAPI

RtlCreateHeap(

  IN ULONG                Flags,
  IN PVOID                Base OPTIONAL,
  IN ULONG                Reserve OPTIONAL,
  IN ULONG                Commit,
  IN BOOLEAN              Lock OPTIONAL,
  IN PRTL_HEAP_DEFINITION RtlHeapParams OPTIONAL );

Flags
Flags are defined in <WinNT.h>. Can be one of following:
    HEAP_NO_SERIALIZE
    HEAP_GROWABLE
    HEAP_GENERATE_EXCEPTIONS
    HEAP_ZERO_MEMORY
    HEAP_REALLOC_IN_PLACE_ONLY
    HEAP_TAIL_CHECKING_ENABLED
    HEAP_FREE_CHECKING_ENABLED
    HEAP_DISABLE_COALESCE_ON_FREE
    HEAP_CREATE_ALIGN_16
    HEAP_CREATE_ENABLE_TRACING

Base
Base address, where heap should be created. If memory was previously allocated at this address, heap is created at the nearest possibble virtual address.

Reserve
How much bytes should be reserved. See NtAllocateVirtualMemory.

Commit
How meny bytes should be commited. If Reserve is greater than zero, Commit must be less or equal to Reserve.

Lock
If set, heap will be locked. See RtlLockHeap / RtlUnlockHeap.

RtlHeapParams
Pointer to RTL_HEAP_DEFINITION structure. On NT 4.0 all bytes of this (except length field) are set to zero.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
NtAllocateVirtualMemory
NtLockVirtualMemory
RTL_HEAP_DEFINITION
RtlDestroyHeap
RtlLockHeap
RtlUnlockHeap


RtlDestroyHeap

2OOO, 4 November

RtlDestroyHeap
RtlDestroyHeap

NTSYSAPI
NTSTATUS
NTAPI

RtlDestroyHeap(

  IN PVOID               HeapHandle );

HeapHandle
Pointer to heap memory block.

Requirements:
Library: ntdll.lib

See also:
RtlGetProcessHeaps
RtlCreateHeap


RtlEnumProcessHeaps

2OOO, 14 December

RtlEnumProcessHeaps
RtlEnumProcessHeaps

NTSYSAPI
NTSTATUS
NTAPI

RtlEnumProcessHeaps(

  IN PHEAP_ENUMERATION_ROUTINE HeapEnumerationRoutine,
  IN PVOID                Param OPTIONAL );

PHEAP_ENUMERATION_ROUTINE is defined as follows:

typedef NTSTATUS
(*PHEAP_ENUMERATION_ROUTINE)(
        IN PVOID HeapHandle,
        IN PVOID UserParam
        );

HeapEnumerationRoutine
User function address.

Param
User defined parameter, will be placed as UserParam in every HeapEnumerationRoutine calls.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
RtlGetProcessHeaps


RtlFreeHeap

2OOO, 14 December

RtlFreeHeap
RtlFreeHeap

NTSYSAPI
BOOLEAN
NTAPI

RtlFreeHeap(

  IN PVOID                HeapHandle,
  IN ULONG                Flags OPTIONAL,
  IN PVOID                MemoryPointer );

Maps directly to Win32 API HeapFree from Kernel32.dll.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtFreeVirtualMemory
RtlAllocateHeap


RtlGetProcessHeaps

2OOO, 4 November

RtlGetProcessHeaps
RtlGetProcessHeaps

NTSYSAPI
ULONG
NTAPI

RtlGetProcessHeaps(

  IN ULONG                MaxNumberOfHeaps,
  OUT PVOID               *HeapArray );

MaxNumberOfHeaps
Size of HeapArray.

Return value:
Number of process heaps.

Requirements:
Library: ntdll.lib

See also:
RtlEnumProcessHeaps


RtlLockHeap

2OOO, 14 December

RtlLockHeap
RtlLockHeap

NTSYSAPI
BOOLEAN
NTAPI

RtlLockHeap(

  IN PVOID                HeapHandle );

HeapHandle
Heap address.

Function protect locks virtual memory. See NtLockVirtualMemory for additional information.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtLockVirtualMemory
RtlUnlockHeap


RtlProtectHeap

2OOO, 14 December

RtlProtectHeap
RtlProtectHeap

NTSYSAPI
PVOID
NTAPI

RtlProtectHeap(

  IN PVOID                HeapHandle,
  IN BOOLEAN              Protect );

HeapHandle
Address of heap.

Protect
If set, memory is protected to PAGE_READONLY. If zero, protect with PAGE_READWRITE.

Return value
Result is address of protected or unprotected heap.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtProtectVirtualMemory
RtlLockHeap


RtlReAllocateHeap

2OOO, 14 December

RtlReAllocateHeap
RtlReAllocateHeap

NTSYSAPI
PVOID
NTAPI

RtlReAllocateHeap(

  IN PVOID                HeapHandle,
  IN ULONG                Flags,
  IN PVOID                MemoryPointer,
  IN ULONG                Size );

Kernel32.dll HeapReAlloc maps directly to RtlReAllocateHeap. All parameters are descripted in Ms SDK.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
RtlAllocateHeap
RtlCreateHeap
RtlFreeHeap


RtlSizeHeap

2OOO, 14 December

RtlSizeHeap
RtlSizeHeap

NTSYSAPI
ULONG
NTAPI

RtlSizeHeap(

  IN PVOID                HeapHandle,
  IN ULONG                Flags,
  IN PVOID                MemoryPointer );

Kernel32.dll HeapSize maps directly to RtlSizeHeap. See Ms SDK for definition.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
RtlCreateHeap


RtlUnlockHeap

2OOO, 14 December

RtlUnlockHeap
RtlUnlockHeap

NTSYSAPI
BOOLEAN
NTAPI

RtlUnlockHeap(

  IN PVOID                HeapHandle );

HeapHandle
Address of heap.

See RtlLockHeap for details.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
RtlCreateHeap
RtlLockHeap


RtlValidateHeap

2OOO, 14 December

RtlValidateHeap
RtlValidateHeap

NTSYSAPI
BOOLEAN
NTAPI

RtlValidateHeap(

  IN PVOID                HeapHandle,
  IN ULONG                Flags,
  IN PVOID                AddressToValidate OPTIONAL );

HeapHandle
Address of heap to validate.

Flags
See RtlCreateHeap.

AddressToValidate
If specified, only one block is validated. If not, all blocks from heap are validated.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
RtlValidateProcessHeaps


RtlValidateProcessHeaps

2OOO, 14 December

RtlValidateProcessHeaps
RtlValidateProcessHeaps

NTSYSAPI
BOOLEAN
NTAPI

RtlValidateProcessHeaps(

 );

Function validate all heaps associated with calling process. See RtlValidateHeap for more information.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
RtlGetProcessHeaps
RtlValidateHeap


RtlWalkHeap

2OOO, 14 December

RtlWalkHeap
RtlWalkHeap

NTSYSAPI
NTSTATUS
NTAPI

RtlWalkHeap(

  IN PVOID                HeapHandle,
  IN OUT LPPROCESS_HEAP_ENTRY ProcessHeapEntry );

HeapHandle
Address of heap.

ProcessHeapEntry
Pointer to PROCESS_HEAP_ENTRY structure defined in <WinNT.h>.

Return value
Repeat calls to RtlWalkHeap until result is STATUS_NO_MORE_ENTRIES.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
RtlAllocateHeap


RTL_HEAP_DEFINITION

2OOO, 14 December

RTL_HEAP_DEFINITION
RTL_HEAP_DEFINITION

typedef struct _RTL_HEAP_DEFINITION {

  ULONG                   Length;
  ULONG                   Unknown1;
  ULONG                   Unknown2;
  ULONG                   Unknown3;
  ULONG                   Unknown4;
  ULONG                   Unknown5;
  ULONG                   Unknown6;
  ULONG                   Unknown7;
  ULONG                   Unknown8;
  ULONG                   Unknown9;
  ULONG                   Unknown10;
  ULONG                   Unknown11;
  ULONG                   Unknown12;

} RTL_HEAP_DEFINITION, *PRTL_HEAP_DEFINITION;

Documented by:
Reactos

Requirements:
Library: ntdll.lib

See also:
RtlCreateHeap


NtAllocateVirtualMemory

2OOO, 3 December

NtAllocateVirtualMemory
NtAllocateVirtualMemory

NTSYSAPI
NTSTATUS
NTAPI

NtAllocateVirtualMemory(

  IN HANDLE               ProcessHandle,
  IN OUT PVOID            *BaseAddress,
  IN ULONG                ZeroBits,
  IN OUT PULONG           RegionSize,
  IN ULONG                AllocationType,
  IN ULONG                Protect );

ProcessHandle
Handle to Process Object opened with PROCESS_VM_OPERATION access.

*BaseAddress
If not zero, system tries to allocate virtual memory block on this virtual address. If BaseAddress is zero, system use first free virtual location.

AllocationType
Can be MEM_RESERVE or MEM_COMMIT.

Protect
One or combination of PAGE_*** attributes.

Documented by:
Reactos
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtFreeVirtualMemory
NtMapViewOfSection


NtFlushVirtualMemory

2OO4, 28 January

NtFlushVirtualMemory
NtFlushVirtualMemory

NTSYSAPI
NTSTATUS
NTAPI

NtFlushVirtualMemory(

  IN HANDLE               ProcessHandle,
  IN OUT PVOID            *BaseAddress,
  IN OUT PULONG           NumberOfBytesToFlush,
  OUT PIO_STATUS_BLOCK    IoStatusBlock );

NtFlushVirtualMemory flushes mapped section view to file.
  • ProcessHandle
    • HANDLE of process containing mapped view of section to flush.
  • *BaseAddress
    • Pointer to PVOID value containing address of memory area to flush. On output this value is rounded to Page Size (0x1000).
  • NumberOfBytesToFlush
    • Pointer to ULONG value specifing length of area to flush. On output this value is rounded up to Page Size (0x1000).
  • IoStatusBlock
    • Pointer to IO_STATUS_BLOCK structure. After call Information member contains the same value as NumberOfBytesToFlush parameter.

    WARNING: Two (or more) memory pages mapped in different calls of NtMapViewOfSection cannot be flushed in one function call, even if both has the same SECTION as a source.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateSection
    NtMapViewOfSection
    NtOpenSection
    NtUnmapViewOfSection


NtFreeVirtualMemory

2OOO, 3 December

NtFreeVirtualMemory
NtFreeVirtualMemory

NTSYSAPI
NTSTATUS
NTAPI

NtFreeVirtualMemory(

  IN HANDLE               ProcessHandle,
  IN PVOID                *BaseAddress,
  IN OUT PULONG           RegionSize,
  IN ULONG                FreeType );

RegionSize
If you put pointer to NULL value as RegionSize, system will free all region, and put size of it in result.

FreeType
Can be one of the values:  MEM_DECOMMIT, or MEM_RELEASE.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
NtAllocateVirtualMemory


NtLockVirtualMemory

2OOO, 3 December

NtLockVirtualMemory
NtLockVirtualMemory

NTSYSAPI
NTSTATUS
NTAPI

NtLockVirtualMemory(

  IN HANDLE               ProcessHandle,
  IN PVOID                *BaseAddress,
  IN OUT PULONG           NumberOfBytesToLock,
  IN ULONG                LockOption );

LockOption
Can be one or both of following values:

    #define VM_LOCK_1		0x0001	// This is used, when calling KERNEL32.DLL VirtualLock routine
    #define VM_LOCK_2		0x0002	// This require SE_LOCK_MEMORY_NAME privilege

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib
Privilege: SE_LOCK_MEMORY_NAME

See also:
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtUnlockVirtualMemory


NtProtectVirtualMemory

2OOO, 5 December

NtProtectVirtualMemory
NtProtectVirtualMemory

NTSYSAPI
NTSTATUS
NTAPI

NtProtectVirtualMemory(

  IN HANDLE               ProcessHandle,
  IN OUT PVOID            *BaseAddress,
  IN OUT PULONG           NumberOfBytesToProtect,
  IN ULONG                NewAccessProtection,
  OUT PULONG              OldAccessProtection );

ProcessHandle
Handle to Process Object opened with PROCESS_VM_OPERATION access.

*BaseAddress
Pointer to base address to protect. Protection will change on all page containing specified address. On output, BaseAddress will point to page start address.

NumberOfBytesToProtect
Pointer to size of region to protect. On output will be round to page size (4KB).

NewAccessProtection
One or some of PAGE_... attributess.

OldAccessProtection
Receive previous protection.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
NtAllocateVirtualMemory
NtQueryVirtualMemory


NtQueryVirtualMemory

2OOO, 5 December

NtQueryVirtualMemory
NtQueryVirtualMemory

NTSYSAPI
NTSTATUS
NTAPI

NtQueryVirtualMemory(

  IN HANDLE               ProcessHandle,
  IN PVOID                BaseAddress,
  IN MEMORY_INFORMATION_CLASS MemoryInformationClass,
  OUT PVOID               Buffer,
  IN ULONG                Length,
  OUT PULONG              ResultLength OPTIONAL );

Function NtQueryVirtualMemory retrieves parameters of queried memory block.

  • ProcessHandle
    • HANDLE to process containing queried address in process'es address space.
  • BaseAddress
    • Virtual address to query.
  • MemoryInformationClass
    • Information class defined in MEMORY_INFORMATION_CLASS enumeration type. Currently only one class is supported.
  • Buffer
    • As long as only MemoryBasicInformation is supported, this value points to structure MEMORY_BASIC_INFORMATION, defined in <WINNT.h> and described in MS SDK.
  • Length
    • Length of Buffer, in bytes.
  • ResultLength
    • Optionally pointer to ULONG value receiving required size of Buffer, in bytes.

    Documented by:
    Tomasz Nowak
    Reactos

    Requirements:
    Library: ntdll.lib

    See also:
    MEMORY_BASIC_INFORMATION
    MEMORY_INFORMATION_CLASS
    NtAllocateVirtualMemory
    NtFreeVirtualMemory
    NtLockVirtualMemory
    NtProtectVirtualMemory


NtReadVirtualMemory

2OOO, 5 December

NtReadVirtualMemory
NtReadVirtualMemory

NTSYSAPI
NTSTATUS
NTAPI

NtReadVirtualMemory(

  IN HANDLE               ProcessHandle,
  IN PVOID                BaseAddress,
  OUT PVOID               Buffer,
  IN ULONG                NumberOfBytesToRead,
  OUT PULONG              NumberOfBytesReaded OPTIONAL );

NtReadVirtualMemory is similar to API ReadProcessMemory, described in MS SDK.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
NtAllocateVirtualMemory
NtLockVirtualMemory
NtQueryVirtualMemory
NtWriteVirtualMemory


NtUnlockVirtualMemory

2OOO, 5 December

NtUnlockVirtualMemory
NtUnlockVirtualMemory

NTSYSAPI
NTSTATUS
NTAPI

NtUnlockVirtualMemory(

  IN HANDLE               ProcessHandle,
  IN PVOID                *BaseAddress,
  IN OUT PULONG           NumberOfBytesToUnlock,
  IN ULONG                LockType );

See NtLockVirtualMemory for more information about parameters and usage.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
NtAllocateVirtualMemory
NtLockVirtualMemory
NtQueryVirtualMemory


NtWriteVirtualMemory

2OOO, 5 December

NtWriteVirtualMemory
NtWriteVirtualMemory

NTSYSAPI
NTSTATUS
NTAPI

NtWriteVirtualMemory(

  IN HANDLE               ProcessHandle,
  IN PVOID                BaseAddress,
  IN PVOID                Buffer,
  IN ULONG                NumberOfBytesToWrite,
  OUT PULONG              NumberOfBytesWritten OPTIONAL );

NtWriteVirtualMemory is similar to WINAPI WriteProcessMemory. See Ms SDK for detailed description of parameters.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
NtAllocateVirtualMemory
NtLockVirtualMemory
NtQueryVirtualMemory
NtReadVirtualMemory


MEMORY_INFORMATION_CLASS

2OO1, 6 December

MEMORY_INFORMATION_CLASS
MEMORY_INFORMATION_CLASS

typedef enum _MEMORY_INFORMATION_CLASS {

    MemoryBasicInformation

} MEMORY_INFORMATION_CLASS, *PMEMORY_INFORMATION_CLASS;

Enumeration type MEMORY_INFORMATION_CLASS specify type of information returned in a call to NtQueryVirtualMemory function. Currently only one class is defined.

  • MemoryBasicInformation
    • Result buffer contains structure     MEMORY_BASIC_INFORMATION.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    MEMORY_BASIC_INFORMATION
    NtQueryVirtualMemory


MEMORY_BASIC_INFORMATION

2OO1, 15 April

MEMORY_BASIC_INFORMATION
MEMORY_BASIC_INFORMATION

typedef struct _MEMORY_BASIC_INFORMATION {

  PVOID                   BaseAddress;
  PVOID                   AllocationBase;
  ULONG                   AllocationProtect;
  ULONG                   RegionSize;
  ULONG                   State;
  ULONG                   Protect;
  ULONG                   Type;

} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;

Structure MEMORY_BASIC_INFORMATION is returned as a reselt of call NtQueryVirtualMemory with MemoryBasicInformation information class. It's also descripted in Ms SDK.

  • BaseAddress
    • Address of queried memory page.
  • AllocationBase
    • Base address of allocation. It's different (typically less) to BaseAddress when user allocate more then one page length memory block, and change attributes of a part of allocated block.
  • AllocationProtect
    • Access type on memory allocation. Can be one or combination of following attributes:
    • PAGE_NOACCESS
    • PAGE_READONLY
    • PAGE_READWRITE
    • PAGE_WRITECOPY
    • PAGE_EXECUTE
    • PAGE_EXECUTE_READ
    • PAGE_EXECUTE_READWRITE
    • PAGE_EXECUTE_WRITECOPY
    • PAGE_GUARD
    • PAGE_NOCACHE
    • PAGE_WRITECOMBINE
  • RegionSize
    • Size of queried region, in bytes.
  • State
    • State of memory block. Can be one of:
    • MEM_RESERVE
    • MEM_COMMIT
    • MEM_FREE
  • Protect
    • Current protection of queried memory block. Can be one or combination of values listed for AllocationProtect member.
  • Type
    • Type of queried memory block. Can be one of:
    • MEM_PRIVATE - Queried block was allocated by call NtAllocateVirtualMemory,
    • MEM_MAPPED - Queried block is memory mapped Section Object,
    • SEC_IMAGE - Queried block is Section Object representing executable image file in memory.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    MEMORY_INFORMATION_CLASS
    NtAllocateVirtualMemory
    NtProtectVirtualMemory
    NtQueryVirtualMemory


Other NT Object Functions

Other functions, described in other section of this help file. You can use it with all NT Object types.

Security

  • NtQuerySecurityObject
  • NtSetSecurityObject


NtClose

2OOO, 18 October

NtClose
NtClose

NTSYSAPI
NTSTATUS
NTAPI

NtClose(

  IN HANDLE               ObjectHandle );

ObjectHandle

Handle to open object.
If ObjectHandle is last reference to object in system, object will be removed from memory.

Requirements:
Library: ntdll.lib


NtDuplicateObject

2OOO, 3 December

NtDuplicateObject
NtDuplicateObject

NTSYSAPI
NTSTATUS
NTAPI

NtDuplicateObject(

  IN HANDLE               SourceProcessHandle,
  IN PHANDLE              SourceHandle,
  IN HANDLE               TargetProcessHandle,
  OUT PHANDLE             TargetHandle,
  IN ACCESS_MASK          DesiredAccess OPTIONAL,
  IN BOOLEAN              InheritHandle,
  IN ULONG                Options );

See Microsoft SDK for description of DuplicateHandle Win32 API.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib


NtMakeTemporaryObject

2OO1, 29 January

NtMakeTemporaryObject
NtMakeTemporaryObject

NTSYSAPI
NTSTATUS
NTAPI

NtMakeTemporaryObject(

  IN HANDLE               ObjectHandle );

(Also avaiable in Win2000 DDK)

Function clears object's PERMANENT flag, so it's live as long as the latest HANDLE is closed.
  • ObjectHandle
    • HANDLE to object to make temporary.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtClose
    NtQueryObject


NtQueryObject

2OO4, 4 February

NtQueryObject
NtQueryObject

NTSYSAPI
NTSTATUS
NTAPI

NtQueryObject(

  IN HANDLE               ObjectHandle,
  IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
  OUT PVOID               ObjectInformation,
  IN ULONG                Length,
  OUT PULONG              ResultLength );

Function NtQueryObject retrives some informations about any or all objects opened by calling process. It can be used with any type of object.
  • ObjectHandle
    • HANDLE to object.
  • ObjectInformationClass
    • Kind of information to retrive. See OBJECT_INFORMATION_CLASS for possible values list.
  • ObjectInformation
    • Output buffer allocated by caller.
  • Length
    • Length of ObjectInformation buffer, in bytes.
  • ResultLength
    • Pointer to ULONG value that contains required size of ObjectInformation buffer after function call.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtSetInformationObject
    OBJECT_INFORMATION_CLASS


NtSetInformationObject

2OOO, 8 December

NtSetInformationObject
NtSetInformationObject

NTSYSAPI
NTSTATUS
NTAPI

NtSetInformationObject(

  IN HANDLE               ObjectHandle,
  IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
  IN PVOID                ObjectInformation,
  IN ULONG                Length );

ObjectHandle
Open handle to any NT object.

ObjectInformationClass
See NtQueryObject for detailed description of possible information classes.

ObjectInformation
Buffor with data to set.

Length
Length of ObjectInformation buffer, in bytes.

Currently only one class in allowed in set mode: ObjectDataInformation. See description of OBJECT_DATA_INFORMATION structure.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtQueryObject
OBJECT_DATA_INFORMATION


NtSignalAndWaitForSingleObject

2OO1, 3 March

NtSignalAndWaitForSingleObject
NtSignalAndWaitForSingleObject

NTSYSAPI
NTSTATUS
NTAPI

NtSignalAndWaitForSingleObject(

  IN HANDLE               ObjectToSignal,
  IN HANDLE               WaitableObject,
  IN BOOLEAN              Alertable,
  IN PLARGE_INTEGER       Time OPTIONAL );

Function NtSignalAndWaitForSingleObject signals one object and wait for second object. See also Win32 API SignalObjectAndWait description in Microsoft SDK.

  • ObjectToSignal
    • HANDLE to object to signal. Possible object's types are:
    • Event Object
    • Semaphore Object
    • Mutant Object
  • WaitableObject
    • HANDLE to object to wait for. Can be any waitable object.
  • Alertable
    • If set, APC Routine can break waiting.
  • Time
    • Optionally pointer to LARGE_INTEGER value specifing time (absolute or relative) when function time outs (in 100-ns units). Negative value means relative time.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateEvent
    NtCreateMutant
    NtCreateSemaphore
    NtWaitForMultipleObjects
    NtWaitForSingleObject


NtWaitForMultipleObjects

2OO1, 17 January

NtWaitForMultipleObjects
NtWaitForMultipleObjects

NTSYSAPI
NTSTATUS
NTAPI

NtWaitForMultipleObjects(

  IN ULONG                ObjectCount,
  IN PHANDLE              ObjectsArray,
  IN OBJECT_WAIT_TYPE     WaitType,
  IN BOOLEAN              Alertable,
  IN PLARGE_INTEGER       TimeOut OPTIONAL );

  • ObjectCount
    • Number of objects in ObjectsArray array.
  • ObjectsArray
    • Pointer to array of HANDLE. Each must be opened with SYNCHRONIZE access.
  • WaitType
    • Can be WaitAllObjects or WaitAnyObject.
  • Alertable
    • If set, thread is signaled (APC routines queued for this thread are executed).
  • TimeOut
    • Time-out interval.

    NtWaitForMultipleObjects is used typically to response for notyfications. For synchronization purposes you should use NtWaitForSingleObject.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtSignalAndWaitForSingleObject
    NtWaitForSingleObject
    OBJECT_WAIT_TYPE


NtWaitForSingleObject

2OO1, 17 January

NtWaitForSingleObject
NtWaitForSingleObject

NTSYSAPI
NTSTATUS
NTAPI

NtWaitForSingleObject(

  IN HANDLE               ObjectHandle,
  IN BOOLEAN              Alertable,
  IN PLARGE_INTEGER       TimeOut OPTIONAL );

  • ObjectHandle
    • HANDLE to alertable object.
  • Alertable
    • If set, calling thread is signaled, so all queued APC routines are executed.
  • TimeOut
    • Time-out interval, in microseconds. NULL means infinite.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtSignalAndWaitForSingleObject
    NtWaitForMultipleObjects


OBJECT_INFORMATION_CLASS

2OO4, 3O January

OBJECT_INFORMATION_CLASS
OBJECT_INFORMATION_CLASS

typedef enum _OBJECT_INFORMATION_CLASS {

    ObjectBasicInformation,
    ObjectNameInformation,
    ObjectTypeInformation,
    ObjectAllInformation,
    ObjectDataInformation

} OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS;

OBJECT_INFORMATION_CLASS specifies a kind of information of any object available in caller context. It's used with functions NtQueryObject and NtSetInformationObject.
  • ObjectBasicInformation
    • Action | : Query
Buffer size | : 0x038
Structure | : OBJECT_BASIC_INFORMATION
  • ObjectNameInformation
    • Action | : Query
Buffer size | : 0x08
Structure | : OBJECT_NAME_INFORMATION
  • ObjectTypeInformation
    • Action | : Query
Buffer size | : 0x070
Structure | : OBJECT_TYPE_INFORMATION
  • ObjectAllInformation
    • Action | : Query
Buffer size | : 0x04+
Structure | : OBJECT_ALL_INFORMATION
Comment | : Size of buffer depends on number of objects opened by caller.
  • ObjectDataInformation
    • Action | : Query, Set
Buffer size | : 0x02
Structure | : OBJECT_DATA_INFORMATION

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtSetInformationObject


OBJECT_WAIT_TYPE

2OO1, 17 January

OBJECT_WAIT_TYPE
OBJECT_WAIT_TYPE

typedef enum _OBJECT_WAIT_TYPE {

    WaitAllObject,
    WaitAnyObject

} OBJECT_WAIT_TYPE, *POBJECT_WAIT_TYPE;

OBJECT_WAIT_TYPE is used in a call to NtWaitForMultipleObjects.
  • WaitAllObject
    • All objects specified in waiting function must be signaled to continue execution.
  • WaitAnyObject
    • At least one of specified objects must be signaled. Return value indicates position of signaled object in object's array. STATUS_WAIT_0 indicates first element in object's array, STATUS_WAIT_1 is the second etc.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtWaitForMultipleObjects


OBJECT_BASIC_INFORMATION

2OO4, 6 October

OBJECT_BASIC_INFORMATION
OBJECT_BASIC_INFORMATION

typedef struct _OBJECT_BASIC_INFORMATION {

  ULONG                   Attributes;
  ACCESS_MASK             DesiredAccess;
  ULONG                   HandleCount;
  ULONG                   ReferenceCount;
  ULONG                   PagedPoolUsage;
  ULONG                   NonPagedPoolUsage;
  ULONG                   Reserved[3];
  ULONG                   NameInformationLength;
  ULONG                   TypeInformationLength;
  ULONG                   SecurityDescriptorLength;
  LARGE_INTEGER           CreationTime;

} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;

Structure OBJECT_BASIC_INFORMATION is returned in a result of call NtQueryObject with ObjectBasicInformation information class.
  • Attributes
  • DesiredAccess
  • HandleCount
  • ReferenceCount
  • PagedPoolUsage
  • NonPagedPoolUsage
  • Reserved[3]
  • NameInformationLength
  • TypeInformationLength
  • SecurityDescriptorLength
  • CreationTime

    • Supported on system versions:
    NT 4.0,Win 2000,Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtQueryObject
    OBJECT_INFORMATION_CLASS


OBJECT_NAME_INFORMATION

2OO4, 7 October

OBJECT_NAME_INFORMATION
OBJECT_NAME_INFORMATION

typedef struct _OBJECT_NAME_INFORMATION {

  UNICODE_STRING          Name;
  WCHAR                   NameBuffer[0];

} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;

Structure OBJECT_NAME_INFORMATION is used as a result of call NtQueryObject with ObjectNameInformation information class.
  • Name
    • Name of object or NULL if object don't have associated name.
  • NameBuffer[0]
    • Buffer with UNICODE name of object.

    Supported on system versions:
    NT 4.0,Win 2000,Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtQueryObject
    OBJECT_INFORMATION_CLASS


NtCreateDebugObject

2OO8, 2O May

NtCreateDebugObject
NtCreateDebugObject

NTSYSAPI
NTSTATUS
NTAPI

NtCreateDebugObject(

  OUT PHANDLE             DebugObjectHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
  IN BOOLEAN              KillProcessOnExit );

Function NtCreateDebugObject is used for Debug Object creation. Debug Object it's a new functionality implemented in Windows XP and above as support for debuging User Mode applications. In previous versions of NT debuging was implemented with Port objects (see NtCreatePort). Application can debug one or few different applications in the same time, but need to create as many Debug Objects as number of debuged processes.

There're two methods of start debugging. To start application in debug mode, user need to use NtCreateProcessEx function (avaiable on XP+) with HANDLE to previously created Debug Object. Or just attach debugger to working process by calling NtDebugActiveProcess.
  • DebugObjectHandle
    • Pointer to newly created Debug Object HANDLE.
  • DesiredAccess
    • Access mask for Debug Object. Can be one or more of following:
    • DEBUGOBJECT_WAIT_STATE_CHANGE
    • DEBUGOBJECT_ADD_REMOVE_PROCESS
    • DEBUGOBJECT_ALL_ACCESS
  • ObjectAttributes
    • Optionally can define object's name.
  • KillProcessOnExit
    • If set, debuged process will be terminated with closing Debug Object.

    Supported on system versions:
    Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    DBG_STATE
    NtCreateProcessEx
    NtDebugActiveProcess


NtDebugActiveProcess

2OO9, 23 March

NtDebugActiveProcess
NtDebugActiveProcess

NTSYSAPI
NTSTATUS
NTAPI

NtDebugActiveProcess(

  IN HANDLE               ProcessHandle,
  IN HANDLE               DebugObjectHandle );

Function NtDebugActiveProcess is used to attach Debug Object to any non-debuged process.
  • ProcessHandle
    • HANDLE to process being debugged (opened with enough access rigths - see NtOpenProcess).
  • DebugObjectHandle
    • HANDLE to previously created Debug Object.

    Supported on system versions:
    Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateDebugObject
    NtOpenProcess
    NtRemoveProcessDebug


NtRemoveProcessDebug

2OO9, 23 March

NtRemoveProcessDebug
NtRemoveProcessDebug

NTSYSAPI
NTSTATUS
NTAPI

NtRemoveProcessDebug(

  IN HANDLE               ProcessHandle,
  IN HANDLE               DebugObjectHandle );

Function NtRemoveProcessDebug detach debugger from process. It's reverse of NtDebugActiveProcess function.
  • ProcessHandle
    • HANDLE to process being debugged.
  • DebugObjectHandle
    • HANDLE to Debug Object.

    Supported on system versions:
    Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateDebugObject
    NtDebugActiveProcess


DBG_STATE

2OO8, 17 April

DBG_STATE
DBG_STATE

typedef enum _DBG_STATE {

    DbgIdle,
    DbgReplyPending,
    DbgCreateThreadStateChange,
    DbgCreateProcessStateChange,
    DbgExitThreadStateChange,
    DbgExitProcessStateChange,
    DbgExceptionStateChange,
    DbgBreakpointStateChange,
    DbgSingleStepStateChange,
    DbgLoadDllStateChange,
    DbgUnloadDllStateChange

} DBG_STATE, *PDBG_STATE;

DBG_STATE enumeration is used by Debug Objects as a member of DBGUI_WAIT_STATE_CHANGE structure returned in successfull call to NtWaitForDebugEvent function. It describes current state of Debug Object. Possible values are:
  • DbgIdle
  • DbgReplyPending
  • DbgCreateThreadStateChange
  • DbgCreateProcessStateChange
  • DbgExitThreadStateChange
  • DbgExitProcessStateChange
  • DbgExceptionStateChange
  • DbgBreakpointStateChange
  • DbgSingleStepStateChange
  • DbgLoadDllStateChange
  • DbgUnloadDllStateChange

    • Supported on system versions:
    Win XP/2003

    Documented by:
    Reactos
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtWaitForDebugObject


NtCreateDirectoryObject

2OOO, 2O December

NtCreateDirectoryObject
NtCreateDirectoryObject

NTSYSAPI
NTSTATUS
NTAPI

NtCreateDirectoryObject(

  OUT PHANDLE             DirectoryHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes );

DirectoryHandle
Pointer to newly created Directory Object after function call.

DesiredAccess
As defined in <ntddk.h> can be one of following:

   #define DIRECTORY_QUERY                 (0x0001)
   #define DIRECTORY_TRAVERSE              (0x0002)
   #define DIRECTORY_CREATE_OBJECT         (0x0004)
   #define DIRECTORY_CREATE_SUBDIRECTORY   (0x0008)
   #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)

ObjectAttributes
Pointer to object attributes. Structure must contain valid object name.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
NtOpenDirectoryObject
NtQueryDirectoryObject


NtOpenDirectoryObject

2OOO, 21 December

NtOpenDirectoryObject
NtOpenDirectoryObject

NTSYSAPI
NTSTATUS
NTAPI

NtOpenDirectoryObject(

  OUT PHANDLE             DirectoryObjectHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes );

DirectoryObjectHandle
Pointer to HANDLE value representing opened Directory Object.

DesiredAccess
Access mask. See NtCreateDirectoryObject for possible values.

ObjectAttributes
Must contains valid Directory Object name.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtCreateDirectoryObject
NtQueryDirectoryObject


NtQueryDirectoryObject

2OOO, 21 December

NtQueryDirectoryObject
NtQueryDirectoryObject

NTSYSAPI
NTSTATUS
NTAPI

NtQueryDirectoryObject(

  IN HANDLE               DirectoryObjectHandle,
  OUT POBJDIR_INFORMATION DirObjInformation,
  IN ULONG                BufferLength,
  IN BOOLEAN              GetNextIndex,
  IN BOOLEAN              IgnoreInputIndex,
  IN OUT PULONG           ObjectIndex,
  OUT PULONG              DataWritten OPTIONAL );

DirectoryObjectHandle
Handle to Directory Object opened with DIRECTORY_QUERY access.

DirObjInformation
Pointer to OBJDIR_INFORMATION structure. Warning: structure has variable length dependly to length of object name.
To test for required length of buffer use DataWritten parameter.

BufferLength
Length of DirObjInformation buffer.

GetNextIndex
Decide of ObjectIndex parameter usage on output.
  If FALSE:	ObjectIndex is number of object in Object Directory.
  If TRUE:	ObjectIndex is index of next object to quered object (see below) in Object Directory.

IgnoreInputIndex
Decide how to use ObjectIndex on function input.
  If FALSE:	ObjectIndex point to ULONG index of object in Object Directory.
  If TRUE:	ObjectIndex input value is ignored. Function always return informations about first object in Object Directory.

ObjectIndex
Pointer to ULONG value described above.

DataWritten
Pointer to ULONG value receiving required / written buffer size. This parameter is optional.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtCreateDirectoryObject
NtOpenDirectoryObject
OBJDIR_INFORMATION


OBJDIR_INFORMATION

2OOO, 21 December

OBJDIR_INFORMATION
OBJDIR_INFORMATION

typedef struct _OBJDIR_INFORMATION {

  UNICODE_STRING          ObjectName;
  UNICODE_STRING          ObjectTypeName;
  BYTE                    Data[1];

} OBJDIR_INFORMATION, *POBJDIR_INFORMATION;

Structure is used with NtQueryDirectoryObject function. Contains information of named object placed in object directory space.

ObjectName
Name of object.

ObjectTypeName
Name of object type.

Data[1]
Variable length data buffer.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtQueryDirectoryObject


NtClearEvent

2OO1, 7 January

NtClearEvent
NtClearEvent

NTSYSAPI
NTSTATUS
NTAPI

NtClearEvent(

  IN HANDLE               EventHandle );

  • EventHandle
    • HANDLE to Event Object opened with EVENT_MODIFY_STATE attribute.

    There're no functional difference between NtClearEvent and NtResetEvent, but the first works faster (see NtResetEvent).

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateEvent
    NtOpenEvent
    NtResetEvent
    NtSetEvent


NtCreateEvent

2OO1, 7 January

NtCreateEvent
NtCreateEvent

NTSYSAPI
NTSTATUS
NTAPI

NtCreateEvent(

  OUT PHANDLE             EventHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
  IN EVENT_TYPE           EventType,
  IN BOOLEAN              InitialState );

  • EventHandle
    • Result of call - HANDLE to newly created Event Object.
  • DesiredAccess
    • Assess rights associated with created event. Can be one of following values from <winnt.h>:
    • EVENT_QUERY_STATE
    • EVENT_MODIFY_STATE
    • EVENT_ALL_ACCESS
  • ObjectAttributes
    • Optional name of Event Object for multiprocess use.
  • EventType
    • See EVENT_TYPE for details.
  • InitialState
    • State of event immediatelly after creation.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    EVENT_TYPE
    NtOpenEvent


NtOpenEvent

2OO1, 7 January

NtOpenEvent
NtOpenEvent

NTSYSAPI
NTSTATUS
NTAPI

NtOpenEvent(

  OUT PHANDLE             EventHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes );

  • EventHandle
    • Result of call - HANDLE to Event Object.
  • DesiredAccess
    • See NtCreateEvent for possible access rights.
  • ObjectAttributes
    • Must contain valid Event Object name, in NT Objects Namespace.

    Only named events can be opened by this function call.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateEvent


NtPulseEvent

2OO1, 7 January

NtPulseEvent
NtPulseEvent

NTSYSAPI
NTSTATUS
NTAPI

NtPulseEvent(

  IN HANDLE               EventHandle,
  OUT PLONG               PreviousState OPTIONAL );

  • EventHandle
    • HANDLE to Event Object opened with EVENT_MODIFY_STATE access.
  • PreviousState
    • State of event before call.

    Function sets event to signaled state, releases all (or one - dependly of EVENT_TYPE) waiting threads, and resets event to non-signaled state. If they're no waiting threads, NtPulseEvent just clear event state.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    EVENT_TYPE
    NtClearEvent
    NtCreateEvent
    NtOpenEvent
    NtResetEvent
    NtSetEvent


NtQueryEvent

2OO1, 7 January

NtQueryEvent
NtQueryEvent

NTSYSAPI
NTSTATUS
NTAPI

NtQueryEvent(

  IN HANDLE               EventHandle,
  IN EVENT_INFORMATION_CLASS EventInformationClass,
  OUT PVOID               EventInformation,
  IN ULONG                EventInformationLength,
  OUT PULONG              ReturnLength OPTIONAL );

  • EventHandle
    • HANDLE to Event Object opened with EVENT_QUERY_STATE access.
  • EventInformationClass
    • See EVENT_INFORMATION_CLASS for details.
  • EventInformation
    • Caller's allocated buffer for result data.
  • EventInformationLength
    • Length of EventInformation buffer, in bytes.
  • ReturnLength
    • Returns required/used size of EventInformation buffer.

    Currently there're only one information class for use with Event Object. See EVENT_INFORMATION_CLASS for details.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    EVENT_BASIC_INFORMATION
    EVENT_INFORMATION_CLASS
    NtCreateEvent
    NtOpenEvent


NtResetEvent

2OO1, 7 January

NtResetEvent
NtResetEvent

NTSYSAPI
NTSTATUS
NTAPI

NtResetEvent(

  IN HANDLE               EventHandle,
  OUT PLONG               PreviousState OPTIONAL );

  • EventHandle
    • HANDLE to Event Object opened with EVENT_MODIFY_STATE access.
  • PreviousState
    • Optional pointer to state of event before function call. Difference between NtResetEvent and NtClearEvent is the first one can return state of event before call.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtClearEvent
    NtCreateEvent
    NtOpenEvent
    NtQueryEvent
    NtSetEvent


NtSetEvent

2OO1, 7 January

NtSetEvent
NtSetEvent

NTSYSAPI
NTSTATUS
NTAPI

NtSetEvent(

  IN HANDLE               EventHandle,
  OUT PLONG               PreviousState OPTIONAL );

  • EventHandle
    • HANDLE to Event Object opened with EVENT_MODIFY_STATE access.
  • PreviousState
    • State of Event Object before function call.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtClearEvent
    NtCreateEvent
    NtOpenEvent
    NtResetEvent


NtSetEventBoostPriority

2OO7, 29 April

NtSetEventBoostPriority
NtSetEventBoostPriority

NTSYSAPI
NTSTATUS
NTAPI

NtSetEventBoostPriority(

  IN HANDLE               EventHandle );

Function NtSetEventPriorityBoost was added in Windows XP system. Has the same functionality as NtSetEvent, but thread that is waiting on specified Event will be executed immediatelly after context switch, regardless of waiting thread's priority.
  • EventHandle
    • HANDLE to previously created or opened Event object. Note that Event has to be created with EVENT_TYPE set to SynchronizationEvent (automatic reset), in other cases function will return with error.

    Supported on system versions:
    Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    EVENT_TYPE
    NtCreateEvent
    NtOpenEvent
    NtSetEvent


EVENT_INFORMATION_CLASS

2OO1, 7 January

EVENT_INFORMATION_CLASS
EVENT_INFORMATION_CLASS

typedef enum _EVENT_INFORMATION_CLASS {

    EventBasicInformation

} EVENT_INFORMATION_CLASS, *PEVENT_INFORMATION_CLASS;

This enumeration type is used with NtQueryEvent. There're no corresponding function to set event information. Currently only one information class is defined:
  • EventBasicInformation
    • See     EVENT_BASIC_INFORMATION for details.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    EVENT_BASIC_INFORMATION
    NtQueryEvent


EVENT_TYPE

2OO1, 7 January

EVENT_TYPE
EVENT_TYPE

typedef enum _EVENT_TYPE {

    NotificationEvent,
    SynchronizationEvent

} EVENT_TYPE, *PEVENT_TYPE;

There are two Event types in WinNT:
  • NotificationEvent
    • Known also as manual-reset event. Caller decide about state of event. You can use     NtClearEvent or NtResetEvent to put Event Object into non-signaled state.
  • SynchronizationEvent
    • Known as auto-reset event. This type automatically change his state to non-signaled after releasing any (but only one) waiting thread.

    To check what type of event do you have, use     NtQueryEvent.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtClearEvent
    NtCreateEvent
    NtQueryEvent
    NtResetEvent


EVENT_BASIC_INFORMATION

2OO1, 7 January

EVENT_BASIC_INFORMATION
EVENT_BASIC_INFORMATION

typedef struct _EVENT_BASIC_INFORMATION {

  EVENT_TYPE              EventType;
  LONG                    EventState;

} EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;

This structure is used with EventBasicInformation information class as a result of call NtQueryEvent.
  • EventType
    • Type of Event Object. Can be SynchronizationEvent or NotificationEvent. See EVENT_TYPE for details.
  • EventState
    • Current state of Event Object.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    EVENT_INFORMATION_CLASS
    EVENT_TYPE
    NtQueryEvent


NtCreateEventPair

2OOO, 7 December

NtCreateEventPair
NtCreateEventPair

NTSYSAPI
NTSTATUS
NTAPI

NtCreateEventPair(

  OUT PHANDLE             EventPairHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL );

EventPairHandle
Result handle to EventPair object.

DesiredAccess
Is defined as:

#define EVENT_PAIR_ALL_ACCESS ( STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE )

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtOpenEventPair


NtOpenEventPair

2OOO, 8 December

NtOpenEventPair
NtOpenEventPair

NTSYSAPI
NTSTATUS
NTAPI

NtOpenEventPair(

  OUT PHANDLE             EventPairHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes );

DesiredAccess
See NtCreateEventPair for definitions of EventPair possibble access rights.

Documented by:
Tomasz Nowak
Sven B. Schreiber

Requirements:
Library: ntdll.lib

See also:
NtCreateEventPair


NtSetHighEventPair

2OOO, 8 December

NtSetHighEventPair
NtSetHighEventPair

NTSYSAPI
NTSTATUS
NTAPI

NtSetHighEventPair(

  IN HANDLE               EventPairHandle );

Function sets HIGH event state to signalled.

Documented by:
Tomasz Nowak
Sven B. Schreiber

Requirements:
Library: ntdll.lib

See also:
NtCreateEventPair
NtOpenEventPair
NtSetHighWaitLowEventPair
NtSetLowEventPair
NtWaitHighEventPair


NtSetHighWaitLowEventPair

2OOO, 8 December

NtSetHighWaitLowEventPair
NtSetHighWaitLowEventPair

NTSYSAPI
NTSTATUS
NTAPI

NtSetHighWaitLowEventPair(

  IN HANDLE               EventPairHandle );

Function signals HIGH event and waits unlit LOW event will be signaled.

Documented by:
Tomasz Nowak
Sven B. Schreiber

Requirements:
Library: ntdll.lib

See also:
NtCreateEventPair
NtOpenEventPair
NtSetHighEventPair
NtSetLowWaitHighEventPair
NtWaitLowEventPair


NtSetHighWaitLowThread

2OOO, 8 December

NtSetHighWaitLowThread
NtSetHighWaitLowThread

NTSYSAPI
NTSTATUS
NTAPI

NtSetHighWaitLowThread(

 );

- ???

See also SetInformationThread with ThreadEventPair information class.

Documented by:
Sven B. Schreiber
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtCreateEventPair
NtOpenEventPair
NtSetHighEventPair
NtSetHighWaitLowEventPair
NtSetInformationThread
NtWaitLowEventPair
THREAD_INFORMATION_CLASS


NtSetLowEventPair

2OOO, 8 December

NtSetLowEventPair
NtSetLowEventPair

NTSYSAPI
NTSTATUS
NTAPI

NtSetLowEventPair(

  IN HANDLE               EventPairHandle );

Function sets LOW event for EventPairHandle object.

Documented by:
Tomasz Nowak
Sven B. Schreiber

Requirements:
Library: ntdll.lib

See also:
NtCreateEventPair
NtOpenEventPair
NtSetHighEventPair
NtSetLowWaitHighEventPair
NtWaitLowEventPair


NtSetLowWaitHighEventPair

2OOO, 8 December

NtSetLowWaitHighEventPair
NtSetLowWaitHighEventPair

NTSYSAPI
NTSTATUS
NTAPI

NtSetLowWaitHighEventPair(

  IN HANDLE               EventPairHandle );

Function set signalled state to LOW event and wait until HIGH event will be signaled.

Documented by:
Tomasz Nowak
Sven B. Schreiber

Requirements:
Library: ntdll.lib

See also:
NtCreateEventPair
NtOpenEventPair
NtSetLowEventPair
NtWaitHighEventPair


NtSetLowWaitHighThread

2OOO, 8 December

NtSetLowWaitHighThread
NtSetLowWaitHighThread

NTSYSAPI
NTSTATUS
NTAPI

NtSetLowWaitHighThread(

 );

Function NtSetLowWaitHighThread is obsolete and exist up to NT 4.0.

(?)

See also NtSetInformationThread with ThreadEventPair information class.

Documented by:
Sven B. Schreiber
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtCreateEventPair
NtOpenEventPair
NtSetInformationThread
NtSetLowEventPair
NtSetLowWaitHighEventPair
NtWaitHighEventPair
THREAD_INFORMATION_CLASS


NtWaitHighEventPair

2OOO, 8 December

NtWaitHighEventPair
NtWaitHighEventPair

NTSYSAPI
NTSTATUS
NTAPI

NtWaitHighEventPair(

  IN HANDLE               EventPairHandle );

Wait until HIGH event of EventPairHandle will be signaled.

Documented by:
Tomasz Nowak
Sven B. Schreiber

Requirements:
Library: ntdll.lib

See also:
NtCreateEventPair
NtOpenEventPair
NtWaitLowEventPair


NtWaitLowEventPair

2OOO, 8 December

NtWaitLowEventPair
NtWaitLowEventPair

NTSYSAPI
NTSTATUS
NTAPI

NtWaitLowEventPair(

  IN HANDLE               EventPairHandle );

Function waits, until LOW event will be signaled.

Documented by:
Tomasz Nowak
Sven B. Schreiber

Requirements:
Library: ntdll.lib

See also:
NtCreateEventPair
NtOpenEventPair
NtWaitHighEventPair


NtCancelIoFile

2OO1, 11 February

NtCancelIoFile
NtCancelIoFile

NTSYSAPI
NTSTATUS
NTAPI

NtCancelIoFile(

  IN HANDLE               FileHandle,
  OUT PIO_STATUS_BLOCK    IoStatusBlock );

Function NtCancelIoFile sends cancel signal to Device Driver. If any IO operation with specified file is pending, it is immediatelly canceled.

  • FileHandle
    • HANDLE to File Object.
  • IoStatusBlock
    • IO result of call.

    Documented by:
    Tomasz Nowak
    Reactos

    Requirements:
    Library: ntdll.lib

    See also:
    NtFlushBuffersFile
    NtQueryInformationFile
    NtReadFile
    NtSetEaFile
    NtSetInformationFile
    NtWriteFile


NtCreateFile

2OOO, 29 December

NtCreateFile
NtCreateFile

NTSYSAPI
NTSTATUS
NTAPI

NtCreateFile(

  OUT PHANDLE             FileHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PLARGE_INTEGER       AllocationSize OPTIONAL,
  IN ULONG                FileAttributes,
  IN ULONG                ShareAccess,
  IN ULONG                CreateDisposition,
  IN ULONG                CreateOptions,
  IN PVOID                EaBuffer OPTIONAL,
  IN ULONG                EaLength );

(Avaiable also in 2000 DDK.)
  • FileHandle
    • Result of call - HANDLE to File Object.
  • DesiredAccess
    • Access mask based on definitions in schema FILE_* from <WinNT.h>.
  • ObjectAttributes
    • Name of file to create (or open), optionally path in name string. You can also define root directory, security descriptor and attributes OBJ_CASE_INSENSITIVE and OBJ_INHERIT.
  • IoStatusBlock
    • Pointer to IO_STATUS_BLOCK structure, that receive final status of function call. Can be one of:
    • FILE_CREATED
    • FILE_OPENED
    • FILE_OVERWRITTEN
    • FILE_SUPERSEDED
    • FILE_EXISTS
    • FILE_DOES_NOT_EXIST
  • AllocationSize
    • File size after creation.
  • FileAttributes
    • Attributes for newly created file, as follows:
    • FILE_ATTRIBUTE_READONLY
    • FILE_ATTRIBUTE_HIDDEN
    • FILE_ATTRIBUTE_SYSTEM
    • FILE_ATTRIBUTE_ARCHIVE
    • FILE_ATTRIBUTE_NORMAL
    • FILE_ATTRIBUTE_TEMPORARY
    • FILE_ATTRIBUTE_OFFLINE
    • FILE_ATTRIBUTE_NOT_CONTENT_INDEXED
  • ShareAccess
    • Specifies share method for opened object. Can be set to zero or any combination of flags:
    • FILE_SHARE_READ
    • FILE_SHARE_WRITE
    • FILE_SHARE_DELETE
  • CreateDisposition
    • Specifies disposition how to create or open object and can be one of:
    • FILE_SUPERSEDE - If file exists, deletes it before creation of new one.
    • FILE_OPEN - Fails, if file not exists.
    • FILE_CREATE - Fails, if file exists.
    • FILE_OPEN_IF - If file exists, opens it. If not, creates new one and then open it.
    • FILE_OVERWRITE - If file not exists, create and open it. If exists, open them and reset content.
    • FILE_OVERWRITE_IF - As FILE_OVERWRITE, but fails if file not exists.
  • CreateOptions
    • Creation options.
  • EaBuffer
    • Buffer for Extended Attributes contains one or more of FILE_FULL_EA_INFORMATION structures.
  • EaLength
    • Length of EaBuffer.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_FULL_EA_INFORMATION
    NtDeleteFile
    NtOpenFile
    NtSetEaFile


NtCreateMailslotFile

2OO1, 14 February

NtCreateMailslotFile
NtCreateMailslotFile

NTSYSAPI
NTSTATUS
NTAPI

NtCreateMailslotFile(

  OUT PHANDLE             MailslotFileHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN ULONG                CreateOptions,
  IN ULONG                MailslotQuota,
  IN ULONG                MaxMessageSize,
  IN PLARGE_INTEGER       ReadTimeOut );

Function NtCreateMailslotFile creates especial File Object called Mailslot. See Microsoft SDK for more information about Mailslots.

  • MailslotFileHandle
    • Result of call - HANDLE to Mailslot File Object.
  • DesiredAccess
    • Access rights associated with opened handle.
  • ObjectAttributes
    • Pointer to OBJECT_ATTRIBUTES structure contains valid object name. Name must be in format "\\??\MAILSLOT\..." where "..." means unique name of Mailslot.
  • IoStatusBlock
    • IO result of call.
  • CreateOptions
    • Can be combination of:
    • FILE_WRITE_THROUGH
    • FILE_SYNCHRONOUS_IO_ALERT
    • FILE_SYNCHRONOUS_IO_NONALERT
  • MailslotQuota
    • - ???
  • MaxMessageSize
    • Maximum message size, or MAILSLOT_SIZE_AUTO for automatic message size.
  • ReadTimeOut
    • Timeout value, or -1 for infinite waiting.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_MAILSLOT_QUERY_INFORMATION
    FILE_MAILSLOT_SET_INFORMATION
    NtQueryInformationFile
    NtReadFile
    NtSetInformationFile
    NtWriteFile


NtCreateNamedPipeFile

2OO1, 1 March

NtCreateNamedPipeFile
NtCreateNamedPipeFile

NTSYSAPI
NTSTATUS
NTAPI

NtCreateNamedPipeFile(

  OUT PHANDLE             NamedPipeFileHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN ULONG                ShareAccess,
  IN ULONG                CreateDisposition,
  IN ULONG                CreateOptions,
  IN BOOLEAN              WriteModeMessage,
  IN BOOLEAN              ReadModeMessage,
  IN BOOLEAN              NonBlocking,
  IN ULONG                MaxInstances,
  IN ULONG                InBufferSize,
  IN ULONG                OutBufferSize,
  IN PLARGE_INTEGER       DefaultTimeOut );

Function NtCreateNamedPipeFile creates Named Pipe File Object. Named Pipes are especial kind of files, so all functionality is provided with file's functions like NtReadFile, NtWriteFile etc.
Named Pipes are frequently used in NT system, for example as stdin and stdout handles.

  • NamedPipeFileHandle
    • Result of call - pointer to HANDLE to Named Pipe.
  • DesiredAccess
    • Access rights for object's handle. Can be one or combination of:
    • FILE_READ_DATA
    • FILE_WRITE_DATA
    • FILE_CREATE_PIPE_INSTANCE
    • FILE_READ_ATTRIBUTES
    • FILE_WRITE_ATTRIBUTES
    • SYNCHRONIZE
    • READ_CONTROL
    • WRITE_OWNER
    • WRITE_DAC
    • ACCESS_SYSTEM_SECURITY
    Also combination of Generic rights are supported.
  • ObjectAttributes
    • Pointer to OBJECT_ATTRIBUTES structure contains name of named pipe. Name must begin with "\??\PIPE\" string, that is Symbolic Link to NamedPipe device object.
  • IoStatusBlock
    • IO result of call.
  • ShareAccess
    • Can be combination of following:
    • FILE_SHARE_READ
    • FILE_SHARE_WRITE
    • FILE_SHARE_DELETE
  • CreateDisposition
    • Use FILE_CREATE, FILE_OPEN or FILE_OPEN_IF.
  • CreateOptions
    • See description of NtCreateFile for possible creation flags.
  • WriteModeMessage
    • If set, writing to created pipe are processed in Message Mode. If not, all writes are in Byte Mode.
  • ReadModeMessage
    • The same functionality as WriteModeMessage parameter, but for reading data.
  • NonBlocking
    • If set, all operations on created pipe are asynchronous.
  • MaxInstances
    • Maximum number of open handles for Named Pipe, or FILE_PIPE_UNLIMITED_INSTANCES constant.
  • InBufferSize
    • Input buffer size, in bytes.
  • OutBufferSize
    • Output buffer size, in bytes.
  • DefaultTimeOut
    • Pointer to LARGE_INTEGER value specifing pipe's time out, in 100-ns units. Negative value means relative time.

    Documented by:
    Tomasz Nowak
    Reactos

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_INFORMATION_CLASS
    FILE_PIPE_INFORMATION
    FILE_PIPE_LOCAL_INFORMATION
    FILE_PIPE_REMOTE_INFORMATION
    NtFsControlFile
    NtQueryInformationFile
    NtReadFile
    NtSetInformationFile
    NtWriteFile


NtCreatePagingFile

2OO1, 9 February

NtCreatePagingFile
NtCreatePagingFile

NTSYSAPI
NTSTATUS
NTAPI

NtCreatePagingFile(

  IN PUNICODE_STRING      PageFileName,
  IN PLARGE_INTEGER       MiniumSize,
  IN PLARGE_INTEGER       MaxiumSize,
  OUT PLARGE_INTEGER      ActualSize OPTIONAL );

Function NtCreatePagingFile is typically used by Control Panel's "System" applet for creating new paged files.

  • PageFileName
    • System path to newly created paged file.
  • MiniumSize
    • Minimum size of paged file, in bytes. This value must be multiply of page size (0x1000 bytes on x86), and must be greater then 2MB (0x02000000 bytes).
  • MaxiumSize
    • Maximum size of paged file, in bytes. Also this value must be multiply of page size. Minimal value accepted is 5MB (0x05000000 bytes).
  • ActualSize
    • Optional (and currently unused) parameter.

    Documented by:
    Tomasz Nowak
    Reactos

    Requirements:
    Library: ntdll.lib
    Privilege: SE_CREATE_PAGEFILE_PRIVILEGE

    See also:
    SYSTEM_PAGEFILE_INFORMATION


NtDeleteFile

2OOO, 29 December

NtDeleteFile
NtDeleteFile

NTSYSAPI
NTSTATUS
NTAPI

NtDeleteFile(

  IN POBJECT_ATTRIBUTES   ObjectAttributes );

It's very interesting NT System Call... Normally, file deletion is realised as FileDispositionInformation class in a call to NtSetInformationFile. When you use NtDeleteFile, file will be deleted immediatly after call (system isn't waiting for close last HANDLE to file).

ObjectAttributes
You can manipulate ObjectName and RootDirectory members.
Example:
  If you have only file name as Unicode string, use it as ObjectName.
  If you have only a HANDLE to file, set it as RootDirectory. Set ObjectName as empty string.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtCreateFile
NtOpenFile
NtSetInformationFile


NtDeviceIoControlFile

2OO1, 11 February

NtDeviceIoControlFile
NtDeviceIoControlFile

NTSYSAPI
NTSTATUS
NTAPI

NtDeviceIoControlFile(

  IN HANDLE               FileHandle,
  IN HANDLE               Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN ULONG                IoControlCode,
  IN PVOID                InputBuffer OPTIONAL,
  IN ULONG                InputBufferLength,
  OUT PVOID               OutputBuffer OPTIONAL,
  IN ULONG                OutputBufferLength );

Function NtDeviceIoControlFile sends IOCTL_* control code to Device Driver. It is primary (but not the best) solution to communicate between application and Device Driver.

  • FileHandle
    • HANDLE to Device Object opened as a file.
  • Event
    • Optional HANDLE to Event Object signalled on the end of processing request.
  • ApcRoutine
    • Optional pointer to user's APC Routine called on the end of processing request.
  • ApcContext
    • User's parameter to ApcRoutine.
  • IoStatusBlock
    • IO result of call.
  • IoControlCode
    • IO Control code [IOCTL_*].
  • InputBuffer
    • User's allocated buffer with input data.
  • InputBufferLength
    • Length of InputBuffer, in bytes.
  • OutputBuffer
    • User's allocated buffer for result data.
  • OutputBufferLength
    • Length of OutputBuffer, in bytes.

    See also NtFsControlFile.

    Documented by:
    Tomasz Nowak
    Reactos

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateFile
    NtFsControlFile
    NtOpenFile


NtFlushBuffersFile

2OO1, 11 February

NtFlushBuffersFile
NtFlushBuffersFile

NTSYSAPI
NTSTATUS
NTAPI

NtFlushBuffersFile(

  IN HANDLE               FileHandle,
  OUT PIO_STATUS_BLOCK    IoStatusBlock );

Function NtFlushBuffersFile flushes currently cashed data and write it to storage.

  • FileHandle
    • HANDLE to File Object.
  • IoStatusBlock
    • IO result of call.

    Documented by:
    Tomasz Nowak
    Reactos

    Requirements:
    Library: ntdll.lib

    See also:
    NtWriteFile


NtFsControlFile

2OO1, 11 February

NtFsControlFile
NtFsControlFile

NTSYSAPI
NTSTATUS
NTAPI

NtFsControlFile(

  IN HANDLE               FileHandle,
  IN HANDLE               Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN ULONG                FsControlCode,
  IN PVOID                InputBuffer OPTIONAL,
  IN ULONG                InputBufferLength,
  OUT PVOID               OutputBuffer OPTIONAL,
  IN ULONG                OutputBufferLength );

Function NtFsControlFile sends FSCTL_* code to File System Device Driver. See also description of NtDeviceIoControlFile function.

  • FileHandle
    • HANDLE to File System Device Object opened as a file.
  • Event
    • Optional HANDLE to Event Object.
  • ApcRoutine
    • Optional pointer to user's APC Routine.
  • ApcContext
    • Parameter for ApcRoutine.
  • IoStatusBlock
    • IO result of call.
  • FsControlCode
    • Control Code typically defined as FSCTL_*.
  • InputBuffer
    • User's allocated buffer contains input data.
  • InputBufferLength
    • Length of InputBuffer, in bytes.
  • OutputBuffer
    • User's allocated buffer for results of call.
  • OutputBufferLength
    • Length of OutputBuffer, in bytes.

    Documented by:
    Tomasz Nowak
    Reactos

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateFile
    NtDeviceIoControlFile
    NtOpenFile


NtLockFile

2OO1, 6 January

NtLockFile
NtLockFile

NTSYSAPI
NTSTATUS
NTAPI

NtLockFile(

  IN HANDLE               FileHandle,
  IN HANDLE               LockGrantedEvent OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PLARGE_INTEGER       ByteOffset,
  IN PLARGE_INTEGER       Length,
  IN PULONG               Key,
  IN BOOLEAN              ReturnImmediately,
  IN BOOLEAN              ExclusiveLock );

  • FileHandle
    • HANDLE to File Object opened with FILE_READ_DATA access.
  • LockGrantedEvent
    • Optional HANDLE to Event Object, whitch is signaled when lock is created (typically used with ReturnImmediately parameter set to TRUE).
  • ApcRoutine
    • APC routine executed when lock is granted.
  • ApcContext
    • Optional parameter for ApcRoutine.
  • IoStatusBlock
    • IO result of call.
  • ByteOffset
    • Offset (in bytes) to begin of file region to lock.
  • Length
    • Length of region to lock, in bytes.
  • Key
    • Pointer to user's defined 4-bytes key associated with this lock. It can be used in multi-thread process to allow reading or writing data only for one specified thread, whitch known Key value.
  • ReturnImmediately
    • If TRUE, function returns immediately. Caller is informed about lock creation by LockGrantedEvent or by executing ApcRoutine.
  • ExclusiveLock
    • If set, all read and write operation are denied for other processes. If not, only write operation is denied.

    Documented by:
    Reactos
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateFile
    NtOpenFile
    NtReadFile
    NtReadFileScatter
    NtUnlockFile
    NtWriteFile
    NtWriteFileGather


NtNotifyChangeDirectoryFile

2OO1, 1O February

NtNotifyChangeDirectoryFile
NtNotifyChangeDirectoryFile

NTSYSAPI
NTSTATUS
NTAPI

NtNotifyChangeDirectoryFile(

  IN HANDLE               FileHandle,
  IN HANDLE               Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID               Buffer,
  IN ULONG                BufferSize,
  IN ULONG                CompletionFilter,
  IN BOOLEAN              WatchTree );

NtNotifyChangeDirectoryFile is used to process changes to directory File Object. Becouse function returns immediatelly with STATUS_PENDING, you must decide to use Event Object or APC routine as notification form.

  • FileHandle
    • HANDLE to File Object opened with SYNCHRONIZE access and FILE_DIRECTORY_FILE option set.
  • Event
    • HANDLE to Event Object. Event can be created as NotificationEvent or SynchronizationEvent, but second one is better in this situation.
  • ApcRoutine
    • Address of user's APC routine, queued when change complete.
  • ApcContext
    • Optional parameter for ApcRoutine.
  • IoStatusBlock
    • IO result of call. Status member in IoStatusBlock can result STATUS_NOTIFY_ENUM_DIR when Buffer was to small.
  • Buffer
    • User's allocated buffer for change informations. It contains one or more of FILE_NOTIFY_INFORMATION structures.
  • BufferSize
    • Size of Buffer, in bytes.
  • CompletionFilter
    • Mask specifing what sort of changes should be monitored. Can be combination of:
    • FILE_NOTIFY_CHANGE_FILE_NAME
    • FILE_NOTIFY_CHANGE_DIR_NAME
    • FILE_NOTIFY_CHANGE_NAME
    • FILE_NOTIFY_CHANGE_ATTRIBUTES
    • FILE_NOTIFY_CHANGE_SIZE
    • FILE_NOTIFY_CHANGE_LAST_WRITE
    • FILE_NOTIFY_CHANGE_LAST_ACCESS
    • FILE_NOTIFY_CHANGE_CREATION
    • FILE_NOTIFY_CHANGE_EA
    • FILE_NOTIFY_CHANGE_SECURITY
    • FILE_NOTIFY_CHANGE_STREAM_NAME
    • FILE_NOTIFY_CHANGE_STREAM_SIZE
    • FILE_NOTIFY_CHANGE_STREAM_WRITE
  • WatchTree
    • If set, all subdirectiories of specified directory will be also monitored.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    EVENT_TYPE
    FILE_NOTIFY_INFORMATION


NtOpenFile

2OOO, 29 December

NtOpenFile
NtOpenFile

NTSYSAPI
NTSTATUS
NTAPI

NtOpenFile(

  OUT PHANDLE             FileHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN ULONG                ShareAccess,
  IN ULONG                OpenOptions );

(Also avaiable in 2000 DDK.)
  • FileHandle
    • Result of call.
  • DesiredAccess
    • Access mask to opened file object.
  • ObjectAttributes
    • File name, path etc. See NtCreateFile for more information.
  • IoStatusBlock
    • Completion status of call.
  • ShareAccess
    • Sharing option defined as FILE_SHARE_*.
  • OpenOptions
    • Open options.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateFile


NtQueryAttributesFile

2OO1, 9 January

NtQueryAttributesFile
NtQueryAttributesFile

NTSYSAPI
NTSTATUS
NTAPI

NtQueryAttributesFile(

  IN POBJECT_ATTRIBUTES   ObjectAttributes,
  OUT PFILE_BASIC_INFORMATION FileAttributes );

  • ObjectAttributes
    • Contains file name, in NT Objects Namespace format.
  • FileAttributes
    • Becouse only four bytes at offset 0x20 are used, this may be any buffer at least 0x24 bytes length. Time information fields from FILE_BASIC_INFORMATION are skipped.

    Use of NtQueryAttributesFile is the easiest and the best way to check if file exist. NtOpenFile isn't good for this, becouse it modifies last access time for opened file. See NtQueryDirectoryFile for details.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_BASIC_INFORMATION
    NtOpenFile
    NtQueryDirectoryFile
    NtQueryFullAttributesFile
    NtQueryInformationFile


NtQueryDirectoryFile

2OO1, 17 January

NtQueryDirectoryFile
NtQueryDirectoryFile

NTSYSAPI
NTSTATUS
NTAPI

NtQueryDirectoryFile(

  IN HANDLE               FileHandle,
  IN HANDLE               Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID               FileInformation,
  IN ULONG                Length,
  IN FILE_INFORMATION_CLASS FileInformationClass,
  IN BOOLEAN              ReturnSingleEntry,
  IN PUNICODE_STRING      FileMask OPTIONAL,
  IN BOOLEAN              RestartScan );

NtQueryDirectoryFile is used to enumerate entries (files or directories) placed into file container object (directory). Win32 API use it in FindFirstFile-FindNextFile routines.

  • FileHandle
    • HANDLE to File Object opened with FILE_DIRECTORY_FILE option and FILE_LIST_DIRECTORY access.
  • Event
    • Optional HANDLE to Event Object signaled after query complete.
  • ApcRoutine
    • Optinal pointer to user's APC routine queued after query complete.
  • ApcContext
    • Parameter for ApcRoutine.
  • IoStatusBlock
    • Pointer to IO_STATUS_BLOCK structure. After enumeration complete, Information member of this structure contains number of bytes writed into FileInformation buffer. Status member contains IO result of call, and can be one of:
    • STATUS_SUCCESS - Enumeration has results in FileInformation buffer.
    • STATUS_NO_MORE_FILES - FileInformation buffer is empty, and next call isn't needed.
    • STATUS_NO_SUCH_FILE - Returned when FileMask parameter specify exactly one file (don't contains '*' or '?' characters), and queried directory don't contains that file.
  • FileInformation
    • User's allocated buffer for output data.
  • Length
    • Length of FileInformation buffer, in bytes.
  • FileInformationClass
    • Information class. Can be one of:
    • FileDirectoryInformation
    • FileFullDirectoryInformation
    • FileBothDirectoryInformation
    • FileNamesInformation
    • FileOleDirectoryInformation
  • ReturnSingleEntry
    • If set, only one entry is returned.
  • FileMask
    • If specified, only information about files matches this wildchar mask will be returned.
    WARNING: There's no rule specifing what to do when caller makes two calls to NtQueryDirectoryFile both with different masks. Typically FileMask specified in second call will be ignored, and results will match the first (for example: NTFS.SYS). The best solution is to close directory HANDLE after every call with FileMask parameter specified.
  • RestartScan
    • Used with ReturnSingleEntry parameter. If set, NtQueryDirectoryFile continue enumeration after last enumerated element in previous call. If no, returns the first entry in directory.

    For detailed information about results, see FILE_INFORMATION_CLASS with information classes specified above.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateFile
    NtOpenFile
    NtQueryInformationFile
    NtQueryOleDirectoryFile
    NtQueryVolumeInformationFile


NtQueryEaFile

2OO1, 25 January

NtQueryEaFile
NtQueryEaFile

NTSYSAPI
NTSTATUS
NTAPI

NtQueryEaFile(

  IN HANDLE               FileHandle,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID               Buffer,
  IN ULONG                Length,
  IN BOOLEAN              ReturnSingleEntry,
  IN PVOID                EaList OPTIONAL,
  IN ULONG                EaListLength,
  IN PULONG               EaIndex OPTIONAL,
  IN BOOLEAN              RestartScan );

NtQueryEaFile is used to read EA from NTFS file. For more information about EA see FILE_FULL_EA_INFORMATION.
  • FileHandle
    • HANDLE to File Object opened with FILE_READ_EA access.
  • IoStatusBlock
    • IO result of call.
  • Buffer
    • Caller's allocated buffer for output data. See FILE_FULL_EA_INFORMATION for detailed description of fields avaiable in buffer.
  • Length
    • Length of buffer, in bytes.
  • ReturnSingleEntry
    • If set, only one entry is returned.
  • EaList
    • Optional list of FILE_GET_EA_INFORMATION structures containing names of EA.
  • EaListLength
    • Length of EaList, in bytes.
  • EaIndex
    • Pointer to ULONG value contains 1-based index of queried attribute.
  • RestartScan
    • If set, result is the first quered EA.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_FULL_EA_INFORMATION
    FILE_GET_EA_INFORMATION
    NtCreateFile
    NtSetEaFile


NtQueryFullAttributesFile

2OO1, 11 February

NtQueryFullAttributesFile
NtQueryFullAttributesFile

NTSYSAPI
NTSTATUS
NTAPI

NtQueryFullAttributesFile(

  IN POBJECT_ATTRIBUTES   ObjectAttributes,
  OUT PVOID               Attributes );

Function NtQueryFullAttributesFile is used to get information about file stored on low-speed connection device. See also description of NtQueryAttributesFile function.

  • ObjectAttributes
    • Path and name of File Object to query.
  • Attributes
    • Pointer to FILE_NETWORK_OPEN_INFORMATION structure.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_NETWORK_OPEN_INFORMATION
    NtQueryAttributesFile


NtQueryInformationFile

2OOO, 3O December

NtQueryInformationFile
NtQueryInformationFile

NTSYSAPI
NTSTATUS
NTAPI

NtQueryInformationFile(

  IN HANDLE               FileHandle,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID               FileInformation,
  IN ULONG                Length,
  IN FILE_INFORMATION_CLASS FileInformationClass );

(Also avaiable in Microsoft 2000 DDK)
  • FileHandle
    • HANDLE to File Object.
  • IoStatusBlock
    • Completion status of call.
  • FileInformation
    • Caller's allocated buffer for result data.
  • Length
    • Length of FileInformation buffer, in bytes.
  • FileInformationClass
    • Enumerated information class. See FILE_INFORMATION_CLASS for detailed information about usage.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_INFORMATION_CLASS
    NtCreateFile
    NtOpenFile
    NtQueryAttributesFile
    NtQueryDirectoryFile
    NtSetInformationFile


NtQueryOleDirectoryFile

2OO1, 3 March

NtQueryOleDirectoryFile
NtQueryOleDirectoryFile

NTSYSAPI
NTSTATUS
NTAPI

NtQueryOleDirectoryFile(

  IN HANDLE               FileHandle,
  IN HANDLE               Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID               FileInformation,
  IN ULONG                Length,
  IN FILE_INFORMATION_CLASS FileInformationClass,
  IN BOOLEAN              ReturnSingleEntry,
  IN PUNICODE_STRING      FileMask OPTIONAL,
  IN BOOLEAN              RestartScan );

Function NtQueryOleDirectoryFile is obsolete, and it's no longer exported. All OLE functionality is implemented in function NtQueryDirectoryFile, also in NT ver. 4.0 .

All function's parameters are descripted in NtQueryDirectoryFile section.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtQueryDirectoryFile


NtQueryVolumeInformationFile

2OO1, 2O January

NtQueryVolumeInformationFile
NtQueryVolumeInformationFile

NTSYSAPI
NTSTATUS
NTAPI

NtQueryVolumeInformationFile(

  IN HANDLE               FileHandle,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID               FileSystemInformation,
  IN ULONG                Length,
  IN FS_INFORMATION_CLASS FileSystemInformationClass );

  • FileHandle
    • HANDLE to File Object.
  • IoStatusBlock
    • IO result of call.
  • FileSystemInformation
    • Caller's allocated buffer for output data.
  • Length
    • Length of FileSystemInformation buffer, in bytes.
  • FileSystemInformationClass
    • Information class descripted in FS_INFORMATION_CLASS topic.

    NtQueryVolumeInformationFile gives information about volume (device) containing file specified as FileHandle parameter.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FS_INFORMATION_CLASS
    NtOpenFile
    NtSetVolumeInformationFile


NtReadFile

2OO1, 15 January

NtReadFile
NtReadFile

NTSYSAPI
NTSTATUS
NTAPI

NtReadFile(

  IN HANDLE               FileHandle,
  IN HANDLE               Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID               Buffer,
  IN ULONG                Length,
  IN PLARGE_INTEGER       ByteOffset OPTIONAL,
  IN PULONG               Key OPTIONAL );

(Also descripted in Win2000 DDK)
  • FileHandle
    • HANDLE to File Object opened with FILE_READ_DATA access.
  • Event
    • Optional HANDLE to Event Object signaled when reading is done.
  • ApcRoutine
    • User defined APC routine queued for execute after reading is done.
  • ApcContext
    • User parameter to ApcRoutine.
  • IoStatusBlock
    • Pointer to IO_STATUS structure received IO status of file reading.
  • Buffer
    • User-allocated buffer for readed data.
  • Length
    • Length of Buffer, in bytes.
  • ByteOffset
    • Offset from begining of file, in bytes.
  • Key
    • - ??? (In my opinion: use this, if you previously lock file, and now you want read it, but without unlocking).

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateFile
    NtOpenFile
    NtWriteFile


NtReadFileScatter

2OO1, 14 February

NtReadFileScatter
NtReadFileScatter

NTSYSAPI
NTSTATUS
NTAPI

NtReadFileScatter(

  IN HANDLE               FileHandle,
  IN HANDLE               Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN FILE_SEGMENT_ELEMENT SegmentArray,
  IN ULONG                Length,
  IN PLARGE_INTEGER       ByteOffset,
  IN PULONG               Key OPTIONAL );

Function NtReadFileScatter reads specified block from file into multiple buffers. Each buffer must have one page length (0x1000 bytes on x86).

  • FileHandle
    • HANDLE to File Object opened with FILE_READ_DATA access and with FILE_NO_INTERMEDIATE_BUFFERING open option.
  • Event
    • HANDLE to Event Object signaled when reading is complete. This parameter is optional, but caller should use one of notification way, becouse function always use asynchronous reading method.
  • ApcRoutine
    • Optional pointer to user's APC Routine.
  • ApcContext
    • User's parameter for ApcRoutine.
  • IoStatusBlock
    • IO result of call.
  • SegmentArray
    • Array of FILE_SEGMENT_ELEMENT unions. Any element point to allocated memory page address. Last element of array must be NULL.
  • Length
    • Number of bytes to read.
  • ByteOffset
    • Pointer to LARGE_INTEGER value indicates reading start position.
  • Key
    • Optional pointer to user's key, used when file is locked (see NtLockFile).

    See also ReadFileScatter description in Microsoft SDK.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateFile
    NtLockFile
    NtOpenFile
    NtReadFile
    NtUnlockFile
    NtWriteFileGather


NtSetEaFile

2OO1, 26 January

NtSetEaFile
NtSetEaFile

NTSYSAPI
NTSTATUS
NTAPI

NtSetEaFile(

  IN HANDLE               FileHandle,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PVOID                EaBuffer,
  IN ULONG                EaBufferSize );

See NtQueryEaFile for information about EA.
  • FileHandle
    • HANDLE to File Object opened with FILE_SET_EA access.
  • IoStatusBlock
    • IO result of call.
  • EaBuffer
    • User's allocated input buffer containing one or more FILE_FULL_EA_INFORMATION structures.
  • EaBufferSize
    • Size of EaBuffer, in bytes.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_FULL_EA_INFORMATION
    NtCreateFile
    NtQueryEaFile


NtSetInformationFile

2OO1, 26 January

NtSetInformationFile
NtSetInformationFile

NTSYSAPI
NTSTATUS
NTAPI

NtSetInformationFile(

  IN HANDLE               FileHandle,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PVOID                FileInformation,
  IN ULONG                Length,
  IN FILE_INFORMATION_CLASS FileInformationClass );

(Description of this function is also avaiable in Win2000 DDK)
  • FileHandle
    • HANDLE to File Object.
  • IoStatusBlock
    • IO result of call.
  • FileInformation
    • User's allocated buffer contains data to set to.
  • Length
    • Length of FileInformation buffer, in bytes.
  • FileInformationClass
    • See FILE_INFORMATION_CLASS for possible information classes and required contents of FileInformation buffer.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_INFORMATION_CLASS
    NtOpenFile
    NtQueryInformationFile
    NtSetVolumeInformationFile


NtSetVolumeInformationFile

2OO1, 2O January

NtSetVolumeInformationFile
NtSetVolumeInformationFile

NTSYSAPI
NTSTATUS
NTAPI

NtSetVolumeInformationFile(

  IN HANDLE               FileHandle,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PVOID                FileSystemInformation,
  IN ULONG                Length,
  IN FS_INFORMATION_CLASS FileSystemInformationClass );

  • FileHandle
    • HANDLE to File Object.
  • IoStatusBlock
    • IO result of call.
  • FileSystemInformation
    • Buffer containing information to set, dependly to FileSystemInformationClass parameter.
  • Length
    • Length of FileSystemInformation buffer, in bytes.
  • FileSystemInformationClass
    • Class of information to set. See FS_INFORMATION_CLASS for valid information classes.

    NtSetVolumeInformationFile sets information to volume (device) containing file specified in FileHandle parameter.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FS_INFORMATION_CLASS
    NtQueryVolumeInformationFile


NtUnlockFile

2OO1, 6 January

NtUnlockFile
NtUnlockFile

NTSYSAPI
NTSTATUS
NTAPI

NtUnlockFile(

  IN HANDLE               FileHandle,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PLARGE_INTEGER       ByteOffset,
  IN PLARGE_INTEGER       Length,
  IN PULONG               Key );

  • FileHandle
    • HANDLE to File Object with locked region.
  • IoStatusBlock
    • IO result of function call.
  • ByteOffset
    • Offset in file where unlock region begins.
  • Length
    • Length of region to unlock.
  • Key
    • Pointer to 4-bytes key associated with lock. See NtLockFile for additional information about locking by key usage.

    Documented by:
    Reactos
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateFile
    NtLockFile
    NtOpenFile
    NtReadFile
    NtReadFileScatter
    NtWriteFile
    NtWriteFileGather


NtWriteFile

2OO1, 16 January

NtWriteFile
NtWriteFile

NTSYSAPI
NTSTATUS
NTAPI

NtWriteFile(

  IN HANDLE               FileHandle,
  IN HANDLE               Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PVOID                Buffer,
  IN ULONG                Length,
  IN PLARGE_INTEGER       ByteOffset OPTIONAL,
  IN PULONG               Key OPTIONAL );

(Also descripted in Win 2000 DDK)
  • FileHandle
    • HANDLE to File Object opened with FILE_WRITE_DATA access.
  • Event
    • HANDLE to Event Object signaled when write finished.
  • ApcRoutine
    • User APC routine executed after writing is complete.
  • ApcContext
    • Parameter to ApcRoutine.
  • IoStatusBlock
    • IO result of call.
  • Buffer
    • Buffer with data to write.
  • Length
    • Length of Buffer, in bytes.
  • ByteOffset
    • Offset from begining of file, where write starts.
  • Key
    • - ??? (See NtReadFile).

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateFile
    NtOpenFile
    NtReadFile


NtWriteFileGather

2OO1, 14 February

NtWriteFileGather
NtWriteFileGather

NTSYSAPI
NTSTATUS
NTAPI

NtWriteFileGather(

  IN HANDLE               FileHandle,
  IN HANDLE               Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN FILE_SEGMENT_ELEMENT SegmentArray,
  IN ULONG                Length,
  IN PLARGE_INTEGER       ByteOffset,
  IN PULONG               Key OPTIONAL );

Function NtWriteFileGather writes specified block of file with data from memory pages. See NtReadFileScatter for more information.

  • FileHandle
    • HANDLE to File Object opened with FILE_WRITE_DATA access and FILE_NO_INTERMEDIATE_BUFFERING open option.
    Warring: You cannot use File Object opened with FILE_APPEND_DATA access.
  • Event
    • HANDLE to Event Object signaled when writing will finish. Function always use asynchronous writing operation, so caller should define Event or ApcRoutine parameter.
  • ApcRoutine
    • Pointer to user's APC Routine.
  • ApcContext
    • Parameter for ApcRoutine.
  • IoStatusBlock
    • IO result of call.
  • SegmentArray
    • Array of FILE_SEGMENT_ELEMENT elements pointing to memory pages to write. Last array element must be NULL.
  • Length
    • Number of bytes to write.
  • ByteOffset
    • Pointer to LARGE_INTEGER value indicates starting position for write.
  • Key
    • Pointer to user's defined key, used when file is locked (see NtLockFile).

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateFile
    NtLockFile
    NtOpenFile
    NtReadFileScatter
    NtWriteFile


FILE_INFORMATION_CLASS

2OO1, 14 February

FILE_INFORMATION_CLASS
FILE_INFORMATION_CLASS

typedef enum _FILE_INFORMATION_CLASS {

    FileDirectoryInformation=1,
    FileFullDirectoryInformation,
    FileBothDirectoryInformation,
    FileBasicInformation,
    FileStandardInformation,
    FileInternalInformation,
    FileEaInformation,
    FileAccessInformation,
    FileNameInformation,
    FileRenameInformation,
    FileLinkInformation,
    FileNamesInformation,
    FileDispositionInformation,
    FilePositionInformation,
    FileFullEaInformation,
    FileModeInformation,
    FileAlignmentInformation,
    FileAllInformation,
    FileAllocationInformation,
    FileEndOfFileInformation,
    FileAlternateNameInformation,
    FileStreamInformation,
    FilePipeInformation,
    FilePipeLocalInformation,
    FilePipeRemoteInformation,
    FileMailslotQueryInformation,
    FileMailslotSetInformation,
    FileCompressionInformation,
    FileCopyOnWriteInformation,
    FileCompletionInformation,
    FileMoveClusterInformation,
    FileQuotaInformation,
    FileReparsePointInformation,
    FileNetworkOpenInformation,
    FileObjectIdInformation,
    FileTrackingInformation,
    FileOleDirectoryInformation,
    FileContentIndexInformation,
    FileInheritContentIndexInformation,
    FileOleInformation,
    FileMaximumInformation

} FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;

Enumeration type FILE_INFORMATION_CLASS defines informational classes for File Objects. It's used by NtQueryInformationFile, NtQueryDirectoryFile and NtSetInformationFile functions.

  • FileDirectoryInformation=1
    • Action | : Query
Buffer size | : 0x48
Structure | : FILE_DIRECTORY_INFORMATION
Function | : NtQueryDirectoryFile
  • FileFullDirectoryInformation
    • Action | : Query
Buffer size | : 0x48
Structure | : FILE_FULL_DIR_INFORMATION
Function | : NtQueryDirectoryFile
  • FileBothDirectoryInformation
    • Action | : Query
Buffer size | : 0x48
Structure | : FILE_BOTH_DIR_INFORMATION
Function | : NtQueryDirectoryFile
  • FileBasicInformation
    • Action | : Query
Buffer size | : 0x28
Structure | : FILE_BASIC_INFORMATION
Function | : NtQueryInformationFile

    Action | : Set
Buffer size | : 0x28
Structure | : FILE_BASIC_INFORMATION
Function | : NtSetInformationFile
  • FileStandardInformation
    • Action | : Query
Buffer size | : 0x18
Structure | : FILE_STANDARD_INFORMATION
Function | : NtQueryInformationFile
  • FileInternalInformation
    • Action | : Query
Buffer size | : 0x08
Structure | : FILE_INTERNAL_INFORMATION
Function | : NtQueryInformationFile
  • FileEaInformation
    • Action | : Query
Buffer size | : 0x04
Structure | : FILE_EA_INFORMATION
Function | : NtQueryInformationFile
  • FileAccessInformation
    • // 8 FILE_ACCESS_INFORMATION 0x04 NtQueryInformationFile
  • FileNameInformation
    • Action | : Query
Buffer size | : 0x08+
Structure | : FILE_NAME_INFORMATION
Function | : NtQueryInformationFile
  • FileRenameInformation
    • Action | : Set
Buffer size | : 0x10
Structure | : FILE_RENAME_INFORMATION
Function | : NtSetInformationFile
  • FileLinkInformation
    • Action | : Set
Buffer size | : 0x10
Structure | : FILE_LINK_INFORMATION
Function | : NtSetInformationFile
  • FileNamesInformation
    • Action | : Query
Buffer size | : 0x10
Structure | : FILE_NAMES_INFORMATION
Function | : NtQueryDirectoryFile
  • FileDispositionInformation
    • Action | : Set
Buffer size | : 0x01
Structure | : FILE_DISPOSITION_INFORMATION
Function | : NtSetInformationFile
  • FilePositionInformation
    • Action | : Query
Buffer size | : 0x08
Structure | : FILE_POSITION_INFORMATION
Function | : NtQueryInformationFile

    Action | : Set
Buffer size | : 0x08
Structure | : FILE_POSITION_INFORMATION
Function | : NtSetInformationFile
  • FileFullEaInformation
    • // 15 FILE_FULL_EA_INFORMATION ??? ???
  • FileModeInformation
    • // 16 FILE_MODE_INFORMATION 0x04 0x04 NtQueryInformationFile
  • FileAlignmentInformation
    • // 17 FILE_ALIGNMENT_INFORMATION 0x04 NtQueryInformationFile
  • FileAllInformation
    • Action | : Query
Buffer size | : 0x68
Structure | : FILE_ALL_INFORMATION
Function | : NtQueryInformationFile
  • FileAllocationInformation
    • // 19 FILE_ALLOCATION_INFORMATION 0x08
  • FileEndOfFileInformation
    • Action | : Set
Buffer size | : 0x08
Structure | : FILE_END_OF_FILE_INFORMATION
Function | : NtSetInformationFile
  • FileAlternateNameInformation
    • Action | : Query
Buffer size | : 0x08+
Structure | : FILE_NAME_INFORMATION
Function | : NtQueryInformationFile
  • FileStreamInformation
    • // 22 FILE_STREAM_INFORMATION 0x20 NtQueryInformationFile
  • FilePipeInformation
    • // 23 FILE_PIPE_INFORMATION 0x08 0x08 NtQueryInformationFile
  • FilePipeLocalInformation
    • // 24 FILE_PIPE_LOCAL_INFORMATION 0x28 NtQueryInformationFile
  • FilePipeRemoteInformation
    • // 25 FILE_PIPE_REMOTE_INFORMATION 0x10 0x10 NtQueryInformationFile
  • FileMailslotQueryInformation
    • // 26 FILE_MAILSLOT_QUERY_INFORMATION 0x18 NtQueryInformationFile
  • FileMailslotSetInformation
    • // 27 FILE_MAILSLOT_SET_INFORMATION 0x04
  • FileCompressionInformation
    • // 28 FILE_COMPRESSION_INFORMATION 0x10 NtQueryInformationFile
  • FileCopyOnWriteInformation
    • // 29 FILE_COPY_ON_WRITE_INFORMATION 0x10
  • FileCompletionInformation
    • Action | : Set
Buffer size | : 0x08
Structure | : FILE_COMPLETION_INFORMATION
Function | : NtSetInformationFile
  • FileMoveClusterInformation
    • // 31 0x10
  • FileQuotaInformation
    • // 32 FILE_QUOTA_INFORMATION 0x10 -> FileOleClassIdInformation
  • FileReparsePointInformation
    • // 33 0x08 -> FileOleStateBitsInformation
  • FileNetworkOpenInformation
    • Action | : Query
Buffer size | : 0x38
Structure | : FILE_NETWORK_OPEN_INFORMATION
Function | : NtQueryInformationFile
  • FileObjectIdInformation
    • // 35 FILE_ATTRIBUTE_TAG_INFORMATION 0x14
  • FileTrackingInformation
    • // 36 0xC0 NtQueryInformationFile -> FileOleAllInformation
  • FileOleDirectoryInformation
    • // 37 0x60 NtQueryDirectoryFile
  • FileContentIndexInformation
    • // 38 0x01
  • FileInheritContentIndexInformation
    • // 39 0x01
  • FileOleInformation
    • // 40 0x38 0x38 NtQueryInformationFile
  • FileMaximumInformation
    • // 41

    Documented by:
    Tomasz Nowak
    Bo Branten
    SysInternals

    Requirements:
    Library: ntdll.lib

    See also:
    NtQueryDirectoryFile
    NtQueryInformationFile
    NtQueryOleDirectoryFile
    NtSetInformationFile


FS_INFORMATION_CLASS

2OO1, 19 January

FS_INFORMATION_CLASS
FS_INFORMATION_CLASS

typedef enum _FS_INFORMATION_CLASS {

    FileFsVolumeInformation=1,
    FileFsLabelInformation,
    FileFsSizeInformation,
    FileFsDeviceInformation,
    FileFsAttributeInformation,
    FileFsControlInformation,
    FileFsFullSizeInformation,
    FileFsObjectIdInformation,
    FileFsMaximumInformation

} FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;

FS_INFORMATION_CLASS enumeration type is used in a call to NtQueryVolumeInformationFile and NtSetVolumeInformationFile.

  • FileFsVolumeInformation
    • Action | : Query
Buffer size | : 0x18
Structure | : FILE_FS_VOLUME_INFORMATION
  • FileFsLabelInformation
    • Action | : Set
Buffer size | : 0x08
Structure | : FILE_FS_LABEL_INFORMATION
  • FileFsSizeInformation
    • Action | : Query
Buffer size | : 0x18
Structure | : FILE_FS_SIZE_INFORMATION
  • FileFsDeviceInformation
    • Action | : Query
Buffer size | : 0x08
Structure | : FILE_FS_DEVICE_INFORMATION
  • FileFsAttributeInformation
    • Action | : Query
Buffer size | : 0x10
Structure | : FILE_FS_ATTRIBUTE_INFORMATION
  • FileFsControlInformation
    • Action | : Query, Set
Buffer size | : 0x30, 0x30
Structure | : FILE_FS_CONTROL_INFORMATION
  • FileFsFullSizeInformation
    • Action | : Query
Buffer size | : 0x38
Structure | : ???
  • FileFsObjectIdInformation
    • Action | : Set
Buffer size | : 0x38
Structure | : ???

    Documented by:
    Tomasz Nowak
    Bo Branten
    Reactos

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_FS_ATTRIBUTE_INFORMATION
    FILE_FS_CONTROL_INFORMATION
    FILE_FS_DEVICE_INFORMATION
    FILE_FS_LABEL_INFORMATION
    FILE_FS_SIZE_INFORMATION
    FILE_FS_VOLUME_INFORMATION
    NtQueryVolumeInformationFile
    NtSetVolumeInformationFile


FILE_BASIC_INFORMATION

2OO1, 5 March

FILE_BASIC_INFORMATION
FILE_BASIC_INFORMATION

typedef struct _FILE_BASIC_INFORMATION {

  LARGE_INTEGER           CreationTime;
  LARGE_INTEGER           LastAccessTime;
  LARGE_INTEGER           LastWriteTime;
  LARGE_INTEGER           ChangeTime;
  ULONG                   FileAttributes;

} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;

Structure FILE_BASIC_INFORMATION is used in a call to function NtSetInformationFile with FileBasicInformation information class, and is received in a call to NtQueryInformationFile with the same information class. Also function NtQueryAttributesFile uses as a result FILE_BASIC_INFORMATION, but it fills only FileAttributes field. See required function's description for details.

  • CreationTime
    • Time of file creation, in 100-ns units.
  • LastAccessTime
    • Time of last open operation, in 100-ns units.
  • LastWriteTime
    • Time of last write operation, in 100-ns units.
  • ChangeTime
    • Time of any last change, in 100-ns units.
  • FileAttributes
    • File attributes. See NtCreateFile for possibilities.

    Structure is also avaiable in Microsoft DDK.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_INFORMATION_CLASS
    NtCreateFile
    NtQueryAttributesFile
    NtQueryInformationFile
    NtSetInformationFile


FILE_BOTH_DIR_INFORMATION

2OO1, 13 April

FILE_BOTH_DIR_INFORMATION
FILE_BOTH_DIR_INFORMATION

typedef struct _FILE_BOTH_DIR_INFORMATION {

  ULONG                   NextEntryOffset;
  ULONG                   FileIndex;
  LARGE_INTEGER           CreationTime;
  LARGE_INTEGER           LastAccessTime;
  LARGE_INTEGER           LastWriteTime;
  LARGE_INTEGER           ChangeTime;
  LARGE_INTEGER           EndOfFile;
  LARGE_INTEGER           AllocationSize;
  ULONG                   FileAttributes;
  ULONG                   FileNameLength;
  ULONG                   EaSize;
  BYTE                    ShortNameLength;
  WCHAR                   ShortName[12];
  WCHAR                   FileName[1];

} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;

Structure FILE_BOTH_DIR_INFORMATION is returned as a result of call NtQueryDirectoryFile with FileBothDirectoryInformation information class. It's extended version of FILE_FULL_DIR_INFORMATION structure, additionally containing short file name. It's used in Win32 API calls FindFirstFile and FindNextFile.

  • NextEntryOffset
    • Offset (in bytes) of next FILE_BOTH_DIR_INFORMATION structure placed in result buffer. If there's no more entries, NextEntryOffset is set to zero.
  • FileIndex
    • File index value, or zero, if directory indexing is not avaiable.
  • CreationTime
    • Time of object creation;
  • LastAccessTime
    • Last access time. Means time when last open operation was performed.
  • LastWriteTime
    • Time of last write data.
  • ChangeTime
    • Time of last change.
  • EndOfFile
    • Specify length of file, in bytes.
  • AllocationSize
    • Specify real size of file on device. It must be equal or greater to EndOfFile member.
  • FileAttributes
    • Attributes of file.
  • FileNameLength
    • Length of FileName array, in bytes.
  • EaSize
    • Size of Extended Attributes associated with file. See also FILE_EA_INFORMATION structure.
  • ShortNameLength
    • Length ShortName array, in bytes.
  • ShortName[12]
    • Alternate file name, in UNICODE format. Empty string means:
    1. Primary name is compatible with 8DOT3 (MS DOS) standart, and there's no reason to set the same name twice;
    2. File system don't improve short names;
  • FileName[1]
    • UNICODE string specifing file name.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_DIRECTORY_INFORMATION
    FILE_FULL_DIR_INFORMATION
    FILE_INFORMATION_CLASS
    FILE_NAME_INFORMATION
    FILE_NAMES_INFORMATION
    NtQueryDirectoryFile
    NtQueryOleDirectoryFile


FILE_DIRECTORY_INFORMATION

2OO1, 13 April

FILE_DIRECTORY_INFORMATION
FILE_DIRECTORY_INFORMATION

typedef struct _FILE_DIRECTORY_INFORMATION {

  ULONG                   NextEntryOffset;
  ULONG                   FileIndex;
  LARGE_INTEGER           CreationTime;
  LARGE_INTEGER           LastAccessTime;
  LARGE_INTEGER           LastWriteTime;
  LARGE_INTEGER           ChangeTime;
  LARGE_INTEGER           EndOfFile;
  LARGE_INTEGER           AllocationSize;
  ULONG                   FileAttributes;
  ULONG                   FileNameLength;
  WCHAR                   FileName[1];

} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;

Structure FILE_DIRECTORY_INFORMATION is returned as a result of call NtQueryDirectoryFile with FileDirectoryInformation information class. It contains some typical informations about directory entries.

  • NextEntryOffset
    • Offset (in bytes) of next FILE_DIRECTORY_INFORMATION structure placed in result buffer. If there's no more entries, NextEntryOffset is set to zero.
  • FileIndex
    • File index value, or zero, if directory indexing is not avaiable.
  • CreationTime
    • Time of object creation;
  • LastAccessTime
    • Last access time. Means time when last open operation was performed.
  • LastWriteTime
    • Time of last write data.
  • ChangeTime
    • Time of last change.
  • EndOfFile
    • Specify length of file, in bytes.
  • AllocationSize
    • Specify real size of file on device. It must be equal or greater to EndOfFile member.
  • FileAttributes
    • Attributes of file.
  • FileNameLength
    • Length of FileName array, in bytes.
  • FileName[1]
    • UNICODE string specifing file name.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_BOTH_DIR_INFORMATION
    FILE_FULL_DIR_INFORMATION
    FILE_INFORMATION_CLASS
    FILE_NAMES_INFORMATION
    NtQueryDirectoryFile


FILE_FS_ATTRIBUTE_INFORMATION

2OO1, 2O January

FILE_FS_ATTRIBUTE_INFORMATION
FILE_FS_ATTRIBUTE_INFORMATION

typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {

  ULONG                   FileSystemAttributes;
  LONG                    MaximumComponentNameLength;
  ULONG                   FileSystemNameLength;
  WCHAR                   FileSystemName[1];

} FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;

FILE_FS_ATTRIBUTE_INFORMATION is output buffer in a call to NtQueryVolumeInformationFile function with FileFsAttributeInformation information class.
  • FileSystemAttributes
    • - ??? (0x1F)
  • MaximumComponentNameLength
    • Maximum length of file name on specified device.
  • FileSystemNameLength
    • Length of FileSystemName array, in bytes.
  • FileSystemName[1]
    • Name of File System on specified device (ex. "NTFS").

    Documented by:
    Bo Branten
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    FS_INFORMATION_CLASS
    NtQueryVolumeInformationFile


FILE_FS_CONTROL_INFORMATION

2OO1, 2O January

FILE_FS_CONTROL_INFORMATION
FILE_FS_CONTROL_INFORMATION

typedef struct _FILE_FS_CONTROL_INFORMATION {

  LARGE_INTEGER           FreeSpaceStartFiltering;
  LARGE_INTEGER           FreeSpaceThreshold;
  LARGE_INTEGER           FreeSpaceStopFiltering;
  LARGE_INTEGER           DefaultQuotaThreshold;
  LARGE_INTEGER           DefaultQuotaLimit;
  ULONG                   FileSystemControlFlags;

} FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;

Structure FILE_FS_CONTROL_INFORMATION is user as input and output buffers in calls to NtQueryVolumeInformationFile and NtSetVolumeInformationFile with information class set to FileFsControlInformation.
  • FreeSpaceStartFiltering
  • FreeSpaceThreshold
  • FreeSpaceStopFiltering
  • DefaultQuotaThreshold
  • DefaultQuotaLimit
  • FileSystemControlFlags

    • Documented by:
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FS_INFORMATION_CLASS
    NtQueryVolumeInformationFile
    NtSetVolumeInformationFile


FILE_FS_DEVICE_INFORMATION

2OO1, 2O January

FILE_FS_DEVICE_INFORMATION
FILE_FS_DEVICE_INFORMATION

typedef struct _FILE_FS_DEVICE_INFORMATION {

  DEVICE_TYPE             DeviceType;
  ULONG                   Characteristics;

} FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;

FILE_FS_DEVICE_INFORMATION represents output buffer in a call to NtQueryVolumeInformationFile with FileFsDeviceInformation information class. Structure is avaiable in <ntddk.h> header file from Win2000 DDK.

  • DeviceType
    • Numeric device types are defined in <ntddk.h> as FILE_DEVICE_* precompiler definitions.
  • Characteristics
    • Or-ed bit mask of device characteristic. Can be one of:
    • FILE_REMOVABLE_MEDIA
    • FILE_READ_ONLY_DEVICE
    • FILE_FLOPPY_DISKETTE
    • FILE_WRITE_ONCE_MEDIA
    • FILE_REMOTE_DEVICE
    • FILE_DEVICE_IS_MOUNTED
    • FILE_VIRTUAL_VOLUME
    • FILE_AUTOGENERATED_DEVICE_NAME
    • FILE_DEVICE_SECURE_OPEN

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    FS_INFORMATION_CLASS
    NtQueryVolumeInformationFile


FILE_FS_LABEL_INFORMATION

2OO1, 2O January

FILE_FS_LABEL_INFORMATION
FILE_FS_LABEL_INFORMATION

typedef struct _FILE_FS_LABEL_INFORMATION {

  ULONG                   VolumeLabelLength;
  WCHAR                   VolumeLabel[1];

} FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;

Structure is an input buffer for NtSetVolumeInformationFile call with information class FileFsLabelInformation.

  • VolumeLabelLength
    • Length of VolumeLabel array, in bytes.
  • VolumeLabel[1]
    • Label for specified volume.

    Documented by:
    Bo Branten
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    FS_INFORMATION_CLASS
    NtSetVolumeInformationFile


FILE_FS_SIZE_INFORMATION

2OO1, 2O January

FILE_FS_SIZE_INFORMATION
FILE_FS_SIZE_INFORMATION

typedef struct _FILE_FS_SIZE_INFORMATION {

  LARGE_INTEGER           TotalAllocationUnits;
  LARGE_INTEGER           AvailableAllocationUnits;
  ULONG                   SectorsPerAllocationUnit;
  ULONG                   BytesPerSector;

} FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;

Structure provides detailed information about volume physical size. Is returned in call to NtQueryVolumeInformationFile with FileFsSizeInformation information class.
  • TotalAllocationUnits
  • AvailableAllocationUnits
  • SectorsPerAllocationUnit
  • BytesPerSector

    • Documented by:
    Bo Branten
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    FS_INFORMATION_CLASS
    NtQueryVolumeInformationFile


FILE_FS_VOLUME_INFORMATION

2OO1, 2O January

FILE_FS_VOLUME_INFORMATION
FILE_FS_VOLUME_INFORMATION

typedef struct _FILE_FS_VOLUME_INFORMATION {

  LARGE_INTEGER           VolumeCreationTime;
  ULONG                   VolumeSerialNumber;
  ULONG                   VolumeLabelLength;
  BOOLEAN                 SupportsObjects;
  WCHAR                   VolumeLabel[1];

} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;

Structure provides basic information about volume. It's filled in a result of call NtQueryVolumeInformationFile with FileFsVolumeInformation class.

  • VolumeCreationTime
    • It means time of last Volume Formating Process.
  • VolumeSerialNumber
    • Serial number of volume, associated in Volume Formating Process.
  • VolumeLabelLength
    • Length of VolumeLabel array, in bytes.
  • SupportsObjects
    • If TRUE, Object Files can be stored on specified volume.
  • VolumeLabel[1]
    • Name of volume. Can be set with FileFsLabelInformation.

    Documented by:
    Bo Branten
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_FS_LABEL_INFORMATION
    FS_INFORMATION_CLASS
    NtQueryVolumeInformationFile


FILE_FULL_DIR_INFORMATION

2OO1, 13 April

FILE_FULL_DIR_INFORMATION
FILE_FULL_DIR_INFORMATION

typedef struct _FILE_FULL_DIR_INFORMATION {

  ULONG                   NextEntryOffset;
  ULONG                   FileIndex;
  LARGE_INTEGER           CreationTime;
  LARGE_INTEGER           LastAccessTime;
  LARGE_INTEGER           LastWriteTime;
  LARGE_INTEGER           ChangeTime;
  LARGE_INTEGER           EndOfFile;
  LARGE_INTEGER           AllocationSize;
  ULONG                   FileAttributes;
  ULONG                   FileNameLength;
  ULONG                   EaSize;
  WCHAR                   FileName[1];

} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;

Structure FILE_FULL_DIR_INFORMATION is returned as a result of call NtQueryDirectoryFile with FileFullDirectoryInformation information class. It contains some typical informations about directory entries, like a FILE_DIRECTORY_INFORMATION structure, but additionally contains member specifing size of Extended Attributes.

  • NextEntryOffset
    • Offset (in bytes) of next FILE_FULL_DIR_INFORMATION structure placed in result buffer. If there's no more entries, NextEntryOffset is set to zero.
  • FileIndex
    • File index value, or zero, if directory indexing is not avaiable.
  • CreationTime
    • Time of object creation;
  • LastAccessTime
    • Last access time. Means time when last open operation was performed.
  • LastWriteTime
    • Time of last write data.
  • ChangeTime
    • Time of last change.
  • EndOfFile
    • Specify length of file, in bytes.
  • AllocationSize
    • Specify real size of file on device. It must be equal or greater to EndOfFile member.
  • FileAttributes
    • Attributes of file.
  • FileNameLength
    • Length of FileName array, in bytes.
  • EaSize
    • Size of Extended Attributes associated with file. See also FILE_EA_INFORMATION structure.
  • FileName[1]
    • UNICODE string specifing file name.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_BOTH_DIR_INFORMATION
    FILE_DIRECTORY_INFORMATION
    FILE_INFORMATION_CLASS
    FILE_NAMES_INFORMATION
    NtQueryDirectoryFile
    NtQueryOleDirectoryFile


FILE_FULL_EA_INFORMATION

2OO1, 25 January

FILE_FULL_EA_INFORMATION
FILE_FULL_EA_INFORMATION

typedef struct _FILE_FULL_EA_INFORMATION {

  ULONG                   NextEntryOffset;
  BYTE                    Flags;
  BYTE                    EaNameLength;
  USHORT                  EaValueLength;
  CHAR                    EaName[1];

} FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;

Structure FILE_FULL_EA_INFORMATION is used for get or store Extended Attributes for NTFS files and directories. Extended Attributes (EA) is a list of pair Name-Value. Name is capitalised ASCII string up to 256 characters long. Value is any data and can be up to 65536 bytes long.
Structure can be used in a call to NtCreateFile and NtSetEaFile, or as a result of call NtQueryEaFile.
  • NextEntryOffset
    • Offset for next FILE_FULL_EA_INFORMATION structure in buffer, relative to currently used structure. If current structure is last one in buffer, this field has value 0.
  • Flags
    • - ???
  • EaNameLength
    • Length of EA name, in bytes (without leading zero).
  • EaValueLength
    • Length of EA value, in bytes (without leading zero).
  • EaName[1]
    • User's allocated buffer contains ASCIIZ name and value. ASCII value must be finished by zero.

    Structure FILE_FULL_EA_INFORMATION is also defined in Win2000 DDK.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_EA_INFORMATION
    FILE_GET_EA_INFORMATION
    NtCreateFile
    NtQueryEaFile
    NtSetEaFile


FILE_GET_EA_INFORMATION

2OO1, 25 January

FILE_GET_EA_INFORMATION
FILE_GET_EA_INFORMATION

typedef struct _FILE_GET_EA_INFORMATION {

  ULONG                   NextEntryOffset;
  BYTE                    EaNameLength;
  CHAR                    EaName[1];

} FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;

Structure FILE_GET_EA_INFORMATION is used in a call to NtQueryEaFile function. See FILE_FULL_EA_INFORMATION for detailed information about EA.
  • NextEntryOffset
    • Relative offset for next FILE_GET_EA_INFORMATION structure in buffer.
  • EaNameLength
    • Length of EA name, in bytes (without leading zero).
  • EaName[1]
    • ASCIIZ name of EA, case insensitive.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_FULL_EA_INFORMATION
    NtQueryEaFile


FILE_INTERNAL_INFORMATION

2OO1, 19 January

FILE_INTERNAL_INFORMATION
FILE_INTERNAL_INFORMATION

typedef struct _FILE_INTERNAL_INFORMATION {

  LARGE_INTEGER           IndexNumber;

} FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;

FILE_INTERNAL_INFORMATION structure is a result of call NtQueryInformationFile with FileInternalInformation information class. It's not possible to set file unique identifier.

  • IndexNumber
    • File indentifier, unique for file's device.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_ALL_INFORMATION
    FILE_INFORMATION_CLASS
    NtCreateFile
    NtOpenFile
    NtQueryInformationFile


FILE_LINK_INFORMATION

2OO1, 5 April

FILE_LINK_INFORMATION
FILE_LINK_INFORMATION

typedef struct _FILE_LINK_INFORMATION {

  BOOLEAN                 ReplaceIfExists;
  HANDLE                  RootDirectory;
  ULONG                   FileNameLength;
  WCHAR                   FileName[1];

} FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;

Structure FILE_LINK_INFORMATION is used as input buffer for function NtSetInformationFile called with FileLinkInformation information class for make hard link to file.
On standart NT system only links to files are accepted. Caller cannot create link to directory (for Poxis compatibility reason).

  • ReplaceIfExists
    • If set, and destination object already exists, it will be replaced with newly created link.
  • RootDirectory
    • HANDLE to File Object specyfing directory where link should be placed. Can be NULL if FileName parameter contains full path.
  • FileNameLength
    • Length of FileName array, in bytes.
  • FileName[1]
    • UNICODE string specyfing name of link and optionally with path (see description of RootDirectory).

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_INFORMATION_CLASS
    FILE_RENAME_INFORMATION
    NtSetInformationFile


FILE_NAME_INFORMATION

2OO1, 13 March

FILE_NAME_INFORMATION
FILE_NAME_INFORMATION

typedef struct _FILE_NAME_INFORMATION {

  ULONG                   FileNameLength;
  WCHAR                   FileName[1];

} FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;

Structure FILE_NAME_INFORMATION contains name of queried file object. It's used as a result of call NtQueryInformationFile with FileNameInformation or FileAlternateNameInformation information class.

  • FileNameLength
    • Length of FileName, in bytes.
  • FileName[1]
    • UNICODE name of file. If caller query about FileNameInformation, FileName additionally contains path to file, and begins with '\' (full path to file relative to device).

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_ALL_INFORMATION
    FILE_INFORMATION_CLASS
    NtQueryInformationFile


FILE_NAMES_INFORMATION

2OO1, 13 April

FILE_NAMES_INFORMATION
FILE_NAMES_INFORMATION

typedef struct _FILE_NAMES_INFORMATION {

  ULONG                   NextEntryOffset;
  ULONG                   FileIndex;
  ULONG                   FileNameLength;
  WCHAR                   FileName[1];

} FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;

Structure FILE_NAMES_INFORMATION is used as a result of call NtQueryDirectoryFile with FileNamesInformation information class. It's shorter then other directory informational structures, so can be used for better performance, when only file names are required.

  • NextEntryOffset
    • Offset (in bytes) of next FILE_NAMES_INFORMATION entry, or zero if last.
  • FileIndex
    • Index of file, or zero if Directory Indexing is disabled.
  • FileNameLength
    • Length of FileName array, in bytes.
  • FileName[1]
    • Name of file, in UNICODE format.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_BOTH_DIR_INFORMATION
    FILE_DIRECTORY_INFORMATION
    FILE_FULL_DIR_INFORMATION
    FILE_INFORMATION_CLASS
    NtQueryDirectoryFile


FILE_NETWORK_OPEN_INFORMATION

2OO1, 11 February

FILE_NETWORK_OPEN_INFORMATION
FILE_NETWORK_OPEN_INFORMATION

typedef struct _FILE_NETWORK_OPEN_INFORMATION {

  LARGE_INTEGER           CreationTime;
  LARGE_INTEGER           LastAccessTime;
  LARGE_INTEGER           LastWriteTime;
  LARGE_INTEGER           ChangeTime;
  LARGE_INTEGER           AllocationSize;
  LARGE_INTEGER           EndOfFile;
  ULONG                   FileAttributes;
  ULONG                   Unknown;

} FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;

FILE_NETWORK_OPEN_INFORMATION structure is used with two file functions:

1) NtQueryFullAttributesFile,
2) NtQueryInformationFile with FileNetworkOpenInformation information class.

  • CreationTime
    • Indicates time of file creation.
  • LastAccessTime
    • Time of last open file.
  • LastWriteTime
    • Time of last write operation.
  • ChangeTime
    • Time of any last change.
  • AllocationSize
    • Number of bytes that file use on storage, equal or greater to EndOfFile.
  • EndOfFile
    • Length of file, in bytes.
  • FileAttributes
    • File attributes.
  • Unknown
    • - ???

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_BASIC_INFORMATION
    FILE_INFORMATION_CLASS
    FILE_STANDARD_INFORMATION
    NtCreateFile
    NtOpenFile
    NtQueryAttributesFile
    NtQueryFullAttributesFile
    NtQueryInformationFile
    NtWriteFile


FILE_NOTIFY_INFORMATION

2OO1, 1O February

FILE_NOTIFY_INFORMATION
FILE_NOTIFY_INFORMATION

typedef struct _FILE_NOTIFY_INFORMATION {

  ULONG                   NextEntryOffset;
  ULONG                   Action;
  ULONG                   FileNameLength;
  WCHAR                   FileName[1];

} FILE_NOTIFY_INFORMATION, *PFILE_NOTIFY_INFORMATION;

FILE_NOTIFY_INFORMATION structure is used in processing results of call NtNotifyChangeDirectoryFile. It is defined in <WinNT.h> include file.
  • NextEntryOffset
    • Offset to next FILE_NOTIFY_INFORMATION structure or zero, if last.
  • Action
    • Action indicates notification purpose. Can be one of:
    • FILE_ACTION_ADDED
    • FILE_ACTION_REMOVED
    • FILE_ACTION_MODIFIED
    • FILE_ACTION_RENAMED_OLD_NAME
    • FILE_ACTION_RENAMED_NEW_NAME
    • FILE_ACTION_ADDED_STREAM
    • FILE_ACTION_REMOVED_STREAM
    • FILE_ACTION_MODIFIED_STREAM
  • FileNameLength
    • Length of FileName array, in bytes.
  • FileName[1]
    • Unicode file name.

    Only some of notification reasons can be readed from Action member. In most cases is contains FILE_ACTION_MODIFIED value, and user must check sort of notitication manually.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtNotifyChangeDirectoryFile


FILE_RENAME_INFORMATION

2OO1, 17 March

FILE_RENAME_INFORMATION
FILE_RENAME_INFORMATION

typedef struct _FILE_RENAME_INFORMATION {

  BOOLEAN                 ReplaceIfExists;
  HANDLE                  RootDirectory;
  ULONG                   FileNameLength;
  WCHAR                   FileName[1];

} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;

Structure FILE_RENAME_INFORMATION is used as input buffer for function NtSetInformationFile, called with FileRenameInformation information class. Using this structure caller can rename file, or move it into other directory.

  • ReplaceIfExists
    • If set, and file with the same name as destination exist, it will be replaced. If no, STATUS_OBJECT_NAME_COLLISION is returned.
  • RootDirectory
    • Optional HANDLE to parent directory for destination file.
  • FileNameLength
    • Length of FileName array, in bytes.
  • FileName[1]
    • UNICODE string specifing destination file name. If RootDirectory is NULL, it must contains full system path, or only destination file name for in-place rename operation.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_INFORMATION_CLASS
    NtCreateFile
    NtNotifyChangeDirectoryFile
    NtOpenFile
    NtSetInformationFile


NtCreateIoCompletion

2OO1, 18 February

NtCreateIoCompletion
NtCreateIoCompletion

NTSYSAPI
NTSTATUS
NTAPI

NtCreateIoCompletion(

  OUT PHANDLE             IoCompletionHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
  IN ULONG                NumberOfConcurrentThreads );

Function NtCreateIoCompletion creates IO Completion Object. IO Completion Object is used for waiting on pending IO operation (reading or writing) in multi-process file access. It contains more informations about IO operation than synchronization event or APC Routine.

  • IoCompletionHandle
    • Result of call - HANDLE to newly created IO Completion Object.
  • DesiredAccess
    • Access mask for created HANDLE. Can be combination of:
    • IO_COMPLETION_QUERY_STATE
    • IO_COMPLETION_MODIFY_STATE
    • IO_COMPLETION_ALL_ACCESS
  • ObjectAttributes
    • Optionally contains object name, in Objects Namespace.
  • NumberOfConcurrentThreads
    • Number of threads accessing File Object associated with IO Completion. If Zero, system reserves memory for number of threads equal to current nymber of processes.

    Documented by:
    Tomasz Nowak
    Reactos

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_INFORMATION_CLASS
    NtOpenIoCompletion
    NtQueryIoCompletion
    NtRemoveIoCompletion
    NtSetInformationFile
    NtSetIoCompletion


NtOpenIoCompletion

2OO1, 18 February

NtOpenIoCompletion
NtOpenIoCompletion

NTSYSAPI
NTSTATUS
NTAPI

NtOpenIoCompletion(

  OUT PHANDLE             IoCompletionHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes );

Function NtOpenIoCompletion opens existing IO Completion Object. IO Completion must be created as named object.

  • IoCompletionHandle
    • Result of call - pointer to HANDLE value.
  • DesiredAccess
    • Can be one or combination of:
    • IO_COMPLETION_QUERY_STATE
    • IO_COMPLETION_MODIFY_STATE
    • IO_COMPLETION_ALL_ACCESS
  • ObjectAttributes
    • Pointer to OBJECT_ATTRIBUTES structure containing valid IO Completion name.

    Documented by:
    Tomasz Nowak
    Reactos

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateIoCompletion


NtQueryIoCompletion

2OO1, 18 February

NtQueryIoCompletion
NtQueryIoCompletion

NTSYSAPI
NTSTATUS
NTAPI

NtQueryIoCompletion(

  IN HANDLE               IoCompletionHandle,
  IN IO_COMPLETION_INFORMATION_CLASS InformationClass,
  OUT PVOID               IoCompletionInformation,
  IN ULONG                InformationBufferLength,
  OUT PULONG              RequiredLength OPTIONAL );

Function NtQueryIoCompletion receives number of file operations pending on specified IO Completion Object.

  • IoCompletionHandle
    • HANDLE to IO Completion Object opened with IO_COMPLETION_QUERY_STATE access.
  • InformationClass
    • See IO_COMPLETION_INFORMATION_CLASS for possible values.
  • IoCompletionInformation
    • User's allocated buffer for result data.
  • InformationBufferLength
    • Length of IoCompletionInformation buffer, in bytes.
  • RequiredLength
    • Optionally receives required length of buffer.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    IO_COMPLETION_INFORMATION_CLASS
    NtCreateIoCompletion
    NtOpenIoCompletion
    NtRemoveIoCompletion
    NtSetIoCompletion


NtRemoveIoCompletion

2OO7, 29 April

NtRemoveIoCompletion
NtRemoveIoCompletion

NTSYSAPI
NTSTATUS
NTAPI

NtRemoveIoCompletion(

  IN HANDLE               IoCompletionHandle,
  OUT PULONG              CompletionKey,
  OUT PULONG              CompletionValue,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PLARGE_INTEGER       Timeout OPTIONAL );

Function NtRemoveIoCompletion is one of waiting calls and it's finished when at least one completion record will be avaiable in specified Io Completion object. Records are added when I/O operation is finished, but previously File object have to been associated with Io Completion object.
Association between File and Io Completion objects is maded by call to NtSetInformationFile with FileCompletionInformation information class. Additionally every assotiation have to have unique Key defined. This functionality allows to use one Io Completion object with different File objects.
Every one File object can have only one Io Completion associated with it.
I/O operations won't be appended to Io Completion object except file operations will be called with non-zero value in ApcContext parameters.

  • IoCompletionHandle
    • HANDLE to previously created or opened Io Completion object.
  • CompletionKey
    • Receives completion Key informing about File object who finishes I/O.
  • CompletionValue
    • Value of ApcContext file operation parameter. CompletionValue informs about operation finished.
  • IoStatusBlock
    • Io status of finished operation.
  • Timeout
    • Optionally pointer to time out value.

    Supported on system versions:
    NT 4.0,Win 2000,Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    FILE_COMPLETION_INFORMATION
    FILE_INFORMATION_CLASS
    NtCreateIoCompletion
    NtOpenIoCompletion
    NtReadFile
    NtSetInformationFile
    NtSetIoCompletion
    NtWriteFile


NtSetIoCompletion

2OO1, 18 February

NtSetIoCompletion
NtSetIoCompletion

NTSYSAPI
NTSTATUS
NTAPI

NtSetIoCompletion(

  IN HANDLE               IoCompletionHandle,
  IN ULONG                CompletionKey,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN NTSTATUS             CompletionStatus,
  IN ULONG                NumberOfBytesTransfered );

Function NtSetIoCompletion increments pending IO counter in IO Completion Object. It can be used to manual finish IO operation.

  • IoCompletionHandle
    • HANDLE to IO Completion Object opened with IO_COMPLETION_MODIFY_STATE access.
  • CompletionKey
    • User's defined key received by NtRemoveIoCompletion function.
  • IoStatusBlock
    • IO result of call.
  • CompletionStatus
    • IO operation status.
  • NumberOfBytesTransfered
    • Number of bytes transfered in manually finished IO operation.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateIoCompletion
    NtOpenIoCompletion
    NtQueryIoCompletion
    NtRemoveIoCompletion


IO_COMPLETION_INFORMATION_CLASS

2OO1, 18 February

IO_COMPLETION_INFORMATION_CLASS
IO_COMPLETION_INFORMATION_CLASS

typedef enum _IO_COMPLETION_INFORMATION_CLASS {

    IoCompletionBasicInformation

} IO_COMPLETION_INFORMATION_CLASS, *PIO_COMPLETION_INFORMATION_CLASS;

Enumeration type IO_COMPLETION_INFORMATION_CLASS is used with NtQueryIoCompletion function to get information about IO Completion object. Currently only one information class is defined.

  • IoCompletionBasicInformation
    • Buffer receiving data is descripted as     IO_COMPLETION_BASIC_INFORMATION structure and has 0x04 bytes length.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    IO_COMPLETION_BASIC_INFORMATION
    NtQueryIoCompletion


IO_COMPLETION_BASIC_INFORMATION

2OO1, 18 February

IO_COMPLETION_BASIC_INFORMATION
IO_COMPLETION_BASIC_INFORMATION

typedef struct _IO_COMPLETION_BASIC_INFORMATION {

  ULONG                   Depth;

} IO_COMPLETION_BASIC_INFORMATION, *PIO_COMPLETION_BASIC_INFORMATION;

Structure IO_COMPLETION_BASIC_INFORMATION is used as result of call NtQueryIoCompletion with IoCompletionBasicInformation information class.

  • Depth
    • Number of currently pending file operations for specified IO Completion Object.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    IO_COMPLETION_INFORMATION_CLASS
    NtQueryIoCompletion


NtCompactKeys

2OO5, 21 February

NtCompactKeys
NtCompactKeys

NTSYSAPI
NTSTATUS
NTAPI

NtCompactKeys(

  IN ULONG                NrOfKeys,
  IN HANDLE               KeysArray[] );

Function NtCompactKeys compacts (reduces size) of specified key(s). On Windows NT the same functionality was given by use NtSaveKey and NtRestoreKey
  • NrOfKeys
    • Number of enries in KeysArray array.
  • KeysArray[]
    • Array containing handles for previously opened keys.

    Supported on system versions:
    Win 2000,Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateKey
    NtOpenKey
    NtRestoreKey
    NtSaveKey


NtCompressKey

2OO7, 22 April

NtCompressKey
NtCompressKey

NTSYSAPI
NTSTATUS
NTAPI

NtCompressKey(

  IN HANDLE               Key );

This function compress data associated with specified Key and all his sub-keys. Compressed key require smaller space in registry file, but whole functionality used with compressed key works slower.
  • Key
    • HANDLE of previously opened key object (with write access).

    Supported on system versions:
    Win 2000,Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCompactKeys
    NtCreateKey
    NtOpenKey


NtCreateKey

2OOO, 19 October

NtCreateKey
NtCreateKey

NTSYSAPI
NTSTATUS
NTAPI

NtCreateKey(

  OUT PHANDLE             pKeyHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes,
  IN ULONG                TitleIndex,
  IN PUNICODE_STRING      Class OPTIONAL,
  IN ULONG                CreateOptions,
  OUT PULONG              Disposition OPTIONAL );

See ZwCreateKey in NT DDK or 2000 DDK for detailed description.

Requirements:
Library: ntdll.lib

See also:
NtOpenKey
NtDeleteKey


NtDeleteKey

2OOO, 19 October

NtDeleteKey
NtDeleteKey

NTSYSAPI
NTSTATUS
NTAPI

NtDeleteKey(

  IN HANDLE               KeyHandle );

See ZwDeleteKey in NT DDK or 2000 DDK for detailed description.

Requirements:
Library: ntdll.lib

See also:
NtCreateKey
NtOpenKey


NtDeleteValueKey

2OOO, 1 November

NtDeleteValueKey
NtDeleteValueKey

NTSYSAPI
NTSTATUS
NTAPI

NtDeleteValueKey(

  IN HANDLE               KeyHandle,
  IN PUNICODE_STRING      ValueName );

Requirements:
Library: ntdll.lib

See also:
NtDeleteKey
NtEnumerateValueKey
NtQueryValueKey
NtSetValueKey


NtEnumerateKey

2OOO, 19 October

NtEnumerateKey
NtEnumerateKey

NTSYSAPI
NTSTATUS
NTAPI

NtEnumerateKey(

  IN HANDLE               KeyHandle,
  IN ULONG                Index,
  IN KEY_INFORMATION_CLASS KeyInformationClass,
  OUT PVOID               KeyInformation,
  IN ULONG                Length,
  OUT PULONG              ResultLength );

See ZwEnumerateKey in NT DDK or 2000 DDK for detailed description.

Requirements:
Library: ntdll.lib

See also:
NtCreateKey
NtOpenKey


NtEnumerateValueKey

2OOO, 19 October

NtEnumerateValueKey
NtEnumerateValueKey

NTSYSAPI
NTSTATUS
NTAPI

NtEnumerateValueKey(

  IN HANDLE               KeyHandle,
  IN ULONG                Index,
  IN KEY_VALUE_INFORMATION_CLASS KeyValueInformation,
  OUT PVOID               KeyValueInformation,
  IN ULONG                Length,
  OUT PULONG              ResultLength );

See ZwEnumerateValueKey in NT DDK or 2000 DDK for detailed description.

Requirements:
Library: ntdll.lib

See also:
NtCreateKey
NtEnumerateKey
NtOpenKey


NtFlushKey

2OOO, 19 October

NtFlushKey
NtFlushKey

NTSYSAPI
NTSTATUS
NTAPI

NtFlushKey(

  IN HANDLE               KeyHandle );

See ZwFlushKey in NT DDK or 2000 DDK for detailed description.

Requirements:
Library: ntdll.lib

See also:
NtCreateKey
NtDeleteKey
NtOpenKey


NtLoadKey

2OO1, 3O January

NtLoadKey
NtLoadKey

NTSYSAPI
NTSTATUS
NTAPI

NtLoadKey(

  IN POBJECT_ATTRIBUTES   DestinationKeyName,
  IN POBJECT_ATTRIBUTES   HiveFileName );

Function NtLoadKey is used to make avaiable registry keys and values stored in Hive File. Hive file can be created by calling NtSaveKey. If loaded Hive is no longer needed (for example when user logout for HKCU Hive), it can be udloaded by call NtUnloadKey.

  • DestinationKeyName
    • Pointer to OBJECT_ATTRIBUTES structure contains destination key name and HANDLE to root key. Root can be \REGISTRY\machine or \REGISTRY\user. All other keys are invalid.
  • HiveFileName
    • Pointer to OBJECT_ATTRIBUTES structure contains Hive file path and name.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib
    Privilege: SE_RESTORE_PRIVILEGE

    See also:
    NtLoadKey2
    NtSaveKey
    NtUnloadKey


NtLoadKey2

2OO1, 3 March

NtLoadKey2
NtLoadKey2

NTSYSAPI
NTSTATUS
NTAPI

NtLoadKey2(

  IN POBJECT_ATTRIBUTES   DestinationKeyName,
  IN POBJECT_ATTRIBUTES   HiveFileName,
  IN ULONG                Flags );

Function NtLoadKey2 loads Hive file into registry structure.

  • DestinationKeyName
    • Pointer to OBJECT_ATTRIBUTES structure contains name of loaded key and virtual parent key ("machine" or "user").
  • HiveFileName
    • Pointer to OBJECT_ATTRIBUTES structure specifing Hive file.
  • Flags
    • (?) Only values 0x0000 and 0x0004 are valid. If caller set Flags to 0x0000, function works as NtLoadKey.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib
    Privilege: SE_RESTORE_PRIVILEGE

    See also:
    NtLoadKey
    NtSaveKey
    NtUnloadKey


NtNotifyChangeKey

2OOO, 19 October

NtNotifyChangeKey
NtNotifyChangeKey

NTSYSAPI
NTSTATUS
NTAPI

NtNotifyChangeKey(

  IN HANDLE               KeyHandle,
  IN HANDLE               EventHandle,
  IN PIO_APC_ROUTINE      ApcRoutine,
  IN PVOID                ApcRoutineContext,
  IN PIO_STATUS_BLOCK     IoStatusBlock,
  IN ULONG                NotifyFilter,
  IN BOOLEAN              WatchSubtree,
  OUT PVOID               RegChangesDataBuffer,
  IN ULONG                RegChangesDataBufferLength,
  IN BOOLEAN              Asynchronous );

Requirements:
Library: ntdll.lib

See also:
NtOpenKey


NtOpenKey

2OOO, 19 October

NtOpenKey
NtOpenKey

NTSYSAPI
NTSTATUS
NTAPI

NtOpenKey(

  OUT PHANDLE             pKeyHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes );

See ZwOpenKey in NT DDK or 2000 DDK for detailed description.

Requirements:
Library: ntdll.lib

See also:
NtCreateKey


NtQueryKey

2OOO, 19 October

NtQueryKey
NtQueryKey

NTSYSAPI
NTSTATUS
NTAPI

NtQueryKey(

  IN HANDLE               KeyHandle,
  IN KEY_INFORMATION_CLASS KeyInformationClass,
  OUT PVOID               KeyInformation,
  IN ULONG                Length,
  OUT PULONG              ResultLength );

See ZwQueryKey in NT DDK or 2000 DDK for detailed description.

Requirements:
Library: ntdll.lib

See also:
NtCreateKey
NtEnumerateKey
NtOpenKey


NtQueryMultipleValueKey

2OO1, 2O February

NtQueryMultipleValueKey
NtQueryMultipleValueKey

NTSYSAPI
NTSTATUS
NTAPI

NtQueryMultipleValueKey(

  IN HANDLE               KeyHandle,
  IN OUT PKEY_MULTIPLE_VALUE_INFORMATION ValuesList,
  IN ULONG                NumberOfValues,
  OUT PVOID               DataBuffer,
  IN OUT ULONG            BufferLength,
  OUT PULONG              RequiredLength OPTIONAL );

Function NtQueryMultipleValueKey returns data of one or more values under specified Key Object.

  • KeyHandle
    • HANDLE to Key Object opened with KEY_READ access.
  • ValuesList
    • Array of KEY_MULTIPLE_VALUE_INFORMATION structures contains names of values to query.
  • NumberOfValues
    • Number of members in ValueList array.
  • DataBuffer
    • User's allocated buffer receiving queried value's data.
  • BufferLength
    • Pointer to value specifing length of DataBuffer, in bytes.
  • RequiredLength
    • Optionally pointer to value receiving required DataBuffer length, in bytes.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    KEY_MULTIPLE_VALUE_INFORMATION
    NtCreateKey
    NtEnumerateValueKey
    NtOpenKey
    NtQueryValueKey


NtQueryValueKey

2OOO, 19 October

NtQueryValueKey
NtQueryValueKey

NTSYSAPI
NTSTATUS
NTAPI

NtQueryValueKey(

  IN HANDLE               KeyHandle,
  IN PUNICODE_STRING      ValueName,
  IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
  OUT PVOID               KeyValueInformation,
  IN ULONG                Length,
  OUT PULONG              ResultLength );

See ZwQueryValueKey in NT DDK or 2000 DDK for detailed description.

Requirements:
Library: ntdll.lib

See also:
NtEnumerateValueKey
NtQueryKey
NtSetValueKey


NtReplaceKey

2OO1, 21 February

NtReplaceKey
NtReplaceKey

NTSYSAPI
NTSTATUS
NTAPI

NtReplaceKey(

  IN POBJECT_ATTRIBUTES   NewHiveFileName,
  IN HANDLE               KeyHandle,
  IN POBJECT_ATTRIBUTES   BackupHiveFileName );

Function NtReplaceKey save specified hive key to file, and starts use this file instread of original hive file. Original hive file contents is replaced with contents of third hive file, specified below.

  • NewHiveFileName
    • Pointer to OBJECT_ATTRIBUTES structure containing name of third file (file with new contents).
  • KeyHandle
    • HANDLE to Key Object. Backuped and replaced are all keys from hive whith contains key specified by KeyHandle parameter.
  • BackupHiveFileName
    • Pointer to OBJECT_ATTRIBUTES structure containing name of first file (new hive file).

    Example:

    NewHiveFile -> OrginalHiveFile -> BackupHiveFile

    Before call to NtReplaceKey system uses OriginalHiveFile.
    After call, system use BackupHiveFile.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtLoadKey
    NtLoadKey2
    NtRestoreKey
    NtSaveKey
    NtUnloadKey


NtRestoreKey

2OOO, 19 October

NtRestoreKey
NtRestoreKey

NTSYSAPI
NTSTATUS
NTAPI

NtRestoreKey(

  IN HANDLE               KeyHandle,
  IN HANDLE               FileHandle,
  IN ULONG                RestoreOption );

KeyHandle

All keys and values stored in file represented by FileHandle will be childern of KeyHandle.

FileHandle

See NtSaveKey for more information about FileHandle.

RestoreOption

See RegRestoreKey in SDK

Requirements:
Library: ntdll.lib
Privileges: SE_RESTORE_NAME

See also:
NtCreateKey
NtOpenKey
NtSaveKey


NtSaveKey

2OOO, 19 October

NtSaveKey
NtSaveKey

NTSYSAPI
NTSTATUS
NTAPI

NtSaveKey(

  IN HANDLE               KeyHandle,
  IN HANDLE               FileHandle );

KeyHandle

FileHandle

HANDLE to any file created with write access.

Before use FileHandle in other registry function without closing it, call NtFlushKey with KeyHandle
as param.

Requirements:
Library: ntdll.lib
Privileges: SE_BACKUP_NAME

See also:
NtOpenKey
NtRestoreKey


NtSetInformationKey

2OOO, 19 October

NtSetInformationKey
NtSetInformationKey

NTSYSAPI
NTSTATUS
NTAPI

NtSetInformationKey(

  IN HANDLE               KeyHandle,
  IN KEY_SET_INFORMATION_CLASS InformationClass,
  IN PVOID                KeyInformationData,
  IN ULONG                DataLength );

InformationClass

See <ntddk.h> for possible values. Currently only KEY_WRITE_TIME_INFORMATION is supported.

KeyInformationData

See <ntddk.h> for detailed structure KEY_WRITE_TIME_INFORMATION.

Requirements:
Library: ntdll.lib

See also:
NtCreateKey
NtEnumerateKey
NtOpenKey
NtQueryKey


NtSetValueKey

2OOO, 19 October

NtSetValueKey
NtSetValueKey

NTSYSAPI
NTSTATUS
NTAPI

NtSetValueKey(

  IN HANDLE               KeyHandle,
  IN PUNICODE_STRING      ValueName,
  IN ULONG                TitleIndex OPTIONAL,
  IN ULONG                Type,
  IN PVOID                Data,
  IN ULONG                DataSize );

See ZwSetValueKey in NT DDK or 2000 DDK for detailed description.

Requirements:
Library: ntdll.lib

See also:
NtEnumerateValueKey
NtOpenKey
NtQueryValueKey


NtUnloadKey

2OO1, 3O January

NtUnloadKey
NtUnloadKey

NTSYSAPI
NTSTATUS
NTAPI

NtUnloadKey(

  IN POBJECT_ATTRIBUTES   DestinationKeyName );

Function NtUnloadKey unloads previously loaded Hive file from registry structure. All changes made to keys and values under this Hive are stored.

  • DestinationKeyName
    • Pointer to OBJECT_ATTRIBUTES structure contains path and name of Hive root key.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib
    Privileges: SE_RESTORE_PRIVILEGE

    See also:
    NtLoadKey
    NtLoadKey2


RtlFormatCurrentUserKeyPath

2OOO, 19 October

RtlFormatCurrentUserKeyPath
RtlFormatCurrentUserKeyPath

NTSYSAPI
NTSTATUS
NTAPI

RtlFormatCurrentUserKeyPath(

  OUT PUNICODE_STRING  RegistryPath );

Requirements:
Library: ntdll.lib

See also:
NtCreateKey
NtOpenKey


KEY_MULTIPLE_VALUE_INFORMATION

2OO1, 2O February

KEY_MULTIPLE_VALUE_INFORMATION
KEY_MULTIPLE_VALUE_INFORMATION

typedef struct _KEY_MULTIPLE_VALUE_INFORMATION {

  PUNICODE_STRING         ValueName;
  ULONG                   DataLength;
  ULONG                   DataOffset;
  ULONG                   Type;

} KEY_MULTIPLE_VALUE_INFORMATION, *PKEY_MULTIPLE_VALUE_INFORMATION;

Structure KEY_MULTIPLE_VALUE_INFORMATION is used with function NtQueryMultipleValueKey.

  • ValueName
    • Pointer to UNICODE_STRING structure containing value name. If specified value not exist, function fails.
  • DataLength
    • Length of value's data, in bytes.
  • DataOffset
    • Offset in output buffer (declared in NtQueryMultipleValueKey) to value's data.
  • Type
    • Type of queried value.

    On entry caller must specify ValueName parameter, and set other to zero. Function NtQueryMultipleValueKey fills rest of fields with informations about specified value.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtQueryMultipleValueKey


NtCreateKeyedEvent

2OO7, 27 April

NtCreateKeyedEvent
NtCreateKeyedEvent

NTSYSAPI
NTSTATUS
NTAPI

NtCreateKeyedEvent(

  OUT PHANDLE             KeyedEventHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
  IN ULONG                Reserved );

Synchronization object called KeyedEvent is avaiable in Windows XP+ systems. It's usefull when both (or more) threads have to wait for each other.
  • KeyedEventHandle
    • HANDLE to newly created KeyedEvent object.
  • DesiredAccess
    • The same values as for Event objects (typically EVENT_ALL_ACCESS).
  • ObjectAttributes
    • Optionally name of object.
  • Reserved
    • Have to be zero. Reserved for future use.

    Supported on system versions:
    Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtOpenKeyedEvent
    NtReleaseKeyedEvent
    NtWaitForkeyedEvent


NtOpenKeyedEvent

2OO7, 27 April

NtOpenKeyedEvent
NtOpenKeyedEvent

NTSYSAPI
NTSTATUS
NTAPI

NtOpenKeyedEvent(

  OUT PHANDLE             KeyedEventHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL );

Function NtOpenKeyedEvent is used for open previously created KeyedEvent with associated name.
  • KeyedEventHandle
    • Result of call - HANDLE to opened KeyedEvent object.
  • DesiredAccess
    • Access to object, the same values as for Event object.
  • ObjectAttributes
    • Name of KeyedEvent to open.

    Supported on system versions:
    Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateKeyedEvent


NtReleaseKeyedEvent

2OO7, 27 April

NtReleaseKeyedEvent
NtReleaseKeyedEvent

NTSYSAPI
NTSTATUS
NTAPI

NtReleaseKeyedEvent(

  IN HANDLE               KeyedEventHandle,
  IN PVOID                Key,
  IN BOOLEAN              Alertable,
  IN PLARGE_INTEGER       Timeout OPTIONAL );

This function is used for signal KeyedEvent object with value specified as Key parameter. If there are no other thread (or threads) waiting for the same KeyedEvent with the same Key value, waiting is performed up to NtWaitForKeyedEvent called by any other thread.
  • KeyedEventHandle
    • HANDLE to KeyedEvent object.
  • Key
    • Value used as KEY. Note that this value has to have lowest bit cleared (must divide by two).
  • Alertable
    • If set, waiting can be broken by alerting thread.
  • Timeout
    • Optional pointer for timeout value.

    Supported on system versions:
    Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateKeyedEvent
    NtOpenKeyedEvent
    NtWaitForKeyedEvent


NtWaitForKeyedEvent

2OO7, 27 April

NtWaitForKeyedEvent
NtWaitForKeyedEvent

NTSYSAPI
NTSTATUS
NTAPI

NtWaitForKeyedEvent(

  IN HANDLE               KeyedEventHandle,
  IN PVOID                Key,
  IN BOOLEAN              Alertable,
  IN PLARGE_INTEGER       Timeout OPTIONAL );

Function with similar functionality as NtReleaseKeyedEvent. In my opinion it is not needed and exists only for future vision of KeyedEvent objects or just as a mistake.
  • KeyedEventHandle
    • HANDLE for previously opened KeyedEvent object.
  • Key
    • Value to wait for, must have lowest bit clear.
  • Alertable
    • If set, waiting can be broken by alerting thread.
  • Timeout
    • Optinally pointer for timing out value.

    Supported on system versions:
    Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateKeyedEvent
    NtOpenKeyedEvent
    NtReleaseKeyedEvent


NtCreateMutant

2OOO, 24 November

NtCreateMutant
NtCreateMutant

NTSYSAPI
NTSTATUS
NTAPI

NtCreateMutant(

  OUT PHANDLE             MutantHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
  IN BOOLEAN              InitialOwner );

MutantHandle
Result of function call - handle to newly created Mutant object.

DesiredAccess
In most cases there's MUTANT_ALL_ACCESS. See <WinNT.h> or <WinBase.h> for other information about Mutant objects access rights.

ObjectAttributes
May be used to creation named Mutant objects. Named Mutant can be used by more then one process.

InitialOwner
If TRUE, Mutant is created with non-signaled state. Caller should call NtReleaseMutant after program initialization.

Mutant object live in object namespace as long as at least one handle is still open. To destroy Mutant, just call NtClose with MutantHandle.

Documented by:
Tomasz Nowak
Sven B. Schreiber

Requirements:
Library: ntdll.lib

See also:
NtClose
NtOpenMutant


NtOpenMutant

2OOO, 24 November

NtOpenMutant
NtOpenMutant

NTSYSAPI
NTSTATUS
NTAPI

NtOpenMutant(

  OUT PHANDLE             MutantHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes );

DesiredAccess
See <WinNT.h> or <WinBase.h> for possible Mutant access rights.

ObjectAttributes
Name of Mutant object to open.

Documented by:
Tomasz Nowak
Sven B. Schreiber

Requirements:
Library: ntdll.lib

See also:
NtCreateMutant


NtQueryMutant

2OOO, 24 November

NtQueryMutant
NtQueryMutant

NTSYSAPI
NTSTATUS
NTAPI

NtQueryMutant(

  IN HANDLE               MutantHandle,
  IN MUTANT_INFORMATION_CLASS MutantInformationClass,
  OUT PVOID               MutantInformation,
  IN ULONG                MutantInformationLength,
  OUT PULONG              ResultLength OPTIONAL );

MutantHandle
Handle to Mutant object.

MutantInformationClass
Is defined as enum:

    typedef enum _MUTANT_INFORMATION_CLASS
    {
        MutantBasicInformation

    } MUTANT_INFORMATION_CLASS, *PMUTANT_INFORMATION_CLASS;

MutantInformation
Buffer for result. As long as only one information type is defined, set MutantInformation as a pointer to MUTANT_BASIC_INFORMATION structure.

MutantInformationLength
Size of buffer.

ResultLength
Number of bytes written to buffer.

Documented by:
Tomasz Nowak
Sven B. Schreiber

Requirements:
Library: ntdll.lib

See also:
MUTANT_BASIC_INFORMATION
NtCreateMutant
NtOpenMutant


NtReleaseMutant

2OOO, 24 November

NtReleaseMutant
NtReleaseMutant

NTSYSAPI
NTSTATUS
NTAPI

NtReleaseMutant(

  IN HANDLE               MutantHandle,
  OUT PLONG               PreviousCount OPTIONAL );

PreviousCount
Internal mutant counter state before call NtReleaseMutant.

Documented by:
Sven B. Schreiber
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtCreateMutant
NtOpenMutant
NtQueryMutant


MUTANT_BASIC_INFORMATION

2OOO, 24 November

MUTANT_BASIC_INFORMATION
MUTANT_BASIC_INFORMATION

typedef struct _MUTANT_BASIC_INFORMATION {

  LONG                    CurrentCount;
  BOOLEAN                 OwnedByCaller;
  BOOLEAN                 AbandonedState;

} MUTANT_BASIC_INFORMATION, *PMUTANT_BASIC_INFORMATION;

Use MUTANT_BASIC_INFORMATION as a buffer in NtQueryMutant call.

CurrentCount
If CurrentCount is less than zero, mutant is signaled.

OwnedByCaller
It's TRUE if mutant is signaled by caller's thread.

AbandonedState
Is set when thread terminates without call NtReleaseMutant.

Documented by:
Sven B. Schreiber
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtCreateMutant
NtOpenMutant
NtQueryMutant
NtReleaseMutant


NtAcceptConnectPort

2OO1, 27 January

NtAcceptConnectPort
NtAcceptConnectPort

NTSYSAPI
NTSTATUS
NTAPI

NtAcceptConnectPort(

  OUT PHANDLE             ServerPortHandle,
  IN HANDLE               AlternativeReceivePortHandle OPTIONAL,
  IN PLPC_MESSAGE         ConnectionReply,
  IN BOOLEAN              AcceptConnection,
  IN OUT PLPC_SECTION_OWNER_MEMORY ServerSharedMemory OPTIONAL,
  OUT PLPC_SECTION_MEMORY ClientSharedMemory OPTIONAL );

NtAcceptConnectPort function is used in LPC communication by server process for establish connection with client. It should be called after NtListenPort completes.
  • ServerPortHandle
    • Result of call - HANDLE to Port Object for established connection.
  • AlternativeReceivePortHandle
  • ConnectionReply
    • Pointer to LPC_MESSAGE structure received from NtListenPort.
  • AcceptConnection
    • If not set, connection on client's side will be refused.
  • ServerSharedMemory
    • If connection uses large data buffers, and a HANDLE to Section Object for shared memory window is created on server side, server process shout set this parameter to pointer to LPC_SECTION_OWNER_MEMORY structure with filled SectionHandle member.
  • ClientSharedMemory
    • Similar to ServerSharedMemory, but when connection client create Section Object. In this case server doesn't know section's HANDLE, but shared memory window is automatically maped to his address space. Size and base address of mapped memory are returned in LPC_SECTION_MEMORY structure.

    This function returns HANDLE to newly created Port Object. All other LPC functions for currently accepted connection should use this HANDLE, not a base named port HANDLE created with NtCreatePort.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    LPC_MESSAGE
    LPC_SECTION_MEMORY
    LPC_SECTION_OWNER_MEMORY
    NtCompleteConnectPort
    NtCreatePort
    NtListenPort


NtCompleteConnectPort

2OO1, 27 January

NtCompleteConnectPort
NtCompleteConnectPort

NTSYSAPI
NTSTATUS
NTAPI

NtCompleteConnectPort(

  IN HANDLE               PortHandle );

NtCompleteConnectPort is called by server process after all initializations for new connection.
  • PortHandle
    • HANDLE to Port Object received with NtAcceptConnectPort call.

    Return from NtConnectPort on client's side is synchronised with return from this call. Both sides of LPC connection are ready for sending and receiving LPC messages.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    NtAcceptConnectPort
    NtConnectPort


NtConnectPort

2OO1, 27 January

NtConnectPort
NtConnectPort

NTSYSAPI
NTSTATUS
NTAPI

NtConnectPort(

  OUT PHANDLE             ClientPortHandle,
  IN PUNICODE_STRING      ServerPortName,
  IN PSECURITY_QUALITY_OF_SERVICE SecurityQos,
  IN OUT PLPC_SECTION_OWNER_MEMORY ClientSharedMemory OPTIONAL,
  OUT PLPC_SECTION_MEMORY ServerSharedMemory OPTIONAL,
  OUT PULONG              MaximumMessageLength OPTIONAL,
  IN                      ConnectionInfo OPTIONAL,
  IN PULONG               ConnectionInfoLength OPTIONAL );

NtConnectPort is used by client process for establish LPC connection with Named Port's owner.
  • ClientPortHandle
    • Result of call - HANDLE to Port Object.
  • ServerPortName
    • Name of port to connect to.
  • SecurityQos
  • ClientSharedMemory
    • Used when calling process created Section Object for shared memory. See NtAcceptConnectPort for details.
  • ServerSharedMemory
    • Used when calling process didn't create Section Object. See NtAcceptConnectPort for details.
  • MaximumMessageLength
    • Maximum communication message length. This value is calculated by server on port creation process (see NtCreatePort).
  • ConnectionInfo
    • Pointer to RAW buffer containing information from client. That information is received by server through LPC_MESSAGE with MessageType field set to LPC_CONNECTION_REQUEST.
  • ConnectionInfoLength
    • Size of ConnectionInfo buffer, in bytes.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    LPC_MESSAGE
    LPC_SECTION_MEMORY
    LPC_SECTION_OWNER_MEMORY
    NtAcceptConnectPort
    NtCompleteConnectPort
    NtCreatePort


NtCreatePort

2OO1, 14 January

NtCreatePort
NtCreatePort

NTSYSAPI
NTSTATUS
NTAPI

NtCreatePort(

  OUT PHANDLE             PortHandle,
  IN POBJECT_ATTRIBUTES   ObjectAttributes,
  IN ULONG                MaxConnectInfoLength,
  IN ULONG                MaxDataLength,
  IN OUT PULONG           Reserved OPTIONAL );

  • PortHandle
    • Result of call - HANDLE to Port Object.
  • ObjectAttributes
    • Typically contains name and SECURITY_DESCRIPTOR for newly created named port.
  • MaxConnectInfoLength
  • MaxDataLength
    • Maximum size of message.
  • Reserved

    • Documented by:
    Bo Branten
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtConnectPort
    NtListenPort


NtImpersonateClientOfPort

2OO1, 28 January

NtImpersonateClientOfPort
NtImpersonateClientOfPort

NTSYSAPI
NTSTATUS
NTAPI

NtImpersonateClientOfPort(

  IN HANDLE               PortHandle,
  IN PLPC_MESSAGE         Request );

NtImpersonateClientOfPort is called by LPC server process to get security context of client. That means: client's Token Object is assiciated with calling server thread (like NtSetInformationThread with ThreadImpersonationToken information class).
  • PortHandle
    • HANDLE to Port Object opened with NtAcceptConnectPort call.
  • Request
    • Pointer to LPC_MESSAGE structure contains reason of impersonation.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    LPC_MESSAGE
    NtAcceptConnectPort
    NtOpenThreadToken
    NtQueryInformationThread
    NtSetInformationThread


NtListenPort

2OO1, 27 January

NtListenPort
NtListenPort

NTSYSAPI
NTSTATUS
NTAPI

NtListenPort(

  IN HANDLE               PortHandle,
  OUT PLPC_MESSAGE        ConnectionRequest );

NtListenPort is used by LPC server.
  • PortHandle
    • HANDLE to named Port Object, created with NtCreatePort.
  • ConnectionRequest
    • Result of call - pointer to structure LPC_MESSAGE filled with incomming connection data.

    Server process should create new thread starting from execution of NtAcceptConnectPort. Main thread should call NtListenPort again to make possible for other processes to connect to port.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    LPC_MESSAGE
    NtAcceptConnectPort
    NtConnectPort
    NtCreatePort


NtQueryInformationPort

2OO1, 28 January

NtQueryInformationPort
NtQueryInformationPort

NTSYSAPI
NTSTATUS
NTAPI

NtQueryInformationPort(

  IN HANDLE               PortHandle,
  IN PORT_INFORMATION_CLASS PortInformationClass,
  OUT PVOID               PortInformation,
  IN ULONG                Length,
  OUT PULONG              ResultLength OPTIONAL );

Currently (on WinNT 4.0 SP6) there are no information classes for Port Object.
  • PortHandle
  • PortInformationClass
  • PortInformation
  • Length
  • ResultLength

    • Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    PORT_INFORMATION_CLASS


NtReadRequestData

2OO1, 29 January

NtReadRequestData
NtReadRequestData

NTSYSAPI
NTSTATUS
NTAPI

NtReadRequestData(

  IN HANDLE               PortHandle,
  IN PLPC_MESSAGE         Request,
  IN ULONG                DataIndex,
  OUT PVOID               Buffer,
  IN ULONG                Length,
  OUT PULONG              ResultLength OPTIONAL );

  • PortHandle
    • HANDLE to Port Object opened in a result of call NtAcceptConnectPort.
  • Request
  • DataIndex
  • Buffer
  • Length
  • ResultLength

    • Documented by:
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    LPC_MESSAGE
    NtAcceptConnectPort
    NtWriteRequestData


NtReplyPort

2OO1, 28 January

NtReplyPort
NtReplyPort

NTSYSAPI
NTSTATUS
NTAPI

NtReplyPort(

  IN HANDLE               PortHandle,
  IN PLPC_MESSAGE         Reply );

NtReplyPort can be used by both sides of LPC connection.
  • PortHandle
    • HANDLE to Port Object.
  • Reply
    • Pointer to LPC_MESSAGE structure.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    NtAcceptConnectPort
    NtConnectPort
    NtReplyWaitReceivePort
    NtReplyWaitReplyPort
    NtRequestWaitReplyPort


NtReplyWaitReceivePort

2OO1, 27 January

NtReplyWaitReceivePort
NtReplyWaitReceivePort

NTSYSAPI
NTSTATUS
NTAPI

NtReplyWaitReceivePort(

  IN HANDLE               PortHandle,
  OUT PHANDLE             ReceivePortHandle OPTIONAL,
  IN PLPC_MESSAGE         Reply OPTIONAL,
  OUT PLPC_MESSAGE        IncomingRequest );

NtReplyWaitReceivePort is typically used by LPC server process for receive LPC requests incomming from client process.
  • PortHandle
    • HANDLE to Port Object returned by
  • ReceivePortHandle
  • Reply
    • If other side waiting for reply message, you can send it by specyfing LPC Message Buffer as this parameter.
  • IncomingRequest
    • Pointer to user's allocated buffer receiving request data. Received data starts with

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    LPC_MESSAGE
    NtAcceptConnectPort
    NtReplyPort
    NtReplyWaitReplyPort
    NtRequestPort
    NtRequestWaitReplyPort


NtReplyWaitReplyPort

2OO1, 28 January

NtReplyWaitReplyPort
NtReplyWaitReplyPort

NTSYSAPI
NTSTATUS
NTAPI

NtReplyWaitReplyPort(

  IN HANDLE               PortHandle,
  IN OUT PLPC_MESSAGE     Reply );

NtReplyWaitReplyPort sends REPLY and waits for other side REPLY.
  • PortHandle
    • HANDLE to Port Object.
  • Reply
    • There's a pointer to LPC_MESSAGE structure. On input, should be filled with REPLY data by user. On output it contains REPLY from other side.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    LPC_MESSAGE
    NtAcceptConnectPort
    NtConnectPort
    NtReplyPort
    NtReplyWaitReceivePort
    NtRequestWaitReplyPort


NtRequestPort

2OO1, 28 January

NtRequestPort
NtRequestPort

NTSYSAPI
NTSTATUS
NTAPI

NtRequestPort(

  IN HANDLE               PortHandle,
  IN PLPC_MESSAGE         Request );

NtRequestPort sends request message to other side of LPC connection.
  • PortHandle
    • HANDLE to Port Object.
  • Request
    • Pointer to LPC_MESSAGE struct contains request data.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    LPC_MESSAGE
    NtAcceptConnectPort
    NtConnectPort
    NtListenPort
    NtReplyPort
    NtRequestWaitReplyPort


NtRequestWaitReplyPort

2OO1, 28 January

NtRequestWaitReplyPort
NtRequestWaitReplyPort

NTSYSAPI
NTSTATUS
NTAPI

NtRequestWaitReplyPort(

  IN HANDLE               PortHandle,
  IN PLPC_MESSAGE         Request,
  OUT PLPC_MESSAGE        IncomingReply );

NtRequestWaitReplyPort is used typically by client side in LPC connection.
  • PortHandle
    • HANDLE to Port Object.
  • Request
    • Pointer to LPC_MESSAGE buffer contains request data.
  • IncomingReply
    • Pointer to LPC_MESSAGE buffer filled on return with reply from other side.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    LPC_MESSAGE
    NtAcceptConnectPort
    NtConnectPort
    NtReplyPort
    NtReplyWaitReceivePort
    NtReplyWaitReplyPort
    NtRequestPort


NtWriteRequestData

2OO1, 29 January

NtWriteRequestData
NtWriteRequestData

NTSYSAPI
NTSTATUS
NTAPI

NtWriteRequestData(

  IN HANDLE               PortHandle,
  IN PLPC_MESSAGE         Request,
  IN ULONG                DataIndex,
  IN PVOID                Buffer,
  IN ULONG                Length,
  OUT PULONG              ResultLength OPTIONAL );

  • PortHandle
    • HANDLE to Port Object opened in a result of call NtAcceptConnectPort.
  • Request
  • DataIndex
  • Buffer
  • Length
  • ResultLength

    • Documented by:
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    LPC_MESSAGE
    NtAcceptConnectPort
    NtReadRequestData


PORT_INFORMATION_CLASS

2OO1, 29 January

PORT_INFORMATION_CLASS
PORT_INFORMATION_CLASS

typedef enum _PORT_INFORMATION_CLASS {

    PortNoInformation

} PORT_INFORMATION_CLASS, *PPORT_INFORMATION_CLASS;

  • PortNoInformation
    • Currently (on WinNT 4.0 SP6) there are no information classes for Port Objects.

    Documented by:
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    NtQueryInformationPort


LPC_MESSAGE

2OO1, 14 January

LPC_MESSAGE
LPC_MESSAGE

typedef struct _LPC_MESSAGE {

  USHORT                  DataLength;
  USHORT                  Length;
  USHORT                  MessageType;
  USHORT                  DataInfoOffset;
  CLIENT_ID               ClientId;
  ULONG                   MessageId;
  ULONG                   CallbackId;

} LPC_MESSAGE, *PLPC_MESSAGE;

Structure LPC_MESSAGE it's a header for all LPC messages. Any LPC message must contains at least 0x18 bytes length for LPC_MESSAGE header.

  • DataLength
    • Length of additional data in message. Maximum length of data is 0x130 bytes.
  • Length
    • Length of message, including header. Maximum value is 0x148 bytes length.
  • MessageType
    • Type of message. This field is filled by system in message transfer process. Can be one of following:
    • LPC_REQUEST
    • LPC_REPLY
    • LPC_DATAGRAM
    • LPC_LOST_REPLY
    • LPC_PORT_CLOSED
    • LPC_CLIENT_DIED
    • LPC_EXCEPTION
    • LPC_DEBUG_EVENT
    • LPC_ERROR_EVENT
    • LPC_CONNECTION_REQUEST
  • DataInfoOffset
  • ClientId
    • Port's client unique identifier.
  • MessageId
    • System set this field to actual value of incremental message counter.
  • CallbackId

    • Structure is known also as LPC_MESSAGE_HEADER.

    Documented by:
    Bo Branten
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtAcceptConnectPort
    NtImpersonateClientOfPort
    NtListenPort
    NtReadRequestData
    NtReplyPort
    NtReplyWaitReceivePort
    NtReplyWaitReplyPort
    NtRequestPort
    NtRequestWaitReplyPort
    NtWriteRequestData


LPC_SECTION_MEMORY

2OO1, 27 January

LPC_SECTION_MEMORY
LPC_SECTION_MEMORY

typedef struct _LPC_SECTION_MEMORY {

  ULONG                   Length;
  ULONG                   ViewSize;
  PVOID                   ViewBase;

} LPC_SECTION_MEMORY, *PLPC_SECTION_MEMORY;

Structure is used with LPC connection functions: NtAcceptConnectPort on server's side and NtConnectPort on client's side. It receives information about mapped view of section. Section Object must be created by other side (see LPC_SECTION_OWNER_MEMORY).
  • Length
    • Length of structure, in bytes.
  • ViewSize
    • Size of memory window, in bytes. This member is filled by LPC connection function.
  • ViewBase
    • Base address of memory window in current process memory space.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    LPC_SECTION_OWNER_MEMORY
    NtAcceptConnectPort
    NtConnectPort
    NtMapViewOfSection


LPC_SECTION_OWNER_MEMORY

2OO1, 27 January

LPC_SECTION_OWNER_MEMORY
LPC_SECTION_OWNER_MEMORY

typedef struct _LPC_SECTION_OWNER_MEMORY {

  ULONG                   Length;
  HANDLE                  SectionHandle;
  ULONG                   OffsetInSection;
  ULONG                   ViewSize;
  PVOID                   ViewBase;
  PVOID                   OtherSideViewBase;

} LPC_SECTION_OWNER_MEMORY, *PLPC_SECTION_OWNER_MEMORY;

This structure is used by LPC connection functions by Section Object creator side (whatever it is client of port or server). See LPC_SECTION_MEMORY for more information.
  • Length
    • Length of structure.
  • SectionHandle
    • HANDLE to SectionObject mapped on both sides of LPC connection.
  • OffsetInSection
  • ViewSize
    • Receives size of mapped window.
  • ViewBase
    • Receives base address of mapped window.
  • OtherSideViewBase
    • Receives base address of mapped window for other LPC connection side.

    Documented by:
    Tomasz Nowak
    Bo Branten

    Requirements:
    Library: ntdll.lib

    See also:
    LPC_SECTION_MEMORY
    NtAcceptConnectPort
    NtConnectPort
    NtCreateSection
    NtMapViewOfSection


LPC_TERMINATION_MESSAGE

2OO1, 3 February

LPC_TERMINATION_MESSAGE
LPC_TERMINATION_MESSAGE

typedef struct _LPC_TERMINATION_MESSAGE {

  LPC_MESSAGE_HEADER      Header;
  LARGE_INTEGER           CreationTime;

} LPC_TERMINATION_MESSAGE, *PLPC_TERMINATION_MESSAGE;

LPC_TERMINATION_MESSAGE is send to LPC server process when thread is terminating. Thread must be registered for inform server process by call NtRegisterThreadTerminatePort.

This message type is also send when LPC client close connection to server's port.
  • Header
    • Header.MessageType is LPC_CLIENT_DIED when thread terminate.
    Header.MessageType is LPC_PORT_CLOSED when LPC client close connection.

    See LPC_MESSAGE for details.
  • CreationTime
    • Time of thread creation or time of connection begin.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    LPC_MESSAGE
    NtConnectPort
    NtRegisterThreadTerminatePort


NtCreateProcess

NtCreateProcess
NtCreateProcess

NTSYSAPI
NTSTATUS
NTAPI

NtCreateProcess(

  OUT PHANDLE           ProcessHandle,
  IN ACCESS_MASK        DesiredAccess,
  IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
  IN HANDLE             ParentProcess,
  IN BOOLEAN            InheritObjectTable,
  IN HANDLE             SectionHandle OPTIONAL,
  IN HANDLE             DebugPort OPTIONAL,
  IN HANDLE             ExceptionPort OPTIONAL );

Requirements:
Library: ntdll.lib

See also:
PsCreateSystemProcess
NtTerminateProcess
NtOpenProcess


NtFlushInstructionCache

2OO1, 19 February

NtFlushInstructionCache
NtFlushInstructionCache

NTSYSAPI
NTSTATUS
NTAPI

NtFlushInstructionCache(

  IN HANDLE               ProcessHandle,
  IN PVOID                BaseAddress,
  IN ULONG                NumberOfBytesToFlush );

Function NtFlushInstructionCache empties execution cache for specified region of code. It shoult be used always after modification of process's executable memory (for example when NtLdr fills imported function's entries).

  • ProcessHandle
    • HANDLE to Process Object.
  • BaseAddress
    • Starting memory address to flush.
  • NumberOfBytesToFlush
    • Length of flushed memory block.

    Documented by:
    Reactos
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtOpenProcess


NtOpenProcess

2OOO, 13 November

NtOpenProcess
NtOpenProcess

NTSYSAPI
NTSTATUS
NTAPI

NtOpenProcess(

  OUT PHANDLE             ProcessHandle,
  IN ACCESS_MASK          AccessMask,
  IN POBJECT_ATTRIBUTES   ObjectAttributes,
  IN PCLIENT_ID           ClientId );

AccessMask

  • PROCESS_TERMINATE

  • PROCESS_CREATE_THREAD

  • PROCESS_SET_SESSIONID

  • PROCESS_VM_OPERATION

  • PROCESS_VM_READ

  • PROCESS_VM_WRITE

  • PROCESS_DUP_HANDLE

  • PROCESS_CREATE_PROCESS

  • PROCESS_SET_QUOTA

  • PROCESS_SET_INFORMATION

  • PROCESS_QUERY_INFORMATION

  • PROCESS_ALL_ACCESS

ObjectAttributes
For standard processes, all fields of ObjectAttributes should be NULL.

ClientId
Process id and thread id must be fill with valid values.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtCreateProcess
NtTerminateProcess


NtQueryInformationProcess

2OOO, 13 November

NtQueryInformationProcess
NtQueryInformationProcess

NTSYSAPI
NTSTATUS
NTAPI

NtQueryInformationProcess(

  IN HANDLE               ProcessHandle,
  IN PROCESS_INFORMATION_CLASS ProcessInformationClass,
  OUT PVOID               ProcessInformation,
  IN ULONG                ProcessInformationLength,
  OUT PULONG              ReturnLength );

ProcessHandle
Handle to process opened with PROCESS_QUERY_INFORMATION access.

ProcessInformationClass
See PROCESS_INFORMATION_CLASS.

ProcessInformation
Buffer for results.

ProcessInformationLength
Length of buffer. See PROCESS_INFORMATION_CLASS for additional information.

ReturnLength
Number of bytes needed, if ProcessInformationLength was too small.

Documented by:
Reactos
Sven B. Schreiber
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtCreateProcess
NtOpenProcess
NtSetInformationProcess
PROCESS_INFORMATION_CLASS


NtSetInformationProcess

2OOO, 13 November

NtSetInformationProcess
NtSetInformationProcess

NTSYSAPI
NTSTATUS
NTAPI

NtSetInformationProcess(

  IN HANDLE               ProcessHandle,
  IN PROCESS_INFORMATION_CLASS ProcessInformationClass,
  IN PVOID                ProcessInformation,
  IN ULONG                ProcessInformationLength );

ProcessHandle
Handle to process opened with PROCESS_SET_INFORMATION access.

ProcessInformationClass
See PROCESS_INFORMATION_CLASS for more information.

Documented by:
Reactos
Sven B. Schreiber
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtCreateProcess
NtOpenProcess
NtQueryInformationProcess
PROCESS_INFORMATION_CLASS


NtTerminateProcess

2OOO, 18 October

NtTerminateProcess
NtTerminateProcess

NTSYSAPI
NTSTATUS
NTAPI

NtTerminateProcess(

  IN HANDLE               ProcessHandle OPTIONAL,
  IN NTSTATUS             ExitStatus );

ProcessHandle

If not specified, caller process is killed.

Requirements:
Library: ntdll.lib

See also:
NtCreateProcess
NtOpenProcess
LdrShutdownProcess


RtlCreateUserProcess

2OOO, 2 December

RtlCreateUserProcess
RtlCreateUserProcess

NTSYSAPI
NTSTATUS
NTAPI

RtlCreateUserProcess(

  IN PUNICODE_STRING      ImagePath,
  IN ULONG                ObjectAttributes,
  IN OUT PRTL_USER_PROCESS_PARAMETERS ProcessParameters,
  IN PSECURITY_DESCRIPTOR ProcessSecurityDescriptor OPTIONAL,
  IN PSECURITY_DESCRIPTOR ThreadSecurityDescriptor OPTIONAL,
  IN HANDLE               ParentProcess,
  IN BOOLEAN              InheritHandles,
  IN HANDLE               DebugPort OPTIONAL,
  IN HANDLE               ExceptionPort OPTIONAL,
  OUT PRTL_USER_PROCESS_INFORMATION ProcessInformation );

ImagePath
Full path to executable image, in NT format (ex: "\??\C:\WinNT\SYSTEM32\cmd.exe").

ObjectAttributes
Used in File object creation. Valid are OBJ_INHERIT and OBJ_CASE_INSENSITIVE.

ProcessParameters
Normalized RTL_USER_PROCESS_PARAMETERS structure pointer. See RtlCreateProcessParameters for more information.

ParentProcess
Handle to object Process, opened with PROCESS_CREATE_PROCESS access.

ProcessInformation
Pointer to user-allocated structure RTL_USER_PROCESS_INFORMATION.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
RTL_USER_PROCESS_INFORMATION
RTL_USER_PROCESS_PARAMETERS
RtlCreateProcessParameters
RtlCreateUserThread
RtlNormalizeProcessParams


PROCESS_INFORMATION_CLASS

2OO1, 6 March

PROCESS_INFORMATION_CLASS
PROCESS_INFORMATION_CLASS

typedef enum _PROCESS_INFORMATION_CLASS {

    ProcessBasicInformation,
    ProcessQuotaLimits,
    ProcessIoCounters,
    ProcessVmCounters,
    ProcessTimes,
    ProcessBasePriority,
    ProcessRaisePriority,
    ProcessDebugPort,
    ProcessExceptionPort,
    ProcessAccessToken,
    ProcessLdtInformation,
    ProcessLdtSize,
    ProcessDefaultHardErrorMode,
    ProcessIoPortHandlers,
    ProcessPooledUsageAndLimits,
    ProcessWorkingSetWatch,
    ProcessUserModeIOPL,
    ProcessEnableAlignmentFaultFixup,
    ProcessPriorityClass,
    ProcessWx86Information,
    ProcessHandleCount,
    ProcessAffinityMask,
    ProcessPriorityBoost,
    MaxProcessInfoClass

} PROCESS_INFORMATION_CLASS, *PPROCESS_INFORMATION_CLASS;

Enumeration type PROCESS_INFORMATION_CLASS is used in a calls to NtQueryInformationProcess and NtSetInformationProcess. Structures for sending or receiving data are accessable below, separatelly for target information class.

  • ProcessBasicInformation
    • Action | : Query
Buffer size | : 0x018
Structure | : PROCESS_BASIC_INFORMATION
  • ProcessQuotaLimits
    • Action | : Query, Set
Buffer size | : 0x020
Structure | : QUOTA_LIMITS
  • ProcessIoCounters
    • Action | : Query
Buffer size | : ???
Structure | : IO_COUNTERS
  • ProcessVmCounters
    • Action | : Query
Buffer size | : 0x02C
Structure | : VM_COUNTERS
  • ProcessTimes
    • Action | : Query
Buffer size | : 0x020
Structure | : KERNEL_USER_TIMES
  • ProcessBasePriority
    • Action | : Set
Buffer size | : 0x004
Buffer | : KPRIORITY
Comment | : Sets process' Base Priority.
  • ProcessRaisePriority
    • Action | : Set
Buffer size | : 0x004
Buffer | : KPRIORITY
Comment | : Sets process' Raise Priority.
  • ProcessDebugPort
    • Action | : Query, Set
Buffer size | : 0x004
Buffer | : HANDLE
Comment | : Queries and sets process' Debug Port. See also NtCreatePort.
  • ProcessExceptionPort
    • Action | : Set
Buffer size | : 0x004
Buffer | : HANDLE
Comment | : Sets process' Exception Port. See also NtCreatePort.
  • ProcessAccessToken
    • Action | : Set
Buffer size | : 0x008
Structure | : PROCESS_ACCESS_TOKEN
  • ProcessLdtInformation
    • Action | : Query
Buffer size | : ???
Structure | : LDT_ENTRY

    Action | : Set
Buffer size | : 0x010
Structure | : LDT_ENTRY
  • ProcessLdtSize
    • Action | : Set
Buffer size | : 0x004
Buffer | : ULONG
Comment | : Sets process' Local Description Table size. See also NtSetLdtEntries function.
  • ProcessDefaultHardErrorMode
    • Action | : Query, Set
Buffer size | : 0x004
Buffer | : ULONG
Comment | : ???
  • ProcessIoPortHandlers
    • Action | : Set
Buffer size | : ???
Structure | : ???
  • ProcessPooledUsageAndLimits
    • Action | : Query
Buffer size | : 0x024
Structure | : POOLED_USAGE_AND_LIMITS
  • ProcessWorkingSetWatch
    • Action | : Query
Buffer size | : ???
Structure | : PROCESS_WS_WATCH_INFORMATION

    Action | : Set
Buffer size | : ???
Structure | :
  • ProcessUserModeIOPL
    • Action | : Set
Buffer size | : ???
Structure | :
  • ProcessEnableAlignmentFaultFixup
    • Action | : Set
Buffer size | : 0x001
Buffer | : BOOLEAN
Comment | : If set, enables automatic fixup of memory dissaligments.
  • ProcessPriorityClass
    • Action | : Set
Buffer size | : 0x002
Buffer | : WORD
Comment | : Sets process' Priority Class.
  • ProcessWx86Information
    • Action | : Query
Buffer size | : 0x004
Buffer | : ULONG
Comment | : ???
  • ProcessHandleCount
    • Action | : Query
Buffer size | : 0x004
Buffer | : ULONG
Comment | : Retrives Handle's count for process.
  • ProcessAffinityMask
    • Action | : Set
Buffer size | : 0x0
Buffer | : KAFFINITY
Comment | : Sets process' Affinity Mask.
  • ProcessPriorityBoost
    • Action | : Query, Set
Buffer size | : 0x004
Buffer | : KPRIORITY
Comment | : Queries and sets process' Priority Boost.

    Documented by:
    Tomasz Nowak
    Sven B. Schreiber

    Requirements:
    Library: ntdll.lib

    See also:
    NtSetInformationProcess


PEB

2OO1, 2 March

PEB
PEB

typedef struct _PEB {

  BOOLEAN                 InheritedAddressSpace;
  BOOLEAN                 ReadImageFileExecOptions;
  BOOLEAN                 BeingDebugged;
  BOOLEAN                 Spare;
  HANDLE                  Mutant;
  PVOID                   ImageBaseAddress;
  PPEB_LDR_DATA           LoaderData;
  PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
  PVOID                   SubSystemData;
  PVOID                   ProcessHeap;
  PVOID                   FastPebLock;
  PPEBLOCKROUTINE         FastPebLockRoutine;
  PPEBLOCKROUTINE         FastPebUnlockRoutine;
  ULONG                   EnvironmentUpdateCount;
  PPVOID                  KernelCallbackTable;
  PVOID                   EventLogSection;
  PVOID                   EventLog;
  PPEB_FREE_BLOCK         FreeList;
  ULONG                   TlsExpansionCounter;
  PVOID                   TlsBitmap;
  ULONG                   TlsBitmapBits[0x2];
  PVOID                   ReadOnlySharedMemoryBase;
  PVOID                   ReadOnlySharedMemoryHeap;
  PPVOID                  ReadOnlyStaticServerData;
  PVOID                   AnsiCodePageData;
  PVOID                   OemCodePageData;
  PVOID                   UnicodeCaseTableData;
  ULONG                   NumberOfProcessors;
  ULONG                   NtGlobalFlag;
  BYTE                    Spare2[0x4];
  LARGE_INTEGER           CriticalSectionTimeout;
  ULONG                   HeapSegmentReserve;
  ULONG                   HeapSegmentCommit;
  ULONG                   HeapDeCommitTotalFreeThreshold;
  ULONG                   HeapDeCommitFreeBlockThreshold;
  ULONG                   NumberOfHeaps;
  ULONG                   MaximumNumberOfHeaps;
  PPVOID                  *ProcessHeaps;
  PVOID                   GdiSharedHandleTable;
  PVOID                   ProcessStarterHelper;
  PVOID                   GdiDCAttributeList;
  PVOID                   LoaderLock;
  ULONG                   OSMajorVersion;
  ULONG                   OSMinorVersion;
  ULONG                   OSBuildNumber;
  ULONG                   OSPlatformId;
  ULONG                   ImageSubSystem;
  ULONG                   ImageSubSystemMajorVersion;
  ULONG                   ImageSubSystemMinorVersion;
  ULONG                   GdiHandleBuffer[0x22];
  ULONG                   PostProcessInitRoutine;
  ULONG                   TlsExpansionBitmap;
  BYTE                    TlsExpansionBitmapBits[0x80];
  ULONG                   SessionId;

} PEB, *PPEB;

Structure PEB (Process Enviroment Block) contains all User-Mode parameters associated by system with current process.

  • InheritedAddressSpace
  • ReadImageFileExecOptions
  • BeingDebugged
  • Spare
  • Mutant
  • ImageBaseAddress
    • Address of executable image in process' memory.
  • LoaderData
    • Pointer to PEB_LDR_DATA structure contains information filled by Loader.
  • ProcessParameters
    • Pointer to RTL_USER_PROCESS_PARAMETERS structure.
  • SubSystemData
  • ProcessHeap
    • Address of process' first heap allocated by Loader.
  • FastPebLock
    • Parameter for PEBLOCKROUTINE (see below).
  • FastPebLockRoutine
    • Address of fast-locking routine for PEB. Definition of routine is:
    typedef void (*PPEBLOCKROUTINE)(
    PVOID PebLock
    );
  • FastPebUnlockRoutine
    • PEB fast-unlock routine.
  • EnvironmentUpdateCount
    • Counter of process environment updates.
  • KernelCallbackTable
  • EventLogSection
  • EventLog
  • FreeList
  • TlsExpansionCounter
  • TlsBitmap
  • TlsBitmapBits[0x2]
  • ReadOnlySharedMemoryBase
  • ReadOnlySharedMemoryHeap
  • ReadOnlyStaticServerData
  • AnsiCodePageData
  • OemCodePageData
  • UnicodeCaseTableData
  • NumberOfProcessors
  • NtGlobalFlag
  • Spare2[0x4]
  • CriticalSectionTimeout
  • HeapSegmentReserve
  • HeapSegmentCommit
  • HeapDeCommitTotalFreeThreshold
  • HeapDeCommitFreeBlockThreshold
  • NumberOfHeaps
  • MaximumNumberOfHeaps
  • *ProcessHeaps
  • GdiSharedHandleTable
  • ProcessStarterHelper
  • GdiDCAttributeList
  • LoaderLock
  • OSMajorVersion
  • OSMinorVersion
  • OSBuildNumber
  • OSPlatformId
  • ImageSubSystem
  • ImageSubSystemMajorVersion
  • ImageSubSystemMinorVersion
  • GdiHandleBuffer[0x22]
  • PostProcessInitRoutine
  • TlsExpansionBitmap
  • TlsExpansionBitmapBits[0x80]
  • SessionId

    • Documented by:
    Reactos
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtQueryInformationProcess
    PEB_FREE_BLOCK
    PEB_LDR_DATA
    PROCESS_BASIC_INFORMATION
    RTL_USER_PROCESS_PARAMETERS
    TEB


PEB_FREE_BLOCK

2OO1, 2 March

PEB_FREE_BLOCK
PEB_FREE_BLOCK

typedef struct _PEB_FREE_BLOCK {

  PEB_FREE_BLOCK          *Next;
  ULONG                   Size;

} PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;

Structure PEB_FREE_BLOCK is used internally in PEB (Process Enviroment Block) structure for describe free blocks in memory allocated for PEB.

  • *Next
    • Pointer to next free block.
  • Size
    • Size of block, in bytes.

    Documented by:
    Reactos

    Requirements:
    Library: ntdll.lib

    See also:
    PEB


PEB_LDR_DATA

2OOO, 27 December

PEB_LDR_DATA
PEB_LDR_DATA

typedef struct _PEB_LDR_DATA {

  ULONG                   Length;
  BOOLEAN                 Initialized;
  PVOID                   SsHandle;
  LIST_ENTRY              InLoadOrderModuleList;
  LIST_ENTRY              InMemoryOrderModuleList;
  LIST_ENTRY              InInitializationOrderModuleList;

} PEB_LDR_DATA, *PPEB_LDR_DATA;

Length
Size of structure, used by ntdll.dll as structure version ID.

Initialized
If set, loader data section for current process is initialized.

SsHandle
- ???

InLoadOrderModuleList
Doubly linked list containing pointers to LDR_MODULE structure for previous and next module in load order.

InMemoryOrderModuleList
As above, but in memory placement order.

InInitializationOrderModuleList
As InLoadOrderModuleList, but in initialization order.

Documented by:
Reactos
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
LDR_MODULE
PEB


POOLED_USAGE_AND_LIMITS

2OO7, 5 May

POOLED_USAGE_AND_LIMITS
POOLED_USAGE_AND_LIMITS

typedef struct _POOLED_USAGE_AND_LIMITS {

  ULONG                   PeakPagedPoolUsage;
  ULONG                   PagedPoolUsage;
  ULONG                   PagedPoolLimit;
  ULONG                   PeakNonPagedPoolUsage;
  ULONG                   NonPagedPoolUsage;
  ULONG                   NonPagedPoolLimit;
  ULONG                   PeakPagefileUsage;
  ULONG                   PagefileUsage;
  ULONG                   PagefileLimit;

} POOLED_USAGE_AND_LIMITS, *PPOOLED_USAGE_AND_LIMITS;

  • PeakPagedPoolUsage
  • PagedPoolUsage
  • PagedPoolLimit
  • PeakNonPagedPoolUsage
  • NonPagedPoolUsage
  • NonPagedPoolLimit
  • PeakPagefileUsage
  • PagefileUsage
  • PagefileLimit

    • Supported on system versions:
    NT 4.0,Win 2000,Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateProcess
    NtOpenProcess
    NtQueryInformationProcess
    PROCESS_INFORMATION_CLASS


PROCESS_ACCESS_TOKEN

2OO7, 5 May

PROCESS_ACCESS_TOKEN
PROCESS_ACCESS_TOKEN

typedef struct _PROCESS_ACCESS_TOKEN {

  HANDLE                  Token;
  HANDLE                  Thread;

} PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;

  • Token
  • Thread

    • Supported on system versions:
    NT 4.0,Win 2000,Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateProcess
    NtOpenProcess
    NtSetInformationProcess
    PROCESS_INFORMATION_CLASS


PROCESS_WS_WATCH_INFORMATION

2OO7, 5 May

PROCESS_WS_WATCH_INFORMATION
PROCESS_WS_WATCH_INFORMATION

typedef struct _PROCESS_WS_WATCH_INFORMATION {

  PVOID                   FaultingPc;
  PVOID                   FaultingVa;

} PROCESS_WS_WATCH_INFORMATION, *PPROCESS_WS_WATCH_INFORMATION;

  • FaultingPc
  • FaultingVa

    • Supported on system versions:
    NT 4.0,Win 2000,Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateProcess
    NtOpenProcess
    NtQueryInformationProcess
    PROCESS_INFORMATION_CLASS


RTL_USER_PROCESS_PARAMETERS

2OOO, 2 December

RTL_USER_PROCESS_PARAMETERS
RTL_USER_PROCESS_PARAMETERS

typedef struct _RTL_USER_PROCESS_PARAMETERS {

  ULONG                   MaximumLength;
  ULONG                   Length;
  ULONG                   Flags;
  ULONG                   DebugFlags;
  PVOID                   ConsoleHandle;
  ULONG                   ConsoleFlags;
  HANDLE                  StdInputHandle;
  HANDLE                  StdOutputHandle;
  HANDLE                  StdErrorHandle;
  UNICODE_STRING          CurrentDirectoryPath;
  HANDLE                  CurrentDirectoryHandle;
  UNICODE_STRING          DllPath;
  UNICODE_STRING          ImagePathName;
  UNICODE_STRING          CommandLine;
  PVOID                   Environment;
  ULONG                   StartingPositionLeft;
  ULONG                   StartingPositionTop;
  ULONG                   Width;
  ULONG                   Height;
  ULONG                   CharWidth;
  ULONG                   CharHeight;
  ULONG                   ConsoleTextAttributes;
  ULONG                   WindowFlags;
  ULONG                   ShowWindowFlags;
  UNICODE_STRING          WindowTitle;
  UNICODE_STRING          DesktopName;
  UNICODE_STRING          ShellInfo;
  UNICODE_STRING          RuntimeData;
  RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];

} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;

MaximumLength
Should be set before call RtlCreateProcessParameters.

Length
Length of valid structure.

Flags
Currently only one flag is known:
    PPF_NORMALIZED	(1)		// Means that structure is normalized by call RtlNormalizeProcessParams

DebugFlags

ConsoleHandle
HWND to console window associated with process (if any).

ConsoleFlags

StdInputHandle

StdOutputHandle

StdErrorHandle

CurrentDirectoryPath
Specified in DOS-like symbolic link path, ex: "C:\WinNT\SYSTEM32"

CurrentDirectoryHandle
Handle to FILE object.

DllPath
DOS-like paths separated by ';' where system shoult search for DLL files.

ImagePathName
Full path in DOS-like format to process'es file image.

CommandLine
Command line.

Environment
Pointer to environment block (see RtlCreateEnvironment).

StartingPositionLeft

StartingPositionTop

Width

Height

CharWidth

CharHeight

ConsoleTextAttributes

WindowFlags

ShowWindowFlags

WindowTitle

DesktopName
Name of WindowStation and Desktop objects, where process is assigned.

ShellInfo

RuntimeData

DLCurrentDirectory[0x20]
- ???

RTL_USER_PROCESS_PARAMETERS is located at address 0x20000 (for all processes created by call WIN32 API CreateProcess).

Documented by:
Reactos
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
PEB
RTL_DRIVE_LETTER_CURDIR
RtlCreateEnvironment
RtlCreateProcessParameters
RtlCreateUserProcess
RtlDeNormalizeProcessParams
RtlDestroyProcessParameters
RtlNormalizeProcessParams


RTL_USER_PROCESS_INFORMATION

2OOO, 2 December

RTL_USER_PROCESS_INFORMATION
RTL_USER_PROCESS_INFORMATION

typedef struct _RTL_USER_PROCESS_INFORMATION {

  ULONG                   Size;
  HANDLE                  ProcessHandle;
  HANDLE                  ThreadHandle;
  CLIENT_ID               ClientId;
  SECTION_IMAGE_INFORMATION ImageInformation;

} RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION;

Size
Size of structure, in bytes.

ProcessHandle
HANDLE to newly created Process object.

ThreadHandle
HANDLE to Thread object representing main thread in process.

ClientId
Unique Id of process and thread.

ImageInformation
Some information from PE header. Created in result of call NtQuerySection with SectionImageInformation class.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
NtQuerySection
RtlCreateUserProcess
SECTION_IMAGE_INFORMATION


RTL_DRIVE_LETTER_CURDIR

2OOO, 2 December

RTL_DRIVE_LETTER_CURDIR
RTL_DRIVE_LETTER_CURDIR

typedef struct _RTL_DRIVE_LETTER_CURDIR {

  USHORT                  Flags;
  USHORT                  Length;
  ULONG                   TimeStamp;
  UNICODE_STRING          DosPath;

} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;

-???

Flags

Length

TimeStamp

DosPath

Documented by:
Reactos

Requirements:
Library: ntdll.lib

See also:
RTL_USER_PROCESS_PARAMETERS


LDR_MODULE

2OOO, 27 December

LDR_MODULE
LDR_MODULE

typedef struct _LDR_MODULE {

  LIST_ENTRY              InLoadOrderModuleList;
  LIST_ENTRY              InMemoryOrderModuleList;
  LIST_ENTRY              InInitializationOrderModuleList;
  PVOID                   BaseAddress;
  PVOID                   EntryPoint;
  ULONG                   SizeOfImage;
  UNICODE_STRING          FullDllName;
  UNICODE_STRING          BaseDllName;
  ULONG                   Flags;
  SHORT                   LoadCount;
  SHORT                   TlsIndex;
  LIST_ENTRY              HashTableEntry;
  ULONG                   TimeDateStamp;

} LDR_MODULE, *PLDR_MODULE;

InLoadOrderModuleList
Pointers to previous and next LDR_MODULE in load order.

InMemoryOrderModuleList
Pointers to previous and next LDR_MODULE in memory placement order.

InInitializationOrderModuleList
Pointers to previous and next LDR_MODULE in initialization order.

BaseAddress
Module base address known also as HMODULE.

EntryPoint
Module entry point (address of initialization procedure).

SizeOfImage
Sum of all image's sections placed in memory. Rounded up to 4Kb (page size).

FullDllName
Path and name of module.

BaseDllName
Module name only.

Flags

LoadCount

TlsIndex

HashTableEntry
LIST_ENTRY contains pointer to LdrpHashTable. Both prev and next values are the same.
LdrpHashTable it is table of LIST_ENTRY structures points to LDR_MODULE for current process.

TimeDateStamp

Documented by:
Reactos
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
PEB_LDR_DATA


NtCreateProfile

2OO1, 24 February

NtCreateProfile
NtCreateProfile

NTSYSAPI
NTSTATUS
NTAPI

NtCreateProfile(

  OUT PHANDLE             ProfileHandle,
  IN HANDLE               Process OPTIONAL,
  IN PVOID                ImageBase,
  IN ULONG                ImageSize,
  IN ULONG                BucketSize,
  IN PVOID                Buffer,
  IN ULONG                BufferSize,
  IN KPROFILE_SOURCE      ProfileSource,
  IN KAFFINITY            Affinity );

Function NtCreateProfile creates Profile Object.

Profile Objects are used for application profiling. There're 24 profile counters defined in KPROFILE_SOURCE enumeration type. Single Profile Object can be used to get information from one performance counter.

  • ProfileHandle
    • Result of call - HANDLE to Profile Object.
  • Process
    • HANDLE to Process Object to profile. Not required if profiled code is placed in Kernel address space (above 0x80000000).
  • ImageBase
    • Start address of profiling.
  • ImageSize
    • Size of profiled memory block.
  • BucketSize
    • - ??? (cannot be less than 2 ).
  • Buffer
    • Caller's allocated buffer for data.
  • BufferSize
    • Size of buffer, in bytes.
  • ProfileSource
    • Identifier of performance counter. See KPROFILE_SOURCE enumeration type for possible values.
  • Affinity
    • Processor affinity mask. It defines processors to ask about performance counter.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib
    Privileges for UserMode: SE_PROF_SINGLE_PROCESS_PRIVILEGE
    Privileges for KernelMode: SE_SYSTEM_PROFILE_PRIVILEGE

    See also:
    KPROFILE_SOURCE
    NtQueryIntervalProfile
    NtSetIntervalProfile
    NtStartProfile
    NtStopProfile


NtQueryIntervalProfile

2OO1, 25 February

NtQueryIntervalProfile
NtQueryIntervalProfile

NTSYSAPI
NTSTATUS
NTAPI

NtQueryIntervalProfile(

  IN KPROFILE_SOURCE      ProfileSource,
  OUT PULONG              Interval );

Function NtQueryIntervalProfile retrieves currently set delay between performance counter's ticks. See also description of NtSetIntervalProfile function.

  • ProfileSource
    • Performance counter identifier defined in KPROFILE_SOURCE enumeration type.
  • Interval
    • Pointer to ULONG value receiving current interval, in ms. If received value is zero, counter specified in ProfileSource parameter is hardware counter (performacne counter build in CPU).

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    KPROFILE_SOURCE
    NtCreateProfile
    NtSetIntervalProfile


NtSetIntervalProfile

2OO1, 25 February

NtSetIntervalProfile
NtSetIntervalProfile

NTSYSAPI
NTSTATUS
NTAPI

NtSetIntervalProfile(

  IN ULONG                Interval,
  IN KPROFILE_SOURCE      Source );

Function NtSetIntervalProfile sets delay between performance counter's ticks. Setting profile's interval has global effect for all running processes.

User can set interval only for software performance counters. To determine if counter is software or not, call NtQueryIntervalProfile. If returned interval is zero, queried counter is hardware counter (build in CPU).

  • Interval
    • New interval, in ms.
  • Source
    • Performance counter's identifier, defined in KPROFILE_SOURCE enumeration type.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    KPROFILE_SOURCE
    NtCreateProfile
    NtQueryIntervalProfile


NtStartProfile

2OO1, 25 February

NtStartProfile
NtStartProfile

NTSYSAPI
NTSTATUS
NTAPI

NtStartProfile(

  IN HANDLE               ProfileHandle );

Function NtStartProfile starts performance counter assiciated with previously created Profile Object.

  • ProfileHandle
    • HANDLE to Profile Object.

    Counter is stopped when user call NtStopProfile.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateProfile
    NtStopProfile


NtStopProfile

2OO1, 25 February

NtStopProfile
NtStopProfile

NTSYSAPI
NTSTATUS
NTAPI

NtStopProfile(

  IN HANDLE               ProfileHandle );

Function NtStopProfile stops performance counter associated with Profile Object.

  • ProfileHandle
    • HANDLE to Profile Object, previously started with NtStartProfile function call.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateProfile
    NtStartProfile


KPROFILE_SOURCE

2OO1, 24 February

KPROFILE_SOURCE
KPROFILE_SOURCE

typedef enum _KPROFILE_SOURCE {

    ProfileTime,
    ProfileAlignmentFixup,
    ProfileTotalIssues,
    ProfilePipelineDry,
    ProfileLoadInstructions,
    ProfilePipelineFrozen,
    ProfileBranchInstructions,
    ProfileTotalNonissues,
    ProfileDcacheMisses,
    ProfileIcacheMisses,
    ProfileCacheMisses,
    ProfileBranchMispredictions,
    ProfileStoreInstructions,
    ProfileFpInstructions,
    ProfileIntegerInstructions,
    Profile2Issue,
    Profile3Issue,
    Profile4Issue,
    ProfileSpecialInstructions,
    ProfileTotalCycles,
    ProfileIcacheIssues,
    ProfileDcacheAccesses,
    ProfileMemoryBarrierCycles,
    ProfileLoadLinkedIssues,
    ProfileMaximum

} KPROFILE_SOURCE, *PKPROFILE_SOURCE;

Enumerated type KPROFILE_SOURCE is used as performance counter identifier in application profiling. See NtCreateProfile for more information about Profile Objects.

This enumeration type is also defined in <ntddk.h> header file.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtCreateProfile
NtQueryIntervalProfile
NtSetIntervalProfile


NtCreateSection

2OOO, 12 October

NtCreateSection
NtCreateSection

NTSYSAPI
NTSTATUS
NTAPI

NtCreateSection(

  OUT PHANDLE             SectionHandle,
  IN ULONG                DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
  IN PLARGE_INTEGER       MaximumSize OPTIONAL,
  IN ULONG                PageAttributess,
  IN ULONG                SectionAttributes,
  IN HANDLE               FileHandle OPTIONAL );

Function NtCreateSection creates Section Object (virtual memory block with associated file).

  • SectionHandle
    • Result of call - HANDLE to Section Object.
  • DesiredAccess
    • Access mask. Can be combination of:
    • SECTION_QUERY
    • SECTION_MAP_WRITE
    • SECTION_MAP_READ
    • SECTION_MAP_EXECUTE
    • SECTION_EXTEND_SIZE
    • SECTION_ALL_ACCESS
  • ObjectAttributes
    • Pointer to OBJECT_ATTRIBUTES structure contains section name, in Object Namespace format.
  • MaximumSize
    • Optionally define maximum size of section. Must be defined when caller create section based on system PageFile.
  • PageAttributess
    • Can be one or combination of:
    • PAGE_NOACCESS
    • PAGE_READONLY
    • PAGE_READWRITE
    • PAGE_WRITECOPY
    • PAGE_EXECUTE
    • PAGE_EXECUTE_READ
    • PAGE_EXECUTE_READWRITE
    • PAGE_EXECUTE_WRITECOPY
    • PAGE_GUARD
    • PAGE_NOCACHE
    • PAGE_WRITECOMBINE
  • SectionAttributes
    • Can be one or combination of:
    • SEC_FILE
    • SEC_IMAGE
    • SEC_RESERVE
    • SEC_COMMIT
    • SEC_NOCACHE
  • FileHandle
    • Optionally HANDLE to File Object opened with proper access.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateFile
    NtExtendSection
    NtFlushVirtualMemory
    NtMapViewOfSection
    NtOpenFile
    NtOpenSection
    NtQuerySection


NtExtendSection

NtExtendSection
NtExtendSection

NTSYSAPI
NTSTATUS
NTAPI

NtExtendSection(

  IN HANDLE               SectionHandle,
  IN PLARGE_INTEGER       NewSectionSize );

SectionHandle

Must be open with SECTION_EXTEND_SIZE attribute.
If section it's a mapped file, function fails.

Requirements:
Library: ntdll.lib

See also:
NtCreateSection
NtOpenSection


NtMapViewOfSection

2OOO, 12 October

NtMapViewOfSection
NtMapViewOfSection

NTSYSAPI
NTSTATUS
NTAPI

NtMapViewOfSection(

  IN HANDLE               SectionHandle,
  IN HANDLE               ProcessHandle,
  IN OUT PVOID            *BaseAddress OPTIONAL,
  IN ULONG                ZeroBits OPTIONAL,
  IN ULONG                CommitSize,
  IN OUT PLARGE_INTEGER   SectionOffset OPTIONAL,
  IN OUT PULONG           ViewSize,
  IN                      InheritDisposition,
  IN ULONG                AllocationType OPTIONAL,
  IN ULONG                Protect );

Function NtMapViewOfSection maps specified part of Section Object into process memory.

  • SectionHandle
    • HANDLE to Section Object opened with one or more from SECTION_MAP_EXECUTE, SECTION_MAP_READ, SECTION_MAP_WRITE attributes.
  • ProcessHandle
    • HANDLE to Process Object opened with PROCESS_VM_OPERATION access.
  • *BaseAddress
    • Pointer to variable receiving virtual address of mapped memory. If this value is not NULL, system tries to allocate memory from specified value.
  • ZeroBits
    • Indicates how many high bits must not be set in BaseAddress.
  • CommitSize
    • Size of initially commited memory, in bytes.
  • SectionOffset
    • Pointer to begin of mapped block in section. This value must be rounded up to X64K block size (0x10000 on X86).
  • ViewSize
    • Pointer to size of mapped block, in bytes. This value is rounded up to page size (0x1000 on x86).
  • InheritDisposition
    • How to child processes inherid maped section. See description of enumeration type SECTION_INHERIT.
  • AllocationType
    • Can be one of:
    • MEM_COMMIT
    • MEM_RESERVE
  • Protect
    • Page protection. Can be one of:
    • PAGE_NOACCESS
    • PAGE_READONLY
    • PAGE_READWRITE
    • PAGE_WRITECOPY
    • PAGE_EXECUTE
    • PAGE_EXECUTE_READ
    • PAGE_EXECUTE_READWRITE
    • PAGE_EXECUTE_WRITECOPY
    • PAGE_GUARD
    • PAGE_NOCACHE
    • PAGE_WRITECOMBINE

    Supported on system versions:
    NT 4.0,Win 2000,Win XP/2003

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtAllocateVirtualMemory
    NtCreateSection
    NtOpenSection
    NtUnmapViewOfSection


NtOpenSection

NtOpenSection
NtOpenSection

NTSYSAPI
NTSTATUS
NTAPI

NtOpenSection(

  OUT PHANDLE             SectionHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes );

Requirements:
Library: ntdll.lib

See also:
NtCreateSection


NtQuerySection

NtQuerySection
NtQuerySection

NTSYSAPI
NTSTATUS
NTAPI

NtQuerySection(

  IN HANDLE               SectionHandle,
  IN SECTION_INFORMATION_CLASS InformationClass,
  OUT PVOID               InformationBuffer,
  IN ULONG                InformationBufferSize,
  OUT PULONG              ResultLength OPTIONAL );

InformationClass

Use one of following:

  • SectionBasicInformation     // Result is SECTION_BASIC_INFORMATION structure
    •

  • SectionImageInformation     // Result is SECTION_IMAGE_INFORMATION structure
    •

SectionImageInformation Are avaiable only for file-based sections.

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateProcess
    NtCreateSection
    NtOpenSection
    SECTION_BASIC_INFORMATION
    SECTION_IMAGE_INFORMATION


NtUnmapViewOfSection

NtUnmapViewOfSection
NtUnmapViewOfSection

NTSYSAPI
NTSTATUS
NTAPI

NtUnmapViewOfSection(

  IN HANDLE               ProcessHandle,
  IN PVOID                BaseAddress );

Requirements:
Library: ntdll.lib

See also:
NtMapViewOfSection
NtOpenSection


SECTION_INFORMATION_CLASS

2OO1, 14 March

SECTION_INFORMATION_CLASS
SECTION_INFORMATION_CLASS

typedef enum _SECTION_INFORMATION_CLASS {

    SectionBasicInformation,
    SectionImageInformation

} SECTION_INFORMATION_CLASS, *PSECTION_INFORMATION_CLASS;

Enumeration type SECTION_INFORMATION_CLASS is used in a call to NtQuerySection function.

This type can be one of:
  • SectionBasicInformation
    • Result buffer contains structure     SECTION_BASIC_INFORMATION. Buffer size shoud be set to 0x0C.
  • SectionImageInformation
    • Result buffer contains structure     SECTION_IMAGE_INFORMATION. Buffer size shoud be set to 0x28. This information class is accessable only where section was created with HANDLE to open executable file (see NtCreateSection for details).

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateSection
    NtOpenSection
    NtQuerySection
    SECTION_BASIC_INFORMATION
    SECTION_IMAGE_INFORMATION


SECTION_INHERIT

2OO0, 12 October

SECTION_INHERIT
SECTION_INHERIT

typedef enum _SECTION_INHERIT {

    ViewShare=1,
    ViewUnmap=2

} SECTION_INHERIT, *PSECTION_INHERIT;

Enumeration type SECTION_INHERIT is used in a call to NtMapViewOfSection.

  • ViewShare
    • Created view of Section Object will be also mapped to any created in future process.
  • ViewUnmap
    • Created view will not be inherited by child processes.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtMapViewOfSection


SECTION_BASIC_INFORMATION

2OO1, 14 March

SECTION_BASIC_INFORMATION
SECTION_BASIC_INFORMATION

typedef struct _SECTION_BASIC_INFORMATION {

  ULONG                   Unknown;
  ULONG                   SectionAttributes;
  LARGE_INTEGER           SectionSize;

} SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;

Structure SECTION_BASIC_INFORMATION is returned as a result of call NtQuerySection with SectionBasicInformation information class.

  • Unknown
    • (?), always set to zero.
  • SectionAttributes
    • Can be one or combination of:
    • SEC_RESERVE
    • SEC_IMAGE
    • SEC_FILE
  • SectionSize
    • Size of section, in bytes. This value equals to section's size declared in a call to NtCreateSection or NtExtendSection.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateSection
    NtExtendSection
    NtQuerySection
    SECTION_IMAGE_INFORMATION
    SECTION_INFORMATION_CLASS


SECTION_IMAGE_INFORMATION

2OO0, 26 November

SECTION_IMAGE_INFORMATION
SECTION_IMAGE_INFORMATION

typedef struct _SECTION_IMAGE_INFORMATION {

  PVOID                   EntryPoint;
  ULONG                   StackZeroBits;
  ULONG                   StackReserved;
  ULONG                   StackCommit;
  ULONG                   ImageSubsystem;
  WORD                    SubSystemVersionLow;
  WORD                    SubSystemVersionHigh;
  ULONG                   Unknown1;
  ULONG                   ImageCharacteristics;
  ULONG                   ImageMachineType;
  ULONG                   Unknown2[3];

} SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;

Structure SECTION_IMAGE_INFORMATION is returned as a result of call NtQuerySection with SectionImageInformation information class. System automatically check type and contents of File Object passed as a parameter to function NtCreateSection, and sets SEC_IMAGE bit on Section Attributes.

This structure is very useful in process creation, becouse caller can check most interesting of PE Header fields just before call to NtCreateProcess and without mapping section to target process'es memory.

  • EntryPoint
    • Image's entry point.
  • StackZeroBits
    • Number of bits from left side of stack address must be set to zero. It means maximum stack's address in process memory.
  • StackReserved
    • Total size of stack, in bytes.
  • StackCommit
    • Initially commited stack's block size.
  • ImageSubsystem
    • One of IMAGE_SUBSYSTEM_* descripted in Microsoft SDK and avaiable in <winnt.h> header file.
  • SubSystemVersionLow
    • Minor version number of subsystem.
  • SubSystemVersionHigh
    • Major version number of subsystem.
  • Unknown1
    • (?)
  • ImageCharacteristics
    • DLL Characteristics.
  • ImageMachineType
    • One of IMAGE_FILE_MACHINE_*.
  • Unknown2[3]
    • (?)

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateProcess
    NtCreateSection
    NtMapViewOfSection
    NtOpenSection
    NtQuerySection
    SECTION_BASIC_INFORMATION
    SECTION_INFORMATION_CLASS


NtCreateSemaphore

2OO1, 1O February

NtCreateSemaphore
NtCreateSemaphore

NTSYSAPI
NTSTATUS
NTAPI

NtCreateSemaphore(

  OUT PHANDLE             SemaphoreHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
  IN ULONG                InitialCount,
  IN ULONG                MaximumCount );

Function NtCreateSemaphore creates Semaphore Object with or without name in Object Namespace, and sets initial and maximum releases number.

  • SemaphoreHandle
    • Result of call - pointer to HANDLE to Semaphore Object.
  • DesiredAccess
    • Access rights to Semaphore Object. Can be one of:
    • SEMAPHORE_QUERY_STATE
    • SEMAPHORE_MODIFY_STATE
    • SEMAPHORE_ALL_ACCESS
  • ObjectAttributes
    • Optional pointer to OBJECT_ATTRIBUTES structure containing semaphore's name.
  • InitialCount
    • Initial state of semaphore. Typically the same as MaximumCount.
  • MaximumCount
    • Maximum releases number.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtOpenSemaphore
    NtQuerySemaphore


NtOpenSemaphore

2OO1, 1O February

NtOpenSemaphore
NtOpenSemaphore

NTSYSAPI
NTSTATUS
NTAPI

NtOpenSemaphore(

  OUT PHANDLE             SemaphoreHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes );

Function NtOpenSemaphore opens named Semaphore Object. This operation doesn't modify semaphore's internal counter.

  • SemaphoreHandle
    • Result of call - pointer to HANDLE to Semaphore Object.
  • DesiredAccess
    • Access rights, descripted in NtCreateSemaphore.
  • ObjectAttributes
    • Pointer to OBJECT_ATTRIBUTES structure containing semaphore's name.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateSemaphore


NtQuerySemaphore

2OO1, 1O February

NtQuerySemaphore
NtQuerySemaphore

NTSYSAPI
NTSTATUS
NTAPI

NtQuerySemaphore(

  IN HANDLE               SemaphoreHandle,
  IN SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,
  OUT PVOID               SemaphoreInformation,
  IN ULONG                SemaphoreInformationLength,
  OUT PULONG              ReturnLength OPTIONAL );

Function NtQuerySemaphore retrieve semaphore's parameters (see SEMAPHORE_BASIC_INFORMATION).

  • SemaphoreHandle
    • HANDLE to Semaphore Object opened with SEMAPHORE_QUERY_STATE access.
  • SemaphoreInformationClass
    • Information class descripted in SEMAPHORE_INFORMATION_CLASS section.
  • SemaphoreInformation
    • Pointer to user's allocated buffer for result data.
  • SemaphoreInformationLength
    • Size of SemaphoreInformation buffer, in bytes.
  • ReturnLength
    • Optionally returns required buffer size.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateSemaphore
    NtOpenSemaphore
    SEMAPHORE_BASIC_INFORMATION
    SEMAPHORE_INFORMATION_CLASS


NtReleaseSemaphore

2OO1, 1O February

NtReleaseSemaphore
NtReleaseSemaphore

NTSYSAPI
NTSTATUS
NTAPI

NtReleaseSemaphore(

  IN HANDLE               SemaphoreHandle,
  IN ULONG                ReleaseCount,
  OUT PULONG              PreviousCount OPTIONAL );

Function NtReleaseSemaphore increments semaphore's counter, oposite to any waiting function (semaphore is signaled when semaphore's counter is greater then zero).

  • SemaphoreHandle
    • HANDLE to Semaphore Object opened with SEMAPHORE_MODIFY_STATE access.
  • ReleaseCount
    • Number of increments, typically set to 1.
  • PreviousCount
    • Optional pointer to ULONG value receiving semaphore's counter state before call.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateSemaphore
    NtOpenSemaphore
    NtQuerySemaphore


SEMAPHORE_INFORMATION_CLASS

2OO1, 1O February

SEMAPHORE_INFORMATION_CLASS
SEMAPHORE_INFORMATION_CLASS

typedef enum _SEMAPHORE_INFORMATION_CLASS {

    SemaphoreBasicInformation

} SEMAPHORE_INFORMATION_CLASS, *PSEMAPHORE_INFORMATION_CLASS;

SEMAPHORE_INFORMATION_CLASS is enumeration type used with function NtQuerySemaphore. Currently only one class is defined:

  • SemaphoreBasicInformation
    • Result of call to     NtQuerySemaphore is SEMAPHORE_BASIC_INFORMATION structure.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtQuerySemaphore
    SEMAPHORE_BASIC_INFORMATION


SEMAPHORE_BASIC_INFORMATION

2OO1, 1O February

SEMAPHORE_BASIC_INFORMATION
SEMAPHORE_BASIC_INFORMATION

typedef struct _SEMAPHORE_BASIC_INFORMATION {

  ULONG                   CurrentCount;
  ULONG                   MaximumCount;

} SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;

Structure SEMAPHORE_BASIC_INFORMATION is retrieved as a result of call NtQuerySemaphore with SemaphoreBasicInformation information class.

  • CurrentCount
    • Current state of semaphore's counter.
  • MaximumCount
    • Maximum counter position, defined with call to NtCreateSemaphore.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateSemaphore
    NtQuerySemaphore
    SEMAPHORE_INFORMATION_CLASS


NtCreateSymbolicLinkObject

NtCreateSymbolicLinkObject
NtCreateSymbolicLinkObject

NTSYSAPI
NTSTATUS
NTAPI

NtCreateSymbolicLinkObject (

  OUT PHANDLE             pHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes,
  IN PUNICODE_STRING      DestinationName );

pHandle

Handle to SymbolicLinkObject.

ObjectAttributes

Name of SymbolicLinkObject.

DestinationName

Name or path to destination object in Object Namespace.

Requirements:
Library: ntdll.lib

See also:
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject


NtOpenSymbolicLinkObject

NtOpenSymbolicLinkObject
NtOpenSymbolicLinkObject

NTSYSAPI
NTSTATUS
NTAPI

NtOpenSymbolicLinkObject(

  OUT PHANDLE             pHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes );

Requirements:
Library: ntdll.lib

See also:
NtCreateSymbolicLinkObject
NtQuerySymbolicLinkObject


NtQuerySymbolicLinkObject

NtQuerySymbolicLinkObject
NtQuerySymbolicLinkObject

NTSYSAPI
NTSTATUS
NTAPI

NtQuerySymbolicLinkObject(

  IN HANDLE               SymbolicLinkHandle,
  OUT PUNICODE_STRING     pLinkName,
  OUT PULONG              pDataWritten OPTIONAL );

pLinkName

Received path to destination object.

pDataWritten

- ???

Requirements:
Library: ntdll.lib

See also:
NtCreateSymbolicLinkObject
NtOpenSymbolicLinkObject


NtGetContextThread

2OOO, 11 November

NtGetContextThread
NtGetContextThread

NTSYSAPI
NTSTATUS
NTAPI

NtGetContextThread(

  IN HANDLE               ThreadHandle,
  OUT PCONTEXT            pContext );

pContext
See <ntddk.h> for information about CONTEXT structure usage.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtContinue
NtCreateThread
NtSetContextThread
RtlInitializeContext


NtSetContextThread

2OOO, 1O December

NtSetContextThread
NtSetContextThread

NTSYSAPI
NTSTATUS
NTAPI

NtSetContextThread(

  IN HANDLE               ThreadHandle,
  IN PCONTEXT             Context );

ThreadHandle
Handle to Thread Object opened with THREAD_SET_CONTEXT access flag.

Context
Context to set to thread.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtContinue
NtCreateThread
NtGetContextThread
RtlInitializeContext


RtlInitializeContext

2OOO, 10 November

RtlInitializeContext
RtlInitializeContext

NTSYSAPI
PVOID
NTAPI

RtlInitializeContext(

  IN HANDLE               ProcessHandle,
  OUT PCONTEXT            ThreadContext,
  IN PVOID                ThreadStartParam OPTIONAL,
  IN PTHREAD_START_ROUTINE ThreadStartAddress,
  IN PINITIAL_TEB     InitialTeb );

Initialise CONTEXT structure for use with NtCreateThread.

Requirements:
Library: ntdll.lib

See also:
NtCreateThread
NtGetContextThread
NtSetContextThread


NtAlertResumeThread

2OOO, 14 November

NtAlertResumeThread
NtAlertResumeThread

NTSYSAPI
NTSTATUS
NTAPI

NtAlertResumeThread(

  IN HANDLE               ThreadHandle,
  OUT PULONG              SuspendCount );

ThreadHandle
Handle to thread object.

SuspendCount
Returns number of suspend request for thread ThreadHandle before call NtAlertResumeThread. If this number is 0,
thread will continue execution.

Difference between AlertResumeThread and ResumeThread it's the first one sets Thread Object to alerted state (so before thread will continue execution, all APC will be executed).

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
NtCreateThread
NtOpenThread
NtResumeThread
NtSuspendThread


NtContinue

2OOO, 14 November

NtContinue
NtContinue

NTSYSAPI
NTSTATUS
NTAPI

NtContinue(

  IN PCONTEXT             ThreadContext,
  IN BOOLEAN              RaiseAlert );

  • ThreadContext
    • Pointer to CONTEXT structure for current thread.
  • RaiseAlert
    • If set, remove Alerted state from current Thread Object.

    You can use NtContinue after processing exception for continue executing thread. System uses NtContinue also in APC processing.

    Documented by:
    Tomasz Nowak
    Reactos

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateThread
    NtGetContextThread
    NtSetContextThread


NtCreateThread

2OOO, 11 November

NtCreateThread
NtCreateThread

NTSYSAPI
NTSTATUS
NTAPI

NtCreateThread(

  OUT PHANDLE             ThreadHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
  IN HANDLE               ProcessHandle,
  OUT PCLIENT_ID          ClientId,
  IN PCONTEXT             ThreadContext,
  IN PINITIAL_TEB         InitialTeb,
  IN BOOLEAN              CreateSuspended );

ThreadHandle
Caller supplied storage for the resulting handle.

DesiredAccess
Specifies the allowed or desired access to the thread.

ObjectAttributes
Initialized attributes for the object.

ProcessHandle
Handle to the threads parent process.

ClientId
Caller supplies storage for returned process id and thread id.

ThreadContext
Initial processor context for the thread.

InitialTeb
Initial user mode stack context for the thread.

CreateSuspended
Specifies if the thread is ready for scheduling. See NtContinue for more information.

Documented by:
Reactos

Requirements:
Library: ntdll.lib

See also:
INITIAL_TEB
NtContinue
NtCreateProcess
NtTerminateThread
NtAlertResumeThread


NtCurrentTeb

2OO1, 2 March

NtCurrentTeb
NtCurrentTeb

NTSYSAPI
PTEB
NTAPI

NtCurrentTeb(

 );

Function NtCurrentTeb returns address of TEB (Thread Environment Block) for calling thread.

NtCurrentTeb isn't typical NT CALL realised via INT 2E, becouse TEB is accessable at address fs:[0018h].

Microsoft declare NtCurrentTeb as __cdecl, but ntdll.dll export it as __stdcall (it don't have metter, becouse function don't have any parameters), so you cannot use ntdll.dll export. In this case the better way is write NtCurrentTeb manually, declaring it as __cdecl.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
TEB


NtDelayExecution

2OOO, 17 December

NtDelayExecution
NtDelayExecution

NTSYSAPI
NTSTATUS
NTAPI

NtDelayExecution(

  IN BOOLEAN              Alertable,
  IN PLARGE_INTEGER       DelayInterval );

  • Alertable
    •
    If set, execution can break in a result of NtAlertThread call.
  • DelayInterval
    •
    Delay in 100-ns units. Negative value means delay relative to current.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtAlertThread
    NtSignalAndWaitForSingleObject
    NtWaitForMultipleObjects
    NtWaitForSingleObject


NtImpersonateThread

2OO1, 15 February

NtImpersonateThread
NtImpersonateThread

NTSYSAPI
NTSTATUS
NTAPI

NtImpersonateThread(

  IN HANDLE               ThreadHandle,
  IN HANDLE               ThreadToImpersonate,
  IN PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService );

Function NtImpersonateThread assigns one thread's token to another. If source thread don't have associated Token Object, function use process'es token to impersonate destination thread.

  • ThreadHandle
    • HANDLE to source Thread Object.
  • ThreadToImpersonate
    • HANDLE to destination Thread Object opened with THREAD_IMPERSONATE access.
  • SecurityQualityOfService
    • Pointer to SECURITY_QUALITY_OF_SERVICE structure filled by user.

    Documented by:
    Tomasz Nowak
    Reactos

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateThread
    NtImpersonateClientOfPort
    NtOpenThread
    SECURITY_QUALITY_OF_SERVICE


NtOpenThread

2OOO, 16 November

NtOpenThread
NtOpenThread

NTSYSAPI
NTSTATUS
NTAPI

NtOpenThread(

  OUT PHANDLE             ThreadHandle,
  IN ACCESS_MASK          AccessMask,
  IN POBJECT_ATTRIBUTES   ObjectAttributes,
  IN PCLIENT_ID           ClientId );

ThreadHandle
Pointer to received handle to thread object.

AccessMask
Access mask. See WinNT.h for details.

ObjectAttributes
Attributes of thread to open. For standard threads there are empty.

ClientId
Pointer to CLIENT_ID structure. Only UniqueThread member is required (difference to NtOpenProcess).

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtCreateThread
NtOpenProcess
NtTerminateThread


NtQueryInformationThread

2OOO, 19 December

NtQueryInformationThread
NtQueryInformationThread

NTSYSAPI
NTSTATUS
NTAPI

NtQueryInformationThread(

  IN HANDLE               ThreadHandle,
  IN THREAD_INFORMATION_CLASS ThreadInformationClass,
  OUT PVOID               ThreadInformation,
  IN ULONG                ThreadInformationLength,
  OUT PULONG              ReturnLength OPTIONAL );

ThreadHandle
Handle to Thread Object opened with THREAD_QUERY_INFORMATION access.

ThreadInformationClass
Information class defined in THREAD_INFORMATION_CLASS enumerated type.

ThreadInformation
Caller's allocated buffer for results.

ThreadInformationLength
Length of buffer, in bytes.

ReturnLength
Optional pointer to required buffer length.

See THREAD_INFORMATION_CLASS for more information.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtSetInformationThread
THREAD_INFORMATION_CLASS


NtRegisterThreadTerminatePort

2OO1, 3 February

NtRegisterThreadTerminatePort
NtRegisterThreadTerminatePort

NTSYSAPI
NTSTATUS
NTAPI

NtRegisterThreadTerminatePort(

  IN HANDLE               PortHandle );

  • PortHandle
    • HANDLE to previously connected Port Object.

    Typically, NtRegisterThreadTerminatePort is used in CsrNewThread function, called before thread execution begins, but in thread context.
    Function associate PortHandle with thread, and sends LPC_TERMINATION_MESSAGE to specified port immediatelly after call NtTerminateThread.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    CsrNewThread
    LPC_TERMINATION_MESSAGE
    NtConnectPort
    NtTerminateThread


NtResumeThread

2OOO, 3 December

NtResumeThread
NtResumeThread

NTSYSAPI
NTSTATUS
NTAPI

NtResumeThread(

  IN HANDLE               ThreadHandle,
  OUT PULONG              SuspendCount OPTIONAL );

See AlertResumeThread.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
NtAlertResumeThread
NtCreateThread
NtSuspendThread


NtSetInformationThread

2OOO, 19 December

NtSetInformationThread
NtSetInformationThread

NTSYSAPI
NTSTATUS
NTAPI

NtSetInformationThread(

  IN HANDLE               ThreadHandle,
  IN THREAD_INFORMATION_CLASS ThreadInformationClass,
  IN PVOID                ThreadInformation,
  IN ULONG                ThreadInformationLength );

ThreadHandle
Handle to Thread Object opened with THREAD_SET_INFORMATION access.

ThreadInformationClass
Information class to set to. See THREAD_INFORMATION_CLASS for detailed description of use.

ThreadInformation
Pointer to value to set.

ThreadInformationLength
Length of value to set.

See THREAD_INFORMATION_CLASS for more information.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtQueryInformationThread
THREAD_INFORMATION_CLASS


NtSuspendThread

2OOO, 5 December

NtSuspendThread
NtSuspendThread

NTSYSAPI
NTSTATUS
NTAPI

NtSuspendThread(

  IN HANDLE               ThreadHandle,
  OUT PULONG              PreviousSuspendCount OPTIONAL );

PreviousSuspendCount
Suspend count for ThreadHandle thread before function call.

Documented by:
Reactos
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtAlertResumeThread
NtResumeThread


NtTerminateThread

2OOO, 16 November

NtTerminateThread
NtTerminateThread

NTSYSAPI
NTSTATUS
NTAPI

NtTerminateThread(

  IN HANDLE               ThreadHandle,
  IN NTSTATUS             ExitStatus );

ThreadHandle
Open handle to thread object.

ExitStatus
Result of thread, as NTSTATUS.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtCreateThread
NtOpenThread
NtTerminateProcess


NtYieldExecution

2OOO, 17 December

NtYieldExecution
NtYieldExecution

NTSYSAPI
NTSTATUS
NTAPI

NtYieldExecution(

 );

This function stop executing of calling thread, and switch to any other currently running thread.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib


RtlCreateUserThread

2OOO, 2 December

RtlCreateUserThread
RtlCreateUserThread

NTSYSAPI
NTSTATUS
NTAPI

RtlCreateUserThread(

  IN HANDLE               ProcessHandle,
  IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL,
  IN BOOLEAN              CreateSuspended,
  IN ULONG                StackZeroBits,
  IN OUT PULONG           StackReserved,
  IN OUT PULONG           StackCommit,
  IN PVOID                StartAddress,
  IN PVOID                StartParameter OPTIONAL,
  OUT PHANDLE             ThreadHandle,
  OUT PCLIENT_ID          ClientID );

StackZeroBits
How many older bits must be clear while allocating thread stack. See INITIAL_TEB.

StartAddress
Thread start routine address.

Documented by:
Reactos
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
INITIAL_TEB
NtCreateThread
NtTerminateThread


THREAD_INFORMATION_CLASS

2OOO, 19 December

THREAD_INFORMATION_CLASS
THREAD_INFORMATION_CLASS

typedef enum _THREAD_INFORMATION_CLASS {

    ThreadBasicInformation,
    ThreadTimes,
    ThreadPriority,
    ThreadBasePriority,
    ThreadAffinityMask,
    ThreadImpersonationToken,
    ThreadDescriptorTableEntry,
    ThreadEnableAlignmentFaultFixup,
    ThreadEventPair,
    ThreadQuerySetWin32StartAddress,
    ThreadZeroTlsCell,
    ThreadPerformanceCount,
    ThreadAmILastThread,
    ThreadIdealProcessor,
    ThreadPriorityBoost,
    ThreadSetTlsArrayAddress,
    ThreadIsIoPending,
    ThreadHideFromDebugger

} THREAD_INFORMATION_CLASS, *PTHREAD_INFORMATION_CLASS;

THREAD_INFORMATION_CLASS is information class enumerated type for use with NtQueryInformationThread and NtSetInformationThread calls.

ThreadBasicInformation
QUERY mode only. Required result buffer length is 0x1C. Output buffer points to THREAD_BASIC_INFORMATION structure.

ThreadTimes
QUERY mode only. Required result buffer length is 0x20. Output buffer points to THREAD_TIMES_INFORMATION structure.

ThreadPriority
SET mode only. Required information buffer size is 0x04 bytes. Output buffer points to ULONG value.
(called from ADVAPI32.dll performance functions)

ThreadBasePriority
SET mode only. Required information buffer size is 0x04 bytes. Output buffer points to ULONG value.
(called from Kernel32.dll SetThreadPriority)

ThreadAffinityMask
SET mode only. Required information buffer size is 0x04 bytes. Output buffer points to ULONG value.
(called from Kernel32.dll SetThreadAffinityMask)

ThreadImpersonationToken
SET mode only. Required information buffer size is 0x04 bytes. Output buffer points to HANDLE value.

ThreadDescriptorTableEntry
QUERY mode only. Required result buffer length is 0x0C. Output buffer points to DESCRIPTOR_TABLE_ENTRY structure defined in <windbgkd.h> from Win2000 DDK.

ThreadEnableAlignmentFaultFixup
SET mode only. Required information buffer size is 0x01 bytes. Output buffer points to BOOLEAN value.

ThreadEventPair
SET mode only. Required information buffer size is 0x04 bytes. Output buffer points to HANDLE value to EventPair object.

ThreadQuerySetWin32StartAddress
QUERY and SET mode. Required buffer length is 0x04 bytes. Buffer points to PVOID value specifing address of thread start routine.

ThreadZeroTlsCell
SET mode only. Required information buffer size is 0x04 bytes. Output buffer points to ULONG value.
(TlsID. Called from Kernel32.dll TlsFree())

ThreadPerformanceCount
QUERY mode only. Required result buffer length is 0x08. Output buffer points to LARGE_INTEGER value.

ThreadAmILastThread
QUERY mode only. Required result buffer length is 0x04. Output buffer points to Win32 predefined BOOL value.

ThreadIdealProcessor
SET mode only. Required information buffer size is 0x04 bytes. Output buffer points to ULONG value.
(Called from Kernel32.dll SetThreadIdealProcessor())

ThreadPriorityBoost
QUERY and SET mode. Required buffer length is 0x04 bytes. Buffer points to BOOLEAN value.

ThreadSetTlsArrayAddress
SET mode only. Required information buffer size is 0x04 bytes. Output buffer points to PVOID value specifing ThreadLocalStorage array address.

ThreadIsIoPending
Not implemented - STATUS_INVALID_INFO_CLASS.

ThreadHideFromDebugger
Not implemented - STATUS_INVALID_INFO_CLASS.

Documented by:
Tomasz Nowak
Reactos

Requirements:
Library: ntdll.lib

See also:
NtQueryInformationThread
NtSetInformationThread
THREAD_BASIC_INFORMATION
THREAD_TIMES_INFORMATION


INITIAL_TEB

2OOO, 1O November

INITIAL_TEB
INITIAL_TEB

typedef struct _INITIAL_TEB {

  PVOID                StackBase;
  PVOID                StackLimit;
  PVOID                StackCommit;
  PVOID                StackCommitMax;
  PVOID                StackReserved;

} INITIAL_TEB, *PINITIAL_TEB;

StackBase

StackLimit

StackCommit

StackCommitMax

StackReserved

Documented by:
Reactos

Requirements:
Library: ntdll.lib

See also:
RtlInitializeContext


TEB

2OO1, 2 March

TEB
TEB

typedef struct _TEB {

  NT_TIB                  Tib;
  PVOID                   EnvironmentPointer;
  CLIENT_ID               Cid;
  PVOID                   ActiveRpcInfo;
  PVOID                   ThreadLocalStoragePointer;
  PPEB                    Peb;
  ULONG                   LastErrorValue;
  ULONG                   CountOfOwnedCriticalSections;
  PVOID                   CsrClientThread;
  PVOID                   Win32ThreadInfo;
  ULONG                   Win32ClientInfo[0x1F];
  PVOID                   WOW32Reserved;
  ULONG                   CurrentLocale;
  ULONG                   FpSoftwareStatusRegister;
  PVOID                   SystemReserved1[0x36];
  PVOID                   Spare1;
  ULONG                   ExceptionCode;
  ULONG                   SpareBytes1[0x28];
  PVOID                   SystemReserved2[0xA];
  ULONG                   GdiRgn;
  ULONG                   GdiPen;
  ULONG                   GdiBrush;
  CLIENT_ID               RealClientId;
  PVOID                   GdiCachedProcessHandle;
  ULONG                   GdiClientPID;
  ULONG                   GdiClientTID;
  PVOID                   GdiThreadLocaleInfo;
  PVOID                   UserReserved[5];
  PVOID                   GlDispatchTable[0x118];
  ULONG                   GlReserved1[0x1A];
  PVOID                   GlReserved2;
  PVOID                   GlSectionInfo;
  PVOID                   GlSection;
  PVOID                   GlTable;
  PVOID                   GlCurrentRC;
  PVOID                   GlContext;
  NTSTATUS                LastStatusValue;
  UNICODE_STRING          StaticUnicodeString;
  WCHAR                   StaticUnicodeBuffer[0x105];
  PVOID                   DeallocationStack;
  PVOID                   TlsSlots[0x40];
  LIST_ENTRY              TlsLinks;
  PVOID                   Vdm;
  PVOID                   ReservedForNtRpc;
  PVOID                   DbgSsReserved[0x2];
  ULONG                   HardErrorDisabled;
  PVOID                   Instrumentation[0x10];
  PVOID                   WinSockData;
  ULONG                   GdiBatchCount;
  ULONG                   Spare2;
  ULONG                   Spare3;
  ULONG                   Spare4;
  PVOID                   ReservedForOle;
  ULONG                   WaitingOnLoaderLock;
  PVOID                   StackCommit;
  PVOID                   StackCommitMax;
  PVOID                   StackReserved;

} TEB, *PTEB;

Structure TEB (Thread Environment Block) is memory block containing system variables placed in User-Mode memory. Every created thread have own TEB block. User can get address of TEB by call NtCurrentTeb function.

  • Tib
    • Structure NT_TIB is avaiable in <WinNT.h> header file.
  • EnvironmentPointer
  • Cid
  • ActiveRpcInfo
  • ThreadLocalStoragePointer
  • Peb
    • Pointer to PEB structure contains Process Environment Block.
  • LastErrorValue
  • CountOfOwnedCriticalSections
  • CsrClientThread
  • Win32ThreadInfo
  • Win32ClientInfo[0x1F]
  • WOW32Reserved
  • CurrentLocale
  • FpSoftwareStatusRegister
  • SystemReserved1[0x36]
  • Spare1
  • ExceptionCode
  • SpareBytes1[0x28]
  • SystemReserved2[0xA]
  • GdiRgn
  • GdiPen
  • GdiBrush
  • RealClientId
  • GdiCachedProcessHandle
  • GdiClientPID
  • GdiClientTID
  • GdiThreadLocaleInfo
  • UserReserved[5]
  • GlDispatchTable[0x118]
  • GlReserved1[0x1A]
  • GlReserved2
  • GlSectionInfo
  • GlSection
  • GlTable
  • GlCurrentRC
  • GlContext
  • LastStatusValue
  • StaticUnicodeString
  • StaticUnicodeBuffer[0x105]
  • DeallocationStack
  • TlsSlots[0x40]
  • TlsLinks
  • Vdm
  • ReservedForNtRpc
  • DbgSsReserved[0x2]
  • HardErrorDisabled
  • Instrumentation[0x10]
  • WinSockData
  • GdiBatchCount
  • Spare2
  • Spare3
  • Spare4
  • ReservedForOle
  • WaitingOnLoaderLock
  • StackCommit
  • StackCommitMax
  • StackReserved

    • Documented by:
    Reactos
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCurrentTeb
    PEB
    THREAD_BASIC_INFORMATION


THREAD_BASIC_INFORMATION

2OOO, 19 December

THREAD_BASIC_INFORMATION
THREAD_BASIC_INFORMATION

typedef struct _THREAD_BASIC_INFORMATION {

  NTSTATUS                ExitStatus;
  PVOID                   TebBaseAddress;
  CLIENT_ID               ClientId;
  KAFFINITY               AffinityMask;
  KPRIORITY               Priority;
  KPRIORITY               BasePriority;

} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;

  • ExitStatus
    • Thread exit status. If thread is not terminated, it has STATUS_PENDING value. See also Win32 API GetExitCodeThread.
  • TebBaseAddress
    • Address of TEB structure for specified thread. See also NtCurrentTeb.
  • ClientId
    • Unique process id and thread id.
  • AffinityMask
    • Thread affinity mask. There are no Win32 call GetThreadAffinityMask, but there's function SetThreadAffinityMask that's use AffinityMask value. See also ThreadAffinityMask information class.
  • Priority
    • I'm not sure...
  • BasePriority
    • Thread base priority. Used by Kernel32.dll in function GetThreadPriority. See also ThreadBasePriority information class.

    Structure is used with ThreadBasicInformation information class in NtQueryInformationThread call.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtQueryInformationThread
    THREAD_INFORMATION_CLASS


THREAD_TIMES_INFORMATION

2OOO, 19 December

THREAD_TIMES_INFORMATION
THREAD_TIMES_INFORMATION

typedef struct _THREAD_TIMES_INFORMATION {

  LARGE_INTEGER           CreationTime;
  LARGE_INTEGER           ExitTime;
  LARGE_INTEGER           KernelTime;
  LARGE_INTEGER           UserTime;

} THREAD_TIMES_INFORMATION, *PTHREAD_TIMES_INFORMATION;

CreationTime
Time of thread creation.

ExitTime
Time of thread termination.

KernelTime
Time that thread spent in KernelMode.

UserTime
Time that thread spent in UserMode.

Structure is used with ThreadTimes information class in NtQueryInformationThread call.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtQueryInformationThread
THREAD_INFORMATION_CLASS


NtCancelTimer

2OO1, 7 January

NtCancelTimer
NtCancelTimer

NTSYSAPI
NTSTATUS
NTAPI

NtCancelTimer(

  IN HANDLE               TimerHandle,
  OUT PBOOLEAN            CurrentState OPTIONAL );

  • TimerHandle
    • HANDLE to Timer Object opened with TIMER_MODIFY_STATE access.
  • CurrentState
    • Pointer to BOOLEAN value, that received state of timer before function call.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtOpenTimer
    NtQueryTimer
    NtSetTimer


NtCreateTimer

2OO1, 7 January

NtCreateTimer
NtCreateTimer

NTSYSAPI
NTSTATUS
NTAPI

NtCreateTimer(

  OUT PHANDLE             TimerHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
  IN TIMER_TYPE           TimerType );

  • TimerHandle
    • Result of call - HANDLE to Timer Object.
  • DesiredAccess
    • Access mask for TimerHandle. Can be set of (from <WinNT.h>):
    • TIMER_QUERY_STATE
    • TIMER_MODIFY_STATE
    • TIMER_ALL_ACCESS
  • ObjectAttributes
    • Optional name of Timer Object.
  • TimerType
    • Can be NotificationTimer or SynchronizationTimer (enumerated type definition from <ntdef.h>). See also EVENT_TYPE.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    EVENT_TYPE
    NtOpenTimer


NtOpenTimer

2OO1, 7 January

NtOpenTimer
NtOpenTimer

NTSYSAPI
NTSTATUS
NTAPI

NtOpenTimer(

  OUT PHANDLE             TimerHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes );

  • TimerHandle
    • Result of call - HANDLE to Timer Object.
  • DesiredAccess
    • Access mask for TimerHandle. See NtCreateTimer for possible values.
  • ObjectAttributes
    • Name of Timer Object.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateTimer


NtQueryTimer

2OO1, 7 January

NtQueryTimer
NtQueryTimer

NTSYSAPI
NTSTATUS
NTAPI

NtQueryTimer(

  IN HANDLE               TimerHandle,
  IN TIMER_INFORMATION_CLASS TimerInformationClass,
  OUT PVOID               TimerInformation,
  IN ULONG                TimerInformationLength,
  OUT PULONG              ReturnLength OPTIONAL );

  • TimerHandle
    • HANDLE to Timer Object opened with TIMER_QUERY_STATE access.
  • TimerInformationClass
    • Information class. See TIMER_INFORMATION_CLASS for details.
  • TimerInformation
    • User's allocated buffer for result data.
  • TimerInformationLength
    • Length of TimerInformation buffer, in bytes.
  • ReturnLength
    • Optional pointer to value received used/required length of TimerInformation buffer.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateTimer
    NtOpenTimer
    TIMER_INFORMATION_CLASS


NtSetTimer

2OO1, 7 January

NtSetTimer
NtSetTimer

NTSYSAPI
NTSTATUS
NTAPI

NtSetTimer(

  IN HANDLE               TimerHandle,
  IN PLARGE_INTEGER       DueTime,
  IN PTIMER_APC_ROUTINE   TimerApcRoutine OPTIONAL,
  IN PVOID                TimerContext OPTIONAL,
  IN BOOLEAN              ResumeTimer,
  IN LONG                 Period OPTIONAL,
  OUT PBOOLEAN            PreviousState OPTIONAL );

  • TimerHandle
    • HANDLE to Timer Object opened with TIMER_MODIFY_STATE access.
  • DueTime
    • Time when timer should be set, in 100ns units. If it is negative value, it means relative time.
  • TimerApcRoutine
    • User's APC routine, defined as follows:
        typedef void (*PTIMER_APC_ROUTINE)(
            IN PVOID TimerContext,
            IN ULONG TimerLowValue,
            IN LONG TimerHighValue
            );
  • TimerContext
    • Optional parameter to TimerApcRoutine.
  • ResumeTimer
    • If set, Power Management restores system to normal mode when timer is signaled.
  • Period
    • If zero, timer is set only once. Else will be set periodic in time intervals defined in Period value (in 100ms units).
  • PreviousState
    • Optional pointer to value receiving state of Timer Object before NtSetTimer call.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCancelTimer
    NtCreateTimer
    NtOpenTimer
    NtQueryTimer


TIMER_INFORMATION_CLASS

2OO1, 7 January

TIMER_INFORMATION_CLASS
TIMER_INFORMATION_CLASS

typedef enum _TIMER_INFORMATION_CLASS {

    TimerBasicInformation

} TIMER_INFORMATION_CLASS, *PTIMER_INFORMATION_CLASS;

Currently only one information class is avaiable for Timer Object.
  • TimerBasicInformation
    • Information buffer is     TIMER_BASIC_INFORMATION structure.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtQueryTimer
    TIMER_BASIC_INFORMATION


TIMER_BASIC_INFORMATION

2OO1, 7 January

TIMER_BASIC_INFORMATION
TIMER_BASIC_INFORMATION

typedef struct _TIMER_BASIC_INFORMATION {

  LARGE_INTEGER           RemainingTime;
  BOOLEAN                 TimerState;

} TIMER_BASIC_INFORMATION, *PTIMER_BASIC_INFORMATION;

  • RemainingTime
    • Contains time (in 100ns units) to next timer signal (negative value), or time after last signalization.
  • TimerState
    • If TRUE, timer is signaled.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtQueryTimer
    TIMER_INFORMATION_CLASS


NtAdjustGroupsToken

2OO1, 17 February

NtAdjustGroupsToken
NtAdjustGroupsToken

NTSYSAPI
NTSTATUS
NTAPI

NtAdjustGroupsToken(

  IN HANDLE               TokenHandle,
  IN BOOLEAN              ResetToDefault,
  IN PTOKEN_GROUPS        TokenGroups,
  IN ULONG                PreviousGroupsLength,
  OUT PTOKEN_GROUPS       PreviousGroups OPTIONAL,
  OUT PULONG              RequiredLength OPTIONAL );

Function NtAdjustGroupsToken modify state of one or more groups avaialbe for Token Object. See also description of similar Win32 API AdjustTokenGroups in Win32 SDK.

  • TokenHandle
    • HANDLE to Token Object opened with TOKEN_ADJUST_GROUPS access.
  • ResetToDefault
    • If set, groups are reset to token's defaults. In this case all other parameters are ignored.
  • TokenGroups
    • Pointer to TOKEN_GROUPS structure containing groups to modify.
  • PreviousGroupsLength
    • Specifies length of PreviousGroups buffer, in bytes.
  • PreviousGroups
    • Optionally pointer to TOKEN_GROUPS buffer receiving information about modified groups before modification begins.
  • RequiredLength
    • If PreviousGroups parameter is specified, and PreviousGroupsLength is to small, this value receives required length of buffer, in bytes.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtAdjustPrivilegesToken
    NtCreateToken
    NtOpenProcessToken
    NtOpenThreadToken
    NtQueryInformationToken
    NtSetInformationToken
    TOKEN_GROUPS


NtAdjustPrivilegesToken

2OO1, 9 February

NtAdjustPrivilegesToken
NtAdjustPrivilegesToken

NTSYSAPI
NTSTATUS
NTAPI

NtAdjustPrivilegesToken(

  IN HANDLE               TokenHandle,
  IN BOOLEAN              DisableAllPrivileges,
  IN PTOKEN_PRIVILEGES    TokenPrivileges,
  IN ULONG                PreviousPrivilegesLength,
  OUT PTOKEN_PRIVILEGES   PreviousPrivileges OPTIONAL,
  OUT PULONG              RequiredLength OPTIONAL );

Function NtAdjustPrivilegesToken is used to modify state of avaiable token's privileges, and it's descripted also in Microsoft SDK help as AdjustTokenPrivileges.

  • TokenHandle
    • HANDLE to Token Object opened with TOKEN_ADJUST_PRIVILEGES access. If PreviousPrivileges parameter is non-NULL, also TOKEN_QUERY access is required.
  • DisableAllPrivileges
    • If set, all accessable privileges are disabled, and rest of parameters below are ignored.
  • TokenPrivileges
    • Pointer to TOKEN_PRIVILEGES structure containing array of privileges to adjust.
  • PreviousPrivilegesLength
    • Length of PreviousPrivileges buffer, in bytes.
  • PreviousPrivileges
    • Optionally pointer to TOKEN_PRIVILEGES structure filled by function with previous state of privileges specified by TokenPrivileges array.
  • RequiredLength
    • If PreviousPrivileges buffer was to small, this parameter point to required size.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtAdjustGroupsToken
    NtCreateToken
    NtOpenProcessToken
    NtOpenThreadToken
    NtPrivilegeCheck
    NtQueryInformationToken
    TOKEN_PRIVILEGES


NtCreateToken

2OO1, 1 March

NtCreateToken
NtCreateToken

NTSYSAPI
NTSTATUS
NTAPI

NtCreateToken(

  OUT PHANDLE             TokenHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes,
  IN TOKEN_TYPE           TokenType,
  IN PLUID                AuthenticationId,
  IN PLARGE_INTEGER       ExpirationTime,
  IN PTOKEN_USER          TokenUser,
  IN PTOKEN_GROUPS        TokenGroups,
  IN PTOKEN_PRIVILEGES    TokenPrivileges,
  IN PTOKEN_OWNER         TokenOwner,
  IN PTOKEN_PRIMARY_GROUP TokenPrimaryGroup,
  IN PTOKEN_DEFAULT_DACL  TokenDefaultDacl,
  IN PTOKEN_SOURCE        TokenSource );

Function NtCreateToken creates Token Object.

  • TokenHandle
    • Result of call - pointer to HANDLE to Token Object.
  • DesiredAccess
    • Can be one or more of following:
    • TOKEN_ASSIGN_PRIMARY
    • TOKEN_DUPLICATE
    • TOKEN_IMPERSONATE
    • TOKEN_QUERY
    • TOKEN_QUERY_SOURCE
    • TOKEN_ADJUST_PRIVILEGES
    • TOKEN_ADJUST_GROUPS
    • TOKEN_ADJUST_DEFAULT
    • TOKEN_ADJUST_SESSIONID
    • TOKEN_ALL_ACCESS
  • ObjectAttributes
    • Pointer to OBJECT_ATTRIBUTES structure.
  • TokenType
    • (?), see TOKEN_TYPE enumeration type.
  • AuthenticationId
    • (?), see NtAllocateLocallyUniqueId security function.
  • ExpirationTime
    • (?), pointer to LARGE_INTEGER value contains time in 100-ns format.
  • TokenUser
    • (?), see TOKEN_USER structure.
  • TokenGroups
    • (?), see TOKEN_GROUPS structure.
  • TokenPrivileges
    • (?), see TOKEN_PRIVILEGES structure.
  • TokenOwner
    • (?), see TOKEN_OWNER structure.
  • TokenPrimaryGroup
    • (?), see TOKEN_PRIMARY_GROUP structure.
  • TokenDefaultDacl
    • (?), see TOKEN_DEFAULT_DACL structure.
  • TokenSource
    • (?), see TOKEN_SOURCE structure.

    Documented by:
    Reactos

    Requirements:
    Library: ntdll.lib
    Privilege: SE_CREATE_TOKEN_PRIVILEGE

    See also:
    NtAllocateLocallyUniqueId
    NtDuplicateToken
    NtOpenProcessToken
    NtOpenThreadToken
    NtQueryInformationToken
    NtSetInformationToken


NtDuplicateToken

2OO1, 15 February

NtDuplicateToken
NtDuplicateToken

NTSYSAPI
NTSTATUS
NTAPI

NtDuplicateToken(

  IN HANDLE               ExistingToken,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES   ObjectAttributes OPTIONAL,
  IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
  IN TOKEN_TYPE           TokenType,
  OUT PHANDLE             NewToken );

Function NtDuplicateToken creates new Token Object basing on existing Token Object.

  • ExistingToken
    • HANDLE to Token Object opened with TOKEN_DUPLICATE access.
  • DesiredAccess
    • Access mask for newly created token. Can be combination of:
    • TOKEN_ASSIGN_PRIMARY
    • TOKEN_DUPLICATE
    • TOKEN_IMPERSONATE
    • TOKEN_QUERY
    • TOKEN_QUERY_SOURCE
    • TOKEN_ADJUST_PRIVILEGES
    • TOKEN_ADJUST_GROUPS
    • TOKEN_ADJUST_DEFAULT
    • TOKEN_ADJUST_SESSIONID
  • ObjectAttributes
    • Optionally pointer to OBJECT_ATTRIBUTES structure, containing token's name.
  • ImpersonationLevel
    • Level of impersonation for new token.
  • TokenType
    • Type of new token.
  • NewToken
    • Result of call - pointer to HANDLE to new Token Object.

    Documented by:
    Tomasz Nowak
    Reactos

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateToken
    NtOpenProcessToken
    NtOpenThreadToken
    NtQueryInformationToken
    NtSetInformationToken


NtOpenProcessToken

2OO1, 28 January

NtOpenProcessToken
NtOpenProcessToken

NTSYSAPI
NTSTATUS
NTAPI

NtOpenProcessToken(

  IN HANDLE               ProcessHandle,
  IN ACCESS_MASK          DesiredAccess,
  OUT PHANDLE             TokenHandle );

  • ProcessHandle
    • HANDLE to Process Object.
  • DesiredAccess
    • Access mask for opened Token Object.
  • TokenHandle
    • Result of call - HANDLE to Token Object associated with process specified by ProcessHandle parameter.

    See also PROCESS_INFORMATION_CLASS with ProcessAccessToken information class.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateToken
    NtOpenThreadToken
    NtQueryInformationProcess
    NtSetInformationProcess
    PROCESS_INFORMATION_CLASS


NtOpenThreadToken

2OOO, 31 December

NtOpenThreadToken
NtOpenThreadToken

NTSYSAPI
NTSTATUS
NTAPI

NtOpenThreadToken(

  IN HANDLE               ThreadHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN BOOLEAN              OpenAsSelf,
  OUT PHANDLE             TokenHandle );

  • ThreadHandle
    • HANDLE to thread object.
  • DesiredAccess
    • Access mask for opened Token Object.
  • OpenAsSelf
    • - ???
  • TokenHandle
    • Result of call - HANDLE to Token Object associated with ThreadHandle thread.

    Usually Win32 threads don't have associated Tokens. If you want to associate Token for Thread Object, use NtSetInformationThread with ThreadImpersonationToken information class.

    Documented by:
    Tomasz Nowak
    Reactos

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateToken
    NtOpenProcessToken
    NtOpenThread
    NtSetInformationThread
    THREAD_INFORMATION_CLASS


NtQueryInformationToken

2OO1, 15 February

NtQueryInformationToken
NtQueryInformationToken

NTSYSAPI
NTSTATUS
NTAPI

NtQueryInformationToken(

  IN HANDLE               TokenHandle,
  IN TOKEN_INFORMATION_CLASS TokenInformationClass,
  OUT PVOID               TokenInformation,
  IN ULONG                TokenInformationLength,
  OUT PULONG              ReturnLength );

Function NtQueryInformationToken receives informations specified by information class from Token Object. See also Win32 API GetTokenInformation.

  • TokenHandle
    • HANDLE to Token Object opened with TOKEN_QUERY access.
  • TokenInformationClass
    • Information class descripted in TOKEN_INFORMATION_CLASS topic.
  • TokenInformation
    • User's allocated buffer for output data. Format of output buffer depends on TokenInformationClass parameter.
  • TokenInformationLength
    • Length of TokenInformation buffer, in bytes.
  • ReturnLength
    • If output buffer is to small, value under this parameter receives required length.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateToken
    NtOpenProcessToken
    NtOpenThreadToken
    NtSetInformationToken
    TOKEN_INFORMATION_CLASS


NtSetInformationToken

2OO1, 15 February

NtSetInformationToken
NtSetInformationToken

NTSYSAPI
NTSTATUS
NTAPI

NtSetInformationToken(

  IN HANDLE               TokenHandle,
  IN TOKEN_INFORMATION_CLASS TokenInformationClass,
  OUT PVOID               TokenInformation,
  IN ULONG                TokenInformationLength );

Function NtSetInforamtionToken sets parameters of Token Objects. See also description of SetTokenInformation in Win32 API SDK.

  • TokenHandle
    • HANDLE to Token Object opened with TOKEN_ADJUST_DEFAULT access.
  • TokenInformationClass
    • Information class descripted in TOKEN_INFORMATION_CLASS topic.
  • TokenInformation
    • User's allocated buffer containing data to set to.
  • TokenInformationLength
    • Length of TokenInformation buffer, in bytes.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreateToken
    NtOpenProcessToken
    NtOpenThreadToken
    NtQueryInformationToken
    TOKEN_INFORMATION_CLASS


NtAccessCheckAndAuditAlarm

2OO1, 27 February

NtAccessCheckAndAuditAlarm
NtAccessCheckAndAuditAlarm

NTSYSAPI
NTSTATUS
NTAPI

NtAccessCheckAndAuditAlarm(

  IN PUNICODE_STRING      SubsystemName OPTIONAL,
  IN HANDLE               ObjectHandle OPTIONAL,
  IN PUNICODE_STRING      ObjectTypeName OPTIONAL,
  IN PUNICODE_STRING      ObjectName OPTIONAL,
  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
  IN ACCESS_MASK          DesiredAccess,
  IN PGENERIC_MAPPING     GenericMapping,
  IN BOOLEAN              ObjectCreation,
  OUT PULONG              GrantedAccess,
  OUT PULONG              AccessStatus,
  OUT PBOOLEAN            GenerateOnClose );

Function NtAccessCheckAndAuditAlarm doesn't work properly on NT40-SP6. For more information about alarms see description of similar function AccessCheckAndAuditAlarm in Microsoft SDK.

  • SubsystemName
    • - ???
  • ObjectHandle
    • Can be any valid HANDLE to object, or NULL.
  • ObjectTypeName
    • - ???
  • ObjectName
    • - ???
  • SecurityDescriptor
    • Pointer to "Absolute" SECURITY_DESCRIPTOR structure.
  • DesiredAccess
    • - ???
  • GenericMapping
    • Pointer to GENERIC_MAPPING structure valid for object specified above as ObjectHandle parameter.
  • ObjectCreation
    • - ???
  • GrantedAccess
    • Pointer to ACCESS_MASK value (?).
  • AccessStatus
    • Pointer to NTSTATUS value (?).
  • GenerateOnClose
    • Pointer to BOOLEAN value (?).

    Function can be called only from impersonated thread. (See NtImpersonateThread for more information).

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib
    Privilege: SE_AUDIT_PRIVILEGE

    See also:
    NtAccessCheck
    NtCloseObjectAuditAlarm
    NtDeleteObjectAuditAlarm
    NtImpersonateThread
    NtOpenObjectAuditAlarm
    SECURITY_DESCRIPTOR


NtCloseObjectAuditAlarm

2OO1, 27 February

NtCloseObjectAuditAlarm
NtCloseObjectAuditAlarm

NTSYSAPI
NTSTATUS
NTAPI

NtCloseObjectAuditAlarm(

  IN PUNICODE_STRING      SubsystemName,
  IN HANDLE               ObjectHandle OPTIONAL,
  IN BOOLEAN              GenerateOnClose );

Function NtCloseObjectAuditAlarm sends alarm to Event Log, section Security. Alarm informs about close user's created object.

  • SubsystemName
    • This string is sent to Event Log as the first parameter.
  • ObjectHandle
    • HANDLE to object, or NULL value.
  • GenerateOnClose
    • If set, event is generated.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib
    Privilege: SE_AUDIT_PRIVILEGE

    See also:
    NtAccessCheckAndAuditAlarm
    NtDeleteObjectAuditAlarm
    NtOpenObjectAuditAlarm


NtDeleteObjectAuditAlarm

2OO1, 27 February

NtDeleteObjectAuditAlarm
NtDeleteObjectAuditAlarm

NTSYSAPI
NTSTATUS
NTAPI

NtDeleteObjectAuditAlarm(

  IN PUNICODE_STRING      SubsystemName,
  IN HANDLE               ObjectHandle OPTIONAL,
  IN BOOLEAN              GenerateOnClose );

Function NtDeleteObjectAuditAlarm generates Security Audit Alarm, stored in Event Log. See also description of NtCloseObjectAuditAlarm.

  • SubsystemName
    • This string is passed as a parameter to event message.
  • ObjectHandle
    • HANDLE to any object.
  • GenerateOnClose
    • If set, event is generated.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib
    Privilege: SE_AUDIT_PRIVILEGE

    See also:
    NtCloseObjectAuditAlarm
    NtOpenObjectAuditAlarm


NtOpenObjectAuditAlarm

2OO1, 27 February

NtOpenObjectAuditAlarm
NtOpenObjectAuditAlarm

NTSYSAPI
NTSTATUS
NTAPI

NtOpenObjectAuditAlarm(

  IN PUNICODE_STRING      SubsystemName OPTIONAL,
  IN PHANDLE              ObjectHandle OPTIONAL,
  IN PUNICODE_STRING      ObjectTypeName OPTIONAL,
  IN PUNICODE_STRING      ObjectName OPTIONAL,
  IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL,
  IN HANDLE               ClientToken,
  IN ACCESS_MASK          DesiredAccess,
  IN ACCESS_MASK          GrantedAccess,
  IN PPRIVILEGE_SET       Privileges OPTIONAL,
  IN BOOLEAN              ObjectCreation,
  IN BOOLEAN              AccessGranted,
  OUT PBOOLEAN            GenerateOnClose OPTIONAL );

Function NtOpenObjectAuditAlarm does not work on NT40-SP6. For additional information see description of ObjectOpenAuditAlarm function in Microsoft SDK.

  • SubsystemName
    • - ???
  • ObjectHandle
    • Can be any valid HANDLE to object, or NULL.
  • ObjectTypeName
    • - ???
  • ObjectName
    • - ???
  • SecurityDescriptor
    • Pointer to SECURITY_DESCRIPTOR structure, or NULL.
  • ClientToken
    • HANDLE to Token Object previously opened with TOKEN_QUERY access.
  • DesiredAccess
    • - ???
  • GrantedAccess
    • - ???
  • Privileges
    • Optionally pointer to PRIVILEGE_SET structure filled by user with valid privileges.
  • ObjectCreation
    • - ???
  • AccessGranted
    • = ???
  • GenerateOnClose
    • Optionally pointer to BOOLEAN value.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib
    Privilege: SE_AUDIT_PRIVILEGE

    See also:
    NtAccessCheckAndAuditAlarm
    NtCloseObjectAuditAlarm
    NtDeleteObjectAuditAlarm
    PRIVILEGE_SET
    SECURITY_DESCRIPTOR


NtPrivilegeObjectAuditAlarm

2OO1, 27 February

NtPrivilegeObjectAuditAlarm
NtPrivilegeObjectAuditAlarm

NTSYSAPI
NTSTATUS
NTAPI

NtPrivilegeObjectAuditAlarm(

  IN PUNICODE_STRING      SubsystemName OPTIONAL,
  IN HANDLE               ObjectHandle OPTIONAL,
  IN HANDLE               ClientToken,
  IN ULONG                DesiredAccess,
  IN PPRIVILEGE_SET       ClientPrivileges,
  IN BOOLEAN              AccessGranted );

Function NtPrivilegeObjectAuditAlarm doesn't work, as the most of other auditing functions...

  • SubsystemName
    • - ???
  • ObjectHandle
    • This can be any value.
  • ClientToken
    • HANDLE to Token Object opened with TOKEN_QUERY access.
  • DesiredAccess
    • - ???
  • ClientPrivileges
    • Pointer to PRIVILEGE_SET structure filled with valid data.
  • AccessGranted
    • - ???

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib
    Privilege: SE_AUDIT_PRIVILEGE

    See also:
    NtAccessCheckAndAuditAlarm
    NtOpenObjectAuditAlarm
    NtPrivilegedServiceAuditAlarm
    PRIVILEGE_SET


NtPrivilegedServiceAuditAlarm

2OO1, 27 February

NtPrivilegedServiceAuditAlarm
NtPrivilegedServiceAuditAlarm

NTSYSAPI
NTSTATUS
NTAPI

NtPrivilegedServiceAuditAlarm(

  IN PUNICODE_STRING      SubsystemName OPTIONAL,
  IN PUNICODE_STRING      ServiceName OPTIONAL,
  IN HANDLE               ClientToken,
  IN PPRIVILEGE_SET       ClientPrivileges,
  IN BOOLEAN              AccessGranted );

Function NtPrivilegedServiceAuditAlarm doesn't work on NT40-SP6. For more information see description of PrivilegedServiceAuditAlarm in Microsoft SDK.

  • SubsystemName
    • - ???
  • ServiceName
    • - ???
  • ClientToken
    • HANDLE to Token Object opened with TOKEN_QUERY access.
  • ClientPrivileges
    • Pointer to PRIVILEGE_SET structure contains valid data.
  • AccessGranted
    • - ???

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib
    Privilege: SE_AUDIT_PRIVILEGE

    See also:
    NtOpenObjectAuditAlarm
    NtPrivilegeObjectAuditAlarm
    PRIVILEGE_SET


NtAccessCheck

2OO1, 5 March

NtAccessCheck
NtAccessCheck

NTSYSAPI
NTSTATUS
NTAPI

NtAccessCheck(

  IN PSECURITY_DESCRIPTOR SecurityDescriptor,
  IN HANDLE               ClientToken,
  IN ACCESS_MASK          DesiredAccess,
  IN PGENERIC_MAPPING     GenericMapping OPTIONAL,
  OUT PPRIVILEGE_SET      RequiredPrivilegesBuffer,
  IN OUT PULONG           BufferLength,
  OUT PACCESS_MASK        GrantedAccess,
  OUT PNTSTATUS           AccessStatus );

Function NtAccessCheck should be used by server applications working in SYSTEM context for check access to object for connected client's token. See similar Win32 API AccessCheck in Microsoft SDK.

  • SecurityDescriptor
    • Pointer to SECURITY_DESCRIPTOR structure.
  • ClientToken
    • HANDLE to client's Token Object opened with TOKEN_QUERY access.
  • DesiredAccess
    • ACCESS_MASK required by client.
  • GenericMapping
    • Pointer to GENERIC_MAPPING structure. Caller can take it in a call to NtQueryObject.
  • RequiredPrivilegesBuffer
    • Function fills this buffer with structure PRIVILEGE_SET contains required privileges.
  • BufferLength
    • Pointer to ULONG value. On input this value means size of RequiredPrivilegesBuffer buffer. If buffer was to small, required buffer size is avaiable on output.
  • GrantedAccess
    • Pointer to ACCESS_MASK value receiving granted access for object.
  • AccessStatus
    • Result of access check, in typical NTSTATUS format.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtImpersonateClientOfPort
    NtImpersonateThread
    NtOpenProcessToken
    NtOpenThreadToken
    NtPrivilegeCheck
    NtQueryObject
    NtQuerySecurityObject


NtAllocateLocallyUniqueId

2OO1, 9 February

NtAllocateLocallyUniqueId
NtAllocateLocallyUniqueId

NTSYSAPI
NTSTATUS
NTAPI

NtAllocateLocallyUniqueId(

  OUT PLUID               LocallyUniqueId );

Function allocates LUID (Locally Unique Identifier) for future use.

  • LocallyUniqueId
    • Pointer to LUID structure receiving new locally unique identifier.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtAllocateUuids
    NtCreateToken


NtAllocateUuids

2OO1, 17 February

NtAllocateUuids
NtAllocateUuids

NTSYSAPI
NTSTATUS
NTAPI

NtAllocateUuids(

  OUT PLARGE_INTEGER      Time,
  OUT PULONG              Range,
  OUT PULONG              Sequence );

Function NtAllocateUuids allocates User Unique Identifier's base values. UUIDs are used to build unique SIDs.

  • Time
    • Returns current time.
  • Range
    • Returns allocation range. (???)
  • Sequence
    • Returns allocation sequence. (???)

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtAllocateLocallyUniqueId


NtPrivilegeCheck

2OO1, 9 February

NtPrivilegeCheck
NtPrivilegeCheck

NTSYSAPI
NTSTATUS
NTAPI

NtPrivilegeCheck(

  IN HANDLE               TokenHandle,
  IN PPRIVILEGE_SET       RequiredPrivileges,
  IN PBOOLEAN             Result );

Function NtPrivilegeCheck is used to check state of any privileges in Token Object. It's also descripted in Microsoft SDK as PrivilegeCheck.

  • TokenHandle
    • HANDLE to Token Object opened with TOKEN_QUERY access.
  • RequiredPrivileges
    • Pointer to PRIVILEGE_SET structure contains definitions of privileges to check.
  • Result
    • Result of call - pointer to BOOLEAN value containing TRUE is all asked privileges are enabled.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtAdjustPrivilegesToken
    NtCreateToken
    NtOpenProcessToken
    NtOpenThreadToken
    PRIVILEGE_SET


NtQuerySecurityObject

2OOO, 17 October

NtQuerySecurityObject
NtQuerySecurityObject

NTSYSAPI
NTSTATUS
NTAPI

NtQuerySecurityObject(

  IN HANDLE               ObjectHandle,
  IN SECURITY_INFORMATION SecurityInformationClass,
  OUT PSECURITY_DESCRIPTOR DescriptorBuffer,
  IN ULONG                DescriptorBufferLength,
  OUT PULONG              RequiredLength );

Function NtQuerySecurityObject retrieve object's Security Descriptor.

  • ObjectHandle
    • HANDLE to any object opened with READ_CONTROL access.
  • SecurityInformationClass
    • Can be combination of:
    • OWNER_SECURITY_INFORMATION
    • GROUP_SECURITY_INFORMATION
    • DACL_SECURITY_INFORMATION
    • SACL_SECURITY_INFORMATION
  • DescriptorBuffer
    • Result of call - pointer to SECURITY_DESCRIPTOR structure.
  • DescriptorBufferLength
    • Size of buffer, in bytes.
  • RequiredLength
    • Pointer to value receiving required length of buffer.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtSetSecurityObject
    SECURITY_DESCRIPTOR


NtSetSecurityObject

2OOO, 17 October

NtSetSecurityObject
NtSetSecurityObject

NTSYSAPI
NTSTATUS
NTAPI

NtSetSecurityObject(

  IN HANDLE               ObjectHandle,
  IN SECURITY_INFORMATION SecurityInformationClass,
  IN PSECURITY_DESCRIPTOR DescriptorBuffer );

Function NtSetSecurityDescriptor writes object's Security Descriptor.

  • ObjectHandle
    • HANDLE to object of any type. Must be opened with WRITE_DAC or WRITE_OWNER access dependly to SecurityInformationClass parameter.
  • SecurityInformationClass
    • See NtQuerySecurityObject for possible values.
  • DescriptorBuffer
    • Pointer to user's allocated SECURITY_DESCRIPTOR to set.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtQuerySecurityObject
    SECURITY_DESCRIPTOR


NtQuerySystemInformation

2OOO, 24 December

NtQuerySystemInformation
NtQuerySystemInformation

NTSYSAPI
NTSTATUS
NTAPI

NtQuerySystemInformation(

  IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
  OUT PVOID               SystemInformation,
  IN ULONG                SystemInformationLength,
  OUT PULONG              ReturnLength OPTIONAL );

NtQuerySystemInformation is used to check some system informations avaiable only in KernelMode (above 0x80000000). All avaiable (or all known) information classes are described in SYSTEM_INFORMATION_CLASS.

  • SystemInformationClass
    • Information class (see SYSTEM_INFORMATION_CLASS).
  • SystemInformation
    • User-allocated buffer for results. Sometimes this parameter can be NULL (OPTIONAL), if you check required buffer size (see below).
  • SystemInformationLength
    • Length of SystemInformation buffer (in bytes).
  • ReturnLength
    • Required length of SystemInformation buffer.

    Documented by:
    Sven B. Schreiber
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtSetSystemInformation
    SYSTEM_INFORMATION_CLASS


NtSetSystemInformation

2OOO, 24 December

NtSetSystemInformation
NtSetSystemInformation

NTSYSAPI
NTSTATUS
NTAPI

NtSetSystemInformation(

  IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
  IN PVOID                SystemInformation,
  IN ULONG                SystemInformationLength );

NtSetSystemInformation is used to set some unaccessable KernelMode variables. See also NtQuerySystemInformation.

  • SystemInformationClass
    • Information class described in SYSTEM_INFORMATION_CLASS.
  • SystemInformation
    • Pointer to data buffer to set.
  • SystemInformationLength
    • Length of information in SystemInformation buffer, in bytes.

    Documented by:
    Sven B. Schreiber
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtQuerySystemInformation
    SYSTEM_INFORMATION_CLASS


SYSTEM_INFORMATION_CLASS

2OO1, 5 March

SYSTEM_INFORMATION_CLASS
SYSTEM_INFORMATION_CLASS

typedef enum _SYSTEM_INFORMATION_CLASS {

    SystemBasicInformation,
    SystemProcessorInformation,
    SystemPerformanceInformation,
    SystemTimeOfDayInformation,
    SystemPathInformation,
    SystemProcessInformation,
    SystemCallCountInformation,
    SystemDeviceInformation,
    SystemProcessorPerformanceInformation,
    SystemFlagsInformation,
    SystemCallTimeInformation,
    SystemModuleInformation,
    SystemLocksInformation,
    SystemStackTraceInformation,
    SystemPagedPoolInformation,
    SystemNonPagedPoolInformation,
    SystemHandleInformation,
    SystemObjectInformation,
    SystemPageFileInformation,
    SystemVdmInstemulInformation,
    SystemVdmBopInformation,
    SystemFileCacheInformation,
    SystemPoolTagInformation,
    SystemInterruptInformation,
    SystemDpcBehaviorInformation,
    SystemFullMemoryInformation,
    SystemLoadGdiDriverInformation,
    SystemUnloadGdiDriverInformation,
    SystemTimeAdjustmentInformation,
    SystemSummaryMemoryInformation,
    SystemNextEventIdInformation,
    SystemEventIdsInformation,
    SystemCrashDumpInformation,
    SystemExceptionInformation,
    SystemCrashDumpStateInformation,
    SystemKernelDebuggerInformation,
    SystemContextSwitchInformation,
    SystemRegistryQuotaInformation,
    SystemExtendServiceTableInformation,
    SystemPrioritySeperation,
    SystemPlugPlayBusInformation,
    SystemDockInformation,
    SystemPowerInformation,
    SystemProcessorSpeedInformation,
    SystemCurrentTimeZoneInformation,
    SystemLookasideInformation

} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;

Enumeration type SYSTEM_INFORMATION_CLASS defines information classes for a lot of system settings. This type is used with function NtQuerySystemInformation and NtSetSystemInformation. For detailed informations see descriptions of structures associated with information classes below.

  • SystemBasicInformation
    • Action | : Query
Buffer size | : 0x02C
Structure | : SYSTEM_BASIC_INFORMATION
  • SystemProcessorInformation
    • Action | : Query
Buffer size | : 0x00C
Structure | : SYSTEM_PROCESSOR_INFORMATION
  • SystemPerformanceInformation
    • 0x138 GET
  • SystemTimeOfDayInformation
    • 0x020 GET
  • SystemPathInformation
    • Action | : Query
Buffer size | : ???
Structure | : STATUS_NOT_IMPLEMENTED

    System path is avaiable via structure KUSER_SHARED_DATA
  • SystemProcessInformation
    • Action
            : Query
    Buffer size
            : 0x088+
    Structure
            : SYSTEM_PROCESS_INFORMATION
  • SystemCallCountInformation
    • Action
            : Query
    Buffer size
            : 0x018+
    Structure
            : SYSTEM_CALL_COUNT_INFORMATION
  • SystemDeviceInformation
    • 0x018 GET SystemConfigurationInformation
  • SystemProcessorPerformanceInformation
    • Action
            : Query
    Buffer size
            : 0x030
    Structure
            : SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
  • SystemFlagsInformation
    • 0x004 GET SET
  • SystemCallTimeInformation
    • NOT_IMPLEMENTED
  • SystemModuleInformation
    • Action
            : Query
    Buffer size
            : 0x106+
    Structure
            : SYSTEM_MODULE_INFORMATION
  • SystemLocksInformation
    • 0x028+ GET
  • SystemStackTraceInformation
    • 0x05C GET
  • SystemPagedPoolInformation
    • 0x01C GET checked build only
  • SystemNonPagedPoolInformation
    • 0x01C GET checked build only
  • SystemHandleInformation
    • Action
            : Query
    Buffer size
            : 0x014+
    Structure
            : SYSTEM_HANDLE_INFORMATION
  • SystemObjectInformation
    • Action
            : Query
    Buffer size
            : 0x038+
    Structure
            : SYSTEM_OBJECT_INFORMATION
  • SystemPageFileInformation
    • Action
            : Query
    Buffer size
            : 0x018+
    Structure
            : SYSTEM_PAGEFILE_INFORMATION
  • SystemVdmInstemulInformation
    • 0x088 GET
  • SystemVdmBopInformation
    • INVALID_INFO_CLASS
  • SystemFileCacheInformation
    • 0x00C, 0x024 GET SET
  • SystemPoolTagInformation
    • 0x020+ GET
  • SystemInterruptInformation
    • 0x018 GET
  • SystemDpcBehaviorInformation
    • 0x014 GET SET
  • SystemFullMemoryInformation
    • 0x014 GET checked build only
  • SystemLoadGdiDriverInformation
    • 0x018 SET
  • SystemUnloadGdiDriverInformation
    • 0x004 SET
  • SystemTimeAdjustmentInformation
    • Action
            : Query
    Buffer size
            : 0x00C
    Structure
            : SYSTEM_QUERY_TIME_ADJUST_INFORMATION

    Action
            : Set
    Buffer size
            : 0x008
    Structure
            : SYSTEM_SET_TIME_ADJUST_INFORMATION
  • SystemSummaryMemoryInformation
    • 0x014 GET checked build only
  • SystemNextEventIdInformation
    • ???? (C0000005) GET checked build only
  • SystemEventIdsInformation
    • 0xB66 GET checked build only
  • SystemCrashDumpInformation
    • 0x004 GET
  • SystemExceptionInformation
    • 0x010 GET
  • SystemCrashDumpStateInformation
    • 0x004 GET
  • SystemKernelDebuggerInformation
    • 0x002 GET
  • SystemContextSwitchInformation
    • 0x030 GET
  • SystemRegistryQuotaInformation
    • Action
            : Query
    Buffer size
            : 0x00C
    Structure
            : SYSTEM_REGISTRY_QUOTA_INFORMATION

    Action
            : Set
    Buffer size
            : 0x00C
    Structure
            : SYSTEM_REGISTRY_QUOTA_INFORMATION
  • SystemExtendServiceTableInformation
    • Action
            : Set
    Buffer size
            : 0x008
    Structure
            : SYSTEM_LOAD_IMAGE_INFORMATION
  • SystemPrioritySeperation
    • 0x004 SET
  • SystemPlugPlayBusInformation
    • NOT_IMPLEMENTED, GET
  • SystemDockInformation
    • NOT_IMPLEMENTED, GET
  • SystemPowerInformation
    • INVALID_INFO_CLASS
  • SystemProcessorSpeedInformation
    • INVALID_INFO_CLASS
  • SystemCurrentTimeZoneInformation
    • 0x0AC GET
  • SystemLookasideInformation
    • 0x000 GET

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtSetSystemInformation


SYSTEM_MODULE

SYSTEM_MODULE
SYSTEM_MODULE

typedef struct _SYSTEM_MODULE {

  ULONG                Reserved1;
  ULONG                Reserved2;
  PVOID                ImageBaseAddress;
  ULONG                ImageSize;
  ULONG                Flags;
  WORD                 Id;
  WORD                 Rank;
  WORD                 w018;
  WORD                 NameOffset;
  BYTE                 Name[MAXIMUM_FILENAME_LENGTH];

} SYSTEM_MODULE, *PSYSTEM_MODULE;

Reserved1
Reserved (always 0xBAADF00D).

Reserved2
Reserved (always 0).

Address
Module address in virtual address space.

ImageSize
Size of module in virtual address space.

Flags
- ???

Id
0-based counter of results.

Rank
The same as Id (in global enumeration with NtQuerySystemInformation), or unknown.

w018
In process module enumeration with LdrQueryProcessModuleInformation always 0xFFFF, in other - unknown.

NameOffset
Offset in Name table to first char of module name.

Name
Path to module.

Requirements:
Library: ntdll.lib

See also:
KMODULE
SYSTEM_MODULE_INFORMATION
LdrQueryProcessModuleInformation
NtQuerySystemInformation


SYSTEM_MODULE_INFORMATION

SYSTEM_MODULE_INFORMATION
SYSTEM_MODULE_INFORMATION

typedef struct _SYSTEM_MODULE_INFORMATION {

  ULONG                ModulesCount;
  SYSTEM_MODULE        Modules[0];

} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

See SYSTEM_MODULE for details.
See NtQuerySystemInformation with SystemModuleInformation class for global module enumeration.
See LdrQueryProcessModuleInformation for process module enumeration.

Requirements:
Library: ntdll.lib

See also:
KMODULE
SYSTEM_MODULE
LdrQueryProcessModuleInformation
NtQuerySystemInformation


SYSTEM_PAGEFILE_INFORMATION

2OO1, 9 February

SYSTEM_PAGEFILE_INFORMATION
SYSTEM_PAGEFILE_INFORMATION

typedef struct _SYSTEM_PAGEFILE_INFORMATION {

  ULONG                   NextEntryOffset;
  ULONG                   TotalSize;
  ULONG                   TotalInUse;
  ULONG                   PeakUsage;
  UNICODE_STRING          PageFileName;

} SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION;

Structure SYSTEM_PAGEFILE_INFORMATION is used as a result of call NtQuerySystemInformation with SystemPageFileInformation information class. If contains information about currently instaled Paged Files (files used by system for swap paged pool memory to disk).

  • NextEntryOffset
    • Offset to next SYSTEM_PAGEFILE_INFORMATION structure or zero, if it's last one.
  • TotalSize
    • Size of paged file, in pages (Size of page depend on machine type, for x86 one page is 0x1000 (4096) bytes).
  • TotalInUse
    • Number of currently used pages in paged file.
  • PeakUsage
    • Maximum number of pages used in this boot session.
  • PageFileName
    • System path to paged file.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtCreatePagingFile
    NtQuerySystemInformation
    SYSTEM_INFORMATION_CLASS


SYSTEM_PROCESS_INFORMATION

2OO2, 8 April

SYSTEM_PROCESS_INFORMATION
SYSTEM_PROCESS_INFORMATION

typedef struct _SYSTEM_PROCESS_INFORMATION {

  ULONG                   NextEntryOffset;
  ULONG                   NumberOfThreads;
  LARGE_INTEGER           Reserved[3];
  LARGE_INTEGER           CreateTime;
  LARGE_INTEGER           UserTime;
  LARGE_INTEGER           KernelTime;
  UNICODE_STRING          ImageName;
  KPRIORITY               BasePriority;
  HANDLE                  ProcessId;
  HANDLE                  InheritedFromProcessId;
  ULONG                   HandleCount;
  ULONG                   Reserved2[2];
  ULONG                   PrivatePageCount;
  VM_COUNTERS             VirtualMemoryCounters;
  IO_COUNTERS             IoCounters;
  SYSTEM_THREAD           Threads[0];

} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;

Structure SYSTEM_PROCESS_INFORMATION contains list of processes and threads and it's avaiable via NtQuerySystemInformation function with SystemProcessInformation information class.

  • NextEntryOffset
    • Offset from begining of output buffer to next process entry. On last entry contains zero.
  • NumberOfThreads
    • Number of process'es threads. Also number of members in Threads array descripted below.
  • Reserved[3]
    • Reserved.
  • CreateTime
    • Process creation time, in 100-ns units.
  • UserTime
    • Effective time in User Mode.
  • KernelTime
    • Effective time in Kernel Mode.
  • ImageName
    • Process name, based on executable file name.
  • BasePriority
    • Process base priority.
  • ProcessId
    • Unique identifier of process.
  • InheritedFromProcessId
    • Creator's identifier.
  • HandleCount
    • Nr of open HANDLEs.
  • Reserved2[2]
    • Reserved.
  • PrivatePageCount
    • Number of memory pages assigned to process.
  • VirtualMemoryCounters
    • Memory performance counters.
  • IoCounters
    • IO performance counters.
  • Threads[0]
    • Array of SYSTEM_THREAD structures descripting process's threads.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtQuerySystemInformation
    SYSTEM_INFORMATION_CLASS
    SYSTEM_THREAD


SYSTEM_REGISTRY_QUOTA_INFORMATION

2OOO, 24 December

SYSTEM_REGISTRY_QUOTA_INFORMATION
SYSTEM_REGISTRY_QUOTA_INFORMATION

typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION {

  ULONG                   RegistryQuotaAllowed;
  ULONG                   RegistryQuotaUsed;
  ULONG                   PagedPoolSize;

} SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION;

RegistryQuotaAllowed
Allowed size of all currently loaded hives.

RegistryQuotaUsed
Size of all currently loaded hives.

PagedPoolSize
Paged Pool size. RegistryQuotaAllowed shouldn't be grater then 80 percent of PagedPoolSize.

Remember that registry size is always sum of all loaded hives. So if you call NtSaveKey, size of registry will have the highest point at the end of saving.
SYSTEM_REGISTRY_QUOTA_INFORMATION don't need restart of system to change registry quota.

Documented by:
Tomasz Nowak
Sven B. Schreiber

Requirements:
Library: ntdll.lib
Privileges: SE_INCREASE_QUOTA_PRIVILEGE

See also:
NtQuerySystemInformation
NtRestoreKey
NtSaveKey
NtSetSystemInformation
SYSTEM_INFORMATION_CLASS


SYSTEM_THREAD

2OO2, 18 March

SYSTEM_THREAD
SYSTEM_THREAD

typedef struct _SYSTEM_THREAD {

  LARGE_INTEGER           KernelTime;
  LARGE_INTEGER           UserTime;
  LARGE_INTEGER           CreateTime;
  ULONG                   WaitTime;
  PVOID                   StartAddress;
  CLIENT_ID               ClientId;
  KPRIORITY               Priority;
  LONG                    BasePriority;
  ULONG                   ContextSwitchCount;
  ULONG                   State;
  KWAIT_REASON            WaitReason;

} SYSTEM_THREAD, *PSYSTEM_THREAD;

Structure SYSTEM_THREAD is a part of SYSTEM_PROCESS_INFORMATION structure avaiable by NtQuerySystemInformation with SystemProcessInformation enumeration type.

  • KernelTime
    • Sum of thread's execution time in KernelMode, in native format.
  • UserTime
    • Sum of thread's execution time in UserMode, in native format.
  • CreateTime
    • Time of thread creation, in native format.
  • WaitTime
    • Sum of thread's waiting time, in native format.
  • StartAddress
    • Thread start address.
  • ClientId
    • Process and thread identyficators.
  • Priority
    • Thread prioryty.
  • BasePriority
    • Thread base prioryty.
  • ContextSwitchCount
    • Number of context switches executed by thread.
  • State
    • Current thread's state.
  • WaitReason
    • Reason for waiting (if any).

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtQuerySystemInformation
    SYSTEM_PROCESS_INFORMATION


NtGetTickCount

2OO1, 24 February

NtGetTickCount
NtGetTickCount

NTSYSAPI
ULONG
NTAPI

NtGetTickCount(

 );

Function NtGetTickCount returns system Timer's ticks counter. This counter is also avaiable in KUSER_SHARED_DATA structure as TickCountLow member.

Calling NtSetTimerResolution doesn't effect in counter's update resolution.

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
KUSER_SHARED_DATA
NtSetTimerResolution


NtQueryPerformanceCounter

2OOO, 24 November

NtQueryPerformanceCounter
NtQueryPerformanceCounter

NTSYSAPI
NTSTATUS
NTAPI

NtQueryPerformanceCounter(

  OUT PLARGE_INTEGER      PerformanceCounter,
  OUT PLARGE_INTEGER      PerformanceFrequency OPTIONAL );

  • PerformanceCounter
    • Result is number of processor ticks after last reset.
  • PerformanceFrequency
    • It's number of processor ticks per one second.

    Another method of uptime calculation :

    UpTime = PerformanceCounter / PerformanceFrequency;

    Documented by:
    Sven B. Schreiber
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib


NtQuerySystemTime

2OO1, 17 February

NtQuerySystemTime
NtQuerySystemTime

NTSYSAPI
NTSTATUS
NTAPI

NtQuerySystemTime(

  OUT PLARGE_INTEGER      SystemTime );

Function NtQuerySystemTime returns current time in Coordinated Universal Time (UTC) 8-bytes format.

  • SystemTime
    • Pointer to LARGE_INTEGER value receiving current time.

    UTC time it's represented as 8 bytes length integer. This value means number of 100-nanosecond units since 1600, 1 January.
    Time is incremented 10.000.000 times per second. So 64-bit counter overloads after about 58.426 years... (If you don't believe, check this).

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtSetSystemTime
    RtlTimeFieldsToTime
    RtlTimeToTimeFields


NtQueryTimerResolution

2OO1, 24 February

NtQueryTimerResolution
NtQueryTimerResolution

NTSYSAPI
NTSTATUS
NTAPI

NtQueryTimerResolution(

  OUT PULONG              MinimumResolution,
  OUT PULONG              MaximumResolution,
  OUT PULONG              CurrentResolution );

Function NtQueryTimerResolution returns resolution of system Timer in context of calling process. See also description of NtSetTimerResolution.

  • MinimumResolution
    • Means highest possible delay (in 100-ns units) between timer events.
  • MaximumResolution
    • Means lowest possible delay (in 100-ns units) between timer events.
  • CurrentResolution
    • Current timer resolution, in 100-ns units.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtGetTickCount
    NtSetTimer
    NtSetTimerResolution


NtSetSystemTime

2OO1, 17 February

NtSetSystemTime
NtSetSystemTime

NTSYSAPI
NTSTATUS
NTAPI

NtSetSystemTime(

  IN PLARGE_INTEGER       SystemTime,
  OUT PLARGE_INTEGER      PreviousTime OPTIONAL );

Function NtSetSystemTime sets system time. See NtQuerySystemTime for detailed information.

  • SystemTime
    • Pointer to LARGE_INTEGER contains UTC time to set.
  • PreviousTime
    • Optionally receives time before change.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib
    Privilege: SE_SYSTEMTIME_PRIVILEGE

    See also:
    NtQuerySystemTime
    RtlTimeFieldsToTime
    RtlTimeToTimeFields


NtSetTimerResolution

2OO1, 24 February

NtSetTimerResolution
NtSetTimerResolution

NTSYSAPI
NTSTATUS
NTAPI

NtSetTimerResolution(

  IN ULONG                DesiredResolution,
  IN BOOLEAN              SetResolution,
  OUT PULONG              CurrentResolution );

Function NtSetTimerResolution sets resolution of system Timer in calling process context.

  • DesiredResolution
    • Resolution to set. To receive minimum and maximum resolution values, call NtQueryTimerResolution.
  • SetResolution
    • If set, system Timer's resolution is set to DesiredResolution value. If no, parameter DesiredResolution is ignored.
  • CurrentResolution
    • Pointer to ULONG value receiving current timer's resolution, in 100-ns units.

    Documented by:
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtGetTickCount
    NtQueryTimerResolution
    NtSetTimer


RtlTimeFieldsToTime

2OO1, 18 February

RtlTimeFieldsToTime
RtlTimeFieldsToTime

NTSYSAPI
BOOLEAN
NTAPI

RtlTimeFieldsToTime(

  IN PTIME_FIELDS         TimeFields,
  OUT PLARGE_INTEGER      Time );

Function RtlTimeFieldsToTime converts user-readable structure TIME_FIELDS to 64-bit integer.

  • TimeFields
    • Pointer to TIME_FIELDS structure containing time to convert.
  • Time
    • Pointer to LARGE_INTEGER receiving converted time.

    See also oposite function RtlTimeToTimeFields.

    Documented by:
    Reactos
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    RtlTimeToTimeFields
    TIME_FIELDS


RtlTimeToTimeFields

2OO1, 18 February

RtlTimeToTimeFields
RtlTimeToTimeFields

NTSYSAPI
VOID
NTAPI

RtlTimeToTimeFields(

  IN PLARGE_INTEGER       Time,
  OUT PTIME_FIELDS        TimeFields );

Function RtlTimeToTimeFields converts 64-bit time to user-readable structure TIME_FIELDS.

  • Time
    • Pointer to LARGE_INTEGER contains time to convert.
  • TimeFields
    • Result of call - pointer to TIME_FIELDS structure.

    Documented by:
    Reactos
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    RtlTimeFieldsToTime
    TIME_FIELDS


TIME_FIELDS

2OO1, 18 February

TIME_FIELDS
TIME_FIELDS

typedef struct _TIME_FIELDS {

  USHORT                  Year;
  USHORT                  Month;
  USHORT                  Day;
  USHORT                  Hour;
  USHORT                  Minute;
  USHORT                  Second;
  USHORT                  Milliseconds;
  USHORT                  Weekday;

} TIME_FIELDS, *PTIME_FIELDS;

TIME_FIELDS structure is NTDLL version of Win 32 API SYSTEM_TIME. It contains detailed information about date and time.

  • Year
    • Year, in range 1601 - 65535.
  • Month
    • Month, in range 1 - 12.
  • Day
    • Day, in range 1 - 31, dependly on Month member.
  • Hour
    • Hour, in range 0 - 23.
  • Minute
    • Minute, in range 0 - 59.
  • Second
    • Second, in range 0 - 59.
  • Milliseconds
    • Milliseconds, in range 0 - 1000.
  • Weekday
    • Day of week, in range 0 - 6, where 0 means "Sunday", 1 means "Monday" etc.

    Documented by:
    Reactos
    Tomasz Nowak

    Requirements:
    Library: ntdll.lib

    See also:
    NtQuerySystemTime
    NtSetSystemTime
    RtlTimeFieldsToTime
    RtlTimeToTimeFields


001	   DbgPrint
002	   INITIAL_TEB
003	   KiUserApcDispatcher
004	   KMODULE
005	   LdrGetDllHandle
006	   LdrGetProcedureAddress
007	   LdrLoadDll
008	   LdrQueryProcessModuleInformation
009	   LdrShutdownProcess
010	   LdrShutdownThread
011	   LdrUnloadDll
012	   MUTANT_BASIC_INFORMATION
013	   NtAlertResumeThread
014	   NtAllocateVirtualMemory
015	   NtClose
016	   NtContinue
017	   NtCreateEventPair
018	   NtCreateKey
019	   NtCreateMutant
020	   NtCreateProcess
021	   NtCreateSection
022	   NtCreateSymbolicLinkObject
023	   NtCreateThread
024	   NtDeleteKey
025	   NtDeleteValueKey
026	   NtDuplicateObject
027	   NtEnumerateKey
028	   NtEnumerateValueKey
029	   NtExtendSection
030	   NtFlushKey
031	   NtFlushVirtualMemory
032	   NtFreeVirtualMemory
033	   NtGetContextThread
034	   NtLoadDriver
035	   NtLockVirtualMemory
036	   NtMapViewOfSection
037	   NtNotifyChangeKey
038	   NtOpenEventPair
039	   NtOpenKey
040	   NtOpenMutant
041	   NtOpenProcess
042	   NtOpenSection
043	   NtOpenSymbolicLinkObject
044	   NtOpenThread
045	   NtProtectVirtualMemory
046	   NtQueryInformationProcess
047	   NtQueryKey
048	   NtQueryMutant
049	   NtQueryObject
050	   NtQueryPerformanceCounter
051	   NtQuerySection
052	   NtQuerySecurityObject
053	   NtQuerySymbolicLinkObject
054	   NtQuerySystemEnvironmentValue
055	   NtQueryValueKey
056	   NtQueryVirtualMemory
057	   NtQueueApcThread
058	   NtReadVirtualMemory
059	   NtReleaseMutant
060	   NtRestoreKey
061	   NtResumeThread
062	   NtSaveKey
063	   NtSetContextThread
064	   NtSetHighEventPair
065	   NtSetHighWaitLowEventPair
066	   NtSetHighWaitLowThread
067	   NtSetInformationKey
068	   NtSetInformationObject
069	   NtSetInformationProcess
070	   NtSetLowEventPair
071	   NtSetLowWaitHighEventPair
072	   NtSetLowWaitHighThread
073	   NtSetSecurityObject
074	   NtSetSystemEnvironmentValue
075	   NtSetValueKey
076	   NtSuspendThread
077	   NtTerminateProcess
078	   NtTerminateThread
079	   NtTestAlert
080	   NtUnloadDriver
081	   NtUnlockVirtualMemory
082	   NtUnmapViewOfSection
083	   NtWaitHighEventPair
084	   NtWaitLowEventPair
085	   NtWriteVirtualMemory
086	   OBJECT_ALL_INFORMATION
087	   OBJECT_BASIC_INFORMATION
088	   OBJECT_DATA_INFORMATION
089	   OBJECT_NAME_INFORMATION
090	   OBJECT_TYPE_INFORMATION
091	   OtherObjectFunctions
092	   PsCreateSystemProcess
093	   PsCreateWin32Process
094	   PsLookupProcessByProcessId
095	   RtlAllocateHeap
096	   RtlCompactHeap
097	   RtlCompressBuffer
098	   RtlCreateEnvironment
099	   RtlCreateHeap
100	   RtlCreateUserProcess
101	   RtlCreateUserThread
102	   RtlDecompressBuffer
103	   RtlDestroyEnvironment
104	   RtlDestroyHeap
105	   RtlEnumProcessHeaps
106	   RtlExpandEnvironmentStrings_U
107	   RtlFormatCurrentUserKeyPath
108	   RtlFreeHeap
109	   RtlGetCompressionWorkSpaceSize
110	   RtlGetProcessHeaps
111	   RtlImageNtHeader
112	   RtlImageRvaToVa
113	   RtlInitializeContext
114	   RtlLockHeap
115	   RtlProtectHeap
116	   RtlQueryEnvironmentVariable_U
117	   RtlReAllocateHeap
118	   RtlSetCurrentEnvironment
119	   RtlSetEnvironmentVariable
120	   RtlSizeHeap
121	   RtlUnlockHeap
122	   RtlValidateHeap
123	   RtlValidateProcessHeaps
124	   RtlWalkHeap
125	   RTL_DRIVE_LETTER_CURDIR
126	   RTL_HEAP_DEFINITION
127	   RTL_USER_PROCESS_INFORMATION
128	   RTL_USER_PROCESS_PARAMETERS
129	   SECTION_BASIC_INFORMATION
130	   SECTION_IMAGE_INFORMATION
131	   SYSTEM_MODULE
132	   SYSTEM_MODULE_INFORMATION


KMODULE

Undocumented functions of NTOSKRNL

KMODULE
KMODULE

typedef struct _KMODULE {

  LIST_ENTRY          KernelLoadedModuleList;     // _PsLoadedModuleList if last
  DWORD               d008;
  DWORD               d00C;
  PVOID               p010;
  DWORD               p014;
  PVOID               ImageBase;
  PVOID               EntryPoint;
  DWORD               d020;
  UNICODE_STRING      Path;
  UNICODE_STRING      ModuleName;

} KMODULE, *PKMODULE;

KernelLoadedModuleList

List begin from _PsLoadedModuleList.

sPath
System path to image file.

sModuleName
Module name, typically file name from sPath.

Requirements:
Library: ntoskrnl.lib


SECTION_OBJECT_POINTERS

2OO6, 24 March

SECTION_OBJECT_POINTERS
SECTION_OBJECT_POINTERS

typedef struct _SECTION_OBJECT_POINTERS {

  PVOID                   DataSectionObject;
  PVOID                   SharedCacheMap;
  PVOID                   ImageSectionObject;

} SECTION_OBJECT_POINTERS, *PSECTION_OBJECT_POINTERS;

  • DataSectionObject
  • SharedCacheMap
  • ImageSectionObject

    • Supported on system versions:
    NT 4.0,Win 2000,Win XP/2003

    Documented by:
    Microsoft

    Requirements:
    Library: ntdll.lib

    See also:
    MmCreateSection


OBJECT_ALL_INFORMATION

2OOO, 22 November

OBJECT_ALL_INFORMATION
OBJECT_ALL_INFORMATION

typedef struct _OBJECT_ALL_INFORMATION {

  ULONG                   NumberOfObjectsTypes;
  OBJECT_TYPE_INFORMATION ObjectTypeInformation[1];

} OBJECT_ALL_INFORMATION, *POBJECT_ALL_INFORMATION;

Documented by:
Tomasz Nowak
Sven B. Schreiber

Requirements:
Library: ntdll.lib

See also:
NtQueryObject
OBJECT_ALL_INFORMATION
OBJECT_BASIC_INFORMATION
OBJECT_DATA_INFORMATION
OBJECT_NAME_INFORMATION
OBJECT_TYPE_INFORMATION


OBJECT_DATA_INFORMATION

2OOO, 22 November

OBJECT_DATA_INFORMATION
OBJECT_DATA_INFORMATION

typedef struct _OBJECT_DATA_INFORMATION {

  BOOLEAN                 InheritHandle;
  BOOLEAN                 ProtectFromClose;

} OBJECT_DATA_INFORMATION, *POBJECT_DATA_INFORMATION;

Can be used with NtSetInformationObject. WIN32 API uses this to protect Port Object from close in Process Creation routine.

Documented by:
Sven B. Schreiber
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtQueryObject
NtSetInformationObject
OBJECT_ALL_INFORMATION
OBJECT_BASIC_INFORMATION
OBJECT_DATA_INFORMATION
OBJECT_NAME_INFORMATION
OBJECT_TYPE_INFORMATION


OBJECT_TYPE_INFORMATION

2OOO, 17 November

OBJECT_TYPE_INFORMATION
OBJECT_TYPE_INFORMATION

typedef struct _OBJECT_TYPE_INFORMATION {

  UNICODE_STRING          TypeName;
  ULONG                   TotalNumberOfHandles;
  ULONG                   TotalNumberOfObjects;
  WCHAR                   Unused1[8];
  ULONG                   HighWaterNumberOfHandles;
  ULONG                   HighWaterNumberOfObjects;
  WCHAR                   Unused2[8];
  ACCESS_MASK             InvalidAttributes;
  GENERIC_MAPPING         GenericMapping;
  ACCESS_MASK             ValidAttributes;
  BOOLEAN                 SecurityRequired;
  BOOLEAN                 MaintainHandleCount;
  USHORT                  MaintainTypeList;
  POOL_TYPE               PoolType;
  ULONG                   DefaultPagedPoolCharge;
  ULONG                   DefaultNonPagedPoolCharge;

} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;

Documented by:
Tomasz Nowak

Requirements:
Library: ntdll.lib

See also:
NtQueryObject
OBJECT_ALL_INFORMATION
OBJECT_BASIC_INFORMATION
OBJECT_DATA_INFORMATION
OBJECT_NAME_INFORMATION
OBJECT_TYPE_INFORMATION