1const std = @import("../../std.zig");
2const windows = std.os.windows;
3
4const ACCESS_MASK = windows.ACCESS_MASK;
5const ANSI_STRING = windows.ANSI_STRING;
6const BOOL = windows.BOOL;
7const BOOLEAN = windows.BOOLEAN;
8const CONDITION_VARIABLE = windows.CONDITION_VARIABLE;
9const CONTEXT = windows.CONTEXT;
10const CRITICAL_SECTION = windows.CRITICAL_SECTION;
11const CTL_CODE = windows.CTL_CODE;
12const CURDIR = windows.CURDIR;
13const DIRECTORY = windows.DIRECTORY;
14const DWORD = windows.DWORD;
15const DWORD64 = windows.DWORD64;
16const ERESOURCE = windows.ERESOURCE;
17const EVENT_TYPE = windows.EVENT_TYPE;
18const EXCEPTION_ROUTINE = windows.EXCEPTION_ROUTINE;
19const FILE = windows.FILE;
20const FS_INFORMATION_CLASS = windows.FS_INFORMATION_CLASS;
21const HANDLE = windows.HANDLE;
22const HEAP = windows.HEAP;
23const IO_APC_ROUTINE = windows.IO_APC_ROUTINE;
24const IO_STATUS_BLOCK = windows.IO_STATUS_BLOCK;
25const KEY = windows.KEY;
26const KNONVOLATILE_CONTEXT_POINTERS = windows.KNONVOLATILE_CONTEXT_POINTERS;
27const LARGE_INTEGER = windows.LARGE_INTEGER;
28const LDR = windows.LDR;
29const LOGICAL = windows.LOGICAL;
30const LONG = windows.LONG;
31const LPCVOID = windows.LPCVOID;
32const LPVOID = windows.LPVOID;
33const MEM = windows.MEM;
34const NTSTATUS = windows.NTSTATUS;
35const OBJECT = windows.OBJECT;
36const PAGE = windows.PAGE;
37const PCWSTR = windows.PCWSTR;
38const PROCESS = windows.PROCESS;
39const PVOID = windows.PVOID;
40const PWSTR = windows.PWSTR;
41const REG = windows.REG;
42const RTL_OSVERSIONINFOW = windows.RTL_OSVERSIONINFOW;
43const RTL_QUERY_REGISTRY_TABLE = windows.RTL_QUERY_REGISTRY_TABLE;
44const RUNTIME_FUNCTION = windows.RUNTIME_FUNCTION;
45const SEC = windows.SEC;
46const SECTION_INHERIT = windows.SECTION_INHERIT;
47const SIZE_T = windows.SIZE_T;
48const SRWLOCK = windows.SRWLOCK;
49const SYSTEM = windows.SYSTEM;
50const THREAD = windows.THREAD;
51const ULONG = windows.ULONG;
52const ULONG_PTR = windows.ULONG_PTR;
53const UNICODE_STRING = windows.UNICODE_STRING;
54const UNWIND_HISTORY_TABLE = windows.UNWIND_HISTORY_TABLE;
55const USHORT = windows.USHORT;
56const VECTORED_EXCEPTION_HANDLER = windows.VECTORED_EXCEPTION_HANDLER;
57const WORD = windows.WORD;
58const USER_THREAD_START_ROUTINE = windows.USER_THREAD_START_ROUTINE;
59const PS = windows.PS;
60const TEB = windows.TEB;
61
62// ref: km/ntifs.h
63
64pub extern "ntdll" fn RtlCreateHeap(
65 Flags: HEAP.FLAGS.CREATE,
66 HeapBase: ?PVOID,
67 ReserveSize: SIZE_T,
68 CommitSize: SIZE_T,
69 Lock: ?*ERESOURCE,
70 Parameters: ?*const HEAP.RTL_PARAMETERS,
71) callconv(.winapi) ?*HEAP;
72
73pub extern "ntdll" fn RtlDestroyHeap(
74 HeapHandle: *HEAP,
75) callconv(.winapi) ?*HEAP;
76
77pub extern "ntdll" fn RtlAllocateHeap(
78 HeapHandle: *HEAP,
79 Flags: HEAP.FLAGS.ALLOCATION,
80 Size: SIZE_T,
81) callconv(.winapi) ?PVOID;
82
83pub extern "ntdll" fn RtlFreeHeap(
84 HeapHandle: *HEAP,
85 Flags: HEAP.FLAGS.ALLOCATION,
86 BaseAddress: ?PVOID,
87) callconv(.winapi) LOGICAL;
88
89pub extern "ntdll" fn RtlCaptureStackBackTrace(
90 FramesToSkip: ULONG,
91 FramesToCapture: ULONG,
92 BackTrace: **anyopaque,
93 BackTraceHash: ?*ULONG,
94) callconv(.winapi) USHORT;
95
96pub extern "ntdll" fn RtlCaptureContext(
97 ContextRecord: *CONTEXT,
98) callconv(.winapi) void;
99
100pub extern "ntdll" fn NtSetInformationThread(
101 ThreadHandle: HANDLE,
102 ThreadInformationClass: THREAD.INFOCLASS,
103 ThreadInformation: *const anyopaque,
104 ThreadInformationLength: ULONG,
105) callconv(.winapi) NTSTATUS;
106
107pub extern "ntdll" fn NtCreateFile(
108 FileHandle: *HANDLE,
109 DesiredAccess: ACCESS_MASK,
110 ObjectAttributes: *const OBJECT.ATTRIBUTES,
111 IoStatusBlock: *IO_STATUS_BLOCK,
112 AllocationSize: ?*const LARGE_INTEGER,
113 FileAttributes: FILE.ATTRIBUTE,
114 ShareAccess: FILE.SHARE,
115 CreateDisposition: FILE.CREATE_DISPOSITION,
116 CreateOptions: FILE.MODE,
117 EaBuffer: ?*const anyopaque,
118 EaLength: ULONG,
119) callconv(.winapi) NTSTATUS;
120
121pub extern "ntdll" fn NtDeviceIoControlFile(
122 FileHandle: HANDLE,
123 Event: ?HANDLE,
124 ApcRoutine: ?*align(2) const IO_APC_ROUTINE,
125 ApcContext: ?*anyopaque,
126 IoStatusBlock: *IO_STATUS_BLOCK,
127 IoControlCode: CTL_CODE,
128 InputBuffer: ?*const anyopaque,
129 InputBufferLength: ULONG,
130 OutputBuffer: ?PVOID,
131 OutputBufferLength: ULONG,
132) callconv(.winapi) NTSTATUS;
133
134pub extern "ntdll" fn NtFsControlFile(
135 FileHandle: HANDLE,
136 Event: ?HANDLE,
137 ApcRoutine: ?*align(2) const IO_APC_ROUTINE,
138 ApcContext: ?*anyopaque,
139 IoStatusBlock: *IO_STATUS_BLOCK,
140 FsControlCode: CTL_CODE,
141 InputBuffer: ?*const anyopaque,
142 InputBufferLength: ULONG,
143 OutputBuffer: ?PVOID,
144 OutputBufferLength: ULONG,
145) callconv(.winapi) NTSTATUS;
146
147pub extern "ntdll" fn NtLockFile(
148 FileHandle: HANDLE,
149 Event: ?HANDLE,
150 ApcRoutine: ?*align(2) const IO_APC_ROUTINE,
151 ApcContext: ?*anyopaque,
152 IoStatusBlock: *IO_STATUS_BLOCK,
153 ByteOffset: *const LARGE_INTEGER,
154 Length: *const LARGE_INTEGER,
155 Key: ?*const ULONG,
156 FailImmediately: BOOLEAN,
157 ExclusiveLock: BOOLEAN,
158) callconv(.winapi) NTSTATUS;
159
160pub extern "ntdll" fn NtOpenFile(
161 FileHandle: *HANDLE,
162 DesiredAccess: ACCESS_MASK,
163 ObjectAttributes: *const OBJECT.ATTRIBUTES,
164 IoStatusBlock: *IO_STATUS_BLOCK,
165 ShareAccess: FILE.SHARE,
166 OpenOptions: FILE.MODE,
167) callconv(.winapi) NTSTATUS;
168
169pub extern "ntdll" fn NtQueryDirectoryFile(
170 FileHandle: HANDLE,
171 Event: ?HANDLE,
172 ApcRoutine: ?*align(2) const IO_APC_ROUTINE,
173 ApcContext: ?*anyopaque,
174 IoStatusBlock: *IO_STATUS_BLOCK,
175 FileInformation: *anyopaque,
176 Length: ULONG,
177 FileInformationClass: FILE.INFORMATION_CLASS,
178 ReturnSingleEntry: BOOLEAN,
179 FileName: ?*const UNICODE_STRING,
180 RestartScan: BOOLEAN,
181) callconv(.winapi) NTSTATUS;
182
183pub extern "ntdll" fn NtQueryInformationFile(
184 FileHandle: HANDLE,
185 IoStatusBlock: *IO_STATUS_BLOCK,
186 FileInformation: *anyopaque,
187 Length: ULONG,
188 FileInformationClass: FILE.INFORMATION_CLASS,
189) callconv(.winapi) NTSTATUS;
190
191pub extern "ntdll" fn NtQueryVolumeInformationFile(
192 FileHandle: HANDLE,
193 IoStatusBlock: *IO_STATUS_BLOCK,
194 FsInformation: *anyopaque,
195 Length: ULONG,
196 FsInformationClass: FS_INFORMATION_CLASS,
197) callconv(.winapi) NTSTATUS;
198
199pub extern "ntdll" fn NtReadFile(
200 FileHandle: HANDLE,
201 Event: ?HANDLE,
202 ApcRoutine: ?*align(2) const IO_APC_ROUTINE,
203 ApcContext: ?*anyopaque,
204 IoStatusBlock: *IO_STATUS_BLOCK,
205 Buffer: *anyopaque,
206 Length: ULONG,
207 ByteOffset: ?*const LARGE_INTEGER,
208 Key: ?*const ULONG,
209) callconv(.winapi) NTSTATUS;
210
211pub extern "ntdll" fn NtSetInformationFile(
212 FileHandle: HANDLE,
213 IoStatusBlock: *IO_STATUS_BLOCK,
214 /// This can't be const as providing read-only memory could result in ACCESS_VIOLATION
215 /// in certain scenarios. This has been seen when using FILE_DISPOSITION_INFORMATION_EX
216 /// and targeting x86-windows.
217 FileInformation: *anyopaque,
218 Length: ULONG,
219 FileInformationClass: FILE.INFORMATION_CLASS,
220) callconv(.winapi) NTSTATUS;
221
222pub extern "ntdll" fn NtWriteFile(
223 FileHandle: HANDLE,
224 Event: ?HANDLE,
225 ApcRoutine: ?*align(2) const IO_APC_ROUTINE,
226 ApcContext: ?*anyopaque,
227 IoStatusBlock: *IO_STATUS_BLOCK,
228 Buffer: *const anyopaque,
229 Length: ULONG,
230 ByteOffset: ?*const LARGE_INTEGER,
231 Key: ?*const ULONG,
232) callconv(.winapi) NTSTATUS;
233
234pub extern "ntdll" fn NtUnlockFile(
235 FileHandle: HANDLE,
236 IoStatusBlock: *IO_STATUS_BLOCK,
237 ByteOffset: *const LARGE_INTEGER,
238 Length: *const LARGE_INTEGER,
239 Key: ULONG,
240) callconv(.winapi) NTSTATUS;
241
242pub extern "ntdll" fn NtQueryObject(
243 Handle: HANDLE,
244 ObjectInformationClass: OBJECT.INFORMATION_CLASS,
245 ObjectInformation: ?PVOID,
246 ObjectInformationLength: ULONG,
247 ReturnLength: ?*ULONG,
248) callconv(.winapi) NTSTATUS;
249
250pub extern "ntdll" fn NtClose(
251 Handle: HANDLE,
252) callconv(.winapi) NTSTATUS;
253
254pub extern "ntdll" fn NtCreateSection(
255 SectionHandle: *HANDLE,
256 DesiredAccess: ACCESS_MASK,
257 ObjectAttributes: ?*const OBJECT.ATTRIBUTES,
258 MaximumSize: ?*const LARGE_INTEGER,
259 SectionPageProtection: PAGE,
260 AllocationAttributes: SEC,
261 FileHandle: ?HANDLE,
262) callconv(.winapi) NTSTATUS;
263
264pub extern "ntdll" fn NtExtendSection(
265 SectionHandle: HANDLE,
266 NewSectionSize: *LARGE_INTEGER,
267) callconv(.winapi) NTSTATUS;
268
269pub extern "ntdll" fn NtAllocateVirtualMemory(
270 ProcessHandle: HANDLE,
271 BaseAddress: *PVOID,
272 ZeroBits: ULONG_PTR,
273 RegionSize: *SIZE_T,
274 AllocationType: MEM.ALLOCATE,
275 Protect: PAGE,
276) callconv(.winapi) NTSTATUS;
277
278pub extern "ntdll" fn NtFreeVirtualMemory(
279 ProcessHandle: HANDLE,
280 BaseAddress: *PVOID,
281 RegionSize: *SIZE_T,
282 FreeType: MEM.FREE,
283) callconv(.winapi) NTSTATUS;
284
285// ref: km/wdm.h
286
287pub extern "ntdll" fn RtlQueryRegistryValues(
288 RelativeTo: ULONG,
289 Path: PCWSTR,
290 QueryTable: [*]RTL_QUERY_REGISTRY_TABLE,
291 Context: ?*const anyopaque,
292 Environment: ?*const anyopaque,
293) callconv(.winapi) NTSTATUS;
294
295pub extern "ntdll" fn RtlEqualUnicodeString(
296 String1: *const UNICODE_STRING,
297 String2: *const UNICODE_STRING,
298 CaseInSensitive: BOOLEAN,
299) callconv(.winapi) BOOLEAN;
300
301pub extern "ntdll" fn RtlUpcaseUnicodeChar(
302 SourceCharacter: u16,
303) callconv(.winapi) u16;
304
305pub extern "ntdll" fn RtlFreeUnicodeString(
306 UnicodeString: *UNICODE_STRING,
307) callconv(.winapi) void;
308
309pub extern "ntdll" fn RtlGetVersion(
310 lpVersionInformation: *RTL_OSVERSIONINFOW,
311) callconv(.winapi) NTSTATUS;
312
313// ref: um/winnt.h
314
315pub extern "ntdll" fn RtlLookupFunctionEntry(
316 ControlPc: usize,
317 ImageBase: *usize,
318 HistoryTable: *UNWIND_HISTORY_TABLE,
319) callconv(.winapi) ?*RUNTIME_FUNCTION;
320
321pub extern "ntdll" fn RtlVirtualUnwind(
322 HandlerType: DWORD,
323 ImageBase: usize,
324 ControlPc: usize,
325 FunctionEntry: *RUNTIME_FUNCTION,
326 ContextRecord: *CONTEXT,
327 HandlerData: *?PVOID,
328 EstablisherFrame: *usize,
329 ContextPointers: ?*KNONVOLATILE_CONTEXT_POINTERS,
330) callconv(.winapi) *EXCEPTION_ROUTINE;
331
332// ref: um/winternl.h
333
334pub extern "ntdll" fn NtWaitForSingleObject(
335 Handle: HANDLE,
336 Alertable: BOOLEAN,
337 Timeout: ?*const LARGE_INTEGER,
338) callconv(.winapi) NTSTATUS;
339
340pub extern "ntdll" fn NtQueryInformationProcess(
341 ProcessHandle: HANDLE,
342 ProcessInformationClass: PROCESS.INFOCLASS,
343 ProcessInformation: *anyopaque,
344 ProcessInformationLength: ULONG,
345 ReturnLength: ?*ULONG,
346) callconv(.winapi) NTSTATUS;
347
348pub extern "ntdll" fn NtQueryInformationThread(
349 ThreadHandle: HANDLE,
350 ThreadInformationClass: THREAD.INFOCLASS,
351 ThreadInformation: *anyopaque,
352 ThreadInformationLength: ULONG,
353 ReturnLength: ?*ULONG,
354) callconv(.winapi) NTSTATUS;
355
356pub extern "ntdll" fn NtQuerySystemInformation(
357 SystemInformationClass: SYSTEM.INFORMATION_CLASS,
358 SystemInformation: PVOID,
359 SystemInformationLength: ULONG,
360 ReturnLength: ?*ULONG,
361) callconv(.winapi) NTSTATUS;
362
363// ref none
364
365pub extern "ntdll" fn RtlGetActiveActivationContext(
366 ActivationContext: *?HANDLE,
367) callconv(.winapi) NTSTATUS;
368
369pub extern "ntdll" fn RtlActivateActivationContextEx(
370 Flags: ULONG,
371 Teb: *TEB,
372 ActivationContext: HANDLE,
373 Cookie: *ULONG,
374) callconv(.winapi) NTSTATUS;
375
376pub extern "ntdll" fn RtlReleaseActivationContext(
377 ActivationContext: HANDLE,
378) callconv(.winapi) void;
379
380pub extern "ntdll" fn LdrAddRefDll(
381 Flags: ULONG,
382 DllHandle: PVOID,
383) callconv(.winapi) NTSTATUS;
384pub extern "ntdll" fn LdrLoadDll(
385 DllPath: ?PCWSTR,
386 DllCharacteristics: ?*const ULONG,
387 DllName: *const UNICODE_STRING,
388 DllHandle: *PVOID,
389) callconv(.winapi) NTSTATUS;
390pub extern "ntdll" fn LdrUnloadDll(
391 DllHandle: PVOID,
392) callconv(.winapi) NTSTATUS;
393
394pub extern "ntdll" fn LdrFindEntryForAddress(
395 DllHandle: PVOID,
396 Entry: **LDR.DATA_TABLE_ENTRY,
397) callconv(.winapi) NTSTATUS;
398pub extern "ntdll" fn LdrGetDllFullName(
399 DllHandle: ?PVOID,
400 FullDllName: *UNICODE_STRING,
401) callconv(.winapi) NTSTATUS;
402pub extern "ntdll" fn LdrGetDllPath(
403 DllName: PCWSTR,
404 Flags: LDR.LOAD,
405 DllPath: *PWSTR,
406 SearchPaths: *PWSTR,
407) callconv(.winapi) NTSTATUS;
408
409pub extern "ntdll" fn LdrGetDllHandle(
410 DllPath: ?PCWSTR,
411 DllCharacteristics: ?*const ULONG,
412 DllName: *const UNICODE_STRING,
413 DllHandle: *PVOID,
414) callconv(.winapi) NTSTATUS;
415pub extern "ntdll" fn LdrGetDllHandleByMapping(
416 BaseAddress: PVOID,
417 DllHandle: *PVOID,
418) callconv(.winapi) NTSTATUS;
419pub extern "ntdll" fn LdrGetDllHandleByName(
420 BaseDllName: *const UNICODE_STRING,
421 FullDllName: *const UNICODE_STRING,
422 DllHandle: *PVOID,
423) callconv(.winapi) NTSTATUS;
424pub extern "ntdll" fn LdrGetDllHandleEx(
425 Flags: LDR.GET_DLL_HANDLE_EX,
426 DllPath: ?PCWSTR,
427 DllCharacteristics: ?*const ULONG,
428 DllName: *const UNICODE_STRING,
429 DllHandle: *PVOID,
430) callconv(.winapi) NTSTATUS;
431
432pub extern "ntdll" fn LdrGetProcedureAddress(
433 DllHandle: PVOID,
434 ProcedureName: *const ANSI_STRING,
435 ProcedureNumber: ULONG,
436 ProcedureAddress: *PVOID,
437) callconv(.winapi) NTSTATUS;
438pub extern "ntdll" fn LdrGetProcedureAddressEx(
439 DllHandle: PVOID,
440 ProcedureName: *const ANSI_STRING,
441 ProcedureNumber: ULONG,
442 ProcedureAddress: *PVOID,
443 Flags: LDR.GET_PROCEDURE_ADDRESS,
444) callconv(.winapi) NTSTATUS;
445pub extern "ntdll" fn LdrGetProcedureAddressForCaller(
446 DllHandle: PVOID,
447 ProcedureName: *const ANSI_STRING,
448 ProcedureNumber: ULONG,
449 ProcedureAddress: *PVOID,
450 Flags: LDR.GET_PROCEDURE_ADDRESS,
451 CallerAddress: PVOID,
452) callconv(.winapi) NTSTATUS;
453
454pub extern "ntdll" fn LdrRegisterDllNotification(
455 Flags: LDR.DLL_NOTIFICATION.REGISTER,
456 NotificationFunction: *const LDR.DLL_NOTIFICATION.FUNCTION,
457 Context: ?PVOID,
458 Cookie: *LDR.DLL_NOTIFICATION.COOKIE,
459) callconv(.winapi) NTSTATUS;
460pub extern "ntdll" fn LdrUnregisterDllNotification(
461 Cookie: LDR.DLL_NOTIFICATION.COOKIE,
462) callconv(.winapi) NTSTATUS;
463
464pub extern "ntdll" fn NtQueryAttributesFile(
465 ObjectAttributes: *const OBJECT.ATTRIBUTES,
466 FileAttributes: *FILE.BASIC_INFORMATION,
467) callconv(.winapi) NTSTATUS;
468
469pub extern "ntdll" fn NtCreateEvent(
470 EventHandle: *HANDLE,
471 DesiredAccess: ACCESS_MASK,
472 ObjectAttributes: ?*const OBJECT.ATTRIBUTES,
473 EventType: EVENT_TYPE,
474 InitialState: BOOLEAN,
475) callconv(.winapi) NTSTATUS;
476pub extern "ntdll" fn NtSetEvent(
477 EventHandle: HANDLE,
478 PreviousState: ?*LONG,
479) callconv(.winapi) NTSTATUS;
480
481pub extern "ntdll" fn NtCreateKeyedEvent(
482 KeyedEventHandle: *HANDLE,
483 DesiredAccess: ACCESS_MASK,
484 ObjectAttributes: ?*const OBJECT.ATTRIBUTES,
485 Flags: ULONG,
486) callconv(.winapi) NTSTATUS;
487pub extern "ntdll" fn NtReleaseKeyedEvent(
488 EventHandle: ?HANDLE,
489 Key: ?*const anyopaque,
490 Alertable: BOOLEAN,
491 Timeout: ?*const LARGE_INTEGER,
492) callconv(.winapi) NTSTATUS;
493pub extern "ntdll" fn NtWaitForKeyedEvent(
494 EventHandle: ?HANDLE,
495 Key: ?*const anyopaque,
496 Alertable: BOOLEAN,
497 Timeout: ?*const LARGE_INTEGER,
498) callconv(.winapi) NTSTATUS;
499
500pub extern "ntdll" fn NtCancelSynchronousIoFile(
501 ThreadHandle: HANDLE,
502 IoRequestToCancel: ?*IO_STATUS_BLOCK,
503 IoStatusBlock: *IO_STATUS_BLOCK,
504) callconv(.winapi) NTSTATUS;
505pub extern "ntdll" fn NtCancelIoFile(
506 FileHandle: HANDLE,
507 IoStatusBlock: *IO_STATUS_BLOCK,
508) callconv(.winapi) NTSTATUS;
509pub extern "ntdll" fn NtCancelIoFileEx(
510 FileHandle: HANDLE,
511 IoRequestToCancel: *const IO_STATUS_BLOCK,
512 IoStatusBlock: *IO_STATUS_BLOCK,
513) callconv(.winapi) NTSTATUS;
514
515/// This function has been observed to return SUCCESS on timeout on Windows 10
516/// and TIMEOUT on Wine 10.0.
517///
518/// This function has been observed on Windows 11 such that positive interval
519/// is real time, which can cause waits to be interrupted by changing system
520/// time, however negative intervals are not affected by changes to system
521/// time.
522pub extern "ntdll" fn NtDelayExecution(
523 Alertable: BOOLEAN,
524 DelayInterval: *const LARGE_INTEGER,
525) callconv(.winapi) NTSTATUS;
526
527pub extern "ntdll" fn NtNotifyChangeDirectoryFileEx(
528 FileHandle: HANDLE,
529 Event: ?HANDLE,
530 ApcRoutine: ?*align(2) const IO_APC_ROUTINE,
531 ApcContext: ?*anyopaque,
532 IoStatusBlock: *IO_STATUS_BLOCK,
533 Buffer: *anyopaque,
534 Length: ULONG,
535 CompletionFilter: FILE.NOTIFY.CHANGE,
536 WatchTree: BOOLEAN,
537 DirectoryNotifyInformationClass: DIRECTORY.NOTIFY_INFORMATION_CLASS,
538) callconv(.winapi) NTSTATUS;
539
540pub extern "ntdll" fn NtOpenThread(
541 ThreadHandle: *HANDLE,
542 DesiredAccess: ACCESS_MASK,
543 ObjectAttributes: *const OBJECT.ATTRIBUTES,
544 ClientId: *const windows.CLIENT_ID,
545) callconv(.winapi) NTSTATUS;
546
547pub extern "ntdll" fn NtCreateNamedPipeFile(
548 FileHandle: *HANDLE,
549 DesiredAccess: ACCESS_MASK,
550 ObjectAttributes: *const OBJECT.ATTRIBUTES,
551 IoStatusBlock: *IO_STATUS_BLOCK,
552 ShareAccess: FILE.SHARE,
553 CreateDisposition: FILE.CREATE_DISPOSITION,
554 CreateOptions: FILE.MODE,
555 NamedPipeType: FILE.PIPE.TYPE,
556 ReadMode: FILE.PIPE.READ_MODE,
557 CompletionMode: FILE.PIPE.COMPLETION_MODE,
558 MaximumInstances: ULONG,
559 InboundQuota: ULONG,
560 OutboundQuota: ULONG,
561 DefaultTimeout: ?*const LARGE_INTEGER,
562) callconv(.winapi) NTSTATUS;
563
564pub extern "ntdll" fn NtFlushBuffersFile(
565 FileHandle: HANDLE,
566 IoStatusBlock: *IO_STATUS_BLOCK,
567) callconv(.winapi) NTSTATUS;
568
569pub extern "ntdll" fn NtMapViewOfSection(
570 SectionHandle: HANDLE,
571 ProcessHandle: HANDLE,
572 BaseAddress: ?*PVOID,
573 ZeroBits: ?*const ULONG,
574 CommitSize: SIZE_T,
575 SectionOffset: ?*LARGE_INTEGER,
576 ViewSize: *SIZE_T,
577 InheritDispostion: SECTION_INHERIT,
578 AllocationType: MEM.MAP,
579 PageProtection: PAGE,
580) callconv(.winapi) NTSTATUS;
581pub extern "ntdll" fn NtUnmapViewOfSection(
582 ProcessHandle: HANDLE,
583 BaseAddress: PVOID,
584) callconv(.winapi) NTSTATUS;
585pub extern "ntdll" fn NtUnmapViewOfSectionEx(
586 ProcessHandle: HANDLE,
587 BaseAddress: PVOID,
588 UnmapFlags: MEM.UNMAP,
589) callconv(.winapi) NTSTATUS;
590
591pub extern "ntdll" fn NtOpenKey(
592 KeyHandle: *HANDLE,
593 DesiredAccess: ACCESS_MASK,
594 ObjectAttributes: *const OBJECT.ATTRIBUTES,
595) callconv(.winapi) NTSTATUS;
596
597pub extern "ntdll" fn NtQueueApcThread(
598 ThreadHandle: HANDLE,
599 ApcRoutine: *const IO_APC_ROUTINE,
600 ApcArgument1: ?*anyopaque,
601 ApcArgument2: ?*anyopaque,
602 ApcArgument3: ?*anyopaque,
603) callconv(.winapi) NTSTATUS;
604
605pub extern "ntdll" fn NtReadVirtualMemory(
606 ProcessHandle: HANDLE,
607 BaseAddress: ?PVOID,
608 Buffer: LPVOID,
609 NumberOfBytesToRead: SIZE_T,
610 NumberOfBytesRead: ?*SIZE_T,
611) callconv(.winapi) NTSTATUS;
612pub extern "ntdll" fn NtWriteVirtualMemory(
613 ProcessHandle: HANDLE,
614 BaseAddress: ?PVOID,
615 Buffer: LPCVOID,
616 NumberOfBytesToWrite: SIZE_T,
617 NumberOfBytesWritten: ?*SIZE_T,
618) callconv(.winapi) NTSTATUS;
619pub extern "ntdll" fn NtProtectVirtualMemory(
620 ProcessHandle: HANDLE,
621 BaseAddress: *?PVOID,
622 NumberOfBytesToProtect: *SIZE_T,
623 NewAccessProtection: PAGE,
624 OldAccessProtection: *PAGE,
625) callconv(.winapi) NTSTATUS;
626
627pub extern "ntdll" fn NtWaitForAlertByThreadId(
628 Address: ?*const anyopaque,
629 Timeout: ?*const LARGE_INTEGER,
630) callconv(.winapi) NTSTATUS;
631pub extern "ntdll" fn NtAlertThreadByThreadId(ThreadId: DWORD) callconv(.winapi) NTSTATUS;
632pub extern "ntdll" fn NtAlertThread(ThreadHandle: HANDLE) callconv(.winapi) NTSTATUS;
633pub extern "ntdll" fn NtAlertMultipleThreadByThreadId(
634 ThreadIds: [*]const ULONG_PTR,
635 ThreadCount: ULONG,
636 Unknown1: ?*const anyopaque,
637 Unknown2: ?*const anyopaque,
638) callconv(.winapi) NTSTATUS;
639
640pub extern "ntdll" fn NtYieldExecution() callconv(.winapi) NTSTATUS;
641
642pub extern "ntdll" fn RtlAddVectoredExceptionHandler(
643 First: ULONG,
644 Handler: ?VECTORED_EXCEPTION_HANDLER,
645) callconv(.winapi) ?LPVOID;
646pub extern "ntdll" fn RtlRemoveVectoredExceptionHandler(
647 Handle: HANDLE,
648) callconv(.winapi) ULONG;
649
650pub extern "ntdll" fn RtlDosPathNameToNtPathName_U(
651 DosPathName: [*:0]const u16,
652 NtPathName: *UNICODE_STRING,
653 NtFileNamePart: ?*?[*:0]const u16,
654 DirectoryInfo: ?*CURDIR,
655) callconv(.winapi) BOOL;
656
657pub extern "ntdll" fn RtlExitUserProcess(
658 ExitStatus: u32,
659) callconv(.winapi) noreturn;
660
661/// Returns the number of bytes written to `Buffer`.
662/// If the returned count is larger than `BufferByteLength`, the buffer was too small.
663/// If the returned count is zero, an error occurred.
664pub extern "ntdll" fn RtlGetFullPathName_U(
665 FileName: [*:0]const u16,
666 BufferByteLength: ULONG,
667 Buffer: [*]u16,
668 ShortName: ?*[*:0]const u16,
669) callconv(.winapi) ULONG;
670
671pub extern "ntdll" fn RtlGetCurrentDirectory_U(
672 BufferByteLength: ULONG,
673 Buffer: [*]u16,
674) callconv(.winapi) ULONG;
675
676pub extern "ntdll" fn RtlGetSystemTimePrecise() callconv(.winapi) LARGE_INTEGER;
677
678pub extern "ntdll" fn RtlInitializeCriticalSection(
679 lpCriticalSection: *CRITICAL_SECTION,
680) callconv(.winapi) NTSTATUS;
681pub extern "ntdll" fn RtlEnterCriticalSection(
682 lpCriticalSection: *CRITICAL_SECTION,
683) callconv(.winapi) NTSTATUS;
684pub extern "ntdll" fn RtlLeaveCriticalSection(
685 lpCriticalSection: *CRITICAL_SECTION,
686) callconv(.winapi) NTSTATUS;
687pub extern "ntdll" fn RtlDeleteCriticalSection(
688 lpCriticalSection: *CRITICAL_SECTION,
689) callconv(.winapi) NTSTATUS;
690
691pub extern "ntdll" fn RtlQueryPerformanceCounter(
692 PerformanceCounter: *LARGE_INTEGER,
693) callconv(.winapi) BOOL;
694pub extern "ntdll" fn RtlQueryPerformanceFrequency(
695 PerformanceFrequency: *LARGE_INTEGER,
696) callconv(.winapi) BOOL;
697
698pub extern "ntdll" fn RtlReAllocateHeap(
699 HeapHandle: *HEAP,
700 Flags: HEAP.FLAGS.ALLOCATION,
701 BaseAddress: ?PVOID,
702 Size: SIZE_T,
703) callconv(.winapi) ?PVOID;
704
705pub extern "ntdll" fn RtlReportSilentProcessExit(
706 ProcessHandle: HANDLE,
707 ExitStatus: NTSTATUS,
708) callconv(.winapi) NTSTATUS;
709pub extern "ntdll" fn NtTerminateProcess(
710 ProcessHandle: ?HANDLE,
711 ExitStatus: NTSTATUS,
712) callconv(.winapi) NTSTATUS;
713
714pub extern "ntdll" fn RtlSetCurrentDirectory_U(
715 PathName: *const UNICODE_STRING,
716) callconv(.winapi) NTSTATUS;
717
718pub extern "ntdll" fn RtlTryAcquireSRWLockExclusive(
719 SRWLock: *SRWLOCK,
720) callconv(.winapi) BOOLEAN;
721pub extern "ntdll" fn RtlAcquireSRWLockExclusive(
722 SRWLock: *SRWLOCK,
723) callconv(.winapi) void;
724pub extern "ntdll" fn RtlReleaseSRWLockExclusive(
725 SRWLock: *SRWLOCK,
726) callconv(.winapi) void;
727
728pub extern "ntdll" fn RtlWakeAddressAll(
729 Address: ?*const anyopaque,
730) callconv(.winapi) void;
731pub extern "ntdll" fn RtlWakeAddressSingle(
732 Address: ?*const anyopaque,
733) callconv(.winapi) void;
734pub extern "ntdll" fn RtlWaitOnAddress(
735 Address: ?*const anyopaque,
736 CompareAddress: ?*const anyopaque,
737 AddressSize: SIZE_T,
738 Timeout: ?*const LARGE_INTEGER,
739) callconv(.winapi) NTSTATUS;
740
741pub extern "ntdll" fn RtlWakeConditionVariable(
742 ConditionVariable: *CONDITION_VARIABLE,
743) callconv(.winapi) void;
744pub extern "ntdll" fn RtlWakeAllConditionVariable(
745 ConditionVariable: *CONDITION_VARIABLE,
746) callconv(.winapi) void;
747
748pub extern "ntdll" fn NtOpenKeyEx(
749 KeyHandle: *HANDLE,
750 DesiredAccess: ACCESS_MASK,
751 ObjectAttributes: *const OBJECT.ATTRIBUTES,
752 OpenOptions: REG.OpenOptions,
753) callconv(.winapi) NTSTATUS;
754pub extern "ntdll" fn RtlOpenCurrentUser(
755 DesiredAccess: ACCESS_MASK,
756 CurrentUserKey: *HANDLE,
757) callconv(.winapi) NTSTATUS;
758pub extern "ntdll" fn NtQueryValueKey(
759 KeyHandle: HANDLE,
760 ValueName: *const UNICODE_STRING,
761 KeyValueInformationClass: KEY.VALUE.INFORMATION_CLASS,
762 KeyValueInformation: *anyopaque,
763 /// Length of KeyValueInformation buffer in bytes
764 Length: ULONG,
765 /// On STATUS_SUCCESS, contains the length of the populated portion of the
766 /// provided buffer. On STATUS_BUFFER_OVERFLOW or STATUS_BUFFER_TOO_SMALL,
767 /// contains the minimum `Length` value that would be required to hold the information.
768 ResultLength: *ULONG,
769) callconv(.winapi) NTSTATUS;
770pub extern "ntdll" fn NtLoadKeyEx(
771 TargetKey: *const OBJECT.ATTRIBUTES,
772 SourceFile: *const OBJECT.ATTRIBUTES,
773 Flags: REG.LoadOptions,
774 TrustClassKey: ?HANDLE,
775 Event: ?HANDLE,
776 DesiredAccess: ACCESS_MASK,
777 RootHandle: ?*HANDLE,
778 Reserved: ?*anyopaque,
779) callconv(.winapi) NTSTATUS;
780
781pub extern "ntdll" fn NtCreateThreadEx(
782 ThreadHandle: *HANDLE,
783 DesiredAccess: ACCESS_MASK,
784 ObjectAttributes: *const OBJECT.ATTRIBUTES,
785 ProcessHandle: HANDLE,
786 StartRoutine: *const USER_THREAD_START_ROUTINE,
787 Argument: ?PVOID,
788 CreateFlags: THREAD.CREATE_FLAGS,
789 ZeroBits: SIZE_T,
790 /// This value is rounded up to the nearest page.
791 /// If this value is larger than `StackReserve`, the reserved stack
792 /// size will be the rounded value of this parameter.
793 /// https://learn.microsoft.com/en-us/windows/win32/procthread/thread-stack-size
794 StackCommit: THREAD.StackSize,
795 StackReserve: THREAD.StackSize,
796 AttributeList: ?*PS.ATTRIBUTE.LIST,
797) callconv(.winapi) NTSTATUS;
798
799pub extern "ntdll" fn NtResumeThread(
800 ThreadHandle: HANDLE,
801 PreviousSuspendCount: ?*ULONG,
802) callconv(.winapi) NTSTATUS;