Process Hacker
ntioapi.h
Go to the documentation of this file.
1 #ifndef _NTIOAPI_H
2 #define _NTIOAPI_H
3 
4 // Create disposition
5 
6 #define FILE_SUPERSEDE 0x00000000
7 #define FILE_OPEN 0x00000001
8 #define FILE_CREATE 0x00000002
9 #define FILE_OPEN_IF 0x00000003
10 #define FILE_OVERWRITE 0x00000004
11 #define FILE_OVERWRITE_IF 0x00000005
12 #define FILE_MAXIMUM_DISPOSITION 0x00000005
13 
14 // Create/open flags
15 
16 #define FILE_DIRECTORY_FILE 0x00000001
17 #define FILE_WRITE_THROUGH 0x00000002
18 #define FILE_SEQUENTIAL_ONLY 0x00000004
19 #define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008
20 
21 #define FILE_SYNCHRONOUS_IO_ALERT 0x00000010
22 #define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
23 #define FILE_NON_DIRECTORY_FILE 0x00000040
24 #define FILE_CREATE_TREE_CONNECTION 0x00000080
25 
26 #define FILE_COMPLETE_IF_OPLOCKED 0x00000100
27 #define FILE_NO_EA_KNOWLEDGE 0x00000200
28 #define FILE_OPEN_FOR_RECOVERY 0x00000400
29 #define FILE_RANDOM_ACCESS 0x00000800
30 
31 #define FILE_DELETE_ON_CLOSE 0x00001000
32 #define FILE_OPEN_BY_FILE_ID 0x00002000
33 #define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000
34 #define FILE_NO_COMPRESSION 0x00008000
35 #if (PHNT_VERSION >= PHNT_WIN7)
36 #define FILE_OPEN_REQUIRING_OPLOCK 0x00010000
37 #define FILE_DISALLOW_EXCLUSIVE 0x00020000
38 #endif
39 #if (PHNT_VERSION >= PHNT_WIN8)
40 #define FILE_SESSION_AWARE 0x00040000
41 #endif
42 
43 #define FILE_RESERVE_OPFILTER 0x00100000
44 #define FILE_OPEN_REPARSE_POINT 0x00200000
45 #define FILE_OPEN_NO_RECALL 0x00400000
46 #define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000
47 
48 #define FILE_COPY_STRUCTURED_STORAGE 0x00000041
49 #define FILE_STRUCTURED_STORAGE 0x00000441
50 
51 // I/O status information values for NtCreateFile/NtOpenFile
52 
53 #define FILE_SUPERSEDED 0x00000000
54 #define FILE_OPENED 0x00000001
55 #define FILE_CREATED 0x00000002
56 #define FILE_OVERWRITTEN 0x00000003
57 #define FILE_EXISTS 0x00000004
58 #define FILE_DOES_NOT_EXIST 0x00000005
59 
60 // Special ByteOffset parameters
61 
62 #define FILE_WRITE_TO_END_OF_FILE 0xffffffff
63 #define FILE_USE_FILE_POINTER_POSITION 0xfffffffe
64 
65 // Alignment requirement values
66 
67 #define FILE_BYTE_ALIGNMENT 0x00000000
68 #define FILE_WORD_ALIGNMENT 0x00000001
69 #define FILE_LONG_ALIGNMENT 0x00000003
70 #define FILE_QUAD_ALIGNMENT 0x00000007
71 #define FILE_OCTA_ALIGNMENT 0x0000000f
72 #define FILE_32_BYTE_ALIGNMENT 0x0000001f
73 #define FILE_64_BYTE_ALIGNMENT 0x0000003f
74 #define FILE_128_BYTE_ALIGNMENT 0x0000007f
75 #define FILE_256_BYTE_ALIGNMENT 0x000000ff
76 #define FILE_512_BYTE_ALIGNMENT 0x000001ff
77 
78 // Maximum length of a filename string
79 
80 #define MAXIMUM_FILENAME_LENGTH 256
81 
82 // Extended attributes
83 
84 #define FILE_NEED_EA 0x00000080
85 
86 #define FILE_EA_TYPE_BINARY 0xfffe
87 #define FILE_EA_TYPE_ASCII 0xfffd
88 #define FILE_EA_TYPE_BITMAP 0xfffb
89 #define FILE_EA_TYPE_METAFILE 0xfffa
90 #define FILE_EA_TYPE_ICON 0xfff9
91 #define FILE_EA_TYPE_EA 0xffee
92 #define FILE_EA_TYPE_MVMT 0xffdf
93 #define FILE_EA_TYPE_MVST 0xffde
94 #define FILE_EA_TYPE_ASN1 0xffdd
95 #define FILE_EA_TYPE_FAMILY_IDS 0xff01
96 
97 // Device characteristics
98 
99 #define FILE_REMOVABLE_MEDIA 0x00000001
100 #define FILE_READ_ONLY_DEVICE 0x00000002
101 #define FILE_FLOPPY_DISKETTE 0x00000004
102 #define FILE_WRITE_ONCE_MEDIA 0x00000008
103 #define FILE_REMOTE_DEVICE 0x00000010
104 #define FILE_DEVICE_IS_MOUNTED 0x00000020
105 #define FILE_VIRTUAL_VOLUME 0x00000040
106 #define FILE_AUTOGENERATED_DEVICE_NAME 0x00000080
107 #define FILE_DEVICE_SECURE_OPEN 0x00000100
108 #define FILE_CHARACTERISTIC_PNP_DEVICE 0x00000800
109 #define FILE_CHARACTERISTIC_TS_DEVICE 0x00001000
110 #define FILE_CHARACTERISTIC_WEBDAV_DEVICE 0x00002000
111 #define FILE_CHARACTERISTIC_CSV 0x00010000
112 #define FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL 0x00020000
113 #define FILE_PORTABLE_DEVICE 0x00040000
114 
115 // Named pipe values
116 
117 // NamedPipeType for NtCreateNamedPipeFile
118 #define FILE_PIPE_BYTE_STREAM_TYPE 0x00000000
119 #define FILE_PIPE_MESSAGE_TYPE 0x00000001
120 #define FILE_PIPE_ACCEPT_REMOTE_CLIENTS 0x00000000
121 #define FILE_PIPE_REJECT_REMOTE_CLIENTS 0x00000002
122 #define FILE_PIPE_TYPE_VALID_MASK 0x00000003
123 
124 // CompletionMode for NtCreateNamedPipeFile
125 #define FILE_PIPE_QUEUE_OPERATION 0x00000000
126 #define FILE_PIPE_COMPLETE_OPERATION 0x00000001
127 
128 // ReadMode for NtCreateNamedPipeFile
129 #define FILE_PIPE_BYTE_STREAM_MODE 0x00000000
130 #define FILE_PIPE_MESSAGE_MODE 0x00000001
131 
132 // NamedPipeConfiguration for NtQueryInformationFile
133 #define FILE_PIPE_INBOUND 0x00000000
134 #define FILE_PIPE_OUTBOUND 0x00000001
135 #define FILE_PIPE_FULL_DUPLEX 0x00000002
136 
137 // NamedPipeState for NtQueryInformationFile
138 #define FILE_PIPE_DISCONNECTED_STATE 0x00000001
139 #define FILE_PIPE_LISTENING_STATE 0x00000002
140 #define FILE_PIPE_CONNECTED_STATE 0x00000003
141 #define FILE_PIPE_CLOSING_STATE 0x00000004
142 
143 // NamedPipeEnd for NtQueryInformationFile
144 #define FILE_PIPE_CLIENT_END 0x00000000
145 #define FILE_PIPE_SERVER_END 0x00000001
146 
147 // Mailslot values
148 
149 #define MAILSLOT_SIZE_AUTO 0
150 
151 typedef struct _IO_STATUS_BLOCK
152 {
153  union
154  {
155  NTSTATUS Status;
156  PVOID Pointer;
157  };
158  ULONG_PTR Information;
159 } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
160 
161 typedef VOID (NTAPI *PIO_APC_ROUTINE)(
162  _In_ PVOID ApcContext,
163  _In_ PIO_STATUS_BLOCK IoStatusBlock,
164  _In_ ULONG Reserved
165  );
166 
167 // private
168 typedef struct _FILE_IO_COMPLETION_INFORMATION
169 {
170  PVOID KeyContext;
171  PVOID ApcContext;
172  IO_STATUS_BLOCK IoStatusBlock;
173 } FILE_IO_COMPLETION_INFORMATION, *PFILE_IO_COMPLETION_INFORMATION;
174 
175 typedef enum _FILE_INFORMATION_CLASS
176 {
177  FileDirectoryInformation = 1,
178  FileFullDirectoryInformation,
179  FileBothDirectoryInformation,
180  FileBasicInformation,
181  FileStandardInformation,
182  FileInternalInformation,
183  FileEaInformation,
184  FileAccessInformation,
185  FileNameInformation,
186  FileRenameInformation, // 10
187  FileLinkInformation,
188  FileNamesInformation,
189  FileDispositionInformation,
190  FilePositionInformation,
191  FileFullEaInformation,
192  FileModeInformation,
193  FileAlignmentInformation,
194  FileAllInformation,
195  FileAllocationInformation,
196  FileEndOfFileInformation, // 20
197  FileAlternateNameInformation,
198  FileStreamInformation,
199  FilePipeInformation,
200  FilePipeLocalInformation,
201  FilePipeRemoteInformation,
202  FileMailslotQueryInformation,
203  FileMailslotSetInformation,
204  FileCompressionInformation,
205  FileObjectIdInformation,
206  FileCompletionInformation, // 30
207  FileMoveClusterInformation,
208  FileQuotaInformation,
209  FileReparsePointInformation,
210  FileNetworkOpenInformation,
211  FileAttributeTagInformation,
212  FileTrackingInformation,
213  FileIdBothDirectoryInformation,
214  FileIdFullDirectoryInformation,
215  FileValidDataLengthInformation,
216  FileShortNameInformation, // 40
217  FileIoCompletionNotificationInformation,
218  FileIoStatusBlockRangeInformation,
219  FileIoPriorityHintInformation,
220  FileSfioReserveInformation,
221  FileSfioVolumeInformation,
222  FileHardLinkInformation,
223  FileProcessIdsUsingFileInformation,
224  FileNormalizedNameInformation,
225  FileNetworkPhysicalNameInformation,
226  FileIdGlobalTxDirectoryInformation, // 50
227  FileIsRemoteDeviceInformation,
228  FileUnusedInformation,
229  FileNumaNodeInformation,
230  FileStandardLinkInformation,
231  FileRemoteProtocolInformation,
232  FileRenameInformationBypassAccessCheck, // (kernel-mode only) // since WIN8
233  FileLinkInformationBypassAccessCheck, // (kernel-mode only)
234  FileIntegrityStreamInformation,
235  FileVolumeNameInformation,
236  FileIdInformation,
237  FileIdExtdDirectoryInformation,
238  FileReplaceCompletionInformation, // since WINBLUE
239  FileHardLinkFullIdInformation,
240  FileIdExtdBothDirectoryInformation, // since THRESHOLD
241  FileMaximumInformation
242 } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;
243 
244 // NtQueryInformationFile/NtSetInformationFile types
245 
246 typedef struct _FILE_BASIC_INFORMATION
247 {
248  LARGE_INTEGER CreationTime;
249  LARGE_INTEGER LastAccessTime;
250  LARGE_INTEGER LastWriteTime;
251  LARGE_INTEGER ChangeTime;
252  ULONG FileAttributes;
253 } FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;
254 
255 typedef struct _FILE_STANDARD_INFORMATION
256 {
257  LARGE_INTEGER AllocationSize;
258  LARGE_INTEGER EndOfFile;
259  ULONG NumberOfLinks;
260  BOOLEAN DeletePending;
261  BOOLEAN Directory;
262 } FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;
263 
264 typedef struct _FILE_STANDARD_INFORMATION_EX
265 {
266  LARGE_INTEGER AllocationSize;
267  LARGE_INTEGER EndOfFile;
268  ULONG NumberOfLinks;
269  BOOLEAN DeletePending;
270  BOOLEAN Directory;
271  BOOLEAN AlternateStream;
272  BOOLEAN MetadataAttribute;
273 } FILE_STANDARD_INFORMATION_EX, *PFILE_STANDARD_INFORMATION_EX;
274 
275 typedef struct _FILE_INTERNAL_INFORMATION
276 {
277  LARGE_INTEGER IndexNumber;
278 } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;
279 
280 typedef struct _FILE_EA_INFORMATION
281 {
282  ULONG EaSize;
283 } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;
284 
285 typedef struct _FILE_ACCESS_INFORMATION
286 {
287  ACCESS_MASK AccessFlags;
288 } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;
289 
290 typedef struct _FILE_POSITION_INFORMATION
291 {
292  LARGE_INTEGER CurrentByteOffset;
293 } FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;
294 
295 typedef struct _FILE_MODE_INFORMATION
296 {
297  ULONG Mode;
298 } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;
299 
300 typedef struct _FILE_ALIGNMENT_INFORMATION
301 {
302  ULONG AlignmentRequirement;
303 } FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION;
304 
305 typedef struct _FILE_NAME_INFORMATION
306 {
307  ULONG FileNameLength;
308  WCHAR FileName[1];
309 } FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;
310 
311 typedef struct _FILE_ALL_INFORMATION
312 {
313  FILE_BASIC_INFORMATION BasicInformation;
314  FILE_STANDARD_INFORMATION StandardInformation;
315  FILE_INTERNAL_INFORMATION InternalInformation;
316  FILE_EA_INFORMATION EaInformation;
317  FILE_ACCESS_INFORMATION AccessInformation;
318  FILE_POSITION_INFORMATION PositionInformation;
319  FILE_MODE_INFORMATION ModeInformation;
320  FILE_ALIGNMENT_INFORMATION AlignmentInformation;
321  FILE_NAME_INFORMATION NameInformation;
322 } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;
323 
324 typedef struct _FILE_NETWORK_OPEN_INFORMATION
325 {
326  LARGE_INTEGER CreationTime;
327  LARGE_INTEGER LastAccessTime;
328  LARGE_INTEGER LastWriteTime;
329  LARGE_INTEGER ChangeTime;
330  LARGE_INTEGER AllocationSize;
331  LARGE_INTEGER EndOfFile;
332  ULONG FileAttributes;
333 } FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;
334 
335 typedef struct _FILE_ATTRIBUTE_TAG_INFORMATION
336 {
337  ULONG FileAttributes;
338  ULONG ReparseTag;
339 } FILE_ATTRIBUTE_TAG_INFORMATION, *PFILE_ATTRIBUTE_TAG_INFORMATION;
340 
341 typedef struct _FILE_ALLOCATION_INFORMATION
342 {
343  LARGE_INTEGER AllocationSize;
344 } FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;
345 
346 typedef struct _FILE_COMPRESSION_INFORMATION
347 {
348  LARGE_INTEGER CompressedFileSize;
349  USHORT CompressionFormat;
350  UCHAR CompressionUnitShift;
351  UCHAR ChunkShift;
352  UCHAR ClusterShift;
353  UCHAR Reserved[3];
354 } FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;
355 
356 typedef struct _FILE_DISPOSITION_INFORMATION
357 {
358  BOOLEAN DeleteFile;
359 } FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;
360 
361 typedef struct _FILE_END_OF_FILE_INFORMATION
362 {
363  LARGE_INTEGER EndOfFile;
364 } FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;
365 
366 typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION
367 {
368  LARGE_INTEGER ValidDataLength;
369 } FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION;
370 
371 typedef struct _FILE_LINK_INFORMATION
372 {
373  BOOLEAN ReplaceIfExists;
374  HANDLE RootDirectory;
375  ULONG FileNameLength;
376  WCHAR FileName[1];
377 } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;
378 
379 typedef struct _FILE_MOVE_CLUSTER_INFORMATION
380 {
381  ULONG ClusterCount;
382  HANDLE RootDirectory;
383  ULONG FileNameLength;
384  WCHAR FileName[1];
385 } FILE_MOVE_CLUSTER_INFORMATION, *PFILE_MOVE_CLUSTER_INFORMATION;
386 
387 typedef struct _FILE_RENAME_INFORMATION
388 {
389  BOOLEAN ReplaceIfExists;
390  HANDLE RootDirectory;
391  ULONG FileNameLength;
392  WCHAR FileName[1];
393 } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;
394 
395 typedef struct _FILE_STREAM_INFORMATION
396 {
397  ULONG NextEntryOffset;
398  ULONG StreamNameLength;
399  LARGE_INTEGER StreamSize;
400  LARGE_INTEGER StreamAllocationSize;
401  WCHAR StreamName[1];
402 } FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;
403 
404 typedef struct _FILE_TRACKING_INFORMATION
405 {
406  HANDLE DestinationFile;
407  ULONG ObjectInformationLength;
408  CHAR ObjectInformation[1];
409 } FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION;
410 
411 typedef struct _FILE_COMPLETION_INFORMATION
412 {
413  HANDLE Port;
414  PVOID Key;
415 } FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;
416 
417 typedef struct _FILE_PIPE_INFORMATION
418 {
419  ULONG ReadMode;
420  ULONG CompletionMode;
421 } FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;
422 
423 typedef struct _FILE_PIPE_LOCAL_INFORMATION
424 {
425  ULONG NamedPipeType;
426  ULONG NamedPipeConfiguration;
427  ULONG MaximumInstances;
428  ULONG CurrentInstances;
429  ULONG InboundQuota;
430  ULONG ReadDataAvailable;
431  ULONG OutboundQuota;
432  ULONG WriteQuotaAvailable;
433  ULONG NamedPipeState;
434  ULONG NamedPipeEnd;
435 } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;
436 
437 typedef struct _FILE_PIPE_REMOTE_INFORMATION
438 {
439  LARGE_INTEGER CollectDataTime;
440  ULONG MaximumCollectionCount;
441 } FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION;
442 
443 typedef struct _FILE_MAILSLOT_QUERY_INFORMATION
444 {
445  ULONG MaximumMessageSize;
446  ULONG MailslotQuota;
447  ULONG NextMessageSize;
448  ULONG MessagesAvailable;
449  LARGE_INTEGER ReadTimeout;
450 } FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION;
451 
452 typedef struct _FILE_MAILSLOT_SET_INFORMATION
453 {
454  PLARGE_INTEGER ReadTimeout;
455 } FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION;
456 
457 typedef struct _FILE_REPARSE_POINT_INFORMATION
458 {
459  LONGLONG FileReference;
460  ULONG Tag;
461 } FILE_REPARSE_POINT_INFORMATION, *PFILE_REPARSE_POINT_INFORMATION;
462 
463 typedef struct _FILE_LINK_ENTRY_INFORMATION
464 {
465  ULONG NextEntryOffset;
466  LONGLONG ParentFileId;
467  ULONG FileNameLength;
468  WCHAR FileName[1];
469 } FILE_LINK_ENTRY_INFORMATION, *PFILE_LINK_ENTRY_INFORMATION;
470 
471 typedef struct _FILE_LINKS_INFORMATION
472 {
473  ULONG BytesNeeded;
474  ULONG EntriesReturned;
475  FILE_LINK_ENTRY_INFORMATION Entry;
476 } FILE_LINKS_INFORMATION, *PFILE_LINKS_INFORMATION;
477 
478 typedef struct _FILE_NETWORK_PHYSICAL_NAME_INFORMATION
479 {
480  ULONG FileNameLength;
481  WCHAR FileName[1];
482 } FILE_NETWORK_PHYSICAL_NAME_INFORMATION, *PFILE_NETWORK_PHYSICAL_NAME_INFORMATION;
483 
484 typedef struct _FILE_STANDARD_LINK_INFORMATION
485 {
486  ULONG NumberOfAccessibleLinks;
487  ULONG TotalNumberOfLinks;
488  BOOLEAN DeletePending;
489  BOOLEAN Directory;
490 } FILE_STANDARD_LINK_INFORMATION, *PFILE_STANDARD_LINK_INFORMATION;
491 
492 typedef struct _FILE_SFIO_RESERVE_INFORMATION
493 {
494  ULONG RequestsPerPeriod;
495  ULONG Period;
496  BOOLEAN RetryFailures;
497  BOOLEAN Discardable;
498  ULONG RequestSize;
499  ULONG NumOutstandingRequests;
500 } FILE_SFIO_RESERVE_INFORMATION, *PFILE_SFIO_RESERVE_INFORMATION;
501 
502 typedef struct _FILE_SFIO_VOLUME_INFORMATION
503 {
504  ULONG MaximumRequestsPerPeriod;
505  ULONG MinimumPeriod;
506  ULONG MinimumTransferSize;
507 } FILE_SFIO_VOLUME_INFORMATION, *PFILE_SFIO_VOLUME_INFORMATION;
508 
509 typedef enum _IO_PRIORITY_HINT
510 {
511  IoPriorityVeryLow = 0, // Defragging, content indexing and other background I/Os.
512  IoPriorityLow, // Prefetching for applications.
513  IoPriorityNormal, // Normal I/Os.
514  IoPriorityHigh, // Used by filesystems for checkpoint I/O.
515  IoPriorityCritical, // Used by memory manager. Not available for applications.
516  MaxIoPriorityTypes
517 } IO_PRIORITY_HINT;
518 
519 #define FILE_SKIP_COMPLETION_PORT_ON_SUCCESS 0x1
520 #define FILE_SKIP_SET_EVENT_ON_HANDLE 0x2
521 #define FILE_SKIP_SET_USER_EVENT_ON_FAST_IO 0x4
522 
523 typedef struct _FILE_IO_PRIORITY_HINT_INFORMATION
524 {
525  IO_PRIORITY_HINT PriorityHint;
526 } FILE_IO_PRIORITY_HINT_INFORMATION, *PFILE_IO_PRIORITY_HINT_INFORMATION;
527 
528 typedef struct _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION
529 {
530  ULONG Flags;
531 } FILE_IO_COMPLETION_NOTIFICATION_INFORMATION, *PFILE_IO_COMPLETION_NOTIFICATION_INFORMATION;
532 
533 typedef struct _FILE_PROCESS_IDS_USING_FILE_INFORMATION
534 {
535  ULONG NumberOfProcessIdsInList;
536  ULONG_PTR ProcessIdList[1];
537 } FILE_PROCESS_IDS_USING_FILE_INFORMATION, *PFILE_PROCESS_IDS_USING_FILE_INFORMATION;
538 
539 typedef struct _FILE_IS_REMOTE_DEVICE_INFORMATION
540 {
541  BOOLEAN IsRemote;
542 } FILE_IS_REMOTE_DEVICE_INFORMATION, *PFILE_IS_REMOTE_DEVICE_INFORMATION;
543 
544 typedef struct _FILE_NUMA_NODE_INFORMATION
545 {
546  USHORT NodeNumber;
547 } FILE_NUMA_NODE_INFORMATION, *PFILE_NUMA_NODE_INFORMATION;
548 
549 typedef struct _FILE_IOSTATUSBLOCK_RANGE_INFORMATION
550 {
551  PUCHAR IoStatusBlockRange;
552  ULONG Length;
553 } FILE_IOSTATUSBLOCK_RANGE_INFORMATION, *PFILE_IOSTATUSBLOCK_RANGE_INFORMATION;
554 
555 typedef struct _FILE_REMOTE_PROTOCOL_INFORMATION
556 {
557  USHORT StructureVersion; // 1
558  USHORT StructureSize;
559 
560  ULONG Protocol; // WNNC_NET_*
561 
562  USHORT ProtocolMajorVersion;
563  USHORT ProtocolMinorVersion;
564  USHORT ProtocolRevision;
565 
566  USHORT Reserved;
567 
568  // Generic information
569 
570  ULONG Flags;
571 
572  struct
573  {
574  ULONG Reserved[8];
575  } GenericReserved;
576 
577  // Specific information
578 
579  struct
580  {
581  ULONG Reserved[16];
582  } ProtocolSpecificReserved;
583 } FILE_REMOTE_PROTOCOL_INFORMATION, *PFILE_REMOTE_PROTOCOL_INFORMATION;
584 
585 #define CHECKSUM_ENFORCEMENT_OFF 0x00000001
586 
587 typedef struct _FILE_INTEGRITY_STREAM_INFORMATION
588 {
589  USHORT ChecksumAlgorithm;
590  UCHAR ChecksumChunkShift;
591  UCHAR ClusterShift;
592  ULONG Flags;
593 } FILE_INTEGRITY_STREAM_INFORMATION, *PFILE_INTEGRITY_STREAM_INFORMATION;
594 
595 // private
596 typedef struct _FILE_VOLUME_NAME_INFORMATION
597 {
598  ULONG DeviceNameLength;
599  WCHAR DeviceName[1];
600 } FILE_VOLUME_NAME_INFORMATION, *PFILE_VOLUME_NAME_INFORMATION;
601 
602 // NtQueryDirectoryFile types
603 
604 typedef struct _FILE_DIRECTORY_INFORMATION
605 {
606  ULONG NextEntryOffset;
607  ULONG FileIndex;
608  LARGE_INTEGER CreationTime;
609  LARGE_INTEGER LastAccessTime;
610  LARGE_INTEGER LastWriteTime;
611  LARGE_INTEGER ChangeTime;
612  LARGE_INTEGER EndOfFile;
613  LARGE_INTEGER AllocationSize;
614  ULONG FileAttributes;
615  ULONG FileNameLength;
616  WCHAR FileName[1];
617 } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;
618 
619 typedef struct _FILE_FULL_DIR_INFORMATION
620 {
621  ULONG NextEntryOffset;
622  ULONG FileIndex;
623  LARGE_INTEGER CreationTime;
624  LARGE_INTEGER LastAccessTime;
625  LARGE_INTEGER LastWriteTime;
626  LARGE_INTEGER ChangeTime;
627  LARGE_INTEGER EndOfFile;
628  LARGE_INTEGER AllocationSize;
629  ULONG FileAttributes;
630  ULONG FileNameLength;
631  ULONG EaSize;
632  WCHAR FileName[1];
633 } FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;
634 
635 typedef struct _FILE_ID_FULL_DIR_INFORMATION
636 {
637  ULONG NextEntryOffset;
638  ULONG FileIndex;
639  LARGE_INTEGER CreationTime;
640  LARGE_INTEGER LastAccessTime;
641  LARGE_INTEGER LastWriteTime;
642  LARGE_INTEGER ChangeTime;
643  LARGE_INTEGER EndOfFile;
644  LARGE_INTEGER AllocationSize;
645  ULONG FileAttributes;
646  ULONG FileNameLength;
647  ULONG EaSize;
648  LARGE_INTEGER FileId;
649  WCHAR FileName[1];
650 } FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION;
651 
652 typedef struct _FILE_BOTH_DIR_INFORMATION
653 {
654  ULONG NextEntryOffset;
655  ULONG FileIndex;
656  LARGE_INTEGER CreationTime;
657  LARGE_INTEGER LastAccessTime;
658  LARGE_INTEGER LastWriteTime;
659  LARGE_INTEGER ChangeTime;
660  LARGE_INTEGER EndOfFile;
661  LARGE_INTEGER AllocationSize;
662  ULONG FileAttributes;
663  ULONG FileNameLength;
664  ULONG EaSize;
665  CCHAR ShortNameLength;
666  WCHAR ShortName[12];
667  WCHAR FileName[1];
668 } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;
669 
670 typedef struct _FILE_ID_BOTH_DIR_INFORMATION
671 {
672  ULONG NextEntryOffset;
673  ULONG FileIndex;
674  LARGE_INTEGER CreationTime;
675  LARGE_INTEGER LastAccessTime;
676  LARGE_INTEGER LastWriteTime;
677  LARGE_INTEGER ChangeTime;
678  LARGE_INTEGER EndOfFile;
679  LARGE_INTEGER AllocationSize;
680  ULONG FileAttributes;
681  ULONG FileNameLength;
682  ULONG EaSize;
683  CCHAR ShortNameLength;
684  WCHAR ShortName[12];
685  LARGE_INTEGER FileId;
686  WCHAR FileName[1];
687 } FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;
688 
689 typedef struct _FILE_NAMES_INFORMATION
690 {
691  ULONG NextEntryOffset;
692  ULONG FileIndex;
693  ULONG FileNameLength;
694  WCHAR FileName[1];
695 } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;
696 
697 typedef struct _FILE_ID_GLOBAL_TX_DIR_INFORMATION
698 {
699  ULONG NextEntryOffset;
700  ULONG FileIndex;
701  LARGE_INTEGER CreationTime;
702  LARGE_INTEGER LastAccessTime;
703  LARGE_INTEGER LastWriteTime;
704  LARGE_INTEGER ChangeTime;
705  LARGE_INTEGER EndOfFile;
706  LARGE_INTEGER AllocationSize;
707  ULONG FileAttributes;
708  ULONG FileNameLength;
709  LARGE_INTEGER FileId;
710  GUID LockingTransactionId;
711  ULONG TxInfoFlags;
712  WCHAR FileName[1];
713 } FILE_ID_GLOBAL_TX_DIR_INFORMATION, *PFILE_ID_GLOBAL_TX_DIR_INFORMATION;
714 
715 #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_WRITELOCKED 0x00000001
716 #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_TO_TX 0x00000002
717 #define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_OUTSIDE_TX 0x00000004
718 
719 typedef struct _FILE_OBJECTID_INFORMATION
720 {
721  LONGLONG FileReference;
722  UCHAR ObjectId[16];
723  union
724  {
725  struct
726  {
727  UCHAR BirthVolumeId[16];
728  UCHAR BirthObjectId[16];
729  UCHAR DomainId[16];
730  };
731  UCHAR ExtendedInfo[48];
732  };
733 } FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION;
734 
735 // NtQueryEaFile/NtSetEaFile types
736 
737 typedef struct _FILE_FULL_EA_INFORMATION
738 {
739  ULONG NextEntryOffset;
740  UCHAR Flags;
741  UCHAR EaNameLength;
742  USHORT EaValueLength;
743  CHAR EaName[1];
744 } FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION;
745 
746 typedef struct _FILE_GET_EA_INFORMATION
747 {
748  ULONG NextEntryOffset;
749  UCHAR EaNameLength;
750  CHAR EaName[1];
751 } FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION;
752 
753 // NtQueryQuotaInformationFile/NtSetQuotaInformationFile types
754 
755 typedef struct _FILE_GET_QUOTA_INFORMATION
756 {
757  ULONG NextEntryOffset;
758  ULONG SidLength;
759  SID Sid;
760 } FILE_GET_QUOTA_INFORMATION, *PFILE_GET_QUOTA_INFORMATION;
761 
762 typedef struct _FILE_QUOTA_INFORMATION
763 {
764  ULONG NextEntryOffset;
765  ULONG SidLength;
766  LARGE_INTEGER ChangeTime;
767  LARGE_INTEGER QuotaUsed;
768  LARGE_INTEGER QuotaThreshold;
769  LARGE_INTEGER QuotaLimit;
770  SID Sid;
771 } FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION;
772 
773 typedef enum _FSINFOCLASS
774 {
775  FileFsVolumeInformation = 1,
776  FileFsLabelInformation,
777  FileFsSizeInformation,
778  FileFsDeviceInformation,
779  FileFsAttributeInformation,
780  FileFsControlInformation,
781  FileFsFullSizeInformation,
782  FileFsObjectIdInformation,
783  FileFsDriverPathInformation,
784  FileFsVolumeFlagsInformation,
785  FileFsSectorSizeInformation, // since WIN8
786  FileFsDataCopyInformation,
787  FileFsMetadataSizeInformation, // since THRESHOLD
788  FileFsMaximumInformation
789 } FSINFOCLASS, *PFSINFOCLASS;
790 
791 // NtQueryVolumeInformation/NtSetVolumeInformation types
792 
793 typedef struct _FILE_FS_LABEL_INFORMATION
794 {
795  ULONG VolumeLabelLength;
796  WCHAR VolumeLabel[1];
797 } FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
798 
799 typedef struct _FILE_FS_VOLUME_INFORMATION
800 {
801  LARGE_INTEGER VolumeCreationTime;
802  ULONG VolumeSerialNumber;
803  ULONG VolumeLabelLength;
804  BOOLEAN SupportsObjects;
805  WCHAR VolumeLabel[1];
806 } FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
807 
808 typedef struct _FILE_FS_SIZE_INFORMATION
809 {
810  LARGE_INTEGER TotalAllocationUnits;
811  LARGE_INTEGER AvailableAllocationUnits;
812  ULONG SectorsPerAllocationUnit;
813  ULONG BytesPerSector;
814 } FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
815 
816 typedef struct _FILE_FS_FULL_SIZE_INFORMATION
817 {
818  LARGE_INTEGER TotalAllocationUnits;
819  LARGE_INTEGER CallerAvailableAllocationUnits;
820  LARGE_INTEGER ActualAvailableAllocationUnits;
821  ULONG SectorsPerAllocationUnit;
822  ULONG BytesPerSector;
823 } FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
824 
825 typedef struct _FILE_FS_OBJECTID_INFORMATION
826 {
827  UCHAR ObjectId[16];
828  UCHAR ExtendedInfo[48];
829 } FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION;
830 
831 typedef struct _FILE_FS_DEVICE_INFORMATION
832 {
833  DEVICE_TYPE DeviceType;
834  ULONG Characteristics;
835 } FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;
836 
837 typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
838 {
839  ULONG FileSystemAttributes;
840  LONG MaximumComponentNameLength;
841  ULONG FileSystemNameLength;
842  WCHAR FileSystemName[1];
843 } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
844 
845 typedef struct _FILE_FS_DRIVER_PATH_INFORMATION
846 {
847  BOOLEAN DriverInPath;
848  ULONG DriverNameLength;
849  WCHAR DriverName[1];
850 } FILE_FS_DRIVER_PATH_INFORMATION, *PFILE_FS_DRIVER_PATH_INFORMATION;
851 
852 typedef struct _FILE_FS_VOLUME_FLAGS_INFORMATION
853 {
854  ULONG Flags;
855 } FILE_FS_VOLUME_FLAGS_INFORMATION, *PFILE_FS_VOLUME_FLAGS_INFORMATION;
856 
857 #define SSINFO_FLAGS_ALIGNED_DEVICE 0x00000001
858 #define SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE 0x00000002
859 
860 // If set for Sector and Partition fields, alignment is not known.
861 #define SSINFO_OFFSET_UNKNOWN 0xffffffff
862 
863 typedef struct _FILE_FS_SECTOR_SIZE_INFORMATION
864 {
865  ULONG LogicalBytesPerSector;
866  ULONG PhysicalBytesPerSectorForAtomicity;
867  ULONG PhysicalBytesPerSectorForPerformance;
868  ULONG FileSystemEffectivePhysicalBytesPerSectorForAtomicity;
869  ULONG Flags;
870  ULONG ByteOffsetForSectorAlignment;
871  ULONG ByteOffsetForPartitionAlignment;
872 } FILE_FS_SECTOR_SIZE_INFORMATION, *PFILE_FS_SECTOR_SIZE_INFORMATION;
873 
874 typedef struct _FILE_FS_METADATA_SIZE_INFORMATION
875 {
876  LARGE_INTEGER TotalMetadataAllocationUnits;
877  ULONG SectorsPerAllocationUnit;
878  ULONG BytesPerSector;
879 } FILE_FS_METADATA_SIZE_INFORMATION, *PFILE_FS_METADATA_SIZE_INFORMATION;
880 
881 // NtNotifyChangeDirectoryFile
882 
883 /*
884 typedef struct _FILE_NOTIFY_INFORMATION
885 {
886  ULONG NextEntryOffset;
887  ULONG Action;
888  ULONG FileNameLength;
889  WCHAR FileName[1];
890 } FILE_NOTIFY_INFORMATION, *PFILE_NOTIFY_INFORMATION;
891 */
892 
893 // System calls
894 
895 NTSYSCALLAPI
896 NTSTATUS
897 NTAPI
898 NtCreateFile(
899  _Out_ PHANDLE FileHandle,
900  _In_ ACCESS_MASK DesiredAccess,
901  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
902  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
903  _In_opt_ PLARGE_INTEGER AllocationSize,
904  _In_ ULONG FileAttributes,
905  _In_ ULONG ShareAccess,
906  _In_ ULONG CreateDisposition,
907  _In_ ULONG CreateOptions,
908  _In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
909  _In_ ULONG EaLength
910  );
911 
912 NTSYSCALLAPI
913 NTSTATUS
914 NTAPI
915 NtCreateNamedPipeFile(
916  _Out_ PHANDLE FileHandle,
917  _In_ ULONG DesiredAccess,
918  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
919  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
920  _In_ ULONG ShareAccess,
921  _In_ ULONG CreateDisposition,
922  _In_ ULONG CreateOptions,
923  _In_ ULONG NamedPipeType,
924  _In_ ULONG ReadMode,
925  _In_ ULONG CompletionMode,
926  _In_ ULONG MaximumInstances,
927  _In_ ULONG InboundQuota,
928  _In_ ULONG OutboundQuota,
929  _In_opt_ PLARGE_INTEGER DefaultTimeout
930  );
931 
932 NTSYSCALLAPI
933 NTSTATUS
934 NTAPI
935 NtCreateMailslotFile(
936  _Out_ PHANDLE FileHandle,
937  _In_ ULONG DesiredAccess,
938  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
939  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
940  _In_ ULONG CreateOptions,
941  _In_ ULONG MailslotQuota,
942  _In_ ULONG MaximumMessageSize,
943  _In_ PLARGE_INTEGER ReadTimeout
944  );
945 
946 NTSYSCALLAPI
947 NTSTATUS
948 NTAPI
949 NtOpenFile(
950  _Out_ PHANDLE FileHandle,
951  _In_ ACCESS_MASK DesiredAccess,
952  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
953  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
954  _In_ ULONG ShareAccess,
955  _In_ ULONG OpenOptions
956  );
957 
958 NTSYSCALLAPI
959 NTSTATUS
960 NTAPI
961 NtDeleteFile(
962  _In_ POBJECT_ATTRIBUTES ObjectAttributes
963  );
964 
965 NTSYSCALLAPI
966 NTSTATUS
967 NTAPI
968 NtFlushBuffersFile(
969  _In_ HANDLE FileHandle,
970  _Out_ PIO_STATUS_BLOCK IoStatusBlock
971  );
972 
973 #define FLUSH_FLAGS_FILE_DATA_ONLY 0x00000001
974 #define FLUSH_FLAGS_NO_SYNC 0x00000002
975 
976 #if (PHNT_VERSION >= PHNT_WIN8)
977 NTSYSCALLAPI
978 NTSTATUS
979 NTAPI
980 NtFlushBuffersFileEx(
981  _In_ HANDLE FileHandle,
982  _In_ ULONG Flags,
983  _In_reads_bytes_(ParametersSize) PVOID Parameters,
984  _In_ ULONG ParametersSize,
985  _Out_ PIO_STATUS_BLOCK IoStatusBlock
986  );
987 #endif
988 
989 NTSYSCALLAPI
990 NTSTATUS
991 NTAPI
992 NtQueryInformationFile(
993  _In_ HANDLE FileHandle,
994  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
995  _Out_writes_bytes_(Length) PVOID FileInformation,
996  _In_ ULONG Length,
997  _In_ FILE_INFORMATION_CLASS FileInformationClass
998  );
999 
1000 NTSYSCALLAPI
1001 NTSTATUS
1002 NTAPI
1003 NtSetInformationFile(
1004  _In_ HANDLE FileHandle,
1005  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1006  _In_reads_bytes_(Length) PVOID FileInformation,
1007  _In_ ULONG Length,
1008  _In_ FILE_INFORMATION_CLASS FileInformationClass
1009  );
1010 
1011 NTSYSCALLAPI
1012 NTSTATUS
1013 NTAPI
1014 NtQueryDirectoryFile(
1015  _In_ HANDLE FileHandle,
1016  _In_opt_ HANDLE Event,
1017  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
1018  _In_opt_ PVOID ApcContext,
1019  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1020  _Out_writes_bytes_(Length) PVOID FileInformation,
1021  _In_ ULONG Length,
1022  _In_ FILE_INFORMATION_CLASS FileInformationClass,
1023  _In_ BOOLEAN ReturnSingleEntry,
1024  _In_opt_ PUNICODE_STRING FileName,
1025  _In_ BOOLEAN RestartScan
1026  );
1027 
1028 NTSYSCALLAPI
1029 NTSTATUS
1030 NTAPI
1031 NtQueryEaFile(
1032  _In_ HANDLE FileHandle,
1033  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1034  _Out_writes_bytes_(Length) PVOID Buffer,
1035  _In_ ULONG Length,
1036  _In_ BOOLEAN ReturnSingleEntry,
1037  _In_reads_bytes_opt_(EaListLength) PVOID EaList,
1038  _In_ ULONG EaListLength,
1039  _In_opt_ PULONG EaIndex,
1040  _In_ BOOLEAN RestartScan
1041  );
1042 
1043 NTSYSCALLAPI
1044 NTSTATUS
1045 NTAPI
1046 NtSetEaFile(
1047  _In_ HANDLE FileHandle,
1048  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1049  _In_reads_bytes_(Length) PVOID Buffer,
1050  _In_ ULONG Length
1051  );
1052 
1053 NTSYSCALLAPI
1054 NTSTATUS
1055 NTAPI
1056 NtQueryQuotaInformationFile(
1057  _In_ HANDLE FileHandle,
1058  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1059  _Out_writes_bytes_(Length) PVOID Buffer,
1060  _In_ ULONG Length,
1061  _In_ BOOLEAN ReturnSingleEntry,
1062  _In_reads_bytes_opt_(SidListLength) PVOID SidList,
1063  _In_ ULONG SidListLength,
1064  _In_opt_ PSID StartSid,
1065  _In_ BOOLEAN RestartScan
1066  );
1067 
1068 NTSYSCALLAPI
1069 NTSTATUS
1070 NTAPI
1071 NtSetQuotaInformationFile(
1072  _In_ HANDLE FileHandle,
1073  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1074  _In_reads_bytes_(Length) PVOID Buffer,
1075  _In_ ULONG Length
1076  );
1077 
1078 NTSYSCALLAPI
1079 NTSTATUS
1080 NTAPI
1081 NtQueryVolumeInformationFile(
1082  _In_ HANDLE FileHandle,
1083  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1084  _Out_writes_bytes_(Length) PVOID FsInformation,
1085  _In_ ULONG Length,
1086  _In_ FSINFOCLASS FsInformationClass
1087  );
1088 
1089 NTSYSCALLAPI
1090 NTSTATUS
1091 NTAPI
1092 NtSetVolumeInformationFile(
1093  _In_ HANDLE FileHandle,
1094  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1095  _In_reads_bytes_(Length) PVOID FsInformation,
1096  _In_ ULONG Length,
1097  _In_ FSINFOCLASS FsInformationClass
1098  );
1099 
1100 NTSYSCALLAPI
1101 NTSTATUS
1102 NTAPI
1103 NtCancelIoFile(
1104  _In_ HANDLE FileHandle,
1105  _Out_ PIO_STATUS_BLOCK IoStatusBlock
1106  );
1107 
1108 #if (PHNT_VERSION >= PHNT_VISTA)
1109 NTSYSCALLAPI
1110 NTSTATUS
1111 NTAPI
1112 NtCancelIoFileEx(
1113  _In_ HANDLE FileHandle,
1114  _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,
1115  _Out_ PIO_STATUS_BLOCK IoStatusBlock
1116  );
1117 #endif
1118 
1119 #if (PHNT_VERSION >= PHNT_VISTA)
1120 NTSYSCALLAPI
1121 NTSTATUS
1122 NTAPI
1123 NtCancelSynchronousIoFile(
1124  _In_ HANDLE ThreadHandle,
1125  _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,
1126  _Out_ PIO_STATUS_BLOCK IoStatusBlock
1127  );
1128 #endif
1129 
1130 NTSYSCALLAPI
1131 NTSTATUS
1132 NTAPI
1133 NtDeviceIoControlFile(
1134  _In_ HANDLE FileHandle,
1135  _In_opt_ HANDLE Event,
1136  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
1137  _In_opt_ PVOID ApcContext,
1138  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1139  _In_ ULONG IoControlCode,
1140  _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
1141  _In_ ULONG InputBufferLength,
1142  _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
1143  _In_ ULONG OutputBufferLength
1144  );
1145 
1146 NTSYSCALLAPI
1147 NTSTATUS
1148 NTAPI
1149 NtFsControlFile(
1150  _In_ HANDLE FileHandle,
1151  _In_opt_ HANDLE Event,
1152  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
1153  _In_opt_ PVOID ApcContext,
1154  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1155  _In_ ULONG FsControlCode,
1156  _In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer,
1157  _In_ ULONG InputBufferLength,
1158  _Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer,
1159  _In_ ULONG OutputBufferLength
1160  );
1161 
1162 NTSYSCALLAPI
1163 NTSTATUS
1164 NTAPI
1165 NtReadFile(
1166  _In_ HANDLE FileHandle,
1167  _In_opt_ HANDLE Event,
1168  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
1169  _In_opt_ PVOID ApcContext,
1170  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1171  _Out_writes_bytes_(Length) PVOID Buffer,
1172  _In_ ULONG Length,
1173  _In_opt_ PLARGE_INTEGER ByteOffset,
1174  _In_opt_ PULONG Key
1175  );
1176 
1177 NTSYSCALLAPI
1178 NTSTATUS
1179 NTAPI
1180 NtWriteFile(
1181  _In_ HANDLE FileHandle,
1182  _In_opt_ HANDLE Event,
1183  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
1184  _In_opt_ PVOID ApcContext,
1185  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1186  _In_reads_bytes_(Length) PVOID Buffer,
1187  _In_ ULONG Length,
1188  _In_opt_ PLARGE_INTEGER ByteOffset,
1189  _In_opt_ PULONG Key
1190  );
1191 
1192 NTSYSCALLAPI
1193 NTSTATUS
1194 NTAPI
1195 NtReadFileScatter(
1196  _In_ HANDLE FileHandle,
1197  _In_opt_ HANDLE Event,
1198  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
1199  _In_opt_ PVOID ApcContext,
1200  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1201  _In_ PFILE_SEGMENT_ELEMENT SegmentArray,
1202  _In_ ULONG Length,
1203  _In_opt_ PLARGE_INTEGER ByteOffset,
1204  _In_opt_ PULONG Key
1205  );
1206 
1207 NTSYSCALLAPI
1208 NTSTATUS
1209 NTAPI
1210 NtWriteFileGather(
1211  _In_ HANDLE FileHandle,
1212  _In_opt_ HANDLE Event,
1213  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
1214  _In_opt_ PVOID ApcContext,
1215  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1216  _In_ PFILE_SEGMENT_ELEMENT SegmentArray,
1217  _In_ ULONG Length,
1218  _In_opt_ PLARGE_INTEGER ByteOffset,
1219  _In_opt_ PULONG Key
1220  );
1221 
1222 NTSYSCALLAPI
1223 NTSTATUS
1224 NTAPI
1225 NtLockFile(
1226  _In_ HANDLE FileHandle,
1227  _In_opt_ HANDLE Event,
1228  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
1229  _In_opt_ PVOID ApcContext,
1230  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1231  _In_ PLARGE_INTEGER ByteOffset,
1232  _In_ PLARGE_INTEGER Length,
1233  _In_ ULONG Key,
1234  _In_ BOOLEAN FailImmediately,
1235  _In_ BOOLEAN ExclusiveLock
1236  );
1237 
1238 NTSYSCALLAPI
1239 NTSTATUS
1240 NTAPI
1241 NtUnlockFile(
1242  _In_ HANDLE FileHandle,
1243  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1244  _In_ PLARGE_INTEGER ByteOffset,
1245  _In_ PLARGE_INTEGER Length,
1246  _In_ ULONG Key
1247  );
1248 
1249 NTSYSCALLAPI
1250 NTSTATUS
1251 NTAPI
1252 NtQueryAttributesFile(
1253  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
1254  _Out_ PFILE_BASIC_INFORMATION FileInformation
1255  );
1256 
1257 NTSYSCALLAPI
1258 NTSTATUS
1259 NTAPI
1260 NtQueryFullAttributesFile(
1261  _In_ POBJECT_ATTRIBUTES ObjectAttributes,
1262  _Out_ PFILE_NETWORK_OPEN_INFORMATION FileInformation
1263  );
1264 
1265 NTSYSCALLAPI
1266 NTSTATUS
1267 NTAPI
1268 NtNotifyChangeDirectoryFile(
1269  _In_ HANDLE FileHandle,
1270  _In_opt_ HANDLE Event,
1271  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
1272  _In_opt_ PVOID ApcContext,
1273  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1274  _Out_writes_bytes_(Length) PVOID Buffer,
1275  _In_ ULONG Length,
1276  _In_ ULONG CompletionFilter,
1277  _In_ BOOLEAN WatchTree
1278  );
1279 
1280 NTSYSCALLAPI
1281 NTSTATUS
1282 NTAPI
1283 NtLoadDriver(
1284  _In_ PUNICODE_STRING DriverServiceName
1285  );
1286 
1287 NTSYSCALLAPI
1288 NTSTATUS
1289 NTAPI
1290 NtUnloadDriver(
1291  _In_ PUNICODE_STRING DriverServiceName
1292  );
1293 
1294 // I/O completion port
1295 
1296 #ifndef IO_COMPLETION_QUERY_STATE
1297 #define IO_COMPLETION_QUERY_STATE 0x0001
1298 #endif
1299 
1300 typedef enum _IO_COMPLETION_INFORMATION_CLASS
1301 {
1302  IoCompletionBasicInformation
1303 } IO_COMPLETION_INFORMATION_CLASS;
1304 
1305 typedef struct _IO_COMPLETION_BASIC_INFORMATION
1306 {
1307  LONG Depth;
1308 } IO_COMPLETION_BASIC_INFORMATION, *PIO_COMPLETION_BASIC_INFORMATION;
1309 
1310 NTSYSCALLAPI
1311 NTSTATUS
1312 NTAPI
1313 NtCreateIoCompletion(
1314  _Out_ PHANDLE IoCompletionHandle,
1315  _In_ ACCESS_MASK DesiredAccess,
1316  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
1317  _In_opt_ ULONG Count
1318  );
1319 
1320 NTSYSCALLAPI
1321 NTSTATUS
1322 NTAPI
1323 NtOpenIoCompletion(
1324  _Out_ PHANDLE IoCompletionHandle,
1325  _In_ ACCESS_MASK DesiredAccess,
1326  _In_ POBJECT_ATTRIBUTES ObjectAttributes
1327  );
1328 
1329 NTSYSCALLAPI
1330 NTSTATUS
1331 NTAPI
1332 NtQueryIoCompletion(
1333  _In_ HANDLE IoCompletionHandle,
1334  _In_ IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass,
1335  _Out_writes_bytes_(IoCompletionInformation) PVOID IoCompletionInformation,
1336  _In_ ULONG IoCompletionInformationLength,
1337  _Out_opt_ PULONG ReturnLength
1338  );
1339 
1340 NTSYSCALLAPI
1341 NTSTATUS
1342 NTAPI
1343 NtSetIoCompletion(
1344  _In_ HANDLE IoCompletionHandle,
1345  _In_opt_ PVOID KeyContext,
1346  _In_opt_ PVOID ApcContext,
1347  _In_ NTSTATUS IoStatus,
1348  _In_ ULONG_PTR IoStatusInformation
1349  );
1350 
1351 #if (PHNT_VERSION >= PHNT_WIN7)
1352 NTSYSCALLAPI
1353 NTSTATUS
1354 NTAPI
1355 NtSetIoCompletionEx(
1356  _In_ HANDLE IoCompletionHandle,
1357  _In_ HANDLE IoCompletionPacketHandle,
1358  _In_opt_ PVOID KeyContext,
1359  _In_opt_ PVOID ApcContext,
1360  _In_ NTSTATUS IoStatus,
1361  _In_ ULONG_PTR IoStatusInformation
1362  );
1363 #endif
1364 
1365 NTSYSCALLAPI
1366 NTSTATUS
1367 NTAPI
1368 NtRemoveIoCompletion(
1369  _In_ HANDLE IoCompletionHandle,
1370  _Out_ PVOID *KeyContext,
1371  _Out_ PVOID *ApcContext,
1372  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
1373  _In_opt_ PLARGE_INTEGER Timeout
1374  );
1375 
1376 #if (PHNT_VERSION >= PHNT_VISTA)
1377 NTSYSCALLAPI
1378 NTSTATUS
1379 NTAPI
1380 NtRemoveIoCompletionEx(
1381  _In_ HANDLE IoCompletionHandle,
1382  _Out_writes_to_(Count, *NumEntriesRemoved) PFILE_IO_COMPLETION_INFORMATION IoCompletionInformation,
1383  _In_ ULONG Count,
1384  _Out_ PULONG NumEntriesRemoved,
1385  _In_opt_ PLARGE_INTEGER Timeout,
1386  _In_ BOOLEAN Alertable
1387  );
1388 #endif
1389 
1390 // Wait completion packet
1391 
1392 #if (PHNT_VERSION >= PHNT_WIN8)
1393 
1394 NTSYSCALLAPI
1395 NTSTATUS
1396 NTAPI
1397 NtCreateWaitCompletionPacket(
1398  _Out_ PHANDLE WaitCompletionPacketHandle,
1399  _In_ ACCESS_MASK DesiredAccess,
1400  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes
1401  );
1402 
1403 NTSYSCALLAPI
1404 NTSTATUS
1405 NTAPI
1406 NtAssociateWaitCompletionPacket(
1407  _In_ HANDLE WaitCompletionPacketHandle,
1408  _In_ HANDLE IoCompletionHandle,
1409  _In_ HANDLE TargetObjectHandle,
1410  _In_opt_ PVOID KeyContext,
1411  _In_opt_ PVOID ApcContext,
1412  _In_ NTSTATUS IoStatus,
1413  _In_ ULONG_PTR IoStatusInformation,
1414  _Out_opt_ PBOOLEAN AlreadySignaled
1415  );
1416 
1417 NTSYSCALLAPI
1418 NTSTATUS
1419 NTAPI
1420 NtCancelWaitCompletionPacket(
1421  _In_ HANDLE WaitCompletionPacketHandle,
1422  _In_ BOOLEAN RemoveSignaledPacket
1423  );
1424 
1425 #endif
1426 
1427 // Sessions
1428 
1429 typedef enum _IO_SESSION_EVENT
1430 {
1431  IoSessionEventIgnore,
1432  IoSessionEventCreated,
1433  IoSessionEventTerminated,
1434  IoSessionEventConnected,
1435  IoSessionEventDisconnected,
1436  IoSessionEventLogon,
1437  IoSessionEventLogoff,
1438  IoSessionEventMax
1439 } IO_SESSION_EVENT;
1440 
1441 typedef enum _IO_SESSION_STATE
1442 {
1443  IoSessionStateCreated,
1444  IoSessionStateInitialized,
1445  IoSessionStateConnected,
1446  IoSessionStateDisconnected,
1447  IoSessionStateDisconnectedLoggedOn,
1448  IoSessionStateLoggedOn,
1449  IoSessionStateLoggedOff,
1450  IoSessionStateTerminated,
1451  IoSessionStateMax
1452 } IO_SESSION_STATE;
1453 
1454 #if (PHNT_VERSION >= PHNT_WIN7)
1455 NTSYSCALLAPI
1456 NTSTATUS
1457 NTAPI
1458 NtNotifyChangeSession(
1459  _In_ HANDLE SessionHandle,
1460  _In_ ULONG ChangeSequenceNumber,
1461  _In_ PLARGE_INTEGER ChangeTimeStamp,
1462  _In_ IO_SESSION_EVENT Event,
1463  _In_ IO_SESSION_STATE NewState,
1464  _In_ IO_SESSION_STATE PreviousState,
1465  _In_reads_bytes_opt_(PayloadSize) PVOID Payload,
1466  _In_ ULONG PayloadSize
1467  );
1468 #endif
1469 
1470 // Other types
1471 
1472 typedef enum _INTERFACE_TYPE
1473 {
1474  InterfaceTypeUndefined = -1,
1475  Internal,
1476  Isa,
1477  Eisa,
1478  MicroChannel,
1479  TurboChannel,
1480  PCIBus,
1481  VMEBus,
1482  NuBus,
1483  PCMCIABus,
1484  CBus,
1485  MPIBus,
1486  MPSABus,
1487  ProcessorInternal,
1488  InternalPowerBus,
1489  PNPISABus,
1490  PNPBus,
1491  Vmcs,
1492  MaximumInterfaceType
1493 } INTERFACE_TYPE, *PINTERFACE_TYPE;
1494 
1495 typedef enum _DMA_WIDTH
1496 {
1497  Width8Bits,
1498  Width16Bits,
1499  Width32Bits,
1500  MaximumDmaWidth
1501 } DMA_WIDTH, *PDMA_WIDTH;
1502 
1503 typedef enum _DMA_SPEED
1504 {
1505  Compatible,
1506  TypeA,
1507  TypeB,
1508  TypeC,
1509  TypeF,
1510  MaximumDmaSpeed
1511 } DMA_SPEED, *PDMA_SPEED;
1512 
1513 typedef enum _BUS_DATA_TYPE
1514 {
1515  ConfigurationSpaceUndefined = -1,
1516  Cmos,
1517  EisaConfiguration,
1518  Pos,
1519  CbusConfiguration,
1520  PCIConfiguration,
1521  VMEConfiguration,
1522  NuBusConfiguration,
1523  PCMCIAConfiguration,
1524  MPIConfiguration,
1525  MPSAConfiguration,
1526  PNPISAConfiguration,
1527  SgiInternalConfiguration,
1528  MaximumBusDataType
1529 } BUS_DATA_TYPE, *PBUS_DATA_TYPE;
1530 
1531 // Control structures
1532 
1533 // Reparse structure for FSCTL_SET_REPARSE_POINT, FSCTL_GET_REPARSE_POINT, FSCTL_DELETE_REPARSE_POINT
1534 
1535 #define SYMLINK_FLAG_RELATIVE 1
1536 
1537 typedef struct _REPARSE_DATA_BUFFER
1538 {
1539  ULONG ReparseTag;
1540  USHORT ReparseDataLength;
1541  USHORT Reserved;
1542  union
1543  {
1544  struct
1545  {
1546  USHORT SubstituteNameOffset;
1547  USHORT SubstituteNameLength;
1548  USHORT PrintNameOffset;
1549  USHORT PrintNameLength;
1550  ULONG Flags;
1551  WCHAR PathBuffer[1];
1552  } SymbolicLinkReparseBuffer;
1553  struct
1554  {
1555  USHORT SubstituteNameOffset;
1556  USHORT SubstituteNameLength;
1557  USHORT PrintNameOffset;
1558  USHORT PrintNameLength;
1559  WCHAR PathBuffer[1];
1560  } MountPointReparseBuffer;
1561  struct
1562  {
1563  UCHAR DataBuffer[1];
1564  } GenericReparseBuffer;
1565  };
1566 } REPARSE_DATA_BUFFER, *PREPARSE_DATA_BUFFER;
1567 
1568 // Named pipe FS control definitions
1569 
1570 #define FSCTL_PIPE_ASSIGN_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
1571 #define FSCTL_PIPE_DISCONNECT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
1572 #define FSCTL_PIPE_LISTEN CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
1573 #define FSCTL_PIPE_PEEK CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
1574 #define FSCTL_PIPE_QUERY_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
1575 #define FSCTL_PIPE_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
1576 #define FSCTL_PIPE_WAIT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
1577 #define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
1578 #define FSCTL_PIPE_SET_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
1579 #define FSCTL_PIPE_QUERY_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
1580 #define FSCTL_PIPE_GET_PIPE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
1581 #define FSCTL_PIPE_SET_PIPE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
1582 #define FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
1583 #define FSCTL_PIPE_SET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 13, METHOD_BUFFERED, FILE_ANY_ACCESS)
1584 #define FSCTL_PIPE_GET_HANDLE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 14, METHOD_BUFFERED, FILE_ANY_ACCESS)
1585 #define FSCTL_PIPE_SET_HANDLE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
1586 #define FSCTL_PIPE_FLUSH CTL_CODE(FILE_DEVICE_NAMED_PIPE, 16, METHOD_BUFFERED, FILE_WRITE_DATA)
1587 
1588 #define FSCTL_PIPE_INTERNAL_READ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
1589 #define FSCTL_PIPE_INTERNAL_WRITE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
1590 #define FSCTL_PIPE_INTERNAL_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
1591 #define FSCTL_PIPE_INTERNAL_READ_OVFLOW CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
1592 
1593 // Flags for query event
1594 
1595 #define FILE_PIPE_READ_DATA 0x00000000
1596 #define FILE_PIPE_WRITE_SPACE 0x00000001
1597 
1598 // Input for FSCTL_PIPE_ASSIGN_EVENT
1599 typedef struct _FILE_PIPE_ASSIGN_EVENT_BUFFER
1600 {
1601  HANDLE EventHandle;
1602  ULONG KeyValue;
1603 } FILE_PIPE_ASSIGN_EVENT_BUFFER, *PFILE_PIPE_ASSIGN_EVENT_BUFFER;
1604 
1605 // Output for FILE_PIPE_PEEK_BUFFER
1606 typedef struct _FILE_PIPE_PEEK_BUFFER
1607 {
1608  ULONG NamedPipeState;
1609  ULONG ReadDataAvailable;
1610  ULONG NumberOfMessages;
1611  ULONG MessageLength;
1612  CHAR Data[1];
1613 } FILE_PIPE_PEEK_BUFFER, *PFILE_PIPE_PEEK_BUFFER;
1614 
1615 // Output for FSCTL_PIPE_QUERY_EVENT
1616 typedef struct _FILE_PIPE_EVENT_BUFFER
1617 {
1618  ULONG NamedPipeState;
1619  ULONG EntryType;
1620  ULONG ByteCount;
1621  ULONG KeyValue;
1622  ULONG NumberRequests;
1623 } FILE_PIPE_EVENT_BUFFER, *PFILE_PIPE_EVENT_BUFFER;
1624 
1625 // Input for FSCTL_PIPE_WAIT
1626 typedef struct _FILE_PIPE_WAIT_FOR_BUFFER
1627 {
1628  LARGE_INTEGER Timeout;
1629  ULONG NameLength;
1630  BOOLEAN TimeoutSpecified;
1631  WCHAR Name[1];
1632 } FILE_PIPE_WAIT_FOR_BUFFER, *PFILE_PIPE_WAIT_FOR_BUFFER;
1633 
1634 // Input for FSCTL_PIPE_SET_CLIENT_PROCESS, Output for FSCTL_PIPE_QUERY_CLIENT_PROCESS
1635 typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER
1636 {
1637 #if !defined(BUILD_WOW6432)
1638  PVOID ClientSession;
1639  PVOID ClientProcess;
1640 #else
1641  ULONGLONG ClientSession;
1642  ULONGLONG ClientProcess;
1643 #endif
1644 } FILE_PIPE_CLIENT_PROCESS_BUFFER, *PFILE_PIPE_CLIENT_PROCESS_BUFFER;
1645 
1646 #define FILE_PIPE_COMPUTER_NAME_LENGTH 15
1647 
1648 // Input for FSCTL_PIPE_SET_CLIENT_PROCESS, Output for FSCTL_PIPE_QUERY_CLIENT_PROCESS
1649 typedef struct _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX
1650 {
1651 #if !defined(BUILD_WOW6432)
1652  PVOID ClientSession;
1653  PVOID ClientProcess;
1654 #else
1655  ULONGLONG ClientSession;
1656  ULONGLONG ClientProcess;
1657 #endif
1658  USHORT ClientComputerNameLength; // in bytes
1659  WCHAR ClientComputerBuffer[FILE_PIPE_COMPUTER_NAME_LENGTH + 1]; // null-terminated
1660 } FILE_PIPE_CLIENT_PROCESS_BUFFER_EX, *PFILE_PIPE_CLIENT_PROCESS_BUFFER_EX;
1661 
1662 // Mailslot FS control definitions
1663 
1664 #define MAILSLOT_CLASS_FIRSTCLASS 1
1665 #define MAILSLOT_CLASS_SECONDCLASS 2
1666 
1667 #define FSCTL_MAILSLOT_PEEK CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)
1668 
1669 // Output for FSCTL_MAILSLOT_PEEK
1670 typedef struct _FILE_MAILSLOT_PEEK_BUFFER
1671 {
1672  ULONG ReadDataAvailable;
1673  ULONG NumberOfMessages;
1674  ULONG MessageLength;
1675 } FILE_MAILSLOT_PEEK_BUFFER, *PFILE_MAILSLOT_PEEK_BUFFER;
1676 
1677 #endif