Process Hacker
phbase.h File Reference
#include <ntwin.h>
#include <ntbasic.h>
#include <phnt.h>
#include <phsup.h>
#include <ref.h>
#include <fastlock.h>
#include <queuedlock.h>

Go to the source code of this file.

Data Structures

struct  _PH_EVENT
 A fast event object. More...
 
struct  _PH_BARRIER
 
struct  _PH_RUNDOWN_PROTECT
 
struct  _PH_RUNDOWN_WAIT_BLOCK
 
struct  _PH_INITONCE
 
struct  _PH_STRINGREF
 
struct  _PH_BYTESREF
 
struct  _PH_RELATIVE_BYTESREF
 
struct  _PH_STRING
 A 16-bit string object, which supports UTF-16. More...
 
struct  _PH_BYTES
 An 8-bit string object, which supports ASCII, UTF-8 and Windows multi-byte encodings, as well as binary data. More...
 
struct  _PH_UNICODE_DECODER
 
struct  _PH_STRING_BUILDER
 A string builder structure. More...
 
struct  _PH_BYTES_BUILDER
 A byte string builder structure. More...
 
struct  _PH_LIST
 A list structure. More...
 
struct  _PH_POINTER_LIST
 A pointer list structure. More...
 
struct  _PH_HASH_ENTRY
 
struct  _PH_HASHTABLE_ENTRY
 
struct  _PH_HASHTABLE
 A hashtable structure. More...
 
struct  _PH_HASHTABLE_ENUM_CONTEXT
 
struct  _PH_KEY_VALUE_PAIR
 
struct  _PH_FREE_LIST
 
struct  _PH_FREE_LIST_ENTRY
 
struct  _PH_CALLBACK_REGISTRATION
 A callback registration structure. More...
 
struct  _PH_CALLBACK
 A callback structure. More...
 
struct  _PH_FORMAT
 Describes an element to be formatted to a string. More...
 
struct  _PH_AVL_LINKS
 
struct  _PH_AVL_TREE
 
struct  _PH_HANDLE_TABLE_ENTRY
 
struct  _PH_HANDLE_TABLE_BASIC_INFORMATION
 
struct  _PH_HANDLE_TABLE_FLAGS_INFORMATION
 
struct  _PH_WORK_QUEUE
 
struct  _PH_WORK_QUEUE_ITEM
 

Macros

#define UNICODE
 
#define PHLIBAPI
 
#define _User_set_
 
#define WINDOWS_ANCIENT   0
 
#define WINDOWS_XP   51
 
#define WINDOWS_SERVER_2003   52
 
#define WINDOWS_VISTA   60
 
#define WINDOWS_7   61
 
#define WINDOWS_8   62
 
#define WINDOWS_8_1   63
 
#define WINDOWS_10   100
 
#define WINDOWS_NEW   MAXLONG
 
#define WINDOWS_HAS_CONSOLE_HOST   (WindowsVersion >= WINDOWS_7)
 
#define WINDOWS_HAS_CYCLE_TIME   (WindowsVersion >= WINDOWS_VISTA)
 
#define WINDOWS_HAS_IFILEDIALOG   (WindowsVersion >= WINDOWS_VISTA)
 
#define WINDOWS_HAS_IMAGE_FILE_NAME_BY_PROCESS_ID   (WindowsVersion >= WINDOWS_VISTA)
 
#define WINDOWS_HAS_IMMERSIVE   (WindowsVersion >= WINDOWS_8)
 
#define WINDOWS_HAS_LIMITED_ACCESS   (WindowsVersion >= WINDOWS_VISTA)
 
#define WINDOWS_HAS_PSSUSPENDRESUMEPROCESS   (WindowsVersion >= WINDOWS_VISTA)
 
#define WINDOWS_HAS_SERVICE_TAGS   (WindowsVersion >= WINDOWS_VISTA)
 
#define WINDOWS_HAS_UAC   (WindowsVersion >= WINDOWS_VISTA)
 
#define dprintf(format,...)
 
#define PHLIB_INIT_MODULE_RESERVED1   0x1
 
#define PHLIB_INIT_MODULE_RESERVED2   0x2
 
#define PHLIB_INIT_MODULE_WORK_QUEUE   0x4
 Needed to use work queues.
 
#define PHLIB_INIT_MODULE_HANDLE_TABLE   0x8
 Needed to use handle tables.
 
#define PHLIB_INIT_MODULE_IO_SUPPORT   0x10
 Needed to use file streams.
 
#define PHLIB_INIT_MODULE_SYMBOL_PROVIDER   0x20
 Needed to use symbol providers.
 
#define PHLIB_INIT_MODULE_RESERVED3   0x40
 
#define PHLIB_INIT_TOKEN_INFO   0x100000
 Retrieves token information (e.g.
 
#define PH_EVENT_SET   0x1
 
#define PH_EVENT_SET_SHIFT   0
 
#define PH_EVENT_REFCOUNT_SHIFT   1
 
#define PH_EVENT_REFCOUNT_INC   0x2
 
#define PH_EVENT_REFCOUNT_MASK   (((ULONG_PTR)1 << 15) - 1)
 
#define PH_EVENT_INIT   { { PH_EVENT_REFCOUNT_INC }, NULL }
 
#define PhSetEvent   PhfSetEvent
 
#define PhResetEvent   PhfResetEvent
 
#define PH_BARRIER_COUNT_SHIFT   0
 
#define PH_BARRIER_COUNT_MASK   (((LONG_PTR)1 << (sizeof(ULONG_PTR) * 8 / 2 - 1)) - 1)
 
#define PH_BARRIER_COUNT_INC   ((LONG_PTR)1 << PH_BARRIER_COUNT_SHIFT)
 
#define PH_BARRIER_TARGET_SHIFT   (sizeof(ULONG_PTR) * 8 / 2)
 
#define PH_BARRIER_TARGET_MASK   (((LONG_PTR)1 << (sizeof(ULONG_PTR) * 8 / 2 - 1)) - 1)
 
#define PH_BARRIER_TARGET_INC   ((LONG_PTR)1 << PH_BARRIER_TARGET_SHIFT)
 
#define PH_BARRIER_WAKING   ((LONG_PTR)1 << (sizeof(ULONG_PTR) * 8 - 1))
 
#define PH_BARRIER_MASTER   1
 
#define PH_BARRIER_SLAVE   2
 
#define PH_BARRIER_OBSERVER   3
 
#define PH_BARRIER_INIT(Target)   { (ULONG_PTR)(Target) << PH_BARRIER_TARGET_SHIFT, PH_QUEUED_LOCK_INIT }
 
#define PhWaitForBarrier   PhfWaitForBarrier
 
#define PH_RUNDOWN_ACTIVE   0x1
 
#define PH_RUNDOWN_REF_SHIFT   1
 
#define PH_RUNDOWN_REF_INC   0x2
 
#define PH_RUNDOWN_PROTECT_INIT   { 0 }
 
#define PH_INITONCE_SHIFT   31
 
#define PH_INITONCE_INITIALIZING   (0x1 << PH_INITONCE_SHIFT)
 
#define PH_INITONCE_INITIALIZING_SHIFT   PH_INITONCE_SHIFT
 
#define PH_INITONCE_INIT   { PH_EVENT_INIT }
 
#define PhInitializeInitOnce   PhfInitializeInitOnce
 
#define PhEndInitOnce   PhfEndInitOnce
 
#define PH_STRINGREF_INIT(String)   { sizeof(String) - sizeof(WCHAR), (String) }
 
#define PH_BYTESREF_INIT(String)   { sizeof(String) - sizeof(CHAR), (String) }
 
#define PH_SPLIT_AT_CHAR_SET   0x0
 
#define PH_SPLIT_AT_STRING   0x1
 
#define PH_SPLIT_AT_RANGE   0x2
 
#define PH_SPLIT_CASE_INSENSITIVE   0x1000
 
#define PH_SPLIT_COMPLEMENT_CHAR_SET   0x2000
 
#define PH_SPLIT_START_AT_END   0x4000
 
#define PH_SPLIT_CHAR_SET_IS_UPPERCASE   0x8000
 
#define PH_TRIM_START_ONLY   0x1
 
#define PH_TRIM_END_ONLY   0x2
 
#define PH_CONCAT_STRINGS_LENGTH_CACHE_SIZE   16
 
#define PH_UNICODE_BYTE_ORDER_MARK   0xfeff
 
#define PH_UNICODE_MAX_CODE_POINT   0x10ffff
 
#define PH_UNICODE_UTF16_TO_HIGH_SURROGATE(CodePoint)   ((USHORT)((CodePoint) >> 10) + 0xd7c0)
 
#define PH_UNICODE_UTF16_TO_LOW_SURROGATE(CodePoint)   ((USHORT)((CodePoint) & 0x3ff) + 0xdc00)
 
#define PH_UNICODE_UTF16_IS_HIGH_SURROGATE(CodeUnit)   ((CodeUnit) >= 0xd800 && (CodeUnit) <= 0xdbff)
 
#define PH_UNICODE_UTF16_IS_LOW_SURROGATE(CodeUnit)   ((CodeUnit) >= 0xdc00 && (CodeUnit) <= 0xdfff)
 
#define PH_UNICODE_UTF16_TO_CODE_POINT(HighSurrogate, LowSurrogate)   (((ULONG)(HighSurrogate) << 10) + (ULONG)(LowSurrogate) - 0x35fdc00)
 
#define PH_UNICODE_UTF8   0
 
#define PH_UNICODE_UTF16   1
 
#define PH_UNICODE_UTF32   2
 
#define PH_IS_LIST_POINTER_VALID(Pointer)   (!((ULONG_PTR)(Pointer) & 0x1))
 
#define PH_HASH_SET_INIT   { 0 }
 
#define PH_HASH_SET_SIZE(Buckets)   (sizeof(Buckets) / sizeof(PPH_HASH_ENTRY))
 
#define PH_HASHTABLE_POWER_OF_TWO_SIZE
 
#define PH_HASHTABLE_ENTRY_SIZE(InnerSize)   (FIELD_OFFSET(PH_HASHTABLE_ENTRY, Body) + (InnerSize))
 
#define PH_HASHTABLE_GET_ENTRY(Hashtable, Index)
 
#define PH_HASHTABLE_GET_ENTRY_INDEX(Hashtable, Entry)
 
#define PH_CALLBACK_DECLARE(Name)   PH_CALLBACK Name = { &Name.ListHead, &Name.ListHead, PH_QUEUED_LOCK_INIT, PH_QUEUED_LOCK_INIT }
 
#define PH_TIMESPAN_STR_LEN   30
 
#define PH_TIMESPAN_STR_LEN_1   (PH_TIMESPAN_STR_LEN + 1)
 
#define PH_TIMESPAN_HMS   0
 
#define PH_TIMESPAN_HMSM   1
 
#define PH_TIMESPAN_DHMS   2
 
#define PhInitFormatC(f, v)   do { (f)->Type = CharFormatType; (f)->u.Char = (v); } while (0)
 
#define PhInitFormatS(f, v)   do { (f)->Type = StringFormatType; PhInitializeStringRef(&(f)->u.String, (v)); } while (0)
 
#define PhInitFormatSR(f, v)   do { (f)->Type = StringFormatType; (f)->u.String = (v); } while (0)
 
#define PhInitFormatMultiByteS(f, v)   do { (f)->Type = MultiByteStringFormatType; PhInitializeBytesRef(&(f)->u.MultiByteString, (v)); } while (0)
 
#define PhInitFormatD(f, v)   do { (f)->Type = Int32FormatType; (f)->u.Int32 = (v); } while (0)
 
#define PhInitFormatU(f, v)   do { (f)->Type = UInt32FormatType; (f)->u.UInt32 = (v); } while (0)
 
#define PhInitFormatX(f, v)   do { (f)->Type = UInt32FormatType | FormatUseRadix; (f)->u.UInt32 = (v); (f)->Radix = 16; } while (0)
 
#define PhInitFormatI64D(f, v)   do { (f)->Type = Int64FormatType; (f)->u.Int64 = (v); } while (0)
 
#define PhInitFormatI64U(f, v)   do { (f)->Type = UInt64FormatType; (f)->u.UInt64 = (v); } while (0)
 
#define PhInitFormatI64X(f, v)   do { (f)->Type = UInt64FormatType | FormatUseRadix; (f)->u.UInt64 = (v); (f)->Radix = 16; } while (0)
 
#define PhInitFormatIU(f, v)   do { (f)->Type = UIntPtrFormatType; (f)->u.UIntPtr = (v); } while (0)
 
#define PhInitFormatIX(f, v)   do { (f)->Type = UIntPtrFormatType | FormatUseRadix; (f)->u.UIntPtr = (v); (f)->Radix = 16; } while (0)
 
#define PhInitFormatF(f, v, p)   do { (f)->Type = DoubleFormatType | FormatUsePrecision; (f)->u.Double = (v); (f)->Precision = (p); } while (0)
 
#define PhInitFormatE(f, v, p)   do { (f)->Type = DoubleFormatType | FormatStandardForm | FormatUsePrecision; (f)->u.Double = (v); (f)->Precision = (p); } while (0)
 
#define PhInitFormatA(f, v, p)   do { (f)->Type = DoubleFormatType | FormatHexadecimalForm | FormatUsePrecision; (f)->u.Double = (v); (f)->Precision = (p); } while (0)
 
#define PhInitFormatSize(f, v)   do { (f)->Type = SizeFormatType; (f)->u.Size = (v); } while (0)
 
#define PhIsLeftChildElement(Links)   ((Links)->Parent->Left == (Links))
 
#define PhIsRightChildElement(Links)   ((Links)->Parent->Right == (Links))
 
#define PH_AVL_TREE_INIT(CompareFunction)   { { NULL, NULL, NULL, 0 }, 0, CompareFunction }
 
#define PhRootElementAvlTree(Tree)   ((Tree)->Root.Right)
 
#define PH_HANDLE_TABLE_SAFE
 
#define PH_HANDLE_TABLE_FREE_COUNT   64
 
#define PH_HANDLE_TABLE_STRICT_FIFO   0x1
 
#define PH_HANDLE_TABLE_VALID_FLAGS   0x1
 

Typedefs

typedef struct _PH_STRINGPPH_STRING
 
typedef struct _PH_PROVIDER_THREAD PH_PROVIDER_THREAD
 
typedef struct
_PH_STARTUP_PARAMETERS 
PH_STARTUP_PARAMETERS
 
typedef struct _PH_OBJECT_TYPEPPH_OBJECT_TYPE
 
typedef struct _PH_EVENT PH_EVENT
 A fast event object.
 
typedef struct _PH_EVENTPPH_EVENT
 
typedef struct _PH_BARRIER PH_BARRIER
 
typedef struct _PH_BARRIERPPH_BARRIER
 
typedef struct _PH_RUNDOWN_PROTECT PH_RUNDOWN_PROTECT
 
typedef struct
_PH_RUNDOWN_PROTECT
PPH_RUNDOWN_PROTECT
 
typedef struct
_PH_RUNDOWN_WAIT_BLOCK 
PH_RUNDOWN_WAIT_BLOCK
 
typedef struct
_PH_RUNDOWN_WAIT_BLOCK
PPH_RUNDOWN_WAIT_BLOCK
 
typedef struct _PH_INITONCE PH_INITONCE
 
typedef struct _PH_INITONCEPPH_INITONCE
 
typedef struct _PH_STRINGREF PH_STRINGREF
 
typedef struct _PH_STRINGREFPPH_STRINGREF
 
typedef struct _PH_BYTESREF PH_BYTESREF
 
typedef struct _PH_BYTESREFPPH_BYTESREF
 
typedef struct
_PH_RELATIVE_BYTESREF 
PH_RELATIVE_BYTESREF
 
typedef struct
_PH_RELATIVE_BYTESREF
PPH_RELATIVE_BYTESREF
 
typedef struct
_PH_RELATIVE_BYTESREF 
PH_RELATIVE_STRINGREF
 
typedef struct
_PH_RELATIVE_BYTESREF
PPH_RELATIVE_STRINGREF
 
typedef struct _PH_STRING PH_STRING
 A 16-bit string object, which supports UTF-16.
 
typedef struct _PH_BYTES PH_BYTES
 An 8-bit string object, which supports ASCII, UTF-8 and Windows multi-byte encodings, as well as binary data.
 
typedef struct _PH_BYTESPPH_BYTES
 
typedef struct _PH_UNICODE_DECODER PH_UNICODE_DECODER
 
typedef struct
_PH_UNICODE_DECODER
PPH_UNICODE_DECODER
 
typedef struct _PH_STRING_BUILDER PH_STRING_BUILDER
 A string builder structure.
 
typedef struct _PH_STRING_BUILDERPPH_STRING_BUILDER
 
typedef struct _PH_BYTES_BUILDER PH_BYTES_BUILDER
 A byte string builder structure.
 
typedef struct _PH_BYTES_BUILDERPPH_BYTES_BUILDER
 
typedef struct _PH_LIST PH_LIST
 A list structure.
 
typedef struct _PH_LISTPPH_LIST
 
typedef LONG(NTAPI * PPH_COMPARE_FUNCTION )(_In_ PVOID Item1, _In_ PVOID Item2, _In_opt_ PVOID Context)
 A comparison function.
 
typedef struct _PH_POINTER_LIST PH_POINTER_LIST
 A pointer list structure.
 
typedef struct _PH_POINTER_LISTPPH_POINTER_LIST
 
typedef struct _PH_HASH_ENTRY PH_HASH_ENTRY
 
typedef struct _PH_HASH_ENTRYPPH_HASH_ENTRY
 
typedef struct _PH_HASHTABLE_ENTRY PH_HASHTABLE_ENTRY
 
typedef struct
_PH_HASHTABLE_ENTRY
PPH_HASHTABLE_ENTRY
 
typedef BOOLEAN(NTAPI * PPH_HASHTABLE_COMPARE_FUNCTION )(_In_ PVOID Entry1, _In_ PVOID Entry2)
 A comparison function used by a hashtable.
 
typedef ULONG(NTAPI * PPH_HASHTABLE_HASH_FUNCTION )(_In_ PVOID Entry)
 A hash function used by a hashtable.
 
typedef struct _PH_HASHTABLE PH_HASHTABLE
 A hashtable structure.
 
typedef struct _PH_HASHTABLEPPH_HASHTABLE
 
typedef struct
_PH_HASHTABLE_ENUM_CONTEXT 
PH_HASHTABLE_ENUM_CONTEXT
 
typedef struct
_PH_HASHTABLE_ENUM_CONTEXT
PPH_HASHTABLE_ENUM_CONTEXT
 
typedef struct _PH_KEY_VALUE_PAIR PH_KEY_VALUE_PAIR
 
typedef struct _PH_KEY_VALUE_PAIRPPH_KEY_VALUE_PAIR
 
typedef struct _PH_FREE_LIST PH_FREE_LIST
 
typedef struct _PH_FREE_LISTPPH_FREE_LIST
 
typedef struct _PH_FREE_LIST_ENTRY PH_FREE_LIST_ENTRY
 
typedef struct
_PH_FREE_LIST_ENTRY
PPH_FREE_LIST_ENTRY
 
typedef VOID(NTAPI * PPH_CALLBACK_FUNCTION )(_In_opt_ PVOID Parameter, _In_opt_ PVOID Context)
 A callback function.
 
typedef struct
_PH_CALLBACK_REGISTRATION 
PH_CALLBACK_REGISTRATION
 A callback registration structure.
 
typedef struct
_PH_CALLBACK_REGISTRATION
PPH_CALLBACK_REGISTRATION
 
typedef struct _PH_CALLBACK PH_CALLBACK
 A callback structure.
 
typedef struct _PH_CALLBACKPPH_CALLBACK
 
typedef enum _PH_FORMAT_TYPE PH_FORMAT_TYPE
 
typedef struct _PH_FORMAT PH_FORMAT
 Describes an element to be formatted to a string.
 
typedef struct _PH_FORMATPPH_FORMAT
 
typedef enum
_PH_TREE_ENUMERATION_ORDER 
PH_TREE_ENUMERATION_ORDER
 
typedef struct _PH_AVL_LINKS PH_AVL_LINKS
 
typedef struct _PH_AVL_LINKSPPH_AVL_LINKS
 
typedef _In_ PPH_AVL_LINKS Links2
 
typedef struct _PH_AVL_TREE PH_AVL_TREE
 
typedef struct _PH_AVL_TREEPPH_AVL_TREE
 
typedef BOOLEAN(NTAPI * PPH_ENUM_AVL_TREE_CALLBACK )(_In_ PPH_AVL_TREE Tree, _In_ PPH_AVL_LINKS Element, _In_opt_ PVOID Context)
 
typedef struct _PH_HANDLE_TABLEPPH_HANDLE_TABLE
 
typedef struct
_PH_HANDLE_TABLE_ENTRY 
PH_HANDLE_TABLE_ENTRY
 
typedef struct
_PH_HANDLE_TABLE_ENTRY
PPH_HANDLE_TABLE_ENTRY
 
typedef BOOLEAN(NTAPI * PPH_ENUM_HANDLE_TABLE_CALLBACK )(_In_ PPH_HANDLE_TABLE HandleTable, _In_ HANDLE Handle, _In_ PPH_HANDLE_TABLE_ENTRY HandleTableEntry, _In_opt_ PVOID Context)
 
typedef enum
_PH_HANDLE_TABLE_INFORMATION_CLASS 
PH_HANDLE_TABLE_INFORMATION_CLASS
 
typedef struct
_PH_HANDLE_TABLE_BASIC_INFORMATION 
PH_HANDLE_TABLE_BASIC_INFORMATION
 
typedef struct
_PH_HANDLE_TABLE_BASIC_INFORMATION
PPH_HANDLE_TABLE_BASIC_INFORMATION
 
typedef struct
_PH_HANDLE_TABLE_FLAGS_INFORMATION 
PH_HANDLE_TABLE_FLAGS_INFORMATION
 
typedef struct
_PH_HANDLE_TABLE_FLAGS_INFORMATION
PPH_HANDLE_TABLE_FLAGS_INFORMATION
 
typedef struct _PH_WORK_QUEUE PH_WORK_QUEUE
 
typedef struct _PH_WORK_QUEUEPPH_WORK_QUEUE
 
typedef VOID(NTAPI * PPH_WORK_QUEUE_ITEM_DELETE_FUNCTION )(_In_ PUSER_THREAD_START_ROUTINE Function, _In_ PVOID Context)
 
typedef struct _PH_WORK_QUEUE_ITEM PH_WORK_QUEUE_ITEM
 
typedef struct
_PH_WORK_QUEUE_ITEM
PPH_WORK_QUEUE_ITEM
 

Enumerations

enum  _PH_FORMAT_TYPE {
  CharFormatType, StringFormatType, StringZFormatType, MultiByteStringFormatType,
  MultiByteStringZFormatType, Int32FormatType, Int64FormatType, IntPtrFormatType,
  UInt32FormatType, UInt64FormatType, UIntPtrFormatType, DoubleFormatType,
  SizeFormatType, FormatTypeMask = 0x3f, FormatUsePrecision = 0x40, FormatUsePad = 0x80,
  FormatUseRadix = 0x100, FormatUseParameter = 0x200, FormatStandardForm = 0x1000, FormatHexadecimalForm = 0x2000,
  FormatForceDecimalPoint = 0x4000, FormatCropZeros = 0x8000, FormatGroupDigits = 0x10000, FormatPrefixSign = 0x20000,
  FormatPadZeros = 0x40000, FormatLeftAlign = 0x80000000, FormatRightAlign = 0x40000000, FormatUpperCase = 0x20000000
}
 
enum  _PH_TREE_ENUMERATION_ORDER { TreeEnumerateInOrder, TreeEnumerateInReverseOrder }
 
enum  _PH_HANDLE_TABLE_INFORMATION_CLASS { HandleTableBasicInformation, HandleTableFlagsInformation, MaxHandleTableInfoClass }
 

Functions

NTSTATUS PhInitializePhLib (VOID)
 
NTSTATUS PhInitializePhLibEx (_In_ ULONG Flags, _In_opt_ SIZE_T HeapReserveSize, _In_opt_ SIZE_T HeapCommitSize)
 
BOOLEAN PhIsExecutingInWow64 (VOID)
 
BOOLEAN PhInitializeBase (_In_ ULONG Flags)
 Initializes the base support module.
 
PHLIBAPI HANDLE NTAPI PhCreateThread (_In_opt_ SIZE_T StackSize, _In_ PUSER_THREAD_START_ROUTINE StartAddress, _In_opt_ PVOID Parameter)
 Creates a thread.
 
FORCEINLINE PVOID PhGetDllHandle (_In_ PWSTR DllName)
 
FORCEINLINE PVOID PhGetProcedureAddress (_In_ PVOID DllHandle, _In_opt_ PSTR ProcedureName, _In_opt_ ULONG ProcedureNumber)
 
PHLIBAPI VOID NTAPI PhQuerySystemTime (_Out_ PLARGE_INTEGER SystemTime)
 Gets the current system time (UTC).
 
PHLIBAPI VOID NTAPI PhQueryTimeZoneBias (_Out_ PLARGE_INTEGER TimeZoneBias)
 Gets the offset of the current time zone from UTC.
 
PHLIBAPI VOID NTAPI PhSystemTimeToLocalTime (_In_ PLARGE_INTEGER SystemTime, _Out_ PLARGE_INTEGER LocalTime)
 Converts system time to local time.
 
PHLIBAPI VOID NTAPI PhLocalTimeToSystemTime (_In_ PLARGE_INTEGER LocalTime, _Out_ PLARGE_INTEGER SystemTime)
 Converts local time to system time.
 
_May_raise_ _Check_return_
_Ret_notnull_ 
_Post_writable_byte_size_ (Size) PHLIBAPI PVOID NTAPI PhAllocate(_In_ SIZE_T Size)
 
PHLIBAPI PVOID NTAPI PhAllocateSafe (_In_ SIZE_T Size)
 Allocates a block of memory.
 
PHLIBAPI PVOID NTAPI PhAllocateExSafe (_In_ SIZE_T Size, _In_ ULONG Flags)
 Allocates a block of memory.
 
PHLIBAPI VOID NTAPI PhFree (_Frees_ptr_opt_ PVOID Memory)
 Frees a block of memory allocated with PhAllocate().
 
PHLIBAPI PVOID NTAPI PhReAllocateSafe (_In_ PVOID Memory, _In_ SIZE_T Size)
 Re-allocates a block of memory originally allocated with PhAllocate().
 
_Check_return_ _Ret_maybenull_
PHLIBAPI PVOID NTAPI 
PhAllocatePage (_In_ SIZE_T Size, _Out_opt_ PSIZE_T NewSize)
 Allocates pages of memory.
 
PHLIBAPI VOID NTAPI PhFreePage (_Frees_ptr_opt_ PVOID Memory)
 Frees pages of memory allocated with PhAllocatePage().
 
FORCEINLINE PVOID PhAllocateCopy (_In_ PVOID Data, _In_ SIZE_T Size)
 
 C_ASSERT (sizeof(PH_EVENT)==sizeof(ULONG_PTR)+sizeof(HANDLE))
 
PHLIBAPI VOID FASTCALL PhfInitializeEvent (_Out_ PPH_EVENT Event)
 Initializes an event object.
 
PHLIBAPI VOID FASTCALL PhfSetEvent (_Inout_ PPH_EVENT Event)
 Sets an event object.
 
PHLIBAPI BOOLEAN FASTCALL PhfWaitForEvent (_Inout_ PPH_EVENT Event, _In_opt_ PLARGE_INTEGER Timeout)
 Waits for an event object to be set.
 
FORCEINLINE BOOLEAN PhWaitForEvent (_Inout_ PPH_EVENT Event, _In_opt_ PLARGE_INTEGER Timeout)
 
PHLIBAPI VOID FASTCALL PhfResetEvent (_Inout_ PPH_EVENT Event)
 Resets an event's state.
 
FORCEINLINE VOID PhInitializeEvent (_Out_ PPH_EVENT Event)
 
FORCEINLINE BOOLEAN PhTestEvent (_In_ PPH_EVENT Event)
 Determines whether an event object is set.
 
PHLIBAPI VOID FASTCALL PhfInitializeBarrier (_Out_ PPH_BARRIER Barrier, _In_ ULONG_PTR Target)
 
PHLIBAPI BOOLEAN FASTCALL PhfWaitForBarrier (_Inout_ PPH_BARRIER Barrier, _In_ BOOLEAN Spin)
 Waits until all threads are blocking on the barrier, and resets the state of the barrier.
 
FORCEINLINE VOID PhInitializeBarrier (_Out_ PPH_BARRIER Barrier, _In_ ULONG_PTR Target)
 
PHLIBAPI VOID FASTCALL PhfInitializeRundownProtection (_Out_ PPH_RUNDOWN_PROTECT Protection)
 
PHLIBAPI BOOLEAN FASTCALL PhfAcquireRundownProtection (_Inout_ PPH_RUNDOWN_PROTECT Protection)
 
PHLIBAPI VOID FASTCALL PhfReleaseRundownProtection (_Inout_ PPH_RUNDOWN_PROTECT Protection)
 
PHLIBAPI VOID FASTCALL PhfWaitForRundownProtection (_Inout_ PPH_RUNDOWN_PROTECT Protection)
 
FORCEINLINE VOID PhInitializeRundownProtection (_Out_ PPH_RUNDOWN_PROTECT Protection)
 
FORCEINLINE BOOLEAN PhAcquireRundownProtection (_Inout_ PPH_RUNDOWN_PROTECT Protection)
 
FORCEINLINE VOID PhReleaseRundownProtection (_Inout_ PPH_RUNDOWN_PROTECT Protection)
 
FORCEINLINE VOID PhWaitForRundownProtection (_Inout_ PPH_RUNDOWN_PROTECT Protection)
 
 C_ASSERT (PH_INITONCE_SHIFT >=FIELD_OFFSET(PH_EVENT, AvailableForUse)*8)
 
PHLIBAPI VOID FASTCALL PhfInitializeInitOnce (_Out_ PPH_INITONCE InitOnce)
 
PHLIBAPI BOOLEAN FASTCALL PhfBeginInitOnce (_Inout_ PPH_INITONCE InitOnce)
 
PHLIBAPI VOID FASTCALL PhfEndInitOnce (_Inout_ PPH_INITONCE InitOnce)
 
FORCEINLINE BOOLEAN PhBeginInitOnce (_Inout_ PPH_INITONCE InitOnce)
 
FORCEINLINE BOOLEAN PhTestInitOnce (_In_ PPH_INITONCE InitOnce)
 
PHLIBAPI SIZE_T NTAPI PhCountStringZ (_In_ PWSTR String)
 Determines the length of the specified string, in characters.
 
PHLIBAPI PSTR NTAPI PhDuplicateBytesZ (_In_ PSTR String)
 Allocates space for and copies a byte string.
 
PHLIBAPI PSTR NTAPI PhDuplicateBytesZSafe (_In_ PSTR String)
 Allocates space for and copies a byte string.
 
PHLIBAPI PWSTR NTAPI PhDuplicateStringZ (_In_ PWSTR String)
 Allocates space for and copies a 16-bit string.
 
PHLIBAPI BOOLEAN NTAPI PhCopyBytesZ (_In_ PSTR InputBuffer, _In_ SIZE_T InputCount, _Out_writes_opt_z_(OutputCount) PSTR OutputBuffer, _In_ SIZE_T OutputCount, _Out_opt_ PSIZE_T ReturnCount)
 Copies a string with optional null termination and a maximum number of characters.
 
PHLIBAPI BOOLEAN NTAPI PhCopyStringZ (_In_ PWSTR InputBuffer, _In_ SIZE_T InputCount, _Out_writes_opt_z_(OutputCount) PWSTR OutputBuffer, _In_ SIZE_T OutputCount, _Out_opt_ PSIZE_T ReturnCount)
 Copies a string with optional null termination and a maximum number of characters.
 
PHLIBAPI BOOLEAN NTAPI PhCopyStringZFromBytes (_In_ PSTR InputBuffer, _In_ SIZE_T InputCount, _Out_writes_opt_z_(OutputCount) PWSTR OutputBuffer, _In_ SIZE_T OutputCount, _Out_opt_ PSIZE_T ReturnCount)
 Copies a string with optional null termination and a maximum number of characters.
 
PHLIBAPI BOOLEAN NTAPI PhCopyStringZFromMultiByte (_In_ PSTR InputBuffer, _In_ SIZE_T InputCount, _Out_writes_opt_z_(OutputCount) PWSTR OutputBuffer, _In_ SIZE_T OutputCount, _Out_opt_ PSIZE_T ReturnCount)
 Copies a string with optional null termination and a maximum number of characters.
 
PHLIBAPI LONG NTAPI PhCompareStringZNatural (_In_ PWSTR A, _In_ PWSTR B, _In_ BOOLEAN IgnoreCase)
 Compares two strings in natural sort order.
 
FORCEINLINE BOOLEAN PhAreCharactersDifferent (_In_ WCHAR Char1, _In_ WCHAR Char2)
 
FORCEINLINE BOOLEAN PhIsDigitCharacter (_In_ WCHAR Char)
 
FORCEINLINE LONG PhCompareBytesZ (_In_ PSTR String1, _In_ PSTR String2, _In_ BOOLEAN IgnoreCase)
 
FORCEINLINE BOOLEAN PhEqualBytesZ (_In_ PSTR String1, _In_ PSTR String2, _In_ BOOLEAN IgnoreCase)
 
FORCEINLINE LONG PhCompareStringZ (_In_ PWSTR String1, _In_ PWSTR String2, _In_ BOOLEAN IgnoreCase)
 
FORCEINLINE BOOLEAN PhEqualStringZ (_In_ PWSTR String1, _In_ PWSTR String2, _In_ BOOLEAN IgnoreCase)
 
FORCEINLINE VOID PhInitializeStringRef (_Out_ PPH_STRINGREF String, _In_ PWSTR Buffer)
 
FORCEINLINE VOID PhInitializeStringRefLongHint (_Out_ PPH_STRINGREF String, _In_ PWSTR Buffer)
 
FORCEINLINE VOID PhInitializeBytesRef (_Out_ PPH_BYTESREF Bytes, _In_ PSTR Buffer)
 
FORCEINLINE VOID PhInitializeEmptyStringRef (_Out_ PPH_STRINGREF String)
 
FORCEINLINE BOOLEAN PhStringRefToUnicodeString (_In_ PPH_STRINGREF String, _Out_ PUNICODE_STRING UnicodeString)
 
FORCEINLINE VOID PhUnicodeStringToStringRef (_In_ PUNICODE_STRING UnicodeString, _Out_ PPH_STRINGREF String)
 
PHLIBAPI LONG NTAPI PhCompareStringRef (_In_ PPH_STRINGREF String1, _In_ PPH_STRINGREF String2, _In_ BOOLEAN IgnoreCase)
 Compares two strings.
 
PHLIBAPI BOOLEAN NTAPI PhEqualStringRef (_In_ PPH_STRINGREF String1, _In_ PPH_STRINGREF String2, _In_ BOOLEAN IgnoreCase)
 Determines if two strings are equal.
 
PHLIBAPI ULONG_PTR NTAPI PhFindCharInStringRef (_In_ PPH_STRINGREF String, _In_ WCHAR Character, _In_ BOOLEAN IgnoreCase)
 Locates a character in a string.
 
PHLIBAPI ULONG_PTR NTAPI PhFindLastCharInStringRef (_In_ PPH_STRINGREF String, _In_ WCHAR Character, _In_ BOOLEAN IgnoreCase)
 Locates a character in a string, searching backwards.
 
PHLIBAPI ULONG_PTR NTAPI PhFindStringInStringRef (_In_ PPH_STRINGREF String, _In_ PPH_STRINGREF SubString, _In_ BOOLEAN IgnoreCase)
 Locates a string in a string.
 
PHLIBAPI BOOLEAN NTAPI PhSplitStringRefAtChar (_In_ PPH_STRINGREF Input, _In_ WCHAR Separator, _Out_ PPH_STRINGREF FirstPart, _Out_ PPH_STRINGREF SecondPart)
 Splits a string.
 
PHLIBAPI BOOLEAN NTAPI PhSplitStringRefAtLastChar (_In_ PPH_STRINGREF Input, _In_ WCHAR Separator, _Out_ PPH_STRINGREF FirstPart, _Out_ PPH_STRINGREF SecondPart)
 Splits a string at the last occurrence of a character.
 
PHLIBAPI BOOLEAN NTAPI PhSplitStringRefAtString (_In_ PPH_STRINGREF Input, _In_ PPH_STRINGREF Separator, _In_ BOOLEAN IgnoreCase, _Out_ PPH_STRINGREF FirstPart, _Out_ PPH_STRINGREF SecondPart)
 Splits a string.
 
PHLIBAPI BOOLEAN NTAPI PhSplitStringRefEx (_In_ PPH_STRINGREF Input, _In_ PPH_STRINGREF Separator, _In_ ULONG Flags, _Out_ PPH_STRINGREF FirstPart, _Out_ PPH_STRINGREF SecondPart, _Out_opt_ PPH_STRINGREF SeparatorPart)
 Splits a string.
 
PHLIBAPI VOID NTAPI PhTrimStringRef (_Inout_ PPH_STRINGREF String, _In_ PPH_STRINGREF CharSet, _In_ ULONG Flags)
 
FORCEINLINE LONG PhCompareStringRef2 (_In_ PPH_STRINGREF String1, _In_ PWSTR String2, _In_ BOOLEAN IgnoreCase)
 
FORCEINLINE BOOLEAN PhEqualStringRef2 (_In_ PPH_STRINGREF String1, _In_ PWSTR String2, _In_ BOOLEAN IgnoreCase)
 
FORCEINLINE BOOLEAN PhStartsWithStringRef (_In_ PPH_STRINGREF String, _In_ PPH_STRINGREF Prefix, _In_ BOOLEAN IgnoreCase)
 
FORCEINLINE BOOLEAN PhStartsWithStringRef2 (_In_ PPH_STRINGREF String, _In_ PWSTR Prefix, _In_ BOOLEAN IgnoreCase)
 
FORCEINLINE BOOLEAN PhEndsWithStringRef (_In_ PPH_STRINGREF String, _In_ PPH_STRINGREF Suffix, _In_ BOOLEAN IgnoreCase)
 
FORCEINLINE BOOLEAN PhEndsWithStringRef2 (_In_ PPH_STRINGREF String, _In_ PWSTR Suffix, _In_ BOOLEAN IgnoreCase)
 
FORCEINLINE VOID PhSkipStringRef (_Inout_ PPH_STRINGREF String, _In_ LONG_PTR Length)
 
FORCEINLINE VOID PhReverseStringRef (_In_ PPH_STRINGREF String)
 
PHLIBAPI PPH_STRING NTAPI PhCreateString (_In_ PWSTR Buffer)
 Creates a string object from an existing null-terminated string.
 
PHLIBAPI PPH_STRING NTAPI PhCreateStringEx (_In_opt_ PWCHAR Buffer, _In_ SIZE_T Length)
 Creates a string object using a specified length.
 
FORCEINLINE PPH_STRING PhCreateString2 (_In_ PPH_STRINGREF String)
 
FORCEINLINE PPH_STRING PhCreateStringFromUnicodeString (_In_ PUNICODE_STRING UnicodeString)
 
PHLIBAPI PPH_STRING NTAPI PhReferenceEmptyString (VOID)
 Obtains a reference to a zero-length string.
 
PHLIBAPI PPH_STRING NTAPI PhConcatStrings (_In_ ULONG Count,...)
 Concatenates multiple strings.
 
PHLIBAPI PPH_STRING NTAPI PhConcatStrings_V (_In_ ULONG Count, _In_ va_list ArgPtr)
 Concatenates multiple strings.
 
PHLIBAPI PPH_STRING NTAPI PhConcatStrings2 (_In_ PWSTR String1, _In_ PWSTR String2)
 Concatenates two strings.
 
PHLIBAPI PPH_STRING NTAPI PhConcatStringRef2 (_In_ PPH_STRINGREF String1, _In_ PPH_STRINGREF String2)
 Concatenates two strings.
 
PPH_STRING NTAPI PhConcatStringRef3 (_In_ PPH_STRINGREF String1, _In_ PPH_STRINGREF String2, _In_ PPH_STRINGREF String3)
 Concatenates three strings.
 
PHLIBAPI PPH_STRING NTAPI PhFormatString (_In_ _Printf_format_string_ PWSTR Format,...)
 Creates a string using format specifiers.
 
PHLIBAPI PPH_STRING NTAPI PhFormatString_V (_In_ _Printf_format_string_ PWSTR Format, _In_ va_list ArgPtr)
 Creates a string using format specifiers.
 
FORCEINLINE PWSTR PhGetString (_In_opt_ PPH_STRING String)
 Retrieves a pointer to a string object's buffer or returns NULL.
 
FORCEINLINE PH_STRINGREF PhGetStringRef (_In_opt_ PPH_STRING String)
 
FORCEINLINE PWSTR PhGetStringOrEmpty (_In_opt_ PPH_STRING String)
 Retrieves a pointer to a string object's buffer or returns an empty string.
 
FORCEINLINE PWSTR PhGetStringOrDefault (_In_opt_ PPH_STRING String, _In_ PWSTR DefaultString)
 Retrieves a pointer to a string object's buffer or returns the specified alternative string.
 
FORCEINLINE BOOLEAN PhIsNullOrEmptyString (_In_opt_ PPH_STRING String)
 Determines whether a string is null or empty.
 
FORCEINLINE PPH_STRING PhDuplicateString (_In_ PPH_STRING String)
 Duplicates a string.
 
FORCEINLINE LONG PhCompareString (_In_ PPH_STRING String1, _In_ PPH_STRING String2, _In_ BOOLEAN IgnoreCase)
 Compares two strings.
 
FORCEINLINE LONG PhCompareString2 (_In_ PPH_STRING String1, _In_ PWSTR String2, _In_ BOOLEAN IgnoreCase)
 Compares two strings.
 
FORCEINLINE LONG PhCompareStringWithNull (_In_opt_ PPH_STRING String1, _In_opt_ PPH_STRING String2, _In_ BOOLEAN IgnoreCase)
 Compares two strings, handling NULL strings.
 
FORCEINLINE BOOLEAN PhEqualString (_In_ PPH_STRING String1, _In_ PPH_STRING String2, _In_ BOOLEAN IgnoreCase)
 Determines whether two strings are equal.
 
FORCEINLINE BOOLEAN PhEqualString2 (_In_ PPH_STRING String1, _In_ PWSTR String2, _In_ BOOLEAN IgnoreCase)
 Determines whether two strings are equal.
 
FORCEINLINE BOOLEAN PhStartsWithString (_In_ PPH_STRING String, _In_ PPH_STRING Prefix, _In_ BOOLEAN IgnoreCase)
 Determines whether a string starts with another.
 
FORCEINLINE BOOLEAN PhStartsWithString2 (_In_ PPH_STRING String, _In_ PWSTR Prefix, _In_ BOOLEAN IgnoreCase)
 Determines whether a string starts with another.
 
FORCEINLINE BOOLEAN PhEndsWithString (_In_ PPH_STRING String, _In_ PPH_STRING Suffix, _In_ BOOLEAN IgnoreCase)
 Determines whether a string ends with another.
 
FORCEINLINE BOOLEAN PhEndsWithString2 (_In_ PPH_STRING String, _In_ PWSTR Suffix, _In_ BOOLEAN IgnoreCase)
 Determines whether a string ends with another.
 
FORCEINLINE ULONG_PTR PhFindCharInString (_In_ PPH_STRING String, _In_ SIZE_T StartIndex, _In_ WCHAR Char)
 Locates a character in a string.
 
FORCEINLINE ULONG_PTR PhFindLastCharInString (_In_ PPH_STRING String, _In_ SIZE_T StartIndex, _In_ WCHAR Char)
 Locates a character in a string, backwards.
 
FORCEINLINE ULONG_PTR PhFindStringInString (_In_ PPH_STRING String, _In_ SIZE_T StartIndex, _In_ PWSTR SubString)
 Locates a string in a string.
 
FORCEINLINE PPH_STRING PhSubstring (_In_ PPH_STRING String, _In_ SIZE_T StartIndex, _In_ SIZE_T Count)
 Creates a substring of a string.
 
FORCEINLINE VOID PhLowerString (_Inout_ PPH_STRING String)
 Converts a string to lowercase in-place.
 
FORCEINLINE VOID PhUpperString (_Inout_ PPH_STRING String)
 Converts a string to uppercase in-place.
 
FORCEINLINE VOID PhTrimToNullTerminatorString (_Inout_ PPH_STRING String)
 Updates a string object's length with its true length as determined by an embedded null terminator.
 
PHLIBAPI PPH_BYTES NTAPI PhCreateBytes (_In_ PSTR Buffer)
 Creates a bytes object from an existing null-terminated string of bytes.
 
PHLIBAPI PPH_BYTES NTAPI PhCreateBytesEx (_In_opt_ PCHAR Buffer, _In_ SIZE_T Length)
 Creates a bytes object.
 
FORCEINLINE PPH_BYTES PhCreateBytes2 (_In_ PPH_BYTESREF Bytes)
 
FORCEINLINE VOID PhInitializeUnicodeDecoder (_Out_ PPH_UNICODE_DECODER Decoder, _In_ UCHAR Encoding)
 
PHLIBAPI BOOLEAN NTAPI PhWriteUnicodeDecoder (_Inout_ PPH_UNICODE_DECODER Decoder, _In_ ULONG CodeUnit)
 
PHLIBAPI BOOLEAN NTAPI PhDecodeUnicodeDecoder (_Inout_ PPH_UNICODE_DECODER Decoder, _Out_ PULONG CodePoint)
 
PHLIBAPI BOOLEAN NTAPI PhEncodeUnicode (_In_ UCHAR Encoding, _In_ ULONG CodePoint, _Out_opt_ PVOID CodeUnits, _Out_ PULONG NumberOfCodeUnits)
 
PHLIBAPI VOID NTAPI PhZeroExtendToUtf16Buffer (_In_reads_bytes_(InputLength) PCH Input, _In_ SIZE_T InputLength, _Out_writes_bytes_(InputLength *sizeof(WCHAR)) PWCH Output)
 
PHLIBAPI PPH_STRING NTAPI PhZeroExtendToUtf16Ex (_In_reads_bytes_(InputLength) PCH Input, _In_ SIZE_T InputLength)
 
FORCEINLINE PPH_STRING PhZeroExtendToUtf16 (_In_ PSTR Input)
 
PHLIBAPI PPH_BYTES NTAPI PhConvertUtf16ToAsciiEx (_In_ PWCH Buffer, _In_ SIZE_T Length, _In_opt_ CHAR Replacement)
 
FORCEINLINE PPH_BYTES PhConvertUtf16ToAscii (_In_ PWSTR Buffer, _In_opt_ CHAR Replacement)
 
PHLIBAPI PPH_STRING NTAPI PhConvertMultiByteToUtf16 (_In_ PSTR Buffer)
 Creates a string object from an existing null-terminated multi-byte string.
 
PHLIBAPI PPH_STRING NTAPI PhConvertMultiByteToUtf16Ex (_In_ PCHAR Buffer, _In_ SIZE_T Length)
 Creates a string object from an existing null-terminated multi-byte string.
 
PHLIBAPI PPH_BYTES NTAPI PhConvertUtf16ToMultiByte (_In_ PWSTR Buffer)
 Creates a multi-byte string from an existing null-terminated UTF-16 string.
 
PHLIBAPI PPH_BYTES NTAPI PhConvertUtf16ToMultiByteEx (_In_ PWCHAR Buffer, _In_ SIZE_T Length)
 Creates a multi-byte string from an existing null-terminated UTF-16 string.
 
PHLIBAPI BOOLEAN NTAPI PhConvertUtf8ToUtf16Size (_Out_ PSIZE_T BytesInUtf16String, _In_reads_bytes_(BytesInUtf8String) PCH Utf8String, _In_ SIZE_T BytesInUtf8String)
 
PHLIBAPI BOOLEAN NTAPI PhConvertUtf8ToUtf16Buffer (_Out_writes_bytes_to_(MaxBytesInUtf16String,*BytesInUtf16String) PWCH Utf16String, _In_ SIZE_T MaxBytesInUtf16String, _Out_opt_ PSIZE_T BytesInUtf16String, _In_reads_bytes_(BytesInUtf8String) PCH Utf8String, _In_ SIZE_T BytesInUtf8String)
 
PHLIBAPI PPH_STRING NTAPI PhConvertUtf8ToUtf16 (_In_ PSTR Buffer)
 
PHLIBAPI PPH_STRING NTAPI PhConvertUtf8ToUtf16Ex (_In_ PCHAR Buffer, _In_ SIZE_T Length)
 
PHLIBAPI BOOLEAN NTAPI PhConvertUtf16ToUtf8Size (_Out_ PSIZE_T BytesInUtf8String, _In_reads_bytes_(BytesInUtf16String) PWCH Utf16String, _In_ SIZE_T BytesInUtf16String)
 
PHLIBAPI BOOLEAN NTAPI PhConvertUtf16ToUtf8Buffer (_Out_writes_bytes_to_(MaxBytesInUtf8String,*BytesInUtf8String) PCH Utf8String, _In_ SIZE_T MaxBytesInUtf8String, _Out_opt_ PSIZE_T BytesInUtf8String, _In_reads_bytes_(BytesInUtf16String) PWCH Utf16String, _In_ SIZE_T BytesInUtf16String)
 
PHLIBAPI PPH_BYTES NTAPI PhConvertUtf16ToUtf8 (_In_ PWSTR Buffer)
 
PHLIBAPI PPH_BYTES NTAPI PhConvertUtf16ToUtf8Ex (_In_ PWCHAR Buffer, _In_ SIZE_T Length)
 
PHLIBAPI VOID NTAPI PhInitializeStringBuilder (_Out_ PPH_STRING_BUILDER StringBuilder, _In_ SIZE_T InitialCapacity)
 Initializes a string builder object.
 
PHLIBAPI VOID NTAPI PhDeleteStringBuilder (_Inout_ PPH_STRING_BUILDER StringBuilder)
 Frees resources used by a string builder object.
 
PHLIBAPI PPH_STRING NTAPI PhFinalStringBuilderString (_Inout_ PPH_STRING_BUILDER StringBuilder)
 Obtains a reference to the string constructed by a string builder object and frees resources used by the object.
 
PHLIBAPI VOID NTAPI PhAppendStringBuilder (_Inout_ PPH_STRING_BUILDER StringBuilder, _In_ PPH_STRINGREF String)
 Appends a string to the end of a string builder string.
 
PHLIBAPI VOID NTAPI PhAppendStringBuilder2 (_Inout_ PPH_STRING_BUILDER StringBuilder, _In_ PWSTR String)
 Appends a string to the end of a string builder string.
 
PHLIBAPI VOID NTAPI PhAppendStringBuilderEx (_Inout_ PPH_STRING_BUILDER StringBuilder, _In_opt_ PWCHAR String, _In_ SIZE_T Length)
 Appends a string to the end of a string builder string.
 
PHLIBAPI VOID NTAPI PhAppendCharStringBuilder (_Inout_ PPH_STRING_BUILDER StringBuilder, _In_ WCHAR Character)
 Appends a character to the end of a string builder string.
 
PHLIBAPI VOID NTAPI PhAppendCharStringBuilder2 (_Inout_ PPH_STRING_BUILDER StringBuilder, _In_ WCHAR Character, _In_ SIZE_T Count)
 Appends a number of characters to the end of a string builder string.
 
PHLIBAPI VOID NTAPI PhAppendFormatStringBuilder (_Inout_ PPH_STRING_BUILDER StringBuilder, _In_ _Printf_format_string_ PWSTR Format,...)
 Appends a formatted string to the end of a string builder string.
 
VOID NTAPI PhAppendFormatStringBuilder_V (_Inout_ PPH_STRING_BUILDER StringBuilder, _In_ _Printf_format_string_ PWSTR Format, _In_ va_list ArgPtr)
 
PHLIBAPI VOID NTAPI PhInsertStringBuilder (_Inout_ PPH_STRING_BUILDER StringBuilder, _In_ SIZE_T Index, _In_ PPH_STRINGREF String)
 Inserts a string into a string builder string.
 
PHLIBAPI VOID NTAPI PhInsertStringBuilder2 (_Inout_ PPH_STRING_BUILDER StringBuilder, _In_ SIZE_T Index, _In_ PWSTR String)
 Inserts a string into a string builder string.
 
PHLIBAPI VOID NTAPI PhInsertStringBuilderEx (_Inout_ PPH_STRING_BUILDER StringBuilder, _In_ SIZE_T Index, _In_opt_ PWCHAR String, _In_ SIZE_T Length)
 Inserts a string into a string builder string.
 
PHLIBAPI VOID NTAPI PhRemoveStringBuilder (_Inout_ PPH_STRING_BUILDER StringBuilder, _In_ SIZE_T StartIndex, _In_ SIZE_T Count)
 Removes characters from a string builder string.
 
FORCEINLINE VOID PhRemoveEndStringBuilder (_Inout_ PPH_STRING_BUILDER StringBuilder, _In_ SIZE_T Count)
 
PHLIBAPI VOID NTAPI PhInitializeBytesBuilder (_Out_ PPH_BYTES_BUILDER BytesBuilder, _In_ SIZE_T InitialCapacity)
 Initializes a byte string builder object.
 
PHLIBAPI VOID NTAPI PhDeleteBytesBuilder (_Inout_ PPH_BYTES_BUILDER BytesBuilder)
 Frees resources used by a byte string builder object.
 
PHLIBAPI PPH_BYTES NTAPI PhFinalBytesBuilderBytes (_Inout_ PPH_BYTES_BUILDER BytesBuilder)
 Obtains a reference to the byte string constructed by a byte string builder object and frees resources used by the object.
 
FORCEINLINE PVOID PhOffsetBytesBuilder (_In_ PPH_BYTES_BUILDER BytesBuilder, _In_ SIZE_T Offset)
 
PHLIBAPI VOID NTAPI PhAppendBytesBuilder (_Inout_ PPH_BYTES_BUILDER BytesBuilder, _In_ PPH_BYTESREF Bytes)
 Appends a byte string to the end of a byte string builder string.
 
PHLIBAPI VOID NTAPI PhAppendBytesBuilder2 (_Inout_ PPH_BYTES_BUILDER BytesBuilder, _In_ PCHAR Bytes)
 Appends a byte string to the end of a byte string builder string.
 
PHLIBAPI PVOID NTAPI PhAppendBytesBuilderEx (_Inout_ PPH_BYTES_BUILDER BytesBuilder, _In_opt_ PVOID Buffer, _In_ SIZE_T Length, _In_opt_ SIZE_T Alignment, _Out_opt_ PSIZE_T Offset)
 Appends a byte string to the end of a byte string builder string.
 
PHLIBAPI PPH_LIST NTAPI PhCreateList (_In_ ULONG InitialCapacity)
 Creates a list object.
 
PHLIBAPI VOID NTAPI PhResizeList (_Inout_ PPH_LIST List, _In_ ULONG NewCapacity)
 Resizes a list.
 
PHLIBAPI VOID NTAPI PhAddItemList (_Inout_ PPH_LIST List, _In_ PVOID Item)
 Adds an item to a list.
 
PHLIBAPI VOID NTAPI PhAddItemsList (_Inout_ PPH_LIST List, _In_ PVOID *Items, _In_ ULONG Count)
 Adds items to a list.
 
PHLIBAPI VOID NTAPI PhClearList (_Inout_ PPH_LIST List)
 Clears a list.
 
 _Success_ (return!=-1) PHLIBAPI ULONG NTAPI PhFindItemList(_In_ PPH_LIST List
 
PHLIBAPI VOID NTAPI PhInsertItemList (_Inout_ PPH_LIST List, _In_ ULONG Index, _In_ PVOID Item)
 Inserts an item into a list.
 
PHLIBAPI VOID NTAPI PhInsertItemsList (_Inout_ PPH_LIST List, _In_ ULONG Index, _In_ PVOID *Items, _In_ ULONG Count)
 Inserts items into a list.
 
PHLIBAPI VOID NTAPI PhRemoveItemList (_Inout_ PPH_LIST List, _In_ ULONG Index)
 Removes an item from a list.
 
PHLIBAPI VOID NTAPI PhRemoveItemsList (_Inout_ PPH_LIST List, _In_ ULONG StartIndex, _In_ ULONG Count)
 Removes items from a list.
 
PHLIBAPI PPH_POINTER_LIST NTAPI PhCreatePointerList (_In_ ULONG InitialCapacity)
 Creates a pointer list object.
 
PHLIBAPI HANDLE NTAPI PhAddItemPointerList (_Inout_ PPH_POINTER_LIST PointerList, _In_ PVOID Pointer)
 Adds a pointer to a pointer list.
 
PHLIBAPI BOOLEAN NTAPI PhEnumPointerListEx (_In_ PPH_POINTER_LIST PointerList, _Inout_ PULONG EnumerationKey, _Out_ PVOID *Pointer, _Out_ PHANDLE PointerHandle)
 
PHLIBAPI HANDLE NTAPI PhFindItemPointerList (_In_ PPH_POINTER_LIST PointerList, _In_ PVOID Pointer)
 Locates a pointer in a pointer list.
 
PHLIBAPI VOID NTAPI PhRemoveItemPointerList (_Inout_ PPH_POINTER_LIST PointerList, _In_ HANDLE PointerHandle)
 Removes a pointer from a pointer list.
 
FORCEINLINE BOOLEAN PhEnumPointerList (_In_ PPH_POINTER_LIST PointerList, _Inout_ PULONG EnumerationKey, _Out_ PVOID *Pointer)
 
FORCEINLINE VOID PhInitializeHashSet (_Out_ PPH_HASH_ENTRY *Buckets, _In_ ULONG NumberOfBuckets)
 Initializes a hash set.
 
FORCEINLINE PPH_HASH_ENTRYPhCreateHashSet (_In_ ULONG NumberOfBuckets)
 Allocates and initializes a hash set.
 
FORCEINLINE ULONG PhCountHashSet (_In_ PPH_HASH_ENTRY *Buckets, _In_ ULONG NumberOfBuckets)
 Determines the number of entries in a hash set.
 
FORCEINLINE VOID PhDistributeHashSet (_Inout_ PPH_HASH_ENTRY *NewBuckets, _In_ ULONG NumberOfNewBuckets, _In_ PPH_HASH_ENTRY *OldBuckets, _In_ ULONG NumberOfOldBuckets)
 Moves entries from one hash set to another.
 
FORCEINLINE VOID PhAddEntryHashSet (_Inout_ PPH_HASH_ENTRY *Buckets, _In_ ULONG NumberOfBuckets, _Out_ PPH_HASH_ENTRY Entry, _In_ ULONG Hash)
 Adds an entry to a hash set.
 
FORCEINLINE PPH_HASH_ENTRY PhFindEntryHashSet (_In_ PPH_HASH_ENTRY *Buckets, _In_ ULONG NumberOfBuckets, _In_ ULONG Hash)
 Begins the process of finding an entry in a hash set.
 
FORCEINLINE VOID PhRemoveEntryHashSet (_Inout_ PPH_HASH_ENTRY *Buckets, _In_ ULONG NumberOfBuckets, _Inout_ PPH_HASH_ENTRY Entry)
 Removes an entry from a hash set.
 
FORCEINLINE VOID PhResizeHashSet (_Inout_ PPH_HASH_ENTRY **Buckets, _Inout_ PULONG NumberOfBuckets, _In_ ULONG NewNumberOfBuckets)
 Resizes a hash set.
 
PHLIBAPI PPH_HASHTABLE NTAPI PhCreateHashtable (_In_ ULONG EntrySize, _In_ PPH_HASHTABLE_COMPARE_FUNCTION CompareFunction, _In_ PPH_HASHTABLE_HASH_FUNCTION HashFunction, _In_ ULONG InitialCapacity)
 Creates a hashtable object.
 
PHLIBAPI PVOID NTAPI PhAddEntryHashtable (_Inout_ PPH_HASHTABLE Hashtable, _In_ PVOID Entry)
 Adds an entry to a hashtable.
 
PHLIBAPI PVOID NTAPI PhAddEntryHashtableEx (_Inout_ PPH_HASHTABLE Hashtable, _In_ PVOID Entry, _Out_opt_ PBOOLEAN Added)
 Adds an entry to a hashtable or returns an existing one.
 
PHLIBAPI VOID NTAPI PhClearHashtable (_Inout_ PPH_HASHTABLE Hashtable)
 Clears a hashtable.
 
PHLIBAPI BOOLEAN NTAPI PhEnumHashtable (_In_ PPH_HASHTABLE Hashtable, _Out_ PVOID *Entry, _Inout_ PULONG EnumerationKey)
 Enumerates the entries in a hashtable.
 
PHLIBAPI PVOID NTAPI PhFindEntryHashtable (_In_ PPH_HASHTABLE Hashtable, _In_ PVOID Entry)
 Locates an entry in a hashtable.
 
PHLIBAPI BOOLEAN NTAPI PhRemoveEntryHashtable (_Inout_ PPH_HASHTABLE Hashtable, _In_ PVOID Entry)
 Removes an entry from a hashtable.
 
FORCEINLINE VOID PhBeginEnumHashtable (_In_ PPH_HASHTABLE Hashtable, _Out_ PPH_HASHTABLE_ENUM_CONTEXT Context)
 
FORCEINLINE PVOID PhNextEnumHashtable (_Inout_ PPH_HASHTABLE_ENUM_CONTEXT Context)
 
PHLIBAPI ULONG NTAPI PhHashBytes (_In_reads_(Length) PUCHAR Bytes, _In_ SIZE_T Length)
 Generates a hash code for a sequence of bytes.
 
PHLIBAPI ULONG NTAPI PhHashStringRef (_In_ PPH_STRINGREF String, _In_ BOOLEAN IgnoreCase)
 Generates a hash code for a string.
 
FORCEINLINE ULONG PhHashInt32 (_In_ ULONG Value)
 
FORCEINLINE ULONG PhHashInt64 (_In_ ULONG64 Value)
 
FORCEINLINE ULONG PhHashIntPtr (_In_ ULONG_PTR Value)
 
PHLIBAPI PPH_HASHTABLE NTAPI PhCreateSimpleHashtable (_In_ ULONG InitialCapacity)
 
PHLIBAPI PVOID NTAPI PhAddItemSimpleHashtable (_Inout_ PPH_HASHTABLE SimpleHashtable, _In_opt_ PVOID Key, _In_opt_ PVOID Value)
 
PHLIBAPI PVOID *NTAPI PhFindItemSimpleHashtable (_In_ PPH_HASHTABLE SimpleHashtable, _In_opt_ PVOID Key)
 
FORCEINLINE PVOID NTAPI PhFindItemSimpleHashtable2 (_In_ PPH_HASHTABLE SimpleHashtable, _In_opt_ PVOID Key)
 
PHLIBAPI BOOLEAN NTAPI PhRemoveItemSimpleHashtable (_Inout_ PPH_HASHTABLE SimpleHashtable, _In_opt_ PVOID Key)
 
 C_ASSERT (FIELD_OFFSET(PH_FREE_LIST_ENTRY, ListEntry)==0x0)
 
 C_ASSERT (FIELD_OFFSET(PH_FREE_LIST_ENTRY, Body)==0x8)
 
PHLIBAPI VOID NTAPI PhInitializeFreeList (_Out_ PPH_FREE_LIST FreeList, _In_ SIZE_T Size, _In_ ULONG MaximumCount)
 Initializes a free list object.
 
PHLIBAPI VOID NTAPI PhDeleteFreeList (_Inout_ PPH_FREE_LIST FreeList)
 Frees resources used by a free list object.
 
PHLIBAPI PVOID NTAPI PhAllocateFromFreeList (_Inout_ PPH_FREE_LIST FreeList)
 Allocates a block of memory from a free list.
 
PHLIBAPI VOID NTAPI PhFreeToFreeList (_Inout_ PPH_FREE_LIST FreeList, _In_ PVOID Memory)
 Frees a block of memory to a free list.
 
PHLIBAPI VOID NTAPI PhInitializeCallback (_Out_ PPH_CALLBACK Callback)
 Initializes a callback object.
 
PHLIBAPI VOID NTAPI PhDeleteCallback (_Inout_ PPH_CALLBACK Callback)
 Frees resources used by a callback object.
 
PHLIBAPI VOID NTAPI PhRegisterCallback (_Inout_ PPH_CALLBACK Callback, _In_ PPH_CALLBACK_FUNCTION Function, _In_opt_ PVOID Context, _Out_ PPH_CALLBACK_REGISTRATION Registration)
 Registers a callback function to be notified.
 
PHLIBAPI VOID NTAPI PhRegisterCallbackEx (_Inout_ PPH_CALLBACK Callback, _In_ PPH_CALLBACK_FUNCTION Function, _In_opt_ PVOID Context, _In_ USHORT Flags, _Out_ PPH_CALLBACK_REGISTRATION Registration)
 Registers a callback function to be notified.
 
PHLIBAPI VOID NTAPI PhUnregisterCallback (_Inout_ PPH_CALLBACK Callback, _Inout_ PPH_CALLBACK_REGISTRATION Registration)
 Unregisters a callback function.
 
PHLIBAPI VOID NTAPI PhInvokeCallback (_In_ PPH_CALLBACK Callback, _In_opt_ PVOID Parameter)
 Notifies all registered callback functions.
 
PHLIBAPI ULONG NTAPI PhGetPrimeNumber (_In_ ULONG Minimum)
 Retrieves a prime number bigger than or equal to the specified number.
 
PHLIBAPI ULONG NTAPI PhRoundUpToPowerOfTwo (_In_ ULONG Number)
 Rounds up a number to the next power of two.
 
PHLIBAPI ULONG NTAPI PhExponentiate (_In_ ULONG Base, _In_ ULONG Exponent)
 Performs exponentiation.
 
PHLIBAPI ULONG64 NTAPI PhExponentiate64 (_In_ ULONG64 Base, _In_ ULONG Exponent)
 Performs 64-bit exponentiation.
 
PHLIBAPI BOOLEAN NTAPI PhHexStringToBuffer (_In_ PPH_STRINGREF String, _Out_writes_bytes_(String->Length/sizeof(WCHAR)/2) PUCHAR Buffer)
 Converts a sequence of hexadecimal digits into a byte array.
 
PHLIBAPI PPH_STRING NTAPI PhBufferToHexString (_In_reads_bytes_(Length) PUCHAR Buffer, _In_ ULONG Length)
 Converts a byte array into a sequence of hexadecimal digits.
 
PPH_STRING NTAPI PhBufferToHexStringEx (_In_reads_bytes_(Length) PUCHAR Buffer, _In_ ULONG Length, _In_ BOOLEAN UpperCase)
 Converts a byte array into a sequence of hexadecimal digits.
 
PHLIBAPI BOOLEAN NTAPI PhStringToInteger64 (_In_ PPH_STRINGREF String, _In_opt_ ULONG Base, _Out_opt_ PLONG64 Integer)
 Converts a string to an integer.
 
PHLIBAPI PPH_STRING NTAPI PhIntegerToString64 (_In_ LONG64 Integer, _In_opt_ ULONG Base, _In_ BOOLEAN Signed)
 Converts an integer to a string.
 
PHLIBAPI VOID NTAPI PhPrintTimeSpan (_Out_writes_(PH_TIMESPAN_STR_LEN_1) PWSTR Destination, _In_ ULONG64 Ticks, _In_opt_ ULONG Mode)
 
PHLIBAPI VOID NTAPI PhFillMemoryUlong (_Inout_updates_(Count) _Needs_align_(4) PULONG Memory, _In_ ULONG Value, _In_ SIZE_T Count)
 Fills a memory block with a ULONG pattern.
 
PHLIBAPI VOID FASTCALL PhxfFillMemoryUlong (PULONG Memory, ULONG Value, ULONG Count)
 Deprecated.
 
PHLIBAPI VOID NTAPI PhDivideSinglesBySingle (_Inout_updates_(Count) PFLOAT A, _In_ FLOAT B, _In_ SIZE_T Count)
 Divides an array of numbers by a number.
 
PHLIBAPI VOID FASTCALL PhxfDivideSingle2U (PFLOAT A, FLOAT B, ULONG Count)
 Deprecated.
 
PHLIBAPI PPH_STRING NTAPI PhFormat (_In_reads_(Count) PPH_FORMAT Format, _In_ ULONG Count, _In_opt_ SIZE_T InitialCapacity)
 Creates a formatted string.
 
PHLIBAPI BOOLEAN NTAPI PhFormatToBuffer (_In_reads_(Count) PPH_FORMAT Format, _In_ ULONG Count, _Out_writes_bytes_opt_(BufferLength) PWSTR Buffer, _In_opt_ SIZE_T BufferLength, _Out_opt_ PSIZE_T ReturnLength)
 Writes a formatted string to a buffer.
 
PHLIBAPI PPH_STRING NTAPI PhaCreateString (_In_ PWSTR Buffer)
 
PHLIBAPI PPH_STRING NTAPI PhaCreateStringEx (_In_opt_ PWSTR Buffer, _In_ SIZE_T Length)
 
PHLIBAPI PPH_STRING NTAPI PhaDuplicateString (_In_ PPH_STRING String)
 
PHLIBAPI PPH_STRING NTAPI PhaConcatStrings (_In_ ULONG Count,...)
 
PHLIBAPI PPH_STRING NTAPI PhaConcatStrings2 (_In_ PWSTR String1, _In_ PWSTR String2)
 
PHLIBAPI PPH_STRING NTAPI PhaFormatString (_In_ _Printf_format_string_ PWSTR Format,...)
 
PHLIBAPI PPH_STRING NTAPI PhaLowerString (_In_ PPH_STRING String)
 
PHLIBAPI PPH_STRING NTAPI PhaUpperString (_In_ PPH_STRING String)
 
PHLIBAPI PPH_STRING NTAPI PhaSubstring (_In_ PPH_STRING String, _In_ SIZE_T StartIndex, _In_ SIZE_T Count)
 
PHLIBAPI ULONG NTAPI PhNtStatusToDosError (_In_ NTSTATUS Status)
 Converts a NTSTATUS value to a Win32 error code.
 
PHLIBAPI NTSTATUS NTAPI PhDosErrorToNtStatus (_In_ ULONG DosError)
 Converts a Win32 error code to a NTSTATUS value.
 
PHLIBAPI BOOLEAN NTAPI PhNtStatusFileNotFound (_In_ NTSTATUS Status)
 Determines whether a NTSTATUS value indicates that a file cannot be not found.
 
typedef LONG (NTAPI *PPH_AVL_TREE_COMPARE_FUNCTION)(_In_ PPH_AVL_LINKS Links1
 
PHLIBAPI VOID NTAPI PhInitializeAvlTree (_Out_ PPH_AVL_TREE Tree, _In_ PPH_AVL_TREE_COMPARE_FUNCTION CompareFunction)
 Initializes an AVL tree.
 
PHLIBAPI PPH_AVL_LINKS NTAPI PhAddElementAvlTree (_Inout_ PPH_AVL_TREE Tree, _Out_ PPH_AVL_LINKS Element)
 Adds an element to an AVL tree.
 
PHLIBAPI VOID NTAPI PhRemoveElementAvlTree (_Inout_ PPH_AVL_TREE Tree, _Inout_ PPH_AVL_LINKS Element)
 Removes an element from an AVL tree.
 
PHLIBAPI PPH_AVL_LINKS NTAPI PhFindElementAvlTree (_In_ PPH_AVL_TREE Tree, _In_ PPH_AVL_LINKS Element)
 Finds an element in an AVL tree.
 
PHLIBAPI PPH_AVL_LINKS NTAPI PhFindElementAvlTree2 (_In_ PPH_AVL_TREE Tree, _In_ PPH_AVL_LINKS Element, _Out_ PLONG Result)
 Finds an element in an AVL tree.
 
PHLIBAPI PPH_AVL_LINKS NTAPI PhMinimumElementAvlTree (_In_ PPH_AVL_TREE Tree)
 Finds the smallest element in an AVL tree.
 
PHLIBAPI PPH_AVL_LINKS NTAPI PhMaximumElementAvlTree (_In_ PPH_AVL_TREE Tree)
 Finds the biggest element in an AVL tree.
 
PHLIBAPI PPH_AVL_LINKS NTAPI PhSuccessorElementAvlTree (_In_ PPH_AVL_LINKS Element)
 Finds the next element in an AVL tree.
 
PHLIBAPI PPH_AVL_LINKS NTAPI PhPredecessorElementAvlTree (_In_ PPH_AVL_LINKS Element)
 Finds the previous element in an AVL tree.
 
PHLIBAPI VOID NTAPI PhEnumAvlTree (_In_ PPH_AVL_TREE Tree, _In_ PH_TREE_ENUMERATION_ORDER Order, _In_ PPH_ENUM_AVL_TREE_CALLBACK Callback, _In_opt_ PVOID Context)
 Enumerates the elements in an AVL tree.
 
VOID PhHandleTableInitialization (VOID)
 
PPH_HANDLE_TABLE NTAPI PhCreateHandleTable (VOID)
 
VOID NTAPI PhDestroyHandleTable (_In_ _Post_invalid_ PPH_HANDLE_TABLE HandleTable)
 
BOOLEAN NTAPI PhLockHandleTableEntry (_Inout_ PPH_HANDLE_TABLE HandleTable, _Inout_ PPH_HANDLE_TABLE_ENTRY HandleTableEntry)
 
VOID NTAPI PhUnlockHandleTableEntry (_Inout_ PPH_HANDLE_TABLE HandleTable, _Inout_ PPH_HANDLE_TABLE_ENTRY HandleTableEntry)
 
HANDLE NTAPI PhCreateHandle (_Inout_ PPH_HANDLE_TABLE HandleTable, _In_ PPH_HANDLE_TABLE_ENTRY HandleTableEntry)
 
BOOLEAN NTAPI PhDestroyHandle (_Inout_ PPH_HANDLE_TABLE HandleTable, _In_ HANDLE Handle, _In_opt_ PPH_HANDLE_TABLE_ENTRY HandleTableEntry)
 
PPH_HANDLE_TABLE_ENTRY NTAPI PhLookupHandleTableEntry (_In_ PPH_HANDLE_TABLE HandleTable, _In_ HANDLE Handle)
 
VOID NTAPI PhEnumHandleTable (_In_ PPH_HANDLE_TABLE HandleTable, _In_ PPH_ENUM_HANDLE_TABLE_CALLBACK Callback, _In_opt_ PVOID Context)
 
VOID NTAPI PhSweepHandleTable (_In_ PPH_HANDLE_TABLE HandleTable, _In_ PPH_ENUM_HANDLE_TABLE_CALLBACK Callback, _In_opt_ PVOID Context)
 
NTSTATUS NTAPI PhQueryInformationHandleTable (_In_ PPH_HANDLE_TABLE HandleTable, _In_ PH_HANDLE_TABLE_INFORMATION_CLASS InformationClass, _Out_writes_bytes_opt_(BufferLength) PVOID Buffer, _In_ ULONG BufferLength, _Out_opt_ PULONG ReturnLength)
 
NTSTATUS NTAPI PhSetInformationHandleTable (_Inout_ PPH_HANDLE_TABLE HandleTable, _In_ PH_HANDLE_TABLE_INFORMATION_CLASS InformationClass, _In_reads_bytes_(BufferLength) PVOID Buffer, _In_ ULONG BufferLength)
 
VOID PhWorkQueueInitialization (VOID)
 
PHLIBAPI VOID NTAPI PhInitializeWorkQueue (_Out_ PPH_WORK_QUEUE WorkQueue, _In_ ULONG MinimumThreads, _In_ ULONG MaximumThreads, _In_ ULONG NoWorkTimeout)
 Initializes a work queue.
 
PHLIBAPI VOID NTAPI PhDeleteWorkQueue (_Inout_ PPH_WORK_QUEUE WorkQueue)
 Frees resources used by a work queue.
 
PHLIBAPI VOID NTAPI PhWaitForWorkQueue (_Inout_ PPH_WORK_QUEUE WorkQueue)
 Waits for all queued work items to be executed.
 
PHLIBAPI VOID NTAPI PhQueueItemWorkQueue (_Inout_ PPH_WORK_QUEUE WorkQueue, _In_ PUSER_THREAD_START_ROUTINE Function, _In_opt_ PVOID Context)
 Queues a work item to a work queue.
 
VOID PhQueueItemWorkQueueEx (_Inout_ PPH_WORK_QUEUE WorkQueue, _In_ PUSER_THREAD_START_ROUTINE Function, _In_opt_ PVOID Context, _In_opt_ PPH_WORK_QUEUE_ITEM_DELETE_FUNCTION DeleteFunction)
 Queues a work item to a work queue.
 
PHLIBAPI VOID NTAPI PhQueueItemGlobalWorkQueue (_In_ PUSER_THREAD_START_ROUTINE Function, _In_opt_ PVOID Context)
 Queues a work item to the global work queue.
 

Variables

PHLIBAPI _User_set_ PVOID PhLibImageBase
 
PHLIBAPI _User_set_ PWSTR PhApplicationName
 
PHLIBAPI ULONG PhCurrentSessionId
 
PHLIBAPI HANDLE PhCurrentTokenQueryHandle
 
PHLIBAPI BOOLEAN PhElevated
 
PHLIBAPI TOKEN_ELEVATION_TYPE PhElevationType
 
PHLIBAPI PVOID PhHeapHandle
 
PHLIBAPI RTL_OSVERSIONINFOEXW PhOsVersion
 
PHLIBAPI SYSTEM_BASIC_INFORMATION PhSystemBasicInformation
 
PHLIBAPI ULONG WindowsVersion
 
PHLIBAPI ACCESS_MASK ProcessQueryAccess
 
PHLIBAPI ACCESS_MASK ProcessAllAccess
 
PHLIBAPI ACCESS_MASK ThreadQueryAccess
 
PHLIBAPI ACCESS_MASK ThreadSetAccess
 
PHLIBAPI ACCESS_MASK ThreadAllAccess
 
_May_raise_ _In_ SIZE_T Size
 
PPH_OBJECT_TYPE PhStringType
 
PPH_OBJECT_TYPE PhBytesType
 
PPH_OBJECT_TYPE PhListType
 
_In_ PVOID Item
 
PPH_OBJECT_TYPE PhPointerListType
 
PPH_OBJECT_TYPE PhHashtableType
 
SID PhSeNobodySid
 
SID PhSeEveryoneSid
 
SID PhSeLocalSid
 
SID PhSeCreatorOwnerSid
 
SID PhSeCreatorGroupSid
 
SID PhSeDialupSid
 
SID PhSeNetworkSid
 
SID PhSeBatchSid
 
SID PhSeInteractiveSid
 
SID PhSeServiceSid
 
SID PhSeAnonymousLogonSid
 
SID PhSeProxySid
 
SID PhSeAuthenticatedUserSid
 
SID PhSeRestrictedCodeSid
 
SID PhSeTerminalServerUserSid
 
SID PhSeRemoteInteractiveLogonSid
 
SID PhSeLocalSystemSid
 
SID PhSeLocalServiceSid
 
SID PhSeNetworkServiceSid
 
PH_STRINGREF PhUnicodeByteOrderMark
 
BOOLEAN PhCharIsPrintable [256]
 
ULONG PhCharToInteger [256]
 
CHAR PhIntegerToChar [69]
 
CHAR PhIntegerToCharUpper [69]
 
ULONG PhCrc32Table [256]
 
WCHAR * PhIoPriorityHintNames [MaxIoPriorityTypes]
 
WCHAR * PhKThreadStateNames [MaximumThreadState]
 
WCHAR * PhKWaitReasonNames [MaximumWaitReason]
 

Macro Definition Documentation

#define _User_set_

Definition at line 55 of file phbase.h.

#define dprintf (   format,
  ... 
)

Definition at line 100 of file phbase.h.

#define PH_AVL_TREE_INIT (   CompareFunction)    { { NULL, NULL, NULL, 0 }, 0, CompareFunction }

Definition at line 3695 of file phbase.h.

#define PH_BARRIER_COUNT_INC   ((LONG_PTR)1 << PH_BARRIER_COUNT_SHIFT)

Definition at line 482 of file phbase.h.

#define PH_BARRIER_COUNT_MASK   (((LONG_PTR)1 << (sizeof(ULONG_PTR) * 8 / 2 - 1)) - 1)

Definition at line 481 of file phbase.h.

#define PH_BARRIER_COUNT_SHIFT   0

Definition at line 480 of file phbase.h.

#define PH_BARRIER_INIT (   Target)    { (ULONG_PTR)(Target) << PH_BARRIER_TARGET_SHIFT, PH_QUEUED_LOCK_INIT }

Definition at line 498 of file phbase.h.

#define PH_BARRIER_MASTER   1

Definition at line 488 of file phbase.h.

#define PH_BARRIER_OBSERVER   3

Definition at line 490 of file phbase.h.

#define PH_BARRIER_SLAVE   2

Definition at line 489 of file phbase.h.

#define PH_BARRIER_TARGET_INC   ((LONG_PTR)1 << PH_BARRIER_TARGET_SHIFT)

Definition at line 485 of file phbase.h.

#define PH_BARRIER_TARGET_MASK   (((LONG_PTR)1 << (sizeof(ULONG_PTR) * 8 / 2 - 1)) - 1)

Definition at line 484 of file phbase.h.

#define PH_BARRIER_TARGET_SHIFT   (sizeof(ULONG_PTR) * 8 / 2)

Definition at line 483 of file phbase.h.

#define PH_BARRIER_WAKING   ((LONG_PTR)1 << (sizeof(ULONG_PTR) * 8 - 1))

Definition at line 486 of file phbase.h.

#define PH_BYTESREF_INIT (   String)    { sizeof(String) - sizeof(CHAR), (String) }

Definition at line 905 of file phbase.h.

#define PH_CALLBACK_DECLARE (   Name)    PH_CALLBACK Name = { &Name.ListHead, &Name.ListHead, PH_QUEUED_LOCK_INIT, PH_QUEUED_LOCK_INIT }

Definition at line 3258 of file phbase.h.

#define PH_CONCAT_STRINGS_LENGTH_CACHE_SIZE   16

Definition at line 1297 of file phbase.h.

#define PH_EVENT_INIT   { { PH_EVENT_REFCOUNT_INC }, NULL }

Definition at line 406 of file phbase.h.

#define PH_EVENT_REFCOUNT_INC   0x2

Definition at line 374 of file phbase.h.

#define PH_EVENT_REFCOUNT_MASK   (((ULONG_PTR)1 << 15) - 1)

Definition at line 375 of file phbase.h.

#define PH_EVENT_REFCOUNT_SHIFT   1

Definition at line 373 of file phbase.h.

#define PH_EVENT_SET   0x1

Definition at line 371 of file phbase.h.

#define PH_EVENT_SET_SHIFT   0

Definition at line 372 of file phbase.h.

#define PH_HANDLE_TABLE_FREE_COUNT   64

Definition at line 3817 of file phbase.h.

#define PH_HANDLE_TABLE_SAFE

Definition at line 3816 of file phbase.h.

#define PH_HANDLE_TABLE_STRICT_FIFO   0x1

Definition at line 3819 of file phbase.h.

#define PH_HANDLE_TABLE_VALID_FLAGS   0x1

Definition at line 3820 of file phbase.h.

#define PH_HASH_SET_INIT   { 0 }

Definition at line 2605 of file phbase.h.

#define PH_HASH_SET_SIZE (   Buckets)    (sizeof(Buckets) / sizeof(PPH_HASH_ENTRY))

Definition at line 2606 of file phbase.h.

#define PH_HASHTABLE_ENTRY_SIZE (   InnerSize)    (FIELD_OFFSET(PH_HASHTABLE_ENTRY, Body) + (InnerSize))

Definition at line 2924 of file phbase.h.

#define PH_HASHTABLE_GET_ENTRY (   Hashtable,
  Index 
)
Value:
((PPH_HASHTABLE_ENTRY)PTR_ADD_OFFSET((Hashtable)->Entries, \
PH_HASHTABLE_ENTRY_SIZE((Hashtable)->EntrySize) * (Index)))

Definition at line 2925 of file phbase.h.

#define PH_HASHTABLE_GET_ENTRY_INDEX (   Hashtable,
  Entry 
)
Value:
((ULONG)(PTR_ADD_OFFSET(Entry, -(Hashtable)->Entries) / \
PH_HASHTABLE_ENTRY_SIZE((Hashtable)->EntrySize)))

Definition at line 2928 of file phbase.h.

#define PH_HASHTABLE_POWER_OF_TWO_SIZE

Definition at line 2888 of file phbase.h.

#define PH_INITONCE_INIT   { PH_EVENT_INIT }

Definition at line 659 of file phbase.h.

#define PH_INITONCE_INITIALIZING   (0x1 << PH_INITONCE_SHIFT)

Definition at line 649 of file phbase.h.

#define PH_INITONCE_INITIALIZING_SHIFT   PH_INITONCE_SHIFT

Definition at line 650 of file phbase.h.

#define PH_INITONCE_SHIFT   31

Definition at line 648 of file phbase.h.

#define PH_IS_LIST_POINTER_VALID (   Pointer)    (!((ULONG_PTR)(Pointer) & 0x1))

Definition at line 2530 of file phbase.h.

#define PH_RUNDOWN_ACTIVE   0x1

Definition at line 530 of file phbase.h.

#define PH_RUNDOWN_PROTECT_INIT   { 0 }

Definition at line 539 of file phbase.h.

#define PH_RUNDOWN_REF_INC   0x2

Definition at line 532 of file phbase.h.

#define PH_RUNDOWN_REF_SHIFT   1

Definition at line 531 of file phbase.h.

#define PH_SPLIT_AT_CHAR_SET   0x0

Definition at line 1051 of file phbase.h.

#define PH_SPLIT_AT_RANGE   0x2

Definition at line 1053 of file phbase.h.

#define PH_SPLIT_AT_STRING   0x1

Definition at line 1052 of file phbase.h.

#define PH_SPLIT_CASE_INSENSITIVE   0x1000

Definition at line 1054 of file phbase.h.

#define PH_SPLIT_CHAR_SET_IS_UPPERCASE   0x8000

Definition at line 1057 of file phbase.h.

#define PH_SPLIT_COMPLEMENT_CHAR_SET   0x2000

Definition at line 1055 of file phbase.h.

#define PH_SPLIT_START_AT_END   0x4000

Definition at line 1056 of file phbase.h.

#define PH_STRINGREF_INIT (   String)    { sizeof(String) - sizeof(WCHAR), (String) }

Definition at line 904 of file phbase.h.

#define PH_TIMESPAN_DHMS   2

Definition at line 3390 of file phbase.h.

#define PH_TIMESPAN_HMS   0

Definition at line 3388 of file phbase.h.

#define PH_TIMESPAN_HMSM   1

Definition at line 3389 of file phbase.h.

#define PH_TIMESPAN_STR_LEN   30

Definition at line 3385 of file phbase.h.

#define PH_TIMESPAN_STR_LEN_1   (PH_TIMESPAN_STR_LEN + 1)

Definition at line 3386 of file phbase.h.

#define PH_TRIM_END_ONLY   0x2

Definition at line 1072 of file phbase.h.

#define PH_TRIM_START_ONLY   0x1

Definition at line 1071 of file phbase.h.

#define PH_UNICODE_BYTE_ORDER_MARK   0xfeff

Definition at line 1914 of file phbase.h.

#define PH_UNICODE_MAX_CODE_POINT   0x10ffff

Definition at line 1915 of file phbase.h.

#define PH_UNICODE_UTF16   1

Definition at line 1924 of file phbase.h.

#define PH_UNICODE_UTF16_IS_HIGH_SURROGATE (   CodeUnit)    ((CodeUnit) >= 0xd800 && (CodeUnit) <= 0xdbff)

Definition at line 1919 of file phbase.h.

#define PH_UNICODE_UTF16_IS_LOW_SURROGATE (   CodeUnit)    ((CodeUnit) >= 0xdc00 && (CodeUnit) <= 0xdfff)

Definition at line 1920 of file phbase.h.

#define PH_UNICODE_UTF16_TO_CODE_POINT (   HighSurrogate,
  LowSurrogate 
)    (((ULONG)(HighSurrogate) << 10) + (ULONG)(LowSurrogate) - 0x35fdc00)

Definition at line 1921 of file phbase.h.

#define PH_UNICODE_UTF16_TO_HIGH_SURROGATE (   CodePoint)    ((USHORT)((CodePoint) >> 10) + 0xd7c0)

Definition at line 1917 of file phbase.h.

#define PH_UNICODE_UTF16_TO_LOW_SURROGATE (   CodePoint)    ((USHORT)((CodePoint) & 0x3ff) + 0xdc00)

Definition at line 1918 of file phbase.h.

#define PH_UNICODE_UTF32   2

Definition at line 1925 of file phbase.h.

#define PH_UNICODE_UTF8   0

Definition at line 1923 of file phbase.h.

#define PhEndInitOnce   PhfEndInitOnce

Definition at line 676 of file phbase.h.

#define PhInitFormatA (   f,
  v,
 
)    do { (f)->Type = DoubleFormatType | FormatHexadecimalForm | FormatUsePrecision; (f)->u.Double = (v); (f)->Precision = (p); } while (0)

Definition at line 3540 of file phbase.h.

#define PhInitFormatC (   f,
 
)    do { (f)->Type = CharFormatType; (f)->u.Char = (v); } while (0)

Definition at line 3526 of file phbase.h.

#define PhInitFormatD (   f,
 
)    do { (f)->Type = Int32FormatType; (f)->u.Int32 = (v); } while (0)

Definition at line 3530 of file phbase.h.

#define PhInitFormatE (   f,
  v,
 
)    do { (f)->Type = DoubleFormatType | FormatStandardForm | FormatUsePrecision; (f)->u.Double = (v); (f)->Precision = (p); } while (0)

Definition at line 3539 of file phbase.h.

#define PhInitFormatF (   f,
  v,
 
)    do { (f)->Type = DoubleFormatType | FormatUsePrecision; (f)->u.Double = (v); (f)->Precision = (p); } while (0)

Definition at line 3538 of file phbase.h.

#define PhInitFormatI64D (   f,
 
)    do { (f)->Type = Int64FormatType; (f)->u.Int64 = (v); } while (0)

Definition at line 3533 of file phbase.h.

#define PhInitFormatI64U (   f,
 
)    do { (f)->Type = UInt64FormatType; (f)->u.UInt64 = (v); } while (0)

Definition at line 3534 of file phbase.h.

#define PhInitFormatI64X (   f,
 
)    do { (f)->Type = UInt64FormatType | FormatUseRadix; (f)->u.UInt64 = (v); (f)->Radix = 16; } while (0)

Definition at line 3535 of file phbase.h.

#define PhInitFormatIU (   f,
 
)    do { (f)->Type = UIntPtrFormatType; (f)->u.UIntPtr = (v); } while (0)

Definition at line 3536 of file phbase.h.

#define PhInitFormatIX (   f,
 
)    do { (f)->Type = UIntPtrFormatType | FormatUseRadix; (f)->u.UIntPtr = (v); (f)->Radix = 16; } while (0)

Definition at line 3537 of file phbase.h.

#define PhInitFormatMultiByteS (   f,
 
)    do { (f)->Type = MultiByteStringFormatType; PhInitializeBytesRef(&(f)->u.MultiByteString, (v)); } while (0)

Definition at line 3529 of file phbase.h.

#define PhInitFormatS (   f,
 
)    do { (f)->Type = StringFormatType; PhInitializeStringRef(&(f)->u.String, (v)); } while (0)

Definition at line 3527 of file phbase.h.

#define PhInitFormatSize (   f,
 
)    do { (f)->Type = SizeFormatType; (f)->u.Size = (v); } while (0)

Definition at line 3541 of file phbase.h.

#define PhInitFormatSR (   f,
 
)    do { (f)->Type = StringFormatType; (f)->u.String = (v); } while (0)

Definition at line 3528 of file phbase.h.

#define PhInitFormatU (   f,
 
)    do { (f)->Type = UInt32FormatType; (f)->u.UInt32 = (v); } while (0)

Definition at line 3531 of file phbase.h.

#define PhInitFormatX (   f,
 
)    do { (f)->Type = UInt32FormatType | FormatUseRadix; (f)->u.UInt32 = (v); (f)->Radix = 16; } while (0)

Definition at line 3532 of file phbase.h.

#define PhInitializeInitOnce   PhfInitializeInitOnce

Definition at line 661 of file phbase.h.

#define PhIsLeftChildElement (   Links)    ((Links)->Parent->Left == (Links))

Definition at line 3667 of file phbase.h.

#define PhIsRightChildElement (   Links)    ((Links)->Parent->Right == (Links))

Definition at line 3668 of file phbase.h.

#define PHLIB_INIT_MODULE_HANDLE_TABLE   0x8

Needed to use handle tables.

Definition at line 116 of file phbase.h.

#define PHLIB_INIT_MODULE_IO_SUPPORT   0x10

Needed to use file streams.

Basic I/O functions do not require this in order to work.

Definition at line 118 of file phbase.h.

#define PHLIB_INIT_MODULE_RESERVED1   0x1

Definition at line 111 of file phbase.h.

#define PHLIB_INIT_MODULE_RESERVED2   0x2

Definition at line 112 of file phbase.h.

#define PHLIB_INIT_MODULE_RESERVED3   0x40

Definition at line 121 of file phbase.h.

#define PHLIB_INIT_MODULE_SYMBOL_PROVIDER   0x20

Needed to use symbol providers.

Definition at line 120 of file phbase.h.

#define PHLIB_INIT_MODULE_WORK_QUEUE   0x4

Needed to use work queues.

Definition at line 114 of file phbase.h.

#define PHLIB_INIT_TOKEN_INFO   0x100000

Retrieves token information (e.g.

elevation status).

Definition at line 125 of file phbase.h.

#define PHLIBAPI

Definition at line 31 of file phbase.h.

#define PhResetEvent   PhfResetEvent

Definition at line 444 of file phbase.h.

#define PhRootElementAvlTree (   Tree)    ((Tree)->Root.Right)

Definition at line 3697 of file phbase.h.

#define PhSetEvent   PhfSetEvent

Definition at line 415 of file phbase.h.

#define PhWaitForBarrier   PhfWaitForBarrier

Definition at line 508 of file phbase.h.

#define UNICODE

Definition at line 23 of file phbase.h.

#define WINDOWS_10   100

Definition at line 82 of file phbase.h.

#define WINDOWS_7   61

Definition at line 79 of file phbase.h.

#define WINDOWS_8   62

Definition at line 80 of file phbase.h.

#define WINDOWS_8_1   63

Definition at line 81 of file phbase.h.

#define WINDOWS_ANCIENT   0

Definition at line 75 of file phbase.h.

#define WINDOWS_HAS_CONSOLE_HOST   (WindowsVersion >= WINDOWS_7)

Definition at line 85 of file phbase.h.

#define WINDOWS_HAS_CYCLE_TIME   (WindowsVersion >= WINDOWS_VISTA)

Definition at line 86 of file phbase.h.

#define WINDOWS_HAS_IFILEDIALOG   (WindowsVersion >= WINDOWS_VISTA)

Definition at line 87 of file phbase.h.

#define WINDOWS_HAS_IMAGE_FILE_NAME_BY_PROCESS_ID   (WindowsVersion >= WINDOWS_VISTA)

Definition at line 88 of file phbase.h.

#define WINDOWS_HAS_IMMERSIVE   (WindowsVersion >= WINDOWS_8)

Definition at line 89 of file phbase.h.

#define WINDOWS_HAS_LIMITED_ACCESS   (WindowsVersion >= WINDOWS_VISTA)

Definition at line 90 of file phbase.h.

#define WINDOWS_HAS_PSSUSPENDRESUMEPROCESS   (WindowsVersion >= WINDOWS_VISTA)

Definition at line 91 of file phbase.h.

#define WINDOWS_HAS_SERVICE_TAGS   (WindowsVersion >= WINDOWS_VISTA)

Definition at line 92 of file phbase.h.

#define WINDOWS_HAS_UAC   (WindowsVersion >= WINDOWS_VISTA)

Definition at line 93 of file phbase.h.

#define WINDOWS_NEW   MAXLONG

Definition at line 83 of file phbase.h.

#define WINDOWS_SERVER_2003   52

Definition at line 77 of file phbase.h.

#define WINDOWS_VISTA   60

Definition at line 78 of file phbase.h.

#define WINDOWS_XP   51

Definition at line 76 of file phbase.h.

Typedef Documentation

typedef _In_ PPH_AVL_LINKS Links2

Definition at line 3685 of file phbase.h.

typedef struct _PH_AVL_LINKS PH_AVL_LINKS
typedef struct _PH_AVL_TREE PH_AVL_TREE
typedef struct _PH_BARRIER PH_BARRIER
typedef struct _PH_BYTES PH_BYTES

An 8-bit string object, which supports ASCII, UTF-8 and Windows multi-byte encodings, as well as binary data.

A byte string builder structure.

This is similar to string builder, but is based on PH_BYTES and is suitable for general binary data.

typedef struct _PH_BYTESREF PH_BYTESREF
typedef struct _PH_CALLBACK PH_CALLBACK

A callback structure.

The callback object allows multiple callback functions to be registered and notified in a thread-safe way.

A callback registration structure.

typedef struct _PH_EVENT PH_EVENT

A fast event object.

Remarks
This event object does not use a kernel event object until necessary, and frees the object automatically when it is no longer needed.
typedef struct _PH_FORMAT PH_FORMAT

Describes an element to be formatted to a string.

typedef struct _PH_FREE_LIST PH_FREE_LIST
typedef struct _PH_HASH_ENTRY PH_HASH_ENTRY
typedef struct _PH_HASHTABLE PH_HASHTABLE

A hashtable structure.

typedef struct _PH_INITONCE PH_INITONCE
typedef struct _PH_LIST PH_LIST

A list structure.

Storage is automatically allocated for new elements.

A pointer list structure.

The pointer list is similar to the normal list structure, but both insertions and deletions occur in constant time. The list is not ordered.

Definition at line 50 of file phbase.h.

Definition at line 53 of file phbase.h.

typedef struct _PH_STRING PH_STRING

A 16-bit string object, which supports UTF-16.

Remarks
The Length never includes the null terminator. Every string must have a null terminator at the end, for compatibility reasons. Thus the invariant is:
Buffer[Length / sizeof(WCHAR)] = 0

A string builder structure.

The string builder object allows you to easily construct complex strings without allocating a great number of strings in the process.

typedef struct _PH_STRINGREF PH_STRINGREF
typedef struct _PH_WORK_QUEUE PH_WORK_QUEUE
typedef struct _PH_AVL_LINKS * PPH_AVL_LINKS
typedef struct _PH_AVL_TREE * PPH_AVL_TREE
typedef struct _PH_BARRIER * PPH_BARRIER
typedef struct _PH_BYTES * PPH_BYTES
typedef struct _PH_BYTESREF * PPH_BYTESREF
typedef struct _PH_CALLBACK * PPH_CALLBACK
typedef VOID(NTAPI * PPH_CALLBACK_FUNCTION)(_In_opt_ PVOID Parameter, _In_opt_ PVOID Context)

A callback function.

Parameters
ParameterA value given to all callback functions being notified.
ContextA user-defined value passed to PhRegisterCallback().

Definition at line 3214 of file phbase.h.

typedef LONG(NTAPI * PPH_COMPARE_FUNCTION)(_In_ PVOID Item1, _In_ PVOID Item2, _In_opt_ PVOID Context)

A comparison function.

Parameters
Item1The first item.
Item2The second item.
ContextA user-defined value.
Returns
  • A positive value if Item1 > Item2,
  • A negative value if Item1 < Item2, and
  • 0 if Item1 = Item2.

Definition at line 2500 of file phbase.h.

typedef BOOLEAN(NTAPI * PPH_ENUM_AVL_TREE_CALLBACK)(_In_ PPH_AVL_TREE Tree, _In_ PPH_AVL_LINKS Element, _In_opt_ PVOID Context)

Definition at line 3768 of file phbase.h.

typedef BOOLEAN(NTAPI * PPH_ENUM_HANDLE_TABLE_CALLBACK)(_In_ PPH_HANDLE_TABLE HandleTable, _In_ HANDLE Handle, _In_ PPH_HANDLE_TABLE_ENTRY HandleTableEntry, _In_opt_ PVOID Context)

Definition at line 3875 of file phbase.h.

typedef struct _PH_EVENT * PPH_EVENT
typedef struct _PH_FORMAT * PPH_FORMAT
typedef struct _PH_FREE_LIST * PPH_FREE_LIST

Definition at line 3787 of file phbase.h.

typedef struct _PH_HASH_ENTRY * PPH_HASH_ENTRY
typedef struct _PH_HASHTABLE * PPH_HASHTABLE
typedef BOOLEAN(NTAPI * PPH_HASHTABLE_COMPARE_FUNCTION)(_In_ PVOID Entry1, _In_ PVOID Entry2)

A comparison function used by a hashtable.

Parameters
Entry1The first entry.
Entry2The second entry.
Returns
TRUE if the entries are equal, otherwise FALSE.

Definition at line 2864 of file phbase.h.

typedef ULONG(NTAPI * PPH_HASHTABLE_HASH_FUNCTION)(_In_ PVOID Entry)

A hash function used by a hashtable.

Parameters
EntryThe entry.
Returns
A hash code for the entry.
Remarks
  • Two entries which are considered to be equal by the comparison function must be given the same hash code.
  • Two different entries do not have to be given different hash codes.

Definition at line 2883 of file phbase.h.

typedef struct _PH_INITONCE * PPH_INITONCE
typedef struct _PH_LIST * PPH_LIST

Definition at line 158 of file phbase.h.

typedef struct _PH_STRING * PPH_STRING

Definition at line 47 of file phbase.h.

typedef struct _PH_STRINGREF * PPH_STRINGREF
typedef struct _PH_WORK_QUEUE * PPH_WORK_QUEUE
typedef VOID(NTAPI * PPH_WORK_QUEUE_ITEM_DELETE_FUNCTION)(_In_ PUSER_THREAD_START_ROUTINE Function, _In_ PVOID Context)

Definition at line 3962 of file phbase.h.

Enumeration Type Documentation

Enumerator:
CharFormatType 
StringFormatType 
StringZFormatType 
MultiByteStringFormatType 
MultiByteStringZFormatType 
Int32FormatType 
Int64FormatType 
IntPtrFormatType 
UInt32FormatType 
UInt64FormatType 
UIntPtrFormatType 
DoubleFormatType 
SizeFormatType 
FormatTypeMask 
FormatUsePrecision 

If not specified, for floating-point 6 is assumed.

FormatUsePad 

If not specified, ' ' is assumed.

FormatUseRadix 

If not specified, 10 is assumed.

FormatUseParameter 

If not specified, the default value is assumed.

FormatStandardForm 

Use standard form instead of normal form.

FormatHexadecimalForm 

Use hexadecimal form instead of normal form.

FormatForceDecimalPoint 

Reserved.

FormatCropZeros 

Trailing zeros and possibly the decimal point are trimmed.

FormatGroupDigits 

Group digits (with floating-point, only works when in normal form)

FormatPrefixSign 

Always insert a prefix, '+' for positive and '-' for negative.

FormatPadZeros 

Pad left with zeros, taking into consideration the sign.

Width must be specified. Format*Align cannot be used in conjunction with this flag. If FormatGroupDigits is specified, this flag is ignored.

FormatLeftAlign 

Applies left alignment.

Width must be specified.

FormatRightAlign 

Applies right alignment.

Width must be specified.

FormatUpperCase 

Make characters uppercase (only available for some types)

Definition at line 3427 of file phbase.h.

Enumerator:
HandleTableBasicInformation 
HandleTableFlagsInformation 
MaxHandleTableInfoClass 

Definition at line 3898 of file phbase.h.

Enumerator:
TreeEnumerateInOrder 
TreeEnumerateInReverseOrder 

Definition at line 3661 of file phbase.h.

Function Documentation

_May_raise_ _Check_return_ _Ret_notnull_ _Post_writable_byte_size_ ( Size  )
_Success_ ( return!  = -1)
C_ASSERT ( sizeof(PH_EVENT = =sizeof(ULONG_PTR)+sizeof(HANDLE))
C_ASSERT ( PH_INITONCE_SHIFT >=FIELD_OFFSET(PH_EVENT, AvailableForUse)*  8)
C_ASSERT ( FIELD_OFFSET(PH_FREE_LIST_ENTRY, ListEntry)  = =0x0)
C_ASSERT ( FIELD_OFFSET(PH_FREE_LIST_ENTRY, Body)  = =0x8)
typedef LONG ( NTAPI *  PPH_AVL_TREE_COMPARE_FUNCTION)
PHLIBAPI PPH_STRING NTAPI PhaConcatStrings ( _In_ ULONG  Count,
  ... 
)

Definition at line 47 of file basesupa.c.

PHLIBAPI PPH_STRING NTAPI PhaConcatStrings2 ( _In_ PWSTR  String1,
_In_ PWSTR  String2 
)

Definition at line 59 of file basesupa.c.

FORCEINLINE BOOLEAN PhAcquireRundownProtection ( _Inout_ PPH_RUNDOWN_PROTECT  Protection)

Definition at line 586 of file phbase.h.

PHLIBAPI PPH_STRING NTAPI PhaCreateString ( _In_ PWSTR  Buffer)

Definition at line 25 of file basesupa.c.

PHLIBAPI PPH_STRING NTAPI PhaCreateStringEx ( _In_opt_ PWSTR  Buffer,
_In_ SIZE_T  Length 
)

Definition at line 32 of file basesupa.c.

PHLIBAPI PPH_AVL_LINKS NTAPI PhAddElementAvlTree ( _Inout_ PPH_AVL_TREE  Tree,
_Out_ PPH_AVL_LINKS  Element 
)

Adds an element to an AVL tree.

Parameters
TreeThe tree.
ElementThe element to add.
Returns
NULL if the element was added, or an existing element.

Definition at line 492 of file collect.c.

FORCEINLINE VOID PhAddEntryHashSet ( _Inout_ PPH_HASH_ENTRY Buckets,
_In_ ULONG  NumberOfBuckets,
_Out_ PPH_HASH_ENTRY  Entry,
_In_ ULONG  Hash 
)

Adds an entry to a hash set.

Parameters
BucketsThe bucket array.
NumberOfBucketsThe number of buckets.
EntryThe entry.
HashThe hash for the entry.
Remarks
This function does not check for duplicates.

Definition at line 2729 of file phbase.h.

PHLIBAPI PVOID NTAPI PhAddEntryHashtable ( _Inout_ PPH_HASHTABLE  Hashtable,
_In_ PVOID  Entry 
)

Adds an entry to a hashtable.

Parameters
HashtableA hashtable object.
EntryThe entry to add.
Returns
A pointer to the entry as stored in the hashtable. This pointer is valid until the hashtable is modified. If the hashtable already contained an equal entry, NULL is returned.
Remarks
Entries are only guaranteed to be 8 byte aligned, even on 64-bit systems.

Definition at line 4668 of file basesup.c.

PHLIBAPI PVOID NTAPI PhAddEntryHashtableEx ( _Inout_ PPH_HASHTABLE  Hashtable,
_In_ PVOID  Entry,
_Out_opt_ PBOOLEAN  Added 
)

Adds an entry to a hashtable or returns an existing one.

Parameters
HashtableA hashtable object.
EntryThe entry to add.
AddedA variable which receives TRUE if a new entry was created, and FALSE if an existing entry was returned.
Returns
A pointer to the entry as stored in the hashtable. This pointer is valid until the hashtable is modified. If the hashtable already contained an equal entry, the existing entry is returned. Check the value of Added to determine whether the returned entry is new or existing.
Remarks
Entries are only guaranteed to be 8 byte aligned, even on 64-bit systems.

Definition at line 4703 of file basesup.c.

PHLIBAPI VOID NTAPI PhAddItemList ( _Inout_ PPH_LIST  List,
_In_ PVOID  Item 
)

Adds an item to a list.

Parameters
ListA list object.
ItemThe item to add.

Definition at line 4049 of file basesup.c.

PHLIBAPI HANDLE NTAPI PhAddItemPointerList ( _Inout_ PPH_POINTER_LIST  PointerList,
_In_ PVOID  Pointer 
)

Adds a pointer to a pointer list.

Parameters
PointerListA pointer list object.
PointerThe pointer to add. The pointer must be at least 2 byte aligned.
Returns
A handle to the pointer, valid until the pointer is removed from the pointer list.

Definition at line 4322 of file basesup.c.

PHLIBAPI PVOID NTAPI PhAddItemSimpleHashtable ( _Inout_ PPH_HASHTABLE  SimpleHashtable,
_In_opt_ PVOID  Key,
_In_opt_ PVOID  Value 
)

Definition at line 4972 of file basesup.c.

PHLIBAPI VOID NTAPI PhAddItemsList ( _Inout_ PPH_LIST  List,
_In_ PVOID *  Items,
_In_ ULONG  Count 
)

Adds items to a list.

Parameters
ListA list object.
ItemsAn array containing the items to add.
CountThe number of items to add.

Definition at line 4071 of file basesup.c.

PHLIBAPI PPH_STRING NTAPI PhaDuplicateString ( _In_ PPH_STRING  String)

Definition at line 40 of file basesupa.c.

PHLIBAPI PPH_STRING NTAPI PhaFormatString ( _In_ _Printf_format_string_ PWSTR  Format,
  ... 
)

Definition at line 67 of file basesupa.c.

FORCEINLINE PVOID PhAllocateCopy ( _In_ PVOID  Data,
_In_ SIZE_T  Size 
)

Definition at line 356 of file phbase.h.

PHLIBAPI PVOID NTAPI PhAllocateExSafe ( _In_ SIZE_T  Size,
_In_ ULONG  Flags 
)

Allocates a block of memory.

Parameters
SizeThe number of bytes to allocate.
FlagsFlags controlling the allocation.
Returns
A pointer to the allocated block of memory, or NULL if the block could not be allocated.

Definition at line 392 of file basesup.c.

PHLIBAPI PVOID NTAPI PhAllocateFromFreeList ( _Inout_ PPH_FREE_LIST  FreeList)

Allocates a block of memory from a free list.

Parameters
FreeListA pointer to a free list object.
Returns
A pointer to the allocated block of memory. The memory must be freed using PhFreeToFreeList(). The block is guaranteed to be aligned at MEMORY_ALLOCATION_ALIGNMENT bytes.

Definition at line 5070 of file basesup.c.

_Check_return_ _Ret_maybenull_ PHLIBAPI PVOID NTAPI PhAllocatePage ( _In_ SIZE_T  Size,
_Out_opt_ PSIZE_T  NewSize 
)

Allocates pages of memory.

Parameters
SizeThe number of bytes to allocate. The number of pages allocated will be large enough to contain Size bytes.
NewSizeThe number of bytes actually allocated. This is Size rounded up to the next multiple of PAGE_SIZE.
Returns
A pointer to the allocated block of memory, or NULL if the block could not be allocated.

Definition at line 472 of file basesup.c.

PHLIBAPI PVOID NTAPI PhAllocateSafe ( _In_ SIZE_T  Size)

Allocates a block of memory.

Parameters
SizeThe number of bytes to allocate.
Returns
A pointer to the allocated block of memory, or NULL if the block could not be allocated.

Definition at line 376 of file basesup.c.

PHLIBAPI PPH_STRING NTAPI PhaLowerString ( _In_ PPH_STRING  String)

Definition at line 79 of file basesupa.c.

PHLIBAPI VOID NTAPI PhAppendBytesBuilder ( _Inout_ PPH_BYTES_BUILDER  BytesBuilder,
_In_ PPH_BYTESREF  Bytes 
)

Appends a byte string to the end of a byte string builder string.

Parameters
BytesBuilderA byte string builder object.
BytesThe byte string to append.

Definition at line 3905 of file basesup.c.

PHLIBAPI VOID NTAPI PhAppendBytesBuilder2 ( _Inout_ PPH_BYTES_BUILDER  BytesBuilder,
_In_ PCHAR  Bytes 
)

Appends a byte string to the end of a byte string builder string.

Parameters
BytesBuilderA byte string builder object.
BytesThe byte string to append.

Definition at line 3925 of file basesup.c.

PHLIBAPI PVOID NTAPI PhAppendBytesBuilderEx ( _Inout_ PPH_BYTES_BUILDER  BytesBuilder,
_In_opt_ PVOID  Buffer,
_In_ SIZE_T  Length,
_In_opt_ SIZE_T  Alignment,
_Out_opt_ PSIZE_T  Offset 
)

Appends a byte string to the end of a byte string builder string.

Parameters
BytesBuilderA byte string builder object.
BufferThe byte string to append. Specify NULL to simply reserve Length bytes.
LengthThe number of bytes to append.
AlignmentThe required alignment. This should not be greater than 8.
OffsetA variable which receives the byte offset of the appended or reserved bytes in the byte string builder string.
Returns
A pointer to the appended or reserved bytes.

Definition at line 3951 of file basesup.c.

PHLIBAPI VOID NTAPI PhAppendCharStringBuilder ( _Inout_ PPH_STRING_BUILDER  StringBuilder,
_In_ WCHAR  Character 
)

Appends a character to the end of a string builder string.

Parameters
StringBuilderA string builder object.
CharacterThe character to append.

Definition at line 3597 of file basesup.c.

PHLIBAPI VOID NTAPI PhAppendCharStringBuilder2 ( _Inout_ PPH_STRING_BUILDER  StringBuilder,
_In_ WCHAR  Character,
_In_ SIZE_T  Count 
)

Appends a number of characters to the end of a string builder string.

Parameters
StringBuilderA string builder object.
CharacterThe character to append.
CountThe number of times to append the character.

Definition at line 3620 of file basesup.c.

PHLIBAPI VOID NTAPI PhAppendFormatStringBuilder ( _Inout_ PPH_STRING_BUILDER  StringBuilder,
_In_ _Printf_format_string_ PWSTR  Format,
  ... 
)

Appends a formatted string to the end of a string builder string.

Parameters
StringBuilderA string builder object.
FormatThe format-control string.

Definition at line 3652 of file basesup.c.

VOID NTAPI PhAppendFormatStringBuilder_V ( _Inout_ PPH_STRING_BUILDER  StringBuilder,
_In_ _Printf_format_string_ PWSTR  Format,
_In_ va_list  ArgPtr 
)

Definition at line 3664 of file basesup.c.

PHLIBAPI VOID NTAPI PhAppendStringBuilder ( _Inout_ PPH_STRING_BUILDER  StringBuilder,
_In_ PPH_STRINGREF  String 
)

Appends a string to the end of a string builder string.

Parameters
StringBuilderA string builder object.
StringThe string to append.

Definition at line 3523 of file basesup.c.

PHLIBAPI VOID NTAPI PhAppendStringBuilder2 ( _Inout_ PPH_STRING_BUILDER  StringBuilder,
_In_ PWSTR  String 
)

Appends a string to the end of a string builder string.

Parameters
StringBuilderA string builder object.
StringThe string to append.

Definition at line 3541 of file basesup.c.

PHLIBAPI VOID NTAPI PhAppendStringBuilderEx ( _Inout_ PPH_STRING_BUILDER  StringBuilder,
_In_opt_ PWCHAR  String,
_In_ SIZE_T  Length 
)

Appends a string to the end of a string builder string.

Parameters
StringBuilderA string builder object.
StringThe string to append. Specify NULL to simply reserve Length bytes.
LengthThe number of bytes to append.

Definition at line 3560 of file basesup.c.

FORCEINLINE BOOLEAN PhAreCharactersDifferent ( _In_ WCHAR  Char1,
_In_ WCHAR  Char2 
)

Definition at line 790 of file phbase.h.

PHLIBAPI PPH_STRING NTAPI PhaSubstring ( _In_ PPH_STRING  String,
_In_ SIZE_T  StartIndex,
_In_ SIZE_T  Count 
)

Definition at line 103 of file basesupa.c.

PHLIBAPI PPH_STRING NTAPI PhaUpperString ( _In_ PPH_STRING  String)

Definition at line 91 of file basesupa.c.

FORCEINLINE VOID PhBeginEnumHashtable ( _In_ PPH_HASHTABLE  Hashtable,
_Out_ PPH_HASHTABLE_ENUM_CONTEXT  Context 
)

Definition at line 3002 of file phbase.h.

FORCEINLINE BOOLEAN PhBeginInitOnce ( _Inout_ PPH_INITONCE  InitOnce)

Definition at line 686 of file phbase.h.

PHLIBAPI PPH_STRING NTAPI PhBufferToHexString ( _In_reads_bytes_(Length) PUCHAR  Buffer,
_In_ ULONG  Length 
)

Converts a byte array into a sequence of hexadecimal digits.

Parameters
BufferThe input buffer.
LengthThe number of bytes to convert.
Returns
A string containing a sequence of hexadecimal digits.

Definition at line 5437 of file basesup.c.

PPH_STRING NTAPI PhBufferToHexStringEx ( _In_reads_bytes_(Length) PUCHAR  Buffer,
_In_ ULONG  Length,
_In_ BOOLEAN  UpperCase 
)

Converts a byte array into a sequence of hexadecimal digits.

Parameters
BufferThe input buffer.
LengthThe number of bytes to convert.
UpperCaseTRUE to use uppercase characters, otherwise FALSE.
Returns
A string containing a sequence of hexadecimal digits.

Definition at line 5454 of file basesup.c.

PHLIBAPI VOID NTAPI PhClearHashtable ( _Inout_ PPH_HASHTABLE  Hashtable)

Clears a hashtable.

Parameters
HashtableA hashtable object.

Definition at line 4717 of file basesup.c.

PHLIBAPI VOID NTAPI PhClearList ( _Inout_ PPH_LIST  List)

Clears a list.

Parameters
ListA list object.

Definition at line 4102 of file basesup.c.

FORCEINLINE LONG PhCompareBytesZ ( _In_ PSTR  String1,
_In_ PSTR  String2,
_In_ BOOLEAN  IgnoreCase 
)

Definition at line 818 of file phbase.h.

FORCEINLINE LONG PhCompareString ( _In_ PPH_STRING  String1,
_In_ PPH_STRING  String2,
_In_ BOOLEAN  IgnoreCase 
)

Compares two strings.

Parameters
String1The first string.
String2The second string.
IgnoreCaseWhether to ignore character cases.

Definition at line 1468 of file phbase.h.

FORCEINLINE LONG PhCompareString2 ( _In_ PPH_STRING  String1,
_In_ PWSTR  String2,
_In_ BOOLEAN  IgnoreCase 
)

Compares two strings.

Parameters
String1The first string.
String2The second string.
IgnoreCaseWhether to ignore character cases.

Definition at line 1489 of file phbase.h.

PHLIBAPI LONG NTAPI PhCompareStringRef ( _In_ PPH_STRINGREF  String1,
_In_ PPH_STRINGREF  String2,
_In_ BOOLEAN  IgnoreCase 
)

Compares two strings.

Parameters
String1The first string.
String2The second string.
IgnoreCaseTRUE to perform a case-insensitive comparison, otherwise FALSE.

Definition at line 1145 of file basesup.c.

FORCEINLINE LONG PhCompareStringRef2 ( _In_ PPH_STRINGREF  String1,
_In_ PWSTR  String2,
_In_ BOOLEAN  IgnoreCase 
)

Definition at line 1085 of file phbase.h.

FORCEINLINE LONG PhCompareStringWithNull ( _In_opt_ PPH_STRING  String1,
_In_opt_ PPH_STRING  String2,
_In_ BOOLEAN  IgnoreCase 
)

Compares two strings, handling NULL strings.

Parameters
String1The first string.
String2The second string.
IgnoreCaseWhether to ignore character cases.

Definition at line 1514 of file phbase.h.

FORCEINLINE LONG PhCompareStringZ ( _In_ PWSTR  String1,
_In_ PWSTR  String2,
_In_ BOOLEAN  IgnoreCase 
)

Definition at line 846 of file phbase.h.

PHLIBAPI LONG NTAPI PhCompareStringZNatural ( _In_ PWSTR  A,
_In_ PWSTR  B,
_In_ BOOLEAN  IgnoreCase 
)

Compares two strings in natural sort order.

Parameters
AThe first string.
BThe second string.
IgnoreCaseWhether to ignore character cases.

Definition at line 1125 of file basesup.c.

PHLIBAPI PPH_STRING NTAPI PhConcatStringRef2 ( _In_ PPH_STRINGREF  String1,
_In_ PPH_STRINGREF  String2 
)

Concatenates two strings.

Parameters
String1The first string.
String2The second string.

Definition at line 2344 of file basesup.c.

PPH_STRING NTAPI PhConcatStringRef3 ( _In_ PPH_STRINGREF  String1,
_In_ PPH_STRINGREF  String2,
_In_ PPH_STRINGREF  String3 
)

Concatenates three strings.

Parameters
String1The first string.
String2The second string.
String3The third string.

Definition at line 2368 of file basesup.c.

PHLIBAPI PPH_STRING NTAPI PhConcatStrings ( _In_ ULONG  Count,
  ... 
)

Concatenates multiple strings.

Parameters
CountThe number of strings to concatenate.

Definition at line 2232 of file basesup.c.

PHLIBAPI PPH_STRING NTAPI PhConcatStrings2 ( _In_ PWSTR  String1,
_In_ PWSTR  String2 
)

Concatenates two strings.

Parameters
String1The first string.
String2The second string.

Definition at line 2312 of file basesup.c.

PHLIBAPI PPH_STRING NTAPI PhConcatStrings_V ( _In_ ULONG  Count,
_In_ va_list  ArgPtr 
)

Concatenates multiple strings.

Parameters
CountThe number of strings to concatenate.
ArgPtrA pointer to an array of strings.

Definition at line 2250 of file basesup.c.

PHLIBAPI PPH_STRING NTAPI PhConvertMultiByteToUtf16 ( _In_ PSTR  Buffer)

Creates a string object from an existing null-terminated multi-byte string.

Parameters
BufferA null-terminated multi-byte string.

Definition at line 2998 of file basesup.c.

PHLIBAPI PPH_STRING NTAPI PhConvertMultiByteToUtf16Ex ( _In_ PCHAR  Buffer,
_In_ SIZE_T  Length 
)

Creates a string object from an existing null-terminated multi-byte string.

Parameters
BufferA null-terminated multi-byte string.
LengthThe number of bytes to use.

Definition at line 3014 of file basesup.c.

FORCEINLINE PPH_BYTES PhConvertUtf16ToAscii ( _In_ PWSTR  Buffer,
_In_opt_ CHAR  Replacement 
)

Definition at line 2039 of file phbase.h.

PHLIBAPI PPH_BYTES NTAPI PhConvertUtf16ToAsciiEx ( _In_ PWCH  Buffer,
_In_ SIZE_T  Length,
_In_opt_ CHAR  Replacement 
)

Definition at line 2945 of file basesup.c.

PHLIBAPI PPH_BYTES NTAPI PhConvertUtf16ToMultiByte ( _In_ PWSTR  Buffer)

Creates a multi-byte string from an existing null-terminated UTF-16 string.

Parameters
BufferA null-terminated UTF-16 string.

Definition at line 3055 of file basesup.c.

PHLIBAPI PPH_BYTES NTAPI PhConvertUtf16ToMultiByteEx ( _In_ PWCHAR  Buffer,
_In_ SIZE_T  Length 
)

Creates a multi-byte string from an existing null-terminated UTF-16 string.

Parameters
BufferA null-terminated UTF-16 string.
LengthThe number of bytes to use.

Definition at line 3071 of file basesup.c.

PHLIBAPI PPH_BYTES NTAPI PhConvertUtf16ToUtf8 ( _In_ PWSTR  Buffer)

Definition at line 3367 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhConvertUtf16ToUtf8Buffer ( _Out_writes_bytes_to_(MaxBytesInUtf8String,*BytesInUtf8String) PCH  Utf8String,
_In_ SIZE_T  MaxBytesInUtf8String,
_Out_opt_ PSIZE_T  BytesInUtf8String,
_In_reads_bytes_(BytesInUtf16String) PWCH  Utf16String,
_In_ SIZE_T  BytesInUtf16String 
)

Definition at line 3297 of file basesup.c.

PHLIBAPI PPH_BYTES NTAPI PhConvertUtf16ToUtf8Ex ( _In_ PWCHAR  Buffer,
_In_ SIZE_T  Length 
)

Definition at line 3377 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhConvertUtf16ToUtf8Size ( _Out_ PSIZE_T  BytesInUtf8String,
_In_reads_bytes_(BytesInUtf16String) PWCH  Utf16String,
_In_ SIZE_T  BytesInUtf16String 
)

Definition at line 3257 of file basesup.c.

PHLIBAPI PPH_STRING NTAPI PhConvertUtf8ToUtf16 ( _In_ PSTR  Buffer)

Definition at line 3213 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhConvertUtf8ToUtf16Buffer ( _Out_writes_bytes_to_(MaxBytesInUtf16String,*BytesInUtf16String) PWCH  Utf16String,
_In_ SIZE_T  MaxBytesInUtf16String,
_Out_opt_ PSIZE_T  BytesInUtf16String,
_In_reads_bytes_(BytesInUtf8String) PCH  Utf8String,
_In_ SIZE_T  BytesInUtf8String 
)

Definition at line 3147 of file basesup.c.

PHLIBAPI PPH_STRING NTAPI PhConvertUtf8ToUtf16Ex ( _In_ PCHAR  Buffer,
_In_ SIZE_T  Length 
)

Definition at line 3223 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhConvertUtf8ToUtf16Size ( _Out_ PSIZE_T  BytesInUtf16String,
_In_reads_bytes_(BytesInUtf8String) PCH  Utf8String,
_In_ SIZE_T  BytesInUtf8String 
)

Definition at line 3107 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhCopyBytesZ ( _In_ PSTR  InputBuffer,
_In_ SIZE_T  InputCount,
_Out_writes_opt_z_(OutputCount) PSTR  OutputBuffer,
_In_ SIZE_T  OutputCount,
_Out_opt_ PSIZE_T  ReturnCount 
)

Copies a string with optional null termination and a maximum number of characters.

Parameters
InputBufferA pointer to the input string.
InputCountThe maximum number of characters to copy, not including the null terminator. Specify -1 for no limit.
OutputBufferA pointer to the output buffer.
OutputCountThe number of characters in the output buffer, including the null terminator.
ReturnCountA variable which receives the number of characters required to contain the input string, including the null terminator. If the function returns TRUE, this variable contains the number of characters written to the output buffer.
Returns
TRUE if the input string was copied to the output string, otherwise FALSE.
Remarks
The function stops copying when it encounters the first null character in the input string. It will also stop copying when it reaches the character count specified in InputCount, if InputCount is not -1.

Definition at line 671 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhCopyStringZ ( _In_ PWSTR  InputBuffer,
_In_ SIZE_T  InputCount,
_Out_writes_opt_z_(OutputCount) PWSTR  OutputBuffer,
_In_ SIZE_T  OutputCount,
_Out_opt_ PSIZE_T  ReturnCount 
)

Copies a string with optional null termination and a maximum number of characters.

Parameters
InputBufferA pointer to the input string.
InputCountThe maximum number of characters to copy, not including the null terminator. Specify -1 for no limit.
OutputBufferA pointer to the output buffer.
OutputCountThe number of characters in the output buffer, including the null terminator.
ReturnCountA variable which receives the number of characters required to contain the input string, including the null terminator. If the function returns TRUE, this variable contains the number of characters written to the output buffer.
Returns
TRUE if the input string was copied to the output string, otherwise FALSE.
Remarks
The function stops copying when it encounters the first null character in the input string. It will also stop copying when it reaches the character count specified in InputCount, if InputCount is not -1.

Definition at line 741 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhCopyStringZFromBytes ( _In_ PSTR  InputBuffer,
_In_ SIZE_T  InputCount,
_Out_writes_opt_z_(OutputCount) PWSTR  OutputBuffer,
_In_ SIZE_T  OutputCount,
_Out_opt_ PSIZE_T  ReturnCount 
)

Copies a string with optional null termination and a maximum number of characters.

Parameters
InputBufferA pointer to the input string.
InputCountThe maximum number of characters to copy, not including the null terminator. Specify -1 for no limit.
OutputBufferA pointer to the output buffer.
OutputCountThe number of characters in the output buffer, including the null terminator.
ReturnCountA variable which receives the number of characters required to contain the input string, including the null terminator. If the function returns TRUE, this variable contains the number of characters written to the output buffer.
Returns
TRUE if the input string was copied to the output string, otherwise FALSE.
Remarks
The function stops copying when it encounters the first null character in the input string. It will also stop copying when it reaches the character count specified in InputCount, if InputCount is not -1.

Definition at line 811 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhCopyStringZFromMultiByte ( _In_ PSTR  InputBuffer,
_In_ SIZE_T  InputCount,
_Out_writes_opt_z_(OutputCount) PWSTR  OutputBuffer,
_In_ SIZE_T  OutputCount,
_Out_opt_ PSIZE_T  ReturnCount 
)

Copies a string with optional null termination and a maximum number of characters.

Parameters
InputBufferA pointer to the input string.
InputCountThe maximum number of characters to copy, not including the null terminator. Specify -1 for no limit.
OutputBufferA pointer to the output buffer.
OutputCountThe number of characters in the output buffer, including the null terminator.
ReturnCountA variable which receives the number of characters required to contain the input string, including the null terminator. If the function returns TRUE, this variable contains the number of characters written to the output buffer.
Returns
TRUE if the input string was copied to the output string, otherwise FALSE.
Remarks
The function stops copying when it encounters the first null character in the input string. It will also stop copying when it reaches the character count specified in InputCount, if InputCount is not -1.

Definition at line 881 of file basesup.c.

FORCEINLINE ULONG PhCountHashSet ( _In_ PPH_HASH_ENTRY Buckets,
_In_ ULONG  NumberOfBuckets 
)

Determines the number of entries in a hash set.

Parameters
BucketsThe bucket array.
NumberOfBucketsThe number of buckets.
Returns
The number of entries in the hash set.

Definition at line 2656 of file phbase.h.

PHLIBAPI SIZE_T NTAPI PhCountStringZ ( _In_ PWSTR  String)

Determines the length of the specified string, in characters.

Parameters
StringThe string.

Definition at line 527 of file basesup.c.

PHLIBAPI PPH_BYTES NTAPI PhCreateBytes ( _In_ PSTR  Buffer)

Creates a bytes object from an existing null-terminated string of bytes.

Parameters
BufferA null-terminated byte string.

Definition at line 2443 of file basesup.c.

FORCEINLINE PPH_BYTES PhCreateBytes2 ( _In_ PPH_BYTESREF  Bytes)

Definition at line 1905 of file phbase.h.

PHLIBAPI PPH_BYTES NTAPI PhCreateBytesEx ( _In_opt_ PCHAR  Buffer,
_In_ SIZE_T  Length 
)

Creates a bytes object.

Parameters
BufferAn array of bytes.
LengthThe length of Buffer, in bytes.

Definition at line 2456 of file basesup.c.

HANDLE NTAPI PhCreateHandle ( _Inout_ PPH_HANDLE_TABLE  HandleTable,
_In_ PPH_HANDLE_TABLE_ENTRY  HandleTableEntry 
)

Definition at line 234 of file handle.c.

PPH_HANDLE_TABLE NTAPI PhCreateHandleTable ( VOID  )

Definition at line 45 of file handle.c.

FORCEINLINE PPH_HASH_ENTRY* PhCreateHashSet ( _In_ ULONG  NumberOfBuckets)

Allocates and initializes a hash set.

Parameters
NumberOfBucketsThe number of buckets.
Returns
The allocated hash set. You must free it with PhFree() when you no longer need it.

Definition at line 2634 of file phbase.h.

PHLIBAPI PPH_HASHTABLE NTAPI PhCreateHashtable ( _In_ ULONG  EntrySize,
_In_ PPH_HASHTABLE_COMPARE_FUNCTION  CompareFunction,
_In_ PPH_HASHTABLE_HASH_FUNCTION  HashFunction,
_In_ ULONG  InitialCapacity 
)

Creates a hashtable object.

Parameters
EntrySizeThe size of each hashtable entry, in bytes.
CompareFunctionA comparison function that is executed to compare two hashtable entries.
HashFunctionA hash function that is executed to generate a hash code for a hashtable entry.
InitialCapacityThe number of entries to allocate storage for initially.

Definition at line 4495 of file basesup.c.

PHLIBAPI PPH_LIST NTAPI PhCreateList ( _In_ ULONG  InitialCapacity)

Creates a list object.

Parameters
InitialCapacityThe number of elements to allocate storage for initially.

Definition at line 3994 of file basesup.c.

PHLIBAPI PPH_POINTER_LIST NTAPI PhCreatePointerList ( _In_ ULONG  InitialCapacity)

Creates a pointer list object.

Parameters
InitialCapacityThe number of elements to allocate storage for initially.

Definition at line 4241 of file basesup.c.

PHLIBAPI PPH_HASHTABLE NTAPI PhCreateSimpleHashtable ( _In_ ULONG  InitialCapacity)

Definition at line 4960 of file basesup.c.

PHLIBAPI PPH_STRING NTAPI PhCreateString ( _In_ PWSTR  Buffer)

Creates a string object from an existing null-terminated string.

Parameters
BufferA null-terminated Unicode string.

Definition at line 2154 of file basesup.c.

FORCEINLINE PPH_STRING PhCreateString2 ( _In_ PPH_STRINGREF  String)

Definition at line 1266 of file phbase.h.

PHLIBAPI PPH_STRING NTAPI PhCreateStringEx ( _In_opt_ PWCHAR  Buffer,
_In_ SIZE_T  Length 
)

Creates a string object using a specified length.

Parameters
BufferA null-terminated Unicode string.
LengthThe length, in bytes, of the string.

Definition at line 2167 of file basesup.c.

FORCEINLINE PPH_STRING PhCreateStringFromUnicodeString ( _In_ PUNICODE_STRING  UnicodeString)

Definition at line 1275 of file phbase.h.

PHLIBAPI HANDLE NTAPI PhCreateThread ( _In_opt_ SIZE_T  StackSize,
_In_ PUSER_THREAD_START_ROUTINE  StartAddress,
_In_opt_ PVOID  Parameter 
)

Creates a thread.

Parameters
StackSizeThe initial stack size of the thread.
StartAddressThe function to execute in the thread.
ParameterA user-defined value to pass to the function.

Definition at line 236 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhDecodeUnicodeDecoder ( _Inout_ PPH_UNICODE_DECODER  Decoder,
_Out_ PULONG  CodePoint 
)

Definition at line 2597 of file basesup.c.

PHLIBAPI VOID NTAPI PhDeleteBytesBuilder ( _Inout_ PPH_BYTES_BUILDER  BytesBuilder)

Frees resources used by a byte string builder object.

Parameters
BytesBuilderA byte string builder object.

Definition at line 3836 of file basesup.c.

PHLIBAPI VOID NTAPI PhDeleteCallback ( _Inout_ PPH_CALLBACK  Callback)

Frees resources used by a callback object.

Parameters
CallbackA pointer to a callback object.

Definition at line 5139 of file basesup.c.

PHLIBAPI VOID NTAPI PhDeleteFreeList ( _Inout_ PPH_FREE_LIST  FreeList)

Frees resources used by a free list object.

Parameters
FreeListA pointer to the free list object.

Definition at line 5043 of file basesup.c.

PHLIBAPI VOID NTAPI PhDeleteStringBuilder ( _Inout_ PPH_STRING_BUILDER  StringBuilder)

Frees resources used by a string builder object.

Parameters
StringBuilderA string builder object.

Definition at line 3451 of file basesup.c.

PHLIBAPI VOID NTAPI PhDeleteWorkQueue ( _Inout_ PPH_WORK_QUEUE  WorkQueue)

Frees resources used by a work queue.

Parameters
WorkQueueA work queue object.

Definition at line 137 of file workqueue.c.

BOOLEAN NTAPI PhDestroyHandle ( _Inout_ PPH_HANDLE_TABLE  HandleTable,
_In_ HANDLE  Handle,
_In_opt_ PPH_HANDLE_TABLE_ENTRY  HandleTableEntry 
)

Definition at line 263 of file handle.c.

VOID NTAPI PhDestroyHandleTable ( _In_ _Post_invalid_ PPH_HANDLE_TABLE  HandleTable)

Definition at line 96 of file handle.c.

FORCEINLINE VOID PhDistributeHashSet ( _Inout_ PPH_HASH_ENTRY NewBuckets,
_In_ ULONG  NumberOfNewBuckets,
_In_ PPH_HASH_ENTRY OldBuckets,
_In_ ULONG  NumberOfOldBuckets 
)

Moves entries from one hash set to another.

Parameters
NewBucketsThe new bucket array.
NumberOfNewBucketsThe number of buckets in NewBuckets.
OldBucketsThe old bucket array.
NumberOfOldBucketsThe number of buckets in OldBuckets.
Remarks
NewBuckets and OldBuckets must be different.

Definition at line 2688 of file phbase.h.

PHLIBAPI VOID NTAPI PhDivideSinglesBySingle ( _Inout_updates_(Count) PFLOAT  A,
_In_ FLOAT  B,
_In_ SIZE_T  Count 
)

Divides an array of numbers by a number.

Parameters
AThe destination array, divided by B.
BThe number.
CountThe number of elements.

Definition at line 5805 of file basesup.c.

PHLIBAPI NTSTATUS NTAPI PhDosErrorToNtStatus ( _In_ ULONG  DosError)

Converts a Win32 error code to a NTSTATUS value.

Remarks
Only a small number of cases are currently supported. Other status values are wrapped using FACILITY_NTWIN32.

Definition at line 47 of file error.c.

PHLIBAPI PSTR NTAPI PhDuplicateBytesZ ( _In_ PSTR  String)

Allocates space for and copies a byte string.

Parameters
StringThe string to duplicate.
Returns
The new string, which can be freed using PhFree().

Definition at line 581 of file basesup.c.

PHLIBAPI PSTR NTAPI PhDuplicateBytesZSafe ( _In_ PSTR  String)

Allocates space for and copies a byte string.

Parameters
StringThe string to duplicate.
Returns
The new string, which can be freed using PhFree(), or NULL if storage could not be allocated.

Definition at line 604 of file basesup.c.

FORCEINLINE PPH_STRING PhDuplicateString ( _In_ PPH_STRING  String)

Duplicates a string.

Parameters
StringA string to duplicate.

Definition at line 1452 of file phbase.h.

PHLIBAPI PWSTR NTAPI PhDuplicateStringZ ( _In_ PWSTR  String)

Allocates space for and copies a 16-bit string.

Parameters
StringThe string to duplicate.
Returns
The new string, which can be freed using PhFree().

Definition at line 630 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhEncodeUnicode ( _In_ UCHAR  Encoding,
_In_ ULONG  CodePoint,
_Out_opt_ PVOID  CodeUnits,
_Out_ PULONG  NumberOfCodeUnits 
)

Definition at line 2794 of file basesup.c.

FORCEINLINE BOOLEAN PhEndsWithString ( _In_ PPH_STRING  String,
_In_ PPH_STRING  Suffix,
_In_ BOOLEAN  IgnoreCase 
)

Determines whether a string ends with another.

Parameters
StringThe first string.
SuffixThe second string.
IgnoreCaseWhether to ignore character cases.
Returns
TRUE if String ends with Suffix, otherwise FALSE.

Definition at line 1632 of file phbase.h.

FORCEINLINE BOOLEAN PhEndsWithString2 ( _In_ PPH_STRING  String,
_In_ PWSTR  Suffix,
_In_ BOOLEAN  IgnoreCase 
)

Determines whether a string ends with another.

Parameters
StringThe first string.
SuffixThe second string.
IgnoreCaseWhether to ignore character cases.
Returns
TRUE if String ends with Suffix, otherwise FALSE.

Definition at line 1652 of file phbase.h.

FORCEINLINE BOOLEAN PhEndsWithStringRef ( _In_ PPH_STRINGREF  String,
_In_ PPH_STRINGREF  Suffix,
_In_ BOOLEAN  IgnoreCase 
)

Definition at line 1149 of file phbase.h.

FORCEINLINE BOOLEAN PhEndsWithStringRef2 ( _In_ PPH_STRINGREF  String,
_In_ PWSTR  Suffix,
_In_ BOOLEAN  IgnoreCase 
)

Definition at line 1168 of file phbase.h.

PHLIBAPI VOID NTAPI PhEnumAvlTree ( _In_ PPH_AVL_TREE  Tree,
_In_ PH_TREE_ENUMERATION_ORDER  Order,
_In_ PPH_ENUM_AVL_TREE_CALLBACK  Callback,
_In_opt_ PVOID  Context 
)

Enumerates the elements in an AVL tree.

Parameters
TreeThe tree.
OrderThe enumeration order.
CallbackThe callback function.
ContextA user-defined value to pass to the callback function.

Definition at line 894 of file collect.c.

VOID NTAPI PhEnumHandleTable ( _In_ PPH_HANDLE_TABLE  HandleTable,
_In_ PPH_ENUM_HANDLE_TABLE_CALLBACK  Callback,
_In_opt_ PVOID  Context 
)

Definition at line 317 of file handle.c.

PHLIBAPI BOOLEAN NTAPI PhEnumHashtable ( _In_ PPH_HASHTABLE  Hashtable,
_Out_ PVOID *  Entry,
_Inout_ PULONG  EnumerationKey 
)

Enumerates the entries in a hashtable.

Parameters
HashtableA hashtable object.
EntryA variable which receives a pointer to the hashtable entry. The pointer is valid until the hashtable is modified.
EnumerationKeyA variable which is initialized to 0 before first calling this function.
Returns
TRUE if an entry pointer was stored in Entry, FALSE if there are no more entries.
Remarks
Do not modify the hashtable while the hashtable is being enumerated (between calls to this function). Otherwise, the function may behave unexpectedly. You may reset the EnumerationKey variable to 0 if you wish to restart the enumeration.

Definition at line 4751 of file basesup.c.

FORCEINLINE BOOLEAN PhEnumPointerList ( _In_ PPH_POINTER_LIST  PointerList,
_Inout_ PULONG  EnumerationKey,
_Out_ PVOID *  Pointer 
)

Definition at line 2575 of file phbase.h.

PHLIBAPI BOOLEAN NTAPI PhEnumPointerListEx ( _In_ PPH_POINTER_LIST  PointerList,
_Inout_ PULONG  EnumerationKey,
_Out_ PVOID *  Pointer,
_Out_ PHANDLE  PointerHandle 
)

Definition at line 4359 of file basesup.c.

FORCEINLINE BOOLEAN PhEqualBytesZ ( _In_ PSTR  String1,
_In_ PSTR  String2,
_In_ BOOLEAN  IgnoreCase 
)

Definition at line 832 of file phbase.h.

FORCEINLINE BOOLEAN PhEqualString ( _In_ PPH_STRING  String1,
_In_ PPH_STRING  String2,
_In_ BOOLEAN  IgnoreCase 
)

Determines whether two strings are equal.

Parameters
String1The first string.
String2The second string.
IgnoreCaseWhether to ignore character cases.

Definition at line 1543 of file phbase.h.

FORCEINLINE BOOLEAN PhEqualString2 ( _In_ PPH_STRING  String1,
_In_ PWSTR  String2,
_In_ BOOLEAN  IgnoreCase 
)

Determines whether two strings are equal.

Parameters
String1The first string.
String2The second string.
IgnoreCaseWhether to ignore character cases.

Definition at line 1561 of file phbase.h.

PHLIBAPI BOOLEAN NTAPI PhEqualStringRef ( _In_ PPH_STRINGREF  String1,
_In_ PPH_STRINGREF  String2,
_In_ BOOLEAN  IgnoreCase 
)

Determines if two strings are equal.

Parameters
String1The first string.
String2The second string.
IgnoreCaseTRUE to perform a case-insensitive comparison, otherwise FALSE.

Definition at line 1217 of file basesup.c.

FORCEINLINE BOOLEAN PhEqualStringRef2 ( _In_ PPH_STRINGREF  String1,
_In_ PWSTR  String2,
_In_ BOOLEAN  IgnoreCase 
)

Definition at line 1100 of file phbase.h.

FORCEINLINE BOOLEAN PhEqualStringZ ( _In_ PWSTR  String1,
_In_ PWSTR  String2,
_In_ BOOLEAN  IgnoreCase 
)

Definition at line 860 of file phbase.h.

PHLIBAPI ULONG NTAPI PhExponentiate ( _In_ ULONG  Base,
_In_ ULONG  Exponent 
)

Performs exponentiation.

Definition at line 5354 of file basesup.c.

PHLIBAPI ULONG64 NTAPI PhExponentiate64 ( _In_ ULONG64  Base,
_In_ ULONG  Exponent 
)

Performs 64-bit exponentiation.

Definition at line 5376 of file basesup.c.

PHLIBAPI BOOLEAN FASTCALL PhfAcquireRundownProtection ( _Inout_ PPH_RUNDOWN_PROTECT  Protection)

Definition at line 373 of file sync.c.

PHLIBAPI BOOLEAN FASTCALL PhfBeginInitOnce ( _Inout_ PPH_INITONCE  InitOnce)

Definition at line 497 of file sync.c.

PHLIBAPI VOID FASTCALL PhfEndInitOnce ( _Inout_ PPH_INITONCE  InitOnce)

Definition at line 509 of file sync.c.

PHLIBAPI VOID NTAPI PhFillMemoryUlong ( _Inout_updates_(Count) _Needs_align_(4) PULONG  Memory,
_In_ ULONG  Value,
_In_ SIZE_T  Count 
)

Fills a memory block with a ULONG pattern.

Parameters
MemoryThe memory block. The block must be 4 byte aligned.
ValueThe ULONG pattern.
CountThe number of elements.

Definition at line 5717 of file basesup.c.

PHLIBAPI PPH_BYTES NTAPI PhFinalBytesBuilderBytes ( _Inout_ PPH_BYTES_BUILDER  BytesBuilder)

Obtains a reference to the byte string constructed by a byte string builder object and frees resources used by the object.

Parameters
BytesBuilderA byte string builder object.
Returns
A pointer to a byte string. You must free the byte string using PhDereferenceObject() when you no longer need it.

Definition at line 3854 of file basesup.c.

PHLIBAPI PPH_STRING NTAPI PhFinalStringBuilderString ( _Inout_ PPH_STRING_BUILDER  StringBuilder)

Obtains a reference to the string constructed by a string builder object and frees resources used by the object.

Parameters
StringBuilderA string builder object.
Returns
A pointer to a string. You must free the string using PhDereferenceObject() when you no longer need it.

Definition at line 3469 of file basesup.c.

FORCEINLINE ULONG_PTR PhFindCharInString ( _In_ PPH_STRING  String,
_In_ SIZE_T  StartIndex,
_In_ WCHAR  Char 
)

Locates a character in a string.

Parameters
StringThe string to search.
StartIndexThe index, in characters, to start searching at.
CharThe character to search for.
Returns
The index, in characters, of the first occurrence of Char in String after StartIndex. If Char was not found, -1 is returned.

Definition at line 1678 of file phbase.h.

PHLIBAPI ULONG_PTR NTAPI PhFindCharInStringRef ( _In_ PPH_STRINGREF  String,
_In_ WCHAR  Character,
_In_ BOOLEAN  IgnoreCase 
)

Locates a character in a string.

Parameters
StringThe string to search.
CharacterThe character to search for.
IgnoreCaseTRUE to perform a case-insensitive search, otherwise FALSE.
Returns
The index, in characters, of the first occurrence of Character in String1. If Character was not found, -1 is returned.

Definition at line 1366 of file basesup.c.

PHLIBAPI PPH_AVL_LINKS NTAPI PhFindElementAvlTree ( _In_ PPH_AVL_TREE  Tree,
_In_ PPH_AVL_LINKS  Element 
)

Finds an element in an AVL tree.

Parameters
TreeThe tree.
ElementAn element to find.
Returns
The element, or NULL if it could not be found.

Definition at line 706 of file collect.c.

PHLIBAPI PPH_AVL_LINKS NTAPI PhFindElementAvlTree2 ( _In_ PPH_AVL_TREE  Tree,
_In_ PPH_AVL_LINKS  Element,
_Out_ PLONG  Result 
)

Finds an element in an AVL tree.

Parameters
TreeThe tree.
ElementThe element to find.
ResultThe result of the search.
Returns
The closest element, or NULL if the tree is empty.

Definition at line 731 of file collect.c.

FORCEINLINE PPH_HASH_ENTRY PhFindEntryHashSet ( _In_ PPH_HASH_ENTRY Buckets,
_In_ ULONG  NumberOfBuckets,
_In_ ULONG  Hash 
)

Begins the process of finding an entry in a hash set.

Parameters
BucketsThe bucket array.
NumberOfBucketsThe number of buckets.
HashThe hash for the entry.
Returns
The first entry in the chain.
Remarks
If the function returns NULL, the entry does not exist in the hash set.

Definition at line 2759 of file phbase.h.

PHLIBAPI PVOID NTAPI PhFindEntryHashtable ( _In_ PPH_HASHTABLE  Hashtable,
_In_ PVOID  Entry 
)

Locates an entry in a hashtable.

Parameters
HashtableA hashtable object.
EntryAn entry representing the entry to find.
Returns
A pointer to the entry as stored in the hashtable. This pointer is valid until the hashtable is modified. If the entry could not be found, NULL is returned.
Remarks
The entry specified in Entry can be a partial entry that is filled in enough so that the comparison and hash functions can work with them.

Definition at line 4790 of file basesup.c.

PHLIBAPI HANDLE NTAPI PhFindItemPointerList ( _In_ PPH_POINTER_LIST  PointerList,
_In_ PVOID  Pointer 
)

Locates a pointer in a pointer list.

Parameters
PointerListA pointer list object.
PointerThe pointer to find. The pointer must be at least 2 byte aligned.
Returns
A handle to the pointer, valid until the pointer is removed from the pointer list. If the pointer is not contained in the pointer list, NULL is returned.

Definition at line 4398 of file basesup.c.

PHLIBAPI PVOID* NTAPI PhFindItemSimpleHashtable ( _In_ PPH_HASHTABLE  SimpleHashtable,
_In_opt_ PVOID  Key 
)

Definition at line 4989 of file basesup.c.

FORCEINLINE PVOID NTAPI PhFindItemSimpleHashtable2 ( _In_ PPH_HASHTABLE  SimpleHashtable,
_In_opt_ PVOID  Key 
)

Definition at line 3125 of file phbase.h.

FORCEINLINE ULONG_PTR PhFindLastCharInString ( _In_ PPH_STRING  String,
_In_ SIZE_T  StartIndex,
_In_ WCHAR  Char 
)

Locates a character in a string, backwards.

Parameters
StringThe string to search.
StartIndexThe index, in characters, to start searching at.
CharThe character to search for.
Returns
The index, in characters, of the last occurrence of Char in String after StartIndex. If Char was not found, -1 is returned.

Definition at line 1717 of file phbase.h.

PHLIBAPI ULONG_PTR NTAPI PhFindLastCharInStringRef ( _In_ PPH_STRINGREF  String,
_In_ WCHAR  Character,
_In_ BOOLEAN  IgnoreCase 
)

Locates a character in a string, searching backwards.

Parameters
StringThe string to search.
CharacterThe character to search for.
IgnoreCaseTRUE to perform a case-insensitive search, otherwise FALSE.
Returns
The index, in characters, of the last occurrence of Character in String1. If Character was not found, -1 is returned.

Definition at line 1452 of file basesup.c.

FORCEINLINE ULONG_PTR PhFindStringInString ( _In_ PPH_STRING  String,
_In_ SIZE_T  StartIndex,
_In_ PWSTR  SubString 
)

Locates a string in a string.

Parameters
StringThe string to search.
StartIndexThe index, in characters, to start searching at.
SubStringThe string to search for.
Returns
The index, in characters, of the first occurrence of SubString in String after StartIndex. If SubString was not found, -1 is returned.

Definition at line 1756 of file phbase.h.

PHLIBAPI ULONG_PTR NTAPI PhFindStringInStringRef ( _In_ PPH_STRINGREF  String,
_In_ PPH_STRINGREF  SubString,
_In_ BOOLEAN  IgnoreCase 
)

Locates a string in a string.

Parameters
StringThe string to search.
SubStringThe string to search for.
IgnoreCaseTRUE to perform a case-insensitive search, otherwise FALSE.
Returns
The index, in characters, of the first occurrence of SubString in String. If SubString was not found, -1 is returned.

Definition at line 1545 of file basesup.c.

PHLIBAPI VOID FASTCALL PhfInitializeBarrier ( _Out_ PPH_BARRIER  Barrier,
_In_ ULONG_PTR  Target 
)

Definition at line 220 of file sync.c.

PHLIBAPI VOID FASTCALL PhfInitializeEvent ( _Out_ PPH_EVENT  Event)

Initializes an event object.

Parameters
EventA pointer to an event object.

Definition at line 58 of file sync.c.

PHLIBAPI VOID FASTCALL PhfInitializeInitOnce ( _Out_ PPH_INITONCE  InitOnce)

Definition at line 490 of file sync.c.

PHLIBAPI VOID FASTCALL PhfInitializeRundownProtection ( _Out_ PPH_RUNDOWN_PROTECT  Protection)

Definition at line 366 of file sync.c.

PHLIBAPI PPH_STRING NTAPI PhFormat ( _In_reads_(Count) PPH_FORMAT  Format,
_In_ ULONG  Count,
_In_opt_ SIZE_T  InitialCapacity 
)

Creates a formatted string.

Parameters
FormatAn array of format structures.
CountThe number of structures supplied in Format.
InitialCapacityThe number of bytes to reserve initially for the string. If 0 is specified, a default value is used.

Definition at line 105 of file format.c.

PHLIBAPI PPH_STRING NTAPI PhFormatString ( _In_ _Printf_format_string_ PWSTR  Format,
  ... 
)

Creates a string using format specifiers.

Parameters
FormatThe format-control string.

Definition at line 2400 of file basesup.c.

PHLIBAPI PPH_STRING NTAPI PhFormatString_V ( _In_ _Printf_format_string_ PWSTR  Format,
_In_ va_list  ArgPtr 
)

Creates a string using format specifiers.

Parameters
FormatThe format-control string.
ArgPtrA pointer to the list of arguments.

Definition at line 2418 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhFormatToBuffer ( _In_reads_(Count) PPH_FORMAT  Format,
_In_ ULONG  Count,
_Out_writes_bytes_opt_(BufferLength) PWSTR  Buffer,
_In_opt_ SIZE_T  BufferLength,
_Out_opt_ PSIZE_T  ReturnLength 
)

Writes a formatted string to a buffer.

Parameters
FormatAn array of format structures.
CountThe number of structures supplied in Format.
BufferA buffer. If NULL, no data is written.
BufferLengthThe number of bytes available in Buffer, including space for the null terminator.
ReturnLengthThe number of bytes required to hold the string, including the null terminator.
Returns
TRUE if the buffer was large enough and the string was written (i.e. BufferLength >= ReturnLength), otherwise FALSE. In either case, the required number of bytes is stored in ReturnLength.
Remarks
If the function fails but BufferLength != 0, a single null byte is written to the start of Buffer.

Definition at line 175 of file format.c.

PHLIBAPI VOID NTAPI PhFree ( _Frees_ptr_opt_ PVOID  Memory)

Frees a block of memory allocated with PhAllocate().

Parameters
MemoryA pointer to a block of memory.

Definition at line 406 of file basesup.c.

PHLIBAPI VOID NTAPI PhFreePage ( _Frees_ptr_opt_ PVOID  Memory)

Frees pages of memory allocated with PhAllocatePage().

Parameters
MemoryA pointer to a block of memory.

Definition at line 506 of file basesup.c.

PHLIBAPI VOID NTAPI PhFreeToFreeList ( _Inout_ PPH_FREE_LIST  FreeList,
_In_ PVOID  Memory 
)

Frees a block of memory to a free list.

Parameters
FreeListA pointer to a free list object.
MemoryA pointer to a block of memory.

Definition at line 5098 of file basesup.c.

PHLIBAPI VOID FASTCALL PhfReleaseRundownProtection ( _Inout_ PPH_RUNDOWN_PROTECT  Protection)

Definition at line 398 of file sync.c.

PHLIBAPI VOID FASTCALL PhfResetEvent ( _Inout_ PPH_EVENT  Event)

Resets an event's state.

Parameters
EventA pointer to an event object.
Remarks
This function is not thread-safe. Make sure no other threads are using the event when you call this function.

Definition at line 210 of file sync.c.

PHLIBAPI VOID FASTCALL PhfSetEvent ( _Inout_ PPH_EVENT  Event)

Sets an event object.

Any threads waiting on the event will be released.

Parameters
EventA pointer to an event object.

Definition at line 110 of file sync.c.

PHLIBAPI BOOLEAN FASTCALL PhfWaitForBarrier ( _Inout_ PPH_BARRIER  Barrier,
_In_ BOOLEAN  Spin 
)

Waits until all threads are blocking on the barrier, and resets the state of the barrier.

Parameters
BarrierA barrier.
SpinTRUE to spin on the barrier before blocking, FALSE to block immediately.
Returns
TRUE for an unspecified thread after each phase, and FALSE for all other threads.
Remarks
By checking the return value of the function, in each phase an action can be performed exactly once. This could, for example, involve merging the results of calculations.

Definition at line 281 of file sync.c.

PHLIBAPI BOOLEAN FASTCALL PhfWaitForEvent ( _Inout_ PPH_EVENT  Event,
_In_opt_ PLARGE_INTEGER  Timeout 
)

Waits for an event object to be set.

Parameters
EventA pointer to an event object.
TimeoutThe timeout value.
Returns
TRUE if the event object was set before the timeout period expired, otherwise FALSE.
Remarks
To test the event, use PhTestEvent() instead of using a timeout of zero.

Definition at line 142 of file sync.c.

PHLIBAPI VOID FASTCALL PhfWaitForRundownProtection ( _Inout_ PPH_RUNDOWN_PROTECT  Protection)

Definition at line 439 of file sync.c.

FORCEINLINE PVOID PhGetDllHandle ( _In_ PWSTR  DllName)

Definition at line 199 of file phbase.h.

PHLIBAPI ULONG NTAPI PhGetPrimeNumber ( _In_ ULONG  Minimum)

Retrieves a prime number bigger than or equal to the specified number.

Definition at line 5299 of file basesup.c.

FORCEINLINE PVOID PhGetProcedureAddress ( _In_ PVOID  DllHandle,
_In_opt_ PSTR  ProcedureName,
_In_opt_ ULONG  ProcedureNumber 
)

Definition at line 216 of file phbase.h.

FORCEINLINE PWSTR PhGetString ( _In_opt_ PPH_STRING  String)

Retrieves a pointer to a string object's buffer or returns NULL.

Parameters
StringA pointer to a string object.
Returns
A pointer to the string object's buffer if the supplied pointer is non-NULL, otherwise NULL.

Definition at line 1359 of file phbase.h.

FORCEINLINE PWSTR PhGetStringOrDefault ( _In_opt_ PPH_STRING  String,
_In_ PWSTR  DefaultString 
)

Retrieves a pointer to a string object's buffer or returns the specified alternative string.

Parameters
StringA pointer to a string object.
DefaultStringThe alternative string.
Returns
A pointer to the string object's buffer if the supplied pointer is non-NULL, otherwise the specified alternative string.

Definition at line 1420 of file phbase.h.

FORCEINLINE PWSTR PhGetStringOrEmpty ( _In_opt_ PPH_STRING  String)

Retrieves a pointer to a string object's buffer or returns an empty string.

Parameters
StringA pointer to a string object.
Returns
A pointer to the string object's buffer if the supplied pointer is non-NULL, otherwise an empty string.

Definition at line 1397 of file phbase.h.

FORCEINLINE PH_STRINGREF PhGetStringRef ( _In_opt_ PPH_STRING  String)

Definition at line 1371 of file phbase.h.

VOID PhHandleTableInitialization ( VOID  )

Definition at line 29 of file handle.c.

PHLIBAPI ULONG NTAPI PhHashBytes ( _In_reads_(Length) PUCHAR  Bytes,
_In_ SIZE_T  Length 
)

Generates a hash code for a sequence of bytes.

Parameters
BytesA pointer to a byte array.
LengthThe number of bytes to hash.

Definition at line 4882 of file basesup.c.

FORCEINLINE ULONG PhHashInt32 ( _In_ ULONG  Value)

Definition at line 3050 of file phbase.h.

FORCEINLINE ULONG PhHashInt64 ( _In_ ULONG64  Value)

Definition at line 3061 of file phbase.h.

FORCEINLINE ULONG PhHashIntPtr ( _In_ ULONG_PTR  Value)

Definition at line 3079 of file phbase.h.

PHLIBAPI ULONG NTAPI PhHashStringRef ( _In_ PPH_STRINGREF  String,
_In_ BOOLEAN  IgnoreCase 
)

Generates a hash code for a string.

Parameters
StringThe string to hash.
IgnoreCaseTRUE for a case-insensitive hash function, otherwise FALSE.

Definition at line 4909 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhHexStringToBuffer ( _In_ PPH_STRINGREF  String,
_Out_writes_bytes_(String->Length/sizeof(WCHAR)/2) PUCHAR  Buffer 
)

Converts a sequence of hexadecimal digits into a byte array.

Parameters
StringA string containing hexadecimal digits to convert. The string must have an even number of digits, because each pair of hexadecimal digits represents one byte. Example: "129a2eff5c0b".
BufferThe output buffer.
Returns
TRUE if the string was successfully converted, otherwise FALSE.

Definition at line 5405 of file basesup.c.

PHLIBAPI VOID NTAPI PhInitializeAvlTree ( _Out_ PPH_AVL_TREE  Tree,
_In_ PPH_AVL_TREE_COMPARE_FUNCTION  CompareFunction 
)

Initializes an AVL tree.

Parameters
TreeThe tree.
CompareFunctionA function used to compare tree elements.

Definition at line 31 of file collect.c.

FORCEINLINE VOID PhInitializeBarrier ( _Out_ PPH_BARRIER  Barrier,
_In_ ULONG_PTR  Target 
)

Definition at line 519 of file phbase.h.

BOOLEAN PhInitializeBase ( _In_ ULONG  Flags)

Initializes the base support module.

Definition at line 138 of file basesup.c.

PHLIBAPI VOID NTAPI PhInitializeBytesBuilder ( _Out_ PPH_BYTES_BUILDER  BytesBuilder,
_In_ SIZE_T  InitialCapacity 
)

Initializes a byte string builder object.

Parameters
BytesBuilderA byte string builder object.
InitialCapacityThe number of bytes to allocate initially.

Definition at line 3820 of file basesup.c.

FORCEINLINE VOID PhInitializeBytesRef ( _Out_ PPH_BYTESREF  Bytes,
_In_ PSTR  Buffer 
)

Definition at line 931 of file phbase.h.

PHLIBAPI VOID NTAPI PhInitializeCallback ( _Out_ PPH_CALLBACK  Callback)

Initializes a callback object.

Parameters
CallbackA pointer to a callback object.

Definition at line 5125 of file basesup.c.

FORCEINLINE VOID PhInitializeEmptyStringRef ( _Out_ PPH_STRINGREF  String)

Definition at line 942 of file phbase.h.

FORCEINLINE VOID PhInitializeEvent ( _Out_ PPH_EVENT  Event)

Definition at line 454 of file phbase.h.

PHLIBAPI VOID NTAPI PhInitializeFreeList ( _Out_ PPH_FREE_LIST  FreeList,
_In_ SIZE_T  Size,
_In_ ULONG  MaximumCount 
)

Initializes a free list object.

Parameters
FreeListA pointer to the free list object.
SizeThe number of bytes in each allocation.
MaximumCountThe number of unused allocations to store.

Definition at line 5026 of file basesup.c.

FORCEINLINE VOID PhInitializeHashSet ( _Out_ PPH_HASH_ENTRY Buckets,
_In_ ULONG  NumberOfBuckets 
)

Initializes a hash set.

Parameters
BucketsThe bucket array.
NumberOfBucketsThe number of buckets.

Definition at line 2616 of file phbase.h.

NTSTATUS PhInitializePhLib ( VOID  )

Definition at line 66 of file global.c.

NTSTATUS PhInitializePhLibEx ( _In_ ULONG  Flags,
_In_opt_ SIZE_T  HeapReserveSize,
_In_opt_ SIZE_T  HeapCommitSize 
)

Definition at line 77 of file global.c.

FORCEINLINE VOID PhInitializeRundownProtection ( _Out_ PPH_RUNDOWN_PROTECT  Protection)

Definition at line 577 of file phbase.h.

PHLIBAPI VOID NTAPI PhInitializeStringBuilder ( _Out_ PPH_STRING_BUILDER  StringBuilder,
_In_ SIZE_T  InitialCapacity 
)

Initializes a string builder object.

Parameters
StringBuilderA string builder object.
InitialCapacityThe number of bytes to allocate initially.

Definition at line 3418 of file basesup.c.

FORCEINLINE VOID PhInitializeStringRef ( _Out_ PPH_STRINGREF  String,
_In_ PWSTR  Buffer 
)

Definition at line 909 of file phbase.h.

FORCEINLINE VOID PhInitializeStringRefLongHint ( _Out_ PPH_STRINGREF  String,
_In_ PWSTR  Buffer 
)

Definition at line 920 of file phbase.h.

FORCEINLINE VOID PhInitializeUnicodeDecoder ( _Out_ PPH_UNICODE_DECODER  Decoder,
_In_ UCHAR  Encoding 
)

Definition at line 1963 of file phbase.h.

PHLIBAPI VOID NTAPI PhInitializeWorkQueue ( _Out_ PPH_WORK_QUEUE  WorkQueue,
_In_ ULONG  MinimumThreads,
_In_ ULONG  MaximumThreads,
_In_ ULONG  NoWorkTimeout 
)

Initializes a work queue.

Parameters
WorkQueueA work queue object.
MinimumThreadsThe suggested minimum number of threads to keep alive, even when there is no work to be performed.
MaximumThreadsThe suggested maximum number of threads to create.
NoWorkTimeoutThe number of milliseconds after which threads without work will terminate.

Definition at line 101 of file workqueue.c.

PHLIBAPI VOID NTAPI PhInsertItemList ( _Inout_ PPH_LIST  List,
_In_ ULONG  Index,
_In_ PVOID  Item 
)

Inserts an item into a list.

Parameters
ListA list object.
IndexThe index at which to insert the item.
ItemThe item to add.

Definition at line 4142 of file basesup.c.

PHLIBAPI VOID NTAPI PhInsertItemsList ( _Inout_ PPH_LIST  List,
_In_ ULONG  Index,
_In_ PVOID *  Items,
_In_ ULONG  Count 
)

Inserts items into a list.

Parameters
ListA list object.
IndexThe index at which to insert the items.
ItemsAn array containing the items to add.
CountThe number of items to add.

Definition at line 4159 of file basesup.c.

PHLIBAPI VOID NTAPI PhInsertStringBuilder ( _Inout_ PPH_STRING_BUILDER  StringBuilder,
_In_ SIZE_T  Index,
_In_ PPH_STRINGREF  String 
)

Inserts a string into a string builder string.

Parameters
StringBuilderA string builder object.
IndexThe index, in characters, at which to insert the string.
StringThe string to insert.

Definition at line 3702 of file basesup.c.

PHLIBAPI VOID NTAPI PhInsertStringBuilder2 ( _Inout_ PPH_STRING_BUILDER  StringBuilder,
_In_ SIZE_T  Index,
_In_ PWSTR  String 
)

Inserts a string into a string builder string.

Parameters
StringBuilderA string builder object.
IndexThe index, in characters, at which to insert the string.
StringThe string to insert.

Definition at line 3724 of file basesup.c.

PHLIBAPI VOID NTAPI PhInsertStringBuilderEx ( _Inout_ PPH_STRING_BUILDER  StringBuilder,
_In_ SIZE_T  Index,
_In_opt_ PWCHAR  String,
_In_ SIZE_T  Length 
)

Inserts a string into a string builder string.

Parameters
StringBuilderA string builder object.
IndexThe index, in characters, at which to insert the string.
StringThe string to insert. Specify NULL to simply reserve Length bytes at Index.
LengthThe number of bytes to insert.

Definition at line 3748 of file basesup.c.

PHLIBAPI PPH_STRING NTAPI PhIntegerToString64 ( _In_ LONG64  Integer,
_In_opt_ ULONG  Base,
_In_ BOOLEAN  Signed 
)

Converts an integer to a string.

Parameters
IntegerThe integer to process.
BaseThe base which the integer is represented with. The maximum value is
  1. The base cannot be 1. If the parameter is 0, the base used is 10.
SignedTRUE if Integer is a signed value, otherwise FALSE.
Returns
The resulting string, or NULL if an error occurred.

Definition at line 5642 of file basesup.c.

PHLIBAPI VOID NTAPI PhInvokeCallback ( _In_ PPH_CALLBACK  Callback,
_In_opt_ PVOID  Parameter 
)

Notifies all registered callback functions.

Parameters
CallbackA pointer to a callback object.
ParameterA value to pass to all callback functions.

Definition at line 5246 of file basesup.c.

FORCEINLINE BOOLEAN PhIsDigitCharacter ( _In_ WCHAR  Char)

Definition at line 809 of file phbase.h.

BOOLEAN PhIsExecutingInWow64 ( VOID  )

Definition at line 117 of file global.c.

FORCEINLINE BOOLEAN PhIsNullOrEmptyString ( _In_opt_ PPH_STRING  String)

Determines whether a string is null or empty.

Parameters
StringA pointer to a string object.

Definition at line 1438 of file phbase.h.

PHLIBAPI VOID NTAPI PhLocalTimeToSystemTime ( _In_ PLARGE_INTEGER  LocalTime,
_Out_ PLARGE_INTEGER  SystemTime 
)

Converts local time to system time.

Parameters
LocalTimeA local time value.
SystemTimeA variable which receives the UTC time value. This may be the same variable as LocalTime.
Remarks
Use this function instead of RtlLocalTimeToSystemTime() because no system calls are involved.

Definition at line 333 of file basesup.c.

BOOLEAN NTAPI PhLockHandleTableEntry ( _Inout_ PPH_HANDLE_TABLE  HandleTable,
_Inout_ PPH_HANDLE_TABLE_ENTRY  HandleTableEntry 
)

Definition at line 192 of file handle.c.

PPH_HANDLE_TABLE_ENTRY NTAPI PhLookupHandleTableEntry ( _In_ PPH_HANDLE_TABLE  HandleTable,
_In_ HANDLE  Handle 
)

Definition at line 299 of file handle.c.

FORCEINLINE VOID PhLowerString ( _Inout_ PPH_STRING  String)

Converts a string to lowercase in-place.

Parameters
StringThe string to convert.

Definition at line 1811 of file phbase.h.

PHLIBAPI PPH_AVL_LINKS NTAPI PhMaximumElementAvlTree ( _In_ PPH_AVL_TREE  Tree)

Finds the biggest element in an AVL tree.

Parameters
TreeThe tree.
Returns
An element, or NULL if the tree is empty.

Definition at line 781 of file collect.c.

PHLIBAPI PPH_AVL_LINKS NTAPI PhMinimumElementAvlTree ( _In_ PPH_AVL_TREE  Tree)

Finds the smallest element in an AVL tree.

Parameters
TreeThe tree.
Returns
An element, or NULL if the tree is empty.

Definition at line 757 of file collect.c.

FORCEINLINE PVOID PhNextEnumHashtable ( _Inout_ PPH_HASHTABLE_ENUM_CONTEXT  Context)

Definition at line 3014 of file phbase.h.

PHLIBAPI BOOLEAN NTAPI PhNtStatusFileNotFound ( _In_ NTSTATUS  Status)

Determines whether a NTSTATUS value indicates that a file cannot be not found.

Definition at line 73 of file error.c.

PHLIBAPI ULONG NTAPI PhNtStatusToDosError ( _In_ NTSTATUS  Status)

Converts a NTSTATUS value to a Win32 error code.

Remarks
This function handles FACILITY_NTWIN32 status values properly, unlike RtlNtStatusToDosError.

Definition at line 31 of file error.c.

FORCEINLINE PVOID PhOffsetBytesBuilder ( _In_ PPH_BYTES_BUILDER  BytesBuilder,
_In_ SIZE_T  Offset 
)

Definition at line 2350 of file phbase.h.

PHLIBAPI PPH_AVL_LINKS NTAPI PhPredecessorElementAvlTree ( _In_ PPH_AVL_LINKS  Element)

Finds the previous element in an AVL tree.

Parameters
ElementThe element.
Returns
The previous element, or NULL if there are no more elements.

Definition at line 848 of file collect.c.

PHLIBAPI VOID NTAPI PhPrintTimeSpan ( _Out_writes_(PH_TIMESPAN_STR_LEN_1) PWSTR  Destination,
_In_ ULONG64  Ticks,
_In_opt_ ULONG  Mode 
)

Definition at line 5667 of file basesup.c.

NTSTATUS NTAPI PhQueryInformationHandleTable ( _In_ PPH_HANDLE_TABLE  HandleTable,
_In_ PH_HANDLE_TABLE_INFORMATION_CLASS  InformationClass,
_Out_writes_bytes_opt_(BufferLength) PVOID  Buffer,
_In_ ULONG  BufferLength,
_Out_opt_ PULONG  ReturnLength 
)

Definition at line 380 of file handle.c.

PHLIBAPI VOID NTAPI PhQuerySystemTime ( _Out_ PLARGE_INTEGER  SystemTime)

Gets the current system time (UTC).

Remarks
Use this function instead of NtQuerySystemTime() because no system calls are involved.

Definition at line 277 of file basesup.c.

PHLIBAPI VOID NTAPI PhQueryTimeZoneBias ( _Out_ PLARGE_INTEGER  TimeZoneBias)

Gets the offset of the current time zone from UTC.

Definition at line 291 of file basesup.c.

PHLIBAPI VOID NTAPI PhQueueItemGlobalWorkQueue ( _In_ PUSER_THREAD_START_ROUTINE  Function,
_In_opt_ PVOID  Context 
)

Queues a work item to the global work queue.

Parameters
FunctionA function to execute.
ContextA user-defined value to pass to the function.

Definition at line 421 of file workqueue.c.

PHLIBAPI VOID NTAPI PhQueueItemWorkQueue ( _Inout_ PPH_WORK_QUEUE  WorkQueue,
_In_ PUSER_THREAD_START_ROUTINE  Function,
_In_opt_ PVOID  Context 
)

Queues a work item to a work queue.

Parameters
WorkQueueA work queue object.
FunctionA function to execute.
ContextA user-defined value to pass to the function.

Definition at line 363 of file workqueue.c.

VOID PhQueueItemWorkQueueEx ( _Inout_ PPH_WORK_QUEUE  WorkQueue,
_In_ PUSER_THREAD_START_ROUTINE  Function,
_In_opt_ PVOID  Context,
_In_opt_ PPH_WORK_QUEUE_ITEM_DELETE_FUNCTION  DeleteFunction 
)

Queues a work item to a work queue.

Parameters
WorkQueueA work queue object.
FunctionA function to execute.
ContextA user-defined value to pass to the function.
DeleteFunctionA callback function that is executed when the work queue item is about to be freed.

Definition at line 380 of file workqueue.c.

PHLIBAPI PVOID NTAPI PhReAllocateSafe ( _In_ PVOID  Memory,
_In_ SIZE_T  Size 
)

Re-allocates a block of memory originally allocated with PhAllocate().

Parameters
MemoryA pointer to a block of memory.
SizeThe new size of the memory block, in bytes.
Returns
A pointer to the new block of memory, or NULL if the block could not be allocated. The existing contents of the memory block are copied to the new block.

Definition at line 451 of file basesup.c.

PHLIBAPI PPH_STRING NTAPI PhReferenceEmptyString ( VOID  )

Obtains a reference to a zero-length string.

Definition at line 2195 of file basesup.c.

PHLIBAPI VOID NTAPI PhRegisterCallback ( _Inout_ PPH_CALLBACK  Callback,
_In_ PPH_CALLBACK_FUNCTION  Function,
_In_opt_ PVOID  Context,
_Out_ PPH_CALLBACK_REGISTRATION  Registration 
)

Registers a callback function to be notified.

Parameters
CallbackA pointer to a callback object.
FunctionThe callback function.
ContextA user-defined value to pass to the callback function.
RegistrationA variable which receives registration information for the callback. Do not modify the contents of this structure and do not free the storage for this structure until you have unregistered the callback.

Definition at line 5159 of file basesup.c.

PHLIBAPI VOID NTAPI PhRegisterCallbackEx ( _Inout_ PPH_CALLBACK  Callback,
_In_ PPH_CALLBACK_FUNCTION  Function,
_In_opt_ PVOID  Context,
_In_ USHORT  Flags,
_Out_ PPH_CALLBACK_REGISTRATION  Registration 
)

Registers a callback function to be notified.

Parameters
CallbackA pointer to a callback object.
FunctionThe callback function.
ContextA user-defined value to pass to the callback function.
FlagsA combination of flags controlling the callback. Set this parameter to 0.
RegistrationA variable which receives registration information for the callback. Do not modify the contents of this structure and do not free the storage for this structure until you have unregistered the callback.

Definition at line 5190 of file basesup.c.

FORCEINLINE VOID PhReleaseRundownProtection ( _Inout_ PPH_RUNDOWN_PROTECT  Protection)

Definition at line 610 of file phbase.h.

PHLIBAPI VOID NTAPI PhRemoveElementAvlTree ( _Inout_ PPH_AVL_TREE  Tree,
_Inout_ PPH_AVL_LINKS  Element 
)

Removes an element from an AVL tree.

Parameters
TreeThe tree.
ElementAn element already present in the tree.

Definition at line 577 of file collect.c.

FORCEINLINE VOID PhRemoveEndStringBuilder ( _Inout_ PPH_STRING_BUILDER  StringBuilder,
_In_ SIZE_T  Count 
)

Definition at line 2296 of file phbase.h.

FORCEINLINE VOID PhRemoveEntryHashSet ( _Inout_ PPH_HASH_ENTRY Buckets,
_In_ ULONG  NumberOfBuckets,
_Inout_ PPH_HASH_ENTRY  Entry 
)

Removes an entry from a hash set.

Parameters
BucketsThe bucket array.
NumberOfBucketsThe number of buckets.
EntryAn entry present in the hash set.

Definition at line 2777 of file phbase.h.

PHLIBAPI BOOLEAN NTAPI PhRemoveEntryHashtable ( _Inout_ PPH_HASHTABLE  Hashtable,
_In_ PVOID  Entry 
)

Removes an entry from a hashtable.

Parameters
HashtableA hashtable object.
EntryThe entry to remove.
Returns
TRUE if the entry was removed, FALSE if the entry could not be found.
Remarks
The entry specified in Entry can be an actual entry pointer returned by PhFindEntryHashtable, or a partial entry.

Definition at line 4830 of file basesup.c.

PHLIBAPI VOID NTAPI PhRemoveItemList ( _Inout_ PPH_LIST  List,
_In_ ULONG  Index 
)

Removes an item from a list.

Parameters
ListA list object.
IndexThe index of the item.

Definition at line 4203 of file basesup.c.

PHLIBAPI VOID NTAPI PhRemoveItemPointerList ( _Inout_ PPH_POINTER_LIST  PointerList,
_In_ HANDLE  PointerHandle 
)

Removes a pointer from a pointer list.

Parameters
PointerListA pointer list object.
PointerHandleA handle to the pointer to remove.
Remarks
No checking is performed on the pointer handle. Make sure the handle is valid before calling the function.

Definition at line 4427 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhRemoveItemSimpleHashtable ( _Inout_ PPH_HASHTABLE  SimpleHashtable,
_In_opt_ PVOID  Key 
)

Definition at line 5006 of file basesup.c.

PHLIBAPI VOID NTAPI PhRemoveItemsList ( _Inout_ PPH_LIST  List,
_In_ ULONG  StartIndex,
_In_ ULONG  Count 
)

Removes items from a list.

Parameters
ListA list object.
StartIndexThe index at which to begin removing items.
CountThe number of items to remove.

Definition at line 4219 of file basesup.c.

PHLIBAPI VOID NTAPI PhRemoveStringBuilder ( _Inout_ PPH_STRING_BUILDER  StringBuilder,
_In_ SIZE_T  StartIndex,
_In_ SIZE_T  Count 
)

Removes characters from a string builder string.

Parameters
StringBuilderA string builder object.
StartIndexThe index, in characters, at which to begin removing characters.
CountThe number of characters to remove.

Definition at line 3796 of file basesup.c.

FORCEINLINE VOID PhResizeHashSet ( _Inout_ PPH_HASH_ENTRY **  Buckets,
_Inout_ PULONG  NumberOfBuckets,
_In_ ULONG  NewNumberOfBuckets 
)

Resizes a hash set.

Parameters
BucketsA pointer to the bucket array. On return the new bucket array is stored in this variable.
NumberOfBucketsA pointer to the number of buckets. On return the new number of buckets is stored in this variable.
NewNumberOfBucketsThe new number of buckets.

Definition at line 2823 of file phbase.h.

PHLIBAPI VOID NTAPI PhResizeList ( _Inout_ PPH_LIST  List,
_In_ ULONG  NewCapacity 
)

Resizes a list.

Parameters
ListA list object.
NewCapacityThe new required number of elements for which storage has been reserved. This must not be smaller than the current number of items in the list.

Definition at line 4031 of file basesup.c.

FORCEINLINE VOID PhReverseStringRef ( _In_ PPH_STRINGREF  String)

Definition at line 1194 of file phbase.h.

PHLIBAPI ULONG NTAPI PhRoundUpToPowerOfTwo ( _In_ ULONG  Number)

Rounds up a number to the next power of two.

Definition at line 5336 of file basesup.c.

NTSTATUS NTAPI PhSetInformationHandleTable ( _Inout_ PPH_HANDLE_TABLE  HandleTable,
_In_ PH_HANDLE_TABLE_INFORMATION_CLASS  InformationClass,
_In_reads_bytes_(BufferLength) PVOID  Buffer,
_In_ ULONG  BufferLength 
)

Definition at line 439 of file handle.c.

FORCEINLINE VOID PhSkipStringRef ( _Inout_ PPH_STRINGREF  String,
_In_ LONG_PTR  Length 
)

Definition at line 1183 of file phbase.h.

PHLIBAPI BOOLEAN NTAPI PhSplitStringRefAtChar ( _In_ PPH_STRINGREF  Input,
_In_ WCHAR  Separator,
_Out_ PPH_STRINGREF  FirstPart,
_Out_ PPH_STRINGREF  SecondPart 
)

Splits a string.

Parameters
InputThe input string.
SeparatorThe character to split at.
FirstPartA variable which receives the part of Input before the separator. This may be the same variable as Input. If the separator is not found in Input, this variable is set to Input.
SecondPartA variable which recieves the part of Input after the separator. This may be the same variable as Input. If the separator is not found in Input, this variable is set to an empty string.
Returns
TRUE if Separator was found in Input, otherwise FALSE.

Definition at line 1619 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhSplitStringRefAtLastChar ( _In_ PPH_STRINGREF  Input,
_In_ WCHAR  Separator,
_Out_ PPH_STRINGREF  FirstPart,
_Out_ PPH_STRINGREF  SecondPart 
)

Splits a string at the last occurrence of a character.

Parameters
InputThe input string.
SeparatorThe character to split at.
FirstPartA variable which receives the part of Input before the separator. This may be the same variable as Input. If the separator is not found in Input, this variable is set to Input.
SecondPartA variable which recieves the part of Input after the separator. This may be the same variable as Input. If the separator is not found in Input, this variable is set to an empty string.
Returns
TRUE if Separator was found in Input, otherwise FALSE.

Definition at line 1668 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhSplitStringRefAtString ( _In_ PPH_STRINGREF  Input,
_In_ PPH_STRINGREF  Separator,
_In_ BOOLEAN  IgnoreCase,
_Out_ PPH_STRINGREF  FirstPart,
_Out_ PPH_STRINGREF  SecondPart 
)

Splits a string.

Parameters
InputThe input string.
SeparatorThe string to split at.
IgnoreCaseTRUE to perform a case-insensitive search, otherwise FALSE.
FirstPartA variable which receives the part of Input before the separator. This may be the same variable as Input. If the separator is not found in Input, this variable is set to Input.
SecondPartA variable which recieves the part of Input after the separator. This may be the same variable as Input. If the separator is not found in Input, this variable is set to an empty string.
Returns
TRUE if Separator was found in Input, otherwise FALSE.

Definition at line 1719 of file basesup.c.

PHLIBAPI BOOLEAN NTAPI PhSplitStringRefEx ( _In_ PPH_STRINGREF  Input,
_In_ PPH_STRINGREF  Separator,
_In_ ULONG  Flags,
_Out_ PPH_STRINGREF  FirstPart,
_Out_ PPH_STRINGREF  SecondPart,
_Out_opt_ PPH_STRINGREF  SeparatorPart 
)

Splits a string.

Parameters
InputThe input string.
SeparatorThe character set, string or range to split at.
FlagsA combination of flags.
  • PH_SPLIT_AT_CHAR_SET Separator specifies a character set. Input will be split at a character which is contained in Separator.
  • PH_SPLIT_AT_STRING Separator specifies a string. Input will be split an occurrence of Separator.
  • PH_SPLIT_AT_RANGE Separator specifies a range. The Buffer field contains a character index cast to PWSTR and the Length field contains the length of the range, in bytes.
  • PH_SPLIT_CASE_INSENSITIVE Specifies a case-insensitive search.
  • PH_SPLIT_COMPLEMENT_CHAR_SET If used with PH_SPLIT_AT_CHAR_SET, the separator is a character which is not contained in Separator.
  • PH_SPLIT_START_AT_END If used with PH_SPLIT_AT_CHAR_SET, the search is performed starting from the end of the string.
  • PH_SPLIT_CHAR_SET_IS_UPPERCASE If used with PH_SPLIT_CASE_INSENSITIVE, specifies that the character set in Separator contains only uppercase characters.
FirstPartA variable which receives the part of Input before the separator. This may be the same variable as Input. If the separator is not found in Input, this variable is set to Input.
SecondPartA variable which recieves the part of Input after the separator. This may be the same variable as Input. If the separator is not found in Input, this variable is set to an empty string.
SeparatorPartA variable which receives the part of Input that is the separator. If the separator is not found in Input, this variable is set to an empty string.
Returns
TRUE if a separator was found in Input, otherwise FALSE.

Definition at line 1789 of file basesup.c.

FORCEINLINE BOOLEAN PhStartsWithString ( _In_ PPH_STRING  String,
_In_ PPH_STRING  Prefix,
_In_ BOOLEAN  IgnoreCase 
)

Determines whether a string starts with another.

Parameters
StringThe first string.
PrefixThe second string.
IgnoreCaseWhether to ignore character cases.
Returns
TRUE if String starts with Prefix, otherwise FALSE.

Definition at line 1588 of file phbase.h.

FORCEINLINE BOOLEAN PhStartsWithString2 ( _In_ PPH_STRING  String,
_In_ PWSTR  Prefix,
_In_ BOOLEAN  IgnoreCase 
)

Determines whether a string starts with another.

Parameters
StringThe first string.
PrefixThe second string.
IgnoreCaseWhether to ignore character cases.
Returns
TRUE if String starts with Prefix, otherwise FALSE.

Definition at line 1608 of file phbase.h.

FORCEINLINE BOOLEAN PhStartsWithStringRef ( _In_ PPH_STRINGREF  String,
_In_ PPH_STRINGREF  Prefix,
_In_ BOOLEAN  IgnoreCase 
)

Definition at line 1115 of file phbase.h.

FORCEINLINE BOOLEAN PhStartsWithStringRef2 ( _In_ PPH_STRINGREF  String,
_In_ PWSTR  Prefix,
_In_ BOOLEAN  IgnoreCase 
)

Definition at line 1134 of file phbase.h.

FORCEINLINE BOOLEAN PhStringRefToUnicodeString ( _In_ PPH_STRINGREF  String,
_Out_ PUNICODE_STRING  UnicodeString 
)

Definition at line 952 of file phbase.h.

PHLIBAPI BOOLEAN NTAPI PhStringToInteger64 ( _In_ PPH_STRINGREF  String,
_In_opt_ ULONG  Base,
_Out_opt_ PLONG64  Integer 
)

Converts a string to an integer.

Parameters
StringThe string to process.
BaseThe base which the string uses to represent the integer. The maximum value is
  1. If the parameter is 0, the base is inferred from the string.
IntegerThe resulting integer.
Remarks
If Base is 0, the following prefixes may be used to indicate bases:
  • 0x Base 16.
  • 0o Base 8.
  • 0b Base 2.
  • 0t Base 3.
  • 0q Base 4.
  • 0w Base 12.
  • 0r Base 32.

If there is no recognized prefix, base 10 is used.

Definition at line 5544 of file basesup.c.

FORCEINLINE PPH_STRING PhSubstring ( _In_ PPH_STRING  String,
_In_ SIZE_T  StartIndex,
_In_ SIZE_T  Count 
)

Creates a substring of a string.

Parameters
StringThe original string.
StartIndexThe start index, in characters.
CountThe number of characters to use.

Definition at line 1795 of file phbase.h.

PHLIBAPI PPH_AVL_LINKS NTAPI PhSuccessorElementAvlTree ( _In_ PPH_AVL_LINKS  Element)

Finds the next element in an AVL tree.

Parameters
ElementThe element.
Returns
The next element, or NULL if there are no more elements.

Definition at line 806 of file collect.c.

VOID NTAPI PhSweepHandleTable ( _In_ PPH_HANDLE_TABLE  HandleTable,
_In_ PPH_ENUM_HANDLE_TABLE_CALLBACK  Callback,
_In_opt_ PVOID  Context 
)

Definition at line 349 of file handle.c.

PHLIBAPI VOID NTAPI PhSystemTimeToLocalTime ( _In_ PLARGE_INTEGER  SystemTime,
_Out_ PLARGE_INTEGER  LocalTime 
)

Converts system time to local time.

Parameters
SystemTimeA UTC time value.
LocalTimeA variable which receives the local time value. This may be the same variable as SystemTime.
Remarks
Use this function instead of RtlSystemTimeToLocalTime() because no system calls are involved.

Definition at line 312 of file basesup.c.

FORCEINLINE BOOLEAN PhTestEvent ( _In_ PPH_EVENT  Event)

Determines whether an event object is set.

Parameters
EventA pointer to an event object.
Returns
TRUE if the event object is set, otherwise FALSE.

Definition at line 471 of file phbase.h.

FORCEINLINE BOOLEAN PhTestInitOnce ( _In_ PPH_INITONCE  InitOnce)

Definition at line 698 of file phbase.h.

PHLIBAPI VOID NTAPI PhTrimStringRef ( _Inout_ PPH_STRINGREF  String,
_In_ PPH_STRINGREF  CharSet,
_In_ ULONG  Flags 
)

Definition at line 2006 of file basesup.c.

FORCEINLINE VOID PhTrimToNullTerminatorString ( _Inout_ PPH_STRING  String)

Updates a string object's length with its true length as determined by an embedded null terminator.

Parameters
StringThe string to modify.
Remarks
Use this function after modifying a string object's buffer manually.

Definition at line 1844 of file phbase.h.

FORCEINLINE VOID PhUnicodeStringToStringRef ( _In_ PUNICODE_STRING  UnicodeString,
_Out_ PPH_STRINGREF  String 
)

Definition at line 966 of file phbase.h.

VOID NTAPI PhUnlockHandleTableEntry ( _Inout_ PPH_HANDLE_TABLE  HandleTable,
_Inout_ PPH_HANDLE_TABLE_ENTRY  HandleTableEntry 
)

Definition at line 222 of file handle.c.

PHLIBAPI VOID NTAPI PhUnregisterCallback ( _Inout_ PPH_CALLBACK  Callback,
_Inout_ PPH_CALLBACK_REGISTRATION  Registration 
)

Unregisters a callback function.

Parameters
CallbackA pointer to a callback object.
RegistrationThe structure returned by PhRegisterCallback().
Remarks
It is guaranteed that the callback function will not be in execution once this function returns. Attempting to unregister a callback function from within the same function will result in a deadlock.

Definition at line 5221 of file basesup.c.

FORCEINLINE VOID PhUpperString ( _Inout_ PPH_STRING  String)

Converts a string to uppercase in-place.

Parameters
StringThe string to convert.

Definition at line 1825 of file phbase.h.

FORCEINLINE BOOLEAN PhWaitForEvent ( _Inout_ PPH_EVENT  Event,
_In_opt_ PLARGE_INTEGER  Timeout 
)

Definition at line 433 of file phbase.h.

FORCEINLINE VOID PhWaitForRundownProtection ( _Inout_ PPH_RUNDOWN_PROTECT  Protection)

Definition at line 630 of file phbase.h.

PHLIBAPI VOID NTAPI PhWaitForWorkQueue ( _Inout_ PPH_WORK_QUEUE  WorkQueue)

Waits for all queued work items to be executed.

Parameters
WorkQueueA work queue object.

Definition at line 184 of file workqueue.c.

VOID PhWorkQueueInitialization ( VOID  )

Definition at line 47 of file workqueue.c.

PHLIBAPI BOOLEAN NTAPI PhWriteUnicodeDecoder ( _Inout_ PPH_UNICODE_DECODER  Decoder,
_In_ ULONG  CodeUnit 
)

Definition at line 2480 of file basesup.c.

PHLIBAPI VOID FASTCALL PhxfDivideSingle2U ( PFLOAT  A,
FLOAT  B,
ULONG  Count 
)

Deprecated.

Use PhDivideSinglesBySingle instead.

Definition at line 5882 of file basesup.c.

PHLIBAPI VOID FASTCALL PhxfFillMemoryUlong ( PULONG  Memory,
ULONG  Value,
ULONG  Count 
)

Deprecated.

Use PhFillMemoryUlong instead.

Definition at line 5793 of file basesup.c.

FORCEINLINE PPH_STRING PhZeroExtendToUtf16 ( _In_ PSTR  Input)

Definition at line 2019 of file phbase.h.

PHLIBAPI VOID NTAPI PhZeroExtendToUtf16Buffer ( _In_reads_bytes_(InputLength) PCH  Input,
_In_ SIZE_T  InputLength,
_Out_writes_bytes_(InputLength *sizeof(WCHAR)) PWCH  Output 
)
PHLIBAPI PPH_STRING NTAPI PhZeroExtendToUtf16Ex ( _In_reads_bytes_(InputLength) PCH  Input,
_In_ SIZE_T  InputLength 
)

Definition at line 2932 of file basesup.c.

Variable Documentation

_In_ PVOID Item

Definition at line 2450 of file phbase.h.

PHLIBAPI _User_set_ PWSTR PhApplicationName

Definition at line 45 of file global.c.

PPH_OBJECT_TYPE PhBytesType

Definition at line 102 of file basesup.c.

BOOLEAN PhCharIsPrintable[256]

Definition at line 37 of file data.c.

ULONG PhCharToInteger[256]

Definition at line 59 of file data.c.

ULONG PhCrc32Table[256]

Definition at line 103 of file data.c.

PHLIBAPI ULONG PhCurrentSessionId

Definition at line 46 of file global.c.

PHLIBAPI HANDLE PhCurrentTokenQueryHandle

Definition at line 47 of file global.c.

PHLIBAPI BOOLEAN PhElevated

Definition at line 48 of file global.c.

PHLIBAPI TOKEN_ELEVATION_TYPE PhElevationType

Definition at line 49 of file global.c.

PPH_OBJECT_TYPE PhHashtableType

Definition at line 105 of file basesup.c.

PHLIBAPI PVOID PhHeapHandle

Definition at line 50 of file global.c.

CHAR PhIntegerToChar[69]

Definition at line 81 of file data.c.

CHAR PhIntegerToCharUpper[69]

Definition at line 91 of file data.c.

WCHAR* PhIoPriorityHintNames[MaxIoPriorityTypes]

Definition at line 142 of file data.c.

WCHAR* PhKThreadStateNames[MaximumThreadState]

Definition at line 152 of file data.c.

WCHAR* PhKWaitReasonNames[MaximumWaitReason]

Definition at line 167 of file data.c.

PHLIBAPI _User_set_ PVOID PhLibImageBase

Definition at line 43 of file global.c.

PPH_OBJECT_TYPE PhListType

Definition at line 103 of file basesup.c.

PHLIBAPI RTL_OSVERSIONINFOEXW PhOsVersion

Definition at line 51 of file global.c.

PPH_OBJECT_TYPE PhPointerListType

Definition at line 104 of file basesup.c.

SID PhSeAnonymousLogonSid

Definition at line 20 of file data.c.

SID PhSeAuthenticatedUserSid

Definition at line 22 of file data.c.

SID PhSeBatchSid

Definition at line 17 of file data.c.

SID PhSeCreatorGroupSid

Definition at line 13 of file data.c.

SID PhSeCreatorOwnerSid

Definition at line 12 of file data.c.

SID PhSeDialupSid

Definition at line 15 of file data.c.

SID PhSeEveryoneSid

Definition at line 8 of file data.c.

SID PhSeInteractiveSid

Definition at line 18 of file data.c.

SID PhSeLocalServiceSid

Definition at line 27 of file data.c.

SID PhSeLocalSid

Definition at line 10 of file data.c.

SID PhSeLocalSystemSid

Definition at line 26 of file data.c.

SID PhSeNetworkServiceSid

Definition at line 28 of file data.c.

SID PhSeNetworkSid

Definition at line 16 of file data.c.

SID PhSeNobodySid

Definition at line 6 of file data.c.

SID PhSeProxySid

Definition at line 21 of file data.c.

SID PhSeRemoteInteractiveLogonSid

Definition at line 25 of file data.c.

SID PhSeRestrictedCodeSid

Definition at line 23 of file data.c.

SID PhSeServiceSid

Definition at line 19 of file data.c.

SID PhSeTerminalServerUserSid

Definition at line 24 of file data.c.

PPH_OBJECT_TYPE PhStringType

Definition at line 101 of file basesup.c.

PHLIBAPI SYSTEM_BASIC_INFORMATION PhSystemBasicInformation

Definition at line 52 of file global.c.

PH_STRINGREF PhUnicodeByteOrderMark

Definition at line 32 of file data.c.

PHLIBAPI ACCESS_MASK ProcessAllAccess

Definition at line 56 of file global.c.

PHLIBAPI ACCESS_MASK ProcessQueryAccess

Definition at line 55 of file global.c.

_May_raise_ _In_ SIZE_T Size

Definition at line 327 of file phbase.h.

PHLIBAPI ACCESS_MASK ThreadAllAccess

Definition at line 59 of file global.c.

PHLIBAPI ACCESS_MASK ThreadQueryAccess

Definition at line 57 of file global.c.

PHLIBAPI ACCESS_MASK ThreadSetAccess

Definition at line 58 of file global.c.

PHLIBAPI ULONG WindowsVersion

Definition at line 53 of file global.c.