653 lines
22 KiB
C
653 lines
22 KiB
C
#pragma once
|
|
#include <Windows.h>
|
|
|
|
#define STATUS_SUCCESS 0x00000000
|
|
#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
|
|
#define OBJ_CASE_INSENSITIVE 0x00000040L
|
|
#define OBJ_OPENLINK 0x00000100
|
|
|
|
#define INTERNAL_REG_OPTION_CREATE_LINK (0x00000002L)
|
|
#define INTERNAL_REG_OPTION_OPEN_LINK (0x00000100L)
|
|
|
|
#define FILE_SUPERSEDE 0x00000000
|
|
|
|
#define FILE_OPEN 0x00000001
|
|
|
|
#define FILE_CREATE 0x00000002
|
|
|
|
#define FILE_OPEN_IF 0x00000003
|
|
|
|
#define FILE_OVERWRITE 0x00000004
|
|
|
|
#define FILE_OVERWRITE_IF 0x00000005
|
|
|
|
#define FILE_MAXIMUM_DISPOSITION 0x00000005
|
|
|
|
#define FILE_DIRECTORY_FILE 0x00000001
|
|
|
|
#define FILE_WRITE_THROUGH 0x00000002
|
|
|
|
#define FILE_SEQUENTIAL_ONLY 0x00000004
|
|
|
|
#define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008
|
|
|
|
#define FILE_SYNCHRONOUS_IO_ALERT 0x00000010
|
|
|
|
#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
|
|
|
|
#define FILE_NON_DIRECTORY_FILE 0x00000040
|
|
|
|
#define FILE_CREATE_TREE_CONNECTION 0x00000080
|
|
|
|
#define FILE_COMPLETE_IF_OPLOCKED 0x00000100
|
|
|
|
#define FILE_NO_EA_KNOWLEDGE 0x00000200
|
|
|
|
#define FILE_OPEN_FOR_RECOVERY 0x00000400
|
|
|
|
#define FILE_RANDOM_ACCESS 0x00000800
|
|
|
|
#define FILE_DELETE_ON_CLOSE 0x00001000
|
|
|
|
#define FILE_OPEN_BY_FILE_ID 0x00002000
|
|
|
|
#define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000
|
|
|
|
#define FILE_NO_COMPRESSION 0x00008000
|
|
|
|
#define FILE_OPEN_REQUIRING_OPLOCK 0x00010000
|
|
|
|
#define FILE_DISALLOW_EXCLUSIVE 0x00020000
|
|
|
|
#define FILE_SESSION_AWARE 0x00040000
|
|
|
|
#define FILE_RESERVE_OPFILTER 0x00100000
|
|
|
|
#define FILE_OPEN_REPARSE_POINT 0x00200000
|
|
|
|
#define FILE_OPEN_NO_RECALL 0x00400000
|
|
|
|
#define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000
|
|
|
|
#define FILE_COPY_STRUCTURED_STORAGE 0x00000041
|
|
|
|
#define FILE_STRUCTURED_STORAGE 0x00000441
|
|
|
|
#define FILE_SUPERSEDED 0x00000000
|
|
|
|
#define FILE_OPENED 0x00000001
|
|
|
|
#define FILE_CREATED 0x00000002
|
|
|
|
#define FILE_OVERWRITTEN 0x00000003
|
|
|
|
#define FILE_EXISTS 0x00000004
|
|
|
|
#define FILE_DOES_NOT_EXIST 0x00000005
|
|
|
|
#define FILE_WRITE_TO_END_OF_FILE 0xffffffff
|
|
|
|
#define FILE_USE_FILE_POINTER_POSITION 0xfffffffe
|
|
|
|
#define FILE_BYTE_ALIGNMENT 0x00000000
|
|
|
|
#define FILE_WORD_ALIGNMENT 0x00000001
|
|
|
|
#define FILE_LONG_ALIGNMENT 0x00000003
|
|
|
|
#define FILE_QUAD_ALIGNMENT 0x00000007
|
|
|
|
#define FILE_OCTA_ALIGNMENT 0x0000000f
|
|
|
|
#define FILE_32_BYTE_ALIGNMENT 0x0000001f
|
|
|
|
#define FILE_64_BYTE_ALIGNMENT 0x0000003f
|
|
|
|
#define FILE_128_BYTE_ALIGNMENT 0x0000007f
|
|
|
|
#define FILE_256_BYTE_ALIGNMENT 0x000000ff
|
|
|
|
#define FILE_512_BYTE_ALIGNMENT 0x000001ff
|
|
|
|
#define MAXIMUM_FILENAME_LENGTH 256
|
|
|
|
#define FILE_NEED_EA 0x00000080
|
|
|
|
#define FILE_EA_TYPE_BINARY 0xfffe
|
|
|
|
#define FILE_EA_TYPE_ASCII 0xfffd
|
|
|
|
#define FILE_EA_TYPE_BITMAP 0xfffb
|
|
|
|
#define FILE_EA_TYPE_METAFILE 0xfffa
|
|
|
|
#define FILE_EA_TYPE_ICON 0xfff9
|
|
|
|
#define FILE_EA_TYPE_EA 0xffee
|
|
|
|
#define FILE_EA_TYPE_MVMT 0xffdf
|
|
|
|
#define FILE_EA_TYPE_MVST 0xffde
|
|
|
|
#define FILE_EA_TYPE_ASN1 0xffdd
|
|
|
|
#define FILE_EA_TYPE_FAMILY_IDS 0xff01
|
|
|
|
#define FILE_REMOVABLE_MEDIA 0x00000001
|
|
|
|
#define FILE_READ_ONLY_DEVICE 0x00000002
|
|
|
|
#define FILE_FLOPPY_DISKETTE 0x00000004
|
|
|
|
#define FILE_WRITE_ONCE_MEDIA 0x00000008
|
|
|
|
#define FILE_REMOTE_DEVICE 0x00000010
|
|
|
|
#define FILE_DEVICE_IS_MOUNTED 0x00000020
|
|
|
|
#define FILE_VIRTUAL_VOLUME 0x00000040
|
|
|
|
#define FILE_AUTOGENERATED_DEVICE_NAME 0x00000080
|
|
|
|
#define FILE_DEVICE_SECURE_OPEN 0x00000100
|
|
|
|
#define FILE_CHARACTERISTIC_PNP_DEVICE 0x00000800
|
|
|
|
#define FILE_CHARACTERISTIC_TS_DEVICE 0x00001000
|
|
|
|
#define FILE_CHARACTERISTIC_WEBDAV_DEVICE 0x00002000
|
|
|
|
#define FILE_CHARACTERISTIC_CSV 0x00010000
|
|
|
|
#define FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL 0x00020000
|
|
|
|
#define FILE_PORTABLE_DEVICE 0x00040000
|
|
|
|
#define FILE_PIPE_BYTE_STREAM_TYPE 0x00000000
|
|
|
|
#define FILE_PIPE_MESSAGE_TYPE 0x00000001
|
|
|
|
#define FILE_PIPE_ACCEPT_REMOTE_CLIENTS 0x00000000
|
|
|
|
#define FILE_PIPE_REJECT_REMOTE_CLIENTS 0x00000002
|
|
|
|
#define FILE_PIPE_TYPE_VALID_MASK 0x00000003
|
|
|
|
#define FILE_PIPE_QUEUE_OPERATION 0x00000000
|
|
|
|
#define FILE_PIPE_COMPLETE_OPERATION 0x00000001
|
|
|
|
#define FILE_PIPE_BYTE_STREAM_MODE 0x00000000
|
|
|
|
#define FILE_PIPE_MESSAGE_MODE 0x00000001
|
|
|
|
#define FILE_PIPE_INBOUND 0x00000000
|
|
|
|
#define FILE_PIPE_OUTBOUND 0x00000001
|
|
|
|
#define FILE_PIPE_FULL_DUPLEX 0x00000002
|
|
|
|
#define FILE_PIPE_DISCONNECTED_STATE 0x00000001
|
|
|
|
#define FILE_PIPE_LISTENING_STATE 0x00000002
|
|
|
|
#define FILE_PIPE_CONNECTED_STATE 0x00000003
|
|
|
|
#define FILE_PIPE_CLOSING_STATE 0x00000004
|
|
|
|
#define FILE_PIPE_CLIENT_END 0x00000000
|
|
|
|
#define FILE_PIPE_SERVER_END 0x00000001
|
|
|
|
#define MAILSLOT_SIZE_AUTO 0
|
|
|
|
#define FILE_SKIP_COMPLETION_PORT_ON_SUCCESS 0x1
|
|
|
|
#define FILE_SKIP_SET_EVENT_ON_HANDLE 0x2
|
|
|
|
#define FILE_SKIP_SET_USER_EVENT_ON_FAST_IO 0x4
|
|
|
|
#define CHECKSUM_ENFORCEMENT_OFF 0x00000001
|
|
|
|
#define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_WRITELOCKED 0x00000001
|
|
|
|
#define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_TO_TX 0x00000002
|
|
|
|
#define FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_OUTSIDE_TX 0x00000004
|
|
|
|
#define SSINFO_FLAGS_ALIGNED_DEVICE 0x00000001
|
|
|
|
#define SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE 0x00000002
|
|
|
|
#define SSINFO_OFFSET_UNKNOWN 0xffffffff
|
|
|
|
#define FLUSH_FLAGS_FILE_DATA_ONLY 0x00000001
|
|
|
|
#define FLUSH_FLAGS_NO_SYNC 0x00000002
|
|
|
|
#define IO_COMPLETION_QUERY_STATE 0x0001
|
|
|
|
#define SYMLINK_FLAG_RELATIVE 1
|
|
|
|
#define FSCTL_PIPE_ASSIGN_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 0, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
|
|
#define FSCTL_PIPE_DISCONNECT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 1, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
|
|
#define FSCTL_PIPE_LISTEN CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
|
|
#define FSCTL_PIPE_PEEK CTL_CODE(FILE_DEVICE_NAMED_PIPE, 3, METHOD_BUFFERED, FILE_READ_DATA)
|
|
|
|
#define FSCTL_PIPE_QUERY_EVENT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 4, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
|
|
#define FSCTL_PIPE_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 5, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
|
|
#define FSCTL_PIPE_WAIT CTL_CODE(FILE_DEVICE_NAMED_PIPE, 6, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
|
|
#define FSCTL_PIPE_IMPERSONATE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 7, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
|
|
#define FSCTL_PIPE_SET_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 8, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
|
|
#define FSCTL_PIPE_QUERY_CLIENT_PROCESS CTL_CODE(FILE_DEVICE_NAMED_PIPE, 9, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
|
|
#define FSCTL_PIPE_GET_PIPE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 10, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
|
|
#define FSCTL_PIPE_SET_PIPE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 11, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
|
|
#define FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
|
|
#define FSCTL_PIPE_SET_CONNECTION_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 13, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
|
|
#define FSCTL_PIPE_GET_HANDLE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 14, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
|
|
#define FSCTL_PIPE_SET_HANDLE_ATTRIBUTE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 15, METHOD_BUFFERED, FILE_ANY_ACCESS)
|
|
|
|
#define FSCTL_PIPE_FLUSH CTL_CODE(FILE_DEVICE_NAMED_PIPE, 16, METHOD_BUFFERED, FILE_WRITE_DATA)
|
|
|
|
#define FSCTL_PIPE_INTERNAL_READ CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2045, METHOD_BUFFERED, FILE_READ_DATA)
|
|
|
|
#define FSCTL_PIPE_INTERNAL_WRITE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2046, METHOD_BUFFERED, FILE_WRITE_DATA)
|
|
|
|
#define FSCTL_PIPE_INTERNAL_TRANSCEIVE CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2047, METHOD_NEITHER, FILE_READ_DATA | FILE_WRITE_DATA)
|
|
|
|
#define FSCTL_PIPE_INTERNAL_READ_OVFLOW CTL_CODE(FILE_DEVICE_NAMED_PIPE, 2048, METHOD_BUFFERED, FILE_READ_DATA)
|
|
|
|
#define FILE_PIPE_READ_DATA 0x00000000
|
|
|
|
#define FILE_PIPE_WRITE_SPACE 0x00000001
|
|
|
|
#define FILE_PIPE_COMPUTER_NAME_LENGTH 15
|
|
|
|
#define MAILSLOT_CLASS_FIRSTCLASS 1
|
|
|
|
#define MAILSLOT_CLASS_SECONDCLASS 2
|
|
|
|
#define FSCTL_MAILSLOT_PEEK CTL_CODE(FILE_DEVICE_MAILSLOT, 0, METHOD_NEITHER, FILE_READ_DATA)
|
|
|
|
#define FILE_DISPOSITION_DO_NOT_DELETE 0x00000000
|
|
|
|
#define FILE_DISPOSITION_DELETE 0x00000001
|
|
|
|
#define FILE_DISPOSITION_POSIX_SEMANTICS 0x00000002
|
|
|
|
#define FILE_DISPOSITION_FORCE_IMAGE_SECTION_CHECK 0x00000004
|
|
|
|
#define FILE_DISPOSITION_ON_CLOSE 0x00000008
|
|
|
|
#define FILE_DISPOSITION_IGNORE_READONLY_ATTRIBUTE 0x00000010
|
|
|
|
#define FILE_CS_FLAG_CASE_SENSITIVE_DIR 0x00000001
|
|
|
|
typedef struct _UNICODE_STRING {
|
|
USHORT Length;
|
|
USHORT MaximumLength;
|
|
PWSTR Buffer;
|
|
} UNICODE_STRING;
|
|
|
|
typedef UNICODE_STRING* PUNICODE_STRING;
|
|
typedef const UNICODE_STRING* PCUNICODE_STRING;
|
|
typedef USHORT RTL_STRING_LENGTH_TYPE;
|
|
|
|
typedef struct _STRING {
|
|
USHORT Length;
|
|
USHORT MaximumLength;
|
|
PCHAR Buffer;
|
|
} STRING;
|
|
|
|
typedef STRING* PSTRING;
|
|
typedef STRING ANSI_STRING;
|
|
typedef PSTRING PANSI_STRING;
|
|
|
|
typedef struct _OBJECT_ATTRIBUTES {
|
|
ULONG uLength;
|
|
HANDLE hRootDirectory;
|
|
PUNICODE_STRING pObjectName;
|
|
ULONG uAttributes;
|
|
PVOID pSecurityDescriptor;
|
|
PVOID pSecurityQualityOfService;
|
|
} OBJECT_ATTRIBUTES;
|
|
typedef OBJECT_ATTRIBUTES* POBJECT_ATTRIBUTES;
|
|
|
|
typedef struct _IO_STATUS_BLOCK {
|
|
union {
|
|
NTSTATUS Status;
|
|
PVOID Pointer;
|
|
};
|
|
ULONG_PTR Information;
|
|
} IO_STATUS_BLOCK, * PIO_STATUS_BLOCK;
|
|
|
|
typedef struct _FILE_NAME_INFORMATION {
|
|
ULONG FileNameLength;
|
|
WCHAR FileName[1];
|
|
} FILE_NAME_INFORMATION, * PFILE_NAME_INFORMATION;
|
|
|
|
typedef struct _FILE_CASE_SENSITIVE_INFORMATION {
|
|
ULONG Flags;
|
|
} FILE_CASE_SENSITIVE_INFORMATION, * PFILE_CASE_SENSITIVE_INFORMATION;
|
|
|
|
typedef enum _FILE_INFORMATION_CLASS {
|
|
FileDirectoryInformation = 1,
|
|
FileFullDirectoryInformation, // 2
|
|
FileBothDirectoryInformation, // 3
|
|
FileBasicInformation, // 4
|
|
FileStandardInformation, // 5
|
|
FileInternalInformation, // 6
|
|
FileEaInformation, // 7
|
|
FileAccessInformation, // 8
|
|
FileNameInformation, // 9
|
|
FileRenameInformation, // 10
|
|
FileLinkInformation, // 11
|
|
FileNamesInformation, // 12
|
|
FileDispositionInformation, // 13
|
|
FilePositionInformation, // 14
|
|
FileFullEaInformation, // 15
|
|
FileModeInformation, // 16
|
|
FileAlignmentInformation, // 17
|
|
FileAllInformation, // 18
|
|
FileAllocationInformation, // 19
|
|
FileEndOfFileInformation, // 20
|
|
FileAlternateNameInformation, // 21
|
|
FileStreamInformation, // 22
|
|
FilePipeInformation, // 23
|
|
FilePipeLocalInformation, // 24
|
|
FilePipeRemoteInformation, // 25
|
|
FileMailslotQueryInformation, // 26
|
|
FileMailslotSetInformation, // 27
|
|
FileCompressionInformation, // 28
|
|
FileObjectIdInformation, // 29
|
|
FileCompletionInformation, // 30
|
|
FileMoveClusterInformation, // 31
|
|
FileQuotaInformation, // 32
|
|
FileReparsePointInformation, // 33
|
|
FileNetworkOpenInformation, // 34
|
|
FileAttributeTagInformation, // 35
|
|
FileTrackingInformation, // 36
|
|
FileIdBothDirectoryInformation, // 37
|
|
FileIdFullDirectoryInformation, // 38
|
|
FileValidDataLengthInformation, // 39
|
|
FileShortNameInformation, // 40
|
|
FileIoCompletionNotificationInformation, // 41
|
|
FileIoStatusBlockRangeInformation, // 42
|
|
FileIoPriorityHintInformation, // 43
|
|
FileSfioReserveInformation, // 44
|
|
FileSfioVolumeInformation, // 45
|
|
FileHardLinkInformation, // 46
|
|
FileProcessIdsUsingFileInformation, // 47
|
|
FileNormalizedNameInformation, // 48
|
|
FileNetworkPhysicalNameInformation, // 49
|
|
FileIdGlobalTxDirectoryInformation, // 50
|
|
FileIsRemoteDeviceInformation, // 51
|
|
FileUnusedInformation, // 52
|
|
FileNumaNodeInformation, // 53
|
|
FileStandardLinkInformation, // 54
|
|
FileRemoteProtocolInformation, // 55
|
|
//
|
|
// These are special versions of these operations (defined earlier)
|
|
// which can be used by kernel mode drivers only to bypass security
|
|
// access checks for Rename and HardLink operations. These operations
|
|
// are only recognized by the IOManager, a file system should never
|
|
// receive these.
|
|
//
|
|
|
|
FileRenameInformationBypassAccessCheck, // 56
|
|
FileLinkInformationBypassAccessCheck, // 57
|
|
//
|
|
// End of special information classes reserved for IOManager.
|
|
//
|
|
FileVolumeNameInformation, // 58
|
|
FileIdInformation, // 59
|
|
FileIdExtdDirectoryInformation, // 60
|
|
FileReplaceCompletionInformation, // 61
|
|
FileHardLinkFullIdInformation, // 62
|
|
FileIdExtdBothDirectoryInformation, // 63
|
|
FileDispositionInformationEx, // 64
|
|
FileRenameInformationEx, // 65
|
|
FileRenameInformationExBypassAccessCheck, // 66
|
|
FileDesiredStorageClassInformation, // 67
|
|
FileStatInformation, // 68
|
|
FileMemoryPartitionInformation, // 69
|
|
FileStatLxInformation, // 70
|
|
FileCaseSensitiveInformation, // 71
|
|
FileLinkInformationEx, // 72
|
|
FileLinkInformationExBypassAccessCheck, // 73
|
|
FileStorageReserveIdInformation, // 74
|
|
FileCaseSensitiveInformationForceAccessCheck, // 75
|
|
FileMaximumInformation
|
|
} FILE_INFORMATION_CLASS, * PFILE_INFORMATION_CLASS;
|
|
typedef struct _FILE_RENAME_INFORMATION {
|
|
#if (_WIN32_WINNT >= _WIN32_WINNT_WIN10_RS1)
|
|
union {
|
|
BOOLEAN ReplaceIfExists; // FileRenameInformation
|
|
ULONG Flags; // FileRenameInformationEx
|
|
} DUMMYUNIONNAME;
|
|
#else
|
|
BOOLEAN ReplaceIfExists;
|
|
#endif
|
|
HANDLE RootDirectory;
|
|
ULONG FileNameLength;
|
|
WCHAR FileName[1];
|
|
} FILE_RENAME_INFORMATION, * PFILE_RENAME_INFORMATION;
|
|
typedef struct _CLIENT_ID
|
|
{
|
|
HANDLE UniqueProcess;
|
|
HANDLE UniqueThread;
|
|
} CLIENT_ID, * PCLIENT_ID;
|
|
typedef struct _FILE_LINK_INFORMATION {
|
|
BOOLEAN ReplaceIfExists;
|
|
HANDLE RootDirectory;
|
|
ULONG FileNameLength;
|
|
WCHAR FileName[1];
|
|
} FILE_LINK_INFORMATION, * PFILE_LINK_INFORMATION;
|
|
typedef VOID(NTAPI* PIO_APC_ROUTINE)(_In_ PVOID ApcContext, _In_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG Reserved);
|
|
#define SYMLINK_FLAG_RELATIVE 1
|
|
|
|
typedef struct _REPARSE_DATA_BUFFER {
|
|
ULONG ReparseTag;
|
|
USHORT ReparseDataLength;
|
|
USHORT Reserved;
|
|
union {
|
|
struct {
|
|
USHORT SubstituteNameOffset;
|
|
USHORT SubstituteNameLength;
|
|
USHORT PrintNameOffset;
|
|
USHORT PrintNameLength;
|
|
ULONG Flags;
|
|
WCHAR PathBuffer[1];
|
|
} SymbolicLinkReparseBuffer;
|
|
struct {
|
|
USHORT SubstituteNameOffset;
|
|
USHORT SubstituteNameLength;
|
|
USHORT PrintNameOffset;
|
|
USHORT PrintNameLength;
|
|
WCHAR PathBuffer[1];
|
|
} MountPointReparseBuffer;
|
|
struct {
|
|
UCHAR DataBuffer[1];
|
|
} GenericReparseBuffer;
|
|
} DUMMYUNIONNAME;
|
|
} REPARSE_DATA_BUFFER, * PREPARSE_DATA_BUFFER;
|
|
typedef struct _FILE_DISPOSITION_INFORMATION_EX {
|
|
ULONG Flags;
|
|
} FILE_DISPOSITION_INFORMATION_EX, * PFILE_DISPOSITION_INFORMATION_EX;
|
|
#define REPARSE_DATA_BUFFER_HEADER_LENGTH FIELD_OFFSET(REPARSE_DATA_BUFFER, GenericReparseBuffer.DataBuffer)
|
|
|
|
#define IO_REPARSE_TAG_MOUNT_POINT (0xA0000003L) // winnt
|
|
#define IO_REPARSE_TAG_HSM (0xC0000004L) // winnt
|
|
#define IO_REPARSE_TAG_DRIVE_EXTENDER (0x80000005L)
|
|
#define IO_REPARSE_TAG_HSM2 (0x80000006L) // winnt
|
|
#define IO_REPARSE_TAG_SIS (0x80000007L) // winnt
|
|
#define IO_REPARSE_TAG_WIM (0x80000008L) // winnt
|
|
#define IO_REPARSE_TAG_CSV (0x80000009L) // winnt
|
|
#define IO_REPARSE_TAG_DFS (0x8000000AL) // winnt
|
|
#define IO_REPARSE_TAG_FILTER_MANAGER (0x8000000BL)
|
|
#define IO_REPARSE_TAG_SYMLINK (0xA000000CL) // winnt
|
|
#define IO_REPARSE_TAG_IIS_CACHE (0xA0000010L)
|
|
#define IO_REPARSE_TAG_DFSR (0x80000012L) // winnt
|
|
#define IO_REPARSE_TAG_DEDUP (0x80000013L) // winnt
|
|
#define IO_REPARSE_TAG_APPXSTRM (0xC0000014L)
|
|
#define IO_REPARSE_TAG_NFS (0x80000014L) // winnt
|
|
#define IO_REPARSE_TAG_FILE_PLACEHOLDER (0x80000015L) // winnt
|
|
#define IO_REPARSE_TAG_DFM (0x80000016L)
|
|
#define IO_REPARSE_TAG_WOF (0x80000017L) // winnt
|
|
|
|
NTSTATUS(WINAPI* _NtRaiseHardError)(NTSTATUS ErrorStatus,
|
|
ULONG NumberOfParameters,
|
|
ULONG UnicodeStringParameterMask,
|
|
PULONG_PTR* Parameters,
|
|
ULONG ValidResponseOption,
|
|
PULONG Response);
|
|
NTSTATUS(WINAPI* _RtlAdjustPrivilege)(ULONG Privilege,
|
|
BOOLEAN Enable,
|
|
BOOLEAN CurrentThread,
|
|
PBOOLEAN Enabled);
|
|
NTSTATUS(WINAPI* _NtSetInformationFile)(HANDLE FileHandle,
|
|
PIO_STATUS_BLOCK IoStatusBlock,
|
|
PVOID FileInformation,
|
|
ULONG Length,
|
|
FILE_INFORMATION_CLASS FileInformationClass);
|
|
|
|
ULONG(WINAPI* _RtlNtStatusToDosError)(NTSTATUS Status);
|
|
NTSTATUS(WINAPI* _RtlInitUnicodeString)(PUNICODE_STRING, PCWSTR);
|
|
NTSTATUS(WINAPI* _NtCreateSymbolicLinkObject)(
|
|
OUT PHANDLE pHandle,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
|
IN PUNICODE_STRING DestinationName);
|
|
NTSTATUS(WINAPI* _NtCreateFile)(
|
|
PHANDLE FileHandle,
|
|
ACCESS_MASK DesiredAccess,
|
|
POBJECT_ATTRIBUTES ObjectAttributes,
|
|
PIO_STATUS_BLOCK IoStatusBlock,
|
|
PLARGE_INTEGER AllocationSize,
|
|
ULONG FileAttributes,
|
|
ULONG ShareAccess,
|
|
ULONG CreateDisposition,
|
|
ULONG CreateOptions,
|
|
PVOID EaBuffer,
|
|
ULONG EaLength);
|
|
NTSTATUS(WINAPI* _NtSetSecurityObject)(
|
|
HANDLE Handle,
|
|
SECURITY_INFORMATION SecurityInformation,
|
|
PSECURITY_DESCRIPTOR SecurityDescriptor
|
|
);
|
|
NTSTATUS(WINAPI* _NtOpenProcess)(
|
|
PHANDLE ProcessHandle,
|
|
ACCESS_MASK DesiredAccess,
|
|
POBJECT_ATTRIBUTES ObjectAttributes,
|
|
PCLIENT_ID ClientId
|
|
);
|
|
NTSTATUS(WINAPI* _NtTerminateProcess)(
|
|
IN HANDLE ProcessHandle OPTIONAL,
|
|
IN NTSTATUS ExitStatus);
|
|
NTSTATUS(WINAPI* _NtClose)(
|
|
HANDLE Handle
|
|
);
|
|
NTSTATUS(WINAPI* _NtDeviceIoControlFile)(
|
|
HANDLE FileHandle,
|
|
HANDLE Event,
|
|
PIO_APC_ROUTINE ApcRoutine,
|
|
PVOID ApcContext,
|
|
PIO_STATUS_BLOCK IoStatusBlock,
|
|
ULONG IoControlCode,
|
|
PVOID InputBuffer,
|
|
ULONG InputBufferLength,
|
|
PVOID OutputBuffer,
|
|
ULONG OutputBufferLength
|
|
);
|
|
NTSTATUS(WINAPI* _NtCreateDirectoryObjectEx)(PHANDLE, ACCESS_MASK,
|
|
POBJECT_ATTRIBUTES, HANDLE, BOOLEAN);//this one was a pain to find goddamn why MS always make it hard
|
|
|
|
NTSTATUS(WINAPI* _NtOpenDirectoryObject)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
|
|
|
|
NTSTATUS(WINAPI* _NtWriteFile)(
|
|
HANDLE FileHandle,
|
|
HANDLE Event,
|
|
PIO_APC_ROUTINE ApcRoutine,
|
|
PVOID ApcContext,
|
|
PIO_STATUS_BLOCK IoStatusBlock,
|
|
PVOID Buffer,
|
|
ULONG Length,
|
|
PLARGE_INTEGER ByteOffset,
|
|
PULONG Key
|
|
);
|
|
NTSTATUS(WINAPI* _NtWaitForSingleObject)(
|
|
IN HANDLE ObjectHandle,
|
|
IN BOOLEAN Alertable,
|
|
IN PLARGE_INTEGER TimeOut OPTIONAL);
|
|
NTSTATUS(WINAPI* _NtReadFile)(
|
|
_In_ HANDLE FileHandle,
|
|
_In_opt_ HANDLE Event,
|
|
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
|
|
_In_opt_ PVOID ApcContext,
|
|
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
|
_Out_ PVOID Buffer,
|
|
_In_ ULONG Length,
|
|
_In_opt_ PLARGE_INTEGER ByteOffset,
|
|
_In_opt_ PULONG Key
|
|
);
|
|
NTSTATUS(WINAPI* _NtCompareTokens)(
|
|
_In_ HANDLE FirstTokenHandle,
|
|
_In_ HANDLE SecondTokenHandle,
|
|
_Out_ PBOOLEAN Equal
|
|
);
|
|
NTSTATUS(WINAPI* _ZwDeleteFile)(
|
|
POBJECT_ATTRIBUTES ObjectAttributes
|
|
);
|
|
|
|
NTSTATUS(WINAPI* _ZwCreateKey)(
|
|
PHANDLE KeyHandle,
|
|
ACCESS_MASK DesiredAccess,
|
|
POBJECT_ATTRIBUTES ObjectAttributes,
|
|
ULONG TitleIndex,
|
|
PUNICODE_STRING Class,
|
|
ULONG CreateOptions,
|
|
PULONG Disposition
|
|
);
|
|
|
|
NTSTATUS(WINAPI* _ZwDeleteKey)(
|
|
HANDLE KeyHandle
|
|
);
|
|
NTSTATUS(WINAPI* _ZwSetValueKey)(
|
|
HANDLE KeyHandle,
|
|
PUNICODE_STRING ValueName,
|
|
ULONG TitleIndex,
|
|
ULONG Type,
|
|
PVOID Data,
|
|
ULONG DataSize
|
|
);
|
|
NTSTATUS(WINAPI* _NtSuspendProcess)(
|
|
HANDLE ProcessHandle
|
|
);
|
|
NTSTATUS(WINAPI* _NtResumeProcess)(
|
|
HANDLE ProcessHandle
|
|
);
|
|
NTSTATUS(WINAPI* _ZwMakeTemporaryObject)(
|
|
HANDLE Handle
|
|
);
|
|
NTSTATUS(WINAPI* _ZwMakePermanentObject)(
|
|
HANDLE Handle
|
|
);
|
|
NTSTATUS (WINAPI* _NtOpenSymbolicLinkObject)(
|
|
_Out_ PHANDLE LinkHandle,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes
|
|
); |