1 /*++ NDK Version: 0098 2 3 Copyright (c) Alex Ionescu. All rights reserved. 4 5 Header Name: 6 7 rtlfuncs.h 8 9 Abstract: 10 11 Function definitions for the Run-Time Library 12 13 Author: 14 15 Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006 16 17 --*/ 18 19 #ifndef _RTLFUNCS_H 20 #define _RTLFUNCS_H 21 22 // 23 // Dependencies 24 // 25 #include <umtypes.h> 26 #include <ntnls.h> 27 #include <rtltypes.h> 28 #include <pstypes.h> 29 #include <extypes.h> 30 #include "in6addr.h" 31 #include "inaddr.h" 32 33 #ifdef __cplusplus 34 extern "C" { 35 #endif 36 37 #ifdef NTOS_MODE_USER 38 39 // 40 // List Functions 41 // 42 FORCEINLINE 43 VOID 44 InitializeListHead( 45 _Out_ PLIST_ENTRY ListHead 46 ) 47 { 48 ListHead->Flink = ListHead->Blink = ListHead; 49 } 50 51 FORCEINLINE 52 VOID 53 InsertHeadList( 54 _Inout_ PLIST_ENTRY ListHead, 55 _Inout_ PLIST_ENTRY Entry 56 ) 57 { 58 PLIST_ENTRY OldFlink; 59 OldFlink = ListHead->Flink; 60 Entry->Flink = OldFlink; 61 Entry->Blink = ListHead; 62 OldFlink->Blink = Entry; 63 ListHead->Flink = Entry; 64 } 65 66 FORCEINLINE 67 VOID 68 InsertTailList( 69 _Inout_ PLIST_ENTRY ListHead, 70 _Inout_ PLIST_ENTRY Entry 71 ) 72 { 73 PLIST_ENTRY OldBlink; 74 OldBlink = ListHead->Blink; 75 Entry->Flink = ListHead; 76 Entry->Blink = OldBlink; 77 OldBlink->Flink = Entry; 78 ListHead->Blink = Entry; 79 } 80 81 _Must_inspect_result_ 82 FORCEINLINE 83 BOOLEAN 84 IsListEmpty( 85 _In_ const LIST_ENTRY * ListHead 86 ) 87 { 88 return (BOOLEAN)(ListHead->Flink == ListHead); 89 } 90 91 FORCEINLINE 92 PSINGLE_LIST_ENTRY 93 PopEntryList( 94 _Inout_ PSINGLE_LIST_ENTRY ListHead 95 ) 96 { 97 PSINGLE_LIST_ENTRY FirstEntry; 98 FirstEntry = ListHead->Next; 99 if (FirstEntry != NULL) { 100 ListHead->Next = FirstEntry->Next; 101 } 102 103 return FirstEntry; 104 } 105 106 FORCEINLINE 107 VOID 108 PushEntryList( 109 _Inout_ PSINGLE_LIST_ENTRY ListHead, 110 _Inout_ PSINGLE_LIST_ENTRY Entry 111 ) 112 { 113 Entry->Next = ListHead->Next; 114 ListHead->Next = Entry; 115 } 116 117 FORCEINLINE 118 BOOLEAN 119 RemoveEntryList( 120 _In_ PLIST_ENTRY Entry) 121 { 122 PLIST_ENTRY OldFlink; 123 PLIST_ENTRY OldBlink; 124 125 OldFlink = Entry->Flink; 126 OldBlink = Entry->Blink; 127 OldFlink->Blink = OldBlink; 128 OldBlink->Flink = OldFlink; 129 return (BOOLEAN)(OldFlink == OldBlink); 130 } 131 132 FORCEINLINE 133 PLIST_ENTRY 134 RemoveHeadList( 135 _Inout_ PLIST_ENTRY ListHead) 136 { 137 PLIST_ENTRY Flink; 138 PLIST_ENTRY Entry; 139 140 Entry = ListHead->Flink; 141 Flink = Entry->Flink; 142 ListHead->Flink = Flink; 143 Flink->Blink = ListHead; 144 return Entry; 145 } 146 147 FORCEINLINE 148 PLIST_ENTRY 149 RemoveTailList( 150 _Inout_ PLIST_ENTRY ListHead) 151 { 152 PLIST_ENTRY Blink; 153 PLIST_ENTRY Entry; 154 155 Entry = ListHead->Blink; 156 Blink = Entry->Blink; 157 ListHead->Blink = Blink; 158 Blink->Flink = ListHead; 159 return Entry; 160 } 161 162 // 163 // Unicode string macros 164 // 165 _At_(UnicodeString->Buffer, _Post_equal_to_(Buffer)) 166 _At_(UnicodeString->Length, _Post_equal_to_(0)) 167 _At_(UnicodeString->MaximumLength, _Post_equal_to_(BufferSize)) 168 FORCEINLINE 169 VOID 170 RtlInitEmptyUnicodeString( 171 _Out_ PUNICODE_STRING UnicodeString, 172 _When_(BufferSize != 0, _Notnull_) _Writable_bytes_(BufferSize) __drv_aliasesMem PWCHAR Buffer, 173 _In_ USHORT BufferSize) 174 { 175 UnicodeString->Length = 0; 176 UnicodeString->MaximumLength = BufferSize; 177 UnicodeString->Buffer = Buffer; 178 } 179 180 _At_(AnsiString->Buffer, _Post_equal_to_(Buffer)) 181 _At_(AnsiString->Length, _Post_equal_to_(0)) 182 _At_(AnsiString->MaximumLength, _Post_equal_to_(BufferSize)) 183 FORCEINLINE 184 VOID 185 RtlInitEmptyAnsiString( 186 _Out_ PANSI_STRING AnsiString, 187 _When_(BufferSize != 0, _Notnull_) _Writable_bytes_(BufferSize) __drv_aliasesMem PCHAR Buffer, 188 _In_ USHORT BufferSize) 189 { 190 AnsiString->Length = 0; 191 AnsiString->MaximumLength = BufferSize; 192 AnsiString->Buffer = Buffer; 193 } 194 195 // 196 // LUID Macros 197 // 198 #define RtlEqualLuid(L1, L2) (((L1)->HighPart == (L2)->HighPart) && \ 199 ((L1)->LowPart == (L2)->LowPart)) 200 FORCEINLINE 201 LUID 202 NTAPI_INLINE 203 RtlConvertUlongToLuid( 204 _In_ ULONG Ulong) 205 { 206 LUID TempLuid; 207 208 TempLuid.LowPart = Ulong; 209 TempLuid.HighPart = 0; 210 return TempLuid; 211 } 212 213 // 214 // ASSERT Macros 215 // 216 #ifndef ASSERT 217 #if DBG 218 219 #define ASSERT( exp ) \ 220 ((void)((!(exp)) ? \ 221 (RtlAssert( (PVOID)#exp, (PVOID)__FILE__, __LINE__, NULL ),FALSE) : \ 222 TRUE)) 223 224 #define ASSERTMSG( msg, exp ) \ 225 ((void)((!(exp)) ? \ 226 (RtlAssert( (PVOID)#exp, (PVOID)__FILE__, __LINE__, (PCHAR)msg ),FALSE) : \ 227 TRUE)) 228 229 #else 230 231 #define ASSERT( exp ) ((void) 0) 232 #define ASSERTMSG( msg, exp ) ((void) 0) 233 234 #endif 235 #endif 236 237 #ifdef NTOS_KERNEL_RUNTIME 238 239 // 240 // Executing RTL functions at DISPATCH_LEVEL or higher will result in a 241 // bugcheck. 242 // 243 #define RTL_PAGED_CODE PAGED_CODE 244 245 #else 246 247 // 248 // This macro does nothing in user mode 249 // 250 #define RTL_PAGED_CODE() 251 252 #endif 253 254 // 255 // RTL Splay Tree Functions 256 // 257 #ifndef RTL_USE_AVL_TABLES 258 259 NTSYSAPI 260 VOID 261 NTAPI 262 RtlInitializeGenericTable( 263 _Out_ PRTL_GENERIC_TABLE Table, 264 _In_ PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine, 265 _In_opt_ PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine, 266 _In_opt_ PRTL_GENERIC_FREE_ROUTINE FreeRoutine, 267 _In_opt_ PVOID TableContext 268 ); 269 270 NTSYSAPI 271 PVOID 272 NTAPI 273 RtlInsertElementGenericTable( 274 _In_ PRTL_GENERIC_TABLE Table, 275 _In_reads_bytes_(BufferSize) PVOID Buffer, 276 _In_ CLONG BufferSize, 277 _Out_opt_ PBOOLEAN NewElement 278 ); 279 280 NTSYSAPI 281 PVOID 282 NTAPI 283 RtlInsertElementGenericTableFull( 284 _In_ PRTL_GENERIC_TABLE Table, 285 _In_reads_bytes_(BufferSize) PVOID Buffer, 286 _In_ CLONG BufferSize, 287 _Out_opt_ PBOOLEAN NewElement, 288 _In_ PVOID NodeOrParent, 289 _In_ TABLE_SEARCH_RESULT SearchResult 290 ); 291 292 NTSYSAPI 293 BOOLEAN 294 NTAPI 295 RtlDeleteElementGenericTable( 296 _In_ PRTL_GENERIC_TABLE Table, 297 _In_ PVOID Buffer 298 ); 299 300 _Must_inspect_result_ 301 NTSYSAPI 302 PVOID 303 NTAPI 304 RtlLookupElementGenericTable( 305 _In_ PRTL_GENERIC_TABLE Table, 306 _In_ PVOID Buffer 307 ); 308 309 NTSYSAPI 310 PVOID 311 NTAPI 312 RtlLookupElementGenericTableFull( 313 _In_ PRTL_GENERIC_TABLE Table, 314 _In_ PVOID Buffer, 315 _Out_ PVOID *NodeOrParent, 316 _Out_ TABLE_SEARCH_RESULT *SearchResult 317 ); 318 319 _Must_inspect_result_ 320 NTSYSAPI 321 PVOID 322 NTAPI 323 RtlEnumerateGenericTable( 324 _In_ PRTL_GENERIC_TABLE Table, 325 _In_ BOOLEAN Restart 326 ); 327 328 _Must_inspect_result_ 329 NTSYSAPI 330 PVOID 331 NTAPI 332 RtlEnumerateGenericTableWithoutSplaying( 333 _In_ PRTL_GENERIC_TABLE Table, 334 _Inout_ PVOID *RestartKey 335 ); 336 337 _Must_inspect_result_ 338 NTSYSAPI 339 PVOID 340 NTAPI 341 RtlGetElementGenericTable( 342 _In_ PRTL_GENERIC_TABLE Table, 343 _In_ ULONG I 344 ); 345 346 NTSYSAPI 347 ULONG 348 NTAPI 349 RtlNumberGenericTableElements( 350 _In_ PRTL_GENERIC_TABLE Table 351 ); 352 353 _Must_inspect_result_ 354 NTSYSAPI 355 BOOLEAN 356 NTAPI 357 RtlIsGenericTableEmpty( 358 _In_ PRTL_GENERIC_TABLE Table 359 ); 360 361 #endif /* !RTL_USE_AVL_TABLES */ 362 363 NTSYSAPI 364 PRTL_SPLAY_LINKS 365 NTAPI 366 RtlSplay( 367 _Inout_ PRTL_SPLAY_LINKS Links 368 ); 369 370 NTSYSAPI 371 PRTL_SPLAY_LINKS 372 NTAPI 373 RtlDelete( 374 _In_ PRTL_SPLAY_LINKS Links 375 ); 376 377 NTSYSAPI 378 VOID 379 NTAPI 380 RtlDeleteNoSplay( 381 _In_ PRTL_SPLAY_LINKS Links, 382 _Inout_ PRTL_SPLAY_LINKS *Root 383 ); 384 385 _Must_inspect_result_ 386 NTSYSAPI 387 PRTL_SPLAY_LINKS 388 NTAPI 389 RtlSubtreeSuccessor( 390 _In_ PRTL_SPLAY_LINKS Links 391 ); 392 393 _Must_inspect_result_ 394 NTSYSAPI 395 PRTL_SPLAY_LINKS 396 NTAPI 397 RtlSubtreePredecessor( 398 _In_ PRTL_SPLAY_LINKS Links 399 ); 400 401 _Must_inspect_result_ 402 NTSYSAPI 403 PRTL_SPLAY_LINKS 404 NTAPI 405 RtlRealSuccessor( 406 _In_ PRTL_SPLAY_LINKS Links 407 ); 408 409 _Must_inspect_result_ 410 NTSYSAPI 411 PRTL_SPLAY_LINKS 412 NTAPI 413 RtlRealPredecessor( 414 _In_ PRTL_SPLAY_LINKS Links 415 ); 416 417 #define RtlIsLeftChild(Links) \ 418 (RtlLeftChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links)) 419 420 #define RtlIsRightChild(Links) \ 421 (RtlRightChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links)) 422 423 #define RtlRightChild(Links) \ 424 ((PRTL_SPLAY_LINKS)(Links))->RightChild 425 426 #define RtlIsRoot(Links) \ 427 (RtlParent(Links) == (PRTL_SPLAY_LINKS)(Links)) 428 429 #define RtlLeftChild(Links) \ 430 ((PRTL_SPLAY_LINKS)(Links))->LeftChild 431 432 #define RtlParent(Links) \ 433 ((PRTL_SPLAY_LINKS)(Links))->Parent 434 435 // FIXME: use inline function 436 437 #define RtlInitializeSplayLinks(Links) \ 438 { \ 439 PRTL_SPLAY_LINKS _SplayLinks; \ 440 _SplayLinks = (PRTL_SPLAY_LINKS)(Links); \ 441 _SplayLinks->Parent = _SplayLinks; \ 442 _SplayLinks->LeftChild = NULL; \ 443 _SplayLinks->RightChild = NULL; \ 444 } 445 446 #define RtlInsertAsLeftChild(ParentLinks,ChildLinks) \ 447 { \ 448 PRTL_SPLAY_LINKS _SplayParent; \ 449 PRTL_SPLAY_LINKS _SplayChild; \ 450 _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \ 451 _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \ 452 _SplayParent->LeftChild = _SplayChild; \ 453 _SplayChild->Parent = _SplayParent; \ 454 } 455 456 #define RtlInsertAsRightChild(ParentLinks,ChildLinks) \ 457 { \ 458 PRTL_SPLAY_LINKS _SplayParent; \ 459 PRTL_SPLAY_LINKS _SplayChild; \ 460 _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \ 461 _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \ 462 _SplayParent->RightChild = _SplayChild; \ 463 _SplayChild->Parent = _SplayParent; \ 464 } 465 466 // 467 // RTL AVL Tree Functions 468 // 469 NTSYSAPI 470 VOID 471 NTAPI 472 RtlInitializeGenericTableAvl( 473 _Out_ PRTL_AVL_TABLE Table, 474 _In_ PRTL_AVL_COMPARE_ROUTINE CompareRoutine, 475 _In_opt_ PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine, 476 _In_opt_ PRTL_AVL_FREE_ROUTINE FreeRoutine, 477 _In_opt_ PVOID TableContext 478 ); 479 480 NTSYSAPI 481 PVOID 482 NTAPI 483 RtlInsertElementGenericTableAvl( 484 _In_ PRTL_AVL_TABLE Table, 485 _In_reads_bytes_(BufferSize) PVOID Buffer, 486 _In_ CLONG BufferSize, 487 _Out_opt_ PBOOLEAN NewElement 488 ); 489 490 NTSYSAPI 491 PVOID 492 NTAPI 493 RtlInsertElementGenericTableFullAvl( 494 _In_ PRTL_AVL_TABLE Table, 495 _In_reads_bytes_(BufferSize) PVOID Buffer, 496 _In_ CLONG BufferSize, 497 _Out_opt_ PBOOLEAN NewElement, 498 _In_ PVOID NodeOrParent, 499 _In_ TABLE_SEARCH_RESULT SearchResult 500 ); 501 502 NTSYSAPI 503 BOOLEAN 504 NTAPI 505 RtlDeleteElementGenericTableAvl( 506 _In_ PRTL_AVL_TABLE Table, 507 _In_ PVOID Buffer 508 ); 509 510 _Must_inspect_result_ 511 NTSYSAPI 512 PVOID 513 NTAPI 514 RtlLookupElementGenericTableAvl( 515 _In_ PRTL_AVL_TABLE Table, 516 _In_ PVOID Buffer 517 ); 518 519 NTSYSAPI 520 PVOID 521 NTAPI 522 RtlLookupElementGenericTableFullAvl( 523 _In_ PRTL_AVL_TABLE Table, 524 _In_ PVOID Buffer, 525 _Out_ PVOID *NodeOrParent, 526 _Out_ TABLE_SEARCH_RESULT *SearchResult 527 ); 528 529 _Must_inspect_result_ 530 NTSYSAPI 531 PVOID 532 NTAPI 533 RtlEnumerateGenericTableAvl( 534 _In_ PRTL_AVL_TABLE Table, 535 _In_ BOOLEAN Restart 536 ); 537 538 _Must_inspect_result_ 539 NTSYSAPI 540 PVOID 541 NTAPI 542 RtlEnumerateGenericTableWithoutSplayingAvl( 543 _In_ PRTL_AVL_TABLE Table, 544 _Inout_ PVOID *RestartKey 545 ); 546 547 _Must_inspect_result_ 548 NTSYSAPI 549 PVOID 550 NTAPI 551 RtlLookupFirstMatchingElementGenericTableAvl( 552 _In_ PRTL_AVL_TABLE Table, 553 _In_ PVOID Buffer, 554 _Out_ PVOID *RestartKey 555 ); 556 557 _Must_inspect_result_ 558 NTSYSAPI 559 PVOID 560 NTAPI 561 RtlEnumerateGenericTableLikeADirectory( 562 _In_ PRTL_AVL_TABLE Table, 563 _In_opt_ PRTL_AVL_MATCH_FUNCTION MatchFunction, 564 _In_opt_ PVOID MatchData, 565 _In_ ULONG NextFlag, 566 _Inout_ PVOID *RestartKey, 567 _Inout_ PULONG DeleteCount, 568 _In_ PVOID Buffer 569 ); 570 571 _Must_inspect_result_ 572 NTSYSAPI 573 PVOID 574 NTAPI 575 RtlGetElementGenericTableAvl( 576 _In_ PRTL_AVL_TABLE Table, 577 _In_ ULONG I 578 ); 579 580 NTSYSAPI 581 ULONG 582 NTAPI 583 RtlNumberGenericTableElementsAvl( 584 _In_ PRTL_AVL_TABLE Table 585 ); 586 587 _Must_inspect_result_ 588 NTSYSAPI 589 BOOLEAN 590 NTAPI 591 RtlIsGenericTableEmptyAvl( 592 _In_ PRTL_AVL_TABLE Table 593 ); 594 595 #ifdef RTL_USE_AVL_TABLES 596 597 #define RtlInitializeGenericTable RtlInitializeGenericTableAvl 598 #define RtlInsertElementGenericTable RtlInsertElementGenericTableAvl 599 #define RtlInsertElementGenericTableFull RtlInsertElementGenericTableFullAvl 600 #define RtlDeleteElementGenericTable RtlDeleteElementGenericTableAvl 601 #define RtlLookupElementGenericTable RtlLookupElementGenericTableAvl 602 #define RtlLookupElementGenericTableFull RtlLookupElementGenericTableFullAvl 603 #define RtlEnumerateGenericTable RtlEnumerateGenericTableAvl 604 #define RtlEnumerateGenericTableWithoutSplaying RtlEnumerateGenericTableWithoutSplayingAvl 605 #define RtlGetElementGenericTable RtlGetElementGenericTableAvl 606 #define RtlNumberGenericTableElements RtlNumberGenericTableElementsAvl 607 #define RtlIsGenericTableEmpty RtlIsGenericTableEmptyAvl 608 609 #endif /* RTL_USE_AVL_TABLES */ 610 611 // 612 // Exception and Error Functions 613 // 614 NTSYSAPI 615 PVOID 616 NTAPI 617 RtlAddVectoredExceptionHandler( 618 _In_ ULONG FirstHandler, 619 _In_ PVECTORED_EXCEPTION_HANDLER VectoredHandler 620 ); 621 622 NTSYSAPI 623 ULONG 624 NTAPI 625 RtlRemoveVectoredExceptionHandler( 626 _In_ PVOID VectoredHandlerHandle 627 ); 628 629 NTSYSAPI 630 PVOID 631 NTAPI 632 RtlAddVectoredContinueHandler( 633 _In_ ULONG FirstHandler, 634 _In_ PVECTORED_EXCEPTION_HANDLER VectoredHandler 635 ); 636 637 NTSYSAPI 638 ULONG 639 NTAPI 640 RtlRemoveVectoredContinueHandler( 641 _In_ PVOID VectoredHandlerHandle 642 ); 643 644 NTSYSAPI 645 VOID 646 NTAPI 647 RtlSetUnhandledExceptionFilter( 648 _In_ PRTLP_UNHANDLED_EXCEPTION_FILTER TopLevelExceptionFilter 649 ); 650 651 NTSYSAPI 652 LONG 653 NTAPI 654 RtlUnhandledExceptionFilter( 655 _In_ struct _EXCEPTION_POINTERS* ExceptionInfo 656 ); 657 658 __analysis_noreturn 659 NTSYSAPI 660 VOID 661 NTAPI 662 RtlAssert( 663 _In_ PVOID FailedAssertion, 664 _In_ PVOID FileName, 665 _In_ ULONG LineNumber, 666 _In_opt_z_ PCHAR Message 667 ); 668 669 NTSYSAPI 670 PVOID 671 NTAPI 672 RtlEncodePointer( 673 _In_ PVOID Pointer 674 ); 675 676 NTSYSAPI 677 PVOID 678 NTAPI 679 RtlDecodePointer( 680 _In_ PVOID Pointer 681 ); 682 683 NTSYSAPI 684 PVOID 685 NTAPI 686 RtlEncodeSystemPointer( 687 _In_ PVOID Pointer 688 ); 689 690 NTSYSAPI 691 PVOID 692 NTAPI 693 RtlDecodeSystemPointer( 694 _In_ PVOID Pointer 695 ); 696 697 NTSYSAPI 698 NTSTATUS 699 NTAPI 700 RtlGetLastNtStatus( 701 VOID 702 ); 703 704 NTSYSAPI 705 ULONG 706 NTAPI 707 RtlGetLastWin32Error( 708 VOID 709 ); 710 711 NTSYSAPI 712 VOID 713 NTAPI 714 RtlSetLastWin32Error( 715 _In_ ULONG LastError 716 ); 717 718 NTSYSAPI 719 VOID 720 NTAPI 721 RtlSetLastWin32ErrorAndNtStatusFromNtStatus( 722 _In_ NTSTATUS Status 723 ); 724 725 NTSYSAPI 726 NTSTATUS 727 NTAPI 728 RtlSetThreadErrorMode( 729 _In_ ULONG NewMode, 730 _Out_opt_ PULONG OldMode 731 ); 732 733 NTSYSAPI 734 ULONG 735 NTAPI 736 RtlGetThreadErrorMode( 737 VOID 738 ); 739 740 #endif /* NTOS_MODE_USER */ 741 742 NTSYSAPI 743 VOID 744 NTAPI 745 RtlCaptureContext( 746 _Out_ PCONTEXT ContextRecord 747 ); 748 749 NTSYSAPI 750 BOOLEAN 751 NTAPI 752 RtlDispatchException( 753 _In_ PEXCEPTION_RECORD ExceptionRecord, 754 _In_ PCONTEXT Context 755 ); 756 757 _IRQL_requires_max_(APC_LEVEL) 758 _When_(Status < 0, _Out_range_(>, 0)) 759 _When_(Status >= 0, _Out_range_(==, 0)) 760 NTSYSAPI 761 ULONG 762 NTAPI 763 RtlNtStatusToDosError( 764 _In_ NTSTATUS Status 765 ); 766 767 _When_(Status < 0, _Out_range_(>, 0)) 768 _When_(Status >= 0, _Out_range_(==, 0)) 769 NTSYSAPI 770 ULONG 771 NTAPI 772 RtlNtStatusToDosErrorNoTeb( 773 _In_ NTSTATUS Status 774 ); 775 776 NTSYSAPI 777 NTSTATUS 778 NTAPI 779 RtlMapSecurityErrorToNtStatus( 780 _In_ ULONG SecurityError 781 ); 782 783 NTSYSAPI 784 VOID 785 NTAPI 786 RtlRaiseException( 787 _In_ PEXCEPTION_RECORD ExceptionRecord 788 ); 789 790 DECLSPEC_NORETURN 791 NTSYSAPI 792 VOID 793 NTAPI 794 RtlRaiseStatus( 795 _In_ NTSTATUS Status 796 ); 797 798 NTSYSAPI 799 VOID 800 NTAPI 801 RtlUnwind( 802 _In_opt_ PVOID TargetFrame, 803 _In_opt_ PVOID TargetIp, 804 _In_opt_ PEXCEPTION_RECORD ExceptionRecord, 805 _In_ PVOID ReturnValue 806 ); 807 808 #define RTL_STACK_WALKING_MODE_FRAMES_TO_SKIP_SHIFT 8 809 810 // 811 // Tracing Functions 812 // 813 NTSYSAPI 814 ULONG 815 NTAPI 816 RtlWalkFrameChain( 817 _Out_writes_(Count - (Flags >> RTL_STACK_WALKING_MODE_FRAMES_TO_SKIP_SHIFT)) PVOID *Callers, 818 _In_ ULONG Count, 819 _In_ ULONG Flags 820 ); 821 822 NTSYSAPI 823 USHORT 824 NTAPI 825 RtlLogStackBackTrace( 826 VOID 827 ); 828 829 #ifdef NTOS_MODE_USER 830 // 831 // Heap Functions 832 // 833 _Must_inspect_result_ 834 _Ret_maybenull_ 835 _Post_writable_byte_size_(Size) 836 NTSYSAPI 837 PVOID 838 NTAPI 839 RtlAllocateHeap( 840 _In_ PVOID HeapHandle, 841 _In_opt_ ULONG Flags, 842 _In_ SIZE_T Size 843 ); 844 845 _Must_inspect_result_ 846 NTSYSAPI 847 PVOID 848 NTAPI 849 RtlCreateHeap( 850 _In_ ULONG Flags, 851 _In_opt_ PVOID BaseAddress, 852 _In_opt_ SIZE_T SizeToReserve, 853 _In_opt_ SIZE_T SizeToCommit, 854 _In_opt_ PVOID Lock, 855 _In_opt_ PRTL_HEAP_PARAMETERS Parameters 856 ); 857 858 NTSYSAPI 859 ULONG 860 NTAPI 861 RtlCreateTagHeap( 862 _In_ HANDLE HeapHandle, 863 _In_ ULONG Flags, 864 _In_ PWSTR TagName, 865 _In_ PWSTR TagSubName 866 ); 867 868 ULONG 869 NTAPI 870 RtlCompactHeap( 871 _In_ HANDLE Heap, 872 _In_ ULONG Flags 873 ); 874 875 _Must_inspect_result_ 876 NTSYSAPI 877 PVOID 878 NTAPI 879 RtlDebugCreateHeap( 880 _In_ ULONG Flags, 881 _In_opt_ PVOID BaseAddress, 882 _In_opt_ SIZE_T SizeToReserve, 883 _In_opt_ SIZE_T SizeToCommit, 884 _In_opt_ PVOID Lock, 885 _In_opt_ PRTL_HEAP_PARAMETERS Parameters 886 ); 887 888 NTSYSAPI 889 HANDLE 890 NTAPI 891 RtlDestroyHeap( 892 _In_ _Post_invalid_ HANDLE Heap 893 ); 894 895 NTSYSAPI 896 ULONG 897 NTAPI 898 RtlExtendHeap( 899 _In_ HANDLE Heap, 900 _In_ ULONG Flags, 901 _In_ PVOID P, 902 _In_ SIZE_T Size 903 ); 904 905 _Success_(return != 0) 906 NTSYSAPI 907 BOOLEAN 908 NTAPI 909 RtlFreeHeap( 910 _In_ HANDLE HeapHandle, 911 _In_opt_ ULONG Flags, 912 _In_ _Post_invalid_ PVOID P 913 ); 914 915 ULONG 916 NTAPI 917 RtlGetProcessHeaps( 918 _In_ ULONG HeapCount, 919 _Out_cap_(HeapCount) HANDLE *HeapArray 920 ); 921 922 _Success_(return != 0) 923 BOOLEAN 924 NTAPI 925 RtlGetUserInfoHeap( 926 _In_ PVOID HeapHandle, 927 _In_ ULONG Flags, 928 _In_ PVOID BaseAddress, 929 _Inout_opt_ PVOID *UserValue, 930 _Out_opt_ PULONG UserFlags 931 ); 932 933 NTSYSAPI 934 PVOID 935 NTAPI 936 RtlProtectHeap( 937 _In_ PVOID HeapHandle, 938 _In_ BOOLEAN Protect 939 ); 940 941 NTSYSAPI 942 NTSTATUS 943 NTAPI 944 RtlQueryHeapInformation( 945 _In_ PVOID HeapHandle, 946 _In_ HEAP_INFORMATION_CLASS HeapInformationClass, 947 _Out_ PVOID HeapInformation, 948 _In_ SIZE_T HeapInformationLength, 949 _When_(HeapInformationClass==HeapCompatibilityInformation, _On_failure_(_Out_opt_)) 950 _Out_opt_ PSIZE_T ReturnLength 951 ); 952 953 _Ret_opt_z_ 954 NTSYSAPI 955 PWSTR 956 NTAPI 957 RtlQueryTagHeap( 958 _In_ PVOID HeapHandle, 959 _In_ ULONG Flags, 960 _In_ USHORT TagIndex, 961 _In_ BOOLEAN ResetCounters, 962 _Out_ PRTL_HEAP_TAG_INFO HeapTagInfo 963 ); 964 965 _Must_inspect_result_ 966 _Ret_maybenull_ 967 _Post_writable_byte_size_(Size) 968 NTSYSAPI 969 PVOID 970 NTAPI 971 RtlReAllocateHeap( 972 _In_ HANDLE Heap, 973 _In_opt_ ULONG Flags, 974 _In_ _Post_invalid_ PVOID Ptr, 975 _In_ SIZE_T Size 976 ); 977 978 NTSYSAPI 979 NTSTATUS 980 NTAPI 981 RtlSetHeapInformation( 982 _In_ PVOID HeapHandle, 983 _In_ HEAP_INFORMATION_CLASS HeapInformationClass, 984 _When_(HeapInformationClass==HeapCompatibilityInformation,_In_) PVOID HeapInformation, 985 _In_ SIZE_T HeapInformationLength 986 ); 987 988 NTSYSAPI 989 BOOLEAN 990 NTAPI 991 RtlLockHeap( 992 _In_ HANDLE Heap 993 ); 994 995 _Must_inspect_result_ 996 NTSYSAPI 997 NTSTATUS 998 NTAPI 999 RtlMultipleAllocateHeap ( 1000 _In_ HANDLE HeapHandle, 1001 _In_ ULONG Flags, 1002 _In_ SIZE_T Size, 1003 _In_ ULONG Count, 1004 _Out_cap_(Count) _Deref_post_bytecap_(Size) PVOID * Array 1005 ); 1006 1007 NTSYSAPI 1008 NTSTATUS 1009 NTAPI 1010 RtlMultipleFreeHeap ( 1011 _In_ HANDLE HeapHandle, 1012 _In_ ULONG Flags, 1013 _In_ ULONG Count, 1014 _In_count_(Count) /* _Deref_ _Post_invalid_ */ PVOID * Array 1015 ); 1016 1017 NTSYSAPI 1018 NTSTATUS 1019 NTAPI 1020 RtlUsageHeap( 1021 _In_ HANDLE Heap, 1022 _In_ ULONG Flags, 1023 _Out_ PRTL_HEAP_USAGE Usage 1024 ); 1025 1026 NTSYSAPI 1027 BOOLEAN 1028 NTAPI 1029 RtlUnlockHeap( 1030 _In_ HANDLE Heap 1031 ); 1032 1033 BOOLEAN 1034 NTAPI 1035 RtlSetUserValueHeap( 1036 _In_ PVOID HeapHandle, 1037 _In_ ULONG Flags, 1038 _In_ PVOID BaseAddress, 1039 _In_ PVOID UserValue 1040 ); 1041 1042 BOOLEAN 1043 NTAPI 1044 RtlSetUserFlagsHeap( 1045 _In_ PVOID HeapHandle, 1046 _In_ ULONG Flags, 1047 _In_ PVOID BaseAddress, 1048 _In_ ULONG UserFlagsReset, 1049 _In_ ULONG UserFlagsSet 1050 ); 1051 1052 NTSYSAPI 1053 BOOLEAN 1054 NTAPI 1055 RtlValidateHeap( 1056 _In_ HANDLE Heap, 1057 _In_ ULONG Flags, 1058 _In_opt_ PVOID P 1059 ); 1060 1061 NTSYSAPI 1062 NTSTATUS 1063 NTAPI 1064 RtlWalkHeap( 1065 _In_ HANDLE HeapHandle, 1066 _In_ PVOID HeapEntry 1067 ); 1068 1069 #define RtlGetProcessHeap() (NtCurrentPeb()->ProcessHeap) 1070 1071 #endif // NTOS_MODE_USER 1072 1073 #define NtCurrentPeb() (NtCurrentTeb()->ProcessEnvironmentBlock) 1074 1075 NTSYSAPI 1076 SIZE_T 1077 NTAPI 1078 RtlSizeHeap( 1079 _In_ PVOID HeapHandle, 1080 _In_ ULONG Flags, 1081 _In_ PVOID MemoryPointer 1082 ); 1083 1084 1085 // 1086 // Security Functions 1087 // 1088 _IRQL_requires_max_(APC_LEVEL) 1089 NTSYSAPI 1090 NTSTATUS 1091 NTAPI 1092 RtlAbsoluteToSelfRelativeSD( 1093 _In_ PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor, 1094 _Out_writes_bytes_to_opt_(*BufferLength, *BufferLength) PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor, 1095 _Inout_ PULONG BufferLength 1096 ); 1097 1098 _IRQL_requires_max_(APC_LEVEL) 1099 NTSYSAPI 1100 NTSTATUS 1101 NTAPI 1102 RtlAddAccessAllowedAce( 1103 _Inout_ PACL Acl, 1104 _In_ ULONG Revision, 1105 _In_ ACCESS_MASK AccessMask, 1106 _In_ PSID Sid 1107 ); 1108 1109 _IRQL_requires_max_(APC_LEVEL) 1110 NTSYSAPI 1111 NTSTATUS 1112 NTAPI 1113 RtlAddAccessAllowedAceEx( 1114 _Inout_ PACL pAcl, 1115 _In_ ULONG dwAceRevision, 1116 _In_ ULONG AceFlags, 1117 _In_ ACCESS_MASK AccessMask, 1118 _In_ PSID pSid 1119 ); 1120 1121 NTSYSAPI 1122 NTSTATUS 1123 NTAPI 1124 RtlAddAccessAllowedObjectAce( 1125 _Inout_ PACL pAcl, 1126 _In_ ULONG dwAceRevision, 1127 _In_ ULONG AceFlags, 1128 _In_ ACCESS_MASK AccessMask, 1129 _In_opt_ GUID *ObjectTypeGuid, 1130 _In_opt_ GUID *InheritedObjectTypeGuid, 1131 _In_ PSID pSid 1132 ); 1133 1134 NTSYSAPI 1135 NTSTATUS 1136 NTAPI 1137 RtlAddAccessDeniedAce( 1138 _Inout_ PACL Acl, 1139 _In_ ULONG Revision, 1140 _In_ ACCESS_MASK AccessMask, 1141 _In_ PSID Sid 1142 ); 1143 1144 NTSYSAPI 1145 NTSTATUS 1146 NTAPI 1147 RtlAddAccessDeniedAceEx( 1148 _Inout_ PACL Acl, 1149 _In_ ULONG Revision, 1150 _In_ ULONG Flags, 1151 _In_ ACCESS_MASK AccessMask, 1152 _In_ PSID Sid 1153 ); 1154 1155 NTSYSAPI 1156 NTSTATUS 1157 NTAPI 1158 RtlAddAccessDeniedObjectAce( 1159 _Inout_ PACL pAcl, 1160 _In_ ULONG dwAceRevision, 1161 _In_ ULONG AceFlags, 1162 _In_ ACCESS_MASK AccessMask, 1163 _In_opt_ GUID *ObjectTypeGuid, 1164 _In_opt_ GUID *InheritedObjectTypeGuid, 1165 _In_ PSID pSid 1166 ); 1167 1168 NTSYSAPI 1169 NTSTATUS 1170 NTAPI 1171 RtlAddAce( 1172 _Inout_ PACL Acl, 1173 _In_ ULONG AceRevision, 1174 _In_ ULONG StartingAceIndex, 1175 _In_reads_bytes_(AceListLength) PVOID AceList, 1176 _In_ ULONG AceListLength 1177 ); 1178 1179 NTSYSAPI 1180 NTSTATUS 1181 NTAPI 1182 RtlAddAuditAccessAce( 1183 _Inout_ PACL Acl, 1184 _In_ ULONG Revision, 1185 _In_ ACCESS_MASK AccessMask, 1186 _In_ PSID Sid, 1187 _In_ BOOLEAN Success, 1188 _In_ BOOLEAN Failure 1189 ); 1190 1191 NTSYSAPI 1192 NTSTATUS 1193 NTAPI 1194 RtlAcquirePrivilege( 1195 _In_ PULONG Privilege, 1196 _In_ ULONG NumPriv, 1197 _In_ ULONG Flags, 1198 _Out_ PVOID *ReturnedState 1199 ); 1200 1201 NTSYSAPI 1202 NTSTATUS 1203 NTAPI 1204 RtlAddAuditAccessAceEx( 1205 _Inout_ PACL Acl, 1206 _In_ ULONG Revision, 1207 _In_ ULONG Flags, 1208 _In_ ACCESS_MASK AccessMask, 1209 _In_ PSID Sid, 1210 _In_ BOOLEAN Success, 1211 _In_ BOOLEAN Failure 1212 ); 1213 1214 NTSYSAPI 1215 NTSTATUS 1216 NTAPI 1217 RtlAddAuditAccessObjectAce( 1218 _Inout_ PACL Acl, 1219 _In_ ULONG Revision, 1220 _In_ ULONG Flags, 1221 _In_ ACCESS_MASK AccessMask, 1222 _In_opt_ GUID *ObjectTypeGuid, 1223 _In_opt_ GUID *InheritedObjectTypeGuid, 1224 _In_ PSID Sid, 1225 _In_ BOOLEAN Success, 1226 _In_ BOOLEAN Failure 1227 ); 1228 1229 NTSYSAPI 1230 NTSTATUS 1231 NTAPI 1232 RtlAddMandatoryAce( 1233 _Inout_ PACL Acl, 1234 _In_ ULONG Revision, 1235 _In_ ULONG Flags, 1236 _In_ ULONG MandatoryFlags, 1237 _In_ UCHAR AceType, 1238 _In_ PSID LabelSid); 1239 1240 NTSYSAPI 1241 NTSTATUS 1242 NTAPI 1243 RtlAdjustPrivilege( 1244 _In_ ULONG Privilege, 1245 _In_ BOOLEAN NewValue, 1246 _In_ BOOLEAN ForThread, 1247 _Out_ PBOOLEAN OldValue 1248 ); 1249 1250 _Must_inspect_result_ 1251 NTSYSAPI 1252 NTSTATUS 1253 NTAPI 1254 RtlAllocateAndInitializeSid( 1255 _In_ PSID_IDENTIFIER_AUTHORITY IdentifierAuthority, 1256 _In_ UCHAR SubAuthorityCount, 1257 _In_ ULONG SubAuthority0, 1258 _In_ ULONG SubAuthority1, 1259 _In_ ULONG SubAuthority2, 1260 _In_ ULONG SubAuthority3, 1261 _In_ ULONG SubAuthority4, 1262 _In_ ULONG SubAuthority5, 1263 _In_ ULONG SubAuthority6, 1264 _In_ ULONG SubAuthority7, 1265 _Outptr_ PSID *Sid 1266 ); 1267 1268 NTSYSAPI 1269 BOOLEAN 1270 NTAPI 1271 RtlAreAllAccessesGranted( 1272 ACCESS_MASK GrantedAccess, 1273 ACCESS_MASK DesiredAccess 1274 ); 1275 1276 NTSYSAPI 1277 BOOLEAN 1278 NTAPI 1279 RtlAreAnyAccessesGranted( 1280 ACCESS_MASK GrantedAccess, 1281 ACCESS_MASK DesiredAccess 1282 ); 1283 1284 _IRQL_requires_max_(APC_LEVEL) 1285 NTSYSAPI 1286 VOID 1287 NTAPI 1288 RtlCopyLuid ( 1289 _Out_ PLUID DestinationLuid, 1290 _In_ PLUID SourceLuid 1291 ); 1292 1293 NTSYSAPI 1294 VOID 1295 NTAPI 1296 RtlCopyLuidAndAttributesArray( 1297 ULONG Count, 1298 PLUID_AND_ATTRIBUTES Src, 1299 PLUID_AND_ATTRIBUTES Dest 1300 ); 1301 1302 NTSYSAPI 1303 NTSTATUS 1304 NTAPI 1305 RtlCopySidAndAttributesArray( 1306 _In_ ULONG Count, 1307 _In_ PSID_AND_ATTRIBUTES Src, 1308 _In_ ULONG SidAreaSize, 1309 _In_ PSID_AND_ATTRIBUTES Dest, 1310 _In_ PSID SidArea, 1311 _Out_ PSID* RemainingSidArea, 1312 _Out_ PULONG RemainingSidAreaSize 1313 ); 1314 1315 _IRQL_requires_max_(APC_LEVEL) 1316 NTSYSAPI 1317 NTSTATUS 1318 NTAPI 1319 RtlConvertSidToUnicodeString( 1320 _Inout_ PUNICODE_STRING UnicodeString, 1321 _In_ PSID Sid, 1322 _In_ BOOLEAN AllocateDestinationString 1323 ); 1324 1325 _IRQL_requires_max_(APC_LEVEL) 1326 NTSYSAPI 1327 NTSTATUS 1328 NTAPI 1329 RtlCopySid( 1330 _In_ ULONG DestinationSidLength, 1331 _Out_writes_bytes_(DestinationSidLength) PSID DestinationSid, 1332 _In_ PSID SourceSid 1333 ); 1334 1335 NTSYSAPI 1336 NTSTATUS 1337 NTAPI 1338 RtlCreateAcl( 1339 PACL Acl, 1340 ULONG AclSize, 1341 ULONG AclRevision 1342 ); 1343 1344 NTSYSAPI 1345 NTSTATUS 1346 NTAPI 1347 RtlCreateSecurityDescriptor( 1348 _Out_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1349 _In_ ULONG Revision 1350 ); 1351 1352 NTSYSAPI 1353 NTSTATUS 1354 NTAPI 1355 RtlCreateSecurityDescriptorRelative( 1356 _Out_ PISECURITY_DESCRIPTOR_RELATIVE SecurityDescriptor, 1357 _In_ ULONG Revision 1358 ); 1359 1360 NTSYSAPI 1361 NTSTATUS 1362 NTAPI 1363 RtlCopySecurityDescriptor( 1364 _In_ PSECURITY_DESCRIPTOR pSourceSecurityDescriptor, 1365 _Out_ PSECURITY_DESCRIPTOR *pDestinationSecurityDescriptor 1366 ); 1367 1368 NTSYSAPI 1369 NTSTATUS 1370 NTAPI 1371 RtlDeleteAce( 1372 PACL Acl, 1373 ULONG AceIndex 1374 ); 1375 1376 NTSYSAPI 1377 BOOLEAN 1378 NTAPI 1379 RtlEqualPrefixSid( 1380 PSID Sid1, 1381 PSID Sid2 1382 ); 1383 1384 NTSYSAPI 1385 BOOLEAN 1386 NTAPI 1387 RtlEqualSid ( 1388 _In_ PSID Sid1, 1389 _In_ PSID Sid2 1390 ); 1391 1392 NTSYSAPI 1393 BOOLEAN 1394 NTAPI 1395 RtlFirstFreeAce( 1396 PACL Acl, 1397 PACE* Ace 1398 ); 1399 1400 NTSYSAPI 1401 PVOID 1402 NTAPI 1403 RtlFreeSid( 1404 _In_ _Post_invalid_ PSID Sid 1405 ); 1406 1407 NTSYSAPI 1408 NTSTATUS 1409 NTAPI 1410 RtlGetAce( 1411 PACL Acl, 1412 ULONG AceIndex, 1413 PVOID *Ace 1414 ); 1415 1416 NTSYSAPI 1417 NTSTATUS 1418 NTAPI 1419 RtlGetControlSecurityDescriptor( 1420 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1421 _Out_ PSECURITY_DESCRIPTOR_CONTROL Control, 1422 _Out_ PULONG Revision 1423 ); 1424 1425 NTSYSAPI 1426 NTSTATUS 1427 NTAPI 1428 RtlGetDaclSecurityDescriptor( 1429 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1430 _Out_ PBOOLEAN DaclPresent, 1431 _Out_ PACL *Dacl, 1432 _Out_ PBOOLEAN DaclDefaulted 1433 ); 1434 1435 NTSYSAPI 1436 NTSTATUS 1437 NTAPI 1438 RtlGetSaclSecurityDescriptor( 1439 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1440 _Out_ PBOOLEAN SaclPresent, 1441 _Out_ PACL* Sacl, 1442 _Out_ PBOOLEAN SaclDefaulted 1443 ); 1444 1445 NTSYSAPI 1446 NTSTATUS 1447 NTAPI 1448 RtlGetGroupSecurityDescriptor( 1449 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1450 _Out_ PSID *Group, 1451 _Out_ PBOOLEAN GroupDefaulted 1452 ); 1453 1454 NTSYSAPI 1455 NTSTATUS 1456 NTAPI 1457 RtlGetOwnerSecurityDescriptor( 1458 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1459 _Out_ PSID *Owner, 1460 _Out_ PBOOLEAN OwnerDefaulted 1461 ); 1462 1463 NTSYSAPI 1464 BOOLEAN 1465 NTAPI 1466 RtlGetSecurityDescriptorRMControl( 1467 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1468 _Out_ PUCHAR RMControl 1469 ); 1470 1471 NTSYSAPI 1472 PSID_IDENTIFIER_AUTHORITY 1473 NTAPI 1474 RtlIdentifierAuthoritySid(PSID Sid); 1475 1476 NTSYSAPI 1477 NTSTATUS 1478 NTAPI 1479 RtlImpersonateSelf(IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel); 1480 1481 _IRQL_requires_max_(APC_LEVEL) 1482 NTSYSAPI 1483 NTSTATUS 1484 NTAPI 1485 RtlInitializeSid( 1486 _Out_ PSID Sid, 1487 _In_ PSID_IDENTIFIER_AUTHORITY IdentifierAuthority, 1488 _In_ UCHAR SubAuthorityCount 1489 ); 1490 1491 NTSYSAPI 1492 ULONG 1493 NTAPI 1494 RtlLengthRequiredSid(IN ULONG SubAuthorityCount); 1495 1496 _IRQL_requires_max_(APC_LEVEL) 1497 NTSYSAPI 1498 ULONG 1499 NTAPI 1500 RtlLengthSecurityDescriptor( 1501 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor); 1502 1503 NTSYSAPI 1504 ULONG 1505 NTAPI 1506 RtlLengthSid(IN PSID Sid); 1507 1508 NTSYSAPI 1509 NTSTATUS 1510 NTAPI 1511 RtlMakeSelfRelativeSD( 1512 _In_ PSECURITY_DESCRIPTOR AbsoluteSD, 1513 _Out_ PSECURITY_DESCRIPTOR SelfRelativeSD, 1514 _Inout_ PULONG BufferLength); 1515 1516 NTSYSAPI 1517 VOID 1518 NTAPI 1519 RtlMapGenericMask( 1520 PACCESS_MASK AccessMask, 1521 PGENERIC_MAPPING GenericMapping 1522 ); 1523 1524 #ifdef NTOS_MODE_USER 1525 1526 NTSYSAPI 1527 NTSTATUS 1528 NTAPI 1529 RtlQueryInformationAcl( 1530 PACL Acl, 1531 PVOID Information, 1532 ULONG InformationLength, 1533 ACL_INFORMATION_CLASS InformationClass 1534 ); 1535 1536 #endif 1537 1538 NTSYSAPI 1539 VOID 1540 NTAPI 1541 RtlReleasePrivilege( 1542 _In_ PVOID ReturnedState 1543 ); 1544 1545 _IRQL_requires_max_(APC_LEVEL) 1546 NTSYSAPI 1547 NTSTATUS 1548 NTAPI 1549 RtlSelfRelativeToAbsoluteSD( 1550 _In_ PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor, 1551 _Out_writes_bytes_to_opt_(*AbsoluteSecurityDescriptorSize, *AbsoluteSecurityDescriptorSize) PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor, 1552 _Inout_ PULONG AbsoluteSecurityDescriptorSize, 1553 _Out_writes_bytes_to_opt_(*DaclSize, *DaclSize) PACL Dacl, 1554 _Inout_ PULONG DaclSize, 1555 _Out_writes_bytes_to_opt_(*SaclSize, *SaclSize) PACL Sacl, 1556 _Inout_ PULONG SaclSize, 1557 _Out_writes_bytes_to_opt_(*OwnerSize, *OwnerSize) PSID Owner, 1558 _Inout_ PULONG OwnerSize, 1559 _Out_writes_bytes_to_opt_(*PrimaryGroupSize, *PrimaryGroupSize) PSID PrimaryGroup, 1560 _Inout_ PULONG PrimaryGroupSize 1561 ); 1562 1563 NTSYSAPI 1564 NTSTATUS 1565 NTAPI 1566 RtlSelfRelativeToAbsoluteSD2( 1567 _Inout_ PSECURITY_DESCRIPTOR SelfRelativeSD, 1568 _Out_ PULONG BufferSize 1569 ); 1570 1571 NTSYSAPI 1572 NTSTATUS 1573 NTAPI 1574 RtlSetAttributesSecurityDescriptor( 1575 _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1576 _In_ SECURITY_DESCRIPTOR_CONTROL Control, 1577 _Out_ PULONG Revision 1578 ); 1579 1580 NTSYSAPI 1581 NTSTATUS 1582 NTAPI 1583 RtlSetControlSecurityDescriptor( 1584 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1585 _In_ SECURITY_DESCRIPTOR_CONTROL ControlBitsOfInterest, 1586 _In_ SECURITY_DESCRIPTOR_CONTROL ControlBitsToSet 1587 ); 1588 1589 _IRQL_requires_max_(APC_LEVEL) 1590 NTSYSAPI 1591 NTSTATUS 1592 NTAPI 1593 RtlSetDaclSecurityDescriptor( 1594 _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1595 _In_ BOOLEAN DaclPresent, 1596 _In_opt_ PACL Dacl, 1597 _In_opt_ BOOLEAN DaclDefaulted 1598 ); 1599 1600 _IRQL_requires_max_(APC_LEVEL) 1601 NTSYSAPI 1602 NTSTATUS 1603 NTAPI 1604 RtlSetGroupSecurityDescriptor( 1605 _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1606 _In_opt_ PSID Group, 1607 _In_opt_ BOOLEAN GroupDefaulted 1608 ); 1609 1610 #ifdef NTOS_MODE_USER 1611 1612 NTSYSAPI 1613 NTSTATUS 1614 NTAPI 1615 RtlSetInformationAcl( 1616 PACL Acl, 1617 PVOID Information, 1618 ULONG InformationLength, 1619 ACL_INFORMATION_CLASS InformationClass 1620 ); 1621 1622 #endif 1623 1624 _IRQL_requires_max_(APC_LEVEL) 1625 NTSYSAPI 1626 NTSTATUS 1627 NTAPI 1628 RtlSetOwnerSecurityDescriptor( 1629 _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1630 _In_opt_ PSID Owner, 1631 _In_opt_ BOOLEAN OwnerDefaulted 1632 ); 1633 1634 NTSYSAPI 1635 NTSTATUS 1636 NTAPI 1637 RtlSetSaclSecurityDescriptor( 1638 _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1639 _In_ BOOLEAN SaclPresent, 1640 _In_ PACL Sacl, 1641 _In_ BOOLEAN SaclDefaulted 1642 ); 1643 1644 NTSYSAPI 1645 VOID 1646 NTAPI 1647 RtlSetSecurityDescriptorRMControl( 1648 _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1649 _In_ PUCHAR RMControl 1650 ); 1651 1652 NTSYSAPI 1653 PUCHAR 1654 NTAPI 1655 RtlSubAuthorityCountSid( 1656 _In_ PSID Sid 1657 ); 1658 1659 NTSYSAPI 1660 PULONG 1661 NTAPI 1662 RtlSubAuthoritySid( 1663 _In_ PSID Sid, 1664 _In_ ULONG SubAuthority 1665 ); 1666 1667 _IRQL_requires_max_(APC_LEVEL) 1668 _Must_inspect_result_ 1669 NTSYSAPI 1670 BOOLEAN 1671 NTAPI 1672 RtlValidRelativeSecurityDescriptor( 1673 _In_reads_bytes_(SecurityDescriptorLength) PSECURITY_DESCRIPTOR SecurityDescriptorInput, 1674 _In_ ULONG SecurityDescriptorLength, 1675 _In_ SECURITY_INFORMATION RequiredInformation 1676 ); 1677 1678 NTSYSAPI 1679 BOOLEAN 1680 NTAPI 1681 RtlValidSecurityDescriptor(IN PSECURITY_DESCRIPTOR SecurityDescriptor); 1682 1683 NTSYSAPI 1684 BOOLEAN 1685 NTAPI 1686 RtlValidSid(IN PSID Sid); 1687 1688 NTSYSAPI 1689 BOOLEAN 1690 NTAPI 1691 RtlValidAcl(PACL Acl); 1692 1693 NTSYSAPI 1694 NTSTATUS 1695 NTAPI 1696 RtlDeleteSecurityObject( 1697 _In_ PSECURITY_DESCRIPTOR *ObjectDescriptor 1698 ); 1699 1700 NTSYSAPI 1701 NTSTATUS 1702 NTAPI 1703 RtlNewSecurityObject( 1704 _In_ PSECURITY_DESCRIPTOR ParentDescriptor, 1705 _In_ PSECURITY_DESCRIPTOR CreatorDescriptor, 1706 _Out_ PSECURITY_DESCRIPTOR *NewDescriptor, 1707 _In_ BOOLEAN IsDirectoryObject, 1708 _In_ HANDLE Token, 1709 _In_ PGENERIC_MAPPING GenericMapping 1710 ); 1711 1712 NTSYSAPI 1713 NTSTATUS 1714 NTAPI 1715 RtlQuerySecurityObject( 1716 _In_ PSECURITY_DESCRIPTOR ObjectDescriptor, 1717 _In_ SECURITY_INFORMATION SecurityInformation, 1718 _Out_ PSECURITY_DESCRIPTOR ResultantDescriptor, 1719 _In_ ULONG DescriptorLength, 1720 _Out_ PULONG ReturnLength 1721 ); 1722 1723 NTSYSAPI 1724 NTSTATUS 1725 NTAPI 1726 RtlSetSecurityObject( 1727 _In_ SECURITY_INFORMATION SecurityInformation, 1728 _In_ PSECURITY_DESCRIPTOR ModificationDescriptor, 1729 _Out_ PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor, 1730 _In_ PGENERIC_MAPPING GenericMapping, 1731 _In_ HANDLE Token 1732 ); 1733 1734 // 1735 // Single-Character Functions 1736 // 1737 NTSYSAPI 1738 NTSTATUS 1739 NTAPI 1740 RtlLargeIntegerToChar( 1741 _In_ PLARGE_INTEGER Value, 1742 _In_ ULONG Base, 1743 _In_ ULONG Length, 1744 _Out_ PCHAR String 1745 ); 1746 1747 NTSYSAPI 1748 CHAR 1749 NTAPI 1750 RtlUpperChar(CHAR Source); 1751 1752 NTSYSAPI 1753 WCHAR 1754 NTAPI 1755 RtlUpcaseUnicodeChar(WCHAR Source); 1756 1757 NTSYSAPI 1758 WCHAR 1759 NTAPI 1760 RtlDowncaseUnicodeChar(IN WCHAR Source); 1761 1762 NTSYSAPI 1763 NTSTATUS 1764 NTAPI 1765 RtlIntegerToChar( 1766 _In_ ULONG Value, 1767 _In_ ULONG Base, 1768 _In_ ULONG Length, 1769 _Out_ PCHAR String 1770 ); 1771 1772 NTSYSAPI 1773 NTSTATUS 1774 NTAPI 1775 RtlIntegerToUnicode( 1776 _In_ ULONG Value, 1777 _In_opt_ ULONG Base, 1778 _In_opt_ ULONG Length, 1779 _Inout_ LPWSTR String 1780 ); 1781 1782 _IRQL_requires_max_(PASSIVE_LEVEL) 1783 _At_(String->MaximumLength, _Const_) 1784 NTSYSAPI 1785 NTSTATUS 1786 NTAPI 1787 RtlIntegerToUnicodeString( 1788 _In_ ULONG Value, 1789 _In_opt_ ULONG Base, 1790 _Inout_ PUNICODE_STRING String 1791 ); 1792 1793 NTSYSAPI 1794 NTSTATUS 1795 NTAPI 1796 RtlCharToInteger( 1797 PCSZ String, 1798 ULONG Base, 1799 PULONG Value 1800 ); 1801 1802 // 1803 // Byte Swap Functions 1804 // 1805 #ifdef NTOS_MODE_USER 1806 1807 unsigned short __cdecl _byteswap_ushort(unsigned short); 1808 unsigned long __cdecl _byteswap_ulong (unsigned long); 1809 unsigned __int64 __cdecl _byteswap_uint64(unsigned __int64); 1810 #ifdef _MSC_VER 1811 #pragma intrinsic(_byteswap_ushort) 1812 #pragma intrinsic(_byteswap_ulong) 1813 #pragma intrinsic(_byteswap_uint64) 1814 #endif // _MSC_VER 1815 #define RtlUshortByteSwap(_x) _byteswap_ushort((USHORT)(_x)) 1816 #define RtlUlongByteSwap(_x) _byteswap_ulong((_x)) 1817 #define RtlUlonglongByteSwap(_x) _byteswap_uint64((_x)) 1818 1819 #endif // NTOS_MODE_USER 1820 1821 // 1822 // Unicode->Ansi String Functions 1823 // 1824 NTSYSAPI 1825 ULONG 1826 NTAPI 1827 RtlxUnicodeStringToAnsiSize(IN PCUNICODE_STRING UnicodeString); 1828 1829 #ifdef NTOS_MODE_USER 1830 1831 #define RtlUnicodeStringToAnsiSize(STRING) ( \ 1832 NLS_MB_CODE_PAGE_TAG ? \ 1833 RtlxUnicodeStringToAnsiSize(STRING) : \ 1834 ((STRING)->Length + sizeof(UNICODE_NULL)) / sizeof(WCHAR) \ 1835 ) 1836 1837 #endif 1838 1839 NTSYSAPI 1840 NTSTATUS 1841 NTAPI 1842 RtlUnicodeStringToAnsiString( 1843 PANSI_STRING DestinationString, 1844 PCUNICODE_STRING SourceString, 1845 BOOLEAN AllocateDestinationString 1846 ); 1847 1848 // 1849 // Unicode->OEM String Functions 1850 // 1851 NTSYSAPI 1852 NTSTATUS 1853 NTAPI 1854 RtlUpcaseUnicodeStringToOemString( 1855 POEM_STRING DestinationString, 1856 PCUNICODE_STRING SourceString, 1857 BOOLEAN AllocateDestinationString 1858 ); 1859 1860 _IRQL_requires_max_(PASSIVE_LEVEL) 1861 _Must_inspect_result_ 1862 //_At_(DestinationString->Buffer, _Post_bytecount_(DestinationString->Length)) 1863 NTSYSAPI 1864 NTSTATUS 1865 NTAPI 1866 RtlUpcaseUnicodeStringToCountedOemString( 1867 _When_(AllocateDestinationString, _Out_ _At_(DestinationString->Buffer, __drv_allocatesMem(Mem))) 1868 _When_(!AllocateDestinationString, _Inout_) 1869 POEM_STRING DestinationString, 1870 _In_ PCUNICODE_STRING SourceString, 1871 _In_ BOOLEAN AllocateDestinationString 1872 ); 1873 1874 NTSYSAPI 1875 NTSTATUS 1876 NTAPI 1877 RtlUnicodeStringToOemString( 1878 POEM_STRING DestinationString, 1879 PCUNICODE_STRING SourceString, 1880 BOOLEAN AllocateDestinationString 1881 ); 1882 1883 NTSYSAPI 1884 NTSTATUS 1885 NTAPI 1886 RtlUpcaseUnicodeToOemN( 1887 PCHAR OemString, 1888 ULONG OemSize, 1889 PULONG ResultSize, 1890 PCWCH UnicodeString, 1891 ULONG UnicodeSize 1892 ); 1893 1894 NTSYSAPI 1895 ULONG 1896 NTAPI 1897 RtlxUnicodeStringToOemSize(IN PCUNICODE_STRING UnicodeString); 1898 1899 #ifdef NTOS_MODE_USER 1900 1901 #define RtlUnicodeStringToOemSize(STRING) ( \ 1902 NLS_MB_OEM_CODE_PAGE_TAG ? \ 1903 RtlxUnicodeStringToOemSize(STRING) : \ 1904 ((STRING)->Length + sizeof(UNICODE_NULL)) / sizeof(WCHAR) \ 1905 ) 1906 1907 #define RtlUnicodeStringToCountedOemSize(STRING) ( \ 1908 (ULONG)(RtlUnicodeStringToOemSize(STRING) - sizeof(ANSI_NULL)) \ 1909 ) 1910 1911 #endif 1912 1913 NTSYSAPI 1914 NTSTATUS 1915 NTAPI 1916 RtlUnicodeToOemN( 1917 PCHAR OemString, 1918 ULONG OemSize, 1919 PULONG ResultSize, 1920 PCWCH UnicodeString, 1921 ULONG UnicodeSize 1922 ); 1923 1924 // 1925 // Unicode->MultiByte String Functions 1926 // 1927 NTSYSAPI 1928 NTSTATUS 1929 NTAPI 1930 RtlUnicodeToMultiByteN( 1931 PCHAR MbString, 1932 ULONG MbSize, 1933 PULONG ResultSize, 1934 PCWCH UnicodeString, 1935 ULONG UnicodeSize 1936 ); 1937 1938 NTSYSAPI 1939 NTSTATUS 1940 NTAPI 1941 RtlUpcaseUnicodeToMultiByteN( 1942 PCHAR MbString, 1943 ULONG MbSize, 1944 PULONG ResultSize, 1945 PCWCH UnicodeString, 1946 ULONG UnicodeSize 1947 ); 1948 1949 NTSYSAPI 1950 NTSTATUS 1951 NTAPI 1952 RtlUnicodeToMultiByteSize( 1953 PULONG MbSize, 1954 PCWCH UnicodeString, 1955 ULONG UnicodeSize 1956 ); 1957 1958 NTSYSAPI 1959 ULONG 1960 NTAPI 1961 RtlxOemStringToUnicodeSize(IN PCOEM_STRING OemString); 1962 1963 // 1964 // OEM to Unicode Functions 1965 // 1966 NTSYSAPI 1967 NTSTATUS 1968 NTAPI 1969 RtlOemStringToUnicodeString( 1970 PUNICODE_STRING DestinationString, 1971 PCOEM_STRING SourceString, 1972 BOOLEAN AllocateDestinationString 1973 ); 1974 1975 _IRQL_requires_max_(PASSIVE_LEVEL) 1976 NTSYSAPI 1977 NTSTATUS 1978 NTAPI 1979 RtlOemToUnicodeN( 1980 _Out_writes_bytes_to_(MaxBytesInUnicodeString, *BytesInUnicodeString) PWCH UnicodeString, 1981 _In_ ULONG MaxBytesInUnicodeString, 1982 _Out_opt_ PULONG BytesInUnicodeString, 1983 _In_reads_bytes_(BytesInOemString) PCCH OemString, 1984 _In_ ULONG BytesInOemString 1985 ); 1986 1987 #ifdef NTOS_MODE_USER 1988 1989 #define RtlOemStringToUnicodeSize(STRING) ( \ 1990 NLS_MB_OEM_CODE_PAGE_TAG ? \ 1991 RtlxOemStringToUnicodeSize(STRING) : \ 1992 ((STRING)->Length + sizeof(ANSI_NULL)) * sizeof(WCHAR) \ 1993 ) 1994 1995 #define RtlOemStringToCountedUnicodeSize(STRING) ( \ 1996 (ULONG)(RtlOemStringToUnicodeSize(STRING) - sizeof(UNICODE_NULL)) \ 1997 ) 1998 1999 #endif 2000 2001 // 2002 // Ansi->Unicode String Functions 2003 // 2004 _IRQL_requires_max_(APC_LEVEL) 2005 NTSYSAPI 2006 WCHAR 2007 NTAPI 2008 RtlAnsiCharToUnicodeChar( 2009 _Inout_ PUCHAR *SourceCharacter); 2010 2011 NTSYSAPI 2012 NTSTATUS 2013 NTAPI 2014 RtlAnsiStringToUnicodeString( 2015 PUNICODE_STRING DestinationString, 2016 PCANSI_STRING SourceString, 2017 BOOLEAN AllocateDestinationString 2018 ); 2019 2020 NTSYSAPI 2021 ULONG 2022 NTAPI 2023 RtlxAnsiStringToUnicodeSize( 2024 PCANSI_STRING AnsiString 2025 ); 2026 2027 #ifdef NTOS_MODE_USER 2028 2029 #define RtlAnsiStringToUnicodeSize(STRING) ( \ 2030 NLS_MB_CODE_PAGE_TAG ? \ 2031 RtlxAnsiStringToUnicodeSize(STRING) : \ 2032 ((STRING)->Length + sizeof(ANSI_NULL)) * sizeof(WCHAR) \ 2033 ) 2034 2035 #endif 2036 2037 NTSYSAPI 2038 BOOLEAN 2039 NTAPI 2040 RtlCreateUnicodeStringFromAsciiz( 2041 _Out_ PUNICODE_STRING Destination, 2042 _In_ PCSZ Source 2043 ); 2044 2045 // 2046 // Unicode String Functions 2047 // 2048 NTSYSAPI 2049 NTSTATUS 2050 NTAPI 2051 RtlAppendUnicodeToString( 2052 PUNICODE_STRING Destination, 2053 PCWSTR Source 2054 ); 2055 2056 NTSYSAPI 2057 NTSTATUS 2058 NTAPI 2059 RtlAppendUnicodeStringToString( 2060 PUNICODE_STRING Destination, 2061 PCUNICODE_STRING Source 2062 ); 2063 2064 NTSYSAPI 2065 LONG 2066 NTAPI 2067 RtlCompareUnicodeString( 2068 PCUNICODE_STRING String1, 2069 PCUNICODE_STRING String2, 2070 BOOLEAN CaseInsensitive 2071 ); 2072 2073 NTSYSAPI 2074 VOID 2075 NTAPI 2076 RtlCopyUnicodeString( 2077 PUNICODE_STRING DestinationString, 2078 PCUNICODE_STRING SourceString 2079 ); 2080 2081 NTSYSAPI 2082 BOOLEAN 2083 NTAPI 2084 RtlCreateUnicodeString( 2085 PUNICODE_STRING DestinationString, 2086 PCWSTR SourceString 2087 ); 2088 2089 #ifdef NTOS_MODE_USER 2090 2091 NTSYSAPI 2092 NTSTATUS 2093 NTAPI 2094 RtlDowncaseUnicodeString( 2095 _Inout_ PUNICODE_STRING UniDest, 2096 _In_ PCUNICODE_STRING UniSource, 2097 _In_ BOOLEAN AllocateDestinationString 2098 ); 2099 2100 NTSYSAPI 2101 NTSTATUS 2102 NTAPI 2103 RtlDuplicateUnicodeString( 2104 _In_ ULONG Flags, 2105 _In_ PCUNICODE_STRING SourceString, 2106 _Out_ PUNICODE_STRING DestinationString 2107 ); 2108 2109 NTSYSAPI 2110 NTSTATUS 2111 NTAPI 2112 RtlFindCharInUnicodeString( 2113 _In_ ULONG Flags, 2114 _In_ PCUNICODE_STRING SearchString, 2115 _In_ PCUNICODE_STRING MatchString, 2116 _Out_ PUSHORT Position 2117 ); 2118 2119 // 2120 // Memory Functions 2121 // 2122 #if defined(_M_AMD64) 2123 2124 FORCEINLINE 2125 VOID 2126 RtlFillMemoryUlong( 2127 _Out_writes_bytes_all_(Length) PVOID Destination, 2128 _In_ SIZE_T Length, 2129 _In_ ULONG Pattern) 2130 { 2131 PULONG Address = (PULONG)Destination; 2132 if ((Length /= 4) != 0) { 2133 if (((ULONG64)Address & 4) != 0) { 2134 *Address = Pattern; 2135 if ((Length -= 1) == 0) { 2136 return; 2137 } 2138 Address += 1; 2139 } 2140 __stosq((PULONG64)(Address), Pattern | ((ULONG64)Pattern << 32), Length / 2); 2141 if ((Length & 1) != 0) Address[Length - 1] = Pattern; 2142 } 2143 return; 2144 } 2145 2146 #define RtlFillMemoryUlonglong(Destination, Length, Pattern) \ 2147 __stosq((PULONG64)(Destination), Pattern, (Length) / 8) 2148 2149 #else 2150 2151 NTSYSAPI 2152 VOID 2153 NTAPI 2154 RtlFillMemoryUlong( 2155 _Out_writes_bytes_all_(Length) PVOID Destination, 2156 _In_ SIZE_T Length, 2157 _In_ ULONG Pattern 2158 ); 2159 2160 NTSYSAPI 2161 VOID 2162 NTAPI 2163 RtlFillMemoryUlonglong( 2164 _Out_ PVOID Destination, 2165 _In_ SIZE_T Length, 2166 _In_ ULONGLONG Pattern 2167 ); 2168 2169 #endif 2170 2171 NTSYSAPI 2172 NTSTATUS 2173 NTAPI 2174 RtlCopyMappedMemory( 2175 _Out_writes_bytes_all_(Size) PVOID Destination, 2176 _In_reads_bytes_(Size) const VOID *Source, 2177 _In_ SIZE_T Size 2178 ); 2179 2180 NTSYSAPI 2181 SIZE_T 2182 NTAPI 2183 RtlCompareMemoryUlong( 2184 _In_ PVOID Source, 2185 _In_ SIZE_T Length, 2186 _In_ ULONG Pattern 2187 ); 2188 2189 #ifndef RtlEqualMemory 2190 #define RtlEqualMemory(Destination, Source, Length) \ 2191 (!memcmp(Destination, Source, Length)) 2192 #endif 2193 2194 #define RtlCopyBytes RtlCopyMemory 2195 #define RtlFillBytes RtlFillMemory 2196 #define RtlZeroBytes RtlZeroMemory 2197 2198 #endif 2199 2200 NTSYSAPI 2201 BOOLEAN 2202 NTAPI 2203 RtlEqualUnicodeString( 2204 PCUNICODE_STRING String1, 2205 PCUNICODE_STRING String2, 2206 BOOLEAN CaseInsensitive 2207 ); 2208 2209 _IRQL_requires_max_(PASSIVE_LEVEL) 2210 NTSYSAPI 2211 VOID 2212 NTAPI 2213 RtlFreeUnicodeString( 2214 _Inout_ _At_(UnicodeString->Buffer, __drv_freesMem(Mem)) 2215 PUNICODE_STRING UnicodeString 2216 ); 2217 2218 NTSYSAPI 2219 VOID 2220 NTAPI 2221 RtlEraseUnicodeString( 2222 _Inout_ PUNICODE_STRING String 2223 ); 2224 2225 NTSYSAPI 2226 NTSTATUS 2227 NTAPI 2228 RtlHashUnicodeString( 2229 _In_ CONST UNICODE_STRING *String, 2230 _In_ BOOLEAN CaseInSensitive, 2231 _In_ ULONG HashAlgorithm, 2232 _Out_ PULONG HashValue 2233 ); 2234 2235 _IRQL_requires_max_(DISPATCH_LEVEL) 2236 _At_(DestinationString->Buffer, _Post_equal_to_(SourceString)) 2237 _When_(SourceString != NULL, 2238 _At_(DestinationString->Length, _Post_equal_to_(_String_length_(SourceString))) 2239 _At_(DestinationString->MaximumLength, _Post_equal_to_(DestinationString->Length + sizeof(CHAR)))) 2240 _When_(SourceString == NULL, 2241 _At_(DestinationString->Length, _Post_equal_to_(0)) 2242 _At_(DestinationString->MaximumLength, _Post_equal_to_(0))) 2243 NTSYSAPI 2244 VOID 2245 NTAPI 2246 RtlInitString( 2247 _Out_ PSTRING DestinationString, 2248 _In_opt_z_ __drv_aliasesMem PCSTR SourceString 2249 ); 2250 2251 _IRQL_requires_max_(DISPATCH_LEVEL) 2252 _At_(DestinationString->Buffer, _Post_equal_to_(SourceString)) 2253 _When_(SourceString != NULL, 2254 _At_(DestinationString->Length, _Post_equal_to_(_String_length_(SourceString) * sizeof(WCHAR))) 2255 _At_(DestinationString->MaximumLength, _Post_equal_to_(DestinationString->Length + sizeof(WCHAR)))) 2256 _When_(SourceString == NULL, 2257 _At_(DestinationString->Length, _Post_equal_to_(0)) 2258 _At_(DestinationString->MaximumLength, _Post_equal_to_(0))) 2259 NTSYSAPI 2260 VOID 2261 NTAPI 2262 RtlInitUnicodeString( 2263 _Out_ PUNICODE_STRING DestinationString, 2264 _In_opt_z_ __drv_aliasesMem PCWSTR SourceString 2265 ); 2266 2267 _IRQL_requires_max_(DISPATCH_LEVEL) 2268 NTSYSAPI 2269 NTSTATUS 2270 NTAPI 2271 RtlInitUnicodeStringEx( 2272 _Out_ PUNICODE_STRING DestinationString, 2273 _In_opt_z_ __drv_aliasesMem PCWSTR SourceString 2274 ); 2275 2276 NTSYSAPI 2277 BOOLEAN 2278 NTAPI 2279 RtlIsTextUnicode( 2280 _In_ CONST VOID* Buffer, 2281 _In_ INT Size, 2282 _Inout_opt_ INT* Flags 2283 ); 2284 2285 _IRQL_requires_max_(PASSIVE_LEVEL) 2286 _Must_inspect_result_ 2287 NTSYSAPI 2288 BOOLEAN 2289 NTAPI 2290 RtlPrefixString( 2291 _In_ const STRING *String1, 2292 _In_ const STRING *String2, 2293 _In_ BOOLEAN CaseInsensitive 2294 ); 2295 2296 _IRQL_requires_max_(PASSIVE_LEVEL) 2297 _Must_inspect_result_ 2298 NTSYSAPI 2299 BOOLEAN 2300 NTAPI 2301 RtlPrefixUnicodeString( 2302 _In_ PCUNICODE_STRING String1, 2303 _In_ PCUNICODE_STRING String2, 2304 _In_ BOOLEAN CaseInsensitive 2305 ); 2306 2307 _IRQL_requires_max_(PASSIVE_LEVEL) 2308 NTSYSAPI 2309 VOID 2310 NTAPI 2311 RtlUpperString( 2312 _Inout_ PSTRING DestinationString, 2313 _In_ const STRING *SourceString 2314 ); 2315 2316 _IRQL_requires_max_(PASSIVE_LEVEL) 2317 _Must_inspect_result_ 2318 NTSYSAPI 2319 LONG 2320 NTAPI 2321 RtlCompareString( 2322 _In_ const STRING *String1, 2323 _In_ const STRING *String2, 2324 _In_ BOOLEAN CaseInSensitive 2325 ); 2326 2327 NTSYSAPI 2328 VOID 2329 NTAPI 2330 RtlCopyString( 2331 _Out_ PSTRING DestinationString, 2332 _In_opt_ const STRING *SourceString 2333 ); 2334 2335 _IRQL_requires_max_(PASSIVE_LEVEL) 2336 _Must_inspect_result_ 2337 NTSYSAPI 2338 BOOLEAN 2339 NTAPI 2340 RtlEqualString( 2341 _In_ const STRING *String1, 2342 _In_ const STRING *String2, 2343 _In_ BOOLEAN CaseInSensitive 2344 ); 2345 2346 _IRQL_requires_max_(APC_LEVEL) 2347 NTSYSAPI 2348 NTSTATUS 2349 NTAPI 2350 RtlAppendStringToString( 2351 _Inout_ PSTRING Destination, 2352 _In_ const STRING *Source 2353 ); 2354 2355 _IRQL_requires_max_(PASSIVE_LEVEL) 2356 _When_(AllocateDestinationString, _Must_inspect_result_) 2357 NTSYSAPI 2358 NTSTATUS 2359 NTAPI 2360 RtlUpcaseUnicodeString( 2361 _When_(AllocateDestinationString, _Out_ _At_(DestinationString->Buffer, __drv_allocatesMem(Mem))) 2362 _When_(!AllocateDestinationString, _Inout_) 2363 PUNICODE_STRING DestinationString, 2364 _In_ PCUNICODE_STRING SourceString, 2365 _In_ BOOLEAN AllocateDestinationString 2366 ); 2367 2368 _IRQL_requires_max_(PASSIVE_LEVEL) 2369 NTSYSAPI 2370 NTSTATUS 2371 NTAPI 2372 RtlUnicodeStringToInteger( 2373 _In_ PCUNICODE_STRING String, 2374 _In_opt_ ULONG Base, 2375 _Out_ PULONG Value 2376 ); 2377 2378 NTSYSAPI 2379 NTSTATUS 2380 NTAPI 2381 RtlValidateUnicodeString( 2382 _In_ ULONG Flags, 2383 _In_ PCUNICODE_STRING String 2384 ); 2385 2386 #define RTL_SKIP_BUFFER_COPY 0x00000001 2387 2388 NTSYSAPI 2389 NTSTATUS 2390 NTAPI 2391 RtlpEnsureBufferSize( 2392 _In_ ULONG Flags, 2393 _Inout_ PRTL_BUFFER Buffer, 2394 _In_ SIZE_T RequiredSize 2395 ); 2396 2397 #ifdef NTOS_MODE_USER 2398 2399 FORCEINLINE 2400 VOID 2401 RtlInitBuffer( 2402 _Inout_ PRTL_BUFFER Buffer, 2403 _In_ PUCHAR Data, 2404 _In_ ULONG DataSize 2405 ) 2406 { 2407 Buffer->Buffer = Buffer->StaticBuffer = Data; 2408 Buffer->Size = Buffer->StaticSize = DataSize; 2409 Buffer->ReservedForAllocatedSize = 0; 2410 Buffer->ReservedForIMalloc = NULL; 2411 } 2412 2413 FORCEINLINE 2414 NTSTATUS 2415 RtlEnsureBufferSize( 2416 _In_ ULONG Flags, 2417 _Inout_ PRTL_BUFFER Buffer, 2418 _In_ ULONG RequiredSize 2419 ) 2420 { 2421 if (Buffer && RequiredSize <= Buffer->Size) 2422 return STATUS_SUCCESS; 2423 return RtlpEnsureBufferSize(Flags, Buffer, RequiredSize); 2424 } 2425 2426 FORCEINLINE 2427 VOID 2428 RtlFreeBuffer( 2429 _Inout_ PRTL_BUFFER Buffer 2430 ) 2431 { 2432 if (Buffer->Buffer != Buffer->StaticBuffer && Buffer->Buffer) 2433 RtlFreeHeap(RtlGetProcessHeap(), 0, Buffer->Buffer); 2434 Buffer->Buffer = Buffer->StaticBuffer; 2435 Buffer->Size = Buffer->StaticSize; 2436 } 2437 2438 NTSYSAPI 2439 VOID 2440 NTAPI 2441 RtlRunEncodeUnicodeString( 2442 _Inout_ PUCHAR Hash, 2443 _Inout_ PUNICODE_STRING String 2444 ); 2445 2446 NTSYSAPI 2447 VOID 2448 NTAPI 2449 RtlRunDecodeUnicodeString( 2450 _In_ UCHAR Hash, 2451 _Inout_ PUNICODE_STRING String 2452 ); 2453 2454 #endif /* NTOS_MODE_USER */ 2455 2456 // 2457 // Ansi String Functions 2458 // 2459 _IRQL_requires_max_(PASSIVE_LEVEL) 2460 NTSYSAPI 2461 VOID 2462 NTAPI 2463 RtlFreeAnsiString( 2464 _Inout_ _At_(AnsiString->Buffer, __drv_freesMem(Mem)) 2465 PANSI_STRING AnsiString 2466 ); 2467 2468 _IRQL_requires_max_(DISPATCH_LEVEL) 2469 NTSYSAPI 2470 VOID 2471 NTAPI 2472 RtlInitAnsiString( 2473 _Out_ PANSI_STRING DestinationString, 2474 _In_opt_z_ __drv_aliasesMem PCSZ SourceString 2475 ); 2476 2477 _IRQL_requires_max_(DISPATCH_LEVEL) 2478 NTSYSAPI 2479 NTSTATUS 2480 NTAPI 2481 RtlInitAnsiStringEx( 2482 _Out_ PANSI_STRING DestinationString, 2483 _In_opt_z_ __drv_aliasesMem PCSZ SourceString 2484 ); 2485 2486 // 2487 // OEM String Functions 2488 // 2489 _IRQL_requires_max_(PASSIVE_LEVEL) 2490 NTSYSAPI 2491 VOID 2492 NTAPI 2493 RtlFreeOemString( 2494 _Inout_ _At_(OemString->Buffer, __drv_freesMem(Mem)) 2495 POEM_STRING OemString 2496 ); 2497 2498 // 2499 // MultiByte->Unicode String Functions 2500 // 2501 _IRQL_requires_max_(PASSIVE_LEVEL) 2502 NTSYSAPI 2503 NTSTATUS 2504 NTAPI 2505 RtlMultiByteToUnicodeN( 2506 _Out_writes_bytes_to_(MaxBytesInUnicodeString, *BytesInUnicodeString) PWCH UnicodeString, 2507 _In_ ULONG MaxBytesInUnicodeString, 2508 _Out_opt_ PULONG BytesInUnicodeString, 2509 _In_reads_bytes_(BytesInMultiByteString) const CHAR *MultiByteString, 2510 _In_ ULONG BytesInMultiByteString 2511 ); 2512 2513 _IRQL_requires_max_(PASSIVE_LEVEL) 2514 NTSYSAPI 2515 NTSTATUS 2516 NTAPI 2517 RtlMultiByteToUnicodeSize( 2518 _Out_ PULONG BytesInUnicodeString, 2519 _In_reads_bytes_(BytesInMultiByteString) const CHAR *MultiByteString, 2520 _In_ ULONG BytesInMultiByteString 2521 ); 2522 2523 // 2524 // Atom Functions 2525 // 2526 NTSYSAPI 2527 NTSTATUS 2528 NTAPI 2529 RtlAddAtomToAtomTable( 2530 _In_ PRTL_ATOM_TABLE AtomTable, 2531 _In_ PWSTR AtomName, 2532 _Out_ PRTL_ATOM Atom 2533 ); 2534 2535 NTSYSAPI 2536 NTSTATUS 2537 NTAPI 2538 RtlCreateAtomTable( 2539 _In_ ULONG TableSize, 2540 _Inout_ PRTL_ATOM_TABLE *AtomTable 2541 ); 2542 2543 NTSYSAPI 2544 NTSTATUS 2545 NTAPI 2546 RtlDeleteAtomFromAtomTable( 2547 _In_ PRTL_ATOM_TABLE AtomTable, 2548 _In_ RTL_ATOM Atom 2549 ); 2550 2551 NTSYSAPI 2552 NTSTATUS 2553 NTAPI 2554 RtlDestroyAtomTable(IN PRTL_ATOM_TABLE AtomTable); 2555 2556 NTSYSAPI 2557 NTSTATUS 2558 NTAPI 2559 RtlQueryAtomInAtomTable( 2560 _In_ PRTL_ATOM_TABLE AtomTable, 2561 _In_ RTL_ATOM Atom, 2562 _Out_opt_ PULONG RefCount, 2563 _Out_opt_ PULONG PinCount, 2564 _Out_opt_z_bytecap_(*NameLength) PWSTR AtomName, 2565 _Inout_opt_ PULONG NameLength 2566 ); 2567 2568 NTSYSAPI 2569 NTSTATUS 2570 NTAPI 2571 RtlPinAtomInAtomTable( 2572 _In_ PRTL_ATOM_TABLE AtomTable, 2573 _In_ RTL_ATOM Atom 2574 ); 2575 2576 NTSYSAPI 2577 NTSTATUS 2578 NTAPI 2579 RtlLookupAtomInAtomTable( 2580 _In_ PRTL_ATOM_TABLE AtomTable, 2581 _In_ PWSTR AtomName, 2582 _Out_ PRTL_ATOM Atom 2583 ); 2584 2585 // 2586 // Process Management Functions 2587 // 2588 NTSYSAPI 2589 PPEB 2590 NTAPI 2591 RtlGetCurrentPeb( 2592 VOID 2593 ); 2594 2595 NTSYSAPI 2596 VOID 2597 NTAPI 2598 RtlAcquirePebLock(VOID); 2599 2600 NTSYSAPI 2601 NTSTATUS 2602 NTAPI 2603 RtlCreateProcessParameters ( 2604 _Out_ PRTL_USER_PROCESS_PARAMETERS *ProcessParameters, 2605 _In_ PUNICODE_STRING ImagePathName, 2606 _In_opt_ PUNICODE_STRING DllPath, 2607 _In_opt_ PUNICODE_STRING CurrentDirectory, 2608 _In_opt_ PUNICODE_STRING CommandLine, 2609 _In_opt_ PWSTR Environment, 2610 _In_opt_ PUNICODE_STRING WindowTitle, 2611 _In_opt_ PUNICODE_STRING DesktopInfo, 2612 _In_opt_ PUNICODE_STRING ShellInfo, 2613 _In_opt_ PUNICODE_STRING RuntimeInfo 2614 ); 2615 2616 NTSYSAPI 2617 NTSTATUS 2618 NTAPI 2619 RtlCreateUserProcess( 2620 _In_ PUNICODE_STRING ImageFileName, 2621 _In_ ULONG Attributes, 2622 _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters, 2623 _In_opt_ PSECURITY_DESCRIPTOR ProcessSecutityDescriptor, 2624 _In_opt_ PSECURITY_DESCRIPTOR ThreadSecurityDescriptor, 2625 _In_opt_ HANDLE ParentProcess, 2626 _In_ BOOLEAN CurrentDirectory, 2627 _In_opt_ HANDLE DebugPort, 2628 _In_opt_ HANDLE ExceptionPort, 2629 _Out_ PRTL_USER_PROCESS_INFORMATION ProcessInfo 2630 ); 2631 2632 #if (NTDDI_VERSION >= NTDDI_WIN7) 2633 NTSYSAPI 2634 NTSTATUS 2635 NTAPI 2636 RtlCreateUserThread( 2637 _In_ PVOID ThreadContext, 2638 _Out_ HANDLE *OutThreadHandle, 2639 _Reserved_ PVOID Reserved1, 2640 _Reserved_ PVOID Reserved2, 2641 _Reserved_ PVOID Reserved3, 2642 _Reserved_ PVOID Reserved4, 2643 _Reserved_ PVOID Reserved5, 2644 _Reserved_ PVOID Reserved6, 2645 _Reserved_ PVOID Reserved7, 2646 _Reserved_ PVOID Reserved8 2647 ); 2648 #else 2649 NTSYSAPI 2650 NTSTATUS 2651 NTAPI 2652 RtlCreateUserThread( 2653 _In_ HANDLE ProcessHandle, 2654 _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor, 2655 _In_ BOOLEAN CreateSuspended, 2656 _In_ ULONG StackZeroBits, 2657 _In_ SIZE_T StackReserve, 2658 _In_ SIZE_T StackCommit, 2659 _In_ PTHREAD_START_ROUTINE StartAddress, 2660 _In_ PVOID Parameter, 2661 _Out_opt_ PHANDLE ThreadHandle, 2662 _Out_opt_ PCLIENT_ID ClientId 2663 ); 2664 #endif 2665 2666 NTSYSAPI 2667 PRTL_USER_PROCESS_PARAMETERS 2668 NTAPI 2669 RtlDeNormalizeProcessParams( 2670 _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters); 2671 2672 NTSYSAPI 2673 NTSTATUS 2674 NTAPI 2675 RtlDestroyProcessParameters( 2676 _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters); 2677 2678 NTSYSAPI 2679 VOID 2680 NTAPI 2681 RtlExitUserThread( 2682 _In_ NTSTATUS Status); 2683 2684 NTSYSAPI 2685 VOID 2686 NTAPI 2687 RtlInitializeContext( 2688 _In_ HANDLE ProcessHandle, 2689 _Out_ PCONTEXT ThreadContext, 2690 _In_opt_ PVOID ThreadStartParam, 2691 _In_ PTHREAD_START_ROUTINE ThreadStartAddress, 2692 _In_ PINITIAL_TEB InitialTeb 2693 ); 2694 2695 #ifdef _M_AMD64 2696 typedef struct _WOW64_CONTEXT *PWOW64_CONTEXT; 2697 2698 NTSYSAPI 2699 NTSTATUS 2700 NTAPI 2701 RtlWow64GetThreadContext( 2702 _In_ HANDLE ThreadHandle, 2703 _Inout_ PWOW64_CONTEXT ThreadContext 2704 ); 2705 2706 2707 NTSYSAPI 2708 NTSTATUS 2709 NTAPI 2710 RtlWow64SetThreadContext( 2711 _In_ HANDLE ThreadHandle, 2712 _In_ PWOW64_CONTEXT ThreadContext 2713 ); 2714 #endif 2715 2716 NTSYSAPI 2717 BOOLEAN 2718 NTAPI 2719 RtlIsThreadWithinLoaderCallout(VOID); 2720 2721 NTSYSAPI 2722 PRTL_USER_PROCESS_PARAMETERS 2723 NTAPI 2724 RtlNormalizeProcessParams( 2725 _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters); 2726 2727 NTSYSAPI 2728 VOID 2729 NTAPI 2730 RtlReleasePebLock(VOID); 2731 2732 NTSYSAPI 2733 NTSTATUS 2734 NTAPI 2735 RtlRemoteCall( 2736 _In_ HANDLE Process, 2737 _In_ HANDLE Thread, 2738 _In_ PVOID CallSite, 2739 _In_ ULONG ArgumentCount, 2740 _In_ PULONG Arguments, 2741 _In_ BOOLEAN PassContext, 2742 _In_ BOOLEAN AlreadySuspended 2743 ); 2744 2745 NTSYSAPI 2746 NTSTATUS 2747 __cdecl 2748 RtlSetProcessIsCritical( 2749 _In_ BOOLEAN NewValue, 2750 _Out_opt_ PBOOLEAN OldValue, 2751 _In_ BOOLEAN NeedBreaks 2752 ); 2753 2754 NTSYSAPI 2755 NTSTATUS 2756 __cdecl 2757 RtlSetThreadIsCritical( 2758 _In_ BOOLEAN NewValue, 2759 _Out_opt_ PBOOLEAN OldValue, 2760 _In_ BOOLEAN NeedBreaks 2761 ); 2762 2763 NTSYSAPI 2764 ULONG 2765 NTAPI 2766 RtlGetCurrentProcessorNumber( 2767 VOID 2768 ); 2769 2770 2771 // 2772 // Thread Pool Functions 2773 // 2774 // 2775 NTSTATUS 2776 NTAPI 2777 RtlSetThreadPoolStartFunc( 2778 _In_ PRTL_START_POOL_THREAD StartPoolThread, 2779 _In_ PRTL_EXIT_POOL_THREAD ExitPoolThread 2780 ); 2781 2782 NTSYSAPI 2783 NTSTATUS 2784 NTAPI 2785 RtlDeregisterWaitEx( 2786 _In_ HANDLE hWaitHandle, 2787 _In_opt_ HANDLE hCompletionEvent 2788 ); 2789 2790 NTSYSAPI 2791 NTSTATUS 2792 NTAPI 2793 RtlDeregisterWait( 2794 _In_ HANDLE hWaitHandle 2795 ); 2796 2797 NTSYSAPI 2798 NTSTATUS 2799 NTAPI 2800 RtlQueueWorkItem( 2801 _In_ WORKERCALLBACKFUNC Function, 2802 _In_opt_ PVOID Context, 2803 _In_ ULONG Flags 2804 ); 2805 2806 NTSYSAPI 2807 NTSTATUS 2808 NTAPI 2809 RtlSetIoCompletionCallback( 2810 _In_ HANDLE FileHandle, 2811 _In_ PIO_APC_ROUTINE Callback, 2812 _In_ ULONG Flags 2813 ); 2814 2815 NTSYSAPI 2816 NTSTATUS 2817 NTAPI 2818 RtlRegisterWait( 2819 _In_ PHANDLE phNewWaitObject, 2820 _In_ HANDLE hObject, 2821 _In_ WAITORTIMERCALLBACKFUNC Callback, 2822 _In_ PVOID pvContext, 2823 _In_ ULONG ulMilliseconds, 2824 _In_ ULONG ulFlags 2825 ); 2826 2827 // 2828 // Environment/Path Functions 2829 // 2830 NTSYSAPI 2831 NTSTATUS 2832 NTAPI 2833 RtlCreateEnvironment( 2834 _In_ BOOLEAN Inherit, 2835 _Out_ PWSTR *Environment 2836 ); 2837 2838 NTSYSAPI 2839 NTSTATUS 2840 NTAPI 2841 RtlComputePrivatizedDllName_U( 2842 _In_ PUNICODE_STRING DllName, 2843 _Inout_ PUNICODE_STRING RealName, 2844 _Inout_ PUNICODE_STRING LocalName 2845 ); 2846 2847 NTSYSAPI 2848 VOID 2849 NTAPI 2850 RtlDestroyEnvironment( 2851 _In_ PWSTR Environment 2852 ); 2853 2854 NTSYSAPI 2855 BOOLEAN 2856 NTAPI 2857 RtlDoesFileExists_U( 2858 _In_ PCWSTR FileName 2859 ); 2860 2861 NTSYSAPI 2862 RTL_PATH_TYPE 2863 NTAPI 2864 RtlDetermineDosPathNameType_U( 2865 _In_ PCWSTR Path 2866 ); 2867 2868 NTSYSAPI 2869 ULONG 2870 NTAPI 2871 RtlDosSearchPath_U( 2872 _In_ PCWSTR Path, 2873 _In_ PCWSTR FileName, 2874 _In_ PCWSTR Extension, 2875 _In_ ULONG BufferSize, 2876 _Out_ PWSTR Buffer, 2877 _Out_ PWSTR *PartName 2878 ); 2879 2880 NTSYSAPI 2881 NTSTATUS 2882 NTAPI 2883 RtlDosSearchPath_Ustr( 2884 _In_ ULONG Flags, 2885 _In_ PUNICODE_STRING PathString, 2886 _In_ PUNICODE_STRING FileNameString, 2887 _In_ PUNICODE_STRING ExtensionString, 2888 _In_ PUNICODE_STRING CallerBuffer, 2889 _Inout_opt_ PUNICODE_STRING DynamicString, 2890 _Out_opt_ PUNICODE_STRING* FullNameOut, 2891 _Out_opt_ PSIZE_T FilePartSize, 2892 _Out_opt_ PSIZE_T LengthNeeded 2893 ); 2894 2895 NTSYSAPI 2896 BOOLEAN 2897 NTAPI 2898 RtlDosPathNameToNtPathName_U( 2899 _In_opt_z_ PCWSTR DosPathName, 2900 _Out_ PUNICODE_STRING NtPathName, 2901 _Out_opt_ PCWSTR *NtFileNamePart, 2902 _Out_opt_ PRTL_RELATIVE_NAME_U DirectoryInfo 2903 ); 2904 2905 2906 #define RTL_UNCHANGED_UNK_PATH 1 2907 #define RTL_CONVERTED_UNC_PATH 2 2908 #define RTL_CONVERTED_NT_PATH 3 2909 #define RTL_UNCHANGED_DOS_PATH 4 2910 2911 NTSYSAPI 2912 NTSTATUS 2913 NTAPI 2914 RtlNtPathNameToDosPathName( 2915 _In_ ULONG Flags, 2916 _Inout_ PRTL_UNICODE_STRING_BUFFER Path, 2917 _Out_opt_ PULONG PathType, 2918 _Out_opt_ PULONG Unknown 2919 ); 2920 2921 2922 NTSYSAPI 2923 BOOLEAN 2924 NTAPI 2925 RtlDosPathNameToRelativeNtPathName_U( 2926 _In_ PCWSTR DosName, 2927 _Out_ PUNICODE_STRING NtName, 2928 _Out_ PCWSTR *PartName, 2929 _Out_ PRTL_RELATIVE_NAME_U RelativeName 2930 ); 2931 2932 _At_(Destination->Buffer, _Out_bytecap_(Destination->MaximumLength)) 2933 NTSYSAPI 2934 NTSTATUS 2935 NTAPI 2936 RtlExpandEnvironmentStrings_U( 2937 _In_z_ PWSTR Environment, 2938 _In_ PUNICODE_STRING Source, 2939 _Inout_ PUNICODE_STRING Destination, 2940 _Out_ PULONG Length 2941 ); 2942 2943 NTSYSAPI 2944 ULONG 2945 NTAPI 2946 RtlGetCurrentDirectory_U( 2947 _In_ ULONG MaximumLength, 2948 _Out_bytecap_(MaximumLength) PWSTR Buffer 2949 ); 2950 2951 NTSYSAPI 2952 ULONG 2953 NTAPI 2954 RtlGetFullPathName_U( 2955 _In_ PCWSTR FileName, 2956 _In_ ULONG Size, 2957 _Out_z_bytecap_(Size) PWSTR Buffer, 2958 _Out_opt_ PWSTR *ShortName 2959 ); 2960 2961 #if (NTDDI_VERSION >= NTDDI_WIN7) 2962 NTSYSAPI 2963 NTSTATUS 2964 NTAPI 2965 RtlGetFullPathName_UEx( 2966 _In_ PWSTR FileName, 2967 _In_ ULONG BufferLength, 2968 _Out_ PWSTR Buffer, 2969 _Out_opt_ PWSTR *FilePart, 2970 _Out_opt_ RTL_PATH_TYPE *InputPathType 2971 ); 2972 #endif 2973 2974 NTSTATUS 2975 NTAPI 2976 RtlGetFullPathName_UstrEx( 2977 _In_ PUNICODE_STRING FileName, 2978 _In_opt_ PUNICODE_STRING StaticString, 2979 _In_opt_ PUNICODE_STRING DynamicString, 2980 _Out_opt_ PUNICODE_STRING *StringUsed, 2981 _Out_opt_ PSIZE_T FilePartSize, 2982 _Out_opt_ PBOOLEAN NameInvalid, 2983 _Out_ RTL_PATH_TYPE* PathType, 2984 _Out_opt_ PSIZE_T LengthNeeded 2985 ); 2986 2987 NTSYSAPI 2988 NTSTATUS 2989 NTAPI 2990 RtlGetLengthWithoutTrailingPathSeperators( 2991 _Reserved_ ULONG Flags, 2992 _In_ PCUNICODE_STRING PathString, 2993 _Out_ PULONG Length 2994 ); 2995 2996 NTSYSAPI 2997 ULONG 2998 NTAPI 2999 RtlGetLongestNtPathLength( 3000 VOID 3001 ); 3002 3003 NTSYSAPI 3004 ULONG 3005 NTAPI 3006 RtlIsDosDeviceName_U( 3007 _In_ PCWSTR Name 3008 ); 3009 3010 NTSYSAPI 3011 ULONG 3012 NTAPI 3013 RtlIsDosDeviceName_Ustr( 3014 _In_ PCUNICODE_STRING Name 3015 ); 3016 3017 _IRQL_requires_max_(PASSIVE_LEVEL) 3018 _Must_inspect_result_ 3019 NTSYSAPI 3020 BOOLEAN 3021 NTAPI 3022 RtlIsNameLegalDOS8Dot3( 3023 _In_ PCUNICODE_STRING Name, 3024 _Inout_opt_ POEM_STRING OemName, 3025 _Out_opt_ PBOOLEAN NameContainsSpaces 3026 ); 3027 3028 NTSYSAPI 3029 NTSTATUS 3030 NTAPI 3031 RtlQueryEnvironmentVariable_U( 3032 _In_opt_ PWSTR Environment, 3033 _In_ PCUNICODE_STRING Name, 3034 _Out_ PUNICODE_STRING Value 3035 ); 3036 3037 VOID 3038 NTAPI 3039 RtlReleaseRelativeName( 3040 _In_ PRTL_RELATIVE_NAME_U RelativeName 3041 ); 3042 3043 NTSYSAPI 3044 NTSTATUS 3045 NTAPI 3046 RtlSetCurrentDirectory_U( 3047 _In_ PUNICODE_STRING name 3048 ); 3049 3050 NTSYSAPI 3051 NTSTATUS 3052 NTAPI 3053 RtlSetEnvironmentVariable( 3054 _In_z_ PWSTR *Environment, 3055 _In_ PUNICODE_STRING Name, 3056 _In_ PUNICODE_STRING Value 3057 ); 3058 3059 // 3060 // Critical Section/Resource Functions 3061 // 3062 NTSYSAPI 3063 NTSTATUS 3064 NTAPI 3065 RtlDeleteCriticalSection ( 3066 _In_ PRTL_CRITICAL_SECTION CriticalSection 3067 ); 3068 3069 NTSYSAPI 3070 NTSTATUS 3071 NTAPI 3072 RtlEnterCriticalSection( 3073 _In_ PRTL_CRITICAL_SECTION CriticalSection 3074 ); 3075 3076 NTSYSAPI 3077 NTSTATUS 3078 NTAPI 3079 RtlInitializeCriticalSection( 3080 _In_ PRTL_CRITICAL_SECTION CriticalSection 3081 ); 3082 3083 NTSYSAPI 3084 NTSTATUS 3085 NTAPI 3086 RtlInitializeCriticalSectionAndSpinCount( 3087 _In_ PRTL_CRITICAL_SECTION CriticalSection, 3088 _In_ ULONG SpinCount 3089 ); 3090 3091 NTSYSAPI 3092 ULONG 3093 NTAPI 3094 RtlIsCriticalSectionLocked( 3095 _In_ PRTL_CRITICAL_SECTION CriticalSection 3096 ); 3097 3098 NTSYSAPI 3099 ULONG 3100 NTAPI 3101 RtlIsCriticalSectionLockedByThread( 3102 _In_ PRTL_CRITICAL_SECTION CriticalSection 3103 ); 3104 3105 NTSYSAPI 3106 NTSTATUS 3107 NTAPI 3108 RtlLeaveCriticalSection( 3109 _In_ PRTL_CRITICAL_SECTION CriticalSection 3110 ); 3111 3112 NTSYSAPI 3113 BOOLEAN 3114 NTAPI 3115 RtlTryEnterCriticalSection( 3116 _In_ PRTL_CRITICAL_SECTION CriticalSection 3117 ); 3118 3119 NTSYSAPI 3120 VOID 3121 NTAPI 3122 RtlpUnWaitCriticalSection( 3123 _In_ PRTL_CRITICAL_SECTION CriticalSection 3124 ); 3125 3126 NTSYSAPI 3127 NTSTATUS 3128 NTAPI 3129 RtlpWaitForCriticalSection( 3130 _In_ PRTL_CRITICAL_SECTION CriticalSection 3131 ); 3132 3133 NTSYSAPI 3134 BOOLEAN 3135 NTAPI 3136 RtlAcquireResourceExclusive( 3137 _In_ PRTL_RESOURCE Resource, 3138 _In_ BOOLEAN Wait 3139 ); 3140 3141 NTSYSAPI 3142 BOOLEAN 3143 NTAPI 3144 RtlAcquireResourceShared( 3145 _In_ PRTL_RESOURCE Resource, 3146 _In_ BOOLEAN Wait 3147 ); 3148 3149 NTSYSAPI 3150 VOID 3151 NTAPI 3152 RtlConvertExclusiveToShared( 3153 _In_ PRTL_RESOURCE Resource 3154 ); 3155 3156 NTSYSAPI 3157 VOID 3158 NTAPI 3159 RtlConvertSharedToExclusive( 3160 _In_ PRTL_RESOURCE Resource 3161 ); 3162 3163 NTSYSAPI 3164 VOID 3165 NTAPI 3166 RtlDeleteResource( 3167 _In_ PRTL_RESOURCE Resource 3168 ); 3169 3170 NTSYSAPI 3171 VOID 3172 NTAPI 3173 RtlDumpResource( 3174 _In_ PRTL_RESOURCE Resource 3175 ); 3176 3177 NTSYSAPI 3178 VOID 3179 NTAPI 3180 RtlInitializeResource( 3181 _In_ PRTL_RESOURCE Resource 3182 ); 3183 3184 NTSYSAPI 3185 VOID 3186 NTAPI 3187 RtlReleaseResource( 3188 _In_ PRTL_RESOURCE Resource 3189 ); 3190 3191 // 3192 // Compression Functions 3193 // 3194 NTSYSAPI //NT_RTL_COMPRESS_API 3195 NTSTATUS 3196 NTAPI 3197 RtlCompressBuffer( 3198 _In_ USHORT CompressionFormatAndEngine, 3199 _In_reads_bytes_(UncompressedBufferSize) PUCHAR UncompressedBuffer, 3200 _In_ ULONG UncompressedBufferSize, 3201 _Out_writes_bytes_to_(CompressedBufferSize, *FinalCompressedSize) PUCHAR CompressedBuffer, 3202 _In_ ULONG CompressedBufferSize, 3203 _In_ ULONG UncompressedChunkSize, 3204 _Out_ PULONG FinalCompressedSize, 3205 _In_ PVOID WorkSpace 3206 ); 3207 3208 _IRQL_requires_max_(APC_LEVEL) 3209 NTSYSAPI //NT_RTL_COMPRESS_API 3210 NTSTATUS 3211 NTAPI 3212 RtlDecompressBuffer( 3213 _In_ USHORT CompressionFormat, 3214 _Out_writes_bytes_to_(UncompressedBufferSize, *FinalUncompressedSize) PUCHAR UncompressedBuffer, 3215 _In_ ULONG UncompressedBufferSize, 3216 _In_reads_bytes_(CompressedBufferSize) PUCHAR CompressedBuffer, 3217 _In_ ULONG CompressedBufferSize, 3218 _Out_ PULONG FinalUncompressedSize 3219 ); 3220 3221 NTSYSAPI 3222 NTSTATUS 3223 NTAPI 3224 RtlGetCompressionWorkSpaceSize( 3225 _In_ USHORT CompressionFormatAndEngine, 3226 _Out_ PULONG CompressBufferWorkSpaceSize, 3227 _Out_ PULONG CompressFragmentWorkSpaceSize 3228 ); 3229 3230 // 3231 // Frame Functions 3232 // 3233 NTSYSAPI 3234 VOID 3235 NTAPI 3236 RtlPopFrame( 3237 _In_ PTEB_ACTIVE_FRAME Frame 3238 ); 3239 3240 NTSYSAPI 3241 VOID 3242 NTAPI 3243 RtlPushFrame( 3244 _In_ PTEB_ACTIVE_FRAME Frame 3245 ); 3246 3247 NTSYSAPI 3248 PTEB_ACTIVE_FRAME 3249 NTAPI 3250 RtlGetFrame( 3251 VOID 3252 ); 3253 3254 // 3255 // Debug Info Functions 3256 // 3257 NTSYSAPI 3258 PRTL_DEBUG_INFORMATION 3259 NTAPI 3260 RtlCreateQueryDebugBuffer( 3261 _In_ ULONG Size, 3262 _In_ BOOLEAN EventPair 3263 ); 3264 3265 NTSYSAPI 3266 NTSTATUS 3267 NTAPI 3268 RtlDestroyQueryDebugBuffer(IN PRTL_DEBUG_INFORMATION DebugBuffer); 3269 3270 NTSYSAPI 3271 NTSTATUS 3272 NTAPI 3273 RtlQueryProcessDebugInformation( 3274 _In_ ULONG ProcessId, 3275 _In_ ULONG DebugInfoClassMask, 3276 _Inout_ PRTL_DEBUG_INFORMATION DebugBuffer 3277 ); 3278 3279 // 3280 // Bitmap Functions 3281 // 3282 #ifdef NTOS_MODE_USER 3283 3284 NTSYSAPI 3285 BOOLEAN 3286 NTAPI 3287 RtlAreBitsClear( 3288 _In_ PRTL_BITMAP BitMapHeader, 3289 _In_ ULONG StartingIndex, 3290 _In_ ULONG Length 3291 ); 3292 3293 NTSYSAPI 3294 BOOLEAN 3295 NTAPI 3296 RtlAreBitsSet( 3297 _In_ PRTL_BITMAP BitMapHeader, 3298 _In_ ULONG StartingIndex, 3299 _In_ ULONG Length 3300 ); 3301 3302 NTSYSAPI 3303 VOID 3304 NTAPI 3305 RtlClearAllBits( 3306 _In_ PRTL_BITMAP BitMapHeader 3307 ); 3308 3309 NTSYSAPI 3310 VOID 3311 NTAPI 3312 RtlClearBit( 3313 _In_ PRTL_BITMAP BitMapHeader, 3314 _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitNumber 3315 ); 3316 3317 NTSYSAPI 3318 VOID 3319 NTAPI 3320 RtlClearBits( 3321 _In_ PRTL_BITMAP BitMapHeader, 3322 _In_range_(0, BitMapHeader->SizeOfBitMap - NumberToClear) ULONG StartingIndex, 3323 _In_range_(0, BitMapHeader->SizeOfBitMap - StartingIndex) ULONG NumberToClear 3324 ); 3325 3326 NTSYSAPI 3327 ULONG 3328 NTAPI 3329 RtlFindClearBits( 3330 _In_ PRTL_BITMAP BitMapHeader, 3331 _In_ ULONG NumberToFind, 3332 _In_ ULONG HintIndex 3333 ); 3334 3335 NTSYSAPI 3336 ULONG 3337 NTAPI 3338 RtlFindClearBitsAndSet( 3339 _In_ PRTL_BITMAP BitMapHeader, 3340 _In_ ULONG NumberToFind, 3341 _In_ ULONG HintIndex 3342 ); 3343 3344 NTSYSAPI 3345 ULONG 3346 NTAPI 3347 RtlFindFirstRunClear( 3348 _In_ PRTL_BITMAP BitMapHeader, 3349 _Out_ PULONG StartingIndex 3350 ); 3351 3352 NTSYSAPI 3353 ULONG 3354 NTAPI 3355 RtlFindClearRuns( 3356 _In_ PRTL_BITMAP BitMapHeader, 3357 _Out_writes_to_(SizeOfRunArray, return) PRTL_BITMAP_RUN RunArray, 3358 _In_range_(>, 0) ULONG SizeOfRunArray, 3359 _In_ BOOLEAN LocateLongestRuns 3360 ); 3361 3362 NTSYSAPI 3363 ULONG 3364 NTAPI 3365 RtlFindLastBackwardRunClear( 3366 _In_ PRTL_BITMAP BitMapHeader, 3367 _In_ ULONG FromIndex, 3368 _Out_ PULONG StartingRunIndex 3369 ); 3370 3371 NTSYSAPI 3372 CCHAR 3373 NTAPI 3374 RtlFindLeastSignificantBit( 3375 _In_ ULONGLONG Value 3376 ); 3377 3378 NTSYSAPI 3379 ULONG 3380 NTAPI 3381 RtlFindLongestRunClear( 3382 _In_ PRTL_BITMAP BitMapHeader, 3383 _Out_ PULONG StartingIndex 3384 ); 3385 3386 NTSYSAPI 3387 CCHAR 3388 NTAPI 3389 RtlFindMostSignificantBit( 3390 _In_ ULONGLONG Value 3391 ); 3392 3393 NTSYSAPI 3394 ULONG 3395 NTAPI 3396 RtlFindNextForwardRunClear( 3397 _In_ PRTL_BITMAP BitMapHeader, 3398 _In_ ULONG FromIndex, 3399 _Out_ PULONG StartingRunIndex 3400 ); 3401 3402 NTSYSAPI 3403 ULONG 3404 NTAPI 3405 RtlFindNextForwardRunSet( 3406 _In_ PRTL_BITMAP BitMapHeader, 3407 _In_ ULONG FromIndex, 3408 _Out_ PULONG StartingRunIndex 3409 ); 3410 3411 NTSYSAPI 3412 ULONG 3413 NTAPI 3414 RtlFindSetBits( 3415 _In_ PRTL_BITMAP BitMapHeader, 3416 _In_ ULONG NumberToFind, 3417 _In_ ULONG HintIndex 3418 ); 3419 3420 NTSYSAPI 3421 ULONG 3422 NTAPI 3423 RtlFindSetBitsAndClear( 3424 _In_ PRTL_BITMAP BitMapHeader, 3425 _In_ ULONG NumberToFind, 3426 _In_ ULONG HintIndex 3427 ); 3428 3429 #ifdef __REACTOS__ // ReactOS improvement 3430 _At_(BitMapHeader->SizeOfBitMap, _Post_equal_to_(SizeOfBitMap)) 3431 _At_(BitMapHeader->Buffer, _Post_equal_to_(BitMapBuffer)) 3432 #endif 3433 NTSYSAPI 3434 VOID 3435 NTAPI 3436 RtlInitializeBitMap( 3437 _Out_ PRTL_BITMAP BitMapHeader, 3438 _In_opt_ __drv_aliasesMem PULONG BitMapBuffer, 3439 _In_opt_ ULONG SizeOfBitMap 3440 ); 3441 3442 NTSYSAPI 3443 ULONG 3444 NTAPI 3445 RtlNumberOfClearBits( 3446 _In_ PRTL_BITMAP BitMapHeader 3447 ); 3448 3449 NTSYSAPI 3450 ULONG 3451 NTAPI 3452 RtlNumberOfSetBits( 3453 _In_ PRTL_BITMAP BitMapHeader 3454 ); 3455 3456 NTSYSAPI 3457 VOID 3458 NTAPI 3459 RtlSetBit( 3460 _In_ PRTL_BITMAP BitMapHeader, 3461 _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitNumber 3462 ); 3463 3464 NTSYSAPI 3465 VOID 3466 NTAPI 3467 RtlSetBits( 3468 _In_ PRTL_BITMAP BitMapHeader, 3469 _In_range_(0, BitMapHeader->SizeOfBitMap - NumberToSet) ULONG StartingIndex, 3470 _In_range_(0, BitMapHeader->SizeOfBitMap - StartingIndex) ULONG NumberToSet 3471 ); 3472 3473 NTSYSAPI 3474 VOID 3475 NTAPI 3476 RtlSetAllBits( 3477 _In_ PRTL_BITMAP BitMapHeader 3478 ); 3479 3480 _Must_inspect_result_ 3481 NTSYSAPI 3482 BOOLEAN 3483 NTAPI 3484 RtlTestBit( 3485 _In_ PRTL_BITMAP BitMapHeader, 3486 _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitNumber 3487 ); 3488 3489 #if defined(_M_AMD64) 3490 _Must_inspect_result_ 3491 FORCEINLINE 3492 BOOLEAN 3493 RtlCheckBit( 3494 _In_ PRTL_BITMAP BitMapHeader, 3495 _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitPosition) 3496 { 3497 return BitTest64((LONG64 CONST*)BitMapHeader->Buffer, (LONG64)BitPosition); 3498 } 3499 #else 3500 #define RtlCheckBit(BMH,BP) (((((PLONG)(BMH)->Buffer)[(BP)/32]) >> ((BP)%32)) & 0x1) 3501 #endif /* defined(_M_AMD64) */ 3502 3503 #endif // NTOS_MODE_USER 3504 3505 3506 // 3507 // Timer Functions 3508 // 3509 NTSYSAPI 3510 NTSTATUS 3511 NTAPI 3512 RtlCreateTimer( 3513 _In_ HANDLE TimerQueue, 3514 _In_ PHANDLE phNewTimer, 3515 _In_ WAITORTIMERCALLBACKFUNC Callback, 3516 _In_ PVOID Parameter, 3517 _In_ ULONG DueTime, 3518 _In_ ULONG Period, 3519 _In_ ULONG Flags 3520 ); 3521 3522 NTSYSAPI 3523 NTSTATUS 3524 NTAPI 3525 RtlCreateTimerQueue(PHANDLE TimerQueue); 3526 3527 NTSYSAPI 3528 NTSTATUS 3529 NTAPI 3530 RtlDeleteTimer( 3531 _In_ HANDLE TimerQueue, 3532 _In_ HANDLE Timer, 3533 _In_ HANDLE CompletionEvent 3534 ); 3535 3536 NTSYSAPI 3537 NTSTATUS 3538 NTAPI 3539 RtlUpdateTimer( 3540 _In_ HANDLE TimerQueue, 3541 _In_ HANDLE Timer, 3542 _In_ ULONG DueTime, 3543 _In_ ULONG Period 3544 ); 3545 3546 NTSYSAPI 3547 NTSTATUS 3548 NTAPI 3549 RtlDeleteTimerQueueEx( 3550 _In_ HANDLE TimerQueue, 3551 _In_opt_ HANDLE CompletionEvent 3552 ); 3553 3554 NTSYSAPI 3555 NTSTATUS 3556 NTAPI 3557 RtlDeleteTimerQueue(HANDLE TimerQueue); 3558 3559 // 3560 // SList functions 3561 // 3562 PSLIST_ENTRY 3563 FASTCALL 3564 InterlockedPushListSList( 3565 _Inout_ PSLIST_HEADER ListHead, 3566 _Inout_ __drv_aliasesMem PSLIST_ENTRY List, 3567 _Inout_ PSLIST_ENTRY ListEnd, 3568 _In_ ULONG Count 3569 ); 3570 3571 // 3572 // Range List functions 3573 // 3574 NTSYSAPI 3575 VOID 3576 NTAPI 3577 RtlInitializeRangeList( 3578 _Inout_ PRTL_RANGE_LIST RangeList 3579 ); 3580 3581 NTSYSAPI 3582 VOID 3583 NTAPI 3584 RtlFreeRangeList( 3585 _In_ PRTL_RANGE_LIST RangeList 3586 ); 3587 3588 NTSYSAPI 3589 NTSTATUS 3590 NTAPI 3591 RtlAddRange( 3592 _Inout_ PRTL_RANGE_LIST RangeList, 3593 _In_ ULONGLONG Start, 3594 _In_ ULONGLONG End, 3595 _In_ UCHAR Attributes, 3596 _In_ ULONG Flags, 3597 _In_opt_ PVOID UserData, 3598 _In_opt_ PVOID Owner 3599 ); 3600 3601 // 3602 // Debug Functions 3603 // 3604 ULONG 3605 __cdecl 3606 DbgPrint( 3607 _In_z_ _Printf_format_string_ PCSTR Format, 3608 ... 3609 ); 3610 3611 NTSYSAPI 3612 ULONG 3613 __cdecl 3614 DbgPrintEx( 3615 _In_ ULONG ComponentId, 3616 _In_ ULONG Level, 3617 _In_z_ _Printf_format_string_ PCSTR Format, 3618 ... 3619 ); 3620 3621 NTSYSAPI 3622 ULONG 3623 NTAPI 3624 DbgPrompt( 3625 _In_z_ PCCH Prompt, 3626 _Out_writes_bytes_(MaximumResponseLength) PCH Response, 3627 _In_ ULONG MaximumResponseLength 3628 ); 3629 3630 #undef DbgBreakPoint 3631 VOID 3632 NTAPI 3633 DbgBreakPoint( 3634 VOID 3635 ); 3636 3637 VOID 3638 NTAPI 3639 DbgLoadImageSymbols( 3640 _In_ PSTRING Name, 3641 _In_ PVOID Base, 3642 _In_ ULONG_PTR ProcessId 3643 ); 3644 3645 VOID 3646 NTAPI 3647 DbgUnLoadImageSymbols( 3648 _In_ PSTRING Name, 3649 _In_ PVOID Base, 3650 _In_ ULONG_PTR ProcessId 3651 ); 3652 3653 VOID 3654 NTAPI 3655 DbgCommandString( 3656 _In_ PCCH Name, 3657 _In_ PCCH Command 3658 ); 3659 3660 // 3661 // Generic Table Functions 3662 // 3663 #if defined(NTOS_MODE_USER) || defined(_NTIFS_) 3664 NTSYSAPI 3665 PVOID 3666 NTAPI 3667 RtlInsertElementGenericTable( 3668 _In_ PRTL_GENERIC_TABLE Table, 3669 _In_reads_bytes_(BufferSize) PVOID Buffer, 3670 _In_ CLONG BufferSize, 3671 _Out_opt_ PBOOLEAN NewElement 3672 ); 3673 3674 NTSYSAPI 3675 PVOID 3676 NTAPI 3677 RtlInsertElementGenericTableFull( 3678 _In_ PRTL_GENERIC_TABLE Table, 3679 _In_reads_bytes_(BufferSize) PVOID Buffer, 3680 _In_ CLONG BufferSize, 3681 _Out_opt_ PBOOLEAN NewElement, 3682 _In_ PVOID NodeOrParent, 3683 _In_ TABLE_SEARCH_RESULT SearchResult 3684 ); 3685 3686 NTSYSAPI 3687 BOOLEAN 3688 NTAPI 3689 RtlIsGenericTableEmpty( 3690 _In_ PRTL_GENERIC_TABLE Table 3691 ); 3692 3693 NTSYSAPI 3694 PVOID 3695 NTAPI 3696 RtlLookupElementGenericTableFull( 3697 _In_ PRTL_GENERIC_TABLE Table, 3698 _In_ PVOID Buffer, 3699 _Out_ PVOID *NodeOrParent, 3700 _Out_ TABLE_SEARCH_RESULT *SearchResult 3701 ); 3702 #endif 3703 3704 // 3705 // Handle Table Functions 3706 // 3707 NTSYSAPI 3708 PRTL_HANDLE_TABLE_ENTRY 3709 NTAPI 3710 RtlAllocateHandle( 3711 _In_ PRTL_HANDLE_TABLE HandleTable, 3712 _Inout_ PULONG Index 3713 ); 3714 3715 NTSYSAPI 3716 VOID 3717 NTAPI 3718 RtlDestroyHandleTable( 3719 _Inout_ PRTL_HANDLE_TABLE HandleTable); 3720 3721 NTSYSAPI 3722 BOOLEAN 3723 NTAPI 3724 RtlFreeHandle( 3725 _In_ PRTL_HANDLE_TABLE HandleTable, 3726 _In_ PRTL_HANDLE_TABLE_ENTRY Handle 3727 ); 3728 3729 NTSYSAPI 3730 VOID 3731 NTAPI 3732 RtlInitializeHandleTable( 3733 _In_ ULONG TableSize, 3734 _In_ ULONG HandleSize, 3735 _In_ PRTL_HANDLE_TABLE HandleTable 3736 ); 3737 3738 NTSYSAPI 3739 BOOLEAN 3740 NTAPI 3741 RtlIsValidHandle( 3742 _In_ PRTL_HANDLE_TABLE HandleTable, 3743 _In_ PRTL_HANDLE_TABLE_ENTRY Handle 3744 ); 3745 3746 _Success_(return!=FALSE) 3747 NTSYSAPI 3748 BOOLEAN 3749 NTAPI 3750 RtlIsValidIndexHandle( 3751 _In_ PRTL_HANDLE_TABLE HandleTable, 3752 _In_ ULONG Index, 3753 _Out_ PRTL_HANDLE_TABLE_ENTRY *Handle 3754 ); 3755 3756 // 3757 // PE Functions 3758 // 3759 NTSYSAPI 3760 NTSTATUS 3761 NTAPI 3762 RtlFindMessage( 3763 _In_ PVOID BaseAddress, 3764 _In_ ULONG Type, 3765 _In_ ULONG Language, 3766 _In_ ULONG MessageId, 3767 _Out_ PMESSAGE_RESOURCE_ENTRY *MessageResourceEntry 3768 ); 3769 3770 NTSYSAPI 3771 ULONG 3772 NTAPI 3773 RtlGetNtGlobalFlags(VOID); 3774 3775 _Success_(return!=NULL) 3776 NTSYSAPI 3777 PVOID 3778 NTAPI 3779 RtlImageDirectoryEntryToData( 3780 _In_ PVOID BaseAddress, 3781 _In_ BOOLEAN MappedAsImage, 3782 _In_ USHORT Directory, 3783 _Out_ PULONG Size 3784 ); 3785 3786 NTSYSAPI 3787 PVOID 3788 NTAPI 3789 RtlImageRvaToVa( 3790 _In_ PIMAGE_NT_HEADERS NtHeader, 3791 _In_ PVOID BaseAddress, 3792 _In_ ULONG Rva, 3793 _Inout_opt_ PIMAGE_SECTION_HEADER *SectionHeader 3794 ); 3795 3796 NTSYSAPI 3797 PIMAGE_NT_HEADERS 3798 NTAPI 3799 RtlImageNtHeader( 3800 _In_ PVOID BaseAddress); 3801 3802 NTSYSAPI 3803 NTSTATUS 3804 NTAPI 3805 RtlImageNtHeaderEx( 3806 _In_ ULONG Flags, 3807 _In_ PVOID BaseAddress, 3808 _In_ ULONGLONG Size, 3809 _Out_ PIMAGE_NT_HEADERS *NtHeader 3810 ); 3811 3812 NTSYSAPI 3813 PIMAGE_SECTION_HEADER 3814 NTAPI 3815 RtlImageRvaToSection( 3816 _In_ PIMAGE_NT_HEADERS NtHeader, 3817 _In_ PVOID BaseAddress, 3818 _In_ ULONG Rva 3819 ); 3820 3821 NTSYSAPI 3822 ULONG 3823 NTAPI 3824 LdrRelocateImageWithBias( 3825 _In_ PVOID NewAddress, 3826 _In_ LONGLONG AdditionalBias, 3827 _In_ PCCH LoaderName, 3828 _In_ ULONG Success, 3829 _In_ ULONG Conflict, 3830 _In_ ULONG Invalid 3831 ); 3832 3833 // 3834 // Activation Context Functions 3835 // 3836 #ifdef NTOS_MODE_USER 3837 NTSYSAPI 3838 NTSTATUS 3839 NTAPI 3840 RtlActivateActivationContextEx( 3841 _In_ ULONG Flags, 3842 _In_ PTEB Teb, 3843 _In_ PVOID Context, 3844 _Out_ PULONG_PTR Cookie 3845 ); 3846 3847 NTSYSAPI 3848 NTSTATUS 3849 NTAPI 3850 RtlActivateActivationContext( 3851 _In_ ULONG Flags, 3852 _In_ HANDLE Handle, 3853 _Out_ PULONG_PTR Cookie 3854 ); 3855 3856 NTSYSAPI 3857 VOID 3858 NTAPI 3859 RtlAddRefActivationContext( 3860 _In_ PVOID Context 3861 ); 3862 3863 NTSYSAPI 3864 PRTL_ACTIVATION_CONTEXT_STACK_FRAME 3865 FASTCALL 3866 RtlActivateActivationContextUnsafeFast( 3867 _In_ PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame, 3868 _In_ PVOID Context 3869 ); 3870 3871 NTSYSAPI 3872 NTSTATUS 3873 NTAPI 3874 RtlAllocateActivationContextStack( 3875 _In_ PACTIVATION_CONTEXT_STACK *Stack 3876 ); 3877 3878 NTSYSAPI 3879 NTSTATUS 3880 NTAPI 3881 RtlCreateActivationContext( 3882 _In_ ULONG Flags, 3883 _In_ PACTIVATION_CONTEXT_DATA ActivationContextData, 3884 _In_ ULONG ExtraBytes, 3885 _In_ PVOID NotificationRoutine, 3886 _In_ PVOID NotificationContext, 3887 _Out_ PACTIVATION_CONTEXT *ActCtx 3888 ); 3889 3890 NTSYSAPI 3891 NTSTATUS 3892 NTAPI 3893 RtlGetActiveActivationContext( 3894 _In_ PVOID *Context 3895 ); 3896 3897 NTSYSAPI 3898 VOID 3899 NTAPI 3900 RtlReleaseActivationContext( 3901 _In_ HANDLE handle 3902 ); 3903 3904 NTSYSAPI 3905 NTSTATUS 3906 NTAPI 3907 RtlDeactivateActivationContext( 3908 _In_ ULONG dwFlags, 3909 _In_ ULONG_PTR ulCookie 3910 ); 3911 3912 NTSYSAPI 3913 VOID 3914 NTAPI 3915 RtlFreeActivationContextStack( 3916 _In_ PACTIVATION_CONTEXT_STACK Stack 3917 ); 3918 3919 NTSYSAPI 3920 VOID 3921 NTAPI 3922 RtlFreeThreadActivationContextStack(VOID); 3923 3924 NTSYSAPI 3925 PRTL_ACTIVATION_CONTEXT_STACK_FRAME 3926 FASTCALL 3927 RtlDeactivateActivationContextUnsafeFast( 3928 _In_ PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame 3929 ); 3930 3931 NTSYSAPI 3932 NTSTATUS 3933 NTAPI 3934 RtlDosApplyFileIsolationRedirection_Ustr( 3935 _In_ ULONG Flags, 3936 _In_ PUNICODE_STRING OriginalName, 3937 _In_ PUNICODE_STRING Extension, 3938 _Inout_ PUNICODE_STRING StaticString, 3939 _Inout_ PUNICODE_STRING DynamicString, 3940 _Inout_ PUNICODE_STRING *NewName, 3941 _In_ PULONG NewFlags, 3942 _In_ PSIZE_T FileNameSize, 3943 _In_ PSIZE_T RequiredLength 3944 ); 3945 3946 NTSYSAPI 3947 NTSTATUS 3948 NTAPI 3949 RtlFindActivationContextSectionString( 3950 _In_ ULONG dwFlags, 3951 _In_ const GUID *ExtensionGuid, 3952 _In_ ULONG SectionType, 3953 _In_ const UNICODE_STRING *SectionName, 3954 _Inout_ PVOID ReturnedData 3955 ); 3956 3957 NTSYSAPI 3958 NTSTATUS 3959 NTAPI 3960 RtlQueryInformationActivationContext( 3961 _In_ DWORD dwFlags, 3962 _In_opt_ PVOID Context, 3963 _In_opt_ PVOID pvSubInstance, 3964 _In_ ULONG ulInfoClass, 3965 _Out_bytecap_(cbBuffer) PVOID pvBuffer, 3966 _In_opt_ SIZE_T cbBuffer, 3967 _Out_opt_ SIZE_T *pcbWrittenOrRequired 3968 ); 3969 3970 NTSYSAPI 3971 NTSTATUS 3972 NTAPI 3973 RtlQueryInformationActiveActivationContext( 3974 _In_ ULONG ulInfoClass, 3975 _Out_bytecap_(cbBuffer) PVOID pvBuffer, 3976 _In_opt_ SIZE_T cbBuffer, 3977 _Out_opt_ SIZE_T *pcbWrittenOrRequired 3978 ); 3979 3980 NTSYSAPI 3981 NTSTATUS 3982 NTAPI 3983 RtlZombifyActivationContext( 3984 PVOID Context 3985 ); 3986 3987 // 3988 // WOW64 Functions 3989 // 3990 NTSYSAPI 3991 NTSTATUS 3992 NTAPI 3993 RtlWow64EnableFsRedirection( 3994 _In_ BOOLEAN Wow64FsEnableRedirection 3995 ); 3996 3997 NTSYSAPI 3998 NTSTATUS 3999 NTAPI 4000 RtlWow64EnableFsRedirectionEx( 4001 _In_ PVOID Wow64FsEnableRedirection, 4002 _Out_ PVOID *OldFsRedirectionLevel 4003 ); 4004 4005 #endif 4006 4007 // 4008 // Registry Functions 4009 // 4010 _IRQL_requires_max_(PASSIVE_LEVEL) 4011 _Must_inspect_result_ 4012 NTSYSAPI 4013 NTSTATUS 4014 NTAPI 4015 RtlCheckRegistryKey( 4016 _In_ ULONG RelativeTo, 4017 _In_ PWSTR Path 4018 ); 4019 4020 NTSYSAPI 4021 NTSTATUS 4022 NTAPI 4023 RtlCreateRegistryKey( 4024 _In_ ULONG RelativeTo, 4025 _In_ PWSTR Path 4026 ); 4027 4028 NTSYSAPI 4029 NTSTATUS 4030 NTAPI 4031 RtlFormatCurrentUserKeyPath( 4032 _Out_ _At_(KeyPath->Buffer, __drv_allocatesMem(Mem) _Post_bytecap_(KeyPath->MaximumLength) _Post_bytecount_(KeyPath->Length)) 4033 PUNICODE_STRING KeyPath 4034 ); 4035 4036 NTSYSAPI 4037 NTSTATUS 4038 NTAPI 4039 RtlOpenCurrentUser( 4040 _In_ ACCESS_MASK DesiredAccess, 4041 _Out_ PHANDLE KeyHandle 4042 ); 4043 4044 _IRQL_requires_max_(PASSIVE_LEVEL) 4045 NTSYSAPI 4046 NTSTATUS 4047 NTAPI 4048 RtlQueryRegistryValues( 4049 _In_ ULONG RelativeTo, 4050 _In_ PCWSTR Path, 4051 _Inout_ _At_(*(*QueryTable).EntryContext, _Pre_unknown_) 4052 PRTL_QUERY_REGISTRY_TABLE QueryTable, 4053 _In_opt_ PVOID Context, 4054 _In_opt_ PVOID Environment 4055 ); 4056 4057 _IRQL_requires_max_(PASSIVE_LEVEL) 4058 NTSYSAPI 4059 NTSTATUS 4060 NTAPI 4061 RtlWriteRegistryValue( 4062 _In_ ULONG RelativeTo, 4063 _In_ PCWSTR Path, 4064 _In_z_ PCWSTR ValueName, 4065 _In_ ULONG ValueType, 4066 _In_reads_bytes_opt_(ValueLength) PVOID ValueData, 4067 _In_ ULONG ValueLength 4068 ); 4069 4070 #ifdef NTOS_MODE_USER 4071 NTSYSAPI 4072 NTSTATUS 4073 NTAPI 4074 RtlpNtCreateKey( 4075 _Out_ HANDLE KeyHandle, 4076 _In_ ACCESS_MASK DesiredAccess, 4077 _In_ POBJECT_ATTRIBUTES ObjectAttributes, 4078 _In_ ULONG TitleIndex, 4079 _In_ PUNICODE_STRING Class, 4080 _Out_ PULONG Disposition 4081 ); 4082 4083 NTSYSAPI 4084 NTSTATUS 4085 NTAPI 4086 RtlpNtEnumerateSubKey( 4087 _In_ HANDLE KeyHandle, 4088 _Inout_ PUNICODE_STRING SubKeyName, 4089 _In_ ULONG Index, 4090 _In_ ULONG Unused 4091 ); 4092 4093 NTSYSAPI 4094 NTSTATUS 4095 NTAPI 4096 RtlpNtMakeTemporaryKey( 4097 _In_ HANDLE KeyHandle 4098 ); 4099 4100 NTSYSAPI 4101 NTSTATUS 4102 NTAPI 4103 RtlpNtOpenKey( 4104 _Out_ HANDLE KeyHandle, 4105 _In_ ACCESS_MASK DesiredAccess, 4106 _In_ POBJECT_ATTRIBUTES ObjectAttributes, 4107 _In_ ULONG Unused 4108 ); 4109 4110 NTSYSAPI 4111 NTSTATUS 4112 NTAPI 4113 RtlpNtQueryValueKey( 4114 _In_ HANDLE KeyHandle, 4115 _Out_opt_ PULONG Type, 4116 _Out_opt_ PVOID Data, 4117 _Inout_opt_ PULONG DataLength, 4118 _In_ ULONG Unused 4119 ); 4120 4121 NTSYSAPI 4122 NTSTATUS 4123 NTAPI 4124 RtlpNtSetValueKey( 4125 _In_ HANDLE KeyHandle, 4126 _In_ ULONG Type, 4127 _In_ PVOID Data, 4128 _In_ ULONG DataLength 4129 ); 4130 #endif 4131 4132 // 4133 // NLS Functions 4134 // 4135 NTSYSAPI 4136 VOID 4137 NTAPI 4138 RtlGetDefaultCodePage( 4139 _Out_ PUSHORT AnsiCodePage, 4140 _Out_ PUSHORT OemCodePage 4141 ); 4142 4143 NTSYSAPI 4144 VOID 4145 NTAPI 4146 RtlInitNlsTables( 4147 _In_ PUSHORT AnsiTableBase, 4148 _In_ PUSHORT OemTableBase, 4149 _In_ PUSHORT CaseTableBase, 4150 _Out_ PNLSTABLEINFO NlsTable 4151 ); 4152 4153 _IRQL_requires_max_(PASSIVE_LEVEL) 4154 NTSYSAPI 4155 VOID 4156 NTAPI 4157 RtlInitCodePageTable( 4158 _In_ PUSHORT TableBase, 4159 _Out_ PCPTABLEINFO CodePageTable 4160 ); 4161 4162 NTSYSAPI 4163 VOID 4164 NTAPI 4165 RtlResetRtlTranslations( 4166 _In_ PNLSTABLEINFO NlsTable); 4167 4168 #if defined(NTOS_MODE_USER) && !defined(NO_RTL_INLINES) 4169 4170 // 4171 // Misc conversion functions 4172 // 4173 static __inline 4174 LARGE_INTEGER 4175 NTAPI_INLINE 4176 RtlConvertLongToLargeInteger( 4177 _In_ LONG SignedInteger 4178 ) 4179 { 4180 LARGE_INTEGER Result; 4181 4182 Result.QuadPart = SignedInteger; 4183 return Result; 4184 } 4185 4186 static __inline 4187 LARGE_INTEGER 4188 NTAPI_INLINE 4189 RtlEnlargedIntegerMultiply( 4190 _In_ LONG Multiplicand, 4191 _In_ LONG Multiplier 4192 ) 4193 { 4194 LARGE_INTEGER Product; 4195 4196 Product.QuadPart = (LONGLONG)Multiplicand * (ULONGLONG)Multiplier; 4197 return Product; 4198 } 4199 4200 static __inline 4201 ULONG 4202 NTAPI_INLINE 4203 RtlEnlargedUnsignedDivide( 4204 _In_ ULARGE_INTEGER Dividend, 4205 _In_ ULONG Divisor, 4206 _In_opt_ PULONG Remainder 4207 ) 4208 { 4209 ULONG Quotient; 4210 4211 Quotient = (ULONG)(Dividend.QuadPart / Divisor); 4212 if (Remainder) { 4213 *Remainder = (ULONG)(Dividend.QuadPart % Divisor); 4214 } 4215 4216 return Quotient; 4217 } 4218 4219 static __inline 4220 LARGE_INTEGER 4221 NTAPI_INLINE 4222 RtlEnlargedUnsignedMultiply( 4223 _In_ ULONG Multiplicand, 4224 _In_ ULONG Multiplier 4225 ) 4226 { 4227 LARGE_INTEGER Product; 4228 4229 Product.QuadPart = (ULONGLONG)Multiplicand * (ULONGLONG)Multiplier; 4230 return Product; 4231 } 4232 4233 #if defined(_AMD64_) || defined(_IA64_) 4234 static __inline 4235 LARGE_INTEGER 4236 NTAPI_INLINE 4237 RtlExtendedLargeIntegerDivide( 4238 _In_ LARGE_INTEGER Dividend, 4239 _In_ ULONG Divisor, 4240 _Out_opt_ PULONG Remainder) 4241 { 4242 LARGE_INTEGER ret; 4243 ret.QuadPart = (ULONG64)Dividend.QuadPart / Divisor; 4244 if (Remainder) 4245 *Remainder = (ULONG)(Dividend.QuadPart % Divisor); 4246 return ret; 4247 } 4248 4249 #else 4250 NTSYSAPI 4251 LARGE_INTEGER 4252 NTAPI 4253 RtlExtendedLargeIntegerDivide( 4254 _In_ LARGE_INTEGER Dividend, 4255 _In_ ULONG Divisor, 4256 _Out_opt_ PULONG Remainder 4257 ); 4258 4259 #endif /* defined(_AMD64_) || defined(_IA64_) */ 4260 4261 #endif 4262 4263 4264 NTSYSAPI 4265 ULONG 4266 NTAPI 4267 RtlUniform( 4268 _In_ PULONG Seed 4269 ); 4270 4271 NTSYSAPI 4272 ULONG 4273 NTAPI 4274 RtlRandom( 4275 _Inout_ PULONG Seed 4276 ); 4277 4278 NTSYSAPI 4279 ULONG 4280 NTAPI 4281 RtlComputeCrc32( 4282 _In_ ULONG InitialCrc, 4283 _In_ PUCHAR Buffer, 4284 _In_ ULONG Length 4285 ); 4286 4287 // 4288 // Network Functions 4289 // 4290 NTSYSAPI 4291 PSTR 4292 NTAPI 4293 RtlIpv4AddressToStringA( 4294 _In_ const struct in_addr *Addr, 4295 _Out_writes_(16) PCHAR S 4296 ); 4297 4298 NTSYSAPI 4299 PWSTR 4300 NTAPI 4301 RtlIpv4AddressToStringW( 4302 _In_ const struct in_addr *Addr, 4303 _Out_writes_(16) PWCHAR S 4304 ); 4305 4306 NTSYSAPI 4307 NTSTATUS 4308 NTAPI 4309 RtlIpv4AddressToStringExA( 4310 _In_ const struct in_addr *Address, 4311 _In_ USHORT Port, 4312 _Out_writes_to_(*AddressStringLength, *AddressStringLength) PCHAR AddressString, 4313 _Inout_ PULONG AddressStringLength 4314 ); 4315 4316 NTSTATUS 4317 NTAPI 4318 RtlIpv4AddressToStringExW( 4319 _In_ const struct in_addr *Address, 4320 _In_ USHORT Port, 4321 _Out_writes_to_(*AddressStringLength, *AddressStringLength) PWCHAR AddressString, 4322 _Inout_ PULONG AddressStringLength 4323 ); 4324 4325 NTSYSAPI 4326 NTSTATUS 4327 NTAPI 4328 RtlIpv4StringToAddressA( 4329 _In_ PCSTR String, 4330 _In_ BOOLEAN Strict, 4331 _Out_ PCSTR *Terminator, 4332 _Out_ struct in_addr *Addr 4333 ); 4334 4335 NTSYSAPI 4336 NTSTATUS 4337 NTAPI 4338 RtlIpv4StringToAddressW( 4339 _In_ PCWSTR String, 4340 _In_ BOOLEAN Strict, 4341 _Out_ PCWSTR *Terminator, 4342 _Out_ struct in_addr *Addr 4343 ); 4344 4345 NTSYSAPI 4346 NTSTATUS 4347 NTAPI 4348 RtlIpv4StringToAddressExA( 4349 _In_ PCSTR AddressString, 4350 _In_ BOOLEAN Strict, 4351 _Out_ struct in_addr *Address, 4352 _Out_ PUSHORT Port 4353 ); 4354 4355 NTSYSAPI 4356 NTSTATUS 4357 NTAPI 4358 RtlIpv4StringToAddressExW( 4359 _In_ PCWSTR AddressString, 4360 _In_ BOOLEAN Strict, 4361 _Out_ struct in_addr *Address, 4362 _Out_ PUSHORT Port 4363 ); 4364 4365 NTSYSAPI 4366 PSTR 4367 NTAPI 4368 RtlIpv6AddressToStringA( 4369 _In_ const struct in6_addr *Addr, 4370 _Out_writes_(46) PSTR S 4371 ); 4372 4373 NTSYSAPI 4374 PWSTR 4375 NTAPI 4376 RtlIpv6AddressToStringW( 4377 _In_ const struct in6_addr *Addr, 4378 _Out_writes_(46) PWSTR S 4379 ); 4380 4381 NTSYSAPI 4382 NTSTATUS 4383 NTAPI 4384 RtlIpv6AddressToStringExA( 4385 _In_ const struct in6_addr *Address, 4386 _In_ ULONG ScopeId, 4387 _In_ USHORT Port, 4388 _Out_writes_to_(*AddressStringLength, *AddressStringLength) PSTR AddressString, 4389 _Inout_ PULONG AddressStringLength 4390 ); 4391 4392 NTSYSAPI 4393 NTSTATUS 4394 NTAPI 4395 RtlIpv6AddressToStringExW( 4396 _In_ const struct in6_addr *Address, 4397 _In_ ULONG ScopeId, 4398 _In_ USHORT Port, 4399 _Out_writes_to_(*AddressStringLength, *AddressStringLength) PWCHAR AddressString, 4400 _Inout_ PULONG AddressStringLength 4401 ); 4402 4403 NTSYSAPI 4404 NTSTATUS 4405 NTAPI 4406 RtlIpv6StringToAddressA( 4407 _In_ PCSTR String, 4408 _Out_ PCSTR *Terminator, 4409 _Out_ struct in6_addr *Addr 4410 ); 4411 4412 NTSYSAPI 4413 NTSTATUS 4414 NTAPI 4415 RtlIpv6StringToAddressW( 4416 _In_ PCWSTR String, 4417 _Out_ PCWSTR *Terminator, 4418 _Out_ struct in6_addr *Addr 4419 ); 4420 4421 NTSYSAPI 4422 NTSTATUS 4423 NTAPI 4424 RtlIpv6StringToAddressExA( 4425 _In_ PCSTR AddressString, 4426 _Out_ struct in6_addr *Address, 4427 _Out_ PULONG ScopeId, 4428 _Out_ PUSHORT Port 4429 ); 4430 4431 NTSYSAPI 4432 NTSTATUS 4433 NTAPI 4434 RtlIpv6StringToAddressExW( 4435 _In_ PCWSTR AddressString, 4436 _Out_ struct in6_addr *Address, 4437 _Out_ PULONG ScopeId, 4438 _Out_ PUSHORT Port 4439 ); 4440 4441 4442 // 4443 // Time Functions 4444 // 4445 NTSYSAPI 4446 NTSTATUS 4447 NTAPI 4448 RtlQueryTimeZoneInformation( 4449 _Out_ PRTL_TIME_ZONE_INFORMATION TimeZoneInformation); 4450 4451 NTSYSAPI 4452 VOID 4453 NTAPI 4454 RtlSecondsSince1970ToTime( 4455 _In_ ULONG SecondsSince1970, 4456 _Out_ PLARGE_INTEGER Time 4457 ); 4458 4459 NTSYSAPI 4460 NTSTATUS 4461 NTAPI 4462 RtlSetTimeZoneInformation( 4463 _In_ PRTL_TIME_ZONE_INFORMATION TimeZoneInformation); 4464 4465 _Success_(return!=FALSE) 4466 _Must_inspect_result_ 4467 NTSYSAPI 4468 BOOLEAN 4469 NTAPI 4470 RtlTimeFieldsToTime( 4471 _In_ PTIME_FIELDS TimeFields, 4472 _Out_ PLARGE_INTEGER Time 4473 ); 4474 4475 _Success_(return != 0) 4476 _Must_inspect_result_ 4477 NTSYSAPI 4478 BOOLEAN 4479 NTAPI 4480 RtlTimeToSecondsSince1970( 4481 _In_ PLARGE_INTEGER Time, 4482 _Out_ PULONG ElapsedSeconds 4483 ); 4484 4485 NTSYSAPI 4486 VOID 4487 NTAPI 4488 RtlTimeToTimeFields( 4489 PLARGE_INTEGER Time, 4490 PTIME_FIELDS TimeFields 4491 ); 4492 4493 NTSYSAPI 4494 NTSTATUS 4495 NTAPI 4496 RtlSystemTimeToLocalTime( 4497 _In_ PLARGE_INTEGER SystemTime, 4498 _Out_ PLARGE_INTEGER LocalTime 4499 ); 4500 4501 // 4502 // Version Functions 4503 // 4504 _IRQL_requires_max_(PASSIVE_LEVEL) 4505 _Must_inspect_result_ 4506 NTSYSAPI 4507 NTSTATUS 4508 NTAPI 4509 RtlVerifyVersionInfo( 4510 _In_ PRTL_OSVERSIONINFOEXW VersionInfo, 4511 _In_ ULONG TypeMask, 4512 _In_ ULONGLONG ConditionMask 4513 ); 4514 4515 _IRQL_requires_max_(PASSIVE_LEVEL) 4516 NTSYSAPI 4517 NTSTATUS 4518 NTAPI 4519 RtlGetVersion( 4520 _Out_ 4521 _At_(lpVersionInformation->dwOSVersionInfoSize, _Pre_ _Valid_) 4522 _When_(lpVersionInformation->dwOSVersionInfoSize == sizeof(RTL_OSVERSIONINFOEXW), 4523 _At_((PRTL_OSVERSIONINFOEXW)lpVersionInformation, _Out_)) 4524 PRTL_OSVERSIONINFOW lpVersionInformation 4525 ); 4526 4527 NTSYSAPI 4528 BOOLEAN 4529 NTAPI 4530 RtlGetNtProductType(OUT PNT_PRODUCT_TYPE ProductType); 4531 4532 // 4533 // Secure Memory Functions 4534 // 4535 #ifdef NTOS_MODE_USER 4536 NTSYSAPI 4537 NTSTATUS 4538 NTAPI 4539 RtlRegisterSecureMemoryCacheCallback( 4540 _In_ PRTL_SECURE_MEMORY_CACHE_CALLBACK Callback); 4541 4542 NTSYSAPI 4543 BOOLEAN 4544 NTAPI 4545 RtlFlushSecureMemoryCache( 4546 _In_ PVOID MemoryCache, 4547 _In_opt_ SIZE_T MemoryLength 4548 ); 4549 #endif 4550 4551 // 4552 // Boot Status Data Functions 4553 // 4554 #ifdef NTOS_MODE_USER 4555 NTSYSAPI 4556 NTSTATUS 4557 NTAPI 4558 RtlCreateBootStatusDataFile( 4559 VOID 4560 ); 4561 4562 NTSYSAPI 4563 NTSTATUS 4564 NTAPI 4565 RtlGetSetBootStatusData( 4566 _In_ HANDLE FileHandle, 4567 _In_ BOOLEAN WriteMode, 4568 _In_ RTL_BSD_ITEM_TYPE DataClass, 4569 _In_ PVOID Buffer, 4570 _In_ ULONG BufferSize, 4571 _Out_opt_ PULONG ReturnLength 4572 ); 4573 4574 NTSYSAPI 4575 NTSTATUS 4576 NTAPI 4577 RtlLockBootStatusData( 4578 _Out_ PHANDLE FileHandle 4579 ); 4580 4581 NTSYSAPI 4582 NTSTATUS 4583 NTAPI 4584 RtlUnlockBootStatusData( 4585 _In_ HANDLE FileHandle 4586 ); 4587 #endif 4588 4589 #ifdef NTOS_MODE_USER 4590 _Must_inspect_result_ 4591 NTSYSAPI 4592 NTSTATUS 4593 NTAPI 4594 RtlGUIDFromString( 4595 _In_ PUNICODE_STRING GuidString, 4596 _Out_ GUID *Guid); 4597 4598 _Must_inspect_result_ 4599 NTSYSAPI 4600 NTSTATUS 4601 NTAPI 4602 RtlStringFromGUID( 4603 _In_ REFGUID Guid, 4604 _Out_ _At_(GuidString->Buffer, __drv_allocatesMem(Mem)) 4605 PUNICODE_STRING GuidString); 4606 4607 NTSYSAPI 4608 NTSTATUS 4609 NTAPI 4610 RtlComputeImportTableHash( 4611 _In_ HANDLE hFile, 4612 _Out_ PCHAR Hash, 4613 _In_ ULONG ImportTableHashRevision 4614 ); 4615 #endif 4616 4617 // 4618 // MemoryStream functions 4619 // 4620 #ifdef NTOS_MODE_USER 4621 4622 NTSYSAPI 4623 VOID 4624 NTAPI 4625 RtlInitMemoryStream( 4626 _Out_ PRTL_MEMORY_STREAM Stream 4627 ); 4628 4629 NTSYSAPI 4630 VOID 4631 NTAPI 4632 RtlInitOutOfProcessMemoryStream( 4633 _Out_ PRTL_MEMORY_STREAM Stream 4634 ); 4635 4636 NTSYSAPI 4637 VOID 4638 NTAPI 4639 RtlFinalReleaseOutOfProcessMemoryStream( 4640 _In_ PRTL_MEMORY_STREAM Stream 4641 ); 4642 4643 NTSYSAPI 4644 HRESULT 4645 NTAPI 4646 RtlQueryInterfaceMemoryStream( 4647 _In_ struct IStream *This, 4648 _In_ REFIID RequestedIid, 4649 _Outptr_ PVOID *ResultObject 4650 ); 4651 4652 NTSYSAPI 4653 ULONG 4654 NTAPI 4655 RtlAddRefMemoryStream( 4656 _In_ struct IStream *This 4657 ); 4658 4659 NTSYSAPI 4660 ULONG 4661 NTAPI 4662 RtlReleaseMemoryStream( 4663 _In_ struct IStream *This 4664 ); 4665 4666 NTSYSAPI 4667 HRESULT 4668 NTAPI 4669 RtlReadMemoryStream( 4670 _In_ struct IStream *This, 4671 _Out_writes_bytes_(Length) PVOID Buffer, 4672 _In_ ULONG Length, 4673 _Out_opt_ PULONG BytesRead 4674 ); 4675 4676 NTSYSAPI 4677 HRESULT 4678 NTAPI 4679 RtlReadOutOfProcessMemoryStream( 4680 _In_ struct IStream *This, 4681 _Out_writes_bytes_(Length) PVOID Buffer, 4682 _In_ ULONG Length, 4683 _Out_opt_ PULONG BytesRead 4684 ); 4685 4686 NTSYSAPI 4687 HRESULT 4688 NTAPI 4689 RtlSeekMemoryStream( 4690 _In_ struct IStream *This, 4691 _In_ LARGE_INTEGER RelativeOffset, 4692 _In_ ULONG Origin, 4693 _Out_opt_ PULARGE_INTEGER ResultOffset 4694 ); 4695 4696 NTSYSAPI 4697 HRESULT 4698 NTAPI 4699 RtlCopyMemoryStreamTo( 4700 _In_ struct IStream *This, 4701 _In_ struct IStream *Target, 4702 _In_ ULARGE_INTEGER Length, 4703 _Out_opt_ PULARGE_INTEGER BytesRead, 4704 _Out_opt_ PULARGE_INTEGER BytesWritten 4705 ); 4706 4707 NTSYSAPI 4708 HRESULT 4709 NTAPI 4710 RtlCopyOutOfProcessMemoryStreamTo( 4711 _In_ struct IStream *This, 4712 _In_ struct IStream *Target, 4713 _In_ ULARGE_INTEGER Length, 4714 _Out_opt_ PULARGE_INTEGER BytesRead, 4715 _Out_opt_ PULARGE_INTEGER BytesWritten 4716 ); 4717 4718 NTSYSAPI 4719 HRESULT 4720 NTAPI 4721 RtlStatMemoryStream( 4722 _In_ struct IStream *This, 4723 _Out_ struct tagSTATSTG *Stats, 4724 _In_ ULONG Flags 4725 ); 4726 4727 // Dummy functions 4728 NTSYSAPI 4729 HRESULT 4730 NTAPI 4731 RtlWriteMemoryStream( 4732 _In_ struct IStream *This, 4733 _In_reads_bytes_(Length) CONST VOID *Buffer, 4734 _In_ ULONG Length, 4735 _Out_opt_ PULONG BytesWritten 4736 ); 4737 4738 NTSYSAPI 4739 HRESULT 4740 NTAPI 4741 RtlSetMemoryStreamSize( 4742 _In_ struct IStream *This, 4743 _In_ ULARGE_INTEGER NewSize 4744 ); 4745 4746 NTSYSAPI 4747 HRESULT 4748 NTAPI 4749 RtlCommitMemoryStream( 4750 _In_ struct IStream *This, 4751 _In_ ULONG CommitFlags 4752 ); 4753 4754 NTSYSAPI 4755 HRESULT 4756 NTAPI 4757 RtlRevertMemoryStream( 4758 _In_ struct IStream *This 4759 ); 4760 4761 NTSYSAPI 4762 HRESULT 4763 NTAPI 4764 RtlLockMemoryStreamRegion( 4765 _In_ struct IStream *This, 4766 _In_ ULARGE_INTEGER Offset, 4767 _In_ ULARGE_INTEGER Length, 4768 _In_ ULONG LockType 4769 ); 4770 4771 NTSYSAPI 4772 HRESULT 4773 NTAPI 4774 RtlUnlockMemoryStreamRegion( 4775 _In_ struct IStream *This, 4776 _In_ ULARGE_INTEGER Offset, 4777 _In_ ULARGE_INTEGER Length, 4778 _In_ ULONG LockType 4779 ); 4780 4781 NTSYSAPI 4782 HRESULT 4783 NTAPI 4784 RtlCloneMemoryStream( 4785 _In_ struct IStream *This, 4786 _Outptr_ struct IStream **ResultStream 4787 ); 4788 4789 NTSYSAPI 4790 NTSTATUS 4791 NTAPI 4792 RtlGetNativeSystemInformation( 4793 _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass, 4794 _Out_writes_bytes_to_opt_(SystemInformationLength, *ReturnLength) PVOID SystemInformation, 4795 _In_ ULONG SystemInformationLength, 4796 _Out_opt_ PULONG ReturnLength 4797 ); 4798 4799 #endif // NTOS_MODE_USER 4800 4801 NTSYSAPI 4802 NTSTATUS 4803 NTAPI 4804 RtlFindActivationContextSectionGuid( 4805 ULONG flags, 4806 const GUID *extguid, 4807 ULONG section_kind, 4808 const GUID *guid, 4809 void *ptr 4810 ); 4811 4812 #ifdef __cplusplus 4813 } 4814 #endif 4815 4816 #endif 4817