1 /*++ NDK Version: 0098 2 3 Copyright (c) Alex Ionescu. All rights reserved. 4 5 Header Name: 6 7 rtlfuncs.h 8 9 Abstract: 10 11 Function definitions for the Run-Time Library 12 13 Author: 14 15 Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006 16 17 --*/ 18 19 #ifndef _RTLFUNCS_H 20 #define _RTLFUNCS_H 21 22 // 23 // Dependencies 24 // 25 #include <umtypes.h> 26 #include <ntnls.h> 27 #include <rtltypes.h> 28 #include <pstypes.h> 29 #include <extypes.h> 30 #include "in6addr.h" 31 #include "inaddr.h" 32 33 #ifdef __cplusplus 34 extern "C" { 35 #endif 36 37 #ifdef NTOS_MODE_USER 38 39 // 40 // List Functions 41 // 42 FORCEINLINE 43 VOID 44 InitializeListHead( 45 _Out_ PLIST_ENTRY ListHead 46 ) 47 { 48 ListHead->Flink = ListHead->Blink = ListHead; 49 } 50 51 FORCEINLINE 52 VOID 53 InsertHeadList( 54 _Inout_ PLIST_ENTRY ListHead, 55 _Inout_ PLIST_ENTRY Entry 56 ) 57 { 58 PLIST_ENTRY OldFlink; 59 OldFlink = ListHead->Flink; 60 Entry->Flink = OldFlink; 61 Entry->Blink = ListHead; 62 OldFlink->Blink = Entry; 63 ListHead->Flink = Entry; 64 } 65 66 FORCEINLINE 67 VOID 68 InsertTailList( 69 _Inout_ PLIST_ENTRY ListHead, 70 _Inout_ PLIST_ENTRY Entry 71 ) 72 { 73 PLIST_ENTRY OldBlink; 74 OldBlink = ListHead->Blink; 75 Entry->Flink = ListHead; 76 Entry->Blink = OldBlink; 77 OldBlink->Flink = Entry; 78 ListHead->Blink = Entry; 79 } 80 81 _Must_inspect_result_ 82 FORCEINLINE 83 BOOLEAN 84 IsListEmpty( 85 _In_ const LIST_ENTRY * ListHead 86 ) 87 { 88 return (BOOLEAN)(ListHead->Flink == ListHead); 89 } 90 91 FORCEINLINE 92 PSINGLE_LIST_ENTRY 93 PopEntryList( 94 _Inout_ PSINGLE_LIST_ENTRY ListHead 95 ) 96 { 97 PSINGLE_LIST_ENTRY FirstEntry; 98 FirstEntry = ListHead->Next; 99 if (FirstEntry != NULL) { 100 ListHead->Next = FirstEntry->Next; 101 } 102 103 return FirstEntry; 104 } 105 106 FORCEINLINE 107 VOID 108 PushEntryList( 109 _Inout_ PSINGLE_LIST_ENTRY ListHead, 110 _Inout_ PSINGLE_LIST_ENTRY Entry 111 ) 112 { 113 Entry->Next = ListHead->Next; 114 ListHead->Next = Entry; 115 } 116 117 FORCEINLINE 118 BOOLEAN 119 RemoveEntryList( 120 _In_ PLIST_ENTRY Entry) 121 { 122 PLIST_ENTRY OldFlink; 123 PLIST_ENTRY OldBlink; 124 125 OldFlink = Entry->Flink; 126 OldBlink = Entry->Blink; 127 OldFlink->Blink = OldBlink; 128 OldBlink->Flink = OldFlink; 129 return (BOOLEAN)(OldFlink == OldBlink); 130 } 131 132 FORCEINLINE 133 PLIST_ENTRY 134 RemoveHeadList( 135 _Inout_ PLIST_ENTRY ListHead) 136 { 137 PLIST_ENTRY Flink; 138 PLIST_ENTRY Entry; 139 140 Entry = ListHead->Flink; 141 Flink = Entry->Flink; 142 ListHead->Flink = Flink; 143 Flink->Blink = ListHead; 144 return Entry; 145 } 146 147 FORCEINLINE 148 PLIST_ENTRY 149 RemoveTailList( 150 _Inout_ PLIST_ENTRY ListHead) 151 { 152 PLIST_ENTRY Blink; 153 PLIST_ENTRY Entry; 154 155 Entry = ListHead->Blink; 156 Blink = Entry->Blink; 157 ListHead->Blink = Blink; 158 Blink->Flink = ListHead; 159 return Entry; 160 } 161 162 // 163 // Unicode string macros 164 // 165 _At_(UnicodeString->Buffer, _Post_equal_to_(Buffer)) 166 _At_(UnicodeString->Length, _Post_equal_to_(0)) 167 _At_(UnicodeString->MaximumLength, _Post_equal_to_(BufferSize)) 168 FORCEINLINE 169 VOID 170 RtlInitEmptyUnicodeString( 171 _Out_ PUNICODE_STRING UnicodeString, 172 _When_(BufferSize != 0, _Notnull_) _Writable_bytes_(BufferSize) __drv_aliasesMem PWCHAR Buffer, 173 _In_ USHORT BufferSize) 174 { 175 UnicodeString->Length = 0; 176 UnicodeString->MaximumLength = BufferSize; 177 UnicodeString->Buffer = Buffer; 178 } 179 180 _At_(AnsiString->Buffer, _Post_equal_to_(Buffer)) 181 _At_(AnsiString->Length, _Post_equal_to_(0)) 182 _At_(AnsiString->MaximumLength, _Post_equal_to_(BufferSize)) 183 FORCEINLINE 184 VOID 185 RtlInitEmptyAnsiString( 186 _Out_ PANSI_STRING AnsiString, 187 _When_(BufferSize != 0, _Notnull_) _Writable_bytes_(BufferSize) __drv_aliasesMem PCHAR Buffer, 188 _In_ USHORT BufferSize) 189 { 190 AnsiString->Length = 0; 191 AnsiString->MaximumLength = BufferSize; 192 AnsiString->Buffer = Buffer; 193 } 194 195 // 196 // LUID Macros 197 // 198 #define RtlEqualLuid(L1, L2) (((L1)->HighPart == (L2)->HighPart) && \ 199 ((L1)->LowPart == (L2)->LowPart)) 200 FORCEINLINE 201 LUID 202 NTAPI_INLINE 203 RtlConvertUlongToLuid( 204 _In_ ULONG Ulong) 205 { 206 LUID TempLuid; 207 208 TempLuid.LowPart = Ulong; 209 TempLuid.HighPart = 0; 210 return TempLuid; 211 } 212 213 // 214 // ASSERT Macros 215 // 216 #ifndef ASSERT 217 #if DBG 218 219 #define ASSERT( exp ) \ 220 ((void)((!(exp)) ? \ 221 (RtlAssert( (PVOID)#exp, (PVOID)__FILE__, __LINE__, NULL ),FALSE) : \ 222 TRUE)) 223 224 #define ASSERTMSG( msg, exp ) \ 225 ((void)((!(exp)) ? \ 226 (RtlAssert( (PVOID)#exp, (PVOID)__FILE__, __LINE__, (PCHAR)msg ),FALSE) : \ 227 TRUE)) 228 229 #else 230 231 #define ASSERT( exp ) ((void) 0) 232 #define ASSERTMSG( msg, exp ) ((void) 0) 233 234 #endif 235 #endif 236 237 #ifdef NTOS_KERNEL_RUNTIME 238 239 // 240 // Executing RTL functions at DISPATCH_LEVEL or higher will result in a 241 // bugcheck. 242 // 243 #define RTL_PAGED_CODE PAGED_CODE 244 245 #else 246 247 // 248 // This macro does nothing in user mode 249 // 250 #define RTL_PAGED_CODE() 251 252 #endif 253 254 // 255 // RTL Splay Tree Functions 256 // 257 #ifndef RTL_USE_AVL_TABLES 258 259 NTSYSAPI 260 VOID 261 NTAPI 262 RtlInitializeGenericTable( 263 _Out_ PRTL_GENERIC_TABLE Table, 264 _In_ PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine, 265 _In_opt_ PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine, 266 _In_opt_ PRTL_GENERIC_FREE_ROUTINE FreeRoutine, 267 _In_opt_ PVOID TableContext 268 ); 269 270 NTSYSAPI 271 PVOID 272 NTAPI 273 RtlInsertElementGenericTable( 274 _In_ PRTL_GENERIC_TABLE Table, 275 _In_reads_bytes_(BufferSize) PVOID Buffer, 276 _In_ CLONG BufferSize, 277 _Out_opt_ PBOOLEAN NewElement 278 ); 279 280 NTSYSAPI 281 PVOID 282 NTAPI 283 RtlInsertElementGenericTableFull( 284 _In_ PRTL_GENERIC_TABLE Table, 285 _In_reads_bytes_(BufferSize) PVOID Buffer, 286 _In_ CLONG BufferSize, 287 _Out_opt_ PBOOLEAN NewElement, 288 _In_ PVOID NodeOrParent, 289 _In_ TABLE_SEARCH_RESULT SearchResult 290 ); 291 292 NTSYSAPI 293 BOOLEAN 294 NTAPI 295 RtlDeleteElementGenericTable( 296 _In_ PRTL_GENERIC_TABLE Table, 297 _In_ PVOID Buffer 298 ); 299 300 _Must_inspect_result_ 301 NTSYSAPI 302 PVOID 303 NTAPI 304 RtlLookupElementGenericTable( 305 _In_ PRTL_GENERIC_TABLE Table, 306 _In_ PVOID Buffer 307 ); 308 309 NTSYSAPI 310 PVOID 311 NTAPI 312 RtlLookupElementGenericTableFull( 313 _In_ PRTL_GENERIC_TABLE Table, 314 _In_ PVOID Buffer, 315 _Out_ PVOID *NodeOrParent, 316 _Out_ TABLE_SEARCH_RESULT *SearchResult 317 ); 318 319 _Must_inspect_result_ 320 NTSYSAPI 321 PVOID 322 NTAPI 323 RtlEnumerateGenericTable( 324 _In_ PRTL_GENERIC_TABLE Table, 325 _In_ BOOLEAN Restart 326 ); 327 328 _Must_inspect_result_ 329 NTSYSAPI 330 PVOID 331 NTAPI 332 RtlEnumerateGenericTableWithoutSplaying( 333 _In_ PRTL_GENERIC_TABLE Table, 334 _Inout_ PVOID *RestartKey 335 ); 336 337 _Must_inspect_result_ 338 NTSYSAPI 339 PVOID 340 NTAPI 341 RtlGetElementGenericTable( 342 _In_ PRTL_GENERIC_TABLE Table, 343 _In_ ULONG I 344 ); 345 346 NTSYSAPI 347 ULONG 348 NTAPI 349 RtlNumberGenericTableElements( 350 _In_ PRTL_GENERIC_TABLE Table 351 ); 352 353 _Must_inspect_result_ 354 NTSYSAPI 355 BOOLEAN 356 NTAPI 357 RtlIsGenericTableEmpty( 358 _In_ PRTL_GENERIC_TABLE Table 359 ); 360 361 #endif /* !RTL_USE_AVL_TABLES */ 362 363 NTSYSAPI 364 PRTL_SPLAY_LINKS 365 NTAPI 366 RtlSplay( 367 _Inout_ PRTL_SPLAY_LINKS Links 368 ); 369 370 NTSYSAPI 371 PRTL_SPLAY_LINKS 372 NTAPI 373 RtlDelete( 374 _In_ PRTL_SPLAY_LINKS Links 375 ); 376 377 NTSYSAPI 378 VOID 379 NTAPI 380 RtlDeleteNoSplay( 381 _In_ PRTL_SPLAY_LINKS Links, 382 _Inout_ PRTL_SPLAY_LINKS *Root 383 ); 384 385 _Must_inspect_result_ 386 NTSYSAPI 387 PRTL_SPLAY_LINKS 388 NTAPI 389 RtlSubtreeSuccessor( 390 _In_ PRTL_SPLAY_LINKS Links 391 ); 392 393 _Must_inspect_result_ 394 NTSYSAPI 395 PRTL_SPLAY_LINKS 396 NTAPI 397 RtlSubtreePredecessor( 398 _In_ PRTL_SPLAY_LINKS Links 399 ); 400 401 _Must_inspect_result_ 402 NTSYSAPI 403 PRTL_SPLAY_LINKS 404 NTAPI 405 RtlRealSuccessor( 406 _In_ PRTL_SPLAY_LINKS Links 407 ); 408 409 _Must_inspect_result_ 410 NTSYSAPI 411 PRTL_SPLAY_LINKS 412 NTAPI 413 RtlRealPredecessor( 414 _In_ PRTL_SPLAY_LINKS Links 415 ); 416 417 #define RtlIsLeftChild(Links) \ 418 (RtlLeftChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links)) 419 420 #define RtlIsRightChild(Links) \ 421 (RtlRightChild(RtlParent(Links)) == (PRTL_SPLAY_LINKS)(Links)) 422 423 #define RtlRightChild(Links) \ 424 ((PRTL_SPLAY_LINKS)(Links))->RightChild 425 426 #define RtlIsRoot(Links) \ 427 (RtlParent(Links) == (PRTL_SPLAY_LINKS)(Links)) 428 429 #define RtlLeftChild(Links) \ 430 ((PRTL_SPLAY_LINKS)(Links))->LeftChild 431 432 #define RtlParent(Links) \ 433 ((PRTL_SPLAY_LINKS)(Links))->Parent 434 435 // FIXME: use inline function 436 437 #define RtlInitializeSplayLinks(Links) \ 438 { \ 439 PRTL_SPLAY_LINKS _SplayLinks; \ 440 _SplayLinks = (PRTL_SPLAY_LINKS)(Links); \ 441 _SplayLinks->Parent = _SplayLinks; \ 442 _SplayLinks->LeftChild = NULL; \ 443 _SplayLinks->RightChild = NULL; \ 444 } 445 446 #define RtlInsertAsLeftChild(ParentLinks,ChildLinks) \ 447 { \ 448 PRTL_SPLAY_LINKS _SplayParent; \ 449 PRTL_SPLAY_LINKS _SplayChild; \ 450 _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \ 451 _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \ 452 _SplayParent->LeftChild = _SplayChild; \ 453 _SplayChild->Parent = _SplayParent; \ 454 } 455 456 #define RtlInsertAsRightChild(ParentLinks,ChildLinks) \ 457 { \ 458 PRTL_SPLAY_LINKS _SplayParent; \ 459 PRTL_SPLAY_LINKS _SplayChild; \ 460 _SplayParent = (PRTL_SPLAY_LINKS)(ParentLinks); \ 461 _SplayChild = (PRTL_SPLAY_LINKS)(ChildLinks); \ 462 _SplayParent->RightChild = _SplayChild; \ 463 _SplayChild->Parent = _SplayParent; \ 464 } 465 466 // 467 // RTL AVL Tree Functions 468 // 469 NTSYSAPI 470 VOID 471 NTAPI 472 RtlInitializeGenericTableAvl( 473 _Out_ PRTL_AVL_TABLE Table, 474 _In_ PRTL_AVL_COMPARE_ROUTINE CompareRoutine, 475 _In_opt_ PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine, 476 _In_opt_ PRTL_AVL_FREE_ROUTINE FreeRoutine, 477 _In_opt_ PVOID TableContext 478 ); 479 480 NTSYSAPI 481 PVOID 482 NTAPI 483 RtlInsertElementGenericTableAvl( 484 _In_ PRTL_AVL_TABLE Table, 485 _In_reads_bytes_(BufferSize) PVOID Buffer, 486 _In_ CLONG BufferSize, 487 _Out_opt_ PBOOLEAN NewElement 488 ); 489 490 NTSYSAPI 491 PVOID 492 NTAPI 493 RtlInsertElementGenericTableFullAvl( 494 _In_ PRTL_AVL_TABLE Table, 495 _In_reads_bytes_(BufferSize) PVOID Buffer, 496 _In_ CLONG BufferSize, 497 _Out_opt_ PBOOLEAN NewElement, 498 _In_ PVOID NodeOrParent, 499 _In_ TABLE_SEARCH_RESULT SearchResult 500 ); 501 502 NTSYSAPI 503 BOOLEAN 504 NTAPI 505 RtlDeleteElementGenericTableAvl( 506 _In_ PRTL_AVL_TABLE Table, 507 _In_ PVOID Buffer 508 ); 509 510 _Must_inspect_result_ 511 NTSYSAPI 512 PVOID 513 NTAPI 514 RtlLookupElementGenericTableAvl( 515 _In_ PRTL_AVL_TABLE Table, 516 _In_ PVOID Buffer 517 ); 518 519 NTSYSAPI 520 PVOID 521 NTAPI 522 RtlLookupElementGenericTableFullAvl( 523 _In_ PRTL_AVL_TABLE Table, 524 _In_ PVOID Buffer, 525 _Out_ PVOID *NodeOrParent, 526 _Out_ TABLE_SEARCH_RESULT *SearchResult 527 ); 528 529 _Must_inspect_result_ 530 NTSYSAPI 531 PVOID 532 NTAPI 533 RtlEnumerateGenericTableAvl( 534 _In_ PRTL_AVL_TABLE Table, 535 _In_ BOOLEAN Restart 536 ); 537 538 _Must_inspect_result_ 539 NTSYSAPI 540 PVOID 541 NTAPI 542 RtlEnumerateGenericTableWithoutSplayingAvl( 543 _In_ PRTL_AVL_TABLE Table, 544 _Inout_ PVOID *RestartKey 545 ); 546 547 _Must_inspect_result_ 548 NTSYSAPI 549 PVOID 550 NTAPI 551 RtlLookupFirstMatchingElementGenericTableAvl( 552 _In_ PRTL_AVL_TABLE Table, 553 _In_ PVOID Buffer, 554 _Out_ PVOID *RestartKey 555 ); 556 557 _Must_inspect_result_ 558 NTSYSAPI 559 PVOID 560 NTAPI 561 RtlEnumerateGenericTableLikeADirectory( 562 _In_ PRTL_AVL_TABLE Table, 563 _In_opt_ PRTL_AVL_MATCH_FUNCTION MatchFunction, 564 _In_opt_ PVOID MatchData, 565 _In_ ULONG NextFlag, 566 _Inout_ PVOID *RestartKey, 567 _Inout_ PULONG DeleteCount, 568 _In_ PVOID Buffer 569 ); 570 571 _Must_inspect_result_ 572 NTSYSAPI 573 PVOID 574 NTAPI 575 RtlGetElementGenericTableAvl( 576 _In_ PRTL_AVL_TABLE Table, 577 _In_ ULONG I 578 ); 579 580 NTSYSAPI 581 ULONG 582 NTAPI 583 RtlNumberGenericTableElementsAvl( 584 _In_ PRTL_AVL_TABLE Table 585 ); 586 587 _Must_inspect_result_ 588 NTSYSAPI 589 BOOLEAN 590 NTAPI 591 RtlIsGenericTableEmptyAvl( 592 _In_ PRTL_AVL_TABLE Table 593 ); 594 595 #ifdef RTL_USE_AVL_TABLES 596 597 #define RtlInitializeGenericTable RtlInitializeGenericTableAvl 598 #define RtlInsertElementGenericTable RtlInsertElementGenericTableAvl 599 #define RtlInsertElementGenericTableFull RtlInsertElementGenericTableFullAvl 600 #define RtlDeleteElementGenericTable RtlDeleteElementGenericTableAvl 601 #define RtlLookupElementGenericTable RtlLookupElementGenericTableAvl 602 #define RtlLookupElementGenericTableFull RtlLookupElementGenericTableFullAvl 603 #define RtlEnumerateGenericTable RtlEnumerateGenericTableAvl 604 #define RtlEnumerateGenericTableWithoutSplaying RtlEnumerateGenericTableWithoutSplayingAvl 605 #define RtlGetElementGenericTable RtlGetElementGenericTableAvl 606 #define RtlNumberGenericTableElements RtlNumberGenericTableElementsAvl 607 #define RtlIsGenericTableEmpty RtlIsGenericTableEmptyAvl 608 609 #endif /* RTL_USE_AVL_TABLES */ 610 611 // 612 // Exception and Error Functions 613 // 614 NTSYSAPI 615 PVOID 616 NTAPI 617 RtlAddVectoredExceptionHandler( 618 _In_ ULONG FirstHandler, 619 _In_ PVECTORED_EXCEPTION_HANDLER VectoredHandler 620 ); 621 622 NTSYSAPI 623 ULONG 624 NTAPI 625 RtlRemoveVectoredExceptionHandler( 626 _In_ PVOID VectoredHandlerHandle 627 ); 628 629 NTSYSAPI 630 PVOID 631 NTAPI 632 RtlAddVectoredContinueHandler( 633 _In_ ULONG FirstHandler, 634 _In_ PVECTORED_EXCEPTION_HANDLER VectoredHandler 635 ); 636 637 NTSYSAPI 638 ULONG 639 NTAPI 640 RtlRemoveVectoredContinueHandler( 641 _In_ PVOID VectoredHandlerHandle 642 ); 643 644 NTSYSAPI 645 VOID 646 NTAPI 647 RtlSetUnhandledExceptionFilter( 648 _In_ PRTLP_UNHANDLED_EXCEPTION_FILTER TopLevelExceptionFilter 649 ); 650 651 NTSYSAPI 652 LONG 653 NTAPI 654 RtlUnhandledExceptionFilter( 655 _In_ struct _EXCEPTION_POINTERS* ExceptionInfo 656 ); 657 658 __analysis_noreturn 659 NTSYSAPI 660 VOID 661 NTAPI 662 RtlAssert( 663 _In_ PVOID FailedAssertion, 664 _In_ PVOID FileName, 665 _In_ ULONG LineNumber, 666 _In_opt_z_ PCHAR Message 667 ); 668 669 NTSYSAPI 670 PVOID 671 NTAPI 672 RtlEncodePointer( 673 _In_ PVOID Pointer 674 ); 675 676 NTSYSAPI 677 PVOID 678 NTAPI 679 RtlDecodePointer( 680 _In_ PVOID Pointer 681 ); 682 683 NTSYSAPI 684 PVOID 685 NTAPI 686 RtlEncodeSystemPointer( 687 _In_ PVOID Pointer 688 ); 689 690 NTSYSAPI 691 PVOID 692 NTAPI 693 RtlDecodeSystemPointer( 694 _In_ PVOID Pointer 695 ); 696 697 NTSYSAPI 698 NTSTATUS 699 NTAPI 700 RtlGetLastNtStatus( 701 VOID 702 ); 703 704 NTSYSAPI 705 ULONG 706 NTAPI 707 RtlGetLastWin32Error( 708 VOID 709 ); 710 711 NTSYSAPI 712 VOID 713 NTAPI 714 RtlSetLastWin32Error( 715 _In_ ULONG LastError 716 ); 717 718 NTSYSAPI 719 VOID 720 NTAPI 721 RtlSetLastWin32ErrorAndNtStatusFromNtStatus( 722 _In_ NTSTATUS Status 723 ); 724 725 NTSYSAPI 726 NTSTATUS 727 NTAPI 728 RtlSetThreadErrorMode( 729 _In_ ULONG NewMode, 730 _Out_opt_ PULONG OldMode 731 ); 732 733 NTSYSAPI 734 ULONG 735 NTAPI 736 RtlGetThreadErrorMode( 737 VOID 738 ); 739 740 #endif /* NTOS_MODE_USER */ 741 742 NTSYSAPI 743 VOID 744 NTAPI 745 RtlCaptureContext( 746 _Out_ PCONTEXT ContextRecord 747 ); 748 749 NTSYSAPI 750 BOOLEAN 751 NTAPI 752 RtlDispatchException( 753 _In_ PEXCEPTION_RECORD ExceptionRecord, 754 _In_ PCONTEXT Context 755 ); 756 757 _IRQL_requires_max_(APC_LEVEL) 758 _When_(Status < 0, _Out_range_(>, 0)) 759 _When_(Status >= 0, _Out_range_(==, 0)) 760 NTSYSAPI 761 ULONG 762 NTAPI 763 RtlNtStatusToDosError( 764 _In_ NTSTATUS Status 765 ); 766 767 _When_(Status < 0, _Out_range_(>, 0)) 768 _When_(Status >= 0, _Out_range_(==, 0)) 769 NTSYSAPI 770 ULONG 771 NTAPI 772 RtlNtStatusToDosErrorNoTeb( 773 _In_ NTSTATUS Status 774 ); 775 776 NTSYSAPI 777 NTSTATUS 778 NTAPI 779 RtlMapSecurityErrorToNtStatus( 780 _In_ ULONG SecurityError 781 ); 782 783 NTSYSAPI 784 VOID 785 NTAPI 786 RtlRaiseException( 787 _In_ PEXCEPTION_RECORD ExceptionRecord 788 ); 789 790 DECLSPEC_NORETURN 791 NTSYSAPI 792 VOID 793 NTAPI 794 RtlRaiseStatus( 795 _In_ NTSTATUS Status 796 ); 797 798 NTSYSAPI 799 VOID 800 NTAPI 801 RtlUnwind( 802 _In_opt_ PVOID TargetFrame, 803 _In_opt_ PVOID TargetIp, 804 _In_opt_ PEXCEPTION_RECORD ExceptionRecord, 805 _In_ PVOID ReturnValue 806 ); 807 808 #define RTL_STACK_WALKING_MODE_FRAMES_TO_SKIP_SHIFT 8 809 810 // 811 // Tracing Functions 812 // 813 NTSYSAPI 814 ULONG 815 NTAPI 816 RtlWalkFrameChain( 817 _Out_writes_(Count - (Flags >> RTL_STACK_WALKING_MODE_FRAMES_TO_SKIP_SHIFT)) PVOID *Callers, 818 _In_ ULONG Count, 819 _In_ ULONG Flags 820 ); 821 822 NTSYSAPI 823 USHORT 824 NTAPI 825 RtlLogStackBackTrace( 826 VOID 827 ); 828 829 #ifdef NTOS_MODE_USER 830 // 831 // Heap Functions 832 // 833 _Must_inspect_result_ 834 _Ret_maybenull_ 835 _Post_writable_byte_size_(Size) 836 NTSYSAPI 837 PVOID 838 NTAPI 839 RtlAllocateHeap( 840 _In_ PVOID HeapHandle, 841 _In_opt_ ULONG Flags, 842 _In_ SIZE_T Size 843 ); 844 845 _Must_inspect_result_ 846 NTSYSAPI 847 PVOID 848 NTAPI 849 RtlCreateHeap( 850 _In_ ULONG Flags, 851 _In_opt_ PVOID BaseAddress, 852 _In_opt_ SIZE_T SizeToReserve, 853 _In_opt_ SIZE_T SizeToCommit, 854 _In_opt_ PVOID Lock, 855 _In_opt_ PRTL_HEAP_PARAMETERS Parameters 856 ); 857 858 NTSYSAPI 859 ULONG 860 NTAPI 861 RtlCreateTagHeap( 862 _In_ HANDLE HeapHandle, 863 _In_ ULONG Flags, 864 _In_ PWSTR TagName, 865 _In_ PWSTR TagSubName 866 ); 867 868 ULONG 869 NTAPI 870 RtlCompactHeap( 871 _In_ HANDLE Heap, 872 _In_ ULONG Flags 873 ); 874 875 _Must_inspect_result_ 876 NTSYSAPI 877 PVOID 878 NTAPI 879 RtlDebugCreateHeap( 880 _In_ ULONG Flags, 881 _In_opt_ PVOID BaseAddress, 882 _In_opt_ SIZE_T SizeToReserve, 883 _In_opt_ SIZE_T SizeToCommit, 884 _In_opt_ PVOID Lock, 885 _In_opt_ PRTL_HEAP_PARAMETERS Parameters 886 ); 887 888 NTSYSAPI 889 HANDLE 890 NTAPI 891 RtlDestroyHeap( 892 _In_ _Post_invalid_ HANDLE Heap 893 ); 894 895 NTSYSAPI 896 ULONG 897 NTAPI 898 RtlExtendHeap( 899 _In_ HANDLE Heap, 900 _In_ ULONG Flags, 901 _In_ PVOID P, 902 _In_ SIZE_T Size 903 ); 904 905 _Success_(return != 0) 906 NTSYSAPI 907 BOOLEAN 908 NTAPI 909 RtlFreeHeap( 910 _In_ HANDLE HeapHandle, 911 _In_opt_ ULONG Flags, 912 _In_ _Post_invalid_ PVOID P 913 ); 914 915 ULONG 916 NTAPI 917 RtlGetProcessHeaps( 918 _In_ ULONG HeapCount, 919 _Out_cap_(HeapCount) HANDLE *HeapArray 920 ); 921 922 _Success_(return != 0) 923 BOOLEAN 924 NTAPI 925 RtlGetUserInfoHeap( 926 _In_ PVOID HeapHandle, 927 _In_ ULONG Flags, 928 _In_ PVOID BaseAddress, 929 _Inout_opt_ PVOID *UserValue, 930 _Out_opt_ PULONG UserFlags 931 ); 932 933 NTSYSAPI 934 PVOID 935 NTAPI 936 RtlProtectHeap( 937 _In_ PVOID HeapHandle, 938 _In_ BOOLEAN Protect 939 ); 940 941 NTSYSAPI 942 NTSTATUS 943 NTAPI 944 RtlQueryHeapInformation( 945 _In_ PVOID HeapHandle, 946 _In_ HEAP_INFORMATION_CLASS HeapInformationClass, 947 _Out_ PVOID HeapInformation, 948 _In_ SIZE_T HeapInformationLength, 949 _When_(HeapInformationClass==HeapCompatibilityInformation, _On_failure_(_Out_opt_)) 950 _Out_opt_ PSIZE_T ReturnLength 951 ); 952 953 _Ret_opt_z_ 954 NTSYSAPI 955 PWSTR 956 NTAPI 957 RtlQueryTagHeap( 958 _In_ PVOID HeapHandle, 959 _In_ ULONG Flags, 960 _In_ USHORT TagIndex, 961 _In_ BOOLEAN ResetCounters, 962 _Out_ PRTL_HEAP_TAG_INFO HeapTagInfo 963 ); 964 965 _Must_inspect_result_ 966 _Ret_maybenull_ 967 _Post_writable_byte_size_(Size) 968 NTSYSAPI 969 PVOID 970 NTAPI 971 RtlReAllocateHeap( 972 _In_ HANDLE Heap, 973 _In_opt_ ULONG Flags, 974 _In_ _Post_invalid_ PVOID Ptr, 975 _In_ SIZE_T Size 976 ); 977 978 NTSYSAPI 979 NTSTATUS 980 NTAPI 981 RtlSetHeapInformation( 982 _In_ PVOID HeapHandle, 983 _In_ HEAP_INFORMATION_CLASS HeapInformationClass, 984 _When_(HeapInformationClass==HeapCompatibilityInformation,_In_) PVOID HeapInformation, 985 _In_ SIZE_T HeapInformationLength 986 ); 987 988 NTSYSAPI 989 BOOLEAN 990 NTAPI 991 RtlLockHeap( 992 _In_ HANDLE Heap 993 ); 994 995 NTSYSAPI 996 ULONG 997 NTAPI 998 RtlMultipleAllocateHeap( 999 _In_ HANDLE HeapHandle, 1000 _In_ ULONG Flags, 1001 _In_ SIZE_T Size, 1002 _In_ ULONG Count, 1003 _Out_cap_(Count) _Deref_post_bytecap_(Size) PVOID * Array 1004 ); 1005 1006 NTSYSAPI 1007 ULONG 1008 NTAPI 1009 RtlMultipleFreeHeap( 1010 _In_ HANDLE HeapHandle, 1011 _In_ ULONG Flags, 1012 _In_ ULONG Count, 1013 _In_count_(Count) /* _Deref_ _Post_invalid_ */ PVOID * Array 1014 ); 1015 1016 NTSYSAPI 1017 NTSTATUS 1018 NTAPI 1019 RtlUsageHeap( 1020 _In_ HANDLE Heap, 1021 _In_ ULONG Flags, 1022 _Out_ PRTL_HEAP_USAGE Usage 1023 ); 1024 1025 NTSYSAPI 1026 BOOLEAN 1027 NTAPI 1028 RtlUnlockHeap( 1029 _In_ HANDLE Heap 1030 ); 1031 1032 BOOLEAN 1033 NTAPI 1034 RtlSetUserValueHeap( 1035 _In_ PVOID HeapHandle, 1036 _In_ ULONG Flags, 1037 _In_ PVOID BaseAddress, 1038 _In_ PVOID UserValue 1039 ); 1040 1041 BOOLEAN 1042 NTAPI 1043 RtlSetUserFlagsHeap( 1044 _In_ PVOID HeapHandle, 1045 _In_ ULONG Flags, 1046 _In_ PVOID BaseAddress, 1047 _In_ ULONG UserFlagsReset, 1048 _In_ ULONG UserFlagsSet 1049 ); 1050 1051 NTSYSAPI 1052 BOOLEAN 1053 NTAPI 1054 RtlValidateHeap( 1055 _In_ HANDLE Heap, 1056 _In_ ULONG Flags, 1057 _In_opt_ PVOID P 1058 ); 1059 1060 NTSYSAPI 1061 NTSTATUS 1062 NTAPI 1063 RtlWalkHeap( 1064 _In_ HANDLE HeapHandle, 1065 _In_ PVOID HeapEntry 1066 ); 1067 1068 #define RtlGetProcessHeap() (NtCurrentPeb()->ProcessHeap) 1069 1070 #endif // NTOS_MODE_USER 1071 1072 #define NtCurrentPeb() (NtCurrentTeb()->ProcessEnvironmentBlock) 1073 1074 NTSYSAPI 1075 SIZE_T 1076 NTAPI 1077 RtlSizeHeap( 1078 _In_ PVOID HeapHandle, 1079 _In_ ULONG Flags, 1080 _In_ PVOID MemoryPointer 1081 ); 1082 1083 1084 // 1085 // Security Functions 1086 // 1087 _IRQL_requires_max_(APC_LEVEL) 1088 NTSYSAPI 1089 NTSTATUS 1090 NTAPI 1091 RtlAbsoluteToSelfRelativeSD( 1092 _In_ PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor, 1093 _Out_writes_bytes_to_opt_(*BufferLength, *BufferLength) PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor, 1094 _Inout_ PULONG BufferLength 1095 ); 1096 1097 _IRQL_requires_max_(APC_LEVEL) 1098 NTSYSAPI 1099 NTSTATUS 1100 NTAPI 1101 RtlAddAccessAllowedAce( 1102 _Inout_ PACL Acl, 1103 _In_ ULONG Revision, 1104 _In_ ACCESS_MASK AccessMask, 1105 _In_ PSID Sid 1106 ); 1107 1108 _IRQL_requires_max_(APC_LEVEL) 1109 NTSYSAPI 1110 NTSTATUS 1111 NTAPI 1112 RtlAddAccessAllowedAceEx( 1113 _Inout_ PACL pAcl, 1114 _In_ ULONG dwAceRevision, 1115 _In_ ULONG AceFlags, 1116 _In_ ACCESS_MASK AccessMask, 1117 _In_ PSID pSid 1118 ); 1119 1120 NTSYSAPI 1121 NTSTATUS 1122 NTAPI 1123 RtlAddAccessAllowedObjectAce( 1124 _Inout_ PACL pAcl, 1125 _In_ ULONG dwAceRevision, 1126 _In_ ULONG AceFlags, 1127 _In_ ACCESS_MASK AccessMask, 1128 _In_opt_ GUID *ObjectTypeGuid, 1129 _In_opt_ GUID *InheritedObjectTypeGuid, 1130 _In_ PSID pSid 1131 ); 1132 1133 NTSYSAPI 1134 NTSTATUS 1135 NTAPI 1136 RtlAddAccessDeniedAce( 1137 _Inout_ PACL Acl, 1138 _In_ ULONG Revision, 1139 _In_ ACCESS_MASK AccessMask, 1140 _In_ PSID Sid 1141 ); 1142 1143 NTSYSAPI 1144 NTSTATUS 1145 NTAPI 1146 RtlAddAccessDeniedAceEx( 1147 _Inout_ PACL Acl, 1148 _In_ ULONG Revision, 1149 _In_ ULONG Flags, 1150 _In_ ACCESS_MASK AccessMask, 1151 _In_ PSID Sid 1152 ); 1153 1154 NTSYSAPI 1155 NTSTATUS 1156 NTAPI 1157 RtlAddAccessDeniedObjectAce( 1158 _Inout_ PACL pAcl, 1159 _In_ ULONG dwAceRevision, 1160 _In_ ULONG AceFlags, 1161 _In_ ACCESS_MASK AccessMask, 1162 _In_opt_ GUID *ObjectTypeGuid, 1163 _In_opt_ GUID *InheritedObjectTypeGuid, 1164 _In_ PSID pSid 1165 ); 1166 1167 NTSYSAPI 1168 NTSTATUS 1169 NTAPI 1170 RtlAddAce( 1171 _Inout_ PACL Acl, 1172 _In_ ULONG AceRevision, 1173 _In_ ULONG StartingAceIndex, 1174 _In_reads_bytes_(AceListLength) PVOID AceList, 1175 _In_ ULONG AceListLength 1176 ); 1177 1178 NTSYSAPI 1179 NTSTATUS 1180 NTAPI 1181 RtlAddAuditAccessAce( 1182 _Inout_ PACL Acl, 1183 _In_ ULONG Revision, 1184 _In_ ACCESS_MASK AccessMask, 1185 _In_ PSID Sid, 1186 _In_ BOOLEAN Success, 1187 _In_ BOOLEAN Failure 1188 ); 1189 1190 NTSYSAPI 1191 NTSTATUS 1192 NTAPI 1193 RtlAcquirePrivilege( 1194 _In_ PULONG Privilege, 1195 _In_ ULONG NumPriv, 1196 _In_ ULONG Flags, 1197 _Out_ PVOID *ReturnedState 1198 ); 1199 1200 NTSYSAPI 1201 NTSTATUS 1202 NTAPI 1203 RtlAddAuditAccessAceEx( 1204 _Inout_ PACL Acl, 1205 _In_ ULONG Revision, 1206 _In_ ULONG Flags, 1207 _In_ ACCESS_MASK AccessMask, 1208 _In_ PSID Sid, 1209 _In_ BOOLEAN Success, 1210 _In_ BOOLEAN Failure 1211 ); 1212 1213 NTSYSAPI 1214 NTSTATUS 1215 NTAPI 1216 RtlAddAuditAccessObjectAce( 1217 _Inout_ PACL Acl, 1218 _In_ ULONG Revision, 1219 _In_ ULONG Flags, 1220 _In_ ACCESS_MASK AccessMask, 1221 _In_opt_ GUID *ObjectTypeGuid, 1222 _In_opt_ GUID *InheritedObjectTypeGuid, 1223 _In_ PSID Sid, 1224 _In_ BOOLEAN Success, 1225 _In_ BOOLEAN Failure 1226 ); 1227 1228 NTSYSAPI 1229 NTSTATUS 1230 NTAPI 1231 RtlAddMandatoryAce( 1232 _Inout_ PACL Acl, 1233 _In_ ULONG Revision, 1234 _In_ ULONG Flags, 1235 _In_ ULONG MandatoryFlags, 1236 _In_ UCHAR AceType, 1237 _In_ PSID LabelSid); 1238 1239 NTSYSAPI 1240 NTSTATUS 1241 NTAPI 1242 RtlAdjustPrivilege( 1243 _In_ ULONG Privilege, 1244 _In_ BOOLEAN NewValue, 1245 _In_ BOOLEAN ForThread, 1246 _Out_ PBOOLEAN OldValue 1247 ); 1248 1249 _Must_inspect_result_ 1250 NTSYSAPI 1251 NTSTATUS 1252 NTAPI 1253 RtlAllocateAndInitializeSid( 1254 _In_ PSID_IDENTIFIER_AUTHORITY IdentifierAuthority, 1255 _In_ UCHAR SubAuthorityCount, 1256 _In_ ULONG SubAuthority0, 1257 _In_ ULONG SubAuthority1, 1258 _In_ ULONG SubAuthority2, 1259 _In_ ULONG SubAuthority3, 1260 _In_ ULONG SubAuthority4, 1261 _In_ ULONG SubAuthority5, 1262 _In_ ULONG SubAuthority6, 1263 _In_ ULONG SubAuthority7, 1264 _Outptr_ PSID *Sid 1265 ); 1266 1267 NTSYSAPI 1268 BOOLEAN 1269 NTAPI 1270 RtlAreAllAccessesGranted( 1271 ACCESS_MASK GrantedAccess, 1272 ACCESS_MASK DesiredAccess 1273 ); 1274 1275 NTSYSAPI 1276 BOOLEAN 1277 NTAPI 1278 RtlAreAnyAccessesGranted( 1279 ACCESS_MASK GrantedAccess, 1280 ACCESS_MASK DesiredAccess 1281 ); 1282 1283 _IRQL_requires_max_(APC_LEVEL) 1284 NTSYSAPI 1285 VOID 1286 NTAPI 1287 RtlCopyLuid ( 1288 _Out_ PLUID DestinationLuid, 1289 _In_ PLUID SourceLuid 1290 ); 1291 1292 NTSYSAPI 1293 VOID 1294 NTAPI 1295 RtlCopyLuidAndAttributesArray( 1296 ULONG Count, 1297 PLUID_AND_ATTRIBUTES Src, 1298 PLUID_AND_ATTRIBUTES Dest 1299 ); 1300 1301 NTSYSAPI 1302 NTSTATUS 1303 NTAPI 1304 RtlCopySidAndAttributesArray( 1305 _In_ ULONG Count, 1306 _In_ PSID_AND_ATTRIBUTES Src, 1307 _In_ ULONG SidAreaSize, 1308 _In_ PSID_AND_ATTRIBUTES Dest, 1309 _In_ PSID SidArea, 1310 _Out_ PSID* RemainingSidArea, 1311 _Out_ PULONG RemainingSidAreaSize 1312 ); 1313 1314 _IRQL_requires_max_(APC_LEVEL) 1315 NTSYSAPI 1316 NTSTATUS 1317 NTAPI 1318 RtlConvertSidToUnicodeString( 1319 _Inout_ PUNICODE_STRING UnicodeString, 1320 _In_ PSID Sid, 1321 _In_ BOOLEAN AllocateDestinationString 1322 ); 1323 1324 _IRQL_requires_max_(APC_LEVEL) 1325 NTSYSAPI 1326 NTSTATUS 1327 NTAPI 1328 RtlCopySid( 1329 _In_ ULONG DestinationSidLength, 1330 _Out_writes_bytes_(DestinationSidLength) PSID DestinationSid, 1331 _In_ PSID SourceSid 1332 ); 1333 1334 NTSYSAPI 1335 NTSTATUS 1336 NTAPI 1337 RtlCreateAcl( 1338 PACL Acl, 1339 ULONG AclSize, 1340 ULONG AclRevision 1341 ); 1342 1343 NTSYSAPI 1344 NTSTATUS 1345 NTAPI 1346 RtlCreateSecurityDescriptor( 1347 _Out_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1348 _In_ ULONG Revision 1349 ); 1350 1351 NTSYSAPI 1352 NTSTATUS 1353 NTAPI 1354 RtlCreateSecurityDescriptorRelative( 1355 _Out_ PISECURITY_DESCRIPTOR_RELATIVE SecurityDescriptor, 1356 _In_ ULONG Revision 1357 ); 1358 1359 NTSYSAPI 1360 NTSTATUS 1361 NTAPI 1362 RtlCopySecurityDescriptor( 1363 _In_ PSECURITY_DESCRIPTOR pSourceSecurityDescriptor, 1364 _Out_ PSECURITY_DESCRIPTOR *pDestinationSecurityDescriptor 1365 ); 1366 1367 NTSYSAPI 1368 NTSTATUS 1369 NTAPI 1370 RtlDeleteAce( 1371 PACL Acl, 1372 ULONG AceIndex 1373 ); 1374 1375 NTSYSAPI 1376 BOOLEAN 1377 NTAPI 1378 RtlEqualPrefixSid( 1379 PSID Sid1, 1380 PSID Sid2 1381 ); 1382 1383 NTSYSAPI 1384 BOOLEAN 1385 NTAPI 1386 RtlEqualSid ( 1387 _In_ PSID Sid1, 1388 _In_ PSID Sid2 1389 ); 1390 1391 NTSYSAPI 1392 BOOLEAN 1393 NTAPI 1394 RtlFirstFreeAce( 1395 PACL Acl, 1396 PACE* Ace 1397 ); 1398 1399 NTSYSAPI 1400 PVOID 1401 NTAPI 1402 RtlFreeSid( 1403 _In_ _Post_invalid_ PSID Sid 1404 ); 1405 1406 NTSYSAPI 1407 NTSTATUS 1408 NTAPI 1409 RtlGetAce( 1410 PACL Acl, 1411 ULONG AceIndex, 1412 PVOID *Ace 1413 ); 1414 1415 NTSYSAPI 1416 NTSTATUS 1417 NTAPI 1418 RtlGetControlSecurityDescriptor( 1419 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1420 _Out_ PSECURITY_DESCRIPTOR_CONTROL Control, 1421 _Out_ PULONG Revision 1422 ); 1423 1424 NTSYSAPI 1425 NTSTATUS 1426 NTAPI 1427 RtlGetDaclSecurityDescriptor( 1428 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1429 _Out_ PBOOLEAN DaclPresent, 1430 _Out_ PACL *Dacl, 1431 _Out_ PBOOLEAN DaclDefaulted 1432 ); 1433 1434 NTSYSAPI 1435 NTSTATUS 1436 NTAPI 1437 RtlGetSaclSecurityDescriptor( 1438 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1439 _Out_ PBOOLEAN SaclPresent, 1440 _Out_ PACL* Sacl, 1441 _Out_ PBOOLEAN SaclDefaulted 1442 ); 1443 1444 NTSYSAPI 1445 NTSTATUS 1446 NTAPI 1447 RtlGetGroupSecurityDescriptor( 1448 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1449 _Out_ PSID *Group, 1450 _Out_ PBOOLEAN GroupDefaulted 1451 ); 1452 1453 NTSYSAPI 1454 NTSTATUS 1455 NTAPI 1456 RtlGetOwnerSecurityDescriptor( 1457 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1458 _Out_ PSID *Owner, 1459 _Out_ PBOOLEAN OwnerDefaulted 1460 ); 1461 1462 NTSYSAPI 1463 BOOLEAN 1464 NTAPI 1465 RtlGetSecurityDescriptorRMControl( 1466 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1467 _Out_ PUCHAR RMControl 1468 ); 1469 1470 NTSYSAPI 1471 PSID_IDENTIFIER_AUTHORITY 1472 NTAPI 1473 RtlIdentifierAuthoritySid(PSID Sid); 1474 1475 NTSYSAPI 1476 NTSTATUS 1477 NTAPI 1478 RtlImpersonateSelf(IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel); 1479 1480 _IRQL_requires_max_(APC_LEVEL) 1481 NTSYSAPI 1482 NTSTATUS 1483 NTAPI 1484 RtlInitializeSid( 1485 _Out_ PSID Sid, 1486 _In_ PSID_IDENTIFIER_AUTHORITY IdentifierAuthority, 1487 _In_ UCHAR SubAuthorityCount 1488 ); 1489 1490 NTSYSAPI 1491 ULONG 1492 NTAPI 1493 RtlLengthRequiredSid(IN ULONG SubAuthorityCount); 1494 1495 _IRQL_requires_max_(APC_LEVEL) 1496 NTSYSAPI 1497 ULONG 1498 NTAPI 1499 RtlLengthSecurityDescriptor( 1500 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor); 1501 1502 NTSYSAPI 1503 ULONG 1504 NTAPI 1505 RtlLengthSid(IN PSID Sid); 1506 1507 NTSYSAPI 1508 NTSTATUS 1509 NTAPI 1510 RtlMakeSelfRelativeSD( 1511 _In_ PSECURITY_DESCRIPTOR AbsoluteSD, 1512 _Out_ PSECURITY_DESCRIPTOR SelfRelativeSD, 1513 _Inout_ PULONG BufferLength); 1514 1515 NTSYSAPI 1516 VOID 1517 NTAPI 1518 RtlMapGenericMask( 1519 PACCESS_MASK AccessMask, 1520 PGENERIC_MAPPING GenericMapping 1521 ); 1522 1523 #ifdef NTOS_MODE_USER 1524 1525 NTSYSAPI 1526 NTSTATUS 1527 NTAPI 1528 RtlQueryInformationAcl( 1529 PACL Acl, 1530 PVOID Information, 1531 ULONG InformationLength, 1532 ACL_INFORMATION_CLASS InformationClass 1533 ); 1534 1535 #endif 1536 1537 NTSYSAPI 1538 VOID 1539 NTAPI 1540 RtlReleasePrivilege( 1541 _In_ PVOID ReturnedState 1542 ); 1543 1544 _IRQL_requires_max_(APC_LEVEL) 1545 NTSYSAPI 1546 NTSTATUS 1547 NTAPI 1548 RtlSelfRelativeToAbsoluteSD( 1549 _In_ PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor, 1550 _Out_writes_bytes_to_opt_(*AbsoluteSecurityDescriptorSize, *AbsoluteSecurityDescriptorSize) PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor, 1551 _Inout_ PULONG AbsoluteSecurityDescriptorSize, 1552 _Out_writes_bytes_to_opt_(*DaclSize, *DaclSize) PACL Dacl, 1553 _Inout_ PULONG DaclSize, 1554 _Out_writes_bytes_to_opt_(*SaclSize, *SaclSize) PACL Sacl, 1555 _Inout_ PULONG SaclSize, 1556 _Out_writes_bytes_to_opt_(*OwnerSize, *OwnerSize) PSID Owner, 1557 _Inout_ PULONG OwnerSize, 1558 _Out_writes_bytes_to_opt_(*PrimaryGroupSize, *PrimaryGroupSize) PSID PrimaryGroup, 1559 _Inout_ PULONG PrimaryGroupSize 1560 ); 1561 1562 NTSYSAPI 1563 NTSTATUS 1564 NTAPI 1565 RtlSelfRelativeToAbsoluteSD2( 1566 _Inout_ PSECURITY_DESCRIPTOR SelfRelativeSD, 1567 _Out_ PULONG BufferSize 1568 ); 1569 1570 NTSYSAPI 1571 NTSTATUS 1572 NTAPI 1573 RtlSetAttributesSecurityDescriptor( 1574 _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1575 _In_ SECURITY_DESCRIPTOR_CONTROL Control, 1576 _Out_ PULONG Revision 1577 ); 1578 1579 NTSYSAPI 1580 NTSTATUS 1581 NTAPI 1582 RtlSetControlSecurityDescriptor( 1583 _In_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1584 _In_ SECURITY_DESCRIPTOR_CONTROL ControlBitsOfInterest, 1585 _In_ SECURITY_DESCRIPTOR_CONTROL ControlBitsToSet 1586 ); 1587 1588 _IRQL_requires_max_(APC_LEVEL) 1589 NTSYSAPI 1590 NTSTATUS 1591 NTAPI 1592 RtlSetDaclSecurityDescriptor( 1593 _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1594 _In_ BOOLEAN DaclPresent, 1595 _In_opt_ PACL Dacl, 1596 _In_opt_ BOOLEAN DaclDefaulted 1597 ); 1598 1599 _IRQL_requires_max_(APC_LEVEL) 1600 NTSYSAPI 1601 NTSTATUS 1602 NTAPI 1603 RtlSetGroupSecurityDescriptor( 1604 _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1605 _In_opt_ PSID Group, 1606 _In_opt_ BOOLEAN GroupDefaulted 1607 ); 1608 1609 #ifdef NTOS_MODE_USER 1610 1611 NTSYSAPI 1612 NTSTATUS 1613 NTAPI 1614 RtlSetInformationAcl( 1615 PACL Acl, 1616 PVOID Information, 1617 ULONG InformationLength, 1618 ACL_INFORMATION_CLASS InformationClass 1619 ); 1620 1621 #endif 1622 1623 _IRQL_requires_max_(APC_LEVEL) 1624 NTSYSAPI 1625 NTSTATUS 1626 NTAPI 1627 RtlSetOwnerSecurityDescriptor( 1628 _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1629 _In_opt_ PSID Owner, 1630 _In_opt_ BOOLEAN OwnerDefaulted 1631 ); 1632 1633 NTSYSAPI 1634 NTSTATUS 1635 NTAPI 1636 RtlSetSaclSecurityDescriptor( 1637 _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1638 _In_ BOOLEAN SaclPresent, 1639 _In_ PACL Sacl, 1640 _In_ BOOLEAN SaclDefaulted 1641 ); 1642 1643 NTSYSAPI 1644 VOID 1645 NTAPI 1646 RtlSetSecurityDescriptorRMControl( 1647 _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, 1648 _In_ PUCHAR RMControl 1649 ); 1650 1651 NTSYSAPI 1652 PUCHAR 1653 NTAPI 1654 RtlSubAuthorityCountSid( 1655 _In_ PSID Sid 1656 ); 1657 1658 NTSYSAPI 1659 PULONG 1660 NTAPI 1661 RtlSubAuthoritySid( 1662 _In_ PSID Sid, 1663 _In_ ULONG SubAuthority 1664 ); 1665 1666 _IRQL_requires_max_(APC_LEVEL) 1667 _Must_inspect_result_ 1668 NTSYSAPI 1669 BOOLEAN 1670 NTAPI 1671 RtlValidRelativeSecurityDescriptor( 1672 _In_reads_bytes_(SecurityDescriptorLength) PSECURITY_DESCRIPTOR SecurityDescriptorInput, 1673 _In_ ULONG SecurityDescriptorLength, 1674 _In_ SECURITY_INFORMATION RequiredInformation 1675 ); 1676 1677 NTSYSAPI 1678 BOOLEAN 1679 NTAPI 1680 RtlValidSecurityDescriptor(IN PSECURITY_DESCRIPTOR SecurityDescriptor); 1681 1682 NTSYSAPI 1683 BOOLEAN 1684 NTAPI 1685 RtlValidSid(IN PSID Sid); 1686 1687 NTSYSAPI 1688 BOOLEAN 1689 NTAPI 1690 RtlValidAcl(PACL Acl); 1691 1692 NTSYSAPI 1693 NTSTATUS 1694 NTAPI 1695 RtlDeleteSecurityObject( 1696 _In_ PSECURITY_DESCRIPTOR *ObjectDescriptor 1697 ); 1698 1699 NTSYSAPI 1700 NTSTATUS 1701 NTAPI 1702 RtlNewSecurityObject( 1703 _In_ PSECURITY_DESCRIPTOR ParentDescriptor, 1704 _In_ PSECURITY_DESCRIPTOR CreatorDescriptor, 1705 _Out_ PSECURITY_DESCRIPTOR *NewDescriptor, 1706 _In_ BOOLEAN IsDirectoryObject, 1707 _In_ HANDLE Token, 1708 _In_ PGENERIC_MAPPING GenericMapping 1709 ); 1710 1711 NTSYSAPI 1712 NTSTATUS 1713 NTAPI 1714 RtlQuerySecurityObject( 1715 _In_ PSECURITY_DESCRIPTOR ObjectDescriptor, 1716 _In_ SECURITY_INFORMATION SecurityInformation, 1717 _Out_ PSECURITY_DESCRIPTOR ResultantDescriptor, 1718 _In_ ULONG DescriptorLength, 1719 _Out_ PULONG ReturnLength 1720 ); 1721 1722 NTSYSAPI 1723 NTSTATUS 1724 NTAPI 1725 RtlSetSecurityObject( 1726 _In_ SECURITY_INFORMATION SecurityInformation, 1727 _In_ PSECURITY_DESCRIPTOR ModificationDescriptor, 1728 _Out_ PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor, 1729 _In_ PGENERIC_MAPPING GenericMapping, 1730 _In_ HANDLE Token 1731 ); 1732 1733 // 1734 // Single-Character Functions 1735 // 1736 NTSYSAPI 1737 NTSTATUS 1738 NTAPI 1739 RtlLargeIntegerToChar( 1740 _In_ PLARGE_INTEGER Value, 1741 _In_ ULONG Base, 1742 _In_ ULONG Length, 1743 _Out_ PCHAR String 1744 ); 1745 1746 NTSYSAPI 1747 CHAR 1748 NTAPI 1749 RtlUpperChar(CHAR Source); 1750 1751 NTSYSAPI 1752 WCHAR 1753 NTAPI 1754 RtlUpcaseUnicodeChar(WCHAR Source); 1755 1756 NTSYSAPI 1757 WCHAR 1758 NTAPI 1759 RtlDowncaseUnicodeChar(IN WCHAR Source); 1760 1761 NTSYSAPI 1762 NTSTATUS 1763 NTAPI 1764 RtlIntegerToChar( 1765 _In_ ULONG Value, 1766 _In_ ULONG Base, 1767 _In_ ULONG Length, 1768 _Out_ PCHAR String 1769 ); 1770 1771 NTSYSAPI 1772 NTSTATUS 1773 NTAPI 1774 RtlIntegerToUnicode( 1775 _In_ ULONG Value, 1776 _In_opt_ ULONG Base, 1777 _In_opt_ ULONG Length, 1778 _Inout_ LPWSTR String 1779 ); 1780 1781 _IRQL_requires_max_(PASSIVE_LEVEL) 1782 _At_(String->MaximumLength, _Const_) 1783 NTSYSAPI 1784 NTSTATUS 1785 NTAPI 1786 RtlIntegerToUnicodeString( 1787 _In_ ULONG Value, 1788 _In_opt_ ULONG Base, 1789 _Inout_ PUNICODE_STRING String 1790 ); 1791 1792 NTSYSAPI 1793 NTSTATUS 1794 NTAPI 1795 RtlCharToInteger( 1796 PCSZ String, 1797 ULONG Base, 1798 PULONG Value 1799 ); 1800 1801 // 1802 // Byte Swap Functions 1803 // 1804 #ifdef NTOS_MODE_USER 1805 1806 unsigned short __cdecl _byteswap_ushort(unsigned short); 1807 unsigned long __cdecl _byteswap_ulong (unsigned long); 1808 unsigned __int64 __cdecl _byteswap_uint64(unsigned __int64); 1809 #ifdef _MSC_VER 1810 #pragma intrinsic(_byteswap_ushort) 1811 #pragma intrinsic(_byteswap_ulong) 1812 #pragma intrinsic(_byteswap_uint64) 1813 #endif // _MSC_VER 1814 #define RtlUshortByteSwap(_x) _byteswap_ushort((USHORT)(_x)) 1815 #define RtlUlongByteSwap(_x) _byteswap_ulong((_x)) 1816 #define RtlUlonglongByteSwap(_x) _byteswap_uint64((_x)) 1817 1818 #endif // NTOS_MODE_USER 1819 1820 // 1821 // Unicode->Ansi String Functions 1822 // 1823 NTSYSAPI 1824 ULONG 1825 NTAPI 1826 RtlxUnicodeStringToAnsiSize(IN PCUNICODE_STRING UnicodeString); 1827 1828 #ifdef NTOS_MODE_USER 1829 1830 #define RtlUnicodeStringToAnsiSize(STRING) ( \ 1831 NLS_MB_CODE_PAGE_TAG ? \ 1832 RtlxUnicodeStringToAnsiSize(STRING) : \ 1833 ((STRING)->Length + sizeof(UNICODE_NULL)) / sizeof(WCHAR) \ 1834 ) 1835 1836 #endif 1837 1838 NTSYSAPI 1839 NTSTATUS 1840 NTAPI 1841 RtlUnicodeStringToAnsiString( 1842 PANSI_STRING DestinationString, 1843 PCUNICODE_STRING SourceString, 1844 BOOLEAN AllocateDestinationString 1845 ); 1846 1847 // 1848 // Unicode->OEM String Functions 1849 // 1850 NTSYSAPI 1851 NTSTATUS 1852 NTAPI 1853 RtlUpcaseUnicodeStringToOemString( 1854 POEM_STRING DestinationString, 1855 PCUNICODE_STRING SourceString, 1856 BOOLEAN AllocateDestinationString 1857 ); 1858 1859 _IRQL_requires_max_(PASSIVE_LEVEL) 1860 _Must_inspect_result_ 1861 //_At_(DestinationString->Buffer, _Post_bytecount_(DestinationString->Length)) 1862 NTSYSAPI 1863 NTSTATUS 1864 NTAPI 1865 RtlUpcaseUnicodeStringToCountedOemString( 1866 _When_(AllocateDestinationString, _Out_ _At_(DestinationString->Buffer, __drv_allocatesMem(Mem))) 1867 _When_(!AllocateDestinationString, _Inout_) 1868 POEM_STRING DestinationString, 1869 _In_ PCUNICODE_STRING SourceString, 1870 _In_ BOOLEAN AllocateDestinationString 1871 ); 1872 1873 NTSYSAPI 1874 NTSTATUS 1875 NTAPI 1876 RtlUnicodeStringToOemString( 1877 POEM_STRING DestinationString, 1878 PCUNICODE_STRING SourceString, 1879 BOOLEAN AllocateDestinationString 1880 ); 1881 1882 NTSYSAPI 1883 NTSTATUS 1884 NTAPI 1885 RtlUpcaseUnicodeToOemN( 1886 PCHAR OemString, 1887 ULONG OemSize, 1888 PULONG ResultSize, 1889 PCWCH UnicodeString, 1890 ULONG UnicodeSize 1891 ); 1892 1893 NTSYSAPI 1894 ULONG 1895 NTAPI 1896 RtlxUnicodeStringToOemSize(IN PCUNICODE_STRING UnicodeString); 1897 1898 #ifdef NTOS_MODE_USER 1899 1900 #define RtlUnicodeStringToOemSize(STRING) ( \ 1901 NLS_MB_OEM_CODE_PAGE_TAG ? \ 1902 RtlxUnicodeStringToOemSize(STRING) : \ 1903 ((STRING)->Length + sizeof(UNICODE_NULL)) / sizeof(WCHAR) \ 1904 ) 1905 1906 #define RtlUnicodeStringToCountedOemSize(STRING) ( \ 1907 (ULONG)(RtlUnicodeStringToOemSize(STRING) - sizeof(ANSI_NULL)) \ 1908 ) 1909 1910 #endif 1911 1912 NTSYSAPI 1913 NTSTATUS 1914 NTAPI 1915 RtlUnicodeToOemN( 1916 PCHAR OemString, 1917 ULONG OemSize, 1918 PULONG ResultSize, 1919 PCWCH UnicodeString, 1920 ULONG UnicodeSize 1921 ); 1922 1923 // 1924 // Unicode->MultiByte String Functions 1925 // 1926 NTSYSAPI 1927 NTSTATUS 1928 NTAPI 1929 RtlUnicodeToMultiByteN( 1930 PCHAR MbString, 1931 ULONG MbSize, 1932 PULONG ResultSize, 1933 PCWCH UnicodeString, 1934 ULONG UnicodeSize 1935 ); 1936 1937 NTSYSAPI 1938 NTSTATUS 1939 NTAPI 1940 RtlUpcaseUnicodeToMultiByteN( 1941 PCHAR MbString, 1942 ULONG MbSize, 1943 PULONG ResultSize, 1944 PCWCH UnicodeString, 1945 ULONG UnicodeSize 1946 ); 1947 1948 NTSYSAPI 1949 NTSTATUS 1950 NTAPI 1951 RtlUnicodeToMultiByteSize( 1952 PULONG MbSize, 1953 PCWCH UnicodeString, 1954 ULONG UnicodeSize 1955 ); 1956 1957 NTSYSAPI 1958 ULONG 1959 NTAPI 1960 RtlxOemStringToUnicodeSize(IN PCOEM_STRING OemString); 1961 1962 // 1963 // OEM to Unicode Functions 1964 // 1965 NTSYSAPI 1966 NTSTATUS 1967 NTAPI 1968 RtlOemStringToUnicodeString( 1969 PUNICODE_STRING DestinationString, 1970 PCOEM_STRING SourceString, 1971 BOOLEAN AllocateDestinationString 1972 ); 1973 1974 _IRQL_requires_max_(PASSIVE_LEVEL) 1975 NTSYSAPI 1976 NTSTATUS 1977 NTAPI 1978 RtlOemToUnicodeN( 1979 _Out_writes_bytes_to_(MaxBytesInUnicodeString, *BytesInUnicodeString) PWCH UnicodeString, 1980 _In_ ULONG MaxBytesInUnicodeString, 1981 _Out_opt_ PULONG BytesInUnicodeString, 1982 _In_reads_bytes_(BytesInOemString) PCCH OemString, 1983 _In_ ULONG BytesInOemString 1984 ); 1985 1986 #ifdef NTOS_MODE_USER 1987 1988 #define RtlOemStringToUnicodeSize(STRING) ( \ 1989 NLS_MB_OEM_CODE_PAGE_TAG ? \ 1990 RtlxOemStringToUnicodeSize(STRING) : \ 1991 ((STRING)->Length + sizeof(ANSI_NULL)) * sizeof(WCHAR) \ 1992 ) 1993 1994 #define RtlOemStringToCountedUnicodeSize(STRING) ( \ 1995 (ULONG)(RtlOemStringToUnicodeSize(STRING) - sizeof(UNICODE_NULL)) \ 1996 ) 1997 1998 #endif 1999 2000 // 2001 // Ansi->Unicode String Functions 2002 // 2003 _IRQL_requires_max_(APC_LEVEL) 2004 NTSYSAPI 2005 WCHAR 2006 NTAPI 2007 RtlAnsiCharToUnicodeChar( 2008 _Inout_ PUCHAR *SourceCharacter); 2009 2010 NTSYSAPI 2011 NTSTATUS 2012 NTAPI 2013 RtlAnsiStringToUnicodeString( 2014 PUNICODE_STRING DestinationString, 2015 PCANSI_STRING SourceString, 2016 BOOLEAN AllocateDestinationString 2017 ); 2018 2019 NTSYSAPI 2020 ULONG 2021 NTAPI 2022 RtlxAnsiStringToUnicodeSize( 2023 PCANSI_STRING AnsiString 2024 ); 2025 2026 #ifdef NTOS_MODE_USER 2027 2028 #define RtlAnsiStringToUnicodeSize(STRING) ( \ 2029 NLS_MB_CODE_PAGE_TAG ? \ 2030 RtlxAnsiStringToUnicodeSize(STRING) : \ 2031 ((STRING)->Length + sizeof(ANSI_NULL)) * sizeof(WCHAR) \ 2032 ) 2033 2034 #endif 2035 2036 NTSYSAPI 2037 BOOLEAN 2038 NTAPI 2039 RtlCreateUnicodeStringFromAsciiz( 2040 _Out_ PUNICODE_STRING Destination, 2041 _In_ PCSZ Source 2042 ); 2043 2044 // 2045 // Unicode String Functions 2046 // 2047 NTSYSAPI 2048 NTSTATUS 2049 NTAPI 2050 RtlAppendUnicodeToString( 2051 PUNICODE_STRING Destination, 2052 PCWSTR Source 2053 ); 2054 2055 NTSYSAPI 2056 NTSTATUS 2057 NTAPI 2058 RtlAppendUnicodeStringToString( 2059 PUNICODE_STRING Destination, 2060 PCUNICODE_STRING Source 2061 ); 2062 2063 NTSYSAPI 2064 LONG 2065 NTAPI 2066 RtlCompareUnicodeString( 2067 PCUNICODE_STRING String1, 2068 PCUNICODE_STRING String2, 2069 BOOLEAN CaseInsensitive 2070 ); 2071 2072 NTSYSAPI 2073 VOID 2074 NTAPI 2075 RtlCopyUnicodeString( 2076 PUNICODE_STRING DestinationString, 2077 PCUNICODE_STRING SourceString 2078 ); 2079 2080 NTSYSAPI 2081 BOOLEAN 2082 NTAPI 2083 RtlCreateUnicodeString( 2084 PUNICODE_STRING DestinationString, 2085 PCWSTR SourceString 2086 ); 2087 2088 #ifdef NTOS_MODE_USER 2089 2090 NTSYSAPI 2091 NTSTATUS 2092 NTAPI 2093 RtlDowncaseUnicodeString( 2094 _Inout_ PUNICODE_STRING UniDest, 2095 _In_ PCUNICODE_STRING UniSource, 2096 _In_ BOOLEAN AllocateDestinationString 2097 ); 2098 2099 NTSYSAPI 2100 NTSTATUS 2101 NTAPI 2102 RtlDuplicateUnicodeString( 2103 _In_ ULONG Flags, 2104 _In_ PCUNICODE_STRING SourceString, 2105 _Out_ PUNICODE_STRING DestinationString 2106 ); 2107 2108 NTSYSAPI 2109 NTSTATUS 2110 NTAPI 2111 RtlFindCharInUnicodeString( 2112 _In_ ULONG Flags, 2113 _In_ PCUNICODE_STRING SearchString, 2114 _In_ PCUNICODE_STRING MatchString, 2115 _Out_ PUSHORT Position 2116 ); 2117 2118 // 2119 // Memory Functions 2120 // 2121 #if defined(_M_AMD64) 2122 2123 FORCEINLINE 2124 VOID 2125 RtlFillMemoryUlong( 2126 _Out_writes_bytes_all_(Length) PVOID Destination, 2127 _In_ SIZE_T Length, 2128 _In_ ULONG Pattern) 2129 { 2130 PULONG Address = (PULONG)Destination; 2131 if ((Length /= 4) != 0) { 2132 if (((ULONG64)Address & 4) != 0) { 2133 *Address = Pattern; 2134 if ((Length -= 1) == 0) { 2135 return; 2136 } 2137 Address += 1; 2138 } 2139 __stosq((PULONG64)(Address), Pattern | ((ULONG64)Pattern << 32), Length / 2); 2140 if ((Length & 1) != 0) Address[Length - 1] = Pattern; 2141 } 2142 return; 2143 } 2144 2145 #define RtlFillMemoryUlonglong(Destination, Length, Pattern) \ 2146 __stosq((PULONG64)(Destination), Pattern, (Length) / 8) 2147 2148 #else 2149 2150 NTSYSAPI 2151 VOID 2152 NTAPI 2153 RtlFillMemoryUlong( 2154 _Out_writes_bytes_all_(Length) PVOID Destination, 2155 _In_ SIZE_T Length, 2156 _In_ ULONG Pattern 2157 ); 2158 2159 NTSYSAPI 2160 VOID 2161 NTAPI 2162 RtlFillMemoryUlonglong( 2163 _Out_ PVOID Destination, 2164 _In_ SIZE_T Length, 2165 _In_ ULONGLONG Pattern 2166 ); 2167 2168 #endif 2169 2170 NTSYSAPI 2171 NTSTATUS 2172 NTAPI 2173 RtlCopyMappedMemory( 2174 _Out_writes_bytes_all_(Size) PVOID Destination, 2175 _In_reads_bytes_(Size) const VOID *Source, 2176 _In_ SIZE_T Size 2177 ); 2178 2179 NTSYSAPI 2180 SIZE_T 2181 NTAPI 2182 RtlCompareMemoryUlong( 2183 _In_ PVOID Source, 2184 _In_ SIZE_T Length, 2185 _In_ ULONG Pattern 2186 ); 2187 2188 #ifndef RtlEqualMemory 2189 #define RtlEqualMemory(Destination, Source, Length) \ 2190 (!memcmp(Destination, Source, Length)) 2191 #endif 2192 2193 #define RtlCopyBytes RtlCopyMemory 2194 #define RtlFillBytes RtlFillMemory 2195 #define RtlZeroBytes RtlZeroMemory 2196 2197 #endif 2198 2199 NTSYSAPI 2200 BOOLEAN 2201 NTAPI 2202 RtlEqualUnicodeString( 2203 PCUNICODE_STRING String1, 2204 PCUNICODE_STRING String2, 2205 BOOLEAN CaseInsensitive 2206 ); 2207 2208 _IRQL_requires_max_(PASSIVE_LEVEL) 2209 NTSYSAPI 2210 VOID 2211 NTAPI 2212 RtlFreeUnicodeString( 2213 _Inout_ _At_(UnicodeString->Buffer, __drv_freesMem(Mem)) 2214 PUNICODE_STRING UnicodeString 2215 ); 2216 2217 NTSYSAPI 2218 VOID 2219 NTAPI 2220 RtlEraseUnicodeString( 2221 _Inout_ PUNICODE_STRING String 2222 ); 2223 2224 NTSYSAPI 2225 NTSTATUS 2226 NTAPI 2227 RtlHashUnicodeString( 2228 _In_ CONST UNICODE_STRING *String, 2229 _In_ BOOLEAN CaseInSensitive, 2230 _In_ ULONG HashAlgorithm, 2231 _Out_ PULONG HashValue 2232 ); 2233 2234 _IRQL_requires_max_(DISPATCH_LEVEL) 2235 _At_(DestinationString->Buffer, _Post_equal_to_(SourceString)) 2236 _When_(SourceString != NULL, 2237 _At_(DestinationString->Length, _Post_equal_to_(_String_length_(SourceString))) 2238 _At_(DestinationString->MaximumLength, _Post_equal_to_(DestinationString->Length + sizeof(CHAR)))) 2239 _When_(SourceString == NULL, 2240 _At_(DestinationString->Length, _Post_equal_to_(0)) 2241 _At_(DestinationString->MaximumLength, _Post_equal_to_(0))) 2242 NTSYSAPI 2243 VOID 2244 NTAPI 2245 RtlInitString( 2246 _Out_ PSTRING DestinationString, 2247 _In_opt_z_ __drv_aliasesMem PCSTR SourceString 2248 ); 2249 2250 _IRQL_requires_max_(DISPATCH_LEVEL) 2251 _At_(DestinationString->Buffer, _Post_equal_to_(SourceString)) 2252 _When_(SourceString != NULL, 2253 _At_(DestinationString->Length, _Post_equal_to_(_String_length_(SourceString) * sizeof(WCHAR))) 2254 _At_(DestinationString->MaximumLength, _Post_equal_to_(DestinationString->Length + sizeof(WCHAR)))) 2255 _When_(SourceString == NULL, 2256 _At_(DestinationString->Length, _Post_equal_to_(0)) 2257 _At_(DestinationString->MaximumLength, _Post_equal_to_(0))) 2258 NTSYSAPI 2259 VOID 2260 NTAPI 2261 RtlInitUnicodeString( 2262 _Out_ PUNICODE_STRING DestinationString, 2263 _In_opt_z_ __drv_aliasesMem PCWSTR SourceString 2264 ); 2265 2266 _IRQL_requires_max_(DISPATCH_LEVEL) 2267 NTSYSAPI 2268 NTSTATUS 2269 NTAPI 2270 RtlInitUnicodeStringEx( 2271 _Out_ PUNICODE_STRING DestinationString, 2272 _In_opt_z_ __drv_aliasesMem PCWSTR SourceString 2273 ); 2274 2275 NTSYSAPI 2276 BOOLEAN 2277 NTAPI 2278 RtlIsTextUnicode( 2279 _In_ CONST VOID* Buffer, 2280 _In_ INT Size, 2281 _Inout_opt_ INT* Flags 2282 ); 2283 2284 _IRQL_requires_max_(PASSIVE_LEVEL) 2285 _Must_inspect_result_ 2286 NTSYSAPI 2287 BOOLEAN 2288 NTAPI 2289 RtlPrefixString( 2290 _In_ const STRING *String1, 2291 _In_ const STRING *String2, 2292 _In_ BOOLEAN CaseInsensitive 2293 ); 2294 2295 _IRQL_requires_max_(PASSIVE_LEVEL) 2296 _Must_inspect_result_ 2297 NTSYSAPI 2298 BOOLEAN 2299 NTAPI 2300 RtlPrefixUnicodeString( 2301 _In_ PCUNICODE_STRING String1, 2302 _In_ PCUNICODE_STRING String2, 2303 _In_ BOOLEAN CaseInsensitive 2304 ); 2305 2306 _IRQL_requires_max_(PASSIVE_LEVEL) 2307 NTSYSAPI 2308 VOID 2309 NTAPI 2310 RtlUpperString( 2311 _Inout_ PSTRING DestinationString, 2312 _In_ const STRING *SourceString 2313 ); 2314 2315 _IRQL_requires_max_(PASSIVE_LEVEL) 2316 _Must_inspect_result_ 2317 NTSYSAPI 2318 LONG 2319 NTAPI 2320 RtlCompareString( 2321 _In_ const STRING *String1, 2322 _In_ const STRING *String2, 2323 _In_ BOOLEAN CaseInSensitive 2324 ); 2325 2326 NTSYSAPI 2327 VOID 2328 NTAPI 2329 RtlCopyString( 2330 _Out_ PSTRING DestinationString, 2331 _In_opt_ const STRING *SourceString 2332 ); 2333 2334 _IRQL_requires_max_(PASSIVE_LEVEL) 2335 _Must_inspect_result_ 2336 NTSYSAPI 2337 BOOLEAN 2338 NTAPI 2339 RtlEqualString( 2340 _In_ const STRING *String1, 2341 _In_ const STRING *String2, 2342 _In_ BOOLEAN CaseInSensitive 2343 ); 2344 2345 _IRQL_requires_max_(APC_LEVEL) 2346 NTSYSAPI 2347 NTSTATUS 2348 NTAPI 2349 RtlAppendStringToString( 2350 _Inout_ PSTRING Destination, 2351 _In_ const STRING *Source 2352 ); 2353 2354 _IRQL_requires_max_(PASSIVE_LEVEL) 2355 _When_(AllocateDestinationString, _Must_inspect_result_) 2356 NTSYSAPI 2357 NTSTATUS 2358 NTAPI 2359 RtlUpcaseUnicodeString( 2360 _When_(AllocateDestinationString, _Out_ _At_(DestinationString->Buffer, __drv_allocatesMem(Mem))) 2361 _When_(!AllocateDestinationString, _Inout_) 2362 PUNICODE_STRING DestinationString, 2363 _In_ PCUNICODE_STRING SourceString, 2364 _In_ BOOLEAN AllocateDestinationString 2365 ); 2366 2367 _IRQL_requires_max_(PASSIVE_LEVEL) 2368 NTSYSAPI 2369 NTSTATUS 2370 NTAPI 2371 RtlUnicodeStringToInteger( 2372 _In_ PCUNICODE_STRING String, 2373 _In_opt_ ULONG Base, 2374 _Out_ PULONG Value 2375 ); 2376 2377 NTSYSAPI 2378 NTSTATUS 2379 NTAPI 2380 RtlValidateUnicodeString( 2381 _In_ ULONG Flags, 2382 _In_ PCUNICODE_STRING String 2383 ); 2384 2385 #define RTL_SKIP_BUFFER_COPY 0x00000001 2386 2387 NTSYSAPI 2388 NTSTATUS 2389 NTAPI 2390 RtlpEnsureBufferSize( 2391 _In_ ULONG Flags, 2392 _Inout_ PRTL_BUFFER Buffer, 2393 _In_ SIZE_T RequiredSize 2394 ); 2395 2396 #ifdef NTOS_MODE_USER 2397 2398 FORCEINLINE 2399 VOID 2400 RtlInitBuffer( 2401 _Inout_ PRTL_BUFFER Buffer, 2402 _In_ PUCHAR Data, 2403 _In_ ULONG DataSize 2404 ) 2405 { 2406 Buffer->Buffer = Buffer->StaticBuffer = Data; 2407 Buffer->Size = Buffer->StaticSize = DataSize; 2408 Buffer->ReservedForAllocatedSize = 0; 2409 Buffer->ReservedForIMalloc = NULL; 2410 } 2411 2412 FORCEINLINE 2413 NTSTATUS 2414 RtlEnsureBufferSize( 2415 _In_ ULONG Flags, 2416 _Inout_ PRTL_BUFFER Buffer, 2417 _In_ ULONG RequiredSize 2418 ) 2419 { 2420 if (Buffer && RequiredSize <= Buffer->Size) 2421 return STATUS_SUCCESS; 2422 return RtlpEnsureBufferSize(Flags, Buffer, RequiredSize); 2423 } 2424 2425 FORCEINLINE 2426 VOID 2427 RtlFreeBuffer( 2428 _Inout_ PRTL_BUFFER Buffer 2429 ) 2430 { 2431 if (Buffer->Buffer != Buffer->StaticBuffer && Buffer->Buffer) 2432 RtlFreeHeap(RtlGetProcessHeap(), 0, Buffer->Buffer); 2433 Buffer->Buffer = Buffer->StaticBuffer; 2434 Buffer->Size = Buffer->StaticSize; 2435 } 2436 2437 NTSYSAPI 2438 VOID 2439 NTAPI 2440 RtlRunEncodeUnicodeString( 2441 _Inout_ PUCHAR Hash, 2442 _Inout_ PUNICODE_STRING String 2443 ); 2444 2445 NTSYSAPI 2446 VOID 2447 NTAPI 2448 RtlRunDecodeUnicodeString( 2449 _In_ UCHAR Hash, 2450 _Inout_ PUNICODE_STRING String 2451 ); 2452 2453 #endif /* NTOS_MODE_USER */ 2454 2455 // 2456 // Ansi String Functions 2457 // 2458 _IRQL_requires_max_(PASSIVE_LEVEL) 2459 NTSYSAPI 2460 VOID 2461 NTAPI 2462 RtlFreeAnsiString( 2463 _Inout_ _At_(AnsiString->Buffer, __drv_freesMem(Mem)) 2464 PANSI_STRING AnsiString 2465 ); 2466 2467 _IRQL_requires_max_(DISPATCH_LEVEL) 2468 NTSYSAPI 2469 VOID 2470 NTAPI 2471 RtlInitAnsiString( 2472 _Out_ PANSI_STRING DestinationString, 2473 _In_opt_z_ __drv_aliasesMem PCSZ SourceString 2474 ); 2475 2476 _IRQL_requires_max_(DISPATCH_LEVEL) 2477 NTSYSAPI 2478 NTSTATUS 2479 NTAPI 2480 RtlInitAnsiStringEx( 2481 _Out_ PANSI_STRING DestinationString, 2482 _In_opt_z_ __drv_aliasesMem PCSZ SourceString 2483 ); 2484 2485 // 2486 // OEM String Functions 2487 // 2488 _IRQL_requires_max_(PASSIVE_LEVEL) 2489 NTSYSAPI 2490 VOID 2491 NTAPI 2492 RtlFreeOemString( 2493 _Inout_ _At_(OemString->Buffer, __drv_freesMem(Mem)) 2494 POEM_STRING OemString 2495 ); 2496 2497 // 2498 // MultiByte->Unicode String Functions 2499 // 2500 _IRQL_requires_max_(PASSIVE_LEVEL) 2501 NTSYSAPI 2502 NTSTATUS 2503 NTAPI 2504 RtlMultiByteToUnicodeN( 2505 _Out_writes_bytes_to_(MaxBytesInUnicodeString, *BytesInUnicodeString) PWCH UnicodeString, 2506 _In_ ULONG MaxBytesInUnicodeString, 2507 _Out_opt_ PULONG BytesInUnicodeString, 2508 _In_reads_bytes_(BytesInMultiByteString) const CHAR *MultiByteString, 2509 _In_ ULONG BytesInMultiByteString 2510 ); 2511 2512 _IRQL_requires_max_(PASSIVE_LEVEL) 2513 NTSYSAPI 2514 NTSTATUS 2515 NTAPI 2516 RtlMultiByteToUnicodeSize( 2517 _Out_ PULONG BytesInUnicodeString, 2518 _In_reads_bytes_(BytesInMultiByteString) const CHAR *MultiByteString, 2519 _In_ ULONG BytesInMultiByteString 2520 ); 2521 2522 // 2523 // Atom Functions 2524 // 2525 NTSYSAPI 2526 NTSTATUS 2527 NTAPI 2528 RtlAddAtomToAtomTable( 2529 _In_ PRTL_ATOM_TABLE AtomTable, 2530 _In_ PWSTR AtomName, 2531 _Out_ PRTL_ATOM Atom 2532 ); 2533 2534 NTSYSAPI 2535 NTSTATUS 2536 NTAPI 2537 RtlCreateAtomTable( 2538 _In_ ULONG TableSize, 2539 _Inout_ PRTL_ATOM_TABLE *AtomTable 2540 ); 2541 2542 NTSYSAPI 2543 NTSTATUS 2544 NTAPI 2545 RtlDeleteAtomFromAtomTable( 2546 _In_ PRTL_ATOM_TABLE AtomTable, 2547 _In_ RTL_ATOM Atom 2548 ); 2549 2550 NTSYSAPI 2551 NTSTATUS 2552 NTAPI 2553 RtlDestroyAtomTable(IN PRTL_ATOM_TABLE AtomTable); 2554 2555 NTSYSAPI 2556 NTSTATUS 2557 NTAPI 2558 RtlQueryAtomInAtomTable( 2559 _In_ PRTL_ATOM_TABLE AtomTable, 2560 _In_ RTL_ATOM Atom, 2561 _Out_opt_ PULONG RefCount, 2562 _Out_opt_ PULONG PinCount, 2563 _Out_opt_z_bytecap_(*NameLength) PWSTR AtomName, 2564 _Inout_opt_ PULONG NameLength 2565 ); 2566 2567 NTSYSAPI 2568 NTSTATUS 2569 NTAPI 2570 RtlPinAtomInAtomTable( 2571 _In_ PRTL_ATOM_TABLE AtomTable, 2572 _In_ RTL_ATOM Atom 2573 ); 2574 2575 NTSYSAPI 2576 NTSTATUS 2577 NTAPI 2578 RtlLookupAtomInAtomTable( 2579 _In_ PRTL_ATOM_TABLE AtomTable, 2580 _In_ PWSTR AtomName, 2581 _Out_ PRTL_ATOM Atom 2582 ); 2583 2584 // 2585 // Process Management Functions 2586 // 2587 NTSYSAPI 2588 PPEB 2589 NTAPI 2590 RtlGetCurrentPeb( 2591 VOID 2592 ); 2593 2594 NTSYSAPI 2595 VOID 2596 NTAPI 2597 RtlAcquirePebLock(VOID); 2598 2599 NTSYSAPI 2600 NTSTATUS 2601 NTAPI 2602 RtlCreateProcessParameters ( 2603 _Out_ PRTL_USER_PROCESS_PARAMETERS *ProcessParameters, 2604 _In_ PUNICODE_STRING ImagePathName, 2605 _In_opt_ PUNICODE_STRING DllPath, 2606 _In_opt_ PUNICODE_STRING CurrentDirectory, 2607 _In_opt_ PUNICODE_STRING CommandLine, 2608 _In_opt_ PWSTR Environment, 2609 _In_opt_ PUNICODE_STRING WindowTitle, 2610 _In_opt_ PUNICODE_STRING DesktopInfo, 2611 _In_opt_ PUNICODE_STRING ShellInfo, 2612 _In_opt_ PUNICODE_STRING RuntimeInfo 2613 ); 2614 2615 NTSYSAPI 2616 NTSTATUS 2617 NTAPI 2618 RtlCreateUserProcess( 2619 _In_ PUNICODE_STRING ImageFileName, 2620 _In_ ULONG Attributes, 2621 _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters, 2622 _In_opt_ PSECURITY_DESCRIPTOR ProcessSecutityDescriptor, 2623 _In_opt_ PSECURITY_DESCRIPTOR ThreadSecurityDescriptor, 2624 _In_opt_ HANDLE ParentProcess, 2625 _In_ BOOLEAN CurrentDirectory, 2626 _In_opt_ HANDLE DebugPort, 2627 _In_opt_ HANDLE ExceptionPort, 2628 _Out_ PRTL_USER_PROCESS_INFORMATION ProcessInfo 2629 ); 2630 2631 #if (NTDDI_VERSION >= NTDDI_WIN7) 2632 NTSYSAPI 2633 NTSTATUS 2634 NTAPI 2635 RtlCreateUserThread( 2636 _In_ PVOID ThreadContext, 2637 _Out_ HANDLE *OutThreadHandle, 2638 _Reserved_ PVOID Reserved1, 2639 _Reserved_ PVOID Reserved2, 2640 _Reserved_ PVOID Reserved3, 2641 _Reserved_ PVOID Reserved4, 2642 _Reserved_ PVOID Reserved5, 2643 _Reserved_ PVOID Reserved6, 2644 _Reserved_ PVOID Reserved7, 2645 _Reserved_ PVOID Reserved8 2646 ); 2647 #else 2648 NTSYSAPI 2649 NTSTATUS 2650 NTAPI 2651 RtlCreateUserThread( 2652 _In_ HANDLE ProcessHandle, 2653 _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor, 2654 _In_ BOOLEAN CreateSuspended, 2655 _In_ ULONG StackZeroBits, 2656 _In_ SIZE_T StackReserve, 2657 _In_ SIZE_T StackCommit, 2658 _In_ PTHREAD_START_ROUTINE StartAddress, 2659 _In_ PVOID Parameter, 2660 _Out_opt_ PHANDLE ThreadHandle, 2661 _Out_opt_ PCLIENT_ID ClientId 2662 ); 2663 #endif 2664 2665 NTSYSAPI 2666 PRTL_USER_PROCESS_PARAMETERS 2667 NTAPI 2668 RtlDeNormalizeProcessParams( 2669 _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters); 2670 2671 NTSYSAPI 2672 NTSTATUS 2673 NTAPI 2674 RtlDestroyProcessParameters( 2675 _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters); 2676 2677 NTSYSAPI 2678 VOID 2679 NTAPI 2680 RtlExitUserThread( 2681 _In_ NTSTATUS Status); 2682 2683 NTSYSAPI 2684 VOID 2685 NTAPI 2686 RtlInitializeContext( 2687 _In_ HANDLE ProcessHandle, 2688 _Out_ PCONTEXT ThreadContext, 2689 _In_opt_ PVOID ThreadStartParam, 2690 _In_ PTHREAD_START_ROUTINE ThreadStartAddress, 2691 _In_ PINITIAL_TEB InitialTeb 2692 ); 2693 2694 #ifdef _M_AMD64 2695 typedef struct _WOW64_CONTEXT *PWOW64_CONTEXT; 2696 2697 NTSYSAPI 2698 NTSTATUS 2699 NTAPI 2700 RtlWow64GetThreadContext( 2701 _In_ HANDLE ThreadHandle, 2702 _Inout_ PWOW64_CONTEXT ThreadContext 2703 ); 2704 2705 2706 NTSYSAPI 2707 NTSTATUS 2708 NTAPI 2709 RtlWow64SetThreadContext( 2710 _In_ HANDLE ThreadHandle, 2711 _In_ PWOW64_CONTEXT ThreadContext 2712 ); 2713 #endif 2714 2715 NTSYSAPI 2716 BOOLEAN 2717 NTAPI 2718 RtlIsThreadWithinLoaderCallout(VOID); 2719 2720 NTSYSAPI 2721 PRTL_USER_PROCESS_PARAMETERS 2722 NTAPI 2723 RtlNormalizeProcessParams( 2724 _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters); 2725 2726 NTSYSAPI 2727 VOID 2728 NTAPI 2729 RtlReleasePebLock(VOID); 2730 2731 NTSYSAPI 2732 NTSTATUS 2733 NTAPI 2734 RtlRemoteCall( 2735 _In_ HANDLE Process, 2736 _In_ HANDLE Thread, 2737 _In_ PVOID CallSite, 2738 _In_ ULONG ArgumentCount, 2739 _In_ PULONG Arguments, 2740 _In_ BOOLEAN PassContext, 2741 _In_ BOOLEAN AlreadySuspended 2742 ); 2743 2744 NTSYSAPI 2745 NTSTATUS 2746 __cdecl 2747 RtlSetProcessIsCritical( 2748 _In_ BOOLEAN NewValue, 2749 _Out_opt_ PBOOLEAN OldValue, 2750 _In_ BOOLEAN NeedBreaks 2751 ); 2752 2753 NTSYSAPI 2754 NTSTATUS 2755 __cdecl 2756 RtlSetThreadIsCritical( 2757 _In_ BOOLEAN NewValue, 2758 _Out_opt_ PBOOLEAN OldValue, 2759 _In_ BOOLEAN NeedBreaks 2760 ); 2761 2762 NTSYSAPI 2763 ULONG 2764 NTAPI 2765 RtlGetCurrentProcessorNumber( 2766 VOID 2767 ); 2768 2769 2770 // 2771 // Thread Pool Functions 2772 // 2773 // 2774 NTSTATUS 2775 NTAPI 2776 RtlSetThreadPoolStartFunc( 2777 _In_ PRTL_START_POOL_THREAD StartPoolThread, 2778 _In_ PRTL_EXIT_POOL_THREAD ExitPoolThread 2779 ); 2780 2781 NTSYSAPI 2782 NTSTATUS 2783 NTAPI 2784 RtlDeregisterWaitEx( 2785 _In_ HANDLE hWaitHandle, 2786 _In_opt_ HANDLE hCompletionEvent 2787 ); 2788 2789 NTSYSAPI 2790 NTSTATUS 2791 NTAPI 2792 RtlDeregisterWait( 2793 _In_ HANDLE hWaitHandle 2794 ); 2795 2796 NTSYSAPI 2797 NTSTATUS 2798 NTAPI 2799 RtlQueueWorkItem( 2800 _In_ WORKERCALLBACKFUNC Function, 2801 _In_opt_ PVOID Context, 2802 _In_ ULONG Flags 2803 ); 2804 2805 NTSYSAPI 2806 NTSTATUS 2807 NTAPI 2808 RtlSetIoCompletionCallback( 2809 _In_ HANDLE FileHandle, 2810 _In_ PIO_APC_ROUTINE Callback, 2811 _In_ ULONG Flags 2812 ); 2813 2814 NTSYSAPI 2815 NTSTATUS 2816 NTAPI 2817 RtlRegisterWait( 2818 _In_ PHANDLE phNewWaitObject, 2819 _In_ HANDLE hObject, 2820 _In_ WAITORTIMERCALLBACKFUNC Callback, 2821 _In_ PVOID pvContext, 2822 _In_ ULONG ulMilliseconds, 2823 _In_ ULONG ulFlags 2824 ); 2825 2826 // 2827 // Environment/Path Functions 2828 // 2829 NTSYSAPI 2830 NTSTATUS 2831 NTAPI 2832 RtlCreateEnvironment( 2833 _In_ BOOLEAN Inherit, 2834 _Out_ PWSTR *Environment 2835 ); 2836 2837 NTSYSAPI 2838 NTSTATUS 2839 NTAPI 2840 RtlComputePrivatizedDllName_U( 2841 _In_ PUNICODE_STRING DllName, 2842 _Inout_ PUNICODE_STRING RealName, 2843 _Inout_ PUNICODE_STRING LocalName 2844 ); 2845 2846 NTSYSAPI 2847 VOID 2848 NTAPI 2849 RtlDestroyEnvironment( 2850 _In_ PWSTR Environment 2851 ); 2852 2853 NTSYSAPI 2854 BOOLEAN 2855 NTAPI 2856 RtlDoesFileExists_U( 2857 _In_ PCWSTR FileName 2858 ); 2859 2860 NTSYSAPI 2861 RTL_PATH_TYPE 2862 NTAPI 2863 RtlDetermineDosPathNameType_U( 2864 _In_ PCWSTR Path 2865 ); 2866 2867 NTSYSAPI 2868 ULONG 2869 NTAPI 2870 RtlDosSearchPath_U( 2871 _In_ PCWSTR Path, 2872 _In_ PCWSTR FileName, 2873 _In_ PCWSTR Extension, 2874 _In_ ULONG BufferSize, 2875 _Out_ PWSTR Buffer, 2876 _Out_ PWSTR *PartName 2877 ); 2878 2879 NTSYSAPI 2880 NTSTATUS 2881 NTAPI 2882 RtlDosSearchPath_Ustr( 2883 _In_ ULONG Flags, 2884 _In_ PUNICODE_STRING PathString, 2885 _In_ PUNICODE_STRING FileNameString, 2886 _In_ PUNICODE_STRING ExtensionString, 2887 _In_ PUNICODE_STRING CallerBuffer, 2888 _Inout_opt_ PUNICODE_STRING DynamicString, 2889 _Out_opt_ PUNICODE_STRING* FullNameOut, 2890 _Out_opt_ PSIZE_T FilePartSize, 2891 _Out_opt_ PSIZE_T LengthNeeded 2892 ); 2893 2894 NTSYSAPI 2895 BOOLEAN 2896 NTAPI 2897 RtlDosPathNameToNtPathName_U( 2898 _In_opt_z_ PCWSTR DosPathName, 2899 _Out_ PUNICODE_STRING NtPathName, 2900 _Out_opt_ PCWSTR *NtFileNamePart, 2901 _Out_opt_ PRTL_RELATIVE_NAME_U DirectoryInfo 2902 ); 2903 2904 2905 #define RTL_UNCHANGED_UNK_PATH 1 2906 #define RTL_CONVERTED_UNC_PATH 2 2907 #define RTL_CONVERTED_NT_PATH 3 2908 #define RTL_UNCHANGED_DOS_PATH 4 2909 2910 NTSYSAPI 2911 NTSTATUS 2912 NTAPI 2913 RtlNtPathNameToDosPathName( 2914 _In_ ULONG Flags, 2915 _Inout_ PRTL_UNICODE_STRING_BUFFER Path, 2916 _Out_opt_ PULONG PathType, 2917 _Out_opt_ PULONG Unknown 2918 ); 2919 2920 2921 NTSYSAPI 2922 BOOLEAN 2923 NTAPI 2924 RtlDosPathNameToRelativeNtPathName_U( 2925 _In_ PCWSTR DosName, 2926 _Out_ PUNICODE_STRING NtName, 2927 _Out_ PCWSTR *PartName, 2928 _Out_ PRTL_RELATIVE_NAME_U RelativeName 2929 ); 2930 2931 _At_(Destination->Buffer, _Out_bytecap_(Destination->MaximumLength)) 2932 NTSYSAPI 2933 NTSTATUS 2934 NTAPI 2935 RtlExpandEnvironmentStrings_U( 2936 _In_z_ PWSTR Environment, 2937 _In_ PUNICODE_STRING Source, 2938 _Inout_ PUNICODE_STRING Destination, 2939 _Out_ PULONG Length 2940 ); 2941 2942 NTSYSAPI 2943 ULONG 2944 NTAPI 2945 RtlGetCurrentDirectory_U( 2946 _In_ ULONG MaximumLength, 2947 _Out_bytecap_(MaximumLength) PWSTR Buffer 2948 ); 2949 2950 NTSYSAPI 2951 ULONG 2952 NTAPI 2953 RtlGetFullPathName_U( 2954 _In_ PCWSTR FileName, 2955 _In_ ULONG Size, 2956 _Out_z_bytecap_(Size) PWSTR Buffer, 2957 _Out_opt_ PWSTR *ShortName 2958 ); 2959 2960 #if (NTDDI_VERSION >= NTDDI_WIN7) 2961 NTSYSAPI 2962 NTSTATUS 2963 NTAPI 2964 RtlGetFullPathName_UEx( 2965 _In_ PWSTR FileName, 2966 _In_ ULONG BufferLength, 2967 _Out_ PWSTR Buffer, 2968 _Out_opt_ PWSTR *FilePart, 2969 _Out_opt_ RTL_PATH_TYPE *InputPathType 2970 ); 2971 #endif 2972 2973 NTSTATUS 2974 NTAPI 2975 RtlGetFullPathName_UstrEx( 2976 _In_ PUNICODE_STRING FileName, 2977 _In_opt_ PUNICODE_STRING StaticString, 2978 _In_opt_ PUNICODE_STRING DynamicString, 2979 _Out_opt_ PUNICODE_STRING *StringUsed, 2980 _Out_opt_ PSIZE_T FilePartSize, 2981 _Out_opt_ PBOOLEAN NameInvalid, 2982 _Out_ RTL_PATH_TYPE* PathType, 2983 _Out_opt_ PSIZE_T LengthNeeded 2984 ); 2985 2986 NTSYSAPI 2987 NTSTATUS 2988 NTAPI 2989 RtlGetLengthWithoutTrailingPathSeperators( 2990 _Reserved_ ULONG Flags, 2991 _In_ PCUNICODE_STRING PathString, 2992 _Out_ PULONG Length 2993 ); 2994 2995 NTSYSAPI 2996 ULONG 2997 NTAPI 2998 RtlGetLongestNtPathLength( 2999 VOID 3000 ); 3001 3002 NTSYSAPI 3003 ULONG 3004 NTAPI 3005 RtlIsDosDeviceName_U( 3006 _In_ PCWSTR Name 3007 ); 3008 3009 NTSYSAPI 3010 ULONG 3011 NTAPI 3012 RtlIsDosDeviceName_Ustr( 3013 _In_ PCUNICODE_STRING Name 3014 ); 3015 3016 _IRQL_requires_max_(PASSIVE_LEVEL) 3017 _Must_inspect_result_ 3018 NTSYSAPI 3019 BOOLEAN 3020 NTAPI 3021 RtlIsNameLegalDOS8Dot3( 3022 _In_ PCUNICODE_STRING Name, 3023 _Inout_opt_ POEM_STRING OemName, 3024 _Out_opt_ PBOOLEAN NameContainsSpaces 3025 ); 3026 3027 NTSYSAPI 3028 NTSTATUS 3029 NTAPI 3030 RtlQueryEnvironmentVariable_U( 3031 _In_opt_ PWSTR Environment, 3032 _In_ PCUNICODE_STRING Name, 3033 _Out_ PUNICODE_STRING Value 3034 ); 3035 3036 VOID 3037 NTAPI 3038 RtlReleaseRelativeName( 3039 _In_ PRTL_RELATIVE_NAME_U RelativeName 3040 ); 3041 3042 NTSYSAPI 3043 NTSTATUS 3044 NTAPI 3045 RtlSetCurrentDirectory_U( 3046 _In_ PUNICODE_STRING name 3047 ); 3048 3049 NTSYSAPI 3050 NTSTATUS 3051 NTAPI 3052 RtlSetEnvironmentVariable( 3053 _In_z_ PWSTR *Environment, 3054 _In_ PUNICODE_STRING Name, 3055 _In_ PUNICODE_STRING Value 3056 ); 3057 3058 // 3059 // Critical Section/Resource Functions 3060 // 3061 NTSYSAPI 3062 NTSTATUS 3063 NTAPI 3064 RtlDeleteCriticalSection ( 3065 _In_ PRTL_CRITICAL_SECTION CriticalSection 3066 ); 3067 3068 NTSYSAPI 3069 NTSTATUS 3070 NTAPI 3071 RtlEnterCriticalSection( 3072 _In_ PRTL_CRITICAL_SECTION CriticalSection 3073 ); 3074 3075 NTSYSAPI 3076 NTSTATUS 3077 NTAPI 3078 RtlInitializeCriticalSection( 3079 _In_ PRTL_CRITICAL_SECTION CriticalSection 3080 ); 3081 3082 NTSYSAPI 3083 NTSTATUS 3084 NTAPI 3085 RtlInitializeCriticalSectionAndSpinCount( 3086 _In_ PRTL_CRITICAL_SECTION CriticalSection, 3087 _In_ ULONG SpinCount 3088 ); 3089 3090 NTSYSAPI 3091 ULONG 3092 NTAPI 3093 RtlIsCriticalSectionLocked( 3094 _In_ PRTL_CRITICAL_SECTION CriticalSection 3095 ); 3096 3097 NTSYSAPI 3098 ULONG 3099 NTAPI 3100 RtlIsCriticalSectionLockedByThread( 3101 _In_ PRTL_CRITICAL_SECTION CriticalSection 3102 ); 3103 3104 NTSYSAPI 3105 NTSTATUS 3106 NTAPI 3107 RtlLeaveCriticalSection( 3108 _In_ PRTL_CRITICAL_SECTION CriticalSection 3109 ); 3110 3111 NTSYSAPI 3112 BOOLEAN 3113 NTAPI 3114 RtlTryEnterCriticalSection( 3115 _In_ PRTL_CRITICAL_SECTION CriticalSection 3116 ); 3117 3118 NTSYSAPI 3119 VOID 3120 NTAPI 3121 RtlpUnWaitCriticalSection( 3122 _In_ PRTL_CRITICAL_SECTION CriticalSection 3123 ); 3124 3125 NTSYSAPI 3126 NTSTATUS 3127 NTAPI 3128 RtlpWaitForCriticalSection( 3129 _In_ PRTL_CRITICAL_SECTION CriticalSection 3130 ); 3131 3132 NTSYSAPI 3133 BOOLEAN 3134 NTAPI 3135 RtlAcquireResourceExclusive( 3136 _In_ PRTL_RESOURCE Resource, 3137 _In_ BOOLEAN Wait 3138 ); 3139 3140 NTSYSAPI 3141 BOOLEAN 3142 NTAPI 3143 RtlAcquireResourceShared( 3144 _In_ PRTL_RESOURCE Resource, 3145 _In_ BOOLEAN Wait 3146 ); 3147 3148 NTSYSAPI 3149 VOID 3150 NTAPI 3151 RtlConvertExclusiveToShared( 3152 _In_ PRTL_RESOURCE Resource 3153 ); 3154 3155 NTSYSAPI 3156 VOID 3157 NTAPI 3158 RtlConvertSharedToExclusive( 3159 _In_ PRTL_RESOURCE Resource 3160 ); 3161 3162 NTSYSAPI 3163 VOID 3164 NTAPI 3165 RtlDeleteResource( 3166 _In_ PRTL_RESOURCE Resource 3167 ); 3168 3169 NTSYSAPI 3170 VOID 3171 NTAPI 3172 RtlDumpResource( 3173 _In_ PRTL_RESOURCE Resource 3174 ); 3175 3176 NTSYSAPI 3177 VOID 3178 NTAPI 3179 RtlInitializeResource( 3180 _In_ PRTL_RESOURCE Resource 3181 ); 3182 3183 NTSYSAPI 3184 VOID 3185 NTAPI 3186 RtlReleaseResource( 3187 _In_ PRTL_RESOURCE Resource 3188 ); 3189 3190 // 3191 // Compression Functions 3192 // 3193 NTSYSAPI //NT_RTL_COMPRESS_API 3194 NTSTATUS 3195 NTAPI 3196 RtlCompressBuffer( 3197 _In_ USHORT CompressionFormatAndEngine, 3198 _In_reads_bytes_(UncompressedBufferSize) PUCHAR UncompressedBuffer, 3199 _In_ ULONG UncompressedBufferSize, 3200 _Out_writes_bytes_to_(CompressedBufferSize, *FinalCompressedSize) PUCHAR CompressedBuffer, 3201 _In_ ULONG CompressedBufferSize, 3202 _In_ ULONG UncompressedChunkSize, 3203 _Out_ PULONG FinalCompressedSize, 3204 _In_ PVOID WorkSpace 3205 ); 3206 3207 _IRQL_requires_max_(APC_LEVEL) 3208 NTSYSAPI //NT_RTL_COMPRESS_API 3209 NTSTATUS 3210 NTAPI 3211 RtlDecompressBuffer( 3212 _In_ USHORT CompressionFormat, 3213 _Out_writes_bytes_to_(UncompressedBufferSize, *FinalUncompressedSize) PUCHAR UncompressedBuffer, 3214 _In_ ULONG UncompressedBufferSize, 3215 _In_reads_bytes_(CompressedBufferSize) PUCHAR CompressedBuffer, 3216 _In_ ULONG CompressedBufferSize, 3217 _Out_ PULONG FinalUncompressedSize 3218 ); 3219 3220 NTSYSAPI 3221 NTSTATUS 3222 NTAPI 3223 RtlGetCompressionWorkSpaceSize( 3224 _In_ USHORT CompressionFormatAndEngine, 3225 _Out_ PULONG CompressBufferWorkSpaceSize, 3226 _Out_ PULONG CompressFragmentWorkSpaceSize 3227 ); 3228 3229 // 3230 // Frame Functions 3231 // 3232 NTSYSAPI 3233 VOID 3234 NTAPI 3235 RtlPopFrame( 3236 _In_ PTEB_ACTIVE_FRAME Frame 3237 ); 3238 3239 NTSYSAPI 3240 VOID 3241 NTAPI 3242 RtlPushFrame( 3243 _In_ PTEB_ACTIVE_FRAME Frame 3244 ); 3245 3246 NTSYSAPI 3247 PTEB_ACTIVE_FRAME 3248 NTAPI 3249 RtlGetFrame( 3250 VOID 3251 ); 3252 3253 // 3254 // Debug Info Functions 3255 // 3256 NTSYSAPI 3257 PRTL_DEBUG_INFORMATION 3258 NTAPI 3259 RtlCreateQueryDebugBuffer( 3260 _In_ ULONG Size, 3261 _In_ BOOLEAN EventPair 3262 ); 3263 3264 NTSYSAPI 3265 NTSTATUS 3266 NTAPI 3267 RtlDestroyQueryDebugBuffer(IN PRTL_DEBUG_INFORMATION DebugBuffer); 3268 3269 NTSYSAPI 3270 NTSTATUS 3271 NTAPI 3272 RtlQueryProcessDebugInformation( 3273 _In_ ULONG ProcessId, 3274 _In_ ULONG DebugInfoClassMask, 3275 _Inout_ PRTL_DEBUG_INFORMATION DebugBuffer 3276 ); 3277 3278 // 3279 // Bitmap Functions 3280 // 3281 #ifdef NTOS_MODE_USER 3282 3283 NTSYSAPI 3284 BOOLEAN 3285 NTAPI 3286 RtlAreBitsClear( 3287 _In_ PRTL_BITMAP BitMapHeader, 3288 _In_ ULONG StartingIndex, 3289 _In_ ULONG Length 3290 ); 3291 3292 NTSYSAPI 3293 BOOLEAN 3294 NTAPI 3295 RtlAreBitsSet( 3296 _In_ PRTL_BITMAP BitMapHeader, 3297 _In_ ULONG StartingIndex, 3298 _In_ ULONG Length 3299 ); 3300 3301 NTSYSAPI 3302 VOID 3303 NTAPI 3304 RtlClearAllBits( 3305 _In_ PRTL_BITMAP BitMapHeader 3306 ); 3307 3308 NTSYSAPI 3309 VOID 3310 NTAPI 3311 RtlClearBit( 3312 _In_ PRTL_BITMAP BitMapHeader, 3313 _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitNumber 3314 ); 3315 3316 NTSYSAPI 3317 VOID 3318 NTAPI 3319 RtlClearBits( 3320 _In_ PRTL_BITMAP BitMapHeader, 3321 _In_range_(0, BitMapHeader->SizeOfBitMap - NumberToClear) ULONG StartingIndex, 3322 _In_range_(0, BitMapHeader->SizeOfBitMap - StartingIndex) ULONG NumberToClear 3323 ); 3324 3325 NTSYSAPI 3326 ULONG 3327 NTAPI 3328 RtlFindClearBits( 3329 _In_ PRTL_BITMAP BitMapHeader, 3330 _In_ ULONG NumberToFind, 3331 _In_ ULONG HintIndex 3332 ); 3333 3334 NTSYSAPI 3335 ULONG 3336 NTAPI 3337 RtlFindClearBitsAndSet( 3338 _In_ PRTL_BITMAP BitMapHeader, 3339 _In_ ULONG NumberToFind, 3340 _In_ ULONG HintIndex 3341 ); 3342 3343 NTSYSAPI 3344 ULONG 3345 NTAPI 3346 RtlFindFirstRunClear( 3347 _In_ PRTL_BITMAP BitMapHeader, 3348 _Out_ PULONG StartingIndex 3349 ); 3350 3351 NTSYSAPI 3352 ULONG 3353 NTAPI 3354 RtlFindClearRuns( 3355 _In_ PRTL_BITMAP BitMapHeader, 3356 _Out_writes_to_(SizeOfRunArray, return) PRTL_BITMAP_RUN RunArray, 3357 _In_range_(>, 0) ULONG SizeOfRunArray, 3358 _In_ BOOLEAN LocateLongestRuns 3359 ); 3360 3361 NTSYSAPI 3362 ULONG 3363 NTAPI 3364 RtlFindLastBackwardRunClear( 3365 _In_ PRTL_BITMAP BitMapHeader, 3366 _In_ ULONG FromIndex, 3367 _Out_ PULONG StartingRunIndex 3368 ); 3369 3370 NTSYSAPI 3371 CCHAR 3372 NTAPI 3373 RtlFindLeastSignificantBit( 3374 _In_ ULONGLONG Value 3375 ); 3376 3377 NTSYSAPI 3378 ULONG 3379 NTAPI 3380 RtlFindLongestRunClear( 3381 _In_ PRTL_BITMAP BitMapHeader, 3382 _Out_ PULONG StartingIndex 3383 ); 3384 3385 NTSYSAPI 3386 CCHAR 3387 NTAPI 3388 RtlFindMostSignificantBit( 3389 _In_ ULONGLONG Value 3390 ); 3391 3392 NTSYSAPI 3393 ULONG 3394 NTAPI 3395 RtlFindNextForwardRunClear( 3396 _In_ PRTL_BITMAP BitMapHeader, 3397 _In_ ULONG FromIndex, 3398 _Out_ PULONG StartingRunIndex 3399 ); 3400 3401 NTSYSAPI 3402 ULONG 3403 NTAPI 3404 RtlFindNextForwardRunSet( 3405 _In_ PRTL_BITMAP BitMapHeader, 3406 _In_ ULONG FromIndex, 3407 _Out_ PULONG StartingRunIndex 3408 ); 3409 3410 NTSYSAPI 3411 ULONG 3412 NTAPI 3413 RtlFindSetBits( 3414 _In_ PRTL_BITMAP BitMapHeader, 3415 _In_ ULONG NumberToFind, 3416 _In_ ULONG HintIndex 3417 ); 3418 3419 NTSYSAPI 3420 ULONG 3421 NTAPI 3422 RtlFindSetBitsAndClear( 3423 _In_ PRTL_BITMAP BitMapHeader, 3424 _In_ ULONG NumberToFind, 3425 _In_ ULONG HintIndex 3426 ); 3427 3428 #ifdef __REACTOS__ // ReactOS improvement 3429 _At_(BitMapHeader->SizeOfBitMap, _Post_equal_to_(SizeOfBitMap)) 3430 _At_(BitMapHeader->Buffer, _Post_equal_to_(BitMapBuffer)) 3431 #endif 3432 NTSYSAPI 3433 VOID 3434 NTAPI 3435 RtlInitializeBitMap( 3436 _Out_ PRTL_BITMAP BitMapHeader, 3437 _In_opt_ __drv_aliasesMem PULONG BitMapBuffer, 3438 _In_opt_ ULONG SizeOfBitMap 3439 ); 3440 3441 NTSYSAPI 3442 ULONG 3443 NTAPI 3444 RtlNumberOfClearBits( 3445 _In_ PRTL_BITMAP BitMapHeader 3446 ); 3447 3448 NTSYSAPI 3449 ULONG 3450 NTAPI 3451 RtlNumberOfSetBits( 3452 _In_ PRTL_BITMAP BitMapHeader 3453 ); 3454 3455 NTSYSAPI 3456 VOID 3457 NTAPI 3458 RtlSetBit( 3459 _In_ PRTL_BITMAP BitMapHeader, 3460 _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitNumber 3461 ); 3462 3463 NTSYSAPI 3464 VOID 3465 NTAPI 3466 RtlSetBits( 3467 _In_ PRTL_BITMAP BitMapHeader, 3468 _In_range_(0, BitMapHeader->SizeOfBitMap - NumberToSet) ULONG StartingIndex, 3469 _In_range_(0, BitMapHeader->SizeOfBitMap - StartingIndex) ULONG NumberToSet 3470 ); 3471 3472 NTSYSAPI 3473 VOID 3474 NTAPI 3475 RtlSetAllBits( 3476 _In_ PRTL_BITMAP BitMapHeader 3477 ); 3478 3479 _Must_inspect_result_ 3480 NTSYSAPI 3481 BOOLEAN 3482 NTAPI 3483 RtlTestBit( 3484 _In_ PRTL_BITMAP BitMapHeader, 3485 _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitNumber 3486 ); 3487 3488 #if defined(_M_AMD64) 3489 _Must_inspect_result_ 3490 FORCEINLINE 3491 BOOLEAN 3492 RtlCheckBit( 3493 _In_ PRTL_BITMAP BitMapHeader, 3494 _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitPosition) 3495 { 3496 return BitTest64((LONG64 CONST*)BitMapHeader->Buffer, (LONG64)BitPosition); 3497 } 3498 #else 3499 #define RtlCheckBit(BMH,BP) (((((PLONG)(BMH)->Buffer)[(BP)/32]) >> ((BP)%32)) & 0x1) 3500 #endif /* defined(_M_AMD64) */ 3501 3502 #endif // NTOS_MODE_USER 3503 3504 3505 // 3506 // Timer Functions 3507 // 3508 NTSYSAPI 3509 NTSTATUS 3510 NTAPI 3511 RtlCreateTimer( 3512 _In_ HANDLE TimerQueue, 3513 _In_ PHANDLE phNewTimer, 3514 _In_ WAITORTIMERCALLBACKFUNC Callback, 3515 _In_ PVOID Parameter, 3516 _In_ ULONG DueTime, 3517 _In_ ULONG Period, 3518 _In_ ULONG Flags 3519 ); 3520 3521 NTSYSAPI 3522 NTSTATUS 3523 NTAPI 3524 RtlCreateTimerQueue(PHANDLE TimerQueue); 3525 3526 NTSYSAPI 3527 NTSTATUS 3528 NTAPI 3529 RtlDeleteTimer( 3530 _In_ HANDLE TimerQueue, 3531 _In_ HANDLE Timer, 3532 _In_ HANDLE CompletionEvent 3533 ); 3534 3535 NTSYSAPI 3536 NTSTATUS 3537 NTAPI 3538 RtlUpdateTimer( 3539 _In_ HANDLE TimerQueue, 3540 _In_ HANDLE Timer, 3541 _In_ ULONG DueTime, 3542 _In_ ULONG Period 3543 ); 3544 3545 NTSYSAPI 3546 NTSTATUS 3547 NTAPI 3548 RtlDeleteTimerQueueEx( 3549 _In_ HANDLE TimerQueue, 3550 _In_opt_ HANDLE CompletionEvent 3551 ); 3552 3553 NTSYSAPI 3554 NTSTATUS 3555 NTAPI 3556 RtlDeleteTimerQueue(HANDLE TimerQueue); 3557 3558 // 3559 // SList functions 3560 // 3561 PSLIST_ENTRY 3562 FASTCALL 3563 InterlockedPushListSList( 3564 _Inout_ PSLIST_HEADER ListHead, 3565 _Inout_ __drv_aliasesMem PSLIST_ENTRY List, 3566 _Inout_ PSLIST_ENTRY ListEnd, 3567 _In_ ULONG Count 3568 ); 3569 3570 // 3571 // Range List functions 3572 // 3573 NTSYSAPI 3574 VOID 3575 NTAPI 3576 RtlInitializeRangeList( 3577 _Inout_ PRTL_RANGE_LIST RangeList 3578 ); 3579 3580 NTSYSAPI 3581 VOID 3582 NTAPI 3583 RtlFreeRangeList( 3584 _In_ PRTL_RANGE_LIST RangeList 3585 ); 3586 3587 NTSYSAPI 3588 NTSTATUS 3589 NTAPI 3590 RtlAddRange( 3591 _Inout_ PRTL_RANGE_LIST RangeList, 3592 _In_ ULONGLONG Start, 3593 _In_ ULONGLONG End, 3594 _In_ UCHAR Attributes, 3595 _In_ ULONG Flags, 3596 _In_opt_ PVOID UserData, 3597 _In_opt_ PVOID Owner 3598 ); 3599 3600 // 3601 // Debug Functions 3602 // 3603 ULONG 3604 __cdecl 3605 DbgPrint( 3606 _In_z_ _Printf_format_string_ PCSTR Format, 3607 ... 3608 ); 3609 3610 NTSYSAPI 3611 ULONG 3612 __cdecl 3613 DbgPrintEx( 3614 _In_ ULONG ComponentId, 3615 _In_ ULONG Level, 3616 _In_z_ _Printf_format_string_ PCSTR Format, 3617 ... 3618 ); 3619 3620 NTSYSAPI 3621 ULONG 3622 NTAPI 3623 DbgPrompt( 3624 _In_z_ PCCH Prompt, 3625 _Out_writes_bytes_(MaximumResponseLength) PCH Response, 3626 _In_ ULONG MaximumResponseLength 3627 ); 3628 3629 #undef DbgBreakPoint 3630 VOID 3631 NTAPI 3632 DbgBreakPoint( 3633 VOID 3634 ); 3635 3636 VOID 3637 NTAPI 3638 DbgLoadImageSymbols( 3639 _In_ PSTRING Name, 3640 _In_ PVOID Base, 3641 _In_ ULONG_PTR ProcessId 3642 ); 3643 3644 VOID 3645 NTAPI 3646 DbgUnLoadImageSymbols( 3647 _In_ PSTRING Name, 3648 _In_ PVOID Base, 3649 _In_ ULONG_PTR ProcessId 3650 ); 3651 3652 VOID 3653 NTAPI 3654 DbgCommandString( 3655 _In_ PCCH Name, 3656 _In_ PCCH Command 3657 ); 3658 3659 // 3660 // Generic Table Functions 3661 // 3662 #if defined(NTOS_MODE_USER) || defined(_NTIFS_) 3663 NTSYSAPI 3664 PVOID 3665 NTAPI 3666 RtlInsertElementGenericTable( 3667 _In_ PRTL_GENERIC_TABLE Table, 3668 _In_reads_bytes_(BufferSize) PVOID Buffer, 3669 _In_ CLONG BufferSize, 3670 _Out_opt_ PBOOLEAN NewElement 3671 ); 3672 3673 NTSYSAPI 3674 PVOID 3675 NTAPI 3676 RtlInsertElementGenericTableFull( 3677 _In_ PRTL_GENERIC_TABLE Table, 3678 _In_reads_bytes_(BufferSize) PVOID Buffer, 3679 _In_ CLONG BufferSize, 3680 _Out_opt_ PBOOLEAN NewElement, 3681 _In_ PVOID NodeOrParent, 3682 _In_ TABLE_SEARCH_RESULT SearchResult 3683 ); 3684 3685 NTSYSAPI 3686 BOOLEAN 3687 NTAPI 3688 RtlIsGenericTableEmpty( 3689 _In_ PRTL_GENERIC_TABLE Table 3690 ); 3691 3692 NTSYSAPI 3693 PVOID 3694 NTAPI 3695 RtlLookupElementGenericTableFull( 3696 _In_ PRTL_GENERIC_TABLE Table, 3697 _In_ PVOID Buffer, 3698 _Out_ PVOID *NodeOrParent, 3699 _Out_ TABLE_SEARCH_RESULT *SearchResult 3700 ); 3701 #endif 3702 3703 // 3704 // Handle Table Functions 3705 // 3706 NTSYSAPI 3707 PRTL_HANDLE_TABLE_ENTRY 3708 NTAPI 3709 RtlAllocateHandle( 3710 _In_ PRTL_HANDLE_TABLE HandleTable, 3711 _Inout_ PULONG Index 3712 ); 3713 3714 NTSYSAPI 3715 VOID 3716 NTAPI 3717 RtlDestroyHandleTable( 3718 _Inout_ PRTL_HANDLE_TABLE HandleTable); 3719 3720 NTSYSAPI 3721 BOOLEAN 3722 NTAPI 3723 RtlFreeHandle( 3724 _In_ PRTL_HANDLE_TABLE HandleTable, 3725 _In_ PRTL_HANDLE_TABLE_ENTRY Handle 3726 ); 3727 3728 NTSYSAPI 3729 VOID 3730 NTAPI 3731 RtlInitializeHandleTable( 3732 _In_ ULONG TableSize, 3733 _In_ ULONG HandleSize, 3734 _In_ PRTL_HANDLE_TABLE HandleTable 3735 ); 3736 3737 NTSYSAPI 3738 BOOLEAN 3739 NTAPI 3740 RtlIsValidHandle( 3741 _In_ PRTL_HANDLE_TABLE HandleTable, 3742 _In_ PRTL_HANDLE_TABLE_ENTRY Handle 3743 ); 3744 3745 _Success_(return!=FALSE) 3746 NTSYSAPI 3747 BOOLEAN 3748 NTAPI 3749 RtlIsValidIndexHandle( 3750 _In_ PRTL_HANDLE_TABLE HandleTable, 3751 _In_ ULONG Index, 3752 _Out_ PRTL_HANDLE_TABLE_ENTRY *Handle 3753 ); 3754 3755 // 3756 // PE Functions 3757 // 3758 NTSYSAPI 3759 NTSTATUS 3760 NTAPI 3761 RtlFindMessage( 3762 _In_ PVOID BaseAddress, 3763 _In_ ULONG Type, 3764 _In_ ULONG Language, 3765 _In_ ULONG MessageId, 3766 _Out_ PMESSAGE_RESOURCE_ENTRY *MessageResourceEntry 3767 ); 3768 3769 NTSYSAPI 3770 ULONG 3771 NTAPI 3772 RtlGetNtGlobalFlags(VOID); 3773 3774 _Success_(return!=NULL) 3775 NTSYSAPI 3776 PVOID 3777 NTAPI 3778 RtlImageDirectoryEntryToData( 3779 _In_ PVOID BaseAddress, 3780 _In_ BOOLEAN MappedAsImage, 3781 _In_ USHORT Directory, 3782 _Out_ PULONG Size 3783 ); 3784 3785 NTSYSAPI 3786 PVOID 3787 NTAPI 3788 RtlImageRvaToVa( 3789 _In_ PIMAGE_NT_HEADERS NtHeader, 3790 _In_ PVOID BaseAddress, 3791 _In_ ULONG Rva, 3792 _Inout_opt_ PIMAGE_SECTION_HEADER *SectionHeader 3793 ); 3794 3795 NTSYSAPI 3796 PIMAGE_NT_HEADERS 3797 NTAPI 3798 RtlImageNtHeader( 3799 _In_ PVOID BaseAddress); 3800 3801 NTSYSAPI 3802 NTSTATUS 3803 NTAPI 3804 RtlImageNtHeaderEx( 3805 _In_ ULONG Flags, 3806 _In_ PVOID BaseAddress, 3807 _In_ ULONGLONG Size, 3808 _Out_ PIMAGE_NT_HEADERS *NtHeader 3809 ); 3810 3811 NTSYSAPI 3812 PIMAGE_SECTION_HEADER 3813 NTAPI 3814 RtlImageRvaToSection( 3815 _In_ PIMAGE_NT_HEADERS NtHeader, 3816 _In_ PVOID BaseAddress, 3817 _In_ ULONG Rva 3818 ); 3819 3820 NTSYSAPI 3821 ULONG 3822 NTAPI 3823 LdrRelocateImageWithBias( 3824 _In_ PVOID NewAddress, 3825 _In_ LONGLONG AdditionalBias, 3826 _In_ PCCH LoaderName, 3827 _In_ ULONG Success, 3828 _In_ ULONG Conflict, 3829 _In_ ULONG Invalid 3830 ); 3831 3832 // 3833 // Activation Context Functions 3834 // 3835 #ifdef NTOS_MODE_USER 3836 NTSYSAPI 3837 NTSTATUS 3838 NTAPI 3839 RtlActivateActivationContextEx( 3840 _In_ ULONG Flags, 3841 _In_ PTEB Teb, 3842 _In_ PVOID Context, 3843 _Out_ PULONG_PTR Cookie 3844 ); 3845 3846 NTSYSAPI 3847 NTSTATUS 3848 NTAPI 3849 RtlActivateActivationContext( 3850 _In_ ULONG Flags, 3851 _In_ HANDLE Handle, 3852 _Out_ PULONG_PTR Cookie 3853 ); 3854 3855 NTSYSAPI 3856 VOID 3857 NTAPI 3858 RtlAddRefActivationContext( 3859 _In_ PVOID Context 3860 ); 3861 3862 NTSYSAPI 3863 PRTL_ACTIVATION_CONTEXT_STACK_FRAME 3864 FASTCALL 3865 RtlActivateActivationContextUnsafeFast( 3866 _In_ PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame, 3867 _In_ PVOID Context 3868 ); 3869 3870 NTSYSAPI 3871 NTSTATUS 3872 NTAPI 3873 RtlAllocateActivationContextStack( 3874 _In_ PACTIVATION_CONTEXT_STACK *Stack 3875 ); 3876 3877 NTSYSAPI 3878 NTSTATUS 3879 NTAPI 3880 RtlCreateActivationContext( 3881 _In_ ULONG Flags, 3882 _In_ PACTIVATION_CONTEXT_DATA ActivationContextData, 3883 _In_ ULONG ExtraBytes, 3884 _In_ PVOID NotificationRoutine, 3885 _In_ PVOID NotificationContext, 3886 _Out_ PACTIVATION_CONTEXT *ActCtx 3887 ); 3888 3889 NTSYSAPI 3890 NTSTATUS 3891 NTAPI 3892 RtlGetActiveActivationContext( 3893 _In_ PVOID *Context 3894 ); 3895 3896 NTSYSAPI 3897 VOID 3898 NTAPI 3899 RtlReleaseActivationContext( 3900 _In_ HANDLE handle 3901 ); 3902 3903 NTSYSAPI 3904 NTSTATUS 3905 NTAPI 3906 RtlDeactivateActivationContext( 3907 _In_ ULONG dwFlags, 3908 _In_ ULONG_PTR ulCookie 3909 ); 3910 3911 NTSYSAPI 3912 VOID 3913 NTAPI 3914 RtlFreeActivationContextStack( 3915 _In_ PACTIVATION_CONTEXT_STACK Stack 3916 ); 3917 3918 NTSYSAPI 3919 VOID 3920 NTAPI 3921 RtlFreeThreadActivationContextStack(VOID); 3922 3923 NTSYSAPI 3924 PRTL_ACTIVATION_CONTEXT_STACK_FRAME 3925 FASTCALL 3926 RtlDeactivateActivationContextUnsafeFast( 3927 _In_ PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame 3928 ); 3929 3930 NTSYSAPI 3931 NTSTATUS 3932 NTAPI 3933 RtlDosApplyFileIsolationRedirection_Ustr( 3934 _In_ ULONG Flags, 3935 _In_ PUNICODE_STRING OriginalName, 3936 _In_ PUNICODE_STRING Extension, 3937 _Inout_ PUNICODE_STRING StaticString, 3938 _Inout_ PUNICODE_STRING DynamicString, 3939 _Inout_ PUNICODE_STRING *NewName, 3940 _In_ PULONG NewFlags, 3941 _In_ PSIZE_T FileNameSize, 3942 _In_ PSIZE_T RequiredLength 3943 ); 3944 3945 NTSYSAPI 3946 NTSTATUS 3947 NTAPI 3948 RtlFindActivationContextSectionString( 3949 _In_ ULONG dwFlags, 3950 _In_ const GUID *ExtensionGuid, 3951 _In_ ULONG SectionType, 3952 _In_ const UNICODE_STRING *SectionName, 3953 _Inout_ PVOID ReturnedData 3954 ); 3955 3956 NTSYSAPI 3957 NTSTATUS 3958 NTAPI 3959 RtlQueryInformationActivationContext( 3960 _In_ DWORD dwFlags, 3961 _In_opt_ PVOID Context, 3962 _In_opt_ PVOID pvSubInstance, 3963 _In_ ULONG ulInfoClass, 3964 _Out_bytecap_(cbBuffer) PVOID pvBuffer, 3965 _In_opt_ SIZE_T cbBuffer, 3966 _Out_opt_ SIZE_T *pcbWrittenOrRequired 3967 ); 3968 3969 NTSYSAPI 3970 NTSTATUS 3971 NTAPI 3972 RtlQueryInformationActiveActivationContext( 3973 _In_ ULONG ulInfoClass, 3974 _Out_bytecap_(cbBuffer) PVOID pvBuffer, 3975 _In_opt_ SIZE_T cbBuffer, 3976 _Out_opt_ SIZE_T *pcbWrittenOrRequired 3977 ); 3978 3979 NTSYSAPI 3980 NTSTATUS 3981 NTAPI 3982 RtlZombifyActivationContext( 3983 PVOID Context 3984 ); 3985 3986 // 3987 // WOW64 Functions 3988 // 3989 NTSYSAPI 3990 NTSTATUS 3991 NTAPI 3992 RtlWow64EnableFsRedirection( 3993 _In_ BOOLEAN Wow64FsEnableRedirection 3994 ); 3995 3996 NTSYSAPI 3997 NTSTATUS 3998 NTAPI 3999 RtlWow64EnableFsRedirectionEx( 4000 _In_ PVOID Wow64FsEnableRedirection, 4001 _Out_ PVOID *OldFsRedirectionLevel 4002 ); 4003 4004 #endif 4005 4006 // 4007 // Registry Functions 4008 // 4009 _IRQL_requires_max_(PASSIVE_LEVEL) 4010 _Must_inspect_result_ 4011 NTSYSAPI 4012 NTSTATUS 4013 NTAPI 4014 RtlCheckRegistryKey( 4015 _In_ ULONG RelativeTo, 4016 _In_ PWSTR Path 4017 ); 4018 4019 NTSYSAPI 4020 NTSTATUS 4021 NTAPI 4022 RtlCreateRegistryKey( 4023 _In_ ULONG RelativeTo, 4024 _In_ PWSTR Path 4025 ); 4026 4027 NTSYSAPI 4028 NTSTATUS 4029 NTAPI 4030 RtlFormatCurrentUserKeyPath( 4031 _Out_ _At_(KeyPath->Buffer, __drv_allocatesMem(Mem) _Post_bytecap_(KeyPath->MaximumLength) _Post_bytecount_(KeyPath->Length)) 4032 PUNICODE_STRING KeyPath 4033 ); 4034 4035 NTSYSAPI 4036 NTSTATUS 4037 NTAPI 4038 RtlOpenCurrentUser( 4039 _In_ ACCESS_MASK DesiredAccess, 4040 _Out_ PHANDLE KeyHandle 4041 ); 4042 4043 _IRQL_requires_max_(PASSIVE_LEVEL) 4044 NTSYSAPI 4045 NTSTATUS 4046 NTAPI 4047 RtlQueryRegistryValues( 4048 _In_ ULONG RelativeTo, 4049 _In_ PCWSTR Path, 4050 _Inout_ _At_(*(*QueryTable).EntryContext, _Pre_unknown_) 4051 PRTL_QUERY_REGISTRY_TABLE QueryTable, 4052 _In_opt_ PVOID Context, 4053 _In_opt_ PVOID Environment 4054 ); 4055 4056 _IRQL_requires_max_(PASSIVE_LEVEL) 4057 NTSYSAPI 4058 NTSTATUS 4059 NTAPI 4060 RtlWriteRegistryValue( 4061 _In_ ULONG RelativeTo, 4062 _In_ PCWSTR Path, 4063 _In_z_ PCWSTR ValueName, 4064 _In_ ULONG ValueType, 4065 _In_reads_bytes_opt_(ValueLength) PVOID ValueData, 4066 _In_ ULONG ValueLength 4067 ); 4068 4069 #ifdef NTOS_MODE_USER 4070 NTSYSAPI 4071 NTSTATUS 4072 NTAPI 4073 RtlpNtCreateKey( 4074 _Out_ HANDLE KeyHandle, 4075 _In_ ACCESS_MASK DesiredAccess, 4076 _In_ POBJECT_ATTRIBUTES ObjectAttributes, 4077 _In_ ULONG TitleIndex, 4078 _In_ PUNICODE_STRING Class, 4079 _Out_ PULONG Disposition 4080 ); 4081 4082 NTSYSAPI 4083 NTSTATUS 4084 NTAPI 4085 RtlpNtEnumerateSubKey( 4086 _In_ HANDLE KeyHandle, 4087 _Inout_ PUNICODE_STRING SubKeyName, 4088 _In_ ULONG Index, 4089 _In_ ULONG Unused 4090 ); 4091 4092 NTSYSAPI 4093 NTSTATUS 4094 NTAPI 4095 RtlpNtMakeTemporaryKey( 4096 _In_ HANDLE KeyHandle 4097 ); 4098 4099 NTSYSAPI 4100 NTSTATUS 4101 NTAPI 4102 RtlpNtOpenKey( 4103 _Out_ HANDLE KeyHandle, 4104 _In_ ACCESS_MASK DesiredAccess, 4105 _In_ POBJECT_ATTRIBUTES ObjectAttributes, 4106 _In_ ULONG Unused 4107 ); 4108 4109 NTSYSAPI 4110 NTSTATUS 4111 NTAPI 4112 RtlpNtQueryValueKey( 4113 _In_ HANDLE KeyHandle, 4114 _Out_opt_ PULONG Type, 4115 _Out_opt_ PVOID Data, 4116 _Inout_opt_ PULONG DataLength, 4117 _In_ ULONG Unused 4118 ); 4119 4120 NTSYSAPI 4121 NTSTATUS 4122 NTAPI 4123 RtlpNtSetValueKey( 4124 _In_ HANDLE KeyHandle, 4125 _In_ ULONG Type, 4126 _In_ PVOID Data, 4127 _In_ ULONG DataLength 4128 ); 4129 #endif 4130 4131 // 4132 // NLS Functions 4133 // 4134 NTSYSAPI 4135 VOID 4136 NTAPI 4137 RtlGetDefaultCodePage( 4138 _Out_ PUSHORT AnsiCodePage, 4139 _Out_ PUSHORT OemCodePage 4140 ); 4141 4142 NTSYSAPI 4143 VOID 4144 NTAPI 4145 RtlInitNlsTables( 4146 _In_ PUSHORT AnsiTableBase, 4147 _In_ PUSHORT OemTableBase, 4148 _In_ PUSHORT CaseTableBase, 4149 _Out_ PNLSTABLEINFO NlsTable 4150 ); 4151 4152 _IRQL_requires_max_(PASSIVE_LEVEL) 4153 NTSYSAPI 4154 VOID 4155 NTAPI 4156 RtlInitCodePageTable( 4157 _In_ PUSHORT TableBase, 4158 _Out_ PCPTABLEINFO CodePageTable 4159 ); 4160 4161 NTSYSAPI 4162 VOID 4163 NTAPI 4164 RtlResetRtlTranslations( 4165 _In_ PNLSTABLEINFO NlsTable); 4166 4167 #if defined(NTOS_MODE_USER) && !defined(NO_RTL_INLINES) 4168 4169 // 4170 // Misc conversion functions 4171 // 4172 static __inline 4173 LARGE_INTEGER 4174 NTAPI_INLINE 4175 RtlConvertLongToLargeInteger( 4176 _In_ LONG SignedInteger 4177 ) 4178 { 4179 LARGE_INTEGER Result; 4180 4181 Result.QuadPart = SignedInteger; 4182 return Result; 4183 } 4184 4185 static __inline 4186 LARGE_INTEGER 4187 NTAPI_INLINE 4188 RtlEnlargedIntegerMultiply( 4189 _In_ LONG Multiplicand, 4190 _In_ LONG Multiplier 4191 ) 4192 { 4193 LARGE_INTEGER Product; 4194 4195 Product.QuadPart = (LONGLONG)Multiplicand * (ULONGLONG)Multiplier; 4196 return Product; 4197 } 4198 4199 static __inline 4200 ULONG 4201 NTAPI_INLINE 4202 RtlEnlargedUnsignedDivide( 4203 _In_ ULARGE_INTEGER Dividend, 4204 _In_ ULONG Divisor, 4205 _In_opt_ PULONG Remainder 4206 ) 4207 { 4208 ULONG Quotient; 4209 4210 Quotient = (ULONG)(Dividend.QuadPart / Divisor); 4211 if (Remainder) { 4212 *Remainder = (ULONG)(Dividend.QuadPart % Divisor); 4213 } 4214 4215 return Quotient; 4216 } 4217 4218 static __inline 4219 LARGE_INTEGER 4220 NTAPI_INLINE 4221 RtlEnlargedUnsignedMultiply( 4222 _In_ ULONG Multiplicand, 4223 _In_ ULONG Multiplier 4224 ) 4225 { 4226 LARGE_INTEGER Product; 4227 4228 Product.QuadPart = (ULONGLONG)Multiplicand * (ULONGLONG)Multiplier; 4229 return Product; 4230 } 4231 4232 #if defined(_AMD64_) || defined(_IA64_) 4233 static __inline 4234 LARGE_INTEGER 4235 NTAPI_INLINE 4236 RtlExtendedLargeIntegerDivide( 4237 _In_ LARGE_INTEGER Dividend, 4238 _In_ ULONG Divisor, 4239 _Out_opt_ PULONG Remainder) 4240 { 4241 LARGE_INTEGER ret; 4242 ret.QuadPart = (ULONG64)Dividend.QuadPart / Divisor; 4243 if (Remainder) 4244 *Remainder = (ULONG)(Dividend.QuadPart % Divisor); 4245 return ret; 4246 } 4247 4248 #else 4249 NTSYSAPI 4250 LARGE_INTEGER 4251 NTAPI 4252 RtlExtendedLargeIntegerDivide( 4253 _In_ LARGE_INTEGER Dividend, 4254 _In_ ULONG Divisor, 4255 _Out_opt_ PULONG Remainder 4256 ); 4257 4258 #endif /* defined(_AMD64_) || defined(_IA64_) */ 4259 4260 #endif 4261 4262 4263 NTSYSAPI 4264 ULONG 4265 NTAPI 4266 RtlUniform( 4267 _In_ PULONG Seed 4268 ); 4269 4270 NTSYSAPI 4271 ULONG 4272 NTAPI 4273 RtlRandom( 4274 _Inout_ PULONG Seed 4275 ); 4276 4277 NTSYSAPI 4278 ULONG 4279 NTAPI 4280 RtlComputeCrc32( 4281 _In_ ULONG InitialCrc, 4282 _In_ PUCHAR Buffer, 4283 _In_ ULONG Length 4284 ); 4285 4286 // 4287 // Network Functions 4288 // 4289 NTSYSAPI 4290 PSTR 4291 NTAPI 4292 RtlIpv4AddressToStringA( 4293 _In_ const struct in_addr *Addr, 4294 _Out_writes_(16) PCHAR S 4295 ); 4296 4297 NTSYSAPI 4298 PWSTR 4299 NTAPI 4300 RtlIpv4AddressToStringW( 4301 _In_ const struct in_addr *Addr, 4302 _Out_writes_(16) PWCHAR S 4303 ); 4304 4305 NTSYSAPI 4306 NTSTATUS 4307 NTAPI 4308 RtlIpv4AddressToStringExA( 4309 _In_ const struct in_addr *Address, 4310 _In_ USHORT Port, 4311 _Out_writes_to_(*AddressStringLength, *AddressStringLength) PCHAR AddressString, 4312 _Inout_ PULONG AddressStringLength 4313 ); 4314 4315 NTSTATUS 4316 NTAPI 4317 RtlIpv4AddressToStringExW( 4318 _In_ const struct in_addr *Address, 4319 _In_ USHORT Port, 4320 _Out_writes_to_(*AddressStringLength, *AddressStringLength) PWCHAR AddressString, 4321 _Inout_ PULONG AddressStringLength 4322 ); 4323 4324 NTSYSAPI 4325 NTSTATUS 4326 NTAPI 4327 RtlIpv4StringToAddressA( 4328 _In_ PCSTR String, 4329 _In_ BOOLEAN Strict, 4330 _Out_ PCSTR *Terminator, 4331 _Out_ struct in_addr *Addr 4332 ); 4333 4334 NTSYSAPI 4335 NTSTATUS 4336 NTAPI 4337 RtlIpv4StringToAddressW( 4338 _In_ PCWSTR String, 4339 _In_ BOOLEAN Strict, 4340 _Out_ PCWSTR *Terminator, 4341 _Out_ struct in_addr *Addr 4342 ); 4343 4344 NTSYSAPI 4345 NTSTATUS 4346 NTAPI 4347 RtlIpv4StringToAddressExA( 4348 _In_ PCSTR AddressString, 4349 _In_ BOOLEAN Strict, 4350 _Out_ struct in_addr *Address, 4351 _Out_ PUSHORT Port 4352 ); 4353 4354 NTSYSAPI 4355 NTSTATUS 4356 NTAPI 4357 RtlIpv4StringToAddressExW( 4358 _In_ PCWSTR AddressString, 4359 _In_ BOOLEAN Strict, 4360 _Out_ struct in_addr *Address, 4361 _Out_ PUSHORT Port 4362 ); 4363 4364 NTSYSAPI 4365 PSTR 4366 NTAPI 4367 RtlIpv6AddressToStringA( 4368 _In_ const struct in6_addr *Addr, 4369 _Out_writes_(46) PSTR S 4370 ); 4371 4372 NTSYSAPI 4373 PWSTR 4374 NTAPI 4375 RtlIpv6AddressToStringW( 4376 _In_ const struct in6_addr *Addr, 4377 _Out_writes_(46) PWSTR S 4378 ); 4379 4380 NTSYSAPI 4381 NTSTATUS 4382 NTAPI 4383 RtlIpv6AddressToStringExA( 4384 _In_ const struct in6_addr *Address, 4385 _In_ ULONG ScopeId, 4386 _In_ USHORT Port, 4387 _Out_writes_to_(*AddressStringLength, *AddressStringLength) PSTR AddressString, 4388 _Inout_ PULONG AddressStringLength 4389 ); 4390 4391 NTSYSAPI 4392 NTSTATUS 4393 NTAPI 4394 RtlIpv6AddressToStringExW( 4395 _In_ const struct in6_addr *Address, 4396 _In_ ULONG ScopeId, 4397 _In_ USHORT Port, 4398 _Out_writes_to_(*AddressStringLength, *AddressStringLength) PWCHAR AddressString, 4399 _Inout_ PULONG AddressStringLength 4400 ); 4401 4402 NTSYSAPI 4403 NTSTATUS 4404 NTAPI 4405 RtlIpv6StringToAddressA( 4406 _In_ PCSTR String, 4407 _Out_ PCSTR *Terminator, 4408 _Out_ struct in6_addr *Addr 4409 ); 4410 4411 NTSYSAPI 4412 NTSTATUS 4413 NTAPI 4414 RtlIpv6StringToAddressW( 4415 _In_ PCWSTR String, 4416 _Out_ PCWSTR *Terminator, 4417 _Out_ struct in6_addr *Addr 4418 ); 4419 4420 NTSYSAPI 4421 NTSTATUS 4422 NTAPI 4423 RtlIpv6StringToAddressExA( 4424 _In_ PCSTR AddressString, 4425 _Out_ struct in6_addr *Address, 4426 _Out_ PULONG ScopeId, 4427 _Out_ PUSHORT Port 4428 ); 4429 4430 NTSYSAPI 4431 NTSTATUS 4432 NTAPI 4433 RtlIpv6StringToAddressExW( 4434 _In_ PCWSTR AddressString, 4435 _Out_ struct in6_addr *Address, 4436 _Out_ PULONG ScopeId, 4437 _Out_ PUSHORT Port 4438 ); 4439 4440 4441 // 4442 // Time Functions 4443 // 4444 NTSYSAPI 4445 NTSTATUS 4446 NTAPI 4447 RtlQueryTimeZoneInformation( 4448 _Out_ PRTL_TIME_ZONE_INFORMATION TimeZoneInformation); 4449 4450 NTSYSAPI 4451 VOID 4452 NTAPI 4453 RtlSecondsSince1970ToTime( 4454 _In_ ULONG SecondsSince1970, 4455 _Out_ PLARGE_INTEGER Time 4456 ); 4457 4458 NTSYSAPI 4459 NTSTATUS 4460 NTAPI 4461 RtlSetTimeZoneInformation( 4462 _In_ PRTL_TIME_ZONE_INFORMATION TimeZoneInformation); 4463 4464 _Success_(return!=FALSE) 4465 _Must_inspect_result_ 4466 NTSYSAPI 4467 BOOLEAN 4468 NTAPI 4469 RtlTimeFieldsToTime( 4470 _In_ PTIME_FIELDS TimeFields, 4471 _Out_ PLARGE_INTEGER Time 4472 ); 4473 4474 _Success_(return != 0) 4475 _Must_inspect_result_ 4476 NTSYSAPI 4477 BOOLEAN 4478 NTAPI 4479 RtlTimeToSecondsSince1970( 4480 _In_ PLARGE_INTEGER Time, 4481 _Out_ PULONG ElapsedSeconds 4482 ); 4483 4484 NTSYSAPI 4485 VOID 4486 NTAPI 4487 RtlTimeToTimeFields( 4488 PLARGE_INTEGER Time, 4489 PTIME_FIELDS TimeFields 4490 ); 4491 4492 NTSYSAPI 4493 NTSTATUS 4494 NTAPI 4495 RtlSystemTimeToLocalTime( 4496 _In_ PLARGE_INTEGER SystemTime, 4497 _Out_ PLARGE_INTEGER LocalTime 4498 ); 4499 4500 // 4501 // Version Functions 4502 // 4503 _IRQL_requires_max_(PASSIVE_LEVEL) 4504 _Must_inspect_result_ 4505 NTSYSAPI 4506 NTSTATUS 4507 NTAPI 4508 RtlVerifyVersionInfo( 4509 _In_ PRTL_OSVERSIONINFOEXW VersionInfo, 4510 _In_ ULONG TypeMask, 4511 _In_ ULONGLONG ConditionMask 4512 ); 4513 4514 _IRQL_requires_max_(PASSIVE_LEVEL) 4515 NTSYSAPI 4516 NTSTATUS 4517 NTAPI 4518 RtlGetVersion( 4519 _Out_ 4520 _At_(lpVersionInformation->dwOSVersionInfoSize, _Pre_ _Valid_) 4521 _When_(lpVersionInformation->dwOSVersionInfoSize == sizeof(RTL_OSVERSIONINFOEXW), 4522 _At_((PRTL_OSVERSIONINFOEXW)lpVersionInformation, _Out_)) 4523 PRTL_OSVERSIONINFOW lpVersionInformation 4524 ); 4525 4526 NTSYSAPI 4527 BOOLEAN 4528 NTAPI 4529 RtlGetNtProductType(_Out_ PNT_PRODUCT_TYPE ProductType); 4530 4531 // 4532 // Secure Memory Functions 4533 // 4534 #ifdef NTOS_MODE_USER 4535 NTSYSAPI 4536 NTSTATUS 4537 NTAPI 4538 RtlRegisterSecureMemoryCacheCallback( 4539 _In_ PRTL_SECURE_MEMORY_CACHE_CALLBACK Callback); 4540 4541 NTSYSAPI 4542 BOOLEAN 4543 NTAPI 4544 RtlFlushSecureMemoryCache( 4545 _In_ PVOID MemoryCache, 4546 _In_opt_ SIZE_T MemoryLength 4547 ); 4548 #endif 4549 4550 // 4551 // Boot Status Data Functions 4552 // 4553 #ifdef NTOS_MODE_USER 4554 NTSYSAPI 4555 NTSTATUS 4556 NTAPI 4557 RtlCreateBootStatusDataFile( 4558 VOID 4559 ); 4560 4561 NTSYSAPI 4562 NTSTATUS 4563 NTAPI 4564 RtlGetSetBootStatusData( 4565 _In_ HANDLE FileHandle, 4566 _In_ BOOLEAN WriteMode, 4567 _In_ RTL_BSD_ITEM_TYPE DataClass, 4568 _In_ PVOID Buffer, 4569 _In_ ULONG BufferSize, 4570 _Out_opt_ PULONG ReturnLength 4571 ); 4572 4573 NTSYSAPI 4574 NTSTATUS 4575 NTAPI 4576 RtlLockBootStatusData( 4577 _Out_ PHANDLE FileHandle 4578 ); 4579 4580 NTSYSAPI 4581 NTSTATUS 4582 NTAPI 4583 RtlUnlockBootStatusData( 4584 _In_ HANDLE FileHandle 4585 ); 4586 #endif 4587 4588 #ifdef NTOS_MODE_USER 4589 _Must_inspect_result_ 4590 NTSYSAPI 4591 NTSTATUS 4592 NTAPI 4593 RtlGUIDFromString( 4594 _In_ PUNICODE_STRING GuidString, 4595 _Out_ GUID *Guid); 4596 4597 _Must_inspect_result_ 4598 NTSYSAPI 4599 NTSTATUS 4600 NTAPI 4601 RtlStringFromGUID( 4602 _In_ REFGUID Guid, 4603 _Out_ _At_(GuidString->Buffer, __drv_allocatesMem(Mem)) 4604 PUNICODE_STRING GuidString); 4605 4606 NTSYSAPI 4607 NTSTATUS 4608 NTAPI 4609 RtlComputeImportTableHash( 4610 _In_ HANDLE hFile, 4611 _Out_ PCHAR Hash, 4612 _In_ ULONG ImportTableHashRevision 4613 ); 4614 #endif 4615 4616 // 4617 // MemoryStream functions 4618 // 4619 #ifdef NTOS_MODE_USER 4620 4621 NTSYSAPI 4622 VOID 4623 NTAPI 4624 RtlInitMemoryStream( 4625 _Out_ PRTL_MEMORY_STREAM Stream 4626 ); 4627 4628 NTSYSAPI 4629 VOID 4630 NTAPI 4631 RtlInitOutOfProcessMemoryStream( 4632 _Out_ PRTL_MEMORY_STREAM Stream 4633 ); 4634 4635 NTSYSAPI 4636 VOID 4637 NTAPI 4638 RtlFinalReleaseOutOfProcessMemoryStream( 4639 _In_ PRTL_MEMORY_STREAM Stream 4640 ); 4641 4642 NTSYSAPI 4643 HRESULT 4644 NTAPI 4645 RtlQueryInterfaceMemoryStream( 4646 _In_ struct IStream *This, 4647 _In_ REFIID RequestedIid, 4648 _Outptr_ PVOID *ResultObject 4649 ); 4650 4651 NTSYSAPI 4652 ULONG 4653 NTAPI 4654 RtlAddRefMemoryStream( 4655 _In_ struct IStream *This 4656 ); 4657 4658 NTSYSAPI 4659 ULONG 4660 NTAPI 4661 RtlReleaseMemoryStream( 4662 _In_ struct IStream *This 4663 ); 4664 4665 NTSYSAPI 4666 HRESULT 4667 NTAPI 4668 RtlReadMemoryStream( 4669 _In_ struct IStream *This, 4670 _Out_writes_bytes_(Length) PVOID Buffer, 4671 _In_ ULONG Length, 4672 _Out_opt_ PULONG BytesRead 4673 ); 4674 4675 NTSYSAPI 4676 HRESULT 4677 NTAPI 4678 RtlReadOutOfProcessMemoryStream( 4679 _In_ struct IStream *This, 4680 _Out_writes_bytes_(Length) PVOID Buffer, 4681 _In_ ULONG Length, 4682 _Out_opt_ PULONG BytesRead 4683 ); 4684 4685 NTSYSAPI 4686 HRESULT 4687 NTAPI 4688 RtlSeekMemoryStream( 4689 _In_ struct IStream *This, 4690 _In_ LARGE_INTEGER RelativeOffset, 4691 _In_ ULONG Origin, 4692 _Out_opt_ PULARGE_INTEGER ResultOffset 4693 ); 4694 4695 NTSYSAPI 4696 HRESULT 4697 NTAPI 4698 RtlCopyMemoryStreamTo( 4699 _In_ struct IStream *This, 4700 _In_ struct IStream *Target, 4701 _In_ ULARGE_INTEGER Length, 4702 _Out_opt_ PULARGE_INTEGER BytesRead, 4703 _Out_opt_ PULARGE_INTEGER BytesWritten 4704 ); 4705 4706 NTSYSAPI 4707 HRESULT 4708 NTAPI 4709 RtlCopyOutOfProcessMemoryStreamTo( 4710 _In_ struct IStream *This, 4711 _In_ struct IStream *Target, 4712 _In_ ULARGE_INTEGER Length, 4713 _Out_opt_ PULARGE_INTEGER BytesRead, 4714 _Out_opt_ PULARGE_INTEGER BytesWritten 4715 ); 4716 4717 NTSYSAPI 4718 HRESULT 4719 NTAPI 4720 RtlStatMemoryStream( 4721 _In_ struct IStream *This, 4722 _Out_ struct tagSTATSTG *Stats, 4723 _In_ ULONG Flags 4724 ); 4725 4726 // Dummy functions 4727 NTSYSAPI 4728 HRESULT 4729 NTAPI 4730 RtlWriteMemoryStream( 4731 _In_ struct IStream *This, 4732 _In_reads_bytes_(Length) CONST VOID *Buffer, 4733 _In_ ULONG Length, 4734 _Out_opt_ PULONG BytesWritten 4735 ); 4736 4737 NTSYSAPI 4738 HRESULT 4739 NTAPI 4740 RtlSetMemoryStreamSize( 4741 _In_ struct IStream *This, 4742 _In_ ULARGE_INTEGER NewSize 4743 ); 4744 4745 NTSYSAPI 4746 HRESULT 4747 NTAPI 4748 RtlCommitMemoryStream( 4749 _In_ struct IStream *This, 4750 _In_ ULONG CommitFlags 4751 ); 4752 4753 NTSYSAPI 4754 HRESULT 4755 NTAPI 4756 RtlRevertMemoryStream( 4757 _In_ struct IStream *This 4758 ); 4759 4760 NTSYSAPI 4761 HRESULT 4762 NTAPI 4763 RtlLockMemoryStreamRegion( 4764 _In_ struct IStream *This, 4765 _In_ ULARGE_INTEGER Offset, 4766 _In_ ULARGE_INTEGER Length, 4767 _In_ ULONG LockType 4768 ); 4769 4770 NTSYSAPI 4771 HRESULT 4772 NTAPI 4773 RtlUnlockMemoryStreamRegion( 4774 _In_ struct IStream *This, 4775 _In_ ULARGE_INTEGER Offset, 4776 _In_ ULARGE_INTEGER Length, 4777 _In_ ULONG LockType 4778 ); 4779 4780 NTSYSAPI 4781 HRESULT 4782 NTAPI 4783 RtlCloneMemoryStream( 4784 _In_ struct IStream *This, 4785 _Outptr_ struct IStream **ResultStream 4786 ); 4787 4788 NTSYSAPI 4789 NTSTATUS 4790 NTAPI 4791 RtlGetNativeSystemInformation( 4792 _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass, 4793 _Out_writes_bytes_to_opt_(SystemInformationLength, *ReturnLength) PVOID SystemInformation, 4794 _In_ ULONG SystemInformationLength, 4795 _Out_opt_ PULONG ReturnLength 4796 ); 4797 4798 #endif // NTOS_MODE_USER 4799 4800 NTSYSAPI 4801 NTSTATUS 4802 NTAPI 4803 RtlFindActivationContextSectionGuid( 4804 ULONG flags, 4805 const GUID *extguid, 4806 ULONG section_kind, 4807 const GUID *guid, 4808 void *ptr 4809 ); 4810 4811 #ifdef __cplusplus 4812 } 4813 #endif 4814 4815 #endif 4816