///////////////////////////////////////////////////////////////////////////////

//

// Type and function declarations for the NT native API.

//

///////////////////////////////////////////////////////////////////////////////

//

// Copyright (c) 2016-2018, 2021, 2023 Oliver Schneider (assarbad.net)

//

// Permission is hereby granted, free of charge, to any person or organization

// obtaining a copy of the software and accompanying documentation covered by

// this license (the "Software") to use, reproduce, display, distribute,

// execute, and transmit the Software, and to prepare derivative works of the

// Software, and to permit third-parties to whom the Software is furnished to

// do so, all subject to the following:

//

// The copyright notices in the Software and this entire statement, including

// the above license grant, this restriction and the following disclaimer,

// must be included in all copies of the Software, in whole or in part, and

// all derivative works of the Software, unless such copies or derivative

// works are solely in the form of machine-executable object code generated by

// a source language processor.

//

// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

// FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT

// SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE

// FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,

// ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

// DEALINGS IN THE SOFTWARE.

//

// [Boost Software License - Version 1.0 - August 17th, 2003]

//

// SPDX-License-Identifier: BSL-1.0

//

///////////////////////////////////////////////////////////////////////////////

// http://terminus.rewolf.pl/terminus/

// http://undocumented.ntinternals.net

// https://github.com/ntdiff/headers + https://ntdiff.github.io

// https://www.vergiliusproject.com/

// https://ntdoc.m417z.com/symbols

///////////////////////////////////////////////////////////////////////////////

#ifndef __NTNATIVE_H_VER__

#define __NTNATIVE_H_VER__ 2023111723

#if (defined(_MSC_VER) && (_MSC_VER >= 1020)) || defined(__MCPP)

# pragma once

#endif // Check for "#pragma once" support

#if defined(NT_INCLUDED) || defined(_WINNT_) || defined(_WINDOWS_) || defined(_INC_WINDOWS)

# error This header should be included before those pesky Windows headers (it also includes some of them but needs to cheat on some particulars)

#else

# define WIN32_LEAN_AND_MEAN // this can be worked around by explicitly including the rarely used stuff

# pragma push_macro("NtCurrentTeb")

# define NtCurrentTeb NtCurrentTeb_Mock // comes transiently from winnt.h

# include <Windows.h>

# undef NtCurrentTeb

# pragma pop_macro("NtCurrentTeb")

#endif

#pragma push_macro("STATIC_INLINE")

#ifdef STATIC_INLINE

# undef STATIC_INLINE

#endif // STATIC_INLINE

#ifdef _MSC_VER

# define STATIC_INLINE static __forceinline

#else

# define STATIC_INLINE static inline

#endif // _MSC_VER

// Fake the SAL1 annotations where they don't exist.

#if !defined(__in_bcount) && !defined(_In_reads_bytes_)

# define __success(x)

# define __field_range(x, y)

# define __field_nullterminated

# define __in

# define __in_z

# define __in_bcount(x)

# define __in_opt

# define __inout

# define __inout_opt

# define __out

# define __out_bcount(x)

# define __out_opt

# define __out_bcount_opt(x)

# define __reserved

#endif

// Fake the SAL2 annotations where they don't exist.

#if defined(__in_bcount) && !defined(_In_reads_bytes_)

# define _Success_(x) __success(x)

# define _Field_range_(x, y) __field_range(x, y)

# define _Field_z_ __field_nullterminated

# define _In_ __in

# define _In_z_ __in_z

# define _In_reads_bytes_(x) __in_bcount(x)

# define _In_opt_ __in_opt

# define _Inout_ __inout

# define _Inout_opt_ __inout_opt

# define _Out_ __out

# define _Out_writes_bytes_(x) __out_bcount(x)

# define _Out_opt_ __out_opt

# define _Out_writes_bytes_opt_(x) __out_bcount_opt(x)

# define _Reserved_ __reserved

#endif

#ifndef _Must_inspect_result_

# define _Must_inspect_result_

#endif

#ifndef _Ret_maybenull_

# define _Ret_maybenull_

#endif

#ifndef _Ret_writes_bytes_maybenull_

# define _Ret_writes_bytes_maybenull_(Size)

#endif

#ifndef _Post_writable_byte_size_

# define _Post_writable_byte_size_(Size)

#endif

#ifndef _Post_invalid_

# define _Post_invalid_

#endif

#ifndef _Post_ptr_invalid_

# define _Post_ptr_invalid_

#endif

#ifndef _Notnull_

# define _Notnull_

#endif

#ifndef _Pre_

# define _Pre_

#endif

#ifndef _When_

# define _When_(x, y)

#endif

#ifndef _In_range_

# define _In_range_(x, y)

#endif

#ifndef _Out_range_

# define _Out_range_(x, y)

#endif

#ifndef _Frees_ptr_opt_

# define _Frees_ptr_opt_

#endif

#ifndef _Frees_ptr_

# define _Frees_ptr_

#endif

#ifndef _Inout_updates_opt_

# define _Inout_updates_opt_(x)

#endif

#ifndef _Inout_updates_

# define _Inout_updates_(x)

#endif

#ifndef _Out_writes_bytes_to_opt_

# define _Out_writes_bytes_to_opt_(x, y)

#endif

#ifndef _In_reads_opt_

# define _In_reads_opt_(x)

#endif

#ifndef _Strict_type_match_

# define _Strict_type_match_

#endif

#ifndef _Outptr_

# define _Outptr_

#endif

#ifndef _Outptr_result_maybenull_

# define _Outptr_result_maybenull_

#endif

#ifndef _Writable_elements_

# define _Writable_elements_(x)

#endif

#ifndef _In_opt_z_

# define _In_opt_z_

#endif

#ifndef _Printf_format_string_

# define _Printf_format_string_

#endif

#if defined(DDKBUILD)

# pragma push_macro("NtCurrentTeb")

# define NtCurrentTeb NtCurrentTeb_Mock // comes transiently from winnt.h

# include <WinDef.h>

# undef NtCurrentTeb

# pragma pop_macro("NtCurrentTeb")

#else

# pragma push_macro("NTSYSCALLAPI")

# pragma push_macro("NtCurrentTeb")

# ifdef NTSYSCALLAPI

# undef NTSYSCALLAPI

# define NTSYSCALLAPI

# endif

# pragma warning(push)

# pragma warning(disable : 4201)

# define OBJECT_INFORMATION_CLASS OBJECT_INFORMATION_CLASS_MOCK

# define _OBJECT_INFORMATION_CLASS _OBJECT_INFORMATION_CLASS_MOCK

# define _TEB _TEB_MOCK

# define TEB TEB_MOCK

# define PTEB PTEB_MOCK

# define ObjectBasicInformation ObjectBasicInformation_Mock

# define ObjectTypeInformation ObjectTypeInformation_Mock

# define NtQueryObject NtQueryObject_Mock

# define NtCurrentTeb NtCurrentTeb_Mock // comes transiently from winnt.h (via windef.h)

# include <winternl.h>

# undef OBJECT_INFORMATION_CLASS

# undef _OBJECT_INFORMATION_CLASS

# undef _TEB

# undef TEB

# undef PTEB

# undef ObjectBasicInformation

# undef ObjectTypeInformation

# undef NtQueryObject

# undef NtCurrentTeb

# pragma warning(pop)

# pragma pop_macro("NtCurrentTeb")

# pragma pop_macro("NTSYSCALLAPI")

#endif // DDKBUILD

#pragma warning(push)

#pragma warning(disable : 4005)

#include <ntstatus.h>

#pragma warning(pop)

#if defined(DDKBUILD)

# if defined(__cplusplus)

extern "C"

{

# endif

typedef struct _UNICODE_STRING

{

USHORT Length;

USHORT MaximumLength;

PWSTR Buffer;

} UNICODE_STRING;

typedef UNICODE_STRING* PUNICODE_STRING;

typedef const UNICODE_STRING* PCUNICODE_STRING;

typedef struct _OBJECT_ATTRIBUTES

} OBJECT_ATTRIBUTES;

typedef OBJECT_ATTRIBUTES* POBJECT_ATTRIBUTES;

# ifndef _NTDEF_

typedef _Success_(return >= 0) LONG NTSTATUS;

typedef NTSTATUS* PNTSTATUS;

# if defined(DDKBUILD)

typedef struct _STRING

} STRING;

typedef STRING* PSTRING;

typedef STRING ANSI_STRING;

typedef PSTRING PANSI_STRING;

typedef STRING OEM_STRING;

typedef PSTRING POEM_STRING;

typedef int PROCESSINFOCLASS;

typedef int THREADINFOCLASS;

typedef int SYSTEM_INFORMATION_CLASS;

typedef CONST char* PCSZ;

typedef PSTRING PCANSI_STRING;

# endif

# endif

typedef struct _IO_STATUS_BLOCK

} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;

# ifndef RtlMoveMemory

# define RtlMoveMemory(Destination, Source, Length) memmove((Destination), (Source), (Length)) // use __movsb?

# endif

# ifndef RtlFillMemory

# define RtlFillMemory(Destination, Length, Fill) memset((Destination), (Fill), (Length)) // use __stosb?

# endif

# ifndef RtlZeroMemory

# define RtlZeroMemory(Destination, Length) memset((Destination), 0, (Length))

# endif

# ifndef OBJ_INHERIT

# define OBJ_INHERIT 0x00000002L

# endif

NTSTATUS

NTAPI

NtClose(_In_ _Post_ptr_invalid_ HANDLE Handle);

VOID NTAPI RtlInitUnicodeString(_Out_ PUNICODE_STRING DestinationString, _In_opt_z_ PCWSTR SourceString);

# if defined(__cplusplus)

}

# endif

#endif // DDKBUILD

#ifndef InitializeObjectAttributes

# define InitializeObjectAttributes(p, n, a, r, s) \

{ \

(p)->Length = sizeof(OBJECT_ATTRIBUTES); \

(p)->RootDirectory = r; \

(p)->Attributes = a; \

(p)->ObjectName = n; \

(p)->SecurityDescriptor = s; \

(p)->SecurityQualityOfService = NULL; \

}

#endif

typedef enum _OBJECT_INFORMATION_CLASS

} OBJECT_INFORMATION_CLASS;

#ifndef RTL_CONSTANT_STRING

# if defined(__cplusplus)

extern "C++"

{

char _RTL_CONSTANT_STRING_type_check(const char* s);

char _RTL_CONSTANT_STRING_type_check(const WCHAR* s);

// __typeof would be desirable here instead of sizeof.

template <size_t N> class _RTL_CONSTANT_STRING_remove_const_template_class;

template <> class _RTL_CONSTANT_STRING_remove_const_template_class<sizeof(char)>

{

public:

typedef char T;

};

template <> class _RTL_CONSTANT_STRING_remove_const_template_class<sizeof(WCHAR)>

{

public:

typedef WCHAR T;

};

# define _RTL_CONSTANT_STRING_remove_const_macro(s) (const_cast<_RTL_CONSTANT_STRING_remove_const_template_class<sizeof((s)[0])>::T*>(s))

}

# else

char _RTL_CONSTANT_STRING_type_check(const void* s);

# define _RTL_CONSTANT_STRING_remove_const_macro(s) (s)

# endif // __cplusplus

# define RTL_CONSTANT_STRING(s) \

{ \

sizeof(s) - sizeof((s)[0]), sizeof(s) / (sizeof(_RTL_CONSTANT_STRING_type_check(s))), _RTL_CONSTANT_STRING_remove_const_macro(s) \

}

#endif // RTL_CONSTANT_STRING

#if defined(__cplusplus)

extern "C"

{

#endif

#ifndef OBJECT_TYPE_CREATE

# define OBJECT_TYPE_CREATE (0x0001)

#endif // OBJECT_TYPE_CREATE

#ifndef OBJECT_TYPE_ALL_ACCESS

# define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)

#endif // OBJECT_TYPE_ALL_ACCESS

#ifndef DIRECTORY_QUERY

# define DIRECTORY_QUERY (0x0001)

#endif // DIRECTORY_QUERY

#ifndef DIRECTORY_TRAVERSE

# define DIRECTORY_TRAVERSE (0x0002)

#endif // DIRECTORY_TRAVERSE

#ifndef DIRECTORY_CREATE_OBJECT

# define DIRECTORY_CREATE_OBJECT (0x0004)

#endif // DIRECTORY_CREATE_OBJECT

#ifndef DIRECTORY_CREATE_SUBDIRECTORY

# define DIRECTORY_CREATE_SUBDIRECTORY (0x0008)

#endif // DIRECTORY_CREATE_SUBDIRECTORY

#ifndef DIRECTORY_ALL_ACCESS

# define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)

#endif // DIRECTORY_ALL_ACCESS

#ifndef SYMBOLIC_LINK_QUERY

# define SYMBOLIC_LINK_QUERY (0x0001)

#endif // SYMBOLIC_LINK_QUERY

#ifndef SYMBOLIC_LINK_ALL_ACCESS

# define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)

#endif // SYMBOLIC_LINK_ALL_ACCESS

#if !defined(_NTDEF_) && !defined(_NTSTATUS_)

typedef _Success_(return >= 0) LONG NTSTATUS;

typedef NTSTATUS* PNTSTATUS;

# define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)

# define NT_INFORMATION(Status) ((((ULONG)(Status)) >> 30) == 1)

# define NT_WARNING(Status) ((((ULONG)(Status)) >> 30) == 2)

# define NT_ERROR(Status) ((((ULONG)(Status)) >> 30) == 3)

#endif

typedef enum _SECTION_INHERIT

} SECTION_INHERIT;

//

// Section Access Rights.

//

#ifndef SECTION_QUERY

# define SECTION_QUERY 0x0001

#endif // SECTION_QUERY

#ifndef SECTION_MAP_WRITE

# define SECTION_MAP_WRITE 0x0002

#endif // SECTION_MAP_WRITE

#ifndef SECTION_MAP_READ

# define SECTION_MAP_READ 0x0004

#endif // SECTION_MAP_READ

#ifndef SECTION_MAP_EXECUTE

# define SECTION_MAP_EXECUTE 0x0008

#endif // SECTION_MAP_EXECUTE

#ifndef SECTION_EXTEND_SIZE

# define SECTION_EXTEND_SIZE 0x0010

#endif // SECTION_EXTEND_SIZE

#ifndef SECTION_MAP_EXECUTE_EXPLICIT

# define SECTION_MAP_EXECUTE_EXPLICIT 0x0020 // not included in SECTION_ALL_ACCESS

#endif // SECTION_MAP_EXECUTE_EXPLICIT

#ifndef SECTION_ALL_ACCESS

# define SECTION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_WRITE | SECTION_MAP_READ | SECTION_MAP_EXECUTE | SECTION_EXTEND_SIZE)

#endif // SECTION_ALL_ACCESS

typedef struct _OBJECT_BASIC_INFORMATION

} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;

typedef struct _OBJECT_TYPE_INFORMATION

} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;

typedef struct _OBJECT_TYPES_INFORMATION

} OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION;

typedef struct _OBJECT_DIRECTORY_INFORMATION

} OBJECT_DIRECTORY_INFORMATION, *POBJECT_DIRECTORY_INFORMATION;

typedef enum _ATOM_INFORMATION_CLASS

} ATOM_INFORMATION_CLASS;

typedef enum _EVENT_INFORMATION_CLASS

{

EventBasicInformation

} EVENT_INFORMATION_CLASS;

typedef enum _IO_COMPLETION_INFORMATION_CLASS

{

IoCompletionBasicInformation

} IO_COMPLETION_INFORMATION_CLASS, *PIO_COMPLETION_INFORMATION_CLASS;

typedef enum _KEY_INFORMATION_CLASS

} KEY_INFORMATION_CLASS;

typedef enum _KEY_VALUE_INFORMATION_CLASS

} KEY_VALUE_INFORMATION_CLASS;

#if !defined(_WDMDDK_) && !defined(_WDM_INCLUDED_) && !defined(_DDK_DRIVER_) && !defined(WINAPI_FAMILY_PARTITION) && !defined(WINAPI_PARTITION_DESKTOP) && \

!defined(WINAPI_PARTITION_SYSTEM)

/* newer Windows Kits have this one, so we check for WINAPI_FAMILY_PARTITION and friends */

typedef enum _KEY_SET_INFORMATION_CLASS

} KEY_SET_INFORMATION_CLASS;

#endif

typedef enum _MUTANT_INFORMATION_CLASS

} MUTANT_INFORMATION_CLASS;

typedef enum _SECTION_INFORMATION_CLASS

} SECTION_INFORMATION_CLASS;

typedef enum _SEMAPHORE_INFORMATION_CLASS

{

SemaphoreBasicInformation

} SEMAPHORE_INFORMATION_CLASS;

typedef enum _TIMER_INFORMATION_CLASS

{

TimerBasicInformation

} TIMER_INFORMATION_CLASS;

typedef enum _EVENT_TYPE

} EVENT_TYPE, *PEVENT_TYPE;

typedef struct _EVENT_BASIC_INFORMATION

} EVENT_BASIC_INFORMATION, *PEVENT_BASIC_INFORMATION;

typedef struct _IO_COMPLETION_BASIC_INFORMATION

{

LONG Depth;

} IO_COMPLETION_BASIC_INFORMATION, *PIO_COMPLETION_BASIC_INFORMATION;

typedef struct _KEY_BASIC_INFORMATION

} KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;

typedef struct _KEY_VALUE_BASIC_INFORMATION

} KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION;

typedef struct _KEY_VALUE_FULL_INFORMATION

} KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;

typedef struct _KEY_VALUE_PARTIAL_INFORMATION

} KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;

typedef struct _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64

} KEY_VALUE_PARTIAL_INFORMATION_ALIGN64, *PKEY_VALUE_PARTIAL_INFORMATION_ALIGN64;

#if (_MSC_VER < 1500) || defined(DDKBUILD)

typedef struct _KEY_VALUE_ENTRY

} KEY_VALUE_ENTRY, *PKEY_VALUE_ENTRY;

#endif

typedef struct _MUTANT_BASIC_INFORMATION

} MUTANT_BASIC_INFORMATION, *PMUTANT_BASIC_INFORMATION;

typedef struct _SECTIONBASICINFO

} SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;

#pragma warning(push)

#pragma warning(disable : 4201 4214)

typedef struct _SECTION_IMAGE_INFORMATION

} SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;

#pragma warning(pop)

typedef struct _SEMAPHORE_BASIC_INFORMATION

} SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;

typedef struct _TIMER_BASIC_INFORMATION

} TIMER_BASIC_INFORMATION, *PTIMER_BASIC_INFORMATION;

//

// The context structure is used when generating 8.3 names. The caller must

// always zero out the structure before starting a new generation sequence

//

typedef struct _GENERATE_NAME_CONTEXT

} GENERATE_NAME_CONTEXT;

typedef GENERATE_NAME_CONTEXT* PGENERATE_NAME_CONTEXT;

#ifndef PIO_APC_ROUTINE_DEFINED

# pragma warning(push) /* disable code analyzer warnings for ATL & WTL libraries */

# pragma warning(disable : 28301) /* warning C28301 : No annotations for first declaration of ... */

typedef VOID(NTAPI* PIO_APC_ROUTINE)(_In_ PVOID ApcContext, _In_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG Reserved);

# define PIO_APC_ROUTINE_DEFINED

# pragma warning(pop) /* restore code analyzer warnings*/

#endif // PIO_APC_ROUTINE_DEFINED

typedef enum _NT_FILE_INFORMATION_CLASS

} NT_FILE_INFORMATION_CLASS, *PNT_FILE_INFORMATION_CLASS;

typedef struct _FILE_STREAM_INFORMATION

} FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION;

typedef struct _FILE_DIRECTORY_INFORMATION

} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;

typedef struct _FILE_FULL_DIR_INFORMATION

} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;

typedef struct _FILE_ID_FULL_DIR_INFORMATION

} FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION;

typedef struct _FILE_BOTH_DIR_INFORMATION

} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;

typedef struct _FILE_ID_BOTH_DIR_INFORMATION

} FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;

/* xref: https://googleprojectzero.blogspot.de/2016/02/the-definitive-guide-on-win32-to-nt.html */

typedef struct _RTL_RELATIVE_NAME

} RTL_RELATIVE_NAME, *PRTL_RELATIVE_NAME;

typedef enum

{

RtlPathTypeUnknown,

RtlPathTypeUncAbsolute,

RtlPathTypeDriveAbsolute,

RtlPathTypeDriveRelative,

RtlPathTypeRooted,

RtlPathTypeRelative,

RtlPathTypeLocalDevice,

RtlPathTypeRootLocalDevice,

} RTL_PATH_TYPE;

//

// I/O completion port access rights

//

#ifndef IO_COMPLETION_QUERY_STATE

# define IO_COMPLETION_QUERY_STATE 0x0001

#endif // IO_COMPLETION_QUERY_STATE

#ifndef IO_COMPLETION_MODIFY_STATE

# define IO_COMPLETION_MODIFY_STATE 0x0002

#endif // IO_COMPLETION_MODIFY_STATE

#ifndef IO_COMPLETION_ALL_ACCESS

# define IO_COMPLETION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | IO_COMPLETION_QUERY_STATE | IO_COMPLETION_MODIFY_STATE)

#endif // IO_COMPLETION_ALL_ACCESS

#if !defined(DYNAMIC_NTNATIVE) || (!DYNAMIC_NTNATIVE)

// Creating object types

NTSTATUS

NTAPI

NtCreateIoCompletion(_Out_ PHANDLE IoCompletionHandle,

_In_ ACCESS_MASK DesiredAccess,

_Inout_opt_ POBJECT_ATTRIBUTES ObjectAttributes,

_In_opt_ ULONG Count);

NTSTATUS

NTAPI

NtCreateKey(_Out_ PHANDLE KeyHandle,

_In_ ACCESS_MASK DesiredAccess,

_In_ POBJECT_ATTRIBUTES ObjectAttributes,

_Reserved_ ULONG TitleIndex,

_In_opt_ PUNICODE_STRING Class,

_In_ ULONG CreateOptions,

_Out_opt_ PULONG Disposition);

NTSTATUS

NTAPI

NtCreateSection(_Out_ PHANDLE SectionHandle,

_In_ ACCESS_MASK DesiredAccess,

_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,

_In_opt_ PLARGE_INTEGER MaximumSize,

_In_ ULONG SectionPageProtection,

_In_ ULONG AllocationAttributes,

_In_opt_ HANDLE FileHandle);

// Opening object types

NTSTATUS

NTAPI

NtOpenDirectoryObject(_Out_ PHANDLE DirectoryHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes);

NTSTATUS

NTAPI

NtOpenEvent(_Out_ PHANDLE EventHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes);

NTSTATUS

NTAPI

NtOpenEventPair(_Out_ PHANDLE EventPairHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes);

# if defined(DDKBUILD)

NTSTATUS

NTAPI

NtOpenFile(_Out_ PHANDLE FileHandle,

_In_ ACCESS_MASK DesiredAccess,

_In_ POBJECT_ATTRIBUTES ObjectAttributes,

_Out_ PIO_STATUS_BLOCK IoStatusBlock,

_In_ ULONG ShareAccess,

_In_ ULONG OpenOptions);

# endif // DDKBUILD

NTSTATUS

NTAPI