ntdll.h

#ifndef _NTDDK_
#define _NTDDK_

#define NT_INCLUDED
#define _NTDEF_
#define _CTYPE_DISABLE_MACROS

#ifndef _In_range_
#define _In_range_(a,b)
#endif
#ifndef _In_
#define _In_
#endif
#ifndef _In_z_
#define _In_z_
#endif
#ifndef _In_opt_
#define _In_opt_
#endif
#ifndef _Out_
#define _Out_
#endif
#ifndef IN
#define IN
#endif
#ifndef __in
#define __in
#endif
#ifndef __in_z
#define __in_z
#endif
#ifndef __drv_formatString
#define __drv_formatString(f)
#endif

#pragma warning(push)
#pragma warning(disable : 4200)
#pragma warning(disable : 4214)
#pragma warning(disable : 4201)

#ifndef WIN32_NO_STATUS

#undef STATUS_WAIT_0
#undef STATUS_ABANDONED_WAIT_0
#undef STATUS_USER_APC
#undef STATUS_TIMEOUT
#undef STATUS_PENDING
#undef DBG_CONTINUE
#undef STATUS_SEGMENT_NOTIFICATION
#undef DBG_TERMINATE_THREAD
#undef DBG_TERMINATE_PROCESS
#undef DBG_CONTROL_C
#undef DBG_CONTROL_BREAK
#undef STATUS_GUARD_PAGE_VIOLATION
#undef STATUS_DATATYPE_MISALIGNMENT
#undef STATUS_BREAKPOINT
#undef STATUS_SINGLE_STEP
#undef DBG_EXCEPTION_NOT_HANDLED
#undef STATUS_ACCESS_VIOLATION
#undef STATUS_IN_PAGE_ERROR
#undef STATUS_INVALID_HANDLE
#undef STATUS_NO_MEMORY
#undef STATUS_ILLEGAL_INSTRUCTION
#undef STATUS_NONCONTINUABLE_EXCEPTION
#undef STATUS_INVALID_DISPOSITION
#undef STATUS_ARRAY_BOUNDS_EXCEEDED
#undef STATUS_FLOAT_DENORMAL_OPERAND
#undef STATUS_FLOAT_DIVIDE_BY_ZERO
#undef STATUS_FLOAT_INEXACT_RESULT
#undef STATUS_FLOAT_INVALID_OPERATION
#undef STATUS_FLOAT_OVERFLOW
#undef STATUS_FLOAT_STACK_CHECK
#undef STATUS_FLOAT_UNDERFLOW
#undef STATUS_INTEGER_DIVIDE_BY_ZERO
#undef STATUS_INTEGER_OVERFLOW
#undef STATUS_PRIVILEGED_INSTRUCTION
#undef STATUS_STACK_OVERFLOW
#undef STATUS_CONTROL_C_EXIT
#undef STATUS_FLOAT_MULTIPLE_FAULTS
#undef STATUS_FLOAT_MULTIPLE_TRAPS
#undef STATUS_ILLEGAL_VLM_REFERENCE
#undef STATUS_REG_NAT_CONSUMPTION
#undef DBG_EXCEPTION_HANDLED
#undef DBG_COMMAND_EXCEPTION
#undef STATUS_SXS_EARLY_DEACTIVATION
#undef STATUS_SXS_INVALID_DEACTIVATION
#undef DBG_PRINTEXCEPTION_C
#undef DBG_RIPEXCEPTION
#undef STATUS_LONGJUMP
#undef STATUS_UNWIND_CONSOLIDATE
#undef STATUS_INVALID_PARAMETER
#undef STATUS_DLL_NOT_FOUND
#undef STATUS_ORDINAL_NOT_FOUND
#undef STATUS_ENTRYPOINT_NOT_FOUND
#undef STATUS_DLL_INIT_FAILED
#undef STATUS_STACK_BUFFER_OVERRUN
#undef STATUS_INVALID_CRUNTIME_PARAMETER
#undef STATUS_ASSERTION_FAILURE
#undef STATUS_FATAL_APP_EXIT
#undef STATUS_HEAP_CORRUPTION
#undef DBG_REPLY_LATER
#undef DBG_PRINTEXCEPTION_WIDE_C
#undef STATUS_ENCLAVE_VIOLATION
#undef STATUS_CONTROL_STACK_VIOLATION
#undef STATUS_INTERRUPTED
#undef STATUS_THREAD_NOT_RUNNING
#undef STATUS_ALREADY_REGISTERED

#endif

#include <ntstatus.h>

#if (_MSC_VER >= 800) || defined(_STDCALL_SUPPORTED)
#define NTAPI __stdcall
#else
#define _cdecl
#define NTAPI
#endif

#ifdef __cplusplus
extern "C"
{
#endif

#define MAXIMUM_FILENAME_LENGTH 256
#define PORT_MAXIMUM_MESSAGE_LENGTH 256
#define INITIAL_PRIVILEGE_COUNT 3

#define FSCTL_GET_VOLUME_INFORMATION 0x90064

    // constants for RtlDetermineDosPathNameType_U 
#define DOS_PATHTYPE_UNC 0x00000001	// \COMPUTER1
#define DOS_PATHTYPE_ROOTDRIVE 0x00000002	// C:
#define DOS_PATHTYPE_STREAM 0x00000003	// X:X or C:
#define DOS_PATHTYPE_NT 0x00000004	// \??\C:
#define DOS_PATHTYPE_NAME 0x00000005	// C
#define DOS_PATHTYPE_DEVICE 0x00000006	// \.C:
#define DOS_PATHTYPE_LOCALUNCROOT 0x00000007	// \.

    // Define the various device characteristics flags 
#define FILE_REMOVABLE_MEDIA 0x00000001
#define FILE_READ_ONLY_DEVICE 0x00000002
#define FILE_FLOPPY_DISKETTE 0x00000004
#define FILE_WRITE_ONCE_MEDIA 0x00000008
#define FILE_REMOTE_DEVICE 0x00000010
#define FILE_DEVICE_IS_MOUNTED 0x00000020
#define FILE_VIRTUAL_VOLUME 0x00000040
#define FILE_AUTOGENERATED_DEVICE_NAME 0x00000080
#define FILE_DEVICE_SECURE_OPEN 0x00000100

#define FILE_SUPERSEDE 0x00000000
#define FILE_OPEN 0x00000001
#define FILE_CREATE 0x00000002
#define FILE_OPEN_IF 0x00000003
#define FILE_OVERWRITE 0x00000004
#define FILE_OVERWRITE_IF 0x00000005
#define FILE_MAXIMUM_DISPOSITION 0x00000005

#define FILE_DIRECTORY_FILE 0x00000001
#define FILE_WRITE_THROUGH 0x00000002
#define FILE_SEQUENTIAL_ONLY 0x00000004
#define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008

#define FILE_SYNCHRONOUS_IO_ALERT 0x00000010
#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
#define FILE_NON_DIRECTORY_FILE 0x00000040
#define FILE_CREATE_TREE_CONNECTION 0x00000080

#define FILE_COMPLETE_IF_OPLOCKED 0x00000100
#define FILE_NO_EA_KNOWLEDGE 0x00000200
#define FILE_OPEN_FOR_RECOVERY 0x00000400
#define FILE_RANDOM_ACCESS 0x00000800

#define FILE_DELETE_ON_CLOSE 0x00001000
#define FILE_OPEN_BY_FILE_ID 0x00002000
#define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000
#define FILE_NO_COMPRESSION 0x00008000

#define FILE_RESERVE_OPFILTER 0x00100000
#define FILE_OPEN_REPARSE_POINT 0x00200000
#define FILE_OPEN_NO_RECALL 0x00400000
#define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000

#define FILE_COPY_STRUCTURED_STORAGE 0x00000041
#define FILE_STRUCTURED_STORAGE 0x00000441

#define FILE_VALID_OPTION_FLAGS 0x00ffffff
#define FILE_VALID_PIPE_OPTION_FLAGS 0x00000032
#define FILE_VALID_MAILSLOT_OPTION_FLAGS 0x00000032
#define FILE_VALID_SET_FLAGS 0x00000036

#ifndef FILE_DEVICE_CONSOLE
#define FILE_DEVICE_CONSOLE             0x00000050
#endif

    // THREAD STATES 
#define THREAD_STATE_INITIALIZED 0
#define THREAD_STATE_READY 1
#define THREAD_STATE_RUNNING 2
#define THREAD_STATE_STANDBY 3
#define THREAD_STATE_TERMINATED 4
#define THREAD_STATE_WAIT 5
#define THREAD_STATE_TRANSITION 6
#define THREAD_STATE_UNKNOWN 7

    // OBJECT TYPE CODES 
#define OB_TYPE_TYPE 1
#define OB_TYPE_DIRECTORY 2
#define OB_TYPE_SYMBOLIC_LINK 3
#define OB_TYPE_TOKEN 4
#define OB_TYPE_PROCESS 5
#define OB_TYPE_THREAD 6
#define OB_TYPE_EVENT 7
#define OB_TYPE_EVENT_PAIR 8
#define OB_TYPE_MUTANT 9
#define OB_TYPE_SEMAPHORE 10
#define OB_TYPE_TIMER 11
#define OB_TYPE_PROFILE 12
#define OB_TYPE_WINDOW_STATION 13
#define OB_TYPE_DESKTOP 14
#define OB_TYPE_SECTION 15
#define OB_TYPE_KEY 16
#define OB_TYPE_PORT 17
#define OB_TYPE_ADAPTER 18
#define OB_TYPE_CONTROLLER 19
#define OB_TYPE_DEVICE 20
#define OB_TYPE_DRIVER 21
#define OB_TYPE_IO_COMPLETION 22
#define OB_TYPE_FILE 23

#define OBJ_INHERIT 0x00000002
#define OBJ_PERMANENT 0x00000010
#define OBJ_EXCLUSIVE 0x00000020
#define OBJ_CASE_INSENSITIVE 0x00000040
#define OBJ_OPENIF 0x00000080
#define OBJ_OPENLINK 0x00000100
#define OBJ_VALID_ATTRIBUTES 0x000001F2


    // Object Manager Directory Specific Access Rights. 
#define DIRECTORY_QUERY 0x0001
#define DIRECTORY_TRAVERSE 0x0002
#define DIRECTORY_CREATE_OBJECT 0x0004
#define DIRECTORY_CREATE_SUBDIRECTORY 0x0008
#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)

    // Object Manager Symbolic Link Specific Access Rights. 
#define SYMBOLIC_LINK_QUERY 0x0001
#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)

#ifndef NT_SUCCESS
#define NT_SUCCESS(Status) ((LONG)(Status) >= 0)
#define NT_ERROR(Status) ((ULONG)(Status) >> 30 == 3)
#endif

#ifndef DEVICE_TYPE
#define DEVICE_TYPE DWORD
#endif

    //
    // Privilege attributes
    //

#define SE_PRIVILEGE_ENABLED_BY_DEFAULT (0x00000001L)
#define SE_PRIVILEGE_ENABLED            (0x00000002L)
#define SE_PRIVILEGE_REMOVED            (0X00000004L)
#define SE_PRIVILEGE_USED_FOR_ACCESS    (0x80000000L)

#define SE_PRIVILEGE_VALID_ATTRIBUTES   (SE_PRIVILEGE_ENABLED_BY_DEFAULT | \
                                         SE_PRIVILEGE_ENABLED            | \
                                         SE_PRIVILEGE_REMOVED            | \
                                         SE_PRIVILEGE_USED_FOR_ACCESS)


    //
    // Privilege Set Control flags
    //

#define PRIVILEGE_SET_ALL_NECESSARY    (1)

    //
    // These must be converted to LUIDs before other use that with
    // RtlAdjustPrivilege().
    //
#define SE_MIN_WELL_KNOWN_PRIVILEGE         (2L)
#define SE_CREATE_TOKEN_PRIVILEGE           (2L)
#define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE     (3L)
#define SE_LOCK_MEMORY_PRIVILEGE            (4L)
#define SE_INCREASE_QUOTA_PRIVILEGE         (5L)
#define SE_MACHINE_ACCOUNT_PRIVILEGE        (6L)
#define SE_TCB_PRIVILEGE                    (7L)
#define SE_SECURITY_PRIVILEGE               (8L)
#define SE_TAKE_OWNERSHIP_PRIVILEGE         (9L)
#define SE_LOAD_DRIVER_PRIVILEGE            (10L)
#define SE_SYSTEM_PROFILE_PRIVILEGE         (11L)
#define SE_SYSTEMTIME_PRIVILEGE             (12L)
#define SE_PROF_SINGLE_PROCESS_PRIVILEGE    (13L)
#define SE_INC_BASE_PRIORITY_PRIVILEGE      (14L)
#define SE_CREATE_PAGEFILE_PRIVILEGE        (15L)
#define SE_CREATE_PERMANENT_PRIVILEGE       (16L)
#define SE_BACKUP_PRIVILEGE                 (17L)
#define SE_RESTORE_PRIVILEGE                (18L)
#define SE_SHUTDOWN_PRIVILEGE               (19L)
#define SE_DEBUG_PRIVILEGE                  (20L)
#define SE_AUDIT_PRIVILEGE                  (21L)
#define SE_SYSTEM_ENVIRONMENT_PRIVILEGE     (22L)
#define SE_CHANGE_NOTIFY_PRIVILEGE          (23L)
#define SE_REMOTE_SHUTDOWN_PRIVILEGE        (24L)
#define SE_UNDOCK_PRIVILEGE                 (25L)
#define SE_SYNC_AGENT_PRIVILEGE             (26L)
#define SE_ENABLE_DELEGATION_PRIVILEGE      (27L)
#define SE_MANAGE_VOLUME_PRIVILEGE          (28L)
#define SE_IMPERSONATE_PRIVILEGE            (29L)
#define SE_CREATE_GLOBAL_PRIVILEGE          (30L)
#define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE (31L)
#define SE_RELABEL_PRIVILEGE                (32L)
#define SE_INC_WORKING_SET_PRIVILEGE        (33L)
#define SE_TIME_ZONE_PRIVILEGE              (34L)
#define SE_CREATE_SYMBOLIC_LINK_PRIVILEGE   (35L)
#define SE_MAX_WELL_KNOWN_PRIVILEGE         (SE_CREATE_SYMBOLIC_LINK_PRIVILEGE)

#define InitializeObjectAttributes( p, n, a, r, s ) { \
(p)->Length = sizeof( OBJECT_ATTRIBUTES ); \
(p)->RootDirectory = r; \
(p)->Attributes = a; \
(p)->ObjectName = n; \
(p)->SecurityDescriptor = s; \
(p)->SecurityQualityOfService = NULL; \
}


    typedef LONG NTSTATUS;
    /*lint -e624 */// Don't complain about different typedefs. 
                   // winnt 
    typedef NTSTATUS *PNTSTATUS;
    /*lint +e624 */// Resume checking for different typedefs. 

    typedef NTSTATUS(NTAPI * NTSYSCALL) ();
    typedef NTSYSCALL *PNTSYSCALL;

    typedef ULONG_PTR KAFFINITY;
    typedef KAFFINITY *PKAFFINITY;

    typedef LONG KPRIORITY;

    typedef BYTE KPROCESSOR_MODE;

    typedef VOID *POBJECT;

    typedef VOID(*PKNORMAL_ROUTINE) (IN PVOID NormalContext,
        IN PVOID SystemArgument1,
        IN PVOID SystemArgument2);

#ifndef _NTSECAPI_

    typedef struct _STRING
    {
        USHORT Length;
        USHORT MaximumLength;
#ifdef MIDL_PASS
        [size_is(MaximumLength), length_is(Length)]
#endif				// MIDL_PASS
        PCHAR Buffer;
    } STRING, *PSTRING;


    typedef struct _UNICODE_STRING
    {
        USHORT Length;
        USHORT MaximumLength;
        PWSTR Buffer;
    } UNICODE_STRING, *PUNICODE_STRING;

#endif

    typedef const PSTRING PCSTRING;

    typedef const PUNICODE_STRING PCUNICODE_STRING;

    typedef STRING ANSI_STRING;
    typedef PSTRING PANSI_STRING;

    typedef STRING OEM_STRING;
    typedef PSTRING POEM_STRING;


    typedef struct _HARDWARE_PTE
    {
        ULONG Valid : 1;
        ULONG Write : 1;
        ULONG Owner : 1;
        ULONG WriteThrough : 1;
        ULONG CacheDisable : 1;
        ULONG Accessed : 1;
        ULONG Dirty : 1;
        ULONG LargePage : 1;
        ULONG Global : 1;
        ULONG CopyOnWrite : 1;
        ULONG Prototype : 1;
        ULONG reserved : 1;
        ULONG PageFrameNumber : 20;
    } HARDWARE_PTE, *PHARDWARE_PTE;

    typedef struct _OBJECT_ATTRIBUTES
    {
        ULONG Length;
        HANDLE RootDirectory;
        PUNICODE_STRING ObjectName;
        ULONG Attributes;
        PVOID SecurityDescriptor;
        PVOID SecurityQualityOfService;
    } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;

    typedef struct _CLIENT_ID
    {
        DWORD_PTR UniqueProcess;
        DWORD_PTR UniqueThread;
    } CLIENT_ID, *PCLIENT_ID;

    typedef struct _PEB_FREE_BLOCK
    {
        struct _PEB_FREE_BLOCK *Next;
        ULONG Size;
    } PEB_FREE_BLOCK, *PPEB_FREE_BLOCK;

    typedef struct _CURDIR
    {
        UNICODE_STRING DosPath;
        HANDLE Handle;
    } CURDIR, *PCURDIR;

    typedef struct _RTL_DRIVE_LETTER_CURDIR
    {
        WORD Flags;
        WORD Length;
        DWORD TimeStamp;
        STRING DosPath;
    } RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;

#define PROCESS_PARAMETERS_NORMALIZED 1	// pointers in are absolute (not self-relative)

    typedef struct _PROCESS_PARAMETERS
    {
        ULONG MaximumLength;
        ULONG Length;
        ULONG Flags;		// PROCESS_PARAMETERS_NORMALIZED 
        ULONG DebugFlags;
        HANDLE ConsoleHandle;
        ULONG_PTR ConsoleFlags;
        HANDLE StandardInput;
        HANDLE StandardOutput;
        HANDLE StandardError;
        CURDIR CurrentDirectory;
        UNICODE_STRING DllPath;
        UNICODE_STRING ImagePathName;
        UNICODE_STRING CommandLine;
        PWSTR Environment;
        ULONG StartingX;
        ULONG StartingY;
        ULONG CountX;
        ULONG CountY;
        ULONG CountCharsX;
        ULONG CountCharsY;
        ULONG FillAttribute;
        ULONG WindowFlags;
        ULONG ShowWindowFlags;
        UNICODE_STRING WindowTitle;
        UNICODE_STRING Desktop;
        UNICODE_STRING ShellInfo;
        UNICODE_STRING RuntimeInfo;
        RTL_DRIVE_LETTER_CURDIR CurrentDirectores[32];
    } PROCESS_PARAMETERS, *PPROCESS_PARAMETERS;

    typedef struct _RTL_BITMAP
    {
        ULONG SizeOfBitMap;
        PULONG Buffer;
    } RTL_BITMAP, *PRTL_BITMAP, **PPRTL_BITMAP;

    //
    //  The following routine initializes a new bitmap.  It does not alter the
    //  data currently in the bitmap.  This routine must be called before
    //  any other bitmap routine/macro.
    //

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    NTSYSAPI
        VOID
        NTAPI
        RtlInitializeBitMap(
            OUT PRTL_BITMAP BitMapHeader,
            IN OPTIONAL PULONG BitMapBuffer,
            IN OPTIONAL ULONG SizeOfBitMap
        );
#endif

    //
    //  The following three routines clear, set, and test the state of a
    //  single bit in a bitmap.
    //

#if (NTDDI_VERSION >= NTDDI_WINXP)
    NTSYSAPI
        VOID
        NTAPI
        RtlClearBit(
            IN PRTL_BITMAP BitMapHeader,
            _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitNumber
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WINXP)
    NTSYSAPI
        VOID
        NTAPI
        RtlSetBit(
            IN PRTL_BITMAP BitMapHeader,
            _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitNumber
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WINXP)
    
        NTSYSAPI
        BOOLEAN
        NTAPI
        RtlTestBit(
            IN PRTL_BITMAP BitMapHeader,
            _In_range_(<, BitMapHeader->SizeOfBitMap) ULONG BitNumber
        );
#endif

    //
    //  The following two routines either clear or set all of the bits
    //  in a bitmap.
    //

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    NTSYSAPI
        VOID
        NTAPI
        RtlClearAllBits(
            IN PRTL_BITMAP BitMapHeader
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    NTSYSAPI
        VOID
        NTAPI
        RtlSetAllBits(
            IN PRTL_BITMAP BitMapHeader
        );
#endif

    //
    //  The following two routines locate a contiguous region of either
    //  clear or set bits within the bitmap.  The region will be at least
    //  as large as the number specified, and the search of the bitmap will
    //  begin at the specified hint index (which is a bit index within the
    //  bitmap, zero based).  The return value is the bit index of the located
    //  region (zero based) or -1 (i.e., 0xffffffff) if such a region cannot
    //  be located
    //

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    
        
        NTSYSAPI
        ULONG
        NTAPI
        RtlFindClearBits(
            IN PRTL_BITMAP BitMapHeader,
            IN ULONG NumberToFind,
            IN ULONG HintIndex
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    
        
        NTSYSAPI
        ULONG
        NTAPI
        RtlFindSetBits(
            IN PRTL_BITMAP BitMapHeader,
            IN ULONG NumberToFind,
            IN ULONG HintIndex
        );
#endif

    //
    //  The following two routines locate a contiguous region of either
    //  clear or set bits within the bitmap and either set or clear the bits
    //  within the located region.  The region will be as large as the number
    //  specified, and the search for the region will begin at the specified
    //  hint index (which is a bit index within the bitmap, zero based).  The
    //  return value is the bit index of the located region (zero based) or
    //  -1 (i.e., 0xffffffff) if such a region cannot be located.  If a region
    //  cannot be located then the setting/clearing of the bitmap is not performed.
    //

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    
        NTSYSAPI
        ULONG
        NTAPI
        RtlFindClearBitsAndSet(
            IN PRTL_BITMAP BitMapHeader,
            IN ULONG NumberToFind,
            IN ULONG HintIndex
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    
        NTSYSAPI
        ULONG
        NTAPI
        RtlFindSetBitsAndClear(
            IN PRTL_BITMAP BitMapHeader,
            IN ULONG NumberToFind,
            IN ULONG HintIndex
        );
#endif

    //
    //  The following two routines clear or set bits within a specified region
    //  of the bitmap.  The starting index is zero based.
    //

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    NTSYSAPI
        VOID
        NTAPI
        RtlClearBits(
            IN PRTL_BITMAP BitMapHeader,
            ULONG StartingIndex,
            ULONG NumberToClear
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    NTSYSAPI
        VOID
        NTAPI
        RtlSetBits(
            IN PRTL_BITMAP BitMapHeader,
            ULONG StartingIndex,
            ULONG NumberToSet
        );
#endif

    //
    //  The following routine locates a set of contiguous regions of clear
    //  bits within the bitmap.  The caller specifies whether to return the
    //  longest runs or just the first found lcoated.  The following structure is
    //  used to denote a contiguous run of bits.  The two routines return an array
    //  of this structure, one for each run located.
    //

    typedef struct _RTL_BITMAP_RUN {

        ULONG StartingIndex;
        ULONG NumberOfBits;

    } RTL_BITMAP_RUN;
    typedef RTL_BITMAP_RUN *PRTL_BITMAP_RUN;

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    NTSYSAPI
        ULONG
        NTAPI
        RtlFindClearRuns(
            IN PRTL_BITMAP BitMapHeader,
            OUT PRTL_BITMAP_RUN RunArray,
            IN ULONG SizeOfRunArray,
            IN BOOLEAN LocateLongestRuns
        );
#endif

    //
    //  The following routine locates the longest contiguous region of
    //  clear bits within the bitmap.  The returned starting index value
    //  denotes the first contiguous region located satisfying our requirements
    //  The return value is the length (in bits) of the longest region found.
    //

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    NTSYSAPI
        ULONG
        NTAPI
        RtlFindLongestRunClear(
            IN PRTL_BITMAP BitMapHeader,
            OUT PULONG StartingIndex
        );
#endif

    //
    //  The following routine locates the first contiguous region of
    //  clear bits within the bitmap.  The returned starting index value
    //  denotes the first contiguous region located satisfying our requirements
    //  The return value is the length (in bits) of the region found.
    //

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    NTSYSAPI
        ULONG
        NTAPI
        RtlFindFirstRunClear(
            IN PRTL_BITMAP BitMapHeader,
            OUT PULONG StartingIndex
        );
#endif

    //
    //  The following macro returns the value of the bit stored within the
    //  bitmap at the specified location.  If the bit is set a value of 1 is
    //  returned otherwise a value of 0 is returned.
    //
    //      ULONG
    //      RtlCheckBit (
    //          PRTL_BITMAP BitMapHeader,
    //          ULONG BitPosition
    //          );
    //
    //
    //  To implement CheckBit the macro retrieves the longword containing the
    //  bit in question, shifts the longword to get the bit in question into the
    //  low order bit position and masks out all other bits.
    //

#if defined(_M_AMD64) && !defined(MIDL_PASS)

    
        FORCEINLINE
        BOOLEAN
        RtlCheckBit(
            IN PRTL_BITMAP BitMapHeader,
            ULONG BitPosition
        )

    {
        return BitTest64((LONG64 const *)BitMapHeader->Buffer, (LONG64)BitPosition);
    }

#else

#define RtlCheckBit(BMH,BP) (((((PLONG)(BMH)->Buffer)[(BP) / 32]) >> ((BP) % 32)) & 0x1)

#endif

    //
    //  The following two procedures return to the caller the total number of
    //  clear or set bits within the specified bitmap.
    //

#if (NTDDI_VERSION >= NTDDI_WIN8)

    NTSYSAPI
        ULONG
        NTAPI
        RtlNumberOfClearBitsInRange(
            IN PRTL_BITMAP BitMapHeader,
            IN ULONG StartingIndex,
            IN ULONG Length
        );

    NTSYSAPI
        ULONG
        NTAPI
        RtlNumberOfSetBitsInRange(
            IN PRTL_BITMAP BitMapHeader,
            IN ULONG StartingIndex,
            IN ULONG Length
        );

#endif

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    NTSYSAPI
        ULONG
        NTAPI
        RtlNumberOfClearBits(
            IN PRTL_BITMAP BitMapHeader
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    NTSYSAPI
        ULONG
        NTAPI
        RtlNumberOfSetBits(
            IN PRTL_BITMAP BitMapHeader
        );
#endif

    //
    //  The following two procedures return to the caller a boolean value
    //  indicating if the specified range of bits are all clear or set.
    //

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    
        NTSYSAPI
        BOOLEAN
        NTAPI
        RtlAreBitsClear(
            IN PRTL_BITMAP BitMapHeader,
            IN ULONG StartingIndex,
            IN ULONG Length
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    
        NTSYSAPI
        BOOLEAN
        NTAPI
        RtlAreBitsSet(
            IN PRTL_BITMAP BitMapHeader,
            IN ULONG StartingIndex,
            IN ULONG Length
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    NTSYSAPI
        ULONG
        NTAPI
        RtlFindNextForwardRunClear(
            IN PRTL_BITMAP BitMapHeader,
            IN ULONG FromIndex,
            OUT PULONG StartingRunIndex
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    NTSYSAPI
        ULONG
        NTAPI
        RtlFindLastBackwardRunClear(
            IN PRTL_BITMAP BitMapHeader,
            IN ULONG FromIndex,
            OUT PULONG StartingRunIndex
        );
#endif

    //
    //  The following two procedures return to the caller a value indicating
    //  the position within a ULONGLONG of the most or least significant non-zero
    //  bit.  A value of zero results in a return value of -1.
    //

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    
        
        NTSYSAPI
        CCHAR
        NTAPI
        RtlFindLeastSignificantBit(
            IN ULONGLONG Set
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WIN2K)
    
        
        NTSYSAPI
        CCHAR
        NTAPI
        RtlFindMostSignificantBit(
            IN ULONGLONG Set
        );
#endif

    //
    // The following procedure finds the number of set bits within a ULONG_PTR
    // value.
    //

#if (NTDDI_VERSION >= NTDDI_VISTA)
    NTSYSAPI
        ULONG
        NTAPI
        RtlNumberOfSetBitsUlongPtr(
            IN ULONG_PTR Target
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WIN8)

    NTSYSAPI
        VOID
        NTAPI
        RtlCopyBitMap(
            IN PRTL_BITMAP Source,
            IN PRTL_BITMAP Destination,
            ULONG TargetBit
        );

    NTSYSAPI
        VOID
        NTAPI
        RtlExtractBitMap(
            IN PRTL_BITMAP Source,
            IN PRTL_BITMAP Destination,
            ULONG TargetBit,
            ULONG NumberOfBits
        );

#endif

#define LDR_STATIC_LINK 0x0000002
#define LDR_IMAGE_DLL 0x0000004
#define LDR_LOAD_IN_PROGRESS 0x0001000
#define LDR_UNLOAD_IN_PROGRESS 0x0002000
#define LDR_ENTRY_PROCESSED 0x0004000
#define LDR_ENTRY_INSERTED 0x0008000
#define LDR_CURRENT_LOAD 0x0010000
#define LDR_FAILED_BUILTIN_LOAD 0x0020000
#define LDR_DONT_CALL_FOR_THREADS 0x0040000
#define LDR_PROCESS_ATTACH_CALLED 0x0080000
#define LDR_DEBUG_SYMBOLS_LOADED 0x0100000
#define LDR_IMAGE_NOT_AT_BASE 0x0200000
#define LDR_WX86_IGNORE_MACHINETYPE 0x0400000

    typedef struct _LDR_DATA_TABLE_ENTRY
    {
        LIST_ENTRY InLoadOrderModuleList;
        LIST_ENTRY InMemoryOrderModuleList;
        LIST_ENTRY InInitializationOrderModuleList;
        PVOID DllBase;
        PVOID EntryPoint;
        ULONG SizeOfImage;		// in bytes 
        UNICODE_STRING FullDllName;
        UNICODE_STRING BaseDllName;
        ULONG Flags;		// LDR_* 
        USHORT LoadCount;
        USHORT TlsIndex;
        LIST_ENTRY HashLinks;
        PVOID SectionPointer;
        ULONG CheckSum;
        ULONG TimeDateStamp;
        // PVOID LoadedImports; // seems they are exist only on XP !!! 
        // PVOID EntryPointActivationContext; // -same- 
    } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

    typedef struct _PEB_LDR_DATA
    {
        ULONG Length;
        BOOLEAN Initialized;
        PVOID SsHandle;
        LIST_ENTRY InLoadOrderModuleList;	// ref. to PLDR_DATA_TABLE_ENTRY->InLoadOrderModuleList 
        LIST_ENTRY InMemoryOrderModuleList;	// ref. to PLDR_DATA_TABLE_ENTRY->InMemoryOrderModuleList 
        LIST_ENTRY InInitializationOrderModuleList;	// ref. to PLDR_DATA_TABLE_ENTRY->InInitializationOrderModuleList 
    } PEB_LDR_DATA, *PPEB_LDR_DATA;

    typedef VOID NTSYSAPI(*PPEBLOCKROUTINE) (PVOID);

    typedef struct _SYSTEM_STRINGS
    {
        UNICODE_STRING SystemRoot;	// C:WINNT 
        UNICODE_STRING System32Root;	// C:WINNTSystem32 
        UNICODE_STRING BaseNamedObjects;	// BaseNamedObjects 
    } SYSTEM_STRINGS, *PSYSTEM_STRINGS;

    typedef struct _TEXT_INFO
    {
        PVOID Reserved;
        PSYSTEM_STRINGS SystemStrings;
    } TEXT_INFO, *PTEXT_INFO;

    typedef struct _PEB
    {
        UCHAR InheritedAddressSpace;	// 0 
        UCHAR ReadImageFileExecOptions;	// 1 
        UCHAR BeingDebugged;	// 2 
        BYTE b003;			// 3 
#ifdef _WIN64
        BYTE b004;			// 3 
        BYTE b005;			// 3 
        BYTE b006;			// 3 
        BYTE b007;			// 3 
#endif
        PVOID Mutant;		// 4 
        PVOID ImageBaseAddress;	// 8 
        PPEB_LDR_DATA Ldr;		// C 
        PPROCESS_PARAMETERS ProcessParameters;	// 10 
        PVOID SubSystemData;	// 14 
        PVOID ProcessHeap;		// 18 
        KSPIN_LOCK FastPebLock;	// 1C 
        PPEBLOCKROUTINE FastPebLockRoutine;	// 20 
        PPEBLOCKROUTINE FastPebUnlockRoutine;	// 24 
        ULONG EnvironmentUpdateCount;	// 28 
        PVOID *KernelCallbackTable;	// 2C 
        PVOID EventLogSection;	// 30 
        PVOID EventLog;		// 34 
        PPEB_FREE_BLOCK FreeList;	// 38 
        ULONG TlsExpansionCounter;	// 3C 
        PRTL_BITMAP TlsBitmap;	// 40 
        ULONG TlsBitmapData[0x2];	// 44 
        PVOID ReadOnlySharedMemoryBase;	// 4C 
        PVOID ReadOnlySharedMemoryHeap;	// 50 
        PTEXT_INFO ReadOnlyStaticServerData;	// 54 
        PVOID InitAnsiCodePageData;	// 58 
        PVOID InitOemCodePageData;	// 5C 
        PVOID InitUnicodeCaseTableData;	// 60 
        ULONG KeNumberProcessors;	// 64 
        ULONG NtGlobalFlag;		// 68 
        DWORD d6C;			// 6C 
        LARGE_INTEGER MmCriticalSectionTimeout;	// 70 
        ULONG MmHeapSegmentReserve;	// 78 
        ULONG MmHeapSegmentCommit;	// 7C 
        ULONG MmHeapDeCommitTotalFreeThreshold;	// 80 
        ULONG MmHeapDeCommitFreeBlockThreshold;	// 84 
        ULONG NumberOfHeaps;	// 88 
        ULONG AvailableHeaps;	// 8C 
        PHANDLE ProcessHeapsListBuffer;	// 90 
        PVOID GdiSharedHandleTable;	// 94 
        PVOID ProcessStarterHelper;	// 98 
        PVOID GdiDCAttributeList;	// 9C 
        KSPIN_LOCK LoaderLock;	// A0 
        ULONG NtMajorVersion;	// A4 
        ULONG NtMinorVersion;	// A8 
        USHORT NtBuildNumber;	// AC 
        USHORT NtCSDVersion;	// AE 
        ULONG PlatformId;		// B0 
        ULONG Subsystem;		// B4 
        ULONG MajorSubsystemVersion;	// B8 
        ULONG MinorSubsystemVersion;	// BC 
        KAFFINITY AffinityMask;	// C0 
        ULONG GdiHandleBuffer[0x22];	// C4 
        ULONG PostProcessInitRoutine;	// 14C 
        ULONG TlsExpansionBitmap;	// 150 
        UCHAR TlsExpansionBitmapBits[0x80];	// 154 
        ULONG SessionId;		// 1D4 
        ULARGE_INTEGER AppCompatFlags;	// 1D8 
        PWORD CSDVersion;		// 1E0 
                                        /* PVOID AppCompatInfo; // 1E4
                                        UNICODE_STRING usCSDVersion;
                                        PVOID ActivationContextData;
                                        PVOID ProcessAssemblyStorageMap;
                                        PVOID SystemDefaultActivationContextData;
                                        PVOID SystemAssemblyStorageMap;
                                        ULONG MinimumStackCommit; */
    } PEB, *PPEB;

    typedef struct _TEB
    {
        NT_TIB Tib;
        PVOID EnvironmentPointer;
        CLIENT_ID Cid;
        PVOID ActiveRpcInfo;
        PVOID ThreadLocalStoragePointer;
        PPEB Peb;
        ULONG LastErrorValue;
        ULONG CountOfOwnedCriticalSections;
        PVOID CsrClientThread;
        PVOID Win32ThreadInfo;
        ULONG Win32ClientInfo[0x1F];
        PVOID WOW32Reserved;
        ULONG CurrentLocale;
        ULONG FpSoftwareStatusRegister;
        PVOID SystemReserved1[0x36];
        PVOID Spare1;
        LONG ExceptionCode;
        ULONG SpareBytes1[0x28];
        PVOID SystemReserved2[0xA];
        ULONG gdiRgn;
        ULONG gdiPen;
        ULONG gdiBrush;
        CLIENT_ID RealClientId;
        PVOID GdiCachedProcessHandle;
        ULONG GdiClientPID;
        ULONG GdiClientTID;
        PVOID GdiThreadLocaleInfo;
        PVOID UserReserved[5];
        PVOID glDispatchTable[0x118];
        ULONG glReserved1[0x1A];
        PVOID glReserved2;
        PVOID glSectionInfo;
        PVOID glSection;
        PVOID glTable;
        PVOID glCurrentRC;
        PVOID glContext;
        NTSTATUS LastStatusValue;
        UNICODE_STRING StaticUnicodeString;
        WCHAR StaticUnicodeBuffer[0x105];
        PVOID DeallocationStack;
        PVOID TlsSlots[0x40];
        LIST_ENTRY TlsLinks;
        PVOID Vdm;
        PVOID ReservedForNtRpc;
        PVOID DbgSsReserved[0x2];
        ULONG HardErrorDisabled;
        PVOID Instrumentation[0x10];
        PVOID WinSockData;
        ULONG GdiBatchCount;
        ULONG Spare2;
        ULONG Spare3;
        ULONG Spare4;
        PVOID ReservedForOle;
        ULONG WaitingOnLoaderLock;
        PVOID StackCommit;
        PVOID StackCommitMax;
        PVOID StackReserve;
    } TEB, *PTEB;

#define NtCurrentDirectoryHandle() \
  (NtCurrentTeb()->Peb->ProcessParameters->CurrentDirectory.Handle)

    typedef enum _POOL_TYPE
    {
        NonPagedPool,
        PagedPool,
        NonPagedPoolMustSucceed,
        DontUseThisType,
        NonPagedPoolCacheAligned,
        PagedPoolCacheAligned,
        NonPagedPoolCacheAlignedMustS,
        MaxPoolType
    } POOL_TYPE, *PPOOL_TYPE;

    typedef enum _KWAIT_REASON
    {
        Executive,
        FreePage,
        PageIn,
        PoolAllocation,
        DelayExecution,
        Suspended,
        UserRequest,
        WrExecutive,
        WrFreePage,
        WrPageIn,
        WrPoolAllocation,
        WrDelayExecution,
        WrSuspended,
        WrUserRequest,
        WrEventPair,
        WrQueue,
        WrLpcReceive,
        WrLpcReply,
        WrVirtualMemory,
        WrPageOut,
        WrRendezvous,
        Spare2,
        Spare3,
        Spare4,
        Spare5,
        Spare6,
        WrKernel,
        MaximumWaitReason
    } KWAIT_REASON, *PKWAIT_REASON;

    typedef struct _DISPATCHER_HEADER
    {
        BYTE uType;			//DO_TYPE_* 
        BYTE uAbsolute;
        BYTE uSize;			// number of DWORDs 
        BYTE uInserted;
        LONG lSignalState;
        LIST_ENTRY WaitListHead;
    } DISPATCHER_HEADER, *PDISPATCHER_HEADER;

    typedef struct _KPROCESS
    {
        DISPATCHER_HEADER Header;	// DO_TYPE_PROCESS (0x1A) 
        LIST_ENTRY le10;
        DWORD d18;
        DWORD d1C;
        DWORD d20;
        DWORD d24;
        DWORD d28;
        DWORD d2C;
        DWORD d30;
        DWORD d34;
        DWORD dKernelTime;		// ticks 
        DWORD dUserTime;		// ticks 
        LIST_ENTRY le40;
        LIST_ENTRY OutSwapList;
        LIST_ENTRY ThreadListHead;	// KTHREAD.ThreadList 
        DWORD d58;
        KAFFINITY AffinityMask;
        WORD w60;
        BYTE bBasePriority;
        BYTE b63;
        WORD w64;
        BYTE b66;
        BOOLEAN fPriorityBoost;
    } KPROCESS, *PKPROCESS;

    typedef struct _PORT_MESSAGE
    {
        USHORT DataSize;
        USHORT MessageSize;
        USHORT MessageType;
        USHORT VirtualRangesOffset;
        CLIENT_ID ClientId;
        ULONG MessageId;
        ULONG SectionSize;
        // UCHAR Data[]; 
    } PORT_MESSAGE, *PPORT_MESSAGE;

    typedef struct _SERVICE_DESCRIPTOR_TABLE
    {
        PNTSYSCALL ServiceTable;	// array of entrypoints 
        PULONG puCounterTable;	// array of counters 
        ULONG uTableSize;		// number of table entries 
        PBYTE pbArgumentTable;	// array of byte counts 
    } SERVICE_DESCRIPTOR_TABLE, *PSERVICE_DESCRIPTOR_TABLE;

    typedef struct _KSEMAPHORE
    {
        DISPATCHER_HEADER Header;
        LONG lLimit;
    } KSEMAPHORE, *PKSEMAPHORE;

    typedef struct _KTHREAD
    {
        DISPATCHER_HEADER Header;	// DO_TYPE_THREAD (0x6C) 
        LIST_ENTRY le010;
        DWORD d018;
        DWORD d01C;
        PTEB pTeb;
        DWORD d024;
        DWORD d028;
        BYTE b02C;
        BYTE bThreadState;		// THREAD_STATE_* 
        WORD w02E;
        WORD w030;
        BYTE b032;
        BYTE bPriority;
        LIST_ENTRY le034;
        LIST_ENTRY le03C;
        PKPROCESS pProcess;
        DWORD d048;
        DWORD dContextSwitches;
        DWORD d050;
        WORD w054;
        BYTE b056;
        BYTE bWaitReason;
        DWORD d058;
        PLIST_ENTRY ple05C;
        PLIST_ENTRY ple060;
        DWORD d064;
        BYTE bBasePriority;
        BYTE b069;
        WORD w06A;
        DWORD d06C;
        DWORD d070;
        DWORD d074;
        DWORD d078;
        DWORD d07C;
        DWORD d080;
        DWORD d084;
        DWORD d088;
        DWORD d08C;
        DWORD d090;
        DWORD d094;
        DWORD d098;
        DWORD d09C;
        DWORD d0A0;
        DWORD d0A4;
        DWORD d0A8;
        DWORD d0AC;
        DWORD d0B0;
        DWORD d0B4;
        DWORD d0B8;
        DWORD d0BC;
        DWORD d0C0;
        DWORD d0C4;
        DWORD d0C8;
        DWORD d0CC;
        DWORD d0D0;
        DWORD d0D4;
        DWORD d0D8;
        PSERVICE_DESCRIPTOR_TABLE pServiceDescriptorTable;
        DWORD d0E0;
        DWORD d0E4;
        DWORD d0E8;
        DWORD d0EC;
        LIST_ENTRY le0F0;
        DWORD d0F8;
        DWORD d0FC;
        DWORD d100;
        DWORD d104;
        DWORD d108;
        DWORD d10C;
        DWORD d110;
        DWORD d114;
        DWORD d118;
        BYTE b11C;
        BYTE b11D;
        WORD w11E;
        DWORD d120;
        DWORD d124;
        DWORD d128;
        DWORD d12C;
        DWORD d130;
        WORD w134;
        BYTE b136;
        KPROCESSOR_MODE ProcessorMode;
        DWORD dKernelTime;		// ticks 
        DWORD dUserTime;		// ticks 
        DWORD d140;
        DWORD d144;
        DWORD d148;
        DWORD d14C;
        DWORD d150;
        DWORD d154;
        DWORD d158;
        DWORD d15C;
        DWORD d160;
        DWORD d164;
        DWORD d168;
        DWORD d16C;
        DWORD d170;
        PROC SuspendNop;
        DWORD d178;
        DWORD d17C;
        DWORD d180;
        DWORD d184;
        DWORD d188;
        DWORD d18C;
        KSEMAPHORE SuspendSemaphore;
        LIST_ENTRY ThreadList;	// KPROCESS.ThreadListHead 
        DWORD d1AC;
    } KTHREAD, *PKTHREAD;

    typedef struct _ETHREAD
    {
        KTHREAD Tcb;
        LARGE_INTEGER liCreateTime;
        LARGE_INTEGER liExitTime;
        NTSTATUS ExitStatus;
        LIST_ENTRY PostBlockList;
        LIST_ENTRY TerminationPortList;
        ULONG uActiveTimerListLock;
        LIST_ENTRY ActiveTimerListHead;
        CLIENT_ID Cid;
        KSEMAPHORE LpcReplySemaphore;
        ULONG uLpcReplyMessage;
        LARGE_INTEGER liLpcReplyMessageId;
        ULONG uImpersonationInfo;
        LIST_ENTRY IrpList;
        LIST_ENTRY TopLevelIrp;
        ULONG uReadClusterSize;
        BOOLEAN fForwardClusterOnly;
        BOOLEAN fDisablePageFaultClustering;
        BOOLEAN fDeadThread;
        BOOLEAN fHasTerminated;
        ULONG uEventPair;
        ULONG uGrantedAccess;
        ULONG uThreadsProcess;
        PVOID pStartAddress;
        PVOID Win32StartAddress;
        BOOLEAN fLpcExitThreadCalled;
        BOOLEAN fHardErrorsAreDisabled;
        WORD wUknown1;
        DWORD dwUknown2;
    } ETHREAD, *PETHREAD;

    typedef PETHREAD ERESOURCE_THREAD, *PERESOURCE_THREAD;

    typedef struct _KEVENT
    {
        DISPATCHER_HEADER Header;
    } KEVENT, *PKEVENT;

    typedef struct _ERESOURCE_OLD
    {
        LIST_ENTRY SystemResourcesList;
        PERESOURCE_THREAD OwnerThreads;
        PBYTE pbOwnerCounts;
        WORD wTableSize;
        WORD wActiveCount;
        WORD wFlag;
        WORD wTableRover;
        BYTE bInitialOwnerCounts[4];
        ERESOURCE_THREAD InitialOwnerThreads[4];
        DWORD dwUknown1;
        ULONG uContentionCount;
        WORD wNumberOfExclusiveWaiters;
        WORD wNumberOfSharedWaiters;
        KSEMAPHORE SharedWaiters;
        KEVENT ExclusiveWaiters;
        KSPIN_LOCK SpinLock;
        ULONG uCreatorBackTraceIndex;
        WORD wDepth;
        WORD wUknown2;
        PVOID pOwnerBackTrace[4];
    } ERESOURCE_OLD, *PERESOURCE_OLD;

    typedef struct _OWNER_ENTRY
    {
        ERESOURCE_THREAD OwnerThread;
        SHORT sOwnerCount;
        WORD wTableSize;
    } OWNER_ENTRY, *POWNER_ENTRY;

    typedef struct _ERESOURCE_LITE
    {
        LIST_ENTRY SystemResourcesList;
        POWNER_ENTRY OwnerTable;
        SHORT sActiveCount;
        WORD wFlag;
        PKSEMAPHORE SharedWaiters;
        PKEVENT ExclusiveWaiters;
        OWNER_ENTRY OwnerThreads[2];
        ULONG uContentionCount;
        WORD wNumberOfSharedWaiters;
        WORD wNumberOfExclusiveWaiters;
        union
        {
            PVOID pAddress;
            ULONG uCreatorBackTraceIndex;
        };
        KSPIN_LOCK SpinLock;
    } ERESOURCE_LITE, *PERESOURCE_LITE;

    typedef ERESOURCE_LITE ERESOURCE, *PERESOURCE;

    //
    // Define the base asynchronous I/O argument types
    //

    typedef struct _IO_STATUS_BLOCK {
        union {
            NTSTATUS Status;
            PVOID Pointer;
        } DUMMYUNIONNAME;

        ULONG_PTR Information;
    } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;


    //
    // Define the I/O status information return values for NtCreateFile/NtOpenFile
    //

#define FILE_SUPERSEDED                 0x00000000
#define FILE_OPENED                     0x00000001
#define FILE_CREATED                    0x00000002
#define FILE_OVERWRITTEN                0x00000003
#define FILE_EXISTS                     0x00000004
#define FILE_DOES_NOT_EXIST             0x00000005

#if defined(_WIN64)

    typedef struct _IO_STATUS_BLOCK32 {
        NTSTATUS Status;
        ULONG Information;
    } IO_STATUS_BLOCK32, *PIO_STATUS_BLOCK32;

#endif

    /* Defined in Winnt.h
    typedef struct _QUOTA_LIMITS {
    SIZE_T PagedPoolLimit;
    SIZE_T NonPagedPoolLimit;
    SIZE_T MinimumWorkingSetSize;
    SIZE_T MaximumWorkingSetSize;
    SIZE_T PagefileLimit;
    LARGE_INTEGER TimeLimit;
    } QUOTA_LIMITS, *PQUOTA_LIMITS;
    */

    typedef struct _IOCOUNTERS
    {
        ULONG uReadOperationCount;
        ULONG uWriteOperationCount;
        ULONG uOtherOperationCount;
        LARGE_INTEGER liReadTransferCount;
        LARGE_INTEGER liWriteTransferCount;
        LARGE_INTEGER liOtherTransferCount;
    } IOCOUNTERS, *PIOCOUNTERS;

    typedef struct _VM_COUNTERS
    {
        ULONG uPeakVirtualSize;
        ULONG uVirtualSize;
        ULONG uPageFaultCount;
        ULONG uPeakWorkingSetSize;
        ULONG uWorkingSetSize;
        ULONG uQuotaPeakPagedPoolUsage;
        ULONG uQuotaPagedPoolUsage;
        ULONG uQuotaPeakNonPagedPoolUsage;
        ULONG uQuotaNonPagedPoolUsage;
        ULONG uPagefileUsage;
        ULONG uPeakPagefileUsage;
    } VM_COUNTERS, *PVM_COUNTERS;

    typedef struct _KERNEL_USER_TIMES
    {
        LARGE_INTEGER liCreateTime;
        LARGE_INTEGER liExitTime;
        LARGE_INTEGER liKernelTime;
        LARGE_INTEGER liUserTime;
    } KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;

    typedef struct _BASE_PRIORITY_INFORMATION
    {
        KPRIORITY BasePriority;
    } BASE_PRIORITY_INFORMATION, *PBASE_PRIORITY_INFORMATION;

    typedef struct _AFFINITY_MASK
    {
        KAFFINITY AffinityMask;
    } AFFINITY_MASK, *PAFFINITY_MASK;

    typedef struct _TIME_FIELDS
    {
        WORD wYear;
        WORD wMonth;
        WORD wDay;
        WORD wHour;
        WORD wMinute;
        WORD wSecond;
        WORD wMilliseconds;
        WORD wWeekday;
    } TIME_FIELDS, *PTIME_FIELDS;

    typedef void(*PIO_APC_ROUTINE) (PVOID ApcContext,
        PIO_STATUS_BLOCK IoStatusBlock,
        ULONG Reserved);

#if(_WIN32_WINNT < 0x0400)

    typedef struct _NTFS_VOLUME_DATA_BUFFER
    {
        LARGE_INTEGER liSerialNumber;
        LARGE_INTEGER liNumberOfSectors;
        LARGE_INTEGER liTotalClusters;
        LARGE_INTEGER liFreeClusters;
        LARGE_INTEGER liReserved;
        ULONG uBytesPerSector;
        ULONG uBytesPerCluster;
        ULONG uBytesPerMFTRecord;
        ULONG uClustersPerMFTRecord;
        LARGE_INTEGER liMFTLength;
        LARGE_INTEGER liMFTStart;
        LARGE_INTEGER liMFTMirrorStart;
        LARGE_INTEGER liMFTZoneStart;
        LARGE_INTEGER liMFTZoneEnd;
    } NTFS_VOLUME_DATA_BUFFER, *PNTFS_VOLUME_DATA_BUFFER;

#endif

    typedef struct _OBJDIR_INFORMATION
    {
        UNICODE_STRING ObjectName;
        UNICODE_STRING ObjectTypeName;	// e.g. Directory, Device ... 
        UCHAR Data[1];		// variable length 
    } OBJDIR_INFORMATION, *POBJDIR_INFORMATION;

    // Define the file system information class values 
    typedef enum _FSINFOCLASS
    {
        FileFsVolumeInformation = 1,
        FileFsLabelInformation,	// 2 
        FileFsSizeInformation,	// 3 
        FileFsDeviceInformation,	// 4 
        FileFsAttributeInformation,	// 5 
        FileFsControlInformation,	// 6 
        FileFsFullSizeInformation,	// 7 
        FileFsObjectIdInformation,	// 8 
        FileFsMaximumInformation
    } FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS;

    typedef struct _FILE_FS_VOLUME_INFORMATION
    {
        LARGE_INTEGER VolumeCreationTime;
        ULONG VolumeSerialNumber;
        ULONG VolumeLabelLength;
        BOOLEAN SupportsObjects;
        WCHAR VolumeLabel[1];
    } FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;

    typedef struct _FILE_FS_LABEL_INFORMATION
    {
        ULONG VolumeLabelLength;
        WCHAR VolumeLabel[1];
    } FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;

    typedef struct _FILE_FS_SIZE_INFORMATION
    {
        LARGE_INTEGER TotalAllocationUnits;
        LARGE_INTEGER AvailableAllocationUnits;
        ULONG SectorsPerAllocationUnit;
        ULONG BytesPerSector;
    } FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;

    typedef struct _FILE_FS_DEVICE_INFORMATION
    {
        DEVICE_TYPE DeviceType;
        ULONG Characteristics;
    } FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;

    typedef struct _FILE_FS_ATTRIBUTE_INFORMATION
    {
        ULONG FileSystemAttributes;
        LONG MaximumComponentNameLength;
        ULONG FileSystemNameLength;
        WCHAR FileSystemName[1];
    } FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;

    typedef struct _FILE_FS_CONTROL_INFORMATION
    {
        LARGE_INTEGER FreeSpaceStartFiltering;
        LARGE_INTEGER FreeSpaceThreshold;
        LARGE_INTEGER FreeSpaceStopFiltering;
        LARGE_INTEGER DefaultQuotaThreshold;
        LARGE_INTEGER DefaultQuotaLimit;
        ULONG FileSystemControlFlags;
    } FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;

    typedef struct _FILE_FS_FULL_SIZE_INFORMATION
    {
        LARGE_INTEGER TotalQuotaAllocationUnits;
        LARGE_INTEGER AvailableQuotaAllocationUnits;
        LARGE_INTEGER AvailableAllocationUnits;
        ULONG SectorsPerAllocationUnit;
        ULONG BytesPerSector;
    } FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;

    typedef struct _FILE_FS_OBJECT_ID_INFORMATION
    {
        GUID VolumeObjectId;
        ULONG VolumeObjectIdExtendedInfo[12];
    } FILE_FS_OBJECT_ID_INFORMATION, *PFILE_FS_OBJECT_ID_INFORMATION;

    typedef enum _SYSTEMINFOCLASS
    {
        SystemBasicInformation,	// 0x002C 
        SystemProcessorInformation,	// 0x000C 
        SystemPerformanceInformation,	// 0x0138 
        SystemTimeInformation,	// 0x0020 
        SystemPathInformation,	// not implemented 
        SystemProcessInformation,	// 0x00C8+ per process 
        SystemCallInformation,	// 0x0018 + (n * 0x0004) 
        SystemConfigurationInformation,	// 0x0018 
        SystemProcessorCounters,	// 0x0030 per cpu 
        SystemGlobalFlag,		// 0x0004 (fails if size != 4) 
        SystemCallTimeInformation,	// not implemented 
        SystemModuleInformation,	// 0x0004 + (n * 0x011C) 
        SystemLockInformation,	// 0x0004 + (n * 0x0024) 
        SystemStackTraceInformation,	// not implemented 
        SystemPagedPoolInformation,	// checked build only 
        SystemNonPagedPoolInformation,	// checked build only 
        SystemHandleInformation,	// 0x0004 + (n * 0x0010) 
        SystemObjectTypeInformation,	// 0x0038+ + (n * 0x0030+) 
        SystemPageFileInformation,	// 0x0018+ per page file 
        SystemVdmInstemulInformation,	// 0x0088 
        SystemVdmBopInformation,	// invalid info class 
        SystemCacheInformation,	// 0x0024 
        SystemPoolTagInformation,	// 0x0004 + (n * 0x001C) 
        SystemInterruptInformation,	// 0x0000, or 0x0018 per cpu 
        SystemDpcInformation,	// 0x0014 
        SystemFullMemoryInformation,	// checked build only 
        SystemLoadDriver,		// 0x0018, set mode only 
        SystemUnloadDriver,		// 0x0004, set mode only 
        SystemTimeAdjustmentInformation,	// 0x000C, 0x0008 writeable 
        SystemSummaryMemoryInformation,	// checked build only 
        SystemNextEventIdInformation,	// checked build only 
        SystemEventIdsInformation,	// checked build only 
        SystemCrashDumpInformation,	// 0x0004 
        SystemExceptionInformation,	// 0x0010 
        SystemCrashDumpStateInformation,	// 0x0004 
        SystemDebuggerInformation,	// 0x0002 
        SystemContextSwitchInformation,	// 0x0030 
        SystemRegistryQuotaInformation,	// 0x000C 
        SystemAddDriver,		// 0x0008, set mode only 
        SystemPrioritySeparationInformation,	// 0x0004, set mode only 
        SystemPlugPlayBusInformation,	// not implemented 
        SystemDockInformation,	// not implemented 
        SystemPowerInfo,		// 0x0060 (XP only!) 
        SystemProcessorSpeedInformation,	// 0x000C (XP only!) 
        SystemTimeZoneInformation,	// 0x00AC 
        SystemLookasideInformation,	// n * 0x0020 
        SystemSetTimeSlipEvent,
        SystemCreateSession,	// set mode only 
        SystemDeleteSession,	// set mode only 
        SystemInvalidInfoClass1,	// invalid info class 
        SystemRangeStartInformation,	// 0x0004 (fails if size != 4) 
        SystemVerifierInformation,
        SystemAddVerifier,
        SystemSessionProcessesInformation,	// checked build only 
        MaxSystemInfoClass
    } SYSTEMINFOCLASS, *PSYSTEMINFOCLASS;

#if defined(_WIN64)
    typedef ULONG SYSINF_PAGE_COUNT;
#else
    typedef SIZE_T SYSINF_PAGE_COUNT;
#endif

    typedef struct _SYSTEM_BASIC_INFORMATION {
        ULONG Reserved;
        ULONG TimerResolution;
        ULONG PageSize;
        SYSINF_PAGE_COUNT NumberOfPhysicalPages;
        SYSINF_PAGE_COUNT LowestPhysicalPageNumber;
        SYSINF_PAGE_COUNT HighestPhysicalPageNumber;
        ULONG AllocationGranularity;
        ULONG_PTR MinimumUserModeAddress;
        ULONG_PTR MaximumUserModeAddress;
        ULONG_PTR ActiveProcessorsAffinityMask;
        CCHAR NumberOfProcessors;
    } SYSTEM_BASIC_INFORMATION, * PSYSTEM_BASIC_INFORMATION;

    typedef struct _SYSTEM_PROCESSOR_INFORMATION
    {
        WORD wKeProcessorArchitecture;	// PROCESSOR_ARCHITECTURE_* (PROCESSOR_ARCHITECTURE_INTEL) 
        WORD wKeProcessorLevel;	// PROCESSOR_* (PROCESSOR_INTEL_PENTIUM) 
        WORD wKeProcessorRevision;	// Pentium: H=model, L=stepping 
        WORD wUnknown1;		// 0 
        ULONG uKeFeatureBits;
    } SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION;

    typedef struct _MM_INFO_COUNTERS
    {
        ULONG uPageFaults;
        ULONG uWriteCopyFaults;
        ULONG uTransistionFaults;
        ULONG uCacheTransitionCount;
        ULONG uDemandZeroFaults;
        ULONG uPagesRead;
        ULONG uPageReadIos;
        ULONG uCacheReadCount;
        ULONG uCacheIoCount;
        ULONG uPagefilePagesWritten;
        ULONG uPagefilePageWriteIos;
        ULONG uMappedFilePagesWritten;
        ULONG uMappedFilePageWriteIos;
    } MM_INFO_COUNTERS, *PMM_INFO_COUNTERS;

    typedef struct _SYSTEM_PERFORMANCE_INFORMATION
    {
        LARGE_INTEGER liIdleTime;	// 100 nsec units 
        LARGE_INTEGER liIoReadTransferCount;
        LARGE_INTEGER liIoWriteTransferCount;
        LARGE_INTEGER liIoOtherTransferCount;
        ULONG uIoReadOperationCount;
        ULONG uIoWriteOperationCount;
        ULONG uIoOtherOperationCount;
        ULONG uMmAvailablePages;
        ULONG uMmTotalCommittedPages;
        ULONG uMmTotalCommitLimit;	// pages 
        ULONG uMmPeakCommitLimit;	// pages 
        MM_INFO_COUNTERS MmInfoCounters;
        ULONG uPoolPaged;		// pages 
        ULONG uPoolNonPaged;	// pages 
        ULONG uPagedPoolAllocs;
        ULONG uPagedPoolFrees;
        ULONG uNonPagedPoolAllocs;
        ULONG uNonPagedPoolFrees;
        ULONG uMmTotalFreeSystemPages;
        ULONG uMmSystemCodePage;
        ULONG uMmTotalSystemDriverPages;
        ULONG uMmTotalSystemCodePages;
        ULONG uSmallNonPagedLookasideListAllocateHits;
        ULONG uSmallPagedLookasideListAllocateHits;
        DWORD dwUnknown1;
        ULONG uMmSystemCachePage;
        ULONG uMmPagedPoolPage;
        ULONG uMmSystemDriverPage;
        ULONG uCcFastReadNoWait;
        ULONG uCcFastReadWait;
        ULONG uCcFastReadResourceMiss;
        ULONG uCcFastReadNotPossible;
        ULONG uCcFastMdlReadNoWait;
        ULONG uCcFastMdlReadWait;
        ULONG uCcFastMdlReadResourceMiss;
        ULONG uCcFastMdlReadNotPossible;
        ULONG uCcMapDataNoWait;
        ULONG uCcMapDataWait;
        ULONG uCcMapDataNoWaitMiss;
        ULONG uCcMapDataWaitMiss;
        ULONG uCcPinMappedDataCount;
        ULONG uCcPinReadNoWait;
        ULONG uCcPinReadWait;
        ULONG uCcPinReadNoWaitMiss;
        ULONG uCcPinReadWaitMiss;
        ULONG uCcCopyReadNoWait;
        ULONG uCcCopyReadWait;
        ULONG uCcCopyReadNoWaitMiss;
        ULONG uCcCopyReadWaitMiss;
        ULONG uCcMdlReadNoWait;
        ULONG uCcMdlReadWait;
        ULONG uCcMdlReadNoWaitMiss;
        ULONG uCcMdlReadWaitMiss;
        ULONG uCcReadAheadIos;
        ULONG uCcLazyWriteIos;
        ULONG uCcLazyWritePages;
        ULONG uCcDataFlushes;
        ULONG uCcDataPages;
        ULONG uTotalContextSwitches;	// total across cpus 
        ULONG uFirstLevelTbFills;
        ULONG uSecondLevelTbFills;
        ULONG uSystemCalls;
    } SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;

    typedef struct _SYSTEM_TIME_INFORMATION
    {
        LARGE_INTEGER liKeBootTime;	// relative to 01-01-1601 
        LARGE_INTEGER liKeSystemTime;	// relative to 01-01-1601 
        LARGE_INTEGER liExpTimeZoneBias;	// utc time = local time + bias 
        ULONG uExpCurrentTimeZoneId;	// TIME_ZONE_ID_* (TIME_ZONE_ID_UNKNOWN, etc.) 
        DWORD dwUnknown1;
    } SYSTEM_TIME_INFORMATION, *PSYSTEM_TIME_INFORMATION;

    typedef enum
    {
        StateInitialized,
        StateReady,
        StateRunning,
        StateStandby,
        StateTerminated,
        StateWait,
        StateTransition,
        StateUnknown
    } THREAD_STATE;

    typedef struct _SYSTEM_THREAD
    {
        LARGE_INTEGER liKernelTime;	// 100 nsec units 
        LARGE_INTEGER liUserTime;	// 100 nsec units 
        LARGE_INTEGER liCreateTime;	// relative to 01-01-1601 
        ULONG WaitTime;		// ticks 
        PVOID pStartAddress;	// EIP 
        CLIENT_ID Cid;		// process/thread ids 
        KPRIORITY Priority;
        KPRIORITY BasePriority;
        ULONG ContextSwitches;
        THREAD_STATE ThreadState;
        KWAIT_REASON WaitReason;
        // DWORD dwUnknown2; // maybe it not exists !!! 
    } SYSTEM_THREAD, *PSYSTEM_THREAD;

    typedef struct _SYSTEM_PROCESS_INFORMATION {
        ULONG NextEntryOffset;
        ULONG NumberOfThreads;
        LARGE_INTEGER SpareLi1;
        LARGE_INTEGER SpareLi2;
        LARGE_INTEGER SpareLi3;
        LARGE_INTEGER CreateTime;
        LARGE_INTEGER UserTime;
        LARGE_INTEGER KernelTime;
        UNICODE_STRING ImageName;
        KPRIORITY BasePriority;
        HANDLE UniqueProcessId;
        HANDLE InheritedFromUniqueProcessId;
        ULONG HandleCount;
        ULONG SessionId;
        ULONG_PTR PageDirectoryBase;
        SIZE_T PeakVirtualSize;
        SIZE_T VirtualSize;
        ULONG PageFaultCount;
        SIZE_T PeakWorkingSetSize;
        SIZE_T WorkingSetSize;
        SIZE_T QuotaPeakPagedPoolUsage;
        SIZE_T QuotaPagedPoolUsage;
        SIZE_T QuotaPeakNonPagedPoolUsage;
        SIZE_T QuotaNonPagedPoolUsage;
        SIZE_T PagefileUsage;
        SIZE_T PeakPagefileUsage;
        SIZE_T PrivatePageCount;
        LARGE_INTEGER ReadOperationCount;
        LARGE_INTEGER WriteOperationCount;
        LARGE_INTEGER OtherOperationCount;
        LARGE_INTEGER ReadTransferCount;
        LARGE_INTEGER WriteTransferCount;
        LARGE_INTEGER OtherTransferCount;
    } SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;

    typedef struct _IO_COUNTERSEX
    {
        LARGE_INTEGER ReadOperationCount;
        LARGE_INTEGER WriteOperationCount;
        LARGE_INTEGER OtherOperationCount;
        LARGE_INTEGER ReadTransferCount;
        LARGE_INTEGER WriteTransferCount;
        LARGE_INTEGER OtherTransferCount;
    } IO_COUNTERSEX, *PIO_COUNTERSEX;

    typedef struct _SYSTEM_PROCESS_INFORMATION_2000
    {
        ULONG uNext;		// relative offset 
        ULONG uThreadCount;
        LARGE_INTEGER liUnknown1;
        LARGE_INTEGER liUnknown2;
        LARGE_INTEGER liUnknown3;
        LARGE_INTEGER liCreateTime;	// relative to 01-01-1601 
        LARGE_INTEGER liUserTime;	// 100 nsec units 
        LARGE_INTEGER liKernelTime;	// 100 nsec units 
        UNICODE_STRING usName;
        KPRIORITY BasePriority;
        ULONG uUniqueProcessId;
        ULONG uInheritedFromUniqueProcessId;
        ULONG uHandleCount;
        ULONG uSessionId;		// W2K Only! 
        DWORD dwUnknown5;
        VM_COUNTERS VmCounters;
        ULONG uCommitCharge;	// bytes 
        IO_COUNTERSEX IoCounters;
        SYSTEM_THREAD aST[];
    } SYSTEM_PROCESS_INFORMATION_2000, *PSYSTEM_PROCESS_INFORMATION_2000;

    typedef struct _SYSTEM_CALL_INFORMATION
    {
        ULONG Length;
        ULONG NumberOfTables;
        // ULONG NumberOfEntries[NumberOfTables] 
        // ULONG CallCounts[NumberOfTables][NumberOfEntries]; 
    } SYSTEM_CALL_INFORMATION, *PSYSTEM_CALL_INFORMATION;

    typedef struct _SYSTEM_CONFIGURATION_INFORMATION
    {
        ULONG uDiskCount;
        ULONG uFloppyCount;
        ULONG uCDRomCount;
        ULONG uTapeCount;
        ULONG uSerialCount;		// com port with mouse not included 
        ULONG uParallelCount;
    } SYSTEM_CONFIGURATION_INFORMATION, *PSYSTEM_CONFIGURATION_INFORMATION;

    typedef struct _SYSTEM_PROCESSOR_COUNTERS
    {
        LARGE_INTEGER liProcessorTime;	// 100 nsec units 
        LARGE_INTEGER liKernelTime;	// 100 nsec units 
        LARGE_INTEGER liUserTime;	// 100 nsec units 
        LARGE_INTEGER liDpcTime;	// 100 nsec units 
        LARGE_INTEGER liInterruptTime;	// 100 nsec units 
        ULONG uInterruptCount;
        DWORD dwUnknown1;
    } SYSTEM_PROCESSOR_COUNTERS, *PSYSTEM_PROCESSOR_COUNTERS;

    typedef struct _SYSTEM_GLOBAL_FLAG
    {
        ULONG NtGlobalFlag;		// see Q147314, Q102985, Q105677 
    } SYSTEM_GLOBAL_FLAG, *PSYSTEM_GLOBAL_FLAG;

    typedef struct _SYSTEM_CALL_TIME_INFORMATION
    {
        ULONG Length;
        ULONG TotalCalls;
        LARGE_INTEGER TimeOfCalls[1];
    } SYSTEM_CALL_TIME_INFORMATION, *PSYSTEM_CALL_TIME_INFORMATION;

    typedef struct _SYSTEM_MODULE
    {
        ULONG Reserved[2];
        ULONG Base;
        ULONG Size;
        ULONG Flags;
        USHORT Index;
        USHORT Unknown;
        USHORT LoadCount;
        USHORT ModuleNameOffset;
        CHAR ImageName[256];
    } SYSTEM_MODULE, *PSYSTEM_MODULE;

    typedef struct _SYSTEM_MODULE_INFORMATION
    {
        ULONG uCount;
        SYSTEM_MODULE aSM[];
    } SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

    typedef struct _SYSTEM_LOCK
    {
        union
        {
            PERESOURCE_OLD pEResourceOld;	// old ERESOURCE format 
            PERESOURCE_LITE pEResourceLite;	// new "lite" format 
            PERESOURCE pEResource;	// current format 
        };
        WORD wUnknown1;		// 1 
        WORD wUnknown2;		// 0 
        ULONG ExclusiveOwnerThreadId;
        ULONG uActiveCount;
        ULONG uContentionCount;
        DWORD dwUnknown3;
        DWORD dwUnknown4;
        ULONG uNumberOfSharedWaiters;
        ULONG uNumberOfExclusiveWaiters;
    } SYSTEM_LOCK, *PSYSTEM_LOCK;

    typedef struct _SYSTEM_LOCK_INFORMATION
    {
        ULONG uCount;
        SYSTEM_LOCK aSL[];
    } SYSTEM_LOCK_INFORMATION, *PSYSTEM_LOCK_INFORMATION;

    typedef struct _SYSTEM_HANDLE
    {
        ULONG ProcessId;
        UCHAR ObjectType;		// OB_TYPE_* (OB_TYPE_TYPE, etc.) 
        UCHAR Flags;		// HANDLE_FLAG_* (HANDLE_FLAG_INHERIT, etc.) 
        USHORT Handle;
        POBJECT Object;
        ACCESS_MASK GrantedAccess;
    } SYSTEM_HANDLE, *PSYSTEM_HANDLE;

    typedef struct _SYSTEM_HANDLE_INFORMATION
    {
        ULONG HandleCount;
        SYSTEM_HANDLE Handles[];
    } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

    typedef struct _SYSTEM_OBJECTTYPE_INFORMATION
    {
        ULONG NextEntryOffset;	// absolute offset 
        ULONG ObjectCount;
        ULONG HandleCount;
        ULONG TypeIndex;		// OB_TYPE_* (OB_TYPE_TYPE, etc.) 
        ULONG InvalidAttributes;	// OBJ_* (OBJ_INHERIT, etc.) 
        GENERIC_MAPPING GenericMapping;
        ACCESS_MASK ValidAccessMask;
        POOL_TYPE PoolType;
        BOOLEAN SecurityRequired;
        BOOLEAN WaitableObject;
        UNICODE_STRING TypeName;
    } SYSTEM_OBJECTTYPE_INFORMATION, *PSYSTEM_OBJECTTYPE_INFORMATION;

    // follows after SYSTEM_OBJECTTYPE_INFORMATION.TypeName 
    typedef struct _SYSTEM_OBJECT_INFORMATION
    {
        ULONG NextEntryOffset;	// absolute offset 
        POBJECT Object;
        ULONG CreatorProcessId;
        USHORT CreatorBackTraceIndex;
        USHORT Flags;		// see "Native API Reference" page 24 
        LONG PointerCount;
        LONG HandleCount;
        ULONG PagedPoolCharge;
        ULONG NonPagedPoolCharge;
        ULONG ExclusiveProcessId;
        PSECURITY_DESCRIPTOR SecurityDescriptor;
        UNICODE_STRING ObjectName;
    } SYSTEM_OBJECT_INFORMATION, *PSYSTEM_OBJECT_INFORMATION;

    typedef struct _SYSTEM_PAGE_FILE_INFORMATION
    {
        ULONG NextEntryOffset;	// relative offset 
        ULONG CurrentSize;		// pages 
        ULONG TotalUsed;		// pages 
        ULONG PeakUsed;		// pages 
        UNICODE_STRING FileName;
    } SYSTEM_PAGE_FILE_INFORMATION, *PSYSTEM_PAGE_FILE_INFORMATION;

    typedef struct _SYSTEM_VDM_INSTEMUL_INFO
    {
        BOOL fExVdmSegmentNotPresent;
        ULONG uOpcode0FV86;
        ULONG uOpcodeESPrefixV86;
        ULONG uOpcodeCSPrefixV86;
        ULONG uOpcodeSSPrefixV86;
        ULONG uOpcodeDSPrefixV86;
        ULONG uOpcodeFSPrefixV86;
        ULONG uOpcodeGSPrefixV86;
        ULONG uOpcodeOPER32PrefixV86;
        ULONG uOpcodeADDR32PrefixV86;
        ULONG uOpcodeINSBV86;
        ULONG uOpcodeINSWV86;
        ULONG uOpcodeOUTSBV86;
        ULONG uOpcodeOUTSWV86;
        ULONG uOpcodePUSHFV86;
        ULONG uOpcodePOPFV86;
        ULONG uOpcodeINTnnV86;
        ULONG uOpcodeINTOV86;
        ULONG uOpcodeIRETV86;
        ULONG uOpcodeINBimmV86;
        ULONG uOpcodeINWimmV86;
        ULONG uOpcodeOUTBimmV86;
        ULONG uOpcodeOUTWimmV86;
        ULONG uOpcodeINBV86;
        ULONG uOpcodeINWV86;
        ULONG uOpcodeOUTBV86;
        ULONG uOpcodeOUTWV86;
        ULONG uOpcodeLOCKPrefixV86;
        ULONG uOpcodeREPNEPrefixV86;
        ULONG uOpcodeREPPrefixV86;
        ULONG uOpcodeHLTV86;
        ULONG uOpcodeCLIV86;
        ULONG uOpcodeSTIV86;
        ULONG uVdmBopCount;
    } SYSTEM_VDM_INSTEMUL_INFO, *PSYSTEM_VDM_INSTEMUL_INFO;

    typedef struct _SYSTEM_CACHE_INFORMATION
    {
        ULONG uFileCache;		// bytes 
        ULONG uFileCachePeak;	// bytes 
        ULONG PageFaultCount;
        ULONG MinimumWorkingSet;
        ULONG MaximumWorkingSet;
        ULONG TransitionSharedPages;
        ULONG TransitionSharedPagesPeak;
        ULONG Reserved[2];
    } SYSTEM_CACHE_INFORMATION, *PSYSTEM_CACHE_INFORMATION;

    typedef struct _SYSTEM_POOL_ENTRY
    {
        BOOLEAN Allocated;
        BOOLEAN Spare0;
        USHORT AllocatorBackTraceIndex;
        ULONG Size;
        union
        {
            UCHAR Tag[4];
            ULONG TagUlong;
            PVOID ProcessChargedQuota;
        };
    } SYSTEM_POOL_ENTRY, *PSYSTEM_POOL_ENTRY;

    typedef struct _SYSTEM_POOL_INFORMATION
    {
        ULONG TotalSize;
        PVOID FirstEntry;
        USHORT EntryOverhead;
        BOOLEAN PoolTagPresent;
        BOOLEAN Spare0;
        ULONG NumberOfEntries;
        SYSTEM_POOL_ENTRY Entries[1];
    } SYSTEM_POOL_INFORMATION, *PSYSTEM_POOL_INFORMATION;

    typedef struct _SYSTEM_POOL_TAG
    {
        union
        {
            UCHAR Tag[4];
            ULONG TagUlong;
        };
        ULONG PagedPoolAllocs;
        ULONG PagedPoolFrees;
        ULONG PagedPoolUsage;
        ULONG NonPagedPoolAllocs;
        ULONG NonPagedPoolFrees;
        ULONG NonPagedPoolUsage;
    } SYSTEM_POOL_TAG, *PSYSTEM_POOL_TAG;

    typedef struct _SYSTEM_POOL_TAG_INFORMATION
    {
        ULONG uCount;
        SYSTEM_POOL_TAG aSPT[];
    } SYSTEM_POOL_TAG_INFORMATION, *PSYSTEM_POOL_TAG_INFORMATION;

    typedef struct _SYSTEM_INTERRUPT_INFORMATION
    {
        ULONG ContextSwitches;
        ULONG DpcCount;
        ULONG DpcRate;
        ULONG TimeIncrement;
        ULONG DpcBypassCount;
        ULONG ApcBypassCount;
    } SYSTEM_INTERRUPT_INFORMATION, *PSYSTEM_INTERRUPT_INFORMATION;

    typedef struct _SYSTEM_DPC_INFORMATION
    {
        DWORD dwUnknown1;
        ULONG MaximumDpcQueueDepth;
        ULONG MinimumDpcRate;
        ULONG AdjustDpcThreshold;
        ULONG IdealDpcRate;
    } SYSTEM_DPC_INFORMATION, *PSYSTEM_DPC_INFORMATION;

    typedef struct _SYSTEM_MEMORY_INFO
    {
        PUCHAR StringOffset;
        USHORT ValidCount;
        USHORT TransitionCount;
        USHORT ModifiedCount;
        USHORT PageTableCount;
    } SYSTEM_MEMORY_INFO, *PSYSTEM_MEMORY_INFO;

    typedef struct _SYSTEM_MEMORY_INFORMATION
    {
        ULONG InfoSize;
        ULONG StringStart;
        SYSTEM_MEMORY_INFO Memory[1];
    } SYSTEM_MEMORY_INFORMATION, *PSYSTEM_MEMORY_INFORMATION;

    typedef struct _SYSTEM_LOAD_DRIVER
    {
        UNICODE_STRING DriverName;	// input 
        PVOID BaseAddress;		// output 
        PVOID SectionPointer;	// output 
        PVOID EntryPoint;		// output 
        PIMAGE_EXPORT_DIRECTORY ExportDirectory;	// output 
    } SYSTEM_LOAD_DRIVER, *PSYSTEM_LOAD_DRIVER;

    typedef struct _SYSTEM_UNLOAD_DRIVER
    {
        PVOID SectionPointer;
    } SYSTEM_UNLOAD_DRIVER, *PSYSTEM_UNLOAD_DRIVER;

    typedef struct _SYSTEM_QUERY_TIME_ADJUSTMENT
    {
        ULONG TimeAdjustment;
        ULONG MaximumIncrement;
        BOOLEAN TimeSynchronization;
    } SYSTEM_QUERY_TIME_ADJUSTMENT, *PSYSTEM_QUERY_TIME_ADJUSTMENT;

    typedef struct _SYSTEM_SET_TIME_ADJUSTMENT
    {
        ULONG TimeAdjustment;
        BOOLEAN TimeSynchronization;
    } SYSTEM_SET_TIME_ADJUSTMENT, *PSYSTEM_SET_TIME_ADJUSTMENT;

    typedef struct _SYSTEM_CRASH_DUMP_INFORMATION
    {
        HANDLE CrashDumpSectionHandle;
    } SYSTEM_CRASH_DUMP_INFORMATION, *PSYSTEM_CRASH_DUMP_INFORMATION;

    typedef struct _SYSTEM_CRASH_DUMP_INFORMATION_2000
    {
        HANDLE CrashDumpSectionHandle;
        HANDLE Unknown;		// Windows 2000 only 
    } SYSTEM_CRASH_DUMP_INFORMATION_2000, *PSYSTEM_CRASH_DUMP_INFORMATION_2000;

    typedef struct _SYSTEM_EXCEPTION_INFORMATION
    {
        ULONG AlignmentFixupCount;
        ULONG ExceptionDispatchCount;
        ULONG FloatingEmulationCount;
        ULONG ByteWordEmulationCount;
    } SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION;

    typedef struct _SYSTEM_CRASH_DUMP_STATE_INFORMATION
    {
        ULONG ValidCrashDump;
    } SYSTEM_CRASH_DUMP_STATE_INFORMATION,
        *PSYSTEM_CRASH_DUMP_STATE_INFORMATION;

    typedef struct _SYSTEM_CRASH_DUMP_STATE_INFORMATION_2000
    {
        ULONG ValidCrashDump;
        ULONG Unknown;		// Windows 2000 only 
    } SYSTEM_CRASH_DUMP_STATE_INFORMATION_2000,
        *PSYSTEM_CRASH_DUMP_STATE_INFORMATION_2000;

    typedef struct _SYSTEM_DEBUGGER_INFORMATION
    {
        BOOLEAN KernelDebuggerEnabled;
        BOOLEAN KernelDebuggerNotPresent;
    } SYSTEM_DEBUGGER_INFORMATION, *PSYSTEM_DEBUGGER_INFORMATION;

    typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION
    {
        ULONG ContextSwitches;
        ULONG FindAny;
        ULONG FindLast;
        ULONG FindIdeal;
        ULONG IdleAny;
        ULONG IdleCurrent;
        ULONG IdleLast;
        ULONG IdleIdeal;
        ULONG PreemptAny;
        ULONG PreemptCurrent;
        ULONG PreemptLast;
        ULONG SwitchToIdle;
    } SYSTEM_CONTEXT_SWITCH_INFORMATION, *PSYSTEM_CONTEXT_SWITCH_INFORMATION;

    typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION
    {
        ULONG  RegistryQuotaAllowed;
        ULONG  RegistryQuotaUsed;
        SIZE_T PagedPoolSize;
    } SYSTEM_REGISTRY_QUOTA_INFORMATION, * PSYSTEM_REGISTRY_QUOTA_INFORMATION;

    typedef struct _SYSTEM_ADD_DRIVER
    {
        UNICODE_STRING ModuleName;
    } SYSTEM_ADD_DRIVER, *PSYSTEM_ADD_DRIVER;

    typedef struct _SYSTEM_PRIORITY_SEPARATION_INFORMATION
    {
        ULONG PrioritySeparation;	// 0..2 
    } SYSTEM_PRIORITY_SEPARATION_INFORMATION,
        *PSYSTEM_PRIORITY_SEPARATION_INFORMATION;

    typedef enum _PLUGPLAY_BUS_CLASS
    {
        SystemBus,
        PlugPlayVirtualBus,
        MaxPlugPlayBusClass
    } PLUGPLAY_BUS_CLASS, *PPLUGPLAY_BUS_CLASS;

    typedef enum _PLUGPLAY_VIRTUAL_BUS_TYPE
    {
        Root,
        MaxPlugPlayVirtualBusType
    } PLUGPLAY_VIRTUAL_BUS_TYPE, *PPLUGPLAY_VIRTUAL_BUS_TYPE;

    typedef enum _INTERFACE_TYPE
    {
        InterfaceTypeUndefined = -1,
        Internal,
        Isa,
        Eisa,
        MicroChannel,
        TurboChannel,
        PCIBus,
        VMEBus,
        NuBus,
        PCMCIABus,
        CBus,
        MPIBus,
        MPSABus,
        ProcessorInternal,
        InternalPowerBus,
        PNPISABus,
        PNPBus,
        MaximumInterfaceType
    } INTERFACE_TYPE, *PINTERFACE_TYPE;

    typedef struct _PLUGPLAY_BUS_TYPE
    {
        PLUGPLAY_BUS_CLASS BusClass;
        union
        {
            INTERFACE_TYPE SystemBusType;
            PLUGPLAY_VIRTUAL_BUS_TYPE PlugPlayVirtualBusType;
        };
    } PLUGPLAY_BUS_TYPE, *PPLUGPLAY_BUS_TYPE;

#ifndef MAX_BUS_NAME
#define MAX_BUS_NAME 24
#endif

    typedef struct _PLUGPLAY_BUS_INSTANCE
    {
        PLUGPLAY_BUS_TYPE BusType;
        ULONG BusNumber;
        WCHAR BusName[MAX_BUS_NAME];
    } PLUGPLAY_BUS_INSTANCE, *PPLUGPLAY_BUS_INSTANCE;

    typedef struct _SYSTEM_PLUGPLAY_BUS_INFORMATION
    {
        ULONG BusCount;
        PLUGPLAY_BUS_INSTANCE BusInstance[1];
    } SYSTEM_PLUGPLAY_BUS_INFORMATION, *PSYSTEM_PLUGPLAY_BUS_INFORMATION;

    typedef enum _SYSTEM_DOCK_STATE
    {
        SystemDockStateUnknown,
        SystemUndocked,
        SystemDocked
    } SYSTEM_DOCK_STATE, *PSYSTEM_DOCK_STATE;

    typedef struct _SYSTEM_DOCK_INFORMATION
    {
        SYSTEM_DOCK_STATE DockState;
        INTERFACE_TYPE DeviceBusType;
        ULONG DeviceBusNumber;
        ULONG SlotNumber;
    } SYSTEM_DOCK_INFORMATION, *PSYSTEM_DOCK_INFORMATION;

    typedef struct _SYSTEM_POWER_INFORMATION	// not for SystemPowerInfo ! 
    {
        BOOLEAN SystemSuspendSupported;
        BOOLEAN SystemHibernateSupported;
        BOOLEAN ResumeTimerSupportsSuspend;
        BOOLEAN ResumeTimerSupportsHibernate;
        BOOLEAN LidSupported;
        BOOLEAN TurboSettingSupported;
        BOOLEAN TurboMode;
        BOOLEAN SystemAcOrDc;
        BOOLEAN PowerDownDisabled;
        LARGE_INTEGER SpindownDrives;
    } SYSTEM_POWER_INFORMATION, *PSYSTEM_POWER_INFORMATION;

    typedef struct _SYSTEM_PROCESSOR_SPEED_INFORMATION	// not for SystemProcessorSpeedInformation ! 
    {
        ULONG MaximumProcessorSpeed;
        ULONG CurrentAvailableSpeed;
        ULONG ConfiguredSpeedLimit;
        BOOLEAN PowerLimit;
        BOOLEAN ThermalLimit;
        BOOLEAN TurboLimit;
    } SYSTEM_PROCESSOR_SPEED_INFORMATION, *PSYSTEM_PROCESSOR_SPEED_INFORMATION;

    typedef struct _SYSTEM_TIME_ZONE_INFORMATION
    {
        LONG Bias;
        WCHAR StandardName[32];
        TIME_FIELDS StandardDate;
        LONG StandardBias;
        WCHAR DaylightName[32];
        TIME_FIELDS DaylightDate;
        LONG DaylightBias;
    } SYSTEM_TIME_ZONE_INFORMATION, *PSYSTEM_TIME_ZONE_INFORMATION;

    typedef struct _SYSTEM_LOOKASIDE
    {
        USHORT Depth;
        USHORT MaximumDepth;
        ULONG TotalAllocates;
        ULONG AllocateMisses;
        ULONG TotalFrees;
        ULONG FreeMisses;
        POOL_TYPE Type;
        ULONG Tag;
        ULONG Size;
    } SYSTEM_LOOKASIDE, *PSYSTEM_LOOKASIDE;

    typedef struct _SYSTEM_LOOKASIDE_INFORMATION
    {
        SYSTEM_LOOKASIDE asl[];
    } SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION;

    typedef struct _SYSTEM_SET_TIME_SLIP_EVENT
    {
        HANDLE TimeSlipEvent;
    } SYSTEM_SET_TIME_SLIP_EVENT, *PSYSTEM_SET_TIME_SLIP_EVENT;

    typedef struct _SYSTEM_CREATE_SESSION
    {
        ULONG Session;
    } SYSTEM_CREATE_SESSION, *PSYSTEM_CREATE_SESSION;

    typedef struct _SYSTEM_DELETE_SESSION
    {
        ULONG Session;
    } SYSTEM_DELETE_SESSION, *PSYSTEM_DELETE_SESSION;

    typedef struct _SYSTEM_RANGE_START_INFORMATION
    {
        PVOID SystemRangeStart;
    } SYSTEM_RANGE_START_INFORMATION, *PSYSTEM_RANGE_START_INFORMATION;

#ifndef _WINTERNL_

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtQuerySystemInformation(IN SYSTEMINFOCLASS SystemInformationClass,
            OUT PVOID pSystemInformation,
            IN ULONG uSystemInformationLength,
            OUT PULONG puReturnLength OPTIONAL);
#endif

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtSetSystemInformation(IN SYSTEMINFOCLASS SystemInformationClass,
            IN PVOID pSystemInformation,
            IN ULONG uSystemInformationLength);

    // Time functions 
    NTSYSAPI NTSTATUS NTAPI NtQuerySystemTime(OUT PLARGE_INTEGER SystemTime);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtSetSystemTime(IN PLARGE_INTEGER NewTime,
            OUT PLARGE_INTEGER OldTime OPTIONAL);

    NTSYSAPI
        VOID
        NTAPI
        RtlTimeToTimeFields(IN PLARGE_INTEGER pliTime,
            OUT PTIME_FIELDS pTimeFields);

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlTimeFieldsToTime(IN PTIME_FIELDS pTimeFields,
            OUT PLARGE_INTEGER pliTime);

    NTSYSAPI
        VOID
        NTAPI
        RtlSecondsSince1970ToTime(IN ULONG SecondsSince1970,
            OUT PLARGE_INTEGER Time);

#ifndef _WINTERNL_

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlTimeToSecondsSince1970(IN PLARGE_INTEGER Time,
            OUT PULONG SecondsSince1970);

#endif

    //
    // Event Specific Access Rights.
    //

#define EVENT_QUERY_STATE       0x0001
#define EVENT_MODIFY_STATE      0x0002  
#define EVENT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) 


//
// Semaphore Specific Access Rights.
//

#define SEMAPHORE_QUERY_STATE       0x0001
#define SEMAPHORE_MODIFY_STATE      0x0002  

#define SEMAPHORE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) 

    // Event functions 
    NTSYSAPI
        NTSTATUS
        NTAPI
        NtOpenEvent(PHANDLE phEvent,
            ACCESS_MASK AccessMask, POBJECT_ATTRIBUTES pObjectAttributes);

    NTSYSAPI NTSTATUS NTAPI NtClearEvent(IN HANDLE hEvent);

    NTSYSAPI
        NTSTATUS
        NTAPI NtSetEvent(IN HANDLE hEvent, OUT PLONG plSignaled OPTIONAL);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtCreateSemaphore(OUT PHANDLE SemaphoreHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes,
            IN LONG InitialCount, IN LONG MaximumCount);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtOpenSemaphore(OUT PHANDLE SemaphoreHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtReleaseSemaphore(IN HANDLE SemaphoreHandle,
            IN LONG ReleaseCount,
            OUT PLONG PreviousCount OPTIONAL);

    typedef enum _SEMAPHORE_INFORMATION_CLASS
    {
        SemaphoreBasicInformation
    } SEMAPHORE_INFORMATION_CLASS;

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtQuerySemaphore(IN HANDLE SemaphoreHandle,
            IN SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,
            OUT PVOID SemaphoreInformation,
            IN ULONG SemaphoreInformationLength,
            OUT PULONG ResultLength OPTIONAL);

    typedef struct _SEMAPHORE_BASIC_INFORMATION
    {
        LONG CurrentCount;
        LONG MaximumCount;
    } SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;

    // Directory and Symbolic Link functions 
    NTSYSAPI
        NTSTATUS
        NTAPI
        NtCreateDirectoryObject(OUT PHANDLE phDirectory,
            IN ACCESS_MASK AccessMask,
            IN POBJECT_ATTRIBUTES pObjectAttributes);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtOpenDirectoryObject(OUT PHANDLE DirectoryHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes);

    typedef struct _DIRECTORY_CONTENTS
    {
        struct
        {
            UNICODE_STRING Name;
            UNICODE_STRING Type;
        } Entry[ANYSIZE_ARRAY];
    } DIRECTORY_CONTENTS, *PDIRECTORY_CONTENTS;

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtQueryDirectoryObject(IN HANDLE DirectoryHandle,
            OUT PDIRECTORY_CONTENTS Buffer,
            IN ULONG Length,
            IN BOOLEAN ReturnSingleEntry,
            IN BOOLEAN RestartScan,
            IN OUT PULONG Index,
            OUT PULONG ResultLength OPTIONAL);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtCreateSymbolicLinkObject(
            OUT PHANDLE             LinkHandle,
            IN ACCESS_MASK          DesiredAccess,
            IN POBJECT_ATTRIBUTES   ObjectAttributes,
            IN PUNICODE_STRING      DestinationName);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtOpenSymbolicLinkObject(
            OUT PHANDLE LinkHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtQuerySymbolicLinkObject(
            IN HANDLE LinkHandle,
            IN OUT PUNICODE_STRING LinkTarget,
            OUT PULONG ReturnedLength OPTIONAL
        );

    typedef
        NTSTATUS
        NTAPI
        fNtCreateKey(
            OUT PHANDLE KeyHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes,
            IN ULONG TitleIndex,
            IN PUNICODE_STRING Class OPTIONAL,
            IN ULONG CreateOptions,
            OUT PULONG Disposition OPTIONAL);

    NTSYSAPI fNtCreateKey NtCreateKey;
    NTSYSAPI fNtCreateKey ZwCreateKey;

    typedef
        NTSTATUS
        NTAPI
        fRtlpNtCreateKey(
            OUT PHANDLE KeyHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes,
            IN ULONG Options,
            IN PUNICODE_STRING Provider,
            OUT OPTIONAL PULONG Disposition);

    NTSYSAPI fRtlpNtCreateKey RtlpNtCreateKey;
    NTSYSAPI fRtlpNtCreateKey RtlpZwCreateKey;

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtCreateKeyTransacted(
            OUT PHANDLE KeyHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes,
            IN ULONG TitleIndex,
            IN PUNICODE_STRING Class OPTIONAL,
            IN ULONG CreateOptions,
            IN HANDLE TransactionHandle,
            OUT PULONG Disposition OPTIONAL
        );

    typedef
        NTSTATUS
        NTAPI
        fNtOpenKey(
            OUT PHANDLE KeyHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes);

    NTSYSAPI fNtOpenKey NtOpenKey;
    NTSYSAPI fNtOpenKey ZwOpenKey;

    typedef
        NTSTATUS
        NTAPI
        fRtlpNtOpenKey(
            OUT PHANDLE KeyHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes,
            IN ULONG Options);

    NTSYSAPI fRtlpNtOpenKey RtlpNtOpenKey;
    NTSYSAPI fRtlpNtOpenKey RtlpZwOpenKey;

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtOpenKeyEx(
            OUT PHANDLE KeyHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes,
            IN ULONG OpenOptions
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtOpenKeyTransacted(
            OUT PHANDLE KeyHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes,
            IN HANDLE TransactionHandle
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtOpenKeyTransactedEx(
            OUT PHANDLE KeyHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes,
            IN ULONG OpenOptions,
            IN HANDLE TransactionHandle
        );

    NTSYSAPI
        NTSTATUS NTAPI NtSaveKey(IN HANDLE KeyHandle, IN HANDLE FileHandle);

    // File functions 
    NTSYSAPI
        NTSTATUS
        NTAPI
        NtCreateFile(PHANDLE phFile,
            ACCESS_MASK AccessMask,
            POBJECT_ATTRIBUTES pObjectAttributes,
            PIO_STATUS_BLOCK pIoStatusBlock,
            PLARGE_INTEGER pliAllocationSize,
            ULONG uFileAttributes,
            ULONG uShareAccess,
            ULONG uCreateDisposition,
            ULONG uCreateOptions, PVOID pEaBuffer, ULONG uEaLength);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtOpenFile(PHANDLE phFile,
            ACCESS_MASK AccessMask,
            POBJECT_ATTRIBUTES pObjectAttributes,
            PIO_STATUS_BLOCK pIoStatusBlock,
            ULONG uShareAccess, ULONG uOpenOptions);

    NTSYSAPI
        NTSTATUS NTAPI NtDeleteFile(IN POBJECT_ATTRIBUTES pObjectAttributes);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtDeleteKey(IN HANDLE               KeyHandle);

    typedef enum _FILE_INFORMATION_CLASS
    {
        FileDirectoryInformation = 1,
        FileFullDirectoryInformation,	// 2
        FileBothDirectoryInformation,	// 3
        FileBasicInformation,	// 4  wdm
        FileStandardInformation,	// 5  wdm
        FileInternalInformation,	// 6
        FileEaInformation,		// 7
        FileAccessInformation,	// 8
        FileNameInformation,	// 9
        FileRenameInformation,	// 10
        FileLinkInformation,	// 11
        FileNamesInformation,	// 12
        FileDispositionInformation,	// 13
        FilePositionInformation,	// 14 wdm
        FileFullEaInformation,	// 15
        FileModeInformation,	// 16
        FileAlignmentInformation,	// 17
        FileAllInformation,		// 18
        FileAllocationInformation,	// 19
        FileEndOfFileInformation,	// 20 wdm
        FileAlternateNameInformation,	// 21
        FileStreamInformation,	// 22
        FilePipeInformation,	// 23
        FilePipeLocalInformation,	// 24
        FilePipeRemoteInformation,	// 25
        FileMailslotQueryInformation,	// 26
        FileMailslotSetInformation,	// 27
        FileCompressionInformation,	// 28
        FileObjectIdInformation,	// 29
        FileCompletionInformation,	// 30
        FileMoveClusterInformation,	// 31
        FileQuotaInformation,	// 32
        FileReparsePointInformation,	// 33
        FileNetworkOpenInformation,	// 34
        FileAttributeTagInformation,	// 35
        FileTrackingInformation,	// 36
        FileIdBothDirectoryInformation,	// 37
        FileIdFullDirectoryInformation,	// 38
        FileValidDataLengthInformation,	// 39
        FileShortNameInformation,	// 40
        FileMaximumInformation
    } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS;

    typedef struct _FILE_DIRECTORY_INFORMATION
    {
        ULONG NextEntryOffset;
        ULONG FileIndex;
        LARGE_INTEGER CreationTime;
        LARGE_INTEGER LastAccessTime;
        LARGE_INTEGER LastWriteTime;
        LARGE_INTEGER ChangeTime;
        LARGE_INTEGER EndOfFile;
        LARGE_INTEGER AllocationSize;
        ULONG FileAttributes;
        ULONG FileNameLength;
        WCHAR FileName[1];
    } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;

    typedef struct _FILE_FULL_DIR_INFORMATION
    {
        ULONG NextEntryOffset;
        ULONG FileIndex;
        LARGE_INTEGER CreationTime;
        LARGE_INTEGER LastAccessTime;
        LARGE_INTEGER LastWriteTime;
        LARGE_INTEGER ChangeTime;
        LARGE_INTEGER EndOfFile;
        LARGE_INTEGER AllocationSize;
        ULONG FileAttributes;
        ULONG FileNameLength;
        ULONG EaSize;
        WCHAR FileName[1];
    } FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;

    typedef struct _FILE_BOTH_DIR_INFORMATION
    {
        ULONG NextEntryOffset;
        ULONG FileIndex;
        LARGE_INTEGER CreationTime;
        LARGE_INTEGER LastAccessTime;
        LARGE_INTEGER LastWriteTime;
        LARGE_INTEGER ChangeTime;
        LARGE_INTEGER EndOfFile;
        LARGE_INTEGER AllocationSize;
        ULONG FileAttributes;
        ULONG FileNameLength;
        ULONG EaSize;
        CCHAR ShortNameLength;
        WCHAR ShortName[12];
        WCHAR FileName[ANYSIZE_ARRAY];
    } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;

    typedef struct _FILE_BASIC_INFORMATION
    {
        LARGE_INTEGER CreationTime;
        LARGE_INTEGER LastAccessTime;
        LARGE_INTEGER LastWriteTime;
        LARGE_INTEGER ChangeTime;
        ULONG FileAttributes;
    } FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;

    typedef struct _FILE_STANDARD_INFORMATION
    {
        LARGE_INTEGER AllocationSize;
        LARGE_INTEGER EndOfFile;
        ULONG NumberOfLinks;
        BOOLEAN DeletePending;
        BOOLEAN Directory;
    } FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;

    typedef struct _FILE_INTERNAL_INFORMATION
    {
        LARGE_INTEGER IndexNumber;
    } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION;

    typedef struct _FILE_EA_INFORMATION
    {
        ULONG EaSize;
    } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION;

    typedef struct _FILE_ACCESS_INFORMATION
    {
        ACCESS_MASK AccessFlags;
    } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION;

    typedef struct _FILE_MODE_INFORMATION {
        ULONG Mode;
    } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION;

    typedef struct _FILE_RENAME_INFORMATION
    {
        BOOLEAN ReplaceIfExists;
        HANDLE RootDirectory;
        ULONG FileNameLength;
        WCHAR FileName[1];
    } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;

    typedef struct _FILE_PIPE_INFORMATION {
        ULONG ReadMode;
        ULONG CompletionMode;
    } FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION;

    typedef struct _FILE_PIPE_LOCAL_INFORMATION {
        ULONG NamedPipeType;
        ULONG NamedPipeConfiguration;
        ULONG MaximumInstances;
        ULONG CurrentInstances;
        ULONG InboundQuota;
        ULONG ReadDataAvailable;
        ULONG OutboundQuota;
        ULONG WriteQuotaAvailable;
        ULONG NamedPipeState;
        ULONG NamedPipeEnd;
    } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION;

    typedef struct _FILE_PIPE_REMOTE_INFORMATION {
        LARGE_INTEGER CollectDataTime;
        ULONG MaximumCollectionCount;
    } FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION;

    typedef struct _FILE_LINK_INFORMATION
    {
        BOOLEAN ReplaceIfExists;
        HANDLE RootDirectory;
        ULONG FileNameLength;
        WCHAR FileName[1];
    } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;

    typedef struct _FILE_NAMES_INFORMATION
    {
        ULONG NextEntryOffset;
        ULONG FileIndex;
        ULONG FileNameLength;
        WCHAR FileName[1];
    } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;

    typedef struct _FILE_ALLOCATION_INFORMATION
    {
        LARGE_INTEGER AllocationSize;
    } FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION;

    typedef struct _FILE_COMPRESSION_INFORMATION
    {
        LARGE_INTEGER CompressedFileSize;
        USHORT CompressionFormat;
        UCHAR CompressionUnitShift;
        UCHAR ChunkShift;
        UCHAR ClusterShift;
        UCHAR Reserved[3];
    } FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION;

    typedef struct _FILE_COMPLETION_INFORMATION
    {
        HANDLE Port;
        ULONG Key;
    } FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;

    typedef struct _FILE_POSITION_INFORMATION
    {
        LARGE_INTEGER CurrentByteOffset;
    } FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;

    typedef struct _FILE_ALIGNMENT_INFORMATION
    {
        ULONG AlignmentRequirement;
    } FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION;

    typedef struct _FILE_NAME_INFORMATION
    {
        ULONG FileNameLength;
        WCHAR FileName[1];
    } FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION;

    typedef struct _FILE_NETWORK_OPEN_INFORMATION
    {
        LARGE_INTEGER CreationTime;
        LARGE_INTEGER LastAccessTime;
        LARGE_INTEGER LastWriteTime;
        LARGE_INTEGER ChangeTime;
        LARGE_INTEGER AllocationSize;
        LARGE_INTEGER EndOfFile;
        ULONG FileAttributes;
    } FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;

    typedef struct _FILE_ATTRIBUTE_TAG_INFORMATION
    {
        ULONG FileAttributes;
        ULONG ReparseTag;
    } FILE_ATTRIBUTE_TAG_INFORMATION, *PFILE_ATTRIBUTE_TAG_INFORMATION;

    typedef struct _FILE_DISPOSITION_INFORMATION
    {
        BOOLEAN DeleteFile;
    } FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION;

    typedef struct _FILE_END_OF_FILE_INFORMATION
    {
        LARGE_INTEGER EndOfFile;
    } FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION;

    typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION
    {
        LARGE_INTEGER ValidDataLength;
    } FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION;

    typedef struct _FILE_ALL_INFORMATION {
        FILE_BASIC_INFORMATION BasicInformation;
        FILE_STANDARD_INFORMATION StandardInformation;
        FILE_INTERNAL_INFORMATION InternalInformation;
        FILE_EA_INFORMATION EaInformation;
        FILE_ACCESS_INFORMATION AccessInformation;
        FILE_POSITION_INFORMATION PositionInformation;
        FILE_MODE_INFORMATION ModeInformation;
        FILE_ALIGNMENT_INFORMATION AlignmentInformation;
        FILE_NAME_INFORMATION NameInformation;
    } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION;

    //
    // NtQueryDirectoryFile return types:
    //
    //      FILE_DIRECTORY_INFORMATION
    //      FILE_FULL_DIR_INFORMATION
    //      FILE_ID_FULL_DIR_INFORMATION
    //      FILE_BOTH_DIR_INFORMATION
    //      FILE_ID_BOTH_DIR_INFORMATION
    //      FILE_NAMES_INFORMATION
    //      FILE_OBJECTID_INFORMATION
    //

    typedef struct _FILE_ID_FULL_DIR_INFORMATION {
        ULONG NextEntryOffset;
        ULONG FileIndex;
        LARGE_INTEGER CreationTime;
        LARGE_INTEGER LastAccessTime;
        LARGE_INTEGER LastWriteTime;
        LARGE_INTEGER ChangeTime;
        LARGE_INTEGER EndOfFile;
        LARGE_INTEGER AllocationSize;
        ULONG FileAttributes;
        ULONG FileNameLength;
        ULONG EaSize;
        LARGE_INTEGER FileId;
        WCHAR FileName[1];
    } FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION;

    typedef struct _FILE_ID_BOTH_DIR_INFORMATION {
        ULONG NextEntryOffset;
        ULONG FileIndex;
        LARGE_INTEGER CreationTime;
        LARGE_INTEGER LastAccessTime;
        LARGE_INTEGER LastWriteTime;
        LARGE_INTEGER ChangeTime;
        LARGE_INTEGER EndOfFile;
        LARGE_INTEGER AllocationSize;
        ULONG FileAttributes;
        ULONG FileNameLength;
        ULONG EaSize;
        CCHAR ShortNameLength;
        WCHAR ShortName[12];
        LARGE_INTEGER FileId;
        WCHAR FileName[1];
    } FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;

    typedef struct _FILE_OBJECTID_INFORMATION {
        LONGLONG FileReference;
        UCHAR ObjectId[16];
        union {
            struct {
                UCHAR BirthVolumeId[16];
                UCHAR BirthObjectId[16];
                UCHAR DomainId[16];
            };
            UCHAR ExtendedInfo[48];
        };
    } FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION;

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtQueryDirectoryFile(
            __in HANDLE FileHandle,
            __in_opt HANDLE Event,
            __in_opt PIO_APC_ROUTINE ApcRoutine,
            __in_opt PVOID ApcContext,
            __out PIO_STATUS_BLOCK IoStatusBlock,
            __out_bcount(Length) PVOID FileInformation,
            __in ULONG Length,
            __in FILE_INFORMATION_CLASS FileInformationClass,
            __in BOOLEAN ReturnSingleEntry,
            __in_opt PUNICODE_STRING FileName,
            __in BOOLEAN RestartScan
            );

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtQueryInformationFile(IN HANDLE FileHandle,
            OUT PIO_STATUS_BLOCK IoStatusBlock,
            OUT PVOID FileInformation,
            IN ULONG Length,
            IN FILE_INFORMATION_CLASS FileInformationClass);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtDeviceIoControlFile(IN HANDLE FileHandle,
            IN HANDLE Event OPTIONAL,
            IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
            IN PVOID ApcContext OPTIONAL,
            OUT PIO_STATUS_BLOCK IoStatusBlock,
            IN ULONG IoControlCode,
            IN PVOID InputBuffer OPTIONAL,
            IN ULONG InputBufferLength,
            OUT PVOID OutputBuffer OPTIONAL,
            IN ULONG OutputBufferLength);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtFsControlFile(IN HANDLE FileHandle,
            IN HANDLE Event OPTIONAL,
            IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
            IN PVOID ApcContext OPTIONAL,
            OUT PIO_STATUS_BLOCK IoStatusBlock,
            IN ULONG FsControlCode,
            IN PVOID InputBuffer OPTIONAL,
            IN ULONG InputBufferLength,
            OUT PVOID OutputBuffer OPTIONAL,
            IN ULONG OutputBufferLength);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtQueryVolumeInformationFile(IN HANDLE FileHandle,
            OUT PIO_STATUS_BLOCK IoStatusBlock,
            OUT PVOID FsInformation,
            IN ULONG Length,
            IN FS_INFORMATION_CLASS FsInformationClass);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtFlushBuffersFile(IN HANDLE FileHandle,
            OUT PIO_STATUS_BLOCK IoStatusBlock);

    // Process functions 
#define NtCurrentProcess() ((HANDLE) -1)

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtOpenProcess(OUT PHANDLE phProcess,
            IN ACCESS_MASK AccessMask,
            IN POBJECT_ATTRIBUTES pObjectAttributes,
            IN PCLIENT_ID pClientId);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtCreateProcess(OUT PHANDLE ProcessHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes,
            IN HANDLE InheritFromProcessHandle,
            IN BOOLEAN InheritHandles,
            IN HANDLE SectionHandle OPTIONAL,
            IN HANDLE DebugPort OPTIONAL,
            IN HANDLE ExceptionPort OPTIONAL);

    typedef enum _PROCESSINFOCLASS
    {
        ProcessBasicInformation,
        ProcessQuotaLimits,		// QUOTA_LIMITS 
        ProcessIoCounters,		// IOCOUNTERS 
        ProcessVmCounters,		// VM_COUNTERS 
        ProcessTimes,		// KERNEL_USER_TIMES 
        ProcessBasePriority,	// BASE_PRIORITY_INFORMATION 
        ProcessRaisePriority,
        ProcessDebugPort,
        ProcessExceptionPort,
        ProcessAccessToken,
        ProcessLdtInformation,
        ProcessLdtSize,
        ProcessDefaultHardErrorMode,
        ProcessIoPortHandlers,	// Note: this is kernel mode only 
        ProcessPooledUsageAndLimits,
        ProcessWorkingSetWatch,
        ProcessUserModeIOPL,
        ProcessEnableAlignmentFaultFixup,
        ProcessPriorityClass,
        ProcessWx86Information,
        ProcessHandleCount,
        ProcessAffinityMask,	// AFFINITY_MASK 
        ProcessPriorityBoost,
        ProcessDeviceMap,
        ProcessSessionInformation,
        ProcessForegroundInformation,
        ProcessWow64Information,
        MaxProcessInfoClass
    } PROCESSINFOCLASS;

    typedef struct _PROCESS_BASIC_INFORMATION {
        NTSTATUS ExitStatus;
        PPEB PebBaseAddress;
        ULONG_PTR AffinityMask;
        KPRIORITY BasePriority;
        ULONG_PTR UniqueProcessId;
        ULONG_PTR InheritedFromUniqueProcessId;
    } PROCESS_BASIC_INFORMATION;
    typedef PROCESS_BASIC_INFORMATION *PPROCESS_BASIC_INFORMATION;

    typedef struct _PROCESS_RAISE_PRIORITY
    {
        KPRIORITY RaisePriority;
    } PROCESS_RAISE_PRIORITY, *PPROCESS_RAISE_PRIORITY;

    typedef struct _PROCESS_DEBUG_PORT_INFORMATION
    {
        HANDLE DebugPort;
    } PROCESS_DEBUG_PORT_INFORMATION, *PPROCESS_DEBUG_PORT_INFORMATION;

    typedef struct _PROCESS_EXCEPTION_PORT
    {
        HANDLE ExceptionPort;
    } PROCESS_EXCEPTION_PORT, *PPROCESS_EXCEPTION_PORT;

    typedef struct _PROCESS_ACCESS_TOKEN
    {
        HANDLE Token;
        HANDLE Thread;
    } PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;

#ifndef _LDT_ENTRY_DEFINED
#define _LDT_ENTRY_DEFINED

    typedef struct _LDT_ENTRY
    {
        USHORT LimitLow;
        USHORT BaseLow;
        union
        {
            struct
            {
                UCHAR BaseMid;
                UCHAR Flags1;		// Declare as bytes to avoid alignment 
                UCHAR Flags2;		// Problems. 
                UCHAR BaseHi;
            } Bytes;

            struct
            {
                ULONG BaseMid : 8;
                ULONG Type : 5;
                ULONG Dpl : 2;
                ULONG Pres : 1;
                ULONG LimitHi : 4;
                ULONG Sys : 1;
                ULONG Reserved_0 : 1;
                ULONG Default_Big : 1;
                ULONG Granularity : 1;
                ULONG BaseHi : 8;
            } Bits;
        } HighWord;
    } LDT_ENTRY, *PLDT_ENTRY;

#endif

#define LDT_TABLE_SIZE (8 * 1024 * sizeof(LDT_ENTRY))

    typedef struct _LDT_INFORMATION
    {
        ULONG Start;
        ULONG Length;
        LDT_ENTRY LdtEntries[1];
    } PROCESS_LDT_INFORMATION, *PPROCESS_LDT_INFORMATION;

    typedef struct _LDT_SIZE
    {
        ULONG Length;
    } PROCESS_LDT_SIZE, *PPROCESS_LDT_SIZE;

    typedef struct _PROCESS_DEFAULT_HARDERROR_MODE_INFORMATION
    {
        ULONG HardErrorMode;	// SEM_* (SEM_FAILCRITICALERRORS, etc.) 
    } PROCESS_DEFAULT_HARDERROR_MODE_INFORMATION,
        *PPROCESS_DEFAULT_HARDERROR_MODE_INFORMATION;

    typedef struct _PROCESS_POOLED_USAGE_AND_LIMITS_INFORMATION
    {
        ULONG PeakPagedPoolUsage;
        ULONG PagedPoolUsage;
        ULONG PagedPoolLimit;
        ULONG PeakNonPagedPoolUsage;
        ULONG NonPagedPoolUsage;
        ULONG NonPagedPoolLimit;
        ULONG PeakPagefileUsage;
        ULONG PagefileUsage;
        ULONG PagefileLimit;
    } PROCESS_POOLED_USAGE_AND_LIMITS_INFORMATION,
        *PPROCESS_POOLED_USAGE_AND_LIMITS_INFORMATION;

    typedef struct _PROCESS_WS_WATCH_INFORMATION
    {
        PVOID FaultingPc;
        PVOID FaultingVa;
    } PROCESS_WS_WATCH_INFORMATION, *PPROCESS_WS_WATCH_INFORMATION;

    typedef struct _PROCESS_IOPL
    {
        ULONG Iopl;
    } PROCESS_IOPL, *PPROCESS_IOPL;

    typedef struct _PROCESS_ALLIGNMENT_FAULT_FIXUP
    {
        BOOLEAN EnableAllignmentFaultFixup;
    } PROCESS_ALLIGNMENT_FAULT_FIXUP, *PPROCESS_ALLIGNMENT_FAULT_FIXUP;

#define KRNL_NORMAL_PRIORITY_CLASS 0x02
#define KRNL_IDLE_PRIORITY_CLASS 0x01
#define KRNL_HIGH_PRIORITY_CLASS 0x03
#define KRNL_REALTIME_PRIORITY_CLASS 0x04

    typedef struct _PROCESS_PRIORITY_CLASS_INFORMATION
    {
        UCHAR Unknown;
        UCHAR PriorityClass;
    } PROCESS_PRIORITY_CLASS_INFORMATION, *PPROCESS_PRIORITY_CLASS_INFORMATION;

    typedef struct _PROCESS_X86_INFORMATION
    {
        ULONG x86Info;
    } PROCESS_X86_INFORMATION, *PPROCESS_X86_INFORMATION;

    typedef struct _PROCESS_HANDLE_COUNT_INFORMATION
    {
        ULONG HandleCount;
    } PROCESS_HANDLE_COUNT_INFORMATION, *PPROCESS_HANDLE_COUNT_INFORMATION;

    typedef struct _PROCESS_PRIORITY_BOOST_INFORMATION
    {
        ULONG PriorityBoostEnabled;
    } PROCESS_PRIORITY_BOOST_INFORMATION, *PPROCESS_PRIORITY_BOOST_INFORMATION;

    typedef struct _PROCESS_DEVICE_MAP_INFORMATION
    {
        union
        {
            struct
            {
                HANDLE DirectoryHandle;
            } Set;

            struct
            {
                ULONG DriveMap;
                UCHAR DriveType[32];
            } Query;
        };

    } PROCESS_DEVICE_MAP_INFORMATION, *PPROCESS_DEVICE_MAP_INFORMATION;

    typedef struct _PROCESS_SESSION_INFORMATION
    {
        ULONG SessionId;
    } PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtQueryInformationProcess(IN HANDLE hProcess,
            IN PROCESSINFOCLASS ProcessInformationClass,
            OUT PVOID pProcessInformation,
            IN ULONG uProcessInformationLength,
            OUT PULONG puReturnLength OPTIONAL);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtSetInformationProcess(IN HANDLE hProcess,
            IN PROCESSINFOCLASS ProcessInformationClass,
            OUT PVOID pProcessInformation,
            IN ULONG uProcessInformationLength);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtSetInformationFile(IN HANDLE FileHandle,
            OUT PIO_STATUS_BLOCK IoStatusBlock,
            IN PVOID FileInformation,
            IN ULONG Length,
            IN FILE_INFORMATION_CLASS FileInformationClass);

    NTSTATUS
        NTAPI
        RtlCreateProcessParameters(OUT PPROCESS_PARAMETERS * ProcessParameters,
            IN PUNICODE_STRING ImageFile,
            IN PUNICODE_STRING DllPath OPTIONAL,
            IN PUNICODE_STRING CurrentDirectory OPTIONAL,
            IN PUNICODE_STRING CommandLine OPTIONAL,
            IN ULONG CreationFlags,
            IN PUNICODE_STRING WindowTitle OPTIONAL,
            IN PUNICODE_STRING Desktop OPTIONAL,
            IN PUNICODE_STRING Reserved OPTIONAL,
            IN PUNICODE_STRING Reserved2 OPTIONAL);

    NTSTATUS
        NTAPI
        RtlDestroyProcessParameters(IN PPROCESS_PARAMETERS ProcessParameters);

    // Thread functions 
#define NtCurrentThread() ((HANDLE) -2)

    typedef struct _USER_STACK
    {
        PVOID FixedStackBase;
        PVOID FixedStackLimit;
        PVOID ExpandableStackBase;
        PVOID ExpandableStackLimit;
        PVOID ExpandableStackBottom;
    } USER_STACK, *PUSER_STACK;

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtCreateThread(OUT PHANDLE ThreadHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes,
            IN HANDLE ProcessHandle,
            OUT PCLIENT_ID ClientId,
            IN PCONTEXT ThreadContext,
            IN PUSER_STACK UserStack, IN BOOLEAN CreateSuspended);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtOpenThread(OUT PHANDLE phThread,
            IN ACCESS_MASK AccessMask,
            IN POBJECT_ATTRIBUTES pObjectAttributes,
            IN PCLIENT_ID pClientId);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtTerminateThread(IN HANDLE ThreadHandle OPTIONAL,
            IN NTSTATUS ExitStatus);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtSuspendThread(IN HANDLE ThreadHandle,
            OUT PULONG PreviousSuspendCount OPTIONAL);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtResumeThread(IN HANDLE ThreadHandle,
            OUT PULONG PreviousSuspendCount OPTIONAL);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtSuspendProcess(IN HANDLE ProcessHandle);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtResumeProcess(IN HANDLE ProcessHandle);

    typedef enum _THREADINFOCLASS
    {
        ThreadBasicInformation,
        ThreadTimes,		// KERNEL_USER_TIMES 
        ThreadPriority,
        ThreadBasePriority,		// BASE_PRIORITY_INFORMATION 
        ThreadAffinityMask,		// AFFINITY_MASK 
        ThreadImpersonationToken,
        ThreadDescriptorTableEntry,
        ThreadEnableAlignmentFaultFixup,
        ThreadEventPair,
        ThreadQuerySetWin32StartAddress,
        ThreadZeroTlsCell,
        ThreadPerformanceCount,
        ThreadAmILastThread,
        ThreadIdealProcessor,
        ThreadPriorityBoost,
        ThreadSetTlsArrayAddress,
        ThreadIsIoPending,		// W2K 
        ThreadHideFromDebugger,	// W2K 
        MaxThreadInfoClass
    } THREADINFOCLASS;

    typedef struct _THREAD_BASIC_INFORMATION
    {
        NTSTATUS ExitStatus;
        PTEB TebBaseAddress;
        CLIENT_ID ClientId;
        KAFFINITY AffinityMask;
        KPRIORITY Priority;
        KPRIORITY BasePriority;
    } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;

    typedef struct _THREAD_PRIORITY
    {
        KPRIORITY Priority;
    } THREAD_PRIORITY, *PTHREAD_PRIORITY;

    typedef struct _THREAD_DESCRIPTOR_TABLE_ENTRY_INFORMATION
    {
        ULONG Selector;
        LDT_ENTRY Descriptor;
    } THREAD_DESCRIPTOR_TABLE_ENTRY_INFORMATION,
        *PTHREAD_DESCRIPTOR_TABLE_ENTRY_INFORMATION;

    typedef struct _THREAD_EVENTPAIR
    {
        HANDLE EventPair;
    } THREAD_EVENTPAIR, *PTHREAD_EVENTPAIR;

    typedef struct _THREAD_WIN32_START_ADDRESS_INFORMATION
    {
        PVOID Win32StartAddress;
    } THREAD_WIN32_START_ADDRESS_INFORMATION,
        *PTHREAD_WIN32_START_ADDRESS_INFORMATION;

    typedef struct _THREAD_ZERO_TLSCELL
    {
        ULONG TlsIndex;
    } THREAD_ZERO_TLSCELL, *PTHREAD_ZERO_TLSCELL;

    typedef struct _THREAD_PERFORMANCE_COUNTER_INFORMATION
    {
        ULONG Count1;
        ULONG Count2;
    } THREAD_PERFORMANCE_COUNTER_INFORMATION,
        *PTHREAD_PERFORMANCE_COUNTER_INFORMATION;

    typedef struct _THREAD_AMI_LAST_THREAD
    {
        ULONG AmILastThread;
    } THREAD_AMI_LAST_THREAD, *PTHREAD_AMI_LAST_THREAD;

    typedef struct _THREAD_IDEAL_PROCESSOR
    {
        ULONG IdealProcessor;
    } THREAD_IDEAL_PROCESSOR, *PTHREAD_IDEAL_PROCESSOR;

    typedef struct _THREAD_TLS_ARRAY
    {
        PULONG TlsArray;
    } THREAD_TLS_ARRAY, *PTHREAD_TLS_ARRAY;

    typedef struct _THREAD_IS_IO_PENDING_INFORMATION
    {
        ULONG IsIOPending;
    } THREAD_IS_IO_PENDING_INFORMATION, *PTHREAD_IS_IO_PENDING_INFORMATION;

    typedef struct _THREAD_HIDE_FROM_DEBUGGER
    {
        ULONG HideFromDebugger;
    } THREAD_HIDE_FROM_DEBUGGER, *PTHREAD_HIDE_FROM_DEBUGGER;

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtQueryInformationThread(IN HANDLE hThread,
            IN THREADINFOCLASS ThreadInformationClass,
            OUT PVOID pThreadInformation,
            IN ULONG uThreadInformationLength,
            OUT PULONG puReturnLength OPTIONAL);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtSetInformationThread(IN HANDLE hThread,
            IN THREADINFOCLASS ThreadInformationClass,
            OUT PVOID pThreadInformation,
            IN ULONG uthreadInformationLength);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtOpenThreadToken(IN HANDLE hThread,
            IN ACCESS_MASK DesiredAccess,
            IN BOOLEAN bOpenAsSelf, OUT PHANDLE phToken);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtImpersonateThread(IN HANDLE ThreadHandle,
            IN HANDLE TargetThreadHandle,
            IN PSECURITY_QUALITY_OF_SERVICE SecurityQos);

    NTSYSAPI
        NTSTATUS
        NTAPI NtGetContextThread(IN HANDLE ThreadHandle, OUT PCONTEXT Context);

    NTSYSAPI
        NTSTATUS
        NTAPI NtSetContextThread(IN HANDLE ThreadHandle, IN PCONTEXT Context);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtQueueApcThread(IN HANDLE ThreadHandle,
            IN PKNORMAL_ROUTINE ApcRoutine,
            IN PVOID ApcContext OPTIONAL,
            IN PVOID Argument1 OPTIONAL,
            IN PVOID Argument2 OPTIONAL);

    NTSYSAPI NTSTATUS NTAPI NtImpersonateAnonymousToken(IN HANDLE hThread);

    NTSYSAPI NTSTATUS NTAPI NtMakeTemporaryObject(IN HANDLE Handle);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtCreateSection(OUT PHANDLE SectionHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes,
            IN PLARGE_INTEGER SectionSize OPTIONAL,
            IN ULONG Protect,
            IN ULONG Attributes, IN HANDLE FileHandle);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtOpenSection(OUT PHANDLE SectionHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes);

    typedef enum _SECTION_INFORMATION_CLASS
    {
        SectionBasicInformation,
        SectionImageInformation
    } SECTION_INFORMATION_CLASS;

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtQuerySection(IN HANDLE SectionHandle,
            IN SECTION_INFORMATION_CLASS SectionInformationClass,
            OUT PVOID SectionInformation,
            IN ULONG SectionInformationLength,
            OUT PULONG ResultLength OPTIONAL);

    typedef struct _SECTION_BASIC_INFORMATION
    {
        PVOID BaseAddress;
        ULONG Attributes;
        LARGE_INTEGER Size;
    } SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;

    typedef struct _SECTION_IMAGE_INFORMATION
    {
        PVOID EntryPoint;
        ULONG Unknown1;
        ULONG StackReserve;
        ULONG StackCommit;
        ULONG Subsystem;
        USHORT MinorSubsystemVersion;
        USHORT MajorSubsystemVersion;
        ULONG Unknown2;
        ULONG Characteristics;
        USHORT ImageNumber;
        BOOLEAN Executable;
        UCHAR Unknown3;
        ULONG Unknown4[3];
    } SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtExtendSection(IN HANDLE SectionHandle, IN PLARGE_INTEGER SectionSize);

    NTSYSAPI
        NTSTATUS
        NTAPI NtUnmapViewOfSection(IN HANDLE hProcess, IN PVOID pBaseAddress);

    NTSYSAPI NTSTATUS NTAPI NtWaitForSingleObject(IN HANDLE hObject, IN BOOL fAlertable, IN PLARGE_INTEGER pliTimeout	// NULL = infinite 
        );

    // Object functions 
    typedef enum _OBJECT_INFORMATION_CLASS
    {
        ObjectBasicInformation,	// 0 Y N 
        ObjectNameInformation,	// 1 Y N 
        ObjectTypeInformation,	// 2 Y N 
        ObjectAllTypesInformation,	// 3 Y N 
        ObjectHandleInformation	// 4 Y Y 
    } OBJECT_INFORMATION_CLASS;

    typedef struct _OBJECT_BASIC_INFORMATION
    {
        ULONG Attributes;
        ACCESS_MASK GrantedAccess;
        ULONG HandleCount;
        ULONG PointerCount;
        ULONG PagedPoolUsage;
        ULONG NonPagedPoolUsage;
        ULONG Reserved[3];
        ULONG NameInformationLength;
        ULONG TypeInformationLength;
        ULONG SecurityDescriptorLength;
        LARGE_INTEGER CreateTime;
    } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;

    typedef struct _OBJECT_NAME_INFORMATION
    {
        UNICODE_STRING Name;
    } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;

    typedef struct _OBJECT_TYPE_INFORMATION
    {
        UNICODE_STRING Name;
        ULONG ObjectCount;
        ULONG HandleCount;
        ULONG Reserved1[4];
        ULONG PeakObjectCount;
        ULONG PeakHandleCount;
        ULONG Reserved2[4];
        ULONG InvalidAttributes;
        GENERIC_MAPPING GenericMapping;
        ULONG ValidAccess;
        UCHAR Unknown;
        BOOLEAN MaintainHandleDatabase;
        UCHAR Reserved3[2];
        POOL_TYPE PoolType;
        ULONG PagedPoolUsage;
        ULONG NonPagedPoolUsage;
    } OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;

    typedef struct _OBJECT_ALL_TYPES_INFORMATION
    {
        ULONG NumberOfTypes;
        OBJECT_TYPE_INFORMATION TypeInformation;
    } OBJECT_ALL_TYPES_INFORMATION, *POBJECT_ALL_TYPES_INFORMATION;

    typedef struct _OBJECT_HANDLE_ATTRIBUTE_INFORMATION
    {
        BOOLEAN Inherit;
        BOOLEAN ProtectFromClose;
    } OBJECT_HANDLE_ATTRIBUTE_INFORMATION,
        *POBJECT_HANDLE_ATTRIBUTE_INFORMATION;

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtQueryObject(IN HANDLE ObjectHandle,
            IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
            OUT PVOID ObjectInformation,
            IN ULONG ObjectInformationLength,
            OUT PULONG ReturnLength OPTIONAL);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtSetInformationObject(IN HANDLE ObjectHandle,
            IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
            IN PVOID ObjectInformation,
            IN ULONG ObjectInformationLength);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtDuplicateObject(IN HANDLE SourceProcessHandle,
            IN HANDLE SourceHandle,
            IN HANDLE TargetProcessHandle OPTIONAL,
            OUT PHANDLE TargetHandle OPTIONAL,
            IN ACCESS_MASK DesiredAccess,
            IN ULONG HandleAttributes, IN ULONG Options);

#define DUPLICATE_SAME_ATTRIBUTES   0x00000004

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtQuerySecurityObject(IN HANDLE FileHandle,
            IN SECURITY_INFORMATION SecurityInformation,
            OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
            IN ULONG Length, OUT PULONG ResultLength);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtSetSecurityObject(IN HANDLE FileHandle,
            IN SECURITY_INFORMATION SecurityInformation,
            IN PSECURITY_DESCRIPTOR SecurityDescriptor);

    // Memory management functions 
    NTSYSAPI
        NTSTATUS
        NTAPI
        NtAllocateVirtualMemory(IN HANDLE ProcessHandle,
            IN OUT PVOID * BaseAddress,
            IN ULONG ZeroBits,
            IN OUT PSIZE_T AllocationSize,
            IN ULONG AllocationType, IN ULONG Protect);

    typedef enum _MEMORY_INFORMATION_CLASS
    {
        MemoryBasicInformation,
        MemoryWorkingSetList,
        MemorySectionName,
        MemoryBasicVlmInformation
    } MEMORY_INFORMATION_CLASS;

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtQueryVirtualMemory(IN HANDLE ProcessHandle,
            IN PVOID BaseAddress,
            IN MEMORY_INFORMATION_CLASS MemoryInformationClass,
            OUT PVOID MemoryInformation,
            IN ULONG MemoryInformationLength,
            OUT PULONG ReturnLength OPTIONAL);

    /* Defined in Winnt.h
    typedef struct _MEMORY_BASIC_INFORMATION
    {
    PVOID BaseAddress;
    PVOID AllocationBase;
    ULONG AllocationProtect;
    ULONG RegionSize;
    ULONG State;
    ULONG Protect;
    ULONG Type;
    } MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;
    */

    typedef struct _MEMORY_WORKING_SET_LIST
    {
        ULONG NumberOfPages;
        ULONG WorkingSetList[1];
    } MEMORY_WORKING_SET_LIST, *PMEMORY_WORKING_SET_LIST;

    typedef struct _MEMORY_SECTION_NAME
    {
        UNICODE_STRING SectionFileName;
    } MEMORY_SECTION_NAME, *PMEMORY_SECTION_NAME;

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtReadVirtualMemory(IN HANDLE ProcessHandle,
            IN PVOID BaseAddress,
            OUT PVOID Buffer,
            IN ULONG BufferLength,
            OUT PULONG ReturnLength OPTIONAL);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtWriteVirtualMemory(IN HANDLE ProcessHandle,
            IN PVOID BaseAddress,
            IN PVOID Buffer,
            IN ULONG BufferLength,
            OUT PULONG ReturnLength OPTIONAL);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtProtectVirtualMemory(IN HANDLE ProcessHandle,
            IN OUT PVOID * BaseAddress,
            IN OUT PULONG ProtectSize,
            IN ULONG NewProtect, OUT PULONG OldProtect);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtFlushVirtualMemory(IN HANDLE ProcessHandle,
            IN OUT PVOID * BaseAddress,
            IN OUT PULONG FlushSize,
            OUT PIO_STATUS_BLOCK IoStatusBlock);

    // Ldr Functions 
    NTSYSAPI NTSTATUS NTAPI LdrDisableThreadCalloutsForDll(IN PVOID hModule);

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrGetProcedureAddress(
            IN PVOID DllHandle,
            IN CONST ANSI_STRING* ProcedureName OPTIONAL,
            IN ULONG ProcedureNumber OPTIONAL,
            OUT PVOID* ProcedureAddress
        );

    NTSYSAPI
        NTSTATUS
        NTAPI
        LdrLoadDll(
            IN PCWSTR DllPath OPTIONAL,
            IN PULONG DllCharacteristics OPTIONAL,
            IN PCUNICODE_STRING DllName,
            OUT PVOID* DllHandle
        );

    // Rtl String Functions 
    NTSYSAPI
        VOID
        NTAPI
        RtlInitUnicodeString(OUT PUNICODE_STRING DestinationString,
            IN PCWSTR SourceString);

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlCreateUnicodeString(OUT PUNICODE_STRING AllocatedString,
            IN PCWSTR SourceString);

    NTSYSAPI
        VOID
        NTAPI RtlFreeUnicodeString(IN PUNICODE_STRING UnicodeString);

    NTSYSAPI
        VOID
        NTAPI
        RtlFreeAnsiString(
            IN OUT PANSI_STRING AnsiString
            );

    NTSYSAPI
        VOID
        NTAPI
        RtlInitAnsiString(IN OUT PANSI_STRING DestinationString,
            IN PCSTR SourceString);

    NTSYSAPI
        ULONG
        NTAPI
        RtlAnsiStringToUnicodeSize(IN PANSI_STRING AnsiString);

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlAnsiStringToUnicodeString(OUT PUNICODE_STRING DestinationString,
            IN PANSI_STRING SourceString,
            IN BOOLEAN AllocateDestinationString);

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlAppendUnicodeStringToString(OUT PUNICODE_STRING Destination,
            IN PUNICODE_STRING Source);

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlAppendUnicodeToString(OUT PUNICODE_STRING Destination,
            IN PWSTR Source);

    NTSYSAPI
        LONG
        NTAPI
        RtlCompareUnicodeString(IN PUNICODE_STRING String1,
            IN PUNICODE_STRING String2,
            IN BOOLEAN CaseInSensitive);

    NTSYSAPI
        VOID
        NTAPI
        RtlCopyUnicodeString(OUT PUNICODE_STRING DestinationString,
            IN PUNICODE_STRING SourceString);

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDowncaseUnicodeString(OUT PUNICODE_STRING DestinationString,
            IN PUNICODE_STRING SourceString,
            IN BOOLEAN AllocateDestinationString);

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlEqualUnicodeString(IN PUNICODE_STRING String1,
            IN PUNICODE_STRING String2,
            IN BOOLEAN CaseInSensitive);

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlIntegerToUnicodeString(IN ULONG Value,
            IN ULONG Base, OUT PUNICODE_STRING String);

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlUnicodeStringToInteger(IN PUNICODE_STRING String,
            IN ULONG Base, OUT PULONG Value);

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlUnicodeStringToAnsiString(
            IN OUT PANSI_STRING DestinationString,
            IN const PUNICODE_STRING SourceString,
            IN BOOLEAN AllocateDestinationString
            );

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDuplicateUnicodeString(IN ULONG Flags,
            IN const PUNICODE_STRING SourceString,
            IN OUT PUNICODE_STRING DestinationString);

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlOemStringToUnicodeString(OUT PUNICODE_STRING DestinationString,
            IN POEM_STRING SourceString,
            IN BOOLEAN AllocateDestinationString);

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlPrefixUnicodeString(IN PUNICODE_STRING String1,
            IN PUNICODE_STRING String2,
            IN BOOLEAN CaseInSensitive);

    NTSYSAPI WCHAR NTAPI RtlUpcaseUnicodeChar(IN WCHAR SourceCharacter);

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlUpcaseUnicodeString(OUT PUNICODE_STRING DestinationString,
            IN PUNICODE_STRING SourceString,
            IN BOOLEAN AllocateDestinationString);

    NTSYSAPI
        ULONG NTAPI RtlxAnsiStringToUnicodeSize(IN PANSI_STRING AnsiString);

    NTSYSAPI ULONG NTAPI RtlxOemStringToUnicodeSize(IN POEM_STRING OemString);

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlUnicodeStringToOemString(POEM_STRING DestinationString,
            PUNICODE_STRING SourceString,
            BOOLEAN AllocateDestinationString);

    NTSYSAPI
        VOID
        NTAPI
        RtlFreeOemString(POEM_STRING OemString);

    // Rtl Misc Operations 
    NTSYSAPI NTSTATUS NTAPI NtReplyPort(IN HANDLE hPort, OUT PVOID pReply);

    NTSYSAPI NTSTATUS NTAPI NtClose(IN HANDLE hObject);

    NTSYSAPI ULONG NTAPI RtlNtStatusToDosError(NTSTATUS status);

    NTSYSAPI LONG NTAPI RtlRandom(PULONG Seed);

    NTSYSAPI UINT NTAPI RtlGetLongestNtPathLength();

    NTSYSAPI UINT NTAPI RtlDetermineDosPathNameType_U(IN PWSTR Path);

    NTSYSAPI UINT NTAPI RtlIsDosDeviceName_U(IN PWSTR Path);

    NTSYSAPI SIZE_T NTAPI RtlCompareMemoryUlong(
        IN PVOID  Source,
        SIZE_T Length,
        ULONG  Pattern
    );

    NTSYSAPI BOOLEAN NTAPI RtlIsZeroMemory(
        PVOID  Buffer,
        SIZE_T Length
    );

    NTSYSAPI
        BOOLEAN
        NTAPI
        RtlDosPathNameToNtPathName_U(IN PCWSTR DosName,
            OUT PUNICODE_STRING NtName,
            OUT PWSTR * DosFilePath OPTIONAL,
            OUT PUNICODE_STRING NtFilePath OPTIONAL);

    //
    // preallocated heap-growable buffers
    //
    struct _RTL_BUFFER;

#if !defined(RTL_BUFFER)

    // This is duplicated in ntldr.h.

#define RTL_BUFFER RTL_BUFFER

    typedef struct _RTL_BUFFER {
        PUCHAR    Buffer;
        PUCHAR    StaticBuffer;
        SIZE_T    Size;
        SIZE_T    StaticSize;
        SIZE_T    ReservedForAllocatedSize; // for future doubling
        PVOID     ReservedForIMalloc; // for future pluggable growth
    } RTL_BUFFER, * PRTL_BUFFER;

#endif

#define RTLP_BUFFER_IS_HEAP_ALLOCATED(b) ((b)->Buffer != (b)->StaticBuffer)

    //
    // a preallocated buffer that is "tied" to a UNICODE_STRING
    //
    struct _RTL_UNICODE_STRING_BUFFER;

    typedef struct _RTL_UNICODE_STRING_BUFFER {
        UNICODE_STRING String;
        RTL_BUFFER     ByteBuffer;
        UCHAR          MinimumStaticBufferForTerminalNul[sizeof(WCHAR)];
    } RTL_UNICODE_STRING_BUFFER, * PRTL_UNICODE_STRING_BUFFER;

    //
    // These work for both UNICODE_STRING and STRING.
    // That's why "plain" 0 and sizeof(Buffer[0]) is used.
    //

    typedef USHORT RTL_STRING_LENGTH_TYPE;

    // odd but correct use of RTL_STRING_IS_PUT_AT_SAFE instead of RTL_STRING_IS_GET_AT_SAFE,
    // we are reaching past the Length
#define RTL_STRING_IS_NUL_TERMINATED(s)    (RTL_STRING_IS_PUT_AT_SAFE(s, RTL_STRING_GET_LENGTH_CHARS(s), 0) \
                                           && RTL_STRING_GET_AT_UNSAFE(s, RTL_STRING_GET_LENGTH_CHARS(s)) == 0)

#define RTL_STRING_NUL_TERMINATE(s)        ((VOID)(ASSERT(RTL_STRING_IS_PUT_AT_SAFE(s, RTL_STRING_GET_LENGTH_CHARS(s), 0)), \
                                           ((s)->Buffer[RTL_STRING_GET_LENGTH_CHARS(s)] = 0)))

#define RTL_NUL_TERMINATE_STRING(s)        (RTL_STRING_NUL_TERMINATE(s)) /* compatibility */

#define RTL_STRING_MAKE_LENGTH_INCLUDE_TERMINAL_NUL(s) ((VOID)(ASSERT(RTL_STRING_IS_NUL_TERMINATED(s)), \
                                                       ((s)->Length += sizeof((s)->Buffer[0]))))

#define RTL_STRING_IS_EMPTY(s)             ((s)->Length == 0)

#define RTL_STRING_GET_LAST_CHAR(s)        (RTL_STRING_GET_AT((s), RTL_STRING_GET_LENGTH_CHARS(s) - 1))

#define RTL_STRING_GET_LENGTH_CHARS(s)     ((s)->Length / sizeof((s)->Buffer[0]))
#define RTL_STRING_GET_MAX_LENGTH_CHARS(s) ((s)->MaximumLength / sizeof((s)->Buffer[0]))
#define RTL_STRING_GET_LENGTH_BYTES(s)     ((s)->Length)

#define RTL_STRING_SET_LENGTH_CHARS_UNSAFE(s,n) ((s)->Length = (RTL_STRING_LENGTH_TYPE)(((n) * sizeof(s)->Buffer[0])))

#define RtlEnsureBufferSize(Flags, Buff, NewSizeBytes) \
    (   ((Buff) != NULL && (NewSizeBytes) <= (Buff)->Size) \
        ? STATUS_SUCCESS \
        : RtlpEnsureBufferSize((Flags), (Buff), (NewSizeBytes)) \
    )

#define RtlAppendUnicodeStringBuffer(Dest, Source)                            \
    ( ( ( (Dest)->String.Length + (Source)->Length + sizeof((Dest)->String.Buffer[0]) ) > UNICODE_STRING_MAX_BYTES ) \
        ? STATUS_NAME_TOO_LONG                                                \
        : (!NT_SUCCESS(                                                       \
                RtlEnsureBufferSize(                                          \
                    0,                                                        \
                    &(Dest)->ByteBuffer,                                          \
                    (Dest)->String.Length + (Source)->Length + sizeof((Dest)->String.Buffer[0]) ) ) \
                ? STATUS_NO_MEMORY                                            \
                : ( ( (Dest)->String.Buffer = (PWSTR)(Dest)->ByteBuffer.Buffer ), \
                    ( RtlMoveMemory(                                          \
                        (Dest)->String.Buffer + (Dest)->String.Length / sizeof((Dest)->String.Buffer[0]), \
                        (Source)->Buffer,                                     \
                        (Source)->Length) ),                                  \
                    ( (Dest)->String.MaximumLength = (RTL_STRING_LENGTH_TYPE)((Dest)->String.Length + (Source)->Length + sizeof((Dest)->String.Buffer[0]))), \
                    ( (Dest)->String.Length = (USHORT) ((Dest)->String.Length + (Source)->Length )),            \
                    ( (Dest)->String.Buffer[(Dest)->String.Length / sizeof((Dest)->String.Buffer[0])] = 0 ), \
                    ( STATUS_SUCCESS ) ) ) )

#define RtlAssignUnicodeStringBuffer(Buff, Str) \
    (((Buff)->String.Length = 0), (RtlAppendUnicodeStringBuffer((Buff), (Str))))

#define RtlInitBuffer(Buff, StatBuff, StatSize) \
    do {                                        \
        (Buff)->Buffer       = (StatBuff);      \
        (Buff)->Size         = (StatSize);      \
        (Buff)->StaticBuffer = (StatBuff);      \
        (Buff)->StaticSize   = (StatSize);      \
    } while (0)

#define RTL_ENSURE_BUFFER_SIZE_NO_COPY (0x00000001)

    NTSTATUS
        NTAPI
        RtlpEnsureBufferSize(
            IN ULONG           Flags,
            IN OUT PRTL_BUFFER Buffer,
            IN SIZE_T          NewSizeBytes
        );

#define RtlFreeBuffer(Buff)                              \
    do {                                                 \
        if ((Buff) != NULL && (Buff)->Buffer != NULL) {  \
            if (RTLP_BUFFER_IS_HEAP_ALLOCATED(Buff)) {   \
                UNICODE_STRING UnicodeString;            \
                UnicodeString.Buffer = (PWSTR)(PVOID)(Buff)->Buffer; \
                RtlFreeUnicodeString(&UnicodeString);    \
            }                                            \
            (Buff)->Buffer = (Buff)->StaticBuffer;       \
            (Buff)->Size = (Buff)->StaticSize;           \
        }                                                \
    } while (0)

#define RtlInitUnicodeStringBuffer(Buff, StatBuff, StatSize)      \
    do {                                                          \
        SIZE_T TempStaticSize = (StatSize);                       \
        PUCHAR TempStaticBuff = (StatBuff);                       \
        TempStaticSize &= ~(sizeof((Buff)->String.Buffer[0]) - 1);  \
        if (TempStaticSize > UNICODE_STRING_MAX_BYTES) {          \
            TempStaticSize = UNICODE_STRING_MAX_BYTES;            \
        }                                                         \
        if (TempStaticSize < sizeof(WCHAR)) {                     \
            TempStaticBuff = (Buff)->MinimumStaticBufferForTerminalNul; \
            TempStaticSize = sizeof(WCHAR);                       \
        }                                                         \
        RtlInitBuffer(&(Buff)->ByteBuffer, TempStaticBuff, TempStaticSize); \
        (Buff)->String.Buffer = (WCHAR*)TempStaticBuff;           \
        if ((Buff)->String.Buffer != NULL)                        \
            (Buff)->String.Buffer[0] = 0;                         \
        (Buff)->String.Length = 0;                                \
        (Buff)->String.MaximumLength = (RTL_STRING_LENGTH_TYPE)TempStaticSize;    \
    } while (0)

#define RtlFreeUnicodeStringBuffer(Buff)      \
    do {                                      \
        if ((Buff) != NULL) {                 \
            RtlFreeBuffer(&(Buff)->ByteBuffer);   \
            (Buff)->String.Buffer = (PWSTR)(Buff)->ByteBuffer.StaticBuffer; \
            if ((Buff)->String.Buffer != NULL) \
                (Buff)->String.Buffer[0] = 0;  \
            (Buff)->String.Length = 0;         \
            (Buff)->String.MaximumLength = (RTL_STRING_LENGTH_TYPE)(Buff)->ByteBuffer.StaticSize; \
        } \
    } while (0)

    //
    // These are OUT Disposition values.
    //
#define RTL_NT_PATH_NAME_TO_DOS_PATH_NAME_AMBIGUOUS   (0x00000001)
#define RTL_NT_PATH_NAME_TO_DOS_PATH_NAME_UNC         (0x00000002)
#define RTL_NT_PATH_NAME_TO_DOS_PATH_NAME_DRIVE       (0x00000003)
#define RTL_NT_PATH_NAME_TO_DOS_PATH_NAME_ALREADY_DOS (0x00000004)

    NTSTATUS
        NTAPI
        RtlNtPathNameToDosPathName(
            IN     ULONG                      Flags,
            IN OUT PRTL_UNICODE_STRING_BUFFER Path,
            OUT    ULONG* Disposition OPTIONAL,
            IN OUT PWSTR* FilePart OPTIONAL
        );

    // Rtl Large Integer Operations 

#define RtlLargeIntegerLessThanZero($a) (($a).HighPart < 0)
#define Li2Double(x) ((double)((x).HighPart) * 4.294967296E9 + (double)((x).LowPart))

    NTSYSAPI
        LARGE_INTEGER
        NTAPI
        RtlEnlargedIntegerMultiply(IN LONG lMultiplicand, IN LONG lMultiplier);

    NTSYSAPI
        ULONG
        NTAPI
        RtlEnlargedUnsignedDivide(IN LARGE_INTEGER liDividend,
            IN ULONG uDivisor,
            OUT PULONG puRemainder OPTIONAL);

    NTSYSAPI
        LARGE_INTEGER
        NTAPI
        RtlEnlargedUnsignedMultiply(IN ULONG uMultiplicand, IN ULONG uMultiplier);

    NTSYSAPI
        LARGE_INTEGER
        NTAPI
        RtlExtendedIntegerMultiply(IN LARGE_INTEGER liMultiplicand,
            IN LONG lMultiplier);

    NTSYSAPI
        LARGE_INTEGER
        NTAPI
        RtlExtendedLargeIntegerDivide(IN LARGE_INTEGER liDividend,
            IN ULONG uDivisor,
            OUT PULONG puRemainder OPTIONAL);

    NTSYSAPI
        LARGE_INTEGER
        NTAPI
        RtlLargeIntegerAdd(IN LARGE_INTEGER liAddend1,
            IN LARGE_INTEGER liAddend2);

    NTSYSAPI
        LARGE_INTEGER
        NTAPI
        RtlLargeIntegerDivide(IN LARGE_INTEGER liDividend,
            IN LARGE_INTEGER liDivisor,
            OUT PLARGE_INTEGER pliRemainder OPTIONAL);

    NTSYSAPI
        LARGE_INTEGER NTAPI RtlLargeIntegerNegate(IN LARGE_INTEGER liSubtrahend);

    NTSYSAPI
        LARGE_INTEGER
        NTAPI
        RtlLargeIntegerSubtract(IN LARGE_INTEGER liMinuend,
            IN LARGE_INTEGER liSubtrahend);

    // Debug Functions 
    typedef struct _DEBUG_BUFFER
    {
        HANDLE SectionHandle;
        PVOID SectionBase;
        PVOID RemoteSectionBase;
        ULONG SectionBaseDelta;
        HANDLE EventPairHandle;
        ULONG Unknown[2];
        HANDLE RemoteThreadHandle;
        ULONG InfoClassMask;
        ULONG SizeOfInfo;
        ULONG AllocatedSize;
        ULONG SectionSize;
        PVOID ModuleInformation;
        PVOID BackTraceInformation;
        PVOID HeapInformation;
        PVOID LockInformation;
        PVOID Reserved[8];
    } DEBUG_BUFFER, *PDEBUG_BUFFER;

#define PDI_MODULES 0x01
#define PDI_BACKTRACE 0x02
#define PDI_HEAPS 0x04
#define PDI_HEAP_TAGS 0x08
#define PDI_HEAP_BLOCKS 0x10
#define PDI_LOCKS 0x20

    typedef struct _DEBUG_MODULE_INFORMATION	// c.f. SYSTEM_MODULE_INFORMATION 
    {
        ULONG Reserved[2];
        ULONG Base;
        ULONG Size;
        ULONG Flags;
        USHORT Index;
        USHORT Unknown;
        USHORT LoadCount;
        USHORT ModuleNameOffset;
        CHAR ImageName[256];
    } DEBUG_MODULE_INFORMATION, *PDEBUG_MODULE_INFORMATION;

    typedef struct _DEBUG_HEAP_INFORMATION
    {
        ULONG Base;
        ULONG Flags;
        USHORT Granularity;
        USHORT Unknown;
        ULONG Allocated;
        ULONG Committed;
        ULONG TagCount;
        ULONG BlockCount;
        ULONG Reserved[7];
        PVOID Tags;
        PVOID Blocks;
    } DEBUG_HEAP_INFORMATION, *PDEBUG_HEAP_INFORMATION;

    typedef struct _DEBUG_LOCK_INFORMATION	// c.f. SYSTEM_LOCK_INFORMATION 
    {
        PVOID Address;
        USHORT Type;
        USHORT CreatorBackTraceIndex;
        ULONG OwnerThreadId;
        ULONG ActiveCount;
        ULONG ContentionCount;
        ULONG EntryCount;
        ULONG RecursionCount;
        ULONG NumberOfSharedWaiters;
        ULONG NumberOfExclusiveWaiters;
    } DEBUG_LOCK_INFORMATION, *PDEBUG_LOCK_INFORMATION;


    NTSYSAPI
        PDEBUG_BUFFER
        NTAPI RtlCreateQueryDebugBuffer(IN ULONG Size, IN BOOLEAN EventPair);

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlQueryProcessDebugInformation(IN ULONG ProcessId,
            IN ULONG DebugInfoClassMask,
            IN OUT PDEBUG_BUFFER DebugBuffer);

    NTSYSAPI
        NTSTATUS NTAPI RtlDestroyQueryDebugBuffer(IN PDEBUG_BUFFER DebugBuffer);

    NTSYSAPI NTSTATUS NTAPI NtLoadDriver(
        // "\Registry\Machine\System\CurrentControlSet\Services\<DriverName>" 
        IN PUNICODE_STRING RegistryPath);

    NTSYSAPI NTSTATUS NTAPI NtUnloadDriver(
        // "\Registry\Machine\System\CurrentControlSet\Services\<DriverName>" 
        IN PUNICODE_STRING RegistryPath);

    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlAdjustPrivilege(IN ULONG Privilege,
            IN BOOLEAN NewValue,
            IN BOOLEAN ForThread, OUT PBOOLEAN OldValue);

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtFreeVirtualMemory(IN HANDLE ProcessHandle,
            IN PVOID * BaseAddress,
            IN OUT PSIZE_T RegionSize, IN ULONG FreeType);

    NTSYSAPI
        VOID
        NTAPI
        DbgBreakPoint(
            VOID
        );

    NTSYSAPI
        ULONG
        __cdecl
        DbgPrint(
            __in_z __drv_formatString(printf) PCSTR Format,
            ...
        );

    NTSYSAPI
        ULONG
        __cdecl
        DbgPrintEx(
            __in ULONG ComponentId,
            __in ULONG Level,
            __in_z __drv_formatString(printf) PCSTR Format,
            ...
        );

#ifdef _VA_LIST_DEFINED

#if (NTDDI_VERSION >= NTDDI_WINXP)
    NTSYSAPI
        ULONG
        NTAPI
        vDbgPrintEx(
            _In_ ULONG ComponentId,
            _In_ ULONG Level,
            _In_z_ PCCH Format,
            _In_ va_list arglist
        );

    NTSYSAPI
        ULONG
        NTAPI
        vDbgPrintExWithPrefix(
            _In_z_ PCCH Prefix,
            _In_ ULONG ComponentId,
            _In_ ULONG Level,
            _In_z_ PCCH Format,
            _In_ va_list arglist
        );

#endif

#endif // _VA_LIST_DEFINED

    NTSYSAPI
        NTSTATUS
        NTAPI
        NtCreatePagingFile(IN PUNICODE_STRING      PageFileName,
            IN PLARGE_INTEGER       MiniumSize,
            IN PLARGE_INTEGER       MaxiumSize,
            OUT PLARGE_INTEGER      ActualSize OPTIONAL);

    typedef struct _CRYPTO_BUFFER {
        DWORD Length;
        DWORD MaximumLength;
        PBYTE Buffer;
    } CRYPTO_BUFFER, * PCRYPTO_BUFFER;

    typedef struct _GROUP_MEMBERSHIP
    {
        DWORD Rid;
        DWORD Attributes;
    } GROUP_MEMBERSHIP, * PGROUP_MEMBERSHIP;

    typedef CONST CRYPTO_BUFFER* PCCRYPTO_BUFFER;

#define RtlEncryptDecryptRC4		SystemFunction032

    EXTERN_C NTSYSAPI NTSTATUS NTAPI
        RtlEncryptDecryptRC4(
            IN OUT PCRYPTO_BUFFER data,
            IN PCCRYPTO_BUFFER key);

#ifdef _LSALOOKUP_
    typedef HANDLE LSAPR_HANDLE;
    typedef LSAPR_HANDLE* PLSAPR_HANDLE;

    typedef
        NTSTATUS
        NTAPI
        fLsaIOpenPolicyTrusted(
            OUT PLSAPR_HANDLE PolicyHandle
        );

    typedef fLsaIOpenPolicyTrusted* pfLsaIOpenPolicyTrusted;

    typedef
        NTSTATUS
        NTAPI
        fLsarOpenPolicy(
            IN PWCHAR SystemName,
            IN PLSA_OBJECT_ATTRIBUTES ObjectAttributes,
            IN ACCESS_MASK DesiredAccess,
            OUT LSAPR_HANDLE* PolicyHandle
        );

    typedef fLsarOpenPolicy* pfLsarOpenPolicy;

    typedef
        NTSTATUS
        NTAPI
        fLsarOpenSecret(
            IN LSAPR_HANDLE PolicyHandle,
            IN PLSA_UNICODE_STRING SecretName,
            IN ACCESS_MASK DesiredAccess,
            OUT LSA_HANDLE* SecretHandle
        );

    typedef fLsarOpenSecret* pfLsarOpenSecret;

    typedef struct _LSAPR_CR_CIPHER_VALUE {
        ULONG Length;
        ULONG MaximumLength;
        PUCHAR Buffer;
    } LSAPR_CR_CIPHER_VALUE, * PLSAPR_CR_CIPHER_VALUE;

    typedef
        NTSTATUS
        NTAPI
        fLsarQuerySecret(
            IN LSAPR_HANDLE SecretHandle,
            IN OUT PLSAPR_CR_CIPHER_VALUE* EncryptedCurrentValue,
            IN OUT PLARGE_INTEGER CurrentValueSetTime,
            IN OUT PLSAPR_CR_CIPHER_VALUE* EncryptedOldValue,
            IN OUT PLARGE_INTEGER OldValueSetTime
        );

    typedef fLsarQuerySecret* pfLsarQuerySecret;

    typedef
        NTSTATUS
        NTAPI
        fLsarClose(
            IN LSAPR_HANDLE Handle
        );

    typedef fLsarClose* pfLsarClose;

#define SECRET_SET_VALUE    0x00000001
#define SECRET_QUERY_VALUE  0x00000002

#endif

    //
    //  Compressed Data Information structure.  This structure is
    //  used to describe the state of a compressed data buffer,
    //  whose uncompressed size is known.  All compressed chunks
    //  described by this structure must be compressed with the
    //  same format.  On compressed reads, this entire structure
    //  is an output, and on compressed writes the entire structure
    //  is an input.
    //

    typedef struct _COMPRESSED_DATA_INFO {

        //
        //  Code for the compression format (and engine) as
        //  defined in ntrtl.h.  Note that COMPRESSION_FORMAT_NONE
        //  and COMPRESSION_FORMAT_DEFAULT are invalid if
        //  any of the described chunks are compressed.
        //

        USHORT CompressionFormatAndEngine;

        //
        //  Since chunks and compression units are expected to be
        //  powers of 2 in size, we express then log2.  So, for
        //  example (1 << ChunkShift) == ChunkSizeInBytes.  The
        //  ClusterShift indicates how much space must be saved
        //  to successfully compress a compression unit - each
        //  successfully compressed compression unit must occupy
        //  at least one cluster less in bytes than an uncompressed
        //  compression unit.
        //

        UCHAR CompressionUnitShift;
        UCHAR ChunkShift;
        UCHAR ClusterShift;
        UCHAR Reserved;

        //
        //  This is the number of entries in the CompressedChunkSizes
        //  array.
        //

        USHORT NumberOfChunks;

        //
        //  This is an array of the sizes of all chunks resident
        //  in the compressed data buffer.  There must be one entry
        //  in this array for each chunk possible in the uncompressed
        //  buffer size.  A size of FSRTL_CHUNK_SIZE indicates the
        //  corresponding chunk is uncompressed and occupies exactly
        //  that size.  A size of 0 indicates that the corresponding
        //  chunk contains nothing but binary 0's, and occupies no
        //  space in the compressed data.  All other sizes must be
        //  less than FSRTL_CHUNK_SIZE, and indicate the exact size
        //  of the compressed data in bytes.
        //

        ULONG CompressedChunkSizes[ANYSIZE_ARRAY];

    } COMPRESSED_DATA_INFO;
    typedef COMPRESSED_DATA_INFO *PCOMPRESSED_DATA_INFO;

#if (NTDDI_VERSION >= NTDDI_WINXP)
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlGetCompressionWorkSpaceSize(
            IN USHORT CompressionFormatAndEngine,
            OUT PULONG CompressBufferWorkSpaceSize,
            OUT PULONG CompressFragmentWorkSpaceSize
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WINXP)
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlCompressBuffer(
            IN USHORT CompressionFormatAndEngine,
            IN PUCHAR UncompressedBuffer,
            IN ULONG UncompressedBufferSize,
            OUT PUCHAR CompressedBuffer,
            IN ULONG CompressedBufferSize,
            IN ULONG UncompressedChunkSize,
            OUT PULONG FinalCompressedSize,
            IN PVOID WorkSpace
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WINXP)
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDecompressBuffer(
            IN USHORT CompressionFormat,
            OUT PUCHAR UncompressedBuffer,
            IN ULONG UncompressedBufferSize,
            IN PUCHAR CompressedBuffer,
            IN ULONG CompressedBufferSize,
            OUT PULONG FinalUncompressedSize
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WINXP)
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDecompressFragment(
            IN USHORT CompressionFormat,
            OUT PUCHAR UncompressedFragment,
            IN ULONG UncompressedFragmentSize,
            IN PUCHAR CompressedBuffer,
            IN ULONG CompressedBufferSize,
            IN ULONG FragmentOffset,
            OUT PULONG FinalUncompressedSize,
            IN PVOID WorkSpace
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WINXP)
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDescribeChunk(
            IN USHORT CompressionFormat,
            IN OUT PUCHAR *CompressedBuffer,
            IN PUCHAR EndOfCompressedBufferPlus1,
            OUT PUCHAR *ChunkBuffer,
            OUT PULONG ChunkSize
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WINXP)
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlReserveChunk(
            IN USHORT CompressionFormat,
            IN OUT PUCHAR *CompressedBuffer,
            IN PUCHAR EndOfCompressedBufferPlus1,
            OUT PUCHAR *ChunkBuffer,
            IN ULONG ChunkSize
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WINXP)
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlDecompressChunks(
            __out_bcount(UncompressedBufferSize) PUCHAR UncompressedBuffer,
            __in ULONG UncompressedBufferSize,
            __in_bcount(CompressedBufferSize) PUCHAR CompressedBuffer,
            __in ULONG CompressedBufferSize,
            __in_bcount(CompressedTailSize) PUCHAR CompressedTail,
            __in ULONG CompressedTailSize,
            __in PCOMPRESSED_DATA_INFO CompressedDataInfo
        );
#endif

#if (NTDDI_VERSION >= NTDDI_WINXP)
    NTSYSAPI
        NTSTATUS
        NTAPI
        RtlCompressChunks(
            IN PUCHAR UncompressedBuffer,
            IN ULONG UncompressedBufferSize,
            OUT PUCHAR CompressedBuffer,
            IN ULONG CompressedBufferSize,
            IN OUT PCOMPRESSED_DATA_INFO CompressedDataInfo,
            IN ULONG CompressedDataInfoLength,
            IN PVOID WorkSpace
        );
#endif // NTDDI_VERSION >= NTDDI_WINXP

//
// BOOLEAN
// RtlEqualLuid(
//      PLUID L1,
//      PLUID L2
//      );

#define RtlEqualLuid(L1, L2) (((L1)->LowPart == (L2)->LowPart) && \
                              ((L1)->HighPart  == (L2)->HighPart))

//
// BOOLEAN
// RtlIsZeroLuid(
//      PLUID L1
//      );
//
#define RtlIsZeroLuid(L1) ((BOOLEAN) (((L1)->LowPart | (L1)->HighPart) == 0))

    FORCEINLINE
        LUID
        NTAPI_INLINE
        RtlConvertLongToLuid(
            IN LONG Long
        )
    {
        LUID TempLuid;
        LARGE_INTEGER TempLi;

        TempLi.QuadPart = Long;
        TempLuid.LowPart = TempLi.u.LowPart;
        TempLuid.HighPart = TempLi.u.HighPart;
        return(TempLuid);
    }

    FORCEINLINE
        LUID
        NTAPI_INLINE
        RtlConvertUlongToLuid(
            IN ULONG Ulong
        )
    {
        LUID TempLuid;

        TempLuid.LowPart = Ulong;
        TempLuid.HighPart = 0;
        return(TempLuid);
    }

    NTSYSAPI NTSTATUS NTAPI ZwDisplayString(IN PUNICODE_STRING String);

    NTSYSAPI NTSTATUS NTAPI NtDisplayString(IN PUNICODE_STRING String);

        NTSYSAPI
        NTSTATUS
        NTAPI
        RtlStringFromGUID(
            IN REFGUID Guid,
            OUT PUNICODE_STRING GuidString
        );

        NTSYSAPI
        NTSTATUS
        NTAPI
        RtlGUIDFromString(
            IN PUNICODE_STRING GuidString,
            OUT GUID* Guid
        );

        NTSYSCALLAPI
            NTSTATUS
            NTAPI
            NtCreateToken(
                OUT PHANDLE TokenHandle,
                IN ACCESS_MASK DesiredAccess,
                IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
                IN TOKEN_TYPE TokenType,
                IN PLUID AuthenticationId,
                IN PLARGE_INTEGER ExpirationTime,
                IN PTOKEN_USER User,
                IN PTOKEN_GROUPS Groups,
                IN PTOKEN_PRIVILEGES Privileges,
                IN PTOKEN_OWNER Owner OPTIONAL,
                IN PTOKEN_PRIMARY_GROUP PrimaryGroup,
                IN PTOKEN_DEFAULT_DACL DefaultDacl OPTIONAL,
                IN PTOKEN_SOURCE TokenSource
            );

        typedef
            PVOID
            NTAPI
            fRtlLookupElementGenericTableAvl(
                IN PVOID Table,
                IN PVOID Buffer
        );
        
        NTSYSCALLAPI
            fRtlLookupElementGenericTableAvl RtlLookupElementGenericTableAvl;

        typedef
            PVOID
            NTAPI
            fRtlInsertElementGenericTableAvl(
                IN PVOID Table,
                IN PVOID Buffer,
                IN ULONG BufferSize,
                IN PBOOLEAN NewElement OPTIONAL
            );

        NTSYSCALLAPI
            fRtlInsertElementGenericTableAvl RtlInsertElementGenericTableAvl;

        typedef struct _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE
        {
            ULONG64 Version;
            UNICODE_STRING Name;
        } TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE, * PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE;

        typedef struct _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE
        {
            PVOID pValue;
            ULONG ValueLength;
        } TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE, * PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE;

        typedef struct _TOKEN_SECURITY_ATTRIBUTE_V1
        {
            UNICODE_STRING Name;
            USHORT ValueType;
            USHORT Reserved;
            ULONG Flags;
            ULONG ValueCount;
            union
            {
                PLONG64 pInt64;
                PULONG64 pUint64;
                PUNICODE_STRING pString;
                PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE pFqbn;
                PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE pOctetString;
            } Values;
        } TOKEN_SECURITY_ATTRIBUTE_V1, * PTOKEN_SECURITY_ATTRIBUTE_V1;

        typedef struct _TOKEN_SECURITY_ATTRIBUTES_INFORMATION
        {
            USHORT Version;
            USHORT Reserved;
            ULONG AttributeCount;
            union
            {
                PTOKEN_SECURITY_ATTRIBUTE_V1 pAttributeV1;
            } Attribute;
        } TOKEN_SECURITY_ATTRIBUTES_INFORMATION, * PTOKEN_SECURITY_ATTRIBUTES_INFORMATION;

        typedef
        NTSTATUS
        NTAPI
        fNtCreateTokenEx(
            _Out_ PHANDLE TokenHandle,
            _In_ ACCESS_MASK DesiredAccess,
            _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
            _In_ TOKEN_TYPE TokenType,
            _In_ PLUID AuthenticationId,
            _In_ PLARGE_INTEGER ExpirationTime,
            _In_ PTOKEN_USER User,
            _In_ PTOKEN_GROUPS Groups,
            _In_ PTOKEN_PRIVILEGES Privileges,
            _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION UserAttributes,
            _In_opt_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION DeviceAttributes,
            _In_opt_ PTOKEN_GROUPS DeviceGroups,
            _In_opt_ PTOKEN_MANDATORY_POLICY TokenMandatoryPolicy,
            _In_opt_ PTOKEN_OWNER Owner,
            _In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,
            _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,
            _In_ PTOKEN_SOURCE TokenSource
        );

        NTSYSCALLAPI
            fNtCreateTokenEx NtCreateTokenEx;

        NTSYSCALLAPI
        NTSTATUS
        NTAPI
        NtSetInformationToken(
                __in HANDLE TokenHandle,
                __in TOKEN_INFORMATION_CLASS TokenInformationClass,
                __in_bcount(TokenInformationLength) PVOID TokenInformation,
                __in ULONG TokenInformationLength
            );

        NTSYSAPI
            BOOLEAN
            NTAPI
            RtlValidSid(
                __in PSID Sid
            );

        NTSYSAPI
            BOOLEAN
            NTAPI
            RtlEqualSid(
                __in PSID Sid1,
                __in PSID Sid2
            );

        NTSYSAPI
            BOOLEAN
            NTAPI
            RtlEqualPrefixSid(
                __in PSID Sid1,
                __in PSID Sid2
            );

        NTSYSAPI
            NTSTATUS
            NTAPI
            RtlInitializeSid(
                PSID                      Sid,
                PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,
                UCHAR                     SubAuthorityCount);

        NTSYSAPI
            PULONG
            NTAPI
            RtlSubAuthoritySid(
                PSID  Sid,
                ULONG SubAuthority);

        NTSYSAPI
            NTSTATUS
            NTAPI
            RtlConvertSidToUnicodeString(
                IN OUT PUNICODE_STRING DestinationString,
                IN PSID pSID,
                IN BOOLEAN AllocateDestinationString);

        NTSTATUS
            NTAPI
            NtOpenProcessToken(
                __in HANDLE ProcessHandle,
                __in ACCESS_MASK DesiredAccess,
                __out PHANDLE TokenHandle
            );

        NTSTATUS
            NTAPI
            NtQueryInformationToken(
                __in HANDLE TokenHandle,
                __in TOKEN_INFORMATION_CLASS TokenInformationClass,
                __out_bcount_part_opt(TokenInformationLength, *ReturnLength) PVOID TokenInformation,
                __in ULONG TokenInformationLength,
                __out PULONG ReturnLength
            );

#ifdef __cplusplus
}

#pragma warning(pop)

#endif
#endif