path: root/include/ntapi/nt_file.h

#ifndef _NT_FILE_H_
#define _NT_FILE_H_

#include "nt_abi.h"
#include "nt_object.h"
#include "nt_device.h"

typedef enum _nt_file_info_class {
	NT_FILE_DIRECTORY_INFORMATION			= 1,
	NT_FILE_FULL_DIRECTORY_INFORMATION		= 2,
	NT_FILE_BOTH_DIRECTORY_INFORMATION		= 3,
	NT_FILE_BASIC_INFORMATION			= 4,
	NT_FILE_STANDARD_INFORMATION			= 5,
	NT_FILE_INTERNAL_INFORMATION			= 6,
	NT_FILE_EA_INFORMATION				= 7,
	NT_FILE_ACCESS_INFORMATION			= 8,
	NT_FILE_NAME_INFORMATION			= 9,
	NT_FILE_RENAME_INFORMATION			= 10,
	NT_FILE_LINK_INFORMATION			= 11,
	NT_FILE_NAMES_INFORMATION			= 12,
	NT_FILE_DISPOSITION_INFORMATION			= 13,
	NT_FILE_POSITION_INFORMATION			= 14,
	NT_FILE_FULL_EA_INFORMATION			= 15,
	NT_FILE_MODE_INFORMATION			= 16,
	NT_FILE_ALIGNMENT_INFORMATION			= 17,
	NT_FILE_ALL_INFORMATION				= 18,
	NT_FILE_ALLOCATION_INFORMATION			= 19,
	NT_FILE_END_OF_FILE_INFORMATION			= 20,
	NT_FILE_ALTERNATE_NAME_INFORMATION		= 21,
	NT_FILE_STREAM_INFORMATION			= 22,
	NT_FILE_PIPE_INFORMATION			= 23,
	NT_FILE_PIPE_LOCAL_INFORMATION			= 24,
	NT_FILE_PIPE_REMOTE_INFORMATION			= 25,
	NT_FILE_MAILSLOT_QUERY_INFORMATION		= 26,
	NT_FILE_MAILSLOT_SET_INFORMATION		= 27,
	NT_FILE_COMPRESSION_INFORMATION			= 28,
	NT_FILE_OBJECT_ID_INFORMATION			= 29,
	NT_FILE_COMPLETION_INFORMATION			= 30,
	NT_FILE_MOVE_CLUSTER_INFORMATION		= 31,
	NT_FILE_QUOTA_INFORMATION			= 32,
	NT_FILE_REPARSE_POINT_INFORMATION		= 33,
	NT_FILE_NETWORK_OPEN_INFORMATION		= 34,
	NT_FILE_ATTRIBUTE_TAG_INFORMATION		= 35,
	NT_FILE_TRACKING_INFORMATION			= 36,
	NT_FILE_ID_BOTH_DIRECTORY_INFORMATION		= 37,
	NT_FILE_ID_FULL_DIRECTORY_INFORMATION		= 38,
	NT_FILE_VALID_DATA_LENGTH_INFORMATION		= 39,
	NT_FILE_SHORT_NAME_INFORMATION			= 40,
	NT_FILE_IO_COMPLETION_NOTIFICATION_INFORMATION	= 41,
	NT_FILE_IO_STATUS_BLOCK_RANGE_INFORMATION	= 42,
	NT_FILE_IO_PRIORITY_HINT_INFORMATION		= 43,
	NT_FILE_SFIO_RESERVE_INFORMATION		= 44,
	NT_FILE_SFIO_VOLUME_INFORMATION			= 45,
	NT_FILE_HARD_LINK_INFORMATION			= 46,
	NT_FILE_PROCESS_IDS_USING_FILE_INFORMATION	= 47,
	NT_FILE_NORMALIZED_NAME_INFORMATION		= 48,
	NT_FILE_NETWORK_PHYSICAL_NAME_INFORMATION	= 49,
	NT_FILE_ID_GLOBAL_TX_DIRECTORY_INFORMATION	= 50,
	NT_FILE_IS_REMOTE_DEVICE_INFORMATION		= 51,
	NT_FILE_ATTRIBUTE_CACHE_INFORMATION		= 52,
	NT_FILE_NUMA_NODE_INFORMATION			= 53,
	NT_FILE_STANDARD_LINK_INFORMATION		= 54,
	NT_FILE_REMOTE_PROTOCOL_INFORMATION		= 55,
	NT_FILE_REPLACE_COMPLETION_INFORMATION		= 56,
	NT_FILE_INFORMATION_CAP				= 57
} nt_file_info_class;


typedef enum _nt_file_create_disposition {
	NT_FILE_SUPERSEDE	= 0x00000000,
	NT_FILE_OPEN		= 0x00000001,
	NT_FILE_CREATE		= 0x00000002,
	NT_FILE_OPEN_IF		= 0x00000003,
	NT_FILE_OVERWRITE	= 0x00000004,
	NT_FILE_OVERWRITE_IF	= 0x00000005
} nt_file_create_disposition;


typedef enum _nt_file_status {
	NT_FILE_SUPERSEDED	= 0x00000000,
	NT_FILE_OPENED		= 0x00000001,
	NT_FILE_CREATED		= 0x00000002,
	NT_FILE_OVERWRITTEN	= 0x00000003,
	NT_FILE_EXISTS		= 0x00000004,
	NT_FILE_DOES_NOT_EXIST	= 0x00000005
} nt_file_status;


typedef enum _nt_file_action {
	NT_FILE_ACTION_ADDED			= 0x00000001,
	NT_FILE_ACTION_REMOVED			= 0x00000002,
	NT_FILE_ACTION_MODIFIED			= 0x00000003,
	NT_FILE_ACTION_RENAMED_OLD_NAME		= 0x00000004,
	NT_FILE_ACTION_RENAMED_NEW_NAME		= 0x00000005,
	NT_FILE_ACTION_ADDED_STREAM		= 0x00000006,
	NT_FILE_ACTION_REMOVED_STREAM		= 0x00000007,
	NT_FILE_ACTION_MODIFIED_STREAM		= 0x00000008,
	NT_FILE_ACTION_REMOVED_BY_DELETE	= 0x00000009,
} nt_file_action;


typedef enum _nt_file_pipe_flags {
	NT_FILE_PIPE_BYTE_STREAM_MODE	= 0x00000000,
	NT_FILE_PIPE_MESSAGE_MODE	= 0x00000001,

	NT_FILE_PIPE_QUEUE_OPERATION	= 0x00000000,
	NT_FILE_PIPE_COMPLETE_OPERATION	= 0x00000001,

	NT_FILE_PIPE_BYTE_STREAM_TYPE	= 0x00000000,
	NT_FILE_PIPE_MESSAGE_TYPE	= 0x00000001,

	NT_FILE_PIPE_INBOUND		= 0x00000000,
	NT_FILE_PIPE_OUTBOUND		= 0x00000001,
	NT_FILE_PIPE_FULL_DUPLEX	= 0x00000002,

	NT_FILE_PIPE_DISCONNECTED_STATE	= 0x00000001,
	NT_FILE_PIPE_LISTENING_STATE	= 0x00000002,
	NT_FILE_PIPE_CONNECTED_STATE	= 0x00000003,
	NT_FILE_PIPE_CLOSING_STATE	= 0x00000004,

	NT_FILE_PIPE_CLIENT_END		= 0x00000000,
	NT_FILE_PIPE_SERVER_END		= 0x00000001,
} nt_file_pipe_flags;


typedef enum _nt_io_priority_hint {
	NT_IO_PRIORITY_VERY_LOW		= 0,
	NT_IO_PRIORITY_LOW		= 1,
	NT_IO_PRIORITY_NORMAL		= 2,
	NT_IO_PRIORITY_HIGH		= 3,
	NT_IO_PRIORITY_CRITICAL		= 4,
	NT_MAX_IO_PRIORITY_TYPES	= 5
} nt_io_priority_hint;


typedef enum _nt_fs_info_class {
	NT_FILE_FS_VOLUME_INFORMATION		= 1,
	NT_FILE_FS_LABEL_INFORMATION		= 2,
	NT_FILE_FS_SIZE_INFORMATION		= 3,
	NT_FILE_FS_DEVICE_INFORMATION		= 4,
	NT_FILE_FS_ATTRIBUTE_INFORMATION	= 5,
	NT_FILE_FS_CONTROL_INFORMATION		= 6,
	NT_FILE_FS_FULL_SIZE_INFORMATION	= 7,
	NT_FILE_FS_OBJECT_ID_INFORMATION	= 8,
	NT_FILE_FS_DRIVER_PATH_INFORMATION	= 9,
	NT_FILE_FS_VOLUME_FLAGS_INFORMATION	= 10,
	NT_FILE_FS_SECTOR_SIZE_INFORMATION	= 11,
} nt_fs_info_class;


/* file attributes */
#define NT_FILE_ATTRIBUTE_READONLY		0x00000001
#define NT_FILE_ATTRIBUTE_HIDDEN		0x00000002
#define NT_FILE_ATTRIBUTE_SYSTEM		0x00000004
#define NT_FILE_ATTRIBUTE_DIRECTORY		0x00000010
#define NT_FILE_ATTRIBUTE_ARCHIVE		0x00000020
#define NT_FILE_ATTRIBUTE_DEVICE		0x00000040
#define NT_FILE_ATTRIBUTE_NORMAL		0x00000080
#define NT_FILE_ATTRIBUTE_TEMPORARY		0x00000100
#define NT_FILE_ATTRIBUTE_SPARSE_FILE		0x00000200
#define NT_FILE_ATTRIBUTE_REPARSE_POINT		0x00000400
#define NT_FILE_ATTRIBUTE_COMPRESSED		0x00000800
#define NT_FILE_ATTRIBUTE_OFFLINE		0x00001000
#define NT_FILE_ATTRIBUTE_NOT_CONTENT_INDEXED	0x00002000
#define NT_FILE_ATTRIBUTE_ENCRYPTED		0x00004000
#define NT_FILE_ATTRIBUTE_INTEGRITY_STREAM	0x00008000
#define NT_FILE_ATTRIBUTE_VIRTUAL		0x00010000
#define NT_FILE_ATTRIBUTE_NO_SCRUB_DATA		0x00020000


/* file create options */
#define NT_FILE_ASYNCHRONOUS_IO			0x00000000
#define NT_FILE_DIRECTORY_FILE			0x00000001
#define NT_FILE_WRITE_THROUGH			0x00000002
#define NT_FILE_SEQUENTIAL_ONLY			0x00000004
#define NT_FILE_NO_INTERMEDIATE_BUFFERING	0x00000008
#define NT_FILE_SYNCHRONOUS_IO_ALERT		0x00000010
#define NT_FILE_SYNCHRONOUS_IO_NONALERT		0x00000020
#define NT_FILE_NON_DIRECTORY_FILE		0x00000040
#define NT_FILE_CREATE_TREE_CONNECTION		0x00000080
#define NT_FILE_COMPLETE_IF_OPLOCKED		0x00000100
#define NT_FILE_NO_EA_KNOWLEDGE			0x00000200
#define NT_FILE_OPEN_REMOTE_INSTANCE		0x00000400
#define NT_FILE_RANDOM_ACCESS			0x00000800
#define NT_FILE_DELETE_ON_CLOSE			0x00001000
#define NT_FILE_OPEN_BY_FILE_ID			0x00002000
#define NT_FILE_OPEN_FOR_BACKUP_INTENT		0x00004000
#define NT_FILE_NO_COMPRESSION			0x00008000
#define NT_FILE_SESSION_AWARE			0x00040000
#define NT_FILE_RESERVE_OPFILTER		0x00100000
#define NT_FILE_OPEN_REPARSE_POINT		0x00200000
#define NT_FILE_OPEN_NO_RECALL			0x00400000
#define NT_FILE_OPEN_FOR_FREE_SPACE_QUERY	0x00800000


/* file share access */
#define NT_FILE_SHARE_READ			0x00000001
#define NT_FILE_SHARE_WRITE			0x00000002
#define NT_FILE_SHARE_DELETE			0x00000004


/* file notify */
#define NT_FILE_NOTIFY_CHANGE_FILE_NAME		0x00000001
#define NT_FILE_NOTIFY_CHANGE_DIR_NAME		0x00000002
#define NT_FILE_NOTIFY_CHANGE_ATTRIBUTES	0x00000004
#define NT_FILE_NOTIFY_CHANGE_SIZE		0x00000008
#define NT_FILE_NOTIFY_CHANGE_LAST_WRITE	0x00000010
#define NT_FILE_NOTIFY_CHANGE_LAST_ACCESS	0x00000020
#define NT_FILE_NOTIFY_CHANGE_CREATION		0x00000040
#define NT_FILE_NOTIFY_CHANGE_EA		0x00000040
#define NT_FILE_NOTIFY_CHANGE_SECURITY		0x00000100
#define NT_FILE_NOTIFY_CHANGE_STREAM_NAME	0x00000100
#define NT_FILE_NOTIFY_CHANGE_STREAM_SIZE	0x00000100
#define NT_FILE_NOTIFY_CHANGE_STREAM_WRITE	0x00000100


/* file system flags */
#define NT_FILE_CASE_SENSITIVE_SEARCH		0x00000001
#define NT_FILE_CASE_PRESERVED_NAMES		0x00000002
#define NT_FILE_UNICODE_ON_DISK			0x00000004
#define NT_FILE_PERSISTENT_ACLS			0x00000008
#define NT_FILE_FILE_COMPRESSION		0x00000010
#define NT_FILE_VOLUME_QUOTAS			0x00000020
#define NT_FILE_SUPPORTS_SPARSE_FILES		0x00000040
#define NT_FILE_SUPPORTS_REPARSE_POINTS		0x00000080
#define NT_FILE_SUPPORTS_REMOTE_STORAGE		0x00000100
#define NT_FILE_VOLUME_IS_COMPRESSED		0x00008000
#define NT_FILE_SUPPORTS_OBJECT_IDS		0x00010000
#define NT_FILE_SUPPORTS_ENCRYPTION		0x00020000
#define NT_FILE_NAMED_STREAMS			0x00040000
#define NT_FILE_READ_ONLY_VOLUME		0x00080000
#define NT_FILE_SEQUENTIAL_WRITE_ONCE		0x00100000
#define NT_FILE_SUPPORTS_TRANSACTIONS		0x00200000
#define NT_FILE_SUPPORTS_HARD_LINKS		0x00400000
#define NT_FILE_SUPPORTS_EXTENDED_ATTRIBUTES	0x00800000
#define NT_FILE_SUPPORTS_OPEN_BY_FILE_ID	0x01000000
#define NT_FILE_SUPPORTS_USN_JOURNAL		0x02000000
#define NT_FILE_SUPPORT_INTEGRITY_STREAMS	0x04000000


/* file sector size flags */
#define NT_SSINFO_FLAGS_ALIGNED_DEVICE			0x00000001
#define NT_SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE	0x00000002
#define NT_SSINFO_FLAGS_NO_SEEK_PENALTY			0x00000004
#define NT_SSINFO_FLAGS_TRIM_ENABLED			0x00000008


/* file alignment flags */
#define NT_FILE_BYTE_ALIGNMENT		0x00000000
#define NT_FILE_WORD_ALIGNMENT		0x00000001
#define NT_FILE_LONG_ALIGNMENT		0x00000003
#define NT_FILE_QUAD_ALIGNMENT		0x00000007
#define NT_FILE_OCTA_ALIGNMENT		0x0000000f
#define NT_FILE_32_BYTE_ALIGNMENT	0x0000001f
#define NT_FILE_64_BYTE_ALIGNMENT	0x0000003f
#define NT_FILE_128_BYTE_ALIGNMENT	0x0000007f
#define NT_FILE_256_BYTE_ALIGNMENT	0x000000ff
#define NT_FILE_512_BYTE_ALIGNMENT	0x000001ff


/* file tx info flags */
#define NT_FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_WRITELOCKED		0x00000001
#define NT_FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_TO_TX	0x00000002
#define NT_FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_OUTSIDE_TX	0x00000004


/* friendly file type bits */
#define NT_FILE_TYPE_UNKNOWN		(0x0000u)
#define NT_FILE_TYPE_FILE		(0x0001u)
#define NT_FILE_TYPE_DIRECTORY		(0x0002u)
#define NT_FILE_TYPE_PIPE		(0x0004u)
#define NT_FILE_TYPE_SOCKET		(0x0008u)
#define NT_FILE_TYPE_MAILSLOT		(0x0010u)
#define NT_FILE_TYPE_CSRSS		(0x0020u)
#define NT_FILE_TYPE_PTY		(0x0040u)
#define NT_FILE_TYPE_VFD		(0x0080u)


/* file access bits */
#define	NT_FILE_ANY_ACCESS		(0x0000u)
#define	NT_FILE_READ_ACCESS		(0x0001u)
#define	NT_FILE_READ_DATA		(0x0001u)
#define	NT_FILE_LIST_DIRECTORY		(0x0001u)
#define	NT_FILE_WRITE_ACCESS		(0x0002u)
#define	NT_FILE_WRITE_DATA		(0x0002u)
#define	NT_FILE_ADD_FILE		(0x0002u)
#define	NT_FILE_APPEND_DATA		(0x0004u)
#define	NT_FILE_ADD_SUBDIRECTORY	(0x0004u)
#define	NT_FILE_CREATE_PIPE_INSTANCE	(0x0004u)
#define	NT_FILE_READ_EA			(0x0008u)
#define	NT_FILE_WRITE_EA		(0x0010u)
#define	NT_FILE_EXECUTE			(0x0020u)
#define	NT_FILE_TRAVERSE		(0x0020u)
#define	NT_FILE_DELETE_CHILD		(0x0040u)
#define	NT_FILE_READ_ATTRIBUTES		(0x0080u)
#define	NT_FILE_WRITE_ATTRIBUTES	(0x0100u)

#define NT_FILE_GENERIC_WRITE		NT_FILE_WRITE_ATTRIBUTES \
					| NT_FILE_WRITE_DATA \
					| NT_FILE_WRITE_EA \
					| NT_FILE_APPEND_DATA \
					| NT_SEC_READ_CONTROL \
					| NT_SEC_SYNCHRONIZE

#define NT_FILE_ALL_ACCESS		NT_FILE_ANY_ACCESS \
					| NT_FILE_READ_ACCESS \
					| NT_FILE_WRITE_ACCESS \
					| NT_FILE_APPEND_DATA \
					| NT_FILE_READ_EA \
					| NT_FILE_WRITE_EA \
					| NT_FILE_EXECUTE \
					| NT_FILE_TRAVERSE \
					| NT_FILE_DELETE_CHILD \
					| NT_FILE_READ_ATTRIBUTES \
					| NT_FILE_WRITE_ATTRIBUTES \
					| NT_SEC_SYNCHRONIZE \
					| NT_SEC_STANDARD_RIGHTS_ALL


/* structures related to nt_fs_info_class */
typedef struct _nt_file_fs_volume_information {
	nt_large_integer	volume_creation_time;
	uint32_t		volume_serial_number;
	uint32_t		volume_label_length;
	unsigned char		supports_objects ;
	unsigned char		reserved;
	wchar16_t		volume_label[];
} nt_file_fs_volume_information, nt_fsvi;


typedef struct _nt_file_fs_label_information {
	uint32_t		volume_label_length;
	wchar16_t		volume_label[];
} nt_file_fs_label_information;


typedef struct _nt_file_fs_size_information {
	nt_large_integer	total_allocation_units;
	nt_large_integer	available_allocation_units;
	uint32_t		sectors_per_allocation_unit;
	uint32_t		bytes_per_sector;
} nt_file_fs_size_information, nt_fssi;


typedef struct _nt_file_fs_device_information {
	nt_device_type	device_type;
	uint32_t	characteristics;
} nt_file_fs_device_information, nt_fsdi;


typedef struct _nt_file_fs_attribute_information {
	uint32_t	file_system_attributes;
	uint32_t	maximum_component_name_length;
	uint32_t	file_system_name_length;
	wchar16_t	file_system_name[];
} nt_file_fs_attribute_information, nt_fsai;


typedef struct _nt_file_fs_control_information {
	nt_large_integer	free_space_start_filtering;
	nt_large_integer	free_space_threshold;
	nt_large_integer	free_space_stop_filtering;
	nt_large_integer	default_quota_threshold;
	nt_large_integer	default_quota_limit;
	uint32_t		file_system_control_flags;
	uint32_t		padding;
} nt_file_fs_control_information, nt_fsci;


typedef struct _nt_file_fs_full_size_information {
	nt_large_integer	total_allocation_units;
	nt_large_integer	caller_available_allocation_units;
	nt_large_integer	actual_available_allocation_units;
	uint32_t		sectors_per_allocation_unit;
	uint32_t		bytes_per_sector;
} nt_file_fs_full_size_information, nt_fsfsi;


typedef struct _nt_file_fs_object_id_information {
	nt_uuid		volume_object_id;
	uint32_t	volume_object_id_extended_info;
} nt_file_fs_object_id_information, nt_fsoii;


typedef struct _nt_file_fs_driver_path_information {
	unsigned char 		driver_in_path;
	unsigned char		reserved[3];
	uint32_t		driver_name_length;
	wchar16_t		driver_name[];
} nt_file_fs_driver_path_information, nt_fsdpi;


typedef struct _nt_file_fs_sector_size_information {
	uint32_t	logical_bytes_per_sector;
	uint32_t	physical_bytes_per_sector_for_atomicity;
	uint32_t	physical_bytes_per_sector_for_performance;
	uint32_t	effective_physical_bytes_per_sector_for_atomicity;
	uint32_t	flags;
	uint32_t	byte_offset_for_sector_alignment;
	uint32_t	byte_offset_for_partition_alignment;
} nt_file_fs_sector_size_information, nt_fsssi;


typedef struct _nt_file_fs_persistent_volume_information {
	uint32_t	volume_flags;
	uint32_t	flag_mask;
	uint32_t	version;
	uint32_t	reserved;
} nt_file_fs_persistent_volume_information;


/* structures related to zw_query_quota_information_file */
typedef struct _nt_file_user_quota_information {
	uint32_t		next_entry_offset;
	uint32_t		sid_length;
	nt_large_integer	change_time;
	nt_large_integer	quota_used;
	nt_large_integer	quota_threshold;
	nt_large_integer	quota_limit;
	nt_sid			sid[];
} nt_file_user_quota_information;


typedef struct _nt_file_quota_list_information {
	uint32_t	next_entry_offset;
	uint32_t	sid_length;
	nt_sid		sid[];
} nt_file_quota_list_information;



/* structures included in nt_file_all_information */
typedef struct _nt_file_basic_information {
	nt_large_integer	creation_time;
	nt_large_integer	last_access_time;
	nt_large_integer	last_write_time;
	nt_large_integer	change_time;
	uint32_t		file_attr;
} nt_file_basic_information, nt_fbi;


typedef struct _nt_file_standard_information {
	nt_large_integer	allocation_size;
	nt_large_integer	end_of_file;
	uint32_t		number_of_links;
	unsigned char		delete_pending;
	unsigned char		directory;
	unsigned char		reserved[2];
} nt_file_standard_information, nt_fsi;


typedef struct _nt_file_internal_information {
	nt_large_integer	index_number;
} nt_file_internal_information, nt_fii;


typedef struct _nt_file_ea_information {
	uint32_t	ea_size;
} nt_file_ea_information, nt_fei;


typedef struct _nt_file_access_information {
	uint32_t	access_flags;
} nt_file_access_information, nt_facci;


typedef struct _nt_file_position_information {
	nt_large_integer	current_byte_offset;
} nt_file_position_information, nt_fpi;


typedef struct _nt_file_mode_information {
	uint32_t	mode;
} nt_file_mode_information, nt_fmi;


typedef struct _nt_file_alignment_information {
	uint32_t	alignment_requirement;
} nt_file_alignment_information, nt_falii;


typedef struct _nt_file_name_information {
	uint32_t	file_name_length;
	wchar16_t	file_name[];
} nt_file_name_information, nt_fni;


typedef struct _nt_file_all_information {
	nt_file_basic_information	basic_info;
	nt_file_standard_information	standard_info;
	nt_file_internal_information	internal_info;
	nt_file_ea_information		ea_info;
	nt_file_access_information	access_info;
	nt_file_position_information	position_info;
	nt_file_mode_information	mode_info;
	nt_file_alignment_information	alignment_info;
	nt_file_name_information	name_info;
} nt_file_all_information, nt_fai;



/* structures related to nt_file_info_class */
typedef struct _nt_file_directory_information {
	uint32_t		next_entry_offset;
	uint32_t		file_index;
	nt_large_integer	creation_time;
	nt_large_integer	last_access_time;
	nt_large_integer	last_write_time;
	nt_large_integer	change_time;
	nt_large_integer	end_of_file;
	nt_large_integer	allocation_size;
	uint32_t		file_attributes;
	uint32_t		file_name_length;
	wchar16_t		file_name[];
} nt_file_directory_information, nt_fdiri;


typedef struct _nt_file_full_dir_information {
	uint32_t		next_entry_offset;
	uint32_t		file_index;
	nt_large_integer	creation_time;
	nt_large_integer	last_access_time;
	nt_large_integer	last_write_time;
	nt_large_integer	change_time;
	nt_large_integer	end_of_file;
	nt_large_integer	allocation_size;
	uint32_t		file_attributes;
	uint32_t		file_name_length;
	uint32_t		ea_size;
	wchar16_t		file_name[];
} nt_file_full_dir_information;


typedef struct _nt_file_both_dir_information {
	uint32_t		next_entry_offset;
	uint32_t		file_index;
	nt_large_integer	creation_time;
	nt_large_integer	last_access_time;
	nt_large_integer	last_write_time;
	nt_large_integer	change_time;
	nt_large_integer	end_of_file;
	nt_large_integer	allocation_size;
	uint32_t		file_attributes;
	uint32_t		file_name_length;
	uint32_t		ea_size;
	char			short_name_length;
	char			reserved;
	wchar16_t		short_name[12];
	wchar16_t		file_name[];
} nt_file_both_dir_information;


typedef struct _nt_file_rename_information {
	unsigned char		replace_if_exists;
	void *			root_directory;
	uint32_t		file_name_length;
	wchar16_t		file_name[];
} nt_file_rename_information, nt_frni;


typedef struct _nt_file_link_information {
	unsigned char		replace_if_exists;
	void *			root_directory;
	uint32_t		file_name_length;
	wchar16_t		file_name[];
} nt_file_link_information;


typedef struct _nt_file_names_information {
	uint32_t		next_entry_offset;
	uint32_t		file_index;
	uint32_t		file_name_length;
	wchar16_t		file_name[];
} nt_file_names_information, nt_fnamesi;


typedef struct _nt_file_disposition_information {
	unsigned char	delete_file;
} nt_file_disposition_information, nt_fdi;


typedef struct _nt_file_full_ea_information {
	uint32_t	next_entry_offset;
	unsigned char	flags;
	unsigned char	ea_name_length;
	uint16_t	ea_value_length;
	char		ea_name[];
} nt_file_full_ea_information;


typedef struct _nt_file_allocation_information {
	nt_large_integer	allocation_size;
} nt_file_allocation_information;


typedef struct _nt_file_end_of_file_information {
	nt_large_integer	end_of_file;
} nt_file_end_of_file_information, nt_eof;


typedef struct _nt_file_stream_information {
	uint32_t		next_entry_offset;
	uint32_t		stream_name_length;
	nt_large_integer	stream_size;
	nt_large_integer	stream_allocation_size;
	wchar16_t		stream_name[];
} nt_file_stream_information;


typedef struct _nt_file_pipe_information {
	uint32_t	read_mode;
	uint32_t	completion_mode;
} nt_file_pipe_information;


typedef struct _nt_file_pipe_local_information {
	uint32_t	named_pipe_type;
	uint32_t	named_pipe_configuration;
	uint32_t	maximum_instances;
	uint32_t	current_instances;
	uint32_t	inbound_quota;
	uint32_t	read_data_available;
	uint32_t	outbound_quota;
	uint32_t	write_quota_available;
	uint32_t	named_pipe_state;
	uint32_t	named_pipe_end;
} nt_file_pipe_local_information;


typedef struct _nt_file_pipe_remote_information {
	nt_large_integer	collect_data_time;
	uint32_t		maximum_collection_count;
} nt_file_pipe_remote_information;


typedef struct _nt_file_mailslot_query_information {
	uint32_t		maximum_message_size;
	uint32_t		mailslot_quota;
	uint32_t		next_message_size;
	uint32_t		messages_available;
	nt_large_integer	read_timeout;
} nt_file_mailslot_query_information;


typedef struct _nt_file_mailslot_set_information {
	nt_large_integer *	read_timeout;
} nt_file_mailslot_set_information;


typedef struct _nt_file_compression_information {
	nt_large_integer		CompressedFileSize;
	uint16_t			CompressionFormat;
	unsigned char			CompressionUnitShift;
	unsigned char			ChunkShift;
	unsigned char			ClusterShift;
	unsigned char			Reserved[3];
} nt_file_compression_information;


typedef struct _nt_file_object_id_buffer {
	unsigned char	obj_id[16];
	unsigned char	birth_volume_id[16];
	unsigned char	birth_object_id[16];
	unsigned char	domain_id[16];
} nt_file_object_id_buffer;


typedef struct _nt_file_object_id_information {
	int64_t		file_reference;
	unsigned char	object_id[16];

	union {
		struct {
			unsigned char	birth_volume_id[16];
			unsigned char	birth_object_id[16];
			unsigned char	domain_id[16];
		};
		unsigned char	extended_info[48];
	};
} nt_file_object_id_information;


typedef struct _nt_file_quota_information {
	uint32_t		next_entry_offset;
	uint32_t		sid_length;
	nt_large_integer	change_time;
	nt_large_integer	quota_used;
	nt_large_integer	quota_threshold;
	nt_large_integer	quota_limit;
	nt_sid			sid;
} nt_file_quota_information;


typedef struct _nt_file_reparse_point_information {
	int64_t		file_reference;
	uint32_t	tag;
} nt_file_reparse_point_information, nt_frpi;


typedef struct _nt_file_network_open_information {
	nt_large_integer	creation_time;
	nt_large_integer	last_access_time;
	nt_large_integer	last_write_time;
	nt_large_integer	change_time;
	nt_large_integer	allocation_size;
	nt_large_integer	end_of_file;
	uint32_t		file_attributes;
} nt_file_network_open_information;


typedef struct _nt_file_attribute_tag_information {
	uint32_t	file_attr;
	uint32_t	reparse_tag;
} nt_file_attribute_tag_information, nt_ftagi;


typedef struct _nt_file_id_both_dir_information {
	uint32_t		next_entry_offset;
	uint32_t		file_index;
	nt_large_integer	creation_time;
	nt_large_integer	last_access_time;
	nt_large_integer	last_write_time;
	nt_large_integer	change_time;
	nt_large_integer	end_of_file;
	nt_large_integer	allocation_size;
	uint32_t		file_attributes;
	uint32_t		file_name_length;
	uint32_t		ea_size;
	char			short_name_length;
	char			reserved;
	wchar16_t		short_name[12];
	nt_large_integer	file_id;
	wchar16_t		file_name[];
} nt_file_id_both_dir_information, nt_fsdirent;


typedef struct _nt_file_id_full_dir_information {
	uint32_t		next_entry_offset;
	uint32_t		file_index;
	nt_large_integer	creation_time;
	nt_large_integer	last_access_time;
	nt_large_integer	last_write_time;
	nt_large_integer	change_time;
	nt_large_integer	end_of_file;
	nt_large_integer	allocation_size;
	uint32_t		file_attributes;
	uint32_t		file_name_length;
	uint32_t		ea_size;
	nt_large_integer	FileId;
	wchar16_t		file_name[];
} nt_file_id_full_dir_information;


typedef struct _nt_file_valid_data_length_information {
	nt_large_integer	valid_data_length;
} nt_file_valid_data_length_information;


typedef struct _nt_file_io_priority_hint_information {
	nt_io_priority_hint	priority_hint;
} nt_file_io_priority_hint_information;


typedef struct _nt_file_link_entry_information {
	uint32_t	next_entry_offset;
	int64_t		parent_file_id;
	uint32_t	file_name_length;
	wchar16_t	file_name[];
} nt_file_link_entry_information;


typedef struct _nt_file_links_information {
	uint32_t	bytes_needed;
	uint32_t	entries_returned;
	nt_file_link_entry_information	entry;
} nt_file_links_information;


typedef struct _nt_file_id_global_tx_dir_information {
	uint32_t		next_entry_offset;
	uint32_t		file_index;
	nt_large_integer	creation_time;
	nt_large_integer	last_access_time;
	nt_large_integer	last_write_time;
	nt_large_integer	change_time;
	nt_large_integer	end_of_file;
	nt_large_integer	allocation_size;
	uint32_t		file_attributes;
	uint32_t		file_name_length;
	nt_large_integer	file_id;
	nt_guid			locking_transaction_id;
	uint32_t		tx_info_flags;
	wchar16_t		file_name[];
} nt_file_id_global_tx_dir_information;


typedef struct _nt_file_completion_information {
	void *	port;
	void *	key;
} nt_file_completion_information;



/* file extended attributes */
typedef struct _nt_file_get_ea_information {
	uint32_t	next_entry_offset;
	unsigned char	ea_name_length;
	char		ea_name[];
} nt_file_get_ea_information;


/* quota information */
typedef struct _nt_file_get_quota_information {
	uint32_t	next_entry_offset;
	uint32_t	sid_length;
	nt_sid		sid;
} nt_file_get_quota_information;


/* file change notification */
typedef struct _nt_file_notify_information {
	uint32_t	next_entry_offset;
	uint32_t	action;
	uint32_t	file_name_length;
	wchar16_t	file_name[];
} nt_file_notify_information;


/* file segment element */
typedef union _nt_file_segment_element {
  uint64_t *	buffer;
  uint64_t	alignment;
} nt_file_segment_element;


/* section object pointers */
typedef struct _nt_section_object_pointers {
	void *	data_section_object;
	void *	shared_cache_map;
	void *	image_section_object;
} nt_section_object_pointers;


/* reparse guid data buffer */
typedef struct _nt_reparse_guid_data_buffer {
	uint32_t	reparse_tag;
	uint16_t	reparse_data_length;
	uint16_t	reserved;
	nt_guid		reparse_guid;
	unsigned char	generic_reparse_buffer[];
} nt_reparse_guid_data_buffer;


/* reparse data buffer */
typedef struct _nt_reparse_data_buffer {
	uint32_t	reparse_tag;
	uint16_t	reparse_data_length;
	uint16_t	reserved;

	union {
		struct {
			uint16_t	substitute_name_offset;
			uint16_t	substitute_name_length;
			uint16_t	print_name_offset;
			uint16_t	print_name_length;
			uint32_t	flags;
		} symbolic_link_reparse_buffer;

		struct {
			uint16_t	substitute_name_offset;
			uint16_t	substitute_name_length;
			uint16_t	print_name_offset;
			uint16_t	print_name_length;
		} mount_point_reparse_buffer;
	};

	wchar16_t	path_buffer[];
} nt_reparse_data_buffer;


/* file object */
typedef struct _nt_file_object {
	int16_t				type;
	int16_t				size;
	nt_device_object *		dev_obj;
	nt_vpb				vpb;
	void *				fs_context;
	void *				fs_context_2nd;
	nt_section_object_pointers *	sec_obj_ptr;
	void *				private_cache_map;
	int32_t				final_status;
	struct _nt_file_object *	related_file_obj;
	unsigned char			lock_operation;
	unsigned char			delete_pending;
	unsigned char			read_access;
	unsigned char			write_access;
	unsigned char			delete_access;
	unsigned char			shared_read;
	unsigned char			shared_write;
	unsigned char			shared_delete;
	uint32_t			flags;
	nt_unicode_string		file_name;
	nt_large_integer		current_byte_offset;
	uint32_t			waiters;
	uint32_t			busy;
	void *				last_lock;
	nt_kevent			lock;
	nt_kevent			event;
	nt_io_completion_context *	completion_context;
	uint32_t			irp_list_lock;
	nt_list_entry			irp_list;
	void *				file_obj_ext;
} nt_file_object;




/* file-related function signatures */
typedef int32_t __stdcall ntapi_zw_create_file(
	__out	void **			hfile,
	__in	uint32_t		desired_access,
	__in	nt_object_attributes *	obj_attr,
	__out	nt_io_status_block *	io_status_block,
	__in	nt_large_integer *	allocation_size		__optional,
	__in	uint32_t		file_attr,
	__in	uint32_t		share_access,
	__in	uint32_t		create_disposition,
	__in	uint32_t		create_options,
	__in	void *			ea_buffer		__optional,
	__in	uint32_t		ea_length);


typedef int32_t	__stdcall ntapi_zw_open_file(
	__out	void **			hfile,
	__in	uint32_t		desired_access,
	__in	nt_object_attributes *	obj_attr,
	__out	nt_io_status_block *	io_status_block,
	__in	uint32_t		share_access,
	__in	uint32_t		open_options);


typedef int32_t	__stdcall ntapi_zw_delete_file(
	__in	nt_object_attributes *	obj_attr);


typedef int32_t	__stdcall ntapi_zw_flush_buffers_file(
	__in	void *			hfile,
	__out	nt_io_status_block *	io_status_block);


typedef int32_t	__stdcall ntapi_zw_cancel_io_file(
	__in	void *			hfile,
	__out	nt_io_status_block *	io_status_block);


typedef int32_t	__stdcall ntapi_zw_cancel_io_file_ex(
	__in	void *			hfile,
	__in	nt_io_status_block *	request_iosb	__optional,
	__out	nt_io_status_block *	cancel_iosb);


typedef int32_t	__stdcall ntapi_zw_read_file(
	__in	void *			hfile,
	__in	void *			hevent		__optional,
	__in	nt_io_apc_routine *	apc_routine	__optional,
	__in	void *			apc_context	__optional,
	__out	nt_iosb volatile *	io_status_block,
	__out	void *			buffer,
	__in	uint32_t		bytes_to_read,
	__in	nt_large_integer *	byte_offset	__optional,
	__in	uint32_t *		key		__optional);


typedef int32_t __stdcall ntapi_zw_write_file(
	__in	void *			hfile,
	__in 	void *			hevent		__optional,
	__in	nt_io_apc_routine *	apc_routine	__optional,
	__in	void * 			apc_context	__optional,
	__out	nt_iosb volatile *	io_status_block,
	__in	void * 			buffer,
	__in	uint32_t		bytes_sent,
	__in	nt_large_integer *	byte_offset	__optional,
	__in	uint32_t *		key		__optional);


typedef int32_t	__stdcall ntapi_zw_read_file_scatter(
	__in	void *				hfile,
	__in	void *				hevent		__optional,
	__in	nt_io_apc_routine *		apc_routine	__optional,
	__in	void *				apc_context	__optional,
	__out	nt_iosb volatile *		io_status_block,
	__in	nt_file_segment_element *	buffer,
	__in	uint32_t			bytes_to_read,
	__in	nt_large_integer *		byte_offset	__optional,
	__in	uint32_t *			key		__optional);


typedef int32_t	__stdcall ntapi_zw_write_file_gather(
	__in	void *				hfile,
	__in	void *				hevent		__optional,
	__in	nt_io_apc_routine *		apc_routine	__optional,
	__in	void *				apc_context	__optional,
	__out	nt_iosb volatile *		io_status_block,
	__in	nt_file_segment_element *	buffer,
	__in	uint32_t			bytes_to_read,
	__in	nt_large_integer *		byte_offset	__optional,
	__in	uint32_t *			key		__optional);


typedef int32_t	__stdcall ntapi_zw_lock_file(
	__in	void *				hfile,
	__in	void *				hevent		__optional,
	__in	nt_io_apc_routine *		apc_routine	__optional,
	__in	void *				apc_context	__optional,
	__out	nt_iosb volatile *		io_status_block,
	__in	nt_large_integer *		lock_offset,
	__in	nt_large_integer *		lock_length,
	__in	uint32_t			key,
	__in	unsigned char			fail_immediately,
	__in	unsigned char			exclusive_lock);


typedef int32_t	__stdcall ntapi_zw_unlock_file(
	__in	void *				hfile,
	__out	nt_io_status_block *		io_status_block,
	__in	nt_large_integer *		lock_offset,
	__in	nt_large_integer *		lock_length,
	__in	uint32_t			key);


typedef int32_t	__stdcall ntapi_zw_device_io_control_file(
	__in	void *				hfile,
	__in	void *				hevent			__optional,
	__in	nt_io_apc_routine *		apc_routine		__optional,
	__in	void *				apc_context		__optional,
	__out	nt_iosb volatile *		io_status_block,
	__in	uint32_t			io_control_code,
	__in	void *				input_buffer		__optional,
	__in	uint32_t			input_buffer_length,
	__out	void *				output_buffer		__optional,
	__in	uint32_t			output_buffer_length);


typedef int32_t	__stdcall ntapi_zw_fs_control_file(
	__in	void *				hfile,
	__in	void *				hevent			__optional,
	__in	nt_io_apc_routine *		apc_routine		__optional,
	__in	void *				apc_context		__optional,
	__out	nt_iosb volatile *		io_status_block,
	__in	uint32_t			fs_control_code,
	__in	void *				input_buffer		__optional,
	__in	uint32_t			input_buffer_length,
	__out	void *				output_buffer		__optional,
	__in	uint32_t			output_buffer_length);


typedef int32_t	__stdcall ntapi_zw_notify_change_directory_file(
	__in	void *				hfile	,
	__in	void *				hevent			__optional,
	__in	nt_io_apc_routine *		apc_routine		__optional,
	__in	void *				apc_context		__optional,
	__out	nt_iosb volatile *		io_status_block,
	__out	nt_file_notify_information *	buffer,
	__in	uint32_t			buffer_length,
	__in	uint32_t			notify_filter,
	__in	unsigned char			watch_subtree);


typedef int32_t	__stdcall ntapi_zw_query_ea_file(
	__in	void *				hfile	,
	__out	nt_io_status_block *		io_status_block,
	__out	nt_file_full_ea_information *	buffer,
	__in	uint32_t			buffer_length,
	__in	unsigned char			return_single_entry,
	__in	nt_file_get_ea_information *	ea_list			__optional,
	__in	uint32_t			ea_list_length,
	__in	uint32_t *			ea_index		__optional,
	__in	unsigned char			restart_scan);


typedef int32_t	__stdcall ntapi_zw_set_ea_file(
	__in	void *				hfile	,
	__out	nt_io_status_block *		io_status_block,
	__in	nt_file_full_ea_information *	buffer,
	__in	uint32_t			buffer_length);


typedef int32_t	__stdcall ntapi_zw_create_named_pipe_file(
	__out	void **			hfile,
	__in	uint32_t		desired_access,
	__in	nt_object_attributes *	obj_attr,
	__out	nt_io_status_block *	io_status_block,
	__in	uint32_t		share_access,
	__in	uint32_t		create_disposition,
	__in	uint32_t		create_options,
	__in	uint32_t		type_message,
	__in	uint32_t		readmode_message,
	__in	uint32_t		non_blocking,
	__in	uint32_t		max_instances,
	__in	size_t			in_buffer_size,
	__in	size_t			out_buffer_size,
	__in	nt_large_integer *	default_timeout	__optional);


typedef int32_t	__stdcall ntapi_zw_create_mailslot_file(
	__out	void **			hfile,
	__in	uint32_t		desired_access,
	__in	nt_object_attributes *	obj_attr,
	__out	nt_io_status_block *	io_status_block,
	__in	uint32_t		create_options,
	__in	uint32_t		in_buffer_size,
	__in	uint32_t		max_message_size,
	__in	nt_large_integer *	read_timeout	__optional);


typedef int32_t	__stdcall ntapi_zw_query_volume_information_file(
	__in	void *				hfile	,
	__out	nt_io_status_block *		io_status_block,
	__out	void *				vol_info,
	__in	uint32_t			vol_info_length,
	__in	nt_fs_info_class		vol_info_class);


typedef int32_t	__stdcall ntapi_zw_set_volume_information_file(
	__in	void *				hfile	,
	__out	nt_io_status_block *		io_status_block,
	__in	void *				vol_info,
	__in	uint32_t			vol_info_length,
	__in	nt_fs_info_class		vol_info_class);


typedef int32_t	__stdcall ntapi_zw_query_quota_information_file(
	__in	void *					hfile	,
	__out	nt_io_status_block *			io_status_block,
	__out	nt_file_user_quota_information *	buffer,
	__in	uint32_t				buffer_length,
	__in	unsigned char				returning_single_entry,
	__in	nt_file_quota_list_information *	sid_list		__optional,
	__in	uint32_t				sid_list_length,
	__in	nt_sid *				start_sid		__optional,
	__in	unsigned char				restart_scan);


typedef int32_t	__stdcall ntapi_zw_set_quota_information_file(
	__in	void *					hfile	,
	__out	nt_io_status_block *			io_status_block,
	__in	nt_file_user_quota_information *	buffer,
	__in	uint32_t				buffer_length);


typedef int32_t	__stdcall ntapi_zw_query_attributes_file(
	__in	nt_object_attributes *		obj_attr,
	__out	nt_file_basic_information *	file_info);


typedef int32_t	__stdcall ntapi_zw_query_full_attributes_file(
	__in	nt_object_attributes *			obj_attr,
	__out	nt_file_network_open_information *	file_info);


typedef int32_t	__stdcall ntapi_zw_query_directory_file(
	__in	void *			hfile,
	__in	void *			hevent		__optional,
	__in	nt_io_apc_routine *	apc_routine	__optional,
	__in	void *			apc_context	__optional,
	__out	nt_iosb volatile *	io_status_block,
	__out	void *			file_info,
	__in	uint32_t		file_info_length,
	__in	nt_file_info_class	file_info_class,
	__in	unsigned char		return_single_entry,
	__in	nt_unicode_string *	file_name	__optional,
	__in	unsigned char		restart_scan);


typedef int32_t	__stdcall ntapi_zw_query_information_file(
	__in	void *			hfile,
	__out	nt_io_status_block *	io_status_block,
	__out	void *			file_info,
	__in	uint32_t		file_info_length,
	__in	nt_file_info_class	file_info_class);


typedef int32_t	__stdcall ntapi_zw_set_information_file(
	__in	void *			hfile,
	__out	nt_io_status_block *	io_status_block,
	__in	void *			file_info,
	__in	uint32_t		file_info_length,
	__in	nt_file_info_class	file_info_class);

/* extension functions */
typedef int32_t __stdcall ntapi_tt_get_file_handle_type(
	__in	void *		handle,
	__out	int32_t *	type);

typedef int32_t __stdcall ntapi_tt_open_logical_parent_directory(
	__out	void **		hparent,
	__in	void *		hdir,
	__out	uintptr_t *	buffer,
	__in	uint32_t	buffer_size,
	__in	uint32_t	oattr,
	__in	uint32_t	desired_access,
	__in	uint32_t	share_access,
	__in	uint32_t	open_options,
	__out	int *		reserved);

typedef int32_t __stdcall ntapi_tt_open_physical_parent_directory(
	__out	void **		hparent,
	__in	void *		hdir,
	__out	uintptr_t *	buffer,
	__in	uint32_t	buffer_size,
	__in	uint32_t	oattr,
	__in	uint32_t	desired_access,
	__in	uint32_t	share_access,
	__in	uint32_t	open_options,
	__out	int *		reserved);

typedef int32_t	__stdcall ntapi_tt_open_volume_by_guid(
	__out	void **			hfile,
	__in	const nt_guid *		guid,
	__in	uint32_t		desired_access,
	__in	nt_object_attributes *	obj_attr,
	__out	nt_io_status_block *	io_status_block,
	__in	uint32_t		share_access,
	__in	uint32_t		open_options);

#endif