#ifndef _NT_FILE_H_ #define _NT_FILE_H_ #include "nt_abi.h" #include "nt_object.h" #include "nt_device.h" typedef enum _nt_file_info_class { NT_FILE_DIRECTORY_INFORMATION = 1, NT_FILE_FULL_DIRECTORY_INFORMATION = 2, NT_FILE_BOTH_DIRECTORY_INFORMATION = 3, NT_FILE_BASIC_INFORMATION = 4, NT_FILE_STANDARD_INFORMATION = 5, NT_FILE_INTERNAL_INFORMATION = 6, NT_FILE_EA_INFORMATION = 7, NT_FILE_ACCESS_INFORMATION = 8, NT_FILE_NAME_INFORMATION = 9, NT_FILE_RENAME_INFORMATION = 10, NT_FILE_LINK_INFORMATION = 11, NT_FILE_NAMES_INFORMATION = 12, NT_FILE_DISPOSITION_INFORMATION = 13, NT_FILE_POSITION_INFORMATION = 14, NT_FILE_FULL_EA_INFORMATION = 15, NT_FILE_MODE_INFORMATION = 16, NT_FILE_ALIGNMENT_INFORMATION = 17, NT_FILE_ALL_INFORMATION = 18, NT_FILE_ALLOCATION_INFORMATION = 19, NT_FILE_END_OF_FILE_INFORMATION = 20, NT_FILE_ALTERNATE_NAME_INFORMATION = 21, NT_FILE_STREAM_INFORMATION = 22, NT_FILE_PIPE_INFORMATION = 23, NT_FILE_PIPE_LOCAL_INFORMATION = 24, NT_FILE_PIPE_REMOTE_INFORMATION = 25, NT_FILE_MAILSLOT_QUERY_INFORMATION = 26, NT_FILE_MAILSLOT_SET_INFORMATION = 27, NT_FILE_COMPRESSION_INFORMATION = 28, NT_FILE_OBJECT_ID_INFORMATION = 29, NT_FILE_COMPLETION_INFORMATION = 30, NT_FILE_MOVE_CLUSTER_INFORMATION = 31, NT_FILE_QUOTA_INFORMATION = 32, NT_FILE_REPARSE_POINT_INFORMATION = 33, NT_FILE_NETWORK_OPEN_INFORMATION = 34, NT_FILE_ATTRIBUTE_TAG_INFORMATION = 35, NT_FILE_TRACKING_INFORMATION = 36, NT_FILE_ID_BOTH_DIRECTORY_INFORMATION = 37, NT_FILE_ID_FULL_DIRECTORY_INFORMATION = 38, NT_FILE_VALID_DATA_LENGTH_INFORMATION = 39, NT_FILE_SHORT_NAME_INFORMATION = 40, NT_FILE_IO_COMPLETION_NOTIFICATION_INFORMATION = 41, NT_FILE_IO_STATUS_BLOCK_RANGE_INFORMATION = 42, NT_FILE_IO_PRIORITY_HINT_INFORMATION = 43, NT_FILE_SFIO_RESERVE_INFORMATION = 44, NT_FILE_SFIO_VOLUME_INFORMATION = 45, NT_FILE_HARD_LINK_INFORMATION = 46, NT_FILE_PROCESS_IDS_USING_FILE_INFORMATION = 47, NT_FILE_NORMALIZED_NAME_INFORMATION = 48, NT_FILE_NETWORK_PHYSICAL_NAME_INFORMATION = 49, NT_FILE_ID_GLOBAL_TX_DIRECTORY_INFORMATION = 50, NT_FILE_IS_REMOTE_DEVICE_INFORMATION = 51, NT_FILE_ATTRIBUTE_CACHE_INFORMATION = 52, NT_FILE_NUMA_NODE_INFORMATION = 53, NT_FILE_STANDARD_LINK_INFORMATION = 54, NT_FILE_REMOTE_PROTOCOL_INFORMATION = 55, NT_FILE_REPLACE_COMPLETION_INFORMATION = 56, NT_FILE_INFORMATION_CAP = 57 } nt_file_info_class; typedef enum _nt_file_create_disposition { NT_FILE_SUPERSEDE = 0x00000000, NT_FILE_OPEN = 0x00000001, NT_FILE_CREATE = 0x00000002, NT_FILE_OPEN_IF = 0x00000003, NT_FILE_OVERWRITE = 0x00000004, NT_FILE_OVERWRITE_IF = 0x00000005 } nt_file_create_disposition; typedef enum _nt_file_status { NT_FILE_SUPERSEDED = 0x00000000, NT_FILE_OPENED = 0x00000001, NT_FILE_CREATED = 0x00000002, NT_FILE_OVERWRITTEN = 0x00000003, NT_FILE_EXISTS = 0x00000004, NT_FILE_DOES_NOT_EXIST = 0x00000005 } nt_file_status; typedef enum _nt_file_action { NT_FILE_ACTION_ADDED = 0x00000001, NT_FILE_ACTION_REMOVED = 0x00000002, NT_FILE_ACTION_MODIFIED = 0x00000003, NT_FILE_ACTION_RENAMED_OLD_NAME = 0x00000004, NT_FILE_ACTION_RENAMED_NEW_NAME = 0x00000005, NT_FILE_ACTION_ADDED_STREAM = 0x00000006, NT_FILE_ACTION_REMOVED_STREAM = 0x00000007, NT_FILE_ACTION_MODIFIED_STREAM = 0x00000008, NT_FILE_ACTION_REMOVED_BY_DELETE = 0x00000009, } nt_file_action; typedef enum _nt_file_pipe_flags { NT_FILE_PIPE_BYTE_STREAM_MODE = 0x00000000, NT_FILE_PIPE_MESSAGE_MODE = 0x00000001, NT_FILE_PIPE_QUEUE_OPERATION = 0x00000000, NT_FILE_PIPE_COMPLETE_OPERATION = 0x00000001, NT_FILE_PIPE_BYTE_STREAM_TYPE = 0x00000000, NT_FILE_PIPE_MESSAGE_TYPE = 0x00000001, NT_FILE_PIPE_INBOUND = 0x00000000, NT_FILE_PIPE_OUTBOUND = 0x00000001, NT_FILE_PIPE_FULL_DUPLEX = 0x00000002, NT_FILE_PIPE_DISCONNECTED_STATE = 0x00000001, NT_FILE_PIPE_LISTENING_STATE = 0x00000002, NT_FILE_PIPE_CONNECTED_STATE = 0x00000003, NT_FILE_PIPE_CLOSING_STATE = 0x00000004, NT_FILE_PIPE_CLIENT_END = 0x00000000, NT_FILE_PIPE_SERVER_END = 0x00000001, } nt_file_pipe_flags; typedef enum _nt_io_priority_hint { NT_IO_PRIORITY_VERY_LOW = 0, NT_IO_PRIORITY_LOW = 1, NT_IO_PRIORITY_NORMAL = 2, NT_IO_PRIORITY_HIGH = 3, NT_IO_PRIORITY_CRITICAL = 4, NT_MAX_IO_PRIORITY_TYPES = 5 } nt_io_priority_hint; typedef enum _nt_fs_info_class { NT_FILE_FS_VOLUME_INFORMATION = 1, NT_FILE_FS_LABEL_INFORMATION = 2, NT_FILE_FS_SIZE_INFORMATION = 3, NT_FILE_FS_DEVICE_INFORMATION = 4, NT_FILE_FS_ATTRIBUTE_INFORMATION = 5, NT_FILE_FS_CONTROL_INFORMATION = 6, NT_FILE_FS_FULL_SIZE_INFORMATION = 7, NT_FILE_FS_OBJECT_ID_INFORMATION = 8, NT_FILE_FS_DRIVER_PATH_INFORMATION = 9, NT_FILE_FS_VOLUME_FLAGS_INFORMATION = 10, NT_FILE_FS_SECTOR_SIZE_INFORMATION = 11, } nt_fs_info_class; /* file attributes */ #define NT_FILE_ATTRIBUTE_READONLY 0x00000001 #define NT_FILE_ATTRIBUTE_HIDDEN 0x00000002 #define NT_FILE_ATTRIBUTE_SYSTEM 0x00000004 #define NT_FILE_ATTRIBUTE_DIRECTORY 0x00000010 #define NT_FILE_ATTRIBUTE_ARCHIVE 0x00000020 #define NT_FILE_ATTRIBUTE_DEVICE 0x00000040 #define NT_FILE_ATTRIBUTE_NORMAL 0x00000080 #define NT_FILE_ATTRIBUTE_TEMPORARY 0x00000100 #define NT_FILE_ATTRIBUTE_SPARSE_FILE 0x00000200 #define NT_FILE_ATTRIBUTE_REPARSE_POINT 0x00000400 #define NT_FILE_ATTRIBUTE_COMPRESSED 0x00000800 #define NT_FILE_ATTRIBUTE_OFFLINE 0x00001000 #define NT_FILE_ATTRIBUTE_NOT_CONTENT_INDEXED 0x00002000 #define NT_FILE_ATTRIBUTE_ENCRYPTED 0x00004000 #define NT_FILE_ATTRIBUTE_INTEGRITY_STREAM 0x00008000 #define NT_FILE_ATTRIBUTE_VIRTUAL 0x00010000 #define NT_FILE_ATTRIBUTE_NO_SCRUB_DATA 0x00020000 /* file create options */ #define NT_FILE_ASYNCHRONOUS_IO 0x00000000 #define NT_FILE_DIRECTORY_FILE 0x00000001 #define NT_FILE_WRITE_THROUGH 0x00000002 #define NT_FILE_SEQUENTIAL_ONLY 0x00000004 #define NT_FILE_NO_INTERMEDIATE_BUFFERING 0x00000008 #define NT_FILE_SYNCHRONOUS_IO_ALERT 0x00000010 #define NT_FILE_SYNCHRONOUS_IO_NONALERT 0x00000020 #define NT_FILE_NON_DIRECTORY_FILE 0x00000040 #define NT_FILE_CREATE_TREE_CONNECTION 0x00000080 #define NT_FILE_COMPLETE_IF_OPLOCKED 0x00000100 #define NT_FILE_NO_EA_KNOWLEDGE 0x00000200 #define NT_FILE_OPEN_REMOTE_INSTANCE 0x00000400 #define NT_FILE_RANDOM_ACCESS 0x00000800 #define NT_FILE_DELETE_ON_CLOSE 0x00001000 #define NT_FILE_OPEN_BY_FILE_ID 0x00002000 #define NT_FILE_OPEN_FOR_BACKUP_INTENT 0x00004000 #define NT_FILE_NO_COMPRESSION 0x00008000 #define NT_FILE_SESSION_AWARE 0x00040000 #define NT_FILE_RESERVE_OPFILTER 0x00100000 #define NT_FILE_OPEN_REPARSE_POINT 0x00200000 #define NT_FILE_OPEN_NO_RECALL 0x00400000 #define NT_FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000 /* file share access */ #define NT_FILE_SHARE_READ 0x00000001 #define NT_FILE_SHARE_WRITE 0x00000002 #define NT_FILE_SHARE_DELETE 0x00000004 /* file notify */ #define NT_FILE_NOTIFY_CHANGE_FILE_NAME 0x00000001 #define NT_FILE_NOTIFY_CHANGE_DIR_NAME 0x00000002 #define NT_FILE_NOTIFY_CHANGE_ATTRIBUTES 0x00000004 #define NT_FILE_NOTIFY_CHANGE_SIZE 0x00000008 #define NT_FILE_NOTIFY_CHANGE_LAST_WRITE 0x00000010 #define NT_FILE_NOTIFY_CHANGE_LAST_ACCESS 0x00000020 #define NT_FILE_NOTIFY_CHANGE_CREATION 0x00000040 #define NT_FILE_NOTIFY_CHANGE_EA 0x00000040 #define NT_FILE_NOTIFY_CHANGE_SECURITY 0x00000100 #define NT_FILE_NOTIFY_CHANGE_STREAM_NAME 0x00000100 #define NT_FILE_NOTIFY_CHANGE_STREAM_SIZE 0x00000100 #define NT_FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000100 /* file system flags */ #define NT_FILE_CASE_SENSITIVE_SEARCH 0x00000001 #define NT_FILE_CASE_PRESERVED_NAMES 0x00000002 #define NT_FILE_UNICODE_ON_DISK 0x00000004 #define NT_FILE_PERSISTENT_ACLS 0x00000008 #define NT_FILE_FILE_COMPRESSION 0x00000010 #define NT_FILE_VOLUME_QUOTAS 0x00000020 #define NT_FILE_SUPPORTS_SPARSE_FILES 0x00000040 #define NT_FILE_SUPPORTS_REPARSE_POINTS 0x00000080 #define NT_FILE_SUPPORTS_REMOTE_STORAGE 0x00000100 #define NT_FILE_VOLUME_IS_COMPRESSED 0x00008000 #define NT_FILE_SUPPORTS_OBJECT_IDS 0x00010000 #define NT_FILE_SUPPORTS_ENCRYPTION 0x00020000 #define NT_FILE_NAMED_STREAMS 0x00040000 #define NT_FILE_READ_ONLY_VOLUME 0x00080000 #define NT_FILE_SEQUENTIAL_WRITE_ONCE 0x00100000 #define NT_FILE_SUPPORTS_TRANSACTIONS 0x00200000 #define NT_FILE_SUPPORTS_HARD_LINKS 0x00400000 #define NT_FILE_SUPPORTS_EXTENDED_ATTRIBUTES 0x00800000 #define NT_FILE_SUPPORTS_OPEN_BY_FILE_ID 0x01000000 #define NT_FILE_SUPPORTS_USN_JOURNAL 0x02000000 #define NT_FILE_SUPPORT_INTEGRITY_STREAMS 0x04000000 /* file sector size flags */ #define NT_SSINFO_FLAGS_ALIGNED_DEVICE 0x00000001 #define NT_SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE 0x00000002 #define NT_SSINFO_FLAGS_NO_SEEK_PENALTY 0x00000004 #define NT_SSINFO_FLAGS_TRIM_ENABLED 0x00000008 /* file alignment flags */ #define NT_FILE_BYTE_ALIGNMENT 0x00000000 #define NT_FILE_WORD_ALIGNMENT 0x00000001 #define NT_FILE_LONG_ALIGNMENT 0x00000003 #define NT_FILE_QUAD_ALIGNMENT 0x00000007 #define NT_FILE_OCTA_ALIGNMENT 0x0000000f #define NT_FILE_32_BYTE_ALIGNMENT 0x0000001f #define NT_FILE_64_BYTE_ALIGNMENT 0x0000003f #define NT_FILE_128_BYTE_ALIGNMENT 0x0000007f #define NT_FILE_256_BYTE_ALIGNMENT 0x000000ff #define NT_FILE_512_BYTE_ALIGNMENT 0x000001ff /* file tx info flags */ #define NT_FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_WRITELOCKED 0x00000001 #define NT_FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_TO_TX 0x00000002 #define NT_FILE_ID_GLOBAL_TX_DIR_INFO_FLAG_VISIBLE_OUTSIDE_TX 0x00000004 /* friendly file type bits */ #define NT_FILE_TYPE_UNKNOWN (0x0000u) #define NT_FILE_TYPE_FILE (0x0001u) #define NT_FILE_TYPE_DIRECTORY (0x0002u) #define NT_FILE_TYPE_PIPE (0x0004u) #define NT_FILE_TYPE_SOCKET (0x0008u) #define NT_FILE_TYPE_MAILSLOT (0x0010u) #define NT_FILE_TYPE_CSRSS (0x0020u) #define NT_FILE_TYPE_PTY (0x0040u) #define NT_FILE_TYPE_VFD (0x0080u) /* file access bits */ #define NT_FILE_ANY_ACCESS (0x0000u) #define NT_FILE_READ_ACCESS (0x0001u) #define NT_FILE_READ_DATA (0x0001u) #define NT_FILE_LIST_DIRECTORY (0x0001u) #define NT_FILE_WRITE_ACCESS (0x0002u) #define NT_FILE_WRITE_DATA (0x0002u) #define NT_FILE_ADD_FILE (0x0002u) #define NT_FILE_APPEND_DATA (0x0004u) #define NT_FILE_ADD_SUBDIRECTORY (0x0004u) #define NT_FILE_CREATE_PIPE_INSTANCE (0x0004u) #define NT_FILE_READ_EA (0x0008u) #define NT_FILE_WRITE_EA (0x0010u) #define NT_FILE_EXECUTE (0x0020u) #define NT_FILE_TRAVERSE (0x0020u) #define NT_FILE_DELETE_CHILD (0x0040u) #define NT_FILE_READ_ATTRIBUTES (0x0080u) #define NT_FILE_WRITE_ATTRIBUTES (0x0100u) #define NT_FILE_GENERIC_WRITE NT_FILE_WRITE_ATTRIBUTES \ | NT_FILE_WRITE_DATA \ | NT_FILE_WRITE_EA \ | NT_FILE_APPEND_DATA \ | NT_SEC_READ_CONTROL \ | NT_SEC_SYNCHRONIZE #define NT_FILE_ALL_ACCESS NT_FILE_ANY_ACCESS \ | NT_FILE_READ_ACCESS \ | NT_FILE_WRITE_ACCESS \ | NT_FILE_APPEND_DATA \ | NT_FILE_READ_EA \ | NT_FILE_WRITE_EA \ | NT_FILE_EXECUTE \ | NT_FILE_TRAVERSE \ | NT_FILE_DELETE_CHILD \ | NT_FILE_READ_ATTRIBUTES \ | NT_FILE_WRITE_ATTRIBUTES \ | NT_SEC_SYNCHRONIZE \ | NT_SEC_STANDARD_RIGHTS_ALL /* structures related to nt_fs_info_class */ typedef struct _nt_file_fs_volume_information { nt_large_integer volume_creation_time; uint32_t volume_serial_number; uint32_t volume_label_length; unsigned char supports_objects ; unsigned char reserved; wchar16_t volume_label[]; } nt_file_fs_volume_information, nt_fsvi; typedef struct _nt_file_fs_label_information { uint32_t volume_label_length; wchar16_t volume_label[]; } nt_file_fs_label_information; typedef struct _nt_file_fs_size_information { nt_large_integer total_allocation_units; nt_large_integer available_allocation_units; uint32_t sectors_per_allocation_unit; uint32_t bytes_per_sector; } nt_file_fs_size_information, nt_fssi; typedef struct _nt_file_fs_device_information { nt_device_type device_type; uint32_t characteristics; } nt_file_fs_device_information, nt_fsdi; typedef struct _nt_file_fs_attribute_information { uint32_t file_system_attributes; uint32_t maximum_component_name_length; uint32_t file_system_name_length; wchar16_t file_system_name[]; } nt_file_fs_attribute_information, nt_fsai; typedef struct _nt_file_fs_control_information { nt_large_integer free_space_start_filtering; nt_large_integer free_space_threshold; nt_large_integer free_space_stop_filtering; nt_large_integer default_quota_threshold; nt_large_integer default_quota_limit; uint32_t file_system_control_flags; uint32_t padding; } nt_file_fs_control_information, nt_fsci; typedef struct _nt_file_fs_full_size_information { nt_large_integer total_allocation_units; nt_large_integer caller_available_allocation_units; nt_large_integer actual_available_allocation_units; uint32_t sectors_per_allocation_unit; uint32_t bytes_per_sector; } nt_file_fs_full_size_information, nt_fsfsi; typedef struct _nt_file_fs_object_id_information { nt_uuid volume_object_id; uint32_t volume_object_id_extended_info; } nt_file_fs_object_id_information, nt_fsoii; typedef struct _nt_file_fs_driver_path_information { unsigned char driver_in_path; unsigned char reserved[3]; uint32_t driver_name_length; wchar16_t driver_name[]; } nt_file_fs_driver_path_information, nt_fsdpi; typedef struct _nt_file_fs_sector_size_information { uint32_t logical_bytes_per_sector; uint32_t physical_bytes_per_sector_for_atomicity; uint32_t physical_bytes_per_sector_for_performance; uint32_t effective_physical_bytes_per_sector_for_atomicity; uint32_t flags; uint32_t byte_offset_for_sector_alignment; uint32_t byte_offset_for_partition_alignment; } nt_file_fs_sector_size_information, nt_fsssi; typedef struct _nt_file_fs_persistent_volume_information { uint32_t volume_flags; uint32_t flag_mask; uint32_t version; uint32_t reserved; } nt_file_fs_persistent_volume_information; /* structures related to zw_query_quota_information_file */ typedef struct _nt_file_user_quota_information { uint32_t next_entry_offset; uint32_t sid_length; nt_large_integer change_time; nt_large_integer quota_used; nt_large_integer quota_threshold; nt_large_integer quota_limit; nt_sid sid[]; } nt_file_user_quota_information; typedef struct _nt_file_quota_list_information { uint32_t next_entry_offset; uint32_t sid_length; nt_sid sid[]; } nt_file_quota_list_information; /* structures included in nt_file_all_information */ typedef struct _nt_file_basic_information { nt_large_integer creation_time; nt_large_integer last_access_time; nt_large_integer last_write_time; nt_large_integer change_time; uint32_t file_attr; } nt_file_basic_information, nt_fbi; typedef struct _nt_file_standard_information { nt_large_integer allocation_size; nt_large_integer end_of_file; uint32_t number_of_links; unsigned char delete_pending; unsigned char directory; unsigned char reserved[2]; } nt_file_standard_information, nt_fsi; typedef struct _nt_file_internal_information { nt_large_integer index_number; } nt_file_internal_information, nt_fii; typedef struct _nt_file_ea_information { uint32_t ea_size; } nt_file_ea_information, nt_fei; typedef struct _nt_file_access_information { uint32_t access_flags; } nt_file_access_information, nt_facci; typedef struct _nt_file_position_information { nt_large_integer current_byte_offset; } nt_file_position_information, nt_fpi; typedef struct _nt_file_mode_information { uint32_t mode; } nt_file_mode_information, nt_fmi; typedef struct _nt_file_alignment_information { uint32_t alignment_requirement; } nt_file_alignment_information, nt_falii; typedef struct _nt_file_name_information { uint32_t file_name_length; wchar16_t file_name[]; } nt_file_name_information, nt_fni; typedef struct _nt_file_all_information { nt_file_basic_information basic_info; nt_file_standard_information standard_info; nt_file_internal_information internal_info; nt_file_ea_information ea_info; nt_file_access_information access_info; nt_file_position_information position_info; nt_file_mode_information mode_info; nt_file_alignment_information alignment_info; nt_file_name_information name_info; } nt_file_all_information, nt_fai; /* structures related to nt_file_info_class */ typedef struct _nt_file_directory_information { uint32_t next_entry_offset; uint32_t file_index; nt_large_integer creation_time; nt_large_integer last_access_time; nt_large_integer last_write_time; nt_large_integer change_time; nt_large_integer end_of_file; nt_large_integer allocation_size; uint32_t file_attributes; uint32_t file_name_length; wchar16_t file_name[]; } nt_file_directory_information, nt_fdiri; typedef struct _nt_file_full_dir_information { uint32_t next_entry_offset; uint32_t file_index; nt_large_integer creation_time; nt_large_integer last_access_time; nt_large_integer last_write_time; nt_large_integer change_time; nt_large_integer end_of_file; nt_large_integer allocation_size; uint32_t file_attributes; uint32_t file_name_length; uint32_t ea_size; wchar16_t file_name[]; } nt_file_full_dir_information; typedef struct _nt_file_both_dir_information { uint32_t next_entry_offset; uint32_t file_index; nt_large_integer creation_time; nt_large_integer last_access_time; nt_large_integer last_write_time; nt_large_integer change_time; nt_large_integer end_of_file; nt_large_integer allocation_size; uint32_t file_attributes; uint32_t file_name_length; uint32_t ea_size; char short_name_length; char reserved; wchar16_t short_name[12]; wchar16_t file_name[]; } nt_file_both_dir_information; typedef struct _nt_file_rename_information { unsigned char replace_if_exists; void * root_directory; uint32_t file_name_length; wchar16_t file_name[]; } nt_file_rename_information, nt_frni; typedef struct _nt_file_link_information { unsigned char replace_if_exists; void * root_directory; uint32_t file_name_length; wchar16_t file_name[]; } nt_file_link_information; typedef struct _nt_file_names_information { uint32_t next_entry_offset; uint32_t file_index; uint32_t file_name_length; wchar16_t file_name[]; } nt_file_names_information, nt_fnamesi; typedef struct _nt_file_disposition_information { unsigned char delete_file; } nt_file_disposition_information, nt_fdi; typedef struct _nt_file_full_ea_information { uint32_t next_entry_offset; unsigned char flags; unsigned char ea_name_length; uint16_t ea_value_length; char ea_name[]; } nt_file_full_ea_information; typedef struct _nt_file_allocation_information { nt_large_integer allocation_size; } nt_file_allocation_information; typedef struct _nt_file_end_of_file_information { nt_large_integer end_of_file; } nt_file_end_of_file_information, nt_eof; typedef struct _nt_file_stream_information { uint32_t next_entry_offset; uint32_t stream_name_length; nt_large_integer stream_size; nt_large_integer stream_allocation_size; wchar16_t stream_name[]; } nt_file_stream_information; typedef struct _nt_file_pipe_information { uint32_t read_mode; uint32_t completion_mode; } nt_file_pipe_information; typedef struct _nt_file_pipe_local_information { uint32_t named_pipe_type; uint32_t named_pipe_configuration; uint32_t maximum_instances; uint32_t current_instances; uint32_t inbound_quota; uint32_t read_data_available; uint32_t outbound_quota; uint32_t write_quota_available; uint32_t named_pipe_state; uint32_t named_pipe_end; } nt_file_pipe_local_information; typedef struct _nt_file_pipe_remote_information { nt_large_integer collect_data_time; uint32_t maximum_collection_count; } nt_file_pipe_remote_information; typedef struct _nt_file_mailslot_query_information { uint32_t maximum_message_size; uint32_t mailslot_quota; uint32_t next_message_size; uint32_t messages_available; nt_large_integer read_timeout; } nt_file_mailslot_query_information; typedef struct _nt_file_mailslot_set_information { nt_large_integer * read_timeout; } nt_file_mailslot_set_information; typedef struct _nt_file_compression_information { nt_large_integer CompressedFileSize; uint16_t CompressionFormat; unsigned char CompressionUnitShift; unsigned char ChunkShift; unsigned char ClusterShift; unsigned char Reserved[3]; } nt_file_compression_information; typedef struct _nt_file_object_id_buffer { unsigned char obj_id[16]; unsigned char birth_volume_id[16]; unsigned char birth_object_id[16]; unsigned char domain_id[16]; } nt_file_object_id_buffer; typedef struct _nt_file_object_id_information { int64_t file_reference; unsigned char object_id[16]; union { struct { unsigned char birth_volume_id[16]; unsigned char birth_object_id[16]; unsigned char domain_id[16]; }; unsigned char extended_info[48]; }; } nt_file_object_id_information; typedef struct _nt_file_quota_information { uint32_t next_entry_offset; uint32_t sid_length; nt_large_integer change_time; nt_large_integer quota_used; nt_large_integer quota_threshold; nt_large_integer quota_limit; nt_sid sid; } nt_file_quota_information; typedef struct _nt_file_reparse_point_information { int64_t file_reference; uint32_t tag; } nt_file_reparse_point_information, nt_frpi; typedef struct _nt_file_network_open_information { nt_large_integer creation_time; nt_large_integer last_access_time; nt_large_integer last_write_time; nt_large_integer change_time; nt_large_integer allocation_size; nt_large_integer end_of_file; uint32_t file_attributes; } nt_file_network_open_information; typedef struct _nt_file_attribute_tag_information { uint32_t file_attr; uint32_t reparse_tag; } nt_file_attribute_tag_information, nt_ftagi; typedef struct _nt_file_id_both_dir_information { uint32_t next_entry_offset; uint32_t file_index; nt_large_integer creation_time; nt_large_integer last_access_time; nt_large_integer last_write_time; nt_large_integer change_time; nt_large_integer end_of_file; nt_large_integer allocation_size; uint32_t file_attributes; uint32_t file_name_length; uint32_t ea_size; char short_name_length; char reserved; wchar16_t short_name[12]; wchar16_t pad; nt_large_integer file_id; wchar16_t file_name[]; } nt_file_id_both_dir_information, nt_fsdirent; typedef struct _nt_file_id_full_dir_information { uint32_t next_entry_offset; uint32_t file_index; nt_large_integer creation_time; nt_large_integer last_access_time; nt_large_integer last_write_time; nt_large_integer change_time; nt_large_integer end_of_file; nt_large_integer allocation_size; uint32_t file_attributes; uint32_t file_name_length; uint32_t ea_size; nt_large_integer FileId; wchar16_t file_name[]; } nt_file_id_full_dir_information; typedef struct _nt_file_valid_data_length_information { nt_large_integer valid_data_length; } nt_file_valid_data_length_information; typedef struct _nt_file_io_priority_hint_information { nt_io_priority_hint priority_hint; } nt_file_io_priority_hint_information; typedef struct _nt_file_link_entry_information { uint32_t next_entry_offset; int64_t parent_file_id; uint32_t file_name_length; wchar16_t file_name[]; } nt_file_link_entry_information; typedef struct _nt_file_links_information { uint32_t bytes_needed; uint32_t entries_returned; nt_file_link_entry_information entry; } nt_file_links_information; typedef struct _nt_file_id_global_tx_dir_information { uint32_t next_entry_offset; uint32_t file_index; nt_large_integer creation_time; nt_large_integer last_access_time; nt_large_integer last_write_time; nt_large_integer change_time; nt_large_integer end_of_file; nt_large_integer allocation_size; uint32_t file_attributes; uint32_t file_name_length; nt_large_integer file_id; nt_guid locking_transaction_id; uint32_t tx_info_flags; wchar16_t file_name[]; } nt_file_id_global_tx_dir_information; typedef struct _nt_file_completion_information { void * port; void * key; } nt_file_completion_information; /* file extended attributes */ typedef struct _nt_file_get_ea_information { uint32_t next_entry_offset; unsigned char ea_name_length; char ea_name[]; } nt_file_get_ea_information; /* quota information */ typedef struct _nt_file_get_quota_information { uint32_t next_entry_offset; uint32_t sid_length; nt_sid sid; } nt_file_get_quota_information; /* file change notification */ typedef struct _nt_file_notify_information { uint32_t next_entry_offset; uint32_t action; uint32_t file_name_length; wchar16_t file_name[]; } nt_file_notify_information; /* file segment element */ typedef union _nt_file_segment_element { uint64_t * buffer; uint64_t alignment; } nt_file_segment_element; /* section object pointers */ typedef struct _nt_section_object_pointers { void * data_section_object; void * shared_cache_map; void * image_section_object; } nt_section_object_pointers; /* reparse guid data buffer */ typedef struct _nt_reparse_guid_data_buffer { uint32_t reparse_tag; uint16_t reparse_data_length; uint16_t reserved; nt_guid reparse_guid; unsigned char generic_reparse_buffer[]; } nt_reparse_guid_data_buffer; /* reparse data buffer */ typedef struct _nt_reparse_data_buffer { uint32_t reparse_tag; uint16_t reparse_data_length; uint16_t reserved; union { struct { uint16_t substitute_name_offset; uint16_t substitute_name_length; uint16_t print_name_offset; uint16_t print_name_length; uint32_t flags; } symbolic_link_reparse_buffer; struct { uint16_t substitute_name_offset; uint16_t substitute_name_length; uint16_t print_name_offset; uint16_t print_name_length; } mount_point_reparse_buffer; }; wchar16_t path_buffer[]; } nt_reparse_data_buffer; /* file object */ typedef struct _nt_file_object { int16_t type; int16_t size; nt_device_object * dev_obj; nt_vpb vpb; void * fs_context; void * fs_context_2nd; nt_section_object_pointers * sec_obj_ptr; void * private_cache_map; int32_t final_status; struct _nt_file_object * related_file_obj; unsigned char lock_operation; unsigned char delete_pending; unsigned char read_access; unsigned char write_access; unsigned char delete_access; unsigned char shared_read; unsigned char shared_write; unsigned char shared_delete; uint32_t flags; nt_unicode_string file_name; nt_large_integer current_byte_offset; uint32_t waiters; uint32_t busy; void * last_lock; nt_kevent lock; nt_kevent event; nt_io_completion_context * completion_context; uint32_t irp_list_lock; nt_list_entry irp_list; void * file_obj_ext; } nt_file_object; /* file-related function signatures */ typedef int32_t __stdcall ntapi_zw_create_file( __out void ** hfile, __in uint32_t desired_access, __in nt_object_attributes * obj_attr, __out nt_io_status_block * io_status_block, __in nt_large_integer * allocation_size __optional, __in uint32_t file_attr, __in uint32_t share_access, __in uint32_t create_disposition, __in uint32_t create_options, __in void * ea_buffer __optional, __in uint32_t ea_length); typedef int32_t __stdcall ntapi_zw_open_file( __out void ** hfile, __in uint32_t desired_access, __in nt_object_attributes * obj_attr, __out nt_io_status_block * io_status_block, __in uint32_t share_access, __in uint32_t open_options); typedef int32_t __stdcall ntapi_zw_delete_file( __in nt_object_attributes * obj_attr); typedef int32_t __stdcall ntapi_zw_flush_buffers_file( __in void * hfile, __out nt_io_status_block * io_status_block); typedef int32_t __stdcall ntapi_zw_cancel_io_file( __in void * hfile, __out nt_io_status_block * io_status_block); typedef int32_t __stdcall ntapi_zw_cancel_io_file_ex( __in void * hfile, __in nt_io_status_block * request_iosb __optional, __out nt_io_status_block * cancel_iosb); typedef int32_t __stdcall ntapi_zw_read_file( __in void * hfile, __in void * hevent __optional, __in nt_io_apc_routine * apc_routine __optional, __in void * apc_context __optional, __out nt_iosb volatile * io_status_block, __out void * buffer, __in uint32_t bytes_to_read, __in nt_large_integer * byte_offset __optional, __in uint32_t * key __optional); typedef int32_t __stdcall ntapi_zw_write_file( __in void * hfile, __in void * hevent __optional, __in nt_io_apc_routine * apc_routine __optional, __in void * apc_context __optional, __out nt_iosb volatile * io_status_block, __in void * buffer, __in uint32_t bytes_sent, __in nt_large_integer * byte_offset __optional, __in uint32_t * key __optional); typedef int32_t __stdcall ntapi_zw_read_file_scatter( __in void * hfile, __in void * hevent __optional, __in nt_io_apc_routine * apc_routine __optional, __in void * apc_context __optional, __out nt_iosb volatile * io_status_block, __in nt_file_segment_element * buffer, __in uint32_t bytes_to_read, __in nt_large_integer * byte_offset __optional, __in uint32_t * key __optional); typedef int32_t __stdcall ntapi_zw_write_file_gather( __in void * hfile, __in void * hevent __optional, __in nt_io_apc_routine * apc_routine __optional, __in void * apc_context __optional, __out nt_iosb volatile * io_status_block, __in nt_file_segment_element * buffer, __in uint32_t bytes_to_read, __in nt_large_integer * byte_offset __optional, __in uint32_t * key __optional); typedef int32_t __stdcall ntapi_zw_lock_file( __in void * hfile, __in void * hevent __optional, __in nt_io_apc_routine * apc_routine __optional, __in void * apc_context __optional, __out nt_iosb volatile * io_status_block, __in nt_large_integer * lock_offset, __in nt_large_integer * lock_length, __in uint32_t key, __in unsigned char fail_immediately, __in unsigned char exclusive_lock); typedef int32_t __stdcall ntapi_zw_unlock_file( __in void * hfile, __out nt_io_status_block * io_status_block, __in nt_large_integer * lock_offset, __in nt_large_integer * lock_length, __in uint32_t key); typedef int32_t __stdcall ntapi_zw_device_io_control_file( __in void * hfile, __in void * hevent __optional, __in nt_io_apc_routine * apc_routine __optional, __in void * apc_context __optional, __out nt_iosb volatile * io_status_block, __in uint32_t io_control_code, __in void * input_buffer __optional, __in uint32_t input_buffer_length, __out void * output_buffer __optional, __in uint32_t output_buffer_length); typedef int32_t __stdcall ntapi_zw_fs_control_file( __in void * hfile, __in void * hevent __optional, __in nt_io_apc_routine * apc_routine __optional, __in void * apc_context __optional, __out nt_iosb volatile * io_status_block, __in uint32_t fs_control_code, __in void * input_buffer __optional, __in uint32_t input_buffer_length, __out void * output_buffer __optional, __in uint32_t output_buffer_length); typedef int32_t __stdcall ntapi_zw_notify_change_directory_file( __in void * hfile , __in void * hevent __optional, __in nt_io_apc_routine * apc_routine __optional, __in void * apc_context __optional, __out nt_iosb volatile * io_status_block, __out nt_file_notify_information * buffer, __in uint32_t buffer_length, __in uint32_t notify_filter, __in unsigned char watch_subtree); typedef int32_t __stdcall ntapi_zw_query_ea_file( __in void * hfile , __out nt_io_status_block * io_status_block, __out nt_file_full_ea_information * buffer, __in uint32_t buffer_length, __in unsigned char return_single_entry, __in nt_file_get_ea_information * ea_list __optional, __in uint32_t ea_list_length, __in uint32_t * ea_index __optional, __in unsigned char restart_scan); typedef int32_t __stdcall ntapi_zw_set_ea_file( __in void * hfile , __out nt_io_status_block * io_status_block, __in nt_file_full_ea_information * buffer, __in uint32_t buffer_length); typedef int32_t __stdcall ntapi_zw_create_named_pipe_file( __out void ** hfile, __in uint32_t desired_access, __in nt_object_attributes * obj_attr, __out nt_io_status_block * io_status_block, __in uint32_t share_access, __in uint32_t create_disposition, __in uint32_t create_options, __in uint32_t type_message, __in uint32_t readmode_message, __in uint32_t non_blocking, __in uint32_t max_instances, __in size_t in_buffer_size, __in size_t out_buffer_size, __in nt_large_integer * default_timeout __optional); typedef int32_t __stdcall ntapi_zw_create_mailslot_file( __out void ** hfile, __in uint32_t desired_access, __in nt_object_attributes * obj_attr, __out nt_io_status_block * io_status_block, __in uint32_t create_options, __in uint32_t in_buffer_size, __in uint32_t max_message_size, __in nt_large_integer * read_timeout __optional); typedef int32_t __stdcall ntapi_zw_query_volume_information_file( __in void * hfile , __out nt_io_status_block * io_status_block, __out void * vol_info, __in uint32_t vol_info_length, __in nt_fs_info_class vol_info_class); typedef int32_t __stdcall ntapi_zw_set_volume_information_file( __in void * hfile , __out nt_io_status_block * io_status_block, __in void * vol_info, __in uint32_t vol_info_length, __in nt_fs_info_class vol_info_class); typedef int32_t __stdcall ntapi_zw_query_quota_information_file( __in void * hfile , __out nt_io_status_block * io_status_block, __out nt_file_user_quota_information * buffer, __in uint32_t buffer_length, __in unsigned char returning_single_entry, __in nt_file_quota_list_information * sid_list __optional, __in uint32_t sid_list_length, __in nt_sid * start_sid __optional, __in unsigned char restart_scan); typedef int32_t __stdcall ntapi_zw_set_quota_information_file( __in void * hfile , __out nt_io_status_block * io_status_block, __in nt_file_user_quota_information * buffer, __in uint32_t buffer_length); typedef int32_t __stdcall ntapi_zw_query_attributes_file( __in nt_object_attributes * obj_attr, __out nt_file_basic_information * file_info); typedef int32_t __stdcall ntapi_zw_query_full_attributes_file( __in nt_object_attributes * obj_attr, __out nt_file_network_open_information * file_info); typedef int32_t __stdcall ntapi_zw_query_directory_file( __in void * hfile, __in void * hevent __optional, __in nt_io_apc_routine * apc_routine __optional, __in void * apc_context __optional, __out nt_iosb volatile * io_status_block, __out void * file_info, __in uint32_t file_info_length, __in nt_file_info_class file_info_class, __in unsigned char return_single_entry, __in nt_unicode_string * file_name __optional, __in unsigned char restart_scan); typedef int32_t __stdcall ntapi_zw_query_information_file( __in void * hfile, __out nt_io_status_block * io_status_block, __out void * file_info, __in uint32_t file_info_length, __in nt_file_info_class file_info_class); typedef int32_t __stdcall ntapi_zw_set_information_file( __in void * hfile, __out nt_io_status_block * io_status_block, __in void * file_info, __in uint32_t file_info_length, __in nt_file_info_class file_info_class); /* extension functions */ typedef int32_t __stdcall ntapi_tt_get_file_handle_type( __in void * handle, __out int32_t * type); typedef int32_t __stdcall ntapi_tt_open_logical_parent_directory( __out void ** hparent, __in void * hdir, __out uintptr_t * buffer, __in uint32_t buffer_size, __in uint32_t oattr, __in uint32_t desired_access, __in uint32_t share_access, __in uint32_t open_options, __out int * reserved); typedef int32_t __stdcall ntapi_tt_open_physical_parent_directory( __out void ** hparent, __in void * hdir, __out void * buffer, __in uint32_t buffer_size, __in uint32_t oattr, __in uint32_t desired_access, __in uint32_t share_access, __in uint32_t open_options, __out int * reserved); typedef int32_t __stdcall ntapi_tt_open_volume_by_guid( __out void ** hfile, __in const nt_guid * guid, __in uint32_t desired_access, __in nt_object_attributes * obj_attr, __out nt_io_status_block * io_status_block, __in uint32_t share_access, __in uint32_t open_options); #endif