/********************************************************/ /* ntapi: Native API core library */ /* Copyright (C) 2013--2017 Z. Gilboa */ /* Released under GPLv2 and GPLv3; see COPYING.NTAPI. */ /********************************************************/ #ifndef ___NTAPI_HASH_TABLE_H_ #define ___NTAPI_HASH_TABLE_H_ #include #define __NTAPI_HASH_TABLE \ {0x000f6dee, (150)}, /* CsrPortHandle */ \ {0x00b3a87b, (30)}, /* ZwMapUserPhysicalPages */ \ {0x011c4489, (95)}, /* ZwPulseEvent */ \ {0x02513506, (39)}, /* ZwAreMappedFilesTheSame */ \ {0x034a4430, (63)}, /* RtlCreateProcessParameters */ \ {0x03bb7a3c, (187)}, /* ZwRestoreKey */ \ {0x04e21f45, (75)}, /* ZwCreateToken */ \ {0x04f94dc4, (190)}, /* ZwUnloadKey */ \ {0x06125322, (216)}, /* ZwAccessCheckByTypeResultListAndAuditAlarmByHandle */ \ {0x06b550e3, (146)}, /* ZwWriteRequestData */ \ {0x0708114b, (50)}, /* ZwTestAlert */ \ {0x08087626, (34)}, /* ZwOpenSection */ \ {0x0815d651, (230)}, /* ZwSetInformationDebugObject */ \ {0x08b1918f, (45)}, /* ZwSuspendThread */ \ {0x097e0efd, (154)}, /* ZwOpenFile */ \ {0x0a7a10d0, (88)}, /* ZwOpenTimer */ \ {0x0a83f5d6, (191)}, /* ZwQueryOpenSubKeys */ \ {0x0bd77556, (218)}, /* ZwSetThreadExecutionState */ \ {0x0c5cf449, (168)}, /* ZwQueryEaFile */ \ {0x0d638bd2, (74)}, /* ZwSetInformationJobObject */ \ {0x0e629eed, (102)}, /* ZwQuerySemaphore */ \ {0x11fcbb7c, (23)}, /* ZwReadVirtualMemory */ \ {0x121f1e7e, (225)}, /* ZwCreateDebugObject */ \ {0x124a301e, (16)}, /* ZwSetSystemEnvironmentValue */ \ {0x12ec66eb, (235)}, /* ZwQueryDefaultLocale */ \ {0x1742c5c9, (162)}, /* ZwWriteFileGather */ \ {0x177157e3, (42)}, /* ZwTerminateThread */ \ {0x1af41c1a, (22)}, /* ZwProtectVirtualMemory */ \ {0x1c0197e6, (241)}, /* ZwAllocateUuids */ \ {0x1c7a90a1, (5)}, /* ZwQuerySecurityObject */ \ {0x1cf668c5, (194)}, /* ZwQueryKey */ \ {0x21b850be, (258)}, /* _snprintf */ \ {0x2259fc62, (2)}, /* ZwDuplicateObject */ \ {0x24e09c64, (18)}, /* ZwSystemDebugControl */ \ {0x255bf138, (142)}, /* ZwReplyWaitReplyPort */ \ {0x25684721, (76)}, /* ZwOpenProcessToken */ \ {0x25d91d90, (71)}, /* ZwTerminateJobObject */ \ {0x26e1170e, (193)}, /* ZwSetInformationKey */ \ {0x27dd46c3, (29)}, /* ZwFreeUserPhysicalPages */ \ {0x2812eb3c, (240)}, /* ZwAllocateLocallyUniqueId */ \ {0x28574a3f, (77)}, /* ZwOpenThreadToken */ \ {0x29b5ea3d, (140)}, /* ZwRequestWaitReplyPort */ \ {0x2a6ac6fb, (26)}, /* ZwUnlockVirtualMemory */ \ {0x2aad9aed, (83)}, /* ZwSetInformationToken */ \ {0x2b2356f7, (52)}, /* ZwAlertResumeThread */ \ {0x2c0f001a, (238)}, /* ZwSetDefaultUILanguage */ \ {0x2f22b634, (96)}, /* ZwResetEvent */ \ {0x30309daa, (170)}, /* ZwCreateNamedPipeFile */ \ {0x3064d37b, (68)}, /* RtlQueryProcessDebugInformation */ \ {0x30911e3f, (196)}, /* ZwNotifyChangeKey */ \ {0x32ad44f5, (73)}, /* ZwQueryInformationJobObject */ \ {0x33a33c40, (163)}, /* ZwLockFile */ \ {0x357f8a82, (36)}, /* ZwExtendSection */ \ {0x3753c2c8, (198)}, /* ZwDeleteValueKey */ \ {0x379a6717, (93)}, /* ZwOpenEvent */ \ {0x391b8d79, (157)}, /* ZwCancelIoFile */ \ {0x3928a4cc, (20)}, /* ZwFreeVirtualMemory */ \ {0x39bea937, (89)}, /* ZwCancelTimer */ \ {0x3abffc38, (247)}, /* ZwFlushWriteBuffer */ \ {0x3b1f8d85, (124)}, /* ZwQueryTimerResolution */ \ {0x3cd73491, (226)}, /* ZwDebugActiveProcess */ \ {0x3d4aceeb, (256)}, /* memset */ \ {0x3e1d331d, (44)}, /* ZwSetInformationThread */ \ {0x3f62370b, (204)}, /* ZwPrivilegeCheck */ \ {0x416c4024, (118)}, /* ZwSetLowWaitHighEventPair */ \ {0x43c1745d, (92)}, /* ZwCreateEvent */ \ {0x43d65de2, (239)}, /* ZwQueryInstallUILanguage */ \ {0x45d7086f, (108)}, /* ZwOpenIoCompletion */ \ {0x465977c0, (129)}, /* ZwQueryIntervalProfile */ \ {0x47b3fd39, (8)}, /* ZwOpenDirectoryObject */ \ {0x47dd6896, (171)}, /* ZwCreateMailslotFile */ \ {0x49d62b40, (254)}, /* LdrLoadDll */ \ {0x4a638203, (91)}, /* ZwQueryTimer */ \ {0x4c51093e, (189)}, /* ZwLoadKey2 */ \ {0x4cb0ea34, (206)}, /* ZwPrivilegedServiceAuditAlarm */ \ {0x4cc741f4, (222)}, /* ZwPowerInformation */ \ {0x4d0aa736, (207)}, /* ZwAccessCheck */ \ {0x4d361035, (181)}, /* ZwCreateKey */ \ {0x4de0faef, (10)}, /* ZwCreateSymbolicLinkObject */ \ {0x4e049b9b, (72)}, /* ZwAssignProcessToJobObject */ \ {0x4ed4c833, (0)}, /* ZwQueryObject */ \ {0x4efff89a, (166)}, /* ZwFsControlFile */ \ {0x4fe5a956, (49)}, /* ZwQueueApcThread */ \ {0x50f7777d, (84)}, /* ZwWaitForSingleObject */ \ {0x513877ab, (61)}, /* ZwSetInformationProcess */ \ {0x51d5c98d, (137)}, /* ZwAcceptConnectPort */ \ {0x51ddffce, (250)}, /* ZwDisplayString */ \ {0x51fbe1c4, (165)}, /* ZwDeviceIoControlFile */ \ {0x52334a05, (213)}, /* ZwDeleteObjectAuditAlarm */ \ {0x5288a7cf, (46)}, /* ZwResumeThread */ \ {0x54a89e87, (131)}, /* ZwStopProfile */ \ {0x56ada303, (185)}, /* ZwSaveKey */ \ {0x573e11b1, (231)}, /* ZwQueryDebugFilterState */ \ {0x57dd87c6, (114)}, /* ZwWaitLowEventPair */ \ {0x5879157d, (249)}, /* ZwSetDefaultHardErrorPort */ \ {0x58b766a7, (200)}, /* ZwQueryValueKey */ \ {0x59d0cf7f, (9)}, /* ZwQueryDirectoryObject */ \ {0x5a201018, (180)}, /* ZwSetInformationFile */ \ {0x5b24a650, (155)}, /* ZwDeleteFile */ \ {0x5cc5b0cc, (149)}, /* CsrClientCallServer */ \ {0x5ccb443b, (253)}, /* ZwVdmControl */ \ {0x5d5b0c74, (15)}, /* ZwQuerySystemEnvironmentValue */ \ {0x5dcf9e33, (205)}, /* ZwPrivilegeObjectAuditAlarm */ \ {0x5f3fb511, (164)}, /* ZwUnlockFile */ \ {0x60ebf65f, (120)}, /* ZwQuerySystemTime */ \ {0x63033516, (252)}, /* ZwSetLdtEntries */ \ {0x63cc9e64, (66)}, /* RtlCreateQueryDebugBuffer */ \ {0x64a2ceb5, (56)}, /* ZwCreateProcess */ \ {0x654da6fd, (143)}, /* ZwReplyWaitReceivePort */ \ {0x6570064e, (251)}, /* ZwCreatePagingFile */ \ {0x65b5374b, (14)}, /* ZwSetSystemInformation */ \ {0x6a2d88fc, (126)}, /* ZwYieldExecution */ \ {0x6c1b25c0, (97)}, /* ZwClearEvent */ \ {0x6db16208, (246)}, /* ZwQueryInformationAtom */ \ {0x6e0c0f9d, (65)}, /* RtlNormalizeProcessParams */ \ {0x6f11895e, (217)}, /* ZwIsSystemResumeAutomatic */ \ {0x7160272d, (144)}, /* ZwReplyWaitReceivePortEx */ \ {0x72f83a29, (67)}, /* RtlDestroyQueryDebugBuffer */ \ {0x73349dea, (160)}, /* ZwWriteFile */ \ {0x75e01428, (111)}, /* ZwQueryIoCompletion */ \ {0x75e970e4, (115)}, /* ZwSetLowEventPair */ \ {0x7683000f, (38)}, /* ZwUnmapViewOfSection */ \ {0x76d9a68b, (159)}, /* ZwReadFile */ \ {0x7783f5c4, (98)}, /* ZwQueryEvent */ \ {0x78327b0d, (173)}, /* ZwSetVolumeInformationFile */ \ {0x78a28538, (80)}, /* ZwAdjustPrivilegesToken */ \ {0x7b9f9b64, (182)}, /* ZwOpenKey */ \ {0x7c868d67, (260)}, /* _vsnprintf */ \ {0x7ccd8968, (138)}, /* ZwCompleteConnectPort */ \ {0x7dfb3677, (169)}, /* ZwSetEaFile */ \ {0x7e21039a, (87)}, /* ZwCreateTimer */ \ {0x7e92a7a6, (259)}, /* vsprintf */ \ {0x7ec723c2, (122)}, /* ZwQueryPerformanceCounter */ \ {0x7f99ab33, (145)}, /* ZwReadRequestData */ \ {0x8053fc81, (228)}, /* ZwWaitForDebugEvent */ \ {0x81b18dcd, (21)}, /* ZwQueryVirtualMemory */ \ {0x842e9cbb, (43)}, /* ZwQueryInformationThread */ \ {0x84d52359, (112)}, /* ZwCreateEventPair */ \ {0x84e3898f, (183)}, /* ZwDeleteKey */ \ {0x850106f7, (7)}, /* ZwCreateDirectoryObject */ \ {0x8548dfbd, (106)}, /* ZwQueryMutant */ \ {0x85f069ec, (197)}, /* ZwNotifyChangeMultipleKeys */ \ {0x87763935, (257)}, /* sprintf */ \ {0x87fd0a60, (24)}, /* ZwWriteVirtualMemory */ \ {0x8a1989d8, (136)}, /* ZwListenPort */ \ {0x8afaa2ca, (31)}, /* ZwGetWriteWatch */ \ {0x8b3aacc6, (174)}, /* ZwQueryQuotaInformationFile */ \ {0x8bf01eb2, (135)}, /* ZwSecureConnectPort */ \ {0x8c4a9ca2, (100)}, /* ZwOpenSemaphore */ \ {0x8cb632f5, (17)}, /* ZwShutdownSystem */ \ {0x8d31519d, (58)}, /* ZwOpenProcess */ \ {0x8d5b0647, (53)}, /* ZwRegisterThreadTerminatePort */ \ {0x8df4b3ed, (158)}, /* ZwCancelIoFileEx */ \ {0x8e80b080, (119)}, /* ZwSetHighWaitLowEventPair */ \ {0x8eb2c33b, (121)}, /* ZwSetSystemTime */ \ {0x8fe01ce6, (4)}, /* ZwClose */ \ {0x8ffaebe4, (70)}, /* ZwOpenJobObject */ \ {0x90bf911c, (177)}, /* ZwQueryFullAttributesFile */ \ {0x920b0183, (116)}, /* ZwWaitHighEventPair */ \ {0x9331fae3, (25)}, /* ZwLockVirtualMemory */ \ {0x9384c236, (103)}, /* ZwCreateMutant */ \ {0x93cf5771, (232)}, /* ZwSetDebugFilterState */ \ {0x93e64266, (130)}, /* ZwStartProfile */ \ {0x949f76b6, (19)}, /* ZwAllocateVirtualMemory */ \ {0x956ba548, (11)}, /* ZwOpenSymbolicLinkObject */ \ {0x9636e6ce, (227)}, /* ZwRemoveProcessDebug */ \ {0x963cafbc, (237)}, /* ZwQueryDefaultUILanguage */ \ {0x9731aded, (178)}, /* ZwQueryDirectoryFile */ \ {0x978855cd, (37)}, /* ZwMapViewOfSection */ \ {0x98058c5c, (86)}, /* ZwWaitForMultipleObjects */ \ {0x997388d8, (245)}, /* ZwDeleteAtom */ \ {0x9bf04a73, (172)}, /* ZwQueryVolumeInformationFile */ \ {0x9c805856, (167)}, /* ZwNotifyChangeDirectoryFile */ \ {0x9d9c64db, (186)}, /* ZwSaveMergedKeys */ \ {0x9fb42181, (79)}, /* ZwFilterToken */ \ {0x9fce5072, (57)}, /* ZwCreateUserProcess */ \ {0xa09dea3c, (192)}, /* ZwReplaceKey */ \ {0xa313f9b0, (220)}, /* ZwSetSystemPowerState */ \ {0xa34a43e1, (48)}, /* ZwSetContextThread */ \ {0xa51616fd, (156)}, /* ZwFlushBuffersFile */ \ {0xa589ce00, (234)}, /* ZwContinue */ \ {0xa5b2c609, (117)}, /* ZwSetHighEventPair */ \ {0xa8720028, (153)}, /* ZwCreateFile */ \ {0xa93301f4, (110)}, /* ZwRemoveIoCompletion */ \ {0xa9e5e651, (199)}, /* ZwSetValueKey */ \ {0xabc87b74, (32)}, /* ZwResetWriteWatch */ \ {0xac5765bd, (211)}, /* ZwOpenObjectAuditAlarm */ \ {0xac77c9d4, (47)}, /* ZwGetContextThread */ \ {0xaccf3eee, (214)}, /* ZwAccessCheckByTypeAndAuditAlarm */ \ {0xacdddfe2, (176)}, /* ZwQueryAttributesFile */ \ {0xafe64c80, (179)}, /* ZwQueryInformationFile */ \ {0xb28fcd19, (1)}, /* ZwSetInformationObject */ \ {0xb2adc219, (209)}, /* ZwAccessCheckByType */ \ {0xb32b8a16, (41)}, /* ZwOpenThread */ \ {0xb39f2b58, (128)}, /* ZwSetIntervalProfile */ \ {0xb3a5ef4c, (64)}, /* RtlDestroyProcessParameters */ \ {0xb3d90f63, (60)}, /* ZwQueryInformationProcess */ \ {0xb3f8b8ba, (184)}, /* ZwFlushKey */ \ {0xb468e7d0, (233)}, /* ZwRaiseException */ \ {0xb4f463e1, (175)}, /* ZwSetQuotaInformationFile */ \ {0xb5ce95b0, (109)}, /* ZwSetIoCompletion */ \ {0xb677bd15, (219)}, /* ZwGetDevicePowerState */ \ {0xb891d19c, (141)}, /* ZwReplyPort */ \ {0xba08cfed, (221)}, /* ZwInitiatePowerAction */ \ {0xba5bdfc3, (242)}, /* ZwSetUuidSeed */ \ {0xba812651, (229)}, /* ZwDebugContinue */ \ {0xbc310050, (133)}, /* ZwCreateWaitablePort */ \ {0xbde7d8d1, (151)}, /* ZwLoadDriver */ \ {0xbe9990b9, (134)}, /* ZwConnectPort */ \ {0xc0040fd0, (90)}, /* ZwSetTimer */ \ {0xc00fc05c, (248)}, /* ZwRaiseHardError */ \ {0xc4bd0fda, (99)}, /* ZwCreateSemaphore */ \ {0xc524def2, (148)}, /* ZwImpersonateClientOfPort */ \ {0xc6a277e0, (244)}, /* ZwFindAtom */ \ {0xc6de9ce3, (139)}, /* ZwRequestPort */ \ {0xc707f028, (27)}, /* ZwFlushVirtualMemory */ \ {0xc70d789c, (69)}, /* ZwCreateJobObject */ \ {0xc71b989a, (78)}, /* ZwDuplicateToken */ \ {0xc7835b75, (195)}, /* ZwEnumerateKey */ \ {0xc7d8afa4, (85)}, /* ZwSignalAndWaitForSingleObject */ \ {0xc94ea8a6, (81)}, /* ZwAdjustGroupsToken */ \ {0xc9f42a5d, (243)}, /* ZwAddAtom */ \ {0xca250552, (210)}, /* ZwAccessCheckByTypeResultList */ \ {0xcaf1f803, (152)}, /* ZwUnloadDriver */ \ {0xcb3c8251, (223)}, /* ZwPlugPlayControl */ \ {0xcc22b021, (113)}, /* ZwOpenEventPair */ \ {0xcdb98ed4, (59)}, /* ZwTerminateProcess */ \ {0xced9d11d, (123)}, /* ZwSetTimerResolution */ \ {0xd4191071, (127)}, /* ZwCreateProfile */ \ {0xd48a2bbc, (40)}, /* ZwCreateThread */ \ {0xd517401d, (54)}, /* ZwImpersonateThread */ \ {0xd5a16cee, (51)}, /* ZwAlertThread */ \ {0xd628c8f6, (236)}, /* ZwSetDefaultLocale */ \ {0xd7fef93d, (201)}, /* ZwEnumerateValueKey */ \ {0xda57df71, (255)}, /* LdrUnloadDll */ \ {0xdaa7575e, (215)}, /* ZwAccessCheckByTypeResultListAndAuditAlarm */ \ {0xde07d08f, (224)}, /* ZwGetPlugPlayEvent */ \ {0xde5468ed, (202)}, /* ZwQueryMultipleValueKey */ \ {0xdf8698ed, (13)}, /* ZwQuerySystemInformation */ \ {0xdf86b31f, (6)}, /* ZwSetSecurityObject */ \ {0xe0c1d02e, (55)}, /* ZwImpersonateAnonymousToken */ \ {0xe1562f17, (3)}, /* ZwMakeTemporaryObject */ \ {0xe19be90e, (33)}, /* ZwCreateSection */ \ {0xe23ef886, (161)}, /* ZwReadFileScatter */ \ {0xe2ff4b82, (188)}, /* ZwLoadKey */ \ {0xe3521fd4, (101)}, /* ZwReleaseSemaphore */ \ {0xe3624a9b, (212)}, /* ZwCloseObjectAuditAlarm */ \ {0xe3ae76c7, (132)}, /* ZwCreatePort */ \ {0xe43a3a6f, (147)}, /* ZwQueryInformationPort */ \ {0xe624ac47, (12)}, /* ZwQuerySymbolicLinkObject */ \ {0xe6a6cc2d, (208)}, /* ZwAccessCheckAndAuditAlarm */ \ {0xe8d1aec4, (105)}, /* ZwReleaseMutant */ \ {0xeb69e74d, (62)}, /* ZwFlushInstructionCache */ \ {0xed4a67c1, (28)}, /* ZwAllocateUserPhysicalPages */ \ {0xed5deedd, (107)}, /* ZwCreateIoCompletion */ \ {0xedac7230, (203)}, /* ZwInitializeRegistry */ \ {0xee535edc, (35)}, /* ZwQuerySection */ \ {0xee5cdc2d, (82)}, /* ZwQueryInformationToken */ \ {0xf3d1faa7, (125)}, /* ZwDelayExecution */ \ {0xf425639c, (104)}, /* ZwOpenMutant */ \ {0xfde47817, (94)}, /* ZwSetEvent */ \ #define __NT_IMPORTED_SYMBOLS_ARRAY_SIZE 261 #endif